diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000000..e8036160ea
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,4 @@
+# Always check-out / check-in files with LF line endings.
+* text=auto eol=lf
+
+**/zz_generated.*.go linguist-generated=true
diff --git a/cmd/ateapi/internal/controlapi/actor.go b/cmd/ateapi/internal/controlapi/actor.go
index fd18e3ba88..69bb7c1b31 100644
--- a/cmd/ateapi/internal/controlapi/actor.go
+++ b/cmd/ateapi/internal/controlapi/actor.go
@@ -26,32 +26,47 @@ import (
 	"github.com/agent-substrate/substrate/internal/resources"
 	atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
 	"github.com/agent-substrate/substrate/pkg/proto/ateapipb"
+	"github.com/google/uuid"
 	"go.opentelemetry.io/otel/attribute"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/timestamppb"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/operation"
 	"k8s.io/apimachinery/pkg/api/validate/content"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 )
 
 func (s *Service) CreateActor(ctx context.Context, req *ateapipb.CreateActorRequest) (created *ateapipb.Actor, err error) {
-	if errs := validateCreateActorRequest(req); len(errs) > 0 {
+	// First scrub any fields that users are not allowed to set.
+	inActor := req.Actor
+	if inActor != nil { // otherwise validation will flag it
+		scrubActor(inActor)
+	}
+
+	// Validate the request, including the object within it.
+	if errs := validateCreateActorRequest(ctx, req); len(errs) > 0 {
 		return nil, toGRPCStatusError(errs)
 	}
+
+	//
+	// Handle the request
+	//
+
 	start := time.Now()
-	in := req.GetActor()
 	// Recorded only after validation, so every operation uniformly measures a
 	// validated request; malformed ones stay visible in rpc.server.call.duration.
 	defer func() {
 		s.instruments.recordLifecycleOp(ctx, ateattr.OperationCreate, start, err,
-			ateattr.TemplateNameKey.String(in.GetActorTemplateName()),
-			ateattr.TemplateNamespaceKey.String(in.GetActorTemplateNamespace()),
+			ateattr.TemplateNameKey.String(inActor.GetActorTemplateName()),
+			ateattr.TemplateNamespaceKey.String(inActor.GetActorTemplateNamespace()),
 		)
 	}()
-	templateNamespace := in.GetActorTemplateNamespace()
-	templateName := in.GetActorTemplateName()
+	templateNamespace := inActor.GetActorTemplateNamespace()
+	templateName := inActor.GetActorTemplateName()
 
-	setSpanActorRefAttributes(ctx, resources.ActorRefFromActor(in))
+	setSpanActorRefAttributes(ctx, resources.ActorRefFromActor(inActor))
 
 	template, err := s.actorTemplateLister.ActorTemplates(templateNamespace).Get(templateName)
 	if err != nil {
@@ -62,15 +77,15 @@ func (s *Service) CreateActor(ctx context.Context, req *ateapipb.CreateActorRequ
 	}
 
 	var sourceSnapshotInfo *ateapipb.ActorSnapshotSource
-	if src := in.GetSourceSnapshot(); src != nil {
-		sourceSnapshotInfo, err = s.resolveSnapshotSource(ctx, in.GetMetadata().GetAtespace(), src, template)
+	if src := inActor.GetSourceSnapshot(); src != nil {
+		sourceSnapshotInfo, err = s.resolveSnapshotSource(ctx, inActor.GetMetadata().GetAtespace(), src, template)
 		if err != nil {
 			return nil, err
 		}
 	}
 
-	atespace := in.GetMetadata().GetAtespace()
-	name := in.GetMetadata().GetName()
+	atespace := inActor.GetMetadata().GetAtespace()
+	name := inActor.GetMetadata().GetName()
 
 	// The atespace must already exist.
 	exists, err := s.persistence.AtespaceExists(ctx, atespace)
@@ -87,20 +102,18 @@ func (s *Service) CreateActor(ctx context.Context, req *ateapipb.CreateActorRequ
 		return nil, err
 	}
 
-	actor := &ateapipb.Actor{
-		Metadata: &ateapipb.ResourceMetadata{
-			Atespace: atespace,
-			Name:     name,
-		},
-		Status:                 ateapipb.Actor_STATUS_SUSPENDED,
-		ActorTemplateNamespace: templateNamespace,
-		ActorTemplateName:      templateName,
-		WorkerSelector:         in.GetWorkerSelector(),
-		ActorVolumes:           initVols,
-		LatestSnapshot:         sourceSnapshotInfo.GetSnapshot(),
-		SourceSnapshot:         sourceSnapshotInfo,
-	}
-	stored, err := s.persistence.CreateActor(ctx, actor)
+	// Verify that the result is properly valid before storing it.
+	outActor := proto.CloneOf(inActor)
+	outActor.Status = ateapipb.Actor_STATUS_SUSPENDED
+	outActor.ActorVolumes = initVols
+	outActor.LatestSnapshot = sourceSnapshotInfo.GetSnapshot()
+	outActor.SourceSnapshot = sourceSnapshotInfo
+	if errs := validateActorUpdate(ctx, outActor, inActor); len(errs) > 0 {
+		return nil, toGRPCInternalError(errs)
+	}
+
+	// Save the data in the storage layer.
+	stored, err := s.persistence.CreateActor(ctx, outActor)
 	if err != nil {
 		if errors.Is(err, store.ErrAlreadyExists) {
 			return nil, status.Errorf(codes.AlreadyExists, "Actor %s already exists", name)
@@ -112,6 +125,40 @@ func (s *Service) CreateActor(ctx context.Context, req *ateapipb.CreateActorRequ
 	return stored, nil
 }
 
+// scrubActor removes any fields from the request that clients are not allowed
+// to set.
+func scrubActor(actor *ateapipb.Actor) {
+	// TODO: find a way to do this automatically - proto tags or codegen or something
+	//FIXME: this is obviously wrong for update
+	scrubResourceMetadata(actor.Metadata)
+	actor.Status = 0
+	actor.WorkerAssignment = nil
+	actor.InProgressSnapshotName = ""
+	actor.LatestSnapshot = nil
+	actor.LocalSnapshotInfo = nil
+	actor.InProgressSnapshotSourceActorVersion = 0
+	actor.ActorVolumes = nil
+	actor.InProgressLocalSnapshotName = ""
+	// FIXME: SourceSnapshot has mixed input/output fields, so we need smarter scrub
+}
+
+// FIXME: put this in a common place for all resources.
+// TODO: find a way to do this automatically - proto tags or codegen or something
+func scrubResourceMetadata(in *ateapipb.ResourceMetadata) {
+	if in == nil {
+		return // validation will flag it
+	}
+	now := timestamppb.Now()
+	*in = ateapipb.ResourceMetadata{
+		Atespace:   in.Atespace,
+		Name:       in.Name,
+		Uid:        uuid.NewString(),
+		Version:    1,
+		CreateTime: now,
+		UpdateTime: now,
+	}
+}
+
 // resolveSnapshotSource resolves a CreateActor request's source snapshot tag
 // and checks that its scope and ActorSnapshot are compatible with creating
 // an Actor in actorAtespace from template.
@@ -161,29 +208,20 @@ func (s *Service) resolveSnapshotSource(ctx context.Context, actorAtespace strin
 	}, nil
 }
 
-func validateCreateActorRequest(req *ateapipb.CreateActorRequest) field.ErrorList {
+func validateCreateActorRequest(ctx context.Context, req *ateapipb.CreateActorRequest) field.ErrorList {
 	var fldPath *field.Path
-	var errs field.ErrorList
+
+	// Call the generated validation.
+	op := operation.Operation{Type: operation.Create, Options: map[string]bool{"validateOutput": false}}
+	errs := Validate_CreateActorRequest(ctx, op, nil, req, nil)
 
 	actor := req.GetActor()
 	actorPath := fldPath.Child("actor")
 	if actor == nil {
-		errs = append(errs, field.Required(actorPath, ""))
+		// handled by DV
 		return errs
 	}
 
-	metaPath := actorPath.Child("metadata")
-	if val, p := actor.GetMetadata().GetAtespace(), metaPath.Child("atespace"); val == "" {
-		errs = append(errs, field.Required(p, ""))
-	} else {
-		errs = append(errs, resources.ValidateResourceName(val, p)...)
-	}
-	if val, p := actor.GetMetadata().GetName(), metaPath.Child("name"); val == "" {
-		errs = append(errs, field.Required(p, ""))
-	} else {
-		errs = append(errs, resources.ValidateResourceName(val, p)...)
-	}
-
 	if val, p := actor.GetActorTemplateNamespace(), actorPath.Child("actor_template_namespace"); val == "" {
 		errs = append(errs, field.Required(p, ""))
 	} else {
@@ -468,6 +506,16 @@ func validateSuspendActorRequest(req *ateapipb.SuspendActorRequest) field.ErrorL
 	return errs
 }
 
+func validateActorUpdate(ctx context.Context, newVal, oldVal *ateapipb.Actor) field.ErrorList {
+	var fldPath *field.Path
+
+	// Call the generated validation.
+	op := operation.Operation{Type: operation.Update, Options: map[string]bool{"validateOutput": true}}
+	errs := Validate_Actor(ctx, op, fldPath, newVal, oldVal)
+
+	return errs
+}
+
 func validateSelector(sel *ateapipb.Selector, fldPath *field.Path) field.ErrorList {
 	var errs field.ErrorList
 
diff --git a/cmd/ateapi/internal/controlapi/actor_test.go b/cmd/ateapi/internal/controlapi/actor_test.go
index c04c86953c..f2c73eac83 100644
--- a/cmd/ateapi/internal/controlapi/actor_test.go
+++ b/cmd/ateapi/internal/controlapi/actor_test.go
@@ -98,6 +98,10 @@ func TestValidateCreateActorRequest(t *testing.T) {
 		"missing actor",
 		&ateapipb.CreateActorRequest{},
 		field.ErrorList{field.Required(field.NewPath("actor"), "")},
+	}, {
+		"missing actor.metadata",
+		validActor(func(a *ateapipb.Actor) { a.Metadata = nil }),
+		field.ErrorList{field.Required(field.NewPath("actor", "metadata"), "")},
 	}, {
 		"missing actor.metadata.atespace",
 		validActor(func(a *ateapipb.Actor) { a.Metadata.Atespace = "" }),
@@ -105,7 +109,7 @@ func TestValidateCreateActorRequest(t *testing.T) {
 	}, {
 		"invalid actor.metadata.atespace",
 		validActor(func(a *ateapipb.Actor) { a.Metadata.Atespace = "NS1" }),
-		field.ErrorList{field.Invalid(field.NewPath("actor", "metadata", "atespace"), "NS1", "")},
+		field.ErrorList{field.Invalid(field.NewPath("actor", "metadata", "atespace"), nil, "").WithOrigin("format=k8s-short-name")},
 	}, {
 		"missing actor.metadata.name",
 		validActor(func(a *ateapipb.Actor) { a.Metadata.Name = "" }),
@@ -113,7 +117,7 @@ func TestValidateCreateActorRequest(t *testing.T) {
 	}, {
 		"invalid actor.metadata.name",
 		validActor(func(a *ateapipb.Actor) { a.Metadata.Name = "ID1" }),
-		field.ErrorList{field.Invalid(field.NewPath("actor", "metadata", "name"), "ID1", "")},
+		field.ErrorList{field.Invalid(field.NewPath("actor", "metadata", "name"), nil, "").WithOrigin("format=k8s-short-name")},
 	}, {
 		"missing actor_template_namespace",
 		validActor(func(a *ateapipb.Actor) { a.ActorTemplateNamespace = "" }),
@@ -121,7 +125,7 @@ func TestValidateCreateActorRequest(t *testing.T) {
 	}, {
 		"invalid actor_template_namespace",
 		validActor(func(a *ateapipb.Actor) { a.ActorTemplateNamespace = "invalid value" }),
-		field.ErrorList{field.Invalid(field.NewPath("actor", "actor_template_namespace"), "invalid value", "")},
+		field.ErrorList{field.Invalid(field.NewPath("actor", "actor_template_namespace"), nil, "")},
 	}, {
 		"missing actor_template_name",
 		validActor(func(a *ateapipb.Actor) { a.ActorTemplateName = "" }),
@@ -129,7 +133,23 @@ func TestValidateCreateActorRequest(t *testing.T) {
 	}, {
 		"invalid actor_template_name",
 		validActor(func(a *ateapipb.Actor) { a.ActorTemplateName = "invalid value" }),
-		field.ErrorList{field.Invalid(field.NewPath("actor", "actor_template_name"), "invalid value", "")},
+		field.ErrorList{field.Invalid(field.NewPath("actor", "actor_template_name"), nil, "")},
+	}, {
+		"unspecified actor.status",
+		validActor(func(a *ateapipb.Actor) { a.Status = 0 }),
+		nil,
+	}, {
+		"negative actor.status",
+		validActor(func(a *ateapipb.Actor) { a.Status = -1 }),
+		field.ErrorList{field.Forbidden(field.NewPath("actor", "status"), "")},
+	}, {
+		"valid actor.status",
+		validActor(func(a *ateapipb.Actor) { a.Status = ateapipb.Actor_STATUS_RUNNING }),
+		field.ErrorList{field.Forbidden(field.NewPath("actor", "status"), "")},
+	}, {
+		"invalid actor.status",
+		validActor(func(a *ateapipb.Actor) { a.Status = 1234567890 }),
+		field.ErrorList{field.Forbidden(field.NewPath("actor", "status"), "")},
 	}, {
 		"worker_selector with nil match_labels",
 		validActor(func(a *ateapipb.Actor) { a.WorkerSelector = &ateapipb.Selector{} }),
@@ -167,7 +187,7 @@ func TestValidateCreateActorRequest(t *testing.T) {
 	}}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			assertValidateErr(t, validateCreateActorRequest(tt.req), tt.want)
+			assertValidateErr(t, validateCreateActorRequest(context.Background(), tt.req), tt.want)
 		})
 	}
 }
diff --git a/internal/proto/ateompb/gen.go b/cmd/ateapi/internal/controlapi/doc.go
similarity index 63%
rename from internal/proto/ateompb/gen.go
rename to cmd/ateapi/internal/controlapi/doc.go
index 97a9a566e3..98ca7cd808 100644
--- a/internal/proto/ateompb/gen.go
+++ b/cmd/ateapi/internal/controlapi/doc.go
@@ -12,6 +12,12 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateompb
+// Kubernetes codegen tools required this to be in doc.go, no other name will
+// work.
 
-//go:generate bash -c "../../../hack/protoc.sh --plugin=protoc-gen-go=$(bash ../../../hack/run-tool.sh --print-bin-path protoc-gen-go) --plugin=protoc-gen-go-grpc=$(bash ../../../hack/run-tool.sh --print-bin-path protoc-gen-go-grpc) --go_out=paths=source_relative:. --go-grpc_out=paths=source_relative:. ateom.proto"
+// +k8s:validation-gen=TypesWithSuffix=Request
+// +k8s:validation-gen-input=github.com/agent-substrate/substrate/pkg/proto/ateapipb
+// +k8s:validation-gen-scheme-registry=nil
+// +k8s:validation-gen-deep-equal-func=protoDeepEqual
+
+package controlapi
diff --git a/cmd/ateapi/internal/controlapi/functional_test.go b/cmd/ateapi/internal/controlapi/functional_test.go
index 0087b0da1d..52a3bca6a3 100644
--- a/cmd/ateapi/internal/controlapi/functional_test.go
+++ b/cmd/ateapi/internal/controlapi/functional_test.go
@@ -828,12 +828,8 @@ func TestCreateActor_Success(t *testing.T) {
 
 	createResp, err := tc.client.CreateActor(context.Background(), &ateapipb.CreateActorRequest{Actor: &ateapipb.Actor{
 		Metadata: &ateapipb.ResourceMetadata{
-			Atespace:   testAtespace,
-			Name:       "id1",
-			Uid:        "caller-supplied-uid",
-			Version:    999,
-			CreateTime: timestamppb.New(time.Unix(1, 0)),
-			UpdateTime: timestamppb.New(time.Unix(1, 0)),
+			Atespace: testAtespace,
+			Name:     "id1",
 		},
 		ActorTemplateNamespace: ns,
 		ActorTemplateName:      "tmpl1",
@@ -3494,7 +3490,7 @@ func TestDeleteAtespace_NotFound(t *testing.T) {
 
 func assertValidateErr(t *testing.T, got field.ErrorList, want field.ErrorList) {
 	t.Helper()
-	field.ErrorMatcher{}.ByType().ByField().ByValue().Test(t, want, got)
+	field.ErrorMatcher{}.ByType().ByField().ByOrigin().Test(t, want, got)
 }
 
 // TestSuspendActor_FromPaused suspends a PAUSED actor end-to-end: instead of
diff --git a/cmd/ateapi/internal/controlapi/validate.go b/cmd/ateapi/internal/controlapi/validate.go
index 3aea4a88ad..3fbafb85e2 100644
--- a/cmd/ateapi/internal/controlapi/validate.go
+++ b/cmd/ateapi/internal/controlapi/validate.go
@@ -17,9 +17,26 @@ package controlapi
 import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 )
 
 func toGRPCStatusError(errs field.ErrorList) error {
 	return status.Error(codes.InvalidArgument, errs.ToAggregate().Error())
 }
+
+func toGRPCInternalError(errs field.ErrorList) error {
+	return status.Error(codes.Internal, errs.ToAggregate().Error())
+}
+
+func protoDeepEqual[T any](a, b T) bool {
+	pa, ok := any(a).(proto.Message)
+	if !ok {
+		panic("protoDeepEqual: a is not a proto.Message")
+	}
+	pb, ok := any(b).(proto.Message)
+	if !ok {
+		panic("protoDeepEqual: b is not a proto.Message")
+	}
+	return proto.Equal(pa, pb)
+}
diff --git a/cmd/ateapi/internal/controlapi/validation_test.go b/cmd/ateapi/internal/controlapi/validation_test.go
new file mode 100644
index 0000000000..33f083fbf5
--- /dev/null
+++ b/cmd/ateapi/internal/controlapi/validation_test.go
@@ -0,0 +1,473 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package controlapi
+
+import (
+	"context"
+	"math"
+	"strings"
+	"testing"
+
+	"github.com/agent-substrate/substrate/pkg/proto/ateapipb"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/timestamppb"
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func validResourceMetadata(mutate ...func(*ateapipb.ResourceMetadata)) *ateapipb.ResourceMetadata {
+	// This is valid with as many fields populated as possible.
+	rm := &ateapipb.ResourceMetadata{
+		Atespace:   "as",
+		Name:       "nm",
+		Uid:        "01234567-89ab-cdef-0123-456789abcdef",
+		Version:    93,
+		CreateTime: &timestamppb.Timestamp{Seconds: 867},
+		UpdateTime: &timestamppb.Timestamp{Seconds: 5309},
+	}
+	for _, m := range mutate {
+		m(rm)
+	}
+	return rm
+}
+
+func TestValidateResourceMetadataCreate(t *testing.T) {
+	valid := validResourceMetadata
+
+	// Focus this test on fields other than atespace and name.
+	tests := []struct {
+		name         string
+		obj          *ateapipb.ResourceMetadata
+		want         field.ErrorList
+		wantOnInput  field.ErrorList // validateOutput = false
+		wantOnOutput field.ErrorList // validateOutput = true
+	}{{
+		name: "valid",
+		obj:  valid(),
+	}, {
+		name: "valid atespace: empty",
+		obj:  valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "" }),
+	}, {
+		name: "missing name",
+		obj:  valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "" }),
+		want: field.ErrorList{field.Required(field.NewPath("name"), "")},
+	}, {
+		name:         "unspecified uid",
+		obj:          valid(func(rm *ateapipb.ResourceMetadata) { rm.Uid = "" }),
+		wantOnInput:  nil,
+		wantOnOutput: field.ErrorList{field.Required(field.NewPath("uid"), "")},
+	}, {
+		name: "invalid uid: close but not valid",
+		obj:  valid(func(rm *ateapipb.ResourceMetadata) { rm.Uid = "aaaaaaaa-bbbbcccc-dddd-eeeeeeeeeeee" }),
+		want: field.ErrorList{field.Invalid(field.NewPath("uid"), nil, "").WithOrigin("format=k8s-uuid")},
+	}, {
+		name: "invalid uid: not even close",
+		obj:  valid(func(rm *ateapipb.ResourceMetadata) { rm.Uid = "not a uid" }),
+		want: field.ErrorList{field.Invalid(field.NewPath("uid"), nil, "").WithOrigin("format=k8s-uuid")},
+	}, {
+		name:         "unspecified version",
+		obj:          valid(func(rm *ateapipb.ResourceMetadata) { rm.Version = 0 }),
+		wantOnInput:  nil,
+		wantOnOutput: field.ErrorList{field.Required(field.NewPath("version"), "")},
+	}, {
+		name: "valid version: large",
+		obj:  valid(func(rm *ateapipb.ResourceMetadata) { rm.Version = math.MaxInt64 }),
+	}, {
+		name: "invalid version: negative",
+		obj:  valid(func(rm *ateapipb.ResourceMetadata) { rm.Version = -1 }),
+		want: field.ErrorList{field.Invalid(field.NewPath("version"), nil, "").WithOrigin("minimum")},
+	}, {
+		name:         "unspecified createTime",
+		obj:          valid(func(rm *ateapipb.ResourceMetadata) { rm.CreateTime = nil }),
+		wantOnInput:  nil,
+		wantOnOutput: field.ErrorList{field.Required(field.NewPath("create_time"), "")},
+	}, {
+		name:         "unspecified updateTime",
+		obj:          valid(func(rm *ateapipb.ResourceMetadata) { rm.UpdateTime = nil }),
+		wantOnInput:  nil,
+		wantOnOutput: field.ErrorList{field.Required(field.NewPath("update_time"), "")},
+	}}
+	for _, tt := range tests {
+		t.Run(tt.name+"_validateOutput_false", func(t *testing.T) {
+			obj := proto.CloneOf(tt.obj) // avoid internal mutations
+			want := append(tt.want, tt.wantOnInput...)
+			op := operation.Operation{Type: operation.Create, Options: map[string]bool{"validateOutput": false}}
+			matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+			matcher.Test(t, want, Validate_ResourceMetadata(context.Background(), op, nil, obj, nil))
+		})
+		t.Run(tt.name+"_validateOutput_true", func(t *testing.T) {
+			obj := proto.CloneOf(tt.obj) // avoid internal mutations
+			want := append(tt.want, tt.wantOnOutput...)
+			op := operation.Operation{Type: operation.Create, Options: map[string]bool{"validateOutput": true}}
+			matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+			matcher.Test(t, want, Validate_ResourceMetadata(context.Background(), op, nil, obj, nil))
+		})
+	}
+}
+
+func TestValidateResourceMetadataUpdate(t *testing.T) {
+	valid := validResourceMetadata
+
+	// Focus this test on fields other than atespace and name.
+	tests := []struct {
+		name         string
+		oldObj       *ateapipb.ResourceMetadata // should always be valid
+		newObj       *ateapipb.ResourceMetadata
+		want         field.ErrorList
+		wantOnInput  field.ErrorList // validateOutput = false
+		wantOnOutput field.ErrorList // validateOutput = true
+	}{{
+		name:   "valid",
+		oldObj: valid(),
+		newObj: valid(),
+	}, {
+		name:         "atespace: empty -> non-empty",
+		oldObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "" }),
+		newObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "present" }),
+		wantOnInput:  field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("immutable")},
+		wantOnOutput: field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("immutable")},
+	}, {
+		name:         "atespace: non-empty -> empty",
+		oldObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "present" }),
+		newObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "" }),
+		wantOnInput:  field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("immutable")},
+		wantOnOutput: field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("immutable")},
+	}, {
+		name:         "atespace: changed",
+		oldObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "value-1" }),
+		newObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "value-2" }),
+		wantOnInput:  field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("immutable")},
+		wantOnOutput: field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("immutable")},
+	}, {
+		name:   "name: unset",
+		oldObj: valid(),
+		newObj: valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "" }),
+		wantOnInput: field.ErrorList{
+			field.Required(field.NewPath("name"), ""),
+			field.Invalid(field.NewPath("name"), nil, "").WithOrigin("immutable"),
+		},
+		wantOnOutput: field.ErrorList{
+			field.Required(field.NewPath("name"), ""),
+			field.Invalid(field.NewPath("name"), nil, "").WithOrigin("immutable"),
+		},
+	}, {
+		name:         "name: changed",
+		oldObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "value-1" }),
+		newObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "value-2" }),
+		wantOnInput:  field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("immutable")},
+		wantOnOutput: field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("immutable")},
+	}, {
+		name:        "uid: unset",
+		oldObj:      valid(),
+		newObj:      valid(func(rm *ateapipb.ResourceMetadata) { rm.Uid = "" }),
+		wantOnInput: nil, // optional on input
+		wantOnOutput: field.ErrorList{
+			field.Required(field.NewPath("uid"), ""),
+			field.Invalid(field.NewPath("uid"), nil, "").WithOrigin("immutable"),
+		},
+	}, {
+		name:         "uid: changed to valid",
+		oldObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.Uid = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" }),
+		newObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.Uid = "11111111-2222-3333-4444-555555555555" }),
+		wantOnInput:  nil, // is a precondition on input, so can be different
+		wantOnOutput: field.ErrorList{field.Invalid(field.NewPath("uid"), nil, "").WithOrigin("immutable")},
+	}, {
+		name:         "uid: changed to invalid",
+		oldObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.Uid = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" }),
+		newObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.Uid = "not a uid" }),
+		wantOnInput:  field.ErrorList{field.Invalid(field.NewPath("uid"), nil, "").WithOrigin("format=k8s-uuid")},
+		wantOnOutput: field.ErrorList{field.Invalid(field.NewPath("uid"), nil, "").WithOrigin("immutable")},
+	}, {
+		name:        "version: unset",
+		oldObj:      valid(),
+		newObj:      valid(func(rm *ateapipb.ResourceMetadata) { rm.Version = 0 }),
+		wantOnInput: nil, // optional on input
+		wantOnOutput: field.ErrorList{
+			field.Required(field.NewPath("version"), ""),
+			field.Invalid(field.NewPath("version"), nil, "").WithOrigin("update"),
+		},
+	}, {
+		name:         "version: changed to valid",
+		oldObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.Version = 123 }),
+		newObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.Version = 456 }),
+		wantOnInput:  nil, // is a precondition on input, so can be different
+		wantOnOutput: nil,
+	}, {
+		name:        "version: changed non-monotonically",
+		oldObj:      valid(func(rm *ateapipb.ResourceMetadata) { rm.Version = 456 }),
+		newObj:      valid(func(rm *ateapipb.ResourceMetadata) { rm.Version = 123 }),
+		wantOnInput: nil,
+		wantOnOutput: field.ErrorList{
+			field.Invalid(field.NewPath("version"), nil, "").WithOrigin("monotonic"),
+		},
+	}, {
+		name:   "version: changed to invalid",
+		oldObj: valid(func(rm *ateapipb.ResourceMetadata) { rm.Version = 456 }),
+		newObj: valid(func(rm *ateapipb.ResourceMetadata) { rm.Version = -1 }),
+		wantOnInput: field.ErrorList{
+			field.Invalid(field.NewPath("version"), nil, "").WithOrigin("minimum"),
+		},
+		wantOnOutput: field.ErrorList{
+			field.Invalid(field.NewPath("version"), nil, "").WithOrigin("monotonic"),
+			field.Invalid(field.NewPath("version"), nil, "").WithOrigin("minimum"),
+		},
+	}, {
+		name:        "create_time: unset",
+		oldObj:      valid(),
+		newObj:      valid(func(rm *ateapipb.ResourceMetadata) { rm.CreateTime = nil }),
+		wantOnInput: nil, // ignored on input
+		wantOnOutput: field.ErrorList{
+			field.Required(field.NewPath("create_time"), ""),
+			field.Invalid(field.NewPath("create_time"), nil, "").WithOrigin("immutable"),
+		},
+	}, {
+		name:         "create_time: changed",
+		oldObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.CreateTime.Seconds = 123 }),
+		newObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.CreateTime.Seconds = 456 }),
+		wantOnInput:  nil, // ignored on input
+		wantOnOutput: field.ErrorList{field.Invalid(field.NewPath("create_time"), nil, "").WithOrigin("immutable")},
+	}, {
+		name:        "update_time: unset",
+		oldObj:      valid(),
+		newObj:      valid(func(rm *ateapipb.ResourceMetadata) { rm.UpdateTime = nil }),
+		wantOnInput: nil, // ignored on input
+		wantOnOutput: field.ErrorList{
+			field.Required(field.NewPath("update_time"), ""),
+		},
+	}, {
+		name:         "update_time: changed to valid",
+		oldObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.UpdateTime.Seconds = 123 }),
+		newObj:       valid(func(rm *ateapipb.ResourceMetadata) { rm.UpdateTime.Seconds = 456 }),
+		wantOnInput:  nil, // ignored on input
+		wantOnOutput: nil,
+	}}
+	for _, tt := range tests {
+		t.Run(tt.name+"_validateInput", func(t *testing.T) {
+			oldObj := proto.CloneOf(tt.oldObj) // avoid internal mutations
+			newObj := proto.CloneOf(tt.newObj) // avoid internal mutations
+			want := append(tt.want, tt.wantOnInput...)
+			op := operation.Operation{Type: operation.Update, Options: map[string]bool{"validateOutput": false}}
+			matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+			matcher.Test(t, want, Validate_ResourceMetadata(context.Background(), op, nil, newObj, oldObj))
+		})
+		t.Run(tt.name+"_validateOutput", func(t *testing.T) {
+			oldObj := proto.CloneOf(tt.oldObj) // avoid internal mutations
+			newObj := proto.CloneOf(tt.newObj) // avoid internal mutations
+			want := append(tt.want, tt.wantOnOutput...)
+			op := operation.Operation{Type: operation.Update, Options: map[string]bool{"validateOutput": true}}
+			matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+			matcher.Test(t, want, Validate_ResourceMetadata(context.Background(), op, nil, newObj, oldObj))
+		})
+	}
+}
+
+func TestValidateResourceMetadataNameAndAtespaceFormat(t *testing.T) {
+	valid := validResourceMetadata
+
+	// Focus this test on exhaustive testing of the name and atespace fields.
+	tests := []struct {
+		name string
+		obj  *ateapipb.ResourceMetadata
+		want field.ErrorList
+	}{{
+		"valid",
+		valid(),
+		nil,
+	}, {
+		"valid atespace: alphabetic",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "myatespace" }),
+		nil,
+	}, {
+		"valid atespace: dashes",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "my-ate-space" }),
+		nil,
+	}, {
+		"valid atespace: repeat dashes",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "my---ate---space" }),
+		nil,
+	}, {
+		"valid atespace: alphanumeric",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "my-123-atespace" }),
+		nil,
+	}, {
+		"valid atespace: leading numeric",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "123-atespace" }),
+		nil,
+	}, {
+		"valid atespace: trailing numeric",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "my-123" }),
+		nil,
+	}, {
+		"valid atespace: fully numeric",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "123" }),
+		nil,
+	}, {
+		"valid atespace: long",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = strings.Repeat("x", 63) }),
+		nil,
+	}, {
+		"invalid atespace: uppercase",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "MYATESPACE" }),
+		field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid atespace: leading dash",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "-atespace" }),
+		field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid atespace: trailing dash",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "my-" }),
+		field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid atespace: dots",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "my.atespace" }),
+		field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid atespace: underscores",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "my_atespace" }),
+		field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid atespace: bang",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "my!atespace" }),
+		field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid atespace: at",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "my@atespace" }),
+		field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid atespace: pound",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "my#atespace" }),
+		field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid atespace: dollar",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "my$atespace" }),
+		field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid atespace: percent",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "my%%atespace" }),
+		field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid atespace: caret",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "my^atespace" }),
+		field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid atespace: ampersand",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "my&atespace" }),
+		field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid atespace: star",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = "my*atespace" }),
+		field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid atespace: too long",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Atespace = strings.Repeat("x", 64) }),
+		field.ErrorList{field.Invalid(field.NewPath("atespace"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"valid name: alphabetic",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "myname" }),
+		nil,
+	}, {
+		"valid name: dashes",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "my-na-me" }),
+		nil,
+	}, {
+		"valid name: repeat dashes",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "my---na---me" }),
+		nil,
+	}, {
+		"valid name: alphanumeric",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "my-123-name" }),
+		nil,
+	}, {
+		"invalid name: leading numeric",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "123-name" }),
+		nil,
+	}, {
+		"invalid name: trailing numeric",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "my-123" }),
+		nil,
+	}, {
+		"invalid name: fully numeric",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "123" }),
+		nil,
+	}, {
+		"valid name: long",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = strings.Repeat("x", 63) }),
+		nil,
+	}, {
+		"invalid name: uppercase",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "MYNAME" }),
+		field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid name: leading dash",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "-name" }),
+		field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid name: trailing dash",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "my-" }),
+		field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid name: dots",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "my.name" }),
+		field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid name: underscores",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "my_name" }),
+		field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid name: bang",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "my!name" }),
+		field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid name: at",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "my@name" }),
+		field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid name: pound",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "my#name" }),
+		field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid name: dollar",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "my$name" }),
+		field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid name: percent",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "my%%name" }),
+		field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid name: caret",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "my^name" }),
+		field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid name: ampersand",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "my&name" }),
+		field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid name: star",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = "my*name" }),
+		field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"invalid name: too long",
+		valid(func(rm *ateapipb.ResourceMetadata) { rm.Name = strings.Repeat("x", 64) }),
+		field.ErrorList{field.Invalid(field.NewPath("name"), nil, "").WithOrigin("format=k8s-short-name")},
+	}}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			obj := proto.CloneOf(tt.obj) // avoid internal mutations
+			op := operation.Operation{Type: operation.Create, Options: map[string]bool{"validateOutput": true}}
+			matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+			matcher.Test(t, tt.want, Validate_ResourceMetadata(context.Background(), op, nil, obj, nil))
+		})
+	}
+}
diff --git a/cmd/ateapi/internal/controlapi/zz_generated.validation.go b/cmd/ateapi/internal/controlapi/zz_generated.validation.go
new file mode 100644
index 0000000000..30b5d38556
--- /dev/null
+++ b/cmd/ateapi/internal/controlapi/zz_generated.validation.go
@@ -0,0 +1,418 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package controlapi
+
+import (
+	context "context"
+
+	ateapipb "github.com/agent-substrate/substrate/pkg/proto/ateapipb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Validate_Actor validates an instance of Actor according
+// to declarative validation rules in the API schema.
+func Validate_Actor(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ateapipb.Actor) (errs field.ErrorList) {
+
+	{ // field ateapipb.Actor.Metadata
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ateapipb.ResourceMetadata,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if protoDeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			func() { // cohort = "atespace"
+				earlyReturn := false
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "atespace",
+					func(o *ateapipb.ResourceMetadata) *string { return &o.Atespace }, validate.DirectEqual, validate.RequiredValue).MarkShortCircuit(); len(e) != 0 {
+					errs = append(errs, e...)
+					earlyReturn = true
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "atespace",
+					func(o *ateapipb.ResourceMetadata) *string { return &o.Atespace }, validate.DirectEqual, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+					earlyReturn = true
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "atespace",
+					func(o *ateapipb.ResourceMetadata) *string { return &o.Atespace }, validate.DirectEqual, validate.OptionalValue).MarkShortCircuit(); len(e) != 0 {
+					earlyReturn = true
+				}
+				if earlyReturn {
+					return // do not proceed
+				}
+			}()
+			// call the type's validation function
+			errs = append(errs, Validate_ResourceMetadata(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ateapipb.Actor) *ateapipb.ResourceMetadata {
+				return oldObj.Metadata
+			})
+		errs = append(errs, fn(fldPath.Child("metadata"), obj.Metadata, oldVal, oldObj != nil)...)
+	}
+
+	// field ateapipb.Actor.ActorTemplateNamespace has no validation
+	// field ateapipb.Actor.ActorTemplateName has no validation
+	// field ateapipb.Actor.ActorTemplateVersion has no validation
+
+	{ // field ateapipb.Actor.Status
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ateapipb.Actor_Status,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "validateOutput", false, validate.ForbiddenValue).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "validateOutput", false, validate.OptionalValue).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "validateOutput", true, validate.RequiredValue).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 8); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ateapipb.Actor) *ateapipb.Actor_Status {
+				return &oldObj.Status
+			})
+		errs = append(errs, fn(fldPath.Child("status"), &obj.Status, oldVal, oldObj != nil)...)
+	}
+
+	// field ateapipb.Actor.WorkerAssignment has no validation
+	// field ateapipb.Actor.InProgressSnapshotName has no validation
+	// field ateapipb.Actor.WorkerSelector has no validation
+	// field ateapipb.Actor.LatestSnapshot has no validation
+	// field ateapipb.Actor.LocalSnapshotInfo has no validation
+	// field ateapipb.Actor.InProgressSnapshotSourceActorVersion has no validation
+	// field ateapipb.Actor.ActorVolumes has no validation
+	// field ateapipb.Actor.InProgressLocalSnapshotName has no validation
+	// field ateapipb.Actor.SourceSnapshot has no validation
+	return errs
+}
+
+// Validate_CreateActorRequest validates an instance of CreateActorRequest according
+// to declarative validation rules in the API schema.
+func Validate_CreateActorRequest(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ateapipb.CreateActorRequest) (errs field.ErrorList) {
+
+	{ // field ateapipb.CreateActorRequest.Actor
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ateapipb.Actor,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if protoDeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Actor(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ateapipb.CreateActorRequest) *ateapipb.Actor {
+				return oldObj.Actor
+			})
+		errs = append(errs, fn(fldPath.Child("actor"), obj.Actor, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ResourceMetadata validates an instance of ResourceMetadata according
+// to declarative validation rules in the API schema.
+func Validate_ResourceMetadata(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ateapipb.ResourceMetadata) (errs field.ErrorList) {
+
+	{ // field ateapipb.ResourceMetadata.Atespace
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ShortName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ateapipb.ResourceMetadata) *string {
+				return &oldObj.Atespace
+			})
+		errs = append(errs, fn(fldPath.Child("atespace"), &obj.Atespace, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ateapipb.ResourceMetadata.Name
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ShortName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ateapipb.ResourceMetadata) *string {
+				return &oldObj.Name
+			})
+		errs = append(errs, fn(fldPath.Child("name"), &obj.Name, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ateapipb.ResourceMetadata.Uid
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "validateOutput", false, validate.OptionalValue).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "validateOutput", true, validate.RequiredValue).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "validateOutput", true, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.UUID(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ateapipb.ResourceMetadata) *string {
+				return &oldObj.Uid
+			})
+		errs = append(errs, fn(fldPath.Child("uid"), &obj.Uid, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ateapipb.ResourceMetadata.Version
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "validateOutput", false, validate.OptionalValue).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "validateOutput", true, validate.RequiredValue).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "validateOutput", true,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int64) field.ErrorList {
+					return validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+						func(a int64, b int64) bool { return a == b }, validate.NoUnset)
+				}).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "validateOutput", true, validate.Monotonic).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ateapipb.ResourceMetadata) *int64 {
+				return &oldObj.Version
+			})
+		errs = append(errs, fn(fldPath.Child("version"), &obj.Version, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ateapipb.ResourceMetadata.CreateTime
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *timestamppb.Timestamp,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if protoDeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "validateOutput", false, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "validateOutput", true, validate.RequiredPointer).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "validateOutput", true, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ateapipb.ResourceMetadata) *timestamppb.Timestamp {
+				return oldObj.CreateTime
+			})
+		errs = append(errs, fn(fldPath.Child("create_time"), obj.CreateTime, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ateapipb.ResourceMetadata.UpdateTime
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *timestamppb.Timestamp,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if protoDeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "validateOutput", false, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "validateOutput", true, validate.RequiredPointer).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ateapipb.ResourceMetadata) *timestamppb.Timestamp {
+				return oldObj.UpdateTime
+			})
+		errs = append(errs, fn(fldPath.Child("update_time"), obj.UpdateTime, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/cmd/ateapi/internal/store/atepg/atepg.go b/cmd/ateapi/internal/store/atepg/atepg.go
index ead0b22f8d..73db914f88 100644
--- a/cmd/ateapi/internal/store/atepg/atepg.go
+++ b/cmd/ateapi/internal/store/atepg/atepg.go
@@ -644,10 +644,7 @@ func (p *Persistence) CreateActor(ctx context.Context, actor *ateapipb.Actor) (*
 	atespace := actor.GetMetadata().GetAtespace()
 	name := actor.GetMetadata().GetName()
 
-	dbActor := proto.Clone(actor).(*ateapipb.Actor)
-	dbActor.Metadata = newCreateMetadata(atespace, name)
-
-	protoBytes, err := proto.Marshal(dbActor)
+	protoBytes, err := proto.Marshal(actor)
 	if err != nil {
 		return nil, fmt.Errorf("marshaling actor: %w", err)
 	}
@@ -655,7 +652,7 @@ func (p *Persistence) CreateActor(ctx context.Context, actor *ateapipb.Actor) (*
 	_, err = p.pool.Exec(ctx, `
 		INSERT INTO actors (atespace, name, uid, version, proto)
 		VALUES ($1, $2, $3, $4, $5)`,
-		atespace, name, dbActor.GetMetadata().GetUid(), dbActor.GetMetadata().GetVersion(), protoBytes)
+		atespace, name, actor.GetMetadata().GetUid(), actor.GetMetadata().GetVersion(), protoBytes)
 	if err != nil {
 		if isUniqueViolation(err) {
 			return nil, store.ErrAlreadyExists
@@ -667,7 +664,7 @@ func (p *Persistence) CreateActor(ctx context.Context, actor *ateapipb.Actor) (*
 		}
 		return nil, fmt.Errorf("inserting actor %s/%s: %w", atespace, name, err)
 	}
-	return dbActor, nil
+	return actor, nil
 }
 
 func getActorRow(ctx context.Context, q querier, atespace, name string) (*ateapipb.Actor, error) {
diff --git a/cmd/ateapi/internal/store/ateredis/ateredis.go b/cmd/ateapi/internal/store/ateredis/ateredis.go
index a279627543..b03c6a7f25 100644
--- a/cmd/ateapi/internal/store/ateredis/ateredis.go
+++ b/cmd/ateapi/internal/store/ateredis/ateredis.go
@@ -727,17 +727,12 @@ func (s *Persistence) GetActor(ctx context.Context, actorRef resources.ActorRef)
 func (s *Persistence) CreateActor(ctx context.Context, actor *ateapipb.Actor) (*ateapipb.Actor, error) {
 	dbKey := actorDBKey(resources.ActorRefFromActor(actor))
 
-	// Clone so we don't stomp the caller's copy, then attach fresh server-owned
-	// metadata carrying the caller-specified identity.
-	dbActor := proto.Clone(actor).(*ateapipb.Actor)
-	dbActor.Metadata = newCreateMetadata(actor.GetMetadata().GetAtespace(), actor.GetMetadata().GetName())
-
-	dbActorBytes, err := protojson.Marshal(dbActor)
+	actorBytes, err := protojson.Marshal(actor)
 	if err != nil {
 		return nil, fmt.Errorf("in protojson.Marshal: %w", err)
 	}
 
-	ok, err := s.rdb.SetNX(ctx, dbKey, dbActorBytes, 0).Result()
+	ok, err := s.rdb.SetNX(ctx, dbKey, actorBytes, 0).Result()
 	if err != nil {
 		return nil, fmt.Errorf("while executing redis set: %w", err)
 	}
@@ -745,7 +740,7 @@ func (s *Persistence) CreateActor(ctx context.Context, actor *ateapipb.Actor) (*
 		return nil, store.ErrAlreadyExists
 	}
 
-	return dbActor, nil
+	return actor, nil
 }
 
 func (s *Persistence) CreateActorSnapshot(ctx context.Context, snapshot *ateapipb.ActorSnapshot) (*ateapipb.ActorSnapshot, error) {
diff --git a/go.mod b/go.mod
index cc6d8d97de..0d97629d28 100644
--- a/go.mod
+++ b/go.mod
@@ -57,12 +57,12 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260720211330-0afa2a65878a
 	google.golang.org/grpc v1.83.0
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
-	k8s.io/api v0.36.1
+	k8s.io/api v0.37.0-rc.0
 	k8s.io/apiextensions-apiserver v0.36.1
-	k8s.io/apimachinery v0.36.1
-	k8s.io/client-go v0.36.1
+	k8s.io/apimachinery v0.37.0-rc.0
+	k8s.io/client-go v0.37.0-rc.0
 	k8s.io/metrics v0.36.1
-	k8s.io/utils v0.0.0-20260319190234-28399d86e0b5
+	k8s.io/utils v0.0.0-20260626114624-be93311217bd
 	sigs.k8s.io/controller-runtime v0.24.1
 	sigs.k8s.io/yaml v1.6.0
 )
@@ -121,24 +121,24 @@ require (
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
-	github.com/go-openapi/jsonpointer v0.22.4 // indirect
-	github.com/go-openapi/jsonreference v0.21.4 // indirect
-	github.com/go-openapi/swag v0.25.4 // indirect
-	github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
-	github.com/go-openapi/swag/conv v0.25.4 // indirect
-	github.com/go-openapi/swag/fileutils v0.25.4 // indirect
-	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
-	github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
-	github.com/go-openapi/swag/loading v0.25.4 // indirect
-	github.com/go-openapi/swag/mangling v0.25.4 // indirect
-	github.com/go-openapi/swag/netutils v0.25.4 // indirect
-	github.com/go-openapi/swag/stringutils v0.25.4 // indirect
-	github.com/go-openapi/swag/typeutils v0.25.4 // indirect
-	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
+	github.com/go-openapi/jsonpointer v1.0.0 // indirect
+	github.com/go-openapi/jsonreference v1.0.0 // indirect
+	github.com/go-openapi/swag v0.27.1 // indirect
+	github.com/go-openapi/swag/cmdutils v0.27.1 // indirect
+	github.com/go-openapi/swag/conv v0.27.1 // indirect
+	github.com/go-openapi/swag/fileutils v0.27.1 // indirect
+	github.com/go-openapi/swag/jsonutils v0.27.1 // indirect
+	github.com/go-openapi/swag/loading v0.27.1 // indirect
+	github.com/go-openapi/swag/mangling v0.27.1 // indirect
+	github.com/go-openapi/swag/netutils v0.27.1 // indirect
+	github.com/go-openapi/swag/pools v0.27.1 // indirect
+	github.com/go-openapi/swag/stringutils v0.27.1 // indirect
+	github.com/go-openapi/swag/typeutils v0.27.1 // indirect
+	github.com/go-openapi/swag/yamlutils v0.27.1 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/pprof v0.0.0-20250602020802-c6617b811d0e // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
@@ -216,9 +216,11 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
-	k8s.io/streaming v0.36.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
+	k8s.io/streaming v0.37.0-rc.0 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
 )
+
+replace k8s.io/apimachinery => ./third_party/k8s.io/apimachinery
diff --git a/go.sum b/go.sum
index c29b78a08a..b0426d7a1f 100644
--- a/go.sum
+++ b/go.sum
@@ -157,8 +157,8 @@ github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
-github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
+github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -170,40 +170,40 @@ github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
 github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
-github.com/go-openapi/jsonpointer v0.22.4 h1:dZtK82WlNpVLDW2jlA1YCiVJFVqkED1MegOUy9kR5T4=
-github.com/go-openapi/jsonpointer v0.22.4/go.mod h1:elX9+UgznpFhgBuaMQ7iu4lvvX1nvNsesQ3oxmYTw80=
-github.com/go-openapi/jsonreference v0.21.4 h1:24qaE2y9bx/q3uRK/qN+TDwbok1NhbSmGjjySRCHtC8=
-github.com/go-openapi/jsonreference v0.21.4/go.mod h1:rIENPTjDbLpzQmQWCj5kKj3ZlmEh+EFVbz3RTUh30/4=
-github.com/go-openapi/swag v0.25.4 h1:OyUPUFYDPDBMkqyxOTkqDYFnrhuhi9NR6QVUvIochMU=
-github.com/go-openapi/swag v0.25.4/go.mod h1:zNfJ9WZABGHCFg2RnY0S4IOkAcVTzJ6z2Bi+Q4i6qFQ=
-github.com/go-openapi/swag/cmdutils v0.25.4 h1:8rYhB5n6WawR192/BfUu2iVlxqVR9aRgGJP6WaBoW+4=
-github.com/go-openapi/swag/cmdutils v0.25.4/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0=
-github.com/go-openapi/swag/conv v0.25.4 h1:/Dd7p0LZXczgUcC/Ikm1+YqVzkEeCc9LnOWjfkpkfe4=
-github.com/go-openapi/swag/conv v0.25.4/go.mod h1:3LXfie/lwoAv0NHoEuY1hjoFAYkvlqI/Bn5EQDD3PPU=
-github.com/go-openapi/swag/fileutils v0.25.4 h1:2oI0XNW5y6UWZTC7vAxC8hmsK/tOkWXHJQH4lKjqw+Y=
-github.com/go-openapi/swag/fileutils v0.25.4/go.mod h1:cdOT/PKbwcysVQ9Tpr0q20lQKH7MGhOEb6EwmHOirUk=
-github.com/go-openapi/swag/jsonname v0.25.4 h1:bZH0+MsS03MbnwBXYhuTttMOqk+5KcQ9869Vye1bNHI=
-github.com/go-openapi/swag/jsonname v0.25.4/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag=
-github.com/go-openapi/swag/jsonutils v0.25.4 h1:VSchfbGhD4UTf4vCdR2F4TLBdLwHyUDTd1/q4i+jGZA=
-github.com/go-openapi/swag/jsonutils v0.25.4/go.mod h1:7OYGXpvVFPn4PpaSdPHJBtF0iGnbEaTk8AvBkoWnaAY=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4 h1:IACsSvBhiNJwlDix7wq39SS2Fh7lUOCJRmx/4SN4sVo=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4/go.mod h1:Mt0Ost9l3cUzVv4OEZG+WSeoHwjWLnarzMePNDAOBiM=
-github.com/go-openapi/swag/loading v0.25.4 h1:jN4MvLj0X6yhCDduRsxDDw1aHe+ZWoLjW+9ZQWIKn2s=
-github.com/go-openapi/swag/loading v0.25.4/go.mod h1:rpUM1ZiyEP9+mNLIQUdMiD7dCETXvkkC30z53i+ftTE=
-github.com/go-openapi/swag/mangling v0.25.4 h1:2b9kBJk9JvPgxr36V23FxJLdwBrpijI26Bx5JH4Hp48=
-github.com/go-openapi/swag/mangling v0.25.4/go.mod h1:6dxwu6QyORHpIIApsdZgb6wBk/DPU15MdyYj/ikn0Hg=
-github.com/go-openapi/swag/netutils v0.25.4 h1:Gqe6K71bGRb3ZQLusdI8p/y1KLgV4M/k+/HzVSqT8H0=
-github.com/go-openapi/swag/netutils v0.25.4/go.mod h1:m2W8dtdaoX7oj9rEttLyTeEFFEBvnAx9qHd5nJEBzYg=
-github.com/go-openapi/swag/stringutils v0.25.4 h1:O6dU1Rd8bej4HPA3/CLPciNBBDwZj9HiEpdVsb8B5A8=
-github.com/go-openapi/swag/stringutils v0.25.4/go.mod h1:GTsRvhJW5xM5gkgiFe0fV3PUlFm0dr8vki6/VSRaZK0=
-github.com/go-openapi/swag/typeutils v0.25.4 h1:1/fbZOUN472NTc39zpa+YGHn3jzHWhv42wAJSN91wRw=
-github.com/go-openapi/swag/typeutils v0.25.4/go.mod h1:Ou7g//Wx8tTLS9vG0UmzfCsjZjKhpjxayRKTHXf2pTE=
-github.com/go-openapi/swag/yamlutils v0.25.4 h1:6jdaeSItEUb7ioS9lFoCZ65Cne1/RZtPBZ9A56h92Sw=
-github.com/go-openapi/swag/yamlutils v0.25.4/go.mod h1:MNzq1ulQu+yd8Kl7wPOut/YHAAU/H6hL91fF+E2RFwc=
-github.com/go-openapi/testify/enable/yaml/v2 v2.0.2 h1:0+Y41Pz1NkbTHz8NngxTuAXxEodtNSI1WG1c/m5Akw4=
-github.com/go-openapi/testify/enable/yaml/v2 v2.0.2/go.mod h1:kme83333GCtJQHXQ8UKX3IBZu6z8T5Dvy5+CW3NLUUg=
-github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
-github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
+github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
+github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
+github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY=
+github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0=
+github.com/go-openapi/swag v0.27.1 h1:VotvOLWW8q/EAxB0YdsBBGC8XYyeL1YwBj2ungAGPNg=
+github.com/go-openapi/swag v0.27.1/go.mod h1:GTkJPwHfhJp6MWr4/rCh64HVI3Ofu+tcsbfjfHmTxpE=
+github.com/go-openapi/swag/cmdutils v0.27.1 h1:I7sYqaWVl5mq0NEmNQkAmFDyNin9ufvMX/p2zwtQaOE=
+github.com/go-openapi/swag/cmdutils v0.27.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
+github.com/go-openapi/swag/conv v0.27.1 h1:8wi9ZG+olmY1wXphl93EWniPtbSPkXM/feH7FgjsvrU=
+github.com/go-openapi/swag/conv v0.27.1/go.mod h1:QbqMivkpKhC3g1B1GGGOJ6ANewI3S62dbzYu3Duowqs=
+github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzrb0QkmLKf9oM=
+github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8=
+github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU=
+github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1 h1:mJu3COL9WEaZVp/Kf2PRMi7tPszPEJfSr/OO75ynCs8=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY=
+github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY=
+github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE=
+github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA=
+github.com/go-openapi/swag/mangling v0.27.1/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w=
+github.com/go-openapi/swag/netutils v0.27.1 h1:mICMFoS82F5TZ4Zy3cqmcQk+BFeCp3Uyq3Np7GI0/qU=
+github.com/go-openapi/swag/netutils v0.27.1/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ=
+github.com/go-openapi/swag/pools v0.27.1 h1:9LeadcMyb2GJCbXX5hVQDbZ2Lq9TL4dCs/nx1j5DO0E=
+github.com/go-openapi/swag/pools v0.27.1/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE=
+github.com/go-openapi/swag/stringutils v0.27.1 h1:ZXePZ0r2p1qSjo8tD3Un4vFj8+FqlCkczxDrJIhYUp8=
+github.com/go-openapi/swag/stringutils v0.27.1/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM=
+github.com/go-openapi/swag/typeutils v0.27.1 h1:KSTdFlfnse4r6dP9IrEnwMldjE+zs71UeEB3//PtVXc=
+github.com/go-openapi/swag/typeutils v0.27.1/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ=
+github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA=
+github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo=
+github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
+github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
@@ -504,24 +504,22 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
-k8s.io/api v0.36.1 h1:XbL/EMj8K2aJpJtePmqUyQMsM0D4QI2pvl7YKJ20FTY=
-k8s.io/api v0.36.1/go.mod h1:KOWo4ey3TINlXjeHVuwB3i+tXXnu+UcwFBHlI/9dvEo=
+k8s.io/api v0.37.0-rc.0 h1:CgvGMEmo+Y37oJ7KfUr+ExMDU1isvQwmdgtz8q3ZxTM=
+k8s.io/api v0.37.0-rc.0/go.mod h1:T5puuXyM+NMzZo8BRm9d+AW9siY2BqHiw8duWKswpiQ=
 k8s.io/apiextensions-apiserver v0.36.1 h1:6JfYmPUsuUIHuN+3QxutXYWj492RqF5fBSx67GYK5Ks=
 k8s.io/apiextensions-apiserver v0.36.1/go.mod h1:pLzZin90riwisdzKwv/GoTwENooytoIx5zWJb4Hkby8=
-k8s.io/apimachinery v0.36.1 h1:G63Gjx2W+q0YD+72Vo8oY0nDnePVwnuzTmmy5ENrVSA=
-k8s.io/apimachinery v0.36.1/go.mod h1:ibYOR00vW/I1kzvi5SF0dRuJ52BvKtfvRdOn35GPQ+8=
-k8s.io/client-go v0.36.1 h1:FN/K8QIT2CEDt+2WB2HnWrUANZ50AP5GII43/SP2JR0=
-k8s.io/client-go v0.36.1/go.mod h1:s6rAnCtTGYDQnpNjEhSaISV+2O8jwruZ6m3QOYBFbtU=
+k8s.io/client-go v0.37.0-rc.0 h1:ZK5uYpvA/R5F69IKVONNEBAk5Ctkovee6Gw/QODCEZI=
+k8s.io/client-go v0.37.0-rc.0/go.mod h1:z6ybzfQXKJ6qJIIa0lniOiYtL9a6pCMUo8bN+UpU2uA=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
-k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a h1:xCeOEAOoGYl2jnJoHkC3hkbPJgdATINPMAxaynU2Ovg=
-k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
 k8s.io/metrics v0.36.1 h1:MQPb+G4RhrKEpt8NETPssbW8QgGUc4Jbqu1jx+kPqGk=
 k8s.io/metrics v0.36.1/go.mod h1:xqS8XcWLjDzo6E7DJm/GfjKpRKdN5/MtJAQFuV6nLUc=
-k8s.io/streaming v0.36.1 h1:L+K68n4Gg940BGNNYtUBvL1WTLL0YnKT3s+P1MNAmR4=
-k8s.io/streaming v0.36.1/go.mod h1:z6fV3D+NVkoeqRMtWwlUZK6U17SY/LqNzOxWL6GyR/s=
-k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 h1:kBawHLSnx/mYHmRnNUf9d4CpjREbeZuxoSGOX/J+aYM=
-k8s.io/utils v0.0.0-20260319190234-28399d86e0b5/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+k8s.io/streaming v0.37.0-rc.0 h1:zDBjrKCnSLQyznohS8DyT1vmiD1s7XEcj5B9kyfN1WQ=
+k8s.io/streaming v0.37.0-rc.0/go.mod h1:APlJR26ZWRcVy5bIEj0QRrKUXROtBHPcxl2NT7EAzPU=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
 pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
 pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
 sigs.k8s.io/controller-runtime v0.24.1 h1:miPEwrmirImAvgME1L9qebGHrOnGJoVmVdtOU9fRfo4=
@@ -530,7 +528,7 @@ sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5E
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/run-tool.sh b/hack/run-tool.sh
index 8a030425d1..b1f89e4025 100755
--- a/hack/run-tool.sh
+++ b/hack/run-tool.sh
@@ -30,9 +30,9 @@ fi
 TOOL_NAME="$1"
 shift
 
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ROOT="$(git rev-parse --show-toplevel)"
 case "${TOOL_NAME}" in
-  "client-gen"|"informer-gen"|"lister-gen")
+  "client-gen"|"informer-gen"|"lister-gen"|"validation-gen")
     TOOL_DIR="${ROOT}/hack/tools/code-generator"
     ;;
   *)
diff --git a/hack/tools/code-generator/go.mod b/hack/tools/code-generator/go.mod
index f41aa538c9..cff84f9145 100644
--- a/hack/tools/code-generator/go.mod
+++ b/hack/tools/code-generator/go.mod
@@ -3,19 +3,58 @@ module github.com/agent-substrate/substrate/hack/tools/code-generator
 go 1.26.1
 
 require (
-	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/spf13/pflag v1.0.9 // indirect
-	golang.org/x/mod v0.29.0 // indirect
-	golang.org/x/sync v0.18.0 // indirect
-	golang.org/x/text v0.31.0 // indirect
-	golang.org/x/tools v0.38.0 // indirect
-	k8s.io/code-generator v0.35.0 // indirect
-	k8s.io/gengo/v2 v2.0.0-20250922181213-ec3ebc5fd46b // indirect
-	k8s.io/klog/v2 v2.130.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
+	github.com/go-openapi/jsonpointer v1.0.0 // indirect
+	github.com/go-openapi/jsonreference v1.0.0 // indirect
+	github.com/go-openapi/swag v0.28.0 // indirect
+	github.com/go-openapi/swag/cmdutils v0.28.0 // indirect
+	github.com/go-openapi/swag/conv v0.28.0 // indirect
+	github.com/go-openapi/swag/fileutils v0.28.0 // indirect
+	github.com/go-openapi/swag/jsonutils v0.28.0 // indirect
+	github.com/go-openapi/swag/loading v0.28.0 // indirect
+	github.com/go-openapi/swag/mangling v0.28.0 // indirect
+	github.com/go-openapi/swag/netutils v0.28.0 // indirect
+	github.com/go-openapi/swag/pools v0.28.0 // indirect
+	github.com/go-openapi/swag/stringutils v0.28.0 // indirect
+	github.com/go-openapi/swag/typeutils v0.28.0 // indirect
+	github.com/go-openapi/swag/yamlutils v0.28.0 // indirect
+	github.com/google/gnostic-models v0.7.1 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/mod v0.40.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	k8s.io/apimachinery v0.37.0-rc.0 // indirect
+	k8s.io/code-generator v0.37.0-rc.0 // indirect
+	k8s.io/gengo/v2 v2.0.0-20260408192533-25e2208e0dc3 // indirect
+	k8s.io/klog/v2 v2.140.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
+	k8s.io/streaming v0.37.0-rc.0 // indirect
+	k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
 tool (
 	k8s.io/code-generator/cmd/client-gen
 	k8s.io/code-generator/cmd/informer-gen
 	k8s.io/code-generator/cmd/lister-gen
+	k8s.io/code-generator/cmd/validation-gen
 )
+
+replace k8s.io/code-generator => ./third_party/k8s.io/code-generator
+
+replace k8s.io/apimachinery => ./third_party/k8s.io/apimachinery
diff --git a/hack/tools/code-generator/go.sum b/hack/tools/code-generator/go.sum
index 1979b5d1b0..ad13ce3bb2 100644
--- a/hack/tools/code-generator/go.sum
+++ b/hack/tools/code-generator/go.sum
@@ -1,20 +1,114 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
+github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
+github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
+github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
+github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY=
+github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0=
+github.com/go-openapi/swag v0.28.0 h1:xkgbOSKj6DZziNpyqRRAOt3GJGtgjgsd2RoyT30VWuw=
+github.com/go-openapi/swag v0.28.0/go.mod h1:4qYnT3Cqr1p1VknOdPo70evN4rgQnAg6jwApHyxSGIg=
+github.com/go-openapi/swag/cmdutils v0.28.0 h1:7TOeNtkYru1SG8Y34tDh9WBbLsMqGnptuxWiHREPZ4Q=
+github.com/go-openapi/swag/cmdutils v0.28.0/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
+github.com/go-openapi/swag/conv v0.28.0 h1:GtqqbyFe7vR5Y7ehxG9W6/OvrSFdf1OLeTGp40TqxH8=
+github.com/go-openapi/swag/conv v0.28.0/go.mod h1:mbUE+mzctnhxi864m0Q07SpN8OowD9JhxmxuYvZZD/k=
+github.com/go-openapi/swag/fileutils v0.28.0 h1:Z04XWQD7R8Eq+7GnOrjovBxPPmZzsS4gt2H2GPGIViU=
+github.com/go-openapi/swag/fileutils v0.28.0/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8=
+github.com/go-openapi/swag/jsonutils v0.28.0 h1:YIch6FwO7RXzeAnbO8Tu7dWBZeUEH+4nA0HXltVTnv4=
+github.com/go-openapi/swag/jsonutils v0.28.0/go.mod h1:CYM3WlTUcagR2ZoHdz54di/cbBqt82tuxuXgAjxw+mg=
+github.com/go-openapi/swag/loading v0.28.0 h1:td8QZdZC9MIYGGSnSPKShKiK22I2tU5UQvuUhIBPRLU=
+github.com/go-openapi/swag/loading v0.28.0/go.mod h1:rXB0QiQX5mMveXEA7ouM4KiiM9jVJe4K6BVbwhD1M4k=
+github.com/go-openapi/swag/mangling v0.28.0 h1:pH8eyeNO9SLYsTMWJrurnNfKmDa28XrlA+HePVD53VM=
+github.com/go-openapi/swag/mangling v0.28.0/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w=
+github.com/go-openapi/swag/netutils v0.28.0 h1:YXN6TALEi2pzts8/8GNm6T61HTAZsieukGZidap989k=
+github.com/go-openapi/swag/netutils v0.28.0/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ=
+github.com/go-openapi/swag/pools v0.28.0 h1:HPMZWSAfce3rdVTFcjFiCIBtDg9h4x2QlRrHipwhxeU=
+github.com/go-openapi/swag/pools v0.28.0/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE=
+github.com/go-openapi/swag/stringutils v0.28.0 h1:ixsc9iYgDPubHL/8nSkbnryEHpD2VRlBMLKpQyPXcDU=
+github.com/go-openapi/swag/stringutils v0.28.0/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM=
+github.com/go-openapi/swag/typeutils v0.28.0 h1:nRBKSBXjDgf01VDPB3fWeD9nQuhCOVeIYAkUx2tbkyY=
+github.com/go-openapi/swag/typeutils v0.28.0/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ=
+github.com/go-openapi/swag/yamlutils v0.28.0 h1:TV3JXH6DS46KUroDtMLAYHGkdWf5VDq3wVWFirmzROY=
+github.com/go-openapi/swag/yamlutils v0.28.0/go.mod h1:x0q/yndZHEgk9Rx3DyDqzFUmHy55KTvIZldvF2dTJXs=
+github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
+github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
 golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
 golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
 golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
 golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+k8s.io/apimachinery v0.37.0-rc.0 h1:z92lapcEJUiMb38pzUIp81kEXT6lIWXhs6auvm8+/s4=
+k8s.io/apimachinery v0.37.0-rc.0/go.mod h1:mhq6CPCzI6XJNHSiek+w7Ws9/rP9qL5s+7aBrh5ODSI=
 k8s.io/code-generator v0.35.0 h1:TvrtfKYZTm9oDF2z+veFKSCcgZE3Igv0svY+ehCmjHQ=
 k8s.io/code-generator v0.35.0/go.mod h1:iS1gvVf3c/T71N5DOGYO+Gt3PdJ6B9LYSvIyQ4FHzgc=
+k8s.io/code-generator v0.37.0-rc.0 h1:d0i65nsz5LS2HUl3CgJcjxFr3IvLBGs82IZth2UuQEk=
+k8s.io/code-generator v0.37.0-rc.0/go.mod h1:gwljmdmKalNet8U3+3tu8dyV0+etqGStU2uXJy+NgD8=
 k8s.io/gengo/v2 v2.0.0-20250922181213-ec3ebc5fd46b h1:gMplByicHV/TJBizHd9aVEsTYoJBnnUAT5MHlTkbjhQ=
 k8s.io/gengo/v2 v2.0.0-20250922181213-ec3ebc5fd46b/go.mod h1:CgujABENc3KuTrcsdpGmrrASjtQsWCT7R99mEV4U/fM=
+k8s.io/gengo/v2 v2.0.0-20260408192533-25e2208e0dc3 h1:3L6PNkMLXkU/pz3jWzaaIUz0Rs2V9h+5O51AeRC7poc=
+k8s.io/gengo/v2 v2.0.0-20260408192533-25e2208e0dc3/go.mod h1:yvyl3l9E+UxlqOMUULdKTAYB0rEhsmjr7+2Vb/1pCSo=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+k8s.io/streaming v0.37.0-rc.0 h1:zDBjrKCnSLQyznohS8DyT1vmiD1s7XEcj5B9kyfN1WQ=
+k8s.io/streaming v0.37.0-rc.0/go.mod h1:APlJR26ZWRcVy5bIEj0QRrKUXROtBHPcxl2NT7EAzPU=
+k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 h1:jVkFFVfXdXP74B/zbO3hM3hpSFD0xvhQ5U686DPurkE=
+k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3/go.mod h1:M2s5JB1lIYP3jzZdorPLHXIPJzt9vv2muW5a6L9DtNM=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/.github/PULL_REQUEST_TEMPLATE.md b/hack/tools/code-generator/third_party/k8s.io/apimachinery/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000000..e7e5eb834b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,2 @@
+Sorry, we do not accept changes directly against this repository. Please see
+CONTRIBUTING.md for information on where and how to contribute instead.
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/CONTRIBUTING.md b/hack/tools/code-generator/third_party/k8s.io/apimachinery/CONTRIBUTING.md
new file mode 100644
index 0000000000..4bcf54520d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/CONTRIBUTING.md
@@ -0,0 +1,7 @@
+# Contributing guidelines
+
+Do not open pull requests directly against this repository, they will be ignored. Instead, please open pull requests against [kubernetes/kubernetes](https://git.k8s.io/kubernetes/).  Please follow the same [contributing guide](https://git.k8s.io/kubernetes/CONTRIBUTING.md) you would follow for any other pull request made to kubernetes/kubernetes.
+
+This repository is published from [kubernetes/kubernetes/staging/src/k8s.io/apimachinery](https://git.k8s.io/kubernetes/staging/src/k8s.io/apimachinery) by the [kubernetes publishing-bot](https://git.k8s.io/publishing-bot).
+
+Please see [Staging Directory and Publishing](https://git.k8s.io/community/contributors/devel/sig-architecture/staging.md) for more information
diff --git a/vendor/github.com/go-openapi/swag/jsonname/LICENSE b/hack/tools/code-generator/third_party/k8s.io/apimachinery/LICENSE
similarity index 100%
rename from vendor/github.com/go-openapi/swag/jsonname/LICENSE
rename to hack/tools/code-generator/third_party/k8s.io/apimachinery/LICENSE
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/OWNERS b/hack/tools/code-generator/third_party/k8s.io/apimachinery/OWNERS
new file mode 100644
index 0000000000..08b30b3ebc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/OWNERS
@@ -0,0 +1,28 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+  - smarterclayton
+  - deads2k
+  - sttts
+  - liggitt
+  - caesarxuchao
+  - jpbetz
+reviewers:
+  - apelisse
+  - thockin
+  - smarterclayton
+  - wojtek-t
+  - deads2k
+  - derekwaynecarr
+  - caesarxuchao
+  - cheftako
+  - mikedanese
+  - liggitt
+  - sttts
+  - jpbetz
+labels:
+  - sig/api-machinery
+emeritus_approvers:
+  - lavalamp
+emeritus_reviewers:
+  - ncdc
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/README.md b/hack/tools/code-generator/third_party/k8s.io/apimachinery/README.md
new file mode 100644
index 0000000000..420e9fda12
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/README.md
@@ -0,0 +1,34 @@
+> ⚠️ **This is an automatically published [staged repository](https://git.k8s.io/kubernetes/staging#external-repository-staging-area) for Kubernetes**.   
+> Contributions, including issues and pull requests, should be made to the main Kubernetes repository: [https://github.com/kubernetes/kubernetes](https://github.com/kubernetes/kubernetes).  
+> This repository is read-only for importing, and not used for direct contributions.  
+> See [CONTRIBUTING.md](./CONTRIBUTING.md) for more details.
+# apimachinery
+
+Scheme, typing, encoding, decoding, and conversion packages for Kubernetes and Kubernetes-like API objects.
+
+
+## Purpose
+
+This library is a shared dependency for servers and clients to work with Kubernetes API infrastructure without direct
+type dependencies. Its first consumers are `k8s.io/kubernetes`, `k8s.io/client-go`, and `k8s.io/apiserver`.
+
+
+## Compatibility
+
+There are *NO compatibility guarantees* for this repository. It is in direct support of Kubernetes, so branches
+will track Kubernetes and be compatible with that repo. As we more cleanly separate the layers, we will review the
+compatibility guarantee.
+
+
+## Where does it come from?
+
+`apimachinery` is synced from https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery.
+Code changes are made in that location, merged into `k8s.io/kubernetes` and later synced here.
+
+
+## Things you should *NOT* do
+
+ 1. Add API types to this repo. This is for the machinery, not for the types.
+ 2. Directly modify any files under `pkg` in this repo. Those are driven from `k8s.io/kubernetes/staging/src/k8s.io/apimachinery`.
+ 3. Expect compatibility. This repo is direct support of Kubernetes and the API isn't yet stable enough for API guarantees.
+
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/SECURITY_CONTACTS b/hack/tools/code-generator/third_party/k8s.io/apimachinery/SECURITY_CONTACTS
new file mode 100644
index 0000000000..f6003980fc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/SECURITY_CONTACTS
@@ -0,0 +1,16 @@
+# Defined below are the security contacts for this repo.
+#
+# They are the contact point for the Product Security Committee to reach out
+# to for triaging and handling of incoming issues.
+#
+# The below names agree to abide by the
+# [Embargo Policy](https://git.k8s.io/security/private-distributors-list.md#embargo-policy)
+# and will be removed and replaced if they violate that agreement.
+#
+# DO NOT REPORT SECURITY VULNERABILITIES DIRECTLY TO THESE NAMES, FOLLOW THE
+# INSTRUCTIONS AT https://kubernetes.io/security/
+
+cheftako
+deads2k
+lavalamp
+sttts
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/code-of-conduct.md b/hack/tools/code-generator/third_party/k8s.io/apimachinery/code-of-conduct.md
new file mode 100644
index 0000000000..0d15c00cf3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/code-of-conduct.md
@@ -0,0 +1,3 @@
+# Kubernetes Community Code of Conduct
+
+Please refer to our [Kubernetes Community Code of Conduct](https://git.k8s.io/community/code-of-conduct.md)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/doc.go
new file mode 100644
index 0000000000..1659a0fa6e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/doc.go
@@ -0,0 +1,17 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apimachinery
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/go.mod b/hack/tools/code-generator/third_party/k8s.io/apimachinery/go.mod
new file mode 100644
index 0000000000..c99bb415a7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/go.mod
@@ -0,0 +1,62 @@
+// This is a generated file. Do not edit directly.
+
+module k8s.io/apimachinery
+
+go 1.26.0
+
+godebug default=go1.26
+
+require (
+	github.com/fxamacker/cbor/v2 v2.9.1
+	github.com/google/gnostic-models v0.7.0
+	github.com/google/go-cmp v0.7.0
+	github.com/google/uuid v1.6.0
+	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
+	github.com/spf13/pflag v1.0.10
+	github.com/stretchr/testify v1.11.1
+	golang.org/x/net v0.57.0
+	golang.org/x/time v0.15.0
+	gopkg.in/evanphx/json-patch.v4 v4.13.0
+	gopkg.in/inf.v0 v0.9.1
+	k8s.io/klog/v2 v2.140.0
+	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad
+	k8s.io/streaming v0.37.0-rc.0
+	k8s.io/utils v0.0.0-20260626114624-be93311217bd
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730
+	sigs.k8s.io/randfill v1.0.0
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2
+	sigs.k8s.io/yaml v1.6.0
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-openapi/jsonpointer v1.0.0 // indirect
+	github.com/go-openapi/jsonreference v1.0.0 // indirect
+	github.com/go-openapi/swag v0.27.1 // indirect
+	github.com/go-openapi/swag/cmdutils v0.27.1 // indirect
+	github.com/go-openapi/swag/conv v0.27.1 // indirect
+	github.com/go-openapi/swag/fileutils v0.27.1 // indirect
+	github.com/go-openapi/swag/jsonutils v0.27.1 // indirect
+	github.com/go-openapi/swag/loading v0.27.1 // indirect
+	github.com/go-openapi/swag/mangling v0.27.1 // indirect
+	github.com/go-openapi/swag/netutils v0.27.1 // indirect
+	github.com/go-openapi/swag/pools v0.27.1 // indirect
+	github.com/go-openapi/swag/stringutils v0.27.1 // indirect
+	github.com/go-openapi/swag/typeutils v0.27.1 // indirect
+	github.com/go-openapi/swag/yamlutils v0.27.1 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
+	github.com/moby/spdystream v0.5.1 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
+	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/go.sum b/hack/tools/code-generator/third_party/k8s.io/apimachinery/go.sum
new file mode 100644
index 0000000000..99df51e773
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/go.sum
@@ -0,0 +1,123 @@
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
+github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
+github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
+github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY=
+github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0=
+github.com/go-openapi/swag v0.27.1 h1:VotvOLWW8q/EAxB0YdsBBGC8XYyeL1YwBj2ungAGPNg=
+github.com/go-openapi/swag v0.27.1/go.mod h1:GTkJPwHfhJp6MWr4/rCh64HVI3Ofu+tcsbfjfHmTxpE=
+github.com/go-openapi/swag/cmdutils v0.27.1 h1:I7sYqaWVl5mq0NEmNQkAmFDyNin9ufvMX/p2zwtQaOE=
+github.com/go-openapi/swag/cmdutils v0.27.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
+github.com/go-openapi/swag/conv v0.27.1 h1:8wi9ZG+olmY1wXphl93EWniPtbSPkXM/feH7FgjsvrU=
+github.com/go-openapi/swag/conv v0.27.1/go.mod h1:QbqMivkpKhC3g1B1GGGOJ6ANewI3S62dbzYu3Duowqs=
+github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzrb0QkmLKf9oM=
+github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8=
+github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU=
+github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1 h1:mJu3COL9WEaZVp/Kf2PRMi7tPszPEJfSr/OO75ynCs8=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY=
+github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY=
+github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE=
+github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA=
+github.com/go-openapi/swag/mangling v0.27.1/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w=
+github.com/go-openapi/swag/netutils v0.27.1 h1:mICMFoS82F5TZ4Zy3cqmcQk+BFeCp3Uyq3Np7GI0/qU=
+github.com/go-openapi/swag/netutils v0.27.1/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ=
+github.com/go-openapi/swag/pools v0.27.1 h1:9LeadcMyb2GJCbXX5hVQDbZ2Lq9TL4dCs/nx1j5DO0E=
+github.com/go-openapi/swag/pools v0.27.1/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE=
+github.com/go-openapi/swag/stringutils v0.27.1 h1:ZXePZ0r2p1qSjo8tD3Un4vFj8+FqlCkczxDrJIhYUp8=
+github.com/go-openapi/swag/stringutils v0.27.1/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM=
+github.com/go-openapi/swag/typeutils v0.27.1 h1:KSTdFlfnse4r6dP9IrEnwMldjE+zs71UeEB3//PtVXc=
+github.com/go-openapi/swag/typeutils v0.27.1/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ=
+github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA=
+github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo=
+github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
+github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y=
+github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+k8s.io/streaming v0.37.0-rc.0 h1:zDBjrKCnSLQyznohS8DyT1vmiD1s7XEcj5B9kyfN1WQ=
+k8s.io/streaming v0.37.0-rc.0/go.mod h1:APlJR26ZWRcVy5bIEj0QRrKUXROtBHPcxl2NT7EAzPU=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/OWNERS b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/OWNERS
new file mode 100644
index 0000000000..18c387cc97
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/OWNERS
@@ -0,0 +1,9 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+  - caesarxuchao
+  - deads2k
+  - smarterclayton
+  - liggitt
+emeritus_approvers:
+  - lavalamp
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/close.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/close.go
new file mode 100644
index 0000000000..dfb5657eb9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/close.go
@@ -0,0 +1,54 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apitesting
+
+import (
+	"io"
+	"testing"
+)
+
+// Close and fail the test if it returns an error.
+func Close(t TestingT, c io.Closer) {
+	t.Helper()
+	assertNoError(t, c.Close())
+}
+
+// CloseNoOp does nothing. Use as a replacement for Close when you
+// need to disable a defer.
+func CloseNoOp(TestingT, io.Closer) {}
+
+// TestingT simulates assert.TestingT and assert.tHelper without adding
+// testify as a non-test dependency.
+type TestingT interface {
+	Errorf(format string, args ...interface{})
+	Helper()
+}
+
+// Ensure that testing T & B satisfy the TestingT interface
+var _ TestingT = &testing.T{}
+var _ TestingT = &testing.B{}
+
+// assertNoError simulates assert.NoError without adding testify as a
+// non-test dependency.
+//
+// In test files, use github.com/stretchr/testify/assert instead.
+func assertNoError(t TestingT, err error) {
+	t.Helper()
+	if err != nil {
+		t.Errorf("Received unexpected error:\n%+v", err)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/codec.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/codec.go
new file mode 100644
index 0000000000..542b0aa275
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/codec.go
@@ -0,0 +1,116 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apitesting
+
+import (
+	"fmt"
+	"mime"
+	"os"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apimachinery/pkg/runtime/serializer/recognizer"
+)
+
+var (
+	testCodecMediaType        string
+	testStorageCodecMediaType string
+)
+
+// TestCodec returns the codec for the API version to test against, as set by the
+// KUBE_TEST_API_TYPE env var.
+func TestCodec(codecs runtimeserializer.CodecFactory, gvs ...schema.GroupVersion) runtime.Codec {
+	if len(testCodecMediaType) != 0 {
+		serializerInfo, ok := runtime.SerializerInfoForMediaType(codecs.SupportedMediaTypes(), testCodecMediaType)
+		if !ok {
+			panic(fmt.Sprintf("no serializer for %s", testCodecMediaType))
+		}
+		return codecs.CodecForVersions(serializerInfo.Serializer, codecs.UniversalDeserializer(), schema.GroupVersions(gvs), nil)
+	}
+	return codecs.LegacyCodec(gvs...)
+}
+
+// TestStorageCodec returns the codec for the API version to test against used in storage, as set by the
+// KUBE_TEST_API_STORAGE_TYPE env var.
+func TestStorageCodec(codecs runtimeserializer.CodecFactory, gvs ...schema.GroupVersion) runtime.Codec {
+	if len(testStorageCodecMediaType) != 0 {
+		serializerInfo, ok := runtime.SerializerInfoForMediaType(codecs.SupportedMediaTypes(), testStorageCodecMediaType)
+		if !ok {
+			panic(fmt.Sprintf("no serializer for %s", testStorageCodecMediaType))
+		}
+
+		// etcd2 only supports string data - we must wrap any result before returning
+		// TODO: remove for etcd3 / make parameterizable
+		serializer := serializerInfo.Serializer
+		if !serializerInfo.EncodesAsText {
+			serializer = runtime.NewBase64Serializer(serializer, serializer)
+		}
+
+		decoder := recognizer.NewDecoder(serializer, codecs.UniversalDeserializer())
+		return codecs.CodecForVersions(serializer, decoder, schema.GroupVersions(gvs), nil)
+
+	}
+	return codecs.LegacyCodec(gvs...)
+}
+
+func init() {
+	var err error
+	if apiMediaType := os.Getenv("KUBE_TEST_API_TYPE"); len(apiMediaType) > 0 {
+		testCodecMediaType, _, err = mime.ParseMediaType(apiMediaType)
+		if err != nil {
+			panic(err)
+		}
+	}
+
+	if storageMediaType := os.Getenv("KUBE_TEST_API_STORAGE_TYPE"); len(storageMediaType) > 0 {
+		testStorageCodecMediaType, _, err = mime.ParseMediaType(storageMediaType)
+		if err != nil {
+			panic(err)
+		}
+	}
+}
+
+// InstallOrDieFunc mirrors install functions that require success
+type InstallOrDieFunc func(scheme *runtime.Scheme)
+
+// SchemeForInstallOrDie builds a simple test scheme and codecfactory pair for easy unit testing from higher level install methods
+func SchemeForInstallOrDie(installFns ...InstallOrDieFunc) (*runtime.Scheme, runtimeserializer.CodecFactory) {
+	scheme := runtime.NewScheme()
+	codecFactory := runtimeserializer.NewCodecFactory(scheme)
+	for _, installFn := range installFns {
+		installFn(scheme)
+	}
+
+	return scheme, codecFactory
+}
+
+// InstallFunc mirrors install functions that can return an error
+type InstallFunc func(scheme *runtime.Scheme) error
+
+// SchemeForOrDie builds a simple test scheme and codecfactory pair for easy unit testing from the bare registration methods.
+func SchemeForOrDie(installFns ...InstallFunc) (*runtime.Scheme, runtimeserializer.CodecFactory) {
+	scheme := runtime.NewScheme()
+	codecFactory := runtimeserializer.NewCodecFactory(scheme)
+	for _, installFn := range installFns {
+		if err := installFn(scheme); err != nil {
+			panic(err)
+		}
+	}
+
+	return scheme, codecFactory
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/fuzzer.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/fuzzer.go
new file mode 100644
index 0000000000..a12370886f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/fuzzer.go
@@ -0,0 +1,73 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fuzzer
+
+import (
+	"encoding/json"
+	"fmt"
+	"math/rand"
+
+	"sigs.k8s.io/randfill"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	kjson "k8s.io/apimachinery/pkg/util/json"
+)
+
+// FuzzerFuncs returns a list of func(*SomeType, c randfill.Continue) functions.
+type FuzzerFuncs func(codecs runtimeserializer.CodecFactory) []interface{}
+
+// FuzzerFor can randomly populate api objects that are destined for version.
+func FuzzerFor(funcs FuzzerFuncs, src rand.Source, codecs runtimeserializer.CodecFactory) *randfill.Filler {
+	f := randfill.New().NilChance(.5).NumElements(0, 1)
+	if src != nil {
+		f.RandSource(src)
+	}
+	f.Funcs(funcs(codecs)...)
+	return f
+}
+
+// MergeFuzzerFuncs will merge the given funcLists, overriding early funcs with later ones if there first
+// argument has the same type.
+func MergeFuzzerFuncs(funcs ...FuzzerFuncs) FuzzerFuncs {
+	return FuzzerFuncs(func(codecs runtimeserializer.CodecFactory) []interface{} {
+		result := []interface{}{}
+		for _, f := range funcs {
+			if f != nil {
+				result = append(result, f(codecs)...)
+			}
+		}
+		return result
+	})
+}
+
+func NormalizeJSONRawExtension(ext *runtime.RawExtension) {
+	if json.Valid(ext.Raw) {
+		// RawExtension->JSON encodes struct fields in field index order while map[string]interface{}->JSON encodes
+		// struct fields (i.e. keys in the map) lexicographically. We have to sort the fields here to ensure the
+		// JSON in the (RawExtension->)JSON->map[string]interface{}->JSON round trip results in identical JSON.
+		var u any
+		err := kjson.Unmarshal(ext.Raw, &u)
+		if err != nil {
+			panic(fmt.Sprintf("Failed to encode object: %v", err))
+		}
+		ext.Raw, err = kjson.Marshal(&u)
+		if err != nil {
+			panic(fmt.Sprintf("Failed to encode object: %v", err))
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/valuefuzz.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/valuefuzz.go
new file mode 100644
index 0000000000..facff57bba
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/valuefuzz.go
@@ -0,0 +1,86 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fuzzer
+
+import (
+	"reflect"
+)
+
+// ValueFuzz recursively changes all basic type values in an object. Any kind of references will not
+// be touch, i.e. the addresses of slices, maps, pointers will stay unchanged.
+func ValueFuzz(obj interface{}) {
+	valueFuzz(reflect.ValueOf(obj))
+}
+
+func valueFuzz(obj reflect.Value) {
+	switch obj.Kind() {
+	case reflect.Array:
+		for i := 0; i < obj.Len(); i++ {
+			valueFuzz(obj.Index(i))
+		}
+	case reflect.Slice:
+		if obj.IsNil() {
+			// TODO: set non-nil value
+		} else {
+			for i := 0; i < obj.Len(); i++ {
+				valueFuzz(obj.Index(i))
+			}
+		}
+	case reflect.Interface, reflect.Pointer:
+		if obj.IsNil() {
+			// TODO: set non-nil value
+		} else {
+			valueFuzz(obj.Elem())
+		}
+	case reflect.Struct:
+		for i, n := 0, obj.NumField(); i < n; i++ {
+			valueFuzz(obj.Field(i))
+		}
+	case reflect.Map:
+		if obj.IsNil() {
+			// TODO: set non-nil value
+		} else {
+			for _, k := range obj.MapKeys() {
+				// map values are not addressable. We need a copy.
+				v := obj.MapIndex(k)
+				copy := reflect.New(v.Type())
+				copy.Elem().Set(v)
+				valueFuzz(copy.Elem())
+				obj.SetMapIndex(k, copy.Elem())
+			}
+			// TODO: set some new value
+		}
+	case reflect.Func: // ignore, we don't have function types in our API
+	default:
+		if !obj.CanSet() {
+			return
+		}
+		switch obj.Kind() {
+		case reflect.String:
+			obj.SetString(obj.String() + "x")
+		case reflect.Bool:
+			obj.SetBool(!obj.Bool())
+		case reflect.Float32, reflect.Float64:
+			obj.SetFloat(obj.Float()*2.0 + 1.0)
+		case reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64, reflect.Int:
+			obj.SetInt(obj.Int() + 1)
+		case reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uint:
+			obj.SetUint(obj.Uint() + 1)
+		default:
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/valuefuzz_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/valuefuzz_test.go
new file mode 100644
index 0000000000..a935aa40c7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/valuefuzz_test.go
@@ -0,0 +1,73 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fuzzer
+
+import "testing"
+
+func TestValueFuzz(t *testing.T) {
+	type (
+		Y struct {
+			I int
+			B bool
+			F float32
+			U uint
+		}
+		X struct {
+			Ptr   *X
+			Y     Y
+			Map   map[string]int
+			Slice []int
+		}
+	)
+
+	x := X{
+		Ptr:   &X{},
+		Map:   map[string]int{"foo": 42},
+		Slice: []int{1, 2, 3},
+	}
+
+	p := x.Ptr
+	m := x.Map
+	s := x.Slice
+
+	ValueFuzz(x)
+
+	if x.Ptr.Y.I == 0 {
+		t.Errorf("x.Ptr.Y.I should have changed")
+	}
+
+	if x.Map["foo"] == 42 {
+		t.Errorf("x.Map[foo] should have changed")
+	}
+
+	if x.Slice[0] == 1 {
+		t.Errorf("x.Slice[0] should have changed")
+	}
+
+	if x.Ptr != p {
+		t.Errorf("x.Ptr changed")
+	}
+
+	m["foo"] = 7
+	if x.Map["foo"] != m["foo"] {
+		t.Errorf("x.Map changed")
+	}
+	s[0] = 7
+	if x.Slice[0] != s[0] {
+		t.Errorf("x.Slice changed")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/naming/naming.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/naming/naming.go
new file mode 100644
index 0000000000..d089b9f53b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/naming/naming.go
@@ -0,0 +1,168 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package naming
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+var (
+	marshalerType   = reflect.TypeOf((*json.Marshaler)(nil)).Elem()
+	unmarshalerType = reflect.TypeOf((*json.Unmarshaler)(nil)).Elem()
+)
+
+// VerifyGroupNames ensures that all groups in the scheme ends with the k8s.io suffix.
+// Exceptions can be tolerated using the legacyUnsuffixedGroups parameter
+func VerifyGroupNames(scheme *runtime.Scheme, legacyUnsuffixedGroups sets.String) error {
+	errs := []error{}
+	for _, gv := range scheme.PrioritizedVersionsAllGroups() {
+		if !strings.HasSuffix(gv.Group, ".k8s.io") && !legacyUnsuffixedGroups.Has(gv.Group) {
+			errs = append(errs, fmt.Errorf("group %s does not have the standard kubernetes API group suffix of .k8s.io", gv.Group))
+		}
+	}
+	return errors.NewAggregate(errs)
+}
+
+// VerifyTagNaming ensures that all types in the scheme have JSON tags set on external types, and JSON tags not set on internal types.
+// Exceptions can be tolerated using the typesAllowedTags and allowedNonstandardJSONNames parameters
+func VerifyTagNaming(scheme *runtime.Scheme, typesAllowedTags map[reflect.Type]bool, allowedNonstandardJSONNames map[reflect.Type]string) error {
+	errs := []error{}
+	for gvk, knownType := range scheme.AllKnownTypes() {
+		var err error
+		if gvk.Version == runtime.APIVersionInternal {
+			err = errors.NewAggregate(ensureNoTags(gvk, knownType, nil, typesAllowedTags))
+		} else {
+			err = errors.NewAggregate(ensureTags(gvk, knownType, nil, allowedNonstandardJSONNames))
+		}
+		if err != nil {
+			errs = append(errs, err)
+		}
+	}
+	return errors.NewAggregate(errs)
+}
+
+func ensureNoTags(gvk schema.GroupVersionKind, tp reflect.Type, parents []reflect.Type, typesAllowedTags map[reflect.Type]bool) []error {
+	errs := []error{}
+	if _, ok := typesAllowedTags[tp]; ok {
+		return errs
+	}
+
+	// Don't look at the same type multiple times
+	if containsType(parents, tp) {
+		return nil
+	}
+	parents = append(parents, tp)
+
+	switch tp.Kind() {
+	case reflect.Map, reflect.Slice, reflect.Pointer:
+		errs = append(errs, ensureNoTags(gvk, tp.Elem(), parents, typesAllowedTags)...)
+
+	case reflect.String, reflect.Bool, reflect.Float32, reflect.Float64, reflect.Int32, reflect.Int64, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr, reflect.Interface:
+		// no-op
+
+	case reflect.Struct:
+		for i := 0; i < tp.NumField(); i++ {
+			f := tp.Field(i)
+			if f.PkgPath != "" {
+				continue // Ignore unexported fields
+			}
+			_, jsonTagExists := f.Tag.Lookup("json")
+			protoTag := f.Tag.Get("protobuf")
+			if jsonTagExists || len(protoTag) > 0 {
+				errs = append(errs, fmt.Errorf("internal types should not have json or protobuf tags. %#v has tag on field %v: %v.\n%s", gvk, f.Name, f.Tag, fmtParentString(parents)))
+			}
+
+			errs = append(errs, ensureNoTags(gvk, f.Type, parents, typesAllowedTags)...)
+		}
+
+	default:
+		errs = append(errs, fmt.Errorf("unexpected type %v in %#v.\n%s", tp.Kind(), gvk, fmtParentString(parents)))
+	}
+	return errs
+}
+
+func ensureTags(gvk schema.GroupVersionKind, tp reflect.Type, parents []reflect.Type, allowedNonstandardJSONNames map[reflect.Type]string) []error {
+	errs := []error{}
+	// This type handles its own encoding/decoding and doesn't need json tags
+	if tp.Implements(marshalerType) && (tp.Implements(unmarshalerType) || reflect.PointerTo(tp).Implements(unmarshalerType)) {
+		return errs
+	}
+
+	// Don't look at the same type multiple times
+	if containsType(parents, tp) {
+		return nil
+	}
+	parents = append(parents, tp)
+
+	switch tp.Kind() {
+	case reflect.Map, reflect.Slice, reflect.Pointer:
+		errs = append(errs, ensureTags(gvk, tp.Elem(), parents, allowedNonstandardJSONNames)...)
+
+	case reflect.String, reflect.Bool, reflect.Float32, reflect.Float64, reflect.Int32, reflect.Int64, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr, reflect.Interface:
+		// no-op
+
+	case reflect.Struct:
+		for i := 0; i < tp.NumField(); i++ {
+			f := tp.Field(i)
+			jsonTag, jsonTagExists := f.Tag.Lookup("json")
+			if len(jsonTag) == 0 {
+				if f.Anonymous && jsonTagExists {
+					// allow json:"" on embedded fields
+				} else {
+					errs = append(errs, fmt.Errorf("external types should have json tags. %#v tags on field %v are: %s.\n%s", gvk, f.Name, f.Tag, fmtParentString(parents)))
+				}
+			}
+
+			jsonTagName := strings.Split(jsonTag, ",")[0]
+			if len(jsonTagName) > 0 && (jsonTagName[0] < 'a' || jsonTagName[0] > 'z') && jsonTagName != "-" && allowedNonstandardJSONNames[tp] != jsonTagName {
+				errs = append(errs, fmt.Errorf("external types should have json names starting with lowercase letter. %#v has json tag on field %v with name %s.\n%s", gvk, f.Name, jsonTagName, fmtParentString(parents)))
+			}
+
+			errs = append(errs, ensureTags(gvk, f.Type, parents, allowedNonstandardJSONNames)...)
+		}
+
+	default:
+		errs = append(errs, fmt.Errorf("unexpected type %v in %#v.\n%s", tp.Kind(), gvk, fmtParentString(parents)))
+	}
+	return errs
+}
+
+func fmtParentString(parents []reflect.Type) string {
+	str := "Type parents:\n"
+	for i, tp := range parents {
+		str += fmt.Sprintf("%s%v\n", strings.Repeat(" ", i), tp)
+	}
+	return str
+}
+
+// containsType returns true if s contains t, false otherwise
+func containsType(s []reflect.Type, t reflect.Type) bool {
+	for _, u := range s {
+		if t == u {
+			return true
+		}
+	}
+	return false
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/compatibility.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/compatibility.go
new file mode 100644
index 0000000000..deba9b456b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/compatibility.go
@@ -0,0 +1,530 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package roundtrip
+
+import (
+	"bytes"
+	gojson "encoding/json"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"reflect"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+	"k8s.io/apimachinery/pkg/runtime/serializer/protobuf"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// CompatibilityTestOptions holds configuration for running a compatibility test using in-memory objects
+// and serialized files on disk representing the current code and serialized data from previous versions.
+//
+// Example use: `NewCompatibilityTestOptions(scheme).Complete(t).Run(t)`
+type CompatibilityTestOptions struct {
+	// Scheme is used to create new objects for filling, decoding, and for constructing serializers.
+	// Required.
+	Scheme *runtime.Scheme
+
+	// TestDataDir points to a directory containing compatibility test data.
+	// Complete() populates this with "testdata" if unset.
+	TestDataDir string
+
+	// TestDataDirCurrentVersion points to a directory containing compatibility test data for the current version.
+	// Complete() populates this with "<TestDataDir>/HEAD" if unset.
+	// Within this directory, `<group>.<version>.<kind>.[json|yaml|pb]` files are required to exist, and are:
+	// * verified to match serialized FilledObjects[GVK]
+	// * verified to decode without error
+	// * verified to round-trip byte-for-byte when re-encoded
+	// * verified to be semantically equal when decoded into memory
+	TestDataDirCurrentVersion string
+
+	// TestDataDirsPreviousVersions is a list of directories containing compatibility test data for previous versions.
+	// Complete() populates this with "<TestDataDir>/v*" directories if nil.
+	// Within these directories, `<group>.<version>.<kind>.[json|yaml|pb]` files are optional. If present, they are:
+	// * verified to decode without error
+	// * verified to round-trip byte-for-byte when re-encoded (or to match a `<group>.<version>.<kind>.[json|yaml|pb].after_roundtrip.[json|yaml|pb]` file if it exists)
+	// * verified to be semantically equal when decoded into memory
+	TestDataDirsPreviousVersions []string
+
+	// Kinds is a list of fully qualified kinds to test.
+	// Complete() populates this with Scheme.AllKnownTypes() if unset.
+	Kinds []schema.GroupVersionKind
+
+	// FilledObjects is an optional set of pre-filled objects to use for verifying HEAD fixtures.
+	// Complete() populates this with the result of CompatibilityTestObject(Kinds[*], Scheme, FillFuncs) for any missing kinds.
+	// Objects must deterministically populate every field and be identical on every invocation.
+	FilledObjects map[schema.GroupVersionKind]runtime.Object
+
+	// FillFuncs is an optional map of custom functions to use to fill instances of particular types.
+	FillFuncs map[reflect.Type]FillFunc
+
+	JSON  runtime.Serializer
+	YAML  runtime.Serializer
+	Proto runtime.Serializer
+}
+
+// FillFunc is a function that populates all serializable fields in obj.
+// s and i are string and integer values relevant to the object being populated
+// (for example, the json key or protobuf tag containing the object)
+// that can be used when filling the object to make the object content identifiable
+type FillFunc func(s string, i int, obj interface{})
+
+func NewCompatibilityTestOptions(scheme *runtime.Scheme) *CompatibilityTestOptions {
+	return &CompatibilityTestOptions{Scheme: scheme}
+}
+
+// coreKinds includes kinds that typically only need to be tested in a single API group
+var coreKinds = sets.NewString(
+	"CreateOptions", "UpdateOptions", "PatchOptions", "DeleteOptions",
+	"GetOptions", "ListOptions", "ExportOptions",
+	"WatchEvent",
+)
+
+func (c *CompatibilityTestOptions) Complete(t *testing.T) *CompatibilityTestOptions {
+	t.Helper()
+
+	// Verify scheme
+	if c.Scheme == nil {
+		t.Fatal("scheme is required")
+	}
+
+	// Populate testdata dirs
+	if c.TestDataDir == "" {
+		c.TestDataDir = "testdata"
+	}
+	if c.TestDataDirCurrentVersion == "" {
+		c.TestDataDirCurrentVersion = filepath.Join(c.TestDataDir, http.MethodHead)
+	}
+	if c.TestDataDirsPreviousVersions == nil {
+		dirs, err := filepath.Glob(filepath.Join(c.TestDataDir, "v*"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		sort.Strings(dirs)
+		c.TestDataDirsPreviousVersions = dirs
+	}
+
+	// Populate kinds
+	if len(c.Kinds) == 0 {
+		gvks := []schema.GroupVersionKind{}
+		for gvk := range c.Scheme.AllKnownTypes() {
+			if gvk.Version == "" || gvk.Version == runtime.APIVersionInternal {
+				// only test external types
+				continue
+			}
+			if strings.HasSuffix(gvk.Kind, "List") {
+				// omit list types
+				continue
+			}
+			if gvk.Group != "" && coreKinds.Has(gvk.Kind) {
+				// only test options types in the core API group
+				continue
+			}
+			gvks = append(gvks, gvk)
+		}
+		c.Kinds = gvks
+	}
+
+	// Sort kinds to get deterministic test order
+	sort.Slice(c.Kinds, func(i, j int) bool {
+		if c.Kinds[i].Group != c.Kinds[j].Group {
+			return c.Kinds[i].Group < c.Kinds[j].Group
+		}
+		if c.Kinds[i].Version != c.Kinds[j].Version {
+			return c.Kinds[i].Version < c.Kinds[j].Version
+		}
+		if c.Kinds[i].Kind != c.Kinds[j].Kind {
+			return c.Kinds[i].Kind < c.Kinds[j].Kind
+		}
+		return false
+	})
+
+	// Fill any missing objects
+	if c.FilledObjects == nil {
+		c.FilledObjects = map[schema.GroupVersionKind]runtime.Object{}
+	}
+	fillFuncs := defaultFillFuncs()
+	for k, v := range c.FillFuncs {
+		fillFuncs[k] = v
+	}
+	for _, gvk := range c.Kinds {
+		if _, ok := c.FilledObjects[gvk]; ok {
+			continue
+		}
+		obj, err := CompatibilityTestObject(c.Scheme, gvk, fillFuncs)
+		if err != nil {
+			t.Fatal(err)
+		}
+		c.FilledObjects[gvk] = obj
+	}
+
+	if c.JSON == nil {
+		c.JSON = json.NewSerializerWithOptions(json.DefaultMetaFactory, c.Scheme, c.Scheme, json.SerializerOptions{Pretty: true})
+	}
+	if c.YAML == nil {
+		c.YAML = json.NewSerializerWithOptions(json.DefaultMetaFactory, c.Scheme, c.Scheme, json.SerializerOptions{Yaml: true})
+	}
+	if c.Proto == nil {
+		c.Proto = protobuf.NewSerializer(c.Scheme, c.Scheme)
+	}
+
+	return c
+}
+
+func (c *CompatibilityTestOptions) Run(t *testing.T) {
+	usedHEADFixtures := sets.NewString()
+
+	for _, gvk := range c.Kinds {
+		t.Run(makeName(gvk), func(t *testing.T) {
+
+			t.Run(http.MethodHead, func(t *testing.T) {
+				c.runCurrentVersionTest(t, gvk, usedHEADFixtures)
+			})
+
+			for _, previousVersionDir := range c.TestDataDirsPreviousVersions {
+				t.Run(filepath.Base(previousVersionDir), func(t *testing.T) {
+					c.runPreviousVersionTest(t, gvk, previousVersionDir, nil)
+				})
+			}
+
+		})
+	}
+
+	// Check for unused HEAD fixtures
+	t.Run("unused_fixtures", func(t *testing.T) {
+		files, err := os.ReadDir(c.TestDataDirCurrentVersion)
+		if err != nil {
+			t.Fatal(err)
+		}
+		allFixtures := sets.NewString()
+		for _, file := range files {
+			allFixtures.Insert(file.Name())
+		}
+
+		if unused := allFixtures.Difference(usedHEADFixtures); len(unused) > 0 {
+			t.Fatalf("remove unused fixtures from %s:\n%s", c.TestDataDirCurrentVersion, strings.Join(unused.List(), "\n"))
+		}
+	})
+}
+
+func (c *CompatibilityTestOptions) runCurrentVersionTest(t *testing.T, gvk schema.GroupVersionKind, usedFiles sets.String) {
+	expectedObject := c.FilledObjects[gvk]
+	expectedJSON, expectedYAML, expectedProto := c.encode(t, expectedObject)
+
+	actualJSON, actualYAML, actualProto, err := read(c.TestDataDirCurrentVersion, gvk, "", usedFiles)
+	if err != nil && !os.IsNotExist(err) {
+		t.Fatal(err)
+	}
+
+	needsUpdate := false
+	if os.IsNotExist(err) {
+		t.Errorf("current version compatibility files did not exist: %v", err)
+		needsUpdate = true
+	} else {
+		if !bytes.Equal(expectedJSON, actualJSON) {
+			t.Errorf("json differs")
+			t.Log(cmp.Diff(string(actualJSON), string(expectedJSON)))
+			needsUpdate = true
+		}
+
+		if !bytes.Equal(expectedYAML, actualYAML) {
+			t.Errorf("yaml differs")
+			t.Log(cmp.Diff(string(actualYAML), string(expectedYAML)))
+			needsUpdate = true
+		}
+
+		if !bytes.Equal(expectedProto, actualProto) {
+			t.Errorf("proto differs")
+			needsUpdate = true
+			t.Log(cmp.Diff(dumpProto(t, actualProto[4:]), dumpProto(t, expectedProto[4:])))
+			// t.Logf("json (for locating the offending field based on surrounding data): %s", string(expectedJSON))
+		}
+	}
+
+	if needsUpdate {
+		const updateEnvVar = "UPDATE_COMPATIBILITY_FIXTURE_DATA"
+		if os.Getenv(updateEnvVar) == "true" {
+			writeFile(t, c.TestDataDirCurrentVersion, gvk, "", "json", expectedJSON)
+			writeFile(t, c.TestDataDirCurrentVersion, gvk, "", "yaml", expectedYAML)
+			writeFile(t, c.TestDataDirCurrentVersion, gvk, "", "pb", expectedProto)
+			t.Logf("wrote expected compatibility data... verify, commit, and rerun tests")
+		} else {
+			t.Logf("if the diff is expected because of a new type or a new field, re-run with %s=true to update the compatibility data", updateEnvVar)
+		}
+		return
+	}
+
+	emptyObj, err := c.Scheme.New(gvk)
+	if err != nil {
+		t.Fatal(err)
+	}
+	{
+		// compact before decoding since embedded RawExtension fields retain indenting
+		compacted := &bytes.Buffer{}
+		if err := gojson.Compact(compacted, actualJSON); err != nil {
+			t.Error(err)
+		}
+
+		jsonDecoded := emptyObj.DeepCopyObject()
+		jsonDecoded, _, err = c.JSON.Decode(compacted.Bytes(), &gvk, jsonDecoded)
+		if err != nil {
+			t.Error(err)
+		} else if !apiequality.Semantic.DeepEqual(expectedObject, jsonDecoded) {
+			t.Errorf("expected and decoded json objects differed:\n%s", cmp.Diff(expectedObject, jsonDecoded))
+		}
+	}
+	{
+		yamlDecoded := emptyObj.DeepCopyObject()
+		yamlDecoded, _, err = c.YAML.Decode(actualYAML, &gvk, yamlDecoded)
+		if err != nil {
+			t.Error(err)
+		} else if !apiequality.Semantic.DeepEqual(expectedObject, yamlDecoded) {
+			t.Errorf("expected and decoded yaml objects differed:\n%s", cmp.Diff(expectedObject, yamlDecoded))
+		}
+	}
+	{
+		protoDecoded := emptyObj.DeepCopyObject()
+		protoDecoded, _, err = c.Proto.Decode(actualProto, &gvk, protoDecoded)
+		if err != nil {
+			t.Error(err)
+		} else if !apiequality.Semantic.DeepEqual(expectedObject, protoDecoded) {
+			t.Errorf("expected and decoded proto objects differed:\n%s", cmp.Diff(expectedObject, protoDecoded))
+		}
+	}
+}
+
+func (c *CompatibilityTestOptions) encode(t *testing.T, obj runtime.Object) (json, yaml, proto []byte) {
+	jsonBytes := bytes.NewBuffer(nil)
+	if err := c.JSON.Encode(obj, jsonBytes); err != nil {
+		t.Fatalf("error encoding json: %v", err)
+	}
+	yamlBytes := bytes.NewBuffer(nil)
+	if err := c.YAML.Encode(obj, yamlBytes); err != nil {
+		t.Fatalf("error encoding yaml: %v", err)
+	}
+	protoBytes := bytes.NewBuffer(nil)
+	if err := c.Proto.Encode(obj, protoBytes); err != nil {
+		t.Fatalf("error encoding proto: %v", err)
+	}
+	return jsonBytes.Bytes(), yamlBytes.Bytes(), protoBytes.Bytes()
+}
+
+func read(dir string, gvk schema.GroupVersionKind, suffix string, usedFiles sets.String) (json, yaml, proto []byte, err error) {
+	jsonFilename := makeName(gvk) + suffix + ".json"
+	actualJSON, jsonErr := ioutil.ReadFile(filepath.Join(dir, jsonFilename))
+	yamlFilename := makeName(gvk) + suffix + ".yaml"
+	actualYAML, yamlErr := ioutil.ReadFile(filepath.Join(dir, yamlFilename))
+	protoFilename := makeName(gvk) + suffix + ".pb"
+	actualProto, protoErr := ioutil.ReadFile(filepath.Join(dir, protoFilename))
+	if usedFiles != nil {
+		usedFiles.Insert(jsonFilename)
+		usedFiles.Insert(yamlFilename)
+		usedFiles.Insert(protoFilename)
+	}
+	if jsonErr != nil {
+		return actualJSON, actualYAML, actualProto, jsonErr
+	}
+	if yamlErr != nil {
+		return actualJSON, actualYAML, actualProto, yamlErr
+	}
+	if protoErr != nil {
+		return actualJSON, actualYAML, actualProto, protoErr
+	}
+	return actualJSON, actualYAML, actualProto, nil
+}
+
+func writeFile(t *testing.T, dir string, gvk schema.GroupVersionKind, suffix, extension string, data []byte) {
+	if err := os.MkdirAll(dir, os.FileMode(0755)); err != nil {
+		t.Fatal("error making directory", err)
+	}
+	if err := ioutil.WriteFile(filepath.Join(dir, makeName(gvk)+suffix+"."+extension), data, os.FileMode(0644)); err != nil {
+		t.Fatalf("error writing %s: %v", extension, err)
+	}
+}
+
+func deleteFile(t *testing.T, dir string, gvk schema.GroupVersionKind, suffix, extension string) {
+	if err := os.Remove(filepath.Join(dir, makeName(gvk)+suffix+"."+extension)); err != nil {
+		t.Fatalf("error removing %s: %v", extension, err)
+	}
+}
+
+func (c *CompatibilityTestOptions) runPreviousVersionTest(t *testing.T, gvk schema.GroupVersionKind, previousVersionDir string, usedFiles sets.String) {
+	jsonBeforeRoundTrip, yamlBeforeRoundTrip, protoBeforeRoundTrip, err := read(previousVersionDir, gvk, "", usedFiles)
+	if os.IsNotExist(err) || (len(jsonBeforeRoundTrip) == 0 && len(yamlBeforeRoundTrip) == 0 && len(protoBeforeRoundTrip) == 0) {
+		t.SkipNow()
+		return
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	emptyObj, err := c.Scheme.New(gvk)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// compact before decoding since embedded RawExtension fields retain indenting
+	compacted := &bytes.Buffer{}
+	if err := gojson.Compact(compacted, jsonBeforeRoundTrip); err != nil {
+		t.Fatal(err)
+	}
+
+	jsonDecoded := emptyObj.DeepCopyObject()
+	jsonDecoded, _, err = c.JSON.Decode(compacted.Bytes(), &gvk, jsonDecoded)
+	if err != nil {
+		t.Fatal(err)
+	}
+	jsonBytes := bytes.NewBuffer(nil)
+	if err := c.JSON.Encode(jsonDecoded, jsonBytes); err != nil {
+		t.Fatalf("error encoding json: %v", err)
+	}
+	jsonAfterRoundTrip := jsonBytes.Bytes()
+
+	yamlDecoded := emptyObj.DeepCopyObject()
+	yamlDecoded, _, err = c.YAML.Decode(yamlBeforeRoundTrip, &gvk, yamlDecoded)
+	if err != nil {
+		t.Fatal(err)
+	} else if !apiequality.Semantic.DeepEqual(jsonDecoded, yamlDecoded) {
+		t.Errorf("decoded json and yaml objects differ:\n%s", cmp.Diff(jsonDecoded, yamlDecoded))
+	}
+	yamlBytes := bytes.NewBuffer(nil)
+	if err := c.YAML.Encode(yamlDecoded, yamlBytes); err != nil {
+		t.Fatalf("error encoding yaml: %v", err)
+	}
+	yamlAfterRoundTrip := yamlBytes.Bytes()
+
+	protoDecoded := emptyObj.DeepCopyObject()
+	protoDecoded, _, err = c.Proto.Decode(protoBeforeRoundTrip, &gvk, protoDecoded)
+	if err != nil {
+		t.Fatal(err)
+	} else if !apiequality.Semantic.DeepEqual(jsonDecoded, protoDecoded) {
+		t.Errorf("decoded json and proto objects differ:\n%s", cmp.Diff(jsonDecoded, protoDecoded))
+	}
+	protoBytes := bytes.NewBuffer(nil)
+	if err := c.Proto.Encode(protoDecoded, protoBytes); err != nil {
+		t.Fatalf("error encoding proto: %v", err)
+	}
+	protoAfterRoundTrip := protoBytes.Bytes()
+
+	jsonNeedsRemove := false
+	yamlNeedsRemove := false
+	protoNeedsRemove := false
+
+	expectedJSONAfterRoundTrip, expectedYAMLAfterRoundTrip, expectedProtoAfterRoundTrip, _ := read(previousVersionDir, gvk, ".after_roundtrip", usedFiles)
+	if len(expectedJSONAfterRoundTrip) == 0 {
+		expectedJSONAfterRoundTrip = jsonBeforeRoundTrip
+	} else if bytes.Equal(jsonBeforeRoundTrip, expectedJSONAfterRoundTrip) {
+		t.Errorf("JSON after_roundtrip file is identical and should be removed")
+		jsonNeedsRemove = true
+	}
+	if len(expectedYAMLAfterRoundTrip) == 0 {
+		expectedYAMLAfterRoundTrip = yamlBeforeRoundTrip
+	} else if bytes.Equal(yamlBeforeRoundTrip, expectedYAMLAfterRoundTrip) {
+		t.Errorf("YAML after_roundtrip file is identical and should be removed")
+		yamlNeedsRemove = true
+	}
+	if len(expectedProtoAfterRoundTrip) == 0 {
+		expectedProtoAfterRoundTrip = protoBeforeRoundTrip
+	} else if bytes.Equal(protoBeforeRoundTrip, expectedProtoAfterRoundTrip) {
+		t.Errorf("Proto after_roundtrip file is identical and should be removed")
+		protoNeedsRemove = true
+	}
+
+	jsonNeedsUpdate := false
+	yamlNeedsUpdate := false
+	protoNeedsUpdate := false
+
+	if !bytes.Equal(expectedJSONAfterRoundTrip, jsonAfterRoundTrip) {
+		t.Errorf("json differs")
+		t.Log(cmp.Diff(string(expectedJSONAfterRoundTrip), string(jsonAfterRoundTrip)))
+		jsonNeedsUpdate = true
+	}
+
+	if !bytes.Equal(expectedYAMLAfterRoundTrip, yamlAfterRoundTrip) {
+		t.Errorf("yaml differs")
+		t.Log(cmp.Diff(string(expectedYAMLAfterRoundTrip), string(yamlAfterRoundTrip)))
+		yamlNeedsUpdate = true
+	}
+
+	if !bytes.Equal(expectedProtoAfterRoundTrip, protoAfterRoundTrip) {
+		t.Errorf("proto differs")
+		protoNeedsUpdate = true
+		t.Log(cmp.Diff(dumpProto(t, expectedProtoAfterRoundTrip[4:]), dumpProto(t, protoAfterRoundTrip[4:])))
+		// t.Logf("json (for locating the offending field based on surrounding data): %s", string(expectedJSON))
+	}
+
+	if jsonNeedsUpdate || yamlNeedsUpdate || protoNeedsUpdate || jsonNeedsRemove || yamlNeedsRemove || protoNeedsRemove {
+		const updateEnvVar = "UPDATE_COMPATIBILITY_FIXTURE_DATA"
+		if os.Getenv(updateEnvVar) == "true" {
+			if jsonNeedsUpdate {
+				writeFile(t, previousVersionDir, gvk, ".after_roundtrip", "json", jsonAfterRoundTrip)
+			} else if jsonNeedsRemove {
+				deleteFile(t, previousVersionDir, gvk, ".after_roundtrip", "json")
+			}
+
+			if yamlNeedsUpdate {
+				writeFile(t, previousVersionDir, gvk, ".after_roundtrip", "yaml", yamlAfterRoundTrip)
+			} else if yamlNeedsRemove {
+				deleteFile(t, previousVersionDir, gvk, ".after_roundtrip", "yaml")
+			}
+
+			if protoNeedsUpdate {
+				writeFile(t, previousVersionDir, gvk, ".after_roundtrip", "pb", protoAfterRoundTrip)
+			} else if protoNeedsRemove {
+				deleteFile(t, previousVersionDir, gvk, ".after_roundtrip", "pb")
+			}
+			t.Logf("wrote expected compatibility data... verify, commit, and rerun tests")
+		} else {
+			t.Logf("if the diff is expected because of a new type or a new field, re-run with %s=true to update the compatibility data", updateEnvVar)
+		}
+		return
+	}
+}
+
+func makeName(gvk schema.GroupVersionKind) string {
+	g := gvk.Group
+	if g == "" {
+		g = "core"
+	}
+	return g + "." + gvk.Version + "." + gvk.Kind
+}
+
+func dumpProto(t *testing.T, data []byte) string {
+	t.Helper()
+	protoc, err := exec.LookPath("protoc")
+	if err != nil {
+		t.Log(err)
+		return ""
+	}
+	cmd := exec.Command(protoc, "--decode_raw")
+	cmd.Stdin = bytes.NewBuffer(data)
+	d, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Log(err)
+		return ""
+	}
+	return string(d)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/construct.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/construct.go
new file mode 100644
index 0000000000..da334a373b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/construct.go
@@ -0,0 +1,192 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package roundtrip
+
+import (
+	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
+	"time"
+
+	apimeta "k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/intstr"
+)
+
+func defaultFillFuncs() map[reflect.Type]FillFunc {
+	funcs := map[reflect.Type]FillFunc{}
+	funcs[reflect.TypeOf(&runtime.RawExtension{})] = func(s string, i int, obj interface{}) {
+		// generate a raw object in normalized form
+		// TODO: test non-normalized round-tripping... YAMLToJSON normalizes and makes exact comparisons fail
+		obj.(*runtime.RawExtension).Raw = []byte(`{"apiVersion":"example.com/v1","kind":"CustomType","spec":{"replicas":1},"status":{"available":1}}`)
+	}
+	funcs[reflect.TypeOf(&metav1.TypeMeta{})] = func(s string, i int, obj interface{}) {
+		// APIVersion and Kind are not serialized in all formats (notably protobuf), so clear by default for cross-format checking.
+		obj.(*metav1.TypeMeta).APIVersion = ""
+		obj.(*metav1.TypeMeta).Kind = ""
+	}
+	funcs[reflect.TypeOf(&metav1.FieldsV1{})] = func(s string, i int, obj interface{}) {
+		obj.(*metav1.FieldsV1).SetRawString(`{}`)
+	}
+	funcs[reflect.TypeOf(&metav1.Time{})] = func(s string, i int, obj interface{}) {
+		// use the integer as an offset from the year
+		obj.(*metav1.Time).Time = time.Date(2000+i, 1, 1, 1, 1, 1, 0, time.UTC)
+	}
+	funcs[reflect.TypeOf(&metav1.MicroTime{})] = func(s string, i int, obj interface{}) {
+		// use the integer as an offset from the year, and as a microsecond
+		obj.(*metav1.MicroTime).Time = time.Date(2000+i, 1, 1, 1, 1, 1, i*int(time.Microsecond), time.UTC)
+	}
+	funcs[reflect.TypeOf(&intstr.IntOrString{})] = func(s string, i int, obj interface{}) {
+		// use the string as a string value
+		obj.(*intstr.IntOrString).Type = intstr.String
+		obj.(*intstr.IntOrString).StrVal = s + "Value"
+	}
+	return funcs
+}
+
+// CompatibilityTestObject returns a deterministically filled object for the specified GVK
+func CompatibilityTestObject(scheme *runtime.Scheme, gvk schema.GroupVersionKind, fillFuncs map[reflect.Type]FillFunc) (runtime.Object, error) {
+	// Construct the object
+	obj, err := scheme.New(gvk)
+	if err != nil {
+		return nil, err
+	}
+
+	fill("", 0, reflect.TypeOf(obj), reflect.ValueOf(obj), fillFuncs, map[reflect.Type]bool{})
+
+	// Set the kind and apiVersion
+	if typeAcc, err := apimeta.TypeAccessor(obj); err != nil {
+		return nil, err
+	} else {
+		typeAcc.SetKind(gvk.Kind)
+		typeAcc.SetAPIVersion(gvk.GroupVersion().String())
+	}
+
+	return obj, nil
+}
+
+func fill(dataString string, dataInt int, t reflect.Type, v reflect.Value, fillFuncs map[reflect.Type]FillFunc, filledTypes map[reflect.Type]bool) {
+	if filledTypes[t] {
+		// we already filled this type, avoid recursing infinitely
+		return
+	}
+	filledTypes[t] = true
+	defer delete(filledTypes, t)
+
+	// if nil, populate pointers with a zero-value instance of the underlying type
+	if t.Kind() == reflect.Pointer && v.IsNil() {
+		if v.CanSet() {
+			v.Set(reflect.New(t.Elem()))
+		} else if v.IsNil() {
+			panic(fmt.Errorf("unsettable nil pointer of type %v in field %s", t, dataString))
+		}
+	}
+
+	if f, ok := fillFuncs[t]; ok {
+		// use the custom fill function for this type
+		f(dataString, dataInt, v.Interface())
+		return
+	}
+
+	switch t.Kind() {
+	case reflect.Slice:
+		// populate with a single-item slice
+		v.Set(reflect.MakeSlice(t, 1, 1))
+		// recurse to populate the item, preserving the data context
+		if t.Elem().Kind() == reflect.Pointer {
+			fill(dataString, dataInt, t.Elem(), v.Index(0), fillFuncs, filledTypes)
+		} else {
+			fill(dataString, dataInt, reflect.PointerTo(t.Elem()), v.Index(0).Addr(), fillFuncs, filledTypes)
+		}
+
+	case reflect.Map:
+		// construct the key, which must be a string type, possibly converted to a type alias of string
+		key := reflect.ValueOf(dataString + "Key").Convert(t.Key())
+		// construct a zero-value item
+		item := reflect.New(t.Elem())
+		// recurse to populate the item, preserving the data context
+		fill(dataString, dataInt, t.Elem(), item.Elem(), fillFuncs, filledTypes)
+		// store in the map
+		v.Set(reflect.MakeMap(t))
+		v.SetMapIndex(key, item.Elem())
+
+	case reflect.Struct:
+		for i := 0; i < t.NumField(); i++ {
+			field := t.Field(i)
+
+			if !field.IsExported() {
+				continue
+			}
+
+			// use the json field name, which must be stable
+			jsonTag, _ := field.Tag.Lookup("json")
+			dataString = strings.Split(jsonTag, ",")[0]
+			if dataString == "-" {
+				// unserialized field, no need to fill it
+				continue
+			}
+			if len(dataString) == 0 {
+				// fall back to the struct field name if there is no json field name
+				dataString = "<no json tag> " + field.Name
+			}
+
+			// use the protobuf tag, which must be stable
+			dataInt := 0
+			if protobufTagParts := strings.Split(field.Tag.Get("protobuf"), ","); len(protobufTagParts) > 1 {
+				if tag, err := strconv.Atoi(protobufTagParts[1]); err != nil {
+					panic(err)
+				} else {
+					dataInt = tag
+				}
+			}
+			if dataInt == 0 {
+				// fall back to the length of dataString as a backup
+				dataInt = -len(dataString)
+			}
+
+			fieldType := field.Type
+			fieldValue := v.Field(i)
+
+			fill(dataString, dataInt, reflect.PointerTo(fieldType), fieldValue.Addr(), fillFuncs, filledTypes)
+		}
+
+	case reflect.Pointer:
+		fill(dataString, dataInt, t.Elem(), v.Elem(), fillFuncs, filledTypes)
+
+	case reflect.String:
+		// use Convert to set into string alias types correctly
+		v.Set(reflect.ValueOf(dataString + "Value").Convert(t))
+
+	case reflect.Bool:
+		// set to true to ensure we serialize omitempty fields
+		v.Set(reflect.ValueOf(true).Convert(t))
+
+	case reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		// use Convert to set into int alias types and different int widths correctly
+		v.Set(reflect.ValueOf(dataInt).Convert(t))
+
+	case reflect.Float32, reflect.Float64:
+		// use Convert to set into float types
+		v.Set(reflect.ValueOf(float32(dataInt) + 0.5).Convert(t))
+
+	default:
+		panic(fmt.Errorf("unhandled type %v in field %s", t, dataString))
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/fuzz_norace.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/fuzz_norace.go
new file mode 100644
index 0000000000..23057619b1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/fuzz_norace.go
@@ -0,0 +1,22 @@
+//go:build !race
+
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package roundtrip
+
+// in non-race-detection mode, a higher number of iterations is reasonable
+const defaultFuzzIters = 20
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/fuzz_race.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/fuzz_race.go
new file mode 100644
index 0000000000..f7ebb8c170
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/fuzz_race.go
@@ -0,0 +1,22 @@
+//go:build race
+
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package roundtrip
+
+// in race-detection mode, lower the number of iterations to keep reasonable runtimes in CI
+const defaultFuzzIters = 5
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/roundtrip.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/roundtrip.go
new file mode 100644
index 0000000000..7a6cb93f5e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/roundtrip.go
@@ -0,0 +1,434 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package roundtrip
+
+import (
+	"bytes"
+	"encoding/hex"
+	"math/rand"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	flag "github.com/spf13/pflag"
+	"sigs.k8s.io/randfill"
+
+	apitesting "k8s.io/apimachinery/pkg/api/apitesting"
+	"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	apimeta "k8s.io/apimachinery/pkg/api/meta"
+	metafuzzer "k8s.io/apimachinery/pkg/apis/meta/fuzzer"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+	"k8s.io/apimachinery/pkg/runtime/serializer/protobuf"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/utils/dump"
+)
+
+type InstallFunc func(scheme *runtime.Scheme)
+
+// RoundTripTestForAPIGroup is convenient to call from your install package to make sure that a "bare" install of your group provides
+// enough information to round trip
+func RoundTripTestForAPIGroup(t *testing.T, installFn InstallFunc, fuzzingFuncs fuzzer.FuzzerFuncs) {
+	scheme := runtime.NewScheme()
+	installFn(scheme)
+
+	RoundTripTestForScheme(t, scheme, fuzzingFuncs)
+}
+
+// RoundTripTestForScheme is convenient to call if you already have a scheme and want to make sure that its well-formed
+func RoundTripTestForScheme(t *testing.T, scheme *runtime.Scheme, fuzzingFuncs fuzzer.FuzzerFuncs) {
+	codecFactory := runtimeserializer.NewCodecFactory(scheme)
+	f := fuzzer.FuzzerFor(
+		fuzzer.MergeFuzzerFuncs(metafuzzer.Funcs, fuzzingFuncs),
+		rand.NewSource(rand.Int63()),
+		codecFactory,
+	)
+	RoundTripTypesWithoutProtobuf(t, scheme, codecFactory, f, nil)
+}
+
+// RoundTripProtobufTestForAPIGroup is convenient to call from your install package to make sure that a "bare" install of your group provides
+// enough information to round trip
+func RoundTripProtobufTestForAPIGroup(t *testing.T, installFn InstallFunc, fuzzingFuncs fuzzer.FuzzerFuncs) {
+	scheme := runtime.NewScheme()
+	installFn(scheme)
+
+	RoundTripProtobufTestForScheme(t, scheme, fuzzingFuncs)
+}
+
+// RoundTripProtobufTestForScheme is convenient to call if you already have a scheme and want to make sure that its well-formed
+func RoundTripProtobufTestForScheme(t *testing.T, scheme *runtime.Scheme, fuzzingFuncs fuzzer.FuzzerFuncs) {
+	codecFactory := runtimeserializer.NewCodecFactory(scheme)
+	fuzzer := fuzzer.FuzzerFor(
+		fuzzer.MergeFuzzerFuncs(metafuzzer.Funcs, fuzzingFuncs),
+		rand.NewSource(rand.Int63()),
+		codecFactory,
+	)
+	RoundTripTypes(t, scheme, codecFactory, fuzzer, nil)
+}
+
+var FuzzIters = flag.Int("fuzz-iters", defaultFuzzIters, "How many fuzzing iterations to do.")
+
+// globalNonRoundTrippableTypes are kinds that are effectively reserved across all GroupVersions
+// They don't roundtrip
+var globalNonRoundTrippableTypes = sets.NewString(
+	"ExportOptions",
+	"GetOptions",
+	// WatchEvent does not include kind and version and can only be deserialized
+	// implicitly (if the caller expects the specific object). The watch call defines
+	// the schema by content type, rather than via kind/version included in each
+	// object.
+	"WatchEvent",
+	// ListOptions is now part of the meta group
+	"ListOptions",
+	// Delete options is only read in metav1
+	"DeleteOptions",
+)
+
+// GlobalNonRoundTrippableTypes returns the kinds that are effectively reserved across all GroupVersions.
+// They don't roundtrip and thus can be excluded in any custom/downstream roundtrip tests
+//
+//	kinds := scheme.AllKnownTypes()
+//	for gvk := range kinds {
+//	    if roundtrip.GlobalNonRoundTrippableTypes().Has(gvk.Kind) {
+//	        continue
+//	    }
+//	    t.Run(gvk.Group+"."+gvk.Version+"."+gvk.Kind, func(t *testing.T) {
+//	        // roundtrip test
+//	    })
+//	}
+func GlobalNonRoundTrippableTypes() sets.String {
+	return sets.NewString(globalNonRoundTrippableTypes.List()...)
+}
+
+// RoundTripTypesWithoutProtobuf applies the round-trip test to all round-trippable Kinds
+// in the scheme.  It will skip all the GroupVersionKinds in the skip list.
+func RoundTripTypesWithoutProtobuf(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+	roundTripTypes(t, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, true)
+}
+
+func RoundTripTypes(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+	roundTripTypes(t, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, false)
+}
+
+func roundTripTypes(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool, skipProtobuf bool) {
+	for _, group := range groupsFromScheme(scheme) {
+		t.Logf("starting group %q", group)
+		internalVersion := schema.GroupVersion{Group: group, Version: runtime.APIVersionInternal}
+		internalKindToGoType := scheme.KnownTypes(internalVersion)
+
+		for kind := range internalKindToGoType {
+			if globalNonRoundTrippableTypes.Has(kind) {
+				continue
+			}
+
+			internalGVK := internalVersion.WithKind(kind)
+			roundTripSpecificKind(t, internalGVK, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, skipProtobuf)
+		}
+
+		t.Logf("finished group %q", group)
+	}
+}
+
+// RoundTripExternalTypes applies the round-trip test to all external round-trippable Kinds
+// in the scheme.  It will skip all the GroupVersionKinds in the nonRoundTripExternalTypes list .
+func RoundTripExternalTypes(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+	kinds := scheme.AllKnownTypes()
+	for gvk := range kinds {
+		if gvk.Version == runtime.APIVersionInternal || globalNonRoundTrippableTypes.Has(gvk.Kind) {
+			continue
+		}
+		t.Run(gvk.Group+"."+gvk.Version+"."+gvk.Kind, func(t *testing.T) {
+			roundTripSpecificKind(t, gvk, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, false)
+		})
+	}
+}
+
+// RoundTripExternalTypesWithoutProtobuf applies the round-trip test to all external round-trippable Kinds
+// in the scheme.  It will skip all the GroupVersionKinds in the nonRoundTripExternalTypes list.
+func RoundTripExternalTypesWithoutProtobuf(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+	kinds := scheme.AllKnownTypes()
+	for gvk := range kinds {
+		if gvk.Version == runtime.APIVersionInternal || globalNonRoundTrippableTypes.Has(gvk.Kind) {
+			continue
+		}
+		t.Run(gvk.Group+"."+gvk.Version+"."+gvk.Kind, func(t *testing.T) {
+			roundTripSpecificKind(t, gvk, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, true)
+		})
+	}
+}
+
+func RoundTripSpecificKindWithoutProtobuf(t *testing.T, gvk schema.GroupVersionKind, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+	roundTripSpecificKind(t, gvk, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, true)
+}
+
+func RoundTripSpecificKind(t *testing.T, gvk schema.GroupVersionKind, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+	roundTripSpecificKind(t, gvk, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, false)
+}
+
+func roundTripSpecificKind(t *testing.T, gvk schema.GroupVersionKind, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool, skipProtobuf bool) {
+	if nonRoundTrippableTypes[gvk] {
+		t.Logf("skipping %v", gvk)
+		return
+	}
+
+	// Try a few times, since runTest uses random values.
+	for i := 0; i < *FuzzIters; i++ {
+		if gvk.Version == runtime.APIVersionInternal {
+			roundTripToAllExternalVersions(t, scheme, codecFactory, fuzzer, gvk, nonRoundTrippableTypes, skipProtobuf)
+		} else {
+			roundTripOfExternalType(t, scheme, codecFactory, fuzzer, gvk, skipProtobuf)
+		}
+		if t.Failed() {
+			break
+		}
+	}
+}
+
+// fuzzInternalObject fuzzes an arbitrary runtime object using the appropriate
+// fuzzer registered with the apitesting package.
+func fuzzInternalObject(t *testing.T, fuzzer *randfill.Filler, object runtime.Object) runtime.Object {
+	fuzzer.Fill(object)
+
+	j, err := apimeta.TypeAccessor(object)
+	if err != nil {
+		t.Fatalf("Unexpected error %v for %#v", err, object)
+	}
+	j.SetKind("")
+	j.SetAPIVersion("")
+
+	return object
+}
+
+func groupsFromScheme(scheme *runtime.Scheme) []string {
+	ret := sets.String{}
+	for gvk := range scheme.AllKnownTypes() {
+		ret.Insert(gvk.Group)
+	}
+	return ret.List()
+}
+
+func roundTripToAllExternalVersions(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, internalGVK schema.GroupVersionKind, nonRoundTrippableTypes map[schema.GroupVersionKind]bool, skipProtobuf bool) {
+	object, err := scheme.New(internalGVK)
+	if err != nil {
+		t.Fatalf("Couldn't make a %v? %v", internalGVK, err)
+	}
+	if _, err := apimeta.TypeAccessor(object); err != nil {
+		t.Fatalf("%q is not a TypeMeta and cannot be tested - add it to nonRoundTrippableInternalTypes: %v", internalGVK, err)
+	}
+
+	fuzzInternalObject(t, fuzzer, object)
+
+	// find all potential serializations in the scheme.
+	// TODO fix this up to handle kinds that cross registered with different names.
+	for externalGVK, externalGoType := range scheme.AllKnownTypes() {
+		if externalGVK.Version == runtime.APIVersionInternal {
+			continue
+		}
+		if externalGVK.GroupKind() != internalGVK.GroupKind() {
+			continue
+		}
+		if nonRoundTrippableTypes[externalGVK] {
+			t.Logf("\tskipping  %v %v", externalGVK, externalGoType)
+			continue
+		}
+		t.Logf("\tround tripping to %v %v", externalGVK, externalGoType)
+
+		roundTrip(t, scheme, apitesting.TestCodec(codecFactory, externalGVK.GroupVersion()), object)
+
+		// TODO remove this hack after we're past the intermediate steps
+		if !skipProtobuf && externalGVK.Group != "kubeadm.k8s.io" {
+			s := protobuf.NewSerializer(scheme, scheme)
+			protobufCodec := codecFactory.CodecForVersions(s, s, externalGVK.GroupVersion(), nil)
+			roundTrip(t, scheme, protobufCodec, object)
+		}
+	}
+}
+
+func roundTripOfExternalType(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, externalGVK schema.GroupVersionKind, skipProtobuf bool) {
+	object, err := scheme.New(externalGVK)
+	if err != nil {
+		t.Fatalf("Couldn't make a %v? %v", externalGVK, err)
+	}
+	typeAcc, err := apimeta.TypeAccessor(object)
+	if err != nil {
+		t.Fatalf("%q is not a TypeMeta and cannot be tested - add it to nonRoundTrippableInternalTypes: %v", externalGVK, err)
+	}
+
+	fuzzInternalObject(t, fuzzer, object)
+
+	typeAcc.SetKind(externalGVK.Kind)
+	typeAcc.SetAPIVersion(externalGVK.GroupVersion().String())
+
+	roundTrip(t, scheme, json.NewSerializerWithOptions(json.DefaultMetaFactory, scheme, scheme, json.SerializerOptions{}), object)
+
+	// TODO remove this hack after we're past the intermediate steps
+	if !skipProtobuf {
+		roundTrip(t, scheme, protobuf.NewSerializer(scheme, scheme), object)
+	}
+}
+
+// roundTrip applies a single round-trip test to the given runtime object
+// using the given codec.  The round-trip test ensures that an object can be
+// deep-copied, converted, marshaled and back without loss of data.
+//
+// For internal types this means
+//
+//	internal -> external -> json/protobuf -> external -> internal.
+//
+// For external types this means
+//
+//	external -> json/protobuf -> external.
+func roundTrip(t *testing.T, scheme *runtime.Scheme, codec runtime.Codec, object runtime.Object) {
+	original := object
+
+	// deep copy the original object
+	object = object.DeepCopyObject()
+	name := reflect.TypeOf(object).Elem().Name()
+	if !apiequality.Semantic.DeepEqual(original, object) {
+		t.Errorf("%v: DeepCopy altered the object, diff: %v", name, cmp.Diff(original, object))
+		t.Errorf("%s", dump.Pretty(original))
+		t.Errorf("%s", dump.Pretty(object))
+		return
+	}
+
+	// encode (serialize) the deep copy using the provided codec
+	data, err := runtime.Encode(codec, object)
+	if err != nil {
+		if runtime.IsNotRegisteredError(err) {
+			t.Logf("%v: not registered: %v (%s)", name, err, dump.Pretty(object))
+		} else {
+			t.Errorf("%v: %v (%s)", name, err, dump.Pretty(object))
+		}
+		return
+	}
+
+	// ensure that the deep copy is equal to the original; neither the deep
+	// copy or conversion should alter the object
+	// TODO eliminate this global
+	if !apiequality.Semantic.DeepEqual(original, object) {
+		t.Errorf("%v: encode altered the object, diff: %v", name, cmp.Diff(original, object))
+		return
+	}
+
+	// encode (serialize) a second time to verify that it was not varying
+	secondData, err := runtime.Encode(codec, object)
+	if err != nil {
+		if runtime.IsNotRegisteredError(err) {
+			t.Logf("%v: not registered: %v (%s)", name, err, dump.Pretty(object))
+		} else {
+			t.Errorf("%v: %v (%s)", name, err, dump.Pretty(object))
+		}
+		return
+	}
+
+	// serialization to the wire must be stable to ensure that we don't write twice to the DB
+	// when the object hasn't changed.
+	if !bytes.Equal(data, secondData) {
+		t.Errorf("%v: serialization is not stable: %s", name, dump.Pretty(object))
+	}
+
+	// decode (deserialize) the encoded data back into an object
+	obj2, err := runtime.Decode(codec, data)
+	if err != nil {
+		t.Errorf("%v: %v\nCodec: %#v\nData: %s\nSource: %s", name, err, codec, dataAsString(data), dump.Pretty(object))
+		panic("failed")
+	}
+
+	// ensure that the object produced from decoding the encoded data is equal
+	// to the original object
+	if !apiequality.Semantic.DeepEqual(original, obj2) {
+		t.Errorf("%v: diff: %v\nCodec: %#v\nSource:\n\n%s\n\nEncoded:\n\n%s\n\nFinal:\n\n%s", name, cmp.Diff(original, obj2), codec, dump.Pretty(original), dataAsString(data), dump.Pretty(obj2))
+		return
+	}
+
+	// decode the encoded data into a new object (instead of letting the codec
+	// create a new object)
+	obj3 := reflect.New(reflect.TypeOf(object).Elem()).Interface().(runtime.Object)
+	if err := runtime.DecodeInto(codec, data, obj3); err != nil {
+		t.Errorf("%v: %v", name, err)
+		return
+	}
+
+	// special case for kinds which are internal and external at the same time (many in meta.k8s.io are). For those
+	// runtime.DecodeInto above will return the external variant and set the APIVersion and kind, while the input
+	// object might be internal. Hence, we clear those values for obj3 for that case to correctly compare.
+	intAndExt, err := internalAndExternalKind(scheme, object)
+	if err != nil {
+		t.Errorf("%v: %v", name, err)
+		return
+	}
+	if intAndExt {
+		typeAcc, err := apimeta.TypeAccessor(object)
+		if err != nil {
+			t.Fatalf("%v: error accessing TypeMeta: %v", name, err)
+		}
+		if len(typeAcc.GetAPIVersion()) == 0 {
+			typeAcc, err := apimeta.TypeAccessor(obj3)
+			if err != nil {
+				t.Fatalf("%v: error accessing TypeMeta: %v", name, err)
+			}
+			typeAcc.SetAPIVersion("")
+			typeAcc.SetKind("")
+		}
+	}
+
+	// ensure that the new runtime object is equal to the original after being
+	// decoded into
+	if !apiequality.Semantic.DeepEqual(object, obj3) {
+		t.Errorf("%v: diff: %v\nCodec: %#v", name, cmp.Diff(object, obj3), codec)
+		return
+	}
+
+	// do structure-preserving fuzzing of the deep-copied object. If it shares anything with the original,
+	// the deep-copy was actually only a shallow copy. Then original and obj3 will be different after fuzzing.
+	// NOTE: we use the encoding+decoding here as an alternative, guaranteed deep-copy to compare against.
+	fuzzer.ValueFuzz(object)
+	if !apiequality.Semantic.DeepEqual(original, obj3) {
+		t.Errorf("%v: fuzzing a copy altered the original, diff: %v", name, cmp.Diff(original, obj3))
+		return
+	}
+}
+
+func internalAndExternalKind(scheme *runtime.Scheme, object runtime.Object) (bool, error) {
+	kinds, _, err := scheme.ObjectKinds(object)
+	if err != nil {
+		return false, err
+	}
+	internal, external := false, false
+	for _, k := range kinds {
+		if k.Version == runtime.APIVersionInternal {
+			internal = true
+		} else {
+			external = true
+		}
+	}
+	return internal && external, nil
+}
+
+// dataAsString returns the given byte array as a string; handles detecting
+// protocol buffers.
+func dataAsString(data []byte) string {
+	dataString := string(data)
+	if !strings.HasPrefix(dataString, "{") {
+		dataString = "\n" + hex.Dump(data)
+	}
+	return dataString
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/unstructured.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/unstructured.go
new file mode 100644
index 0000000000..f1794943d2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/unstructured.go
@@ -0,0 +1,247 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package roundtrip
+
+import (
+	"bytes"
+	"fmt"
+	"math/rand"
+	"os"
+	"strconv"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	metafuzzer "k8s.io/apimachinery/pkg/apis/meta/fuzzer"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	cborserializer "k8s.io/apimachinery/pkg/runtime/serializer/cbor"
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	jsonserializer "k8s.io/apimachinery/pkg/runtime/serializer/json"
+	"k8s.io/apimachinery/pkg/util/sets"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+// RoundtripToUnstructured verifies the roundtrip faithfulness of all external types in a scheme
+// from native to unstructured and back using both the JSON and CBOR serializers. The intermediate
+// unstructured objects produced by both encodings must be identical and be themselves
+// roundtrippable to JSON and CBOR.
+//
+// Values for all external types in the scheme are generated by fuzzing the a value of the
+// corresponding internal type and converting it, except for types whose registered GVK appears in
+// the "nointernal" set, which are fuzzed directly.
+func RoundtripToUnstructured(t *testing.T, scheme *runtime.Scheme, funcs fuzzer.FuzzerFuncs, skipped sets.Set[schema.GroupVersionKind], nointernal sets.Set[schema.GroupVersionKind]) {
+	codecs := serializer.NewCodecFactory(scheme)
+
+	seed := int64(time.Now().Nanosecond())
+	if override := os.Getenv("TEST_RAND_SEED"); len(override) > 0 {
+		overrideSeed, err := strconv.ParseInt(override, 10, 64)
+		if err != nil {
+			t.Fatal(err)
+		}
+		seed = overrideSeed
+		t.Logf("using overridden seed: %d", seed)
+	} else {
+		t.Logf("seed (override with TEST_RAND_SEED if desired): %d", seed)
+	}
+
+	var buf bytes.Buffer
+	for gvk := range scheme.AllKnownTypes() {
+		if globalNonRoundTrippableTypes.Has(gvk.Kind) {
+			continue
+		}
+
+		if gvk.Version == runtime.APIVersionInternal {
+			continue
+		}
+
+		subtestName := fmt.Sprintf("%s.%s/%s", gvk.Version, gvk.Group, gvk.Kind)
+		if gvk.Group == "" {
+			subtestName = fmt.Sprintf("%s/%s", gvk.Version, gvk.Kind)
+		}
+
+		t.Run(subtestName, func(t *testing.T) {
+			if skipped.Has(gvk) {
+				t.SkipNow()
+			}
+
+			fuzzer := fuzzer.FuzzerFor(fuzzer.MergeFuzzerFuncs(metafuzzer.Funcs, funcs), rand.NewSource(seed), codecs)
+
+			for i := 0; i < *FuzzIters; i++ {
+				item, err := scheme.New(gvk)
+				if err != nil {
+					t.Fatalf("couldn't create external object %v: %v", gvk.Kind, err)
+				}
+
+				if nointernal.Has(gvk) {
+					fuzzer.Fill(item)
+				} else {
+					internalObj, err := scheme.New(gvk.GroupKind().WithVersion(runtime.APIVersionInternal))
+					if err != nil {
+						t.Fatalf("couldn't create internal object %v: %v", gvk.Kind, err)
+					}
+					fuzzer.Fill(internalObj)
+
+					if err := scheme.Convert(internalObj, item, nil); err != nil {
+						t.Fatalf("conversion for %v failed: %v", gvk.Kind, err)
+					}
+				}
+
+				// Decoding into Unstructured requires that apiVersion and kind be
+				// serialized, so populate TypeMeta.
+				item.GetObjectKind().SetGroupVersionKind(gvk)
+
+				jsonSerializer := jsonserializer.NewSerializerWithOptions(jsonserializer.DefaultMetaFactory, scheme, scheme, jsonserializer.SerializerOptions{})
+				cborSerializer := cborserializer.NewSerializer(scheme, scheme)
+
+				// original->JSON->Unstructured
+				buf.Reset()
+				if err := jsonSerializer.Encode(item, &buf); err != nil {
+					t.Fatalf("error encoding native to json: %v", err)
+				}
+				var uJSON runtime.Object = &unstructured.Unstructured{}
+				uJSON, _, err = jsonSerializer.Decode(buf.Bytes(), &gvk, uJSON)
+				if err != nil {
+					t.Fatalf("error decoding json to unstructured: %v", err)
+				}
+
+				// original->CBOR->Unstructured
+				buf.Reset()
+				if err := cborSerializer.Encode(item, &buf); err != nil {
+					t.Fatalf("error encoding native to cbor: %v", err)
+				}
+				var uCBOR runtime.Object = &unstructured.Unstructured{}
+				uCBOR, _, err = cborSerializer.Decode(buf.Bytes(), &gvk, uCBOR)
+				if err != nil {
+					diag, _ := cbor.Diagnose(buf.Bytes())
+					t.Fatalf("error decoding cbor to unstructured: %v, diag: %s", err, diag)
+				}
+
+				// original->JSON->Unstructured == original->CBOR->Unstructured
+				if !apiequality.Semantic.DeepEqual(uJSON, uCBOR) {
+					t.Fatalf("unstructured via json differed from unstructured via cbor: %v", cmp.Diff(uJSON, uCBOR))
+				}
+
+				// original->CBOR(nondeterministic)->Unstructured
+				buf.Reset()
+				if err := cborSerializer.EncodeNondeterministic(item, &buf); err != nil {
+					t.Fatalf("error encoding native to cbor: %v", err)
+				}
+				var uCBORNondeterministic runtime.Object = &unstructured.Unstructured{}
+				uCBORNondeterministic, _, err = cborSerializer.Decode(buf.Bytes(), &gvk, uCBORNondeterministic)
+				if err != nil {
+					diag, _ := cbor.Diagnose(buf.Bytes())
+					t.Fatalf("error decoding cbor to unstructured: %v, diag: %s", err, diag)
+				}
+
+				// original->CBOR->Unstructured == original->CBOR(nondeterministic)->Unstructured
+				if !apiequality.Semantic.DeepEqual(uCBOR, uCBORNondeterministic) {
+					t.Fatalf("unstructured via nondeterministic cbor differed from unstructured via cbor: %v", cmp.Diff(uCBOR, uCBORNondeterministic))
+				}
+
+				// original->JSON/CBOR->Unstructured == original->JSON/CBOR->Unstructured->JSON->Unstructured
+				buf.Reset()
+				if err := jsonSerializer.Encode(uJSON, &buf); err != nil {
+					t.Fatalf("error encoding unstructured to json: %v", err)
+				}
+				var uJSON2 runtime.Object = &unstructured.Unstructured{}
+				uJSON2, _, err = jsonSerializer.Decode(buf.Bytes(), &gvk, uJSON2)
+				if err != nil {
+					t.Fatalf("error decoding json to unstructured: %v", err)
+				}
+				if !apiequality.Semantic.DeepEqual(uJSON, uJSON2) {
+					t.Errorf("object changed during native-json-unstructured-json-unstructured roundtrip, diff: %s", cmp.Diff(uJSON, uJSON2))
+				}
+
+				// original->JSON/CBOR->Unstructured == original->JSON/CBOR->Unstructured->CBOR->Unstructured
+				buf.Reset()
+				if err := cborSerializer.Encode(uCBOR, &buf); err != nil {
+					t.Fatalf("error encoding unstructured to cbor: %v", err)
+				}
+				var uCBOR2 runtime.Object = &unstructured.Unstructured{}
+				uCBOR2, _, err = cborSerializer.Decode(buf.Bytes(), &gvk, uCBOR2)
+				if err != nil {
+					diag, _ := cbor.Diagnose(buf.Bytes())
+					t.Fatalf("error decoding cbor to unstructured: %v, diag: %s", err, diag)
+				}
+				if !apiequality.Semantic.DeepEqual(uCBOR, uCBOR2) {
+					t.Errorf("object changed during native-cbor-unstructured-cbor-unstructured roundtrip, diff: %s", cmp.Diff(uCBOR, uCBOR2))
+				}
+
+				// original->JSON/CBOR->Unstructured->CBOR->Unstructured == original->JSON/CBOR->Unstructured->CBOR(nondeterministic)->Unstructured
+				buf.Reset()
+				if err := cborSerializer.EncodeNondeterministic(uCBOR, &buf); err != nil {
+					t.Fatalf("error encoding unstructured to cbor: %v", err)
+				}
+				var uCBOR2Nondeterministic runtime.Object = &unstructured.Unstructured{}
+				uCBOR2Nondeterministic, _, err = cborSerializer.Decode(buf.Bytes(), &gvk, uCBOR2Nondeterministic)
+				if err != nil {
+					diag, _ := cbor.Diagnose(buf.Bytes())
+					t.Fatalf("error decoding cbor to unstructured: %v, diag: %s", err, diag)
+				}
+				if !apiequality.Semantic.DeepEqual(uCBOR, uCBOR2Nondeterministic) {
+					t.Errorf("object changed during native-cbor-unstructured-cbor(nondeterministic)-unstructured roundtrip, diff: %s", cmp.Diff(uCBOR, uCBOR2Nondeterministic))
+				}
+
+				// original->JSON/CBOR->Unstructured->JSON->final == original
+				buf.Reset()
+				if err := jsonSerializer.Encode(uJSON, &buf); err != nil {
+					t.Fatalf("error encoding unstructured to json: %v", err)
+				}
+				finalJSON, _, err := jsonSerializer.Decode(buf.Bytes(), &gvk, nil)
+				if err != nil {
+					t.Fatalf("error decoding json to native: %v", err)
+				}
+				if !apiequality.Semantic.DeepEqual(item, finalJSON) {
+					t.Errorf("object changed during native-json-unstructured-json-native roundtrip, diff: %s", cmp.Diff(item, finalJSON))
+				}
+
+				// original->JSON/CBOR->Unstructured->CBOR->final == original
+				buf.Reset()
+				if err := cborSerializer.Encode(uCBOR, &buf); err != nil {
+					t.Fatalf("error encoding unstructured to cbor: %v", err)
+				}
+				finalCBOR, _, err := cborSerializer.Decode(buf.Bytes(), &gvk, nil)
+				if err != nil {
+					diag, _ := cbor.Diagnose(buf.Bytes())
+					t.Fatalf("error decoding cbor to native: %v, diag: %s", err, diag)
+				}
+				if !apiequality.Semantic.DeepEqual(item, finalCBOR) {
+					t.Errorf("object changed during native-cbor-unstructured-cbor-native roundtrip, diff: %s", cmp.Diff(item, finalCBOR))
+				}
+
+				// original->JSON/CBOR->Unstructured->CBOR(nondeterministic)->final == original
+				buf.Reset()
+				if err := cborSerializer.EncodeNondeterministic(uCBOR, &buf); err != nil {
+					t.Fatalf("error encoding unstructured to cbor: %v", err)
+				}
+				finalCBORNondeterministic, _, err := cborSerializer.Decode(buf.Bytes(), &gvk, nil)
+				if err != nil {
+					diag, _ := cbor.Diagnose(buf.Bytes())
+					t.Fatalf("error decoding cbor to native: %v, diag: %s", err, diag)
+				}
+				if !apiequality.Semantic.DeepEqual(item, finalCBORNondeterministic) {
+					t.Errorf("object changed during native-cbor-unstructured-cbor-native roundtrip, diff: %s", cmp.Diff(item, finalCBORNondeterministic))
+				}
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/equality/semantic.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/equality/semantic.go
new file mode 100644
index 0000000000..cd78c38416
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/equality/semantic.go
@@ -0,0 +1,52 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package equality
+
+import (
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+)
+
+// Semantic can do semantic deep equality checks for api objects.
+// Example: apiequality.Semantic.DeepEqual(aPod, aPodWithNonNilButEmptyMaps) == true
+var Semantic = conversion.EqualitiesOrDie(
+	func(a, b resource.Quantity) bool {
+		// Ignore formatting, only care that numeric value stayed the same.
+		// TODO: if we decide it's important, it should be safe to start comparing the format.
+		//
+		// Uninitialized quantities are equivalent to 0 quantities.
+		return a.Cmp(b) == 0
+	},
+	func(a, b metav1.MicroTime) bool {
+		return a.UTC() == b.UTC()
+	},
+	func(a, b metav1.Time) bool {
+		return a.UTC() == b.UTC()
+	},
+	func(a, b metav1.FieldsV1) bool {
+		return a.Equal(b)
+	},
+	func(a, b labels.Selector) bool {
+		return a.String() == b.String()
+	},
+	func(a, b fields.Selector) bool {
+		return a.String() == b.String()
+	},
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/errors/OWNERS b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/errors/OWNERS
new file mode 100644
index 0000000000..1a9f5e7706
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/errors/OWNERS
@@ -0,0 +1,16 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+reviewers:
+  - thockin
+  - smarterclayton
+  - wojtek-t
+  - deads2k
+  - derekwaynecarr
+  - caesarxuchao
+  - mikedanese
+  - liggitt
+  - saad-ali
+  - janetkuo
+  - tallclair
+  - dims
+  - cjcullen
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/errors/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/errors/doc.go
new file mode 100644
index 0000000000..58751ed0ec
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/errors/doc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package errors provides detailed error types for api field validation.
+package errors
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/errors/errors.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/errors/errors.go
new file mode 100644
index 0000000000..7b57a9eb6c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/errors/errors.go
@@ -0,0 +1,865 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package errors
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"reflect"
+	"strings"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// StatusError is an error intended for consumption by a REST API server; it can also be
+// reconstructed by clients from a REST response. Public to allow easy type switches.
+type StatusError struct {
+	ErrStatus metav1.Status
+}
+
+// APIStatus is exposed by errors that can be converted to an api.Status object
+// for finer grained details.
+type APIStatus interface {
+	Status() metav1.Status
+}
+
+var _ error = &StatusError{}
+
+var knownReasons = map[metav1.StatusReason]struct{}{
+	// metav1.StatusReasonUnknown : {}
+	metav1.StatusReasonUnauthorized:          {},
+	metav1.StatusReasonForbidden:             {},
+	metav1.StatusReasonNotFound:              {},
+	metav1.StatusReasonAlreadyExists:         {},
+	metav1.StatusReasonConflict:              {},
+	metav1.StatusReasonGone:                  {},
+	metav1.StatusReasonInvalid:               {},
+	metav1.StatusReasonServerTimeout:         {},
+	metav1.StatusReasonStoreReadError:        {},
+	metav1.StatusReasonTimeout:               {},
+	metav1.StatusReasonTooManyRequests:       {},
+	metav1.StatusReasonBadRequest:            {},
+	metav1.StatusReasonMethodNotAllowed:      {},
+	metav1.StatusReasonNotAcceptable:         {},
+	metav1.StatusReasonRequestEntityTooLarge: {},
+	metav1.StatusReasonUnsupportedMediaType:  {},
+	metav1.StatusReasonInternalError:         {},
+	metav1.StatusReasonExpired:               {},
+	metav1.StatusReasonServiceUnavailable:    {},
+}
+
+// Error implements the Error interface.
+func (e *StatusError) Error() string {
+	return e.ErrStatus.Message
+}
+
+// Status allows access to e's status without having to know the detailed workings
+// of StatusError.
+func (e *StatusError) Status() metav1.Status {
+	return e.ErrStatus
+}
+
+// DebugError reports extended info about the error to debug output.
+func (e *StatusError) DebugError() (string, []interface{}) {
+	if out, err := json.MarshalIndent(e.ErrStatus, "", "  "); err == nil {
+		return "server response object: %s", []interface{}{string(out)}
+	}
+	return "server response object: %#v", []interface{}{e.ErrStatus}
+}
+
+// HasStatusCause returns true if the provided error has a details cause
+// with the provided type name.
+// It supports wrapped errors and returns false when the error is nil.
+func HasStatusCause(err error, name metav1.CauseType) bool {
+	_, ok := StatusCause(err, name)
+	return ok
+}
+
+// StatusCause returns the named cause from the provided error if it exists and
+// the error unwraps to the type APIStatus. Otherwise it returns false.
+func StatusCause(err error, name metav1.CauseType) (metav1.StatusCause, bool) {
+	status, ok := err.(APIStatus)
+	if (ok || errors.As(err, &status)) && status.Status().Details != nil {
+		for _, cause := range status.Status().Details.Causes {
+			if cause.Type == name {
+				return cause, true
+			}
+		}
+	}
+	return metav1.StatusCause{}, false
+}
+
+// UnexpectedObjectError can be returned by FromObject if it's passed a non-status object.
+type UnexpectedObjectError struct {
+	Object runtime.Object
+}
+
+// Error returns an error message describing 'u'.
+func (u *UnexpectedObjectError) Error() string {
+	return fmt.Sprintf("unexpected object: %v", u.Object)
+}
+
+// FromObject generates an StatusError from an metav1.Status, if that is the type of obj; otherwise,
+// returns an UnexpecteObjectError.
+func FromObject(obj runtime.Object) error {
+	switch t := obj.(type) {
+	case *metav1.Status:
+		return &StatusError{ErrStatus: *t}
+	case runtime.Unstructured:
+		var status metav1.Status
+		obj := t.UnstructuredContent()
+		if !reflect.DeepEqual(obj["kind"], "Status") {
+			break
+		}
+		if err := runtime.DefaultUnstructuredConverter.FromUnstructured(t.UnstructuredContent(), &status); err != nil {
+			return err
+		}
+		if status.APIVersion != "v1" && status.APIVersion != "meta.k8s.io/v1" {
+			break
+		}
+		return &StatusError{ErrStatus: status}
+	}
+	return &UnexpectedObjectError{obj}
+}
+
+// NewNotFound returns a new error which indicates that the resource of the kind and the name was not found.
+func NewNotFound(qualifiedResource schema.GroupResource, name string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusNotFound,
+		Reason: metav1.StatusReasonNotFound,
+		Details: &metav1.StatusDetails{
+			Group: qualifiedResource.Group,
+			Kind:  qualifiedResource.Resource,
+			Name:  name,
+		},
+		Message: fmt.Sprintf("%s %q not found", qualifiedResource.String(), name),
+	}}
+}
+
+// NewAlreadyExists returns an error indicating the item requested exists by that identifier.
+func NewAlreadyExists(qualifiedResource schema.GroupResource, name string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusConflict,
+		Reason: metav1.StatusReasonAlreadyExists,
+		Details: &metav1.StatusDetails{
+			Group: qualifiedResource.Group,
+			Kind:  qualifiedResource.Resource,
+			Name:  name,
+		},
+		Message: fmt.Sprintf("%s %q already exists", qualifiedResource.String(), name),
+	}}
+}
+
+// NewGenerateNameConflict returns an error indicating the server
+// was not able to generate a valid name for a resource.
+func NewGenerateNameConflict(qualifiedResource schema.GroupResource, name string, retryAfterSeconds int) *StatusError {
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusConflict,
+		Reason: metav1.StatusReasonAlreadyExists,
+		Details: &metav1.StatusDetails{
+			Group:             qualifiedResource.Group,
+			Kind:              qualifiedResource.Resource,
+			Name:              name,
+			RetryAfterSeconds: int32(retryAfterSeconds),
+		},
+		Message: fmt.Sprintf(
+			"%s %q already exists, the server was not able to generate a unique name for the object",
+			qualifiedResource.String(), name),
+	}}
+}
+
+// NewUnauthorized returns an error indicating the client is not authorized to perform the requested
+// action.
+func NewUnauthorized(reason string) *StatusError {
+	message := reason
+	if len(message) == 0 {
+		message = "not authorized"
+	}
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusUnauthorized,
+		Reason:  metav1.StatusReasonUnauthorized,
+		Message: message,
+	}}
+}
+
+// NewForbidden returns an error indicating the requested action was forbidden
+func NewForbidden(qualifiedResource schema.GroupResource, name string, err error) *StatusError {
+	var message string
+	if qualifiedResource.Empty() {
+		message = fmt.Sprintf("forbidden: %v", err)
+	} else if name == "" {
+		message = fmt.Sprintf("%s is forbidden: %v", qualifiedResource.String(), err)
+	} else {
+		message = fmt.Sprintf("%s %q is forbidden: %v", qualifiedResource.String(), name, err)
+	}
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusForbidden,
+		Reason: metav1.StatusReasonForbidden,
+		Details: &metav1.StatusDetails{
+			Group: qualifiedResource.Group,
+			Kind:  qualifiedResource.Resource,
+			Name:  name,
+		},
+		Message: message,
+	}}
+}
+
+// NewConflict returns an error indicating the item can't be updated as provided.
+func NewConflict(qualifiedResource schema.GroupResource, name string, err error) *StatusError {
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusConflict,
+		Reason: metav1.StatusReasonConflict,
+		Details: &metav1.StatusDetails{
+			Group: qualifiedResource.Group,
+			Kind:  qualifiedResource.Resource,
+			Name:  name,
+		},
+		Message: fmt.Sprintf("Operation cannot be fulfilled on %s %q: %v", qualifiedResource.String(), name, err),
+	}}
+}
+
+// NewApplyConflict returns an error including details on the requests apply conflicts
+func NewApplyConflict(causes []metav1.StatusCause, message string) *StatusError {
+	return &StatusError{ErrStatus: metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusConflict,
+		Reason: metav1.StatusReasonConflict,
+		Details: &metav1.StatusDetails{
+			// TODO: Get obj details here?
+			Causes: causes,
+		},
+		Message: message,
+	}}
+}
+
+// NewGone returns an error indicating the item no longer available at the server and no forwarding address is known.
+//
+// Deprecated: Please use NewResourceExpired instead.
+func NewGone(message string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusGone,
+		Reason:  metav1.StatusReasonGone,
+		Message: message,
+	}}
+}
+
+// NewResourceExpired creates an error that indicates that the requested resource content has expired from
+// the server (usually due to a resourceVersion that is too old).
+func NewResourceExpired(message string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusGone,
+		Reason:  metav1.StatusReasonExpired,
+		Message: message,
+	}}
+}
+
+// NewInvalid returns an error indicating the item is invalid and cannot be processed.
+func NewInvalid(qualifiedKind schema.GroupKind, name string, errs field.ErrorList) *StatusError {
+	causes := make([]metav1.StatusCause, 0, len(errs))
+	for i := range errs {
+		err := errs[i]
+		causes = append(causes, metav1.StatusCause{
+			Type:    metav1.CauseType(err.Type),
+			Message: err.ErrorBody(),
+			Field:   err.Field,
+		})
+	}
+	err := &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusUnprocessableEntity,
+		Reason: metav1.StatusReasonInvalid,
+		Details: &metav1.StatusDetails{
+			Group:  qualifiedKind.Group,
+			Kind:   qualifiedKind.Kind,
+			Name:   name,
+			Causes: causes,
+		},
+	}}
+	aggregatedErrs := errs.ToAggregate()
+	if aggregatedErrs == nil {
+		err.ErrStatus.Message = fmt.Sprintf("%s %q is invalid", qualifiedKind.String(), name)
+	} else {
+		err.ErrStatus.Message = fmt.Sprintf("%s %q is invalid: %v", qualifiedKind.String(), name, aggregatedErrs)
+	}
+	return err
+}
+
+// NewBadRequest creates an error that indicates that the request is invalid and can not be processed.
+func NewBadRequest(reason string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusBadRequest,
+		Reason:  metav1.StatusReasonBadRequest,
+		Message: reason,
+	}}
+}
+
+// NewTooManyRequests creates an error that indicates that the client must try again later because
+// the specified endpoint is not accepting requests. More specific details should be provided
+// if client should know why the failure was limited.
+func NewTooManyRequests(message string, retryAfterSeconds int) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusTooManyRequests,
+		Reason:  metav1.StatusReasonTooManyRequests,
+		Message: message,
+		Details: &metav1.StatusDetails{
+			RetryAfterSeconds: int32(retryAfterSeconds),
+		},
+	}}
+}
+
+// NewServiceUnavailable creates an error that indicates that the requested service is unavailable.
+func NewServiceUnavailable(reason string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusServiceUnavailable,
+		Reason:  metav1.StatusReasonServiceUnavailable,
+		Message: reason,
+	}}
+}
+
+// NewMethodNotSupported returns an error indicating the requested action is not supported on this kind.
+func NewMethodNotSupported(qualifiedResource schema.GroupResource, action string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusMethodNotAllowed,
+		Reason: metav1.StatusReasonMethodNotAllowed,
+		Details: &metav1.StatusDetails{
+			Group: qualifiedResource.Group,
+			Kind:  qualifiedResource.Resource,
+		},
+		Message: fmt.Sprintf("%s is not supported on resources of kind %q", action, qualifiedResource.String()),
+	}}
+}
+
+// NewServerTimeout returns an error indicating the requested action could not be completed due to a
+// transient error, and the client should try again.
+func NewServerTimeout(qualifiedResource schema.GroupResource, operation string, retryAfterSeconds int) *StatusError {
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusInternalServerError,
+		Reason: metav1.StatusReasonServerTimeout,
+		Details: &metav1.StatusDetails{
+			Group:             qualifiedResource.Group,
+			Kind:              qualifiedResource.Resource,
+			Name:              operation,
+			RetryAfterSeconds: int32(retryAfterSeconds),
+		},
+		Message: fmt.Sprintf("The %s operation against %s could not be completed at this time, please try again.", operation, qualifiedResource.String()),
+	}}
+}
+
+// NewServerTimeoutForKind should not exist.  Server timeouts happen when accessing resources, the Kind is just what we
+// happened to be looking at when the request failed.  This delegates to keep code sane, but we should work towards removing this.
+func NewServerTimeoutForKind(qualifiedKind schema.GroupKind, operation string, retryAfterSeconds int) *StatusError {
+	return NewServerTimeout(schema.GroupResource{Group: qualifiedKind.Group, Resource: qualifiedKind.Kind}, operation, retryAfterSeconds)
+}
+
+// NewInternalError returns an error indicating the item is invalid and cannot be processed.
+func NewInternalError(err error) *StatusError {
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusInternalServerError,
+		Reason: metav1.StatusReasonInternalError,
+		Details: &metav1.StatusDetails{
+			Causes: []metav1.StatusCause{{Message: err.Error()}},
+		},
+		Message: fmt.Sprintf("Internal error occurred: %v", err),
+	}}
+}
+
+// NewTimeoutError returns an error indicating that a timeout occurred before the request
+// could be completed.  Clients may retry, but the operation may still complete.
+func NewTimeoutError(message string, retryAfterSeconds int) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusGatewayTimeout,
+		Reason:  metav1.StatusReasonTimeout,
+		Message: fmt.Sprintf("Timeout: %s", message),
+		Details: &metav1.StatusDetails{
+			RetryAfterSeconds: int32(retryAfterSeconds),
+		},
+	}}
+}
+
+// NewTooManyRequestsError returns an error indicating that the request was rejected because
+// the server has received too many requests. Client should wait and retry. But if the request
+// is perishable, then the client should not retry the request.
+func NewTooManyRequestsError(message string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusTooManyRequests,
+		Reason:  metav1.StatusReasonTooManyRequests,
+		Message: fmt.Sprintf("Too many requests: %s", message),
+	}}
+}
+
+// NewRequestEntityTooLargeError returns an error indicating that the request
+// entity was too large.
+func NewRequestEntityTooLargeError(message string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusRequestEntityTooLarge,
+		Reason:  metav1.StatusReasonRequestEntityTooLarge,
+		Message: fmt.Sprintf("Request entity too large: %s", message),
+	}}
+}
+
+// NewGenericServerResponse returns a new error for server responses that are not in a recognizable form.
+func NewGenericServerResponse(code int, verb string, qualifiedResource schema.GroupResource, name, serverMessage string, retryAfterSeconds int, isUnexpectedResponse bool) *StatusError {
+	reason := metav1.StatusReasonUnknown
+	message := fmt.Sprintf("the server responded with the status code %d but did not return more information", code)
+	switch code {
+	case http.StatusConflict:
+		if verb == http.MethodPost {
+			reason = metav1.StatusReasonAlreadyExists
+		} else {
+			reason = metav1.StatusReasonConflict
+		}
+		message = "the server reported a conflict"
+	case http.StatusNotFound:
+		reason = metav1.StatusReasonNotFound
+		message = "the server could not find the requested resource"
+	case http.StatusBadRequest:
+		reason = metav1.StatusReasonBadRequest
+		message = "the server rejected our request for an unknown reason"
+	case http.StatusUnauthorized:
+		reason = metav1.StatusReasonUnauthorized
+		message = "the server has asked for the client to provide credentials"
+	case http.StatusForbidden:
+		reason = metav1.StatusReasonForbidden
+		// the server message has details about who is trying to perform what action.  Keep its message.
+		message = serverMessage
+	case http.StatusNotAcceptable:
+		reason = metav1.StatusReasonNotAcceptable
+		// the server message has details about what types are acceptable
+		if len(serverMessage) == 0 || serverMessage == "unknown" {
+			message = "the server was unable to respond with a content type that the client supports"
+		} else {
+			message = serverMessage
+		}
+	case http.StatusUnsupportedMediaType:
+		reason = metav1.StatusReasonUnsupportedMediaType
+		// the server message has details about what types are acceptable
+		message = serverMessage
+	case http.StatusMethodNotAllowed:
+		reason = metav1.StatusReasonMethodNotAllowed
+		message = "the server does not allow this method on the requested resource"
+	case http.StatusUnprocessableEntity:
+		reason = metav1.StatusReasonInvalid
+		message = "the server rejected our request due to an error in our request"
+	case http.StatusServiceUnavailable:
+		reason = metav1.StatusReasonServiceUnavailable
+		message = "the server is currently unable to handle the request"
+	case http.StatusGatewayTimeout:
+		reason = metav1.StatusReasonTimeout
+		message = "the server was unable to return a response in the time allotted, but may still be processing the request"
+	case http.StatusTooManyRequests:
+		reason = metav1.StatusReasonTooManyRequests
+		message = "the server has received too many requests and has asked us to try again later"
+	default:
+		if code >= 500 {
+			reason = metav1.StatusReasonInternalError
+			message = fmt.Sprintf("an error on the server (%q) has prevented the request from succeeding", serverMessage)
+		}
+	}
+	switch {
+	case !qualifiedResource.Empty() && len(name) > 0:
+		message = fmt.Sprintf("%s (%s %s %s)", message, strings.ToLower(verb), qualifiedResource.String(), name)
+	case !qualifiedResource.Empty():
+		message = fmt.Sprintf("%s (%s %s)", message, strings.ToLower(verb), qualifiedResource.String())
+	}
+	var causes []metav1.StatusCause
+	if isUnexpectedResponse {
+		causes = []metav1.StatusCause{
+			{
+				Type:    metav1.CauseTypeUnexpectedServerResponse,
+				Message: serverMessage,
+			},
+		}
+	} else {
+		causes = nil
+	}
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   int32(code),
+		Reason: reason,
+		Details: &metav1.StatusDetails{
+			Group: qualifiedResource.Group,
+			Kind:  qualifiedResource.Resource,
+			Name:  name,
+
+			Causes:            causes,
+			RetryAfterSeconds: int32(retryAfterSeconds),
+		},
+		Message: message,
+	}}
+}
+
+// IsNotFound returns true if the specified error was created by NewNotFound.
+// It supports wrapped errors and returns false when the error is nil.
+func IsNotFound(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonNotFound {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusNotFound {
+		return true
+	}
+	return false
+}
+
+// IsAlreadyExists determines if the err is an error which indicates that a specified resource already exists.
+// It supports wrapped errors and returns false when the error is nil.
+func IsAlreadyExists(err error) bool {
+	return ReasonForError(err) == metav1.StatusReasonAlreadyExists
+}
+
+// IsConflict determines if the err is an error which indicates the provided update conflicts.
+// It supports wrapped errors and returns false when the error is nil.
+func IsConflict(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonConflict {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusConflict {
+		return true
+	}
+	return false
+}
+
+// IsInvalid determines if the err is an error which indicates the provided resource is not valid.
+// It supports wrapped errors and returns false when the error is nil.
+func IsInvalid(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonInvalid {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusUnprocessableEntity {
+		return true
+	}
+	return false
+}
+
+// IsGone is true if the error indicates the requested resource is no longer available.
+// It supports wrapped errors and returns false when the error is nil.
+func IsGone(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonGone {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusGone {
+		return true
+	}
+	return false
+}
+
+// IsResourceExpired is true if the error indicates the resource has expired and the current action is
+// no longer possible.
+// It supports wrapped errors and returns false when the error is nil.
+func IsResourceExpired(err error) bool {
+	return ReasonForError(err) == metav1.StatusReasonExpired
+}
+
+// IsNotAcceptable determines if err is an error which indicates that the request failed due to an invalid Accept header
+// It supports wrapped errors and returns false when the error is nil.
+func IsNotAcceptable(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonNotAcceptable {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusNotAcceptable {
+		return true
+	}
+	return false
+}
+
+// IsUnsupportedMediaType determines if err is an error which indicates that the request failed due to an invalid Content-Type header
+// It supports wrapped errors and returns false when the error is nil.
+func IsUnsupportedMediaType(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonUnsupportedMediaType {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusUnsupportedMediaType {
+		return true
+	}
+	return false
+}
+
+// IsMethodNotSupported determines if the err is an error which indicates the provided action could not
+// be performed because it is not supported by the server.
+// It supports wrapped errors and returns false when the error is nil.
+func IsMethodNotSupported(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonMethodNotAllowed {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusMethodNotAllowed {
+		return true
+	}
+	return false
+}
+
+// IsServiceUnavailable is true if the error indicates the underlying service is no longer available.
+// It supports wrapped errors and returns false when the error is nil.
+func IsServiceUnavailable(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonServiceUnavailable {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusServiceUnavailable {
+		return true
+	}
+	return false
+}
+
+// IsBadRequest determines if err is an error which indicates that the request is invalid.
+// It supports wrapped errors and returns false when the error is nil.
+func IsBadRequest(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonBadRequest {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusBadRequest {
+		return true
+	}
+	return false
+}
+
+// IsUnauthorized determines if err is an error which indicates that the request is unauthorized and
+// requires authentication by the user.
+// It supports wrapped errors and returns false when the error is nil.
+func IsUnauthorized(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonUnauthorized {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusUnauthorized {
+		return true
+	}
+	return false
+}
+
+// IsForbidden determines if err is an error which indicates that the request is forbidden and cannot
+// be completed as requested.
+// It supports wrapped errors and returns false when the error is nil.
+func IsForbidden(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonForbidden {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusForbidden {
+		return true
+	}
+	return false
+}
+
+// IsTimeout determines if err is an error which indicates that request times out due to long
+// processing.
+// It supports wrapped errors and returns false when the error is nil.
+func IsTimeout(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonTimeout {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusGatewayTimeout {
+		return true
+	}
+	return false
+}
+
+// IsServerTimeout determines if err is an error which indicates that the request needs to be retried
+// by the client.
+// It supports wrapped errors and returns false when the error is nil.
+func IsServerTimeout(err error) bool {
+	// do not check the status code, because no https status code exists that can
+	// be scoped to retryable timeouts.
+	return ReasonForError(err) == metav1.StatusReasonServerTimeout
+}
+
+// IsInternalError determines if err is an error which indicates an internal server error.
+// It supports wrapped errors and returns false when the error is nil.
+func IsInternalError(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonInternalError {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusInternalServerError {
+		return true
+	}
+	return false
+}
+
+// IsTooManyRequests determines if err is an error which indicates that there are too many requests
+// that the server cannot handle.
+// It supports wrapped errors and returns false when the error is nil.
+func IsTooManyRequests(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonTooManyRequests {
+		return true
+	}
+
+	// IsTooManyRequests' checking of code predates the checking of the code in
+	// the other Is* functions. In order to maintain backward compatibility, this
+	// does not check that the reason is unknown.
+	if code == http.StatusTooManyRequests {
+		return true
+	}
+	return false
+}
+
+// IsRequestEntityTooLargeError determines if err is an error which indicates
+// the request entity is too large.
+// It supports wrapped errors and returns false when the error is nil.
+func IsRequestEntityTooLargeError(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonRequestEntityTooLarge {
+		return true
+	}
+
+	// IsRequestEntityTooLargeError's checking of code predates the checking of
+	// the code in the other Is* functions. In order to maintain backward
+	// compatibility, this does not check that the reason is unknown.
+	if code == http.StatusRequestEntityTooLarge {
+		return true
+	}
+	return false
+}
+
+// IsUnexpectedServerError returns true if the server response was not in the expected API format,
+// and may be the result of another HTTP actor.
+// It supports wrapped errors and returns false when the error is nil.
+func IsUnexpectedServerError(err error) bool {
+	status, ok := err.(APIStatus)
+	if (ok || errors.As(err, &status)) && status.Status().Details != nil {
+		for _, cause := range status.Status().Details.Causes {
+			if cause.Type == metav1.CauseTypeUnexpectedServerResponse {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// IsUnexpectedObjectError determines if err is due to an unexpected object from the master.
+// It supports wrapped errors and returns false when the error is nil.
+func IsUnexpectedObjectError(err error) bool {
+	uoe, ok := err.(*UnexpectedObjectError)
+	return err != nil && (ok || errors.As(err, &uoe))
+}
+
+// IsStoreReadError determines if err is due to either failure to transform the
+// data from the storage, or failure to decode the object appropriately.
+func IsStoreReadError(err error) bool {
+	return ReasonForError(err) == metav1.StatusReasonStoreReadError
+}
+
+// SuggestsClientDelay returns true if this error suggests a client delay as well as the
+// suggested seconds to wait, or false if the error does not imply a wait. It does not
+// address whether the error *should* be retried, since some errors (like a 3xx) may
+// request delay without retry.
+// It supports wrapped errors and returns false when the error is nil.
+func SuggestsClientDelay(err error) (int, bool) {
+	t, ok := err.(APIStatus)
+	if (ok || errors.As(err, &t)) && t.Status().Details != nil {
+		switch t.Status().Reason {
+		// this StatusReason explicitly requests the caller to delay the action
+		case metav1.StatusReasonServerTimeout:
+			return int(t.Status().Details.RetryAfterSeconds), true
+		}
+		// If the client requests that we retry after a certain number of seconds
+		if t.Status().Details.RetryAfterSeconds > 0 {
+			return int(t.Status().Details.RetryAfterSeconds), true
+		}
+	}
+	return 0, false
+}
+
+// ReasonForError returns the HTTP status for a particular error.
+// It supports wrapped errors and returns StatusReasonUnknown when
+// the error is nil or doesn't have a status.
+func ReasonForError(err error) metav1.StatusReason {
+	if status, ok := err.(APIStatus); ok || errors.As(err, &status) {
+		return status.Status().Reason
+	}
+	return metav1.StatusReasonUnknown
+}
+
+func reasonAndCodeForError(err error) (metav1.StatusReason, int32) {
+	if status, ok := err.(APIStatus); ok || errors.As(err, &status) {
+		return status.Status().Reason, status.Status().Code
+	}
+	return metav1.StatusReasonUnknown, 0
+}
+
+// ErrorReporter converts generic errors into runtime.Object errors without
+// requiring the caller to take a dependency on meta/v1 (where Status lives).
+// This prevents circular dependencies in core watch code.
+type ErrorReporter struct {
+	code   int
+	verb   string
+	reason string
+}
+
+// NewClientErrorReporter will respond with valid v1.Status objects that report
+// unexpected server responses. Primarily used by watch to report errors when
+// we attempt to decode a response from the server and it is not in the form
+// we expect. Because watch is a dependency of the core api, we can't return
+// meta/v1.Status in that package and so much inject this interface to convert a
+// generic error as appropriate. The reason is passed as a unique status cause
+// on the returned status, otherwise the generic "ClientError" is returned.
+func NewClientErrorReporter(code int, verb string, reason string) *ErrorReporter {
+	return &ErrorReporter{
+		code:   code,
+		verb:   verb,
+		reason: reason,
+	}
+}
+
+// AsObject returns a valid error runtime.Object (a v1.Status) for the given
+// error, using the code and verb of the reporter type. The error is set to
+// indicate that this was an unexpected server response.
+func (r *ErrorReporter) AsObject(err error) runtime.Object {
+	status := NewGenericServerResponse(r.code, r.verb, schema.GroupResource{}, "", err.Error(), 0, true)
+	if status.ErrStatus.Details == nil {
+		status.ErrStatus.Details = &metav1.StatusDetails{}
+	}
+	reason := r.reason
+	if len(reason) == 0 {
+		reason = "ClientError"
+	}
+	status.ErrStatus.Details.Causes = append(status.ErrStatus.Details.Causes, metav1.StatusCause{
+		Type:    metav1.CauseType(reason),
+		Message: err.Error(),
+	})
+	return &status.ErrStatus
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/errors/errors_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/errors/errors_test.go
new file mode 100644
index 0000000000..2268d652f6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/errors/errors_test.go
@@ -0,0 +1,705 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package errors
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"reflect"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func resource(resource string) schema.GroupResource {
+	return schema.GroupResource{Group: "", Resource: resource}
+}
+func kind(kind string) schema.GroupKind {
+	return schema.GroupKind{Group: "", Kind: kind}
+}
+
+func TestErrorNew(t *testing.T) {
+	err := NewAlreadyExists(resource("tests"), "1")
+	if !IsAlreadyExists(err) {
+		t.Errorf("expected to be %s", metav1.StatusReasonAlreadyExists)
+	}
+	if IsConflict(err) {
+		t.Errorf("expected to not be %s", metav1.StatusReasonConflict)
+	}
+	if IsNotFound(err) {
+		t.Errorf("expected to not be %s", metav1.StatusReasonNotFound)
+	}
+	if IsInvalid(err) {
+		t.Errorf("expected to not be %s", metav1.StatusReasonInvalid)
+	}
+	if IsBadRequest(err) {
+		t.Errorf("expected to not be %s", metav1.StatusReasonBadRequest)
+	}
+	if IsForbidden(err) {
+		t.Errorf("expected to not be %s", metav1.StatusReasonForbidden)
+	}
+	if IsServerTimeout(err) {
+		t.Errorf("expected to not be %s", metav1.StatusReasonServerTimeout)
+	}
+	if IsMethodNotSupported(err) {
+		t.Errorf("expected to not be %s", metav1.StatusReasonMethodNotAllowed)
+	}
+
+	if !IsConflict(NewConflict(resource("tests"), "2", errors.New("message"))) {
+		t.Errorf("expected to be %s", metav1.StatusReasonAlreadyExists)
+	}
+	if !IsNotFound(NewNotFound(resource("tests"), "3")) {
+		t.Errorf("expected to be %s", metav1.StatusReasonNotFound)
+	}
+	if !IsInvalid(NewInvalid(kind("Test"), "2", nil)) {
+		t.Errorf("expected to be %s", metav1.StatusReasonInvalid)
+	}
+	if !IsBadRequest(NewBadRequest("reason")) {
+		t.Errorf("expected to be %s", metav1.StatusReasonBadRequest)
+	}
+	if !IsForbidden(NewForbidden(resource("tests"), "2", errors.New("reason"))) {
+		t.Errorf("expected to be %s", metav1.StatusReasonForbidden)
+	}
+	if !IsUnauthorized(NewUnauthorized("reason")) {
+		t.Errorf("expected to be %s", metav1.StatusReasonUnauthorized)
+	}
+	if !IsServerTimeout(NewServerTimeout(resource("tests"), "reason", 0)) {
+		t.Errorf("expected to be %s", metav1.StatusReasonServerTimeout)
+	}
+	if !IsMethodNotSupported(NewMethodNotSupported(resource("foos"), "delete")) {
+		t.Errorf("expected to be %s", metav1.StatusReasonMethodNotAllowed)
+	}
+
+	if !IsAlreadyExists(NewGenerateNameConflict(resource("tests"), "3", 1)) {
+		t.Errorf("expected to be %s", metav1.StatusReasonAlreadyExists)
+	}
+	if time, ok := SuggestsClientDelay(NewGenerateNameConflict(resource("tests"), "3", 1)); time != 1 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+
+	if time, ok := SuggestsClientDelay(NewServerTimeout(resource("tests"), "doing something", 10)); time != 10 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+	if time, ok := SuggestsClientDelay(NewServerTimeout(resource("tests"), "doing something", 0)); time != 0 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+	if time, ok := SuggestsClientDelay(NewTimeoutError("test reason", 10)); time != 10 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+	if time, ok := SuggestsClientDelay(NewTooManyRequests("doing something", 10)); time != 10 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+	if time, ok := SuggestsClientDelay(NewTooManyRequests("doing something", 1)); time != 1 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+	if time, ok := SuggestsClientDelay(NewGenericServerResponse(429, http.MethodGet, resource("tests"), "test", "doing something", 10, true)); time != 10 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+	if time, ok := SuggestsClientDelay(NewGenericServerResponse(500, http.MethodGet, resource("tests"), "test", "doing something", 10, true)); time != 10 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+	if time, ok := SuggestsClientDelay(NewGenericServerResponse(429, http.MethodGet, resource("tests"), "test", "doing something", 0, true)); time != 0 || ok {
+		t.Errorf("unexpected %d", time)
+	}
+}
+
+func TestNewInvalid(t *testing.T) {
+	testCases := []struct {
+		Err     *field.Error
+		Details *metav1.StatusDetails
+		Msg     string
+	}{
+		{
+			field.Duplicate(field.NewPath("field[0].name"), "bar"),
+			&metav1.StatusDetails{
+				Kind: "Kind",
+				Name: "name",
+				Causes: []metav1.StatusCause{{
+					Type:  metav1.CauseTypeFieldValueDuplicate,
+					Field: "field[0].name",
+				}},
+			},
+			`Kind "name" is invalid: field[0].name: Duplicate value: "bar"`,
+		},
+		{
+			field.Invalid(field.NewPath("field[0].name"), "bar", "detail"),
+			&metav1.StatusDetails{
+				Kind: "Kind",
+				Name: "name",
+				Causes: []metav1.StatusCause{{
+					Type:  metav1.CauseTypeFieldValueInvalid,
+					Field: "field[0].name",
+				}},
+			},
+			`Kind "name" is invalid: field[0].name: Invalid value: "bar": detail`,
+		},
+		{
+			field.NotFound(field.NewPath("field[0].name"), "bar"),
+			&metav1.StatusDetails{
+				Kind: "Kind",
+				Name: "name",
+				Causes: []metav1.StatusCause{{
+					Type:  metav1.CauseTypeFieldValueNotFound,
+					Field: "field[0].name",
+				}},
+			},
+			`Kind "name" is invalid: field[0].name: Not found: "bar"`,
+		},
+		{
+			field.NotSupported[string](field.NewPath("field[0].name"), "bar", nil),
+			&metav1.StatusDetails{
+				Kind: "Kind",
+				Name: "name",
+				Causes: []metav1.StatusCause{{
+					Type:  metav1.CauseTypeFieldValueNotSupported,
+					Field: "field[0].name",
+				}},
+			},
+			`Kind "name" is invalid: field[0].name: Unsupported value: "bar"`,
+		},
+		{
+			field.Required(field.NewPath("field[0].name"), ""),
+			&metav1.StatusDetails{
+				Kind: "Kind",
+				Name: "name",
+				Causes: []metav1.StatusCause{{
+					Type:  metav1.CauseTypeFieldValueRequired,
+					Field: "field[0].name",
+				}},
+			},
+			`Kind "name" is invalid: field[0].name: Required value`,
+		},
+		{
+			nil,
+			&metav1.StatusDetails{
+				Kind:   "Kind",
+				Name:   "name",
+				Causes: []metav1.StatusCause{},
+			},
+			`Kind "name" is invalid`,
+		},
+	}
+	for i, testCase := range testCases {
+		vErr, expected := testCase.Err, testCase.Details
+		if vErr != nil && expected != nil {
+			expected.Causes[0].Message = vErr.ErrorBody()
+		}
+		var errList field.ErrorList
+		if vErr != nil {
+			errList = append(errList, vErr)
+		}
+		err := NewInvalid(kind("Kind"), "name", errList)
+		status := err.ErrStatus
+		if status.Code != 422 || status.Reason != metav1.StatusReasonInvalid {
+			t.Errorf("%d: unexpected status: %#v", i, status)
+		}
+		if !reflect.DeepEqual(expected, status.Details) {
+			t.Errorf("%d: expected %#v, got %#v", i, expected, status.Details)
+		}
+		if testCase.Msg != status.Message {
+			t.Errorf("%d: expected\n%s\ngot\n%s", i, testCase.Msg, status.Message)
+		}
+	}
+}
+
+func TestReasonForError(t *testing.T) {
+	if e, a := metav1.StatusReasonUnknown, ReasonForError(nil); e != a {
+		t.Errorf("unexpected reason type: %#v", a)
+	}
+}
+
+type TestType struct{}
+
+func (obj *TestType) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+func (obj *TestType) DeepCopyObject() runtime.Object {
+	if obj == nil {
+		return nil
+	}
+	clone := *obj
+	return &clone
+}
+
+func TestFromObject(t *testing.T) {
+	table := []struct {
+		obj     runtime.Object
+		message string
+	}{
+		{&metav1.Status{Message: "foobar"}, "foobar"},
+		{&TestType{}, "unexpected object: &{}"},
+	}
+
+	for _, item := range table {
+		if e, a := item.message, FromObject(item.obj).Error(); e != a {
+			t.Errorf("Expected %v, got %v", e, a)
+		}
+	}
+}
+
+func TestReasonForErrorSupportsWrappedErrors(t *testing.T) {
+	testCases := []struct {
+		name           string
+		err            error
+		expectedReason metav1.StatusReason
+	}{
+		{
+			name:           "Direct match",
+			err:            &StatusError{ErrStatus: metav1.Status{Reason: metav1.StatusReasonUnauthorized}},
+			expectedReason: metav1.StatusReasonUnauthorized,
+		},
+		{
+			name:           "No match",
+			err:            errors.New("some other error"),
+			expectedReason: metav1.StatusReasonUnknown,
+		},
+		{
+			name:           "Nested match",
+			err:            fmt.Errorf("wrapping: %w", fmt.Errorf("some more: %w", &StatusError{ErrStatus: metav1.Status{Reason: metav1.StatusReasonAlreadyExists}})),
+			expectedReason: metav1.StatusReasonAlreadyExists,
+		},
+		{
+			name:           "Nested, no match",
+			err:            fmt.Errorf("wrapping: %w", fmt.Errorf("some more: %w", errors.New("hello"))),
+			expectedReason: metav1.StatusReasonUnknown,
+		},
+		{
+			name:           "Nil",
+			expectedReason: metav1.StatusReasonUnknown,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if result := ReasonForError(tc.err); result != tc.expectedReason {
+				t.Errorf("expected reason: %q, but got known reason: %q", tc.expectedReason, result)
+			}
+		})
+	}
+}
+
+func TestIsTooManyRequestsSupportsWrappedErrors(t *testing.T) {
+	testCases := []struct {
+		name        string
+		err         error
+		expectMatch bool
+	}{
+		{
+			name:        "Direct match via status reason",
+			err:         &StatusError{ErrStatus: metav1.Status{Reason: metav1.StatusReasonTooManyRequests}},
+			expectMatch: true,
+		},
+		{
+			name:        "Direct match via status code",
+			err:         &StatusError{ErrStatus: metav1.Status{Code: http.StatusTooManyRequests}},
+			expectMatch: true,
+		},
+		{
+			name:        "No match",
+			err:         &StatusError{},
+			expectMatch: false,
+		},
+		{
+			name:        "Nested match via status reason",
+			err:         fmt.Errorf("Wrapping: %w", &StatusError{ErrStatus: metav1.Status{Reason: metav1.StatusReasonTooManyRequests}}),
+			expectMatch: true,
+		},
+		{
+			name:        "Nested match via status code",
+			err:         fmt.Errorf("Wrapping: %w", &StatusError{ErrStatus: metav1.Status{Code: http.StatusTooManyRequests}}),
+			expectMatch: true,
+		},
+		{
+			name:        "Nested,no match",
+			err:         fmt.Errorf("Wrapping: %w", &StatusError{ErrStatus: metav1.Status{Code: http.StatusNotFound}}),
+			expectMatch: false,
+		},
+		{
+			name:        "Nil",
+			expectMatch: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		if result := IsTooManyRequests(tc.err); result != tc.expectMatch {
+			t.Errorf("Expect match %t, got match %t", tc.expectMatch, result)
+		}
+	}
+}
+func TestIsRequestEntityTooLargeErrorSupportsWrappedErrors(t *testing.T) {
+	testCases := []struct {
+		name        string
+		err         error
+		expectMatch bool
+	}{
+		{
+			name:        "Direct match via status reason",
+			err:         &StatusError{ErrStatus: metav1.Status{Reason: metav1.StatusReasonRequestEntityTooLarge}},
+			expectMatch: true,
+		},
+		{
+			name:        "Direct match via status code",
+			err:         &StatusError{ErrStatus: metav1.Status{Code: http.StatusRequestEntityTooLarge}},
+			expectMatch: true,
+		},
+		{
+			name:        "No match",
+			err:         &StatusError{},
+			expectMatch: false,
+		},
+		{
+			name:        "Nested match via status reason",
+			err:         fmt.Errorf("Wrapping: %w", &StatusError{ErrStatus: metav1.Status{Reason: metav1.StatusReasonRequestEntityTooLarge}}),
+			expectMatch: true,
+		},
+		{
+			name:        "Nested match via status code",
+			err:         fmt.Errorf("Wrapping: %w", &StatusError{ErrStatus: metav1.Status{Code: http.StatusRequestEntityTooLarge}}),
+			expectMatch: true,
+		},
+		{
+			name:        "Nested,no match",
+			err:         fmt.Errorf("Wrapping: %w", &StatusError{ErrStatus: metav1.Status{Code: http.StatusNotFound}}),
+			expectMatch: false,
+		},
+		{
+			name:        "Nil",
+			expectMatch: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		if result := IsRequestEntityTooLargeError(tc.err); result != tc.expectMatch {
+			t.Errorf("Expect match %t, got match %t", tc.expectMatch, result)
+		}
+	}
+}
+
+func TestIsUnexpectedServerError(t *testing.T) {
+	unexpectedServerErr := func() error {
+		return &StatusError{
+			ErrStatus: metav1.Status{
+				Details: &metav1.StatusDetails{
+					Causes: []metav1.StatusCause{{Type: metav1.CauseTypeUnexpectedServerResponse}},
+				},
+			},
+		}
+	}
+	testCases := []struct {
+		name        string
+		err         error
+		expectMatch bool
+	}{
+		{
+			name:        "Direct match",
+			err:         unexpectedServerErr(),
+			expectMatch: true,
+		},
+		{
+			name:        "No match",
+			err:         errors.New("some other error"),
+			expectMatch: false,
+		},
+		{
+			name:        "Nested match",
+			err:         fmt.Errorf("wrapping: %w", unexpectedServerErr()),
+			expectMatch: true,
+		},
+		{
+			name:        "Nested, no match",
+			err:         fmt.Errorf("wrapping: %w", fmt.Errorf("some more: %w", errors.New("hello"))),
+			expectMatch: false,
+		},
+		{
+			name:        "Nil",
+			expectMatch: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if result := IsUnexpectedServerError(tc.err); result != tc.expectMatch {
+				t.Errorf("expected match: %t, but got match: %t", tc.expectMatch, result)
+			}
+		})
+	}
+}
+
+func TestIsUnexpectedObjectError(t *testing.T) {
+	unexpectedObjectErr := func() error {
+		return &UnexpectedObjectError{}
+	}
+	testCases := []struct {
+		name        string
+		err         error
+		expectMatch bool
+	}{
+		{
+			name:        "Direct match",
+			err:         unexpectedObjectErr(),
+			expectMatch: true,
+		},
+		{
+			name:        "No match",
+			err:         errors.New("some other error"),
+			expectMatch: false,
+		},
+		{
+			name:        "Nested match",
+			err:         fmt.Errorf("wrapping: %w", unexpectedObjectErr()),
+			expectMatch: true,
+		},
+		{
+			name:        "Nested, no match",
+			err:         fmt.Errorf("wrapping: %w", fmt.Errorf("some more: %w", errors.New("hello"))),
+			expectMatch: false,
+		},
+		{
+			name:        "Nil",
+			expectMatch: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if result := IsUnexpectedObjectError(tc.err); result != tc.expectMatch {
+				t.Errorf("expected match: %t, but got match: %t", tc.expectMatch, result)
+			}
+		})
+	}
+}
+
+func TestSuggestsClientDelaySupportsWrapping(t *testing.T) {
+	suggestsClientDelayErr := func() error {
+		return &StatusError{
+			ErrStatus: metav1.Status{
+				Reason:  metav1.StatusReasonServerTimeout,
+				Details: &metav1.StatusDetails{},
+			},
+		}
+	}
+	testCases := []struct {
+		name        string
+		err         error
+		expectMatch bool
+	}{
+		{
+			name:        "Direct match",
+			err:         suggestsClientDelayErr(),
+			expectMatch: true,
+		},
+		{
+			name:        "No match",
+			err:         errors.New("some other error"),
+			expectMatch: false,
+		},
+		{
+			name:        "Nested match",
+			err:         fmt.Errorf("wrapping: %w", suggestsClientDelayErr()),
+			expectMatch: true,
+		},
+		{
+			name:        "Nested, no match",
+			err:         fmt.Errorf("wrapping: %w", fmt.Errorf("some more: %w", errors.New("hello"))),
+			expectMatch: false,
+		},
+		{
+			name:        "Nil",
+			expectMatch: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if _, result := SuggestsClientDelay(tc.err); result != tc.expectMatch {
+				t.Errorf("expected match: %t, but got match: %t", tc.expectMatch, result)
+			}
+		})
+	}
+}
+
+func TestIsErrorTypesByReasonAndCode(t *testing.T) {
+	testCases := []struct {
+		name                  string
+		knownReason           metav1.StatusReason
+		otherReason           metav1.StatusReason
+		otherReasonConsidered bool
+		code                  int32
+		fn                    func(error) bool
+	}{
+		{
+			name:                  "IsRequestEntityTooLarge",
+			knownReason:           metav1.StatusReasonRequestEntityTooLarge,
+			otherReason:           metav1.StatusReasonForbidden,
+			otherReasonConsidered: false,
+			code:                  http.StatusRequestEntityTooLarge,
+			fn:                    IsRequestEntityTooLargeError,
+		}, {
+			name:                  "TooManyRequests",
+			knownReason:           metav1.StatusReasonTooManyRequests,
+			otherReason:           metav1.StatusReasonForbidden,
+			otherReasonConsidered: false,
+			code:                  http.StatusTooManyRequests,
+			fn:                    IsTooManyRequests,
+		}, {
+			name:                  "Forbidden",
+			knownReason:           metav1.StatusReasonForbidden,
+			otherReason:           metav1.StatusReasonNotFound,
+			otherReasonConsidered: true,
+			code:                  http.StatusForbidden,
+			fn:                    IsForbidden,
+		}, {
+			name:                  "NotFound",
+			knownReason:           metav1.StatusReasonNotFound,
+			otherReason:           metav1.StatusReasonForbidden,
+			otherReasonConsidered: true,
+			code:                  http.StatusNotFound,
+			fn:                    IsNotFound,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Run("by known reason", func(t *testing.T) {
+				err := &StatusError{
+					metav1.Status{
+						Reason: tc.knownReason,
+					},
+				}
+
+				got := tc.fn(err)
+				if !got {
+					t.Errorf("expected reason %s to match", tc.knownReason)
+				}
+			})
+
+			t.Run("by code and unknown reason", func(t *testing.T) {
+				err := &StatusError{
+					metav1.Status{
+						Reason: metav1.StatusReasonUnknown, // this could be _any_ reason that isn't in knownReasons.
+						Code:   tc.code,
+					},
+				}
+
+				got := tc.fn(err)
+				if !got {
+					t.Errorf("expected code %d with reason %s to match", tc.code, tc.otherReason)
+				}
+			})
+
+			if !tc.otherReasonConsidered {
+				return
+			}
+
+			t.Run("by code and other known reason", func(t *testing.T) {
+				err := &StatusError{
+					metav1.Status{
+						Reason: tc.otherReason,
+						Code:   tc.code,
+					},
+				}
+
+				got := tc.fn(err)
+				if got {
+					t.Errorf("expected code %d with reason %s to not match", tc.code, tc.otherReason)
+				}
+			})
+
+		})
+
+	}
+}
+
+func TestStatusCauseSupportsWrappedErrors(t *testing.T) {
+	err := &StatusError{ErrStatus: metav1.Status{
+		Details: &metav1.StatusDetails{
+			Causes: []metav1.StatusCause{{Type: "SomeCause"}},
+		},
+	}}
+
+	if cause, ok := StatusCause(nil, "SomeCause"); ok {
+		t.Errorf("expected no cause for nil, got %v: %#v", ok, cause)
+	}
+	if cause, ok := StatusCause(errors.New("boom"), "SomeCause"); ok {
+		t.Errorf("expected no cause for wrong type, got %v: %#v", ok, cause)
+	}
+
+	if cause, ok := StatusCause(err, "Other"); ok {
+		t.Errorf("expected no cause for wrong name, got %v: %#v", ok, cause)
+	}
+	if cause, ok := StatusCause(err, "SomeCause"); !ok || cause != err.ErrStatus.Details.Causes[0] {
+		t.Errorf("expected cause, got %v: %#v", ok, cause)
+	}
+
+	wrapped := fmt.Errorf("once: %w", err)
+	if cause, ok := StatusCause(wrapped, "SomeCause"); !ok || cause != err.ErrStatus.Details.Causes[0] {
+		t.Errorf("expected cause when wrapped, got %v: %#v", ok, cause)
+	}
+
+	nested := fmt.Errorf("twice: %w", wrapped)
+	if cause, ok := StatusCause(nested, "SomeCause"); !ok || cause != err.ErrStatus.Details.Causes[0] {
+		t.Errorf("expected cause when nested, got %v: %#v", ok, cause)
+	}
+}
+
+func BenchmarkIsAlreadyExistsWrappedErrors(b *testing.B) {
+	err := NewAlreadyExists(schema.GroupResource{}, "")
+	wrapped := fmt.Errorf("once: %w", err)
+
+	b.Run("Nil", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			IsAlreadyExists(nil)
+		}
+	})
+
+	b.Run("Bare", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			IsAlreadyExists(err)
+		}
+	})
+
+	b.Run("Wrapped", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			IsAlreadyExists(wrapped)
+		}
+	})
+}
+
+func BenchmarkIsNotFoundWrappedErrors(b *testing.B) {
+	err := NewNotFound(schema.GroupResource{}, "")
+	wrapped := fmt.Errorf("once: %w", err)
+
+	b.Run("Nil", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			IsNotFound(nil)
+		}
+	})
+
+	b.Run("Bare", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			IsNotFound(err)
+		}
+	})
+
+	b.Run("Wrapped", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			IsNotFound(wrapped)
+		}
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/OWNERS b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/OWNERS
new file mode 100644
index 0000000000..3bd8bf535e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/OWNERS
@@ -0,0 +1,15 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+reviewers:
+  - thockin
+  - smarterclayton
+  - wojtek-t
+  - deads2k
+  - derekwaynecarr
+  - caesarxuchao
+  - mikedanese
+  - liggitt
+  - janetkuo
+  - dims
+emeritus_reviewers:
+  - ncdc
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/conditions.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/conditions.go
new file mode 100644
index 0000000000..cbdf2eeb83
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/conditions.go
@@ -0,0 +1,119 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// SetStatusCondition sets the corresponding condition in conditions to newCondition and returns true
+// if the conditions are changed by this call.
+// conditions must be non-nil.
+//  1. if the condition of the specified type already exists (all fields of the existing condition are updated to
+//     newCondition, LastTransitionTime is set to now if the new status differs from the old status)
+//  2. if a condition of the specified type does not exist (LastTransitionTime is set to now() if unset, and newCondition is appended)
+func SetStatusCondition(conditions *[]metav1.Condition, newCondition metav1.Condition) (changed bool) {
+	if conditions == nil {
+		return false
+	}
+	existingCondition := FindStatusCondition(*conditions, newCondition.Type)
+	if existingCondition == nil {
+		if newCondition.LastTransitionTime.IsZero() {
+			newCondition.LastTransitionTime = metav1.NewTime(time.Now())
+		}
+		*conditions = append(*conditions, newCondition)
+		return true
+	}
+
+	if existingCondition.Status != newCondition.Status {
+		existingCondition.Status = newCondition.Status
+		if !newCondition.LastTransitionTime.IsZero() {
+			existingCondition.LastTransitionTime = newCondition.LastTransitionTime
+		} else {
+			existingCondition.LastTransitionTime = metav1.NewTime(time.Now())
+		}
+		changed = true
+	}
+
+	if existingCondition.Reason != newCondition.Reason {
+		existingCondition.Reason = newCondition.Reason
+		changed = true
+	}
+	if existingCondition.Message != newCondition.Message {
+		existingCondition.Message = newCondition.Message
+		changed = true
+	}
+	if existingCondition.ObservedGeneration != newCondition.ObservedGeneration {
+		existingCondition.ObservedGeneration = newCondition.ObservedGeneration
+		changed = true
+	}
+
+	return changed
+}
+
+// RemoveStatusCondition removes the corresponding conditionType from conditions if present. Returns
+// true if it was present and got removed.
+// conditions must be non-nil.
+func RemoveStatusCondition(conditions *[]metav1.Condition, conditionType string) (removed bool) {
+	if conditions == nil || len(*conditions) == 0 {
+		return false
+	}
+	newConditions := make([]metav1.Condition, 0, len(*conditions)-1)
+	for _, condition := range *conditions {
+		if condition.Type != conditionType {
+			newConditions = append(newConditions, condition)
+		}
+	}
+
+	removed = len(*conditions) != len(newConditions)
+	*conditions = newConditions
+
+	return removed
+}
+
+// FindStatusCondition finds the conditionType in conditions.
+func FindStatusCondition(conditions []metav1.Condition, conditionType string) *metav1.Condition {
+	for i := range conditions {
+		if conditions[i].Type == conditionType {
+			return &conditions[i]
+		}
+	}
+
+	return nil
+}
+
+// IsStatusConditionTrue returns true when the conditionType is present and set to `metav1.ConditionTrue`
+func IsStatusConditionTrue(conditions []metav1.Condition, conditionType string) bool {
+	return IsStatusConditionPresentAndEqual(conditions, conditionType, metav1.ConditionTrue)
+}
+
+// IsStatusConditionFalse returns true when the conditionType is present and set to `metav1.ConditionFalse`
+func IsStatusConditionFalse(conditions []metav1.Condition, conditionType string) bool {
+	return IsStatusConditionPresentAndEqual(conditions, conditionType, metav1.ConditionFalse)
+}
+
+// IsStatusConditionPresentAndEqual returns true when conditionType is present and equal to status.
+func IsStatusConditionPresentAndEqual(conditions []metav1.Condition, conditionType string, status metav1.ConditionStatus) bool {
+	for _, condition := range conditions {
+		if condition.Type == conditionType {
+			return condition.Status == status
+		}
+	}
+	return false
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/conditions_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/conditions_test.go
new file mode 100644
index 0000000000..248c885800
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/conditions_test.go
@@ -0,0 +1,250 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"reflect"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestSetStatusCondition(t *testing.T) {
+	oneHourBefore := time.Now().Add(-1 * time.Hour)
+	oneHourAfter := time.Now().Add(1 * time.Hour)
+
+	tests := []struct {
+		name          string
+		conditions    []metav1.Condition
+		toAdd         metav1.Condition
+		expectChanged bool
+		expected      []metav1.Condition
+	}{
+		{
+			name: "should-add",
+			conditions: []metav1.Condition{
+				{Type: "first"},
+				{Type: "third"},
+			},
+			toAdd:         metav1.Condition{Type: "second", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourBefore}, Reason: "reason", Message: "message"},
+			expectChanged: true,
+			expected: []metav1.Condition{
+				{Type: "first"},
+				{Type: "third"},
+				{Type: "second", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourBefore}, Reason: "reason", Message: "message"},
+			},
+		},
+		{
+			name: "use-supplied-time",
+			conditions: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second", Status: metav1.ConditionFalse},
+				{Type: "third"},
+			},
+			toAdd:         metav1.Condition{Type: "second", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourBefore}, Reason: "reason", Message: "message"},
+			expectChanged: true,
+			expected: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourBefore}, Reason: "reason", Message: "message"},
+				{Type: "third"},
+			},
+		},
+		{
+			name: "update-fields",
+			conditions: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourBefore}},
+				{Type: "third"},
+			},
+			toAdd:         metav1.Condition{Type: "second", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourAfter}, Reason: "reason", Message: "message", ObservedGeneration: 3},
+			expectChanged: true,
+			expected: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourBefore}, Reason: "reason", Message: "message", ObservedGeneration: 3},
+				{Type: "third"},
+			},
+		},
+		{
+			name: "nothing changes",
+			conditions: []metav1.Condition{{
+				Type:               "type",
+				Status:             metav1.ConditionTrue,
+				LastTransitionTime: metav1.Time{Time: oneHourBefore},
+			}},
+			toAdd: metav1.Condition{Type: "type", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourBefore}},
+			expected: []metav1.Condition{{
+				Type:               "type",
+				Status:             metav1.ConditionTrue,
+				LastTransitionTime: metav1.Time{Time: oneHourBefore},
+			}},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			changed := SetStatusCondition(&test.conditions, test.toAdd)
+			if test.expectChanged != changed {
+				t.Errorf("expectChanged=%t != changed=%t", test.expectChanged, changed)
+			}
+			if !reflect.DeepEqual(test.conditions, test.expected) {
+				t.Error(test.conditions)
+			}
+		})
+	}
+}
+
+func TestRemoveStatusCondition(t *testing.T) {
+	tests := []struct {
+		name          string
+		conditions    []metav1.Condition
+		conditionType string
+		expectRemoval bool
+		expected      []metav1.Condition
+	}{
+		{
+			name: "present",
+			conditions: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second"},
+				{Type: "third"},
+			},
+			conditionType: "second",
+			expectRemoval: true,
+			expected: []metav1.Condition{
+				{Type: "first"},
+				{Type: "third"},
+			},
+		},
+		{
+			name: "not-present",
+			conditions: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second"},
+				{Type: "third"},
+			},
+			conditionType: "fourth",
+			expected: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second"},
+				{Type: "third"},
+			},
+		},
+		{
+			name:          "empty_conditions",
+			conditions:    []metav1.Condition{},
+			conditionType: "Foo",
+			expected:      []metav1.Condition{},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			removed := RemoveStatusCondition(&test.conditions, test.conditionType)
+			if test.expectRemoval != removed {
+				t.Errorf("expectRemoval=%t != removal=%t", test.expectRemoval, removed)
+			}
+			if !reflect.DeepEqual(test.conditions, test.expected) {
+				t.Error(test.conditions)
+			}
+		})
+	}
+}
+
+func TestFindStatusCondition(t *testing.T) {
+	tests := []struct {
+		name          string
+		conditions    []metav1.Condition
+		conditionType string
+		expected      *metav1.Condition
+	}{
+		{
+			name: "not-present",
+			conditions: []metav1.Condition{
+				{Type: "first"},
+			},
+			conditionType: "second",
+			expected:      nil,
+		},
+		{
+			name: "present",
+			conditions: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second"},
+			},
+			conditionType: "second",
+			expected:      &metav1.Condition{Type: "second"},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := FindStatusCondition(test.conditions, test.conditionType)
+			if !reflect.DeepEqual(actual, test.expected) {
+				t.Error(actual)
+			}
+		})
+	}
+}
+
+func TestIsStatusConditionPresentAndEqual(t *testing.T) {
+	tests := []struct {
+		name            string
+		conditions      []metav1.Condition
+		conditionType   string
+		conditionStatus metav1.ConditionStatus
+		expected        bool
+	}{
+		{
+			name: "doesnt-match-true",
+			conditions: []metav1.Condition{
+				{Type: "first", Status: metav1.ConditionUnknown},
+			},
+			conditionType:   "first",
+			conditionStatus: metav1.ConditionTrue,
+			expected:        false,
+		},
+		{
+			name: "does-match-true",
+			conditions: []metav1.Condition{
+				{Type: "first", Status: metav1.ConditionTrue},
+			},
+			conditionType:   "first",
+			conditionStatus: metav1.ConditionTrue,
+			expected:        true,
+		},
+		{
+			name: "does-match-false",
+			conditions: []metav1.Condition{
+				{Type: "first", Status: metav1.ConditionFalse},
+			},
+			conditionType:   "first",
+			conditionStatus: metav1.ConditionFalse,
+			expected:        true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := IsStatusConditionPresentAndEqual(test.conditions, test.conditionType, test.conditionStatus)
+			if actual != test.expected {
+				t.Error(actual)
+			}
+
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/doc.go
new file mode 100644
index 0000000000..a3b18a5c9a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package meta provides functions for retrieving API metadata from objects
+// belonging to the Kubernetes API
+package meta
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/errors.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/errors.go
new file mode 100644
index 0000000000..f36aa4ec22
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/errors.go
@@ -0,0 +1,132 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"errors"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// AmbiguousResourceError is returned if the RESTMapper finds multiple matches for a resource
+type AmbiguousResourceError struct {
+	PartialResource schema.GroupVersionResource
+
+	MatchingResources []schema.GroupVersionResource
+	MatchingKinds     []schema.GroupVersionKind
+}
+
+func (e *AmbiguousResourceError) Error() string {
+	switch {
+	case len(e.MatchingKinds) > 0 && len(e.MatchingResources) > 0:
+		return fmt.Sprintf("%v matches multiple resources %v and kinds %v", e.PartialResource, e.MatchingResources, e.MatchingKinds)
+	case len(e.MatchingKinds) > 0:
+		return fmt.Sprintf("%v matches multiple kinds %v", e.PartialResource, e.MatchingKinds)
+	case len(e.MatchingResources) > 0:
+		return fmt.Sprintf("%v matches multiple resources %v", e.PartialResource, e.MatchingResources)
+	}
+	return fmt.Sprintf("%v matches multiple resources or kinds", e.PartialResource)
+}
+
+func (*AmbiguousResourceError) Is(target error) bool {
+	_, ok := target.(*AmbiguousResourceError)
+	return ok
+}
+
+// AmbiguousKindError is returned if the RESTMapper finds multiple matches for a kind
+type AmbiguousKindError struct {
+	PartialKind schema.GroupVersionKind
+
+	MatchingResources []schema.GroupVersionResource
+	MatchingKinds     []schema.GroupVersionKind
+}
+
+func (e *AmbiguousKindError) Error() string {
+	switch {
+	case len(e.MatchingKinds) > 0 && len(e.MatchingResources) > 0:
+		return fmt.Sprintf("%v matches multiple resources %v and kinds %v", e.PartialKind, e.MatchingResources, e.MatchingKinds)
+	case len(e.MatchingKinds) > 0:
+		return fmt.Sprintf("%v matches multiple kinds %v", e.PartialKind, e.MatchingKinds)
+	case len(e.MatchingResources) > 0:
+		return fmt.Sprintf("%v matches multiple resources %v", e.PartialKind, e.MatchingResources)
+	}
+	return fmt.Sprintf("%v matches multiple resources or kinds", e.PartialKind)
+}
+
+func (*AmbiguousKindError) Is(target error) bool {
+	_, ok := target.(*AmbiguousKindError)
+	return ok
+}
+
+func IsAmbiguousError(err error) bool {
+	if err == nil {
+		return false
+	}
+	return errors.Is(err, &AmbiguousResourceError{}) || errors.Is(err, &AmbiguousKindError{})
+}
+
+// NoResourceMatchError is returned if the RESTMapper can't find any match for a resource
+type NoResourceMatchError struct {
+	PartialResource schema.GroupVersionResource
+}
+
+func (e *NoResourceMatchError) Error() string {
+	return fmt.Sprintf("no matches for %v", e.PartialResource)
+}
+
+func (*NoResourceMatchError) Is(target error) bool {
+	_, ok := target.(*NoResourceMatchError)
+	return ok
+}
+
+// NoKindMatchError is returned if the RESTMapper can't find any match for a kind
+type NoKindMatchError struct {
+	// GroupKind is the API group and kind that was searched
+	GroupKind schema.GroupKind
+	// SearchedVersions is the optional list of versions the search was restricted to
+	SearchedVersions []string
+}
+
+func (e *NoKindMatchError) Error() string {
+	searchedVersions := sets.NewString()
+	for _, v := range e.SearchedVersions {
+		searchedVersions.Insert(schema.GroupVersion{Group: e.GroupKind.Group, Version: v}.String())
+	}
+
+	switch len(searchedVersions) {
+	case 0:
+		return fmt.Sprintf("no matches for kind %q in group %q", e.GroupKind.Kind, e.GroupKind.Group)
+	case 1:
+		return fmt.Sprintf("no matches for kind %q in version %q", e.GroupKind.Kind, searchedVersions.List()[0])
+	default:
+		return fmt.Sprintf("no matches for kind %q in versions %q", e.GroupKind.Kind, searchedVersions.List())
+	}
+}
+
+func (*NoKindMatchError) Is(target error) bool {
+	_, ok := target.(*NoKindMatchError)
+	return ok
+}
+
+func IsNoMatchError(err error) bool {
+	if err == nil {
+		return false
+	}
+	return errors.Is(err, &NoResourceMatchError{}) || errors.Is(err, &NoKindMatchError{})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/errors_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/errors_test.go
new file mode 100644
index 0000000000..56e5d030b4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/errors_test.go
@@ -0,0 +1,79 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestErrorMatching(t *testing.T) {
+	testCases := []struct {
+		name string
+		// input should contain an error that is _not_ empty, otherwise the naive reflectlite.DeepEqual matching of
+		// the errors lib will always succeed, but for all of these we want to verify that the matching is based on
+		// type.
+		input       error
+		new         func() error
+		matcherFunc func(error) bool
+	}{
+		{
+			name:        "AmbiguousResourceError",
+			input:       &AmbiguousResourceError{MatchingResources: []schema.GroupVersionResource{{}}},
+			new:         func() error { return &AmbiguousResourceError{} },
+			matcherFunc: IsAmbiguousError,
+		},
+		{
+			name:        "AmbiguousKindError",
+			input:       &AmbiguousKindError{MatchingResources: []schema.GroupVersionResource{{}}},
+			new:         func() error { return &AmbiguousKindError{} },
+			matcherFunc: IsAmbiguousError,
+		},
+		{
+			name:        "NoResourceMatchError",
+			input:       &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Group: "foo"}},
+			new:         func() error { return &NoResourceMatchError{} },
+			matcherFunc: IsNoMatchError,
+		},
+		{
+			name:        "NoKindMatchError",
+			input:       &NoKindMatchError{SearchedVersions: []string{"foo"}},
+			new:         func() error { return &NoKindMatchError{} },
+			matcherFunc: IsNoMatchError,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if !errors.Is(tc.input, tc.new()) {
+				t.Error("error doesn't match itself directly")
+			}
+			if !errors.Is(fmt.Errorf("wrapepd: %w", tc.input), tc.new()) {
+				t.Error("error doesn't match itself when wrapped")
+			}
+			if !tc.matcherFunc(tc.input) {
+				t.Errorf("error doesn't get matched by matcherfunc")
+			}
+			if errors.Is(tc.input, errors.New("foo")) {
+				t.Error("error incorrectly matches other error")
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/firsthit_restmapper.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/firsthit_restmapper.go
new file mode 100644
index 0000000000..1bc816fe3f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/firsthit_restmapper.go
@@ -0,0 +1,105 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+)
+
+var (
+	_ ResettableRESTMapper = &FirstHitRESTMapper{}
+)
+
+// FirstHitRESTMapper is a wrapper for multiple RESTMappers which returns the
+// first successful result for the singular requests
+type FirstHitRESTMapper struct {
+	MultiRESTMapper
+}
+
+func (m FirstHitRESTMapper) String() string {
+	return fmt.Sprintf("FirstHitRESTMapper{\n\t%v\n}", m.MultiRESTMapper)
+}
+
+func (m FirstHitRESTMapper) ResourceFor(resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	errors := []error{}
+	for _, t := range m.MultiRESTMapper {
+		ret, err := t.ResourceFor(resource)
+		if err == nil {
+			return ret, nil
+		}
+		errors = append(errors, err)
+	}
+
+	return schema.GroupVersionResource{}, collapseAggregateErrors(errors)
+}
+
+func (m FirstHitRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	errors := []error{}
+	for _, t := range m.MultiRESTMapper {
+		ret, err := t.KindFor(resource)
+		if err == nil {
+			return ret, nil
+		}
+		errors = append(errors, err)
+	}
+
+	return schema.GroupVersionKind{}, collapseAggregateErrors(errors)
+}
+
+// RESTMapping provides the REST mapping for the resource based on the
+// kind and version. This implementation supports multiple REST schemas and
+// return the first match.
+func (m FirstHitRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	errors := []error{}
+	for _, t := range m.MultiRESTMapper {
+		ret, err := t.RESTMapping(gk, versions...)
+		if err == nil {
+			return ret, nil
+		}
+		errors = append(errors, err)
+	}
+
+	return nil, collapseAggregateErrors(errors)
+}
+
+func (m FirstHitRESTMapper) Reset() {
+	m.MultiRESTMapper.Reset()
+}
+
+// collapseAggregateErrors returns the minimal errors.  it handles empty as nil, handles one item in a list
+// by returning the item, and collapses all NoMatchErrors to a single one (since they should all be the same)
+func collapseAggregateErrors(errors []error) error {
+	if len(errors) == 0 {
+		return nil
+	}
+	if len(errors) == 1 {
+		return errors[0]
+	}
+
+	allNoMatchErrors := true
+	for _, err := range errors {
+		allNoMatchErrors = allNoMatchErrors && IsNoMatchError(err)
+	}
+	if allNoMatchErrors {
+		return errors[0]
+	}
+
+	return utilerrors.NewAggregate(errors)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/help.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/help.go
new file mode 100644
index 0000000000..468afd0e9e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/help.go
@@ -0,0 +1,334 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+	"sync"
+
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+var (
+	// isListCache maintains a cache of types that are checked for lists
+	// which is used by IsListType.
+	// TODO: remove and replace with an interface check
+	isListCache = struct {
+		lock   sync.RWMutex
+		byType map[reflect.Type]bool
+	}{
+		byType: make(map[reflect.Type]bool, 1024),
+	}
+)
+
+// IsListType returns true if the provided Object has a slice called Items.
+// TODO: Replace the code in this check with an interface comparison by
+// creating and enforcing that lists implement a list accessor.
+func IsListType(obj runtime.Object) bool {
+	switch t := obj.(type) {
+	case runtime.Unstructured:
+		return t.IsList()
+	}
+	t := reflect.TypeOf(obj)
+
+	isListCache.lock.RLock()
+	ok, exists := isListCache.byType[t]
+	isListCache.lock.RUnlock()
+
+	if !exists {
+		_, err := getItemsPtr(obj)
+		ok = err == nil
+
+		// cache only the first 1024 types
+		isListCache.lock.Lock()
+		if len(isListCache.byType) < 1024 {
+			isListCache.byType[t] = ok
+		}
+		isListCache.lock.Unlock()
+	}
+
+	return ok
+}
+
+var (
+	errExpectFieldItems = errors.New("no Items field in this object")
+	errExpectSliceItems = errors.New("Items field must be a slice of objects")
+)
+
+// GetItemsPtr returns a pointer to the list object's Items member.
+// If 'list' doesn't have an Items member, it's not really a list type
+// and an error will be returned.
+// This function will either return a pointer to a slice, or an error, but not both.
+// TODO: this will be replaced with an interface in the future
+func GetItemsPtr(list runtime.Object) (interface{}, error) {
+	obj, err := getItemsPtr(list)
+	if err != nil {
+		return nil, fmt.Errorf("%T is not a list: %v", list, err)
+	}
+	return obj, nil
+}
+
+// getItemsPtr returns a pointer to the list object's Items member or an error.
+func getItemsPtr(list runtime.Object) (interface{}, error) {
+	v, err := conversion.EnforcePtr(list)
+	if err != nil {
+		return nil, err
+	}
+
+	items := v.FieldByName("Items")
+	if !items.IsValid() {
+		return nil, errExpectFieldItems
+	}
+	switch items.Kind() {
+	case reflect.Interface, reflect.Pointer:
+		target := reflect.TypeOf(items.Interface()).Elem()
+		if target.Kind() != reflect.Slice {
+			return nil, errExpectSliceItems
+		}
+		return items.Interface(), nil
+	case reflect.Slice:
+		return items.Addr().Interface(), nil
+	default:
+		return nil, errExpectSliceItems
+	}
+}
+
+// EachListItem invokes fn on each runtime.Object in the list. Any error immediately terminates
+// the loop.
+//
+// If items passed to fn are retained for different durations, and you want to avoid
+// retaining all items in obj as long as any item is referenced, use EachListItemWithAlloc instead.
+func EachListItem(obj runtime.Object, fn func(runtime.Object) error) error {
+	return eachListItem(obj, fn, false)
+}
+
+// EachListItemWithAlloc works like EachListItem, but avoids retaining references to the items slice in obj.
+// It does this by making a shallow copy of non-pointer items in obj.
+//
+// If the items passed to fn are not retained, or are retained for the same duration, use EachListItem instead for memory efficiency.
+func EachListItemWithAlloc(obj runtime.Object, fn func(runtime.Object) error) error {
+	return eachListItem(obj, fn, true)
+}
+
+// allocNew: Whether shallow copy is required when the elements in Object.Items are struct
+func eachListItem(obj runtime.Object, fn func(runtime.Object) error, allocNew bool) error {
+	if unstructured, ok := obj.(runtime.Unstructured); ok {
+		if allocNew {
+			return unstructured.EachListItemWithAlloc(fn)
+		}
+		return unstructured.EachListItem(fn)
+	}
+	// TODO: Change to an interface call?
+	itemsPtr, err := GetItemsPtr(obj)
+	if err != nil {
+		return err
+	}
+	items, err := conversion.EnforcePtr(itemsPtr)
+	if err != nil {
+		return err
+	}
+	len := items.Len()
+	if len == 0 {
+		return nil
+	}
+	takeAddr := false
+	if elemType := items.Type().Elem(); elemType.Kind() != reflect.Pointer && elemType.Kind() != reflect.Interface {
+		if !items.Index(0).CanAddr() {
+			return fmt.Errorf("unable to take address of items in %T for EachListItem", obj)
+		}
+		takeAddr = true
+	}
+
+	for i := 0; i < len; i++ {
+		raw := items.Index(i)
+		if takeAddr {
+			if allocNew {
+				// shallow copy to avoid retaining a reference to the original list item
+				itemCopy := reflect.New(raw.Type())
+				// assign to itemCopy and type-assert
+				itemCopy.Elem().Set(raw)
+				// reflect.New will guarantee that itemCopy must be a pointer.
+				raw = itemCopy
+			} else {
+				raw = raw.Addr()
+			}
+		}
+		// raw must be a pointer or an interface
+		// allocate a pointer is cheap
+		switch item := raw.Interface().(type) {
+		case *runtime.RawExtension:
+			if err := fn(item.Object); err != nil {
+				return err
+			}
+		case runtime.Object:
+			if err := fn(item); err != nil {
+				return err
+			}
+		default:
+			obj, ok := item.(runtime.Object)
+			if !ok {
+				return fmt.Errorf("%v: item[%v]: Expected object, got %#v(%s)", obj, i, raw.Interface(), raw.Kind())
+			}
+			if err := fn(obj); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// ExtractList returns obj's Items element as an array of runtime.Objects.
+// Returns an error if obj is not a List type (does not have an Items member).
+//
+// If items in the returned list are retained for different durations, and you want to avoid
+// retaining all items in obj as long as any item is referenced, use ExtractListWithAlloc instead.
+func ExtractList(obj runtime.Object) ([]runtime.Object, error) {
+	return extractList(obj, false)
+}
+
+// ExtractListWithAlloc works like ExtractList, but avoids retaining references to the items slice in obj.
+// It does this by making a shallow copy of non-pointer items in obj.
+//
+// If the items in the returned list are not retained, or are retained for the same duration, use ExtractList instead for memory efficiency.
+func ExtractListWithAlloc(obj runtime.Object) ([]runtime.Object, error) {
+	return extractList(obj, true)
+}
+
+// allocNew: Whether shallow copy is required when the elements in Object.Items are struct
+func extractList(obj runtime.Object, allocNew bool) ([]runtime.Object, error) {
+	itemsPtr, err := GetItemsPtr(obj)
+	if err != nil {
+		return nil, err
+	}
+	items, err := conversion.EnforcePtr(itemsPtr)
+	if err != nil {
+		return nil, err
+	}
+	if items.IsNil() {
+		return nil, nil
+	}
+	list := make([]runtime.Object, items.Len())
+	if len(list) == 0 {
+		return list, nil
+	}
+	elemType := items.Type().Elem()
+	isRawExtension := elemType == rawExtensionObjectType
+	implementsObject := elemType.Implements(objectType)
+	for i := range list {
+		raw := items.Index(i)
+		switch {
+		case isRawExtension:
+			item := raw.Interface().(runtime.RawExtension)
+			switch {
+			case item.Object != nil:
+				list[i] = item.Object
+			case item.Raw != nil:
+				// TODO: Set ContentEncoding and ContentType correctly.
+				list[i] = &runtime.Unknown{Raw: item.Raw}
+			default:
+				list[i] = nil
+			}
+		case implementsObject:
+			list[i] = raw.Interface().(runtime.Object)
+		case allocNew:
+			// shallow copy to avoid retaining a reference to the original list item
+			itemCopy := reflect.New(raw.Type())
+			// assign to itemCopy and type-assert
+			itemCopy.Elem().Set(raw)
+			var ok bool
+			// reflect.New will guarantee that itemCopy must be a pointer.
+			if list[i], ok = itemCopy.Interface().(runtime.Object); !ok {
+				return nil, fmt.Errorf("%v: item[%v]: Expected object, got %#v(%s)", obj, i, raw.Interface(), raw.Kind())
+			}
+		default:
+			var found bool
+			if list[i], found = raw.Addr().Interface().(runtime.Object); !found {
+				return nil, fmt.Errorf("%v: item[%v]: Expected object, got %#v(%s)", obj, i, raw.Interface(), raw.Kind())
+			}
+		}
+	}
+	return list, nil
+}
+
+var (
+	// objectSliceType is the type of a slice of Objects
+	objectSliceType        = reflect.TypeOf([]runtime.Object{})
+	objectType             = reflect.TypeOf((*runtime.Object)(nil)).Elem()
+	rawExtensionObjectType = reflect.TypeOf(runtime.RawExtension{})
+)
+
+// LenList returns the length of this list or 0 if it is not a list.
+func LenList(list runtime.Object) int {
+	itemsPtr, err := GetItemsPtr(list)
+	if err != nil {
+		return 0
+	}
+	items, err := conversion.EnforcePtr(itemsPtr)
+	if err != nil {
+		return 0
+	}
+	return items.Len()
+}
+
+// SetList sets the given list object's Items member have the elements given in
+// objects.
+// Returns an error if list is not a List type (does not have an Items member),
+// or if any of the objects are not of the right type.
+func SetList(list runtime.Object, objects []runtime.Object) error {
+	itemsPtr, err := GetItemsPtr(list)
+	if err != nil {
+		return err
+	}
+	items, err := conversion.EnforcePtr(itemsPtr)
+	if err != nil {
+		return err
+	}
+	if items.Type() == objectSliceType {
+		items.Set(reflect.ValueOf(objects))
+		return nil
+	}
+	slice := reflect.MakeSlice(items.Type(), len(objects), len(objects))
+	for i := range objects {
+		dest := slice.Index(i)
+		if dest.Type() == rawExtensionObjectType {
+			dest = dest.FieldByName("Object")
+		}
+
+		// check to see if you're directly assignable
+		if reflect.TypeOf(objects[i]).AssignableTo(dest.Type()) {
+			dest.Set(reflect.ValueOf(objects[i]))
+			continue
+		}
+
+		src, err := conversion.EnforcePtr(objects[i])
+		if err != nil {
+			return err
+		}
+		if src.Type().AssignableTo(dest.Type()) {
+			dest.Set(src)
+		} else if src.Type().ConvertibleTo(dest.Type()) {
+			dest.Set(src.Convert(dest.Type()))
+		} else {
+			return fmt.Errorf("item[%d]: can't assign or convert %v into %v", i, src.Type(), dest.Type())
+		}
+	}
+	items.Set(slice)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/help_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/help_test.go
new file mode 100644
index 0000000000..e3047f50f1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/help_test.go
@@ -0,0 +1,585 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"reflect"
+	"strconv"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+const (
+	fakeObjectItemsNum = 1000
+	exemptObjectIndex  = fakeObjectItemsNum / 4
+)
+
+type SampleSpec struct {
+	Flied int
+}
+
+type FooSpec struct {
+	Flied int
+}
+
+type FooList struct {
+	metav1.TypeMeta
+	metav1.ListMeta
+	Items []Foo
+}
+
+func (s *FooList) DeepCopyObject() runtime.Object { panic("unimplemented") }
+
+type SampleList struct {
+	metav1.TypeMeta
+	metav1.ListMeta
+	Items []Sample
+}
+
+func (s *SampleList) DeepCopyObject() runtime.Object { panic("unimplemented") }
+
+type RawExtensionList struct {
+	metav1.TypeMeta
+	metav1.ListMeta
+
+	Items []runtime.RawExtension
+}
+
+func (l RawExtensionList) DeepCopyObject() runtime.Object { panic("unimplemented") }
+
+// NOTE: Foo struct itself is the implementer of runtime.Object.
+type Foo struct {
+	metav1.TypeMeta
+	metav1.ObjectMeta
+	Spec FooSpec
+}
+
+func (f Foo) GetObjectKind() schema.ObjectKind {
+	tm := f.TypeMeta
+	return &tm
+}
+
+func (f Foo) DeepCopyObject() runtime.Object { panic("unimplemented") }
+
+// NOTE: the pointer of Sample that is the implementer of runtime.Object.
+// the behavior is similar to our corev1.Pod. corev1.Node
+type Sample struct {
+	metav1.TypeMeta
+	metav1.ObjectMeta
+	Spec SampleSpec
+}
+
+func (s *Sample) GetObjectKind() schema.ObjectKind {
+	tm := s.TypeMeta
+	return &tm
+}
+
+func (s *Sample) DeepCopyObject() runtime.Object { panic("unimplemented") }
+
+func fakeSampleList(numItems int) *SampleList {
+	out := &SampleList{
+		Items: make([]Sample, numItems),
+	}
+
+	for i := range out.Items {
+		out.Items[i] = Sample{
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: "sample.org/v1",
+				Kind:       "Sample",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      strconv.Itoa(i),
+				Namespace: "default",
+				Labels: map[string]string{
+					"label-key-1": "label-value-1",
+				},
+				Annotations: map[string]string{
+					"annotations-key-1": "annotations-value-1",
+				},
+			},
+			Spec: SampleSpec{
+				Flied: i,
+			},
+		}
+	}
+	return out
+}
+
+func fakeExtensionList(numItems int) *RawExtensionList {
+	out := &RawExtensionList{
+		Items: make([]runtime.RawExtension, numItems),
+	}
+
+	for i := range out.Items {
+		out.Items[i] = runtime.RawExtension{
+			Object: &Foo{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "sample.org/v2",
+					Kind:       "Sample",
+				},
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      strconv.Itoa(i),
+					Namespace: "default",
+					Labels: map[string]string{
+						"label-key-1": "label-value-1",
+					},
+					Annotations: map[string]string{
+						"annotations-key-1": "annotations-value-1",
+					},
+				},
+				Spec: FooSpec{
+					Flied: i,
+				},
+			},
+		}
+	}
+	return out
+}
+
+func fakeUnstructuredList(numItems int) runtime.Unstructured {
+	out := &unstructured.UnstructuredList{
+		Items: make([]unstructured.Unstructured, numItems),
+	}
+
+	for i := range out.Items {
+		out.Items[i] = unstructured.Unstructured{
+			Object: map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "Pod",
+				"metadata": map[string]interface{}{
+					"creationTimestamp": nil,
+					"name":              strconv.Itoa(i),
+				},
+				"spec": map[string]interface{}{
+					"hostname": "example.com",
+				},
+				"status": map[string]interface{}{},
+			},
+		}
+	}
+	return out
+}
+
+func fakeFooList(numItems int) *FooList {
+	out := &FooList{
+		Items: make([]Foo, numItems),
+	}
+
+	for i := range out.Items {
+		out.Items[i] = Foo{
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: "foo.org/v1",
+				Kind:       "Foo",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      strconv.Itoa(i),
+				Namespace: "default",
+				Labels: map[string]string{
+					"label-key-1": "label-value-1",
+				},
+				Annotations: map[string]string{
+					"annotations-key-1": "annotations-value-1",
+				},
+			},
+			Spec: FooSpec{
+				Flied: i,
+			},
+		}
+	}
+	return out
+}
+
+func TestEachList(t *testing.T) {
+	tests := []struct {
+		name            string
+		generateFunc    func(num int) (list runtime.Object)
+		expectObjectNum int
+	}{
+		{
+			name: "StructReceiverList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeFooList(num)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+		{
+			name: "PointerReceiverList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeSampleList(num)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+		{
+			name: "RawExtensionList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeExtensionList(num)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+		{
+			name: "UnstructuredList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeUnstructuredList(fakeObjectItemsNum)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Run("EachListItem", func(t *testing.T) {
+				expectObjectNames := map[string]struct{}{}
+				for i := 0; i < tc.expectObjectNum; i++ {
+					expectObjectNames[strconv.Itoa(i)] = struct{}{}
+				}
+				list := tc.generateFunc(tc.expectObjectNum)
+				err := EachListItem(list, func(object runtime.Object) error {
+					o, err := Accessor(object)
+					if err != nil {
+						return err
+					}
+					delete(expectObjectNames, o.GetName())
+					return nil
+				})
+				if err != nil {
+					t.Errorf("each list item %#v: %v", list, err)
+				}
+				if len(expectObjectNames) != 0 {
+					t.Fatal("expectObjectNames should be empty")
+				}
+			})
+			t.Run("EachListItemWithAlloc", func(t *testing.T) {
+				expectObjectNames := map[string]struct{}{}
+				for i := 0; i < tc.expectObjectNum; i++ {
+					expectObjectNames[strconv.Itoa(i)] = struct{}{}
+				}
+				list := tc.generateFunc(tc.expectObjectNum)
+				err := EachListItemWithAlloc(list, func(object runtime.Object) error {
+					o, err := Accessor(object)
+					if err != nil {
+						return err
+					}
+					delete(expectObjectNames, o.GetName())
+					return nil
+				})
+				if err != nil {
+					t.Errorf("each list %#v with alloc: %v", list, err)
+				}
+				if len(expectObjectNames) != 0 {
+					t.Fatal("expectObjectNames should be empty")
+				}
+			})
+		})
+	}
+}
+
+func TestExtractList(t *testing.T) {
+	tests := []struct {
+		name            string
+		generateFunc    func(num int) (list runtime.Object)
+		expectObjectNum int
+	}{
+		{
+			name: "StructReceiverList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeFooList(num)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+		{
+			name: "PointerReceiverList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeSampleList(num)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+		{
+			name: "RawExtensionList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeExtensionList(num)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+		{
+			name: "UnstructuredList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeUnstructuredList(fakeObjectItemsNum)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Run("ExtractList", func(t *testing.T) {
+				expectObjectNames := map[string]struct{}{}
+				for i := 0; i < tc.expectObjectNum; i++ {
+					expectObjectNames[strconv.Itoa(i)] = struct{}{}
+				}
+				list := tc.generateFunc(tc.expectObjectNum)
+				objs, err := ExtractList(list)
+				if err != nil {
+					t.Fatalf("extract list %#v: %v", list, err)
+				}
+				for i := range objs {
+					var (
+						o   metav1.Object
+						err error
+						obj = objs[i]
+					)
+
+					if reflect.TypeOf(obj).Kind() == reflect.Struct {
+						copy := reflect.New(reflect.TypeOf(obj))
+						copy.Elem().Set(reflect.ValueOf(obj))
+						o, err = Accessor(copy.Interface())
+					} else {
+						o, err = Accessor(obj)
+					}
+					if err != nil {
+						t.Fatalf("Accessor object %#v: %v", obj, err)
+					}
+					delete(expectObjectNames, o.GetName())
+				}
+				if len(expectObjectNames) != 0 {
+					t.Fatal("expectObjectNames should be empty")
+				}
+			})
+			t.Run("ExtractListWithAlloc", func(t *testing.T) {
+				expectObjectNames := map[string]struct{}{}
+				for i := 0; i < tc.expectObjectNum; i++ {
+					expectObjectNames[strconv.Itoa(i)] = struct{}{}
+				}
+				list := tc.generateFunc(tc.expectObjectNum)
+				objs, err := ExtractListWithAlloc(list)
+				if err != nil {
+					t.Fatalf("extract list with alloc: %v", err)
+				}
+				for i := range objs {
+					var (
+						o   metav1.Object
+						err error
+						obj = objs[i]
+					)
+					if reflect.TypeOf(obj).Kind() == reflect.Struct {
+						copy := reflect.New(reflect.TypeOf(obj))
+						copy.Elem().Set(reflect.ValueOf(obj))
+						o, err = Accessor(copy.Interface())
+					} else {
+						o, err = Accessor(obj)
+					}
+					if err != nil {
+						t.Fatalf("Accessor object %#v: %v", obj, err)
+					}
+					delete(expectObjectNames, o.GetName())
+				}
+				if len(expectObjectNames) != 0 {
+					t.Fatal("expectObjectNames should be empty")
+				}
+			})
+		})
+	}
+}
+
+func TestLenList(t *testing.T) {
+	tests := []struct {
+		name string
+		list runtime.Object
+		want int
+	}{
+		{
+			name: "nil",
+			list: nil,
+			want: 0,
+		},
+		{
+			name: "empty FooList",
+			list: &FooList{},
+			want: 0,
+		},
+		{
+			name: "FooList",
+			list: fakeFooList(fakeObjectItemsNum),
+			want: fakeObjectItemsNum,
+		},
+		{
+			name: "SampleList",
+			list: fakeSampleList(fakeObjectItemsNum),
+			want: fakeObjectItemsNum,
+		},
+		{
+			name: "RawExtensionList",
+			list: fakeExtensionList(fakeObjectItemsNum),
+			want: fakeObjectItemsNum,
+		},
+		{
+			name: "UnstructuredList",
+			list: fakeUnstructuredList(fakeObjectItemsNum).(*unstructured.UnstructuredList),
+			want: fakeObjectItemsNum,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := LenList(tc.list); got != tc.want {
+				t.Errorf("LenList() = %d, want %d", got, tc.want)
+			}
+		})
+	}
+}
+
+func BenchmarkExtractListItem(b *testing.B) {
+	tests := []struct {
+		name string
+		list runtime.Object
+	}{
+		{
+			name: "StructReceiverList",
+			list: fakeFooList(fakeObjectItemsNum),
+		},
+		{
+			name: "PointerReceiverList",
+			list: fakeSampleList(fakeObjectItemsNum),
+		},
+		{
+			name: "RawExtensionList",
+			list: fakeExtensionList(fakeObjectItemsNum),
+		},
+	}
+	for _, tc := range tests {
+		b.Run(tc.name, func(b *testing.B) {
+			b.ResetTimer()
+			for i := 0; i < b.N; i++ {
+				_, err := ExtractList(tc.list)
+				if err != nil {
+					b.Fatalf("ExtractList: %v", err)
+				}
+			}
+			b.StopTimer()
+		})
+	}
+}
+
+func BenchmarkEachListItem(b *testing.B) {
+	tests := []struct {
+		name string
+		list runtime.Object
+	}{
+		{
+			name: "StructReceiverList",
+			list: fakeFooList(fakeObjectItemsNum),
+		},
+		{
+			name: "PointerReceiverList",
+			list: fakeSampleList(fakeObjectItemsNum),
+		},
+		{
+			name: "RawExtensionList",
+			list: fakeExtensionList(fakeObjectItemsNum),
+		},
+		{
+			name: "UnstructuredList",
+			list: fakeUnstructuredList(fakeObjectItemsNum),
+		},
+	}
+	for _, tc := range tests {
+		b.Run(tc.name, func(b *testing.B) {
+			b.ResetTimer()
+			for i := 0; i < b.N; i++ {
+				err := EachListItem(tc.list, func(object runtime.Object) error {
+					return nil
+				})
+				if err != nil {
+					b.Fatalf("EachListItem: %v", err)
+				}
+			}
+			b.StopTimer()
+		})
+	}
+}
+
+func BenchmarkExtractListItemWithAlloc(b *testing.B) {
+	tests := []struct {
+		name string
+		list runtime.Object
+	}{
+		{
+			name: "StructReceiverList",
+			list: fakeFooList(fakeObjectItemsNum),
+		},
+		{
+			name: "PointerReceiverList",
+			list: fakeSampleList(fakeObjectItemsNum),
+		},
+		{
+			name: "RawExtensionList",
+			list: fakeExtensionList(fakeObjectItemsNum),
+		},
+	}
+	for _, tc := range tests {
+		b.Run(tc.name, func(b *testing.B) {
+			b.ResetTimer()
+			for i := 0; i < b.N; i++ {
+				_, err := ExtractListWithAlloc(tc.list)
+				if err != nil {
+					b.Fatalf("ExtractListWithAlloc: %v", err)
+				}
+			}
+			b.StopTimer()
+		})
+	}
+}
+
+func BenchmarkEachListItemWithAlloc(b *testing.B) {
+	tests := []struct {
+		name string
+		list runtime.Object
+	}{
+		{
+			name: "StructReceiverList",
+			list: fakeFooList(fakeObjectItemsNum),
+		},
+		{
+			name: "PointerReceiverList",
+			list: fakeSampleList(fakeObjectItemsNum),
+		},
+		{
+			name: "RawExtensionList",
+			list: fakeExtensionList(fakeObjectItemsNum),
+		},
+		{
+			name: "UnstructuredList",
+			list: fakeUnstructuredList(fakeObjectItemsNum),
+		},
+	}
+	for _, tc := range tests {
+		b.Run(tc.name, func(b *testing.B) {
+			b.ResetTimer()
+			for i := 0; i < b.N; i++ {
+				err := EachListItemWithAlloc(tc.list, func(object runtime.Object) error {
+					return nil
+				})
+				if err != nil {
+					b.Fatalf("EachListItemWithAlloc: %v", err)
+				}
+			}
+			b.StopTimer()
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/interfaces.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/interfaces.go
new file mode 100644
index 0000000000..628187eeeb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/interfaces.go
@@ -0,0 +1,250 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+type ListMetaAccessor interface {
+	GetListMeta() List
+}
+
+// List lets you work with list metadata from any of the versioned or
+// internal API objects. Attempting to set or retrieve a field on an object that does
+// not support that field will be a no-op and return a default value.
+type List metav1.ListInterface
+
+// Type exposes the type and APIVersion of versioned or internal API objects.
+type Type metav1.Type
+
+// MetadataAccessor lets you work with object and list metadata from any of the versioned or
+// internal API objects. Attempting to set or retrieve a field on an object that does
+// not support that field (Name, UID, Namespace on lists) will be a no-op and return
+// a default value.
+//
+// MetadataAccessor exposes Interface in a way that can be used with multiple objects.
+type MetadataAccessor interface {
+	APIVersion(obj runtime.Object) (string, error)
+	SetAPIVersion(obj runtime.Object, version string) error
+
+	Kind(obj runtime.Object) (string, error)
+	SetKind(obj runtime.Object, kind string) error
+
+	Namespace(obj runtime.Object) (string, error)
+	SetNamespace(obj runtime.Object, namespace string) error
+
+	Name(obj runtime.Object) (string, error)
+	SetName(obj runtime.Object, name string) error
+
+	GenerateName(obj runtime.Object) (string, error)
+	SetGenerateName(obj runtime.Object, name string) error
+
+	UID(obj runtime.Object) (types.UID, error)
+	SetUID(obj runtime.Object, uid types.UID) error
+
+	SelfLink(obj runtime.Object) (string, error)
+	SetSelfLink(obj runtime.Object, selfLink string) error
+
+	Labels(obj runtime.Object) (map[string]string, error)
+	SetLabels(obj runtime.Object, labels map[string]string) error
+
+	Annotations(obj runtime.Object) (map[string]string, error)
+	SetAnnotations(obj runtime.Object, annotations map[string]string) error
+
+	Continue(obj runtime.Object) (string, error)
+	SetContinue(obj runtime.Object, c string) error
+
+	runtime.ResourceVersioner
+}
+
+type RESTScopeName string
+
+const (
+	RESTScopeNameNamespace RESTScopeName = "namespace"
+	RESTScopeNameRoot      RESTScopeName = "root"
+)
+
+// RESTScope contains the information needed to deal with REST resources that are in a resource hierarchy
+type RESTScope interface {
+	// Name of the scope
+	Name() RESTScopeName
+}
+
+// RESTMapping contains the information needed to deal with objects of a specific
+// resource and kind in a RESTful manner.
+type RESTMapping struct {
+	// Resource is the GroupVersionResource (location) for this endpoint
+	Resource schema.GroupVersionResource
+
+	// GroupVersionKind is the GroupVersionKind (data format) to submit to this endpoint
+	GroupVersionKind schema.GroupVersionKind
+
+	// Scope contains the information needed to deal with REST Resources that are in a resource hierarchy
+	Scope RESTScope
+}
+
+// RESTMapper allows clients to map resources to kind, and map kind and version
+// to interfaces for manipulating those objects. It is primarily intended for
+// consumers of Kubernetes compatible REST APIs as defined in docs/devel/api-conventions.md.
+//
+// The Kubernetes API provides versioned resources and object kinds which are scoped
+// to API groups. In other words, kinds and resources should not be assumed to be
+// unique across groups.
+//
+// RESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use RESTMapperWithContext instead.
+type RESTMapper interface {
+	// KindFor takes a partial resource and returns the single match.  Returns an error if there are multiple matches
+	KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error)
+
+	// KindsFor takes a partial resource and returns the list of potential kinds in priority order
+	KindsFor(resource schema.GroupVersionResource) ([]schema.GroupVersionKind, error)
+
+	// ResourceFor takes a partial resource and returns the single match.  Returns an error if there are multiple matches
+	ResourceFor(input schema.GroupVersionResource) (schema.GroupVersionResource, error)
+
+	// ResourcesFor takes a partial resource and returns the list of potential resource in priority order
+	ResourcesFor(input schema.GroupVersionResource) ([]schema.GroupVersionResource, error)
+
+	// RESTMapping identifies a preferred resource mapping for the provided group kind.
+	RESTMapping(gk schema.GroupKind, versions ...string) (*RESTMapping, error)
+	// RESTMappings returns all resource mappings for the provided group kind if no
+	// version search is provided. Otherwise identifies a preferred resource mapping for
+	// the provided version(s).
+	RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error)
+
+	ResourceSingularizer(resource string) (singular string, err error)
+}
+
+// RESTMapperWithContext allows clients to map resources to kind, and map kind and version
+// to interfaces for manipulating those objects. It is primarily intended for
+// consumers of Kubernetes compatible REST APIs as defined in docs/devel/api-conventions.md.
+//
+// The Kubernetes API provides versioned resources and object kinds which are scoped
+// to API groups. In other words, kinds and resources should not be assumed to be
+// unique across groups.
+type RESTMapperWithContext interface {
+	// KindFor takes a partial resource and returns the single match.  Returns an error if there are multiple matches
+	KindForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error)
+
+	// KindsFor takes a partial resource and returns the list of potential kinds in priority order
+	KindsForWithContext(ctx context.Context, resource schema.GroupVersionResource) ([]schema.GroupVersionKind, error)
+
+	// ResourceFor takes a partial resource and returns the single match.  Returns an error if there are multiple matches
+	ResourceForWithContext(ctx context.Context, input schema.GroupVersionResource) (schema.GroupVersionResource, error)
+
+	// ResourcesFor takes a partial resource and returns the list of potential resource in priority order
+	ResourcesForWithContext(ctx context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionResource, error)
+
+	// RESTMapping identifies a preferred resource mapping for the provided group kind.
+	RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error)
+	// RESTMappings returns all resource mappings for the provided group kind if no
+	// version search is provided. Otherwise identifies a preferred resource mapping for
+	// the provided version(s).
+	RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error)
+
+	ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error)
+}
+
+func ToRESTMapperWithContext(m RESTMapper) RESTMapperWithContext {
+	if m == nil {
+		return nil
+	}
+	if m, ok := m.(RESTMapperWithContext); ok {
+		return m
+	}
+	return &restMapperWrapper{
+		delegate: m,
+	}
+}
+
+type restMapperWrapper struct {
+	delegate RESTMapper
+}
+
+func (m *restMapperWrapper) KindForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return m.delegate.KindFor(resource)
+}
+func (m *restMapperWrapper) KindsForWithContext(ctx context.Context, resource schema.GroupVersionResource) ([]schema.GroupVersionKind, error) {
+	return m.delegate.KindsFor(resource)
+}
+func (m *restMapperWrapper) ResourceForWithContext(ctx context.Context, input schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	return m.delegate.ResourceFor(input)
+}
+func (m *restMapperWrapper) ResourcesForWithContext(ctx context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return m.delegate.ResourcesFor(input)
+}
+func (m *restMapperWrapper) RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	return m.delegate.RESTMapping(gk, versions...)
+}
+func (m *restMapperWrapper) RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	return m.delegate.RESTMappings(gk, versions...)
+}
+func (m *restMapperWrapper) ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error) {
+	return m.delegate.ResourceSingularizer(resource)
+}
+
+// ResettableRESTMapper is a RESTMapper which is capable of resetting itself
+// from discovery.
+// All rest mappers that delegate to other rest mappers must implement this interface and dynamically
+// check if the delegate mapper supports the Reset() operation.
+//
+// ResettableRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ResettableRESTMapperWithContext instead.
+type ResettableRESTMapper interface {
+	RESTMapper
+	Reset()
+}
+
+// ResettableRESTMapperWithContext is a RESTMapper which is capable of resetting itself
+// from discovery.
+// All rest mappers that delegate to other rest mappers must implement this interface and dynamically
+// check if the delegate mapper supports the ResetWithContext() operation.
+type ResettableRESTMapperWithContext interface {
+	RESTMapperWithContext
+	ResetWithContext(ctx context.Context)
+}
+
+func ToResettableRESTMapperWithContext(m ResettableRESTMapper) ResettableRESTMapperWithContext {
+	if m == nil {
+		return nil
+	}
+	if m, ok := m.(ResettableRESTMapperWithContext); ok {
+		return m
+	}
+	return &resettableRESTMapperWrapper{
+		RESTMapperWithContext: ToRESTMapperWithContext(m),
+		delegate:              m,
+	}
+}
+
+type resettableRESTMapperWrapper struct {
+	RESTMapperWithContext
+	delegate ResettableRESTMapper
+}
+
+func (m *resettableRESTMapperWrapper) ResetWithContext(ctx context.Context) {
+	m.delegate.Reset()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/lazy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/lazy.go
new file mode 100644
index 0000000000..a4298114b6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/lazy.go
@@ -0,0 +1,112 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"sync"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// lazyObject defers loading the mapper and typer until necessary.
+type lazyObject struct {
+	loader func() (RESTMapper, error)
+
+	lock   sync.Mutex
+	loaded bool
+	err    error
+	mapper RESTMapper
+}
+
+// NewLazyRESTMapperLoader handles unrecoverable errors when creating a RESTMapper / ObjectTyper by
+// returning those initialization errors when the interface methods are invoked. This defers the
+// initialization and any server calls until a client actually needs to perform the action.
+func NewLazyRESTMapperLoader(fn func() (RESTMapper, error)) RESTMapper {
+	obj := &lazyObject{loader: fn}
+	return obj
+}
+
+// init lazily loads the mapper and typer, returning an error if initialization has failed.
+func (o *lazyObject) init() error {
+	o.lock.Lock()
+	defer o.lock.Unlock()
+	if o.loaded {
+		return o.err
+	}
+	o.mapper, o.err = o.loader()
+	o.loaded = true
+	return o.err
+}
+
+var _ ResettableRESTMapper = &lazyObject{}
+
+func (o *lazyObject) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	if err := o.init(); err != nil {
+		return schema.GroupVersionKind{}, err
+	}
+	return o.mapper.KindFor(resource)
+}
+
+func (o *lazyObject) KindsFor(resource schema.GroupVersionResource) ([]schema.GroupVersionKind, error) {
+	if err := o.init(); err != nil {
+		return []schema.GroupVersionKind{}, err
+	}
+	return o.mapper.KindsFor(resource)
+}
+
+func (o *lazyObject) ResourceFor(input schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	if err := o.init(); err != nil {
+		return schema.GroupVersionResource{}, err
+	}
+	return o.mapper.ResourceFor(input)
+}
+
+func (o *lazyObject) ResourcesFor(input schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	if err := o.init(); err != nil {
+		return []schema.GroupVersionResource{}, err
+	}
+	return o.mapper.ResourcesFor(input)
+}
+
+func (o *lazyObject) RESTMapping(gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	if err := o.init(); err != nil {
+		return nil, err
+	}
+	return o.mapper.RESTMapping(gk, versions...)
+}
+
+func (o *lazyObject) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	if err := o.init(); err != nil {
+		return nil, err
+	}
+	return o.mapper.RESTMappings(gk, versions...)
+}
+
+func (o *lazyObject) ResourceSingularizer(resource string) (singular string, err error) {
+	if err := o.init(); err != nil {
+		return "", err
+	}
+	return o.mapper.ResourceSingularizer(resource)
+}
+
+func (o *lazyObject) Reset() {
+	o.lock.Lock()
+	defer o.lock.Unlock()
+	if o.loaded && o.err == nil {
+		MaybeResetRESTMapper(o.mapper)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/meta.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/meta.go
new file mode 100644
index 0000000000..4bf24da522
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/meta.go
@@ -0,0 +1,647 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"fmt"
+	"reflect"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/klog/v2"
+)
+
+// errNotList is returned when an object implements the Object style interfaces but not the List style
+// interfaces.
+var errNotList = fmt.Errorf("object does not implement the List interfaces")
+
+var errNotCommon = fmt.Errorf("object does not implement the common interface for accessing the SelfLink")
+
+// CommonAccessor returns a Common interface for the provided object or an error if the object does
+// not provide List.
+func CommonAccessor(obj interface{}) (metav1.Common, error) {
+	switch t := obj.(type) {
+	case List:
+		return t, nil
+	case ListMetaAccessor:
+		if m := t.GetListMeta(); m != nil {
+			return m, nil
+		}
+		return nil, errNotCommon
+	case metav1.ListMetaAccessor:
+		if m := t.GetListMeta(); m != nil {
+			return m, nil
+		}
+		return nil, errNotCommon
+	case metav1.Object:
+		return t, nil
+	case metav1.ObjectMetaAccessor:
+		if m := t.GetObjectMeta(); m != nil {
+			return m, nil
+		}
+		return nil, errNotCommon
+	default:
+		return nil, errNotCommon
+	}
+}
+
+// ListAccessor returns a List interface for the provided object or an error if the object does
+// not provide List.
+// IMPORTANT: Objects are NOT a superset of lists. Do not use this check to determine whether an
+// object *is* a List.
+func ListAccessor(obj interface{}) (List, error) {
+	switch t := obj.(type) {
+	case List:
+		return t, nil
+	case ListMetaAccessor:
+		if m := t.GetListMeta(); m != nil {
+			return m, nil
+		}
+		return nil, errNotList
+	case metav1.ListMetaAccessor:
+		if m := t.GetListMeta(); m != nil {
+			return m, nil
+		}
+		return nil, errNotList
+	default:
+		return nil, errNotList
+	}
+}
+
+// errNotObject is returned when an object implements the List style interfaces but not the Object style
+// interfaces.
+var errNotObject = fmt.Errorf("object does not implement the Object interfaces")
+
+// Accessor takes an arbitrary object pointer and returns meta.Interface.
+// obj must be a pointer to an API type. An error is returned if the minimum
+// required fields are missing. Fields that are not required return the default
+// value and are a no-op if set.
+func Accessor(obj interface{}) (metav1.Object, error) {
+	switch t := obj.(type) {
+	case metav1.Object:
+		return t, nil
+	case metav1.ObjectMetaAccessor:
+		if m := t.GetObjectMeta(); m != nil {
+			return m, nil
+		}
+		return nil, errNotObject
+	default:
+		return nil, errNotObject
+	}
+}
+
+// AsPartialObjectMetadata takes the metav1 interface and returns a partial object.
+// TODO: consider making this solely a conversion action.
+func AsPartialObjectMetadata(m metav1.Object) *metav1.PartialObjectMetadata {
+	switch t := m.(type) {
+	case *metav1.ObjectMeta:
+		return &metav1.PartialObjectMetadata{ObjectMeta: *t}
+	default:
+		return &metav1.PartialObjectMetadata{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:                       m.GetName(),
+				GenerateName:               m.GetGenerateName(),
+				Namespace:                  m.GetNamespace(),
+				SelfLink:                   m.GetSelfLink(),
+				UID:                        m.GetUID(),
+				ResourceVersion:            m.GetResourceVersion(),
+				Generation:                 m.GetGeneration(),
+				CreationTimestamp:          m.GetCreationTimestamp(),
+				DeletionTimestamp:          m.GetDeletionTimestamp(),
+				DeletionGracePeriodSeconds: m.GetDeletionGracePeriodSeconds(),
+				Labels:                     m.GetLabels(),
+				Annotations:                m.GetAnnotations(),
+				OwnerReferences:            m.GetOwnerReferences(),
+				Finalizers:                 m.GetFinalizers(),
+				ManagedFields:              m.GetManagedFields(),
+			},
+		}
+	}
+}
+
+// TypeAccessor returns an interface that allows retrieving and modifying the APIVersion
+// and Kind of an in-memory internal object.
+// TODO: this interface is used to test code that does not have ObjectMeta or ListMeta
+// in round tripping (objects which can use apiVersion/kind, but do not fit the Kube
+// api conventions).
+func TypeAccessor(obj interface{}) (Type, error) {
+	if typed, ok := obj.(runtime.Object); ok {
+		return objectAccessor{typed}, nil
+	}
+	v, err := conversion.EnforcePtr(obj)
+	if err != nil {
+		return nil, err
+	}
+	t := v.Type()
+	if v.Kind() != reflect.Struct {
+		return nil, fmt.Errorf("expected struct, but got %v: %v (%#v)", v.Kind(), t, v.Interface())
+	}
+
+	typeMeta := v.FieldByName("TypeMeta")
+	if !typeMeta.IsValid() {
+		return nil, fmt.Errorf("struct %v lacks embedded TypeMeta type", t)
+	}
+	a := &genericAccessor{}
+	if err := extractFromTypeMeta(typeMeta, a); err != nil {
+		return nil, fmt.Errorf("unable to find type fields on %#v: %v", typeMeta, err)
+	}
+	return a, nil
+}
+
+type objectAccessor struct {
+	runtime.Object
+}
+
+func (obj objectAccessor) GetKind() string {
+	return obj.GetObjectKind().GroupVersionKind().Kind
+}
+
+func (obj objectAccessor) SetKind(kind string) {
+	gvk := obj.GetObjectKind().GroupVersionKind()
+	gvk.Kind = kind
+	obj.GetObjectKind().SetGroupVersionKind(gvk)
+}
+
+func (obj objectAccessor) GetAPIVersion() string {
+	return obj.GetObjectKind().GroupVersionKind().GroupVersion().String()
+}
+
+func (obj objectAccessor) SetAPIVersion(version string) {
+	gvk := obj.GetObjectKind().GroupVersionKind()
+	gv, err := schema.ParseGroupVersion(version)
+	if err != nil {
+		gv = schema.GroupVersion{Version: version}
+	}
+	gvk.Group, gvk.Version = gv.Group, gv.Version
+	obj.GetObjectKind().SetGroupVersionKind(gvk)
+}
+
+// NewAccessor returns a MetadataAccessor that can retrieve
+// or manipulate resource version on objects derived from core API
+// metadata concepts.
+func NewAccessor() MetadataAccessor {
+	return resourceAccessor{}
+}
+
+// resourceAccessor implements ResourceVersioner and SelfLinker.
+type resourceAccessor struct{}
+
+func (resourceAccessor) Kind(obj runtime.Object) (string, error) {
+	return objectAccessor{obj}.GetKind(), nil
+}
+
+func (resourceAccessor) SetKind(obj runtime.Object, kind string) error {
+	objectAccessor{obj}.SetKind(kind)
+	return nil
+}
+
+func (resourceAccessor) APIVersion(obj runtime.Object) (string, error) {
+	return objectAccessor{obj}.GetAPIVersion(), nil
+}
+
+func (resourceAccessor) SetAPIVersion(obj runtime.Object, version string) error {
+	objectAccessor{obj}.SetAPIVersion(version)
+	return nil
+}
+
+func (resourceAccessor) Namespace(obj runtime.Object) (string, error) {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return "", err
+	}
+	return accessor.GetNamespace(), nil
+}
+
+func (resourceAccessor) SetNamespace(obj runtime.Object, namespace string) error {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetNamespace(namespace)
+	return nil
+}
+
+func (resourceAccessor) Name(obj runtime.Object) (string, error) {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return "", err
+	}
+	return accessor.GetName(), nil
+}
+
+func (resourceAccessor) SetName(obj runtime.Object, name string) error {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetName(name)
+	return nil
+}
+
+func (resourceAccessor) GenerateName(obj runtime.Object) (string, error) {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return "", err
+	}
+	return accessor.GetGenerateName(), nil
+}
+
+func (resourceAccessor) SetGenerateName(obj runtime.Object, name string) error {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetGenerateName(name)
+	return nil
+}
+
+func (resourceAccessor) UID(obj runtime.Object) (types.UID, error) {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return "", err
+	}
+	return accessor.GetUID(), nil
+}
+
+func (resourceAccessor) SetUID(obj runtime.Object, uid types.UID) error {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetUID(uid)
+	return nil
+}
+
+func (resourceAccessor) SelfLink(obj runtime.Object) (string, error) {
+	accessor, err := CommonAccessor(obj)
+	if err != nil {
+		return "", err
+	}
+	return accessor.GetSelfLink(), nil
+}
+
+func (resourceAccessor) SetSelfLink(obj runtime.Object, selfLink string) error {
+	accessor, err := CommonAccessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetSelfLink(selfLink)
+	return nil
+}
+
+func (resourceAccessor) Labels(obj runtime.Object) (map[string]string, error) {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return nil, err
+	}
+	return accessor.GetLabels(), nil
+}
+
+func (resourceAccessor) SetLabels(obj runtime.Object, labels map[string]string) error {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetLabels(labels)
+	return nil
+}
+
+func (resourceAccessor) Annotations(obj runtime.Object) (map[string]string, error) {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return nil, err
+	}
+	return accessor.GetAnnotations(), nil
+}
+
+func (resourceAccessor) SetAnnotations(obj runtime.Object, annotations map[string]string) error {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetAnnotations(annotations)
+	return nil
+}
+
+func (resourceAccessor) ResourceVersion(obj runtime.Object) (string, error) {
+	accessor, err := CommonAccessor(obj)
+	if err != nil {
+		return "", err
+	}
+	return accessor.GetResourceVersion(), nil
+}
+
+func (resourceAccessor) SetResourceVersion(obj runtime.Object, version string) error {
+	accessor, err := CommonAccessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetResourceVersion(version)
+	return nil
+}
+
+func (resourceAccessor) Continue(obj runtime.Object) (string, error) {
+	accessor, err := ListAccessor(obj)
+	if err != nil {
+		return "", err
+	}
+	return accessor.GetContinue(), nil
+}
+
+func (resourceAccessor) SetContinue(obj runtime.Object, version string) error {
+	accessor, err := ListAccessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetContinue(version)
+	return nil
+}
+
+// extractFromOwnerReference extracts v to o. v is the OwnerReferences field of an object.
+func extractFromOwnerReference(v reflect.Value, o *metav1.OwnerReference) error {
+	if err := runtime.Field(v, "APIVersion", &o.APIVersion); err != nil {
+		return err
+	}
+	if err := runtime.Field(v, "Kind", &o.Kind); err != nil {
+		return err
+	}
+	if err := runtime.Field(v, "Name", &o.Name); err != nil {
+		return err
+	}
+	if err := runtime.Field(v, "UID", &o.UID); err != nil {
+		return err
+	}
+	var controllerPtr *bool
+	if err := runtime.Field(v, "Controller", &controllerPtr); err != nil {
+		return err
+	}
+	if controllerPtr != nil {
+		controller := *controllerPtr
+		o.Controller = &controller
+	}
+	var blockOwnerDeletionPtr *bool
+	if err := runtime.Field(v, "BlockOwnerDeletion", &blockOwnerDeletionPtr); err != nil {
+		return err
+	}
+	if blockOwnerDeletionPtr != nil {
+		block := *blockOwnerDeletionPtr
+		o.BlockOwnerDeletion = &block
+	}
+	return nil
+}
+
+// setOwnerReference sets v to o. v is the OwnerReferences field of an object.
+func setOwnerReference(v reflect.Value, o *metav1.OwnerReference) error {
+	if err := runtime.SetField(o.APIVersion, v, "APIVersion"); err != nil {
+		return err
+	}
+	if err := runtime.SetField(o.Kind, v, "Kind"); err != nil {
+		return err
+	}
+	if err := runtime.SetField(o.Name, v, "Name"); err != nil {
+		return err
+	}
+	if err := runtime.SetField(o.UID, v, "UID"); err != nil {
+		return err
+	}
+	if o.Controller != nil {
+		controller := *(o.Controller)
+		if err := runtime.SetField(&controller, v, "Controller"); err != nil {
+			return err
+		}
+	}
+	if o.BlockOwnerDeletion != nil {
+		block := *(o.BlockOwnerDeletion)
+		if err := runtime.SetField(&block, v, "BlockOwnerDeletion"); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// genericAccessor contains pointers to strings that can modify an arbitrary
+// struct and implements the Accessor interface.
+type genericAccessor struct {
+	namespace         *string
+	name              *string
+	generateName      *string
+	uid               *types.UID
+	apiVersion        *string
+	kind              *string
+	resourceVersion   *string
+	selfLink          *string
+	creationTimestamp *metav1.Time
+	deletionTimestamp **metav1.Time
+	labels            *map[string]string
+	annotations       *map[string]string
+	ownerReferences   reflect.Value
+	finalizers        *[]string
+}
+
+func (a genericAccessor) GetNamespace() string {
+	if a.namespace == nil {
+		return ""
+	}
+	return *a.namespace
+}
+
+func (a genericAccessor) SetNamespace(namespace string) {
+	if a.namespace == nil {
+		return
+	}
+	*a.namespace = namespace
+}
+
+func (a genericAccessor) GetName() string {
+	if a.name == nil {
+		return ""
+	}
+	return *a.name
+}
+
+func (a genericAccessor) SetName(name string) {
+	if a.name == nil {
+		return
+	}
+	*a.name = name
+}
+
+func (a genericAccessor) GetGenerateName() string {
+	if a.generateName == nil {
+		return ""
+	}
+	return *a.generateName
+}
+
+func (a genericAccessor) SetGenerateName(generateName string) {
+	if a.generateName == nil {
+		return
+	}
+	*a.generateName = generateName
+}
+
+func (a genericAccessor) GetUID() types.UID {
+	if a.uid == nil {
+		return ""
+	}
+	return *a.uid
+}
+
+func (a genericAccessor) SetUID(uid types.UID) {
+	if a.uid == nil {
+		return
+	}
+	*a.uid = uid
+}
+
+func (a genericAccessor) GetAPIVersion() string {
+	return *a.apiVersion
+}
+
+func (a genericAccessor) SetAPIVersion(version string) {
+	*a.apiVersion = version
+}
+
+func (a genericAccessor) GetKind() string {
+	return *a.kind
+}
+
+func (a genericAccessor) SetKind(kind string) {
+	*a.kind = kind
+}
+
+func (a genericAccessor) GetResourceVersion() string {
+	return *a.resourceVersion
+}
+
+func (a genericAccessor) SetResourceVersion(version string) {
+	*a.resourceVersion = version
+}
+
+func (a genericAccessor) GetSelfLink() string {
+	return *a.selfLink
+}
+
+func (a genericAccessor) SetSelfLink(selfLink string) {
+	*a.selfLink = selfLink
+}
+
+func (a genericAccessor) GetCreationTimestamp() metav1.Time {
+	return *a.creationTimestamp
+}
+
+func (a genericAccessor) SetCreationTimestamp(timestamp metav1.Time) {
+	*a.creationTimestamp = timestamp
+}
+
+func (a genericAccessor) GetDeletionTimestamp() *metav1.Time {
+	return *a.deletionTimestamp
+}
+
+func (a genericAccessor) SetDeletionTimestamp(timestamp *metav1.Time) {
+	*a.deletionTimestamp = timestamp
+}
+
+func (a genericAccessor) GetLabels() map[string]string {
+	if a.labels == nil {
+		return nil
+	}
+	return *a.labels
+}
+
+func (a genericAccessor) SetLabels(labels map[string]string) {
+	*a.labels = labels
+}
+
+func (a genericAccessor) GetAnnotations() map[string]string {
+	if a.annotations == nil {
+		return nil
+	}
+	return *a.annotations
+}
+
+func (a genericAccessor) SetAnnotations(annotations map[string]string) {
+	if a.annotations == nil {
+		emptyAnnotations := make(map[string]string)
+		a.annotations = &emptyAnnotations
+	}
+	*a.annotations = annotations
+}
+
+func (a genericAccessor) GetFinalizers() []string {
+	if a.finalizers == nil {
+		return nil
+	}
+	return *a.finalizers
+}
+
+func (a genericAccessor) SetFinalizers(finalizers []string) {
+	*a.finalizers = finalizers
+}
+
+func (a genericAccessor) GetOwnerReferences() []metav1.OwnerReference {
+	var ret []metav1.OwnerReference
+	s := a.ownerReferences
+	if s.Kind() != reflect.Pointer || s.Elem().Kind() != reflect.Slice {
+		//nolint:logcheck // Should not happen.
+		klog.Errorf("expect %v to be a pointer to slice", s)
+		return ret
+	}
+	s = s.Elem()
+	// Set the capacity to one element greater to avoid copy if the caller later append an element.
+	ret = make([]metav1.OwnerReference, s.Len(), s.Len()+1)
+	for i := 0; i < s.Len(); i++ {
+		if err := extractFromOwnerReference(s.Index(i), &ret[i]); err != nil {
+			//nolint:logcheck // Should not happen.
+			klog.Errorf("extractFromOwnerReference failed: %v", err)
+			return ret
+		}
+	}
+	return ret
+}
+
+func (a genericAccessor) SetOwnerReferences(references []metav1.OwnerReference) {
+	s := a.ownerReferences
+	if s.Kind() != reflect.Pointer || s.Elem().Kind() != reflect.Slice {
+		//nolint:logcheck // Should not happen.
+		klog.Errorf("expect %v to be a pointer to slice", s)
+	}
+	s = s.Elem()
+	newReferences := reflect.MakeSlice(s.Type(), len(references), len(references))
+	for i := 0; i < len(references); i++ {
+		if err := setOwnerReference(newReferences.Index(i), &references[i]); err != nil {
+			//nolint:logcheck // Should not happen.
+			klog.Errorf("setOwnerReference failed: %v", err)
+			return
+		}
+	}
+	s.Set(newReferences)
+}
+
+// extractFromTypeMeta extracts pointers to version and kind fields from an object
+func extractFromTypeMeta(v reflect.Value, a *genericAccessor) error {
+	if err := runtime.FieldPtr(v, "APIVersion", &a.apiVersion); err != nil {
+		return err
+	}
+	if err := runtime.FieldPtr(v, "Kind", &a.kind); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/meta_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/meta_test.go
new file mode 100644
index 0000000000..31402441a9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/meta_test.go
@@ -0,0 +1,51 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"math/rand"
+	"reflect"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	metav1beta1 "k8s.io/apimachinery/pkg/apis/meta/v1beta1"
+
+	"github.com/google/go-cmp/cmp"
+	"sigs.k8s.io/randfill"
+)
+
+func TestAsPartialObjectMetadata(t *testing.T) {
+	f := randfill.New().NilChance(.5).NumElements(0, 1).RandSource(rand.NewSource(1))
+
+	for i := 0; i < 100; i++ {
+		m := &metav1.ObjectMeta{}
+		f.Fill(m)
+		partial := AsPartialObjectMetadata(m)
+		if !reflect.DeepEqual(&partial.ObjectMeta, m) {
+			t.Fatalf("incomplete partial object metadata: %s", cmp.Diff(&partial.ObjectMeta, m))
+		}
+	}
+
+	for i := 0; i < 100; i++ {
+		m := &metav1beta1.PartialObjectMetadata{}
+		f.Fill(&m.ObjectMeta)
+		partial := AsPartialObjectMetadata(m)
+		if !reflect.DeepEqual(&partial.ObjectMeta, &m.ObjectMeta) {
+			t.Fatalf("incomplete partial object metadata: %s", cmp.Diff(&partial.ObjectMeta, &m.ObjectMeta))
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/multirestmapper.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/multirestmapper.go
new file mode 100644
index 0000000000..2b2c143ce7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/multirestmapper.go
@@ -0,0 +1,318 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+)
+
+var (
+	_ ResettableRESTMapper            = MultiRESTMapper{}
+	_ fmt.Stringer                    = MultiRESTMapper{}
+	_ ResettableRESTMapperWithContext = MultiRESTMapperWithContext{}
+	_ fmt.Stringer                    = MultiRESTMapperWithContext{}
+)
+
+// MultiRESTMapper is a wrapper for multiple RESTMappers.
+//
+// MultiRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext instead.
+type MultiRESTMapper []RESTMapper
+
+// MultiRESTMapperWithContext is a wrapper for multiple RESTMapperWithContext instances.
+type MultiRESTMapperWithContext []RESTMapperWithContext
+
+func (m MultiRESTMapper) String() string {
+	return stringifyMapper("MultiRESTMapper", m)
+}
+
+func (m MultiRESTMapperWithContext) String() string {
+	return stringifyMapper("MultiRESTMapperWithContext", m)
+}
+
+func stringifyMapper[T any](typeName string, m []T) string {
+	nested := make([]string, 0, len(m))
+	for _, t := range m {
+		currString := fmt.Sprintf("%v", t)
+		splitStrings := strings.Split(currString, "\n")
+		nested = append(nested, strings.Join(splitStrings, "\n\t"))
+	}
+
+	return fmt.Sprintf("%s{\n\t%s\n}", typeName, strings.Join(nested, "\n\t"))
+}
+
+func ToMultiRESTMapperWithContext(m MultiRESTMapper) MultiRESTMapperWithContext {
+	if m == nil {
+		return nil
+	}
+	mc := make(MultiRESTMapperWithContext, len(m))
+	for i, m := range m {
+		mc[i] = ToRESTMapperWithContext(m)
+	}
+	return mc
+}
+
+// ResourceSingularizer converts a REST resource name from plural to singular (e.g., from pods to pod)
+// This implementation supports multiple REST schemas and return the first match.
+//
+// MultiRESTMapperWithContext.ResourceSingularizerWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.ResourceSingularizerWithContext instead.
+func (m MultiRESTMapper) ResourceSingularizer(resource string) (singular string, err error) {
+	return ToMultiRESTMapperWithContext(m).ResourceSingularizerWithContext(context.Background(), resource)
+}
+
+// MultiRESTMapperWithContext.ResourcesForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.ResourcesForWithContext instead.
+func (m MultiRESTMapper) ResourcesFor(resource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return ToMultiRESTMapperWithContext(m).ResourcesForWithContext(context.Background(), resource)
+}
+
+// MultiRESTMapperWithContext.KindsForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.KindsForWithContext instead.
+func (m MultiRESTMapper) KindsFor(resource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
+	return ToMultiRESTMapperWithContext(m).KindsForWithContext(context.Background(), resource)
+}
+
+// MultiRESTMapperWithContext.ResourceForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.ResourceForWithContext instead.
+func (m MultiRESTMapper) ResourceFor(resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	return ToMultiRESTMapperWithContext(m).ResourceForWithContext(context.Background(), resource)
+}
+
+// MultiRESTMapperWithContext.KindForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.KindForWithContext instead.
+func (m MultiRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return ToMultiRESTMapperWithContext(m).KindForWithContext(context.Background(), resource)
+}
+
+// RESTMapping provides the REST mapping for the resource based on the
+// kind and version. This implementation supports multiple REST schemas and
+// return the first match.
+//
+// MultiRESTMapperWithContext.RESTMappingWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.RESTMappingWithContext instead.
+func (m MultiRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	return ToMultiRESTMapperWithContext(m).RESTMappingWithContext(context.Background(), gk, versions...)
+}
+
+// RESTMappings returns all possible RESTMappings for the provided group kind, or an error
+// if the type is not recognized.
+//
+// MultiRESTMapperWithContext.RESTMappingsWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.RESTMappingsWithContext instead.
+func (m MultiRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	return ToMultiRESTMapperWithContext(m).RESTMappingsWithContext(context.Background(), gk, versions...)
+}
+
+// MultiRESTMapperWithContext.Reset is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.Reset instead.
+func (m MultiRESTMapper) Reset() {
+	for _, t := range m {
+		MaybeResetRESTMapper(t)
+	}
+}
+
+// ResourceSingularizer converts a REST resource name from plural to singular (e.g., from pods to pod)
+// This implementation supports multiple REST schemas and return the first match.
+func (m MultiRESTMapperWithContext) ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error) {
+	for _, t := range m {
+		singular, err = t.ResourceSingularizerWithContext(ctx, resource)
+		if err == nil {
+			return
+		}
+	}
+	return
+}
+
+func (m MultiRESTMapperWithContext) ResourcesForWithContext(ctx context.Context, resource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	allGVRs := []schema.GroupVersionResource{}
+	for _, t := range m {
+		gvrs, err := t.ResourcesForWithContext(ctx, resource)
+		// ignore "no match" errors, but any other error percolates back up
+		if IsNoMatchError(err) {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+
+		// walk the existing values to de-dup
+		for _, curr := range gvrs {
+			found := false
+			for _, existing := range allGVRs {
+				if curr == existing {
+					found = true
+					break
+				}
+			}
+
+			if !found {
+				allGVRs = append(allGVRs, curr)
+			}
+		}
+	}
+
+	if len(allGVRs) == 0 {
+		return nil, &NoResourceMatchError{PartialResource: resource}
+	}
+
+	return allGVRs, nil
+}
+
+func (m MultiRESTMapperWithContext) KindsForWithContext(ctx context.Context, resource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
+	allGVKs := []schema.GroupVersionKind{}
+	for _, t := range m {
+		gvks, err := t.KindsForWithContext(ctx, resource)
+		// ignore "no match" errors, but any other error percolates back up
+		if IsNoMatchError(err) {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+
+		// walk the existing values to de-dup
+		for _, curr := range gvks {
+			found := false
+			for _, existing := range allGVKs {
+				if curr == existing {
+					found = true
+					break
+				}
+			}
+
+			if !found {
+				allGVKs = append(allGVKs, curr)
+			}
+		}
+	}
+
+	if len(allGVKs) == 0 {
+		return nil, &NoResourceMatchError{PartialResource: resource}
+	}
+
+	return allGVKs, nil
+}
+
+func (m MultiRESTMapperWithContext) ResourceForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	resources, err := m.ResourcesForWithContext(ctx, resource)
+	if err != nil {
+		return schema.GroupVersionResource{}, err
+	}
+	if len(resources) == 1 {
+		return resources[0], nil
+	}
+
+	return schema.GroupVersionResource{}, &AmbiguousResourceError{PartialResource: resource, MatchingResources: resources}
+}
+
+func (m MultiRESTMapperWithContext) KindForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	kinds, err := m.KindsForWithContext(ctx, resource)
+	if err != nil {
+		return schema.GroupVersionKind{}, err
+	}
+	if len(kinds) == 1 {
+		return kinds[0], nil
+	}
+
+	return schema.GroupVersionKind{}, &AmbiguousResourceError{PartialResource: resource, MatchingKinds: kinds}
+}
+
+// RESTMapping provides the REST mapping for the resource based on the
+// kind and version. This implementation supports multiple REST schemas and
+// return the first match.
+func (m MultiRESTMapperWithContext) RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	allMappings := []*RESTMapping{}
+	errors := []error{}
+
+	for _, t := range m {
+		currMapping, err := t.RESTMappingWithContext(ctx, gk, versions...)
+		// ignore "no match" errors, but any other error percolates back up
+		if IsNoMatchError(err) {
+			continue
+		}
+		if err != nil {
+			errors = append(errors, err)
+			continue
+		}
+
+		allMappings = append(allMappings, currMapping)
+	}
+
+	// if we got exactly one mapping, then use it even if other requested failed
+	if len(allMappings) == 1 {
+		return allMappings[0], nil
+	}
+	if len(allMappings) > 1 {
+		var kinds []schema.GroupVersionKind
+		for _, m := range allMappings {
+			kinds = append(kinds, m.GroupVersionKind)
+		}
+		return nil, &AmbiguousKindError{PartialKind: gk.WithVersion(""), MatchingKinds: kinds}
+	}
+	if len(errors) > 0 {
+		return nil, utilerrors.NewAggregate(errors)
+	}
+	return nil, &NoKindMatchError{GroupKind: gk, SearchedVersions: versions}
+}
+
+// RESTMappings returns all possible RESTMappings for the provided group kind, or an error
+// if the type is not recognized.
+func (m MultiRESTMapperWithContext) RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	var allMappings []*RESTMapping
+	var errors []error
+
+	for _, t := range m {
+		currMappings, err := t.RESTMappingsWithContext(ctx, gk, versions...)
+		// ignore "no match" errors, but any other error percolates back up
+		if IsNoMatchError(err) {
+			continue
+		}
+		if err != nil {
+			errors = append(errors, err)
+			continue
+		}
+		allMappings = append(allMappings, currMappings...)
+	}
+	if len(errors) > 0 {
+		return nil, utilerrors.NewAggregate(errors)
+	}
+	if len(allMappings) == 0 {
+		return nil, &NoKindMatchError{GroupKind: gk, SearchedVersions: versions}
+	}
+	return allMappings, nil
+}
+
+func (m MultiRESTMapperWithContext) ResetWithContext(ctx context.Context) {
+	for _, t := range m {
+		MaybeResetRESTMapperWithContext(ctx, t)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/multirestmapper_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/multirestmapper_test.go
new file mode 100644
index 0000000000..b71ca468d3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/multirestmapper_test.go
@@ -0,0 +1,391 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"errors"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestMultiRESTMapperResourceFor(t *testing.T) {
+	tcs := []struct {
+		name string
+
+		mapper MultiRESTMapper
+		input  schema.GroupVersionResource
+		result schema.GroupVersionResource
+		err    error
+	}{
+		{
+			name:   "empty",
+			mapper: MultiRESTMapper{},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: schema.GroupVersionResource{},
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "ignore not found",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "IGNORE_THIS"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: schema.GroupVersionResource{},
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "accept first failure",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: errors.New("fail on this")}, fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{{Resource: "unused"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: schema.GroupVersionResource{},
+			err:    errors.New("fail on this"),
+		},
+	}
+
+	for _, tc := range tcs {
+		actualResult, actualErr := tc.mapper.ResourceFor(tc.input)
+		if e, a := tc.result, actualResult; e != a {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		switch {
+		case tc.err == nil && actualErr == nil:
+		case tc.err == nil:
+			t.Errorf("%s: unexpected error: %v", tc.name, actualErr)
+		case actualErr == nil:
+			t.Errorf("%s: expected error: %v got nil", tc.name, tc.err)
+		case tc.err.Error() != actualErr.Error():
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+func TestMultiRESTMapperResourcesFor(t *testing.T) {
+	tcs := []struct {
+		name string
+
+		mapper MultiRESTMapper
+		input  schema.GroupVersionResource
+		result []schema.GroupVersionResource
+		err    error
+	}{
+		{
+			name:   "empty",
+			mapper: MultiRESTMapper{},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: nil,
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "ignore not found",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "IGNORE_THIS"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: nil,
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "accept first failure",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: errors.New("fail on this")}, fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{{Resource: "unused"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: nil,
+			err:    errors.New("fail on this"),
+		},
+		{
+			name: "union and dedup",
+			mapper: MultiRESTMapper{
+				fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{{Resource: "dupe"}, {Resource: "first"}}},
+				fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{{Resource: "dupe"}, {Resource: "second"}}},
+			},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: []schema.GroupVersionResource{{Resource: "dupe"}, {Resource: "first"}, {Resource: "second"}},
+		},
+		{
+			name: "skip not and continue",
+			mapper: MultiRESTMapper{
+				fixedRESTMapper{err: &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "IGNORE_THIS"}}},
+				fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{{Resource: "first"}, {Resource: "second"}}},
+			},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: []schema.GroupVersionResource{{Resource: "first"}, {Resource: "second"}},
+		},
+	}
+
+	for _, tc := range tcs {
+		actualResult, actualErr := tc.mapper.ResourcesFor(tc.input)
+		if e, a := tc.result, actualResult; !reflect.DeepEqual(e, a) {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		switch {
+		case tc.err == nil && actualErr == nil:
+		case tc.err == nil:
+			t.Errorf("%s: unexpected error: %v", tc.name, actualErr)
+		case actualErr == nil:
+			t.Errorf("%s: expected error: %v got nil", tc.name, tc.err)
+		case tc.err.Error() != actualErr.Error():
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+func TestMultiRESTMapperKindsFor(t *testing.T) {
+	tcs := []struct {
+		name string
+
+		mapper MultiRESTMapper
+		input  schema.GroupVersionResource
+		result []schema.GroupVersionKind
+		err    error
+	}{
+		{
+			name:   "empty",
+			mapper: MultiRESTMapper{},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: nil,
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "ignore not found",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "IGNORE_THIS"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: nil,
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "accept first failure",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: errors.New("fail on this")}, fixedRESTMapper{kindsFor: []schema.GroupVersionKind{{Kind: "unused"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: nil,
+			err:    errors.New("fail on this"),
+		},
+		{
+			name: "union and dedup",
+			mapper: MultiRESTMapper{
+				fixedRESTMapper{kindsFor: []schema.GroupVersionKind{{Kind: "dupe"}, {Kind: "first"}}},
+				fixedRESTMapper{kindsFor: []schema.GroupVersionKind{{Kind: "dupe"}, {Kind: "second"}}},
+			},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: []schema.GroupVersionKind{{Kind: "dupe"}, {Kind: "first"}, {Kind: "second"}},
+		},
+		{
+			name: "skip not and continue",
+			mapper: MultiRESTMapper{
+				fixedRESTMapper{err: &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "IGNORE_THIS"}}},
+				fixedRESTMapper{kindsFor: []schema.GroupVersionKind{{Kind: "first"}, {Kind: "second"}}},
+			},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: []schema.GroupVersionKind{{Kind: "first"}, {Kind: "second"}},
+		},
+	}
+
+	for _, tc := range tcs {
+		actualResult, actualErr := tc.mapper.KindsFor(tc.input)
+		if e, a := tc.result, actualResult; !reflect.DeepEqual(e, a) {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		switch {
+		case tc.err == nil && actualErr == nil:
+		case tc.err == nil:
+			t.Errorf("%s: unexpected error: %v", tc.name, actualErr)
+		case actualErr == nil:
+			t.Errorf("%s: expected error: %v got nil", tc.name, tc.err)
+		case tc.err.Error() != actualErr.Error():
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+func TestMultiRESTMapperKindFor(t *testing.T) {
+	tcs := []struct {
+		name string
+
+		mapper MultiRESTMapper
+		input  schema.GroupVersionResource
+		result schema.GroupVersionKind
+		err    error
+	}{
+		{
+			name:   "empty",
+			mapper: MultiRESTMapper{},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: schema.GroupVersionKind{},
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "ignore not found",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "IGNORE_THIS"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: schema.GroupVersionKind{},
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "accept first failure",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: errors.New("fail on this")}, fixedRESTMapper{kindsFor: []schema.GroupVersionKind{{Kind: "unused"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: schema.GroupVersionKind{},
+			err:    errors.New("fail on this"),
+		},
+	}
+
+	for _, tc := range tcs {
+		actualResult, actualErr := tc.mapper.KindFor(tc.input)
+		if e, a := tc.result, actualResult; e != a {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		switch {
+		case tc.err == nil && actualErr == nil:
+		case tc.err == nil:
+			t.Errorf("%s: unexpected error: %v", tc.name, actualErr)
+		case actualErr == nil:
+			t.Errorf("%s: expected error: %v got nil", tc.name, tc.err)
+		case tc.err.Error() != actualErr.Error():
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+func TestMultiRESTMapperRESTMappings(t *testing.T) {
+	mapping1, mapping2 := &RESTMapping{}, &RESTMapping{}
+	tcs := []struct {
+		name string
+
+		mapper    MultiRESTMapper
+		groupKind schema.GroupKind
+		versions  []string
+		result    []*RESTMapping
+		err       error
+	}{
+		{
+			name:      "empty with no versions",
+			mapper:    MultiRESTMapper{},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			result:    nil,
+			err:       &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}},
+		},
+		{
+			name:      "empty with one version",
+			mapper:    MultiRESTMapper{},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			versions:  []string{"v1beta"},
+			result:    nil,
+			err:       &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}, SearchedVersions: []string{"v1beta"}},
+		},
+		{
+			name:      "empty with multi(two) vesions",
+			mapper:    MultiRESTMapper{},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			versions:  []string{"v1beta", "v2"},
+			result:    nil,
+			err:       &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}, SearchedVersions: []string{"v1beta", "v2"}},
+		},
+		{
+			name:      "ignore not found with kind not exist",
+			mapper:    MultiRESTMapper{fixedRESTMapper{err: &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "IGNORE_THIS"}}}},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			versions:  nil,
+			result:    nil,
+			err:       &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}},
+		},
+		{
+			name:      "ignore not found with version not exist",
+			mapper:    MultiRESTMapper{fixedRESTMapper{err: &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}, SearchedVersions: []string{"v1"}}}},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			versions:  []string{"v1beta"},
+			result:    nil,
+			err:       &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}, SearchedVersions: []string{"v1beta"}},
+		},
+		{
+			name:      "ignore not found with multi versions not exist",
+			mapper:    MultiRESTMapper{fixedRESTMapper{err: &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}, SearchedVersions: []string{"v1"}}}},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			versions:  []string{"v1beta", "v2"},
+			result:    nil,
+			err:       &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}, SearchedVersions: []string{"v1beta", "v2"}},
+		},
+		{
+			name:      "accept first failure",
+			mapper:    MultiRESTMapper{fixedRESTMapper{err: errors.New("fail on this")}, fixedRESTMapper{mappings: []*RESTMapping{mapping1}}},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			versions:  []string{"v1beta"},
+			result:    nil,
+			err:       errors.New("fail on this"),
+		},
+		{
+			name:      "return both",
+			mapper:    MultiRESTMapper{fixedRESTMapper{mappings: []*RESTMapping{mapping1}}, fixedRESTMapper{mappings: []*RESTMapping{mapping2}}},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			versions:  []string{"v1beta"},
+			result:    []*RESTMapping{mapping1, mapping2},
+		},
+	}
+
+	for _, tc := range tcs {
+		actualResult, actualErr := tc.mapper.RESTMappings(tc.groupKind, tc.versions...)
+		if e, a := tc.result, actualResult; !reflect.DeepEqual(e, a) {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		switch {
+		case tc.err == nil && actualErr == nil:
+		case tc.err == nil:
+			t.Errorf("%s: unexpected error: %v", tc.name, actualErr)
+		case actualErr == nil:
+			t.Errorf("%s: expected error: %v got nil", tc.name, tc.err)
+		case tc.err.Error() != actualErr.Error():
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+type fixedRESTMapper struct {
+	resourcesFor []schema.GroupVersionResource
+	kindsFor     []schema.GroupVersionKind
+	resourceFor  schema.GroupVersionResource
+	kindFor      schema.GroupVersionKind
+	mappings     []*RESTMapping
+
+	err error
+}
+
+func (m fixedRESTMapper) ResourceSingularizer(resource string) (singular string, err error) {
+	return "", m.err
+}
+
+func (m fixedRESTMapper) ResourcesFor(resource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return m.resourcesFor, m.err
+}
+
+func (m fixedRESTMapper) KindsFor(resource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
+	return m.kindsFor, m.err
+}
+
+func (m fixedRESTMapper) ResourceFor(resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	return m.resourceFor, m.err
+}
+
+func (m fixedRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return m.kindFor, m.err
+}
+
+func (m fixedRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (mapping *RESTMapping, err error) {
+	return nil, m.err
+}
+
+func (m fixedRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) (mappings []*RESTMapping, err error) {
+	return m.mappings, m.err
+}
+
+func (m fixedRESTMapper) ResourceIsValid(resource schema.GroupVersionResource) bool {
+	return false
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/priority.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/priority.go
new file mode 100644
index 0000000000..d152e7e322
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/priority.go
@@ -0,0 +1,328 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"context"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+const (
+	AnyGroup    = "*"
+	AnyVersion  = "*"
+	AnyResource = "*"
+	AnyKind     = "*"
+)
+
+var (
+	_ ResettableRESTMapper            = PriorityRESTMapper{}
+	_ ResettableRESTMapperWithContext = PriorityRESTMapperWithContext{}
+	_ fmt.Stringer                    = PriorityRESTMapperWithContext{}
+)
+
+// PriorityRESTMapper is a wrapper for automatically choosing a particular Resource or Kind
+// when multiple matches are possible
+//
+// PriorityRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext instead.
+type PriorityRESTMapper struct {
+	// Delegate is the RESTMapper to use to locate all the Kind and Resource matches
+	Delegate RESTMapper
+
+	// ResourcePriority is a list of priority patterns to apply to matching resources.
+	// The list of all matching resources is narrowed based on the patterns until only one remains.
+	// A pattern with no matches is skipped.  A pattern with more than one match uses its
+	// matches as the list to continue matching against.
+	ResourcePriority []schema.GroupVersionResource
+
+	// KindPriority is a list of priority patterns to apply to matching kinds.
+	// The list of all matching kinds is narrowed based on the patterns until only one remains.
+	// A pattern with no matches is skipped.  A pattern with more than one match uses its
+	// matches as the list to continue matching against.
+	KindPriority []schema.GroupVersionKind
+}
+
+func (m PriorityRESTMapper) String() string {
+	return fmt.Sprintf("PriorityRESTMapper{\n\t%v\n\t%v\n\t%v\n}", m.ResourcePriority, m.KindPriority, m.Delegate)
+}
+
+// PriorityRESTMapperWithContext is a wrapper for automatically choosing a particular Resource or Kind
+// when multiple matches are possible
+type PriorityRESTMapperWithContext struct {
+	// Delegate is the RESTMapperWithContext to use to locate all the Kind and Resource matches
+	Delegate RESTMapperWithContext
+
+	// ResourcePriority is a list of priority patterns to apply to matching resources.
+	// The list of all matching resources is narrowed based on the patterns until only one remains.
+	// A pattern with no matches is skipped.  A pattern with more than one match uses its
+	// matches as the list to continue matching against.
+	ResourcePriority []schema.GroupVersionResource
+
+	// KindPriority is a list of priority patterns to apply to matching kinds.
+	// The list of all matching kinds is narrowed based on the patterns until only one remains.
+	// A pattern with no matches is skipped.  A pattern with more than one match uses its
+	// matches as the list to continue matching against.
+	KindPriority []schema.GroupVersionKind
+}
+
+func (m PriorityRESTMapperWithContext) String() string {
+	return fmt.Sprintf("PriorityRESTMapperWithContext{\n\t%v\n\t%v\n\t%v\n}", m.ResourcePriority, m.KindPriority, m.Delegate)
+}
+
+func ToPriorityRESTMapperWithContext(m PriorityRESTMapper) PriorityRESTMapperWithContext {
+	return PriorityRESTMapperWithContext{
+		Delegate:         ToRESTMapperWithContext(m.Delegate),
+		ResourcePriority: m.ResourcePriority,
+		KindPriority:     m.KindPriority,
+	}
+}
+
+// ResourceFor finds all resources, then passes them through the ResourcePriority patterns to find a single matching hit.
+//
+// PriorityRESTMapperWithContext.ResourceForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.ResourceForWithContext instead.
+func (m PriorityRESTMapper) ResourceFor(partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	return ToPriorityRESTMapperWithContext(m).ResourceForWithContext(context.Background(), partiallySpecifiedResource)
+}
+
+// KindFor finds all kinds, then passes them through the KindPriority patterns to find a single matching hit.
+//
+// PriorityRESTMapperWithContext.KindForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.KindForWithContext instead.
+func (m PriorityRESTMapper) KindFor(partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return ToPriorityRESTMapperWithContext(m).KindForWithContext(context.Background(), partiallySpecifiedResource)
+}
+
+// PriorityRESTMapperWithContext.RESTMappingWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.RESTMappingWithContext instead.
+func (m PriorityRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (mapping *RESTMapping, err error) {
+	return ToPriorityRESTMapperWithContext(m).RESTMappingWithContext(context.Background(), gk, versions...)
+}
+
+// PriorityRESTMapperWithContext.RESTMappingsWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.RESTMappingsWithContext instead.
+func (m PriorityRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	return m.Delegate.RESTMappings(gk, versions...)
+}
+
+// PriorityRESTMapperWithContext.ResourceSingularizerWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.ResourceSingularizerWithContext instead.
+func (m PriorityRESTMapper) ResourceSingularizer(resource string) (singular string, err error) {
+	return m.Delegate.ResourceSingularizer(resource)
+}
+
+// PriorityRESTMapperWithContext.ResourcesForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.ResourcesForWithContext instead.
+func (m PriorityRESTMapper) ResourcesFor(partiallySpecifiedResource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return m.Delegate.ResourcesFor(partiallySpecifiedResource)
+}
+
+// PriorityRESTMapperWithContext.KindsForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.KindsForWithContext instead.
+func (m PriorityRESTMapper) KindsFor(partiallySpecifiedResource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
+	return m.Delegate.KindsFor(partiallySpecifiedResource)
+}
+
+// PriorityRESTMapperWithContext.ResetWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.ResetWithContext instead.
+func (m PriorityRESTMapper) Reset() {
+	MaybeResetRESTMapper(m.Delegate)
+}
+
+// ResourceFor finds all resources, then passes them through the ResourcePriority patterns to find a single matching hit.
+func (m PriorityRESTMapperWithContext) ResourceForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	originalGVRs, originalErr := m.Delegate.ResourcesForWithContext(ctx, partiallySpecifiedResource)
+	if originalErr != nil && len(originalGVRs) == 0 {
+		return schema.GroupVersionResource{}, originalErr
+	}
+	if len(originalGVRs) == 1 {
+		return originalGVRs[0], originalErr
+	}
+
+	remainingGVRs := append([]schema.GroupVersionResource{}, originalGVRs...)
+	for _, pattern := range m.ResourcePriority {
+		matchedGVRs := []schema.GroupVersionResource{}
+		for _, gvr := range remainingGVRs {
+			if resourceMatches(pattern, gvr) {
+				matchedGVRs = append(matchedGVRs, gvr)
+			}
+		}
+
+		switch len(matchedGVRs) {
+		case 0:
+			// if you have no matches, then nothing matched this pattern just move to the next
+			continue
+		case 1:
+			// one match, return
+			return matchedGVRs[0], originalErr
+		default:
+			// more than one match, use the matched hits as the list moving to the next pattern.
+			// this way you can have a series of selection criteria
+			remainingGVRs = matchedGVRs
+		}
+	}
+
+	return schema.GroupVersionResource{}, &AmbiguousResourceError{PartialResource: partiallySpecifiedResource, MatchingResources: originalGVRs}
+}
+
+// KindFor finds all kinds, then passes them through the KindPriority patterns to find a single matching hit.
+func (m PriorityRESTMapperWithContext) KindForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	originalGVKs, originalErr := m.Delegate.KindsForWithContext(ctx, partiallySpecifiedResource)
+	if originalErr != nil && len(originalGVKs) == 0 {
+		return schema.GroupVersionKind{}, originalErr
+	}
+	if len(originalGVKs) == 1 {
+		return originalGVKs[0], originalErr
+	}
+
+	remainingGVKs := append([]schema.GroupVersionKind{}, originalGVKs...)
+	for _, pattern := range m.KindPriority {
+		matchedGVKs := []schema.GroupVersionKind{}
+		for _, gvr := range remainingGVKs {
+			if kindMatches(pattern, gvr) {
+				matchedGVKs = append(matchedGVKs, gvr)
+			}
+		}
+
+		switch len(matchedGVKs) {
+		case 0:
+			// if you have no matches, then nothing matched this pattern just move to the next
+			continue
+		case 1:
+			// one match, return
+			return matchedGVKs[0], originalErr
+		default:
+			// more than one match, use the matched hits as the list moving to the next pattern.
+			// this way you can have a series of selection criteria
+			remainingGVKs = matchedGVKs
+		}
+	}
+
+	return schema.GroupVersionKind{}, &AmbiguousResourceError{PartialResource: partiallySpecifiedResource, MatchingKinds: originalGVKs}
+}
+
+func resourceMatches(pattern schema.GroupVersionResource, resource schema.GroupVersionResource) bool {
+	if pattern.Group != AnyGroup && pattern.Group != resource.Group {
+		return false
+	}
+	if pattern.Version != AnyVersion && pattern.Version != resource.Version {
+		return false
+	}
+	if pattern.Resource != AnyResource && pattern.Resource != resource.Resource {
+		return false
+	}
+
+	return true
+}
+
+func kindMatches(pattern schema.GroupVersionKind, kind schema.GroupVersionKind) bool {
+	if pattern.Group != AnyGroup && pattern.Group != kind.Group {
+		return false
+	}
+	if pattern.Version != AnyVersion && pattern.Version != kind.Version {
+		return false
+	}
+	if pattern.Kind != AnyKind && pattern.Kind != kind.Kind {
+		return false
+	}
+
+	return true
+}
+
+func (m PriorityRESTMapperWithContext) RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (mapping *RESTMapping, err error) {
+	mappings, originalErr := m.Delegate.RESTMappingsWithContext(ctx, gk, versions...)
+	if originalErr != nil && len(mappings) == 0 {
+		return nil, originalErr
+	}
+
+	// any versions the user provides take priority
+	priorities := m.KindPriority
+	if len(versions) > 0 {
+		priorities = make([]schema.GroupVersionKind, 0, len(m.KindPriority)+len(versions))
+		for _, version := range versions {
+			gv := schema.GroupVersion{
+				Version: version,
+				Group:   gk.Group,
+			}
+			priorities = append(priorities, gv.WithKind(AnyKind))
+		}
+		priorities = append(priorities, m.KindPriority...)
+	}
+
+	remaining := append([]*RESTMapping{}, mappings...)
+	for _, pattern := range priorities {
+		var matching []*RESTMapping
+		for _, m := range remaining {
+			if kindMatches(pattern, m.GroupVersionKind) {
+				matching = append(matching, m)
+			}
+		}
+
+		switch len(matching) {
+		case 0:
+			// if you have no matches, then nothing matched this pattern just move to the next
+			continue
+		case 1:
+			// one match, return
+			return matching[0], originalErr
+		default:
+			// more than one match, use the matched hits as the list moving to the next pattern.
+			// this way you can have a series of selection criteria
+			remaining = matching
+		}
+	}
+	if len(remaining) == 1 {
+		return remaining[0], originalErr
+	}
+
+	var kinds []schema.GroupVersionKind
+	for _, m := range mappings {
+		kinds = append(kinds, m.GroupVersionKind)
+	}
+	return nil, &AmbiguousKindError{PartialKind: gk.WithVersion(""), MatchingKinds: kinds}
+}
+
+func (m PriorityRESTMapperWithContext) RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	return m.Delegate.RESTMappingsWithContext(ctx, gk, versions...)
+}
+
+func (m PriorityRESTMapperWithContext) ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error) {
+	return m.Delegate.ResourceSingularizerWithContext(ctx, resource)
+}
+
+func (m PriorityRESTMapperWithContext) ResourcesForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return m.Delegate.ResourcesForWithContext(ctx, partiallySpecifiedResource)
+}
+
+func (m PriorityRESTMapperWithContext) KindsForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
+	return m.Delegate.KindsForWithContext(ctx, partiallySpecifiedResource)
+}
+
+func (m PriorityRESTMapperWithContext) ResetWithContext(ctx context.Context) {
+	MaybeResetRESTMapperWithContext(ctx, m.Delegate)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/priority_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/priority_test.go
new file mode 100644
index 0000000000..fff1afd172
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/priority_test.go
@@ -0,0 +1,409 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"errors"
+	"reflect"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestPriorityRESTMapperResourceForErrorHandling(t *testing.T) {
+	tcs := []struct {
+		name string
+
+		delegate         RESTMapper
+		resourcePatterns []schema.GroupVersionResource
+		result           schema.GroupVersionResource
+		err              string
+	}{
+		{
+			name:     "error",
+			delegate: fixedRESTMapper{err: errors.New("delegateError")},
+			err:      "delegateError",
+		},
+		{
+			name:     "single hit + error",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{{Resource: "single-hit"}}, err: errors.New("delegateError")},
+			result:   schema.GroupVersionResource{Resource: "single-hit"},
+			err:      "delegateError",
+		},
+		{
+			name: "group selection + error",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{
+				{Group: "one", Version: "a", Resource: "first"},
+				{Group: "two", Version: "b", Resource: "second"},
+			}, err: errors.New("delegateError")},
+			resourcePatterns: []schema.GroupVersionResource{
+				{Group: "one", Version: AnyVersion, Resource: AnyResource},
+			},
+			result: schema.GroupVersionResource{Group: "one", Version: "a", Resource: "first"},
+			err:    "delegateError",
+		},
+
+		{
+			name:     "single hit",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{{Resource: "single-hit"}}},
+			result:   schema.GroupVersionResource{Resource: "single-hit"},
+		},
+		{
+			name: "ambiguous match",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{
+				{Group: "one", Version: "a", Resource: "first"},
+				{Group: "two", Version: "b", Resource: "second"},
+			}},
+			err: "matches multiple resources",
+		},
+		{
+			name: "group selection",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{
+				{Group: "one", Version: "a", Resource: "first"},
+				{Group: "two", Version: "b", Resource: "second"},
+			}},
+			resourcePatterns: []schema.GroupVersionResource{
+				{Group: "one", Version: AnyVersion, Resource: AnyResource},
+			},
+			result: schema.GroupVersionResource{Group: "one", Version: "a", Resource: "first"},
+		},
+		{
+			name: "empty match continues",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{
+				{Group: "one", Version: "a", Resource: "first"},
+				{Group: "two", Version: "b", Resource: "second"},
+			}},
+			resourcePatterns: []schema.GroupVersionResource{
+				{Group: "fail", Version: AnyVersion, Resource: AnyResource},
+				{Group: "one", Version: AnyVersion, Resource: AnyResource},
+			},
+			result: schema.GroupVersionResource{Group: "one", Version: "a", Resource: "first"},
+		},
+		{
+			name: "group followed by version selection",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{
+				{Group: "one", Version: "a", Resource: "first"},
+				{Group: "two", Version: "b", Resource: "second"},
+				{Group: "one", Version: "c", Resource: "third"},
+			}},
+			resourcePatterns: []schema.GroupVersionResource{
+				{Group: "one", Version: AnyVersion, Resource: AnyResource},
+				{Group: AnyGroup, Version: "a", Resource: AnyResource},
+			},
+			result: schema.GroupVersionResource{Group: "one", Version: "a", Resource: "first"},
+		},
+		{
+			name: "resource selection",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{
+				{Group: "one", Version: "a", Resource: "first"},
+				{Group: "one", Version: "a", Resource: "second"},
+			}},
+			resourcePatterns: []schema.GroupVersionResource{
+				{Group: AnyGroup, Version: AnyVersion, Resource: "second"},
+			},
+			result: schema.GroupVersionResource{Group: "one", Version: "a", Resource: "second"},
+		},
+	}
+
+	for _, tc := range tcs {
+		mapper := PriorityRESTMapper{Delegate: tc.delegate, ResourcePriority: tc.resourcePatterns}
+
+		actualResult, actualErr := mapper.ResourceFor(schema.GroupVersionResource{})
+		if e, a := tc.result, actualResult; e != a {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		if len(tc.err) == 0 && actualErr == nil {
+			continue
+		}
+		if len(tc.err) == 0 && actualErr != nil {
+			t.Errorf("%s: unexpected err: %v", tc.name, actualErr)
+			continue
+		}
+		if len(tc.err) > 0 && actualErr == nil {
+			t.Errorf("%s: missing expected err: %v", tc.name, tc.err)
+			continue
+		}
+		if !strings.Contains(actualErr.Error(), tc.err) {
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+func TestPriorityRESTMapperKindForErrorHandling(t *testing.T) {
+	tcs := []struct {
+		name string
+
+		delegate     RESTMapper
+		kindPatterns []schema.GroupVersionKind
+		result       schema.GroupVersionKind
+		err          string
+	}{
+		{
+			name:     "error",
+			delegate: fixedRESTMapper{err: errors.New("delegateErr")},
+			err:      "delegateErr",
+		},
+		{
+			name:     "single hit + error",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{{Kind: "single-hit"}}, err: errors.New("delegateErr")},
+			result:   schema.GroupVersionKind{Kind: "single-hit"},
+			err:      "delegateErr",
+		},
+		{
+			name: "group selection + error",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{
+				{Group: "one", Version: "a", Kind: "first"},
+				{Group: "two", Version: "b", Kind: "second"},
+			}, err: errors.New("delegateErr")},
+			kindPatterns: []schema.GroupVersionKind{
+				{Group: "one", Version: AnyVersion, Kind: AnyKind},
+			},
+			result: schema.GroupVersionKind{Group: "one", Version: "a", Kind: "first"},
+			err:    "delegateErr",
+		},
+
+		{
+			name:     "single hit",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{{Kind: "single-hit"}}},
+			result:   schema.GroupVersionKind{Kind: "single-hit"},
+		},
+		{
+			name: "ambiguous match",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{
+				{Group: "one", Version: "a", Kind: "first"},
+				{Group: "two", Version: "b", Kind: "second"},
+			}},
+			err: "matches multiple kinds",
+		},
+		{
+			name: "group selection",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{
+				{Group: "one", Version: "a", Kind: "first"},
+				{Group: "two", Version: "b", Kind: "second"},
+			}},
+			kindPatterns: []schema.GroupVersionKind{
+				{Group: "one", Version: AnyVersion, Kind: AnyKind},
+			},
+			result: schema.GroupVersionKind{Group: "one", Version: "a", Kind: "first"},
+		},
+		{
+			name: "empty match continues",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{
+				{Group: "one", Version: "a", Kind: "first"},
+				{Group: "two", Version: "b", Kind: "second"},
+			}},
+			kindPatterns: []schema.GroupVersionKind{
+				{Group: "fail", Version: AnyVersion, Kind: AnyKind},
+				{Group: "one", Version: AnyVersion, Kind: AnyKind},
+			},
+			result: schema.GroupVersionKind{Group: "one", Version: "a", Kind: "first"},
+		},
+		{
+			name: "group followed by version selection",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{
+				{Group: "one", Version: "a", Kind: "first"},
+				{Group: "two", Version: "b", Kind: "second"},
+				{Group: "one", Version: "c", Kind: "third"},
+			}},
+			kindPatterns: []schema.GroupVersionKind{
+				{Group: "one", Version: AnyVersion, Kind: AnyKind},
+				{Group: AnyGroup, Version: "a", Kind: AnyKind},
+			},
+			result: schema.GroupVersionKind{Group: "one", Version: "a", Kind: "first"},
+		},
+		{
+			name: "kind selection",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{
+				{Group: "one", Version: "a", Kind: "first"},
+				{Group: "one", Version: "a", Kind: "second"},
+			}},
+			kindPatterns: []schema.GroupVersionKind{
+				{Group: AnyGroup, Version: AnyVersion, Kind: "second"},
+			},
+			result: schema.GroupVersionKind{Group: "one", Version: "a", Kind: "second"},
+		},
+	}
+
+	for _, tc := range tcs {
+		mapper := PriorityRESTMapper{Delegate: tc.delegate, KindPriority: tc.kindPatterns}
+
+		actualResult, actualErr := mapper.KindFor(schema.GroupVersionResource{})
+		if e, a := tc.result, actualResult; e != a {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		if len(tc.err) == 0 && actualErr == nil {
+			continue
+		}
+		if len(tc.err) == 0 && actualErr != nil {
+			t.Errorf("%s: unexpected err: %v", tc.name, actualErr)
+			continue
+		}
+		if len(tc.err) > 0 && actualErr == nil {
+			t.Errorf("%s: missing expected err: %v", tc.name, tc.err)
+			continue
+		}
+		if !strings.Contains(actualErr.Error(), tc.err) {
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+func TestPriorityRESTMapperRESTMapping(t *testing.T) {
+	mapping1 := &RESTMapping{
+		GroupVersionKind: schema.GroupVersionKind{Kind: "Foo", Version: "v1alpha1"},
+	}
+	mapping2 := &RESTMapping{
+		GroupVersionKind: schema.GroupVersionKind{Kind: "Foo", Version: "v1"},
+	}
+	mapping3 := &RESTMapping{
+		GroupVersionKind: schema.GroupVersionKind{Group: "other", Kind: "Foo", Version: "v1"},
+	}
+	allMappers := MultiRESTMapper{
+		fixedRESTMapper{mappings: []*RESTMapping{mapping1}},
+		fixedRESTMapper{mappings: []*RESTMapping{mapping2}},
+		fixedRESTMapper{mappings: []*RESTMapping{mapping3}},
+	}
+	tcs := []struct {
+		name string
+
+		mapper PriorityRESTMapper
+		input  schema.GroupKind
+		result *RESTMapping
+		err    error
+	}{
+		{
+			name:   "empty",
+			mapper: PriorityRESTMapper{Delegate: MultiRESTMapper{}},
+			input:  schema.GroupKind{Kind: "Foo"},
+			err:    &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}},
+		},
+		{
+			name:   "ignore not found",
+			mapper: PriorityRESTMapper{Delegate: MultiRESTMapper{fixedRESTMapper{err: &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "IGNORE_THIS"}}}}},
+			input:  schema.GroupKind{Kind: "Foo"},
+			err:    &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}},
+		},
+		{
+			name:   "accept first failure",
+			mapper: PriorityRESTMapper{Delegate: MultiRESTMapper{fixedRESTMapper{err: errors.New("fail on this")}, fixedRESTMapper{mappings: []*RESTMapping{mapping1}}}},
+			input:  schema.GroupKind{Kind: "Foo"},
+			err:    errors.New("fail on this"),
+		},
+		{
+			name:   "result + error",
+			mapper: PriorityRESTMapper{Delegate: fixedRESTMapper{mappings: []*RESTMapping{mapping1}, err: errors.New("fail on this")}},
+			input:  schema.GroupKind{Kind: "Foo"},
+			result: mapping1,
+			err:    errors.New("fail on this"),
+		},
+		{
+			name: "return error for ambiguous",
+			mapper: PriorityRESTMapper{
+				Delegate: allMappers,
+			},
+			input: schema.GroupKind{Kind: "Foo"},
+			err: &AmbiguousKindError{
+				PartialKind: schema.GroupVersionKind{Kind: "Foo"},
+				MatchingKinds: []schema.GroupVersionKind{
+					{Kind: "Foo", Version: "v1alpha1"},
+					{Kind: "Foo", Version: "v1"},
+					{Group: "other", Kind: "Foo", Version: "v1"},
+				},
+			},
+		},
+		{
+			name: "accept only item",
+			mapper: PriorityRESTMapper{
+				Delegate: fixedRESTMapper{mappings: []*RESTMapping{mapping1}},
+			},
+			input:  schema.GroupKind{Kind: "Foo"},
+			result: mapping1,
+		},
+		{
+			name: "return single priority",
+			mapper: PriorityRESTMapper{
+				Delegate:     allMappers,
+				KindPriority: []schema.GroupVersionKind{{Version: "v1", Kind: AnyKind}, {Version: "v1alpha1", Kind: AnyKind}},
+			},
+			input:  schema.GroupKind{Kind: "Foo"},
+			result: mapping2,
+		},
+		{
+			name: "return out of group match",
+			mapper: PriorityRESTMapper{
+				Delegate:     allMappers,
+				KindPriority: []schema.GroupVersionKind{{Group: AnyGroup, Version: "v1", Kind: AnyKind}, {Group: "other", Version: AnyVersion, Kind: AnyKind}},
+			},
+			input:  schema.GroupKind{Kind: "Foo"},
+			result: mapping3,
+		},
+	}
+
+	for _, tc := range tcs {
+		actualResult, actualErr := tc.mapper.RESTMapping(tc.input)
+		if e, a := tc.result, actualResult; !reflect.DeepEqual(e, a) {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		switch {
+		case tc.err == nil && actualErr == nil:
+		case tc.err == nil:
+			t.Errorf("%s: unexpected error: %v", tc.name, actualErr)
+		case actualErr == nil:
+			t.Errorf("%s: expected error: %v got nil", tc.name, tc.err)
+		case tc.err.Error() != actualErr.Error():
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+func TestPriorityRESTMapperRESTMappingHonorsUserVersion(t *testing.T) {
+	mappingV2alpha1 := &RESTMapping{
+		GroupVersionKind: schema.GroupVersionKind{Group: "Bar", Kind: "Foo", Version: "v2alpha1"},
+	}
+	mappingV1 := &RESTMapping{
+		GroupVersionKind: schema.GroupVersionKind{Group: "Bar", Kind: "Foo", Version: "v1"},
+	}
+
+	allMappers := MultiRESTMapper{
+		fixedRESTMapper{mappings: []*RESTMapping{mappingV2alpha1}},
+		fixedRESTMapper{mappings: []*RESTMapping{mappingV1}},
+	}
+
+	mapper := PriorityRESTMapper{
+		Delegate:     allMappers,
+		KindPriority: []schema.GroupVersionKind{{Group: "Bar", Version: "v2alpha1", Kind: AnyKind}, {Group: "Bar", Version: AnyVersion, Kind: AnyKind}},
+	}
+
+	outMapping1, err := mapper.RESTMapping(schema.GroupKind{Group: "Bar", Kind: "Foo"}, "v1")
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	if outMapping1 != mappingV1 {
+		t.Errorf("asked for version %v, expected mapping for %v, got mapping for %v", "v1", mappingV1.GroupVersionKind, outMapping1.GroupVersionKind)
+	}
+
+	outMapping2, err := mapper.RESTMapping(schema.GroupKind{Group: "Bar", Kind: "Foo"}, "v2alpha1")
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	if outMapping2 != mappingV2alpha1 {
+		t.Errorf("asked for version %v, expected mapping for %v, got mapping for %v", "v2alpha1", mappingV2alpha1.GroupVersionKind, outMapping2.GroupVersionKind)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/restmapper.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/restmapper.go
new file mode 100644
index 0000000000..d64db33d41
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/restmapper.go
@@ -0,0 +1,579 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// TODO: move everything in this file to pkg/api/rest
+package meta
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// Implements RESTScope interface
+type restScope struct {
+	name RESTScopeName
+}
+
+func (r *restScope) Name() RESTScopeName {
+	return r.name
+}
+
+var RESTScopeNamespace = &restScope{
+	name: RESTScopeNameNamespace,
+}
+
+var RESTScopeRoot = &restScope{
+	name: RESTScopeNameRoot,
+}
+
+// DefaultRESTMapper exposes mappings between the types defined in a
+// runtime.Scheme. It assumes that all types defined the provided scheme
+// can be mapped with the provided MetadataAccessor and Codec interfaces.
+//
+// The resource name of a Kind is defined as the lowercase,
+// English-plural version of the Kind string.
+// When converting from resource to Kind, the singular version of the
+// resource name is also accepted for convenience.
+//
+// TODO: Only accept plural for some operations for increased control?
+// (`get pod bar` vs `get pods bar`)
+type DefaultRESTMapper struct {
+	defaultGroupVersions []schema.GroupVersion
+
+	resourceToKind       map[schema.GroupVersionResource]schema.GroupVersionKind
+	kindToPluralResource map[schema.GroupVersionKind]schema.GroupVersionResource
+	kindToScope          map[schema.GroupVersionKind]RESTScope
+	singularToPlural     map[schema.GroupVersionResource]schema.GroupVersionResource
+	pluralToSingular     map[schema.GroupVersionResource]schema.GroupVersionResource
+}
+
+func (m *DefaultRESTMapper) String() string {
+	if m == nil {
+		return "<nil>"
+	}
+	return fmt.Sprintf("DefaultRESTMapper{kindToPluralResource=%v}", m.kindToPluralResource)
+}
+
+var _ RESTMapper = &DefaultRESTMapper{}
+var _ RESTMapperWithContext = &DefaultRESTMapper{}
+var _ fmt.Stringer = &DefaultRESTMapper{}
+
+// NewDefaultRESTMapper initializes a mapping between Kind and APIVersion
+// to a resource name and back based on the objects in a runtime.Scheme
+// and the Kubernetes API conventions. Takes a group name, a priority list of the versions
+// to search when an object has no default version (set empty to return an error),
+// and a function that retrieves the correct metadata for a given version.
+func NewDefaultRESTMapper(defaultGroupVersions []schema.GroupVersion) *DefaultRESTMapper {
+	resourceToKind := make(map[schema.GroupVersionResource]schema.GroupVersionKind)
+	kindToPluralResource := make(map[schema.GroupVersionKind]schema.GroupVersionResource)
+	kindToScope := make(map[schema.GroupVersionKind]RESTScope)
+	singularToPlural := make(map[schema.GroupVersionResource]schema.GroupVersionResource)
+	pluralToSingular := make(map[schema.GroupVersionResource]schema.GroupVersionResource)
+	// TODO: verify name mappings work correctly when versions differ
+
+	return &DefaultRESTMapper{
+		resourceToKind:       resourceToKind,
+		kindToPluralResource: kindToPluralResource,
+		kindToScope:          kindToScope,
+		defaultGroupVersions: defaultGroupVersions,
+		singularToPlural:     singularToPlural,
+		pluralToSingular:     pluralToSingular,
+	}
+}
+
+func (m *DefaultRESTMapper) Add(kind schema.GroupVersionKind, scope RESTScope) {
+	plural, singular := UnsafeGuessKindToResource(kind)
+	m.AddSpecific(kind, plural, singular, scope)
+}
+
+func (m *DefaultRESTMapper) AddSpecific(kind schema.GroupVersionKind, plural, singular schema.GroupVersionResource, scope RESTScope) {
+	m.singularToPlural[singular] = plural
+	m.pluralToSingular[plural] = singular
+
+	m.resourceToKind[singular] = kind
+	m.resourceToKind[plural] = kind
+
+	m.kindToPluralResource[kind] = plural
+	m.kindToScope[kind] = scope
+}
+
+// unpluralizedSuffixes is a list of resource suffixes that are the same plural and singular
+// This is only is only necessary because some bits of code are lazy and don't actually use the RESTMapper like they should.
+// TODO eliminate this so that different callers can correctly map to resources.  This probably means updating all
+// callers to use the RESTMapper they mean.
+var unpluralizedSuffixes = []string{
+	"endpoints",
+}
+
+// UnsafeGuessKindToResource converts Kind to a resource name.
+// Broken. This method only "sort of" works when used outside of this package.  It assumes that Kinds and Resources match
+// and they aren't guaranteed to do so.
+func UnsafeGuessKindToResource(kind schema.GroupVersionKind) ( /*plural*/ schema.GroupVersionResource /*singular*/, schema.GroupVersionResource) {
+	kindName := kind.Kind
+	if len(kindName) == 0 {
+		return schema.GroupVersionResource{}, schema.GroupVersionResource{}
+	}
+	singularName := strings.ToLower(kindName)
+	singular := kind.GroupVersion().WithResource(singularName)
+
+	for _, skip := range unpluralizedSuffixes {
+		if strings.HasSuffix(singularName, skip) {
+			return singular, singular
+		}
+	}
+
+	switch string(singularName[len(singularName)-1]) {
+	case "s":
+		return kind.GroupVersion().WithResource(singularName + "es"), singular
+	case "y":
+		return kind.GroupVersion().WithResource(strings.TrimSuffix(singularName, "y") + "ies"), singular
+	}
+
+	return kind.GroupVersion().WithResource(singularName + "s"), singular
+}
+
+// ResourceSingularizer implements RESTMapper
+// It converts a resource name from plural to singular (e.g., from pods to pod)
+func (m *DefaultRESTMapper) ResourceSingularizer(resourceType string) (string, error) {
+	partialResource := schema.GroupVersionResource{Resource: resourceType}
+	resources, err := m.ResourcesFor(partialResource)
+	if err != nil {
+		return resourceType, err
+	}
+
+	singular := schema.GroupVersionResource{}
+	for _, curr := range resources {
+		currSingular, ok := m.pluralToSingular[curr]
+		if !ok {
+			continue
+		}
+		if singular.Empty() {
+			singular = currSingular
+			continue
+		}
+
+		if currSingular.Resource != singular.Resource {
+			return resourceType, fmt.Errorf("multiple possible singular resources (%v) found for %v", resources, resourceType)
+		}
+	}
+
+	if singular.Empty() {
+		return resourceType, fmt.Errorf("no singular of resource %v has been defined", resourceType)
+	}
+
+	return singular.Resource, nil
+}
+
+func (m *DefaultRESTMapper) ResourceSingularizerWithContext(_ context.Context, resourceType string) (string, error) {
+	return m.ResourceSingularizer(resourceType)
+}
+
+// coerceResourceForMatching makes the resource lower case and converts internal versions to unspecified (legacy behavior)
+func coerceResourceForMatching(resource schema.GroupVersionResource) schema.GroupVersionResource {
+	resource.Resource = strings.ToLower(resource.Resource)
+	if resource.Version == runtime.APIVersionInternal {
+		resource.Version = ""
+	}
+
+	return resource
+}
+
+func (m *DefaultRESTMapper) ResourcesFor(input schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	resource := coerceResourceForMatching(input)
+
+	hasResource := len(resource.Resource) > 0
+	hasGroup := len(resource.Group) > 0
+	hasVersion := len(resource.Version) > 0
+
+	if !hasResource {
+		return nil, fmt.Errorf("a resource must be present, got: %v", resource)
+	}
+
+	ret := []schema.GroupVersionResource{}
+	switch {
+	case hasGroup && hasVersion:
+		// fully qualified.  Find the exact match
+		for plural, singular := range m.pluralToSingular {
+			if singular == resource {
+				ret = append(ret, plural)
+				break
+			}
+			if plural == resource {
+				ret = append(ret, plural)
+				break
+			}
+		}
+
+	case hasGroup:
+		// given a group, prefer an exact match.  If you don't find one, resort to a prefix match on group
+		foundExactMatch := false
+		requestedGroupResource := resource.GroupResource()
+		for plural, singular := range m.pluralToSingular {
+			if singular.GroupResource() == requestedGroupResource {
+				foundExactMatch = true
+				ret = append(ret, plural)
+			}
+			if plural.GroupResource() == requestedGroupResource {
+				foundExactMatch = true
+				ret = append(ret, plural)
+			}
+		}
+
+		// if you didn't find an exact match, match on group prefixing. This allows storageclass.storage to match
+		// storageclass.storage.k8s.io
+		if !foundExactMatch {
+			for plural, singular := range m.pluralToSingular {
+				if !strings.HasPrefix(plural.Group, requestedGroupResource.Group) {
+					continue
+				}
+				if singular.Resource == requestedGroupResource.Resource {
+					ret = append(ret, plural)
+				}
+				if plural.Resource == requestedGroupResource.Resource {
+					ret = append(ret, plural)
+				}
+			}
+
+		}
+
+	case hasVersion:
+		for plural, singular := range m.pluralToSingular {
+			if singular.Version == resource.Version && singular.Resource == resource.Resource {
+				ret = append(ret, plural)
+			}
+			if plural.Version == resource.Version && plural.Resource == resource.Resource {
+				ret = append(ret, plural)
+			}
+		}
+
+	default:
+		for plural, singular := range m.pluralToSingular {
+			if singular.Resource == resource.Resource {
+				ret = append(ret, plural)
+			}
+			if plural.Resource == resource.Resource {
+				ret = append(ret, plural)
+			}
+		}
+	}
+
+	if len(ret) == 0 {
+		return nil, &NoResourceMatchError{PartialResource: resource}
+	}
+
+	sort.Sort(resourceByPreferredGroupVersion{ret, m.defaultGroupVersions})
+	return ret, nil
+}
+
+func (m *DefaultRESTMapper) ResourcesForWithContext(_ context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return m.ResourcesFor(input)
+}
+
+func (m *DefaultRESTMapper) ResourceFor(resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	resources, err := m.ResourcesFor(resource)
+	if err != nil {
+		return schema.GroupVersionResource{}, err
+	}
+	if len(resources) == 1 {
+		return resources[0], nil
+	}
+
+	return schema.GroupVersionResource{}, &AmbiguousResourceError{PartialResource: resource, MatchingResources: resources}
+}
+
+func (m *DefaultRESTMapper) ResourceForWithContext(_ context.Context, resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	return m.ResourceFor(resource)
+}
+
+func (m *DefaultRESTMapper) KindsFor(input schema.GroupVersionResource) ([]schema.GroupVersionKind, error) {
+	resource := coerceResourceForMatching(input)
+
+	hasResource := len(resource.Resource) > 0
+	hasGroup := len(resource.Group) > 0
+	hasVersion := len(resource.Version) > 0
+
+	if !hasResource {
+		return nil, fmt.Errorf("a resource must be present, got: %v", resource)
+	}
+
+	ret := []schema.GroupVersionKind{}
+	switch {
+	// fully qualified.  Find the exact match
+	case hasGroup && hasVersion:
+		kind, exists := m.resourceToKind[resource]
+		if exists {
+			ret = append(ret, kind)
+		}
+
+	case hasGroup:
+		foundExactMatch := false
+		requestedGroupResource := resource.GroupResource()
+		for currResource, currKind := range m.resourceToKind {
+			if currResource.GroupResource() == requestedGroupResource {
+				foundExactMatch = true
+				ret = append(ret, currKind)
+			}
+		}
+
+		// if you didn't find an exact match, match on group prefixing. This allows storageclass.storage to match
+		// storageclass.storage.k8s.io
+		if !foundExactMatch {
+			for currResource, currKind := range m.resourceToKind {
+				if !strings.HasPrefix(currResource.Group, requestedGroupResource.Group) {
+					continue
+				}
+				if currResource.Resource == requestedGroupResource.Resource {
+					ret = append(ret, currKind)
+				}
+			}
+
+		}
+
+	case hasVersion:
+		for currResource, currKind := range m.resourceToKind {
+			if currResource.Version == resource.Version && currResource.Resource == resource.Resource {
+				ret = append(ret, currKind)
+			}
+		}
+
+	default:
+		for currResource, currKind := range m.resourceToKind {
+			if currResource.Resource == resource.Resource {
+				ret = append(ret, currKind)
+			}
+		}
+	}
+
+	if len(ret) == 0 {
+		return nil, &NoResourceMatchError{PartialResource: input}
+	}
+
+	sort.Sort(kindByPreferredGroupVersion{ret, m.defaultGroupVersions})
+	return ret, nil
+}
+
+func (m *DefaultRESTMapper) KindsForWithContext(_ context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionKind, error) {
+	return m.KindsFor(input)
+}
+
+func (m *DefaultRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	kinds, err := m.KindsFor(resource)
+	if err != nil {
+		return schema.GroupVersionKind{}, err
+	}
+	if len(kinds) == 1 {
+		return kinds[0], nil
+	}
+
+	return schema.GroupVersionKind{}, &AmbiguousResourceError{PartialResource: resource, MatchingKinds: kinds}
+}
+
+func (m *DefaultRESTMapper) KindForWithContext(_ context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return m.KindFor(resource)
+}
+
+type kindByPreferredGroupVersion struct {
+	list      []schema.GroupVersionKind
+	sortOrder []schema.GroupVersion
+}
+
+func (o kindByPreferredGroupVersion) Len() int      { return len(o.list) }
+func (o kindByPreferredGroupVersion) Swap(i, j int) { o.list[i], o.list[j] = o.list[j], o.list[i] }
+func (o kindByPreferredGroupVersion) Less(i, j int) bool {
+	lhs := o.list[i]
+	rhs := o.list[j]
+	if lhs == rhs {
+		return false
+	}
+
+	if lhs.GroupVersion() == rhs.GroupVersion() {
+		return lhs.Kind < rhs.Kind
+	}
+
+	// otherwise, the difference is in the GroupVersion, so we need to sort with respect to the preferred order
+	lhsIndex := -1
+	rhsIndex := -1
+
+	for i := range o.sortOrder {
+		if o.sortOrder[i] == lhs.GroupVersion() {
+			lhsIndex = i
+		}
+		if o.sortOrder[i] == rhs.GroupVersion() {
+			rhsIndex = i
+		}
+	}
+
+	if rhsIndex == -1 {
+		return true
+	}
+
+	return lhsIndex < rhsIndex
+}
+
+type resourceByPreferredGroupVersion struct {
+	list      []schema.GroupVersionResource
+	sortOrder []schema.GroupVersion
+}
+
+func (o resourceByPreferredGroupVersion) Len() int      { return len(o.list) }
+func (o resourceByPreferredGroupVersion) Swap(i, j int) { o.list[i], o.list[j] = o.list[j], o.list[i] }
+func (o resourceByPreferredGroupVersion) Less(i, j int) bool {
+	lhs := o.list[i]
+	rhs := o.list[j]
+	if lhs == rhs {
+		return false
+	}
+
+	if lhs.GroupVersion() == rhs.GroupVersion() {
+		return lhs.Resource < rhs.Resource
+	}
+
+	// otherwise, the difference is in the GroupVersion, so we need to sort with respect to the preferred order
+	lhsIndex := -1
+	rhsIndex := -1
+
+	for i := range o.sortOrder {
+		if o.sortOrder[i] == lhs.GroupVersion() {
+			lhsIndex = i
+		}
+		if o.sortOrder[i] == rhs.GroupVersion() {
+			rhsIndex = i
+		}
+	}
+
+	if rhsIndex == -1 {
+		return true
+	}
+
+	return lhsIndex < rhsIndex
+}
+
+// RESTMapping returns a struct representing the resource path and conversion interfaces a
+// RESTClient should use to operate on the provided group/kind in order of versions. If a version search
+// order is not provided, the search order provided to DefaultRESTMapper will be used to resolve which
+// version should be used to access the named group/kind.
+func (m *DefaultRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	mappings, err := m.RESTMappings(gk, versions...)
+	if err != nil {
+		return nil, err
+	}
+	if len(mappings) == 0 {
+		return nil, &NoKindMatchError{GroupKind: gk, SearchedVersions: versions}
+	}
+	// since we rely on RESTMappings method
+	// take the first match and return to the caller
+	// as this was the existing behavior.
+	return mappings[0], nil
+}
+
+func (m *DefaultRESTMapper) RESTMappingWithContext(_ context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	return m.RESTMapping(gk, versions...)
+}
+
+// RESTMappings returns the RESTMappings for the provided group kind. If a version search order
+// is not provided, the search order provided to DefaultRESTMapper will be used.
+func (m *DefaultRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	mappings := make([]*RESTMapping, 0)
+	potentialGVK := make([]schema.GroupVersionKind, 0)
+	hadVersion := false
+
+	// Pick an appropriate version
+	for _, version := range versions {
+		if len(version) == 0 || version == runtime.APIVersionInternal {
+			continue
+		}
+		currGVK := gk.WithVersion(version)
+		hadVersion = true
+		if _, ok := m.kindToPluralResource[currGVK]; ok {
+			potentialGVK = append(potentialGVK, currGVK)
+			break
+		}
+	}
+	// Use the default preferred versions
+	if !hadVersion && len(potentialGVK) == 0 {
+		for _, gv := range m.defaultGroupVersions {
+			if gv.Group != gk.Group {
+				continue
+			}
+			potentialGVK = append(potentialGVK, gk.WithVersion(gv.Version))
+		}
+	}
+
+	if len(potentialGVK) == 0 {
+		return nil, &NoKindMatchError{GroupKind: gk, SearchedVersions: versions}
+	}
+
+	for _, gvk := range potentialGVK {
+		//Ensure we have a REST mapping
+		res, ok := m.kindToPluralResource[gvk]
+		if !ok {
+			continue
+		}
+
+		// Ensure we have a REST scope
+		scope, ok := m.kindToScope[gvk]
+		if !ok {
+			return nil, fmt.Errorf("the provided version %q and kind %q cannot be mapped to a supported scope", gvk.GroupVersion(), gvk.Kind)
+		}
+
+		mappings = append(mappings, &RESTMapping{
+			Resource:         res,
+			GroupVersionKind: gvk,
+			Scope:            scope,
+		})
+	}
+
+	if len(mappings) == 0 {
+		return nil, &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Group: gk.Group, Resource: gk.Kind}}
+	}
+	return mappings, nil
+}
+
+func (m *DefaultRESTMapper) RESTMappingsWithContext(_ context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	return m.RESTMappings(gk, versions...)
+}
+
+// MaybeResetRESTMapper calls Reset() on the mapper if it is a ResettableRESTMapper or
+// ResetWithContext() if it is a ResettableRESTMapperWithContext.
+//
+// MaybeResetRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MaybeResetRESTMapperWithContext instead.
+func MaybeResetRESTMapper(mapper RESTMapper) {
+	maybeReset(context.Background(), mapper)
+}
+
+// MaybeResetRESTMapperWithContext calls Reset() on the mapper if it is a ResettableRESTMapper or
+// ResetWithContext() if it is a ResettableRESTMapperWithContext.
+func MaybeResetRESTMapperWithContext(ctx context.Context, mapper RESTMapperWithContext) {
+	maybeReset(ctx, mapper)
+}
+
+func maybeReset(ctx context.Context, mapper any) {
+	if m, ok := mapper.(ResettableRESTMapperWithContext); ok {
+		m.ResetWithContext(ctx)
+		return
+	}
+	if m, ok := mapper.(ResettableRESTMapper); ok {
+		m.Reset()
+		return
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/restmapper_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/restmapper_test.go
new file mode 100644
index 0000000000..f168f033c7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/restmapper_test.go
@@ -0,0 +1,724 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestRESTMapperVersionAndKindForResource(t *testing.T) {
+	testGroup := "test.group"
+	testVersion := "test"
+	testGroupVersion := schema.GroupVersion{Group: testGroup, Version: testVersion}
+
+	testCases := []struct {
+		Resource               schema.GroupVersionResource
+		GroupVersionToRegister schema.GroupVersion
+		ExpectedGVK            schema.GroupVersionKind
+		Err                    bool
+	}{
+		{Resource: schema.GroupVersionResource{Resource: "internalobjec"}, Err: true},
+		{Resource: schema.GroupVersionResource{Resource: "internalObjec"}, Err: true},
+
+		{Resource: schema.GroupVersionResource{Resource: "internalobject"}, ExpectedGVK: testGroupVersion.WithKind("InternalObject")},
+		{Resource: schema.GroupVersionResource{Resource: "internalobjects"}, ExpectedGVK: testGroupVersion.WithKind("InternalObject")},
+	}
+	for i, testCase := range testCases {
+		mapper := NewDefaultRESTMapper([]schema.GroupVersion{testGroupVersion})
+		if len(testCase.ExpectedGVK.Kind) != 0 {
+			mapper.Add(testCase.ExpectedGVK, RESTScopeNamespace)
+		}
+		actualGVK, err := mapper.KindFor(testCase.Resource)
+
+		hasErr := err != nil
+		if hasErr != testCase.Err {
+			t.Errorf("%d: unexpected error behavior %t: %v", i, testCase.Err, err)
+			continue
+		}
+		if err != nil {
+			continue
+		}
+
+		if actualGVK != testCase.ExpectedGVK {
+			t.Errorf("%d: unexpected version and kind: e=%s a=%s", i, testCase.ExpectedGVK, actualGVK)
+		}
+	}
+}
+
+func TestRESTMapperGroupForResource(t *testing.T) {
+	testCases := []struct {
+		Resource         schema.GroupVersionResource
+		GroupVersionKind schema.GroupVersionKind
+		Err              bool
+	}{
+		{Resource: schema.GroupVersionResource{Resource: "myObject"}, GroupVersionKind: schema.GroupVersionKind{Group: "testapi", Version: "test", Kind: "MyObject"}},
+		{Resource: schema.GroupVersionResource{Resource: "myobject"}, GroupVersionKind: schema.GroupVersionKind{Group: "testapi2", Version: "test", Kind: "MyObject"}},
+		{Resource: schema.GroupVersionResource{Resource: "myObje"}, Err: true, GroupVersionKind: schema.GroupVersionKind{Group: "testapi", Version: "test", Kind: "MyObject"}},
+		{Resource: schema.GroupVersionResource{Resource: "myobje"}, Err: true, GroupVersionKind: schema.GroupVersionKind{Group: "testapi", Version: "test", Kind: "MyObject"}},
+	}
+	for i, testCase := range testCases {
+		mapper := NewDefaultRESTMapper([]schema.GroupVersion{testCase.GroupVersionKind.GroupVersion()})
+		mapper.Add(testCase.GroupVersionKind, RESTScopeNamespace)
+
+		actualGVK, err := mapper.KindFor(testCase.Resource)
+		if testCase.Err {
+			if err == nil {
+				t.Errorf("%d: expected error", i)
+			}
+		} else if err != nil {
+			t.Errorf("%d: unexpected error: %v", i, err)
+		} else if actualGVK != testCase.GroupVersionKind {
+			t.Errorf("%d: expected group %q, got %q", i, testCase.GroupVersionKind, actualGVK)
+		}
+	}
+}
+
+func TestRESTMapperKindsFor(t *testing.T) {
+	testCases := []struct {
+		Name                     string
+		PreferredOrder           []schema.GroupVersion
+		KindsToRegister          []schema.GroupVersionKind
+		PartialResourceToRequest schema.GroupVersionResource
+
+		ExpectedKinds   []schema.GroupVersionKind
+		ExpectedKindErr string
+	}{
+		{
+			// exact matches are preferred
+			Name: "groups, with group exact",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "first-group-1", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group-1", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+			PartialResourceToRequest: schema.GroupVersionResource{Group: "first-group", Resource: "my-kind"},
+
+			ExpectedKinds: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+		},
+
+		{
+			// group prefixes work
+			Name: "groups, with group prefix",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "second-group", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+			},
+			PartialResourceToRequest: schema.GroupVersionResource{Group: "first", Resource: "my-kind"},
+
+			ExpectedKinds: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+		},
+
+		{
+			// group prefixes can be ambiguous
+			Name: "groups, with ambiguous group prefix",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "first-group-1", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group-1", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+			PartialResourceToRequest: schema.GroupVersionResource{Group: "first", Resource: "my-kind"},
+
+			ExpectedKinds: []schema.GroupVersionKind{
+				{Group: "first-group-1", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+			ExpectedKindErr: " matches multiple kinds ",
+		},
+
+		{
+			Name: "ambiguous groups, with preference order",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "second-group", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "your-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "your-kind"},
+			},
+			PartialResourceToRequest: schema.GroupVersionResource{Resource: "my-kinds"},
+
+			ExpectedKinds: []schema.GroupVersionKind{
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+			ExpectedKindErr: " matches multiple kinds ",
+		},
+
+		{
+			Name: "ambiguous groups, with explicit group match",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "second-group", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "your-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "your-kind"},
+			},
+			PartialResourceToRequest: schema.GroupVersionResource{Group: "first-group", Resource: "my-kinds"},
+
+			ExpectedKinds: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+		},
+
+		{
+			Name: "ambiguous groups, with ambiguous version match",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "first-group", Version: "first-version"},
+				{Group: "second-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "your-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "your-kind"},
+			},
+			PartialResourceToRequest: schema.GroupVersionResource{Version: "first-version", Resource: "my-kinds"},
+
+			ExpectedKinds: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+			},
+			ExpectedKindErr: " matches multiple kinds ",
+		},
+	}
+	for _, testCase := range testCases {
+		tcName := testCase.Name
+		mapper := NewDefaultRESTMapper(testCase.PreferredOrder)
+		for _, kind := range testCase.KindsToRegister {
+			mapper.Add(kind, RESTScopeNamespace)
+		}
+
+		actualKinds, err := mapper.KindsFor(testCase.PartialResourceToRequest)
+		if err != nil {
+			t.Errorf("%s: unexpected error: %v", tcName, err)
+			continue
+		}
+		if !reflect.DeepEqual(testCase.ExpectedKinds, actualKinds) {
+			t.Errorf("%s: expected %v, got %v", tcName, testCase.ExpectedKinds, actualKinds)
+		}
+
+		singleKind, err := mapper.KindFor(testCase.PartialResourceToRequest)
+		if err == nil && len(testCase.ExpectedKindErr) != 0 {
+			t.Errorf("%s: expected error: %v", tcName, testCase.ExpectedKindErr)
+			continue
+		}
+		if err != nil {
+			if len(testCase.ExpectedKindErr) == 0 {
+				t.Errorf("%s: unexpected error: %v", tcName, err)
+				continue
+			} else {
+				if !strings.Contains(err.Error(), testCase.ExpectedKindErr) {
+					t.Errorf("%s: expected %v, got %v", tcName, testCase.ExpectedKindErr, err)
+					continue
+				}
+			}
+
+		} else {
+			if testCase.ExpectedKinds[0] != singleKind {
+				t.Errorf("%s: expected %v, got %v", tcName, testCase.ExpectedKinds[0], singleKind)
+			}
+
+		}
+	}
+}
+
+func TestRESTMapperResourcesFor(t *testing.T) {
+	testCases := []struct {
+		Name                             string
+		PreferredOrder                   []schema.GroupVersion
+		KindsToRegister                  []schema.GroupVersionKind
+		PluralPartialResourceToRequest   schema.GroupVersionResource
+		SingularPartialResourceToRequest schema.GroupVersionResource
+
+		ExpectedResources   []schema.GroupVersionResource
+		ExpectedResourceErr string
+	}{
+		{
+			// exact matches are preferred
+			Name: "groups, with group exact",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "first-group-1", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group-1", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+			PluralPartialResourceToRequest:   schema.GroupVersionResource{Group: "first-group", Resource: "my-kinds"},
+			SingularPartialResourceToRequest: schema.GroupVersionResource{Group: "first-group", Resource: "my-kind"},
+
+			ExpectedResources: []schema.GroupVersionResource{
+				{Group: "first-group", Version: "first-version", Resource: "my-kinds"},
+			},
+		},
+
+		{
+			// group prefixes work
+			Name: "groups, with group prefix",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "second-group", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+			},
+			PluralPartialResourceToRequest:   schema.GroupVersionResource{Group: "first", Resource: "my-kinds"},
+			SingularPartialResourceToRequest: schema.GroupVersionResource{Group: "first", Resource: "my-kind"},
+
+			ExpectedResources: []schema.GroupVersionResource{
+				{Group: "first-group", Version: "first-version", Resource: "my-kinds"},
+			},
+		},
+
+		{
+			// group prefixes can be ambiguous
+			Name: "groups, with ambiguous group prefix",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "first-group-1", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group-1", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+			PluralPartialResourceToRequest:   schema.GroupVersionResource{Group: "first", Resource: "my-kinds"},
+			SingularPartialResourceToRequest: schema.GroupVersionResource{Group: "first", Resource: "my-kind"},
+
+			ExpectedResources: []schema.GroupVersionResource{
+				{Group: "first-group-1", Version: "first-version", Resource: "my-kinds"},
+				{Group: "first-group", Version: "first-version", Resource: "my-kinds"},
+			},
+			ExpectedResourceErr: " matches multiple resources ",
+		},
+
+		{
+			Name: "ambiguous groups, with preference order",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "second-group", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "your-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "your-kind"},
+			},
+			PluralPartialResourceToRequest:   schema.GroupVersionResource{Resource: "my-kinds"},
+			SingularPartialResourceToRequest: schema.GroupVersionResource{Resource: "my-kind"},
+
+			ExpectedResources: []schema.GroupVersionResource{
+				{Group: "second-group", Version: "first-version", Resource: "my-kinds"},
+				{Group: "first-group", Version: "first-version", Resource: "my-kinds"},
+			},
+			ExpectedResourceErr: " matches multiple resources ",
+		},
+
+		{
+			Name: "ambiguous groups, with explicit group match",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "second-group", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "your-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "your-kind"},
+			},
+			PluralPartialResourceToRequest:   schema.GroupVersionResource{Group: "first-group", Resource: "my-kinds"},
+			SingularPartialResourceToRequest: schema.GroupVersionResource{Group: "first-group", Resource: "my-kind"},
+
+			ExpectedResources: []schema.GroupVersionResource{
+				{Group: "first-group", Version: "first-version", Resource: "my-kinds"},
+			},
+		},
+
+		{
+			Name: "ambiguous groups, with ambiguous version match",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "first-group", Version: "first-version"},
+				{Group: "second-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "your-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "your-kind"},
+			},
+			PluralPartialResourceToRequest:   schema.GroupVersionResource{Version: "first-version", Resource: "my-kinds"},
+			SingularPartialResourceToRequest: schema.GroupVersionResource{Version: "first-version", Resource: "my-kind"},
+
+			ExpectedResources: []schema.GroupVersionResource{
+				{Group: "first-group", Version: "first-version", Resource: "my-kinds"},
+				{Group: "second-group", Version: "first-version", Resource: "my-kinds"},
+			},
+			ExpectedResourceErr: " matches multiple resources ",
+		},
+	}
+	for _, testCase := range testCases {
+		tcName := testCase.Name
+
+		for _, partialResource := range []schema.GroupVersionResource{testCase.PluralPartialResourceToRequest, testCase.SingularPartialResourceToRequest} {
+			mapper := NewDefaultRESTMapper(testCase.PreferredOrder)
+			for _, kind := range testCase.KindsToRegister {
+				mapper.Add(kind, RESTScopeNamespace)
+			}
+
+			actualResources, err := mapper.ResourcesFor(partialResource)
+			if err != nil {
+				t.Errorf("%s: unexpected error: %v", tcName, err)
+				continue
+			}
+			if !reflect.DeepEqual(testCase.ExpectedResources, actualResources) {
+				t.Errorf("%s: expected %v, got %v", tcName, testCase.ExpectedResources, actualResources)
+			}
+
+			singleResource, err := mapper.ResourceFor(partialResource)
+			if err == nil && len(testCase.ExpectedResourceErr) != 0 {
+				t.Errorf("%s: expected error: %v", tcName, testCase.ExpectedResourceErr)
+				continue
+			}
+			if err != nil {
+				if len(testCase.ExpectedResourceErr) == 0 {
+					t.Errorf("%s: unexpected error: %v", tcName, err)
+					continue
+				} else {
+					if !strings.Contains(err.Error(), testCase.ExpectedResourceErr) {
+						t.Errorf("%s: expected %v, got %v", tcName, testCase.ExpectedResourceErr, err)
+						continue
+					}
+				}
+
+			} else {
+				if testCase.ExpectedResources[0] != singleResource {
+					t.Errorf("%s: expected %v, got %v", tcName, testCase.ExpectedResources[0], singleResource)
+				}
+
+			}
+		}
+	}
+}
+
+func TestKindToResource(t *testing.T) {
+	testCases := []struct {
+		Kind             string
+		Plural, Singular string
+	}{
+		{Kind: "Pod", Plural: "pods", Singular: "pod"},
+
+		{Kind: "ReplicationController", Plural: "replicationcontrollers", Singular: "replicationcontroller"},
+
+		// Add "ies" when ending with "y"
+		{Kind: "ImageRepository", Plural: "imagerepositories", Singular: "imagerepository"},
+		// Add "es" when ending with "s"
+		{Kind: "miss", Plural: "misses", Singular: "miss"},
+		// Add "s" otherwise
+		{Kind: "lowercase", Plural: "lowercases", Singular: "lowercase"},
+	}
+	for i, testCase := range testCases {
+		version := schema.GroupVersion{}
+
+		plural, singular := UnsafeGuessKindToResource(version.WithKind(testCase.Kind))
+		if singular != version.WithResource(testCase.Singular) || plural != version.WithResource(testCase.Plural) {
+			t.Errorf("%d: unexpected plural and singular: %v %v", i, plural, singular)
+		}
+	}
+}
+
+func TestRESTMapperResourceSingularizer(t *testing.T) {
+	testGroupVersion := schema.GroupVersion{Group: "tgroup", Version: "test"}
+
+	testCases := []struct {
+		Kind     string
+		Plural   string
+		Singular string
+	}{
+		{Kind: "Pod", Plural: "pods", Singular: "pod"},
+		{Kind: "ReplicationController", Plural: "replicationcontrollers", Singular: "replicationcontroller"},
+		{Kind: "ImageRepository", Plural: "imagerepositories", Singular: "imagerepository"},
+		{Kind: "Status", Plural: "statuses", Singular: "status"},
+
+		{Kind: "lowercase", Plural: "lowercases", Singular: "lowercase"},
+		// TODO this test is broken.  This updates to reflect actual behavior.  Kinds are expected to be singular
+		// old (incorrect), comment: Don't add extra s if the original object is already plural
+		{Kind: "lowercases", Plural: "lowercaseses", Singular: "lowercases"},
+	}
+	for i, testCase := range testCases {
+		mapper := NewDefaultRESTMapper([]schema.GroupVersion{testGroupVersion})
+		// create singular/plural mapping
+		mapper.Add(testGroupVersion.WithKind(testCase.Kind), RESTScopeNamespace)
+
+		singular, err := mapper.ResourceSingularizer(testCase.Plural)
+		if err != nil {
+			t.Errorf("%d: unexpected error: %v", i, err)
+		}
+		if singular != testCase.Singular {
+			t.Errorf("%d: mismatched singular: got %v, expected %v", i, singular, testCase.Singular)
+		}
+	}
+}
+
+func TestRESTMapperRESTMapping(t *testing.T) {
+	testGroup := "tgroup"
+	testGroupVersion := schema.GroupVersion{Group: testGroup, Version: "test"}
+	internalGroupVersion := schema.GroupVersion{Group: testGroup, Version: "test"}
+
+	testCases := []struct {
+		Kind             string
+		APIGroupVersions []schema.GroupVersion
+		DefaultVersions  []schema.GroupVersion
+
+		Resource             schema.GroupVersionResource
+		ExpectedGroupVersion *schema.GroupVersion
+		Err                  bool
+	}{
+		{Kind: "Unknown", Err: true},
+		{Kind: "InternalObject", Err: true},
+
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "Unknown", Err: true},
+
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "InternalObject", APIGroupVersions: []schema.GroupVersion{{Group: testGroup, Version: "test"}}, Resource: testGroupVersion.WithResource("internalobjects")},
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "InternalObject", APIGroupVersions: []schema.GroupVersion{{Group: testGroup, Version: "test"}}, Resource: testGroupVersion.WithResource("internalobjects")},
+
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "InternalObject", APIGroupVersions: []schema.GroupVersion{{Group: testGroup, Version: "test"}}, Resource: testGroupVersion.WithResource("internalobjects")},
+
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "InternalObject", APIGroupVersions: []schema.GroupVersion{}, Resource: internalGroupVersion.WithResource("internalobjects"), ExpectedGroupVersion: &schema.GroupVersion{Group: testGroup, Version: "test"}},
+
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "InternalObject", APIGroupVersions: []schema.GroupVersion{{Group: testGroup, Version: "test"}}, Resource: testGroupVersion.WithResource("internalobjects")},
+
+		// TODO: add test for a resource that exists in one version but not another
+	}
+	for i, testCase := range testCases {
+		mapper := NewDefaultRESTMapper(testCase.DefaultVersions)
+		mapper.Add(internalGroupVersion.WithKind("InternalObject"), RESTScopeNamespace)
+
+		preferredVersions := []string{}
+		for _, gv := range testCase.APIGroupVersions {
+			preferredVersions = append(preferredVersions, gv.Version)
+		}
+		gk := schema.GroupKind{Group: testGroup, Kind: testCase.Kind}
+
+		mapping, err := mapper.RESTMapping(gk, preferredVersions...)
+		hasErr := err != nil
+		if hasErr != testCase.Err {
+			t.Errorf("%d: unexpected error behavior %t: %v", i, testCase.Err, err)
+		}
+		if hasErr {
+			continue
+		}
+		if mapping.Resource != testCase.Resource {
+			t.Errorf("%d: unexpected resource: %#v", i, mapping)
+		}
+
+		groupVersion := testCase.ExpectedGroupVersion
+		if groupVersion == nil {
+			groupVersion = &testCase.APIGroupVersions[0]
+		}
+		if mapping.GroupVersionKind.GroupVersion() != *groupVersion {
+			t.Errorf("%d: unexpected version: %#v", i, mapping)
+		}
+
+	}
+}
+
+func TestRESTMapperRESTMappingSelectsVersion(t *testing.T) {
+	expectedGroupVersion1 := schema.GroupVersion{Group: "tgroup", Version: "test1"}
+	expectedGroupVersion2 := schema.GroupVersion{Group: "tgroup", Version: "test2"}
+	expectedGroupVersion3 := schema.GroupVersion{Group: "tgroup", Version: "test3"}
+	internalObjectGK := schema.GroupKind{Group: "tgroup", Kind: "InternalObject"}
+	otherObjectGK := schema.GroupKind{Group: "tgroup", Kind: "OtherObject"}
+
+	mapper := NewDefaultRESTMapper([]schema.GroupVersion{expectedGroupVersion1, expectedGroupVersion2})
+	mapper.Add(expectedGroupVersion1.WithKind("InternalObject"), RESTScopeNamespace)
+	mapper.Add(expectedGroupVersion2.WithKind("OtherObject"), RESTScopeNamespace)
+
+	// pick default matching object kind based on search order
+	mapping, err := mapper.RESTMapping(otherObjectGK)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if mapping.Resource != expectedGroupVersion2.WithResource("otherobjects") || mapping.GroupVersionKind.GroupVersion() != expectedGroupVersion2 {
+		t.Errorf("unexpected mapping: %#v", mapping)
+	}
+
+	mapping, err = mapper.RESTMapping(internalObjectGK)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if mapping.Resource != expectedGroupVersion1.WithResource("internalobjects") || mapping.GroupVersionKind.GroupVersion() != expectedGroupVersion1 {
+		t.Errorf("unexpected mapping: %#v", mapping)
+	}
+
+	// mismatch of version
+	_, err = mapper.RESTMapping(internalObjectGK, expectedGroupVersion2.Version)
+	if err == nil {
+		t.Errorf("unexpected non-error")
+	}
+	_, err = mapper.RESTMapping(otherObjectGK, expectedGroupVersion1.Version)
+	if err == nil {
+		t.Errorf("unexpected non-error")
+	}
+
+	// not in the search versions
+	_, err = mapper.RESTMapping(otherObjectGK, expectedGroupVersion3.Version)
+	if err == nil {
+		t.Errorf("unexpected non-error")
+	}
+
+	// explicit search order
+	_, err = mapper.RESTMapping(otherObjectGK, expectedGroupVersion3.Version, expectedGroupVersion1.Version)
+	if err == nil {
+		t.Errorf("unexpected non-error")
+	}
+
+	mapping, err = mapper.RESTMapping(otherObjectGK, expectedGroupVersion3.Version, expectedGroupVersion2.Version)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if mapping.Resource != expectedGroupVersion2.WithResource("otherobjects") || mapping.GroupVersionKind.GroupVersion() != expectedGroupVersion2 {
+		t.Errorf("unexpected mapping: %#v", mapping)
+	}
+}
+
+func TestRESTMapperRESTMappings(t *testing.T) {
+	testGroup := "tgroup"
+	testGroupVersion := schema.GroupVersion{Group: testGroup, Version: "v1"}
+
+	testCases := []struct {
+		Kind                string
+		APIGroupVersions    []schema.GroupVersion
+		DefaultVersions     []schema.GroupVersion
+		AddGroupVersionKind []schema.GroupVersionKind
+
+		ExpectedRESTMappings []*RESTMapping
+		Err                  bool
+	}{
+		{Kind: "Unknown", Err: true},
+		{Kind: "InternalObject", Err: true},
+
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "Unknown", Err: true},
+
+		// ask for specific version - not available - thus error
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "InternalObject", APIGroupVersions: []schema.GroupVersion{{Group: testGroup, Version: "v2"}}, Err: true},
+
+		// ask for specific version - available - check ExpectedRESTMappings
+		{
+			DefaultVersions:      []schema.GroupVersion{testGroupVersion},
+			Kind:                 "InternalObject",
+			APIGroupVersions:     []schema.GroupVersion{{Group: testGroup, Version: "v2"}},
+			AddGroupVersionKind:  []schema.GroupVersionKind{schema.GroupVersion{Group: testGroup, Version: "v2"}.WithKind("InternalObject")},
+			ExpectedRESTMappings: []*RESTMapping{{Resource: schema.GroupVersionResource{Group: testGroup, Version: "v2", Resource: "internalobjects"}, GroupVersionKind: schema.GroupVersionKind{Group: testGroup, Version: "v2", Kind: "InternalObject"}}},
+		},
+
+		// ask for specific versions - only one available - check ExpectedRESTMappings
+		{
+			DefaultVersions:      []schema.GroupVersion{testGroupVersion},
+			Kind:                 "InternalObject",
+			APIGroupVersions:     []schema.GroupVersion{{Group: testGroup, Version: "v3"}, {Group: testGroup, Version: "v2"}},
+			AddGroupVersionKind:  []schema.GroupVersionKind{schema.GroupVersion{Group: testGroup, Version: "v2"}.WithKind("InternalObject")},
+			ExpectedRESTMappings: []*RESTMapping{{Resource: schema.GroupVersionResource{Group: testGroup, Version: "v2", Resource: "internalobjects"}, GroupVersionKind: schema.GroupVersionKind{Group: testGroup, Version: "v2", Kind: "InternalObject"}}},
+		},
+
+		// do not ask for specific version - search through default versions - check ExpectedRESTMappings
+		{
+			DefaultVersions:     []schema.GroupVersion{testGroupVersion, {Group: testGroup, Version: "v2"}},
+			Kind:                "InternalObject",
+			AddGroupVersionKind: []schema.GroupVersionKind{schema.GroupVersion{Group: testGroup, Version: "v1"}.WithKind("InternalObject"), schema.GroupVersion{Group: testGroup, Version: "v2"}.WithKind("InternalObject")},
+			ExpectedRESTMappings: []*RESTMapping{
+				{
+					Resource:         schema.GroupVersionResource{Group: testGroup, Version: "v1", Resource: "internalobjects"},
+					GroupVersionKind: schema.GroupVersionKind{Group: testGroup, Version: "v1", Kind: "InternalObject"},
+				},
+				{
+					Resource:         schema.GroupVersionResource{Group: testGroup, Version: "v2", Resource: "internalobjects"},
+					GroupVersionKind: schema.GroupVersionKind{Group: testGroup, Version: "v2", Kind: "InternalObject"},
+				},
+			},
+		},
+	}
+
+	for i, testCase := range testCases {
+		mapper := NewDefaultRESTMapper(testCase.DefaultVersions)
+		for _, gvk := range testCase.AddGroupVersionKind {
+			mapper.Add(gvk, RESTScopeNamespace)
+		}
+
+		preferredVersions := []string{}
+		for _, gv := range testCase.APIGroupVersions {
+			preferredVersions = append(preferredVersions, gv.Version)
+		}
+		gk := schema.GroupKind{Group: testGroup, Kind: testCase.Kind}
+
+		mappings, err := mapper.RESTMappings(gk, preferredVersions...)
+		hasErr := err != nil
+		if hasErr != testCase.Err {
+			t.Errorf("%d: unexpected error behavior %t: %v", i, testCase.Err, err)
+		}
+		if hasErr {
+			continue
+		}
+		if len(mappings) != len(testCase.ExpectedRESTMappings) {
+			t.Errorf("%d: unexpected number = %d of rest mappings was returned, expected = %d", i, len(mappings), len(testCase.ExpectedRESTMappings))
+		}
+		for j, mapping := range mappings {
+			exp := testCase.ExpectedRESTMappings[j]
+			if mapping.Resource != exp.Resource {
+				t.Errorf("%d - %d: unexpected resource: %#v", i, j, mapping)
+			}
+			if mapping.GroupVersionKind != exp.GroupVersionKind {
+				t.Errorf("%d - %d: unexpected GroupVersionKind: %#v", i, j, mapping)
+			}
+		}
+	}
+}
+
+func TestRESTMapperReportsErrorOnBadVersion(t *testing.T) {
+	expectedGroupVersion1 := schema.GroupVersion{Group: "tgroup", Version: "test1"}
+	expectedGroupVersion2 := schema.GroupVersion{Group: "tgroup", Version: "test2"}
+	internalObjectGK := schema.GroupKind{Group: "tgroup", Kind: "InternalObject"}
+
+	mapper := NewDefaultRESTMapper([]schema.GroupVersion{expectedGroupVersion1, expectedGroupVersion2})
+	mapper.Add(expectedGroupVersion1.WithKind("InternalObject"), RESTScopeNamespace)
+	_, err := mapper.RESTMapping(internalObjectGK, "test3")
+	if err == nil {
+		t.Errorf("unexpected non-error")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/table/table.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/table/table.go
new file mode 100644
index 0000000000..1887f32626
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/table/table.go
@@ -0,0 +1,70 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package table
+
+import (
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/duration"
+)
+
+// MetaToTableRow converts a list or object into one or more table rows. The provided rowFn is invoked for
+// each accessed item, with name and age being passed to each.
+func MetaToTableRow(obj runtime.Object, rowFn func(obj runtime.Object, m metav1.Object, name, age string) ([]interface{}, error)) ([]metav1.TableRow, error) {
+	if meta.IsListType(obj) {
+		rows := make([]metav1.TableRow, 0, 16)
+		err := meta.EachListItem(obj, func(obj runtime.Object) error {
+			nestedRows, err := MetaToTableRow(obj, rowFn)
+			if err != nil {
+				return err
+			}
+			rows = append(rows, nestedRows...)
+			return nil
+		})
+		if err != nil {
+			return nil, err
+		}
+		return rows, nil
+	}
+
+	rows := make([]metav1.TableRow, 0, 1)
+	m, err := meta.Accessor(obj)
+	if err != nil {
+		return nil, err
+	}
+	row := metav1.TableRow{
+		Object: runtime.RawExtension{Object: obj},
+	}
+	row.Cells, err = rowFn(obj, m, m.GetName(), ConvertToHumanReadableDateType(m.GetCreationTimestamp()))
+	if err != nil {
+		return nil, err
+	}
+	rows = append(rows, row)
+	return rows, nil
+}
+
+// ConvertToHumanReadableDateType returns the elapsed time since timestamp in
+// human-readable approximation.
+func ConvertToHumanReadableDateType(timestamp metav1.Time) string {
+	if timestamp.IsZero() {
+		return "<unknown>"
+	}
+	return duration.HumanDuration(time.Since(timestamp.Time))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/testrestmapper/test_restmapper.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/testrestmapper/test_restmapper.go
new file mode 100644
index 0000000000..72c6438cb6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/meta/testrestmapper/test_restmapper.go
@@ -0,0 +1,165 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testrestmapper
+
+import (
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// TestOnlyStaticRESTMapper returns a union RESTMapper of all known types with priorities chosen in the following order:
+//  1. legacy kube group preferred version, extensions preferred version, metrics preferred version, legacy
+//     kube any version, extensions any version, metrics any version, all other groups alphabetical preferred version,
+//     all other groups alphabetical.
+//
+// TODO callers of this method should be updated to build their own specific restmapper based on their scheme for their tests
+// TODO the things being tested are related to whether various cases are handled, not tied to the particular types being checked.
+func TestOnlyStaticRESTMapper(scheme *runtime.Scheme, versionPatterns ...schema.GroupVersion) meta.RESTMapper {
+	unionMapper := meta.MultiRESTMapper{}
+	unionedGroups := sets.NewString()
+	for _, enabledVersion := range scheme.PrioritizedVersionsAllGroups() {
+		if !unionedGroups.Has(enabledVersion.Group) {
+			unionedGroups.Insert(enabledVersion.Group)
+			unionMapper = append(unionMapper, newRESTMapper(enabledVersion.Group, scheme))
+		}
+	}
+
+	if len(versionPatterns) != 0 {
+		resourcePriority := []schema.GroupVersionResource{}
+		kindPriority := []schema.GroupVersionKind{}
+		for _, versionPriority := range versionPatterns {
+			resourcePriority = append(resourcePriority, versionPriority.WithResource(meta.AnyResource))
+			kindPriority = append(kindPriority, versionPriority.WithKind(meta.AnyKind))
+		}
+
+		return meta.PriorityRESTMapper{Delegate: unionMapper, ResourcePriority: resourcePriority, KindPriority: kindPriority}
+	}
+
+	prioritizedGroups := []string{"", "extensions", "metrics"}
+	resourcePriority, kindPriority := prioritiesForGroups(scheme, prioritizedGroups...)
+
+	prioritizedGroupsSet := sets.NewString(prioritizedGroups...)
+	remainingGroups := sets.String{}
+	for _, enabledVersion := range scheme.PrioritizedVersionsAllGroups() {
+		if !prioritizedGroupsSet.Has(enabledVersion.Group) {
+			remainingGroups.Insert(enabledVersion.Group)
+		}
+	}
+
+	remainingResourcePriority, remainingKindPriority := prioritiesForGroups(scheme, remainingGroups.List()...)
+	resourcePriority = append(resourcePriority, remainingResourcePriority...)
+	kindPriority = append(kindPriority, remainingKindPriority...)
+
+	return meta.PriorityRESTMapper{Delegate: unionMapper, ResourcePriority: resourcePriority, KindPriority: kindPriority}
+}
+
+// prioritiesForGroups returns the resource and kind priorities for a PriorityRESTMapper, preferring the preferred version of each group first,
+// then any non-preferred version of the group second.
+func prioritiesForGroups(scheme *runtime.Scheme, groups ...string) ([]schema.GroupVersionResource, []schema.GroupVersionKind) {
+	resourcePriority := []schema.GroupVersionResource{}
+	kindPriority := []schema.GroupVersionKind{}
+
+	for _, group := range groups {
+		availableVersions := scheme.PrioritizedVersionsForGroup(group)
+		if len(availableVersions) > 0 {
+			resourcePriority = append(resourcePriority, availableVersions[0].WithResource(meta.AnyResource))
+			kindPriority = append(kindPriority, availableVersions[0].WithKind(meta.AnyKind))
+		}
+	}
+	for _, group := range groups {
+		resourcePriority = append(resourcePriority, schema.GroupVersionResource{Group: group, Version: meta.AnyVersion, Resource: meta.AnyResource})
+		kindPriority = append(kindPriority, schema.GroupVersionKind{Group: group, Version: meta.AnyVersion, Kind: meta.AnyKind})
+	}
+
+	return resourcePriority, kindPriority
+}
+
+func newRESTMapper(group string, scheme *runtime.Scheme) meta.RESTMapper {
+	mapper := meta.NewDefaultRESTMapper(scheme.PrioritizedVersionsForGroup(group))
+	for _, gv := range scheme.PrioritizedVersionsForGroup(group) {
+		for kind := range scheme.KnownTypes(gv) {
+			if ignoredKinds.Has(kind) {
+				continue
+			}
+			scope := meta.RESTScopeNamespace
+			if rootScopedKinds[gv.WithKind(kind).GroupKind()] {
+				scope = meta.RESTScopeRoot
+			}
+			mapper.Add(gv.WithKind(kind), scope)
+		}
+	}
+
+	return mapper
+}
+
+// hardcoded is good enough for the test we're running
+var rootScopedKinds = map[schema.GroupKind]bool{
+	{Group: "admission.k8s.io", Kind: "AdmissionReview"}: true,
+
+	{Group: "admissionregistration.k8s.io", Kind: "ValidatingWebhookConfiguration"}: true,
+	{Group: "admissionregistration.k8s.io", Kind: "MutatingWebhookConfiguration"}:   true,
+
+	{Group: "authentication.k8s.io", Kind: "TokenReview"}: true,
+
+	{Group: "authorization.k8s.io", Kind: "SubjectAccessReview"}:     true,
+	{Group: "authorization.k8s.io", Kind: "SelfSubjectAccessReview"}: true,
+	{Group: "authorization.k8s.io", Kind: "SelfSubjectRulesReview"}:  true,
+
+	{Group: "certificates.k8s.io", Kind: "CertificateSigningRequest"}: true,
+
+	{Group: "", Kind: "Node"}:             true,
+	{Group: "", Kind: "Namespace"}:        true,
+	{Group: "", Kind: "PersistentVolume"}: true,
+	{Group: "", Kind: "ComponentStatus"}:  true,
+
+	{Group: "rbac.authorization.k8s.io", Kind: "ClusterRole"}:        true,
+	{Group: "rbac.authorization.k8s.io", Kind: "ClusterRoleBinding"}: true,
+
+	{Group: "scheduling.k8s.io", Kind: "PriorityClass"}: true,
+
+	{Group: "storage.k8s.io", Kind: "StorageClass"}:     true,
+	{Group: "storage.k8s.io", Kind: "VolumeAttachment"}: true,
+
+	{Group: "apiextensions.k8s.io", Kind: "CustomResourceDefinition"}: true,
+
+	{Group: "apiserver.k8s.io", Kind: "AdmissionConfiguration"}: true,
+
+	{Group: "audit.k8s.io", Kind: "Event"}:  true,
+	{Group: "audit.k8s.io", Kind: "Policy"}: true,
+
+	{Group: "apiregistration.k8s.io", Kind: "APIService"}: true,
+
+	{Group: "metrics.k8s.io", Kind: "NodeMetrics"}: true,
+
+	{Group: "wardle.example.com", Kind: "Fischer"}: true,
+}
+
+// hardcoded is good enough for the test we're running
+var ignoredKinds = sets.NewString(
+	"ListOptions",
+	"DeleteOptions",
+	"Status",
+	"PodLogOptions",
+	"PodExecOptions",
+	"PodAttachOptions",
+	"PodPortForwardOptions",
+	"PodProxyOptions",
+	"NodeProxyOptions",
+	"ServiceProxyOptions",
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/operation/operation.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/operation/operation.go
new file mode 100644
index 0000000000..cccc7e60c2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/operation/operation.go
@@ -0,0 +1,100 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package operation
+
+import (
+	"strings"
+)
+
+// Operation provides contextual information about a validation request and the API
+// operation being validated.
+// This type is intended for use with generate validation code and may be enhanced
+// in the future to include other information needed to validate requests.
+type Operation struct {
+	// Type is the category of operation being validated.  This does not
+	// differentiate between HTTP verbs like PUT and PATCH, but rather merges
+	// those into a single "Update" category.
+	Type Type
+
+	// Options are the validation options in effect for this operation, mapping option
+	// name to whether it is enabled. Option names typically match feature gates, but an
+	// option may be enabled even when its feature gate is off — e.g. when the feature is
+	// already in use by the object being updated. Set by the resource strategy and
+	// read-only during validation.
+	//
+	// Every option a validation tag references must be defined here by the strategy; an
+	// option that is not defined is a programming error (see HasOption).
+	Options map[string]bool
+
+	// Request provides information about the request being validated.
+	Request Request
+}
+
+// HasOption returns whether the named option is enabled and whether it was defined by
+// the strategy. Every option a validation tag references must be defined; callers treat
+// an undefined option as an internal error (see validate.IfOption) rather than silently
+// as disabled.
+func (o Operation) HasOption(option string) (enabled, defined bool) {
+	enabled, defined = o.Options[option]
+	return
+}
+
+// Request provides information about the request being validated.
+type Request struct {
+	// Subresources identifies the subresource path components of the request. For
+	// example, Subresources for a request to `/api/v1/pods/my-pod/status` would be
+	// `["status"]`. For `/api/v1/widget/my-widget/x/y/z`, it would be `["x", "y",
+	// "z"]`. For a root resource (`/api/v1/pods/my-pod`), Subresources will be an
+	// empty slice.
+	//
+	// Validation logic should only consult this field if the validation rules for a
+	// particular field differ depending on whether the main resource or a specific
+	// subresource is being accessed. For example:
+	//
+	// Updates to a Pod resource (`/`) normally cannot change container resource
+	// requests/limits after the Pod is created (they are immutable). However, when
+	// accessing the Pod's "resize" subresource (`/resize`), these specific fields
+	// are allowed to be modified. In this scenario, the validation logic for
+	// `spec.container[*].resources` must check `Subresources` to permit changes only
+	// when the request targets the "resize" subresource.
+	//
+	// Note: This field should not be used to control which fields a subresource
+	// operation is allowed to write. This is the responsibility of "field wiping".
+	// Field wiping logic is expected to be handled in resource strategies by
+	// modifying the incoming object before it is validated.
+	Subresources []string
+}
+
+// SubresourcePath returns the path is a slash-separated list of subresource
+// names. For example, `/status`, `/resize`, or `/x/y/z`.
+func (r Request) SubresourcePath() string {
+	if len(r.Subresources) == 0 {
+		return "/"
+	}
+	return "/" + strings.Join(r.Subresources, "/")
+}
+
+// Code is the request operation to be validated.
+type Type uint32
+
+const (
+	// Create indicates the request being validated is for a resource create operation.
+	Create Type = iota
+
+	// Update indicates the request being validated is for a resource update operation.
+	Update
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/OWNERS b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/OWNERS
new file mode 100644
index 0000000000..063fd285da
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/OWNERS
@@ -0,0 +1,10 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+reviewers:
+  - thockin
+  - smarterclayton
+  - wojtek-t
+  - derekwaynecarr
+  - mikedanese
+  - saad-ali
+  - janetkuo
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/amount.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/amount.go
new file mode 100644
index 0000000000..2eebec667d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/amount.go
@@ -0,0 +1,337 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"math/big"
+	"strconv"
+
+	inf "gopkg.in/inf.v0"
+)
+
+// Scale is used for getting and setting the base-10 scaled value.
+// Base-2 scales are omitted for mathematical simplicity.
+// See Quantity.ScaledValue for more details.
+type Scale int32
+
+// infScale adapts a Scale value to an inf.Scale value.
+func (s Scale) infScale() inf.Scale {
+	return inf.Scale(-s) // inf.Scale is upside-down
+}
+
+const (
+	Nano  Scale = -9
+	Micro Scale = -6
+	Milli Scale = -3
+	Kilo  Scale = 3
+	Mega  Scale = 6
+	Giga  Scale = 9
+	Tera  Scale = 12
+	Peta  Scale = 15
+	Exa   Scale = 18
+)
+
+var (
+	Zero = int64Amount{}
+
+	// Used by quantity strings - treat as read only
+	zeroBytes = []byte("0")
+)
+
+// int64Amount represents a fixed precision numerator and arbitrary scale exponent. It is faster
+// than operations on inf.Dec for values that can be represented as int64.
+// +k8s:openapi-gen=true
+type int64Amount struct {
+	value int64
+	scale Scale
+}
+
+// Sign returns 0 if the value is zero, -1 if it is less than 0, or 1 if it is greater than 0.
+func (a int64Amount) Sign() int {
+	switch {
+	case a.value == 0:
+		return 0
+	case a.value > 0:
+		return 1
+	default:
+		return -1
+	}
+}
+
+// AsInt64 returns the current amount as an int64 at scale 0, or false if the value cannot be
+// represented in an int64 OR would result in a loss of precision. This method is intended as
+// an optimization to avoid calling AsDec.
+func (a int64Amount) AsInt64() (int64, bool) {
+	if a.scale == 0 {
+		return a.value, true
+	}
+	if a.scale < 0 {
+		// TODO: attempt to reduce factors, although it is assumed that factors are reduced prior
+		// to the int64Amount being created.
+		return 0, false
+	}
+	return positiveScaleInt64(a.value, a.scale)
+}
+
+// AsScaledInt64 returns an int64 representing the value of this amount at the specified scale,
+// rounding up, or false if that would result in overflow. (1e20).AsScaledInt64(1) would result
+// in overflow because 1e19 is not representable as an int64. Note that setting a scale larger
+// than the current value may result in loss of precision - i.e. (1e-6).AsScaledInt64(0) would
+// return 1, because 0.000001 is rounded up to 1.
+func (a int64Amount) AsScaledInt64(scale Scale) (result int64, ok bool) {
+	if a.scale < scale {
+		result, _ = negativeScaleInt64(a.value, scale-a.scale)
+		return result, true
+	}
+	return positiveScaleInt64(a.value, a.scale-scale)
+}
+
+// AsDec returns an inf.Dec representation of this value.
+func (a int64Amount) AsDec() *inf.Dec {
+	var base inf.Dec
+	base.SetUnscaled(a.value)
+	base.SetScale(inf.Scale(-a.scale))
+	return &base
+}
+
+// Cmp returns 0 if a and b are equal, 1 if a is greater than b, or -1 if a is less than b.
+func (a int64Amount) Cmp(b int64Amount) int {
+	switch {
+	case a.scale == b.scale:
+		// compare only the unscaled portion
+	case a.scale > b.scale:
+		result, remainder, exact := divideByScaleInt64(b.value, a.scale-b.scale)
+		if !exact {
+			return a.AsDec().Cmp(b.AsDec())
+		}
+		if result == a.value {
+			switch {
+			case remainder == 0:
+				return 0
+			case remainder > 0:
+				return -1
+			default:
+				return 1
+			}
+		}
+		b.value = result
+	default:
+		result, remainder, exact := divideByScaleInt64(a.value, b.scale-a.scale)
+		if !exact {
+			return a.AsDec().Cmp(b.AsDec())
+		}
+		if result == b.value {
+			switch {
+			case remainder == 0:
+				return 0
+			case remainder > 0:
+				return 1
+			default:
+				return -1
+			}
+		}
+		a.value = result
+	}
+
+	switch {
+	case a.value == b.value:
+		return 0
+	case a.value < b.value:
+		return -1
+	default:
+		return 1
+	}
+}
+
+// Add adds two int64Amounts together, matching scales. It will return false and not mutate
+// a if overflow or underflow would result.
+func (a *int64Amount) Add(b int64Amount) bool {
+	switch {
+	case b.value == 0:
+		return true
+	case a.value == 0:
+		a.value = b.value
+		a.scale = b.scale
+		return true
+	case a.scale == b.scale:
+		c, ok := int64Add(a.value, b.value)
+		if !ok {
+			return false
+		}
+		a.value = c
+	case a.scale > b.scale:
+		c, ok := positiveScaleInt64(a.value, a.scale-b.scale)
+		if !ok {
+			return false
+		}
+		c, ok = int64Add(c, b.value)
+		if !ok {
+			return false
+		}
+		a.scale = b.scale
+		a.value = c
+	default:
+		c, ok := positiveScaleInt64(b.value, b.scale-a.scale)
+		if !ok {
+			return false
+		}
+		c, ok = int64Add(a.value, c)
+		if !ok {
+			return false
+		}
+		a.value = c
+	}
+	return true
+}
+
+// Sub removes the value of b from the current amount, or returns false if underflow would result.
+func (a *int64Amount) Sub(b int64Amount) bool {
+	return a.Add(int64Amount{value: -b.value, scale: b.scale})
+}
+
+// Mul multiplies the provided b to the current amount, or
+// returns false if overflow or underflow would result.
+func (a *int64Amount) Mul(b int64) bool {
+	switch {
+	case a.value == 0:
+		return true
+	case b == 0:
+		a.value = 0
+		a.scale = 0
+		return true
+	case a.scale == 0:
+		c, ok := int64Multiply(a.value, b)
+		if !ok {
+			return false
+		}
+		a.value = c
+	case a.scale > 0:
+		c, ok := int64Multiply(a.value, b)
+		if !ok {
+			return false
+		}
+		if _, ok = positiveScaleInt64(c, a.scale); !ok {
+			return false
+		}
+		a.value = c
+	default:
+		c, ok := int64Multiply(a.value, b)
+		if !ok {
+			return false
+		}
+		if _, ok = negativeScaleInt64(c, -a.scale); !ok {
+			return false
+		}
+		a.value = c
+	}
+	return true
+}
+
+// AsScale adjusts this amount to set a minimum scale, rounding up, and returns true iff no precision
+// was lost. (1.1e5).AsScale(5) would return 1.1e5, but (1.1e5).AsScale(6) would return 1e6.
+func (a int64Amount) AsScale(scale Scale) (int64Amount, bool) {
+	if a.scale >= scale {
+		return a, true
+	}
+	result, exact := negativeScaleInt64(a.value, scale-a.scale)
+	return int64Amount{value: result, scale: scale}, exact
+}
+
+// AsCanonicalBytes accepts a buffer to write the base-10 string value of this field to, and returns
+// either that buffer or a larger buffer and the current exponent of the value. The value is adjusted
+// until the exponent is a multiple of 3 - i.e. 1.1e5 would return "110", 3.
+func (a int64Amount) AsCanonicalBytes(out []byte) (result []byte, exponent int32) {
+	mantissa := a.value
+	exponent = int32(a.scale)
+
+	amount, times := removeInt64Factors(mantissa, 10)
+	exponent += int32(times)
+
+	// make sure exponent is a multiple of 3
+	var ok bool
+	switch exponent % 3 {
+	case 1, -2:
+		amount, ok = int64MultiplyScale10(amount)
+		if !ok {
+			return infDecAmount{a.AsDec()}.AsCanonicalBytes(out)
+		}
+		exponent = exponent - 1
+	case 2, -1:
+		amount, ok = int64MultiplyScale100(amount)
+		if !ok {
+			return infDecAmount{a.AsDec()}.AsCanonicalBytes(out)
+		}
+		exponent = exponent - 2
+	}
+	return strconv.AppendInt(out, amount, 10), exponent
+}
+
+// AsCanonicalBase1024Bytes accepts a buffer to write the base-1024 string value of this field to, and returns
+// either that buffer or a larger buffer and the current exponent of the value. 2048 is 2 * 1024 ^ 1 and would
+// return []byte("2048"), 1.
+func (a int64Amount) AsCanonicalBase1024Bytes(out []byte) (result []byte, exponent int32) {
+	value, ok := a.AsScaledInt64(0)
+	if !ok {
+		return infDecAmount{a.AsDec()}.AsCanonicalBase1024Bytes(out)
+	}
+	amount, exponent := removeInt64Factors(value, 1024)
+	return strconv.AppendInt(out, amount, 10), exponent
+}
+
+// infDecAmount implements common operations over an inf.Dec that are specific to the quantity
+// representation.
+type infDecAmount struct {
+	*inf.Dec
+}
+
+// AsScale adjusts this amount to set a minimum scale, rounding up, and returns true iff no precision
+// was lost. (1.1e5).AsScale(5) would return 1.1e5, but (1.1e5).AsScale(6) would return 1e6.
+func (a infDecAmount) AsScale(scale Scale) (infDecAmount, bool) {
+	tmp := &inf.Dec{}
+	tmp.Round(a.Dec, scale.infScale(), inf.RoundUp)
+	return infDecAmount{tmp}, tmp.Cmp(a.Dec) == 0
+}
+
+// AsCanonicalBytes accepts a buffer to write the base-10 string value of this field to, and returns
+// either that buffer or a larger buffer and the current exponent of the value. The value is adjusted
+// until the exponent is a multiple of 3 - i.e. 1.1e5 would return "110", 3.
+func (a infDecAmount) AsCanonicalBytes(out []byte) (result []byte, exponent int32) {
+	mantissa := a.Dec.UnscaledBig()
+	exponent = int32(-a.Dec.Scale())
+	amount := big.NewInt(0).Set(mantissa)
+	// move all factors of 10 into the exponent for easy reasoning
+	amount, times := removeBigIntFactors(amount, bigTen)
+	exponent += times
+
+	// make sure exponent is a multiple of 3
+	for exponent%3 != 0 {
+		amount.Mul(amount, bigTen)
+		exponent--
+	}
+
+	return append(out, amount.String()...), exponent
+}
+
+// AsCanonicalBase1024Bytes accepts a buffer to write the base-1024 string value of this field to, and returns
+// either that buffer or a larger buffer and the current exponent of the value. 2048 is 2 * 1024 ^ 1 and would
+// return []byte("2048"), 1.
+func (a infDecAmount) AsCanonicalBase1024Bytes(out []byte) (result []byte, exponent int32) {
+	tmp := &inf.Dec{}
+	tmp.Round(a.Dec, 0, inf.RoundUp)
+	amount, exponent := removeBigIntFactors(tmp.UnscaledBig(), big1024)
+	return append(out, amount.String()...), exponent
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/amount_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/amount_test.go
new file mode 100644
index 0000000000..a6c4054b98
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/amount_test.go
@@ -0,0 +1,205 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"testing"
+)
+
+func TestInt64AmountAsInt64(t *testing.T) {
+	for _, test := range []struct {
+		value  int64
+		scale  Scale
+		result int64
+		ok     bool
+	}{
+		{100, 0, 100, true},
+		{100, 1, 1000, true},
+		{100, -5, 0, false},
+		{100, 100, 0, false},
+	} {
+		r, ok := int64Amount{value: test.value, scale: test.scale}.AsInt64()
+		if r != test.result {
+			t.Errorf("%v: unexpected result: %d", test, r)
+		}
+		if ok != test.ok {
+			t.Errorf("%v: unexpected ok: %t", test, ok)
+		}
+	}
+}
+
+func TestInt64AmountAdd(t *testing.T) {
+	for _, test := range []struct {
+		a, b, c int64Amount
+		ok      bool
+	}{
+		{int64Amount{value: 100, scale: 1}, int64Amount{value: 10, scale: 2}, int64Amount{value: 200, scale: 1}, true},
+		{int64Amount{value: 100, scale: 1}, int64Amount{value: 1, scale: 2}, int64Amount{value: 110, scale: 1}, true},
+		{int64Amount{value: 100, scale: 1}, int64Amount{value: 1, scale: 100}, int64Amount{value: 1, scale: 100}, false},
+		{int64Amount{value: -5, scale: 2}, int64Amount{value: 50, scale: 1}, int64Amount{value: 0, scale: 1}, true},
+		{int64Amount{value: -5, scale: 2}, int64Amount{value: 5, scale: 2}, int64Amount{value: 0, scale: 2}, true},
+
+		{int64Amount{value: mostPositive, scale: -1}, int64Amount{value: 1, scale: -1}, int64Amount{value: 0, scale: -1}, false},
+		{int64Amount{value: mostPositive, scale: -1}, int64Amount{value: 0, scale: -1}, int64Amount{value: mostPositive, scale: -1}, true},
+		{int64Amount{value: mostPositive / 10, scale: 1}, int64Amount{value: 10, scale: 0}, int64Amount{value: mostPositive, scale: -1}, false},
+	} {
+		c := test.a
+		ok := c.Add(test.b)
+		if ok != test.ok {
+			t.Errorf("%v: unexpected ok: %t", test, ok)
+		}
+		if ok {
+			if c != test.c {
+				t.Errorf("%v: unexpected result: %d", test, c)
+			}
+		} else {
+			if c != test.a {
+				t.Errorf("%v: overflow addition mutated source: %d", test, c)
+			}
+		}
+
+		// addition is commutative
+		c = test.b
+		if ok := c.Add(test.a); ok != test.ok {
+			t.Errorf("%v: unexpected ok: %t", test, ok)
+		}
+		if ok {
+			if c != test.c {
+				t.Errorf("%v: unexpected result: %d", test, c)
+			}
+		} else {
+			if c != test.b {
+				t.Errorf("%v: overflow addition mutated source: %d", test, c)
+			}
+		}
+	}
+}
+
+func TestInt64AmountMul(t *testing.T) {
+	for _, test := range []struct {
+		a  int64Amount
+		b  int64
+		c  int64Amount
+		ok bool
+	}{
+		{int64Amount{value: 100, scale: 1}, 1000, int64Amount{value: 100000, scale: 1}, true},
+		{int64Amount{value: 100, scale: -1}, 1000, int64Amount{value: 100000, scale: -1}, true},
+		{int64Amount{value: 1, scale: 100}, 10, int64Amount{value: 1, scale: 100}, false},
+		{int64Amount{value: 1, scale: -100}, 10, int64Amount{value: 1, scale: -100}, false},
+		{int64Amount{value: -5, scale: 2}, 500, int64Amount{value: -2500, scale: 2}, true},
+		{int64Amount{value: -5, scale: -2}, 500, int64Amount{value: -2500, scale: -2}, true},
+		{int64Amount{value: 0, scale: 1}, 0, int64Amount{value: 0, scale: 1}, true},
+
+		{int64Amount{value: mostPositive, scale: -1}, 10, int64Amount{value: mostPositive, scale: -1}, false},
+		{int64Amount{value: mostPositive, scale: -1}, 0, int64Amount{value: 0, scale: 0}, true},
+		{int64Amount{value: mostPositive, scale: 0}, 1, int64Amount{value: mostPositive, scale: 0}, true},
+		{int64Amount{value: mostPositive / 10, scale: 1}, 10, int64Amount{value: mostPositive / 10, scale: 1}, false},
+		{int64Amount{value: mostPositive, scale: 0}, -1, int64Amount{value: -mostPositive, scale: 0}, true},
+		{int64Amount{value: mostNegative, scale: 0}, 1, int64Amount{value: mostNegative, scale: 0}, true},
+		{int64Amount{value: mostNegative, scale: 1}, 0, int64Amount{value: 0, scale: 0}, true},
+		{int64Amount{value: mostNegative, scale: 1}, 1, int64Amount{value: mostNegative, scale: 1}, false},
+	} {
+		c := test.a
+		ok := c.Mul(test.b)
+		if ok && !test.ok {
+			t.Errorf("unextected success: %v", c)
+		} else if !ok && test.ok {
+			t.Errorf("unexpeted failure: %v", c)
+		} else if ok {
+			if c != test.c {
+				t.Errorf("%v: unexpected result: %d", test, c)
+			}
+		} else {
+			if c != test.a {
+				t.Errorf("%v: overflow multiplication mutated source: %d", test, c)
+			}
+		}
+	}
+}
+
+func TestInt64AsCanonicalString(t *testing.T) {
+	for _, test := range []struct {
+		value    int64
+		scale    Scale
+		result   string
+		exponent int32
+	}{
+		{100, 0, "100", 0},
+		{100, 1, "1", 3},
+		{100, -1, "10", 0},
+		{10800, -10, "1080", -9},
+	} {
+		r, exp := int64Amount{value: test.value, scale: test.scale}.AsCanonicalBytes(nil)
+		if string(r) != test.result {
+			t.Errorf("%v: unexpected result: %s", test, r)
+		}
+		if exp != test.exponent {
+			t.Errorf("%v: unexpected exponent: %d", test, exp)
+		}
+	}
+}
+
+func TestAmountSign(t *testing.T) {
+	table := []struct {
+		i      int64Amount
+		expect int
+	}{
+		{int64Amount{value: -50, scale: 1}, -1},
+		{int64Amount{value: 0, scale: 1}, 0},
+		{int64Amount{value: 300, scale: 1}, 1},
+		{int64Amount{value: -50, scale: -8}, -1},
+		{int64Amount{value: 50, scale: -8}, 1},
+		{int64Amount{value: 0, scale: -8}, 0},
+		{int64Amount{value: -50, scale: 0}, -1},
+		{int64Amount{value: 50, scale: 0}, 1},
+		{int64Amount{value: 0, scale: 0}, 0},
+	}
+	for _, testCase := range table {
+		if result := testCase.i.Sign(); result != testCase.expect {
+			t.Errorf("i: %v, Expected: %v, Actual: %v", testCase.i, testCase.expect, result)
+		}
+	}
+}
+
+func TestInt64AmountAsScaledInt64(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		i      int64Amount
+		scaled Scale
+		result int64
+		ok     bool
+	}{
+		{"test when i.scale < scaled ", int64Amount{value: 100, scale: 0}, 5, 1, true},
+		{"test when i.scale = scaled", int64Amount{value: 100, scale: 1}, 1, 100, true},
+		{"test when i.scale > scaled and result doesn't overflow", int64Amount{value: 100, scale: 5}, 2, 100000, true},
+		{"test when i.scale > scaled and result overflows", int64Amount{value: 876, scale: 30}, 4, 0, false},
+		{"test when i.scale < 0 and fraction exists", int64Amount{value: 93, scale: -1}, 0, 10, true},
+		{"test when i.scale < 0 and fraction doesn't exist", int64Amount{value: 100, scale: -1}, 0, 10, true},
+		{"test when i.value < 0 and fraction exists", int64Amount{value: -1932, scale: 2}, 4, -20, true},
+		{"test when i.value < 0 and fraction doesn't exists", int64Amount{value: -1900, scale: 2}, 4, -19, true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			r, ok := test.i.AsScaledInt64(test.scaled)
+			if r != test.result {
+				t.Errorf("%v: expected result: %d, got result: %d", test.name, test.result, r)
+			}
+			if ok != test.ok {
+				t.Errorf("%v: expected ok: %t, got ok: %t", test.name, test.ok, ok)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/generated.pb.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/generated.pb.go
new file mode 100644
index 0000000000..9e1a5c0e1f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/generated.pb.go
@@ -0,0 +1,24 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/apimachinery/pkg/api/resource/generated.proto
+
+package resource
+
+func (m *Quantity) Reset() { *m = Quantity{} }
+
+func (m *QuantityValue) Reset() { *m = QuantityValue{} }
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/generated.proto b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/generated.proto
new file mode 100644
index 0000000000..875ad8577a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/generated.proto
@@ -0,0 +1,113 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.apimachinery.pkg.api.resource;
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/apimachinery/pkg/api/resource";
+
+// Quantity is a fixed-point representation of a number.
+// It provides convenient marshaling/unmarshaling in JSON and YAML,
+// in addition to String() and AsInt64() accessors.
+//
+// The serialization format is:
+//
+// ```
+// <quantity>        ::= <signedNumber><suffix>
+//
+// 	(Note that <suffix> may be empty, from the "" case in <decimalSI>.)
+//
+// <digit>           ::= 0 | 1 | ... | 9
+// <digits>          ::= <digit> | <digit><digits>
+// <number>          ::= <digits> | <digits>.<digits> | <digits>. | .<digits>
+// <sign>            ::= "+" | "-"
+// <signedNumber>    ::= <number> | <sign><number>
+// <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI>
+// <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei
+//
+// 	(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)
+//
+// <decimalSI>       ::= m | "" | k | M | G | T | P | E
+//
+// 	(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)
+//
+// <decimalExponent> ::= "e" <signedNumber> | "E" <signedNumber>
+// ```
+//
+// No matter which of the three exponent forms is used, no quantity may represent
+// a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal
+// places. Numbers larger or more precise will be capped or rounded up.
+// (E.g.: 0.1m will rounded up to 1m.)
+// This may be extended in the future if we require larger or smaller quantities.
+//
+// When a Quantity is parsed from a string, it will remember the type of suffix
+// it had, and will use the same type again when it is serialized.
+//
+// Before serializing, Quantity will be put in "canonical form".
+// This means that Exponent/suffix will be adjusted up or down (with a
+// corresponding increase or decrease in Mantissa) such that:
+//
+// - No precision is lost
+// - No fractional digits will be emitted
+// - The exponent (or suffix) is as large as possible.
+//
+// The sign will be omitted unless the number is negative.
+//
+// Examples:
+//
+// - 1.5 will be serialized as "1500m"
+// - 1.5Gi will be serialized as "1536Mi"
+//
+// Note that the quantity will NEVER be internally represented by a
+// floating point number. That is the whole point of this exercise.
+//
+// Non-canonical values will still parse as long as they are well formed,
+// but will be re-emitted in their canonical form. (So always use canonical
+// form, or don't diff.)
+//
+// This format is intended to make it difficult to use these numbers without
+// writing some sort of special handling code in the hopes that that will
+// cause implementors to also use a fixed point implementation.
+//
+// +protobuf=true
+// +protobuf.embed=string
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:deepcopy-gen=true
+// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.api.resource
+message Quantity {
+  optional string string = 1;
+}
+
+// QuantityValue makes it possible to use a Quantity as value for a command
+// line parameter.
+//
+// +protobuf=true
+// +protobuf.embed=string
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:deepcopy-gen=true
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.api.resource
+message QuantityValue {
+  optional string string = 1;
+}
+
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/math.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/math.go
new file mode 100644
index 0000000000..8ffcb9f09a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/math.go
@@ -0,0 +1,310 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"math/big"
+
+	inf "gopkg.in/inf.v0"
+)
+
+const (
+	// maxInt64Factors is the highest value that will be checked when removing factors of 10 from an int64.
+	// It is also the maximum decimal digits that can be represented with an int64.
+	maxInt64Factors = 18
+)
+
+var (
+	// Commonly needed big.Int values-- treat as read only!
+	bigTen      = big.NewInt(10)
+	bigZero     = big.NewInt(0)
+	bigOne      = big.NewInt(1)
+	bigThousand = big.NewInt(1000)
+	big1024     = big.NewInt(1024)
+
+	// Commonly needed inf.Dec values-- treat as read only!
+	decZero = inf.NewDec(0, 0)
+	decOne  = inf.NewDec(1, 0)
+
+	// Largest (in magnitude) number allowed.
+	maxAllowed = infDecAmount{inf.NewDec((1<<63)-1, 0)} // == max int64
+
+	// The maximum value we can represent milli-units for.
+	// Compare with the return value of Quantity.Value() to
+	// see if it's safe to use Quantity.MilliValue().
+	MaxMilliValue = int64(((1 << 63) - 1) / 1000)
+)
+
+const mostNegative = -(mostPositive + 1)
+const mostPositive = 1<<63 - 1
+
+// int64Add returns a+b, or false if that would overflow int64.
+func int64Add(a, b int64) (int64, bool) {
+	c := a + b
+	switch {
+	case a > 0 && b > 0:
+		if c < 0 {
+			return 0, false
+		}
+	case a < 0 && b < 0:
+		if c > 0 {
+			return 0, false
+		}
+		if a == mostNegative && b == mostNegative {
+			return 0, false
+		}
+	}
+	return c, true
+}
+
+// int64Multiply returns a*b, or false if that would overflow or underflow int64.
+func int64Multiply(a, b int64) (int64, bool) {
+	if a == 0 || b == 0 || a == 1 || b == 1 {
+		return a * b, true
+	}
+	if a == mostNegative || b == mostNegative {
+		return 0, false
+	}
+	c := a * b
+	return c, c/b == a
+}
+
+// int64MultiplyScale returns a*b, assuming b is greater than one, or false if that would overflow or underflow int64.
+// Use when b is known to be greater than one.
+func int64MultiplyScale(a int64, b int64) (int64, bool) {
+	if a == 0 || a == 1 {
+		return a * b, true
+	}
+	if a == mostNegative && b != 1 {
+		return 0, false
+	}
+	c := a * b
+	return c, c/b == a
+}
+
+// int64MultiplyScale10 multiplies a by 10, or returns false if that would overflow. This method is faster than
+// int64Multiply(a, 10) because the compiler can optimize constant factor multiplication.
+func int64MultiplyScale10(a int64) (int64, bool) {
+	if a == 0 || a == 1 {
+		return a * 10, true
+	}
+	if a == mostNegative {
+		return 0, false
+	}
+	c := a * 10
+	return c, c/10 == a
+}
+
+// int64MultiplyScale100 multiplies a by 100, or returns false if that would overflow. This method is faster than
+// int64Multiply(a, 100) because the compiler can optimize constant factor multiplication.
+func int64MultiplyScale100(a int64) (int64, bool) {
+	if a == 0 || a == 1 {
+		return a * 100, true
+	}
+	if a == mostNegative {
+		return 0, false
+	}
+	c := a * 100
+	return c, c/100 == a
+}
+
+// int64MultiplyScale1000 multiplies a by 1000, or returns false if that would overflow. This method is faster than
+// int64Multiply(a, 1000) because the compiler can optimize constant factor multiplication.
+func int64MultiplyScale1000(a int64) (int64, bool) {
+	if a == 0 || a == 1 {
+		return a * 1000, true
+	}
+	if a == mostNegative {
+		return 0, false
+	}
+	c := a * 1000
+	return c, c/1000 == a
+}
+
+// positiveScaleInt64 multiplies base by 10^scale, returning false if the
+// value overflows. Passing a negative scale is undefined.
+func positiveScaleInt64(base int64, scale Scale) (int64, bool) {
+	switch scale {
+	case 0:
+		return base, true
+	case 1:
+		return int64MultiplyScale10(base)
+	case 2:
+		return int64MultiplyScale100(base)
+	case 3:
+		return int64MultiplyScale1000(base)
+	case 6:
+		return int64MultiplyScale(base, 1000000)
+	case 9:
+		return int64MultiplyScale(base, 1000000000)
+	default:
+		value := base
+		var ok bool
+		for i := Scale(0); i < scale; i++ {
+			if value, ok = int64MultiplyScale(value, 10); !ok {
+				return 0, false
+			}
+		}
+		return value, true
+	}
+}
+
+// negativeScaleInt64 reduces base by the provided scale, rounding up, until the
+// value is zero or the scale is reached. Passing a negative scale is undefined.
+// The value returned, if not exact, is rounded away from zero.
+func negativeScaleInt64(base int64, scale Scale) (result int64, exact bool) {
+	if scale == 0 {
+		return base, true
+	}
+
+	value := base
+	var fraction bool
+	for i := Scale(0); i < scale; i++ {
+		if !fraction && value%10 != 0 {
+			fraction = true
+		}
+		value = value / 10
+		if value == 0 {
+			if fraction {
+				if base > 0 {
+					return 1, false
+				}
+				return -1, false
+			}
+			return 0, true
+		}
+	}
+	if fraction {
+		if base > 0 {
+			value++
+		} else {
+			value--
+		}
+	}
+	return value, !fraction
+}
+
+func pow10Int64(b int64) int64 {
+	switch b {
+	case 0:
+		return 1
+	case 1:
+		return 10
+	case 2:
+		return 100
+	case 3:
+		return 1000
+	case 4:
+		return 10000
+	case 5:
+		return 100000
+	case 6:
+		return 1000000
+	case 7:
+		return 10000000
+	case 8:
+		return 100000000
+	case 9:
+		return 1000000000
+	case 10:
+		return 10000000000
+	case 11:
+		return 100000000000
+	case 12:
+		return 1000000000000
+	case 13:
+		return 10000000000000
+	case 14:
+		return 100000000000000
+	case 15:
+		return 1000000000000000
+	case 16:
+		return 10000000000000000
+	case 17:
+		return 100000000000000000
+	case 18:
+		return 1000000000000000000
+	default:
+		return 0
+	}
+}
+
+// negativeScaleInt64 returns the result of dividing base by scale * 10 and the remainder, or
+// false if no such division is possible. Dividing by negative scales is undefined.
+func divideByScaleInt64(base int64, scale Scale) (result, remainder int64, exact bool) {
+	if scale == 0 {
+		return base, 0, true
+	}
+	// the max scale representable in base 10 in an int64 is 18 decimal places
+	if scale >= 18 {
+		return 0, base, false
+	}
+	divisor := pow10Int64(int64(scale))
+	return base / divisor, base % divisor, true
+}
+
+// removeInt64Factors divides in a loop; the return values have the property that
+// value == result * base ^ scale
+func removeInt64Factors(value int64, base int64) (result int64, times int32) {
+	times = 0
+	result = value
+	negative := result < 0
+	if negative {
+		result = -result
+	}
+	switch base {
+	// allow the compiler to optimize the common cases
+	case 10:
+		for result >= 10 && result%10 == 0 {
+			times++
+			result = result / 10
+		}
+	// allow the compiler to optimize the common cases
+	case 1024:
+		for result >= 1024 && result%1024 == 0 {
+			times++
+			result = result / 1024
+		}
+	default:
+		for result >= base && result%base == 0 {
+			times++
+			result = result / base
+		}
+	}
+	if negative {
+		result = -result
+	}
+	return result, times
+}
+
+// removeBigIntFactors divides in a loop; the return values have the property that
+// d == result * factor ^ times
+// d may be modified in place.
+// If d == 0, then the return values will be (0, 0)
+func removeBigIntFactors(d, factor *big.Int) (result *big.Int, times int32) {
+	q := big.NewInt(0)
+	m := big.NewInt(0)
+	for d.Cmp(bigZero) != 0 {
+		q.DivMod(d, factor, m)
+		if m.Cmp(bigZero) != 0 {
+			break
+		}
+		times++
+		d, q = q, d
+	}
+	return d, times
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/math_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/math_test.go
new file mode 100644
index 0000000000..070a0c237e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/math_test.go
@@ -0,0 +1,211 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"testing"
+)
+
+func TestDetectOverflowAdd(t *testing.T) {
+	for _, test := range []struct {
+		a, b int64
+		c    int64
+		ok   bool
+	}{
+		{0, 0, 0, true},
+		{-1, 1, 0, true},
+		{0, 1, 1, true},
+		{2, 2, 4, true},
+		{2, -2, 0, true},
+		{-2, -2, -4, true},
+
+		{mostNegative, -1, 0, false},
+		{mostNegative, 1, mostNegative + 1, true},
+		{mostPositive, -1, mostPositive - 1, true},
+		{mostPositive, 1, 0, false},
+
+		{mostNegative, mostPositive, -1, true},
+		{mostPositive, mostNegative, -1, true},
+		{mostPositive, mostPositive, 0, false},
+		{mostNegative, mostNegative, 0, false},
+
+		{-mostPositive, mostNegative, 0, false},
+		{mostNegative, -mostPositive, 0, false},
+		{-mostPositive, -mostPositive, 0, false},
+	} {
+		c, ok := int64Add(test.a, test.b)
+		if c != test.c {
+			t.Errorf("%v: unexpected result: %d", test, c)
+		}
+		if ok != test.ok {
+			t.Errorf("%v: unexpected overflow: %t", test, ok)
+		}
+		// addition is commutative
+		d, ok2 := int64Add(test.b, test.a)
+		if c != d || ok != ok2 {
+			t.Errorf("%v: not commutative: %d %t", test, d, ok2)
+		}
+	}
+}
+
+func TestDetectOverflowMultiply(t *testing.T) {
+	for _, test := range []struct {
+		a, b int64
+		c    int64
+		ok   bool
+	}{
+		{0, 0, 0, true},
+		{-1, 1, -1, true},
+		{-1, -1, 1, true},
+		{1, 1, 1, true},
+		{0, 1, 0, true},
+		{1, 0, 0, true},
+		{2, 2, 4, true},
+		{2, -2, -4, true},
+		{-2, -2, 4, true},
+
+		{mostNegative, -1, 0, false},
+		{mostNegative, 1, mostNegative, true},
+		{mostPositive, -1, -mostPositive, true},
+		{mostPositive, 1, mostPositive, true},
+
+		{mostNegative, mostPositive, 0, false},
+		{mostPositive, mostNegative, 0, false},
+		{mostPositive, mostPositive, 1, false},
+		{mostNegative, mostNegative, 0, false},
+
+		{-mostPositive, mostNegative, 0, false},
+		{mostNegative, -mostPositive, 0, false},
+		{-mostPositive, -mostPositive, 1, false},
+	} {
+		c, ok := int64Multiply(test.a, test.b)
+		if c != test.c {
+			t.Errorf("%v: unexpected result: %d", test, c)
+		}
+		if ok != test.ok {
+			t.Errorf("%v: unexpected overflow: %t", test, ok)
+		}
+		// multiplication is commutative
+		d, ok2 := int64Multiply(test.b, test.a)
+		if c != d || ok != ok2 {
+			t.Errorf("%v: not commutative: %d %t", test, d, ok2)
+		}
+	}
+}
+
+func TestDetectOverflowScale(t *testing.T) {
+	for _, a := range []int64{0, -1, 1, 10, -10, mostPositive, mostNegative, -mostPositive} {
+		for _, b := range []int64{1, 2, 10, 100, 1000, mostPositive} {
+			expect, expectOk := int64Multiply(a, b)
+
+			c, ok := int64MultiplyScale(a, b)
+			if c != expect {
+				t.Errorf("%d*%d: unexpected result: %d", a, b, c)
+			}
+			if ok != expectOk {
+				t.Errorf("%d*%d: unexpected overflow: %t", a, b, ok)
+			}
+		}
+		for _, test := range []struct {
+			base int64
+			fn   func(a int64) (int64, bool)
+		}{
+			{10, int64MultiplyScale10},
+			{100, int64MultiplyScale100},
+			{1000, int64MultiplyScale1000},
+		} {
+			expect, expectOk := int64Multiply(a, test.base)
+			c, ok := test.fn(a)
+			if c != expect {
+				t.Errorf("%d*%d: unexpected result: %d", a, test.base, c)
+			}
+			if ok != expectOk {
+				t.Errorf("%d*%d: unexpected overflow: %t", a, test.base, ok)
+			}
+		}
+	}
+}
+
+func TestRemoveInt64Factors(t *testing.T) {
+	for _, test := range []struct {
+		value  int64
+		max    int64
+		result int64
+		scale  int32
+	}{
+		{100, 10, 1, 2},
+		{100, 10, 1, 2},
+		{100, 100, 1, 1},
+		{1, 10, 1, 0},
+	} {
+		r, s := removeInt64Factors(test.value, test.max)
+		if r != test.result {
+			t.Errorf("%v: unexpected result: %d", test, r)
+		}
+		if s != test.scale {
+			t.Errorf("%v: unexpected scale: %d", test, s)
+		}
+	}
+}
+
+func TestNegativeScaleInt64(t *testing.T) {
+	for _, test := range []struct {
+		base   int64
+		scale  Scale
+		result int64
+		exact  bool
+	}{
+		{1234567, 0, 1234567, true},
+		{1234567, 1, 123457, false},
+		{1234567, 2, 12346, false},
+		{1234567, 3, 1235, false},
+		{1234567, 4, 124, false},
+
+		{-1234567, 0, -1234567, true},
+		{-1234567, 1, -123457, false},
+		{-1234567, 2, -12346, false},
+		{-1234567, 3, -1235, false},
+		{-1234567, 4, -124, false},
+
+		{1000, 0, 1000, true},
+		{1000, 1, 100, true},
+		{1000, 2, 10, true},
+		{1000, 3, 1, true},
+		{1000, 4, 1, false},
+
+		{-1000, 0, -1000, true},
+		{-1000, 1, -100, true},
+		{-1000, 2, -10, true},
+		{-1000, 3, -1, true},
+		{-1000, 4, -1, false},
+
+		{0, 0, 0, true},
+		{0, 1, 0, true},
+		{0, 2, 0, true},
+
+		// negative scale is undefined behavior
+		{1000, -1, 1000, true},
+	} {
+		result, exact := negativeScaleInt64(test.base, test.scale)
+		if result != test.result {
+			t.Errorf("%v: unexpected result: %d", test, result)
+		}
+		if exact != test.exact {
+			t.Errorf("%v: unexpected exact: %t", test, exact)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/quantity.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/quantity.go
new file mode 100644
index 0000000000..e6b1f1b535
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/quantity.go
@@ -0,0 +1,891 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	math "math"
+	"math/big"
+	"strconv"
+	"strings"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+
+	inf "gopkg.in/inf.v0"
+)
+
+// Quantity is a fixed-point representation of a number.
+// It provides convenient marshaling/unmarshaling in JSON and YAML,
+// in addition to String() and AsInt64() accessors.
+//
+// The serialization format is:
+//
+// ```
+// <quantity>        ::= <signedNumber><suffix>
+//
+//	(Note that <suffix> may be empty, from the "" case in <decimalSI>.)
+//
+// <digit>           ::= 0 | 1 | ... | 9
+// <digits>          ::= <digit> | <digit><digits>
+// <number>          ::= <digits> | <digits>.<digits> | <digits>. | .<digits>
+// <sign>            ::= "+" | "-"
+// <signedNumber>    ::= <number> | <sign><number>
+// <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI>
+// <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei
+//
+//	(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)
+//
+// <decimalSI>       ::= m | "" | k | M | G | T | P | E
+//
+//	(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)
+//
+// <decimalExponent> ::= "e" <signedNumber> | "E" <signedNumber>
+// ```
+//
+// No matter which of the three exponent forms is used, no quantity may represent
+// a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal
+// places. Numbers larger or more precise will be capped or rounded up.
+// (E.g.: 0.1m will rounded up to 1m.)
+// This may be extended in the future if we require larger or smaller quantities.
+//
+// When a Quantity is parsed from a string, it will remember the type of suffix
+// it had, and will use the same type again when it is serialized.
+//
+// Before serializing, Quantity will be put in "canonical form".
+// This means that Exponent/suffix will be adjusted up or down (with a
+// corresponding increase or decrease in Mantissa) such that:
+//
+// - No precision is lost
+// - No fractional digits will be emitted
+// - The exponent (or suffix) is as large as possible.
+//
+// The sign will be omitted unless the number is negative.
+//
+// Examples:
+//
+// - 1.5 will be serialized as "1500m"
+// - 1.5Gi will be serialized as "1536Mi"
+//
+// Note that the quantity will NEVER be internally represented by a
+// floating point number. That is the whole point of this exercise.
+//
+// Non-canonical values will still parse as long as they are well formed,
+// but will be re-emitted in their canonical form. (So always use canonical
+// form, or don't diff.)
+//
+// This format is intended to make it difficult to use these numbers without
+// writing some sort of special handling code in the hopes that that will
+// cause implementors to also use a fixed point implementation.
+//
+// +protobuf=true
+// +protobuf.embed=string
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:deepcopy-gen=true
+// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.api.resource
+type Quantity struct {
+	// i is the quantity in int64 scaled form, if d.Dec == nil
+	i int64Amount
+	// d is the quantity in inf.Dec form if d.Dec != nil
+	d infDecAmount
+	// s is the generated value of this quantity to avoid recalculation
+	s string
+
+	// Change Format at will. See the comment for Canonicalize for
+	// more details.
+	Format
+}
+
+// CanonicalValue allows a quantity amount to be converted to a string.
+type CanonicalValue interface {
+	// AsCanonicalBytes returns a byte array representing the string representation
+	// of the value mantissa and an int32 representing its exponent in base-10. Callers may
+	// pass a byte slice to the method to avoid allocations.
+	AsCanonicalBytes(out []byte) ([]byte, int32)
+	// AsCanonicalBase1024Bytes returns a byte array representing the string representation
+	// of the value mantissa and an int32 representing its exponent in base-1024. Callers
+	// may pass a byte slice to the method to avoid allocations.
+	AsCanonicalBase1024Bytes(out []byte) ([]byte, int32)
+}
+
+// Format lists the three possible formattings of a quantity.
+type Format string
+
+const (
+	DecimalExponent = Format("DecimalExponent") // e.g., 12e6
+	BinarySI        = Format("BinarySI")        // e.g., 12Mi (12 * 2^20)
+	DecimalSI       = Format("DecimalSI")       // e.g., 12M  (12 * 10^6)
+)
+
+// MustParse turns the given string into a quantity or panics; for tests
+// or other cases where you know the string is valid.
+func MustParse(str string) Quantity {
+	q, err := ParseQuantity(str)
+	if err != nil {
+		panic(fmt.Errorf("cannot parse '%v': %v", str, err))
+	}
+	return q
+}
+
+const (
+	// splitREString is used to separate a number from its suffix; as such,
+	// this is overly permissive, but that's OK-- it will be checked later.
+	splitREString = "^([+-]?[0-9.]+)([eEinumkKMGTP]*[-+]?[0-9]*)$"
+)
+
+var (
+	// Errors that could happen while parsing a string.
+	ErrFormatWrong = errors.New("quantities must match the regular expression '" + splitREString + "'")
+	ErrNumeric     = errors.New("unable to parse numeric part of quantity")
+	ErrSuffix      = errors.New("unable to parse quantity's suffix")
+)
+
+// parseQuantityString is a fast scanner for quantity values.
+func parseQuantityString(str string) (positive bool, value, num, denom, suffix string, err error) {
+	positive = true
+	pos := 0
+	end := len(str)
+
+	// handle leading sign
+	if pos < end {
+		switch str[0] {
+		case '-':
+			positive = false
+			pos++
+		case '+':
+			pos++
+		}
+	}
+
+	// strip leading zeros
+Zeroes:
+	for i := pos; ; i++ {
+		if i >= end {
+			num = "0"
+			value = num
+			return
+		}
+		switch str[i] {
+		case '0':
+			pos++
+		default:
+			break Zeroes
+		}
+	}
+
+	// extract the numerator
+Num:
+	for i := pos; ; i++ {
+		if i >= end {
+			num = str[pos:end]
+			value = str[0:end]
+			return
+		}
+		switch str[i] {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+		default:
+			num = str[pos:i]
+			pos = i
+			break Num
+		}
+	}
+
+	// if we stripped all numerator positions, always return 0
+	if len(num) == 0 {
+		num = "0"
+	}
+
+	// handle a denominator
+	if pos < end && str[pos] == '.' {
+		pos++
+	Denom:
+		for i := pos; ; i++ {
+			if i >= end {
+				denom = str[pos:end]
+				value = str[0:end]
+				return
+			}
+			switch str[i] {
+			case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			default:
+				denom = str[pos:i]
+				pos = i
+				break Denom
+			}
+		}
+		// TODO: we currently allow 1.G, but we may not want to in the future.
+		// if len(denom) == 0 {
+		// 	err = ErrFormatWrong
+		// 	return
+		// }
+	}
+	value = str[0:pos]
+
+	// grab the elements of the suffix
+	suffixStart := pos
+	for i := pos; ; i++ {
+		if i >= end {
+			suffix = str[suffixStart:end]
+			return
+		}
+		if !strings.ContainsAny(str[i:i+1], "eEinumkKMGTP") {
+			pos = i
+			break
+		}
+	}
+	if pos < end {
+		switch str[pos] {
+		case '-', '+':
+			pos++
+		}
+	}
+Suffix:
+	for i := pos; ; i++ {
+		if i >= end {
+			suffix = str[suffixStart:end]
+			return
+		}
+		switch str[i] {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+		default:
+			break Suffix
+		}
+	}
+	// we encountered a non decimal in the Suffix loop, but the last character
+	// was not a valid exponent
+	err = ErrFormatWrong
+	return
+}
+
+// ParseQuantity turns str into a Quantity, or returns an error.
+func ParseQuantity(str string) (Quantity, error) {
+	if len(str) == 0 {
+		return Quantity{}, ErrFormatWrong
+	}
+	if str == "0" {
+		return Quantity{Format: DecimalSI, s: str}, nil
+	}
+
+	positive, value, num, denom, suf, err := parseQuantityString(str)
+	if err != nil {
+		return Quantity{}, err
+	}
+
+	base, exponent, format, ok := quantitySuffixer.interpret(suffix(suf))
+	if !ok {
+		return Quantity{}, ErrSuffix
+	}
+
+	precision := int32(0)
+	scale := int32(0)
+	mantissa := int64(1)
+	switch format {
+	case DecimalExponent, DecimalSI:
+		scale = exponent
+		precision = maxInt64Factors - int32(len(num)+len(denom))
+	case BinarySI:
+		scale = 0
+		switch {
+		case exponent >= 0 && len(denom) == 0:
+			// only handle positive binary numbers with the fast path
+			mantissa = int64(int64(mantissa) << uint64(exponent))
+			// 1Mi (2^20) has ~6 digits of decimal precision, so exponent*3/10 -1 is roughly the precision
+			precision = 15 - int32(len(num)) - int32(float32(exponent)*3/10) - 1
+		default:
+			precision = -1
+		}
+	}
+
+	if precision >= 0 {
+		// if we have a denominator, shift the entire value to the left by the number of places in the
+		// denominator
+		scale -= int32(len(denom))
+		if scale >= int32(Nano) {
+			shifted := num + denom
+
+			var value int64
+			value, err := strconv.ParseInt(shifted, 10, 64)
+			if err != nil {
+				return Quantity{}, ErrNumeric
+			}
+			if result, ok := int64Multiply(value, int64(mantissa)); ok {
+				if !positive {
+					result = -result
+				}
+				// if the number is in canonical form, reuse the string
+				switch format {
+				case BinarySI:
+					if exponent%10 == 0 && (value&0x07 != 0) {
+						return Quantity{i: int64Amount{value: result, scale: Scale(scale)}, Format: format, s: str}, nil
+					}
+				default:
+					if scale%3 == 0 && !strings.HasSuffix(shifted, "000") && shifted[0] != '0' {
+						return Quantity{i: int64Amount{value: result, scale: Scale(scale)}, Format: format, s: str}, nil
+					}
+				}
+				return Quantity{i: int64Amount{value: result, scale: Scale(scale)}, Format: format}, nil
+			}
+		}
+	}
+
+	amount := new(inf.Dec)
+	if _, ok := amount.SetString(value); !ok {
+		return Quantity{}, ErrNumeric
+	}
+
+	// So that no one but us has to think about suffixes, remove it.
+	if base == 10 {
+		amount.SetScale(amount.Scale() + Scale(exponent).infScale())
+	} else if base == 2 {
+		// numericSuffix = 2 ** exponent
+		numericSuffix := big.NewInt(1).Lsh(bigOne, uint(exponent))
+		ub := amount.UnscaledBig()
+		amount.SetUnscaledBig(ub.Mul(ub, numericSuffix))
+	}
+
+	// Cap at min/max bounds.
+	sign := amount.Sign()
+	if sign == -1 {
+		amount.Neg(amount)
+	}
+
+	// This rounds non-zero values up to the minimum representable value, under the theory that
+	// if you want some resources, you should get some resources, even if you asked for way too small
+	// of an amount.  Arguably, this should be inf.RoundHalfUp (normal rounding), but that would have
+	// the side effect of rounding values < .5n to zero.
+	if v, ok := amount.Unscaled(); v != int64(0) || !ok {
+		amount.Round(amount, Nano.infScale(), inf.RoundUp)
+	}
+
+	// The max is just a simple cap.
+	// TODO: this prevents accumulating quantities greater than int64, for instance quota across a cluster
+	if format == BinarySI && amount.Cmp(maxAllowed.Dec) > 0 {
+		amount.Set(maxAllowed.Dec)
+	}
+
+	if format == BinarySI && amount.Cmp(decOne) < 0 && amount.Cmp(decZero) > 0 {
+		// This avoids rounding and hopefully confusion, too.
+		format = DecimalSI
+	}
+	if sign == -1 {
+		amount.Neg(amount)
+	}
+
+	return Quantity{d: infDecAmount{amount}, Format: format}, nil
+}
+
+// DeepCopy returns a deep-copy of the Quantity value.  Note that the method
+// receiver is a value, so we can mutate it in-place and return it.
+func (q Quantity) DeepCopy() Quantity {
+	if q.d.Dec != nil {
+		tmp := &inf.Dec{}
+		q.d.Dec = tmp.Set(q.d.Dec)
+	}
+	return q
+}
+
+// OpenAPISchemaType is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+//
+// See: https://github.com/kubernetes/kube-openapi/tree/master/pkg/generators
+func (_ Quantity) OpenAPISchemaType() []string { return []string{"string"} }
+
+// OpenAPISchemaFormat is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+func (_ Quantity) OpenAPISchemaFormat() string { return "" }
+
+// OpenAPIV3OneOfTypes is used by the kube-openapi generator when constructing
+// the OpenAPI v3 spec of this type.
+func (Quantity) OpenAPIV3OneOfTypes() []string { return []string{"string", "number"} }
+
+// CanonicalizeBytes returns the canonical form of q and its suffix (see comment on Quantity).
+//
+// Note about BinarySI:
+//   - If q.Format is set to BinarySI and q.Amount represents a non-zero value between
+//     -1 and +1, it will be emitted as if q.Format were DecimalSI.
+//   - Otherwise, if q.Format is set to BinarySI, fractional parts of q.Amount will be
+//     rounded up. (1.1i becomes 2i.)
+func (q *Quantity) CanonicalizeBytes(out []byte) (result, suffix []byte) {
+	if q.IsZero() {
+		return zeroBytes, nil
+	}
+
+	var rounded CanonicalValue
+	format := q.Format
+	switch format {
+	case DecimalExponent, DecimalSI:
+	case BinarySI:
+		if q.CmpInt64(-1024) > 0 && q.CmpInt64(1024) < 0 {
+			// This avoids rounding and hopefully confusion, too.
+			format = DecimalSI
+		} else {
+			var exact bool
+			if rounded, exact = q.AsScale(0); !exact {
+				// Don't lose precision-- show as DecimalSI
+				format = DecimalSI
+			}
+		}
+	default:
+		format = DecimalExponent
+	}
+
+	// TODO: If BinarySI formatting is requested but would cause rounding, upgrade to
+	// one of the other formats.
+	switch format {
+	case DecimalExponent, DecimalSI:
+		number, exponent := q.AsCanonicalBytes(out)
+		suffix, _ := quantitySuffixer.constructBytes(10, exponent, format)
+		return number, suffix
+	default:
+		// format must be BinarySI
+		number, exponent := rounded.AsCanonicalBase1024Bytes(out)
+		suffix, _ := quantitySuffixer.constructBytes(2, exponent*10, format)
+		return number, suffix
+	}
+}
+
+// AsApproximateFloat64 returns a float64 representation of the quantity which
+// may lose precision. If precision matter more than performance, see
+// AsFloat64Slow. If the value of the quantity is outside the range of a
+// float64 +Inf/-Inf will be returned.
+func (q *Quantity) AsApproximateFloat64() float64 {
+	var base float64
+	var exponent int
+	if q.d.Dec != nil {
+		base, _ = big.NewFloat(0).SetInt(q.d.Dec.UnscaledBig()).Float64()
+		exponent = int(-q.d.Dec.Scale())
+	} else {
+		base = float64(q.i.value)
+		exponent = int(q.i.scale)
+	}
+	if exponent == 0 {
+		return base
+	}
+
+	return base * math.Pow10(exponent)
+}
+
+// AsFloat64Slow returns a float64 representation of the quantity.  This is
+// more precise than AsApproximateFloat64 but significantly slower.  If the
+// value of the quantity is outside the range of a float64 +Inf/-Inf will be
+// returned.
+func (q *Quantity) AsFloat64Slow() float64 {
+	infDec := q.AsDec()
+
+	var absScale int64
+	if infDec.Scale() < 0 {
+		absScale = int64(-infDec.Scale())
+	} else {
+		absScale = int64(infDec.Scale())
+	}
+	pow10AbsScale := big.NewInt(10)
+	pow10AbsScale = pow10AbsScale.Exp(pow10AbsScale, big.NewInt(absScale), nil)
+
+	var resultBigFloat *big.Float
+	if infDec.Scale() < 0 {
+		resultBigInt := new(big.Int).Mul(infDec.UnscaledBig(), pow10AbsScale)
+		resultBigFloat = new(big.Float).SetInt(resultBigInt)
+	} else {
+		pow10AbsScaleFloat := new(big.Float).SetInt(pow10AbsScale)
+		resultBigFloat = new(big.Float).SetInt(infDec.UnscaledBig())
+		resultBigFloat = resultBigFloat.Quo(resultBigFloat, pow10AbsScaleFloat)
+	}
+
+	result, _ := resultBigFloat.Float64()
+	return result
+}
+
+// AsInt64 returns a representation of the current value as an int64 if a fast conversion
+// is possible. If false is returned, callers must use the inf.Dec form of this quantity.
+func (q *Quantity) AsInt64() (int64, bool) {
+	if q.d.Dec != nil {
+		return 0, false
+	}
+	return q.i.AsInt64()
+}
+
+// ToDec promotes the quantity in place to use an inf.Dec representation and returns itself.
+func (q *Quantity) ToDec() *Quantity {
+	if q.d.Dec == nil {
+		q.d.Dec = q.i.AsDec()
+		q.i = int64Amount{}
+	}
+	return q
+}
+
+// AsDec returns the quantity as represented by a scaled inf.Dec.
+func (q *Quantity) AsDec() *inf.Dec {
+	if q.d.Dec != nil {
+		return q.d.Dec
+	}
+	q.d.Dec = q.i.AsDec()
+	q.i = int64Amount{}
+	return q.d.Dec
+}
+
+// AsCanonicalBytes returns the canonical byte representation of this quantity as a mantissa
+// and base 10 exponent. The out byte slice may be passed to the method to avoid an extra
+// allocation.
+func (q *Quantity) AsCanonicalBytes(out []byte) (result []byte, exponent int32) {
+	if q.d.Dec != nil {
+		return q.d.AsCanonicalBytes(out)
+	}
+	return q.i.AsCanonicalBytes(out)
+}
+
+// IsZero returns true if the quantity is equal to zero.
+func (q *Quantity) IsZero() bool {
+	if q.d.Dec != nil {
+		return q.d.Dec.Sign() == 0
+	}
+	return q.i.value == 0
+}
+
+// Sign returns 0 if the quantity is zero, -1 if the quantity is less than zero, or 1 if the
+// quantity is greater than zero.
+func (q *Quantity) Sign() int {
+	if q.d.Dec != nil {
+		return q.d.Dec.Sign()
+	}
+	return q.i.Sign()
+}
+
+// AsScale returns the current value, rounded up to the provided scale, and returns
+// false if the scale resulted in a loss of precision.
+func (q *Quantity) AsScale(scale Scale) (CanonicalValue, bool) {
+	if q.d.Dec != nil {
+		return q.d.AsScale(scale)
+	}
+	return q.i.AsScale(scale)
+}
+
+// RoundUp updates the quantity to the provided scale, ensuring that the value is at
+// least 1. False is returned if the rounding operation resulted in a loss of precision.
+// Negative numbers are rounded away from zero (-9 scale 1 rounds to -10).
+func (q *Quantity) RoundUp(scale Scale) bool {
+	if q.d.Dec != nil {
+		q.s = ""
+		d, exact := q.d.AsScale(scale)
+		q.d = d
+		return exact
+	}
+	// avoid clearing the string value if we have already calculated it
+	if q.i.scale >= scale {
+		return true
+	}
+	q.s = ""
+	i, exact := q.i.AsScale(scale)
+	q.i = i
+	return exact
+}
+
+// Add adds the provide y quantity to the current value. If the current value is zero,
+// the format of the quantity will be updated to the format of y.
+func (q *Quantity) Add(y Quantity) {
+	q.s = ""
+	if q.d.Dec == nil && y.d.Dec == nil {
+		if q.i.value == 0 {
+			q.Format = y.Format
+		}
+		if q.i.Add(y.i) {
+			return
+		}
+	} else if q.IsZero() {
+		q.Format = y.Format
+	}
+	q.ToDec().d.Dec.Add(q.d.Dec, y.AsDec())
+}
+
+// Sub subtracts the provided quantity from the current value in place. If the current
+// value is zero, the format of the quantity will be updated to the format of y.
+func (q *Quantity) Sub(y Quantity) {
+	q.s = ""
+	if q.IsZero() {
+		q.Format = y.Format
+	}
+	if q.d.Dec == nil && y.d.Dec == nil && q.i.Sub(y.i) {
+		return
+	}
+	q.ToDec().d.Dec.Sub(q.d.Dec, y.AsDec())
+}
+
+// Mul multiplies the provided y to the current value.
+// It will return false if the result is inexact. Otherwise, it will return true.
+func (q *Quantity) Mul(y int64) bool {
+	q.s = ""
+	if q.d.Dec == nil && q.i.Mul(y) {
+		return true
+	}
+	return q.ToDec().d.Dec.Mul(q.d.Dec, inf.NewDec(y, inf.Scale(0))).UnscaledBig().IsInt64()
+}
+
+// Cmp returns 0 if the quantity is equal to y, -1 if the quantity is less than y, or 1 if the
+// quantity is greater than y.
+func (q *Quantity) Cmp(y Quantity) int {
+	if q.d.Dec == nil && y.d.Dec == nil {
+		return q.i.Cmp(y.i)
+	}
+	return q.AsDec().Cmp(y.AsDec())
+}
+
+// CmpInt64 returns 0 if the quantity is equal to y, -1 if the quantity is less than y, or 1 if the
+// quantity is greater than y.
+func (q *Quantity) CmpInt64(y int64) int {
+	if q.d.Dec != nil {
+		return q.d.Dec.Cmp(inf.NewDec(y, inf.Scale(0)))
+	}
+	return q.i.Cmp(int64Amount{value: y})
+}
+
+// Neg sets quantity to be the negative value of itself.
+func (q *Quantity) Neg() {
+	q.s = ""
+	if q.d.Dec == nil {
+		q.i.value = -q.i.value
+		return
+	}
+	q.d.Dec.Neg(q.d.Dec)
+}
+
+// Equal checks equality of two Quantities. This is useful for testing with
+// cmp.Equal.
+func (q Quantity) Equal(v Quantity) bool {
+	return q.Cmp(v) == 0
+}
+
+// int64QuantityExpectedBytes is the expected width in bytes of the canonical string representation
+// of most Quantity values.
+const int64QuantityExpectedBytes = 18
+
+// String formats the Quantity as a string, caching the result if not calculated.
+// String is an expensive operation and caching this result significantly reduces the cost of
+// normal parse / marshal operations on Quantity.
+func (q *Quantity) String() string {
+	if q == nil {
+		return "<nil>"
+	}
+	if len(q.s) == 0 {
+		result := make([]byte, 0, int64QuantityExpectedBytes)
+		number, suffix := q.CanonicalizeBytes(result)
+		number = append(number, suffix...)
+		q.s = string(number)
+	}
+	return q.s
+}
+
+// MarshalJSON implements the json.Marshaller interface.
+func (q Quantity) MarshalJSON() ([]byte, error) {
+	if len(q.s) > 0 {
+		out := make([]byte, len(q.s)+2)
+		out[0], out[len(out)-1] = '"', '"'
+		copy(out[1:], q.s)
+		return out, nil
+	}
+	result := make([]byte, int64QuantityExpectedBytes)
+	result[0] = '"'
+	number, suffix := q.CanonicalizeBytes(result[1:1])
+	// if the same slice was returned to us that we passed in, avoid another allocation by copying number into
+	// the source slice and returning that
+	if len(number) > 0 && &number[0] == &result[1] && (len(number)+len(suffix)+2) <= int64QuantityExpectedBytes {
+		number = append(number, suffix...)
+		number = append(number, '"')
+		return result[:1+len(number)], nil
+	}
+	// if CanonicalizeBytes needed more space than our slice provided, we may need to allocate again so use
+	// append
+	result = result[:1]
+	result = append(result, number...)
+	result = append(result, suffix...)
+	result = append(result, '"')
+	return result, nil
+}
+
+func (q Quantity) MarshalCBOR() ([]byte, error) {
+	// The call to String() should never return the string "<nil>" because the receiver's
+	// address will never be nil.
+	return cbor.Marshal(q.String())
+}
+
+// ToUnstructured implements the value.UnstructuredConverter interface.
+func (q Quantity) ToUnstructured() interface{} {
+	return q.String()
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+// TODO: Remove support for leading/trailing whitespace
+func (q *Quantity) UnmarshalJSON(value []byte) error {
+	l := len(value)
+	if l == 4 && bytes.Equal(value, []byte("null")) {
+		q.d.Dec = nil
+		q.i = int64Amount{}
+		return nil
+	}
+	if l >= 2 && value[0] == '"' && value[l-1] == '"' {
+		value = value[1 : l-1]
+	}
+
+	parsed, err := ParseQuantity(strings.TrimSpace(string(value)))
+	if err != nil {
+		return err
+	}
+
+	// This copy is safe because parsed will not be referred to again.
+	*q = parsed
+	return nil
+}
+
+func (q *Quantity) UnmarshalCBOR(value []byte) error {
+	var s *string
+	if err := cbor.Unmarshal(value, &s); err != nil {
+		return err
+	}
+
+	if s == nil {
+		q.d.Dec = nil
+		q.i = int64Amount{}
+		return nil
+	}
+
+	parsed, err := ParseQuantity(strings.TrimSpace(*s))
+	if err != nil {
+		return err
+	}
+
+	*q = parsed
+	return nil
+}
+
+// NewDecimalQuantity returns a new Quantity representing the given
+// value in the given format.
+func NewDecimalQuantity(b inf.Dec, format Format) *Quantity {
+	return &Quantity{
+		d:      infDecAmount{&b},
+		Format: format,
+	}
+}
+
+// NewQuantity returns a new Quantity representing the given
+// value in the given format.
+func NewQuantity(value int64, format Format) *Quantity {
+	return &Quantity{
+		i:      int64Amount{value: value},
+		Format: format,
+	}
+}
+
+// NewMilliQuantity returns a new Quantity representing the given
+// value * 1/1000 in the given format. Note that BinarySI formatting
+// will round fractional values, and will be changed to DecimalSI for
+// values x where (-1 < x < 1) && (x != 0).
+func NewMilliQuantity(value int64, format Format) *Quantity {
+	return &Quantity{
+		i:      int64Amount{value: value, scale: -3},
+		Format: format,
+	}
+}
+
+// NewScaledQuantity returns a new Quantity representing the given
+// value * 10^scale in DecimalSI format.
+func NewScaledQuantity(value int64, scale Scale) *Quantity {
+	return &Quantity{
+		i:      int64Amount{value: value, scale: scale},
+		Format: DecimalSI,
+	}
+}
+
+// Value returns the unscaled value of q rounded up to the nearest integer away from 0.
+func (q *Quantity) Value() int64 {
+	return q.ScaledValue(0)
+}
+
+// MilliValue returns the value of ceil(q * 1000); this could overflow an int64;
+// if that's a concern, call Value() first to verify the number is small enough.
+func (q *Quantity) MilliValue() int64 {
+	return q.ScaledValue(Milli)
+}
+
+// ScaledValue returns the value of ceil(q / 10^scale).
+// For example, NewQuantity(1, DecimalSI).ScaledValue(Milli) returns 1000.
+// This could overflow an int64.
+// To detect overflow, call Value() first and verify the expected magnitude.
+func (q *Quantity) ScaledValue(scale Scale) int64 {
+	if q.d.Dec == nil {
+		i, _ := q.i.AsScaledInt64(scale)
+		return i
+	}
+	dec := q.d.Dec
+	return scaledValue(dec.UnscaledBig(), int(dec.Scale()), int(scale.infScale()))
+}
+
+// Set sets q's value to be value.
+func (q *Quantity) Set(value int64) {
+	q.SetScaled(value, 0)
+}
+
+// SetMilli sets q's value to be value * 1/1000.
+func (q *Quantity) SetMilli(value int64) {
+	q.SetScaled(value, Milli)
+}
+
+// SetScaled sets q's value to be value * 10^scale
+func (q *Quantity) SetScaled(value int64, scale Scale) {
+	q.s = ""
+	q.d.Dec = nil
+	q.i = int64Amount{value: value, scale: scale}
+}
+
+// QuantityValue makes it possible to use a Quantity as value for a command
+// line parameter.
+//
+// +protobuf=true
+// +protobuf.embed=string
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:deepcopy-gen=true
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.api.resource
+type QuantityValue struct {
+	Quantity
+}
+
+// Set implements pflag.Value.Set and Go flag.Value.Set.
+func (q *QuantityValue) Set(s string) error {
+	quantity, err := ParseQuantity(s)
+	if err != nil {
+		return err
+	}
+	q.Quantity = quantity
+	return nil
+}
+
+// Type implements pflag.Value.Type.
+func (q QuantityValue) Type() string {
+	return "quantity"
+}
+
+// QuantityPtrEqual compares two Quantity pointers and returns true if they are both nil or point to equal quantities.
+func QuantityPtrEqual(a, b *Quantity) bool {
+	if a == nil && b == nil {
+		return true
+	}
+	if a == nil || b == nil {
+		return false
+	}
+	return a.Equal(*b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_example_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_example_test.go
new file mode 100644
index 0000000000..56a7dbe0e0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_example_test.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource_test
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/resource"
+)
+
+func ExampleFormat() {
+	memorySize := resource.NewQuantity(5*1024*1024*1024, resource.BinarySI)
+	fmt.Printf("memorySize = %v\n", memorySize)
+
+	diskSize := resource.NewQuantity(5*1000*1000*1000, resource.DecimalSI)
+	fmt.Printf("diskSize = %v\n", diskSize)
+
+	cores := resource.NewMilliQuantity(5300, resource.DecimalSI)
+	fmt.Printf("cores = %v\n", cores)
+
+	// Output:
+	// memorySize = 5Gi
+	// diskSize = 5G
+	// cores = 5300m
+}
+
+func ExampleMustParse() {
+	memorySize := resource.MustParse("5Gi")
+	fmt.Printf("memorySize = %v (%v)\n", memorySize.Value(), memorySize.Format)
+
+	diskSize := resource.MustParse("5G")
+	fmt.Printf("diskSize = %v (%v)\n", diskSize.Value(), diskSize.Format)
+
+	cores := resource.MustParse("5300m")
+	fmt.Printf("milliCores = %v (%v)\n", cores.MilliValue(), cores.Format)
+
+	cores2 := resource.MustParse("5.4")
+	fmt.Printf("milliCores = %v (%v)\n", cores2.MilliValue(), cores2.Format)
+
+	// Output:
+	// memorySize = 5368709120 (BinarySI)
+	// diskSize = 5000000000 (DecimalSI)
+	// milliCores = 5300 (DecimalSI)
+	// milliCores = 5400 (DecimalSI)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_proto.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_proto.go
new file mode 100644
index 0000000000..364ec80da2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_proto.go
@@ -0,0 +1,284 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"fmt"
+	"io"
+	"math/bits"
+)
+
+func (m *Quantity) Marshal() (data []byte, err error) {
+	size := m.Size()
+	data = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(data[:size])
+	if err != nil {
+		return nil, err
+	}
+	return data[:n], nil
+}
+
+// MarshalTo is a customized version of the generated Protobuf unmarshaler for a struct
+// with a single string field.
+func (m *Quantity) MarshalTo(data []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(data[:size])
+}
+
+// MarshalToSizedBuffer is a customized version of the generated
+// Protobuf unmarshaler for a struct with a single string field.
+func (m *Quantity) MarshalToSizedBuffer(data []byte) (int, error) {
+	i := len(data)
+	_ = i
+	var l int
+	_ = l
+
+	// BEGIN CUSTOM MARSHAL
+	out := m.String()
+	i -= len(out)
+	copy(data[i:], out)
+	i = encodeVarintGenerated(data, i, uint64(len(out)))
+	// END CUSTOM MARSHAL
+	i--
+	data[i] = 0xa
+
+	return len(data) - i, nil
+}
+
+func encodeVarintGenerated(data []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		data[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	data[offset] = uint8(v)
+	return base
+}
+
+func (m *Quantity) Size() (n int) {
+	var l int
+	_ = l
+
+	// BEGIN CUSTOM SIZE
+	l = len(m.String())
+	// END CUSTOM SIZE
+
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (bits.Len64(x|1) + 6) / 7
+}
+
+// Unmarshal is a customized version of the generated Protobuf unmarshaler for a struct
+// with a single string field.
+func (m *Quantity) Unmarshal(data []byte) error {
+	l := len(data)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := data[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Quantity: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Quantity: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field String_", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := data[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(data[iNdEx:postIndex])
+
+			// BEGIN CUSTOM DECODE
+			p, err := ParseQuantity(s)
+			if err != nil {
+				return err
+			}
+			*m = p
+			// END CUSTOM DECODE
+
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(data[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+
+func skipGenerated(data []byte) (n int, err error) {
+	l := len(data)
+	iNdEx := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := data[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if data[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+			return iNdEx, nil
+		case 1:
+			iNdEx += 8
+			return iNdEx, nil
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := data[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			iNdEx += length
+			if length < 0 {
+				return 0, ErrInvalidLengthGenerated
+			}
+			return iNdEx, nil
+		case 3:
+			for {
+				var innerWire uint64
+				var start int = iNdEx
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return 0, ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return 0, io.ErrUnexpectedEOF
+					}
+					b := data[iNdEx]
+					iNdEx++
+					innerWire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				innerWireType := int(innerWire & 0x7)
+				if innerWireType == 4 {
+					break
+				}
+				next, err := skipGenerated(data[start:])
+				if err != nil {
+					return 0, err
+				}
+				iNdEx = start + next
+			}
+			return iNdEx, nil
+		case 4:
+			return iNdEx, nil
+		case 5:
+			iNdEx += 4
+			return iNdEx, nil
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+	}
+	panic("unreachable")
+}
+
+var (
+	ErrInvalidLengthGenerated = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowGenerated   = fmt.Errorf("proto: integer overflow")
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_proto_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_proto_test.go
new file mode 100644
index 0000000000..574a3cf5d7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_proto_test.go
@@ -0,0 +1,103 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"testing"
+
+	inf "gopkg.in/inf.v0"
+)
+
+func TestQuantityProtoMarshal(t *testing.T) {
+	// Test when d is nil
+	table := []struct {
+		quantity string
+		expect   Quantity
+	}{
+		{"0", Quantity{i: int64Amount{value: 0, scale: 0}, s: "0", Format: DecimalSI}},
+		{"100m", Quantity{i: int64Amount{value: 100, scale: -3}, s: "100m", Format: DecimalSI}},
+		{"50m", Quantity{i: int64Amount{value: 50, scale: -3}, s: "50m", Format: DecimalSI}},
+		{"10000T", Quantity{i: int64Amount{value: 10000, scale: 12}, s: "10000T", Format: DecimalSI}},
+	}
+	for _, testCase := range table {
+		q := MustParse(testCase.quantity)
+		// Won't currently get an error as MarshalTo can't return one
+		result, _ := q.Marshal()
+		q.MarshalTo(result)
+		if q.Cmp(testCase.expect) != 0 {
+			t.Errorf("Expected: %v, Actual: %v", testCase.expect, q)
+		}
+	}
+	// Test when i is {0,0}
+	table2 := []struct {
+		dec    *inf.Dec
+		expect Quantity
+	}{
+		{dec(0, 0).Dec, Quantity{i: int64Amount{value: 0, scale: 0}, d: infDecAmount{dec(0, 0).Dec}, s: "0", Format: DecimalSI}},
+		{dec(10, 0).Dec, Quantity{i: int64Amount{value: 0, scale: 0}, d: infDecAmount{dec(10, 0).Dec}, s: "10", Format: DecimalSI}},
+		{dec(-10, 0).Dec, Quantity{i: int64Amount{value: 0, scale: 0}, d: infDecAmount{dec(-10, 0).Dec}, s: "-10", Format: DecimalSI}},
+	}
+	for _, testCase := range table2 {
+		q := Quantity{d: infDecAmount{testCase.dec}, Format: DecimalSI}
+		// Won't currently get an error as MarshalTo can't return one
+		result, _ := q.Marshal()
+		q.Unmarshal(result)
+		if q.Cmp(testCase.expect) != 0 {
+			t.Errorf("Expected: %v, Actual: %v", testCase.expect, q)
+		}
+	}
+}
+
+func TestQuantityProtoUnmarshal(t *testing.T) {
+	// Test when d is nil
+	table := []struct {
+		input  Quantity
+		expect string
+	}{
+		{Quantity{i: int64Amount{value: 0, scale: 0}, s: "0", Format: DecimalSI}, "0"},
+		{Quantity{i: int64Amount{value: 100, scale: -3}, s: "100m", Format: DecimalSI}, "100m"},
+		{Quantity{i: int64Amount{value: 50, scale: -3}, s: "50m", Format: DecimalSI}, "50m"},
+		{Quantity{i: int64Amount{value: 10000, scale: 12}, s: "10000T", Format: DecimalSI}, "10000T"},
+	}
+	for _, testCase := range table {
+		var inputQ Quantity
+		expectQ := MustParse(testCase.expect)
+		inputByteArray, _ := testCase.input.Marshal()
+		inputQ.Unmarshal(inputByteArray)
+		if inputQ.Cmp(expectQ) != 0 {
+			t.Errorf("Expected: %v, Actual: %v", inputQ, expectQ)
+		}
+	}
+	// Test when i is {0,0}
+	table2 := []struct {
+		input  Quantity
+		expect *inf.Dec
+	}{
+		{Quantity{i: int64Amount{value: 0, scale: 0}, d: infDecAmount{dec(0, 0).Dec}, s: "0", Format: DecimalSI}, dec(0, 0).Dec},
+		{Quantity{i: int64Amount{value: 0, scale: 0}, d: infDecAmount{dec(10, 0).Dec}, s: "10", Format: DecimalSI}, dec(10, 0).Dec},
+		{Quantity{i: int64Amount{value: 0, scale: 0}, d: infDecAmount{dec(-10, 0).Dec}, s: "-10", Format: DecimalSI}, dec(-10, 0).Dec},
+	}
+	for _, testCase := range table2 {
+		var inputQ Quantity
+		expectQ := Quantity{d: infDecAmount{testCase.expect}, Format: DecimalSI}
+		inputByteArray, _ := testCase.input.Marshal()
+		inputQ.Unmarshal(inputByteArray)
+		if inputQ.Cmp(expectQ) != 0 {
+			t.Errorf("Expected: %v, Actual: %v", inputQ, expectQ)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_test.go
new file mode 100644
index 0000000000..6553b0047d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_test.go
@@ -0,0 +1,2035 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"encoding/json"
+	"fmt"
+	"math"
+	"math/big"
+	"math/rand"
+	"os"
+	"strings"
+	"testing"
+	"unicode"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/spf13/pflag"
+	inf "gopkg.in/inf.v0"
+	"sigs.k8s.io/randfill"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	"k8s.io/utils/ptr"
+)
+
+var (
+	bigMostPositive = big.NewInt(mostPositive)
+	bigMostNegative = big.NewInt(mostNegative)
+)
+
+func dec(i int64, exponent int) infDecAmount {
+	// See the below test-- scale is the negative of an exponent.
+	return infDecAmount{inf.NewDec(i, inf.Scale(-exponent))}
+}
+
+func bigDec(i *big.Int, exponent int) infDecAmount {
+	// See the below test-- scale is the negative of an exponent.
+	return infDecAmount{inf.NewDecBig(i, inf.Scale(-exponent))}
+}
+
+func decQuantity(i int64, exponent int, format Format) Quantity {
+	return Quantity{d: dec(i, exponent), Format: format}
+}
+
+func bigDecQuantity(i *big.Int, exponent int, format Format) Quantity {
+	return Quantity{d: bigDec(i, exponent), Format: format}
+}
+
+func intQuantity(i int64, exponent Scale, format Format) Quantity {
+	return Quantity{i: int64Amount{value: i, scale: exponent}, Format: format}
+}
+
+func TestDec(t *testing.T) {
+	table := []struct {
+		got    infDecAmount
+		expect string
+	}{
+		{dec(1, 0), "1"},
+		{dec(1, 1), "10"},
+		{dec(5, 2), "500"},
+		{dec(8, 3), "8000"},
+		{dec(2, 0), "2"},
+		{dec(1, -1), "0.1"},
+		{dec(3, -2), "0.03"},
+		{dec(4, -3), "0.004"},
+	}
+
+	for _, item := range table {
+		if e, a := item.expect, item.got.Dec.String(); e != a {
+			t.Errorf("expected %v, got %v", e, a)
+		}
+	}
+}
+
+func TestBigDec(t *testing.T) {
+	table := []struct {
+		got    infDecAmount
+		expect string
+	}{
+		{bigDec(big.NewInt(1), 0), "1"},
+		{bigDec(big.NewInt(1), 1), "10"},
+		{bigDec(big.NewInt(5), 2), "500"},
+		{bigDec(big.NewInt(8), 3), "8000"},
+		{bigDec(big.NewInt(2), 0), "2"},
+		{bigDec(big.NewInt(1), -1), "0.1"},
+		{bigDec(big.NewInt(3), -2), "0.03"},
+		{bigDec(big.NewInt(4), -3), "0.004"},
+		{bigDec(big.NewInt(0).Add(bigMostPositive, big.NewInt(1)), 0), "9223372036854775808"},
+		{bigDec(big.NewInt(0).Add(bigMostPositive, big.NewInt(1)), 1), "92233720368547758080"},
+		{bigDec(big.NewInt(0).Add(bigMostPositive, big.NewInt(1)), 2), "922337203685477580800"},
+		{bigDec(big.NewInt(0).Add(bigMostPositive, big.NewInt(1)), -1), "922337203685477580.8"},
+		{bigDec(big.NewInt(0).Add(bigMostPositive, big.NewInt(1)), -2), "92233720368547758.08"},
+		{bigDec(big.NewInt(0).Sub(bigMostNegative, big.NewInt(1)), 0), "-9223372036854775809"},
+		{bigDec(big.NewInt(0).Sub(bigMostNegative, big.NewInt(1)), 1), "-92233720368547758090"},
+		{bigDec(big.NewInt(0).Sub(bigMostNegative, big.NewInt(1)), 2), "-922337203685477580900"},
+		{bigDec(big.NewInt(0).Sub(bigMostNegative, big.NewInt(1)), -1), "-922337203685477580.9"},
+		{bigDec(big.NewInt(0).Sub(bigMostNegative, big.NewInt(1)), -2), "-92233720368547758.09"},
+	}
+
+	for _, item := range table {
+		if e, a := item.expect, item.got.Dec.String(); e != a {
+			t.Errorf("expected %v, got %v", e, a)
+		}
+	}
+}
+
+// TestQuantityParseZero ensures that when a 0 quantity is passed, its string value is 0
+func TestQuantityParseZero(t *testing.T) {
+	zero := MustParse("0")
+	if expected, actual := "0", zero.String(); expected != actual {
+		t.Errorf("Expected %v, actual %v", expected, actual)
+	}
+}
+
+// TestQuantityParseNonNumericPanic ensures that when a non-numeric string is parsed
+// it panics
+func TestQuantityParseNonNumericPanic(t *testing.T) {
+	defer func() {
+		if r := recover(); r == nil {
+			t.Errorf("MustParse did not panic")
+		}
+	}()
+	_ = MustParse("Non-Numeric")
+}
+
+// TestQuantityAddZeroPreservesSuffix verifies that a suffix is preserved
+// independent of the order of operations when adding a zero and non-zero val
+func TestQuantityAddZeroPreservesSuffix(t *testing.T) {
+	testValues := []string{"100m", "1Gi"}
+	zero := MustParse("0")
+	for _, testValue := range testValues {
+		value := MustParse(testValue)
+		v1 := value.DeepCopy()
+		// ensure non-zero + zero = non-zero (suffix preserved)
+		v1.Add(zero)
+		// ensure zero + non-zero = non-zero (suffix preserved)
+		v2 := zero.DeepCopy()
+		v2.Add(value)
+
+		if v1.String() != testValue {
+			t.Errorf("Expected %v, actual %v", testValue, v1.String())
+			continue
+		}
+		if v2.String() != testValue {
+			t.Errorf("Expected %v, actual %v", testValue, v2.String())
+		}
+	}
+}
+
+// TestQuantitySubZeroPreservesSuffix verifies that a suffix is preserved
+// independent of the order of operations when subtracting a zero and non-zero val
+func TestQuantitySubZeroPreservesSuffix(t *testing.T) {
+	testValues := []string{"100m", "1Gi"}
+	zero := MustParse("0")
+	for _, testValue := range testValues {
+		value := MustParse(testValue)
+		v1 := value.DeepCopy()
+		// ensure non-zero - zero = non-zero (suffix preserved)
+		v1.Sub(zero)
+		// ensure we preserved the input value
+		if v1.String() != testValue {
+			t.Errorf("Expected %v, actual %v", testValue, v1.String())
+		}
+
+		// ensure zero - non-zero = -non-zero (suffix preserved)
+		v2 := zero.DeepCopy()
+		v2.Sub(value)
+		negVal := value.DeepCopy()
+		negVal.Neg()
+		if v2.String() != negVal.String() {
+			t.Errorf("Expected %v, actual %v", negVal.String(), v2.String())
+		}
+	}
+}
+
+// TestQuantityCanocicalizeZero verifies that you get 0 as canonical value if internal value is 0, and not 0<suffix>
+func TestQuantityCanocicalizeZero(t *testing.T) {
+	val := MustParse("1000m")
+	val.i.Sub(int64Amount{value: 1})
+	zero := Quantity{i: val.i, Format: DecimalSI}
+	if expected, actual := "0", zero.String(); expected != actual {
+		t.Errorf("Expected %v, actual %v", expected, actual)
+	}
+}
+
+func TestQuantityCmp(t *testing.T) {
+	// Test when d is nil
+	table := []struct {
+		x      string
+		y      string
+		expect int
+	}{
+		{"0", "0", 0},
+		{"100m", "50m", 1},
+		{"50m", "100m", -1},
+		{"10000T", "100Gi", 1},
+	}
+	for _, testCase := range table {
+		q1 := MustParse(testCase.x)
+		q2 := MustParse(testCase.y)
+		if result := q1.Cmp(q2); result != testCase.expect {
+			t.Errorf("X: %v, Y: %v, Expected: %v, Actual: %v", testCase.x, testCase.y, testCase.expect, result)
+		}
+	}
+	// Test when i is {0,0}
+	table2 := []struct {
+		x      *inf.Dec
+		y      *inf.Dec
+		expect int
+	}{
+		{dec(0, 0).Dec, dec(0, 0).Dec, 0},
+		{nil, dec(0, 0).Dec, 0},
+		{dec(0, 0).Dec, nil, 0},
+		{nil, nil, 0},
+		{nil, dec(10, 0).Dec, -1},
+		{nil, dec(-10, 0).Dec, 1},
+		{dec(10, 0).Dec, nil, 1},
+		{dec(-10, 0).Dec, nil, -1},
+	}
+	for _, testCase := range table2 {
+		q1 := Quantity{d: infDecAmount{testCase.x}, Format: DecimalSI}
+		q2 := Quantity{d: infDecAmount{testCase.y}, Format: DecimalSI}
+		if result := q1.Cmp(q2); result != testCase.expect {
+			t.Errorf("X: %v, Y: %v, Expected: %v, Actual: %v", testCase.x, testCase.y, testCase.expect, result)
+		}
+	}
+}
+
+func TestParseQuantityString(t *testing.T) {
+	table := []struct {
+		input              string
+		positive           bool
+		value              string
+		num, denom, suffix string
+	}{
+		{"0.025Ti", true, "0.025", "0", "025", "Ti"},
+		{"1.025Ti", true, "1.025", "1", "025", "Ti"},
+		{"-1.025Ti", false, "-1.025", "1", "025", "Ti"},
+		{".", true, ".", "0", "", ""},
+		{"-.", false, "-.", "0", "", ""},
+		{"1E-3", true, "1", "1", "", "E-3"},
+	}
+	for _, test := range table {
+		positive, value, num, denom, suffix, err := parseQuantityString(test.input)
+		if err != nil {
+			t.Errorf("%s: error: %v", test.input, err)
+			continue
+		}
+		if positive != test.positive || value != test.value || num != test.num || denom != test.denom || suffix != test.suffix {
+			t.Errorf("%s: unmatched: %t %q %q %q %q", test.input, positive, value, num, denom, suffix)
+		}
+	}
+}
+
+func TestQuantityParse(t *testing.T) {
+	if _, err := ParseQuantity(""); err == nil {
+		t.Errorf("expected empty string to return error")
+	}
+
+	table := []struct {
+		input  string
+		expect Quantity
+	}{
+		{"0", decQuantity(0, 0, DecimalSI)},
+		{"0n", decQuantity(0, 0, DecimalSI)},
+		{"0u", decQuantity(0, 0, DecimalSI)},
+		{"0m", decQuantity(0, 0, DecimalSI)},
+		{"0Ki", decQuantity(0, 0, BinarySI)},
+		{"0k", decQuantity(0, 0, DecimalSI)},
+		{"0Mi", decQuantity(0, 0, BinarySI)},
+		{"0M", decQuantity(0, 0, DecimalSI)},
+		{"0Gi", decQuantity(0, 0, BinarySI)},
+		{"0G", decQuantity(0, 0, DecimalSI)},
+		{"0Ti", decQuantity(0, 0, BinarySI)},
+		{"0T", decQuantity(0, 0, DecimalSI)},
+
+		// Quantity less numbers are allowed
+		{"1", decQuantity(1, 0, DecimalSI)},
+
+		// Binary suffixes
+		{"1Ki", decQuantity(1024, 0, BinarySI)},
+		{"8Ki", decQuantity(8*1024, 0, BinarySI)},
+		{"7Mi", decQuantity(7*1024*1024, 0, BinarySI)},
+		{"6Gi", decQuantity(6*1024*1024*1024, 0, BinarySI)},
+		{"5Ti", decQuantity(5*1024*1024*1024*1024, 0, BinarySI)},
+		{"4Pi", decQuantity(4*1024*1024*1024*1024*1024, 0, BinarySI)},
+		{"3Ei", decQuantity(3*1024*1024*1024*1024*1024*1024, 0, BinarySI)},
+
+		{"10Ti", decQuantity(10*1024*1024*1024*1024, 0, BinarySI)},
+		{"100Ti", decQuantity(100*1024*1024*1024*1024, 0, BinarySI)},
+
+		// Decimal suffixes
+		{"5n", decQuantity(5, -9, DecimalSI)},
+		{"4u", decQuantity(4, -6, DecimalSI)},
+		{"3m", decQuantity(3, -3, DecimalSI)},
+		{"9", decQuantity(9, 0, DecimalSI)},
+		{"8k", decQuantity(8, 3, DecimalSI)},
+		{"50k", decQuantity(5, 4, DecimalSI)},
+		{"7M", decQuantity(7, 6, DecimalSI)},
+		{"6G", decQuantity(6, 9, DecimalSI)},
+		{"5T", decQuantity(5, 12, DecimalSI)},
+		{"40T", decQuantity(4, 13, DecimalSI)},
+		{"300T", decQuantity(3, 14, DecimalSI)},
+		{"2P", decQuantity(2, 15, DecimalSI)},
+		{"1E", decQuantity(1, 18, DecimalSI)},
+
+		// Decimal exponents
+		{"1E-3", decQuantity(1, -3, DecimalExponent)},
+		{"1e3", decQuantity(1, 3, DecimalExponent)},
+		{"1E6", decQuantity(1, 6, DecimalExponent)},
+		{"1e9", decQuantity(1, 9, DecimalExponent)},
+		{"1E12", decQuantity(1, 12, DecimalExponent)},
+		{"1e15", decQuantity(1, 15, DecimalExponent)},
+		{"1E18", decQuantity(1, 18, DecimalExponent)},
+
+		// Nonstandard but still parsable
+		{"1e14", decQuantity(1, 14, DecimalExponent)},
+		{"1e13", decQuantity(1, 13, DecimalExponent)},
+		{"1e3", decQuantity(1, 3, DecimalExponent)},
+		{"100.035k", decQuantity(100035, 0, DecimalSI)},
+
+		// Things that look like floating point
+		{"0.001", decQuantity(1, -3, DecimalSI)},
+		{"0.0005k", decQuantity(5, -1, DecimalSI)},
+		{"0.005", decQuantity(5, -3, DecimalSI)},
+		{"0.05", decQuantity(5, -2, DecimalSI)},
+		{"0.5", decQuantity(5, -1, DecimalSI)},
+		{"0.00050k", decQuantity(5, -1, DecimalSI)},
+		{"0.00500", decQuantity(5, -3, DecimalSI)},
+		{"0.05000", decQuantity(5, -2, DecimalSI)},
+		{"0.50000", decQuantity(5, -1, DecimalSI)},
+		{"0.5e0", decQuantity(5, -1, DecimalExponent)},
+		{"0.5e-1", decQuantity(5, -2, DecimalExponent)},
+		{"0.5e-2", decQuantity(5, -3, DecimalExponent)},
+		{"0.5e0", decQuantity(5, -1, DecimalExponent)},
+		{"10.035M", decQuantity(10035, 3, DecimalSI)},
+
+		{"1.2e3", decQuantity(12, 2, DecimalExponent)},
+		{"1.3E+6", decQuantity(13, 5, DecimalExponent)},
+		{"1.40e9", decQuantity(14, 8, DecimalExponent)},
+		{"1.53E12", decQuantity(153, 10, DecimalExponent)},
+		{"1.6e15", decQuantity(16, 14, DecimalExponent)},
+		{"1.7E18", decQuantity(17, 17, DecimalExponent)},
+
+		{"9.01", decQuantity(901, -2, DecimalSI)},
+		{"8.1k", decQuantity(81, 2, DecimalSI)},
+		{"7.123456M", decQuantity(7123456, 0, DecimalSI)},
+		{"6.987654321G", decQuantity(6987654321, 0, DecimalSI)},
+		{"5.444T", decQuantity(5444, 9, DecimalSI)},
+		{"40.1T", decQuantity(401, 11, DecimalSI)},
+		{"300.2T", decQuantity(3002, 11, DecimalSI)},
+		{"2.5P", decQuantity(25, 14, DecimalSI)},
+		{"1.01E", decQuantity(101, 16, DecimalSI)},
+
+		// Things that saturate/round
+		{"3.001n", decQuantity(4, -9, DecimalSI)},
+		{"1.1E-9", decQuantity(2, -9, DecimalExponent)},
+		{"0.0000000001", decQuantity(1, -9, DecimalSI)},
+		{"0.0000000005", decQuantity(1, -9, DecimalSI)},
+		{"0.00000000050", decQuantity(1, -9, DecimalSI)},
+		{"0.5e-9", decQuantity(1, -9, DecimalExponent)},
+		{"0.9n", decQuantity(1, -9, DecimalSI)},
+		{"0.00000012345", decQuantity(124, -9, DecimalSI)},
+		{"0.00000012354", decQuantity(124, -9, DecimalSI)},
+		{"9Ei", Quantity{d: maxAllowed, Format: BinarySI}},
+		{"9223372036854775807Ki", Quantity{d: maxAllowed, Format: BinarySI}},
+		{"12E", decQuantity(12, 18, DecimalSI)},
+
+		// We'll accept fractional binary stuff, too.
+		{"100.035Ki", decQuantity(10243584, -2, BinarySI)},
+		{"0.5Mi", decQuantity(.5*1024*1024, 0, BinarySI)},
+		{"0.05Gi", decQuantity(536870912, -1, BinarySI)},
+		{"0.025Ti", decQuantity(274877906944, -1, BinarySI)},
+
+		// Things written by trolls
+		{"0.000000000001Ki", decQuantity(2, -9, DecimalSI)}, // rounds up, changes format
+		{".001", decQuantity(1, -3, DecimalSI)},
+		{".0001k", decQuantity(100, -3, DecimalSI)},
+		{"1.", decQuantity(1, 0, DecimalSI)},
+		{"1.G", decQuantity(1, 9, DecimalSI)},
+	}
+
+	for _, asDec := range []bool{false, true} {
+		for _, item := range table {
+			got, err := ParseQuantity(item.input)
+			if err != nil {
+				t.Errorf("%v: unexpected error: %v", item.input, err)
+				continue
+			}
+			if asDec {
+				got.AsDec()
+			}
+
+			if e, a := item.expect, got; e.Cmp(a) != 0 {
+				t.Errorf("%v: expected %v, got %v", item.input, e.String(), a.String())
+			}
+			if e, a := item.expect.Format, got.Format; e != a {
+				t.Errorf("%v: expected %#v, got %#v", item.input, e, a)
+			}
+
+			if asDec {
+				if i, ok := got.AsInt64(); i != 0 || ok {
+					t.Errorf("%v: expected inf.Dec to return false for AsInt64: %d", item.input, i)
+				}
+				continue
+			}
+			i, ok := item.expect.AsInt64()
+			if !ok {
+				continue
+			}
+			j, ok := got.AsInt64()
+			if !ok {
+				if got.d.Dec == nil && got.i.scale >= 0 {
+					t.Errorf("%v: is an int64Amount, but can't return AsInt64: %v", item.input, got)
+				}
+				continue
+			}
+			if i != j {
+				t.Errorf("%v: expected equivalent representation as int64: %d %d", item.input, i, j)
+			}
+		}
+
+		for _, item := range table {
+			got, err := ParseQuantity(item.input)
+			if err != nil {
+				t.Errorf("%v: unexpected error: %v", item.input, err)
+				continue
+			}
+
+			if asDec {
+				got.AsDec()
+			}
+
+			for _, format := range []Format{DecimalSI, BinarySI, DecimalExponent} {
+				// ensure we are not simply checking pointer equality by creating a new inf.Dec
+				var copied inf.Dec
+				copied.Add(inf.NewDec(0, inf.Scale(0)), got.AsDec())
+				q := NewDecimalQuantity(copied, format)
+				if c := q.Cmp(got); c != 0 {
+					t.Errorf("%v: round trip from decimal back to quantity is not comparable: %d: %#v vs %#v", item.input, c, got, q)
+				}
+			}
+
+			// verify that we can decompose the input and get the same result by building up from the base.
+			positive, _, num, denom, suffix, err := parseQuantityString(item.input)
+			if err != nil {
+				t.Errorf("%v: unexpected error: %v", item.input, err)
+				continue
+			}
+			if got.Sign() >= 0 && !positive || got.Sign() < 0 && positive {
+				t.Errorf("%v: positive was incorrect: %t", item.input, positive)
+				continue
+			}
+			var value string
+			if !positive {
+				value = "-"
+			}
+			value += num
+			if len(denom) > 0 {
+				value += "." + denom
+			}
+			value += suffix
+			if len(value) == 0 {
+				t.Errorf("%v: did not parse correctly, %q %q %q", item.input, num, denom, suffix)
+			}
+			expected, err := ParseQuantity(value)
+			if err != nil {
+				t.Errorf("%v: unexpected error for %s: %v", item.input, value, err)
+				continue
+			}
+			if expected.Cmp(got) != 0 {
+				t.Errorf("%v: not the same as %s", item.input, value)
+				continue
+			}
+		}
+
+		// Try the negative version of everything
+		desired := &inf.Dec{}
+		expect := Quantity{d: infDecAmount{Dec: desired}}
+		for _, item := range table {
+			got, err := ParseQuantity("-" + strings.TrimLeftFunc(item.input, unicode.IsSpace))
+			if err != nil {
+				t.Errorf("-%v: unexpected error: %v", item.input, err)
+				continue
+			}
+			if asDec {
+				got.AsDec()
+			}
+
+			expected := item.expect
+			desired.Neg(expected.AsDec())
+
+			if e, a := expect, got; e.Cmp(a) != 0 {
+				t.Errorf("%v: expected %s, got %s", item.input, e.String(), a.String())
+			}
+			if e, a := expected.Format, got.Format; e != a {
+				t.Errorf("%v: expected %#v, got %#v", item.input, e, a)
+			}
+		}
+
+		// Try everything with an explicit +
+		for _, item := range table {
+			got, err := ParseQuantity("+" + strings.TrimLeftFunc(item.input, unicode.IsSpace))
+			if err != nil {
+				t.Errorf("-%v: unexpected error: %v", item.input, err)
+				continue
+			}
+			if asDec {
+				got.AsDec()
+			}
+
+			if e, a := item.expect, got; e.Cmp(a) != 0 {
+				t.Errorf("%v(%t): expected %s, got %s", item.input, asDec, e.String(), a.String())
+			}
+			if e, a := item.expect.Format, got.Format; e != a {
+				t.Errorf("%v: expected %#v, got %#v", item.input, e, a)
+			}
+		}
+	}
+
+	invalid := []string{
+		"1.1.M",
+		"1+1.0M",
+		"0.1mi",
+		"0.1am",
+		"aoeu",
+		".5i",
+		"1i",
+		"-3.01i",
+		"-3.01e-",
+
+		// trailing whitespace is forbidden
+		" 1",
+		"1 ",
+	}
+	for _, item := range invalid {
+		_, err := ParseQuantity(item)
+		if err == nil {
+			t.Errorf("%v parsed unexpectedly", item)
+		}
+	}
+}
+
+func TestQuantityRoundUp(t *testing.T) {
+	table := []struct {
+		in     string
+		scale  Scale
+		expect Quantity
+		ok     bool
+	}{
+		{"9.01", -3, decQuantity(901, -2, DecimalSI), true},
+		{"9.01", -2, decQuantity(901, -2, DecimalSI), true},
+		{"9.01", -1, decQuantity(91, -1, DecimalSI), false},
+		{"9.01", 0, decQuantity(10, 0, DecimalSI), false},
+		{"9.01", 1, decQuantity(10, 0, DecimalSI), false},
+		{"9.01", 2, decQuantity(100, 0, DecimalSI), false},
+
+		{"-9.01", -3, decQuantity(-901, -2, DecimalSI), true},
+		{"-9.01", -2, decQuantity(-901, -2, DecimalSI), true},
+		{"-9.01", -1, decQuantity(-91, -1, DecimalSI), false},
+		{"-9.01", 0, decQuantity(-10, 0, DecimalSI), false},
+		{"-9.01", 1, decQuantity(-10, 0, DecimalSI), false},
+		{"-9.01", 2, decQuantity(-100, 0, DecimalSI), false},
+	}
+
+	for _, asDec := range []bool{false, true} {
+		for _, item := range table {
+			got, err := ParseQuantity(item.in)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			expect := item.expect.DeepCopy()
+			if asDec {
+				got.AsDec()
+			}
+			if ok := got.RoundUp(item.scale); ok != item.ok {
+				t.Errorf("%s(%d,%t): unexpected ok: %t", item.in, item.scale, asDec, ok)
+			}
+			if got.Cmp(expect) != 0 {
+				t.Errorf("%s(%d,%t): unexpected round: %s vs %s", item.in, item.scale, asDec, got.String(), expect.String())
+			}
+		}
+	}
+}
+
+func TestQuantityCmpInt64AndDec(t *testing.T) {
+	table := []struct {
+		a, b Quantity
+		cmp  int
+	}{
+		{intQuantity(901, -2, DecimalSI), intQuantity(901, -2, DecimalSI), 0},
+		{intQuantity(90, -1, DecimalSI), intQuantity(901, -2, DecimalSI), -1},
+		{intQuantity(901, -2, DecimalSI), intQuantity(900, -2, DecimalSI), 1},
+		{intQuantity(0, 0, DecimalSI), intQuantity(0, 0, DecimalSI), 0},
+		{intQuantity(0, 1, DecimalSI), intQuantity(0, -1, DecimalSI), 0},
+		{intQuantity(0, -1, DecimalSI), intQuantity(0, 1, DecimalSI), 0},
+		{intQuantity(800, -3, DecimalSI), intQuantity(1, 0, DecimalSI), -1},
+		{intQuantity(800, -3, DecimalSI), intQuantity(79, -2, DecimalSI), 1},
+
+		{intQuantity(mostPositive, 0, DecimalSI), intQuantity(1, -1, DecimalSI), 1},
+		{intQuantity(mostPositive, 1, DecimalSI), intQuantity(1, 0, DecimalSI), 1},
+		{intQuantity(mostPositive, 1, DecimalSI), intQuantity(1, 1, DecimalSI), 1},
+		{intQuantity(mostPositive, 1, DecimalSI), intQuantity(0, 1, DecimalSI), 1},
+		{intQuantity(mostPositive, -16, DecimalSI), intQuantity(1, 3, DecimalSI), -1},
+
+		{intQuantity(mostNegative, 0, DecimalSI), intQuantity(0, 0, DecimalSI), -1},
+		{intQuantity(mostNegative, -18, DecimalSI), intQuantity(-1, 0, DecimalSI), -1},
+		{intQuantity(mostNegative, -19, DecimalSI), intQuantity(-1, 0, DecimalSI), 1},
+
+		{intQuantity(1*1000000*1000000*1000000, -17, DecimalSI), intQuantity(1, 1, DecimalSI), 0},
+		{intQuantity(1*1000000*1000000*1000000, -17, DecimalSI), intQuantity(-10, 0, DecimalSI), 1},
+		{intQuantity(-1*1000000*1000000*1000000, -17, DecimalSI), intQuantity(-10, 0, DecimalSI), 0},
+		{intQuantity(1*1000000*1000000*1000000, -17, DecimalSI), intQuantity(1, 0, DecimalSI), 1},
+
+		{intQuantity(1*1000000*1000000*1000000+1, -17, DecimalSI), intQuantity(1, 1, DecimalSI), 1},
+		{intQuantity(1*1000000*1000000*1000000-1, -17, DecimalSI), intQuantity(1, 1, DecimalSI), -1},
+	}
+
+	for _, item := range table {
+		if cmp := item.a.Cmp(item.b); cmp != item.cmp {
+			t.Errorf("%#v: unexpected Cmp: %d", item, cmp)
+		}
+		if cmp := item.b.Cmp(item.a); cmp != -item.cmp {
+			t.Errorf("%#v: unexpected inverted Cmp: %d", item, cmp)
+		}
+	}
+
+	for _, item := range table {
+		a, b := item.a.DeepCopy(), item.b.DeepCopy()
+		a.AsDec()
+		if cmp := a.Cmp(b); cmp != item.cmp {
+			t.Errorf("%#v: unexpected Cmp: %d", item, cmp)
+		}
+		if cmp := b.Cmp(a); cmp != -item.cmp {
+			t.Errorf("%#v: unexpected inverted Cmp: %d", item, cmp)
+		}
+	}
+
+	for _, item := range table {
+		a, b := item.a.DeepCopy(), item.b.DeepCopy()
+		b.AsDec()
+		if cmp := a.Cmp(b); cmp != item.cmp {
+			t.Errorf("%#v: unexpected Cmp: %d", item, cmp)
+		}
+		if cmp := b.Cmp(a); cmp != -item.cmp {
+			t.Errorf("%#v: unexpected inverted Cmp: %d", item, cmp)
+		}
+	}
+
+	for _, item := range table {
+		a, b := item.a.DeepCopy(), item.b.DeepCopy()
+		a.AsDec()
+		b.AsDec()
+		if cmp := a.Cmp(b); cmp != item.cmp {
+			t.Errorf("%#v: unexpected Cmp: %d", item, cmp)
+		}
+		if cmp := b.Cmp(a); cmp != -item.cmp {
+			t.Errorf("%#v: unexpected inverted Cmp: %d", item, cmp)
+		}
+	}
+}
+
+func TestQuantityNeg(t *testing.T) {
+	table := []struct {
+		a   Quantity
+		out string
+	}{
+		{intQuantity(901, -2, DecimalSI), "-9010m"},
+		{decQuantity(901, -2, DecimalSI), "-9010m"},
+	}
+
+	for i, item := range table {
+		out := item.a.DeepCopy()
+		out.Neg()
+		if out.Cmp(item.a) == 0 {
+			t.Errorf("%d: negating an item should not mutate the source: %s", i, out.String())
+		}
+		if out.String() != item.out {
+			t.Errorf("%d: negating did not equal exact value: %s", i, out.String())
+		}
+	}
+}
+
+func TestQuantityString(t *testing.T) {
+	table := []struct {
+		in        Quantity
+		expect    string
+		alternate string
+	}{
+		{decQuantity(1024*1024*1024, 0, BinarySI), "1Gi", "1024Mi"},
+		{decQuantity(300*1024*1024, 0, BinarySI), "300Mi", "307200Ki"},
+		{decQuantity(6*1024, 0, BinarySI), "6Ki", ""},
+		{decQuantity(1001*1024*1024*1024, 0, BinarySI), "1001Gi", "1025024Mi"},
+		{decQuantity(1024*1024*1024*1024, 0, BinarySI), "1Ti", "1024Gi"},
+		{decQuantity(5, 0, BinarySI), "5", "5000m"},
+		{decQuantity(500, -3, BinarySI), "500m", "0.5"},
+		{decQuantity(1, 9, DecimalSI), "1G", "1000M"},
+		{decQuantity(1000, 6, DecimalSI), "1G", "0.001T"},
+		{decQuantity(1000000, 3, DecimalSI), "1G", ""},
+		{decQuantity(1000000000, 0, DecimalSI), "1G", ""},
+		{decQuantity(1, -3, DecimalSI), "1m", "1000u"},
+		{decQuantity(80, -3, DecimalSI), "80m", ""},
+		{decQuantity(1080, -3, DecimalSI), "1080m", "1.08"},
+		{decQuantity(108, -2, DecimalSI), "1080m", "1080000000n"},
+		{decQuantity(10800, -4, DecimalSI), "1080m", ""},
+		{decQuantity(300, 6, DecimalSI), "300M", ""},
+		{decQuantity(1, 12, DecimalSI), "1T", ""},
+		{decQuantity(1234567, 6, DecimalSI), "1234567M", ""},
+		{decQuantity(1234567, -3, BinarySI), "1234567m", ""},
+		{decQuantity(3, 3, DecimalSI), "3k", ""},
+		{decQuantity(1025, 0, BinarySI), "1025", ""},
+		{decQuantity(0, 0, DecimalSI), "0", ""},
+		{decQuantity(0, 0, BinarySI), "0", ""},
+		{decQuantity(1, 9, DecimalExponent), "1e9", ".001e12"},
+		{decQuantity(1, -3, DecimalExponent), "1e-3", "0.001e0"},
+		{decQuantity(1, -9, DecimalExponent), "1e-9", "1000e-12"},
+		{decQuantity(80, -3, DecimalExponent), "80e-3", ""},
+		{decQuantity(300, 6, DecimalExponent), "300e6", ""},
+		{decQuantity(1, 12, DecimalExponent), "1e12", ""},
+		{decQuantity(1, 3, DecimalExponent), "1e3", ""},
+		{decQuantity(3, 3, DecimalExponent), "3e3", ""},
+		{decQuantity(3, 3, DecimalSI), "3k", ""},
+		{decQuantity(0, 0, DecimalExponent), "0", "00"},
+		{decQuantity(1, -9, DecimalSI), "1n", ""},
+		{decQuantity(80, -9, DecimalSI), "80n", ""},
+		{decQuantity(1080, -9, DecimalSI), "1080n", ""},
+		{decQuantity(108, -8, DecimalSI), "1080n", ""},
+		{decQuantity(10800, -10, DecimalSI), "1080n", ""},
+		{decQuantity(1, -6, DecimalSI), "1u", ""},
+		{decQuantity(80, -6, DecimalSI), "80u", ""},
+		{decQuantity(1080, -6, DecimalSI), "1080u", ""},
+	}
+	for _, item := range table {
+		got := item.in.String()
+		if e, a := item.expect, got; e != a {
+			t.Errorf("%#v: expected %v, got %v", item.in, e, a)
+		}
+		q, err := ParseQuantity(item.expect)
+		if err != nil {
+			t.Errorf("%#v: unexpected error: %v", item.expect, err)
+		}
+		if len(q.s) == 0 || q.s != item.expect {
+			t.Errorf("%#v: did not copy canonical string on parse: %s", item.expect, q.s)
+		}
+		if len(item.alternate) == 0 {
+			continue
+		}
+		q, err = ParseQuantity(item.alternate)
+		if err != nil {
+			t.Errorf("%#v: unexpected error: %v", item.expect, err)
+			continue
+		}
+		if len(q.s) != 0 {
+			t.Errorf("%#v: unexpected nested string: %v", item.expect, q.s)
+		}
+		if q.String() != item.expect {
+			t.Errorf("%#v: unexpected alternate canonical: %v", item.expect, q.String())
+		}
+		if len(q.s) == 0 || q.s != item.expect {
+			t.Errorf("%#v: did not set canonical string on ToString: %s", item.expect, q.s)
+		}
+	}
+	desired := &inf.Dec{} // Avoid modifying the values in the table.
+	for _, item := range table {
+		if item.in.Cmp(Quantity{}) == 0 {
+			// Don't expect it to print "-0" ever
+			continue
+		}
+		q := item.in
+		q.d = infDecAmount{desired.Neg(q.AsDec())}
+		if e, a := "-"+item.expect, q.String(); e != a {
+			t.Errorf("%#v: expected %v, got %v", item.in, e, a)
+		}
+	}
+}
+
+func TestQuantityParseEmit(t *testing.T) {
+	table := []struct {
+		in     string
+		expect string
+	}{
+		{"1Ki", "1Ki"},
+		{"1Mi", "1Mi"},
+		{"1Gi", "1Gi"},
+		{"1024Mi", "1Gi"},
+		{"1000M", "1G"},
+		{".001Ki", "1024m"},
+		{".000001Ki", "1024u"},
+		{".000000001Ki", "1024n"},
+		{".000000000001Ki", "2n"},
+	}
+
+	for _, item := range table {
+		q, err := ParseQuantity(item.in)
+		if err != nil {
+			t.Errorf("Couldn't parse %v", item.in)
+			continue
+		}
+		if e, a := item.expect, q.String(); e != a {
+			t.Errorf("%#v: expected %v, got %v", item.in, e, a)
+		}
+	}
+	for _, item := range table {
+		q, err := ParseQuantity("-" + item.in)
+		if err != nil {
+			t.Errorf("Couldn't parse %v", item.in)
+			continue
+		}
+		if q.Cmp(Quantity{}) == 0 {
+			continue
+		}
+		if e, a := "-"+item.expect, q.String(); e != a {
+			t.Errorf("%#v: expected %v, got %v (%#v)", item.in, e, a, q.i)
+		}
+	}
+}
+
+var fuzzer = randfill.New().Funcs(
+	func(q *Quantity, c randfill.Continue) {
+		q.i = Zero
+		if c.Bool() {
+			q.Format = BinarySI
+			if c.Bool() {
+				dec := &inf.Dec{}
+				q.d = infDecAmount{Dec: dec}
+				dec.SetScale(0)
+				dec.SetUnscaled(c.Int63())
+				return
+			}
+			// Be sure to test cases like 1Mi
+			dec := &inf.Dec{}
+			q.d = infDecAmount{Dec: dec}
+			dec.SetScale(0)
+			dec.SetUnscaled(c.Int63n(1024) << uint(10*c.Intn(5)))
+			return
+		}
+		if c.Bool() {
+			q.Format = DecimalSI
+		} else {
+			q.Format = DecimalExponent
+		}
+		if c.Bool() {
+			dec := &inf.Dec{}
+			q.d = infDecAmount{Dec: dec}
+			dec.SetScale(inf.Scale(c.Intn(4)))
+			dec.SetUnscaled(c.Int63())
+			return
+		}
+		// Be sure to test cases like 1M
+		dec := &inf.Dec{}
+		q.d = infDecAmount{Dec: dec}
+		dec.SetScale(inf.Scale(3 - c.Intn(15)))
+		dec.SetUnscaled(c.Int63n(1000))
+	},
+)
+
+func TestQuantityDeepCopy(t *testing.T) {
+	// Test when d is nil
+	slice := []string{"0", "100m", "50m", "10000T"}
+	for _, testCase := range slice {
+		q := MustParse(testCase)
+		if result := q.DeepCopy(); result != q {
+			t.Errorf("Expected: %v, Actual: %v", q, result)
+		}
+	}
+	table := []*inf.Dec{
+		dec(0, 0).Dec,
+		dec(10, 0).Dec,
+		dec(-10, 0).Dec,
+	}
+	// Test when i is {0,0}
+	for _, testCase := range table {
+		q := Quantity{d: infDecAmount{testCase}, Format: DecimalSI}
+		result := q.DeepCopy()
+		if q.d.Cmp(result.AsDec()) != 0 {
+			t.Errorf("Expected: %v, Actual: %v", q.String(), result.String())
+		}
+		result = Quantity{d: infDecAmount{dec(2, 0).Dec}, Format: DecimalSI}
+		if q.d.Cmp(result.AsDec()) == 0 {
+			t.Errorf("Modifying result has affected q")
+		}
+	}
+}
+
+func TestJSON(t *testing.T) {
+	for i := 0; i < 500; i++ {
+		q := &Quantity{}
+		fuzzer.Fill(q)
+		b, err := json.Marshal(q)
+		if err != nil {
+			t.Errorf("error encoding %v: %v", q, err)
+			continue
+		}
+		q2 := &Quantity{}
+		err = json.Unmarshal(b, q2)
+		if err != nil {
+			t.Logf("%d: %s", i, string(b))
+			t.Errorf("%v: error decoding %v: %v", q, string(b), err)
+		}
+		if q2.Cmp(*q) != 0 {
+			t.Errorf("Expected equal: %v, %v (json was '%v')", q, q2, string(b))
+		}
+	}
+}
+
+func TestJSONWhitespace(t *testing.T) {
+	q := Quantity{}
+	testCases := []struct {
+		in     string
+		expect string
+	}{
+		{`" 1"`, "1"},
+		{`"1 "`, "1"},
+		{`1`, "1"},
+		{` 1`, "1"},
+		{`1 `, "1"},
+		{`10`, "10"},
+		{`-1`, "-1"},
+		{` -1`, "-1"},
+	}
+	for _, test := range testCases {
+		if err := json.Unmarshal([]byte(test.in), &q); err != nil {
+			t.Errorf("%q: %v", test.in, err)
+		}
+		if q.String() != test.expect {
+			t.Errorf("unexpected string: %q", q.String())
+		}
+	}
+}
+
+func TestMilliNewSet(t *testing.T) {
+	table := []struct {
+		value  int64
+		format Format
+		expect string
+		exact  bool
+	}{
+		{1, DecimalSI, "1m", true},
+		{1000, DecimalSI, "1", true},
+		{1234000, DecimalSI, "1234", true},
+		{1024, BinarySI, "1024m", false}, // Format changes
+		{1000000, "invalidFormatDefaultsToExponent", "1e3", true},
+		{1024 * 1024, BinarySI, "1048576m", false}, // Format changes
+	}
+
+	for _, item := range table {
+		q := NewMilliQuantity(item.value, item.format)
+		if e, a := item.expect, q.String(); e != a {
+			t.Errorf("Expected %v, got %v; %#v", e, a, q)
+		}
+		if !item.exact {
+			continue
+		}
+		q2, err := ParseQuantity(q.String())
+		if err != nil {
+			t.Errorf("Round trip failed on %v", q)
+		}
+		if e, a := item.value, q2.MilliValue(); e != a {
+			t.Errorf("Expected %v, got %v", e, a)
+		}
+	}
+
+	for _, item := range table {
+		q := NewQuantity(0, item.format)
+		q.SetMilli(item.value)
+		if e, a := item.expect, q.String(); e != a {
+			t.Errorf("Set: Expected %v, got %v; %#v", e, a, q)
+		}
+	}
+}
+
+func TestNewSet(t *testing.T) {
+	table := []struct {
+		value  int64
+		format Format
+		expect string
+	}{
+		{1, DecimalSI, "1"},
+		{1000, DecimalSI, "1k"},
+		{1234000, DecimalSI, "1234k"},
+		{1024, BinarySI, "1Ki"},
+		{1000000, "invalidFormatDefaultsToExponent", "1e6"},
+		{1024 * 1024, BinarySI, "1Mi"},
+	}
+
+	for _, asDec := range []bool{false, true} {
+		for _, item := range table {
+			q := NewQuantity(item.value, item.format)
+			if asDec {
+				q.ToDec()
+			}
+			if e, a := item.expect, q.String(); e != a {
+				t.Errorf("Expected %v, got %v; %#v", e, a, q)
+			}
+			q2, err := ParseQuantity(q.String())
+			if err != nil {
+				t.Errorf("Round trip failed on %v", q)
+			}
+			if e, a := item.value, q2.Value(); e != a {
+				t.Errorf("Expected %v, got %v", e, a)
+			}
+		}
+
+		for _, item := range table {
+			q := NewQuantity(0, item.format)
+			q.Set(item.value)
+			if asDec {
+				q.ToDec()
+			}
+			if e, a := item.expect, q.String(); e != a {
+				t.Errorf("Set: Expected %v, got %v; %#v", e, a, q)
+			}
+		}
+	}
+}
+
+func TestNewScaledSet(t *testing.T) {
+	table := []struct {
+		value  int64
+		scale  Scale
+		expect string
+	}{
+		{1, Nano, "1n"},
+		{1000, Nano, "1u"},
+		{1, Micro, "1u"},
+		{1000, Micro, "1m"},
+		{1, Milli, "1m"},
+		{1000, Milli, "1"},
+		{1, 0, "1"},
+		{0, Nano, "0"},
+		{0, Micro, "0"},
+		{0, Milli, "0"},
+		{0, 0, "0"},
+	}
+
+	for _, item := range table {
+		q := NewScaledQuantity(item.value, item.scale)
+		if e, a := item.expect, q.String(); e != a {
+			t.Errorf("Expected %v, got %v; %#v", e, a, q)
+		}
+		q2, err := ParseQuantity(q.String())
+		if err != nil {
+			t.Errorf("Round trip failed on %v", q)
+		}
+		if e, a := item.value, q2.ScaledValue(item.scale); e != a {
+			t.Errorf("Expected %v, got %v", e, a)
+		}
+		q3 := NewQuantity(0, DecimalSI)
+		q3.SetScaled(item.value, item.scale)
+		if q.Cmp(*q3) != 0 {
+			t.Errorf("Expected %v and %v to be equal", q, q3)
+		}
+	}
+}
+
+func TestScaledValue(t *testing.T) {
+	table := []struct {
+		fromScale Scale
+		toScale   Scale
+		expected  int64
+	}{
+		{Nano, Nano, 1},
+		{Nano, Micro, 1},
+		{Nano, Milli, 1},
+		{Nano, 0, 1},
+		{Micro, Nano, 1000},
+		{Micro, Micro, 1},
+		{Micro, Milli, 1},
+		{Micro, 0, 1},
+		{Milli, Nano, 1000 * 1000},
+		{Milli, Micro, 1000},
+		{Milli, Milli, 1},
+		{Milli, 0, 1},
+		{0, Nano, 1000 * 1000 * 1000},
+		{0, Micro, 1000 * 1000},
+		{0, Milli, 1000},
+		{0, 0, 1},
+		{2, -2, 100 * 100},
+	}
+
+	for _, item := range table {
+		q := NewScaledQuantity(1, item.fromScale)
+		if e, a := item.expected, q.ScaledValue(item.toScale); e != a {
+			t.Errorf("%v to %v: Expected %v, got %v", item.fromScale, item.toScale, e, a)
+		}
+	}
+}
+
+func TestUninitializedNoCrash(t *testing.T) {
+	var q Quantity
+
+	q.Value()
+	q.MilliValue()
+	q.DeepCopy()
+	_ = q.String()
+	q.MarshalJSON()
+}
+
+func TestDeepCopy(t *testing.T) {
+	q := NewQuantity(5, DecimalSI)
+	c := q.DeepCopy()
+	c.Set(6)
+	if q.Value() == 6 {
+		t.Errorf("Copy didn't")
+	}
+}
+
+func TestSub(t *testing.T) {
+	tests := []struct {
+		a        Quantity
+		b        Quantity
+		expected Quantity
+	}{
+		{decQuantity(10, 0, DecimalSI), decQuantity(1, 1, DecimalSI), decQuantity(0, 0, DecimalSI)},
+		{decQuantity(10, 0, DecimalSI), decQuantity(1, 0, BinarySI), decQuantity(9, 0, DecimalSI)},
+		{decQuantity(10, 0, BinarySI), decQuantity(1, 0, DecimalSI), decQuantity(9, 0, BinarySI)},
+		{Quantity{Format: DecimalSI}, decQuantity(50, 0, DecimalSI), decQuantity(-50, 0, DecimalSI)},
+		{decQuantity(50, 0, DecimalSI), Quantity{Format: DecimalSI}, decQuantity(50, 0, DecimalSI)},
+		{Quantity{Format: DecimalSI}, Quantity{Format: DecimalSI}, decQuantity(0, 0, DecimalSI)},
+	}
+
+	for i, test := range tests {
+		test.a.Sub(test.b)
+		if test.a.Cmp(test.expected) != 0 {
+			t.Errorf("[%d] Expected %q, got %q", i, test.expected.String(), test.a.String())
+		}
+	}
+}
+
+func TestNeg(t *testing.T) {
+	tests := []struct {
+		a        Quantity
+		b        Quantity
+		expected Quantity
+	}{
+		{a: intQuantity(0, 0, DecimalSI), expected: intQuantity(0, 0, DecimalSI)},
+		{a: Quantity{}, expected: Quantity{}},
+		{a: intQuantity(10, 0, BinarySI), expected: intQuantity(-10, 0, BinarySI)},
+		{a: intQuantity(-10, 0, BinarySI), expected: intQuantity(10, 0, BinarySI)},
+		{a: decQuantity(0, 0, DecimalSI), expected: intQuantity(0, 0, DecimalSI)},
+		{a: decQuantity(10, 0, BinarySI), expected: intQuantity(-10, 0, BinarySI)},
+		{a: decQuantity(-10, 0, BinarySI), expected: intQuantity(10, 0, BinarySI)},
+	}
+
+	for i, test := range tests {
+		a := test.a.DeepCopy()
+		a.Neg()
+		// ensure value is same
+		if a.Cmp(test.expected) != 0 {
+			t.Errorf("[%d] Expected %q, got %q", i, test.expected.String(), a.String())
+		}
+	}
+}
+
+func TestAdd(t *testing.T) {
+	tests := []struct {
+		a        Quantity
+		b        Quantity
+		expected Quantity
+	}{
+		{decQuantity(10, 0, DecimalSI), decQuantity(1, 1, DecimalSI), decQuantity(20, 0, DecimalSI)},
+		{decQuantity(10, 0, DecimalSI), decQuantity(1, 0, BinarySI), decQuantity(11, 0, DecimalSI)},
+		{decQuantity(10, 0, BinarySI), decQuantity(1, 0, DecimalSI), decQuantity(11, 0, BinarySI)},
+		{Quantity{Format: DecimalSI}, decQuantity(50, 0, DecimalSI), decQuantity(50, 0, DecimalSI)},
+		{decQuantity(50, 0, DecimalSI), Quantity{Format: DecimalSI}, decQuantity(50, 0, DecimalSI)},
+		{Quantity{Format: DecimalSI}, Quantity{Format: DecimalSI}, decQuantity(0, 0, DecimalSI)},
+	}
+
+	for i, test := range tests {
+		test.a.Add(test.b)
+		if test.a.Cmp(test.expected) != 0 {
+			t.Errorf("[%d] Expected %q, got %q", i, test.expected.String(), test.a.String())
+		}
+	}
+}
+
+func TestMul(t *testing.T) {
+	tests := []struct {
+		a        Quantity
+		b        int64
+		expected Quantity
+		ok       bool
+	}{
+		{decQuantity(10, 0, DecimalSI), 10, decQuantity(100, 0, DecimalSI), true},
+		{decQuantity(10, 0, DecimalSI), 1, decQuantity(10, 0, DecimalSI), true},
+		{decQuantity(10, 0, BinarySI), 1, decQuantity(10, 0, BinarySI), true},
+		{Quantity{Format: DecimalSI}, 50, decQuantity(0, 0, DecimalSI), true},
+		{decQuantity(50, 0, DecimalSI), 0, decQuantity(0, 0, DecimalSI), true},
+		{Quantity{Format: DecimalSI}, 0, decQuantity(0, 0, DecimalSI), true},
+
+		{decQuantity(10, 0, DecimalSI), -10, decQuantity(-100, 0, DecimalSI), true},
+		{decQuantity(-10, 0, DecimalSI), 1, decQuantity(-10, 0, DecimalSI), true},
+		{decQuantity(10, 0, BinarySI), -1, decQuantity(-10, 0, BinarySI), true},
+		{decQuantity(-50, 0, DecimalSI), 0, decQuantity(0, 0, DecimalSI), true},
+		{decQuantity(-50, 0, DecimalSI), -50, decQuantity(2500, 0, DecimalSI), true},
+		{Quantity{Format: DecimalSI}, -50, decQuantity(0, 0, DecimalSI), true},
+		{decQuantity(mostPositive, 0, DecimalSI), 0, decQuantity(0, 1, DecimalSI), true},
+		{decQuantity(mostPositive, 0, DecimalSI), 1, decQuantity(mostPositive, 0, DecimalSI), true},
+		{decQuantity(mostPositive, 0, DecimalSI), -1, decQuantity(-mostPositive, 0, DecimalSI), true},
+		{decQuantity(mostPositive/2, 0, DecimalSI), 2, decQuantity((mostPositive/2)*2, 0, DecimalSI), true},
+		{decQuantity(mostPositive/-2, 0, DecimalSI), -2, decQuantity((mostPositive/2)*2, 0, DecimalSI), true},
+		{decQuantity(mostPositive, 0, DecimalSI), 2,
+			bigDecQuantity(big.NewInt(0).Mul(bigMostPositive, big.NewInt(2)), 0, DecimalSI), false},
+		{decQuantity(mostPositive, 0, DecimalSI), 10, decQuantity(mostPositive, 1, DecimalSI), false},
+		{decQuantity(mostPositive, 0, DecimalSI), -10, decQuantity(-mostPositive, 1, DecimalSI), false},
+		{decQuantity(mostNegative, 0, DecimalSI), 0, decQuantity(0, 1, DecimalSI), true},
+		{decQuantity(mostNegative, 0, DecimalSI), 1, decQuantity(mostNegative, 0, DecimalSI), true},
+		{decQuantity(mostNegative, 0, DecimalSI), -1,
+			bigDecQuantity(big.NewInt(0).Add(bigMostPositive, big.NewInt(1)), 0, DecimalSI), false},
+		{decQuantity(mostNegative/2, 0, DecimalSI), 2, decQuantity(mostNegative, 0, DecimalSI), true},
+		{decQuantity(mostNegative/-2, 0, DecimalSI), -2, decQuantity(mostNegative, 0, DecimalSI), true},
+		{decQuantity(mostNegative, 0, DecimalSI), 2,
+			bigDecQuantity(big.NewInt(0).Mul(bigMostNegative, big.NewInt(2)), 0, DecimalSI), false},
+		{decQuantity(mostNegative, 0, DecimalSI), 10, decQuantity(mostNegative, 1, DecimalSI), false},
+		{decQuantity(mostNegative, 0, DecimalSI), -10,
+			bigDecQuantity(big.NewInt(0).Add(bigMostPositive, big.NewInt(1)), 1, DecimalSI), false},
+	}
+
+	for i, test := range tests {
+		if ok := test.a.Mul(test.b); test.ok != ok {
+			t.Errorf("[%d] Expected ok: %t, got ok: %t", i, test.ok, ok)
+		}
+		if test.a.Cmp(test.expected) != 0 {
+			t.Errorf("[%d] Expected %q, got %q", i, test.expected.AsDec().String(), test.a.AsDec().String())
+		}
+	}
+}
+
+func TestAddSubRoundTrip(t *testing.T) {
+	for k := -10; k <= 10; k++ {
+		q := Quantity{Format: DecimalSI}
+		var order []int64
+		for i := 0; i < 100; i++ {
+			j := rand.Int63()
+			order = append(order, j)
+			q.Add(*NewScaledQuantity(j, Scale(k)))
+		}
+		for _, j := range order {
+			q.Sub(*NewScaledQuantity(j, Scale(k)))
+		}
+		if !q.IsZero() {
+			t.Errorf("addition and subtraction did not cancel: %s", &q)
+		}
+	}
+}
+
+func TestAddSubRoundTripAcrossScales(t *testing.T) {
+	q := Quantity{Format: DecimalSI}
+	var order []int64
+	for i := 0; i < 100; i++ {
+		j := rand.Int63()
+		order = append(order, j)
+		q.Add(*NewScaledQuantity(j, Scale(j%20-10)))
+	}
+	for _, j := range order {
+		q.Sub(*NewScaledQuantity(j, Scale(j%20-10)))
+	}
+	if !q.IsZero() {
+		t.Errorf("addition and subtraction did not cancel: %s", &q)
+	}
+}
+
+func TestNegateRoundTrip(t *testing.T) {
+	for _, asDec := range []bool{false, true} {
+		for k := -10; k <= 10; k++ {
+			for i := 0; i < 100; i++ {
+				j := rand.Int63()
+				q := *NewScaledQuantity(j, Scale(k))
+				if asDec {
+					q.AsDec()
+				}
+
+				b := q.DeepCopy()
+				b.Neg()
+				b.Neg()
+				if b.Cmp(q) != 0 {
+					t.Errorf("double negation did not cancel: %s", &q)
+				}
+			}
+		}
+	}
+}
+
+func TestQuantityAsApproximateFloat64(t *testing.T) {
+	// NOTE: this table should be kept in sync with TestQuantityAsFloat64Slow
+	table := []struct {
+		in  Quantity
+		out float64
+	}{
+		{decQuantity(0, 0, DecimalSI), 0.0},
+		{decQuantity(0, 0, DecimalExponent), 0.0},
+		{decQuantity(0, 0, BinarySI), 0.0},
+
+		{decQuantity(1, 0, DecimalSI), 1},
+		{decQuantity(1, 0, DecimalExponent), 1},
+		{decQuantity(1, 0, BinarySI), 1},
+
+		// Binary suffixes
+		{decQuantity(1024, 0, BinarySI), 1024},
+		{decQuantity(8*1024, 0, BinarySI), 8 * 1024},
+		{decQuantity(7*1024*1024, 0, BinarySI), 7 * 1024 * 1024},
+		{decQuantity(7*1024*1024, 1, BinarySI), (7 * 1024 * 1024) * 10},
+		{decQuantity(7*1024*1024, 4, BinarySI), (7 * 1024 * 1024) * 10000},
+		{decQuantity(7*1024*1024, 8, BinarySI), (7 * 1024 * 1024) * 100000000},
+		{decQuantity(7*1024*1024, -1, BinarySI), (7 * 1024 * 1024) * math.Pow10(-1)}, // '* Pow10' and '/ float(10)' do not round the same way
+		{decQuantity(7*1024*1024, -8, BinarySI), (7 * 1024 * 1024) / float64(100000000)},
+
+		{decQuantity(1024, 0, DecimalSI), 1024},
+		{decQuantity(8*1024, 0, DecimalSI), 8 * 1024},
+		{decQuantity(7*1024*1024, 0, DecimalSI), 7 * 1024 * 1024},
+		{decQuantity(7*1024*1024, 1, DecimalSI), (7 * 1024 * 1024) * 10},
+		{decQuantity(7*1024*1024, 4, DecimalSI), (7 * 1024 * 1024) * 10000},
+		{decQuantity(7*1024*1024, 8, DecimalSI), (7 * 1024 * 1024) * 100000000},
+		{decQuantity(7*1024*1024, -1, DecimalSI), (7 * 1024 * 1024) * math.Pow10(-1)}, // '* Pow10' and '/ float(10)' do not round the same way
+		{decQuantity(7*1024*1024, -8, DecimalSI), (7 * 1024 * 1024) / float64(100000000)},
+
+		{decQuantity(1024, 0, DecimalExponent), 1024},
+		{decQuantity(8*1024, 0, DecimalExponent), 8 * 1024},
+		{decQuantity(7*1024*1024, 0, DecimalExponent), 7 * 1024 * 1024},
+		{decQuantity(7*1024*1024, 1, DecimalExponent), (7 * 1024 * 1024) * 10},
+		{decQuantity(7*1024*1024, 4, DecimalExponent), (7 * 1024 * 1024) * 10000},
+		{decQuantity(7*1024*1024, 8, DecimalExponent), (7 * 1024 * 1024) * 100000000},
+		{decQuantity(7*1024*1024, -1, DecimalExponent), (7 * 1024 * 1024) * math.Pow10(-1)}, // '* Pow10' and '/ float(10)' do not round the same way
+		{decQuantity(7*1024*1024, -8, DecimalExponent), (7 * 1024 * 1024) / float64(100000000)},
+
+		// very large numbers
+		{Quantity{d: maxAllowed, Format: DecimalSI}, math.MaxInt64},
+		{Quantity{d: maxAllowed, Format: BinarySI}, math.MaxInt64},
+		{decQuantity(12, 18, DecimalSI), 1.2e19},
+
+		// infinities caused due to float64 overflow
+		{decQuantity(12, 500, DecimalSI), math.Inf(0)},
+		{decQuantity(-12, 500, DecimalSI), math.Inf(-1)},
+	}
+
+	for i, item := range table {
+		t.Run(fmt.Sprintf("%s %s", item.in.Format, item.in.String()), func(t *testing.T) {
+			out := item.in.AsApproximateFloat64()
+			if out != item.out {
+				t.Fatalf("test %d expected %v, got %v", i+1, item.out, out)
+			}
+			if item.in.d.Dec != nil {
+				if i, ok := item.in.AsInt64(); ok {
+					q := intQuantity(i, 0, item.in.Format)
+					out := q.AsApproximateFloat64()
+					if out != item.out {
+						t.Fatalf("as int quantity: expected %v, got %v", item.out, out)
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestQuantityAsFloat64Slow(t *testing.T) {
+	// NOTE: this table should be kept in sync with TestQuantityAsApproximateFloat64
+	table := []struct {
+		in  Quantity
+		out float64
+	}{
+		{decQuantity(0, 0, DecimalSI), 0.0},
+		{decQuantity(0, 0, DecimalExponent), 0.0},
+		{decQuantity(0, 0, BinarySI), 0.0},
+
+		{decQuantity(1, 0, DecimalSI), 1},
+		{decQuantity(1, 0, DecimalExponent), 1},
+		{decQuantity(1, 0, BinarySI), 1},
+
+		// Binary suffixes
+		{decQuantity(1024, 0, BinarySI), 1024},
+		{decQuantity(8*1024, 0, BinarySI), 8 * 1024},
+		{decQuantity(7*1024*1024, 0, BinarySI), 7 * 1024 * 1024},
+		{decQuantity(7*1024*1024, 1, BinarySI), (7 * 1024 * 1024) * 10},
+		{decQuantity(7*1024*1024, 4, BinarySI), (7 * 1024 * 1024) * 10000},
+		{decQuantity(7*1024*1024, 8, BinarySI), (7 * 1024 * 1024) * 100000000},
+		{decQuantity(7*1024*1024, -1, BinarySI), (7 * 1024 * 1024) / float64(10)},
+		{decQuantity(7*1024*1024, -8, BinarySI), (7 * 1024 * 1024) / float64(100000000)},
+
+		{decQuantity(1024, 0, DecimalSI), 1024},
+		{decQuantity(8*1024, 0, DecimalSI), 8 * 1024},
+		{decQuantity(7*1024*1024, 0, DecimalSI), 7 * 1024 * 1024},
+		{decQuantity(7*1024*1024, 1, DecimalSI), (7 * 1024 * 1024) * 10},
+		{decQuantity(7*1024*1024, 4, DecimalSI), (7 * 1024 * 1024) * 10000},
+		{decQuantity(7*1024*1024, 8, DecimalSI), (7 * 1024 * 1024) * 100000000},
+		{decQuantity(7*1024*1024, -1, DecimalSI), (7 * 1024 * 1024) / float64(10)},
+		{decQuantity(7*1024*1024, -8, DecimalSI), (7 * 1024 * 1024) / float64(100000000)},
+
+		{decQuantity(1024, 0, DecimalExponent), 1024},
+		{decQuantity(8*1024, 0, DecimalExponent), 8 * 1024},
+		{decQuantity(7*1024*1024, 0, DecimalExponent), 7 * 1024 * 1024},
+		{decQuantity(7*1024*1024, 1, DecimalExponent), (7 * 1024 * 1024) * 10},
+		{decQuantity(7*1024*1024, 4, DecimalExponent), (7 * 1024 * 1024) * 10000},
+		{decQuantity(7*1024*1024, 8, DecimalExponent), (7 * 1024 * 1024) * 100000000},
+		{decQuantity(7*1024*1024, -1, DecimalExponent), (7 * 1024 * 1024) / float64(10)},
+		{decQuantity(7*1024*1024, -8, DecimalExponent), (7 * 1024 * 1024) / float64(100000000)},
+
+		// very large numbers
+		{Quantity{d: maxAllowed, Format: DecimalSI}, math.MaxInt64},
+		{Quantity{d: maxAllowed, Format: BinarySI}, math.MaxInt64},
+		{decQuantity(12, 18, DecimalSI), 1.2e19},
+
+		// infinities caused due to float64 overflow
+		{decQuantity(12, 500, DecimalSI), math.Inf(0)},
+		{decQuantity(-12, 500, DecimalSI), math.Inf(-1)},
+	}
+
+	for i, item := range table {
+		t.Run(fmt.Sprintf("%s %s", item.in.Format, item.in.String()), func(t *testing.T) {
+			out := item.in.AsFloat64Slow()
+			if out != item.out {
+				t.Fatalf("test %d expected %v, got %v", i+1, item.out, out)
+			}
+			if item.in.d.Dec != nil {
+				if i, ok := item.in.AsInt64(); ok {
+					q := intQuantity(i, 0, item.in.Format)
+					out := q.AsFloat64Slow()
+					if out != item.out {
+						t.Fatalf("as int quantity: expected %v, got %v", item.out, out)
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestStringQuantityAsApproximateFloat64(t *testing.T) {
+	table := []struct {
+		in  string
+		out float64
+	}{
+		{"2Ki", 2048},
+		{"1.1Ki", 1126.4e+0},
+		{"1Mi", 1.048576e+06},
+		{"2Gi", 2.147483648e+09},
+	}
+
+	for _, item := range table {
+		t.Run(item.in, func(t *testing.T) {
+			in, err := ParseQuantity(item.in)
+			if err != nil {
+				t.Fatal(err)
+			}
+			out := in.AsApproximateFloat64()
+			if out != item.out {
+				t.Fatalf("expected %v, got %v", item.out, out)
+			}
+			if in.d.Dec != nil {
+				if i, ok := in.AsInt64(); ok {
+					q := intQuantity(i, 0, in.Format)
+					out := q.AsApproximateFloat64()
+					if out != item.out {
+						t.Fatalf("as int quantity: expected %v, got %v", item.out, out)
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestStringQuantityAsFloat64Slow(t *testing.T) {
+	table := []struct {
+		in  string
+		out float64
+	}{
+		{"2Ki", 2048},
+		{"1.1Ki", 1126.4e+0},
+		{"1Mi", 1.048576e+06},
+		{"2Gi", 2.147483648e+09},
+	}
+
+	for _, item := range table {
+		t.Run(item.in, func(t *testing.T) {
+			in, err := ParseQuantity(item.in)
+			if err != nil {
+				t.Fatal(err)
+			}
+			out := in.AsFloat64Slow()
+			if out != item.out {
+				t.Fatalf("expected %v, got %v", item.out, out)
+			}
+			if in.d.Dec != nil {
+				if i, ok := in.AsInt64(); ok {
+					q := intQuantity(i, 0, in.Format)
+					out := q.AsFloat64Slow()
+					if out != item.out {
+						t.Fatalf("as int quantity: expected %v, got %v", item.out, out)
+					}
+				}
+			}
+		})
+	}
+}
+
+func benchmarkQuantities() []Quantity {
+	return []Quantity{
+		intQuantity(1024*1024*1024, 0, BinarySI),
+		intQuantity(1024*1024*1024*1024, 0, BinarySI),
+		intQuantity(1000000, 3, DecimalSI),
+		intQuantity(1000000000, 0, DecimalSI),
+		intQuantity(1, -3, DecimalSI),
+		intQuantity(80, -3, DecimalSI),
+		intQuantity(1080, -3, DecimalSI),
+		intQuantity(0, 0, BinarySI),
+		intQuantity(1, 9, DecimalExponent),
+		intQuantity(1, -9, DecimalSI),
+		intQuantity(1000000, 10, DecimalSI),
+	}
+}
+
+func BenchmarkQuantityString(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	var s string
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		q.s = ""
+		s = q.String()
+	}
+	b.StopTimer()
+	if len(s) == 0 {
+		b.Fatal(s)
+	}
+}
+
+func BenchmarkQuantityStringPrecalc(b *testing.B) {
+	values := benchmarkQuantities()
+	for i := range values {
+		_ = values[i].String()
+	}
+	b.ResetTimer()
+	var s string
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		s = q.String()
+	}
+	b.StopTimer()
+	if len(s) == 0 {
+		b.Fatal(s)
+	}
+}
+
+func BenchmarkQuantityStringBinarySI(b *testing.B) {
+	values := benchmarkQuantities()
+	for i := range values {
+		values[i].Format = BinarySI
+	}
+	b.ResetTimer()
+	var s string
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		q.s = ""
+		s = q.String()
+	}
+	b.StopTimer()
+	if len(s) == 0 {
+		b.Fatal(s)
+	}
+}
+
+func BenchmarkQuantityMarshalJSON(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		q.s = ""
+		if _, err := q.MarshalJSON(); err != nil {
+			b.Fatal(err)
+		}
+	}
+	b.StopTimer()
+}
+
+func BenchmarkQuantityUnmarshalJSON(b *testing.B) {
+	values := benchmarkQuantities()
+	var json [][]byte
+	for _, v := range values {
+		data, _ := v.MarshalJSON()
+		json = append(json, data)
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		var q Quantity
+		if err := q.UnmarshalJSON(json[i%len(values)]); err != nil {
+			b.Fatal(err)
+		}
+	}
+	b.StopTimer()
+}
+
+func BenchmarkParseQuantity(b *testing.B) {
+	values := benchmarkQuantities()
+	var strings []string
+	for _, v := range values {
+		strings = append(strings, v.String())
+	}
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		if _, err := ParseQuantity(strings[i%len(values)]); err != nil {
+			b.Fatal(err)
+		}
+	}
+	b.StopTimer()
+}
+
+func BenchmarkCanonicalize(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	buffer := make([]byte, 0, 100)
+	for i := 0; i < b.N; i++ {
+		s, _ := values[i%len(values)].CanonicalizeBytes(buffer)
+		if len(s) == 0 {
+			b.Fatal(s)
+		}
+	}
+	b.StopTimer()
+}
+
+func BenchmarkQuantityRoundUp(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		copied := q
+		copied.RoundUp(-3)
+	}
+	b.StopTimer()
+}
+
+func BenchmarkQuantityCopy(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		values[i%len(values)].DeepCopy()
+	}
+	b.StopTimer()
+}
+
+func BenchmarkQuantityAdd(b *testing.B) {
+	values := benchmarkQuantities()
+	base := &Quantity{}
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		base.d.Dec = nil
+		base.i = int64Amount{value: 100}
+		base.Add(q)
+	}
+	b.StopTimer()
+}
+
+func BenchmarkQuantityCmp(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		if q.Cmp(q) != 0 {
+			b.Fatal(q)
+		}
+	}
+	b.StopTimer()
+}
+
+func BenchmarkQuantityAsApproximateFloat64(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		if q.AsApproximateFloat64() == -1 {
+			b.Fatal(q)
+		}
+	}
+	b.StopTimer()
+}
+
+func BenchmarkQuantityAsFloat64Slow(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		if q.AsFloat64Slow() == -1 {
+			b.Fatal(q)
+		}
+	}
+	b.StopTimer()
+}
+
+var _ pflag.Value = &QuantityValue{}
+
+func TestQuantityValueSet(t *testing.T) {
+	q := QuantityValue{}
+
+	if err := q.Set("invalid"); err == nil {
+
+		t.Error("'invalid' did not trigger a parse error")
+	}
+
+	if err := q.Set("1Mi"); err != nil {
+		t.Errorf("parsing 1Mi should have worked, got: %v", err)
+	}
+	if q.Value() != 1024*1024 {
+		t.Errorf("quantity should have been set to 1Mi, got: %v", q)
+	}
+
+	data, err := json.Marshal(q)
+	if err != nil {
+		t.Errorf("unexpected encoding error: %v", err)
+	}
+	expected := `"1Mi"`
+	if string(data) != expected {
+		t.Errorf("expected 1Mi value to be encoded as %q, got: %q", expected, string(data))
+	}
+}
+
+func ExampleQuantityValue() {
+	q := QuantityValue{
+		Quantity: MustParse("1Mi"),
+	}
+	fs := pflag.FlagSet{}
+	fs.SetOutput(os.Stdout)
+	fs.Var(&q, "mem", "sets amount of memory")
+	fs.PrintDefaults()
+	// Output:
+	// --mem quantity   sets amount of memory (default 1Mi)
+}
+
+func TestQuantityUnmarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		in         []byte
+		want       Quantity
+		errMessage string
+	}{
+		{
+			name: "null",
+			in:   []byte{0xf6}, // null
+			want: Quantity{},
+		},
+		{
+			name: "text string input",
+			in:   []byte("\x621M"), // "1M"
+			want: Quantity{i: int64Amount{value: 1, scale: 6}},
+		},
+		{
+			name: "byte string input",
+			in:   []byte("\x421M"), // '1M'
+			want: Quantity{i: int64Amount{value: 1, scale: 6}},
+		},
+		{
+			name: "whitespace",
+			in:   []byte("\x4a \t\n\r1M \t\n\r"), // h'20090a0d314d20090a0d'
+			want: Quantity{i: int64Amount{value: 1, scale: 6}},
+		},
+		{
+			name:       "empty byte string",
+			in:         []byte{0x40},
+			errMessage: ErrFormatWrong.Error(),
+		},
+		{
+			name:       "empty text string",
+			in:         []byte{0x60},
+			errMessage: ErrFormatWrong.Error(),
+		},
+		{
+			name:       "unsupported input type",
+			in:         []byte{0x07}, // 7
+			errMessage: "cbor: cannot unmarshal positive integer into Go value of type string",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var got Quantity
+			if err := got.UnmarshalCBOR(tc.in); err != nil {
+				if tc.errMessage == "" {
+					t.Fatalf("want nil error, got: %v", err)
+				} else if gotMessage := err.Error(); tc.errMessage != gotMessage {
+					t.Fatalf("want error: %q, got: %q", tc.errMessage, gotMessage)
+				}
+			} else if tc.errMessage != "" {
+				t.Fatalf("got nil error, want: %s", tc.errMessage)
+			}
+
+			if diff := cmp.Diff(tc.want, got); diff != "" {
+				t.Errorf("unexpected diff:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestQuantityRoundtripCBOR(t *testing.T) {
+	for i := 0; i < 500; i++ {
+		var initial, final Quantity
+		fuzzer.Fill(&initial)
+		b, err := cbor.Marshal(initial)
+		if err != nil {
+			t.Errorf("error encoding %v: %v", initial, err)
+			continue
+		}
+		err = cbor.Unmarshal(b, &final)
+		if err != nil {
+			t.Errorf("%v: error decoding %v: %v", initial, string(b), err)
+		}
+		if final.Cmp(initial) != 0 {
+			diag, err := cbor.Diagnose(b)
+			if err != nil {
+				t.Logf("failed to produce diagnostic encoding of 0x%x: %v", b, err)
+			}
+			t.Errorf("Expected equal: %v, %v (cbor was '%s')", initial, final, diag)
+		}
+	}
+}
+
+func TestParseQuantity(t *testing.T) {
+	ptrDec := func(s string) *infDecAmount {
+		d, ok := new(inf.Dec).SetString(s)
+		if !ok {
+			t.Fatalf("invalid dec: %s", s)
+		}
+		return &infDecAmount{d}
+	}
+
+	tests := []struct {
+		input       string
+		wantAsInt64 *int64
+		wantAsDec   *infDecAmount
+		canonical   string
+	}{
+		// min/max 18 digits
+		{input: "-999999999999999999", wantAsInt64: ptr.To[int64](-999999999999999999), wantAsDec: ptrDec("-999999999999999999")},
+		{input: "999999999999999999", wantAsInt64: ptr.To[int64](999999999999999999), wantAsDec: ptrDec("999999999999999999")},
+		// .0
+		{input: "-999999999999999999.0", wantAsInt64: nil, wantAsDec: ptrDec("-999999999999999999"), canonical: "-999999999999999999"},
+		{input: "999999999999999999.0", wantAsInt64: nil, wantAsDec: ptrDec("999999999999999999"), canonical: "999999999999999999"},
+		// .1
+		{input: "-999999999999999999.1", wantAsInt64: nil, wantAsDec: ptrDec("-999999999999999999.1"), canonical: "-999999999999999999100m"},
+		{input: "999999999999999999.1", wantAsInt64: nil, wantAsDec: ptrDec("999999999999999999.1"), canonical: "999999999999999999100m"},
+
+		// min/max 19 digits
+		{input: "-9999999999999999999", wantAsInt64: nil, wantAsDec: ptrDec("-9999999999999999999")},
+		{input: "9999999999999999999", wantAsInt64: nil, wantAsDec: ptrDec("9999999999999999999")},
+		{input: "-1E", wantAsInt64: ptr.To[int64](-1000000000000000000), wantAsDec: ptrDec("-1000000000000000000")},
+		{input: "1E", wantAsInt64: ptr.To[int64](1000000000000000000), wantAsDec: ptrDec("1000000000000000000")},
+		{input: "-1000000000000000000", wantAsInt64: nil, wantAsDec: ptrDec("-1000000000000000000"), canonical: "-1E"}, // should be wantAsInt64: <value>
+		{input: "1000000000000000000", wantAsInt64: nil, wantAsDec: ptrDec("1000000000000000000"), canonical: "1E"},    // should be wantAsInt64: <value>
+		// .0
+		{input: "-9999999999999999999.0", wantAsInt64: nil, wantAsDec: ptrDec("-9999999999999999999"), canonical: "-9999999999999999999"},
+		{input: "9999999999999999999.0", wantAsInt64: nil, wantAsDec: ptrDec("9999999999999999999"), canonical: "9999999999999999999"},
+		{input: "-1.0E", wantAsInt64: ptr.To[int64](-1000000000000000000), wantAsDec: ptrDec("-1000000000000000000"), canonical: "-1E"},
+		{input: "1.0E", wantAsInt64: ptr.To[int64](1000000000000000000), wantAsDec: ptrDec("1000000000000000000"), canonical: "1E"},
+		{input: "-1000000000000000000.0", wantAsInt64: nil, wantAsDec: ptrDec("-1000000000000000000"), canonical: "-1E"}, // should be wantAsInt64: <value>
+		{input: "1000000000000000000.0", wantAsInt64: nil, wantAsDec: ptrDec("1000000000000000000"), canonical: "1E"},    // should be wantAsInt64: <value>
+		// 000m
+		{input: "-9999999999999999999000m", wantAsInt64: nil, wantAsDec: ptrDec("-9999999999999999999"), canonical: "-9999999999999999999"},
+		{input: "9999999999999999999000m", wantAsInt64: nil, wantAsDec: ptrDec("9999999999999999999"), canonical: "9999999999999999999"},
+		// .1
+		{input: "-9999999999999999999.1", wantAsInt64: nil, wantAsDec: ptrDec("-9999999999999999999.1"), canonical: "-9999999999999999999100m"},
+		{input: "9999999999999999999.1", wantAsInt64: nil, wantAsDec: ptrDec("9999999999999999999.1"), canonical: "9999999999999999999100m"},
+		{input: "-1.0000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("-1000000000000000000.1"), canonical: "-1000000000000000000100m"},
+		{input: "1.0000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("1000000000000000000.1"), canonical: "1000000000000000000100m"},
+		{input: "-1000000000000000000.1", wantAsInt64: nil, wantAsDec: ptrDec("-1000000000000000000.1"), canonical: "-1000000000000000000100m"},
+		{input: "1000000000000000000.1", wantAsInt64: nil, wantAsDec: ptrDec("1000000000000000000.1"), canonical: "1000000000000000000100m"},
+		// +1
+		{input: "-1.000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("-1000000000000000001"), canonical: "-1000000000000000001"}, // should be wantAsInt64: <value>
+		{input: "1.000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("1000000000000000001"), canonical: "1000000000000000001"},    // should be wantAsInt64: <value>
+		{input: "-1000000000000000001", wantAsInt64: nil, wantAsDec: ptrDec("-1000000000000000001")},                                      // should be wantAsInt64: <value>
+		{input: "1000000000000000001", wantAsInt64: nil, wantAsDec: ptrDec("1000000000000000001")},                                        // should be wantAsInt64: <value>
+
+		// min/max 20 digits
+		{input: "-10E", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000000")},
+		{input: "10E", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000000")},
+		{input: "-10000000000000000000", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000000"), canonical: "-10E"},
+		{input: "10000000000000000000", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000000"), canonical: "10E"},
+		// .0
+		{input: "-10.0E", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000000"), canonical: "-10E"},
+		{input: "10.0E", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000000"), canonical: "10E"},
+		{input: "-10000000000000000000.0", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000000"), canonical: "-10E"},
+		{input: "10000000000000000000.0", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000000"), canonical: "10E"},
+		// 000m
+		{input: "-10000000000000000000000m", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000000"), canonical: "-10E"},
+		{input: "10000000000000000000000m", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000000"), canonical: "10E"},
+		// .1
+		{input: "-10.0000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000000.1"), canonical: "-10000000000000000000100m"},
+		{input: "10.0000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000000.1"), canonical: "10000000000000000000100m"},
+		{input: "-10000000000000000000.1", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000000.1"), canonical: "-10000000000000000000100m"},
+		{input: "10000000000000000000.1", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000000.1"), canonical: "10000000000000000000100m"},
+		// +1
+		{input: "-10.000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000001"), canonical: "-10000000000000000001"},
+		{input: "10.000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000001"), canonical: "10000000000000000001"},
+		{input: "-10000000000000000001", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000001")},
+		{input: "10000000000000000001", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000001")},
+
+		// min/max int64 - 1
+		{input: "-9223372036854775809", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775809")},
+		{input: "9223372036854775806", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775806")}, // should be wantAsInt64: <value>
+		// .0
+		{input: "-9223372036854775809.0", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775809"), canonical: "-9223372036854775809"},
+		{input: "9223372036854775806.0", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775806"), canonical: "9223372036854775806"}, // should be wantAsInt64: <value>
+		// 000m
+		{input: "-9223372036854775809000m", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775809"), canonical: "-9223372036854775809"},
+		{input: "9223372036854775806000m", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775806"), canonical: "9223372036854775806"}, // should be wantAsInt64: <value>
+		// .1
+		{input: "-9223372036854775809.1", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775809.1"), canonical: "-9223372036854775809100m"},
+		{input: "9223372036854775806.1", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775806.1"), canonical: "9223372036854775806100m"},
+
+		// min/max int64
+		{input: "-9223372036854775808", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775808")}, // should be wantAsInt64: <value>
+		{input: "9223372036854775807", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775807")},   // should be wantAsInt64: <value>
+		// .0
+		{input: "-9223372036854775808.0", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775808"), canonical: "-9223372036854775808"}, // should be wantAsInt64: <value>
+		{input: "9223372036854775807.0", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775807"), canonical: "9223372036854775807"},    // should be wantAsInt64: <value>
+		// 000m
+		{input: "-9223372036854775808000m", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775808"), canonical: "-9223372036854775808"}, // should be wantAsInt64: <value>
+		{input: "9223372036854775807000m", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775807"), canonical: "9223372036854775807"},    // should be wantAsInt64: <value>
+		// .1
+		{input: "-9223372036854775808.1", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775808.1"), canonical: "-9223372036854775808100m"},
+		{input: "9223372036854775807.1", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775807.1"), canonical: "9223372036854775807100m"},
+
+		// min/max int64 + 1
+		{input: "-9223372036854775807", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775807")}, // should be wantAsInt64: <value>
+		{input: "9223372036854775808", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775808")},
+		// .0
+		{input: "-9223372036854775807.0", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775807"), canonical: "-9223372036854775807"}, // should be wantAsInt64: <value>
+		{input: "9223372036854775808.0", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775808"), canonical: "9223372036854775808"},
+		// 000m
+		{input: "-9223372036854775807000m", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775807"), canonical: "-9223372036854775807"}, // should be wantAsInt64: <value>
+		{input: "9223372036854775808000m", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775808"), canonical: "9223372036854775808"},
+		// .1
+		{input: "-9223372036854775807.1", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775807.1"), canonical: "-9223372036854775807100m"},
+		{input: "9223372036854775808.1", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775808.1"), canonical: "9223372036854775808100m"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.input, func(t *testing.T) {
+			q, err := ParseQuantity(tt.input)
+			if err != nil {
+				t.Fatalf("unexpected error for input %q: %v", tt.input, err)
+			}
+
+			val, ok := q.AsInt64()
+			if tt.wantAsInt64 != nil {
+				if !ok {
+					t.Errorf("AsInt64() returned ok=false for input %q, want ok=true and value %d", tt.input, *tt.wantAsInt64)
+				} else if val != *tt.wantAsInt64 {
+					t.Errorf("AsInt64() returned value %d for input %q, want value %d", val, tt.input, *tt.wantAsInt64)
+				}
+			} else {
+				if ok {
+					t.Errorf("AsInt64() returned ok=true and value %d for input %q, want ok=false", val, tt.input)
+				}
+			}
+
+			if tt.wantAsDec != nil {
+				if q.AsDec().Cmp(tt.wantAsDec.Dec) != 0 {
+					t.Errorf("AsDec() returned %s for input %q, want %s", q.AsDec().String(), tt.input, tt.wantAsDec.Dec.String())
+				}
+			}
+
+			serialized := q.String()
+			expectedString := tt.input
+			if tt.canonical != "" {
+				if tt.canonical == tt.input {
+					t.Errorf("unnecessary identical explicit canonical value in testcase")
+				}
+				expectedString = tt.canonical
+			}
+			if serialized != expectedString {
+				t.Errorf("expected input %q to reserialize to %q but got %q", tt.input, expectedString, serialized)
+			}
+		})
+	}
+}
+
+func TestQuantityPtrEqual(t *testing.T) {
+	q1 := MustParse("100m")
+	q2 := MustParse("100m")
+	q3 := MustParse("200m")
+
+	tests := []struct {
+		name   string
+		a      *Quantity
+		b      *Quantity
+		expect bool
+	}{
+		{
+			name:   "both nil",
+			a:      nil,
+			b:      nil,
+			expect: true,
+		},
+		{
+			name:   "first nil",
+			a:      nil,
+			b:      &q1,
+			expect: false,
+		},
+		{
+			name:   "second nil",
+			a:      &q1,
+			b:      nil,
+			expect: false,
+		},
+		{
+			name:   "equal quantities",
+			a:      &q1,
+			b:      &q2,
+			expect: true,
+		},
+		{
+			name:   "unequal quantities",
+			a:      &q1,
+			b:      &q3,
+			expect: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := QuantityPtrEqual(tt.a, tt.b); got != tt.expect {
+				t.Errorf("QuantityPtrEqual() = %v, want %v", got, tt.expect)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/scale_int.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/scale_int.go
new file mode 100644
index 0000000000..55e177b0e9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/scale_int.go
@@ -0,0 +1,95 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"math"
+	"math/big"
+	"sync"
+)
+
+var (
+	// A sync pool to reduce allocation.
+	intPool  sync.Pool
+	maxInt64 = big.NewInt(math.MaxInt64)
+)
+
+func init() {
+	intPool.New = func() interface{} {
+		return &big.Int{}
+	}
+}
+
+// scaledValue scales given unscaled value from scale to new Scale and returns
+// an int64. It ALWAYS rounds up the result when scale down. The final result might
+// overflow.
+//
+// scale, newScale represents the scale of the unscaled decimal.
+// The mathematical value of the decimal is unscaled * 10**(-scale).
+func scaledValue(unscaled *big.Int, scale, newScale int) int64 {
+	dif := scale - newScale
+	if dif == 0 {
+		return unscaled.Int64()
+	}
+
+	// Handle scale up
+	// This is an easy case, we do not need to care about rounding and overflow.
+	// If any intermediate operation causes overflow, the result will overflow.
+	if dif < 0 {
+		return unscaled.Int64() * int64(math.Pow10(-dif))
+	}
+
+	// Handle scale down
+	// We have to be careful about the intermediate operations.
+
+	// fast path when unscaled < max.Int64 and exp(10,dif) < max.Int64
+	const log10MaxInt64 = 19
+	if unscaled.Cmp(maxInt64) < 0 && dif < log10MaxInt64 {
+		divide := int64(math.Pow10(dif))
+		result := unscaled.Int64() / divide
+		mod := unscaled.Int64() % divide
+		if mod != 0 {
+			return result + 1
+		}
+		return result
+	}
+
+	// We should only convert back to int64 when getting the result.
+	divisor := intPool.Get().(*big.Int)
+	exp := intPool.Get().(*big.Int)
+	result := intPool.Get().(*big.Int)
+	defer func() {
+		intPool.Put(divisor)
+		intPool.Put(exp)
+		intPool.Put(result)
+	}()
+
+	// divisor = 10^(dif)
+	// TODO: create loop up table if exp costs too much.
+	divisor.Exp(bigTen, exp.SetInt64(int64(dif)), nil)
+	// reuse exp
+	remainder := exp
+
+	// result = unscaled / divisor
+	// remainder = unscaled % divisor
+	result.DivMod(unscaled, divisor, remainder)
+	if remainder.Sign() != 0 {
+		return result.Int64() + 1
+	}
+
+	return result.Int64()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/scale_int_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/scale_int_test.go
new file mode 100644
index 0000000000..b150fa514c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/scale_int_test.go
@@ -0,0 +1,85 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"math"
+	"math/big"
+	"testing"
+)
+
+func TestScaledValueInternal(t *testing.T) {
+	tests := []struct {
+		unscaled *big.Int
+		scale    int
+		newScale int
+
+		want int64
+	}{
+		// remain scale
+		{big.NewInt(1000), 0, 0, 1000},
+
+		// scale down
+		{big.NewInt(1000), 0, -3, 1},
+		{big.NewInt(1000), 3, 0, 1},
+		{big.NewInt(0), 3, 0, 0},
+
+		// always round up
+		{big.NewInt(999), 3, 0, 1},
+		{big.NewInt(500), 3, 0, 1},
+		{big.NewInt(499), 3, 0, 1},
+		{big.NewInt(1), 3, 0, 1},
+		// large scaled value does not lose precision
+		{big.NewInt(0).Sub(maxInt64, bigOne), 1, 0, (math.MaxInt64-1)/10 + 1},
+		// large intermediate result.
+		{big.NewInt(1).Exp(big.NewInt(10), big.NewInt(100), nil), 100, 0, 1},
+
+		// scale up
+		{big.NewInt(0), 0, 3, 0},
+		{big.NewInt(1), 0, 3, 1000},
+		{big.NewInt(1), -3, 0, 1000},
+		{big.NewInt(1000), -3, 2, 100000000},
+		{big.NewInt(0).Div(big.NewInt(math.MaxInt64), bigThousand), 0, 3,
+			(math.MaxInt64 / 1000) * 1000},
+	}
+
+	for i, tt := range tests {
+		old := (&big.Int{}).Set(tt.unscaled)
+		got := scaledValue(tt.unscaled, tt.scale, tt.newScale)
+		if got != tt.want {
+			t.Errorf("#%d: got = %v, want %v", i, got, tt.want)
+		}
+		if tt.unscaled.Cmp(old) != 0 {
+			t.Errorf("#%d: unscaled = %v, want %v", i, tt.unscaled, old)
+		}
+	}
+}
+
+func BenchmarkScaledValueSmall(b *testing.B) {
+	s := big.NewInt(1000)
+	for i := 0; i < b.N; i++ {
+		scaledValue(s, 3, 0)
+	}
+}
+
+func BenchmarkScaledValueLarge(b *testing.B) {
+	s := big.NewInt(math.MaxInt64)
+	s.Mul(s, big.NewInt(1000))
+	for i := 0; i < b.N; i++ {
+		scaledValue(s, 10, 0)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/suffix.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/suffix.go
new file mode 100644
index 0000000000..6ec527f9c0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/suffix.go
@@ -0,0 +1,198 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"strconv"
+)
+
+type suffix string
+
+// suffixer can interpret and construct suffixes.
+type suffixer interface {
+	interpret(suffix) (base, exponent int32, fmt Format, ok bool)
+	construct(base, exponent int32, fmt Format) (s suffix, ok bool)
+	constructBytes(base, exponent int32, fmt Format) (s []byte, ok bool)
+}
+
+// quantitySuffixer handles suffixes for all three formats that quantity
+// can handle.
+var quantitySuffixer = newSuffixer()
+
+type bePair struct {
+	base, exponent int32
+}
+
+type listSuffixer struct {
+	suffixToBE      map[suffix]bePair
+	beToSuffix      map[bePair]suffix
+	beToSuffixBytes map[bePair][]byte
+}
+
+func (ls *listSuffixer) addSuffix(s suffix, pair bePair) {
+	if ls.suffixToBE == nil {
+		ls.suffixToBE = map[suffix]bePair{}
+	}
+	if ls.beToSuffix == nil {
+		ls.beToSuffix = map[bePair]suffix{}
+	}
+	if ls.beToSuffixBytes == nil {
+		ls.beToSuffixBytes = map[bePair][]byte{}
+	}
+	ls.suffixToBE[s] = pair
+	ls.beToSuffix[pair] = s
+	ls.beToSuffixBytes[pair] = []byte(s)
+}
+
+func (ls *listSuffixer) lookup(s suffix) (base, exponent int32, ok bool) {
+	pair, ok := ls.suffixToBE[s]
+	if !ok {
+		return 0, 0, false
+	}
+	return pair.base, pair.exponent, true
+}
+
+func (ls *listSuffixer) construct(base, exponent int32) (s suffix, ok bool) {
+	s, ok = ls.beToSuffix[bePair{base, exponent}]
+	return
+}
+
+func (ls *listSuffixer) constructBytes(base, exponent int32) (s []byte, ok bool) {
+	s, ok = ls.beToSuffixBytes[bePair{base, exponent}]
+	return
+}
+
+type suffixHandler struct {
+	decSuffixes listSuffixer
+	binSuffixes listSuffixer
+}
+
+type fastLookup struct {
+	*suffixHandler
+}
+
+func (l fastLookup) interpret(s suffix) (base, exponent int32, format Format, ok bool) {
+	switch s {
+	case "":
+		return 10, 0, DecimalSI, true
+	case "n":
+		return 10, -9, DecimalSI, true
+	case "u":
+		return 10, -6, DecimalSI, true
+	case "m":
+		return 10, -3, DecimalSI, true
+	case "k":
+		return 10, 3, DecimalSI, true
+	case "M":
+		return 10, 6, DecimalSI, true
+	case "G":
+		return 10, 9, DecimalSI, true
+	}
+	return l.suffixHandler.interpret(s)
+}
+
+func newSuffixer() suffixer {
+	sh := &suffixHandler{}
+
+	// IMPORTANT: if you change this section you must change fastLookup
+
+	sh.binSuffixes.addSuffix("Ki", bePair{2, 10})
+	sh.binSuffixes.addSuffix("Mi", bePair{2, 20})
+	sh.binSuffixes.addSuffix("Gi", bePair{2, 30})
+	sh.binSuffixes.addSuffix("Ti", bePair{2, 40})
+	sh.binSuffixes.addSuffix("Pi", bePair{2, 50})
+	sh.binSuffixes.addSuffix("Ei", bePair{2, 60})
+	// Don't emit an error when trying to produce
+	// a suffix for 2^0.
+	sh.decSuffixes.addSuffix("", bePair{2, 0})
+
+	sh.decSuffixes.addSuffix("n", bePair{10, -9})
+	sh.decSuffixes.addSuffix("u", bePair{10, -6})
+	sh.decSuffixes.addSuffix("m", bePair{10, -3})
+	sh.decSuffixes.addSuffix("", bePair{10, 0})
+	sh.decSuffixes.addSuffix("k", bePair{10, 3})
+	sh.decSuffixes.addSuffix("M", bePair{10, 6})
+	sh.decSuffixes.addSuffix("G", bePair{10, 9})
+	sh.decSuffixes.addSuffix("T", bePair{10, 12})
+	sh.decSuffixes.addSuffix("P", bePair{10, 15})
+	sh.decSuffixes.addSuffix("E", bePair{10, 18})
+
+	return fastLookup{sh}
+}
+
+func (sh *suffixHandler) construct(base, exponent int32, fmt Format) (s suffix, ok bool) {
+	switch fmt {
+	case DecimalSI:
+		return sh.decSuffixes.construct(base, exponent)
+	case BinarySI:
+		return sh.binSuffixes.construct(base, exponent)
+	case DecimalExponent:
+		if base != 10 {
+			return "", false
+		}
+		if exponent == 0 {
+			return "", true
+		}
+		return suffix("e" + strconv.FormatInt(int64(exponent), 10)), true
+	}
+	return "", false
+}
+
+func (sh *suffixHandler) constructBytes(base, exponent int32, format Format) (s []byte, ok bool) {
+	switch format {
+	case DecimalSI:
+		return sh.decSuffixes.constructBytes(base, exponent)
+	case BinarySI:
+		return sh.binSuffixes.constructBytes(base, exponent)
+	case DecimalExponent:
+		if base != 10 {
+			return nil, false
+		}
+		if exponent == 0 {
+			return nil, true
+		}
+		result := make([]byte, 8)
+		result[0] = 'e'
+		number := strconv.AppendInt(result[1:1], int64(exponent), 10)
+		if &result[1] == &number[0] {
+			return result[:1+len(number)], true
+		}
+		result = append(result[:1], number...)
+		return result, true
+	}
+	return nil, false
+}
+
+func (sh *suffixHandler) interpret(suffix suffix) (base, exponent int32, fmt Format, ok bool) {
+	// Try lookup tables first
+	if b, e, ok := sh.decSuffixes.lookup(suffix); ok {
+		return b, e, DecimalSI, true
+	}
+	if b, e, ok := sh.binSuffixes.lookup(suffix); ok {
+		return b, e, BinarySI, true
+	}
+
+	if len(suffix) > 1 && (suffix[0] == 'E' || suffix[0] == 'e') {
+		parsed, err := strconv.ParseInt(string(suffix[1:]), 10, 64)
+		if err != nil {
+			return 0, 0, DecimalExponent, false
+		}
+		return 10, int32(parsed), DecimalExponent, true
+	}
+
+	return 0, 0, DecimalExponent, false
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..abb00f38e2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/zz_generated.deepcopy.go
@@ -0,0 +1,45 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package resource
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Quantity) DeepCopyInto(out *Quantity) {
+	*out = in.DeepCopy()
+	return
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *QuantityValue) DeepCopyInto(out *QuantityValue) {
+	*out = *in
+	out.Quantity = in.Quantity.DeepCopy()
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new QuantityValue.
+func (in *QuantityValue) DeepCopy() *QuantityValue {
+	if in == nil {
+		return nil
+	}
+	out := new(QuantityValue)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/zz_generated.model_name.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/zz_generated.model_name.go
new file mode 100644
index 0000000000..2575a2e8c8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/resource/zz_generated.model_name.go
@@ -0,0 +1,32 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package resource
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Quantity) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.api.resource.Quantity"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in QuantityValue) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.api.resource.QuantityValue"
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/safe/safe.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/safe/safe.go
new file mode 100644
index 0000000000..6d6d1f88fe
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/safe/safe.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package safe
+
+// Field takes a pointer to any value (which may or may not be nil) and a
+// function that traverses to a target type R (a typical use case is to
+// dereference a field), and returns the result of the traversal, or the zero
+// value of the target type.
+//
+// This is roughly equivalent to:
+//
+//	value != nil ? fn(value) : zero-value
+//
+// ...in languages that support the ternary operator.
+func Field[V any, R any](value *V, fn func(*V) R) R {
+	if value == nil {
+		var zero R
+		return zero
+	}
+	o := fn(value)
+	return o
+}
+
+// Cast takes any value, attempts to cast it to T, and returns the T value if
+// the cast is successful, or else the zero value of T.
+func Cast[T any](value any) T {
+	result, _ := value.(T)
+	return result
+}
+
+// Value takes a pointer to any value (which may or may not be nil) and a
+// function that returns a pointer to the same type.  If the value is not nil,
+// it is returned, otherwise the result of the function is returned.
+//
+// This is roughly equivalent to:
+//
+//	value != nil ? value : fn()
+//
+// ...in languages that support the ternary operator.
+func Value[T any](value *T, fn func() *T) *T {
+	if value != nil {
+		return value
+	}
+	return fn()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/README.md b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/README.md
new file mode 100644
index 0000000000..52ca031d44
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/README.md
@@ -0,0 +1,64 @@
+# API validation
+
+This package holds functions which validate fields and types in the Kubernetes
+API. It may be useful beyond API validation, but this is the primary goal.
+
+Most of the public functions here have signatures which adhere to the following
+pattern, which is assumed by automation and code-generation:
+
+```
+import (
+        "context"
+        "k8s.io/apimachinery/pkg/api/operation"
+        "k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func <Name>(ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue <ValueType>, <OtherArgs...>) field.ErrorList
+```
+
+The name of validator functions should consider that callers will generally be
+spelling out the package name and the function name, and so should aim for
+legibility.  E.g. `validate.Concept()`.
+
+The `ctx` argument is Go's usual Context.
+
+The `opCtx` argument provides information about the API operation in question.
+
+The `fldPath` argument indicates the path to the field in question, to be used
+in errors.
+
+The `value` and `oldValue` arguments are the thing(s) being validated.  For
+CREATE operations (`opCtx.Operation == operation.Create`), the `oldValue`
+argument will be nil.  Many validators functions only look at the current value
+(`value`) and disregard `oldValue`.
+
+The `value` and `oldValue` arguments are always nilable - pointers to primitive
+types, slices of any type, or maps of any type.  Validator functions should
+avoid dereferencing nil. Callers are expected to not pass a nil `value` unless the
+API field itself was nilable. `oldValue` is always nil for CREATE operations and 
+is also nil for UPDATE operations if the `value` is not correlated with an `oldValue`.
+
+Simple content-validators may have no `<OtherArgs>`, but validator functions
+may take additional arguments.  Some validator functions will be built as
+generics, e.g. to allow any integer type or to handle arbitrary slices.
+
+Examples:
+
+```
+// NonEmpty validates that a string is not empty.
+func NonEmpty(ctx context.Context, op operation.Operation, fldPath *field.Path, value, _ *string) field.ErrorList
+
+// Even validates that a slice has an even number of items.
+func Even[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, _ []T) field.ErrorList
+
+// KeysMaxLen validates that all of the string keys in a map are under the
+// specified length.
+func KeysMaxLen[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, _ map[string]T, maxLen int) field.ErrorList
+```
+
+Validator functions always return an `ErrorList` where each item is a distinct
+validation failure and a zero-length return value (not just nil) indicates
+success.
+
+Good validation failure messages follow the Kubernetes API conventions, for
+example using "must" instead of "should".
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/common.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/common.go
new file mode 100644
index 0000000000..14a6f0da7f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/common.go
@@ -0,0 +1,28 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// ValidateFunc is a function that validates a value, possibly considering the
+// old value (if any).
+type ValidateFunc[T any] func(ctx context.Context, op operation.Operation, fldPath *field.Path, newValue, oldValue T) field.ErrorList
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/constraints/constraints.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/constraints/constraints.go
new file mode 100644
index 0000000000..1689d3c079
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/constraints/constraints.go
@@ -0,0 +1,32 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package constraints
+
+// Signed is a constraint that permits any signed integer type.
+type Signed interface {
+	~int | ~int8 | ~int16 | ~int32 | ~int64
+}
+
+// Unsigned is a constraint that permits any unsigned integer type.
+type Unsigned interface {
+	~uint | ~uint8 | ~uint16 | ~uint32 | ~uint64 | ~uintptr
+}
+
+// Integer is a constraint that permits any integer type.
+type Integer interface {
+	Signed | Unsigned
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/decimal_int.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/decimal_int.go
new file mode 100644
index 0000000000..5622ca15a8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/decimal_int.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+const decimalIntegerErrMsg string = "must be a valid decimal integer in canonical form"
+
+// IsDecimalInteger validates that a string represents a decimal integer in strict canonical form.
+// This means the string must be formatted exactly as a human would naturally write an integer,
+// without any programming language conventions like leading zeros, plus signs, or alternate bases.
+//
+// valid values:"0" or Non-zero integers (i.e., "123", "-456") where the first digit is 1-9,
+// followed by any digits 0-9.
+//
+// This validator is stricter than strconv.ParseInt, which accepts leading zeros values (i.e, "0700")
+// and interprets them as decimal 700, potentially causing confusion with octal notation.
+func IsDecimalInteger(value string) []string {
+	n := len(value)
+	if n == 0 {
+		return []string{EmptyError()}
+	}
+
+	i := 0
+	if value[0] == '-' {
+		if n == 1 {
+			return []string{decimalIntegerErrMsg}
+		}
+		i = 1
+	}
+
+	if value[i] == '0' {
+		if n == 1 && i == 0 {
+			return nil
+		}
+		return []string{decimalIntegerErrMsg}
+	}
+
+	if value[i] < '1' || value[i] > '9' {
+		return []string{decimalIntegerErrMsg}
+	}
+
+	for i++; i < n; i++ {
+		if value[i] < '0' || value[i] > '9' {
+			return []string{decimalIntegerErrMsg}
+		}
+	}
+
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/decimal_int_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/decimal_int_test.go
new file mode 100644
index 0000000000..369417d26a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/decimal_int_test.go
@@ -0,0 +1,234 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"strconv"
+	"strings"
+	"testing"
+)
+
+func TestIsDecimalInteger(t *testing.T) {
+	testCases := []struct {
+		name        string
+		input       string
+		shouldPass  bool
+		errContains string
+	}{
+		// valid
+		{name: "zero", input: "0", shouldPass: true},
+		{name: "positive single digit 1", input: "1", shouldPass: true},
+		{name: "positive single digit 2", input: "2", shouldPass: true},
+		{name: "positive single digit 5", input: "5", shouldPass: true},
+		{name: "positive single digit 9", input: "9", shouldPass: true},
+		{name: "negative single digit", input: "-5", shouldPass: true},
+		{name: "negative single digit 1", input: "-1", shouldPass: true},
+		{name: "negative single digit 9", input: "-9", shouldPass: true},
+
+		{name: "number starting with 1", input: "100", shouldPass: true},
+		{name: "number starting with 2", input: "234", shouldPass: true},
+		{name: "number starting with 3", input: "345", shouldPass: true},
+		{name: "number starting with 4", input: "456", shouldPass: true},
+		{name: "number starting with 5", input: "567", shouldPass: true},
+		{name: "number starting with 6", input: "678", shouldPass: true},
+		{name: "number starting with 7", input: "789", shouldPass: true},
+		{name: "number starting with 8", input: "890", shouldPass: true},
+		{name: "number starting with 9", input: "999", shouldPass: true},
+
+		{name: "positive multi-digit", input: "123", shouldPass: true},
+		{name: "negative multi-digit", input: "-456", shouldPass: true},
+		{name: "negative starting with 1", input: "-100", shouldPass: true},
+		{name: "negative starting with 9", input: "-987", shouldPass: true},
+		{name: "large positive number", input: "9223372036854775807", shouldPass: true},  // max int64
+		{name: "large negative number", input: "-9223372036854775808", shouldPass: true}, // min int64
+		{name: "very long valid number", input: "12345678901234567890", shouldPass: true},
+		{name: "all nines", input: "999999999999", shouldPass: true},
+
+		// invalid
+		{name: "negative zero", input: "-0", shouldPass: false},
+		{name: "double zero", input: "00", shouldPass: false},
+		{name: "triple zero", input: "000", shouldPass: false},
+		{name: "many zeros", input: "0000000", shouldPass: false},
+		{name: "leading zero single digit", input: "01", shouldPass: false},
+		{name: "leading zero digit 2", input: "02", shouldPass: false},
+		{name: "leading zero digit 9", input: "09", shouldPass: false},
+		{name: "leading zero multi-digit", input: "0123", shouldPass: false},
+		{name: "octal-like format", input: "0700", shouldPass: false},
+		{name: "octal-like format 2", input: "0950", shouldPass: false},
+		{name: "multiple leading zeros", input: "00123", shouldPass: false},
+		{name: "negative with leading zero", input: "-01", shouldPass: false},
+		{name: "negative with leading zeros", input: "-0123", shouldPass: false},
+		{name: "negative double zero", input: "-00", shouldPass: false},
+		{name: "plus sign", input: "+123", shouldPass: false},
+		{name: "positive plus sign", input: "+5", shouldPass: false},
+		{name: "plus zero", input: "+0", shouldPass: false},
+
+		// Invalid cases - empty and whitespace
+		{name: "empty string", input: "", shouldPass: false, errContains: "non-empty"},
+		{name: "just minus sign", input: "-", shouldPass: false},
+		{name: "just plus sign", input: "+", shouldPass: false},
+		{name: "single space", input: " ", shouldPass: false},
+		{name: "multiple spaces", input: "   ", shouldPass: false},
+		{name: "leading space", input: " 123", shouldPass: false},
+		{name: "trailing space", input: "123 ", shouldPass: false},
+		{name: "space in middle", input: "12 3", shouldPass: false},
+		{name: "spaces around", input: " 123 ", shouldPass: false},
+
+		{name: "decimal number", input: "12.3", shouldPass: false},
+		{name: "decimal zero", input: "0.0", shouldPass: false},
+		{name: "negative decimal", input: "-12.5", shouldPass: false},
+		{name: "trailing dot", input: "123.", shouldPass: false},
+		{name: "leading dot", input: ".123", shouldPass: false},
+
+		{name: "alphabetic", input: "abc", shouldPass: false},
+		{name: "alphanumeric", input: "12a3", shouldPass: false},
+		{name: "letter at start", input: "a123", shouldPass: false},
+		{name: "letter at end", input: "123a", shouldPass: false},
+		{name: "uppercase letters", input: "ABC", shouldPass: false},
+		{name: "mixed case", input: "12A3", shouldPass: false},
+
+		{name: "hexadecimal", input: "0x123", shouldPass: false},
+		{name: "hex uppercase", input: "0X123", shouldPass: false},
+		{name: "octal prefix", input: "0o777", shouldPass: false},
+		{name: "binary prefix", input: "0b101", shouldPass: false},
+		{name: "scientific notation", input: "1e5", shouldPass: false},
+		{name: "scientific negative exp", input: "1e-5", shouldPass: false},
+		{name: "scientific uppercase", input: "1E5", shouldPass: false},
+
+		{name: "underscore separator", input: "1_000", shouldPass: false},
+		{name: "comma separator", input: "1,000", shouldPass: false},
+		{name: "period separator", input: "1.000", shouldPass: false},
+		{name: "apostrophe separator", input: "1'000", shouldPass: false},
+
+		{name: "double minus", input: "--123", shouldPass: false},
+		{name: "double plus", input: "++123", shouldPass: false},
+		{name: "plus minus", input: "+-123", shouldPass: false},
+		{name: "minus plus", input: "-+123", shouldPass: false},
+		{name: "minus at end", input: "123-", shouldPass: false},
+		{name: "minus in middle", input: "12-3", shouldPass: false},
+		{name: "plus at end", input: "123+", shouldPass: false},
+		{name: "plus in middle", input: "12+3", shouldPass: false},
+
+		{name: "tab character at start", input: "\t123", shouldPass: false},
+		{name: "tab character at end", input: "123\t", shouldPass: false},
+		{name: "newline character", input: "123\n", shouldPass: false},
+		{name: "carriage return", input: "123\r", shouldPass: false},
+		{name: "null character", input: "123\x00", shouldPass: false},
+		{name: "vertical tab", input: "123\v", shouldPass: false},
+		{name: "form feed", input: "123\f", shouldPass: false},
+
+		{name: "parentheses", input: "(123)", shouldPass: false},
+		{name: "brackets", input: "[123]", shouldPass: false},
+		{name: "braces", input: "{123}", shouldPass: false},
+		{name: "dollar sign", input: "$123", shouldPass: false},
+		{name: "percent sign", input: "123%", shouldPass: false},
+		{name: "hash", input: "#123", shouldPass: false},
+		{name: "at sign", input: "@123", shouldPass: false},
+		{name: "ampersand", input: "&123", shouldPass: false},
+		{name: "asterisk", input: "*123", shouldPass: false},
+		{name: "slash", input: "12/3", shouldPass: false},
+		{name: "backslash", input: "12\\3", shouldPass: false},
+		{name: "pipe", input: "12|3", shouldPass: false},
+		{name: "semicolon", input: "12;3", shouldPass: false},
+		{name: "colon", input: "12:3", shouldPass: false},
+		{name: "question mark", input: "12?3", shouldPass: false},
+		{name: "exclamation", input: "12!3", shouldPass: false},
+		{name: "tilde", input: "~123", shouldPass: false},
+		{name: "backtick", input: "`123", shouldPass: false},
+		{name: "single quote", input: "'123'", shouldPass: false},
+		{name: "double quote", input: "\"123\"", shouldPass: false},
+
+		{name: "unicode minus", input: "−123", shouldPass: false}, // U+2212 minus sign
+		{name: "unicode digit", input: "１２３", shouldPass: false},  // fullwidth digits
+		{name: "arabic digits", input: "١٢٣", shouldPass: false},  // Arabic-Indic digits
+		{name: "chinese characters", input: "一二三", shouldPass: false},
+		{name: "superscript", input: "123⁴", shouldPass: false},
+		{name: "subscript", input: "123₄", shouldPass: false},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := IsDecimalInteger(tc.input)
+			if tc.shouldPass {
+				if len(errs) != 0 {
+					t.Errorf("IsDecimalInteger(%q) = %v, want no errors", tc.input, errs)
+				}
+			} else {
+				if len(errs) == 0 {
+					t.Errorf("IsDecimalInteger(%q) = no errors, want errors", tc.input)
+				} else if tc.errContains != "" {
+					found := false
+					for _, err := range errs {
+						if strings.Contains(err, tc.errContains) {
+							found = true
+							break
+						}
+					}
+					if !found {
+						t.Errorf("IsDecimalInteger(%q) errors %v should contain %q", tc.input, errs, tc.errContains)
+					}
+				}
+			}
+		})
+	}
+
+	// Additional verification: valid strings should parse with strconv.ParseInt
+	validCases := []string{
+		"0", "1", "2", "5", "9",
+		"-1", "-5", "-9",
+		"123", "-456", "100", "999",
+		"9223372036854775807", "-9223372036854775808",
+		"12345678901234567890",
+	}
+	for _, validCase := range validCases {
+		if errs := IsDecimalInteger(validCase); len(errs) != 0 {
+			t.Errorf("Valid case %q should return no errors, got: %v", validCase, errs)
+		}
+		// Verify it can also be parsed by strconv.ParseInt (within range)
+		if len(validCase) <= 19 { // Only test cases that fit in int64
+			if _, err := strconv.ParseInt(validCase, 10, 64); err != nil {
+				t.Errorf("Valid case %q should be parseable by strconv.ParseInt: %v", validCase, err)
+			}
+		}
+	}
+
+	// Verify that our function rejects what we intend to reject (even if strconv.ParseInt accepts it)
+	rejectedCases := []string{
+		"0700", "0950", "01", "02", "09",
+		"+123", "+5", "+0",
+		"-0", "00", "000",
+		"-01", "-00",
+	}
+	for _, rejectedCase := range rejectedCases {
+		if errs := IsDecimalInteger(rejectedCase); len(errs) == 0 {
+			t.Errorf("Case %q should be rejected by strict validation", rejectedCase)
+		}
+	}
+
+	// Edge case: verify strconv.ParseInt accepts things we reject (proving we're stricter)
+	strconvAcceptsButWeReject := []string{"+123", "0700", "01"}
+	for _, case_ := range strconvAcceptsButWeReject {
+		// strconv.ParseInt should accept it
+		if _, err := strconv.ParseInt(case_, 10, 64); err != nil {
+			t.Errorf("strconv.ParseInt should accept %q but got error: %v", case_, err)
+		}
+		// But our function should reject it
+		if errs := IsDecimalInteger(case_); len(errs) == 0 {
+			t.Errorf("IsDecimalInteger should reject %q (stricter than strconv)", case_)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/dns.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/dns.go
new file mode 100644
index 0000000000..bd20720794
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/dns.go
@@ -0,0 +1,101 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"regexp"
+)
+
+const dns1123LabelFmt string = "[a-z0-9]([-a-z0-9]*[a-z0-9])?"
+
+const dns1123LabelErrMsg string = "a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character"
+
+// DNS1123LabelMaxLength is a label's max length in DNS (RFC 1123)
+const DNS1123LabelMaxLength int = 63
+
+var dns1123LabelRegexp = regexp.MustCompile("^" + dns1123LabelFmt + "$")
+
+// IsDNS1123Label tests for a string that conforms to the definition of a label in
+// DNS (RFC 1123).
+func IsDNS1123Label(value string) []string {
+	var errs []string
+	if len(value) > DNS1123LabelMaxLength {
+		errs = append(errs, MaxLenError(DNS1123LabelMaxLength))
+	}
+	if !dns1123LabelRegexp.MatchString(value) {
+		if dns1123SubdomainRegexp.MatchString(value) {
+			// It was a valid subdomain and not a valid label.  Since we
+			// already checked length, it must be dots.
+			errs = append(errs, "must not contain dots")
+		} else {
+			errs = append(errs, RegexError(dns1123LabelErrMsg, dns1123LabelFmt, "my-name", "123-abc"))
+		}
+	}
+	return errs
+}
+
+const dns1123SubdomainFmt string = dns1123LabelFmt + "(\\." + dns1123LabelFmt + ")*"
+const dns1123SubdomainFmtCaseless string = "(?i)" + dns1123SubdomainFmt
+const dns1123SubdomainErrorMsg string = "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character"
+const dns1123SubdomainCaselessErrorMsg string = "an RFC 1123 subdomain must consist of alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character"
+
+// DNS1123SubdomainMaxLength is a subdomain's max length in DNS (RFC 1123)
+const DNS1123SubdomainMaxLength int = 253
+
+var dns1123SubdomainRegexp = regexp.MustCompile("^" + dns1123SubdomainFmt + "$")
+var dns1123SubdomainCaselessRegexp = regexp.MustCompile("^" + dns1123SubdomainFmtCaseless + "$")
+
+// IsDNS1123Subdomain tests for a string that conforms to the definition of a
+// subdomain in DNS (RFC 1123) lowercase.
+func IsDNS1123Subdomain(value string) []string {
+	return isDNS1123Subdomain(value, false)
+}
+
+// IsDNS1123SubdomainCaseless tests for a string that conforms to the definition of a
+// subdomain in DNS (RFC 1123).
+//
+// Deprecated: API validation should never be caseless. Caseless validation is a vector
+// for bugs and failed uniqueness assumptions. For example, names like "foo.com" and
+// "FOO.COM" are both accepted as valid, but they are typically not treated as equal by
+// consumers (e.g. CSI and DRA driver names). This fails the "least surprise" principle and
+// can cause inconsistent behaviors.
+//
+// Note: This allows uppercase names but is not caseless — uppercase and lowercase are
+// treated as different values. Use IsDNS1123Subdomain for strict, lowercase validation
+// instead.
+func IsDNS1123SubdomainCaseless(value string) []string {
+	return isDNS1123Subdomain(value, true)
+}
+
+func isDNS1123Subdomain(value string, caseless bool) []string {
+	var errs []string
+	if len(value) > DNS1123SubdomainMaxLength {
+		errs = append(errs, MaxLenError(DNS1123SubdomainMaxLength))
+	}
+	errorMsg := dns1123SubdomainErrorMsg
+	example := "example.com"
+	regexp := dns1123SubdomainRegexp
+	if caseless {
+		errorMsg = dns1123SubdomainCaselessErrorMsg
+		example = "Example.com"
+		regexp = dns1123SubdomainCaselessRegexp
+	}
+	if !regexp.MatchString(value) {
+		errs = append(errs, RegexError(errorMsg, dns1123SubdomainFmt, example))
+	}
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/dns_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/dns_test.go
new file mode 100644
index 0000000000..c241d722c1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/dns_test.go
@@ -0,0 +1,126 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestIsDNS1123Label(t *testing.T) {
+	goodValues := []string{
+		"a", "ab", "abc", "a1", "a-1", "a--1--2--b",
+		"0", "01", "012", "1a", "1-a", "1--a--b--2",
+		strings.Repeat("a", 63),
+	}
+	for _, val := range goodValues {
+		if msgs := IsDNS1123Label(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"", "A", "ABC", "aBc", "A1", "A-1", "1-A",
+		"-", "a-", "-a", "1-", "-1",
+		"_", "a_", "_a", "a_b", "1_", "_1", "1_2",
+		".", "a.", ".a", "a.b", "1.", ".1", "1.2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2",
+		strings.Repeat("a", 64),
+	}
+	for _, val := range badValues {
+		if msgs := IsDNS1123Label(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
+
+func TestIsDNS1123Subdomain(t *testing.T) {
+	goodValues := []string{
+		"a", "ab", "abc", "a1", "a-1", "a--1--2--b",
+		"0", "01", "012", "1a", "1-a", "1--a--b--2",
+		"a.a", "ab.a", "abc.a", "a1.a", "a-1.a", "a--1--2--b.a",
+		"a.1", "ab.1", "abc.1", "a1.1", "a-1.1", "a--1--2--b.1",
+		"0.a", "01.a", "012.a", "1a.a", "1-a.a", "1--a--b--2",
+		"0.1", "01.1", "012.1", "1a.1", "1-a.1", "1--a--b--2.1",
+		"a.b.c.d.e", "aa.bb.cc.dd.ee", "1.2.3.4.5", "11.22.33.44.55",
+		strings.Repeat("a", 253),
+	}
+	for _, val := range goodValues {
+		if msgs := IsDNS1123Subdomain(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"", "A", "ABC", "aBc", "A1", "A-1", "1-A",
+		"-", "a-", "-a", "1-", "-1",
+		"_", "a_", "_a", "a_b", "1_", "_1", "1_2",
+		".", "a.", ".a", "a..b", "1.", ".1", "1..2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2",
+		"A.a", "aB.a", "ab.A", "A1.a", "a1.A",
+		"A.1", "aB.1", "A1.1", "1A.1",
+		"0.A", "01.A", "012.A", "1A.a", "1a.A",
+		"A.B.C.D.E", "AA.BB.CC.DD.EE", "a.B.c.d.e", "aa.bB.cc.dd.ee",
+		"a@b", "a,b", "a_b", "a;b",
+		"a:b", "a%b", "a?b", "a$b",
+		strings.Repeat("a", 254),
+	}
+	for _, val := range badValues {
+		if msgs := IsDNS1123Subdomain(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
+
+func TestIsDNS1123SubdomainCaseless(t *testing.T) {
+	goodValues := []string{
+		"a", "ab", "abc", "a1", "a-1", "a--1--2--b",
+		"0", "01", "012", "1a", "1-a", "1--a--b--2",
+		"a.a", "ab.a", "abc.a", "a1.a", "a-1.a", "a--1--2--b.a",
+		"a.1", "ab.1", "abc.1", "a1.1", "a-1.1", "a--1--2--b.1",
+		"0.a", "01.a", "012.a", "1a.a", "1-a.a", "1--a--b--2",
+		"0.1", "01.1", "012.1", "1a.1", "1-a.1", "1--a--b--2.1",
+		"a.b.c.d.e", "aa.bb.cc.dd.ee", "1.2.3.4.5", "11.22.33.44.55",
+		"A", "AB", "ABC", "A1", "A-1",
+		"A.A", "AB.A", "ABC.A", "A1.A", "A-1.A",
+		"A.B.C.D.E", "AA.BB.CC.DD.EE",
+		"a.B.c.d.e", "aa.bB.cc.dd.ee",
+		strings.Repeat("a", 253),
+		strings.Repeat("A", 253),
+	}
+	for _, val := range goodValues {
+		if msgs := IsDNS1123SubdomainCaseless(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"",
+		"-", "a-", "-a", "1-", "-1",
+		"_", "a_", "_a", "a_b", "1_", "_1", "1_2",
+		".", "a.", ".a", "a..b", "1.", ".1", "1..2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2",
+		"a@b", "a,b", "a_b", "a;b",
+		"a:b", "a%b", "a?b", "a$b",
+		strings.Repeat("a", 254),
+	}
+	for _, val := range badValues {
+		if msgs := IsDNS1123SubdomainCaseless(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/errors.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/errors.go
new file mode 100644
index 0000000000..13eeced1a0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/errors.go
@@ -0,0 +1,72 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"fmt"
+	"reflect"
+
+	"k8s.io/apimachinery/pkg/api/validate/constraints"
+)
+
+// MinError returns a string explanation of a "must be greater than or equal"
+// validation failure.
+func MinError[T constraints.Integer](min T) string {
+	return fmt.Sprintf("must be greater than or equal to %d", min)
+}
+
+// MaxError returns a string explanation of a "must be less than or equal"
+// validation failure.
+func MaxError[T constraints.Integer](max T) string {
+	return fmt.Sprintf("must be less than or equal to %d", max)
+}
+
+// MaxLenError returns a string explanation of a "string too long" validation
+// failure.
+func MaxLenError(length int) string {
+	return fmt.Sprintf("must be no more than %d bytes", length)
+}
+
+// EmptyError returns a string explanation of an "empty string" validation.
+func EmptyError() string {
+	return "must be non-empty"
+}
+
+// RegexError returns a string explanation of a regex validation failure.
+func RegexError(msg string, re string, examples ...string) string {
+	if len(examples) == 0 {
+		return msg + " (regex used for validation is '" + re + "')"
+	}
+	msg += " (e.g. "
+	for i := range examples {
+		if i > 0 {
+			msg += " or "
+		}
+		msg += "'" + examples[i] + "', "
+	}
+	msg += "regex used for validation is '" + re + "')"
+	return msg
+}
+
+// NEQError returns a string explanation of a "must not be equal to" validation failure.
+func NEQError[T any](disallowed T) string {
+	format := "%v"
+	if reflect.ValueOf(disallowed).Kind() == reflect.String {
+		format = "%q"
+	}
+	return fmt.Sprintf("must not be equal to "+format, disallowed)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/identifier.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/identifier.go
new file mode 100644
index 0000000000..3913ec9916
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/identifier.go
@@ -0,0 +1,35 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"regexp"
+)
+
+const cIdentifierFmt string = "[A-Za-z_][A-Za-z0-9_]*"
+const identifierErrMsg string = "a valid C identifier must start with alphabetic character or '_', followed by a string of alphanumeric characters or '_'"
+
+var cIdentifierRegexp = regexp.MustCompile("^" + cIdentifierFmt + "$")
+
+// IsCIdentifier tests for a string that conforms the definition of an identifier
+// in C. This checks the format, but not the length.
+func IsCIdentifier(value string) []string {
+	if !cIdentifierRegexp.MatchString(value) {
+		return []string{RegexError(identifierErrMsg, cIdentifierFmt, "my_name", "MY_NAME", "MyName")}
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/identifier_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/identifier_test.go
new file mode 100644
index 0000000000..e5c1bf84ab
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/identifier_test.go
@@ -0,0 +1,46 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"testing"
+)
+
+func TestIsCIdentifier(t *testing.T) {
+	goodValues := []string{
+		"a", "ab", "abc", "a1", "_a", "a_", "a_b", "a_1", "a__1__2__b", "__abc_123",
+		"A", "AB", "AbC", "A1", "_A", "A_", "A_B", "A_1", "A__1__2__B", "__123_ABC",
+	}
+	for _, val := range goodValues {
+		if msgs := IsCIdentifier(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"", "1", "123", "1a",
+		"-", "a-", "-a", "1-", "-1", "1_", "1_2",
+		".", "a.", ".a", "a.b", "1.", ".1", "1.2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2",
+		"#a#",
+	}
+	for _, val := range badValues {
+		if msgs := IsCIdentifier(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/kube.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/kube.go
new file mode 100644
index 0000000000..608073f708
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/kube.go
@@ -0,0 +1,117 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"regexp"
+	"strings"
+)
+
+const labelKeyCharFmt string = "[A-Za-z0-9]"
+const labelKeyExtCharFmt string = "[-A-Za-z0-9_.]"
+const labelKeyFmt string = "(" + labelKeyCharFmt + labelKeyExtCharFmt + "*)?" + labelKeyCharFmt
+const labelKeyErrMsg string = "must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character"
+const labelKeyMaxLength int = 63
+
+var labelKeyRegexp = regexp.MustCompile("^" + labelKeyFmt + "$")
+
+// IsQualifiedName tests whether the value passed is what Kubernetes calls a
+// "qualified name", which is the same as a label key.
+//
+// Deprecated: use IsLabelKey instead.
+var IsQualifiedName = IsLabelKey
+
+// IsLabelKey tests whether the value passed is a valid label key. This format
+// is used to validate many fields in the Kubernetes API.
+// Label keys consist of an optional prefix and a name, separated by a '/'.
+// If the value is not valid, a list of error strings is returned. Otherwise, an
+// empty list (or nil) is returned.
+func IsLabelKey(value string) []string {
+	var errs []string
+	parts := strings.Split(value, "/")
+	var name string
+	switch len(parts) {
+	case 1:
+		name = parts[0]
+	case 2:
+		var prefix string
+		prefix, name = parts[0], parts[1]
+		if len(prefix) == 0 {
+			errs = append(errs, "prefix part "+EmptyError())
+		} else if msgs := IsDNS1123Subdomain(prefix); len(msgs) != 0 {
+			errs = append(errs, prefixEach(msgs, "prefix part ")...)
+		}
+	default:
+		return append(errs, "a valid label key "+RegexError(labelKeyErrMsg, labelKeyFmt, "MyName", "my.name", "123-abc")+
+			" with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')")
+	}
+
+	if len(name) == 0 {
+		errs = append(errs, "name part "+EmptyError())
+	} else if len(name) > labelKeyMaxLength {
+		errs = append(errs, "name part "+MaxLenError(labelKeyMaxLength))
+	}
+	if !labelKeyRegexp.MatchString(name) {
+		errs = append(errs, "name part "+RegexError(labelKeyErrMsg, labelKeyFmt, "MyName", "my.name", "123-abc"))
+	}
+	return errs
+}
+
+const labelValueFmt string = "(" + labelKeyFmt + ")?"
+const labelValueErrMsg string = "a valid label must be an empty string or consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character"
+
+// LabelValueMaxLength is a label's max length
+const LabelValueMaxLength int = 63
+
+var labelValueRegexp = regexp.MustCompile("^" + labelValueFmt + "$")
+
+// IsLabelValue tests whether the value passed is a valid label value.  If
+// the value is not valid, a list of error strings is returned.  Otherwise an
+// empty list (or nil) is returned.
+func IsLabelValue(value string) []string {
+	var errs []string
+	if len(value) > LabelValueMaxLength {
+		errs = append(errs, MaxLenError(LabelValueMaxLength))
+	}
+	if !labelValueRegexp.MatchString(value) {
+		errs = append(errs, RegexError(labelValueErrMsg, labelValueFmt, "MyValue", "my_value", "12345"))
+	}
+	return errs
+}
+
+func prefixEach(msgs []string, prefix string) []string {
+	for i := range msgs {
+		msgs[i] = prefix + msgs[i]
+	}
+	return msgs
+}
+
+// IsPrefixedLabelKey tests whether the value passed is a valid label key with
+// a domain prefix. This allows "example.com/key" but not "key".
+// If the value is not valid, a list of error strings is returned. Otherwise,
+// an empty list (or nil) is returned.
+func IsPrefixedLabelKey(value string) []string {
+	if errs := IsLabelKey(value); len(errs) > 0 {
+		return errs
+	}
+
+	segments := strings.Split(value, "/")
+	if len(segments) != 2 {
+		return []string{"must include a prefix (e.g. 'example.com/key')"}
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/kube_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/kube_test.go
new file mode 100644
index 0000000000..59f6f2cd28
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/kube_test.go
@@ -0,0 +1,145 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestIsLabelKey(t *testing.T) {
+	successCases := []string{
+		"simple",
+		"now-with-dashes",
+		"1-starts-with-num",
+		"1234",
+		"simple/simple",
+		"now-with-dashes/simple",
+		"now-with-dashes/now-with-dashes",
+		"now.with.dots/simple",
+		"now-with.dashes-and.dots/simple",
+		"1-num.2-num/3-num",
+		"1234/5678",
+		"1.2.3.4/5678",
+		"Uppercase_Is_OK_123",
+		"example.com/Uppercase_Is_OK_123",
+		"requests.storage-foo",
+		strings.Repeat("a", 63),
+		strings.Repeat("a", 253) + "/" + strings.Repeat("b", 63),
+	}
+	for i := range successCases {
+		if errs := IsLabelKey(successCases[i]); len(errs) != 0 {
+			t.Errorf("case[%d]: %q: expected success: %v", i, successCases[i], errs)
+		}
+	}
+
+	errorCases := []string{
+		"nospecialchars%^=@",
+		"cantendwithadash-",
+		"-cantstartwithadash-",
+		"only/one/slash",
+		"Example.com/abc",
+		"example_com/abc",
+		"example.com/",
+		"/simple",
+		strings.Repeat("a", 64),
+		strings.Repeat("a", 254) + "/abc",
+	}
+	for i := range errorCases {
+		if errs := IsLabelKey(errorCases[i]); len(errs) == 0 {
+			t.Errorf("case[%d]: %q: expected failure", i, errorCases[i])
+		}
+	}
+}
+
+func TestIsLabelValue(t *testing.T) {
+	successCases := []string{
+		"simple",
+		"now-with-dashes",
+		"1-starts-with-num",
+		"end-with-num-1",
+		"1234",                  // only num
+		strings.Repeat("a", 63), // to the limit
+		"",                      // empty value
+	}
+	for i := range successCases {
+		if errs := IsLabelValue(successCases[i]); len(errs) != 0 {
+			t.Errorf("case %s expected success: %v", successCases[i], errs)
+		}
+	}
+
+	errorCases := []string{
+		"nospecialchars%^=@",
+		"Tama-nui-te-rā.is.Māori.sun",
+		"\\backslashes\\are\\bad",
+		"-starts-with-dash",
+		"ends-with-dash-",
+		".starts.with.dot",
+		"ends.with.dot.",
+		strings.Repeat("a", 64), // over the limit
+	}
+	for i := range errorCases {
+		if errs := IsLabelValue(errorCases[i]); len(errs) == 0 {
+			t.Errorf("case[%d] expected failure", i)
+		}
+	}
+}
+
+func TestIsPrefixedLabelKey(t *testing.T) {
+	successCases := []string{
+		"simple/simple",
+		"now-with-dashes/simple",
+		"now-with-dashes/now-with-dashes",
+		"now.with.dots/simple",
+		"now-with.dashes-and.dots/simple",
+		"1-num.2-num/3-num",
+		"1234/5678",
+		"1.2.3.4/5678",
+		"example.com/Uppercase_Is_OK_123",
+		strings.Repeat("a", 253) + "/" + strings.Repeat("b", 63),
+	}
+	for i := range successCases {
+		if errs := IsPrefixedLabelKey(successCases[i]); len(errs) != 0 {
+			t.Errorf("case[%d]: %q: expected success: %v", i, successCases[i], errs)
+		}
+	}
+
+	errorCases := []string{
+		"simple",
+		"now-with-dashes",
+		"1-starts-with-num",
+		"1234",
+		"Uppercase_Is_OK_123",
+		"requests.storage-foo",
+		strings.Repeat("a", 63),
+		"nospecialchars%^=@",
+		"cantendwithadash-",
+		"-cantstartwithadash-",
+		"only/one/slash",
+		"Example.com/abc",
+		"example_com/abc",
+		"example.com/",
+		"/simple",
+		strings.Repeat("a", 64),
+		strings.Repeat("a", 254) + "/abc",
+	}
+	for i := range errorCases {
+		if errs := IsPrefixedLabelKey(errorCases[i]); len(errs) == 0 {
+			t.Errorf("case[%d]: %q: expected failure", i, errorCases[i])
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/path.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/path.go
new file mode 100644
index 0000000000..c41b1d4731
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/path.go
@@ -0,0 +1,63 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"fmt"
+	"strings"
+)
+
+// Strings that cannot be used as names specified as path segments (like the
+// REST API or etcd store).
+var pathSegmentNameMayNotBe = []string{".", ".."}
+
+// Substrings that cannot be used in names specified as path segments (like the
+// REST API or etcd store).
+var pathSegmentNameMayNotContain = []string{"/", "%"}
+
+// IsPathSegmentName validates the name can be safely encoded as a path
+// segment.
+//
+// Note that, for historical reason, this function does not check for
+// empty strings or impose a limit on the length of the name.
+func IsPathSegmentName(name string) []string {
+	for _, illegalName := range pathSegmentNameMayNotBe {
+		if name == illegalName {
+			return []string{fmt.Sprintf(`may not be '%s'`, illegalName)}
+		}
+	}
+
+	return IsPathSegmentPrefix(name)
+}
+
+// IsPathSegmentPrefix validates the name can be used as a prefix for a
+// name which will be encoded as a path segment It does not check for exact
+// matches with disallowed names, since an arbitrary suffix might make the name
+// valid.
+//
+// Note that, for historical reason, this function does not check for
+// empty strings or impose a limit on the length of the name.
+func IsPathSegmentPrefix(name string) []string {
+	var errors []string
+	for _, illegalContent := range pathSegmentNameMayNotContain {
+		if strings.Contains(name, illegalContent) {
+			errors = append(errors, fmt.Sprintf(`may not contain '%s'`, illegalContent))
+		}
+	}
+
+	return errors
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/path_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/path_test.go
new file mode 100644
index 0000000000..16a1119e82
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/content/path_test.go
@@ -0,0 +1,158 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestIsPathSegmentPrefix(t *testing.T) {
+	testcases := map[string]struct {
+		Name        string
+		ExpectedMsg string
+	}{
+		"empty": {
+			Name:        "",
+			ExpectedMsg: "", // NOTE: this probably should fail
+		},
+		// NOTE: no validation of max length
+		"valid short": {
+			Name:        "foo",
+			ExpectedMsg: "",
+		},
+		"valid long": {
+			Name:        "foo.bar.baz",
+			ExpectedMsg: "",
+		},
+		// Make sure mixed case, non DNS subdomain characters are tolerated
+		"valid complex": {
+			Name:        "sha256:ABCDEF012345@ABCDEF012345",
+			ExpectedMsg: "",
+		},
+		// Make sure non-ascii characters are tolerated
+		"valid extended charset": {
+			Name:        "Iñtërnâtiônàlizætiøn",
+			ExpectedMsg: "",
+		},
+		"dot": {
+			Name:        ".",
+			ExpectedMsg: "",
+		},
+		"dot leading": {
+			Name:        ".test",
+			ExpectedMsg: "",
+		},
+		"dot dot": {
+			Name:        "..",
+			ExpectedMsg: "",
+		},
+		"dot dot leading": {
+			Name:        "..test",
+			ExpectedMsg: "",
+		},
+		"slash": {
+			Name:        "foo/bar",
+			ExpectedMsg: "/",
+		},
+		"percent": {
+			Name:        "foo%bar",
+			ExpectedMsg: "%",
+		},
+	}
+
+	for k, tc := range testcases {
+		msgs := IsPathSegmentPrefix(tc.Name)
+		if len(tc.ExpectedMsg) == 0 && len(msgs) > 0 {
+			t.Errorf("%s: expected no error, got %v", k, msgs)
+		}
+		if len(tc.ExpectedMsg) > 0 && len(msgs) == 0 {
+			t.Errorf("%s: expected error, got none", k)
+		}
+		if len(tc.ExpectedMsg) > 0 && !strings.Contains(msgs[0], tc.ExpectedMsg) {
+			t.Errorf("%s: expected error containing %q, got %v", k, tc.ExpectedMsg, msgs[0])
+		}
+	}
+}
+
+func TestIsPathSegmentName(t *testing.T) {
+	testcases := map[string]struct {
+		Name        string
+		ExpectedMsg string
+	}{
+		"empty": {
+			Name:        "",
+			ExpectedMsg: "", // NOTE: this probably should fail
+		},
+		// NOTE: no validation of max length
+		"valid short": {
+			Name:        "foo",
+			ExpectedMsg: "",
+		},
+		"valid long": {
+			Name:        "foo.bar.baz",
+			ExpectedMsg: "",
+		},
+		// Make sure mixed case, non DNS subdomain characters are tolerated
+		"valid complex": {
+			Name:        "sha256:ABCDEF012345@ABCDEF012345",
+			ExpectedMsg: "",
+		},
+		// Make sure non-ascii characters are tolerated
+		"valid extended charset": {
+			Name:        "Iñtërnâtiônàlizætiøn",
+			ExpectedMsg: "",
+		},
+		"dot": {
+			Name:        ".",
+			ExpectedMsg: ".",
+		},
+		"dot leading": {
+			Name:        ".test",
+			ExpectedMsg: "",
+		},
+		"dot dot": {
+			Name:        "..",
+			ExpectedMsg: "..",
+		},
+		"dot dot leading": {
+			Name:        "..test",
+			ExpectedMsg: "",
+		},
+		"slash": {
+			Name:        "foo/bar",
+			ExpectedMsg: "/",
+		},
+		"percent": {
+			Name:        "foo%bar",
+			ExpectedMsg: "%",
+		},
+	}
+
+	for k, tc := range testcases {
+		msgs := IsPathSegmentName(tc.Name)
+		if len(tc.ExpectedMsg) == 0 && len(msgs) > 0 {
+			t.Errorf("%s: expected no error, got %v", k, msgs)
+		}
+		if len(tc.ExpectedMsg) > 0 && len(msgs) == 0 {
+			t.Errorf("%s: expected error, got none", k)
+		}
+		if len(tc.ExpectedMsg) > 0 && !strings.Contains(msgs[0], tc.ExpectedMsg) {
+			t.Errorf("%s: expected error containing %q, got %v", k, tc.ExpectedMsg, msgs[0])
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/dependentrequired.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/dependentrequired.go
new file mode 100644
index 0000000000..69222c9752
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/dependentrequired.go
@@ -0,0 +1,83 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// DependentRequired verifies that when triggerIsSet(obj) is true, dependentIsSet(obj)
+// is also true; otherwise reports an error at fldPath.Child(dependentName).
+// On Update, the check is skipped if neither side's set-ness changed from oldObj,
+// so unrelated updates can proceed past a pre-existing violation.
+func DependentRequired[T any](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *T,
+	triggerName string, triggerIsSet ExtractorFn[*T, bool],
+	dependentName string, dependentIsSet ExtractorFn[*T, bool],
+) field.ErrorList {
+	if obj == nil {
+		return nil
+	}
+	if op.Type == operation.Update && oldObj != nil {
+		if triggerIsSet(obj) == triggerIsSet(oldObj) && dependentIsSet(obj) == dependentIsSet(oldObj) {
+			return nil
+		}
+	}
+	if !triggerIsSet(obj) {
+		return nil
+	}
+	if dependentIsSet(obj) {
+		return nil
+	}
+	return field.ErrorList{
+		field.Required(fldPath.Child(dependentName),
+			fmt.Sprintf("must be set when %s is set", triggerName)).
+			WithOrigin("dependentRequired"),
+	}
+}
+
+// DependentForbidden verifies that when triggerIsSet(obj) is true, dependentIsSet(obj)
+// is false; otherwise reports an error at fldPath.Child(dependentName).
+// On Update, the check is skipped if neither side's set-ness changed from oldObj,
+// so unrelated updates can proceed past a pre-existing violation.
+func DependentForbidden[T any](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *T,
+	triggerName string, triggerIsSet ExtractorFn[*T, bool],
+	dependentName string, dependentIsSet ExtractorFn[*T, bool],
+) field.ErrorList {
+	if obj == nil {
+		return nil
+	}
+	if op.Type == operation.Update && oldObj != nil {
+		if triggerIsSet(obj) == triggerIsSet(oldObj) && dependentIsSet(obj) == dependentIsSet(oldObj) {
+			return nil
+		}
+	}
+	if !triggerIsSet(obj) {
+		return nil
+	}
+	if !dependentIsSet(obj) {
+		return nil
+	}
+	return field.ErrorList{
+		field.Forbidden(fldPath.Child(dependentName),
+			fmt.Sprintf("may not be set when %s is set", triggerName)).
+			WithOrigin("dependentForbidden"),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/dependentrequired_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/dependentrequired_test.go
new file mode 100644
index 0000000000..5727b9327a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/dependentrequired_test.go
@@ -0,0 +1,194 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"regexp"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestDependentRequired(t *testing.T) {
+	type obj struct {
+		Trigger    *string
+		Dependent  *string
+		OtherField *string
+	}
+
+	triggerIsSet := func(o *obj) bool { return o != nil && o.Trigger != nil }
+	dependentIsSet := func(o *obj) bool { return o != nil && o.Dependent != nil }
+
+	cases := []struct {
+		name   string
+		op     operation.Operation
+		obj    *obj
+		oldObj *obj
+		err    string // regex; empty means expect no error
+	}{{
+		name: "create: trigger unset, dependent set",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  &obj{Dependent: new("d")},
+	}, {
+		name: "create: trigger set, dependent set",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  &obj{Trigger: new("t"), Dependent: new("d")},
+	}, {
+		name: "create: trigger set, dependent unset",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  &obj{Trigger: new("t")},
+		err:  `fldpath\.dependent: Required value: must be set when trigger is set`,
+	}, {
+		name: "create: nil obj",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  nil,
+	}, {
+		name:   "ratchet: unrelated field changed, trigger and dependent set-ness unchanged",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t"), OtherField: new("new")},
+		oldObj: &obj{Trigger: new("t"), OtherField: new("old")},
+	}, {
+		name:   "ratchet: trigger value changed, set-ness unchanged",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t")},
+		oldObj: &obj{Trigger: new("old")},
+	}, {
+		name:   "update: trigger newly set",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t")},
+		oldObj: &obj{},
+		err:    `fldpath\.dependent: Required value: must be set when trigger is set`,
+	}, {
+		name:   "update: dependent newly cleared",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t")},
+		oldObj: &obj{Trigger: new("t"), Dependent: new("d")},
+		err:    `fldpath\.dependent: Required value: must be set when trigger is set`,
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := DependentRequired(context.Background(), tc.op,
+				field.NewPath("fldpath"), tc.obj, tc.oldObj,
+				"trigger", triggerIsSet,
+				"dependent", dependentIsSet)
+			if len(result) > 0 && tc.err == "" {
+				t.Fatalf("unexpected failure: %v", fmtErrs(result))
+			}
+			if len(result) == 0 && tc.err != "" {
+				t.Fatalf("unexpected success: expected %q", tc.err)
+			}
+			if len(result) > 1 {
+				t.Fatalf("unexpected multi-error: %v", fmtErrs(result))
+			}
+			if len(result) > 0 {
+				if !regexp.MustCompile(tc.err).MatchString(result[0].Error()) {
+					t.Errorf("wrong error\nexpected: %q\n     got: %v", tc.err, fmtErrs(result))
+				}
+				if result[0].Origin != "dependentRequired" {
+					t.Errorf("expected origin %q, got %q", "dependentRequired", result[0].Origin)
+				}
+			}
+		})
+	}
+}
+
+func TestDependentForbidden(t *testing.T) {
+	type obj struct {
+		Trigger    *string
+		Dependent  *string
+		OtherField *string
+	}
+
+	triggerIsSet := func(o *obj) bool { return o != nil && o.Trigger != nil }
+	dependentIsSet := func(o *obj) bool { return o != nil && o.Dependent != nil }
+
+	cases := []struct {
+		name   string
+		op     operation.Operation
+		obj    *obj
+		oldObj *obj
+		err    string // regex; empty means expect no error
+	}{{
+		name: "create: trigger unset, dependent set",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  &obj{Dependent: new("d")},
+	}, {
+		name: "create: trigger set, dependent unset",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  &obj{Trigger: new("t")},
+	}, {
+		name: "create: trigger set, dependent set",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  &obj{Trigger: new("t"), Dependent: new("d")},
+		err:  `fldpath\.dependent: Forbidden: may not be set when trigger is set`,
+	}, {
+		name: "create: nil obj",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  nil,
+	}, {
+		name:   "ratchet: unrelated field changed, trigger and dependent set-ness unchanged",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t"), Dependent: new("d"), OtherField: new("new")},
+		oldObj: &obj{Trigger: new("t"), Dependent: new("d"), OtherField: new("old")},
+	}, {
+		name:   "ratchet: trigger value changed, set-ness unchanged",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t"), Dependent: new("d")},
+		oldObj: &obj{Trigger: new("old"), Dependent: new("d")},
+	}, {
+		name:   "update: trigger newly set",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t"), Dependent: new("d")},
+		oldObj: &obj{Dependent: new("d")},
+		err:    `fldpath\.dependent: Forbidden: may not be set when trigger is set`,
+	}, {
+		name:   "update: dependent newly set",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t"), Dependent: new("d")},
+		oldObj: &obj{Trigger: new("t")},
+		err:    `fldpath\.dependent: Forbidden: may not be set when trigger is set`,
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := DependentForbidden(context.Background(), tc.op,
+				field.NewPath("fldpath"), tc.obj, tc.oldObj,
+				"trigger", triggerIsSet,
+				"dependent", dependentIsSet)
+			if len(result) > 0 && tc.err == "" {
+				t.Fatalf("unexpected failure: %v", fmtErrs(result))
+			}
+			if len(result) == 0 && tc.err != "" {
+				t.Fatalf("unexpected success: expected %q", tc.err)
+			}
+			if len(result) > 1 {
+				t.Fatalf("unexpected multi-error: %v", fmtErrs(result))
+			}
+			if len(result) > 0 {
+				if !regexp.MustCompile(tc.err).MatchString(result[0].Error()) {
+					t.Errorf("wrong error\nexpected: %q\n     got: %v", tc.err, fmtErrs(result))
+				}
+				if result[0].Origin != "dependentForbidden" {
+					t.Errorf("expected origin %q, got %q", "dependentForbidden", result[0].Origin)
+				}
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/discriminator.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/discriminator.go
new file mode 100644
index 0000000000..6f4b3cddda
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/discriminator.go
@@ -0,0 +1,74 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// DiscriminatedRule defines a validation to apply for a specific discriminator value.
+type DiscriminatedRule[Tfield any, Tdisc comparable] struct {
+	Value      Tdisc
+	Validation ValidateFunc[Tfield]
+}
+
+// Discriminated validates a member field based on a discriminator value.
+// It iterates through the rules and applies the first one that matches the discriminator.
+// If no rule matches, it applies the defaultValidation if provided.
+//
+// It performs ratcheting: if the operation is an Update, and neither the discriminator
+// nor the value (checked via equiv) have changed, validation is skipped.
+//
+// The equiv function can be called with nil arguments in the case of nilable
+// fields.
+func Discriminated[Tfield any, Tdisc comparable, Tstruct any](ctx context.Context, op operation.Operation, structPath *field.Path,
+	obj, oldObj *Tstruct, fieldName string, getMemberValue func(*Tstruct) Tfield, getDiscriminator func(*Tstruct) Tdisc,
+	equiv MatchFunc[Tfield], defaultValidation ValidateFunc[Tfield], rules []DiscriminatedRule[Tfield, Tdisc],
+) field.ErrorList {
+	value := getMemberValue(obj)
+	discriminator := getDiscriminator(obj)
+	var oldValue Tfield
+	var oldDiscriminator Tdisc
+
+	if oldObj != nil {
+		oldValue = getMemberValue(oldObj)
+		oldDiscriminator = getDiscriminator(oldObj)
+	}
+
+	if op.Type == operation.Update && oldObj != nil && discriminator == oldDiscriminator && equiv(value, oldValue) {
+		return nil
+	}
+
+	fldPath := structPath.Child(fieldName)
+	for _, rule := range rules {
+		if rule.Value == discriminator {
+			if rule.Validation == nil {
+				return nil
+			}
+			return rule.Validation(ctx, op, fldPath, value, oldValue)
+		}
+	}
+
+	if defaultValidation != nil {
+		return defaultValidation(ctx, op, fldPath, value, oldValue)
+	}
+
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/discriminator_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/discriminator_test.go
new file mode 100644
index 0000000000..ae9621b2a9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/discriminator_test.go
@@ -0,0 +1,265 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestDiscriminated(t *testing.T) {
+	errMatch := field.ErrorList{field.Invalid(field.NewPath("foo"), "bar", "match error")}
+	errDefault := field.ErrorList{field.Invalid(field.NewPath("foo"), "bar", "default error")}
+
+	mockValid := func(_ context.Context, _ operation.Operation, _ *field.Path, _, _ *string) field.ErrorList {
+		return nil
+	}
+	mockErrorMatch := func(_ context.Context, _ operation.Operation, _ *field.Path, _, _ *string) field.ErrorList {
+		return errMatch
+	}
+	mockErrorDefault := func(_ context.Context, _ operation.Operation, _ *field.Path, _, _ *string) field.ErrorList {
+		return errDefault
+	}
+
+	// mockEqual compares pointer values by dereferencing, not by pointer identity.
+	mockEqual := func(a, b *string) bool {
+		if a == nil && b == nil {
+			return true
+		}
+		if a == nil || b == nil {
+			return false
+		}
+		return *a == *b
+	}
+
+	testCases := []struct {
+		name              string
+		opType            operation.Type
+		discriminator     string
+		oldDiscriminator  string
+		value             *string
+		oldValue          *string
+		rules             []DiscriminatedRule[*string, string]
+		defaultValidation ValidateFunc[*string]
+		expected          field.ErrorList
+	}{
+		{
+			name:             "matches rule, returns valid",
+			opType:           operation.Create,
+			discriminator:    "A",
+			oldDiscriminator: "A",
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "A", Validation: mockValid},
+				{Value: "B", Validation: mockErrorMatch},
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          nil,
+		},
+		{
+			name:             "matches rule, returns error",
+			opType:           operation.Create,
+			discriminator:    "B",
+			oldDiscriminator: "B",
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "A", Validation: mockValid},
+				{Value: "B", Validation: mockErrorMatch},
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          errMatch,
+		},
+		{
+			name:             "ratcheting: update, unchanged, skips validation",
+			opType:           operation.Update,
+			discriminator:    "B",
+			oldDiscriminator: "B", // unchanged
+			value:            nil,
+			oldValue:         nil, // unchanged
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "B", Validation: mockErrorMatch}, // would fail if run
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          nil,
+		},
+		{
+			name:             "ratcheting: update, same value different pointers, skips validation",
+			opType:           operation.Update,
+			discriminator:    "B",
+			oldDiscriminator: "B",
+			value:            strPtr("same"),
+			oldValue:         strPtr("same"), // different pointer, same value
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "B", Validation: mockErrorMatch}, // would fail if run
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          nil,
+		},
+		{
+			name:             "ratcheting: update, discriminator changed, runs validation",
+			opType:           operation.Update,
+			discriminator:    "B",
+			oldDiscriminator: "A", // changed
+			value:            nil,
+			oldValue:         nil,
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "B", Validation: mockErrorMatch},
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          errMatch,
+		},
+		{
+			name:             "ratcheting: update, value changed, discriminator unchanged, runs validation",
+			opType:           operation.Update,
+			discriminator:    "B",
+			oldDiscriminator: "B", // unchanged
+			value:            strPtr("new"),
+			oldValue:         strPtr("old"), // changed
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "B", Validation: mockErrorMatch},
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          errMatch,
+		},
+		{
+			name:          "matches rule with nil validation, returns valid",
+			opType:        operation.Create,
+			discriminator: "A",
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "A", Validation: nil},
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          nil,
+		},
+		{
+			name:          "no match, runs default",
+			opType:        operation.Create,
+			discriminator: "C",
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "A", Validation: mockValid},
+				{Value: "B", Validation: mockErrorMatch},
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          errDefault,
+		},
+		{
+			name:          "no match, nil default, returns valid",
+			opType:        operation.Create,
+			discriminator: "C",
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "A", Validation: mockValid},
+			},
+			defaultValidation: nil,
+			expected:          nil,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			oldDisc := tc.oldDiscriminator
+			if oldDisc == "" {
+				oldDisc = tc.discriminator
+			}
+
+			type StringP struct {
+				Val  *string
+				Disc string
+			}
+			newObj := &StringP{Val: tc.value, Disc: tc.discriminator}
+			var oldObj *StringP
+			if tc.opType == operation.Update {
+				oldObj = &StringP{Val: tc.oldValue, Disc: oldDisc}
+			}
+			getVal := func(p *StringP) *string { return p.Val }
+			getDisc := func(p *StringP) string { return p.Disc }
+			got := Discriminated[*string, string, StringP](context.Background(), operation.Operation{Type: tc.opType}, field.NewPath("root"), newObj, oldObj, "field", getVal, getDisc, mockEqual, tc.defaultValidation, tc.rules)
+
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
+
+func TestDiscriminatedIntDiscriminator(t *testing.T) {
+	errMatch := field.ErrorList{field.Invalid(field.NewPath("foo"), "bar", "match error")}
+	errDefault := field.ErrorList{field.Invalid(field.NewPath("foo"), "bar", "default error")}
+
+	mockErrorMatch := func(_ context.Context, _ operation.Operation, _ *field.Path, _, _ *string) field.ErrorList {
+		return errMatch
+	}
+	mockErrorDefault := func(_ context.Context, _ operation.Operation, _ *field.Path, _, _ *string) field.ErrorList {
+		return errDefault
+	}
+
+	mockEqual := func(a, b *string) bool {
+		return a == b
+	}
+
+	type IntP struct {
+		Val  *string
+		Disc int
+	}
+	newObj := &IntP{Val: nil, Disc: 1}
+	getVal := func(p *IntP) *string { return p.Val }
+	getDisc := func(p *IntP) int { return p.Disc }
+
+	got := Discriminated[*string, int, IntP](context.Background(), operation.Operation{Type: operation.Create}, field.NewPath("root"), newObj, nil, "field", getVal, getDisc, mockEqual, mockErrorDefault, []DiscriminatedRule[*string, int]{
+		{Value: 1, Validation: mockErrorMatch},
+	})
+	if !reflect.DeepEqual(got, errMatch) {
+		t.Errorf("int discriminator: got %v want %v", got, errMatch)
+	}
+}
+
+func TestDiscriminatedBoolDiscriminator(t *testing.T) {
+	errMatch := field.ErrorList{field.Invalid(field.NewPath("foo"), "bar", "match error")}
+	errDefault := field.ErrorList{field.Invalid(field.NewPath("foo"), "bar", "default error")}
+
+	mockErrorMatch := func(_ context.Context, _ operation.Operation, _ *field.Path, _, _ *string) field.ErrorList {
+		return errMatch
+	}
+	mockErrorDefault := func(_ context.Context, _ operation.Operation, _ *field.Path, _, _ *string) field.ErrorList {
+		return errDefault
+	}
+
+	mockEqual := func(a, b *string) bool {
+		return a == b
+	}
+
+	type BoolP struct {
+		Val  *string
+		Disc bool
+	}
+	newObj := &BoolP{Val: nil, Disc: true}
+	getVal := func(p *BoolP) *string { return p.Val }
+	getDisc := func(p *BoolP) bool { return p.Disc }
+
+	got := Discriminated[*string, bool, BoolP](context.Background(), operation.Operation{Type: operation.Create}, field.NewPath("root"), newObj, nil, "field", getVal, getDisc, mockEqual, mockErrorDefault, []DiscriminatedRule[*string, bool]{
+		{Value: true, Validation: mockErrorMatch},
+	})
+	if !reflect.DeepEqual(got, errMatch) {
+		t.Errorf("bool discriminator: got %v want %v", got, errMatch)
+	}
+}
+
+// strPtr returns a new pointer to a copy of s, guaranteeing a distinct allocation.
+func strPtr(s string) *string {
+	return &s
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/doc.go
new file mode 100644
index 0000000000..eee13e9b38
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/doc.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package validate holds API validation functions which are designed for use
+// with the k8s.io/code-generator/cmd/validation-gen tool.  Each validation
+// function has a similar fingerprint:
+//
+//	func <Name>(ctx context.Context,
+//	            op operation.Operation,
+//	            fldPath *field.Path,
+//	            value, oldValue <nilable type>,
+//	            <other args...>) field.ErrorList
+//
+// The value and oldValue arguments will always be a nilable type.  If the
+// original value was a string, these will be a *string.  If the original value
+// was a slice or map, these will be the same slice or map type.
+//
+// For a CREATE operation, the oldValue will always be nil.  For an UPDATE
+// operation, either value or oldValue may be nil, e.g. when adding or removing
+// a value in a list-map.  Validators which care about UPDATE operations should
+// look at the opCtx argument to know which operation is being executed.
+//
+// Tightened validation (also known as ratcheting validation) is supported by
+// defining a new validation function. For example:
+//
+//	func TightenedMaxLength(ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *string) field.ErrorList {
+//	  if oldValue != nil && len(MaxLength(ctx, op, fldPath, oldValue, nil)) > 0 {
+//	    // old value is not valid, so this value skips the tightened validation
+//	    return nil
+//	  }
+//	  return MaxLength(ctx, op, fldPath, value, nil)
+//	}
+//
+// In general, we cannot distinguish a non-specified slice or map from one that
+// is specified but empty.  Validators should not rely on nil values, but use
+// len() instead.
+package validate
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/each.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/each.go
new file mode 100644
index 0000000000..affc44576b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/each.go
@@ -0,0 +1,348 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"reflect"
+	"slices"
+	"sort"
+
+	"k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// MatchFunc is a function that compares two values of the same type,
+// according to some criteria, and returns true if they match.
+type MatchFunc[T any] func(T, T) bool
+
+// EachValSliceVal performs validation on each element of a slice of values
+// using the provided validation function.
+//
+// For update operations, the match function finds corresponding values in
+// oldSlice for each value in newSlice. This comparison can be either full or
+// partial (e.g., matching only specific struct fields that serve as a unique
+// identifier). If match is nil, validation proceeds without considering old
+// values, and the equiv function is not used.
+//
+// For update operations, the equiv function checks if a new value is
+// equivalent to its corresponding old value, enabling validation ratcheting.
+// If equiv is nil but match is provided, the match function is assumed to
+// perform full value comparison.
+//
+// The match and equiv functions will never be called with nil arguments.
+//
+// Note: The slice element type must be non-nilable.
+func EachValSliceVal[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newSlice, oldSlice []T,
+	match, equiv MatchFunc[*T], validator ValidateFunc[*T]) field.ErrorList {
+	var errs field.ErrorList
+	for i := range newSlice {
+		val := &newSlice[i]
+
+		var old *T
+		if match != nil && len(oldSlice) > 0 {
+			old = lookup(oldSlice, val, match)
+		}
+		// If the operation is an update, for validation ratcheting, skip re-validating if the old
+		// value exists and either:
+		// 1. The match function provides full comparison (equiv is nil)
+		// 2. The equiv function confirms the values are equivalent (either directly or semantically)
+		//
+		// The equiv function provides equality comparison when match uses partial comparison.
+		if op.Type == operation.Update && old != nil && (equiv == nil || equiv(val, old)) {
+			continue
+		}
+		errs = append(errs, validator(ctx, op, fldPath.Index(i), val, old)...)
+	}
+	return errs
+}
+
+// EachPtrSliceVal performs validation on each element of a slice of pointers
+// using the provided validation function.
+//
+// For update operations, the match function finds corresponding values in
+// oldSlice for each value in newSlice. This comparison can be either full or
+// partial (e.g., matching only specific struct fields that serve as a unique
+// identifier). If match is nil, validation proceeds without considering old
+// values, and the equiv function is not used.
+//
+// For update operations, the equiv function checks if a new value is
+// equivalent to its corresponding old value, enabling validation ratcheting.
+// If equiv is nil but match is provided, the match function is assumed to
+// perform full value comparison.
+//
+// The match and equiv functions will never be called with nil arguments.
+func EachPtrSliceVal[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newSlice, oldSlice []*T,
+	match, equiv MatchFunc[*T], validator ValidateFunc[*T]) field.ErrorList {
+	var errs field.ErrorList
+	for i := range newSlice {
+		val := newSlice[i]
+		if val == nil {
+			// Ignore nil items; they are supposed to have been checked by PtrSliceNoNils.
+			continue
+		}
+
+		var old *T
+		if match != nil && len(oldSlice) > 0 {
+			old = lookupPointer(oldSlice, val, match)
+		}
+		if op.Type == operation.Update && old != nil && (equiv == nil || equiv(val, old)) {
+			continue
+		}
+		errs = append(errs, validator(ctx, op, fldPath.Index(i), val, old)...)
+	}
+	return errs
+}
+
+// lookup returns a pointer to the first element in the list that matches the
+// target, according to the provided comparison function, or else nil.
+func lookup[T any](list []T, target *T, match MatchFunc[*T]) *T {
+	for i := range list {
+		if match(&list[i], target) {
+			return &list[i]
+		}
+	}
+	return nil
+}
+
+// lookupPointer returns the first non-nil element in the list that matches the
+// target, according to the provided comparison function, or else nil.
+// Nil elements in the list are skipped.
+func lookupPointer[T any](list []*T, target *T, match MatchFunc[*T]) *T {
+	for i := range list {
+		if list[i] == nil {
+			// We can't really do anything about nil entries in the old list,
+			// just skip them.
+			continue
+		}
+		if match(list[i], target) {
+			return list[i]
+		}
+	}
+	return nil
+}
+
+// EachMapVal validates each value in newMap using the specified validation
+// function, passing the corresponding old value from oldMap if the key exists in oldMap.
+// For update operations, it implements validation ratcheting by skipping validation
+// when the old value exists and the equiv function confirms the values are equivalent.
+// The value-type of the map is assumed to not be nilable.
+//
+// The equiv function will never be called with nil arguments.
+//
+// If equiv is nil, value-based ratcheting is disabled and all values will be validated.
+func EachMapVal[K ~string, V any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]V,
+	equiv MatchFunc[*V], validator ValidateFunc[*V]) field.ErrorList {
+	var errs field.ErrorList
+	for key, val := range newMap {
+		var old *V
+		if o, found := oldMap[key]; found {
+			old = &o
+		}
+		// If the operation is an update, for validation ratcheting, skip re-validating if the old
+		// value is found and the equiv function confirms the values are equivalent.
+		if op.Type == operation.Update && old != nil && equiv != nil && equiv(&val, old) {
+			continue
+		}
+		errs = append(errs, validator(ctx, op, fldPath.Key(string(key)), &val, old)...)
+	}
+	return errs
+}
+
+// EachPtrMapVal validates each value in newMap (which is a map of pointers)
+// using the specified validation function, passing the corresponding old value
+// from oldMap if the key exists in oldMap.
+// For update operations, it implements validation ratcheting by skipping validation
+// when the old value exists and the equiv function confirms the values are equivalent.
+//
+// The equiv function will never be called with nil arguments.
+//
+// If equiv is nil, value-based ratcheting is disabled and all values will be validated.
+func EachPtrMapVal[K ~string, V any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]*V,
+	equiv MatchFunc[*V], validator ValidateFunc[*V]) field.ErrorList {
+	var errs field.ErrorList
+	for key, val := range newMap {
+		if val == nil {
+			// Ignore nil items; they are supposed to have been checked by PtrMapNoNils.
+			continue
+		}
+
+		var old *V
+		if o, found := oldMap[key]; found {
+			old = o
+		}
+		// If the operation is an update, for validation ratcheting, skip re-validating if the old
+		// value is found and the equiv function confirms the values are equivalent.
+		if op.Type == operation.Update && old != nil && equiv != nil && equiv(val, old) {
+			continue
+		}
+		errs = append(errs, validator(ctx, op, fldPath.Key(string(key)), val, old)...)
+	}
+	return errs
+}
+
+// EachMapKey validates each element of newMap with the specified
+// validation function.
+func EachMapKey[K ~string, T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]T,
+	validator ValidateFunc[*K]) field.ErrorList {
+	var errs field.ErrorList
+	for key := range newMap {
+		var old *K
+		if _, found := oldMap[key]; found {
+			old = &key
+		}
+		// If the operation is an update, for validation ratcheting, skip re-validating if
+		// the key is found in oldMap.
+		if op.Type == operation.Update && old != nil {
+			continue
+		}
+		// Note: the field path is the field, not the key.
+		errs = append(errs, validator(ctx, op, fldPath, &key, nil)...)
+	}
+	return errs
+}
+
+// ValSliceUnique verifies that each element of a slice of values is unique,
+// according to the match function. It compares every element of the slice with
+// every other element and returns errors for non-unique items.
+//
+// The match function will never be called with nil arguments.
+func ValSliceUnique[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, newSlice, _ []T, match MatchFunc[*T]) field.ErrorList {
+	var dups []int
+	for i := range newSlice {
+		for j := i + 1; j < len(newSlice); j++ {
+			if match(&newSlice[i], &newSlice[j]) {
+				if dups == nil {
+					dups = make([]int, 0, len(newSlice))
+				}
+				if !slices.Contains(dups, j) {
+					dups = append(dups, j)
+				}
+			}
+		}
+	}
+
+	var errs field.ErrorList
+	sort.Ints(dups)
+	for _, i := range dups {
+		var val any = newSlice[i]
+		// TODO: we don't want the whole item to be logged in the error, just
+		// the key(s). Unfortunately, the way errors are rendered, it comes out
+		// as something like "map[string]any{...}" which is not very nice. Once
+		// that is fixed, we can consider adding a way for this function to
+		// specify that just the keys should be rendered in the error.
+		errs = append(errs, field.Duplicate(fldPath.Index(i), val))
+	}
+	return errs
+}
+
+// PtrSliceUnique verifies that each element of a slice of pointers is unique,
+// according to the match function. It compares every element of the slice with
+// every other element and returns errors for non-unique items.
+//
+// The match function will never be called with nil arguments.
+func PtrSliceUnique[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, newSlice, _ []*T, match MatchFunc[*T]) field.ErrorList {
+	var errs field.ErrorList
+	var dups []int
+	for i := range newSlice {
+		if newSlice[i] == nil {
+			// Ignore nil items; they are supposed to have been checked by PtrSliceNoNils.
+			continue
+		}
+		for j := i + 1; j < len(newSlice); j++ {
+			if newSlice[j] == nil {
+				continue
+			}
+			if match(newSlice[i], newSlice[j]) {
+				if dups == nil {
+					dups = make([]int, 0, len(newSlice))
+				}
+				if !slices.Contains(dups, j) {
+					dups = append(dups, j)
+				}
+			}
+		}
+	}
+
+	sort.Ints(dups)
+	for _, i := range dups {
+		var val any = newSlice[i]
+		errs = append(errs, field.Duplicate(fldPath.Index(i), val))
+	}
+	return errs
+}
+
+// SemanticDeepEqual is a MatchFunc that uses equality.Semantic.DeepEqual to
+// compare two values.
+// This wrapper is needed because MatchFunc requires a function that takes two
+// arguments of specific type T, while equality.Semantic.DeepEqual takes
+// arguments of type interface{}/any. The wrapper satisfies the type
+// constraints of MatchFunc while leveraging the underlying semantic equality
+// logic. It can be used by any other function that needs to call DeepEqual.
+//
+// Deprecated: Callers should use equality.Semantic.DeepEqual directly.
+func SemanticDeepEqual[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
+
+// ReflectDeepEqual is a MatchFunc that uses reflect.DeepEqual to compare two
+// values.
+// This wrapper is needed because MatchFunc requires a function that takes two
+// arguments of specific type T, while reflect.DeepEqual takes arguments of
+// type interface{}/any. It can be used by any other function that needs to
+// call DeepEqual.
+func ReflectDeepEqual[T any](a, b T) bool {
+	return reflect.DeepEqual(a, b)
+}
+
+// DirectEqual is a MatchFunc that dereferences two pointers and uses the ==
+// operator to compare the values. If both pointers are nil, it returns true.
+// If one pointer is nil and the other is not, it returns false.
+// It can be used by any other function that needs to compare two pointees
+// directly.
+func DirectEqual[T comparable](a, b *T) bool {
+	if a == b {
+		return true
+	}
+	if a == nil || b == nil {
+		return false
+	}
+	return *a == *b
+}
+
+// PtrSliceNoNils returns a Required error for each nil element in a slice of
+// pointers.
+func PtrSliceNoNils[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, newSlice, _ []*T) (errs field.ErrorList) {
+	for i := range newSlice {
+		if newSlice[i] == nil {
+			errs = append(errs, field.Required(fldPath.Index(i), ""))
+		}
+	}
+	return
+}
+
+// PtrMapNoNils returns a Required error for each nil element in a map of
+// pointers.
+func PtrMapNoNils[K ~string, V any](_ context.Context, _ operation.Operation, fldPath *field.Path, newMap, _ map[K]*V) (errs field.ErrorList) {
+	for key, val := range newMap {
+		if val == nil {
+			errs = append(errs, field.Required(fldPath.Key(string(key)), ""))
+		}
+	}
+	return
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/each_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/each_test.go
new file mode 100644
index 0000000000..a8b73ae6fc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/each_test.go
@@ -0,0 +1,846 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"slices"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+type TestStruct struct {
+	I int
+	D string
+}
+
+type TestStructWithKey struct {
+	Key string
+	I   int
+	D   string
+}
+
+type NonComparableKey struct {
+	I *int
+}
+
+type NonComparableStruct struct {
+	I int
+	S []string
+}
+
+type NonComparableStructWithKey struct {
+	Key string
+	I   int
+	S   []string
+}
+
+type NonComparableStructWithPtr struct {
+	I int
+	P *int
+}
+
+func TestEachValSliceVal(t *testing.T) {
+	testEachValSliceVal(t, "valid", []int{11, 12, 13})
+	testEachValSliceVal(t, "valid", []string{"a", "b", "c"})
+	testEachValSliceVal(t, "valid", []TestStruct{{11, "a"}, {12, "b"}, {13, "c"}})
+
+	testEachValSliceVal(t, "empty", []int{})
+	testEachValSliceVal(t, "empty", []string{})
+	testEachValSliceVal(t, "empty", []TestStruct{})
+
+	testEachValSliceVal[int](t, "nil", nil)
+	testEachValSliceVal[string](t, "nil", nil)
+	testEachValSliceVal[TestStruct](t, "nil", nil)
+
+	testEachValSliceValUpdate(t, "valid", []int{11, 12, 13})
+	testEachValSliceValUpdate(t, "valid", []string{"a", "b", "c"})
+	testEachValSliceValUpdate(t, "valid", []TestStruct{{11, "a"}, {12, "b"}, {13, "c"}})
+
+	testEachValSliceValUpdate(t, "empty", []int{})
+	testEachValSliceValUpdate(t, "empty", []string{})
+	testEachValSliceValUpdate(t, "empty", []TestStruct{})
+
+	testEachValSliceValUpdate[int](t, "nil", nil)
+	testEachValSliceValUpdate[string](t, "nil", nil)
+	testEachValSliceValUpdate[TestStruct](t, "nil", nil)
+}
+
+func testEachValSliceVal[T any](t *testing.T, name string, input []T) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			if oldVal != nil {
+				t.Errorf("expected nil oldVal, got %v", *oldVal)
+			}
+			calls++
+			return nil
+		}
+		_ = EachValSliceVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, nil, vfn)
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func testEachValSliceValUpdate[T any](t *testing.T, name string, input []T) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			if oldVal == nil {
+				t.Fatalf("expected non-nil oldVal")
+			}
+			if !reflect.DeepEqual(*newVal, *oldVal) {
+				t.Errorf("expected oldVal == newVal, got %v, %v", *oldVal, *newVal)
+			}
+			calls++
+			return nil
+		}
+		old := make([]T, len(input))
+		copy(old, input)
+		slices.Reverse(old)
+		match := func(a, b *T) bool { return reflect.DeepEqual(*a, *b) }
+		_ = EachValSliceVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, old, match, match, vfn)
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func TestEachValSliceValRatcheting(t *testing.T) {
+	testEachValSliceValRatcheting(t, "ComparableStruct same data different order",
+		[]TestStruct{
+			{11, "a"}, {12, "b"}, {13, "c"},
+		},
+		[]TestStruct{
+			{11, "a"}, {13, "c"}, {12, "b"},
+		},
+		ReflectDeepEqual,
+		nil,
+	)
+	testEachValSliceValRatcheting(t, "ComparableStruct less data in new, exist in old",
+		[]TestStruct{
+			{11, "a"}, {12, "b"}, {13, "c"},
+		},
+		[]TestStruct{
+			{11, "a"}, {13, "c"},
+		},
+		DirectEqual,
+		nil,
+	)
+	testEachValSliceValRatcheting(t, "Comparable struct with key same data different order",
+		[]TestStructWithKey{
+			{Key: "a", I: 11, D: "a"}, {Key: "b", I: 12, D: "b"}, {Key: "c", I: 13, D: "c"},
+		},
+		[]TestStructWithKey{
+			{Key: "a", I: 11, D: "a"}, {Key: "c", I: 13, D: "c"}, {Key: "b", I: 12, D: "b"},
+		},
+		MatchFunc[*TestStructWithKey](func(a, b *TestStructWithKey) bool {
+			return a.Key == b.Key
+		}),
+		DirectEqual,
+	)
+	testEachValSliceValRatcheting(t, "Comparable struct with key less data in new, exist in old",
+		[]TestStructWithKey{
+			{Key: "a", I: 11, D: "a"}, {Key: "b", I: 12, D: "b"}, {Key: "c", I: 13, D: "c"},
+		},
+		[]TestStructWithKey{
+			{Key: "a", I: 11, D: "a"}, {Key: "c", I: 13, D: "c"},
+		},
+		MatchFunc[*TestStructWithKey](func(a, b *TestStructWithKey) bool {
+			return a.Key == b.Key
+		}),
+		DirectEqual,
+	)
+	testEachValSliceValRatcheting(t, "NonComparableStruct same data different order",
+		[]NonComparableStruct{
+			{I: 11, S: []string{"a"}}, {I: 12, S: []string{"b"}}, {I: 13, S: []string{"c"}},
+		},
+		[]NonComparableStruct{
+			{I: 11, S: []string{"a"}}, {I: 13, S: []string{"c"}}, {I: 12, S: []string{"b"}},
+		},
+		ReflectDeepEqual,
+		nil,
+	)
+	testEachValSliceValRatcheting(t, "NonComparableStructWithKey same data different order",
+		[]NonComparableStructWithKey{
+			{Key: "a", I: 11, S: []string{"a"}}, {Key: "b", I: 12, S: []string{"b"}}, {Key: "c", I: 13, S: []string{"c"}},
+		},
+		[]NonComparableStructWithKey{
+			{Key: "a", I: 11, S: []string{"a"}}, {Key: "b", I: 12, S: []string{"b"}}, {Key: "c", I: 13, S: []string{"c"}},
+		},
+		MatchFunc[*NonComparableStructWithKey](func(a, b *NonComparableStructWithKey) bool {
+			return a.Key == b.Key
+		}),
+		ReflectDeepEqual,
+	)
+
+}
+
+func testEachValSliceValRatcheting[T any](t *testing.T, name string, old, new []T, match, equiv MatchFunc[*T]) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			return field.ErrorList{field.Invalid(fldPath, *newVal, "expected no calls")}
+		}
+		errs := EachValSliceVal(context.Background(), operation.Operation{Type: operation.Update}, field.NewPath("test"), new, old, match, equiv, vfn)
+		if len(errs) > 0 {
+			t.Errorf("expected no errors, got %d: %s", len(errs), fmtErrs(errs))
+		}
+	})
+}
+
+func TestEachMapVal(t *testing.T) {
+	testEachMapVal(t, "valid", map[string]int{"one": 11, "two": 12, "three": 13})
+	testEachMapVal(t, "valid", map[string]string{"A": "a", "B": "b", "C": "c"})
+	testEachMapVal(t, "valid", map[string]TestStruct{"one": {11, "a"}, "two": {12, "b"}, "three": {13, "c"}})
+
+	testEachMapVal(t, "empty", map[string]int{})
+	testEachMapVal(t, "empty", map[string]string{})
+	testEachMapVal(t, "empty", map[string]TestStruct{})
+
+	testEachMapVal[int](t, "nil", nil)
+	testEachMapVal[string](t, "nil", nil)
+	testEachMapVal[TestStruct](t, "nil", nil)
+}
+
+func testEachMapVal[T any](t *testing.T, name string, input map[string]T) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			if oldVal != nil {
+				t.Errorf("expected nil oldVal, got %v", *oldVal)
+			}
+			calls++
+			return nil
+		}
+		_ = EachMapVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, vfn)
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func TestEachMapValRatcheting(t *testing.T) {
+	testEachMapValRatcheting(t, "primitive same data",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13, "two": 12},
+		DirectEqual,
+		0,
+	)
+	testEachMapValRatcheting(t, "primitive less data in new, exist in old",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13},
+		DirectEqual,
+		0,
+	)
+	testEachMapValRatcheting(t, "primitive new data, not exist in old",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13, "two": 12, "four": 14},
+		DirectEqual,
+		1,
+	)
+	testEachMapValRatcheting(t, "non comparable value, same data",
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"three": {I: 13, S: []string{"c"}},
+			"two":   {I: 12, S: []string{"b"}},
+		},
+		ReflectDeepEqual,
+		0,
+	)
+	testEachMapValRatcheting(t, "non comparable value, less data in new, exist in old",
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		ReflectDeepEqual,
+		0,
+	)
+	testEachMapValRatcheting(t, "non comparable value, new data, not exist in old",
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"three": {I: 13, S: []string{"c"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"four":  {I: 14, S: []string{"d"}},
+		},
+		ReflectDeepEqual,
+		1,
+	)
+	testEachMapValRatcheting(t, "struct with pointer field, same value different pointer",
+		map[string]NonComparableStructWithPtr{
+			"one": {I: 11, P: new(1)},
+			"two": {I: 12, P: new(2)},
+		},
+		map[string]NonComparableStructWithPtr{
+			"one": {I: 11, P: new(1)},
+			"two": {I: 12, P: new(2)},
+		},
+		ReflectDeepEqual,
+		0,
+	)
+	testEachMapValRatcheting(t, "nil map to empty map",
+		nil,
+		map[string]int{},
+		DirectEqual,
+		0,
+	)
+
+	testEachMapValRatcheting(t, "nil map to non-empty map",
+		nil,
+		map[string]int{"one": 1},
+		DirectEqual,
+		1, // Expect validation for new entry
+	)
+
+	testEachMapValRatcheting(t, "empty map to nil map",
+		map[string]int{},
+		nil,
+		DirectEqual,
+		0,
+	)
+
+	testEachMapValRatcheting(t, "non-empty map to nil map",
+		map[string]int{"one": 1},
+		nil,
+		DirectEqual,
+		0,
+	)
+}
+
+func testEachMapValRatcheting[K ~string, V any](t *testing.T, name string, old, new map[K]V, equiv MatchFunc[*V], wantCalls int) {
+	t.Helper()
+	var zero V
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *V) field.ErrorList {
+			calls++
+			return nil
+		}
+		_ = EachMapVal(context.Background(), operation.Operation{Type: operation.Update}, field.NewPath("test"), new, old, equiv, vfn)
+		if calls != wantCalls {
+			t.Errorf("expected %d calls, got %d", wantCalls, calls)
+		}
+	})
+}
+
+func TestEachPtrMapVal(t *testing.T) {
+	testEachPtrMapVal(t, "valid", map[string]*int{"one": new(11), "two": new(12), "three": new(13)})
+	testEachPtrMapVal(t, "valid", map[string]*string{"A": new("a"), "B": new("b"), "C": new("c")})
+	testEachPtrMapVal(t, "valid", map[string]*TestStruct{"one": {11, "a"}, "two": {12, "b"}, "three": {13, "c"}})
+
+	testEachPtrMapVal(t, "empty", map[string]*int{})
+	testEachPtrMapVal(t, "empty", map[string]*string{})
+	testEachPtrMapVal(t, "empty", map[string]*TestStruct{})
+
+	testEachPtrMapVal[int](t, "nil", nil)
+	testEachPtrMapVal[string](t, "nil", nil)
+	testEachPtrMapVal[TestStruct](t, "nil", nil)
+
+	t.Run("nil element ignored", func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *int) field.ErrorList {
+			calls++
+			return nil
+		}
+		input := map[string]*int{"a": new(1), "b": nil, "c": new(3)}
+		errs := EachPtrMapVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, vfn)
+		if len(errs) != 0 {
+			t.Errorf("expected 0 errors, got %d: %v", len(errs), errs)
+		}
+		if calls != 2 {
+			t.Errorf("expected 2 calls, got %d", calls)
+		}
+	})
+}
+
+func testEachPtrMapVal[T any](t *testing.T, name string, input map[string]*T) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(*%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			if oldVal != nil {
+				t.Errorf("expected nil oldVal, got %v", *oldVal)
+			}
+			calls++
+			return nil
+		}
+		errs := EachPtrMapVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, vfn)
+		if len(errs) != 0 {
+			t.Errorf("expected 0 errors, got %d: %v", len(errs), errs)
+		}
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func TestEachPtrMapValRatcheting(t *testing.T) {
+	testEachPtrMapValRatcheting(t, "primitive same data",
+		map[string]*int{"one": new(11), "two": new(12), "three": new(13)},
+		map[string]*int{"one": new(11), "three": new(13), "two": new(12)},
+		DirectEqual,
+		0,
+	)
+	testEachPtrMapValRatcheting(t, "primitive less data in new, exist in old",
+		map[string]*int{"one": new(11), "two": new(12), "three": new(13)},
+		map[string]*int{"one": new(11), "three": new(13)},
+		DirectEqual,
+		0,
+	)
+	testEachPtrMapValRatcheting(t, "primitive new data, not exist in old",
+		map[string]*int{"one": new(11), "two": new(12)},
+		map[string]*int{"one": new(11), "two": new(12), "three": new(13)},
+		DirectEqual,
+		1,
+	)
+	testEachPtrMapValRatcheting(t, "non comparable value, same data",
+		map[string]*NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		map[string]*NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"three": {I: 13, S: []string{"c"}},
+			"two":   {I: 12, S: []string{"b"}},
+		},
+		ReflectDeepEqual,
+		0,
+	)
+	testEachPtrMapValRatcheting(t, "non comparable value, less data in new, exist in old",
+		map[string]*NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		map[string]*NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		ReflectDeepEqual,
+		0,
+	)
+	testEachPtrMapValRatcheting(t, "non comparable value, new data, not exist in old",
+		map[string]*NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		map[string]*NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"three": {I: 13, S: []string{"c"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"four":  {I: 14, S: []string{"d"}},
+		},
+		ReflectDeepEqual,
+		1,
+	)
+	testEachPtrMapValRatcheting(t, "struct with pointer field, same value different pointer",
+		map[string]*NonComparableStructWithPtr{
+			"one": {I: 11, P: new(1)},
+			"two": {I: 12, P: new(2)},
+		},
+		map[string]*NonComparableStructWithPtr{
+			"one": {I: 11, P: new(1)},
+			"two": {I: 12, P: new(2)},
+		},
+		ReflectDeepEqual,
+		0,
+	)
+	testEachPtrMapValRatcheting(t, "nil map to empty map",
+		nil,
+		map[string]*int{},
+		DirectEqual,
+		0,
+	)
+	testEachPtrMapValRatcheting(t, "nil map to non-empty map",
+		nil,
+		map[string]*int{"one": new(1)},
+		DirectEqual,
+		1,
+	)
+	testEachPtrMapValRatcheting(t, "empty map to nil map",
+		map[string]*int{},
+		nil,
+		DirectEqual,
+		0,
+	)
+	testEachPtrMapValRatcheting(t, "non-empty map to nil map",
+		map[string]*int{"one": new(1)},
+		nil,
+		DirectEqual,
+		0,
+	)
+}
+
+func testEachPtrMapValRatcheting[K ~string, V any](t *testing.T, name string, old, new map[K]*V, equiv MatchFunc[*V], wantCalls int) {
+	t.Helper()
+	var zero V
+	t.Run(fmt.Sprintf("%s(*%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *V) field.ErrorList {
+			calls++
+			return nil
+		}
+		_ = EachPtrMapVal(context.Background(), operation.Operation{Type: operation.Update}, field.NewPath("test"), new, old, equiv, vfn)
+		if calls != wantCalls {
+			t.Errorf("expected %d calls, got %d", wantCalls, calls)
+		}
+	})
+}
+
+type StringType string
+
+func TestEachMapKey(t *testing.T) {
+	testEachMapKey(t, "valid", map[string]int{"one": 11, "two": 12, "three": 13})
+	testEachMapKey(t, "valid", map[StringType]string{"A": "a", "B": "b", "C": "c"})
+}
+
+func testEachMapKey[K ~string, V any](t *testing.T, name string, input map[K]V) {
+	t.Helper()
+	var zero K
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *K) field.ErrorList {
+			if oldVal != nil {
+				t.Errorf("expected nil oldVal, got %v", *oldVal)
+			}
+			calls++
+			return nil
+		}
+		_ = EachMapKey(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, vfn)
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func TestEachMapKeyRatcheting(t *testing.T) {
+	testEachMapKeyRatcheting(t, "same data, 0 validation calls",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13, "two": 12},
+		0,
+	)
+	testEachMapKeyRatcheting(t, "less data in new, exist in old, 0 validation calls",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13},
+		0,
+	)
+	testEachMapKeyRatcheting(t, "new data, not exist in old, 1 validation call",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13, "two": 12, "four": 14},
+		1,
+	)
+}
+
+func testEachMapKeyRatcheting[K ~string, V any](t *testing.T, name string, old, new map[K]V, wantCalls int) {
+	t.Helper()
+	var zero V
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *K) field.ErrorList {
+			calls++
+			return nil
+		}
+		_ = EachMapKey(context.Background(), operation.Operation{Type: operation.Update}, field.NewPath("test"), new, old, vfn)
+		if calls != wantCalls {
+			t.Errorf("expected %d calls, got %d", wantCalls, calls)
+		}
+	})
+}
+
+func TestValSliceUniqueComparableValues(t *testing.T) {
+	testValSliceUnique(t, "int_nil", []int(nil), 0)
+	testValSliceUnique(t, "int_empty", []int{}, 0)
+	testValSliceUnique(t, "int_uniq", []int{1, 2, 3}, 0)
+	testValSliceUnique(t, "int_dup", []int{1, 2, 3, 2, 1}, 2)
+
+	testValSliceUnique(t, "string_nil", []string(nil), 0)
+	testValSliceUnique(t, "string_empty", []string{}, 0)
+	testValSliceUnique(t, "string_uniq", []string{"a", "b", "c"}, 0)
+	testValSliceUnique(t, "string_dup", []string{"a", "a", "c", "b", "a"}, 2)
+
+	type isComparable struct {
+		I int
+		S string
+	}
+
+	testValSliceUnique(t, "struct_nil", []isComparable(nil), 0)
+	testValSliceUnique(t, "struct_empty", []isComparable{}, 0)
+	testValSliceUnique(t, "struct_uniq", []isComparable{{1, "a"}, {2, "b"}, {3, "c"}}, 0)
+	testValSliceUnique(t, "struct_dup", []isComparable{{1, "a"}, {2, "b"}, {3, "c"}, {2, "b"}, {1, "a"}}, 2)
+}
+
+func testValSliceUnique[T comparable](t *testing.T, name string, input []T, wantErrs int) {
+	t.Helper()
+	t.Run(fmt.Sprintf("%s(direct)", name), func(t *testing.T) {
+		errs := ValSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, DirectEqual)
+		if len(errs) != wantErrs {
+			t.Errorf("expected %d errors, got %d: %s", wantErrs, len(errs), fmtErrs(errs))
+		}
+	})
+	t.Run(fmt.Sprintf("%s(reflect)", name), func(t *testing.T) {
+		errs := ValSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, ReflectDeepEqual)
+		if len(errs) != wantErrs {
+			t.Errorf("expected %d errors, got %d: %s", wantErrs, len(errs), fmtErrs(errs))
+		}
+	})
+}
+
+func TestValSliceUniqueNonComparableValues(t *testing.T) {
+	type nonComparable struct {
+		I int
+		S []string
+	}
+
+	testValSliceUniqueByReflect(t, "noncomp_nil", []nonComparable(nil), 0)
+	testValSliceUniqueByReflect(t, "noncomp_empty", []nonComparable{}, 0)
+	testValSliceUniqueByReflect(t, "noncomp_uniq", []nonComparable{{1, []string{"a"}}, {2, []string{"b"}}, {3, []string{"c"}}}, 0)
+	testValSliceUniqueByReflect(t, "noncomp_dup", []nonComparable{
+		{1, []string{"a"}},
+		{2, []string{"b"}},
+		{3, []string{"c"}},
+		{2, []string{"b"}},
+		{1, []string{"a"}}}, 2)
+}
+
+func testValSliceUniqueByReflect[T any](t *testing.T, name string, input []T, wantErrs int) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		errs := ValSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, ReflectDeepEqual)
+		if len(errs) != wantErrs {
+			t.Errorf("expected %d errors, got %d: %s", wantErrs, len(errs), fmtErrs(errs))
+		}
+	})
+}
+
+func TestEachPtrSliceVal(t *testing.T) {
+	testEachPtrSliceVal(t, "valid", []*int{new(11), new(12), new(13)})
+	testEachPtrSliceVal(t, "valid", []*string{new("a"), new("b"), new("c")})
+	testEachPtrSliceVal(t, "valid", []*TestStruct{{11, "a"}, {12, "b"}, {13, "c"}})
+
+	testEachPtrSliceVal(t, "empty", []*int{})
+	testEachPtrSliceVal[int](t, "nil", nil)
+
+	// Test nil elements
+	t.Run("nil elements", func(t *testing.T) {
+		input := []*int{new(11), nil, new(13)}
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *int) field.ErrorList {
+			calls++
+			return nil
+		}
+		errs := EachPtrSliceVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, nil, vfn)
+		if len(errs) != 0 {
+			t.Errorf("expected 0 errors, got %d", len(errs))
+		}
+		if calls != 2 {
+			t.Errorf("expected 2 calls, got %d", calls)
+		}
+	})
+
+	testEachPtrSliceValUpdate(t, "valid", []*int{new(11), new(12), new(13)})
+}
+
+func testEachPtrSliceVal[T any](t *testing.T, name string, input []*T) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(*%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			if oldVal != nil {
+				t.Errorf("expected nil oldVal, got %v", *oldVal)
+			}
+			calls++
+			return nil
+		}
+		errs := EachPtrSliceVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, nil, vfn)
+		if len(errs) != 0 {
+			t.Errorf("expected 0 errors, got %d: %v", len(errs), errs)
+		}
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func testEachPtrSliceValUpdate[T any](t *testing.T, name string, input []*T) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(*%T) update", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			if oldVal == nil {
+				t.Fatalf("expected non-nil oldVal")
+			}
+			if !reflect.DeepEqual(*newVal, *oldVal) {
+				t.Errorf("expected oldVal == newVal, got %v, %v", *oldVal, *newVal)
+			}
+			calls++
+			return nil
+		}
+		old := make([]*T, len(input))
+		copy(old, input)
+		slices.Reverse(old)
+		match := func(a, b *T) bool { return reflect.DeepEqual(*a, *b) }
+		errs := EachPtrSliceVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, old, match, match, vfn)
+		if len(errs) != 0 {
+			t.Errorf("expected 0 errors, got %d: %v", len(errs), errs)
+		}
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func TestEachPtrSliceValRatcheting(t *testing.T) {
+	testEachPtrSliceValRatcheting(t, "ComparableStruct same data different order",
+		[]*TestStruct{{11, "a"}, {12, "b"}, {13, "c"}},
+		[]*TestStruct{{11, "a"}, {13, "c"}, {12, "b"}},
+		ReflectDeepEqual,
+		nil,
+	)
+}
+
+func testEachPtrSliceValRatcheting[T any](t *testing.T, name string, old, new []*T, match, equiv MatchFunc[*T]) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(*%T)", name, zero), func(t *testing.T) {
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			return field.ErrorList{field.Invalid(fldPath, *newVal, "expected no calls")}
+		}
+		errs := EachPtrSliceVal(context.Background(), operation.Operation{Type: operation.Update}, field.NewPath("test"), new, old, match, equiv, vfn)
+		if len(errs) != 0 {
+			t.Errorf("expected 0 errors, got %d: %v", len(errs), errs)
+		}
+	})
+}
+
+func TestPtrSliceUnique(t *testing.T) {
+	testPtrSliceUnique(t, "int_nil", []*int(nil), 0, 0)
+	testPtrSliceUnique(t, "int_empty", []*int{}, 0, 0)
+	testPtrSliceUnique(t, "int_uniq", []*int{new(1), new(2), new(3)}, 0, 0)
+	testPtrSliceUnique(t, "int_dup", []*int{new(1), new(2), new(3), new(2), new(1)}, 2, 0)
+	testPtrSliceUnique(t, "int_nil_element", []*int{new(1), nil, new(3), nil}, 0, 0)
+	testPtrSliceUnique(t, "int_dup_and_nil", []*int{new(1), nil, new(1), nil}, 1, 0)
+}
+
+func testPtrSliceUnique[T comparable](t *testing.T, name string, input []*T, wantDupErrs, wantReqErrs int) {
+	t.Helper()
+	t.Run(fmt.Sprintf("%s(direct)", name), func(t *testing.T) {
+		errs := PtrSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, DirectEqual)
+		gotDup, gotReq := countErrors(errs)
+		if gotDup != wantDupErrs || gotReq != wantReqErrs {
+			t.Errorf("expected %d dup, %d req errors; got %d dup, %d req: %s", wantDupErrs, wantReqErrs, gotDup, gotReq, fmtErrs(errs))
+		}
+	})
+}
+
+func countErrors(errs field.ErrorList) (dup, req int) {
+	for _, err := range errs {
+		switch err.Type {
+		case field.ErrorTypeDuplicate:
+			dup++
+		case field.ErrorTypeRequired:
+			req++
+		}
+	}
+	return
+}
+
+func TestPtrSliceNoNils(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    []*int
+		wantErrs int
+	}{
+		{"nil", nil, 0},
+		{"empty", []*int{}, 0},
+		{"no_nil", []*int{new(1), new(2)}, 0},
+		{"has_nil", []*int{new(1), nil, new(3), nil}, 2},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			errs := PtrSliceNoNils(context.Background(), operation.Operation{}, field.NewPath("test"), tt.input, nil)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("expected %d errors, got %d: %v", tt.wantErrs, len(errs), errs)
+			}
+			for _, err := range errs {
+				if err.Type != field.ErrorTypeRequired {
+					t.Errorf("expected Required error, got %v", err.Type)
+				}
+			}
+		})
+	}
+}
+
+func TestPtrMapNoNils(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    map[string]*int
+		wantErrs int
+	}{
+		{"nil", nil, 0},
+		{"empty", map[string]*int{}, 0},
+		{"no_nil", map[string]*int{"a": new(1), "b": new(2)}, 0},
+		{"has_nil", map[string]*int{"a": new(1), "b": nil, "c": new(3), "d": nil}, 2},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			errs := PtrMapNoNils(context.Background(), operation.Operation{}, field.NewPath("test"), tt.input, nil)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("expected %d errors, got %d: %v", tt.wantErrs, len(errs), errs)
+			}
+			for _, err := range errs {
+				if err.Type != field.ErrorTypeRequired {
+					t.Errorf("expected Required error, got %v", err.Type)
+				}
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/enum.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/enum.go
new file mode 100644
index 0000000000..4d8e2c0aa8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/enum.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"slices"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Enum verifies that a given value is a member of a set of enum values.
+// Exclude Rules that apply when options are enabled or disabled are also considered.
+// If ANY exclude rule matches for a value, that value is excluded from the enum when validating.
+func Enum[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T, validValues sets.Set[T], exclusions []EnumExclusion[T]) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	excluded, err := isExcluded(op, exclusions, *value)
+	if err != nil {
+		return field.ErrorList{field.InternalError(fldPath, err)}
+	}
+	if !validValues.Has(*value) || excluded {
+		supported, err := supportedValues(op, validValues, exclusions)
+		if err != nil {
+			return field.ErrorList{field.InternalError(fldPath, err)}
+		}
+		return field.ErrorList{field.NotSupported[T](fldPath, *value, supported)}
+	}
+	return nil
+}
+
+// supportedValues returns a sorted list of supported values.
+// Excluded enum values are not included in the list.
+func supportedValues[T ~string](op operation.Operation, values sets.Set[T], exclusions []EnumExclusion[T]) ([]T, error) {
+	res := make([]T, 0, len(values))
+	for key := range values {
+		excluded, err := isExcluded(op, exclusions, key)
+		if err != nil {
+			return nil, err
+		}
+		if excluded {
+			continue
+		}
+		res = append(res, key)
+	}
+	slices.Sort(res)
+	return res, nil
+}
+
+// EnumExclusion represents a single enum exclusion rule.
+type EnumExclusion[T ~string] struct {
+	// Value specifies the enum value to be conditionally excluded.
+	Value T
+	// ExcludeWhen determines the condition for exclusion.
+	// If true, the value is excluded if the option is present.
+	// If false, the value is excluded if the option is NOT present.
+	ExcludeWhen bool
+	// Option is the name of the feature option that controls the exclusion.
+	Option string
+}
+
+func isExcluded[T ~string](op operation.Operation, exclusions []EnumExclusion[T], value T) (bool, error) {
+	for _, rule := range exclusions {
+		on, defined := op.HasOption(rule.Option)
+		if !defined {
+			return false, fmt.Errorf("undefined validation option %q", rule.Option)
+		}
+		if rule.Value == value && rule.ExcludeWhen == on {
+			return true, nil
+		}
+	}
+	return false, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/enum_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/enum_test.go
new file mode 100644
index 0000000000..523cbabba4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/enum_test.go
@@ -0,0 +1,241 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestEnum(t *testing.T) {
+	cases := []struct {
+		name      string
+		value     string
+		valid     sets.Set[string]
+		expectErr string
+	}{{
+		name:      "valid value",
+		value:     "a",
+		valid:     sets.New("a", "b", "c"),
+		expectErr: "",
+	}, {
+		name:      "invalid value",
+		value:     "x",
+		valid:     sets.New("a", "b", "c"),
+		expectErr: `fldpath: Unsupported value: "x": supported values: "a", "b", "c"`,
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			op := operation.Operation{Type: operation.Create}
+			errs := Enum(context.Background(), op, field.NewPath("fldpath"), &tc.value, nil, tc.valid, nil)
+
+			if tc.expectErr == "" {
+				if len(errs) > 0 {
+					t.Fatalf("expected no error, but got: %v", errs)
+				}
+			} else {
+				if len(errs) == 0 {
+					t.Fatal("expected an error, but got none")
+				}
+				if len(errs) > 1 {
+					t.Fatalf("expected a single error, but got: %v", errs)
+				}
+				if errs[0].Error() != tc.expectErr {
+					t.Errorf("expected error %q, but got %q", tc.expectErr, errs[0].Error())
+				}
+			}
+		})
+	}
+}
+
+func TestEnumTypedef(t *testing.T) {
+	type StringType string
+	const (
+		NotStringFoo StringType = "foo"
+		NotStringBar StringType = "bar"
+		NotStringQux StringType = "qux"
+	)
+
+	cases := []struct {
+		name      string
+		value     StringType
+		valid     sets.Set[StringType]
+		expectErr string
+	}{{
+		name:      "valid value",
+		value:     "foo",
+		valid:     sets.New(NotStringFoo, NotStringBar, NotStringQux),
+		expectErr: "",
+	}, {
+		name:      "invalid value",
+		value:     "x",
+		valid:     sets.New(NotStringFoo, NotStringBar, NotStringQux),
+		expectErr: `fldpath: Unsupported value: "x": supported values: "bar", "foo", "qux"`,
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			op := operation.Operation{Type: operation.Create}
+			errs := Enum(context.Background(), op, field.NewPath("fldpath"), &tc.value, nil, tc.valid, nil)
+
+			if tc.expectErr == "" {
+				if len(errs) > 0 {
+					t.Fatalf("expected no error, but got: %v", errs)
+				}
+			} else {
+				if len(errs) == 0 {
+					t.Fatal("expected an error, but got none")
+				}
+				if len(errs) > 1 {
+					t.Fatalf("expected a single error, but got: %v", errs)
+				}
+				if errs[0].Error() != tc.expectErr {
+					t.Errorf("expected error %q, but got %q", tc.expectErr, errs[0].Error())
+				}
+			}
+		})
+	}
+}
+
+func TestEnumExclude(t *testing.T) {
+	type TestEnum string
+	const (
+		ValueA TestEnum = "A"
+		ValueB TestEnum = "B"
+		ValueC TestEnum = "C"
+		ValueD TestEnum = "D"
+	)
+
+	const (
+		FeatureA = "FeatureA"
+		FeatureB = "FeatureB"
+	)
+
+	testEnumValues := sets.New(ValueA, ValueB, ValueC, ValueD)
+	testEnumExclusions := []EnumExclusion[TestEnum]{
+		{Value: ValueA, Option: FeatureA, ExcludeWhen: true},
+		{Value: ValueB, Option: FeatureB, ExcludeWhen: false},
+		{Value: ValueD, Option: FeatureA, ExcludeWhen: true},
+		{Value: ValueD, Option: FeatureB, ExcludeWhen: false},
+	}
+
+	testCases := []struct {
+		name           string
+		value          TestEnum
+		opts           map[string]bool
+		expectInternal bool
+		expectErr      string
+	}{
+		{
+			name:  "no options, A is valid",
+			value: ValueA,
+			opts:  map[string]bool{FeatureA: false, FeatureB: false},
+		},
+		{
+			name:      "no options, B is invalid",
+			value:     ValueB,
+			opts:      map[string]bool{FeatureA: false, FeatureB: false},
+			expectErr: `fld: Unsupported value: "B": supported values: "A", "C"`,
+		},
+		{
+			name:      "no options, D is invalid",
+			value:     ValueD,
+			opts:      map[string]bool{FeatureA: false, FeatureB: false},
+			expectErr: `fld: Unsupported value: "D": supported values: "A", "C"`,
+		},
+		{
+			name:      "FeatureA enabled, A is invalid",
+			value:     ValueA,
+			opts:      map[string]bool{FeatureA: true, FeatureB: false},
+			expectErr: `fld: Unsupported value: "A": supported values: "C"`,
+		},
+		{
+			name:      "FeatureA enabled, B is invalid",
+			value:     ValueB,
+			opts:      map[string]bool{FeatureA: true, FeatureB: false},
+			expectErr: `fld: Unsupported value: "B": supported values: "C"`,
+		},
+		{
+			name:  "FeatureB enabled, A is valid",
+			value: ValueA,
+			opts:  map[string]bool{FeatureA: false, FeatureB: true},
+		},
+		{
+			name:  "FeatureB enabled, B is valid",
+			value: ValueB,
+			opts:  map[string]bool{FeatureA: false, FeatureB: true},
+		},
+		{
+			name:      "FeatureA and FeatureB enabled, A is invalid",
+			value:     ValueA,
+			opts:      map[string]bool{FeatureA: true, FeatureB: true},
+			expectErr: `fld: Unsupported value: "A": supported values: "B", "C"`,
+		},
+		{
+			name:  "FeatureA and FeatureB enabled, B is valid",
+			value: ValueB,
+			opts:  map[string]bool{FeatureA: true, FeatureB: true},
+		},
+		{
+			name:      "FeatureA and FeatureB enabled, D is invalid",
+			value:     ValueD,
+			opts:      map[string]bool{FeatureA: true, FeatureB: true},
+			expectErr: `fld: Unsupported value: "D": supported values: "B", "C"`,
+		},
+		{
+			name:           "undeclared option is an internal error",
+			value:          ValueB,
+			opts:           map[string]bool{FeatureA: false},
+			expectInternal: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			op := operation.Operation{Type: operation.Create, Options: tc.opts}
+			errs := Enum(context.Background(), op, field.NewPath("fld"), &tc.value, nil, testEnumValues, testEnumExclusions)
+
+			if tc.expectInternal {
+				if len(errs) != 1 || errs[0].Type != field.ErrorTypeInternal {
+					t.Fatalf("expected a single internal error, but got: %v", errs)
+				}
+				return
+			}
+
+			if tc.expectErr == "" {
+				if len(errs) > 0 {
+					t.Fatalf("expected no error, but got: %v", errs)
+				}
+			} else {
+				if len(errs) == 0 {
+					t.Fatal("expected an error, but got none")
+				}
+				if len(errs) > 1 {
+					t.Fatalf("expected a single error, but got: %v", errs)
+				}
+				if errs[0].Error() != tc.expectErr {
+					t.Errorf("expected error %q, but got %q", tc.expectErr, errs[0].Error())
+				}
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/equality.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/equality.go
new file mode 100644
index 0000000000..12e99d0ec4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/equality.go
@@ -0,0 +1,38 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/content"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// NEQ validates that the specified comparable value is not equal to the disallowed value.
+func NEQ[T comparable](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, disallowed T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	if *value == disallowed {
+		return field.ErrorList{
+			field.Invalid(fldPath, *value, content.NEQError(disallowed)).WithOrigin("neq"),
+		}
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/errors.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/errors.go
new file mode 100644
index 0000000000..a9dc4b01c0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/errors.go
@@ -0,0 +1,96 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"errors"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+type allDeclarativeEnforcedKeyType struct{}
+
+var allDeclarativeEnforcedKey = allDeclarativeEnforcedKeyType{}
+
+// WithAllDeclarativeEnforcedForTest returns a copy of parent context with allDeclarativeEnforcedKey set to true.
+// This is used for testing to expose all declarative validation errors and filter all handwritten validation errors
+// that are covered by declarative validation, regardless of the feature gate or maturity level.
+//
+// NOTE: This function is intended for testing purposes only and should not be used in production code.
+func WithAllDeclarativeEnforcedForTest(ctx context.Context) context.Context {
+	return context.WithValue(ctx, allDeclarativeEnforcedKey, true)
+}
+
+// AllDeclarativeEnforced returns true if the context contains allDeclarativeEnforcedKey set to true.
+func AllDeclarativeEnforced(ctx context.Context) bool {
+	if ctx == nil {
+		return false
+	}
+	return ctx.Value(allDeclarativeEnforcedKey) == true
+}
+
+// FilterCoveredHandwrittenErrors removes a CoveredByDeclarative handwritten error when a matching enforced
+// beta declarative error exists (matched by type, field, and origin). In AllDeclarativeEnforced
+// (testing-only) mode every covered handwritten error is removed.
+func FilterCoveredHandwrittenErrors(ctx context.Context, imperativeErrs, enforcedDeclarativeErrs field.ErrorList, betaEnabled bool, rules ...field.NormalizationRule) field.ErrorList {
+	matcher := field.ErrorMatcher{}.ByType().ByOrigin().RequireOriginWhenInvalid().ByFieldNormalized(rules)
+	allDeclarativeEnforced := AllDeclarativeEnforced(ctx)
+	return imperativeErrs.Filter(func(e error) bool {
+		var fe *field.Error
+		if !errors.As(e, &fe) || !fe.CoveredByDeclarative {
+			return false
+		}
+		if allDeclarativeEnforced {
+			return true
+		}
+		for _, dErr := range enforcedDeclarativeErrs {
+			if dErr.IsBeta() && matcher.Matches(fe, dErr) {
+				return true
+			}
+		}
+		return false
+	})
+}
+
+// FilterEnforcedDeclarativeErrors collects the declarative errors that are enforced (i.e. surfaced to the user) in the
+// current mode. A declarative error is enforced when any of the following holds:
+//   - AllDeclarativeEnforced is set (testing): every declarative error is enforced.
+//   - It is an internal error: always enforced, regardless of lifecycle.
+//   - It is a beta error and BetaEnabled is true.
+//   - It is a standard (unprefixed) error: always enforced.
+//
+// Alpha errors are never enforced; they remain shadowed by handwritten validation.
+func FilterEnforcedDeclarativeErrors(ctx context.Context, declarativeErrs field.ErrorList, betaEnabled bool) field.ErrorList {
+	enforcedDeclarativeErrs := make(field.ErrorList, 0, len(declarativeErrs))
+	allDeclarativeEnforced := AllDeclarativeEnforced(ctx)
+	for _, dvErr := range declarativeErrs {
+		switch {
+		case allDeclarativeEnforced:
+			enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr)
+		case dvErr.Type == field.ErrorTypeInternal:
+			enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr)
+		case dvErr.IsBeta():
+			if betaEnabled {
+				enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr)
+			}
+		case !dvErr.IsAlpha():
+			enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr) // Standard
+		}
+	}
+	return enforcedDeclarativeErrs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/errors_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/errors_test.go
new file mode 100644
index 0000000000..a90f21898b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/errors_test.go
@@ -0,0 +1,139 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestFilterCoveredHandwrittenErrors(t *testing.T) {
+	originRule := "test-origin"
+
+	handwrittenCovered := field.Invalid(field.NewPath("spec", "name"), "invalid-value", "must be valid").WithOrigin(originRule).MarkCoveredByDeclarative()
+
+	handwrittenNotCovered := field.Invalid(field.NewPath("spec", "name"), "invalid-value", "must be valid").WithOrigin(originRule)
+
+	matchingBetaDeclarative := field.Invalid(field.NewPath("spec", "name"), "invalid-value", "must be valid").WithOrigin(originRule).MarkBeta()
+
+	matchingAlphaDeclarative := field.Invalid(field.NewPath("spec", "name"), "invalid-value", "must be valid").WithOrigin(originRule).MarkAlpha()
+
+	tests := []struct {
+		name                   string
+		errs                   field.ErrorList
+		enforcedDeclarative    field.ErrorList
+		allDeclarativeEnforced bool
+		betaEnabled            bool
+		rules                  []field.NormalizationRule
+		expectedLen            int
+	}{
+		{
+			name:                   "uncovered handwritten error is preserved",
+			errs:                   field.ErrorList{handwrittenNotCovered},
+			enforcedDeclarative:    field.ErrorList{matchingBetaDeclarative},
+			allDeclarativeEnforced: false,
+			expectedLen:            1,
+		},
+		{
+			name:                   "covered handwritten error filtered when matching beta declarative error exists",
+			errs:                   field.ErrorList{handwrittenCovered},
+			enforcedDeclarative:    field.ErrorList{matchingBetaDeclarative},
+			allDeclarativeEnforced: false,
+			expectedLen:            0,
+		},
+		{
+			name:                   "covered handwritten error not filtered when matching declarative is alpha",
+			errs:                   field.ErrorList{handwrittenCovered},
+			enforcedDeclarative:    field.ErrorList{matchingAlphaDeclarative},
+			allDeclarativeEnforced: false,
+			expectedLen:            1,
+		},
+		{
+			name:                   "covered handwritten error filtered in allDeclarativeEnforced mode regardless of matching declarative error",
+			errs:                   field.ErrorList{handwrittenCovered},
+			enforcedDeclarative:    nil,
+			allDeclarativeEnforced: true,
+			expectedLen:            0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			if tt.allDeclarativeEnforced {
+				ctx = WithAllDeclarativeEnforcedForTest(ctx)
+			}
+			res := FilterCoveredHandwrittenErrors(ctx, tt.errs, tt.enforcedDeclarative, tt.betaEnabled, tt.rules...)
+			if len(res) != tt.expectedLen {
+				t.Errorf("FilterCoveredHandwrittenErrors() returned %d errors, expected %d", len(res), tt.expectedLen)
+			}
+		})
+	}
+}
+
+func TestFilterEnforcedDeclarativeErrors(t *testing.T) {
+	internalErr := field.InternalError(field.NewPath("spec"), errors.New("internal error"))
+	alphaErr := field.Invalid(field.NewPath("spec"), "val", "alpha").MarkAlpha()
+	betaErr := field.Invalid(field.NewPath("spec"), "val", "beta").MarkBeta()
+	stdErr := field.Invalid(field.NewPath("spec"), "val", "standard")
+
+	tests := []struct {
+		name                   string
+		declarativeErrs        field.ErrorList
+		betaEnabled            bool
+		allDeclarativeEnforced bool
+		expectedLen            int
+	}{
+		{
+			name:                   "all errors enforced in allDeclarativeEnforced mode",
+			declarativeErrs:        field.ErrorList{internalErr, alphaErr, betaErr, stdErr},
+			betaEnabled:            false,
+			allDeclarativeEnforced: true,
+			expectedLen:            4,
+		},
+		{
+			name:                   "beta disabled ignores alpha and beta",
+			declarativeErrs:        field.ErrorList{internalErr, alphaErr, betaErr, stdErr},
+			betaEnabled:            false,
+			allDeclarativeEnforced: false,
+			expectedLen:            2, // internal + std
+		},
+		{
+			name:                   "beta enabled includes beta but excludes alpha",
+			declarativeErrs:        field.ErrorList{internalErr, alphaErr, betaErr, stdErr},
+			betaEnabled:            true,
+			allDeclarativeEnforced: false,
+			expectedLen:            3, // internal + beta + std
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			if tt.allDeclarativeEnforced {
+				ctx = WithAllDeclarativeEnforcedForTest(ctx)
+			}
+			res := FilterEnforcedDeclarativeErrors(ctx, tt.declarativeErrs, tt.betaEnabled)
+			if len(res) != tt.expectedLen {
+				t.Errorf("FilterEnforcedDeclarativeErrors() returned %d errors, expected %d", len(res), tt.expectedLen)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/immutable.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/immutable.go
new file mode 100644
index 0000000000..01a879c98f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/immutable.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Immutable verifies that the specified value has not changed in the course of
+// an update operation. It does nothing if the old value is not provided.
+//
+// This function unconditionally returns a validation error as it
+// relies on the default ratcheting mechanism to only be called when a
+// change to the field has already been detected.  This avoids a redundant
+// equivalence check across ratcheting and this function.
+func Immutable[T any](_ context.Context, op operation.Operation, fldPath *field.Path, _, _ T) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+	return field.ErrorList{
+		field.Invalid(fldPath, nil, "field is immutable").WithOrigin("immutable"),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/immutable_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/immutable_test.go
new file mode 100644
index 0000000000..60396b0cc6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/immutable_test.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestImmutable(t *testing.T) {
+	// The Immutable function relies on validation ratcheting to avoid being
+	// called when old and new values are equivalent. This unit test only needs
+	// to confirm two behaviors:
+	// 1. The function does nothing for non-update operations (e.g., create).
+	// 2. The function *always* returns an error for update operations, since
+	//    ratcheting should have prevented the call if the values were unchanged.
+
+	type simpleStruct struct {
+		S string
+	}
+
+	for _, tc := range []struct {
+		name string
+		fn   func(op operation.Operation, fldPath *field.Path) field.ErrorList
+	}{{
+		name: "with primitive type",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return Immutable(context.Background(), op, fld, ptr.To(123), ptr.To(456))
+		},
+	}, {
+		name: "with struct type",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return Immutable(context.Background(), op, fld, &simpleStruct{S: "a"}, &simpleStruct{S: "b"})
+		},
+	}, {
+		name: "with nil values",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			// Explicitly type the nil to satisfy the generic function signature.
+			return Immutable[*int](context.Background(), op, fld, nil, nil)
+		},
+	}} {
+		t.Run(tc.name, func(t *testing.T) {
+			// Create operations should never return an error.
+			errs := tc.fn(operation.Operation{Type: operation.Create}, field.NewPath("field"))
+			if len(errs) != 0 {
+				t.Errorf("expected success for create operation, but got errors: %v", errs)
+			}
+
+			// Update operations should always return exactly one error.
+			errs = tc.fn(operation.Operation{Type: operation.Update}, field.NewPath("field"))
+			if len(errs) == 0 {
+				t.Errorf("expected a failure for update operation, but got success")
+			} else if len(errs) > 1 {
+				t.Errorf("expected exactly one error for update operation, but got %d: %v", len(errs), errs)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/item.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/item.go
new file mode 100644
index 0000000000..4ddb2860c5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/item.go
@@ -0,0 +1,140 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// MatchItemFunc takes an item and returns true if it matches the criteria.
+type MatchItemFunc[T any] func(T) bool
+
+// ValSliceItem finds the first item in a list of values which satisfies the
+// match function, and if found, also looks for a matching item in oldList. If
+// the value of the item is the same as the previous value, as per the equiv
+// function, then no validation is performed. Otherwise, it invokes
+// 'itemValidator' on these items.
+//
+// This function processes only the *first* matching item found in newList. It
+// assumes that the match functions targets a unique identifier (primary key)
+// and will match at most one element per list. If this assumption is violated,
+// changes in list order can lead this function to have inconsistent behavior.
+//
+// The match and equiv functions will never be called with nil arguments.
+//
+// The fldPath passed to itemValidator is indexed to the matched item's
+// position in newList.
+//
+// This function does not validate items that were removed (present in oldList
+// but not in newList).
+func ValSliceItem[TList ~[]TItem, TItem any](
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	newList, oldList TList,
+	match MatchItemFunc[*TItem],
+	equiv MatchFunc[*TItem],
+	itemValidator func(ctx context.Context, op operation.Operation, fldPath *field.Path, newObj, oldObj *TItem) field.ErrorList,
+) field.ErrorList {
+	var matchedNew, matchedOld *TItem
+	var newIndex int
+
+	for i := range newList {
+		if match(&newList[i]) {
+			matchedNew = &newList[i]
+			newIndex = i
+			break
+		}
+	}
+	if matchedNew == nil {
+		return nil
+	}
+
+	for i := range oldList {
+		if match(&oldList[i]) {
+			matchedOld = &oldList[i]
+			break
+		}
+	}
+
+	if op.Type == operation.Update && matchedOld != nil && equiv(matchedNew, matchedOld) {
+		return nil
+	}
+
+	return itemValidator(ctx, op, fldPath.Index(newIndex), matchedNew, matchedOld)
+}
+
+// PtrSliceItem finds the first item in a list of pointers which satisfies the
+// match function, and if found, also looks for a matching item in oldList. If
+// the value of the item is the same as the previous value, as per the equiv
+// function, then no validation is performed. Otherwise, it invokes
+// 'itemValidator' on these items.
+//
+// This function processes only the *first* matching item found in newList. It
+// assumes that the match functions targets a unique identifier (primary key)
+// and will match at most one element per list. If this assumption is violated,
+// changes in list order can lead this function to have inconsistent behavior.
+//
+// The match and equiv functions will never be called with nil arguments.
+//
+// The fldPath passed to itemValidator is indexed to the matched item's
+// position in newList.
+//
+// This function does not validate items that were removed (present in oldList
+// but not in newList).
+func PtrSliceItem[TList ~[]*TItem, TItem any](
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	newList, oldList TList,
+	match MatchItemFunc[*TItem],
+	equiv MatchFunc[*TItem],
+	itemValidator func(ctx context.Context, op operation.Operation, fldPath *field.Path, newObj, oldObj *TItem) field.ErrorList,
+) field.ErrorList {
+	var matchedNew, matchedOld *TItem
+	var newIndex int
+
+	for i := range newList {
+		if newList[i] == nil {
+			// Ignore nil items; they are supposed to have been checked by PtrSliceNoNils.
+			continue
+		}
+		if match(newList[i]) {
+			matchedNew = newList[i]
+			newIndex = i
+			break
+		}
+	}
+	if matchedNew == nil {
+		return nil
+	}
+
+	for i := range oldList {
+		if oldList[i] == nil {
+			continue
+		}
+		if match(oldList[i]) {
+			matchedOld = oldList[i]
+			break
+		}
+	}
+
+	if op.Type == operation.Update && matchedOld != nil && equiv(matchedNew, matchedOld) {
+		return nil
+	}
+
+	return itemValidator(ctx, op, fldPath.Index(newIndex), matchedNew, matchedOld)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/item_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/item_test.go
new file mode 100644
index 0000000000..180b8da62c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/item_test.go
@@ -0,0 +1,237 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+type multiKeyItem struct {
+	K1 string `json:"k1"`
+	K2 string `json:"k2"`
+	V  int    `json:"v"`
+}
+
+func TestValSliceItem(t *testing.T) {
+	testCases := []struct {
+		name      string
+		new       []multiKeyItem
+		old       []multiKeyItem
+		match     MatchItemFunc[*multiKeyItem]
+		validator func(context.Context, operation.Operation, *field.Path, *multiKeyItem, *multiKeyItem) field.ErrorList
+		expected  field.ErrorList
+	}{
+		{
+			name: "no match",
+			new: []multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "target"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, _, _ *multiKeyItem) field.ErrorList {
+				return field.ErrorList{field.Invalid(fp, nil, "err")}
+			},
+			expected: nil,
+		},
+		{
+			name: "new item with matching keys",
+			new: []multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+				{K1: "target", K2: "target2", V: 2},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "target" && i.K2 == "target2"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, o *multiKeyItem) field.ErrorList {
+				if n != nil && o == nil {
+					return field.ErrorList{field.Invalid(fp, n.K1, "added")}
+				}
+				return nil
+			},
+			expected: field.ErrorList{field.Invalid(field.NewPath("").Index(1), "target", "added")},
+		},
+		{
+			name: "updated item - same keys different values",
+			new: []multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+				{K1: "update", K2: "target2", V: 20},
+			},
+			old: []multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+				{K1: "update", K2: "target2", V: 2},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "update" && i.K2 == "target2"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, o *multiKeyItem) field.ErrorList {
+				if n != nil && o != nil && n.V != o.V {
+					return field.ErrorList{field.Invalid(fp.Child("v"), n.V, "changed")}
+				}
+				return nil
+			},
+			expected: field.ErrorList{field.Invalid(field.NewPath("").Index(1).Child("v"), 20, "changed")},
+		},
+		{
+			// For completeness as listType=map && listKey=... required tags prevents dupes.
+			name: "first match only - multiple items with same keys",
+			new: []multiKeyItem{
+				{K1: "dup", K2: "target2", V: 1},
+				{K1: "dup", K2: "target2", V: 2},
+			},
+			old: []multiKeyItem{
+				{K1: "dup", K2: "target2", V: 10},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "dup" && i.K2 == "target2"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, o *multiKeyItem) field.ErrorList {
+				if n != nil && o != nil {
+					return field.ErrorList{field.Invalid(fp, n.V, "value")}
+				}
+				return nil
+			},
+			expected: field.ErrorList{field.Invalid(field.NewPath("").Index(0), 1, "value")},
+		},
+		{
+			name: "nil new list",
+			new:  nil,
+			old: []multiKeyItem{
+				{K1: "exists", K2: "target2", V: 1},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "exists" && i.K2 == "target2"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, o *multiKeyItem) field.ErrorList {
+				if n == nil && o != nil {
+					return field.ErrorList{field.Invalid(fp, nil, "deleted")}
+				}
+				return nil
+			},
+			expected: nil,
+		},
+		{
+			name:  "empty lists",
+			new:   []multiKeyItem{},
+			old:   []multiKeyItem{},
+			match: func(i *multiKeyItem) bool { return true },
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, _, _ *multiKeyItem) field.ErrorList {
+				return field.ErrorList{field.Invalid(fp, nil, "err")}
+			},
+			expected: nil,
+		},
+		{
+			name:  "nil lists",
+			new:   nil,
+			old:   nil,
+			match: func(i *multiKeyItem) bool { return true },
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, _, _ *multiKeyItem) field.ErrorList {
+				return field.ErrorList{field.Invalid(fp, nil, "err")}
+			},
+			expected: nil,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := context.Background()
+			op := operation.Operation{Type: operation.Update}
+			fp := field.NewPath("")
+
+			got := ValSliceItem(ctx, op, fp, tc.new, tc.old, tc.match, ReflectDeepEqual, tc.validator)
+
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
+
+func TestPtrSliceItem(t *testing.T) {
+	testCases := []struct {
+		name      string
+		new       []*multiKeyItem
+		old       []*multiKeyItem
+		match     MatchItemFunc[*multiKeyItem]
+		validator func(context.Context, operation.Operation, *field.Path, *multiKeyItem, *multiKeyItem) field.ErrorList
+		expected  field.ErrorList
+	}{
+		{
+			name: "no match",
+			new: []*multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "target"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, _, _ *multiKeyItem) field.ErrorList {
+				return field.ErrorList{field.Invalid(fp, nil, "err")}
+			},
+			expected: nil,
+		},
+		{
+			name: "new item with matching keys",
+			new: []*multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+				{K1: "target", K2: "target2", V: 2},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "target" && i.K2 == "target2"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, o *multiKeyItem) field.ErrorList {
+				if n != nil && o == nil {
+					return field.ErrorList{field.Invalid(fp, n.K1, "added")}
+				}
+				return nil
+			},
+			expected: field.ErrorList{field.Invalid(field.NewPath("").Index(1), "target", "added")},
+		},
+		{
+			name: "nil element in new list (ignored)",
+			new: []*multiKeyItem{
+				nil,
+				{K1: "target", V: 1},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "target"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, _ *multiKeyItem) field.ErrorList {
+				return field.ErrorList{field.Invalid(fp, n.K1, "matched")}
+			},
+			expected: field.ErrorList{field.Invalid(field.NewPath("").Index(1), "target", "matched")},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := context.Background()
+			op := operation.Operation{Type: operation.Update}
+			fp := field.NewPath("")
+
+			got := PtrSliceItem(ctx, op, fp, tc.new, tc.old, tc.match, ReflectDeepEqual, tc.validator)
+
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/limits.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/limits.go
new file mode 100644
index 0000000000..768546f6bc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/limits.go
@@ -0,0 +1,160 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"math"
+	"unicode/utf8"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/constraints"
+	"k8s.io/apimachinery/pkg/api/validate/content"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// MaxLength verifies that the specified value is not longer than max
+// characters.
+func MaxLength[T ~string](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, max int) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+
+	// if the length of the value in bytes is less
+	// than the maximum size then we can confidently
+	// say that this value is within the bounds
+	// enforced by the maximum value regardless
+	// of the actual makeup of characters in the value
+	byteLength := len(*value)
+	if byteLength <= max {
+		return nil
+	}
+
+	// because runes are up to 4 byte characters, if we assume all characters
+	// in the input are runes, the minimum number of characters that
+	// are specified is len(value)/4. If the minimum multi-byte
+	// character count is greater than our enforced maximum, we
+	// can confidently say that the value is invalid without having
+	// to actually perform the more expensive rune counting step
+	minimum := int(math.Ceil(float64(byteLength) / 4.0))
+	if minimum > max || utf8.RuneCountInString(string(*value)) > max {
+		return field.ErrorList{field.TooLongCharacters(fldPath, *value, max).WithOrigin("maxLength")}
+	}
+	return nil
+}
+
+// MaxBytes verifies that the specified value is not longer than max bytes.
+func MaxBytes[T ~string](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, max int) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+
+	if len(*value) > max {
+		return field.ErrorList{field.TooLong(fldPath, *value, max).WithOrigin("maxBytes")}
+	}
+
+	return nil
+}
+
+// MaxItems verifies that the specified slice is not longer than max items.
+func MaxItems[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ []T, max int) field.ErrorList {
+	if len(value) > max {
+		return field.ErrorList{field.TooMany(fldPath, len(value), max).WithOrigin("maxItems")}
+	}
+	return nil
+}
+
+// MaxProperties verifies that the specified map has no more than max keys.
+func MaxProperties[K comparable, V any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]V, max int) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+
+	if len(value) > max {
+		return field.ErrorList{field.TooMany(fldPath, len(value), max).WithOrigin("maxProperties")}
+	}
+	return nil
+}
+
+// MinItems verifies that the specified slice is not shorter than min items.
+func MinItems[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ []T, min int) field.ErrorList {
+	if len(value) < min {
+		return field.ErrorList{field.TooFew(fldPath, len(value), min).WithOrigin("minItems")}
+	}
+	return nil
+}
+
+// MinProperties verifies that the specified map is not shorter than min properties.
+func MinProperties[K comparable, V any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]V, min int) field.ErrorList {
+	if len(value) < min {
+		return field.ErrorList{field.TooFew(fldPath, len(value), min).WithOrigin("minProperties")}
+	}
+	return nil
+}
+
+// Minimum verifies that the specified value is greater than or equal to min.
+func Minimum[T constraints.Integer](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, min T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	if *value < min {
+		return field.ErrorList{field.Invalid(fldPath, *value, content.MinError(min)).WithOrigin("minimum")}
+	}
+	return nil
+}
+
+// Maximum verifies that the specified value is less than or equal to max.
+func Maximum[T constraints.Integer](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, max T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	if *value > max {
+		return field.ErrorList{field.Invalid(fldPath, *value, content.MaxError(max)).WithOrigin("maximum")}
+	}
+	return nil
+}
+
+// MinLength verifies that the specified value is at least min characters, if non-nil.
+func MinLength[T ~string](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, min int) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+
+	byteLength := len(*value)
+
+	// because runes are up to 4 byte characters, if we assume all characters
+	// in the input are 4 byte runes, the minimum number of characters that
+	// are specified is len(value)/4. If the minimum multi-byte
+	// character count is greater than or equal to our enforced minimum, we
+	// can confidently say that the value is valid without having
+	// to actually perform the more expensive rune counting step
+	if int(math.Ceil(float64(byteLength)/4.0)) >= min {
+		return nil
+	}
+
+	// if the length of the value in bytes is less
+	// than the minimum size then we can confidently
+	// say that this value is not within the bounds
+	// enforced by the maximum value regardless
+	// of the actual makeup of characters in the value.
+	// Otherwise, perform a rune count to determine if the
+	// number of characters is less than the minimum.
+	if byteLength < min || utf8.RuneCountInString(string(*value)) < min {
+		return field.ErrorList{field.TooShort(fldPath, *value, min).WithOrigin("minLength")}
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/limits_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/limits_test.go
new file mode 100644
index 0000000000..934b876f8f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/limits_test.go
@@ -0,0 +1,679 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/constraints"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestMaxLength(t *testing.T) {
+	cases := []struct {
+		name     string
+		value    string
+		max      int
+		wantErrs field.ErrorList
+	}{{
+		name:     "empty string",
+		value:    "",
+		max:      0,
+		wantErrs: nil,
+	}, {
+		name:  "zero length",
+		value: "0",
+		max:   0,
+		wantErrs: field.ErrorList{
+			field.TooLongCharacters(field.NewPath("fldpath"), "", 0).WithOrigin("maxLength"),
+		},
+	}, {
+		name:     "one character",
+		value:    "0",
+		max:      1,
+		wantErrs: nil,
+	}, {
+		name:  "two characters",
+		value: "01",
+		max:   1,
+		wantErrs: field.ErrorList{
+			field.TooLongCharacters(field.NewPath("fldpath"), "", 1).WithOrigin("maxLength"),
+		},
+	}, {
+		value: "",
+		max:   -1,
+		wantErrs: field.ErrorList{
+			field.TooLongCharacters(field.NewPath("fldpath"), "", -1).WithOrigin("maxLength"),
+		},
+	}, {
+		name:     "ascii-only characters, less characters than max (n-1)",
+		value:    "abcdefghi",
+		max:      10,
+		wantErrs: nil,
+	}, {
+		name:     "multi-byte characters, less characters than max (n-1)",
+		value:    "©®©®©®©®©",
+		max:      10,
+		wantErrs: nil,
+	}, {
+		name:  "ascii-only characters, more characters than max (n+1)",
+		value: "abcdefghijkl",
+		max:   10,
+		wantErrs: field.ErrorList{
+			field.TooLongCharacters(field.NewPath("fldpath"), "", 10).WithOrigin("maxLength"),
+		},
+	}, {
+		name:  "multi-byte characters, more characters than max (n+1)",
+		value: "©®©®©®©®©®©",
+		max:   10,
+		wantErrs: field.ErrorList{
+			field.TooLongCharacters(field.NewPath("fldpath"), "", 10).WithOrigin("maxLength"),
+		},
+	}, {
+		name:  "mixture of characters, minimum possible size of input is less than max, rune count exceed maximum",
+		value: "©abc®defghi",
+		max:   10,
+		wantErrs: field.ErrorList{
+			field.TooLongCharacters(field.NewPath("fldpath"), "", 10).WithOrigin("maxLength"),
+		},
+	}, {
+		name:     "multi-byte characters, exact characters as max (n)",
+		value:    "©®©®©®©®©®",
+		max:      10,
+		wantErrs: nil,
+	}, {
+		name:     "ascii-only characters, exact characters as max (n)",
+		value:    "abcdefghij",
+		max:      10,
+		wantErrs: nil,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			v := tc.value
+			gotErrs := MaxLength(context.Background(), operation.Operation{}, field.NewPath("fldpath"), &v, nil, tc.max)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMinItems(t *testing.T) {
+	cases := []struct {
+		name     string
+		items    int
+		min      int
+		wantErrs field.ErrorList
+	}{{
+		name:  "0 items, min 0",
+		items: 0,
+		min:   0,
+	}, {
+		name:  "1 item, min 0",
+		items: 1,
+		min:   0,
+	}, {
+		name:  "1 item, min 1",
+		items: 1,
+		min:   1,
+	}, {
+		name:  "0 items, min 1",
+		items: 0,
+		min:   1,
+		wantErrs: field.ErrorList{
+			field.TooFew(field.NewPath("fldpath"), 0, 1).WithOrigin("minItems"),
+		},
+	}, {
+		name:  "1 item, min 2",
+		items: 1,
+		min:   2,
+		wantErrs: field.ErrorList{
+			field.TooFew(field.NewPath("fldpath"), 1, 2).WithOrigin("minItems"),
+		},
+	}, {
+		name:  "0 items, min -1",
+		items: 0,
+		min:   -1,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := make([]bool, tc.items)
+			gotErrs := MinItems(context.Background(), operation.Operation{}, field.NewPath("fldpath"), value, nil, tc.min)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMinProperties(t *testing.T) {
+	cases := []struct {
+		name       string
+		properties int
+		min        int
+		wantErrs   field.ErrorList
+	}{{
+		name:       "0 properties, min 0",
+		properties: 0,
+		min:        0,
+	}, {
+		name:       "1 property, min 0",
+		properties: 1,
+		min:        0,
+	}, {
+		name:       "1 property, min 1",
+		properties: 1,
+		min:        1,
+	}, {
+		name:       "0 properties, min 1",
+		properties: 0,
+		min:        1,
+		wantErrs: field.ErrorList{
+			field.TooFew(field.NewPath("fldpath"), 0, 1).WithOrigin("minProperties"),
+		},
+	}, {
+		name:       "1 property, min 2",
+		properties: 1,
+		min:        2,
+		wantErrs: field.ErrorList{
+			field.TooFew(field.NewPath("fldpath"), 1, 2).WithOrigin("minProperties"),
+		},
+	}, {
+		name:       "0 properties, min 100000",
+		properties: 0,
+		min:        100000,
+		wantErrs: field.ErrorList{
+			field.TooFew(field.NewPath("fldpath"), 0, 100000).WithOrigin("minProperties"),
+		},
+	}, {
+		name:       "99999 properties, min 100000",
+		properties: 99999,
+		min:        100000,
+		wantErrs: field.ErrorList{
+			field.TooFew(field.NewPath("fldpath"), 99999, 100000).WithOrigin("minProperties"),
+		},
+	}, {
+		name:       "100000 properties, min 100000",
+		properties: 100000,
+		min:        100000,
+	}, {
+		// Note: While JSON Schema does not allow negative values for minProperties,
+		// we test that the validator handles it safely if it ever occurs at runtime.
+		name:       "0 properties, min -1",
+		properties: 0,
+		min:        -1,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := make(map[string]bool, tc.properties)
+			for i := 0; i < tc.properties; i++ {
+				value[fmt.Sprintf("k%d", i)] = true
+			}
+			gotErrs := MinProperties(context.Background(), operation.Operation{}, field.NewPath("fldpath"), value, nil, tc.min)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMaxItems(t *testing.T) {
+	cases := []struct {
+		name     string
+		items    int
+		max      int
+		wantErrs field.ErrorList
+	}{{
+		name:  "0 items, max 0",
+		items: 0,
+		max:   0,
+	}, {
+		name:  "1 item, max 0",
+		items: 1,
+		max:   0,
+		wantErrs: field.ErrorList{
+			field.TooMany(field.NewPath("fldpath"), 1, 0).WithOrigin("maxItems"),
+		},
+	}, {
+		name:  "1 item, max 1",
+		items: 1,
+		max:   1,
+	}, {
+		name:  "2 items, max 1",
+		items: 2,
+		max:   1,
+		wantErrs: field.ErrorList{
+			field.TooMany(field.NewPath("fldpath"), 2, 1).WithOrigin("maxItems"),
+		},
+	}, {
+		name:  "0 items, max -1",
+		items: 0,
+		max:   -1,
+		wantErrs: field.ErrorList{
+			field.TooMany(field.NewPath("fldpath"), 0, -1).WithOrigin("maxItems"),
+		},
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := make([]bool, tc.items)
+			gotErrs := MaxItems(context.Background(), operation.Operation{}, field.NewPath("fldpath"), value, nil, tc.max)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMaxProperties(t *testing.T) {
+	cases := []struct {
+		name       string
+		properties int
+		max        int
+		wantErrs   field.ErrorList
+	}{{
+		name:       "0 properties, max 0",
+		properties: 0,
+		max:        0,
+	}, {
+		name:       "1 property, max 0",
+		properties: 1,
+		max:        0,
+		wantErrs: field.ErrorList{
+			field.TooMany(field.NewPath("fldpath"), 1, 0).WithOrigin("maxProperties"),
+		},
+	}, {
+		name:       "1 property, max 1",
+		properties: 1,
+		max:        1,
+	}, {
+		name:       "2 properties, max 1",
+		properties: 2,
+		max:        1,
+		wantErrs: field.ErrorList{
+			field.TooMany(field.NewPath("fldpath"), 2, 1).WithOrigin("maxProperties"),
+		},
+	}, {
+		name:       "100000 properties, max 100000",
+		properties: 100000,
+		max:        100000,
+	}, {
+		name:       "100001 properties, max 100000",
+		properties: 100001,
+		max:        100000,
+		wantErrs: field.ErrorList{
+			field.TooMany(field.NewPath("fldpath"), 100001, 100000).WithOrigin("maxProperties"),
+		},
+	}, {
+		// Note: While JSON Schema does not allow negative values for maxProperties,
+		// we test that the validator handles it safely if it ever occurs at runtime.
+		name:       "0 properties, max -1",
+		properties: 0,
+		max:        -1,
+		wantErrs: field.ErrorList{
+			field.TooMany(field.NewPath("fldpath"), 0, -1).WithOrigin("maxProperties"),
+		},
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := make(map[string]string, tc.properties)
+			for i := 0; i < tc.properties; i++ {
+				value[fmt.Sprintf("%d", i)] = "value"
+			}
+
+			gotErrs := MaxProperties(context.Background(), operation.Operation{}, field.NewPath("fldpath"), value, nil, tc.max)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMinimum(t *testing.T) {
+	testMinimumPositive[int](t)
+	testMinimumNegative[int](t)
+	testMinimumPositive[int8](t)
+	testMinimumNegative[int8](t)
+	testMinimumPositive[int16](t)
+	testMinimumNegative[int16](t)
+	testMinimumPositive[int32](t)
+	testMinimumNegative[int32](t)
+	testMinimumPositive[int64](t)
+	testMinimumNegative[int64](t)
+
+	testMinimumPositive[uint](t)
+	testMinimumPositive[uint8](t)
+	testMinimumPositive[uint16](t)
+	testMinimumPositive[uint32](t)
+	testMinimumPositive[uint64](t)
+}
+
+type minimumTestCase[T constraints.Integer] struct {
+	min      T
+	value    T
+	wantErrs field.ErrorList
+}
+
+func testMinimumPositive[T constraints.Integer](t *testing.T) {
+	t.Helper()
+	cases := []minimumTestCase[T]{{
+		min:   0,
+		value: 0,
+	}, {
+		min:   1,
+		value: 0,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), nil, "must be greater than or equal to").WithOrigin("minimum"),
+		},
+	}, {
+		min:   1,
+		value: 1,
+	}, {
+		min:   2,
+		value: 1,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), nil, "must be greater than or equal to").WithOrigin("minimum"),
+		},
+	}}
+	doTestMinimum[T](t, cases)
+}
+
+func testMinimumNegative[T constraints.Signed](t *testing.T) {
+	t.Helper()
+	cases := []minimumTestCase[T]{{
+		min:   -1,
+		value: -1,
+	}, {
+		min:   -1,
+		value: -2,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), nil, "must be greater than or equal to").WithOrigin("minimum"),
+		},
+	}}
+
+	doTestMinimum[T](t, cases)
+}
+
+func doTestMinimum[T constraints.Integer](t *testing.T, cases []minimumTestCase[T]) {
+	t.Helper()
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		name := fmt.Sprintf("%T (%v >= %v)", tc.value, tc.value, tc.min)
+		t.Run(name, func(t *testing.T) {
+			v := tc.value
+			gotErrs := Minimum(context.Background(), operation.Operation{}, field.NewPath("fldpath"), &v, nil, tc.min)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMaximum(t *testing.T) {
+	testMaximumPositive[int](t)
+	testMaximumNegative[int](t)
+	testMaximumPositive[int8](t)
+	testMaximumNegative[int8](t)
+	testMaximumPositive[int16](t)
+	testMaximumNegative[int16](t)
+	testMaximumPositive[int32](t)
+	testMaximumNegative[int32](t)
+	testMaximumPositive[int64](t)
+	testMaximumNegative[int64](t)
+
+	testMaximumPositive[uint](t)
+	testMaximumPositive[uint8](t)
+	testMaximumPositive[uint16](t)
+	testMaximumPositive[uint32](t)
+	testMaximumPositive[uint64](t)
+}
+
+type maximumTestCase[T constraints.Integer] struct {
+	max      T
+	value    T
+	wantErrs field.ErrorList
+}
+
+func testMaximumPositive[T constraints.Integer](t *testing.T) {
+	t.Helper()
+	cases := []maximumTestCase[T]{{
+		max:   0,
+		value: 0,
+	}, {
+		max:   0,
+		value: 1,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), nil, "must be less than or equal to").WithOrigin("maximum"),
+		},
+	}, {
+		max:   1,
+		value: 1,
+	}, {
+		max:   1,
+		value: 2,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), nil, "must be less than or equal to").WithOrigin("maximum"),
+		},
+	}}
+	doTestMaximum[T](t, cases)
+}
+
+func testMaximumNegative[T constraints.Signed](t *testing.T) {
+	t.Helper()
+	cases := []maximumTestCase[T]{{
+		max:   -1,
+		value: -1,
+	}, {
+		max:   -2,
+		value: -1,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), nil, "must be less than or equal to").WithOrigin("maximum"),
+		},
+	}}
+
+	doTestMaximum[T](t, cases)
+}
+
+func doTestMaximum[T constraints.Integer](t *testing.T, cases []maximumTestCase[T]) {
+	t.Helper()
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		name := fmt.Sprintf("%T (%v <= %v)", tc.value, tc.value, tc.max)
+		t.Run(name, func(t *testing.T) {
+			v := tc.value
+			gotErrs := Maximum(context.Background(), operation.Operation{}, field.NewPath("fldpath"), &v, nil, tc.max)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMaxBytes(t *testing.T) {
+	cases := []struct {
+		name     string
+		value    string
+		max      int
+		wantErrs field.ErrorList
+	}{{
+		name:     "empty string",
+		value:    "",
+		max:      0,
+		wantErrs: nil,
+	}, {
+		name:  "zero length",
+		value: "0",
+		max:   0,
+		wantErrs: field.ErrorList{
+			field.TooLong(field.NewPath("fldpath"), "", 0).WithOrigin("maxBytes"),
+		},
+	}, {
+		name:     "one character",
+		value:    "0",
+		max:      1,
+		wantErrs: nil,
+	}, {
+		name:  "two characters",
+		value: "01",
+		max:   1,
+		wantErrs: field.ErrorList{
+			field.TooLong(field.NewPath("fldpath"), "", 1).WithOrigin("maxBytes"),
+		},
+	}, {
+		value: "",
+		max:   -1,
+		wantErrs: field.ErrorList{
+			field.TooLong(field.NewPath("fldpath"), "", -1).WithOrigin("maxBytes"),
+		},
+	}, {
+		name:     "ascii-only characters, less bytes than max",
+		value:    "abcdefghi",
+		max:      10,
+		wantErrs: nil,
+	}, {
+		name:     "multi-byte characters, less bytes than max",
+		value:    "©®©®",
+		max:      10,
+		wantErrs: nil,
+	}, {
+		name:  "ascii-only characters, more bytes than max",
+		value: "abcdefghijkl",
+		max:   10,
+		wantErrs: field.ErrorList{
+			field.TooLong(field.NewPath("fldpath"), "", 10).WithOrigin("maxBytes"),
+		},
+	}, {
+		name:  "multi-byte characters, more bytes than max",
+		value: "©®©®©©",
+		max:   10,
+		wantErrs: field.ErrorList{
+			field.TooLong(field.NewPath("fldpath"), "", 10).WithOrigin("maxBytes"),
+		},
+	}, {
+		name:     "mixture of characters, less bytes than max",
+		value:    "©abc®®",
+		max:      10,
+		wantErrs: nil,
+	}, {
+		name:  "mixture of characters, more bytes than max",
+		value: "©abc®®abc",
+		max:   10,
+		wantErrs: field.ErrorList{
+			field.TooLong(field.NewPath("fldpath"), "", 10).WithOrigin("maxBytes"),
+		},
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			v := tc.value
+			gotErrs := MaxBytes(context.Background(), operation.Operation{}, field.NewPath("fldpath"), &v, nil, tc.max)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMinLength(t *testing.T) {
+	cases := []struct {
+		name     string
+		value    string
+		min      int
+		wantErrs field.ErrorList // regex
+	}{{
+		name:     "empty string allowed",
+		value:    "",
+		min:      0,
+		wantErrs: nil,
+	}, {
+		name:  "minimum length of one, empty string",
+		value: "",
+		min:   1,
+		wantErrs: field.ErrorList{
+			field.TooShort(field.NewPath("fldpath"), "", 1).WithOrigin("minLength"),
+		},
+	}, {
+		name:     "minimum length of one, non-empty string",
+		value:    "test",
+		min:      1,
+		wantErrs: nil,
+	}, {
+		name:  "minimum length of 10, 9 character string",
+		value: "012345678",
+		min:   10,
+		wantErrs: field.ErrorList{
+			field.TooShort(field.NewPath("fldpath"), "012345678", 10).WithOrigin("minLength"),
+		},
+	}, {
+		name:     "minimum length of 10, 10 character string",
+		value:    "0123456789",
+		min:      10,
+		wantErrs: nil,
+	}, {
+		name:     "negative minimum value",
+		value:    "",
+		min:      -1,
+		wantErrs: nil,
+	}, {
+		name:  "ascii-only characters, less characters than min (n-1)",
+		value: "abcdefghi",
+		min:   10,
+		wantErrs: field.ErrorList{
+			field.TooShort(field.NewPath("fldpath"), "abcdefghi", 10).WithOrigin("minLength"),
+		},
+	}, {
+		name:  "multi-byte characters, less characters than min (n-1)",
+		value: "©®©®©®©®©",
+		min:   10,
+		wantErrs: field.ErrorList{
+			field.TooShort(field.NewPath("fldpath"), "©®©®©®©®©", 10).WithOrigin("minLength"),
+		},
+	}, {
+		name:     "ascii-only characters, more characters than min (n+1)",
+		value:    "abcdefghijkl",
+		min:      10,
+		wantErrs: nil,
+	}, {
+		name:     "multi-byte characters, more characters than min (n+1)",
+		value:    "©®©®©®©®©®©",
+		min:      10,
+		wantErrs: nil,
+	}, {
+		name:  "mixture of characters, maximum size in bytes of input is greater than min, rune count less than min",
+		value: "©®©®©®", // 12 bytes, but 6 characters
+		min:   10,
+		wantErrs: field.ErrorList{
+			field.TooShort(field.NewPath("fldpath"), "©®©®©®", 10).WithOrigin("minLength"),
+		},
+	}, {
+		name:     "multi-byte characters, exact characters as min (n)",
+		value:    "©®©®©®©®©®",
+		min:      10,
+		wantErrs: nil,
+	}, {
+		name:     "ascii-only characters, exact characters as min (n)",
+		value:    "abcdefghij",
+		min:      10,
+		wantErrs: nil,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			v := tc.value
+			gotErrs := MinLength(context.Background(), operation.Operation{}, field.NewPath("fldpath"), &v, nil, tc.min)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/monotonic.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/monotonic.go
new file mode 100644
index 0000000000..f0526c9ffe
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/monotonic.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/constraints"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Monotonic validates that an integer value has not decreased on update.
+func Monotonic[T constraints.Integer](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+
+	if value == nil || oldValue == nil {
+		return nil
+	}
+
+	if *value < *oldValue {
+		return field.ErrorList{field.Invalid(fldPath, *value, fmt.Sprintf("may not be decreased from %v", *oldValue)).WithOrigin("monotonic")}
+	}
+
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/monotonic_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/monotonic_test.go
new file mode 100644
index 0000000000..4f900ef6c9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/monotonic_test.go
@@ -0,0 +1,121 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/constraints"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestMonotonic(t *testing.T) {
+	testMonotonicPositive[int](t)
+	testMonotonicNegative[int](t)
+	testMonotonicPositive[int64](t)
+	testMonotonicPositive[uint64](t)
+}
+
+type monotonicTestCase[T constraints.Integer] struct {
+	name     string
+	op       operation.Operation
+	value    *T
+	oldValue *T
+	wantErrs field.ErrorList
+}
+
+func testMonotonicPositive[T constraints.Integer](t *testing.T) {
+	t.Helper()
+	v0 := T(0)
+	v1 := T(1)
+	v2 := T(2)
+
+	cases := []monotonicTestCase[T]{{
+		name:     "create (ignored)",
+		op:       operation.Operation{Type: operation.Create},
+		value:    &v0,
+		oldValue: nil,
+	}, {
+		name:     "update same value",
+		op:       operation.Operation{Type: operation.Update},
+		value:    &v1,
+		oldValue: &v1,
+	}, {
+		name:     "update increase",
+		op:       operation.Operation{Type: operation.Update},
+		value:    &v2,
+		oldValue: &v1,
+	}, {
+		name:     "update decrease",
+		op:       operation.Operation{Type: operation.Update},
+		value:    &v1,
+		oldValue: &v2,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), v1, "").WithOrigin("monotonic"),
+		},
+	}, {
+		name:     "update nil value",
+		op:       operation.Operation{Type: operation.Update},
+		value:    nil,
+		oldValue: &v1,
+	}, {
+		name:     "update nil old value",
+		op:       operation.Operation{Type: operation.Update},
+		value:    &v1,
+		oldValue: nil,
+	}}
+
+	doTestMonotonic[T](t, cases)
+}
+
+func testMonotonicNegative[T constraints.Signed](t *testing.T) {
+	t.Helper()
+	vM1 := T(-1)
+	vM2 := T(-2)
+
+	cases := []monotonicTestCase[T]{{
+		name:     "update negative increase",
+		op:       operation.Operation{Type: operation.Update},
+		value:    &vM1,
+		oldValue: &vM2,
+	}, {
+		name:     "update negative decrease",
+		op:       operation.Operation{Type: operation.Update},
+		value:    &vM2,
+		oldValue: &vM1,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), vM2, "").WithOrigin("monotonic"),
+		},
+	}}
+
+	doTestMonotonic[T](t, cases)
+}
+
+func doTestMonotonic[T constraints.Integer](t *testing.T, cases []monotonicTestCase[T]) {
+	t.Helper()
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		name := fmt.Sprintf("%T %s", *new(T), tc.name)
+		t.Run(name, func(t *testing.T) {
+			gotErrs := Monotonic(context.Background(), tc.op, field.NewPath("fldpath"), tc.value, tc.oldValue)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/options.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/options.go
new file mode 100644
index 0000000000..143be3b64a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/options.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// IfOption conditionally evaluates a validation function. If the option and enabled are both true the validator
+// is called. If the option and enabled are both false the validator is called. Otherwise, the validator is not called.
+func IfOption[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue T,
+	optionName string, enabled bool, validator func(context.Context, operation.Operation, *field.Path, T, T) field.ErrorList,
+) field.ErrorList {
+	on, defined := op.HasOption(optionName)
+	if !defined {
+		return field.ErrorList{field.InternalError(fldPath, fmt.Errorf("undefined validation option %q", optionName))}
+	}
+	if on == enabled {
+		return validator(ctx, op, fldPath, value, oldValue)
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/required.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/required.go
new file mode 100644
index 0000000000..61a253a9d8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/required.go
@@ -0,0 +1,133 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// RequiredValue verifies that the specified value is not the zero-value for
+// its type.
+func RequiredValue[T comparable](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	var zero T
+	if *value != zero {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "")}
+}
+
+// RequiredPointer verifies that the specified pointer is not nil.
+func RequiredPointer[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value != nil {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "")}
+}
+
+// RequiredSlice verifies that the specified slice is not empty.
+func RequiredSlice[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ []T) field.ErrorList {
+	if len(value) > 0 {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "")}
+}
+
+// RequiredMap verifies that the specified map is not empty.
+func RequiredMap[K comparable, T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]T) field.ErrorList {
+	if len(value) > 0 {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "")}
+}
+
+// ForbiddenValue verifies that the specified value is the zero-value for its
+// type.
+func ForbiddenValue[T comparable](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	var zero T
+	if *value == zero {
+		return nil
+	}
+	return field.ErrorList{field.Forbidden(fldPath, "")}
+}
+
+// ForbiddenPointer verifies that the specified pointer is nil.
+func ForbiddenPointer[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	return field.ErrorList{field.Forbidden(fldPath, "")}
+}
+
+// ForbiddenSlice verifies that the specified slice is empty.
+func ForbiddenSlice[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ []T) field.ErrorList {
+	if len(value) == 0 {
+		return nil
+	}
+	return field.ErrorList{field.Forbidden(fldPath, "")}
+}
+
+// ForbiddenMap verifies that the specified map is empty.
+func ForbiddenMap[K comparable, T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]T) field.ErrorList {
+	if len(value) == 0 {
+		return nil
+	}
+	return field.ErrorList{field.Forbidden(fldPath, "")}
+}
+
+// OptionalValue verifies that the specified value is not the zero-value for
+// its type. This is identical to RequiredValue, but the caller should treat an
+// error here as an indication that the optional value was not specified.
+func OptionalValue[T comparable](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	var zero T
+	if *value != zero {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "optional value was not specified")}
+}
+
+// OptionalPointer verifies that the specified pointer is not nil. This is
+// identical to RequiredPointer, but the caller should treat an error here as an
+// indication that the optional value was not specified.
+func OptionalPointer[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value != nil {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "optional value was not specified")}
+}
+
+// OptionalSlice verifies that the specified slice is not empty. This is
+// identical to RequiredSlice, but the caller should treat an error here as an
+// indication that the optional value was not specified.
+func OptionalSlice[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ []T) field.ErrorList {
+	if len(value) > 0 {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "optional value was not specified")}
+}
+
+// OptionalMap verifies that the specified map is not empty. This is identical
+// to RequiredMap, but the caller should treat an error here as an indication that
+// the optional value was not specified.
+func OptionalMap[K comparable, T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]T) field.ErrorList {
+	if len(value) > 0 {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "optional value was not specified")}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/required_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/required_test.go
new file mode 100644
index 0000000000..6511271cd9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/required_test.go
@@ -0,0 +1,924 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"regexp"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestRequiredValue(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := "value"
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := "" // zero-value
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 123
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0 // zero-value
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := true
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false // zero-value
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{"value"}
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{} // zero-value
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ptr.To("")
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil) // zero-value
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Required value",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestRequiredPointer(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ""
+			return RequiredPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*string)(nil)
+			return RequiredPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0
+			return RequiredPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*int)(nil)
+			return RequiredPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false
+			return RequiredPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*bool)(nil)
+			return RequiredPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{}
+			return RequiredPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*struct{ S string })(nil)
+			return RequiredPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil)
+			return RequiredPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (**string)(nil)
+			return RequiredPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath: Required value",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestRequiredSlice(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{""}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{0}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{false}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{nil}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestRequiredMap(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{"": ""}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{0: 0}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[bool]bool{false: false}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]bool{}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestOptionalValue(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := "value"
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := "" // zero-value
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 123
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0 // zero-value
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := true
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false // zero-value
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{"value"}
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{} // zero-value
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ptr.To("")
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil) // zero-value
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestOptionalPointer(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ""
+			return OptionalPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*string)(nil)
+			return OptionalPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0
+			return OptionalPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*int)(nil)
+			return OptionalPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false
+			return OptionalPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*bool)(nil)
+			return OptionalPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{}
+			return OptionalPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*struct{ S string })(nil)
+			return OptionalPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil)
+			return OptionalPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (**string)(nil)
+			return OptionalPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestOptionalSlice(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{""}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{0}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{false}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{nil}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestOptionalMap(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{"": ""}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{0: 0}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[bool]bool{false: false}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]bool{}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestForbiddenValue(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ""
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := "value"
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 123
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := true
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{}
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{"value"}
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil)
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ptr.To("")
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestForbiddenPointer(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*string)(nil)
+			return ForbiddenPointer(context.Background(), op, fp, pointer, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ""
+			return ForbiddenPointer(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*int)(nil)
+			return ForbiddenPointer(context.Background(), op, fp, pointer, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0
+			return ForbiddenPointer(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*bool)(nil)
+			return ForbiddenPointer(context.Background(), op, fp, pointer, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false
+			return ForbiddenPointer(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*struct{ S string })(nil)
+			return ForbiddenPointer(context.Background(), op, fp, pointer, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{}
+			return ForbiddenPointer(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (**string)(nil)
+			return ForbiddenPointer(context.Background(), op, fp, pointer, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil)
+			return ForbiddenPointer(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestForbiddenSlice(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{""}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{0}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{false}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{nil}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestForbiddenMap(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{"": ""}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{0: 0}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]bool{}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[bool]bool{false: false}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/strfmt.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/strfmt.go
new file mode 100644
index 0000000000..893f55d777
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/strfmt.go
@@ -0,0 +1,329 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/content"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+const (
+	uuidErrorMessage              = "must be a lowercase UUID in 8-4-4-4-12 format"
+	defaultResourceRequestsPrefix = "requests."
+	// Default namespace prefix.
+	resourceDefaultNamespacePrefix = "kubernetes.io/"
+	resourceDeviceMaxLength        = 32
+)
+
+// ShortName verifies that the specified value is a valid "short name"
+// (sometimes known as a "DNS label").
+//   - must not be empty
+//   - must be less than 64 characters long
+//   - must start and end with lower-case alphanumeric characters
+//   - must contain only lower-case alphanumeric characters or dashes
+//
+// All errors returned by this function will be "invalid" type errors. If the
+// caller wants better errors, it must take responsibility for checking things
+// like required/optional and max-length.
+func ShortName[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	for _, msg := range content.IsDNS1123Label((string)(*value)) {
+		allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-short-name"))
+	}
+	return allErrs
+}
+
+// LongName verifies that the specified value is a valid "long name"
+// (sometimes known as a "DNS subdomain").
+//   - must not be empty
+//   - must be less than 254 characters long
+//   - each element must start and end with lower-case alphanumeric characters
+//   - each element must contain only lower-case alphanumeric characters or dashes
+//
+// All errors returned by this function will be "invalid" type errors. If the
+// caller wants better errors, it must take responsibility for checking things
+// like required/optional and max-length.
+func LongName[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	for _, msg := range content.IsDNS1123Subdomain((string)(*value)) {
+		allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-long-name"))
+	}
+	return allErrs
+}
+
+// LabelKey verifies that the specified value is a valid label key.
+// A label key is composed of an optional prefix and a name, separated by a '/'.
+// The name part is required and must:
+//   - be 63 characters or less
+//   - begin and end with an alphanumeric character ([a-z0-9A-Z])
+//   - contain only alphanumeric characters, dashes (-), underscores (_), or dots (.)
+//
+// The prefix is optional and must:
+//   - be a DNS subdomain
+//   - be no more than 253 characters
+func LabelKey[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	for _, msg := range content.IsLabelKey((string)(*value)) {
+		allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-label-key"))
+	}
+	return allErrs
+}
+
+// PrefixedLabelKey verifies that the specified value is a valid label key with
+// a domain prefix.
+// A prefixed label key is composed of a prefix and a name, separated by a '/'.
+// The name part is required and must:
+//   - be 63 characters or less
+//   - begin and end with an alphanumeric character ([a-z0-9A-Z])
+//   - contain only alphanumeric characters, dashes (-), underscores (_), or dots (.)
+//
+// The prefix must:
+//   - be a DNS subdomain
+//   - be no more than 253 characters
+func PrefixedLabelKey[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	for _, msg := range content.IsPrefixedLabelKey((string)(*value)) {
+		allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-prefixed-label-key"))
+	}
+	return allErrs
+}
+
+// LongNameCaseless verifies that the specified value is a valid "long name"
+// (sometimes known as a "DNS subdomain"), but is case-insensitive.
+//   - must not be empty
+//   - must be less than 254 characters long
+//   - each element must start and end with alphanumeric characters
+//   - each element must contain only alphanumeric characters or dashes
+//
+// Deprecated: Case-insensitive names are not recommended as they can lead to ambiguity
+// (e.g., 'Foo', 'FOO', and 'foo' would be allowed names for foo). Use LongName for strict, lowercase validation.
+func LongNameCaseless[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	for _, msg := range content.IsDNS1123SubdomainCaseless((string)(*value)) {
+		allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-long-name-caseless"))
+	}
+	return allErrs
+}
+
+// LabelValue verifies that the specified value is a valid label value.
+//   - can be empty
+//   - must be no more than 63 characters
+//   - must start and end with alphanumeric characters
+//   - must contain only alphanumeric characters, dashes, underscores, or dots
+func LabelValue[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	for _, msg := range content.IsLabelValue((string)(*value)) {
+		allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-label-value"))
+	}
+	return allErrs
+}
+
+// PathSegmentName verifies that the specified value is a valid path segment name.
+// A path segment name can be safely encoded as a path segment in URLs and file paths.
+//   - must not be exactly "." or ".."
+//   - must not contain "/" (forward slash)
+//   - must not contain "%" (percent sign)
+//   - can contain any other characters including mixed case, numbers, dots, hyphens, underscores, and non-ASCII characters
+func PathSegmentName[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	for _, msg := range content.IsPathSegmentName((string)(*value)) {
+		allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-path-segment-name"))
+	}
+	return allErrs
+}
+
+// UUID verifies that the specified value is a valid UUID (RFC 4122).
+//   - must be 36 characters long
+//   - must be in the normalized form `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`
+//   - must use only lowercase hexadecimal characters
+func UUID[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	val := (string)(*value)
+	if len(val) != 36 {
+		return field.ErrorList{field.Invalid(fldPath, val, uuidErrorMessage).WithOrigin("format=k8s-uuid")}
+	}
+	for idx := 0; idx < len(val); idx++ {
+		character := val[idx]
+		switch idx {
+		case 8, 13, 18, 23:
+			if character != '-' {
+				return field.ErrorList{field.Invalid(fldPath, val, uuidErrorMessage).WithOrigin("format=k8s-uuid")}
+			}
+		default:
+			// should be lower case hexadecimal.
+			if (character < '0' || character > '9') && (character < 'a' || character > 'f') {
+				return field.ErrorList{field.Invalid(fldPath, val, uuidErrorMessage).WithOrigin("format=k8s-uuid")}
+			}
+		}
+	}
+	return nil
+}
+
+// ResourcePoolName verifies that the specified value is one or more valid "long name"
+// parts separated by a '/' and no longer than 253 characters.
+func ResourcePoolName[T ~string](ctx context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	val := (string)(*value)
+	var allErrs field.ErrorList
+	if len(val) > 253 {
+		allErrs = append(allErrs, field.TooLong(fldPath, val, 253))
+	}
+	parts := strings.Split(val, "/")
+	for i, part := range parts {
+		if len(part) == 0 {
+			allErrs = append(allErrs, field.Invalid(fldPath, val, fmt.Sprintf("segment %d: must not be empty", i)))
+			continue
+		}
+		// Note that we are overwriting the origin from the underlying LongName validation.
+		allErrs = append(allErrs, LongName(ctx, op, fldPath, &part, nil).PrefixDetail(fmt.Sprintf("segment %d: ", i))...)
+	}
+	return allErrs.WithOrigin("format=k8s-resource-pool-name")
+}
+
+// ExtendedResourceName verifies that the specified value is a valid extended resource name.
+// An extended resource name is a domain-prefixed name that does not use the "kubernetes.io"
+// or "requests." prefixes. Must be a valid label key when appended to "requests.", as in quota.
+//
+//   - must have slash domain and name.
+//   - must not have the "kubernetes.io" domain
+//   - must not have the "requests." prefix
+//   - name must be 63 characters or less
+//   - must be a valid label key when appended to "requests.", as in quota
+//     -- must contain only alphanumeric characters, dashes, underscores, or dots
+//     -- must end with an alphanumeric character
+func ExtendedResourceName[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	val := string(*value)
+	allErrs := field.ErrorList{}
+	if !strings.Contains(val, "/") {
+		allErrs = append(allErrs, field.Invalid(fldPath, val, "a name must be a domain-prefixed path, such as 'example.com/my-prop'"))
+	} else if strings.Contains(val, resourceDefaultNamespacePrefix) {
+		allErrs = append(allErrs, field.Invalid(fldPath, val, fmt.Sprintf("must not have %q domain", resourceDefaultNamespacePrefix)))
+	}
+	// Ensure extended resource is not type of quota.
+	if strings.HasPrefix(val, defaultResourceRequestsPrefix) {
+		allErrs = append(allErrs, field.Invalid(fldPath, val, fmt.Sprintf("must not have %q prefix", defaultResourceRequestsPrefix)))
+	}
+
+	// Ensure it satisfies the rules in IsLabelKey() after converted into quota resource name
+	nameForQuota := fmt.Sprintf("%s%s", defaultResourceRequestsPrefix, val)
+	for _, msg := range content.IsLabelKey(nameForQuota) {
+		allErrs = append(allErrs, field.Invalid(fldPath, val, msg))
+	}
+	return allErrs.WithOrigin("format=k8s-extended-resource-name")
+}
+
+// resourcesQualifiedName verifies that the specified value is a valid Kubernetes resources
+// qualified name.
+//   - must not be empty
+//   - must be composed of an optional prefix and a name, separated by a slash (e.g., "prefix/name")
+//   - the prefix, if specified, must be a DNS subdomain
+//   - the name part must be a C identifier
+//   - the name part must be no more than 32 characters
+func resourcesQualifiedName[T ~string](ctx context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	s := string(*value)
+	parts := strings.Split(s, "/")
+	// TODO: This validation and the corresponding handwritten validation validateQualifiedName in
+	// pkg/apis/resource/validation/validation.go are not validating whether there are more than 1
+	// slash. This should be fixed in both places.
+	switch len(parts) {
+	case 1:
+		allErrs = append(allErrs, validateCIdentifier(parts[0], resourceDeviceMaxLength, fldPath)...)
+	case 2:
+		if len(parts[0]) == 0 {
+			allErrs = append(allErrs, field.Invalid(fldPath, "", "prefix must not be empty"))
+		} else {
+			if len(parts[0]) > 63 {
+				allErrs = append(allErrs, field.TooLong(fldPath, parts[0], 63))
+			}
+			allErrs = append(allErrs, LongName(ctx, op, fldPath, &parts[0], nil).PrefixDetail("prefix: ")...)
+		}
+		if len(parts[1]) == 0 {
+			allErrs = append(allErrs, field.Invalid(fldPath, "", "name must not be empty"))
+		} else {
+			allErrs = append(allErrs, validateCIdentifier(parts[1], resourceDeviceMaxLength, fldPath)...)
+		}
+	}
+	return allErrs
+}
+
+// ResourceFullyQualifiedName verifies that the specified value is a valid Kubernetes
+// fully qualified name.
+//   - must not be empty
+//   - must be composed of a prefix and a name, separated by a slash (e.g., "prefix/name")
+//   - the prefix must be a DNS subdomain
+//   - the name part must be a C identifier
+//   - the name part must be no more than 32 characters
+func ResourceFullyQualifiedName[T ~string](ctx context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	s := string(*value)
+	allErrs = append(allErrs, resourcesQualifiedName(ctx, op, fldPath, &s, nil)...)
+	if !strings.Contains(s, "/") {
+		allErrs = append(allErrs, field.Invalid(fldPath, s, "a fully qualified name must be a domain and a name separated by a slash"))
+	}
+	return allErrs.WithOrigin("format=k8s-resource-fully-qualified-name")
+}
+
+func validateCIdentifier(id string, length int, fldPath *field.Path) field.ErrorList {
+	var allErrs field.ErrorList
+	if len(id) > length {
+		allErrs = append(allErrs, field.TooLong(fldPath, id, length))
+	}
+	for _, msg := range content.IsCIdentifier(id) {
+		allErrs = append(allErrs, field.Invalid(fldPath, id, msg))
+	}
+	return allErrs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/strfmt_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/strfmt_test.go
new file mode 100644
index 0000000000..1310f414a3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/strfmt_test.go
@@ -0,0 +1,950 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestShortName(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid",
+		input:    "abc-123",
+		wantErrs: nil,
+	}, {
+		name:  "invalid: empty",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character").WithOrigin("format=k8s-short-name"),
+		},
+	}, {
+		name:  "invalid: too long",
+		input: "01234567890123456789012345678901234567890123456789012345678901234",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "01234567890123456789012345678901234567890123456789012345678901234", "must be no more than 63 bytes").WithOrigin("format=k8s-short-name"),
+		},
+	}, {
+		name:  "invalid: starts with dash",
+		input: "-abc-123",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "-abc-123", "a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character").WithOrigin("format=k8s-short-name"),
+		},
+	}, {
+		name:  "invalid: ends with dash",
+		input: "abc-123-",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "abc-123-", "a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character").WithOrigin("format=k8s-short-name"),
+		},
+	}, {
+		name:  "invalid: upper-case",
+		input: "ABC-123",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "ABC-123", "a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character").WithOrigin("format=k8s-short-name"),
+		},
+	}, {
+		name:  "invalid: other chars",
+		input: "abc_123",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "abc_123", "a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character").WithOrigin("format=k8s-short-name"),
+		},
+	}}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailSubstring()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := tc.input
+			gotErrs := ShortName(ctx, operation.Operation{}, fldPath, &value, nil)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestLongName(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid",
+		input:    "a.b.c",
+		wantErrs: nil,
+	}, {
+		name:  "invalid: empty",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name"),
+		},
+	}, {
+		name:  "invalid: too long",
+		input: strings.Repeat("a", 254),
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, strings.Repeat("a", 254), "must be no more than 253 bytes").WithOrigin("format=k8s-long-name"),
+		},
+	}, {
+		name:  "invalid: starts with dash",
+		input: "-a.b.c",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "-a.b.c", "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name"),
+		},
+	}, {
+		name:  "invalid: ends with dash",
+		input: "a.b.c-",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "a.b.c-", "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name"),
+		},
+	}, {
+		name:  "invalid: upper-case",
+		input: "A.b.c",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "A.b.c", "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name"),
+		},
+	}, {
+		name:  "invalid: other chars",
+		input: "a_b.c",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "a_b.c", "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name"),
+		},
+	}}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailSubstring()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := tc.input
+			gotErrs := LongName(ctx, operation.Operation{}, fldPath, &value, nil)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestLabelKey(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid key",
+		input:    "app",
+		wantErrs: nil,
+	}, {
+		name:     "valid key with dash",
+		input:    "app-name",
+		wantErrs: nil,
+	}, {
+		name:     "valid key with dot",
+		input:    "app.name",
+		wantErrs: nil,
+	}, {
+		name:     "valid key with underscore",
+		input:    "app_name",
+		wantErrs: nil,
+	}, {
+		name:     "valid key with prefix",
+		input:    "example.com/app",
+		wantErrs: nil,
+	}, {
+		name:     "valid key with long prefix",
+		input:    strings.Repeat("a", 63) + "." + strings.Repeat("b", 63) + "." + strings.Repeat("c", 63) + "." + strings.Repeat("d", 55) + "/app",
+		wantErrs: nil,
+	}, {
+		name:  "invalid: empty string",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-key"),
+		},
+	}, {
+		name:  "invalid: starts with dash",
+		input: "-app",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-key"),
+		},
+	}, {
+		name:  "invalid: ends with dash",
+		input: "app-",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-key"),
+		},
+	}, {
+		name:  "invalid: contains invalid characters",
+		input: "app^",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-key"),
+		},
+	}, {
+		name:  "invalid: name too long",
+		input: strings.Repeat("a", 64),
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-key"),
+		},
+	}, {
+		name:  "invalid: prefix too long",
+		input: strings.Repeat("a", 254) + "/app",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-key"),
+		},
+	}, {
+		name:  "invalid: prefix is not a DNS subdomain",
+		input: "example-.com/app",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-key"),
+		},
+	}, {
+		name:     "nil value",
+		input:    "", // This will be handled by setting value to nil in the test runner
+		wantErrs: nil,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			var value *string
+			if tc.name != "nil value" {
+				v := tc.input
+				value = &v
+			}
+			gotErrs := LabelKey(ctx, operation.Operation{}, fldPath, value, nil)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestPrefixedLabelKey(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:  "valid key",
+		input: "app",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "valid key with dash",
+		input: "app-name",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "valid key with dot",
+		input: "app.name",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "valid key with underscore",
+		input: "app_name",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:     "valid key with prefix",
+		input:    "example.com/app",
+		wantErrs: nil,
+	}, {
+		name:     "valid key with long prefix",
+		input:    strings.Repeat("a", 63) + "." + strings.Repeat("b", 63) + "." + strings.Repeat("c", 63) + "." + strings.Repeat("d", 55) + "/app",
+		wantErrs: nil,
+	}, {
+		name:  "invalid: empty string",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "invalid: starts with dash",
+		input: "-app",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "invalid: ends with dash",
+		input: "app-",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "invalid: contains invalid characters",
+		input: "app^",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "invalid: name too long",
+		input: strings.Repeat("a", 64),
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "invalid: prefix too long",
+		input: strings.Repeat("a", 254) + "/app",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "invalid: prefix is not a DNS subdomain",
+		input: "example-.com/app",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:     "nil value",
+		input:    "", // This will be handled by setting value to nil in the test runner
+		wantErrs: nil,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			var value *string
+			if tc.name != "nil value" {
+				v := tc.input
+				value = &v
+			}
+			gotErrs := PrefixedLabelKey(ctx, operation.Operation{}, fldPath, value, nil)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestK8sUUID(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid uuid with hyphens",
+		input:    "123e4567-e89b-12d3-a456-426614174000",
+		wantErrs: nil,
+	}, {
+		name:  "invalid uuid with hyphens uppercase",
+		input: "123E4567-E89B-12D3-A456-426614174000",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "123E4567-E89B-12D3-A456-426614174000", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}, {
+		name:  "invalid uuid with urn prefix",
+		input: "urn:uuid:123e4567-e89b-12d3-a456-426614174000",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "urn:uuid:123e4567-e89b-12d3-a456-426614174000", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}, {
+		name:  "invalid uuid without hyphens",
+		input: "123e4567e89b12d3a456426614174000",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "123e4567e89b12d3a456426614174000", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}, {
+		name:  "invalid: wrong length",
+		input: "123e4567-e89b-12d3-a456-42661417400",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "123e4567-e89b-12d3-a456-42661417400", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}, {
+		name:  "invalid: wrong characters",
+		input: "123e4567-e89b-12d3-a456-42661417400g",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "123e4567-e89b-12d3-a456-42661417400g", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}, {
+		name:  "invalid: misplaced hyphens",
+		input: "123e4567-e89b-12d3-a4564-26614174000",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "123e4567-e89b-12d3-a4564-26614174000", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}, {
+		name:  "empty string",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}, {
+		name:  "not a uuid",
+		input: "not-a-uuid",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "not-a-uuid", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailExact()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := tc.input
+			gotErrs := UUID(ctx, operation.Operation{}, fldPath, &value, nil)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestLabelValue(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid value",
+		input:    "valid-value",
+		wantErrs: nil,
+	}, {
+		name:     "valid value with dots",
+		input:    "valid.value",
+		wantErrs: nil,
+	}, {
+		name:     "valid value with underscores",
+		input:    "valid_value",
+		wantErrs: nil,
+	}, {
+		name:     "valid single character value",
+		input:    "a",
+		wantErrs: nil,
+	}, {
+		name:     "valid value with numbers",
+		input:    "123-abc",
+		wantErrs: nil,
+	}, {
+		name:     "valid uppercase characters",
+		input:    "Valid-Value",
+		wantErrs: nil,
+	}, {
+		name:  "invalid: starts with dash",
+		input: "-invalid-value",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:  "invalid: ends with dash",
+		input: "invalid-value-",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:  "invalid: starts with dot",
+		input: ".invalid.value",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:  "invalid: ends with dot",
+		input: "invalid.value.",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:  "invalid: starts with underscore",
+		input: "_invalid_value",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:  "invalid: ends with underscore",
+		input: "invalid_value_",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:  "invalid: contains special characters",
+		input: "invalid@value",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:  "invalid: too long",
+		input: "a" + strings.Repeat("b", 62) + "c", // 64 characters
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:     "valid: max length",
+		input:    "a" + strings.Repeat("b", 61) + "c", // 63 characters
+		wantErrs: nil,
+	}, {
+		name:     "valid: empty string",
+		input:    "",
+		wantErrs: nil,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := tc.input
+			gotErrs := LabelValue(ctx, operation.Operation{}, fldPath, &value, nil)
+
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestPathSegmentName(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	// This format validator does not check for empty strings or max length,
+	// only checks path-segment-unsafe characters. Those constraints are
+	// handled by separate validators (Required, maxLength) in the schema.
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid simple name",
+		input:    "valid-name",
+		wantErrs: nil,
+	}, {
+		name:     "valid with dots",
+		input:    "foo.bar.baz",
+		wantErrs: nil,
+	}, {
+		name:     "valid with mixed case",
+		input:    "MyResource",
+		wantErrs: nil,
+	}, {
+		name:     "valid with numbers",
+		input:    "resource123",
+		wantErrs: nil,
+	}, {
+		name:     "valid with underscores",
+		input:    "my_resource",
+		wantErrs: nil,
+	}, {
+		name:     "valid complex identifier",
+		input:    "sha256:ABCDEF012345@ABCDEF012345",
+		wantErrs: nil,
+	}, {
+		name:     "valid with non-ASCII characters",
+		input:    "Iñtërnâtiônàlizætiøn",
+		wantErrs: nil,
+	}, {
+		name:     "valid with leading dot",
+		input:    ".test",
+		wantErrs: nil,
+	}, {
+		name:     "valid with leading double dot",
+		input:    "..test",
+		wantErrs: nil,
+	}, {
+		name:     "valid empty string",
+		input:    "",
+		wantErrs: nil,
+	}, {
+		name:  "invalid: exactly dot",
+		input: ".",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, ".", "may not be '.'").WithOrigin("format=k8s-path-segment-name"),
+		},
+	}, {
+		name:  "invalid: exactly double dot",
+		input: "..",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "..", "may not be '..'").WithOrigin("format=k8s-path-segment-name"),
+		},
+	}, {
+		name:  "invalid: contains slash",
+		input: "foo/bar",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "foo/bar", "may not contain '/'").WithOrigin("format=k8s-path-segment-name"),
+		},
+	}, {
+		name:  "invalid: contains percent",
+		input: "foo%bar",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "foo%bar", "may not contain '%'").WithOrigin("format=k8s-path-segment-name"),
+		},
+	}, {
+		name:  "invalid: contains both slash and percent",
+		input: "foo/bar%baz",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "may not contain '/'").WithOrigin("format=k8s-path-segment-name"),
+			field.Invalid(fldPath, nil, "may not contain '%'").WithOrigin("format=k8s-path-segment-name"),
+		},
+	}}
+
+	exactMatcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailSubstring()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := tc.input
+			gotErrs := PathSegmentName(ctx, operation.Operation{}, fldPath, &value, nil)
+
+			exactMatcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestLongNameCaseless(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid",
+		input:    "A.b.C",
+		wantErrs: nil,
+	}, {
+		name:  "invalid: empty",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "an RFC 1123 subdomain must consist of alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name-caseless"),
+		},
+	}, {
+		name:  "invalid: too long",
+		input: strings.Repeat("a", 254),
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, strings.Repeat("a", 254), "must be no more than 253 bytes").WithOrigin("format=k8s-long-name-caseless"),
+		},
+	}, {
+		name:  "invalid: starts with dash",
+		input: "-A.b.C",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "-A.b.C", "an RFC 1123 subdomain must consist of alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name-caseless"),
+		},
+	},
+		{
+			name:  "invalid: ends with dash",
+			input: "A.b.C-",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "A.b.C-", "an RFC 1123 subdomain must consist of alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name-caseless"),
+			},
+		},
+		{
+			name:  "invalid: other chars",
+			input: "A_b.C",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "A_b.C", "an RFC 1123 subdomain must consist of alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name-caseless"),
+			},
+		},
+	}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := tc.input
+			gotErrs := LongNameCaseless(ctx, operation.Operation{}, fldPath, &value, nil)
+
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestResourcePoolName(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:  "valid: single segment",
+		input: "a.valid.long-name",
+	}, {
+		name:  "valid: two segments",
+		input: "a.valid.long-name/another.one",
+	}, {
+		name:  "valid: multiple segments",
+		input: "a/b/c.d.e",
+	}, {
+		name:  "valid: segments with numbers",
+		input: "1.2.3/4.5.6",
+	}, {
+		name:  "invalid: empty string",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "segment 0: must not be empty").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: leading slash",
+		input: "/a.b.c",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: trailing slash",
+		input: "a.b.c/",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: double slash",
+		input: "a.b.c//d.e.f",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: one segment has uppercase",
+		input: "a.valid.name/Not.Valid",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "segment 1: a lowercase RFC 1123").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: one segment starts with dash",
+		input: "a.valid.name/-not-valid",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "segment 1: a lowercase RFC 1123").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: one segment has special characters",
+		input: "a.valid.name/not_valid",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "segment 1: a lowercase RFC 1123").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: too long",
+		input: "a.valid.name/" + strings.Repeat("b", 253),
+		wantErrs: field.ErrorList{
+			field.TooLong(fldPath, nil, 253).WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: segment too long",
+		input: strings.Repeat("b", 254),
+		wantErrs: field.ErrorList{
+			field.TooLong(fldPath, nil, 253).WithOrigin("format=k8s-resource-pool-name"),
+			field.Invalid(fldPath, nil, "segment 0: must be no more than 253 bytes").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: multiple invalid segments",
+		input: "Not/Valid/Either",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "segment 0: a lowercase RFC 1123").WithOrigin("format=k8s-resource-pool-name"),
+			field.Invalid(fldPath, nil, "segment 1: a lowercase RFC 1123").WithOrigin("format=k8s-resource-pool-name"),
+			field.Invalid(fldPath, nil, "segment 2: a lowercase RFC 1123").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: just a slash",
+		input: "/",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "segment 0: must not be empty").WithOrigin("format=k8s-resource-pool-name"),
+			field.Invalid(fldPath, nil, "segment 1: must not be empty").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}}
+
+	exactMatcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailSubstring()
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := &tc.input
+			gotErrs := ResourcePoolName(ctx, operation.Operation{}, fldPath, value, nil)
+			exactMatcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestExtendedResourceName(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{
+		{
+			name:     "valid",
+			input:    "example-kub.io/foo",
+			wantErrs: nil,
+		},
+		{
+			name:  "invalid: name too long",
+			input: strings.Repeat("a", 64),
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, strings.Repeat("a", 64), "a name must be a domain-prefixed path, such as 'example.com/my-prop").WithOrigin("format=k8s-extended-resource-name"),
+				field.Invalid(fldPath, strings.Repeat("a", 64), "name part must be no more than 63 bytes").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+		{
+			name:  "invalid: empty",
+			input: "",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "", "a name must be a domain-prefixed path, such as 'example.com/my-prop").WithOrigin("format=k8s-extended-resource-name"),
+				field.Invalid(fldPath, "", "name part must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]')").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+		{
+			name:  "invalid: no domain",
+			input: "foo",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "foo", "a name must be a domain-prefixed path, such as 'example.com/my-prop'").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+		{
+			name:  "invalid: no domain and no name",
+			input: "/",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "/", "name part must be non-empty").WithOrigin("format=k8s-extended-resource-name"),
+				field.Invalid(fldPath, "/", "name part must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]')").WithOrigin("format=k8s-extended-resource-name"),
+				field.Invalid(fldPath, "/", "prefix part a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+		{
+			name:  "invalid: something.kubernetes.io domain",
+			input: "something.kubernetes.io/foo",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "something.kubernetes.io/foo", "must not have \"kubernetes.io/\" domain").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+		{
+			name:  "invalid: kubernetes.io domain",
+			input: "kubernetes.io/foo",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "kubernetes.io/foo", "must not have \"kubernetes.io/\" domain").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+		{
+			name:  "invalid: requests prefix",
+			input: "requests.example.com/foo",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "requests.example.com/foo", "must not have \"requests.\" prefix").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+		{
+			name:  "invalid: name too long",
+			input: "example.com/" + strings.Repeat("a", 64),
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "example.com/"+strings.Repeat("a", 64), "name part must be no more than 63 bytes").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+	}
+
+	exactMatcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailSubstring()
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := &tc.input
+			gotErrs := ExtendedResourceName(ctx, operation.Operation{}, fldPath, value, nil)
+			exactMatcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestResourceFullyQualifiedName(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid name with prefix",
+		input:    "prefix.com/name",
+		wantErrs: nil,
+	}, {
+		name:     "valid name with complex prefix",
+		input:    "my-subdomain.example.com/name",
+		wantErrs: nil,
+	}, {
+		name:  "invalid name with dots",
+		input: "prefix.com/name.with.dots",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "name.with.dots", "a valid C identifier must start with alphabetic character").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:  "invalid name with dashes",
+		input: "prefix.com/name-with-dashes",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "name-with-dashes", "a valid C identifier must start with alphabetic character").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:  "invalid: no prefix",
+		input: "name",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "name", "a fully qualified name must be a domain and a name separated by a slash").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:  "invalid: empty",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "a fully qualified name must be a domain and a name separated by a slash").WithOrigin("format=k8s-resource-fully-qualified-name"),
+			field.Invalid(fldPath, "", "a valid C identifier must start with alphabetic character").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:  "invalid: prefix too long",
+		input: strings.Repeat("a", 254) + "/name",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, strings.Repeat("a", 254), "prefix: must be no more than 253 bytes").WithOrigin("format=k8s-resource-fully-qualified-name"),
+			field.TooLong(fldPath, strings.Repeat("a", 254), 63).WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:  "invalid: name too long",
+		input: "prefix.com/" + strings.Repeat("a", 64),
+		wantErrs: field.ErrorList{
+			field.TooLong(fldPath, strings.Repeat("a", 64), 32).WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:  "invalid: prefix is not a valid DNS subdomain",
+		input: "Prefix.com/name",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "Prefix.com", "prefix: a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:     "invalid: name is not a valid RFC 1123 label",
+		input:    "prefix.com/Name",
+		wantErrs: nil, // no errors, C-identifiers can have uppercase letters
+	}, {
+		name:     "invalid: more than one slash",
+		input:    "prefix.com/name/extra",
+		wantErrs: nil, // This is not validated, yet.
+	}, {
+		name:  "invalid: empty name",
+		input: "prefix.com/",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "name must not be empty").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:  "invalid: empty prefix",
+		input: "/name",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "prefix must not be empty").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := tc.input
+			gotErrs := ResourceFullyQualifiedName(ctx, operation.Operation{}, fldPath, &value, nil)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/subfield.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/subfield.go
new file mode 100644
index 0000000000..7aa48d3304
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/subfield.go
@@ -0,0 +1,56 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// GetFieldFunc is a function that extracts a field from a type and returns a
+// nilable value.
+type GetFieldFunc[Tstruct any, Tfield any] func(*Tstruct) Tfield
+
+// Subfield validates a subfield of a struct against a validator function. If
+// the value of the subfield is the same as the previous value, as per the
+// equiv function, then no validation is performed.
+//
+// The equiv function can be called with nil arguments in the case of nilable
+// fields.
+//
+// The fldPath passed to the validator includes the subfield name.
+func Subfield[Tstruct any, Tfield any](
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	newStruct, oldStruct *Tstruct,
+	fldName string, getField GetFieldFunc[Tstruct, Tfield],
+	equiv MatchFunc[Tfield],
+	validator ValidateFunc[Tfield],
+) field.ErrorList {
+	var errs field.ErrorList
+	newVal := getField(newStruct)
+	var oldVal Tfield
+	if oldStruct != nil {
+		oldVal = getField(oldStruct)
+	}
+	if op.Type == operation.Update && oldStruct != nil && equiv(newVal, oldVal) {
+		return nil
+	}
+	errs = append(errs, validator(ctx, op, fldPath.Child(fldName), newVal, oldVal)...)
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/testing.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/testing.go
new file mode 100644
index 0000000000..461bb0cdd0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/testing.go
@@ -0,0 +1,35 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// FixedResult asserts a fixed boolean result.  This is mostly useful for
+// testing.
+func FixedResult[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ T, result bool, arg string) field.ErrorList {
+	if result {
+		return nil
+	}
+	return field.ErrorList{
+		field.Invalid(fldPath, value, "forced failure: "+arg).WithOrigin("validateFalse"),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/testing_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/testing_test.go
new file mode 100644
index 0000000000..762e6df621
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/testing_test.go
@@ -0,0 +1,146 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestFixedResult(t *testing.T) {
+	cases := []struct {
+		value any
+		pass  bool
+	}{{
+		value: "",
+		pass:  false,
+	}, {
+		value: "",
+		pass:  true,
+	}, {
+		value: "nonempty",
+		pass:  false,
+	}, {
+		value: "nonempty",
+		pass:  true,
+	}, {
+		value: 0,
+		pass:  false,
+	}, {
+		value: 0,
+		pass:  true,
+	}, {
+		value: 1,
+		pass:  false,
+	}, {
+		value: 1,
+		pass:  true,
+	}, {
+		value: false,
+		pass:  false,
+	}, {
+		value: false,
+		pass:  true,
+	}, {
+		value: true,
+		pass:  false,
+	}, {
+		value: true,
+		pass:  true,
+	}, {
+		value: nil,
+		pass:  false,
+	}, {
+		value: nil,
+		pass:  true,
+	}, {
+		value: ptr.To(""),
+		pass:  false,
+	}, {
+		value: ptr.To(""),
+		pass:  true,
+	}, {
+		value: ptr.To("nonempty"),
+		pass:  false,
+	}, {
+		value: ptr.To("nonempty"),
+		pass:  true,
+	}, {
+		value: []string(nil),
+		pass:  false,
+	}, {
+		value: []string(nil),
+		pass:  true,
+	}, {
+		value: []string{},
+		pass:  false,
+	}, {
+		value: []string{},
+		pass:  true,
+	}, {
+		value: []string{"s"},
+		pass:  false,
+	}, {
+		value: []string{"s"},
+		pass:  true,
+	}, {
+		value: map[string]string(nil),
+		pass:  false,
+	}, {
+		value: map[string]string(nil),
+		pass:  true,
+	}, {
+		value: map[string]string{},
+		pass:  false,
+	}, {
+		value: map[string]string{},
+		pass:  true,
+	}, {
+		value: map[string]string{"k": "v"},
+		pass:  false,
+	}, {
+		value: map[string]string{"k": "v"},
+		pass:  true,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailExact()
+	for i, tc := range cases {
+		result := FixedResult(context.Background(), operation.Operation{}, field.NewPath("fldpath"), tc.value, nil, tc.pass, "detail string")
+		if len(result) != 0 && tc.pass {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && !tc.pass {
+			t.Errorf("case %d: unexpected success", i)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			wantErrorList := field.ErrorList{
+				field.Invalid(field.NewPath("fldpath"), tc.value, "forced failure: detail string").WithOrigin("validateFalse"),
+			}
+			matcher.Test(t, wantErrorList, result)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/union.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/union.go
new file mode 100644
index 0000000000..753a4a9ee1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/union.go
@@ -0,0 +1,238 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// ExtractorFn extracts a value from a parent object. Depending on the context,
+// that could be the value of a field or just whether that field was set or
+// not.
+// Note: obj is not guaranteed to be non-nil, need to handle nil obj in the
+// extractor.
+type ExtractorFn[T, V any] func(obj T) V
+
+// UnionValidationOptions configures how union validation behaves
+type UnionValidationOptions struct {
+	// ErrorForEmpty returns error when no fields are set (nil means no error)
+	ErrorForEmpty func(fldPath *field.Path, allFields []string) *field.Error
+
+	// ErrorForMultiple returns error when multiple fields are set (nil means no error)
+	ErrorForMultiple func(fldPath *field.Path, specifiedFields []string, allFields []string) *field.Error
+}
+
+// Union verifies that exactly one member of a union is specified.
+//
+// UnionMembership must define all the members of the union.
+//
+// For example:
+//
+//	var UnionMembershipForABC := validate.NewUnionMembership(
+//	 	validate.NewUnionMember("a"),
+//	 	validate.NewUnionMember("b"),
+//	 	validate.NewUnionMember("c"),
+//	 )
+//	func ValidateABC(ctx context.Context, op operation.Operation, fldPath *field.Path, in *ABC) (errs field.ErrorList) {
+//		errs = append(errs, Union(ctx, op, fldPath, in, oldIn, UnionMembershipForABC,
+//			func(in *ABC) bool { return in.A != nil },
+//			func(in *ABC) bool { return in.B != "" },
+//			func(in *ABC) bool { return in.C != 0 },
+//		)...)
+//		return errs
+//	}
+//
+// Note that T is "any", rather than "comparable", because union-members can be
+// slices, meaning T might be a struct with a slice, meaning it is not
+// comparable.
+func Union[T any](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj T, union *UnionMembership, isSetFns ...ExtractorFn[T, bool]) field.ErrorList {
+	options := UnionValidationOptions{
+		ErrorForEmpty: func(fldPath *field.Path, allFields []string) *field.Error {
+			return field.Invalid(fldPath, "",
+				fmt.Sprintf("must specify one of: %s", strings.Join(allFields, ", ")))
+		},
+		ErrorForMultiple: func(fldPath *field.Path, specifiedFields []string, allFields []string) *field.Error {
+			return field.Invalid(fldPath, fmt.Sprintf("{%s}", strings.Join(specifiedFields, ", ")),
+				fmt.Sprintf("must specify exactly one of: %s", strings.Join(allFields, ", ")))
+		},
+	}
+
+	return unionValidate(op, fldPath, obj, oldObj, union, options, isSetFns...).WithOrigin("union")
+}
+
+// DiscriminatedUnion verifies specified union member matches the discriminator.
+//
+// UnionMembership must define all the members of the union and the discriminator.
+//
+// For example:
+//
+//	var UnionMembershipForABC = validate.NewDiscriminatedUnionMembership("type",
+//	 	validate.NewDiscriminatedUnionMember("a", "A"),
+//	 	validate.NewDiscriminatedUnionMember("b", "B"),
+//	 	validate.NewDiscriminatedUnionMember("c", "C"),
+//	)
+//	func ValidateABC(ctx context.Context, op operation.Operation, fldPath *field.Path, in *ABC) (errs field.ErrorList) {
+//		errs = append(errs, DiscriminatedUnion(ctx, op, fldPath, in, oldIn, UnionMembershipForABC,
+//			func(in *ABC) string { return string(in.Type) },
+//			func(in *ABC) bool { return in.A != nil },
+//			func(in *ABC) bool { return in.B != "" },
+//			func(in *ABC) bool { return in.C != 0 },
+//		)...)
+//		return errs
+//	}
+//
+// It is not an error for the discriminatorValue to be unknown.  That must be
+// validated on its own.
+//
+// Note that T is "any", rather than "comparable", because union-members can be
+// slices, meaning T might be a struct with a slice, meaning it is not
+// comparable.
+func DiscriminatedUnion[T any, D ~string](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj T, union *UnionMembership, discriminatorExtractor ExtractorFn[T, D], isSetFns ...ExtractorFn[T, bool]) (errs field.ErrorList) {
+	if len(union.members) != len(isSetFns) {
+		return field.ErrorList{
+			field.InternalError(fldPath,
+				fmt.Errorf("number of extractors (%d) does not match number of union members (%d)",
+					len(isSetFns), len(union.members))),
+		}
+	}
+	hasOldValue := !reflect.ValueOf(oldObj).IsZero() // because T is any, rather than comparable
+	var changed bool
+	discriminatorValue := discriminatorExtractor(obj)
+	if op.Type == operation.Update {
+		oldDiscriminatorValue := discriminatorExtractor(oldObj)
+		changed = discriminatorValue != oldDiscriminatorValue
+	}
+
+	for i, fieldIsSet := range isSetFns {
+		member := union.members[i]
+		isDiscriminatedMember := string(discriminatorValue) == member.discriminatorValue
+		newIsSet := fieldIsSet(obj)
+		if op.Type == operation.Update && !changed {
+			oldIsSet := fieldIsSet(oldObj)
+			changed = changed || newIsSet != oldIsSet
+		}
+		if newIsSet && !isDiscriminatedMember {
+			errs = append(errs, field.Invalid(fldPath.Child(member.fieldName), "",
+				fmt.Sprintf("may only be specified when `%s` is %q", union.discriminatorName, member.discriminatorValue)))
+		} else if !newIsSet && isDiscriminatedMember {
+			errs = append(errs, field.Invalid(fldPath.Child(member.fieldName), "",
+				fmt.Sprintf("must be specified when `%s` is %q", union.discriminatorName, discriminatorValue)))
+		}
+	}
+	// If the union discriminator and membership is unchanged, we don't need to
+	// re-validate.
+	if op.Type == operation.Update && hasOldValue && !changed {
+		return nil
+	}
+	return errs.WithOrigin("union")
+}
+
+// UnionMember represents a member of a union.
+type UnionMember struct {
+	fieldName          string
+	discriminatorValue string
+}
+
+// NewUnionMember returns a new UnionMember for the given field name.
+func NewUnionMember(fieldName string) UnionMember {
+	return UnionMember{fieldName: fieldName}
+}
+
+// NewDiscriminatedUnionMember returns a new UnionMember for the given field
+// name and discriminator value.
+func NewDiscriminatedUnionMember(fieldName, discriminatorValue string) UnionMember {
+	return UnionMember{fieldName: fieldName, discriminatorValue: discriminatorValue}
+}
+
+// UnionMembership represents an ordered list of field union memberships.
+type UnionMembership struct {
+	discriminatorName string
+	members           []UnionMember
+}
+
+// NewUnionMembership returns a new UnionMembership for the given list of members.
+// Member names must be unique.
+func NewUnionMembership(member ...UnionMember) *UnionMembership {
+	return NewDiscriminatedUnionMembership("", member...)
+}
+
+// NewDiscriminatedUnionMembership returns a new UnionMembership for the given discriminator field and list of members.
+// members are provided in the same way as for NewUnionMembership.
+func NewDiscriminatedUnionMembership(discriminatorFieldName string, members ...UnionMember) *UnionMembership {
+	return &UnionMembership{
+		discriminatorName: discriminatorFieldName,
+		members:           members,
+	}
+}
+
+// allFields returns a string listing all the field names of the member of a union for use in error reporting.
+func (u UnionMembership) allFields() []string {
+	memberNames := make([]string, 0, len(u.members))
+	for _, f := range u.members {
+		memberNames = append(memberNames, fmt.Sprintf("`%s`", f.fieldName))
+	}
+	return memberNames
+}
+
+func unionValidate[T any](op operation.Operation, fldPath *field.Path,
+	obj, oldObj T, union *UnionMembership, options UnionValidationOptions, isSetFns ...ExtractorFn[T, bool],
+) field.ErrorList {
+	if len(union.members) != len(isSetFns) {
+		return field.ErrorList{
+			field.InternalError(fldPath,
+				fmt.Errorf("number of extractors (%d) does not match number of union members (%d)",
+					len(isSetFns), len(union.members))),
+		}
+	}
+
+	hasOldValue := !reflect.ValueOf(oldObj).IsZero() // because T is any, rather than comparable
+	var specifiedFields []string
+	var changed bool
+	for i, fieldIsSet := range isSetFns {
+		newIsSet := fieldIsSet(obj)
+		if op.Type == operation.Update && !changed {
+			oldIsSet := fieldIsSet(oldObj)
+			changed = changed || newIsSet != oldIsSet
+		}
+		if newIsSet {
+			specifiedFields = append(specifiedFields, union.members[i].fieldName)
+		}
+	}
+
+	// If the union membership is unchanged, we don't need to re-validate.
+	if op.Type == operation.Update && hasOldValue && !changed {
+		return nil
+	}
+
+	var errs field.ErrorList
+
+	if len(specifiedFields) > 1 && options.ErrorForMultiple != nil {
+		errs = append(errs, options.ErrorForMultiple(fldPath, specifiedFields, union.allFields()))
+	}
+
+	if len(specifiedFields) == 0 && options.ErrorForEmpty != nil {
+		errs = append(errs, options.ErrorForEmpty(fldPath, union.allFields()))
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/union_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/union_test.go
new file mode 100644
index 0000000000..4afc3f759d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/union_test.go
@@ -0,0 +1,485 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+type testMember struct{}
+
+func TestUnion(t *testing.T) {
+	testCases := []struct {
+		name        string
+		fields      []string
+		fieldValues []bool
+		expected    field.ErrorList
+	}{
+		{
+			name:        "one member set",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{false, false, false, true},
+			expected:    nil,
+		},
+		{
+			name:        "two members set",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{false, true, false, true},
+			expected:    field.ErrorList{field.Invalid(nil, "{b, d}", "must specify exactly one of: `a`, `b`, `c`, `d`")}.WithOrigin("union"),
+		},
+		{
+			name:        "all members set",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{true, true, true, true},
+			expected:    field.ErrorList{field.Invalid(nil, "{a, b, c, d}", "must specify exactly one of: `a`, `b`, `c`, `d`")}.WithOrigin("union"),
+		},
+		{
+			name:        "no member set",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{false, false, false, false},
+			expected:    field.ErrorList{field.Invalid(nil, "", "must specify one of: `a`, `b`, `c`, `d`")}.WithOrigin("union"),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			members := []UnionMember{}
+			for _, f := range tc.fields {
+				members = append(members, NewUnionMember(f))
+			}
+
+			t.Run("pointer", func(t *testing.T) {
+				// Create mock extractors that return predefined values instead of
+				// actually extracting from the object.
+				extractors := make([]ExtractorFn[*testMember, bool], len(tc.fieldValues))
+				for i, val := range tc.fieldValues {
+					extractors[i] = func(_ *testMember) bool { return val }
+				}
+
+				got := Union(context.Background(), operation.Operation{}, nil, &testMember{}, nil,
+					NewUnionMembership(members...), extractors...)
+				if !reflect.DeepEqual(got, tc.expected) {
+					t.Errorf("got %v want %v", got, tc.expected)
+				}
+			})
+			t.Run("value", func(t *testing.T) {
+				// Create mock extractors that return predefined values instead of
+				// actually extracting from the object.
+				extractors := make([]ExtractorFn[testMember, bool], len(tc.fieldValues))
+				for i, val := range tc.fieldValues {
+					extractors[i] = func(_ testMember) bool { return val }
+				}
+
+				got := Union(context.Background(), operation.Operation{}, nil, testMember{}, testMember{},
+					NewUnionMembership(members...), extractors...)
+				if !reflect.DeepEqual(got, tc.expected) {
+					t.Errorf("got %v want %v", got, tc.expected)
+				}
+			})
+		})
+	}
+}
+
+func TestDiscriminatedUnion(t *testing.T) {
+	testCases := []struct {
+		name               string
+		discriminatorField string
+		fields             [][2]string
+		discriminatorValue string
+		fieldValues        []bool
+		expected           field.ErrorList
+	}{
+		{
+			name:               "valid discriminated union A",
+			discriminatorField: "d",
+			fields:             [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			discriminatorValue: "A",
+			fieldValues:        []bool{true, false, false, false},
+		},
+		{
+			name:               "valid discriminated union C",
+			discriminatorField: "d",
+			fields:             [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			discriminatorValue: "C",
+			fieldValues:        []bool{false, false, true, false},
+		},
+		{
+			name:               "invalid, discriminator not set to member that is specified",
+			discriminatorField: "type",
+			fields:             [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			discriminatorValue: "C",
+			fieldValues:        []bool{false, true, false, false},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("b"), "", "may only be specified when `type` is \"B\""),
+				field.Invalid(field.NewPath("c"), "", "must be specified when `type` is \"C\""),
+			}.WithOrigin("union"),
+		},
+		{
+			name:               "invalid, discriminator correct, multiple members set",
+			discriminatorField: "type",
+			fields:             [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			discriminatorValue: "C",
+			fieldValues:        []bool{false, true, true, true},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("b"), "", "may only be specified when `type` is \"B\""),
+				field.Invalid(field.NewPath("d"), "", "may only be specified when `type` is \"D\""),
+			}.WithOrigin("union"),
+		},
+	}
+
+	for _, tc := range testCases {
+		members := []UnionMember{}
+		for _, f := range tc.fields {
+			members = append(members, NewDiscriminatedUnionMember(f[0], f[1]))
+		}
+
+		t.Run(tc.name, func(t *testing.T) {
+			t.Run("pointer", func(t *testing.T) {
+				discriminatorExtractor := func(_ *testMember) string { return tc.discriminatorValue }
+
+				// Create mock extractors that return predefined values instead of
+				// actually extracting from the object.
+				extractors := make([]ExtractorFn[*testMember, bool], len(tc.fieldValues))
+				for i, val := range tc.fieldValues {
+					extractors[i] = func(_ *testMember) bool { return val }
+				}
+
+				got := DiscriminatedUnion(context.Background(), operation.Operation{}, nil, &testMember{}, nil,
+					NewDiscriminatedUnionMembership(tc.discriminatorField, members...), discriminatorExtractor, extractors...)
+				if !reflect.DeepEqual(got, tc.expected) {
+					t.Errorf("got %v want %v", got.ToAggregate(), tc.expected.ToAggregate())
+				}
+			})
+			t.Run("value", func(t *testing.T) {
+				discriminatorExtractor := func(_ testMember) string { return tc.discriminatorValue }
+
+				// Create mock extractors that return predefined values instead of
+				// actually extracting from the object.
+				extractors := make([]ExtractorFn[testMember, bool], len(tc.fieldValues))
+				for i, val := range tc.fieldValues {
+					extractors[i] = func(_ testMember) bool { return val }
+				}
+
+				got := DiscriminatedUnion(context.Background(), operation.Operation{}, nil, testMember{}, testMember{},
+					NewDiscriminatedUnionMembership(tc.discriminatorField, members...), discriminatorExtractor, extractors...)
+				if !reflect.DeepEqual(got, tc.expected) {
+					t.Errorf("got %v want %v", got.ToAggregate(), tc.expected.ToAggregate())
+				}
+			})
+		})
+	}
+}
+
+type testStruct struct {
+	M1 *m1               `json:"m1"`
+	M2 *m2               `json:"m2"`
+	M3 []string          `json:"m3"`
+	M4 map[string]string `json:"m4"`
+}
+
+type m1 struct{}
+type m2 struct{}
+
+var extractors = []ExtractorFn[*testStruct, bool]{
+	func(s *testStruct) bool {
+		if s == nil {
+			return false
+		}
+		return s.M1 != nil
+	},
+	func(s *testStruct) bool {
+		if s == nil {
+			return false
+		}
+		return s.M2 != nil
+	},
+	func(s *testStruct) bool {
+		if s == nil {
+			return false
+		}
+		return len(s.M3) != 0
+	},
+	func(s *testStruct) bool {
+		if s == nil {
+			return false
+		}
+		return len(s.M4) != 0
+	},
+}
+
+func TestUnionRatcheting(t *testing.T) {
+	testCases := []struct {
+		name      string
+		oldStruct *testStruct
+		newStruct *testStruct
+		expected  field.ErrorList
+	}{
+		{
+			name:      "old nil - no ratcheting",
+			oldStruct: nil,
+			newStruct: &testStruct{},
+			expected: field.ErrorList{
+				field.Invalid(nil, "", "must specify one of: `m1`, `m2`, `m3`, `m4`"),
+			}.WithOrigin("union"),
+		},
+		{
+			name:      "both empty struct",
+			oldStruct: &testStruct{},
+			newStruct: &testStruct{},
+		},
+		{
+			name: "both have more than one member",
+			oldStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+			newStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+		},
+		{
+			name: "change to invalid",
+			oldStruct: &testStruct{
+				M1: &m1{},
+			},
+			newStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(nil, "{m1, m2}", "must specify exactly one of: `m1`, `m2`, `m3`, `m4`"),
+			}.WithOrigin("union"),
+		},
+		{
+			name:      "slice member ratcheting: unchanged membership",
+			oldStruct: &testStruct{M3: []string{"a"}},
+			newStruct: &testStruct{M3: []string{"b"}},
+		},
+		{
+			name:      "map member ratcheting: unchanged membership",
+			oldStruct: &testStruct{M4: map[string]string{"k": "v1"}},
+			newStruct: &testStruct{M4: map[string]string{"k": "v2"}},
+		},
+		{
+			name:      "empty slice is not set",
+			oldStruct: nil,
+			newStruct: &testStruct{M3: []string{}},
+			expected: field.ErrorList{
+				field.Invalid(nil, "", "must specify one of: `m1`, `m2`, `m3`, `m4`"),
+			}.WithOrigin("union"),
+		},
+		{
+			name:      "empty map is not set",
+			oldStruct: nil,
+			newStruct: &testStruct{M4: map[string]string{}},
+			expected: field.ErrorList{
+				field.Invalid(nil, "", "must specify one of: `m1`, `m2`, `m3`, `m4`"),
+			}.WithOrigin("union"),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			members := []UnionMember{NewUnionMember("m1"), NewUnionMember("m2"), NewUnionMember("m3"), NewUnionMember("m4")}
+			got := Union(context.Background(), operation.Operation{Type: operation.Update}, nil, tc.newStruct, tc.oldStruct,
+				NewUnionMembership(members...), extractors...)
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
+
+type testDiscriminatedStruct struct {
+	D  string            `json:"d"`
+	M1 *m1               `json:"m1"`
+	M2 *m2               `json:"m2"`
+	M3 []string          `json:"m3"`
+	M4 map[string]string `json:"m4"`
+}
+
+var testDiscriminatorExtractor = func(s *testDiscriminatedStruct) string {
+	if s != nil {
+		return s.D
+	}
+	return ""
+}
+var testDiscriminatedExtractors = []ExtractorFn[*testDiscriminatedStruct, bool]{
+	func(s *testDiscriminatedStruct) bool {
+		if s == nil {
+			return false
+		}
+		return s.M1 != nil
+	},
+	func(s *testDiscriminatedStruct) bool {
+		if s == nil {
+			return false
+		}
+		return s.M2 != nil
+	},
+	func(s *testDiscriminatedStruct) bool {
+		if s == nil {
+			return false
+		}
+		return len(s.M3) != 0
+	},
+	func(s *testDiscriminatedStruct) bool {
+		if s == nil {
+			return false
+		}
+		return len(s.M4) != 0
+	},
+}
+
+func TestDiscriminatedUnionRatcheting(t *testing.T) {
+	testCases := []struct {
+		name      string
+		oldStruct *testDiscriminatedStruct
+		newStruct *testDiscriminatedStruct
+		expected  field.ErrorList
+	}{
+		{
+			name: "pass with both nil",
+		},
+		{
+			name:      "pass with both empty struct",
+			oldStruct: &testDiscriminatedStruct{},
+			newStruct: &testDiscriminatedStruct{},
+		},
+		{
+			name: "pass with both not set to member that is specified",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M2: &m2{},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M2: &m2{},
+			},
+		},
+		{
+			name: "pass with both set to more than one member",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M1: &m1{},
+				M2: &m2{},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M1: &m1{},
+				M2: &m2{},
+			},
+		},
+		{
+			name: "fail on changing to invalid with both set",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M1: &m1{},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M1: &m1{},
+				M2: &m2{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("m2"), "", "may only be specified when `d` is \"m2\""),
+			}.WithOrigin("union"),
+		},
+		{
+			name: "fail on changing the discriminator",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M1: &m1{},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m2",
+				M1: &m1{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("m1"), "", "may only be specified when `d` is \"m1\""),
+				field.Invalid(field.NewPath("m2"), "", "must be specified when `d` is \"m2\""),
+			}.WithOrigin("union"),
+		},
+		{
+			name: "slice member ratcheting: unchanged membership",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m3",
+				M3: []string{"a"},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m3",
+				M3: []string{"b"},
+			},
+		},
+		{
+			name: "map member ratcheting: unchanged membership",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m4",
+				M4: map[string]string{"k": "v1"},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m4",
+				M4: map[string]string{"k": "v2"},
+			},
+		},
+		{
+			name: "empty slice is not set",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m3",
+				M3: []string{"a"},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m3",
+				M3: []string{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("m3"), "", "must be specified when `d` is \"m3\""),
+			}.WithOrigin("union"),
+		},
+		{
+			name: "empty map is not set",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m4",
+				M4: map[string]string{"k": "v"},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m4",
+				M4: map[string]string{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("m4"), "", "must be specified when `d` is \"m4\""),
+			}.WithOrigin("union"),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			members := []UnionMember{NewDiscriminatedUnionMember("m1", "m1"), NewDiscriminatedUnionMember("m2", "m2"), NewDiscriminatedUnionMember("m3", "m3"), NewDiscriminatedUnionMember("m4", "m4")}
+			got := DiscriminatedUnion(context.Background(), operation.Operation{Type: operation.Update}, nil, tc.newStruct, tc.oldStruct,
+				NewDiscriminatedUnionMembership("d", members...), testDiscriminatorExtractor, testDiscriminatedExtractors...)
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/update.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/update.go
new file mode 100644
index 0000000000..cf4db5b529
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/update.go
@@ -0,0 +1,289 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"slices"
+
+	"k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// UpdateConstraint represents a constraint on update operations
+type UpdateConstraint int
+
+const (
+	// NoSet prevents unset->set transitions
+	NoSet UpdateConstraint = iota
+	// NoUnset prevents set->unset transitions
+	NoUnset
+	// NoModify prevents value changes but allows set/unset transitions
+	NoModify
+	// NoAddItem prevents adding items to a slice or map
+	NoAddItem
+	// NoRemoveItem prevents removing items from a slice or map
+	NoRemoveItem
+)
+
+// UpdateValue verifies update constraints for value types.
+func UpdateValue[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, equiv MatchFunc[T], constraints ...UpdateConstraint) field.ErrorList {
+	// nil oldValue means no prior value to compare against (eg: a new item at +k8s:eachVal scope) -> no transition to check.
+	if op.Type != operation.Update || oldValue == nil {
+		return nil
+	}
+
+	var errs field.ErrorList
+	var zero T
+	valueIsZero := equiv(*value, zero)
+	oldValueIsZero := equiv(*oldValue, zero)
+
+	for _, constraint := range constraints {
+		switch constraint {
+		case NoSet:
+			if oldValueIsZero && !valueIsZero {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+			}
+		case NoUnset:
+			if !oldValueIsZero && valueIsZero {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+			}
+		case NoModify:
+			// Rely on validation ratcheting to detect that the value has changed.
+			// This check only verifies that the field was set in both the old and
+			// new objects, confirming it was a modification, not a set/unset.
+			if !oldValueIsZero && !valueIsZero {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be modified once set").WithOrigin("update"))
+			}
+		}
+	}
+
+	return errs
+}
+
+// UpdateValueByCompare verifies update constraints for comparable value types.
+//
+// Deprecated: Use UpdateValue instead.
+func UpdateValueByCompare[T comparable](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+	return UpdateValue(ctx, op, fldPath, value, oldValue, func(a, b T) bool { return a == b }, constraints...)
+}
+
+// UpdatePointer verifies update constraints for pointer types.
+func UpdatePointer[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+
+	var errs field.ErrorList
+
+	for _, constraint := range constraints {
+		switch constraint {
+		case NoSet:
+			if oldValue == nil && value != nil {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+			}
+		case NoUnset:
+			if oldValue != nil && value == nil {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+			}
+		case NoModify:
+			// Rely on validation ratcheting to detect that the value has changed.
+			// This check only verifies that the field was non-nil in both the old
+			// and new objects, confirming it was a modification, not a set/unset.
+			if oldValue != nil && value != nil {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be modified once set").WithOrigin("update"))
+			}
+		}
+	}
+
+	return errs
+}
+
+// UpdateValueByReflect verifies update constraints for non-comparable value types using reflection.
+//
+// Deprecated: Use UpdateValue instead.
+func UpdateValueByReflect[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+	return UpdateValue(ctx, op, fldPath, value, oldValue, func(a, b T) bool { return equality.Semantic.DeepEqual(a, b) }, constraints...)
+}
+
+// UpdateStruct verifies update constraints for non-pointer struct types.
+// Non-pointer structs are always considered "set" and never "unset".
+func UpdateStruct[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+	// nil oldValue means no prior value to compare against (eg: a new item at +k8s:eachVal scope) -> no transition to check.
+	if op.Type != operation.Update || oldValue == nil {
+		return nil
+	}
+
+	var errs field.ErrorList
+
+	for _, constraint := range constraints {
+		switch constraint {
+		case NoSet, NoUnset:
+			// These constraints don't apply to non-pointer structs
+			// as they can't be unset. This should be caught at generation time.
+			continue
+		case NoModify:
+			// Non-pointer structs are always considered "set". Therefore, any
+			// change detected by validation ratcheting is a modification.
+			// The deep equality check is redundant and has been removed.
+			errs = append(errs, field.Invalid(fldPath, nil, "field cannot be modified once set").WithOrigin("update"))
+		}
+	}
+
+	return errs
+}
+
+// ValSliceUpdate verifies update constraints for slices of values.
+// NoAddItem and NoRemoveItem use the match function to find corresponding
+// elements between value and oldValue. NoSet and NoUnset treat len == 0 as
+// "unset".
+//
+// The match function will never be called with nil arguments.
+func ValSliceUpdate[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue []T, match MatchFunc[*T], constraints ...UpdateConstraint) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+
+	if match == nil && (slices.Contains(constraints, NoAddItem) || slices.Contains(constraints, NoRemoveItem)) {
+		return field.ErrorList{field.InternalError(fldPath, fmt.Errorf("ValSliceUpdate: NoAddItem/NoRemoveItem require a non-nil match function"))}
+	}
+
+	var errs field.ErrorList
+
+	for _, constraint := range constraints {
+		switch constraint {
+		case NoSet:
+			if len(oldValue) == 0 && len(value) > 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+			}
+		case NoUnset:
+			if len(oldValue) > 0 && len(value) == 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+			}
+		case NoAddItem:
+			for i := range value {
+				newItem := &value[i]
+				if lookup(oldValue, newItem, match) == nil {
+					errs = append(errs, field.Forbidden(fldPath.Index(i), "item may not be added").WithOrigin("update"))
+				}
+			}
+		case NoRemoveItem:
+			for i := range oldValue {
+				oldItem := &oldValue[i]
+				if lookup(value, oldItem, match) == nil {
+					errs = append(errs, field.Forbidden(fldPath, "item may not be removed").WithOrigin("update"))
+				}
+			}
+		}
+	}
+
+	return errs
+}
+
+// PtrSliceUpdate verifies update constraints for slices of pointers.
+// NoAddItem and NoRemoveItem use the match function to find corresponding
+// elements between value and oldValue. NoSet and NoUnset treat len == 0 as
+// "unset".
+//
+// The match function will never be called with nil arguments.
+func PtrSliceUpdate[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue []*T, match MatchFunc[*T], constraints ...UpdateConstraint) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+
+	if match == nil && (slices.Contains(constraints, NoAddItem) || slices.Contains(constraints, NoRemoveItem)) {
+		return field.ErrorList{field.InternalError(fldPath, fmt.Errorf("PtrSliceUpdate: NoAddItem/NoRemoveItem require a non-nil match function"))}
+	}
+
+	var errs field.ErrorList
+
+	for _, constraint := range constraints {
+		switch constraint {
+		case NoSet:
+			if len(oldValue) == 0 && len(value) > 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+			}
+		case NoUnset:
+			if len(oldValue) > 0 && len(value) == 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+			}
+		case NoAddItem:
+			for i := range value {
+				newItem := value[i]
+				if newItem == nil {
+					// Ignore nil items; they are supposed to have been checked by PtrSliceNoNils.
+					continue
+				}
+				if lookupPointer(oldValue, newItem, match) == nil {
+					errs = append(errs, field.Forbidden(fldPath.Index(i), "item may not be added").WithOrigin("update"))
+				}
+			}
+		case NoRemoveItem:
+			for i := range oldValue {
+				oldItem := oldValue[i]
+				if oldItem == nil {
+					continue
+				}
+				if lookupPointer(value, oldItem, match) == nil {
+					errs = append(errs, field.Forbidden(fldPath, "item may not be removed").WithOrigin("update"))
+				}
+			}
+		}
+	}
+
+	return errs
+}
+
+// UpdateMap verifies update constraints for map types.
+// NoAddItem and NoRemoveItem compare keys between value and oldValue. NoSet
+// and NoUnset treat len == 0 as "unset".
+func UpdateMap[K comparable, V any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue map[K]V, constraints ...UpdateConstraint) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+
+	var errs field.ErrorList
+
+	for _, constraint := range constraints {
+		switch constraint {
+		case NoSet:
+			if len(oldValue) == 0 && len(value) > 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+			}
+		case NoUnset:
+			if len(oldValue) > 0 && len(value) == 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+			}
+		case NoAddItem:
+			for k := range value {
+				if _, ok := oldValue[k]; !ok {
+					errs = append(errs, field.Forbidden(fldPath.Key(fmt.Sprintf("%v", k)), "item may not be added").WithOrigin("update"))
+				}
+			}
+		case NoRemoveItem:
+			for k := range oldValue {
+				if _, ok := value[k]; !ok {
+					errs = append(errs, field.Forbidden(fldPath.Key(fmt.Sprintf("%v", k)), "item may not be removed").WithOrigin("update"))
+				}
+			}
+		}
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/update_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/update_test.go
new file mode 100644
index 0000000000..1978ced8d7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/update_test.go
@@ -0,0 +1,928 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestUpdateValue(t *testing.T) {
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       string
+		oldValue    string
+		constraints []UpdateConstraint
+		wantErrs    int
+		wantMsgs    []string
+	}{
+		{
+			name:        "create operation - no validation",
+			op:          operation.Create,
+			value:       "value",
+			oldValue:    "",
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoSet - unset to set transition (forbidden)",
+			op:          operation.Update,
+			value:       "value",
+			oldValue:    "",
+			constraints: []UpdateConstraint{NoSet},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoSet - set to set transition (allowed)",
+			op:          operation.Update,
+			value:       "value2",
+			oldValue:    "value1",
+			constraints: []UpdateConstraint{NoSet},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoUnset - set to unset transition (forbidden)",
+			op:          operation.Update,
+			value:       "",
+			oldValue:    "value",
+			constraints: []UpdateConstraint{NoUnset},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "NoUnset - unset to set transition (allowed)",
+			op:          operation.Update,
+			value:       "value",
+			oldValue:    "",
+			constraints: []UpdateConstraint{NoUnset},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - set to different value (forbidden)",
+			op:          operation.Update,
+			value:       "value2",
+			oldValue:    "value1",
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+		{
+			name:        "NoModify - unset to set transition (allowed)",
+			op:          operation.Update,
+			value:       "value",
+			oldValue:    "",
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - set to unset transition (allowed)",
+			op:          operation.Update,
+			value:       "",
+			oldValue:    "value",
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "Multiple constraints - NoSet and NoUnset",
+			op:          operation.Update,
+			value:       "value",
+			oldValue:    "",
+			constraints: []UpdateConstraint{NoSet, NoUnset},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be set once created"},
+		},
+		{
+			name:        "Multiple constraints - NoUnset and NoModify",
+			op:          operation.Update,
+			value:       "",
+			oldValue:    "value",
+			constraints: []UpdateConstraint{NoUnset, NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "Multiple constraints - NoSet, NoUnset, NoModify - modify attempt",
+			op:          operation.Update,
+			value:       "value2",
+			oldValue:    "value1",
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+		{
+			name:        "No constraints",
+			op:          operation.Update,
+			value:       "value2",
+			oldValue:    "value1",
+			constraints: []UpdateConstraint{},
+			wantErrs:    0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := UpdateValue(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, func(a, b string) bool { return a == b }, tt.constraints...)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("UpdateValue() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
+			}
+			for i, msg := range tt.wantMsgs {
+				if i >= len(errs) {
+					t.Errorf("Expected error message %q not found", msg)
+					continue
+				}
+				if errs[i].Detail != msg {
+					t.Errorf("UpdateValue() error message = %q, want %q", errs[i].Detail, msg)
+				}
+			}
+		})
+	}
+}
+
+func TestUpdateValueByCompare(t *testing.T) {
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       string
+		oldValue    string
+		constraints []UpdateConstraint
+		wantErrs    int
+		wantMsgs    []string
+	}{
+		{
+			name:        "NoSet - unset to set transition (forbidden)",
+			op:          operation.Update,
+			value:       "value",
+			oldValue:    "",
+			constraints: []UpdateConstraint{NoSet},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoUnset - set to unset transition (forbidden)",
+			op:          operation.Update,
+			value:       "",
+			oldValue:    "value",
+			constraints: []UpdateConstraint{NoUnset},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "NoModify - set to different value (forbidden)",
+			op:          operation.Update,
+			value:       "value2",
+			oldValue:    "value1",
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := UpdateValueByCompare(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, tt.constraints...)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("UpdateValueByCompare() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
+			}
+			for i, msg := range tt.wantMsgs {
+				if i >= len(errs) {
+					t.Errorf("Expected error message %q not found", msg)
+					continue
+				}
+				if errs[i].Detail != msg {
+					t.Errorf("UpdateValueByCompare() error message = %q, want %q", errs[i].Detail, msg)
+				}
+			}
+		})
+	}
+}
+
+func TestUpdateValue_CustomMatchFunc(t *testing.T) {
+	type NonComparableStruct struct {
+		Name string
+		Tags []string
+	}
+
+	customEquiv := func(a, b NonComparableStruct) bool {
+		return a.Name == b.Name && (len(a.Tags) == 0 && len(b.Tags) == 0 || (len(a.Tags) == len(b.Tags) && a.Tags[0] == b.Tags[0]))
+	}
+
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       NonComparableStruct
+		oldValue    NonComparableStruct
+		constraints []UpdateConstraint
+		wantErrs    int
+		wantMsgs    []string
+	}{
+		{
+			name:        "NoSet - unset to set (forbidden)",
+			op:          operation.Update,
+			value:       NonComparableStruct{Name: "foo", Tags: []string{"a"}},
+			oldValue:    NonComparableStruct{},
+			constraints: []UpdateConstraint{NoSet},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoUnset - set to unset (forbidden)",
+			op:          operation.Update,
+			value:       NonComparableStruct{},
+			oldValue:    NonComparableStruct{Name: "foo", Tags: []string{"a"}},
+			constraints: []UpdateConstraint{NoUnset},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "NoModify - zero to non-zero transition (allowed)",
+			op:          operation.Update,
+			value:       NonComparableStruct{Name: "foo", Tags: []string{"a"}},
+			oldValue:    NonComparableStruct{},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - non-zero to zero transition (allowed)",
+			op:          operation.Update,
+			value:       NonComparableStruct{},
+			oldValue:    NonComparableStruct{Name: "foo", Tags: []string{"a"}},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - non-zero to non-zero transition (forbidden)",
+			op:          operation.Update,
+			value:       NonComparableStruct{Name: "foo", Tags: []string{"b"}},
+			oldValue:    NonComparableStruct{Name: "foo", Tags: []string{"a"}},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := UpdateValue(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, customEquiv, tt.constraints...)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("UpdateValue() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
+			}
+			for i, msg := range tt.wantMsgs {
+				if i >= len(errs) {
+					t.Errorf("Expected error message %q not found", msg)
+					continue
+				}
+				if errs[i].Detail != msg {
+					t.Errorf("UpdateValue() error message = %q, want %q", errs[i].Detail, msg)
+				}
+			}
+		})
+	}
+}
+
+func TestUpdatePointer(t *testing.T) {
+	stringPtr := func(s string) *string { return &s }
+
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       *string
+		oldValue    *string
+		constraints []UpdateConstraint
+		wantErrs    int
+		wantMsgs    []string
+	}{
+		{
+			name:        "create operation - no validation",
+			op:          operation.Create,
+			value:       stringPtr("value"),
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoSet - nil to non-nil transition (forbidden)",
+			op:          operation.Update,
+			value:       stringPtr("value"),
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoSet - non-nil to non-nil transition (allowed)",
+			op:          operation.Update,
+			value:       stringPtr("value2"),
+			oldValue:    stringPtr("value1"),
+			constraints: []UpdateConstraint{NoSet},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoUnset - non-nil to nil transition (forbidden)",
+			op:          operation.Update,
+			value:       nil,
+			oldValue:    stringPtr("value"),
+			constraints: []UpdateConstraint{NoUnset},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "NoUnset - nil to non-nil transition (allowed)",
+			op:          operation.Update,
+			value:       stringPtr("value"),
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoUnset},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - different values (forbidden)",
+			op:          operation.Update,
+			value:       stringPtr("value2"),
+			oldValue:    stringPtr("value1"),
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+		{
+			name:        "NoModify - nil to non-nil transition (allowed)",
+			op:          operation.Update,
+			value:       stringPtr("value"),
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - non-nil to nil transition (allowed)",
+			op:          operation.Update,
+			value:       nil,
+			oldValue:    stringPtr("value"),
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "Multiple constraints - all three",
+			op:          operation.Update,
+			value:       stringPtr("value2"),
+			oldValue:    stringPtr("value1"),
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := UpdatePointer(context.TODO(), op, field.NewPath("test"), tt.value, tt.oldValue, tt.constraints...)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("UpdatePointer() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
+			}
+			for i, msg := range tt.wantMsgs {
+				if i >= len(errs) {
+					t.Errorf("Expected error message %q not found", msg)
+					continue
+				}
+				if errs[i].Detail != msg {
+					t.Errorf("UpdatePointer() error message = %q, want %q", errs[i].Detail, msg)
+				}
+			}
+		})
+	}
+}
+
+func TestUpdateValueByReflect(t *testing.T) {
+	type CustomStruct struct {
+		Field1 string
+		Field2 int
+	}
+
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       CustomStruct
+		oldValue    CustomStruct
+		constraints []UpdateConstraint
+		wantErrs    int
+		wantMsgs    []string
+	}{
+		{
+			name:        "NoModify - zero to non-zero transition (allowed)",
+			op:          operation.Update,
+			value:       CustomStruct{Field1: "test", Field2: 42},
+			oldValue:    CustomStruct{},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - non-zero to zero transition (allowed)",
+			op:          operation.Update,
+			value:       CustomStruct{},
+			oldValue:    CustomStruct{Field1: "test", Field2: 42},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - different values (forbidden)",
+			op:          operation.Update,
+			value:       CustomStruct{Field1: "test2", Field2: 100},
+			oldValue:    CustomStruct{Field1: "test1", Field2: 42},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+		{
+			name:        "NoSet - zero to non-zero (forbidden)",
+			op:          operation.Update,
+			value:       CustomStruct{Field1: "test", Field2: 42},
+			oldValue:    CustomStruct{},
+			constraints: []UpdateConstraint{NoSet},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoUnset - non-zero to zero (forbidden)",
+			op:          operation.Update,
+			value:       CustomStruct{},
+			oldValue:    CustomStruct{Field1: "test", Field2: 42},
+			constraints: []UpdateConstraint{NoUnset},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "Multiple constraints",
+			op:          operation.Update,
+			value:       CustomStruct{Field1: "test", Field2: 42},
+			oldValue:    CustomStruct{},
+			constraints: []UpdateConstraint{NoSet, NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be set once created"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := UpdateValueByReflect(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, tt.constraints...)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("UpdateValueByReflect() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
+			}
+			for i, msg := range tt.wantMsgs {
+				if i >= len(errs) {
+					t.Errorf("Expected error message %q not found", msg)
+					continue
+				}
+				if errs[i].Detail != msg {
+					t.Errorf("UpdateValueByReflect() error message = %q, want %q", errs[i].Detail, msg)
+				}
+			}
+		})
+	}
+}
+
+func TestUpdateStruct(t *testing.T) {
+	type TestStruct struct {
+		Field1 string
+		Field2 int
+	}
+
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       TestStruct
+		oldValue    TestStruct
+		constraints []UpdateConstraint
+		wantErrs    int
+		wantMsgs    []string
+	}{
+		{
+			name:        "create operation - no validation",
+			op:          operation.Create,
+			value:       TestStruct{Field1: "test", Field2: 42},
+			oldValue:    TestStruct{},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - different values (forbidden)",
+			op:          operation.Update,
+			value:       TestStruct{Field1: "test2", Field2: 100},
+			oldValue:    TestStruct{Field1: "test1", Field2: 42},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+		{
+			name:        "NoModify - zero value to non-zero (forbidden)",
+			op:          operation.Update,
+			value:       TestStruct{Field1: "test", Field2: 42},
+			oldValue:    TestStruct{},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+		{
+			name:        "NoSet and NoUnset with modification - only NoModify triggers",
+			op:          operation.Update,
+			value:       TestStruct{Field1: "test2", Field2: 100},
+			oldValue:    TestStruct{Field1: "test1", Field2: 42},
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := UpdateStruct(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, tt.constraints...)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("UpdateStruct() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
+			}
+			for i, msg := range tt.wantMsgs {
+				if i >= len(errs) {
+					t.Errorf("Expected error message %q not found", msg)
+					continue
+				}
+				if errs[i].Detail != msg {
+					t.Errorf("UpdateStruct() error message = %q, want %q", errs[i].Detail, msg)
+				}
+			}
+		})
+	}
+}
+
+func TestValSliceUpdate(t *testing.T) {
+	type keyed struct {
+		Name  string
+		Value string
+	}
+	keyMatch := func(a, b *keyed) bool { return a.Name == b.Name }
+
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       []string
+		oldValue    []string
+		match       MatchFunc[*string]
+		constraints []UpdateConstraint
+		wantDetails []string
+	}{
+		{
+			name:        "create operation - no validation",
+			op:          operation.Create,
+			value:       []string{"a"},
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoAddItem, NoRemoveItem},
+			match:       DirectEqual[string],
+		},
+		{
+			name:        "NoSet nil to non-empty (forbidden)",
+			op:          operation.Update,
+			value:       []string{"a"},
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet},
+			wantDetails: []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoSet empty to non-empty (forbidden)",
+			op:          operation.Update,
+			value:       []string{"a"},
+			oldValue:    []string{},
+			constraints: []UpdateConstraint{NoSet},
+			wantDetails: []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoSet non-empty to non-empty (allowed)",
+			op:          operation.Update,
+			value:       []string{"a", "b"},
+			oldValue:    []string{"a"},
+			constraints: []UpdateConstraint{NoSet},
+		},
+		{
+			name:        "NoUnset non-empty to nil (forbidden)",
+			op:          operation.Update,
+			value:       nil,
+			oldValue:    []string{"a"},
+			constraints: []UpdateConstraint{NoUnset},
+			wantDetails: []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "NoUnset non-empty to empty (forbidden)",
+			op:          operation.Update,
+			value:       []string{},
+			oldValue:    []string{"a"},
+			constraints: []UpdateConstraint{NoUnset},
+			wantDetails: []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "NoAddItem direct-equal item added",
+			op:          operation.Update,
+			value:       []string{"a", "b", "c"},
+			oldValue:    []string{"a", "c"},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoAddItem},
+			wantDetails: []string{"item may not be added"},
+		},
+		{
+			name:        "NoAddItem direct-equal reorder allowed",
+			op:          operation.Update,
+			value:       []string{"c", "a", "b"},
+			oldValue:    []string{"a", "b", "c"},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoAddItem},
+		},
+		{
+			name:        "NoRemoveItem direct-equal item removed",
+			op:          operation.Update,
+			value:       []string{"a"},
+			oldValue:    []string{"a", "b"},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoRemoveItem},
+			wantDetails: []string{"item may not be removed"},
+		},
+		{
+			name:        "NoAddItem + NoRemoveItem frozen shape (allowed)",
+			op:          operation.Update,
+			value:       []string{"a", "b"},
+			oldValue:    []string{"b", "a"},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoAddItem, NoRemoveItem},
+		},
+		{
+			name:        "NoAddItem + NoRemoveItem one added one removed",
+			op:          operation.Update,
+			value:       []string{"a", "c"},
+			oldValue:    []string{"a", "b"},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoAddItem, NoRemoveItem},
+			wantDetails: []string{
+				"item may not be added",
+				"item may not be removed",
+			},
+		},
+		{
+			name:        "NoAddItem + NoRemoveItem combined with NoUnset",
+			op:          operation.Update,
+			value:       nil,
+			oldValue:    []string{"a"},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoUnset, NoAddItem, NoRemoveItem},
+			wantDetails: []string{
+				"field cannot be cleared once set",
+				"item may not be removed",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := ValSliceUpdate(context.TODO(), op, field.NewPath("test"), tt.value, tt.oldValue, tt.match, tt.constraints...)
+			if len(errs) != len(tt.wantDetails) {
+				t.Fatalf("ValSliceUpdate() returned %d errors, want %d: %v", len(errs), len(tt.wantDetails), errs)
+			}
+			for i, want := range tt.wantDetails {
+				if errs[i].Detail != want {
+					t.Errorf("ValSliceUpdate() error[%d] = %q, want %q", i, errs[i].Detail, want)
+				}
+				if errs[i].Origin != "update" {
+					t.Errorf("ValSliceUpdate() error[%d] origin = %q, want %q", i, errs[i].Origin, "update")
+				}
+			}
+		})
+	}
+
+	// Keyed-match case: matching by the Name field only. Modifying the Value
+	// of a keyed item should not trigger either NoAddItem or NoRemoveItem
+	// (that check belongs to eachVal + NoModify).
+	t.Run("NoAddItem+NoRemoveItem keyed match allows item modification", func(t *testing.T) {
+		op := operation.Operation{Type: operation.Update}
+		newList := []keyed{{Name: "alpha", Value: "v2"}, {Name: "beta", Value: "v1"}}
+		oldList := []keyed{{Name: "alpha", Value: "v1"}, {Name: "beta", Value: "v1"}}
+		errs := ValSliceUpdate(context.TODO(), op, field.NewPath("test"), newList, oldList, keyMatch, NoAddItem, NoRemoveItem)
+		if len(errs) != 0 {
+			t.Errorf("expected no errors for keyed-match item modification, got %v", errs)
+		}
+	})
+
+	t.Run("NoAddItem+NoRemoveItem keyed match reports add and remove by key", func(t *testing.T) {
+		op := operation.Operation{Type: operation.Update}
+		newList := []keyed{{Name: "alpha"}, {Name: "gamma"}}
+		oldList := []keyed{{Name: "alpha"}, {Name: "beta"}}
+		errs := ValSliceUpdate(context.TODO(), op, field.NewPath("test"), newList, oldList, keyMatch, NoAddItem, NoRemoveItem)
+		if len(errs) != 2 {
+			t.Fatalf("expected 2 errors, got %d: %v", len(errs), errs)
+		}
+	})
+
+	t.Run("NoAddItem without match returns internal error", func(t *testing.T) {
+		op := operation.Operation{Type: operation.Update}
+		errs := ValSliceUpdate[string](context.TODO(), op, field.NewPath("test"), []string{"a"}, nil, nil, NoAddItem)
+		if len(errs) != 1 || errs[0].Type != field.ErrorTypeInternal {
+			t.Errorf("expected single InternalError, got %v", errs)
+		}
+	})
+}
+
+func TestUpdateMap(t *testing.T) {
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       map[string]string
+		oldValue    map[string]string
+		constraints []UpdateConstraint
+		wantDetails []string
+	}{
+		{
+			name:        "create operation - no validation",
+			op:          operation.Create,
+			value:       map[string]string{"a": "1"},
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoAddItem, NoRemoveItem},
+		},
+		{
+			name:        "NoSet nil to non-empty (forbidden)",
+			op:          operation.Update,
+			value:       map[string]string{"a": "1"},
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet},
+			wantDetails: []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoUnset non-empty to empty (forbidden)",
+			op:          operation.Update,
+			value:       map[string]string{},
+			oldValue:    map[string]string{"a": "1"},
+			constraints: []UpdateConstraint{NoUnset},
+			wantDetails: []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "NoAddItem key added",
+			op:          operation.Update,
+			value:       map[string]string{"a": "1", "b": "2"},
+			oldValue:    map[string]string{"a": "1"},
+			constraints: []UpdateConstraint{NoAddItem},
+			wantDetails: []string{"item may not be added"},
+		},
+		{
+			name:        "NoAddItem value-only change allowed",
+			op:          operation.Update,
+			value:       map[string]string{"a": "2"},
+			oldValue:    map[string]string{"a": "1"},
+			constraints: []UpdateConstraint{NoAddItem},
+		},
+		{
+			name:        "NoRemoveItem key removed",
+			op:          operation.Update,
+			value:       map[string]string{"a": "1"},
+			oldValue:    map[string]string{"a": "1", "b": "2"},
+			constraints: []UpdateConstraint{NoRemoveItem},
+			wantDetails: []string{"item may not be removed"},
+		},
+		{
+			name:        "NoAddItem + NoRemoveItem stable keys allowed",
+			op:          operation.Update,
+			value:       map[string]string{"a": "1", "b": "22"},
+			oldValue:    map[string]string{"a": "11", "b": "2"},
+			constraints: []UpdateConstraint{NoAddItem, NoRemoveItem},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := UpdateMap(context.TODO(), op, field.NewPath("test"), tt.value, tt.oldValue, tt.constraints...)
+			if len(errs) != len(tt.wantDetails) {
+				t.Fatalf("UpdateMap() returned %d errors, want %d: %v", len(errs), len(tt.wantDetails), errs)
+			}
+			for i, want := range tt.wantDetails {
+				if errs[i].Detail != want {
+					t.Errorf("UpdateMap() error[%d] = %q, want %q", i, errs[i].Detail, want)
+				}
+				if errs[i].Origin != "update" {
+					t.Errorf("UpdateMap() error[%d] origin = %q, want %q", i, errs[i].Origin, "update")
+				}
+			}
+		})
+	}
+}
+
+func TestPtrSliceUpdate(t *testing.T) {
+	type keyed struct {
+		Name  string
+		Value string
+	}
+	keyMatch := func(a, b *keyed) bool { return a.Name == b.Name }
+
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       []*string
+		oldValue    []*string
+		match       MatchFunc[*string]
+		constraints []UpdateConstraint
+		wantDetails []string
+	}{
+		{
+			name:        "create operation - no validation",
+			op:          operation.Create,
+			value:       []*string{new("a")},
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoAddItem, NoRemoveItem},
+			match:       DirectEqual[string],
+		},
+		{
+			name:        "NoSet nil to non-empty (forbidden)",
+			op:          operation.Update,
+			value:       []*string{new("a")},
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet},
+			wantDetails: []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoAddItem direct-equal item added",
+			op:          operation.Update,
+			value:       []*string{new("a"), new("b"), new("c")},
+			oldValue:    []*string{new("a"), new("c")},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoAddItem},
+			wantDetails: []string{"item may not be added"},
+		},
+		{
+			name:        "NoRemoveItem direct-equal item removed",
+			op:          operation.Update,
+			value:       []*string{new("a")},
+			oldValue:    []*string{new("a"), new("b")},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoRemoveItem},
+			wantDetails: []string{"item may not be removed"},
+		},
+		{
+			name:        "nil element in value (ignored)",
+			op:          operation.Update,
+			value:       []*string{new("a"), nil, new("c")},
+			oldValue:    []*string{new("a"), new("c")},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoAddItem},
+			// Expect 0 errors because nil is ignored and non-nil elements match old values.
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := PtrSliceUpdate(context.TODO(), op, field.NewPath("test"), tt.value, tt.oldValue, tt.match, tt.constraints...)
+
+			if len(errs) != len(tt.wantDetails) {
+				t.Fatalf("PtrSliceUpdate() returned %d errors, want %d: %v", len(errs), len(tt.wantDetails), errs)
+			}
+			for i, want := range tt.wantDetails {
+				if errs[i].Detail != want {
+					t.Errorf("PtrSliceUpdate() error[%d] = %q, want %q", i, errs[i].Detail, want)
+				}
+				if errs[i].Origin != "update" {
+					t.Errorf("PtrSliceUpdate() error[%d] origin = %q, want %q", i, errs[i].Origin, "update")
+				}
+			}
+		})
+	}
+
+	t.Run("NoAddItem+NoRemoveItem keyed match allows item modification", func(t *testing.T) {
+		op := operation.Operation{Type: operation.Update}
+		newList := []*keyed{{Name: "alpha", Value: "v2"}, {Name: "beta", Value: "v1"}}
+		oldList := []*keyed{{Name: "alpha", Value: "v1"}, {Name: "beta", Value: "v1"}}
+		errs := PtrSliceUpdate(context.TODO(), op, field.NewPath("test"), newList, oldList, keyMatch, NoAddItem, NoRemoveItem)
+		if len(errs) != 0 {
+			t.Errorf("expected no errors for keyed-match item modification, got %v", errs)
+		}
+	})
+
+	t.Run("NoAddItem without match returns internal error", func(t *testing.T) {
+		op := operation.Operation{Type: operation.Update}
+		errs := PtrSliceUpdate[string](context.TODO(), op, field.NewPath("test"), []*string{new("a")}, nil, nil, NoAddItem)
+		if len(errs) != 1 || errs[0].Type != field.ErrorTypeInternal {
+			t.Errorf("expected single InternalError, got %v", errs)
+		}
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/util_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/util_test.go
new file mode 100644
index 0000000000..28bd577c8d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/util_test.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"bytes"
+	"strconv"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// fmtErrs is a helper for nicer test output.  It will use multiple lines if
+// errs has more than 1 item.
+func fmtErrs(errs field.ErrorList) string {
+	if len(errs) == 0 {
+		return "<no errors>"
+	}
+	if len(errs) == 1 {
+		return strconv.Quote(errs[0].Error())
+	}
+	buf := bytes.Buffer{}
+	for _, e := range errs {
+		buf.WriteString("\n")
+		buf.WriteString(strconv.Quote(e.Error()))
+	}
+	return buf.String()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/zeroorone.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/zeroorone.go
new file mode 100644
index 0000000000..6a5df4ca34
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/zeroorone.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// ZeroOrOneOfUnion verifies that at most one member of a union is specified.
+//
+// ZeroOrOneOfMembership must define all the members of the union.
+//
+// For example:
+//
+//	var ZeroOrOneOfMembershipForABC = validate.NewUnionMembership(
+//		validate.NewUnionMember("a"),
+//		validate.NewUnionMember("b"),
+//		validate.NewUnionMember("c"),
+//	)
+//	func ValidateABC(ctx context.Context, op operation.Operation, fldPath *field.Path, in *ABC) (errs field.ErrorList) {
+//		errs = append(errs, validate.ZeroOrOneOfUnion(ctx, op, fldPath, in, oldIn,
+//			ZeroOrOneOfMembershipForABC,
+//			func(in *ABC) bool { return in.A != nil },
+//			func(in *ABC) bool { return in.B != ""},
+//			func(in *ABC) bool { return in.C != 0 },
+//		)...)
+//		return errs
+//	}
+func ZeroOrOneOfUnion[T any](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj T, union *UnionMembership, isSetFns ...ExtractorFn[T, bool]) field.ErrorList {
+	options := UnionValidationOptions{
+		ErrorForEmpty: nil,
+		ErrorForMultiple: func(fldPath *field.Path, specifiedFields []string, allFields []string) *field.Error {
+			return field.Invalid(fldPath, fmt.Sprintf("{%s}", strings.Join(specifiedFields, ", ")),
+				fmt.Sprintf("must specify at most one of: %s", strings.Join(allFields, ", "))).WithOrigin("zeroOrOneOf")
+		},
+	}
+
+	errs := unionValidate(op, fldPath, obj, oldObj, union, options, isSetFns...)
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/zeroorone_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/zeroorone_test.go
new file mode 100644
index 0000000000..686a1c11a6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validate/zeroorone_test.go
@@ -0,0 +1,153 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestZeroOrOneOfUnion(t *testing.T) {
+	testCases := []struct {
+		name        string
+		fields      []string
+		fieldValues []bool
+		expected    field.ErrorList
+	}{
+		{
+			name:        "one member set",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{false, false, false, true},
+			expected:    nil,
+		},
+		{
+			name:        "two members set",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{false, true, false, true},
+			expected:    field.ErrorList{field.Invalid(nil, "{b, d}", "must specify at most one of: `a`, `b`, `c`, `d`").WithOrigin("zeroOrOneOf")},
+		},
+		{
+			name:        "all members set",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{true, true, true, true},
+			expected:    field.ErrorList{field.Invalid(nil, "{a, b, c, d}", "must specify at most one of: `a`, `b`, `c`, `d`").WithOrigin("zeroOrOneOf")},
+		},
+		{
+			name:        "no member set - allowed for ZeroOrOneOf",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{false, false, false, false},
+			expected:    nil, // This is the key difference from Union
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			members := []UnionMember{}
+			for _, f := range tc.fields {
+				members = append(members, NewUnionMember(f))
+			}
+
+			// Create mock extractors that return predefined values instead of
+			// actually extracting from the object.
+			extractors := make([]ExtractorFn[*testMember, bool], len(tc.fieldValues))
+			for i, val := range tc.fieldValues {
+				extractors[i] = func(_ *testMember) bool { return val }
+			}
+
+			got := ZeroOrOneOfUnion(context.Background(), operation.Operation{}, nil, &testMember{}, nil,
+				NewUnionMembership(members...), extractors...)
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
+
+func TestZeroOrOneOfUnionRatcheting(t *testing.T) {
+	testCases := []struct {
+		name      string
+		oldStruct *testStruct
+		newStruct *testStruct
+		expected  field.ErrorList
+	}{
+		{
+			name:      "both nil",
+			oldStruct: nil,
+			newStruct: nil,
+		},
+		{
+			name:      "both empty struct - allowed for ZeroOrOneOf",
+			oldStruct: &testStruct{},
+			newStruct: &testStruct{},
+		},
+		{
+			name: "both have more than one member",
+			oldStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+			newStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+		},
+		{
+			name: "change to invalid",
+			oldStruct: &testStruct{
+				M1: &m1{},
+			},
+			newStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(nil, "{m1, m2}", "must specify at most one of: `m1`, `m2`, `m3`, `m4`").WithOrigin("zeroOrOneOf"),
+			},
+		},
+		{
+			name:      "change from empty to one member - allowed",
+			oldStruct: &testStruct{},
+			newStruct: &testStruct{
+				M1: &m1{},
+			},
+			expected: nil,
+		},
+		{
+			name: "change from one member to empty - allowed",
+			oldStruct: &testStruct{
+				M1: &m1{},
+			},
+			newStruct: &testStruct{},
+			expected:  nil,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			members := []UnionMember{NewUnionMember("m1"), NewUnionMember("m2"), NewUnionMember("m3"), NewUnionMember("m4")}
+			got := ZeroOrOneOfUnion(context.Background(), operation.Operation{Type: operation.Update}, nil, tc.newStruct, tc.oldStruct,
+				NewUnionMembership(members...), extractors...)
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/OWNERS b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/OWNERS
new file mode 100644
index 0000000000..4023732476
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/OWNERS
@@ -0,0 +1,11 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+# Disable inheritance as this is an api owners file
+options:
+  no_parent_owners: true
+approvers:
+  - api-approvers
+reviewers:
+  - api-reviewers
+labels:
+  - kind/api-change
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/doc.go
new file mode 100644
index 0000000000..9e305b0b18
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/doc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package validation contains generic api type validation functions.
+package validation
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/generic.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/generic.go
new file mode 100644
index 0000000000..35ea723a0f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/generic.go
@@ -0,0 +1,94 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// IsNegativeErrorMsg is a error message for value must be greater than or equal to 0.
+const IsNegativeErrorMsg string = `must be greater than or equal to 0`
+
+// ValidateNameFunc validates that the provided name is valid for a given resource type.
+// Not all resources have the same validation rules for names. Prefix is true
+// if the name will have a value appended to it.  If the name is not valid,
+// this returns a list of descriptions of individual characteristics of the
+// value that were not valid.  Otherwise this returns an empty list or nil.
+type ValidateNameFunc func(name string, prefix bool) []string
+
+// ValidateNameFuncWithErrors validates that the provided name is valid for a
+// given resource type.
+//
+// This is similar to ValidateNameFunc, except that it produces an ErrorList.
+type ValidateNameFuncWithErrors func(fldPath *field.Path, name string) field.ErrorList
+
+// NameIsDNSSubdomain is a ValidateNameFunc for names that must be a DNS subdomain.
+func NameIsDNSSubdomain(name string, prefix bool) []string {
+	if prefix {
+		name = maskTrailingDash(name)
+	}
+	return validation.IsDNS1123Subdomain(name)
+}
+
+// NameIsDNSLabel is a ValidateNameFunc for names that must be a DNS 1123 label.
+func NameIsDNSLabel(name string, prefix bool) []string {
+	if prefix {
+		name = maskTrailingDash(name)
+	}
+	return validation.IsDNS1123Label(name)
+}
+
+// NameIsDNS1035Label is a ValidateNameFunc for names that must be a DNS 952 label.
+func NameIsDNS1035Label(name string, prefix bool) []string {
+	if prefix {
+		name = maskTrailingDash(name)
+	}
+	return validation.IsDNS1035Label(name)
+}
+
+// ValidateNamespaceName can be used to check whether the given namespace name is valid.
+// Prefix indicates this name will be used as part of generation, in which case
+// trailing dashes are allowed.
+var ValidateNamespaceName = NameIsDNSLabel
+
+// ValidateServiceAccountName can be used to check whether the given service account name is valid.
+// Prefix indicates this name will be used as part of generation, in which case
+// trailing dashes are allowed.
+var ValidateServiceAccountName = NameIsDNSSubdomain
+
+// maskTrailingDash replaces the final character of a string with a subdomain safe
+// value if it is a dash and if the length of this string is greater than 1. Note that
+// this is used when a value could be appended to the string, see ValidateNameFunc
+// for more info.
+func maskTrailingDash(name string) string {
+	if len(name) > 1 && strings.HasSuffix(name, "-") {
+		return name[:len(name)-2] + "a"
+	}
+	return name
+}
+
+// ValidateNonnegativeField validates that given value is not negative.
+func ValidateNonnegativeField(value int64, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	if value < 0 {
+		allErrs = append(allErrs, field.Invalid(fldPath, value, IsNegativeErrorMsg).WithOrigin("minimum"))
+	}
+	return allErrs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/generic_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/generic_test.go
new file mode 100644
index 0000000000..a753cc2b22
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/generic_test.go
@@ -0,0 +1,65 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import "testing"
+
+func TestMaskTrailingDash(t *testing.T) {
+	testCases := []struct {
+		beforeMasking        string
+		expectedAfterMasking string
+		description          string
+	}{
+		{
+			beforeMasking:        "",
+			expectedAfterMasking: "",
+			description:          "empty string",
+		},
+		{
+			beforeMasking:        "-",
+			expectedAfterMasking: "-",
+			description:          "only a single dash",
+		},
+		{
+			beforeMasking:        "-foo",
+			expectedAfterMasking: "-foo",
+			description:          "has leading dash",
+		},
+		{
+			beforeMasking:        "-foo-",
+			expectedAfterMasking: "-foa",
+			description:          "has both leading and trailing dashes",
+		},
+		{
+			beforeMasking:        "b-",
+			expectedAfterMasking: "a",
+			description:          "has trailing dash",
+		},
+		{
+			beforeMasking:        "ab",
+			expectedAfterMasking: "ab",
+			description:          "has neither leading nor trailing dashes",
+		},
+	}
+
+	for _, tc := range testCases {
+		afterMasking := maskTrailingDash(tc.beforeMasking)
+		if afterMasking != tc.expectedAfterMasking {
+			t.Errorf("error in test case: %s. expected: %s, actual: %s", tc.description, tc.expectedAfterMasking, afterMasking)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/objectmeta.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/objectmeta.go
new file mode 100644
index 0000000000..ff86973fbd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/objectmeta.go
@@ -0,0 +1,369 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1validation "k8s.io/apimachinery/pkg/apis/meta/v1/validation"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// FieldImmutableErrorMsg is a error message for field is immutable.
+const FieldImmutableErrorMsg string = `field is immutable`
+
+const TotalAnnotationSizeLimitB int = 256 * (1 << 10) // 256 kB
+
+// BannedOwners is a black list of object that are not allowed to be owners.
+var BannedOwners = map[schema.GroupVersionKind]struct{}{
+	{Group: "", Version: "v1", Kind: "Event"}: {},
+}
+
+// ValidateAnnotations validates that a set of annotations are correctly defined.
+func ValidateAnnotations(annotations map[string]string, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	for k := range annotations {
+		// The rule is QualifiedName except that case doesn't matter, so convert to lowercase before checking.
+		for _, msg := range validation.IsQualifiedName(strings.ToLower(k)) {
+			allErrs = append(allErrs, field.Invalid(fldPath, k, msg).WithOrigin("format=k8s-label-key"))
+		}
+	}
+	if err := ValidateAnnotationsSize(annotations); err != nil {
+		allErrs = append(allErrs, field.TooLong(fldPath, "" /*unused*/, TotalAnnotationSizeLimitB))
+	}
+	return allErrs
+}
+
+func ValidateAnnotationsSize(annotations map[string]string) error {
+	var totalSize int64
+	for k, v := range annotations {
+		totalSize += (int64)(len(k)) + (int64)(len(v))
+	}
+	if totalSize > (int64)(TotalAnnotationSizeLimitB) {
+		return fmt.Errorf("annotations size %d is larger than limit %d", totalSize, TotalAnnotationSizeLimitB)
+	}
+	return nil
+}
+
+func validateOwnerReference(ownerReference metav1.OwnerReference, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	gv, err := schema.ParseGroupVersion(ownerReference.APIVersion)
+	// gvk.Group is empty for the legacy group.
+	if len(ownerReference.APIVersion) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("apiVersion"), "must not be empty").MarkCoveredByDeclarative())
+	} else if err != nil || len(gv.Version) == 0 {
+		allErrs = append(allErrs, field.Invalid(fldPath.Child("apiVersion"), ownerReference.APIVersion, "must be <group>/<version> or <version>"))
+	}
+	if len(ownerReference.Kind) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("kind"), "must not be empty").MarkCoveredByDeclarative())
+	}
+	if len(ownerReference.Name) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("name"), "must not be empty").MarkCoveredByDeclarative())
+	}
+	if len(ownerReference.UID) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("uid"), "must not be empty").MarkCoveredByDeclarative())
+	}
+	gvk := gv.WithKind(ownerReference.Kind)
+	if _, ok := BannedOwners[gvk]; ok {
+		allErrs = append(allErrs, field.Invalid(fldPath, ownerReference, fmt.Sprintf("%s is disallowed from being an owner", gvk)))
+	}
+	return allErrs
+}
+
+// ValidateOwnerReferences validates that a set of owner references are correctly defined.
+func ValidateOwnerReferences(ownerReferences []metav1.OwnerReference, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	firstControllerName := ""
+	for idx, ref := range ownerReferences {
+		allErrs = append(allErrs, validateOwnerReference(ref, fldPath.Index(idx))...)
+		if ref.Controller != nil && *ref.Controller {
+			curControllerName := ref.Kind + "/" + ref.Name
+			if firstControllerName != "" {
+				allErrs = append(allErrs, field.Invalid(fldPath, ownerReferences,
+					fmt.Sprintf("Only one reference can have Controller set to true. Found \"true\" in references for %v and %v", firstControllerName, curControllerName)))
+			} else {
+				firstControllerName = curControllerName
+			}
+		}
+	}
+	return allErrs
+}
+
+// ValidateFinalizerName validates finalizer names.
+func ValidateFinalizerName(stringValue string, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	for _, msg := range validation.IsQualifiedName(stringValue) {
+		allErrs = append(allErrs, field.Invalid(fldPath, stringValue, msg))
+	}
+
+	return allErrs
+}
+
+// ValidateNoNewFinalizers validates the new finalizers has no new finalizers compare to old finalizers.
+func ValidateNoNewFinalizers(newFinalizers []string, oldFinalizers []string, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	extra := sets.NewString(newFinalizers...).Difference(sets.NewString(oldFinalizers...))
+	if len(extra) != 0 {
+		allErrs = append(allErrs, field.Forbidden(fldPath, fmt.Sprintf("no new finalizers can be added if the object is being deleted, found new finalizers %#v", extra.List())))
+	}
+	return allErrs
+}
+
+// ValidateImmutableField validates the new value and the old value are deeply equal.
+func ValidateImmutableField(newVal, oldVal interface{}, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	if !apiequality.Semantic.DeepEqual(oldVal, newVal) {
+		allErrs = append(allErrs, field.Invalid(fldPath, newVal, FieldImmutableErrorMsg))
+	}
+	return allErrs
+}
+
+// ValidateObjectMetaDeclaratively validates an ObjectMeta instance declaratively and deduplicates handwritten errors.
+// betaEnabled controls whether declarative validation rules at the Beta stability level are enforced.
+// NOTE: This method should be used in the types for which declarative validation is not enabled yet or cannot be enabled. The types
+// for which declarative validation is enabled and valdiation code is generated must use ValidateObjectMeta and ValidateObjectMetaUpdate.
+func ValidateObjectMetaDeclaratively(ctx context.Context, op operation.Type, obj, oldObj *metav1.ObjectMeta, requiresNamespace bool, nameFn ValidateNameFunc, fldPath *field.Path, betaEnabled bool) field.ErrorList {
+	var errs field.ErrorList
+	switch op {
+	case operation.Create:
+		errs = ValidateObjectMeta(obj, requiresNamespace, nameFn, fldPath)
+	case operation.Update:
+		errs = ValidateObjectMetaUpdate(obj, oldObj, fldPath)
+	}
+	dvErrs := v1validation.Validate_ObjectMeta(ctx, operation.Operation{Type: op}, fldPath, obj, oldObj)
+	enforcedDVErrs := validate.FilterEnforcedDeclarativeErrors(ctx, dvErrs, betaEnabled)
+	errs = errs.MarkFromImperative()
+	errs = validate.FilterCoveredHandwrittenErrors(ctx, errs, enforcedDVErrs, betaEnabled)
+	return append(errs, enforcedDVErrs...)
+}
+
+// ValidateObjectMeta validates an object's metadata on creation. It expects that name generation has already
+// been performed.
+func ValidateObjectMeta(objMeta *metav1.ObjectMeta, requiresNamespace bool, nameFn ValidateNameFunc, fldPath *field.Path) field.ErrorList {
+	metadata, err := meta.Accessor(objMeta)
+	if err != nil {
+		var allErrs field.ErrorList
+		allErrs = append(allErrs, field.Invalid(fldPath, objMeta, err.Error()))
+		return allErrs
+	}
+	return ValidateObjectMetaAccessor(metadata, requiresNamespace, nameFn, fldPath)
+}
+
+// objectMetaValidationOptions defines behavioral modifications for validating
+// an ObjectMeta.
+type objectMetaValidationOptions struct {
+	/* nothing here yet */
+}
+
+// ObjectMetaValidationOption specifies a behavioral modifier for
+// ValidateObjectMetaWithOpts and ValidateObjectMetaAccessorWithOpts.
+type ObjectMetaValidationOption func(opts *objectMetaValidationOptions)
+
+// ValidateObjectMetaWithOpts validates an object's metadata on creation. It
+// expects that name generation has already been performed, so name validation
+// is always executed.
+//
+// This is similar to ValidateObjectMeta, but uses options to buy future-safety
+// and uses different signature for the name validation function.  It also does
+// not directly validate the generateName field, because name generation
+// should have already been performed and it is the result of that generastion
+// that must conform to the nameFn.
+func ValidateObjectMetaWithOpts(objMeta *metav1.ObjectMeta, isNamespaced bool, nameFn ValidateNameFuncWithErrors, fldPath *field.Path, options ...ObjectMetaValidationOption) field.ErrorList {
+	metadata, err := meta.Accessor(objMeta)
+	if err != nil {
+		var allErrs field.ErrorList
+		allErrs = append(allErrs, field.InternalError(fldPath, err))
+		return allErrs
+	}
+	return ValidateObjectMetaAccessorWithOpts(metadata, isNamespaced, nameFn, fldPath, options...)
+}
+
+// ValidateObjectMetaAccessor validates an object's metadata on creation. It expects that name generation has already
+// been performed.
+func ValidateObjectMetaAccessor(meta metav1.Object, requiresNamespace bool, nameFn ValidateNameFunc, fldPath *field.Path) field.ErrorList {
+	var allErrs field.ErrorList
+
+	if len(meta.GetGenerateName()) != 0 {
+		for _, msg := range nameFn(meta.GetGenerateName(), true) {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("generateName"), meta.GetGenerateName(), msg))
+		}
+	}
+	// If the generated name validates, but the calculated value does not, it's a problem with generation, and we
+	// report it here. This may confuse users, but indicates a programming bug and still must be validated.
+	// If there are multiple fields out of which one is required then add an or as a separator
+	if len(meta.GetName()) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("name"), "name or generateName is required"))
+	} else {
+		for _, msg := range nameFn(meta.GetName(), false) {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("name"), meta.GetName(), msg))
+		}
+	}
+
+	return append(allErrs, validateObjectMetaAccessorWithOptsCommon(meta, requiresNamespace, fldPath, nil)...)
+}
+
+// ValidateObjectMetaAccessorWithOpts validates an object's metadata on
+// creation. It expects that name generation has already been performed, so
+// name validation is always executed.
+//
+// This is similar to ValidateObjectMetaAccessor, but uses options to buy
+// future-safety and uses different signature for the name validation function.
+// It also does not directly validate the generateName field, because name
+// generation should have already been performed and it is the result of that
+// generastion that must conform to the nameFn.
+func ValidateObjectMetaAccessorWithOpts(meta metav1.Object, isNamespaced bool, nameFn ValidateNameFuncWithErrors, fldPath *field.Path, options ...ObjectMetaValidationOption) field.ErrorList {
+	opts := objectMetaValidationOptions{}
+	for _, opt := range options {
+		opt(&opts)
+	}
+
+	var allErrs field.ErrorList
+
+	// generateName is not directly validated here. Types can have
+	// different rules for name generation, and the nameFn is for validating
+	// the post-generation data, not the input. In the past we assumed that
+	// name generation was always "append 5 random characters", but that's not
+	// NECESSARILY true. Also, the nameFn should always be considering the max
+	// length of the name, and it doesn't know enough about the name generation
+	// to do that. Also, given a bad generateName, the user will get errors
+	// for both the generateName and name fields. We will focus validation on
+	// the name field, which should give a better UX overall.
+	// TODO(thockin): should we do a max-length check here? e.g. 1K or 4K?
+
+	if len(meta.GetGenerateName()) != 0 && len(meta.GetName()) == 0 {
+		allErrs = append(allErrs,
+			field.InternalError(fldPath.Child("name"), fmt.Errorf("generateName was specified (%q), but no name was generated", meta.GetGenerateName())))
+	}
+	if len(meta.GetName()) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("name"), "name or generateName is required"))
+	} else {
+		allErrs = append(allErrs, nameFn(fldPath.Child("name"), meta.GetName())...)
+	}
+
+	return append(allErrs, validateObjectMetaAccessorWithOptsCommon(meta, isNamespaced, fldPath, &opts)...)
+}
+
+// validateObjectMetaAccessorWithOptsCommon is a shared function for validating
+// the parts of an ObjectMeta with are handled the same in both paths..
+func validateObjectMetaAccessorWithOptsCommon(meta metav1.Object, isNamespaced bool, fldPath *field.Path, _ *objectMetaValidationOptions) field.ErrorList {
+	var allErrs field.ErrorList
+
+	if isNamespaced {
+		if len(meta.GetNamespace()) == 0 {
+			allErrs = append(allErrs, field.Required(fldPath.Child("namespace"), ""))
+		} else {
+			for _, msg := range ValidateNamespaceName(meta.GetNamespace(), false) {
+				allErrs = append(allErrs, field.Invalid(fldPath.Child("namespace"), meta.GetNamespace(), msg))
+			}
+		}
+	} else {
+		if len(meta.GetNamespace()) != 0 {
+			// TODO(thockin): change to "may not be specified on this type" or something
+			allErrs = append(allErrs, field.Forbidden(fldPath.Child("namespace"), "not allowed on this type"))
+		}
+	}
+
+	allErrs = append(allErrs, ValidateNonnegativeField(meta.GetGeneration(), fldPath.Child("generation")).MarkCoveredByDeclarative()...)
+	allErrs = append(allErrs, v1validation.ValidateLabels(meta.GetLabels(), fldPath.Child("labels"))...)
+	allErrs = append(allErrs, ValidateAnnotations(meta.GetAnnotations(), fldPath.Child("annotations"))...)
+	allErrs = append(allErrs, ValidateOwnerReferences(meta.GetOwnerReferences(), fldPath.Child("ownerReferences"))...)
+	allErrs = append(allErrs, ValidateFinalizers(meta.GetFinalizers(), fldPath.Child("finalizers"))...)
+	allErrs = append(allErrs, v1validation.ValidateManagedFields(meta.GetManagedFields(), fldPath.Child("managedFields"), v1validation.CoveredByDeclarative)...)
+	return allErrs
+}
+
+// ValidateFinalizers tests if the finalizers name are valid, and if there are conflicting finalizers.
+func ValidateFinalizers(finalizers []string, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	hasFinalizerOrphanDependents := false
+	hasFinalizerDeleteDependents := false
+	for _, finalizer := range finalizers {
+		allErrs = append(allErrs, ValidateFinalizerName(finalizer, fldPath)...)
+		if finalizer == metav1.FinalizerOrphanDependents {
+			hasFinalizerOrphanDependents = true
+		}
+		if finalizer == metav1.FinalizerDeleteDependents {
+			hasFinalizerDeleteDependents = true
+		}
+	}
+	if hasFinalizerDeleteDependents && hasFinalizerOrphanDependents {
+		allErrs = append(allErrs, field.Invalid(fldPath, finalizers, fmt.Sprintf("finalizer %s and %s cannot be both set", metav1.FinalizerOrphanDependents, metav1.FinalizerDeleteDependents)))
+	}
+	return allErrs
+}
+
+// ValidateObjectMetaUpdate validates an object's metadata when updated.
+func ValidateObjectMetaUpdate(newMeta, oldMeta *metav1.ObjectMeta, fldPath *field.Path) field.ErrorList {
+	newMetadata, err := meta.Accessor(newMeta)
+	if err != nil {
+		allErrs := field.ErrorList{}
+		allErrs = append(allErrs, field.Invalid(fldPath, newMeta, err.Error()))
+		return allErrs
+	}
+	oldMetadata, err := meta.Accessor(oldMeta)
+	if err != nil {
+		allErrs := field.ErrorList{}
+		allErrs = append(allErrs, field.Invalid(fldPath, oldMeta, err.Error()))
+		return allErrs
+	}
+	return ValidateObjectMetaAccessorUpdate(newMetadata, oldMetadata, fldPath)
+}
+
+// ValidateObjectMetaAccessorUpdate validates an object's metadata when updated.
+func ValidateObjectMetaAccessorUpdate(newMeta, oldMeta metav1.Object, fldPath *field.Path) field.ErrorList {
+	var allErrs field.ErrorList
+
+	// Finalizers cannot be added if the object is already being deleted.
+	if oldMeta.GetDeletionTimestamp() != nil {
+		allErrs = append(allErrs, ValidateNoNewFinalizers(newMeta.GetFinalizers(), oldMeta.GetFinalizers(), fldPath.Child("finalizers"))...)
+	}
+
+	// Reject updates that don't specify a resource version
+	if len(newMeta.GetResourceVersion()) == 0 {
+		allErrs = append(allErrs, field.Invalid(fldPath.Child("resourceVersion"), newMeta.GetResourceVersion(), "must be specified for an update"))
+	}
+
+	// Generation shouldn't be decremented
+	allErrs = append(allErrs, ValidateNonnegativeField(newMeta.GetGeneration(), fldPath.Child("generation")).MarkCoveredByDeclarative()...)
+	if newMeta.GetGeneration() < oldMeta.GetGeneration() {
+		allErrs = append(allErrs, field.Invalid(fldPath.Child("generation"), newMeta.GetGeneration(), "must not be decremented"))
+	}
+
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetName(), oldMeta.GetName(), fldPath.Child("name"))...)
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetNamespace(), oldMeta.GetNamespace(), fldPath.Child("namespace"))...)
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetUID(), oldMeta.GetUID(), fldPath.Child("uid")).WithOrigin("immutable").MarkCoveredByDeclarative()...)
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetCreationTimestamp(), oldMeta.GetCreationTimestamp(), fldPath.Child("creationTimestamp")).WithOrigin("immutable").MarkCoveredByDeclarative()...)
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetDeletionTimestamp(), oldMeta.GetDeletionTimestamp(), fldPath.Child("deletionTimestamp")).WithOrigin("immutable").MarkCoveredByDeclarative()...)
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetDeletionGracePeriodSeconds(), oldMeta.GetDeletionGracePeriodSeconds(), fldPath.Child("deletionGracePeriodSeconds")).WithOrigin("immutable").MarkCoveredByDeclarative()...)
+
+	allErrs = append(allErrs, v1validation.ValidateLabels(newMeta.GetLabels(), fldPath.Child("labels"))...)
+	allErrs = append(allErrs, ValidateAnnotations(newMeta.GetAnnotations(), fldPath.Child("annotations"))...)
+	allErrs = append(allErrs, ValidateOwnerReferences(newMeta.GetOwnerReferences(), fldPath.Child("ownerReferences"))...)
+	allErrs = append(allErrs, v1validation.ValidateManagedFields(newMeta.GetManagedFields(), fldPath.Child("managedFields"), v1validation.CoveredByDeclarative)...)
+
+	return allErrs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/objectmeta_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/objectmeta_test.go
new file mode 100644
index 0000000000..ec329d1984
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/objectmeta_test.go
@@ -0,0 +1,999 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"context"
+	"fmt"
+	"math/rand"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+const (
+	maxLengthErrMsg = "must be no more than"
+	namePartErrMsg  = "name part must consist of"
+	nameErrMsg      = "a valid label key must consist of"
+)
+
+// Ensure custom name functions are allowed
+func TestValidateObjectMetaCustomName(t *testing.T) {
+	testCases := []struct {
+		name   string
+		input  metav1.ObjectMeta
+		nErrs  int
+		errStr string
+	}{{
+		name:  "valid name, empty generateName",
+		input: metav1.ObjectMeta{Name: "test", GenerateName: ""},
+	}, {
+		name:  "valid name and generateName",
+		input: metav1.ObjectMeta{Name: "test", GenerateName: "test"},
+	}, {
+		name:   "invalid name, empty generateName",
+		input:  metav1.ObjectMeta{Name: "invalid", GenerateName: ""},
+		nErrs:  1,
+		errStr: "wrong value",
+	}, {
+		name:   "invalid name, valid generateName",
+		input:  metav1.ObjectMeta{Name: "invalid", GenerateName: "test"},
+		nErrs:  1,
+		errStr: "wrong value",
+	}, {
+		name:   "invalid name, invalid generateName",
+		input:  metav1.ObjectMeta{Name: "invalid", GenerateName: "invalid"},
+		nErrs:  2,
+		errStr: "wrong value",
+	}}
+
+	fn := func(s string, prefix bool) []string {
+		// Note: this is called on both name and generateName
+		if s == "test" {
+			return nil
+		}
+		return []string{"wrong value"}
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := ValidateObjectMeta(&tc.input, false, fn, field.NewPath("field"))
+
+			if len(errs) == 0 {
+				if len(tc.errStr) != 0 {
+					t.Fatalf("expected 1 error, got none")
+				}
+			} else {
+				if len(tc.errStr) == 0 {
+					t.Fatalf("expected no errors, got: %v", errs)
+				}
+				if len(errs) != tc.nErrs {
+					t.Fatalf("expected %d errors, got %d: %q", tc.nErrs, len(errs), errs)
+				}
+				if !strings.Contains(errs[0].Error(), "wrong value") {
+					t.Errorf("unexpected error message: %v", errs[0].Error())
+				}
+			}
+		})
+	}
+}
+
+// Ensure custom name functions work
+func TestValidateObjectMetaWithOptsName(t *testing.T) {
+	testCases := []struct {
+		name   string
+		input  metav1.ObjectMeta
+		errStr string
+	}{{
+		name:  "valid name, empty generateName",
+		input: metav1.ObjectMeta{Name: "test", GenerateName: ""},
+	}, {
+		name:  "valid name and generateName",
+		input: metav1.ObjectMeta{Name: "test", GenerateName: "test"},
+	}, {
+		name:   "invalid name, empty generateName",
+		input:  metav1.ObjectMeta{Name: "invalid", GenerateName: ""},
+		errStr: "wrong value",
+	}, {
+		name:   "invalid name, valid generateName",
+		input:  metav1.ObjectMeta{Name: "invalid", GenerateName: "test"},
+		errStr: "wrong value",
+	}, {
+		name:   "invalid name, invalid generateName",
+		input:  metav1.ObjectMeta{Name: "invalid", GenerateName: "invalid"},
+		errStr: "wrong value",
+	}}
+
+	fn := func(fldPath *field.Path, s string) field.ErrorList {
+		if s == "test" {
+			return nil
+		}
+		return field.ErrorList{field.Invalid(fldPath, s, "wrong value")}
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := ValidateObjectMetaWithOpts(&tc.input, false, fn, field.NewPath("field"))
+
+			if len(errs) == 0 {
+				if len(tc.errStr) != 0 {
+					t.Fatalf("expected 1 error, got none")
+				}
+			} else {
+				if len(tc.errStr) == 0 {
+					t.Fatalf("expected no errors, got: %v", errs)
+				}
+				if len(errs) != 1 {
+					t.Fatalf("expected 1 error, got %d: %q", len(errs), errs)
+				}
+				if !strings.Contains(errs[0].Error(), "wrong value") {
+					t.Errorf("unexpected error message: %v", errs[0].Error())
+				}
+			}
+		})
+	}
+}
+
+// Ensure namespace names follow dns label format
+func TestValidateObjectMetaNamespaces(t *testing.T) {
+	errs := validateObjectMetaAccessorWithOptsCommon(
+		&metav1.ObjectMeta{Name: "test", Namespace: "foo.bar"},
+		true, field.NewPath("field"), nil)
+	if len(errs) != 1 {
+		t.Fatalf("unexpected errors: %v", errs)
+	}
+	if !strings.Contains(errs[0].Error(), `Invalid value: "foo.bar"`) {
+		t.Errorf("unexpected error message: %v", errs)
+	}
+	maxLength := 63
+	letters := []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789")
+	b := make([]rune, maxLength+1)
+	for i := range b {
+		b[i] = letters[rand.Intn(len(letters))]
+	}
+	errs = validateObjectMetaAccessorWithOptsCommon(
+		&metav1.ObjectMeta{Name: "test", Namespace: string(b)},
+		true, field.NewPath("field"), nil)
+	if len(errs) != 2 {
+		t.Fatalf("unexpected errors: %v", errs)
+	}
+	if !strings.Contains(errs[0].Error(), "Invalid value") || !strings.Contains(errs[1].Error(), "Invalid value") {
+		t.Errorf("unexpected error message: %v", errs)
+	}
+}
+
+func TestValidateObjectMetaOwnerReferences(t *testing.T) {
+	trueVar := true
+	falseVar := false
+	testCases := []struct {
+		description          string
+		ownerReferences      []metav1.OwnerReference
+		expectError          bool
+		expectedErrorMessage string
+	}{
+		{
+			description: "simple success - third party extension.",
+			ownerReferences: []metav1.OwnerReference{
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind",
+					Name:       "name",
+					UID:        "1",
+				},
+			},
+			expectError:          false,
+			expectedErrorMessage: "",
+		},
+		{
+			description: "simple failures - event shouldn't be set as an owner",
+			ownerReferences: []metav1.OwnerReference{
+				{
+					APIVersion: "v1",
+					Kind:       "Event",
+					Name:       "name",
+					UID:        "1",
+				},
+			},
+			expectError:          true,
+			expectedErrorMessage: "is disallowed from being an owner",
+		},
+		{
+			description: "simple failures - invalid apiVersion with too many slashes",
+			ownerReferences: []metav1.OwnerReference{
+				{
+					APIVersion: "a/b/c",
+					Kind:       "Pod",
+					Name:       "name",
+					UID:        "1",
+				},
+			},
+			expectError:          true,
+			expectedErrorMessage: "must be <group>/<version> or <version>",
+		},
+		{
+			description: "simple failures - invalid apiVersion with empty version",
+			ownerReferences: []metav1.OwnerReference{
+				{
+					APIVersion: "foo/",
+					Kind:       "Pod",
+					Name:       "name",
+					UID:        "1",
+				},
+			},
+			expectError:          true,
+			expectedErrorMessage: "must be <group>/<version> or <version>",
+		},
+		{
+			description: "simple success - apiVersion with no slashes (legacy core group)",
+			ownerReferences: []metav1.OwnerReference{
+				{
+					APIVersion: "v1",
+					Kind:       "Pod",
+					Name:       "name",
+					UID:        "1",
+				},
+			},
+			expectError:          false,
+			expectedErrorMessage: "",
+		},
+		{
+			description: "simple controller ref success - one reference with Controller set",
+			ownerReferences: []metav1.OwnerReference{
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind",
+					Name:       "name",
+					UID:        "1",
+					Controller: &falseVar,
+				},
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind",
+					Name:       "name",
+					UID:        "2",
+					Controller: &trueVar,
+				},
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind",
+					Name:       "name",
+					UID:        "3",
+					Controller: &falseVar,
+				},
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind",
+					Name:       "name",
+					UID:        "4",
+				},
+			},
+			expectError:          false,
+			expectedErrorMessage: "",
+		},
+		{
+			description: "simple controller ref failure - two references with Controller set",
+			ownerReferences: []metav1.OwnerReference{
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind1",
+					Name:       "name",
+					UID:        "1",
+					Controller: &falseVar,
+				},
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind2",
+					Name:       "name",
+					UID:        "2",
+					Controller: &trueVar,
+				},
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind3",
+					Name:       "name",
+					UID:        "3",
+					Controller: &trueVar,
+				},
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind4",
+					Name:       "name",
+					UID:        "4",
+				},
+			},
+			expectError:          true,
+			expectedErrorMessage: "Only one reference can have Controller set to true. Found \"true\" in references for customresourceKind2/name and customresourceKind3/name",
+		},
+	}
+
+	for _, tc := range testCases {
+		errs := validateObjectMetaAccessorWithOptsCommon(
+			&metav1.ObjectMeta{Name: "test", Namespace: "test", OwnerReferences: tc.ownerReferences},
+			true, field.NewPath("field"), nil)
+		if len(errs) != 0 && !tc.expectError {
+			t.Errorf("unexpected error: %v in test case %v", errs, tc.description)
+		}
+		if len(errs) == 0 && tc.expectError {
+			t.Errorf("expect error in test case %v", tc.description)
+		}
+		if len(errs) != 0 && !strings.Contains(errs[0].Error(), tc.expectedErrorMessage) {
+			t.Errorf("unexpected error message: %v in test case %v", errs, tc.description)
+		}
+	}
+}
+
+func TestValidateObjectMetaUpdateIgnoresCreationTimestamp(t *testing.T) {
+	if errs := ValidateObjectMetaUpdate(
+		&metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+		&metav1.ObjectMeta{Name: "test", ResourceVersion: "1", CreationTimestamp: metav1.NewTime(time.Unix(10, 0))},
+		field.NewPath("field"),
+	); len(errs) != 1 {
+		t.Fatalf("unexpected errors: %v", errs)
+	}
+	if errs := ValidateObjectMetaUpdate(
+		&metav1.ObjectMeta{Name: "test", ResourceVersion: "1", CreationTimestamp: metav1.NewTime(time.Unix(10, 0))},
+		&metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+		field.NewPath("field"),
+	); len(errs) != 1 {
+		t.Fatalf("unexpected errors: %v", errs)
+	}
+	if errs := ValidateObjectMetaUpdate(
+		&metav1.ObjectMeta{Name: "test", ResourceVersion: "1", CreationTimestamp: metav1.NewTime(time.Unix(10, 0))},
+		&metav1.ObjectMeta{Name: "test", ResourceVersion: "1", CreationTimestamp: metav1.NewTime(time.Unix(11, 0))},
+		field.NewPath("field"),
+	); len(errs) != 1 {
+		t.Fatalf("unexpected errors: %v", errs)
+	}
+}
+
+func TestValidateFinalizersUpdate(t *testing.T) {
+	testcases := map[string]struct {
+		Old         metav1.ObjectMeta
+		New         metav1.ObjectMeta
+		ExpectedErr string
+	}{
+		"invalid adding finalizers": {
+			Old:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &metav1.Time{}, Finalizers: []string{"x/a"}},
+			New:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &metav1.Time{}, Finalizers: []string{"x/a", "y/b"}},
+			ExpectedErr: "y/b",
+		},
+		"invalid changing finalizers": {
+			Old:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &metav1.Time{}, Finalizers: []string{"x/a"}},
+			New:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &metav1.Time{}, Finalizers: []string{"x/b"}},
+			ExpectedErr: "x/b",
+		},
+		"valid removing finalizers": {
+			Old:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &metav1.Time{}, Finalizers: []string{"x/a", "y/b"}},
+			New:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &metav1.Time{}, Finalizers: []string{"x/a"}},
+			ExpectedErr: "",
+		},
+		"valid adding finalizers for objects not being deleted": {
+			Old:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Finalizers: []string{"x/a"}},
+			New:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Finalizers: []string{"x/a", "y/b"}},
+			ExpectedErr: "",
+		},
+	}
+	for name, tc := range testcases {
+		errs := ValidateObjectMetaUpdate(&tc.New, &tc.Old, field.NewPath("field"))
+		if len(errs) == 0 {
+			if len(tc.ExpectedErr) != 0 {
+				t.Errorf("case: %q, expected error to contain %q", name, tc.ExpectedErr)
+			}
+		} else if e, a := tc.ExpectedErr, errs.ToAggregate().Error(); !strings.Contains(a, e) {
+			t.Errorf("case: %q, expected error to contain %q, got error %q", name, e, a)
+		}
+	}
+}
+
+func TestValidateFinalizersPreventConflictingFinalizers(t *testing.T) {
+	testcases := map[string]struct {
+		ObjectMeta  metav1.ObjectMeta
+		ExpectedErr string
+	}{
+		"conflicting finalizers": {
+			ObjectMeta:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Finalizers: []string{metav1.FinalizerOrphanDependents, metav1.FinalizerDeleteDependents}},
+			ExpectedErr: "cannot be both set",
+		},
+	}
+	for name, tc := range testcases {
+		errs := validateObjectMetaAccessorWithOptsCommon(&tc.ObjectMeta, false, field.NewPath("field"), nil)
+		if len(errs) == 0 {
+			if len(tc.ExpectedErr) != 0 {
+				t.Errorf("case: %q, expected error to contain %q", name, tc.ExpectedErr)
+			}
+		} else if e, a := tc.ExpectedErr, errs.ToAggregate().Error(); !strings.Contains(a, e) {
+			t.Errorf("case: %q, expected error to contain %q, got error %q", name, e, a)
+		}
+	}
+}
+
+func TestValidateObjectMetaUpdatePreventsDeletionFieldMutation(t *testing.T) {
+	now := metav1.NewTime(time.Unix(1000, 0).UTC())
+	later := metav1.NewTime(time.Unix(2000, 0).UTC())
+	gracePeriodShort := int64(30)
+	gracePeriodLong := int64(40)
+
+	testcases := map[string]struct {
+		Old          metav1.ObjectMeta
+		New          metav1.ObjectMeta
+		ExpectedNew  metav1.ObjectMeta
+		ExpectedErrs []string
+	}{
+		"valid without deletion fields": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			ExpectedErrs: []string{},
+		},
+		"valid with deletion fields": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now, DeletionGracePeriodSeconds: &gracePeriodShort},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now, DeletionGracePeriodSeconds: &gracePeriodShort},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now, DeletionGracePeriodSeconds: &gracePeriodShort},
+			ExpectedErrs: []string{},
+		},
+
+		"invalid set deletionTimestamp": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now},
+			ExpectedErrs: []string{"field.deletionTimestamp: Invalid value: \"1970-01-01T00:16:40Z\": field is immutable"},
+		},
+		"invalid clear deletionTimestamp": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			ExpectedErrs: []string{"field.deletionTimestamp: Invalid value: null: field is immutable"},
+		},
+		"invalid change deletionTimestamp": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &later},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &later},
+			ExpectedErrs: []string{"field.deletionTimestamp: Invalid value: \"1970-01-01T00:33:20Z\": field is immutable"},
+		},
+
+		"invalid set deletionGracePeriodSeconds": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionGracePeriodSeconds: &gracePeriodShort},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionGracePeriodSeconds: &gracePeriodShort},
+			ExpectedErrs: []string{"field.deletionGracePeriodSeconds: Invalid value: 30: field is immutable"},
+		},
+		"invalid clear deletionGracePeriodSeconds": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionGracePeriodSeconds: &gracePeriodShort},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			ExpectedErrs: []string{"field.deletionGracePeriodSeconds: Invalid value: null: field is immutable"},
+		},
+		"invalid change deletionGracePeriodSeconds": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionGracePeriodSeconds: &gracePeriodShort},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionGracePeriodSeconds: &gracePeriodLong},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionGracePeriodSeconds: &gracePeriodLong},
+			ExpectedErrs: []string{"field.deletionGracePeriodSeconds: Invalid value: 40: field is immutable"},
+		},
+	}
+
+	for k, tc := range testcases {
+		errs := ValidateObjectMetaUpdate(&tc.New, &tc.Old, field.NewPath("field"))
+		if len(errs) != len(tc.ExpectedErrs) {
+			t.Logf("%s: Expected: %#v", k, tc.ExpectedErrs)
+			t.Logf("%s: Got: %#v", k, errs)
+			t.Errorf("%s: expected %d errors, got %d", k, len(tc.ExpectedErrs), len(errs))
+			continue
+		}
+		for i := range errs {
+			if errs[i].Error() != tc.ExpectedErrs[i] {
+				t.Errorf("%s: error #%d:\n  expected: %q\n       got: %q", k, i, tc.ExpectedErrs[i], errs[i].Error())
+			}
+		}
+		if !reflect.DeepEqual(tc.New, tc.ExpectedNew) {
+			t.Errorf("%s: Expected after validation:\n%#v\ngot\n%#v", k, tc.ExpectedNew, tc.New)
+		}
+	}
+}
+
+func TestObjectMetaGenerationUpdate(t *testing.T) {
+	testcases := map[string]struct {
+		Old          metav1.ObjectMeta
+		New          metav1.ObjectMeta
+		ExpectedErrs []string
+	}{
+		"invalid generation change - decremented": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Generation: 5},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Generation: 4},
+			ExpectedErrs: []string{"field.generation: Invalid value: 4: must not be decremented"},
+		},
+		"valid generation change - incremented by one": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Generation: 1},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Generation: 2},
+			ExpectedErrs: []string{},
+		},
+		"valid generation field - not updated": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Generation: 5},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Generation: 5},
+			ExpectedErrs: []string{},
+		},
+	}
+
+	for k, tc := range testcases {
+		errList := []string{}
+		errs := ValidateObjectMetaUpdate(&tc.New, &tc.Old, field.NewPath("field"))
+		if len(errs) != len(tc.ExpectedErrs) {
+			t.Logf("%s: Expected: %#v", k, tc.ExpectedErrs)
+			for _, err := range errs {
+				errList = append(errList, err.Error())
+			}
+			t.Logf("%s: Got: %#v", k, errList)
+			t.Errorf("%s: expected %d errors, got %d", k, len(tc.ExpectedErrs), len(errs))
+			continue
+		}
+		for i := range errList {
+			if errList[i] != tc.ExpectedErrs[i] {
+				t.Errorf("%s: error #%d:\n  expected: %q\n       got: %q", k, i, tc.ExpectedErrs[i], errs[i].Error())
+			}
+		}
+	}
+}
+
+// Ensure trailing dash is allowed in generate name
+func TestValidateObjectMetaTrimsTrailingDash(t *testing.T) {
+	errs := ValidateObjectMeta(
+		&metav1.ObjectMeta{Name: "test", GenerateName: "foo-"},
+		false,
+		NameIsDNSSubdomain,
+		field.NewPath("field"))
+	if len(errs) != 0 {
+		t.Fatalf("unexpected errors: %v", errs)
+	}
+}
+
+func TestValidateAnnotations(t *testing.T) {
+	successCases := []map[string]string{
+		{"simple": "bar"},
+		{"now-with-dashes": "bar"},
+		{"1-starts-with-num": "bar"},
+		{"1234": "bar"},
+		{"simple/simple": "bar"},
+		{"now-with-dashes/simple": "bar"},
+		{"now-with-dashes/now-with-dashes": "bar"},
+		{"now.with.dots/simple": "bar"},
+		{"now-with.dashes-and.dots/simple": "bar"},
+		{"1-num.2-num/3-num": "bar"},
+		{"1234/5678": "bar"},
+		{"1.2.3.4/5678": "bar"},
+		{"UpperCase123": "bar"},
+		{"a": strings.Repeat("b", TotalAnnotationSizeLimitB-1)},
+		{
+			"a": strings.Repeat("b", TotalAnnotationSizeLimitB/2-1),
+			"c": strings.Repeat("d", TotalAnnotationSizeLimitB/2-1),
+		},
+	}
+	for i := range successCases {
+		errs := ValidateAnnotations(successCases[i], field.NewPath("field"))
+		if len(errs) != 0 {
+			t.Errorf("case[%d] expected success, got %#v", i, errs)
+		}
+	}
+
+	nameErrorCases := []struct {
+		annotations map[string]string
+		expect      string
+	}{
+		{map[string]string{"nospecialchars^=@": "bar"}, namePartErrMsg},
+		{map[string]string{"cantendwithadash-": "bar"}, namePartErrMsg},
+		{map[string]string{"only/one/slash": "bar"}, nameErrMsg},
+		{map[string]string{strings.Repeat("a", 254): "bar"}, maxLengthErrMsg},
+	}
+	for i := range nameErrorCases {
+		errs := ValidateAnnotations(nameErrorCases[i].annotations, field.NewPath("field"))
+		if len(errs) != 1 {
+			t.Errorf("case[%d]: expected failure", i)
+		} else {
+			if !strings.Contains(errs[0].Detail, nameErrorCases[i].expect) {
+				t.Errorf("case[%d]: error details do not include %q: %q", i, nameErrorCases[i].expect, errs[0].Detail)
+			}
+		}
+	}
+	totalSizeErrorCases := []map[string]string{
+		{"a": strings.Repeat("b", TotalAnnotationSizeLimitB)},
+		{
+			"a": strings.Repeat("b", TotalAnnotationSizeLimitB/2),
+			"c": strings.Repeat("d", TotalAnnotationSizeLimitB/2),
+		},
+	}
+	for i := range totalSizeErrorCases {
+		errs := ValidateAnnotations(totalSizeErrorCases[i], field.NewPath("field"))
+		if len(errs) != 1 {
+			t.Errorf("case[%d] expected failure", i)
+		}
+	}
+}
+
+func TestValidateObjectMetaDeclaratively(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("metadata")
+	now := metav1.NewTime(time.Unix(1000, 0).UTC())
+	later := metav1.NewTime(time.Unix(2000, 0).UTC())
+	gracePeriod30 := int64(30)
+	gracePeriod40 := int64(40)
+
+	createCases := []struct {
+		name              string
+		obj               *metav1.ObjectMeta
+		requiresNamespace bool
+		expectedErrs      field.ErrorList
+	}{
+		{
+			name:              "valid metadata",
+			obj:               mkMeta(),
+			requiresNamespace: true,
+			expectedErrs:      nil,
+		},
+		{
+			name:              "invalid name format",
+			obj:               mkMeta(tweakName("invalid_name")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("name"), "invalid_name", "").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "missing required namespace",
+			obj:               mkMeta(tweakNamespace("")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("namespace"), "").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "negative generation",
+			obj:               mkMeta(tweakGeneration(-1)),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("generation"), int64(-1), "").WithOrigin("minimum").MarkAlpha(),
+			},
+		},
+		{
+			name:              "managedFields empty operation",
+			obj:               mkMeta(tweakManagedFields(metav1.ManagedFieldsEntry{FieldsType: "FieldsV1"})),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("managedFields").Index(0).Child("operation"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences empty apiVersion",
+			obj:               mkMeta(tweakOwnerRefs(mkOwnerRef(tweakRefAPIVersion("")))),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("apiVersion"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences empty kind",
+			obj:               mkMeta(tweakOwnerRefs(mkOwnerRef(tweakRefKind("")))),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("kind"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences empty name",
+			obj:               mkMeta(tweakOwnerRefs(mkOwnerRef(tweakRefName("")))),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("name"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences empty uid",
+			obj:               mkMeta(tweakOwnerRefs(mkOwnerRef(tweakRefUID("")))),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("uid"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences event is disallowed",
+			obj:               mkMeta(tweakOwnerRefs(mkOwnerRef(tweakRefKind("Event")))),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("ownerReferences").Index(0), metav1.OwnerReference{APIVersion: "v1", Kind: "Event", Name: "name", UID: "uid-1"}, "").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "invalid annotation key",
+			obj:               mkMeta(tweakAnnotations(map[string]string{"-invalid": "val"})),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("annotations"), "-invalid", "").WithOrigin("format=k8s-label-key").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "annotations size limit exceeded",
+			obj:               mkMeta(tweakAnnotations(map[string]string{"a": strings.Repeat("b", TotalAnnotationSizeLimitB)})),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.TooLong(fldPath.Child("annotations"), "", TotalAnnotationSizeLimitB).MarkFromImperative(),
+			},
+		},
+	}
+
+	matcher := field.ErrorMatcher{}.ByField().ByType().BySource().ByOrigin()
+
+	toExpectedErrs := func(allDeclarativeEnforced bool, betaEnabled bool, errs field.ErrorList) field.ErrorList {
+		expected := make(field.ErrorList, 0, len(errs))
+		for _, err := range errs {
+			e := *err
+			if !allDeclarativeEnforced && (e.IsAlpha() || (!betaEnabled && e.IsBeta())) {
+				_ = e.MarkFromImperative()
+				e.ValidationStabilityLevel = 0
+			}
+			expected = append(expected, &e)
+		}
+		return expected
+	}
+
+	for _, tc := range createCases {
+		for _, betaEnabled := range []bool{true, false} {
+			for _, allDeclarativeEnforced := range []bool{true, false} {
+				t.Run(fmt.Sprintf("Create: %s (betaEnabled=%v, allDeclarativeEnforced=%v)", tc.name, betaEnabled, allDeclarativeEnforced), func(t *testing.T) {
+					testCtx := ctx
+					if allDeclarativeEnforced {
+						testCtx = validate.WithAllDeclarativeEnforcedForTest(ctx)
+					}
+					errs := ValidateObjectMetaDeclaratively(testCtx, operation.Create, tc.obj, nil, tc.requiresNamespace, NameIsDNSSubdomain, fldPath, betaEnabled)
+					matcher.Test(t, toExpectedErrs(allDeclarativeEnforced, betaEnabled, tc.expectedErrs), errs)
+				})
+			}
+		}
+	}
+
+	updateCases := []struct {
+		name              string
+		obj               *metav1.ObjectMeta
+		oldObj            *metav1.ObjectMeta
+		requiresNamespace bool
+		expectedErrs      field.ErrorList
+	}{
+		{
+			name:              "valid update",
+			obj:               mkMeta(tweakResourceVersion("2")),
+			oldObj:            mkMeta(tweakResourceVersion("1")),
+			requiresNamespace: true,
+			expectedErrs:      nil,
+		},
+		{
+			name:              "valid generation zero on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakGeneration(0)),
+			oldObj:            mkMeta(tweakResourceVersion("1"), tweakGeneration(0)),
+			requiresNamespace: true,
+			expectedErrs:      nil,
+		},
+		{
+			name:              "decremented generation to zero on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakGeneration(0)),
+			oldObj:            mkMeta(tweakResourceVersion("1"), tweakGeneration(1)),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("generation"), int64(0), "must not be decremented").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "negative generation on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakGeneration(-1)),
+			oldObj:            mkMeta(tweakResourceVersion("1"), tweakGeneration(0)),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("generation"), int64(-1), "").WithOrigin("minimum").MarkAlpha(),
+				field.Invalid(fldPath.Child("generation"), int64(-1), "must not be decremented").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "immutable namespace",
+			obj:               mkMeta(tweakNamespace("new-ns"), tweakResourceVersion("2")),
+			oldObj:            mkMeta(tweakNamespace("old-ns"), tweakResourceVersion("1")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("namespace"), "new-ns", "").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "ownerReferences empty apiVersion on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakOwnerRefs(mkOwnerRef(tweakRefAPIVersion("")))),
+			oldObj:            mkMeta(tweakResourceVersion("1")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("apiVersion"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences empty kind on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakOwnerRefs(mkOwnerRef(tweakRefKind("")))),
+			oldObj:            mkMeta(tweakResourceVersion("1")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("kind"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences empty name on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakOwnerRefs(mkOwnerRef(tweakRefName("")))),
+			oldObj:            mkMeta(tweakResourceVersion("1")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("name"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences empty uid on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakOwnerRefs(mkOwnerRef(tweakRefUID("")))),
+			oldObj:            mkMeta(tweakResourceVersion("1")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("uid"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "invalid annotation key on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakAnnotations(map[string]string{"-invalid": "val"})),
+			oldObj:            mkMeta(tweakResourceVersion("1")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("annotations"), "-invalid", "").WithOrigin("format=k8s-label-key").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "immutable uid on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakUID("uid-new")),
+			oldObj:            mkMeta(tweakResourceVersion("1"), tweakUID("uid-old")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("uid"), types.UID("uid-new"), "").WithOrigin("immutable").MarkAlpha(),
+			},
+		},
+		{
+			name:              "immutable creationTimestamp on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakCreationTimestamp(later)),
+			oldObj:            mkMeta(tweakResourceVersion("1"), tweakCreationTimestamp(now)),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("creationTimestamp"), later, "").WithOrigin("immutable").MarkAlpha(),
+			},
+		},
+		{
+			name:              "immutable deletionTimestamp on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakDeletionTimestamp(&later)),
+			oldObj:            mkMeta(tweakResourceVersion("1"), tweakDeletionTimestamp(&now)),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("deletionTimestamp"), &later, "").WithOrigin("immutable").MarkAlpha(),
+			},
+		},
+		{
+			name:              "immutable deletionGracePeriodSeconds on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakDeletionGracePeriodSeconds(&gracePeriod40)),
+			oldObj:            mkMeta(tweakResourceVersion("1"), tweakDeletionGracePeriodSeconds(&gracePeriod30)),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("deletionGracePeriodSeconds"), &gracePeriod40, "").WithOrigin("immutable").MarkAlpha(),
+			},
+		},
+	}
+
+	for _, tc := range updateCases {
+		for _, betaEnabled := range []bool{true, false} {
+			for _, allDeclarativeEnforced := range []bool{true, false} {
+				t.Run(fmt.Sprintf("Update: %s (betaEnabled=%v, allDeclarativeEnforced=%v)", tc.name, betaEnabled, allDeclarativeEnforced), func(t *testing.T) {
+					testCtx := ctx
+					if allDeclarativeEnforced {
+						testCtx = validate.WithAllDeclarativeEnforcedForTest(ctx)
+					}
+					errs := ValidateObjectMetaDeclaratively(testCtx, operation.Update, tc.obj, tc.oldObj, tc.requiresNamespace, NameIsDNSSubdomain, fldPath, betaEnabled)
+					matcher.Test(t, toExpectedErrs(allDeclarativeEnforced, betaEnabled, tc.expectedErrs), errs)
+				})
+			}
+		}
+	}
+}
+
+func mkMeta(tweaks ...func(*metav1.ObjectMeta)) *metav1.ObjectMeta {
+	obj := &metav1.ObjectMeta{
+		Name:      "valid-name",
+		Namespace: "valid-ns",
+	}
+	for _, tweak := range tweaks {
+		tweak(obj)
+	}
+	return obj
+}
+
+func tweakName(n string) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.Name = n }
+}
+
+func tweakNamespace(ns string) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.Namespace = ns }
+}
+
+func tweakResourceVersion(rv string) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.ResourceVersion = rv }
+}
+
+func tweakGeneration(g int64) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.Generation = g }
+}
+
+func tweakAnnotations(ann map[string]string) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.Annotations = ann }
+}
+
+func tweakManagedFields(entries ...metav1.ManagedFieldsEntry) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.ManagedFields = entries }
+}
+
+func tweakUID(u string) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.UID = types.UID(u) }
+}
+
+func tweakCreationTimestamp(t metav1.Time) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.CreationTimestamp = t }
+}
+
+func tweakDeletionTimestamp(t *metav1.Time) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.DeletionTimestamp = t }
+}
+
+func tweakDeletionGracePeriodSeconds(gps *int64) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.DeletionGracePeriodSeconds = gps }
+}
+
+func tweakRefAPIVersion(v string) func(*metav1.OwnerReference) {
+	return func(r *metav1.OwnerReference) { r.APIVersion = v }
+}
+
+func tweakRefKind(k string) func(*metav1.OwnerReference) {
+	return func(r *metav1.OwnerReference) { r.Kind = k }
+}
+
+func tweakRefName(n string) func(*metav1.OwnerReference) {
+	return func(r *metav1.OwnerReference) { r.Name = n }
+}
+
+func tweakRefUID(u string) func(*metav1.OwnerReference) {
+	return func(r *metav1.OwnerReference) { r.UID = types.UID(u) }
+}
+
+func tweakOwnerRefs(refs ...metav1.OwnerReference) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.OwnerReferences = refs }
+}
+
+func mkOwnerRef(tweaks ...func(*metav1.OwnerReference)) metav1.OwnerReference {
+	r := &metav1.OwnerReference{
+		APIVersion: "v1",
+		Kind:       "Pod",
+		Name:       "name",
+		UID:        "uid-1",
+	}
+	for _, tweak := range tweaks {
+		tweak(r)
+	}
+	return *r
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/path/name.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/path/name.go
new file mode 100644
index 0000000000..c0dee8108a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/api/validation/path/name.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package path
+
+import (
+	"k8s.io/apimachinery/pkg/api/validate/content"
+)
+
+// IsValidPathSegmentName validates the name can be safely encoded as a path segment
+//
+// Deprecated: use content.IsPathSegmentName directly.
+var IsValidPathSegmentName = content.IsPathSegmentName
+
+// IsValidPathSegmentPrefix validates the name can be used as a prefix for a name which will be encoded as a path segment
+// It does not check for exact matches with disallowed names, since an arbitrary suffix might make the name valid
+//
+// Deprecated: use content.IsPathSegmentPrefix directly.
+var IsValidPathSegmentPrefix = content.IsPathSegmentPrefix
+
+// ValidatePathSegmentName validates the name can be safely encoded as a path segment
+//
+// Deprecated: use a locally defined function.
+func ValidatePathSegmentName(name string, prefix bool) []string {
+	if prefix {
+		return IsValidPathSegmentPrefix(name)
+	}
+	return IsValidPathSegmentName(name)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/OWNERS b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/OWNERS
new file mode 100644
index 0000000000..4023732476
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/OWNERS
@@ -0,0 +1,11 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+# Disable inheritance as this is an api owners file
+options:
+  no_parent_owners: true
+approvers:
+  - api-approvers
+reviewers:
+  - api-reviewers
+labels:
+  - kind/api-change
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/asn1/oid.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/asn1/oid.go
new file mode 100644
index 0000000000..59c363f919
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/asn1/oid.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package asn1
+
+import "encoding/asn1"
+
+// These constants store suffixes for use with the CNCF Private Enterprise Number allocated to Kubernetes:
+// https://www.iana.org/assignments/enterprise-numbers.txt
+//
+// Root: 1.3.6.1.4.1.57683
+//
+// Cloud Native Computing Foundation
+const (
+	// single-value, string value
+	x509UIDSuffix = 2
+)
+
+func makeOID(suffix int) asn1.ObjectIdentifier {
+	return asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57683, suffix}
+}
+
+// X509UID returns an OID (1.3.6.1.4.1.57683.2) for an element of an x509 distinguished name representing a user UID.
+// The UID is a unique value for a particular user that will change if the user is removed from the system
+// and another user is added with the same username.
+//
+// This element must not appear more than once in a distinguished name, and the value must be a string
+func X509UID() asn1.ObjectIdentifier {
+	return makeOID(x509UIDSuffix)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/fuzzer/fuzzer.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/fuzzer/fuzzer.go
new file mode 100644
index 0000000000..c263f1450d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/fuzzer/fuzzer.go
@@ -0,0 +1,339 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fuzzer
+
+import (
+	"fmt"
+	"math/rand"
+	"sort"
+	"strconv"
+	"strings"
+
+	"sigs.k8s.io/randfill"
+
+	apitesting "k8s.io/apimachinery/pkg/api/apitesting"
+	"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	metav1beta1 "k8s.io/apimachinery/pkg/apis/meta/v1beta1"
+	"k8s.io/apimachinery/pkg/runtime"
+	runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+func genericFuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
+	return []interface{}{
+		func(q *resource.Quantity, c randfill.Continue) {
+			*q = *resource.NewQuantity(c.Int63n(1000), resource.DecimalExponent)
+		},
+		func(j *int, c randfill.Continue) {
+			*j = int(c.Int31())
+		},
+		func(j **int, c randfill.Continue) {
+			if c.Bool() {
+				i := int(c.Int31())
+				*j = &i
+			} else {
+				*j = nil
+			}
+		},
+		func(j *runtime.TypeMeta, c randfill.Continue) {
+			// We have to customize the randomization of TypeMetas because their
+			// APIVersion and Kind must remain blank in memory.
+			j.APIVersion = ""
+			j.Kind = ""
+		},
+		func(j *runtime.Object, c randfill.Continue) {
+			// TODO: uncomment when round trip starts from a versioned object
+			if true { // c.Bool() {
+				*j = &runtime.Unknown{
+					// We do not set TypeMeta here because it is not carried through a round trip
+					Raw:         []byte(`{"apiVersion":"unknown.group/unknown","kind":"Something","someKey":"someValue"}`),
+					ContentType: runtime.ContentTypeJSON,
+				}
+			} else {
+				types := []runtime.Object{&metav1.Status{}, &metav1.APIGroup{}}
+				t := types[c.Rand.Intn(len(types))]
+				c.Fill(t)
+				*j = t
+			}
+		},
+		func(r *runtime.RawExtension, c randfill.Continue) {
+			// Pick an arbitrary type and fuzz it
+			types := []runtime.Object{&metav1.Status{}, &metav1.APIGroup{}}
+			obj := types[c.Rand.Intn(len(types))]
+			c.Fill(obj)
+
+			// Find a codec for converting the object to raw bytes.  This is necessary for the
+			// api version and kind to be correctly set be serialization.
+			var codec = apitesting.TestCodec(codecs, metav1.SchemeGroupVersion)
+
+			// Convert the object to raw bytes
+			bytes, err := runtime.Encode(codec, obj)
+			if err != nil {
+				panic(fmt.Sprintf("Failed to encode object: %v", err))
+			}
+
+			// strip trailing newlines which do not survive roundtrips
+			for len(bytes) >= 1 && bytes[len(bytes)-1] == 10 {
+				bytes = bytes[:len(bytes)-1]
+			}
+
+			// Set the bytes field on the RawExtension
+			r.Raw = bytes
+		},
+	}
+}
+
+// taken from randfill (nee gofuzz) internals for RandString
+type charRange struct {
+	first, last rune
+}
+
+func (c *charRange) choose(r *rand.Rand) rune {
+	count := int64(c.last - c.first + 1)
+	ch := c.first + rune(r.Int63n(count))
+
+	return ch
+}
+
+// randomLabelPart produces a valid random label value or name-part
+// of a label key.
+func randomLabelPart(c randfill.Continue, canBeEmpty bool) string {
+	validStartEnd := []charRange{{'0', '9'}, {'a', 'z'}, {'A', 'Z'}}
+	validMiddle := []charRange{{'0', '9'}, {'a', 'z'}, {'A', 'Z'},
+		{'.', '.'}, {'-', '-'}, {'_', '_'}}
+
+	partLen := c.Rand.Intn(64) // len is [0, 63]
+	if !canBeEmpty {
+		partLen = c.Rand.Intn(63) + 1 // len is [1, 63]
+	}
+
+	runes := make([]rune, partLen)
+	if partLen == 0 {
+		return string(runes)
+	}
+
+	runes[0] = validStartEnd[c.Rand.Intn(len(validStartEnd))].choose(c.Rand)
+	for i := range runes[1:] {
+		runes[i+1] = validMiddle[c.Rand.Intn(len(validMiddle))].choose(c.Rand)
+	}
+	runes[len(runes)-1] = validStartEnd[c.Rand.Intn(len(validStartEnd))].choose(c.Rand)
+
+	return string(runes)
+}
+
+func randomDNSLabel(c randfill.Continue) string {
+	validStartEnd := []charRange{{'0', '9'}, {'a', 'z'}}
+	validMiddle := []charRange{{'0', '9'}, {'a', 'z'}, {'-', '-'}}
+
+	partLen := c.Rand.Intn(63) + 1 // len is [1, 63]
+	runes := make([]rune, partLen)
+
+	runes[0] = validStartEnd[c.Rand.Intn(len(validStartEnd))].choose(c.Rand)
+	for i := range runes[1:] {
+		runes[i+1] = validMiddle[c.Rand.Intn(len(validMiddle))].choose(c.Rand)
+	}
+	runes[len(runes)-1] = validStartEnd[c.Rand.Intn(len(validStartEnd))].choose(c.Rand)
+
+	return string(runes)
+}
+
+func randomLabelKey(c randfill.Continue) string {
+	namePart := randomLabelPart(c, false)
+	prefixPart := ""
+
+	usePrefix := c.Bool()
+	if usePrefix {
+		// we can fit, with dots, at most 3 labels in the 253 allotted characters
+		prefixPartsLen := c.Rand.Intn(2) + 1
+		prefixParts := make([]string, prefixPartsLen)
+		for i := range prefixParts {
+			prefixParts[i] = randomDNSLabel(c)
+		}
+		prefixPart = strings.Join(prefixParts, ".") + "/"
+	}
+
+	return prefixPart + namePart
+}
+
+func v1FuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
+
+	return []interface{}{
+		func(j *metav1.TypeMeta, c randfill.Continue) {
+			// We have to customize the randomization of TypeMetas because their
+			// APIVersion and Kind must remain blank in memory.
+			j.APIVersion = ""
+			j.Kind = ""
+		},
+		func(j *metav1.ObjectMeta, c randfill.Continue) {
+			c.FillNoCustom(j)
+
+			j.ResourceVersion = strconv.FormatUint(c.Uint64(), 10)
+			j.UID = types.UID(c.String(0))
+
+			// Fuzzing sec and nsec in a smaller range (uint32 instead of int64),
+			// so that the result Unix time is a valid date and can be parsed into RFC3339 format.
+			var sec, nsec uint32
+			c.Fill(&sec)
+			c.Fill(&nsec)
+			j.CreationTimestamp = metav1.Unix(int64(sec), int64(nsec)).Rfc3339Copy()
+
+			if j.DeletionTimestamp != nil {
+				c.Fill(&sec)
+				c.Fill(&nsec)
+				t := metav1.Unix(int64(sec), int64(nsec)).Rfc3339Copy()
+				j.DeletionTimestamp = &t
+			}
+
+			if len(j.Labels) == 0 {
+				j.Labels = nil
+			} else {
+				delete(j.Labels, "")
+			}
+			if len(j.Annotations) == 0 {
+				j.Annotations = nil
+			} else {
+				delete(j.Annotations, "")
+			}
+			if len(j.OwnerReferences) == 0 {
+				j.OwnerReferences = nil
+			}
+			if len(j.Finalizers) == 0 {
+				j.Finalizers = nil
+			}
+		},
+		func(j *metav1.ResourceVersionMatch, c randfill.Continue) {
+			matches := []metav1.ResourceVersionMatch{"", metav1.ResourceVersionMatchExact, metav1.ResourceVersionMatchNotOlderThan}
+			*j = matches[c.Rand.Intn(len(matches))]
+		},
+		func(j *metav1.ListMeta, c randfill.Continue) {
+			j.ResourceVersion = strconv.FormatUint(c.Uint64(), 10)
+			j.SelfLink = c.String(0) //nolint:staticcheck // SA1019 backwards compatibility
+		},
+		func(j *metav1.LabelSelector, c randfill.Continue) {
+			c.FillNoCustom(j)
+			// we can't have an entirely empty selector, so force
+			// use of MatchExpression if necessary
+			if len(j.MatchLabels) == 0 && len(j.MatchExpressions) == 0 {
+				j.MatchExpressions = make([]metav1.LabelSelectorRequirement, c.Rand.Intn(2)+1)
+			}
+
+			if j.MatchLabels != nil {
+				fuzzedMatchLabels := make(map[string]string, len(j.MatchLabels))
+				for i := 0; i < len(j.MatchLabels); i++ {
+					fuzzedMatchLabels[randomLabelKey(c)] = randomLabelPart(c, true)
+				}
+				j.MatchLabels = fuzzedMatchLabels
+			}
+
+			validOperators := []metav1.LabelSelectorOperator{
+				metav1.LabelSelectorOpIn,
+				metav1.LabelSelectorOpNotIn,
+				metav1.LabelSelectorOpExists,
+				metav1.LabelSelectorOpDoesNotExist,
+			}
+
+			if j.MatchExpressions != nil {
+				// NB: the label selector parser code sorts match expressions by key, and
+				// sorts and deduplicates the values, so we need to make sure ours are
+				// sorted and deduplicated as well here to preserve round-trip comparison.
+				// In practice, not sorting doesn't hurt anything...
+
+				for i := range j.MatchExpressions {
+					req := metav1.LabelSelectorRequirement{}
+					c.Fill(&req)
+					req.Key = randomLabelKey(c)
+					req.Operator = validOperators[c.Rand.Intn(len(validOperators))]
+					if req.Operator == metav1.LabelSelectorOpIn || req.Operator == metav1.LabelSelectorOpNotIn {
+						if len(req.Values) == 0 {
+							// we must have some values here, so randomly choose a short length
+							req.Values = make([]string, c.Rand.Intn(2)+1)
+						}
+						for i := range req.Values {
+							req.Values[i] = randomLabelPart(c, true)
+						}
+						req.Values = sets.List(sets.New(req.Values...))
+					} else {
+						req.Values = nil
+					}
+					j.MatchExpressions[i] = req
+				}
+
+				sort.Slice(j.MatchExpressions, func(a, b int) bool { return j.MatchExpressions[a].Key < j.MatchExpressions[b].Key })
+			}
+		},
+		func(j *metav1.ManagedFieldsEntry, c randfill.Continue) {
+			c.FillNoCustom(j)
+			j.FieldsV1 = nil
+		},
+	}
+}
+
+func v1beta1FuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
+	return []interface{}{
+		func(r *metav1beta1.TableOptions, c randfill.Continue) {
+			c.FillNoCustom(r)
+			// NoHeaders is not serialized to the wire but is allowed within the versioned
+			// type because we don't use meta internal types in the client and API server.
+			r.NoHeaders = false
+		},
+		func(r *metav1beta1.TableRow, c randfill.Continue) {
+			c.Fill(&r.Object)
+			c.Fill(&r.Conditions)
+			if len(r.Conditions) == 0 {
+				r.Conditions = nil
+			}
+			n := c.Intn(10)
+			if n > 0 {
+				r.Cells = make([]interface{}, n)
+			}
+			for i := range r.Cells {
+				t := c.Intn(6)
+				switch t {
+				case 0:
+					r.Cells[i] = c.String(0)
+				case 1:
+					r.Cells[i] = c.Int63()
+				case 2:
+					r.Cells[i] = c.Bool()
+				case 3:
+					x := map[string]interface{}{}
+					for j := c.Intn(10) + 1; j >= 0; j-- {
+						x[c.String(0)] = c.String(0)
+					}
+					r.Cells[i] = x
+				case 4:
+					x := make([]interface{}, c.Intn(10))
+					for i := range x {
+						x[i] = c.Int63()
+					}
+					r.Cells[i] = x
+				default:
+					r.Cells[i] = nil
+				}
+			}
+		},
+	}
+}
+
+var Funcs = fuzzer.MergeFuzzerFuncs(
+	genericFuzzerFuncs,
+	v1FuzzerFuncs,
+	v1beta1FuzzerFuncs,
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/conversion.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/conversion.go
new file mode 100644
index 0000000000..f431157ec4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/conversion.go
@@ -0,0 +1,30 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internalversion
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+)
+
+func Convert_v1_ListOptions_To_internalversion_ListOptions(in *v1.ListOptions, out *ListOptions, s conversion.Scope) error {
+	return autoConvert_v1_ListOptions_To_internalversion_ListOptions(in, out, s)
+}
+
+func Convert_internalversion_ListOptions_To_v1_ListOptions(in *ListOptions, out *v1.ListOptions, s conversion.Scope) error {
+	return autoConvert_internalversion_ListOptions_To_v1_ListOptions(in, out, s)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/defaults.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/defaults.go
new file mode 100644
index 0000000000..29c6a48b6a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/defaults.go
@@ -0,0 +1,38 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internalversion
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// SetListOptionsDefaults sets defaults on the provided ListOptions if applicable.
+//
+// TODO(#115478): once the watch-list fg is always on we register this function in the scheme (via AddTypeDefaultingFunc).
+// TODO(#115478): when the function is registered in the scheme remove all callers of this method.
+func SetListOptionsDefaults(obj *ListOptions, isWatchListFeatureEnabled bool) {
+	if !isWatchListFeatureEnabled {
+		return
+	}
+	if obj.SendInitialEvents != nil || len(obj.ResourceVersionMatch) != 0 {
+		return
+	}
+	legacy := obj.ResourceVersion == "" || obj.ResourceVersion == "0"
+	if obj.Watch && legacy {
+		turnOnInitialEvents := true
+		obj.SendInitialEvents = &turnOnInitialEvents
+		obj.ResourceVersionMatch = metav1.ResourceVersionMatchNotOlderThan
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/defaults_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/defaults_test.go
new file mode 100644
index 0000000000..f1c5016066
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/defaults_test.go
@@ -0,0 +1,107 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internalversion
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/utils/ptr"
+)
+
+func TestSetListOptionsDefaults(t *testing.T) {
+	scenarios := []struct {
+		name                    string
+		watchListFeatureEnabled bool
+		targetObj               ListOptions
+		expectedObj             ListOptions
+	}{
+		{
+			name:                    "no-op, RV doesn't match",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersion: "1"},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersion: "1"},
+		},
+		{
+			name:                    "no-op, SendInitialEvents set",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(true)},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(true)},
+		},
+		{
+			name:                    "no-op, ResourceVersionMatch set",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersionMatch: "m"},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersionMatch: "m"},
+		},
+		{
+			name:                    "no-op, Watch=false",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything()},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything()},
+		},
+		{
+			name:                    "defaults applied, match on empty RV",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(true), ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan},
+		},
+		{
+			name:                    "defaults applied, match on RV=0",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersion: "0"},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersion: "0", SendInitialEvents: ptr.To(true), ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan},
+		},
+		{
+			name:        "no-op, match on empty RV but watch-list fg is off",
+			targetObj:   ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true},
+			expectedObj: ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true},
+		},
+		{
+			name:                    "no-op, match on empty RV but SendInitialEvents is on",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(true)},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(true)},
+		},
+		{
+			name:                    "no-op, match on empty RV but SendInitialEvents is off",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(false)},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(false)},
+		},
+		{
+			name:                    "no-op, match on empty RV but ResourceVersionMatch set",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersionMatch: "m"},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersionMatch: "m"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		t.Run(scenario.name, func(t *testing.T) {
+			SetListOptionsDefaults(&scenario.targetObj, scenario.watchListFeatureEnabled)
+			if !apiequality.Semantic.DeepEqual(&scenario.expectedObj, &scenario.targetObj) {
+				t.Errorf("expected and defaulted objects are different:\n%s", cmp.Diff(&scenario.expectedObj, &scenario.targetObj))
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/doc.go
new file mode 100644
index 0000000000..1e85c5c43d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +k8s:conversion-gen=k8s.io/apimachinery/pkg/apis/meta/v1
+
+package internalversion
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/register.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/register.go
new file mode 100644
index 0000000000..a59ac71268
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/register.go
@@ -0,0 +1,88 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internalversion
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	metav1beta1 "k8s.io/apimachinery/pkg/apis/meta/v1beta1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName is the group name for this API.
+const GroupName = "meta.k8s.io"
+
+var (
+	// TODO: move SchemeBuilder with zz_generated.deepcopy.go to k8s.io/api.
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	AddToScheme        = localSchemeBuilder.AddToScheme
+)
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
+
+// Kind takes an unqualified kind and returns a Group qualified GroupKind
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// addToGroupVersion registers common meta types into schemas.
+func addToGroupVersion(scheme *runtime.Scheme) error {
+	if err := scheme.AddIgnoredConversionType(&metav1.TypeMeta{}, &metav1.TypeMeta{}); err != nil {
+		return err
+	}
+	// ListOptions is the only options struct which needs conversion (it exposes labels and fields
+	// as selectors for convenience). The other types have only a single representation today.
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&ListOptions{},
+		&metav1.GetOptions{},
+		&metav1.DeleteOptions{},
+		&metav1.CreateOptions{},
+		&metav1.UpdateOptions{},
+	)
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&metav1.Table{},
+		&metav1.TableOptions{},
+		&metav1beta1.PartialObjectMetadata{},
+		&metav1beta1.PartialObjectMetadataList{},
+	)
+	if err := metav1beta1.AddMetaToScheme(scheme); err != nil {
+		return err
+	}
+	if err := metav1.AddMetaToScheme(scheme); err != nil {
+		return err
+	}
+	// Allow delete options to be decoded across all version in this scheme (we may want to be more clever than this)
+	scheme.AddUnversionedTypes(SchemeGroupVersion,
+		&metav1.DeleteOptions{},
+		&metav1.CreateOptions{},
+		&metav1.UpdateOptions{})
+
+	metav1.AddToGroupVersion(scheme, metav1.SchemeGroupVersion)
+	if err := metav1beta1.RegisterConversions(scheme); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Unlike other API groups, meta internal knows about all meta external versions, but keeps
+// the logic for conversion private.
+func init() {
+	localSchemeBuilder.Register(addToGroupVersion)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/doc.go
new file mode 100644
index 0000000000..b5ce956ee5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/doc.go
@@ -0,0 +1,17 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scheme
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/register.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/register.go
new file mode 100644
index 0000000000..585d7f44bd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/register.go
@@ -0,0 +1,39 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scheme
+
+import (
+	"k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// Scheme is the registry for any type that adheres to the meta API spec.
+var Scheme = runtime.NewScheme()
+
+// Codecs provides access to encoding and decoding for the scheme.
+var Codecs = serializer.NewCodecFactory(Scheme)
+
+// ParameterCodec handles versioning of objects that are converted to query parameters.
+var ParameterCodec = runtime.NewParameterCodec(Scheme)
+
+// Unlike other API groups, meta internal knows about all meta external versions, but keeps
+// the logic for conversion private.
+func init() {
+	utilruntime.Must(internalversion.AddToScheme(Scheme))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/register_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/register_test.go
new file mode 100644
index 0000000000..e17f28a7a0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/register_test.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scheme
+
+import (
+	"net/url"
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestListOptions(t *testing.T) {
+	// verify round trip conversion
+	ten := int64(10)
+	in := &metav1.ListOptions{
+		LabelSelector:   "a=1",
+		FieldSelector:   "b=1",
+		ResourceVersion: "10",
+		TimeoutSeconds:  &ten,
+		Watch:           true,
+	}
+	out := &metainternalversion.ListOptions{}
+	if err := Scheme.Convert(in, out, nil); err != nil {
+		t.Fatal(err)
+	}
+	actual := &metav1.ListOptions{}
+	if err := Scheme.Convert(out, actual, nil); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(in, actual) {
+		t.Errorf("unexpected: %s", cmp.Diff(in, actual))
+	}
+
+	// verify failing conversion
+	for i, failingObject := range []*metav1.ListOptions{
+		{LabelSelector: "a!!!"},
+		{FieldSelector: "a!!!"},
+	} {
+		out = &metainternalversion.ListOptions{}
+		if err := Scheme.Convert(failingObject, out, nil); err == nil {
+			t.Errorf("%d: unexpected conversion: %#v", i, out)
+		}
+	}
+
+	// verify kind registration
+	if gvks, unversioned, err := Scheme.ObjectKinds(in); err != nil || unversioned || gvks[0] != metav1.SchemeGroupVersion.WithKind("ListOptions") {
+		t.Errorf("unexpected: %v %v %v", gvks[0], unversioned, err)
+	}
+	if gvks, unversioned, err := Scheme.ObjectKinds(out); err != nil || unversioned || gvks[0] != metainternalversion.SchemeGroupVersion.WithKind("ListOptions") {
+		t.Errorf("unexpected: %v %v %v", gvks[0], unversioned, err)
+	}
+
+	actual = &metav1.ListOptions{}
+	if err := ParameterCodec.DecodeParameters(url.Values{"watch": []string{"1"}}, metav1.SchemeGroupVersion, actual); err != nil {
+		t.Fatal(err)
+	}
+	if !actual.Watch {
+		t.Errorf("unexpected watch decode: %#v", actual)
+	}
+
+	// check ParameterCodec
+	query, err := ParameterCodec.EncodeParameters(in, metav1.SchemeGroupVersion)
+	if err != nil {
+		t.Fatal(err)
+	}
+	actual = &metav1.ListOptions{}
+	if err := ParameterCodec.DecodeParameters(query, metav1.SchemeGroupVersion, actual); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(in, actual) {
+		t.Errorf("unexpected: %s", cmp.Diff(in, actual))
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/roundtrip_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/roundtrip_test.go
new file mode 100644
index 0000000000..028942c6a8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/roundtrip_test.go
@@ -0,0 +1,28 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scheme
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/apitesting/roundtrip"
+	"k8s.io/apimachinery/pkg/apis/meta/fuzzer"
+)
+
+func TestRoundTrip(t *testing.T) {
+	roundtrip.RoundTripTestForScheme(t, Scheme, fuzzer.Funcs)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/types.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/types.go
new file mode 100644
index 0000000000..a34a11c3e3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/types.go
@@ -0,0 +1,108 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internalversion
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// ListOptions is the query options to a standard REST list call.
+type ListOptions struct {
+	metav1.TypeMeta
+
+	// A selector based on labels
+	LabelSelector labels.Selector
+	// A selector based on fields
+	FieldSelector fields.Selector
+	// If true, watch for changes to this list
+	Watch bool
+	// allowWatchBookmarks requests watch events with type "BOOKMARK".
+	// Servers that do not implement bookmarks may ignore this flag and
+	// bookmarks are sent at the server's discretion. Clients should not
+	// assume bookmarks are returned at any specific interval, nor may they
+	// assume the server will send any BOOKMARK event during a session.
+	// If this is not a watch, this field is ignored.
+	AllowWatchBookmarks bool
+	// resourceVersion sets a constraint on what resource versions a request may be served from.
+	// See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+	// details.
+	ResourceVersion string
+	// resourceVersionMatch determines how resourceVersion is applied to list calls.
+	// It is highly recommended that resourceVersionMatch be set for list calls where
+	// resourceVersion is set.
+	// See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+	// details.
+	ResourceVersionMatch metav1.ResourceVersionMatch
+
+	// Timeout for the list/watch call.
+	TimeoutSeconds *int64
+	// Limit specifies the maximum number of results to return from the server. The server may
+	// not support this field on all resource types, but if it does and more results remain it
+	// will set the continue field on the returned list object.
+	Limit int64
+	// Continue is a token returned by the server that lets a client retrieve chunks of results
+	// from the server by specifying limit. The server may reject requests for continuation tokens
+	// it does not recognize and will return a 410 error if the token can no longer be used because
+	// it has expired.
+	Continue string
+
+	// `sendInitialEvents=true` may be set together with `watch=true`.
+	// In that case, the watch stream will begin with synthetic events to
+	// produce the current state of objects in the collection. Once all such
+	// events have been sent, a synthetic "Bookmark" event  will be sent.
+	// The bookmark will report the ResourceVersion (RV) corresponding to the
+	// set of objects, and be marked with `"k8s.io/initial-events-end": "true"` annotation.
+	// Afterwards, the watch stream will proceed as usual, sending watch events
+	// corresponding to changes (subsequent to the RV) to objects watched.
+	//
+	// When `sendInitialEvents` option is set, we require `resourceVersionMatch`
+	// option to also be set. The semantic of the watch request is as following:
+	// - `resourceVersionMatch` = NotOlderThan
+	//   is interpreted as "data at least as new as the provided `resourceVersion`"
+	//   and the bookmark event is send when the state is synced
+	//   to a `resourceVersion` at least as fresh as the one provided by the ListOptions.
+	//   If `resourceVersion` is unset, this is interpreted as "consistent read" and the
+	//   bookmark event is send when the state is synced at least to the moment
+	//   when request started being processed.
+	// - `resourceVersionMatch` set to any other value or unset
+	//   Invalid error is returned.
+	//
+	// Defaults to true if `resourceVersion=""` or `resourceVersion="0"` (for backward
+	// compatibility reasons) and to false otherwise.
+	SendInitialEvents *bool
+
+	// ShardSelector is the raw shard selector string from the request.
+	// Parsing is deferred to the apiserver storage layer where the CEL
+	// parser dependency is available.
+	ShardSelector string
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// List holds a list of objects, which may not be known by the server.
+type List struct {
+	metav1.TypeMeta
+	// +optional
+	metav1.ListMeta
+
+	Items []runtime.Object
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/validation/validation.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/validation/validation.go
new file mode 100644
index 0000000000..2734a8f3ba
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/validation/validation.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// ValidateListOptions returns all validation errors found while validating the ListOptions.
+func ValidateListOptions(options *internalversion.ListOptions, isWatchListFeatureEnabled bool) field.ErrorList {
+	if options.Watch {
+		return validateWatchOptions(options, isWatchListFeatureEnabled)
+	}
+	allErrs := field.ErrorList{}
+	if match := options.ResourceVersionMatch; len(match) > 0 {
+		if len(options.ResourceVersion) == 0 {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("resourceVersionMatch"), "resourceVersionMatch is forbidden unless resourceVersion is provided"))
+		}
+		if len(options.Continue) > 0 {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("resourceVersionMatch"), "resourceVersionMatch is forbidden when continue is provided"))
+		}
+		if match != metav1.ResourceVersionMatchExact && match != metav1.ResourceVersionMatchNotOlderThan {
+			allErrs = append(allErrs, field.NotSupported(field.NewPath("resourceVersionMatch"), match, []string{string(metav1.ResourceVersionMatchExact), string(metav1.ResourceVersionMatchNotOlderThan), ""}))
+		}
+		if match == metav1.ResourceVersionMatchExact && options.ResourceVersion == "0" {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("resourceVersionMatch"), "resourceVersionMatch \"exact\" is forbidden for resourceVersion \"0\""))
+		}
+	}
+	if options.SendInitialEvents != nil {
+		allErrs = append(allErrs, field.Forbidden(field.NewPath("sendInitialEvents"), "sendInitialEvents is forbidden for list"))
+	}
+	return allErrs
+}
+
+func validateWatchOptions(options *internalversion.ListOptions, isWatchListFeatureEnabled bool) field.ErrorList {
+	allErrs := field.ErrorList{}
+	match := options.ResourceVersionMatch
+	if options.SendInitialEvents != nil {
+		if match != metav1.ResourceVersionMatchNotOlderThan {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("resourceVersionMatch"), fmt.Sprintf("sendInitialEvents requires setting resourceVersionMatch to %s", metav1.ResourceVersionMatchNotOlderThan)))
+		}
+		if !isWatchListFeatureEnabled {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("sendInitialEvents"), "sendInitialEvents is forbidden for watch unless the WatchList feature gate is enabled"))
+		}
+	}
+	if len(match) > 0 {
+		if options.SendInitialEvents == nil {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("resourceVersionMatch"), "resourceVersionMatch is forbidden for watch unless sendInitialEvents is provided"))
+		}
+		if match != metav1.ResourceVersionMatchNotOlderThan {
+			allErrs = append(allErrs, field.NotSupported(field.NewPath("resourceVersionMatch"), match, []string{string(metav1.ResourceVersionMatchNotOlderThan)}))
+		}
+		if len(options.Continue) > 0 {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("resourceVersionMatch"), "resourceVersionMatch is forbidden when continue is provided"))
+		}
+	}
+	return allErrs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/validation/validation_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/validation/validation_test.go
new file mode 100644
index 0000000000..450627d923
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/validation/validation_test.go
@@ -0,0 +1,193 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/utils/ptr"
+)
+
+func TestValidateListOptions(t *testing.T) {
+	cases := []struct {
+		name                    string
+		opts                    internalversion.ListOptions
+		watchListFeatureEnabled bool
+		expectErrors            []string
+	}{{
+		name: "valid-default",
+		opts: internalversion.ListOptions{},
+	}, {
+		name: "valid-resourceversionmatch-exact",
+		opts: internalversion.ListOptions{
+			ResourceVersion:      "1",
+			ResourceVersionMatch: metav1.ResourceVersionMatchExact,
+		},
+	}, {
+		name: "invalid-resourceversionmatch-exact",
+		opts: internalversion.ListOptions{
+			ResourceVersion:      "0",
+			ResourceVersionMatch: metav1.ResourceVersionMatchExact,
+		},
+		expectErrors: []string{"resourceVersionMatch: Forbidden: resourceVersionMatch \"exact\" is forbidden for resourceVersion \"0\""},
+	}, {
+		name: "valid-resourceversionmatch-notolderthan",
+		opts: internalversion.ListOptions{
+			ResourceVersion:      "0",
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+		},
+	}, {
+		name: "invalid-resourceversionmatch",
+		opts: internalversion.ListOptions{
+			ResourceVersion:      "0",
+			ResourceVersionMatch: "foo",
+		},
+		expectErrors: []string{"resourceVersionMatch: Unsupported value: \"foo\": supported values: \"Exact\", \"NotOlderThan\", \"\""},
+	}, {
+		name: "list-sendInitialEvents-forbidden",
+		opts: internalversion.ListOptions{
+			SendInitialEvents: ptr.To(true),
+		},
+		expectErrors: []string{"sendInitialEvents: Forbidden: sendInitialEvents is forbidden for list"},
+	}, {
+		name: "valid-watch-default",
+		opts: internalversion.ListOptions{
+			Watch: true,
+		},
+	}, {
+		name: "valid-watch-sendInitialEvents-on",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(true),
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+			AllowWatchBookmarks:  true,
+		},
+		watchListFeatureEnabled: true,
+	}, {
+		name: "valid-watch-sendInitialEvents-off",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(false),
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+			AllowWatchBookmarks:  true,
+		},
+		watchListFeatureEnabled: true,
+	}, {
+		name: "watch-resourceversionmatch-without-sendInitialEvents-forbidden",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+		},
+		expectErrors: []string{"resourceVersionMatch: Forbidden: resourceVersionMatch is forbidden for watch unless sendInitialEvents is provided"},
+	}, {
+		name: "watch-sendInitialEvents-without-resourceversionmatch-forbidden",
+		opts: internalversion.ListOptions{
+			Watch:             true,
+			SendInitialEvents: ptr.To(true),
+		},
+		expectErrors: []string{"resourceVersionMatch: Forbidden: sendInitialEvents requires setting resourceVersionMatch to NotOlderThan", "sendInitialEvents: Forbidden: sendInitialEvents is forbidden for watch unless the WatchList feature gate is enabled"},
+	}, {
+		name: "watch-sendInitialEvents-with-exact-resourceversionmatch-forbidden",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(true),
+			ResourceVersionMatch: metav1.ResourceVersionMatchExact,
+			AllowWatchBookmarks:  true,
+		},
+		watchListFeatureEnabled: true,
+		expectErrors:            []string{"resourceVersionMatch: Forbidden: sendInitialEvents requires setting resourceVersionMatch to NotOlderThan", "resourceVersionMatch: Unsupported value: \"Exact\": supported values: \"NotOlderThan\""},
+	}, {
+		name: "watch-sendInitialEvents-on-with-empty-resourceversionmatch-forbidden",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(true),
+			ResourceVersionMatch: "",
+		},
+		expectErrors: []string{"resourceVersionMatch: Forbidden: sendInitialEvents requires setting resourceVersionMatch to NotOlderThan", "sendInitialEvents: Forbidden: sendInitialEvents is forbidden for watch unless the WatchList feature gate is enabled"},
+	}, {
+		name: "watch-sendInitialEvents-off-with-empty-resourceversionmatch-forbidden",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(false),
+			ResourceVersionMatch: "",
+		},
+		expectErrors: []string{"resourceVersionMatch: Forbidden: sendInitialEvents requires setting resourceVersionMatch to NotOlderThan", "sendInitialEvents: Forbidden: sendInitialEvents is forbidden for watch unless the WatchList feature gate is enabled"},
+	}, {
+		name: "watch-sendInitialEvents-with-incorrect-resourceversionmatch-forbidden",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(true),
+			ResourceVersionMatch: "incorrect",
+			AllowWatchBookmarks:  true,
+		},
+		watchListFeatureEnabled: true,
+		expectErrors:            []string{"resourceVersionMatch: Forbidden: sendInitialEvents requires setting resourceVersionMatch to NotOlderThan", "resourceVersionMatch: Unsupported value: \"incorrect\": supported values: \"NotOlderThan\""},
+	}, {
+		// note that validating allowWatchBookmarks would break backward compatibility
+		// because it was possible to request initial events via resourceVersion=0 before this change
+		name: "watch-sendInitialEvents-no-allowWatchBookmark",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(true),
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+		},
+		watchListFeatureEnabled: true,
+	}, {
+		name: "watch-sendInitialEvents-no-watchlist-fg-disabled",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(true),
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+			AllowWatchBookmarks:  true,
+		},
+		expectErrors: []string{"sendInitialEvents: Forbidden: sendInitialEvents is forbidden for watch unless the WatchList feature gate is enabled"},
+	}, {
+		name: "watch-sendInitialEvents-no-watchlist-fg-disabled",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(true),
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+			AllowWatchBookmarks:  true,
+			Continue:             "123",
+		},
+		watchListFeatureEnabled: true,
+		expectErrors:            []string{"resourceVersionMatch: Forbidden: resourceVersionMatch is forbidden when continue is provided"},
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := ValidateListOptions(&tc.opts, tc.watchListFeatureEnabled)
+			if len(tc.expectErrors) > 0 {
+				if len(errs) != len(tc.expectErrors) {
+					t.Errorf("expected %d errors but got %d errors", len(tc.expectErrors), len(errs))
+					return
+				}
+				for i, expectedErr := range tc.expectErrors {
+					if expectedErr != errs[i].Error() {
+						t.Errorf("expected error '%s' but got '%s'", expectedErr, errs[i].Error())
+					}
+				}
+				return
+			}
+			if len(errs) != 0 {
+				t.Errorf("expected no errors, but got: %v", errs)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/zz_generated.conversion.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/zz_generated.conversion.go
new file mode 100644
index 0000000000..f321ad2345
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/zz_generated.conversion.go
@@ -0,0 +1,140 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by conversion-gen. DO NOT EDIT.
+
+package internalversion
+
+import (
+	unsafe "unsafe"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	conversion "k8s.io/apimachinery/pkg/conversion"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+func init() {
+	localSchemeBuilder.Register(RegisterConversions)
+}
+
+// RegisterConversions adds conversion functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*List)(nil), (*v1.List)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_internalversion_List_To_v1_List(a.(*List), b.(*v1.List), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*v1.List)(nil), (*List)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_List_To_internalversion_List(a.(*v1.List), b.(*List), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ListOptions)(nil), (*v1.ListOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_internalversion_ListOptions_To_v1_ListOptions(a.(*ListOptions), b.(*v1.ListOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*v1.ListOptions)(nil), (*ListOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_ListOptions_To_internalversion_ListOptions(a.(*v1.ListOptions), b.(*ListOptions), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+func autoConvert_internalversion_List_To_v1_List(in *List, out *v1.List, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.RawExtension, len(*in))
+		for i := range *in {
+			if err := runtime.Convert_runtime_Object_To_runtime_RawExtension(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
+	return nil
+}
+
+// Convert_internalversion_List_To_v1_List is an autogenerated conversion function.
+func Convert_internalversion_List_To_v1_List(in *List, out *v1.List, s conversion.Scope) error {
+	return autoConvert_internalversion_List_To_v1_List(in, out, s)
+}
+
+func autoConvert_v1_List_To_internalversion_List(in *v1.List, out *List, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.Object, len(*in))
+		for i := range *in {
+			if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
+	return nil
+}
+
+// Convert_v1_List_To_internalversion_List is an autogenerated conversion function.
+func Convert_v1_List_To_internalversion_List(in *v1.List, out *List, s conversion.Scope) error {
+	return autoConvert_v1_List_To_internalversion_List(in, out, s)
+}
+
+func autoConvert_internalversion_ListOptions_To_v1_ListOptions(in *ListOptions, out *v1.ListOptions, s conversion.Scope) error {
+	if err := v1.Convert_labels_Selector_To_string(&in.LabelSelector, &out.LabelSelector, s); err != nil {
+		return err
+	}
+	if err := v1.Convert_fields_Selector_To_string(&in.FieldSelector, &out.FieldSelector, s); err != nil {
+		return err
+	}
+	out.Watch = in.Watch
+	out.AllowWatchBookmarks = in.AllowWatchBookmarks
+	out.ResourceVersion = in.ResourceVersion
+	out.ResourceVersionMatch = v1.ResourceVersionMatch(in.ResourceVersionMatch)
+	out.TimeoutSeconds = (*int64)(unsafe.Pointer(in.TimeoutSeconds))
+	out.Limit = in.Limit
+	out.Continue = in.Continue
+	out.SendInitialEvents = (*bool)(unsafe.Pointer(in.SendInitialEvents))
+	out.ShardSelector = in.ShardSelector
+	return nil
+}
+
+func autoConvert_v1_ListOptions_To_internalversion_ListOptions(in *v1.ListOptions, out *ListOptions, s conversion.Scope) error {
+	if err := v1.Convert_string_To_labels_Selector(&in.LabelSelector, &out.LabelSelector, s); err != nil {
+		return err
+	}
+	if err := v1.Convert_string_To_fields_Selector(&in.FieldSelector, &out.FieldSelector, s); err != nil {
+		return err
+	}
+	out.Watch = in.Watch
+	out.AllowWatchBookmarks = in.AllowWatchBookmarks
+	out.ResourceVersion = in.ResourceVersion
+	out.ResourceVersionMatch = v1.ResourceVersionMatch(in.ResourceVersionMatch)
+	out.TimeoutSeconds = (*int64)(unsafe.Pointer(in.TimeoutSeconds))
+	out.Limit = in.Limit
+	out.Continue = in.Continue
+	out.SendInitialEvents = (*bool)(unsafe.Pointer(in.SendInitialEvents))
+	out.ShardSelector = in.ShardSelector
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..af66a2ac4c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/zz_generated.deepcopy.go
@@ -0,0 +1,102 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package internalversion
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *List) DeepCopyInto(out *List) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.Object, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				(*out)[i] = (*in)[i].DeepCopyObject()
+			}
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new List.
+func (in *List) DeepCopy() *List {
+	if in == nil {
+		return nil
+	}
+	out := new(List)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *List) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListOptions) DeepCopyInto(out *ListOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.LabelSelector != nil {
+		out.LabelSelector = in.LabelSelector.DeepCopySelector()
+	}
+	if in.FieldSelector != nil {
+		out.FieldSelector = in.FieldSelector.DeepCopySelector()
+	}
+	if in.TimeoutSeconds != nil {
+		in, out := &in.TimeoutSeconds, &out.TimeoutSeconds
+		*out = new(int64)
+		**out = **in
+	}
+	if in.SendInitialEvents != nil {
+		in, out := &in.SendInitialEvents, &out.SendInitialEvents
+		*out = new(bool)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListOptions.
+func (in *ListOptions) DeepCopy() *ListOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(ListOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ListOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/OWNERS b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/OWNERS
new file mode 100644
index 0000000000..ec414a84b9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/OWNERS
@@ -0,0 +1,17 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+reviewers:
+  - thockin
+  - smarterclayton
+  - wojtek-t
+  - deads2k
+  - caesarxuchao
+  - liggitt
+  - sttts
+  - luxas
+  - janetkuo
+  - justinsb
+  - soltysh
+  - dims
+emeritus_reviewers:
+  - ncdc
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/controller_ref.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/controller_ref.go
new file mode 100644
index 0000000000..5005beb12d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/controller_ref.go
@@ -0,0 +1,68 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/utils/ptr"
+)
+
+// IsControlledBy checks if the  object has a controllerRef set to the given owner
+func IsControlledBy(obj Object, owner Object) bool {
+	ref := GetControllerOfNoCopy(obj)
+	if ref == nil {
+		return false
+	}
+	return ref.UID == owner.GetUID()
+}
+
+// GetControllerOf returns a pointer to a copy of the controllerRef if controllee has a controller
+func GetControllerOf(controllee Object) *OwnerReference {
+	ref := GetControllerOfNoCopy(controllee)
+	if ref == nil {
+		return nil
+	}
+	cp := *ref
+	cp.Controller = ptr.To(*ref.Controller)
+	if ref.BlockOwnerDeletion != nil {
+		cp.BlockOwnerDeletion = ptr.To(*ref.BlockOwnerDeletion)
+	}
+	return &cp
+}
+
+// GetControllerOfNoCopy returns a pointer to the controllerRef if controllee has a controller
+func GetControllerOfNoCopy(controllee Object) *OwnerReference {
+	refs := controllee.GetOwnerReferences()
+	for i := range refs {
+		if refs[i].Controller != nil && *refs[i].Controller {
+			return &refs[i]
+		}
+	}
+	return nil
+}
+
+// NewControllerRef creates an OwnerReference pointing to the given owner.
+func NewControllerRef(owner Object, gvk schema.GroupVersionKind) *OwnerReference {
+	return &OwnerReference{
+		APIVersion:         gvk.GroupVersion().String(),
+		Kind:               gvk.Kind,
+		Name:               owner.GetName(),
+		UID:                owner.GetUID(),
+		BlockOwnerDeletion: ptr.To(true),
+		Controller:         ptr.To(true),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/controller_ref_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/controller_ref_test.go
new file mode 100644
index 0000000000..3abfb9aa91
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/controller_ref_test.go
@@ -0,0 +1,173 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type metaObj struct {
+	ObjectMeta
+	TypeMeta
+}
+
+func TestNewControllerRef(t *testing.T) {
+	gvk := schema.GroupVersionKind{
+		Group:   "group",
+		Version: "v1",
+		Kind:    "Kind",
+	}
+	obj1 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			Name: "name",
+			UID:  "uid1",
+		},
+	}
+	controllerRef := NewControllerRef(obj1, gvk)
+	if controllerRef.UID != obj1.UID {
+		t.Errorf("Incorrect UID: %s", controllerRef.UID)
+	}
+	if controllerRef.Controller == nil || *controllerRef.Controller != true {
+		t.Error("Controller must be set to true")
+	}
+	if controllerRef.BlockOwnerDeletion == nil || *controllerRef.BlockOwnerDeletion != true {
+		t.Error("BlockOwnerDeletion must be set to true")
+	}
+	if controllerRef.APIVersion == "" ||
+		controllerRef.Kind == "" ||
+		controllerRef.Name == "" {
+		t.Errorf("All controllerRef fields must be set: %v", controllerRef)
+	}
+}
+
+func TestGetControllerOf(t *testing.T) {
+	gvk := schema.GroupVersionKind{
+		Group:   "group",
+		Version: "v1",
+		Kind:    "Kind",
+	}
+	obj1 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			UID:  "uid1",
+			Name: "name1",
+		},
+	}
+	controllerRef := NewControllerRef(obj1, gvk)
+	controllerRef.BlockOwnerDeletion = nil
+	var falseRef = false
+	obj2 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			UID:  "uid2",
+			Name: "name1",
+			OwnerReferences: []OwnerReference{
+				{
+					Name:       "owner1",
+					Controller: &falseRef,
+				},
+				*controllerRef,
+				{
+					Name:       "owner2",
+					Controller: &falseRef,
+				},
+			},
+		},
+	}
+
+	if GetControllerOf(obj1) != nil {
+		t.Error("GetControllerOf must return null")
+	}
+	c := GetControllerOf(obj2)
+	if c.Name != controllerRef.Name || c.UID != controllerRef.UID {
+		t.Errorf("Incorrect result of GetControllerOf: %v", c)
+	}
+
+	// test that all pointers are also deep copied
+	if (c.Controller == controllerRef.Controller) ||
+		(c.BlockOwnerDeletion != nil && c.BlockOwnerDeletion == controllerRef.BlockOwnerDeletion) {
+		t.Errorf("GetControllerOf did not return deep copy: %v", c)
+	}
+}
+
+func BenchmarkGetControllerOf(b *testing.B) {
+	gvk := schema.GroupVersionKind{
+		Group:   "group",
+		Version: "v1",
+		Kind:    "Kind",
+	}
+	obj1 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			UID:  "9d0cdf8a-dedc-11e9-bf91-42010a800167",
+			Name: "my-object",
+		},
+	}
+	controllerRef := NewControllerRef(obj1, gvk)
+	controllerRef2 := *controllerRef
+	controllerRef2.Controller = nil
+	obj2 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			UID:             "uid2",
+			Name:            "name1",
+			OwnerReferences: []OwnerReference{controllerRef2, controllerRef2, *controllerRef},
+		},
+	}
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for n := 0; n < b.N; n++ {
+		c := GetControllerOf(obj2)
+		if c.Name != controllerRef.Name || c.UID != controllerRef.UID {
+			b.Errorf("Incorrect result of GetControllerOf: %v", c)
+		}
+	}
+}
+
+func TestIsControlledBy(t *testing.T) {
+	gvk := schema.GroupVersionKind{
+		Group:   "group",
+		Version: "v1",
+		Kind:    "Kind",
+	}
+	obj1 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			UID: "uid1",
+		},
+	}
+	obj2 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			UID: "uid2",
+			OwnerReferences: []OwnerReference{
+				*NewControllerRef(obj1, gvk),
+			},
+		},
+	}
+	obj3 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			UID: "uid3",
+			OwnerReferences: []OwnerReference{
+				*NewControllerRef(obj2, gvk),
+			},
+		},
+	}
+	if !IsControlledBy(obj2, obj1) || !IsControlledBy(obj3, obj2) {
+		t.Error("Incorrect IsControlledBy result: false")
+	}
+	if IsControlledBy(obj3, obj1) {
+		t.Error("Incorrect IsControlledBy result: true")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/conversion.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/conversion.go
new file mode 100644
index 0000000000..8eaebb80e9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/conversion.go
@@ -0,0 +1,355 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"fmt"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/intstr"
+)
+
+func Convert_Pointer_float64_To_float64(in **float64, out *float64, s conversion.Scope) error {
+	if *in == nil {
+		*out = 0
+		return nil
+	}
+	*out = float64(**in)
+	return nil
+}
+
+func Convert_float64_To_Pointer_float64(in *float64, out **float64, s conversion.Scope) error {
+	temp := float64(*in)
+	*out = &temp
+	return nil
+}
+
+func Convert_Pointer_int32_To_int32(in **int32, out *int32, s conversion.Scope) error {
+	if *in == nil {
+		*out = 0
+		return nil
+	}
+	*out = int32(**in)
+	return nil
+}
+
+func Convert_int32_To_Pointer_int32(in *int32, out **int32, s conversion.Scope) error {
+	temp := int32(*in)
+	*out = &temp
+	return nil
+}
+
+func Convert_Pointer_int64_To_int64(in **int64, out *int64, s conversion.Scope) error {
+	if *in == nil {
+		*out = 0
+		return nil
+	}
+	*out = int64(**in)
+	return nil
+}
+
+func Convert_int64_To_Pointer_int64(in *int64, out **int64, s conversion.Scope) error {
+	temp := int64(*in)
+	*out = &temp
+	return nil
+}
+
+func Convert_Pointer_int64_To_int(in **int64, out *int, s conversion.Scope) error {
+	if *in == nil {
+		*out = 0
+		return nil
+	}
+	*out = int(**in)
+	return nil
+}
+
+func Convert_int_To_Pointer_int64(in *int, out **int64, s conversion.Scope) error {
+	temp := int64(*in)
+	*out = &temp
+	return nil
+}
+
+func Convert_Pointer_string_To_string(in **string, out *string, s conversion.Scope) error {
+	if *in == nil {
+		*out = ""
+		return nil
+	}
+	*out = **in
+	return nil
+}
+
+func Convert_string_To_Pointer_string(in *string, out **string, s conversion.Scope) error {
+	if in == nil {
+		stringVar := ""
+		*out = &stringVar
+		return nil
+	}
+	*out = in
+	return nil
+}
+
+func Convert_Pointer_bool_To_bool(in **bool, out *bool, s conversion.Scope) error {
+	if *in == nil {
+		*out = false
+		return nil
+	}
+	*out = **in
+	return nil
+}
+
+func Convert_bool_To_Pointer_bool(in *bool, out **bool, s conversion.Scope) error {
+	if in == nil {
+		boolVar := false
+		*out = &boolVar
+		return nil
+	}
+	*out = in
+	return nil
+}
+
+// +k8s:conversion-fn=drop
+func Convert_v1_TypeMeta_To_v1_TypeMeta(in, out *TypeMeta, s conversion.Scope) error {
+	// These values are explicitly not copied
+	//out.APIVersion = in.APIVersion
+	//out.Kind = in.Kind
+	return nil
+}
+
+// +k8s:conversion-fn=copy-only
+func Convert_v1_ListMeta_To_v1_ListMeta(in, out *ListMeta, s conversion.Scope) error {
+	*out = *in
+	return nil
+}
+
+// +k8s:conversion-fn=copy-only
+func Convert_v1_DeleteOptions_To_v1_DeleteOptions(in, out *DeleteOptions, s conversion.Scope) error {
+	*out = *in
+	return nil
+}
+
+// +k8s:conversion-fn=copy-only
+func Convert_intstr_IntOrString_To_intstr_IntOrString(in, out *intstr.IntOrString, s conversion.Scope) error {
+	*out = *in
+	return nil
+}
+
+func Convert_Pointer_intstr_IntOrString_To_intstr_IntOrString(in **intstr.IntOrString, out *intstr.IntOrString, s conversion.Scope) error {
+	if *in == nil {
+		*out = intstr.IntOrString{} // zero value
+		return nil
+	}
+	*out = **in // copy
+	return nil
+}
+
+func Convert_intstr_IntOrString_To_Pointer_intstr_IntOrString(in *intstr.IntOrString, out **intstr.IntOrString, s conversion.Scope) error {
+	temp := *in // copy
+	*out = &temp
+	return nil
+}
+
+// +k8s:conversion-fn=copy-only
+func Convert_v1_Time_To_v1_Time(in *Time, out *Time, s conversion.Scope) error {
+	// Cannot deep copy these, because time.Time has unexported fields.
+	*out = *in
+	return nil
+}
+
+// +k8s:conversion-fn=copy-only
+func Convert_v1_MicroTime_To_v1_MicroTime(in *MicroTime, out *MicroTime, s conversion.Scope) error {
+	// Cannot deep copy these, because time.Time has unexported fields.
+	*out = *in
+	return nil
+}
+
+func Convert_Pointer_v1_Duration_To_v1_Duration(in **Duration, out *Duration, s conversion.Scope) error {
+	if *in == nil {
+		*out = Duration{} // zero duration
+		return nil
+	}
+	*out = **in // copy
+	return nil
+}
+
+func Convert_v1_Duration_To_Pointer_v1_Duration(in *Duration, out **Duration, s conversion.Scope) error {
+	temp := *in //copy
+	*out = &temp
+	return nil
+}
+
+// Convert_Slice_string_To_v1_Time allows converting a URL query parameter value
+func Convert_Slice_string_To_v1_Time(in *[]string, out *Time, s conversion.Scope) error {
+	str := ""
+	if len(*in) > 0 {
+		str = (*in)[0]
+	}
+	return out.UnmarshalQueryParameter(str)
+}
+
+func Convert_Slice_string_To_Pointer_v1_Time(in *[]string, out **Time, s conversion.Scope) error {
+	if in == nil {
+		return nil
+	}
+	str := ""
+	if len(*in) > 0 {
+		str = (*in)[0]
+	}
+	temp := Time{}
+	if err := temp.UnmarshalQueryParameter(str); err != nil {
+		return err
+	}
+	*out = &temp
+	return nil
+}
+
+func Convert_string_To_labels_Selector(in *string, out *labels.Selector, s conversion.Scope) error {
+	selector, err := labels.Parse(*in)
+	if err != nil {
+		return err
+	}
+	*out = selector
+	return nil
+}
+
+func Convert_string_To_fields_Selector(in *string, out *fields.Selector, s conversion.Scope) error {
+	selector, err := fields.ParseSelector(*in)
+	if err != nil {
+		return err
+	}
+	*out = selector
+	return nil
+}
+
+func Convert_labels_Selector_To_string(in *labels.Selector, out *string, s conversion.Scope) error {
+	if *in == nil {
+		return nil
+	}
+	*out = (*in).String()
+	return nil
+}
+
+func Convert_fields_Selector_To_string(in *fields.Selector, out *string, s conversion.Scope) error {
+	if *in == nil {
+		return nil
+	}
+	*out = (*in).String()
+	return nil
+}
+
+// +k8s:conversion-fn=copy-only
+func Convert_resource_Quantity_To_resource_Quantity(in *resource.Quantity, out *resource.Quantity, s conversion.Scope) error {
+	*out = *in
+	return nil
+}
+
+func Convert_Map_string_To_string_To_v1_LabelSelector(in *map[string]string, out *LabelSelector, s conversion.Scope) error {
+	if in == nil {
+		return nil
+	}
+	for labelKey, labelValue := range *in {
+		AddLabelToSelector(out, labelKey, labelValue)
+	}
+	return nil
+}
+
+func Convert_v1_LabelSelector_To_Map_string_To_string(in *LabelSelector, out *map[string]string, s conversion.Scope) error {
+	var err error
+	*out, err = LabelSelectorAsMap(in)
+	return err
+}
+
+// Convert_Slice_string_To_Slice_int32 converts multiple query parameters or
+// a single query parameter with a comma delimited value to multiple int32.
+// This is used for port forwarding which needs the ports as int32.
+func Convert_Slice_string_To_Slice_int32(in *[]string, out *[]int32, s conversion.Scope) error {
+	for _, s := range *in {
+		for _, v := range strings.Split(s, ",") {
+			x, err := strconv.ParseUint(v, 10, 16)
+			if err != nil {
+				return fmt.Errorf("cannot convert to []int32: %v", err)
+			}
+			*out = append(*out, int32(x))
+		}
+	}
+	return nil
+}
+
+// Convert_Slice_string_To_Pointer_v1_DeletionPropagation allows converting a URL query parameter propagationPolicy
+func Convert_Slice_string_To_Pointer_v1_DeletionPropagation(in *[]string, out **DeletionPropagation, s conversion.Scope) error {
+	var str string
+	if len(*in) > 0 {
+		str = (*in)[0]
+	} else {
+		str = ""
+	}
+	temp := DeletionPropagation(str)
+	*out = &temp
+	return nil
+}
+
+// Convert_Slice_string_To_v1_IncludeObjectPolicy allows converting a URL query parameter value
+func Convert_Slice_string_To_v1_IncludeObjectPolicy(in *[]string, out *IncludeObjectPolicy, s conversion.Scope) error {
+	if len(*in) > 0 {
+		*out = IncludeObjectPolicy((*in)[0])
+	}
+	return nil
+}
+
+// Convert_url_Values_To_v1_DeleteOptions allows converting a URL to DeleteOptions.
+func Convert_url_Values_To_v1_DeleteOptions(in *url.Values, out *DeleteOptions, s conversion.Scope) error {
+	if err := autoConvert_url_Values_To_v1_DeleteOptions(in, out, s); err != nil {
+		return err
+	}
+
+	uid := types.UID("")
+	if values, ok := (*in)["uid"]; ok && len(values) > 0 {
+		uid = types.UID(values[0])
+	}
+
+	resourceVersion := ""
+	if values, ok := (*in)["resourceVersion"]; ok && len(values) > 0 {
+		resourceVersion = values[0]
+	}
+
+	if len(uid) > 0 || len(resourceVersion) > 0 {
+		if out.Preconditions == nil {
+			out.Preconditions = &Preconditions{}
+		}
+		if len(uid) > 0 {
+			out.Preconditions.UID = &uid
+		}
+		if len(resourceVersion) > 0 {
+			out.Preconditions.ResourceVersion = &resourceVersion
+		}
+	}
+	return nil
+}
+
+// Convert_Slice_string_To_v1_ResourceVersionMatch allows converting a URL query parameter to ResourceVersionMatch
+func Convert_Slice_string_To_v1_ResourceVersionMatch(in *[]string, out *ResourceVersionMatch, s conversion.Scope) error {
+	if len(*in) > 0 {
+		*out = ResourceVersionMatch((*in)[0])
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/conversion_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/conversion_test.go
new file mode 100644
index 0000000000..1063759972
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/conversion_test.go
@@ -0,0 +1,125 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1_test
+
+import (
+	"testing"
+	"time"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestMapToLabelSelectorRoundTrip(t *testing.T) {
+	// We should be able to round-trip a map-only selector through LabelSelector.
+	inputs := []map[string]string{
+		nil,
+		{},
+		{"one": "foo"},
+		{"one": "foo", "two": "bar"},
+	}
+	for _, in := range inputs {
+		ls := &v1.LabelSelector{}
+		if err := v1.Convert_Map_string_To_string_To_v1_LabelSelector(&in, ls, nil); err != nil {
+			t.Errorf("Convert_Map_string_To_string_To_v1_LabelSelector(%#v): %v", in, err)
+			continue
+		}
+		out := map[string]string{}
+		if err := v1.Convert_v1_LabelSelector_To_Map_string_To_string(ls, &out, nil); err != nil {
+			t.Errorf("Convert_v1_LabelSelector_To_Map_string_To_string(%#v): %v", ls, err)
+			continue
+		}
+		if !apiequality.Semantic.DeepEqual(in, out) {
+			t.Errorf("map-selector conversion round-trip failed: got %v; want %v", out, in)
+		}
+	}
+}
+
+func TestConvertSliceStringToDeletionPropagation(t *testing.T) {
+	tcs := []struct {
+		Input  []string
+		Output v1.DeletionPropagation
+	}{
+		{
+			Input:  nil,
+			Output: "",
+		},
+		{
+			Input:  []string{},
+			Output: "",
+		},
+		{
+			Input:  []string{"foo"},
+			Output: "foo",
+		},
+		{
+			Input:  []string{"bar", "foo"},
+			Output: "bar",
+		},
+	}
+
+	for _, tc := range tcs {
+		var dpPtr *v1.DeletionPropagation
+		if err := v1.Convert_Slice_string_To_Pointer_v1_DeletionPropagation(&tc.Input, &dpPtr, nil); err != nil {
+			t.Errorf("Convert_Slice_string_To_Pointer_v1_DeletionPropagation(%#v): %v", tc.Input, err)
+			continue
+		}
+		if !apiequality.Semantic.DeepEqual(dpPtr, &tc.Output) {
+			t.Errorf("slice string to DeletionPropagation conversion failed: got %v; want %v", *dpPtr, tc.Output)
+		}
+	}
+}
+
+func TestConvertSliceStringToPointerTime(t *testing.T) {
+	t1 := v1.Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC)
+	t1String := t1.Format(time.RFC3339)
+	t2 := v1.Date(2000, time.June, 6, 6, 6, 6, 0, time.UTC)
+	t2String := t2.Format(time.RFC3339)
+
+	tcs := []struct {
+		Input  []string
+		Output *v1.Time
+	}{
+		{
+			Input:  []string{},
+			Output: &v1.Time{},
+		},
+		{
+			Input:  []string{""},
+			Output: &v1.Time{},
+		},
+		{
+			Input:  []string{t1String},
+			Output: &t1,
+		},
+		{
+			Input:  []string{t1String, t2String},
+			Output: &t1,
+		},
+	}
+
+	for _, tc := range tcs {
+		var timePtr *v1.Time
+		if err := v1.Convert_Slice_string_To_Pointer_v1_Time(&tc.Input, &timePtr, nil); err != nil {
+			t.Errorf("Convert_Slice_string_To_Pointer_v1_Time(%#v): %v", tc.Input, err)
+			continue
+		}
+		if !apiequality.Semantic.DeepEqual(timePtr, tc.Output) {
+			t.Errorf("slice string to *v1.Time conversion failed: got %#v; want %#v", timePtr, tc.Output)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/deepcopy.go
new file mode 100644
index 0000000000..8751d0524f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/deepcopy.go
@@ -0,0 +1,46 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func (in *TableRow) DeepCopy() *TableRow {
+	if in == nil {
+		return nil
+	}
+
+	out := new(TableRow)
+
+	if in.Cells != nil {
+		out.Cells = make([]interface{}, len(in.Cells))
+		for i := range in.Cells {
+			out.Cells[i] = runtime.DeepCopyJSONValue(in.Cells[i])
+		}
+	}
+
+	if in.Conditions != nil {
+		out.Conditions = make([]TableRowCondition, len(in.Conditions))
+		for i := range in.Conditions {
+			in.Conditions[i].DeepCopyInto(&out.Conditions[i])
+		}
+	}
+
+	in.Object.DeepCopyInto(&out.Object)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/doc.go
new file mode 100644
index 0000000000..31c87361f6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/doc.go
@@ -0,0 +1,25 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:conversion-gen=false
+// +k8s:deepcopy-gen=package
+// +k8s:openapi-gen=true
+// +k8s:defaulter-gen=TypeMeta
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.apis.meta.v1
+
+// +groupName=meta.k8s.io
+
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/duration.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/duration.go
new file mode 100644
index 0000000000..a22b07878f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/duration.go
@@ -0,0 +1,65 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"time"
+)
+
+// Duration is a wrapper around time.Duration which supports correct
+// marshaling to YAML and JSON. In particular, it marshals into strings, which
+// can be used as map keys in json.
+type Duration struct {
+	time.Duration `protobuf:"varint,1,opt,name=duration,casttype=time.Duration"`
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+func (d *Duration) UnmarshalJSON(b []byte) error {
+	var str string
+	err := json.Unmarshal(b, &str)
+	if err != nil {
+		return err
+	}
+
+	pd, err := time.ParseDuration(str)
+	if err != nil {
+		return err
+	}
+	d.Duration = pd
+	return nil
+}
+
+// MarshalJSON implements the json.Marshaler interface.
+func (d Duration) MarshalJSON() ([]byte, error) {
+	return json.Marshal(d.Duration.String())
+}
+
+// ToUnstructured implements the value.UnstructuredConverter interface.
+func (d Duration) ToUnstructured() interface{} {
+	return d.Duration.String()
+}
+
+// OpenAPISchemaType is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+//
+// See: https://github.com/kubernetes/kube-openapi/tree/master/pkg/generators
+func (_ Duration) OpenAPISchemaType() []string { return []string{"string"} }
+
+// OpenAPISchemaFormat is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+func (_ Duration) OpenAPISchemaFormat() string { return "" }
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/duration_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/duration_test.go
new file mode 100644
index 0000000000..34ca6b5ded
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/duration_test.go
@@ -0,0 +1,153 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"sigs.k8s.io/yaml"
+)
+
+type DurationHolder struct {
+	D Duration `json:"d"`
+}
+
+func TestDurationMarshalYAML(t *testing.T) {
+	cases := []struct {
+		input  Duration
+		result string
+	}{
+		{Duration{5 * time.Second}, "d: 5s\n"},
+		{Duration{2 * time.Minute}, "d: 2m0s\n"},
+		{Duration{time.Hour + 3*time.Millisecond}, "d: 1h0m0.003s\n"},
+	}
+
+	for _, c := range cases {
+		input := DurationHolder{c.input}
+		result, err := yaml.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input: %q: %v", input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("Failed to marshal input: %q: expected %q, got %q", input, c.result, string(result))
+		}
+	}
+}
+
+func TestDurationUnmarshalYAML(t *testing.T) {
+	cases := []struct {
+		input  string
+		result Duration
+	}{
+		{"d: 0s\n", Duration{}},
+		{"d: 5s\n", Duration{5 * time.Second}},
+		{"d: 2m0s\n", Duration{2 * time.Minute}},
+		{"d: 1h0m0.003s\n", Duration{time.Hour + 3*time.Millisecond}},
+
+		// Units with zero values can optionally be dropped
+		{"d: 2m\n", Duration{2 * time.Minute}},
+		{"d: 1h0.003s\n", Duration{time.Hour + 3*time.Millisecond}},
+	}
+
+	for _, c := range cases {
+		var result DurationHolder
+		if err := yaml.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("Failed to unmarshal input %q: %v", c.input, err)
+		}
+		if result.D != c.result {
+			t.Errorf("Failed to unmarshal input %q: expected %q, got %q", c.input, c.result, result)
+		}
+	}
+}
+
+func TestDurationMarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  Duration
+		result string
+	}{
+		{Duration{5 * time.Second}, `{"d":"5s"}`},
+		{Duration{2 * time.Minute}, `{"d":"2m0s"}`},
+		{Duration{time.Hour + 3*time.Millisecond}, `{"d":"1h0m0.003s"}`},
+	}
+
+	for _, c := range cases {
+		input := DurationHolder{c.input}
+		result, err := json.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input: %q: %v", input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("Failed to marshal input: %q: expected %q, got %q", input, c.result, string(result))
+		}
+	}
+}
+
+func TestDurationUnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  string
+		result Duration
+	}{
+		{`{"d":"0s"}`, Duration{}},
+		{`{"d":"5s"}`, Duration{5 * time.Second}},
+		{`{"d":"2m0s"}`, Duration{2 * time.Minute}},
+		{`{"d":"1h0m0.003s"}`, Duration{time.Hour + 3*time.Millisecond}},
+
+		// Units with zero values can optionally be dropped
+		{`{"d":"2m"}`, Duration{2 * time.Minute}},
+		{`{"d":"1h0.003s"}`, Duration{time.Hour + 3*time.Millisecond}},
+	}
+
+	for _, c := range cases {
+		var result DurationHolder
+		if err := json.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("Failed to unmarshal input %q: %v", c.input, err)
+		}
+		if result.D != c.result {
+			t.Errorf("Failed to unmarshal input %q: expected %q, got %q", c.input, c.result, result)
+		}
+	}
+}
+
+func TestDurationMarshalJSONUnmarshalYAML(t *testing.T) {
+	cases := []struct {
+		input Duration
+	}{
+		{Duration{}},
+		{Duration{5 * time.Second}},
+		{Duration{2 * time.Minute}},
+		{Duration{time.Hour + 3*time.Millisecond}},
+	}
+
+	for i, c := range cases {
+		input := DurationHolder{c.input}
+		jsonMarshalled, err := json.Marshal(&input)
+		if err != nil {
+			t.Errorf("%d-1: Failed to marshal input: '%v': %v", i, input, err)
+		}
+
+		var result DurationHolder
+		if err := yaml.Unmarshal(jsonMarshalled, &result); err != nil {
+			t.Errorf("%d-2: Failed to unmarshal '%+v': %v", i, string(jsonMarshalled), err)
+		}
+
+		if input.D != result.D {
+			t.Errorf("%d-4: Failed to marshal input '%#v': got %#v", i, input, result)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1.go
new file mode 100644
index 0000000000..81aca59fac
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1.go
@@ -0,0 +1,170 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"fmt"
+	"io"
+)
+
+func (FieldsV1) SwaggerDoc() map[string]string {
+	return map[string]string{
+		"": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:<name>', where <name> is the name of a field in a struct, or key in a map 'v:<value>', where <value> is the exact json formatted value of a list item 'i:<index>', where <index> is position of a item in a list 'k:<keys>', where <keys> is a map of  a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff",
+	}
+}
+
+type FieldsV1Reader interface {
+	io.Reader
+	io.ReaderAt
+	// Size returns the original byte length of the underlying data. Size is the number of bytes available for reading via ReadAt.
+	Size() int64
+}
+
+func (f *FieldsV1) DeepCopy() *FieldsV1 {
+	if f == nil {
+		return nil
+	}
+	out := new(FieldsV1)
+	f.DeepCopyInto(out)
+	return out
+}
+
+func (f *FieldsV1) Marshal() (dAtA []byte, err error) {
+	size := f.Size()
+	dAtA = make([]byte, size)
+	n, err := f.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (f *FieldsV1) MarshalTo(dAtA []byte) (int, error) {
+	size := f.Size()
+	return f.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (f *FieldsV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	rawBytes := f.GetRawBytes()
+	if len(rawBytes) > 0 {
+		i -= len(rawBytes)
+		copy(dAtA[i:], rawBytes)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(rawBytes)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (f *FieldsV1) Size() (n int) {
+	if f == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if l := int(f.GetRawReader().Size()); l > 0 {
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (f *FieldsV1) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: FieldsV1: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: FieldsV1: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Raw", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+
+			f.SetRawBytes(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_benchmark_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_benchmark_test.go
new file mode 100644
index 0000000000..812c181627
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_benchmark_test.go
@@ -0,0 +1,118 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+var benchmarkPayloads = []string{
+	// Small managed fields payload
+	`{"f:metadata":{"f:labels":{"f:app":{}},"f:annotations":{"f:revision":{}}},"f:spec":{"f:replicas":{},"f:template":{"f:metadata":{"f:labels":{"f:app":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"nginx\"}":{".":{},"f:image":{},"f:name":{}}}}}}}`,
+	// Larger, deeply nested valid JSON payload (representing complex managedFields)
+	`{"f:metadata":{"f:annotations":{".":{},"f:kubectl.kubernetes.io/last-applied-configuration":{}},"f:labels":{".":{},"f:app.kubernetes.io/name":{}}},"f:spec":{"f:replicas":{},"f:selector":{},"f:template":{"f:metadata":{"f:labels":{".":{},"f:app.kubernetes.io/name":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"app\"}":{".":{},"f:image":{},"f:name":{},"f:ports":{".":{},"k:{\"containerPort\":8080,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:protocol":{}}},"f:resources":{".":{},"f:limits":{".":{},"f:cpu":{},"f:memory":{}},"f:requests":{".":{},"f:cpu":{},"f:memory":{}}}}}}}}}`,
+}
+
+// BenchmarkDecodeDuplicate measures the allocation and speed of unmarshaling
+// exactly identical payloads repeatedly, which is the most common case for
+// heavily replicated resources (DaemonSets, ReplicaSets) in the API server.
+func BenchmarkDecodeDuplicate(b *testing.B) {
+	for _, payload := range benchmarkPayloads {
+		b.Run(fmt.Sprintf("Size%d", len(payload)), func(b *testing.B) {
+			rawJSON := []byte(payload)
+			b.ResetTimer()
+			b.ReportAllocs()
+			var retained []metav1.FieldsV1
+			for j := 0; j < b.N; j++ {
+				var f metav1.FieldsV1
+				if err := json.Unmarshal(rawJSON, &f); err != nil {
+					b.Fatal(err)
+				}
+				retained = append(retained, f)
+			}
+			_ = retained
+		})
+	}
+}
+
+// BenchmarkDecodeUnique measures the allocation and speed of unmarshaling
+// completely unique payloads to measure the worst-case interning overhead.
+func BenchmarkDecodeUnique(b *testing.B) {
+	for _, payload := range benchmarkPayloads {
+		b.Run(fmt.Sprintf("Size%d", len(payload)), func(b *testing.B) {
+			b.ResetTimer()
+			b.ReportAllocs()
+			var retained []metav1.FieldsV1
+			for j := 0; j < b.N; j++ {
+				// Inject the iteration counter to guarantee the string is unique
+				novelPayload := fmt.Appendf(nil, `{"f:iter":%d,%s`, j, payload[1:])
+				var f metav1.FieldsV1
+				if err := json.Unmarshal(novelPayload, &f); err != nil {
+					b.Fatal(err)
+				}
+				retained = append(retained, f)
+			}
+			_ = retained
+		})
+	}
+}
+
+// BenchmarkParallelDecode tests parallel deserialization of duplicate strings
+// to verify lock contention behavior in highly concurrent environments.
+func BenchmarkParallelDecode(b *testing.B) {
+	for _, payload := range benchmarkPayloads {
+		b.Run(fmt.Sprintf("Size%d", len(payload)), func(b *testing.B) {
+			rawJSON := []byte(payload)
+			b.ResetTimer()
+			b.ReportAllocs()
+			b.RunParallel(func(pb *testing.PB) {
+				for pb.Next() {
+					var f metav1.FieldsV1
+					if err := json.Unmarshal(rawJSON, &f); err != nil {
+						b.Fatal(err)
+					}
+				}
+			})
+		})
+	}
+}
+
+// BenchmarkEqual_Same measures the fast-path equality check for identical structs.
+func BenchmarkEqual_Same(b *testing.B) {
+	f1 := metav1.NewFieldsV1(benchmarkPayloads[1])
+	f2 := metav1.NewFieldsV1(benchmarkPayloads[1])
+	b.ResetTimer()
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		_ = f1.Equal(*f2)
+	}
+}
+
+// BenchmarkEqual_Different measures the fallback-path equality check for differing structs.
+func BenchmarkEqual_Different(b *testing.B) {
+	f1 := metav1.NewFieldsV1(benchmarkPayloads[1])
+	f2 := metav1.NewFieldsV1(benchmarkPayloads[0])
+	b.ResetTimer()
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		_ = f1.Equal(*f2)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_byte.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_byte.go
new file mode 100644
index 0000000000..66f28e1d9f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_byte.go
@@ -0,0 +1,105 @@
+//go:build !fieldsv1string
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"bytes"
+)
+
+// FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.
+//
+// Each key is either a '.' representing the field itself, and will always map to an empty set,
+// or a string representing a sub-field or item. The string will follow one of these four formats:
+// 'f:<name>', where <name> is the name of a field in a struct, or key in a map
+// 'v:<value>', where <value> is the exact json formatted value of a list item
+// 'i:<index>', where <index> is position of a item in a list
+// 'k:<keys>', where <keys> is a map of  a list item's key fields to their unique values
+// If a key maps to an empty Fields value, the field that key represents is part of the set.
+//
+// The exact format is defined in sigs.k8s.io/structured-merge-diff
+// +k8s:deepcopy-gen=false
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type FieldsV1 struct {
+	// Raw is the underlying serialization of this object.
+	//
+	// Deprecated: Direct access to this field is deprecated. Use GetRawBytes, GetRawString, SetRawBytes, SetRawString, GetRawReader, NewFieldsV1 instead.
+	Raw []byte `json:"-" protobuf:"bytes,1,opt,name=Raw"`
+}
+
+func (f FieldsV1) String() string {
+	return string(f.Raw)
+}
+
+func (f FieldsV1) Equal(f2 FieldsV1) bool {
+	return bytes.Equal(f.Raw, f2.Raw)
+}
+
+func (f *FieldsV1) GetRawReader() FieldsV1Reader {
+	if f == nil || len(f.Raw) == 0 {
+		return bytes.NewReader(nil)
+	}
+	return bytes.NewReader(f.Raw)
+}
+
+// GetRawBytes returns the raw bytes.
+// These may or may not be a copy of the underlying bytes.
+// If mutating the underlying bytes is desired, the returned bytes may be mutated and then passed to SetRawBytes().
+// If mutating the underlying bytes is not desired, make a copy of the returned bytes.
+func (f *FieldsV1) GetRawBytes() []byte {
+	if f == nil {
+		return nil
+	}
+	return f.Raw
+}
+
+// GetRawString returns the raw data as a string.
+func (f *FieldsV1) GetRawString() string {
+	if f == nil {
+		return ""
+	}
+	return string(f.Raw)
+}
+
+// SetRawBytes sets the raw bytes. It does not retain the passed-in byte slice.
+func (f *FieldsV1) SetRawBytes(b []byte) {
+	if f != nil {
+		f.Raw = bytes.Clone(b)
+	}
+}
+
+// SetRawString sets the raw data from a string.
+func (f *FieldsV1) SetRawString(s string) {
+	if f != nil {
+		f.Raw = []byte(s)
+	}
+}
+
+func NewFieldsV1(raw string) *FieldsV1 {
+	return &FieldsV1{Raw: []byte(raw)}
+}
+
+func (f *FieldsV1) DeepCopyInto(out *FieldsV1) {
+	*out = *f
+	if f.Raw != nil {
+		in, out := &f.Raw, &out.Raw
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_string.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_string.go
new file mode 100644
index 0000000000..679452ae17
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_string.go
@@ -0,0 +1,113 @@
+//go:build fieldsv1string
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"strings"
+	"unique"
+)
+
+// FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.
+//
+// Each key is either a '.' representing the field itself, and will always map to an empty set,
+// or a string representing a sub-field or item. The string will follow one of these four formats:
+// 'f:<name>', where <name> is the name of a field in a struct, or key in a map
+// 'v:<value>', where <value> is the exact json formatted value of a list item
+// 'i:<index>', where <index> is position of a item in a list
+// 'k:<keys>', where <keys> is a map of  a list item's key fields to their unique values
+// If a key maps to an empty Fields value, the field that key represents is part of the set.
+//
+// The exact format is defined in sigs.k8s.io/structured-merge-diff
+// +k8s:deepcopy-gen=false
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type FieldsV1 struct {
+	// The zero value of a unique.Handle[string] has an uninitialized underlying pointer.
+	// Calling .Value() on it panics. We must explicitly check for this uninitialized
+	// state (f.handle == unique.Handle[string]{}) across accessors to safely support
+	// uninitialized metav1.FieldsV1{} objects.
+	// See ongoing golang discussion related to this here: https://github.com/golang/go/issues/73344
+	handle unique.Handle[string]
+}
+
+func (f FieldsV1) String() string {
+	if f.handle == (unique.Handle[string]{}) {
+		return ""
+	}
+	return f.handle.Value()
+}
+
+func (f FieldsV1) Equal(f2 FieldsV1) bool {
+	if f.handle == f2.handle {
+		return true
+	}
+	// An uninitialized FieldsV1 compared to an explicitly empty
+	// FieldsV1 (unique.Make("") will fail the handle check above.
+	// Evaluate string contents directly as well to maintain parity with legacy
+	// bytes.Equal(nil, []byte{}) == true behavior.
+	return f.GetRawString() == f2.GetRawString()
+}
+
+func (f *FieldsV1) GetRawReader() FieldsV1Reader {
+	if f == nil || f.handle == (unique.Handle[string]{}) {
+		return strings.NewReader("")
+	}
+	return strings.NewReader(f.handle.Value())
+}
+
+// GetRawBytes returns the raw bytes.
+// These may or may not be a copy of the underlying bytes.
+// If mutating the underlying bytes is desired, the returned bytes may be mutated and then passed to SetRawBytes().
+// If mutating the underlying bytes is not desired, make a copy of the returned bytes.
+func (f *FieldsV1) GetRawBytes() []byte {
+	if f == nil || f.handle == (unique.Handle[string]{}) {
+		return nil
+	}
+	return []byte(f.handle.Value())
+}
+
+// GetRawString returns the raw data as a string.
+func (f *FieldsV1) GetRawString() string {
+	if f == nil || f.handle == (unique.Handle[string]{}) {
+		return ""
+	}
+	return f.handle.Value()
+}
+
+// SetRawBytes sets the raw bytes. It does not retain the passed-in byte slice.
+func (f *FieldsV1) SetRawBytes(b []byte) {
+	if f != nil {
+		f.handle = unique.Make(string(b))
+	}
+}
+
+// SetRawString sets the raw data from a string.
+func (f *FieldsV1) SetRawString(s string) {
+	if f != nil {
+		f.handle = unique.Make(s)
+	}
+}
+
+func NewFieldsV1(raw string) *FieldsV1 {
+	return &FieldsV1{handle: unique.Make(raw)}
+}
+
+func (f *FieldsV1) DeepCopyInto(out *FieldsV1) {
+	*out = *f
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_string_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_string_test.go
new file mode 100644
index 0000000000..384951673a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_string_test.go
@@ -0,0 +1,362 @@
+//go:build fieldsv1string
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"testing"
+	"unsafe"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// requireInterned fails the test if the two strings do not point to the exact same memory address.
+func requireInterned(t *testing.T, a, b string) {
+	t.Helper()
+	ptrA := unsafe.StringData(a)
+	ptrB := unsafe.StringData(b)
+	if ptrA != ptrB {
+		t.Fatalf("Expected strings to be interned (same memory address) but pointers differ: %p != %p", ptrA, ptrB)
+	}
+}
+
+func TestFieldsV1_String(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		f        metav1.FieldsV1
+		expected string
+	}{
+		{
+			name:     "zero value handle",
+			f:        metav1.FieldsV1{},
+			expected: "",
+		},
+		{
+			name:     "initialized empty handle",
+			f:        *metav1.NewFieldsV1(""),
+			expected: "",
+		},
+		{
+			name:     "valid payload",
+			f:        *metav1.NewFieldsV1(`{"f:app":{}}`),
+			expected: `{"f:app":{}}`,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := tc.f.String(); got != tc.expected {
+				t.Errorf("expected %q, got %q", tc.expected, got)
+			}
+		})
+	}
+}
+
+func TestFieldsV1_Equal(t *testing.T) {
+	valid := *metav1.NewFieldsV1(`{"f:app":{}}`)
+	validClone := *metav1.NewFieldsV1(`{"f:app":{}}`)
+	different := *metav1.NewFieldsV1(`{"f:other":{}}`)
+
+	for _, tc := range []struct {
+		name     string
+		a        metav1.FieldsV1
+		b        metav1.FieldsV1
+		expected bool
+	}{
+		{"both zero value", metav1.FieldsV1{}, metav1.FieldsV1{}, true},
+		{"zero value and initialized empty handle", metav1.FieldsV1{}, *metav1.NewFieldsV1(""), true},
+		{"identical valid payloads", valid, validClone, true},
+		{"different payloads", valid, different, false},
+		{"zero value and valid payload", metav1.FieldsV1{}, valid, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := tc.a.Equal(tc.b); got != tc.expected {
+				t.Errorf("expected Equal() to be %v, got %v", tc.expected, got)
+			}
+			// Commutative property
+			if got := tc.b.Equal(tc.a); got != tc.expected {
+				t.Errorf("expected Equal() commutative to be %v, got %v", tc.expected, got)
+			}
+		})
+	}
+}
+
+func TestFieldsV1_GetRawReader(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		f        *metav1.FieldsV1
+		expected []byte
+	}{
+		{"nil receiver", nil, []byte("")},
+		{"zero value handle", &metav1.FieldsV1{}, []byte("")},
+		{"initialized empty handle", metav1.NewFieldsV1(""), []byte("")},
+		{"valid payload", metav1.NewFieldsV1(`{"f:app":{}}`), []byte(`{"f:app":{}}`)},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			reader := tc.f.GetRawReader()
+			got, err := io.ReadAll(reader)
+			if err != nil {
+				t.Fatalf("unexpected error reading from RawReader: %v", err)
+			}
+			if !bytes.Equal(got, tc.expected) {
+				t.Errorf("expected %q, got %q", tc.expected, got)
+			}
+		})
+	}
+}
+
+func TestFieldsV1_GetRawBytes(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		f        *metav1.FieldsV1
+		expected []byte
+	}{
+		{"nil receiver", nil, nil},
+		{"zero value handle", &metav1.FieldsV1{}, nil},
+		{"initialized empty handle", metav1.NewFieldsV1(""), []byte{}},
+		{"valid payload", metav1.NewFieldsV1(`{"f:app":{}}`), []byte(`{"f:app":{}}`)},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got := tc.f.GetRawBytes()
+			if !bytes.Equal(got, tc.expected) {
+				t.Errorf("expected %v, got %v", tc.expected, got)
+			}
+			// Explicitly check for nil
+			if tc.expected == nil && got != nil {
+				t.Errorf("expected strict nil, got %v", got)
+			}
+		})
+	}
+
+	t.Run("mutation safety", func(t *testing.T) {
+		f := metav1.NewFieldsV1(`{"f:app":{}}`)
+		b := f.GetRawBytes()
+
+		// Mutate the returned bytes
+		b[2] = 'X'
+
+		// The original interned string must remain unchanged
+		if got := f.GetRawString(); got != `{"f:app":{}}` {
+			t.Errorf("GetRawBytes returned an unisolated slice! Mutating it corrupted the handle. Got: %s", got)
+		}
+	})
+}
+
+func TestFieldsV1_GetRawString(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		f        *metav1.FieldsV1
+		expected string
+	}{
+		{"nil receiver", nil, ""},
+		{"zero value handle", &metav1.FieldsV1{}, ""},
+		{"initialized empty handle", metav1.NewFieldsV1(""), ""},
+		{"valid payload", metav1.NewFieldsV1(`{"f:app":{}}`), `{"f:app":{}}`},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := tc.f.GetRawString(); got != tc.expected {
+				t.Errorf("expected %q, got %q", tc.expected, got)
+			}
+		})
+	}
+}
+
+func TestFieldsV1_SetRawBytes(t *testing.T) {
+	t.Run("nil receiver", func(t *testing.T) {
+		var f *metav1.FieldsV1        // nil
+		f.SetRawBytes([]byte("test")) // Should not panic
+	})
+
+	t.Run("empty slice input", func(t *testing.T) {
+		f := &metav1.FieldsV1{}
+		f.SetRawBytes([]byte{})
+		if f.GetRawString() != "" {
+			t.Errorf("Expected empty string, got %q", f.GetRawString())
+		}
+	})
+
+	t.Run("nil slice input", func(t *testing.T) {
+		f := &metav1.FieldsV1{}
+		f.SetRawBytes(nil)
+		if f.GetRawString() != "" {
+			t.Errorf("Expected empty string, got %q", f.GetRawString())
+		}
+	})
+
+	t.Run("interning behavior", func(t *testing.T) {
+		payload := []byte(`{"f:app":{}}`)
+
+		// Two distinct slices with identical content
+		b1 := append([]byte(nil), payload...)
+		b2 := append([]byte(nil), payload...)
+
+		f1 := &metav1.FieldsV1{}
+		f1.SetRawBytes(b1)
+
+		f2 := &metav1.FieldsV1{}
+		f2.SetRawBytes(b2)
+
+		if f1.GetRawString() != string(payload) {
+			t.Errorf("Expected GetRawString to match payload, got %q", f1.GetRawString())
+		}
+
+		requireInterned(t, f1.GetRawString(), f2.GetRawString())
+	})
+}
+
+func TestFieldsV1_SetRawString(t *testing.T) {
+	t.Run("nil receiver", func(t *testing.T) {
+		var f *metav1.FieldsV1 // nil
+		f.SetRawString("test") // Should not panic
+	})
+
+	t.Run("interning behavior", func(t *testing.T) {
+		payload := `{"f:app":{}}`
+
+		// Force string copy to avoid compiler static string optimization if possible
+		s1 := string(append([]byte(nil), payload...))
+		s2 := string(append([]byte(nil), payload...))
+
+		f1 := &metav1.FieldsV1{}
+		f1.SetRawString(s1)
+
+		f2 := &metav1.FieldsV1{}
+		f2.SetRawString(s2)
+
+		requireInterned(t, f1.GetRawString(), f2.GetRawString())
+	})
+}
+
+func TestFieldsV1_NewFieldsV1(t *testing.T) {
+	t.Run("interning behavior", func(t *testing.T) {
+		payload := `{"f:app":{}}`
+		s1 := string(append([]byte(nil), payload...))
+		s2 := string(append([]byte(nil), payload...))
+
+		f1 := metav1.NewFieldsV1(s1)
+		f2 := metav1.NewFieldsV1(s2)
+
+		requireInterned(t, f1.GetRawString(), f2.GetRawString())
+	})
+}
+
+func TestFieldsV1_DeepCopyInto(t *testing.T) {
+	t.Run("preserves interning", func(t *testing.T) {
+		orig := metav1.NewFieldsV1(`{"f:app":{}}`)
+		var clone metav1.FieldsV1
+		orig.DeepCopyInto(&clone)
+
+		if orig.GetRawString() != clone.GetRawString() {
+			t.Fatalf("Expected strings to match after DeepCopyInto, got %q and %q", orig.GetRawString(), clone.GetRawString())
+		}
+
+		requireInterned(t, orig.GetRawString(), clone.GetRawString())
+	})
+
+	t.Run("zero value deep copy", func(t *testing.T) {
+		var orig metav1.FieldsV1
+		var clone metav1.FieldsV1
+		orig.DeepCopyInto(&clone)
+
+		if clone.GetRawString() != "" {
+			t.Errorf("Expected empty string from cloned zero-value, got %q", clone.GetRawString())
+		}
+		if !orig.Equal(clone) {
+			t.Errorf("Expected original zero-value and its clone to be equal")
+		}
+	})
+
+	t.Run("independence after deep copy", func(t *testing.T) {
+		orig := metav1.NewFieldsV1(`{"f:app":{}}`)
+		var clone metav1.FieldsV1
+		orig.DeepCopyInto(&clone)
+
+		// Modify the clone
+		clone.SetRawString(`{"f:new":{}}`)
+
+		// The original should be completely untouched
+		if got := orig.GetRawString(); got != `{"f:app":{}}` {
+			t.Errorf("DeepCopyInto failed to isolate clone! Modifying clone corrupted original. Got: %s", got)
+		}
+	})
+}
+func TestFieldsV1_UnmarshalInterning(t *testing.T) {
+	jsonPayload := []byte(`{"f:metadata":{"f:labels":{"f:app":{}}}}`)
+	orig := metav1.NewFieldsV1(string(jsonPayload))
+
+	protoPayload, err := orig.Marshal()
+	if err != nil {
+		t.Fatalf("Failed to marshal protobuf payload during setup: %v", err)
+	}
+
+	cborPayload, err := orig.MarshalCBOR()
+	if err != nil {
+		t.Fatalf("Failed to marshal CBOR payload during setup: %v", err)
+	}
+
+	tests := []struct {
+		name      string
+		payload   []byte
+		unmarshal func(t *testing.T, f *metav1.FieldsV1, payload []byte)
+	}{
+		{
+			name:    "json unmarshal",
+			payload: jsonPayload,
+			unmarshal: func(t *testing.T, f *metav1.FieldsV1, payload []byte) {
+				if err := json.Unmarshal(payload, f); err != nil {
+					t.Fatalf("JSON Unmarshal failed: %v", err)
+				}
+			},
+		},
+		{
+			name:    "protobuf unmarshal",
+			payload: protoPayload,
+			unmarshal: func(t *testing.T, f *metav1.FieldsV1, payload []byte) {
+				if err := f.Unmarshal(payload); err != nil {
+					t.Fatalf("Protobuf Unmarshal failed: %v", err)
+				}
+			},
+		},
+		{
+			name:    "cbor unmarshal",
+			payload: cborPayload,
+			unmarshal: func(t *testing.T, f *metav1.FieldsV1, payload []byte) {
+				if err := f.UnmarshalCBOR(payload); err != nil {
+					t.Fatalf("CBOR Unmarshal failed: %v", err)
+				}
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			// Ensure independent slice memory
+			b1 := append([]byte(nil), tc.payload...)
+			b2 := append([]byte(nil), tc.payload...)
+
+			var f1 metav1.FieldsV1
+			var f2 metav1.FieldsV1
+
+			tc.unmarshal(t, &f1, b1)
+			tc.unmarshal(t, &f2, b2)
+
+			requireInterned(t, f1.GetRawString(), f2.GetRawString())
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/generated.pb.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/generated.pb.go
new file mode 100644
index 0000000000..293b0223a7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/generated.pb.go
@@ -0,0 +1,10536 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto
+
+package v1
+
+import (
+	fmt "fmt"
+
+	io "io"
+	"sort"
+
+	runtime "k8s.io/apimachinery/pkg/runtime"
+
+	math_bits "math/bits"
+	reflect "reflect"
+	strings "strings"
+	time "time"
+
+	k8s_io_apimachinery_pkg_types "k8s.io/apimachinery/pkg/types"
+)
+
+func (m *APIGroup) Reset() { *m = APIGroup{} }
+
+func (m *APIGroupList) Reset() { *m = APIGroupList{} }
+
+func (m *APIResource) Reset() { *m = APIResource{} }
+
+func (m *APIResourceList) Reset() { *m = APIResourceList{} }
+
+func (m *APIVersions) Reset() { *m = APIVersions{} }
+
+func (m *ApplyOptions) Reset() { *m = ApplyOptions{} }
+
+func (m *Condition) Reset() { *m = Condition{} }
+
+func (m *CreateOptions) Reset() { *m = CreateOptions{} }
+
+func (m *DeleteOptions) Reset() { *m = DeleteOptions{} }
+
+func (m *Duration) Reset() { *m = Duration{} }
+
+func (m *FieldSelectorRequirement) Reset() { *m = FieldSelectorRequirement{} }
+
+func (m *FieldsV1) Reset() { *m = FieldsV1{} }
+
+func (m *GetOptions) Reset() { *m = GetOptions{} }
+
+func (m *GroupKind) Reset() { *m = GroupKind{} }
+
+func (m *GroupResource) Reset() { *m = GroupResource{} }
+
+func (m *GroupVersion) Reset() { *m = GroupVersion{} }
+
+func (m *GroupVersionForDiscovery) Reset() { *m = GroupVersionForDiscovery{} }
+
+func (m *GroupVersionKind) Reset() { *m = GroupVersionKind{} }
+
+func (m *GroupVersionResource) Reset() { *m = GroupVersionResource{} }
+
+func (m *LabelSelector) Reset() { *m = LabelSelector{} }
+
+func (m *LabelSelectorRequirement) Reset() { *m = LabelSelectorRequirement{} }
+
+func (m *List) Reset() { *m = List{} }
+
+func (m *ListMeta) Reset() { *m = ListMeta{} }
+
+func (m *ListOptions) Reset() { *m = ListOptions{} }
+
+func (m *ManagedFieldsEntry) Reset() { *m = ManagedFieldsEntry{} }
+
+func (m *MicroTime) Reset() { *m = MicroTime{} }
+
+func (m *ObjectMeta) Reset() { *m = ObjectMeta{} }
+
+func (m *OwnerReference) Reset() { *m = OwnerReference{} }
+
+func (m *PartialObjectMetadata) Reset() { *m = PartialObjectMetadata{} }
+
+func (m *PartialObjectMetadataList) Reset() { *m = PartialObjectMetadataList{} }
+
+func (m *Patch) Reset() { *m = Patch{} }
+
+func (m *PatchOptions) Reset() { *m = PatchOptions{} }
+
+func (m *Preconditions) Reset() { *m = Preconditions{} }
+
+func (m *RootPaths) Reset() { *m = RootPaths{} }
+
+func (m *ServerAddressByClientCIDR) Reset() { *m = ServerAddressByClientCIDR{} }
+
+func (m *ShardInfo) Reset() { *m = ShardInfo{} }
+
+func (m *Status) Reset() { *m = Status{} }
+
+func (m *StatusCause) Reset() { *m = StatusCause{} }
+
+func (m *StatusDetails) Reset() { *m = StatusDetails{} }
+
+func (m *TableOptions) Reset() { *m = TableOptions{} }
+
+func (m *Time) Reset() { *m = Time{} }
+
+func (m *Timestamp) Reset() { *m = Timestamp{} }
+
+func (m *TypeMeta) Reset() { *m = TypeMeta{} }
+
+func (m *UpdateOptions) Reset() { *m = UpdateOptions{} }
+
+func (m *Verbs) Reset() { *m = Verbs{} }
+
+func (m *WatchEvent) Reset() { *m = WatchEvent{} }
+
+func (m *APIGroup) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *APIGroup) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *APIGroup) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.ServerAddressByClientCIDRs) > 0 {
+		for iNdEx := len(m.ServerAddressByClientCIDRs) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ServerAddressByClientCIDRs[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x22
+		}
+	}
+	{
+		size, err := m.PreferredVersion.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	if len(m.Versions) > 0 {
+		for iNdEx := len(m.Versions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Versions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *APIGroupList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *APIGroupList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *APIGroupList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Groups) > 0 {
+		for iNdEx := len(m.Groups) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Groups[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *APIResource) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *APIResource) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *APIResource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.StorageVersionHash)
+	copy(dAtA[i:], m.StorageVersionHash)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.StorageVersionHash)))
+	i--
+	dAtA[i] = 0x52
+	i -= len(m.Version)
+	copy(dAtA[i:], m.Version)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version)))
+	i--
+	dAtA[i] = 0x4a
+	i -= len(m.Group)
+	copy(dAtA[i:], m.Group)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Group)))
+	i--
+	dAtA[i] = 0x42
+	if len(m.Categories) > 0 {
+		for iNdEx := len(m.Categories) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Categories[iNdEx])
+			copy(dAtA[i:], m.Categories[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.Categories[iNdEx])))
+			i--
+			dAtA[i] = 0x3a
+		}
+	}
+	i -= len(m.SingularName)
+	copy(dAtA[i:], m.SingularName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.SingularName)))
+	i--
+	dAtA[i] = 0x32
+	if len(m.ShortNames) > 0 {
+		for iNdEx := len(m.ShortNames) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.ShortNames[iNdEx])
+			copy(dAtA[i:], m.ShortNames[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.ShortNames[iNdEx])))
+			i--
+			dAtA[i] = 0x2a
+		}
+	}
+	if m.Verbs != nil {
+		{
+			size, err := m.Verbs.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0x1a
+	i--
+	if m.Namespaced {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x10
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *APIResourceList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *APIResourceList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *APIResourceList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.APIResources) > 0 {
+		for iNdEx := len(m.APIResources) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.APIResources[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	i -= len(m.GroupVersion)
+	copy(dAtA[i:], m.GroupVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.GroupVersion)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *APIVersions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *APIVersions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *APIVersions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.ServerAddressByClientCIDRs) > 0 {
+		for iNdEx := len(m.ServerAddressByClientCIDRs) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ServerAddressByClientCIDRs[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Versions) > 0 {
+		for iNdEx := len(m.Versions) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Versions[iNdEx])
+			copy(dAtA[i:], m.Versions[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.Versions[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ApplyOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ApplyOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ApplyOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.FieldManager)
+	copy(dAtA[i:], m.FieldManager)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldManager)))
+	i--
+	dAtA[i] = 0x1a
+	i--
+	if m.Force {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x10
+	if len(m.DryRun) > 0 {
+		for iNdEx := len(m.DryRun) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.DryRun[iNdEx])
+			copy(dAtA[i:], m.DryRun[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.DryRun[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Condition) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Condition) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Condition) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Message)
+	copy(dAtA[i:], m.Message)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message)))
+	i--
+	dAtA[i] = 0x32
+	i -= len(m.Reason)
+	copy(dAtA[i:], m.Reason)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Reason)))
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.LastTransitionTime.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	i = encodeVarintGenerated(dAtA, i, uint64(m.ObservedGeneration))
+	i--
+	dAtA[i] = 0x18
+	i -= len(m.Status)
+	copy(dAtA[i:], m.Status)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Type)
+	copy(dAtA[i:], m.Type)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *CreateOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CreateOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CreateOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.FieldValidation)
+	copy(dAtA[i:], m.FieldValidation)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldValidation)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.FieldManager)
+	copy(dAtA[i:], m.FieldManager)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldManager)))
+	i--
+	dAtA[i] = 0x1a
+	if len(m.DryRun) > 0 {
+		for iNdEx := len(m.DryRun) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.DryRun[iNdEx])
+			copy(dAtA[i:], m.DryRun[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.DryRun[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *DeleteOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DeleteOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *DeleteOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.IgnoreStoreReadErrorWithClusterBreakingPotential != nil {
+		i--
+		if *m.IgnoreStoreReadErrorWithClusterBreakingPotential {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x30
+	}
+	if len(m.DryRun) > 0 {
+		for iNdEx := len(m.DryRun) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.DryRun[iNdEx])
+			copy(dAtA[i:], m.DryRun[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.DryRun[iNdEx])))
+			i--
+			dAtA[i] = 0x2a
+		}
+	}
+	if m.PropagationPolicy != nil {
+		i -= len(*m.PropagationPolicy)
+		copy(dAtA[i:], *m.PropagationPolicy)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.PropagationPolicy)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.OrphanDependents != nil {
+		i--
+		if *m.OrphanDependents {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Preconditions != nil {
+		{
+			size, err := m.Preconditions.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.GracePeriodSeconds != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.GracePeriodSeconds))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Duration) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Duration) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Duration) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Duration))
+	i--
+	dAtA[i] = 0x8
+	return len(dAtA) - i, nil
+}
+
+func (m *FieldSelectorRequirement) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *FieldSelectorRequirement) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *FieldSelectorRequirement) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Values) > 0 {
+		for iNdEx := len(m.Values) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Values[iNdEx])
+			copy(dAtA[i:], m.Values[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.Values[iNdEx])))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	i -= len(m.Operator)
+	copy(dAtA[i:], m.Operator)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Operator)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Key)
+	copy(dAtA[i:], m.Key)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Key)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *GetOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GetOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GetOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.ResourceVersion)
+	copy(dAtA[i:], m.ResourceVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ResourceVersion)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *GroupKind) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GroupKind) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GroupKind) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Group)
+	copy(dAtA[i:], m.Group)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Group)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *GroupResource) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GroupResource) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GroupResource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Resource)
+	copy(dAtA[i:], m.Resource)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Resource)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Group)
+	copy(dAtA[i:], m.Group)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Group)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *GroupVersion) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GroupVersion) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GroupVersion) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Version)
+	copy(dAtA[i:], m.Version)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Group)
+	copy(dAtA[i:], m.Group)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Group)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *GroupVersionForDiscovery) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GroupVersionForDiscovery) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GroupVersionForDiscovery) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Version)
+	copy(dAtA[i:], m.Version)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.GroupVersion)
+	copy(dAtA[i:], m.GroupVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.GroupVersion)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *GroupVersionKind) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GroupVersionKind) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GroupVersionKind) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Version)
+	copy(dAtA[i:], m.Version)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Group)
+	copy(dAtA[i:], m.Group)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Group)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *GroupVersionResource) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GroupVersionResource) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GroupVersionResource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Resource)
+	copy(dAtA[i:], m.Resource)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Resource)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Version)
+	copy(dAtA[i:], m.Version)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Group)
+	copy(dAtA[i:], m.Group)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Group)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *LabelSelector) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LabelSelector) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *LabelSelector) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.MatchExpressions) > 0 {
+		for iNdEx := len(m.MatchExpressions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.MatchExpressions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.MatchLabels) > 0 {
+		keysForMatchLabels := make([]string, 0, len(m.MatchLabels))
+		for k := range m.MatchLabels {
+			keysForMatchLabels = append(keysForMatchLabels, string(k))
+		}
+		sort.Strings(keysForMatchLabels)
+		for iNdEx := len(keysForMatchLabels) - 1; iNdEx >= 0; iNdEx-- {
+			v := m.MatchLabels[string(keysForMatchLabels[iNdEx])]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = encodeVarintGenerated(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(keysForMatchLabels[iNdEx])
+			copy(dAtA[i:], keysForMatchLabels[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForMatchLabels[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintGenerated(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *LabelSelectorRequirement) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LabelSelectorRequirement) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *LabelSelectorRequirement) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Values) > 0 {
+		for iNdEx := len(m.Values) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Values[iNdEx])
+			copy(dAtA[i:], m.Values[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.Values[iNdEx])))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	i -= len(m.Operator)
+	copy(dAtA[i:], m.Operator)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Operator)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Key)
+	copy(dAtA[i:], m.Key)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Key)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *List) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *List) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *List) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *ListMeta) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListMeta) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.ShardInfo != nil {
+		{
+			size, err := m.ShardInfo.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.RemainingItemCount != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.RemainingItemCount))
+		i--
+		dAtA[i] = 0x20
+	}
+	i -= len(m.Continue)
+	copy(dAtA[i:], m.Continue)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Continue)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.ResourceVersion)
+	copy(dAtA[i:], m.ResourceVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ResourceVersion)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.SelfLink)
+	copy(dAtA[i:], m.SelfLink)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.SelfLink)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *ListOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.ShardSelector)
+	copy(dAtA[i:], m.ShardSelector)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ShardSelector)))
+	i--
+	dAtA[i] = 0x7a
+	if m.SendInitialEvents != nil {
+		i--
+		if *m.SendInitialEvents {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x58
+	}
+	i -= len(m.ResourceVersionMatch)
+	copy(dAtA[i:], m.ResourceVersionMatch)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ResourceVersionMatch)))
+	i--
+	dAtA[i] = 0x52
+	i--
+	if m.AllowWatchBookmarks {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x48
+	i -= len(m.Continue)
+	copy(dAtA[i:], m.Continue)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Continue)))
+	i--
+	dAtA[i] = 0x42
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Limit))
+	i--
+	dAtA[i] = 0x38
+	if m.TimeoutSeconds != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.TimeoutSeconds))
+		i--
+		dAtA[i] = 0x28
+	}
+	i -= len(m.ResourceVersion)
+	copy(dAtA[i:], m.ResourceVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ResourceVersion)))
+	i--
+	dAtA[i] = 0x22
+	i--
+	if m.Watch {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x18
+	i -= len(m.FieldSelector)
+	copy(dAtA[i:], m.FieldSelector)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldSelector)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.LabelSelector)
+	copy(dAtA[i:], m.LabelSelector)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.LabelSelector)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *ManagedFieldsEntry) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ManagedFieldsEntry) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ManagedFieldsEntry) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Subresource)
+	copy(dAtA[i:], m.Subresource)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Subresource)))
+	i--
+	dAtA[i] = 0x42
+	if m.FieldsV1 != nil {
+		{
+			size, err := m.FieldsV1.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x3a
+	}
+	i -= len(m.FieldsType)
+	copy(dAtA[i:], m.FieldsType)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldsType)))
+	i--
+	dAtA[i] = 0x32
+	if m.Time != nil {
+		{
+			size, err := m.Time.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	i -= len(m.APIVersion)
+	copy(dAtA[i:], m.APIVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.APIVersion)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Operation)
+	copy(dAtA[i:], m.Operation)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Operation)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Manager)
+	copy(dAtA[i:], m.Manager)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Manager)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *ObjectMeta) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ObjectMeta) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ObjectMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.ManagedFields) > 0 {
+		for iNdEx := len(m.ManagedFields) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ManagedFields[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0x8a
+		}
+	}
+	if len(m.Finalizers) > 0 {
+		for iNdEx := len(m.Finalizers) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Finalizers[iNdEx])
+			copy(dAtA[i:], m.Finalizers[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.Finalizers[iNdEx])))
+			i--
+			dAtA[i] = 0x72
+		}
+	}
+	if len(m.OwnerReferences) > 0 {
+		for iNdEx := len(m.OwnerReferences) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.OwnerReferences[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x6a
+		}
+	}
+	if len(m.Annotations) > 0 {
+		keysForAnnotations := make([]string, 0, len(m.Annotations))
+		for k := range m.Annotations {
+			keysForAnnotations = append(keysForAnnotations, string(k))
+		}
+		sort.Strings(keysForAnnotations)
+		for iNdEx := len(keysForAnnotations) - 1; iNdEx >= 0; iNdEx-- {
+			v := m.Annotations[string(keysForAnnotations[iNdEx])]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = encodeVarintGenerated(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(keysForAnnotations[iNdEx])
+			copy(dAtA[i:], keysForAnnotations[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForAnnotations[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintGenerated(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x62
+		}
+	}
+	if len(m.Labels) > 0 {
+		keysForLabels := make([]string, 0, len(m.Labels))
+		for k := range m.Labels {
+			keysForLabels = append(keysForLabels, string(k))
+		}
+		sort.Strings(keysForLabels)
+		for iNdEx := len(keysForLabels) - 1; iNdEx >= 0; iNdEx-- {
+			v := m.Labels[string(keysForLabels[iNdEx])]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = encodeVarintGenerated(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(keysForLabels[iNdEx])
+			copy(dAtA[i:], keysForLabels[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForLabels[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintGenerated(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x5a
+		}
+	}
+	if m.DeletionGracePeriodSeconds != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.DeletionGracePeriodSeconds))
+		i--
+		dAtA[i] = 0x50
+	}
+	if m.DeletionTimestamp != nil {
+		{
+			size, err := m.DeletionTimestamp.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x4a
+	}
+	{
+		size, err := m.CreationTimestamp.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x42
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Generation))
+	i--
+	dAtA[i] = 0x38
+	i -= len(m.ResourceVersion)
+	copy(dAtA[i:], m.ResourceVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ResourceVersion)))
+	i--
+	dAtA[i] = 0x32
+	i -= len(m.UID)
+	copy(dAtA[i:], m.UID)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.UID)))
+	i--
+	dAtA[i] = 0x2a
+	i -= len(m.SelfLink)
+	copy(dAtA[i:], m.SelfLink)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.SelfLink)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.Namespace)
+	copy(dAtA[i:], m.Namespace)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Namespace)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.GenerateName)
+	copy(dAtA[i:], m.GenerateName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.GenerateName)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *OwnerReference) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *OwnerReference) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OwnerReference) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.BlockOwnerDeletion != nil {
+		i--
+		if *m.BlockOwnerDeletion {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x38
+	}
+	if m.Controller != nil {
+		i--
+		if *m.Controller {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x30
+	}
+	i -= len(m.APIVersion)
+	copy(dAtA[i:], m.APIVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.APIVersion)))
+	i--
+	dAtA[i] = 0x2a
+	i -= len(m.UID)
+	copy(dAtA[i:], m.UID)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.UID)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *PartialObjectMetadata) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PartialObjectMetadata) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PartialObjectMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *PartialObjectMetadataList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PartialObjectMetadataList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PartialObjectMetadataList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *Patch) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Patch) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Patch) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *PatchOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PatchOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PatchOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.FieldValidation)
+	copy(dAtA[i:], m.FieldValidation)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldValidation)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.FieldManager)
+	copy(dAtA[i:], m.FieldManager)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldManager)))
+	i--
+	dAtA[i] = 0x1a
+	if m.Force != nil {
+		i--
+		if *m.Force {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.DryRun) > 0 {
+		for iNdEx := len(m.DryRun) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.DryRun[iNdEx])
+			copy(dAtA[i:], m.DryRun[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.DryRun[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Preconditions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Preconditions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Preconditions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.ResourceVersion != nil {
+		i -= len(*m.ResourceVersion)
+		copy(dAtA[i:], *m.ResourceVersion)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ResourceVersion)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.UID != nil {
+		i -= len(*m.UID)
+		copy(dAtA[i:], *m.UID)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.UID)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *RootPaths) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RootPaths) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RootPaths) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Paths) > 0 {
+		for iNdEx := len(m.Paths) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Paths[iNdEx])
+			copy(dAtA[i:], m.Paths[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.Paths[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ServerAddressByClientCIDR) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ServerAddressByClientCIDR) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ServerAddressByClientCIDR) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.ServerAddress)
+	copy(dAtA[i:], m.ServerAddress)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ServerAddress)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.ClientCIDR)
+	copy(dAtA[i:], m.ClientCIDR)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ClientCIDR)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *ShardInfo) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ShardInfo) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ShardInfo) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Selector)
+	copy(dAtA[i:], m.Selector)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Selector)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *Status) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Status) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Status) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Code))
+	i--
+	dAtA[i] = 0x30
+	if m.Details != nil {
+		{
+			size, err := m.Details.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2a
+	}
+	i -= len(m.Reason)
+	copy(dAtA[i:], m.Reason)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Reason)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.Message)
+	copy(dAtA[i:], m.Message)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Status)
+	copy(dAtA[i:], m.Status)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status)))
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *StatusCause) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *StatusCause) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *StatusCause) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Field)
+	copy(dAtA[i:], m.Field)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Field)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Message)
+	copy(dAtA[i:], m.Message)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Type)
+	copy(dAtA[i:], m.Type)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *StatusDetails) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *StatusDetails) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *StatusDetails) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.UID)
+	copy(dAtA[i:], m.UID)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.UID)))
+	i--
+	dAtA[i] = 0x32
+	i = encodeVarintGenerated(dAtA, i, uint64(m.RetryAfterSeconds))
+	i--
+	dAtA[i] = 0x28
+	if len(m.Causes) > 0 {
+		for iNdEx := len(m.Causes) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Causes[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x22
+		}
+	}
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Group)
+	copy(dAtA[i:], m.Group)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Group)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *TableOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TableOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *TableOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.IncludeObject)
+	copy(dAtA[i:], m.IncludeObject)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.IncludeObject)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *Timestamp) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Timestamp) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Timestamp) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Nanos))
+	i--
+	dAtA[i] = 0x10
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Seconds))
+	i--
+	dAtA[i] = 0x8
+	return len(dAtA) - i, nil
+}
+
+func (m *TypeMeta) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TypeMeta) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *TypeMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.APIVersion)
+	copy(dAtA[i:], m.APIVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.APIVersion)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *UpdateOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UpdateOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UpdateOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.FieldValidation)
+	copy(dAtA[i:], m.FieldValidation)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldValidation)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.FieldManager)
+	copy(dAtA[i:], m.FieldManager)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldManager)))
+	i--
+	dAtA[i] = 0x12
+	if len(m.DryRun) > 0 {
+		for iNdEx := len(m.DryRun) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.DryRun[iNdEx])
+			copy(dAtA[i:], m.DryRun[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.DryRun[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m Verbs) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m Verbs) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m Verbs) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m) > 0 {
+		for iNdEx := len(m) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m[iNdEx])
+			copy(dAtA[i:], m[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *WatchEvent) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WatchEvent) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WatchEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.Object.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Type)
+	copy(dAtA[i:], m.Type)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *APIGroup) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Versions) > 0 {
+		for _, e := range m.Versions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = m.PreferredVersion.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.ServerAddressByClientCIDRs) > 0 {
+		for _, e := range m.ServerAddressByClientCIDRs {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *APIGroupList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Groups) > 0 {
+		for _, e := range m.Groups {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *APIResource) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	n += 2
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Verbs != nil {
+		l = m.Verbs.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.ShortNames) > 0 {
+		for _, s := range m.ShortNames {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = len(m.SingularName)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Categories) > 0 {
+		for _, s := range m.Categories {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = len(m.Group)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Version)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.StorageVersionHash)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *APIResourceList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.GroupVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.APIResources) > 0 {
+		for _, e := range m.APIResources {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *APIVersions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Versions) > 0 {
+		for _, s := range m.Versions {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.ServerAddressByClientCIDRs) > 0 {
+		for _, e := range m.ServerAddressByClientCIDRs {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *ApplyOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.DryRun) > 0 {
+		for _, s := range m.DryRun {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	n += 2
+	l = len(m.FieldManager)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *Condition) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Type)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Status)
+	n += 1 + l + sovGenerated(uint64(l))
+	n += 1 + sovGenerated(uint64(m.ObservedGeneration))
+	l = m.LastTransitionTime.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Reason)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Message)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *CreateOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.DryRun) > 0 {
+		for _, s := range m.DryRun {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = len(m.FieldManager)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.FieldValidation)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *DeleteOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.GracePeriodSeconds != nil {
+		n += 1 + sovGenerated(uint64(*m.GracePeriodSeconds))
+	}
+	if m.Preconditions != nil {
+		l = m.Preconditions.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.OrphanDependents != nil {
+		n += 2
+	}
+	if m.PropagationPolicy != nil {
+		l = len(*m.PropagationPolicy)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.DryRun) > 0 {
+		for _, s := range m.DryRun {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if m.IgnoreStoreReadErrorWithClusterBreakingPotential != nil {
+		n += 2
+	}
+	return n
+}
+
+func (m *Duration) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 1 + sovGenerated(uint64(m.Duration))
+	return n
+}
+
+func (m *FieldSelectorRequirement) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Key)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Operator)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Values) > 0 {
+		for _, s := range m.Values {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *GetOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.ResourceVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *GroupKind) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Group)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *GroupResource) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Group)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Resource)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *GroupVersion) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Group)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Version)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *GroupVersionForDiscovery) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.GroupVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Version)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *GroupVersionKind) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Group)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Version)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *GroupVersionResource) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Group)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Version)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Resource)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *LabelSelector) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.MatchLabels) > 0 {
+		for k, v := range m.MatchLabels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + len(v) + sovGenerated(uint64(len(v)))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
+	if len(m.MatchExpressions) > 0 {
+		for _, e := range m.MatchExpressions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *LabelSelectorRequirement) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Key)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Operator)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Values) > 0 {
+		for _, s := range m.Values {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *List) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *ListMeta) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.SelfLink)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.ResourceVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Continue)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.RemainingItemCount != nil {
+		n += 1 + sovGenerated(uint64(*m.RemainingItemCount))
+	}
+	if m.ShardInfo != nil {
+		l = m.ShardInfo.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *ListOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.LabelSelector)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.FieldSelector)
+	n += 1 + l + sovGenerated(uint64(l))
+	n += 2
+	l = len(m.ResourceVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.TimeoutSeconds != nil {
+		n += 1 + sovGenerated(uint64(*m.TimeoutSeconds))
+	}
+	n += 1 + sovGenerated(uint64(m.Limit))
+	l = len(m.Continue)
+	n += 1 + l + sovGenerated(uint64(l))
+	n += 2
+	l = len(m.ResourceVersionMatch)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.SendInitialEvents != nil {
+		n += 2
+	}
+	l = len(m.ShardSelector)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *ManagedFieldsEntry) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Manager)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Operation)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.APIVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Time != nil {
+		l = m.Time.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = len(m.FieldsType)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.FieldsV1 != nil {
+		l = m.FieldsV1.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = len(m.Subresource)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *ObjectMeta) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.GenerateName)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Namespace)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.SelfLink)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.UID)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.ResourceVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	n += 1 + sovGenerated(uint64(m.Generation))
+	l = m.CreationTimestamp.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.DeletionTimestamp != nil {
+		l = m.DeletionTimestamp.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.DeletionGracePeriodSeconds != nil {
+		n += 1 + sovGenerated(uint64(*m.DeletionGracePeriodSeconds))
+	}
+	if len(m.Labels) > 0 {
+		for k, v := range m.Labels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + len(v) + sovGenerated(uint64(len(v)))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
+	if len(m.Annotations) > 0 {
+		for k, v := range m.Annotations {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + len(v) + sovGenerated(uint64(len(v)))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
+	if len(m.OwnerReferences) > 0 {
+		for _, e := range m.OwnerReferences {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.Finalizers) > 0 {
+		for _, s := range m.Finalizers {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.ManagedFields) > 0 {
+		for _, e := range m.ManagedFields {
+			l = e.Size()
+			n += 2 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *OwnerReference) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.UID)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.APIVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Controller != nil {
+		n += 2
+	}
+	if m.BlockOwnerDeletion != nil {
+		n += 2
+	}
+	return n
+}
+
+func (m *PartialObjectMetadata) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ObjectMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *PartialObjectMetadataList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *Patch) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *PatchOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.DryRun) > 0 {
+		for _, s := range m.DryRun {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if m.Force != nil {
+		n += 2
+	}
+	l = len(m.FieldManager)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.FieldValidation)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *Preconditions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.UID != nil {
+		l = len(*m.UID)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.ResourceVersion != nil {
+		l = len(*m.ResourceVersion)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *RootPaths) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Paths) > 0 {
+		for _, s := range m.Paths {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *ServerAddressByClientCIDR) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.ClientCIDR)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.ServerAddress)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *ShardInfo) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Selector)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *Status) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Status)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Message)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Reason)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Details != nil {
+		l = m.Details.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	n += 1 + sovGenerated(uint64(m.Code))
+	return n
+}
+
+func (m *StatusCause) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Type)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Message)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Field)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *StatusDetails) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Group)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Causes) > 0 {
+		for _, e := range m.Causes {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	n += 1 + sovGenerated(uint64(m.RetryAfterSeconds))
+	l = len(m.UID)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *TableOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.IncludeObject)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *Timestamp) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 1 + sovGenerated(uint64(m.Seconds))
+	n += 1 + sovGenerated(uint64(m.Nanos))
+	return n
+}
+
+func (m *TypeMeta) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.APIVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *UpdateOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.DryRun) > 0 {
+		for _, s := range m.DryRun {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = len(m.FieldManager)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.FieldValidation)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m Verbs) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m) > 0 {
+		for _, s := range m {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *WatchEvent) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Type)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Object.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozGenerated(x uint64) (n int) {
+	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *APIGroup) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForVersions := "[]GroupVersionForDiscovery{"
+	for _, f := range this.Versions {
+		repeatedStringForVersions += strings.Replace(strings.Replace(f.String(), "GroupVersionForDiscovery", "GroupVersionForDiscovery", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForVersions += "}"
+	repeatedStringForServerAddressByClientCIDRs := "[]ServerAddressByClientCIDR{"
+	for _, f := range this.ServerAddressByClientCIDRs {
+		repeatedStringForServerAddressByClientCIDRs += strings.Replace(strings.Replace(f.String(), "ServerAddressByClientCIDR", "ServerAddressByClientCIDR", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForServerAddressByClientCIDRs += "}"
+	s := strings.Join([]string{`&APIGroup{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`Versions:` + repeatedStringForVersions + `,`,
+		`PreferredVersion:` + strings.Replace(strings.Replace(this.PreferredVersion.String(), "GroupVersionForDiscovery", "GroupVersionForDiscovery", 1), `&`, ``, 1) + `,`,
+		`ServerAddressByClientCIDRs:` + repeatedStringForServerAddressByClientCIDRs + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *APIGroupList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForGroups := "[]APIGroup{"
+	for _, f := range this.Groups {
+		repeatedStringForGroups += strings.Replace(strings.Replace(f.String(), "APIGroup", "APIGroup", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForGroups += "}"
+	s := strings.Join([]string{`&APIGroupList{`,
+		`Groups:` + repeatedStringForGroups + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *APIResource) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&APIResource{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`Namespaced:` + fmt.Sprintf("%v", this.Namespaced) + `,`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`Verbs:` + strings.Replace(fmt.Sprintf("%v", this.Verbs), "Verbs", "Verbs", 1) + `,`,
+		`ShortNames:` + fmt.Sprintf("%v", this.ShortNames) + `,`,
+		`SingularName:` + fmt.Sprintf("%v", this.SingularName) + `,`,
+		`Categories:` + fmt.Sprintf("%v", this.Categories) + `,`,
+		`Group:` + fmt.Sprintf("%v", this.Group) + `,`,
+		`Version:` + fmt.Sprintf("%v", this.Version) + `,`,
+		`StorageVersionHash:` + fmt.Sprintf("%v", this.StorageVersionHash) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *APIResourceList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForAPIResources := "[]APIResource{"
+	for _, f := range this.APIResources {
+		repeatedStringForAPIResources += strings.Replace(strings.Replace(f.String(), "APIResource", "APIResource", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForAPIResources += "}"
+	s := strings.Join([]string{`&APIResourceList{`,
+		`GroupVersion:` + fmt.Sprintf("%v", this.GroupVersion) + `,`,
+		`APIResources:` + repeatedStringForAPIResources + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ApplyOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ApplyOptions{`,
+		`DryRun:` + fmt.Sprintf("%v", this.DryRun) + `,`,
+		`Force:` + fmt.Sprintf("%v", this.Force) + `,`,
+		`FieldManager:` + fmt.Sprintf("%v", this.FieldManager) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Condition) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Condition{`,
+		`Type:` + fmt.Sprintf("%v", this.Type) + `,`,
+		`Status:` + fmt.Sprintf("%v", this.Status) + `,`,
+		`ObservedGeneration:` + fmt.Sprintf("%v", this.ObservedGeneration) + `,`,
+		`LastTransitionTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastTransitionTime), "Time", "Time", 1), `&`, ``, 1) + `,`,
+		`Reason:` + fmt.Sprintf("%v", this.Reason) + `,`,
+		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CreateOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CreateOptions{`,
+		`DryRun:` + fmt.Sprintf("%v", this.DryRun) + `,`,
+		`FieldManager:` + fmt.Sprintf("%v", this.FieldManager) + `,`,
+		`FieldValidation:` + fmt.Sprintf("%v", this.FieldValidation) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *DeleteOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&DeleteOptions{`,
+		`GracePeriodSeconds:` + valueToStringGenerated(this.GracePeriodSeconds) + `,`,
+		`Preconditions:` + strings.Replace(this.Preconditions.String(), "Preconditions", "Preconditions", 1) + `,`,
+		`OrphanDependents:` + valueToStringGenerated(this.OrphanDependents) + `,`,
+		`PropagationPolicy:` + valueToStringGenerated(this.PropagationPolicy) + `,`,
+		`DryRun:` + fmt.Sprintf("%v", this.DryRun) + `,`,
+		`IgnoreStoreReadErrorWithClusterBreakingPotential:` + valueToStringGenerated(this.IgnoreStoreReadErrorWithClusterBreakingPotential) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Duration) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Duration{`,
+		`Duration:` + fmt.Sprintf("%v", this.Duration) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *FieldSelectorRequirement) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&FieldSelectorRequirement{`,
+		`Key:` + fmt.Sprintf("%v", this.Key) + `,`,
+		`Operator:` + fmt.Sprintf("%v", this.Operator) + `,`,
+		`Values:` + fmt.Sprintf("%v", this.Values) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *GetOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&GetOptions{`,
+		`ResourceVersion:` + fmt.Sprintf("%v", this.ResourceVersion) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *GroupVersionForDiscovery) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&GroupVersionForDiscovery{`,
+		`GroupVersion:` + fmt.Sprintf("%v", this.GroupVersion) + `,`,
+		`Version:` + fmt.Sprintf("%v", this.Version) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *LabelSelector) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForMatchExpressions := "[]LabelSelectorRequirement{"
+	for _, f := range this.MatchExpressions {
+		repeatedStringForMatchExpressions += strings.Replace(strings.Replace(f.String(), "LabelSelectorRequirement", "LabelSelectorRequirement", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForMatchExpressions += "}"
+	keysForMatchLabels := make([]string, 0, len(this.MatchLabels))
+	for k := range this.MatchLabels {
+		keysForMatchLabels = append(keysForMatchLabels, k)
+	}
+	sort.Strings(keysForMatchLabels)
+	mapStringForMatchLabels := "map[string]string{"
+	for _, k := range keysForMatchLabels {
+		mapStringForMatchLabels += fmt.Sprintf("%v: %v,", k, this.MatchLabels[k])
+	}
+	mapStringForMatchLabels += "}"
+	s := strings.Join([]string{`&LabelSelector{`,
+		`MatchLabels:` + mapStringForMatchLabels + `,`,
+		`MatchExpressions:` + repeatedStringForMatchExpressions + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *LabelSelectorRequirement) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&LabelSelectorRequirement{`,
+		`Key:` + fmt.Sprintf("%v", this.Key) + `,`,
+		`Operator:` + fmt.Sprintf("%v", this.Operator) + `,`,
+		`Values:` + fmt.Sprintf("%v", this.Values) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *List) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]RawExtension{"
+	for _, f := range this.Items {
+		repeatedStringForItems += fmt.Sprintf("%v", f) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&List{`,
+		`ListMeta:` + strings.Replace(strings.Replace(this.ListMeta.String(), "ListMeta", "ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ListMeta) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ListMeta{`,
+		`SelfLink:` + fmt.Sprintf("%v", this.SelfLink) + `,`,
+		`ResourceVersion:` + fmt.Sprintf("%v", this.ResourceVersion) + `,`,
+		`Continue:` + fmt.Sprintf("%v", this.Continue) + `,`,
+		`RemainingItemCount:` + valueToStringGenerated(this.RemainingItemCount) + `,`,
+		`ShardInfo:` + strings.Replace(this.ShardInfo.String(), "ShardInfo", "ShardInfo", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ListOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ListOptions{`,
+		`LabelSelector:` + fmt.Sprintf("%v", this.LabelSelector) + `,`,
+		`FieldSelector:` + fmt.Sprintf("%v", this.FieldSelector) + `,`,
+		`Watch:` + fmt.Sprintf("%v", this.Watch) + `,`,
+		`ResourceVersion:` + fmt.Sprintf("%v", this.ResourceVersion) + `,`,
+		`TimeoutSeconds:` + valueToStringGenerated(this.TimeoutSeconds) + `,`,
+		`Limit:` + fmt.Sprintf("%v", this.Limit) + `,`,
+		`Continue:` + fmt.Sprintf("%v", this.Continue) + `,`,
+		`AllowWatchBookmarks:` + fmt.Sprintf("%v", this.AllowWatchBookmarks) + `,`,
+		`ResourceVersionMatch:` + fmt.Sprintf("%v", this.ResourceVersionMatch) + `,`,
+		`SendInitialEvents:` + valueToStringGenerated(this.SendInitialEvents) + `,`,
+		`ShardSelector:` + fmt.Sprintf("%v", this.ShardSelector) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ManagedFieldsEntry) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ManagedFieldsEntry{`,
+		`Manager:` + fmt.Sprintf("%v", this.Manager) + `,`,
+		`Operation:` + fmt.Sprintf("%v", this.Operation) + `,`,
+		`APIVersion:` + fmt.Sprintf("%v", this.APIVersion) + `,`,
+		`Time:` + strings.Replace(fmt.Sprintf("%v", this.Time), "Time", "Time", 1) + `,`,
+		`FieldsType:` + fmt.Sprintf("%v", this.FieldsType) + `,`,
+		`FieldsV1:` + strings.Replace(fmt.Sprintf("%v", this.FieldsV1), "FieldsV1", "FieldsV1", 1) + `,`,
+		`Subresource:` + fmt.Sprintf("%v", this.Subresource) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ObjectMeta) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForOwnerReferences := "[]OwnerReference{"
+	for _, f := range this.OwnerReferences {
+		repeatedStringForOwnerReferences += strings.Replace(strings.Replace(f.String(), "OwnerReference", "OwnerReference", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForOwnerReferences += "}"
+	repeatedStringForManagedFields := "[]ManagedFieldsEntry{"
+	for _, f := range this.ManagedFields {
+		repeatedStringForManagedFields += strings.Replace(strings.Replace(f.String(), "ManagedFieldsEntry", "ManagedFieldsEntry", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForManagedFields += "}"
+	keysForLabels := make([]string, 0, len(this.Labels))
+	for k := range this.Labels {
+		keysForLabels = append(keysForLabels, k)
+	}
+	sort.Strings(keysForLabels)
+	mapStringForLabels := "map[string]string{"
+	for _, k := range keysForLabels {
+		mapStringForLabels += fmt.Sprintf("%v: %v,", k, this.Labels[k])
+	}
+	mapStringForLabels += "}"
+	keysForAnnotations := make([]string, 0, len(this.Annotations))
+	for k := range this.Annotations {
+		keysForAnnotations = append(keysForAnnotations, k)
+	}
+	sort.Strings(keysForAnnotations)
+	mapStringForAnnotations := "map[string]string{"
+	for _, k := range keysForAnnotations {
+		mapStringForAnnotations += fmt.Sprintf("%v: %v,", k, this.Annotations[k])
+	}
+	mapStringForAnnotations += "}"
+	s := strings.Join([]string{`&ObjectMeta{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`GenerateName:` + fmt.Sprintf("%v", this.GenerateName) + `,`,
+		`Namespace:` + fmt.Sprintf("%v", this.Namespace) + `,`,
+		`SelfLink:` + fmt.Sprintf("%v", this.SelfLink) + `,`,
+		`UID:` + fmt.Sprintf("%v", this.UID) + `,`,
+		`ResourceVersion:` + fmt.Sprintf("%v", this.ResourceVersion) + `,`,
+		`Generation:` + fmt.Sprintf("%v", this.Generation) + `,`,
+		`CreationTimestamp:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.CreationTimestamp), "Time", "Time", 1), `&`, ``, 1) + `,`,
+		`DeletionTimestamp:` + strings.Replace(fmt.Sprintf("%v", this.DeletionTimestamp), "Time", "Time", 1) + `,`,
+		`DeletionGracePeriodSeconds:` + valueToStringGenerated(this.DeletionGracePeriodSeconds) + `,`,
+		`Labels:` + mapStringForLabels + `,`,
+		`Annotations:` + mapStringForAnnotations + `,`,
+		`OwnerReferences:` + repeatedStringForOwnerReferences + `,`,
+		`Finalizers:` + fmt.Sprintf("%v", this.Finalizers) + `,`,
+		`ManagedFields:` + repeatedStringForManagedFields + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *OwnerReference) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&OwnerReference{`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`UID:` + fmt.Sprintf("%v", this.UID) + `,`,
+		`APIVersion:` + fmt.Sprintf("%v", this.APIVersion) + `,`,
+		`Controller:` + valueToStringGenerated(this.Controller) + `,`,
+		`BlockOwnerDeletion:` + valueToStringGenerated(this.BlockOwnerDeletion) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PartialObjectMetadata) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&PartialObjectMetadata{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(this.ObjectMeta.String(), "ObjectMeta", "ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PartialObjectMetadataList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]PartialObjectMetadata{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "PartialObjectMetadata", "PartialObjectMetadata", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&PartialObjectMetadataList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(this.ListMeta.String(), "ListMeta", "ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Patch) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Patch{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PatchOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&PatchOptions{`,
+		`DryRun:` + fmt.Sprintf("%v", this.DryRun) + `,`,
+		`Force:` + valueToStringGenerated(this.Force) + `,`,
+		`FieldManager:` + fmt.Sprintf("%v", this.FieldManager) + `,`,
+		`FieldValidation:` + fmt.Sprintf("%v", this.FieldValidation) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Preconditions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Preconditions{`,
+		`UID:` + valueToStringGenerated(this.UID) + `,`,
+		`ResourceVersion:` + valueToStringGenerated(this.ResourceVersion) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *RootPaths) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&RootPaths{`,
+		`Paths:` + fmt.Sprintf("%v", this.Paths) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ServerAddressByClientCIDR) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ServerAddressByClientCIDR{`,
+		`ClientCIDR:` + fmt.Sprintf("%v", this.ClientCIDR) + `,`,
+		`ServerAddress:` + fmt.Sprintf("%v", this.ServerAddress) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ShardInfo) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ShardInfo{`,
+		`Selector:` + fmt.Sprintf("%v", this.Selector) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Status) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Status{`,
+		`ListMeta:` + strings.Replace(strings.Replace(this.ListMeta.String(), "ListMeta", "ListMeta", 1), `&`, ``, 1) + `,`,
+		`Status:` + fmt.Sprintf("%v", this.Status) + `,`,
+		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`Reason:` + fmt.Sprintf("%v", this.Reason) + `,`,
+		`Details:` + strings.Replace(this.Details.String(), "StatusDetails", "StatusDetails", 1) + `,`,
+		`Code:` + fmt.Sprintf("%v", this.Code) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *StatusCause) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&StatusCause{`,
+		`Type:` + fmt.Sprintf("%v", this.Type) + `,`,
+		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`Field:` + fmt.Sprintf("%v", this.Field) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *StatusDetails) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForCauses := "[]StatusCause{"
+	for _, f := range this.Causes {
+		repeatedStringForCauses += strings.Replace(strings.Replace(f.String(), "StatusCause", "StatusCause", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForCauses += "}"
+	s := strings.Join([]string{`&StatusDetails{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`Group:` + fmt.Sprintf("%v", this.Group) + `,`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`Causes:` + repeatedStringForCauses + `,`,
+		`RetryAfterSeconds:` + fmt.Sprintf("%v", this.RetryAfterSeconds) + `,`,
+		`UID:` + fmt.Sprintf("%v", this.UID) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *TableOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&TableOptions{`,
+		`IncludeObject:` + fmt.Sprintf("%v", this.IncludeObject) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Timestamp) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Timestamp{`,
+		`Seconds:` + fmt.Sprintf("%v", this.Seconds) + `,`,
+		`Nanos:` + fmt.Sprintf("%v", this.Nanos) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *TypeMeta) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&TypeMeta{`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`APIVersion:` + fmt.Sprintf("%v", this.APIVersion) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *UpdateOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&UpdateOptions{`,
+		`DryRun:` + fmt.Sprintf("%v", this.DryRun) + `,`,
+		`FieldManager:` + fmt.Sprintf("%v", this.FieldManager) + `,`,
+		`FieldValidation:` + fmt.Sprintf("%v", this.FieldValidation) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WatchEvent) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WatchEvent{`,
+		`Type:` + fmt.Sprintf("%v", this.Type) + `,`,
+		`Object:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.Object), "RawExtension", "runtime.RawExtension", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringGenerated(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *APIGroup) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: APIGroup: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: APIGroup: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Versions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Versions = append(m.Versions, GroupVersionForDiscovery{})
+			if err := m.Versions[len(m.Versions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PreferredVersion", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.PreferredVersion.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerAddressByClientCIDRs", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServerAddressByClientCIDRs = append(m.ServerAddressByClientCIDRs, ServerAddressByClientCIDR{})
+			if err := m.ServerAddressByClientCIDRs[len(m.ServerAddressByClientCIDRs)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *APIGroupList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: APIGroupList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: APIGroupList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Groups", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Groups = append(m.Groups, APIGroup{})
+			if err := m.Groups[len(m.Groups)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *APIResource) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: APIResource: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: APIResource: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Namespaced", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Namespaced = bool(v != 0)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Verbs", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Verbs == nil {
+				m.Verbs = Verbs{}
+			}
+			if err := m.Verbs.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ShortNames", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ShortNames = append(m.ShortNames, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SingularName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SingularName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Categories", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Categories = append(m.Categories, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Group", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Group = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StorageVersionHash", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.StorageVersionHash = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *APIResourceList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: APIResourceList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: APIResourceList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GroupVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.GroupVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field APIResources", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.APIResources = append(m.APIResources, APIResource{})
+			if err := m.APIResources[len(m.APIResources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *APIVersions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: APIVersions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: APIVersions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Versions", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Versions = append(m.Versions, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerAddressByClientCIDRs", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServerAddressByClientCIDRs = append(m.ServerAddressByClientCIDRs, ServerAddressByClientCIDR{})
+			if err := m.ServerAddressByClientCIDRs[len(m.ServerAddressByClientCIDRs)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ApplyOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ApplyOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ApplyOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DryRun", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DryRun = append(m.DryRun, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Force", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Force = bool(v != 0)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldManager", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldManager = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Condition) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Condition: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Condition: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Status = ConditionStatus(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObservedGeneration", wireType)
+			}
+			m.ObservedGeneration = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ObservedGeneration |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastTransitionTime", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.LastTransitionTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CreateOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CreateOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CreateOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DryRun", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DryRun = append(m.DryRun, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldManager", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldManager = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldValidation", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldValidation = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeleteOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeleteOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeleteOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GracePeriodSeconds", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.GracePeriodSeconds = &v
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Preconditions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Preconditions == nil {
+				m.Preconditions = &Preconditions{}
+			}
+			if err := m.Preconditions.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OrphanDependents", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.OrphanDependents = &b
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PropagationPolicy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := DeletionPropagation(dAtA[iNdEx:postIndex])
+			m.PropagationPolicy = &s
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DryRun", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DryRun = append(m.DryRun, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IgnoreStoreReadErrorWithClusterBreakingPotential", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.IgnoreStoreReadErrorWithClusterBreakingPotential = &b
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Duration) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Duration: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Duration: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Duration", wireType)
+			}
+			m.Duration = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Duration |= time.Duration(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *FieldSelectorRequirement) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: FieldSelectorRequirement: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: FieldSelectorRequirement: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Key = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Operator", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Operator = FieldSelectorOperator(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Values", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Values = append(m.Values, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GetOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GetOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GetOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GroupKind) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GroupKind: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GroupKind: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Group", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Group = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GroupResource) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GroupResource: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GroupResource: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Group", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Group = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Resource", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Resource = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GroupVersion) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GroupVersion: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GroupVersion: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Group", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Group = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GroupVersionForDiscovery) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GroupVersionForDiscovery: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GroupVersionForDiscovery: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GroupVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.GroupVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GroupVersionKind) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GroupVersionKind: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GroupVersionKind: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Group", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Group = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GroupVersionResource) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GroupVersionResource: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GroupVersionResource: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Group", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Group = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Resource", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Resource = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *LabelSelector) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LabelSelector: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LabelSelector: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MatchLabels", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.MatchLabels == nil {
+				m.MatchLabels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipGenerated(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.MatchLabels[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MatchExpressions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.MatchExpressions = append(m.MatchExpressions, LabelSelectorRequirement{})
+			if err := m.MatchExpressions[len(m.MatchExpressions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *LabelSelectorRequirement) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LabelSelectorRequirement: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LabelSelectorRequirement: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Key = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Operator", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Operator = LabelSelectorOperator(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Values", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Values = append(m.Values, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *List) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: List: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: List: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, runtime.RawExtension{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ListMeta) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ListMeta: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ListMeta: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SelfLink", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SelfLink = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Continue", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Continue = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RemainingItemCount", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.RemainingItemCount = &v
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ShardInfo", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ShardInfo == nil {
+				m.ShardInfo = &ShardInfo{}
+			}
+			if err := m.ShardInfo.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ListOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ListOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ListOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LabelSelector", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LabelSelector = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldSelector", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldSelector = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Watch", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Watch = bool(v != 0)
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TimeoutSeconds", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.TimeoutSeconds = &v
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+			}
+			m.Limit = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Limit |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Continue", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Continue = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AllowWatchBookmarks", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.AllowWatchBookmarks = bool(v != 0)
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceVersionMatch", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceVersionMatch = ResourceVersionMatch(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SendInitialEvents", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.SendInitialEvents = &b
+		case 15:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ShardSelector", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ShardSelector = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ManagedFieldsEntry) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ManagedFieldsEntry: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ManagedFieldsEntry: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Manager", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Manager = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Operation", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Operation = ManagedFieldsOperationType(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field APIVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.APIVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Time", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Time == nil {
+				m.Time = &Time{}
+			}
+			if err := m.Time.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldsType", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldsType = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldsV1", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.FieldsV1 == nil {
+				m.FieldsV1 = &FieldsV1{}
+			}
+			if err := m.FieldsV1.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Subresource", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Subresource = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ObjectMeta) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ObjectMeta: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ObjectMeta: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GenerateName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.GenerateName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Namespace = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SelfLink", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SelfLink = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UID = k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Generation", wireType)
+			}
+			m.Generation = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Generation |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CreationTimestamp", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.CreationTimestamp.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeletionTimestamp", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.DeletionTimestamp == nil {
+				m.DeletionTimestamp = &Time{}
+			}
+			if err := m.DeletionTimestamp.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 10:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeletionGracePeriodSeconds", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.DeletionGracePeriodSeconds = &v
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Labels", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Labels == nil {
+				m.Labels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipGenerated(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.Labels[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 12:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Annotations", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Annotations == nil {
+				m.Annotations = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipGenerated(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.Annotations[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 13:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OwnerReferences", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.OwnerReferences = append(m.OwnerReferences, OwnerReference{})
+			if err := m.OwnerReferences[len(m.OwnerReferences)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 14:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Finalizers", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Finalizers = append(m.Finalizers, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 17:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ManagedFields", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ManagedFields = append(m.ManagedFields, ManagedFieldsEntry{})
+			if err := m.ManagedFields[len(m.ManagedFields)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *OwnerReference) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: OwnerReference: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: OwnerReference: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UID = k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field APIVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.APIVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Controller", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.Controller = &b
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BlockOwnerDeletion", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.BlockOwnerDeletion = &b
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PartialObjectMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PartialObjectMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PartialObjectMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PartialObjectMetadataList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PartialObjectMetadataList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PartialObjectMetadataList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, PartialObjectMetadata{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Patch) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Patch: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Patch: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PatchOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PatchOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PatchOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DryRun", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DryRun = append(m.DryRun, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Force", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.Force = &b
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldManager", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldManager = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldValidation", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldValidation = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Preconditions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Preconditions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Preconditions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
+			m.UID = &s
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ResourceVersion = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RootPaths) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RootPaths: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RootPaths: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Paths", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Paths = append(m.Paths, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ServerAddressByClientCIDR) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ServerAddressByClientCIDR: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ServerAddressByClientCIDR: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientCIDR", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ClientCIDR = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerAddress", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServerAddress = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ShardInfo) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ShardInfo: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ShardInfo: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Selector", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Selector = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Status) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Status: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Status: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Status = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Reason = StatusReason(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Details", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Details == nil {
+				m.Details = &StatusDetails{}
+			}
+			if err := m.Details.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Code", wireType)
+			}
+			m.Code = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Code |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *StatusCause) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: StatusCause: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: StatusCause: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = CauseType(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Field", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Field = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *StatusDetails) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: StatusDetails: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: StatusDetails: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Group", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Group = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Causes", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Causes = append(m.Causes, StatusCause{})
+			if err := m.Causes[len(m.Causes)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RetryAfterSeconds", wireType)
+			}
+			m.RetryAfterSeconds = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.RetryAfterSeconds |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UID = k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TableOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TableOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TableOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IncludeObject", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.IncludeObject = IncludeObjectPolicy(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Timestamp) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Timestamp: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Timestamp: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Seconds", wireType)
+			}
+			m.Seconds = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Seconds |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Nanos", wireType)
+			}
+			m.Nanos = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Nanos |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TypeMeta) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TypeMeta: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TypeMeta: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field APIVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.APIVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UpdateOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UpdateOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UpdateOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DryRun", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DryRun = append(m.DryRun, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldManager", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldManager = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldValidation", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldValidation = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Verbs) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Verbs: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Verbs: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			*m = append(*m, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WatchEvent) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WatchEvent: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WatchEvent: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Object", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Object.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipGenerated(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLengthGenerated
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupGenerated
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthGenerated
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+var (
+	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto
new file mode 100644
index 0000000000..afc9b250fa
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto
@@ -0,0 +1,1331 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.apimachinery.pkg.apis.meta.v1;
+
+import "k8s.io/apimachinery/pkg/runtime/generated.proto";
+import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/apimachinery/pkg/apis/meta/v1";
+
+// APIGroup contains the name, the supported versions, and the preferred version
+// of a group.
+message APIGroup {
+  // name is the name of the group.
+  optional string name = 1;
+
+  // versions are the versions supported in this group.
+  // +listType=atomic
+  repeated GroupVersionForDiscovery versions = 2;
+
+  // preferredVersion is the version preferred by the API server, which
+  // probably is the storage version.
+  // +optional
+  optional GroupVersionForDiscovery preferredVersion = 3;
+
+  // a map of client CIDR to server address that is serving this group.
+  // This is to help clients reach servers in the most network-efficient way possible.
+  // Clients can use the appropriate server address as per the CIDR that they match.
+  // In case of multiple matches, clients should use the longest matching CIDR.
+  // The server returns only those CIDRs that it thinks that the client can match.
+  // For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP.
+  // Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.
+  // +optional
+  // +listType=atomic
+  repeated ServerAddressByClientCIDR serverAddressByClientCIDRs = 4;
+}
+
+// APIGroupList is a list of APIGroup, to allow clients to discover the API at
+// /apis.
+message APIGroupList {
+  // groups is a list of APIGroup.
+  // +listType=atomic
+  repeated APIGroup groups = 1;
+}
+
+// APIResource specifies the name of a resource and whether it is namespaced.
+message APIResource {
+  // name is the plural name of the resource.
+  optional string name = 1;
+
+  // singularName is the singular name of the resource.  This allows clients to handle plural and singular opaquely.
+  // The singularName is more correct for reporting status on a single item and both singular and plural are allowed
+  // from the kubectl CLI interface.
+  optional string singularName = 6;
+
+  // namespaced indicates if a resource is namespaced or not.
+  optional bool namespaced = 2;
+
+  // group is the preferred group of the resource.  Empty implies the group of the containing resource list.
+  // For subresources, this may have a different value, for example: Scale".
+  optional string group = 8;
+
+  // version is the preferred version of the resource.  Empty implies the version of the containing resource list
+  // For subresources, this may have a different value, for example: v1 (while inside a v1beta1 version of the core resource's group)".
+  optional string version = 9;
+
+  // kind is the kind for the resource (e.g. 'Foo' is the kind for a resource 'foo')
+  optional string kind = 3;
+
+  // verbs is a list of supported kube verbs (this includes get, list, watch, create,
+  // update, patch, delete, deletecollection, and proxy)
+  optional Verbs verbs = 4;
+
+  // shortNames is a list of suggested short names of the resource.
+  // +listType=atomic
+  repeated string shortNames = 5;
+
+  // categories is a list of the grouped resources this resource belongs to (e.g. 'all')
+  // +listType=atomic
+  repeated string categories = 7;
+
+  // The hash value of the storage version, the version this resource is
+  // converted to when written to the data store. Value must be treated
+  // as opaque by clients. Only equality comparison on the value is valid.
+  // This is an alpha feature and may change or be removed in the future.
+  // The field is populated by the apiserver only if the
+  // StorageVersionHash feature gate is enabled.
+  // This field will remain optional even if it graduates.
+  // +optional
+  optional string storageVersionHash = 10;
+}
+
+// APIResourceList is a list of APIResource, it is used to expose the name of the
+// resources supported in a specific group and version, and if the resource
+// is namespaced.
+message APIResourceList {
+  // groupVersion is the group and version this APIResourceList is for.
+  optional string groupVersion = 1;
+
+  // resources contains the name of the resources and if they are namespaced.
+  // +listType=atomic
+  repeated APIResource resources = 2;
+}
+
+// APIVersions lists the versions that are available, to allow clients to
+// discover the API at /api, which is the root path of the legacy v1 API.
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+message APIVersions {
+  // versions are the api versions that are available.
+  // +listType=atomic
+  repeated string versions = 1;
+
+  // a map of client CIDR to server address that is serving this group.
+  // This is to help clients reach servers in the most network-efficient way possible.
+  // Clients can use the appropriate server address as per the CIDR that they match.
+  // In case of multiple matches, clients should use the longest matching CIDR.
+  // The server returns only those CIDRs that it thinks that the client can match.
+  // For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP.
+  // Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.
+  // +listType=atomic
+  repeated ServerAddressByClientCIDR serverAddressByClientCIDRs = 2;
+}
+
+// ApplyOptions may be provided when applying an API object.
+// FieldManager is required for apply requests.
+// ApplyOptions is equivalent to PatchOptions. It is provided as a convenience with documentation
+// that speaks specifically to how the options fields relate to apply.
+message ApplyOptions {
+  // When present, indicates that modifications should not be
+  // persisted. An invalid or unrecognized dryRun directive will
+  // result in an error response and no further processing of the
+  // request. Valid values are:
+  // - All: all dry run stages will be processed
+  // +optional
+  // +listType=atomic
+  repeated string dryRun = 1;
+
+  // Force is going to "force" Apply requests. It means user will
+  // re-acquire conflicting fields owned by other people.
+  optional bool force = 2;
+
+  // fieldManager is a name associated with the actor or entity
+  // that is making these changes. The value must be less than or
+  // 128 characters long, and only contain printable characters,
+  // as defined by https://golang.org/pkg/unicode/#IsPrint. This
+  // field is required.
+  optional string fieldManager = 3;
+}
+
+// Condition contains details for one aspect of the current state of this API Resource.
+// ---
+// This struct is intended for direct use as an array at the field path .status.conditions.  For example,
+//
+// 	type FooStatus struct{
+// 	    // Represents the observations of a foo's current state.
+// 	    // Known .status.conditions.type are: "Available", "Progressing", and "Degraded"
+// 	    // +patchMergeKey=type
+// 	    // +patchStrategy=merge
+// 	    // +listType=map
+// 	    // +listMapKey=type
+// 	    // +k8s:alpha(since: "1.37")=+k8s:optional
+// 	    // +k8s:alpha(since: "1.37")=+k8s:listType=map
+// 	    // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+// 	    Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
+//
+// 	    // other fields
+// 	}
+message Condition {
+  // type of condition in CamelCase or in foo.example.com/CamelCase.
+  // ---
+  // Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
+  // useful (see .node.status.conditions), the ability to deconflict is important.
+  // The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+  // +required
+  // +kubebuilder:validation:Required
+  // +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$`
+  // +kubebuilder:validation:MaxLength=316
+  // +k8s:alpha(since: "1.37")=+k8s:required
+  optional string type = 1;
+
+  // status of the condition, one of True, False, Unknown.
+  // +required
+  // +kubebuilder:validation:Required
+  // +kubebuilder:validation:Enum=True;False;Unknown
+  // +k8s:alpha(since: "1.37")=+k8s:required
+  optional string status = 2;
+
+  // observedGeneration represents the .metadata.generation that the condition was set based upon.
+  // For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+  // with respect to the current state of the instance.
+  // +optional
+  // +kubebuilder:validation:Minimum=0
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:minimum=0
+  optional int64 observedGeneration = 3;
+
+  // lastTransitionTime is the last time the condition transitioned from one status to another.
+  // This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+  // +required
+  // +kubebuilder:validation:Required
+  // +kubebuilder:validation:Type=string
+  // +kubebuilder:validation:Format=date-time
+  // +k8s:alpha(since: "1.37")=+k8s:customValidation
+  optional Time lastTransitionTime = 4;
+
+  // reason contains a programmatic identifier indicating the reason for the condition's last transition.
+  // Producers of specific condition types may define expected values and meanings for this field,
+  // and whether the values are considered a guaranteed API.
+  // The value should be a CamelCase string.
+  // This field may not be empty.
+  // +required
+  // +kubebuilder:validation:Required
+  // +kubebuilder:validation:MaxLength=1024
+  // +kubebuilder:validation:MinLength=1
+  // +kubebuilder:validation:Pattern=`^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$`
+  // +k8s:alpha(since: "1.37")=+k8s:required
+  // +k8s:alpha(since: "1.37")=+k8s:maxBytes=1024
+  optional string reason = 5;
+
+  // message is a human readable message indicating details about the transition.
+  // This may be an empty string.
+  // +required
+  // +kubebuilder:validation:Required
+  // +kubebuilder:validation:MaxLength=32768
+  optional string message = 6;
+}
+
+// CreateOptions may be provided when creating an API object.
+message CreateOptions {
+  // When present, indicates that modifications should not be
+  // persisted. An invalid or unrecognized dryRun directive will
+  // result in an error response and no further processing of the
+  // request. Valid values are:
+  // - All: all dry run stages will be processed
+  // +optional
+  // +listType=atomic
+  repeated string dryRun = 1;
+
+  // fieldManager is a name associated with the actor or entity
+  // that is making these changes. The value must be less than or
+  // 128 characters long, and only contain printable characters,
+  // as defined by https://golang.org/pkg/unicode/#IsPrint.
+  // +optional
+  optional string fieldManager = 3;
+
+  // fieldValidation instructs the server on how to handle
+  // objects in the request (POST/PUT/PATCH) containing unknown
+  // or duplicate fields. Valid values are:
+  // - Ignore: This will ignore any unknown fields that are silently
+  // dropped from the object, and will ignore all but the last duplicate
+  // field that the decoder encounters. This is the default behavior
+  // prior to v1.23.
+  // - Warn: This will send a warning via the standard warning response
+  // header for each unknown field that is dropped from the object, and
+  // for each duplicate field that is encountered. The request will
+  // still succeed if there are no other errors, and will only persist
+  // the last of any duplicate fields. This is the default in v1.23+
+  // - Strict: This will fail the request with a BadRequest error if
+  // any unknown fields would be dropped from the object, or if any
+  // duplicate fields are present. The error returned from the server
+  // will contain all unknown and duplicate fields encountered.
+  // +optional
+  optional string fieldValidation = 4;
+}
+
+// DeleteOptions may be provided when deleting an API object.
+message DeleteOptions {
+  // The duration in seconds before the object should be deleted. Value must be non-negative integer.
+  // The value zero indicates delete immediately. If this value is nil, the default grace period for the
+  // specified type will be used.
+  // Defaults to a per object value if not specified. zero means delete immediately.
+  // +optional
+  optional int64 gracePeriodSeconds = 1;
+
+  // Must be fulfilled before a deletion is carried out. If not possible, a 409 Conflict status will be
+  // returned.
+  // +k8s:conversion-gen=false
+  // +optional
+  optional Preconditions preconditions = 2;
+
+  // Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7.
+  // Should the dependent objects be orphaned. If true/false, the "orphan"
+  // finalizer will be added to/removed from the object's finalizers list.
+  // Either this field or PropagationPolicy may be set, but not both.
+  // +optional
+  optional bool orphanDependents = 3;
+
+  // Whether and how garbage collection will be performed.
+  // Either this field or OrphanDependents may be set, but not both.
+  // The default policy is decided by the existing finalizer set in the
+  // metadata.finalizers and the resource-specific default policy.
+  // Acceptable values are: 'Orphan' - orphan the dependents; 'Background' -
+  // allow the garbage collector to delete the dependents in the background;
+  // 'Foreground' - a cascading policy that deletes all dependents in the
+  // foreground.
+  // +optional
+  optional string propagationPolicy = 4;
+
+  // When present, indicates that modifications should not be
+  // persisted. An invalid or unrecognized dryRun directive will
+  // result in an error response and no further processing of the
+  // request. Valid values are:
+  // - All: all dry run stages will be processed
+  // +optional
+  // +listType=atomic
+  repeated string dryRun = 5;
+
+  // if set to true, it will trigger an unsafe deletion of the resource in
+  // case the normal deletion flow fails with a corrupt object error.
+  // A resource is considered corrupt if it can not be retrieved from
+  // the underlying storage successfully because of a) its data can
+  // not be transformed e.g. decryption failure, or b) it fails
+  // to decode into an object.
+  // NOTE: unsafe deletion ignores finalizer constraints, skips
+  // precondition checks, and removes the object from the storage.
+  // WARNING: This may potentially break the cluster if the workload
+  // associated with the resource being unsafe-deleted relies on normal
+  // deletion flow. Use only if you REALLY know what you are doing.
+  // The default value is false, and the user must opt in to enable it
+  // +optional
+  optional bool ignoreStoreReadErrorWithClusterBreakingPotential = 6;
+}
+
+// Duration is a wrapper around time.Duration which supports correct
+// marshaling to YAML and JSON. In particular, it marshals into strings, which
+// can be used as map keys in json.
+message Duration {
+  optional int64 duration = 1;
+}
+
+// FieldSelectorRequirement is a selector that contains values, a key, and an operator that
+// relates the key and values.
+message FieldSelectorRequirement {
+  // key is the field selector key that the requirement applies to.
+  optional string key = 1;
+
+  // operator represents a key's relationship to a set of values.
+  // Valid operators are In, NotIn, Exists, DoesNotExist.
+  // The list of operators may grow in the future.
+  optional string operator = 2;
+
+  // values is an array of string values.
+  // If the operator is In or NotIn, the values array must be non-empty.
+  // If the operator is Exists or DoesNotExist, the values array must be empty.
+  // +optional
+  // +listType=atomic
+  repeated string values = 3;
+}
+
+// FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.
+//
+// Each key is either a '.' representing the field itself, and will always map to an empty set,
+// or a string representing a sub-field or item. The string will follow one of these four formats:
+// 'f:<name>', where <name> is the name of a field in a struct, or key in a map
+// 'v:<value>', where <value> is the exact json formatted value of a list item
+// 'i:<index>', where <index> is position of a item in a list
+// 'k:<keys>', where <keys> is a map of  a list item's key fields to their unique values
+// If a key maps to an empty Fields value, the field that key represents is part of the set.
+//
+// The exact format is defined in sigs.k8s.io/structured-merge-diff
+// +k8s:deepcopy-gen=false
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message FieldsV1 {
+  // Raw is the underlying serialization of this object.
+  //
+  // Deprecated: Direct access to this field is deprecated. Use GetRawBytes, GetRawString, SetRawBytes, SetRawString, GetRawReader, NewFieldsV1 instead.
+  optional bytes Raw = 1;
+}
+
+// GetOptions is the standard query options to the standard REST get call.
+message GetOptions {
+  // resourceVersion sets a constraint on what resource versions a request may be served from.
+  // See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+  // details.
+  //
+  // Defaults to unset
+  // +optional
+  optional string resourceVersion = 1;
+}
+
+// GroupKind specifies a Group and a Kind, but does not force a version.  This is useful for identifying
+// concepts during lookup stages without having partially valid types
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message GroupKind {
+  optional string group = 1;
+
+  optional string kind = 2;
+}
+
+// GroupResource specifies a Group and a Resource, but does not force a version.  This is useful for identifying
+// concepts during lookup stages without having partially valid types
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message GroupResource {
+  optional string group = 1;
+
+  optional string resource = 2;
+}
+
+// GroupVersion contains the "group" and the "version", which uniquely identifies the API.
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message GroupVersion {
+  optional string group = 1;
+
+  optional string version = 2;
+}
+
+// GroupVersion contains the "group/version" and "version" string of a version.
+// It is made a struct to keep extensibility.
+message GroupVersionForDiscovery {
+  // groupVersion specifies the API group and version in the form "group/version"
+  optional string groupVersion = 1;
+
+  // version specifies the version in the form of "version". This is to save
+  // the clients the trouble of splitting the GroupVersion.
+  optional string version = 2;
+}
+
+// GroupVersionKind unambiguously identifies a kind.  It doesn't anonymously include GroupVersion
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message GroupVersionKind {
+  optional string group = 1;
+
+  optional string version = 2;
+
+  optional string kind = 3;
+}
+
+// GroupVersionResource unambiguously identifies a resource.  It doesn't anonymously include GroupVersion
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message GroupVersionResource {
+  optional string group = 1;
+
+  optional string version = 2;
+
+  optional string resource = 3;
+}
+
+// A label selector is a label query over a set of resources. The result of matchLabels and
+// matchExpressions are ANDed. An empty label selector matches all objects. A null
+// label selector matches no objects.
+// +structType=atomic
+message LabelSelector {
+  // matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+  // map is equivalent to an element of matchExpressions, whose key field is "key", the
+  // operator is "In", and the values array contains only "value". The requirements are ANDed.
+  // +optional
+  map<string, string> matchLabels = 1;
+
+  // matchExpressions is a list of label selector requirements. The requirements are ANDed.
+  // +optional
+  // +listType=atomic
+  repeated LabelSelectorRequirement matchExpressions = 2;
+}
+
+// A label selector requirement is a selector that contains values, a key, and an operator that
+// relates the key and values.
+message LabelSelectorRequirement {
+  // key is the label key that the selector applies to.
+  optional string key = 1;
+
+  // operator represents a key's relationship to a set of values.
+  // Valid operators are In, NotIn, Exists and DoesNotExist.
+  optional string operator = 2;
+
+  // values is an array of string values. If the operator is In or NotIn,
+  // the values array must be non-empty. If the operator is Exists or DoesNotExist,
+  // the values array must be empty. This array is replaced during a strategic
+  // merge patch.
+  // +optional
+  // +listType=atomic
+  repeated string values = 3;
+}
+
+// List holds a list of objects, which may not be known by the server.
+message List {
+  // Standard list metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +optional
+  optional ListMeta metadata = 1;
+
+  // List of objects
+  repeated .k8s.io.apimachinery.pkg.runtime.RawExtension items = 2;
+}
+
+// ListMeta describes metadata that synthetic resources must have, including lists and
+// various status objects. A resource may have only one of {ObjectMeta, ListMeta}.
+message ListMeta {
+  // Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
+  // +optional
+  optional string selfLink = 1;
+
+  // String that identifies the server's internal version of this object that
+  // can be used by clients to determine when objects have changed.
+  // Value must be treated as opaque by clients and passed unmodified back to the server.
+  // Populated by the system.
+  // Read-only.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+  // +optional
+  optional string resourceVersion = 2;
+
+  // continue may be set if the user set a limit on the number of items returned, and indicates that
+  // the server has more data available. The value is opaque and may be used to issue another request
+  // to the endpoint that served this list to retrieve the next set of available objects. Continuing a
+  // consistent list may not be possible if the server configuration has changed or more than a few
+  // minutes have passed. The resourceVersion field returned when using this continue value will be
+  // identical to the value in the first response, unless you have received this token from an error
+  // message.
+  optional string continue = 3;
+
+  // remainingItemCount is the number of subsequent items in the list which are not included in this
+  // list response. If the list request contained label or field selectors, then the number of
+  // remaining items is unknown and the field will be left unset and omitted during serialization.
+  // If the list is complete (either because it is not chunking or because this is the last chunk),
+  // then there are no more remaining items and this field will be left unset and omitted during
+  // serialization.
+  // Servers older than v1.15 do not set this field.
+  // The intended use of the remainingItemCount is *estimating* the size of a collection. Clients
+  // should not rely on the remainingItemCount to be set or to be exact.
+  // +optional
+  optional int64 remainingItemCount = 4;
+
+  // shardInfo is set when the list is a filtered subset of the full collection,
+  // as selected by a shard selector on the request. It echoes back the selector
+  // so clients can verify which shard they received and merge sharded responses.
+  // Clients should not cache sharded list responses as a full representation
+  // of the collection.
+  //
+  // This is an alpha field and requires enabling the ShardedListAndWatch feature gate.
+  // +featureGate=ShardedListAndWatch
+  // +optional
+  optional ShardInfo shardInfo = 5;
+}
+
+// ListOptions is the query options to a standard REST list call.
+message ListOptions {
+  // A selector to restrict the list of returned objects by their labels.
+  // Defaults to everything.
+  // +optional
+  optional string labelSelector = 1;
+
+  // A selector to restrict the list of returned objects by their fields.
+  // Defaults to everything.
+  // +optional
+  optional string fieldSelector = 2;
+
+  // Watch for changes to the described resources and return them as a stream of
+  // add, update, and remove notifications. Specify resourceVersion.
+  // +optional
+  optional bool watch = 3;
+
+  // allowWatchBookmarks requests watch events with type "BOOKMARK".
+  // Servers that do not implement bookmarks may ignore this flag and
+  // bookmarks are sent at the server's discretion. Clients should not
+  // assume bookmarks are returned at any specific interval, nor may they
+  // assume the server will send any BOOKMARK event during a session.
+  // If this is not a watch, this field is ignored.
+  // +optional
+  optional bool allowWatchBookmarks = 9;
+
+  // resourceVersion sets a constraint on what resource versions a request may be served from.
+  // See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+  // details.
+  //
+  // Defaults to unset
+  // +optional
+  optional string resourceVersion = 4;
+
+  // resourceVersionMatch determines how resourceVersion is applied to list calls.
+  // It is highly recommended that resourceVersionMatch be set for list calls where
+  // resourceVersion is set
+  // See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+  // details.
+  //
+  // Defaults to unset
+  // +optional
+  optional string resourceVersionMatch = 10;
+
+  // Timeout for the list/watch call.
+  // This limits the duration of the call, regardless of any activity or inactivity.
+  // +optional
+  optional int64 timeoutSeconds = 5;
+
+  // limit is a maximum number of responses to return for a list call. If more items exist, the
+  // server will set the `continue` field on the list metadata to a value that can be used with the
+  // same initial query to retrieve the next set of results. Setting a limit may return fewer than
+  // the requested amount of items (up to zero items) in the event all requested objects are
+  // filtered out and clients should only use the presence of the continue field to determine whether
+  // more results are available. Servers may choose not to support the limit argument and will return
+  // all of the available results. If limit is specified and the continue field is empty, clients may
+  // assume that no more results are available. This field is not supported if watch is true.
+  //
+  // The server guarantees that the objects returned when using continue will be identical to issuing
+  // a single list call without a limit - that is, no objects created, modified, or deleted after the
+  // first request is issued will be included in any subsequent continued requests. This is sometimes
+  // referred to as a consistent snapshot, and ensures that a client that is using limit to receive
+  // smaller chunks of a very large result can ensure they see all possible objects. If objects are
+  // updated during a chunked list the version of the object that was present at the time the first list
+  // result was calculated is returned.
+  optional int64 limit = 7;
+
+  // The continue option should be set when retrieving more results from the server. Since this value is
+  // server defined, clients may only use the continue value from a previous query result with identical
+  // query parameters (except for the value of continue) and the server may reject a continue value it
+  // does not recognize. If the specified continue value is no longer valid whether due to expiration
+  // (generally five to fifteen minutes) or a configuration change on the server, the server will
+  // respond with a 410 ResourceExpired error together with a continue token. If the client needs a
+  // consistent list, it must restart their list without the continue field. Otherwise, the client may
+  // send another list request with the token received with the 410 error, the server will respond with
+  // a list starting from the next key, but from the latest snapshot, which is inconsistent from the
+  // previous list results - objects that are created, modified, or deleted after the first list request
+  // will be included in the response, as long as their keys are after the "next key".
+  //
+  // This field is not supported when watch is true. Clients may start a watch from the last
+  // resourceVersion value returned by the server and not miss any modifications.
+  optional string continue = 8;
+
+  // `sendInitialEvents=true` may be set together with `watch=true`.
+  // In that case, the watch stream will begin with synthetic events to
+  // produce the current state of objects in the collection. Once all such
+  // events have been sent, a synthetic "Bookmark" event  will be sent.
+  // The bookmark will report the ResourceVersion (RV) corresponding to the
+  // set of objects, and be marked with `"k8s.io/initial-events-end": "true"` annotation.
+  // Afterwards, the watch stream will proceed as usual, sending watch events
+  // corresponding to changes (subsequent to the RV) to objects watched.
+  //
+  // When `sendInitialEvents` option is set, we require `resourceVersionMatch`
+  // option to also be set. The semantic of the watch request is as following:
+  // - `resourceVersionMatch` = NotOlderThan
+  //   is interpreted as "data at least as new as the provided `resourceVersion`"
+  //   and the bookmark event is send when the state is synced
+  //   to a `resourceVersion` at least as fresh as the one provided by the ListOptions.
+  //   If `resourceVersion` is unset, this is interpreted as "consistent read" and the
+  //   bookmark event is send when the state is synced at least to the moment
+  //   when request started being processed.
+  // - `resourceVersionMatch` set to any other value or unset
+  //   Invalid error is returned.
+  //
+  // Defaults to true if `resourceVersion=""` or `resourceVersion="0"` (for backward
+  // compatibility reasons) and to false otherwise.
+  // +optional
+  optional bool sendInitialEvents = 11;
+
+  // shardSelector restricts the list of returned objects using a CEL-based
+  // shard selector expression. The format uses the shardRange() function
+  // combined with || (logical OR) to specify one or more hash ranges:
+  //
+  //   shardRange(object.metadata.uid, '0x0', '0x8000000000000000')
+  //   shardRange(object.metadata.uid, '0x0', '0x8000000000000000') || shardRange(object.metadata.uid, '0x8000000000000000', '0x10000000000000000')
+  //
+  // Field paths use CEL-style object-rooted syntax (e.g. "object.metadata.uid"),
+  // NOT the fieldSelector format ("metadata.uid"). Currently supported paths:
+  //   - object.metadata.uid
+  //   - object.metadata.namespace
+  //
+  // hexStart and hexEnd are single-quoted CEL string literals with a '0x' prefix,
+  // defining the inclusive lower and exclusive upper bounds over the 64-bit FNV-1a
+  // hash space. The full range is [0x0, 0x10000000000000000), where the exclusive
+  // upper bound equals 2^64.
+  //
+  // Examples:
+  //   2-shard split:
+  //     shard 0: shardRange(object.metadata.uid, '0x0000000000000000', '0x8000000000000000')
+  //     shard 1: shardRange(object.metadata.uid, '0x8000000000000000', '0x10000000000000000')
+  //   4-shard split:
+  //     shard 0: shardRange(object.metadata.uid, '0x0000000000000000', '0x4000000000000000')
+  //     shard 1: shardRange(object.metadata.uid, '0x4000000000000000', '0x8000000000000000')
+  //     shard 2: shardRange(object.metadata.uid, '0x8000000000000000', '0xc000000000000000')
+  //     shard 3: shardRange(object.metadata.uid, '0xc000000000000000', '0x10000000000000000')
+  //
+  // This is an alpha field and requires enabling the ShardedListAndWatch feature gate.
+  // +featureGate=ShardedListAndWatch
+  // +optional
+  optional string shardSelector = 15;
+}
+
+// ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource
+// that the fieldset applies to.
+message ManagedFieldsEntry {
+  // Manager is an identifier of the workflow managing these fields.
+  optional string manager = 1;
+
+  // Operation is the type of operation which lead to this ManagedFieldsEntry being created.
+  // The only valid values for this field are 'Apply' and 'Update'.
+  // +k8s:alpha(since: "1.37")=+k8s:required
+  optional string operation = 2;
+
+  // APIVersion defines the version of this resource that this field set
+  // applies to. The format is "group/version" just like the top-level
+  // APIVersion field. It is necessary to track the version of a field
+  // set because it cannot be automatically converted.
+  optional string apiVersion = 3;
+
+  // Time is the timestamp of when the ManagedFields entry was added. The
+  // timestamp will also be updated if a field is added, the manager
+  // changes any of the owned fields value or removes a field. The
+  // timestamp does not update when a field is removed from the entry
+  // because another manager took it over.
+  // +optional
+  optional Time time = 4;
+
+  // FieldsType is the discriminator for the different fields format and version.
+  // There is currently only one possible value: "FieldsV1"
+  optional string fieldsType = 6;
+
+  // FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
+  // +optional
+  optional FieldsV1 fieldsV1 = 7;
+
+  // Subresource is the name of the subresource used to update that object, or
+  // empty string if the object was updated through the main resource. The
+  // value of this field is used to distinguish between managers, even if they
+  // share the same name. For example, a status update will be distinct from a
+  // regular update using the same manager name.
+  // Note that the APIVersion field is not related to the Subresource field and
+  // it always corresponds to the version of the main resource.
+  optional string subresource = 8;
+}
+
+// MicroTime is version of Time with microsecond level precision.
+//
+// +protobuf.options.marshal=false
+// +protobuf.as=Timestamp
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message MicroTime {
+  // Represents seconds of UTC time since Unix epoch
+  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+  // 9999-12-31T23:59:59Z inclusive.
+  optional int64 seconds = 1;
+
+  // Non-negative fractions of a second at nanosecond resolution. Negative
+  // second values with fractions must still have non-negative nanos values
+  // that count forward in time. Must be from 0 to 999,999,999
+  // inclusive. This field may be limited in precision depending on context.
+  optional int32 nanos = 2;
+}
+
+// ObjectMeta is metadata that all persisted resources must have, which includes all objects
+// users must create.
+message ObjectMeta {
+  // Name must be unique within a namespace. Is required when creating resources, although
+  // some resources may allow a client to request the generation of an appropriate name
+  // automatically. Name is primarily intended for creation idempotence and configuration
+  // definition.
+  // Cannot be updated.
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+  // +optional
+  optional string name = 1;
+
+  // GenerateName is an optional prefix, used by the server, to generate a unique
+  // name ONLY IF the Name field has not been provided.
+  // If this field is used, the name returned to the client will be different
+  // than the name passed. This value will also be combined with a unique suffix.
+  // The provided value has the same validation rules as the Name field,
+  // and may be truncated by the length of the suffix required to make the value
+  // unique on the server.
+  //
+  // If this field is specified and the generated name exists, the server will return a 409.
+  //
+  // Applied only if Name is not specified.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
+  // +optional
+  optional string generateName = 2;
+
+  // Namespace defines the space within which each name must be unique. An empty namespace is
+  // equivalent to the "default" namespace, but "default" is the canonical representation.
+  // Not all objects are required to be scoped to a namespace - the value of this field for
+  // those objects will be empty.
+  //
+  // Must be a DNS_LABEL.
+  // Cannot be updated.
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces
+  // +optional
+  optional string namespace = 3;
+
+  // Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
+  // +optional
+  optional string selfLink = 4;
+
+  // UID is the unique in time and space value for this object. It is typically generated by
+  // the server on successful creation of a resource and is not allowed to change on PUT
+  // operations.
+  //
+  // Populated by the system.
+  // Read-only.
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+  // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  optional string uid = 5;
+
+  // An opaque value that represents the internal version of this object that can
+  // be used by clients to determine when objects have changed. May be used for optimistic
+  // concurrency, change detection, and the watch operation on a resource or set of resources.
+  // Clients must treat these values as opaque and passed unmodified back to the server.
+  // They may only be valid for a particular resource or set of resources.
+  //
+  // Populated by the system.
+  // Read-only.
+  // Value must be treated as opaque by clients and .
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+  // +optional
+  optional string resourceVersion = 6;
+
+  // A sequence number representing a specific generation of the desired state.
+  // Populated by the system. Read-only.
+  // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:minimum=0
+  optional int64 generation = 7;
+
+  // CreationTimestamp is a timestamp representing the server time when this object was
+  // created. It is not guaranteed to be set in happens-before order across separate operations.
+  // Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+  //
+  // Populated by the system.
+  // Read-only.
+  // Null for lists.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  optional Time creationTimestamp = 8;
+
+  // DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This
+  // field is set by the server when a graceful deletion is requested by the user, and is not
+  // directly settable by a client. The resource is expected to be deleted (no longer visible
+  // from resource lists, and not reachable by name) after the time in this field, once the
+  // finalizers list is empty. As long as the finalizers list contains items, deletion is blocked.
+  // Once the deletionTimestamp is set, this value may not be unset or be set further into the
+  // future, although it may be shortened or the resource may be deleted prior to this time.
+  // For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react
+  // by sending a graceful termination signal to the containers in the pod. After that 30 seconds,
+  // the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup,
+  // remove the pod from the API. In the presence of network partitions, this object may still
+  // exist after this timestamp, until an administrator or automated process can determine the
+  // resource is fully terminated.
+  // If not set, graceful deletion of the object has not been requested.
+  //
+  // Populated by the system when a graceful deletion is requested.
+  // Read-only.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  optional Time deletionTimestamp = 9;
+
+  // Number of seconds allowed for this object to gracefully terminate before
+  // it will be removed from the system. Only set when deletionTimestamp is also set.
+  // May only be shortened.
+  // Read-only.
+  // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  optional int64 deletionGracePeriodSeconds = 10;
+
+  // Map of string keys and values that can be used to organize and categorize
+  // (scope and select) objects. May match selectors of replication controllers
+  // and services.
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
+  // +optional
+  map<string, string> labels = 11;
+
+  // Annotations is an unstructured key value map stored with a resource that may be
+  // set by external tools to store and retrieve arbitrary metadata. They are not
+  // queryable and should be preserved when modifying objects.
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
+  // +optional
+  map<string, string> annotations = 12;
+
+  // List of objects depended by this object. If ALL objects in the list have
+  // been deleted, this object will be garbage collected. If this object is managed by a controller,
+  // then an entry in this list will point to this controller, with the controller field set to true.
+  // There cannot be more than one managing controller.
+  // +optional
+  // +patchMergeKey=uid
+  // +patchStrategy=merge
+  // +listType=map
+  // +listMapKey=uid
+  // +k8s:alpha(since:"1.37")=+k8s:optional
+  repeated OwnerReference ownerReferences = 13;
+
+  // Must be empty before the object is deleted from the registry. Each entry
+  // is an identifier for the responsible component that will remove the entry
+  // from the list. If the deletionTimestamp of the object is non-nil, entries
+  // in this list can only be removed.
+  // Finalizers may be processed and removed in any order.  Order is NOT enforced
+  // because it introduces significant risk of stuck finalizers.
+  // finalizers is a shared field, any actor with permission can reorder it.
+  // If the finalizer list is processed in order, then this can lead to a situation
+  // in which the component responsible for the first finalizer in the list is
+  // waiting for a signal (field value, external system, or other) produced by a
+  // component responsible for a finalizer later in the list, resulting in a deadlock.
+  // Without enforced ordering finalizers are free to order amongst themselves and
+  // are not vulnerable to ordering changes in the list.
+  // +optional
+  // +patchStrategy=merge
+  // +listType=set
+  repeated string finalizers = 14;
+
+  // ManagedFields maps workflow-id and version to the set of fields
+  // that are managed by that workflow. This is mostly for internal
+  // housekeeping, and users typically shouldn't need to set or
+  // understand this field. A workflow can be the user's name, a
+  // controller's name, or the name of a specific apply path like
+  // "ci-cd". The set of fields is always in the version that the
+  // workflow used when modifying the object.
+  //
+  // +optional
+  // +listType=atomic
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  repeated ManagedFieldsEntry managedFields = 17;
+}
+
+// OwnerReference contains enough information to let you identify an owning
+// object. An owning object must be in the same namespace as the dependent, or
+// be cluster-scoped, so there is no namespace field.
+// +structType=atomic
+message OwnerReference {
+  // API version of the referent.
+  // +k8s:alpha(since:"1.37")=+k8s:required
+  optional string apiVersion = 5;
+
+  // Kind of the referent.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +k8s:alpha(since:"1.37")=+k8s:required
+  optional string kind = 1;
+
+  // Name of the referent.
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+  // +k8s:alpha(since:"1.37")=+k8s:required
+  optional string name = 3;
+
+  // UID of the referent.
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+  // +k8s:alpha(since:"1.37")=+k8s:required
+  optional string uid = 4;
+
+  // If true, this reference points to the managing controller.
+  // +optional
+  optional bool controller = 6;
+
+  // If true, AND if the owner has the "foregroundDeletion" finalizer, then
+  // the owner cannot be deleted from the key-value store until this
+  // reference is removed.
+  // See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
+  // for how the garbage collector interacts with this field and enforces the foreground deletion.
+  // Defaults to false.
+  // To set this field, a user needs "delete" permission of the owner,
+  // otherwise 422 (Unprocessable Entity) will be returned.
+  // +optional
+  optional bool blockOwnerDeletion = 7;
+}
+
+// PartialObjectMetadata is a generic representation of any object with ObjectMeta. It allows clients
+// to get access to a particular ObjectMeta schema without knowing the details of the version.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+message PartialObjectMetadata {
+  // Standard object's metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  // +optional
+  // +k8s:opaqueType
+  optional ObjectMeta metadata = 1;
+}
+
+// PartialObjectMetadataList contains a list of objects containing only their metadata
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+message PartialObjectMetadataList {
+  // Standard list metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +optional
+  optional ListMeta metadata = 1;
+
+  // items contains each of the included items.
+  repeated PartialObjectMetadata items = 2;
+}
+
+// Patch is provided to give a concrete name and type to the Kubernetes PATCH request body.
+message Patch {
+}
+
+// PatchOptions may be provided when patching an API object.
+// PatchOptions is meant to be a superset of UpdateOptions.
+message PatchOptions {
+  // When present, indicates that modifications should not be
+  // persisted. An invalid or unrecognized dryRun directive will
+  // result in an error response and no further processing of the
+  // request. Valid values are:
+  // - All: all dry run stages will be processed
+  // +optional
+  // +listType=atomic
+  repeated string dryRun = 1;
+
+  // Force is going to "force" Apply requests. It means user will
+  // re-acquire conflicting fields owned by other people. Force
+  // flag must be unset for non-apply patch requests.
+  // +optional
+  optional bool force = 2;
+
+  // fieldManager is a name associated with the actor or entity
+  // that is making these changes. The value must be less than or
+  // 128 characters long, and only contain printable characters,
+  // as defined by https://golang.org/pkg/unicode/#IsPrint. This
+  // field is required for apply requests
+  // (application/apply-patch) but optional for non-apply patch
+  // types (JsonPatch, MergePatch, StrategicMergePatch).
+  // +optional
+  optional string fieldManager = 3;
+
+  // fieldValidation instructs the server on how to handle
+  // objects in the request (POST/PUT/PATCH) containing unknown
+  // or duplicate fields. Valid values are:
+  // - Ignore: This will ignore any unknown fields that are silently
+  // dropped from the object, and will ignore all but the last duplicate
+  // field that the decoder encounters. This is the default behavior
+  // prior to v1.23.
+  // - Warn: This will send a warning via the standard warning response
+  // header for each unknown field that is dropped from the object, and
+  // for each duplicate field that is encountered. The request will
+  // still succeed if there are no other errors, and will only persist
+  // the last of any duplicate fields. This is the default in v1.23+
+  // - Strict: This will fail the request with a BadRequest error if
+  // any unknown fields would be dropped from the object, or if any
+  // duplicate fields are present. The error returned from the server
+  // will contain all unknown and duplicate fields encountered.
+  // +optional
+  optional string fieldValidation = 4;
+}
+
+// Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.
+message Preconditions {
+  // Specifies the target UID.
+  // +optional
+  optional string uid = 1;
+
+  // Specifies the target ResourceVersion
+  // +optional
+  optional string resourceVersion = 2;
+}
+
+// RootPaths lists the paths available at root.
+// For example: "/healthz", "/apis".
+message RootPaths {
+  // paths are the paths available at root.
+  // +listType=atomic
+  repeated string paths = 1;
+}
+
+// ServerAddressByClientCIDR helps the client to determine the server address that they should use, depending on the clientCIDR that they match.
+message ServerAddressByClientCIDR {
+  // The CIDR with which clients can match their IP to figure out the server address that they should use.
+  optional string clientCIDR = 1;
+
+  // Address of this server, suitable for a client that matches the above CIDR.
+  // This can be a hostname, hostname:port, IP or IP:port.
+  optional string serverAddress = 2;
+}
+
+// ShardInfo describes the shard selector that was applied to produce a list response.
+// Its presence on a list response indicates the list is a filtered subset.
+message ShardInfo {
+  // selector is the shard selector string from the request, echoed back so clients
+  // can verify which shard they received and merge responses from multiple shards.
+  // +required
+  optional string selector = 1;
+}
+
+// Status is a return value for calls that don't return other objects.
+message Status {
+  // Standard list metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +optional
+  optional ListMeta metadata = 1;
+
+  // Status of the operation.
+  // One of: "Success" or "Failure".
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+  // +optional
+  optional string status = 2;
+
+  // A human-readable description of the status of this operation.
+  // +optional
+  optional string message = 3;
+
+  // A machine-readable description of why this operation is in the
+  // "Failure" status. If this value is empty there
+  // is no information available. A Reason clarifies an HTTP status
+  // code but does not override it.
+  // +optional
+  optional string reason = 4;
+
+  // Extended data associated with the reason.  Each reason may define its
+  // own extended details. This field is optional and the data returned
+  // is not guaranteed to conform to any schema except that defined by
+  // the reason type.
+  // +optional
+  optional StatusDetails details = 5;
+
+  // Suggested HTTP return code for this status, 0 if not set.
+  // +optional
+  optional int32 code = 6;
+}
+
+// StatusCause provides more information about an api.Status failure, including
+// cases when multiple errors are encountered.
+message StatusCause {
+  // A machine-readable description of the cause of the error. If this value is
+  // empty there is no information available.
+  // +optional
+  optional string reason = 1;
+
+  // A human-readable description of the cause of the error.  This field may be
+  // presented as-is to a reader.
+  // +optional
+  optional string message = 2;
+
+  // The field of the resource that has caused this error, as named by its JSON
+  // serialization. May include dot and postfix notation for nested attributes.
+  // Arrays are zero-indexed.  Fields may appear more than once in an array of
+  // causes due to fields having multiple errors.
+  // Optional.
+  //
+  // Examples:
+  //   "name" - the field "name" on the current resource
+  //   "items[0].name" - the field "name" on the first array entry in "items"
+  // +optional
+  optional string field = 3;
+}
+
+// StatusDetails is a set of additional properties that MAY be set by the
+// server to provide additional information about a response. The Reason
+// field of a Status object defines what attributes will be set. Clients
+// must ignore fields that do not match the defined type of each attribute,
+// and should assume that any attribute may be empty, invalid, or under
+// defined.
+message StatusDetails {
+  // The name attribute of the resource associated with the status StatusReason
+  // (when there is a single name which can be described).
+  // +optional
+  optional string name = 1;
+
+  // The group attribute of the resource associated with the status StatusReason.
+  // +optional
+  optional string group = 2;
+
+  // The kind attribute of the resource associated with the status StatusReason.
+  // On some operations may differ from the requested resource Kind.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +optional
+  optional string kind = 3;
+
+  // UID of the resource.
+  // (when there is a single resource which can be described).
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+  // +optional
+  optional string uid = 6;
+
+  // The Causes array includes more details associated with the StatusReason
+  // failure. Not all StatusReasons may provide detailed causes.
+  // +optional
+  // +listType=atomic
+  repeated StatusCause causes = 4;
+
+  // If specified, the time in seconds before the operation should be retried. Some errors may indicate
+  // the client must take an alternate action - for those errors this field may indicate how long to wait
+  // before taking the alternate action.
+  // +optional
+  optional int32 retryAfterSeconds = 5;
+}
+
+// TableOptions are used when a Table is requested by the caller.
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+message TableOptions {
+  // includeObject decides whether to include each object along with its columnar information.
+  // Specifying "None" will return no object, specifying "Object" will return the full object contents, and
+  // specifying "Metadata" (the default) will return the object's metadata in the PartialObjectMetadata kind
+  // in version v1beta1 of the meta.k8s.io API group.
+  optional string includeObject = 1;
+}
+
+// Time is a wrapper around time.Time which supports correct
+// marshaling to YAML and JSON.  Wrappers are provided for many
+// of the factory methods that the time package offers.
+//
+// +protobuf.options.marshal=false
+// +protobuf.as=Timestamp
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message Time {
+  // Represents seconds of UTC time since Unix epoch
+  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+  // 9999-12-31T23:59:59Z inclusive.
+  optional int64 seconds = 1;
+
+  // Non-negative fractions of a second at nanosecond resolution. Negative
+  // second values with fractions must still have non-negative nanos values
+  // that count forward in time. Must be from 0 to 999,999,999
+  // inclusive. This field may be limited in precision depending on context.
+  optional int32 nanos = 2;
+}
+
+// Timestamp is a struct that is equivalent to Time, but intended for
+// protobuf marshalling/unmarshalling. It is generated into a serialization
+// that matches Time. Do not use in Go structs.
+message Timestamp {
+  // Represents seconds of UTC time since Unix epoch
+  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+  // 9999-12-31T23:59:59Z inclusive.
+  optional int64 seconds = 1;
+
+  // Non-negative fractions of a second at nanosecond resolution. Negative
+  // second values with fractions must still have non-negative nanos values
+  // that count forward in time. Must be from 0 to 999,999,999
+  // inclusive. This field may be limited in precision depending on context.
+  optional int32 nanos = 2;
+}
+
+// TypeMeta describes an individual object in an API response or request
+// with strings representing the type of the object and its API schema version.
+// Structures that are versioned or persisted should inline TypeMeta.
+//
+// +k8s:deepcopy-gen=false
+message TypeMeta {
+  // Kind is a string value representing the REST resource this object represents.
+  // Servers may infer this from the endpoint the client submits requests to.
+  // Cannot be updated.
+  // In CamelCase.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +optional
+  optional string kind = 1;
+
+  // APIVersion defines the versioned schema of this representation of an object.
+  // Servers should convert recognized schemas to the latest internal value, and
+  // may reject unrecognized values.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+  // +optional
+  optional string apiVersion = 2;
+}
+
+// UpdateOptions may be provided when updating an API object.
+// All fields in UpdateOptions should also be present in PatchOptions.
+message UpdateOptions {
+  // When present, indicates that modifications should not be
+  // persisted. An invalid or unrecognized dryRun directive will
+  // result in an error response and no further processing of the
+  // request. Valid values are:
+  // - All: all dry run stages will be processed
+  // +optional
+  // +listType=atomic
+  repeated string dryRun = 1;
+
+  // fieldManager is a name associated with the actor or entity
+  // that is making these changes. The value must be less than or
+  // 128 characters long, and only contain printable characters,
+  // as defined by https://golang.org/pkg/unicode/#IsPrint.
+  // +optional
+  optional string fieldManager = 2;
+
+  // fieldValidation instructs the server on how to handle
+  // objects in the request (POST/PUT/PATCH) containing unknown
+  // or duplicate fields. Valid values are:
+  // - Ignore: This will ignore any unknown fields that are silently
+  // dropped from the object, and will ignore all but the last duplicate
+  // field that the decoder encounters. This is the default behavior
+  // prior to v1.23.
+  // - Warn: This will send a warning via the standard warning response
+  // header for each unknown field that is dropped from the object, and
+  // for each duplicate field that is encountered. The request will
+  // still succeed if there are no other errors, and will only persist
+  // the last of any duplicate fields. This is the default in v1.23+
+  // - Strict: This will fail the request with a BadRequest error if
+  // any unknown fields would be dropped from the object, or if any
+  // duplicate fields are present. The error returned from the server
+  // will contain all unknown and duplicate fields encountered.
+  // +optional
+  optional string fieldValidation = 3;
+}
+
+// Verbs masks the value so protobuf can generate
+//
+// +protobuf.nullable=true
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message Verbs {
+  // items, if empty, will result in an empty slice
+
+  repeated string items = 1;
+}
+
+// Event represents a single event to a watched resource.
+//
+// +protobuf=true
+// +k8s:deepcopy-gen=true
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+message WatchEvent {
+  optional string type = 1;
+
+  // Object is:
+  //  * If Type is Added or Modified: the new state of the object.
+  //  * If Type is Deleted: the state of the object immediately before deletion.
+  //  * If Type is Error: *Status is recommended; other types may make sense
+  //    depending on context.
+  optional .k8s.io.apimachinery.pkg.runtime.RawExtension object = 2;
+}
+
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/group_version.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/group_version.go
new file mode 100644
index 0000000000..fc9e521e21
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/group_version.go
@@ -0,0 +1,157 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupResource specifies a Group and a Resource, but does not force a version.  This is useful for identifying
+// concepts during lookup stages without having partially valid types
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type GroupResource struct {
+	Group    string `json:"group" protobuf:"bytes,1,opt,name=group"`
+	Resource string `json:"resource" protobuf:"bytes,2,opt,name=resource"`
+}
+
+func (gr *GroupResource) String() string {
+	if gr == nil {
+		return "<nil>"
+	}
+	if len(gr.Group) == 0 {
+		return gr.Resource
+	}
+	return gr.Resource + "." + gr.Group
+}
+
+// GroupVersionResource unambiguously identifies a resource.  It doesn't anonymously include GroupVersion
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type GroupVersionResource struct {
+	Group    string `json:"group" protobuf:"bytes,1,opt,name=group"`
+	Version  string `json:"version" protobuf:"bytes,2,opt,name=version"`
+	Resource string `json:"resource" protobuf:"bytes,3,opt,name=resource"`
+}
+
+func (gvr *GroupVersionResource) String() string {
+	if gvr == nil {
+		return "<nil>"
+	}
+	return strings.Join([]string{gvr.Group, "/", gvr.Version, ", Resource=", gvr.Resource}, "")
+}
+
+// GroupKind specifies a Group and a Kind, but does not force a version.  This is useful for identifying
+// concepts during lookup stages without having partially valid types
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type GroupKind struct {
+	Group string `json:"group" protobuf:"bytes,1,opt,name=group"`
+	Kind  string `json:"kind" protobuf:"bytes,2,opt,name=kind"`
+}
+
+func (gk *GroupKind) String() string {
+	if gk == nil {
+		return "<nil>"
+	}
+	if len(gk.Group) == 0 {
+		return gk.Kind
+	}
+	return gk.Kind + "." + gk.Group
+}
+
+// GroupVersionKind unambiguously identifies a kind.  It doesn't anonymously include GroupVersion
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type GroupVersionKind struct {
+	Group   string `json:"group" protobuf:"bytes,1,opt,name=group"`
+	Version string `json:"version" protobuf:"bytes,2,opt,name=version"`
+	Kind    string `json:"kind" protobuf:"bytes,3,opt,name=kind"`
+}
+
+func (gvk GroupVersionKind) String() string {
+	return gvk.Group + "/" + gvk.Version + ", Kind=" + gvk.Kind
+}
+
+// GroupVersion contains the "group" and the "version", which uniquely identifies the API.
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type GroupVersion struct {
+	Group   string `json:"group" protobuf:"bytes,1,opt,name=group"`
+	Version string `json:"version" protobuf:"bytes,2,opt,name=version"`
+}
+
+// Empty returns true if group and version are empty
+func (gv GroupVersion) Empty() bool {
+	return len(gv.Group) == 0 && len(gv.Version) == 0
+}
+
+// String puts "group" and "version" into a single "group/version" string. For the legacy v1
+// it returns "v1".
+func (gv GroupVersion) String() string {
+	// special case the internal apiVersion for the legacy kube types
+	if gv.Empty() {
+		return ""
+	}
+
+	// special case of "v1" for backward compatibility
+	if len(gv.Group) == 0 && gv.Version == "v1" {
+		return gv.Version
+	}
+	if len(gv.Group) > 0 {
+		return gv.Group + "/" + gv.Version
+	}
+	return gv.Version
+}
+
+// MarshalJSON implements the json.Marshaller interface.
+func (gv GroupVersion) MarshalJSON() ([]byte, error) {
+	s := gv.String()
+	if strings.Count(s, "/") > 1 {
+		return []byte{}, fmt.Errorf("illegal GroupVersion %v: contains more than one /", s)
+	}
+	return json.Marshal(s)
+}
+
+func (gv *GroupVersion) unmarshal(value []byte) error {
+	var s string
+	if err := json.Unmarshal(value, &s); err != nil {
+		return err
+	}
+	parsed, err := schema.ParseGroupVersion(s)
+	if err != nil {
+		return err
+	}
+	gv.Group, gv.Version = parsed.Group, parsed.Version
+	return nil
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+func (gv *GroupVersion) UnmarshalJSON(value []byte) error {
+	return gv.unmarshal(value)
+}
+
+// UnmarshalTEXT implements the Ugorji's encoding.TextUnmarshaler interface.
+func (gv *GroupVersion) UnmarshalText(value []byte) error {
+	return gv.unmarshal(value)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/group_version_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/group_version_test.go
new file mode 100644
index 0000000000..c50a1902ec
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/group_version_test.go
@@ -0,0 +1,78 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	gojson "encoding/json"
+	"reflect"
+	"testing"
+
+	utiljson "k8s.io/apimachinery/pkg/util/json"
+)
+
+type GroupVersionHolder struct {
+	GV GroupVersion `json:"val"`
+}
+
+func TestGroupVersionUnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  []byte
+		expect GroupVersion
+	}{
+		{[]byte(`{"val": "v1"}`), GroupVersion{"", "v1"}},
+		{[]byte(`{"val": "apps/v1"}`), GroupVersion{"apps", "v1"}},
+	}
+
+	for _, c := range cases {
+		var result GroupVersionHolder
+		// test golang lib's JSON codec
+		if err := gojson.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("JSON codec failed to unmarshal input '%v': %v", c.input, err)
+		}
+		if !reflect.DeepEqual(result.GV, c.expect) {
+			t.Errorf("JSON codec failed to unmarshal input '%s': expected %+v, got %+v", c.input, c.expect, result.GV)
+		}
+		// test the utiljson codec
+		if err := utiljson.Unmarshal(c.input, &result); err != nil {
+			t.Errorf("util/json codec failed to unmarshal input '%v': %v", c.input, err)
+		}
+		if !reflect.DeepEqual(result.GV, c.expect) {
+			t.Errorf("util/json codec failed to unmarshal input '%s': expected %+v, got %+v", c.input, c.expect, result.GV)
+		}
+	}
+}
+
+func TestGroupVersionMarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  GroupVersion
+		expect []byte
+	}{
+		{GroupVersion{"", "v1"}, []byte(`{"val":"v1"}`)},
+		{GroupVersion{"apps", "v1"}, []byte(`{"val":"apps/v1"}`)},
+	}
+
+	for _, c := range cases {
+		input := GroupVersionHolder{c.input}
+		result, err := gojson.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input '%v': %v", input, err)
+		}
+		if !reflect.DeepEqual(result, c.expect) {
+			t.Errorf("Failed to marshal input '%+v': expected: %s, got: %s", input, c.expect, result)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/helpers.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/helpers.go
new file mode 100644
index 0000000000..45ed1e9891
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/helpers.go
@@ -0,0 +1,386 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	"k8s.io/apimachinery/pkg/selection"
+	"k8s.io/apimachinery/pkg/types"
+	utiljson "k8s.io/apimachinery/pkg/util/json"
+)
+
+// LabelSelectorAsSelector converts the LabelSelector api type into a struct that implements
+// labels.Selector
+// Note: This function should be kept in sync with the selector methods in pkg/labels/selector.go
+func LabelSelectorAsSelector(ps *LabelSelector) (labels.Selector, error) {
+	if ps == nil {
+		return labels.Nothing(), nil
+	}
+	if len(ps.MatchLabels)+len(ps.MatchExpressions) == 0 {
+		return labels.Everything(), nil
+	}
+	requirements := make([]labels.Requirement, 0, len(ps.MatchLabels)+len(ps.MatchExpressions))
+	for k, v := range ps.MatchLabels {
+		r, err := labels.NewRequirement(k, selection.Equals, []string{v})
+		if err != nil {
+			return nil, err
+		}
+		requirements = append(requirements, *r)
+	}
+	for _, expr := range ps.MatchExpressions {
+		var op selection.Operator
+		switch expr.Operator {
+		case LabelSelectorOpIn:
+			op = selection.In
+		case LabelSelectorOpNotIn:
+			op = selection.NotIn
+		case LabelSelectorOpExists:
+			op = selection.Exists
+		case LabelSelectorOpDoesNotExist:
+			op = selection.DoesNotExist
+		default:
+			return nil, fmt.Errorf("%q is not a valid label selector operator", expr.Operator)
+		}
+		r, err := labels.NewRequirement(expr.Key, op, append([]string(nil), expr.Values...))
+		if err != nil {
+			return nil, err
+		}
+		requirements = append(requirements, *r)
+	}
+	selector := labels.NewSelector()
+	selector = selector.Add(requirements...)
+	return selector, nil
+}
+
+// LabelSelectorAsMap converts the LabelSelector api type into a map of strings, ie. the
+// original structure of a label selector. Operators that cannot be converted into plain
+// labels (Exists, DoesNotExist, NotIn, and In with more than one value) will result in
+// an error.
+func LabelSelectorAsMap(ps *LabelSelector) (map[string]string, error) {
+	if ps == nil {
+		return nil, nil
+	}
+	selector := map[string]string{}
+	for k, v := range ps.MatchLabels {
+		selector[k] = v
+	}
+	for _, expr := range ps.MatchExpressions {
+		switch expr.Operator {
+		case LabelSelectorOpIn:
+			if len(expr.Values) != 1 {
+				return selector, fmt.Errorf("operator %q without a single value cannot be converted into the old label selector format", expr.Operator)
+			}
+			// Should we do anything in case this will override a previous key-value pair?
+			selector[expr.Key] = expr.Values[0]
+		case LabelSelectorOpNotIn, LabelSelectorOpExists, LabelSelectorOpDoesNotExist:
+			return selector, fmt.Errorf("operator %q cannot be converted into the old label selector format", expr.Operator)
+		default:
+			return selector, fmt.Errorf("%q is not a valid selector operator", expr.Operator)
+		}
+	}
+	return selector, nil
+}
+
+// ParseToLabelSelector parses a string representing a selector into a LabelSelector object.
+// Note: This function should be kept in sync with the parser in pkg/labels/selector.go
+func ParseToLabelSelector(selector string) (*LabelSelector, error) {
+	reqs, err := labels.ParseToRequirements(selector)
+	if err != nil {
+		return nil, fmt.Errorf("couldn't parse the selector string \"%s\": %v", selector, err)
+	}
+
+	labelSelector := &LabelSelector{
+		MatchLabels:      map[string]string{},
+		MatchExpressions: []LabelSelectorRequirement{},
+	}
+	for _, req := range reqs {
+		var op LabelSelectorOperator
+		switch req.Operator() {
+		case selection.Equals, selection.DoubleEquals:
+			vals := req.Values()
+			if vals.Len() != 1 {
+				return nil, fmt.Errorf("equals operator must have exactly one value")
+			}
+			val, ok := vals.PopAny()
+			if !ok {
+				return nil, fmt.Errorf("equals operator has exactly one value but it cannot be retrieved")
+			}
+			labelSelector.MatchLabels[req.Key()] = val
+			continue
+		case selection.In:
+			op = LabelSelectorOpIn
+		case selection.NotIn:
+			op = LabelSelectorOpNotIn
+		case selection.Exists:
+			op = LabelSelectorOpExists
+		case selection.DoesNotExist:
+			op = LabelSelectorOpDoesNotExist
+		case selection.GreaterThan, selection.LessThan:
+			// Adding a separate case for these operators to indicate that this is deliberate
+			return nil, fmt.Errorf("%q isn't supported in label selectors", req.Operator())
+		default:
+			return nil, fmt.Errorf("%q is not a valid label selector operator", req.Operator())
+		}
+		labelSelector.MatchExpressions = append(labelSelector.MatchExpressions, LabelSelectorRequirement{
+			Key:      req.Key(),
+			Operator: op,
+			Values:   req.Values().List(),
+		})
+	}
+	return labelSelector, nil
+}
+
+// SetAsLabelSelector converts the labels.Set object into a LabelSelector api object.
+func SetAsLabelSelector(ls labels.Set) *LabelSelector {
+	if ls == nil {
+		return nil
+	}
+
+	selector := &LabelSelector{
+		MatchLabels: make(map[string]string, len(ls)),
+	}
+	for label, value := range ls {
+		selector.MatchLabels[label] = value
+	}
+
+	return selector
+}
+
+// FormatLabelSelector convert labelSelector into plain string
+func FormatLabelSelector(labelSelector *LabelSelector) string {
+	selector, err := LabelSelectorAsSelector(labelSelector)
+	if err != nil {
+		return "<error>"
+	}
+
+	l := selector.String()
+	if len(l) == 0 {
+		l = "<none>"
+	}
+	return l
+}
+
+func ExtractGroupVersions(l *APIGroupList) []string {
+	var groupVersions []string
+	for _, g := range l.Groups {
+		for _, gv := range g.Versions {
+			groupVersions = append(groupVersions, gv.GroupVersion)
+		}
+	}
+	return groupVersions
+}
+
+// HasAnnotation returns a bool if passed in annotation exists
+func HasAnnotation(obj ObjectMeta, ann string) bool {
+	_, found := obj.Annotations[ann]
+	return found
+}
+
+// SetMetaDataAnnotation sets the annotation and value
+func SetMetaDataAnnotation(obj *ObjectMeta, ann string, value string) {
+	if obj.Annotations == nil {
+		obj.Annotations = make(map[string]string)
+	}
+	obj.Annotations[ann] = value
+}
+
+// HasLabel returns a bool if passed in label exists
+func HasLabel(obj ObjectMeta, label string) bool {
+	_, found := obj.Labels[label]
+	return found
+}
+
+// SetMetaDataLabel sets the label and value
+func SetMetaDataLabel(obj *ObjectMeta, label string, value string) {
+	if obj.Labels == nil {
+		obj.Labels = make(map[string]string)
+	}
+	obj.Labels[label] = value
+}
+
+// SingleObject returns a ListOptions for watching a single object.
+func SingleObject(meta ObjectMeta) ListOptions {
+	return ListOptions{
+		FieldSelector:   fields.OneTermEqualSelector("metadata.name", meta.Name).String(),
+		ResourceVersion: meta.ResourceVersion,
+	}
+}
+
+// NewDeleteOptions returns a DeleteOptions indicating the resource should
+// be deleted within the specified grace period. Use zero to indicate
+// immediate deletion. If you would prefer to use the default grace period,
+// use &metav1.DeleteOptions{} directly.
+func NewDeleteOptions(grace int64) *DeleteOptions {
+	return &DeleteOptions{GracePeriodSeconds: &grace}
+}
+
+// NewPreconditionDeleteOptions returns a DeleteOptions with a UID precondition set.
+func NewPreconditionDeleteOptions(uid string) *DeleteOptions {
+	u := types.UID(uid)
+	p := Preconditions{UID: &u}
+	return &DeleteOptions{Preconditions: &p}
+}
+
+// NewUIDPreconditions returns a Preconditions with UID set.
+func NewUIDPreconditions(uid string) *Preconditions {
+	u := types.UID(uid)
+	return &Preconditions{UID: &u}
+}
+
+// NewRVDeletionPrecondition returns a DeleteOptions with a ResourceVersion precondition set.
+func NewRVDeletionPrecondition(rv string) *DeleteOptions {
+	p := Preconditions{ResourceVersion: &rv}
+	return &DeleteOptions{Preconditions: &p}
+}
+
+// HasObjectMetaSystemFieldValues returns true if fields that are managed by the system on ObjectMeta have values.
+func HasObjectMetaSystemFieldValues(meta Object) bool {
+	return !meta.GetCreationTimestamp().Time.IsZero() ||
+		len(meta.GetUID()) != 0
+}
+
+// ResetObjectMetaForStatus forces the meta fields for a status update to match the meta fields
+// for a pre-existing object. This is opt-in for new objects with Status subresource.
+func ResetObjectMetaForStatus(meta, existingMeta Object) {
+	meta.SetDeletionTimestamp(existingMeta.GetDeletionTimestamp())
+	meta.SetGeneration(existingMeta.GetGeneration())
+	meta.SetSelfLink(existingMeta.GetSelfLink())
+	meta.SetLabels(existingMeta.GetLabels())
+	meta.SetAnnotations(existingMeta.GetAnnotations())
+	meta.SetFinalizers(existingMeta.GetFinalizers())
+	meta.SetOwnerReferences(existingMeta.GetOwnerReferences())
+	// managedFields must be preserved since it's been modified to
+	// track changed fields in the status update.
+	//meta.SetManagedFields(existingMeta.GetManagedFields())
+}
+
+// MarshalJSON implements json.Marshaler
+// MarshalJSON may get called on pointers or values, so implement MarshalJSON on value.
+// http://stackoverflow.com/questions/21390979/custom-marshaljson-never-gets-called-in-go
+func (f FieldsV1) MarshalJSON() ([]byte, error) {
+	raw := f.GetRawBytes()
+	if len(raw) == 0 {
+		return []byte("null"), nil
+	}
+	if f.getContentType() == fieldsV1InvalidOrValidCBORObject {
+		var u map[string]interface{}
+		if err := cbor.Unmarshal(raw, &u); err != nil {
+			return nil, fmt.Errorf("metav1.FieldsV1 cbor invalid: %w", err)
+		}
+		return utiljson.Marshal(u)
+	}
+	return raw, nil
+}
+
+// UnmarshalJSON implements json.Unmarshaler
+func (f *FieldsV1) UnmarshalJSON(b []byte) error {
+	if f == nil {
+		return errors.New("metav1.FieldsV1: UnmarshalJSON on nil pointer")
+	}
+	if !bytes.Equal(b, []byte("null")) {
+		f.SetRawBytes(b)
+	}
+	return nil
+}
+
+var _ json.Marshaler = FieldsV1{}
+var _ json.Unmarshaler = &FieldsV1{}
+
+func (f FieldsV1) MarshalCBOR() ([]byte, error) {
+	raw := f.GetRawBytes()
+	if len(raw) == 0 {
+		return cbor.Marshal(nil)
+	}
+	if f.getContentType() == fieldsV1InvalidOrValidJSONObject {
+		var u map[string]interface{}
+		if err := utiljson.Unmarshal(raw, &u); err != nil {
+			return nil, fmt.Errorf("metav1.FieldsV1 json invalid: %w", err)
+		}
+		return cbor.Marshal(u)
+	}
+	return raw, nil
+}
+
+var cborNull = []byte{0xf6}
+
+func (f *FieldsV1) UnmarshalCBOR(b []byte) error {
+	if f == nil {
+		return errors.New("metav1.FieldsV1: UnmarshalCBOR on nil pointer")
+	}
+	if !bytes.Equal(b, cborNull) {
+		f.SetRawBytes(b)
+	}
+	return nil
+}
+
+const (
+	// fieldsV1InvalidOrEmpty indicates that a FieldsV1 either contains no raw bytes or its raw
+	// bytes don't represent an allowable value in any supported encoding.
+	fieldsV1InvalidOrEmpty = iota
+
+	// fieldsV1InvalidOrValidJSONObject indicates that a FieldV1 either contains raw bytes that
+	// are a valid JSON encoding of an allowable value or don't represent an allowable value in
+	// any supported encoding.
+	fieldsV1InvalidOrValidJSONObject
+
+	// fieldsV1InvalidOrValidCBORObject indicates that a FieldV1 either contains raw bytes that
+	// are a valid CBOR encoding of an allowable value or don't represent an allowable value in
+	// any supported encoding.
+	fieldsV1InvalidOrValidCBORObject
+)
+
+// getContentType returns one of fieldsV1InvalidOrEmpty, fieldsV1InvalidOrValidJSONObject,
+// fieldsV1InvalidOrValidCBORObject based on the value of Raw.
+//
+// Raw can be encoded in JSON or CBOR and is only valid if it is empty, null, or an object (map)
+// value. It is invalid if it contains a JSON string, number, boolean, or array. If Raw is nonempty
+// and represents an allowable value, then the initial byte unambiguously distinguishes a
+// JSON-encoded value from a CBOR-encoded value.
+//
+// A valid JSON-encoded value can begin with any of the four JSON whitespace characters, the first
+// character 'n' of null, or '{' (0x09, 0x0a, 0x0d, 0x20, 0x6e, or 0x7b, respectively). A valid
+// CBOR-encoded value can begin with the null simple value, an initial byte with major type "map",
+// or, if a tag-enclosed map, an initial byte with major type "tag" (0xf6, 0xa0...0xbf, or
+// 0xc6...0xdb). The two sets of valid initial bytes don't intersect.
+func (f FieldsV1) getContentType() int {
+	reader := f.GetRawReader()
+	if reader.Size() > 0 {
+		var buf [1]byte
+		if _, err := reader.Read(buf[:]); err != nil {
+			return fieldsV1InvalidOrEmpty
+		}
+		p := buf[0]
+		switch p {
+		case 'n', '{', '\t', '\r', '\n', ' ':
+			return fieldsV1InvalidOrValidJSONObject
+		case 0xf6: // null
+			return fieldsV1InvalidOrValidCBORObject
+		default:
+			if p >= 0xa0 && p <= 0xbf /* map */ || p >= 0xc6 && p <= 0xdb /* tag */ {
+				return fieldsV1InvalidOrValidCBORObject
+			}
+		}
+	}
+	return fieldsV1InvalidOrEmpty
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/helpers_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/helpers_test.go
new file mode 100644
index 0000000000..b529d9b0b1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/helpers_test.go
@@ -0,0 +1,483 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/randfill"
+)
+
+func TestLabelSelectorAsSelector(t *testing.T) {
+	matchLabels := map[string]string{"foo": "bar"}
+	matchExpressions := []LabelSelectorRequirement{{
+		Key:      "baz",
+		Operator: LabelSelectorOpIn,
+		Values:   []string{"qux", "norf"},
+	}}
+	mustParse := func(s string) labels.Selector {
+		out, e := labels.Parse(s)
+		if e != nil {
+			panic(e)
+		}
+		return out
+	}
+	tc := []struct {
+		in        *LabelSelector
+		out       labels.Selector
+		expectErr bool
+	}{
+		{in: nil, out: labels.Nothing()},
+		{in: &LabelSelector{}, out: labels.Everything()},
+		{
+			in:  &LabelSelector{MatchLabels: matchLabels},
+			out: mustParse("foo=bar"),
+		},
+		{
+			in:  &LabelSelector{MatchExpressions: matchExpressions},
+			out: mustParse("baz in (norf,qux)"),
+		},
+		{
+			in:  &LabelSelector{MatchLabels: matchLabels, MatchExpressions: matchExpressions},
+			out: mustParse("baz in (norf,qux),foo=bar"),
+		},
+		{
+			in: &LabelSelector{
+				MatchExpressions: []LabelSelectorRequirement{{
+					Key:      "baz",
+					Operator: LabelSelectorOpExists,
+					Values:   []string{"qux", "norf"},
+				}},
+			},
+			expectErr: true,
+		},
+	}
+
+	for i, tc := range tc {
+		inCopy := tc.in.DeepCopy()
+		out, err := LabelSelectorAsSelector(tc.in)
+		// after calling LabelSelectorAsSelector, tc.in shouldn't be modified
+		if !reflect.DeepEqual(inCopy, tc.in) {
+			t.Errorf("[%v]expected:\n\t%#v\nbut got:\n\t%#v", i, inCopy, tc.in)
+		}
+		if err == nil && tc.expectErr {
+			t.Errorf("[%v]expected error but got none.", i)
+		}
+		if err != nil && !tc.expectErr {
+			t.Errorf("[%v]did not expect error but got: %v", i, err)
+		}
+		// fmt.Sprint() over String() as nil.String() will panic
+		if fmt.Sprint(out) != fmt.Sprint(tc.out) {
+			t.Errorf("[%v]expected:\n\t%s\nbut got:\n\t%s", i, fmt.Sprint(tc.out), fmt.Sprint(out))
+		}
+	}
+}
+
+func BenchmarkLabelSelectorAsSelector(b *testing.B) {
+	selector := &LabelSelector{
+		MatchLabels: map[string]string{
+			"foo": "foo",
+			"bar": "bar",
+		},
+		MatchExpressions: []LabelSelectorRequirement{{
+			Key:      "baz",
+			Operator: LabelSelectorOpExists,
+		}},
+	}
+	b.StartTimer()
+	for i := 0; i < b.N; i++ {
+		_, err := LabelSelectorAsSelector(selector)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func TestLabelSelectorAsMap(t *testing.T) {
+	matchLabels := map[string]string{"foo": "bar"}
+	matchExpressions := func(operator LabelSelectorOperator, values []string) []LabelSelectorRequirement {
+		return []LabelSelectorRequirement{{
+			Key:      "baz",
+			Operator: operator,
+			Values:   values,
+		}}
+	}
+
+	tests := []struct {
+		in        *LabelSelector
+		out       map[string]string
+		errString string
+	}{
+		{in: nil, out: nil},
+		{
+			in:  &LabelSelector{MatchLabels: matchLabels},
+			out: map[string]string{"foo": "bar"},
+		},
+		{
+			in:  &LabelSelector{MatchLabels: matchLabels, MatchExpressions: matchExpressions(LabelSelectorOpIn, []string{"norf"})},
+			out: map[string]string{"foo": "bar", "baz": "norf"},
+		},
+		{
+			in:  &LabelSelector{MatchExpressions: matchExpressions(LabelSelectorOpIn, []string{"norf"})},
+			out: map[string]string{"baz": "norf"},
+		},
+		{
+			in:        &LabelSelector{MatchLabels: matchLabels, MatchExpressions: matchExpressions(LabelSelectorOpIn, []string{"norf", "qux"})},
+			out:       map[string]string{"foo": "bar"},
+			errString: "without a single value cannot be converted",
+		},
+		{
+			in:        &LabelSelector{MatchExpressions: matchExpressions(LabelSelectorOpNotIn, []string{"norf", "qux"})},
+			out:       map[string]string{},
+			errString: "cannot be converted",
+		},
+		{
+			in:        &LabelSelector{MatchLabels: matchLabels, MatchExpressions: matchExpressions(LabelSelectorOpExists, []string{})},
+			out:       map[string]string{"foo": "bar"},
+			errString: "cannot be converted",
+		},
+		{
+			in:        &LabelSelector{MatchExpressions: matchExpressions(LabelSelectorOpDoesNotExist, []string{})},
+			out:       map[string]string{},
+			errString: "cannot be converted",
+		},
+	}
+
+	for i, tc := range tests {
+		out, err := LabelSelectorAsMap(tc.in)
+		if err == nil && len(tc.errString) > 0 {
+			t.Errorf("[%v]expected error but got none.", i)
+			continue
+		}
+		if err != nil && len(tc.errString) == 0 {
+			t.Errorf("[%v]did not expect error but got: %v", i, err)
+			continue
+		}
+		if err != nil && len(tc.errString) > 0 && !strings.Contains(err.Error(), tc.errString) {
+			t.Errorf("[%v]expected error with %q but got: %v", i, tc.errString, err)
+			continue
+		}
+		if !reflect.DeepEqual(out, tc.out) {
+			t.Errorf("[%v]expected:\n\t%+v\nbut got:\n\t%+v", i, tc.out, out)
+		}
+	}
+}
+
+func TestResetObjectMetaForStatus(t *testing.T) {
+	meta := &ObjectMeta{}
+	existingMeta := &ObjectMeta{}
+
+	// fuzz the existingMeta to set every field, no nils
+	f := randfill.New().NilChance(0).NumElements(1, 1).MaxDepth(10)
+	f.Fill(existingMeta)
+	ResetObjectMetaForStatus(meta, existingMeta)
+
+	// not all fields are stomped during the reset.  These fields should not have been set. False
+	// set them all to their zero values.  Before you add anything to this list, consider whether or not
+	// you're enforcing immutability (those are fine) and whether /status should be able to update
+	// these values (these are usually not fine).
+
+	// generateName doesn't do anything after create
+	existingMeta.SetGenerateName("")
+	// resourceVersion is enforced in validation and used during the storage update
+	existingMeta.SetResourceVersion("")
+	// fields made immutable in validation
+	existingMeta.SetUID(types.UID(""))
+	existingMeta.SetName("")
+	existingMeta.SetNamespace("")
+	existingMeta.SetCreationTimestamp(Time{})
+	existingMeta.SetDeletionTimestamp(nil)
+	existingMeta.SetDeletionGracePeriodSeconds(nil)
+	existingMeta.SetManagedFields(nil)
+
+	if !reflect.DeepEqual(meta, existingMeta) {
+		t.Error(cmp.Diff(meta, existingMeta))
+	}
+}
+
+func TestSetMetaDataLabel(t *testing.T) {
+	tests := []struct {
+		obj   *ObjectMeta
+		label string
+		value string
+		want  map[string]string
+	}{
+		{
+			obj:   &ObjectMeta{},
+			label: "foo",
+			value: "bar",
+			want:  map[string]string{"foo": "bar"},
+		},
+		{
+			obj:   &ObjectMeta{Labels: map[string]string{"foo": "bar"}},
+			label: "foo",
+			value: "baz",
+			want:  map[string]string{"foo": "baz"},
+		},
+		{
+			obj:   &ObjectMeta{Labels: map[string]string{"foo": "bar"}},
+			label: "version",
+			value: "1.0.0",
+			want:  map[string]string{"foo": "bar", "version": "1.0.0"},
+		},
+	}
+
+	for _, tc := range tests {
+		SetMetaDataLabel(tc.obj, tc.label, tc.value)
+		if !reflect.DeepEqual(tc.obj.Labels, tc.want) {
+			t.Errorf("got %v, want %v", tc.obj.Labels, tc.want)
+		}
+	}
+}
+
+func TestFieldsV1MarshalJSON(t *testing.T) {
+	for _, tc := range []struct {
+		Name     string
+		FieldsV1 FieldsV1
+		Want     []byte
+		Error    string
+	}{
+		{
+			Name:     "zero-value encodes as json null",
+			FieldsV1: FieldsV1{},
+			Want:     []byte(`null`),
+		},
+		{
+			Name:     "cbor null is transcoded to json null",
+			FieldsV1: *NewFieldsV1(string([]byte{0xf6})), // null
+			Want:     []byte(`null`),
+		},
+		{
+			Name:     "valid non-map cbor and valid non-object json is returned as-is",
+			FieldsV1: *NewFieldsV1(string([]byte{0x30})),
+			Want:     []byte{0x30}, // Valid CBOR encoding of -17 and JSON encoding of 0!
+		},
+		{
+			Name:     "self-described cbor map is transcoded to json map",
+			FieldsV1: *NewFieldsV1(string([]byte{0xd9, 0xd9, 0xf7, 0xa1, 0x43, 'f', 'o', 'o', 0x43, 'b', 'a', 'r'})), // 55799({"foo":"bar"})
+			Want:     []byte(`{"foo":"bar"}`),
+		},
+		{
+			Name:     "json object is returned as-is",
+			FieldsV1: *NewFieldsV1(" \t\r\n{\"foo\":\"bar\"}"),
+			Want:     []byte(" \t\r\n{\"foo\":\"bar\"}"),
+		},
+		{
+			Name:     "invalid json is returned as-is",
+			FieldsV1: *NewFieldsV1(`{{`),
+			Want:     []byte(`{{`),
+		},
+		{
+			Name:     "invalid cbor fails to transcode to json",
+			FieldsV1: *NewFieldsV1(string([]byte{0xa1})),
+			Error:    "metav1.FieldsV1 cbor invalid: unexpected EOF",
+		},
+	} {
+		t.Run(tc.Name, func(t *testing.T) {
+			got, err := tc.FieldsV1.MarshalJSON()
+			if err != nil {
+				if tc.Error == "" {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				if msg := err.Error(); msg != tc.Error {
+					t.Fatalf("expected error %q, got %q", tc.Error, msg)
+				}
+			} else if tc.Error != "" {
+				t.Fatalf("expected error %q, got nil", tc.Error)
+			}
+			if diff := cmp.Diff(tc.Want, got); diff != "" {
+				t.Errorf("unexpected diff:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestFieldsV1MarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		Name     string
+		FieldsV1 FieldsV1
+		Want     []byte
+		Error    string
+	}{
+		{
+			Name:     "nil encodes as cbor null",
+			FieldsV1: FieldsV1{},
+			Want:     []byte{0xf6}, // null
+		},
+		{
+			Name:     "json null is transcoded to cbor null",
+			FieldsV1: *NewFieldsV1(string(`null`)),
+			Want:     []byte{0xf6}, // null
+		},
+		{
+			Name:     "valid non-map cbor and valid non-object json is returned as-is",
+			FieldsV1: *NewFieldsV1(string([]byte{0x30})),
+			Want:     []byte{0x30}, // Valid CBOR encoding of -17 and JSON encoding of 0!
+		},
+		{
+			Name:     "json object is transcoded to cbor map",
+			FieldsV1: *NewFieldsV1(" \t\r\n{\"foo\":\"bar\"}"),
+			Want:     []byte{0xa1, 0x43, 'f', 'o', 'o', 0x43, 'b', 'a', 'r'},
+		},
+		{
+			Name:     "self-described cbor map is returned as-is",
+			FieldsV1: *NewFieldsV1(string([]byte{0xd9, 0xd9, 0xf7, 0xa1, 0x43, 'f', 'o', 'o', 0x43, 'b', 'a', 'r'})), // 55799({"foo":"bar"})
+			Want:     []byte{0xd9, 0xd9, 0xf7, 0xa1, 0x43, 'f', 'o', 'o', 0x43, 'b', 'a', 'r'},                       // 55799({"foo":"bar"})
+		},
+		{
+			Name:     "invalid json fails to transcode to cbor",
+			FieldsV1: *NewFieldsV1(`{{`),
+			Error:    "metav1.FieldsV1 json invalid: invalid character '{' looking for beginning of object key string",
+		},
+		{
+			Name:     "invalid cbor is returned as-is",
+			FieldsV1: *NewFieldsV1(string([]byte{0xa1})),
+			Want:     []byte{0xa1},
+		},
+	} {
+		t.Run(tc.Name, func(t *testing.T) {
+			got, err := tc.FieldsV1.MarshalCBOR()
+			if err != nil {
+				if tc.Error == "" {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				if msg := err.Error(); msg != tc.Error {
+					t.Fatalf("expected error %q, got %q", tc.Error, msg)
+				}
+			} else if tc.Error != "" {
+				t.Fatalf("expected error %q, got nil", tc.Error)
+			}
+
+			if diff := cmp.Diff(tc.Want, got); diff != "" {
+				t.Errorf("unexpected diff:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestFieldsV1UnmarshalJSON(t *testing.T) {
+	for _, tc := range []struct {
+		Name  string
+		JSON  []byte
+		Into  *FieldsV1
+		Want  *FieldsV1
+		Error string
+	}{
+		{
+			Name:  "nil receiver returns error",
+			Into:  nil,
+			Error: "metav1.FieldsV1: UnmarshalJSON on nil pointer",
+		},
+		{
+			Name: "json null does not modify receiver", // conventional for json.Unmarshaler
+			JSON: []byte(`null`),
+			Into: NewFieldsV1(`unmodified`),
+			Want: NewFieldsV1(`unmodified`),
+		},
+		{
+			Name: "valid input is copied verbatim",
+			JSON: []byte("{\"foo\":\"bar\"} \t\r\n"),
+			Into: &FieldsV1{},
+			Want: NewFieldsV1("{\"foo\":\"bar\"} \t\r\n"),
+		},
+		{
+			Name: "invalid input is copied verbatim",
+			JSON: []byte("{{"),
+			Into: &FieldsV1{},
+			Want: NewFieldsV1("{{"),
+		},
+	} {
+		t.Run(tc.Name, func(t *testing.T) {
+			got := tc.Into.DeepCopy()
+			err := got.UnmarshalJSON(tc.JSON)
+			if err != nil {
+				if tc.Error == "" {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				if msg := err.Error(); msg != tc.Error {
+					t.Fatalf("expected error %q, got %q", tc.Error, msg)
+				}
+			} else if tc.Error != "" {
+				t.Fatalf("expected error %q, got nil", tc.Error)
+			}
+
+			if diff := cmp.Diff(tc.Want, got); diff != "" {
+				t.Errorf("unexpected diff:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestFieldsV1UnmarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		Name  string
+		CBOR  []byte
+		Into  *FieldsV1
+		Want  *FieldsV1
+		Error string
+	}{
+		{
+			Name:  "nil receiver returns error",
+			Into:  nil,
+			Want:  nil,
+			Error: "metav1.FieldsV1: UnmarshalCBOR on nil pointer",
+		},
+		{
+			Name: "cbor null does not modify receiver",
+			CBOR: []byte{0xf6},
+			Into: NewFieldsV1(`unmodified`),
+			Want: NewFieldsV1(`unmodified`),
+		},
+		{
+			Name: "valid input is copied verbatim",
+			CBOR: []byte{0xa1, 0x43, 'f', 'o', 'o', 0x43, 'b', 'a', 'r'},
+			Into: &FieldsV1{},
+			Want: NewFieldsV1(string([]byte{0xa1, 0x43, 'f', 'o', 'o', 0x43, 'b', 'a', 'r'})),
+		},
+		{
+			Name: "invalid input is copied verbatim",
+			CBOR: []byte{0xff}, // UnmarshalCBOR should never be called with malformed input, testing anyway.
+			Into: &FieldsV1{},
+			Want: NewFieldsV1(string([]byte{0xff})),
+		},
+	} {
+		t.Run(tc.Name, func(t *testing.T) {
+			got := tc.Into.DeepCopy()
+			err := got.UnmarshalCBOR(tc.CBOR)
+			if err != nil {
+				if tc.Error == "" {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				if msg := err.Error(); msg != tc.Error {
+					t.Fatalf("expected error %q, got %q", tc.Error, msg)
+				}
+			} else if tc.Error != "" {
+				t.Fatalf("expected error %q, got nil", tc.Error)
+			}
+
+			if diff := cmp.Diff(tc.Want, got); diff != "" {
+				t.Errorf("unexpected diff:\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/labels.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/labels.go
new file mode 100644
index 0000000000..9b45145da6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/labels.go
@@ -0,0 +1,55 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+// Clones the given selector and returns a new selector with the given key and value added.
+// Returns the given selector, if labelKey is empty.
+func CloneSelectorAndAddLabel(selector *LabelSelector, labelKey, labelValue string) *LabelSelector {
+	if labelKey == "" {
+		// Don't need to add a label.
+		return selector
+	}
+
+	// Clone.
+	newSelector := selector.DeepCopy()
+
+	if newSelector.MatchLabels == nil {
+		newSelector.MatchLabels = make(map[string]string)
+	}
+
+	newSelector.MatchLabels[labelKey] = labelValue
+
+	return newSelector
+}
+
+// AddLabelToSelector returns a selector with the given key and value added to the given selector's MatchLabels.
+func AddLabelToSelector(selector *LabelSelector, labelKey, labelValue string) *LabelSelector {
+	if labelKey == "" {
+		// Don't need to add a label.
+		return selector
+	}
+	if selector.MatchLabels == nil {
+		selector.MatchLabels = make(map[string]string)
+	}
+	selector.MatchLabels[labelKey] = labelValue
+	return selector
+}
+
+// SelectorHasLabel checks if the given selector contains the given label key in its MatchLabels
+func SelectorHasLabel(selector *LabelSelector, labelKey string) bool {
+	return len(selector.MatchLabels[labelKey]) > 0
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/labels_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/labels_test.go
new file mode 100644
index 0000000000..918b1a294c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/labels_test.go
@@ -0,0 +1,123 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestCloneSelectorAndAddLabel(t *testing.T) {
+	labels := map[string]string{
+		"foo1": "bar1",
+		"foo2": "bar2",
+		"foo3": "bar3",
+	}
+	matchExpressions := []LabelSelectorRequirement{
+		{Key: "foo", Operator: LabelSelectorOpIn, Values: []string{"foo"}},
+	}
+
+	cases := []struct {
+		labels     map[string]string
+		labelKey   string
+		labelValue string
+		want       map[string]string
+	}{
+		{
+			labels: labels,
+			want:   labels,
+		},
+		{
+			labels:     labels,
+			labelKey:   "foo4",
+			labelValue: "89",
+			want: map[string]string{
+				"foo1": "bar1",
+				"foo2": "bar2",
+				"foo3": "bar3",
+				"foo4": "89",
+			},
+		},
+		{
+			labels:     nil,
+			labelKey:   "foo4",
+			labelValue: "12",
+			want: map[string]string{
+				"foo4": "12",
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		ls_in := LabelSelector{MatchLabels: tc.labels, MatchExpressions: matchExpressions}
+		ls_out := LabelSelector{MatchLabels: tc.want, MatchExpressions: matchExpressions}
+
+		got := CloneSelectorAndAddLabel(&ls_in, tc.labelKey, tc.labelValue)
+		if !reflect.DeepEqual(got, &ls_out) {
+			t.Errorf("got %v, want %v", got, tc.want)
+		}
+	}
+}
+
+func TestAddLabelToSelector(t *testing.T) {
+	labels := map[string]string{
+		"foo1": "bar1",
+		"foo2": "bar2",
+		"foo3": "bar3",
+	}
+
+	cases := []struct {
+		labels     map[string]string
+		labelKey   string
+		labelValue string
+		want       map[string]string
+	}{
+		{
+			labels: labels,
+			want:   labels,
+		},
+		{
+			labels:     labels,
+			labelKey:   "foo4",
+			labelValue: "89",
+			want: map[string]string{
+				"foo1": "bar1",
+				"foo2": "bar2",
+				"foo3": "bar3",
+				"foo4": "89",
+			},
+		},
+		{
+			labels:     nil,
+			labelKey:   "foo4",
+			labelValue: "12",
+			want: map[string]string{
+				"foo4": "12",
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		ls_in := LabelSelector{MatchLabels: tc.labels}
+		ls_out := LabelSelector{MatchLabels: tc.want}
+
+		got := AddLabelToSelector(&ls_in, tc.labelKey, tc.labelValue)
+		if !reflect.DeepEqual(got, &ls_out) {
+			t.Errorf("got %v, want %v", got, tc.want)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/meta.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/meta.go
new file mode 100644
index 0000000000..6ae1b095fc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/meta.go
@@ -0,0 +1,185 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// TODO: move this, Object, List, and Type to a different package
+type ObjectMetaAccessor interface {
+	GetObjectMeta() Object
+}
+
+// Object lets you work with object metadata from any of the versioned or
+// internal API objects. Attempting to set or retrieve a field on an object that does
+// not support that field (Name, UID, Namespace on lists) will be a no-op and return
+// a default value.
+type Object interface {
+	GetNamespace() string
+	SetNamespace(namespace string)
+	GetName() string
+	SetName(name string)
+	GetGenerateName() string
+	SetGenerateName(name string)
+	GetUID() types.UID
+	SetUID(uid types.UID)
+	GetResourceVersion() string
+	SetResourceVersion(version string)
+	GetGeneration() int64
+	SetGeneration(generation int64)
+	GetSelfLink() string
+	SetSelfLink(selfLink string)
+	GetCreationTimestamp() Time
+	SetCreationTimestamp(timestamp Time)
+	GetDeletionTimestamp() *Time
+	SetDeletionTimestamp(timestamp *Time)
+	GetDeletionGracePeriodSeconds() *int64
+	SetDeletionGracePeriodSeconds(*int64)
+	GetLabels() map[string]string
+	SetLabels(labels map[string]string)
+	GetAnnotations() map[string]string
+	SetAnnotations(annotations map[string]string)
+	GetFinalizers() []string
+	SetFinalizers(finalizers []string)
+	GetOwnerReferences() []OwnerReference
+	SetOwnerReferences([]OwnerReference)
+	GetManagedFields() []ManagedFieldsEntry
+	SetManagedFields(managedFields []ManagedFieldsEntry)
+}
+
+// ListMetaAccessor retrieves the list interface from an object
+type ListMetaAccessor interface {
+	GetListMeta() ListInterface
+}
+
+// Common lets you work with core metadata from any of the versioned or
+// internal API objects. Attempting to set or retrieve a field on an object that does
+// not support that field will be a no-op and return a default value.
+// TODO: move this, and TypeMeta and ListMeta, to a different package
+type Common interface {
+	GetResourceVersion() string
+	SetResourceVersion(version string)
+	GetSelfLink() string
+	SetSelfLink(selfLink string)
+}
+
+// ListInterface lets you work with list metadata from any of the versioned or
+// internal API objects. Attempting to set or retrieve a field on an object that does
+// not support that field will be a no-op and return a default value.
+// TODO: move this, and TypeMeta and ListMeta, to a different package
+type ListInterface interface {
+	GetResourceVersion() string
+	SetResourceVersion(version string)
+	GetSelfLink() string
+	SetSelfLink(selfLink string)
+	GetContinue() string
+	SetContinue(c string)
+	GetRemainingItemCount() *int64
+	SetRemainingItemCount(c *int64)
+}
+
+// ShardedListInterface can be implemented by list types to indicate that they
+// represent a sharded subset of the full collection rather than the complete list.
+type ShardedListInterface interface {
+	GetShardInfo() *ShardInfo
+	SetShardInfo(*ShardInfo)
+}
+
+// Type exposes the type and APIVersion of versioned or internal API objects.
+// TODO: move this, and TypeMeta and ListMeta, to a different package
+type Type interface {
+	GetAPIVersion() string
+	SetAPIVersion(version string)
+	GetKind() string
+	SetKind(kind string)
+}
+
+var _ ListInterface = &ListMeta{}
+
+func (meta *ListMeta) GetResourceVersion() string        { return meta.ResourceVersion }
+func (meta *ListMeta) SetResourceVersion(version string) { meta.ResourceVersion = version }
+func (meta *ListMeta) GetSelfLink() string               { return meta.SelfLink }
+func (meta *ListMeta) SetSelfLink(selfLink string)       { meta.SelfLink = selfLink }
+func (meta *ListMeta) GetContinue() string               { return meta.Continue }
+func (meta *ListMeta) SetContinue(c string)              { meta.Continue = c }
+func (meta *ListMeta) GetRemainingItemCount() *int64     { return meta.RemainingItemCount }
+func (meta *ListMeta) SetRemainingItemCount(c *int64)    { meta.RemainingItemCount = c }
+func (meta *ListMeta) GetShardInfo() *ShardInfo          { return meta.ShardInfo }
+func (meta *ListMeta) SetShardInfo(s *ShardInfo)         { meta.ShardInfo = s }
+
+func (obj *TypeMeta) GetObjectKind() schema.ObjectKind { return obj }
+
+// SetGroupVersionKind satisfies the ObjectKind interface for all objects that embed TypeMeta
+func (obj *TypeMeta) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	obj.APIVersion, obj.Kind = gvk.ToAPIVersionAndKind()
+}
+
+// GroupVersionKind satisfies the ObjectKind interface for all objects that embed TypeMeta
+func (obj *TypeMeta) GroupVersionKind() schema.GroupVersionKind {
+	return schema.FromAPIVersionAndKind(obj.APIVersion, obj.Kind)
+}
+
+func (obj *ListMeta) GetListMeta() ListInterface { return obj }
+
+func (obj *ObjectMeta) GetObjectMeta() Object { return obj }
+
+// Namespace implements metav1.Object for any object with an ObjectMeta typed field. Allows
+// fast, direct access to metadata fields for API objects.
+func (meta *ObjectMeta) GetNamespace() string                { return meta.Namespace }
+func (meta *ObjectMeta) SetNamespace(namespace string)       { meta.Namespace = namespace }
+func (meta *ObjectMeta) GetName() string                     { return meta.Name }
+func (meta *ObjectMeta) SetName(name string)                 { meta.Name = name }
+func (meta *ObjectMeta) GetGenerateName() string             { return meta.GenerateName }
+func (meta *ObjectMeta) SetGenerateName(generateName string) { meta.GenerateName = generateName }
+func (meta *ObjectMeta) GetUID() types.UID                   { return meta.UID }
+func (meta *ObjectMeta) SetUID(uid types.UID)                { meta.UID = uid }
+func (meta *ObjectMeta) GetResourceVersion() string          { return meta.ResourceVersion }
+func (meta *ObjectMeta) SetResourceVersion(version string)   { meta.ResourceVersion = version }
+func (meta *ObjectMeta) GetGeneration() int64                { return meta.Generation }
+func (meta *ObjectMeta) SetGeneration(generation int64)      { meta.Generation = generation }
+func (meta *ObjectMeta) GetSelfLink() string                 { return meta.SelfLink }
+func (meta *ObjectMeta) SetSelfLink(selfLink string)         { meta.SelfLink = selfLink }
+func (meta *ObjectMeta) GetCreationTimestamp() Time          { return meta.CreationTimestamp }
+func (meta *ObjectMeta) SetCreationTimestamp(creationTimestamp Time) {
+	meta.CreationTimestamp = creationTimestamp
+}
+func (meta *ObjectMeta) GetDeletionTimestamp() *Time { return meta.DeletionTimestamp }
+func (meta *ObjectMeta) SetDeletionTimestamp(deletionTimestamp *Time) {
+	meta.DeletionTimestamp = deletionTimestamp
+}
+func (meta *ObjectMeta) GetDeletionGracePeriodSeconds() *int64 {
+	return meta.DeletionGracePeriodSeconds
+}
+func (meta *ObjectMeta) SetDeletionGracePeriodSeconds(deletionGracePeriodSeconds *int64) {
+	meta.DeletionGracePeriodSeconds = deletionGracePeriodSeconds
+}
+func (meta *ObjectMeta) GetLabels() map[string]string                 { return meta.Labels }
+func (meta *ObjectMeta) SetLabels(labels map[string]string)           { meta.Labels = labels }
+func (meta *ObjectMeta) GetAnnotations() map[string]string            { return meta.Annotations }
+func (meta *ObjectMeta) SetAnnotations(annotations map[string]string) { meta.Annotations = annotations }
+func (meta *ObjectMeta) GetFinalizers() []string                      { return meta.Finalizers }
+func (meta *ObjectMeta) SetFinalizers(finalizers []string)            { meta.Finalizers = finalizers }
+func (meta *ObjectMeta) GetOwnerReferences() []OwnerReference         { return meta.OwnerReferences }
+func (meta *ObjectMeta) SetOwnerReferences(references []OwnerReference) {
+	meta.OwnerReferences = references
+}
+func (meta *ObjectMeta) GetManagedFields() []ManagedFieldsEntry { return meta.ManagedFields }
+func (meta *ObjectMeta) SetManagedFields(managedFields []ManagedFieldsEntry) {
+	meta.ManagedFields = managedFields
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time.go
new file mode 100644
index 0000000000..9f302b3f36
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time.go
@@ -0,0 +1,209 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"time"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+)
+
+const RFC3339Micro = "2006-01-02T15:04:05.000000Z07:00"
+
+// MicroTime is version of Time with microsecond level precision.
+//
+// +protobuf.options.marshal=false
+// +protobuf.as=Timestamp
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type MicroTime struct {
+	time.Time `protobuf:"-"`
+}
+
+// DeepCopy returns a deep-copy of the MicroTime value.  The underlying time.Time
+// type is effectively immutable in the time API, so it is safe to
+// copy-by-assign, despite the presence of (unexported) Pointer fields.
+func (t *MicroTime) DeepCopyInto(out *MicroTime) {
+	*out = *t
+}
+
+// NewMicroTime returns a wrapped instance of the provided time
+func NewMicroTime(time time.Time) MicroTime {
+	return MicroTime{time}
+}
+
+// DateMicro returns the MicroTime corresponding to the supplied parameters
+// by wrapping time.Date.
+func DateMicro(year int, month time.Month, day, hour, min, sec, nsec int, loc *time.Location) MicroTime {
+	return MicroTime{time.Date(year, month, day, hour, min, sec, nsec, loc)}
+}
+
+// NowMicro returns the current local time.
+func NowMicro() MicroTime {
+	return MicroTime{time.Now()}
+}
+
+// IsZero returns true if the value is nil or time is zero.
+func (t *MicroTime) IsZero() bool {
+	if t == nil {
+		return true
+	}
+	return t.Time.IsZero()
+}
+
+// Before reports whether the time instant t is before u.
+func (t *MicroTime) Before(u *MicroTime) bool {
+	if t != nil && u != nil {
+		return t.Time.Before(u.Time)
+	}
+	return false
+}
+
+// Equal reports whether the time instant t is equal to u.
+func (t *MicroTime) Equal(u *MicroTime) bool {
+	if t == nil && u == nil {
+		return true
+	}
+	if t != nil && u != nil {
+		return t.Time.Equal(u.Time)
+	}
+	return false
+}
+
+// BeforeTime reports whether the time instant t is before second-lever precision u.
+func (t *MicroTime) BeforeTime(u *Time) bool {
+	if t != nil && u != nil {
+		return t.Time.Before(u.Time)
+	}
+	return false
+}
+
+// EqualTime reports whether the time instant t is equal to second-lever precision u.
+func (t *MicroTime) EqualTime(u *Time) bool {
+	if t == nil && u == nil {
+		return true
+	}
+	if t != nil && u != nil {
+		return t.Time.Equal(u.Time)
+	}
+	return false
+}
+
+// UnixMicro returns the local time corresponding to the given Unix time
+// by wrapping time.Unix.
+func UnixMicro(sec int64, nsec int64) MicroTime {
+	return MicroTime{time.Unix(sec, nsec)}
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+func (t *MicroTime) UnmarshalJSON(b []byte) error {
+	if len(b) == 4 && string(b) == "null" {
+		t.Time = time.Time{}
+		return nil
+	}
+
+	var str string
+	err := json.Unmarshal(b, &str)
+	if err != nil {
+		return err
+	}
+
+	pt, err := time.Parse(RFC3339Micro, str)
+	if err != nil {
+		return err
+	}
+
+	t.Time = pt.Local()
+	return nil
+}
+
+func (t *MicroTime) UnmarshalCBOR(b []byte) error {
+	var s *string
+	if err := cbor.Unmarshal(b, &s); err != nil {
+		return err
+	}
+	if s == nil {
+		t.Time = time.Time{}
+		return nil
+	}
+
+	parsed, err := time.Parse(RFC3339Micro, *s)
+	if err != nil {
+		return err
+	}
+
+	t.Time = parsed.Local()
+	return nil
+}
+
+// UnmarshalQueryParameter converts from a URL query parameter value to an object
+func (t *MicroTime) UnmarshalQueryParameter(str string) error {
+	if len(str) == 0 {
+		t.Time = time.Time{}
+		return nil
+	}
+	// Tolerate requests from older clients that used JSON serialization to build query params
+	if len(str) == 4 && str == "null" {
+		t.Time = time.Time{}
+		return nil
+	}
+
+	pt, err := time.Parse(RFC3339Micro, str)
+	if err != nil {
+		return err
+	}
+
+	t.Time = pt.Local()
+	return nil
+}
+
+// MarshalJSON implements the json.Marshaler interface.
+func (t MicroTime) MarshalJSON() ([]byte, error) {
+	if t.IsZero() {
+		// Encode unset/nil objects as JSON's "null".
+		return []byte("null"), nil
+	}
+
+	return json.Marshal(t.UTC().Format(RFC3339Micro))
+}
+
+func (t MicroTime) MarshalCBOR() ([]byte, error) {
+	if t.IsZero() {
+		return cbor.Marshal(nil)
+	}
+	return cbor.Marshal(t.UTC().Format(RFC3339Micro))
+}
+
+// OpenAPISchemaType is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+//
+// See: https://github.com/kubernetes/kube-openapi/tree/master/pkg/generators
+func (_ MicroTime) OpenAPISchemaType() []string { return []string{"string"} }
+
+// OpenAPISchemaFormat is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+func (_ MicroTime) OpenAPISchemaFormat() string { return "date-time" }
+
+// MarshalQueryParameter converts to a URL query parameter value
+func (t MicroTime) MarshalQueryParameter() (string, error) {
+	if t.IsZero() {
+		// Encode unset/nil objects as an empty string
+		return "", nil
+	}
+
+	return t.UTC().Format(RFC3339Micro), nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_fuzz.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_fuzz.go
new file mode 100644
index 0000000000..338ea9be72
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_fuzz.go
@@ -0,0 +1,40 @@
+//go:build !notest
+
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"math/rand"
+	"time"
+
+	"sigs.k8s.io/randfill"
+)
+
+// Fuzz satisfies randfill.SimpleSelfFiller.
+func (t *MicroTime) RandFill(r *rand.Rand) {
+	if t == nil {
+		return
+	}
+	// Allow for about 1000 years of randomness. Accurate to a tenth of
+	// micro second. Leave off nanoseconds because JSON doesn't
+	// represent them so they can't round-trip properly.
+	t.Time = time.Unix(r.Int63n(1000*365*24*60*60), 1000*r.Int63n(1000000))
+}
+
+// ensure MicroTime implements randfill.Interface
+var _ randfill.SimpleSelfFiller = &MicroTime{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_proto.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_proto.go
new file mode 100644
index 0000000000..ab68181e91
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_proto.go
@@ -0,0 +1,86 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"time"
+)
+
+// Timestamp is declared in time_proto.go
+
+// Timestamp returns the Time as a new Timestamp value.
+func (m *MicroTime) ProtoMicroTime() *Timestamp {
+	if m == nil {
+		return &Timestamp{}
+	}
+
+	// truncate precision to microseconds to match JSON marshaling/unmarshaling
+	truncatedNanoseconds := time.Duration(m.Time.Nanosecond()).Truncate(time.Microsecond)
+	return &Timestamp{
+		Seconds: m.Time.Unix(),
+		Nanos:   int32(truncatedNanoseconds),
+	}
+}
+
+// Size implements the protobuf marshalling interface.
+func (m *MicroTime) Size() (n int) {
+	if m == nil || m.Time.IsZero() {
+		return 0
+	}
+	return m.ProtoMicroTime().Size()
+}
+
+// Reset implements the protobuf marshalling interface.
+func (m *MicroTime) Unmarshal(data []byte) error {
+	if len(data) == 0 {
+		m.Time = time.Time{}
+		return nil
+	}
+	p := Timestamp{}
+	if err := p.Unmarshal(data); err != nil {
+		return err
+	}
+
+	// truncate precision to microseconds to match JSON marshaling/unmarshaling
+	truncatedNanoseconds := time.Duration(p.Nanos).Truncate(time.Microsecond)
+	m.Time = time.Unix(p.Seconds, int64(truncatedNanoseconds)).Local()
+	return nil
+}
+
+// Marshal implements the protobuf marshalling interface.
+func (m *MicroTime) Marshal() (data []byte, err error) {
+	if m == nil || m.Time.IsZero() {
+		return nil, nil
+	}
+	return m.ProtoMicroTime().Marshal()
+}
+
+// MarshalTo implements the protobuf marshalling interface.
+func (m *MicroTime) MarshalTo(data []byte) (int, error) {
+	if m == nil || m.Time.IsZero() {
+		return 0, nil
+	}
+	return m.ProtoMicroTime().MarshalTo(data)
+}
+
+// MarshalToSizedBuffer implements the protobuf marshalling interface.
+func (m *MicroTime) MarshalToSizedBuffer(data []byte) (int, error) {
+	if m == nil || m.Time.IsZero() {
+		return 0, nil
+	}
+	return m.ProtoMicroTime().MarshalToSizedBuffer(data)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_test.go
new file mode 100644
index 0000000000..b96baa5b77
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_test.go
@@ -0,0 +1,402 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"testing"
+	"time"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	"sigs.k8s.io/yaml"
+
+	"github.com/google/go-cmp/cmp"
+	"sigs.k8s.io/randfill"
+)
+
+type MicroTimeHolder struct {
+	T MicroTime `json:"t"`
+}
+
+func TestMicroTimeMarshalYAML(t *testing.T) {
+	cases := []struct {
+		input  MicroTime
+		result string
+	}{
+		{MicroTime{}, "t: null\n"},
+		{DateMicro(1998, time.May, 5, 1, 5, 5, 50, time.FixedZone("test", -4*60*60)), "t: \"1998-05-05T05:05:05.000000Z\"\n"},
+		{DateMicro(1998, time.May, 5, 5, 5, 5, 0, time.UTC), "t: \"1998-05-05T05:05:05.000000Z\"\n"},
+	}
+
+	for _, c := range cases {
+		input := MicroTimeHolder{c.input}
+		result, err := yaml.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input: '%v': %v", input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("Failed to marshal input: '%v': expected %+v, got %q", input, c.result, string(result))
+		}
+	}
+}
+
+func TestMicroTimeUnmarshalYAML(t *testing.T) {
+	cases := []struct {
+		input  string
+		result MicroTime
+	}{
+		{"t: null\n", MicroTime{}},
+		{"t: 1998-05-05T05:05:05.000000Z\n", MicroTime{Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC).Local()}},
+	}
+
+	for _, c := range cases {
+		var result MicroTimeHolder
+		if err := yaml.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("Failed to unmarshal input '%v': %v", c.input, err)
+		}
+		if result.T != c.result {
+			t.Errorf("Failed to unmarshal input '%v': expected %+v, got %+v", c.input, c.result, result)
+		}
+	}
+}
+
+func TestMicroTimeMarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  MicroTime
+		result string
+	}{
+		{MicroTime{}, "{\"t\":null}"},
+		{DateMicro(1998, time.May, 5, 5, 5, 5, 50, time.UTC), "{\"t\":\"1998-05-05T05:05:05.000000Z\"}"},
+		{DateMicro(1998, time.May, 5, 5, 5, 5, 0, time.UTC), "{\"t\":\"1998-05-05T05:05:05.000000Z\"}"},
+	}
+
+	for _, c := range cases {
+		input := MicroTimeHolder{c.input}
+		result, err := json.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input: '%v': %v", input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("Failed to marshal input: '%v': expected %+v, got %q", input, c.result, string(result))
+		}
+	}
+}
+
+func TestMicroTimeUnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  string
+		result MicroTime
+	}{
+		{"{\"t\":null}", MicroTime{}},
+		{"{\"t\":\"1998-05-05T05:05:05.000000Z\"}", MicroTime{Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC).Local()}},
+	}
+
+	for _, c := range cases {
+		var result MicroTimeHolder
+		if err := json.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("Failed to unmarshal input '%v': %v", c.input, err)
+		}
+		if result.T != c.result {
+			t.Errorf("Failed to unmarshal input '%v': expected %+v, got %+v", c.input, c.result, result)
+		}
+	}
+}
+
+func TestMicroTimeMarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		in   MicroTime
+		out  []byte
+	}{
+		{name: "zero value", in: MicroTime{}, out: []byte{0xf6}},                                                                                       // null
+		{name: "no fractional seconds", in: DateMicro(1998, time.May, 5, 5, 5, 5, 0, time.UTC), out: []byte("\x58\x1b1998-05-05T05:05:05.000000Z")},    // '1998-05-05T05:05:05.000000Z'
+		{name: "nanoseconds truncated", in: DateMicro(1998, time.May, 5, 5, 5, 5, 5050, time.UTC), out: []byte("\x58\x1b1998-05-05T05:05:05.000005Z")}, // '1998-05-05T05:05:05.000005Z'
+	} {
+		t.Run(fmt.Sprintf("%+v", tc.in), func(t *testing.T) {
+			got, err := tc.in.MarshalCBOR()
+			if err != nil {
+				t.Fatal(err)
+			}
+			if diff := cmp.Diff(tc.out, got); diff != "" {
+				t.Errorf("unexpected output:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestMicroTimeUnmarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		in         []byte
+		out        MicroTime
+		errMessage string
+	}{
+		{name: "null", in: []byte{0xf6}, out: MicroTime{}}, // null
+		{name: "valid", in: []byte("\x58\x1b1998-05-05T05:05:05.000000Z"), out: MicroTime{Time: Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC).Local()}},                                    // '1998-05-05T05:05:05.000000Z'
+		{name: "invalid cbor type", in: []byte{0x07}, out: MicroTime{}, errMessage: "cbor: cannot unmarshal positive integer into Go value of type string"},                                // 7
+		{name: "malformed timestamp", in: []byte("\x45hello"), out: MicroTime{}, errMessage: `parsing time "hello" as "2006-01-02T15:04:05.000000Z07:00": cannot parse "hello" as "2006"`}, // 'hello'
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var got MicroTime
+			err := got.UnmarshalCBOR(tc.in)
+			if err != nil {
+				if tc.errMessage == "" {
+					t.Fatalf("want nil error, got: %v", err)
+				} else if gotMessage := err.Error(); tc.errMessage != gotMessage {
+					t.Fatalf("want error: %q, got: %q", tc.errMessage, gotMessage)
+				}
+			} else if tc.errMessage != "" {
+				t.Fatalf("got nil error, want: %s", tc.errMessage)
+			}
+			if diff := cmp.Diff(tc.out, got); diff != "" {
+				t.Errorf("unexpected output:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestMicroTimeProto(t *testing.T) {
+	cases := []struct {
+		input MicroTime
+	}{
+		{MicroTime{}},
+		{DateMicro(1998, time.May, 5, 1, 5, 5, 1000, time.Local)},
+		{DateMicro(1998, time.May, 5, 5, 5, 5, 0, time.Local)},
+	}
+
+	for _, c := range cases {
+		input := c.input
+		data, err := input.Marshal()
+		if err != nil {
+			t.Fatalf("Failed to marshal input: '%v': %v", input, err)
+		}
+		time := MicroTime{}
+		if err := time.Unmarshal(data); err != nil {
+			t.Fatalf("Failed to unmarshal output: '%v': %v", input, err)
+		}
+		if !reflect.DeepEqual(input, time) {
+			t.Errorf("Marshal->Unmarshal is not idempotent: '%v' vs '%v'", input, time)
+		}
+	}
+}
+
+func TestMicroTimeEqual(t *testing.T) {
+	t1 := NewMicroTime(time.Now())
+	cases := []struct {
+		name   string
+		x      *MicroTime
+		y      *MicroTime
+		result bool
+	}{
+		{"nil =? nil", nil, nil, true},
+		{"!nil =? !nil", &t1, &t1, true},
+		{"nil =? !nil", nil, &t1, false},
+		{"!nil =? nil", &t1, nil, false},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.Equal(c.y)
+			if result != c.result {
+				t.Errorf("Failed equality test for '%v', '%v': expected %+v, got %+v", c.x, c.y, c.result, result)
+			}
+		})
+	}
+}
+
+func TestMicroTimeEqualTime(t *testing.T) {
+	t1 := NewMicroTime(time.Now())
+	t2 := NewTime(t1.Time)
+	cases := []struct {
+		name   string
+		x      *MicroTime
+		y      *Time
+		result bool
+	}{
+		{"nil =? nil", nil, nil, true},
+		{"!nil =? !nil", &t1, &t2, true},
+		{"nil =? !nil", nil, &t2, false},
+		{"!nil =? nil", &t1, nil, false},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.EqualTime(c.y)
+			if result != c.result {
+				t.Errorf("Failed equality test for '%v', '%v': expected %+v, got %+v", c.x, c.y, c.result, result)
+			}
+		})
+	}
+}
+
+func TestMicroTimeBefore(t *testing.T) {
+	t1 := NewMicroTime(time.Now())
+	cases := []struct {
+		name string
+		x    *MicroTime
+		y    *MicroTime
+	}{
+		{"nil <? nil", nil, nil},
+		{"!nil <? !nil", &t1, &t1},
+		{"nil <? !nil", nil, &t1},
+		{"!nil <? nil", &t1, nil},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.Before(c.y)
+			if result {
+				t.Errorf("Failed before test for '%v', '%v': expected false, got %+v", c.x, c.y, result)
+			}
+		})
+	}
+}
+func TestMicroTimeBeforeTime(t *testing.T) {
+	t1 := NewMicroTime(time.Now())
+	t2 := NewTime(t1.Time)
+	cases := []struct {
+		name string
+		x    *MicroTime
+		y    *Time
+	}{
+		{"nil <? nil", nil, nil},
+		{"!nil <? !nil", &t1, &t2},
+		{"nil <? !nil", nil, &t2},
+		{"!nil <? nil", &t1, nil},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.BeforeTime(c.y)
+			if result {
+				t.Errorf("Failed before test for '%v', '%v': expected false, got %+v", c.x, c.y, result)
+			}
+		})
+	}
+}
+
+func TestMicroTimeIsZero(t *testing.T) {
+	t1 := NewMicroTime(time.Now())
+	cases := []struct {
+		name   string
+		x      *MicroTime
+		result bool
+	}{
+		{"nil =? 0", nil, true},
+		{"!nil =? 0", &t1, false},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.IsZero()
+			if result != c.result {
+				t.Errorf("Failed equality test for '%v': expected %+v, got %+v", c.x, c.result, result)
+			}
+		})
+	}
+}
+
+func TestMicroTimeUnmarshalJSONAndProtoEqual(t *testing.T) {
+	cases := []struct {
+		name   string
+		input  MicroTime
+		result bool
+	}{
+		{"nanosecond level precision", UnixMicro(123, 123123123), true},
+		{"microsecond level precision", UnixMicro(123, 123123000), true},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			jsonData, err := c.input.MarshalJSON()
+			if err != nil {
+				t.Fatalf("Failed to marshal input to JSON: '%v': %v", c.input, err)
+			}
+
+			protoData, err := c.input.Marshal()
+			if err != nil {
+				t.Fatalf("Failed to marshal input to proto: '%v': %v", c.input, err)
+			}
+
+			var tJSON, tProto MicroTime
+			if err = tJSON.UnmarshalJSON(jsonData); err != nil {
+				t.Fatalf("Failed to unmarshal JSON: '%v': %v", jsonData, err)
+			}
+			if err = tProto.Unmarshal(protoData); err != nil {
+				t.Fatalf("Failed to unmarshal proto: '%v': %v", protoData, err)
+			}
+
+			result := tJSON.Equal(&tProto)
+			if result != c.result {
+				t.Errorf("Failed equality test for '%v': expected %+v, got %+v", c.input, c.result, result)
+			}
+		})
+	}
+}
+
+func TestMicroTimeProtoUnmarshalRaw(t *testing.T) {
+	cases := []struct {
+		name     string
+		input    []byte
+		expected MicroTime
+	}{
+		// input is generated by Timestamp{123, 123123123}.Marshal()
+		{"nanosecond level precision", []byte{8, 123, 16, 179, 235, 218, 58}, UnixMicro(123, 123123000)},
+		// input is generated by Timestamp{123, 123123000}.Marshal()
+		{"microsecond level precision", []byte{8, 123, 16, 184, 234, 218, 58}, UnixMicro(123, 123123000)},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			var actual MicroTime
+			if err := actual.Unmarshal(c.input); err != nil {
+				t.Fatalf("Failed to unmarshal proto: '%v': %v", c.input, err)
+			}
+
+			if !actual.Equal(&c.expected) {
+				t.Errorf("Failed unmarshal from nanosecond-precise raw for '%v': expected %+v, got %+v", c.input, c.expected, actual)
+			}
+		})
+	}
+
+}
+
+func TestMicroTimeRoundtripCBOR(t *testing.T) {
+	fuzzer := randfill.New()
+	for i := 0; i < 500; i++ {
+		var initial, final MicroTime
+		fuzzer.Fill(&initial)
+		b, err := cbor.Marshal(initial)
+		if err != nil {
+			t.Errorf("error encoding %v: %v", initial, err)
+			continue
+		}
+		err = cbor.Unmarshal(b, &final)
+		if err != nil {
+			t.Errorf("%v: error decoding %v: %v", initial, string(b), err)
+		}
+		if !final.Equal(&initial) {
+			diag, err := cbor.Diagnose(b)
+			if err != nil {
+				t.Logf("failed to produce diagnostic encoding of 0x%x: %v", b, err)
+			}
+			t.Errorf("expected equal: %v, %v (cbor was '%s')", initial, final, diag)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/options_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/options_test.go
new file mode 100644
index 0000000000..5d37987dac
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/options_test.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"testing"
+
+	"sigs.k8s.io/randfill"
+)
+
+func TestPatchOptionsIsSuperSetOfUpdateOptions(t *testing.T) {
+	f := randfill.New()
+	for i := 0; i < 1000; i++ {
+		t.Run(fmt.Sprintf("Run %d/1000", i), func(t *testing.T) {
+			update := UpdateOptions{}
+			f.Fill(&update)
+
+			b, err := json.Marshal(update)
+			if err != nil {
+				t.Fatalf("failed to marshal UpdateOptions (%v): %v", err, update)
+			}
+			patch := PatchOptions{}
+			err = json.Unmarshal(b, &patch)
+			if err != nil {
+				t.Fatalf("failed to unmarshal UpdateOptions into PatchOptions: %v", err)
+			}
+
+			b, err = json.Marshal(patch)
+			if err != nil {
+				t.Fatalf("failed to marshal PatchOptions (%v): %v", err, patch)
+			}
+			got := UpdateOptions{}
+			err = json.Unmarshal(b, &got)
+			if err != nil {
+				t.Fatalf("failed to unmarshal UpdateOptions into UpdateOptions: %v", err)
+			}
+
+			if !reflect.DeepEqual(update, got) {
+				t.Fatalf(`UpdateOptions -> PatchOptions -> UpdateOptions round-trip failed:
+got: %v
+want: %v`, got, update)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/register.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/register.go
new file mode 100644
index 0000000000..1abdd626de
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/register.go
@@ -0,0 +1,107 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// GroupName is the group name for this API.
+const GroupName = "meta.k8s.io"
+
+var (
+	// localSchemeBuilder is used to make compiler happy for autogenerated
+	// conversions. However, it's not used.
+	schemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &schemeBuilder
+)
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Unversioned is group version for unversioned API objects
+// TODO: this should be v1 probably
+var Unversioned = schema.GroupVersion{Group: "", Version: "v1"}
+
+// WatchEventKind is name reserved for serializing watch events.
+const WatchEventKind = "WatchEvent"
+
+// Kind takes an unqualified kind and returns a Group qualified GroupKind
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// scheme is the registry for the common types that adhere to the meta v1 API spec.
+var scheme = runtime.NewScheme()
+
+// ParameterCodec knows about query parameters used with the meta v1 API spec.
+var ParameterCodec = runtime.NewParameterCodec(scheme)
+
+var optionsTypes = []runtime.Object{
+	&ListOptions{},
+	&GetOptions{},
+	&DeleteOptions{},
+	&CreateOptions{},
+	&UpdateOptions{},
+	&PatchOptions{},
+}
+
+// AddToGroupVersion registers common meta types into schemas.
+func AddToGroupVersion(scheme *runtime.Scheme, groupVersion schema.GroupVersion) {
+	scheme.AddKnownTypeWithName(groupVersion.WithKind(WatchEventKind), &WatchEvent{})
+	scheme.AddKnownTypeWithName(
+		schema.GroupVersion{Group: groupVersion.Group, Version: runtime.APIVersionInternal}.WithKind(WatchEventKind),
+		&InternalEvent{},
+	)
+	// Supports legacy code paths, most callers should use metav1.ParameterCodec for now
+	scheme.AddKnownTypes(groupVersion, optionsTypes...)
+	// Register Unversioned types under their own special group
+	scheme.AddUnversionedTypes(Unversioned,
+		&Status{},
+		&APIVersions{},
+		&APIGroupList{},
+		&APIGroup{},
+		&APIResourceList{},
+	)
+
+	// register manually. This usually goes through the SchemeBuilder, which we cannot use here.
+	utilruntime.Must(RegisterConversions(scheme))
+	utilruntime.Must(RegisterDefaults(scheme))
+}
+
+// AddMetaToScheme registers base meta types into schemas.
+func AddMetaToScheme(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&Table{},
+		&TableOptions{},
+		&PartialObjectMetadata{},
+		&PartialObjectMetadataList{},
+	)
+
+	return nil
+}
+
+func init() {
+	scheme.AddUnversionedTypes(SchemeGroupVersion, optionsTypes...)
+
+	utilruntime.Must(AddMetaToScheme(scheme))
+
+	// register manually. This usually goes through the SchemeBuilder, which we cannot use here.
+	utilruntime.Must(RegisterDefaults(scheme))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time.go
new file mode 100644
index 0000000000..0333cfdb33
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time.go
@@ -0,0 +1,211 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"time"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+)
+
+// Time is a wrapper around time.Time which supports correct
+// marshaling to YAML and JSON.  Wrappers are provided for many
+// of the factory methods that the time package offers.
+//
+// +protobuf.options.marshal=false
+// +protobuf.as=Timestamp
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type Time struct {
+	time.Time `protobuf:"-"`
+}
+
+// DeepCopyInto creates a deep-copy of the Time value.  The underlying time.Time
+// type is effectively immutable in the time API, so it is safe to
+// copy-by-assign, despite the presence of (unexported) Pointer fields.
+func (t *Time) DeepCopyInto(out *Time) {
+	*out = *t
+}
+
+// NewTime returns a wrapped instance of the provided time
+func NewTime(time time.Time) Time {
+	return Time{time}
+}
+
+// Date returns the Time corresponding to the supplied parameters
+// by wrapping time.Date.
+func Date(year int, month time.Month, day, hour, min, sec, nsec int, loc *time.Location) Time {
+	return Time{time.Date(year, month, day, hour, min, sec, nsec, loc)}
+}
+
+// Now returns the current local time.
+func Now() Time {
+	return Time{time.Now()}
+}
+
+// IsZero returns true if the value is nil or time is zero.
+func (t *Time) IsZero() bool {
+	if t == nil {
+		return true
+	}
+	return t.Time.IsZero()
+}
+
+// Before reports whether the time instant t is before u.
+func (t *Time) Before(u *Time) bool {
+	if t != nil && u != nil {
+		return t.Time.Before(u.Time)
+	}
+	return false
+}
+
+// Equal reports whether the time instant t is equal to u.
+func (t *Time) Equal(u *Time) bool {
+	if t == nil && u == nil {
+		return true
+	}
+	if t != nil && u != nil {
+		return t.Time.Equal(u.Time)
+	}
+	return false
+}
+
+// Unix returns the local time corresponding to the given Unix time
+// by wrapping time.Unix.
+func Unix(sec int64, nsec int64) Time {
+	return Time{time.Unix(sec, nsec)}
+}
+
+// Rfc3339Copy returns a copy of the Time at second-level precision.
+func (t Time) Rfc3339Copy() Time {
+	copied, _ := time.Parse(time.RFC3339, t.Format(time.RFC3339))
+	return Time{copied}
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+func (t *Time) UnmarshalJSON(b []byte) error {
+	if len(b) == 4 && string(b) == "null" {
+		t.Time = time.Time{}
+		return nil
+	}
+
+	var str string
+	err := json.Unmarshal(b, &str)
+	if err != nil {
+		return err
+	}
+
+	pt, err := time.Parse(time.RFC3339, str)
+	if err != nil {
+		return err
+	}
+
+	t.Time = pt.Local()
+	return nil
+}
+
+func (t *Time) UnmarshalCBOR(b []byte) error {
+	var s *string
+	if err := cbor.Unmarshal(b, &s); err != nil {
+		return err
+	}
+	if s == nil {
+		t.Time = time.Time{}
+		return nil
+	}
+
+	parsed, err := time.Parse(time.RFC3339, *s)
+	if err != nil {
+		return err
+	}
+
+	t.Time = parsed.Local()
+	return nil
+}
+
+// UnmarshalQueryParameter converts from a URL query parameter value to an object
+func (t *Time) UnmarshalQueryParameter(str string) error {
+	if len(str) == 0 {
+		t.Time = time.Time{}
+		return nil
+	}
+	// Tolerate requests from older clients that used JSON serialization to build query params
+	if len(str) == 4 && str == "null" {
+		t.Time = time.Time{}
+		return nil
+	}
+
+	pt, err := time.Parse(time.RFC3339, str)
+	if err != nil {
+		return err
+	}
+
+	t.Time = pt.Local()
+	return nil
+}
+
+// MarshalJSON implements the json.Marshaler interface.
+func (t Time) MarshalJSON() ([]byte, error) {
+	if t.IsZero() {
+		// Encode unset/nil objects as JSON's "null".
+		return []byte("null"), nil
+	}
+	buf := make([]byte, 0, len(time.RFC3339)+2)
+	buf = append(buf, '"')
+	// time cannot contain non escapable JSON characters
+	buf = t.UTC().AppendFormat(buf, time.RFC3339)
+	buf = append(buf, '"')
+	return buf, nil
+}
+
+func (t Time) MarshalCBOR() ([]byte, error) {
+	if t.IsZero() {
+		return cbor.Marshal(nil)
+	}
+
+	return cbor.Marshal(t.UTC().Format(time.RFC3339))
+}
+
+// ToUnstructured implements the value.UnstructuredConverter interface.
+func (t Time) ToUnstructured() interface{} {
+	if t.IsZero() {
+		return nil
+	}
+	buf := make([]byte, 0, len(time.RFC3339))
+	buf = t.UTC().AppendFormat(buf, time.RFC3339)
+	return string(buf)
+}
+
+// OpenAPISchemaType is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+//
+// See: https://github.com/kubernetes/kube-openapi/tree/master/pkg/generators
+func (_ Time) OpenAPISchemaType() []string { return []string{"string"} }
+
+// OpenAPISchemaFormat is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+func (_ Time) OpenAPISchemaFormat() string { return "date-time" }
+
+// MarshalQueryParameter converts to a URL query parameter value
+func (t Time) MarshalQueryParameter() (string, error) {
+	if t.IsZero() {
+		// Encode unset/nil objects as an empty string
+		return "", nil
+	}
+
+	return t.UTC().Format(time.RFC3339), nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_fuzz.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_fuzz.go
new file mode 100644
index 0000000000..14ec5f0586
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_fuzz.go
@@ -0,0 +1,40 @@
+//go:build !notest
+
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"math/rand"
+	"time"
+
+	"sigs.k8s.io/randfill"
+)
+
+// Fuzz satisfies randfill.SimpleSelfFiller.
+func (t *Time) RandFill(r *rand.Rand) {
+	if t == nil {
+		return
+	}
+	// Allow for about 1000 years of randomness.  Leave off nanoseconds
+	// because JSON doesn't represent them so they can't round-trip
+	// properly.
+	t.Time = time.Unix(r.Int63n(1000*365*24*60*60), 0)
+}
+
+// ensure Time implements randfill.SimpleSelfFiller
+var _ randfill.SimpleSelfFiller = &Time{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_proto.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_proto.go
new file mode 100644
index 0000000000..eac8d96589
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_proto.go
@@ -0,0 +1,100 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"time"
+)
+
+// Timestamp is a struct that is equivalent to Time, but intended for
+// protobuf marshalling/unmarshalling. It is generated into a serialization
+// that matches Time. Do not use in Go structs.
+type Timestamp struct {
+	// Represents seconds of UTC time since Unix epoch
+	// 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+	// 9999-12-31T23:59:59Z inclusive.
+	Seconds int64 `json:"seconds" protobuf:"varint,1,opt,name=seconds"`
+	// Non-negative fractions of a second at nanosecond resolution. Negative
+	// second values with fractions must still have non-negative nanos values
+	// that count forward in time. Must be from 0 to 999,999,999
+	// inclusive. This field may be limited in precision depending on context.
+	Nanos int32 `json:"nanos" protobuf:"varint,2,opt,name=nanos"`
+}
+
+// Timestamp returns the Time as a new Timestamp value.
+func (m *Time) ProtoTime() *Timestamp {
+	if m == nil {
+		return &Timestamp{}
+	}
+	return &Timestamp{
+		Seconds: m.Time.Unix(),
+		// leaving this here for the record.  our JSON only handled seconds, so this results in writes by
+		// protobuf clients storing values that aren't read by json clients, which results in unexpected
+		// field mutation, which fails various validation and equality code.
+		// Nanos:   int32(m.Time.Nanosecond()),
+	}
+}
+
+// Size implements the protobuf marshalling interface.
+func (m *Time) Size() (n int) {
+	if m == nil || m.Time.IsZero() {
+		return 0
+	}
+	return m.ProtoTime().Size()
+}
+
+// Reset implements the protobuf marshalling interface.
+func (m *Time) Unmarshal(data []byte) error {
+	if len(data) == 0 {
+		m.Time = time.Time{}
+		return nil
+	}
+	p := Timestamp{}
+	if err := p.Unmarshal(data); err != nil {
+		return err
+	}
+	// leaving this here for the record.  our JSON only handled seconds, so this results in writes by
+	// protobuf clients storing values that aren't read by json clients, which results in unexpected
+	// field mutation, which fails various validation and equality code.
+	// m.Time = time.Unix(p.Seconds, int64(p.Nanos)).Local()
+	m.Time = time.Unix(p.Seconds, int64(0)).Local()
+	return nil
+}
+
+// Marshal implements the protobuf marshaling interface.
+func (m *Time) Marshal() (data []byte, err error) {
+	if m == nil || m.Time.IsZero() {
+		return nil, nil
+	}
+	return m.ProtoTime().Marshal()
+}
+
+// MarshalTo implements the protobuf marshaling interface.
+func (m *Time) MarshalTo(data []byte) (int, error) {
+	if m == nil || m.Time.IsZero() {
+		return 0, nil
+	}
+	return m.ProtoTime().MarshalTo(data)
+}
+
+// MarshalToSizedBuffer implements the protobuf reverse marshaling interface.
+func (m *Time) MarshalToSizedBuffer(data []byte) (int, error) {
+	if m == nil || m.Time.IsZero() {
+		return 0, nil
+	}
+	return m.ProtoTime().MarshalToSizedBuffer(data)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_test.go
new file mode 100644
index 0000000000..886425f2fb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_test.go
@@ -0,0 +1,327 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"testing"
+	"time"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	"sigs.k8s.io/yaml"
+
+	"github.com/google/go-cmp/cmp"
+	"sigs.k8s.io/randfill"
+)
+
+type TimeHolder struct {
+	T Time `json:"t"`
+}
+
+func TestTimeMarshalYAML(t *testing.T) {
+	cases := []struct {
+		input  Time
+		result string
+	}{
+		{Time{}, "t: null\n"},
+		{Date(1998, time.May, 5, 1, 5, 5, 50, time.FixedZone("test", -4*60*60)), "t: \"1998-05-05T05:05:05Z\"\n"},
+		{Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC), "t: \"1998-05-05T05:05:05Z\"\n"},
+	}
+
+	for _, c := range cases {
+		input := TimeHolder{c.input}
+		result, err := yaml.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input: '%v': %v", input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("Failed to marshal input: '%v': expected %+v, got %q", input, c.result, string(result))
+		}
+	}
+}
+
+func TestTimeUnmarshalYAML(t *testing.T) {
+	cases := []struct {
+		input  string
+		result Time
+	}{
+		{"t: null\n", Time{}},
+		{"t: 1998-05-05T05:05:05Z\n", Time{Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC).Local()}},
+	}
+
+	for _, c := range cases {
+		var result TimeHolder
+		if err := yaml.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("Failed to unmarshal input '%v': %v", c.input, err)
+		}
+		if result.T != c.result {
+			t.Errorf("Failed to unmarshal input '%v': expected %+v, got %+v", c.input, c.result, result)
+		}
+	}
+}
+
+func TestTimeMarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  Time
+		result string
+	}{
+		{Time{}, "{\"t\":null}"},
+		{Date(1998, time.May, 5, 5, 5, 5, 50, time.UTC), "{\"t\":\"1998-05-05T05:05:05Z\"}"},
+		{Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC), "{\"t\":\"1998-05-05T05:05:05Z\"}"},
+	}
+
+	for _, c := range cases {
+		input := TimeHolder{c.input}
+		result, err := json.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input: '%v': %v", input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("Failed to marshal input: '%v': expected %+v, got %q", input, c.result, string(result))
+		}
+	}
+}
+
+func TestTimeUnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  string
+		result Time
+	}{
+		{"{\"t\":null}", Time{}},
+		{"{\"t\":\"1998-05-05T05:05:05Z\"}", Time{Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC).Local()}},
+		{"{\"t\":\"1998-05-05T05:05:05.123456789Z\"}", Time{Date(1998, time.May, 5, 5, 5, 5, 123456789, time.UTC).Local()}},
+	}
+
+	for _, c := range cases {
+		var result TimeHolder
+		if err := json.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("Failed to unmarshal input '%v': %v", c.input, err)
+		}
+		if result.T != c.result {
+			t.Errorf("Failed to unmarshal input '%v': expected %+v, got %+v", c.input, c.result, result)
+		}
+	}
+}
+
+func TestTimeMarshalJSONUnmarshalYAML(t *testing.T) {
+	cases := []struct {
+		input Time
+	}{
+		{Time{}},
+		{Date(1998, time.May, 5, 5, 5, 5, 50, time.Local).Rfc3339Copy()},
+		{Date(1998, time.May, 5, 5, 5, 5, 0, time.Local).Rfc3339Copy()},
+	}
+
+	for i, c := range cases {
+		input := TimeHolder{c.input}
+		jsonMarshalled, err := json.Marshal(&input)
+		if err != nil {
+			t.Errorf("%d-1: Failed to marshal input: '%v': %v", i, input, err)
+		}
+
+		var result TimeHolder
+		err = yaml.Unmarshal(jsonMarshalled, &result)
+		if err != nil {
+			t.Errorf("%d-2: Failed to unmarshal '%+v': %v", i, string(jsonMarshalled), err)
+		}
+
+		iN, iO := input.T.Zone()
+		oN, oO := result.T.Zone()
+		if iN != oN || iO != oO {
+			t.Errorf("%d-3: Time zones differ before and after serialization %s:%d %s:%d", i, iN, iO, oN, oO)
+		}
+
+		if input.T.UnixNano() != result.T.UnixNano() {
+			t.Errorf("%d-4: Failed to marshal input '%#v': got %#v", i, input, result)
+		}
+	}
+}
+
+func TestTimeMarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		in   Time
+		out  []byte
+	}{
+		{name: "zero value", in: Time{}, out: []byte{0xf6}},                                                                                        // null
+		{name: "no fractional seconds", in: Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC), out: []byte("\x541998-05-05T05:05:05Z")},                // '1998-05-05T05:05:05Z'
+		{name: "fractional seconds truncated", in: Date(1998, time.May, 5, 5, 5, 5, 123456789, time.UTC), out: []byte("\x541998-05-05T05:05:05Z")}, // '1998-05-05T05:05:05Z'
+		{name: "epoch", in: Time{Time: time.Unix(0, 0)}, out: []byte("\x541970-01-01T00:00:00Z")},                                                  // '1970-01-01T00:00:00Z'
+		{name: "pre-epoch", in: Date(1960, time.January, 1, 0, 0, 0, 0, time.UTC), out: []byte("\x541960-01-01T00:00:00Z")},                        // '1960-01-01T00:00:00Z'
+	} {
+		t.Run(fmt.Sprintf("%+v", tc.in), func(t *testing.T) {
+			got, err := tc.in.MarshalCBOR()
+			if err != nil {
+				t.Fatal(err)
+			}
+			if diff := cmp.Diff(tc.out, got); diff != "" {
+				t.Errorf("unexpected output:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestTimeUnmarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		in         []byte
+		out        Time
+		errMessage string
+	}{
+		{name: "null", in: []byte{0xf6}, out: Time{}}, // null
+		{name: "no fractional seconds", in: []byte("\x58\x141998-05-05T05:05:05Z"), out: Time{Time: Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC).Local()}},                    // '1998-05-05T05:05:05Z'
+		{name: "fractional seconds", in: []byte("\x58\x1e1998-05-05T05:05:05.123456789Z"), out: Time{Time: Date(1998, time.May, 5, 5, 5, 5, 123456789, time.UTC).Local()}},     // '1998-05-05T05:05:05.123456789Z'
+		{name: "invalid cbor type", in: []byte{0x07}, out: Time{}, errMessage: "cbor: cannot unmarshal positive integer into Go value of type string"},                         // 7
+		{name: "malformed timestamp", in: []byte("\x45hello"), out: Time{}, errMessage: `parsing time "hello" as "2006-01-02T15:04:05Z07:00": cannot parse "hello" as "2006"`}, // 'hello'
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var got Time
+			err := got.UnmarshalCBOR(tc.in)
+			if err != nil {
+				if tc.errMessage == "" {
+					t.Fatalf("want nil error, got: %v", err)
+				} else if gotMessage := err.Error(); tc.errMessage != gotMessage {
+					t.Fatalf("want error: %q, got: %q", tc.errMessage, gotMessage)
+				}
+			} else if tc.errMessage != "" {
+				t.Fatalf("got nil error, want: %s", tc.errMessage)
+			}
+			if diff := cmp.Diff(tc.out, got); diff != "" {
+				t.Errorf("unexpected output:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestTimeProto(t *testing.T) {
+	cases := []struct {
+		input Time
+	}{
+		{Time{}},
+		{Date(1998, time.May, 5, 1, 5, 5, 0, time.Local)},
+		{Date(1998, time.May, 5, 5, 5, 5, 0, time.Local)},
+	}
+
+	for _, c := range cases {
+		input := c.input
+		data, err := input.Marshal()
+		if err != nil {
+			t.Fatalf("Failed to marshal input: '%v': %v", input, err)
+		}
+		time := Time{}
+		if err := time.Unmarshal(data); err != nil {
+			t.Fatalf("Failed to unmarshal output: '%v': %v", input, err)
+		}
+		if !reflect.DeepEqual(input, time) {
+			t.Errorf("Marshal->Unmarshal is not idempotent: '%v' vs '%v'", input, time)
+		}
+	}
+}
+
+func TestTimeEqual(t *testing.T) {
+	t1 := NewTime(time.Now())
+	cases := []struct {
+		name   string
+		x      *Time
+		y      *Time
+		result bool
+	}{
+		{"nil =? nil", nil, nil, true},
+		{"!nil =? !nil", &t1, &t1, true},
+		{"nil =? !nil", nil, &t1, false},
+		{"!nil =? nil", &t1, nil, false},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.Equal(c.y)
+			if result != c.result {
+				t.Errorf("Failed equality test for '%v', '%v': expected %+v, got %+v", c.x, c.y, c.result, result)
+			}
+		})
+	}
+}
+
+func TestTimeBefore(t *testing.T) {
+	t1 := NewTime(time.Now())
+	cases := []struct {
+		name string
+		x    *Time
+		y    *Time
+	}{
+		{"nil <? nil", nil, nil},
+		{"!nil <? !nil", &t1, &t1},
+		{"nil <? !nil", nil, &t1},
+		{"!nil <? nil", &t1, nil},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.Before(c.y)
+			if result {
+				t.Errorf("Failed equality test for '%v', '%v': expected false, got %+v", c.x, c.y, result)
+			}
+		})
+	}
+}
+
+func TestTimeIsZero(t *testing.T) {
+	t1 := NewTime(time.Now())
+	cases := []struct {
+		name   string
+		x      *Time
+		result bool
+	}{
+		{"nil =? 0", nil, true},
+		{"!nil =? 0", &t1, false},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.IsZero()
+			if result != c.result {
+				t.Errorf("Failed equality test for '%v': expected %+v, got %+v", c.x, c.result, result)
+			}
+		})
+	}
+}
+
+func TestTimeRoundtripCBOR(t *testing.T) {
+	fuzzer := randfill.New()
+	for i := 0; i < 500; i++ {
+		var initial, final Time
+		fuzzer.Fill(&initial)
+		b, err := cbor.Marshal(initial)
+		if err != nil {
+			t.Errorf("error encoding %v: %v", initial, err)
+			continue
+		}
+		err = cbor.Unmarshal(b, &final)
+		if err != nil {
+			t.Errorf("%v: error decoding %v: %v", initial, string(b), err)
+		}
+		if !final.Equal(&initial) {
+			diag, err := cbor.Diagnose(b)
+			if err != nil {
+				t.Logf("failed to produce diagnostic encoding of 0x%x: %v", b, err)
+			}
+			t.Errorf("expected equal: %v, %v (cbor was '%s')", initial, final, diag)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types.go
new file mode 100644
index 0000000000..f88212e15e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types.go
@@ -0,0 +1,1695 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package v1 contains API types that are common to all versions.
+//
+// The package contains two categories of types:
+//   - external (serialized) types that lack their own version (e.g TypeMeta)
+//   - internal (never-serialized) types that are needed by several different
+//     api groups, and so live here, to avoid duplication and/or import loops
+//     (e.g. LabelSelector).
+//
+// In the future, we will probably move these categories of objects into
+// separate packages.
+package v1
+
+import (
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// TypeMeta describes an individual object in an API response or request
+// with strings representing the type of the object and its API schema version.
+// Structures that are versioned or persisted should inline TypeMeta.
+//
+// +k8s:deepcopy-gen=false
+type TypeMeta struct {
+	// Kind is a string value representing the REST resource this object represents.
+	// Servers may infer this from the endpoint the client submits requests to.
+	// Cannot be updated.
+	// In CamelCase.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	Kind string `json:"kind,omitempty" protobuf:"bytes,1,opt,name=kind"`
+
+	// APIVersion defines the versioned schema of this representation of an object.
+	// Servers should convert recognized schemas to the latest internal value, and
+	// may reject unrecognized values.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+	// +optional
+	APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,2,opt,name=apiVersion"`
+}
+
+// ListMeta describes metadata that synthetic resources must have, including lists and
+// various status objects. A resource may have only one of {ObjectMeta, ListMeta}.
+type ListMeta struct {
+	// Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
+	// +optional
+	SelfLink string `json:"selfLink,omitempty" protobuf:"bytes,1,opt,name=selfLink"`
+
+	// String that identifies the server's internal version of this object that
+	// can be used by clients to determine when objects have changed.
+	// Value must be treated as opaque by clients and passed unmodified back to the server.
+	// Populated by the system.
+	// Read-only.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+	// +optional
+	ResourceVersion string `json:"resourceVersion,omitempty" protobuf:"bytes,2,opt,name=resourceVersion"`
+
+	// continue may be set if the user set a limit on the number of items returned, and indicates that
+	// the server has more data available. The value is opaque and may be used to issue another request
+	// to the endpoint that served this list to retrieve the next set of available objects. Continuing a
+	// consistent list may not be possible if the server configuration has changed or more than a few
+	// minutes have passed. The resourceVersion field returned when using this continue value will be
+	// identical to the value in the first response, unless you have received this token from an error
+	// message.
+	Continue string `json:"continue,omitempty" protobuf:"bytes,3,opt,name=continue"`
+
+	// remainingItemCount is the number of subsequent items in the list which are not included in this
+	// list response. If the list request contained label or field selectors, then the number of
+	// remaining items is unknown and the field will be left unset and omitted during serialization.
+	// If the list is complete (either because it is not chunking or because this is the last chunk),
+	// then there are no more remaining items and this field will be left unset and omitted during
+	// serialization.
+	// Servers older than v1.15 do not set this field.
+	// The intended use of the remainingItemCount is *estimating* the size of a collection. Clients
+	// should not rely on the remainingItemCount to be set or to be exact.
+	// +optional
+	RemainingItemCount *int64 `json:"remainingItemCount,omitempty" protobuf:"bytes,4,opt,name=remainingItemCount"`
+
+	// shardInfo is set when the list is a filtered subset of the full collection,
+	// as selected by a shard selector on the request. It echoes back the selector
+	// so clients can verify which shard they received and merge sharded responses.
+	// Clients should not cache sharded list responses as a full representation
+	// of the collection.
+	//
+	// This is an alpha field and requires enabling the ShardedListAndWatch feature gate.
+	// +featureGate=ShardedListAndWatch
+	// +optional
+	ShardInfo *ShardInfo `json:"shardInfo,omitempty" protobuf:"bytes,5,opt,name=shardInfo"`
+}
+
+// ShardInfo describes the shard selector that was applied to produce a list response.
+// Its presence on a list response indicates the list is a filtered subset.
+type ShardInfo struct {
+	// selector is the shard selector string from the request, echoed back so clients
+	// can verify which shard they received and merge responses from multiple shards.
+	// +required
+	Selector string `json:"selector" protobuf:"bytes,1,opt,name=selector"`
+}
+
+// Field path constants that are specific to the internal API
+// representation.
+const (
+	ObjectNameField = "metadata.name"
+)
+
+// These are internal finalizer values for Kubernetes-like APIs, must be qualified name unless defined here
+const (
+	FinalizerOrphanDependents = "orphan"
+	FinalizerDeleteDependents = "foregroundDeletion"
+)
+
+// ObjectMeta is metadata that all persisted resources must have, which includes all objects
+// users must create.
+type ObjectMeta struct {
+	// Name must be unique within a namespace. Is required when creating resources, although
+	// some resources may allow a client to request the generation of an appropriate name
+	// automatically. Name is primarily intended for creation idempotence and configuration
+	// definition.
+	// Cannot be updated.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+	// +optional
+	Name string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name"`
+
+	// GenerateName is an optional prefix, used by the server, to generate a unique
+	// name ONLY IF the Name field has not been provided.
+	// If this field is used, the name returned to the client will be different
+	// than the name passed. This value will also be combined with a unique suffix.
+	// The provided value has the same validation rules as the Name field,
+	// and may be truncated by the length of the suffix required to make the value
+	// unique on the server.
+	//
+	// If this field is specified and the generated name exists, the server will return a 409.
+	//
+	// Applied only if Name is not specified.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
+	// +optional
+	GenerateName string `json:"generateName,omitempty" protobuf:"bytes,2,opt,name=generateName"`
+
+	// Namespace defines the space within which each name must be unique. An empty namespace is
+	// equivalent to the "default" namespace, but "default" is the canonical representation.
+	// Not all objects are required to be scoped to a namespace - the value of this field for
+	// those objects will be empty.
+	//
+	// Must be a DNS_LABEL.
+	// Cannot be updated.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces
+	// +optional
+	Namespace string `json:"namespace,omitempty" protobuf:"bytes,3,opt,name=namespace"`
+
+	// Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
+	// +optional
+	SelfLink string `json:"selfLink,omitempty" protobuf:"bytes,4,opt,name=selfLink"`
+
+	// UID is the unique in time and space value for this object. It is typically generated by
+	// the server on successful creation of a resource and is not allowed to change on PUT
+	// operations.
+	//
+	// Populated by the system.
+	// Read-only.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	UID types.UID `json:"uid,omitempty" protobuf:"bytes,5,opt,name=uid,casttype=k8s.io/kubernetes/pkg/types.UID"`
+
+	// An opaque value that represents the internal version of this object that can
+	// be used by clients to determine when objects have changed. May be used for optimistic
+	// concurrency, change detection, and the watch operation on a resource or set of resources.
+	// Clients must treat these values as opaque and passed unmodified back to the server.
+	// They may only be valid for a particular resource or set of resources.
+	//
+	// Populated by the system.
+	// Read-only.
+	// Value must be treated as opaque by clients and .
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+	// +optional
+	ResourceVersion string `json:"resourceVersion,omitempty" protobuf:"bytes,6,opt,name=resourceVersion"`
+
+	// A sequence number representing a specific generation of the desired state.
+	// Populated by the system. Read-only.
+	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:minimum=0
+	Generation int64 `json:"generation,omitempty" protobuf:"varint,7,opt,name=generation"`
+
+	// CreationTimestamp is a timestamp representing the server time when this object was
+	// created. It is not guaranteed to be set in happens-before order across separate operations.
+	// Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+	//
+	// Populated by the system.
+	// Read-only.
+	// Null for lists.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	CreationTimestamp Time `json:"creationTimestamp,omitempty,omitzero" protobuf:"bytes,8,opt,name=creationTimestamp"`
+
+	// DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This
+	// field is set by the server when a graceful deletion is requested by the user, and is not
+	// directly settable by a client. The resource is expected to be deleted (no longer visible
+	// from resource lists, and not reachable by name) after the time in this field, once the
+	// finalizers list is empty. As long as the finalizers list contains items, deletion is blocked.
+	// Once the deletionTimestamp is set, this value may not be unset or be set further into the
+	// future, although it may be shortened or the resource may be deleted prior to this time.
+	// For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react
+	// by sending a graceful termination signal to the containers in the pod. After that 30 seconds,
+	// the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup,
+	// remove the pod from the API. In the presence of network partitions, this object may still
+	// exist after this timestamp, until an administrator or automated process can determine the
+	// resource is fully terminated.
+	// If not set, graceful deletion of the object has not been requested.
+	//
+	// Populated by the system when a graceful deletion is requested.
+	// Read-only.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	DeletionTimestamp *Time `json:"deletionTimestamp,omitempty" protobuf:"bytes,9,opt,name=deletionTimestamp"`
+
+	// Number of seconds allowed for this object to gracefully terminate before
+	// it will be removed from the system. Only set when deletionTimestamp is also set.
+	// May only be shortened.
+	// Read-only.
+	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	DeletionGracePeriodSeconds *int64 `json:"deletionGracePeriodSeconds,omitempty" protobuf:"varint,10,opt,name=deletionGracePeriodSeconds"`
+
+	// Map of string keys and values that can be used to organize and categorize
+	// (scope and select) objects. May match selectors of replication controllers
+	// and services.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
+	// +optional
+	Labels map[string]string `json:"labels,omitempty" protobuf:"bytes,11,rep,name=labels"`
+
+	// Annotations is an unstructured key value map stored with a resource that may be
+	// set by external tools to store and retrieve arbitrary metadata. They are not
+	// queryable and should be preserved when modifying objects.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
+	// +optional
+	Annotations map[string]string `json:"annotations,omitempty" protobuf:"bytes,12,rep,name=annotations"`
+
+	// List of objects depended by this object. If ALL objects in the list have
+	// been deleted, this object will be garbage collected. If this object is managed by a controller,
+	// then an entry in this list will point to this controller, with the controller field set to true.
+	// There cannot be more than one managing controller.
+	// +optional
+	// +patchMergeKey=uid
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=uid
+	// +k8s:alpha(since:"1.37")=+k8s:optional
+	OwnerReferences []OwnerReference `json:"ownerReferences,omitempty" patchStrategy:"merge" patchMergeKey:"uid" protobuf:"bytes,13,rep,name=ownerReferences"`
+
+	// Must be empty before the object is deleted from the registry. Each entry
+	// is an identifier for the responsible component that will remove the entry
+	// from the list. If the deletionTimestamp of the object is non-nil, entries
+	// in this list can only be removed.
+	// Finalizers may be processed and removed in any order.  Order is NOT enforced
+	// because it introduces significant risk of stuck finalizers.
+	// finalizers is a shared field, any actor with permission can reorder it.
+	// If the finalizer list is processed in order, then this can lead to a situation
+	// in which the component responsible for the first finalizer in the list is
+	// waiting for a signal (field value, external system, or other) produced by a
+	// component responsible for a finalizer later in the list, resulting in a deadlock.
+	// Without enforced ordering finalizers are free to order amongst themselves and
+	// are not vulnerable to ordering changes in the list.
+	// +optional
+	// +patchStrategy=merge
+	// +listType=set
+	Finalizers []string `json:"finalizers,omitempty" patchStrategy:"merge" protobuf:"bytes,14,rep,name=finalizers"`
+
+	// Tombstone: ClusterName was a legacy field that was always cleared by
+	// the system and never used.
+	// ClusterName string `json:"clusterName,omitempty" protobuf:"bytes,15,opt,name=clusterName"`
+
+	// ManagedFields maps workflow-id and version to the set of fields
+	// that are managed by that workflow. This is mostly for internal
+	// housekeeping, and users typically shouldn't need to set or
+	// understand this field. A workflow can be the user's name, a
+	// controller's name, or the name of a specific apply path like
+	// "ci-cd". The set of fields is always in the version that the
+	// workflow used when modifying the object.
+	//
+	// +optional
+	// +listType=atomic
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	ManagedFields []ManagedFieldsEntry `json:"managedFields,omitempty" protobuf:"bytes,17,rep,name=managedFields"`
+}
+
+const (
+	// NamespaceDefault means the object is in the default namespace which is applied when not specified by clients
+	NamespaceDefault = "default"
+	// NamespaceAll is the default argument to specify on a context when you want to list or filter resources across all namespaces
+	NamespaceAll = ""
+	// NamespaceNone is the argument for a context when there is no namespace.
+	NamespaceNone = ""
+	// NamespaceSystem is the system namespace where we place system components.
+	NamespaceSystem = "kube-system"
+	// NamespacePublic is the namespace where we place public info (ConfigMaps)
+	NamespacePublic = "kube-public"
+)
+
+// OwnerReference contains enough information to let you identify an owning
+// object. An owning object must be in the same namespace as the dependent, or
+// be cluster-scoped, so there is no namespace field.
+// +structType=atomic
+type OwnerReference struct {
+	// API version of the referent.
+	// +k8s:alpha(since:"1.37")=+k8s:required
+	APIVersion string `json:"apiVersion" protobuf:"bytes,5,opt,name=apiVersion"`
+	// Kind of the referent.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +k8s:alpha(since:"1.37")=+k8s:required
+	Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"`
+	// Name of the referent.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+	// +k8s:alpha(since:"1.37")=+k8s:required
+	Name string `json:"name" protobuf:"bytes,3,opt,name=name"`
+	// UID of the referent.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+	// +k8s:alpha(since:"1.37")=+k8s:required
+	UID types.UID `json:"uid" protobuf:"bytes,4,opt,name=uid,casttype=k8s.io/apimachinery/pkg/types.UID"`
+	// If true, this reference points to the managing controller.
+	// +optional
+	Controller *bool `json:"controller,omitempty" protobuf:"varint,6,opt,name=controller"`
+	// If true, AND if the owner has the "foregroundDeletion" finalizer, then
+	// the owner cannot be deleted from the key-value store until this
+	// reference is removed.
+	// See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
+	// for how the garbage collector interacts with this field and enforces the foreground deletion.
+	// Defaults to false.
+	// To set this field, a user needs "delete" permission of the owner,
+	// otherwise 422 (Unprocessable Entity) will be returned.
+	// +optional
+	BlockOwnerDeletion *bool `json:"blockOwnerDeletion,omitempty" protobuf:"varint,7,opt,name=blockOwnerDeletion"`
+}
+
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// ListOptions is the query options to a standard REST list call.
+type ListOptions struct {
+	TypeMeta `json:""`
+
+	// A selector to restrict the list of returned objects by their labels.
+	// Defaults to everything.
+	// +optional
+	LabelSelector string `json:"labelSelector,omitempty" protobuf:"bytes,1,opt,name=labelSelector"`
+	// A selector to restrict the list of returned objects by their fields.
+	// Defaults to everything.
+	// +optional
+	FieldSelector string `json:"fieldSelector,omitempty" protobuf:"bytes,2,opt,name=fieldSelector"`
+
+	// +k8s:deprecated=includeUninitialized,protobuf=6
+
+	// Watch for changes to the described resources and return them as a stream of
+	// add, update, and remove notifications. Specify resourceVersion.
+	// +optional
+	Watch bool `json:"watch,omitempty" protobuf:"varint,3,opt,name=watch"`
+	// allowWatchBookmarks requests watch events with type "BOOKMARK".
+	// Servers that do not implement bookmarks may ignore this flag and
+	// bookmarks are sent at the server's discretion. Clients should not
+	// assume bookmarks are returned at any specific interval, nor may they
+	// assume the server will send any BOOKMARK event during a session.
+	// If this is not a watch, this field is ignored.
+	// +optional
+	AllowWatchBookmarks bool `json:"allowWatchBookmarks,omitempty" protobuf:"varint,9,opt,name=allowWatchBookmarks"`
+
+	// resourceVersion sets a constraint on what resource versions a request may be served from.
+	// See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+	// details.
+	//
+	// Defaults to unset
+	// +optional
+	ResourceVersion string `json:"resourceVersion,omitempty" protobuf:"bytes,4,opt,name=resourceVersion"`
+
+	// resourceVersionMatch determines how resourceVersion is applied to list calls.
+	// It is highly recommended that resourceVersionMatch be set for list calls where
+	// resourceVersion is set
+	// See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+	// details.
+	//
+	// Defaults to unset
+	// +optional
+	ResourceVersionMatch ResourceVersionMatch `json:"resourceVersionMatch,omitempty" protobuf:"bytes,10,opt,name=resourceVersionMatch,casttype=ResourceVersionMatch"`
+	// Timeout for the list/watch call.
+	// This limits the duration of the call, regardless of any activity or inactivity.
+	// +optional
+	TimeoutSeconds *int64 `json:"timeoutSeconds,omitempty" protobuf:"varint,5,opt,name=timeoutSeconds"`
+
+	// limit is a maximum number of responses to return for a list call. If more items exist, the
+	// server will set the `continue` field on the list metadata to a value that can be used with the
+	// same initial query to retrieve the next set of results. Setting a limit may return fewer than
+	// the requested amount of items (up to zero items) in the event all requested objects are
+	// filtered out and clients should only use the presence of the continue field to determine whether
+	// more results are available. Servers may choose not to support the limit argument and will return
+	// all of the available results. If limit is specified and the continue field is empty, clients may
+	// assume that no more results are available. This field is not supported if watch is true.
+	//
+	// The server guarantees that the objects returned when using continue will be identical to issuing
+	// a single list call without a limit - that is, no objects created, modified, or deleted after the
+	// first request is issued will be included in any subsequent continued requests. This is sometimes
+	// referred to as a consistent snapshot, and ensures that a client that is using limit to receive
+	// smaller chunks of a very large result can ensure they see all possible objects. If objects are
+	// updated during a chunked list the version of the object that was present at the time the first list
+	// result was calculated is returned.
+	Limit int64 `json:"limit,omitempty" protobuf:"varint,7,opt,name=limit"`
+	// The continue option should be set when retrieving more results from the server. Since this value is
+	// server defined, clients may only use the continue value from a previous query result with identical
+	// query parameters (except for the value of continue) and the server may reject a continue value it
+	// does not recognize. If the specified continue value is no longer valid whether due to expiration
+	// (generally five to fifteen minutes) or a configuration change on the server, the server will
+	// respond with a 410 ResourceExpired error together with a continue token. If the client needs a
+	// consistent list, it must restart their list without the continue field. Otherwise, the client may
+	// send another list request with the token received with the 410 error, the server will respond with
+	// a list starting from the next key, but from the latest snapshot, which is inconsistent from the
+	// previous list results - objects that are created, modified, or deleted after the first list request
+	// will be included in the response, as long as their keys are after the "next key".
+	//
+	// This field is not supported when watch is true. Clients may start a watch from the last
+	// resourceVersion value returned by the server and not miss any modifications.
+	Continue string `json:"continue,omitempty" protobuf:"bytes,8,opt,name=continue"`
+
+	// `sendInitialEvents=true` may be set together with `watch=true`.
+	// In that case, the watch stream will begin with synthetic events to
+	// produce the current state of objects in the collection. Once all such
+	// events have been sent, a synthetic "Bookmark" event  will be sent.
+	// The bookmark will report the ResourceVersion (RV) corresponding to the
+	// set of objects, and be marked with `"k8s.io/initial-events-end": "true"` annotation.
+	// Afterwards, the watch stream will proceed as usual, sending watch events
+	// corresponding to changes (subsequent to the RV) to objects watched.
+	//
+	// When `sendInitialEvents` option is set, we require `resourceVersionMatch`
+	// option to also be set. The semantic of the watch request is as following:
+	// - `resourceVersionMatch` = NotOlderThan
+	//   is interpreted as "data at least as new as the provided `resourceVersion`"
+	//   and the bookmark event is send when the state is synced
+	//   to a `resourceVersion` at least as fresh as the one provided by the ListOptions.
+	//   If `resourceVersion` is unset, this is interpreted as "consistent read" and the
+	//   bookmark event is send when the state is synced at least to the moment
+	//   when request started being processed.
+	// - `resourceVersionMatch` set to any other value or unset
+	//   Invalid error is returned.
+	//
+	// Defaults to true if `resourceVersion=""` or `resourceVersion="0"` (for backward
+	// compatibility reasons) and to false otherwise.
+	// +optional
+	SendInitialEvents *bool `json:"sendInitialEvents,omitempty" protobuf:"varint,11,opt,name=sendInitialEvents"`
+
+	// shardSelector restricts the list of returned objects using a CEL-based
+	// shard selector expression. The format uses the shardRange() function
+	// combined with || (logical OR) to specify one or more hash ranges:
+	//
+	//   shardRange(object.metadata.uid, '0x0', '0x8000000000000000')
+	//   shardRange(object.metadata.uid, '0x0', '0x8000000000000000') || shardRange(object.metadata.uid, '0x8000000000000000', '0x10000000000000000')
+	//
+	// Field paths use CEL-style object-rooted syntax (e.g. "object.metadata.uid"),
+	// NOT the fieldSelector format ("metadata.uid"). Currently supported paths:
+	//   - object.metadata.uid
+	//   - object.metadata.namespace
+	//
+	// hexStart and hexEnd are single-quoted CEL string literals with a '0x' prefix,
+	// defining the inclusive lower and exclusive upper bounds over the 64-bit FNV-1a
+	// hash space. The full range is [0x0, 0x10000000000000000), where the exclusive
+	// upper bound equals 2^64.
+	//
+	// Examples:
+	//   2-shard split:
+	//     shard 0: shardRange(object.metadata.uid, '0x0000000000000000', '0x8000000000000000')
+	//     shard 1: shardRange(object.metadata.uid, '0x8000000000000000', '0x10000000000000000')
+	//   4-shard split:
+	//     shard 0: shardRange(object.metadata.uid, '0x0000000000000000', '0x4000000000000000')
+	//     shard 1: shardRange(object.metadata.uid, '0x4000000000000000', '0x8000000000000000')
+	//     shard 2: shardRange(object.metadata.uid, '0x8000000000000000', '0xc000000000000000')
+	//     shard 3: shardRange(object.metadata.uid, '0xc000000000000000', '0x10000000000000000')
+	//
+	// This is an alpha field and requires enabling the ShardedListAndWatch feature gate.
+	// +featureGate=ShardedListAndWatch
+	// +optional
+	ShardSelector string `json:"shardSelector,omitempty" protobuf:"bytes,15,opt,name=shardSelector"`
+}
+
+const (
+	// InitialEventsAnnotationKey the name of the key
+	// under which an annotation marking the end of
+	// a watchlist stream is stored.
+	//
+	// The annotation is added to a "Bookmark" event.
+	InitialEventsAnnotationKey = "k8s.io/initial-events-end"
+)
+
+// resourceVersionMatch specifies how the resourceVersion parameter is applied. resourceVersionMatch
+// may only be set if resourceVersion is also set.
+//
+// "NotOlderThan" matches data at least as new as the provided resourceVersion.
+// "Exact" matches data at the exact resourceVersion provided.
+//
+// See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+// details.
+type ResourceVersionMatch string
+
+const (
+	// ResourceVersionMatchNotOlderThan matches data at least as new as the provided
+	// resourceVersion.
+	ResourceVersionMatchNotOlderThan ResourceVersionMatch = "NotOlderThan"
+	// ResourceVersionMatchExact matches data at the exact resourceVersion
+	// provided.
+	ResourceVersionMatchExact ResourceVersionMatch = "Exact"
+)
+
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// GetOptions is the standard query options to the standard REST get call.
+type GetOptions struct {
+	TypeMeta `json:""`
+	// resourceVersion sets a constraint on what resource versions a request may be served from.
+	// See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+	// details.
+	//
+	// Defaults to unset
+	// +optional
+	ResourceVersion string `json:"resourceVersion,omitempty" protobuf:"bytes,1,opt,name=resourceVersion"`
+	// +k8s:deprecated=includeUninitialized,protobuf=2
+}
+
+// DeletionPropagation decides if a deletion will propagate to the dependents of
+// the object, and how the garbage collector will handle the propagation.
+type DeletionPropagation string
+
+const (
+	// Orphans the dependents.
+	DeletePropagationOrphan DeletionPropagation = "Orphan"
+	// Deletes the object from the key-value store, the garbage collector will
+	// delete the dependents in the background.
+	DeletePropagationBackground DeletionPropagation = "Background"
+	// The object exists in the key-value store until the garbage collector
+	// deletes all the dependents whose ownerReference.blockOwnerDeletion=true
+	// from the key-value store.  API sever will put the "foregroundDeletion"
+	// finalizer on the object, and sets its deletionTimestamp.  This policy is
+	// cascading, i.e., the dependents will be deleted with Foreground.
+	DeletePropagationForeground DeletionPropagation = "Foreground"
+)
+
+const (
+	// DryRunAll means to complete all processing stages, but don't
+	// persist changes to storage.
+	DryRunAll = "All"
+)
+
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// DeleteOptions may be provided when deleting an API object.
+type DeleteOptions struct {
+	TypeMeta `json:""`
+
+	// The duration in seconds before the object should be deleted. Value must be non-negative integer.
+	// The value zero indicates delete immediately. If this value is nil, the default grace period for the
+	// specified type will be used.
+	// Defaults to a per object value if not specified. zero means delete immediately.
+	// +optional
+	GracePeriodSeconds *int64 `json:"gracePeriodSeconds,omitempty" protobuf:"varint,1,opt,name=gracePeriodSeconds"`
+
+	// Must be fulfilled before a deletion is carried out. If not possible, a 409 Conflict status will be
+	// returned.
+	// +k8s:conversion-gen=false
+	// +optional
+	Preconditions *Preconditions `json:"preconditions,omitempty" protobuf:"bytes,2,opt,name=preconditions"`
+
+	// Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7.
+	// Should the dependent objects be orphaned. If true/false, the "orphan"
+	// finalizer will be added to/removed from the object's finalizers list.
+	// Either this field or PropagationPolicy may be set, but not both.
+	// +optional
+	OrphanDependents *bool `json:"orphanDependents,omitempty" protobuf:"varint,3,opt,name=orphanDependents"`
+
+	// Whether and how garbage collection will be performed.
+	// Either this field or OrphanDependents may be set, but not both.
+	// The default policy is decided by the existing finalizer set in the
+	// metadata.finalizers and the resource-specific default policy.
+	// Acceptable values are: 'Orphan' - orphan the dependents; 'Background' -
+	// allow the garbage collector to delete the dependents in the background;
+	// 'Foreground' - a cascading policy that deletes all dependents in the
+	// foreground.
+	// +optional
+	PropagationPolicy *DeletionPropagation `json:"propagationPolicy,omitempty" protobuf:"varint,4,opt,name=propagationPolicy"`
+
+	// When present, indicates that modifications should not be
+	// persisted. An invalid or unrecognized dryRun directive will
+	// result in an error response and no further processing of the
+	// request. Valid values are:
+	// - All: all dry run stages will be processed
+	// +optional
+	// +listType=atomic
+	DryRun []string `json:"dryRun,omitempty" protobuf:"bytes,5,rep,name=dryRun"`
+
+	// if set to true, it will trigger an unsafe deletion of the resource in
+	// case the normal deletion flow fails with a corrupt object error.
+	// A resource is considered corrupt if it can not be retrieved from
+	// the underlying storage successfully because of a) its data can
+	// not be transformed e.g. decryption failure, or b) it fails
+	// to decode into an object.
+	// NOTE: unsafe deletion ignores finalizer constraints, skips
+	// precondition checks, and removes the object from the storage.
+	// WARNING: This may potentially break the cluster if the workload
+	// associated with the resource being unsafe-deleted relies on normal
+	// deletion flow. Use only if you REALLY know what you are doing.
+	// The default value is false, and the user must opt in to enable it
+	// +optional
+	IgnoreStoreReadErrorWithClusterBreakingPotential *bool `json:"ignoreStoreReadErrorWithClusterBreakingPotential,omitempty" protobuf:"varint,6,opt,name=ignoreStoreReadErrorWithClusterBreakingPotential"`
+}
+
+const (
+	// FieldValidationIgnore ignores unknown/duplicate fields
+	FieldValidationIgnore = "Ignore"
+	// FieldValidationWarn responds with a warning, but successfully serve the request
+	FieldValidationWarn = "Warn"
+	// FieldValidationStrict fails the request on unknown/duplicate fields
+	FieldValidationStrict = "Strict"
+)
+
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// CreateOptions may be provided when creating an API object.
+type CreateOptions struct {
+	TypeMeta `json:""`
+
+	// When present, indicates that modifications should not be
+	// persisted. An invalid or unrecognized dryRun directive will
+	// result in an error response and no further processing of the
+	// request. Valid values are:
+	// - All: all dry run stages will be processed
+	// +optional
+	// +listType=atomic
+	DryRun []string `json:"dryRun,omitempty" protobuf:"bytes,1,rep,name=dryRun"`
+	// +k8s:deprecated=includeUninitialized,protobuf=2
+
+	// fieldManager is a name associated with the actor or entity
+	// that is making these changes. The value must be less than or
+	// 128 characters long, and only contain printable characters,
+	// as defined by https://golang.org/pkg/unicode/#IsPrint.
+	// +optional
+	FieldManager string `json:"fieldManager,omitempty" protobuf:"bytes,3,name=fieldManager"`
+
+	// fieldValidation instructs the server on how to handle
+	// objects in the request (POST/PUT/PATCH) containing unknown
+	// or duplicate fields. Valid values are:
+	// - Ignore: This will ignore any unknown fields that are silently
+	// dropped from the object, and will ignore all but the last duplicate
+	// field that the decoder encounters. This is the default behavior
+	// prior to v1.23.
+	// - Warn: This will send a warning via the standard warning response
+	// header for each unknown field that is dropped from the object, and
+	// for each duplicate field that is encountered. The request will
+	// still succeed if there are no other errors, and will only persist
+	// the last of any duplicate fields. This is the default in v1.23+
+	// - Strict: This will fail the request with a BadRequest error if
+	// any unknown fields would be dropped from the object, or if any
+	// duplicate fields are present. The error returned from the server
+	// will contain all unknown and duplicate fields encountered.
+	// +optional
+	FieldValidation string `json:"fieldValidation,omitempty" protobuf:"bytes,4,name=fieldValidation"`
+}
+
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// PatchOptions may be provided when patching an API object.
+// PatchOptions is meant to be a superset of UpdateOptions.
+type PatchOptions struct {
+	TypeMeta `json:""`
+
+	// When present, indicates that modifications should not be
+	// persisted. An invalid or unrecognized dryRun directive will
+	// result in an error response and no further processing of the
+	// request. Valid values are:
+	// - All: all dry run stages will be processed
+	// +optional
+	// +listType=atomic
+	DryRun []string `json:"dryRun,omitempty" protobuf:"bytes,1,rep,name=dryRun"`
+
+	// Force is going to "force" Apply requests. It means user will
+	// re-acquire conflicting fields owned by other people. Force
+	// flag must be unset for non-apply patch requests.
+	// +optional
+	Force *bool `json:"force,omitempty" protobuf:"varint,2,opt,name=force"`
+
+	// fieldManager is a name associated with the actor or entity
+	// that is making these changes. The value must be less than or
+	// 128 characters long, and only contain printable characters,
+	// as defined by https://golang.org/pkg/unicode/#IsPrint. This
+	// field is required for apply requests
+	// (application/apply-patch) but optional for non-apply patch
+	// types (JsonPatch, MergePatch, StrategicMergePatch).
+	// +optional
+	FieldManager string `json:"fieldManager,omitempty" protobuf:"bytes,3,name=fieldManager"`
+
+	// fieldValidation instructs the server on how to handle
+	// objects in the request (POST/PUT/PATCH) containing unknown
+	// or duplicate fields. Valid values are:
+	// - Ignore: This will ignore any unknown fields that are silently
+	// dropped from the object, and will ignore all but the last duplicate
+	// field that the decoder encounters. This is the default behavior
+	// prior to v1.23.
+	// - Warn: This will send a warning via the standard warning response
+	// header for each unknown field that is dropped from the object, and
+	// for each duplicate field that is encountered. The request will
+	// still succeed if there are no other errors, and will only persist
+	// the last of any duplicate fields. This is the default in v1.23+
+	// - Strict: This will fail the request with a BadRequest error if
+	// any unknown fields would be dropped from the object, or if any
+	// duplicate fields are present. The error returned from the server
+	// will contain all unknown and duplicate fields encountered.
+	// +optional
+	FieldValidation string `json:"fieldValidation,omitempty" protobuf:"bytes,4,name=fieldValidation"`
+}
+
+// ApplyOptions may be provided when applying an API object.
+// FieldManager is required for apply requests.
+// ApplyOptions is equivalent to PatchOptions. It is provided as a convenience with documentation
+// that speaks specifically to how the options fields relate to apply.
+type ApplyOptions struct {
+	TypeMeta `json:""`
+
+	// When present, indicates that modifications should not be
+	// persisted. An invalid or unrecognized dryRun directive will
+	// result in an error response and no further processing of the
+	// request. Valid values are:
+	// - All: all dry run stages will be processed
+	// +optional
+	// +listType=atomic
+	DryRun []string `json:"dryRun,omitempty" protobuf:"bytes,1,rep,name=dryRun"`
+
+	// Force is going to "force" Apply requests. It means user will
+	// re-acquire conflicting fields owned by other people.
+	Force bool `json:"force" protobuf:"varint,2,opt,name=force"`
+
+	// fieldManager is a name associated with the actor or entity
+	// that is making these changes. The value must be less than or
+	// 128 characters long, and only contain printable characters,
+	// as defined by https://golang.org/pkg/unicode/#IsPrint. This
+	// field is required.
+	FieldManager string `json:"fieldManager" protobuf:"bytes,3,name=fieldManager"`
+}
+
+func (o ApplyOptions) ToPatchOptions() PatchOptions {
+	return PatchOptions{DryRun: o.DryRun, Force: &o.Force, FieldManager: o.FieldManager}
+}
+
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// UpdateOptions may be provided when updating an API object.
+// All fields in UpdateOptions should also be present in PatchOptions.
+type UpdateOptions struct {
+	TypeMeta `json:""`
+
+	// When present, indicates that modifications should not be
+	// persisted. An invalid or unrecognized dryRun directive will
+	// result in an error response and no further processing of the
+	// request. Valid values are:
+	// - All: all dry run stages will be processed
+	// +optional
+	// +listType=atomic
+	DryRun []string `json:"dryRun,omitempty" protobuf:"bytes,1,rep,name=dryRun"`
+
+	// fieldManager is a name associated with the actor or entity
+	// that is making these changes. The value must be less than or
+	// 128 characters long, and only contain printable characters,
+	// as defined by https://golang.org/pkg/unicode/#IsPrint.
+	// +optional
+	FieldManager string `json:"fieldManager,omitempty" protobuf:"bytes,2,name=fieldManager"`
+
+	// fieldValidation instructs the server on how to handle
+	// objects in the request (POST/PUT/PATCH) containing unknown
+	// or duplicate fields. Valid values are:
+	// - Ignore: This will ignore any unknown fields that are silently
+	// dropped from the object, and will ignore all but the last duplicate
+	// field that the decoder encounters. This is the default behavior
+	// prior to v1.23.
+	// - Warn: This will send a warning via the standard warning response
+	// header for each unknown field that is dropped from the object, and
+	// for each duplicate field that is encountered. The request will
+	// still succeed if there are no other errors, and will only persist
+	// the last of any duplicate fields. This is the default in v1.23+
+	// - Strict: This will fail the request with a BadRequest error if
+	// any unknown fields would be dropped from the object, or if any
+	// duplicate fields are present. The error returned from the server
+	// will contain all unknown and duplicate fields encountered.
+	// +optional
+	FieldValidation string `json:"fieldValidation,omitempty" protobuf:"bytes,3,name=fieldValidation"`
+}
+
+// Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.
+type Preconditions struct {
+	// Specifies the target UID.
+	// +optional
+	UID *types.UID `json:"uid,omitempty" protobuf:"bytes,1,opt,name=uid,casttype=k8s.io/apimachinery/pkg/types.UID"`
+	// Specifies the target ResourceVersion
+	// +optional
+	ResourceVersion *string `json:"resourceVersion,omitempty" protobuf:"bytes,2,opt,name=resourceVersion"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// Status is a return value for calls that don't return other objects.
+type Status struct {
+	TypeMeta `json:""`
+	// Standard list metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// Status of the operation.
+	// One of: "Success" or "Failure".
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	// +optional
+	Status string `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
+	// A human-readable description of the status of this operation.
+	// +optional
+	Message string `json:"message,omitempty" protobuf:"bytes,3,opt,name=message"`
+	// A machine-readable description of why this operation is in the
+	// "Failure" status. If this value is empty there
+	// is no information available. A Reason clarifies an HTTP status
+	// code but does not override it.
+	// +optional
+	Reason StatusReason `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason,casttype=StatusReason"`
+	// Extended data associated with the reason.  Each reason may define its
+	// own extended details. This field is optional and the data returned
+	// is not guaranteed to conform to any schema except that defined by
+	// the reason type.
+	// +optional
+	Details *StatusDetails `json:"details,omitempty" protobuf:"bytes,5,opt,name=details"`
+	// Suggested HTTP return code for this status, 0 if not set.
+	// +optional
+	Code int32 `json:"code,omitempty" protobuf:"varint,6,opt,name=code"`
+}
+
+// StatusDetails is a set of additional properties that MAY be set by the
+// server to provide additional information about a response. The Reason
+// field of a Status object defines what attributes will be set. Clients
+// must ignore fields that do not match the defined type of each attribute,
+// and should assume that any attribute may be empty, invalid, or under
+// defined.
+type StatusDetails struct {
+	// The name attribute of the resource associated with the status StatusReason
+	// (when there is a single name which can be described).
+	// +optional
+	Name string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name"`
+	// The group attribute of the resource associated with the status StatusReason.
+	// +optional
+	Group string `json:"group,omitempty" protobuf:"bytes,2,opt,name=group"`
+	// The kind attribute of the resource associated with the status StatusReason.
+	// On some operations may differ from the requested resource Kind.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	Kind string `json:"kind,omitempty" protobuf:"bytes,3,opt,name=kind"`
+	// UID of the resource.
+	// (when there is a single resource which can be described).
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+	// +optional
+	UID types.UID `json:"uid,omitempty" protobuf:"bytes,6,opt,name=uid,casttype=k8s.io/apimachinery/pkg/types.UID"`
+	// The Causes array includes more details associated with the StatusReason
+	// failure. Not all StatusReasons may provide detailed causes.
+	// +optional
+	// +listType=atomic
+	Causes []StatusCause `json:"causes,omitempty" protobuf:"bytes,4,rep,name=causes"`
+	// If specified, the time in seconds before the operation should be retried. Some errors may indicate
+	// the client must take an alternate action - for those errors this field may indicate how long to wait
+	// before taking the alternate action.
+	// +optional
+	RetryAfterSeconds int32 `json:"retryAfterSeconds,omitempty" protobuf:"varint,5,opt,name=retryAfterSeconds"`
+}
+
+// Values of Status.Status
+const (
+	StatusSuccess = "Success"
+	StatusFailure = "Failure"
+)
+
+// StatusReason is an enumeration of possible failure causes.  Each StatusReason
+// must map to a single HTTP status code, but multiple reasons may map
+// to the same HTTP status code.
+// TODO: move to apiserver
+type StatusReason string
+
+const (
+	// StatusReasonUnknown means the server has declined to indicate a specific reason.
+	// The details field may contain other information about this error.
+	// Status code 500.
+	StatusReasonUnknown StatusReason = ""
+
+	// StatusReasonUnauthorized means the server can be reached and understood the request, but requires
+	// the user to present appropriate authorization credentials (identified by the WWW-Authenticate header)
+	// in order for the action to be completed. If the user has specified credentials on the request, the
+	// server considers them insufficient.
+	// Status code 401
+	StatusReasonUnauthorized StatusReason = "Unauthorized"
+
+	// StatusReasonForbidden means the server can be reached and understood the request, but refuses
+	// to take any further action.  It is the result of the server being configured to deny access for some reason
+	// to the requested resource by the client.
+	// Details (optional):
+	//   "kind" string - the kind attribute of the forbidden resource
+	//                   on some operations may differ from the requested
+	//                   resource.
+	//   "id"   string - the identifier of the forbidden resource
+	// Status code 403
+	StatusReasonForbidden StatusReason = "Forbidden"
+
+	// StatusReasonNotFound means one or more resources required for this operation
+	// could not be found.
+	// Details (optional):
+	//   "kind" string - the kind attribute of the missing resource
+	//                   on some operations may differ from the requested
+	//                   resource.
+	//   "id"   string - the identifier of the missing resource
+	// Status code 404
+	StatusReasonNotFound StatusReason = "NotFound"
+
+	// StatusReasonAlreadyExists means the resource you are creating already exists.
+	// Details (optional):
+	//   "kind" string - the kind attribute of the conflicting resource
+	//   "id"   string - the identifier of the conflicting resource
+	// Status code 409
+	StatusReasonAlreadyExists StatusReason = "AlreadyExists"
+
+	// StatusReasonConflict means the requested operation cannot be completed
+	// due to a conflict in the operation. The client may need to alter the
+	// request. Each resource may define custom details that indicate the
+	// nature of the conflict.
+	// Status code 409
+	StatusReasonConflict StatusReason = "Conflict"
+
+	// StatusReasonGone means the item is no longer available at the server and no
+	// forwarding address is known.
+	// Status code 410
+	StatusReasonGone StatusReason = "Gone"
+
+	// StatusReasonInvalid means the requested create or update operation cannot be
+	// completed due to invalid data provided as part of the request. The client may
+	// need to alter the request. When set, the client may use the StatusDetails
+	// message field as a summary of the issues encountered.
+	// Details (optional):
+	//   "kind" string - the kind attribute of the invalid resource
+	//   "id"   string - the identifier of the invalid resource
+	//   "causes"      - one or more StatusCause entries indicating the data in the
+	//                   provided resource that was invalid.  The code, message, and
+	//                   field attributes will be set.
+	// Status code 422
+	StatusReasonInvalid StatusReason = "Invalid"
+
+	// StatusReasonServerTimeout means the server can be reached and understood the request,
+	// but cannot complete the action in a reasonable time. The client should retry the request.
+	// This is may be due to temporary server load or a transient communication issue with
+	// another server. Status code 500 is used because the HTTP spec provides no suitable
+	// server-requested client retry and the 5xx class represents actionable errors.
+	// Details (optional):
+	//   "kind" string - the kind attribute of the resource being acted on.
+	//   "id"   string - the operation that is being attempted.
+	//   "retryAfterSeconds" int32 - the number of seconds before the operation should be retried
+	// Status code 500
+	StatusReasonServerTimeout StatusReason = "ServerTimeout"
+
+	// StatusReasonStoreReadError means that the server encountered an error while
+	// retrieving resources from the backend object store.
+	// This may be due to backend database error, or because processing of the read
+	// resource failed.
+	// Details:
+	//   "kind" string - the kind attribute of the resource being acted on.
+	//   "name" string - the prefix where the reading error(s) occurred
+	//   "causes" []StatusCause
+	//      - (optional):
+	//        - "type" CauseType - CauseTypeUnexpectedServerResponse
+	//        - "message" string - the error message from the store backend
+	//        - "field" string - the full path with the key of the resource that failed reading
+	//
+	// Status code 500
+	StatusReasonStoreReadError StatusReason = "StorageReadError"
+
+	// StatusReasonTimeout means that the request could not be completed within the given time.
+	// Clients can get this response only when they specified a timeout param in the request,
+	// or if the server cannot complete the operation within a reasonable amount of time.
+	// The request might succeed with an increased value of timeout param. The client *should*
+	// wait at least the number of seconds specified by the retryAfterSeconds field.
+	// Details (optional):
+	//   "retryAfterSeconds" int32 - the number of seconds before the operation should be retried
+	// Status code 504
+	StatusReasonTimeout StatusReason = "Timeout"
+
+	// StatusReasonTooManyRequests means the server experienced too many requests within a
+	// given window and that the client must wait to perform the action again. A client may
+	// always retry the request that led to this error, although the client should wait at least
+	// the number of seconds specified by the retryAfterSeconds field.
+	// Details (optional):
+	//   "retryAfterSeconds" int32 - the number of seconds before the operation should be retried
+	// Status code 429
+	StatusReasonTooManyRequests StatusReason = "TooManyRequests"
+
+	// StatusReasonBadRequest means that the request itself was invalid, because the request
+	// doesn't make any sense, for example deleting a read-only object.  This is different than
+	// StatusReasonInvalid above which indicates that the API call could possibly succeed, but the
+	// data was invalid.  API calls that return BadRequest can never succeed.
+	// Status code 400
+	StatusReasonBadRequest StatusReason = "BadRequest"
+
+	// StatusReasonMethodNotAllowed means that the action the client attempted to perform on the
+	// resource was not supported by the code - for instance, attempting to delete a resource that
+	// can only be created. API calls that return MethodNotAllowed can never succeed.
+	// Status code 405
+	StatusReasonMethodNotAllowed StatusReason = "MethodNotAllowed"
+
+	// StatusReasonNotAcceptable means that the accept types indicated by the client were not acceptable
+	// to the server - for instance, attempting to receive protobuf for a resource that supports only json and yaml.
+	// API calls that return NotAcceptable can never succeed.
+	// Status code 406
+	StatusReasonNotAcceptable StatusReason = "NotAcceptable"
+
+	// StatusReasonRequestEntityTooLarge means that the request entity is too large.
+	// Status code 413
+	StatusReasonRequestEntityTooLarge StatusReason = "RequestEntityTooLarge"
+
+	// StatusReasonUnsupportedMediaType means that the content type sent by the client is not acceptable
+	// to the server - for instance, attempting to send protobuf for a resource that supports only json and yaml.
+	// API calls that return UnsupportedMediaType can never succeed.
+	// Status code 415
+	StatusReasonUnsupportedMediaType StatusReason = "UnsupportedMediaType"
+
+	// StatusReasonInternalError indicates that an internal error occurred, it is unexpected
+	// and the outcome of the call is unknown.
+	// Details (optional):
+	//   "causes" - The original error
+	// Status code 500
+	StatusReasonInternalError StatusReason = "InternalError"
+
+	// StatusReasonExpired indicates that the request is invalid because the content you are requesting
+	// has expired and is no longer available. It is typically associated with watches that can't be
+	// serviced.
+	// Status code 410 (gone)
+	StatusReasonExpired StatusReason = "Expired"
+
+	// StatusReasonServiceUnavailable means that the request itself was valid,
+	// but the requested service is unavailable at this time.
+	// Retrying the request after some time might succeed.
+	// Status code 503
+	StatusReasonServiceUnavailable StatusReason = "ServiceUnavailable"
+)
+
+// StatusCause provides more information about an api.Status failure, including
+// cases when multiple errors are encountered.
+type StatusCause struct {
+	// A machine-readable description of the cause of the error. If this value is
+	// empty there is no information available.
+	// +optional
+	Type CauseType `json:"reason,omitempty" protobuf:"bytes,1,opt,name=reason,casttype=CauseType"`
+	// A human-readable description of the cause of the error.  This field may be
+	// presented as-is to a reader.
+	// +optional
+	Message string `json:"message,omitempty" protobuf:"bytes,2,opt,name=message"`
+	// The field of the resource that has caused this error, as named by its JSON
+	// serialization. May include dot and postfix notation for nested attributes.
+	// Arrays are zero-indexed.  Fields may appear more than once in an array of
+	// causes due to fields having multiple errors.
+	// Optional.
+	//
+	// Examples:
+	//   "name" - the field "name" on the current resource
+	//   "items[0].name" - the field "name" on the first array entry in "items"
+	// +optional
+	Field string `json:"field,omitempty" protobuf:"bytes,3,opt,name=field"`
+}
+
+// CauseType is a machine readable value providing more detail about what
+// occurred in a status response. An operation may have multiple causes for a
+// status (whether Failure or Success).
+type CauseType string
+
+const (
+	// CauseTypeFieldValueNotFound is used to report failure to find a requested value
+	// (e.g. looking up an ID).
+	CauseTypeFieldValueNotFound CauseType = "FieldValueNotFound"
+	// CauseTypeFieldValueRequired is used to report required values that are not
+	// provided (e.g. empty strings, null values, or empty arrays).
+	CauseTypeFieldValueRequired CauseType = "FieldValueRequired"
+	// CauseTypeFieldValueDuplicate is used to report collisions of values that must be
+	// unique (e.g. unique IDs).
+	CauseTypeFieldValueDuplicate CauseType = "FieldValueDuplicate"
+	// CauseTypeFieldValueInvalid is used to report malformed values (e.g. failed regex
+	// match).
+	CauseTypeFieldValueInvalid CauseType = "FieldValueInvalid"
+	// CauseTypeFieldValueNotSupported is used to report valid (as per formatting rules)
+	// values that can not be handled (e.g. an enumerated string).
+	CauseTypeFieldValueNotSupported CauseType = "FieldValueNotSupported"
+	// CauseTypeForbidden is used to report valid (as per formatting rules)
+	// values which would be accepted under some conditions, but which are not
+	// permitted by the current conditions (such as security policy).  See
+	// Forbidden().
+	CauseTypeForbidden CauseType = "FieldValueForbidden"
+	// CauseTypeTooLong is used to report that the given value is too long.
+	// This is similar to ErrorTypeInvalid, but the error will not include the
+	// too-long value.  See TooLong().
+	CauseTypeTooLong CauseType = "FieldValueTooLong"
+	// CauseTypeTooMany is used to report "too many". This is used to
+	// report that a given list has too many items. This is similar to FieldValueTooLong,
+	// but the error indicates quantity instead of length.
+	CauseTypeTooMany CauseType = "FieldValueTooMany"
+	// CauseTypeInternal is used to report other errors that are not related
+	// to user input.  See InternalError().
+	CauseTypeInternal CauseType = "InternalError"
+	// CauseTypeTypeInvalid is for the value did not match the schema type for that field
+	CauseTypeTypeInvalid CauseType = "FieldValueTypeInvalid"
+	// CauseTypeUnexpectedServerResponse is used to report when the server responded to the client
+	// without the expected return type. The presence of this cause indicates the error may be
+	// due to an intervening proxy or the server software malfunctioning.
+	CauseTypeUnexpectedServerResponse CauseType = "UnexpectedServerResponse"
+	// FieldManagerConflict is used to report when another client claims to manage this field,
+	// It should only be returned for a request using server-side apply.
+	CauseTypeFieldManagerConflict CauseType = "FieldManagerConflict"
+	// CauseTypeResourceVersionTooLarge is used to report that the requested resource version
+	// is newer than the data observed by the API server, so the request cannot be served.
+	CauseTypeResourceVersionTooLarge CauseType = "ResourceVersionTooLarge"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// List holds a list of objects, which may not be known by the server.
+type List struct {
+	TypeMeta `json:""`
+	// Standard list metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// List of objects
+	Items []runtime.RawExtension `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+// APIVersions lists the versions that are available, to allow clients to
+// discover the API at /api, which is the root path of the legacy v1 API.
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type APIVersions struct {
+	TypeMeta `json:""`
+	// versions are the api versions that are available.
+	// +listType=atomic
+	Versions []string `json:"versions" protobuf:"bytes,1,rep,name=versions"`
+	// a map of client CIDR to server address that is serving this group.
+	// This is to help clients reach servers in the most network-efficient way possible.
+	// Clients can use the appropriate server address as per the CIDR that they match.
+	// In case of multiple matches, clients should use the longest matching CIDR.
+	// The server returns only those CIDRs that it thinks that the client can match.
+	// For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP.
+	// Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.
+	// +listType=atomic
+	ServerAddressByClientCIDRs []ServerAddressByClientCIDR `json:"serverAddressByClientCIDRs" protobuf:"bytes,2,rep,name=serverAddressByClientCIDRs"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// APIGroupList is a list of APIGroup, to allow clients to discover the API at
+// /apis.
+type APIGroupList struct {
+	TypeMeta `json:""`
+	// groups is a list of APIGroup.
+	// +listType=atomic
+	Groups []APIGroup `json:"groups" protobuf:"bytes,1,rep,name=groups"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// APIGroup contains the name, the supported versions, and the preferred version
+// of a group.
+type APIGroup struct {
+	TypeMeta `json:""`
+	// name is the name of the group.
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+	// versions are the versions supported in this group.
+	// +listType=atomic
+	Versions []GroupVersionForDiscovery `json:"versions" protobuf:"bytes,2,rep,name=versions"`
+	// preferredVersion is the version preferred by the API server, which
+	// probably is the storage version.
+	// +optional
+	PreferredVersion GroupVersionForDiscovery `json:"preferredVersion,omitempty" protobuf:"bytes,3,opt,name=preferredVersion"`
+	// a map of client CIDR to server address that is serving this group.
+	// This is to help clients reach servers in the most network-efficient way possible.
+	// Clients can use the appropriate server address as per the CIDR that they match.
+	// In case of multiple matches, clients should use the longest matching CIDR.
+	// The server returns only those CIDRs that it thinks that the client can match.
+	// For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP.
+	// Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.
+	// +optional
+	// +listType=atomic
+	ServerAddressByClientCIDRs []ServerAddressByClientCIDR `json:"serverAddressByClientCIDRs,omitempty" protobuf:"bytes,4,rep,name=serverAddressByClientCIDRs"`
+}
+
+// ServerAddressByClientCIDR helps the client to determine the server address that they should use, depending on the clientCIDR that they match.
+type ServerAddressByClientCIDR struct {
+	// The CIDR with which clients can match their IP to figure out the server address that they should use.
+	ClientCIDR string `json:"clientCIDR" protobuf:"bytes,1,opt,name=clientCIDR"`
+	// Address of this server, suitable for a client that matches the above CIDR.
+	// This can be a hostname, hostname:port, IP or IP:port.
+	ServerAddress string `json:"serverAddress" protobuf:"bytes,2,opt,name=serverAddress"`
+}
+
+// GroupVersion contains the "group/version" and "version" string of a version.
+// It is made a struct to keep extensibility.
+type GroupVersionForDiscovery struct {
+	// groupVersion specifies the API group and version in the form "group/version"
+	GroupVersion string `json:"groupVersion" protobuf:"bytes,1,opt,name=groupVersion"`
+	// version specifies the version in the form of "version". This is to save
+	// the clients the trouble of splitting the GroupVersion.
+	Version string `json:"version" protobuf:"bytes,2,opt,name=version"`
+}
+
+// APIResource specifies the name of a resource and whether it is namespaced.
+type APIResource struct {
+	// name is the plural name of the resource.
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+	// singularName is the singular name of the resource.  This allows clients to handle plural and singular opaquely.
+	// The singularName is more correct for reporting status on a single item and both singular and plural are allowed
+	// from the kubectl CLI interface.
+	SingularName string `json:"singularName" protobuf:"bytes,6,opt,name=singularName"`
+	// namespaced indicates if a resource is namespaced or not.
+	Namespaced bool `json:"namespaced" protobuf:"varint,2,opt,name=namespaced"`
+	// group is the preferred group of the resource.  Empty implies the group of the containing resource list.
+	// For subresources, this may have a different value, for example: Scale".
+	Group string `json:"group,omitempty" protobuf:"bytes,8,opt,name=group"`
+	// version is the preferred version of the resource.  Empty implies the version of the containing resource list
+	// For subresources, this may have a different value, for example: v1 (while inside a v1beta1 version of the core resource's group)".
+	Version string `json:"version,omitempty" protobuf:"bytes,9,opt,name=version"`
+	// kind is the kind for the resource (e.g. 'Foo' is the kind for a resource 'foo')
+	Kind string `json:"kind" protobuf:"bytes,3,opt,name=kind"`
+	// verbs is a list of supported kube verbs (this includes get, list, watch, create,
+	// update, patch, delete, deletecollection, and proxy)
+	Verbs Verbs `json:"verbs" protobuf:"bytes,4,opt,name=verbs"`
+	// shortNames is a list of suggested short names of the resource.
+	// +listType=atomic
+	ShortNames []string `json:"shortNames,omitempty" protobuf:"bytes,5,rep,name=shortNames"`
+	// categories is a list of the grouped resources this resource belongs to (e.g. 'all')
+	// +listType=atomic
+	Categories []string `json:"categories,omitempty" protobuf:"bytes,7,rep,name=categories"`
+	// The hash value of the storage version, the version this resource is
+	// converted to when written to the data store. Value must be treated
+	// as opaque by clients. Only equality comparison on the value is valid.
+	// This is an alpha feature and may change or be removed in the future.
+	// The field is populated by the apiserver only if the
+	// StorageVersionHash feature gate is enabled.
+	// This field will remain optional even if it graduates.
+	// +optional
+	StorageVersionHash string `json:"storageVersionHash,omitempty" protobuf:"bytes,10,opt,name=storageVersionHash"`
+}
+
+// Verbs masks the value so protobuf can generate
+//
+// +protobuf.nullable=true
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type Verbs []string
+
+func (vs Verbs) String() string {
+	return fmt.Sprintf("%v", []string(vs))
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// APIResourceList is a list of APIResource, it is used to expose the name of the
+// resources supported in a specific group and version, and if the resource
+// is namespaced.
+type APIResourceList struct {
+	TypeMeta `json:""`
+	// groupVersion is the group and version this APIResourceList is for.
+	GroupVersion string `json:"groupVersion" protobuf:"bytes,1,opt,name=groupVersion"`
+	// resources contains the name of the resources and if they are namespaced.
+	// +listType=atomic
+	APIResources []APIResource `json:"resources" protobuf:"bytes,2,rep,name=resources"`
+}
+
+// RootPaths lists the paths available at root.
+// For example: "/healthz", "/apis".
+type RootPaths struct {
+	// paths are the paths available at root.
+	// +listType=atomic
+	Paths []string `json:"paths" protobuf:"bytes,1,rep,name=paths"`
+}
+
+// TODO: remove me when watch is refactored
+func LabelSelectorQueryParam(version string) string {
+	return "labelSelector"
+}
+
+// TODO: remove me when watch is refactored
+func FieldSelectorQueryParam(version string) string {
+	return "fieldSelector"
+}
+
+// String returns available api versions as a human-friendly version string.
+func (apiVersions APIVersions) String() string {
+	return strings.Join(apiVersions.Versions, ",")
+}
+
+func (apiVersions APIVersions) GoString() string {
+	return apiVersions.String()
+}
+
+// Patch is provided to give a concrete name and type to the Kubernetes PATCH request body.
+type Patch struct{}
+
+// Note:
+// There are two different styles of label selectors used in versioned types:
+// an older style which is represented as just a string in versioned types, and a
+// newer style that is structured.  LabelSelector is an internal representation for the
+// latter style.
+
+// A label selector is a label query over a set of resources. The result of matchLabels and
+// matchExpressions are ANDed. An empty label selector matches all objects. A null
+// label selector matches no objects.
+// +structType=atomic
+type LabelSelector struct {
+	// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+	// map is equivalent to an element of matchExpressions, whose key field is "key", the
+	// operator is "In", and the values array contains only "value". The requirements are ANDed.
+	// +optional
+	MatchLabels map[string]string `json:"matchLabels,omitempty" protobuf:"bytes,1,rep,name=matchLabels"`
+	// matchExpressions is a list of label selector requirements. The requirements are ANDed.
+	// +optional
+	// +listType=atomic
+	MatchExpressions []LabelSelectorRequirement `json:"matchExpressions,omitempty" protobuf:"bytes,2,rep,name=matchExpressions"`
+}
+
+// A label selector requirement is a selector that contains values, a key, and an operator that
+// relates the key and values.
+type LabelSelectorRequirement struct {
+	// key is the label key that the selector applies to.
+	Key string `json:"key" protobuf:"bytes,1,opt,name=key"`
+	// operator represents a key's relationship to a set of values.
+	// Valid operators are In, NotIn, Exists and DoesNotExist.
+	Operator LabelSelectorOperator `json:"operator" protobuf:"bytes,2,opt,name=operator,casttype=LabelSelectorOperator"`
+	// values is an array of string values. If the operator is In or NotIn,
+	// the values array must be non-empty. If the operator is Exists or DoesNotExist,
+	// the values array must be empty. This array is replaced during a strategic
+	// merge patch.
+	// +optional
+	// +listType=atomic
+	Values []string `json:"values,omitempty" protobuf:"bytes,3,rep,name=values"`
+}
+
+// A label selector operator is the set of operators that can be used in a selector requirement.
+type LabelSelectorOperator string
+
+const (
+	LabelSelectorOpIn           LabelSelectorOperator = "In"
+	LabelSelectorOpNotIn        LabelSelectorOperator = "NotIn"
+	LabelSelectorOpExists       LabelSelectorOperator = "Exists"
+	LabelSelectorOpDoesNotExist LabelSelectorOperator = "DoesNotExist"
+)
+
+// FieldSelectorRequirement is a selector that contains values, a key, and an operator that
+// relates the key and values.
+type FieldSelectorRequirement struct {
+	// key is the field selector key that the requirement applies to.
+	Key string `json:"key" protobuf:"bytes,1,opt,name=key"`
+	// operator represents a key's relationship to a set of values.
+	// Valid operators are In, NotIn, Exists, DoesNotExist.
+	// The list of operators may grow in the future.
+	Operator FieldSelectorOperator `json:"operator" protobuf:"bytes,2,opt,name=operator,casttype=FieldSelectorOperator"`
+	// values is an array of string values.
+	// If the operator is In or NotIn, the values array must be non-empty.
+	// If the operator is Exists or DoesNotExist, the values array must be empty.
+	// +optional
+	// +listType=atomic
+	Values []string `json:"values,omitempty" protobuf:"bytes,3,rep,name=values"`
+}
+
+// A field selector operator is the set of operators that can be used in a selector requirement.
+type FieldSelectorOperator string
+
+const (
+	FieldSelectorOpIn           FieldSelectorOperator = "In"
+	FieldSelectorOpNotIn        FieldSelectorOperator = "NotIn"
+	FieldSelectorOpExists       FieldSelectorOperator = "Exists"
+	FieldSelectorOpDoesNotExist FieldSelectorOperator = "DoesNotExist"
+)
+
+// ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource
+// that the fieldset applies to.
+type ManagedFieldsEntry struct {
+	// Manager is an identifier of the workflow managing these fields.
+	Manager string `json:"manager,omitempty" protobuf:"bytes,1,opt,name=manager"`
+	// Operation is the type of operation which lead to this ManagedFieldsEntry being created.
+	// The only valid values for this field are 'Apply' and 'Update'.
+	// +k8s:alpha(since: "1.37")=+k8s:required
+	Operation ManagedFieldsOperationType `json:"operation,omitempty" protobuf:"bytes,2,opt,name=operation,casttype=ManagedFieldsOperationType"`
+	// APIVersion defines the version of this resource that this field set
+	// applies to. The format is "group/version" just like the top-level
+	// APIVersion field. It is necessary to track the version of a field
+	// set because it cannot be automatically converted.
+	APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,3,opt,name=apiVersion"`
+	// Time is the timestamp of when the ManagedFields entry was added. The
+	// timestamp will also be updated if a field is added, the manager
+	// changes any of the owned fields value or removes a field. The
+	// timestamp does not update when a field is removed from the entry
+	// because another manager took it over.
+	// +optional
+	Time *Time `json:"time,omitempty" protobuf:"bytes,4,opt,name=time"`
+
+	// Fields is tombstoned to show why 5 is a reserved protobuf tag.
+	//Fields *Fields `json:"fields,omitempty" protobuf:"bytes,5,opt,name=fields,casttype=Fields"`
+
+	// FieldsType is the discriminator for the different fields format and version.
+	// There is currently only one possible value: "FieldsV1"
+	FieldsType string `json:"fieldsType,omitempty" protobuf:"bytes,6,opt,name=fieldsType"`
+	// FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
+	// +optional
+	FieldsV1 *FieldsV1 `json:"fieldsV1,omitempty" protobuf:"bytes,7,opt,name=fieldsV1"`
+
+	// Subresource is the name of the subresource used to update that object, or
+	// empty string if the object was updated through the main resource. The
+	// value of this field is used to distinguish between managers, even if they
+	// share the same name. For example, a status update will be distinct from a
+	// regular update using the same manager name.
+	// Note that the APIVersion field is not related to the Subresource field and
+	// it always corresponds to the version of the main resource.
+	Subresource string `json:"subresource,omitempty" protobuf:"bytes,8,opt,name=subresource"`
+}
+
+// ManagedFieldsOperationType is the type of operation which lead to a ManagedFieldsEntry being created.
+// +k8s:alpha(since: "1.37")=+k8s:enum
+type ManagedFieldsOperationType string
+
+const (
+	ManagedFieldsOperationApply  ManagedFieldsOperationType = "Apply"
+	ManagedFieldsOperationUpdate ManagedFieldsOperationType = "Update"
+)
+
+// TODO: Table does not generate to protobuf because of the interface{} - fix protobuf
+//   generation to support a meta type that can accept any valid JSON. This can be introduced
+//   in a v1 because clients a) receive an error if they try to access proto today, and b)
+//   once introduced they would be able to gracefully switch over to using it.
+
+// Table is a tabular representation of a set of API resources. The server transforms the
+// object into a set of preferred columns for quickly reviewing the objects.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +protobuf=false
+type Table struct {
+	TypeMeta `json:""`
+	// Standard list metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	ListMeta `json:"metadata,omitempty"`
+
+	// columnDefinitions describes each column in the returned items array. The number of cells per row
+	// will always match the number of column definitions.
+	// +listType=atomic
+	ColumnDefinitions []TableColumnDefinition `json:"columnDefinitions"`
+	// rows is the list of items in the table.
+	// +listType=atomic
+	Rows []TableRow `json:"rows"`
+}
+
+// TableColumnDefinition contains information about a column returned in the Table.
+// +protobuf=false
+type TableColumnDefinition struct {
+	// name is a human readable name for the column.
+	Name string `json:"name"`
+	// type is an OpenAPI type definition for this column, such as number, integer, string, or
+	// array.
+	// See https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#data-types for more.
+	Type string `json:"type"`
+	// format is an optional OpenAPI type modifier for this column. A format modifies the type and
+	// imposes additional rules, like date or time formatting for a string. The 'name' format is applied
+	// to the primary identifier column which has type 'string' to assist in clients identifying column
+	// is the resource name.
+	// See https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#data-types for more.
+	Format string `json:"format"`
+	// description is a human readable description of this column.
+	Description string `json:"description"`
+	// priority is an integer defining the relative importance of this column compared to others. Lower
+	// numbers are considered higher priority. Columns that may be omitted in limited space scenarios
+	// should be given a higher priority.
+	Priority int32 `json:"priority"`
+}
+
+// TableRow is an individual row in a table.
+// +protobuf=false
+type TableRow struct {
+	// cells will be as wide as the column definitions array and may contain strings, numbers (float64 or
+	// int64), booleans, simple maps, lists, or null. See the type field of the column definition for a
+	// more detailed description.
+	// +listType=atomic
+	Cells []interface{} `json:"cells"`
+	// conditions describe additional status of a row that are relevant for a human user. These conditions
+	// apply to the row, not to the object, and will be specific to table output. The only defined
+	// condition type is 'Completed', for a row that indicates a resource that has run to completion and
+	// can be given less visual priority.
+	// +optional
+	// +listType=atomic
+	Conditions []TableRowCondition `json:"conditions,omitempty"`
+	// This field contains the requested additional information about each object based on the includeObject
+	// policy when requesting the Table. If "None", this field is empty, if "Object" this will be the
+	// default serialization of the object for the current API version, and if "Metadata" (the default) will
+	// contain the object metadata. Check the returned kind and apiVersion of the object before parsing.
+	// The media type of the object will always match the enclosing list - if this as a JSON table, these
+	// will be JSON encoded objects.
+	// +optional
+	Object runtime.RawExtension `json:"object,omitempty"`
+}
+
+// TableRowCondition allows a row to be marked with additional information.
+// +protobuf=false
+type TableRowCondition struct {
+	// Type of row condition. The only defined value is 'Completed' indicating that the
+	// object this row represents has reached a completed state and may be given less visual
+	// priority than other rows. Clients are not required to honor any conditions but should
+	// be consistent where possible about handling the conditions.
+	Type RowConditionType `json:"type"`
+	// Status of the condition, one of True, False, Unknown.
+	Status ConditionStatus `json:"status"`
+	// (brief) machine readable reason for the condition's last transition.
+	// +optional
+	Reason string `json:"reason,omitempty"`
+	// Human readable message indicating details about last transition.
+	// +optional
+	Message string `json:"message,omitempty"`
+}
+
+type RowConditionType string
+
+// These are valid conditions of a row. This list is not exhaustive and new conditions may be
+// included by other resources.
+const (
+	// RowCompleted means the underlying resource has reached completion and may be given less
+	// visual priority than other resources.
+	RowCompleted RowConditionType = "Completed"
+)
+
+// +k8s:alpha(since: "1.37")=+k8s:enum
+type ConditionStatus string
+
+// These are valid condition statuses. "ConditionTrue" means a resource is in the condition.
+// "ConditionFalse" means a resource is not in the condition. "ConditionUnknown" means kubernetes
+// can't decide if a resource is in the condition or not. In the future, we could add other
+// intermediate conditions, e.g. ConditionDegraded.
+const (
+	ConditionTrue    ConditionStatus = "True"
+	ConditionFalse   ConditionStatus = "False"
+	ConditionUnknown ConditionStatus = "Unknown"
+)
+
+// IncludeObjectPolicy controls which portion of the object is returned with a Table.
+type IncludeObjectPolicy string
+
+const (
+	// IncludeNone returns no object.
+	IncludeNone IncludeObjectPolicy = "None"
+	// IncludeMetadata serializes the object containing only its metadata field.
+	IncludeMetadata IncludeObjectPolicy = "Metadata"
+	// IncludeObject contains the full object.
+	IncludeObject IncludeObjectPolicy = "Object"
+)
+
+// TableOptions are used when a Table is requested by the caller.
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type TableOptions struct {
+	TypeMeta `json:""`
+
+	// NoHeaders is only exposed for internal callers. It is not included in our OpenAPI definitions
+	// and may be removed as a field in a future release.
+	NoHeaders bool `json:"-"`
+
+	// includeObject decides whether to include each object along with its columnar information.
+	// Specifying "None" will return no object, specifying "Object" will return the full object contents, and
+	// specifying "Metadata" (the default) will return the object's metadata in the PartialObjectMetadata kind
+	// in version v1beta1 of the meta.k8s.io API group.
+	IncludeObject IncludeObjectPolicy `json:"includeObject,omitempty" protobuf:"bytes,1,opt,name=includeObject,casttype=IncludeObjectPolicy"`
+}
+
+// PartialObjectMetadata is a generic representation of any object with ObjectMeta. It allows clients
+// to get access to a particular ObjectMeta schema without knowing the details of the version.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type PartialObjectMetadata struct {
+	TypeMeta `json:""`
+	// Standard object's metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	// +optional
+	// +k8s:opaqueType
+	ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+}
+
+// PartialObjectMetadataList contains a list of objects containing only their metadata
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type PartialObjectMetadataList struct {
+	TypeMeta `json:""`
+	// Standard list metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// items contains each of the included items.
+	Items []PartialObjectMetadata `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+// Condition contains details for one aspect of the current state of this API Resource.
+// ---
+// This struct is intended for direct use as an array at the field path .status.conditions.  For example,
+//
+//	type FooStatus struct{
+//	    // Represents the observations of a foo's current state.
+//	    // Known .status.conditions.type are: "Available", "Progressing", and "Degraded"
+//	    // +patchMergeKey=type
+//	    // +patchStrategy=merge
+//	    // +listType=map
+//	    // +listMapKey=type
+//	    // +k8s:alpha(since: "1.37")=+k8s:optional
+//	    // +k8s:alpha(since: "1.37")=+k8s:listType=map
+//	    // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+//	    Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
+//
+//	    // other fields
+//	}
+type Condition struct {
+	// type of condition in CamelCase or in foo.example.com/CamelCase.
+	// ---
+	// Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
+	// useful (see .node.status.conditions), the ability to deconflict is important.
+	// The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$`
+	// +kubebuilder:validation:MaxLength=316
+	// +k8s:alpha(since: "1.37")=+k8s:required
+	Type string `json:"type" protobuf:"bytes,1,opt,name=type"`
+	// status of the condition, one of True, False, Unknown.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Enum=True;False;Unknown
+	// +k8s:alpha(since: "1.37")=+k8s:required
+	Status ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status"`
+	// observedGeneration represents the .metadata.generation that the condition was set based upon.
+	// For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+	// with respect to the current state of the instance.
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:minimum=0
+	ObservedGeneration int64 `json:"observedGeneration,omitempty" protobuf:"varint,3,opt,name=observedGeneration"`
+	// lastTransitionTime is the last time the condition transitioned from one status to another.
+	// This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Type=string
+	// +kubebuilder:validation:Format=date-time
+	// +k8s:alpha(since: "1.37")=+k8s:customValidation
+	LastTransitionTime Time `json:"lastTransitionTime" protobuf:"bytes,4,opt,name=lastTransitionTime"`
+	// reason contains a programmatic identifier indicating the reason for the condition's last transition.
+	// Producers of specific condition types may define expected values and meanings for this field,
+	// and whether the values are considered a guaranteed API.
+	// The value should be a CamelCase string.
+	// This field may not be empty.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MaxLength=1024
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:Pattern=`^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$`
+	// +k8s:alpha(since: "1.37")=+k8s:required
+	// +k8s:alpha(since: "1.37")=+k8s:maxBytes=1024
+	Reason string `json:"reason" protobuf:"bytes,5,opt,name=reason"`
+	// message is a human readable message indicating details about the transition.
+	// This may be an empty string.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MaxLength=32768
+	Message string `json:"message" protobuf:"bytes,6,opt,name=message"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types_swagger_doc_generated.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types_swagger_doc_generated.go
new file mode 100644
index 0000000000..c45c00f1aa
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types_swagger_doc_generated.go
@@ -0,0 +1,477 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+// This file contains a collection of methods that can be used from go-restful to
+// generate Swagger API documentation for its models. Please read this PR for more
+// information on the implementation: https://github.com/emicklei/go-restful/pull/215
+//
+// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if
+// they are on one line! For multiple line or blocks that you want to ignore use ---.
+// Any context after a --- is ignored.
+//
+// Those methods can be generated by using hack/update-codegen.sh
+
+// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
+var map_APIGroup = map[string]string{
+	"":                           "APIGroup contains the name, the supported versions, and the preferred version of a group.",
+	"name":                       "name is the name of the group.",
+	"versions":                   "versions are the versions supported in this group.",
+	"preferredVersion":           "preferredVersion is the version preferred by the API server, which probably is the storage version.",
+	"serverAddressByClientCIDRs": "a map of client CIDR to server address that is serving this group. This is to help clients reach servers in the most network-efficient way possible. Clients can use the appropriate server address as per the CIDR that they match. In case of multiple matches, clients should use the longest matching CIDR. The server returns only those CIDRs that it thinks that the client can match. For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP. Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.",
+}
+
+func (APIGroup) SwaggerDoc() map[string]string {
+	return map_APIGroup
+}
+
+var map_APIGroupList = map[string]string{
+	"":       "APIGroupList is a list of APIGroup, to allow clients to discover the API at /apis.",
+	"groups": "groups is a list of APIGroup.",
+}
+
+func (APIGroupList) SwaggerDoc() map[string]string {
+	return map_APIGroupList
+}
+
+var map_APIResource = map[string]string{
+	"":                   "APIResource specifies the name of a resource and whether it is namespaced.",
+	"name":               "name is the plural name of the resource.",
+	"singularName":       "singularName is the singular name of the resource.  This allows clients to handle plural and singular opaquely. The singularName is more correct for reporting status on a single item and both singular and plural are allowed from the kubectl CLI interface.",
+	"namespaced":         "namespaced indicates if a resource is namespaced or not.",
+	"group":              "group is the preferred group of the resource.  Empty implies the group of the containing resource list. For subresources, this may have a different value, for example: Scale\".",
+	"version":            "version is the preferred version of the resource.  Empty implies the version of the containing resource list For subresources, this may have a different value, for example: v1 (while inside a v1beta1 version of the core resource's group)\".",
+	"kind":               "kind is the kind for the resource (e.g. 'Foo' is the kind for a resource 'foo')",
+	"verbs":              "verbs is a list of supported kube verbs (this includes get, list, watch, create, update, patch, delete, deletecollection, and proxy)",
+	"shortNames":         "shortNames is a list of suggested short names of the resource.",
+	"categories":         "categories is a list of the grouped resources this resource belongs to (e.g. 'all')",
+	"storageVersionHash": "The hash value of the storage version, the version this resource is converted to when written to the data store. Value must be treated as opaque by clients. Only equality comparison on the value is valid. This is an alpha feature and may change or be removed in the future. The field is populated by the apiserver only if the StorageVersionHash feature gate is enabled. This field will remain optional even if it graduates.",
+}
+
+func (APIResource) SwaggerDoc() map[string]string {
+	return map_APIResource
+}
+
+var map_APIResourceList = map[string]string{
+	"":             "APIResourceList is a list of APIResource, it is used to expose the name of the resources supported in a specific group and version, and if the resource is namespaced.",
+	"groupVersion": "groupVersion is the group and version this APIResourceList is for.",
+	"resources":    "resources contains the name of the resources and if they are namespaced.",
+}
+
+func (APIResourceList) SwaggerDoc() map[string]string {
+	return map_APIResourceList
+}
+
+var map_APIVersions = map[string]string{
+	"":                           "APIVersions lists the versions that are available, to allow clients to discover the API at /api, which is the root path of the legacy v1 API.",
+	"versions":                   "versions are the api versions that are available.",
+	"serverAddressByClientCIDRs": "a map of client CIDR to server address that is serving this group. This is to help clients reach servers in the most network-efficient way possible. Clients can use the appropriate server address as per the CIDR that they match. In case of multiple matches, clients should use the longest matching CIDR. The server returns only those CIDRs that it thinks that the client can match. For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP. Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.",
+}
+
+func (APIVersions) SwaggerDoc() map[string]string {
+	return map_APIVersions
+}
+
+var map_ApplyOptions = map[string]string{
+	"":             "ApplyOptions may be provided when applying an API object. FieldManager is required for apply requests. ApplyOptions is equivalent to PatchOptions. It is provided as a convenience with documentation that speaks specifically to how the options fields relate to apply.",
+	"dryRun":       "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+	"force":        "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people.",
+	"fieldManager": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required.",
+}
+
+func (ApplyOptions) SwaggerDoc() map[string]string {
+	return map_ApplyOptions
+}
+
+var map_Condition = map[string]string{
+	"":                   "Condition contains details for one aspect of the current state of this API Resource.",
+	"type":               "type of condition in CamelCase or in foo.example.com/CamelCase.",
+	"status":             "status of the condition, one of True, False, Unknown.",
+	"observedGeneration": "observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.",
+	"lastTransitionTime": "lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+	"reason":             "reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.",
+	"message":            "message is a human readable message indicating details about the transition. This may be an empty string.",
+}
+
+func (Condition) SwaggerDoc() map[string]string {
+	return map_Condition
+}
+
+var map_CreateOptions = map[string]string{
+	"":                "CreateOptions may be provided when creating an API object.",
+	"dryRun":          "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+	"fieldManager":    "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.",
+	"fieldValidation": "fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.",
+}
+
+func (CreateOptions) SwaggerDoc() map[string]string {
+	return map_CreateOptions
+}
+
+var map_DeleteOptions = map[string]string{
+	"":                   "DeleteOptions may be provided when deleting an API object.",
+	"gracePeriodSeconds": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.",
+	"preconditions":      "Must be fulfilled before a deletion is carried out. If not possible, a 409 Conflict status will be returned.",
+	"orphanDependents":   "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.",
+	"propagationPolicy":  "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.",
+	"dryRun":             "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+	"ignoreStoreReadErrorWithClusterBreakingPotential": "if set to true, it will trigger an unsafe deletion of the resource in case the normal deletion flow fails with a corrupt object error. A resource is considered corrupt if it can not be retrieved from the underlying storage successfully because of a) its data can not be transformed e.g. decryption failure, or b) it fails to decode into an object. NOTE: unsafe deletion ignores finalizer constraints, skips precondition checks, and removes the object from the storage. WARNING: This may potentially break the cluster if the workload associated with the resource being unsafe-deleted relies on normal deletion flow. Use only if you REALLY know what you are doing. The default value is false, and the user must opt in to enable it",
+}
+
+func (DeleteOptions) SwaggerDoc() map[string]string {
+	return map_DeleteOptions
+}
+
+var map_FieldSelectorRequirement = map[string]string{
+	"":         "FieldSelectorRequirement is a selector that contains values, a key, and an operator that relates the key and values.",
+	"key":      "key is the field selector key that the requirement applies to.",
+	"operator": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. The list of operators may grow in the future.",
+	"values":   "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.",
+}
+
+func (FieldSelectorRequirement) SwaggerDoc() map[string]string {
+	return map_FieldSelectorRequirement
+}
+
+var map_GetOptions = map[string]string{
+	"":                "GetOptions is the standard query options to the standard REST get call.",
+	"resourceVersion": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset",
+}
+
+func (GetOptions) SwaggerDoc() map[string]string {
+	return map_GetOptions
+}
+
+var map_GroupVersionForDiscovery = map[string]string{
+	"":             "GroupVersion contains the \"group/version\" and \"version\" string of a version. It is made a struct to keep extensibility.",
+	"groupVersion": "groupVersion specifies the API group and version in the form \"group/version\"",
+	"version":      "version specifies the version in the form of \"version\". This is to save the clients the trouble of splitting the GroupVersion.",
+}
+
+func (GroupVersionForDiscovery) SwaggerDoc() map[string]string {
+	return map_GroupVersionForDiscovery
+}
+
+var map_LabelSelector = map[string]string{
+	"":                 "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.",
+	"matchLabels":      "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+	"matchExpressions": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
+}
+
+func (LabelSelector) SwaggerDoc() map[string]string {
+	return map_LabelSelector
+}
+
+var map_LabelSelectorRequirement = map[string]string{
+	"":         "A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
+	"key":      "key is the label key that the selector applies to.",
+	"operator": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.",
+	"values":   "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
+}
+
+func (LabelSelectorRequirement) SwaggerDoc() map[string]string {
+	return map_LabelSelectorRequirement
+}
+
+var map_List = map[string]string{
+	"":         "List holds a list of objects, which may not be known by the server.",
+	"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"items":    "List of objects",
+}
+
+func (List) SwaggerDoc() map[string]string {
+	return map_List
+}
+
+var map_ListMeta = map[string]string{
+	"":                   "ListMeta describes metadata that synthetic resources must have, including lists and various status objects. A resource may have only one of {ObjectMeta, ListMeta}.",
+	"selfLink":           "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.",
+	"resourceVersion":    "String that identifies the server's internal version of this object that can be used by clients to determine when objects have changed. Value must be treated as opaque by clients and passed unmodified back to the server. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency",
+	"continue":           "continue may be set if the user set a limit on the number of items returned, and indicates that the server has more data available. The value is opaque and may be used to issue another request to the endpoint that served this list to retrieve the next set of available objects. Continuing a consistent list may not be possible if the server configuration has changed or more than a few minutes have passed. The resourceVersion field returned when using this continue value will be identical to the value in the first response, unless you have received this token from an error message.",
+	"remainingItemCount": "remainingItemCount is the number of subsequent items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the field will be left unset and omitted during serialization. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and this field will be left unset and omitted during serialization. Servers older than v1.15 do not set this field. The intended use of the remainingItemCount is *estimating* the size of a collection. Clients should not rely on the remainingItemCount to be set or to be exact.",
+	"shardInfo":          "shardInfo is set when the list is a filtered subset of the full collection, as selected by a shard selector on the request. It echoes back the selector so clients can verify which shard they received and merge sharded responses. Clients should not cache sharded list responses as a full representation of the collection.\n\nThis is an alpha field and requires enabling the ShardedListAndWatch feature gate.",
+}
+
+func (ListMeta) SwaggerDoc() map[string]string {
+	return map_ListMeta
+}
+
+var map_ListOptions = map[string]string{
+	"":                     "ListOptions is the query options to a standard REST list call.",
+	"labelSelector":        "A selector to restrict the list of returned objects by their labels. Defaults to everything.",
+	"fieldSelector":        "A selector to restrict the list of returned objects by their fields. Defaults to everything.",
+	"watch":                "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.",
+	"allowWatchBookmarks":  "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.",
+	"resourceVersion":      "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset",
+	"resourceVersionMatch": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset",
+	"timeoutSeconds":       "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.",
+	"limit":                "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.",
+	"continue":             "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.",
+	"sendInitialEvents":    "`sendInitialEvents=true` may be set together with `watch=true`. In that case, the watch stream will begin with synthetic events to produce the current state of objects in the collection. Once all such events have been sent, a synthetic \"Bookmark\" event  will be sent. The bookmark will report the ResourceVersion (RV) corresponding to the set of objects, and be marked with `\"k8s.io/initial-events-end\": \"true\"` annotation. Afterwards, the watch stream will proceed as usual, sending watch events corresponding to changes (subsequent to the RV) to objects watched.\n\nWhen `sendInitialEvents` option is set, we require `resourceVersionMatch` option to also be set. The semantic of the watch request is as following: - `resourceVersionMatch` = NotOlderThan\n  is interpreted as \"data at least as new as the provided `resourceVersion`\"\n  and the bookmark event is send when the state is synced\n  to a `resourceVersion` at least as fresh as the one provided by the ListOptions.\n  If `resourceVersion` is unset, this is interpreted as \"consistent read\" and the\n  bookmark event is send when the state is synced at least to the moment\n  when request started being processed.\n- `resourceVersionMatch` set to any other value or unset\n  Invalid error is returned.\n\nDefaults to true if `resourceVersion=\"\"` or `resourceVersion=\"0\"` (for backward compatibility reasons) and to false otherwise.",
+	"shardSelector":        "shardSelector restricts the list of returned objects using a CEL-based shard selector expression. The format uses the shardRange() function combined with || (logical OR) to specify one or more hash ranges:\n\n  shardRange(object.metadata.uid, '0x0', '0x8000000000000000')\n  shardRange(object.metadata.uid, '0x0', '0x8000000000000000') || shardRange(object.metadata.uid, '0x8000000000000000', '0x10000000000000000')\n\nField paths use CEL-style object-rooted syntax (e.g. \"object.metadata.uid\"), NOT the fieldSelector format (\"metadata.uid\"). Currently supported paths:\n  - object.metadata.uid\n  - object.metadata.namespace\n\nhexStart and hexEnd are single-quoted CEL string literals with a '0x' prefix, defining the inclusive lower and exclusive upper bounds over the 64-bit FNV-1a hash space. The full range is [0x0, 0x10000000000000000), where the exclusive upper bound equals 2^64.\n\nExamples:\n  2-shard split:\n    shard 0: shardRange(object.metadata.uid, '0x0000000000000000', '0x8000000000000000')\n    shard 1: shardRange(object.metadata.uid, '0x8000000000000000', '0x10000000000000000')\n  4-shard split:\n    shard 0: shardRange(object.metadata.uid, '0x0000000000000000', '0x4000000000000000')\n    shard 1: shardRange(object.metadata.uid, '0x4000000000000000', '0x8000000000000000')\n    shard 2: shardRange(object.metadata.uid, '0x8000000000000000', '0xc000000000000000')\n    shard 3: shardRange(object.metadata.uid, '0xc000000000000000', '0x10000000000000000')\n\nThis is an alpha field and requires enabling the ShardedListAndWatch feature gate.",
+}
+
+func (ListOptions) SwaggerDoc() map[string]string {
+	return map_ListOptions
+}
+
+var map_ManagedFieldsEntry = map[string]string{
+	"":            "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.",
+	"manager":     "Manager is an identifier of the workflow managing these fields.",
+	"operation":   "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.",
+	"apiVersion":  "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.",
+	"time":        "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over.",
+	"fieldsType":  "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"",
+	"fieldsV1":    "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type.",
+	"subresource": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.",
+}
+
+func (ManagedFieldsEntry) SwaggerDoc() map[string]string {
+	return map_ManagedFieldsEntry
+}
+
+var map_ObjectMeta = map[string]string{
+	"":                           "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.",
+	"name":                       "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names",
+	"generateName":               "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency",
+	"namespace":                  "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces",
+	"selfLink":                   "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.",
+	"uid":                        "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids",
+	"resourceVersion":            "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency",
+	"generation":                 "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.",
+	"creationTimestamp":          "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"deletionTimestamp":          "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"deletionGracePeriodSeconds": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.",
+	"labels":                     "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels",
+	"annotations":                "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations",
+	"ownerReferences":            "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.",
+	"finalizers":                 "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order.  Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.",
+	"managedFields":              "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.",
+}
+
+func (ObjectMeta) SwaggerDoc() map[string]string {
+	return map_ObjectMeta
+}
+
+var map_OwnerReference = map[string]string{
+	"":                   "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.",
+	"apiVersion":         "API version of the referent.",
+	"kind":               "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"name":               "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names",
+	"uid":                "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids",
+	"controller":         "If true, this reference points to the managing controller.",
+	"blockOwnerDeletion": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.",
+}
+
+func (OwnerReference) SwaggerDoc() map[string]string {
+	return map_OwnerReference
+}
+
+var map_PartialObjectMetadata = map[string]string{
+	"":         "PartialObjectMetadata is a generic representation of any object with ObjectMeta. It allows clients to get access to a particular ObjectMeta schema without knowing the details of the version.",
+	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+}
+
+func (PartialObjectMetadata) SwaggerDoc() map[string]string {
+	return map_PartialObjectMetadata
+}
+
+var map_PartialObjectMetadataList = map[string]string{
+	"":         "PartialObjectMetadataList contains a list of objects containing only their metadata",
+	"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"items":    "items contains each of the included items.",
+}
+
+func (PartialObjectMetadataList) SwaggerDoc() map[string]string {
+	return map_PartialObjectMetadataList
+}
+
+var map_Patch = map[string]string{
+	"": "Patch is provided to give a concrete name and type to the Kubernetes PATCH request body.",
+}
+
+func (Patch) SwaggerDoc() map[string]string {
+	return map_Patch
+}
+
+var map_PatchOptions = map[string]string{
+	"":                "PatchOptions may be provided when patching an API object. PatchOptions is meant to be a superset of UpdateOptions.",
+	"dryRun":          "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+	"force":           "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.",
+	"fieldManager":    "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).",
+	"fieldValidation": "fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.",
+}
+
+func (PatchOptions) SwaggerDoc() map[string]string {
+	return map_PatchOptions
+}
+
+var map_Preconditions = map[string]string{
+	"":                "Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.",
+	"uid":             "Specifies the target UID.",
+	"resourceVersion": "Specifies the target ResourceVersion",
+}
+
+func (Preconditions) SwaggerDoc() map[string]string {
+	return map_Preconditions
+}
+
+var map_RootPaths = map[string]string{
+	"":      "RootPaths lists the paths available at root. For example: \"/healthz\", \"/apis\".",
+	"paths": "paths are the paths available at root.",
+}
+
+func (RootPaths) SwaggerDoc() map[string]string {
+	return map_RootPaths
+}
+
+var map_ServerAddressByClientCIDR = map[string]string{
+	"":              "ServerAddressByClientCIDR helps the client to determine the server address that they should use, depending on the clientCIDR that they match.",
+	"clientCIDR":    "The CIDR with which clients can match their IP to figure out the server address that they should use.",
+	"serverAddress": "Address of this server, suitable for a client that matches the above CIDR. This can be a hostname, hostname:port, IP or IP:port.",
+}
+
+func (ServerAddressByClientCIDR) SwaggerDoc() map[string]string {
+	return map_ServerAddressByClientCIDR
+}
+
+var map_ShardInfo = map[string]string{
+	"":         "ShardInfo describes the shard selector that was applied to produce a list response. Its presence on a list response indicates the list is a filtered subset.",
+	"selector": "selector is the shard selector string from the request, echoed back so clients can verify which shard they received and merge responses from multiple shards.",
+}
+
+func (ShardInfo) SwaggerDoc() map[string]string {
+	return map_ShardInfo
+}
+
+var map_Status = map[string]string{
+	"":         "Status is a return value for calls that don't return other objects.",
+	"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"status":   "Status of the operation. One of: \"Success\" or \"Failure\". More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
+	"message":  "A human-readable description of the status of this operation.",
+	"reason":   "A machine-readable description of why this operation is in the \"Failure\" status. If this value is empty there is no information available. A Reason clarifies an HTTP status code but does not override it.",
+	"details":  "Extended data associated with the reason.  Each reason may define its own extended details. This field is optional and the data returned is not guaranteed to conform to any schema except that defined by the reason type.",
+	"code":     "Suggested HTTP return code for this status, 0 if not set.",
+}
+
+func (Status) SwaggerDoc() map[string]string {
+	return map_Status
+}
+
+var map_StatusCause = map[string]string{
+	"":        "StatusCause provides more information about an api.Status failure, including cases when multiple errors are encountered.",
+	"reason":  "A machine-readable description of the cause of the error. If this value is empty there is no information available.",
+	"message": "A human-readable description of the cause of the error.  This field may be presented as-is to a reader.",
+	"field":   "The field of the resource that has caused this error, as named by its JSON serialization. May include dot and postfix notation for nested attributes. Arrays are zero-indexed.  Fields may appear more than once in an array of causes due to fields having multiple errors. Optional.\n\nExamples:\n  \"name\" - the field \"name\" on the current resource\n  \"items[0].name\" - the field \"name\" on the first array entry in \"items\"",
+}
+
+func (StatusCause) SwaggerDoc() map[string]string {
+	return map_StatusCause
+}
+
+var map_StatusDetails = map[string]string{
+	"":                  "StatusDetails is a set of additional properties that MAY be set by the server to provide additional information about a response. The Reason field of a Status object defines what attributes will be set. Clients must ignore fields that do not match the defined type of each attribute, and should assume that any attribute may be empty, invalid, or under defined.",
+	"name":              "The name attribute of the resource associated with the status StatusReason (when there is a single name which can be described).",
+	"group":             "The group attribute of the resource associated with the status StatusReason.",
+	"kind":              "The kind attribute of the resource associated with the status StatusReason. On some operations may differ from the requested resource Kind. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"uid":               "UID of the resource. (when there is a single resource which can be described). More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids",
+	"causes":            "The Causes array includes more details associated with the StatusReason failure. Not all StatusReasons may provide detailed causes.",
+	"retryAfterSeconds": "If specified, the time in seconds before the operation should be retried. Some errors may indicate the client must take an alternate action - for those errors this field may indicate how long to wait before taking the alternate action.",
+}
+
+func (StatusDetails) SwaggerDoc() map[string]string {
+	return map_StatusDetails
+}
+
+var map_Table = map[string]string{
+	"":                  "Table is a tabular representation of a set of API resources. The server transforms the object into a set of preferred columns for quickly reviewing the objects.",
+	"metadata":          "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"columnDefinitions": "columnDefinitions describes each column in the returned items array. The number of cells per row will always match the number of column definitions.",
+	"rows":              "rows is the list of items in the table.",
+}
+
+func (Table) SwaggerDoc() map[string]string {
+	return map_Table
+}
+
+var map_TableColumnDefinition = map[string]string{
+	"":            "TableColumnDefinition contains information about a column returned in the Table.",
+	"name":        "name is a human readable name for the column.",
+	"type":        "type is an OpenAPI type definition for this column, such as number, integer, string, or array. See https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#data-types for more.",
+	"format":      "format is an optional OpenAPI type modifier for this column. A format modifies the type and imposes additional rules, like date or time formatting for a string. The 'name' format is applied to the primary identifier column which has type 'string' to assist in clients identifying column is the resource name. See https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#data-types for more.",
+	"description": "description is a human readable description of this column.",
+	"priority":    "priority is an integer defining the relative importance of this column compared to others. Lower numbers are considered higher priority. Columns that may be omitted in limited space scenarios should be given a higher priority.",
+}
+
+func (TableColumnDefinition) SwaggerDoc() map[string]string {
+	return map_TableColumnDefinition
+}
+
+var map_TableOptions = map[string]string{
+	"":              "TableOptions are used when a Table is requested by the caller.",
+	"includeObject": "includeObject decides whether to include each object along with its columnar information. Specifying \"None\" will return no object, specifying \"Object\" will return the full object contents, and specifying \"Metadata\" (the default) will return the object's metadata in the PartialObjectMetadata kind in version v1beta1 of the meta.k8s.io API group.",
+}
+
+func (TableOptions) SwaggerDoc() map[string]string {
+	return map_TableOptions
+}
+
+var map_TableRow = map[string]string{
+	"":           "TableRow is an individual row in a table.",
+	"cells":      "cells will be as wide as the column definitions array and may contain strings, numbers (float64 or int64), booleans, simple maps, lists, or null. See the type field of the column definition for a more detailed description.",
+	"conditions": "conditions describe additional status of a row that are relevant for a human user. These conditions apply to the row, not to the object, and will be specific to table output. The only defined condition type is 'Completed', for a row that indicates a resource that has run to completion and can be given less visual priority.",
+	"object":     "This field contains the requested additional information about each object based on the includeObject policy when requesting the Table. If \"None\", this field is empty, if \"Object\" this will be the default serialization of the object for the current API version, and if \"Metadata\" (the default) will contain the object metadata. Check the returned kind and apiVersion of the object before parsing. The media type of the object will always match the enclosing list - if this as a JSON table, these will be JSON encoded objects.",
+}
+
+func (TableRow) SwaggerDoc() map[string]string {
+	return map_TableRow
+}
+
+var map_TableRowCondition = map[string]string{
+	"":        "TableRowCondition allows a row to be marked with additional information.",
+	"type":    "Type of row condition. The only defined value is 'Completed' indicating that the object this row represents has reached a completed state and may be given less visual priority than other rows. Clients are not required to honor any conditions but should be consistent where possible about handling the conditions.",
+	"status":  "Status of the condition, one of True, False, Unknown.",
+	"reason":  "(brief) machine readable reason for the condition's last transition.",
+	"message": "Human readable message indicating details about last transition.",
+}
+
+func (TableRowCondition) SwaggerDoc() map[string]string {
+	return map_TableRowCondition
+}
+
+var map_TypeMeta = map[string]string{
+	"":           "TypeMeta describes an individual object in an API response or request with strings representing the type of the object and its API schema version. Structures that are versioned or persisted should inline TypeMeta.",
+	"kind":       "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"apiVersion": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+}
+
+func (TypeMeta) SwaggerDoc() map[string]string {
+	return map_TypeMeta
+}
+
+var map_UpdateOptions = map[string]string{
+	"":                "UpdateOptions may be provided when updating an API object. All fields in UpdateOptions should also be present in PatchOptions.",
+	"dryRun":          "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+	"fieldManager":    "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.",
+	"fieldValidation": "fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.",
+}
+
+func (UpdateOptions) SwaggerDoc() map[string]string {
+	return map_UpdateOptions
+}
+
+// AUTO-GENERATED FUNCTIONS END HERE
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types_test.go
new file mode 100644
index 0000000000..f216527ddb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types_test.go
@@ -0,0 +1,134 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	gojson "encoding/json"
+	"reflect"
+	"testing"
+
+	utiljson "k8s.io/apimachinery/pkg/util/json"
+)
+
+func TestVerbsMarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  APIResource
+		result string
+	}{
+		{APIResource{}, `{"name":"","singularName":"","namespaced":false,"kind":"","verbs":null}`},
+		{APIResource{Verbs: Verbs([]string{})}, `{"name":"","singularName":"","namespaced":false,"kind":"","verbs":[]}`},
+		{APIResource{Verbs: Verbs([]string{"delete"})}, `{"name":"","singularName":"","namespaced":false,"kind":"","verbs":["delete"]}`},
+	}
+
+	for i, c := range cases {
+		result, err := gojson.Marshal(&c.input)
+		if err != nil {
+			t.Errorf("[%d] Failed to marshal input: '%v': %v", i, c.input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("[%d] Failed to marshal input: '%v': expected '%v', got '%v'", i, c.input, c.result, string(result))
+		}
+	}
+}
+
+func TestVerbsJsonIterUnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  string
+		result APIResource
+	}{
+		{`{}`, APIResource{}},
+		{`{"verbs":null}`, APIResource{}},
+		{`{"verbs":[]}`, APIResource{Verbs: Verbs([]string{})}},
+		{`{"verbs":["delete"]}`, APIResource{Verbs: Verbs([]string{"delete"})}},
+	}
+
+	for i, c := range cases {
+		var result APIResource
+		if err := utiljson.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("[%d] Failed to unmarshal input '%v': %v", i, c.input, err)
+		}
+		if !reflect.DeepEqual(result, c.result) {
+			t.Errorf("[%d] Failed to unmarshal input '%v': expected %+v, got %+v", i, c.input, c.result, result)
+		}
+	}
+}
+
+// TestMarshalJSONWithOmit tests that we don't have regressions regarding nil and empty slices with "omit"
+func TestMarshalJSONWithOmit(t *testing.T) {
+	cases := []struct {
+		input  LabelSelector
+		result string
+	}{
+		{LabelSelector{}, `{}`},
+		{LabelSelector{MatchExpressions: []LabelSelectorRequirement{}}, `{}`},
+		{LabelSelector{MatchExpressions: []LabelSelectorRequirement{{}}}, `{"matchExpressions":[{"key":"","operator":""}]}`},
+	}
+
+	for i, c := range cases {
+		result, err := gojson.Marshal(&c.input)
+		if err != nil {
+			t.Errorf("[%d] Failed to marshal input: '%v': %v", i, c.input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("[%d] Failed to marshal input: '%v': expected '%v', got '%v'", i, c.input, c.result, string(result))
+		}
+	}
+}
+
+func TestVerbsUnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  string
+		result APIResource
+	}{
+		{`{}`, APIResource{}},
+		{`{"verbs":null}`, APIResource{}},
+		{`{"verbs":[]}`, APIResource{Verbs: Verbs([]string{})}},
+		{`{"verbs":["delete"]}`, APIResource{Verbs: Verbs([]string{"delete"})}},
+	}
+
+	for i, c := range cases {
+		var result APIResource
+		if err := gojson.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("[%d] Failed to unmarshal input '%v': %v", i, c.input, err)
+		}
+		if !reflect.DeepEqual(result, c.result) {
+			t.Errorf("[%d] Failed to unmarshal input '%v': expected %+v, got %+v", i, c.input, c.result, result)
+		}
+	}
+}
+
+func TestVerbsProto(t *testing.T) {
+	cases := []APIResource{
+		{},
+		{Verbs: Verbs([]string{})},
+		{Verbs: Verbs([]string{"delete"})},
+	}
+
+	for _, input := range cases {
+		data, err := input.Marshal()
+		if err != nil {
+			t.Fatalf("Failed to marshal input: '%v': %v", input, err)
+		}
+		resource := APIResource{}
+		if err := resource.Unmarshal(data); err != nil {
+			t.Fatalf("Failed to unmarshal output: '%v': %v", input, err)
+		}
+		if !reflect.DeepEqual(input, resource) {
+			t.Errorf("Marshal->Unmarshal is not idempotent: '%v' vs '%v'", input, resource)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers.go
new file mode 100644
index 0000000000..592445d9c8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers.go
@@ -0,0 +1,551 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructured
+
+import (
+	gojson "encoding/json"
+	"fmt"
+	"io"
+	"math/big"
+	"strings"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/json"
+	"k8s.io/klog/v2"
+)
+
+// NestedFieldCopy returns a deep copy of the value of a nested field.
+// Returns false if the value is missing.
+// No error is returned for a nil field.
+//
+// Note: fields passed to this function are treated as keys within the passed
+// object; no array/slice syntax is supported.
+func NestedFieldCopy(obj map[string]interface{}, fields ...string) (interface{}, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return nil, found, err
+	}
+	return runtime.DeepCopyJSONValue(val), true, nil
+}
+
+// NestedFieldNoCopy returns a reference to a nested field.
+// Returns false if value is not found and an error if unable
+// to traverse obj.
+//
+// Note: fields passed to this function are treated as keys within the passed
+// object; no array/slice syntax is supported.
+func NestedFieldNoCopy(obj map[string]interface{}, fields ...string) (interface{}, bool, error) {
+	var val interface{} = obj
+
+	for i, field := range fields {
+		if val == nil {
+			return nil, false, nil
+		}
+		if m, ok := val.(map[string]interface{}); ok {
+			val, ok = m[field]
+			if !ok {
+				return nil, false, nil
+			}
+		} else {
+			return nil, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected map[string]interface{}", jsonPath(fields[:i+1]), val, val)
+		}
+	}
+	return val, true, nil
+}
+
+// NestedString returns the string value of a nested field.
+// Returns false if value is not found and an error if not a string.
+func NestedString(obj map[string]interface{}, fields ...string) (string, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return "", found, err
+	}
+	s, ok := val.(string)
+	if !ok {
+		return "", false, fmt.Errorf("%v accessor error: %v is of the type %T, expected string", jsonPath(fields), val, val)
+	}
+	return s, true, nil
+}
+
+// NestedBool returns the bool value of a nested field.
+// Returns false if value is not found and an error if not a bool.
+func NestedBool(obj map[string]interface{}, fields ...string) (bool, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return false, found, err
+	}
+	b, ok := val.(bool)
+	if !ok {
+		return false, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected bool", jsonPath(fields), val, val)
+	}
+	return b, true, nil
+}
+
+// NestedFloat64 returns the float64 value of a nested field.
+// Returns false if value is not found and an error if not a float64.
+func NestedFloat64(obj map[string]interface{}, fields ...string) (float64, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return 0, found, err
+	}
+	f, ok := val.(float64)
+	if !ok {
+		return 0, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected float64", jsonPath(fields), val, val)
+	}
+	return f, true, nil
+}
+
+// NestedInt64 returns the int64 value of a nested field.
+// Returns false if value is not found and an error if not an int64.
+func NestedInt64(obj map[string]interface{}, fields ...string) (int64, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return 0, found, err
+	}
+	i, ok := val.(int64)
+	if !ok {
+		return 0, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected int64", jsonPath(fields), val, val)
+	}
+	return i, true, nil
+}
+
+// NestedNumberAsFloat64 returns the float64 value of a nested field. If the field's value is a
+// float64, it is returned. If the field's value is an int64 that can be losslessly converted to
+// float64, it will be converted and returned.  Returns false if value is not found and an error if
+// not a float64 or an int64 that can be accurately represented as a float64.
+func NestedNumberAsFloat64(obj map[string]interface{}, fields ...string) (float64, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return 0, found, err
+	}
+	switch x := val.(type) {
+	case int64:
+		f, accuracy := big.NewInt(x).Float64()
+		if accuracy != big.Exact {
+			return 0, false, fmt.Errorf("%v accessor error: int64 value %v cannot be losslessly converted to float64", jsonPath(fields), x)
+		}
+		return f, true, nil
+	case float64:
+		return x, true, nil
+	default:
+		return 0, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected float64 or int64", jsonPath(fields), val, val)
+	}
+}
+
+// NestedStringSlice returns a copy of []string value of a nested field.
+// Returns false if value is not found and an error if not a []interface{} or contains non-string items in the slice.
+func NestedStringSlice(obj map[string]interface{}, fields ...string) ([]string, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return nil, found, err
+	}
+	m, ok := val.([]interface{})
+	if !ok {
+		return nil, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected []interface{}", jsonPath(fields), val, val)
+	}
+	strSlice := make([]string, 0, len(m))
+	for _, v := range m {
+		if str, ok := v.(string); ok {
+			strSlice = append(strSlice, str)
+		} else {
+			return nil, false, fmt.Errorf("%v accessor error: contains non-string key in the slice: %v is of the type %T, expected string", jsonPath(fields), v, v)
+		}
+	}
+	return strSlice, true, nil
+}
+
+// NestedSlice returns a deep copy of []interface{} value of a nested field.
+// Returns false if value is not found and an error if not a []interface{}.
+func NestedSlice(obj map[string]interface{}, fields ...string) ([]interface{}, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return nil, found, err
+	}
+	_, ok := val.([]interface{})
+	if !ok {
+		return nil, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected []interface{}", jsonPath(fields), val, val)
+	}
+	return runtime.DeepCopyJSONValue(val).([]interface{}), true, nil
+}
+
+// NestedStringMap returns a copy of map[string]string value of a nested field.
+// Returns false if value is not found and an error if not a map[string]interface{} or contains non-string values in the map.
+func NestedStringMap(obj map[string]interface{}, fields ...string) (map[string]string, bool, error) {
+	m, found, err := nestedMapNoCopy(obj, false, fields...)
+	if !found || err != nil {
+		return nil, found, err
+	}
+	strMap := make(map[string]string, len(m))
+	for k, v := range m {
+		if str, ok := v.(string); ok {
+			strMap[k] = str
+		} else {
+			return nil, false, fmt.Errorf("%v accessor error: contains non-string value in the map under key %q: %v is of the type %T, expected string", jsonPath(fields), k, v, v)
+		}
+	}
+	return strMap, true, nil
+}
+
+// NestedNullCoercingStringMap returns a copy of map[string]string value of a nested field.
+// Returns `nil, true, nil` if the value exists and is explicitly null.
+// Returns `nil, false, err` if the value is not a map or a null value, or is a map and contains non-string non-null values.
+// Null values in the map are coerced to "" to match json decoding behavior.
+func NestedNullCoercingStringMap(obj map[string]interface{}, fields ...string) (map[string]string, bool, error) {
+	m, found, err := nestedMapNoCopy(obj, true, fields...)
+	if !found || err != nil || m == nil {
+		return nil, found, err
+	}
+	strMap := make(map[string]string, len(m))
+	for k, v := range m {
+		if str, ok := v.(string); ok {
+			strMap[k] = str
+		} else if v == nil {
+			strMap[k] = ""
+		} else {
+			return nil, false, fmt.Errorf("%v accessor error: contains non-string value in the map under key %q: %v is of the type %T, expected string", jsonPath(fields), k, v, v)
+		}
+	}
+	return strMap, true, nil
+}
+
+// NestedMap returns a deep copy of map[string]interface{} value of a nested field.
+// Returns false if value is not found and an error if not a map[string]interface{}.
+func NestedMap(obj map[string]interface{}, fields ...string) (map[string]interface{}, bool, error) {
+	m, found, err := nestedMapNoCopy(obj, false, fields...)
+	if !found || err != nil {
+		return nil, found, err
+	}
+	return runtime.DeepCopyJSON(m), true, nil
+}
+
+// nestedMapNoCopy returns a map[string]interface{} value of a nested field.
+// Returns false if value is not found and an error if not a map[string]interface{}.
+func nestedMapNoCopy(obj map[string]interface{}, tolerateNil bool, fields ...string) (map[string]interface{}, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return nil, found, err
+	}
+	if val == nil && tolerateNil {
+		return nil, true, nil
+	}
+	m, ok := val.(map[string]interface{})
+	if !ok {
+		return nil, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected map[string]interface{}", jsonPath(fields), val, val)
+	}
+	return m, true, nil
+}
+
+// SetNestedField sets the value of a nested field to a deep copy of the value provided.
+// Returns an error if value cannot be set because one of the nesting levels is not a map[string]interface{}.
+func SetNestedField(obj map[string]interface{}, value interface{}, fields ...string) error {
+	return setNestedFieldNoCopy(obj, runtime.DeepCopyJSONValue(value), fields...)
+}
+
+func setNestedFieldNoCopy(obj map[string]interface{}, value interface{}, fields ...string) error {
+	m := obj
+
+	for i, field := range fields[:len(fields)-1] {
+		if val, ok := m[field]; ok {
+			if valMap, ok := val.(map[string]interface{}); ok {
+				m = valMap
+			} else {
+				return fmt.Errorf("value cannot be set because %v is not a map[string]interface{}", jsonPath(fields[:i+1]))
+			}
+		} else {
+			newVal := make(map[string]interface{})
+			m[field] = newVal
+			m = newVal
+		}
+	}
+	m[fields[len(fields)-1]] = value
+	return nil
+}
+
+// SetNestedStringSlice sets the string slice value of a nested field.
+// Returns an error if value cannot be set because one of the nesting levels is not a map[string]interface{}.
+func SetNestedStringSlice(obj map[string]interface{}, value []string, fields ...string) error {
+	m := make([]interface{}, 0, len(value)) // convert []string into []interface{}
+	for _, v := range value {
+		m = append(m, v)
+	}
+	return setNestedFieldNoCopy(obj, m, fields...)
+}
+
+// SetNestedSlice sets the slice value of a nested field.
+// Returns an error if value cannot be set because one of the nesting levels is not a map[string]interface{}.
+func SetNestedSlice(obj map[string]interface{}, value []interface{}, fields ...string) error {
+	return SetNestedField(obj, value, fields...)
+}
+
+// SetNestedStringMap sets the map[string]string value of a nested field.
+// Returns an error if value cannot be set because one of the nesting levels is not a map[string]interface{}.
+func SetNestedStringMap(obj map[string]interface{}, value map[string]string, fields ...string) error {
+	m := make(map[string]interface{}, len(value)) // convert map[string]string into map[string]interface{}
+	for k, v := range value {
+		m[k] = v
+	}
+	return setNestedFieldNoCopy(obj, m, fields...)
+}
+
+// SetNestedMap sets the map[string]interface{} value of a nested field.
+// Returns an error if value cannot be set because one of the nesting levels is not a map[string]interface{}.
+func SetNestedMap(obj map[string]interface{}, value map[string]interface{}, fields ...string) error {
+	return SetNestedField(obj, value, fields...)
+}
+
+// RemoveNestedField removes the nested field from the obj.
+func RemoveNestedField(obj map[string]interface{}, fields ...string) {
+	m := obj
+	for _, field := range fields[:len(fields)-1] {
+		if x, ok := m[field].(map[string]interface{}); ok {
+			m = x
+		} else {
+			return
+		}
+	}
+	delete(m, fields[len(fields)-1])
+}
+
+func getNestedString(obj map[string]interface{}, fields ...string) string {
+	val, found, err := NestedString(obj, fields...)
+	if !found || err != nil {
+		return ""
+	}
+	return val
+}
+
+func getNestedInt64Pointer(obj map[string]interface{}, fields ...string) *int64 {
+	val, found, err := NestedInt64(obj, fields...)
+	if !found || err != nil {
+		return nil
+	}
+	return &val
+}
+
+func jsonPath(fields []string) string {
+	return "." + strings.Join(fields, ".")
+}
+
+func extractOwnerReference(v map[string]interface{}) metav1.OwnerReference {
+	// though this field is a *bool, but when decoded from JSON, it's
+	// unmarshalled as bool.
+	var controllerPtr *bool
+	if controller, found, err := NestedBool(v, "controller"); err == nil && found {
+		controllerPtr = &controller
+	}
+	var blockOwnerDeletionPtr *bool
+	if blockOwnerDeletion, found, err := NestedBool(v, "blockOwnerDeletion"); err == nil && found {
+		blockOwnerDeletionPtr = &blockOwnerDeletion
+	}
+	return metav1.OwnerReference{
+		Kind:               getNestedString(v, "kind"),
+		Name:               getNestedString(v, "name"),
+		APIVersion:         getNestedString(v, "apiVersion"),
+		UID:                types.UID(getNestedString(v, "uid")),
+		Controller:         controllerPtr,
+		BlockOwnerDeletion: blockOwnerDeletionPtr,
+	}
+}
+
+// UnstructuredJSONScheme is capable of converting JSON data into the Unstructured
+// type, which can be used for generic access to objects without a predefined scheme.
+// TODO: move into serializer/json.
+var UnstructuredJSONScheme runtime.Codec = unstructuredJSONScheme{}
+
+type unstructuredJSONScheme struct{}
+
+const unstructuredJSONSchemeIdentifier runtime.Identifier = "unstructuredJSON"
+
+func (s unstructuredJSONScheme) Decode(data []byte, _ *schema.GroupVersionKind, obj runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	var err error
+	if obj != nil {
+		err = s.decodeInto(data, obj)
+	} else {
+		obj, err = s.decode(data)
+	}
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	gvk := obj.GetObjectKind().GroupVersionKind()
+	if len(gvk.Kind) == 0 {
+		return nil, &gvk, runtime.NewMissingKindErr(string(data))
+	}
+	// TODO(109023): require apiVersion here as well
+
+	return obj, &gvk, nil
+}
+
+func (s unstructuredJSONScheme) Encode(obj runtime.Object, w io.Writer) error {
+	if co, ok := obj.(runtime.CacheableObject); ok {
+		return co.CacheEncode(s.Identifier(), s.doEncode, w)
+	}
+	return s.doEncode(obj, w)
+}
+
+func (unstructuredJSONScheme) doEncode(obj runtime.Object, w io.Writer) error {
+	switch t := obj.(type) {
+	case *Unstructured:
+		return json.NewEncoder(w).Encode(t.Object)
+	case *UnstructuredList:
+		items := make([]interface{}, 0, len(t.Items))
+		for _, i := range t.Items {
+			items = append(items, i.Object)
+		}
+		listObj := make(map[string]interface{}, len(t.Object)+1)
+		for k, v := range t.Object { // Make a shallow copy
+			listObj[k] = v
+		}
+		listObj["items"] = items
+		return json.NewEncoder(w).Encode(listObj)
+	case *runtime.Unknown:
+		// TODO: Unstructured needs to deal with ContentType.
+		_, err := w.Write(t.Raw)
+		return err
+	default:
+		return json.NewEncoder(w).Encode(t)
+	}
+}
+
+// Identifier implements runtime.Encoder interface.
+func (unstructuredJSONScheme) Identifier() runtime.Identifier {
+	return unstructuredJSONSchemeIdentifier
+}
+
+func (s unstructuredJSONScheme) decode(data []byte) (runtime.Object, error) {
+	type detector struct {
+		Items gojson.RawMessage `json:"items"`
+	}
+	var det detector
+	if err := json.Unmarshal(data, &det); err != nil {
+		return nil, err
+	}
+
+	if det.Items != nil {
+		list := &UnstructuredList{}
+		err := s.decodeToList(data, list)
+		return list, err
+	}
+
+	// No Items field, so it wasn't a list.
+	unstruct := &Unstructured{}
+	err := s.decodeToUnstructured(data, unstruct)
+	return unstruct, err
+}
+
+func (s unstructuredJSONScheme) decodeInto(data []byte, obj runtime.Object) error {
+	switch x := obj.(type) {
+	case *Unstructured:
+		return s.decodeToUnstructured(data, x)
+	case *UnstructuredList:
+		return s.decodeToList(data, x)
+	default:
+		return json.Unmarshal(data, x)
+	}
+}
+
+func (unstructuredJSONScheme) decodeToUnstructured(data []byte, unstruct *Unstructured) error {
+	m := make(map[string]interface{})
+	if err := json.Unmarshal(data, &m); err != nil {
+		return err
+	}
+
+	unstruct.Object = m
+
+	return nil
+}
+
+func (s unstructuredJSONScheme) decodeToList(data []byte, list *UnstructuredList) error {
+	type decodeList struct {
+		Items []gojson.RawMessage `json:"items"`
+	}
+
+	var dList decodeList
+	if err := json.Unmarshal(data, &dList); err != nil {
+		return err
+	}
+
+	if err := json.Unmarshal(data, &list.Object); err != nil {
+		return err
+	}
+
+	// For typed lists, e.g., a PodList, API server doesn't set each item's
+	// APIVersion and Kind. We need to set it.
+	listAPIVersion := list.GetAPIVersion()
+	listKind := list.GetKind()
+	itemKind := strings.TrimSuffix(listKind, "List")
+
+	delete(list.Object, "items")
+	list.Items = make([]Unstructured, 0, len(dList.Items))
+	for _, i := range dList.Items {
+		unstruct := &Unstructured{}
+		if err := s.decodeToUnstructured([]byte(i), unstruct); err != nil {
+			return err
+		}
+		// This is hacky. Set the item's Kind and APIVersion to those inferred
+		// from the List.
+		if len(unstruct.GetKind()) == 0 && len(unstruct.GetAPIVersion()) == 0 {
+			unstruct.SetKind(itemKind)
+			unstruct.SetAPIVersion(listAPIVersion)
+		}
+		list.Items = append(list.Items, *unstruct)
+	}
+	return nil
+}
+
+type jsonFallbackEncoder struct {
+	encoder    runtime.Encoder
+	identifier runtime.Identifier
+}
+
+func NewJSONFallbackEncoder(encoder runtime.Encoder) runtime.Encoder {
+	result := map[string]string{
+		"name": "fallback",
+		"base": string(encoder.Identifier()),
+	}
+	identifier, err := gojson.Marshal(result)
+	if err != nil {
+		//nolint:logcheck // Should not be reached.
+		klog.Fatalf("Failed marshaling identifier for jsonFallbackEncoder: %v", err)
+	}
+	return &jsonFallbackEncoder{
+		encoder:    encoder,
+		identifier: runtime.Identifier(identifier),
+	}
+}
+
+func (c *jsonFallbackEncoder) Encode(obj runtime.Object, w io.Writer) error {
+	// There is no need to handle runtime.CacheableObject, as we only
+	// fallback to other encoders here.
+	err := c.encoder.Encode(obj, w)
+	if runtime.IsNotRegisteredError(err) {
+		switch obj.(type) {
+		case *Unstructured, *UnstructuredList:
+			return UnstructuredJSONScheme.Encode(obj, w)
+		}
+	}
+	return err
+}
+
+// Identifier implements runtime.Encoder interface.
+func (c *jsonFallbackEncoder) Identifier() runtime.Identifier {
+	return c.identifier
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers_test.go
new file mode 100644
index 0000000000..7bbb9f91f1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers_test.go
@@ -0,0 +1,388 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructured
+
+import (
+	"io/ioutil"
+	"math"
+	"reflect"
+	"strings"
+	"sync"
+	"testing"
+
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestCodecOfUnstructuredList tests that there are no data races in Encode().
+// i.e. that it does not mutate the object being encoded.
+func TestCodecOfUnstructuredList(t *testing.T) {
+	var wg sync.WaitGroup
+	concurrency := 10
+	list := UnstructuredList{
+		Object: map[string]interface{}{},
+	}
+	wg.Add(concurrency)
+	for i := 0; i < concurrency; i++ {
+		go func() {
+			defer wg.Done()
+			assert.NoError(t, UnstructuredJSONScheme.Encode(&list, ioutil.Discard))
+		}()
+	}
+	wg.Wait()
+}
+
+func TestRemoveNestedField(t *testing.T) {
+	obj := map[string]interface{}{
+		"x": map[string]interface{}{
+			"y": 1,
+			"a": "foo",
+		},
+	}
+	RemoveNestedField(obj, "x", "a")
+	assert.Len(t, obj["x"], 1)
+	RemoveNestedField(obj, "x", "y")
+	assert.Empty(t, obj["x"])
+	RemoveNestedField(obj, "x")
+	assert.Empty(t, obj)
+	RemoveNestedField(obj, "x") // Remove of a non-existent field
+	assert.Empty(t, obj)
+}
+
+func TestNestedFieldNoCopy(t *testing.T) {
+	target := map[string]interface{}{"foo": "bar"}
+
+	obj := map[string]interface{}{
+		"a": map[string]interface{}{
+			"b": target,
+			"c": nil,
+			"d": []interface{}{"foo"},
+			"e": []interface{}{
+				map[string]interface{}{
+					"f": "bar",
+				},
+			},
+		},
+	}
+
+	// case 1: field exists and is non-nil
+	res, exists, err := NestedFieldNoCopy(obj, "a", "b")
+	assert.True(t, exists)
+	assert.NoError(t, err)
+	assert.Equal(t, target, res)
+	target["foo"] = "baz"
+	assert.Equal(t, target["foo"], res.(map[string]interface{})["foo"], "result should be a reference to the expected item")
+
+	// case 2: field exists and is nil
+	res, exists, err = NestedFieldNoCopy(obj, "a", "c")
+	assert.True(t, exists)
+	assert.NoError(t, err)
+	assert.Nil(t, res)
+
+	// case 3: error traversing obj
+	res, exists, err = NestedFieldNoCopy(obj, "a", "d", "foo")
+	assert.False(t, exists)
+	assert.Error(t, err)
+	assert.Nil(t, res)
+
+	// case 4: field does not exist
+	res, exists, err = NestedFieldNoCopy(obj, "a", "g")
+	assert.False(t, exists)
+	assert.NoError(t, err)
+	assert.Nil(t, res)
+
+	// case 5: intermediate field does not exist
+	res, exists, err = NestedFieldNoCopy(obj, "a", "g", "f")
+	assert.False(t, exists)
+	assert.NoError(t, err)
+	assert.Nil(t, res)
+
+	// case 6: intermediate field is null
+	//         (background: happens easily in YAML)
+	res, exists, err = NestedFieldNoCopy(obj, "a", "c", "f")
+	assert.False(t, exists)
+	assert.NoError(t, err)
+	assert.Nil(t, res)
+
+	// case 7: array/slice syntax is not supported
+	//         (background: users may expect this to be supported)
+	res, exists, err = NestedFieldNoCopy(obj, "a", "e[0]")
+	assert.False(t, exists)
+	assert.NoError(t, err)
+	assert.Nil(t, res)
+}
+
+func TestNestedFieldCopy(t *testing.T) {
+	target := map[string]interface{}{"foo": "bar"}
+
+	obj := map[string]interface{}{
+		"a": map[string]interface{}{
+			"b": target,
+			"c": nil,
+			"d": []interface{}{"foo"},
+		},
+	}
+
+	// case 1: field exists and is non-nil
+	res, exists, err := NestedFieldCopy(obj, "a", "b")
+	assert.True(t, exists)
+	assert.NoError(t, err)
+	assert.Equal(t, target, res)
+	target["foo"] = "baz"
+	assert.NotEqual(t, target["foo"], res.(map[string]interface{})["foo"], "result should be a copy of the expected item")
+
+	// case 2: field exists and is nil
+	res, exists, err = NestedFieldCopy(obj, "a", "c")
+	assert.True(t, exists)
+	assert.NoError(t, err)
+	assert.Nil(t, res)
+
+	// case 3: error traversing obj
+	res, exists, err = NestedFieldCopy(obj, "a", "d", "foo")
+	assert.False(t, exists)
+	assert.Error(t, err)
+	assert.Nil(t, res)
+
+	// case 4: field does not exist
+	res, exists, err = NestedFieldCopy(obj, "a", "e")
+	assert.False(t, exists)
+	assert.NoError(t, err)
+	assert.Nil(t, res)
+}
+
+func TestCacheableObject(t *testing.T) {
+	runtimetesting.CacheableObjectTest(t, UnstructuredJSONScheme)
+}
+
+func TestSetNestedStringSlice(t *testing.T) {
+	obj := map[string]interface{}{
+		"x": map[string]interface{}{
+			"y": 1,
+			"a": "foo",
+		},
+	}
+
+	err := SetNestedStringSlice(obj, []string{"bar"}, "x", "z")
+	assert.NoError(t, err)
+	assert.Len(t, obj["x"], 3)
+	assert.Len(t, obj["x"].(map[string]interface{})["z"], 1)
+	assert.Equal(t, "bar", obj["x"].(map[string]interface{})["z"].([]interface{})[0])
+}
+
+func TestSetNestedSlice(t *testing.T) {
+	obj := map[string]interface{}{
+		"x": map[string]interface{}{
+			"y": 1,
+			"a": "foo",
+		},
+	}
+
+	err := SetNestedSlice(obj, []interface{}{"bar"}, "x", "z")
+	assert.NoError(t, err)
+	assert.Len(t, obj["x"], 3)
+	assert.Len(t, obj["x"].(map[string]interface{})["z"], 1)
+	assert.Equal(t, "bar", obj["x"].(map[string]interface{})["z"].([]interface{})[0])
+}
+
+func TestSetNestedStringMap(t *testing.T) {
+	obj := map[string]interface{}{
+		"x": map[string]interface{}{
+			"y": 1,
+			"a": "foo",
+		},
+	}
+
+	err := SetNestedStringMap(obj, map[string]string{"b": "bar"}, "x", "z")
+	assert.NoError(t, err)
+	assert.Len(t, obj["x"], 3)
+	assert.Len(t, obj["x"].(map[string]interface{})["z"], 1)
+	assert.Equal(t, "bar", obj["x"].(map[string]interface{})["z"].(map[string]interface{})["b"])
+}
+
+func TestSetNestedMap(t *testing.T) {
+	obj := map[string]interface{}{
+		"x": map[string]interface{}{
+			"y": 1,
+			"a": "foo",
+		},
+	}
+
+	err := SetNestedMap(obj, map[string]interface{}{"b": "bar"}, "x", "z")
+	assert.NoError(t, err)
+	assert.Len(t, obj["x"], 3)
+	assert.Len(t, obj["x"].(map[string]interface{})["z"], 1)
+	assert.Equal(t, "bar", obj["x"].(map[string]interface{})["z"].(map[string]interface{})["b"])
+}
+
+func TestNestedNumberAsFloat64(t *testing.T) {
+	for _, tc := range []struct {
+		name           string
+		obj            map[string]interface{}
+		path           []string
+		wantFloat64    float64
+		wantBool       bool
+		wantErrMessage string
+	}{
+		{
+			name:           "not found",
+			obj:            nil,
+			path:           []string{"missing"},
+			wantFloat64:    0,
+			wantBool:       false,
+			wantErrMessage: "",
+		},
+		{
+			name:           "found float64",
+			obj:            map[string]interface{}{"value": float64(42)},
+			path:           []string{"value"},
+			wantFloat64:    42,
+			wantBool:       true,
+			wantErrMessage: "",
+		},
+		{
+			name:           "found unexpected type bool",
+			obj:            map[string]interface{}{"value": true},
+			path:           []string{"value"},
+			wantFloat64:    0,
+			wantBool:       false,
+			wantErrMessage: ".value accessor error: true is of the type bool, expected float64 or int64",
+		},
+		{
+			name:           "found int64",
+			obj:            map[string]interface{}{"value": int64(42)},
+			path:           []string{"value"},
+			wantFloat64:    42,
+			wantBool:       true,
+			wantErrMessage: "",
+		},
+		{
+			name:           "found int64 not representable as float64",
+			obj:            map[string]interface{}{"value": int64(math.MaxInt64)},
+			path:           []string{"value"},
+			wantFloat64:    0,
+			wantBool:       false,
+			wantErrMessage: ".value accessor error: int64 value 9223372036854775807 cannot be losslessly converted to float64",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			gotFloat64, gotBool, gotErr := NestedNumberAsFloat64(tc.obj, tc.path...)
+			if gotFloat64 != tc.wantFloat64 {
+				t.Errorf("got %v, wanted %v", gotFloat64, tc.wantFloat64)
+			}
+			if gotBool != tc.wantBool {
+				t.Errorf("got %t, wanted %t", gotBool, tc.wantBool)
+			}
+			if tc.wantErrMessage != "" {
+				if gotErr == nil {
+					t.Errorf("got nil error, wanted %s", tc.wantErrMessage)
+				} else if gotErrMessage := gotErr.Error(); gotErrMessage != tc.wantErrMessage {
+					t.Errorf("wanted error %q, got: %v", gotErrMessage, tc.wantErrMessage)
+				}
+			} else if gotErr != nil {
+				t.Errorf("wanted nil error, got %v", gotErr)
+			}
+		})
+	}
+}
+
+func TestNestedNullCoercingStringMap(t *testing.T) {
+	for _, tc := range []struct {
+		name           string
+		obj            map[string]interface{}
+		path           []string
+		wantObj        map[string]string
+		wantFound      bool
+		wantErrMessage string
+	}{
+		{
+			name:           "missing map",
+			obj:            nil,
+			path:           []string{"path"},
+			wantObj:        nil,
+			wantFound:      false,
+			wantErrMessage: "",
+		},
+		{
+			name:           "null map",
+			obj:            map[string]interface{}{"path": nil},
+			path:           []string{"path"},
+			wantObj:        nil,
+			wantFound:      true,
+			wantErrMessage: "",
+		},
+		{
+			name:           "non map",
+			obj:            map[string]interface{}{"path": 0},
+			path:           []string{"path"},
+			wantObj:        nil,
+			wantFound:      false,
+			wantErrMessage: "type int",
+		},
+		{
+			name:           "empty map",
+			obj:            map[string]interface{}{"path": map[string]interface{}{}},
+			path:           []string{"path"},
+			wantObj:        map[string]string{},
+			wantFound:      true,
+			wantErrMessage: "",
+		},
+		{
+			name:           "string value",
+			obj:            map[string]interface{}{"path": map[string]interface{}{"a": "1", "b": "2"}},
+			path:           []string{"path"},
+			wantObj:        map[string]string{"a": "1", "b": "2"},
+			wantFound:      true,
+			wantErrMessage: "",
+		},
+		{
+			name:           "null value",
+			obj:            map[string]interface{}{"path": map[string]interface{}{"a": "1", "b": nil}},
+			path:           []string{"path"},
+			wantObj:        map[string]string{"a": "1", "b": ""},
+			wantFound:      true,
+			wantErrMessage: "",
+		},
+		{
+			name:           "invalid value",
+			obj:            map[string]interface{}{"path": map[string]interface{}{"a": "1", "b": nil, "c": 0}},
+			path:           []string{"path"},
+			wantObj:        nil,
+			wantFound:      false,
+			wantErrMessage: `key "c": 0`,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			gotObj, gotFound, gotErr := NestedNullCoercingStringMap(tc.obj, tc.path...)
+			if !reflect.DeepEqual(gotObj, tc.wantObj) {
+				t.Errorf("got %#v, wanted %#v", gotObj, tc.wantObj)
+			}
+			if gotFound != tc.wantFound {
+				t.Errorf("got %v, wanted %v", gotFound, tc.wantFound)
+			}
+			if tc.wantErrMessage != "" {
+				if gotErr == nil {
+					t.Errorf("got nil error, wanted %s", tc.wantErrMessage)
+				} else if gotErrMessage := gotErr.Error(); !strings.Contains(gotErrMessage, tc.wantErrMessage) {
+					t.Errorf("wanted error %q, got: %v", gotErrMessage, tc.wantErrMessage)
+				}
+			} else if gotErr != nil {
+				t.Errorf("wanted nil error, got %v", gotErr)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured.go
new file mode 100644
index 0000000000..fdb0c86297
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured.go
@@ -0,0 +1,493 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructured
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// Unstructured allows objects that do not have Golang structs registered to be manipulated
+// generically. This can be used to deal with the API objects from a plug-in. Unstructured
+// objects still have functioning TypeMeta features-- kind, version, etc.
+//
+// WARNING: This object has accessors for the v1 standard metadata. You *MUST NOT* use this
+// type if you are dealing with objects that are not in the server meta v1 schema.
+//
+// TODO: make the serialization part of this type distinct from the field accessors.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:deepcopy-gen=true
+type Unstructured struct {
+	// Object is a JSON compatible map with string, float, int, bool, []interface{}, or
+	// map[string]interface{}
+	// children.
+	Object map[string]interface{}
+}
+
+var _ metav1.Object = &Unstructured{}
+var _ runtime.Unstructured = &Unstructured{}
+var _ metav1.ListInterface = &Unstructured{}
+
+func (obj *Unstructured) GetObjectKind() schema.ObjectKind { return obj }
+
+func (obj *Unstructured) IsList() bool {
+	field, ok := obj.Object["items"]
+	if !ok {
+		return false
+	}
+	_, ok = field.([]interface{})
+	return ok
+}
+func (obj *Unstructured) ToList() (*UnstructuredList, error) {
+	if !obj.IsList() {
+		// return an empty list back
+		return &UnstructuredList{Object: obj.Object}, nil
+	}
+
+	ret := &UnstructuredList{}
+	ret.Object = obj.Object
+
+	err := obj.EachListItem(func(item runtime.Object) error {
+		castItem := item.(*Unstructured)
+		ret.Items = append(ret.Items, *castItem)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return ret, nil
+}
+
+func (obj *Unstructured) EachListItem(fn func(runtime.Object) error) error {
+	field, ok := obj.Object["items"]
+	if !ok {
+		return errors.New("content is not a list")
+	}
+	items, ok := field.([]interface{})
+	if !ok {
+		return fmt.Errorf("content is not a list: %T", field)
+	}
+	for _, item := range items {
+		child, ok := item.(map[string]interface{})
+		if !ok {
+			return fmt.Errorf("items member is not an object: %T", child)
+		}
+		if err := fn(&Unstructured{Object: child}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (obj *Unstructured) EachListItemWithAlloc(fn func(runtime.Object) error) error {
+	// EachListItem has allocated a new Object for the user, we can use it directly.
+	return obj.EachListItem(fn)
+}
+
+func (obj *Unstructured) UnstructuredContent() map[string]interface{} {
+	if obj.Object == nil {
+		return make(map[string]interface{})
+	}
+	return obj.Object
+}
+
+func (obj *Unstructured) SetUnstructuredContent(content map[string]interface{}) {
+	obj.Object = content
+}
+
+// MarshalJSON ensures that the unstructured object produces proper
+// JSON when passed to Go's standard JSON library.
+func (u *Unstructured) MarshalJSON() ([]byte, error) {
+	var buf bytes.Buffer
+	err := UnstructuredJSONScheme.Encode(u, &buf)
+	return buf.Bytes(), err
+}
+
+// UnmarshalJSON ensures that the unstructured object properly decodes
+// JSON when passed to Go's standard JSON library.
+func (u *Unstructured) UnmarshalJSON(b []byte) error {
+	_, _, err := UnstructuredJSONScheme.Decode(b, nil, u)
+	return err
+}
+
+// NewEmptyInstance returns a new instance of the concrete type containing only kind/apiVersion and no other data.
+// This should be called instead of reflect.New() for unstructured types because the go type alone does not preserve kind/apiVersion info.
+func (in *Unstructured) NewEmptyInstance() runtime.Unstructured {
+	out := new(Unstructured)
+	if in != nil {
+		out.GetObjectKind().SetGroupVersionKind(in.GetObjectKind().GroupVersionKind())
+	}
+	return out
+}
+
+func (in *Unstructured) DeepCopy() *Unstructured {
+	if in == nil {
+		return nil
+	}
+	out := new(Unstructured)
+	*out = *in
+	out.Object = runtime.DeepCopyJSON(in.Object)
+	return out
+}
+
+func (u *Unstructured) setNestedField(value interface{}, fields ...string) {
+	if u.Object == nil {
+		u.Object = make(map[string]interface{})
+	}
+	SetNestedField(u.Object, value, fields...)
+}
+
+func (u *Unstructured) setNestedStringSlice(value []string, fields ...string) {
+	if u.Object == nil {
+		u.Object = make(map[string]interface{})
+	}
+	SetNestedStringSlice(u.Object, value, fields...)
+}
+
+func (u *Unstructured) setNestedSlice(value []interface{}, fields ...string) {
+	if u.Object == nil {
+		u.Object = make(map[string]interface{})
+	}
+	SetNestedSlice(u.Object, value, fields...)
+}
+
+func (u *Unstructured) setNestedMap(value map[string]string, fields ...string) {
+	if u.Object == nil {
+		u.Object = make(map[string]interface{})
+	}
+	SetNestedStringMap(u.Object, value, fields...)
+}
+
+func (u *Unstructured) GetOwnerReferences() []metav1.OwnerReference {
+	field, found, err := NestedFieldNoCopy(u.Object, "metadata", "ownerReferences")
+	if !found || err != nil {
+		return nil
+	}
+	original, ok := field.([]interface{})
+	if !ok {
+		return nil
+	}
+	ret := make([]metav1.OwnerReference, 0, len(original))
+	for _, obj := range original {
+		o, ok := obj.(map[string]interface{})
+		if !ok {
+			// expected map[string]interface{}, got something else
+			return nil
+		}
+		ret = append(ret, extractOwnerReference(o))
+	}
+	return ret
+}
+
+func (u *Unstructured) SetOwnerReferences(references []metav1.OwnerReference) {
+	if references == nil {
+		RemoveNestedField(u.Object, "metadata", "ownerReferences")
+		return
+	}
+
+	newReferences := make([]interface{}, 0, len(references))
+	for _, reference := range references {
+		out, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&reference)
+		if err != nil {
+			utilruntime.HandleError(fmt.Errorf("unable to convert Owner Reference: %v", err))
+			continue
+		}
+		newReferences = append(newReferences, out)
+	}
+	u.setNestedField(newReferences, "metadata", "ownerReferences")
+}
+
+func (u *Unstructured) GetAPIVersion() string {
+	return getNestedString(u.Object, "apiVersion")
+}
+
+func (u *Unstructured) SetAPIVersion(version string) {
+	u.setNestedField(version, "apiVersion")
+}
+
+func (u *Unstructured) GetKind() string {
+	return getNestedString(u.Object, "kind")
+}
+
+func (u *Unstructured) SetKind(kind string) {
+	u.setNestedField(kind, "kind")
+}
+
+func (u *Unstructured) GetNamespace() string {
+	return getNestedString(u.Object, "metadata", "namespace")
+}
+
+func (u *Unstructured) SetNamespace(namespace string) {
+	if len(namespace) == 0 {
+		RemoveNestedField(u.Object, "metadata", "namespace")
+		return
+	}
+	u.setNestedField(namespace, "metadata", "namespace")
+}
+
+func (u *Unstructured) GetName() string {
+	return getNestedString(u.Object, "metadata", "name")
+}
+
+func (u *Unstructured) SetName(name string) {
+	if len(name) == 0 {
+		RemoveNestedField(u.Object, "metadata", "name")
+		return
+	}
+	u.setNestedField(name, "metadata", "name")
+}
+
+func (u *Unstructured) GetGenerateName() string {
+	return getNestedString(u.Object, "metadata", "generateName")
+}
+
+func (u *Unstructured) SetGenerateName(generateName string) {
+	if len(generateName) == 0 {
+		RemoveNestedField(u.Object, "metadata", "generateName")
+		return
+	}
+	u.setNestedField(generateName, "metadata", "generateName")
+}
+
+func (u *Unstructured) GetUID() types.UID {
+	return types.UID(getNestedString(u.Object, "metadata", "uid"))
+}
+
+func (u *Unstructured) SetUID(uid types.UID) {
+	if len(string(uid)) == 0 {
+		RemoveNestedField(u.Object, "metadata", "uid")
+		return
+	}
+	u.setNestedField(string(uid), "metadata", "uid")
+}
+
+func (u *Unstructured) GetResourceVersion() string {
+	return getNestedString(u.Object, "metadata", "resourceVersion")
+}
+
+func (u *Unstructured) SetResourceVersion(resourceVersion string) {
+	if len(resourceVersion) == 0 {
+		RemoveNestedField(u.Object, "metadata", "resourceVersion")
+		return
+	}
+	u.setNestedField(resourceVersion, "metadata", "resourceVersion")
+}
+
+func (u *Unstructured) GetGeneration() int64 {
+	val, found, err := NestedInt64(u.Object, "metadata", "generation")
+	if !found || err != nil {
+		return 0
+	}
+	return val
+}
+
+func (u *Unstructured) SetGeneration(generation int64) {
+	if generation == 0 {
+		RemoveNestedField(u.Object, "metadata", "generation")
+		return
+	}
+	u.setNestedField(generation, "metadata", "generation")
+}
+
+func (u *Unstructured) GetSelfLink() string {
+	return getNestedString(u.Object, "metadata", "selfLink")
+}
+
+func (u *Unstructured) SetSelfLink(selfLink string) {
+	if len(selfLink) == 0 {
+		RemoveNestedField(u.Object, "metadata", "selfLink")
+		return
+	}
+	u.setNestedField(selfLink, "metadata", "selfLink")
+}
+
+func (u *Unstructured) GetContinue() string {
+	return getNestedString(u.Object, "metadata", "continue")
+}
+
+func (u *Unstructured) SetContinue(c string) {
+	if len(c) == 0 {
+		RemoveNestedField(u.Object, "metadata", "continue")
+		return
+	}
+	u.setNestedField(c, "metadata", "continue")
+}
+
+func (u *Unstructured) GetRemainingItemCount() *int64 {
+	return getNestedInt64Pointer(u.Object, "metadata", "remainingItemCount")
+}
+
+func (u *Unstructured) SetRemainingItemCount(c *int64) {
+	if c == nil {
+		RemoveNestedField(u.Object, "metadata", "remainingItemCount")
+	} else {
+		u.setNestedField(*c, "metadata", "remainingItemCount")
+	}
+}
+
+func (u *Unstructured) GetCreationTimestamp() metav1.Time {
+	var timestamp metav1.Time
+	timestamp.UnmarshalQueryParameter(getNestedString(u.Object, "metadata", "creationTimestamp"))
+	return timestamp
+}
+
+func (u *Unstructured) SetCreationTimestamp(timestamp metav1.Time) {
+	ts, _ := timestamp.MarshalQueryParameter()
+	if len(ts) == 0 || timestamp.Time.IsZero() {
+		RemoveNestedField(u.Object, "metadata", "creationTimestamp")
+		return
+	}
+	u.setNestedField(ts, "metadata", "creationTimestamp")
+}
+
+func (u *Unstructured) GetDeletionTimestamp() *metav1.Time {
+	var timestamp metav1.Time
+	timestamp.UnmarshalQueryParameter(getNestedString(u.Object, "metadata", "deletionTimestamp"))
+	if timestamp.IsZero() {
+		return nil
+	}
+	return &timestamp
+}
+
+func (u *Unstructured) SetDeletionTimestamp(timestamp *metav1.Time) {
+	if timestamp == nil {
+		RemoveNestedField(u.Object, "metadata", "deletionTimestamp")
+		return
+	}
+	ts, _ := timestamp.MarshalQueryParameter()
+	u.setNestedField(ts, "metadata", "deletionTimestamp")
+}
+
+func (u *Unstructured) GetDeletionGracePeriodSeconds() *int64 {
+	val, found, err := NestedInt64(u.Object, "metadata", "deletionGracePeriodSeconds")
+	if !found || err != nil {
+		return nil
+	}
+	return &val
+}
+
+func (u *Unstructured) SetDeletionGracePeriodSeconds(deletionGracePeriodSeconds *int64) {
+	if deletionGracePeriodSeconds == nil {
+		RemoveNestedField(u.Object, "metadata", "deletionGracePeriodSeconds")
+		return
+	}
+	u.setNestedField(*deletionGracePeriodSeconds, "metadata", "deletionGracePeriodSeconds")
+}
+
+func (u *Unstructured) GetLabels() map[string]string {
+	m, _, _ := NestedNullCoercingStringMap(u.Object, "metadata", "labels")
+	return m
+}
+
+func (u *Unstructured) SetLabels(labels map[string]string) {
+	if labels == nil {
+		RemoveNestedField(u.Object, "metadata", "labels")
+		return
+	}
+	u.setNestedMap(labels, "metadata", "labels")
+}
+
+func (u *Unstructured) GetAnnotations() map[string]string {
+	m, _, _ := NestedNullCoercingStringMap(u.Object, "metadata", "annotations")
+	return m
+}
+
+func (u *Unstructured) SetAnnotations(annotations map[string]string) {
+	if annotations == nil {
+		RemoveNestedField(u.Object, "metadata", "annotations")
+		return
+	}
+	u.setNestedMap(annotations, "metadata", "annotations")
+}
+
+func (u *Unstructured) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	u.SetAPIVersion(gvk.GroupVersion().String())
+	u.SetKind(gvk.Kind)
+}
+
+func (u *Unstructured) GroupVersionKind() schema.GroupVersionKind {
+	gv, err := schema.ParseGroupVersion(u.GetAPIVersion())
+	if err != nil {
+		return schema.GroupVersionKind{}
+	}
+	gvk := gv.WithKind(u.GetKind())
+	return gvk
+}
+
+func (u *Unstructured) GetFinalizers() []string {
+	val, _, _ := NestedStringSlice(u.Object, "metadata", "finalizers")
+	return val
+}
+
+func (u *Unstructured) SetFinalizers(finalizers []string) {
+	if finalizers == nil {
+		RemoveNestedField(u.Object, "metadata", "finalizers")
+		return
+	}
+	u.setNestedStringSlice(finalizers, "metadata", "finalizers")
+}
+
+func (u *Unstructured) GetManagedFields() []metav1.ManagedFieldsEntry {
+	v, found, err := NestedFieldNoCopy(u.Object, "metadata", "managedFields")
+	if !found || err != nil {
+		return nil
+	}
+	items, ok := v.([]interface{})
+	if !ok {
+		return nil
+	}
+	managedFields := []metav1.ManagedFieldsEntry{}
+	for _, item := range items {
+		m, ok := item.(map[string]interface{})
+		if !ok {
+			utilruntime.HandleError(fmt.Errorf("unable to retrieve managedFields for object, item %v is not a map", item))
+			return nil
+		}
+		out := metav1.ManagedFieldsEntry{}
+		if err := runtime.DefaultUnstructuredConverter.FromUnstructured(m, &out); err != nil {
+			utilruntime.HandleError(fmt.Errorf("unable to retrieve managedFields for object: %v", err))
+			return nil
+		}
+		managedFields = append(managedFields, out)
+	}
+	return managedFields
+}
+
+func (u *Unstructured) SetManagedFields(managedFields []metav1.ManagedFieldsEntry) {
+	if managedFields == nil {
+		RemoveNestedField(u.Object, "metadata", "managedFields")
+		return
+	}
+	items := []interface{}{}
+	for _, managedFieldsEntry := range managedFields {
+		out, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&managedFieldsEntry)
+		if err != nil {
+			utilruntime.HandleError(fmt.Errorf("unable to set managedFields for object: %v", err))
+			return
+		}
+		items = append(items, out)
+	}
+	u.setNestedSlice(items, "metadata", "managedFields")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_conversion_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_conversion_test.go
new file mode 100644
index 0000000000..8b4d092ec7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_conversion_test.go
@@ -0,0 +1,532 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructured_test
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	testapigroupv1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/test"
+)
+
+func TestObjectToUnstructuredConversion(t *testing.T) {
+	scheme, _ := test.TestScheme()
+	testCases := []struct {
+		name                          string
+		objectToConvert               runtime.Object
+		expectedErr                   error
+		expectedConvertedUnstructured *unstructured.Unstructured
+	}{
+		{
+			name:                          "convert nil object to unstructured should fail",
+			objectToConvert:               nil,
+			expectedErr:                   fmt.Errorf("unable to convert object type <nil> to Unstructured, must be a runtime.Object"),
+			expectedConvertedUnstructured: &unstructured.Unstructured{},
+		},
+		{
+			name:            "convert versioned empty object to unstructured should work",
+			objectToConvert: &testapigroupv1.Carp{},
+			expectedConvertedUnstructured: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata":   map[string]interface{}{},
+					"spec":       map[string]interface{}{},
+					"status":     map[string]interface{}{},
+				},
+			},
+		},
+		{
+			name: "convert valid versioned object to unstructured should work",
+			objectToConvert: &testapigroupv1.Carp{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "noxu",
+				},
+				Spec: testapigroupv1.CarpSpec{
+					Hostname: "example.com",
+				},
+			},
+			expectedConvertedUnstructured: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+		},
+		{
+			name:            "convert hub-versioned object to unstructured should fail",
+			objectToConvert: &testapigroup.Carp{},
+			expectedErr:     fmt.Errorf("unable to convert the internal object type *testapigroup.Carp to Unstructured without providing a preferred version to convert to"),
+		},
+	}
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			outUnstructured := &unstructured.Unstructured{}
+			err := scheme.Convert(testCase.objectToConvert, outUnstructured, nil)
+			if err != nil {
+				assert.Equal(t, testCase.expectedErr, err)
+				return
+			}
+			assert.Equal(t, testCase.expectedConvertedUnstructured, outUnstructured)
+		})
+	}
+}
+
+func TestUnstructuredToObjectConversion(t *testing.T) {
+	scheme, _ := test.TestScheme()
+	testCases := []struct {
+		name                    string
+		unstructuredToConvert   *unstructured.Unstructured
+		convertingObject        runtime.Object
+		expectPanic             bool
+		expectedErrFunc         func(err error) bool
+		expectedConvertedObject runtime.Object
+	}{
+		{
+			name: "convert empty unstructured w/o gvk to versioned object should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{},
+			},
+			convertingObject: &testapigroupv1.Carp{},
+			expectedErrFunc: func(err error) bool {
+				return reflect.DeepEqual(err, runtime.NewMissingKindErr("unstructured object has no kind"))
+			},
+		},
+		{
+			name: "convert empty versioned unstructured to versioned object should work",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+				},
+			},
+			convertingObject:        &testapigroupv1.Carp{},
+			expectedConvertedObject: &testapigroupv1.Carp{},
+		},
+		{
+			name: "convert empty unstructured w/o gvk to versioned object should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{},
+			},
+			convertingObject: &testapigroupv1.Carp{},
+			expectedErrFunc: func(err error) bool {
+				return reflect.DeepEqual(err, runtime.NewMissingKindErr("unstructured object has no kind"))
+			},
+		},
+		{
+			name: "convert valid versioned unstructured to versioned object should work",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+			convertingObject: &testapigroupv1.Carp{},
+			expectedConvertedObject: &testapigroupv1.Carp{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "noxu",
+				},
+				Spec: testapigroupv1.CarpSpec{
+					Hostname: "example.com",
+				},
+			},
+		},
+		{
+			name: "convert valid versioned unstructured to hub-versioned object should work",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+			convertingObject: &testapigroup.Carp{},
+			expectedConvertedObject: &testapigroup.Carp{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "noxu",
+				},
+				Spec: testapigroup.CarpSpec{
+					Hostname: "example.com",
+				},
+			},
+		},
+		{
+			name: "convert unexisting-versioned unstructured to hub-versioned object should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v9",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+			convertingObject: &testapigroup.Carp{},
+			expectedErrFunc: func(err error) bool {
+				return reflect.DeepEqual(err, runtime.NewNotRegisteredGVKErrForTarget(
+					scheme.Name(),
+					schema.GroupVersionKind{Group: "", Version: "v9", Kind: "Carp"},
+					nil,
+				))
+			},
+		},
+		{
+			name: "convert valid versioned unstructured to object w/ a mismatching kind should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+			convertingObject: &metav1.CreateOptions{},
+			expectedErrFunc: func(err error) bool {
+				return strings.HasPrefix(err.Error(), "converting (v1.Carp) to (v1.CreateOptions):")
+			},
+		},
+	}
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			defer func() {
+				v := recover()
+				assert.Equal(t, testCase.expectPanic, v != nil, "unexpected panic")
+			}()
+			outObject := testCase.convertingObject.DeepCopyObject()
+			// Convert by specifying destination object
+			err := scheme.Convert(testCase.unstructuredToConvert, outObject, nil)
+			if err != nil {
+				if testCase.expectedErrFunc != nil {
+					if !testCase.expectedErrFunc(err) {
+						t.Errorf("error mismatched: %v", err)
+					}
+				}
+				return
+			}
+			assert.Equal(t, testCase.expectedConvertedObject, outObject)
+		})
+	}
+}
+
+func TestUnstructuredToGVConversion(t *testing.T) {
+	scheme, _ := test.TestScheme()
+	// HACK: registering fake internal/v1beta1 api
+	scheme.AddKnownTypes(schema.GroupVersion{Group: "foo", Version: "v1beta1"}, &testapigroup.Carp{})
+	scheme.AddKnownTypes(schema.GroupVersion{Group: "foo", Version: "__internal"}, &testapigroup.Carp{})
+
+	testCases := []struct {
+		name                    string
+		unstructuredToConvert   *unstructured.Unstructured
+		targetGV                schema.GroupVersion
+		expectPanic             bool
+		expectedErrFunc         func(err error) bool
+		expectedConvertedObject runtime.Object
+	}{
+		{
+			name: "convert versioned unstructured to valid external version should work",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+				},
+			},
+			targetGV: schema.GroupVersion{Group: "", Version: "v1"},
+			expectedConvertedObject: &testapigroupv1.Carp{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "v1",
+					Kind:       "Carp",
+				},
+			},
+		},
+		{
+			name: "convert hub-versioned unstructured to hub version should work",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "__internal",
+					"kind":       "Carp",
+				},
+			},
+			targetGV:                schema.GroupVersion{Group: "", Version: "__internal"},
+			expectedConvertedObject: &testapigroup.Carp{},
+		},
+		{
+			name: "convert empty unstructured w/o gvk to versioned should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{},
+			},
+			targetGV: schema.GroupVersion{Group: "", Version: "v1"},
+			expectedErrFunc: func(err error) bool {
+				return reflect.DeepEqual(err, runtime.NewMissingKindErr("unstructured object has no kind"))
+			},
+			expectedConvertedObject: nil,
+		},
+		{
+			name: "convert versioned unstructured to mismatching external version should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+				},
+			},
+			targetGV: schema.GroupVersion{Group: "foo", Version: "v1beta1"},
+			expectedErrFunc: func(err error) bool {
+				return reflect.DeepEqual(err, runtime.NewNotRegisteredErrForTarget(
+					scheme.Name(), reflect.TypeOf(testapigroupv1.Carp{}), schema.GroupVersion{Group: "foo", Version: "v1beta1"}))
+			},
+			expectedConvertedObject: nil,
+		},
+		{
+			name: "convert versioned unstructured to mismatching internal version should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+				},
+			},
+			targetGV: schema.GroupVersion{Group: "foo", Version: "__internal"},
+			expectedErrFunc: func(err error) bool {
+				return reflect.DeepEqual(err, runtime.NewNotRegisteredErrForTarget(
+					scheme.Name(), reflect.TypeOf(testapigroupv1.Carp{}), schema.GroupVersion{Group: "foo", Version: "__internal"}))
+			},
+			expectedConvertedObject: nil,
+		},
+		{
+			name: "convert valid versioned unstructured to its own version should work",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+			targetGV: schema.GroupVersion{Group: "", Version: "v1"},
+			expectedConvertedObject: &testapigroupv1.Carp{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "v1",
+					Kind:       "Carp",
+				},
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "noxu",
+				},
+				Spec: testapigroupv1.CarpSpec{
+					Hostname: "example.com",
+				},
+			},
+		},
+		{
+			name: "convert valid versioned unstructured to hub-version should work ignoring type meta",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+			targetGV: schema.GroupVersion{Group: "", Version: "__internal"},
+			expectedConvertedObject: &testapigroup.Carp{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "noxu",
+				},
+				Spec: testapigroup.CarpSpec{
+					Hostname: "example.com",
+				},
+			},
+		},
+		{
+			name: "convert valid versioned unstructured to unexisting version should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+			targetGV: schema.GroupVersion{Group: "", Version: "v9"},
+			expectedErrFunc: func(err error) bool {
+				return reflect.DeepEqual(err, runtime.NewNotRegisteredGVKErrForTarget(
+					scheme.Name(),
+					schema.GroupVersionKind{Group: "", Version: "v9", Kind: "Carp"},
+					nil,
+				))
+			},
+			expectedConvertedObject: nil,
+		},
+	}
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			defer func() {
+				v := recover()
+				assert.Equal(t, testCase.expectPanic, v != nil, "unexpected panic")
+			}()
+			// Convert by specifying destination object
+			outObject, err := scheme.ConvertToVersion(testCase.unstructuredToConvert, testCase.targetGV)
+			if testCase.expectedErrFunc != nil {
+				if !testCase.expectedErrFunc(err) {
+					t.Errorf("error mismatched: %v", err)
+				}
+			}
+			assert.Equal(t, testCase.expectedConvertedObject, outObject)
+		})
+	}
+}
+
+func TestUnstructuredToUnstructuredConversion(t *testing.T) {
+	// eventually, we don't want any inter-unstructured conversion happen, but for now, the conversion
+	// just copy/pastes
+	scheme, _ := test.TestScheme()
+	inUnstructured := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "Carp",
+		},
+	}
+	outUnstructured := &unstructured.Unstructured{}
+	err := scheme.Convert(inUnstructured, outUnstructured, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, inUnstructured, outUnstructured)
+}
+
+func benchmarkCarp() *testapigroupv1.Carp {
+	t := metav1.Date(2015, 1, 1, 12, 0, 0, 0, time.UTC)
+	return &testapigroupv1.Carp{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "name",
+			Namespace: "namespace",
+		},
+		Spec: testapigroupv1.CarpSpec{
+			RestartPolicy: "restart",
+			NodeSelector: map[string]string{
+				"label1": "value1",
+				"label2": "value2",
+			},
+			ServiceAccountName: "service-account",
+			HostNetwork:        false,
+			HostPID:            true,
+			Subdomain:          "hostname.subdomain.namespace.svc.domain",
+		},
+		Status: testapigroupv1.CarpStatus{
+			Phase: "phase",
+			Conditions: []testapigroupv1.CarpCondition{
+				{
+					Type:               "condition1",
+					Status:             "true",
+					LastProbeTime:      t,
+					LastTransitionTime: t,
+					Reason:             "reason",
+					Message:            "message",
+				},
+			},
+			Message: "message",
+			Reason:  "reason",
+			HostIP:  "1.2.3.4",
+		},
+	}
+}
+
+func BenchmarkToUnstructured(b *testing.B) {
+	carp := benchmarkCarp()
+	converter := runtime.DefaultUnstructuredConverter
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+		result, err := converter.ToUnstructured(carp)
+		if err != nil {
+			b.Fatalf("Unexpected conversion error: %v", err)
+		}
+		if len(result) != 3 {
+			b.Errorf("Unexpected conversion result: %#v", result)
+		}
+	}
+}
+
+func BenchmarkFromUnstructured(b *testing.B) {
+	carp := benchmarkCarp()
+	converter := runtime.DefaultUnstructuredConverter
+	unstr, err := converter.ToUnstructured(carp)
+	if err != nil {
+		b.Fatalf("Unexpected conversion error: %v", err)
+	}
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+		result := testapigroupv1.Carp{}
+		if err := converter.FromUnstructured(unstr, &result); err != nil {
+			b.Fatalf("Unexpected conversion error: %v", err)
+		}
+		if result.Status.Phase != "phase" {
+			b.Errorf("Unexpected conversion result: %#v", result)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_list.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_list.go
new file mode 100644
index 0000000000..82beda2a29
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_list.go
@@ -0,0 +1,219 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructured
+
+import (
+	"bytes"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var _ runtime.Unstructured = &UnstructuredList{}
+var _ metav1.ListInterface = &UnstructuredList{}
+
+// UnstructuredList allows lists that do not have Golang structs
+// registered to be manipulated generically. This can be used to deal
+// with the API lists from a plug-in.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:deepcopy-gen=true
+type UnstructuredList struct {
+	Object map[string]interface{}
+
+	// Items is a list of unstructured objects.
+	Items []Unstructured `json:"items"`
+}
+
+func (u *UnstructuredList) GetObjectKind() schema.ObjectKind { return u }
+
+func (u *UnstructuredList) IsList() bool { return true }
+
+func (u *UnstructuredList) EachListItem(fn func(runtime.Object) error) error {
+	for i := range u.Items {
+		if err := fn(&u.Items[i]); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (u *UnstructuredList) EachListItemWithAlloc(fn func(runtime.Object) error) error {
+	for i := range u.Items {
+		if err := fn(&Unstructured{Object: u.Items[i].Object}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// NewEmptyInstance returns a new instance of the concrete type containing only kind/apiVersion and no other data.
+// This should be called instead of reflect.New() for unstructured types because the go type alone does not preserve kind/apiVersion info.
+func (u *UnstructuredList) NewEmptyInstance() runtime.Unstructured {
+	out := new(UnstructuredList)
+	if u != nil {
+		out.SetGroupVersionKind(u.GroupVersionKind())
+	}
+	return out
+}
+
+// UnstructuredContent returns a map contain an overlay of the Items field onto
+// the Object field. Items always overwrites overlay.
+func (u *UnstructuredList) UnstructuredContent() map[string]interface{} {
+	out := make(map[string]interface{}, len(u.Object)+1)
+
+	// shallow copy every property
+	for k, v := range u.Object {
+		out[k] = v
+	}
+
+	items := make([]interface{}, len(u.Items))
+	for i, item := range u.Items {
+		items[i] = item.UnstructuredContent()
+	}
+	out["items"] = items
+	return out
+}
+
+// SetUnstructuredContent obeys the conventions of List and keeps Items and the items
+// array in sync. If items is not an array of objects in the incoming map, then any
+// mismatched item will be removed.
+func (obj *UnstructuredList) SetUnstructuredContent(content map[string]interface{}) {
+	obj.Object = content
+	if content == nil {
+		obj.Items = nil
+		return
+	}
+	items, ok := obj.Object["items"].([]interface{})
+	if !ok || items == nil {
+		items = []interface{}{}
+	}
+	unstructuredItems := make([]Unstructured, 0, len(items))
+	newItems := make([]interface{}, 0, len(items))
+	for _, item := range items {
+		o, ok := item.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		unstructuredItems = append(unstructuredItems, Unstructured{Object: o})
+		newItems = append(newItems, o)
+	}
+	obj.Items = unstructuredItems
+	obj.Object["items"] = newItems
+}
+
+func (u *UnstructuredList) DeepCopy() *UnstructuredList {
+	if u == nil {
+		return nil
+	}
+	out := new(UnstructuredList)
+	*out = *u
+	out.Object = runtime.DeepCopyJSON(u.Object)
+	out.Items = make([]Unstructured, len(u.Items))
+	for i := range u.Items {
+		u.Items[i].DeepCopyInto(&out.Items[i])
+	}
+	return out
+}
+
+// MarshalJSON ensures that the unstructured list object produces proper
+// JSON when passed to Go's standard JSON library.
+func (u *UnstructuredList) MarshalJSON() ([]byte, error) {
+	var buf bytes.Buffer
+	err := UnstructuredJSONScheme.Encode(u, &buf)
+	return buf.Bytes(), err
+}
+
+// UnmarshalJSON ensures that the unstructured list object properly
+// decodes JSON when passed to Go's standard JSON library.
+func (u *UnstructuredList) UnmarshalJSON(b []byte) error {
+	_, _, err := UnstructuredJSONScheme.Decode(b, nil, u)
+	return err
+}
+
+func (u *UnstructuredList) GetAPIVersion() string {
+	return getNestedString(u.Object, "apiVersion")
+}
+
+func (u *UnstructuredList) SetAPIVersion(version string) {
+	u.setNestedField(version, "apiVersion")
+}
+
+func (u *UnstructuredList) GetKind() string {
+	return getNestedString(u.Object, "kind")
+}
+
+func (u *UnstructuredList) SetKind(kind string) {
+	u.setNestedField(kind, "kind")
+}
+
+func (u *UnstructuredList) GetResourceVersion() string {
+	return getNestedString(u.Object, "metadata", "resourceVersion")
+}
+
+func (u *UnstructuredList) SetResourceVersion(version string) {
+	u.setNestedField(version, "metadata", "resourceVersion")
+}
+
+func (u *UnstructuredList) GetSelfLink() string {
+	return getNestedString(u.Object, "metadata", "selfLink")
+}
+
+func (u *UnstructuredList) SetSelfLink(selfLink string) {
+	u.setNestedField(selfLink, "metadata", "selfLink")
+}
+
+func (u *UnstructuredList) GetContinue() string {
+	return getNestedString(u.Object, "metadata", "continue")
+}
+
+func (u *UnstructuredList) SetContinue(c string) {
+	u.setNestedField(c, "metadata", "continue")
+}
+
+func (u *UnstructuredList) GetRemainingItemCount() *int64 {
+	return getNestedInt64Pointer(u.Object, "metadata", "remainingItemCount")
+}
+
+func (u *UnstructuredList) SetRemainingItemCount(c *int64) {
+	if c == nil {
+		RemoveNestedField(u.Object, "metadata", "remainingItemCount")
+	} else {
+		u.setNestedField(*c, "metadata", "remainingItemCount")
+	}
+}
+
+func (u *UnstructuredList) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	u.SetAPIVersion(gvk.GroupVersion().String())
+	u.SetKind(gvk.Kind)
+}
+
+func (u *UnstructuredList) GroupVersionKind() schema.GroupVersionKind {
+	gv, err := schema.ParseGroupVersion(u.GetAPIVersion())
+	if err != nil {
+		return schema.GroupVersionKind{}
+	}
+	gvk := gv.WithKind(u.GetKind())
+	return gvk
+}
+
+func (u *UnstructuredList) setNestedField(value interface{}, fields ...string) {
+	if u.Object == nil {
+		u.Object = make(map[string]interface{})
+	}
+	SetNestedField(u.Object, value, fields...)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_list_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_list_test.go
new file mode 100644
index 0000000000..d3c42b519a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_list_test.go
@@ -0,0 +1,86 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructured
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUnstructuredList(t *testing.T) {
+	list := &UnstructuredList{
+		Object: map[string]interface{}{"kind": "List", "apiVersion": "v1"},
+		Items: []Unstructured{
+			{Object: map[string]interface{}{"kind": "Pod", "apiVersion": "v1", "metadata": map[string]interface{}{"name": "test"}}},
+		},
+	}
+	content := list.UnstructuredContent()
+	items := content["items"].([]interface{})
+	require.Len(t, items, 1)
+	val, found, err := NestedFieldCopy(items[0].(map[string]interface{}), "metadata", "name")
+	require.True(t, found)
+	require.NoError(t, err)
+	assert.Equal(t, "test", val)
+}
+
+func TestNilDeletionTimestamp(t *testing.T) {
+	var u Unstructured
+	del := u.GetDeletionTimestamp()
+	if del != nil {
+		t.Errorf("unexpected non-nil deletion timestamp: %v", del)
+	}
+	u.SetDeletionTimestamp(u.GetDeletionTimestamp())
+	del = u.GetDeletionTimestamp()
+	if del != nil {
+		t.Errorf("unexpected non-nil deletion timestamp: %v", del)
+	}
+	_, ok := u.Object["metadata"]
+	assert.False(t, ok)
+
+	now := metav1.Now()
+	u.SetDeletionTimestamp(&now)
+	assert.Equal(t, now.Unix(), u.GetDeletionTimestamp().Unix())
+	u.SetDeletionTimestamp(nil)
+	metadata := u.Object["metadata"].(map[string]interface{})
+	_, ok = metadata["deletionTimestamp"]
+	assert.False(t, ok)
+}
+
+func TestEmptyCreationTimestampIsOmitted(t *testing.T) {
+	var u Unstructured
+	now := metav1.Now()
+
+	// set an initial creationTimestamp and ensure the field exists
+	u.SetCreationTimestamp(now)
+	metadata := u.Object["metadata"].(map[string]interface{})
+	_, exists := metadata["creationTimestamp"]
+	if !exists {
+		t.Fatalf("unexpected missing creationTimestamp")
+	}
+
+	// set an empty timestamp and ensure the field no longer exists
+	u.SetCreationTimestamp(metav1.Time{})
+	metadata = u.Object["metadata"].(map[string]interface{})
+	creationTimestamp, exists := metadata["creationTimestamp"]
+	if exists {
+		t.Errorf("unexpected creation timestamp field: %q", creationTimestamp)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_test.go
new file mode 100644
index 0000000000..889083eccb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_test.go
@@ -0,0 +1,476 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructured_test
+
+import (
+	"bytes"
+	"math/big"
+	"math/rand"
+	"os"
+	"reflect"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/randfill"
+
+	"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
+	"k8s.io/apimachinery/pkg/api/equality"
+	metafuzzer "k8s.io/apimachinery/pkg/apis/meta/fuzzer"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	cborserializer "k8s.io/apimachinery/pkg/runtime/serializer/cbor"
+	jsonserializer "k8s.io/apimachinery/pkg/runtime/serializer/json"
+)
+
+func TestNilUnstructuredContent(t *testing.T) {
+	var u unstructured.Unstructured
+	uCopy := u.DeepCopy()
+	content := u.UnstructuredContent()
+	expContent := make(map[string]interface{})
+	assert.EqualValues(t, expContent, content)
+	assert.Equal(t, uCopy, &u)
+}
+
+// TestUnstructuredMetadataRoundTrip checks that metadata accessors
+// correctly set the metadata for unstructured objects.
+// First, it fuzzes an empty ObjectMeta and sets this value as the metadata for an unstructured object.
+// Next, it uses metadata accessor methods to set these fuzzed values to another unstructured object.
+// Finally, it checks that both the unstructured objects are equal.
+func TestUnstructuredMetadataRoundTrip(t *testing.T) {
+	scheme := runtime.NewScheme()
+	codecs := serializer.NewCodecFactory(scheme)
+	seed := rand.Int63()
+	fuzzer := fuzzer.FuzzerFor(metafuzzer.Funcs, rand.NewSource(seed), codecs)
+
+	N := 1000
+	for i := 0; i < N; i++ {
+		u := &unstructured.Unstructured{Object: map[string]interface{}{}}
+		uCopy := u.DeepCopy()
+		metadata := &metav1.ObjectMeta{}
+		fuzzer.Fill(metadata)
+
+		if err := setObjectMeta(u, metadata); err != nil {
+			t.Fatalf("unexpected error setting fuzzed ObjectMeta: %v", err)
+		}
+		setObjectMetaUsingAccessors(u, uCopy)
+
+		if !equality.Semantic.DeepEqual(u, uCopy) {
+			t.Errorf("diff: %v", cmp.Diff(u, uCopy))
+		}
+	}
+}
+
+// TestUnstructuredMetadataOmitempty checks that ObjectMeta omitempty
+// semantics are enforced for unstructured objects.
+// The fuzzing test above should catch these cases but this is here just to be safe.
+// Example: the metadata.clusterName field has the omitempty json tag
+// so if it is set to it's zero value (""), it should be removed from the metadata map.
+func TestUnstructuredMetadataOmitempty(t *testing.T) {
+	scheme := runtime.NewScheme()
+	codecs := serializer.NewCodecFactory(scheme)
+	seed := rand.Int63()
+	fuzzer := fuzzer.FuzzerFor(metafuzzer.Funcs, rand.NewSource(seed), codecs)
+
+	// fuzz to make sure we don't miss any function calls below
+	u := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	metadata := &metav1.ObjectMeta{}
+	fuzzer.Fill(metadata)
+	if err := setObjectMeta(u, metadata); err != nil {
+		t.Fatalf("unexpected error setting fuzzed ObjectMeta: %v", err)
+	}
+
+	// set zero values for all fields in metadata explicitly
+	// to check that omitempty fields having zero values are never set
+	u.SetName("")
+	u.SetGenerateName("")
+	u.SetNamespace("")
+	u.SetSelfLink("")
+	u.SetUID("")
+	u.SetResourceVersion("")
+	u.SetGeneration(0)
+	u.SetCreationTimestamp(metav1.Time{})
+	u.SetDeletionTimestamp(nil)
+	u.SetDeletionGracePeriodSeconds(nil)
+	u.SetLabels(nil)
+	u.SetAnnotations(nil)
+	u.SetOwnerReferences(nil)
+	u.SetFinalizers(nil)
+	u.SetManagedFields(nil)
+
+	gotMetadata, _, err := unstructured.NestedFieldNoCopy(u.UnstructuredContent(), "metadata")
+	if err != nil {
+		t.Error(err)
+	}
+	emptyMetadata := make(map[string]interface{})
+
+	if !reflect.DeepEqual(gotMetadata, emptyMetadata) {
+		t.Errorf("expected %v, got %v", emptyMetadata, gotMetadata)
+	}
+}
+
+// TestRoundTripJSONCBORUnstructured performs fuzz testing for roundtrip for
+// unstructured object between JSON and CBOR
+func TestRoundTripJSONCBORUnstructured(t *testing.T) {
+	roundtripType[*unstructured.Unstructured](t)
+}
+
+// TestRoundTripJSONCBORUnstructuredList performs fuzz testing for roundtrip for
+// unstructuredList object between JSON and CBOR
+func TestRoundTripJSONCBORUnstructuredList(t *testing.T) {
+	roundtripType[*unstructured.UnstructuredList](t)
+}
+
+func setObjectMeta(u *unstructured.Unstructured, objectMeta *metav1.ObjectMeta) error {
+	if objectMeta == nil {
+		unstructured.RemoveNestedField(u.UnstructuredContent(), "metadata")
+		return nil
+	}
+	metadata, err := runtime.DefaultUnstructuredConverter.ToUnstructured(objectMeta)
+	if err != nil {
+		return err
+	}
+	u.UnstructuredContent()["metadata"] = metadata
+	return nil
+}
+
+func setObjectMetaUsingAccessors(u, uCopy *unstructured.Unstructured) {
+	uCopy.SetName(u.GetName())
+	uCopy.SetGenerateName(u.GetGenerateName())
+	uCopy.SetNamespace(u.GetNamespace())
+	uCopy.SetSelfLink(u.GetSelfLink())
+	uCopy.SetUID(u.GetUID())
+	uCopy.SetResourceVersion(u.GetResourceVersion())
+	uCopy.SetGeneration(u.GetGeneration())
+	uCopy.SetCreationTimestamp(u.GetCreationTimestamp())
+	uCopy.SetDeletionTimestamp(u.GetDeletionTimestamp())
+	uCopy.SetDeletionGracePeriodSeconds(u.GetDeletionGracePeriodSeconds())
+	uCopy.SetLabels(u.GetLabels())
+	uCopy.SetAnnotations(u.GetAnnotations())
+	uCopy.SetOwnerReferences(u.GetOwnerReferences())
+	uCopy.SetFinalizers(u.GetFinalizers())
+	uCopy.SetManagedFields(u.GetManagedFields())
+}
+
+// roundtripType performs fuzz testing for roundtrip conversion for
+// unstructured or unstructuredList object between two formats (A and B) in forward
+// and backward directions
+// Original and final unstructured/list are compared along with all intermediate ones
+func roundtripType[U runtime.Unstructured](t *testing.T) {
+	scheme := runtime.NewScheme()
+	fuzzer := fuzzer.FuzzerFor(fuzzer.MergeFuzzerFuncs(metafuzzer.Funcs, unstructuredFuzzerFuncs), rand.NewSource(getSeed(t)), serializer.NewCodecFactory(scheme))
+
+	jS := jsonserializer.NewSerializerWithOptions(jsonserializer.DefaultMetaFactory, scheme, scheme, jsonserializer.SerializerOptions{})
+	cS := cborserializer.NewSerializer(scheme, scheme)
+
+	for i := 0; i < 50; i++ {
+		original := reflect.New(reflect.TypeFor[U]().Elem()).Interface().(runtime.Unstructured)
+		fuzzer.Fill(original)
+		// unstructured -> JSON > unstructured > CBOR -> unstructured -> JSON -> unstructured
+		roundtrip(t, original, jS, cS)
+		// unstructured -> CBOR > unstructured > JSON -> unstructured -> CBOR -> unstructured
+		roundtrip(t, original, cS, jS)
+	}
+}
+
+// roundtrip tests that an Unstructured object roundtrips faithfully along the
+// sequence Unstructured -> A -> Unstructured -> B -> Unstructured -> A -> Unstructured,
+// given serializers for two encodings A and B. The final object and both intermediate
+// objects must all be equal to the original.
+func roundtrip(t *testing.T, original runtime.Unstructured, a, b runtime.Serializer) {
+	var buf bytes.Buffer
+
+	buf.Reset()
+	// (original) Unstructured -> A
+	if err := a.Encode(original, &buf); err != nil {
+		t.Fatalf("error encoding original unstructured to A: %v", err)
+	}
+	// A -> intermediate unstructured
+	uA := reflect.New(reflect.TypeOf(original).Elem()).Interface().(runtime.Object)
+	uA, _, err := a.Decode(buf.Bytes(), nil, uA)
+	if err != nil {
+		t.Fatalf("error decoding A to unstructured: %v", err)
+	}
+
+	// Compare original unstructured vs intermediate unstructured
+	tmp, ok := uA.(runtime.Unstructured)
+	if !ok {
+		t.Fatalf("unexpected type %T for unstructured", tmp)
+	}
+	if !unstructuredEqual(t, original, uA.(runtime.Unstructured)) {
+		t.Fatalf("original unstructured differed from unstructured via A: %v", cmp.Diff(original, uA))
+	}
+
+	buf.Reset()
+	// intermediate unstructured -> B
+	if err := b.Encode(uA, &buf); err != nil {
+		t.Fatalf("error encoding unstructured to B: %v", err)
+	}
+	// B -> intermediate unstructured
+	uB := reflect.New(reflect.TypeOf(original).Elem()).Interface().(runtime.Object)
+	uB, _, err = b.Decode(buf.Bytes(), nil, uB)
+	if err != nil {
+		t.Fatalf("error decoding B to unstructured: %v", err)
+	}
+
+	// compare original vs intermediate unstructured
+	tmp, ok = uB.(runtime.Unstructured)
+	if !ok {
+		t.Fatalf("unexpected type %T for unstructured", tmp)
+	}
+	if !unstructuredEqual(t, original, uB.(runtime.Unstructured)) {
+		t.Fatalf("unstructured via A differed from unstructured via B: %v", cmp.Diff(original, uB))
+	}
+
+	// intermediate unstructured -> A
+	buf.Reset()
+	if err := a.Encode(uB, &buf); err != nil {
+		t.Fatalf("error encoding unstructured to A: %v", err)
+	}
+	// A -> final unstructured
+	final := reflect.New(reflect.TypeOf(original).Elem()).Interface().(runtime.Object)
+	final, _, err = a.Decode(buf.Bytes(), nil, final)
+	if err != nil {
+		t.Fatalf("error decoding A to unstructured: %v", err)
+	}
+
+	// Compare original unstructured vs final unstructured
+	tmp, ok = final.(runtime.Unstructured)
+	if !ok {
+		t.Fatalf("unexpected type %T for unstructured", tmp)
+	}
+	if !unstructuredEqual(t, original, final.(runtime.Unstructured)) {
+		t.Errorf("object changed during unstructured->A->unstructured->B->unstructured roundtrip, diff: %s", cmp.Diff(original, final))
+	}
+}
+
+func getSeed(t *testing.T) int64 {
+	seed := int64(time.Now().Nanosecond())
+	if override := os.Getenv("TEST_RAND_SEED"); len(override) > 0 {
+		overrideSeed, err := strconv.ParseInt(override, 10, 64)
+		if err != nil {
+			t.Fatal(err)
+		}
+		seed = overrideSeed
+		t.Logf("using overridden seed: %d", seed)
+	} else {
+		t.Logf("seed (override with TEST_RAND_SEED if desired): %d", seed)
+	}
+	return seed
+}
+
+const (
+	maxUnstructuredDepth  = 64
+	maxUnstructuredFanOut = 5
+)
+
+func unstructuredFuzzerFuncs(codecs serializer.CodecFactory) []interface{} {
+	return []interface{}{
+		func(u *unstructured.Unstructured, c randfill.Continue) {
+			obj := make(map[string]interface{})
+			obj["apiVersion"] = generateValidAPIVersionString(c)
+			obj["kind"] = generateNonEmptyString(c)
+			for j := c.Intn(maxUnstructuredFanOut); j >= 0; j-- {
+				obj[c.String(0)] = generateRandomTypeValue(maxUnstructuredDepth, c)
+			}
+			u.Object = obj
+		},
+		func(ul *unstructured.UnstructuredList, c randfill.Continue) {
+			obj := make(map[string]interface{})
+			obj["apiVersion"] = generateValidAPIVersionString(c)
+			obj["kind"] = generateNonEmptyString(c)
+			for j := c.Intn(maxUnstructuredFanOut); j >= 0; j-- {
+				obj[c.String(0)] = generateRandomTypeValue(maxUnstructuredDepth, c)
+			}
+			for j := c.Intn(maxUnstructuredFanOut); j >= 0; j-- {
+				var item = unstructured.Unstructured{}
+				c.Fill(&item)
+				ul.Items = append(ul.Items, item)
+			}
+			ul.Object = obj
+		},
+	}
+}
+
+func generateNonEmptyString(c randfill.Continue) string {
+	temp := c.String(0)
+	for len(temp) == 0 {
+		temp = c.String(0)
+	}
+	return temp
+}
+
+// generateNonEmptyNoSlashString generates a non-empty string without any slashes
+func generateNonEmptyNoSlashString(c randfill.Continue) string {
+	temp := strings.ReplaceAll(generateNonEmptyString(c), "/", "")
+	for len(temp) == 0 {
+		temp = strings.ReplaceAll(generateNonEmptyString(c), "/", "")
+	}
+	return temp
+}
+
+// generateValidAPIVersionString generates valid apiVersion string with formats:
+// <string>/<string> or <string>
+func generateValidAPIVersionString(c randfill.Continue) string {
+	if c.Bool() {
+		return generateNonEmptyNoSlashString(c) + "/" + generateNonEmptyNoSlashString(c)
+	} else {
+		return generateNonEmptyNoSlashString(c)
+	}
+}
+
+// generateRandomTypeValue generates fuzzed valid JSON data types:
+// 1. numbers (float64, int64)
+// 2. string (utf-8 encodings)
+// 3. boolean
+// 4. array ([]interface{})
+// 5. object (map[string]interface{})
+// 6. null
+// Decoding into unstructured can only produce a nil interface{} value or the
+// concrete types map[string]interface{}, []interface{}, int64, float64, string, and bool
+// If a value of other types is put into an unstructured, it will roundtrip
+// to one of the above list of supported types. For example, if Time type is used,
+// it will be encoded into a RFC 3339 format string such as "2001-02-03T12:34:56Z"
+// and when decoding into Unstructured, there is no information to indicate
+// that this string was originally produced by encoding a metav1.Time.
+// All external-versioned builtin types are exercised through RoundtripToUnstructured
+// in apitesting package. Types like metav1.Time are implicitly being exercised
+// because they appear as fields in those types.
+func generateRandomTypeValue(depth int, c randfill.Continue) interface{} {
+	t := c.Rand.Intn(120)
+	// If the max depth for unstructured is reached, only add non-recursive types
+	// which is 20+ in range
+	if depth == 0 {
+		t = 20 + c.Rand.Intn(120-20)
+	}
+
+	switch {
+	case t < 10:
+		item := make([]interface{}, c.Intn(maxUnstructuredFanOut))
+		for k := range item {
+			item[k] = generateRandomTypeValue(depth-1, c)
+		}
+		return item
+	case t < 20:
+		item := map[string]interface{}{}
+		for j := c.Intn(maxUnstructuredFanOut); j >= 0; j-- {
+			item[c.String(0)] = generateRandomTypeValue(depth-1, c)
+		}
+		return item
+	case t < 40:
+		// Only valid UTF-8 encodings
+		var item string
+		c.Fill(&item)
+		return item
+	case t < 60:
+		var item int64
+		c.Fill(&item)
+		return item
+	case t < 80:
+		var item bool
+		c.Fill(&item)
+		return item
+	case t < 100:
+		return c.Rand.NormFloat64()
+	case t < 120:
+		return nil
+	default:
+		panic("invalid case")
+	}
+}
+
+func unstructuredEqual(t *testing.T, a, b runtime.Unstructured) bool {
+	return anyEqual(t, a.UnstructuredContent(), b.UnstructuredContent())
+}
+
+// numberEqual asserts equality of two numbers which one is int64 and one is float64
+// In JSON, a non-decimal float64 is converted to int64 automatically in case the
+// float64 fits into int64 range. Otherwise, the non-decimal float64 remains a float.
+// As a result, this func does an int64 to float64 conversion using math/big package
+// to ensure the conversion is lossless before comparison.
+func numberEqual(a int64, b float64) bool {
+	// Ensure roundtrip int64 to float64 conversion is lossless
+	f, accuracy := big.NewInt(a).Float64()
+	if accuracy == big.Exact {
+		// Distinction between int64 and float64 is not preserved during JSON roundtrip for all numbers.
+		return f == b
+	}
+	return false
+}
+
+func anyEqual(t *testing.T, a, b interface{}) bool {
+	switch b.(type) {
+	case nil, bool, string, int64, float64, []interface{}, map[string]interface{}:
+	default:
+		t.Fatalf("unexpected value %v of type %T", b, b)
+	}
+
+	switch ac := a.(type) {
+	case nil, bool, string:
+		return ac == b
+	case int64:
+		if bc, ok := b.(float64); ok {
+			return numberEqual(ac, bc)
+		}
+		return ac == b
+	case float64:
+		if bc, ok := b.(int64); ok {
+			return numberEqual(bc, ac)
+		}
+		return ac == b
+	case []interface{}:
+		bc, ok := b.([]interface{})
+		if !ok {
+			return false
+		}
+		if len(ac) != len(bc) {
+			return false
+		}
+		for i, aa := range ac {
+			if !anyEqual(t, aa, bc[i]) {
+				return false
+			}
+		}
+		return true
+	case map[string]interface{}:
+		bc, ok := b.(map[string]interface{})
+		if !ok {
+			return false
+		}
+		if len(ac) != len(bc) {
+			return false
+		}
+		for k, aa := range ac {
+			bb, ok := bc[k]
+			if !ok {
+				return false
+			}
+			if !anyEqual(t, aa, bb) {
+				return false
+			}
+		}
+		return true
+	default:
+		t.Fatalf("unexpected value %v of type %T", a, a)
+	}
+	return true
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructuredscheme/scheme.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructuredscheme/scheme.go
new file mode 100644
index 0000000000..f8f5ec8560
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructuredscheme/scheme.go
@@ -0,0 +1,129 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructuredscheme
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+	"k8s.io/apimachinery/pkg/runtime/serializer/versioning"
+)
+
+var scheme = runtime.NewScheme()
+
+// NewUnstructuredNegotiatedSerializer returns a simple, negotiated serializer
+func NewUnstructuredNegotiatedSerializer() runtime.NegotiatedSerializer {
+	return unstructuredNegotiatedSerializer{
+		scheme:  scheme,
+		typer:   NewUnstructuredObjectTyper(),
+		creator: NewUnstructuredCreator(),
+	}
+}
+
+type unstructuredNegotiatedSerializer struct {
+	scheme  *runtime.Scheme
+	typer   runtime.ObjectTyper
+	creator runtime.ObjectCreater
+}
+
+func (s unstructuredNegotiatedSerializer) SupportedMediaTypes() []runtime.SerializerInfo {
+	return []runtime.SerializerInfo{
+		{
+			MediaType:        "application/json",
+			MediaTypeType:    "application",
+			MediaTypeSubType: "json",
+			EncodesAsText:    true,
+			Serializer:       json.NewSerializerWithOptions(json.DefaultMetaFactory, s.creator, s.typer, json.SerializerOptions{}),
+			PrettySerializer: json.NewSerializerWithOptions(json.DefaultMetaFactory, s.creator, s.typer, json.SerializerOptions{Pretty: true}),
+			StreamSerializer: &runtime.StreamSerializerInfo{
+				EncodesAsText: true,
+				Serializer:    json.NewSerializerWithOptions(json.DefaultMetaFactory, s.creator, s.typer, json.SerializerOptions{}),
+				Framer:        json.Framer,
+			},
+		},
+		{
+			MediaType:        "application/yaml",
+			MediaTypeType:    "application",
+			MediaTypeSubType: "yaml",
+			EncodesAsText:    true,
+			Serializer:       json.NewSerializerWithOptions(json.DefaultMetaFactory, s.creator, s.typer, json.SerializerOptions{Yaml: true}),
+		},
+	}
+}
+
+func (s unstructuredNegotiatedSerializer) EncoderForVersion(encoder runtime.Encoder, gv runtime.GroupVersioner) runtime.Encoder {
+	return versioning.NewDefaultingCodecForScheme(s.scheme, encoder, nil, gv, nil)
+}
+
+func (s unstructuredNegotiatedSerializer) DecoderToVersion(decoder runtime.Decoder, gv runtime.GroupVersioner) runtime.Decoder {
+	return versioning.NewDefaultingCodecForScheme(s.scheme, nil, decoder, nil, gv)
+}
+
+type unstructuredObjectTyper struct {
+}
+
+// NewUnstructuredObjectTyper returns an object typer that can deal with unstructured things
+func NewUnstructuredObjectTyper() runtime.ObjectTyper {
+	return unstructuredObjectTyper{}
+}
+
+func (t unstructuredObjectTyper) ObjectKinds(obj runtime.Object) ([]schema.GroupVersionKind, bool, error) {
+	// Delegate for things other than Unstructured.
+	if _, ok := obj.(runtime.Unstructured); !ok {
+		return nil, false, fmt.Errorf("cannot type %T", obj)
+	}
+	gvk := obj.GetObjectKind().GroupVersionKind()
+	if len(gvk.Kind) == 0 {
+		return nil, false, runtime.NewMissingKindErr("object has no kind field ")
+	}
+	if len(gvk.Version) == 0 {
+		return nil, false, runtime.NewMissingVersionErr("object has no apiVersion field")
+	}
+
+	return []schema.GroupVersionKind{obj.GetObjectKind().GroupVersionKind()}, false, nil
+}
+
+func (t unstructuredObjectTyper) Recognizes(gvk schema.GroupVersionKind) bool {
+	return true
+}
+
+type unstructuredCreator struct{}
+
+// NewUnstructuredCreator returns a simple object creator that always returns an unstructured
+func NewUnstructuredCreator() runtime.ObjectCreater {
+	return unstructuredCreator{}
+}
+
+func (c unstructuredCreator) New(kind schema.GroupVersionKind) (runtime.Object, error) {
+	ret := &unstructured.Unstructured{}
+	ret.SetGroupVersionKind(kind)
+	return ret, nil
+}
+
+type unstructuredDefaulter struct {
+}
+
+// NewUnstructuredDefaulter returns defaulter suitable for unstructured types that doesn't default anything
+func NewUnstructuredDefaulter() runtime.ObjectDefaulter {
+	return unstructuredDefaulter{}
+}
+
+func (d unstructuredDefaulter) Default(in runtime.Object) {
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..fe8250dd6f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/zz_generated.deepcopy.go
@@ -0,0 +1,56 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package unstructured
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Unstructured) DeepCopyInto(out *Unstructured) {
+	clone := in.DeepCopy()
+	*out = *clone
+	return
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Unstructured) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UnstructuredList) DeepCopyInto(out *UnstructuredList) {
+	clone := in.DeepCopy()
+	*out = *clone
+	return
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *UnstructuredList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/doc.go
new file mode 100644
index 0000000000..3b9cb30f2a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/doc.go
@@ -0,0 +1,21 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-input=k8s.io/apimachinery/pkg/apis/meta/v1
+
+// Package validation holds generated validations for meta/v1 types.
+package validation
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation.go
new file mode 100644
index 0000000000..b9ec344270
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation.go
@@ -0,0 +1,433 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+	"unicode"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+
+	"k8s.io/utils/ptr"
+)
+
+// LabelSelectorValidationOptions is a struct that can be passed to ValidateLabelSelector to record the validate options
+type LabelSelectorValidationOptions struct {
+	// Allow invalid label value in selector
+	AllowInvalidLabelValueInSelector bool
+
+	// Allows an operator that is not interpretable to pass validation.  This is useful for cases where a broader check
+	// can be performed, as in a *SubjectAccessReview
+	AllowUnknownOperatorInRequirement bool
+}
+
+// LabelSelectorHasInvalidLabelValue returns true if the given selector contains an invalid label value in a match expression.
+// This is useful for determining whether AllowInvalidLabelValueInSelector should be set to true when validating an update
+// based on existing persisted invalid values.
+func LabelSelectorHasInvalidLabelValue(ps *metav1.LabelSelector) bool {
+	if ps == nil {
+		return false
+	}
+	for _, e := range ps.MatchExpressions {
+		for _, v := range e.Values {
+			if len(validation.IsValidLabelValue(v)) > 0 {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// ValidateLabelSelector validate the LabelSelector according to the opts and returns any validation errors.
+// opts.AllowInvalidLabelValueInSelector is only expected to be set to true when required for backwards compatibility with existing invalid data.
+func ValidateLabelSelector(ps *metav1.LabelSelector, opts LabelSelectorValidationOptions, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	if ps == nil {
+		return allErrs
+	}
+	allErrs = append(allErrs, ValidateLabels(ps.MatchLabels, fldPath.Child("matchLabels"))...)
+	for i, expr := range ps.MatchExpressions {
+		allErrs = append(allErrs, ValidateLabelSelectorRequirement(expr, opts, fldPath.Child("matchExpressions").Index(i))...)
+	}
+	return allErrs
+}
+
+// ValidateLabelSelectorRequirement validate the requirement according to the opts and returns any validation errors.
+// opts.AllowInvalidLabelValueInSelector is only expected to be set to true when required for backwards compatibility with existing invalid data.
+func ValidateLabelSelectorRequirement(sr metav1.LabelSelectorRequirement, opts LabelSelectorValidationOptions, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	switch sr.Operator {
+	case metav1.LabelSelectorOpIn, metav1.LabelSelectorOpNotIn:
+		if len(sr.Values) == 0 {
+			allErrs = append(allErrs, field.Required(fldPath.Child("values"), "must be specified when `operator` is 'In' or 'NotIn'"))
+		}
+	case metav1.LabelSelectorOpExists, metav1.LabelSelectorOpDoesNotExist:
+		if len(sr.Values) > 0 {
+			allErrs = append(allErrs, field.Forbidden(fldPath.Child("values"), "may not be specified when `operator` is 'Exists' or 'DoesNotExist'"))
+		}
+	default:
+		if !opts.AllowUnknownOperatorInRequirement {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("operator"), sr.Operator, "not a valid selector operator"))
+		}
+	}
+	allErrs = append(allErrs, ValidateLabelName(sr.Key, fldPath.Child("key"))...)
+	if !opts.AllowInvalidLabelValueInSelector {
+		for valueIndex, value := range sr.Values {
+			for _, msg := range validation.IsValidLabelValue(value) {
+				allErrs = append(allErrs, field.Invalid(fldPath.Child("values").Index(valueIndex), value, msg))
+			}
+		}
+	}
+	return allErrs
+}
+
+// ValidateLabelName validates that the label name is correctly defined.
+func ValidateLabelName(labelName string, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	for _, msg := range validation.IsQualifiedName(labelName) {
+		allErrs = append(allErrs, field.Invalid(fldPath, labelName, msg).WithOrigin("format=k8s-label-key"))
+	}
+	return allErrs
+}
+
+// ValidateLabels validates that a set of labels are correctly defined.
+func ValidateLabels(labels map[string]string, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	for k, v := range labels {
+		allErrs = append(allErrs, ValidateLabelName(k, fldPath)...)
+		for _, msg := range validation.IsValidLabelValue(v) {
+			allErrs = append(allErrs, field.Invalid(fldPath, v, msg).WithOrigin("format=k8s-label-value"))
+		}
+	}
+	return allErrs
+}
+
+// FieldSelectorValidationOptions is a struct that can be passed to ValidateFieldSelectorRequirement to record the validate options
+type FieldSelectorValidationOptions struct {
+	// Allows an operator that is not interpretable to pass validation.  This is useful for cases where a broader check
+	// can be performed, as in a *SubjectAccessReview
+	AllowUnknownOperatorInRequirement bool
+}
+
+// ValidateLabelSelectorRequirement validates the requirement according to the opts and returns any validation errors.
+func ValidateFieldSelectorRequirement(requirement metav1.FieldSelectorRequirement, opts FieldSelectorValidationOptions, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+
+	if len(requirement.Key) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("key"), "must be specified"))
+	}
+
+	switch requirement.Operator {
+	case metav1.FieldSelectorOpIn, metav1.FieldSelectorOpNotIn:
+		if len(requirement.Values) == 0 {
+			allErrs = append(allErrs, field.Required(fldPath.Child("values"), "must be specified when `operator` is 'In' or 'NotIn'"))
+		}
+	case metav1.FieldSelectorOpExists, metav1.FieldSelectorOpDoesNotExist:
+		if len(requirement.Values) > 0 {
+			allErrs = append(allErrs, field.Forbidden(fldPath.Child("values"), "may not be specified when `operator` is 'Exists' or 'DoesNotExist'"))
+		}
+	default:
+		if !opts.AllowUnknownOperatorInRequirement {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("operator"), requirement.Operator, "not a valid selector operator"))
+		}
+	}
+
+	return allErrs
+}
+
+func ValidateDeleteOptions(options *metav1.DeleteOptions) field.ErrorList {
+	allErrs := field.ErrorList{}
+	//lint:file-ignore SA1019 Keep validation for deprecated OrphanDependents option until it's being removed
+	if options.OrphanDependents != nil && options.PropagationPolicy != nil {
+		allErrs = append(allErrs, field.Invalid(field.NewPath("propagationPolicy"), options.PropagationPolicy, "orphanDependents and deletionPropagation cannot be both set"))
+	}
+	if options.PropagationPolicy != nil &&
+		*options.PropagationPolicy != metav1.DeletePropagationForeground &&
+		*options.PropagationPolicy != metav1.DeletePropagationBackground &&
+		*options.PropagationPolicy != metav1.DeletePropagationOrphan {
+		allErrs = append(allErrs, field.NotSupported(field.NewPath("propagationPolicy"), options.PropagationPolicy, []string{string(metav1.DeletePropagationForeground), string(metav1.DeletePropagationBackground), string(metav1.DeletePropagationOrphan), "nil"}))
+	}
+	allErrs = append(allErrs, ValidateDryRun(field.NewPath("dryRun"), options.DryRun)...)
+	allErrs = append(allErrs, ValidateIgnoreStoreReadError(field.NewPath("ignoreStoreReadErrorWithClusterBreakingPotential"), options)...)
+	return allErrs
+}
+
+func ValidateCreateOptions(options *metav1.CreateOptions) field.ErrorList {
+	allErrs := field.ErrorList{}
+	allErrs = append(allErrs, ValidateFieldManager(options.FieldManager, field.NewPath("fieldManager"))...)
+	allErrs = append(allErrs, ValidateDryRun(field.NewPath("dryRun"), options.DryRun)...)
+	allErrs = append(allErrs, ValidateFieldValidation(field.NewPath("fieldValidation"), options.FieldValidation)...)
+	return allErrs
+}
+
+func ValidateUpdateOptions(options *metav1.UpdateOptions) field.ErrorList {
+	allErrs := field.ErrorList{}
+	allErrs = append(allErrs, ValidateFieldManager(options.FieldManager, field.NewPath("fieldManager"))...)
+	allErrs = append(allErrs, ValidateDryRun(field.NewPath("dryRun"), options.DryRun)...)
+	allErrs = append(allErrs, ValidateFieldValidation(field.NewPath("fieldValidation"), options.FieldValidation)...)
+	return allErrs
+}
+
+func ValidatePatchOptions(options *metav1.PatchOptions, patchType types.PatchType) field.ErrorList {
+	allErrs := field.ErrorList{}
+	switch patchType {
+	case types.ApplyYAMLPatchType, types.ApplyCBORPatchType:
+		if options.FieldManager == "" {
+			// This field is defaulted to "kubectl" by kubectl, but HAS TO be explicitly set by controllers.
+			allErrs = append(allErrs, field.Required(field.NewPath("fieldManager"), "is required for apply patch"))
+		}
+	default:
+		if options.Force != nil {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("force"), "may not be specified for non-apply patch"))
+		}
+	}
+	allErrs = append(allErrs, ValidateFieldManager(options.FieldManager, field.NewPath("fieldManager"))...)
+	allErrs = append(allErrs, ValidateDryRun(field.NewPath("dryRun"), options.DryRun)...)
+	allErrs = append(allErrs, ValidateFieldValidation(field.NewPath("fieldValidation"), options.FieldValidation)...)
+	return allErrs
+}
+
+var FieldManagerMaxLength = 128
+
+// ValidateFieldManager valides that the fieldManager is the proper length and
+// only has printable characters.
+func ValidateFieldManager(fieldManager string, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	// the field can not be set as a `*string`, so a empty string ("") is
+	// considered as not set and is defaulted by the rest of the process
+	// (unless apply is used, in which case it is required).
+	if len(fieldManager) > FieldManagerMaxLength {
+		allErrs = append(allErrs, field.TooLong(fldPath, "" /*unused*/, FieldManagerMaxLength))
+	}
+	// Verify that all characters are printable.
+	for i, r := range fieldManager {
+		if !unicode.IsPrint(r) {
+			allErrs = append(allErrs, field.Invalid(fldPath, fieldManager, fmt.Sprintf("invalid character %#U (at position %d)", r, i)))
+		}
+	}
+
+	return allErrs
+}
+
+var allowedDryRunValues = sets.NewString(metav1.DryRunAll)
+
+// ValidateDryRun validates that a dryRun query param only contains allowed values.
+func ValidateDryRun(fldPath *field.Path, dryRun []string) field.ErrorList {
+	allErrs := field.ErrorList{}
+	if !allowedDryRunValues.HasAll(dryRun...) {
+		allErrs = append(allErrs, field.NotSupported(fldPath, dryRun, allowedDryRunValues.List()))
+	}
+	return allErrs
+}
+
+var allowedFieldValidationValues = sets.NewString("", metav1.FieldValidationIgnore, metav1.FieldValidationWarn, metav1.FieldValidationStrict)
+
+// ValidateFieldValidation validates that a fieldValidation query param only contains allowed values.
+func ValidateFieldValidation(fldPath *field.Path, fieldValidation string) field.ErrorList {
+	allErrs := field.ErrorList{}
+	if !allowedFieldValidationValues.Has(fieldValidation) {
+		allErrs = append(allErrs, field.NotSupported(fldPath, fieldValidation, allowedFieldValidationValues.List()))
+	}
+	return allErrs
+
+}
+
+const UninitializedStatusUpdateErrorMsg string = `must not update status when the object is uninitialized`
+
+// ValidateTableOptions returns any invalid flags on TableOptions.
+func ValidateTableOptions(opts *metav1.TableOptions) field.ErrorList {
+	var allErrs field.ErrorList
+	switch opts.IncludeObject {
+	case metav1.IncludeMetadata, metav1.IncludeNone, metav1.IncludeObject, "":
+	default:
+		allErrs = append(allErrs, field.Invalid(field.NewPath("includeObject"), opts.IncludeObject, "must be 'Metadata', 'Object', 'None', or empty"))
+	}
+	return allErrs
+}
+
+const MaxSubresourceNameLength = 256
+
+// ManagedFieldsValidationOption specifies options for validating managed fields.
+type ManagedFieldsValidationOption int
+
+const (
+	// CoveredByDeclarative indicates whether errors should be marked as covered by declarative validation.
+	CoveredByDeclarative ManagedFieldsValidationOption = iota + 1
+)
+
+// ValidateManagedFields validates a list of managed fields.
+func ValidateManagedFields(fieldsList []metav1.ManagedFieldsEntry, fldPath *field.Path, opts ...ManagedFieldsValidationOption) field.ErrorList {
+	coveredByDeclarative := false
+	for _, opt := range opts {
+		if opt == CoveredByDeclarative {
+			coveredByDeclarative = true
+		}
+	}
+	var allErrs field.ErrorList
+	for i, fields := range fieldsList {
+		fldPath := fldPath.Index(i)
+		switch fields.Operation {
+		case "":
+			err := field.Required(fldPath.Child("operation"), "must not be empty")
+			if coveredByDeclarative {
+				err = err.MarkCoveredByDeclarative()
+			}
+			allErrs = append(allErrs, err)
+		case metav1.ManagedFieldsOperationApply, metav1.ManagedFieldsOperationUpdate:
+		default:
+			err := field.NotSupported(fldPath.Child("operation"), fields.Operation, []metav1.ManagedFieldsOperationType{metav1.ManagedFieldsOperationApply, metav1.ManagedFieldsOperationUpdate})
+			if coveredByDeclarative {
+				err = err.MarkCoveredByDeclarative()
+			}
+			allErrs = append(allErrs, err)
+		}
+		if len(fields.FieldsType) > 0 && fields.FieldsType != "FieldsV1" {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("fieldsType"), fields.FieldsType, "must be `FieldsV1`"))
+		}
+		allErrs = append(allErrs, ValidateFieldManager(fields.Manager, fldPath.Child("manager"))...)
+
+		if len(fields.Subresource) > MaxSubresourceNameLength {
+			allErrs = append(allErrs, field.TooLong(fldPath.Child("subresource"), "" /*unused*/, MaxSubresourceNameLength))
+		}
+	}
+	return allErrs
+}
+
+func ValidateConditions(conditions []metav1.Condition, fldPath *field.Path) field.ErrorList {
+	var allErrs field.ErrorList
+
+	conditionTypeToFirstIndex := map[string]int{}
+	for i, condition := range conditions {
+		if _, ok := conditionTypeToFirstIndex[condition.Type]; ok {
+			allErrs = append(allErrs, field.Duplicate(fldPath.Index(i), condition.Type).MarkCoveredByDeclarative())
+		} else {
+			conditionTypeToFirstIndex[condition.Type] = i
+		}
+
+		allErrs = append(allErrs, ValidateCondition(condition, fldPath.Index(i))...)
+	}
+
+	return allErrs
+}
+
+// validConditionStatuses is used internally to check validity and provide a good message
+var validConditionStatuses = sets.NewString(string(metav1.ConditionTrue), string(metav1.ConditionFalse), string(metav1.ConditionUnknown))
+
+const (
+	maxReasonLen  = 1 * 1024
+	maxMessageLen = 32 * 1024
+)
+
+func ValidateCondition(condition metav1.Condition, fldPath *field.Path) field.ErrorList {
+	var allErrs field.ErrorList
+
+	// type is set and is a valid format
+	if len(condition.Type) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("type"), "is required").MarkCoveredByDeclarative())
+	} else {
+		allErrs = append(allErrs, ValidateLabelName(condition.Type, fldPath.Child("type"))...)
+	}
+
+	// status is set and is an accepted value
+	if len(condition.Status) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("status"), "").MarkCoveredByDeclarative())
+	} else if !validConditionStatuses.Has(string(condition.Status)) {
+		allErrs = append(allErrs, field.NotSupported(fldPath.Child("status"), condition.Status, validConditionStatuses.List()).MarkCoveredByDeclarative())
+	}
+
+	if condition.ObservedGeneration < 0 {
+		allErrs = append(allErrs, field.Invalid(fldPath.Child("observedGeneration"), condition.ObservedGeneration, "must be greater than or equal to zero").WithOrigin("minimum").MarkCoveredByDeclarative())
+	}
+
+	if condition.LastTransitionTime.IsZero() {
+		allErrs = append(allErrs, field.Required(fldPath.Child("lastTransitionTime"), "").MarkCoveredByDeclarative())
+	}
+
+	if len(condition.Reason) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("reason"), "").MarkCoveredByDeclarative())
+	} else {
+		for _, currErr := range IsValidConditionReason(condition.Reason) {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("reason"), condition.Reason, currErr))
+		}
+		if len(condition.Reason) > maxReasonLen {
+			allErrs = append(allErrs, field.TooLong(fldPath.Child("reason"), "" /*unused*/, maxReasonLen).WithOrigin("maxBytes").MarkCoveredByDeclarative())
+		}
+	}
+
+	if len(condition.Message) > maxMessageLen {
+		allErrs = append(allErrs, field.TooLong(fldPath.Child("message"), "" /*unused*/, maxMessageLen))
+	}
+
+	return allErrs
+}
+
+const conditionReasonFmt string = "[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?"
+const conditionReasonErrMsg string = "a condition reason must start with alphabetic character, optionally followed by a string of alphanumeric characters or '_,:', and must end with an alphanumeric character or '_'"
+
+var conditionReasonRegexp = regexp.MustCompile("^" + conditionReasonFmt + "$")
+
+// IsValidConditionReason tests for a string that conforms to rules for condition
+// reasons. This checks the format, but not the length.
+func IsValidConditionReason(value string) []string {
+	if !conditionReasonRegexp.MatchString(value) {
+		return []string{validation.RegexError(conditionReasonErrMsg, conditionReasonFmt, "my_name", "MY_NAME", "MyName", "ReasonA,ReasonB", "ReasonA:ReasonB")}
+	}
+	return nil
+}
+
+// ValidateIgnoreStoreReadError validates that delete options are valid when
+// ignoreStoreReadErrorWithClusterBreakingPotential is enabled
+func ValidateIgnoreStoreReadError(fldPath *field.Path, options *metav1.DeleteOptions) field.ErrorList {
+	allErrs := field.ErrorList{}
+	if enabled := ptr.Deref[bool](options.IgnoreStoreReadErrorWithClusterBreakingPotential, false); !enabled {
+		return allErrs
+	}
+
+	if options.PropagationPolicy != nil {
+		allErrs = append(allErrs, field.Invalid(fldPath, true, "cannot be set together with .propagationPolicy"))
+	}
+	//nolint:staticcheck // Keep validation for deprecated OrphanDependents option until it's being removed
+	if options.OrphanDependents != nil {
+		allErrs = append(allErrs, field.Invalid(fldPath, true, "cannot be set together with .orphanDependents"))
+	}
+	if options.GracePeriodSeconds != nil {
+		allErrs = append(allErrs, field.Invalid(fldPath, true, "cannot be set together with .gracePeriodSeconds"))
+	}
+	if options.Preconditions != nil {
+		allErrs = append(allErrs, field.Invalid(fldPath, true, "cannot be set together with .preconditions"))
+	}
+
+	return allErrs
+}
+
+// ValidateCustom_Condition_LastTransitionTime is wired into the generated
+// declarative validation by +k8s:customValidation on Condition.LastTransitionTime.
+// It enforces that the field is set, mirroring the handwritten check in
+// ValidateCondition.
+func ValidateCustom_Condition_LastTransitionTime(ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *metav1.Time) field.ErrorList {
+	if value.IsZero() {
+		return field.ErrorList{field.Required(fldPath, "")}
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation_test.go
new file mode 100644
index 0000000000..d7e421037c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation_test.go
@@ -0,0 +1,646 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+
+	"k8s.io/utils/ptr"
+)
+
+func TestValidateLabels(t *testing.T) {
+	successCases := []map[string]string{
+		{"simple": "bar"},
+		{"now-with-dashes": "bar"},
+		{"1-starts-with-num": "bar"},
+		{"1234": "bar"},
+		{"simple/simple": "bar"},
+		{"now-with-dashes/simple": "bar"},
+		{"now-with-dashes/now-with-dashes": "bar"},
+		{"now.with.dots/simple": "bar"},
+		{"now-with.dashes-and.dots/simple": "bar"},
+		{"1-num.2-num/3-num": "bar"},
+		{"1234/5678": "bar"},
+		{"1.2.3.4/5678": "bar"},
+		{"UpperCaseAreOK123": "bar"},
+		{"goodvalue": "123_-.BaR"},
+	}
+	for i := range successCases {
+		errs := ValidateLabels(successCases[i], field.NewPath("field"))
+		if len(errs) != 0 {
+			t.Errorf("case[%d] expected success, got %#v", i, errs)
+		}
+	}
+
+	namePartErrMsg := "name part must consist of"
+	nameErrMsg := "a valid label key must consist of"
+	labelErrMsg := "a valid label must be an empty string or consist of"
+	maxLengthErrMsg := "must be no more than"
+
+	labelNameErrorCases := []struct {
+		labels map[string]string
+		expect string
+	}{
+		{map[string]string{"nospecialchars^=@": "bar"}, namePartErrMsg},
+		{map[string]string{"cantendwithadash-": "bar"}, namePartErrMsg},
+		{map[string]string{"only/one/slash": "bar"}, nameErrMsg},
+		{map[string]string{strings.Repeat("a", 254): "bar"}, maxLengthErrMsg},
+	}
+	for i := range labelNameErrorCases {
+		errs := ValidateLabels(labelNameErrorCases[i].labels, field.NewPath("field"))
+		if len(errs) != 1 {
+			t.Errorf("case[%d]: expected failure", i)
+		} else {
+			if !strings.Contains(errs[0].Detail, labelNameErrorCases[i].expect) {
+				t.Errorf("case[%d]: error details do not include %q: %q", i, labelNameErrorCases[i].expect, errs[0].Detail)
+			}
+		}
+	}
+
+	labelValueErrorCases := []struct {
+		labels map[string]string
+		expect string
+	}{
+		{map[string]string{"toolongvalue": strings.Repeat("a", 64)}, maxLengthErrMsg},
+		{map[string]string{"backslashesinvalue": "some\\bad\\value"}, labelErrMsg},
+		{map[string]string{"nocommasallowed": "bad,value"}, labelErrMsg},
+		{map[string]string{"strangecharsinvalue": "?#$notsogood"}, labelErrMsg},
+	}
+	for i := range labelValueErrorCases {
+		errs := ValidateLabels(labelValueErrorCases[i].labels, field.NewPath("field"))
+		if len(errs) != 1 {
+			t.Errorf("case[%d]: expected failure", i)
+		} else {
+			if !strings.Contains(errs[0].Detail, labelValueErrorCases[i].expect) {
+				t.Errorf("case[%d]: error details do not include %q: %q", i, labelValueErrorCases[i].expect, errs[0].Detail)
+			}
+		}
+	}
+}
+
+func TestValidDryRun(t *testing.T) {
+	tests := [][]string{
+		{},
+		{"All"},
+		{"All", "All"},
+	}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%v", test), func(t *testing.T) {
+			if errs := ValidateDryRun(field.NewPath("dryRun"), test); len(errs) != 0 {
+				t.Errorf("%v should be a valid dry-run value: %v", test, errs)
+			}
+		})
+	}
+}
+
+func TestInvalidDryRun(t *testing.T) {
+	tests := [][]string{
+		{"False"},
+		{"All", "False"},
+	}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%v", test), func(t *testing.T) {
+			if len(ValidateDryRun(field.NewPath("dryRun"), test)) == 0 {
+				t.Errorf("%v shouldn't be a valid dry-run value", test)
+			}
+		})
+	}
+}
+
+func TestValidateDeleteOptionsWithIgnoreStoreReadError(t *testing.T) {
+	fieldPath := field.NewPath("ignoreStoreReadErrorWithClusterBreakingPotential")
+	tests := []struct {
+		name           string
+		opts           metav1.DeleteOptions
+		expectedErrors field.ErrorList
+	}{
+		{
+			name: "option is nil",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: nil,
+				DryRun: []string{"All"},
+			},
+			expectedErrors: field.ErrorList{},
+		},
+		{
+			name: "option is false, PropagationPolicy is set",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: ptr.To[bool](false),
+				DryRun:             []string{"All"},
+				PropagationPolicy:  ptr.To[metav1.DeletionPropagation](metav1.DeletePropagationBackground),
+				GracePeriodSeconds: ptr.To[int64](0),
+				Preconditions:      &metav1.Preconditions{},
+			},
+			expectedErrors: field.ErrorList{},
+		},
+		{
+			name: "option is false, OrphanDependents is set",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: ptr.To[bool](false),
+				DryRun: []string{"All"},
+				//nolint:staticcheck // until it's being removed
+				OrphanDependents:   ptr.To[bool](true),
+				GracePeriodSeconds: ptr.To[int64](0),
+				Preconditions:      &metav1.Preconditions{},
+			},
+			expectedErrors: field.ErrorList{},
+		},
+		{
+			name: "option is true, PropagationPolicy is set",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: ptr.To[bool](true),
+				DryRun:             []string{"All"},
+				PropagationPolicy:  ptr.To[metav1.DeletionPropagation](metav1.DeletePropagationBackground),
+				GracePeriodSeconds: ptr.To[int64](0),
+				Preconditions:      &metav1.Preconditions{},
+			},
+			expectedErrors: field.ErrorList{
+				field.Invalid(fieldPath, true, "cannot be set together with .propagationPolicy"),
+				field.Invalid(fieldPath, true, "cannot be set together with .gracePeriodSeconds"),
+				field.Invalid(fieldPath, true, "cannot be set together with .preconditions"),
+			},
+		},
+		{
+			name: "option is true, OrphanDependents is set",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: ptr.To[bool](true),
+				DryRun: []string{"All"},
+				//nolint:staticcheck // until it's being removed
+				OrphanDependents:   ptr.To[bool](true),
+				GracePeriodSeconds: ptr.To[int64](0),
+				Preconditions:      &metav1.Preconditions{},
+			},
+			expectedErrors: field.ErrorList{
+				field.Invalid(fieldPath, true, "cannot be set together with .orphanDependents"),
+				field.Invalid(fieldPath, true, "cannot be set together with .gracePeriodSeconds"),
+				field.Invalid(fieldPath, true, "cannot be set together with .preconditions"),
+			},
+		},
+		{
+			name: "option is true, no other option is set",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: ptr.To[bool](false),
+			},
+			expectedErrors: field.ErrorList{},
+		},
+		{
+			name: "option is true, dry-run is set (should be allowed)",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: new(true),
+				DryRun: []string{"All"},
+			},
+			expectedErrors: field.ErrorList{},
+		},
+		{
+			name: "option is true, dry-run is set to an invalid value",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: new(true),
+				DryRun: []string{"Invalid"},
+			},
+			expectedErrors: field.ErrorList{
+				field.NotSupported(field.NewPath("dryRun"), []string{"Invalid"}, []string{"All"}),
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			errGot := ValidateDeleteOptions(&test.opts)
+			if !cmp.Equal(test.expectedErrors, errGot) {
+				t.Errorf("expected error(s) to match, diff: %s", cmp.Diff(test.expectedErrors, errGot))
+			}
+		})
+	}
+}
+
+func TestValidPatchOptions(t *testing.T) {
+	tests := []struct {
+		opts      metav1.PatchOptions
+		patchType types.PatchType
+	}{{
+		opts: metav1.PatchOptions{
+			Force:        ptr.To(true),
+			FieldManager: "kubectl",
+		},
+		patchType: types.ApplyYAMLPatchType,
+	}, {
+		opts: metav1.PatchOptions{
+			FieldManager: "kubectl",
+		},
+		patchType: types.ApplyYAMLPatchType,
+	}, {
+		opts: metav1.PatchOptions{
+			Force:        ptr.To(true),
+			FieldManager: "kubectl",
+		},
+		patchType: types.ApplyCBORPatchType,
+	}, {
+		opts: metav1.PatchOptions{
+			FieldManager: "kubectl",
+		},
+		patchType: types.ApplyCBORPatchType,
+	}, {
+		opts:      metav1.PatchOptions{},
+		patchType: types.MergePatchType,
+	}, {
+		opts: metav1.PatchOptions{
+			FieldManager: "patcher",
+		},
+		patchType: types.MergePatchType,
+	}}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%v", test.opts), func(t *testing.T) {
+			errs := ValidatePatchOptions(&test.opts, test.patchType)
+			if len(errs) != 0 {
+				t.Fatalf("Expected no failures, got: %v", errs)
+			}
+		})
+	}
+}
+
+func TestInvalidPatchOptions(t *testing.T) {
+	tests := []struct {
+		opts      metav1.PatchOptions
+		patchType types.PatchType
+	}{
+		// missing manager
+		{
+			opts:      metav1.PatchOptions{},
+			patchType: types.ApplyYAMLPatchType,
+		},
+		// missing manager
+		{
+			opts:      metav1.PatchOptions{},
+			patchType: types.ApplyCBORPatchType,
+		},
+		// force on non-apply
+		{
+			opts: metav1.PatchOptions{
+				Force: ptr.To(true),
+			},
+			patchType: types.MergePatchType,
+		},
+		// manager and force on non-apply
+		{
+			opts: metav1.PatchOptions{
+				FieldManager: "kubectl",
+				Force:        ptr.To(false),
+			},
+			patchType: types.MergePatchType,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%v", test.opts), func(t *testing.T) {
+			errs := ValidatePatchOptions(&test.opts, test.patchType)
+			if len(errs) == 0 {
+				t.Fatal("Expected failures, got none.")
+			}
+		})
+	}
+}
+
+func TestValidateFieldManagerValid(t *testing.T) {
+	tests := []string{
+		"filedManager",
+		"你好", // Hello
+		"🍔",
+	}
+
+	for _, test := range tests {
+		t.Run(test, func(t *testing.T) {
+			errs := ValidateFieldManager(test, field.NewPath("fieldManager"))
+			if len(errs) != 0 {
+				t.Errorf("Validation failed: %v", errs)
+			}
+		})
+	}
+}
+
+func TestValidateFieldManagerInvalid(t *testing.T) {
+	tests := []string{
+		"field\nmanager", // Contains invalid character \n
+		"fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", // Has 129 chars
+	}
+
+	for _, test := range tests {
+		t.Run(test, func(t *testing.T) {
+			errs := ValidateFieldManager(test, field.NewPath("fieldManager"))
+			if len(errs) == 0 {
+				t.Errorf("Validation should have failed")
+			}
+		})
+	}
+}
+
+func TestValidateManagedFieldsInvalid(t *testing.T) {
+	tests := []metav1.ManagedFieldsEntry{{
+		Operation:  metav1.ManagedFieldsOperationUpdate,
+		FieldsType: "RandomVersion",
+		APIVersion: "v1",
+	}, {
+		Operation:  "RandomOperation",
+		FieldsType: "FieldsV1",
+		APIVersion: "v1",
+	}, {
+		// Operation is missing
+		FieldsType: "FieldsV1",
+		APIVersion: "v1",
+	}, {
+		Operation:  metav1.ManagedFieldsOperationUpdate,
+		FieldsType: "FieldsV1",
+		// Invalid fieldManager
+		Manager:    "field\nmanager",
+		APIVersion: "v1",
+	}, {
+		Operation:   metav1.ManagedFieldsOperationApply,
+		FieldsType:  "FieldsV1",
+		APIVersion:  "v1",
+		Subresource: "TooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLong",
+	}}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%#v", test), func(t *testing.T) {
+			errs := ValidateManagedFields([]metav1.ManagedFieldsEntry{test}, field.NewPath("managedFields"))
+			if len(errs) == 0 {
+				t.Errorf("Validation should have failed")
+			}
+			errs = ValidateManagedFields([]metav1.ManagedFieldsEntry{test}, field.NewPath("managedFields"), CoveredByDeclarative)
+			if len(errs) == 0 {
+				t.Errorf("Validation with CoveredByDeclarative should have failed")
+			}
+		})
+	}
+}
+
+func TestValidateMangedFieldsValid(t *testing.T) {
+	tests := []metav1.ManagedFieldsEntry{{
+		Operation:  metav1.ManagedFieldsOperationUpdate,
+		APIVersion: "v1",
+		// FieldsType is missing
+	}, {
+		Operation:  metav1.ManagedFieldsOperationUpdate,
+		FieldsType: "FieldsV1",
+		APIVersion: "v1",
+	}, {
+		Operation:   metav1.ManagedFieldsOperationApply,
+		FieldsType:  "FieldsV1",
+		APIVersion:  "v1",
+		Subresource: "scale",
+	}, {
+		Operation:  metav1.ManagedFieldsOperationApply,
+		FieldsType: "FieldsV1",
+		APIVersion: "v1",
+		Manager:    "🍔",
+	}}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%#v", test), func(t *testing.T) {
+			err := ValidateManagedFields([]metav1.ManagedFieldsEntry{test}, field.NewPath("managedFields"))
+			if err != nil {
+				t.Errorf("Validation failed: %v", err)
+			}
+			err = ValidateManagedFields([]metav1.ManagedFieldsEntry{test}, field.NewPath("managedFields"), CoveredByDeclarative)
+			if err != nil {
+				t.Errorf("Validation with CoveredByDeclarative failed: %v", err)
+			}
+		})
+	}
+}
+
+func TestValidateConditions(t *testing.T) {
+	tests := []struct {
+		name         string
+		conditions   []metav1.Condition
+		validateErrs func(t *testing.T, errs field.ErrorList)
+	}{{
+		name: "bunch-of-invalid-fields",
+		conditions: []metav1.Condition{{
+			Type:               ":invalid",
+			Status:             "unknown",
+			ObservedGeneration: -1,
+			LastTransitionTime: metav1.Time{},
+			Reason:             "invalid;val",
+			Message:            "",
+		}},
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			needle := `status.conditions[0].type: Invalid value: ":invalid": name part must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]')`
+			if !hasError(errs, needle) {
+				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
+			}
+			needle = `status.conditions[0].status: Unsupported value: "unknown": supported values: "False", "True", "Unknown"`
+			if !hasError(errs, needle) {
+				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
+			}
+			needle = `status.conditions[0].observedGeneration: Invalid value: -1: must be greater than or equal to zero`
+			if !hasError(errs, needle) {
+				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
+			}
+			needle = `status.conditions[0].lastTransitionTime: Required value`
+			if !hasError(errs, needle) {
+				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
+			}
+			needle = `status.conditions[0].reason: Invalid value: "invalid;val": a condition reason must start with alphabetic character, optionally followed by a string of alphanumeric characters or '_,:', and must end with an alphanumeric character or '_' (e.g. 'my_name',  or 'MY_NAME',  or 'MyName',  or 'ReasonA,ReasonB',  or 'ReasonA:ReasonB', regex used for validation is '[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?')`
+			if !hasError(errs, needle) {
+				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
+			}
+		},
+	}, {
+		name: "duplicates",
+		conditions: []metav1.Condition{{
+			Type: "First",
+		}, {
+			Type: "Second",
+		}, {
+			Type: "First",
+		}},
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			needle := `status.conditions[2]: Duplicate value: "First"`
+			if !hasError(errs, needle) {
+				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
+			}
+		},
+	}, {
+		name: "colon-allowed-in-reason",
+		conditions: []metav1.Condition{{
+			Type:   "First",
+			Reason: "valid:val",
+		}},
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			needle := `status.conditions[0].reason`
+			if hasPrefixError(errs, needle) {
+				t.Errorf("has %q in\n%v", needle, errorsAsString(errs))
+			}
+		},
+	}, {
+		name: "comma-allowed-in-reason",
+		conditions: []metav1.Condition{{
+			Type:   "First",
+			Reason: "valid,val",
+		}},
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			needle := `status.conditions[0].reason`
+			if hasPrefixError(errs, needle) {
+				t.Errorf("has %q in\n%v", needle, errorsAsString(errs))
+			}
+		},
+	}, {
+		name: "reason-does-not-end-in-delimiter",
+		conditions: []metav1.Condition{{
+			Type:   "First",
+			Reason: "valid,val:",
+		}},
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			needle := `status.conditions[0].reason: Invalid value: "valid,val:": a condition reason must start with alphabetic character, optionally followed by a string of alphanumeric characters or '_,:', and must end with an alphanumeric character or '_' (e.g. 'my_name',  or 'MY_NAME',  or 'MyName',  or 'ReasonA,ReasonB',  or 'ReasonA:ReasonB', regex used for validation is '[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?')`
+			if !hasError(errs, needle) {
+				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
+			}
+		},
+	}}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			errs := ValidateConditions(test.conditions, field.NewPath("status").Child("conditions"))
+			test.validateErrs(t, errs)
+		})
+	}
+}
+
+func TestLabelSelectorMatchExpression(t *testing.T) {
+	testCases := []struct {
+		name            string
+		labelSelector   *metav1.LabelSelector
+		wantErrorNumber int
+		validateErrs    func(t *testing.T, errs field.ErrorList)
+	}{{
+		name: "Valid LabelSelector",
+		labelSelector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{{
+				Key:      "key",
+				Operator: metav1.LabelSelectorOpIn,
+				Values:   []string{"value"},
+			}},
+		},
+		wantErrorNumber: 0,
+		validateErrs:    nil,
+	}, {
+		name: "MatchExpression's key name isn't valid",
+		labelSelector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{{
+				Key:      "-key",
+				Operator: metav1.LabelSelectorOpIn,
+				Values:   []string{"value"},
+			}},
+		},
+		wantErrorNumber: 1,
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			errMessage := "name part must consist of alphanumeric characters"
+			if !partStringInErrorMessage(errs, errMessage) {
+				t.Errorf("missing %q in\n%v", errMessage, errorsAsString(errs))
+			}
+		},
+	}, {
+		name: "MatchExpression's operator isn't valid",
+		labelSelector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{{
+				Key:      "key",
+				Operator: "abc",
+				Values:   []string{"value"},
+			}},
+		},
+		wantErrorNumber: 1,
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			errMessage := "not a valid selector operator"
+			if !partStringInErrorMessage(errs, errMessage) {
+				t.Errorf("missing %q in\n%v", errMessage, errorsAsString(errs))
+			}
+		},
+	}, {
+		name: "MatchExpression's value name isn't valid",
+		labelSelector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{{
+				Key:      "key",
+				Operator: metav1.LabelSelectorOpIn,
+				Values:   []string{"-value"},
+			}},
+		},
+		wantErrorNumber: 1,
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			errMessage := "a valid label must be an empty string or consist of"
+			if !partStringInErrorMessage(errs, errMessage) {
+				t.Errorf("missing %q in\n%v", errMessage, errorsAsString(errs))
+			}
+		},
+	}}
+	for index, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			allErrs := ValidateLabelSelector(testCase.labelSelector, LabelSelectorValidationOptions{AllowInvalidLabelValueInSelector: false}, field.NewPath("labelSelector"))
+			if len(allErrs) != testCase.wantErrorNumber {
+				t.Errorf("case[%d]: expected failure", index)
+			}
+			if len(allErrs) >= 1 && testCase.validateErrs != nil {
+				testCase.validateErrs(t, allErrs)
+			}
+		})
+	}
+}
+
+func hasError(errs field.ErrorList, needle string) bool {
+	for _, curr := range errs {
+		if curr.Error() == needle {
+			return true
+		}
+	}
+	return false
+}
+
+func hasPrefixError(errs field.ErrorList, prefix string) bool {
+	for _, curr := range errs {
+		if strings.HasPrefix(curr.Error(), prefix) {
+			return true
+		}
+	}
+	return false
+}
+
+func partStringInErrorMessage(errs field.ErrorList, prefix string) bool {
+	for _, curr := range errs {
+		if strings.Contains(curr.Error(), prefix) {
+			return true
+		}
+	}
+	return false
+}
+
+func errorsAsString(errs field.ErrorList) string {
+	messages := []string{}
+	for _, curr := range errs {
+		messages = append(messages, curr.Error())
+	}
+	return strings.Join(messages, "\n")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/zz_generated.validations.go
new file mode 100644
index 0000000000..f79373a26d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/zz_generated.validations.go
@@ -0,0 +1,638 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package validation
+
+import (
+	context "context"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	sets "k8s.io/apimachinery/pkg/util/sets"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Validate_Condition validates an instance of Condition according
+// to declarative validation rules in the API schema.
+func Validate_Condition(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.Condition) (errs field.ErrorList) {
+
+	{ // field v1.Condition.Type
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.Condition) *string {
+				return &oldObj.Type
+			})
+		errs = append(errs, fn(fldPath.Child("type"), &obj.Type, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.Condition.Status
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.ConditionStatus,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ConditionStatus(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.Condition) *v1.ConditionStatus {
+				return &oldObj.Status
+			})
+		errs = append(errs, fn(fldPath.Child("status"), &obj.Status, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.Condition.ObservedGeneration
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.Condition) *int64 {
+				return &oldObj.ObservedGeneration
+			})
+		errs = append(errs, fn(fldPath.Child("observedGeneration"), &obj.ObservedGeneration, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.Condition.LastTransitionTime
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.Time,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// custom validation
+			if e := ValidateCustom_Condition_LastTransitionTime(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.Condition) *v1.Time {
+				return &oldObj.LastTransitionTime
+			})
+		errs = append(errs, fn(fldPath.Child("lastTransitionTime"), &obj.LastTransitionTime, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.Condition.Reason
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 1024).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.Condition) *string {
+				return &oldObj.Reason
+			})
+		errs = append(errs, fn(fldPath.Child("reason"), &obj.Reason, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.Condition.Message has no validation
+	return errs
+}
+
+var symbolsForConditionStatus = sets.New(v1.ConditionFalse, v1.ConditionTrue, v1.ConditionUnknown)
+
+// Validate_ConditionStatus validates an instance of ConditionStatus according
+// to declarative validation rules in the API schema.
+func Validate_ConditionStatus(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.ConditionStatus) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForConditionStatus, nil).MarkAlpha(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ManagedFieldsEntry validates an instance of ManagedFieldsEntry according
+// to declarative validation rules in the API schema.
+func Validate_ManagedFieldsEntry(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.ManagedFieldsEntry) (errs field.ErrorList) {
+
+	// field v1.ManagedFieldsEntry.Manager has no validation
+
+	{ // field v1.ManagedFieldsEntry.Operation
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.ManagedFieldsOperationType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ManagedFieldsOperationType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ManagedFieldsEntry) *v1.ManagedFieldsOperationType {
+				return &oldObj.Operation
+			})
+		errs = append(errs, fn(fldPath.Child("operation"), &obj.Operation, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.ManagedFieldsEntry.APIVersion has no validation
+	// field v1.ManagedFieldsEntry.Time has no validation
+	// field v1.ManagedFieldsEntry.FieldsType has no validation
+	// field v1.ManagedFieldsEntry.FieldsV1 has no validation
+	// field v1.ManagedFieldsEntry.Subresource has no validation
+	return errs
+}
+
+var symbolsForManagedFieldsOperationType = sets.New(v1.ManagedFieldsOperationApply, v1.ManagedFieldsOperationUpdate)
+
+// Validate_ManagedFieldsOperationType validates an instance of ManagedFieldsOperationType according
+// to declarative validation rules in the API schema.
+func Validate_ManagedFieldsOperationType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.ManagedFieldsOperationType) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForManagedFieldsOperationType, nil).MarkAlpha(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ObjectMeta validates an instance of ObjectMeta according
+// to declarative validation rules in the API schema.
+func Validate_ObjectMeta(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.ObjectMeta) (errs field.ErrorList) {
+
+	// field v1.ObjectMeta.Name has no validation
+	// field v1.ObjectMeta.GenerateName has no validation
+	// field v1.ObjectMeta.Namespace has no validation
+	// field v1.ObjectMeta.SelfLink has no validation
+
+	{ // field v1.ObjectMeta.UID
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *types.UID,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) *types.UID {
+				return &oldObj.UID
+			})
+		errs = append(errs, fn(fldPath.Child("uid"), &obj.UID, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.ObjectMeta.ResourceVersion has no validation
+
+	{ // field v1.ObjectMeta.Generation
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) *int64 {
+				return &oldObj.Generation
+			})
+		errs = append(errs, fn(fldPath.Child("generation"), &obj.Generation, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.ObjectMeta.CreationTimestamp
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.Time,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) *v1.Time {
+				return &oldObj.CreationTimestamp
+			})
+		errs = append(errs, fn(fldPath.Child("creationTimestamp"), &obj.CreationTimestamp, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.ObjectMeta.DeletionTimestamp
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.Time,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) *v1.Time {
+				return oldObj.DeletionTimestamp
+			})
+		errs = append(errs, fn(fldPath.Child("deletionTimestamp"), obj.DeletionTimestamp, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.ObjectMeta.DeletionGracePeriodSeconds
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) *int64 {
+				return oldObj.DeletionGracePeriodSeconds
+			})
+		errs = append(errs, fn(fldPath.Child("deletionGracePeriodSeconds"), obj.DeletionGracePeriodSeconds, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.ObjectMeta.Labels has no validation
+	// field v1.ObjectMeta.Annotations has no validation
+
+	{ // field v1.ObjectMeta.OwnerReferences
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []v1.OwnerReference,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_OwnerReference); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) []v1.OwnerReference {
+				return oldObj.OwnerReferences
+			})
+		errs = append(errs, fn(fldPath.Child("ownerReferences"), obj.OwnerReferences, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.ObjectMeta.Finalizers has no validation
+
+	{ // field v1.ObjectMeta.ManagedFields
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []v1.ManagedFieldsEntry,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_ManagedFieldsEntry); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) []v1.ManagedFieldsEntry {
+				return oldObj.ManagedFields
+			})
+		errs = append(errs, fn(fldPath.Child("managedFields"), obj.ManagedFields, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_OwnerReference validates an instance of OwnerReference according
+// to declarative validation rules in the API schema.
+func Validate_OwnerReference(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.OwnerReference) (errs field.ErrorList) {
+
+	{ // field v1.OwnerReference.APIVersion
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.OwnerReference) *string {
+				return &oldObj.APIVersion
+			})
+		errs = append(errs, fn(fldPath.Child("apiVersion"), &obj.APIVersion, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.OwnerReference.Kind
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.OwnerReference) *string {
+				return &oldObj.Kind
+			})
+		errs = append(errs, fn(fldPath.Child("kind"), &obj.Kind, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.OwnerReference.Name
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.OwnerReference) *string {
+				return &oldObj.Name
+			})
+		errs = append(errs, fn(fldPath.Child("name"), &obj.Name, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.OwnerReference.UID
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *types.UID,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.OwnerReference) *types.UID {
+				return &oldObj.UID
+			})
+		errs = append(errs, fn(fldPath.Child("uid"), &obj.UID, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.OwnerReference.Controller has no validation
+	// field v1.OwnerReference.BlockOwnerDeletion has no validation
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/watch.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/watch.go
new file mode 100644
index 0000000000..58f0773803
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/watch.go
@@ -0,0 +1,89 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/watch"
+)
+
+// Event represents a single event to a watched resource.
+//
+// +protobuf=true
+// +k8s:deepcopy-gen=true
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type WatchEvent struct {
+	Type string `json:"type" protobuf:"bytes,1,opt,name=type"`
+
+	// Object is:
+	//  * If Type is Added or Modified: the new state of the object.
+	//  * If Type is Deleted: the state of the object immediately before deletion.
+	//  * If Type is Error: *Status is recommended; other types may make sense
+	//    depending on context.
+	Object runtime.RawExtension `json:"object" protobuf:"bytes,2,opt,name=object"`
+}
+
+func Convert_watch_Event_To_v1_WatchEvent(in *watch.Event, out *WatchEvent, s conversion.Scope) error {
+	out.Type = string(in.Type)
+	switch t := in.Object.(type) {
+	case *runtime.Unknown:
+		// TODO: handle other fields on Unknown and detect type
+		out.Object.Raw = t.Raw
+	case nil:
+	default:
+		out.Object.Object = in.Object
+	}
+	return nil
+}
+
+func Convert_v1_InternalEvent_To_v1_WatchEvent(in *InternalEvent, out *WatchEvent, s conversion.Scope) error {
+	return Convert_watch_Event_To_v1_WatchEvent((*watch.Event)(in), out, s)
+}
+
+func Convert_v1_WatchEvent_To_watch_Event(in *WatchEvent, out *watch.Event, s conversion.Scope) error {
+	out.Type = watch.EventType(in.Type)
+	if in.Object.Object != nil {
+		out.Object = in.Object.Object
+	} else if in.Object.Raw != nil {
+		// TODO: handle other fields on Unknown and detect type
+		out.Object = &runtime.Unknown{
+			Raw:         in.Object.Raw,
+			ContentType: runtime.ContentTypeJSON,
+		}
+	}
+	return nil
+}
+
+func Convert_v1_WatchEvent_To_v1_InternalEvent(in *WatchEvent, out *InternalEvent, s conversion.Scope) error {
+	return Convert_v1_WatchEvent_To_watch_Event(in, (*watch.Event)(out), s)
+}
+
+// InternalEvent makes watch.Event versioned
+// +protobuf=false
+type InternalEvent watch.Event
+
+func (e *InternalEvent) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+func (e *WatchEvent) GetObjectKind() schema.ObjectKind    { return schema.EmptyObjectKind }
+func (e *InternalEvent) DeepCopyObject() runtime.Object {
+	if c := e.DeepCopy(); c != nil {
+		return c
+	} else {
+		return nil
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.conversion.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.conversion.go
new file mode 100644
index 0000000000..735cbcb08f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.conversion.go
@@ -0,0 +1,548 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by conversion-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	url "net/url"
+	unsafe "unsafe"
+
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	conversion "k8s.io/apimachinery/pkg/conversion"
+	fields "k8s.io/apimachinery/pkg/fields"
+	labels "k8s.io/apimachinery/pkg/labels"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+	watch "k8s.io/apimachinery/pkg/watch"
+)
+
+func init() {
+	localSchemeBuilder.Register(RegisterConversions)
+}
+
+// RegisterConversions adds conversion functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*url.Values)(nil), (*CreateOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_CreateOptions(a.(*url.Values), b.(*CreateOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*url.Values)(nil), (*DeleteOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_DeleteOptions(a.(*url.Values), b.(*DeleteOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*url.Values)(nil), (*GetOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_GetOptions(a.(*url.Values), b.(*GetOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*url.Values)(nil), (*ListOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_ListOptions(a.(*url.Values), b.(*ListOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*url.Values)(nil), (*PatchOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_PatchOptions(a.(*url.Values), b.(*PatchOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*url.Values)(nil), (*TableOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_TableOptions(a.(*url.Values), b.(*TableOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*url.Values)(nil), (*UpdateOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_UpdateOptions(a.(*url.Values), b.(*UpdateOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*map[string]string)(nil), (*LabelSelector)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Map_string_To_string_To_v1_LabelSelector(a.(*map[string]string), b.(*LabelSelector), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**bool)(nil), (*bool)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_bool_To_bool(a.(**bool), b.(*bool), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**float64)(nil), (*float64)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_float64_To_float64(a.(**float64), b.(*float64), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**int32)(nil), (*int32)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_int32_To_int32(a.(**int32), b.(*int32), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**int64)(nil), (*int)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_int64_To_int(a.(**int64), b.(*int), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**int64)(nil), (*int64)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_int64_To_int64(a.(**int64), b.(*int64), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**intstr.IntOrString)(nil), (*intstr.IntOrString)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_intstr_IntOrString_To_intstr_IntOrString(a.(**intstr.IntOrString), b.(*intstr.IntOrString), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**string)(nil), (*string)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_string_To_string(a.(**string), b.(*string), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**Duration)(nil), (*Duration)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_v1_Duration_To_v1_Duration(a.(**Duration), b.(*Duration), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (**DeletionPropagation)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_Pointer_v1_DeletionPropagation(a.(*[]string), b.(**DeletionPropagation), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (**Time)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_Pointer_v1_Time(a.(*[]string), b.(**Time), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (*[]int32)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_Slice_int32(a.(*[]string), b.(*[]int32), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (*IncludeObjectPolicy)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_v1_IncludeObjectPolicy(a.(*[]string), b.(*IncludeObjectPolicy), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (*ResourceVersionMatch)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_v1_ResourceVersionMatch(a.(*[]string), b.(*ResourceVersionMatch), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (*Time)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_v1_Time(a.(*[]string), b.(*Time), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*bool)(nil), (**bool)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_bool_To_Pointer_bool(a.(*bool), b.(**bool), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*fields.Selector)(nil), (*string)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_fields_Selector_To_string(a.(*fields.Selector), b.(*string), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*float64)(nil), (**float64)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_float64_To_Pointer_float64(a.(*float64), b.(**float64), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*int32)(nil), (**int32)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_int32_To_Pointer_int32(a.(*int32), b.(**int32), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*int64)(nil), (**int64)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_int64_To_Pointer_int64(a.(*int64), b.(**int64), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*int)(nil), (**int64)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_int_To_Pointer_int64(a.(*int), b.(**int64), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*intstr.IntOrString)(nil), (**intstr.IntOrString)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_intstr_IntOrString_To_Pointer_intstr_IntOrString(a.(*intstr.IntOrString), b.(**intstr.IntOrString), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*intstr.IntOrString)(nil), (*intstr.IntOrString)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_intstr_IntOrString_To_intstr_IntOrString(a.(*intstr.IntOrString), b.(*intstr.IntOrString), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*labels.Selector)(nil), (*string)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_labels_Selector_To_string(a.(*labels.Selector), b.(*string), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*resource.Quantity)(nil), (*resource.Quantity)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_resource_Quantity_To_resource_Quantity(a.(*resource.Quantity), b.(*resource.Quantity), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*string)(nil), (**string)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_string_To_Pointer_string(a.(*string), b.(**string), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*string)(nil), (*fields.Selector)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_string_To_fields_Selector(a.(*string), b.(*fields.Selector), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*string)(nil), (*labels.Selector)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_string_To_labels_Selector(a.(*string), b.(*labels.Selector), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*url.Values)(nil), (*DeleteOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_DeleteOptions(a.(*url.Values), b.(*DeleteOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*DeleteOptions)(nil), (*DeleteOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_DeleteOptions_To_v1_DeleteOptions(a.(*DeleteOptions), b.(*DeleteOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*Duration)(nil), (**Duration)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_Duration_To_Pointer_v1_Duration(a.(*Duration), b.(**Duration), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*InternalEvent)(nil), (*WatchEvent)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_InternalEvent_To_v1_WatchEvent(a.(*InternalEvent), b.(*WatchEvent), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*LabelSelector)(nil), (*map[string]string)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_LabelSelector_To_Map_string_To_string(a.(*LabelSelector), b.(*map[string]string), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ListMeta)(nil), (*ListMeta)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_ListMeta_To_v1_ListMeta(a.(*ListMeta), b.(*ListMeta), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*MicroTime)(nil), (*MicroTime)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_MicroTime_To_v1_MicroTime(a.(*MicroTime), b.(*MicroTime), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*Time)(nil), (*Time)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_Time_To_v1_Time(a.(*Time), b.(*Time), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*TypeMeta)(nil), (*TypeMeta)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_TypeMeta_To_v1_TypeMeta(a.(*TypeMeta), b.(*TypeMeta), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*WatchEvent)(nil), (*InternalEvent)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_WatchEvent_To_v1_InternalEvent(a.(*WatchEvent), b.(*InternalEvent), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*WatchEvent)(nil), (*watch.Event)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_WatchEvent_To_watch_Event(a.(*WatchEvent), b.(*watch.Event), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*watch.Event)(nil), (*WatchEvent)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_watch_Event_To_v1_WatchEvent(a.(*watch.Event), b.(*WatchEvent), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+func autoConvert_url_Values_To_v1_CreateOptions(in *url.Values, out *CreateOptions, s conversion.Scope) error {
+	// WARNING: Field TypeMeta does not have json tag, skipping.
+
+	if values, ok := map[string][]string(*in)["dryRun"]; ok && len(values) > 0 {
+		out.DryRun = *(*[]string)(unsafe.Pointer(&values))
+	} else {
+		out.DryRun = nil
+	}
+	if values, ok := map[string][]string(*in)["fieldManager"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldManager, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldManager = ""
+	}
+	if values, ok := map[string][]string(*in)["fieldValidation"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldValidation, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldValidation = ""
+	}
+	return nil
+}
+
+// Convert_url_Values_To_v1_CreateOptions is an autogenerated conversion function.
+func Convert_url_Values_To_v1_CreateOptions(in *url.Values, out *CreateOptions, s conversion.Scope) error {
+	return autoConvert_url_Values_To_v1_CreateOptions(in, out, s)
+}
+
+func autoConvert_url_Values_To_v1_DeleteOptions(in *url.Values, out *DeleteOptions, s conversion.Scope) error {
+	// WARNING: Field TypeMeta does not have json tag, skipping.
+
+	if values, ok := map[string][]string(*in)["gracePeriodSeconds"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_Pointer_int64(&values, &out.GracePeriodSeconds, s); err != nil {
+			return err
+		}
+	} else {
+		out.GracePeriodSeconds = nil
+	}
+	// INFO: in.Preconditions opted out of conversion generation
+	if values, ok := map[string][]string(*in)["orphanDependents"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_Pointer_bool(&values, &out.OrphanDependents, s); err != nil {
+			return err
+		}
+	} else {
+		out.OrphanDependents = nil
+	}
+	if values, ok := map[string][]string(*in)["propagationPolicy"]; ok && len(values) > 0 {
+		if err := Convert_Slice_string_To_Pointer_v1_DeletionPropagation(&values, &out.PropagationPolicy, s); err != nil {
+			return err
+		}
+	} else {
+		out.PropagationPolicy = nil
+	}
+	if values, ok := map[string][]string(*in)["dryRun"]; ok && len(values) > 0 {
+		out.DryRun = *(*[]string)(unsafe.Pointer(&values))
+	} else {
+		out.DryRun = nil
+	}
+	if values, ok := map[string][]string(*in)["ignoreStoreReadErrorWithClusterBreakingPotential"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_Pointer_bool(&values, &out.IgnoreStoreReadErrorWithClusterBreakingPotential, s); err != nil {
+			return err
+		}
+	} else {
+		out.IgnoreStoreReadErrorWithClusterBreakingPotential = nil
+	}
+	return nil
+}
+
+func autoConvert_url_Values_To_v1_GetOptions(in *url.Values, out *GetOptions, s conversion.Scope) error {
+	// WARNING: Field TypeMeta does not have json tag, skipping.
+
+	if values, ok := map[string][]string(*in)["resourceVersion"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.ResourceVersion, s); err != nil {
+			return err
+		}
+	} else {
+		out.ResourceVersion = ""
+	}
+	return nil
+}
+
+// Convert_url_Values_To_v1_GetOptions is an autogenerated conversion function.
+func Convert_url_Values_To_v1_GetOptions(in *url.Values, out *GetOptions, s conversion.Scope) error {
+	return autoConvert_url_Values_To_v1_GetOptions(in, out, s)
+}
+
+func autoConvert_url_Values_To_v1_ListOptions(in *url.Values, out *ListOptions, s conversion.Scope) error {
+	// WARNING: Field TypeMeta does not have json tag, skipping.
+
+	if values, ok := map[string][]string(*in)["labelSelector"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.LabelSelector, s); err != nil {
+			return err
+		}
+	} else {
+		out.LabelSelector = ""
+	}
+	if values, ok := map[string][]string(*in)["fieldSelector"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldSelector, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldSelector = ""
+	}
+	if values, ok := map[string][]string(*in)["watch"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_bool(&values, &out.Watch, s); err != nil {
+			return err
+		}
+	} else {
+		out.Watch = false
+	}
+	if values, ok := map[string][]string(*in)["allowWatchBookmarks"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_bool(&values, &out.AllowWatchBookmarks, s); err != nil {
+			return err
+		}
+	} else {
+		out.AllowWatchBookmarks = false
+	}
+	if values, ok := map[string][]string(*in)["resourceVersion"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.ResourceVersion, s); err != nil {
+			return err
+		}
+	} else {
+		out.ResourceVersion = ""
+	}
+	if values, ok := map[string][]string(*in)["resourceVersionMatch"]; ok && len(values) > 0 {
+		if err := Convert_Slice_string_To_v1_ResourceVersionMatch(&values, &out.ResourceVersionMatch, s); err != nil {
+			return err
+		}
+	} else {
+		out.ResourceVersionMatch = ""
+	}
+	if values, ok := map[string][]string(*in)["timeoutSeconds"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_Pointer_int64(&values, &out.TimeoutSeconds, s); err != nil {
+			return err
+		}
+	} else {
+		out.TimeoutSeconds = nil
+	}
+	if values, ok := map[string][]string(*in)["limit"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_int64(&values, &out.Limit, s); err != nil {
+			return err
+		}
+	} else {
+		out.Limit = 0
+	}
+	if values, ok := map[string][]string(*in)["continue"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.Continue, s); err != nil {
+			return err
+		}
+	} else {
+		out.Continue = ""
+	}
+	if values, ok := map[string][]string(*in)["sendInitialEvents"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_Pointer_bool(&values, &out.SendInitialEvents, s); err != nil {
+			return err
+		}
+	} else {
+		out.SendInitialEvents = nil
+	}
+	if values, ok := map[string][]string(*in)["shardSelector"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.ShardSelector, s); err != nil {
+			return err
+		}
+	} else {
+		out.ShardSelector = ""
+	}
+	return nil
+}
+
+// Convert_url_Values_To_v1_ListOptions is an autogenerated conversion function.
+func Convert_url_Values_To_v1_ListOptions(in *url.Values, out *ListOptions, s conversion.Scope) error {
+	return autoConvert_url_Values_To_v1_ListOptions(in, out, s)
+}
+
+func autoConvert_url_Values_To_v1_PatchOptions(in *url.Values, out *PatchOptions, s conversion.Scope) error {
+	// WARNING: Field TypeMeta does not have json tag, skipping.
+
+	if values, ok := map[string][]string(*in)["dryRun"]; ok && len(values) > 0 {
+		out.DryRun = *(*[]string)(unsafe.Pointer(&values))
+	} else {
+		out.DryRun = nil
+	}
+	if values, ok := map[string][]string(*in)["force"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_Pointer_bool(&values, &out.Force, s); err != nil {
+			return err
+		}
+	} else {
+		out.Force = nil
+	}
+	if values, ok := map[string][]string(*in)["fieldManager"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldManager, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldManager = ""
+	}
+	if values, ok := map[string][]string(*in)["fieldValidation"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldValidation, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldValidation = ""
+	}
+	return nil
+}
+
+// Convert_url_Values_To_v1_PatchOptions is an autogenerated conversion function.
+func Convert_url_Values_To_v1_PatchOptions(in *url.Values, out *PatchOptions, s conversion.Scope) error {
+	return autoConvert_url_Values_To_v1_PatchOptions(in, out, s)
+}
+
+func autoConvert_url_Values_To_v1_TableOptions(in *url.Values, out *TableOptions, s conversion.Scope) error {
+	// WARNING: Field TypeMeta does not have json tag, skipping.
+
+	if values, ok := map[string][]string(*in)["-"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_bool(&values, &out.NoHeaders, s); err != nil {
+			return err
+		}
+	} else {
+		out.NoHeaders = false
+	}
+	if values, ok := map[string][]string(*in)["includeObject"]; ok && len(values) > 0 {
+		if err := Convert_Slice_string_To_v1_IncludeObjectPolicy(&values, &out.IncludeObject, s); err != nil {
+			return err
+		}
+	} else {
+		out.IncludeObject = ""
+	}
+	return nil
+}
+
+// Convert_url_Values_To_v1_TableOptions is an autogenerated conversion function.
+func Convert_url_Values_To_v1_TableOptions(in *url.Values, out *TableOptions, s conversion.Scope) error {
+	return autoConvert_url_Values_To_v1_TableOptions(in, out, s)
+}
+
+func autoConvert_url_Values_To_v1_UpdateOptions(in *url.Values, out *UpdateOptions, s conversion.Scope) error {
+	// WARNING: Field TypeMeta does not have json tag, skipping.
+
+	if values, ok := map[string][]string(*in)["dryRun"]; ok && len(values) > 0 {
+		out.DryRun = *(*[]string)(unsafe.Pointer(&values))
+	} else {
+		out.DryRun = nil
+	}
+	if values, ok := map[string][]string(*in)["fieldManager"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldManager, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldManager = ""
+	}
+	if values, ok := map[string][]string(*in)["fieldValidation"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldValidation, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldValidation = ""
+	}
+	return nil
+}
+
+// Convert_url_Values_To_v1_UpdateOptions is an autogenerated conversion function.
+func Convert_url_Values_To_v1_UpdateOptions(in *url.Values, out *UpdateOptions, s conversion.Scope) error {
+	return autoConvert_url_Values_To_v1_UpdateOptions(in, out, s)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..eb7eb80d9b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.deepcopy.go
@@ -0,0 +1,1218 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	types "k8s.io/apimachinery/pkg/types"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *APIGroup) DeepCopyInto(out *APIGroup) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Versions != nil {
+		in, out := &in.Versions, &out.Versions
+		*out = make([]GroupVersionForDiscovery, len(*in))
+		copy(*out, *in)
+	}
+	out.PreferredVersion = in.PreferredVersion
+	if in.ServerAddressByClientCIDRs != nil {
+		in, out := &in.ServerAddressByClientCIDRs, &out.ServerAddressByClientCIDRs
+		*out = make([]ServerAddressByClientCIDR, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIGroup.
+func (in *APIGroup) DeepCopy() *APIGroup {
+	if in == nil {
+		return nil
+	}
+	out := new(APIGroup)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *APIGroup) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *APIGroupList) DeepCopyInto(out *APIGroupList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Groups != nil {
+		in, out := &in.Groups, &out.Groups
+		*out = make([]APIGroup, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIGroupList.
+func (in *APIGroupList) DeepCopy() *APIGroupList {
+	if in == nil {
+		return nil
+	}
+	out := new(APIGroupList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *APIGroupList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *APIResource) DeepCopyInto(out *APIResource) {
+	*out = *in
+	if in.Verbs != nil {
+		in, out := &in.Verbs, &out.Verbs
+		*out = make(Verbs, len(*in))
+		copy(*out, *in)
+	}
+	if in.ShortNames != nil {
+		in, out := &in.ShortNames, &out.ShortNames
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Categories != nil {
+		in, out := &in.Categories, &out.Categories
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIResource.
+func (in *APIResource) DeepCopy() *APIResource {
+	if in == nil {
+		return nil
+	}
+	out := new(APIResource)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *APIResourceList) DeepCopyInto(out *APIResourceList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.APIResources != nil {
+		in, out := &in.APIResources, &out.APIResources
+		*out = make([]APIResource, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIResourceList.
+func (in *APIResourceList) DeepCopy() *APIResourceList {
+	if in == nil {
+		return nil
+	}
+	out := new(APIResourceList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *APIResourceList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *APIVersions) DeepCopyInto(out *APIVersions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Versions != nil {
+		in, out := &in.Versions, &out.Versions
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ServerAddressByClientCIDRs != nil {
+		in, out := &in.ServerAddressByClientCIDRs, &out.ServerAddressByClientCIDRs
+		*out = make([]ServerAddressByClientCIDR, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIVersions.
+func (in *APIVersions) DeepCopy() *APIVersions {
+	if in == nil {
+		return nil
+	}
+	out := new(APIVersions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *APIVersions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ApplyOptions) DeepCopyInto(out *ApplyOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.DryRun != nil {
+		in, out := &in.DryRun, &out.DryRun
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplyOptions.
+func (in *ApplyOptions) DeepCopy() *ApplyOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(ApplyOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Condition) DeepCopyInto(out *Condition) {
+	*out = *in
+	in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Condition.
+func (in *Condition) DeepCopy() *Condition {
+	if in == nil {
+		return nil
+	}
+	out := new(Condition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CreateOptions) DeepCopyInto(out *CreateOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.DryRun != nil {
+		in, out := &in.DryRun, &out.DryRun
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CreateOptions.
+func (in *CreateOptions) DeepCopy() *CreateOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(CreateOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CreateOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DeleteOptions) DeepCopyInto(out *DeleteOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.GracePeriodSeconds != nil {
+		in, out := &in.GracePeriodSeconds, &out.GracePeriodSeconds
+		*out = new(int64)
+		**out = **in
+	}
+	if in.Preconditions != nil {
+		in, out := &in.Preconditions, &out.Preconditions
+		*out = new(Preconditions)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.OrphanDependents != nil {
+		in, out := &in.OrphanDependents, &out.OrphanDependents
+		*out = new(bool)
+		**out = **in
+	}
+	if in.PropagationPolicy != nil {
+		in, out := &in.PropagationPolicy, &out.PropagationPolicy
+		*out = new(DeletionPropagation)
+		**out = **in
+	}
+	if in.DryRun != nil {
+		in, out := &in.DryRun, &out.DryRun
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.IgnoreStoreReadErrorWithClusterBreakingPotential != nil {
+		in, out := &in.IgnoreStoreReadErrorWithClusterBreakingPotential, &out.IgnoreStoreReadErrorWithClusterBreakingPotential
+		*out = new(bool)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeleteOptions.
+func (in *DeleteOptions) DeepCopy() *DeleteOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(DeleteOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *DeleteOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Duration) DeepCopyInto(out *Duration) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Duration.
+func (in *Duration) DeepCopy() *Duration {
+	if in == nil {
+		return nil
+	}
+	out := new(Duration)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FieldSelectorRequirement) DeepCopyInto(out *FieldSelectorRequirement) {
+	*out = *in
+	if in.Values != nil {
+		in, out := &in.Values, &out.Values
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FieldSelectorRequirement.
+func (in *FieldSelectorRequirement) DeepCopy() *FieldSelectorRequirement {
+	if in == nil {
+		return nil
+	}
+	out := new(FieldSelectorRequirement)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GetOptions) DeepCopyInto(out *GetOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GetOptions.
+func (in *GetOptions) DeepCopy() *GetOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(GetOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *GetOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupKind) DeepCopyInto(out *GroupKind) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupKind.
+func (in *GroupKind) DeepCopy() *GroupKind {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupKind)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupResource) DeepCopyInto(out *GroupResource) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupResource.
+func (in *GroupResource) DeepCopy() *GroupResource {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupResource)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupVersion) DeepCopyInto(out *GroupVersion) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupVersion.
+func (in *GroupVersion) DeepCopy() *GroupVersion {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupVersion)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupVersionForDiscovery) DeepCopyInto(out *GroupVersionForDiscovery) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupVersionForDiscovery.
+func (in *GroupVersionForDiscovery) DeepCopy() *GroupVersionForDiscovery {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupVersionForDiscovery)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupVersionKind) DeepCopyInto(out *GroupVersionKind) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupVersionKind.
+func (in *GroupVersionKind) DeepCopy() *GroupVersionKind {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupVersionKind)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupVersionResource) DeepCopyInto(out *GroupVersionResource) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupVersionResource.
+func (in *GroupVersionResource) DeepCopy() *GroupVersionResource {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupVersionResource)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InternalEvent) DeepCopyInto(out *InternalEvent) {
+	*out = *in
+	if in.Object != nil {
+		out.Object = in.Object.DeepCopyObject()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InternalEvent.
+func (in *InternalEvent) DeepCopy() *InternalEvent {
+	if in == nil {
+		return nil
+	}
+	out := new(InternalEvent)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LabelSelector) DeepCopyInto(out *LabelSelector) {
+	*out = *in
+	if in.MatchLabels != nil {
+		in, out := &in.MatchLabels, &out.MatchLabels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.MatchExpressions != nil {
+		in, out := &in.MatchExpressions, &out.MatchExpressions
+		*out = make([]LabelSelectorRequirement, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LabelSelector.
+func (in *LabelSelector) DeepCopy() *LabelSelector {
+	if in == nil {
+		return nil
+	}
+	out := new(LabelSelector)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LabelSelectorRequirement) DeepCopyInto(out *LabelSelectorRequirement) {
+	*out = *in
+	if in.Values != nil {
+		in, out := &in.Values, &out.Values
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LabelSelectorRequirement.
+func (in *LabelSelectorRequirement) DeepCopy() *LabelSelectorRequirement {
+	if in == nil {
+		return nil
+	}
+	out := new(LabelSelectorRequirement)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *List) DeepCopyInto(out *List) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.RawExtension, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new List.
+func (in *List) DeepCopy() *List {
+	if in == nil {
+		return nil
+	}
+	out := new(List)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *List) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListMeta) DeepCopyInto(out *ListMeta) {
+	*out = *in
+	if in.RemainingItemCount != nil {
+		in, out := &in.RemainingItemCount, &out.RemainingItemCount
+		*out = new(int64)
+		**out = **in
+	}
+	if in.ShardInfo != nil {
+		in, out := &in.ShardInfo, &out.ShardInfo
+		*out = new(ShardInfo)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListMeta.
+func (in *ListMeta) DeepCopy() *ListMeta {
+	if in == nil {
+		return nil
+	}
+	out := new(ListMeta)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListOptions) DeepCopyInto(out *ListOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.TimeoutSeconds != nil {
+		in, out := &in.TimeoutSeconds, &out.TimeoutSeconds
+		*out = new(int64)
+		**out = **in
+	}
+	if in.SendInitialEvents != nil {
+		in, out := &in.SendInitialEvents, &out.SendInitialEvents
+		*out = new(bool)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListOptions.
+func (in *ListOptions) DeepCopy() *ListOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(ListOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ListOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ManagedFieldsEntry) DeepCopyInto(out *ManagedFieldsEntry) {
+	*out = *in
+	if in.Time != nil {
+		in, out := &in.Time, &out.Time
+		*out = (*in).DeepCopy()
+	}
+	if in.FieldsV1 != nil {
+		in, out := &in.FieldsV1, &out.FieldsV1
+		*out = (*in).DeepCopy()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedFieldsEntry.
+func (in *ManagedFieldsEntry) DeepCopy() *ManagedFieldsEntry {
+	if in == nil {
+		return nil
+	}
+	out := new(ManagedFieldsEntry)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MicroTime.
+func (in *MicroTime) DeepCopy() *MicroTime {
+	if in == nil {
+		return nil
+	}
+	out := new(MicroTime)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ObjectMeta) DeepCopyInto(out *ObjectMeta) {
+	*out = *in
+	in.CreationTimestamp.DeepCopyInto(&out.CreationTimestamp)
+	if in.DeletionTimestamp != nil {
+		in, out := &in.DeletionTimestamp, &out.DeletionTimestamp
+		*out = (*in).DeepCopy()
+	}
+	if in.DeletionGracePeriodSeconds != nil {
+		in, out := &in.DeletionGracePeriodSeconds, &out.DeletionGracePeriodSeconds
+		*out = new(int64)
+		**out = **in
+	}
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.OwnerReferences != nil {
+		in, out := &in.OwnerReferences, &out.OwnerReferences
+		*out = make([]OwnerReference, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Finalizers != nil {
+		in, out := &in.Finalizers, &out.Finalizers
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ManagedFields != nil {
+		in, out := &in.ManagedFields, &out.ManagedFields
+		*out = make([]ManagedFieldsEntry, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ObjectMeta.
+func (in *ObjectMeta) DeepCopy() *ObjectMeta {
+	if in == nil {
+		return nil
+	}
+	out := new(ObjectMeta)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *OwnerReference) DeepCopyInto(out *OwnerReference) {
+	*out = *in
+	if in.Controller != nil {
+		in, out := &in.Controller, &out.Controller
+		*out = new(bool)
+		**out = **in
+	}
+	if in.BlockOwnerDeletion != nil {
+		in, out := &in.BlockOwnerDeletion, &out.BlockOwnerDeletion
+		*out = new(bool)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OwnerReference.
+func (in *OwnerReference) DeepCopy() *OwnerReference {
+	if in == nil {
+		return nil
+	}
+	out := new(OwnerReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PartialObjectMetadata) DeepCopyInto(out *PartialObjectMetadata) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PartialObjectMetadata.
+func (in *PartialObjectMetadata) DeepCopy() *PartialObjectMetadata {
+	if in == nil {
+		return nil
+	}
+	out := new(PartialObjectMetadata)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PartialObjectMetadata) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PartialObjectMetadataList) DeepCopyInto(out *PartialObjectMetadataList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]PartialObjectMetadata, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PartialObjectMetadataList.
+func (in *PartialObjectMetadataList) DeepCopy() *PartialObjectMetadataList {
+	if in == nil {
+		return nil
+	}
+	out := new(PartialObjectMetadataList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PartialObjectMetadataList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Patch) DeepCopyInto(out *Patch) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Patch.
+func (in *Patch) DeepCopy() *Patch {
+	if in == nil {
+		return nil
+	}
+	out := new(Patch)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PatchOptions) DeepCopyInto(out *PatchOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.DryRun != nil {
+		in, out := &in.DryRun, &out.DryRun
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Force != nil {
+		in, out := &in.Force, &out.Force
+		*out = new(bool)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PatchOptions.
+func (in *PatchOptions) DeepCopy() *PatchOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(PatchOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PatchOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Preconditions) DeepCopyInto(out *Preconditions) {
+	*out = *in
+	if in.UID != nil {
+		in, out := &in.UID, &out.UID
+		*out = new(types.UID)
+		**out = **in
+	}
+	if in.ResourceVersion != nil {
+		in, out := &in.ResourceVersion, &out.ResourceVersion
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Preconditions.
+func (in *Preconditions) DeepCopy() *Preconditions {
+	if in == nil {
+		return nil
+	}
+	out := new(Preconditions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RootPaths) DeepCopyInto(out *RootPaths) {
+	*out = *in
+	if in.Paths != nil {
+		in, out := &in.Paths, &out.Paths
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RootPaths.
+func (in *RootPaths) DeepCopy() *RootPaths {
+	if in == nil {
+		return nil
+	}
+	out := new(RootPaths)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ServerAddressByClientCIDR) DeepCopyInto(out *ServerAddressByClientCIDR) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServerAddressByClientCIDR.
+func (in *ServerAddressByClientCIDR) DeepCopy() *ServerAddressByClientCIDR {
+	if in == nil {
+		return nil
+	}
+	out := new(ServerAddressByClientCIDR)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ShardInfo) DeepCopyInto(out *ShardInfo) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ShardInfo.
+func (in *ShardInfo) DeepCopy() *ShardInfo {
+	if in == nil {
+		return nil
+	}
+	out := new(ShardInfo)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Status) DeepCopyInto(out *Status) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Details != nil {
+		in, out := &in.Details, &out.Details
+		*out = new(StatusDetails)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Status.
+func (in *Status) DeepCopy() *Status {
+	if in == nil {
+		return nil
+	}
+	out := new(Status)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Status) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StatusCause) DeepCopyInto(out *StatusCause) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StatusCause.
+func (in *StatusCause) DeepCopy() *StatusCause {
+	if in == nil {
+		return nil
+	}
+	out := new(StatusCause)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StatusDetails) DeepCopyInto(out *StatusDetails) {
+	*out = *in
+	if in.Causes != nil {
+		in, out := &in.Causes, &out.Causes
+		*out = make([]StatusCause, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StatusDetails.
+func (in *StatusDetails) DeepCopy() *StatusDetails {
+	if in == nil {
+		return nil
+	}
+	out := new(StatusDetails)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Table) DeepCopyInto(out *Table) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.ColumnDefinitions != nil {
+		in, out := &in.ColumnDefinitions, &out.ColumnDefinitions
+		*out = make([]TableColumnDefinition, len(*in))
+		copy(*out, *in)
+	}
+	if in.Rows != nil {
+		in, out := &in.Rows, &out.Rows
+		*out = make([]TableRow, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Table.
+func (in *Table) DeepCopy() *Table {
+	if in == nil {
+		return nil
+	}
+	out := new(Table)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Table) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TableColumnDefinition) DeepCopyInto(out *TableColumnDefinition) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TableColumnDefinition.
+func (in *TableColumnDefinition) DeepCopy() *TableColumnDefinition {
+	if in == nil {
+		return nil
+	}
+	out := new(TableColumnDefinition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TableOptions) DeepCopyInto(out *TableOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TableOptions.
+func (in *TableOptions) DeepCopy() *TableOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(TableOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TableOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TableRow) DeepCopyInto(out *TableRow) {
+	clone := in.DeepCopy()
+	*out = *clone
+	return
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TableRowCondition) DeepCopyInto(out *TableRowCondition) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TableRowCondition.
+func (in *TableRowCondition) DeepCopy() *TableRowCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(TableRowCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Time.
+func (in *Time) DeepCopy() *Time {
+	if in == nil {
+		return nil
+	}
+	out := new(Time)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Timestamp) DeepCopyInto(out *Timestamp) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Timestamp.
+func (in *Timestamp) DeepCopy() *Timestamp {
+	if in == nil {
+		return nil
+	}
+	out := new(Timestamp)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UpdateOptions) DeepCopyInto(out *UpdateOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.DryRun != nil {
+		in, out := &in.DryRun, &out.DryRun
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UpdateOptions.
+func (in *UpdateOptions) DeepCopy() *UpdateOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(UpdateOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *UpdateOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in Verbs) DeepCopyInto(out *Verbs) {
+	{
+		in := &in
+		*out = make(Verbs, len(*in))
+		copy(*out, *in)
+		return
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Verbs.
+func (in Verbs) DeepCopy() Verbs {
+	if in == nil {
+		return nil
+	}
+	out := new(Verbs)
+	in.DeepCopyInto(out)
+	return *out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WatchEvent) DeepCopyInto(out *WatchEvent) {
+	*out = *in
+	in.Object.DeepCopyInto(&out.Object)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WatchEvent.
+func (in *WatchEvent) DeepCopy() *WatchEvent {
+	if in == nil {
+		return nil
+	}
+	out := new(WatchEvent)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *WatchEvent) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.defaults.go
new file mode 100644
index 0000000000..dac177e93b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.model_name.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.model_name.go
new file mode 100644
index 0000000000..3df687707c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.model_name.go
@@ -0,0 +1,272 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package v1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIGroup) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.APIGroup"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIGroupList) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.APIGroupList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIResource) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.APIResource"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIResourceList) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.APIResourceList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIVersions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.APIVersions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ApplyOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.ApplyOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Condition) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Condition"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CreateOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.CreateOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeleteOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Duration) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Duration"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in FieldSelectorRequirement) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.FieldSelectorRequirement"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in FieldsV1) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GetOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.GetOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GroupKind) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.GroupKind"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GroupResource) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.GroupResource"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GroupVersion) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.GroupVersion"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GroupVersionForDiscovery) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.GroupVersionForDiscovery"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GroupVersionKind) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.GroupVersionKind"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GroupVersionResource) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.GroupVersionResource"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in InternalEvent) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.InternalEvent"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in LabelSelector) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in LabelSelectorRequirement) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in List) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.List"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ListMeta) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.ListMeta"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ListOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.ListOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ManagedFieldsEntry) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in MicroTime) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.MicroTime"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ObjectMeta) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in OwnerReference) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PartialObjectMetadata) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.PartialObjectMetadata"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PartialObjectMetadataList) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.PartialObjectMetadataList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Patch) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Patch"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PatchOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.PatchOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Preconditions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Preconditions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in RootPaths) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.RootPaths"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ServerAddressByClientCIDR) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.ServerAddressByClientCIDR"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ShardInfo) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.ShardInfo"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Status) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Status"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in StatusCause) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.StatusCause"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in StatusDetails) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.StatusDetails"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Table) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Table"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TableColumnDefinition) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.TableColumnDefinition"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TableOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.TableOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TableRow) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.TableRow"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TableRowCondition) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.TableRowCondition"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Time) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Time"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Timestamp) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Timestamp"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TypeMeta) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.TypeMeta"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in UpdateOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.UpdateOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WatchEvent) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent"
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/conversion.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/conversion.go
new file mode 100644
index 0000000000..5cac6fba5a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/conversion.go
@@ -0,0 +1,46 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	"unsafe"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+)
+
+// Convert_Slice_string_To_v1beta1_IncludeObjectPolicy allows converting a URL query parameter value
+func Convert_Slice_string_To_v1beta1_IncludeObjectPolicy(in *[]string, out *IncludeObjectPolicy, s conversion.Scope) error {
+	if len(*in) > 0 {
+		*out = IncludeObjectPolicy((*in)[0])
+	}
+	return nil
+}
+
+// Convert_v1beta1_PartialObjectMetadataList_To_v1_PartialObjectMetadataList allows converting PartialObjectMetadataList between versions
+func Convert_v1beta1_PartialObjectMetadataList_To_v1_PartialObjectMetadataList(in *PartialObjectMetadataList, out *v1.PartialObjectMetadataList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	out.Items = *(*[]v1.PartialObjectMetadata)(unsafe.Pointer(&in.Items))
+	return nil
+}
+
+// Convert_v1_PartialObjectMetadataList_To_v1beta1_PartialObjectMetadataList allows converting PartialObjectMetadataList between versions
+func Convert_v1_PartialObjectMetadataList_To_v1beta1_PartialObjectMetadataList(in *v1.PartialObjectMetadataList, out *PartialObjectMetadataList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	out.Items = *(*[]v1.PartialObjectMetadata)(unsafe.Pointer(&in.Items))
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/deepcopy.go
new file mode 100644
index 0000000000..2b7e8ca0bf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/deepcopy.go
@@ -0,0 +1,17 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/doc.go
new file mode 100644
index 0000000000..159ca0573f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/doc.go
@@ -0,0 +1,24 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +k8s:openapi-gen=true
+// +k8s:defaulter-gen=TypeMeta
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.apis.meta.v1beta1
+
+// +groupName=meta.k8s.io
+
+package v1beta1
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.pb.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.pb.go
new file mode 100644
index 0000000000..3c763898e7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.pb.go
@@ -0,0 +1,341 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.proto
+
+package v1beta1
+
+import (
+	fmt "fmt"
+
+	io "io"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	math_bits "math/bits"
+	reflect "reflect"
+	strings "strings"
+)
+
+func (m *PartialObjectMetadataList) Reset() { *m = PartialObjectMetadataList{} }
+
+func (m *PartialObjectMetadataList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PartialObjectMetadataList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PartialObjectMetadataList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *PartialObjectMetadataList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozGenerated(x uint64) (n int) {
+	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *PartialObjectMetadataList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]PartialObjectMetadata{"
+	for _, f := range this.Items {
+		repeatedStringForItems += fmt.Sprintf("%v", f) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&PartialObjectMetadataList{`,
+		`Items:` + repeatedStringForItems + `,`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringGenerated(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *PartialObjectMetadataList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PartialObjectMetadataList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PartialObjectMetadataList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, v1.PartialObjectMetadata{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipGenerated(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLengthGenerated
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupGenerated
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthGenerated
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+var (
+	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.proto b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.proto
new file mode 100644
index 0000000000..fcec553542
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.proto
@@ -0,0 +1,41 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.apimachinery.pkg.apis.meta.v1beta1;
+
+import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
+import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/apimachinery/pkg/apis/meta/v1beta1";
+
+// PartialObjectMetadataList contains a list of objects containing only their metadata.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+message PartialObjectMetadataList {
+  // Standard list metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 2;
+
+  // items contains each of the included items.
+  repeated .k8s.io.apimachinery.pkg.apis.meta.v1.PartialObjectMetadata items = 1;
+}
+
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/register.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/register.go
new file mode 100644
index 0000000000..a4a412e335
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/register.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName is the group name for this API.
+const GroupName = "meta.k8s.io"
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1beta1"}
+
+// Kind takes an unqualified kind and returns a Group qualified GroupKind
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// AddMetaToScheme registers base meta types into schemas.
+func AddMetaToScheme(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&Table{},
+		&TableOptions{},
+		&PartialObjectMetadata{},
+		&PartialObjectMetadataList{},
+	)
+
+	return nil
+}
+
+// RegisterConversions adds conversion functions to the given scheme.
+func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*PartialObjectMetadataList)(nil), (*v1.PartialObjectMetadataList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1beta1_PartialObjectMetadataList_To_v1_PartialObjectMetadataList(a.(*PartialObjectMetadataList), b.(*v1.PartialObjectMetadataList), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*v1.PartialObjectMetadataList)(nil), (*PartialObjectMetadataList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_PartialObjectMetadataList_To_v1beta1_PartialObjectMetadataList(a.(*v1.PartialObjectMetadataList), b.(*PartialObjectMetadataList), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types.go
new file mode 100644
index 0000000000..1cda0840ac
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types.go
@@ -0,0 +1,85 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// package v1beta1 is alpha objects from meta that will be introduced.
+package v1beta1
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// Table is a tabular representation of a set of API resources. The server transforms the
+// object into a set of preferred columns for quickly reviewing the objects.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +protobuf=false
+type Table = v1.Table
+
+// TableColumnDefinition contains information about a column returned in the Table.
+// +protobuf=false
+type TableColumnDefinition = v1.TableColumnDefinition
+
+// TableRow is an individual row in a table.
+// +protobuf=false
+type TableRow = v1.TableRow
+
+// TableRowCondition allows a row to be marked with additional information.
+// +protobuf=false
+type TableRowCondition = v1.TableRowCondition
+
+type RowConditionType = v1.RowConditionType
+
+type ConditionStatus = v1.ConditionStatus
+
+type IncludeObjectPolicy = v1.IncludeObjectPolicy
+
+// TableOptions are used when a Table is requested by the caller.
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type TableOptions = v1.TableOptions
+
+// PartialObjectMetadata is a generic representation of any object with ObjectMeta. It allows clients
+// to get access to a particular ObjectMeta schema without knowing the details of the version.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type PartialObjectMetadata = v1.PartialObjectMetadata
+
+// IMPORTANT: PartialObjectMetadataList has different protobuf field ids in v1beta1 than
+// v1 because ListMeta was accidentally omitted prior to 1.15. Therefore this type must
+// remain independent of v1.PartialObjectMetadataList to preserve mappings.
+
+// PartialObjectMetadataList contains a list of objects containing only their metadata.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type PartialObjectMetadataList struct {
+	v1.TypeMeta `json:""`
+	// Standard list metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	v1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,2,opt,name=metadata"`
+
+	// items contains each of the included items.
+	Items []v1.PartialObjectMetadata `json:"items" protobuf:"bytes,1,rep,name=items"`
+}
+
+const (
+	RowCompleted = v1.RowCompleted
+
+	ConditionTrue    = v1.ConditionTrue
+	ConditionFalse   = v1.ConditionFalse
+	ConditionUnknown = v1.ConditionUnknown
+
+	IncludeNone     = v1.IncludeNone
+	IncludeMetadata = v1.IncludeMetadata
+	IncludeObject   = v1.IncludeObject
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types_swagger_doc_generated.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types_swagger_doc_generated.go
new file mode 100644
index 0000000000..dff735dcf3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types_swagger_doc_generated.go
@@ -0,0 +1,40 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+// This file contains a collection of methods that can be used from go-restful to
+// generate Swagger API documentation for its models. Please read this PR for more
+// information on the implementation: https://github.com/emicklei/go-restful/pull/215
+//
+// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if
+// they are on one line! For multiple line or blocks that you want to ignore use ---.
+// Any context after a --- is ignored.
+//
+// Those methods can be generated by using hack/update-codegen.sh
+
+// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
+var map_PartialObjectMetadataList = map[string]string{
+	"":         "PartialObjectMetadataList contains a list of objects containing only their metadata.",
+	"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"items":    "items contains each of the included items.",
+}
+
+func (PartialObjectMetadataList) SwaggerDoc() map[string]string {
+	return map_PartialObjectMetadataList
+}
+
+// AUTO-GENERATED FUNCTIONS END HERE
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/validation/validation.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/validation/validation.go
new file mode 100644
index 0000000000..563b62efa5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/validation/validation.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// ValidateTableOptions returns any invalid flags on TableOptions.
+func ValidateTableOptions(opts *metav1.TableOptions) field.ErrorList {
+	var allErrs field.ErrorList
+	switch opts.IncludeObject {
+	case metav1.IncludeMetadata, metav1.IncludeNone, metav1.IncludeObject, "":
+	default:
+		allErrs = append(allErrs, field.Invalid(field.NewPath("includeObject"), opts.IncludeObject, "must be 'Metadata', 'Object', 'None', or empty"))
+	}
+	return allErrs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..972b7f03ea
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.deepcopy.go
@@ -0,0 +1,60 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PartialObjectMetadataList) DeepCopyInto(out *PartialObjectMetadataList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]v1.PartialObjectMetadata, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PartialObjectMetadataList.
+func (in *PartialObjectMetadataList) DeepCopy() *PartialObjectMetadataList {
+	if in == nil {
+		return nil
+	}
+	out := new(PartialObjectMetadataList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PartialObjectMetadataList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.defaults.go
new file mode 100644
index 0000000000..198b5be4af
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.model_name.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.model_name.go
new file mode 100644
index 0000000000..9c3600119a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.model_name.go
@@ -0,0 +1,27 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package v1beta1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PartialObjectMetadataList) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1beta1.PartialObjectMetadataList"
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/doc.go
new file mode 100644
index 0000000000..4307afaf35
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/doc.go
@@ -0,0 +1,22 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +groupName=testapigroup.apimachinery.k8s.io
+//
+// package testapigroup contains an testapigroup API used to demonstrate how to create api groups. Moreover, this is
+// used within tests.
+package testapigroup
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/fuzzer/fuzzer.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/fuzzer/fuzzer.go
new file mode 100644
index 0000000000..ff98239713
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/fuzzer/fuzzer.go
@@ -0,0 +1,99 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fuzzer
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/randfill"
+
+	apitesting "k8s.io/apimachinery/pkg/api/apitesting"
+	"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	v1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
+)
+
+// overrideMetaFuncs override some generic fuzzer funcs from k8s.io/apimachinery in order to have more realistic
+// values in a Kubernetes context.
+func overrideMetaFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
+	return []interface{}{
+		func(j *runtime.Object, c randfill.Continue) {
+			// TODO: uncomment when round trip starts from a versioned object
+			if true { // c.Bool() {
+				*j = &runtime.Unknown{
+					// We do not set TypeMeta here because it is not carried through a round trip
+					Raw:         []byte(`{"apiVersion":"unknown.group/unknown","kind":"Something","someKey":"someValue"}`),
+					ContentType: runtime.ContentTypeJSON,
+				}
+			} else {
+				types := []runtime.Object{&testapigroup.Carp{}}
+				t := types[c.Rand.Intn(len(types))]
+				c.Fill(t)
+				*j = t
+			}
+		},
+		func(r *runtime.RawExtension, c randfill.Continue) {
+			// Pick an arbitrary type and fuzz it
+			types := []runtime.Object{&testapigroup.Carp{}}
+			obj := types[c.Rand.Intn(len(types))]
+			c.Fill(obj)
+
+			// Convert the object to raw bytes
+			bytes, err := runtime.Encode(apitesting.TestCodec(codecs, v1.SchemeGroupVersion), obj)
+			if err != nil {
+				panic(fmt.Sprintf("Failed to encode object: %v", err))
+			}
+
+			// Set the bytes field on the RawExtension
+			r.Raw = bytes
+		},
+	}
+}
+
+func testapigroupFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
+	return []interface{}{
+		func(s *testapigroup.CarpSpec, c randfill.Continue) {
+			c.FillNoCustom(s)
+			// has a default value
+			ttl := int64(30)
+			if c.Bool() {
+				ttl = int64(c.Uint32())
+			}
+			s.TerminationGracePeriodSeconds = &ttl
+
+			if s.SchedulerName == "" {
+				s.SchedulerName = "default-scheduler"
+			}
+		},
+		func(j *testapigroup.CarpPhase, c randfill.Continue) {
+			statuses := []testapigroup.CarpPhase{"Pending", "Running", "Succeeded", "Failed", "Unknown"}
+			*j = statuses[c.Rand.Intn(len(statuses))]
+		},
+		func(rp *testapigroup.RestartPolicy, c randfill.Continue) {
+			policies := []testapigroup.RestartPolicy{"Always", "Never", "OnFailure"}
+			*rp = policies[c.Rand.Intn(len(policies))]
+		},
+	}
+}
+
+// Funcs returns the fuzzer functions for the testapigroup.
+var Funcs = fuzzer.MergeFuzzerFuncs(
+	overrideMetaFuncs,
+	testapigroupFuncs,
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/install/install.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/install/install.go
new file mode 100644
index 0000000000..6fc079f51b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/install/install.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package install installs the certificates API group, making it available as
+// an option to all of the API encoding/decoding machinery.
+package install
+
+import (
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	"k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// Install registers the API group and adds types to a scheme
+func Install(scheme *runtime.Scheme) {
+	utilruntime.Must(testapigroup.AddToScheme(scheme))
+	utilruntime.Must(v1.AddToScheme(scheme))
+	utilruntime.Must(scheme.SetVersionPriority(v1.SchemeGroupVersion))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/install/roundtrip_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/install/roundtrip_test.go
new file mode 100644
index 0000000000..7e9b427a87
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/install/roundtrip_test.go
@@ -0,0 +1,29 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package install
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/apitesting/roundtrip"
+	testapigroupfuzzer "k8s.io/apimachinery/pkg/apis/testapigroup/fuzzer"
+)
+
+func TestRoundTrip(t *testing.T) {
+	roundtrip.RoundTripTestForAPIGroup(t, Install, testapigroupfuzzer.Funcs)
+	roundtrip.RoundTripProtobufTestForAPIGroup(t, Install, testapigroupfuzzer.Funcs)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/register.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/register.go
new file mode 100644
index 0000000000..f70c5a83b4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/register.go
@@ -0,0 +1,52 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testapigroup
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var (
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+	AddToScheme   = SchemeBuilder.AddToScheme
+)
+
+// GroupName is the group name use in this package
+const GroupName = "testapigroup.apimachinery.k8s.io"
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
+
+// Kind takes an unqualified kind and returns a Group qualified GroupKind
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&Carp{},
+		&CarpList{},
+	)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/types.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/types.go
new file mode 100644
index 0000000000..884963fede
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/types.go
@@ -0,0 +1,161 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testapigroup
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type (
+	ConditionStatus   string
+	CarpConditionType string
+	CarpPhase         string
+	RestartPolicy     string
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// Carp is a collection of containers, used as either input (create, update) or as output (list, get).
+type Carp struct {
+	metav1.TypeMeta
+	// +optional
+	metav1.ObjectMeta
+
+	// Spec defines the behavior of a carp.
+	// +optional
+	Spec CarpSpec
+
+	// Status represents the current information about a carp. This data may not be up
+	// to date.
+	// +optional
+	Status CarpStatus
+}
+
+// CarpStatus represents information about the status of a carp. Status may trail the actual
+// state of a system.
+type CarpStatus struct {
+	// +optional
+	Phase CarpPhase
+	// +optional
+	Conditions []CarpCondition
+	// A human readable message indicating details about why the carp is in this state.
+	// +optional
+	Message string
+	// A brief CamelCase message indicating details about why the carp is in this state. e.g. 'DiskPressure'
+	// +optional
+	Reason string
+
+	// +optional
+	HostIP string
+	// +optional
+	CarpIP string
+
+	// Date and time at which the object was acknowledged by the Kubelet.
+	// This is before the Kubelet pulled the container image(s) for the carp.
+	// +optional
+	StartTime *metav1.Time
+
+	// Carp infos are provided by different clients, hence the map type.
+	//
+	// +listType=map
+	// +listKey=a
+	// +listKey=b
+	// +listKey=c
+	Infos []CarpInfo
+}
+
+type CarpCondition struct {
+	Type   CarpConditionType
+	Status ConditionStatus
+	// +optional
+	LastProbeTime metav1.Time
+	// +optional
+	LastTransitionTime metav1.Time
+	// +optional
+	Reason string
+	// +optional
+	Message string
+}
+
+type CarpInfo struct {
+	// A is the first map key.
+	// +required
+	A int64
+	// B is the second map key.
+	// +required
+	B string
+	// C is the third, optional map key
+	// +optional
+	C *string
+
+	// Some data for each pair of A and B.
+	Data string
+}
+
+// CarpSpec is a description of a carp
+type CarpSpec struct {
+	// +optional
+	RestartPolicy RestartPolicy
+	// Optional duration in seconds the carp needs to terminate gracefully. May be decreased in delete request.
+	// Value must be non-negative integer. The value zero indicates delete immediately.
+	// If this value is nil, the default grace period will be used instead.
+	// The grace period is the duration in seconds after the processes running in the carp are sent
+	// a termination signal and the time when the processes are forcibly halted with a kill signal.
+	// Set this value longer than the expected cleanup time for your process.
+	// +optional
+	TerminationGracePeriodSeconds *int64
+	// Optional duration in seconds relative to the StartTime that the carp may be active on a node
+	// before the system actively tries to terminate the carp; value must be positive integer
+	// +optional
+	ActiveDeadlineSeconds *int64
+	// NodeSelector is a selector which must be true for the carp to fit on a node
+	// +optional
+	NodeSelector map[string]string
+
+	// ServiceAccountName is the name of the ServiceAccount to use to run this carp
+	// The carp will be allowed to use secrets referenced by the ServiceAccount
+	ServiceAccountName string
+
+	// NodeName is a request to schedule this carp onto a specific node.  If it is non-empty,
+	// the scheduler simply schedules this carp onto that node, assuming that it fits resource
+	// requirements.
+	// +optional
+	NodeName string
+	// Specifies the hostname of the Carp.
+	// If not specified, the carp's hostname will be set to a system-defined value.
+	// +optional
+	Hostname string
+	// If specified, the fully qualified Carp hostname will be "<hostname>.<subdomain>.<carp namespace>.svc.<cluster domain>".
+	// If not specified, the carp will not have a domainname at all.
+	// +optional
+	Subdomain string
+	// If specified, the carp will be dispatched by specified scheduler.
+	// If not specified, the carp will be dispatched by default scheduler.
+	// +optional
+	SchedulerName string
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// CarpList is a list of Carps.
+type CarpList struct {
+	metav1.TypeMeta
+	// +optional
+	metav1.ListMeta
+
+	Items []Carp
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/conversion.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/conversion.go
new file mode 100644
index 0000000000..3e8448f4c5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/conversion.go
@@ -0,0 +1,26 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func addConversionFuncs(scheme *runtime.Scheme) error {
+	// Add non-generated conversion functions here. Currently there are none.
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/defaults.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/defaults.go
new file mode 100644
index 0000000000..436ccde296
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/defaults.go
@@ -0,0 +1,26 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func addDefaultingFuncs(scheme *runtime.Scheme) error {
+	// return RegisterDefaults(scheme)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/doc.go
new file mode 100644
index 0000000000..35bdf7c7cf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/doc.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen=package
+// +k8s:conversion-gen=k8s.io/apimachinery/pkg/apis/testapigroup
+// +k8s:openapi-gen=false
+// +k8s:defaulter-gen=TypeMeta
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.apis.testapigroup.v1
+
+// +k8s:prerelease-lifecycle-gen=true
+// +groupName=testapigroup.apimachinery.k8s.io
+
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/generated.pb.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/generated.pb.go
new file mode 100644
index 0000000000..b1af782b02
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/generated.pb.go
@@ -0,0 +1,2323 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/apimachinery/pkg/apis/testapigroup/v1/generated.proto
+
+package v1
+
+import (
+	fmt "fmt"
+
+	io "io"
+	"sort"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	math_bits "math/bits"
+	reflect "reflect"
+	strings "strings"
+)
+
+func (m *Carp) Reset() { *m = Carp{} }
+
+func (m *CarpCondition) Reset() { *m = CarpCondition{} }
+
+func (m *CarpInfo) Reset() { *m = CarpInfo{} }
+
+func (m *CarpList) Reset() { *m = CarpList{} }
+
+func (m *CarpSpec) Reset() { *m = CarpSpec{} }
+
+func (m *CarpStatus) Reset() { *m = CarpStatus{} }
+
+func (m *Carp) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Carp) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Carp) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *CarpCondition) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CarpCondition) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CarpCondition) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Message)
+	copy(dAtA[i:], m.Message)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message)))
+	i--
+	dAtA[i] = 0x32
+	i -= len(m.Reason)
+	copy(dAtA[i:], m.Reason)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Reason)))
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.LastTransitionTime.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.LastProbeTime.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Status)
+	copy(dAtA[i:], m.Status)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Type)
+	copy(dAtA[i:], m.Type)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *CarpInfo) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CarpInfo) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CarpInfo) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.C != nil {
+		i -= len(*m.C)
+		copy(dAtA[i:], *m.C)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.C)))
+		i--
+		dAtA[i] = 0x22
+	}
+	i -= len(m.Data)
+	copy(dAtA[i:], m.Data)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Data)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.B)
+	copy(dAtA[i:], m.B)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.B)))
+	i--
+	dAtA[i] = 0x12
+	i = encodeVarintGenerated(dAtA, i, uint64(m.A))
+	i--
+	dAtA[i] = 0x8
+	return len(dAtA) - i, nil
+}
+
+func (m *CarpList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CarpList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CarpList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *CarpSpec) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CarpSpec) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CarpSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.SchedulerName)
+	copy(dAtA[i:], m.SchedulerName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.SchedulerName)))
+	i--
+	dAtA[i] = 0x1
+	i--
+	dAtA[i] = 0x9a
+	i -= len(m.Subdomain)
+	copy(dAtA[i:], m.Subdomain)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Subdomain)))
+	i--
+	dAtA[i] = 0x1
+	i--
+	dAtA[i] = 0x8a
+	i -= len(m.Hostname)
+	copy(dAtA[i:], m.Hostname)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Hostname)))
+	i--
+	dAtA[i] = 0x1
+	i--
+	dAtA[i] = 0x82
+	i--
+	if m.HostIPC {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x68
+	i--
+	if m.HostPID {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x60
+	i--
+	if m.HostNetwork {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x58
+	i -= len(m.NodeName)
+	copy(dAtA[i:], m.NodeName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.NodeName)))
+	i--
+	dAtA[i] = 0x52
+	i -= len(m.DeprecatedServiceAccount)
+	copy(dAtA[i:], m.DeprecatedServiceAccount)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.DeprecatedServiceAccount)))
+	i--
+	dAtA[i] = 0x4a
+	i -= len(m.ServiceAccountName)
+	copy(dAtA[i:], m.ServiceAccountName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ServiceAccountName)))
+	i--
+	dAtA[i] = 0x42
+	if len(m.NodeSelector) > 0 {
+		keysForNodeSelector := make([]string, 0, len(m.NodeSelector))
+		for k := range m.NodeSelector {
+			keysForNodeSelector = append(keysForNodeSelector, string(k))
+		}
+		sort.Strings(keysForNodeSelector)
+		for iNdEx := len(keysForNodeSelector) - 1; iNdEx >= 0; iNdEx-- {
+			v := m.NodeSelector[string(keysForNodeSelector[iNdEx])]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = encodeVarintGenerated(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(keysForNodeSelector[iNdEx])
+			copy(dAtA[i:], keysForNodeSelector[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForNodeSelector[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintGenerated(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x3a
+		}
+	}
+	if m.ActiveDeadlineSeconds != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.ActiveDeadlineSeconds))
+		i--
+		dAtA[i] = 0x28
+	}
+	if m.TerminationGracePeriodSeconds != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.TerminationGracePeriodSeconds))
+		i--
+		dAtA[i] = 0x20
+	}
+	i -= len(m.RestartPolicy)
+	copy(dAtA[i:], m.RestartPolicy)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.RestartPolicy)))
+	i--
+	dAtA[i] = 0x1a
+	return len(dAtA) - i, nil
+}
+
+func (m *CarpStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CarpStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CarpStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Infos) > 0 {
+		for iNdEx := len(m.Infos) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Infos[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x42
+		}
+	}
+	if m.StartTime != nil {
+		{
+			size, err := m.StartTime.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x3a
+	}
+	i -= len(m.CarpIP)
+	copy(dAtA[i:], m.CarpIP)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.CarpIP)))
+	i--
+	dAtA[i] = 0x32
+	i -= len(m.HostIP)
+	copy(dAtA[i:], m.HostIP)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.HostIP)))
+	i--
+	dAtA[i] = 0x2a
+	i -= len(m.Reason)
+	copy(dAtA[i:], m.Reason)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Reason)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.Message)
+	copy(dAtA[i:], m.Message)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message)))
+	i--
+	dAtA[i] = 0x1a
+	if len(m.Conditions) > 0 {
+		for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	i -= len(m.Phase)
+	copy(dAtA[i:], m.Phase)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Phase)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *Carp) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ObjectMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Spec.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *CarpCondition) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Type)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Status)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.LastProbeTime.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.LastTransitionTime.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Reason)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Message)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *CarpInfo) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 1 + sovGenerated(uint64(m.A))
+	l = len(m.B)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Data)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.C != nil {
+		l = len(*m.C)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *CarpList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *CarpSpec) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.RestartPolicy)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.TerminationGracePeriodSeconds != nil {
+		n += 1 + sovGenerated(uint64(*m.TerminationGracePeriodSeconds))
+	}
+	if m.ActiveDeadlineSeconds != nil {
+		n += 1 + sovGenerated(uint64(*m.ActiveDeadlineSeconds))
+	}
+	if len(m.NodeSelector) > 0 {
+		for k, v := range m.NodeSelector {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + len(v) + sovGenerated(uint64(len(v)))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
+	l = len(m.ServiceAccountName)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.DeprecatedServiceAccount)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.NodeName)
+	n += 1 + l + sovGenerated(uint64(l))
+	n += 2
+	n += 2
+	n += 2
+	l = len(m.Hostname)
+	n += 2 + l + sovGenerated(uint64(l))
+	l = len(m.Subdomain)
+	n += 2 + l + sovGenerated(uint64(l))
+	l = len(m.SchedulerName)
+	n += 2 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *CarpStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Phase)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Conditions) > 0 {
+		for _, e := range m.Conditions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = len(m.Message)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Reason)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.HostIP)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.CarpIP)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.StartTime != nil {
+		l = m.StartTime.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.Infos) > 0 {
+		for _, e := range m.Infos {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozGenerated(x uint64) (n int) {
+	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *Carp) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Carp{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "CarpSpec", "CarpSpec", 1), `&`, ``, 1) + `,`,
+		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "CarpStatus", "CarpStatus", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CarpCondition) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CarpCondition{`,
+		`Type:` + fmt.Sprintf("%v", this.Type) + `,`,
+		`Status:` + fmt.Sprintf("%v", this.Status) + `,`,
+		`LastProbeTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastProbeTime), "Time", "v1.Time", 1), `&`, ``, 1) + `,`,
+		`LastTransitionTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastTransitionTime), "Time", "v1.Time", 1), `&`, ``, 1) + `,`,
+		`Reason:` + fmt.Sprintf("%v", this.Reason) + `,`,
+		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CarpInfo) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CarpInfo{`,
+		`A:` + fmt.Sprintf("%v", this.A) + `,`,
+		`B:` + fmt.Sprintf("%v", this.B) + `,`,
+		`Data:` + fmt.Sprintf("%v", this.Data) + `,`,
+		`C:` + valueToStringGenerated(this.C) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CarpList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]Carp{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "Carp", "Carp", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&CarpList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CarpSpec) String() string {
+	if this == nil {
+		return "nil"
+	}
+	keysForNodeSelector := make([]string, 0, len(this.NodeSelector))
+	for k := range this.NodeSelector {
+		keysForNodeSelector = append(keysForNodeSelector, k)
+	}
+	sort.Strings(keysForNodeSelector)
+	mapStringForNodeSelector := "map[string]string{"
+	for _, k := range keysForNodeSelector {
+		mapStringForNodeSelector += fmt.Sprintf("%v: %v,", k, this.NodeSelector[k])
+	}
+	mapStringForNodeSelector += "}"
+	s := strings.Join([]string{`&CarpSpec{`,
+		`RestartPolicy:` + fmt.Sprintf("%v", this.RestartPolicy) + `,`,
+		`TerminationGracePeriodSeconds:` + valueToStringGenerated(this.TerminationGracePeriodSeconds) + `,`,
+		`ActiveDeadlineSeconds:` + valueToStringGenerated(this.ActiveDeadlineSeconds) + `,`,
+		`NodeSelector:` + mapStringForNodeSelector + `,`,
+		`ServiceAccountName:` + fmt.Sprintf("%v", this.ServiceAccountName) + `,`,
+		`DeprecatedServiceAccount:` + fmt.Sprintf("%v", this.DeprecatedServiceAccount) + `,`,
+		`NodeName:` + fmt.Sprintf("%v", this.NodeName) + `,`,
+		`HostNetwork:` + fmt.Sprintf("%v", this.HostNetwork) + `,`,
+		`HostPID:` + fmt.Sprintf("%v", this.HostPID) + `,`,
+		`HostIPC:` + fmt.Sprintf("%v", this.HostIPC) + `,`,
+		`Hostname:` + fmt.Sprintf("%v", this.Hostname) + `,`,
+		`Subdomain:` + fmt.Sprintf("%v", this.Subdomain) + `,`,
+		`SchedulerName:` + fmt.Sprintf("%v", this.SchedulerName) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CarpStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForConditions := "[]CarpCondition{"
+	for _, f := range this.Conditions {
+		repeatedStringForConditions += strings.Replace(strings.Replace(f.String(), "CarpCondition", "CarpCondition", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForConditions += "}"
+	repeatedStringForInfos := "[]CarpInfo{"
+	for _, f := range this.Infos {
+		repeatedStringForInfos += strings.Replace(strings.Replace(f.String(), "CarpInfo", "CarpInfo", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForInfos += "}"
+	s := strings.Join([]string{`&CarpStatus{`,
+		`Phase:` + fmt.Sprintf("%v", this.Phase) + `,`,
+		`Conditions:` + repeatedStringForConditions + `,`,
+		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`Reason:` + fmt.Sprintf("%v", this.Reason) + `,`,
+		`HostIP:` + fmt.Sprintf("%v", this.HostIP) + `,`,
+		`CarpIP:` + fmt.Sprintf("%v", this.CarpIP) + `,`,
+		`StartTime:` + strings.Replace(fmt.Sprintf("%v", this.StartTime), "Time", "v1.Time", 1) + `,`,
+		`Infos:` + repeatedStringForInfos + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringGenerated(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *Carp) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Carp: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Carp: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CarpCondition) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CarpCondition: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CarpCondition: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = CarpConditionType(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Status = ConditionStatus(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastProbeTime", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.LastProbeTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastTransitionTime", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.LastTransitionTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CarpInfo) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CarpInfo: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CarpInfo: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field A", wireType)
+			}
+			m.A = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.A |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field B", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.B = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field C", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.C = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CarpList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CarpList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CarpList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, Carp{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CarpSpec) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CarpSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CarpSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RestartPolicy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RestartPolicy = RestartPolicy(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TerminationGracePeriodSeconds", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.TerminationGracePeriodSeconds = &v
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ActiveDeadlineSeconds", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.ActiveDeadlineSeconds = &v
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeSelector", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.NodeSelector == nil {
+				m.NodeSelector = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipGenerated(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.NodeSelector[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceAccountName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServiceAccountName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeprecatedServiceAccount", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DeprecatedServiceAccount = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NodeName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HostNetwork", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.HostNetwork = bool(v != 0)
+		case 12:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HostPID", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.HostPID = bool(v != 0)
+		case 13:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HostIPC", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.HostIPC = bool(v != 0)
+		case 16:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Hostname", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Hostname = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 17:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Subdomain", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Subdomain = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 19:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulerName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SchedulerName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CarpStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CarpStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CarpStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Phase", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Phase = CarpPhase(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Conditions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Conditions = append(m.Conditions, CarpCondition{})
+			if err := m.Conditions[len(m.Conditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HostIP", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.HostIP = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CarpIP", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CarpIP = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StartTime", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.StartTime == nil {
+				m.StartTime = &v1.Time{}
+			}
+			if err := m.StartTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Infos", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Infos = append(m.Infos, CarpInfo{})
+			if err := m.Infos[len(m.Infos)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipGenerated(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLengthGenerated
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupGenerated
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthGenerated
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+var (
+	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/generated.proto b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/generated.proto
new file mode 100644
index 0000000000..c533cae9aa
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/generated.proto
@@ -0,0 +1,239 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.apimachinery.pkg.apis.testapigroup.v1;
+
+import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
+import "k8s.io/apimachinery/pkg/runtime/generated.proto";
+import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/apimachinery/pkg/apis/testapigroup/v1";
+
+// Carp is a collection of containers, used as either input (create, update) or as output (list, get).
+message Carp {
+  // Standard object's metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
+
+  // Specification of the desired behavior of the carp.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+  // +optional
+  optional CarpSpec spec = 2;
+
+  // Most recently observed status of the carp.
+  // This data may not be up to date.
+  // Populated by the system.
+  // Read-only.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+  // +optional
+  optional CarpStatus status = 3;
+}
+
+message CarpCondition {
+  // Type is the type of the condition.
+  // Currently only Ready.
+  // More info: http://kubernetes.io/docs/user-guide/carp-states#carp-conditions
+  optional string type = 1;
+
+  // Status is the status of the condition.
+  // Can be True, False, Unknown.
+  // More info: http://kubernetes.io/docs/user-guide/carp-states#carp-conditions
+  optional string status = 2;
+
+  // Last time we probed the condition.
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastProbeTime = 3;
+
+  // Last time the condition transitioned from one status to another.
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 4;
+
+  // Unique, one-word, CamelCase reason for the condition's last transition.
+  // +optional
+  optional string reason = 5;
+
+  // Human-readable message indicating details about last transition.
+  // +optional
+  optional string message = 6;
+}
+
+message CarpInfo {
+  // A is the first map key.
+  // +required
+  optional int64 a = 1;
+
+  // B is the second map key.
+  // +required
+  optional string b = 2;
+
+  // C is the third, optional map key
+  // +optional
+  optional string c = 4;
+
+  // Some data for each pair of A and B.
+  optional string data = 3;
+}
+
+// CarpList is a list of Carps.
+message CarpList {
+  // Standard list metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
+
+  // List of carps.
+  // More info: http://kubernetes.io/docs/user-guide/carps
+  repeated Carp items = 2;
+}
+
+// CarpSpec is a description of a carp
+message CarpSpec {
+  // Restart policy for all containers within the carp.
+  // One of Always, OnFailure, Never.
+  // Default to Always.
+  // More info: http://kubernetes.io/docs/user-guide/carp-states#restartpolicy
+  // +optional
+  optional string restartPolicy = 3;
+
+  // Optional duration in seconds the carp needs to terminate gracefully. May be decreased in delete request.
+  // Value must be non-negative integer. The value zero indicates delete immediately.
+  // If this value is nil, the default grace period will be used instead.
+  // The grace period is the duration in seconds after the processes running in the carp are sent
+  // a termination signal and the time when the processes are forcibly halted with a kill signal.
+  // Set this value longer than the expected cleanup time for your process.
+  // Defaults to 30 seconds.
+  // +optional
+  optional int64 terminationGracePeriodSeconds = 4;
+
+  // Optional duration in seconds the carp may be active on the node relative to
+  // StartTime before the system will actively try to mark it failed and kill associated containers.
+  // Value must be a positive integer.
+  // +optional
+  optional int64 activeDeadlineSeconds = 5;
+
+  // NodeSelector is a selector which must be true for the carp to fit on a node.
+  // Selector which must match a node's labels for the carp to be scheduled on that node.
+  // More info: http://kubernetes.io/docs/user-guide/node-selection/README
+  // +optional
+  map<string, string> nodeSelector = 7;
+
+  // ServiceAccountName is the name of the ServiceAccount to use to run this carp.
+  // More info: https://kubernetes.io/docs/concepts/security/service-accounts/
+  // +optional
+  optional string serviceAccountName = 8;
+
+  // DeprecatedServiceAccount is a deprecated alias for ServiceAccountName.
+  // Deprecated: Use serviceAccountName instead.
+  // +k8s:conversion-gen=false
+  // +optional
+  optional string deprecatedServiceAccount = 9;
+
+  // NodeName is a request to schedule this carp onto a specific node. If it is non-empty,
+  // the scheduler simply schedules this carp onto that node, assuming that it fits resource
+  // requirements.
+  // +optional
+  optional string nodeName = 10;
+
+  // Host networking requested for this carp. Use the host's network namespace.
+  // Default to false.
+  // +k8s:conversion-gen=false
+  // +optional
+  optional bool hostNetwork = 11;
+
+  // Use the host's pid namespace.
+  // Optional: Default to false.
+  // +k8s:conversion-gen=false
+  // +optional
+  optional bool hostPID = 12;
+
+  // Use the host's ipc namespace.
+  // Optional: Default to false.
+  // +k8s:conversion-gen=false
+  // +optional
+  optional bool hostIPC = 13;
+
+  // Specifies the hostname of the Carp
+  // If not specified, the carp's hostname will be set to a system-defined value.
+  // +optional
+  optional string hostname = 16;
+
+  // If specified, the fully qualified Carp hostname will be "<hostname>.<subdomain>.<carp namespace>.svc.<cluster domain>".
+  // If not specified, the carp will not have a domainname at all.
+  // +optional
+  optional string subdomain = 17;
+
+  // If specified, the carp will be dispatched by specified scheduler.
+  // If not specified, the carp will be dispatched by default scheduler.
+  // +optional
+  optional string schedulerName = 19;
+}
+
+// CarpStatus represents information about the status of a carp. Status may trail the actual
+// state of a system.
+message CarpStatus {
+  // Current condition of the carp.
+  // More info: http://kubernetes.io/docs/user-guide/carp-states#carp-phase
+  // +optional
+  optional string phase = 1;
+
+  // Current service state of carp.
+  // More info: http://kubernetes.io/docs/user-guide/carp-states#carp-conditions
+  // +patchStrategy=merge
+  // +patchMergeKey=type
+  // +listType=map
+  // +listMapKey=type
+  // +optional
+  repeated CarpCondition conditions = 2;
+
+  // A human readable message indicating details about why the carp is in this condition.
+  // +optional
+  optional string message = 3;
+
+  // A brief CamelCase message indicating details about why the carp is in this state.
+  // e.g. 'DiskPressure'
+  // +optional
+  optional string reason = 4;
+
+  // IP address of the host to which the carp is assigned. Empty if not yet scheduled.
+  // +optional
+  optional string hostIP = 5;
+
+  // IP address allocated to the carp. Routable at least within the cluster.
+  // Empty if not yet allocated.
+  // +optional
+  optional string carpIP = 6;
+
+  // RFC 3339 date and time at which the object was acknowledged by the Kubelet.
+  // This is before the Kubelet pulled the container image(s) for the carp.
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time startTime = 7;
+
+  // Carp infos are provided by different clients, hence the map type.
+  //
+  // +listType=map
+  // +listMapKey=a
+  // +listMapKey=b
+  // +listMapKey=c
+  repeated CarpInfo infos = 8;
+}
+
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/register.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/register.go
new file mode 100644
index 0000000000..afd908c7fe
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/register.go
@@ -0,0 +1,64 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName is the group name use in this package
+const GroupName = "testapigroup.apimachinery.k8s.io"
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Kind takes an unqualified kind and returns a Group qualified GroupKind
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// TODO: move SchemeBuilder with zz_generated.deepcopy.go to k8s.io/api.
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	AddToScheme        = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes, addConversionFuncs, addDefaultingFuncs)
+}
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&Carp{},
+		&CarpList{},
+	)
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/types.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/types.go
new file mode 100644
index 0000000000..8512a514c6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/types.go
@@ -0,0 +1,224 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type (
+	ConditionStatus   string
+	CarpConditionType string
+	CarpPhase         string
+	RestartPolicy     string
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.1
+
+// Carp is a collection of containers, used as either input (create, update) or as output (list, get).
+type Carp struct {
+	metav1.TypeMeta `json:""`
+	// Standard object's metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// Specification of the desired behavior of the carp.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	// +optional
+	Spec CarpSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
+
+	// Most recently observed status of the carp.
+	// This data may not be up to date.
+	// Populated by the system.
+	// Read-only.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	// +optional
+	Status CarpStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
+}
+
+// CarpStatus represents information about the status of a carp. Status may trail the actual
+// state of a system.
+type CarpStatus struct {
+	// Current condition of the carp.
+	// More info: http://kubernetes.io/docs/user-guide/carp-states#carp-phase
+	// +optional
+	Phase CarpPhase `json:"phase,omitempty" protobuf:"bytes,1,opt,name=phase,casttype=CarpPhase"`
+	// Current service state of carp.
+	// More info: http://kubernetes.io/docs/user-guide/carp-states#carp-conditions
+	// +patchStrategy=merge
+	// +patchMergeKey=type
+	// +listType=map
+	// +listMapKey=type
+	// +optional
+	Conditions []CarpCondition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,2,opt,name=conditions"`
+	// A human readable message indicating details about why the carp is in this condition.
+	// +optional
+	Message string `json:"message,omitempty" protobuf:"bytes,3,opt,name=message"`
+	// A brief CamelCase message indicating details about why the carp is in this state.
+	// e.g. 'DiskPressure'
+	// +optional
+	Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
+
+	// IP address of the host to which the carp is assigned. Empty if not yet scheduled.
+	// +optional
+	HostIP string `json:"hostIP,omitempty" protobuf:"bytes,5,opt,name=hostIP"`
+	// IP address allocated to the carp. Routable at least within the cluster.
+	// Empty if not yet allocated.
+	// +optional
+	CarpIP string `json:"carpIP,omitempty" protobuf:"bytes,6,opt,name=carpIP"`
+
+	// RFC 3339 date and time at which the object was acknowledged by the Kubelet.
+	// This is before the Kubelet pulled the container image(s) for the carp.
+	// +optional
+	StartTime *metav1.Time `json:"startTime,omitempty" protobuf:"bytes,7,opt,name=startTime"`
+
+	// Carp infos are provided by different clients, hence the map type.
+	//
+	// +listType=map
+	// +listMapKey=a
+	// +listMapKey=b
+	// +listMapKey=c
+	Infos []CarpInfo `json:"infos,omitempty" protobuf:"bytes,8,rep,name=infos"`
+}
+
+type CarpCondition struct {
+	// Type is the type of the condition.
+	// Currently only Ready.
+	// More info: http://kubernetes.io/docs/user-guide/carp-states#carp-conditions
+	Type CarpConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=CarpConditionType"`
+	// Status is the status of the condition.
+	// Can be True, False, Unknown.
+	// More info: http://kubernetes.io/docs/user-guide/carp-states#carp-conditions
+	Status ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=ConditionStatus"`
+	// Last time we probed the condition.
+	// +optional
+	LastProbeTime metav1.Time `json:"lastProbeTime,omitempty" protobuf:"bytes,3,opt,name=lastProbeTime"`
+	// Last time the condition transitioned from one status to another.
+	// +optional
+	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,4,opt,name=lastTransitionTime"`
+	// Unique, one-word, CamelCase reason for the condition's last transition.
+	// +optional
+	Reason string `json:"reason,omitempty" protobuf:"bytes,5,opt,name=reason"`
+	// Human-readable message indicating details about last transition.
+	// +optional
+	Message string `json:"message,omitempty" protobuf:"bytes,6,opt,name=message"`
+}
+
+type CarpInfo struct {
+	// A is the first map key.
+	// +required
+	A int64 `json:"a" protobuf:"bytes,1,name=a"`
+	// B is the second map key.
+	// +required
+	B string `json:"b" protobuf:"bytes,2,name=b"`
+	// C is the third, optional map key
+	// +optional
+	C *string `json:"c,omitempty" protobuf:"bytes,4,opt,name=c"`
+
+	// Some data for each pair of A and B.
+	Data string `json:"data" protobuf:"bytes,3,name=data"`
+}
+
+// CarpSpec is a description of a carp
+type CarpSpec struct {
+	// Restart policy for all containers within the carp.
+	// One of Always, OnFailure, Never.
+	// Default to Always.
+	// More info: http://kubernetes.io/docs/user-guide/carp-states#restartpolicy
+	// +optional
+	RestartPolicy RestartPolicy `json:"restartPolicy,omitempty" protobuf:"bytes,3,opt,name=restartPolicy,casttype=RestartPolicy"`
+	// Optional duration in seconds the carp needs to terminate gracefully. May be decreased in delete request.
+	// Value must be non-negative integer. The value zero indicates delete immediately.
+	// If this value is nil, the default grace period will be used instead.
+	// The grace period is the duration in seconds after the processes running in the carp are sent
+	// a termination signal and the time when the processes are forcibly halted with a kill signal.
+	// Set this value longer than the expected cleanup time for your process.
+	// Defaults to 30 seconds.
+	// +optional
+	TerminationGracePeriodSeconds *int64 `json:"terminationGracePeriodSeconds,omitempty" protobuf:"varint,4,opt,name=terminationGracePeriodSeconds"`
+	// Optional duration in seconds the carp may be active on the node relative to
+	// StartTime before the system will actively try to mark it failed and kill associated containers.
+	// Value must be a positive integer.
+	// +optional
+	ActiveDeadlineSeconds *int64 `json:"activeDeadlineSeconds,omitempty" protobuf:"varint,5,opt,name=activeDeadlineSeconds"`
+	// NodeSelector is a selector which must be true for the carp to fit on a node.
+	// Selector which must match a node's labels for the carp to be scheduled on that node.
+	// More info: http://kubernetes.io/docs/user-guide/node-selection/README
+	// +optional
+	NodeSelector map[string]string `json:"nodeSelector,omitempty" protobuf:"bytes,7,rep,name=nodeSelector"`
+
+	// ServiceAccountName is the name of the ServiceAccount to use to run this carp.
+	// More info: https://kubernetes.io/docs/concepts/security/service-accounts/
+	// +optional
+	ServiceAccountName string `json:"serviceAccountName,omitempty" protobuf:"bytes,8,opt,name=serviceAccountName"`
+	// DeprecatedServiceAccount is a deprecated alias for ServiceAccountName.
+	// Deprecated: Use serviceAccountName instead.
+	// +k8s:conversion-gen=false
+	// +optional
+	DeprecatedServiceAccount string `json:"deprecatedServiceAccount,omitempty" protobuf:"bytes,9,opt,name=deprecatedServiceAccount"`
+
+	// NodeName is a request to schedule this carp onto a specific node. If it is non-empty,
+	// the scheduler simply schedules this carp onto that node, assuming that it fits resource
+	// requirements.
+	// +optional
+	NodeName string `json:"nodeName,omitempty" protobuf:"bytes,10,opt,name=nodeName"`
+	// Host networking requested for this carp. Use the host's network namespace.
+	// Default to false.
+	// +k8s:conversion-gen=false
+	// +optional
+	HostNetwork bool `json:"hostNetwork,omitempty" protobuf:"varint,11,opt,name=hostNetwork"`
+	// Use the host's pid namespace.
+	// Optional: Default to false.
+	// +k8s:conversion-gen=false
+	// +optional
+	HostPID bool `json:"hostPID,omitempty" protobuf:"varint,12,opt,name=hostPID"`
+	// Use the host's ipc namespace.
+	// Optional: Default to false.
+	// +k8s:conversion-gen=false
+	// +optional
+	HostIPC bool `json:"hostIPC,omitempty" protobuf:"varint,13,opt,name=hostIPC"`
+	// Specifies the hostname of the Carp
+	// If not specified, the carp's hostname will be set to a system-defined value.
+	// +optional
+	Hostname string `json:"hostname,omitempty" protobuf:"bytes,16,opt,name=hostname"`
+	// If specified, the fully qualified Carp hostname will be "<hostname>.<subdomain>.<carp namespace>.svc.<cluster domain>".
+	// If not specified, the carp will not have a domainname at all.
+	// +optional
+	Subdomain string `json:"subdomain,omitempty" protobuf:"bytes,17,opt,name=subdomain"`
+	// If specified, the carp will be dispatched by specified scheduler.
+	// If not specified, the carp will be dispatched by default scheduler.
+	// +optional
+	SchedulerName string `json:"schedulerName,omitempty" protobuf:"bytes,19,opt,name=schedulerName"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.1
+
+// CarpList is a list of Carps.
+type CarpList struct {
+	metav1.TypeMeta `json:""`
+	// Standard list metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// List of carps.
+	// More info: http://kubernetes.io/docs/user-guide/carps
+	Items []Carp `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.conversion.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.conversion.go
new file mode 100644
index 0000000000..92056d520b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.conversion.go
@@ -0,0 +1,274 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by conversion-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	unsafe "unsafe"
+
+	testapigroup "k8s.io/apimachinery/pkg/apis/testapigroup"
+	conversion "k8s.io/apimachinery/pkg/conversion"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+func init() {
+	localSchemeBuilder.Register(RegisterConversions)
+}
+
+// RegisterConversions adds conversion functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*Carp)(nil), (*testapigroup.Carp)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_Carp_To_testapigroup_Carp(a.(*Carp), b.(*testapigroup.Carp), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*testapigroup.Carp)(nil), (*Carp)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_testapigroup_Carp_To_v1_Carp(a.(*testapigroup.Carp), b.(*Carp), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*CarpCondition)(nil), (*testapigroup.CarpCondition)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_CarpCondition_To_testapigroup_CarpCondition(a.(*CarpCondition), b.(*testapigroup.CarpCondition), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*testapigroup.CarpCondition)(nil), (*CarpCondition)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_testapigroup_CarpCondition_To_v1_CarpCondition(a.(*testapigroup.CarpCondition), b.(*CarpCondition), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*CarpInfo)(nil), (*testapigroup.CarpInfo)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_CarpInfo_To_testapigroup_CarpInfo(a.(*CarpInfo), b.(*testapigroup.CarpInfo), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*testapigroup.CarpInfo)(nil), (*CarpInfo)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_testapigroup_CarpInfo_To_v1_CarpInfo(a.(*testapigroup.CarpInfo), b.(*CarpInfo), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*CarpList)(nil), (*testapigroup.CarpList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_CarpList_To_testapigroup_CarpList(a.(*CarpList), b.(*testapigroup.CarpList), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*testapigroup.CarpList)(nil), (*CarpList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_testapigroup_CarpList_To_v1_CarpList(a.(*testapigroup.CarpList), b.(*CarpList), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*CarpSpec)(nil), (*testapigroup.CarpSpec)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_CarpSpec_To_testapigroup_CarpSpec(a.(*CarpSpec), b.(*testapigroup.CarpSpec), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*testapigroup.CarpSpec)(nil), (*CarpSpec)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_testapigroup_CarpSpec_To_v1_CarpSpec(a.(*testapigroup.CarpSpec), b.(*CarpSpec), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*CarpStatus)(nil), (*testapigroup.CarpStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_CarpStatus_To_testapigroup_CarpStatus(a.(*CarpStatus), b.(*testapigroup.CarpStatus), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*testapigroup.CarpStatus)(nil), (*CarpStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_testapigroup_CarpStatus_To_v1_CarpStatus(a.(*testapigroup.CarpStatus), b.(*CarpStatus), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+func autoConvert_v1_Carp_To_testapigroup_Carp(in *Carp, out *testapigroup.Carp, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_v1_CarpSpec_To_testapigroup_CarpSpec(&in.Spec, &out.Spec, s); err != nil {
+		return err
+	}
+	if err := Convert_v1_CarpStatus_To_testapigroup_CarpStatus(&in.Status, &out.Status, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_v1_Carp_To_testapigroup_Carp is an autogenerated conversion function.
+func Convert_v1_Carp_To_testapigroup_Carp(in *Carp, out *testapigroup.Carp, s conversion.Scope) error {
+	return autoConvert_v1_Carp_To_testapigroup_Carp(in, out, s)
+}
+
+func autoConvert_testapigroup_Carp_To_v1_Carp(in *testapigroup.Carp, out *Carp, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_testapigroup_CarpSpec_To_v1_CarpSpec(&in.Spec, &out.Spec, s); err != nil {
+		return err
+	}
+	if err := Convert_testapigroup_CarpStatus_To_v1_CarpStatus(&in.Status, &out.Status, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_testapigroup_Carp_To_v1_Carp is an autogenerated conversion function.
+func Convert_testapigroup_Carp_To_v1_Carp(in *testapigroup.Carp, out *Carp, s conversion.Scope) error {
+	return autoConvert_testapigroup_Carp_To_v1_Carp(in, out, s)
+}
+
+func autoConvert_v1_CarpCondition_To_testapigroup_CarpCondition(in *CarpCondition, out *testapigroup.CarpCondition, s conversion.Scope) error {
+	*out = *(*testapigroup.CarpCondition)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_v1_CarpCondition_To_testapigroup_CarpCondition is an autogenerated conversion function.
+func Convert_v1_CarpCondition_To_testapigroup_CarpCondition(in *CarpCondition, out *testapigroup.CarpCondition, s conversion.Scope) error {
+	return autoConvert_v1_CarpCondition_To_testapigroup_CarpCondition(in, out, s)
+}
+
+func autoConvert_testapigroup_CarpCondition_To_v1_CarpCondition(in *testapigroup.CarpCondition, out *CarpCondition, s conversion.Scope) error {
+	*out = *(*CarpCondition)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_testapigroup_CarpCondition_To_v1_CarpCondition is an autogenerated conversion function.
+func Convert_testapigroup_CarpCondition_To_v1_CarpCondition(in *testapigroup.CarpCondition, out *CarpCondition, s conversion.Scope) error {
+	return autoConvert_testapigroup_CarpCondition_To_v1_CarpCondition(in, out, s)
+}
+
+func autoConvert_v1_CarpInfo_To_testapigroup_CarpInfo(in *CarpInfo, out *testapigroup.CarpInfo, s conversion.Scope) error {
+	*out = *(*testapigroup.CarpInfo)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_v1_CarpInfo_To_testapigroup_CarpInfo is an autogenerated conversion function.
+func Convert_v1_CarpInfo_To_testapigroup_CarpInfo(in *CarpInfo, out *testapigroup.CarpInfo, s conversion.Scope) error {
+	return autoConvert_v1_CarpInfo_To_testapigroup_CarpInfo(in, out, s)
+}
+
+func autoConvert_testapigroup_CarpInfo_To_v1_CarpInfo(in *testapigroup.CarpInfo, out *CarpInfo, s conversion.Scope) error {
+	*out = *(*CarpInfo)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_testapigroup_CarpInfo_To_v1_CarpInfo is an autogenerated conversion function.
+func Convert_testapigroup_CarpInfo_To_v1_CarpInfo(in *testapigroup.CarpInfo, out *CarpInfo, s conversion.Scope) error {
+	return autoConvert_testapigroup_CarpInfo_To_v1_CarpInfo(in, out, s)
+}
+
+func autoConvert_v1_CarpList_To_testapigroup_CarpList(in *CarpList, out *testapigroup.CarpList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]testapigroup.Carp, len(*in))
+		for i := range *in {
+			if err := Convert_v1_Carp_To_testapigroup_Carp(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
+	return nil
+}
+
+// Convert_v1_CarpList_To_testapigroup_CarpList is an autogenerated conversion function.
+func Convert_v1_CarpList_To_testapigroup_CarpList(in *CarpList, out *testapigroup.CarpList, s conversion.Scope) error {
+	return autoConvert_v1_CarpList_To_testapigroup_CarpList(in, out, s)
+}
+
+func autoConvert_testapigroup_CarpList_To_v1_CarpList(in *testapigroup.CarpList, out *CarpList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Carp, len(*in))
+		for i := range *in {
+			if err := Convert_testapigroup_Carp_To_v1_Carp(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
+	return nil
+}
+
+// Convert_testapigroup_CarpList_To_v1_CarpList is an autogenerated conversion function.
+func Convert_testapigroup_CarpList_To_v1_CarpList(in *testapigroup.CarpList, out *CarpList, s conversion.Scope) error {
+	return autoConvert_testapigroup_CarpList_To_v1_CarpList(in, out, s)
+}
+
+func autoConvert_v1_CarpSpec_To_testapigroup_CarpSpec(in *CarpSpec, out *testapigroup.CarpSpec, s conversion.Scope) error {
+	out.RestartPolicy = testapigroup.RestartPolicy(in.RestartPolicy)
+	out.TerminationGracePeriodSeconds = (*int64)(unsafe.Pointer(in.TerminationGracePeriodSeconds))
+	out.ActiveDeadlineSeconds = (*int64)(unsafe.Pointer(in.ActiveDeadlineSeconds))
+	out.NodeSelector = *(*map[string]string)(unsafe.Pointer(&in.NodeSelector))
+	out.ServiceAccountName = in.ServiceAccountName
+	// INFO: in.DeprecatedServiceAccount opted out of conversion generation
+	out.NodeName = in.NodeName
+	// INFO: in.HostNetwork opted out of conversion generation
+	// INFO: in.HostPID opted out of conversion generation
+	// INFO: in.HostIPC opted out of conversion generation
+	out.Hostname = in.Hostname
+	out.Subdomain = in.Subdomain
+	out.SchedulerName = in.SchedulerName
+	return nil
+}
+
+// Convert_v1_CarpSpec_To_testapigroup_CarpSpec is an autogenerated conversion function.
+func Convert_v1_CarpSpec_To_testapigroup_CarpSpec(in *CarpSpec, out *testapigroup.CarpSpec, s conversion.Scope) error {
+	return autoConvert_v1_CarpSpec_To_testapigroup_CarpSpec(in, out, s)
+}
+
+func autoConvert_testapigroup_CarpSpec_To_v1_CarpSpec(in *testapigroup.CarpSpec, out *CarpSpec, s conversion.Scope) error {
+	out.RestartPolicy = RestartPolicy(in.RestartPolicy)
+	out.TerminationGracePeriodSeconds = (*int64)(unsafe.Pointer(in.TerminationGracePeriodSeconds))
+	out.ActiveDeadlineSeconds = (*int64)(unsafe.Pointer(in.ActiveDeadlineSeconds))
+	out.NodeSelector = *(*map[string]string)(unsafe.Pointer(&in.NodeSelector))
+	out.ServiceAccountName = in.ServiceAccountName
+	out.NodeName = in.NodeName
+	out.Hostname = in.Hostname
+	out.Subdomain = in.Subdomain
+	out.SchedulerName = in.SchedulerName
+	return nil
+}
+
+// Convert_testapigroup_CarpSpec_To_v1_CarpSpec is an autogenerated conversion function.
+func Convert_testapigroup_CarpSpec_To_v1_CarpSpec(in *testapigroup.CarpSpec, out *CarpSpec, s conversion.Scope) error {
+	return autoConvert_testapigroup_CarpSpec_To_v1_CarpSpec(in, out, s)
+}
+
+func autoConvert_v1_CarpStatus_To_testapigroup_CarpStatus(in *CarpStatus, out *testapigroup.CarpStatus, s conversion.Scope) error {
+	*out = *(*testapigroup.CarpStatus)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_v1_CarpStatus_To_testapigroup_CarpStatus is an autogenerated conversion function.
+func Convert_v1_CarpStatus_To_testapigroup_CarpStatus(in *CarpStatus, out *testapigroup.CarpStatus, s conversion.Scope) error {
+	return autoConvert_v1_CarpStatus_To_testapigroup_CarpStatus(in, out, s)
+}
+
+func autoConvert_testapigroup_CarpStatus_To_v1_CarpStatus(in *testapigroup.CarpStatus, out *CarpStatus, s conversion.Scope) error {
+	*out = *(*CarpStatus)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_testapigroup_CarpStatus_To_v1_CarpStatus is an autogenerated conversion function.
+func Convert_testapigroup_CarpStatus_To_v1_CarpStatus(in *testapigroup.CarpStatus, out *CarpStatus, s conversion.Scope) error {
+	return autoConvert_testapigroup_CarpStatus_To_v1_CarpStatus(in, out, s)
+}
diff --git a/vendor/k8s.io/api/apidiscovery/v2beta1/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.deepcopy.go
similarity index 52%
rename from vendor/k8s.io/api/apidiscovery/v2beta1/zz_generated.deepcopy.go
rename to hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.deepcopy.go
index cf8f98c6fb..d5969b09fc 100644
--- a/vendor/k8s.io/api/apidiscovery/v2beta1/zz_generated.deepcopy.go
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.deepcopy.go
@@ -19,40 +19,34 @@ limitations under the License.
 
 // Code generated by deepcopy-gen. DO NOT EDIT.
 
-package v2beta1
+package v1
 
 import (
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *APIGroupDiscovery) DeepCopyInto(out *APIGroupDiscovery) {
+func (in *Carp) DeepCopyInto(out *Carp) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	if in.Versions != nil {
-		in, out := &in.Versions, &out.Versions
-		*out = make([]APIVersionDiscovery, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIGroupDiscovery.
-func (in *APIGroupDiscovery) DeepCopy() *APIGroupDiscovery {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Carp.
+func (in *Carp) DeepCopy() *Carp {
 	if in == nil {
 		return nil
 	}
-	out := new(APIGroupDiscovery)
+	out := new(Carp)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *APIGroupDiscovery) DeepCopyObject() runtime.Object {
+func (in *Carp) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -60,64 +54,52 @@ func (in *APIGroupDiscovery) DeepCopyObject() runtime.Object {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *APIGroupDiscoveryList) DeepCopyInto(out *APIGroupDiscoveryList) {
+func (in *CarpCondition) DeepCopyInto(out *CarpCondition) {
 	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]APIGroupDiscovery, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
+	in.LastProbeTime.DeepCopyInto(&out.LastProbeTime)
+	in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIGroupDiscoveryList.
-func (in *APIGroupDiscoveryList) DeepCopy() *APIGroupDiscoveryList {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpCondition.
+func (in *CarpCondition) DeepCopy() *CarpCondition {
 	if in == nil {
 		return nil
 	}
-	out := new(APIGroupDiscoveryList)
+	out := new(CarpCondition)
 	in.DeepCopyInto(out)
 	return out
 }
 
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *APIGroupDiscoveryList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *APIResourceDiscovery) DeepCopyInto(out *APIResourceDiscovery) {
+func (in *CarpInfo) DeepCopyInto(out *CarpInfo) {
 	*out = *in
-	if in.ResponseKind != nil {
-		in, out := &in.ResponseKind, &out.ResponseKind
-		*out = new(v1.GroupVersionKind)
+	if in.C != nil {
+		in, out := &in.C, &out.C
+		*out = new(string)
 		**out = **in
 	}
-	if in.Verbs != nil {
-		in, out := &in.Verbs, &out.Verbs
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.ShortNames != nil {
-		in, out := &in.ShortNames, &out.ShortNames
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Categories != nil {
-		in, out := &in.Categories, &out.Categories
-		*out = make([]string, len(*in))
-		copy(*out, *in)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpInfo.
+func (in *CarpInfo) DeepCopy() *CarpInfo {
+	if in == nil {
+		return nil
 	}
-	if in.Subresources != nil {
-		in, out := &in.Subresources, &out.Subresources
-		*out = make([]APISubresourceDiscovery, len(*in))
+	out := new(CarpInfo)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpList) DeepCopyInto(out *CarpList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Carp, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
@@ -125,53 +107,74 @@ func (in *APIResourceDiscovery) DeepCopyInto(out *APIResourceDiscovery) {
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIResourceDiscovery.
-func (in *APIResourceDiscovery) DeepCopy() *APIResourceDiscovery {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpList.
+func (in *CarpList) DeepCopy() *CarpList {
 	if in == nil {
 		return nil
 	}
-	out := new(APIResourceDiscovery)
+	out := new(CarpList)
 	in.DeepCopyInto(out)
 	return out
 }
 
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CarpList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *APISubresourceDiscovery) DeepCopyInto(out *APISubresourceDiscovery) {
+func (in *CarpSpec) DeepCopyInto(out *CarpSpec) {
 	*out = *in
-	if in.ResponseKind != nil {
-		in, out := &in.ResponseKind, &out.ResponseKind
-		*out = new(v1.GroupVersionKind)
+	if in.TerminationGracePeriodSeconds != nil {
+		in, out := &in.TerminationGracePeriodSeconds, &out.TerminationGracePeriodSeconds
+		*out = new(int64)
 		**out = **in
 	}
-	if in.AcceptedTypes != nil {
-		in, out := &in.AcceptedTypes, &out.AcceptedTypes
-		*out = make([]v1.GroupVersionKind, len(*in))
-		copy(*out, *in)
+	if in.ActiveDeadlineSeconds != nil {
+		in, out := &in.ActiveDeadlineSeconds, &out.ActiveDeadlineSeconds
+		*out = new(int64)
+		**out = **in
 	}
-	if in.Verbs != nil {
-		in, out := &in.Verbs, &out.Verbs
-		*out = make([]string, len(*in))
-		copy(*out, *in)
+	if in.NodeSelector != nil {
+		in, out := &in.NodeSelector, &out.NodeSelector
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
 	}
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APISubresourceDiscovery.
-func (in *APISubresourceDiscovery) DeepCopy() *APISubresourceDiscovery {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpSpec.
+func (in *CarpSpec) DeepCopy() *CarpSpec {
 	if in == nil {
 		return nil
 	}
-	out := new(APISubresourceDiscovery)
+	out := new(CarpSpec)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *APIVersionDiscovery) DeepCopyInto(out *APIVersionDiscovery) {
+func (in *CarpStatus) DeepCopyInto(out *CarpStatus) {
 	*out = *in
-	if in.Resources != nil {
-		in, out := &in.Resources, &out.Resources
-		*out = make([]APIResourceDiscovery, len(*in))
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]CarpCondition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.StartTime != nil {
+		in, out := &in.StartTime, &out.StartTime
+		*out = (*in).DeepCopy()
+	}
+	if in.Infos != nil {
+		in, out := &in.Infos, &out.Infos
+		*out = make([]CarpInfo, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
@@ -179,12 +182,12 @@ func (in *APIVersionDiscovery) DeepCopyInto(out *APIVersionDiscovery) {
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIVersionDiscovery.
-func (in *APIVersionDiscovery) DeepCopy() *APIVersionDiscovery {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpStatus.
+func (in *CarpStatus) DeepCopy() *CarpStatus {
 	if in == nil {
 		return nil
 	}
-	out := new(APIVersionDiscovery)
+	out := new(CarpStatus)
 	in.DeepCopyInto(out)
 	return out
 }
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.defaults.go
new file mode 100644
index 0000000000..dac177e93b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.model_name.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.model_name.go
new file mode 100644
index 0000000000..38ee899cb9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.model_name.go
@@ -0,0 +1,52 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package v1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Carp) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.testapigroup.v1.Carp"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CarpCondition) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.testapigroup.v1.CarpCondition"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CarpInfo) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.testapigroup.v1.CarpInfo"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CarpList) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.testapigroup.v1.CarpList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CarpSpec) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.testapigroup.v1.CarpSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CarpStatus) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.testapigroup.v1.CarpStatus"
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.prerelease-lifecycle.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.prerelease-lifecycle.go
new file mode 100644
index 0000000000..7cd1cf2592
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.prerelease-lifecycle.go
@@ -0,0 +1,34 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by prerelease-lifecycle-gen. DO NOT EDIT.
+
+package v1
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *Carp) APILifecycleIntroduced() (major, minor int) {
+	return 1, 1
+}
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *CarpList) APILifecycleIntroduced() (major, minor int) {
+	return 1, 1
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..a44dcfe14e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/zz_generated.deepcopy.go
@@ -0,0 +1,193 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package testapigroup
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Carp) DeepCopyInto(out *Carp) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Carp.
+func (in *Carp) DeepCopy() *Carp {
+	if in == nil {
+		return nil
+	}
+	out := new(Carp)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Carp) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpCondition) DeepCopyInto(out *CarpCondition) {
+	*out = *in
+	in.LastProbeTime.DeepCopyInto(&out.LastProbeTime)
+	in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpCondition.
+func (in *CarpCondition) DeepCopy() *CarpCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpInfo) DeepCopyInto(out *CarpInfo) {
+	*out = *in
+	if in.C != nil {
+		in, out := &in.C, &out.C
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpInfo.
+func (in *CarpInfo) DeepCopy() *CarpInfo {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpInfo)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpList) DeepCopyInto(out *CarpList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Carp, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpList.
+func (in *CarpList) DeepCopy() *CarpList {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CarpList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpSpec) DeepCopyInto(out *CarpSpec) {
+	*out = *in
+	if in.TerminationGracePeriodSeconds != nil {
+		in, out := &in.TerminationGracePeriodSeconds, &out.TerminationGracePeriodSeconds
+		*out = new(int64)
+		**out = **in
+	}
+	if in.ActiveDeadlineSeconds != nil {
+		in, out := &in.ActiveDeadlineSeconds, &out.ActiveDeadlineSeconds
+		*out = new(int64)
+		**out = **in
+	}
+	if in.NodeSelector != nil {
+		in, out := &in.NodeSelector, &out.NodeSelector
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpSpec.
+func (in *CarpSpec) DeepCopy() *CarpSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpStatus) DeepCopyInto(out *CarpStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]CarpCondition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.StartTime != nil {
+		in, out := &in.StartTime, &out.StartTime
+		*out = (*in).DeepCopy()
+	}
+	if in.Infos != nil {
+		in, out := &in.Infos, &out.Infos
+		*out = make([]CarpInfo, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpStatus.
+func (in *CarpStatus) DeepCopy() *CarpStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/converter.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/converter.go
new file mode 100644
index 0000000000..76b76247c7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/converter.go
@@ -0,0 +1,225 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package conversion
+
+import (
+	"fmt"
+	"reflect"
+)
+
+type typePair struct {
+	source reflect.Type
+	dest   reflect.Type
+}
+
+type NameFunc func(t reflect.Type) string
+
+var DefaultNameFunc = func(t reflect.Type) string { return t.Name() }
+
+// ConversionFunc converts the object a into the object b, reusing arrays or objects
+// or pointers if necessary. It should return an error if the object cannot be converted
+// or if some data is invalid. If you do not wish a and b to share fields or nested
+// objects, you must copy a before calling this function.
+type ConversionFunc func(a, b interface{}, scope Scope) error
+
+// Converter knows how to convert one type to another.
+type Converter struct {
+	// Map from the conversion pair to a function which can
+	// do the conversion.
+	conversionFuncs          ConversionFuncs
+	generatedConversionFuncs ConversionFuncs
+
+	// Set of conversions that should be treated as a no-op
+	ignoredUntypedConversions map[typePair]struct{}
+}
+
+// NewConverter creates a new Converter object.
+// Arg NameFunc is just for backward compatibility.
+func NewConverter(NameFunc) *Converter {
+	c := &Converter{
+		conversionFuncs:           NewConversionFuncs(),
+		generatedConversionFuncs:  NewConversionFuncs(),
+		ignoredUntypedConversions: make(map[typePair]struct{}),
+	}
+	c.RegisterUntypedConversionFunc(
+		(*[]byte)(nil), (*[]byte)(nil),
+		func(a, b interface{}, s Scope) error {
+			return Convert_Slice_byte_To_Slice_byte(a.(*[]byte), b.(*[]byte), s)
+		},
+	)
+	return c
+}
+
+// WithConversions returns a Converter that is a copy of c but with the additional
+// fns merged on top.
+func (c *Converter) WithConversions(fns ConversionFuncs) *Converter {
+	copied := *c
+	copied.conversionFuncs = c.conversionFuncs.Merge(fns)
+	return &copied
+}
+
+// DefaultMeta returns meta for a given type.
+func (c *Converter) DefaultMeta(t reflect.Type) *Meta {
+	return &Meta{}
+}
+
+// Convert_Slice_byte_To_Slice_byte prevents recursing into every byte
+func Convert_Slice_byte_To_Slice_byte(in *[]byte, out *[]byte, s Scope) error {
+	if *in == nil {
+		*out = nil
+		return nil
+	}
+	*out = make([]byte, len(*in))
+	copy(*out, *in)
+	return nil
+}
+
+// Scope is passed to conversion funcs to allow them to continue an ongoing conversion.
+// If multiple converters exist in the system, Scope will allow you to use the correct one
+// from a conversion function--that is, the one your conversion function was called by.
+type Scope interface {
+	// Call Convert to convert sub-objects. Note that if you call it with your own exact
+	// parameters, you'll run out of stack space before anything useful happens.
+	Convert(src, dest interface{}) error
+
+	// Meta returns any information originally passed to Convert.
+	Meta() *Meta
+}
+
+func NewConversionFuncs() ConversionFuncs {
+	return ConversionFuncs{
+		untyped: make(map[typePair]ConversionFunc),
+	}
+}
+
+type ConversionFuncs struct {
+	untyped map[typePair]ConversionFunc
+}
+
+// AddUntyped adds the provided conversion function to the lookup table for the types that are
+// supplied as a and b. a and b must be pointers or an error is returned. This method overwrites
+// previously defined functions.
+func (c ConversionFuncs) AddUntyped(a, b interface{}, fn ConversionFunc) error {
+	tA, tB := reflect.TypeOf(a), reflect.TypeOf(b)
+	if tA.Kind() != reflect.Pointer {
+		return fmt.Errorf("the type %T must be a pointer to register as an untyped conversion", a)
+	}
+	if tB.Kind() != reflect.Pointer {
+		return fmt.Errorf("the type %T must be a pointer to register as an untyped conversion", b)
+	}
+	c.untyped[typePair{tA, tB}] = fn
+	return nil
+}
+
+// Merge returns a new ConversionFuncs that contains all conversions from
+// both other and c, with other conversions taking precedence.
+func (c ConversionFuncs) Merge(other ConversionFuncs) ConversionFuncs {
+	merged := NewConversionFuncs()
+	for k, v := range c.untyped {
+		merged.untyped[k] = v
+	}
+	for k, v := range other.untyped {
+		merged.untyped[k] = v
+	}
+	return merged
+}
+
+// Meta is supplied by Scheme, when it calls Convert.
+type Meta struct {
+	// Context is an optional field that callers may use to pass info to conversion functions.
+	Context interface{}
+}
+
+// scope contains information about an ongoing conversion.
+type scope struct {
+	converter *Converter
+	meta      *Meta
+}
+
+// Convert continues a conversion.
+func (s *scope) Convert(src, dest interface{}) error {
+	return s.converter.Convert(src, dest, s.meta)
+}
+
+// Meta returns the meta object that was originally passed to Convert.
+func (s *scope) Meta() *Meta {
+	return s.meta
+}
+
+// RegisterUntypedConversionFunc registers a function that converts between a and b by passing objects of those
+// types to the provided function. The function *must* accept objects of a and b - this machinery will not enforce
+// any other guarantee.
+func (c *Converter) RegisterUntypedConversionFunc(a, b interface{}, fn ConversionFunc) error {
+	return c.conversionFuncs.AddUntyped(a, b, fn)
+}
+
+// RegisterGeneratedUntypedConversionFunc registers a function that converts between a and b by passing objects of those
+// types to the provided function. The function *must* accept objects of a and b - this machinery will not enforce
+// any other guarantee.
+func (c *Converter) RegisterGeneratedUntypedConversionFunc(a, b interface{}, fn ConversionFunc) error {
+	return c.generatedConversionFuncs.AddUntyped(a, b, fn)
+}
+
+// RegisterIgnoredConversion registers a "no-op" for conversion, where any requested
+// conversion between from and to is ignored.
+func (c *Converter) RegisterIgnoredConversion(from, to interface{}) error {
+	typeFrom := reflect.TypeOf(from)
+	typeTo := reflect.TypeOf(to)
+	if typeFrom.Kind() != reflect.Pointer {
+		return fmt.Errorf("expected pointer arg for 'from' param 0, got: %v", typeFrom)
+	}
+	if typeTo.Kind() != reflect.Pointer {
+		return fmt.Errorf("expected pointer arg for 'to' param 1, got: %v", typeTo)
+	}
+	c.ignoredUntypedConversions[typePair{typeFrom, typeTo}] = struct{}{}
+	return nil
+}
+
+// Convert will translate src to dest if it knows how. Both must be pointers.
+// If no conversion func is registered and the default copying mechanism
+// doesn't work on this type pair, an error will be returned.
+// 'meta' is given to allow you to pass information to conversion functions,
+// it is not used by Convert() other than storing it in the scope.
+// Not safe for objects with cyclic references!
+func (c *Converter) Convert(src, dest interface{}, meta *Meta) error {
+	pair := typePair{reflect.TypeOf(src), reflect.TypeOf(dest)}
+	scope := &scope{
+		converter: c,
+		meta:      meta,
+	}
+
+	// ignore conversions of this type
+	if _, ok := c.ignoredUntypedConversions[pair]; ok {
+		return nil
+	}
+	if fn, ok := c.conversionFuncs.untyped[pair]; ok {
+		return fn(src, dest, scope)
+	}
+	if fn, ok := c.generatedConversionFuncs.untyped[pair]; ok {
+		return fn(src, dest, scope)
+	}
+
+	dv, err := EnforcePtr(dest)
+	if err != nil {
+		return err
+	}
+	sv, err := EnforcePtr(src)
+	if err != nil {
+		return err
+	}
+	return fmt.Errorf("converting (%s) to (%s): unknown conversion", sv.Type(), dv.Type())
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/converter_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/converter_test.go
new file mode 100644
index 0000000000..584068772f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/converter_test.go
@@ -0,0 +1,287 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package conversion
+
+import (
+	"fmt"
+	"reflect"
+	"strconv"
+	"testing"
+)
+
+func TestConverter_byteSlice(t *testing.T) {
+	c := NewConverter(nil)
+	src := []byte{1, 2, 3}
+	dest := []byte{}
+	err := c.Convert(&src, &dest, nil)
+	if err != nil {
+		t.Fatalf("expected no error")
+	}
+	if e, a := src, dest; !reflect.DeepEqual(e, a) {
+		t.Errorf("expected %#v, got %#v", e, a)
+	}
+}
+
+func TestConverter_MismatchedTypes(t *testing.T) {
+	c := NewConverter(nil)
+
+	convertFn := func(in *[]string, out *int, s Scope) error {
+		if str, err := strconv.Atoi((*in)[0]); err != nil {
+			return err
+		} else {
+			*out = str
+			return nil
+		}
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*[]string)(nil), (*int)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn(a.(*[]string), b.(*int), s)
+		},
+	); err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	src := []string{"5"}
+	var dest int
+	if err := c.Convert(&src, &dest, nil); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if e, a := 5, dest; e != a {
+		t.Errorf("expected %#v, got %#v", e, a)
+	}
+}
+
+func TestConverter_CallsRegisteredFunctions(t *testing.T) {
+	type A struct {
+		Foo string
+		Baz int
+	}
+	type B struct {
+		Bar string
+		Baz int
+	}
+	type C struct{}
+	c := NewConverter(nil)
+	convertFn1 := func(in *A, out *B, s Scope) error {
+		out.Bar = in.Foo
+		out.Baz = in.Baz
+		return nil
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*A)(nil), (*B)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn1(a.(*A), b.(*B), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	convertFn2 := func(in *B, out *A, s Scope) error {
+		out.Foo = in.Bar
+		out.Baz = in.Baz
+		return nil
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*B)(nil), (*A)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn2(a.(*B), b.(*A), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	x := A{"hello, intrepid test reader!", 3}
+	y := B{}
+
+	if err := c.Convert(&x, &y, nil); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	if e, a := x.Foo, y.Bar; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := x.Baz, y.Baz; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+
+	z := B{"all your test are belong to us", 42}
+	w := A{}
+
+	if err := c.Convert(&z, &w, nil); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	if e, a := z.Bar, w.Foo; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := z.Baz, w.Baz; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+
+	convertFn3 := func(in *A, out *C, s Scope) error {
+		return fmt.Errorf("C can't store an A, silly")
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*A)(nil), (*C)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn3(a.(*A), b.(*C), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	if err := c.Convert(&A{}, &C{}, nil); err == nil {
+		t.Errorf("unexpected non-error")
+	}
+}
+
+func TestConverter_IgnoredConversion(t *testing.T) {
+	type A struct{}
+	type B struct{}
+
+	count := 0
+	c := NewConverter(nil)
+	convertFn := func(in *A, out *B, s Scope) error {
+		count++
+		return nil
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*A)(nil), (*B)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn(a.(*A), b.(*B), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	if err := c.RegisterIgnoredConversion(&A{}, &B{}); err != nil {
+		t.Fatal(err)
+	}
+	a := A{}
+	b := B{}
+	if err := c.Convert(&a, &b, nil); err != nil {
+		t.Errorf("%v", err)
+	}
+	if count != 0 {
+		t.Errorf("unexpected number of conversion invocations")
+	}
+}
+
+func TestConverter_GeneratedConversionOverridden(t *testing.T) {
+	type A struct{}
+	type B struct{}
+	c := NewConverter(nil)
+	convertFn1 := func(in *A, out *B, s Scope) error {
+		return nil
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*A)(nil), (*B)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn1(a.(*A), b.(*B), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	convertFn2 := func(in *A, out *B, s Scope) error {
+		return fmt.Errorf("generated function should be overridden")
+	}
+	if err := c.RegisterGeneratedUntypedConversionFunc(
+		(*A)(nil), (*B)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn2(a.(*A), b.(*B), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	a := A{}
+	b := B{}
+	if err := c.Convert(&a, &b, nil); err != nil {
+		t.Errorf("%v", err)
+	}
+}
+
+func TestConverter_WithConversionOverridden(t *testing.T) {
+	type A struct{}
+	type B struct{}
+	c := NewConverter(nil)
+	convertFn1 := func(in *A, out *B, s Scope) error {
+		return fmt.Errorf("conversion function should be overridden")
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*A)(nil), (*B)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn1(a.(*A), b.(*B), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	convertFn2 := func(in *A, out *B, s Scope) error {
+		return fmt.Errorf("generated function should be overridden")
+	}
+	if err := c.RegisterGeneratedUntypedConversionFunc(
+		(*A)(nil), (*B)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn2(a.(*A), b.(*B), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	ext := NewConversionFuncs()
+	ext.AddUntyped(
+		(*A)(nil), (*B)(nil),
+		func(a, b interface{}, s Scope) error {
+			return nil
+		},
+	)
+	newc := c.WithConversions(ext)
+
+	a := A{}
+	b := B{}
+	if err := c.Convert(&a, &b, nil); err == nil || err.Error() != "conversion function should be overridden" {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if err := newc.Convert(&a, &b, nil); err != nil {
+		t.Errorf("%v", err)
+	}
+}
+
+func TestConverter_meta(t *testing.T) {
+	type Foo struct{ A string }
+	type Bar struct{ A string }
+	c := NewConverter(nil)
+	checks := 0
+	convertFn1 := func(in *Foo, out *Bar, s Scope) error {
+		if s.Meta() == nil {
+			t.Errorf("Meta did not get passed!")
+		}
+		checks++
+		out.A = in.A
+		return nil
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*Foo)(nil), (*Bar)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn1(a.(*Foo), b.(*Bar), s)
+		},
+	); err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	if err := c.Convert(&Foo{}, &Bar{}, &Meta{}); err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	if checks != 1 {
+		t.Errorf("Registered functions did not get called.")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/deep_equal.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/deep_equal.go
new file mode 100644
index 0000000000..25b2923f22
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/deep_equal.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package conversion
+
+import (
+	"k8s.io/apimachinery/third_party/forked/golang/reflect"
+)
+
+// The code for this type must be located in third_party, since it forks from
+// go std lib. But for convenience, we expose the type here, too.
+type Equalities struct {
+	reflect.Equalities
+}
+
+// For convenience, panics on errors
+func EqualitiesOrDie(funcs ...interface{}) Equalities {
+	e := Equalities{reflect.Equalities{}}
+	if err := e.AddFuncs(funcs...); err != nil {
+		panic(err)
+	}
+	return e
+}
+
+// Performs a shallow copy of the equalities map
+func (e Equalities) Copy() Equalities {
+	result := Equalities{reflect.Equalities{}}
+
+	for key, value := range e.Equalities {
+		result.Equalities[key] = value
+	}
+
+	return result
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/doc.go
new file mode 100644
index 0000000000..0c46ef2d16
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/doc.go
@@ -0,0 +1,24 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package conversion provides go object versioning.
+//
+// Specifically, conversion provides a way for you to define multiple versions
+// of the same object. You may write functions which implement conversion logic,
+// but for the fields which did not change, copying is automated. This makes it
+// easy to modify the structures you use in memory without affecting the format
+// you store on disk or respond to in your external API calls.
+package conversion
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/helper.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/helper.go
new file mode 100644
index 0000000000..7fadd27a46
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/helper.go
@@ -0,0 +1,39 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package conversion
+
+import (
+	"fmt"
+	"reflect"
+)
+
+// EnforcePtr ensures that obj is a pointer of some sort. Returns a reflect.Value
+// of the dereferenced pointer, ensuring that it is settable/addressable.
+// Returns an error if this is not possible.
+func EnforcePtr(obj interface{}) (reflect.Value, error) {
+	v := reflect.ValueOf(obj)
+	if v.Kind() != reflect.Pointer {
+		if v.Kind() == reflect.Invalid {
+			return reflect.Value{}, fmt.Errorf("expected pointer, but got invalid kind")
+		}
+		return reflect.Value{}, fmt.Errorf("expected pointer, but got %v type", v.Type())
+	}
+	if v.IsNil() {
+		return reflect.Value{}, fmt.Errorf("expected pointer, but got nil")
+	}
+	return v.Elem(), nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/helper_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/helper_test.go
new file mode 100644
index 0000000000..8c61a30a88
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/helper_test.go
@@ -0,0 +1,38 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package conversion
+
+import "testing"
+
+func TestInvalidPtrValueKind(t *testing.T) {
+	var simple interface{}
+	switch obj := simple.(type) {
+	default:
+		_, err := EnforcePtr(obj)
+		if err == nil {
+			t.Errorf("Expected error on invalid kind")
+		}
+	}
+}
+
+func TestEnforceNilPtr(t *testing.T) {
+	var nilPtr *struct{}
+	_, err := EnforcePtr(nilPtr)
+	if err == nil {
+		t.Errorf("Expected error on nil pointer")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/convert.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/convert.go
new file mode 100644
index 0000000000..5eb25e2e80
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/convert.go
@@ -0,0 +1,194 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package queryparams
+
+import (
+	"fmt"
+	"net/url"
+	"reflect"
+	"strings"
+)
+
+// Marshaler converts an object to a query parameter string representation
+type Marshaler interface {
+	MarshalQueryParameter() (string, error)
+}
+
+// Unmarshaler converts a string representation to an object
+type Unmarshaler interface {
+	UnmarshalQueryParameter(string) error
+}
+
+func jsonTag(field reflect.StructField) (string, bool) {
+	structTag, exists := field.Tag.Lookup("json")
+	if !exists || len(structTag) == 0 {
+		return "", false
+	}
+	parts := strings.Split(structTag, ",")
+	tag := parts[0]
+	if tag == "-" {
+		tag = ""
+	}
+	omitempty := false
+	parts = parts[1:]
+	for _, part := range parts {
+		if part == "omitempty" {
+			omitempty = true
+			break
+		}
+	}
+	return tag, omitempty
+}
+
+func isPointerKind(kind reflect.Kind) bool {
+	return kind == reflect.Pointer
+}
+
+func isStructKind(kind reflect.Kind) bool {
+	return kind == reflect.Struct
+}
+
+func isValueKind(kind reflect.Kind) bool {
+	switch kind {
+	case reflect.String, reflect.Bool, reflect.Int, reflect.Int8, reflect.Int16,
+		reflect.Int32, reflect.Int64, reflect.Uint, reflect.Uint8,
+		reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Float32,
+		reflect.Float64, reflect.Complex64, reflect.Complex128:
+		return true
+	default:
+		return false
+	}
+}
+
+func zeroValue(value reflect.Value) bool {
+	return reflect.DeepEqual(reflect.Zero(value.Type()).Interface(), value.Interface())
+}
+
+func customMarshalValue(value reflect.Value) (reflect.Value, bool) {
+	// Return unless we implement a custom query marshaler
+	if !value.CanInterface() {
+		return reflect.Value{}, false
+	}
+
+	marshaler, ok := value.Interface().(Marshaler)
+	if !ok {
+		if !isPointerKind(value.Kind()) && value.CanAddr() {
+			marshaler, ok = value.Addr().Interface().(Marshaler)
+			if !ok {
+				return reflect.Value{}, false
+			}
+		} else {
+			return reflect.Value{}, false
+		}
+	}
+
+	// Don't invoke functions on nil pointers
+	// If the type implements MarshalQueryParameter, AND the tag is not omitempty, AND the value is a nil pointer, "" seems like a reasonable response
+	if isPointerKind(value.Kind()) && zeroValue(value) {
+		return reflect.ValueOf(""), true
+	}
+
+	// Get the custom marshalled value
+	v, err := marshaler.MarshalQueryParameter()
+	if err != nil {
+		return reflect.Value{}, false
+	}
+	return reflect.ValueOf(v), true
+}
+
+func addParam(values url.Values, tag string, omitempty bool, value reflect.Value) {
+	if omitempty && zeroValue(value) {
+		return
+	}
+	val := ""
+	iValue := fmt.Sprintf("%v", value.Interface())
+
+	if iValue != "<nil>" {
+		val = iValue
+	}
+	values.Add(tag, val)
+}
+
+func addListOfParams(values url.Values, tag string, omitempty bool, list reflect.Value) {
+	for i := 0; i < list.Len(); i++ {
+		addParam(values, tag, omitempty, list.Index(i))
+	}
+}
+
+// Convert takes an object and converts it to a url.Values object using JSON tags as
+// parameter names. Only top-level simple values, arrays, and slices are serialized.
+// Embedded structs, maps, etc. will not be serialized.
+func Convert(obj interface{}) (url.Values, error) {
+	result := url.Values{}
+	if obj == nil {
+		return result, nil
+	}
+	var sv reflect.Value
+	switch reflect.TypeOf(obj).Kind() {
+	case reflect.Pointer, reflect.Interface:
+		sv = reflect.ValueOf(obj).Elem()
+	default:
+		return nil, fmt.Errorf("expecting a pointer or interface")
+	}
+	st := sv.Type()
+	if !isStructKind(st.Kind()) {
+		return nil, fmt.Errorf("expecting a pointer to a struct")
+	}
+
+	// Check all object fields
+	convertStruct(result, st, sv)
+
+	return result, nil
+}
+
+func convertStruct(result url.Values, st reflect.Type, sv reflect.Value) {
+	for i := 0; i < st.NumField(); i++ {
+		field := sv.Field(i)
+		tag, omitempty := jsonTag(st.Field(i))
+		if len(tag) == 0 {
+			continue
+		}
+		ft := field.Type()
+
+		kind := ft.Kind()
+		if isPointerKind(kind) {
+			ft = ft.Elem()
+			kind = ft.Kind()
+			if !field.IsNil() {
+				field = reflect.Indirect(field)
+				// If the field is non-nil, it should be added to params
+				// and the omitempty should be overwite to false
+				omitempty = false
+			}
+		}
+
+		switch {
+		case isValueKind(kind):
+			addParam(result, tag, omitempty, field)
+		case kind == reflect.Array || kind == reflect.Slice:
+			if isValueKind(ft.Elem().Kind()) {
+				addListOfParams(result, tag, omitempty, field)
+			}
+		case isStructKind(kind) && !(zeroValue(field) && omitempty):
+			if marshalValue, ok := customMarshalValue(field); ok {
+				addParam(result, tag, omitempty, marshalValue)
+			} else {
+				convertStruct(result, ft, field)
+			}
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/convert_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/convert_test.go
new file mode 100644
index 0000000000..a9b9385ced
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/convert_test.go
@@ -0,0 +1,216 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package queryparams_test
+
+import (
+	"net/url"
+	"reflect"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion/queryparams"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/utils/ptr"
+)
+
+type namedString string
+type namedBool bool
+
+type bar struct {
+	Float1   float32 `json:"float1"`
+	Float2   float64 `json:"float2"`
+	Int1     int64   `json:"int1,omitempty"`
+	Int2     int32   `json:"int2,omitempty"`
+	Int3     int16   `json:"int3,omitempty"`
+	Str1     string  `json:"str1,omitempty"`
+	Ignored  int
+	Ignored2 string
+}
+
+func (obj *bar) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+type foo struct {
+	Str       string            `json:"str"`
+	Integer   int               `json:"integer,omitempty"`
+	Slice     []string          `json:"slice,omitempty"`
+	Boolean   bool              `json:"boolean,omitempty"`
+	NamedStr  namedString       `json:"namedStr,omitempty"`
+	NamedBool namedBool         `json:"namedBool,omitempty"`
+	Foobar    bar               `json:"foobar,omitempty"`
+	Testmap   map[string]string `json:"testmap,omitempty"`
+}
+
+func (obj *foo) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+type baz struct {
+	Ptr  *int  `json:"ptr"`
+	Bptr *bool `json:"bptr,omitempty"`
+}
+
+func (obj *baz) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+// childStructs tests some of the types we serialize to query params for log API calls
+// notably, the nested time struct
+type childStructs struct {
+	Container      string       `json:"container,omitempty"`
+	Follow         bool         `json:"follow,omitempty"`
+	Previous       bool         `json:"previous,omitempty"`
+	SinceSeconds   *int64       `json:"sinceSeconds,omitempty"`
+	TailLines      *int64       `json:"tailLines,omitempty"`
+	SinceTime      *metav1.Time `json:"sinceTime,omitempty"`
+	EmptyTime      *metav1.Time `json:"emptyTime"`
+	NonPointerTime metav1.Time  `json:"nonPointerTime"`
+}
+
+func (obj *childStructs) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+func validateResult(t *testing.T, input interface{}, actual, expected url.Values) {
+	local := url.Values{}
+	for k, v := range expected {
+		local[k] = v
+	}
+	for k, v := range actual {
+		if ev, ok := local[k]; !ok || !reflect.DeepEqual(ev, v) {
+			if !ok {
+				t.Errorf("%#v: actual value key %s not found in expected map", input, k)
+			} else {
+				t.Errorf("%#v: values don't match: actual: %#v, expected: %#v", input, v, ev)
+			}
+		}
+		delete(local, k)
+	}
+	if len(local) > 0 {
+		t.Errorf("%#v: expected map has keys that were not found in actual map: %#v", input, local)
+	}
+}
+
+func TestConvert(t *testing.T) {
+	sinceSeconds := int64(123)
+	tailLines := int64(0)
+	sinceTime := metav1.Date(2000, 1, 1, 12, 34, 56, 0, time.UTC)
+
+	tests := []struct {
+		input    interface{}
+		expected url.Values
+	}{
+		{
+			input: &foo{
+				Str: "hello",
+			},
+			expected: url.Values{"str": {"hello"}},
+		},
+		{
+			input: &foo{
+				Str:     "test string",
+				Slice:   []string{"one", "two", "three"},
+				Integer: 234,
+				Boolean: true,
+			},
+			expected: url.Values{"str": {"test string"}, "slice": {"one", "two", "three"}, "integer": {"234"}, "boolean": {"true"}},
+		},
+		{
+			input: &foo{
+				Str:       "named types",
+				NamedStr:  "value1",
+				NamedBool: true,
+			},
+			expected: url.Values{"str": {"named types"}, "namedStr": {"value1"}, "namedBool": {"true"}},
+		},
+		{
+			input: &foo{
+				Str: "don't ignore embedded struct",
+				Foobar: bar{
+					Float1: 5.0,
+				},
+			},
+			expected: url.Values{"str": {"don't ignore embedded struct"}, "float1": {"5"}, "float2": {"0"}},
+		},
+		{
+			// Ignore untagged fields
+			input: &bar{
+				Float1:   23.5,
+				Float2:   100.7,
+				Int1:     1,
+				Int2:     2,
+				Int3:     3,
+				Ignored:  1,
+				Ignored2: "ignored",
+			},
+			expected: url.Values{"float1": {"23.5"}, "float2": {"100.7"}, "int1": {"1"}, "int2": {"2"}, "int3": {"3"}},
+		},
+		{
+			// include fields that are not tagged omitempty
+			input: &foo{
+				NamedStr: "named str",
+			},
+			expected: url.Values{"str": {""}, "namedStr": {"named str"}},
+		},
+		{
+			input: &baz{
+				Ptr:  ptr.To(5),
+				Bptr: ptr.To(true),
+			},
+			expected: url.Values{"ptr": {"5"}, "bptr": {"true"}},
+		},
+		{
+			input: &baz{
+				Bptr: ptr.To(true),
+			},
+			expected: url.Values{"ptr": {""}, "bptr": {"true"}},
+		},
+		{
+			input: &baz{
+				Ptr: ptr.To(5),
+			},
+			expected: url.Values{"ptr": {"5"}},
+		},
+		{
+			input: &childStructs{
+				Container:      "mycontainer",
+				Follow:         true,
+				Previous:       true,
+				SinceSeconds:   &sinceSeconds,
+				TailLines:      nil,
+				SinceTime:      &sinceTime, // test a custom marshaller
+				EmptyTime:      nil,        // test a nil custom marshaller without omitempty
+				NonPointerTime: sinceTime,
+			},
+			expected: url.Values{"container": {"mycontainer"}, "follow": {"true"}, "previous": {"true"}, "sinceSeconds": {"123"}, "sinceTime": {"2000-01-01T12:34:56Z"}, "emptyTime": {""}, "nonPointerTime": {"2000-01-01T12:34:56Z"}},
+		},
+		{
+			input: &childStructs{
+				Container:      "mycontainer",
+				Follow:         true,
+				Previous:       true,
+				SinceSeconds:   &sinceSeconds,
+				TailLines:      &tailLines,
+				SinceTime:      nil, // test a nil custom marshaller with omitempty
+				NonPointerTime: sinceTime,
+			},
+			expected: url.Values{"container": {"mycontainer"}, "follow": {"true"}, "previous": {"true"}, "sinceSeconds": {"123"}, "tailLines": {"0"}, "emptyTime": {""}, "nonPointerTime": {"2000-01-01T12:34:56Z"}},
+		},
+	}
+
+	for _, test := range tests {
+		result, err := queryparams.Convert(test.input)
+		if err != nil {
+			t.Errorf("Unexpected error while converting %#v: %v", test.input, err)
+		}
+		validateResult(t, test.input, result, test.expected)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/doc.go
new file mode 100644
index 0000000000..4c1002a4c1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package queryparams provides conversion from versioned
+// runtime objects to URL query values
+package queryparams
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/doc.go
new file mode 100644
index 0000000000..49059e2635
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package fields implements a simple field system, parsing and matching
+// selectors with sets of fields.
+package fields
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/fields.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/fields.go
new file mode 100644
index 0000000000..623b27e957
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/fields.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fields
+
+import (
+	"sort"
+	"strings"
+)
+
+// Fields allows you to present fields independently from their storage.
+type Fields interface {
+	// Has returns whether the provided field exists.
+	Has(field string) (exists bool)
+
+	// Get returns the value for the provided field.
+	Get(field string) (value string)
+}
+
+// Set is a map of field:value. It implements Fields.
+type Set map[string]string
+
+// String returns all fields listed as a human readable string.
+// Conveniently, exactly the format that ParseSelector takes.
+func (ls Set) String() string {
+	selector := make([]string, 0, len(ls))
+	for key, value := range ls {
+		selector = append(selector, key+"="+value)
+	}
+	// Sort for determinism.
+	sort.StringSlice(selector).Sort()
+	return strings.Join(selector, ",")
+}
+
+// Has returns whether the provided field exists in the map.
+func (ls Set) Has(field string) bool {
+	_, exists := ls[field]
+	return exists
+}
+
+// Get returns the value in the map for the provided field.
+func (ls Set) Get(field string) string {
+	return ls[field]
+}
+
+// AsSelector converts fields into a selectors.
+func (ls Set) AsSelector() Selector {
+	return SelectorFromSet(ls)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/fields_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/fields_test.go
new file mode 100644
index 0000000000..6965be6870
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/fields_test.go
@@ -0,0 +1,57 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fields
+
+import (
+	"testing"
+)
+
+func matches(t *testing.T, ls Set, want string) {
+	if ls.String() != want {
+		t.Errorf("Expected '%s', but got '%s'", want, ls.String())
+	}
+}
+
+func TestSetString(t *testing.T) {
+	matches(t, Set{"x": "y"}, "x=y")
+	matches(t, Set{"foo": "bar"}, "foo=bar")
+	matches(t, Set{"foo": "bar", "baz": "qup"}, "baz=qup,foo=bar")
+}
+
+func TestFieldHas(t *testing.T) {
+	fieldHasTests := []struct {
+		Ls  Fields
+		Key string
+		Has bool
+	}{
+		{Set{"x": "y"}, "x", true},
+		{Set{"x": ""}, "x", true},
+		{Set{"x": "y"}, "foo", false},
+	}
+	for _, lh := range fieldHasTests {
+		if has := lh.Ls.Has(lh.Key); has != lh.Has {
+			t.Errorf("%#v.Has(%#v) => %v, expected %v", lh.Ls, lh.Key, has, lh.Has)
+		}
+	}
+}
+
+func TestFieldGet(t *testing.T) {
+	ls := Set{"x": "y"}
+	if ls.Get("x") != "y" {
+		t.Errorf("Set.Get is broken")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/requirements.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/requirements.go
new file mode 100644
index 0000000000..70d94ded88
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/requirements.go
@@ -0,0 +1,30 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fields
+
+import "k8s.io/apimachinery/pkg/selection"
+
+// Requirements is AND of all requirements.
+type Requirements []Requirement
+
+// Requirement contains a field, a value, and an operator that relates the field and value.
+// This is currently for reading internal selection information of field selector.
+type Requirement struct {
+	Operator selection.Operator
+	Field    string
+	Value    string
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/selector.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/selector.go
new file mode 100644
index 0000000000..a9e204976a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/selector.go
@@ -0,0 +1,478 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fields
+
+import (
+	"bytes"
+	"fmt"
+	"sort"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/selection"
+)
+
+// Selector represents a field selector.
+type Selector interface {
+	// Matches returns true if this selector matches the given set of fields.
+	Matches(Fields) bool
+
+	// Empty returns true if this selector does not restrict the selection space.
+	Empty() bool
+
+	// RequiresExactMatch allows a caller to introspect whether a given selector
+	// requires a single specific field to be set, and if so returns the value it
+	// requires.
+	RequiresExactMatch(field string) (value string, found bool)
+
+	// Transform returns a new copy of the selector after TransformFunc has been
+	// applied to the entire selector, or an error if fn returns an error.
+	// If for a given requirement both field and value are transformed to empty
+	// string, the requirement is skipped.
+	Transform(fn TransformFunc) (Selector, error)
+
+	// Requirements converts this interface to Requirements to expose
+	// more detailed selection information.
+	Requirements() Requirements
+
+	// String returns a human readable string that represents this selector.
+	String() string
+
+	// Make a deep copy of the selector.
+	DeepCopySelector() Selector
+}
+
+type nothingSelector struct{}
+
+func (n nothingSelector) Matches(_ Fields) bool      { return false }
+func (n nothingSelector) Empty() bool                { return false }
+func (n nothingSelector) String() string             { return "" }
+func (n nothingSelector) Requirements() Requirements { return nil }
+func (n nothingSelector) DeepCopySelector() Selector { return n }
+func (n nothingSelector) RequiresExactMatch(field string) (value string, found bool) {
+	return "", false
+}
+func (n nothingSelector) Transform(fn TransformFunc) (Selector, error) { return n, nil }
+
+// Nothing returns a selector that matches no fields
+func Nothing() Selector {
+	return nothingSelector{}
+}
+
+// Everything returns a selector that matches all fields.
+func Everything() Selector {
+	return andTerm{}
+}
+
+type hasTerm struct {
+	field, value string
+}
+
+func (t *hasTerm) Matches(ls Fields) bool {
+	return ls.Get(t.field) == t.value
+}
+
+func (t *hasTerm) Empty() bool {
+	return false
+}
+
+func (t *hasTerm) RequiresExactMatch(field string) (value string, found bool) {
+	if t.field == field {
+		return t.value, true
+	}
+	return "", false
+}
+
+func (t *hasTerm) Transform(fn TransformFunc) (Selector, error) {
+	field, value, err := fn(t.field, t.value)
+	if err != nil {
+		return nil, err
+	}
+	if len(field) == 0 && len(value) == 0 {
+		return Everything(), nil
+	}
+	return &hasTerm{field, value}, nil
+}
+
+func (t *hasTerm) Requirements() Requirements {
+	return []Requirement{{
+		Field:    t.field,
+		Operator: selection.Equals,
+		Value:    t.value,
+	}}
+}
+
+func (t *hasTerm) String() string {
+	return fmt.Sprintf("%v=%v", t.field, EscapeValue(t.value))
+}
+
+func (t *hasTerm) DeepCopySelector() Selector {
+	if t == nil {
+		return nil
+	}
+	out := new(hasTerm)
+	*out = *t
+	return out
+}
+
+type notHasTerm struct {
+	field, value string
+}
+
+func (t *notHasTerm) Matches(ls Fields) bool {
+	return ls.Get(t.field) != t.value
+}
+
+func (t *notHasTerm) Empty() bool {
+	return false
+}
+
+func (t *notHasTerm) RequiresExactMatch(field string) (value string, found bool) {
+	return "", false
+}
+
+func (t *notHasTerm) Transform(fn TransformFunc) (Selector, error) {
+	field, value, err := fn(t.field, t.value)
+	if err != nil {
+		return nil, err
+	}
+	if len(field) == 0 && len(value) == 0 {
+		return Everything(), nil
+	}
+	return &notHasTerm{field, value}, nil
+}
+
+func (t *notHasTerm) Requirements() Requirements {
+	return []Requirement{{
+		Field:    t.field,
+		Operator: selection.NotEquals,
+		Value:    t.value,
+	}}
+}
+
+func (t *notHasTerm) String() string {
+	return fmt.Sprintf("%v!=%v", t.field, EscapeValue(t.value))
+}
+
+func (t *notHasTerm) DeepCopySelector() Selector {
+	if t == nil {
+		return nil
+	}
+	out := new(notHasTerm)
+	*out = *t
+	return out
+}
+
+type andTerm []Selector
+
+func (t andTerm) Matches(ls Fields) bool {
+	for _, q := range t {
+		if !q.Matches(ls) {
+			return false
+		}
+	}
+	return true
+}
+
+func (t andTerm) Empty() bool {
+	if t == nil {
+		return true
+	}
+	if len([]Selector(t)) == 0 {
+		return true
+	}
+	for i := range t {
+		if !t[i].Empty() {
+			return false
+		}
+	}
+	return true
+}
+
+func (t andTerm) RequiresExactMatch(field string) (string, bool) {
+	if t == nil || len([]Selector(t)) == 0 {
+		return "", false
+	}
+	for i := range t {
+		if value, found := t[i].RequiresExactMatch(field); found {
+			return value, found
+		}
+	}
+	return "", false
+}
+
+func (t andTerm) Transform(fn TransformFunc) (Selector, error) {
+	next := make([]Selector, 0, len([]Selector(t)))
+	for _, s := range []Selector(t) {
+		n, err := s.Transform(fn)
+		if err != nil {
+			return nil, err
+		}
+		if !n.Empty() {
+			next = append(next, n)
+		}
+	}
+	return andTerm(next), nil
+}
+
+func (t andTerm) Requirements() Requirements {
+	reqs := make([]Requirement, 0, len(t))
+	for _, s := range []Selector(t) {
+		rs := s.Requirements()
+		reqs = append(reqs, rs...)
+	}
+	return reqs
+}
+
+func (t andTerm) String() string {
+	var terms []string
+	for _, q := range t {
+		terms = append(terms, q.String())
+	}
+	return strings.Join(terms, ",")
+}
+
+func (t andTerm) DeepCopySelector() Selector {
+	if t == nil {
+		return nil
+	}
+	out := make([]Selector, len(t))
+	for i := range t {
+		out[i] = t[i].DeepCopySelector()
+	}
+	return andTerm(out)
+}
+
+// SelectorFromSet returns a Selector which will match exactly the given Set. A
+// nil Set is considered equivalent to Everything().
+func SelectorFromSet(ls Set) Selector {
+	if ls == nil {
+		return Everything()
+	}
+	items := make([]Selector, 0, len(ls))
+	for field, value := range ls {
+		items = append(items, &hasTerm{field: field, value: value})
+	}
+	if len(items) == 1 {
+		return items[0]
+	}
+	return andTerm(items)
+}
+
+// valueEscaper prefixes \,= characters with a backslash
+var valueEscaper = strings.NewReplacer(
+	// escape \ characters
+	`\`, `\\`,
+	// then escape , and = characters to allow unambiguous parsing of the value in a fieldSelector
+	`,`, `\,`,
+	`=`, `\=`,
+)
+
+// EscapeValue escapes an arbitrary literal string for use as a fieldSelector value
+func EscapeValue(s string) string {
+	return valueEscaper.Replace(s)
+}
+
+// InvalidEscapeSequence indicates an error occurred unescaping a field selector
+type InvalidEscapeSequence struct {
+	sequence string
+}
+
+func (i InvalidEscapeSequence) Error() string {
+	return fmt.Sprintf("invalid field selector: invalid escape sequence: %s", i.sequence)
+}
+
+// UnescapedRune indicates an error occurred unescaping a field selector
+type UnescapedRune struct {
+	r rune
+}
+
+func (i UnescapedRune) Error() string {
+	return fmt.Sprintf("invalid field selector: unescaped character in value: %v", i.r)
+}
+
+// UnescapeValue unescapes a fieldSelector value and returns the original literal value.
+// May return the original string if it contains no escaped or special characters.
+func UnescapeValue(s string) (string, error) {
+	// if there's no escaping or special characters, just return to avoid allocation
+	if !strings.ContainsAny(s, `\,=`) {
+		return s, nil
+	}
+
+	v := bytes.NewBuffer(make([]byte, 0, len(s)))
+	inSlash := false
+	for _, c := range s {
+		if inSlash {
+			switch c {
+			case '\\', ',', '=':
+				// omit the \ for recognized escape sequences
+				v.WriteRune(c)
+			default:
+				// error on unrecognized escape sequences
+				return "", InvalidEscapeSequence{sequence: string([]rune{'\\', c})}
+			}
+			inSlash = false
+			continue
+		}
+
+		switch c {
+		case '\\':
+			inSlash = true
+		case ',', '=':
+			// unescaped , and = characters are not allowed in field selector values
+			return "", UnescapedRune{r: c}
+		default:
+			v.WriteRune(c)
+		}
+	}
+
+	// Ending with a single backslash is an invalid sequence
+	if inSlash {
+		return "", InvalidEscapeSequence{sequence: "\\"}
+	}
+
+	return v.String(), nil
+}
+
+// ParseSelectorOrDie takes a string representing a selector and returns an
+// object suitable for matching, or panic when an error occur.
+func ParseSelectorOrDie(s string) Selector {
+	selector, err := ParseSelector(s)
+	if err != nil {
+		panic(err)
+	}
+	return selector
+}
+
+// ParseSelector takes a string representing a selector and returns an
+// object suitable for matching, or an error.
+func ParseSelector(selector string) (Selector, error) {
+	return parseSelector(selector,
+		func(lhs, rhs string) (newLhs, newRhs string, err error) {
+			return lhs, rhs, nil
+		})
+}
+
+// ParseAndTransformSelector parses the selector and runs them through the given TransformFunc.
+func ParseAndTransformSelector(selector string, fn TransformFunc) (Selector, error) {
+	return parseSelector(selector, fn)
+}
+
+// TransformFunc transforms selectors.
+type TransformFunc func(field, value string) (newField, newValue string, err error)
+
+// splitTerms returns the comma-separated terms contained in the given fieldSelector.
+// Backslash-escaped commas are treated as data instead of delimiters, and are included in the returned terms, with the leading backslash preserved.
+func splitTerms(fieldSelector string) []string {
+	if len(fieldSelector) == 0 {
+		return nil
+	}
+
+	terms := make([]string, 0, 1)
+	startIndex := 0
+	inSlash := false
+	for i, c := range fieldSelector {
+		switch {
+		case inSlash:
+			inSlash = false
+		case c == '\\':
+			inSlash = true
+		case c == ',':
+			terms = append(terms, fieldSelector[startIndex:i])
+			startIndex = i + 1
+		}
+	}
+
+	terms = append(terms, fieldSelector[startIndex:])
+
+	return terms
+}
+
+const (
+	notEqualOperator    = "!="
+	doubleEqualOperator = "=="
+	equalOperator       = "="
+)
+
+// termOperators holds the recognized operators supported in fieldSelectors.
+// doubleEqualOperator and equal are equivalent, but doubleEqualOperator is checked first
+// to avoid leaving a leading = character on the rhs value.
+var termOperators = []string{notEqualOperator, doubleEqualOperator, equalOperator}
+
+// splitTerm returns the lhs, operator, and rhs parsed from the given term, along with an indicator of whether the parse was successful.
+// no escaping of special characters is supported in the lhs value, so the first occurrence of a recognized operator is used as the split point.
+// the literal rhs is returned, and the caller is responsible for applying any desired unescaping.
+func splitTerm(term string) (lhs, op, rhs string, ok bool) {
+	for i := range term {
+		remaining := term[i:]
+		for _, op := range termOperators {
+			if strings.HasPrefix(remaining, op) {
+				return term[0:i], op, term[i+len(op):], true
+			}
+		}
+	}
+	return "", "", "", false
+}
+
+func parseSelector(selector string, fn TransformFunc) (Selector, error) {
+	parts := splitTerms(selector)
+	sort.StringSlice(parts).Sort()
+	var items []Selector
+	for _, part := range parts {
+		if part == "" {
+			continue
+		}
+		lhs, op, rhs, ok := splitTerm(part)
+		if !ok {
+			return nil, fmt.Errorf("invalid selector: '%s'; can't understand '%s'", selector, part)
+		}
+		unescapedRHS, err := UnescapeValue(rhs)
+		if err != nil {
+			return nil, err
+		}
+		switch op {
+		case notEqualOperator:
+			items = append(items, &notHasTerm{field: lhs, value: unescapedRHS})
+		case doubleEqualOperator:
+			items = append(items, &hasTerm{field: lhs, value: unescapedRHS})
+		case equalOperator:
+			items = append(items, &hasTerm{field: lhs, value: unescapedRHS})
+		default:
+			return nil, fmt.Errorf("invalid selector: '%s'; can't understand '%s'", selector, part)
+		}
+	}
+	if len(items) == 1 {
+		return items[0].Transform(fn)
+	}
+	return andTerm(items).Transform(fn)
+}
+
+// OneTermEqualSelector returns an object that matches objects where one field/field equals one value.
+// Cannot return an error.
+func OneTermEqualSelector(k, v string) Selector {
+	return &hasTerm{field: k, value: v}
+}
+
+// OneTermNotEqualSelector returns an object that matches objects where one field/field does not equal one value.
+// Cannot return an error.
+func OneTermNotEqualSelector(k, v string) Selector {
+	return &notHasTerm{field: k, value: v}
+}
+
+// AndSelectors creates a selector that is the logical AND of all the given selectors
+func AndSelectors(selectors ...Selector) Selector {
+	return andTerm(selectors)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/selector_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/selector_test.go
new file mode 100644
index 0000000000..0aa66935cc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/fields/selector_test.go
@@ -0,0 +1,397 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fields
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestSplitTerms(t *testing.T) {
+	testcases := map[string][]string{
+		// Simple selectors
+		`a`:                            {`a`},
+		`a=avalue`:                     {`a=avalue`},
+		`a=avalue,b=bvalue`:            {`a=avalue`, `b=bvalue`},
+		`a=avalue,b==bvalue,c!=cvalue`: {`a=avalue`, `b==bvalue`, `c!=cvalue`},
+
+		// Empty terms
+		``:     nil,
+		`a=a,`: {`a=a`, ``},
+		`,a=a`: {``, `a=a`},
+
+		// Escaped values
+		`k=\,,k2=v2`:   {`k=\,`, `k2=v2`},   // escaped comma in value
+		`k=\\,k2=v2`:   {`k=\\`, `k2=v2`},   // escaped backslash, unescaped comma
+		`k=\\\,,k2=v2`: {`k=\\\,`, `k2=v2`}, // escaped backslash and comma
+		`k=\a\b\`:      {`k=\a\b\`},         // non-escape sequences
+		`k=\`:          {`k=\`},             // orphan backslash
+
+		// Multi-byte
+		`함=수,목=록`: {`함=수`, `목=록`},
+	}
+
+	for selector, expectedTerms := range testcases {
+		if terms := splitTerms(selector); !reflect.DeepEqual(terms, expectedTerms) {
+			t.Errorf("splitSelectors(`%s`): Expected\n%#v\ngot\n%#v", selector, expectedTerms, terms)
+		}
+	}
+}
+
+func TestSplitTerm(t *testing.T) {
+	testcases := map[string]struct {
+		lhs string
+		op  string
+		rhs string
+		ok  bool
+	}{
+		// Simple terms
+		`a=value`:  {lhs: `a`, op: `=`, rhs: `value`, ok: true},
+		`b==value`: {lhs: `b`, op: `==`, rhs: `value`, ok: true},
+		`c!=value`: {lhs: `c`, op: `!=`, rhs: `value`, ok: true},
+
+		// Empty or invalid terms
+		``:  {lhs: ``, op: ``, rhs: ``, ok: false},
+		`a`: {lhs: ``, op: ``, rhs: ``, ok: false},
+
+		// Escaped values
+		`k=\,`:          {lhs: `k`, op: `=`, rhs: `\,`, ok: true},
+		`k=\=`:          {lhs: `k`, op: `=`, rhs: `\=`, ok: true},
+		`k=\\\a\b\=\,\`: {lhs: `k`, op: `=`, rhs: `\\\a\b\=\,\`, ok: true},
+
+		// Multi-byte
+		`함=수`: {lhs: `함`, op: `=`, rhs: `수`, ok: true},
+	}
+
+	for term, expected := range testcases {
+		lhs, op, rhs, ok := splitTerm(term)
+		if lhs != expected.lhs || op != expected.op || rhs != expected.rhs || ok != expected.ok {
+			t.Errorf(
+				"splitTerm(`%s`): Expected\n%s,%s,%s,%v\nGot\n%s,%s,%s,%v",
+				term,
+				expected.lhs, expected.op, expected.rhs, expected.ok,
+				lhs, op, rhs, ok,
+			)
+		}
+	}
+}
+
+func TestEscapeValue(t *testing.T) {
+	// map values to their normalized escaped values
+	testcases := map[string]string{
+		``:      ``,
+		`a`:     `a`,
+		`=`:     `\=`,
+		`,`:     `\,`,
+		`\`:     `\\`,
+		`\=\,\`: `\\\=\\\,\\`,
+	}
+
+	for unescapedValue, escapedValue := range testcases {
+		actualEscaped := EscapeValue(unescapedValue)
+		if actualEscaped != escapedValue {
+			t.Errorf("EscapeValue(%s): expected %s, got %s", unescapedValue, escapedValue, actualEscaped)
+		}
+
+		actualUnescaped, err := UnescapeValue(escapedValue)
+		if err != nil {
+			t.Errorf("UnescapeValue(%s): unexpected error %v", escapedValue, err)
+		}
+		if actualUnescaped != unescapedValue {
+			t.Errorf("UnescapeValue(%s): expected %s, got %s", escapedValue, unescapedValue, actualUnescaped)
+		}
+	}
+
+	// test invalid escape sequences
+	invalidTestcases := []string{
+		`\`,   // orphan slash is invalid
+		`\\\`, // orphan slash is invalid
+		`\a`,  // unrecognized escape sequence is invalid
+	}
+	for _, invalidValue := range invalidTestcases {
+		_, err := UnescapeValue(invalidValue)
+		if _, ok := err.(InvalidEscapeSequence); !ok || err == nil {
+			t.Errorf("UnescapeValue(%s): expected invalid escape sequence error, got %#v", invalidValue, err)
+		}
+	}
+}
+
+func TestSelectorParse(t *testing.T) {
+	testGoodStrings := []string{
+		"x=a,y=b,z=c",
+		"",
+		"x!=a,y=b",
+		`x=a||y\=b`,
+		`x=a\=\=b`,
+	}
+	testBadStrings := []string{
+		"x=a||y=b",
+		"x==a==b",
+		"x=a,b",
+		"x in (a)",
+		"x in (a,b,c)",
+		"x",
+	}
+	for _, test := range testGoodStrings {
+		lq, err := ParseSelector(test)
+		if err != nil {
+			t.Errorf("%v: error %v (%#v)\n", test, err, err)
+		}
+		if test != lq.String() {
+			t.Errorf("%v restring gave: %v\n", test, lq.String())
+		}
+	}
+	for _, test := range testBadStrings {
+		_, err := ParseSelector(test)
+		if err == nil {
+			t.Errorf("%v: did not get expected error\n", test)
+		}
+	}
+}
+
+func TestDeterministicParse(t *testing.T) {
+	s1, err := ParseSelector("x=a,a=x")
+	s2, err2 := ParseSelector("a=x,x=a")
+	if err != nil || err2 != nil {
+		t.Errorf("Unexpected parse error")
+	}
+	if s1.String() != s2.String() {
+		t.Errorf("Non-deterministic parse")
+	}
+}
+
+func expectMatch(t *testing.T, selector string, ls Set) {
+	lq, err := ParseSelector(selector)
+	if err != nil {
+		t.Errorf("Unable to parse %v as a selector\n", selector)
+		return
+	}
+	if !lq.Matches(ls) {
+		t.Errorf("Wanted %s to match '%s', but it did not.\n", selector, ls)
+	}
+}
+
+func expectNoMatch(t *testing.T, selector string, ls Set) {
+	lq, err := ParseSelector(selector)
+	if err != nil {
+		t.Errorf("Unable to parse %v as a selector\n", selector)
+		return
+	}
+	if lq.Matches(ls) {
+		t.Errorf("Wanted '%s' to not match '%s', but it did.", selector, ls)
+	}
+}
+
+func TestEverything(t *testing.T) {
+	if !Everything().Matches(Set{"x": "y"}) {
+		t.Errorf("Nil selector didn't match")
+	}
+	if !Everything().Empty() {
+		t.Errorf("Everything was not empty")
+	}
+}
+
+func TestSelectorMatches(t *testing.T) {
+	expectMatch(t, "", Set{"x": "y"})
+	expectMatch(t, "x=y", Set{"x": "y"})
+	expectMatch(t, "x=y,z=w", Set{"x": "y", "z": "w"})
+	expectMatch(t, "x!=y,z!=w", Set{"x": "z", "z": "a"})
+	expectMatch(t, "notin=in", Set{"notin": "in"}) // in and notin in exactMatch
+	expectNoMatch(t, "x=y", Set{"x": "z"})
+	expectNoMatch(t, "x=y,z=w", Set{"x": "w", "z": "w"})
+	expectNoMatch(t, "x!=y,z!=w", Set{"x": "z", "z": "w"})
+
+	fieldset := Set{
+		"foo":     "bar",
+		"baz":     "blah",
+		"complex": `=value\,\`,
+	}
+	expectMatch(t, "foo=bar", fieldset)
+	expectMatch(t, "baz=blah", fieldset)
+	expectMatch(t, "foo=bar,baz=blah", fieldset)
+	expectMatch(t, `foo=bar,baz=blah,complex=\=value\\\,\\`, fieldset)
+	expectNoMatch(t, "foo=blah", fieldset)
+	expectNoMatch(t, "baz=bar", fieldset)
+	expectNoMatch(t, "foo=bar,foobar=bar,baz=blah", fieldset)
+}
+
+func TestOneTermEqualSelector(t *testing.T) {
+	if !OneTermEqualSelector("x", "y").Matches(Set{"x": "y"}) {
+		t.Errorf("No match when match expected.")
+	}
+	if OneTermEqualSelector("x", "y").Matches(Set{"x": "z"}) {
+		t.Errorf("Match when none expected.")
+	}
+}
+
+func expectMatchDirect(t *testing.T, selector, ls Set) {
+	if !SelectorFromSet(selector).Matches(ls) {
+		t.Errorf("Wanted %s to match '%s', but it did not.\n", selector, ls)
+	}
+}
+
+func expectNoMatchDirect(t *testing.T, selector, ls Set) {
+	if SelectorFromSet(selector).Matches(ls) {
+		t.Errorf("Wanted '%s' to not match '%s', but it did.", selector, ls)
+	}
+}
+
+func TestSetMatches(t *testing.T) {
+	labelset := Set{
+		"foo": "bar",
+		"baz": "blah",
+	}
+	expectMatchDirect(t, Set{}, labelset)
+	expectMatchDirect(t, Set{"foo": "bar"}, labelset)
+	expectMatchDirect(t, Set{"baz": "blah"}, labelset)
+	expectMatchDirect(t, Set{"foo": "bar", "baz": "blah"}, labelset)
+	expectNoMatchDirect(t, Set{"foo": "=blah"}, labelset)
+	expectNoMatchDirect(t, Set{"baz": "=bar"}, labelset)
+	expectNoMatchDirect(t, Set{"foo": "=bar", "foobar": "bar", "baz": "blah"}, labelset)
+}
+
+func TestNilMapIsValid(t *testing.T) {
+	selector := Set(nil).AsSelector()
+	if selector == nil {
+		t.Errorf("Selector for nil set should be Everything")
+	}
+	if !selector.Empty() {
+		t.Errorf("Selector for nil set should be Empty")
+	}
+}
+
+func TestSetIsEmpty(t *testing.T) {
+	if !(Set{}).AsSelector().Empty() {
+		t.Errorf("Empty set should be empty")
+	}
+	if !(andTerm(nil)).Empty() {
+		t.Errorf("Nil andTerm should be empty")
+	}
+	if (&hasTerm{}).Empty() {
+		t.Errorf("hasTerm should not be empty")
+	}
+	if (&notHasTerm{}).Empty() {
+		t.Errorf("notHasTerm should not be empty")
+	}
+	if !(andTerm{andTerm{}}).Empty() {
+		t.Errorf("Nested andTerm should be empty")
+	}
+	if (andTerm{&hasTerm{"a", "b"}}).Empty() {
+		t.Errorf("Nested andTerm should not be empty")
+	}
+}
+
+func TestRequiresExactMatch(t *testing.T) {
+	testCases := map[string]struct {
+		S     Selector
+		Label string
+		Value string
+		Found bool
+	}{
+		"empty set":                 {Set{}.AsSelector(), "test", "", false},
+		"empty hasTerm":             {&hasTerm{}, "test", "", false},
+		"skipped hasTerm":           {&hasTerm{"a", "b"}, "test", "", false},
+		"valid hasTerm":             {&hasTerm{"test", "b"}, "test", "b", true},
+		"valid hasTerm no value":    {&hasTerm{"test", ""}, "test", "", true},
+		"valid notHasTerm":          {&notHasTerm{"test", "b"}, "test", "", false},
+		"valid notHasTerm no value": {&notHasTerm{"test", ""}, "test", "", false},
+		"nil andTerm":               {andTerm(nil), "test", "", false},
+		"empty andTerm":             {andTerm{}, "test", "", false},
+		"nested andTerm":            {andTerm{andTerm{}}, "test", "", false},
+		"nested andTerm matches":    {andTerm{&hasTerm{"test", "b"}}, "test", "b", true},
+		"andTerm with non-match":    {andTerm{&hasTerm{}, &hasTerm{"test", "b"}}, "test", "b", true},
+	}
+	for k, v := range testCases {
+		value, found := v.S.RequiresExactMatch(v.Label)
+		if value != v.Value {
+			t.Errorf("%s: expected value %s, got %s", k, v.Value, value)
+		}
+		if found != v.Found {
+			t.Errorf("%s: expected found %t, got %t", k, v.Found, found)
+		}
+	}
+}
+
+func TestTransform(t *testing.T) {
+	testCases := []struct {
+		name      string
+		selector  string
+		transform func(field, value string) (string, string, error)
+		result    string
+		isEmpty   bool
+	}{
+		{
+			name:      "empty selector",
+			selector:  "",
+			transform: func(field, value string) (string, string, error) { return field, value, nil },
+			result:    "",
+			isEmpty:   true,
+		},
+		{
+			name:      "no-op transform",
+			selector:  "a=b,c=d",
+			transform: func(field, value string) (string, string, error) { return field, value, nil },
+			result:    "a=b,c=d",
+			isEmpty:   false,
+		},
+		{
+			name:     "transform one field",
+			selector: "a=b,c=d",
+			transform: func(field, value string) (string, string, error) {
+				if field == "a" {
+					return "e", "f", nil
+				}
+				return field, value, nil
+			},
+			result:  "e=f,c=d",
+			isEmpty: false,
+		},
+		{
+			name:      "remove field to make empty",
+			selector:  "a=b",
+			transform: func(field, value string) (string, string, error) { return "", "", nil },
+			result:    "",
+			isEmpty:   true,
+		},
+		{
+			name:     "remove only one field",
+			selector: "a=b,c=d,e=f",
+			transform: func(field, value string) (string, string, error) {
+				if field == "c" {
+					return "", "", nil
+				}
+				return field, value, nil
+			},
+			result:  "a=b,e=f",
+			isEmpty: false,
+		},
+	}
+
+	for i, tc := range testCases {
+		result, err := ParseAndTransformSelector(tc.selector, tc.transform)
+		if err != nil {
+			t.Errorf("[%d] unexpected error during Transform: %v", i, err)
+		}
+		if result.Empty() != tc.isEmpty {
+			t.Errorf("[%d] expected empty: %t, got: %t", i, tc.isEmpty, result.Empty())
+		}
+		if result.String() != tc.result {
+			t.Errorf("[%d] unexpected result: %s", i, result.String())
+		}
+	}
+
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/doc.go
new file mode 100644
index 0000000000..35ba788094
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package labels implements a simple label system, parsing and matching
+// selectors with sets of labels.
+package labels
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/labels.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/labels.go
new file mode 100644
index 0000000000..670b010ba5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/labels.go
@@ -0,0 +1,183 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package labels
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Labels allows you to present labels independently from their storage.
+type Labels interface {
+	// Has returns whether the provided label exists.
+	Has(label string) (exists bool)
+
+	// Get returns the value for the provided label.
+	Get(label string) (value string)
+
+	// Lookup returns the value for the provided label if it exists and whether the provided label exist
+	Lookup(label string) (value string, exists bool)
+}
+
+// Set is a map of label:value. It implements Labels.
+type Set map[string]string
+
+// String returns all labels listed as a human readable string.
+// Conveniently, exactly the format that ParseSelector takes.
+func (ls Set) String() string {
+	selector := make([]string, 0, len(ls))
+	for key, value := range ls {
+		selector = append(selector, key+"="+value)
+	}
+	// Sort for determinism.
+	sort.StringSlice(selector).Sort()
+	return strings.Join(selector, ",")
+}
+
+// Has returns whether the provided label exists in the map.
+func (ls Set) Has(label string) bool {
+	_, exists := ls[label]
+	return exists
+}
+
+// Get returns the value in the map for the provided label.
+func (ls Set) Get(label string) string {
+	return ls[label]
+}
+
+// Lookup returns the value for the provided label if it exists and whether the provided label exist
+func (ls Set) Lookup(label string) (string, bool) {
+	val, exists := ls[label]
+	return val, exists
+}
+
+// AsSelector converts labels into a selectors. It does not
+// perform any validation, which means the server will reject
+// the request if the Set contains invalid values.
+func (ls Set) AsSelector() Selector {
+	return SelectorFromSet(ls)
+}
+
+// AsValidatedSelector converts labels into a selectors.
+// The Set is validated client-side, which allows to catch errors early.
+func (ls Set) AsValidatedSelector() (Selector, error) {
+	return ValidatedSelectorFromSet(ls)
+}
+
+// AsSelectorPreValidated converts labels into a selector, but
+// assumes that labels are already validated and thus doesn't
+// perform any validation.
+// According to our measurements this is significantly faster
+// in codepaths that matter at high scale.
+// Note: this method copies the Set; if the Set is immutable, consider wrapping it with ValidatedSetSelector
+// instead, which does not copy.
+func (ls Set) AsSelectorPreValidated() Selector {
+	return SelectorFromValidatedSet(ls)
+}
+
+// FormatLabels converts label map into plain string
+func FormatLabels(labelMap map[string]string) string {
+	l := Set(labelMap).String()
+	if l == "" {
+		l = "<none>"
+	}
+	return l
+}
+
+// Conflicts takes 2 maps and returns true if there a key match between
+// the maps but the value doesn't match, and returns false in other cases
+func Conflicts(labels1, labels2 Set) bool {
+	small := labels1
+	big := labels2
+	if len(labels2) < len(labels1) {
+		small = labels2
+		big = labels1
+	}
+
+	for k, v := range small {
+		if val, match := big[k]; match {
+			if val != v {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+// Merge combines given maps, and does not check for any conflicts
+// between the maps. In case of conflicts, second map (labels2) wins
+func Merge(labels1, labels2 Set) Set {
+	mergedMap := Set{}
+
+	for k, v := range labels1 {
+		mergedMap[k] = v
+	}
+	for k, v := range labels2 {
+		mergedMap[k] = v
+	}
+	return mergedMap
+}
+
+// Equals returns true if the given maps are equal
+func Equals(labels1, labels2 Set) bool {
+	if len(labels1) != len(labels2) {
+		return false
+	}
+
+	for k, v := range labels1 {
+		value, ok := labels2[k]
+		if !ok {
+			return false
+		}
+		if value != v {
+			return false
+		}
+	}
+	return true
+}
+
+// ConvertSelectorToLabelsMap converts selector string to labels map
+// and validates keys and values
+func ConvertSelectorToLabelsMap(selector string, opts ...field.PathOption) (Set, error) {
+	labelsMap := Set{}
+
+	if len(selector) == 0 {
+		return labelsMap, nil
+	}
+
+	labels := strings.Split(selector, ",")
+	for _, label := range labels {
+		l := strings.Split(label, "=")
+		if len(l) != 2 {
+			return labelsMap, fmt.Errorf("invalid selector: %s", l)
+		}
+		key := strings.TrimSpace(l[0])
+		if err := validateLabelKey(key, field.ToPath(opts...)); err != nil {
+			return labelsMap, err
+		}
+		value := strings.TrimSpace(l[1])
+		if err := validateLabelValue(key, value, field.ToPath(opts...)); err != nil {
+			return labelsMap, err
+		}
+		labelsMap[key] = value
+	}
+	return labelsMap, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/labels_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/labels_test.go
new file mode 100644
index 0000000000..2d4d761bc2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/labels_test.go
@@ -0,0 +1,231 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package labels
+
+import (
+	"testing"
+)
+
+func matches(t *testing.T, ls Set, want string) {
+	if ls.String() != want {
+		t.Errorf("Expected '%s', but got '%s'", want, ls.String())
+	}
+}
+
+func TestSetString(t *testing.T) {
+	matches(t, Set{"x": "y"}, "x=y")
+	matches(t, Set{"foo": "bar"}, "foo=bar")
+	matches(t, Set{"foo": "bar", "baz": "qup"}, "baz=qup,foo=bar")
+
+	// TODO: Make our label representation robust enough to handle labels
+	// with ",=!" characters in their names.
+}
+
+func TestLabelHas(t *testing.T) {
+	labelHasTests := []struct {
+		Ls  Labels
+		Key string
+		Has bool
+	}{
+		{Set{"x": "y"}, "x", true},
+		{Set{"x": ""}, "x", true},
+		{Set{"x": "y"}, "foo", false},
+	}
+	for _, lh := range labelHasTests {
+		if has := lh.Ls.Has(lh.Key); has != lh.Has {
+			t.Errorf("%#v.Has(%#v) => %v, expected %v", lh.Ls, lh.Key, has, lh.Has)
+		}
+	}
+}
+
+func TestLabelGet(t *testing.T) {
+	ls := Set{"x": "y"}
+	if ls.Get("x") != "y" {
+		t.Errorf("Set.Get is broken")
+	}
+}
+
+func TestLabelConflict(t *testing.T) {
+	tests := []struct {
+		labels1  map[string]string
+		labels2  map[string]string
+		conflict bool
+	}{
+		{
+			labels1:  map[string]string{},
+			labels2:  map[string]string{},
+			conflict: false,
+		},
+		{
+			labels1:  map[string]string{"env": "test"},
+			labels2:  map[string]string{"infra": "true"},
+			conflict: false,
+		},
+		{
+			labels1:  map[string]string{"env": "test"},
+			labels2:  map[string]string{"infra": "true", "env": "test"},
+			conflict: false,
+		},
+		{
+			labels1:  map[string]string{"env": "test"},
+			labels2:  map[string]string{"env": "dev"},
+			conflict: true,
+		},
+		{
+			labels1:  map[string]string{"env": "test", "infra": "false"},
+			labels2:  map[string]string{"infra": "true", "color": "blue"},
+			conflict: true,
+		},
+	}
+	for _, test := range tests {
+		conflict := Conflicts(Set(test.labels1), Set(test.labels2))
+		if conflict != test.conflict {
+			t.Errorf("expected: %v but got: %v", test.conflict, conflict)
+		}
+	}
+}
+
+func TestLabelMerge(t *testing.T) {
+	tests := []struct {
+		labels1      map[string]string
+		labels2      map[string]string
+		mergedLabels map[string]string
+	}{
+		{
+			labels1:      map[string]string{},
+			labels2:      map[string]string{},
+			mergedLabels: map[string]string{},
+		},
+		{
+			labels1:      map[string]string{"infra": "true"},
+			labels2:      map[string]string{},
+			mergedLabels: map[string]string{"infra": "true"},
+		},
+		{
+			labels1:      map[string]string{"infra": "true"},
+			labels2:      map[string]string{"env": "test", "color": "blue"},
+			mergedLabels: map[string]string{"infra": "true", "env": "test", "color": "blue"},
+		},
+	}
+	for _, test := range tests {
+		mergedLabels := Merge(Set(test.labels1), Set(test.labels2))
+		if !Equals(mergedLabels, test.mergedLabels) {
+			t.Errorf("expected: %v but got: %v", test.mergedLabels, mergedLabels)
+		}
+	}
+}
+
+func TestLabelSelectorParse(t *testing.T) {
+	tests := []struct {
+		selector string
+		labels   map[string]string
+		valid    bool
+	}{
+		{
+			selector: "",
+			labels:   map[string]string{},
+			valid:    true,
+		},
+		{
+			selector: "x=a",
+			labels:   map[string]string{"x": "a"},
+			valid:    true,
+		},
+		{
+			selector: "x=a,y=b,z=c",
+			labels:   map[string]string{"x": "a", "y": "b", "z": "c"},
+			valid:    true,
+		},
+		{
+			selector: " x = a , y = b , z = c ",
+			labels:   map[string]string{"x": "a", "y": "b", "z": "c"},
+			valid:    true,
+		},
+		{
+			selector: "color=green,env=test,service=front",
+			labels:   map[string]string{"color": "green", "env": "test", "service": "front"},
+			valid:    true,
+		},
+		{
+			selector: "color=green, env=test, service=front",
+			labels:   map[string]string{"color": "green", "env": "test", "service": "front"},
+			valid:    true,
+		},
+		{
+			selector: ",",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x,y",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x=$y",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x!=y",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x==y",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x=a||y=b",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x in (y)",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x notin (y)",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x y",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+	}
+	for _, test := range tests {
+		labels, err := ConvertSelectorToLabelsMap(test.selector)
+		if test.valid && err != nil {
+			t.Errorf("selector: %s, expected no error but got: %s", test.selector, err)
+		} else if !test.valid && err == nil {
+			t.Errorf("selector: %s, expected an error", test.selector)
+		}
+
+		if !Equals(Set(labels), test.labels) {
+			t.Errorf("expected: %s but got: %s", test.labels, labels)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/selector.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/selector.go
new file mode 100644
index 0000000000..f31a890f2b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/selector.go
@@ -0,0 +1,1073 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package labels
+
+import (
+	"fmt"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+
+	"k8s.io/klog/v2"
+
+	"k8s.io/apimachinery/pkg/api/validate/content"
+	"k8s.io/apimachinery/pkg/selection"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+var (
+	unaryOperators = []string{
+		string(selection.Exists), string(selection.DoesNotExist),
+	}
+	binaryOperators = []string{
+		string(selection.In), string(selection.NotIn),
+		string(selection.Equals), string(selection.DoubleEquals), string(selection.NotEquals),
+		string(selection.GreaterThan), string(selection.LessThan),
+	}
+	validRequirementOperators = append(binaryOperators, unaryOperators...)
+)
+
+// Requirements is AND of all requirements.
+type Requirements []Requirement
+
+func (r Requirements) String() string {
+	var sb strings.Builder
+
+	for i, requirement := range r {
+		if i > 0 {
+			sb.WriteString(", ")
+		}
+		sb.WriteString(requirement.String())
+	}
+
+	return sb.String()
+}
+
+// Selector represents a label selector.
+type Selector interface {
+	// Matches returns true if this selector matches the given set of labels.
+	Matches(Labels) bool
+
+	// Empty returns true if this selector does not restrict the selection space.
+	Empty() bool
+
+	// String returns a human readable string that represents this selector.
+	String() string
+
+	// Add adds requirements to the Selector
+	Add(r ...Requirement) Selector
+
+	// Requirements converts this interface into Requirements to expose
+	// more detailed selection information.
+	// If there are querying parameters, it will return converted requirements and selectable=true.
+	// If this selector doesn't want to select anything, it will return selectable=false.
+	Requirements() (requirements Requirements, selectable bool)
+
+	// Make a deep copy of the selector.
+	DeepCopySelector() Selector
+
+	// RequiresExactMatch allows a caller to introspect whether a given selector
+	// requires a single specific label to be set, and if so returns the value it
+	// requires.
+	RequiresExactMatch(label string) (value string, found bool)
+}
+
+// Sharing this saves 1 alloc per use; this is safe because it's immutable.
+var sharedEverythingSelector Selector = internalSelector{}
+
+// Everything returns a selector that matches all labels.
+func Everything() Selector {
+	return sharedEverythingSelector
+}
+
+type nothingSelector struct{}
+
+func (n nothingSelector) Matches(_ Labels) bool              { return false }
+func (n nothingSelector) Empty() bool                        { return false }
+func (n nothingSelector) String() string                     { return "" }
+func (n nothingSelector) Add(_ ...Requirement) Selector      { return n }
+func (n nothingSelector) Requirements() (Requirements, bool) { return nil, false }
+func (n nothingSelector) DeepCopySelector() Selector         { return n }
+func (n nothingSelector) RequiresExactMatch(label string) (value string, found bool) {
+	return "", false
+}
+
+// Sharing this saves 1 alloc per use; this is safe because it's immutable.
+var sharedNothingSelector Selector = nothingSelector{}
+
+// Nothing returns a selector that matches no labels
+func Nothing() Selector {
+	return sharedNothingSelector
+}
+
+// MatchesNothing only returns true for selectors which are definitively determined to match no objects.
+// This currently only detects the `labels.Nothing()` selector, but may change over time to detect more selectors that match no objects.
+//
+// Note: The current implementation does not check for selector conflict scenarios (e.g., a=a,a!=a).
+// Support for detecting such cases can be added in the future.
+func MatchesNothing(selector Selector) bool {
+	return selector == sharedNothingSelector
+}
+
+// NewSelector returns a nil selector
+func NewSelector() Selector {
+	return internalSelector(nil)
+}
+
+type internalSelector []Requirement
+
+func (s internalSelector) DeepCopy() internalSelector {
+	if s == nil {
+		return nil
+	}
+	result := make([]Requirement, len(s))
+	for i := range s {
+		s[i].DeepCopyInto(&result[i])
+	}
+	return result
+}
+
+func (s internalSelector) DeepCopySelector() Selector {
+	return s.DeepCopy()
+}
+
+// ByKey sorts requirements by key to obtain deterministic parser
+type ByKey []Requirement
+
+func (a ByKey) Len() int { return len(a) }
+
+func (a ByKey) Swap(i, j int) { a[i], a[j] = a[j], a[i] }
+
+func (a ByKey) Less(i, j int) bool { return a[i].key < a[j].key }
+
+// Requirement contains values, a key, and an operator that relates the key and values.
+// The zero value of Requirement is invalid.
+// Requirement implements both set based match and exact match
+// Requirement should be initialized via NewRequirement constructor for creating a valid Requirement.
+// +k8s:deepcopy-gen=true
+type Requirement struct {
+	key      string
+	operator selection.Operator
+	// In huge majority of cases we have at most one value here.
+	// It is generally faster to operate on a single-element slice
+	// than on a single-element map, so we have a slice here.
+	strValues []string
+}
+
+// NewRequirement is the constructor for a Requirement.
+// If any of these rules is violated, an error is returned:
+//  1. The operator can only be In, NotIn, Equals, DoubleEquals, Gt, Lt, NotEquals, Exists, or DoesNotExist.
+//  2. If the operator is In or NotIn, the values set must be non-empty.
+//  3. If the operator is Equals, DoubleEquals, or NotEquals, the values set must contain one value.
+//  4. If the operator is Exists or DoesNotExist, the value set must be empty.
+//  5. If the operator is Gt or Lt, the values set must contain only one value, which will be interpreted as an integer.
+//  6. The key is invalid due to its length, or sequence of characters. See validateLabelKey for more details.
+//
+// The empty string is a valid value in the input values set.
+// Returned error, if not nil, is guaranteed to be an aggregated field.ErrorList
+func NewRequirement(key string, op selection.Operator, vals []string, opts ...field.PathOption) (*Requirement, error) {
+	var allErrs field.ErrorList
+	path := field.ToPath(opts...)
+	if err := validateLabelKey(key, path.Child("key")); err != nil {
+		allErrs = append(allErrs, err)
+	}
+
+	valuePath := path.Child("values")
+	switch op {
+	case selection.In, selection.NotIn:
+		if len(vals) == 0 {
+			allErrs = append(allErrs, field.Invalid(valuePath, vals, "for 'in', 'notin' operators, values set can't be empty"))
+		}
+	case selection.Equals, selection.DoubleEquals, selection.NotEquals:
+		if len(vals) != 1 {
+			allErrs = append(allErrs, field.Invalid(valuePath, vals, "exact-match compatibility requires one single value"))
+		}
+	case selection.Exists, selection.DoesNotExist:
+		if len(vals) != 0 {
+			allErrs = append(allErrs, field.Invalid(valuePath, vals, "values set must be empty for exists and does not exist"))
+		}
+	case selection.GreaterThan, selection.LessThan:
+		if len(vals) != 1 {
+			allErrs = append(allErrs, field.Invalid(valuePath, vals, "for 'Gt', 'Lt' operators, exactly one value is required"))
+		}
+		for i := range vals {
+			if _, err := strconv.ParseInt(vals[i], 10, 64); err != nil {
+				allErrs = append(allErrs, field.Invalid(valuePath.Index(i), vals[i], "for 'Gt', 'Lt' operators, the value must be an integer"))
+			}
+		}
+	default:
+		allErrs = append(allErrs, field.NotSupported(path.Child("operator"), op, validRequirementOperators))
+	}
+
+	for i := range vals {
+		if err := validateLabelValue(key, vals[i], valuePath.Index(i)); err != nil {
+			allErrs = append(allErrs, err)
+		}
+	}
+	return &Requirement{key: key, operator: op, strValues: vals}, allErrs.ToAggregate()
+}
+
+func (r *Requirement) hasValue(value string) bool {
+	for i := range r.strValues {
+		if r.strValues[i] == value {
+			return true
+		}
+	}
+	return false
+}
+
+// Matches returns true if the Requirement matches the input Labels.
+// There is a match in the following cases:
+//  1. The operator is Exists and Labels has the Requirement's key.
+//  2. The operator is In, Labels has the Requirement's key and Labels'
+//     value for that key is in Requirement's value set.
+//  3. The operator is NotIn, Labels has the Requirement's key and
+//     Labels' value for that key is not in Requirement's value set.
+//  4. The operator is DoesNotExist or NotIn and Labels does not have the
+//     Requirement's key.
+//  5. The operator is GreaterThanOperator or LessThanOperator, and Labels has
+//     the Requirement's key and the corresponding value satisfies mathematical inequality.
+func (r *Requirement) Matches(ls Labels) bool {
+	switch r.operator {
+	case selection.In, selection.Equals, selection.DoubleEquals:
+		val, exists := ls.Lookup(r.key)
+		if !exists {
+			return false
+		}
+		return r.hasValue(val)
+	case selection.NotIn, selection.NotEquals:
+		val, exists := ls.Lookup(r.key)
+		if !exists {
+			return true
+		}
+		return !r.hasValue(val)
+	case selection.Exists:
+		return ls.Has(r.key)
+	case selection.DoesNotExist:
+		return !ls.Has(r.key)
+	case selection.GreaterThan, selection.LessThan:
+		val, exists := ls.Lookup(r.key)
+		if !exists {
+			return false
+		}
+		lsValue, err := strconv.ParseInt(val, 10, 64)
+		if err != nil {
+			//nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this.
+			klog.V(10).InfoS("ParseInt failed", "value", val, "label", ls, "err", err)
+			return false
+		}
+
+		// There should be only one strValue in r.strValues, and can be converted to an integer.
+		if len(r.strValues) != 1 {
+			//nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this.
+			klog.V(10).InfoS("Invalid values count: for 'Gt', 'Lt' operators, exactly one value is required", "count", len(r.strValues), "requirement", r)
+			return false
+		}
+
+		var rValue int64
+		for i := range r.strValues {
+			rValue, err = strconv.ParseInt(r.strValues[i], 10, 64)
+			if err != nil {
+				//nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this.
+				klog.V(10).InfoS("ParseInt failed: for 'Gt', 'Lt' operators, the value must be an integer", "value", r.strValues[i], "requirement", r, "err", err)
+				return false
+			}
+		}
+		return (r.operator == selection.GreaterThan && lsValue > rValue) || (r.operator == selection.LessThan && lsValue < rValue)
+	default:
+		return false
+	}
+}
+
+// Key returns requirement key
+func (r *Requirement) Key() string {
+	return r.key
+}
+
+// Operator returns requirement operator
+func (r *Requirement) Operator() selection.Operator {
+	return r.operator
+}
+
+// Values returns requirement values
+func (r *Requirement) Values() sets.String {
+	ret := sets.String{}
+	for i := range r.strValues {
+		ret.Insert(r.strValues[i])
+	}
+	return ret
+}
+
+// ValuesUnsorted returns a copy of requirement values as passed to NewRequirement without sorting.
+func (r *Requirement) ValuesUnsorted() []string {
+	ret := make([]string, 0, len(r.strValues))
+	ret = append(ret, r.strValues...)
+	return ret
+}
+
+// Equal checks the equality of requirement.
+func (r Requirement) Equal(x Requirement) bool {
+	if r.key != x.key {
+		return false
+	}
+	if r.operator != x.operator {
+		return false
+	}
+	return slices.Equal(r.strValues, x.strValues)
+}
+
+// Empty returns true if the internalSelector doesn't restrict selection space
+func (s internalSelector) Empty() bool {
+	if s == nil {
+		return true
+	}
+	return len(s) == 0
+}
+
+// String returns a human-readable string that represents this
+// Requirement. If called on an invalid Requirement, an error is
+// returned. See NewRequirement for creating a valid Requirement.
+func (r *Requirement) String() string {
+	var sb strings.Builder
+	sb.Grow(
+		// length of r.key
+		len(r.key) +
+			// length of 'r.operator' + 2 spaces for the worst case ('in' and 'notin')
+			len(r.operator) + 2 +
+			// length of 'r.strValues' slice times. Heuristically 5 chars per word
+			+5*len(r.strValues))
+	if r.operator == selection.DoesNotExist {
+		sb.WriteString("!")
+	}
+	sb.WriteString(r.key)
+
+	switch r.operator {
+	case selection.Equals:
+		sb.WriteString("=")
+	case selection.DoubleEquals:
+		sb.WriteString("==")
+	case selection.NotEquals:
+		sb.WriteString("!=")
+	case selection.In:
+		sb.WriteString(" in ")
+	case selection.NotIn:
+		sb.WriteString(" notin ")
+	case selection.GreaterThan:
+		sb.WriteString(">")
+	case selection.LessThan:
+		sb.WriteString("<")
+	case selection.Exists, selection.DoesNotExist:
+		return sb.String()
+	}
+
+	switch r.operator {
+	case selection.In, selection.NotIn:
+		sb.WriteString("(")
+	}
+	if len(r.strValues) == 1 {
+		sb.WriteString(r.strValues[0])
+	} else { // only > 1 since == 0 prohibited by NewRequirement
+		// normalizes value order on output, without mutating the in-memory selector representation
+		// also avoids normalization when it is not required, and ensures we do not mutate shared data
+		sb.WriteString(strings.Join(safeSort(r.strValues), ","))
+	}
+
+	switch r.operator {
+	case selection.In, selection.NotIn:
+		sb.WriteString(")")
+	}
+	return sb.String()
+}
+
+// safeSort sorts input strings without modification
+func safeSort(in []string) []string {
+	if sort.StringsAreSorted(in) {
+		return in
+	}
+	out := make([]string, len(in))
+	copy(out, in)
+	sort.Strings(out)
+	return out
+}
+
+// Add adds requirements to the selector. It copies the current selector returning a new one
+func (s internalSelector) Add(reqs ...Requirement) Selector {
+	ret := make(internalSelector, 0, len(s)+len(reqs))
+	ret = append(ret, s...)
+	ret = append(ret, reqs...)
+	sort.Sort(ByKey(ret))
+	return ret
+}
+
+// Matches for a internalSelector returns true if all
+// its Requirements match the input Labels. If any
+// Requirement does not match, false is returned.
+func (s internalSelector) Matches(l Labels) bool {
+	for ix := range s {
+		if matches := s[ix].Matches(l); !matches {
+			return false
+		}
+	}
+	return true
+}
+
+func (s internalSelector) Requirements() (Requirements, bool) { return Requirements(s), true }
+
+// String returns a comma-separated string of all
+// the internalSelector Requirements' human-readable strings.
+func (s internalSelector) String() string {
+	var reqs []string
+	for ix := range s {
+		reqs = append(reqs, s[ix].String())
+	}
+	return strings.Join(reqs, ",")
+}
+
+// RequiresExactMatch introspects whether a given selector requires a single specific field
+// to be set, and if so returns the value it requires.
+func (s internalSelector) RequiresExactMatch(label string) (value string, found bool) {
+	for ix := range s {
+		if s[ix].key == label {
+			switch s[ix].operator {
+			case selection.Equals, selection.DoubleEquals, selection.In:
+				if len(s[ix].strValues) == 1 {
+					return s[ix].strValues[0], true
+				}
+			}
+			return "", false
+		}
+	}
+	return "", false
+}
+
+// Token represents constant definition for lexer token
+type Token int
+
+const (
+	// ErrorToken represents scan error
+	ErrorToken Token = iota
+	// EndOfStringToken represents end of string
+	EndOfStringToken
+	// ClosedParToken represents close parenthesis
+	ClosedParToken
+	// CommaToken represents the comma
+	CommaToken
+	// DoesNotExistToken represents logic not
+	DoesNotExistToken
+	// DoubleEqualsToken represents double equals
+	DoubleEqualsToken
+	// EqualsToken represents equal
+	EqualsToken
+	// GreaterThanToken represents greater than
+	GreaterThanToken
+	// IdentifierToken represents identifier, e.g. keys and values
+	IdentifierToken
+	// InToken represents in
+	InToken
+	// LessThanToken represents less than
+	LessThanToken
+	// NotEqualsToken represents not equal
+	NotEqualsToken
+	// NotInToken represents not in
+	NotInToken
+	// OpenParToken represents open parenthesis
+	OpenParToken
+)
+
+// string2token contains the mapping between lexer Token and token literal
+// (except IdentifierToken, EndOfStringToken and ErrorToken since it makes no sense)
+var string2token = map[string]Token{
+	")":     ClosedParToken,
+	",":     CommaToken,
+	"!":     DoesNotExistToken,
+	"==":    DoubleEqualsToken,
+	"=":     EqualsToken,
+	">":     GreaterThanToken,
+	"in":    InToken,
+	"<":     LessThanToken,
+	"!=":    NotEqualsToken,
+	"notin": NotInToken,
+	"(":     OpenParToken,
+}
+
+// ScannedItem contains the Token and the literal produced by the lexer.
+type ScannedItem struct {
+	tok     Token
+	literal string
+}
+
+// isWhitespace returns true if the rune is a space, tab, or newline.
+func isWhitespace(ch byte) bool {
+	return ch == ' ' || ch == '\t' || ch == '\r' || ch == '\n'
+}
+
+// isSpecialSymbol detects if the character ch can be an operator
+func isSpecialSymbol(ch byte) bool {
+	switch ch {
+	case '=', '!', '(', ')', ',', '>', '<':
+		return true
+	}
+	return false
+}
+
+// Lexer represents the Lexer struct for label selector.
+// It contains necessary informationt to tokenize the input string
+type Lexer struct {
+	// s stores the string to be tokenized
+	s string
+	// pos is the position currently tokenized
+	pos int
+}
+
+// read returns the character currently lexed
+// increment the position and check the buffer overflow
+func (l *Lexer) read() (b byte) {
+	b = 0
+	if l.pos < len(l.s) {
+		b = l.s[l.pos]
+		l.pos++
+	}
+	return b
+}
+
+// unread 'undoes' the last read character
+func (l *Lexer) unread() {
+	l.pos--
+}
+
+// scanIDOrKeyword scans string to recognize literal token (for example 'in') or an identifier.
+func (l *Lexer) scanIDOrKeyword() (tok Token, lit string) {
+	var buffer []byte
+IdentifierLoop:
+	for {
+		switch ch := l.read(); {
+		case ch == 0:
+			break IdentifierLoop
+		case isSpecialSymbol(ch) || isWhitespace(ch):
+			l.unread()
+			break IdentifierLoop
+		default:
+			buffer = append(buffer, ch)
+		}
+	}
+	s := string(buffer)
+	if val, ok := string2token[s]; ok { // is a literal token?
+		return val, s
+	}
+	return IdentifierToken, s // otherwise is an identifier
+}
+
+// scanSpecialSymbol scans string starting with special symbol.
+// special symbol identify non literal operators. "!=", "==", "="
+func (l *Lexer) scanSpecialSymbol() (Token, string) {
+	lastScannedItem := ScannedItem{}
+	var buffer []byte
+SpecialSymbolLoop:
+	for {
+		switch ch := l.read(); {
+		case ch == 0:
+			break SpecialSymbolLoop
+		case isSpecialSymbol(ch):
+			buffer = append(buffer, ch)
+			if token, ok := string2token[string(buffer)]; ok {
+				lastScannedItem = ScannedItem{tok: token, literal: string(buffer)}
+			} else if lastScannedItem.tok != 0 {
+				l.unread()
+				break SpecialSymbolLoop
+			}
+		default:
+			l.unread()
+			break SpecialSymbolLoop
+		}
+	}
+	if lastScannedItem.tok == 0 {
+		return ErrorToken, fmt.Sprintf("error expected: keyword found '%s'", buffer)
+	}
+	return lastScannedItem.tok, lastScannedItem.literal
+}
+
+// skipWhiteSpaces consumes all blank characters
+// returning the first non blank character
+func (l *Lexer) skipWhiteSpaces(ch byte) byte {
+	for {
+		if !isWhitespace(ch) {
+			return ch
+		}
+		ch = l.read()
+	}
+}
+
+// Lex returns a pair of Token and the literal
+// literal is meaningfull only for IdentifierToken token
+func (l *Lexer) Lex() (tok Token, lit string) {
+	switch ch := l.skipWhiteSpaces(l.read()); {
+	case ch == 0:
+		return EndOfStringToken, ""
+	case isSpecialSymbol(ch):
+		l.unread()
+		return l.scanSpecialSymbol()
+	default:
+		l.unread()
+		return l.scanIDOrKeyword()
+	}
+}
+
+// Parser data structure contains the label selector parser data structure
+type Parser struct {
+	l            *Lexer
+	scannedItems []ScannedItem
+	position     int
+	path         *field.Path
+}
+
+// ParserContext represents context during parsing:
+// some literal for example 'in' and 'notin' can be
+// recognized as operator for example 'x in (a)' but
+// it can be recognized as value for example 'value in (in)'
+type ParserContext int
+
+const (
+	// KeyAndOperator represents key and operator
+	KeyAndOperator ParserContext = iota
+	// Values represents values
+	Values
+)
+
+// lookahead func returns the current token and string. No increment of current position
+func (p *Parser) lookahead(context ParserContext) (Token, string) {
+	tok, lit := p.scannedItems[p.position].tok, p.scannedItems[p.position].literal
+	if context == Values {
+		switch tok {
+		case InToken, NotInToken:
+			tok = IdentifierToken
+		}
+	}
+	return tok, lit
+}
+
+// consume returns current token and string. Increments the position
+func (p *Parser) consume(context ParserContext) (Token, string) {
+	p.position++
+	tok, lit := p.scannedItems[p.position-1].tok, p.scannedItems[p.position-1].literal
+	if context == Values {
+		switch tok {
+		case InToken, NotInToken:
+			tok = IdentifierToken
+		}
+	}
+	return tok, lit
+}
+
+// scan runs through the input string and stores the ScannedItem in an array
+// Parser can now lookahead and consume the tokens
+func (p *Parser) scan() {
+	for {
+		token, literal := p.l.Lex()
+		p.scannedItems = append(p.scannedItems, ScannedItem{token, literal})
+		if token == EndOfStringToken {
+			break
+		}
+	}
+}
+
+// parse runs the left recursive descending algorithm
+// on input string. It returns a list of Requirement objects.
+func (p *Parser) parse() (internalSelector, error) {
+	p.scan() // init scannedItems
+
+	var requirements internalSelector
+	for {
+		tok, lit := p.lookahead(Values)
+		switch tok {
+		case IdentifierToken, DoesNotExistToken:
+			r, err := p.parseRequirement()
+			if err != nil {
+				return nil, fmt.Errorf("unable to parse requirement: %v", err)
+			}
+			requirements = append(requirements, *r)
+			t, l := p.consume(Values)
+			switch t {
+			case EndOfStringToken:
+				return requirements, nil
+			case CommaToken:
+				t2, l2 := p.lookahead(Values)
+				if t2 != IdentifierToken && t2 != DoesNotExistToken {
+					return nil, fmt.Errorf("found '%s', expected: identifier after ','", l2)
+				}
+			default:
+				return nil, fmt.Errorf("found '%s', expected: ',' or 'end of string'", l)
+			}
+		case EndOfStringToken:
+			return requirements, nil
+		default:
+			return nil, fmt.Errorf("found '%s', expected: !, identifier, or 'end of string'", lit)
+		}
+	}
+}
+
+func (p *Parser) parseRequirement() (*Requirement, error) {
+	key, operator, err := p.parseKeyAndInferOperator()
+	if err != nil {
+		return nil, err
+	}
+	if operator == selection.Exists || operator == selection.DoesNotExist { // operator found lookahead set checked
+		return NewRequirement(key, operator, []string{}, field.WithPath(p.path))
+	}
+	operator, err = p.parseOperator()
+	if err != nil {
+		return nil, err
+	}
+	var values sets.String
+	switch operator {
+	case selection.In, selection.NotIn:
+		values, err = p.parseValues()
+	case selection.Equals, selection.DoubleEquals, selection.NotEquals, selection.GreaterThan, selection.LessThan:
+		values, err = p.parseExactValue()
+	}
+	if err != nil {
+		return nil, err
+	}
+	return NewRequirement(key, operator, values.List(), field.WithPath(p.path))
+
+}
+
+// parseKeyAndInferOperator parses literals.
+// in case of no operator '!, in, notin, ==, =, !=' are found
+// the 'exists' operator is inferred
+func (p *Parser) parseKeyAndInferOperator() (string, selection.Operator, error) {
+	var operator selection.Operator
+	tok, literal := p.consume(Values)
+	if tok == DoesNotExistToken {
+		operator = selection.DoesNotExist
+		tok, literal = p.consume(Values)
+	}
+	if tok != IdentifierToken {
+		err := fmt.Errorf("found '%s', expected: identifier", literal)
+		return "", "", err
+	}
+	if err := validateLabelKey(literal, p.path); err != nil {
+		return "", "", err
+	}
+	if t, _ := p.lookahead(Values); t == EndOfStringToken || t == CommaToken {
+		if operator != selection.DoesNotExist {
+			operator = selection.Exists
+		}
+	}
+	return literal, operator, nil
+}
+
+// parseOperator returns operator and eventually matchType
+// matchType can be exact
+func (p *Parser) parseOperator() (op selection.Operator, err error) {
+	tok, lit := p.consume(KeyAndOperator)
+	switch tok {
+	// DoesNotExistToken shouldn't be here because it's a unary operator, not a binary operator
+	case InToken:
+		op = selection.In
+	case EqualsToken:
+		op = selection.Equals
+	case DoubleEqualsToken:
+		op = selection.DoubleEquals
+	case GreaterThanToken:
+		op = selection.GreaterThan
+	case LessThanToken:
+		op = selection.LessThan
+	case NotInToken:
+		op = selection.NotIn
+	case NotEqualsToken:
+		op = selection.NotEquals
+	default:
+		return "", fmt.Errorf("found '%s', expected: %v", lit, strings.Join(binaryOperators, ", "))
+	}
+	return op, nil
+}
+
+// parseValues parses the values for set based matching (x,y,z)
+func (p *Parser) parseValues() (sets.String, error) {
+	tok, lit := p.consume(Values)
+	if tok != OpenParToken {
+		return nil, fmt.Errorf("found '%s' expected: '('", lit)
+	}
+	tok, lit = p.lookahead(Values)
+	switch tok {
+	case IdentifierToken, CommaToken:
+		s, err := p.parseIdentifiersList() // handles general cases
+		if err != nil {
+			return s, err
+		}
+		if tok, _ = p.consume(Values); tok != ClosedParToken {
+			return nil, fmt.Errorf("found '%s', expected: ')'", lit)
+		}
+		return s, nil
+	case ClosedParToken: // handles "()"
+		p.consume(Values)
+		return sets.NewString(""), nil
+	default:
+		return nil, fmt.Errorf("found '%s', expected: ',', ')' or identifier", lit)
+	}
+}
+
+// parseIdentifiersList parses a (possibly empty) list of
+// of comma separated (possibly empty) identifiers
+func (p *Parser) parseIdentifiersList() (sets.String, error) {
+	s := sets.NewString()
+	for {
+		tok, lit := p.consume(Values)
+		switch tok {
+		case IdentifierToken:
+			s.Insert(lit)
+			tok2, lit2 := p.lookahead(Values)
+			switch tok2 {
+			case CommaToken:
+				continue
+			case ClosedParToken:
+				return s, nil
+			default:
+				return nil, fmt.Errorf("found '%s', expected: ',' or ')'", lit2)
+			}
+		case CommaToken: // handled here since we can have "(,"
+			if s.Len() == 0 {
+				s.Insert("") // to handle (,
+			}
+			tok2, _ := p.lookahead(Values)
+			if tok2 == ClosedParToken {
+				s.Insert("") // to handle ,)  Double "" removed by StringSet
+				return s, nil
+			}
+			if tok2 == CommaToken {
+				s.Insert("") // to handle ,, Double "" removed by StringSet
+			}
+		default: // it can be operator
+			return s, fmt.Errorf("found '%s', expected: ',', or identifier", lit)
+		}
+	}
+}
+
+// parseExactValue parses the only value for exact match style
+func (p *Parser) parseExactValue() (sets.String, error) {
+	s := sets.NewString()
+	tok, _ := p.lookahead(Values)
+	if tok == EndOfStringToken || tok == CommaToken {
+		s.Insert("")
+		return s, nil
+	}
+	tok, lit := p.consume(Values)
+	if tok == IdentifierToken {
+		s.Insert(lit)
+		return s, nil
+	}
+	return nil, fmt.Errorf("found '%s', expected: identifier", lit)
+}
+
+// Parse takes a string representing a selector and returns a selector
+// object, or an error. This parsing function differs from ParseSelector
+// as they parse different selectors with different syntaxes.
+// The input will cause an error if it does not follow this form:
+//
+//	<selector-syntax>         ::= <requirement> | <requirement> "," <selector-syntax>
+//	<requirement>             ::= [!] KEY [ <set-based-restriction> | <exact-match-restriction> ]
+//	<set-based-restriction>   ::= "" | <inclusion-exclusion> <value-set>
+//	<inclusion-exclusion>     ::= <inclusion> | <exclusion>
+//	<exclusion>               ::= "notin"
+//	<inclusion>               ::= "in"
+//	<value-set>               ::= "(" <values> ")"
+//	<values>                  ::= VALUE | VALUE "," <values>
+//	<exact-match-restriction> ::= ["="|"=="|"!="] VALUE
+//
+// KEY is a sequence of one or more characters following [ DNS_SUBDOMAIN "/" ] DNS_LABEL. Max length is 63 characters.
+// VALUE is a sequence of zero or more characters "([A-Za-z0-9_-\.])". Max length is 63 characters.
+// Delimiter is white space: (' ', '\t')
+// Example of valid syntax:
+//
+//	"x in (foo,,baz),y,z notin ()"
+//
+// Note:
+//  1. Inclusion - " in " - denotes that the KEY exists and is equal to any of the
+//     VALUEs in its requirement
+//  2. Exclusion - " notin " - denotes that the KEY is not equal to any
+//     of the VALUEs in its requirement or does not exist
+//  3. The empty string is a valid VALUE
+//  4. A requirement with just a KEY - as in "y" above - denotes that
+//     the KEY exists and can be any VALUE.
+//  5. A requirement with just !KEY requires that the KEY not exist.
+func Parse(selector string, opts ...field.PathOption) (Selector, error) {
+	parsedSelector, err := parse(selector, field.ToPath(opts...))
+	if err == nil {
+		return parsedSelector, nil
+	}
+	return nil, err
+}
+
+// parse parses the string representation of the selector and returns the internalSelector struct.
+// The callers of this method can then decide how to return the internalSelector struct to their
+// callers. This function has two callers now, one returns a Selector interface and the other
+// returns a list of requirements.
+func parse(selector string, path *field.Path) (internalSelector, error) {
+	p := &Parser{l: &Lexer{s: selector, pos: 0}, path: path}
+	items, err := p.parse()
+	if err != nil {
+		return nil, err
+	}
+	sort.Sort(ByKey(items)) // sort to grant determistic parsing
+	return internalSelector(items), err
+}
+
+func validateLabelKey(k string, path *field.Path) *field.Error {
+	if errs := content.IsLabelKey(k); len(errs) != 0 {
+		return field.Invalid(path, k, strings.Join(errs, "; "))
+	}
+	return nil
+}
+
+func validateLabelValue(k, v string, path *field.Path) *field.Error {
+	if errs := validation.IsValidLabelValue(v); len(errs) != 0 {
+		return field.Invalid(path.Key(k), v, strings.Join(errs, "; "))
+	}
+	return nil
+}
+
+// SelectorFromSet returns a Selector which will match exactly the given Set. A
+// nil and empty Sets are considered equivalent to Everything().
+// It does not perform any validation, which means the server will reject
+// the request if the Set contains invalid values.
+func SelectorFromSet(ls Set) Selector {
+	return SelectorFromValidatedSet(ls)
+}
+
+// ValidatedSelectorFromSet returns a Selector which will match exactly the given Set. A
+// nil and empty Sets are considered equivalent to Everything().
+// The Set is validated client-side, which allows to catch errors early.
+func ValidatedSelectorFromSet(ls Set) (Selector, error) {
+	if ls == nil || len(ls) == 0 {
+		return internalSelector{}, nil
+	}
+	requirements := make([]Requirement, 0, len(ls))
+	for label, value := range ls {
+		r, err := NewRequirement(label, selection.Equals, []string{value})
+		if err != nil {
+			return nil, err
+		}
+		requirements = append(requirements, *r)
+	}
+	// sort to have deterministic string representation
+	sort.Sort(ByKey(requirements))
+	return internalSelector(requirements), nil
+}
+
+// SelectorFromValidatedSet returns a Selector which will match exactly the given Set.
+// A nil and empty Sets are considered equivalent to Everything().
+// It assumes that Set is already validated and doesn't do any validation.
+// Note: this method copies the Set; if the Set is immutable, consider wrapping it with ValidatedSetSelector
+// instead, which does not copy.
+func SelectorFromValidatedSet(ls Set) Selector {
+	if ls == nil || len(ls) == 0 {
+		return internalSelector{}
+	}
+	requirements := make([]Requirement, 0, len(ls))
+	for label, value := range ls {
+		requirements = append(requirements, Requirement{key: label, operator: selection.Equals, strValues: []string{value}})
+	}
+	// sort to have deterministic string representation
+	sort.Sort(ByKey(requirements))
+	return internalSelector(requirements)
+}
+
+// ParseToRequirements takes a string representing a selector and returns a list of
+// requirements. This function is suitable for those callers that perform additional
+// processing on selector requirements.
+// See the documentation for Parse() function for more details.
+// TODO: Consider exporting the internalSelector type instead.
+func ParseToRequirements(selector string, opts ...field.PathOption) ([]Requirement, error) {
+	return parse(selector, field.ToPath(opts...))
+}
+
+// ValidatedSetSelector wraps a Set, allowing it to implement the Selector interface. Unlike
+// Set.AsSelectorPreValidated (which copies the input Set), this type simply wraps the underlying
+// Set. As a result, it is substantially more efficient. A nil and empty Sets are considered
+// equivalent to Everything().
+//
+// Callers MUST ensure the underlying Set is not mutated, and that it is already validated. If these
+// constraints are not met, Set.AsValidatedSelector should be preferred
+//
+// None of the Selector methods mutate the underlying Set, but Add() and Requirements() convert to
+// the less optimized version.
+type ValidatedSetSelector Set
+
+func (s ValidatedSetSelector) Matches(labels Labels) bool {
+	for k, v := range s {
+		val, exists := labels.Lookup(k)
+		if !exists || v != val {
+			return false
+		}
+	}
+	return true
+}
+
+func (s ValidatedSetSelector) Empty() bool {
+	return len(s) == 0
+}
+
+func (s ValidatedSetSelector) String() string {
+	keys := make([]string, 0, len(s))
+	for k := range s {
+		keys = append(keys, k)
+	}
+	// Ensure deterministic output
+	sort.Strings(keys)
+	b := strings.Builder{}
+	for i, key := range keys {
+		v := s[key]
+		b.Grow(len(key) + 2 + len(v))
+		if i != 0 {
+			b.WriteString(",")
+		}
+		b.WriteString(key)
+		b.WriteString("=")
+		b.WriteString(v)
+	}
+	return b.String()
+}
+
+func (s ValidatedSetSelector) Add(r ...Requirement) Selector {
+	return s.toFullSelector().Add(r...)
+}
+
+func (s ValidatedSetSelector) Requirements() (requirements Requirements, selectable bool) {
+	return s.toFullSelector().Requirements()
+}
+
+func (s ValidatedSetSelector) DeepCopySelector() Selector {
+	res := make(ValidatedSetSelector, len(s))
+	for k, v := range s {
+		res[k] = v
+	}
+	return res
+}
+
+func (s ValidatedSetSelector) RequiresExactMatch(label string) (value string, found bool) {
+	v, f := s[label]
+	return v, f
+}
+
+func (s ValidatedSetSelector) toFullSelector() Selector {
+	return SelectorFromValidatedSet(Set(s))
+}
+
+var _ Selector = ValidatedSetSelector{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/selector_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/selector_test.go
new file mode 100644
index 0000000000..abe066154d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/selector_test.go
@@ -0,0 +1,1227 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package labels
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"k8s.io/apimachinery/pkg/selection"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+var (
+	ignoreDetail = cmpopts.IgnoreFields(field.Error{}, "Detail")
+)
+
+func TestSelectorParse(t *testing.T) {
+	testGoodStrings := []string{
+		"x=a,y=b,z=c",
+		"",
+		"x!=a,y=b",
+		"x=",
+		"x= ",
+		"x=,z= ",
+		"x= ,z= ",
+		"!x",
+		"x>1",
+		"x>1,z<5",
+	}
+	testBadStrings := []string{
+		"x=a||y=b",
+		"x==a==b",
+		"!x=a",
+		"x<a",
+	}
+	for _, test := range testGoodStrings {
+		lq, err := Parse(test)
+		if err != nil {
+			t.Errorf("%v: error %v (%#v)\n", test, err, err)
+		}
+		if strings.Replace(test, " ", "", -1) != lq.String() {
+			t.Errorf("%v restring gave: %v\n", test, lq.String())
+		}
+	}
+	for _, test := range testBadStrings {
+		_, err := Parse(test)
+		if err == nil {
+			t.Errorf("%v: did not get expected error\n", test)
+		}
+	}
+}
+
+func TestDeterministicParse(t *testing.T) {
+	s1, err := Parse("x=a,a=x")
+	s2, err2 := Parse("a=x,x=a")
+	if err != nil || err2 != nil {
+		t.Errorf("Unexpected parse error")
+	}
+	if s1.String() != s2.String() {
+		t.Errorf("Non-deterministic parse")
+	}
+}
+
+func expectMatch(t *testing.T, selector string, ls Set) {
+	lq, err := Parse(selector)
+	if err != nil {
+		t.Errorf("Unable to parse %v as a selector\n", selector)
+		return
+	}
+	if !lq.Matches(ls) {
+		t.Errorf("Wanted %s to match '%s', but it did not.\n", selector, ls)
+	}
+}
+
+func expectNoMatch(t *testing.T, selector string, ls Set) {
+	lq, err := Parse(selector)
+	if err != nil {
+		t.Errorf("Unable to parse %v as a selector\n", selector)
+		return
+	}
+	if lq.Matches(ls) {
+		t.Errorf("Wanted '%s' to not match '%s', but it did.", selector, ls)
+	}
+}
+
+func TestEverything(t *testing.T) {
+	if !Everything().Matches(Set{"x": "y"}) {
+		t.Errorf("Nil selector didn't match")
+	}
+	if !Everything().Empty() {
+		t.Errorf("Everything was not empty")
+	}
+}
+
+func TestSelectorMatches(t *testing.T) {
+	expectMatch(t, "", Set{"x": "y"})
+	expectMatch(t, "x=y", Set{"x": "y"})
+	expectMatch(t, "x=y,z=w", Set{"x": "y", "z": "w"})
+	expectMatch(t, "x!=y,z!=w", Set{"x": "z", "z": "a"})
+	expectMatch(t, "notin=in", Set{"notin": "in"}) // in and notin in exactMatch
+	expectMatch(t, "x", Set{"x": "z"})
+	expectMatch(t, "!x", Set{"y": "z"})
+	expectMatch(t, "x>1", Set{"x": "2"})
+	expectMatch(t, "x<1", Set{"x": "0"})
+	expectNoMatch(t, "x=z", Set{})
+	expectNoMatch(t, "x=y", Set{"x": "z"})
+	expectNoMatch(t, "x=y,z=w", Set{"x": "w", "z": "w"})
+	expectNoMatch(t, "x!=y,z!=w", Set{"x": "z", "z": "w"})
+	expectNoMatch(t, "x", Set{"y": "z"})
+	expectNoMatch(t, "!x", Set{"x": "z"})
+	expectNoMatch(t, "x>1", Set{"x": "0"})
+	expectNoMatch(t, "x<1", Set{"x": "2"})
+
+	labelset := Set{
+		"foo": "bar",
+		"baz": "blah",
+	}
+	expectMatch(t, "foo=bar", labelset)
+	expectMatch(t, "baz=blah", labelset)
+	expectMatch(t, "foo=bar,baz=blah", labelset)
+	expectNoMatch(t, "foo=blah", labelset)
+	expectNoMatch(t, "baz=bar", labelset)
+	expectNoMatch(t, "foo=bar,foobar=bar,baz=blah", labelset)
+}
+
+func expectMatchDirect(t *testing.T, selector, ls Set) {
+	if !SelectorFromSet(selector).Matches(ls) {
+		t.Errorf("Wanted %s to match '%s', but it did not.\n", selector, ls)
+	}
+}
+
+//nolint:staticcheck,unused //iccheck // U1000 currently commented out in TODO of TestSetMatches
+func expectNoMatchDirect(t *testing.T, selector, ls Set) {
+	if SelectorFromSet(selector).Matches(ls) {
+		t.Errorf("Wanted '%s' to not match '%s', but it did.", selector, ls)
+	}
+}
+
+func TestSetMatches(t *testing.T) {
+	labelset := Set{
+		"foo": "bar",
+		"baz": "blah",
+	}
+	expectMatchDirect(t, Set{}, labelset)
+	expectMatchDirect(t, Set{"foo": "bar"}, labelset)
+	expectMatchDirect(t, Set{"baz": "blah"}, labelset)
+	expectMatchDirect(t, Set{"foo": "bar", "baz": "blah"}, labelset)
+
+	//TODO: bad values not handled for the moment in SelectorFromSet
+	//expectNoMatchDirect(t, Set{"foo": "=blah"}, labelset)
+	//expectNoMatchDirect(t, Set{"baz": "=bar"}, labelset)
+	//expectNoMatchDirect(t, Set{"foo": "=bar", "foobar": "bar", "baz": "blah"}, labelset)
+}
+
+func TestNilMapIsValid(t *testing.T) {
+	selector := Set(nil).AsSelector()
+	if selector == nil {
+		t.Errorf("Selector for nil set should be Everything")
+	}
+	if !selector.Empty() {
+		t.Errorf("Selector for nil set should be Empty")
+	}
+}
+
+func TestSetIsEmpty(t *testing.T) {
+	if !(Set{}).AsSelector().Empty() {
+		t.Errorf("Empty set should be empty")
+	}
+	if !(NewSelector()).Empty() {
+		t.Errorf("Nil Selector should be empty")
+	}
+}
+
+func TestLexer(t *testing.T) {
+	testcases := []struct {
+		s string
+		t Token
+	}{
+		{"", EndOfStringToken},
+		{",", CommaToken},
+		{"notin", NotInToken},
+		{"in", InToken},
+		{"=", EqualsToken},
+		{"==", DoubleEqualsToken},
+		{">", GreaterThanToken},
+		{"<", LessThanToken},
+		//Note that Lex returns the longest valid token found
+		{"!", DoesNotExistToken},
+		{"!=", NotEqualsToken},
+		{"(", OpenParToken},
+		{")", ClosedParToken},
+		//Non-"special" characters are considered part of an identifier
+		{"~", IdentifierToken},
+		{"||", IdentifierToken},
+	}
+	for _, v := range testcases {
+		l := &Lexer{s: v.s, pos: 0}
+		token, lit := l.Lex()
+		if token != v.t {
+			t.Errorf("Got %d it should be %d for '%s'", token, v.t, v.s)
+		}
+		if v.t != ErrorToken && lit != v.s {
+			t.Errorf("Got '%s' it should be '%s'", lit, v.s)
+		}
+	}
+}
+
+func TestLexerSequence(t *testing.T) {
+	testcases := []struct {
+		s string
+		t []Token
+	}{
+		{"key in ( value )", []Token{IdentifierToken, InToken, OpenParToken, IdentifierToken, ClosedParToken}},
+		{"key notin ( value )", []Token{IdentifierToken, NotInToken, OpenParToken, IdentifierToken, ClosedParToken}},
+		{"key in ( value1, value2 )", []Token{IdentifierToken, InToken, OpenParToken, IdentifierToken, CommaToken, IdentifierToken, ClosedParToken}},
+		{"key", []Token{IdentifierToken}},
+		{"!key", []Token{DoesNotExistToken, IdentifierToken}},
+		{"()", []Token{OpenParToken, ClosedParToken}},
+		{"x in (),y", []Token{IdentifierToken, InToken, OpenParToken, ClosedParToken, CommaToken, IdentifierToken}},
+		{"== != (), = notin", []Token{DoubleEqualsToken, NotEqualsToken, OpenParToken, ClosedParToken, CommaToken, EqualsToken, NotInToken}},
+		{"key>2", []Token{IdentifierToken, GreaterThanToken, IdentifierToken}},
+		{"key<1", []Token{IdentifierToken, LessThanToken, IdentifierToken}},
+	}
+	for _, v := range testcases {
+		var tokens []Token
+		l := &Lexer{s: v.s, pos: 0}
+		for {
+			token, _ := l.Lex()
+			if token == EndOfStringToken {
+				break
+			}
+			tokens = append(tokens, token)
+		}
+		if len(tokens) != len(v.t) {
+			t.Errorf("Bad number of tokens for '%s %d, %d", v.s, len(tokens), len(v.t))
+		}
+		for i := 0; i < min(len(tokens), len(v.t)); i++ {
+			if tokens[i] != v.t[i] {
+				t.Errorf("Test '%s': Mismatching in token type found '%v' it should be '%v'", v.s, tokens[i], v.t[i])
+			}
+		}
+	}
+}
+func TestParserLookahead(t *testing.T) {
+	testcases := []struct {
+		s string
+		t []Token
+	}{
+		{"key in ( value )", []Token{IdentifierToken, InToken, OpenParToken, IdentifierToken, ClosedParToken, EndOfStringToken}},
+		{"key notin ( value )", []Token{IdentifierToken, NotInToken, OpenParToken, IdentifierToken, ClosedParToken, EndOfStringToken}},
+		{"key in ( value1, value2 )", []Token{IdentifierToken, InToken, OpenParToken, IdentifierToken, CommaToken, IdentifierToken, ClosedParToken, EndOfStringToken}},
+		{"key", []Token{IdentifierToken, EndOfStringToken}},
+		{"!key", []Token{DoesNotExistToken, IdentifierToken, EndOfStringToken}},
+		{"()", []Token{OpenParToken, ClosedParToken, EndOfStringToken}},
+		{"", []Token{EndOfStringToken}},
+		{"x in (),y", []Token{IdentifierToken, InToken, OpenParToken, ClosedParToken, CommaToken, IdentifierToken, EndOfStringToken}},
+		{"== != (), = notin", []Token{DoubleEqualsToken, NotEqualsToken, OpenParToken, ClosedParToken, CommaToken, EqualsToken, NotInToken, EndOfStringToken}},
+		{"key>2", []Token{IdentifierToken, GreaterThanToken, IdentifierToken, EndOfStringToken}},
+		{"key<1", []Token{IdentifierToken, LessThanToken, IdentifierToken, EndOfStringToken}},
+	}
+	for _, v := range testcases {
+		p := &Parser{l: &Lexer{s: v.s, pos: 0}, position: 0}
+		p.scan()
+		if len(p.scannedItems) != len(v.t) {
+			t.Errorf("Expected %d items found %d", len(v.t), len(p.scannedItems))
+		}
+		for {
+			token, lit := p.lookahead(KeyAndOperator)
+
+			token2, lit2 := p.consume(KeyAndOperator)
+			if token == EndOfStringToken {
+				break
+			}
+			if token != token2 || lit != lit2 {
+				t.Errorf("Bad values")
+			}
+		}
+	}
+}
+
+func TestParseOperator(t *testing.T) {
+	testcases := []struct {
+		token         string
+		expectedError error
+	}{
+		{"in", nil},
+		{"=", nil},
+		{"==", nil},
+		{">", nil},
+		{"<", nil},
+		{"notin", nil},
+		{"!=", nil},
+		{"!", fmt.Errorf("found '%s', expected: %v", selection.DoesNotExist, strings.Join(binaryOperators, ", "))},
+		{"exists", fmt.Errorf("found '%s', expected: %v", selection.Exists, strings.Join(binaryOperators, ", "))},
+		{"(", fmt.Errorf("found '%s', expected: %v", "(", strings.Join(binaryOperators, ", "))},
+	}
+	for _, testcase := range testcases {
+		p := &Parser{l: &Lexer{s: testcase.token, pos: 0}, position: 0}
+		p.scan()
+
+		_, err := p.parseOperator()
+		if ok := reflect.DeepEqual(testcase.expectedError, err); !ok {
+			t.Errorf("\nexpect err [%v], \nactual err [%v]", testcase.expectedError, err)
+		}
+	}
+}
+
+func TestRequirementConstructor(t *testing.T) {
+	requirementConstructorTests := []struct {
+		Key     string
+		Op      selection.Operator
+		Vals    sets.String
+		WantErr field.ErrorList
+	}{
+		{
+			Key: "x1",
+			Op:  selection.In,
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values",
+					BadValue: []string{},
+				},
+			},
+		},
+		{
+			Key:  "x2",
+			Op:   selection.NotIn,
+			Vals: sets.NewString(),
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values",
+					BadValue: []string{},
+				},
+			},
+		},
+		{
+			Key:  "x3",
+			Op:   selection.In,
+			Vals: sets.NewString("foo"),
+		},
+		{
+			Key:  "x4",
+			Op:   selection.NotIn,
+			Vals: sets.NewString("foo"),
+		},
+		{
+			Key:  "x5",
+			Op:   selection.Equals,
+			Vals: sets.NewString("foo", "bar"),
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values",
+					BadValue: []string{"bar", "foo"},
+				},
+			},
+		},
+		{
+			Key: "x6",
+			Op:  selection.Exists,
+		},
+		{
+			Key: "x7",
+			Op:  selection.DoesNotExist,
+		},
+		{
+			Key:  "x8",
+			Op:   selection.Exists,
+			Vals: sets.NewString("foo"),
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values",
+					BadValue: []string{"foo"},
+				},
+			},
+		},
+		{
+			Key:  "x9",
+			Op:   selection.In,
+			Vals: sets.NewString("bar"),
+		},
+		{
+			Key:  "x10",
+			Op:   selection.In,
+			Vals: sets.NewString("bar"),
+		},
+		{
+			Key:  "x11",
+			Op:   selection.GreaterThan,
+			Vals: sets.NewString("1"),
+		},
+		{
+			Key:  "x12",
+			Op:   selection.LessThan,
+			Vals: sets.NewString("6"),
+		},
+		{
+			Key: "x13",
+			Op:  selection.GreaterThan,
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values",
+					BadValue: []string{},
+				},
+			},
+		},
+		{
+			Key:  "x14",
+			Op:   selection.GreaterThan,
+			Vals: sets.NewString("bar"),
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values[0]",
+					BadValue: "bar",
+				},
+			},
+		},
+		{
+			Key:  "x15",
+			Op:   selection.LessThan,
+			Vals: sets.NewString("bar"),
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values[0]",
+					BadValue: "bar",
+				},
+			},
+		},
+		{
+			Key: strings.Repeat("a", 254), //breaks DNS rule that len(key) <= 253
+			Op:  selection.Exists,
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "key",
+					BadValue: strings.Repeat("a", 254),
+				},
+			},
+		},
+		{
+			Key:  "x16",
+			Op:   selection.Equals,
+			Vals: sets.NewString(strings.Repeat("a", 254)),
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values[0][x16]",
+					BadValue: strings.Repeat("a", 254),
+				},
+			},
+		},
+		{
+			Key:  "x17",
+			Op:   selection.Equals,
+			Vals: sets.NewString("a b"),
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values[0][x17]",
+					BadValue: "a b",
+				},
+			},
+		},
+		{
+			Key: "x18",
+			Op:  "unsupportedOp",
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeNotSupported,
+					Field:    "operator",
+					BadValue: selection.Operator("unsupportedOp"),
+				},
+			},
+		},
+	}
+	for _, rc := range requirementConstructorTests {
+		_, err := NewRequirement(rc.Key, rc.Op, rc.Vals.List())
+		if diff := cmp.Diff(rc.WantErr.ToAggregate(), err, ignoreDetail); diff != "" {
+			t.Errorf("NewRequirement test %v returned unexpected error (-want,+got):\n%s", rc.Key, diff)
+		}
+	}
+}
+
+func TestToString(t *testing.T) {
+	var req Requirement
+	toStringTests := []struct {
+		In    *internalSelector
+		Out   string
+		Valid bool
+	}{
+
+		{&internalSelector{
+			getRequirement("x", selection.In, sets.NewString("abc", "def"), t),
+			getRequirement("y", selection.NotIn, sets.NewString("jkl"), t),
+			getRequirement("z", selection.Exists, nil, t)},
+			"x in (abc,def),y notin (jkl),z", true},
+		{&internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString("abc", "def"), t),
+			getRequirement("y", selection.NotEquals, sets.NewString("jkl"), t),
+			getRequirement("z", selection.DoesNotExist, nil, t)},
+			"x notin (abc,def),y!=jkl,!z", true},
+		{&internalSelector{
+			getRequirement("x", selection.In, sets.NewString("abc", "def"), t),
+			req}, // adding empty req for the trailing ','
+			"x in (abc,def),", false},
+		{&internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString("abc"), t),
+			getRequirement("y", selection.In, sets.NewString("jkl", "mno"), t),
+			getRequirement("z", selection.NotIn, sets.NewString(""), t)},
+			"x notin (abc),y in (jkl,mno),z notin ()", true},
+		{&internalSelector{
+			getRequirement("x", selection.Equals, sets.NewString("abc"), t),
+			getRequirement("y", selection.DoubleEquals, sets.NewString("jkl"), t),
+			getRequirement("z", selection.NotEquals, sets.NewString("a"), t),
+			getRequirement("z", selection.Exists, nil, t)},
+			"x=abc,y==jkl,z!=a,z", true},
+		{&internalSelector{
+			getRequirement("x", selection.GreaterThan, sets.NewString("2"), t),
+			getRequirement("y", selection.LessThan, sets.NewString("8"), t),
+			getRequirement("z", selection.Exists, nil, t)},
+			"x>2,y<8,z", true},
+	}
+	for _, ts := range toStringTests {
+		if out := ts.In.String(); out == "" && ts.Valid {
+			t.Errorf("%#v.String() => '%v' expected no error", ts.In, out)
+		} else if out != ts.Out {
+			t.Errorf("%#v.String() => '%v' want '%v'", ts.In, out, ts.Out)
+		}
+	}
+}
+
+func TestRequirementSelectorMatching(t *testing.T) {
+	var req Requirement
+	labelSelectorMatchingTests := []struct {
+		Set   Set
+		Sel   Selector
+		Match bool
+	}{
+		{Set{"x": "foo", "y": "baz"}, &internalSelector{
+			req,
+		}, false},
+		{Set{"x": "foo", "y": "baz"}, &internalSelector{
+			getRequirement("x", selection.In, sets.NewString("foo"), t),
+			getRequirement("y", selection.NotIn, sets.NewString("alpha"), t),
+		}, true},
+		{Set{"x": "foo", "y": "baz"}, &internalSelector{
+			getRequirement("x", selection.In, sets.NewString("foo"), t),
+			getRequirement("y", selection.In, sets.NewString("alpha"), t),
+		}, false},
+		{Set{"y": ""}, &internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString(""), t),
+			getRequirement("y", selection.Exists, nil, t),
+		}, true},
+		{Set{"y": ""}, &internalSelector{
+			getRequirement("x", selection.DoesNotExist, nil, t),
+			getRequirement("y", selection.Exists, nil, t),
+		}, true},
+		{Set{"y": ""}, &internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString(""), t),
+			getRequirement("y", selection.DoesNotExist, nil, t),
+		}, false},
+		{Set{"y": "baz"}, &internalSelector{
+			getRequirement("x", selection.In, sets.NewString(""), t),
+		}, false},
+		{Set{"z": "2"}, &internalSelector{
+			getRequirement("z", selection.GreaterThan, sets.NewString("1"), t),
+		}, true},
+		{Set{"z": "v2"}, &internalSelector{
+			getRequirement("z", selection.GreaterThan, sets.NewString("1"), t),
+		}, false},
+	}
+	for _, lsm := range labelSelectorMatchingTests {
+		if match := lsm.Sel.Matches(lsm.Set); match != lsm.Match {
+			t.Errorf("%+v.Matches(%#v) => %v, want %v", lsm.Sel, lsm.Set, match, lsm.Match)
+		}
+	}
+}
+
+func TestSetSelectorParser(t *testing.T) {
+	setSelectorParserTests := []struct {
+		In    string
+		Out   Selector
+		Match bool
+		Valid bool
+	}{
+		{"", NewSelector(), true, true},
+		{"\rx", internalSelector{
+			getRequirement("x", selection.Exists, nil, t),
+		}, true, true},
+		{"this-is-a-dns.domain.com/key-with-dash", internalSelector{
+			getRequirement("this-is-a-dns.domain.com/key-with-dash", selection.Exists, nil, t),
+		}, true, true},
+		{"this-is-another-dns.domain.com/key-with-dash in (so,what)", internalSelector{
+			getRequirement("this-is-another-dns.domain.com/key-with-dash", selection.In, sets.NewString("so", "what"), t),
+		}, true, true},
+		{"0.1.2.domain/99 notin (10.10.100.1, tick.tack.clock)", internalSelector{
+			getRequirement("0.1.2.domain/99", selection.NotIn, sets.NewString("10.10.100.1", "tick.tack.clock"), t),
+		}, true, true},
+		{"foo  in	 (abc)", internalSelector{
+			getRequirement("foo", selection.In, sets.NewString("abc"), t),
+		}, true, true},
+		{"x notin\n (abc)", internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString("abc"), t),
+		}, true, true},
+		{"x  notin	\t	(abc,def)", internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString("abc", "def"), t),
+		}, true, true},
+		{"x in (abc,def)", internalSelector{
+			getRequirement("x", selection.In, sets.NewString("abc", "def"), t),
+		}, true, true},
+		{"x in (abc,)", internalSelector{
+			getRequirement("x", selection.In, sets.NewString("abc", ""), t),
+		}, true, true},
+		{"x in (abc,abc)", internalSelector{
+			getRequirement("x", selection.In, sets.NewString("abc"), t),
+		}, true, true},
+		{"x in ()", internalSelector{
+			getRequirement("x", selection.In, sets.NewString(""), t),
+		}, true, true},
+		{"x in (a,,)", internalSelector{
+			getRequirement("x", selection.In, sets.NewString("a", ""), t),
+		}, true, true},
+		{"x in (a,,,)", internalSelector{
+			getRequirement("x", selection.In, sets.NewString("a", ""), t),
+		}, true, true},
+		{"x in (a,,,,,,)", internalSelector{
+			getRequirement("x", selection.In, sets.NewString("a", ""), t),
+		}, true, true},
+		{"x in (a,,a,,a,,a,,)", internalSelector{
+			getRequirement("x", selection.In, sets.NewString("a", ""), t),
+		}, true, true},
+		{"x notin (abc,,def),bar,z in (),w", internalSelector{
+			getRequirement("bar", selection.Exists, nil, t),
+			getRequirement("w", selection.Exists, nil, t),
+			getRequirement("x", selection.NotIn, sets.NewString("abc", "", "def"), t),
+			getRequirement("z", selection.In, sets.NewString(""), t),
+		}, true, true},
+		{"x,y in (a)", internalSelector{
+			getRequirement("y", selection.In, sets.NewString("a"), t),
+			getRequirement("x", selection.Exists, nil, t),
+		}, false, true},
+		{"x=a", internalSelector{
+			getRequirement("x", selection.Equals, sets.NewString("a"), t),
+		}, true, true},
+		{"x>1", internalSelector{
+			getRequirement("x", selection.GreaterThan, sets.NewString("1"), t),
+		}, true, true},
+		{"x<7", internalSelector{
+			getRequirement("x", selection.LessThan, sets.NewString("7"), t),
+		}, true, true},
+		{"x=a,y!=b", internalSelector{
+			getRequirement("x", selection.Equals, sets.NewString("a"), t),
+			getRequirement("y", selection.NotEquals, sets.NewString("b"), t),
+		}, true, true},
+		{"x=a,y!=b,z in (h,i,j)", internalSelector{
+			getRequirement("x", selection.Equals, sets.NewString("a"), t),
+			getRequirement("y", selection.NotEquals, sets.NewString("b"), t),
+			getRequirement("z", selection.In, sets.NewString("h", "i", "j"), t),
+		}, true, true},
+		{"x=a||y=b", internalSelector{}, false, false},
+		{"x,,y", nil, true, false},
+		{",x,y", nil, true, false},
+		{"x nott in (y)", nil, true, false},
+		{"x notin ( )", internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString(""), t),
+		}, true, true},
+		{"x notin (, a)", internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString("", "a"), t),
+		}, true, true},
+		{"a in (xyz),", nil, true, false},
+		{"a in (xyz)b notin ()", nil, true, false},
+		{"a ", internalSelector{
+			getRequirement("a", selection.Exists, nil, t),
+		}, true, true},
+		{"a in (x,y,notin, z,in)", internalSelector{
+			getRequirement("a", selection.In, sets.NewString("in", "notin", "x", "y", "z"), t),
+		}, true, true}, // operator 'in' inside list of identifiers
+		{"a in (xyz abc)", nil, false, false}, // no comma
+		{"a notin(", nil, true, false},        // bad formed
+		{"a (", nil, false, false},            // cpar
+		{"(", nil, false, false},              // opar
+	}
+
+	for _, ssp := range setSelectorParserTests {
+		if sel, err := Parse(ssp.In); err != nil && ssp.Valid {
+			t.Errorf("Parse(%s) => %v expected no error", ssp.In, err)
+		} else if err == nil && !ssp.Valid {
+			t.Errorf("Parse(%s) => %+v expected error", ssp.In, sel)
+		} else if ssp.Match && !reflect.DeepEqual(sel, ssp.Out) {
+			t.Errorf("Parse(%s) => parse output '%#v' doesn't match '%#v' expected match", ssp.In, sel, ssp.Out)
+		}
+	}
+}
+
+func getRequirement(key string, op selection.Operator, vals sets.String, t *testing.T) Requirement {
+	req, err := NewRequirement(key, op, vals.List())
+	if err != nil {
+		t.Errorf("NewRequirement(%v, %v, %v) resulted in error:%v", key, op, vals, err)
+		return Requirement{}
+	}
+	return *req
+}
+
+func TestAdd(t *testing.T) {
+	testCases := []struct {
+		name        string
+		sel         Selector
+		key         string
+		operator    selection.Operator
+		values      []string
+		refSelector Selector
+	}{
+		{
+			"keyInOperator",
+			internalSelector{},
+			"key",
+			selection.In,
+			[]string{"value"},
+			internalSelector{Requirement{"key", selection.In, []string{"value"}}},
+		},
+		{
+			"keyEqualsOperator",
+			internalSelector{Requirement{"key", selection.In, []string{"value"}}},
+			"key2",
+			selection.Equals,
+			[]string{"value2"},
+			internalSelector{
+				Requirement{"key", selection.In, []string{"value"}},
+				Requirement{"key2", selection.Equals, []string{"value2"}},
+			},
+		},
+	}
+	for _, ts := range testCases {
+		req, err := NewRequirement(ts.key, ts.operator, ts.values)
+		if err != nil {
+			t.Errorf("%s - Unable to create labels.Requirement", ts.name)
+		}
+		ts.sel = ts.sel.Add(*req)
+		if !reflect.DeepEqual(ts.sel, ts.refSelector) {
+			t.Errorf("%s - Expected %v found %v", ts.name, ts.refSelector, ts.sel)
+		}
+	}
+}
+
+func TestSafeSort(t *testing.T) {
+	tests := []struct {
+		name   string
+		in     []string
+		inCopy []string
+		want   []string
+	}{
+		{
+			name:   "nil strings",
+			in:     nil,
+			inCopy: nil,
+			want:   nil,
+		},
+		{
+			name:   "ordered strings",
+			in:     []string{"bar", "foo"},
+			inCopy: []string{"bar", "foo"},
+			want:   []string{"bar", "foo"},
+		},
+		{
+			name:   "unordered strings",
+			in:     []string{"foo", "bar"},
+			inCopy: []string{"foo", "bar"},
+			want:   []string{"bar", "foo"},
+		},
+		{
+			name:   "duplicated strings",
+			in:     []string{"foo", "bar", "foo", "bar"},
+			inCopy: []string{"foo", "bar", "foo", "bar"},
+			want:   []string{"bar", "bar", "foo", "foo"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := safeSort(tt.in); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("safeSort() = %v, want %v", got, tt.want)
+			}
+			if !reflect.DeepEqual(tt.in, tt.inCopy) {
+				t.Errorf("after safeSort(), input = %v, want %v", tt.in, tt.inCopy)
+			}
+		})
+	}
+}
+
+func BenchmarkSelectorFromValidatedSet(b *testing.B) {
+	set := map[string]string{
+		"foo": "foo",
+		"bar": "bar",
+	}
+	matchee := Set(map[string]string{
+		"foo":   "foo",
+		"bar":   "bar",
+		"extra": "label",
+	})
+
+	for i := 0; i < b.N; i++ {
+		s := SelectorFromValidatedSet(set)
+		if s.Empty() {
+			b.Errorf("Unexpected selector")
+		}
+		if !s.Matches(matchee) {
+			b.Errorf("Unexpected match")
+		}
+	}
+}
+
+func BenchmarkSetSelector(b *testing.B) {
+	set := map[string]string{
+		"foo": "foo",
+		"bar": "bar",
+	}
+	matchee := Set(map[string]string{
+		"foo":   "foo",
+		"bar":   "bar",
+		"extra": "label",
+	})
+
+	for i := 0; i < b.N; i++ {
+		s := ValidatedSetSelector(set)
+		if s.Empty() {
+			b.Errorf("Unexpected selector")
+		}
+		if !s.Matches(matchee) {
+			b.Errorf("Unexpected match")
+		}
+	}
+}
+
+func TestSetSelectorString(t *testing.T) {
+	cases := []struct {
+		set Set
+		out string
+	}{
+		{
+			Set{},
+			"",
+		},
+		{
+			Set{"app": "foo"},
+			"app=foo",
+		},
+		{
+			Set{"app": "foo", "a": "b"},
+			"a=b,app=foo",
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.out, func(t *testing.T) {
+			if got := ValidatedSetSelector(tt.set).String(); tt.out != got {
+				t.Fatalf("expected %v, got %v", tt.out, got)
+			}
+		})
+	}
+}
+
+func TestRequiresExactMatch(t *testing.T) {
+	testCases := []struct {
+		name          string
+		sel           Selector
+		label         string
+		expectedFound bool
+		expectedValue string
+	}{
+		{
+			name:          "keyInOperatorExactMatch",
+			sel:           internalSelector{Requirement{"key", selection.In, []string{"value"}}},
+			label:         "key",
+			expectedFound: true,
+			expectedValue: "value",
+		},
+		{
+			name:          "keyInOperatorNotExactMatch",
+			sel:           internalSelector{Requirement{"key", selection.In, []string{"value", "value2"}}},
+			label:         "key",
+			expectedFound: false,
+			expectedValue: "",
+		},
+		{
+			name: "keyInOperatorNotExactMatch",
+			sel: internalSelector{
+				Requirement{"key", selection.In, []string{"value", "value1"}},
+				Requirement{"key2", selection.In, []string{"value2"}},
+			},
+			label:         "key2",
+			expectedFound: true,
+			expectedValue: "value2",
+		},
+		{
+			name:          "keyEqualOperatorExactMatch",
+			sel:           internalSelector{Requirement{"key", selection.Equals, []string{"value"}}},
+			label:         "key",
+			expectedFound: true,
+			expectedValue: "value",
+		},
+		{
+			name:          "keyDoubleEqualOperatorExactMatch",
+			sel:           internalSelector{Requirement{"key", selection.DoubleEquals, []string{"value"}}},
+			label:         "key",
+			expectedFound: true,
+			expectedValue: "value",
+		},
+		{
+			name:          "keyNotEqualOperatorExactMatch",
+			sel:           internalSelector{Requirement{"key", selection.NotEquals, []string{"value"}}},
+			label:         "key",
+			expectedFound: false,
+			expectedValue: "",
+		},
+		{
+			name: "keyEqualOperatorExactMatchFirst",
+			sel: internalSelector{
+				Requirement{"key", selection.In, []string{"value"}},
+				Requirement{"key2", selection.In, []string{"value2"}},
+			},
+			label:         "key",
+			expectedFound: true,
+			expectedValue: "value",
+		},
+	}
+	for _, ts := range testCases {
+		t.Run(ts.name, func(t *testing.T) {
+			value, found := ts.sel.RequiresExactMatch(ts.label)
+			if found != ts.expectedFound {
+				t.Errorf("Expected match %v, found %v", ts.expectedFound, found)
+			}
+			if found && value != ts.expectedValue {
+				t.Errorf("Expected value %v, found %v", ts.expectedValue, value)
+			}
+
+		})
+	}
+}
+
+func TestValidatedSelectorFromSet(t *testing.T) {
+	tests := []struct {
+		name             string
+		input            Set
+		expectedSelector internalSelector
+		expectedError    field.ErrorList
+	}{
+		{
+			name:  "Simple Set, no error",
+			input: Set{"key": "val"},
+			expectedSelector: internalSelector{
+				Requirement{
+					key:       "key",
+					operator:  selection.Equals,
+					strValues: []string{"val"},
+				},
+			},
+		},
+		{
+			name:  "Invalid Set, value too long",
+			input: Set{"Key": "axahm2EJ8Phiephe2eixohbee9eGeiyees1thuozi1xoh0GiuH3diewi8iem7Nui"},
+			expectedError: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values[0][Key]",
+					BadValue: "axahm2EJ8Phiephe2eixohbee9eGeiyees1thuozi1xoh0GiuH3diewi8iem7Nui",
+				},
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		selector, err := ValidatedSelectorFromSet(tc.input)
+		if diff := cmp.Diff(tc.expectedError.ToAggregate(), err, ignoreDetail); diff != "" {
+			t.Errorf("ValidatedSelectorFromSet %#v returned unexpected error (-want,+got):\n%s", tc.name, diff)
+		}
+		if err == nil {
+			if diff := cmp.Diff(tc.expectedSelector, selector); diff != "" {
+				t.Errorf("ValidatedSelectorFromSet %#v returned unexpected selector (-want,+got):\n%s", tc.name, diff)
+			}
+		}
+	}
+}
+
+func BenchmarkRequirementString(b *testing.B) {
+	r := Requirement{
+		key:      "environment",
+		operator: selection.NotIn,
+		strValues: []string{
+			"dev",
+		},
+	}
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		if r.String() != "environment notin (dev)" {
+			b.Errorf("Unexpected Requirement string")
+		}
+	}
+}
+
+func BenchmarkRequirementMatches(b *testing.B) {
+	r := Requirement{
+		key:      "environment",
+		operator: selection.NotIn,
+		strValues: []string{
+			"dev",
+		},
+	}
+	labels := Set(map[string]string{
+		"key":         "value",
+		"environment": "dev",
+	})
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		r.Matches(labels)
+	}
+}
+
+func TestRequirementEqual(t *testing.T) {
+	tests := []struct {
+		name string
+		x, y *Requirement
+		want bool
+	}{
+		{
+			name: "same requirements should be equal",
+			x: &Requirement{
+				key:       "key",
+				operator:  selection.Equals,
+				strValues: []string{"foo", "bar"},
+			},
+			y: &Requirement{
+				key:       "key",
+				operator:  selection.Equals,
+				strValues: []string{"foo", "bar"},
+			},
+			want: true,
+		},
+		{
+			name: "requirements with different keys should not be equal",
+			x: &Requirement{
+				key:       "key1",
+				operator:  selection.Equals,
+				strValues: []string{"foo", "bar"},
+			},
+			y: &Requirement{
+				key:       "key2",
+				operator:  selection.Equals,
+				strValues: []string{"foo", "bar"},
+			},
+			want: false,
+		},
+		{
+			name: "requirements with different operators should not be equal",
+			x: &Requirement{
+				key:       "key",
+				operator:  selection.Equals,
+				strValues: []string{"foo", "bar"},
+			},
+			y: &Requirement{
+				key:       "key",
+				operator:  selection.In,
+				strValues: []string{"foo", "bar"},
+			},
+			want: false,
+		},
+		{
+			name: "requirements with different values should not be equal",
+			x: &Requirement{
+				key:       "key",
+				operator:  selection.Equals,
+				strValues: []string{"foo", "bar"},
+			},
+			y: &Requirement{
+				key:       "key",
+				operator:  selection.Equals,
+				strValues: []string{"foobar"},
+			},
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := cmp.Equal(tt.x, tt.y); got != tt.want {
+				t.Errorf("cmp.Equal() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestMatchesNothing(t *testing.T) {
+	tests := []struct {
+		name          string
+		selector      string
+		set           map[string]string
+		labelSelector Selector
+		want          bool
+	}{
+		{
+			name:          "MatchNothing should match Nothing()",
+			labelSelector: Nothing(),
+			want:          true,
+		},
+		{
+			name:          "MatchNothing should match sharedNothingSelector",
+			labelSelector: sharedNothingSelector,
+			want:          true,
+		},
+		{
+			name:          "MatchNothing should not match Everything()",
+			labelSelector: Everything(),
+			want:          false,
+		},
+		{
+			name:          "MatchNothing should not match sharedEverythingSelector",
+			labelSelector: sharedEverythingSelector,
+			want:          false,
+		},
+		{
+			name: "MatchNothing should not match empty set",
+			set:  map[string]string{},
+			want: false,
+		},
+		{
+			name: "MatchNothing should not match non-empty set",
+			set:  map[string]string{"key": "value"},
+			want: false,
+		},
+		{
+			name:     "MatchNothing should not match empty selector",
+			selector: "",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - exists",
+			selector: "a",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - not exists",
+			selector: "!a",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - equals",
+			selector: "a=b",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - not equals",
+			selector: "a!=b",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - in",
+			selector: "a in (b)",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - notin",
+			selector: "a notin (b)",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - conflict exists and not exists",
+			selector: "a,!a",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - conflict equals and not equals",
+			selector: "a=b,a!=b",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - conflict in and notin",
+			selector: "a in (b),a notin (b)",
+			want:     false,
+		},
+	}
+
+	for i := 0; i < len(tests); i++ {
+		if tests[i].labelSelector != nil {
+			expectMatchNothing(t, tests[i].labelSelector, tests[i].want)
+		} else if tests[i].set != nil {
+			expectMatchNothing(t, SelectorFromSet(tests[i].set), tests[i].want)
+		} else {
+			selector, err := Parse(tests[i].selector)
+			if err != nil {
+				t.Errorf("Unable to parse %v as a selector.\n", selector)
+			}
+			expectMatchNothing(t, selector, tests[i].want)
+		}
+	}
+}
+
+func expectMatchNothing(t *testing.T, selector Selector, want bool) {
+	if MatchesNothing(selector) != want {
+		t.Errorf("Wanted %s to MatchNothing '%t', but it did not.\n", selector, want)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..fdf4c31e1e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/labels/zz_generated.deepcopy.go
@@ -0,0 +1,43 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package labels
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Requirement) DeepCopyInto(out *Requirement) {
+	*out = *in
+	if in.strValues != nil {
+		in, out := &in.strValues, &out.strValues
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Requirement.
+func (in *Requirement) DeepCopy() *Requirement {
+	if in == nil {
+		return nil
+	}
+	out := new(Requirement)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/allocator.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/allocator.go
new file mode 100644
index 0000000000..8bf22ae8ac
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/allocator.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"sync"
+)
+
+// AllocatorPool simply stores Allocator objects to avoid additional memory allocations
+// by caching created but unused items for later reuse, relieving pressure on the garbage collector.
+//
+// Usage:
+//
+//	memoryAllocator := runtime.AllocatorPool.Get().(*runtime.Allocator)
+//	defer runtime.AllocatorPool.Put(memoryAllocator)
+//
+// A note for future:
+//
+//	consider introducing multiple pools for storing buffers of different sizes
+//	perhaps this could allow us to be more efficient.
+var AllocatorPool = sync.Pool{
+	New: func() interface{} {
+		return &Allocator{}
+	},
+}
+
+// Allocator knows how to allocate memory
+// It exists to make the cost of object serialization cheaper.
+// In some cases, it allows for allocating memory only once and then reusing it.
+// This approach puts less load on GC and leads to less fragmented memory in general.
+type Allocator struct {
+	buf []byte
+}
+
+var _ MemoryAllocator = &Allocator{}
+
+// Allocate reserves memory for n bytes only if the underlying array doesn't have enough capacity
+// otherwise it returns previously allocated block of memory.
+//
+// Note that the returned array is not zeroed, it is the caller's
+// responsibility to clean the memory if needed.
+func (a *Allocator) Allocate(n uint64) []byte {
+	if uint64(cap(a.buf)) >= n {
+		a.buf = a.buf[:n]
+		return a.buf
+	}
+	// grow the buffer
+	size := uint64(2*cap(a.buf)) + n
+	a.buf = make([]byte, size)
+	a.buf = a.buf[:n]
+	return a.buf
+}
+
+// SimpleAllocator a wrapper around make([]byte)
+// conforms to the MemoryAllocator interface
+type SimpleAllocator struct{}
+
+var _ MemoryAllocator = &SimpleAllocator{}
+
+func (sa *SimpleAllocator) Allocate(n uint64) []byte {
+	return make([]byte, n)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/allocator_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/allocator_test.go
new file mode 100644
index 0000000000..067a5dda5e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/allocator_test.go
@@ -0,0 +1,78 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"math/rand"
+	"testing"
+)
+
+func TestAllocatorRandomInputs(t *testing.T) {
+	maxBytes := 5 * 1000000 // 5 MB
+	iterations := rand.Intn(10000) + 10
+	target := &Allocator{}
+
+	for i := 0; i < iterations; i++ {
+		bytesToAllocate := rand.Intn(maxBytes)
+		buff := target.Allocate(uint64(bytesToAllocate))
+		if cap(buff) < bytesToAllocate {
+			t.Fatalf("expected the buffer to allocate: %v bytes whereas it allocated: %v bytes", bytesToAllocate, cap(buff))
+		}
+		if len(buff) != bytesToAllocate {
+			t.Fatalf("unexpected length of the buffer, expected: %v, got: %v", bytesToAllocate, len(buff))
+		}
+	}
+}
+
+func TestAllocatorNeverShrinks(t *testing.T) {
+	target := &Allocator{}
+	initialSize := 1000000 // 1MB
+	initialBuff := target.Allocate(uint64(initialSize))
+	if cap(initialBuff) < initialSize {
+		t.Fatalf("unexpected size of the buffer, expected at least 1MB, got: %v", cap(initialBuff))
+	}
+
+	for i := initialSize; i > 0; i = i / 10 {
+		newBuff := target.Allocate(uint64(i))
+		if cap(newBuff) < initialSize {
+			t.Fatalf("allocator is now allowed to shrink memory")
+		}
+		if len(newBuff) != i {
+			t.Fatalf("unexpected length of the buffer, expected: %v, got: %v", i, len(newBuff))
+		}
+	}
+}
+
+func TestAllocatorZero(t *testing.T) {
+	target := &Allocator{}
+	initialSize := 1000000 // 1MB
+	buff := target.Allocate(uint64(initialSize))
+	if cap(buff) < initialSize {
+		t.Fatalf("unexpected size of the buffer, expected at least 1MB, got: %v", cap(buff))
+	}
+	if len(buff) != initialSize {
+		t.Fatalf("unexpected length of the buffer, expected: %v, got: %v", initialSize, len(buff))
+	}
+
+	buff = target.Allocate(0)
+	if cap(buff) < initialSize {
+		t.Fatalf("unexpected size of the buffer, expected at least 1MB, got: %v", cap(buff))
+	}
+	if len(buff) != 0 {
+		t.Fatalf("unexpected length of the buffer, expected: 0, got: %v", len(buff))
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/codec.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/codec.go
new file mode 100644
index 0000000000..654835b3ed
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/codec.go
@@ -0,0 +1,398 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/url"
+	"reflect"
+	"strconv"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/conversion/queryparams"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/klog/v2"
+)
+
+// codec binds an encoder and decoder.
+type codec struct {
+	Encoder
+	Decoder
+}
+
+// NewCodec creates a Codec from an Encoder and Decoder.
+func NewCodec(e Encoder, d Decoder) Codec {
+	return codec{e, d}
+}
+
+// Encode is a convenience wrapper for encoding to a []byte from an Encoder
+func Encode(e Encoder, obj Object) ([]byte, error) {
+	buf := &bytes.Buffer{}
+	if err := e.Encode(obj, buf); err != nil {
+		return nil, err
+	}
+	return buf.Bytes(), nil
+}
+
+// Decode is a convenience wrapper for decoding data into an Object.
+func Decode(d Decoder, data []byte) (Object, error) {
+	obj, _, err := d.Decode(data, nil, nil)
+	return obj, err
+}
+
+// DecodeInto performs a Decode into the provided object.
+func DecodeInto(d Decoder, data []byte, into Object) error {
+	out, gvk, err := d.Decode(data, nil, into)
+	if err != nil {
+		return err
+	}
+	if out != into {
+		return fmt.Errorf("unable to decode %s into %v", gvk, reflect.TypeOf(into))
+	}
+	return nil
+}
+
+// EncodeOrDie is a version of Encode which will panic instead of returning an error. For tests.
+func EncodeOrDie(e Encoder, obj Object) string {
+	bytes, err := Encode(e, obj)
+	if err != nil {
+		panic(err)
+	}
+	return string(bytes)
+}
+
+// UseOrCreateObject returns obj if the canonical ObjectKind returned by the provided typer matches gvk, or
+// invokes the ObjectCreator to instantiate a new gvk. Returns an error if the typer cannot find the object.
+func UseOrCreateObject(t ObjectTyper, c ObjectCreater, gvk schema.GroupVersionKind, obj Object) (Object, error) {
+	if obj != nil {
+		kinds, _, err := t.ObjectKinds(obj)
+		if err != nil {
+			return nil, err
+		}
+		for _, kind := range kinds {
+			if gvk == kind {
+				return obj, nil
+			}
+		}
+	}
+	return c.New(gvk)
+}
+
+// NoopEncoder converts an Decoder to a Serializer or Codec for code that expects them but only uses decoding.
+type NoopEncoder struct {
+	Decoder
+}
+
+var _ Serializer = NoopEncoder{}
+
+const noopEncoderIdentifier Identifier = "noop"
+
+func (n NoopEncoder) Encode(obj Object, w io.Writer) error {
+	// There is no need to handle runtime.CacheableObject, as we don't
+	// process the obj at all.
+	return fmt.Errorf("encoding is not allowed for this codec: %v", reflect.TypeOf(n.Decoder))
+}
+
+// Identifier implements runtime.Encoder interface.
+func (n NoopEncoder) Identifier() Identifier {
+	return noopEncoderIdentifier
+}
+
+// NoopDecoder converts an Encoder to a Serializer or Codec for code that expects them but only uses encoding.
+type NoopDecoder struct {
+	Encoder
+}
+
+var _ Serializer = NoopDecoder{}
+
+func (n NoopDecoder) Decode(data []byte, gvk *schema.GroupVersionKind, into Object) (Object, *schema.GroupVersionKind, error) {
+	return nil, nil, fmt.Errorf("decoding is not allowed for this codec: %v", reflect.TypeOf(n.Encoder))
+}
+
+// NewParameterCodec creates a ParameterCodec capable of transforming url values into versioned objects and back.
+func NewParameterCodec(scheme *Scheme) ParameterCodec {
+	return &parameterCodec{
+		typer:     scheme,
+		convertor: scheme,
+		creator:   scheme,
+		defaulter: scheme,
+	}
+}
+
+// parameterCodec implements conversion to and from query parameters and objects.
+type parameterCodec struct {
+	typer     ObjectTyper
+	convertor ObjectConvertor
+	creator   ObjectCreater
+	defaulter ObjectDefaulter
+}
+
+var _ ParameterCodec = &parameterCodec{}
+
+// DecodeParameters converts the provided url.Values into an object of type From with the kind of into, and then
+// converts that object to into (if necessary). Returns an error if the operation cannot be completed.
+func (c *parameterCodec) DecodeParameters(parameters url.Values, from schema.GroupVersion, into Object) error {
+	if len(parameters) == 0 {
+		return nil
+	}
+	targetGVKs, _, err := c.typer.ObjectKinds(into)
+	if err != nil {
+		return err
+	}
+	for i := range targetGVKs {
+		if targetGVKs[i].GroupVersion() == from {
+			if err := c.convertor.Convert(&parameters, into, nil); err != nil {
+				return err
+			}
+			// in the case where we going into the same object we're receiving, default on the outbound object
+			if c.defaulter != nil {
+				c.defaulter.Default(into)
+			}
+			return nil
+		}
+	}
+
+	input, err := c.creator.New(from.WithKind(targetGVKs[0].Kind))
+	if err != nil {
+		return err
+	}
+	if err := c.convertor.Convert(&parameters, input, nil); err != nil {
+		return err
+	}
+	// if we have defaulter, default the input before converting to output
+	if c.defaulter != nil {
+		c.defaulter.Default(input)
+	}
+	return c.convertor.Convert(input, into, nil)
+}
+
+// EncodeParameters converts the provided object into the to version, then converts that object to url.Values.
+// Returns an error if conversion is not possible.
+func (c *parameterCodec) EncodeParameters(obj Object, to schema.GroupVersion) (url.Values, error) {
+	gvks, _, err := c.typer.ObjectKinds(obj)
+	if err != nil {
+		return nil, err
+	}
+	gvk := gvks[0]
+	if to != gvk.GroupVersion() {
+		out, err := c.convertor.ConvertToVersion(obj, to)
+		if err != nil {
+			return nil, err
+		}
+		obj = out
+	}
+	return queryparams.Convert(obj)
+}
+
+type base64Serializer struct {
+	Encoder
+	Decoder
+
+	identifier Identifier
+}
+
+func NewBase64Serializer(e Encoder, d Decoder) Serializer {
+	return &base64Serializer{
+		Encoder:    e,
+		Decoder:    d,
+		identifier: identifier(e),
+	}
+}
+
+func identifier(e Encoder) Identifier {
+	result := map[string]string{
+		"name": "base64",
+	}
+	if e != nil {
+		result["encoder"] = string(e.Identifier())
+	}
+	identifier, err := json.Marshal(result)
+	if err != nil {
+		//nolint:logcheck // Should not be reached.
+		klog.Fatalf("Failed marshaling identifier for base64Serializer: %v", err)
+	}
+	return Identifier(identifier)
+}
+
+func (s base64Serializer) Encode(obj Object, stream io.Writer) error {
+	if co, ok := obj.(CacheableObject); ok {
+		return co.CacheEncode(s.Identifier(), s.doEncode, stream)
+	}
+	return s.doEncode(obj, stream)
+}
+
+func (s base64Serializer) doEncode(obj Object, stream io.Writer) error {
+	e := base64.NewEncoder(base64.StdEncoding, stream)
+	err := s.Encoder.Encode(obj, e)
+	e.Close()
+	return err
+}
+
+// Identifier implements runtime.Encoder interface.
+func (s base64Serializer) Identifier() Identifier {
+	return s.identifier
+}
+
+func (s base64Serializer) Decode(data []byte, defaults *schema.GroupVersionKind, into Object) (Object, *schema.GroupVersionKind, error) {
+	out := make([]byte, base64.StdEncoding.DecodedLen(len(data)))
+	n, err := base64.StdEncoding.Decode(out, data)
+	if err != nil {
+		return nil, nil, err
+	}
+	return s.Decoder.Decode(out[:n], defaults, into)
+}
+
+// SerializerInfoForMediaType returns the first info in types that has a matching media type (which cannot
+// include media-type parameters), or the first info with an empty media type, or false if no type matches.
+func SerializerInfoForMediaType(types []SerializerInfo, mediaType string) (SerializerInfo, bool) {
+	for _, info := range types {
+		if info.MediaType == mediaType {
+			return info, true
+		}
+	}
+	for _, info := range types {
+		if len(info.MediaType) == 0 {
+			return info, true
+		}
+	}
+	return SerializerInfo{}, false
+}
+
+var (
+	// InternalGroupVersioner will always prefer the internal version for a given group version kind.
+	InternalGroupVersioner GroupVersioner = internalGroupVersioner{}
+	// DisabledGroupVersioner will reject all kinds passed to it.
+	DisabledGroupVersioner GroupVersioner = disabledGroupVersioner{}
+)
+
+const (
+	internalGroupVersionerIdentifier = "internal"
+	disabledGroupVersionerIdentifier = "disabled"
+)
+
+type internalGroupVersioner struct{}
+
+// KindForGroupVersionKinds returns an internal Kind if one is found, or converts the first provided kind to the internal version.
+func (internalGroupVersioner) KindForGroupVersionKinds(kinds []schema.GroupVersionKind) (schema.GroupVersionKind, bool) {
+	for _, kind := range kinds {
+		if kind.Version == APIVersionInternal {
+			return kind, true
+		}
+	}
+	for _, kind := range kinds {
+		return schema.GroupVersionKind{Group: kind.Group, Version: APIVersionInternal, Kind: kind.Kind}, true
+	}
+	return schema.GroupVersionKind{}, false
+}
+
+// Identifier implements GroupVersioner interface.
+func (internalGroupVersioner) Identifier() string {
+	return internalGroupVersionerIdentifier
+}
+
+type disabledGroupVersioner struct{}
+
+// KindForGroupVersionKinds returns false for any input.
+func (disabledGroupVersioner) KindForGroupVersionKinds(kinds []schema.GroupVersionKind) (schema.GroupVersionKind, bool) {
+	return schema.GroupVersionKind{}, false
+}
+
+// Identifier implements GroupVersioner interface.
+func (disabledGroupVersioner) Identifier() string {
+	return disabledGroupVersionerIdentifier
+}
+
+// Assert that schema.GroupVersion and GroupVersions implement GroupVersioner
+var _ GroupVersioner = schema.GroupVersion{}
+var _ GroupVersioner = schema.GroupVersions{}
+var _ GroupVersioner = multiGroupVersioner{}
+
+type multiGroupVersioner struct {
+	target             schema.GroupVersion
+	acceptedGroupKinds []schema.GroupKind
+	coerce             bool
+}
+
+// NewMultiGroupVersioner returns the provided group version for any kind that matches one of the provided group kinds.
+// Kind may be empty in the provided group kind, in which case any kind will match.
+func NewMultiGroupVersioner(gv schema.GroupVersion, groupKinds ...schema.GroupKind) GroupVersioner {
+	if len(groupKinds) == 0 || (len(groupKinds) == 1 && groupKinds[0].Group == gv.Group) {
+		return gv
+	}
+	return multiGroupVersioner{target: gv, acceptedGroupKinds: groupKinds}
+}
+
+// NewCoercingMultiGroupVersioner returns the provided group version for any incoming kind.
+// Incoming kinds that match the provided groupKinds are preferred.
+// Kind may be empty in the provided group kind, in which case any kind will match.
+// Examples:
+//
+//	gv=mygroup/__internal, groupKinds=mygroup/Foo, anothergroup/Bar
+//	KindForGroupVersionKinds(yetanother/v1/Baz, anothergroup/v1/Bar) -> mygroup/__internal/Bar (matched preferred group/kind)
+//
+//	gv=mygroup/__internal, groupKinds=mygroup, anothergroup
+//	KindForGroupVersionKinds(yetanother/v1/Baz, anothergroup/v1/Bar) -> mygroup/__internal/Bar (matched preferred group)
+//
+//	gv=mygroup/__internal, groupKinds=mygroup, anothergroup
+//	KindForGroupVersionKinds(yetanother/v1/Baz, yetanother/v1/Bar) -> mygroup/__internal/Baz (no preferred group/kind match, uses first kind in list)
+func NewCoercingMultiGroupVersioner(gv schema.GroupVersion, groupKinds ...schema.GroupKind) GroupVersioner {
+	return multiGroupVersioner{target: gv, acceptedGroupKinds: groupKinds, coerce: true}
+}
+
+// KindForGroupVersionKinds returns the target group version if any kind matches any of the original group kinds. It will
+// use the originating kind where possible.
+func (v multiGroupVersioner) KindForGroupVersionKinds(kinds []schema.GroupVersionKind) (schema.GroupVersionKind, bool) {
+	for _, src := range kinds {
+		for _, kind := range v.acceptedGroupKinds {
+			if kind.Group != src.Group {
+				continue
+			}
+			if len(kind.Kind) > 0 && kind.Kind != src.Kind {
+				continue
+			}
+			return v.target.WithKind(src.Kind), true
+		}
+	}
+	if v.coerce && len(kinds) > 0 {
+		return v.target.WithKind(kinds[0].Kind), true
+	}
+	return schema.GroupVersionKind{}, false
+}
+
+// Identifier implements GroupVersioner interface.
+func (v multiGroupVersioner) Identifier() string {
+	groupKinds := make([]string, 0, len(v.acceptedGroupKinds))
+	for _, gk := range v.acceptedGroupKinds {
+		groupKinds = append(groupKinds, gk.String())
+	}
+	result := map[string]string{
+		"name":     "multi",
+		"target":   v.target.String(),
+		"accepted": strings.Join(groupKinds, ","),
+		"coerce":   strconv.FormatBool(v.coerce),
+	}
+	identifier, err := json.Marshal(result)
+	if err != nil {
+		//nolint:logcheck // Should not be reached.
+		klog.Fatalf("Failed marshaling Identifier for %#v: %v", v, err)
+	}
+	return string(identifier)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/codec_check.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/codec_check.go
new file mode 100644
index 0000000000..e884007766
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/codec_check.go
@@ -0,0 +1,56 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"fmt"
+	"reflect"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/json"
+)
+
+// CheckCodec makes sure that the codec can encode objects like internalType,
+// decode all of the external types listed, and also decode them into the given
+// object. (Will modify internalObject.) (Assumes JSON serialization.)
+// TODO: verify that the correct external version is chosen on encode...
+func CheckCodec(c Codec, internalType Object, externalTypes ...schema.GroupVersionKind) error {
+	if _, err := Encode(c, internalType); err != nil {
+		return fmt.Errorf("internal type not encodable: %v", err)
+	}
+	for _, et := range externalTypes {
+		typeMeta := TypeMeta{
+			Kind:       et.Kind,
+			APIVersion: et.GroupVersion().String(),
+		}
+		exBytes, err := json.Marshal(&typeMeta)
+		if err != nil {
+			return err
+		}
+		obj, err := Decode(c, exBytes)
+		if err != nil {
+			return fmt.Errorf("external type %s not interpretable: %v", et, err)
+		}
+		if reflect.TypeOf(obj) != reflect.TypeOf(internalType) {
+			return fmt.Errorf("decode of external type %s produced: %#v", et, obj)
+		}
+		if err = DecodeInto(c, exBytes, internalType); err != nil {
+			return fmt.Errorf("external type %s not convertible to internal type: %v", et, err)
+		}
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/codec_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/codec_test.go
new file mode 100644
index 0000000000..9425db212a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/codec_test.go
@@ -0,0 +1,104 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime_test
+
+import (
+	"io"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+)
+
+func gv(group, version string) schema.GroupVersion {
+	return schema.GroupVersion{Group: group, Version: version}
+}
+func gvk(group, version, kind string) schema.GroupVersionKind {
+	return schema.GroupVersionKind{Group: group, Version: version, Kind: kind}
+}
+func gk(group, kind string) schema.GroupKind {
+	return schema.GroupKind{Group: group, Kind: kind}
+}
+
+func TestCoercingMultiGroupVersioner(t *testing.T) {
+	testcases := []struct {
+		name           string
+		target         schema.GroupVersion
+		preferredKinds []schema.GroupKind
+		kinds          []schema.GroupVersionKind
+		expectKind     schema.GroupVersionKind
+		expectedId     string
+	}{
+		{
+			name:           "matched preferred group/kind",
+			target:         gv("mygroup", "__internal"),
+			preferredKinds: []schema.GroupKind{gk("mygroup", "Foo"), gk("anothergroup", "Bar")},
+			kinds:          []schema.GroupVersionKind{gvk("yetanother", "v1", "Baz"), gvk("anothergroup", "v1", "Bar")},
+			expectKind:     gvk("mygroup", "__internal", "Bar"),
+			expectedId:     "{\"accepted\":\"Foo.mygroup,Bar.anothergroup\",\"coerce\":\"true\",\"name\":\"multi\",\"target\":\"mygroup/__internal\"}",
+		},
+		{
+			name:           "matched preferred group",
+			target:         gv("mygroup", "__internal"),
+			preferredKinds: []schema.GroupKind{gk("mygroup", ""), gk("anothergroup", "")},
+			kinds:          []schema.GroupVersionKind{gvk("yetanother", "v1", "Baz"), gvk("anothergroup", "v1", "Bar")},
+			expectKind:     gvk("mygroup", "__internal", "Bar"),
+			expectedId:     "{\"accepted\":\".mygroup,.anothergroup\",\"coerce\":\"true\",\"name\":\"multi\",\"target\":\"mygroup/__internal\"}",
+		},
+		{
+			name:           "no preferred group/kind match, uses first kind in list",
+			target:         gv("mygroup", "__internal"),
+			preferredKinds: []schema.GroupKind{gk("mygroup", ""), gk("anothergroup", "")},
+			kinds:          []schema.GroupVersionKind{gvk("yetanother", "v1", "Baz"), gvk("yetanother", "v1", "Bar")},
+			expectKind:     gvk("mygroup", "__internal", "Baz"),
+			expectedId:     "{\"accepted\":\".mygroup,.anothergroup\",\"coerce\":\"true\",\"name\":\"multi\",\"target\":\"mygroup/__internal\"}",
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			v := runtime.NewCoercingMultiGroupVersioner(tc.target, tc.preferredKinds...)
+			kind, ok := v.KindForGroupVersionKinds(tc.kinds)
+			if !ok {
+				t.Error("got no kind")
+			}
+			if kind != tc.expectKind {
+				t.Errorf("expected %#v, got %#v", tc.expectKind, kind)
+			}
+			if e, a := tc.expectedId, v.Identifier(); e != a {
+				t.Errorf("unexpected identifier: %s, expected: %s", a, e)
+			}
+		})
+	}
+}
+
+type mockEncoder struct{}
+
+func (m *mockEncoder) Encode(obj runtime.Object, w io.Writer) error {
+	_, err := w.Write([]byte("mock-result"))
+	return err
+}
+
+func (m *mockEncoder) Identifier() runtime.Identifier {
+	return runtime.Identifier("mock-identifier")
+}
+
+func TestCacheableObject(t *testing.T) {
+	serializer := runtime.NewBase64Serializer(&mockEncoder{}, nil)
+	runtimetesting.CacheableObjectTest(t, serializer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/conversion.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/conversion.go
new file mode 100644
index 0000000000..7cef382de2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/conversion.go
@@ -0,0 +1,183 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package runtime defines conversions between generic types and structs to map query strings
+// to struct objects.
+package runtime
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/conversion"
+)
+
+// DefaultMetaV1FieldSelectorConversion auto-accepts metav1 values for name and namespace.
+// A cluster scoped resource specifying namespace empty works fine and specifying a particular
+// namespace will return no results, as expected.
+func DefaultMetaV1FieldSelectorConversion(label, value string) (string, string, error) {
+	switch label {
+	case "metadata.name":
+		return label, value, nil
+	case "metadata.namespace":
+		return label, value, nil
+	default:
+		return "", "", fmt.Errorf("%q is not a known field selector: only %q, %q", label, "metadata.name", "metadata.namespace")
+	}
+}
+
+func Convert_Slice_string_To_string(in *[]string, out *string, s conversion.Scope) error {
+	if len(*in) == 0 {
+		*out = ""
+		return nil
+	}
+	*out = (*in)[0]
+	return nil
+}
+
+func Convert_Slice_string_To_int(in *[]string, out *int, s conversion.Scope) error {
+	if len(*in) == 0 {
+		*out = 0
+		return nil
+	}
+	str := (*in)[0]
+	i, err := strconv.Atoi(str)
+	if err != nil {
+		return err
+	}
+	*out = i
+	return nil
+}
+
+// Convert_Slice_string_To_bool will convert a string parameter to boolean.
+// Only the absence of a value (i.e. zero-length slice), a value of "false", or a
+// value of "0" resolve to false.
+// Any other value (including empty string) resolves to true.
+func Convert_Slice_string_To_bool(in *[]string, out *bool, s conversion.Scope) error {
+	if len(*in) == 0 {
+		*out = false
+		return nil
+	}
+	switch {
+	case (*in)[0] == "0", strings.EqualFold((*in)[0], "false"):
+		*out = false
+	default:
+		*out = true
+	}
+	return nil
+}
+
+// Convert_Slice_string_To_bool will convert a string parameter to boolean.
+// Only the absence of a value (i.e. zero-length slice), a value of "false", or a
+// value of "0" resolve to false.
+// Any other value (including empty string) resolves to true.
+func Convert_Slice_string_To_Pointer_bool(in *[]string, out **bool, s conversion.Scope) error {
+	if len(*in) == 0 {
+		boolVar := false
+		*out = &boolVar
+		return nil
+	}
+	switch {
+	case (*in)[0] == "0", strings.EqualFold((*in)[0], "false"):
+		boolVar := false
+		*out = &boolVar
+	default:
+		boolVar := true
+		*out = &boolVar
+	}
+	return nil
+}
+
+func string_to_int64(in string) (int64, error) {
+	return strconv.ParseInt(in, 10, 64)
+}
+
+func Convert_string_To_int64(in *string, out *int64, s conversion.Scope) error {
+	if in == nil {
+		*out = 0
+		return nil
+	}
+	i, err := string_to_int64(*in)
+	if err != nil {
+		return err
+	}
+	*out = i
+	return nil
+}
+
+func Convert_Slice_string_To_int64(in *[]string, out *int64, s conversion.Scope) error {
+	if len(*in) == 0 {
+		*out = 0
+		return nil
+	}
+	i, err := string_to_int64((*in)[0])
+	if err != nil {
+		return err
+	}
+	*out = i
+	return nil
+}
+
+func Convert_string_To_Pointer_int64(in *string, out **int64, s conversion.Scope) error {
+	if in == nil {
+		*out = nil
+		return nil
+	}
+	i, err := string_to_int64(*in)
+	if err != nil {
+		return err
+	}
+	*out = &i
+	return nil
+}
+
+func Convert_Slice_string_To_Pointer_int64(in *[]string, out **int64, s conversion.Scope) error {
+	if len(*in) == 0 {
+		*out = nil
+		return nil
+	}
+	i, err := string_to_int64((*in)[0])
+	if err != nil {
+		return err
+	}
+	*out = &i
+	return nil
+}
+
+func RegisterStringConversions(s *Scheme) error {
+	if err := s.AddConversionFunc((*[]string)(nil), (*string)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_string(a.(*[]string), b.(*string), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (*int)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_int(a.(*[]string), b.(*int), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (*bool)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_bool(a.(*[]string), b.(*bool), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (*int64)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_int64(a.(*[]string), b.(*int64), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/converter.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/converter.go
new file mode 100644
index 0000000000..5aa118f58f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/converter.go
@@ -0,0 +1,887 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	encodingjson "encoding/json"
+	"fmt"
+	"math"
+	"os"
+	"reflect"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"sigs.k8s.io/structured-merge-diff/v6/value"
+
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/util/json"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+
+	"k8s.io/klog/v2"
+)
+
+// UnstructuredConverter is an interface for converting between interface{}
+// and map[string]interface representation.
+type UnstructuredConverter interface {
+	ToUnstructured(obj interface{}) (map[string]interface{}, error)
+	FromUnstructured(u map[string]interface{}, obj interface{}) error
+}
+
+type structField struct {
+	structType reflect.Type
+	field      int
+}
+
+type fieldInfo struct {
+	name      string
+	nameValue reflect.Value
+	omitempty bool
+	omitzero  func(dv reflect.Value) bool
+}
+
+type fieldsCacheMap map[structField]*fieldInfo
+
+type fieldsCache struct {
+	sync.Mutex
+	value atomic.Value
+}
+
+func newFieldsCache() *fieldsCache {
+	cache := &fieldsCache{}
+	cache.value.Store(make(fieldsCacheMap))
+	return cache
+}
+
+var (
+	mapStringInterfaceType = reflect.TypeOf(map[string]interface{}{})
+	stringType             = reflect.TypeOf(string(""))
+	fieldCache             = newFieldsCache()
+
+	// DefaultUnstructuredConverter performs unstructured to Go typed object conversions.
+	DefaultUnstructuredConverter = &unstructuredConverter{
+		mismatchDetection: parseBool(os.Getenv("KUBE_PATCH_CONVERSION_DETECTOR")),
+		comparison: conversion.EqualitiesOrDie(
+			func(a, b time.Time) bool {
+				return a.UTC() == b.UTC()
+			},
+		),
+	}
+)
+
+func parseBool(key string) bool {
+	if len(key) == 0 {
+		return false
+	}
+	value, err := strconv.ParseBool(key)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("couldn't parse '%s' as bool for unstructured mismatch detection", key))
+	}
+	return value
+}
+
+// unstructuredConverter knows how to convert between interface{} and
+// Unstructured in both ways.
+type unstructuredConverter struct {
+	// If true, we will be additionally running conversion via json
+	// to ensure that the result is true.
+	// This is supposed to be set only in tests.
+	mismatchDetection bool
+	// comparison is the default test logic used to compare
+	comparison conversion.Equalities
+}
+
+// NewTestUnstructuredConverter creates an UnstructuredConverter that accepts JSON typed maps and translates them
+// to Go types via reflection. It performs mismatch detection automatically and is intended for use by external
+// test tools. Use DefaultUnstructuredConverter if you do not explicitly need mismatch detection.
+func NewTestUnstructuredConverter(comparison conversion.Equalities) UnstructuredConverter {
+	return NewTestUnstructuredConverterWithValidation(comparison)
+}
+
+// NewTestUnstrucutredConverterWithValidation allows for access to
+// FromUnstructuredWithValidation from within tests.
+func NewTestUnstructuredConverterWithValidation(comparison conversion.Equalities) *unstructuredConverter {
+	return &unstructuredConverter{
+		mismatchDetection: true,
+		comparison:        comparison,
+	}
+}
+
+// fromUnstructuredContext provides options for informing the converter
+// the state of its recursive walk through the conversion process.
+type fromUnstructuredContext struct {
+	// isInlined indicates whether the converter is currently in
+	// an inlined field or not to determine whether it should
+	// validate the matchedKeys yet or only collect them.
+	// This should only be set from `structFromUnstructured`
+	isInlined bool
+	// matchedKeys is a stack of the set of all fields that exist in the
+	// concrete go type of the object being converted into.
+	// This should only be manipulated via `pushMatchedKeyTracker`,
+	// `recordMatchedKey`, or `popAndVerifyMatchedKeys`
+	matchedKeys []map[string]struct{}
+	// parentPath collects the path that the conversion
+	// takes as it traverses the unstructured json map.
+	// It is used to report the full path to any unknown
+	// fields that the converter encounters.
+	parentPath []string
+	// returnUnknownFields indicates whether or not
+	// unknown field errors should be collected and
+	// returned to the caller
+	returnUnknownFields bool
+	// unknownFieldErrors are the collection of
+	// the full path to each unknown field in the
+	// object.
+	unknownFieldErrors []error
+}
+
+// pushMatchedKeyTracker adds a placeholder set for tracking
+// matched keys for the given level. This should only be
+// called from `structFromUnstructured`.
+func (c *fromUnstructuredContext) pushMatchedKeyTracker() {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	c.matchedKeys = append(c.matchedKeys, nil)
+}
+
+// recordMatchedKey initializes the last element of matchedKeys
+// (if needed) and sets 'key'. This should only be called from
+// `structFromUnstructured`.
+func (c *fromUnstructuredContext) recordMatchedKey(key string) {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	last := len(c.matchedKeys) - 1
+	if c.matchedKeys[last] == nil {
+		c.matchedKeys[last] = map[string]struct{}{}
+	}
+	c.matchedKeys[last][key] = struct{}{}
+}
+
+// popAndVerifyMatchedKeys pops the last element of matchedKeys,
+// checks the matched keys against the data, and adds unknown
+// field errors for any matched keys.
+// `mapValue` is the value of sv containing all of the keys that exist at this level
+// (ie. sv.MapKeys) in the source data.
+// `matchedKeys` are all the keys found for that level in the destination object.
+// This should only be called from `structFromUnstructured`.
+func (c *fromUnstructuredContext) popAndVerifyMatchedKeys(mapValue reflect.Value) {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	last := len(c.matchedKeys) - 1
+	curMatchedKeys := c.matchedKeys[last]
+	c.matchedKeys[last] = nil
+	c.matchedKeys = c.matchedKeys[:last]
+	for _, key := range mapValue.MapKeys() {
+		if _, ok := curMatchedKeys[key.String()]; !ok {
+			c.recordUnknownField(key.String())
+		}
+	}
+}
+
+func (c *fromUnstructuredContext) recordUnknownField(field string) {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	pathLen := len(c.parentPath)
+	c.pushKey(field)
+	errPath := strings.Join(c.parentPath, "")
+	c.parentPath = c.parentPath[:pathLen]
+	c.unknownFieldErrors = append(c.unknownFieldErrors, fmt.Errorf(`unknown field "%s"`, errPath))
+}
+
+func (c *fromUnstructuredContext) pushIndex(index int) {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	c.parentPath = append(c.parentPath, "[", strconv.Itoa(index), "]")
+}
+
+func (c *fromUnstructuredContext) pushKey(key string) {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	if len(c.parentPath) > 0 {
+		c.parentPath = append(c.parentPath, ".")
+	}
+	c.parentPath = append(c.parentPath, key)
+
+}
+
+// FromUnstructuredWithValidation converts an object from map[string]interface{} representation into a concrete type.
+// It uses encoding/json/Unmarshaler if object implements it or reflection if not.
+// It takes a validationDirective that indicates how to behave when it encounters unknown fields.
+func (c *unstructuredConverter) FromUnstructuredWithValidation(u map[string]interface{}, obj interface{}, returnUnknownFields bool) error {
+	t := reflect.TypeOf(obj)
+	value := reflect.ValueOf(obj)
+	if t.Kind() != reflect.Pointer || value.IsNil() {
+		return fmt.Errorf("FromUnstructured requires a non-nil pointer to an object, got %v", t)
+	}
+
+	fromUnstructuredContext := &fromUnstructuredContext{
+		returnUnknownFields: returnUnknownFields,
+	}
+	err := fromUnstructured(reflect.ValueOf(u), value.Elem(), fromUnstructuredContext)
+	if c.mismatchDetection {
+		newObj := reflect.New(t.Elem()).Interface()
+		newErr := fromUnstructuredViaJSON(u, newObj)
+		if (err != nil) != (newErr != nil) {
+			//nolint:logcheck // Should not be reached.
+			klog.Fatalf("FromUnstructured unexpected error for %v: error: %v", u, err)
+		}
+		if err == nil && !c.comparison.DeepEqual(obj, newObj) {
+			//nolint:logcheck // Should not be reached.
+			klog.Fatalf("FromUnstructured mismatch\nobj1: %#v\nobj2: %#v", obj, newObj)
+		}
+	}
+	if err != nil {
+		return err
+	}
+	if returnUnknownFields && len(fromUnstructuredContext.unknownFieldErrors) > 0 {
+		sort.Slice(fromUnstructuredContext.unknownFieldErrors, func(i, j int) bool {
+			return fromUnstructuredContext.unknownFieldErrors[i].Error() <
+				fromUnstructuredContext.unknownFieldErrors[j].Error()
+		})
+		return NewStrictDecodingError(fromUnstructuredContext.unknownFieldErrors)
+	}
+	return nil
+}
+
+// FromUnstructured converts an object from map[string]interface{} representation into a concrete type.
+// It uses encoding/json/Unmarshaler if object implements it or reflection if not.
+func (c *unstructuredConverter) FromUnstructured(u map[string]interface{}, obj interface{}) error {
+	return c.FromUnstructuredWithValidation(u, obj, false)
+}
+
+func fromUnstructuredViaJSON(u map[string]interface{}, obj interface{}) error {
+	data, err := json.Marshal(u)
+	if err != nil {
+		return err
+	}
+	return json.Unmarshal(data, obj)
+}
+
+func fromUnstructured(sv, dv reflect.Value, ctx *fromUnstructuredContext) error {
+	sv = unwrapInterface(sv)
+	if !sv.IsValid() {
+		dv.Set(reflect.Zero(dv.Type()))
+		return nil
+	}
+	st, dt := sv.Type(), dv.Type()
+
+	switch dt.Kind() {
+	case reflect.Map, reflect.Slice, reflect.Pointer, reflect.Struct, reflect.Interface:
+		// Those require non-trivial conversion.
+	default:
+		// This should handle all simple types.
+		if st.AssignableTo(dt) {
+			dv.Set(sv)
+			return nil
+		}
+		// We cannot simply use "ConvertibleTo", as JSON doesn't support conversions
+		// between those four groups: bools, integers, floats and string. We need to
+		// do the same.
+		if st.ConvertibleTo(dt) {
+			switch st.Kind() {
+			case reflect.String:
+				switch dt.Kind() {
+				case reflect.String:
+					dv.Set(sv.Convert(dt))
+					return nil
+				}
+			case reflect.Bool:
+				switch dt.Kind() {
+				case reflect.Bool:
+					dv.Set(sv.Convert(dt))
+					return nil
+				}
+			case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+				reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+				switch dt.Kind() {
+				case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+					reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+					dv.Set(sv.Convert(dt))
+					return nil
+				case reflect.Float32, reflect.Float64:
+					dv.Set(sv.Convert(dt))
+					return nil
+				}
+			case reflect.Float32, reflect.Float64:
+				switch dt.Kind() {
+				case reflect.Float32, reflect.Float64:
+					dv.Set(sv.Convert(dt))
+					return nil
+				}
+				if sv.Float() == math.Trunc(sv.Float()) {
+					dv.Set(sv.Convert(dt))
+					return nil
+				}
+			}
+			return fmt.Errorf("cannot convert %s to %s", st.String(), dt.String())
+		}
+	}
+
+	// Check if the object has a custom JSON marshaller/unmarshaller.
+	entry := value.TypeReflectEntryOf(dv.Type())
+	if entry.CanConvertFromUnstructured() {
+		return entry.FromUnstructured(sv, dv)
+	}
+
+	switch dt.Kind() {
+	case reflect.Map:
+		return mapFromUnstructured(sv, dv, ctx)
+	case reflect.Slice:
+		return sliceFromUnstructured(sv, dv, ctx)
+	case reflect.Pointer:
+		return pointerFromUnstructured(sv, dv, ctx)
+	case reflect.Struct:
+		return structFromUnstructured(sv, dv, ctx)
+	case reflect.Interface:
+		return interfaceFromUnstructured(sv, dv)
+	default:
+		return fmt.Errorf("unrecognized type: %v", dt.Kind())
+	}
+
+}
+
+func fieldInfoFromField(structType reflect.Type, field int) *fieldInfo {
+	fieldCacheMap := fieldCache.value.Load().(fieldsCacheMap)
+	if info, ok := fieldCacheMap[structField{structType, field}]; ok {
+		return info
+	}
+
+	// Cache miss - we need to compute the field name.
+	info := &fieldInfo{}
+	typeField := structType.Field(field)
+	jsonTag, exists := typeField.Tag.Lookup("json")
+	if !exists || len(jsonTag) == 0 {
+		if !typeField.Anonymous {
+			// match stdlib behavior for naming fields that don't specify a json tag name
+			info.name = typeField.Name
+		}
+	} else {
+		items := strings.Split(jsonTag, ",")
+		info.name = items[0]
+		if isInlinedFromTag(typeField, items[0], items[1:]) {
+			// match stdlib behavior when controlled by tag
+			info.name = ""
+		} else if len(info.name) == 0 && !typeField.Anonymous {
+			// match stdlib behavior for naming fields that don't specify a json tag name
+			info.name = typeField.Name
+		}
+
+		for i := range items {
+			if i > 0 && items[i] == "omitempty" {
+				info.omitempty = true
+			}
+			if i > 0 && items[i] == "omitzero" {
+				info.omitzero = value.OmitZeroFunc(typeField.Type)
+			}
+		}
+	}
+	info.nameValue = reflect.ValueOf(info.name)
+
+	fieldCache.Lock()
+	defer fieldCache.Unlock()
+	fieldCacheMap = fieldCache.value.Load().(fieldsCacheMap)
+	newFieldCacheMap := make(fieldsCacheMap)
+	for k, v := range fieldCacheMap {
+		newFieldCacheMap[k] = v
+	}
+	newFieldCacheMap[structField{structType, field}] = info
+	fieldCache.value.Store(newFieldCacheMap)
+	return info
+}
+
+func unwrapInterface(v reflect.Value) reflect.Value {
+	for v.Kind() == reflect.Interface {
+		v = v.Elem()
+	}
+	return v
+}
+
+func mapFromUnstructured(sv, dv reflect.Value, ctx *fromUnstructuredContext) error {
+	st, dt := sv.Type(), dv.Type()
+	if st.Kind() != reflect.Map {
+		return fmt.Errorf("cannot restore map from %v", st.Kind())
+	}
+
+	if !st.Key().AssignableTo(dt.Key()) && !st.Key().ConvertibleTo(dt.Key()) {
+		return fmt.Errorf("cannot copy map with non-assignable keys: %v %v", st.Key(), dt.Key())
+	}
+
+	if sv.IsNil() {
+		dv.Set(reflect.Zero(dt))
+		return nil
+	}
+	dv.Set(reflect.MakeMap(dt))
+	for _, key := range sv.MapKeys() {
+		value := reflect.New(dt.Elem()).Elem()
+		if val := unwrapInterface(sv.MapIndex(key)); val.IsValid() {
+			if err := fromUnstructured(val, value, ctx); err != nil {
+				return err
+			}
+		} else {
+			value.Set(reflect.Zero(dt.Elem()))
+		}
+		if st.Key().AssignableTo(dt.Key()) {
+			dv.SetMapIndex(key, value)
+		} else {
+			dv.SetMapIndex(key.Convert(dt.Key()), value)
+		}
+	}
+	return nil
+}
+
+func sliceFromUnstructured(sv, dv reflect.Value, ctx *fromUnstructuredContext) error {
+	st, dt := sv.Type(), dv.Type()
+	if st.Kind() == reflect.String && dt.Elem().Kind() == reflect.Uint8 {
+		// We store original []byte representation as string.
+		// This conversion is allowed, but we need to be careful about
+		// marshaling data appropriately.
+		if len(sv.Interface().(string)) > 0 {
+			marshalled, err := json.Marshal(sv.Interface())
+			if err != nil {
+				return fmt.Errorf("error encoding %s to json: %v", st, err)
+			}
+			// TODO: Is this Unmarshal needed?
+			var data []byte
+			err = json.Unmarshal(marshalled, &data)
+			if err != nil {
+				return fmt.Errorf("error decoding from json: %v", err)
+			}
+			dv.SetBytes(data)
+		} else {
+			dv.Set(reflect.MakeSlice(dt, 0, 0))
+		}
+		return nil
+	}
+	if st.Kind() != reflect.Slice {
+		return fmt.Errorf("cannot restore slice from %v", st.Kind())
+	}
+
+	if sv.IsNil() {
+		dv.Set(reflect.Zero(dt))
+		return nil
+	}
+	dv.Set(reflect.MakeSlice(dt, sv.Len(), sv.Cap()))
+
+	pathLen := len(ctx.parentPath)
+	defer func() {
+		ctx.parentPath = ctx.parentPath[:pathLen]
+	}()
+	for i := 0; i < sv.Len(); i++ {
+		ctx.pushIndex(i)
+		if err := fromUnstructured(sv.Index(i), dv.Index(i), ctx); err != nil {
+			return err
+		}
+		ctx.parentPath = ctx.parentPath[:pathLen]
+	}
+	return nil
+}
+
+func pointerFromUnstructured(sv, dv reflect.Value, ctx *fromUnstructuredContext) error {
+	st, dt := sv.Type(), dv.Type()
+
+	if st.Kind() == reflect.Pointer && sv.IsNil() {
+		dv.Set(reflect.Zero(dt))
+		return nil
+	}
+	dv.Set(reflect.New(dt.Elem()))
+	switch st.Kind() {
+	case reflect.Pointer, reflect.Interface:
+		return fromUnstructured(sv.Elem(), dv.Elem(), ctx)
+	default:
+		return fromUnstructured(sv, dv.Elem(), ctx)
+	}
+}
+
+func structFromUnstructured(sv, dv reflect.Value, ctx *fromUnstructuredContext) error {
+	st, dt := sv.Type(), dv.Type()
+	if st.Kind() != reflect.Map {
+		return fmt.Errorf("cannot restore struct from: %v", st.Kind())
+	}
+
+	pathLen := len(ctx.parentPath)
+	svInlined := ctx.isInlined
+	defer func() {
+		ctx.parentPath = ctx.parentPath[:pathLen]
+		ctx.isInlined = svInlined
+	}()
+	if !svInlined {
+		ctx.pushMatchedKeyTracker()
+	}
+	for i := 0; i < dt.NumField(); i++ {
+		fieldInfo := fieldInfoFromField(dt, i)
+		fv := dv.Field(i)
+
+		if len(fieldInfo.name) == 0 {
+			// This field is inlined, recurse into fromUnstructured again
+			// with the same set of matched keys.
+			ctx.isInlined = true
+			if err := fromUnstructured(sv, fv, ctx); err != nil {
+				return err
+			}
+			ctx.isInlined = svInlined
+		} else {
+			// This field is not inlined so we recurse into
+			// child field of sv corresponding to field i of
+			// dv, with a new set of matchedKeys and updating
+			// the parentPath to indicate that we are one level
+			// deeper.
+			ctx.recordMatchedKey(fieldInfo.name)
+			value := unwrapInterface(sv.MapIndex(fieldInfo.nameValue))
+			if value.IsValid() {
+				ctx.isInlined = false
+				ctx.pushKey(fieldInfo.name)
+				if err := fromUnstructured(value, fv, ctx); err != nil {
+					return err
+				}
+				ctx.parentPath = ctx.parentPath[:pathLen]
+				ctx.isInlined = svInlined
+			} else {
+				fv.Set(reflect.Zero(fv.Type()))
+			}
+		}
+	}
+	if !svInlined {
+		ctx.popAndVerifyMatchedKeys(sv)
+	}
+	return nil
+}
+
+func interfaceFromUnstructured(sv, dv reflect.Value) error {
+	// TODO: Is this conversion safe?
+	dv.Set(sv)
+	return nil
+}
+
+// ToUnstructured converts an object into map[string]interface{} representation.
+// It uses encoding/json/Marshaler if object implements it or reflection if not.
+func (c *unstructuredConverter) ToUnstructured(obj interface{}) (map[string]interface{}, error) {
+	var u map[string]interface{}
+	var err error
+	if unstr, ok := obj.(Unstructured); ok {
+		u = unstr.UnstructuredContent()
+	} else {
+		t := reflect.TypeOf(obj)
+		value := reflect.ValueOf(obj)
+		if t.Kind() != reflect.Pointer || value.IsNil() {
+			return nil, fmt.Errorf("ToUnstructured requires a non-nil pointer to an object, got %v", t)
+		}
+		u = map[string]interface{}{}
+		err = toUnstructured(value.Elem(), reflect.ValueOf(&u).Elem())
+	}
+	if c.mismatchDetection {
+		newUnstr := map[string]interface{}{}
+		newErr := toUnstructuredViaJSON(obj, &newUnstr)
+		if (err != nil) != (newErr != nil) {
+			//nolint:logcheck // Should not be reached.
+			klog.Fatalf("ToUnstructured unexpected error for %v: error: %v; newErr: %v", obj, err, newErr)
+		}
+		if err == nil && !c.comparison.DeepEqual(u, newUnstr) {
+			//nolint:logcheck // Should not be reached.
+			klog.Fatalf("ToUnstructured mismatch\nobj1: %#v\nobj2: %#v", u, newUnstr)
+		}
+	}
+	if err != nil {
+		return nil, err
+	}
+	return u, nil
+}
+
+// DeepCopyJSON deep copies the passed value, assuming it is a valid JSON representation i.e. only contains
+// types produced by json.Unmarshal() and also int64.
+// bool, int64, float64, string, []interface{}, map[string]interface{}, json.Number and nil
+func DeepCopyJSON(x map[string]interface{}) map[string]interface{} {
+	return DeepCopyJSONValue(x).(map[string]interface{})
+}
+
+// DeepCopyJSONValue deep copies the passed value, assuming it is a valid JSON representation i.e. only contains
+// types produced by json.Unmarshal() and also int64.
+// bool, int64, float64, string, []interface{}, map[string]interface{}, json.Number and nil
+func DeepCopyJSONValue(x interface{}) interface{} {
+	switch x := x.(type) {
+	case map[string]interface{}:
+		if x == nil {
+			// Typed nil - an interface{} that contains a type map[string]interface{} with a value of nil
+			return x
+		}
+		clone := make(map[string]interface{}, len(x))
+		for k, v := range x {
+			clone[k] = DeepCopyJSONValue(v)
+		}
+		return clone
+	case []interface{}:
+		if x == nil {
+			// Typed nil - an interface{} that contains a type []interface{} with a value of nil
+			return x
+		}
+		clone := make([]interface{}, len(x))
+		for i, v := range x {
+			clone[i] = DeepCopyJSONValue(v)
+		}
+		return clone
+	case string, int64, bool, float64, nil, encodingjson.Number:
+		return x
+	default:
+		panic(fmt.Errorf("cannot deep copy %T", x))
+	}
+}
+
+func toUnstructuredViaJSON(obj interface{}, u *map[string]interface{}) error {
+	data, err := json.Marshal(obj)
+	if err != nil {
+		return err
+	}
+	return json.Unmarshal(data, u)
+}
+
+func toUnstructured(sv, dv reflect.Value) error {
+	// Check if the object has a custom string converter.
+	entry := value.TypeReflectEntryOf(sv.Type())
+	if entry.CanConvertToUnstructured() {
+		v, err := entry.ToUnstructured(sv)
+		if err != nil {
+			return err
+		}
+		if v != nil {
+			dv.Set(reflect.ValueOf(v))
+		}
+		return nil
+	}
+	st := sv.Type()
+	switch st.Kind() {
+	case reflect.String:
+		dv.Set(reflect.ValueOf(sv.String()))
+		return nil
+	case reflect.Bool:
+		dv.Set(reflect.ValueOf(sv.Bool()))
+		return nil
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		dv.Set(reflect.ValueOf(sv.Int()))
+		return nil
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		val, err := uintToUnstructuredHelper(sv.Uint())
+		if err != nil {
+			return err
+		}
+		dv.Set(reflect.ValueOf(val))
+		return nil
+	case reflect.Float32, reflect.Float64:
+		dv.Set(reflect.ValueOf(sv.Float()))
+		return nil
+	case reflect.Map:
+		return mapToUnstructured(sv, dv)
+	case reflect.Slice:
+		return sliceToUnstructured(sv, dv)
+	case reflect.Pointer:
+		return pointerToUnstructured(sv, dv)
+	case reflect.Struct:
+		return structToUnstructured(sv, dv)
+	case reflect.Interface:
+		return interfaceToUnstructured(sv, dv)
+	default:
+		return fmt.Errorf("unrecognized type: %v", st.Kind())
+	}
+}
+
+func mapToUnstructured(sv, dv reflect.Value) error {
+	st, dt := sv.Type(), dv.Type()
+	if sv.IsNil() {
+		dv.Set(reflect.Zero(dt))
+		return nil
+	}
+	if dt.Kind() == reflect.Interface && dv.NumMethod() == 0 {
+		if st.Key().Kind() == reflect.String {
+			dv.Set(reflect.MakeMap(mapStringInterfaceType))
+			dv = dv.Elem()
+			dt = dv.Type()
+		}
+	}
+	if dt.Kind() != reflect.Map {
+		return fmt.Errorf("cannot convert map to: %v", dt.Kind())
+	}
+
+	if !st.Key().AssignableTo(dt.Key()) && !st.Key().ConvertibleTo(dt.Key()) {
+		return fmt.Errorf("cannot copy map with non-assignable keys: %v %v", st.Key(), dt.Key())
+	}
+
+	for _, key := range sv.MapKeys() {
+		value := reflect.New(dt.Elem()).Elem()
+		if err := toUnstructured(sv.MapIndex(key), value); err != nil {
+			return err
+		}
+		if st.Key().AssignableTo(dt.Key()) {
+			dv.SetMapIndex(key, value)
+		} else {
+			dv.SetMapIndex(key.Convert(dt.Key()), value)
+		}
+	}
+	return nil
+}
+
+func sliceToUnstructured(sv, dv reflect.Value) error {
+	st, dt := sv.Type(), dv.Type()
+	if sv.IsNil() {
+		dv.Set(reflect.Zero(dt))
+		return nil
+	}
+	if st.Elem().Kind() == reflect.Uint8 {
+		dv.Set(reflect.New(stringType))
+		data, err := json.Marshal(sv.Bytes())
+		if err != nil {
+			return err
+		}
+		var result string
+		if err = json.Unmarshal(data, &result); err != nil {
+			return err
+		}
+		dv.Set(reflect.ValueOf(result))
+		return nil
+	}
+	if dt.Kind() == reflect.Interface && dv.NumMethod() == 0 {
+		dv.Set(reflect.MakeSlice(reflect.SliceOf(dt), sv.Len(), sv.Cap()))
+		dv = dv.Elem()
+		dt = dv.Type()
+	}
+	if dt.Kind() != reflect.Slice {
+		return fmt.Errorf("cannot convert slice to: %v", dt.Kind())
+	}
+	for i := 0; i < sv.Len(); i++ {
+		if err := toUnstructured(sv.Index(i), dv.Index(i)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func pointerToUnstructured(sv, dv reflect.Value) error {
+	if sv.IsNil() {
+		// We're done - we don't need to store anything.
+		return nil
+	}
+	return toUnstructured(sv.Elem(), dv)
+}
+
+func isEmpty(v reflect.Value) bool {
+	switch v.Kind() {
+	case reflect.Array, reflect.String:
+		return v.Len() == 0
+	case reflect.Bool:
+		return !v.Bool()
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return v.Int() == 0
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return v.Uint() == 0
+	case reflect.Float32, reflect.Float64:
+		return v.Float() == 0
+	case reflect.Map, reflect.Slice:
+		// TODO: It seems that 0-len maps are ignored in it.
+		return v.IsNil() || v.Len() == 0
+	case reflect.Pointer, reflect.Interface:
+		return v.IsNil()
+	}
+	return false
+}
+
+func structToUnstructured(sv, dv reflect.Value) error {
+	st, dt := sv.Type(), dv.Type()
+	if dt.Kind() == reflect.Interface && dv.NumMethod() == 0 {
+		dv.Set(reflect.MakeMapWithSize(mapStringInterfaceType, st.NumField()))
+		dv = dv.Elem()
+		dt = dv.Type()
+	}
+	if dt.Kind() != reflect.Map {
+		return fmt.Errorf("cannot convert struct to: %v", dt.Kind())
+	}
+	realMap := dv.Interface().(map[string]interface{})
+
+	for i := 0; i < st.NumField(); i++ {
+		fieldInfo := fieldInfoFromField(st, i)
+		fv := sv.Field(i)
+
+		if fieldInfo.name == "-" {
+			// This field should be skipped.
+			continue
+		}
+		if fieldInfo.omitempty && isEmpty(fv) {
+			// omitempty fields should be ignored.
+			continue
+		}
+		if fieldInfo.omitzero != nil && fieldInfo.omitzero(fv) {
+			// omitzero fields should be ignored
+			continue
+		}
+		if len(fieldInfo.name) == 0 {
+			// This field is inlined.
+			if err := toUnstructured(fv, dv); err != nil {
+				return err
+			}
+			continue
+		}
+		switch fv.Type().Kind() {
+		case reflect.String:
+			realMap[fieldInfo.name] = fv.String()
+		case reflect.Bool:
+			realMap[fieldInfo.name] = fv.Bool()
+		case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+			realMap[fieldInfo.name] = fv.Int()
+		case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+			val, err := uintToUnstructuredHelper(fv.Uint())
+			if err != nil {
+				return err
+			}
+			realMap[fieldInfo.name] = val
+		case reflect.Float32, reflect.Float64:
+			realMap[fieldInfo.name] = fv.Float()
+		default:
+			subv := reflect.New(dt.Elem()).Elem()
+			if err := toUnstructured(fv, subv); err != nil {
+				return err
+			}
+			dv.SetMapIndex(fieldInfo.nameValue, subv)
+		}
+	}
+	return nil
+}
+
+func interfaceToUnstructured(sv, dv reflect.Value) error {
+	if !sv.IsValid() || sv.IsNil() {
+		dv.Set(reflect.Zero(dv.Type()))
+		return nil
+	}
+	return toUnstructured(sv.Elem(), dv)
+}
+
+func uintToUnstructuredHelper(uVal uint64) (int64, error) {
+	if uVal > math.MaxInt64 {
+		return 0, fmt.Errorf("unsigned value %d does not fit into int64 (overflow)", uVal)
+	}
+	return int64(uVal), nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/converter_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/converter_test.go
new file mode 100644
index 0000000000..0b6aa5b780
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/converter_test.go
@@ -0,0 +1,1213 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// These tests are in a separate package to break cyclic dependency in tests.
+// Unstructured type depends on unstructured converter package but we want to test how the converter handles
+// the Unstructured type so we need to import both.
+
+package runtime_test
+
+import (
+	encodingjson "encoding/json"
+	"fmt"
+	"reflect"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/json"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sigs.k8s.io/randfill"
+)
+
+var simpleEquality = conversion.EqualitiesOrDie(
+	func(a, b time.Time) bool {
+		return a.UTC() == b.UTC()
+	},
+)
+
+// Define a number of test types.
+type A struct {
+	A int    `json:"aa,omitempty"`
+	B string `json:"ab,omitempty"`
+	C bool   `json:"ac,omitempty"`
+	D uint   `json:"ad,omitempty"`
+}
+
+type B struct {
+	A A                 `json:"ba"`
+	B string            `json:"bb"`
+	C map[string]string `json:"bc"`
+	D []string          `json:"bd"`
+}
+
+type C struct {
+	A []A `json:"ca"`
+	B `json:""`
+	C string         `json:"cc"`
+	D *int64         `json:"cd"`
+	E map[string]int `json:"ce"`
+	F []bool         `json:"cf"`
+	G []int          `json:"cg"`
+	H float32        `json:"ch"`
+	I []interface{}  `json:"ci"`
+}
+
+type D struct {
+	A []interface{} `json:"da"`
+}
+
+type E struct {
+	A interface{} `json:"ea"`
+}
+
+type F struct {
+	A string            `json:"fa"`
+	B map[string]string `json:"fb"`
+	C []A               `json:"fc"`
+	D int               `json:"fd"`
+	E float32           `json:"fe"`
+	F []string          `json:"ff"`
+	G []int             `json:"fg"`
+	H []bool            `json:"fh"`
+	I []float32         `json:"fi"`
+	J []byte            `json:"fj"`
+}
+
+type G struct {
+	CustomValue1   CustomValue    `json:"customValue1"`
+	CustomValue2   *CustomValue   `json:"customValue2"`
+	CustomPointer1 CustomPointer  `json:"customPointer1"`
+	CustomPointer2 *CustomPointer `json:"customPointer2"`
+}
+
+type H struct {
+	A A `json:"ha"`
+	C `json:""`
+}
+
+type I struct {
+	A A `json:"ia"`
+	H `json:""`
+
+	UL1 UnknownLevel1 `json:"ul1"`
+}
+
+type UnknownLevel1 struct {
+	A          int64 `json:"a"`
+	InlinedAA  `json:""`
+	InlinedAAA `json:""`
+}
+type InlinedAA struct {
+	AA int64 `json:"aa"`
+}
+type InlinedAAA struct {
+	AAA   int64         `json:"aaa"`
+	Child UnknownLevel2 `json:"child"`
+}
+
+type UnknownLevel2 struct {
+	B          int64 `json:"b"`
+	InlinedBB  `json:""`
+	InlinedBBB `json:""`
+}
+type InlinedBB struct {
+	BB int64 `json:"bb"`
+}
+type InlinedBBB struct {
+	BBB   int64         `json:"bbb"`
+	Child UnknownLevel3 `json:"child"`
+}
+
+type UnknownLevel3 struct {
+	C          int64 `json:"c"`
+	InlinedCC  `json:""`
+	InlinedCCC `json:""`
+}
+type InlinedCC struct {
+	CC int64 `json:"cc"`
+}
+type InlinedCCC struct {
+	CCC int64 `json:"ccc"`
+}
+
+type CustomValue struct {
+	data []byte
+}
+
+// MarshalJSON has a value receiver on this type.
+func (c CustomValue) MarshalJSON() ([]byte, error) {
+	return c.data, nil
+}
+
+type CustomPointer struct {
+	data []byte
+}
+
+// MarshalJSON has a pointer receiver on this type.
+func (c *CustomPointer) MarshalJSON() ([]byte, error) {
+	return c.data, nil
+}
+
+func doRoundTrip(t *testing.T, item interface{}) {
+	data, err := json.Marshal(item)
+	if err != nil {
+		t.Errorf("Error when marshaling object: %v", err)
+		return
+	}
+
+	unstr := make(map[string]interface{})
+	err = json.Unmarshal(data, &unstr)
+	if err != nil {
+		t.Errorf("Error when unmarshaling to unstructured: %v", err)
+		return
+	}
+
+	data, err = json.Marshal(unstr)
+	if err != nil {
+		t.Errorf("Error when marshaling unstructured: %v", err)
+		return
+	}
+	unmarshalledObj := reflect.New(reflect.TypeOf(item).Elem()).Interface()
+	err = json.Unmarshal(data, unmarshalledObj)
+	if err != nil {
+		t.Errorf("Error when unmarshaling to object: %v", err)
+		return
+	}
+	if !reflect.DeepEqual(item, unmarshalledObj) {
+		t.Errorf("Object changed during JSON operations, diff: %v", cmp.Diff(item, unmarshalledObj))
+		return
+	}
+
+	// TODO: should be using mismatch detection but fails due to another error
+	newUnstr, err := runtime.DefaultUnstructuredConverter.ToUnstructured(item)
+	if err != nil {
+		t.Errorf("ToUnstructured failed: %v", err)
+		return
+	}
+
+	copiedNewUnstr := runtime.DeepCopyJSONValue(newUnstr)
+	if value, ok := copiedNewUnstr.(map[string]interface{}); ok {
+		newUnstr = value
+	} else {
+		t.Errorf("DeepCopyJSONValue return unexpected type %T", copiedNewUnstr)
+		return
+	}
+
+	newObj := reflect.New(reflect.TypeOf(item).Elem()).Interface()
+	err = runtime.NewTestUnstructuredConverter(simpleEquality).FromUnstructured(newUnstr, newObj)
+	if err != nil {
+		t.Errorf("FromUnstructured failed: %v", err)
+		return
+	}
+
+	if !reflect.DeepEqual(item, newObj) {
+		t.Errorf("Object changed, diff: %v", cmp.Diff(item, newObj))
+	}
+}
+
+func TestRoundTrip(t *testing.T) {
+	intVal := int64(42)
+	testCases := []struct {
+		obj interface{}
+	}{
+		{
+			obj: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"kind": "List",
+				},
+				// Not testing a list with nil Items because items is a non-optional field and hence
+				// is always marshaled into an empty array which is not equal to nil when unmarshalled and will fail.
+				// That is expected.
+				Items: []unstructured.Unstructured{},
+			},
+		},
+		{
+			obj: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"kind": "List",
+				},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"kind": "Pod",
+						},
+					},
+				},
+			},
+		},
+		{
+			obj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"kind": "Pod",
+				},
+			},
+		},
+		{
+			obj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Foo",
+					"metadata": map[string]interface{}{
+						"name": "foo1",
+					},
+				},
+			},
+		},
+		{
+			// This (among others) tests nil map, slice and pointer.
+			obj: &C{
+				C: "ccc",
+			},
+		},
+		{
+			// This (among others) tests empty map and slice.
+			obj: &C{
+				A: []A{},
+				C: "ccc",
+				E: map[string]int{},
+				I: []interface{}{},
+			},
+		},
+		{
+			obj: &C{
+				A: []A{
+					{
+						A: 1,
+						B: "11",
+						C: true,
+					},
+					{
+						A: 2,
+						B: "22",
+						C: false,
+					},
+				},
+				B: B{
+					A: A{
+						A: 3,
+						B: "33",
+					},
+					B: "bbb",
+					C: map[string]string{
+						"k1": "v1",
+						"k2": "v2",
+					},
+					D: []string{"s1", "s2"},
+				},
+				C: "ccc",
+				D: &intVal,
+				E: map[string]int{
+					"k1": 1,
+					"k2": 2,
+				},
+				F: []bool{true, false, false},
+				G: []int{1, 2, 5},
+				H: 3.3,
+				I: []interface{}{nil, nil, nil},
+			},
+		},
+		{
+			// Test slice of interface{} with empty slices.
+			obj: &D{
+				A: []interface{}{[]interface{}{}, []interface{}{}},
+			},
+		},
+		{
+			// Test slice of interface{} with different values.
+			obj: &D{
+				A: []interface{}{float64(3.5), int64(4), "3.0", nil},
+			},
+		},
+		{
+			// Test uint values.
+			obj: &A{
+				D: 1,
+			},
+		},
+	}
+
+	for i := range testCases {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			doRoundTrip(t, testCases[i].obj)
+		})
+	}
+}
+
+// TestUnknownFields checks for the collection of unknown
+// field errors from the various possible locations of
+// unknown fields (e.g. fields on struct, inlined struct, slice, etc)
+func TestUnknownFields(t *testing.T) {
+	// simples checks that basic unknown fields are found
+	// in fields, subfields and slices.
+	var simplesData = `{
+"ca": [
+	{
+		"aa": 1,
+		"ab": "ab",
+		"ac": true,
+		"unknown1": 24
+	}
+],
+"cc": "ccstring",
+"unknown2": "foo"
+}`
+
+	var simplesErrs = []string{
+		`unknown field "ca[0].unknown1"`,
+		`unknown field "unknown2"`,
+	}
+
+	// same-name, different-levels checks that
+	// fields at a higher level in the json
+	// are not persisted to unrecognized fields
+	// at lower levels and vice-versa.
+	//
+	// In this case, the field "cc" exists at the root level
+	// but not in the nested field ul1. If we are
+	// improperly retaining matched keys, this not
+	// see an issue with "cc" existing inside "ul1"
+	//
+	// The opposite for "aaa", which exists at the
+	// nested level but not at the root.
+	var sameNameDiffLevelData = `
+	{
+		"cc": "foo",
+		"aaa": 1,
+		"ul1": {
+			"aa": 1,
+			"aaa": 1,
+			"cc": 1
+
+		}
+}`
+	var sameNameDiffLevelErrs = []string{
+		`unknown field "aaa"`,
+		`unknown field "ul1.cc"`,
+	}
+
+	// inlined-inlined confirms that we see
+	// fields that are doubly nested and don't recognize
+	// those that aren't
+	var inlinedInlinedData = `{
+		"bb": "foo",
+		"bc": {
+			"foo": "bar"
+		},
+		"bd": ["d1", "d2"],
+		"aa": 1
+}`
+
+	var inlinedInlinedErrs = []string{
+		`unknown field "aa"`,
+	}
+
+	// combined tests everything together
+	var combinedData = `
+	{
+		"ia": {
+			"aa": 1,
+			"ab": "ab",
+			"unknownI": "foo"
+		},
+		"ha": {
+			"aa": 2,
+			"ab": "ab2",
+			"unknownH": "foo"
+		},
+		"ca":[
+			{
+				"aa":1,
+				"ab":"11",
+				"ac":true
+			},
+			{
+				"aa":2,
+				"ab":"22",
+				"unknown1": "foo"
+			},
+			{
+				"aa":3,
+				"ab":"33",
+				"unknown2": "foo"
+			}
+		],
+		"ba":{
+			"aa":3,
+			"ab":"33",
+			"ac": true,
+			"unknown3": 26,
+			"unknown4": "foo"
+		},
+		"unknown5": "foo",
+		"bb":"bbb",
+		"bc":{
+			"k1":"v1",
+			"k2":"v2"
+		},
+		"bd":[
+			"s1",
+			"s2"
+		],
+		"cc":"ccc",
+		"cd":42,
+		"ce":{
+			"k1":1,
+			"k2":2
+		},
+		"cf":[
+			true,
+			false,
+			false
+		],
+		"cg":
+		[
+			1,
+			2,
+			5
+		],
+		"ch":3.3,
+		"ci":[
+			null,
+			null,
+			null
+		],
+		"ul1": {
+			"a": 1,
+			"aa": 1,
+			"aaa": 1,
+			"b": 1,
+			"bb": 1,
+			"bbb": 1,
+			"c": 1,
+			"cc": 1,
+			"ccc": 1,
+			"child": {
+				"a": 1,
+				"aa": 1,
+				"aaa": 1,
+				"b": 1,
+				"bb": 1,
+				"bbb": 1,
+				"c": 1,
+				"cc": 1,
+				"ccc": 1,
+				"child": {
+					"a": 1,
+					"aa": 1,
+					"aaa": 1,
+					"b": 1,
+					"bb": 1,
+					"bbb": 1,
+					"c": 1,
+					"cc": 1,
+					"ccc": 1
+				}
+			}
+		}
+}`
+
+	var combinedErrs = []string{
+		`unknown field "ca[1].unknown1"`,
+		`unknown field "ca[2].unknown2"`,
+		`unknown field "ba.unknown3"`,
+		`unknown field "ba.unknown4"`,
+		`unknown field "unknown5"`,
+		`unknown field "ha.unknownH"`,
+		`unknown field "ia.unknownI"`,
+
+		`unknown field "ul1.b"`,
+		`unknown field "ul1.bb"`,
+		`unknown field "ul1.bbb"`,
+		`unknown field "ul1.c"`,
+		`unknown field "ul1.cc"`,
+		`unknown field "ul1.ccc"`,
+
+		`unknown field "ul1.child.a"`,
+		`unknown field "ul1.child.aa"`,
+		`unknown field "ul1.child.aaa"`,
+		`unknown field "ul1.child.c"`,
+		`unknown field "ul1.child.cc"`,
+		`unknown field "ul1.child.ccc"`,
+
+		`unknown field "ul1.child.child.a"`,
+		`unknown field "ul1.child.child.aa"`,
+		`unknown field "ul1.child.child.aaa"`,
+		`unknown field "ul1.child.child.b"`,
+		`unknown field "ul1.child.child.bb"`,
+		`unknown field "ul1.child.child.bbb"`,
+	}
+
+	testCases := []struct {
+		jsonData            string
+		obj                 interface{}
+		returnUnknownFields bool
+		expectedErrs        []string
+	}{
+		{
+			jsonData:            simplesData,
+			obj:                 &C{},
+			returnUnknownFields: true,
+			expectedErrs:        simplesErrs,
+		},
+		{
+			jsonData:            simplesData,
+			obj:                 &C{},
+			returnUnknownFields: false,
+		},
+		{
+			jsonData:            sameNameDiffLevelData,
+			obj:                 &I{},
+			returnUnknownFields: true,
+			expectedErrs:        sameNameDiffLevelErrs,
+		},
+		{
+			jsonData:            sameNameDiffLevelData,
+			obj:                 &I{},
+			returnUnknownFields: false,
+		},
+		{
+			jsonData:            inlinedInlinedData,
+			obj:                 &I{},
+			returnUnknownFields: true,
+			expectedErrs:        inlinedInlinedErrs,
+		},
+		{
+			jsonData:            inlinedInlinedData,
+			obj:                 &I{},
+			returnUnknownFields: false,
+		},
+		{
+			jsonData:            combinedData,
+			obj:                 &I{},
+			returnUnknownFields: true,
+			expectedErrs:        combinedErrs,
+		},
+		{
+			jsonData:            combinedData,
+			obj:                 &I{},
+			returnUnknownFields: false,
+		},
+	}
+
+	for i, tc := range testCases {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			unstr := make(map[string]interface{})
+			err := json.Unmarshal([]byte(tc.jsonData), &unstr)
+			if err != nil {
+				t.Errorf("Error when unmarshaling to unstructured: %v", err)
+				return
+			}
+			err = runtime.NewTestUnstructuredConverterWithValidation(simpleEquality).FromUnstructuredWithValidation(unstr, tc.obj, tc.returnUnknownFields)
+			if len(tc.expectedErrs) == 0 && err != nil {
+				t.Errorf("unexpected err: %v", err)
+			}
+			var errString string
+			if err != nil {
+				errString = err.Error()
+			}
+			missedErrs := []string{}
+			failed := false
+			for _, expected := range tc.expectedErrs {
+				if !strings.Contains(errString, expected) {
+					failed = true
+					missedErrs = append(missedErrs, expected)
+				} else {
+					errString = strings.Replace(errString, expected, "", 1)
+				}
+			}
+			if failed {
+				for _, e := range missedErrs {
+					t.Errorf("missing err: %v\n", e)
+				}
+			}
+			leftoverErrors := strings.TrimSpace(strings.TrimPrefix(strings.ReplaceAll(errString, ",", ""), "strict decoding error:"))
+			if leftoverErrors != "" {
+				t.Errorf("found unexpected errors: %s", leftoverErrors)
+			}
+		})
+	}
+}
+
+// BenchmarkFromUnstructuredWithValidation benchmarks
+// the time and memory required to perform FromUnstructured
+// with the various validation directives (Ignore, Warn, Strict)
+func BenchmarkFromUnstructuredWithValidation(b *testing.B) {
+	re := regexp.MustCompile("^I$")
+	f := randfill.NewWithSeed(1).NilChance(0.1).SkipFieldsWithPattern(re)
+	iObj := &I{}
+	f.Fill(&iObj)
+
+	unstr, err := runtime.DefaultUnstructuredConverter.ToUnstructured(iObj)
+	if err != nil {
+		b.Fatalf("ToUnstructured failed: %v", err)
+		return
+	}
+	for _, shouldReturn := range []bool{false, true} {
+		b.Run(fmt.Sprintf("shouldReturn=%t", shouldReturn), func(b *testing.B) {
+			newObj := reflect.New(reflect.TypeOf(iObj).Elem()).Interface()
+			b.ReportAllocs()
+			for i := 0; i < b.N; i++ {
+				if err = runtime.NewTestUnstructuredConverterWithValidation(simpleEquality).FromUnstructuredWithValidation(unstr, newObj, shouldReturn); err != nil {
+					b.Fatalf("FromUnstructured failed: %v", err)
+					return
+				}
+			}
+		})
+	}
+}
+
+// Verifies that:
+// 1) serialized json -> object
+// 2) serialized json -> map[string]interface{} -> object
+// produces the same object.
+func doUnrecognized(t *testing.T, jsonData string, item interface{}, expectedErr error) {
+	unmarshalledObj := reflect.New(reflect.TypeOf(item).Elem()).Interface()
+	err := json.Unmarshal([]byte(jsonData), unmarshalledObj)
+	if (err != nil) != (expectedErr != nil) {
+		t.Errorf("Unexpected error when unmarshaling to object: %v, expected: %v", err, expectedErr)
+		return
+	}
+
+	unstr := make(map[string]interface{})
+	err = json.Unmarshal([]byte(jsonData), &unstr)
+	if err != nil {
+		t.Errorf("Error when unmarshaling to unstructured: %v", err)
+		return
+	}
+	newObj := reflect.New(reflect.TypeOf(item).Elem()).Interface()
+	err = runtime.NewTestUnstructuredConverter(simpleEquality).FromUnstructured(unstr, newObj)
+	if (err != nil) != (expectedErr != nil) {
+		t.Errorf("Unexpected error in FromUnstructured: %v, expected: %v", err, expectedErr)
+	}
+
+	if expectedErr == nil && !reflect.DeepEqual(unmarshalledObj, newObj) {
+		t.Errorf("Object changed, diff: %v", cmp.Diff(unmarshalledObj, newObj))
+	}
+}
+
+func TestUnrecognized(t *testing.T) {
+	testCases := []struct {
+		data string
+		obj  interface{}
+		err  error
+	}{
+		{
+			data: "{\"da\":[3.5,4,\"3.0\",null]}",
+			obj:  &D{},
+		},
+		{
+			data: "{\"ea\":[3.5,4,\"3.0\",null]}",
+			obj:  &E{},
+		},
+		{
+			data: "{\"ea\":[null,null,null]}",
+			obj:  &E{},
+		},
+		{
+			data: "{\"ea\":[[],[null]]}",
+			obj:  &E{},
+		},
+		{
+			data: "{\"ea\":{\"a\":[],\"b\":null}}",
+			obj:  &E{},
+		},
+		{
+			data: "{\"fa\":\"fa\",\"fb\":{\"a\":\"a\"}}",
+			obj:  &F{},
+		},
+		{
+			data: "{\"fa\":\"fa\",\"fb\":{\"a\":null}}",
+			obj:  &F{},
+		},
+		{
+			data: "{\"fc\":[null]}",
+			obj:  &F{},
+		},
+		{
+			data: "{\"fc\":[{\"aa\":123,\"ab\":\"bbb\"}]}",
+			obj:  &F{},
+		},
+		{
+			// Only unknown fields
+			data: "{\"fx\":[{\"aa\":123,\"ab\":\"bbb\"}],\"fz\":123}",
+			obj:  &F{},
+		},
+		{
+			data: "{\"fc\":[{\"aa\":\"aaa\",\"ab\":\"bbb\"}]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal string into Go value of type int"),
+		},
+		{
+			data: "{\"fd\":123,\"fe\":3.5}",
+			obj:  &F{},
+		},
+		{
+			data: "{\"ff\":[\"abc\"],\"fg\":[123],\"fh\":[true,false]}",
+			obj:  &F{},
+		},
+		{
+			data: "{\"fj\":\"\"}",
+			obj:  &F{},
+		},
+		{
+			// Invalid string data
+			data: "{\"fa\":123}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type string"),
+		},
+		{
+			// Invalid string data
+			data: "{\"fa\":13.5}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type string"),
+		},
+		{
+			// Invalid string data
+			data: "{\"fa\":true}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal bool into Go value of type string"),
+		},
+		{
+			// Invalid []string data
+			data: "{\"ff\":123}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type []string"),
+		},
+		{
+			// Invalid []string data
+			data: "{\"ff\":3.5}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type []string"),
+		},
+		{
+			// Invalid []string data
+			data: "{\"ff\":[123,345]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type string"),
+		},
+		{
+			// Invalid []int data
+			data: "{\"fg\":123}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type []int"),
+		},
+		{
+			// Invalid []int data
+			data: "{\"fg\":\"abc\"}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal string into Go value of type []int"),
+		},
+		{
+			// Invalid []int data
+			data: "{\"fg\":[\"abc\"]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal string into Go value of type int"),
+		},
+		{
+			// Invalid []int data
+			data: "{\"fg\":[3.5]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number 3.5 into Go value of type int"),
+		},
+		{
+			// Invalid []int data
+			data: "{\"fg\":[true,false]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number 3.5 into Go value of type int"),
+		},
+		{
+			// Invalid []bool data
+			data: "{\"fh\":123}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type []bool"),
+		},
+		{
+			// Invalid []bool data
+			data: "{\"fh\":\"abc\"}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal string into Go value of type []bool"),
+		},
+		{
+			// Invalid []bool data
+			data: "{\"fh\":[\"abc\"]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal string into Go value of type bool"),
+		},
+		{
+			// Invalid []bool data
+			data: "{\"fh\":[3.5]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type bool"),
+		},
+		{
+			// Invalid []bool data
+			data: "{\"fh\":[123]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type bool"),
+		},
+		{
+			// Invalid []float data
+			data: "{\"fi\":123}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type []float32"),
+		},
+		{
+			// Invalid []float data
+			data: "{\"fi\":\"abc\"}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal string into Go value of type []float32"),
+		},
+		{
+			// Invalid []float data
+			data: "{\"fi\":[\"abc\"]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal string into Go value of type float32"),
+		},
+		{
+			// Invalid []float data
+			data: "{\"fi\":[true]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal bool into Go value of type float32"),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.data, func(t *testing.T) {
+			doUnrecognized(t, tc.data, tc.obj, tc.err)
+		})
+	}
+}
+
+func TestDeepCopyJSON(t *testing.T) {
+	src := map[string]interface{}{
+		"a": nil,
+		"b": int64(123),
+		"c": map[string]interface{}{
+			"a": "b",
+		},
+		"d": []interface{}{
+			int64(1), int64(2),
+		},
+		"e": "estr",
+		"f": true,
+		"g": encodingjson.Number("123"),
+	}
+	deepCopy := runtime.DeepCopyJSON(src)
+	assert.Equal(t, src, deepCopy)
+}
+
+func TestFloatIntConversion(t *testing.T) {
+	unstr := map[string]interface{}{"fd": float64(3)}
+
+	var obj F
+	if err := runtime.NewTestUnstructuredConverter(simpleEquality).FromUnstructured(unstr, &obj); err != nil {
+		t.Errorf("Unexpected error in FromUnstructured: %v", err)
+	}
+
+	data, err := json.Marshal(unstr)
+	if err != nil {
+		t.Fatalf("Error when marshaling unstructured: %v", err)
+	}
+	var unmarshalled F
+	if err := json.Unmarshal(data, &unmarshalled); err != nil {
+		t.Fatalf("Error when unmarshaling to object: %v", err)
+	}
+
+	if !reflect.DeepEqual(obj, unmarshalled) {
+		t.Errorf("Incorrect conversion, diff: %v", cmp.Diff(obj, unmarshalled))
+	}
+}
+
+func TestIntFloatConversion(t *testing.T) {
+	unstr := map[string]interface{}{"ch": int64(3)}
+
+	var obj C
+	if err := runtime.NewTestUnstructuredConverter(simpleEquality).FromUnstructured(unstr, &obj); err != nil {
+		t.Errorf("Unexpected error in FromUnstructured: %v", err)
+	}
+
+	data, err := json.Marshal(unstr)
+	if err != nil {
+		t.Fatalf("Error when marshaling unstructured: %v", err)
+	}
+	var unmarshalled C
+	if err := json.Unmarshal(data, &unmarshalled); err != nil {
+		t.Fatalf("Error when unmarshaling to object: %v", err)
+	}
+
+	if !reflect.DeepEqual(obj, unmarshalled) {
+		t.Errorf("Incorrect conversion, diff: %v", cmp.Diff(obj, unmarshalled))
+	}
+}
+
+func TestCustomToUnstructured(t *testing.T) {
+	testcases := []struct {
+		Data     string
+		Expected interface{}
+	}{
+		{Data: `null`, Expected: nil},
+		{Data: `true`, Expected: true},
+		{Data: `false`, Expected: false},
+		{Data: `[]`, Expected: []interface{}{}},
+		{Data: `[1]`, Expected: []interface{}{int64(1)}},
+		{Data: `{}`, Expected: map[string]interface{}{}},
+		{Data: `{"a":1}`, Expected: map[string]interface{}{"a": int64(1)}},
+		{Data: `0`, Expected: int64(0)},
+		{Data: `0.0`, Expected: float64(0)},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.Data, func(t *testing.T) {
+			t.Parallel()
+			result, err := runtime.NewTestUnstructuredConverter(simpleEquality).ToUnstructured(&G{
+				CustomValue1:   CustomValue{data: []byte(tc.Data)},
+				CustomValue2:   &CustomValue{data: []byte(tc.Data)},
+				CustomPointer1: CustomPointer{data: []byte(tc.Data)},
+				CustomPointer2: &CustomPointer{data: []byte(tc.Data)},
+			})
+			require.NoError(t, err)
+			for field, fieldResult := range result {
+				assert.Equal(t, tc.Expected, fieldResult, field)
+			}
+		})
+	}
+}
+
+func TestCustomToUnstructuredTopLevel(t *testing.T) {
+	// Only objects are supported at the top level
+	topLevelCases := []interface{}{
+		&CustomValue{data: []byte(`{"a":1}`)},
+		&CustomPointer{data: []byte(`{"a":1}`)},
+	}
+	expected := map[string]interface{}{"a": int64(1)}
+	for i, obj := range topLevelCases {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			t.Parallel()
+			result, err := runtime.NewTestUnstructuredConverter(simpleEquality).ToUnstructured(obj)
+			require.NoError(t, err)
+			assert.Equal(t, expected, result)
+		})
+	}
+}
+
+type OmitemptyNameField struct {
+	I int `json:"omitempty"`
+}
+
+func TestOmitempty(t *testing.T) {
+	expected := `{"omitempty":0}`
+
+	o := &OmitemptyNameField{}
+	jsonData, err := json.Marshal(o)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if e, a := expected, string(jsonData); e != a {
+		t.Fatalf("expected\n%s\ngot\n%s", e, a)
+	}
+
+	unstr, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&o)
+	if err != nil {
+		t.Fatal(err)
+	}
+	jsonUnstrData, err := json.Marshal(unstr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if e, a := expected, string(jsonUnstrData); e != a {
+		t.Fatalf("expected\n%s\ngot\n%s", e, a)
+	}
+}
+
+type InlineTestPrimitive struct {
+	NoNameTagPrimitive          int64 `json:""`
+	NoNameTagInlinePrimitive    int64 `json:",inline"`
+	NoNameTagOmitemptyPrimitive int64 `json:",omitempty"`
+}
+type InlineTestAnonymous struct {
+	NoTag
+	NoNameTag          `json:""`
+	NameTag            `json:"nameTagEmbedded"`
+	NoNameTagInline    `json:",inline"`
+	NoNameTagEmbed     `json:",embed"` //nolint:staticcheck // SA5008 intentionally exercising a tag not present until Go 1.27
+	NoNameTagOmitempty `json:",omitempty"`
+}
+type InlineTestNamed struct {
+	NoTag              NoTag
+	NoNameTag          NoNameTag          `json:""`
+	NameTag            NameTag            `json:"nameTagEmbedded"`
+	NoNameTagInline    NoNameTagInline    `json:",inline"`
+	NoNameTagEmbed     NoNameTagEmbed     `json:",embed"` //nolint:staticcheck // intentionally exercising a tag not present until Go 1.27
+	NoNameTagOmitempty NoNameTagOmitempty `json:",omitempty"`
+}
+type NoTag struct {
+	Data0 int `json:"data0"`
+}
+type NameTag struct {
+	Data1 int `json:"data1"`
+}
+type NoNameTag struct {
+	Data2 int `json:"data2"`
+}
+type NoNameTagInline struct {
+	Data3 int `json:"data3"`
+}
+type NoNameTagOmitempty struct {
+	Data4 int `json:"data4"`
+}
+type NoNameTagEmbed struct {
+	Data5 int `json:"data5"`
+}
+
+func TestInline(t *testing.T) {
+	testcases := []struct {
+		name   string
+		obj    any
+		expect map[string]any
+	}{
+		{
+			name: "primitive-zero",
+			obj:  &InlineTestPrimitive{},
+			expect: map[string]any{
+				"NoNameTagPrimitive":       int64(0),
+				"NoNameTagInlinePrimitive": int64(0),
+			},
+		},
+		{
+			name: "primitive-set",
+			obj: &InlineTestPrimitive{
+				NoNameTagPrimitive:          1,
+				NoNameTagInlinePrimitive:    2,
+				NoNameTagOmitemptyPrimitive: 3,
+			},
+			expect: map[string]any{
+				"NoNameTagPrimitive":          int64(1),
+				"NoNameTagInlinePrimitive":    int64(2),
+				"NoNameTagOmitemptyPrimitive": int64(3),
+			},
+		},
+		{
+			name: "anonymous-zero",
+			obj:  &InlineTestAnonymous{},
+			expect: map[string]any{
+				"data0":           int64(0),
+				"data2":           int64(0),
+				"data3":           int64(0),
+				"data4":           int64(0),
+				"data5":           int64(0),
+				"nameTagEmbedded": map[string]any{"data1": int64(0)},
+			},
+		},
+		{
+			name: "anonymous-set",
+			obj:  &InlineTestAnonymous{},
+			expect: map[string]any{
+				"data0":           int64(0),
+				"data2":           int64(0),
+				"data3":           int64(0),
+				"data4":           int64(0),
+				"data5":           int64(0),
+				"nameTagEmbedded": map[string]any{"data1": int64(0)},
+			},
+		},
+		{
+			name: "named-zero",
+			obj:  &InlineTestNamed{},
+			expect: func() map[string]any {
+				m := map[string]any{
+					"NoTag":              map[string]any{"data0": int64(0)},
+					"nameTagEmbedded":    map[string]any{"data1": int64(0)},
+					"NoNameTag":          map[string]any{"data2": int64(0)},
+					"NoNameTagInline":    map[string]any{"data3": int64(0)},
+					"NoNameTagOmitempty": map[string]any{"data4": int64(0)},
+				}
+				if stdlibSupportsEmbedTag {
+					m["data5"] = int64(0)
+				} else {
+					m["NoNameTagEmbed"] = map[string]any{"data5": int64(0)}
+				}
+				return m
+			}(),
+		},
+		{
+			name: "named-set",
+			obj: &InlineTestNamed{
+				NoTag:              NoTag{Data0: 10},
+				NameTag:            NameTag{Data1: 11},
+				NoNameTag:          NoNameTag{Data2: 12},
+				NoNameTagInline:    NoNameTagInline{Data3: 13},
+				NoNameTagOmitempty: NoNameTagOmitempty{Data4: 14},
+				NoNameTagEmbed:     NoNameTagEmbed{Data5: 15},
+			},
+			expect: func() map[string]any {
+				m := map[string]any{
+					"NoTag":              map[string]any{"data0": int64(10)},
+					"nameTagEmbedded":    map[string]any{"data1": int64(11)},
+					"NoNameTag":          map[string]any{"data2": int64(12)},
+					"NoNameTagInline":    map[string]any{"data3": int64(13)},
+					"NoNameTagOmitempty": map[string]any{"data4": int64(14)},
+				}
+				if stdlibSupportsEmbedTag {
+					m["data5"] = int64(15)
+				} else {
+					m["NoNameTagEmbed"] = map[string]any{"data5": int64(15)}
+				}
+				return m
+			}(),
+		},
+	}
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				// handle panics
+				if err := recover(); err != nil {
+					t.Fatal(err)
+				}
+			}()
+
+			// Check the expectation against stdlib
+			jsonData, err := json.Marshal(tc.obj)
+			if err != nil {
+				t.Fatal(err)
+			}
+			jsonUnstr := map[string]any{}
+			if err := json.Unmarshal(jsonData, &jsonUnstr); err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(tc.expect, jsonUnstr) {
+				t.Fatal(cmp.Diff(tc.expect, jsonUnstr))
+			}
+
+			// Check the expectation against DefaultUnstructuredConverter.ToUnstructured
+			unstr, err := runtime.DefaultUnstructuredConverter.ToUnstructured(tc.obj)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(tc.expect, unstr) {
+				t.Fatal(cmp.Diff(tc.expect, unstr))
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/converter_zero_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/converter_zero_test.go
new file mode 100644
index 0000000000..e807115a0e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/converter_zero_test.go
@@ -0,0 +1,359 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// These tests are in a separate package to break cyclic dependency in tests.
+// Unstructured type depends on unstructured converter package but we want to test how the converter handles
+// the Unstructured type so we need to import both.
+
+package runtime
+
+import (
+	encodingjson "encoding/json"
+	"fmt"
+	"reflect"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/json"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+type ZeroParent struct {
+	Int               int                    `json:"int,omitzero"`
+	IntP              *int                   `json:"intP,omitzero"`
+	String            string                 `json:"string,omitzero"`
+	StringP           *string                `json:"stringP,omitzero"`
+	Bool              bool                   `json:"bool,omitzero"`
+	BoolP             bool                   `json:"boolP,omitzero"`
+	Slice             []int                  `json:"slice,omitzero"`
+	SliceP            *[]int                 `json:"sliceP,omitzero"`
+	Map               map[string]int         `json:"map,omitzero"`
+	MapP              *map[string]int        `json:"mapP,omitzero"`
+	Struct            ZeroChild              `json:"struct,omitzero"`
+	StructP           *ZeroChild             `json:"structP,omitzero"`
+	CustomPrimitive   ZeroCustomPrimitive    `json:"customPrimitive,omitzero"`
+	CustomPrimitiveP  *ZeroCustomPrimitiveP  `json:"customPrimitiveP,omitzero"`
+	CustomStruct      ZeroCustomStruct       `json:"customStruct,omitzero"`
+	CustomStructP     *ZeroCustomStructP     `json:"customStructP,omitzero"`
+	CustomPPrimitive  ZeroCustomPPrimitive   `json:"customPPrimitive,omitzero"`
+	CustomPPrimitiveP *ZeroCustomPPrimitiveP `json:"customPPrimitiveP,omitzero"`
+	CustomPStruct     ZeroCustomPStruct      `json:"customPStruct,omitzero"`
+	CustomPStructP    *ZeroCustomPStructP    `json:"customPStructP,omitzero"`
+}
+type ZeroChild struct {
+	Data int `json:"data"`
+}
+
+type ZeroCustomPrimitive int
+
+func (z ZeroCustomPrimitive) IsZero() bool {
+	return z == 42
+}
+
+type ZeroCustomPrimitiveP int
+
+func (z ZeroCustomPrimitiveP) IsZero() bool {
+	return z == 42
+}
+
+type ZeroCustomStruct struct {
+	Data int `json:"data"`
+}
+
+func (z ZeroCustomStruct) IsZero() bool {
+	return z.Data == 42
+}
+
+type ZeroCustomStructP struct {
+	Data int `json:"data"`
+}
+
+func (z ZeroCustomStructP) IsZero() bool {
+	return z.Data == 42
+}
+
+type ZeroCustomPPrimitive int
+
+func (z *ZeroCustomPPrimitive) IsZero() bool {
+	return *z == 42
+}
+
+type ZeroCustomPPrimitiveP int
+
+func (z *ZeroCustomPPrimitiveP) IsZero() bool {
+	return *z == 42
+}
+
+type ZeroCustomPStruct struct {
+	Data int `json:"data"`
+}
+
+func (z *ZeroCustomPStruct) IsZero() bool {
+	return z.Data == 42
+}
+
+type ZeroCustomPStructP struct {
+	Data int `json:"data"`
+}
+
+func (z *ZeroCustomPStructP) IsZero() bool {
+	return z.Data == 42
+}
+
+func TestOmitZero2(t *testing.T) {
+	testcases := []struct {
+		name   string
+		obj    any
+		expect map[string]any
+	}{
+		{
+			name: "emptyzero",
+			obj:  &ZeroParent{},
+			expect: map[string]any{
+				"customPPrimitive": int64(0),
+				"customPStruct":    map[string]any{"data": int64(0)},
+				"customPrimitive":  int64(0),
+				"customStruct":     map[string]any{"data": int64(0)},
+			},
+		},
+	}
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			jsonData, err := json.Marshal(tc.obj)
+			if err != nil {
+				t.Fatal(err)
+			}
+			jsonUnstructured := map[string]any{}
+			if err := json.Unmarshal(jsonData, &jsonUnstructured); err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(jsonUnstructured, tc.expect) {
+				t.Fatal(cmp.Diff(tc.expect, jsonUnstructured))
+			}
+
+			unstr, err := DefaultUnstructuredConverter.ToUnstructured(tc.obj)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(unstr, tc.expect) {
+				t.Fatal(cmp.Diff(tc.expect, unstr))
+			}
+		})
+	}
+}
+
+type NonZeroStruct struct{}
+
+func (nzs NonZeroStruct) IsZero() bool {
+	return false
+}
+
+type NoPanicStruct struct {
+	Int int `json:"int,omitzero"`
+}
+
+func (nps *NoPanicStruct) IsZero() bool {
+	return nps.Int != 0
+}
+
+type isZeroer interface {
+	IsZero() bool
+}
+
+type OptionalsZero struct {
+	Sr string `json:"sr"`
+	So string `json:"so,omitzero"`
+	Sw string `json:"-"`
+
+	Ir int `json:"omitzero"` // actually named omitzero, not an option
+	Io int `json:"io,omitzero"`
+
+	Slr       []string `json:"slr,random"` //nolint:staticcheck // SA5008
+	Slo       []string `json:"slo,omitzero"`
+	SloNonNil []string `json:"slononnil,omitzero"`
+
+	Mr  map[string]any `json:"mr"`
+	Mo  map[string]any `json:",omitzero"`
+	Moo map[string]any `json:"moo,omitzero"`
+
+	Fr   float64    `json:"fr"`
+	Fo   float64    `json:"fo,omitzero"`
+	Foo  float64    `json:"foo,omitzero"`
+	Foo2 [2]float64 `json:"foo2,omitzero"`
+
+	Br bool `json:"br"`
+	Bo bool `json:"bo,omitzero"`
+
+	Ur uint `json:"ur"`
+	Uo uint `json:"uo,omitzero"`
+
+	Str struct{} `json:"str"`
+	Sto struct{} `json:"sto,omitzero"`
+
+	Time      time.Time     `json:"time,omitzero"`
+	TimeLocal time.Time     `json:"timelocal,omitzero"`
+	Nzs       NonZeroStruct `json:"nzs,omitzero"`
+
+	NilIsZeroer    isZeroer       `json:"niliszeroer,omitzero"`    // nil interface
+	NonNilIsZeroer isZeroer       `json:"nonniliszeroer,omitzero"` // non-nil interface
+	NoPanicStruct0 isZeroer       `json:"nps0,omitzero"`           // non-nil interface with nil pointer
+	NoPanicStruct1 isZeroer       `json:"nps1,omitzero"`           // non-nil interface with non-nil pointer
+	NoPanicStruct2 *NoPanicStruct `json:"nps2,omitzero"`           // nil pointer
+	NoPanicStruct3 *NoPanicStruct `json:"nps3,omitzero"`           // non-nil pointer
+	NoPanicStruct4 NoPanicStruct  `json:"nps4,omitzero"`           // concrete type
+}
+
+func TestOmitZero(t *testing.T) {
+	const want = `{
+ "Mo": {},
+ "br": false,
+ "fr": 0,
+ "mr": {},
+ "nps1": {},
+ "nps3": {},
+ "nps4": {},
+ "nzs": {},
+ "omitzero": 0,
+ "slononnil": [],
+ "slr": null,
+ "sr": "",
+ "str": {},
+ "ur": 0
+}`
+	var o OptionalsZero
+	o.Sw = "something"
+	o.SloNonNil = make([]string, 0)
+	o.Mr = map[string]any{}
+	o.Mo = map[string]any{}
+
+	o.Foo = -0
+	o.Foo2 = [2]float64{+0, -0}
+
+	o.TimeLocal = time.Time{}.Local()
+
+	o.NonNilIsZeroer = time.Time{}
+	o.NoPanicStruct0 = (*NoPanicStruct)(nil)
+	o.NoPanicStruct1 = &NoPanicStruct{}
+	o.NoPanicStruct3 = &NoPanicStruct{}
+
+	unstr, err := DefaultUnstructuredConverter.ToUnstructured(&o)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := encodingjson.MarshalIndent(unstr, "", " ")
+	if err != nil {
+		t.Fatalf("MarshalIndent error: %v", err)
+	}
+	if got := string(got); got != want {
+		t.Errorf("MarshalIndent:\n\tgot:  %s\n\twant: %s\n", got, want)
+	}
+}
+
+func TestOmitZeroMap(t *testing.T) {
+	const want = `{
+ "foo": {
+  "br": false,
+  "fr": 0,
+  "mr": null,
+  "nps4": {},
+  "nzs": {},
+  "omitzero": 0,
+  "slr": null,
+  "sr": "",
+  "str": {},
+  "ur": 0
+ }
+}`
+
+	m := map[string]OptionalsZero{"foo": {}}
+
+	unstr, err := DefaultUnstructuredConverter.ToUnstructured(&m)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := encodingjson.MarshalIndent(unstr, "", " ")
+	if err != nil {
+		t.Fatalf("MarshalIndent error: %v", err)
+	}
+	if got := string(got); got != want {
+		fmt.Println(got)
+		t.Errorf("MarshalIndent:\n\tgot:  %s\n\twant: %s\n", got, want)
+	}
+}
+
+type OptionalsEmptyZero struct {
+	Sr string `json:"sr"`
+	So string `json:"so,omitempty,omitzero"`
+	Sw string `json:"-"`
+
+	Io int `json:"io,omitempty,omitzero"`
+
+	Slr       []string `json:"slr,random"` //nolint:staticcheck // SA5008
+	Slo       []string `json:"slo,omitempty,omitzero"`
+	SloNonNil []string `json:"slononnil,omitempty,omitzero"`
+
+	Mr map[string]any `json:"mr"`
+	Mo map[string]any `json:",omitempty,omitzero"`
+
+	Fr float64 `json:"fr"`
+	Fo float64 `json:"fo,omitempty,omitzero"`
+
+	Br bool `json:"br"`
+	Bo bool `json:"bo,omitempty,omitzero"`
+
+	Ur uint `json:"ur"`
+	Uo uint `json:"uo,omitempty,omitzero"`
+
+	Str struct{} `json:"str"`
+	Sto struct{} `json:"sto,omitempty,omitzero"`
+
+	Time time.Time     `json:"time,omitempty,omitzero"`
+	Nzs  NonZeroStruct `json:"nzs,omitempty,omitzero"`
+}
+
+func TestOmitEmptyZero(t *testing.T) {
+	const want = `{
+ "br": false,
+ "fr": 0,
+ "mr": {},
+ "nzs": {},
+ "slr": null,
+ "sr": "",
+ "str": {},
+ "ur": 0
+}`
+	var o OptionalsEmptyZero
+	o.Sw = "something"
+	o.SloNonNil = make([]string, 0)
+	o.Mr = map[string]any{}
+	o.Mo = map[string]any{}
+
+	unstr, err := DefaultUnstructuredConverter.ToUnstructured(&o)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := encodingjson.MarshalIndent(unstr, "", " ")
+	if err != nil {
+		t.Fatalf("MarshalIndent error: %v", err)
+	}
+	if got := string(got); got != want {
+		t.Errorf("MarshalIndent:\n\tgot:  %s\n\twant: %s\n", got, want)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/doc.go
new file mode 100644
index 0000000000..fd012dbc79
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/doc.go
@@ -0,0 +1,53 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.runtime
+
+// Package runtime includes helper functions for working with API objects
+// that follow the kubernetes API object conventions, which are:
+//
+// 0. Your API objects have a common metadata struct member, TypeMeta.
+//
+// 1. Your code refers to an internal set of API objects.
+//
+// 2. In a separate package, you have an external set of API objects.
+//
+// 3. The external set is considered to be versioned, and no breaking
+// changes are ever made to it (fields may be added but not changed
+// or removed).
+//
+// 4. As your api evolves, you'll make an additional versioned package
+// with every major change.
+//
+// 5. Versioned packages have conversion functions which convert to
+// and from the internal version.
+//
+// 6. You'll continue to support older versions according to your
+// deprecation policy, and you can easily provide a program/library
+// to update old versions into new versions because of 5.
+//
+// 7. All of your serializations and deserializations are handled in a
+// centralized place.
+//
+// Package runtime provides a conversion helper to make 5 easy, and the
+// Encode/Decode/DecodeInto trio to accomplish 7. You can also register
+// additional "codecs" which use a version of your choice. It's
+// recommended that you register your types with runtime in your
+// package's init function.
+//
+// As a bonus, a few common types useful from all api objects and versions
+// are provided in types.go.
+package runtime
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/embedded.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/embedded.go
new file mode 100644
index 0000000000..7251e65f6e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/embedded.go
@@ -0,0 +1,149 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"errors"
+
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type encodable struct {
+	E        Encoder `json:"-"`
+	obj      Object
+	versions []schema.GroupVersion
+}
+
+func (e encodable) GetObjectKind() schema.ObjectKind { return e.obj.GetObjectKind() }
+func (e encodable) DeepCopyObject() Object {
+	out := e
+	out.obj = e.obj.DeepCopyObject()
+	copy(out.versions, e.versions)
+	return out
+}
+
+// NewEncodable creates an object that will be encoded with the provided codec on demand.
+// Provided as a convenience for test cases dealing with internal objects.
+func NewEncodable(e Encoder, obj Object, versions ...schema.GroupVersion) Object {
+	if _, ok := obj.(*Unknown); ok {
+		return obj
+	}
+	return encodable{e, obj, versions}
+}
+
+func (e encodable) UnmarshalJSON(in []byte) error {
+	return errors.New("runtime.encodable cannot be unmarshalled from JSON")
+}
+
+// Marshal may get called on pointers or values, so implement MarshalJSON on value.
+// http://stackoverflow.com/questions/21390979/custom-marshaljson-never-gets-called-in-go
+func (e encodable) MarshalJSON() ([]byte, error) {
+	return Encode(e.E, e.obj)
+}
+
+// NewEncodableList creates an object that will be encoded with the provided codec on demand.
+// Provided as a convenience for test cases dealing with internal objects.
+func NewEncodableList(e Encoder, objects []Object, versions ...schema.GroupVersion) []Object {
+	out := make([]Object, len(objects))
+	for i := range objects {
+		if _, ok := objects[i].(*Unknown); ok {
+			out[i] = objects[i]
+			continue
+		}
+		out[i] = NewEncodable(e, objects[i], versions...)
+	}
+	return out
+}
+
+func (e *Unknown) UnmarshalJSON(in []byte) error {
+	if e == nil {
+		return errors.New("runtime.Unknown: UnmarshalJSON on nil pointer")
+	}
+	e.TypeMeta = TypeMeta{}
+	e.Raw = append(e.Raw[0:0], in...)
+	e.ContentEncoding = ""
+	e.ContentType = ContentTypeJSON
+	return nil
+}
+
+// Marshal may get called on pointers or values, so implement MarshalJSON on value.
+// http://stackoverflow.com/questions/21390979/custom-marshaljson-never-gets-called-in-go
+func (e Unknown) MarshalJSON() ([]byte, error) {
+	// If ContentType is unset, we assume this is JSON.
+	if e.ContentType != "" && e.ContentType != ContentTypeJSON {
+		return nil, errors.New("runtime.Unknown: MarshalJSON on non-json data")
+	}
+	if e.Raw == nil {
+		return []byte("null"), nil
+	}
+	return e.Raw, nil
+}
+
+func Convert_runtime_Object_To_runtime_RawExtension(in *Object, out *RawExtension, s conversion.Scope) error {
+	if in == nil {
+		out.Raw = []byte("null")
+		return nil
+	}
+	obj := *in
+	if unk, ok := obj.(*Unknown); ok {
+		if unk.Raw != nil {
+			out.Raw = unk.Raw
+			return nil
+		}
+		obj = out.Object
+	}
+	if obj == nil {
+		out.Raw = nil
+		return nil
+	}
+	out.Object = obj
+	return nil
+}
+
+func Convert_runtime_RawExtension_To_runtime_Object(in *RawExtension, out *Object, s conversion.Scope) error {
+	if in.Object != nil {
+		*out = in.Object
+		return nil
+	}
+	data := in.Raw
+	if len(data) == 0 || (len(data) == 4 && string(data) == "null") {
+		*out = nil
+		return nil
+	}
+	*out = &Unknown{
+		Raw: data,
+		// TODO: Set ContentEncoding and ContentType appropriately.
+		// Currently we set ContentTypeJSON to make tests passing.
+		ContentType: ContentTypeJSON,
+	}
+	return nil
+}
+
+func RegisterEmbeddedConversions(s *Scheme) error {
+	if err := s.AddConversionFunc((*Object)(nil), (*RawExtension)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_runtime_Object_To_runtime_RawExtension(a.(*Object), b.(*RawExtension), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*RawExtension)(nil), (*Object)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_runtime_RawExtension_To_runtime_Object(a.(*RawExtension), b.(*Object), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/embedded_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/embedded_test.go
new file mode 100644
index 0000000000..ded6584730
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/embedded_test.go
@@ -0,0 +1,261 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime_test
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+	"k8s.io/apimachinery/pkg/util/diff"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+func TestDecodeEmptyRawExtensionAsObject(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "v1test"}
+	externalGVK := externalGV.WithKind("ObjectTest")
+
+	s := runtime.NewScheme()
+	s.AddKnownTypes(internalGV, &runtimetesting.ObjectTest{})
+	s.AddKnownTypeWithName(externalGVK, &runtimetesting.ObjectTestExternal{})
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+
+	codec := serializer.NewCodecFactory(s).LegacyCodec(externalGV)
+
+	obj, gvk, err := codec.Decode([]byte(`{"kind":"`+externalGVK.Kind+`","apiVersion":"`+externalGV.String()+`","items":[{}]}`), nil, nil)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	test := obj.(*runtimetesting.ObjectTest)
+	if unk, ok := test.Items[0].(*runtime.Unknown); !ok || unk.Kind != "" || unk.APIVersion != "" || string(unk.Raw) != "{}" || unk.ContentType != runtime.ContentTypeJSON {
+		t.Fatalf("unexpected object: %#v", test.Items[0])
+	}
+	if *gvk != externalGVK {
+		t.Fatalf("unexpected kind: %#v", gvk)
+	}
+
+	obj, gvk, err = codec.Decode([]byte(`{"kind":"`+externalGVK.Kind+`","apiVersion":"`+externalGV.String()+`","items":[{"kind":"Other","apiVersion":"v1"}]}`), nil, nil)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	test = obj.(*runtimetesting.ObjectTest)
+	if unk, ok := test.Items[0].(*runtime.Unknown); !ok || unk.Kind != "" || unk.APIVersion != "" || string(unk.Raw) != `{"kind":"Other","apiVersion":"v1"}` || unk.ContentType != runtime.ContentTypeJSON {
+		t.Fatalf("unexpected object: %#v", test.Items[0])
+	}
+	if *gvk != externalGVK {
+		t.Fatalf("unexpected kind: %#v", gvk)
+	}
+}
+
+func TestArrayOfRuntimeObject(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "v1test"}
+
+	s := runtime.NewScheme()
+	s.AddKnownTypes(internalGV, &runtimetesting.EmbeddedTest{})
+	s.AddKnownTypeWithName(externalGV.WithKind("EmbeddedTest"), &runtimetesting.EmbeddedTestExternal{})
+	s.AddKnownTypes(internalGV, &runtimetesting.ObjectTest{})
+	s.AddKnownTypeWithName(externalGV.WithKind("ObjectTest"), &runtimetesting.ObjectTestExternal{})
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+
+	codec := serializer.NewCodecFactory(s).LegacyCodec(externalGV)
+
+	innerItems := []runtime.Object{
+		&runtimetesting.EmbeddedTest{ID: "baz"},
+	}
+	items := []runtime.Object{
+		&runtimetesting.EmbeddedTest{ID: "foo"},
+		&runtimetesting.EmbeddedTest{ID: "bar"},
+		// TODO: until YAML is removed, this JSON must be in ascending key order to ensure consistent roundtrip serialization
+		&runtime.Unknown{
+			Raw:         []byte(`{"apiVersion":"unknown.group/unknown","foo":"bar","kind":"OtherTest"}`),
+			ContentType: runtime.ContentTypeJSON,
+		},
+		&runtimetesting.ObjectTest{
+			Items: runtime.NewEncodableList(codec, innerItems),
+		},
+	}
+	internal := &runtimetesting.ObjectTest{
+		Items: runtime.NewEncodableList(codec, items),
+	}
+	wire, err := runtime.Encode(codec, internal)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	t.Logf("Wire format is:\n%s\n", string(wire))
+
+	obj := &runtimetesting.ObjectTestExternal{}
+	if err := json.Unmarshal(wire, obj); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	t.Logf("exact wire is: %s", string(obj.Items[0].Raw))
+
+	items[3] = &runtimetesting.ObjectTest{Items: innerItems}
+	internal.Items = items
+
+	decoded, err := runtime.Decode(codec, wire)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	list, err := meta.ExtractList(decoded)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if errs := runtime.DecodeList(list, codec); len(errs) > 0 {
+		t.Fatalf("unexpected error: %v", errs)
+	}
+
+	list2, err := meta.ExtractList(list[3])
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if errs := runtime.DecodeList(list2, codec); len(errs) > 0 {
+		t.Fatalf("unexpected error: %v", errs)
+	}
+	if err := meta.SetList(list[3], list2); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// we want DecodeList to set type meta if possible, even on runtime.Unknown objects
+	internal.Items[2].(*runtime.Unknown).TypeMeta = runtime.TypeMeta{Kind: "OtherTest", APIVersion: "unknown.group/unknown"}
+	if e, a := internal.Items, list; !reflect.DeepEqual(e, a) {
+		t.Errorf("mismatched decoded: %s", diff.ObjectGoPrintSideBySide(e, a))
+	}
+}
+
+func TestNestedObject(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "v1test"}
+	embeddedTestExternalGVK := externalGV.WithKind("EmbeddedTest")
+
+	s := runtime.NewScheme()
+	s.AddKnownTypes(internalGV, &runtimetesting.EmbeddedTest{})
+	s.AddKnownTypeWithName(embeddedTestExternalGVK, &runtimetesting.EmbeddedTestExternal{})
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+
+	codec := serializer.NewCodecFactory(s).LegacyCodec(externalGV)
+
+	inner := &runtimetesting.EmbeddedTest{
+		ID: "inner",
+	}
+	outer := &runtimetesting.EmbeddedTest{
+		ID:     "outer",
+		Object: runtime.NewEncodable(codec, inner),
+	}
+
+	wire, err := runtime.Encode(codec, outer)
+	if err != nil {
+		t.Fatalf("Unexpected encode error '%v'", err)
+	}
+
+	t.Logf("Wire format is:\n%v\n", string(wire))
+
+	decoded, err := runtime.Decode(codec, wire)
+	if err != nil {
+		t.Fatalf("Unexpected decode error %v", err)
+	}
+
+	// for later tests
+	outer.Object = inner
+
+	if e, a := outer, decoded; reflect.DeepEqual(e, a) {
+		t.Errorf("Expected unequal %#v %#v", e, a)
+	}
+
+	obj, err := runtime.Decode(codec, decoded.(*runtimetesting.EmbeddedTest).Object.(*runtime.Unknown).Raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	decoded.(*runtimetesting.EmbeddedTest).Object = obj
+	if e, a := outer, decoded; !reflect.DeepEqual(e, a) {
+		t.Errorf("Expected equal %#v %#v", e, a)
+	}
+
+	// test JSON decoding of the external object, which should preserve
+	// raw bytes
+	var externalViaJSON runtimetesting.EmbeddedTestExternal
+	err = json.Unmarshal(wire, &externalViaJSON)
+	if err != nil {
+		t.Fatalf("Unexpected decode error %v", err)
+	}
+	if externalViaJSON.Kind == "" || externalViaJSON.APIVersion == "" || externalViaJSON.ID != "outer" {
+		t.Errorf("Expected objects to have type info set, got %#v", externalViaJSON)
+	}
+	if len(externalViaJSON.EmptyObject.Raw) > 0 {
+		t.Errorf("Expected deserialization of empty nested objects into empty bytes, got %#v", externalViaJSON)
+	}
+
+	// test JSON decoding, too, since Decode uses yaml unmarshalling.
+	// Generic Unmarshalling of JSON cannot load the nested objects because there is
+	// no default schema set.  Consumers wishing to get direct JSON decoding must use
+	// the external representation
+	var decodedViaJSON runtimetesting.EmbeddedTest
+	err = json.Unmarshal(wire, &decodedViaJSON)
+	if err == nil {
+		t.Fatal("Expeceted decode error")
+	}
+	if _, ok := err.(*json.UnmarshalTypeError); !ok {
+		t.Fatalf("Unexpected decode error: %v", err)
+	}
+	if a := decodedViaJSON; a.Object != nil || a.EmptyObject != nil {
+		t.Errorf("Expected embedded objects to be nil: %#v", a)
+	}
+}
+
+// TestDeepCopyOfRuntimeObject checks to make sure that runtime.Objects's can be passed through DeepCopy with fidelity
+func TestDeepCopyOfRuntimeObject(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "v1test"}
+	embeddedTestExternalGVK := externalGV.WithKind("EmbeddedTest")
+
+	s := runtime.NewScheme()
+	s.AddKnownTypes(internalGV, &runtimetesting.EmbeddedTest{})
+	s.AddKnownTypeWithName(embeddedTestExternalGVK, &runtimetesting.EmbeddedTestExternal{})
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+
+	original := &runtimetesting.EmbeddedTest{
+		ID: "outer",
+		Object: &runtimetesting.EmbeddedTest{
+			ID: "inner",
+		},
+	}
+
+	codec := serializer.NewCodecFactory(s).LegacyCodec(externalGV)
+
+	originalData, err := runtime.Encode(codec, original)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	t.Logf("originalRole = %v\n", string(originalData))
+
+	copyOfOriginal := original.DeepCopy()
+	copiedData, err := runtime.Encode(codec, copyOfOriginal)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	t.Logf("copyOfRole   = %v\n", string(copiedData))
+
+	if !reflect.DeepEqual(original, copyOfOriginal) {
+		t.Errorf("expected \n%v\n, got \n%v", string(originalData), string(copiedData))
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/error.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/error.go
new file mode 100644
index 0000000000..7dfa45762f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/error.go
@@ -0,0 +1,172 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type notRegisteredErr struct {
+	schemeName string
+	gvk        schema.GroupVersionKind
+	target     GroupVersioner
+	t          reflect.Type
+}
+
+func NewNotRegisteredErrForKind(schemeName string, gvk schema.GroupVersionKind) error {
+	return &notRegisteredErr{schemeName: schemeName, gvk: gvk}
+}
+
+func NewNotRegisteredErrForType(schemeName string, t reflect.Type) error {
+	return &notRegisteredErr{schemeName: schemeName, t: t}
+}
+
+func NewNotRegisteredErrForTarget(schemeName string, t reflect.Type, target GroupVersioner) error {
+	return &notRegisteredErr{schemeName: schemeName, t: t, target: target}
+}
+
+func NewNotRegisteredGVKErrForTarget(schemeName string, gvk schema.GroupVersionKind, target GroupVersioner) error {
+	return &notRegisteredErr{schemeName: schemeName, gvk: gvk, target: target}
+}
+
+func (k *notRegisteredErr) Error() string {
+	if k.t != nil && k.target != nil {
+		return fmt.Sprintf("%v is not suitable for converting to %q in scheme %q", k.t, k.target, k.schemeName)
+	}
+	nullGVK := schema.GroupVersionKind{}
+	if k.gvk != nullGVK && k.target != nil {
+		return fmt.Sprintf("%q is not suitable for converting to %q in scheme %q", k.gvk.GroupVersion(), k.target, k.schemeName)
+	}
+	if k.t != nil {
+		return fmt.Sprintf("no kind is registered for the type %v in scheme %q", k.t, k.schemeName)
+	}
+	if len(k.gvk.Kind) == 0 {
+		return fmt.Sprintf("no version %q has been registered in scheme %q", k.gvk.GroupVersion(), k.schemeName)
+	}
+	if k.gvk.Version == APIVersionInternal {
+		return fmt.Sprintf("no kind %q is registered for the internal version of group %q in scheme %q", k.gvk.Kind, k.gvk.Group, k.schemeName)
+	}
+
+	return fmt.Sprintf("no kind %q is registered for version %q in scheme %q", k.gvk.Kind, k.gvk.GroupVersion(), k.schemeName)
+}
+
+// IsNotRegisteredError returns true if the error indicates the provided
+// object or input data is not registered.
+func IsNotRegisteredError(err error) bool {
+	if err == nil {
+		return false
+	}
+	_, ok := err.(*notRegisteredErr)
+	return ok
+}
+
+type missingKindErr struct {
+	data string
+}
+
+func NewMissingKindErr(data string) error {
+	return &missingKindErr{data}
+}
+
+func (k *missingKindErr) Error() string {
+	return fmt.Sprintf("Object 'Kind' is missing in '%s'", k.data)
+}
+
+// IsMissingKind returns true if the error indicates that the provided object
+// is missing a 'Kind' field.
+func IsMissingKind(err error) bool {
+	if err == nil {
+		return false
+	}
+	_, ok := err.(*missingKindErr)
+	return ok
+}
+
+type missingVersionErr struct {
+	data string
+}
+
+func NewMissingVersionErr(data string) error {
+	return &missingVersionErr{data}
+}
+
+func (k *missingVersionErr) Error() string {
+	return fmt.Sprintf("Object 'apiVersion' is missing in '%s'", k.data)
+}
+
+// IsMissingVersion returns true if the error indicates that the provided object
+// is missing a 'Version' field.
+func IsMissingVersion(err error) bool {
+	if err == nil {
+		return false
+	}
+	_, ok := err.(*missingVersionErr)
+	return ok
+}
+
+// strictDecodingError is a base error type that is returned by a strict Decoder such
+// as UniversalStrictDecoder.
+type strictDecodingError struct {
+	errors []error
+}
+
+// NewStrictDecodingError creates a new strictDecodingError object.
+func NewStrictDecodingError(errors []error) error {
+	return &strictDecodingError{
+		errors: errors,
+	}
+}
+
+func (e *strictDecodingError) Error() string {
+	var s strings.Builder
+	s.WriteString("strict decoding error: ")
+	for i, err := range e.errors {
+		if i != 0 {
+			s.WriteString(", ")
+		}
+		s.WriteString(err.Error())
+	}
+	return s.String()
+}
+
+func (e *strictDecodingError) Errors() []error {
+	return e.errors
+}
+
+// IsStrictDecodingError returns true if the error indicates that the provided object
+// strictness violations.
+func IsStrictDecodingError(err error) bool {
+	if err == nil {
+		return false
+	}
+	_, ok := err.(*strictDecodingError)
+	return ok
+}
+
+// AsStrictDecodingError returns a strict decoding error
+// containing all the strictness violations.
+func AsStrictDecodingError(err error) (*strictDecodingError, bool) {
+	if err == nil {
+		return nil, false
+	}
+	strictErr, ok := err.(*strictDecodingError)
+	return strictErr, ok
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/extension.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/extension.go
new file mode 100644
index 0000000000..60c000bcb7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/extension.go
@@ -0,0 +1,141 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	"k8s.io/apimachinery/pkg/util/json"
+)
+
+// RawExtension intentionally avoids implementing value.UnstructuredConverter for now because the
+// signature of ToUnstructured does not allow returning an error value in cases where the conversion
+// is not possible (content type is unrecognized or bytes don't match content type).
+func rawToUnstructured(raw []byte, contentType string) (interface{}, error) {
+	switch contentType {
+	case ContentTypeJSON:
+		var u interface{}
+		if err := json.Unmarshal(raw, &u); err != nil {
+			return nil, fmt.Errorf("failed to parse RawExtension bytes as JSON: %w", err)
+		}
+		return u, nil
+	case ContentTypeCBOR:
+		var u interface{}
+		if err := cbor.Unmarshal(raw, &u); err != nil {
+			return nil, fmt.Errorf("failed to parse RawExtension bytes as CBOR: %w", err)
+		}
+		return u, nil
+	default:
+		return nil, fmt.Errorf("cannot convert RawExtension with unrecognized content type to unstructured")
+	}
+}
+
+func (re RawExtension) guessContentType() string {
+	switch {
+	case bytes.HasPrefix(re.Raw, cborSelfDescribed):
+		return ContentTypeCBOR
+	case len(re.Raw) > 0:
+		switch re.Raw[0] {
+		case '\t', '\r', '\n', ' ', '{', '[', 'n', 't', 'f', '"', '-', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			// Prefixes for the four whitespace characters, objects, arrays, strings, numbers, true, false, and null.
+			return ContentTypeJSON
+		}
+	}
+	return ""
+}
+
+func (re *RawExtension) UnmarshalJSON(in []byte) error {
+	if re == nil {
+		return errors.New("runtime.RawExtension: UnmarshalJSON on nil pointer")
+	}
+	if bytes.Equal(in, []byte("null")) {
+		return nil
+	}
+	re.Raw = append(re.Raw[0:0], in...)
+	return nil
+}
+
+var (
+	cborNull          = []byte{0xf6}
+	cborSelfDescribed = []byte{0xd9, 0xd9, 0xf7}
+)
+
+func (re *RawExtension) UnmarshalCBOR(in []byte) error {
+	if re == nil {
+		return errors.New("runtime.RawExtension: UnmarshalCBOR on nil pointer")
+	}
+	if !bytes.Equal(in, cborNull) {
+		if !bytes.HasPrefix(in, cborSelfDescribed) {
+			// The self-described CBOR tag doesn't change the interpretation of the data
+			// item it encloses, but it is useful as a magic number. Its encoding is
+			// also what is used to implement the CBOR RecognizingDecoder.
+			re.Raw = append(re.Raw[:0], cborSelfDescribed...)
+		}
+		re.Raw = append(re.Raw, in...)
+	}
+	return nil
+}
+
+// MarshalJSON may get called on pointers or values, so implement MarshalJSON on value.
+// http://stackoverflow.com/questions/21390979/custom-marshaljson-never-gets-called-in-go
+func (re RawExtension) MarshalJSON() ([]byte, error) {
+	if re.Raw == nil {
+		// TODO: this is to support legacy behavior of JSONPrinter and YAMLPrinter, which
+		// expect to call json.Marshal on arbitrary versioned objects (even those not in
+		// the scheme). pkg/kubectl/resource#AsVersionedObjects and its interaction with
+		// kubectl get on objects not in the scheme needs to be updated to ensure that the
+		// objects that are not part of the scheme are correctly put into the right form.
+		if re.Object != nil {
+			return json.Marshal(re.Object)
+		}
+		return []byte("null"), nil
+	}
+
+	contentType := re.guessContentType()
+	if contentType == ContentTypeJSON {
+		return re.Raw, nil
+	}
+
+	u, err := rawToUnstructured(re.Raw, contentType)
+	if err != nil {
+		return nil, err
+	}
+	return json.Marshal(u)
+}
+
+func (re RawExtension) MarshalCBOR() ([]byte, error) {
+	if re.Raw == nil {
+		if re.Object != nil {
+			return cbor.Marshal(re.Object)
+		}
+		return cbor.Marshal(nil)
+	}
+
+	contentType := re.guessContentType()
+	if contentType == ContentTypeCBOR {
+		return re.Raw, nil
+	}
+
+	u, err := rawToUnstructured(re.Raw, contentType)
+	if err != nil {
+		return nil, err
+	}
+	return cbor.Marshal(u)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/extension_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/extension_test.go
new file mode 100644
index 0000000000..3a296987b7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/extension_test.go
@@ -0,0 +1,264 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestEmbeddedRawExtensionMarshal(t *testing.T) {
+	type test struct {
+		Ext runtime.RawExtension
+	}
+
+	extension := test{Ext: runtime.RawExtension{Raw: []byte(`{"foo":"bar"}`)}}
+	data, err := json.Marshal(extension)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if string(data) != `{"Ext":{"foo":"bar"}}` {
+		t.Errorf("unexpected data: %s", string(data))
+	}
+}
+func TestEmbeddedRawExtensionUnmarshal(t *testing.T) {
+	type test struct {
+		Ext runtime.RawExtension
+	}
+
+	testCases := map[string]struct {
+		orig test
+	}{
+		"non-empty object": {
+			orig: test{Ext: runtime.RawExtension{Raw: []byte(`{"foo":"bar"}`)}},
+		},
+		"empty object": {
+			orig: test{Ext: runtime.RawExtension{}},
+		},
+	}
+
+	for k, tc := range testCases {
+		new := test{}
+		data, _ := json.Marshal(tc.orig)
+		if err := json.Unmarshal(data, &new); err != nil {
+			t.Errorf("%s: umarshal error: %v", k, err)
+		}
+		if !reflect.DeepEqual(tc.orig, new) {
+			t.Errorf("%s: unmarshaled struct differs from original: %v %v", k, tc.orig, new)
+		}
+	}
+}
+
+func TestEmbeddedRawExtensionRoundTrip(t *testing.T) {
+	type test struct {
+		Ext runtime.RawExtension
+	}
+
+	testCases := map[string]struct {
+		orig test
+	}{
+		"non-empty object": {
+			orig: test{Ext: runtime.RawExtension{Raw: []byte(`{"foo":"bar"}`)}},
+		},
+		"empty object": {
+			orig: test{Ext: runtime.RawExtension{}},
+		},
+	}
+
+	for k, tc := range testCases {
+		new1 := test{}
+		new2 := test{}
+		data, err := json.Marshal(tc.orig)
+		if err != nil {
+			t.Errorf("1st marshal error: %v", err)
+		}
+		if err = json.Unmarshal(data, &new1); err != nil {
+			t.Errorf("1st unmarshal error: %v", err)
+		}
+		newData, err := json.Marshal(new1)
+		if err != nil {
+			t.Errorf("2st marshal error: %v", err)
+		}
+		if err = json.Unmarshal(newData, &new2); err != nil {
+			t.Errorf("2nd unmarshal error: %v", err)
+		}
+		if !bytes.Equal(data, newData) {
+			t.Errorf("%s: re-marshaled data differs from original: %v %v", k, data, newData)
+		}
+		if !reflect.DeepEqual(tc.orig, new1) {
+			t.Errorf("%s: unmarshaled struct differs from original: %v %v", k, tc.orig, new1)
+		}
+		if !reflect.DeepEqual(new1, new2) {
+			t.Errorf("%s: re-unmarshaled struct differs from original: %v %v", k, new1, new2)
+		}
+	}
+}
+
+func TestRawExtensionMarshalUnstructured(t *testing.T) {
+	for _, tc := range []struct {
+		Name              string
+		In                runtime.RawExtension
+		WantCBOR          []byte
+		ExpectedErrorCBOR string
+		WantJSON          string
+		ExpectedErrorJSON string
+	}{
+		{
+			Name:     "nil bytes and nil object",
+			In:       runtime.RawExtension{},
+			WantCBOR: []byte{0xf6},
+			WantJSON: "null",
+		},
+		{
+			Name:     "nil bytes and non-nil object",
+			In:       runtime.RawExtension{Object: &runtimetesting.ExternalSimple{TestString: "foo"}},
+			WantCBOR: []byte("\xa1\x4atestString\x43foo"),
+			WantJSON: `{"testString":"foo"}`,
+		},
+		{
+			Name:              "cbor bytes not enclosed in self-described tag",
+			In:                runtime.RawExtension{Raw: []byte{0x43, 'f', 'o', 'o'}}, // 'foo'
+			ExpectedErrorCBOR: "cannot convert RawExtension with unrecognized content type to unstructured",
+			ExpectedErrorJSON: "cannot convert RawExtension with unrecognized content type to unstructured",
+		},
+		{
+			Name:     "cbor bytes enclosed in self-described tag",
+			In:       runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0x43, 'f', 'o', 'o'}}, // 55799('foo')
+			WantCBOR: []byte{0xd9, 0xd9, 0xf7, 0x43, 'f', 'o', 'o'},                            // 55799('foo')
+			WantJSON: `"foo"`,
+		},
+		{
+			Name:     "json bytes",
+			In:       runtime.RawExtension{Raw: []byte(`"foo"`)},
+			WantCBOR: []byte{0x43, 'f', 'o', 'o'},
+			WantJSON: `"foo"`,
+		},
+		{
+			Name:     "ambiguous bytes not enclosed in self-described cbor tag",
+			In:       runtime.RawExtension{Raw: []byte{'0'}}, // CBOR -17 / JSON 0
+			WantCBOR: []byte{0x00},
+			WantJSON: `0`,
+		},
+		{
+			Name:     "ambiguous bytes enclosed in self-described cbor tag",
+			In:       runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, '0'}}, // 55799(-17)
+			WantCBOR: []byte{0xd9, 0xd9, 0xf7, '0'},
+			WantJSON: `-17`,
+		},
+		{
+			Name:              "unrecognized bytes",
+			In:                runtime.RawExtension{Raw: []byte{0xff}},
+			ExpectedErrorCBOR: "cannot convert RawExtension with unrecognized content type to unstructured",
+			ExpectedErrorJSON: "cannot convert RawExtension with unrecognized content type to unstructured",
+		},
+		{
+			Name:              "invalid cbor with self-described cbor prefix",
+			In:                runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0xff}},
+			WantCBOR:          []byte{0xd9, 0xd9, 0xf7, 0xff}, // verbatim
+			ExpectedErrorJSON: `failed to parse RawExtension bytes as CBOR: cbor: unexpected "break" code`,
+		},
+		{
+			Name:              "invalid json with json prefix",
+			In:                runtime.RawExtension{Raw: []byte(`{{`)},
+			ExpectedErrorCBOR: `failed to parse RawExtension bytes as JSON: invalid character '{' looking for beginning of object key string`,
+			WantJSON:          `{{`, // verbatim
+		},
+	} {
+		t.Run(tc.Name, func(t *testing.T) {
+			t.Run("CBOR", func(t *testing.T) {
+				got, err := tc.In.MarshalCBOR()
+				if err != nil {
+					if tc.ExpectedErrorCBOR == "" {
+						t.Fatalf("unexpected error: %v", err)
+					}
+					if msg := err.Error(); msg != tc.ExpectedErrorCBOR {
+						t.Fatalf("expected error %q but got %q", tc.ExpectedErrorCBOR, msg)
+					}
+				}
+
+				if diff := cmp.Diff(tc.WantCBOR, got); diff != "" {
+					t.Errorf("unexpected diff:\n%s", diff)
+				}
+			})
+
+			t.Run("JSON", func(t *testing.T) {
+				got, err := tc.In.MarshalJSON()
+				if err != nil {
+					if tc.ExpectedErrorJSON == "" {
+						t.Fatalf("unexpected error: %v", err)
+					}
+					if msg := err.Error(); msg != tc.ExpectedErrorJSON {
+						t.Fatalf("expected error %q but got %q", tc.ExpectedErrorJSON, msg)
+					}
+				}
+
+				if diff := cmp.Diff(tc.WantJSON, string(got)); diff != "" {
+					t.Errorf("unexpected diff:\n%s", diff)
+				}
+			})
+		})
+	}
+}
+
+func TestRawExtensionUnmarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		Name string
+		In   []byte
+		Want runtime.RawExtension
+	}{
+		{
+			// From json.Unmarshaler: By convention, to approximate the behavior of
+			// Unmarshal itself, Unmarshalers implement UnmarshalJSON([]byte("null")) as
+			// a no-op.
+			Name: "no-op on null",
+			In:   []byte{0xf6},
+			Want: runtime.RawExtension{},
+		},
+		{
+			Name: "input copied verbatim",
+			In:   []byte{0xd9, 0xd9, 0xf7, 0x5f, 0x41, 'f', 0x42, 'o', 'o', 0xff}, // 55799(_ 'f' 'oo')
+			Want: runtime.RawExtension{
+				Raw: []byte{0xd9, 0xd9, 0xf7, 0x5f, 0x41, 'f', 0x42, 'o', 'o', 0xff}, // 55799(_ 'f' 'oo')
+			},
+		},
+		{
+			Name: "input enclosed in self-described tag if absent",
+			In:   []byte{0x5f, 0x41, 'f', 0x42, 'o', 'o', 0xff}, // (_ 'f' 'oo')
+			Want: runtime.RawExtension{
+				Raw: []byte{0xd9, 0xd9, 0xf7, 0x5f, 0x41, 'f', 0x42, 'o', 'o', 0xff}, // 55799(_ 'f' 'oo')
+			},
+		},
+	} {
+		t.Run(tc.Name, func(t *testing.T) {
+			var got runtime.RawExtension
+			if err := got.UnmarshalCBOR(tc.In); err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			if diff := cmp.Diff(tc.Want, got); diff != "" {
+				t.Errorf("unexpected diff:\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_126.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_126.go
new file mode 100644
index 0000000000..686ff6abb3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_126.go
@@ -0,0 +1,26 @@
+//go:build !go1.27
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import "reflect"
+
+func isInlinedFromTag(fieldType reflect.StructField, tagName string, tagDirectives []string) bool {
+	// go <1.27 doesn't honor ",inline"
+	return false
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_126_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_126_test.go
new file mode 100644
index 0000000000..b1da16b9a1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_126_test.go
@@ -0,0 +1,21 @@
+//go:build !go1.27
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime_test
+
+const stdlibSupportsEmbedTag = false
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_127.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_127.go
new file mode 100644
index 0000000000..abaa79a2db
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_127.go
@@ -0,0 +1,33 @@
+//go:build go1.27
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"reflect"
+)
+
+func isInlinedFromTag(field reflect.StructField, tagName string, tagDirectives []string) bool {
+	fieldType := field.Type
+	if fieldType.Kind() == reflect.Pointer && fieldType.Name() == "" {
+		// optionally unwrap a single level
+		fieldType = fieldType.Elem()
+	}
+	// TODO: when switching to direct use of json/v2, error on non-struct embedding and use of embed with other directives
+	return fieldType.Kind() == reflect.Struct && tagName == "" && len(tagDirectives) == 1 && tagDirectives[0] == "embed"
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_127_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_127_test.go
new file mode 100644
index 0000000000..8cb7fc1e51
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_127_test.go
@@ -0,0 +1,21 @@
+//go:build go1.27
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime_test
+
+const stdlibSupportsEmbedTag = true
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/generated.pb.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/generated.pb.go
new file mode 100644
index 0000000000..f5e78d4b36
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/generated.pb.go
@@ -0,0 +1,716 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/apimachinery/pkg/runtime/generated.proto
+
+package runtime
+
+import (
+	fmt "fmt"
+
+	io "io"
+	math_bits "math/bits"
+	reflect "reflect"
+	strings "strings"
+)
+
+func (m *RawExtension) Reset() { *m = RawExtension{} }
+
+func (m *TypeMeta) Reset() { *m = TypeMeta{} }
+
+func (m *Unknown) Reset() { *m = Unknown{} }
+
+func (m *RawExtension) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RawExtension) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RawExtension) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.Raw != nil {
+		i -= len(m.Raw)
+		copy(dAtA[i:], m.Raw)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(m.Raw)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *TypeMeta) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TypeMeta) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *TypeMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.APIVersion)
+	copy(dAtA[i:], m.APIVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.APIVersion)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *Unknown) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Unknown) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Unknown) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.ContentType)
+	copy(dAtA[i:], m.ContentType)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ContentType)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.ContentEncoding)
+	copy(dAtA[i:], m.ContentEncoding)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ContentEncoding)))
+	i--
+	dAtA[i] = 0x1a
+	if m.Raw != nil {
+		i -= len(m.Raw)
+		copy(dAtA[i:], m.Raw)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(m.Raw)))
+		i--
+		dAtA[i] = 0x12
+	}
+	{
+		size, err := m.TypeMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *RawExtension) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Raw != nil {
+		l = len(m.Raw)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *TypeMeta) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.APIVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *Unknown) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.TypeMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Raw != nil {
+		l = len(m.Raw)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = len(m.ContentEncoding)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.ContentType)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozGenerated(x uint64) (n int) {
+	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *RawExtension) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&RawExtension{`,
+		`Raw:` + valueToStringGenerated(this.Raw) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *TypeMeta) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&TypeMeta{`,
+		`APIVersion:` + fmt.Sprintf("%v", this.APIVersion) + `,`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Unknown) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Unknown{`,
+		`TypeMeta:` + strings.Replace(strings.Replace(this.TypeMeta.String(), "TypeMeta", "TypeMeta", 1), `&`, ``, 1) + `,`,
+		`Raw:` + valueToStringGenerated(this.Raw) + `,`,
+		`ContentEncoding:` + fmt.Sprintf("%v", this.ContentEncoding) + `,`,
+		`ContentType:` + fmt.Sprintf("%v", this.ContentType) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringGenerated(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *RawExtension) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RawExtension: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RawExtension: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Raw", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Raw = append(m.Raw[:0], dAtA[iNdEx:postIndex]...)
+			if m.Raw == nil {
+				m.Raw = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TypeMeta) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TypeMeta: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TypeMeta: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field APIVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.APIVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Unknown) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Unknown: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Unknown: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TypeMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.TypeMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Raw", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Raw = append(m.Raw[:0], dAtA[iNdEx:postIndex]...)
+			if m.Raw == nil {
+				m.Raw = []byte{}
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ContentEncoding", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ContentEncoding = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ContentType", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ContentType = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipGenerated(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLengthGenerated
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupGenerated
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthGenerated
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+var (
+	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/generated.proto b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/generated.proto
new file mode 100644
index 0000000000..93d187d94a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/generated.proto
@@ -0,0 +1,134 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.apimachinery.pkg.runtime;
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/apimachinery/pkg/runtime";
+
+// RawExtension is used to hold extensions in external versions.
+//
+// To use this, make a field which has RawExtension as its type in your external, versioned
+// struct, and Object in your internal struct. You also need to register your
+// various plugin types.
+//
+// // Internal package:
+//
+// 	type MyAPIObject struct {
+// 		runtime.TypeMeta `json:""`
+// 		MyPlugin runtime.Object `json:"myPlugin"`
+// 	}
+//
+// 	type PluginA struct {
+// 		AOption string `json:"aOption"`
+// 	}
+//
+// // External package:
+//
+// 	type MyAPIObject struct {
+// 		runtime.TypeMeta `json:""`
+// 		MyPlugin runtime.RawExtension `json:"myPlugin"`
+// 	}
+//
+// 	type PluginA struct {
+// 		AOption string `json:"aOption"`
+// 	}
+//
+// // On the wire, the JSON will look something like this:
+//
+// 	{
+// 		"kind":"MyAPIObject",
+// 		"apiVersion":"v1",
+// 		"myPlugin": {
+// 			"kind":"PluginA",
+// 			"aOption":"foo",
+// 		},
+// 	}
+//
+// So what happens? Decode first uses json or yaml to unmarshal the serialized data into
+// your external MyAPIObject. That causes the raw JSON to be stored, but not unpacked.
+// The next step is to copy (using pkg/conversion) into the internal struct. The runtime
+// package's DefaultScheme has conversion functions installed which will unpack the
+// JSON stored in RawExtension, turning it into the correct object type, and storing it
+// in the Object. (TODO: In the case where the object is of an unknown type, a
+// runtime.Unknown object will be created and stored.)
+//
+// +k8s:deepcopy-gen=true
+// +protobuf=true
+// +k8s:openapi-gen=true
+message RawExtension {
+  // Raw is the underlying serialization of this object.
+  //
+  // TODO: Determine how to detect ContentType and ContentEncoding of 'Raw' data.
+  optional bytes raw = 1;
+}
+
+// TypeMeta is shared by all top level objects. The proper way to use it is to inline it in your type,
+// like this:
+//
+// 	type MyAwesomeAPIObject struct {
+// 	     runtime.TypeMeta    `json:""`
+// 	     ... // other fields
+// 	}
+//
+// func (obj *MyAwesomeAPIObject) SetGroupVersionKind(gvk *metav1.GroupVersionKind) { metav1.UpdateTypeMeta(obj,gvk) }; GroupVersionKind() *GroupVersionKind
+//
+// TypeMeta is provided here for convenience. You may use it directly from this package or define
+// your own with the same fields.
+//
+// +k8s:deepcopy-gen=false
+// +protobuf=true
+// +k8s:openapi-gen=true
+message TypeMeta {
+  // +optional
+  optional string apiVersion = 1;
+
+  // +optional
+  optional string kind = 2;
+}
+
+// Unknown allows api objects with unknown types to be passed-through. This can be used
+// to deal with the API objects from a plug-in. Unknown objects still have functioning
+// TypeMeta features-- kind, version, etc.
+// TODO: Make this object have easy access to field based accessors and settors for
+// metadata and field mutatation.
+//
+// +k8s:deepcopy-gen=true
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +protobuf=true
+// +k8s:openapi-gen=true
+message Unknown {
+  optional TypeMeta typeMeta = 1;
+
+  // Raw will hold the complete serialized object which couldn't be matched
+  // with a registered type. Most likely, nothing should be done with this
+  // except for passing it through the system.
+  optional bytes raw = 2;
+
+  // ContentEncoding is encoding used to encode 'Raw' data.
+  // Unspecified means no encoding.
+  optional string contentEncoding = 3;
+
+  // ContentType  is serialization method used to serialize 'Raw'.
+  // Unspecified means ContentTypeJSON.
+  optional string contentType = 4;
+}
+
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/helper.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/helper.go
new file mode 100644
index 0000000000..242a349865
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/helper.go
@@ -0,0 +1,310 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"fmt"
+	"io"
+	"reflect"
+
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/errors"
+)
+
+// unsafeObjectConvertor implements ObjectConvertor using the unsafe conversion path.
+type unsafeObjectConvertor struct {
+	*Scheme
+}
+
+var _ ObjectConvertor = unsafeObjectConvertor{}
+
+// ConvertToVersion converts in to the provided outVersion without copying the input first, which
+// is only safe if the output object is not mutated or reused.
+func (c unsafeObjectConvertor) ConvertToVersion(in Object, outVersion GroupVersioner) (Object, error) {
+	return c.Scheme.UnsafeConvertToVersion(in, outVersion)
+}
+
+// UnsafeObjectConvertor performs object conversion without copying the object structure,
+// for use when the converted object will not be reused or mutated. Primarily for use within
+// versioned codecs, which use the external object for serialization but do not return it.
+func UnsafeObjectConvertor(scheme *Scheme) ObjectConvertor {
+	return unsafeObjectConvertor{scheme}
+}
+
+// SetField puts the value of src, into fieldName, which must be a member of v.
+// The value of src must be assignable to the field.
+func SetField(src interface{}, v reflect.Value, fieldName string) error {
+	field := v.FieldByName(fieldName)
+	if !field.IsValid() {
+		return fmt.Errorf("couldn't find %v field in %T", fieldName, v.Interface())
+	}
+	srcValue := reflect.ValueOf(src)
+	if srcValue.Type().AssignableTo(field.Type()) {
+		field.Set(srcValue)
+		return nil
+	}
+	if srcValue.Type().ConvertibleTo(field.Type()) {
+		field.Set(srcValue.Convert(field.Type()))
+		return nil
+	}
+	return fmt.Errorf("couldn't assign/convert %v to %v", srcValue.Type(), field.Type())
+}
+
+// Field puts the value of fieldName, which must be a member of v, into dest,
+// which must be a variable to which this field's value can be assigned.
+func Field(v reflect.Value, fieldName string, dest interface{}) error {
+	field := v.FieldByName(fieldName)
+	if !field.IsValid() {
+		return fmt.Errorf("couldn't find %v field in %T", fieldName, v.Interface())
+	}
+	destValue, err := conversion.EnforcePtr(dest)
+	if err != nil {
+		return err
+	}
+	if field.Type().AssignableTo(destValue.Type()) {
+		destValue.Set(field)
+		return nil
+	}
+	if field.Type().ConvertibleTo(destValue.Type()) {
+		destValue.Set(field.Convert(destValue.Type()))
+		return nil
+	}
+	return fmt.Errorf("couldn't assign/convert %v to %v", field.Type(), destValue.Type())
+}
+
+// FieldPtr puts the address of fieldName, which must be a member of v,
+// into dest, which must be an address of a variable to which this field's
+// address can be assigned.
+func FieldPtr(v reflect.Value, fieldName string, dest interface{}) error {
+	field := v.FieldByName(fieldName)
+	if !field.IsValid() {
+		return fmt.Errorf("couldn't find %v field in %T", fieldName, v.Interface())
+	}
+	v, err := conversion.EnforcePtr(dest)
+	if err != nil {
+		return err
+	}
+	field = field.Addr()
+	if field.Type().AssignableTo(v.Type()) {
+		v.Set(field)
+		return nil
+	}
+	if field.Type().ConvertibleTo(v.Type()) {
+		v.Set(field.Convert(v.Type()))
+		return nil
+	}
+	return fmt.Errorf("couldn't assign/convert %v to %v", field.Type(), v.Type())
+}
+
+// EncodeList ensures that each object in an array is converted to a Unknown{} in serialized form.
+// TODO: accept a content type.
+func EncodeList(e Encoder, objects []Object) error {
+	var errs []error
+	for i := range objects {
+		data, err := Encode(e, objects[i])
+		if err != nil {
+			errs = append(errs, err)
+			continue
+		}
+		// TODO: Set ContentEncoding and ContentType.
+		objects[i] = &Unknown{Raw: data}
+	}
+	return errors.NewAggregate(errs)
+}
+
+func decodeListItem(obj *Unknown, decoders []Decoder) (Object, error) {
+	for _, decoder := range decoders {
+		// TODO: Decode based on ContentType.
+		obj, err := Decode(decoder, obj.Raw)
+		if err != nil {
+			if IsNotRegisteredError(err) {
+				continue
+			}
+			return nil, err
+		}
+		return obj, nil
+	}
+	// could not decode, so leave the object as Unknown, but give the decoders the
+	// chance to set Unknown.TypeMeta if it is available.
+	for _, decoder := range decoders {
+		if err := DecodeInto(decoder, obj.Raw, obj); err == nil {
+			return obj, nil
+		}
+	}
+	return obj, nil
+}
+
+// DecodeList alters the list in place, attempting to decode any objects found in
+// the list that have the Unknown type. Any errors that occur are returned
+// after the entire list is processed. Decoders are tried in order.
+func DecodeList(objects []Object, decoders ...Decoder) []error {
+	errs := []error(nil)
+	for i, obj := range objects {
+		switch t := obj.(type) {
+		case *Unknown:
+			decoded, err := decodeListItem(t, decoders)
+			if err != nil {
+				errs = append(errs, err)
+				break
+			}
+			objects[i] = decoded
+		}
+	}
+	return errs
+}
+
+// MultiObjectTyper returns the types of objects across multiple schemes in order.
+type MultiObjectTyper []ObjectTyper
+
+var _ ObjectTyper = MultiObjectTyper{}
+
+func (m MultiObjectTyper) ObjectKinds(obj Object) (gvks []schema.GroupVersionKind, unversionedType bool, err error) {
+	for _, t := range m {
+		gvks, unversionedType, err = t.ObjectKinds(obj)
+		if err == nil {
+			return
+		}
+	}
+	return
+}
+
+func (m MultiObjectTyper) Recognizes(gvk schema.GroupVersionKind) bool {
+	for _, t := range m {
+		if t.Recognizes(gvk) {
+			return true
+		}
+	}
+	return false
+}
+
+// SetZeroValue would set the object of objPtr to zero value of its type.
+func SetZeroValue(objPtr Object) error {
+	v, err := conversion.EnforcePtr(objPtr)
+	if err != nil {
+		return err
+	}
+	v.Set(reflect.Zero(v.Type()))
+	return nil
+}
+
+// DefaultFramer is valid for any stream that can read objects serially without
+// any separation in the stream.
+var DefaultFramer = defaultFramer{}
+
+type defaultFramer struct{}
+
+func (defaultFramer) NewFrameReader(r io.ReadCloser) io.ReadCloser { return r }
+func (defaultFramer) NewFrameWriter(w io.Writer) io.Writer         { return w }
+
+// WithVersionEncoder serializes an object and ensures the GVK is set.
+type WithVersionEncoder struct {
+	Version GroupVersioner
+	Encoder
+	ObjectTyper
+}
+
+// Encode does not do conversion. It sets the gvk during serialization.
+func (e WithVersionEncoder) Encode(obj Object, stream io.Writer) error {
+	gvks, _, err := e.ObjectTyper.ObjectKinds(obj)
+	if err != nil {
+		if IsNotRegisteredError(err) {
+			return e.Encoder.Encode(obj, stream)
+		}
+		return err
+	}
+	kind := obj.GetObjectKind()
+	oldGVK := kind.GroupVersionKind()
+	gvk := gvks[0]
+	if e.Version != nil {
+		preferredGVK, ok := e.Version.KindForGroupVersionKinds(gvks)
+		if ok {
+			gvk = preferredGVK
+		}
+	}
+
+	// The gvk only needs to be set if not already as desired.
+	if gvk != oldGVK {
+		kind.SetGroupVersionKind(gvk)
+		defer kind.SetGroupVersionKind(oldGVK)
+	}
+
+	return e.Encoder.Encode(obj, stream)
+}
+
+// WithoutVersionDecoder clears the group version kind of a deserialized object.
+type WithoutVersionDecoder struct {
+	Decoder
+}
+
+// Decode does not do conversion. It removes the gvk during deserialization.
+func (d WithoutVersionDecoder) Decode(data []byte, defaults *schema.GroupVersionKind, into Object) (Object, *schema.GroupVersionKind, error) {
+	obj, gvk, err := d.Decoder.Decode(data, defaults, into)
+	if obj != nil {
+		kind := obj.GetObjectKind()
+		// clearing the gvk is just a convention of a codec
+		kind.SetGroupVersionKind(schema.GroupVersionKind{})
+	}
+	return obj, gvk, err
+}
+
+type encoderWithAllocator struct {
+	encoder      EncoderWithAllocator
+	memAllocator MemoryAllocator
+}
+
+// NewEncoderWithAllocator returns a new encoder
+func NewEncoderWithAllocator(e EncoderWithAllocator, a MemoryAllocator) Encoder {
+	return &encoderWithAllocator{
+		encoder:      e,
+		memAllocator: a,
+	}
+}
+
+// Encode writes the provided object to the nested writer
+func (e *encoderWithAllocator) Encode(obj Object, w io.Writer) error {
+	return e.encoder.EncodeWithAllocator(obj, w, e.memAllocator)
+}
+
+// Identifier returns identifier of this encoder.
+func (e *encoderWithAllocator) Identifier() Identifier {
+	return e.encoder.Identifier()
+}
+
+// The legacy discovery endpoint requires that its response Encoder implement Serializer.
+// https://github.com/kubernetes/kubernetes/blob/4a1340bfd58fdb3846d4342c101e0bcb574fbfb1/staging/src/k8s.io/apiserver/pkg/endpoints/discovery/util.go#L101-L107
+var _ Serializer = nondeterministicEncoderToEncoderAdapter{}
+
+type nondeterministicEncoderToEncoderAdapter struct {
+	NondeterministicEncoder
+
+	Decoder
+}
+
+func (e nondeterministicEncoderToEncoderAdapter) Encode(obj Object, w io.Writer) error {
+	return e.EncodeNondeterministic(obj, w)
+}
+
+// UseNondeterministicEncoding returns an Encoder that encodes objects using the provided
+// Serializer's EncodeNondeterministic method if it implements NondeterministicEncoder, otherwise it
+// returns the provided Serializer as-is.
+func UseNondeterministicEncoding(serializer Serializer) Encoder {
+	if nondeterministic, ok := serializer.(NondeterministicEncoder); ok {
+		return nondeterministicEncoderToEncoderAdapter{NondeterministicEncoder: nondeterministic, Decoder: serializer}
+	}
+	return serializer
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/interfaces.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/interfaces.go
new file mode 100644
index 0000000000..8456c21d31
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/interfaces.go
@@ -0,0 +1,393 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"io"
+	"net/url"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+const (
+	// APIVersionInternal may be used if you are registering a type that should not
+	// be considered stable or serialized - it is a convention only and has no
+	// special behavior in this package.
+	APIVersionInternal = "__internal"
+)
+
+// GroupVersioner refines a set of possible conversion targets into a single option.
+type GroupVersioner interface {
+	// KindForGroupVersionKinds returns a desired target group version kind for the given input, or returns ok false if no
+	// target is known. In general, if the return target is not in the input list, the caller is expected to invoke
+	// Scheme.New(target) and then perform a conversion between the current Go type and the destination Go type.
+	// Sophisticated implementations may use additional information about the input kinds to pick a destination kind.
+	KindForGroupVersionKinds(kinds []schema.GroupVersionKind) (target schema.GroupVersionKind, ok bool)
+	// Identifier returns string representation of the object.
+	// Identifiers of two different encoders should be equal only if for every input
+	// kinds they return the same result.
+	Identifier() string
+}
+
+// Identifier represents an identifier.
+// Identitier of two different objects should be equal if and only if for every
+// input the output they produce is exactly the same.
+type Identifier string
+
+// Encoder writes objects to a serialized form
+type Encoder interface {
+	// Encode writes an object to a stream. Implementations may return errors if the versions are
+	// incompatible, or if no conversion is defined.
+	Encode(obj Object, w io.Writer) error
+	// Identifier returns an identifier of the encoder.
+	// Identifiers of two different encoders should be equal if and only if for every input
+	// object it will be encoded to the same representation by both of them.
+	//
+	// Identifier is intended for use with CacheableObject#CacheEncode method. In order to
+	// correctly handle CacheableObject, Encode() method should look similar to below, where
+	// doEncode() is the encoding logic of implemented encoder:
+	//   func (e *MyEncoder) Encode(obj Object, w io.Writer) error {
+	//     if co, ok := obj.(CacheableObject); ok {
+	//       return co.CacheEncode(e.Identifier(), e.doEncode, w)
+	//     }
+	//     return e.doEncode(obj, w)
+	//   }
+	Identifier() Identifier
+}
+
+// NondeterministicEncoder is implemented by Encoders that can serialize objects more efficiently in
+// cases where the output does not need to be deterministic.
+type NondeterministicEncoder interface {
+	Encoder
+
+	// EncodeNondeterministic writes an object to the stream. Unlike the Encode method of
+	// Encoder, EncodeNondeterministic does not guarantee that any two invocations will write
+	// the same sequence of bytes to the io.Writer. Any differences will not be significant to a
+	// generic decoder. For example, map entries and struct fields might be encoded in any
+	// order.
+	EncodeNondeterministic(Object, io.Writer) error
+}
+
+// MemoryAllocator is responsible for allocating memory.
+// By encapsulating memory allocation into its own interface, we can reuse the memory
+// across many operations in places we know it can significantly improve the performance.
+type MemoryAllocator interface {
+	// Allocate reserves memory for n bytes.
+	// Note that implementations of this method are not required to zero the returned array.
+	// It is the caller's responsibility to clean the memory if needed.
+	Allocate(n uint64) []byte
+}
+
+// EncoderWithAllocator  serializes objects in a way that allows callers to manage any additional memory allocations.
+type EncoderWithAllocator interface {
+	Encoder
+	// EncodeWithAllocator writes an object to a stream as Encode does.
+	// In addition, it allows for providing a memory allocator for efficient memory usage during object serialization
+	EncodeWithAllocator(obj Object, w io.Writer, memAlloc MemoryAllocator) error
+}
+
+// Decoder attempts to load an object from data.
+type Decoder interface {
+	// Decode attempts to deserialize the provided data using either the innate typing of the scheme or the
+	// default kind, group, and version provided. It returns a decoded object as well as the kind, group, and
+	// version from the serialized data, or an error. If into is non-nil, it will be used as the target type
+	// and implementations may choose to use it rather than reallocating an object. However, the object is not
+	// guaranteed to be populated. The returned object is not guaranteed to match into. If defaults are
+	// provided, they are applied to the data by default. If no defaults or partial defaults are provided, the
+	// type of the into may be used to guide conversion decisions.
+	Decode(data []byte, defaults *schema.GroupVersionKind, into Object) (Object, *schema.GroupVersionKind, error)
+}
+
+// Serializer is the core interface for transforming objects into a serialized format and back.
+// Implementations may choose to perform conversion of the object, but no assumptions should be made.
+type Serializer interface {
+	Encoder
+	Decoder
+}
+
+// Codec is a Serializer that deals with the details of versioning objects. It offers the same
+// interface as Serializer, so this is a marker to consumers that care about the version of the objects
+// they receive.
+type Codec Serializer
+
+// ParameterCodec defines methods for serializing and deserializing API objects to url.Values and
+// performing any necessary conversion. Unlike the normal Codec, query parameters are not self describing
+// and the desired version must be specified.
+type ParameterCodec interface {
+	// DecodeParameters takes the given url.Values in the specified group version and decodes them
+	// into the provided object, or returns an error.
+	DecodeParameters(parameters url.Values, from schema.GroupVersion, into Object) error
+	// EncodeParameters encodes the provided object as query parameters or returns an error.
+	EncodeParameters(obj Object, to schema.GroupVersion) (url.Values, error)
+}
+
+// Framer is a factory for creating readers and writers that obey a particular framing pattern.
+type Framer interface {
+	NewFrameReader(r io.ReadCloser) io.ReadCloser
+	NewFrameWriter(w io.Writer) io.Writer
+}
+
+// SerializerInfo contains information about a specific serialization format
+type SerializerInfo struct {
+	// MediaType is the value that represents this serializer over the wire.
+	MediaType string
+	// MediaTypeType is the first part of the MediaType ("application" in "application/json").
+	MediaTypeType string
+	// MediaTypeSubType is the second part of the MediaType ("json" in "application/json").
+	MediaTypeSubType string
+	// EncodesAsText indicates this serializer can be encoded to UTF-8 safely.
+	EncodesAsText bool
+	// Serializer is the individual object serializer for this media type.
+	Serializer Serializer
+	// PrettySerializer, if set, can serialize this object in a form biased towards
+	// readability.
+	PrettySerializer Serializer
+	// StrictSerializer, if set, deserializes this object strictly,
+	// erring on unknown fields.
+	StrictSerializer Serializer
+	// StreamSerializer, if set, describes the streaming serialization format
+	// for this media type.
+	StreamSerializer *StreamSerializerInfo
+}
+
+// StreamSerializerInfo contains information about a specific stream serialization format
+type StreamSerializerInfo struct {
+	// EncodesAsText indicates this serializer can be encoded to UTF-8 safely.
+	EncodesAsText bool
+	// Serializer is the top level object serializer for this type when streaming
+	Serializer
+	// Framer is the factory for retrieving streams that separate objects on the wire
+	Framer
+}
+
+// NegotiatedSerializer is an interface used for obtaining encoders, decoders, and serializers
+// for multiple supported media types. This would commonly be accepted by a server component
+// that performs HTTP content negotiation to accept multiple formats.
+type NegotiatedSerializer interface {
+	// SupportedMediaTypes is the media types supported for reading and writing single objects.
+	SupportedMediaTypes() []SerializerInfo
+
+	// EncoderForVersion returns an encoder that ensures objects being written to the provided
+	// serializer are in the provided group version.
+	EncoderForVersion(serializer Encoder, gv GroupVersioner) Encoder
+	// DecoderToVersion returns a decoder that ensures objects being read by the provided
+	// serializer are in the provided group version by default.
+	DecoderToVersion(serializer Decoder, gv GroupVersioner) Decoder
+}
+
+// ClientNegotiator handles turning an HTTP content type into the appropriate encoder.
+// Use NewClientNegotiator or NewVersionedClientNegotiator to create this interface from
+// a NegotiatedSerializer.
+type ClientNegotiator interface {
+	// Encoder returns the appropriate encoder for the provided contentType (e.g. application/json)
+	// and any optional mediaType parameters (e.g. pretty=1), or an error. If no serializer is found
+	// a NegotiateError will be returned. The current client implementations consider params to be
+	// optional modifiers to the contentType and will ignore unrecognized parameters.
+	Encoder(contentType string, params map[string]string) (Encoder, error)
+	// Decoder returns the appropriate decoder for the provided contentType (e.g. application/json)
+	// and any optional mediaType parameters (e.g. pretty=1), or an error. If no serializer is found
+	// a NegotiateError will be returned. The current client implementations consider params to be
+	// optional modifiers to the contentType and will ignore unrecognized parameters.
+	Decoder(contentType string, params map[string]string) (Decoder, error)
+	// StreamDecoder returns the appropriate stream decoder for the provided contentType (e.g.
+	// application/json) and any optional mediaType parameters (e.g. pretty=1), or an error. If no
+	// serializer is found a NegotiateError will be returned. The Serializer and Framer will always
+	// be returned if a Decoder is returned. The current client implementations consider params to be
+	// optional modifiers to the contentType and will ignore unrecognized parameters.
+	StreamDecoder(contentType string, params map[string]string) (Decoder, Serializer, Framer, error)
+}
+
+// StorageSerializer is an interface used for obtaining encoders, decoders, and serializers
+// that can read and write data at rest. This would commonly be used by client tools that must
+// read files, or server side storage interfaces that persist restful objects.
+type StorageSerializer interface {
+	// SupportedMediaTypes are the media types supported for reading and writing objects.
+	SupportedMediaTypes() []SerializerInfo
+
+	// UniversalDeserializer returns a Serializer that can read objects in multiple supported formats
+	// by introspecting the data at rest.
+	UniversalDeserializer() Decoder
+
+	// EncoderForVersion returns an encoder that ensures objects being written to the provided
+	// serializer are in the provided group version.
+	EncoderForVersion(serializer Encoder, gv GroupVersioner) Encoder
+	// DecoderForVersion returns a decoder that ensures objects being read by the provided
+	// serializer are in the provided group version by default.
+	DecoderToVersion(serializer Decoder, gv GroupVersioner) Decoder
+}
+
+// NestedObjectEncoder is an optional interface that objects may implement to be given
+// an opportunity to encode any nested Objects / RawExtensions during serialization.
+type NestedObjectEncoder interface {
+	EncodeNestedObjects(e Encoder) error
+}
+
+// NestedObjectDecoder is an optional interface that objects may implement to be given
+// an opportunity to decode any nested Objects / RawExtensions during serialization.
+// It is possible for DecodeNestedObjects to return a non-nil error but for the decoding
+// to have succeeded in the case of strict decoding errors (e.g. unknown/duplicate fields).
+// As such it is important for callers of DecodeNestedObjects to check to confirm whether
+// an error is a runtime.StrictDecodingError before short circuiting.
+// Similarly, implementations of DecodeNestedObjects should ensure that a runtime.StrictDecodingError
+// is only returned when the rest of decoding has succeeded.
+type NestedObjectDecoder interface {
+	DecodeNestedObjects(d Decoder) error
+}
+
+///////////////////////////////////////////////////////////////////////////////
+// Non-codec interfaces
+
+type ObjectDefaulter interface {
+	// Default takes an object (must be a pointer) and applies any default values.
+	// Defaulters may not error.
+	Default(in Object)
+}
+
+type ObjectVersioner interface {
+	ConvertToVersion(in Object, gv GroupVersioner) (out Object, err error)
+	PrioritizedVersionsForGroup(group string) []schema.GroupVersion
+}
+
+// ObjectConvertor converts an object to a different version.
+type ObjectConvertor interface {
+	// Convert attempts to convert one object into another, or returns an error. This
+	// method does not mutate the in object, but the in and out object might share data structures,
+	// i.e. the out object cannot be mutated without mutating the in object as well.
+	// The context argument will be passed to all nested conversions.
+	Convert(in, out, context interface{}) error
+	// ConvertToVersion takes the provided object and converts it the provided version. This
+	// method does not mutate the in object, but the in and out object might share data structures,
+	// i.e. the out object cannot be mutated without mutating the in object as well.
+	// This method is similar to Convert() but handles specific details of choosing the correct
+	// output version.
+	ConvertToVersion(in Object, gv GroupVersioner) (out Object, err error)
+	ConvertFieldLabel(gvk schema.GroupVersionKind, label, value string) (string, string, error)
+}
+
+// ObjectTyper contains methods for extracting the APIVersion and Kind
+// of objects.
+type ObjectTyper interface {
+	// ObjectKinds returns the all possible group,version,kind of the provided object, true if
+	// the object is unversioned, or an error if the object is not recognized
+	// (IsNotRegisteredError will return true).
+	ObjectKinds(Object) ([]schema.GroupVersionKind, bool, error)
+	// Recognizes returns true if the scheme is able to handle the provided version and kind,
+	// or more precisely that the provided version is a possible conversion or decoding
+	// target.
+	Recognizes(gvk schema.GroupVersionKind) bool
+}
+
+// ObjectCreater contains methods for instantiating an object by kind and version.
+type ObjectCreater interface {
+	New(kind schema.GroupVersionKind) (out Object, err error)
+}
+
+// EquivalentResourceMapper provides information about resources that address the same underlying data as a specified resource
+type EquivalentResourceMapper interface {
+	// EquivalentResourcesFor returns a list of resources that address the same underlying data as resource.
+	// If subresource is specified, only equivalent resources which also have the same subresource are included.
+	// The specified resource can be included in the returned list.
+	EquivalentResourcesFor(resource schema.GroupVersionResource, subresource string) []schema.GroupVersionResource
+	// KindFor returns the kind expected by the specified resource[/subresource].
+	// A zero value is returned if the kind is unknown.
+	KindFor(resource schema.GroupVersionResource, subresource string) schema.GroupVersionKind
+}
+
+// EquivalentResourceRegistry provides an EquivalentResourceMapper interface,
+// and allows registering known resource[/subresource] -> kind
+type EquivalentResourceRegistry interface {
+	EquivalentResourceMapper
+	// RegisterKindFor registers the existence of the specified resource[/subresource] along with its expected kind.
+	RegisterKindFor(resource schema.GroupVersionResource, subresource string, kind schema.GroupVersionKind)
+}
+
+// ResourceVersioner provides methods for setting and retrieving
+// the resource version from an API object.
+type ResourceVersioner interface {
+	SetResourceVersion(obj Object, version string) error
+	ResourceVersion(obj Object) (string, error)
+}
+
+// Namer provides methods for retrieving name and namespace of an API object.
+type Namer interface {
+	// Name returns the name of a given object.
+	Name(obj Object) (string, error)
+	// Namespace returns the name of a given object.
+	Namespace(obj Object) (string, error)
+}
+
+// Object interface must be supported by all API types registered with Scheme. Since objects in a scheme are
+// expected to be serialized to the wire, the interface an Object must provide to the Scheme allows
+// serializers to set the kind, version, and group the object is represented as. An Object may choose
+// to return a no-op ObjectKindAccessor in cases where it is not expected to be serialized.
+type Object interface {
+	GetObjectKind() schema.ObjectKind
+	DeepCopyObject() Object
+}
+
+// CacheableObject allows an object to cache its different serializations
+// to avoid performing the same serialization multiple times.
+type CacheableObject interface {
+	// CacheEncode writes an object to a stream. The <encode> function will
+	// be used in case of cache miss. The <encode> function takes ownership
+	// of the object.
+	// If CacheableObject is a wrapper, then deep-copy of the wrapped object
+	// should be passed to <encode> function.
+	// CacheEncode assumes that for two different calls with the same <id>,
+	// <encode> function will also be the same.
+	CacheEncode(id Identifier, encode func(Object, io.Writer) error, w io.Writer) error
+	// GetObject returns a deep-copy of an object to be encoded - the caller of
+	// GetObject() is the owner of returned object. The reason for making a copy
+	// is to avoid bugs, where caller modifies the object and forgets to copy it,
+	// thus modifying the object for everyone.
+	// The object returned by GetObject should be the same as the one that is supposed
+	// to be passed to <encode> function in CacheEncode method.
+	// If CacheableObject is a wrapper, the copy of wrapped object should be returned.
+	GetObject() Object
+}
+
+// Unstructured objects store values as map[string]interface{}, with only values that can be serialized
+// to JSON allowed.
+type Unstructured interface {
+	Object
+	// NewEmptyInstance returns a new instance of the concrete type containing only kind/apiVersion and no other data.
+	// This should be called instead of reflect.New() for unstructured types because the go type alone does not preserve kind/apiVersion info.
+	NewEmptyInstance() Unstructured
+	// UnstructuredContent returns a non-nil map with this object's contents. Values may be
+	// []interface{}, map[string]interface{}, or any primitive type. Contents are typically serialized to
+	// and from JSON. SetUnstructuredContent should be used to mutate the contents.
+	UnstructuredContent() map[string]interface{}
+	// SetUnstructuredContent updates the object content to match the provided map.
+	SetUnstructuredContent(map[string]interface{})
+	// IsList returns true if this type is a list or matches the list convention - has an array called "items".
+	IsList() bool
+	// EachListItem should pass a single item out of the list as an Object to the provided function. Any
+	// error should terminate the iteration. If IsList() returns false, this method should return an error
+	// instead of calling the provided function.
+	EachListItem(func(Object) error) error
+	// EachListItemWithAlloc works like EachListItem, but avoids retaining references to a slice of items.
+	// It does this by making a shallow copy of non-pointer items before passing them to fn.
+	//
+	// If the items passed to fn are not retained, or are retained for the same duration, use EachListItem instead for memory efficiency.
+	EachListItemWithAlloc(func(Object) error) error
+}
+
+// ApplyConfiguration is an interface that root apply configuration types implement.
+type ApplyConfiguration interface {
+	// IsApplyConfiguration is implemented if the object is the root of an apply configuration.
+	IsApplyConfiguration()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/local_scheme_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/local_scheme_test.go
new file mode 100644
index 0000000000..9b90a71800
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/local_scheme_test.go
@@ -0,0 +1,150 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"testing"
+
+	"reflect"
+
+	"github.com/google/go-cmp/cmp"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestPreferredVersionsAllGroups(t *testing.T) {
+	tests := []struct {
+		name                string
+		versionPriority     map[string][]string
+		observedVersions    []schema.GroupVersion
+		expectedPrioritized map[string][]schema.GroupVersion
+		expectedPreferred   map[schema.GroupVersion]bool
+	}{
+		{
+			name: "observedOnly",
+			observedVersions: []schema.GroupVersion{
+				{Group: "", Version: "v3"},
+				{Group: "foo", Version: "v1"},
+				{Group: "foo", Version: "v2"},
+				{Group: "", Version: "v1"},
+			},
+			expectedPrioritized: map[string][]schema.GroupVersion{
+				"": {
+					{Group: "", Version: "v3"},
+					{Group: "", Version: "v1"},
+				},
+				"foo": {
+					{Group: "foo", Version: "v1"},
+					{Group: "foo", Version: "v2"},
+				},
+			},
+			expectedPreferred: map[schema.GroupVersion]bool{
+				{Group: "", Version: "v3"}:    true,
+				{Group: "foo", Version: "v1"}: true,
+			},
+		},
+		{
+			name: "specifiedOnly",
+			versionPriority: map[string][]string{
+				"":    {"v3", "v1"},
+				"foo": {"v1", "v2"},
+			},
+			expectedPrioritized: map[string][]schema.GroupVersion{
+				"": {
+					{Group: "", Version: "v3"},
+					{Group: "", Version: "v1"},
+				},
+				"foo": {
+					{Group: "foo", Version: "v1"},
+					{Group: "foo", Version: "v2"},
+				},
+			},
+			expectedPreferred: map[schema.GroupVersion]bool{
+				{Group: "", Version: "v3"}:    true,
+				{Group: "foo", Version: "v1"}: true,
+			},
+		},
+		{
+			name: "both",
+			versionPriority: map[string][]string{
+				"":    {"v3", "v1"},
+				"foo": {"v1", "v2"},
+			},
+			observedVersions: []schema.GroupVersion{
+				{Group: "", Version: "v1"},
+				{Group: "", Version: "v3"},
+				{Group: "", Version: "v4"},
+				{Group: "", Version: "v5"},
+				{Group: "bar", Version: "v1"},
+				{Group: "bar", Version: "v2"},
+			},
+			expectedPrioritized: map[string][]schema.GroupVersion{
+				"": {
+					{Group: "", Version: "v3"},
+					{Group: "", Version: "v1"},
+					{Group: "", Version: "v4"},
+					{Group: "", Version: "v5"},
+				},
+				"foo": {
+					{Group: "foo", Version: "v1"},
+					{Group: "foo", Version: "v2"},
+				},
+				"bar": {
+					{Group: "bar", Version: "v1"},
+					{Group: "bar", Version: "v2"},
+				},
+			},
+			expectedPreferred: map[schema.GroupVersion]bool{
+				{Group: "", Version: "v3"}:    true,
+				{Group: "foo", Version: "v1"}: true,
+				{Group: "bar", Version: "v1"}: true,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			scheme := NewScheme()
+			scheme.versionPriority = test.versionPriority
+			scheme.observedVersions = test.observedVersions
+
+			for group, expected := range test.expectedPrioritized {
+				actual := scheme.PrioritizedVersionsForGroup(group)
+				if !reflect.DeepEqual(expected, actual) {
+					t.Error(cmp.Diff(expected, actual))
+				}
+			}
+
+			prioritizedAll := scheme.PrioritizedVersionsAllGroups()
+			actualPrioritizedAll := map[string][]schema.GroupVersion{}
+			for _, actual := range prioritizedAll {
+				actualPrioritizedAll[actual.Group] = append(actualPrioritizedAll[actual.Group], actual)
+			}
+			if !reflect.DeepEqual(test.expectedPrioritized, actualPrioritizedAll) {
+				t.Error(cmp.Diff(test.expectedPrioritized, actualPrioritizedAll))
+			}
+
+			preferredAll := scheme.PreferredVersionAllGroups()
+			actualPreferredAll := map[schema.GroupVersion]bool{}
+			for _, actual := range preferredAll {
+				actualPreferredAll[actual] = true
+			}
+			if !reflect.DeepEqual(test.expectedPreferred, actualPreferredAll) {
+				t.Error(cmp.Diff(test.expectedPreferred, actualPreferredAll))
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/mapper.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/mapper.go
new file mode 100644
index 0000000000..3ff84611ab
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/mapper.go
@@ -0,0 +1,98 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"sync"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type equivalentResourceRegistry struct {
+	// keyFunc computes a key for the specified resource (this allows honoring colocated resources across API groups).
+	// if null, or if "" is returned, resource.String() is used as the key
+	keyFunc func(resource schema.GroupResource) string
+	// resources maps key -> subresource -> equivalent resources (subresource is not included in the returned resources).
+	// main resources are stored with subresource="".
+	resources map[string]map[string][]schema.GroupVersionResource
+	// kinds maps resource -> subresource -> kind
+	kinds map[schema.GroupVersionResource]map[string]schema.GroupVersionKind
+	// keys caches the computed key for each GroupResource
+	keys map[schema.GroupResource]string
+
+	mutex sync.RWMutex
+}
+
+var _ EquivalentResourceMapper = (*equivalentResourceRegistry)(nil)
+var _ EquivalentResourceRegistry = (*equivalentResourceRegistry)(nil)
+
+// NewEquivalentResourceRegistry creates a resource registry that considers all versions of a GroupResource to be equivalent.
+func NewEquivalentResourceRegistry() EquivalentResourceRegistry {
+	return &equivalentResourceRegistry{}
+}
+
+// NewEquivalentResourceRegistryWithIdentity creates a resource mapper with a custom identity function.
+// If "" is returned by the function, GroupResource#String is used as the identity.
+// GroupResources with the same identity string are considered equivalent.
+func NewEquivalentResourceRegistryWithIdentity(keyFunc func(schema.GroupResource) string) EquivalentResourceRegistry {
+	return &equivalentResourceRegistry{keyFunc: keyFunc}
+}
+
+func (r *equivalentResourceRegistry) EquivalentResourcesFor(resource schema.GroupVersionResource, subresource string) []schema.GroupVersionResource {
+	r.mutex.RLock()
+	defer r.mutex.RUnlock()
+	return r.resources[r.keys[resource.GroupResource()]][subresource]
+}
+func (r *equivalentResourceRegistry) KindFor(resource schema.GroupVersionResource, subresource string) schema.GroupVersionKind {
+	r.mutex.RLock()
+	defer r.mutex.RUnlock()
+	return r.kinds[resource][subresource]
+}
+func (r *equivalentResourceRegistry) RegisterKindFor(resource schema.GroupVersionResource, subresource string, kind schema.GroupVersionKind) {
+	r.mutex.Lock()
+	defer r.mutex.Unlock()
+	if r.kinds == nil {
+		r.kinds = map[schema.GroupVersionResource]map[string]schema.GroupVersionKind{}
+	}
+	if r.kinds[resource] == nil {
+		r.kinds[resource] = map[string]schema.GroupVersionKind{}
+	}
+	r.kinds[resource][subresource] = kind
+
+	// get the shared key of the parent resource
+	key := ""
+	gr := resource.GroupResource()
+	if r.keyFunc != nil {
+		key = r.keyFunc(gr)
+	}
+	if key == "" {
+		key = gr.String()
+	}
+
+	if r.keys == nil {
+		r.keys = map[schema.GroupResource]string{}
+	}
+	r.keys[gr] = key
+
+	if r.resources == nil {
+		r.resources = map[string]map[string][]schema.GroupVersionResource{}
+	}
+	if r.resources[key] == nil {
+		r.resources[key] = map[string][]schema.GroupVersionResource{}
+	}
+	r.resources[key][subresource] = append(r.resources[key][subresource], resource)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/mapper_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/mapper_test.go
new file mode 100644
index 0000000000..d8423e0e31
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/mapper_test.go
@@ -0,0 +1,136 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestResourceMapper(t *testing.T) {
+	gvr := func(g, v, r string) schema.GroupVersionResource {
+		return schema.GroupVersionResource{Group: g, Version: v, Resource: r}
+	}
+
+	gvk := func(g, v, k string) schema.GroupVersionKind {
+		return schema.GroupVersionKind{Group: g, Version: v, Kind: k}
+	}
+
+	kindsToRegister := []struct {
+		gvr         schema.GroupVersionResource
+		subresource string
+		gvk         schema.GroupVersionKind
+	}{
+		// pods
+		{gvr("", "v1", "pods"), "", gvk("", "v1", "Pod")},
+		// pods/status
+		{gvr("", "v1", "pods"), "status", gvk("", "v1", "Pod")},
+		// deployments
+		{gvr("apps", "v1", "deployments"), "", gvk("apps", "v1", "Deployment")},
+		{gvr("apps", "v1beta1", "deployments"), "", gvk("apps", "v1beta1", "Deployment")},
+		{gvr("apps", "v1alpha1", "deployments"), "", gvk("apps", "v1alpha1", "Deployment")},
+		{gvr("extensions", "v1beta1", "deployments"), "", gvk("extensions", "v1beta1", "Deployment")},
+		// deployments/scale (omitted for apps/v1alpha1)
+		{gvr("apps", "v1", "deployments"), "scale", gvk("", "", "Scale")},
+		{gvr("apps", "v1beta1", "deployments"), "scale", gvk("", "", "Scale")},
+		{gvr("extensions", "v1beta1", "deployments"), "scale", gvk("", "", "Scale")},
+		// deployments/status (omitted for apps/v1alpha1)
+		{gvr("apps", "v1", "deployments"), "status", gvk("apps", "v1", "Deployment")},
+		{gvr("apps", "v1beta1", "deployments"), "status", gvk("apps", "v1beta1", "Deployment")},
+		{gvr("extensions", "v1beta1", "deployments"), "status", gvk("extensions", "v1beta1", "Deployment")},
+	}
+
+	testcases := []struct {
+		Name                           string
+		IdentityFunc                   func(schema.GroupResource) string
+		ResourcesForV1Deployment       []schema.GroupVersionResource
+		ResourcesForV1DeploymentScale  []schema.GroupVersionResource
+		ResourcesForV1DeploymentStatus []schema.GroupVersionResource
+	}{
+		{
+			Name:                           "no identityfunc",
+			ResourcesForV1Deployment:       []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("apps", "v1alpha1", "deployments")},
+			ResourcesForV1DeploymentScale:  []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments")},
+			ResourcesForV1DeploymentStatus: []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments")},
+		},
+		{
+			Name:         "empty identityfunc",
+			IdentityFunc: func(schema.GroupResource) string { return "" },
+			// same group
+			ResourcesForV1Deployment:       []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("apps", "v1alpha1", "deployments")},
+			ResourcesForV1DeploymentScale:  []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments")},
+			ResourcesForV1DeploymentStatus: []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments")},
+		},
+		{
+			Name:         "common identityfunc",
+			IdentityFunc: func(schema.GroupResource) string { return "x" },
+			// all resources are seen as equivalent
+			ResourcesForV1Deployment: []schema.GroupVersionResource{gvr("", "v1", "pods"), gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("apps", "v1alpha1", "deployments"), gvr("extensions", "v1beta1", "deployments")},
+			// all resources with scale are seen as equivalent
+			ResourcesForV1DeploymentScale: []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("extensions", "v1beta1", "deployments")},
+			// all resources with status are seen as equivalent
+			ResourcesForV1DeploymentStatus: []schema.GroupVersionResource{gvr("", "v1", "pods"), gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("extensions", "v1beta1", "deployments")},
+		},
+		{
+			Name: "colocated deployments",
+			IdentityFunc: func(resource schema.GroupResource) string {
+				if resource.Resource == "deployments" {
+					return "deployments"
+				}
+				return ""
+			},
+			// all deployments are seen as equivalent
+			ResourcesForV1Deployment: []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("apps", "v1alpha1", "deployments"), gvr("extensions", "v1beta1", "deployments")},
+			// all deployments with scale are seen as equivalent
+			ResourcesForV1DeploymentScale: []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("extensions", "v1beta1", "deployments")},
+			// all deployments with status are seen as equivalent
+			ResourcesForV1DeploymentStatus: []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("extensions", "v1beta1", "deployments")},
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.Name, func(t *testing.T) {
+			mapper := NewEquivalentResourceRegistryWithIdentity(tc.IdentityFunc)
+
+			// register
+			for _, data := range kindsToRegister {
+				mapper.RegisterKindFor(data.gvr, data.subresource, data.gvk)
+			}
+			// verify
+			for _, data := range kindsToRegister {
+				if kind := mapper.KindFor(data.gvr, data.subresource); kind != data.gvk {
+					t.Errorf("KindFor(%#v, %v) returned %#v, expected %#v", data.gvr, data.subresource, kind, data.gvk)
+				}
+			}
+
+			// Verify equivalents to primary resource
+			if resources := mapper.EquivalentResourcesFor(gvr("apps", "v1", "deployments"), ""); !reflect.DeepEqual(resources, tc.ResourcesForV1Deployment) {
+				t.Errorf("diff:\n%s", cmp.Diff(tc.ResourcesForV1Deployment, resources))
+			}
+			// Verify equivalents to subresources
+			if resources := mapper.EquivalentResourcesFor(gvr("apps", "v1", "deployments"), "scale"); !reflect.DeepEqual(resources, tc.ResourcesForV1DeploymentScale) {
+				t.Errorf("diff:\n%s", cmp.Diff(tc.ResourcesForV1DeploymentScale, resources))
+			}
+			if resources := mapper.EquivalentResourcesFor(gvr("apps", "v1", "deployments"), "status"); !reflect.DeepEqual(resources, tc.ResourcesForV1DeploymentStatus) {
+				t.Errorf("diff:\n%s", cmp.Diff(tc.ResourcesForV1DeploymentStatus, resources))
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/negotiate.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/negotiate.go
new file mode 100644
index 0000000000..3ab119b0a8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/negotiate.go
@@ -0,0 +1,113 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// NegotiateError is returned when a ClientNegotiator is unable to locate
+// a serializer for the requested operation.
+type NegotiateError struct {
+	ContentType string
+	Stream      bool
+}
+
+func (e NegotiateError) Error() string {
+	if e.Stream {
+		return fmt.Sprintf("no stream serializers registered for %s", e.ContentType)
+	}
+	return fmt.Sprintf("no serializers registered for %s", e.ContentType)
+}
+
+type clientNegotiator struct {
+	serializer     NegotiatedSerializer
+	encode, decode GroupVersioner
+}
+
+func (n *clientNegotiator) Encoder(contentType string, params map[string]string) (Encoder, error) {
+	// TODO: `pretty=1` is handled in NegotiateOutputMediaType, consider moving it to this method
+	// if client negotiators truly need to use it
+	mediaTypes := n.serializer.SupportedMediaTypes()
+	info, ok := SerializerInfoForMediaType(mediaTypes, contentType)
+	if !ok {
+		if len(contentType) != 0 || len(mediaTypes) == 0 {
+			return nil, NegotiateError{ContentType: contentType}
+		}
+		info = mediaTypes[0]
+	}
+	return n.serializer.EncoderForVersion(info.Serializer, n.encode), nil
+}
+
+func (n *clientNegotiator) Decoder(contentType string, params map[string]string) (Decoder, error) {
+	mediaTypes := n.serializer.SupportedMediaTypes()
+	info, ok := SerializerInfoForMediaType(mediaTypes, contentType)
+	if !ok {
+		if len(contentType) != 0 || len(mediaTypes) == 0 {
+			return nil, NegotiateError{ContentType: contentType}
+		}
+		info = mediaTypes[0]
+	}
+	return n.serializer.DecoderToVersion(info.Serializer, n.decode), nil
+}
+
+func (n *clientNegotiator) StreamDecoder(contentType string, params map[string]string) (Decoder, Serializer, Framer, error) {
+	mediaTypes := n.serializer.SupportedMediaTypes()
+	info, ok := SerializerInfoForMediaType(mediaTypes, contentType)
+	if !ok {
+		if len(contentType) != 0 || len(mediaTypes) == 0 {
+			return nil, nil, nil, NegotiateError{ContentType: contentType, Stream: true}
+		}
+		info = mediaTypes[0]
+	}
+	if info.StreamSerializer == nil {
+		return nil, nil, nil, NegotiateError{ContentType: info.MediaType, Stream: true}
+	}
+	return n.serializer.DecoderToVersion(info.Serializer, n.decode), info.StreamSerializer.Serializer, info.StreamSerializer.Framer, nil
+}
+
+// NewClientNegotiator will attempt to retrieve the appropriate encoder, decoder, or
+// stream decoder for a given content type. Does not perform any conversion, but will
+// encode the object to the desired group, version, and kind. Use when creating a client.
+func NewClientNegotiator(serializer NegotiatedSerializer, gv schema.GroupVersion) ClientNegotiator {
+	return &clientNegotiator{
+		serializer: serializer,
+		encode:     gv,
+	}
+}
+
+type simpleNegotiatedSerializer struct {
+	info SerializerInfo
+}
+
+func NewSimpleNegotiatedSerializer(info SerializerInfo) NegotiatedSerializer {
+	return &simpleNegotiatedSerializer{info: info}
+}
+
+func (n *simpleNegotiatedSerializer) SupportedMediaTypes() []SerializerInfo {
+	return []SerializerInfo{n.info}
+}
+
+func (n *simpleNegotiatedSerializer) EncoderForVersion(e Encoder, _ GroupVersioner) Encoder {
+	return e
+}
+
+func (n *simpleNegotiatedSerializer) DecoderToVersion(d Decoder, _gv GroupVersioner) Decoder {
+	return d
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/register.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/register.go
new file mode 100644
index 0000000000..1cd2e4c387
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/register.go
@@ -0,0 +1,31 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import "k8s.io/apimachinery/pkg/runtime/schema"
+
+// SetGroupVersionKind satisfies the ObjectKind interface for all objects that embed TypeMeta
+func (obj *TypeMeta) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	obj.APIVersion, obj.Kind = gvk.ToAPIVersionAndKind()
+}
+
+// GroupVersionKind satisfies the ObjectKind interface for all objects that embed TypeMeta
+func (obj *TypeMeta) GroupVersionKind() schema.GroupVersionKind {
+	return schema.FromAPIVersionAndKind(obj.APIVersion, obj.Kind)
+}
+
+func (obj *TypeMeta) GetObjectKind() schema.ObjectKind { return obj }
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/schema/generated.pb.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/schema/generated.pb.go
new file mode 100644
index 0000000000..ed57e08afe
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/schema/generated.pb.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/apimachinery/pkg/runtime/schema/generated.proto
+
+package schema
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/schema/generated.proto b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/schema/generated.proto
new file mode 100644
index 0000000000..01a9c01e5c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/schema/generated.proto
@@ -0,0 +1,26 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.apimachinery.pkg.runtime.schema;
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/apimachinery/pkg/runtime/schema";
+
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/schema/group_version.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/schema/group_version.go
new file mode 100644
index 0000000000..d1c37c9429
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/schema/group_version.go
@@ -0,0 +1,305 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package schema
+
+import (
+	"fmt"
+	"strings"
+)
+
+// ParseResourceArg takes the common style of string which may be either `resource.group.com` or `resource.version.group.com`
+// and parses it out into both possibilities.  This code takes no responsibility for knowing which representation was intended
+// but with a knowledge of all GroupVersions, calling code can take a very good guess.  If there are only two segments, then
+// `*GroupVersionResource` is nil.
+// `resource.group.com` -> `group=com, version=group, resource=resource` and `group=group.com, resource=resource`
+func ParseResourceArg(arg string) (*GroupVersionResource, GroupResource) {
+	var gvr *GroupVersionResource
+	if strings.Count(arg, ".") >= 2 {
+		s := strings.SplitN(arg, ".", 3)
+		gvr = &GroupVersionResource{Group: s[2], Version: s[1], Resource: s[0]}
+	}
+
+	return gvr, ParseGroupResource(arg)
+}
+
+// ParseKindArg takes the common style of string which may be either `Kind.group.com` or `Kind.version.group.com`
+// and parses it out into both possibilities. This code takes no responsibility for knowing which representation was intended
+// but with a knowledge of all GroupKinds, calling code can take a very good guess. If there are only two segments, then
+// `*GroupVersionKind` is nil.
+// `Kind.group.com` -> `group=com, version=group, kind=Kind` and `group=group.com, kind=Kind`
+func ParseKindArg(arg string) (*GroupVersionKind, GroupKind) {
+	var gvk *GroupVersionKind
+	if strings.Count(arg, ".") >= 2 {
+		s := strings.SplitN(arg, ".", 3)
+		gvk = &GroupVersionKind{Group: s[2], Version: s[1], Kind: s[0]}
+	}
+
+	return gvk, ParseGroupKind(arg)
+}
+
+// GroupResource specifies a Group and a Resource, but does not force a version.  This is useful for identifying
+// concepts during lookup stages without having partially valid types
+type GroupResource struct {
+	Group    string
+	Resource string
+}
+
+func (gr GroupResource) WithVersion(version string) GroupVersionResource {
+	return GroupVersionResource{Group: gr.Group, Version: version, Resource: gr.Resource}
+}
+
+func (gr GroupResource) Empty() bool {
+	return len(gr.Group) == 0 && len(gr.Resource) == 0
+}
+
+func (gr GroupResource) String() string {
+	if len(gr.Group) == 0 {
+		return gr.Resource
+	}
+	return gr.Resource + "." + gr.Group
+}
+
+func ParseGroupKind(gk string) GroupKind {
+	i := strings.Index(gk, ".")
+	if i == -1 {
+		return GroupKind{Kind: gk}
+	}
+
+	return GroupKind{Group: gk[i+1:], Kind: gk[:i]}
+}
+
+// ParseGroupResource turns "resource.group" string into a GroupResource struct.  Empty strings are allowed
+// for each field.
+func ParseGroupResource(gr string) GroupResource {
+	if i := strings.Index(gr, "."); i >= 0 {
+		return GroupResource{Group: gr[i+1:], Resource: gr[:i]}
+	}
+	return GroupResource{Resource: gr}
+}
+
+// GroupVersionResource unambiguously identifies a resource.  It doesn't anonymously include GroupVersion
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
+type GroupVersionResource struct {
+	Group    string
+	Version  string
+	Resource string
+}
+
+func (gvr GroupVersionResource) Empty() bool {
+	return len(gvr.Group) == 0 && len(gvr.Version) == 0 && len(gvr.Resource) == 0
+}
+
+func (gvr GroupVersionResource) GroupResource() GroupResource {
+	return GroupResource{Group: gvr.Group, Resource: gvr.Resource}
+}
+
+func (gvr GroupVersionResource) GroupVersion() GroupVersion {
+	return GroupVersion{Group: gvr.Group, Version: gvr.Version}
+}
+
+func (gvr GroupVersionResource) String() string {
+	return strings.Join([]string{gvr.Group, "/", gvr.Version, ", Resource=", gvr.Resource}, "")
+}
+
+// GroupKind specifies a Group and a Kind, but does not force a version.  This is useful for identifying
+// concepts during lookup stages without having partially valid types
+type GroupKind struct {
+	Group string
+	Kind  string
+}
+
+func (gk GroupKind) Empty() bool {
+	return len(gk.Group) == 0 && len(gk.Kind) == 0
+}
+
+func (gk GroupKind) WithVersion(version string) GroupVersionKind {
+	return GroupVersionKind{Group: gk.Group, Version: version, Kind: gk.Kind}
+}
+
+func (gk GroupKind) String() string {
+	if len(gk.Group) == 0 {
+		return gk.Kind
+	}
+	return gk.Kind + "." + gk.Group
+}
+
+// GroupVersionKind unambiguously identifies a kind.  It doesn't anonymously include GroupVersion
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
+type GroupVersionKind struct {
+	Group   string
+	Version string
+	Kind    string
+}
+
+// Empty returns true if group, version, and kind are empty
+func (gvk GroupVersionKind) Empty() bool {
+	return len(gvk.Group) == 0 && len(gvk.Version) == 0 && len(gvk.Kind) == 0
+}
+
+func (gvk GroupVersionKind) GroupKind() GroupKind {
+	return GroupKind{Group: gvk.Group, Kind: gvk.Kind}
+}
+
+func (gvk GroupVersionKind) GroupVersion() GroupVersion {
+	return GroupVersion{Group: gvk.Group, Version: gvk.Version}
+}
+
+func (gvk GroupVersionKind) String() string {
+	return gvk.Group + "/" + gvk.Version + ", Kind=" + gvk.Kind
+}
+
+// GroupVersion contains the "group" and the "version", which uniquely identifies the API.
+type GroupVersion struct {
+	Group   string
+	Version string
+}
+
+// Empty returns true if group and version are empty
+func (gv GroupVersion) Empty() bool {
+	return len(gv.Group) == 0 && len(gv.Version) == 0
+}
+
+// String puts "group" and "version" into a single "group/version" string. For the legacy v1
+// it returns "v1".
+func (gv GroupVersion) String() string {
+	if len(gv.Group) > 0 {
+		return gv.Group + "/" + gv.Version
+	}
+	return gv.Version
+}
+
+// Identifier implements runtime.GroupVersioner interface.
+func (gv GroupVersion) Identifier() string {
+	return gv.String()
+}
+
+// KindForGroupVersionKinds identifies the preferred GroupVersionKind out of a list. It returns ok false
+// if none of the options match the group. It prefers a match to group and version over just group.
+// TODO: Move GroupVersion to a package under pkg/runtime, since it's used by scheme.
+// TODO: Introduce an adapter type between GroupVersion and runtime.GroupVersioner, and use LegacyCodec(GroupVersion)
+// in fewer places.
+func (gv GroupVersion) KindForGroupVersionKinds(kinds []GroupVersionKind) (target GroupVersionKind, ok bool) {
+	for _, gvk := range kinds {
+		if gvk.Group == gv.Group && gvk.Version == gv.Version {
+			return gvk, true
+		}
+	}
+	for _, gvk := range kinds {
+		if gvk.Group == gv.Group {
+			return gv.WithKind(gvk.Kind), true
+		}
+	}
+	return GroupVersionKind{}, false
+}
+
+// ParseGroupVersion turns "group/version" string into a GroupVersion struct. It reports error
+// if it cannot parse the string.
+func ParseGroupVersion(gv string) (GroupVersion, error) {
+	// this can be the internal version for the legacy kube types
+	// TODO once we've cleared the last uses as strings, this special case should be removed.
+	if (len(gv) == 0) || (gv == "/") {
+		return GroupVersion{}, nil
+	}
+
+	switch strings.Count(gv, "/") {
+	case 0:
+		return GroupVersion{"", gv}, nil
+	case 1:
+		i := strings.Index(gv, "/")
+		return GroupVersion{gv[:i], gv[i+1:]}, nil
+	default:
+		return GroupVersion{}, fmt.Errorf("unexpected GroupVersion string: %v", gv)
+	}
+}
+
+// WithKind creates a GroupVersionKind based on the method receiver's GroupVersion and the passed Kind.
+func (gv GroupVersion) WithKind(kind string) GroupVersionKind {
+	return GroupVersionKind{Group: gv.Group, Version: gv.Version, Kind: kind}
+}
+
+// WithResource creates a GroupVersionResource based on the method receiver's GroupVersion and the passed Resource.
+func (gv GroupVersion) WithResource(resource string) GroupVersionResource {
+	return GroupVersionResource{Group: gv.Group, Version: gv.Version, Resource: resource}
+}
+
+// GroupVersions can be used to represent a set of desired group versions.
+// TODO: Move GroupVersions to a package under pkg/runtime, since it's used by scheme.
+// TODO: Introduce an adapter type between GroupVersions and runtime.GroupVersioner, and use LegacyCodec(GroupVersion)
+// in fewer places.
+type GroupVersions []GroupVersion
+
+// Identifier implements runtime.GroupVersioner interface.
+func (gvs GroupVersions) Identifier() string {
+	groupVersions := make([]string, 0, len(gvs))
+	for i := range gvs {
+		groupVersions = append(groupVersions, gvs[i].String())
+	}
+	return fmt.Sprintf("[%s]", strings.Join(groupVersions, ","))
+}
+
+// KindForGroupVersionKinds identifies the preferred GroupVersionKind out of a list. It returns ok false
+// if none of the options match the group.
+func (gvs GroupVersions) KindForGroupVersionKinds(kinds []GroupVersionKind) (GroupVersionKind, bool) {
+	var targets []GroupVersionKind
+	for _, gv := range gvs {
+		target, ok := gv.KindForGroupVersionKinds(kinds)
+		if !ok {
+			continue
+		}
+		targets = append(targets, target)
+	}
+	if len(targets) == 1 {
+		return targets[0], true
+	}
+	if len(targets) > 1 {
+		return bestMatch(kinds, targets), true
+	}
+	return GroupVersionKind{}, false
+}
+
+// bestMatch tries to pick best matching GroupVersionKind and falls back to the first
+// found if no exact match exists.
+func bestMatch(kinds []GroupVersionKind, targets []GroupVersionKind) GroupVersionKind {
+	for _, gvk := range targets {
+		for _, k := range kinds {
+			if k == gvk {
+				return k
+			}
+		}
+	}
+	return targets[0]
+}
+
+// ToAPIVersionAndKind is a convenience method for satisfying runtime.Object on types that
+// do not use TypeMeta.
+func (gvk GroupVersionKind) ToAPIVersionAndKind() (string, string) {
+	if gvk.Empty() {
+		return "", ""
+	}
+	return gvk.GroupVersion().String(), gvk.Kind
+}
+
+// FromAPIVersionAndKind returns a GVK representing the provided fields for types that
+// do not use TypeMeta. This method exists to support test types and legacy serializations
+// that have a distinct group and kind.
+// TODO: further reduce usage of this method.
+func FromAPIVersionAndKind(apiVersion, kind string) GroupVersionKind {
+	if gv, err := ParseGroupVersion(apiVersion); err == nil {
+		return GroupVersionKind{Group: gv.Group, Version: gv.Version, Kind: kind}
+	}
+	return GroupVersionKind{Kind: kind}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/schema/group_version_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/schema/group_version_test.go
new file mode 100644
index 0000000000..ff28593c5c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/schema/group_version_test.go
@@ -0,0 +1,240 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package schema
+
+import (
+	"testing"
+)
+
+func TestGroupVersionParse(t *testing.T) {
+	tests := []struct {
+		input string
+		out   GroupVersion
+		err   func(error) bool
+	}{
+		{input: "v1", out: GroupVersion{Version: "v1"}},
+		{input: "v2", out: GroupVersion{Version: "v2"}},
+		{input: "/v1", out: GroupVersion{Version: "v1"}},
+		{input: "v1/", out: GroupVersion{Group: "v1"}},
+		{input: "/v1/", err: func(err error) bool { return err.Error() == "unexpected GroupVersion string: /v1/" }},
+		{input: "v1/a", out: GroupVersion{Group: "v1", Version: "a"}},
+	}
+	for i, test := range tests {
+		out, err := ParseGroupVersion(test.input)
+		if test.err == nil && err != nil || err == nil && test.err != nil {
+			t.Errorf("%d: unexpected error: %v", i, err)
+			continue
+		}
+		if test.err != nil && !test.err(err) {
+			t.Errorf("%d: unexpected error: %v", i, err)
+			continue
+		}
+		if out != test.out {
+			t.Errorf("%d: unexpected output: %#v", i, out)
+		}
+	}
+}
+
+func TestGroupResourceParse(t *testing.T) {
+	tests := []struct {
+		input string
+		out   GroupResource
+	}{
+		{input: "v1", out: GroupResource{Resource: "v1"}},
+		{input: ".v1", out: GroupResource{Group: "v1"}},
+		{input: "v1.", out: GroupResource{Resource: "v1"}},
+		{input: "v1.a", out: GroupResource{Group: "a", Resource: "v1"}},
+		{input: "b.v1.a", out: GroupResource{Group: "v1.a", Resource: "b"}},
+	}
+	for i, test := range tests {
+		out := ParseGroupResource(test.input)
+		if out != test.out {
+			t.Errorf("%d: unexpected output: %#v", i, out)
+		}
+	}
+}
+
+func TestParseResourceArg(t *testing.T) {
+	tests := []struct {
+		input string
+		gvr   *GroupVersionResource
+		gr    GroupResource
+	}{
+		{input: "v1", gr: GroupResource{Resource: "v1"}},
+		{input: ".v1", gr: GroupResource{Group: "v1"}},
+		{input: "v1.", gr: GroupResource{Resource: "v1"}},
+		{input: "v1.a", gr: GroupResource{Group: "a", Resource: "v1"}},
+		{input: "b.v1.a", gvr: &GroupVersionResource{Group: "a", Version: "v1", Resource: "b"}, gr: GroupResource{Group: "v1.a", Resource: "b"}},
+	}
+	for i, test := range tests {
+		gvr, gr := ParseResourceArg(test.input)
+		if (gvr != nil && test.gvr == nil) || (gvr == nil && test.gvr != nil) || (test.gvr != nil && *gvr != *test.gvr) {
+			t.Errorf("%d: unexpected output: %#v", i, gvr)
+		}
+		if gr != test.gr {
+			t.Errorf("%d: unexpected output: %#v", i, gr)
+		}
+	}
+}
+
+func TestKindForGroupVersionKinds(t *testing.T) {
+	gvks := GroupVersions{
+		GroupVersion{Group: "batch", Version: "v1"},
+		GroupVersion{Group: "batch", Version: "v2alpha1"},
+		GroupVersion{Group: "policy", Version: "v1beta1"},
+	}
+	cases := []struct {
+		input  []GroupVersionKind
+		target GroupVersionKind
+		ok     bool
+	}{
+		{
+			input:  []GroupVersionKind{{Group: "batch", Version: "v2alpha1", Kind: "ScheduledJob"}},
+			target: GroupVersionKind{Group: "batch", Version: "v2alpha1", Kind: "ScheduledJob"},
+			ok:     true,
+		},
+		{
+			input:  []GroupVersionKind{{Group: "batch", Version: "v3alpha1", Kind: "CronJob"}},
+			target: GroupVersionKind{Group: "batch", Version: "v1", Kind: "CronJob"},
+			ok:     true,
+		},
+		{
+			input:  []GroupVersionKind{{Group: "policy", Version: "v1beta1", Kind: "PodDisruptionBudget"}},
+			target: GroupVersionKind{Group: "policy", Version: "v1beta1", Kind: "PodDisruptionBudget"},
+			ok:     true,
+		},
+		{
+			input:  []GroupVersionKind{{Group: "apps", Version: "v1alpha1", Kind: "StatefulSet"}},
+			target: GroupVersionKind{},
+			ok:     false,
+		},
+	}
+
+	for i, c := range cases {
+		target, ok := gvks.KindForGroupVersionKinds(c.input)
+		if c.target != target {
+			t.Errorf("%d: unexpected target: %v, expected %v", i, target, c.target)
+		}
+		if c.ok != ok {
+			t.Errorf("%d: unexpected ok: %v, expected %v", i, ok, c.ok)
+		}
+	}
+}
+
+func TestParseKindArg(t *testing.T) {
+	tests := []struct {
+		input string
+		gvk   *GroupVersionKind
+		gk    GroupKind
+	}{
+		{input: "Pod", gk: GroupKind{Kind: "Pod"}},
+		{input: ".apps", gk: GroupKind{Group: "apps"}},
+		{input: "Pod.", gk: GroupKind{Kind: "Pod"}},
+		{input: "StatefulSet.apps", gk: GroupKind{Group: "apps", Kind: "StatefulSet"}},
+		{input: "StatefulSet.v1.apps", gvk: &GroupVersionKind{Group: "apps", Version: "v1", Kind: "StatefulSet"}, gk: GroupKind{Group: "v1.apps", Kind: "StatefulSet"}},
+	}
+	for i, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			gvk, gk := ParseKindArg(test.input)
+			if (gvk != nil && test.gvk == nil) || (gvk == nil && test.gvk != nil) || (test.gvk != nil && *gvk != *test.gvk) {
+				t.Errorf("%d: expected output: %#v, got: %#v", i, test.gvk, gvk)
+			}
+			if gk != test.gk {
+				t.Errorf("%d: expected output: %#v, got: %#v", i, test.gk, gk)
+			}
+		})
+	}
+}
+
+func TestParseGroupKind(t *testing.T) {
+	tests := []struct {
+		input string
+		out   GroupKind
+	}{
+		{input: "Pod", out: GroupKind{Kind: "Pod"}},
+		{input: ".StatefulSet", out: GroupKind{Group: "StatefulSet"}},
+		{input: "StatefulSet.apps", out: GroupKind{Group: "apps", Kind: "StatefulSet"}},
+	}
+	for i, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			out := ParseGroupKind(test.input)
+			if out != test.out {
+				t.Errorf("%d: expected output: %#v, got: %#v", i, test.out, out)
+			}
+		})
+	}
+}
+
+func TestToAPIVersionAndKind(t *testing.T) {
+	tests := []struct {
+		desc         string
+		input        GroupVersionKind
+		GroupVersion string
+		Kind         string
+	}{
+		{
+			desc:         "gvk object is not empty",
+			input:        GroupVersionKind{Version: "V1", Kind: "pod"},
+			GroupVersion: "V1",
+			Kind:         "pod",
+		},
+		{
+			desc:         "gvk object is empty",
+			input:        GroupVersionKind{},
+			GroupVersion: "",
+			Kind:         "",
+		},
+	}
+	for i, test := range tests {
+		version, kind := test.input.ToAPIVersionAndKind()
+		if version != test.GroupVersion {
+			t.Errorf("%d: expected version: %#v, got: %#v", i, test.GroupVersion, version)
+		}
+		if kind != test.Kind {
+			t.Errorf("%d: expected kind: %#v, got: %#v", i, test.Kind, kind)
+		}
+	}
+}
+
+func TestBestMatch(t *testing.T) {
+	tests := []struct {
+		desc    string
+		kinds   []GroupVersionKind
+		targets []GroupVersionKind
+		output  GroupVersionKind
+	}{
+		{
+			desc:    "targets and kinds have match items",
+			kinds:   []GroupVersionKind{{Version: "V1", Kind: "pod"}, {Version: "V2", Kind: "pod"}},
+			targets: []GroupVersionKind{{Version: "V1", Kind: "pod"}},
+			output:  GroupVersionKind{Version: "V1", Kind: "pod"},
+		},
+		{
+			desc:    "targets and kinds do not have match items",
+			kinds:   []GroupVersionKind{{Version: "V1", Kind: "pod"}, {Version: "V2", Kind: "pod"}},
+			targets: []GroupVersionKind{{Version: "V3", Kind: "pod"}, {Version: "V4", Kind: "pod"}},
+			output:  GroupVersionKind{Version: "V3", Kind: "pod"},
+		},
+	}
+
+	for i, test := range tests {
+		out := bestMatch(test.kinds, test.targets)
+		if out != test.output {
+			t.Errorf("%d: expected out: %#v, got: %#v", i, test.output, out)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/schema/interfaces.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/schema/interfaces.go
new file mode 100644
index 0000000000..f04453fb01
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/schema/interfaces.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package schema
+
+// All objects that are serialized from a Scheme encode their type information. This interface is used
+// by serialization to set type information from the Scheme onto the serialized version of an object.
+// For objects that cannot be serialized or have unique requirements, this interface may be a no-op.
+type ObjectKind interface {
+	// SetGroupVersionKind sets or clears the intended serialized kind of an object. Passing kind nil
+	// should clear the current setting.
+	SetGroupVersionKind(kind GroupVersionKind)
+	// GroupVersionKind returns the stored group, version, and kind of an object, or an empty struct
+	// if the object does not expose or provide these fields.
+	GroupVersionKind() GroupVersionKind
+}
+
+// EmptyObjectKind implements the ObjectKind interface as a noop
+var EmptyObjectKind = emptyObjectKind{}
+
+type emptyObjectKind struct{}
+
+// SetGroupVersionKind implements the ObjectKind interface
+func (emptyObjectKind) SetGroupVersionKind(gvk GroupVersionKind) {}
+
+// GroupVersionKind implements the ObjectKind interface
+func (emptyObjectKind) GroupVersionKind() GroupVersionKind { return GroupVersionKind{} }
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/scheme.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/scheme.go
new file mode 100644
index 0000000000..80662e55c4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/scheme.go
@@ -0,0 +1,827 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/naming"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/kube-openapi/pkg/util"
+)
+
+// Scheme defines methods for serializing and deserializing API objects, a type
+// registry for converting group, version, and kind information to and from Go
+// schemas, and mappings between Go schemas of different versions. A scheme is the
+// foundation for a versioned API and versioned configuration over time.
+//
+// In a Scheme, a Type is a particular Go struct, a Version is a point-in-time
+// identifier for a particular representation of that Type (typically backwards
+// compatible), a Kind is the unique name for that Type within the Version, and a
+// Group identifies a set of Versions, Kinds, and Types that evolve over time. An
+// Unversioned Type is one that is not yet formally bound to a type and is promised
+// to be backwards compatible (effectively a "v1" of a Type that does not expect
+// to break in the future).
+//
+// Schemes are not expected to change at runtime and are only threadsafe after
+// registration is complete.
+type Scheme struct {
+	// gvkToType allows one to figure out the go type of an object with
+	// the given version and name.
+	gvkToType map[schema.GroupVersionKind]reflect.Type
+
+	// typeToGVK allows one to find metadata for a given go object.
+	// The reflect.Type we index by should *not* be a pointer.
+	typeToGVK map[reflect.Type][]schema.GroupVersionKind
+
+	// unversionedTypes are transformed without conversion in ConvertToVersion.
+	unversionedTypes map[reflect.Type]schema.GroupVersionKind
+
+	// unversionedKinds are the names of kinds that can be created in the context of any group
+	// or version
+	// TODO: resolve the status of unversioned types.
+	unversionedKinds map[string]reflect.Type
+
+	// Map from version and resource to the corresponding func to convert
+	// resource field labels in that version to internal version.
+	fieldLabelConversionFuncs map[schema.GroupVersionKind]FieldLabelConversionFunc
+
+	// defaulterFuncs is a map to funcs to be called with an object to provide defaulting
+	// the provided object must be a pointer.
+	defaulterFuncs map[reflect.Type]func(interface{})
+
+	// validationFuncs is a map to funcs to be called with an object to perform validation.
+	// The provided object must be a pointer.
+	// If oldObject is non-nil, update validation is performed and may perform additional
+	// validation such as transition rules and immutability checks.
+	validationFuncs map[reflect.Type]func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList
+
+	// converter stores all registered conversion functions. It also has
+	// default converting behavior.
+	converter *conversion.Converter
+
+	// versionPriority is a map of groups to ordered lists of versions for those groups indicating the
+	// default priorities of these versions as registered in the scheme
+	versionPriority map[string][]string
+
+	// observedVersions keeps track of the order we've seen versions during type registration
+	observedVersions []schema.GroupVersion
+
+	// schemeName is the name of this scheme.  If you don't specify a name, the stack of the NewScheme caller will be used.
+	// This is useful for error reporting to indicate the origin of the scheme.
+	schemeName string
+}
+
+// FieldLabelConversionFunc converts a field selector to internal representation.
+type FieldLabelConversionFunc func(label, value string) (internalLabel, internalValue string, err error)
+
+// NewScheme creates a new Scheme. This scheme is pluggable by default.
+func NewScheme() *Scheme {
+	s := &Scheme{
+		gvkToType:                 map[schema.GroupVersionKind]reflect.Type{},
+		typeToGVK:                 map[reflect.Type][]schema.GroupVersionKind{},
+		unversionedTypes:          map[reflect.Type]schema.GroupVersionKind{},
+		unversionedKinds:          map[string]reflect.Type{},
+		fieldLabelConversionFuncs: map[schema.GroupVersionKind]FieldLabelConversionFunc{},
+		defaulterFuncs:            map[reflect.Type]func(interface{}){},
+		validationFuncs:           map[reflect.Type]func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList{},
+		versionPriority:           map[string][]string{},
+		schemeName:                naming.GetNameFromCallsite(internalPackages...),
+	}
+	s.converter = conversion.NewConverter(nil)
+
+	// Enable couple default conversions by default.
+	utilruntime.Must(RegisterEmbeddedConversions(s))
+	utilruntime.Must(RegisterStringConversions(s))
+	return s
+}
+
+// Converter allows access to the converter for the scheme
+func (s *Scheme) Converter() *conversion.Converter {
+	return s.converter
+}
+
+// AddUnversionedTypes registers the provided types as "unversioned", which means that they follow special rules.
+// Whenever an object of this type is serialized, it is serialized with the provided group version and is not
+// converted. Thus unversioned objects are expected to remain backwards compatible forever, as if they were in an
+// API group and version that would never be updated.
+//
+// TODO: there is discussion about removing unversioned and replacing it with objects that are manifest into
+// every version with particular schemas. Resolve this method at that point.
+func (s *Scheme) AddUnversionedTypes(version schema.GroupVersion, types ...Object) {
+	s.addObservedVersion(version)
+	s.AddKnownTypes(version, types...)
+	for _, obj := range types {
+		t := reflect.TypeOf(obj).Elem()
+		gvk := version.WithKind(t.Name())
+		s.unversionedTypes[t] = gvk
+		if old, ok := s.unversionedKinds[gvk.Kind]; ok && t != old {
+			panic(fmt.Sprintf("%v.%v has already been registered as unversioned kind %q - kind name must be unique in scheme %q", old.PkgPath(), old.Name(), gvk, s.schemeName))
+		}
+		s.unversionedKinds[gvk.Kind] = t
+	}
+}
+
+// AddKnownTypes registers all types passed in 'types' as being members of version 'version'.
+// All objects passed to types should be pointers to structs. The name that go reports for
+// the struct becomes the "kind" field when encoding. Version may not be empty - use the
+// APIVersionInternal constant if you have a type that does not have a formal version.
+func (s *Scheme) AddKnownTypes(gv schema.GroupVersion, types ...Object) {
+	s.addObservedVersion(gv)
+	for _, obj := range types {
+		t := reflect.TypeOf(obj)
+		if t.Kind() != reflect.Pointer {
+			panic("All types must be pointers to structs.")
+		}
+		t = t.Elem()
+		s.AddKnownTypeWithName(gv.WithKind(t.Name()), obj)
+	}
+}
+
+// AddKnownTypeWithName is like AddKnownTypes, but it lets you specify what this type should
+// be encoded as. Useful for testing when you don't want to make multiple packages to define
+// your structs. Version may not be empty - use the APIVersionInternal constant if you have a
+// type that does not have a formal version.
+func (s *Scheme) AddKnownTypeWithName(gvk schema.GroupVersionKind, obj Object) {
+	s.addObservedVersion(gvk.GroupVersion())
+	t := reflect.TypeOf(obj)
+	if len(gvk.Version) == 0 {
+		panic(fmt.Sprintf("version is required on all types: %s %v", gvk, t))
+	}
+	if t.Kind() != reflect.Pointer {
+		panic("All types must be pointers to structs.")
+	}
+	t = t.Elem()
+	if t.Kind() != reflect.Struct {
+		panic("All types must be pointers to structs.")
+	}
+
+	if oldT, found := s.gvkToType[gvk]; found && oldT != t {
+		panic(fmt.Sprintf("Double registration of different types for %v: old=%v.%v, new=%v.%v in scheme %q", gvk, oldT.PkgPath(), oldT.Name(), t.PkgPath(), t.Name(), s.schemeName))
+	}
+
+	s.gvkToType[gvk] = t
+
+	for _, existingGvk := range s.typeToGVK[t] {
+		if existingGvk == gvk {
+			return
+		}
+	}
+	s.typeToGVK[t] = append(s.typeToGVK[t], gvk)
+
+	// if the type implements DeepCopyInto(<obj>), register a self-conversion
+	if m := reflect.ValueOf(obj).MethodByName("DeepCopyInto"); m.IsValid() && m.Type().NumIn() == 1 && m.Type().NumOut() == 0 && m.Type().In(0) == reflect.TypeOf(obj) {
+		if err := s.AddGeneratedConversionFunc(obj, obj, func(a, b interface{}, scope conversion.Scope) error {
+			// copy a to b
+			reflect.ValueOf(a).MethodByName("DeepCopyInto").Call([]reflect.Value{reflect.ValueOf(b)})
+			// clear TypeMeta to match legacy reflective conversion
+			b.(Object).GetObjectKind().SetGroupVersionKind(schema.GroupVersionKind{})
+			return nil
+		}); err != nil {
+			panic(err)
+		}
+	}
+}
+
+// KnownTypes returns the types known for the given version.
+func (s *Scheme) KnownTypes(gv schema.GroupVersion) map[string]reflect.Type {
+	types := make(map[string]reflect.Type)
+	for gvk, t := range s.gvkToType {
+		if gv != gvk.GroupVersion() {
+			continue
+		}
+
+		types[gvk.Kind] = t
+	}
+	return types
+}
+
+// VersionsForGroupKind returns the versions that a particular GroupKind can be converted to within the given group.
+// A GroupKind might be converted to a different group. That information is available in EquivalentResourceMapper.
+func (s *Scheme) VersionsForGroupKind(gk schema.GroupKind) []schema.GroupVersion {
+	availableVersions := []schema.GroupVersion{}
+	for gvk := range s.gvkToType {
+		if gk != gvk.GroupKind() {
+			continue
+		}
+
+		availableVersions = append(availableVersions, gvk.GroupVersion())
+	}
+
+	// order the return for stability
+	ret := []schema.GroupVersion{}
+	for _, version := range s.PrioritizedVersionsForGroup(gk.Group) {
+		for _, availableVersion := range availableVersions {
+			if version != availableVersion {
+				continue
+			}
+			ret = append(ret, availableVersion)
+		}
+	}
+
+	return ret
+}
+
+// AllKnownTypes returns the all known types.
+func (s *Scheme) AllKnownTypes() map[schema.GroupVersionKind]reflect.Type {
+	return s.gvkToType
+}
+
+// ObjectKinds returns all possible group,version,kind of the go object, true if the
+// object is considered unversioned, or an error if it's not a pointer or is unregistered.
+func (s *Scheme) ObjectKinds(obj Object) ([]schema.GroupVersionKind, bool, error) {
+	// Unstructured objects are always considered to have their declared GVK
+	if _, ok := obj.(Unstructured); ok {
+		// we require that the GVK be populated in order to recognize the object
+		gvk := obj.GetObjectKind().GroupVersionKind()
+		if len(gvk.Kind) == 0 {
+			return nil, false, NewMissingKindErr("unstructured object has no kind")
+		}
+		if len(gvk.Version) == 0 {
+			return nil, false, NewMissingVersionErr("unstructured object has no version")
+		}
+		return []schema.GroupVersionKind{gvk}, false, nil
+	}
+
+	v, err := conversion.EnforcePtr(obj)
+	if err != nil {
+		return nil, false, err
+	}
+	t := v.Type()
+
+	gvks, ok := s.typeToGVK[t]
+	if !ok {
+		return nil, false, NewNotRegisteredErrForType(s.schemeName, t)
+	}
+	_, unversionedType := s.unversionedTypes[t]
+
+	return gvks, unversionedType, nil
+}
+
+// Recognizes returns true if the scheme is able to handle the provided group,version,kind
+// of an object.
+func (s *Scheme) Recognizes(gvk schema.GroupVersionKind) bool {
+	_, exists := s.gvkToType[gvk]
+	return exists
+}
+
+func (s *Scheme) IsUnversioned(obj Object) (bool, bool) {
+	v, err := conversion.EnforcePtr(obj)
+	if err != nil {
+		return false, false
+	}
+	t := v.Type()
+
+	if _, ok := s.typeToGVK[t]; !ok {
+		return false, false
+	}
+	_, ok := s.unversionedTypes[t]
+	return ok, true
+}
+
+// New returns a new API object of the given version and name, or an error if it hasn't
+// been registered. The version and kind fields must be specified.
+func (s *Scheme) New(kind schema.GroupVersionKind) (Object, error) {
+	if t, exists := s.gvkToType[kind]; exists {
+		return reflect.New(t).Interface().(Object), nil
+	}
+
+	if t, exists := s.unversionedKinds[kind.Kind]; exists {
+		return reflect.New(t).Interface().(Object), nil
+	}
+	return nil, NewNotRegisteredErrForKind(s.schemeName, kind)
+}
+
+// AddIgnoredConversionType identifies a pair of types that should be skipped by
+// conversion (because the data inside them is explicitly dropped during
+// conversion).
+func (s *Scheme) AddIgnoredConversionType(from, to interface{}) error {
+	return s.converter.RegisterIgnoredConversion(from, to)
+}
+
+// AddConversionFunc registers a function that converts between a and b by passing objects of those
+// types to the provided function. The function *must* accept objects of a and b - this machinery will not enforce
+// any other guarantee.
+func (s *Scheme) AddConversionFunc(a, b interface{}, fn conversion.ConversionFunc) error {
+	return s.converter.RegisterUntypedConversionFunc(a, b, fn)
+}
+
+// AddGeneratedConversionFunc registers a function that converts between a and b by passing objects of those
+// types to the provided function. The function *must* accept objects of a and b - this machinery will not enforce
+// any other guarantee.
+func (s *Scheme) AddGeneratedConversionFunc(a, b interface{}, fn conversion.ConversionFunc) error {
+	return s.converter.RegisterGeneratedUntypedConversionFunc(a, b, fn)
+}
+
+// AddFieldLabelConversionFunc adds a conversion function to convert field selectors
+// of the given kind from the given version to internal version representation.
+func (s *Scheme) AddFieldLabelConversionFunc(gvk schema.GroupVersionKind, conversionFunc FieldLabelConversionFunc) error {
+	s.fieldLabelConversionFuncs[gvk] = conversionFunc
+	return nil
+}
+
+// AddTypeDefaultingFunc registers a function that is passed a pointer to an
+// object and can default fields on the object. These functions will be invoked
+// when Default() is called. The function will never be called unless the
+// defaulted object matches srcType. If this function is invoked twice with the
+// same srcType, the fn passed to the later call will be used instead.
+func (s *Scheme) AddTypeDefaultingFunc(srcType Object, fn func(interface{})) {
+	s.defaulterFuncs[reflect.TypeOf(srcType)] = fn
+}
+
+// Default sets defaults on the provided Object.
+func (s *Scheme) Default(src Object) {
+	if fn, ok := s.defaulterFuncs[reflect.TypeOf(src)]; ok {
+		fn(src)
+	}
+}
+
+// AddValidationFunc registered a function that can validate the object, and
+// oldObject. These functions will be invoked when Validate() or ValidateUpdate()
+// is called. The function will never be called unless the validated object
+// matches srcType. If this function is invoked twice with the same srcType, the
+// fn passed to the later call will be used instead.
+func (s *Scheme) AddValidationFunc(srcType Object, fn func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList) {
+	s.validationFuncs[reflect.TypeOf(srcType)] = fn
+}
+
+// Validate validates the provided Object according to the generated declarative validation code.
+// WARNING: This does not validate all objects!  The handwritten validation code in validation.go
+// is not run when this is called.  Only the generated zz_generated.validations.go validation code is run.
+func (s *Scheme) Validate(ctx context.Context, options map[string]bool, object Object, subresources ...string) field.ErrorList {
+	if fn, ok := s.validationFuncs[reflect.TypeOf(object)]; ok {
+		return fn(ctx, operation.Operation{Type: operation.Create, Request: operation.Request{Subresources: subresources}, Options: options}, object, nil)
+	}
+	return nil
+}
+
+// ValidateUpdate validates the provided object and oldObject according to the generated declarative validation code.
+// WARNING: This does not validate all objects!  The handwritten validation code in validation.go
+// is not run when this is called.  Only the generated zz_generated.validations.go validation code is run.
+func (s *Scheme) ValidateUpdate(ctx context.Context, options map[string]bool, object, oldObject Object, subresources ...string) field.ErrorList {
+	if fn, ok := s.validationFuncs[reflect.TypeOf(object)]; ok {
+		return fn(ctx, operation.Operation{Type: operation.Update, Request: operation.Request{Subresources: subresources}, Options: options}, object, oldObject)
+	}
+	return nil
+}
+
+// HasValidationFunc reports whether a validation function is registered for the
+// object's type. Unlike Validate, it distinguishes "no function registered" from
+// "function ran and found no errors", which both yield a nil error list.
+func (s *Scheme) HasValidationFunc(obj Object) bool {
+	_, ok := s.validationFuncs[reflect.TypeOf(obj)]
+	return ok
+}
+
+// Convert will attempt to convert in into out. Both must be pointers. For easy
+// testing of conversion functions. Returns an error if the conversion isn't
+// possible. You can call this with types that haven't been registered (for example,
+// a to test conversion of types that are nested within registered types). The
+// context interface is passed to the convertor. Convert also supports Unstructured
+// types and will convert them intelligently.
+func (s *Scheme) Convert(in, out interface{}, context interface{}) error {
+	unstructuredIn, okIn := in.(Unstructured)
+	unstructuredOut, okOut := out.(Unstructured)
+	switch {
+	case okIn && okOut:
+		// converting unstructured input to an unstructured output is a straight copy - unstructured
+		// is a "smart holder" and the contents are passed by reference between the two objects
+		unstructuredOut.SetUnstructuredContent(unstructuredIn.UnstructuredContent())
+		return nil
+
+	case okOut:
+		// if the output is an unstructured object, use the standard Go type to unstructured
+		// conversion. The object must not be internal.
+		obj, ok := in.(Object)
+		if !ok {
+			return fmt.Errorf("unable to convert object type %T to Unstructured, must be a runtime.Object", in)
+		}
+		gvks, unversioned, err := s.ObjectKinds(obj)
+		if err != nil {
+			return err
+		}
+		gvk := gvks[0]
+
+		// if no conversion is necessary, convert immediately
+		if unversioned || gvk.Version != APIVersionInternal {
+			content, err := DefaultUnstructuredConverter.ToUnstructured(in)
+			if err != nil {
+				return err
+			}
+			unstructuredOut.SetUnstructuredContent(content)
+			unstructuredOut.GetObjectKind().SetGroupVersionKind(gvk)
+			return nil
+		}
+
+		// attempt to convert the object to an external version first.
+		target, ok := context.(GroupVersioner)
+		if !ok {
+			return fmt.Errorf("unable to convert the internal object type %T to Unstructured without providing a preferred version to convert to", in)
+		}
+		// Convert is implicitly unsafe, so we don't need to perform a safe conversion
+		versioned, err := s.UnsafeConvertToVersion(obj, target)
+		if err != nil {
+			return err
+		}
+		content, err := DefaultUnstructuredConverter.ToUnstructured(versioned)
+		if err != nil {
+			return err
+		}
+		unstructuredOut.SetUnstructuredContent(content)
+		return nil
+
+	case okIn:
+		// converting an unstructured object to any type is modeled by first converting
+		// the input to a versioned type, then running standard conversions
+		typed, err := s.unstructuredToTyped(unstructuredIn)
+		if err != nil {
+			return err
+		}
+		in = typed
+	}
+
+	meta := s.generateConvertMeta(in)
+	meta.Context = context
+	return s.converter.Convert(in, out, meta)
+}
+
+// ConvertFieldLabel alters the given field label and value for an kind field selector from
+// versioned representation to an unversioned one or returns an error.
+func (s *Scheme) ConvertFieldLabel(gvk schema.GroupVersionKind, label, value string) (string, string, error) {
+	conversionFunc, ok := s.fieldLabelConversionFuncs[gvk]
+	if !ok {
+		return DefaultMetaV1FieldSelectorConversion(label, value)
+	}
+	return conversionFunc(label, value)
+}
+
+// ConvertToVersion attempts to convert an input object to its matching Kind in another
+// version within this scheme. Will return an error if the provided version does not
+// contain the inKind (or a mapping by name defined with AddKnownTypeWithName). Will also
+// return an error if the conversion does not result in a valid Object being
+// returned. Passes target down to the conversion methods as the Context on the scope.
+func (s *Scheme) ConvertToVersion(in Object, target GroupVersioner) (Object, error) {
+	return s.convertToVersion(true, in, target)
+}
+
+// UnsafeConvertToVersion will convert in to the provided target if such a conversion is possible,
+// but does not guarantee the output object does not share fields with the input object. It attempts to be as
+// efficient as possible when doing conversion.
+func (s *Scheme) UnsafeConvertToVersion(in Object, target GroupVersioner) (Object, error) {
+	return s.convertToVersion(false, in, target)
+}
+
+// convertToVersion handles conversion with an optional copy.
+func (s *Scheme) convertToVersion(copy bool, in Object, target GroupVersioner) (Object, error) {
+	var t reflect.Type
+
+	if u, ok := in.(Unstructured); ok {
+		typed, err := s.unstructuredToTyped(u)
+		if err != nil {
+			return nil, err
+		}
+
+		in = typed
+		// unstructuredToTyped returns an Object, which must be a pointer to a struct.
+		t = reflect.TypeOf(in).Elem()
+
+	} else {
+		// determine the incoming kinds with as few allocations as possible.
+		t = reflect.TypeOf(in)
+		if t.Kind() != reflect.Pointer {
+			return nil, fmt.Errorf("only pointer types may be converted: %v", t)
+		}
+		t = t.Elem()
+		if t.Kind() != reflect.Struct {
+			return nil, fmt.Errorf("only pointers to struct types may be converted: %v", t)
+		}
+	}
+
+	kinds, ok := s.typeToGVK[t]
+	if !ok || len(kinds) == 0 {
+		return nil, NewNotRegisteredErrForType(s.schemeName, t)
+	}
+
+	gvk, ok := target.KindForGroupVersionKinds(kinds)
+	if !ok {
+		// try to see if this type is listed as unversioned (for legacy support)
+		// TODO: when we move to server API versions, we should completely remove the unversioned concept
+		if unversionedKind, ok := s.unversionedTypes[t]; ok {
+			if gvk, ok := target.KindForGroupVersionKinds([]schema.GroupVersionKind{unversionedKind}); ok {
+				return copyAndSetTargetKind(copy, in, gvk)
+			}
+			return copyAndSetTargetKind(copy, in, unversionedKind)
+		}
+		return nil, NewNotRegisteredErrForTarget(s.schemeName, t, target)
+	}
+
+	// target wants to use the existing type, set kind and return (no conversion necessary)
+	for _, kind := range kinds {
+		if gvk == kind {
+			return copyAndSetTargetKind(copy, in, gvk)
+		}
+	}
+
+	// type is unversioned, no conversion necessary
+	if unversionedKind, ok := s.unversionedTypes[t]; ok {
+		if gvk, ok := target.KindForGroupVersionKinds([]schema.GroupVersionKind{unversionedKind}); ok {
+			return copyAndSetTargetKind(copy, in, gvk)
+		}
+		return copyAndSetTargetKind(copy, in, unversionedKind)
+	}
+
+	out, err := s.New(gvk)
+	if err != nil {
+		return nil, err
+	}
+
+	if copy {
+		in = in.DeepCopyObject()
+	}
+
+	meta := s.generateConvertMeta(in)
+	meta.Context = target
+	if err := s.converter.Convert(in, out, meta); err != nil {
+		return nil, err
+	}
+
+	setTargetKind(out, gvk)
+	return out, nil
+}
+
+// unstructuredToTyped attempts to transform an unstructured object to a typed
+// object if possible. It will return an error if conversion is not possible, or the versioned
+// Go form of the object. Note that this conversion will lose fields.
+func (s *Scheme) unstructuredToTyped(in Unstructured) (Object, error) {
+	// the type must be something we recognize
+	gvks, _, err := s.ObjectKinds(in)
+	if err != nil {
+		return nil, err
+	}
+	typed, err := s.New(gvks[0])
+	if err != nil {
+		return nil, err
+	}
+	if err := DefaultUnstructuredConverter.FromUnstructured(in.UnstructuredContent(), typed); err != nil {
+		return nil, fmt.Errorf("unable to convert unstructured object to %v: %v", gvks[0], err)
+	}
+	return typed, nil
+}
+
+// generateConvertMeta constructs the meta value we pass to Convert.
+func (s *Scheme) generateConvertMeta(in interface{}) *conversion.Meta {
+	return s.converter.DefaultMeta(reflect.TypeOf(in))
+}
+
+// copyAndSetTargetKind performs a conditional copy before returning the object, or an error if copy was not successful.
+func copyAndSetTargetKind(copy bool, obj Object, kind schema.GroupVersionKind) (Object, error) {
+	if copy {
+		obj = obj.DeepCopyObject()
+	}
+	setTargetKind(obj, kind)
+	return obj, nil
+}
+
+// setTargetKind sets the kind on an object, taking into account whether the target kind is the internal version.
+func setTargetKind(obj Object, kind schema.GroupVersionKind) {
+	if kind.Version == APIVersionInternal {
+		// internal is a special case
+		// TODO: look at removing the need to special case this
+		obj.GetObjectKind().SetGroupVersionKind(schema.GroupVersionKind{})
+		return
+	}
+	obj.GetObjectKind().SetGroupVersionKind(kind)
+}
+
+// SetVersionPriority allows specifying a precise order of priority. All specified versions must be in the same group,
+// and the specified order overwrites any previously specified order for this group
+func (s *Scheme) SetVersionPriority(versions ...schema.GroupVersion) error {
+	groups := sets.String{}
+	order := []string{}
+	for _, version := range versions {
+		if len(version.Version) == 0 || version.Version == APIVersionInternal {
+			return fmt.Errorf("internal versions cannot be prioritized: %v", version)
+		}
+
+		groups.Insert(version.Group)
+		order = append(order, version.Version)
+	}
+	if len(groups) != 1 {
+		return fmt.Errorf("must register versions for exactly one group: %v", strings.Join(groups.List(), ", "))
+	}
+
+	s.versionPriority[groups.List()[0]] = order
+	return nil
+}
+
+// PrioritizedVersionsForGroup returns versions for a single group in priority order
+func (s *Scheme) PrioritizedVersionsForGroup(group string) []schema.GroupVersion {
+	ret := []schema.GroupVersion{}
+	for _, version := range s.versionPriority[group] {
+		ret = append(ret, schema.GroupVersion{Group: group, Version: version})
+	}
+	for _, observedVersion := range s.observedVersions {
+		if observedVersion.Group != group {
+			continue
+		}
+		found := false
+		for _, existing := range ret {
+			if existing == observedVersion {
+				found = true
+				break
+			}
+		}
+		if !found {
+			ret = append(ret, observedVersion)
+		}
+	}
+
+	return ret
+}
+
+// PrioritizedVersionsAllGroups returns all known versions in their priority order.  Groups are random, but
+// versions for a single group are prioritized
+func (s *Scheme) PrioritizedVersionsAllGroups() []schema.GroupVersion {
+	ret := []schema.GroupVersion{}
+	for group, versions := range s.versionPriority {
+		for _, version := range versions {
+			ret = append(ret, schema.GroupVersion{Group: group, Version: version})
+		}
+	}
+	for _, observedVersion := range s.observedVersions {
+		found := false
+		for _, existing := range ret {
+			if existing == observedVersion {
+				found = true
+				break
+			}
+		}
+		if !found {
+			ret = append(ret, observedVersion)
+		}
+	}
+	return ret
+}
+
+// PreferredVersionAllGroups returns the most preferred version for every group.
+// group ordering is random.
+func (s *Scheme) PreferredVersionAllGroups() []schema.GroupVersion {
+	ret := []schema.GroupVersion{}
+	for group, versions := range s.versionPriority {
+		for _, version := range versions {
+			ret = append(ret, schema.GroupVersion{Group: group, Version: version})
+			break
+		}
+	}
+	for _, observedVersion := range s.observedVersions {
+		found := false
+		for _, existing := range ret {
+			if existing.Group == observedVersion.Group {
+				found = true
+				break
+			}
+		}
+		if !found {
+			ret = append(ret, observedVersion)
+		}
+	}
+
+	return ret
+}
+
+// IsGroupRegistered returns true if types for the group have been registered with the scheme
+func (s *Scheme) IsGroupRegistered(group string) bool {
+	for _, observedVersion := range s.observedVersions {
+		if observedVersion.Group == group {
+			return true
+		}
+	}
+	return false
+}
+
+// IsVersionRegistered returns true if types for the version have been registered with the scheme
+func (s *Scheme) IsVersionRegistered(version schema.GroupVersion) bool {
+	for _, observedVersion := range s.observedVersions {
+		if observedVersion == version {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (s *Scheme) addObservedVersion(version schema.GroupVersion) {
+	if len(version.Version) == 0 || version.Version == APIVersionInternal {
+		return
+	}
+	for _, observedVersion := range s.observedVersions {
+		if observedVersion == version {
+			return
+		}
+	}
+
+	s.observedVersions = append(s.observedVersions, version)
+}
+
+func (s *Scheme) Name() string {
+	return s.schemeName
+}
+
+// internalPackages are packages that ignored when creating a default reflector name. These packages are in the common
+// call chains to NewReflector, so they'd be low entropy names for reflectors
+var internalPackages = []string{"k8s.io/apimachinery/pkg/runtime/scheme.go"}
+
+// ToOpenAPIDefinitionName returns the REST-friendly OpenAPI definition name known type identified by groupVersionKind.
+// If the groupVersionKind does not identify a known type, an error is returned.
+// The Version field of groupVersionKind is required, and the Group and Kind fields are required for unstructured.Unstructured
+// types. If a required field is empty, an error is returned.
+//
+// The OpenAPI definition name is the canonical name of the type, with the group and version removed.
+// For example, the OpenAPI definition name of Pod is `io.k8s.api.core.v1.Pod`.
+//
+// This respects the util.OpenAPIModelNamer interface and will return the name returned by
+// OpenAPIModelName() if it is defined on the type.
+//
+// A known type that is registered as an unstructured.Unstructured type is treated as a custom resource and
+// which has an OpenAPI definition name of the form `<reversed-group>.<version.<kind>`.
+// For example, the OpenAPI definition name of `group: stable.example.com, version: v1, kind: Pod` is
+// `com.example.stable.v1.Pod`.
+func (s *Scheme) ToOpenAPIDefinitionName(groupVersionKind schema.GroupVersionKind) (string, error) {
+	if groupVersionKind.Version == "" { // Empty version is not allowed by New() so check it first to avoid a panic.
+		return "", fmt.Errorf("version is required on all types: %v", groupVersionKind)
+	}
+	example, err := s.New(groupVersionKind)
+	if err != nil {
+		return "", err
+	}
+
+	// Use a namer if provided
+	if namer, ok := example.(util.OpenAPIModelNamer); ok {
+		return namer.OpenAPIModelName(), nil
+	}
+
+	if _, ok := example.(Unstructured); ok {
+		if groupVersionKind.Group == "" || groupVersionKind.Kind == "" {
+			return "", fmt.Errorf("unable to convert GroupVersionKind with empty fields to unstructured type to an OpenAPI definition name: %v", groupVersionKind)
+		}
+		return reverseParts(groupVersionKind.Group) + "." + groupVersionKind.Version + "." + groupVersionKind.Kind, nil
+	}
+	rtype := reflect.TypeOf(example).Elem()
+	name := toOpenAPIDefinitionName(rtype.PkgPath() + "." + rtype.Name())
+	return name, nil
+}
+
+// toOpenAPIDefinitionName converts Golang package/type canonical name into REST friendly OpenAPI name.
+// Input is expected to be `PkgPath + "." TypeName.
+//
+// Examples of REST friendly OpenAPI name:
+//
+//	Input:  k8s.io/api/core/v1.Pod
+//	Output: io.k8s.api.core.v1.Pod
+//
+//	Input:  k8s.io/api/core/v1
+//	Output: io.k8s.api.core.v1
+//
+//	Input:  csi.storage.k8s.io/v1alpha1.CSINodeInfo
+//	Output: io.k8s.storage.csi.v1alpha1.CSINodeInfo
+//
+// Note that this is a copy of ToRESTFriendlyName from k8s.io/kube-openapi/pkg/util. It is duplicated here to avoid
+// a dependency on kube-openapi.
+func toOpenAPIDefinitionName(name string) string {
+	nameParts := strings.Split(name, "/")
+	// Reverse first part. e.g., io.k8s... instead of k8s.io...
+	if len(nameParts) > 0 && strings.Contains(nameParts[0], ".") {
+		nameParts[0] = reverseParts(nameParts[0])
+	}
+	return strings.Join(nameParts, ".")
+}
+
+func reverseParts(dotSeparatedName string) string {
+	parts := strings.Split(dotSeparatedName, ".")
+	for i, j := 0, len(parts)-1; i < j; i, j = i+1, j-1 {
+		parts[i], parts[j] = parts[j], parts[i]
+	}
+	return strings.Join(parts, ".")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/scheme_builder.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/scheme_builder.go
new file mode 100644
index 0000000000..944db48182
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/scheme_builder.go
@@ -0,0 +1,48 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+// SchemeBuilder collects functions that add things to a scheme. It's to allow
+// code to compile without explicitly referencing generated types. You should
+// declare one in each package that will have generated deep copy or conversion
+// functions.
+type SchemeBuilder []func(*Scheme) error
+
+// AddToScheme applies all the stored functions to the scheme. A non-nil error
+// indicates that one function failed and the attempt was abandoned.
+func (sb *SchemeBuilder) AddToScheme(s *Scheme) error {
+	for _, f := range *sb {
+		if err := f(s); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Register adds a scheme setup function to the list.
+func (sb *SchemeBuilder) Register(funcs ...func(*Scheme) error) {
+	for _, f := range funcs {
+		*sb = append(*sb, f)
+	}
+}
+
+// NewSchemeBuilder calls Register for you.
+func NewSchemeBuilder(funcs ...func(*Scheme) error) SchemeBuilder {
+	var sb SchemeBuilder
+	sb.Register(funcs...)
+	return sb
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/scheme_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/scheme_test.go
new file mode 100644
index 0000000000..5e4fe1e2c9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/scheme_test.go
@@ -0,0 +1,1181 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime_test
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+	"k8s.io/apimachinery/pkg/util/diff"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+type testConversions struct {
+	internalToExternalCalls int
+	externalToInternalCalls int
+}
+
+func (c *testConversions) internalToExternalSimple(in *runtimetesting.InternalSimple, out *runtimetesting.ExternalSimple, scope conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.TestString = in.TestString
+	c.internalToExternalCalls++
+	return nil
+}
+
+func (c *testConversions) externalToInternalSimple(in *runtimetesting.ExternalSimple, out *runtimetesting.InternalSimple, scope conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.TestString = in.TestString
+	c.externalToInternalCalls++
+	return nil
+}
+
+func (c *testConversions) registerConversions(s *runtime.Scheme) error {
+	if err := s.AddConversionFunc((*runtimetesting.InternalSimple)(nil), (*runtimetesting.ExternalSimple)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return c.internalToExternalSimple(a.(*runtimetesting.InternalSimple), b.(*runtimetesting.ExternalSimple), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*runtimetesting.ExternalSimple)(nil), (*runtimetesting.InternalSimple)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return c.externalToInternalSimple(a.(*runtimetesting.ExternalSimple), b.(*runtimetesting.InternalSimple), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+func TestScheme(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	internalGVK := internalGV.WithKind("Simple")
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "testExternal"}
+	externalGVK := externalGV.WithKind("Simple")
+
+	scheme := runtime.NewScheme()
+	scheme.AddKnownTypeWithName(internalGVK, &runtimetesting.InternalSimple{})
+	scheme.AddKnownTypeWithName(externalGVK, &runtimetesting.ExternalSimple{})
+	utilruntime.Must(runtimetesting.RegisterConversions(scheme))
+
+	// If set, would clear TypeMeta during conversion.
+	//scheme.AddIgnoredConversionType(&TypeMeta{}, &TypeMeta{})
+
+	// test that scheme is an ObjectTyper
+	var _ runtime.ObjectTyper = scheme
+
+	conversions := &testConversions{
+		internalToExternalCalls: 0,
+		externalToInternalCalls: 0,
+	}
+
+	// Register functions to verify that scope.Meta() gets set correctly.
+	utilruntime.Must(conversions.registerConversions(scheme))
+
+	t.Run("Encode, Decode, DecodeInto, and DecodeToVersion", func(t *testing.T) {
+		simple := &runtimetesting.InternalSimple{
+			TestString: "foo",
+		}
+
+		codecs := serializer.NewCodecFactory(scheme)
+		codec := codecs.LegacyCodec(externalGV)
+		info, _ := runtime.SerializerInfoForMediaType(codecs.SupportedMediaTypes(), runtime.ContentTypeJSON)
+		jsonserializer := info.Serializer
+
+		obj := runtime.Object(simple)
+		data, err := runtime.Encode(codec, obj)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		obj2, err := runtime.Decode(codec, data)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, ok := obj2.(*runtimetesting.InternalSimple); !ok {
+			t.Fatalf("Got wrong type")
+		}
+		if e, a := simple, obj2; !reflect.DeepEqual(e, a) {
+			t.Errorf("Expected:\n %#v,\n Got:\n %#v", e, a)
+		}
+
+		obj3 := &runtimetesting.InternalSimple{}
+		if err := runtime.DecodeInto(codec, data, obj3); err != nil {
+			t.Fatal(err)
+		}
+		// clearing TypeMeta is a function of the scheme, which we do not test here (ConvertToVersion
+		// does not automatically clear TypeMeta anymore).
+		simple.TypeMeta = runtime.TypeMeta{Kind: "Simple", APIVersion: externalGV.String()}
+		if e, a := simple, obj3; !reflect.DeepEqual(e, a) {
+			t.Errorf("Expected:\n %#v,\n Got:\n %#v", e, a)
+		}
+
+		obj4, err := runtime.Decode(jsonserializer, data)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, ok := obj4.(*runtimetesting.ExternalSimple); !ok {
+			t.Fatalf("Got wrong type")
+		}
+	})
+	t.Run("Convert", func(t *testing.T) {
+		simple := &runtimetesting.InternalSimple{
+			TestString: "foo",
+		}
+
+		external := &runtimetesting.ExternalSimple{}
+		if err := scheme.Convert(simple, external, nil); err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+		if e, a := simple.TestString, external.TestString; e != a {
+			t.Errorf("Expected %q, got %q", e, a)
+		}
+	})
+	t.Run("Convert internal to unstructured", func(t *testing.T) {
+		simple := &runtimetesting.InternalSimple{
+			TestString: "foo",
+		}
+
+		unstructuredObj := &runtimetesting.Unstructured{}
+		err := scheme.Convert(simple, unstructuredObj, nil)
+		if err == nil || !strings.Contains(err.Error(), "to Unstructured without providing a preferred version to convert to") {
+			t.Fatalf("Unexpected non-error: %v", err)
+		}
+		if err := scheme.Convert(simple, unstructuredObj, externalGV); err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+		if e, a := simple.TestString, unstructuredObj.Object["testString"].(string); e != a {
+			t.Errorf("Expected %q, got %q", e, a)
+		}
+		if e := unstructuredObj.GetObjectKind().GroupVersionKind(); e != externalGVK {
+			t.Errorf("Unexpected object kind: %#v", e)
+		}
+		if gvks, unversioned, err := scheme.ObjectKinds(unstructuredObj); err != nil || gvks[0] != externalGVK || unversioned {
+			t.Errorf("Scheme did not recognize unversioned: %v, %#v %t", err, gvks, unversioned)
+		}
+	})
+	t.Run("Convert external to unstructured", func(t *testing.T) {
+		unstructuredObj := &runtimetesting.Unstructured{}
+		external := &runtimetesting.ExternalSimple{
+			TestString: "foo",
+		}
+
+		if err := scheme.Convert(external, unstructuredObj, nil); err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+		if e, a := external.TestString, unstructuredObj.Object["testString"].(string); e != a {
+			t.Errorf("Expected %q, got %q", e, a)
+		}
+		if e := unstructuredObj.GetObjectKind().GroupVersionKind(); e != externalGVK {
+			t.Errorf("Unexpected object kind: %#v", e)
+		}
+	})
+	t.Run("Convert unstructured to unstructured", func(t *testing.T) {
+		uIn := &runtimetesting.Unstructured{Object: map[string]interface{}{
+			"test": []interface{}{"other", "test"},
+		}}
+		uOut := &runtimetesting.Unstructured{}
+		if err := scheme.Convert(uIn, uOut, nil); err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+		if !reflect.DeepEqual(uIn.Object, uOut.Object) {
+			t.Errorf("Unexpected object contents: %#v", uOut.Object)
+		}
+	})
+	t.Run("Convert unstructured to structured", func(t *testing.T) {
+		unstructuredObj := &runtimetesting.Unstructured{
+			Object: map[string]interface{}{
+				"testString": "bla",
+			},
+		}
+		unstructuredObj.SetGroupVersionKind(externalGV.WithKind("Simple"))
+		externalOut := &runtimetesting.ExternalSimple{}
+		if err := scheme.Convert(unstructuredObj, externalOut, nil); err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+		if externalOut.TestString != "bla" {
+			t.Errorf("Unexpected object contents: %#v", externalOut)
+		}
+	})
+	t.Run("Encode and Convert should each have caused an increment", func(t *testing.T) {
+		if e, a := 3, conversions.internalToExternalCalls; e != a {
+			t.Errorf("Expected %v, got %v", e, a)
+		}
+	})
+	t.Run("DecodeInto and Decode should each have caused an increment because of a conversion", func(t *testing.T) {
+		if e, a := 2, conversions.externalToInternalCalls; e != a {
+			t.Errorf("Expected %v, got %v", e, a)
+		}
+	})
+	t.Run("Verify that unstructured types must have V and K set", func(t *testing.T) {
+		emptyObj := &runtimetesting.Unstructured{Object: make(map[string]interface{})}
+		if _, _, err := scheme.ObjectKinds(emptyObj); !runtime.IsMissingKind(err) {
+			t.Errorf("unexpected error: %v", err)
+		}
+		emptyObj.SetGroupVersionKind(schema.GroupVersionKind{Kind: "Test"})
+		if _, _, err := scheme.ObjectKinds(emptyObj); !runtime.IsMissingVersion(err) {
+			t.Errorf("unexpected error: %v", err)
+		}
+		emptyObj.SetGroupVersionKind(schema.GroupVersionKind{Kind: "Test", Version: "v1"})
+		if _, _, err := scheme.ObjectKinds(emptyObj); err != nil {
+			t.Errorf("unexpected error: %v", err)
+		}
+	})
+}
+
+func TestBadJSONRejection(t *testing.T) {
+	scheme := runtime.NewScheme()
+	codecs := serializer.NewCodecFactory(scheme)
+	info, _ := runtime.SerializerInfoForMediaType(codecs.SupportedMediaTypes(), runtime.ContentTypeJSON)
+	jsonserializer := info.Serializer
+
+	badJSONMissingKind := []byte(`{ }`)
+	if _, err := runtime.Decode(jsonserializer, badJSONMissingKind); err == nil {
+		t.Errorf("Did not reject despite lack of kind field: %s", badJSONMissingKind)
+	}
+	badJSONUnknownType := []byte(`{"kind": "bar"}`)
+	if _, err1 := runtime.Decode(jsonserializer, badJSONUnknownType); err1 == nil {
+		t.Errorf("Did not reject despite use of unknown type: %s", badJSONUnknownType)
+	}
+}
+
+func TestExternalToInternalMapping(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "testExternal"}
+
+	scheme := runtime.NewScheme()
+	scheme.AddKnownTypeWithName(internalGV.WithKind("OptionalExtensionType"), &runtimetesting.InternalOptionalExtensionType{})
+	scheme.AddKnownTypeWithName(externalGV.WithKind("OptionalExtensionType"), &runtimetesting.ExternalOptionalExtensionType{})
+	utilruntime.Must(runtimetesting.RegisterConversions(scheme))
+
+	codec := serializer.NewCodecFactory(scheme).LegacyCodec(externalGV)
+
+	table := []struct {
+		obj     runtime.Object
+		encoded string
+	}{
+		{
+			&runtimetesting.InternalOptionalExtensionType{Extension: nil},
+			`{"kind":"OptionalExtensionType","apiVersion":"` + externalGV.String() + `"}`,
+		},
+	}
+
+	for i, item := range table {
+		gotDecoded, err := runtime.Decode(codec, []byte(item.encoded))
+		if err != nil {
+			t.Errorf("unexpected error '%v' (%v)", err, item.encoded)
+		} else if e, a := item.obj, gotDecoded; !reflect.DeepEqual(e, a) {
+			t.Errorf("%d: unexpected objects:\n%s", i, diff.ObjectGoPrintSideBySide(e, a))
+		}
+	}
+}
+
+func TestExtensionMapping(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "testExternal"}
+
+	scheme := runtime.NewScheme()
+	scheme.AddKnownTypeWithName(internalGV.WithKind("ExtensionType"), &runtimetesting.InternalExtensionType{})
+	scheme.AddKnownTypeWithName(internalGV.WithKind("OptionalExtensionType"), &runtimetesting.InternalOptionalExtensionType{})
+	scheme.AddKnownTypeWithName(externalGV.WithKind("ExtensionType"), &runtimetesting.ExternalExtensionType{})
+	scheme.AddKnownTypeWithName(externalGV.WithKind("OptionalExtensionType"), &runtimetesting.ExternalOptionalExtensionType{})
+
+	// register external first when the object is the same in both schemes, so ObjectVersionAndKind reports the
+	// external version.
+	scheme.AddKnownTypeWithName(externalGV.WithKind("A"), &runtimetesting.ExtensionA{})
+	scheme.AddKnownTypeWithName(externalGV.WithKind("B"), &runtimetesting.ExtensionB{})
+	scheme.AddKnownTypeWithName(internalGV.WithKind("A"), &runtimetesting.ExtensionA{})
+	scheme.AddKnownTypeWithName(internalGV.WithKind("B"), &runtimetesting.ExtensionB{})
+	utilruntime.Must(runtimetesting.RegisterConversions(scheme))
+
+	codec := serializer.NewCodecFactory(scheme).LegacyCodec(externalGV)
+
+	table := []struct {
+		obj      runtime.Object
+		expected runtime.Object
+		encoded  string
+	}{
+		{
+			&runtimetesting.InternalExtensionType{
+				Extension: runtime.NewEncodable(codec, &runtimetesting.ExtensionA{TestString: "foo"}),
+			},
+			&runtimetesting.InternalExtensionType{
+				Extension: &runtime.Unknown{
+					Raw:         []byte(`{"apiVersion":"test.group/testExternal","kind":"A","testString":"foo"}`),
+					ContentType: runtime.ContentTypeJSON,
+				},
+			},
+			// apiVersion is set in the serialized object for easier consumption by clients
+			`{"apiVersion":"` + externalGV.String() + `","kind":"ExtensionType","extension":{"apiVersion":"test.group/testExternal","kind":"A","testString":"foo"}}
+`,
+		}, {
+			&runtimetesting.InternalExtensionType{Extension: runtime.NewEncodable(codec, &runtimetesting.ExtensionB{TestString: "bar"})},
+			&runtimetesting.InternalExtensionType{
+				Extension: &runtime.Unknown{
+					Raw:         []byte(`{"apiVersion":"test.group/testExternal","kind":"B","testString":"bar"}`),
+					ContentType: runtime.ContentTypeJSON,
+				},
+			},
+			// apiVersion is set in the serialized object for easier consumption by clients
+			`{"apiVersion":"` + externalGV.String() + `","kind":"ExtensionType","extension":{"apiVersion":"test.group/testExternal","kind":"B","testString":"bar"}}
+`,
+		}, {
+			&runtimetesting.InternalExtensionType{Extension: nil},
+			&runtimetesting.InternalExtensionType{
+				Extension: nil,
+			},
+			`{"apiVersion":"` + externalGV.String() + `","kind":"ExtensionType","extension":null}
+`,
+		},
+	}
+
+	for i, item := range table {
+		gotEncoded, err := runtime.Encode(codec, item.obj)
+		if err != nil {
+			t.Errorf("unexpected error '%v' (%#v)", err, item.obj)
+		} else if e, a := item.encoded, string(gotEncoded); e != a {
+			t.Errorf("expected\n%#v\ngot\n%#v\n", e, a)
+		}
+
+		gotDecoded, err := runtime.Decode(codec, []byte(item.encoded))
+		if err != nil {
+			t.Errorf("unexpected error '%v' (%v)", err, item.encoded)
+		} else if e, a := item.expected, gotDecoded; !reflect.DeepEqual(e, a) {
+			t.Errorf("%d: unexpected objects:\n%s", i, diff.ObjectGoPrintSideBySide(e, a))
+		}
+	}
+}
+
+func TestEncode(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	internalGVK := internalGV.WithKind("Simple")
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "testExternal"}
+	externalGVK := externalGV.WithKind("Simple")
+
+	scheme := runtime.NewScheme()
+	scheme.AddKnownTypeWithName(internalGVK, &runtimetesting.InternalSimple{})
+	scheme.AddKnownTypeWithName(externalGVK, &runtimetesting.ExternalSimple{})
+	utilruntime.Must(runtimetesting.RegisterConversions(scheme))
+
+	codec := serializer.NewCodecFactory(scheme).LegacyCodec(externalGV)
+
+	test := &runtimetesting.InternalSimple{
+		TestString: "I'm the same",
+	}
+	obj := runtime.Object(test)
+	data, err := runtime.Encode(codec, obj)
+	obj2, gvk, err2 := codec.Decode(data, nil, nil)
+	if err != nil || err2 != nil {
+		t.Fatalf("Failure: '%v' '%v'", err, err2)
+	}
+	if _, ok := obj2.(*runtimetesting.InternalSimple); !ok {
+		t.Fatalf("Got wrong type")
+	}
+	if !reflect.DeepEqual(obj2, test) {
+		t.Errorf("Expected:\n %#v,\n Got:\n %#v", test, obj2)
+	}
+	if *gvk != externalGVK {
+		t.Errorf("unexpected gvk returned by decode: %#v", *gvk)
+	}
+}
+
+func TestUnversionedTypes(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	internalGVK := internalGV.WithKind("Simple")
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "testExternal"}
+	externalGVK := externalGV.WithKind("Simple")
+	otherGV := schema.GroupVersion{Group: "group", Version: "other"}
+
+	scheme := runtime.NewScheme()
+	scheme.AddUnversionedTypes(externalGV, &runtimetesting.InternalSimple{})
+	scheme.AddKnownTypeWithName(internalGVK, &runtimetesting.InternalSimple{})
+	scheme.AddKnownTypeWithName(externalGVK, &runtimetesting.ExternalSimple{})
+	scheme.AddKnownTypeWithName(otherGV.WithKind("Simple"), &runtimetesting.ExternalSimple{})
+	utilruntime.Must(runtimetesting.RegisterConversions(scheme))
+
+	codec := serializer.NewCodecFactory(scheme).LegacyCodec(externalGV)
+
+	if unv, ok := scheme.IsUnversioned(&runtimetesting.InternalSimple{}); !unv || !ok {
+		t.Fatalf("type not unversioned and in scheme: %t %t", unv, ok)
+	}
+
+	kinds, _, err := scheme.ObjectKinds(&runtimetesting.InternalSimple{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	kind := kinds[0]
+	if kind != externalGV.WithKind("InternalSimple") {
+		t.Fatalf("unexpected: %#v", kind)
+	}
+
+	test := &runtimetesting.InternalSimple{
+		TestString: "I'm the same",
+	}
+	obj := runtime.Object(test)
+	data, err := runtime.Encode(codec, obj)
+	if err != nil {
+		t.Fatal(err)
+	}
+	obj2, gvk, err := codec.Decode(data, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := obj2.(*runtimetesting.InternalSimple); !ok {
+		t.Fatalf("Got wrong type")
+	}
+	if !reflect.DeepEqual(obj2, test) {
+		t.Errorf("Expected:\n %#v,\n Got:\n %#v", test, obj2)
+	}
+	// object is serialized as an unversioned object (in the group and version it was defined in)
+	if *gvk != externalGV.WithKind("InternalSimple") {
+		t.Errorf("unexpected gvk returned by decode: %#v", *gvk)
+	}
+
+	// when serialized to a different group, the object is kept in its preferred name
+	codec = serializer.NewCodecFactory(scheme).LegacyCodec(otherGV)
+	data, err = runtime.Encode(codec, obj)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(data) != `{"apiVersion":"test.group/testExternal","kind":"InternalSimple","testString":"I'm the same"}`+"\n" {
+		t.Errorf("unexpected data: %s", data)
+	}
+}
+
+// Returns a new Scheme set up with the test objects.
+func GetTestScheme() *runtime.Scheme {
+	internalGV := schema.GroupVersion{Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Version: "v1"}
+	alternateExternalGV := schema.GroupVersion{Group: "custom", Version: "v1"}
+	alternateInternalGV := schema.GroupVersion{Group: "custom", Version: runtime.APIVersionInternal}
+	differentExternalGV := schema.GroupVersion{Group: "other", Version: "v2"}
+
+	s := runtime.NewScheme()
+	// Ordinarily, we wouldn't add TestType2, but because this is a test and
+	// both types are from the same package, we need to get it into the system
+	// so that converter will match it with ExternalType2.
+	s.AddKnownTypes(internalGV, &runtimetesting.TestType1{}, &runtimetesting.TestType2{}, &runtimetesting.ExternalInternalSame{})
+	s.AddKnownTypes(externalGV, &runtimetesting.ExternalInternalSame{})
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType1"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType2"), &runtimetesting.ExternalTestType2{})
+	s.AddKnownTypeWithName(internalGV.WithKind("TestType3"), &runtimetesting.TestType1{})
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType3"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType4"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(alternateInternalGV.WithKind("TestType3"), &runtimetesting.TestType1{})
+	s.AddKnownTypeWithName(alternateExternalGV.WithKind("TestType3"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(alternateExternalGV.WithKind("TestType5"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(differentExternalGV.WithKind("TestType1"), &runtimetesting.ExternalTestType1{})
+	s.AddUnversionedTypes(externalGV, &runtimetesting.UnversionedType{})
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+
+	return s
+}
+
+func TestKnownTypes(t *testing.T) {
+	s := GetTestScheme()
+	if len(s.KnownTypes(schema.GroupVersion{Group: "group", Version: "v2"})) != 0 {
+		t.Errorf("should have no known types for v2")
+	}
+
+	types := s.KnownTypes(schema.GroupVersion{Version: "v1"})
+	for _, s := range []string{"TestType1", "TestType2", "TestType3", "ExternalInternalSame"} {
+		if _, ok := types[s]; !ok {
+			t.Errorf("missing type %q", s)
+		}
+	}
+}
+
+func TestAddKnownTypesIdemPotent(t *testing.T) {
+	s := runtime.NewScheme()
+
+	gv := schema.GroupVersion{Group: "foo", Version: "v1"}
+	s.AddKnownTypes(gv, &runtimetesting.InternalSimple{})
+	s.AddKnownTypes(gv, &runtimetesting.InternalSimple{})
+	if len(s.KnownTypes(gv)) != 1 {
+		t.Errorf("expected only one %v type after double registration", gv)
+	}
+	if len(s.AllKnownTypes()) != 1 {
+		t.Errorf("expected only one type after double registration")
+	}
+
+	s.AddKnownTypeWithName(gv.WithKind("InternalSimple"), &runtimetesting.InternalSimple{})
+	s.AddKnownTypeWithName(gv.WithKind("InternalSimple"), &runtimetesting.InternalSimple{})
+	if len(s.KnownTypes(gv)) != 1 {
+		t.Errorf("expected only one %v type after double registration with custom name", gv)
+	}
+	if len(s.AllKnownTypes()) != 1 {
+		t.Errorf("expected only one type after double registration with custom name")
+	}
+
+	s.AddUnversionedTypes(gv, &runtimetesting.InternalSimple{})
+	s.AddUnversionedTypes(gv, &runtimetesting.InternalSimple{})
+	if len(s.KnownTypes(gv)) != 1 {
+		t.Errorf("expected only one %v type after double registration with custom name", gv)
+	}
+	if len(s.AllKnownTypes()) != 1 {
+		t.Errorf("expected only one type after double registration with custom name")
+	}
+
+	kinds, _, err := s.ObjectKinds(&runtimetesting.InternalSimple{})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(kinds) != 1 {
+		t.Errorf("expected only one kind for InternalSimple after double registration")
+	}
+}
+
+// redefine InternalSimple with the same name, but obviously as a different type than in runtimetesting
+type InternalSimple struct {
+	runtime.TypeMeta `json:""`
+	TestString       string `json:"testString"`
+}
+
+func (s *InternalSimple) DeepCopyObject() runtime.Object { return nil }
+
+func TestConflictingAddKnownTypes(t *testing.T) {
+	s := runtime.NewScheme()
+	gv := schema.GroupVersion{Group: "foo", Version: "v1"}
+
+	panicked := make(chan bool)
+	go func() {
+		defer func() {
+			if recover() != nil {
+				panicked <- true
+			}
+		}()
+		s.AddKnownTypeWithName(gv.WithKind("InternalSimple"), &runtimetesting.InternalSimple{})
+		s.AddKnownTypeWithName(gv.WithKind("InternalSimple"), &runtimetesting.ExternalSimple{})
+		panicked <- false
+	}()
+	if !<-panicked {
+		t.Errorf("Expected AddKnownTypesWithName to panic with conflicting type registrations")
+	}
+
+	go func() {
+		defer func() {
+			if recover() != nil {
+				panicked <- true
+			}
+		}()
+
+		s.AddUnversionedTypes(gv, &runtimetesting.InternalSimple{})
+		s.AddUnversionedTypes(gv, &InternalSimple{})
+		panicked <- false
+	}()
+	if !<-panicked {
+		t.Errorf("Expected AddUnversionedTypes to panic with conflicting type registrations")
+	}
+}
+
+func TestConvertToVersionBasic(t *testing.T) {
+	s := GetTestScheme()
+	tt := &runtimetesting.TestType1{A: "I'm not a pointer object"}
+	other, err := s.ConvertToVersion(tt, schema.GroupVersion{Version: "v1"})
+	if err != nil {
+		t.Fatalf("Failure: %v", err)
+	}
+	converted, ok := other.(*runtimetesting.ExternalTestType1)
+	if !ok {
+		t.Fatalf("Got wrong type: %T", other)
+	}
+	if tt.A != converted.A {
+		t.Fatalf("Failed to convert object correctly: %#v", converted)
+	}
+}
+
+type testGroupVersioner struct {
+	target schema.GroupVersionKind
+	ok     bool
+}
+
+func (m testGroupVersioner) KindForGroupVersionKinds(kinds []schema.GroupVersionKind) (schema.GroupVersionKind, bool) {
+	return m.target, m.ok
+}
+
+func (m testGroupVersioner) Identifier() string {
+	return "testGroupVersioner"
+}
+
+func TestConvertToVersion(t *testing.T) {
+	testCases := []struct {
+		scheme *runtime.Scheme
+		in     runtime.Object
+		gv     runtime.GroupVersioner
+		same   bool
+		out    runtime.Object
+		errFn  func(error) bool
+	}{
+		// errors if the type is not registered in the scheme
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.UnknownType{},
+			errFn:  func(err error) bool { return err != nil && runtime.IsNotRegisteredError(err) },
+		},
+		// errors if the group versioner returns no target
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     testGroupVersioner{},
+			errFn: func(err error) bool {
+				return err != nil && strings.Contains(err.Error(), "is not suitable for converting")
+			},
+		},
+		// converts to internal
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     schema.GroupVersion{Version: runtime.APIVersionInternal},
+			out:    &runtimetesting.TestType1{A: "test"},
+		},
+		// converts from unstructured to internal
+		{
+			scheme: GetTestScheme(),
+			in: &runtimetesting.Unstructured{Object: map[string]interface{}{
+				"apiVersion": "custom/v1",
+				"kind":       "TestType3",
+				"A":          "test",
+			}},
+			gv:  schema.GroupVersion{Version: runtime.APIVersionInternal},
+			out: &runtimetesting.TestType1{A: "test"},
+		},
+		// converts from unstructured to external
+		{
+			scheme: GetTestScheme(),
+			in: &runtimetesting.Unstructured{Object: map[string]interface{}{
+				"apiVersion": "custom/v1",
+				"kind":       "TestType3",
+				"A":          "test",
+			}},
+			gv:  schema.GroupVersion{Group: "custom", Version: "v1"},
+			out: &runtimetesting.ExternalTestType1{MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "custom/v1", ObjectKind: "TestType3"}, A: "test"},
+		},
+		// prefers the best match
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     schema.GroupVersions{{Version: runtime.APIVersionInternal}, {Version: "v1"}},
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// unversioned type returned as-is
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.UnversionedType{A: "test"},
+			gv:     schema.GroupVersions{{Version: "v1"}},
+			same:   true,
+			out: &runtimetesting.UnversionedType{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "UnversionedType"},
+				A:                                     "test",
+			},
+		},
+		// unversioned type returned when not included in the target types
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.UnversionedType{A: "test"},
+			gv:     schema.GroupVersions{{Group: "other", Version: "v2"}},
+			same:   true,
+			out: &runtimetesting.UnversionedType{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "UnversionedType"},
+				A:                                     "test",
+			},
+		},
+		// detected as already being in the target version
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     schema.GroupVersions{{Version: "v1"}},
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// detected as already being in the first target version
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     schema.GroupVersions{{Version: "v1"}, {Version: runtime.APIVersionInternal}},
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// detected as already being in the first target version
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     schema.GroupVersions{{Version: "v1"}, {Version: runtime.APIVersionInternal}},
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// the external type is registered in multiple groups, versions, and kinds, and can be targeted to all of them (1/3): different kind
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     testGroupVersioner{ok: true, target: schema.GroupVersionKind{Kind: "TestType3", Version: "v1"}},
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType3"},
+				A:                                     "test",
+			},
+		},
+		// the external type is registered in multiple groups, versions, and kinds, and can be targeted to all of them (2/3): different gv
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     testGroupVersioner{ok: true, target: schema.GroupVersionKind{Kind: "TestType3", Group: "custom", Version: "v1"}},
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "custom/v1", ObjectKind: "TestType3"},
+				A:                                     "test",
+			},
+		},
+		// the external type is registered in multiple groups, versions, and kinds, and can be targeted to all of them (3/3): different gvk
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     testGroupVersioner{ok: true, target: schema.GroupVersionKind{Group: "custom", Version: "v1", Kind: "TestType5"}},
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "custom/v1", ObjectKind: "TestType5"},
+				A:                                     "test",
+			},
+		},
+		// multi group versioner recognizes multiple groups and forces the output to a particular version, copies because version differs
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     runtime.NewMultiGroupVersioner(schema.GroupVersion{Group: "other", Version: "v2"}, schema.GroupKind{Group: "custom", Kind: "TestType3"}, schema.GroupKind{Kind: "TestType1"}),
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "other/v2", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// multi group versioner recognizes multiple groups and forces the output to a particular version, copies because version differs
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     runtime.NewMultiGroupVersioner(schema.GroupVersion{Group: "other", Version: "v2"}, schema.GroupKind{Kind: "TestType1"}, schema.GroupKind{Group: "custom", Kind: "TestType3"}),
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "other/v2", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// multi group versioner is unable to find a match when kind AND group don't match (there is no TestType1 kind in group "other", and no kind "TestType5" in the default group)
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.TestType1{A: "test"},
+			gv:     runtime.NewMultiGroupVersioner(schema.GroupVersion{Group: "custom", Version: "v1"}, schema.GroupKind{Group: "other"}, schema.GroupKind{Kind: "TestType5"}),
+			errFn: func(err error) bool {
+				return err != nil && strings.Contains(err.Error(), "is not suitable for converting")
+			},
+		},
+		// multi group versioner recognizes multiple groups and forces the output to a particular version, performs no copy
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     runtime.NewMultiGroupVersioner(schema.GroupVersion{Group: "", Version: "v1"}, schema.GroupKind{Group: "custom", Kind: "TestType3"}, schema.GroupKind{Kind: "TestType1"}),
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// multi group versioner recognizes multiple groups and forces the output to a particular version, performs no copy
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     runtime.NewMultiGroupVersioner(schema.GroupVersion{Group: "", Version: "v1"}, schema.GroupKind{Kind: "TestType1"}, schema.GroupKind{Group: "custom", Kind: "TestType3"}),
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// group versioner can choose a particular target kind for a given input when kind is the same across group versions
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.TestType1{A: "test"},
+			gv:     testGroupVersioner{ok: true, target: schema.GroupVersionKind{Version: "v1", Kind: "TestType3"}},
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType3"},
+				A:                                     "test",
+			},
+		},
+		// group versioner can choose a different kind
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.TestType1{A: "test"},
+			gv:     testGroupVersioner{ok: true, target: schema.GroupVersionKind{Kind: "TestType5", Group: "custom", Version: "v1"}},
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "custom/v1", ObjectKind: "TestType5"},
+				A:                                     "test",
+			},
+		},
+	}
+	for i, test := range testCases {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			original := test.in.DeepCopyObject()
+			out, err := test.scheme.ConvertToVersion(test.in, test.gv)
+			switch {
+			case test.errFn != nil:
+				if !test.errFn(err) {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				return
+			case err != nil:
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if out == test.in {
+				t.Fatalf("ConvertToVersion should always copy out: %#v", out)
+			}
+
+			if test.same {
+				if !reflect.DeepEqual(original, test.in) {
+					t.Fatalf("unexpected mutation of input: %s", cmp.Diff(original, test.in))
+				}
+				if !reflect.DeepEqual(out, test.out) {
+					t.Fatalf("unexpected out: %s", cmp.Diff(out, test.out))
+				}
+				unsafe, err := test.scheme.UnsafeConvertToVersion(test.in, test.gv)
+				if err != nil {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				if !reflect.DeepEqual(unsafe, test.out) {
+					t.Fatalf("unexpected unsafe: %s", cmp.Diff(unsafe, test.out))
+				}
+				if unsafe != test.in {
+					t.Fatalf("UnsafeConvertToVersion should return same object: %#v", unsafe)
+				}
+				return
+			}
+			if !reflect.DeepEqual(out, test.out) {
+				t.Fatalf("unexpected out: %s", cmp.Diff(out, test.out))
+			}
+		})
+	}
+}
+
+func TestConvert(t *testing.T) {
+	testCases := []struct {
+		scheme *runtime.Scheme
+		in     runtime.Object
+		into   runtime.Object
+		gv     runtime.GroupVersioner
+		out    runtime.Object
+		errFn  func(error) bool
+	}{
+		// converts from internal to unstructured, given a target version
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.TestType1{A: "test"},
+			into:   &runtimetesting.Unstructured{},
+			out: &runtimetesting.Unstructured{Object: map[string]interface{}{
+				"myVersionKey": "custom/v1",
+				"myKindKey":    "TestType3",
+				"A":            "test",
+			}},
+			gv: schema.GroupVersion{Group: "custom", Version: "v1"},
+		},
+	}
+	for i, test := range testCases {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			err := test.scheme.Convert(test.in, test.into, test.gv)
+			switch {
+			case test.errFn != nil:
+				if !test.errFn(err) {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				return
+			case err != nil:
+				t.Fatalf("unexpected error: %v", err)
+				return
+			}
+
+			if !reflect.DeepEqual(test.into, test.out) {
+				t.Fatalf("unexpected out: %s", cmp.Diff(test.into, test.out))
+			}
+		})
+	}
+}
+
+func TestMetaValues(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "externalVersion"}
+
+	s := runtime.NewScheme()
+	s.AddKnownTypeWithName(internalGV.WithKind("Simple"), &runtimetesting.InternalSimple{})
+	s.AddKnownTypeWithName(externalGV.WithKind("Simple"), &runtimetesting.ExternalSimple{})
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+
+	conversions := &testConversions{
+		internalToExternalCalls: 0,
+		externalToInternalCalls: 0,
+	}
+
+	// Register functions to verify that scope.Meta() gets set correctly.
+	utilruntime.Must(conversions.registerConversions(s))
+
+	simple := &runtimetesting.InternalSimple{
+		TestString: "foo",
+	}
+
+	out, err := s.ConvertToVersion(simple, externalGV)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	internal, err := s.ConvertToVersion(out, internalGV)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if e, a := simple, internal; !reflect.DeepEqual(e, a) {
+		t.Errorf("Expected:\n %#v,\n Got:\n %#v", e, a)
+	}
+
+	if e, a := 1, conversions.internalToExternalCalls; e != a {
+		t.Errorf("Expected %v, got %v", e, a)
+	}
+	if e, a := 1, conversions.externalToInternalCalls; e != a {
+		t.Errorf("Expected %v, got %v", e, a)
+	}
+}
+
+func TestMetaValuesUnregisteredConvert(t *testing.T) {
+	type InternalSimple struct {
+		Version    string `json:"apiVersion,omitempty"`
+		Kind       string `json:"kind,omitempty"`
+		TestString string `json:"testString"`
+	}
+	type ExternalSimple struct {
+		Version    string `json:"apiVersion,omitempty"`
+		Kind       string `json:"kind,omitempty"`
+		TestString string `json:"testString"`
+	}
+	s := runtime.NewScheme()
+	// We deliberately don't register the types.
+
+	internalToExternalCalls := 0
+
+	// Register functions to verify that scope.Meta() gets set correctly.
+	convertSimple := func(in *InternalSimple, out *ExternalSimple, scope conversion.Scope) error {
+		out.TestString = in.TestString
+		internalToExternalCalls++
+		return nil
+	}
+	if err := s.AddConversionFunc((*InternalSimple)(nil), (*ExternalSimple)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertSimple(a.(*InternalSimple), b.(*ExternalSimple), scope)
+	}); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	simple := &InternalSimple{TestString: "foo"}
+	external := &ExternalSimple{}
+	if err := s.Convert(simple, external, nil); err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	if e, a := simple.TestString, external.TestString; e != a {
+		t.Errorf("Expected %v, got %v", e, a)
+	}
+
+	// Verify that our conversion handler got called.
+	if e, a := 1, internalToExternalCalls; e != a {
+		t.Errorf("Expected %v, got %v", e, a)
+	}
+}
+
+func TestRegisterValidate(t *testing.T) {
+	invalidValue := field.Invalid(field.NewPath("testString"), "", "Invalid value").WithOrigin("invalid-value")
+	invalidLength := field.Invalid(field.NewPath("testString"), "", "Invalid length").WithOrigin("invalid-length")
+	invalidStatusErr := field.Invalid(field.NewPath("testString"), "", "Invalid condition").WithOrigin("invalid-condition")
+	invalidIfOptionErr := field.Invalid(field.NewPath("testString"), "", "Invalid when option is set").WithOrigin("invalid-when-option-set")
+
+	testCases := []struct {
+		name        string
+		object      runtime.Object
+		oldObject   runtime.Object
+		subresource []string
+		options     map[string]bool
+		expected    field.ErrorList
+	}{
+		{
+			name:     "single error",
+			object:   &TestType1{},
+			options:  map[string]bool{"option1": false},
+			expected: field.ErrorList{invalidValue},
+		},
+		{
+			name:     "multiple errors",
+			object:   &TestType2{},
+			expected: field.ErrorList{invalidValue, invalidLength},
+		},
+		{
+			name:      "update error",
+			object:    &TestType2{},
+			oldObject: &TestType2{},
+			expected:  field.ErrorList{invalidLength},
+		},
+		{
+			name:     "options error",
+			object:   &TestType1{},
+			options:  map[string]bool{"option1": true},
+			expected: field.ErrorList{invalidIfOptionErr},
+		},
+		{
+			name:        "subresource error",
+			object:      &TestType1{},
+			subresource: []string{"status"},
+			options:     map[string]bool{"option1": false},
+			expected:    field.ErrorList{invalidStatusErr},
+		},
+	}
+
+	s := runtime.NewScheme()
+	ctx := context.Background()
+
+	// register multiple types for testing to ensure registration is working as expected
+	s.AddValidationFunc(&TestType1{}, func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList {
+		if enabled, exists := op.HasOption("option1"); enabled || !exists {
+			return field.ErrorList{invalidIfOptionErr}
+		}
+		if slices.Equal(op.Request.Subresources, []string{"status"}) {
+			return field.ErrorList{invalidStatusErr}
+		}
+		return field.ErrorList{invalidValue}
+	})
+
+	s.AddValidationFunc(&TestType2{}, func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList {
+		if oldObject != nil {
+			return field.ErrorList{invalidLength}
+		}
+		return field.ErrorList{invalidValue, invalidLength}
+	})
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			var results field.ErrorList
+			if tc.oldObject == nil {
+				results = s.Validate(ctx, tc.options, tc.object, tc.subresource...)
+			} else {
+				results = s.ValidateUpdate(ctx, tc.options, tc.object, tc.oldObject, tc.subresource...)
+			}
+			matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+			matcher.Test(t, tc.expected, results)
+		})
+	}
+}
+
+type TestType1 struct {
+	Version    string `json:"apiVersion,omitempty"`
+	Kind       string `json:"kind,omitempty"`
+	TestString string `json:"testString"`
+}
+
+func (TestType1) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+func (TestType1) DeepCopyObject() runtime.Object { return nil }
+
+type TestType2 struct {
+	Version    string `json:"apiVersion,omitempty"`
+	Kind       string `json:"kind,omitempty"`
+	TestString string `json:"testString"`
+}
+
+func (TestType2) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+func (TestType2) DeepCopyObject() runtime.Object { return nil }
+
+func TestToOpenAPIDefinitionName(t *testing.T) {
+	testCases := []struct {
+		name        string
+		registerGvk *schema.GroupVersionKind // defaults to gvk unless set
+		registerObj runtime.Object
+		gvk         schema.GroupVersionKind
+		out         string
+		wantErr     error
+	}{
+		{
+			name:        "unstructured type",
+			registerObj: &unstructured.Unstructured{},
+			gvk:         schema.GroupVersionKind{Group: "stable.example.com", Version: "v1", Kind: "CronTab"},
+			out:         "com.example.stable.v1.CronTab",
+		},
+		{
+			name:        "unregistered type: empty group",
+			registerObj: &unstructured.Unstructured{},
+			gvk:         schema.GroupVersionKind{Version: "v1", Kind: "CronTab"},
+			wantErr:     fmt.Errorf("unable to convert GroupVersionKind with empty fields to unstructured type to an OpenAPI definition name: %v", schema.GroupVersionKind{Version: "v1", Kind: "CronTab"}),
+		},
+		{
+			name:        "unregistered type: empty version",
+			registerObj: &unstructured.Unstructured{},
+			registerGvk: &schema.GroupVersionKind{Group: "stable.example.com", Version: "v1", Kind: "CronTab"},
+			gvk:         schema.GroupVersionKind{Group: "stable.example.com", Kind: "CronTab"},
+			wantErr:     fmt.Errorf("version is required on all types: %v", schema.GroupVersionKind{Group: "stable.example.com", Kind: "CronTab"}),
+		},
+		{
+			name:        "unregistered type: empty kind",
+			registerObj: &unstructured.Unstructured{},
+			gvk:         schema.GroupVersionKind{Group: "stable.example.com", Version: "v1"},
+			wantErr:     fmt.Errorf("unable to convert GroupVersionKind with empty fields to unstructured type to an OpenAPI definition name: %v", schema.GroupVersionKind{Group: "stable.example.com", Version: "v1"}),
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.name, func(t *testing.T) {
+			if test.registerGvk == nil {
+				test.registerGvk = &test.gvk
+			}
+
+			scheme := runtime.NewScheme()
+			scheme.AddKnownTypeWithName(*test.registerGvk, test.registerObj)
+			utilruntime.Must(runtimetesting.RegisterConversions(scheme))
+
+			out, err := scheme.ToOpenAPIDefinitionName(test.gvk)
+			if test.wantErr != nil {
+				if err == nil || err.Error() != test.wantErr.Error() {
+					t.Errorf("expected error: %v but got %v", test.wantErr, err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if out != test.out {
+				t.Errorf("expected %s, got %s", test.out, out)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor.go
new file mode 100644
index 0000000000..e5730e3c50
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor.go
@@ -0,0 +1,402 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cbor
+
+import (
+	"bytes"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+	"k8s.io/apimachinery/pkg/runtime/serializer/recognizer"
+	util "k8s.io/apimachinery/pkg/util/runtime"
+
+	"github.com/fxamacker/cbor/v2"
+)
+
+type metaFactory interface {
+	// Interpret should return the version and kind of the wire-format of the object.
+	Interpret(data []byte) (*schema.GroupVersionKind, error)
+}
+
+type defaultMetaFactory struct{}
+
+func (mf *defaultMetaFactory) Interpret(data []byte) (*schema.GroupVersionKind, error) {
+	var tm metav1.TypeMeta
+	// The input is expected to include additional map keys besides apiVersion and kind, so use
+	// lax mode for decoding into TypeMeta.
+	if err := modes.DecodeLax.Unmarshal(data, &tm); err != nil {
+		return nil, fmt.Errorf("unable to determine group/version/kind: %w", err)
+	}
+	actual := tm.GetObjectKind().GroupVersionKind()
+	return &actual, nil
+}
+
+type Serializer interface {
+	runtime.Serializer
+	runtime.NondeterministicEncoder
+	recognizer.RecognizingDecoder
+
+	// NewSerializer returns a value of this interface type rather than exporting the serializer
+	// type and returning one of those because the zero value of serializer isn't ready to
+	// use. Users aren't intended to implement cbor.Serializer themselves, and this unexported
+	// interface method is here to prevent that (https://go.dev/blog/module-compatibility).
+	private()
+}
+
+var _ Serializer = &serializer{}
+
+type options struct {
+	strict                       bool
+	transcode                    bool
+	streamingCollectionsEncoding bool
+}
+
+type Option func(*options)
+
+// Strict configures a serializer to return a strict decoding error when it encounters map keys that
+// do not correspond to a field in the target object of a decode operation. This option is disabled
+// by default.
+func Strict(s bool) Option {
+	return func(opts *options) {
+		opts.strict = s
+	}
+}
+
+// Transcode configures a serializer to transcode the "raw" bytes of a decoded runtime.RawExtension
+// or metav1.FieldsV1 object to JSON. This is enabled by default to support existing programs that
+// depend on the assumption that objects of either type contain valid JSON.
+func Transcode(s bool) Option {
+	return func(opts *options) {
+		opts.transcode = s
+	}
+}
+
+// StreamingCollectionsEncoding is used for testing purposes only.
+func StreamingCollectionsEncoding(s bool) Option {
+	return func(opts *options) {
+		opts.streamingCollectionsEncoding = s
+	}
+}
+
+type serializer struct {
+	metaFactory metaFactory
+	creater     runtime.ObjectCreater
+	typer       runtime.ObjectTyper
+	options     options
+}
+
+func (serializer) private() {}
+
+// NewSerializer creates and returns a serializer configured with the provided options. The default
+// options are equivalent to explicitly passing Strict(false) and Transcode(true).
+func NewSerializer(creater runtime.ObjectCreater, typer runtime.ObjectTyper, options ...Option) Serializer {
+	return newSerializer(&defaultMetaFactory{}, creater, typer, options...)
+}
+
+func newSerializer(metaFactory metaFactory, creater runtime.ObjectCreater, typer runtime.ObjectTyper, options ...Option) *serializer {
+	s := &serializer{
+		metaFactory: metaFactory,
+		creater:     creater,
+		typer:       typer,
+	}
+	s.options.transcode = true
+	s.options.streamingCollectionsEncoding = true
+	for _, o := range options {
+		o(&s.options)
+	}
+	return s
+}
+
+func (s *serializer) Identifier() runtime.Identifier {
+	return "cbor"
+}
+
+// Encode writes a CBOR representation of the given object.
+//
+// Because the CBOR data item written by a call to Encode is always enclosed in the "self-described
+// CBOR" tag, its encoded form always has the prefix 0xd9d9f7. This prefix is suitable for use as a
+// "magic number" for distinguishing encoded CBOR from other protocols.
+//
+// The default serialization behavior for any given object replicates the behavior of the JSON
+// serializer as far as it is necessary to allow the CBOR serializer to be used as a drop-in
+// replacement for the JSON serializer, with limited exceptions. For example, the distinction
+// between integers and floating-point numbers is preserved in CBOR due to its distinct
+// representations for each type.
+//
+// Objects implementing runtime.Unstructured will have their unstructured content encoded rather
+// than following the default behavior for their dynamic type.
+func (s *serializer) Encode(obj runtime.Object, w io.Writer) error {
+	return s.encode(modes.Encode, obj, w)
+}
+
+func (s *serializer) EncodeNondeterministic(obj runtime.Object, w io.Writer) error {
+	return s.encode(modes.EncodeNondeterministic, obj, w)
+}
+
+func (s *serializer) encode(mode modes.EncMode, obj runtime.Object, w io.Writer) error {
+	if _, err := w.Write(selfDescribedCBOR); err != nil {
+		return err
+	}
+
+	if s.options.streamingCollectionsEncoding {
+		ok, err := streamEncodeCollections(obj, w, mode)
+		if err != nil {
+			return err
+		}
+		if ok {
+			return nil
+		}
+	}
+
+	var v interface{} = obj
+	if u, ok := obj.(runtime.Unstructured); ok {
+		v = u.UnstructuredContent()
+	}
+
+	return mode.MarshalTo(v, w)
+}
+
+// gvkWithDefaults returns group kind and version defaulting from provided default
+func gvkWithDefaults(actual, defaultGVK schema.GroupVersionKind) schema.GroupVersionKind {
+	if len(actual.Kind) == 0 {
+		actual.Kind = defaultGVK.Kind
+	}
+	if len(actual.Version) == 0 && len(actual.Group) == 0 {
+		actual.Group = defaultGVK.Group
+		actual.Version = defaultGVK.Version
+	}
+	if len(actual.Version) == 0 && actual.Group == defaultGVK.Group {
+		actual.Version = defaultGVK.Version
+	}
+	return actual
+}
+
+// diagnose returns the diagnostic encoding of a well-formed CBOR data item.
+func diagnose(data []byte) string {
+	diag, err := modes.Diagnostic.Diagnose(data)
+	if err != nil {
+		// Since the input must already be well-formed CBOR, converting it to diagnostic
+		// notation should not fail.
+		util.HandleError(err)
+
+		return hex.EncodeToString(data)
+	}
+	return diag
+}
+
+// unmarshal unmarshals CBOR data from the provided byte slice into a Go object. If the decoder is
+// configured to report strict errors, the first error return value may be a non-nil strict decoding
+// error. If the last error return value is non-nil, then the unmarshal failed entirely and the
+// state of the destination object should not be relied on.
+func (s *serializer) unmarshal(data []byte, into interface{}) (strict, lax error) {
+	if u, ok := into.(runtime.Unstructured); ok {
+		var content map[string]interface{}
+		defer func() {
+			switch u := u.(type) {
+			case *unstructured.UnstructuredList:
+				// UnstructuredList's implementation of SetUnstructuredContent
+				// produces different objects than those produced by a decode using
+				// UnstructuredJSONScheme:
+				//
+				//   1. SetUnstructuredContent retains the "items" key in the list's
+				//      Object field. It is omitted from Object when decoding with
+				//      UnstructuredJSONScheme.
+				//   2. SetUnstructuredContent does not populate "apiVersion" and
+				//      "kind" on each entry of its Items
+				//      field. UnstructuredJSONScheme does, inferring the singular
+				//      Kind from the list Kind.
+				//   3. SetUnstructuredContent ignores entries of "items" that are
+				//      not JSON objects or are objects without
+				//      "kind". UnstructuredJSONScheme returns an error in either
+				//      case.
+				//
+				// UnstructuredJSONScheme's behavior is replicated here.
+				var items []interface{}
+				if uncast, present := content["items"]; present {
+					var cast bool
+					items, cast = uncast.([]interface{})
+					if !cast {
+						strict, lax = nil, fmt.Errorf("items field of UnstructuredList must be encoded as an array or null if present")
+						return
+					}
+				}
+				apiVersion, _ := content["apiVersion"].(string)
+				kind, _ := content["kind"].(string)
+				kind = strings.TrimSuffix(kind, "List")
+				var unstructureds []unstructured.Unstructured
+				if len(items) > 0 {
+					unstructureds = make([]unstructured.Unstructured, len(items))
+				}
+				for i := range items {
+					object, cast := items[i].(map[string]interface{})
+					if !cast {
+						strict, lax = nil, fmt.Errorf("elements of the items field of UnstructuredList must be encoded as a map")
+						return
+					}
+
+					// As in UnstructuredJSONScheme, only set the heuristic
+					// singular GVK when both "apiVersion" and "kind" are either
+					// missing, non-string, or empty.
+					object["apiVersion"], _ = object["apiVersion"].(string)
+					object["kind"], _ = object["kind"].(string)
+					if object["apiVersion"] == "" && object["kind"] == "" {
+						object["apiVersion"] = apiVersion
+						object["kind"] = kind
+					}
+
+					if object["kind"] == "" {
+						strict, lax = nil, runtime.NewMissingKindErr(diagnose(data))
+						return
+					}
+					if object["apiVersion"] == "" {
+						strict, lax = nil, runtime.NewMissingVersionErr(diagnose(data))
+						return
+					}
+
+					unstructureds[i].Object = object
+				}
+				delete(content, "items")
+				u.Object = content
+				u.Items = unstructureds
+			default:
+				u.SetUnstructuredContent(content)
+			}
+		}()
+		into = &content
+	}
+
+	if !s.options.strict {
+		return nil, modes.DecodeLax.Unmarshal(data, into)
+	}
+
+	err := modes.Decode.Unmarshal(data, into)
+	// TODO: UnknownFieldError is ambiguous. It only provides the index of the first problematic
+	// map entry encountered and does not indicate which map the index refers to.
+	var unknownField *cbor.UnknownFieldError
+	if errors.As(err, &unknownField) {
+		// Unlike JSON, there are no strict errors in CBOR for duplicate map keys. CBOR maps
+		// with duplicate keys are considered invalid according to the spec and are rejected
+		// entirely.
+		return runtime.NewStrictDecodingError([]error{unknownField}), modes.DecodeLax.Unmarshal(data, into)
+	}
+	return nil, err
+}
+
+func (s *serializer) Decode(data []byte, gvk *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	// A preliminary pass over the input to obtain the actual GVK is redundant on a successful
+	// decode into Unstructured.
+	if _, ok := into.(runtime.Unstructured); ok {
+		if _, unmarshalErr := s.unmarshal(data, into); unmarshalErr != nil {
+			actual, interpretErr := s.metaFactory.Interpret(data)
+			if interpretErr != nil {
+				return nil, nil, interpretErr
+			}
+
+			if gvk != nil {
+				*actual = gvkWithDefaults(*actual, *gvk)
+			}
+
+			return nil, actual, unmarshalErr
+		}
+
+		actual := into.GetObjectKind().GroupVersionKind()
+		if len(actual.Kind) == 0 {
+			return nil, &actual, runtime.NewMissingKindErr(diagnose(data))
+		}
+		if len(actual.Version) == 0 {
+			return nil, &actual, runtime.NewMissingVersionErr(diagnose(data))
+		}
+
+		return into, &actual, nil
+	}
+
+	actual, err := s.metaFactory.Interpret(data)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if gvk != nil {
+		*actual = gvkWithDefaults(*actual, *gvk)
+	}
+
+	if into != nil {
+		types, _, err := s.typer.ObjectKinds(into)
+		if err != nil {
+			return nil, actual, err
+		}
+		*actual = gvkWithDefaults(*actual, types[0])
+	}
+
+	if len(actual.Kind) == 0 {
+		return nil, actual, runtime.NewMissingKindErr(diagnose(data))
+	}
+	if len(actual.Version) == 0 {
+		return nil, actual, runtime.NewMissingVersionErr(diagnose(data))
+	}
+
+	obj, err := runtime.UseOrCreateObject(s.typer, s.creater, *actual, into)
+	if err != nil {
+		return nil, actual, err
+	}
+
+	strict, err := s.unmarshal(data, obj)
+	if err != nil {
+		return nil, actual, err
+	}
+
+	if s.options.transcode {
+		if err := transcodeRawTypes(obj); err != nil {
+			return nil, actual, err
+		}
+	}
+
+	return obj, actual, strict
+}
+
+// selfDescribedCBOR is the CBOR encoding of the head of tag number 55799. This tag, specified in
+// RFC 8949 Section 3.4.6 "Self-Described CBOR", encloses all output from the encoder, has no
+// special semantics, and is used as a magic number to recognize CBOR-encoded data items.
+//
+// See https://www.rfc-editor.org/rfc/rfc8949.html#name-self-described-cbor.
+var selfDescribedCBOR = []byte{0xd9, 0xd9, 0xf7}
+
+func (s *serializer) RecognizesData(data []byte) (ok, unknown bool, err error) {
+	return bytes.HasPrefix(data, selfDescribedCBOR), false, nil
+}
+
+// NewSerializerInfo returns a default SerializerInfo for CBOR using the given creater and typer.
+func NewSerializerInfo(creater runtime.ObjectCreater, typer runtime.ObjectTyper) runtime.SerializerInfo {
+	return runtime.SerializerInfo{
+		MediaType:        "application/cbor",
+		MediaTypeType:    "application",
+		MediaTypeSubType: "cbor",
+		Serializer:       NewSerializer(creater, typer),
+		StrictSerializer: NewSerializer(creater, typer, Strict(true)),
+		StreamSerializer: &runtime.StreamSerializerInfo{
+			Framer:     NewFramer(),
+			Serializer: NewSerializer(creater, typer, Transcode(false)),
+		},
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor_test.go
new file mode 100644
index 0000000000..dcb59130c0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor_test.go
@@ -0,0 +1,874 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// The tests in this package focus on the correctness of its implementation of
+// runtime.Serializer. The specific behavior of marshaling Go values to CBOR bytes and back is
+// tested in the ./internal/modes package, which is used both by the Serializer implementation and
+// the package-scoped Marshal/Unmarshal functions in the ./direct package.
+package cbor
+
+import (
+	"bytes"
+	"encoding/hex"
+	"errors"
+	"io"
+	"reflect"
+	"strconv"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestRecognizesData(t *testing.T) {
+	for _, tc := range []struct {
+		in         []byte
+		recognizes bool
+	}{
+		{
+			in:         nil,
+			recognizes: false,
+		},
+		{
+			in:         []byte{},
+			recognizes: false,
+		},
+		{
+			in:         []byte{0xd9},
+			recognizes: false,
+		},
+		{
+			in:         []byte{0xd9, 0xd9},
+			recognizes: false,
+		},
+		{
+			in:         []byte{0xd9, 0xd9, 0xf7},
+			recognizes: true,
+		},
+		{
+			in:         []byte{0xff, 0xff, 0xff},
+			recognizes: false,
+		},
+		{
+			in:         []byte{0xd9, 0xd9, 0xf7, 0x01, 0x02, 0x03},
+			recognizes: true,
+		},
+		{
+			in:         []byte{0xff, 0xff, 0xff, 0x01, 0x02, 0x03},
+			recognizes: false,
+		},
+	} {
+		t.Run(hex.EncodeToString(tc.in), func(t *testing.T) {
+			s := NewSerializer(nil, nil)
+			recognizes, unknown, err := s.RecognizesData(tc.in)
+			if recognizes != tc.recognizes {
+				t.Errorf("expected recognized to be %t, got %t", tc.recognizes, recognizes)
+			}
+			if unknown {
+				t.Error("expected unknown to be false, got true")
+			}
+			if err != nil {
+				t.Errorf("expected nil error, got: %v", err)
+			}
+		})
+	}
+}
+
+type stubWriter struct {
+	n   int
+	err error
+}
+
+func (w stubWriter) Write([]byte) (int, error) {
+	return w.n, w.err
+}
+
+// anyObject wraps arbitrary concrete values to be encoded or decoded.
+type anyObject struct {
+	Value interface{}
+}
+
+func (p anyObject) GetObjectKind() schema.ObjectKind {
+	return schema.EmptyObjectKind
+}
+
+func (anyObject) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+func (p anyObject) MarshalCBOR() ([]byte, error) {
+	return modes.Encode.Marshal(p.Value)
+}
+
+func (p *anyObject) UnmarshalCBOR(in []byte) error {
+	return modes.Decode.Unmarshal(in, &p.Value)
+}
+
+type structWithRawFields struct {
+	FieldsV1            metav1.FieldsV1       `json:"f"`
+	FieldsV1Pointer     *metav1.FieldsV1      `json:"fp"`
+	RawExtension        runtime.RawExtension  `json:"r"`
+	RawExtensionPointer *runtime.RawExtension `json:"rp"`
+}
+
+func (structWithRawFields) GetObjectKind() schema.ObjectKind {
+	return schema.EmptyObjectKind
+}
+
+func (structWithRawFields) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+type structWithEmbeddedMetas struct {
+	metav1.TypeMeta   `json:""`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+}
+
+func (structWithEmbeddedMetas) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+func TestEncode(t *testing.T) {
+	for _, tc := range []struct {
+		name           string
+		in             runtime.Object
+		assertOnWriter func() (io.Writer, func(*testing.T))
+		assertOnError  func(*testing.T, error)
+	}{
+		{
+			name: "io error writing self described cbor tag",
+			assertOnWriter: func() (io.Writer, func(*testing.T)) {
+				return stubWriter{err: io.ErrShortWrite}, func(*testing.T) {}
+			},
+			assertOnError: func(t *testing.T, err error) {
+				if !errors.Is(err, io.ErrShortWrite) {
+					t.Errorf("expected io.ErrShortWrite, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "output enclosed by self-described CBOR tag",
+			in:   anyObject{},
+			assertOnWriter: func() (io.Writer, func(*testing.T)) {
+				var b bytes.Buffer
+				return &b, func(t *testing.T) {
+					if !bytes.HasPrefix(b.Bytes(), []byte{0xd9, 0xd9, 0xf7}) {
+						t.Errorf("expected output to have prefix 0xd9d9f7: 0x%x", b.Bytes())
+					}
+				}
+			},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "unstructuredlist",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"apiVersion": "v",
+					"kind":       "kList",
+				},
+				Items: []unstructured.Unstructured{
+					{Object: map[string]interface{}{"foo": int64(1)}},
+					{Object: map[string]interface{}{"foo": int64(2)}},
+				},
+			},
+			assertOnWriter: func() (io.Writer, func(t *testing.T)) {
+				var b bytes.Buffer
+				return &b, func(t *testing.T) {
+					// {'kind': 'kList', 'items': [{'foo': 1}, {'foo': 2}], 'apiVersion': 'v'}
+					if diff := cmp.Diff(b.Bytes(), []byte("\xd9\xd9\xf7\xa3\x44kind\x45kList\x45items\x82\xa1\x43foo\x01\xa1\x43foo\x02\x4aapiVersion\x41v")); diff != "" {
+						t.Errorf("unexpected diff:\n%s", diff)
+					}
+				}
+			},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "text marshaler",
+			in:   &textMarshalerObject{},
+			assertOnWriter: func() (io.Writer, func(*testing.T)) {
+				var b bytes.Buffer
+				return &b, func(t *testing.T) {
+					if diff := cmp.Diff(b.Bytes(), []byte{0xd9, 0xd9, 0xf7, 0x64, 't', 'e', 's', 't'}); diff != "" {
+						t.Errorf("unexpected diff:\n%s", diff)
+					}
+				}
+			},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "text marshaler within unstructured content",
+			in: &unstructured.Unstructured{
+				Object: map[string]interface{}{"": textMarshalerObject{}},
+			},
+			assertOnWriter: func() (io.Writer, func(*testing.T)) {
+				var b bytes.Buffer
+				return &b, func(t *testing.T) {
+					if diff := cmp.Diff(b.Bytes(), []byte{0xd9, 0xd9, 0xf7, 0xa1, 0x40, 0x64, 't', 'e', 's', 't'}); diff != "" {
+						t.Errorf("unexpected diff:\n%s", diff)
+					}
+				}
+			},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			s := NewSerializer(nil, nil)
+			w, assertOnWriter := tc.assertOnWriter()
+			err := s.Encode(tc.in, w)
+			tc.assertOnError(t, err)
+			assertOnWriter(t)
+		})
+	}
+}
+
+func TestDecode(t *testing.T) {
+	for _, tc := range []struct {
+		name          string
+		options       []Option
+		data          []byte
+		gvk           *schema.GroupVersionKind
+		metaFactory   metaFactory
+		typer         runtime.ObjectTyper
+		creater       runtime.ObjectCreater
+		into          runtime.Object
+		expectedObj   runtime.Object
+		expectedGVK   *schema.GroupVersionKind
+		assertOnError func(*testing.T, error)
+	}{
+		{
+			name:        "self-described cbor tag accepted",
+			data:        []byte("\xd9\xd9\xf7\xa3\x4aapiVersion\x41v\x44kind\x41k\x48metadata\xa1\x44name\x43foo"), // 55799({'apiVersion': 'v', 'kind': 'k', 'metadata': {'name': 'foo'}})
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: &defaultMetaFactory{},
+			typer:       stubTyper{gvks: []schema.GroupVersionKind{{Version: "v", Kind: "k"}}},
+			into:        &metav1.PartialObjectMetadata{},
+			expectedObj: &metav1.PartialObjectMetadata{
+				TypeMeta:   metav1.TypeMeta{APIVersion: "v", Kind: "k"},
+				ObjectMeta: metav1.ObjectMeta{Name: "foo"},
+			},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "k"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "error determining gvk",
+			metaFactory: stubMetaFactory{err: errors.New("test")},
+			assertOnError: func(t *testing.T, err error) {
+				if err == nil || err.Error() != "test" {
+					t.Errorf("expected error \"test\", got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "typer does not recognize into",
+			gvk:         &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       notRegisteredTyper{},
+			into:        &anyObject{},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsNotRegisteredError(err) {
+					t.Errorf("expected NotRegisteredError, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "gvk from type of into",
+			data:        []byte{0xf6},
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       stubTyper{gvks: []schema.GroupVersionKind{{Group: "x", Version: "y", Kind: "z"}}},
+			into:        &anyObject{},
+			expectedObj: &anyObject{},
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "raw types transcoded",
+			data:        []byte{0xa4, 0x41, 'f', 0xa1, 0x41, 'a', 0x01, 0x42, 'f', 'p', 0xa1, 0x41, 'z', 0x02, 0x41, 'r', 0xa1, 0x41, 'b', 0x03, 0x42, 'r', 'p', 0xa1, 0x41, 'y', 0x04},
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       stubTyper{gvks: []schema.GroupVersionKind{{Group: "x", Version: "y", Kind: "z"}}},
+			into:        &structWithRawFields{},
+			expectedObj: &structWithRawFields{
+				FieldsV1:            *metav1.NewFieldsV1(`{"a":1}`),
+				FieldsV1Pointer:     metav1.NewFieldsV1(`{"z":2}`),
+				RawExtension:        runtime.RawExtension{Raw: []byte(`{"b":3}`)},
+				RawExtensionPointer: &runtime.RawExtension{Raw: []byte(`{"y":4}`)},
+			},
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "raw types not transcoded",
+			options:     []Option{Transcode(false)},
+			data:        []byte{0xa4, 0x41, 'f', 0xa1, 0x41, 'a', 0x01, 0x42, 'f', 'p', 0xa1, 0x41, 'z', 0x02, 0x41, 'r', 0xa1, 0x41, 'b', 0x03, 0x42, 'r', 'p', 0xa1, 0x41, 'y', 0x04},
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       stubTyper{gvks: []schema.GroupVersionKind{{Group: "x", Version: "y", Kind: "z"}}},
+			into:        &structWithRawFields{},
+			expectedObj: &structWithRawFields{
+				FieldsV1:        *metav1.NewFieldsV1(string([]byte{0xa1, 0x41, 'a', 0x01})),
+				FieldsV1Pointer: metav1.NewFieldsV1(string([]byte{0xa1, 0x41, 'z', 0x02})),
+				// RawExtension's UnmarshalCBOR ensures the self-described CBOR tag
+				// is present in the result so that there is never any ambiguity in
+				// distinguishing CBOR from JSON or Protobuf. It is unnecessary for
+				// FieldsV1 to do the same because the initial byte is always
+				// sufficient to distinguish a valid JSON-encoded FieldsV1 from a
+				// valid CBOR-encoded FieldsV1.
+				RawExtension:        runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0xa1, 0x41, 'b', 0x03}},
+				RawExtensionPointer: &runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0xa1, 0x41, 'y', 0x04}},
+			},
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "object with embedded typemeta and objectmeta",
+			data:        []byte("\xa2\x48metadata\xa1\x44name\x43foo\x44spec\xa0"), // {"metadata": {"name": "foo"}}
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       stubTyper{gvks: []schema.GroupVersionKind{{Group: "x", Version: "y", Kind: "z"}}},
+			into:        &structWithEmbeddedMetas{},
+			expectedObj: &structWithEmbeddedMetas{
+				ObjectMeta: metav1.ObjectMeta{Name: "foo"},
+			},
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "strict mode strict error",
+			options:     []Option{Strict(true)},
+			data:        []byte{0xa1, 0x61, 'z', 0x01}, // {'z': 1}
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       stubTyper{gvks: []schema.GroupVersionKind{{Group: "x", Version: "y", Kind: "z"}}},
+			into:        &metav1.PartialObjectMetadata{},
+			expectedObj: &metav1.PartialObjectMetadata{},
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsStrictDecodingError(err) {
+					t.Errorf("expected StrictDecodingError, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "no strict mode no strict error",
+			data:        []byte{0xa1, 0x61, 'z', 0x01}, // {'z': 1}
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       stubTyper{gvks: []schema.GroupVersionKind{{Group: "x", Version: "y", Kind: "z"}}},
+			into:        &metav1.PartialObjectMetadata{},
+			expectedObj: &metav1.PartialObjectMetadata{},
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "unknown error from typer on into",
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       stubTyper{err: errors.New("test")},
+			into:        &anyObject{},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{},
+			assertOnError: func(t *testing.T, err error) {
+				if err == nil || err.Error() != "test" {
+					t.Errorf("expected error \"test\", got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "missing kind",
+			gvk:         &schema.GroupVersionKind{Version: "v"},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Version: "v"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingKind(err) {
+					t.Errorf("expected MissingKind, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "missing version",
+			gvk:         &schema.GroupVersionKind{Kind: "k"},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Kind: "k"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingVersion(err) {
+					t.Errorf("expected MissingVersion, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "creater error",
+			gvk:         &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			creater:     stubCreater{err: errors.New("test")},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if err == nil || err.Error() != "test" {
+					t.Errorf("expected error \"test\", got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "unmarshal error",
+			data:        nil, // EOF
+			gvk:         &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			creater:     stubCreater{obj: &anyObject{}},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if !errors.Is(err, io.EOF) {
+					t.Errorf("expected EOF, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "strict mode unmarshal error",
+			options:     []Option{Strict(true)},
+			data:        nil, // EOF
+			gvk:         &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			creater:     stubCreater{obj: &anyObject{}},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if !errors.Is(err, io.EOF) {
+					t.Errorf("expected EOF, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "into unstructured unmarshal error",
+			data:        nil, // EOF
+			gvk:         &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			into:        &unstructured.Unstructured{},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if !errors.Is(err, io.EOF) {
+					t.Errorf("expected EOF, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "into unstructured missing kind",
+			data:        []byte("\xa1\x6aapiVersion\x61v"),
+			into:        &unstructured.Unstructured{},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Version: "v"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingKind(err) {
+					t.Errorf("expected MissingKind, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "into unstructured missing version",
+			data:        []byte("\xa1\x64kind\x61k"),
+			into:        &unstructured.Unstructured{},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Kind: "k"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingVersion(err) {
+					t.Errorf("expected MissingVersion, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "into unstructured",
+			data: []byte("\xa2\x6aapiVersion\x61v\x64kind\x61k"),
+			into: &unstructured.Unstructured{},
+			expectedObj: &unstructured.Unstructured{Object: map[string]interface{}{
+				"apiVersion": "v",
+				"kind":       "k",
+			}},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "k"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "using unstructured creater",
+			data:        []byte("\xa2\x6aapiVersion\x61v\x64kind\x61k"),
+			metaFactory: &defaultMetaFactory{},
+			creater:     stubCreater{obj: &unstructured.Unstructured{}},
+			expectedObj: &unstructured.Unstructured{Object: map[string]interface{}{
+				"apiVersion": "v",
+				"kind":       "k",
+			}},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "k"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "into unstructuredlist missing kind",
+			data:        []byte("\xa1\x6aapiVersion\x61v"),
+			into:        &unstructured.UnstructuredList{},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Version: "v"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingKind(err) {
+					t.Errorf("expected MissingKind, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "into unstructuredlist missing version",
+			data:        []byte("\xa1\x64kind\x65kList"),
+			into:        &unstructured.UnstructuredList{},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Kind: "kList"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingVersion(err) {
+					t.Errorf("expected MissingVersion, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "into unstructuredlist empty",
+			data: []byte("\xa2\x6aapiVersion\x61v\x64kind\x65kList"),
+			into: &unstructured.UnstructuredList{},
+			expectedObj: &unstructured.UnstructuredList{Object: map[string]interface{}{
+				"apiVersion": "v",
+				"kind":       "kList",
+			}},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "kList"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "into unstructuredlist nonempty",
+			data: []byte("\xa3\x6aapiVersion\x61v\x64kind\x65kList\x65items\x82\xa1\x63foo\x01\xa1\x63foo\x02"), // {"apiVersion": "v", "kind": "kList", "items": [{"foo": 1}, {"foo": 2}]}
+			into: &unstructured.UnstructuredList{},
+			expectedObj: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"apiVersion": "v",
+					"kind":       "kList",
+				},
+				Items: []unstructured.Unstructured{
+					{Object: map[string]interface{}{"apiVersion": "v", "kind": "k", "foo": int64(1)}},
+					{Object: map[string]interface{}{"apiVersion": "v", "kind": "k", "foo": int64(2)}},
+				},
+			},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "kList"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "into unstructuredlist item gvk present",
+			data: []byte("\xa3\x6aapiVersion\x61v\x64kind\x65kList\x65items\x81\xa2\x6aapiVersion\x62vv\x64kind\x62kk"), // {"apiVersion": "v", "kind": "kList", "items": [{"apiVersion": "vv", "kind": "kk"}]}
+			into: &unstructured.UnstructuredList{},
+			expectedObj: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"apiVersion": "v",
+					"kind":       "kList",
+				},
+				Items: []unstructured.Unstructured{
+					{Object: map[string]interface{}{"apiVersion": "vv", "kind": "kk"}},
+				},
+			},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "kList"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "into unstructuredlist item missing kind",
+			data:        []byte("\xa3\x6aapiVersion\x61v\x64kind\x65kList\x65items\x81\xa1\x6aapiVersion\x62vv"), // {"apiVersion": "v", "kind": "kList", "items": [{"apiVersion": "vv"}]}
+			metaFactory: &defaultMetaFactory{},
+			into:        &unstructured.UnstructuredList{},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "kList"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingKind(err) {
+					t.Errorf("expected MissingVersion, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "into unstructuredlist item missing version",
+			data:        []byte("\xa3\x6aapiVersion\x61v\x64kind\x65kList\x65items\x81\xa1\x64kind\x62kk"), // {"apiVersion": "v", "kind": "kList", "items": [{"kind": "kk"}]}
+			metaFactory: &defaultMetaFactory{},
+			into:        &unstructured.UnstructuredList{},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "kList"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingVersion(err) {
+					t.Errorf("expected MissingVersion, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "using unstructuredlist creater",
+			data:        []byte("\xa2\x6aapiVersion\x61v\x64kind\x65kList"),
+			metaFactory: &defaultMetaFactory{},
+			creater:     stubCreater{obj: &unstructured.UnstructuredList{}},
+			expectedObj: &unstructured.UnstructuredList{Object: map[string]interface{}{
+				"apiVersion": "v",
+				"kind":       "kList",
+			}},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "kList"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			s := newSerializer(tc.metaFactory, tc.creater, tc.typer, tc.options...)
+
+			actualObj, actualGVK, err := s.Decode(tc.data, tc.gvk, tc.into)
+			tc.assertOnError(t, err)
+
+			if !reflect.DeepEqual(tc.expectedObj, actualObj) {
+				t.Error(cmp.Diff(tc.expectedObj, actualObj))
+			}
+
+			if diff := cmp.Diff(tc.expectedGVK, actualGVK); diff != "" {
+				t.Error(diff)
+			}
+		})
+	}
+}
+
+type textMarshalerObject struct{}
+
+func (p textMarshalerObject) GetObjectKind() schema.ObjectKind {
+	return schema.EmptyObjectKind
+}
+
+func (textMarshalerObject) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+func (textMarshalerObject) MarshalText() ([]byte, error) {
+	return []byte("test"), nil
+}
+
+func TestMetaFactoryInterpret(t *testing.T) {
+	mf := &defaultMetaFactory{}
+	_, err := mf.Interpret(nil)
+	if err == nil {
+		t.Error("expected non-nil error")
+	}
+	gvk, err := mf.Interpret([]byte("\xa2\x6aapiVersion\x63a/b\x64kind\x61c"))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if diff := cmp.Diff(&schema.GroupVersionKind{Group: "a", Version: "b", Kind: "c"}, gvk); diff != "" {
+		t.Error(diff)
+	}
+}
+
+type stubTyper struct {
+	gvks        []schema.GroupVersionKind
+	unversioned bool
+	err         error
+}
+
+func (t stubTyper) ObjectKinds(obj runtime.Object) ([]schema.GroupVersionKind, bool, error) {
+	return t.gvks, t.unversioned, t.err
+}
+
+func (stubTyper) Recognizes(schema.GroupVersionKind) bool {
+	return false
+}
+
+type stubCreater struct {
+	obj runtime.Object
+	err error
+}
+
+func (c stubCreater) New(gvk schema.GroupVersionKind) (runtime.Object, error) {
+	return c.obj, c.err
+}
+
+type notRegisteredTyper struct{}
+
+func (notRegisteredTyper) ObjectKinds(obj runtime.Object) ([]schema.GroupVersionKind, bool, error) {
+	return nil, false, runtime.NewNotRegisteredErrForType("test", reflect.TypeOf(obj))
+}
+
+func (notRegisteredTyper) Recognizes(schema.GroupVersionKind) bool {
+	return false
+}
+
+type stubMetaFactory struct {
+	gvk *schema.GroupVersionKind
+	err error
+}
+
+func (mf stubMetaFactory) Interpret([]byte) (*schema.GroupVersionKind, error) {
+	return mf.gvk, mf.err
+}
+
+type oneMapField struct {
+	metav1.TypeMeta `json:""`
+	Map             map[string]interface{} `json:"map"`
+}
+
+func (o oneMapField) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+func (o oneMapField) GetObjectKind() schema.ObjectKind {
+	panic("unimplemented")
+}
+
+type eightStringFields struct {
+	metav1.TypeMeta `json:""`
+	A               string `json:"1"`
+	B               string `json:"2"`
+	C               string `json:"3"`
+	D               string `json:"4"`
+	E               string `json:"5"`
+	F               string `json:"6"`
+	G               string `json:"7"`
+	H               string `json:"8"`
+}
+
+func (o eightStringFields) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+func (o eightStringFields) GetObjectKind() schema.ObjectKind {
+	panic("unimplemented")
+}
+
+// TestEncodeNondeterministic tests that repeated encodings of multi-field structs and maps do not
+// encode to precisely the same bytes when repeatedly encoded with EncodeNondeterministic. When
+// using EncodeNondeterministic, the order of items in CBOR maps should be intentionally shuffled to
+// prevent applications from inadvertently depending on encoding determinism. All permutations do
+// not necessarily have equal probability.
+func TestEncodeNondeterministic(t *testing.T) {
+	for _, tc := range []struct {
+		name  string
+		input runtime.Object
+	}{
+		{
+			name: "map",
+			input: func() runtime.Object {
+				m := map[string]interface{}{}
+				for i := 1; i <= 8; i++ {
+					m[strconv.Itoa(i)] = strconv.Itoa(i)
+
+				}
+				return oneMapField{Map: m}
+			}(),
+		},
+		{
+			name: "struct",
+			input: eightStringFields{
+				TypeMeta: metav1.TypeMeta{},
+				A:        "1",
+				B:        "2",
+				C:        "3",
+				D:        "4",
+				E:        "5",
+				F:        "6",
+				G:        "7",
+				H:        "8",
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var b bytes.Buffer
+			e := NewSerializer(nil, nil)
+
+			if err := e.EncodeNondeterministic(tc.input, &b); err != nil {
+				t.Fatal(err)
+			}
+			first := b.String()
+
+			const Trials = 128
+			for trial := 0; trial < Trials; trial++ {
+				b.Reset()
+				if err := e.EncodeNondeterministic(tc.input, &b); err != nil {
+					t.Fatal(err)
+				}
+
+				if !bytes.Equal([]byte(first), b.Bytes()) {
+					return
+				}
+			}
+			t.Fatalf("nondeterministic encode produced the same bytes on %d consecutive calls: %s", Trials, first)
+		})
+	}
+
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections.go
new file mode 100644
index 0000000000..5aa0fb7ca4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections.go
@@ -0,0 +1,328 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cbor
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"maps"
+	"math/rand"
+	"reflect"
+	"slices"
+	"sort"
+
+	"k8s.io/apimachinery/pkg/conversion"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+
+	"github.com/fxamacker/cbor/v2"
+)
+
+func streamEncodeCollections(obj runtime.Object, w io.Writer, mode modes.EncMode) (bool, error) {
+	list, ok := obj.(*unstructured.UnstructuredList)
+	if ok {
+		return true, streamingEncodeUnstructuredList(w, list, mode)
+	}
+	if _, ok := obj.(cbor.Marshaler); ok {
+		return false, nil
+	}
+	if _, ok := obj.(json.Marshaler); ok {
+		return false, nil
+	}
+	typeMeta, listMeta, items, err := getListMeta(obj)
+	if err == nil {
+		return true, streamingEncodeList(w, typeMeta, listMeta, items, mode)
+	}
+	return false, nil
+}
+
+// getListMeta implements list extraction logic for cbor stream serialization.
+func getListMeta(list runtime.Object) (metav1.TypeMeta, metav1.ListMeta, []interface{}, error) {
+	listValue, err := conversion.EnforcePtr(list)
+	if err != nil {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, err
+	}
+	listType := listValue.Type()
+	if listType.NumField() != 3 {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected ListType to have 3 fields")
+	}
+	// The streaming encoder reproduces the field names and layout implied by the
+	// json struct tags (kind, apiVersion, metadata, items). The CBOR encoder,
+	// however, gives a "cbor" struct tag precedence over "json", so a cbor tag on
+	// any of these fields could rename a key, change its options (e.g. keyasint),
+	// or un-inline the embedded TypeMeta -- diverging from the streamed output.
+	// Refuse to stream such a type and fall back to the general encoder, which
+	// honors the cbor tag correctly.
+	for i := 0; i < listType.NumField(); i++ {
+		if _, ok := listType.Field(i).Tag.Lookup("cbor"); ok {
+			return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected list field %d to have no cbor tag", i)
+		}
+	}
+	// TypeMeta
+	typeMeta, ok := listValue.Field(0).Interface().(metav1.TypeMeta)
+	if !ok {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected TypeMeta field to have TypeMeta type")
+	}
+	if !listType.Field(0).Anonymous {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be embedded`)
+	}
+	if jsonTag, jsonTagExists := listType.Field(0).Tag.Lookup("json"); !jsonTagExists {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag`)
+	} else if jsonTag != "" && jsonTag != ",inline" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be "" or ",inline"`)
+	}
+	// ListMeta
+	listMeta, ok := listValue.Field(1).Interface().(metav1.ListMeta)
+	if !ok {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected ListMeta field to have ListMeta type")
+	}
+	if listType.Field(1).Tag.Get("json") != "metadata,omitempty" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected ListMeta json field tag to be "metadata,omitempty"`)
+	}
+	// Items
+	if listType.Field(2).Tag.Get("json") != "items" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected Items json field tag to be "items"`)
+	}
+	items, err := getListItems(listValue.Field(2))
+	if err != nil {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, err
+	}
+	return typeMeta, listMeta, items, nil
+}
+
+// getListItems returns the elements of a list's Items field as addressable
+// values. Marshaling each element directly (rather than routing through
+// meta.ExtractList) preserves the element's own type and custom marshaler, so
+// that e.g. a metav1.List whose Items are runtime.RawExtension holding CBOR
+// bytes are encoded verbatim by runtime.RawExtension.MarshalCBOR instead of
+// being flattened into a runtime.Unknown (which has no MarshalCBOR and would be
+// misencoded as a struct or fail JSON transcoding).
+//
+// A nil Items slice returns a nil result, distinct from an empty non-nil slice,
+// so the encoder can emit CBOR null rather than an empty array.
+func getListItems(itemsValue reflect.Value) ([]interface{}, error) {
+	if itemsValue.Kind() != reflect.Slice {
+		return nil, fmt.Errorf("expected Items field to be a slice, got %s", itemsValue.Kind())
+	}
+	if itemsValue.IsNil() {
+		return nil, nil
+	}
+	items := make([]interface{}, itemsValue.Len())
+	for i := range items {
+		items[i] = itemsValue.Index(i).Addr().Interface()
+	}
+	return items, nil
+}
+
+type cborMapEntry struct {
+	key   string
+	write func() error
+}
+
+func streamingEncodeList(w io.Writer, typeMeta metav1.TypeMeta, listMeta metav1.ListMeta, items []interface{}, mode modes.EncMode) error {
+	var entries []cborMapEntry
+
+	if typeMeta.Kind != "" {
+		entries = append(entries, cborMapEntry{
+			key: "kind",
+			write: func() error {
+				return encodeKeyValuePair(w, "kind", typeMeta.Kind, mode)
+			},
+		})
+	}
+	entries = append(entries, cborMapEntry{
+		key: "items",
+		write: func() error {
+			if err := mode.MarshalTo("items", w); err != nil {
+				return err
+			}
+			if items == nil {
+				_, err := w.Write([]byte{0xf6}) // CBOR null
+				return err
+			}
+			if err := writeArrayHead(w, len(items)); err != nil {
+				return err
+			}
+			for _, item := range items {
+				if err := mode.MarshalTo(item, w); err != nil {
+					return err
+				}
+			}
+			return nil
+		},
+	})
+	entries = append(entries, cborMapEntry{
+		key: "metadata",
+		write: func() error {
+			return encodeKeyValuePair(w, "metadata", listMeta, mode)
+		},
+	})
+	if typeMeta.APIVersion != "" {
+		entries = append(entries, cborMapEntry{
+			key: "apiVersion",
+			write: func() error {
+				return encodeKeyValuePair(w, "apiVersion", typeMeta.APIVersion, mode)
+			},
+		})
+	}
+
+	// entries is built in a fixed order (kind, items, metadata, apiVersion).
+	// Unlike streamingEncodeUnstructuredList, whose keys come in Go's randomized
+	// map-iteration order, there is no inherent randomness here, so for
+	// nondeterministic modes (SortFastShuffle) we rotate the encoding for-loop
+	// by a random initial offset.
+	start := 0
+	if !mode.IsDeterministic() && len(entries) > 0 {
+		start = rand.Intn(len(entries))
+	}
+
+	if err := writeMapHead(w, len(entries)); err != nil {
+		return err
+	}
+
+	for i := 0; i < len(entries); i++ {
+		entry := entries[(start+i)%len(entries)]
+		if err := entry.write(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func streamingEncodeUnstructuredList(w io.Writer, list *unstructured.UnstructuredList, mode modes.EncMode) error {
+	keys := slices.Collect(maps.Keys(list.Object))
+	if _, exists := list.Object["items"]; !exists {
+		keys = append(keys, "items")
+	}
+	// keys starts in Go's randomized map-iteration order. For deterministic
+	// modes (SortBytewiseLexical) we sort it: shorter lengths come first, then
+	// lexicographic by content. For nondeterministic modes (SortFastShuffle) we
+	// leave the map-iteration order as-is, which already varies from call to
+	// call (analogous to what SortFastShuffle does for structs), so no explicit
+	// shuffling is needed.
+	if mode.IsDeterministic() {
+		sort.Slice(keys, func(i, j int) bool {
+			if len(keys[i]) != len(keys[j]) {
+				return len(keys[i]) < len(keys[j])
+			}
+			return keys[i] < keys[j]
+		})
+	}
+
+	if err := writeMapHead(w, len(keys)); err != nil {
+		return err
+	}
+
+	for _, key := range keys {
+		if err := mode.MarshalTo(key, w); err != nil {
+			return err
+		}
+		if key == "items" {
+			if err := writeArrayHead(w, len(list.Items)); err != nil {
+				return err
+			}
+			for _, item := range list.Items {
+				if err := mode.MarshalTo(item.Object, w); err != nil {
+					return err
+				}
+			}
+		} else {
+			if err := mode.MarshalTo(list.Object[key], w); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func encodeKeyValuePair(w io.Writer, key string, value interface{}, mode modes.EncMode) error {
+	if err := mode.MarshalTo(key, w); err != nil {
+		return err
+	}
+	if err := mode.MarshalTo(value, w); err != nil {
+		return err
+	}
+	return nil
+}
+
+// CBOR major type prefix bytes (the type in the high 3 bits, additional info
+// zeroed), following RFC 8949 Section 3.1.
+const (
+	cborTypeArray byte = 0x80 // major type 4
+	cborTypeMap   byte = 0xa0 // major type 5
+)
+
+// writeMapHead writes a CBOR map header for a map with n entries.
+func writeMapHead(w io.Writer, n int) error {
+	return writeCollectionHead(w, cborTypeMap, int64(n))
+}
+
+// writeArrayHead writes a CBOR array header for an array with n elements.
+func writeArrayHead(w io.Writer, n int) error {
+	return writeCollectionHead(w, cborTypeArray, int64(n))
+}
+
+// writeCollectionHead writes a CBOR collection (array or map) header encoding
+// the number of elements n, following RFC 8949 Section 3 additional info rules:
+//
+//   - base: the prefix byte for the collection type.
+//     For maps: cborTypeMap (0xa0), for arrays: cborTypeArray (0x80).
+//
+// The extended form prefixes are derived from base using bitwise OR:
+//   - base|24: 1-byte length follows (additional info 24)
+//   - base|25: 2-byte length follows (additional info 25)
+//   - base|26: 4-byte length follows (additional info 26)
+//   - base|27: 8-byte length follows (additional info 27)
+//
+// Encoding table (map example, base=0xa0):
+//
+//	n <= 23:         1 byte  — 0xa0|n
+//	n <= 0xFF:        2 bytes — 0xb8 (0xa0|24), n
+//	n <= 0xFFFF:      3 bytes — 0xb9 (0xa0|25), n>>8, n
+//	n <= 0xFFFFFFFF:  5 bytes — 0xba (0xa0|26), n>>24..n
+//	n > 0xFFFFFFFF:   9 bytes — 0xbb (0xa0|27), n>>56..n
+func writeCollectionHead(w io.Writer, base byte, n int64) error {
+	switch {
+	case n <= 23:
+		// Additional info 0–23: length is encoded directly in the low 5 bits.
+		_, err := w.Write([]byte{base + byte(n)})
+		return err
+	case n <= 0xFF:
+		// Additional info 24: one additional byte carries the length.
+		_, err := w.Write([]byte{base | 24, byte(n)})
+		return err
+	case n <= 0xFFFF:
+		// Additional info 25: two additional bytes carry the length (big-endian).
+		_, err := w.Write([]byte{base | 25, byte(n >> 8), byte(n)})
+		return err
+	case n <= 0xFFFFFFFF:
+		// Additional info 26: four additional bytes carry the length (big-endian).
+		_, err := w.Write([]byte{base | 26, byte(n >> 24), byte(n >> 16), byte(n >> 8), byte(n)})
+		return err
+	default:
+		// Additional info 27: eight additional bytes carry the length (big-endian).
+		_, err := w.Write([]byte{
+			base | 27, byte(n >> 56), byte(n >> 48), byte(n >> 40), byte(n >> 32), byte(n >> 24), byte(n >> 16),
+			byte(n >> 8), byte(n),
+		})
+		return err
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections_test.go
new file mode 100644
index 0000000000..9b205f58e8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections_test.go
@@ -0,0 +1,1316 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cbor
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"sigs.k8s.io/randfill"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	testapigroupv1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+)
+
+// TestStreamingCollectionsEncoding verifies that streaming encoding produces
+// output identical to normal non-streaming encoding, and that the streaming
+// encoder actually uses multiple Write calls (not just buffering everything).
+func TestStreamingCollectionsEncoding(t *testing.T) {
+	var buf writeCountingBuffer
+	var remainingItems int64 = 1
+	for _, tc := range []struct {
+		name         string
+		in           runtime.Object
+		cannotStream bool
+	}{
+		// Preserving the distinction between integers and floating-point numbers
+		{
+			name: "Struct with floats",
+			in: &StructWithFloatsList{
+				Items: []StructWithFloats{
+					{
+						Int:     1,
+						Float32: float32(1),
+						Float64: 1.1,
+					},
+				},
+			},
+		},
+		{
+			name: "Unstructured object float",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"int":     1,
+					"float32": float32(1),
+					"float64": 1.1,
+				},
+			},
+		},
+		{
+			name: "Unstructured items float",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"int":     1,
+							"float32": float32(1),
+							"float64": 1.1,
+						},
+					},
+				},
+			},
+		},
+		// Handling structs with duplicate field names (JSON tag names) without producing duplicate keys in the encoded output
+		{
+			name: "StructWithDuplicatedTags",
+			in: &StructWithDuplicatedTagsList{
+				Items: []StructWithDuplicatedTags{
+					{
+						Key1: "key1",
+						Key2: "key2",
+					},
+				},
+			},
+		},
+		// Encoding Go strings containing invalid UTF-8 sequences without error
+		{
+			name: "UnstructuredList object invalid UTF-8",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"key": "\x80", // first byte is a continuation byte
+				},
+			},
+		},
+		{
+			name: "UnstructuredList items invalid UTF-8",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"key": "\x80",
+						},
+					},
+				},
+			},
+		},
+		// Preserving the distinction between absent, present-but-null, and present-and-empty states for slices and maps
+		{
+			name: "CarpList items nil",
+			in: &testapigroupv1.CarpList{
+				Items: nil,
+			},
+		},
+		{
+			name: "CarpList slice nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: nil,
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "CarpList map nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: nil,
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList items nil",
+			in: &unstructured.UnstructuredList{
+				Items: nil,
+			},
+		},
+		{
+			name: "UnstructuredList items slice nil",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"slice": ([]string)(nil),
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList items map nil",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"map": (map[string]string)(nil),
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList object nil",
+			in: &unstructured.UnstructuredList{
+				Object: nil,
+			},
+		},
+		{
+			name: "UnstructuredList object slice nil",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"slice": ([]string)(nil),
+				},
+			},
+		},
+		{
+			name: "UnstructuredList object map nil",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"map": (map[string]string)(nil),
+				},
+			},
+		},
+		{
+			name: "CarpList items empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{},
+			},
+		},
+		{
+			name: "CarpList slice empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: []testapigroupv1.CarpCondition{},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "CarpList map empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: map[string]string{},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList items empty",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{},
+			},
+		},
+		{
+			name: "UnstructuredList items slice empty",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"slice": []string{},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList items map empty",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"map": map[string]string{},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList object empty",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{},
+			},
+		},
+		{
+			name: "UnstructuredList object slice empty",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"slice": []string{},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList object map empty",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"map": map[string]string{},
+				},
+			},
+		},
+		// Handling structs implementing json.Marshaler method
+		{
+			name:         "List with json.Marshaler cannot be streamed",
+			in:           &ListWithMarshalJSONList{},
+			cannotStream: true,
+		},
+		{
+			name: "Struct with json.Marshaler",
+			in: &StructWithMarshalJSONList{
+				Items: []StructWithMarshalJSON{
+					{},
+				},
+			},
+		},
+		// Handling structs implementing cbor.Marshaler but NOT json.Marshaler
+		{
+			name:         "List with cbor.Marshaler cannot be streamed",
+			in:           &ListWithMarshalCBORList{},
+			cannotStream: true,
+		},
+		{
+			name: "Struct with cbor.Marshaler",
+			in: &StructWithMarshalCBORList{
+				Items: []StructWithMarshalCBOR{
+					{},
+				},
+			},
+		},
+		// Handling structs implementing both json.Marshaler and cbor.Marshaler
+		{
+			name:         "List with json.Marshaler and cbor.Marshaler cannot be streamed",
+			in:           &ListWithBothMarshalersList{},
+			cannotStream: true,
+		},
+		{
+			name: "Struct with json.Marshaler and cbor.Marshaler",
+			in: &StructWithBothMarshalersList{
+				Items: []StructWithBothMarshalers{
+					{},
+				},
+			},
+		},
+		// Handling raw bytes.
+		{
+			name: "Struct with raw bytes",
+			in: &StructWithRawBytesList{
+				Items: []StructWithRawBytes{
+					{
+						Slice: []byte{0x01, 0x02, 0x03},
+						Array: [3]byte{0x01, 0x02, 0x03},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList object raw bytes",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"slice": []byte{0x01, 0x02, 0x03},
+					"array": [3]byte{0x01, 0x02, 0x03},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList items raw bytes",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"slice": []byte{0x01, 0x02, 0x03},
+							"array": [3]byte{0x01, 0x02, 0x03},
+						},
+					},
+				},
+			},
+		},
+		// Other scenarios:
+		{
+			name: "List just kind",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind: "List",
+				},
+			},
+		},
+		{
+			name: "List just apiVersion",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "v1",
+				},
+			},
+		},
+		{
+			name: "List no elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{},
+			},
+		},
+		{
+			name: "List one element with continue",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion:    "2345",
+					Continue:           "abc",
+					RemainingItemCount: &remainingItems,
+				},
+				Items: []testapigroupv1.Carp{
+					{
+						TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+							Name:      "pod",
+							Namespace: "default",
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "List two elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{
+					{
+						TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+							Name:      "pod",
+							Namespace: "default",
+						},
+					},
+					{
+						TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+							Name:      "pod2",
+							Namespace: "default2",
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "List with extra field cannot be streamed",
+			in: &ListWithAdditionalFields{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{},
+			},
+			cannotStream: true,
+		},
+		{
+			// A cbor struct tag takes precedence over json in the CBOR encoder, so
+			// the streaming encoder (which follows the json tags) must not claim
+			// this type; it falls back to the general encoder, which renames the
+			// items key to "elements".
+			name: "List with cbor tag cannot be streamed",
+			in: &ListWithCBORTagList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				Items: []testapigroupv1.Carp{
+					{ObjectMeta: metav1.ObjectMeta{Name: "pod"}},
+				},
+			},
+			cannotStream: true,
+		},
+		{
+			name: "Not a collection cannot be streamed",
+			in: &testapigroupv1.Carp{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+			},
+			cannotStream: true,
+		},
+		{
+			name: "UnstructuredList empty",
+			in:   &unstructured.UnstructuredList{},
+		},
+		{
+			name: "UnstructuredList just kind",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"kind": "List"},
+			},
+		},
+		{
+			name: "UnstructuredList just apiVersion",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"apiVersion": "v1"},
+			},
+		},
+		{
+			name: "UnstructuredList no elements",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"kind": "List", "apiVersion": "v1", "metadata": map[string]interface{}{"resourceVersion": "2345"},
+				},
+				Items: []unstructured.Unstructured{},
+			},
+		},
+		{
+			name: "UnstructuredList one element with continue",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"kind": "List", "apiVersion": "v1", "metadata": map[string]interface{}{
+						"resourceVersion":    "2345",
+						"continue":           "abc",
+						"remainingItemCount": "1",
+					},
+				},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "Carp",
+							"metadata": map[string]interface{}{
+								"name":      "pod",
+								"namespace": "default",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList two elements",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"kind": "List", "apiVersion": "v1", "metadata": map[string]interface{}{
+						"resourceVersion": "2345",
+					},
+				},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "Carp",
+							"metadata": map[string]interface{}{
+								"name":      "pod",
+								"namespace": "default",
+							},
+						},
+					},
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "Carp",
+							"metadata": map[string]interface{}{
+								"name":      "pod2",
+								"namespace": "default",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList conflict on items",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"items": []unstructured.Unstructured{
+						{
+							Object: map[string]interface{}{
+								"name": "pod",
+							},
+						},
+					},
+				},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"name": "pod2",
+						},
+					},
+				},
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			buf.Reset()
+			s := NewSerializer(nil, nil, StreamingCollectionsEncoding(true))
+			if err := s.Encode(tc.in, &buf); err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			var normalBuf bytes.Buffer
+			normalS := NewSerializer(nil, nil, StreamingCollectionsEncoding(false))
+			if err := normalS.Encode(tc.in, &normalBuf); err != nil {
+				t.Fatalf("normal encode error: %v", err)
+			}
+
+			if diff := cmp.Diff(buf.Bytes(), normalBuf.Bytes()); diff != "" {
+				t.Errorf("streaming and normal encoding differ:\n%s", diff)
+			}
+
+			expectStreaming := !tc.cannotStream
+			if expectStreaming && buf.writeCount <= 2 {
+				t.Errorf("expected streaming but Write was called only: %d", buf.writeCount)
+			}
+			if !expectStreaming && buf.writeCount > 2 {
+				t.Errorf("expected non-streaming but Write was called more than once: %d", buf.writeCount)
+			}
+		})
+	}
+}
+
+type StructWithFloatsList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithFloats `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *StructWithFloatsList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithFloats struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	Int     int
+	Float32 float32
+	Float64 float64
+}
+
+func (s *StructWithFloats) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithDuplicatedTagsList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithDuplicatedTags `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *StructWithDuplicatedTagsList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithDuplicatedTags struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	Key1 string `json:"key"`
+	Key2 string `json:"key"` //nolint:govet
+}
+
+func (s *StructWithDuplicatedTags) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type ListWithMarshalJSONList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []string `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *ListWithMarshalJSONList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *ListWithMarshalJSONList) MarshalJSON() ([]byte, error) {
+	return []byte(`"marshallJSON"`), nil
+}
+
+type StructWithMarshalJSONList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithMarshalJSON `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *StructWithMarshalJSONList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithMarshalJSON struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+}
+
+func (l *StructWithMarshalJSON) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *StructWithMarshalJSON) MarshalJSON() ([]byte, error) {
+	return []byte(`"marshallJSON"`), nil
+}
+
+type ListWithMarshalCBORList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []string `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *ListWithMarshalCBORList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *ListWithMarshalCBORList) MarshalCBOR() ([]byte, error) {
+	return []byte("\x6bmarshalCBOR"), nil
+}
+
+type StructWithMarshalCBORList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithMarshalCBOR `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *StructWithMarshalCBORList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithMarshalCBOR struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+}
+
+func (l *StructWithMarshalCBOR) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *StructWithMarshalCBOR) MarshalCBOR() ([]byte, error) {
+	return []byte("\x6bmarshalCBOR"), nil
+}
+
+type ListWithBothMarshalersList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []string `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *ListWithBothMarshalersList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *ListWithBothMarshalersList) MarshalJSON() ([]byte, error) {
+	return []byte(`"marshalJSON"`), nil
+}
+
+func (l *ListWithBothMarshalersList) MarshalCBOR() ([]byte, error) {
+	return []byte("\x6bmarshalCBOR"), nil
+}
+
+type StructWithBothMarshalersList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithBothMarshalers `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *StructWithBothMarshalersList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithBothMarshalers struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+}
+
+func (l *StructWithBothMarshalers) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *StructWithBothMarshalers) MarshalJSON() ([]byte, error) {
+	return []byte(`"marshalJSON"`), nil
+}
+
+func (l *StructWithBothMarshalers) MarshalCBOR() ([]byte, error) {
+	return []byte("\x6bmarshalCBOR"), nil
+}
+
+type StructWithRawBytesList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithRawBytes `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *StructWithRawBytesList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithRawBytes struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Slice             []byte
+	Array             [3]byte
+}
+
+func (s *StructWithRawBytes) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type ListWithAdditionalFields struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []testapigroupv1.Carp `json:"items" protobuf:"bytes,2,rep,name=items"`
+	AdditionalField int
+}
+
+func (s *ListWithAdditionalFields) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+// ListWithCBORTagList has a valid json-tagged shape but a cbor struct tag on
+// Items that renames its key. Because the CBOR encoder prefers the cbor tag over
+// json, getListMeta must refuse to stream this type.
+type ListWithCBORTagList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []testapigroupv1.Carp `json:"items" cbor:"elements" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *ListWithCBORTagList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type writeCountingBuffer struct {
+	writeCount int
+	bytes.Buffer
+}
+
+func (b *writeCountingBuffer) Write(data []byte) (int, error) {
+	b.writeCount++
+	return b.Buffer.Write(data)
+}
+
+func (b *writeCountingBuffer) Reset() {
+	b.writeCount = 0
+	b.Buffer.Reset()
+}
+
+func TestFuzzCollectionsEncoding(t *testing.T) {
+	disableFuzzFieldsV1 := func(field *metav1.FieldsV1, c randfill.Continue) {}
+	fuzzUnstructuredList := func(list *unstructured.UnstructuredList, c randfill.Continue) {
+		list.Object = map[string]interface{}{
+			"kind":       "List",
+			"apiVersion": "v1",
+			c.String(0):  c.String(0),
+			c.String(0):  int64(c.Intn(1000000)), // Limit to int64 range
+			c.String(0):  c.Bool(),
+			"metadata": map[string]interface{}{
+				"resourceVersion":    fmt.Sprintf("%d", c.Intn(1000000)), // String format
+				"continue":           c.String(0),
+				"remainingItemCount": fmt.Sprintf("%d", c.Intn(1000000)), // String format
+				c.String(0):          c.String(0),
+			},
+		}
+		c.Fill(&list.Items)
+	}
+	fuzzMap := func(kvs map[string]interface{}, c randfill.Continue) {
+		kvs[c.String(0)] = c.Bool()
+		kvs[c.String(0)] = int64(c.Intn(1000000)) // Limit to int64 range
+		kvs[c.String(0)] = c.String(0)
+	}
+	f := randfill.New().Funcs(disableFuzzFieldsV1, fuzzUnstructuredList, fuzzMap)
+	streamingSerializer := NewSerializer(nil, nil)
+	normalSerializer := NewSerializer(nil, nil, StreamingCollectionsEncoding(false))
+
+	for _, tc := range []struct {
+		name   string
+		newObj func() runtime.Object
+	}{
+		{name: "CarpList", newObj: func() runtime.Object { return &testapigroupv1.CarpList{} }},
+		{name: "UnstructuredList", newObj: func() runtime.Object { return &unstructured.UnstructuredList{} }},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var streamingBuf writeCountingBuffer
+			var normalBuf, ndetBuf bytes.Buffer
+			for i := range 1000 {
+				obj := tc.newObj()
+				f.Fill(obj)
+
+				// Non-streaming, deterministic encode as the reference for all comparisons.
+				normalBuf.Reset()
+				if err := normalSerializer.Encode(obj, &normalBuf); err != nil {
+					t.Fatalf("trial %d: normal encode error: %v", i, err)
+				}
+
+				// Streaming deterministic encode must match the reference byte-for-byte.
+				streamingBuf.Reset()
+				if err := streamingSerializer.Encode(obj, &streamingBuf); err != nil {
+					t.Fatalf("trial %d: streaming encode error: %v", i, err)
+				}
+				if diff := cmp.Diff(normalBuf.Bytes(), streamingBuf.Bytes()); diff != "" {
+					t.Logf("normal:    %x", normalBuf.Bytes())
+					t.Logf("streaming: %x", streamingBuf.Bytes())
+					t.Fatalf("trial %d: streaming and non-streaming differ:\n%s", i, diff)
+				}
+				if streamingBuf.writeCount <= 2 {
+					t.Errorf("trial %d: expected streaming encoding to use more than 2 writes, got %d", i, streamingBuf.writeCount)
+				}
+
+				// Streaming nondeterministic encode must decode to the same value.
+				ndetBuf.Reset()
+				if err := streamingSerializer.EncodeNondeterministic(obj, &ndetBuf); err != nil {
+					t.Fatalf("trial %d: nondeterministic encode error: %v", i, err)
+				}
+
+				var detObj, ndetObj interface{}
+				if err := modes.Decode.Unmarshal(normalBuf.Bytes(), &detObj); err != nil {
+					t.Fatalf("trial %d: decode deterministic: %v", i, err)
+				}
+				if err := modes.Decode.Unmarshal(ndetBuf.Bytes(), &ndetObj); err != nil {
+					t.Fatalf("trial %d: decode nondeterministic: %v", i, err)
+				}
+				if diff := cmp.Diff(detObj, ndetObj); diff != "" {
+					t.Errorf("trial %d: semantic mismatch between deterministic and nondeterministic:\n%s", i, diff)
+				}
+
+				detTyped := reflect.New(reflect.TypeOf(obj).Elem()).Interface()
+				ndetTyped := reflect.New(reflect.TypeOf(obj).Elem()).Interface()
+				if err := modes.Decode.Unmarshal(normalBuf.Bytes(), detTyped); err != nil {
+					t.Fatalf("trial %d: decode deterministic into %T: %v", i, obj, err)
+				}
+				if err := modes.Decode.Unmarshal(ndetBuf.Bytes(), ndetTyped); err != nil {
+					t.Fatalf("trial %d: decode nondeterministic into %T: %v", i, obj, err)
+				}
+				if !apiequality.Semantic.DeepEqual(detTyped, ndetTyped) {
+					t.Errorf("trial %d: typed %T mismatch between deterministic and nondeterministic encodings", i, obj)
+				}
+			}
+		})
+	}
+}
+
+// mustCBORSelfDescribed encodes v to CBOR and prepends the self-described CBOR
+// tag (0xd9d9f7), matching how runtime.RawExtension stores CBOR-content bytes.
+func mustCBORSelfDescribed(t *testing.T, v interface{}) []byte {
+	t.Helper()
+	data, err := modes.Encode.Marshal(v)
+	if err != nil {
+		t.Fatalf("failed to marshal %#v to CBOR: %v", v, err)
+	}
+	return append([]byte{0xd9, 0xd9, 0xf7}, data...)
+}
+
+// TestStreamEncodeListRawExtension is a regression test for streaming encoding of
+// a metav1.List whose Items are runtime.RawExtension. Streaming encoding must be
+// byte-identical to non-streaming encoding, and must round-trip.
+//
+// Previously the streaming path routed items through meta.ExtractList, which
+// flattens a RawExtension holding raw bytes into a runtime.Unknown (dropping its
+// content type). runtime.Unknown implements MarshalJSON but not MarshalCBOR, so
+// CBOR-content bytes were either misencoded as a struct or, worse, failed while
+// the encoder attempted to transcode them from JSON. The streaming path now
+// marshals each RawExtension directly, honoring runtime.RawExtension.MarshalCBOR.
+func TestStreamEncodeListRawExtension(t *testing.T) {
+	streamingSerializer := NewSerializer(nil, nil)
+	normalSerializer := NewSerializer(nil, nil, StreamingCollectionsEncoding(false))
+
+	for _, tc := range []struct {
+		name string
+		// nonEmpty indicates Items encodes as a non-empty array (should stream).
+		nonEmpty bool
+		// roundTrips indicates decoding the output reproduces the input exactly.
+		// Only holds for CBOR-content RawExtension: decoding normalizes JSON bytes
+		// and populated Objects into CBOR Raw bytes.
+		roundTrips bool
+		items      []runtime.RawExtension
+	}{
+		{
+			name:       "RawExtension with CBOR bytes",
+			nonEmpty:   true,
+			roundTrips: true,
+			items: []runtime.RawExtension{
+				{Raw: mustCBORSelfDescribed(t, map[string]interface{}{"foo": "bar"})},
+				{Raw: mustCBORSelfDescribed(t, map[string]interface{}{"baz": int64(1)})},
+			},
+		},
+		{
+			name:     "RawExtension with JSON bytes",
+			nonEmpty: true,
+			items: []runtime.RawExtension{
+				{Raw: []byte(`{"foo":"bar"}`)},
+			},
+		},
+		{
+			name:     "RawExtension with Object",
+			nonEmpty: true,
+			items: []runtime.RawExtension{
+				{Object: &testapigroupv1.Carp{ObjectMeta: metav1.ObjectMeta{Name: "carp"}}},
+			},
+		},
+		{
+			name:  "RawExtension items empty",
+			items: []runtime.RawExtension{},
+		},
+		{
+			name:  "RawExtension items nil",
+			items: nil,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			in := &metav1.List{
+				TypeMeta: metav1.TypeMeta{Kind: "List", APIVersion: "v1"},
+				ListMeta: metav1.ListMeta{ResourceVersion: "42"},
+				Items:    tc.items,
+			}
+
+			var streamingBuf writeCountingBuffer
+			if err := streamingSerializer.Encode(in, &streamingBuf); err != nil {
+				t.Fatalf("streaming encode error: %v", err)
+			}
+
+			var normalBuf bytes.Buffer
+			if err := normalSerializer.Encode(in, &normalBuf); err != nil {
+				t.Fatalf("normal encode error: %v", err)
+			}
+
+			if diff := cmp.Diff(normalBuf.Bytes(), streamingBuf.Bytes()); diff != "" {
+				t.Logf("normal:    %x", normalBuf.Bytes())
+				t.Logf("streaming: %x", streamingBuf.Bytes())
+				t.Errorf("streaming output differs from normal encoding:\n%s", diff)
+			}
+
+			// Non-empty lists should exercise the streaming path (more than the
+			// map-head + items-key writes).
+			if tc.nonEmpty && streamingBuf.writeCount <= 2 {
+				t.Errorf("expected streaming encoding to use more than 2 writes, got %d", streamingBuf.writeCount)
+			}
+
+			// Round-trip: decoding the streamed bytes must reproduce the input
+			// for CBOR-content items (see roundTrips doc above).
+			if tc.roundTrips {
+				out := &metav1.List{}
+				if err := modes.Decode.Unmarshal(streamingBuf.Bytes(), out); err != nil {
+					t.Fatalf("decode error: %v", err)
+				}
+				if !apiequality.Semantic.DeepEqual(in, out) {
+					t.Errorf("round-trip mismatch:\n%s", cmp.Diff(in, out))
+				}
+			}
+		})
+	}
+}
+
+// TestStreamEncodeCollectionsDeterministic verifies that the streaming serializer
+// produces output identical to the normal non-streaming serializer.
+func TestStreamEncodeCollectionsDeterministic(t *testing.T) {
+	streamingSerializer := NewSerializer(nil, nil)
+	normalSerializer := NewSerializer(nil, nil, StreamingCollectionsEncoding(false))
+
+	for _, tc := range []struct {
+		name string
+		in   runtime.Object
+	}{
+		{
+			name: "CarpList with all top-level fields",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "CarpList",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "42",
+				},
+				Items: []testapigroupv1.Carp{
+					{ObjectMeta: metav1.ObjectMeta{Name: "a"}},
+					{ObjectMeta: metav1.ObjectMeta{Name: "b"}},
+					{ObjectMeta: metav1.ObjectMeta{Name: "c"}},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList with all top-level fields",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"kind":       "List",
+					"apiVersion": "v1",
+					"metadata":   map[string]interface{}{"resourceVersion": "42"},
+				},
+				Items: []unstructured.Unstructured{
+					{Object: map[string]interface{}{"name": "a"}},
+					{Object: map[string]interface{}{"name": "b"}},
+					{Object: map[string]interface{}{"name": "b"}},
+				},
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			// Encode with streaming enabled.
+			var streamingBuf writeCountingBuffer
+			if err := streamingSerializer.Encode(tc.in, &streamingBuf); err != nil {
+				t.Fatalf("streaming encode error: %v", err)
+			}
+
+			// Encode with normal non-streaming encoder.
+			var normalBuf bytes.Buffer
+			if err := normalSerializer.Encode(tc.in, &normalBuf); err != nil {
+				t.Fatalf("normal encode error: %v", err)
+			}
+
+			// Output must be identical.
+			if diff := cmp.Diff(normalBuf.Bytes(), streamingBuf.Bytes()); diff != "" {
+				t.Logf("normal: %x", normalBuf.Bytes())
+				t.Logf("streaming: %x", streamingBuf.Bytes())
+				t.Errorf("streaming output differs from normal encoding:\n%s", diff)
+			}
+
+			if streamingBuf.writeCount <= 2 {
+				t.Errorf("expected streaming encoding to use more than 2 writes, got %d", streamingBuf.writeCount)
+			}
+		})
+	}
+}
+
+// TestStreamEncodeCollectionsNondeterministic verifies that the streaming serializer's
+// EncodeNondeterministic method:
+//  1. Semantic correctness: the output decodes to the same object as deterministic encoding.
+//  2. Non-idempotence: across multiple trials the key order is observed to vary
+//     (probabilistic; uses a multi-key object to make the probability of flake negligible).
+func TestStreamEncodeCollectionsNondeterministic(t *testing.T) {
+	streamingSerializer := NewSerializer(nil, nil)
+	normalSerializer := NewSerializer(nil, nil, StreamingCollectionsEncoding(false))
+
+	// A list with kind+apiVersion+metadata+items = 4 keys.
+	// With SortFastShuffle the number of possible orderings is 4! = 24.
+	// Over 200 trials the probability of seeing only 1 unique ordering is (1/24)^199 ≈ 0.
+	const nTrials = 200
+
+	for _, tc := range []struct {
+		name string
+		in   runtime.Object
+	}{
+		{
+			name: "CarpList",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "CarpList",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "42",
+				},
+				Items: []testapigroupv1.Carp{
+					{ObjectMeta: metav1.ObjectMeta{Name: "a"}},
+					{ObjectMeta: metav1.ObjectMeta{Name: "b"}},
+					{ObjectMeta: metav1.ObjectMeta{Name: "c"}},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"kind":       "List",
+					"apiVersion": "v1",
+					"metadata":   map[string]interface{}{"resourceVersion": "42"},
+				},
+				Items: []unstructured.Unstructured{
+					{Object: map[string]interface{}{"name": "a"}},
+					{Object: map[string]interface{}{"name": "b"}},
+					{Object: map[string]interface{}{"name": "c"}},
+				},
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			// Encode once with non-streaming, deterministic mode as reference for semantic equality.
+			var detBuf bytes.Buffer
+			if err := normalSerializer.Encode(tc.in, &detBuf); err != nil {
+				t.Fatalf("deterministic encode error: %v", err)
+			}
+			var detObj map[string]interface{}
+			if err := modes.Decode.Unmarshal(detBuf.Bytes(), &detObj); err != nil {
+				t.Fatalf("decode deterministic output: %v", err)
+			}
+			detTyped := reflect.New(reflect.TypeOf(tc.in).Elem()).Interface()
+			if err := modes.Decode.Unmarshal(detBuf.Bytes(), detTyped); err != nil {
+				t.Fatalf("decode deterministic output into %T: %v", tc.in, err)
+			}
+
+			// Run nTrials of nondeterministic encoding, stopping early once we
+			// observe a second distinct byte sequence.
+			var firstEncoding string
+			for i := range nTrials {
+				var buf writeCountingBuffer
+				if err := streamingSerializer.EncodeNondeterministic(tc.in, &buf); err != nil {
+					t.Fatalf("trial %d: nondeterministic encode error: %v", i, err)
+				}
+				payload := buf.Bytes()
+
+				// Semantic correctness: decoded value must equal the deterministic reference.
+				var ndetObj map[string]interface{}
+				if err := modes.Decode.Unmarshal(payload, &ndetObj); err != nil {
+					t.Fatalf("trial %d: decode nondeterministic output: %v", i, err)
+				}
+				if diff := cmp.Diff(detObj, ndetObj); diff != "" {
+					t.Errorf("trial %d: semantic mismatch between deterministic and nondeterministic:\n%s", i, diff)
+				}
+
+				ndetTyped := reflect.New(reflect.TypeOf(tc.in).Elem()).Interface()
+				if err := modes.Decode.Unmarshal(payload, ndetTyped); err != nil {
+					t.Fatalf("trial %d: decode nondeterministic output into %T: %v", i, tc.in, err)
+				}
+				if !apiequality.Semantic.DeepEqual(detTyped, ndetTyped) {
+					t.Errorf("trial %d: typed %T mismatch between deterministic and nondeterministic encodings", i, tc.in)
+				}
+
+				if buf.writeCount <= 2 {
+					t.Errorf("trial %d: expected streaming encoding to use more than 2 writes, got %d", i, buf.writeCount)
+				}
+
+				enc := string(payload)
+				if i == 0 {
+					firstEncoding = enc
+				} else if enc != firstEncoding {
+					return
+				}
+			}
+
+			t.Errorf("nondeterministic encoding produced only 1 unique byte sequence over %d trials; expected varied output", nTrials)
+		})
+	}
+}
+
+// TestCollectionHeadMatchesLibrary verifies that writeArrayHead and writeMapHead
+// produce byte-identical output to the fxamacker/cbor library's own head encoding
+// at every length-encoding width boundary (and its neighbors) reachable by
+// allocating a real collection. The library encodes an n-element array/map with a
+// leading definite-length head, so our streamed head must equal that prefix.
+//
+// The reachable sizes exercise the 1-, 2-, 3-, and 5-byte argument forms (the last
+// at n=65536). The 8-byte form (n > 2^32) cannot be produced by allocation and is
+// covered against explicit RFC 8949 bytes by TestWriteCollectionHeadBoundaries.
+func TestCollectionHeadMatchesLibrary(t *testing.T) {
+	// Width-class boundaries and neighbors:
+	//   n <= 23           -> 1-byte head
+	//   24    <= n <= 255 -> 2-byte head
+	//   256   <= n <= 65535 -> 3-byte head
+	//   65536 <= n        -> 5-byte head
+	sizes := []int{0, 1, 23, 24, 25, 255, 256, 257, 65535, 65536, 65537}
+
+	assertPrefix := func(t *testing.T, kind string, n int, head, lib []byte) {
+		t.Helper()
+		end := min(len(head), len(lib))
+		if !bytes.Equal(head, lib[:end]) {
+			t.Errorf("%s head mismatch for n=%d:\n  ours:    % x\n  library: % x", kind, n, head, lib[:min(len(lib), len(head)+4)])
+		}
+	}
+
+	for _, n := range sizes {
+		t.Run(fmt.Sprintf("array/%d", n), func(t *testing.T) {
+			var head bytes.Buffer
+			if err := writeArrayHead(&head, n); err != nil {
+				t.Fatalf("writeArrayHead(%d): %v", n, err)
+			}
+			lib, err := modes.Encode.Marshal(make([]bool, n))
+			if err != nil {
+				t.Fatalf("library marshal []bool len %d: %v", n, err)
+			}
+			assertPrefix(t, "array", n, head.Bytes(), lib)
+		})
+		t.Run(fmt.Sprintf("map/%d", n), func(t *testing.T) {
+			var head bytes.Buffer
+			if err := writeMapHead(&head, n); err != nil {
+				t.Fatalf("writeMapHead(%d): %v", n, err)
+			}
+			m := make(map[int64]bool, n)
+			for i := range n {
+				m[int64(i)] = false
+			}
+			lib, err := modes.Encode.Marshal(m)
+			if err != nil {
+				t.Fatalf("library marshal map len %d: %v", n, err)
+			}
+			assertPrefix(t, "map", n, head.Bytes(), lib)
+		})
+	}
+}
+
+// TestWriteCollectionHeadBoundaries checks writeCollectionHead against explicit
+// RFC 8949 Section 3 expected bytes at every additional-information width boundary
+// and its neighbors, for both the array (0x80) and map (0xa0) major types. Unlike
+// TestCollectionHeadMatchesLibrary, this calls writeCollectionHead directly, so it
+// can cover the 8-byte argument form (n > 2^32) that no allocatable collection can
+// reach.
+func TestWriteCollectionHeadBoundaries(t *testing.T) {
+	for _, tc := range []struct {
+		n     int64
+		array []byte
+		mp    []byte
+	}{
+		{n: 0, array: []byte{0x80}, mp: []byte{0xa0}},
+		{n: 1, array: []byte{0x81}, mp: []byte{0xa1}},
+		{n: 23, array: []byte{0x97}, mp: []byte{0xb7}},                                                                                                            // max 1-byte
+		{n: 24, array: []byte{0x98, 0x18}, mp: []byte{0xb8, 0x18}},                                                                                                // min 2-byte
+		{n: 255, array: []byte{0x98, 0xff}, mp: []byte{0xb8, 0xff}},                                                                                               // max 2-byte
+		{n: 256, array: []byte{0x99, 0x01, 0x00}, mp: []byte{0xb9, 0x01, 0x00}},                                                                                   // min 3-byte
+		{n: 65535, array: []byte{0x99, 0xff, 0xff}, mp: []byte{0xb9, 0xff, 0xff}},                                                                                 // max 3-byte
+		{n: 65536, array: []byte{0x9a, 0x00, 0x01, 0x00, 0x00}, mp: []byte{0xba, 0x00, 0x01, 0x00, 0x00}},                                                         // min 5-byte
+		{n: 4294967295, array: []byte{0x9a, 0xff, 0xff, 0xff, 0xff}, mp: []byte{0xba, 0xff, 0xff, 0xff, 0xff}},                                                    // max 5-byte (2^32-1)
+		{n: 4294967296, array: []byte{0x9b, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00}, mp: []byte{0xbb, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00}},    // min 9-byte (2^32)
+		{n: 1099511627775, array: []byte{0x9b, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff}, mp: []byte{0xbb, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff}}, // 0xFFFFFFFFFF
+	} {
+		t.Run(fmt.Sprintf("array/%d", tc.n), func(t *testing.T) {
+			var buf bytes.Buffer
+			if err := writeCollectionHead(&buf, cborTypeArray, tc.n); err != nil {
+				t.Fatalf("writeCollectionHead: %v", err)
+			}
+			if !bytes.Equal(buf.Bytes(), tc.array) {
+				t.Errorf("n=%d: got % x, want % x", tc.n, buf.Bytes(), tc.array)
+			}
+		})
+		t.Run(fmt.Sprintf("map/%d", tc.n), func(t *testing.T) {
+			var buf bytes.Buffer
+			if err := writeCollectionHead(&buf, cborTypeMap, tc.n); err != nil {
+				t.Fatalf("writeCollectionHead: %v", err)
+			}
+			if !bytes.Equal(buf.Bytes(), tc.mp) {
+				t.Errorf("n=%d: got % x, want % x", tc.n, buf.Bytes(), tc.mp)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct/direct.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct/direct.go
new file mode 100644
index 0000000000..945dc47c14
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct/direct.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package direct provides functions for marshaling and unmarshaling between arbitrary Go values and
+// CBOR data, with behavior that is compatible with that of the CBOR serializer. In particular,
+// types that implement cbor.Marshaler and cbor.Unmarshaler should use these functions.
+package direct
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+)
+
+// Marshal serializes a value to CBOR. If there is more than one way to encode the value, it will
+// make the same choice as the CBOR implementation of runtime.Serializer.
+func Marshal(src any) ([]byte, error) {
+	return modes.Encode.Marshal(src)
+}
+
+// Unmarshal deserializes from CBOR into an addressable value. If there is more than one way to
+// unmarshal a value, it will make the same choice as the CBOR implementation of runtime.Serializer.
+func Unmarshal(src []byte, dst any) error {
+	return modes.Decode.Unmarshal(src, dst)
+}
+
+// Diagnose accepts well-formed CBOR bytes and returns a string representing the same data item in
+// human-readable diagnostic notation (RFC 8949 Section 8). The diagnostic notation is not meant to
+// be parsed.
+func Diagnose(src []byte) (string, error) {
+	return modes.Diagnostic.Diagnose(src)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/framer.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/framer.go
new file mode 100644
index 0000000000..28a733c673
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/framer.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cbor
+
+import (
+	"io"
+
+	"k8s.io/apimachinery/pkg/runtime"
+
+	"github.com/fxamacker/cbor/v2"
+)
+
+// NewFramer returns a runtime.Framer based on RFC 8742 CBOR Sequences. Each frame contains exactly
+// one encoded CBOR data item.
+func NewFramer() runtime.Framer {
+	return framer{}
+}
+
+var _ runtime.Framer = framer{}
+
+type framer struct{}
+
+func (framer) NewFrameReader(rc io.ReadCloser) io.ReadCloser {
+	return &frameReader{
+		decoder: cbor.NewDecoder(rc),
+		closer:  rc,
+	}
+}
+
+func (framer) NewFrameWriter(w io.Writer) io.Writer {
+	// Each data item in a CBOR sequence is self-delimiting (like JSON objects).
+	return w
+}
+
+type frameReader struct {
+	decoder *cbor.Decoder
+	closer  io.Closer
+
+	overflow []byte
+}
+
+func (fr *frameReader) Read(dst []byte) (int, error) {
+	if len(fr.overflow) > 0 {
+		// We read a frame that was too large for the destination slice in a previous call
+		// to Read and have bytes left over.
+		n := copy(dst, fr.overflow)
+		if n < len(fr.overflow) {
+			fr.overflow = fr.overflow[n:]
+			return n, io.ErrShortBuffer
+		}
+		fr.overflow = nil
+		return n, nil
+	}
+
+	// The Reader contract allows implementations to use all of dst[0:len(dst)] as scratch
+	// space, even if n < len(dst), but it does not allow implementations to use
+	// dst[len(dst):cap(dst)]. Slicing it up-front allows us to append to it without worrying
+	// about overwriting dst[len(dst):cap(dst)].
+	m := cbor.RawMessage(dst[0:0:len(dst)])
+	if err := fr.decoder.Decode(&m); err != nil {
+		return 0, err
+	}
+
+	if len(m) > len(dst) {
+		// The frame was too big, m has a newly-allocated underlying array to accommodate
+		// it.
+		fr.overflow = m[len(dst):]
+		return copy(dst, m), io.ErrShortBuffer
+	}
+
+	return len(m), nil
+}
+
+func (fr *frameReader) Close() error {
+	return fr.closer.Close()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/framer_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/framer_test.go
new file mode 100644
index 0000000000..05676a1a8d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/framer_test.go
@@ -0,0 +1,147 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cbor_test
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+// TestFrameReaderReadError tests that the frame reader does not resume after encountering a
+// well-formedness error in the input stream. According to RFC 8742 Section 2.8: "[...] if any data
+// item in the sequence is not well formed, it is not possible to reliably decode the rest of the
+// sequence."
+func TestFrameReaderReadError(t *testing.T) {
+	input := []byte{
+		0xff, // ill-formed initial break
+		0xa0, // followed by well-formed empty map
+	}
+	fr := cbor.NewFramer().NewFrameReader(io.NopCloser(bytes.NewReader(input)))
+	for i := 0; i < 3; i++ {
+		n, err := fr.Read(nil)
+		if err == nil || errors.Is(err, io.ErrShortBuffer) {
+			t.Fatalf("expected a non-nil error other than io.ErrShortBuffer, got: %v", err)
+		}
+		if n != 0 {
+			t.Fatalf("expected 0 bytes read on error, got %d", n)
+		}
+	}
+}
+
+func TestFrameReaderRead(t *testing.T) {
+	type ChunkedFrame [][]byte
+
+	for _, tc := range []struct {
+		Name   string
+		Frames []ChunkedFrame
+	}{
+		{
+			Name: "consecutive frames",
+			Frames: []ChunkedFrame{
+				[][]byte{{0xa0}},
+				[][]byte{{0xa0}},
+			},
+		},
+		{
+			Name: "zero-length destination buffer",
+			Frames: []ChunkedFrame{
+				[][]byte{{}, {0xa0}},
+			},
+		},
+		{
+			Name: "overflow",
+			Frames: []ChunkedFrame{
+				[][]byte{
+					{0x43},
+					{'x'},
+					{'y', 'z'},
+				},
+				[][]byte{
+					{0xa1, 0x43, 'f', 'o', 'o'},
+					{'b'},
+					{'a', 'r'},
+				},
+			},
+		},
+	} {
+		t.Run(tc.Name, func(t *testing.T) {
+			var concatenation []byte
+			for _, f := range tc.Frames {
+				for _, c := range f {
+					concatenation = append(concatenation, c...)
+				}
+			}
+
+			fr := cbor.NewFramer().NewFrameReader(io.NopCloser(bytes.NewReader(concatenation)))
+
+			for _, frame := range tc.Frames {
+				var want, got []byte
+				for i, chunk := range frame {
+					dst := make([]byte, len(chunk), 2*len(chunk))
+					for i := len(dst); i < cap(dst); i++ {
+						dst[:cap(dst)][i] = 0xff
+					}
+					n, err := fr.Read(dst)
+					if n != len(chunk) {
+						t.Errorf("expected %d bytes read, got %d", len(chunk), n)
+					}
+					if i == len(frame)-1 && err != nil {
+						t.Errorf("unexpected non-nil error on last read of frame: %v", err)
+					} else if i < len(frame)-1 && !errors.Is(err, io.ErrShortBuffer) {
+						t.Errorf("expected io.ErrShortBuffer on all but the last read of a frame, got: %v", err)
+					}
+					for i := len(dst); i < cap(dst); i++ {
+						if dst[:cap(dst)][i] != 0xff {
+							t.Errorf("read mutated underlying array beyond slice length: %#v", dst[len(dst):cap(dst)])
+							break
+						}
+					}
+					want = append(want, chunk...)
+					got = append(got, dst...)
+				}
+				if diff := cmp.Diff(want, got); diff != "" {
+					t.Errorf("reassembled frame differs:\n%s", diff)
+				}
+			}
+		})
+	}
+}
+
+type fakeReadCloser struct {
+	err error
+}
+
+func (rc fakeReadCloser) Read(_ []byte) (int, error) {
+	return 0, nil
+}
+
+func (rc fakeReadCloser) Close() error {
+	return rc.err
+}
+
+func TestFrameReaderClose(t *testing.T) {
+	want := errors.New("test")
+	if got := cbor.NewFramer().NewFrameReader(fakeReadCloser{err: want}).Close(); !errors.Is(got, want) {
+		t.Errorf("got error %v, want %v", got, want)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/appendixa_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/appendixa_test.go
new file mode 100644
index 0000000000..e434b666c8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/appendixa_test.go
@@ -0,0 +1,601 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes_test
+
+import (
+	"encoding/hex"
+	"fmt"
+	"math"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+// TestAppendixA roundtrips the examples of encoded CBOR data items in RFC 8949 Appendix A. For
+// completeness, all examples from the appendix are included, even those those that are rejected by
+// this decoder or are re-encoded to a different sequence of CBOR bytes (with explanation).
+func TestAppendixA(t *testing.T) {
+	hex := func(h string) []byte {
+		b, err := hex.DecodeString(h)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return b
+	}
+
+	eq := conversion.EqualitiesOrDie(
+		// NaN float64 values are always inequal and have multiple representations. RFC 8949
+		// Section 4.2.2 recommends protocols not supporting NaN payloads or signaling NaNs
+		// choose a single representation for all NaN values. For the purposes of this test,
+		// all NaN representations are equivalent.
+		func(a float64, b float64) bool {
+			if math.IsNaN(a) && math.IsNaN(b) {
+				return true
+			}
+			return math.Float64bits(a) == math.Float64bits(b)
+		},
+	)
+
+	const (
+		reasonArrayFixedLength  = "indefinite-length arrays are re-encoded with fixed length"
+		reasonByteString        = "strings are encoded as the byte string major type"
+		reasonMapFixedLength    = "indefinite-length maps are re-encoded with fixed length"
+		reasonMapSorted         = "map entries are sorted"
+		reasonStringFixedLength = "indefinite-length strings are re-encoded with fixed length"
+		reasonTagIgnored        = "unrecognized tag numbers are ignored"
+		reasonTimeToInterface   = "times decode to interface{} as RFC3339 timestamps for JSON interoperability"
+	)
+
+	for _, tc := range []struct {
+		example []byte // example data item
+		decoded interface{}
+		reject  string   // reason the decoder rejects the example
+		encoded []byte   // re-encoded object (only if different from example encoding)
+		reasons []string // reasons for re-encode difference
+	}{
+		{
+			example: hex("00"),
+			decoded: int64(0),
+		},
+		{
+			example: hex("01"),
+			decoded: int64(1),
+		},
+		{
+			example: hex("0a"),
+			decoded: int64(10),
+		},
+		{
+			example: hex("17"),
+			decoded: int64(23),
+		},
+		{
+			example: hex("1818"),
+			decoded: int64(24),
+		},
+		{
+			example: hex("1819"),
+			decoded: int64(25),
+		},
+		{
+			example: hex("1864"),
+			decoded: int64(100),
+		},
+		{
+			example: hex("1903e8"),
+			decoded: int64(1000),
+		},
+		{
+			example: hex("1a000f4240"),
+			decoded: int64(1000000),
+		},
+		{
+			example: hex("1b000000e8d4a51000"),
+			decoded: int64(1000000000000),
+		},
+		{
+			example: hex("1bffffffffffffffff"),
+			reject:  "2^64-1 overflows int64 and falling back to float64 (as with JSON) loses distinction between float and integer",
+		},
+		{
+			example: hex("c249010000000000000000"),
+			reject:  "decoding tagged positive bigint value to interface{} can't reproduce this value without losing distinction between float and integer",
+		},
+		{
+			example: hex("3bffffffffffffffff"),
+			reject:  "-2^64-1 overflows int64 and falling back to float64 (as with JSON) loses distinction between float and integer",
+		},
+		{
+			example: hex("c349010000000000000000"),
+			reject:  "-18446744073709551617 overflows int64 and falling back to float64 (as with JSON) loses distinction between float and integer",
+		},
+		{
+			example: hex("20"),
+			decoded: int64(-1),
+		},
+		{
+			example: hex("29"),
+			decoded: int64(-10),
+		},
+		{
+			example: hex("3863"),
+			decoded: int64(-100),
+		},
+		{
+			example: hex("3903e7"),
+			decoded: int64(-1000),
+		},
+		{
+			example: hex("f90000"),
+			decoded: 0.0,
+		},
+		{
+			example: hex("f98000"),
+			decoded: math.Copysign(0, -1),
+		},
+		{
+			example: hex("f93c00"),
+			decoded: 1.0,
+		},
+		{
+			example: hex("fb3ff199999999999a"),
+			decoded: 1.1,
+		},
+		{
+			example: hex("f93e00"),
+			decoded: 1.5,
+		},
+		{
+			example: hex("f97bff"),
+			decoded: 65504.0,
+		},
+		{
+			example: hex("fa47c35000"),
+			decoded: 100000.0,
+		},
+		{
+			example: hex("fa7f7fffff"),
+			decoded: 3.4028234663852886e+38,
+		},
+		{
+			example: hex("fb7e37e43c8800759c"),
+			decoded: 1.0e+300,
+		},
+		{
+			example: hex("f90001"),
+			decoded: 5.960464477539063e-8,
+		},
+		{
+			example: hex("f90400"),
+			decoded: 0.00006103515625,
+		},
+		{
+			example: hex("f9c400"),
+			decoded: -4.0,
+		},
+		{
+			example: hex("fbc010666666666666"),
+			decoded: -4.1,
+		},
+		{
+			example: hex("f97c00"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("f97e00"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("f9fc00"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("fa7f800000"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("fa7fc00000"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("faff800000"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("fb7ff0000000000000"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("fb7ff8000000000000"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("fbfff0000000000000"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("f4"),
+			decoded: false,
+		},
+		{
+			example: hex("f5"),
+			decoded: true,
+		},
+		{
+			example: hex("f6"),
+			decoded: nil,
+		},
+		{
+			example: hex("f7"),
+			reject:  "only simple values false, true, and null have a clear analog",
+		},
+		{
+			example: hex("f0"),
+			reject:  "only simple values false, true, and null have a clear analog",
+		},
+		{
+			example: hex("f8ff"),
+			reject:  "only simple values false, true, and null have a clear analog",
+		},
+		{
+			example: hex("c074323031332d30332d32315432303a30343a30305a"),
+			decoded: "2013-03-21T20:04:00Z",
+			encoded: hex("54323031332d30332d32315432303a30343a30305a"),
+			reasons: []string{
+				reasonByteString,
+				reasonTimeToInterface,
+			},
+		},
+		{
+			example: hex("c11a514b67b0"),
+			decoded: "2013-03-21T20:04:00Z",
+			encoded: hex("54323031332d30332d32315432303a30343a30305a"),
+			reasons: []string{
+				reasonByteString,
+				reasonTimeToInterface,
+			},
+		},
+		{
+			example: hex("c1fb41d452d9ec200000"),
+			decoded: "2013-03-21T20:04:00.5Z",
+			encoded: hex("56323031332d30332d32315432303a30343a30302e355a"),
+			reasons: []string{
+				reasonByteString,
+				reasonTimeToInterface,
+			},
+		},
+		{
+			example: hex("d74401020304"), // 23(h'01020304')
+			decoded: "01020304",
+			encoded: hex("483031303230333034"), // '01020304'
+			reasons: []string{
+				"decoding a byte string enclosed in an expected later encoding tag into an interface{} value automatically converts to the specified encoding for JSON interoperability",
+			},
+		},
+		{
+			example: hex("d818456449455446"),
+			decoded: "dIETF",
+			encoded: hex("456449455446"),
+			reasons: []string{
+				reasonTagIgnored,
+			},
+		},
+		{
+			example: hex("d82076687474703a2f2f7777772e6578616d706c652e636f6d"),
+			decoded: "http://www.example.com",
+			encoded: hex("56687474703a2f2f7777772e6578616d706c652e636f6d"),
+			reasons: []string{
+				reasonByteString,
+				reasonTagIgnored,
+			},
+		},
+		{
+			example: hex("40"),
+			decoded: "",
+		},
+		{
+			example: hex("4401020304"),
+			decoded: "\x01\x02\x03\x04",
+		},
+		{
+			example: hex("60"),
+			decoded: "",
+			encoded: hex("40"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("6161"),
+			decoded: "a",
+			encoded: hex("4161"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("6449455446"),
+			decoded: "IETF",
+			encoded: hex("4449455446"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("62225c"),
+			decoded: "\"\\",
+			encoded: hex("42225c"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("62c3bc"),
+			decoded: "ü",
+			encoded: hex("42c3bc"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("63e6b0b4"),
+			decoded: "水",
+			encoded: hex("43e6b0b4"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("64f0908591"),
+			decoded: "𐅑",
+			encoded: hex("44f0908591"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("80"),
+			decoded: []interface{}{},
+		},
+		{
+			example: hex("83010203"),
+			decoded: []interface{}{int64(1), int64(2), int64(3)},
+		},
+		{
+			example: hex("8301820203820405"),
+			decoded: []interface{}{int64(1), []interface{}{int64(2), int64(3)}, []interface{}{int64(4), int64(5)}},
+		},
+		{
+			example: hex("98190102030405060708090a0b0c0d0e0f101112131415161718181819"),
+			decoded: []interface{}{int64(1), int64(2), int64(3), int64(4), int64(5), int64(6), int64(7), int64(8), int64(9), int64(10), int64(11), int64(12), int64(13), int64(14), int64(15), int64(16), int64(17), int64(18), int64(19), int64(20), int64(21), int64(22), int64(23), int64(24), int64(25)},
+		},
+		{
+			example: hex("a0"),
+			decoded: map[string]interface{}{},
+		},
+		{
+			example: hex("a201020304"),
+			reject:  "integer map keys don't correspond with field names or unstructured keys",
+		},
+		{
+			example: hex("a26161016162820203"),
+			decoded: map[string]interface{}{
+				"a": int64(1),
+				"b": []interface{}{int64(2), int64(3)},
+			},
+			encoded: hex("a24161014162820203"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("826161a161626163"),
+			decoded: []interface{}{
+				"a",
+				map[string]interface{}{"b": "c"},
+			},
+			encoded: hex("824161a141624163"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("a56161614161626142616361436164614461656145"),
+			decoded: map[string]interface{}{
+				"a": "A",
+				"b": "B",
+				"c": "C",
+				"d": "D",
+				"e": "E",
+			},
+			encoded: hex("a54161414141624142416341434164414441654145"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("5f42010243030405ff"),
+			decoded: "\x01\x02\x03\x04\x05",
+			encoded: hex("450102030405"),
+			reasons: []string{
+				reasonStringFixedLength,
+			},
+		},
+		{
+			example: hex("7f657374726561646d696e67ff"),
+			decoded: "streaming",
+			encoded: hex("4973747265616d696e67"),
+			reasons: []string{
+				reasonByteString,
+				reasonStringFixedLength,
+			},
+		},
+		{
+			example: hex("9fff"),
+			decoded: []interface{}{},
+			encoded: hex("80"),
+			reasons: []string{
+				reasonArrayFixedLength,
+			},
+		},
+		{
+			example: hex("9f018202039f0405ffff"),
+			decoded: []interface{}{
+				int64(1),
+				[]interface{}{int64(2), int64(3)},
+				[]interface{}{int64(4), int64(5)},
+			},
+			encoded: hex("8301820203820405"),
+			reasons: []string{
+				reasonArrayFixedLength,
+			},
+		},
+		{
+			example: hex("9f01820203820405ff"),
+			decoded: []interface{}{
+				int64(1),
+				[]interface{}{int64(2), int64(3)},
+				[]interface{}{int64(4), int64(5)},
+			},
+			encoded: hex("8301820203820405"),
+			reasons: []string{
+				reasonArrayFixedLength,
+			},
+		},
+		{
+			example: hex("83018202039f0405ff"),
+			decoded: []interface{}{
+				int64(1),
+				[]interface{}{int64(2), int64(3)},
+				[]interface{}{int64(4), int64(5)},
+			},
+			encoded: hex("8301820203820405"),
+			reasons: []string{
+				reasonArrayFixedLength,
+			},
+		},
+		{
+			example: hex("83019f0203ff820405"),
+			decoded: []interface{}{
+				int64(1),
+				[]interface{}{int64(2), int64(3)},
+				[]interface{}{int64(4), int64(5)},
+			},
+			encoded: hex("8301820203820405"),
+			reasons: []string{
+				reasonArrayFixedLength,
+			},
+		},
+		{
+			example: hex("9f0102030405060708090a0b0c0d0e0f101112131415161718181819ff"),
+			decoded: []interface{}{
+				int64(1), int64(2), int64(3), int64(4), int64(5),
+				int64(6), int64(7), int64(8), int64(9), int64(10),
+				int64(11), int64(12), int64(13), int64(14), int64(15),
+				int64(16), int64(17), int64(18), int64(19), int64(20),
+				int64(21), int64(22), int64(23), int64(24), int64(25),
+			},
+			encoded: hex("98190102030405060708090a0b0c0d0e0f101112131415161718181819"),
+			reasons: []string{
+				reasonArrayFixedLength,
+			},
+		},
+		{
+			example: hex("bf61610161629f0203ffff"),
+			decoded: map[string]interface{}{
+				"a": int64(1),
+				"b": []interface{}{int64(2), int64(3)},
+			},
+			encoded: hex("a24161014162820203"),
+			reasons: []string{
+				reasonArrayFixedLength,
+				reasonByteString,
+				reasonMapFixedLength,
+			},
+		},
+		{
+			example: hex("826161bf61626163ff"),
+			decoded: []interface{}{"a", map[string]interface{}{"b": "c"}},
+			encoded: hex("824161a141624163"),
+			reasons: []string{
+				reasonByteString,
+				reasonMapFixedLength,
+			},
+		},
+		{
+			example: hex("bf6346756ef563416d7421ff"),
+			decoded: map[string]interface{}{
+				"Amt": int64(-2),
+				"Fun": true,
+			},
+			encoded: hex("a243416d74214346756ef5"),
+			reasons: []string{
+				reasonByteString,
+				reasonMapFixedLength,
+				reasonMapSorted,
+			},
+		},
+	} {
+		t.Run(fmt.Sprintf("%x", tc.example), func(t *testing.T) {
+			var decoded interface{}
+			err := modes.Decode.Unmarshal(tc.example, &decoded)
+			if err != nil {
+				if tc.reject != "" {
+					t.Logf("expected decode error (%s) occurred: %v", tc.reject, err)
+					return
+				}
+				t.Fatalf("unexpected decode error: %v", err)
+			} else if tc.reject != "" {
+				t.Fatalf("expected decode error (%v) did not occur", tc.reject)
+			}
+
+			if !eq.DeepEqual(tc.decoded, decoded) {
+				t.Fatal(cmp.Diff(tc.decoded, decoded))
+			}
+
+			actual, err := modes.Encode.Marshal(decoded)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			expected := tc.example
+			if tc.encoded != nil {
+				expected = tc.encoded
+				if len(tc.reasons) == 0 {
+					t.Fatal("invalid test case: missing reasons for difference between the example encoding and the actual encoding")
+				}
+				diff := cmp.Diff(tc.example, tc.encoded)
+				if diff == "" {
+					t.Fatal("invalid test case: no difference between the example encoding and the expected re-encoding")
+				}
+				t.Logf("expecting the following differences from the example encoding on re-encode:\n%s", diff)
+				t.Logf("reasons for encoding differences:")
+				for _, reason := range tc.reasons {
+					t.Logf("- %s", reason)
+				}
+
+			}
+
+			if diff := cmp.Diff(expected, actual); diff != "" {
+				t.Errorf("re-encoded object differs from expected:\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/buffers.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/buffers.go
new file mode 100644
index 0000000000..f14cbd6b58
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/buffers.go
@@ -0,0 +1,65 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"bytes"
+	"sync"
+)
+
+var buffers = BufferProvider{p: new(sync.Pool)}
+
+type buffer struct {
+	bytes.Buffer
+}
+
+type pool interface {
+	Get() interface{}
+	Put(interface{})
+}
+
+type BufferProvider struct {
+	p pool
+}
+
+func (b *BufferProvider) Get() *buffer {
+	if buf, ok := b.p.Get().(*buffer); ok {
+		return buf
+	}
+	return &buffer{}
+}
+
+func (b *BufferProvider) Put(buf *buffer) {
+	if buf.Cap() > 3*1024*1024 /* Default MaxRequestBodyBytes */ {
+		// Objects in a sync.Pool are assumed to be fungible. This is not a good assumption
+		// for pools of *bytes.Buffer because a *bytes.Buffer's underlying array grows as
+		// needed to accommodate writes. In Kubernetes, apiservers tend to encode "small"
+		// objects very frequently and much larger objects (especially large lists) only
+		// occasionally. Under steady load, pooled buffers tend to be borrowed frequently
+		// enough to prevent them from being released. Over time, each buffer is used to
+		// encode a large object and its capacity increases accordingly. The result is that
+		// practically all buffers in the pool retain much more capacity than needed to
+		// encode most objects.
+
+		// As a basic mitigation for the worst case, buffers with more capacity than the
+		// default max request body size are never returned to the pool.
+		// TODO: Optimize for higher buffer utilization.
+		return
+	}
+	buf.Reset()
+	b.p.Put(buf)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/buffers_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/buffers_test.go
new file mode 100644
index 0000000000..dcc619b199
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/buffers_test.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"testing"
+)
+
+type mockPool struct {
+	v interface{}
+}
+
+func (*mockPool) Get() interface{} {
+	return nil
+}
+
+func (p *mockPool) Put(v interface{}) {
+	p.v = v
+}
+
+func TestBufferProviderPut(t *testing.T) {
+	{
+		p := new(mockPool)
+		bp := &BufferProvider{p: p}
+		small := new(buffer)
+		small.Grow(3 * 1024 * 1024)
+		small.WriteString("hello world")
+		bp.Put(small)
+		if p.v != small {
+			t.Errorf("expected buf with capacity %d to be returned to pool", small.Cap())
+		}
+		if small.Len() != 0 {
+			t.Errorf("expected buf to be reset before returning to pool")
+		}
+	}
+
+	{
+		p := new(mockPool)
+		bp := &BufferProvider{p: p}
+		big := new(buffer)
+		big.Grow(3*1024*1024 + 1)
+		bp.Put(big)
+		if p.v != nil {
+			t.Errorf("expected buf with capacity %d not to be returned to pool", big.Cap())
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode.go
new file mode 100644
index 0000000000..4a7055c10f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode.go
@@ -0,0 +1,184 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"reflect"
+
+	"github.com/fxamacker/cbor/v2"
+)
+
+var simpleValues *cbor.SimpleValueRegistry = func() *cbor.SimpleValueRegistry {
+	var opts []func(*cbor.SimpleValueRegistry) error
+	for sv := 0; sv <= 255; sv++ {
+		// Reject simple values 0-19, 23, and 32-255. The simple values 24-31 are reserved
+		// and considered ill-formed by the CBOR specification. We only accept false (20),
+		// true (21), and null (22).
+		switch sv {
+		case 20: // false
+		case 21: // true
+		case 22: // null
+		case 24, 25, 26, 27, 28, 29, 30, 31: // reserved
+		default:
+			opts = append(opts, cbor.WithRejectedSimpleValue(cbor.SimpleValue(sv)))
+		}
+	}
+	simpleValues, err := cbor.NewSimpleValueRegistryFromDefaults(opts...)
+	if err != nil {
+		panic(err)
+	}
+	return simpleValues
+}()
+
+// decode is the basis for the Decode mode, with no JSONUnmarshalerTranscoder
+// configured. TranscodeToJSON uses this directly rather than Decode to avoid an initialization
+// cycle between the two. Everything else should use one of the exported DecModes.
+var decode cbor.DecMode = func() cbor.DecMode {
+	decode, err := cbor.DecOptions{
+		// Maps with duplicate keys are well-formed but invalid according to the CBOR spec
+		// and never acceptable. Unlike the JSON serializer, inputs containing duplicate map
+		// keys are rejected outright and not surfaced as a strict decoding error.
+		DupMapKey: cbor.DupMapKeyEnforcedAPF,
+
+		// For JSON parity, decoding an RFC3339 string into time.Time needs to be accepted
+		// with or without tagging. If a tag number is present, it must be valid.
+		TimeTag: cbor.DecTagOptional,
+
+		// MaxNestedLevels is set to the same value used in the JSON implementation.
+		MaxNestedLevels: 10000,
+
+		// MaxArrayElements is set to the maximum allowed by the cbor library. We rely on
+		// the library initial wellformedness scan and on the api max request limit to
+		// prevent preallocating very large slices during decoding.
+		MaxArrayElements: 2147483647,
+
+		// MaxMapPairs specifies the maximum number of key-value pairs allowed in a map.
+		// We selected this value as it is large enough so that in practice the API server
+		// decoder will always hit the request body limit before the limit here is reached.
+		MaxMapPairs: 2097152,
+
+		// Indefinite-length sequences aren't produced by this serializer, but other
+		// implementations can.
+		IndefLength: cbor.IndefLengthAllowed,
+
+		// Accept inputs that contain CBOR tags.
+		TagsMd: cbor.TagsAllowed,
+
+		// Decode type 0 (unsigned integer) as int64.
+		// TODO: IntDecConvertSignedOrFail errors on overflow, JSON will try to fall back to float64.
+		IntDec: cbor.IntDecConvertSignedOrFail,
+
+		// Disable producing map[cbor.ByteString]interface{}, which is not acceptable for
+		// decodes into interface{}.
+		MapKeyByteString: cbor.MapKeyByteStringForbidden,
+
+		// Error on map keys that don't map to a field in the destination struct.
+		ExtraReturnErrors: cbor.ExtraDecErrorUnknownField,
+
+		// Decode maps into concrete type map[string]interface{} when the destination is an
+		// interface{}.
+		DefaultMapType: reflect.TypeOf(map[string]interface{}(nil)),
+
+		// A CBOR text string whose content is not a valid UTF-8 sequence is well-formed but
+		// invalid according to the CBOR spec. Reject invalid inputs. Encoders are
+		// responsible for ensuring that all text strings they produce contain valid UTF-8
+		// sequences and may use the byte string major type to encode strings that have not
+		// been validated.
+		UTF8: cbor.UTF8RejectInvalid,
+
+		// Never make a case-insensitive match between a map key and a struct field.
+		FieldNameMatching: cbor.FieldNameMatchingCaseSensitive,
+
+		// Produce string concrete values when decoding a CBOR byte string into interface{}.
+		DefaultByteStringType: reflect.TypeOf(""),
+
+		// Allow CBOR byte strings to be decoded into string destination values. If a byte
+		// string is enclosed in an "expected later encoding" tag
+		// (https://www.rfc-editor.org/rfc/rfc8949.html#section-3.4.5.2), then the text
+		// encoding indicated by that tag (e.g. base64) will be applied to the contents of
+		// the byte string.
+		ByteStringToString: cbor.ByteStringToStringAllowedWithExpectedLaterEncoding,
+
+		// Allow CBOR byte strings to match struct fields when appearing as a map key.
+		FieldNameByteString: cbor.FieldNameByteStringAllowed,
+
+		// When decoding an unrecognized tag to interface{}, return the decoded tag content
+		// instead of the default, a cbor.Tag representing a (number, content) pair.
+		UnrecognizedTagToAny: cbor.UnrecognizedTagContentToAny,
+
+		// Decode time tags to interface{} as strings containing RFC 3339 timestamps.
+		TimeTagToAny: cbor.TimeTagToRFC3339Nano,
+
+		// For parity with JSON, strings can be decoded into time.Time if they are RFC 3339
+		// timestamps.
+		ByteStringToTime: cbor.ByteStringToTimeAllowed,
+
+		// Reject NaN and infinite floating-point values since they don't have a JSON
+		// representation (RFC 8259 Section 6).
+		NaN: cbor.NaNDecodeForbidden,
+		Inf: cbor.InfDecodeForbidden,
+
+		// When unmarshaling a byte string into a []byte, assume that the byte string
+		// contains base64-encoded bytes, unless explicitly counterindicated by an "expected
+		// later encoding" tag. This is consistent with the because of unmarshaling a JSON
+		// text into a []byte.
+		ByteStringExpectedFormat: cbor.ByteStringExpectedBase64,
+
+		// Reject the arbitrary-precision integer tags because they can't be faithfully
+		// roundtripped through the allowable Unstructured types.
+		BignumTag: cbor.BignumTagForbidden,
+
+		// Reject anything other than the simple values true, false, and null.
+		SimpleValues: simpleValues,
+
+		// Disable default recognition of types implementing encoding.BinaryUnmarshaler,
+		// which is not recognized for JSON decoding.
+		BinaryUnmarshaler: cbor.BinaryUnmarshalerNone,
+
+		// Marshal types that implement encoding.TextMarshaler by calling their MarshalText
+		// method and encoding the result to a CBOR text string.
+		TextUnmarshaler: cbor.TextUnmarshalerTextString,
+	}.DecMode()
+	if err != nil {
+		panic(err)
+	}
+	return decode
+}()
+
+var Decode cbor.DecMode = func() cbor.DecMode {
+	opts := decode.DecOptions()
+	// When decoding into a value of a type that implements json.Unmarshaler (and does not
+	// implement cbor.Unmarshaler), transcode the input to JSON and pass it to the value's
+	// UnmarshalJSON method.
+	opts.JSONUnmarshalerTranscoder = TranscodeFunc(TranscodeToJSON)
+	dm, err := opts.DecMode()
+	if err != nil {
+		panic(err)
+	}
+	return dm
+}()
+
+// DecodeLax is derived from Decode, but does not complain about unknown fields in the input.
+var DecodeLax cbor.DecMode = func() cbor.DecMode {
+	opts := Decode.DecOptions()
+	opts.ExtraReturnErrors &^= cbor.ExtraDecErrorUnknownField // clear bit
+	dm, err := opts.DecMode()
+	if err != nil {
+		panic(err)
+	}
+	return dm
+}()
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode_test.go
new file mode 100644
index 0000000000..e605981800
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode_test.go
@@ -0,0 +1,851 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes_test
+
+import (
+	"encoding/hex"
+	"fmt"
+	"math"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/google/go-cmp/cmp"
+)
+
+type int64BinaryUnmarshaler int64
+
+func (i *int64BinaryUnmarshaler) UnmarshalBinary(_ []byte) error {
+	return nil
+}
+
+func TestDecode(t *testing.T) {
+	hex := func(h string) []byte {
+		b, err := hex.DecodeString(h)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return b
+	}
+
+	type test struct {
+		name          string
+		modes         []cbor.DecMode // most tests should run for all modes
+		in            []byte
+		into          interface{} // prototype for concrete destination type. if nil, decode into empty interface value.
+		want          interface{}
+		assertOnError func(t *testing.T, e error)
+	}
+
+	// Test cases are grouped by the kind of the CBOR data item being decoded, as enumerated in
+	// https://www.rfc-editor.org/rfc/rfc8949.html#section-2.
+	group := func(t *testing.T, name string, tests []test) {
+		t.Run(name, func(t *testing.T) {
+			for _, test := range tests {
+				t.Run(test.name, func(t *testing.T) {
+					decModes := test.modes
+					if len(decModes) == 0 {
+						decModes = allDecModes
+					}
+
+					for _, decMode := range decModes {
+						modeName, ok := decModeNames[decMode]
+						if !ok {
+							t.Fatal("test case configured to run against unrecognized mode")
+						}
+
+						t.Run(fmt.Sprintf("%s/mode=%s", test.name, modeName), func(t *testing.T) {
+							var dst reflect.Value
+							if test.into == nil {
+								var i interface{}
+								dst = reflect.ValueOf(&i)
+							} else {
+								dst = reflect.New(reflect.TypeOf(test.into))
+							}
+							err := decMode.Unmarshal(test.in, dst.Interface())
+							test.assertOnError(t, err)
+							if err == nil {
+								if diff := cmp.Diff(test.want, dst.Elem().Interface()); diff != "" {
+									t.Errorf("unexpected output:\n%s", diff)
+								}
+							}
+						})
+					}
+				})
+			}
+		})
+	}
+
+	group(t, "unsigned integer", []test{
+		{
+			name:          "unsigned integer decodes to interface{} as int64",
+			in:            hex("0a"), // 10
+			want:          int64(10),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "int64 minimum positive value",
+			in:            hex("00"), // 0
+			want:          int64(0),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "int64 max positive value",
+			in:            hex("1b7fffffffffffffff"), // 9223372036854775807
+			want:          int64(9223372036854775807),
+			assertOnError: assertNilError,
+		},
+		{
+			name: "max positive integer value supported by cbor: 2^64 - 1",
+			in:   hex("1bffffffffffffffff"), // 18446744073709551615
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnmarshalTypeError) {
+				if e == nil {
+					t.Error("expected non-nil error")
+				} else if want := "cbor: cannot unmarshal positive integer into Go value of type int64 (18446744073709551615 overflows Go's int64)"; want != e.Error() {
+					t.Errorf("want error %q, got %q", want, e.Error())
+				}
+			}),
+		},
+	})
+
+	group(t, "negative integer", []test{
+		{
+			name:          "int64 max negative value",
+			in:            hex("20"), // -1
+			want:          int64(-1),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "int64 min negative value",
+			in:            hex("3b7fffffffffffffff"), // -9223372036854775808
+			want:          int64(-9223372036854775808),
+			assertOnError: assertNilError,
+		},
+		{
+			name: "min negative integer value supported by cbor: -2^64",
+			in:   hex("3bffffffffffffffff"), // -18446744073709551616
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnmarshalTypeError) {
+				if e == nil {
+					t.Error("expected non-nil error")
+				} else if want := "cbor: cannot unmarshal negative integer into Go value of type int64 (-18446744073709551616 overflows Go's int64)"; want != e.Error() {
+					t.Errorf("want error %q, got %q", want, e.Error())
+				}
+			}),
+		},
+	})
+
+	group(t, "byte string", []test{
+		{
+			name:          "empty byte string",
+			in:            hex("40"), // ''
+			want:          "",
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "byte string into []byte assumes base64",
+			in:            []byte("\x48AQIDBA=="), // 'AQIDBA=='
+			into:          []byte{},
+			want:          []byte{0x01, 0x02, 0x03, 0x04},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "byte string into []byte errors on invalid base64",
+			in:            hex("41ff"), // h'ff'
+			into:          []byte{},
+			assertOnError: assertErrorMessage("cbor: failed to decode base64 from byte string: illegal base64 data at input byte 0"),
+		},
+		{
+			name:          "empty byte string into []byte assumes base64",
+			in:            hex("40"), // ''
+			into:          []byte{},
+			want:          []byte{},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "byte string with expected encoding tag into []byte does not convert",
+			in:            hex("d64401020304"), // 22(h'01020304')
+			into:          []byte{},
+			want:          []byte{0x01, 0x02, 0x03, 0x04},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "byte string with expected encoding tag into string converts",
+			in:            hex("d64401020304"), // 22(h'01020304')
+			into:          "",
+			want:          "AQIDBA==",
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "byte string with expected encoding tag into interface{} converts",
+			in:            hex("d64401020304"), // 22(h'01020304')
+			want:          "AQIDBA==",
+			assertOnError: assertNilError,
+		},
+		{
+			name: "into non-string type implementing BinaryUnmarshaler",
+			in:   hex("40"), // ''
+			into: int64BinaryUnmarshaler(7),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnmarshalTypeError) {
+				want := &cbor.UnmarshalTypeError{
+					CBORType: "byte string",
+					GoType:   reflect.TypeFor[int64BinaryUnmarshaler]().String(),
+				}
+				if e.CBORType != want.CBORType || e.GoType != want.GoType {
+					t.Errorf("expected %q, got %q", want, e)
+				}
+			}),
+		},
+		{
+			name:          "text unmarshaler",
+			in:            hex("4161"),
+			into:          &RoundtrippableText{},
+			want:          &RoundtrippableText{Text: "a"},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "json unmarshaler",
+			in:            hex("4161"),
+			into:          &RoundtrippableJSON{},
+			want:          &RoundtrippableJSON{Raw: `"a"`},
+			assertOnError: assertNilError,
+		},
+	})
+
+	group(t, "text string", []test{
+		{
+			name: "reject text string containing invalid utf-8 sequence",
+			in:   hex("6180"), // text string beginning with continuation byte 0x80
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.SemanticError) {
+				const expected = "cbor: invalid UTF-8 string"
+				if msg := e.Error(); msg != expected {
+					t.Errorf("expected %v, got %v", expected, msg)
+				}
+			}),
+		},
+		{
+			name:          "indefinite-length text string",
+			in:            hex("7f616161626163ff"), // (_ "a", "b", "c")
+			want:          "abc",
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "empty text string",
+			in:            hex("60"), // ""
+			want:          "",
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "text unmarshaler",
+			in:            hex("6161"),
+			into:          &RoundtrippableText{},
+			want:          &RoundtrippableText{Text: "a"},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "json unmarshaler",
+			in:            hex("6161"),
+			into:          &RoundtrippableJSON{},
+			want:          &RoundtrippableJSON{Raw: `"a"`},
+			assertOnError: assertNilError,
+		},
+	})
+
+	group(t, "array", []test{
+		{
+			name: "nested indefinite-length array",
+			in:   hex("9f9f8080ff9f8080ffff"), // [_ [_ [] []] [_ [][]]]
+			want: []interface{}{
+				[]interface{}{[]interface{}{}, []interface{}{}},
+				[]interface{}{[]interface{}{}, []interface{}{}},
+			},
+			assertOnError: assertNilError,
+		},
+	})
+
+	group(t, "map", []test{
+		{
+			name:          "reject duplicate negative int keys into struct",
+			modes:         []cbor.DecMode{modes.DecodeLax},
+			in:            hex("a220012002"), // {-1: 1, -1: 2}
+			into:          struct{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: int64(-1), Index: 1}),
+		},
+		{
+			name:          "reject duplicate negative int keys into map",
+			in:            hex("a220012002"), // {-1: 1, -1: 2}
+			into:          map[int64]interface{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: int64(-1), Index: 1}),
+		},
+		{
+			name:          "reject duplicate positive int keys into struct",
+			modes:         []cbor.DecMode{modes.DecodeLax},
+			in:            hex("a201010102"), // {1: 1, 1: 2}
+			into:          struct{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: int64(1), Index: 1}),
+		},
+		{
+			name:          "reject duplicate positive int keys into map",
+			in:            hex("a201010102"), // {1: 1, 1: 2}
+			into:          map[int64]interface{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: int64(1), Index: 1}),
+		},
+		{
+			name: "reject duplicate text string keys into struct",
+			in:   hex("a2614101614102"), // {"A": 1, "A": 2}
+			into: struct {
+				A int `json:"A"`
+			}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("A"), Index: 1}),
+		},
+		{
+			name:          "reject duplicate text string keys into map",
+			in:            hex("a2614101614102"), // {"A": 1, "A": 2}
+			into:          map[string]interface{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("A"), Index: 1}),
+		},
+		{
+			name:          "reject duplicate byte string keys into map",
+			in:            hex("a2414101414102"), // {'A': 1, 'A': 2}
+			into:          map[string]interface{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("A"), Index: 1}),
+		},
+		{
+			name: "reject duplicate byte string keys into struct",
+			in:   hex("a2414101414102"), // {'A': 1, 'A': 2}
+			into: struct {
+				A int `json:"A"`
+			}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("A"), Index: 1}),
+		},
+		{
+			name:          "reject duplicate byte string and text string keys into map",
+			in:            hex("a2414101614102"), // {'A': 1, "A": 2}
+			into:          map[string]interface{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("A"), Index: 1}),
+		},
+		{
+			name: "reject duplicate byte string and text string keys into struct",
+			in:   hex("a2414101614102"), // {'A': 1, "A": 2}
+			into: struct {
+				A int `json:"A"`
+			}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("A"), Index: 1}),
+		},
+		{
+			name: "reject two identical indefinite-length byte string keys split into chunks differently into struct",
+			in:   hex("a25f426865436c6c6fff015f416844656c6c6fff02"), // {(_ 'he', 'llo'): 1, (_ 'h', 'ello'): 2}
+			into: struct {
+				Hello int `json:"hello"`
+			}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("hello"), Index: 1}),
+		},
+		{
+			name:          "reject two identical indefinite-length byte string keys split into chunks differently into map",
+			in:            hex("a25f426865436c6c6fff015f416844656c6c6fff02"), // {(_ 'he', 'llo'): 1, (_ 'h', 'ello'): 2}
+			into:          map[string]interface{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("hello"), Index: 1}),
+		},
+		{
+			name: "reject two identical indefinite-length text string keys split into chunks differently into struct",
+			in:   hex("a27f626865636c6c6fff017f616864656c6c6fff02"), // {(_ "he", "llo"): 1, (_ "h", "ello"): 2}
+			into: struct {
+				Hello int `json:"hello"`
+			}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("hello"), Index: 1}),
+		},
+		{
+			name:          "reject two identical indefinite-length text string keys split into chunks differently into map",
+			modes:         []cbor.DecMode{modes.DecodeLax},
+			in:            hex("a27f626865636c6c6fff017f616864656c6c6fff02"), // {(_ "he", "llo"): 1, (_ "h", "ello"): 2}
+			into:          map[string]interface{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("hello"), Index: 1}),
+		},
+		{
+			name:  "case-insensitive match treated as unknown field",
+			modes: []cbor.DecMode{modes.Decode},
+			in:    hex("a1614101"), // {"A": 1}
+			into: struct {
+				A int `json:"a"`
+			}{},
+			assertOnError: assertIdenticalError(&cbor.UnknownFieldError{Index: 0}),
+		},
+		{
+			name:  "case-insensitive match ignored in lax mode",
+			modes: []cbor.DecMode{modes.DecodeLax},
+			in:    hex("a1614101"), // {"A": 1}
+			into: struct {
+				A int `json:"a"`
+			}{},
+			want: struct {
+				A int `json:"a"`
+			}{
+				A: 0,
+			},
+			assertOnError: assertNilError,
+		},
+		{
+			name:  "case-insensitive match after exact match treated as unknown field",
+			modes: []cbor.DecMode{modes.Decode},
+			in:    hex("a2616101614102"), // {"a": 1, "A": 2}
+			into: struct {
+				A int `json:"a"`
+			}{},
+			want: struct {
+				A int `json:"a"`
+			}{
+				A: 1,
+			},
+			assertOnError: assertIdenticalError(&cbor.UnknownFieldError{Index: 1}),
+		},
+		{
+			name:  "case-insensitive match after exact match ignored in lax mode",
+			modes: []cbor.DecMode{modes.DecodeLax},
+			in:    hex("a2616101614102"), // {"a": 1, "A": 2}
+			into: struct {
+				A int `json:"a"`
+			}{},
+			want: struct {
+				A int `json:"a"`
+			}{
+				A: 1,
+			},
+			assertOnError: assertNilError,
+		},
+		{
+			name:  "case-insensitive match before exact match treated as unknown field",
+			modes: []cbor.DecMode{modes.Decode},
+			in:    hex("a2614101616102"), // {"A": 1, "a": 2}
+			into: struct {
+				A int `json:"a"`
+			}{},
+			assertOnError: assertIdenticalError(&cbor.UnknownFieldError{Index: 0}),
+		},
+		{
+			name:  "case-insensitive match before exact match ignored in lax mode",
+			modes: []cbor.DecMode{modes.DecodeLax},
+			in:    hex("a2614101616102"), // {"A": 1, "a": 2}
+			into: struct {
+				A int `json:"a"`
+			}{},
+			want: struct {
+				A int `json:"a"`
+			}{
+				A: 2,
+			},
+			assertOnError: assertNilError,
+		},
+		{
+			name:  "unknown field error",
+			modes: []cbor.DecMode{modes.Decode},
+			in:    hex("a1616101"), // {"a": 1}
+			into:  struct{}{},
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnknownFieldError) {
+				if e.Index != 0 {
+					t.Errorf("expected %#v, got %#v", &cbor.UnknownFieldError{Index: 0}, e)
+				}
+			}),
+		},
+		{
+			name:          "no unknown field error in lax mode",
+			modes:         []cbor.DecMode{modes.DecodeLax},
+			in:            hex("a1616101"), // {"a": 1}
+			into:          struct{}{},
+			want:          struct{}{},
+			assertOnError: assertNilError,
+		},
+		{
+			name: "nested indefinite-length map",
+			in:   hex("bf6141bf616101616202ff6142bf616901616a02ffff"), // {_ "A": {_ "a": 1, "b": 2}, "B": {_ "i": 1, "j": 2}}
+			want: map[string]interface{}{
+				"A": map[string]interface{}{"a": int64(1), "b": int64(2)},
+				"B": map[string]interface{}{"i": int64(1), "j": int64(2)},
+			},
+			assertOnError: assertNilError,
+		},
+		{
+			name: "map with non-string key types",
+			in:   hex("a1fb40091eb851eb851f63706965"), // {3.14: "pie"}
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnmarshalTypeError) {
+				if e.CBORType != "primitives" || e.GoType != "string" {
+					t.Errorf("expected %q, got %q", &cbor.UnmarshalTypeError{CBORType: "primitives", GoType: "string"}, e)
+				}
+			}),
+		},
+		{
+			name:          "map with byte string key",
+			in:            hex("a143abcdef187b"), // {h'abcdef': 123}
+			want:          map[string]interface{}{"\xab\xcd\xef": int64(123)},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "map with text string key",
+			in:            hex("a143414243187b"), // {"ABC": 123}
+			want:          map[string]interface{}{"ABC": int64(123)},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "map with mixed string key types",
+			in:            hex("a243abcdef187b43414243187c"), // {h'abcdef': 123, "ABC": 124}
+			want:          map[string]interface{}{"\xab\xcd\xef": int64(123), "ABC": int64(124)},
+			assertOnError: assertNilError,
+		},
+	})
+
+	group(t, "floating-point number", []test{
+		{
+			name: "half precision infinity",
+			in:   hex("f97c00"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "single precision infinity",
+			in:   hex("fa7f800000"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "double precision infinity",
+			in:   hex("fb7ff0000000000000"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "half precision negative infinity",
+			in:   hex("f9fc00"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "single precision negative infinity",
+			in:   hex("faff800000"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "double precision negative infinity",
+			in:   hex("fbfff0000000000000"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "half precision NaN",
+			in:   hex("f97e00"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point NaN"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "single precision NaN",
+			in:   hex("fa7fc00000"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point NaN"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "double precision NaN",
+			in:   hex("fb7ff8000000000000"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point NaN"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name:          "smallest nonzero float64",
+			in:            hex("fb0000000000000001"),
+			want:          float64(math.SmallestNonzeroFloat64),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "max float64 value",
+			in:            hex("fb7fefffffffffffff"),
+			want:          float64(math.MaxFloat64),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "max float32 value as double precision",
+			in:            hex("fb47efffffe0000000"),
+			want:          float64(math.MaxFloat32),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "max float32 value as single precision",
+			in:            hex("fa7f7fffff"),
+			want:          float64(math.MaxFloat32),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "half precision",
+			in:            hex("f94200"),
+			want:          float64(3),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "double precision without fractional component",
+			in:            hex("fb4000000000000000"),
+			want:          float64(2),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "single precision without fractional component",
+			in:            hex("fa40000000"),
+			want:          float64(2),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "half precision without fractional component",
+			in:            hex("f94000"),
+			want:          float64(2),
+			assertOnError: assertNilError,
+		},
+	})
+
+	group(t, "simple value", append([]test{
+		{
+			name:          "simple value 20",
+			in:            hex("f4"), // false
+			want:          false,
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "simple value 21",
+			in:            hex("f5"), // true
+			want:          true,
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "simple value 22",
+			in:            hex("f6"), // nil
+			want:          nil,
+			assertOnError: assertNilError,
+		},
+		{
+			name: "simple value 23",
+			in:   hex("f7"), // undefined
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "simple value 23 is not recognized"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+	}, func() (generated []test) {
+		// Generate test cases for all simple values (0 to 255) because the number of possible simple values is fixed and small.
+		for i := 0; i <= 255; i++ {
+			each := test{
+				name: fmt.Sprintf("simple value %d", i),
+			}
+			if i <= 23 {
+				each.in = []byte{byte(0xe0) | byte(i)}
+			} else {
+				// larger simple values encode to two bytes
+				each.in = []byte{byte(0xe0) | byte(24), byte(i)}
+			}
+			switch i {
+			case 20, 21, 22, 23: // recognized values with explicit cases
+				continue
+			case 24, 25, 26, 27, 28, 29, 30, 31: // reserved
+				// these are considered not well-formed
+				each.assertOnError = assertOnConcreteError(func(t *testing.T, e *cbor.SyntaxError) {
+					if e == nil {
+						t.Error("expected non-nil error")
+					} else if want := fmt.Sprintf("cbor: invalid simple value %d for type primitives", i); want != e.Error() {
+						t.Errorf("want error %q, got %q", want, e.Error())
+					}
+				})
+			default:
+				// reject all unrecognized simple values
+				each.assertOnError = assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+					if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: fmt.Sprintf("simple value %d is not recognized", i)}, e); diff != "" {
+						t.Errorf("unexpected error diff:\n%s", diff)
+					}
+				})
+			}
+			generated = append(generated, each)
+		}
+		return
+	}()...))
+
+	t.Run("tag", func(t *testing.T) {
+		group(t, "rfc3339 time", []test{
+			{
+				name:          "tag 0 RFC3339 text string",
+				in:            hex("c074323030362d30312d30325431353a30343a30355a"), // 0("2006-01-02T15:04:05Z")
+				want:          "2006-01-02T15:04:05Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 0 byte string",
+				in:            hex("c054323030362d30312d30325431353a30343a30355a"), // 0('2006-01-02T15:04:05Z')
+				want:          "2006-01-02T15:04:05Z",
+				assertOnError: assertErrorMessage("cbor: tag number 0 must be followed by text string, got byte string"),
+			},
+			{
+				name:          "tag 0 non-RFC3339 text string",
+				in:            hex("c06474657874"), // 0("text")
+				assertOnError: assertErrorMessage(`cbor: cannot set text for time.Time: parsing time "text" as "2006-01-02T15:04:05Z07:00": cannot parse "text" as "2006"`),
+			},
+		})
+
+		group(t, "epoch time", []test{
+			{
+				name:          "tag 1 timestamp unsigned integer",
+				in:            hex("c11a43b940e5"), // 1(1136214245)
+				want:          "2006-01-02T15:04:05Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 1 with float16 value",
+				in:            hex("c1f93c00"), // 1(1.0_1)
+				want:          "1970-01-01T00:00:01Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 1 with float32 value",
+				in:            hex("c1fa3f800000"), // 1(1.0_2)
+				want:          "1970-01-01T00:00:01Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 1 with float64 value",
+				in:            hex("c1fb3ff0000000000000"), // 1(1.0_3)
+				want:          "1970-01-01T00:00:01Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 1 with a five digit year",
+				in:            hex("c11b0000003afff44181"), // 1(253402300801)
+				want:          "10000-01-01T00:00:01Z",
+				assertOnError: assertErrorMessage("cbor: decoded time cannot be represented in RFC3339 format with sub-second precision: Time.MarshalText: year outside of range [0,9999]"),
+			},
+			{
+				name:          "tag 1 with a negative integer value",
+				in:            hex("c120"), // 1(-1)
+				want:          "1969-12-31T23:59:59Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 1 with a negative float16 value",
+				in:            hex("c1f9bc00"), // 1(-1.0_1)
+				want:          "1969-12-31T23:59:59Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 1 with a negative float32 value",
+				in:            hex("c1fabf800000"), // 1(-1.0_2)
+				want:          "1969-12-31T23:59:59Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 1 with a negative float64 value",
+				in:            hex("c1fbbff0000000000000"), // 1(-1.0_3)
+				want:          "1969-12-31T23:59:59Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name: "tag 1 with a positive infinity",
+				in:   hex("c1f97c00"), // 1(Infinity)
+				assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+					if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+						t.Errorf("unexpected error diff:\n%s", diff)
+					}
+				}),
+			},
+			{
+				name: "tag 1 with a negative infinity",
+				in:   hex("c1f9fc00"), // 1(-Infinity)
+				assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+					if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+						t.Errorf("unexpected error diff:\n%s", diff)
+					}
+				}),
+			},
+			{
+				name: "tag 1 with NaN",
+				in:   hex("c1f97e00"), // 1(NaN)
+				assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+					if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point NaN"}, e); diff != "" {
+						t.Errorf("unexpected error diff:\n%s", diff)
+					}
+				}),
+			},
+		})
+
+		group(t, "unsigned bignum", []test{
+			{
+				name: "rejected",
+				in:   hex("c249010000000000000000"), // 2(18446744073709551616)
+				assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+					if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "tag", Message: "bignum"}, e); diff != "" {
+						t.Errorf("unexpected error diff:\n%s", diff)
+					}
+				}),
+			},
+		})
+
+		group(t, "negative bignum", []test{
+			{
+				name: "rejected",
+				in:   hex("c349010000000000000000"), // 3(-18446744073709551617)
+				assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+					if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "tag", Message: "bignum"}, e); diff != "" {
+						t.Errorf("unexpected error diff:\n%s", diff)
+					}
+				}),
+			},
+		})
+
+		group(t, "unrecognized", []test{
+			{
+				name:          "decimal fraction",
+				in:            hex("c48221196ab3"), // 4([-2, 27315])
+				want:          []interface{}{int64(-2), int64(27315)},
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "bigfloat",
+				in:            hex("c5822003"), // 5([-1, 3])
+				want:          []interface{}{int64(-1), int64(3)},
+				assertOnError: assertNilError,
+			},
+		})
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/diagnostic.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/diagnostic.go
new file mode 100644
index 0000000000..61f3f145f5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/diagnostic.go
@@ -0,0 +1,36 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"github.com/fxamacker/cbor/v2"
+)
+
+var Diagnostic cbor.DiagMode = func() cbor.DiagMode {
+	opts := Decode.DecOptions()
+	diagnostic, err := cbor.DiagOptions{
+		ByteStringText: true,
+
+		MaxNestedLevels:  opts.MaxNestedLevels,
+		MaxArrayElements: opts.MaxArrayElements,
+		MaxMapPairs:      opts.MaxMapPairs,
+	}.DiagMode()
+	if err != nil {
+		panic(err)
+	}
+	return diagnostic
+}()
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode.go
new file mode 100644
index 0000000000..3287dfd31c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode.go
@@ -0,0 +1,185 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"io"
+
+	"github.com/fxamacker/cbor/v2"
+)
+
+// encode is the basis for the Encode mode, with no JSONMarshalerTranscoder
+// configured. TranscodeFromJSON uses this directly rather than Encode to avoid an initialization
+// cycle between the two. Everything else should use one of the exported EncModes.
+var encode = EncMode{
+	delegate: func() cbor.UserBufferEncMode {
+		encode, err := cbor.EncOptions{
+			// Map keys need to be sorted to have deterministic output, and this is the order
+			// defined in RFC 8949 4.2.1 "Core Deterministic Encoding Requirements".
+			Sort: cbor.SortBytewiseLexical,
+
+			// CBOR supports distinct types for IEEE-754 float16, float32, and float64. Store
+			// floats in the smallest width that preserves value so that equivalent float32 and
+			// float64 values encode to identical bytes, as they do in a JSON
+			// encoding. Satisfies one of the "Core Deterministic Encoding Requirements".
+			ShortestFloat: cbor.ShortestFloat16,
+
+			// Error on attempt to encode NaN and infinite values. This is what the JSON
+			// serializer does.
+			NaNConvert: cbor.NaNConvertReject,
+			InfConvert: cbor.InfConvertReject,
+
+			// Error on attempt to encode math/big.Int values, which can't be faithfully
+			// roundtripped through Unstructured in general (the dynamic numeric types allowed
+			// in Unstructured are limited to float64 and int64).
+			BigIntConvert: cbor.BigIntConvertReject,
+
+			// MarshalJSON for time.Time writes RFC3339 with nanos.
+			Time: cbor.TimeRFC3339Nano,
+
+			// The decoder must be able to accept RFC3339 strings with or without tag 0 (e.g. by
+			// the end of time.Time -> JSON -> Unstructured -> CBOR, the CBOR encoder has no
+			// reliable way of knowing that a particular string originated from serializing a
+			// time.Time), so producing tag 0 has little use.
+			TimeTag: cbor.EncTagNone,
+
+			// Indefinite-length items have multiple encodings and aren't being used anyway, so
+			// disable to avoid an opportunity for nondeterminism.
+			IndefLength: cbor.IndefLengthForbidden,
+
+			// Preserve distinction between nil and empty for slices and maps.
+			NilContainers: cbor.NilContainerAsNull,
+
+			// OK to produce tags.
+			TagsMd: cbor.TagsAllowed,
+
+			// Use the same definition of "empty" as encoding/json.
+			OmitEmpty: cbor.OmitEmptyGoValue,
+
+			// The CBOR types text string and byte string are structurally equivalent, with the
+			// semantic difference that a text string whose content is an invalid UTF-8 sequence
+			// is itself invalid. We reject all invalid text strings at decode time and do not
+			// validate or sanitize all Go strings at encode time. Encoding Go strings to the
+			// byte string type is comparable to the existing Protobuf behavior and cheaply
+			// ensures that the output is valid CBOR.
+			String: cbor.StringToByteString,
+
+			// Encode struct field names to the byte string type rather than the text string
+			// type.
+			FieldName: cbor.FieldNameToByteString,
+
+			// Marshal Go byte arrays to CBOR arrays of integers (as in JSON) instead of byte
+			// strings.
+			ByteArray: cbor.ByteArrayToArray,
+
+			// Marshal []byte to CBOR byte string enclosed in tag 22 (expected later base64
+			// encoding, https://www.rfc-editor.org/rfc/rfc8949.html#section-3.4.5.2), to
+			// interoperate with the existing JSON behavior. This indicates to the decoder that,
+			// when decoding into a string (or unstructured), the resulting value should be the
+			// base64 encoding of the original bytes. No base64 encoding or decoding needs to be
+			// performed for []byte-to-CBOR-to-[]byte roundtrips.
+			ByteSliceLaterFormat: cbor.ByteSliceLaterFormatBase64,
+
+			// Disable default recognition of types implementing encoding.BinaryMarshaler, which
+			// is not recognized for JSON encoding.
+			BinaryMarshaler: cbor.BinaryMarshalerNone,
+
+			// Unmarshal into types that implement encoding.TextUnmarshaler by passing
+			// the contents of a CBOR string to their UnmarshalText method.
+			TextMarshaler: cbor.TextMarshalerTextString,
+		}.UserBufferEncMode()
+		if err != nil {
+			panic(err)
+		}
+		return encode
+	}(),
+	deterministic: true,
+}
+
+var Encode = EncMode{
+	delegate: func() cbor.UserBufferEncMode {
+		opts := encode.options()
+		// To encode a value of a type that implements json.Marshaler (and does not
+		// implement cbor.Marshaler), transcode the result of calling its MarshalJSON method
+		// directly to CBOR.
+		opts.JSONMarshalerTranscoder = TranscodeFunc(TranscodeFromJSON)
+		em, err := opts.UserBufferEncMode()
+		if err != nil {
+			panic(err)
+		}
+		return em
+	}(),
+	deterministic: true,
+}
+
+var EncodeNondeterministic = EncMode{
+	delegate: func() cbor.UserBufferEncMode {
+		opts := Encode.options()
+		opts.Sort = cbor.SortFastShuffle
+		em, err := opts.UserBufferEncMode()
+		if err != nil {
+			panic(err)
+		}
+		return em
+	}(),
+	deterministic: false,
+}
+
+type EncMode struct {
+	delegate      cbor.UserBufferEncMode
+	deterministic bool
+}
+
+func (em EncMode) options() cbor.EncOptions {
+	return em.delegate.EncOptions()
+}
+
+func (em EncMode) IsDeterministic() bool {
+	return em.deterministic
+}
+
+func (em EncMode) MarshalTo(v interface{}, w io.Writer) error {
+	if buf, ok := w.(*buffer); ok {
+		return em.delegate.MarshalToBuffer(v, &buf.Buffer)
+	}
+
+	buf := buffers.Get()
+	defer buffers.Put(buf)
+	if err := em.delegate.MarshalToBuffer(v, &buf.Buffer); err != nil {
+		return err
+	}
+
+	if _, err := io.Copy(w, buf); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (em EncMode) Marshal(v interface{}) ([]byte, error) {
+	buf := buffers.Get()
+	defer buffers.Put(buf)
+
+	if err := em.MarshalTo(v, &buf.Buffer); err != nil {
+		return nil, err
+	}
+
+	clone := make([]byte, buf.Len())
+	copy(clone, buf.Bytes())
+
+	return clone, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode_test.go
new file mode 100644
index 0000000000..5c557b7365
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode_test.go
@@ -0,0 +1,132 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes_test
+
+import (
+	"fmt"
+	"math/big"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/google/go-cmp/cmp"
+)
+
+type int64BinaryMarshaler int64
+
+func (i int64BinaryMarshaler) MarshalBinary() ([]byte, error) {
+	return []byte{}, nil
+}
+
+func TestEncode(t *testing.T) {
+	for _, tc := range []struct {
+		name          string
+		modes         []modes.EncMode
+		in            interface{}
+		want          []byte
+		assertOnError func(t *testing.T, e error)
+	}{
+		{
+			name:          "implementations of BinaryMarshaler are ignored",
+			in:            int64BinaryMarshaler(7),
+			want:          []byte{0x07},
+			assertOnError: assertNilError,
+		},
+		{
+			name: "all duplicate fields are ignored", // Matches behavior of JSON serializer.
+			in: struct {
+				A1 int `json:"a"`
+				A2 int `json:"a"` //nolint:govet // This is intentional to test that the encoder will not encode two map entries with the same key.
+			}{},
+			want:          []byte{0xa0}, // {}
+			assertOnError: assertNilError,
+		},
+		{
+			name: "only tagged field is considered if any are tagged", // Matches behavior of JSON serializer.
+			in: struct {
+				A       int
+				TaggedA int `json:"A"`
+			}{
+				A:       1,
+				TaggedA: 2,
+			},
+			want:          []byte{0xa1, 0x41, 0x41, 0x02}, // {"A": 2}
+			assertOnError: assertNilError,
+		},
+		{
+			name: "math/big.Int values are rejected",
+			in:   big.NewInt(1),
+			assertOnError: assertOnConcreteError(func(t *testing.T, got *cbor.UnsupportedTypeError) {
+				if want := (&cbor.UnsupportedTypeError{Type: reflect.TypeFor[big.Int]()}); *want != *got {
+					t.Errorf("unexpected error, got %#v (%q), want %#v (%q)", got, got.Error(), want, want.Error())
+				}
+			}),
+		},
+		{
+			name:          "byte array encodes to array of integers",
+			in:            [3]byte{0x01, 0x02, 0x03},
+			want:          []byte{0x83, 0x01, 0x02, 0x03}, // [1, 2, 3]
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "string marshalled to byte string",
+			in:            "hello",
+			want:          []byte{0x45, 'h', 'e', 'l', 'l', 'o'},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "[]byte marshalled to byte string in expected base64 encoding tag",
+			in:            []byte("hello"),
+			want:          []byte{0xd6, 0x45, 'h', 'e', 'l', 'l', 'o'},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "text marshaler",
+			in:            &RoundtrippableText{Text: "a"},
+			want:          []byte{0x61, 0x61},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "json marshaler",
+			in:            &RoundtrippableJSON{Raw: `"a"`},
+			want:          []byte{0x41, 0x61},
+			assertOnError: assertNilError,
+		},
+	} {
+		encModes := tc.modes
+		if len(encModes) == 0 {
+			encModes = allEncModes
+		}
+
+		for _, encMode := range encModes {
+			modeName, ok := encModeNames[encMode]
+			if !ok {
+				t.Fatal("test case configured to run against unrecognized mode")
+			}
+
+			t.Run(fmt.Sprintf("mode=%s/%s", modeName, tc.name), func(t *testing.T) {
+				out, err := encMode.Marshal(tc.in)
+				tc.assertOnError(t, err)
+				if diff := cmp.Diff(tc.want, out, cmp.Comparer(func(a, b reflect.Type) bool { return a == b })); diff != "" {
+					t.Errorf("unexpected output:\n%s", diff)
+				}
+			})
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/modes_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/modes_test.go
new file mode 100644
index 0000000000..c303cf5d88
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/modes_test.go
@@ -0,0 +1,83 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes_test
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/google/go-cmp/cmp"
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+)
+
+var encModeNames = map[modes.EncMode]string{
+	modes.Encode:                 "Encode",
+	modes.EncodeNondeterministic: "EncodeNondeterministic",
+}
+
+var allEncModes = []modes.EncMode{
+	modes.Encode,
+	modes.EncodeNondeterministic,
+}
+
+var decModeNames = map[cbor.DecMode]string{
+	modes.Decode:    "Decode",
+	modes.DecodeLax: "DecodeLax",
+}
+
+var allDecModes = []cbor.DecMode{
+	modes.Decode,
+	modes.DecodeLax,
+}
+
+func assertNilError(t *testing.T, e error) {
+	if e != nil {
+		t.Errorf("expected nil error, got: %v", e)
+	}
+}
+
+func assertOnConcreteError[E error](fn func(*testing.T, E)) func(t *testing.T, e error) {
+	return func(t *testing.T, ei error) {
+		var ec E
+		if !errors.As(ei, &ec) {
+			t.Errorf("expected concrete error type %T, got %T: %v", ec, ei, ei)
+			return
+		}
+		fn(t, ec)
+	}
+}
+
+func assertErrorMessage(want string) func(*testing.T, error) {
+	return func(t *testing.T, got error) {
+		if got == nil {
+			t.Error("expected non-nil error")
+			return
+		}
+		if got.Error() != want {
+			t.Errorf("got error %q, want %q", got.Error(), want)
+		}
+	}
+}
+
+func assertIdenticalError[E error](expected E) func(*testing.T, error) {
+	return assertOnConcreteError(func(t *testing.T, actual E) {
+		if diff := cmp.Diff(expected, actual); diff != "" {
+			t.Errorf("diff between actual error and expected error:\n%s", diff)
+		}
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/roundtrip_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/roundtrip_test.go
new file mode 100644
index 0000000000..e99f427127
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/roundtrip_test.go
@@ -0,0 +1,449 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes_test
+
+import (
+	"encoding/base64"
+	"fmt"
+	"math"
+	"reflect"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/google/go-cmp/cmp"
+)
+
+func nilPointerFor[T interface{}]() *T {
+	return nil
+}
+
+type RoundtrippableText struct{ Text string }
+
+func (rt RoundtrippableText) MarshalText() ([]byte, error) {
+	return []byte(rt.Text), nil
+}
+
+func (rt *RoundtrippableText) UnmarshalText(text []byte) error {
+	rt.Text = string(text)
+	return nil
+}
+
+type RoundtrippableJSON struct{ Raw string }
+
+func (rj RoundtrippableJSON) MarshalJSON() ([]byte, error) {
+	return []byte(rj.Raw), nil
+}
+
+func (rj *RoundtrippableJSON) UnmarshalJSON(raw []byte) error {
+	rj.Raw = string(raw)
+	return nil
+}
+
+// TestRoundtrip roundtrips object serialization to interface{} and back via CBOR.
+func TestRoundtrip(t *testing.T) {
+	type modePair struct {
+		enc modes.EncMode
+		dec cbor.DecMode
+	}
+
+	for _, tc := range []struct {
+		name      string
+		modePairs []modePair
+		obj       interface{}
+	}{
+		{
+			name: "nil slice",
+			obj:  []interface{}(nil),
+		},
+		{
+			name: "byte array",
+			obj:  [3]byte{0x01, 0x02, 0x03},
+		},
+		{
+			name: "nil map",
+			obj:  map[string]interface{}(nil),
+		},
+		{
+			name: "empty slice",
+			obj:  []interface{}{},
+		},
+		{
+			name: "empty map",
+			obj:  map[string]interface{}{},
+		},
+		{
+			name: "nil pointer to slice",
+			obj:  nilPointerFor[[]interface{}](),
+		},
+		{
+			name: "nil pointer to map",
+			obj:  nilPointerFor[map[string]interface{}](),
+		},
+		{
+			name: "nonempty string",
+			obj:  "hello world",
+		},
+		{
+			name: "empty string",
+			obj:  "",
+		},
+		{
+			name: "string containing invalid UTF-8 sequence",
+			obj:  "\x80", // first byte is a continuation byte
+		},
+		{
+			name: "true",
+			obj:  true,
+		},
+		{
+			name: "false",
+			obj:  false,
+		},
+		{
+			name: "int64",
+			obj:  int64(5),
+		},
+		{
+			name: "int64 max",
+			obj:  int64(math.MaxInt64),
+		},
+		{
+			name: "int64 min",
+			obj:  int64(math.MinInt64),
+		},
+		{
+			name: "int64 zero",
+			obj:  int64(math.MinInt64),
+		},
+		{
+			name: "uint64 zero",
+			obj:  uint64(0),
+		},
+		{
+			name: "int32 max",
+			obj:  int32(math.MaxInt32),
+		},
+		{
+			name: "int32 min",
+			obj:  int32(math.MinInt32),
+		},
+		{
+			name: "int32 zero",
+			obj:  int32(math.MinInt32),
+		},
+		{
+			name: "uint32 max",
+			obj:  uint32(math.MaxUint32),
+		},
+		{
+			name: "uint32 zero",
+			obj:  uint32(0),
+		},
+		{
+			name: "int16 max",
+			obj:  int16(math.MaxInt16),
+		},
+		{
+			name: "int16 min",
+			obj:  int16(math.MinInt16),
+		},
+		{
+			name: "int16 zero",
+			obj:  int16(math.MinInt16),
+		},
+		{
+			name: "uint16 max",
+			obj:  uint16(math.MaxUint16),
+		},
+		{
+			name: "uint16 zero",
+			obj:  uint16(0),
+		},
+		{
+			name: "int8 max",
+			obj:  int8(math.MaxInt8),
+		},
+		{
+			name: "int8 min",
+			obj:  int8(math.MinInt8),
+		},
+		{
+			name: "int8 zero",
+			obj:  int8(math.MinInt8),
+		},
+		{
+			name: "uint8 max",
+			obj:  uint8(math.MaxUint8),
+		},
+		{
+			name: "uint8 zero",
+			obj:  uint8(0),
+		},
+		{
+			name: "float64",
+			obj:  float64(2.71),
+		},
+		{
+			name: "float64 max",
+			obj:  float64(math.MaxFloat64),
+		},
+		{
+			name: "float64 smallest nonzero",
+			obj:  float64(math.SmallestNonzeroFloat64),
+		},
+		{
+			name: "float64 no fractional component",
+			obj:  float64(5),
+		},
+		{
+			name: "float32",
+			obj:  float32(2.71),
+		},
+		{
+			name: "float32 max",
+			obj:  float32(math.MaxFloat32),
+		},
+		{
+			name: "float32 smallest nonzero",
+			obj:  float32(math.SmallestNonzeroFloat32),
+		},
+		{
+			name: "float32 no fractional component",
+			obj:  float32(5),
+		},
+		{
+			name: "time.Time",
+			obj:  time.Date(2222, time.May, 4, 12, 13, 14, 123, time.UTC),
+		},
+		{
+			name: "int64 omitempty",
+			obj: struct {
+				V int64 `json:"v,omitempty"`
+			}{},
+		},
+		{
+			name: "float64 omitempty",
+			obj: struct {
+				V float64 `json:"v,omitempty"`
+			}{},
+		},
+		{
+			name: "string omitempty",
+			obj: struct {
+				V string `json:"v,omitempty"`
+			}{},
+		},
+		{
+			name: "bool omitempty",
+			obj: struct {
+				V bool `json:"v,omitempty"`
+			}{},
+		},
+		{
+			name: "nil pointer omitempty",
+			obj: struct {
+				V *struct{} `json:"v,omitempty"`
+			}{},
+		},
+		{
+			name: "nil pointer to slice as struct field",
+			obj: struct {
+				V *[]interface{} `json:"v"`
+			}{},
+		},
+		{
+			name: "nil pointer to slice as struct field with omitempty",
+			obj: struct {
+				V *[]interface{} `json:"v,omitempty"`
+			}{},
+		},
+		{
+			name: "nil pointer to map as struct field",
+			obj: struct {
+				V *map[string]interface{} `json:"v"`
+			}{},
+		},
+		{
+			name: "nil pointer to map as struct field with omitempty",
+			obj: struct {
+				V *map[string]interface{} `json:"v,omitempty"`
+			}{},
+		},
+		{
+			name: "textmarshaler and textunmarshaler",
+			obj:  RoundtrippableText{Text: "foo"},
+		},
+		{
+			name: "json marshaler and unmarshaler",
+			obj:  RoundtrippableJSON{Raw: `{"foo":[42,3.1,true,false,null]}`},
+		},
+	} {
+		modePairs := tc.modePairs
+		if len(modePairs) == 0 {
+			// Default is all modes to all modes.
+			modePairs = []modePair{}
+			for _, encMode := range allEncModes {
+				for _, decMode := range allDecModes {
+					modePairs = append(modePairs, modePair{enc: encMode, dec: decMode})
+				}
+			}
+		}
+
+		for _, modePair := range modePairs {
+			encModeName, ok := encModeNames[modePair.enc]
+			if !ok {
+				t.Fatal("test case configured to run against unrecognized encode mode")
+			}
+
+			decModeName, ok := decModeNames[modePair.dec]
+			if !ok {
+				t.Fatal("test case configured to run against unrecognized decode mode")
+			}
+
+			t.Run(fmt.Sprintf("enc=%s/dec=%s/%s", encModeName, decModeName, tc.name), func(t *testing.T) {
+				original := tc.obj
+
+				cborFromOriginal, err := modePair.enc.Marshal(original)
+				if err != nil {
+					t.Fatalf("unexpected error from Marshal of original: %v", err)
+				}
+
+				var iface interface{}
+				if err := modePair.dec.Unmarshal(cborFromOriginal, &iface); err != nil {
+					t.Fatalf("unexpected error from Unmarshal into %T: %v", &iface, err)
+				}
+
+				cborFromIface, err := modePair.enc.Marshal(iface)
+				if err != nil {
+					t.Fatalf("unexpected error from Marshal of iface: %v", err)
+				}
+
+				{
+					// interface{} to interface{}
+					var iface2 interface{}
+					if err := modePair.dec.Unmarshal(cborFromIface, &iface2); err != nil {
+						t.Fatalf("unexpected error from Unmarshal into %T: %v", &iface2, err)
+					}
+					if diff := cmp.Diff(iface, iface2); diff != "" {
+						t.Errorf("unexpected difference on roundtrip from interface{} to interface{}:\n%s", diff)
+					}
+				}
+
+				{
+					// original to original
+					final := reflect.New(reflect.TypeOf(original))
+					err = modePair.dec.Unmarshal(cborFromOriginal, final.Interface())
+					if err != nil {
+						t.Fatalf("unexpected error from Unmarshal into %T: %v", final.Interface(), err)
+					}
+					if diff := cmp.Diff(original, final.Elem().Interface()); diff != "" {
+						t.Errorf("unexpected difference on roundtrip from original to original:\n%s", diff)
+					}
+				}
+
+				{
+					// original to interface{} to original
+					finalViaIface := reflect.New(reflect.TypeOf(original))
+					err = modePair.dec.Unmarshal(cborFromIface, finalViaIface.Interface())
+					if err != nil {
+						t.Fatalf("unexpected error from Unmarshal into %T: %v", finalViaIface.Interface(), err)
+					}
+					if diff := cmp.Diff(original, finalViaIface.Elem().Interface()); diff != "" {
+						t.Errorf("unexpected difference on roundtrip from original to interface{} to original:\n%s", diff)
+					}
+				}
+			})
+		}
+	}
+}
+
+// TestRoundtripTextEncoding exercises roundtrips between []byte and string.
+func TestRoundtripTextEncoding(t *testing.T) {
+	for _, encMode := range allEncModes {
+		for _, decMode := range allDecModes {
+			t.Run(fmt.Sprintf("enc=%s/dec=%s/byte slice", encModeNames[encMode], decModeNames[decMode]), func(t *testing.T) {
+				original := []byte("foo")
+
+				c, err := encMode.Marshal(original)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				var unstructured interface{}
+				if err := decMode.Unmarshal(c, &unstructured); err != nil {
+					t.Fatal(err)
+				}
+				if diff := cmp.Diff(base64.StdEncoding.EncodeToString(original), unstructured); diff != "" {
+					t.Errorf("[]byte to interface{}: unexpected diff:\n%s", diff)
+				}
+
+				var s string
+				if err := decMode.Unmarshal(c, &s); err != nil {
+					t.Fatal(err)
+				}
+				if diff := cmp.Diff(base64.StdEncoding.EncodeToString(original), s); diff != "" {
+					t.Errorf("[]byte to string: unexpected diff:\n%s", diff)
+				}
+
+				var final []byte
+				if err := decMode.Unmarshal(c, &final); err != nil {
+					t.Fatal(err)
+				}
+				if diff := cmp.Diff(original, final); diff != "" {
+					t.Errorf("[]byte to []byte: unexpected diff:\n%s", diff)
+				}
+			})
+
+			t.Run(fmt.Sprintf("enc=%s/dec=%s/string", encModeNames[encMode], decModeNames[decMode]), func(t *testing.T) {
+				decoded := "foo"
+				original := base64.StdEncoding.EncodeToString([]byte(decoded)) // "Zm9v"
+
+				c, err := encMode.Marshal(original)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				var unstructured interface{}
+				if err := decMode.Unmarshal(c, &unstructured); err != nil {
+					t.Fatal(err)
+				}
+				if diff := cmp.Diff(original, unstructured); diff != "" {
+					t.Errorf("string to interface{}: unexpected diff:\n%s", diff)
+				}
+
+				var b []byte
+				if err := decMode.Unmarshal(c, &b); err != nil {
+					t.Fatal(err)
+				}
+				if diff := cmp.Diff([]byte(decoded), b); diff != "" {
+					t.Errorf("string to []byte: unexpected diff:\n%s", diff)
+				}
+
+				var final string
+				if err := decMode.Unmarshal(c, &final); err != nil {
+					t.Fatal(err)
+				}
+				if diff := cmp.Diff(original, final); diff != "" {
+					t.Errorf("string to string: unexpected diff:\n%s", diff)
+				}
+			})
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/transcoding.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/transcoding.go
new file mode 100644
index 0000000000..5620e9ccc9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/transcoding.go
@@ -0,0 +1,108 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+
+	kjson "sigs.k8s.io/json"
+)
+
+type TranscodeFunc func(dst io.Writer, src io.Reader) error
+
+func (f TranscodeFunc) Transcode(dst io.Writer, src io.Reader) error {
+	return f(dst, src)
+}
+
+func TranscodeFromJSON(dst io.Writer, src io.Reader) error {
+	var tmp any
+	dec := kjson.NewDecoderCaseSensitivePreserveInts(src)
+	if err := dec.Decode(&tmp); err != nil {
+		return err
+	}
+	if err := dec.Decode(&struct{}{}); !errors.Is(err, io.EOF) {
+		return errors.New("extraneous data")
+	}
+
+	return encode.MarshalTo(tmp, dst)
+}
+
+func TranscodeToJSON(dst io.Writer, src io.Reader) error {
+	var tmp any
+	dec := decode.NewDecoder(src)
+	if err := dec.Decode(&tmp); err != nil {
+		return err
+	}
+	if err := dec.Decode(&struct{}{}); !errors.Is(err, io.EOF) {
+		return errors.New("extraneous data")
+	}
+
+	// Use an Encoder to avoid the extra []byte allocated by Marshal. Encode, unlike Marshal,
+	// appends a trailing newline to separate consecutive encodings of JSON values that aren't
+	// self-delimiting, like numbers. Strip the newline to avoid the assumption that every
+	// json.Unmarshaler implementation will accept trailing whitespace.
+	enc := json.NewEncoder(&trailingLinefeedSuppressor{delegate: dst})
+	enc.SetIndent("", "")
+	return enc.Encode(tmp)
+}
+
+// trailingLinefeedSuppressor is an io.Writer that wraps another io.Writer, suppressing a single
+// trailing linefeed if it is the last byte written by the latest call to Write.
+type trailingLinefeedSuppressor struct {
+	lf       bool
+	delegate io.Writer
+}
+
+func (w *trailingLinefeedSuppressor) Write(p []byte) (int, error) {
+	if len(p) == 0 {
+		// Avoid flushing a buffered linefeeds on an empty write.
+		return 0, nil
+	}
+
+	if w.lf {
+		// The previous write had a trailing linefeed that was buffered. That wasn't the
+		// last Write call, so flush the buffered linefeed before continuing.
+		n, err := w.delegate.Write([]byte{'\n'})
+		if n > 0 {
+			w.lf = false
+		}
+		if err != nil {
+			return 0, err
+		}
+	}
+
+	if p[len(p)-1] != '\n' {
+		return w.delegate.Write(p)
+	}
+
+	p = p[:len(p)-1]
+
+	if len(p) == 0 { // []byte{'\n'}
+		w.lf = true
+		return 1, nil
+	}
+
+	n, err := w.delegate.Write(p)
+	if n == len(p) {
+		// Everything up to the trailing linefeed has been flushed. Eat the linefeed.
+		w.lf = true
+		n++
+	}
+	return n, err
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/transcoding_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/transcoding_test.go
new file mode 100644
index 0000000000..3033b054e8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/transcoding_test.go
@@ -0,0 +1,291 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"errors"
+	"strings"
+	"testing"
+)
+
+func TestTranscodeFromJSON(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		json string
+		cbor string
+		err  error
+	}{
+		{
+			name: "whole number",
+			json: "42",
+			cbor: "\x18\x2a",
+		},
+		{
+			name: "decimal number",
+			json: "1.5",
+			cbor: "\xf9\x3e\x00",
+		},
+		{
+			name: "false",
+			json: "false",
+			cbor: "\xf4",
+		},
+		{
+			name: "true",
+			json: "true",
+			cbor: "\xf5",
+		},
+		{
+			name: "null",
+			json: "null",
+			cbor: "\xf6",
+		},
+		{
+			name: "string",
+			json: `"foo"`,
+			cbor: "\x43foo",
+		},
+		{
+			name: "array",
+			json: `[]`,
+			cbor: "\x80",
+		},
+		{
+			name: "object",
+			json: `{"foo":"bar"}`,
+			cbor: "\xa1\x43foo\x43bar",
+		},
+		{
+			name: "extraneous data",
+			json: "{}{}",
+			err:  errors.New("extraneous data"),
+		},
+		{
+			name: "eof",
+			json: "",
+			err:  errors.New("EOF"),
+		},
+		{
+			name: "unexpected eof",
+			json: "{",
+			err:  errors.New("unexpected EOF"),
+		},
+		{
+			name: "malformed json",
+			json: "}",
+			err:  errors.New("invalid character '}' looking for beginning of value"),
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var out strings.Builder
+			err := TranscodeFromJSON(&out, strings.NewReader(tc.json))
+			if (err == nil) != (tc.err == nil) || tc.err != nil && tc.err.Error() != err.Error() {
+				t.Fatalf("unexpected error: want %v got %v", tc.err, err)
+			}
+			if got, want := out.String(), tc.cbor; got != want {
+				t.Errorf("unexpected transcoding: want 0x%x got 0x%x", want, got)
+			}
+		})
+	}
+}
+
+func TestTranscodeToJSON(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		cbor string
+		json string
+		err  error
+	}{
+		{
+			name: "whole number",
+			cbor: "\x18\x2a",
+			json: "42",
+		},
+		{
+			name: "decimal number",
+			cbor: "\xf9\x3e\x00",
+			json: "1.5",
+		},
+		{
+			name: "false",
+			cbor: "\xf4",
+			json: "false",
+		},
+		{
+			name: "true",
+			cbor: "\xf5",
+			json: "true",
+		},
+		{
+			name: "null",
+			cbor: "\xf6",
+			json: "null",
+		},
+		{
+			name: "string",
+			cbor: "\x43foo",
+			json: `"foo"`,
+		},
+		{
+			name: "array",
+			cbor: "\x80",
+			json: `[]`,
+		},
+		{
+			name: "object",
+			cbor: "\xa1\x43foo\x43bar",
+			json: `{"foo":"bar"}`,
+		},
+		{
+			name: "extraneous data",
+			cbor: "\xa0\xa0",
+			err:  errors.New("extraneous data"),
+		},
+		{
+			name: "unexpected eof",
+			cbor: "\xa1",
+			err:  errors.New("unexpected EOF"),
+		},
+		{
+			name: "malformed cbor",
+			cbor: "\xff",
+			err:  errors.New(`cbor: unexpected "break" code`),
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var out strings.Builder
+			err := TranscodeToJSON(&out, strings.NewReader(tc.cbor))
+			if (err == nil) != (tc.err == nil) || tc.err != nil && tc.err.Error() != err.Error() {
+				t.Fatalf("unexpected error: want %v got %v", tc.err, err)
+			}
+			if got, want := out.String(), tc.json; got != want {
+				t.Errorf("unexpected transcoding: want %q got %q", want, got)
+			}
+		})
+	}
+}
+
+type write struct {
+	p   string
+	n   int
+	err error
+}
+
+type mockWriter struct {
+	t     testing.TB
+	calls []write
+}
+
+func (m *mockWriter) Write(p []byte) (int, error) {
+	if len(m.calls) == 0 {
+		m.t.Fatalf("unexpected call (p=%q)", string(p))
+	}
+	if got, want := string(p), m.calls[0].p; got != want {
+		m.t.Errorf("unexpected argument: want %q, got %q", want, got)
+	}
+	n, err := m.calls[0].n, m.calls[0].err
+	m.calls = m.calls[1:]
+	return n, err
+}
+
+func TestTrailingLinefeedSuppressor(t *testing.T) {
+	for _, tc := range []struct {
+		name      string
+		calls     []write
+		delegated []write
+	}{
+		{
+			name:      "one write without newline",
+			calls:     []write{{"foo", 3, nil}},
+			delegated: []write{{"foo", 3, nil}},
+		},
+		{
+			name:      "one write with newline",
+			calls:     []write{{"foo\n", 4, nil}},
+			delegated: []write{{"foo", 3, nil}},
+		},
+		{
+			name:      "one write with only newline",
+			calls:     []write{{"\n", 1, nil}},
+			delegated: nil,
+		},
+		{
+			name:      "one empty write",
+			calls:     []write{{"", 0, nil}},
+			delegated: nil,
+		},
+		{
+			name:      "three writes, all with only newline",
+			calls:     []write{{"\n", 1, nil}, {"\n", 1, nil}, {"\n", 1, nil}},
+			delegated: []write{{"\n", 1, nil}, {"\n", 1, nil}},
+		},
+		{
+			name:      "buffered linefeed not flushed on empty write",
+			calls:     []write{{"\n", 1, nil}, {"", 0, nil}},
+			delegated: nil,
+		},
+
+		{
+			name:      "two writes, last with trailing newline",
+			calls:     []write{{"foo", 3, nil}, {"bar\n", 4, nil}},
+			delegated: []write{{"foo", 3, nil}, {"bar", 3, nil}},
+		},
+		{
+			name:      "two writes, first with trailing newline",
+			calls:     []write{{"foo\n", 4, nil}, {"bar", 3, nil}},
+			delegated: []write{{"foo", 3, nil}, {"\n", 1, nil}, {"bar", 3, nil}},
+		},
+		{
+			name:      "two writes, both with trailing newlines",
+			calls:     []write{{"foo\n", 4, nil}, {"bar\n", 4, nil}},
+			delegated: []write{{"foo", 3, nil}, {"\n", 1, nil}, {"bar", 3, nil}},
+		},
+		{
+			name:      "two writes, neither with newlines",
+			calls:     []write{{"foo", 3, nil}, {"bar", 3, nil}},
+			delegated: []write{{"foo", 3, nil}, {"bar", 3, nil}},
+		},
+		{
+			name:      "delegate error before reaching newline",
+			calls:     []write{{"foo\n", 1, errors.New("test")}, {"oo\n", 3, nil}},
+			delegated: []write{{"foo", 1, errors.New("test")}, {"oo", 2, nil}},
+		},
+		{
+			name:      "delegate error after reaching newline",
+			calls:     []write{{"foo\n", 4, errors.New("test")}},
+			delegated: []write{{"foo", 3, errors.New("test")}},
+		},
+		{
+			name:      "delegate error flushing newline",
+			calls:     []write{{"foo\n", 4, nil}, {"\n", 0, errors.New("test")}, {"\n", 1, nil}},
+			delegated: []write{{"foo", 3, nil}, {"\n", 0, errors.New("test")}, {"\n", 1, nil}},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			w := &trailingLinefeedSuppressor{delegate: &mockWriter{t: t, calls: tc.delegated}}
+			for _, call := range tc.calls {
+				n, err := w.Write([]byte(call.p))
+				if n != call.n {
+					t.Errorf("unexpected n: want %d got %d", call.n, n)
+				}
+				if (err == nil) != (call.err == nil) || call.err != nil && call.err.Error() != err.Error() {
+					t.Errorf("unexpected error: want %v got %v", call.err, err)
+				}
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/raw.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/raw.go
new file mode 100644
index 0000000000..6d4f283cae
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/raw.go
@@ -0,0 +1,236 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cbor
+
+import (
+	"fmt"
+	"reflect"
+	"sync"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+var sharedTranscoders transcoders
+
+var rawTypeTranscodeFuncs = map[reflect.Type]func(reflect.Value) error{
+	reflect.TypeFor[runtime.RawExtension](): func(rv reflect.Value) error {
+		if !rv.CanAddr() {
+			return nil
+		}
+		re := rv.Addr().Interface().(*runtime.RawExtension)
+		if re.Raw == nil {
+			// When Raw is nil it encodes to null. Don't change nil Raw values during
+			// transcoding, they would have unmarshalled from JSON as nil too.
+			return nil
+		}
+		j, err := re.MarshalJSON()
+		if err != nil {
+			return fmt.Errorf("failed to transcode RawExtension to JSON: %w", err)
+		}
+		re.Raw = j
+		return nil
+	},
+	reflect.TypeFor[metav1.FieldsV1](): func(rv reflect.Value) error {
+		if !rv.CanAddr() {
+			return nil
+		}
+		fields := rv.Addr().Interface().(*metav1.FieldsV1)
+		if fields.GetRawReader().Size() == 0 {
+			// When Raw is nil it encodes to null. Don't change nil Raw values during
+			// transcoding, they would have unmarshalled from JSON as nil too.
+			return nil
+		}
+		j, err := fields.MarshalJSON()
+		if err != nil {
+			return fmt.Errorf("failed to transcode FieldsV1 to JSON: %w", err)
+		}
+		fields.SetRawBytes(j)
+		return nil
+	},
+}
+
+func transcodeRawTypes(v interface{}) error {
+	if v == nil {
+		return nil
+	}
+
+	rv := reflect.ValueOf(v)
+	return sharedTranscoders.getTranscoder(rv.Type()).fn(rv)
+}
+
+type transcoder struct {
+	fn func(rv reflect.Value) error
+}
+
+var noop = transcoder{
+	fn: func(reflect.Value) error {
+		return nil
+	},
+}
+
+type transcoders struct {
+	lock sync.RWMutex
+	m    map[reflect.Type]**transcoder
+}
+
+func (ts *transcoders) getTranscoder(rt reflect.Type) transcoder {
+	ts.lock.RLock()
+	tpp, ok := ts.m[rt]
+	ts.lock.RUnlock()
+	if ok {
+		return **tpp
+	}
+
+	ts.lock.Lock()
+	defer ts.lock.Unlock()
+	tp := ts.getTranscoderLocked(rt)
+	return *tp
+}
+
+func (ts *transcoders) getTranscoderLocked(rt reflect.Type) *transcoder {
+	if tpp, ok := ts.m[rt]; ok {
+		// A transcoder for this type was cached while waiting to acquire the lock.
+		return *tpp
+	}
+
+	// Cache the transcoder now, before populating fn, so that circular references between types
+	// don't overflow the call stack.
+	t := new(transcoder)
+	if ts.m == nil {
+		ts.m = make(map[reflect.Type]**transcoder)
+	}
+	ts.m[rt] = &t
+
+	for rawType, fn := range rawTypeTranscodeFuncs {
+		if rt == rawType {
+			t = &transcoder{fn: fn}
+			return t
+		}
+	}
+
+	switch rt.Kind() {
+	case reflect.Array:
+		te := ts.getTranscoderLocked(rt.Elem())
+		rtlen := rt.Len()
+		if rtlen == 0 || te == &noop {
+			t = &noop
+			break
+		}
+		t.fn = func(rv reflect.Value) error {
+			for i := 0; i < rtlen; i++ {
+				if err := te.fn(rv.Index(i)); err != nil {
+					return err
+				}
+			}
+			return nil
+		}
+	case reflect.Interface:
+		// Any interface value might have a dynamic type involving RawExtension. It needs to
+		// be checked.
+		t.fn = func(rv reflect.Value) error {
+			if rv.IsNil() {
+				return nil
+			}
+			rv = rv.Elem()
+			// The interface element's type is dynamic so its transcoder can't be
+			// determined statically.
+			return ts.getTranscoder(rv.Type()).fn(rv)
+		}
+	case reflect.Map:
+		rtk := rt.Key()
+		tk := ts.getTranscoderLocked(rtk)
+		rte := rt.Elem()
+		te := ts.getTranscoderLocked(rte)
+		if tk == &noop && te == &noop {
+			t = &noop
+			break
+		}
+		t.fn = func(rv reflect.Value) error {
+			iter := rv.MapRange()
+			rvk := reflect.New(rtk).Elem()
+			rve := reflect.New(rte).Elem()
+			for iter.Next() {
+				rvk.SetIterKey(iter)
+				if err := tk.fn(rvk); err != nil {
+					return err
+				}
+				rve.SetIterValue(iter)
+				if err := te.fn(rve); err != nil {
+					return err
+				}
+			}
+			return nil
+		}
+	case reflect.Pointer:
+		te := ts.getTranscoderLocked(rt.Elem())
+		if te == &noop {
+			t = &noop
+			break
+		}
+		t.fn = func(rv reflect.Value) error {
+			if rv.IsNil() {
+				return nil
+			}
+			return te.fn(rv.Elem())
+		}
+	case reflect.Slice:
+		te := ts.getTranscoderLocked(rt.Elem())
+		if te == &noop {
+			t = &noop
+			break
+		}
+		t.fn = func(rv reflect.Value) error {
+			for i := 0; i < rv.Len(); i++ {
+				if err := te.fn(rv.Index(i)); err != nil {
+					return err
+				}
+			}
+			return nil
+		}
+	case reflect.Struct:
+		type fieldTranscoder struct {
+			Index      int
+			Transcoder *transcoder
+		}
+		var fieldTranscoders []fieldTranscoder
+		for i := 0; i < rt.NumField(); i++ {
+			f := rt.Field(i)
+			tf := ts.getTranscoderLocked(f.Type)
+			if tf == &noop {
+				continue
+			}
+			fieldTranscoders = append(fieldTranscoders, fieldTranscoder{Index: i, Transcoder: tf})
+		}
+		if len(fieldTranscoders) == 0 {
+			t = &noop
+			break
+		}
+		t.fn = func(rv reflect.Value) error {
+			for _, ft := range fieldTranscoders {
+				if err := ft.Transcoder.fn(rv.Field(ft.Index)); err != nil {
+					return err
+				}
+			}
+			return nil
+		}
+	default:
+		t = &noop
+	}
+
+	return t
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/raw_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/raw_test.go
new file mode 100644
index 0000000000..5f6b140e41
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/raw_test.go
@@ -0,0 +1,189 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cbor
+
+import (
+	"fmt"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestTranscodeRawTypes(t *testing.T) {
+	for _, tc := range []struct {
+		In  interface{}
+		Out interface{}
+	}{
+		{
+			In:  nil,
+			Out: nil,
+		},
+		{
+			In:  &runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}},
+			Out: &runtime.RawExtension{Raw: []byte(`7`)},
+		},
+		{
+			In:  &runtime.RawExtension{},
+			Out: &runtime.RawExtension{},
+		},
+		{
+			In:  runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}},
+			Out: runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}, // not addressable
+		},
+		{
+			In:  &[...]runtime.RawExtension{{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}, {Raw: []byte{0xd9, 0xd9, 0xf7, 0x08}}, {Raw: []byte{0xd9, 0xd9, 0xf7, 0x09}}},
+			Out: &[...]runtime.RawExtension{{Raw: []byte(`7`)}, {Raw: []byte(`8`)}, {Raw: []byte(`9`)}},
+		},
+		{
+			In:  &[0]runtime.RawExtension{},
+			Out: &[0]runtime.RawExtension{},
+		},
+		{
+			In:  &[]runtime.RawExtension{{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}, {Raw: []byte{0xd9, 0xd9, 0xf7, 0x08}}, {Raw: []byte{0xd9, 0xd9, 0xf7, 0x09}}},
+			Out: &[]runtime.RawExtension{{Raw: []byte(`7`)}, {Raw: []byte(`8`)}, {Raw: []byte(`9`)}},
+		},
+		{
+			In:  &[]runtime.RawExtension{},
+			Out: &[]runtime.RawExtension{},
+		},
+		{
+			In:  &[]string{"foo"},
+			Out: &[]string{"foo"},
+		},
+		{
+			In:  (*runtime.RawExtension)(nil),
+			Out: (*runtime.RawExtension)(nil),
+		},
+		{
+			In:  &struct{ I fmt.Stringer }{I: &runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}},
+			Out: &struct{ I fmt.Stringer }{I: &runtime.RawExtension{Raw: []byte(`7`)}},
+		},
+		{
+			In:  &struct{ I fmt.Stringer }{I: nil},
+			Out: &struct{ I fmt.Stringer }{I: nil},
+		},
+		{
+			In:  &struct{ I int64 }{I: 7},
+			Out: &struct{ I int64 }{I: 7},
+		},
+		{
+			In: &struct {
+				E runtime.RawExtension
+				I int64
+			}{E: runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}, I: 7},
+			Out: &struct {
+				E runtime.RawExtension
+				I int64
+			}{E: runtime.RawExtension{Raw: []byte(`7`)}, I: 7},
+		},
+		{
+			In: &struct {
+				runtime.RawExtension
+			}{RawExtension: runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}},
+			Out: &struct {
+				runtime.RawExtension
+			}{RawExtension: runtime.RawExtension{Raw: []byte(`7`)}},
+		},
+		{
+			In:  &map[string]string{"hello": "world"},
+			Out: &map[string]string{"hello": "world"},
+		},
+		{
+			In:  &map[string]runtime.RawExtension{"hello": {Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}},
+			Out: &map[string]runtime.RawExtension{"hello": {Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}}, // not addressable
+		},
+		{
+			In:  &map[string][]runtime.RawExtension{"hello": {{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}}},
+			Out: &map[string][]runtime.RawExtension{"hello": {{Raw: []byte(`7`)}}},
+		},
+		{
+			In:  metav1.NewFieldsV1(string([]byte{0xa0})),
+			Out: metav1.NewFieldsV1(`{}`),
+		},
+		{
+			In:  &metav1.FieldsV1{},
+			Out: &metav1.FieldsV1{},
+		},
+		{
+			In:  *metav1.NewFieldsV1(string([]byte{0xa0})),
+			Out: *metav1.NewFieldsV1(string([]byte{0xa0})), // not addressable
+		},
+		{
+			In:  &[...]metav1.FieldsV1{*metav1.NewFieldsV1(string([]byte{0xa0})), *metav1.NewFieldsV1(string([]byte{0xf6}))},
+			Out: &[...]metav1.FieldsV1{*metav1.NewFieldsV1(`{}`), *metav1.NewFieldsV1(`null`)},
+		},
+		{
+			In:  &[0]metav1.FieldsV1{},
+			Out: &[0]metav1.FieldsV1{},
+		},
+		{
+			In:  &[]metav1.FieldsV1{*metav1.NewFieldsV1(string([]byte{0xa0})), *metav1.NewFieldsV1(string([]byte{0xf6}))},
+			Out: &[]metav1.FieldsV1{*metav1.NewFieldsV1(`{}`), *metav1.NewFieldsV1(`null`)},
+		},
+		{
+			In:  &[]metav1.FieldsV1{},
+			Out: &[]metav1.FieldsV1{},
+		},
+		{
+			In:  (*metav1.FieldsV1)(nil),
+			Out: (*metav1.FieldsV1)(nil),
+		},
+		{
+			In:  &struct{ I fmt.Stringer }{I: metav1.NewFieldsV1(string([]byte{0xa0}))},
+			Out: &struct{ I fmt.Stringer }{I: metav1.NewFieldsV1(`{}`)},
+		},
+		{
+			In: &struct {
+				E metav1.FieldsV1
+				I int64
+			}{E: *metav1.NewFieldsV1(string([]byte{0xa0})), I: 7},
+			Out: &struct {
+				E metav1.FieldsV1
+				I int64
+			}{E: *metav1.NewFieldsV1(`{}`), I: 7},
+		},
+		{
+			In: &struct {
+				metav1.FieldsV1
+			}{FieldsV1: *metav1.NewFieldsV1(string([]byte{0xa0}))},
+			Out: &struct {
+				metav1.FieldsV1
+			}{FieldsV1: *metav1.NewFieldsV1(`{}`)},
+		},
+		{
+			In:  &map[string]metav1.FieldsV1{"hello": *metav1.NewFieldsV1(string([]byte{0xa0}))},
+			Out: &map[string]metav1.FieldsV1{"hello": *metav1.NewFieldsV1(string([]byte{0xa0}))}, // not addressable
+		},
+		{
+			In:  &map[string][]metav1.FieldsV1{"hello": {*metav1.NewFieldsV1(string([]byte{0xa0}))}},
+			Out: &map[string][]metav1.FieldsV1{"hello": {*metav1.NewFieldsV1(`{}`)}},
+		},
+	} {
+		t.Run(fmt.Sprintf("%#v", tc.In), func(t *testing.T) {
+			if err := transcodeRawTypes(tc.In); err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			if diff := cmp.Diff(tc.Out, tc.In); diff != "" {
+				t.Errorf("unexpected diff:\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/codec_factory.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/codec_factory.go
new file mode 100644
index 0000000000..81286fccb4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/codec_factory.go
@@ -0,0 +1,322 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serializer
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+	"k8s.io/apimachinery/pkg/runtime/serializer/protobuf"
+	"k8s.io/apimachinery/pkg/runtime/serializer/recognizer"
+	"k8s.io/apimachinery/pkg/runtime/serializer/versioning"
+)
+
+func newSerializersForScheme(scheme *runtime.Scheme, mf json.MetaFactory, options CodecFactoryOptions) []runtime.SerializerInfo {
+	jsonSerializer := json.NewSerializerWithOptions(
+		mf, scheme, scheme,
+		json.SerializerOptions{Yaml: false, Pretty: false, Strict: options.Strict, StreamingCollectionsEncoding: options.StreamingCollectionsEncodingToJSON},
+	)
+	jsonSerializerType := runtime.SerializerInfo{
+		MediaType:        runtime.ContentTypeJSON,
+		MediaTypeType:    "application",
+		MediaTypeSubType: "json",
+		EncodesAsText:    true,
+		Serializer:       jsonSerializer,
+		StrictSerializer: json.NewSerializerWithOptions(
+			mf, scheme, scheme,
+			json.SerializerOptions{Yaml: false, Pretty: false, Strict: true, StreamingCollectionsEncoding: options.StreamingCollectionsEncodingToJSON},
+		),
+		StreamSerializer: &runtime.StreamSerializerInfo{
+			EncodesAsText: true,
+			Serializer:    jsonSerializer,
+			Framer:        json.Framer,
+		},
+	}
+	if options.Pretty {
+		jsonSerializerType.PrettySerializer = json.NewSerializerWithOptions(
+			mf, scheme, scheme,
+			json.SerializerOptions{Yaml: false, Pretty: true, Strict: options.Strict},
+		)
+	}
+
+	yamlSerializer := json.NewSerializerWithOptions(
+		mf, scheme, scheme,
+		json.SerializerOptions{Yaml: true, Pretty: false, Strict: options.Strict},
+	)
+	strictYAMLSerializer := json.NewSerializerWithOptions(
+		mf, scheme, scheme,
+		json.SerializerOptions{Yaml: true, Pretty: false, Strict: true},
+	)
+	protoSerializer := protobuf.NewSerializerWithOptions(scheme, scheme, protobuf.SerializerOptions{
+		StreamingCollectionsEncoding: options.StreamingCollectionsEncodingToProtobuf,
+	})
+	protoRawSerializer := protobuf.NewRawSerializer(scheme, scheme)
+
+	serializers := []runtime.SerializerInfo{
+		jsonSerializerType,
+		{
+			MediaType:        runtime.ContentTypeYAML,
+			MediaTypeType:    "application",
+			MediaTypeSubType: "yaml",
+			EncodesAsText:    true,
+			Serializer:       yamlSerializer,
+			StrictSerializer: strictYAMLSerializer,
+		},
+		{
+			MediaType:        runtime.ContentTypeProtobuf,
+			MediaTypeType:    "application",
+			MediaTypeSubType: "vnd.kubernetes.protobuf",
+			Serializer:       protoSerializer,
+			// note, strict decoding is unsupported for protobuf,
+			// fall back to regular serializing
+			StrictSerializer: protoSerializer,
+			StreamSerializer: &runtime.StreamSerializerInfo{
+				Serializer: protoRawSerializer,
+				Framer:     protobuf.LengthDelimitedFramer,
+			},
+		},
+	}
+
+	for _, f := range options.serializers {
+		serializers = append(serializers, f(scheme, scheme))
+	}
+
+	return serializers
+}
+
+// CodecFactory provides methods for retrieving codecs and serializers for specific
+// versions and content types.
+type CodecFactory struct {
+	scheme    *runtime.Scheme
+	universal runtime.Decoder
+	accepts   []runtime.SerializerInfo
+
+	legacySerializer runtime.Serializer
+}
+
+// CodecFactoryOptions holds the options for configuring CodecFactory behavior
+type CodecFactoryOptions struct {
+	// Strict configures all serializers in strict mode
+	Strict bool
+	// Pretty includes a pretty serializer along with the non-pretty one
+	Pretty bool
+
+	StreamingCollectionsEncodingToJSON     bool
+	StreamingCollectionsEncodingToProtobuf bool
+
+	serializers []func(runtime.ObjectCreater, runtime.ObjectTyper) runtime.SerializerInfo
+}
+
+// CodecFactoryOptionsMutator takes a pointer to an options struct and then modifies it.
+// Functions implementing this type can be passed to the NewCodecFactory() constructor.
+type CodecFactoryOptionsMutator func(*CodecFactoryOptions)
+
+// EnablePretty enables including a pretty serializer along with the non-pretty one
+func EnablePretty(options *CodecFactoryOptions) {
+	options.Pretty = true
+}
+
+// DisablePretty disables including a pretty serializer along with the non-pretty one
+func DisablePretty(options *CodecFactoryOptions) {
+	options.Pretty = false
+}
+
+// EnableStrict enables configuring all serializers in strict mode
+func EnableStrict(options *CodecFactoryOptions) {
+	options.Strict = true
+}
+
+// DisableStrict disables configuring all serializers in strict mode
+func DisableStrict(options *CodecFactoryOptions) {
+	options.Strict = false
+}
+
+// WithSerializer configures a serializer to be supported in addition to the default serializers.
+func WithSerializer(f func(runtime.ObjectCreater, runtime.ObjectTyper) runtime.SerializerInfo) CodecFactoryOptionsMutator {
+	return func(options *CodecFactoryOptions) {
+		options.serializers = append(options.serializers, f)
+	}
+}
+
+func WithStreamingCollectionEncodingToJSON() CodecFactoryOptionsMutator {
+	return func(options *CodecFactoryOptions) {
+		options.StreamingCollectionsEncodingToJSON = true
+	}
+}
+
+func WithStreamingCollectionEncodingToProtobuf() CodecFactoryOptionsMutator {
+	return func(options *CodecFactoryOptions) {
+		options.StreamingCollectionsEncodingToProtobuf = true
+	}
+}
+
+// NewCodecFactory provides methods for retrieving serializers for the supported wire formats
+// and conversion wrappers to define preferred internal and external versions. In the future,
+// as the internal version is used less, callers may instead use a defaulting serializer and
+// only convert objects which are shared internally (Status, common API machinery).
+//
+// Mutators can be passed to change the CodecFactoryOptions before construction of the factory.
+// It is recommended to explicitly pass mutators instead of relying on defaults.
+// By default, Pretty is enabled -- this is conformant with previously supported behavior.
+//
+// TODO: allow other codecs to be compiled in?
+// TODO: accept a scheme interface
+func NewCodecFactory(scheme *runtime.Scheme, mutators ...CodecFactoryOptionsMutator) CodecFactory {
+	options := CodecFactoryOptions{Pretty: true}
+	for _, fn := range mutators {
+		fn(&options)
+	}
+
+	serializers := newSerializersForScheme(scheme, json.DefaultMetaFactory, options)
+	return newCodecFactory(scheme, serializers)
+}
+
+// newCodecFactory is a helper for testing that allows a different metafactory to be specified.
+func newCodecFactory(scheme *runtime.Scheme, serializers []runtime.SerializerInfo) CodecFactory {
+	decoders := make([]runtime.Decoder, 0, len(serializers))
+	var accepts []runtime.SerializerInfo
+	alreadyAccepted := make(map[string]struct{})
+
+	var legacySerializer runtime.Serializer
+	for _, d := range serializers {
+		decoders = append(decoders, d.Serializer)
+		if _, ok := alreadyAccepted[d.MediaType]; ok {
+			continue
+		}
+		alreadyAccepted[d.MediaType] = struct{}{}
+
+		acceptedSerializerShallowCopy := d
+		if d.StreamSerializer != nil {
+			cloned := *d.StreamSerializer
+			acceptedSerializerShallowCopy.StreamSerializer = &cloned
+		}
+		accepts = append(accepts, acceptedSerializerShallowCopy)
+
+		if d.MediaType == runtime.ContentTypeJSON {
+			legacySerializer = d.Serializer
+		}
+	}
+	if legacySerializer == nil {
+		legacySerializer = serializers[0].Serializer
+	}
+
+	return CodecFactory{
+		scheme:    scheme,
+		universal: recognizer.NewDecoder(decoders...),
+
+		accepts: accepts,
+
+		legacySerializer: legacySerializer,
+	}
+}
+
+// WithoutConversion returns a NegotiatedSerializer that performs no conversion, even if the
+// caller requests it.
+func (f CodecFactory) WithoutConversion() runtime.NegotiatedSerializer {
+	return WithoutConversionCodecFactory{f}
+}
+
+// SupportedMediaTypes returns the RFC2046 media types that this factory has serializers for.
+func (f CodecFactory) SupportedMediaTypes() []runtime.SerializerInfo {
+	return f.accepts
+}
+
+// LegacyCodec encodes output to a given API versions, and decodes output into the internal form from
+// any recognized source. The returned codec will always encode output to JSON. If a type is not
+// found in the list of versions an error will be returned.
+//
+// This method is deprecated - clients and servers should negotiate a serializer by mime-type and
+// invoke CodecForVersions. Callers that need only to read data should use UniversalDecoder().
+//
+// TODO: make this call exist only in pkg/api, and initialize it with the set of default versions.
+// All other callers will be forced to request a Codec directly.
+func (f CodecFactory) LegacyCodec(version ...schema.GroupVersion) runtime.Codec {
+	return versioning.NewDefaultingCodecForScheme(f.scheme, f.legacySerializer, f.universal, schema.GroupVersions(version), runtime.InternalGroupVersioner)
+}
+
+// UniversalDeserializer can convert any stored data recognized by this factory into a Go object that satisfies
+// runtime.Object. It does not perform conversion. It does not perform defaulting.
+func (f CodecFactory) UniversalDeserializer() runtime.Decoder {
+	return f.universal
+}
+
+// UniversalDecoder returns a runtime.Decoder capable of decoding all known API objects in all known formats. Used
+// by clients that do not need to encode objects but want to deserialize API objects stored on disk. Only decodes
+// objects in groups registered with the scheme. The GroupVersions passed may be used to select alternate
+// versions of objects to return - by default, runtime.APIVersionInternal is used. If any versions are specified,
+// unrecognized groups will be returned in the version they are encoded as (no conversion). This decoder performs
+// defaulting.
+//
+// TODO: the decoder will eventually be removed in favor of dealing with objects in their versioned form
+// TODO: only accept a group versioner
+func (f CodecFactory) UniversalDecoder(versions ...schema.GroupVersion) runtime.Decoder {
+	var versioner runtime.GroupVersioner
+	if len(versions) == 0 {
+		versioner = runtime.InternalGroupVersioner
+	} else {
+		versioner = schema.GroupVersions(versions)
+	}
+	return f.CodecForVersions(nil, f.universal, nil, versioner)
+}
+
+// CodecForVersions creates a codec with the provided serializer. If an object is decoded and its group is not in the list,
+// it will default to runtime.APIVersionInternal. If encode is not specified for an object's group, the object is not
+// converted. If encode or decode are nil, no conversion is performed.
+func (f CodecFactory) CodecForVersions(encoder runtime.Encoder, decoder runtime.Decoder, encode runtime.GroupVersioner, decode runtime.GroupVersioner) runtime.Codec {
+	// TODO: these are for backcompat, remove them in the future
+	if encode == nil {
+		encode = runtime.DisabledGroupVersioner
+	}
+	if decode == nil {
+		decode = runtime.InternalGroupVersioner
+	}
+	return versioning.NewDefaultingCodecForScheme(f.scheme, encoder, decoder, encode, decode)
+}
+
+// DecoderToVersion returns a decoder that targets the provided group version.
+func (f CodecFactory) DecoderToVersion(decoder runtime.Decoder, gv runtime.GroupVersioner) runtime.Decoder {
+	return f.CodecForVersions(nil, decoder, nil, gv)
+}
+
+// EncoderForVersion returns an encoder that targets the provided group version.
+func (f CodecFactory) EncoderForVersion(encoder runtime.Encoder, gv runtime.GroupVersioner) runtime.Encoder {
+	return f.CodecForVersions(encoder, nil, gv, nil)
+}
+
+// WithoutConversionCodecFactory is a CodecFactory that will explicitly ignore requests to perform conversion.
+// This wrapper is used while code migrates away from using conversion (such as external clients) and in the future
+// will be unnecessary when we change the signature of NegotiatedSerializer.
+type WithoutConversionCodecFactory struct {
+	CodecFactory
+}
+
+// EncoderForVersion returns an encoder that does not do conversion, but does set the group version kind of the object
+// when serialized.
+func (f WithoutConversionCodecFactory) EncoderForVersion(serializer runtime.Encoder, version runtime.GroupVersioner) runtime.Encoder {
+	return runtime.WithVersionEncoder{
+		Version:     version,
+		Encoder:     serializer,
+		ObjectTyper: f.CodecFactory.scheme,
+	}
+}
+
+// DecoderToVersion returns an decoder that does not do conversion.
+func (f WithoutConversionCodecFactory) DecoderToVersion(serializer runtime.Decoder, _ runtime.GroupVersioner) runtime.Decoder {
+	return runtime.WithoutVersionDecoder{
+		Decoder: serializer,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/codec_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/codec_test.go
new file mode 100644
index 0000000000..ceb6f93da8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/codec_test.go
@@ -0,0 +1,370 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serializer
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"os"
+	"reflect"
+	"strings"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+	"k8s.io/apimachinery/pkg/util/diff"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+
+	"github.com/google/go-cmp/cmp"
+	flag "github.com/spf13/pflag"
+	"sigs.k8s.io/randfill"
+	"sigs.k8s.io/yaml"
+)
+
+var fuzzIters = flag.Int("fuzz-iters", 50, "How many fuzzing iterations to do.")
+
+type testMetaFactory struct{}
+
+func (testMetaFactory) Interpret(data []byte) (*schema.GroupVersionKind, error) {
+	findKind := struct {
+		APIVersion string `json:"myVersionKey,omitempty"`
+		ObjectKind string `json:"myKindKey,omitempty"`
+	}{}
+	// yaml is a superset of json, so we use it to decode here. That way,
+	// we understand both.
+	if err := yaml.Unmarshal(data, &findKind); err != nil {
+		return nil, fmt.Errorf("couldn't get version/kind: %v", err)
+	}
+	gv, err := schema.ParseGroupVersion(findKind.APIVersion)
+	if err != nil {
+		return nil, err
+	}
+	return &schema.GroupVersionKind{Group: gv.Group, Version: gv.Version, Kind: findKind.ObjectKind}, nil
+}
+
+// TestObjectFuzzer can randomly populate all the above objects.
+var TestObjectFuzzer = randfill.New().NilChance(.5).NumElements(1, 100).Funcs(
+	func(j *runtimetesting.MyWeirdCustomEmbeddedVersionKindField, c randfill.Continue) {
+		c.FillNoCustom(j)
+		j.APIVersion = ""
+		j.ObjectKind = ""
+	},
+)
+
+// Returns a new Scheme set up with the test objects.
+func GetTestScheme() (*runtime.Scheme, runtime.Codec) {
+	internalGV := schema.GroupVersion{Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Version: "v1"}
+	externalGV2 := schema.GroupVersion{Version: "v2"}
+
+	s := runtime.NewScheme()
+	// Ordinarily, we wouldn't add TestType2, but because this is a test and
+	// both types are from the same package, we need to get it into the system
+	// so that converter will match it with ExternalType2.
+	s.AddKnownTypes(internalGV, &runtimetesting.TestType1{}, &runtimetesting.TestType2{}, &runtimetesting.ExternalInternalSame{})
+	s.AddKnownTypes(externalGV, &runtimetesting.ExternalInternalSame{})
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType1"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType2"), &runtimetesting.ExternalTestType2{})
+	s.AddKnownTypeWithName(internalGV.WithKind("TestType3"), &runtimetesting.TestType1{})
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType3"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(externalGV2.WithKind("TestType1"), &runtimetesting.ExternalTestType1{})
+
+	s.AddUnversionedTypes(externalGV, &metav1.Status{})
+
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+
+	cf := newCodecFactory(s, newSerializersForScheme(s, testMetaFactory{}, CodecFactoryOptions{Pretty: true, Strict: true}))
+	codec := cf.LegacyCodec(schema.GroupVersion{Version: "v1"})
+	return s, codec
+}
+
+var semantic = conversion.EqualitiesOrDie(
+	func(a, b runtimetesting.MyWeirdCustomEmbeddedVersionKindField) bool {
+		a.APIVersion, a.ObjectKind = "", ""
+		b.APIVersion, b.ObjectKind = "", ""
+		return a == b
+	},
+)
+
+func runTest(t *testing.T, source interface{}) {
+	name := reflect.TypeOf(source).Elem().Name()
+	TestObjectFuzzer.Fill(source)
+
+	_, codec := GetTestScheme()
+	data, err := runtime.Encode(codec, source.(runtime.Object))
+	if err != nil {
+		t.Errorf("%v: %v (%#v)", name, err, source)
+		return
+	}
+	obj2, err := runtime.Decode(codec, data)
+	if err != nil {
+		t.Errorf("%v: %v (%v)", name, err, string(data))
+		return
+	}
+	if !semantic.DeepEqual(source, obj2) {
+		t.Errorf("1: %v: diff: %v", name, diff.ObjectGoPrintSideBySide(source, obj2))
+		return
+	}
+	obj3 := reflect.New(reflect.TypeOf(source).Elem()).Interface()
+	if err := runtime.DecodeInto(codec, data, obj3.(runtime.Object)); err != nil {
+		t.Errorf("2: %v: %v", name, err)
+		return
+	}
+	if !semantic.DeepEqual(source, obj3) {
+		t.Errorf("3: %v: diff: %v", name, cmp.Diff(source, obj3))
+		return
+	}
+}
+
+func TestTypes(t *testing.T) {
+	table := []interface{}{
+		&runtimetesting.TestType1{},
+		&runtimetesting.ExternalInternalSame{},
+	}
+	for _, item := range table {
+		// Try a few times, since runTest uses random values.
+		for i := 0; i < *fuzzIters; i++ {
+			runTest(t, item)
+		}
+	}
+}
+
+func TestVersionedEncoding(t *testing.T) {
+	s, _ := GetTestScheme()
+	cf := newCodecFactory(s, newSerializersForScheme(s, testMetaFactory{}, CodecFactoryOptions{Pretty: true, Strict: true}))
+	info, _ := runtime.SerializerInfoForMediaType(cf.SupportedMediaTypes(), runtime.ContentTypeJSON)
+	encoder := info.Serializer
+
+	codec := cf.EncoderForVersion(encoder, schema.GroupVersion{Version: "v2"})
+	out, err := runtime.Encode(codec, &runtimetesting.TestType1{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(out) != `{"myVersionKey":"v2","myKindKey":"TestType1"}`+"\n" {
+		t.Fatal(string(out))
+	}
+
+	codec = cf.EncoderForVersion(encoder, schema.GroupVersion{Version: "v3"})
+	_, err = runtime.Encode(codec, &runtimetesting.TestType1{})
+	if err == nil {
+		t.Fatal(err)
+	}
+
+	// unversioned encode with no versions is written directly to wire
+	codec = cf.EncoderForVersion(encoder, runtime.InternalGroupVersioner)
+	out, err = runtime.Encode(codec, &runtimetesting.TestType1{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(out) != `{}`+"\n" {
+		t.Fatal(string(out))
+	}
+}
+
+func TestMultipleNames(t *testing.T) {
+	_, codec := GetTestScheme()
+
+	obj, _, err := codec.Decode([]byte(`{"myKindKey":"TestType3","myVersionKey":"v1","A":"value"}`), nil, nil)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	internal := obj.(*runtimetesting.TestType1)
+	if internal.A != "value" {
+		t.Fatalf("unexpected decoded object: %#v", internal)
+	}
+
+	out, err := runtime.Encode(codec, internal)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(string(out), `"myKindKey":"TestType1"`) {
+		t.Errorf("unexpected encoded output: %s", string(out))
+	}
+}
+
+func TestStrictOption(t *testing.T) {
+	s, _ := GetTestScheme()
+	duplicateKeys := `{"myKindKey":"TestType3","myVersionKey":"v1","myVersionKey":"v1","A":"value"}`
+
+	strictCodec := newCodecFactory(s, newSerializersForScheme(s, testMetaFactory{}, CodecFactoryOptions{Pretty: true, Strict: true})).LegacyCodec()
+	_, _, err := strictCodec.Decode([]byte(duplicateKeys), nil, nil)
+	if !runtime.IsStrictDecodingError(err) {
+		t.Fatalf("StrictDecodingError not returned on object with duplicate keys: %v, type: %v", err, reflect.TypeOf(err))
+	}
+
+	nonStrictCodec := newCodecFactory(s, newSerializersForScheme(s, testMetaFactory{}, CodecFactoryOptions{Pretty: true, Strict: false})).LegacyCodec()
+	_, _, err = nonStrictCodec.Decode([]byte(duplicateKeys), nil, nil)
+	if runtime.IsStrictDecodingError(err) {
+		t.Fatalf("Non-Strict decoder returned a StrictDecodingError: %v", err)
+	}
+}
+
+func TestConvertTypesWhenDefaultNamesMatch(t *testing.T) {
+	internalGV := schema.GroupVersion{Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Version: "v1"}
+
+	s := runtime.NewScheme()
+	// create two names internally, with TestType1 being preferred
+	s.AddKnownTypeWithName(internalGV.WithKind("TestType1"), &runtimetesting.TestType1{})
+	s.AddKnownTypeWithName(internalGV.WithKind("OtherType1"), &runtimetesting.TestType1{})
+	// create two names externally, with TestType1 being preferred
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType1"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(externalGV.WithKind("OtherType1"), &runtimetesting.ExternalTestType1{})
+	if err := runtimetesting.RegisterConversions(s); err != nil {
+		t.Fatalf("unexpected error; %v", err)
+	}
+
+	ext := &runtimetesting.ExternalTestType1{}
+	ext.APIVersion = "v1"
+	ext.ObjectKind = "OtherType1"
+	ext.A = "test"
+	data, err := json.Marshal(ext)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	expect := &runtimetesting.TestType1{A: "test"}
+
+	codec := newCodecFactory(
+		s, newSerializersForScheme(s, testMetaFactory{}, CodecFactoryOptions{Pretty: true, Strict: true}),
+	).LegacyCodec(schema.GroupVersion{Version: "v1"})
+
+	obj, err := runtime.Decode(codec, data)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !semantic.DeepEqual(expect, obj) {
+		t.Errorf("unexpected object: %#v", obj)
+	}
+
+	into := &runtimetesting.TestType1{}
+	if err := runtime.DecodeInto(codec, data, into); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !semantic.DeepEqual(expect, into) {
+		t.Errorf("unexpected object: %#v", obj)
+	}
+}
+
+func TestEncode_Ptr(t *testing.T) {
+	_, codec := GetTestScheme()
+	tt := &runtimetesting.TestType1{A: "I am a pointer object"}
+	data, err := runtime.Encode(codec, tt)
+	obj2, err2 := runtime.Decode(codec, data)
+	if err != nil || err2 != nil {
+		t.Fatalf("Failure: '%v' '%v'\n%s", err, err2, data)
+	}
+	if _, ok := obj2.(*runtimetesting.TestType1); !ok {
+		t.Fatalf("Got wrong type")
+	}
+	if !semantic.DeepEqual(obj2, tt) {
+		t.Errorf("Expected:\n %#v,\n Got:\n %#v", tt, obj2)
+	}
+}
+
+func TestBadJSONRejection(t *testing.T) {
+	log.SetOutput(os.Stderr)
+	_, codec := GetTestScheme()
+	badJSONs := [][]byte{
+		[]byte(`{"myVersionKey":"v1"}`),                          // Missing kind
+		[]byte(`{"myVersionKey":"v1","myKindKey":"bar"}`),        // Unknown kind
+		[]byte(`{"myVersionKey":"bar","myKindKey":"TestType1"}`), // Unknown version
+		[]byte(`{"myKindKey":"TestType1"}`),                      // Missing version
+	}
+	for _, b := range badJSONs {
+		if _, err := runtime.Decode(codec, b); err == nil {
+			t.Errorf("Did not reject bad json: %s", string(b))
+		}
+	}
+	badJSONKindMismatch := []byte(`{"myVersionKey":"v1","myKindKey":"ExternalInternalSame"}`)
+	if err := runtime.DecodeInto(codec, badJSONKindMismatch, &runtimetesting.TestType1{}); err == nil {
+		t.Errorf("Kind is set but doesn't match the object type: %s", badJSONKindMismatch)
+	}
+	if err := runtime.DecodeInto(codec, []byte(``), &runtimetesting.TestType1{}); err != nil {
+		t.Errorf("Should allow empty decode: %v", err)
+	}
+	if _, _, err := codec.Decode([]byte(``), &schema.GroupVersionKind{Kind: "ExternalInternalSame"}, nil); err == nil {
+		t.Errorf("Did not give error for empty data with only kind default")
+	}
+	if _, _, err := codec.Decode([]byte(`{"myVersionKey":"v1"}`), &schema.GroupVersionKind{Kind: "ExternalInternalSame"}, nil); err != nil {
+		t.Errorf("Gave error for version and kind default")
+	}
+	if _, _, err := codec.Decode([]byte(`{"myKindKey":"ExternalInternalSame"}`), &schema.GroupVersionKind{Version: "v1"}, nil); err != nil {
+		t.Errorf("Gave error for version and kind default")
+	}
+	if _, _, err := codec.Decode([]byte(``), &schema.GroupVersionKind{Kind: "ExternalInternalSame", Version: "v1"}, nil); err != nil {
+		t.Errorf("Gave error for version and kind defaulted: %v", err)
+	}
+	if _, err := runtime.Decode(codec, []byte(``)); err == nil {
+		t.Errorf("Did not give error for empty data")
+	}
+}
+
+// Returns a new Scheme set up with the test objects needed by TestDirectCodec.
+func GetDirectCodecTestScheme() *runtime.Scheme {
+	internalGV := schema.GroupVersion{Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Version: "v1"}
+
+	s := runtime.NewScheme()
+	// Ordinarily, we wouldn't add TestType2, but because this is a test and
+	// both types are from the same package, we need to get it into the system
+	// so that converter will match it with ExternalType2.
+	s.AddKnownTypes(internalGV, &runtimetesting.TestType1{})
+	s.AddKnownTypes(externalGV, &runtimetesting.ExternalTestType1{})
+
+	s.AddUnversionedTypes(externalGV, &metav1.Status{})
+
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+	return s
+}
+
+func TestDirectCodec(t *testing.T) {
+	s := GetDirectCodecTestScheme()
+	cf := newCodecFactory(s, newSerializersForScheme(s, testMetaFactory{}, CodecFactoryOptions{Pretty: true, Strict: true}))
+	info, _ := runtime.SerializerInfoForMediaType(cf.SupportedMediaTypes(), runtime.ContentTypeJSON)
+	serializer := info.Serializer
+	df := cf.WithoutConversion()
+	ignoredGV, err := schema.ParseGroupVersion("ignored group/ignored version")
+	if err != nil {
+		t.Fatal(err)
+	}
+	directEncoder := df.EncoderForVersion(serializer, ignoredGV)
+	directDecoder := df.DecoderToVersion(serializer, ignoredGV)
+	out, err := runtime.Encode(directEncoder, &runtimetesting.ExternalTestType1{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(out) != `{"myVersionKey":"v1","myKindKey":"ExternalTestType1"}`+"\n" {
+		t.Fatal(string(out))
+	}
+	a, _, err := directDecoder.Decode(out, nil, nil)
+	if err != nil {
+		t.Fatalf("error on Decode: %v", err)
+	}
+	e := &runtimetesting.ExternalTestType1{
+		MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{
+			APIVersion: "v1",
+			ObjectKind: "ExternalTestType1",
+		},
+	}
+	if !semantic.DeepEqual(e, a) {
+		t.Fatalf("expect %v, got %v", e, a)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/encoder_with_allocator_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/encoder_with_allocator_test.go
new file mode 100644
index 0000000000..73406d0731
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/encoder_with_allocator_test.go
@@ -0,0 +1,139 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serializer
+
+import (
+	"crypto/rand"
+	"io/ioutil"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	testapigroupv1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/protobuf"
+)
+
+func BenchmarkProtobufEncoder(b *testing.B) {
+	benchmarkEncodeFor(b, protobuf.NewSerializer(nil, nil))
+}
+
+func BenchmarkProtobufEncodeWithAllocator(b *testing.B) {
+	benchmarkEncodeWithAllocatorFor(b, protobuf.NewSerializer(nil, nil))
+}
+
+func BenchmarkRawProtobufEncoder(b *testing.B) {
+	benchmarkEncodeFor(b, protobuf.NewRawSerializer(nil, nil))
+}
+
+func BenchmarkRawProtobufEncodeWithAllocator(b *testing.B) {
+	benchmarkEncodeWithAllocatorFor(b, protobuf.NewRawSerializer(nil, nil))
+}
+
+func benchmarkEncodeFor(b *testing.B, target runtime.Encoder) {
+	for _, tc := range benchTestCases() {
+		b.Run(tc.name, func(b *testing.B) {
+			b.ReportAllocs()
+			for n := 0; n < b.N; n++ {
+				err := target.Encode(tc.obj, ioutil.Discard)
+				if err != nil {
+					b.Fatal(err)
+				}
+			}
+		})
+	}
+}
+
+func benchmarkEncodeWithAllocatorFor(b *testing.B, target runtime.EncoderWithAllocator) {
+	for _, tc := range benchTestCases() {
+		b.Run(tc.name, func(b *testing.B) {
+			b.ReportAllocs()
+			allocator := &runtime.Allocator{}
+			for n := 0; n < b.N; n++ {
+				err := target.EncodeWithAllocator(tc.obj, ioutil.Discard, allocator)
+				if err != nil {
+					b.Fatal(err)
+				}
+			}
+		})
+	}
+}
+
+type benchTestCase struct {
+	name string
+	obj  runtime.Object
+}
+
+func benchTestCases() []benchTestCase {
+	return []benchTestCase{
+		{
+			name: "an obj with 1kB payload",
+			obj: func() runtime.Object {
+				carpPayload := make([]byte, 1000) // 1 kB
+				if _, err := rand.Read(carpPayload); err != nil {
+					panic(err)
+				}
+				return carpWithPayload(carpPayload)
+			}(),
+		},
+		{
+			name: "an obj with 10kB payload",
+			obj: func() runtime.Object {
+				carpPayload := make([]byte, 10000) // 10 kB
+				if _, err := rand.Read(carpPayload); err != nil {
+					panic(err)
+				}
+				return carpWithPayload(carpPayload)
+			}(),
+		},
+		{
+			name: "an obj with 100kB payload",
+			obj: func() runtime.Object {
+				carpPayload := make([]byte, 100000) // 100 kB
+				if _, err := rand.Read(carpPayload); err != nil {
+					panic(err)
+				}
+				return carpWithPayload(carpPayload)
+			}(),
+		},
+		{
+			name: "an obj with 1MB payload",
+			obj: func() runtime.Object {
+				carpPayload := make([]byte, 1000000) // 1 MB
+				if _, err := rand.Read(carpPayload); err != nil {
+					panic(err)
+				}
+				return carpWithPayload(carpPayload)
+			}(),
+		},
+	}
+}
+
+func carpWithPayload(carpPayload []byte) *testapigroupv1.Carp {
+	gvk := &schema.GroupVersionKind{Group: "group", Version: "version", Kind: "Carp"}
+	return &testapigroupv1.Carp{
+		TypeMeta: metav1.TypeMeta{APIVersion: gvk.GroupVersion().String(), Kind: gvk.Kind},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "name",
+			Namespace: "namespace",
+		},
+		Spec: testapigroupv1.CarpSpec{
+			Subdomain:    "carp.k8s.io",
+			NodeSelector: map[string]string{"payload": string(carpPayload)},
+		},
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/collections.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/collections.go
new file mode 100644
index 0000000000..3fa6012dde
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/collections.go
@@ -0,0 +1,249 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"sort"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/conversion"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func streamEncodeCollections(obj runtime.Object, w io.Writer) (bool, error) {
+	list, ok := obj.(*unstructured.UnstructuredList)
+	if ok {
+		return true, newStreamEncoder(w).encodeUnstructuredList(list)
+	}
+	if _, ok := obj.(json.Marshaler); ok {
+		return false, nil
+	}
+	typeMeta, listMeta, items, err := getListMeta(obj)
+	if err == nil {
+		return true, newStreamEncoder(w).encodeList(typeMeta, listMeta, items)
+	}
+	return false, nil
+}
+
+// getListMeta implements list extraction logic for json stream serialization.
+//
+// Reason for a custom logic instead of reusing accessors from meta package:
+// * Validate json tags to prevent incompatibility with json standard package.
+// * ListMetaAccessor doesn't distinguish empty from nil value.
+// * TypeAccessort reparsing "apiVersion" and serializing it with "{group}/{version}"
+func getListMeta(list runtime.Object) (metav1.TypeMeta, metav1.ListMeta, []runtime.Object, error) {
+	listValue, err := conversion.EnforcePtr(list)
+	if err != nil {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, err
+	}
+	listType := listValue.Type()
+	if listType.NumField() != 3 {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected ListType to have 3 fields")
+	}
+	// TypeMeta
+	typeMeta, ok := listValue.Field(0).Interface().(metav1.TypeMeta)
+	if !ok {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected TypeMeta field to have TypeMeta type")
+	}
+	if !listType.Field(0).Anonymous {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be embedded`)
+	}
+	if jsonTag, jsonTagExists := listType.Field(0).Tag.Lookup("json"); !jsonTagExists {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag`)
+	} else if jsonTag != "" && jsonTag != ",inline" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be "" or ",inline"`)
+	}
+	// ListMeta
+	listMeta, ok := listValue.Field(1).Interface().(metav1.ListMeta)
+	if !ok {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected ListMeta field to have ListMeta type")
+	}
+	if listType.Field(1).Tag.Get("json") != "metadata,omitempty" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected ListMeta json field tag to be "metadata,omitempty"`)
+	}
+	// Items
+	items, err := meta.ExtractList(list)
+	if err != nil {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, err
+	}
+	if listType.Field(2).Tag.Get("json") != "items" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected Items json field tag to be "items"`)
+	}
+	return typeMeta, listMeta, items, nil
+}
+
+// streamEncoder encodes JSON values to w, reusing an internal buffer across
+// values to avoid the fresh output allocation json.Marshal makes per call.
+type streamEncoder struct {
+	w    io.Writer
+	buf  bytes.Buffer
+	json *json.Encoder
+}
+
+func newStreamEncoder(w io.Writer) *streamEncoder {
+	e := &streamEncoder{w: w}
+	e.json = json.NewEncoder(&e.buf)
+	return e
+}
+
+func (e *streamEncoder) encodeList(typeMeta metav1.TypeMeta, listMeta metav1.ListMeta, items []runtime.Object) error {
+	// Start
+	if _, err := e.w.Write([]byte(`{`)); err != nil {
+		return err
+	}
+
+	// TypeMeta
+	if typeMeta.Kind != "" {
+		if err := e.encodeKeyValuePair("kind", typeMeta.Kind, []byte(",")); err != nil {
+			return err
+		}
+	}
+	if typeMeta.APIVersion != "" {
+		if err := e.encodeKeyValuePair("apiVersion", typeMeta.APIVersion, []byte(",")); err != nil {
+			return err
+		}
+	}
+
+	// ListMeta
+	if err := e.encodeKeyValuePair("metadata", listMeta, []byte(",")); err != nil {
+		return err
+	}
+
+	// Items
+	if err := e.encodeItemsObjectSlice(items); err != nil {
+		return err
+	}
+
+	// End
+	_, err := e.w.Write([]byte("}\n"))
+	return err
+}
+
+func (e *streamEncoder) encodeItemsObjectSlice(items []runtime.Object) (err error) {
+	if items == nil {
+		err := e.encodeKeyValuePair("items", nil, nil)
+		return err
+	}
+	_, err = e.w.Write([]byte(`"items":[`))
+	if err != nil {
+		return err
+	}
+	suffix := []byte(",")
+	for i, item := range items {
+		if i == len(items)-1 {
+			suffix = nil
+		}
+		err := e.encodeValue(item, suffix)
+		if err != nil {
+			return err
+		}
+	}
+	_, err = e.w.Write([]byte("]"))
+	if err != nil {
+		return err
+	}
+	return err
+}
+
+func (e *streamEncoder) encodeUnstructuredList(list *unstructured.UnstructuredList) error {
+	_, err := e.w.Write([]byte(`{`))
+	if err != nil {
+		return err
+	}
+	keys := make([]string, 0, len(list.Object)+1)
+	for key := range list.Object {
+		keys = append(keys, key)
+	}
+	if _, exists := list.Object["items"]; !exists {
+		keys = append(keys, "items")
+	}
+	sort.Strings(keys)
+
+	suffix := []byte(",")
+	for i, key := range keys {
+		if i == len(keys)-1 {
+			suffix = nil
+		}
+		if key == "items" {
+			err = e.encodeItemsUnstructuredSlice(list.Items, suffix)
+		} else {
+			err = e.encodeKeyValuePair(key, list.Object[key], suffix)
+		}
+		if err != nil {
+			return err
+		}
+	}
+	_, err = e.w.Write([]byte("}\n"))
+	return err
+}
+
+func (e *streamEncoder) encodeItemsUnstructuredSlice(items []unstructured.Unstructured, suffix []byte) (err error) {
+	_, err = e.w.Write([]byte(`"items":[`))
+	if err != nil {
+		return err
+	}
+	comma := []byte(",")
+	for i, item := range items {
+		if i == len(items)-1 {
+			comma = nil
+		}
+		err := e.encodeValue(item.Object, comma)
+		if err != nil {
+			return err
+		}
+	}
+	_, err = e.w.Write([]byte("]"))
+	if err != nil {
+		return err
+	}
+	if len(suffix) > 0 {
+		_, err = e.w.Write(suffix)
+	}
+	return err
+}
+
+func (e *streamEncoder) encodeKeyValuePair(key string, value any, suffix []byte) (err error) {
+	err = e.encodeValue(key, []byte(":"))
+	if err != nil {
+		return err
+	}
+	err = e.encodeValue(value, suffix)
+	if err != nil {
+		return err
+	}
+	return err
+}
+
+func (e *streamEncoder) encodeValue(value any, suffix []byte) error {
+	e.buf.Reset()
+	if err := e.json.Encode(value); err != nil {
+		return err
+	}
+	// Encode appends a newline after the value; replace it with the suffix to
+	// keep the output identical to json.Marshal's.
+	e.buf.Truncate(e.buf.Len() - 1)
+	e.buf.Write(suffix)
+	_, err := e.w.Write(e.buf.Bytes())
+	return err
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/collections_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/collections_test.go
new file mode 100644
index 0000000000..3fc398961b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/collections_test.go
@@ -0,0 +1,869 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	"bytes"
+	"fmt"
+	"math/rand"
+	"slices"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"sigs.k8s.io/randfill"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	testapigroupv1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func TestCollectionsEncoding(t *testing.T) {
+	t.Run("Normal", func(t *testing.T) {
+		testCollectionsEncoding(t, NewSerializerWithOptions(DefaultMetaFactory, nil, nil, SerializerOptions{}), false)
+	})
+	t.Run("Streaming", func(t *testing.T) {
+		testCollectionsEncoding(t, NewSerializerWithOptions(DefaultMetaFactory, nil, nil, SerializerOptions{StreamingCollectionsEncoding: true}), true)
+	})
+}
+
+// testCollectionsEncoding should provide comprehensive tests to validate streaming implementation of encoder.
+func testCollectionsEncoding(t *testing.T, s *Serializer, streamingEnabled bool) {
+	var buf writeCountingBuffer
+	var remainingItems int64 = 1
+	// As defined in KEP-5116 we it should include the following scenarios:
+	// Context: https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/5116-streaming-response-encoding#unit-tests
+	for _, tc := range []struct {
+		name         string
+		in           runtime.Object
+		cannotStream bool
+		expect       string
+		// allow provides allowed alternate representations.
+		// For the json v1->v2 transition, this is used to tolerate changes
+		// in how malformed input in munged.
+		allow []string
+	}{
+		// Preserving the distinction between integers and floating-point numbers
+		{
+			name: "Struct with floats",
+			in: &StructWithFloatsList{
+				Items: []StructWithFloats{
+					{
+						Int:     1,
+						Float32: float32(1),
+						Float64: 1.1,
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"Int\":1,\"Float32\":1,\"Float64\":1.1}]}\n",
+		},
+		{
+			name: "Unstructured object float",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"int":     1,
+					"float32": float32(1),
+					"float64": 1.1,
+				},
+			},
+			expect: "{\"float32\":1,\"float64\":1.1,\"int\":1,\"items\":[]}\n",
+		},
+		{
+			name: "Unstructured items float",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"int":     1,
+							"float32": float32(1),
+							"float64": 1.1,
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"float32\":1,\"float64\":1.1,\"int\":1}]}\n",
+		},
+		// Handling structs with duplicate field names (JSON tag names) without producing duplicate keys in the encoded output
+		{
+			name: "StructWithDuplicatedTags",
+			in: &StructWithDuplicatedTagsList{
+				Items: []StructWithDuplicatedTags{
+					{
+						Key1: "key1",
+						Key2: "key2",
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{}}]}\n",
+		},
+		// Encoding Go strings containing invalid UTF-8 sequences without error
+		{
+			name: "UnstructuredList object invalid UTF-8 ",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"key": "\x80", // first byte is a continuation byte
+				},
+			},
+			expect: "{\"items\":[],\"key\":\"\\ufffd\"}\n",
+			// Go json/v2 emits U+FFFD as raw UTF-8 bytes rather than the \ufffd escape.
+			allow: []string{"{\"items\":[],\"key\":\"\ufffd\"}\n"},
+		},
+		{
+			name: "UnstructuredList items invalid UTF-8 ",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"key": "\x80", // first byte is a continuation byte
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"key\":\"\\ufffd\"}]}\n",
+			// Go json/v2 emits U+FFFD as raw UTF-8 bytes rather than the \ufffd escape.
+			allow: []string{"{\"items\":[{\"key\":\"\ufffd\"}]}\n"},
+		},
+		// Preserving the distinction between absent, present-but-null, and present-and-empty states for slices and maps
+		{
+			name: "CarpList items nil",
+			in: &testapigroupv1.CarpList{
+				Items: nil,
+			},
+			expect: "{\"metadata\":{},\"items\":null}\n",
+		},
+		{
+			name: "CarpList slice nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: nil,
+						},
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"spec\":{},\"status\":{}}]}\n",
+		},
+		{
+			name: "CarpList map nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: nil,
+						},
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"spec\":{},\"status\":{}}]}\n",
+		},
+		{
+			name: "UnstructuredList items nil",
+			in: &unstructured.UnstructuredList{
+				Items: nil,
+			},
+			expect: "{\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList items slice nil",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"slice": ([]string)(nil),
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"slice\":null}]}\n",
+		},
+		{
+			name: "UnstructuredList items map nil",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"map": (map[string]string)(nil),
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"map\":null}]}\n",
+		},
+		{
+			name: "UnstructuredList object nil",
+			in: &unstructured.UnstructuredList{
+				Object: nil,
+			},
+			expect: "{\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList object slice nil",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"slice": ([]string)(nil),
+				},
+			},
+			expect: "{\"items\":[],\"slice\":null}\n",
+		},
+		{
+			name: "UnstructuredList object map nil",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"map": (map[string]string)(nil),
+				},
+			},
+			expect: "{\"items\":[],\"map\":null}\n",
+		},
+		{
+			name: "CarpList items empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{},
+			},
+			expect: "{\"metadata\":{},\"items\":[]}\n",
+		},
+		{
+			name: "CarpList slice empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: []testapigroupv1.CarpCondition{},
+						},
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"spec\":{},\"status\":{}}]}\n",
+		},
+		{
+			name: "CarpList map empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: map[string]string{},
+						},
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"spec\":{},\"status\":{}}]}\n",
+		},
+		{
+			name: "UnstructuredList items empty",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{},
+			},
+			expect: "{\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList items slice empty",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"slice": []string{},
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"slice\":[]}]}\n",
+		},
+		{
+			name: "UnstructuredList items map empty",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"map": map[string]string{},
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"map\":{}}]}\n",
+		},
+		{
+			name: "UnstructuredList object empty",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{},
+			},
+			expect: "{\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList object slice empty",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"slice": []string{},
+				},
+			},
+			expect: "{\"items\":[],\"slice\":[]}\n",
+		},
+		{
+			name: "UnstructuredList object map empty",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"map": map[string]string{},
+				},
+			},
+			expect: "{\"items\":[],\"map\":{}}\n",
+		},
+		// Handling structs implementing MarshallJSON method, especially built-in collection types.
+		{
+			name:         "List with MarshallJSON cannot be streamed",
+			in:           &ListWithMarshalJSONList{},
+			expect:       "\"marshallJSON\"\n",
+			cannotStream: true,
+		},
+		{
+			name: "Struct with MarshallJSON",
+			in: &StructWithMarshalJSONList{
+				Items: []StructWithMarshalJSON{
+					{},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[\"marshallJSON\"]}\n",
+		},
+		// Handling raw bytes.
+		{
+			name: "Struct with raw bytes",
+			in: &StructWithRawBytesList{
+				Items: []StructWithRawBytes{
+					{
+						Slice: []byte{0x01, 0x02, 0x03},
+						Array: [3]byte{0x01, 0x02, 0x03},
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"Slice\":\"AQID\",\"Array\":[1,2,3]}]}\n",
+		},
+		{
+			name: "UnstructuredList object raw bytes",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"slice": []byte{0x01, 0x02, 0x03},
+					"array": [3]byte{0x01, 0x02, 0x03},
+				},
+			},
+			expect: "{\"array\":[1,2,3],\"items\":[],\"slice\":\"AQID\"}\n",
+		},
+		{
+			name: "UnstructuredList items raw bytes",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"slice": []byte{0x01, 0x02, 0x03},
+							"array": [3]byte{0x01, 0x02, 0x03},
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"array\":[1,2,3],\"slice\":\"AQID\"}]}\n",
+		},
+		// Other scenarios:
+		{
+			name: "List just kind",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind: "List",
+				},
+			},
+			expect: "{\"kind\":\"List\",\"metadata\":{},\"items\":null}\n",
+		},
+		{
+			name: "List just apiVersion",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "v1",
+				},
+			},
+			expect: "{\"apiVersion\":\"v1\",\"metadata\":{},\"items\":null}\n",
+		},
+		{
+			name: "List no elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{},
+			},
+			expect: "{\"kind\":\"List\",\"apiVersion\":\"v1\",\"metadata\":{\"resourceVersion\":\"2345\"},\"items\":[]}\n",
+		},
+		{
+			name: "List one element with continue",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion:    "2345",
+					Continue:           "abc",
+					RemainingItemCount: &remainingItems,
+				},
+				Items: []testapigroupv1.Carp{
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod",
+						Namespace: "default",
+					}},
+				},
+			},
+			expect: "{\"kind\":\"List\",\"apiVersion\":\"v1\",\"metadata\":{\"resourceVersion\":\"2345\",\"continue\":\"abc\",\"remainingItemCount\":1},\"items\":[{\"kind\":\"Carp\",\"apiVersion\":\"v1\",\"metadata\":{\"name\":\"pod\",\"namespace\":\"default\"},\"spec\":{},\"status\":{}}]}\n",
+		},
+		{
+			name: "List two elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod",
+						Namespace: "default",
+					}},
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod2",
+						Namespace: "default2",
+					}},
+				},
+			},
+			expect: `{"kind":"List","apiVersion":"v1","metadata":{"resourceVersion":"2345"},"items":[{"kind":"Carp","apiVersion":"v1","metadata":{"name":"pod","namespace":"default"},"spec":{},"status":{}},{"kind":"Carp","apiVersion":"v1","metadata":{"name":"pod2","namespace":"default2"},"spec":{},"status":{}}]}
+`,
+		},
+		{
+			name: "List with extra field cannot be streamed",
+			in: &ListWithAdditionalFields{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{},
+			},
+			cannotStream: true,
+			expect:       "{\"kind\":\"List\",\"apiVersion\":\"v1\",\"metadata\":{\"resourceVersion\":\"2345\"},\"items\":[],\"AdditionalField\":0}\n",
+		},
+		{
+			name: "Not a collection cannot be streamed",
+			in: &testapigroupv1.Carp{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+			},
+			cannotStream: true,
+			expect:       "{\"kind\":\"List\",\"apiVersion\":\"v1\",\"metadata\":{},\"spec\":{},\"status\":{}}\n",
+		},
+		{
+			name:   "UnstructuredList empty",
+			in:     &unstructured.UnstructuredList{},
+			expect: "{\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList just kind",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"kind": "List"},
+			},
+			expect: "{\"items\":[],\"kind\":\"List\"}\n",
+		},
+		{
+			name: "UnstructuredList just apiVersion",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"apiVersion": "v1"},
+			},
+			expect: "{\"apiVersion\":\"v1\",\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList no elements",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"kind": "List", "apiVersion": "v1", "metadata": map[string]interface{}{"resourceVersion": "2345"}},
+				Items:  []unstructured.Unstructured{},
+			},
+			expect: "{\"apiVersion\":\"v1\",\"items\":[],\"kind\":\"List\",\"metadata\":{\"resourceVersion\":\"2345\"}}\n",
+		},
+		{
+			name: "UnstructuredList one element with continue",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"kind": "List", "apiVersion": "v1", "metadata": map[string]interface{}{
+					"resourceVersion":    "2345",
+					"continue":           "abc",
+					"remainingItemCount": "1",
+				}},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "Carp",
+							"metadata": map[string]interface{}{
+								"name":      "pod",
+								"namespace": "default",
+							},
+						},
+					},
+				},
+			},
+			expect: "{\"apiVersion\":\"v1\",\"items\":[{\"apiVersion\":\"v1\",\"kind\":\"Carp\",\"metadata\":{\"name\":\"pod\",\"namespace\":\"default\"}}],\"kind\":\"List\",\"metadata\":{\"continue\":\"abc\",\"remainingItemCount\":\"1\",\"resourceVersion\":\"2345\"}}\n",
+		},
+		{
+			name: "UnstructuredList two elements",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"kind": "List", "apiVersion": "v1", "metadata": map[string]interface{}{
+					"resourceVersion": "2345",
+				}},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "Carp",
+							"metadata": map[string]interface{}{
+								"name":      "pod",
+								"namespace": "default",
+							},
+						},
+					},
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "Carp",
+							"metadata": map[string]interface{}{
+								"name":      "pod2",
+								"namespace": "default",
+							},
+						},
+					},
+				},
+			},
+			expect: "{\"apiVersion\":\"v1\",\"items\":[{\"apiVersion\":\"v1\",\"kind\":\"Carp\",\"metadata\":{\"name\":\"pod\",\"namespace\":\"default\"}},{\"apiVersion\":\"v1\",\"kind\":\"Carp\",\"metadata\":{\"name\":\"pod2\",\"namespace\":\"default\"}}],\"kind\":\"List\",\"metadata\":{\"resourceVersion\":\"2345\"}}\n",
+		},
+		{
+			name: "UnstructuredList conflict on items",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"items": []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"name": "pod",
+						},
+					},
+				},
+				},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"name": "pod2",
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"name\":\"pod2\"}]}\n",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			buf.Reset()
+			if err := s.Encode(tc.in, &buf); err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			t.Logf("encoded: %s", buf.String())
+			if got := buf.String(); got != tc.expect && !slices.Contains(tc.allow, got) {
+				t.Errorf("not matching:\n%s", cmp.Diff(got, tc.expect))
+			}
+			expectStreaming := !tc.cannotStream && streamingEnabled
+			if expectStreaming && buf.writeCount <= 1 {
+				t.Errorf("expected streaming but Write was called only: %d", buf.writeCount)
+			}
+			if !expectStreaming && buf.writeCount > 1 {
+				t.Errorf("expected non-streaming but Write was called more than once: %d", buf.writeCount)
+			}
+		})
+	}
+}
+
+type StructWithFloatsList struct {
+	metav1.TypeMeta `json:""`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithFloats `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *StructWithFloatsList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithFloats struct {
+	metav1.TypeMeta   `json:""`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	Int     int
+	Float32 float32
+	Float64 float64
+}
+
+func (s *StructWithFloats) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithDuplicatedTagsList struct {
+	metav1.TypeMeta `json:""`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithDuplicatedTags `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *StructWithDuplicatedTagsList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithDuplicatedTags struct {
+	metav1.TypeMeta   `json:""`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	Key1 string `json:"key"`
+	Key2 string `json:"key"` //nolint:govet
+}
+
+func (s *StructWithDuplicatedTags) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type ListWithMarshalJSONList struct {
+	metav1.TypeMeta `json:""`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []string `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *ListWithMarshalJSONList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *ListWithMarshalJSONList) MarshalJSON() ([]byte, error) {
+	return []byte(`"marshallJSON"`), nil
+}
+
+type StructWithMarshalJSONList struct {
+	metav1.TypeMeta `json:""`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithMarshalJSON `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *StructWithMarshalJSONList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithMarshalJSON struct {
+	metav1.TypeMeta   `json:""`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+}
+
+func (l *StructWithMarshalJSON) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *StructWithMarshalJSON) MarshalJSON() ([]byte, error) {
+	return []byte(`"marshallJSON"`), nil
+}
+
+type StructWithRawBytesList struct {
+	metav1.TypeMeta `json:""`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithRawBytes `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *StructWithRawBytesList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithRawBytes struct {
+	metav1.TypeMeta   `json:""`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Slice             []byte
+	Array             [3]byte
+}
+
+func (s *StructWithRawBytes) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type ListWithAdditionalFields struct {
+	metav1.TypeMeta `json:""`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []testapigroupv1.Carp `json:"items" protobuf:"bytes,2,rep,name=items"`
+	AdditionalField int
+}
+
+func (s *ListWithAdditionalFields) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type writeCountingBuffer struct {
+	writeCount int
+	bytes.Buffer
+}
+
+func (b *writeCountingBuffer) Write(data []byte) (int, error) {
+	b.writeCount++
+	return b.Buffer.Write(data)
+}
+
+func (b *writeCountingBuffer) Reset() {
+	b.writeCount = 0
+	b.Buffer.Reset()
+}
+
+func TestFuzzCollectionsEncoding(t *testing.T) {
+	disableFuzzFieldsV1 := func(field *metav1.FieldsV1, c randfill.Continue) {}
+	fuzzUnstructuredList := func(list *unstructured.UnstructuredList, c randfill.Continue) {
+		list.Object = map[string]interface{}{
+			"kind":       "List",
+			"apiVersion": "v1",
+			c.String(0):  c.String(0),
+			c.String(0):  c.Uint64(),
+			c.String(0):  c.Bool(),
+			"metadata": map[string]interface{}{
+				"resourceVersion":    fmt.Sprintf("%d", c.Uint64()),
+				"continue":           c.String(0),
+				"remainingItemCount": fmt.Sprintf("%d", c.Uint64()),
+				c.String(0):          c.String(0),
+			}}
+		c.Fill(&list.Items)
+	}
+	fuzzMap := func(kvs map[string]interface{}, c randfill.Continue) {
+		kvs[c.String(0)] = c.Bool()
+		kvs[c.String(0)] = c.Uint64()
+		kvs[c.String(0)] = c.String(0)
+	}
+	f := randfill.New().Funcs(disableFuzzFieldsV1, fuzzUnstructuredList, fuzzMap)
+	streamingBuffer := &bytes.Buffer{}
+	normalSerializer := NewSerializerWithOptions(DefaultMetaFactory, nil, nil, SerializerOptions{StreamingCollectionsEncoding: false})
+	normalBuffer := &bytes.Buffer{}
+	t.Run("CarpList", func(t *testing.T) {
+		for range 1000 {
+			list := &testapigroupv1.CarpList{}
+			f.Fill(list)
+			streamingBuffer.Reset()
+			normalBuffer.Reset()
+			ok, err := streamEncodeCollections(list, streamingBuffer)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if !ok {
+				t.Fatalf("expected streaming encoder to encode %T", list)
+			}
+			if err := normalSerializer.Encode(list, normalBuffer); err != nil {
+				t.Fatal(err)
+			}
+			if diff := cmp.Diff(normalBuffer.String(), streamingBuffer.String()); diff != "" {
+				t.Logf("normal: %s", normalBuffer.String())
+				t.Logf("streaming: %s", streamingBuffer.String())
+				t.Errorf("not matching:\n%s", diff)
+			}
+		}
+	})
+	t.Run("UnstructuredList", func(t *testing.T) {
+		for range 1000 {
+			list := &unstructured.UnstructuredList{}
+			f.Fill(list)
+			streamingBuffer.Reset()
+			normalBuffer.Reset()
+			ok, err := streamEncodeCollections(list, streamingBuffer)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if !ok {
+				t.Fatalf("expected streaming encoder to encode %T", list)
+			}
+			if err := normalSerializer.Encode(list, normalBuffer); err != nil {
+				t.Fatal(err)
+			}
+			if diff := cmp.Diff(normalBuffer.String(), streamingBuffer.String()); diff != "" {
+				t.Logf("normal: %s", normalBuffer.String())
+				t.Logf("streaming: %s", streamingBuffer.String())
+				t.Errorf("not matching:\n%s", diff)
+			}
+		}
+	})
+}
+
+func BenchmarkStreamEncodeCollections(b *testing.B) {
+	disableFuzzFieldsV1 := func(field *metav1.FieldsV1, c randfill.Continue) {}
+	fuzzMap := func(kvs map[string]interface{}, c randfill.Continue) {
+		kvs[c.String(0)] = c.Bool()
+		kvs[c.String(0)] = c.Uint64()
+		kvs[c.String(0)] = c.String(0)
+	}
+	f := randfill.New().RandSource(rand.NewSource(12345)).Funcs(disableFuzzFieldsV1, fuzzMap)
+	carpList := &testapigroupv1.CarpList{}
+	carpList.Items = make([]testapigroupv1.Carp, 1000)
+	for i := range 1000 {
+		f.Fill(&carpList.Items[i])
+	}
+	carpList.Kind = "CarpList"
+	carpList.APIVersion = "testapigroup.k8s.io/v1"
+	carpList.ResourceVersion = "12345"
+	unstructuredList := &unstructured.UnstructuredList{}
+	unstructuredList.Object = map[string]interface{}{
+		"kind":       "List",
+		"apiVersion": "v1",
+		"metadata": map[string]interface{}{
+			"resourceVersion": "12345",
+		},
+	}
+	unstructuredList.Items = make([]unstructured.Unstructured, 1000)
+	for i := range 1000 {
+		unstrMap, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&carpList.Items[i])
+		if err != nil {
+			b.Fatalf("failed to convert carp to unstructured: %v", err)
+		}
+		unstructuredList.Items[i] = unstructured.Unstructured{Object: unstrMap}
+	}
+	b.Run("CarpList", func(b *testing.B) {
+		var buf bytes.Buffer
+		b.ReportAllocs()
+		b.ResetTimer()
+		for i := 0; i < b.N; i++ {
+			buf.Reset()
+			ok, err := streamEncodeCollections(carpList, &buf)
+			if err != nil {
+				b.Fatal(err)
+			}
+			if !ok {
+				b.Fatal("not ok")
+			}
+		}
+	})
+	b.Run("UnstructuredList", func(b *testing.B) {
+		var buf bytes.Buffer
+		b.ReportAllocs()
+		b.ResetTimer()
+		for i := 0; i < b.N; i++ {
+			buf.Reset()
+			ok, err := streamEncodeCollections(unstructuredList, &buf)
+			if err != nil {
+				b.Fatal(err)
+			}
+			if !ok {
+				b.Fatal("not ok")
+			}
+		}
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go
new file mode 100644
index 0000000000..52c814172f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go
@@ -0,0 +1,364 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	"encoding/json"
+	"io"
+	"strconv"
+
+	kjson "sigs.k8s.io/json"
+	"sigs.k8s.io/yaml"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/recognizer"
+	"k8s.io/apimachinery/pkg/util/framer"
+	utilyaml "k8s.io/apimachinery/pkg/util/yaml"
+	"k8s.io/klog/v2"
+)
+
+// NewSerializer creates a JSON serializer that handles encoding versioned objects into the proper JSON form. If typer
+// is not nil, the object has the group, version, and kind fields set.
+// Deprecated: use NewSerializerWithOptions instead.
+func NewSerializer(meta MetaFactory, creater runtime.ObjectCreater, typer runtime.ObjectTyper, pretty bool) *Serializer {
+	return NewSerializerWithOptions(meta, creater, typer, SerializerOptions{false, pretty, false, false})
+}
+
+// NewYAMLSerializer creates a YAML serializer that handles encoding versioned objects into the proper YAML form. If typer
+// is not nil, the object has the group, version, and kind fields set. This serializer supports only the subset of YAML that
+// matches JSON, and will error if constructs are used that do not serialize to JSON.
+// Deprecated: use NewSerializerWithOptions instead.
+func NewYAMLSerializer(meta MetaFactory, creater runtime.ObjectCreater, typer runtime.ObjectTyper) *Serializer {
+	return NewSerializerWithOptions(meta, creater, typer, SerializerOptions{true, false, false, false})
+}
+
+// NewSerializerWithOptions creates a JSON/YAML serializer that handles encoding versioned objects into the proper JSON/YAML
+// form. If typer is not nil, the object has the group, version, and kind fields set. Options are copied into the Serializer
+// and are immutable.
+func NewSerializerWithOptions(meta MetaFactory, creater runtime.ObjectCreater, typer runtime.ObjectTyper, options SerializerOptions) *Serializer {
+	return &Serializer{
+		meta:       meta,
+		creater:    creater,
+		typer:      typer,
+		options:    options,
+		identifier: identifier(options),
+	}
+}
+
+// identifier computes Identifier of Encoder based on the given options.
+func identifier(options SerializerOptions) runtime.Identifier {
+	result := map[string]string{
+		"name":   "json",
+		"yaml":   strconv.FormatBool(options.Yaml),
+		"pretty": strconv.FormatBool(options.Pretty),
+		"strict": strconv.FormatBool(options.Strict),
+	}
+	identifier, err := json.Marshal(result)
+	if err != nil {
+		//nolint:logcheck // Should not be reached.
+		klog.Fatalf("Failed marshaling identifier for json Serializer: %v", err)
+	}
+	return runtime.Identifier(identifier)
+}
+
+// SerializerOptions holds the options which are used to configure a JSON/YAML serializer.
+// example:
+// (1) To configure a JSON serializer, set `Yaml` to `false`.
+// (2) To configure a YAML serializer, set `Yaml` to `true`.
+// (3) To configure a strict serializer that can return strictDecodingError, set `Strict` to `true`.
+type SerializerOptions struct {
+	// Yaml: configures the Serializer to work with JSON(false) or YAML(true).
+	// When `Yaml` is enabled, this serializer only supports the subset of YAML that
+	// matches JSON, and will error if constructs are used that do not serialize to JSON.
+	Yaml bool
+
+	// Pretty: configures a JSON enabled Serializer(`Yaml: false`) to produce human-readable output.
+	// This option is silently ignored when `Yaml` is `true`.
+	Pretty bool
+
+	// Strict: configures the Serializer to return strictDecodingError's when duplicate fields are present decoding JSON or YAML.
+	// Note that enabling this option is not as performant as the non-strict variant, and should not be used in fast paths.
+	Strict bool
+
+	// StreamingCollectionsEncoding enables encoding collection, one item at the time, drastically reducing memory needed.
+	StreamingCollectionsEncoding bool
+}
+
+// Serializer handles encoding versioned objects into the proper JSON form
+type Serializer struct {
+	meta    MetaFactory
+	options SerializerOptions
+	creater runtime.ObjectCreater
+	typer   runtime.ObjectTyper
+
+	identifier runtime.Identifier
+}
+
+// Serializer implements Serializer
+var _ runtime.Serializer = &Serializer{}
+var _ recognizer.RecognizingDecoder = &Serializer{}
+
+// gvkWithDefaults returns group kind and version defaulting from provided default
+func gvkWithDefaults(actual, defaultGVK schema.GroupVersionKind) schema.GroupVersionKind {
+	if len(actual.Kind) == 0 {
+		actual.Kind = defaultGVK.Kind
+	}
+	if len(actual.Version) == 0 && len(actual.Group) == 0 {
+		actual.Group = defaultGVK.Group
+		actual.Version = defaultGVK.Version
+	}
+	if len(actual.Version) == 0 && actual.Group == defaultGVK.Group {
+		actual.Version = defaultGVK.Version
+	}
+	return actual
+}
+
+// Decode attempts to convert the provided data into YAML or JSON, extract the stored schema kind, apply the provided default gvk, and then
+// load that data into an object matching the desired schema kind or the provided into.
+// If into is *runtime.Unknown, the raw data will be extracted and no decoding will be performed.
+// If into is not registered with the typer, then the object will be straight decoded using normal JSON/YAML unmarshalling.
+// If into is provided and the original data is not fully qualified with kind/version/group, the type of the into will be used to alter the returned gvk.
+// If into is nil or data's gvk different from into's gvk, it will generate a new Object with ObjectCreater.New(gvk)
+// On success or most errors, the method will return the calculated schema kind.
+// The gvk calculate priority will be originalData > default gvk > into
+func (s *Serializer) Decode(originalData []byte, gvk *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	data := originalData
+	if s.options.Yaml {
+		altered, err := yaml.YAMLToJSON(data)
+		if err != nil {
+			return nil, nil, err
+		}
+		data = altered
+	}
+
+	actual, err := s.meta.Interpret(data)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if gvk != nil {
+		*actual = gvkWithDefaults(*actual, *gvk)
+	}
+
+	if unk, ok := into.(*runtime.Unknown); ok && unk != nil {
+		unk.Raw = originalData
+		unk.ContentType = runtime.ContentTypeJSON
+		unk.GetObjectKind().SetGroupVersionKind(*actual)
+		return unk, actual, nil
+	}
+
+	if into != nil {
+		_, isUnstructured := into.(runtime.Unstructured)
+		types, _, err := s.typer.ObjectKinds(into)
+		switch {
+		case runtime.IsNotRegisteredError(err), isUnstructured:
+			strictErrs, err := s.unmarshal(into, data, originalData)
+			if err != nil {
+				return nil, actual, err
+			}
+
+			// when decoding directly into a provided unstructured object,
+			// extract the actual gvk decoded from the provided data,
+			// and ensure it is non-empty.
+			if isUnstructured {
+				*actual = into.GetObjectKind().GroupVersionKind()
+				if len(actual.Kind) == 0 {
+					return nil, actual, runtime.NewMissingKindErr(string(originalData))
+				}
+				// TODO(109023): require apiVersion here as well once unstructuredJSONScheme#Decode does
+			}
+
+			if len(strictErrs) > 0 {
+				return into, actual, runtime.NewStrictDecodingError(strictErrs)
+			}
+			return into, actual, nil
+		case err != nil:
+			return nil, actual, err
+		default:
+			*actual = gvkWithDefaults(*actual, types[0])
+		}
+	}
+
+	if len(actual.Kind) == 0 {
+		return nil, actual, runtime.NewMissingKindErr(string(originalData))
+	}
+	if len(actual.Version) == 0 {
+		return nil, actual, runtime.NewMissingVersionErr(string(originalData))
+	}
+
+	// use the target if necessary
+	obj, err := runtime.UseOrCreateObject(s.typer, s.creater, *actual, into)
+	if err != nil {
+		return nil, actual, err
+	}
+
+	strictErrs, err := s.unmarshal(obj, data, originalData)
+	if err != nil {
+		return nil, actual, err
+	} else if len(strictErrs) > 0 {
+		return obj, actual, runtime.NewStrictDecodingError(strictErrs)
+	}
+	return obj, actual, nil
+}
+
+// Encode serializes the provided object to the given writer.
+func (s *Serializer) Encode(obj runtime.Object, w io.Writer) error {
+	if co, ok := obj.(runtime.CacheableObject); ok {
+		return co.CacheEncode(s.Identifier(), s.doEncode, w)
+	}
+	return s.doEncode(obj, w)
+}
+
+func (s *Serializer) doEncode(obj runtime.Object, w io.Writer) error {
+	if s.options.Yaml {
+		json, err := json.Marshal(obj)
+		if err != nil {
+			return err
+		}
+		data, err := yaml.JSONToYAML(json)
+		if err != nil {
+			return err
+		}
+		_, err = w.Write(data)
+		return err
+	}
+
+	if s.options.Pretty {
+		data, err := json.MarshalIndent(obj, "", "  ")
+		if err != nil {
+			return err
+		}
+		_, err = w.Write(data)
+		return err
+	}
+	if s.options.StreamingCollectionsEncoding {
+		ok, err := streamEncodeCollections(obj, w)
+		if err != nil {
+			return err
+		}
+		if ok {
+			return nil
+		}
+	}
+	encoder := json.NewEncoder(w)
+	return encoder.Encode(obj)
+}
+
+// IsStrict indicates whether the serializer
+// uses strict decoding or not
+func (s *Serializer) IsStrict() bool {
+	return s.options.Strict
+}
+
+func (s *Serializer) unmarshal(into runtime.Object, data, originalData []byte) (strictErrs []error, err error) {
+	// If the deserializer is non-strict, return here.
+	if !s.options.Strict {
+		if err := kjson.UnmarshalCaseSensitivePreserveInts(data, into); err != nil {
+			return nil, err
+		}
+		return nil, nil
+	}
+
+	if s.options.Yaml {
+		// In strict mode pass the original data through the YAMLToJSONStrict converter.
+		// This is done to catch duplicate fields in YAML that would have been dropped in the original YAMLToJSON conversion.
+		// TODO: rework YAMLToJSONStrict to return warnings about duplicate fields without terminating so we don't have to do this twice.
+		_, err := yaml.YAMLToJSONStrict(originalData)
+		if err != nil {
+			strictErrs = append(strictErrs, err)
+		}
+	}
+
+	var strictJSONErrs []error
+	if u, isUnstructured := into.(runtime.Unstructured); isUnstructured {
+		// Unstructured is a custom unmarshaler that gets delegated
+		// to, so in order to detect strict JSON errors we need
+		// to unmarshal directly into the object.
+		m := map[string]interface{}{}
+		strictJSONErrs, err = kjson.UnmarshalStrict(data, &m)
+		u.SetUnstructuredContent(m)
+	} else {
+		strictJSONErrs, err = kjson.UnmarshalStrict(data, into)
+	}
+	if err != nil {
+		// fatal decoding error, not due to strictness
+		return nil, err
+	}
+	strictErrs = append(strictErrs, strictJSONErrs...)
+	return strictErrs, nil
+}
+
+// Identifier implements runtime.Encoder interface.
+func (s *Serializer) Identifier() runtime.Identifier {
+	return s.identifier
+}
+
+// RecognizesData implements the RecognizingDecoder interface.
+func (s *Serializer) RecognizesData(data []byte) (ok, unknown bool, err error) {
+	if s.options.Yaml {
+		// we could potentially look for '---'
+		return false, true, nil
+	}
+	return utilyaml.IsJSONBuffer(data), false, nil
+}
+
+// Framer is the default JSON framing behavior, with newlines delimiting individual objects.
+var Framer = jsonFramer{}
+
+type jsonFramer struct{}
+
+// NewFrameWriter implements stream framing for this serializer
+func (jsonFramer) NewFrameWriter(w io.Writer) io.Writer {
+	// we can write JSON objects directly to the writer, because they are self-framing
+	return w
+}
+
+// NewFrameReader implements stream framing for this serializer
+func (jsonFramer) NewFrameReader(r io.ReadCloser) io.ReadCloser {
+	// we need to extract the JSON chunks of data to pass to Decode()
+	return framer.NewJSONFramedReader(r)
+}
+
+// YAMLFramer is the default JSON framing behavior, with newlines delimiting individual objects.
+var YAMLFramer = yamlFramer{}
+
+type yamlFramer struct{}
+
+// NewFrameWriter implements stream framing for this serializer
+func (yamlFramer) NewFrameWriter(w io.Writer) io.Writer {
+	return yamlFrameWriter{w}
+}
+
+// NewFrameReader implements stream framing for this serializer
+func (yamlFramer) NewFrameReader(r io.ReadCloser) io.ReadCloser {
+	// extract the YAML document chunks directly
+	return utilyaml.NewDocumentDecoder(r)
+}
+
+type yamlFrameWriter struct {
+	w io.Writer
+}
+
+// Write separates each document with the YAML document separator (`---` followed by line
+// break). Writers must write well formed YAML documents (include a final line break).
+func (w yamlFrameWriter) Write(data []byte) (n int, err error) {
+	if _, err := w.w.Write([]byte("---\n")); err != nil {
+		return 0, err
+	}
+	return w.w.Write(data)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json_limit_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json_limit_test.go
new file mode 100644
index 0000000000..8214d293c6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json_limit_test.go
@@ -0,0 +1,169 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	gojson "encoding/json"
+	"strings"
+	"testing"
+
+	utiljson "k8s.io/apimachinery/pkg/util/json"
+)
+
+type testcase struct {
+	name     string
+	data     []byte
+	checkErr func(t testing.TB, err error)
+
+	benchmark bool
+}
+
+func testcases() []testcase {
+	// verify we got an error of some kind
+	nonNilError := func(t testing.TB, err error) {
+		if err == nil {
+			t.Errorf("expected error, got none")
+		}
+	}
+	// verify the parse completed, either with success or a max depth error
+	successOrMaxDepthError := func(t testing.TB, err error) {
+		if err != nil && !strings.Contains(err.Error(), "max depth") {
+			t.Errorf("expected success or error containing 'max depth', got: %v", err)
+		}
+	}
+
+	return []testcase{
+		{
+			name:     "3MB of deeply nested slices",
+			checkErr: successOrMaxDepthError,
+			data:     []byte(`{"a":` + strings.Repeat(`[`, 3*1024*1024/2) + strings.Repeat(`]`, 3*1024*1024/2) + "}"),
+		},
+		{
+			name:     "3MB of unbalanced nested slices",
+			checkErr: nonNilError,
+			data:     []byte(`{"a":` + strings.Repeat(`[`, 3*1024*1024)),
+		},
+		{
+			name:     "3MB of deeply nested maps",
+			checkErr: successOrMaxDepthError,
+			data:     []byte(strings.Repeat(`{"":`, 3*1024*1024/5/2) + "{}" + strings.Repeat(`}`, 3*1024*1024/5/2)),
+		},
+		{
+			name:     "3MB of unbalanced nested maps",
+			checkErr: nonNilError,
+			data:     []byte(strings.Repeat(`{"":`, 3*1024*1024/5)),
+		},
+		{
+			name:      "3MB of empty slices",
+			data:      []byte(`{"a":[` + strings.Repeat(`[],`, 3*1024*1024/3-2) + `[]]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of slices",
+			data:      []byte(`{"a":[` + strings.Repeat(`[0],`, 3*1024*1024/4-2) + `[0]]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of empty maps",
+			data:      []byte(`{"a":[` + strings.Repeat(`{},`, 3*1024*1024/3-2) + `{}]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of maps",
+			data:      []byte(`{"a":[` + strings.Repeat(`{"a":0},`, 3*1024*1024/8-2) + `{"a":0}]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of ints",
+			data:      []byte(`{"a":[` + strings.Repeat(`0,`, 3*1024*1024/2-2) + `0]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of floats",
+			data:      []byte(`{"a":[` + strings.Repeat(`0.0,`, 3*1024*1024/4-2) + `0.0]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of bools",
+			data:      []byte(`{"a":[` + strings.Repeat(`true,`, 3*1024*1024/5-2) + `true]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of empty strings",
+			data:      []byte(`{"a":[` + strings.Repeat(`"",`, 3*1024*1024/3-2) + `""]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of strings",
+			data:      []byte(`{"a":[` + strings.Repeat(`"abcdefghijklmnopqrstuvwxyz012",`, 3*1024*1024/30-2) + `"abcdefghijklmnopqrstuvwxyz012"]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of nulls",
+			data:      []byte(`{"a":[` + strings.Repeat(`null,`, 3*1024*1024/5-2) + `null]}`),
+			benchmark: true,
+		},
+	}
+}
+
+var decoders = map[string]func([]byte, interface{}) error{
+	"gojson":   gojson.Unmarshal,
+	"utiljson": utiljson.Unmarshal,
+}
+
+func TestJSONLimits(t *testing.T) {
+	for _, tc := range testcases() {
+		if tc.benchmark {
+			continue
+		}
+		t.Run(tc.name, func(t *testing.T) {
+			for decoderName, decoder := range decoders {
+				t.Run(decoderName, func(t *testing.T) {
+					v := map[string]interface{}{}
+					err := decoder(tc.data, &v)
+
+					if tc.checkErr != nil {
+						tc.checkErr(t, err)
+					} else if err != nil {
+						t.Errorf("unexpected error: %v", err)
+					}
+				})
+			}
+		})
+	}
+}
+
+func BenchmarkJSONLimits(b *testing.B) {
+	for _, tc := range testcases() {
+		b.Run(tc.name, func(b *testing.B) {
+			for decoderName, decoder := range decoders {
+				b.Run(decoderName, func(b *testing.B) {
+					for i := 0; i < b.N; i++ {
+						v := map[string]interface{}{}
+						err := decoder(tc.data, &v)
+
+						if tc.checkErr != nil {
+							tc.checkErr(b, err)
+						} else if err != nil {
+							b.Errorf("unexpected error: %v", err)
+						}
+					}
+				})
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json_test.go
new file mode 100644
index 0000000000..b21479a53f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json_test.go
@@ -0,0 +1,1091 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json_test
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+	"k8s.io/apimachinery/pkg/util/diff"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+type testDecodable struct {
+	metav1.TypeMeta `json:""`
+
+	Other     string
+	Value     int           `json:"value"`
+	Spec      DecodableSpec `json:"spec"`
+	Interface interface{}   `json:"interface"`
+}
+
+// DecodableSpec has 15 fields.
+type DecodableSpec struct {
+	A int `json:"A"`
+	B int `json:"B"`
+	C int `json:"C"`
+	D int `json:"D"`
+	E int `json:"E"`
+	F int `json:"F"`
+	G int `json:"G"`
+	H int `json:"h"`
+	I int `json:"i"`
+	J int `json:"j"`
+	K int `json:"k"`
+	L int `json:"l"`
+	M int `json:"m"`
+	N int `json:"n"`
+	O int `json:"o"`
+}
+
+func (d *testDecodable) DeepCopyObject() runtime.Object {
+	if d == nil {
+		return nil
+	}
+	out := new(testDecodable)
+	d.DeepCopyInto(out)
+	return out
+}
+func (d *testDecodable) DeepCopyInto(out *testDecodable) {
+	*out = *d
+	out.Other = d.Other
+	out.Value = d.Value
+	out.Spec = d.Spec
+	out.Interface = d.Interface
+	return
+}
+
+type testDecodeCoercion struct {
+	metav1.TypeMeta `json:""`
+
+	Bool bool `json:"bool"`
+
+	Int   int `json:"int"`
+	Int32 int `json:"int32"`
+	Int64 int `json:"int64"`
+
+	Float32 float32 `json:"float32"`
+	Float64 float64 `json:"float64"`
+
+	String string `json:"string"`
+
+	Struct testDecodable `json:"struct"`
+
+	Array []string          `json:"array"`
+	Map   map[string]string `json:"map"`
+}
+
+func (d *testDecodeCoercion) DeepCopyObject() runtime.Object {
+	if d == nil {
+		return nil
+	}
+	out := new(testDecodeCoercion)
+	d.DeepCopyInto(out)
+	return out
+}
+func (d *testDecodeCoercion) DeepCopyInto(out *testDecodeCoercion) {
+	*out = *d
+	return
+}
+
+func TestDecode(t *testing.T) {
+	type testCase struct {
+		creater runtime.ObjectCreater
+		typer   runtime.ObjectTyper
+		yaml    bool
+		pretty  bool
+		strict  bool
+
+		data       []byte
+		defaultGVK *schema.GroupVersionKind
+		into       runtime.Object
+
+		errFn          func(error) bool
+		expectedObject runtime.Object
+		expectedGVK    *schema.GroupVersionKind
+	}
+
+	testCases := []testCase{
+		// missing metadata without into, typed creater
+		{
+			data: []byte("{}"),
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data: []byte("{}"),
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data: []byte(`{"kind":"Foo"}`),
+
+			expectedGVK: &schema.GroupVersionKind{Kind: "Foo"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'apiVersion' is missing in") },
+		},
+		{
+			data: []byte(`{"kind":"Foo"}`),
+
+			expectedGVK: &schema.GroupVersionKind{Kind: "Foo"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'apiVersion' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data: []byte(`{"apiVersion":"foo/v1"}`),
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data: []byte(`{"apiVersion":"foo/v1"}`),
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:    []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &testDecodable{}},
+
+			expectedObject: &testDecodable{TypeMeta: metav1.TypeMeta{APIVersion: "/v1", Kind: "Foo"}},
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+		},
+		{
+			data:    []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &testDecodable{}},
+
+			expectedObject: &testDecodable{TypeMeta: metav1.TypeMeta{APIVersion: "/v1", Kind: "Foo"}},
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+			strict:         true,
+		},
+
+		// missing metadata with unstructured into
+		{
+			data:  []byte("{}"),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data:  []byte("{}"),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:  []byte(`{"kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"kind": "Foo"}},
+			// TODO(109023): expect this to error; unstructured decoding currently only requires kind to be set, not apiVersion
+		},
+		{
+			data:  []byte(`{"kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"kind": "Foo"}},
+			strict:         true,
+			// TODO(109023): expect this to error; unstructured decoding currently only requires kind to be set, not apiVersion
+		},
+
+		{
+			data:  []byte(`{"apiVersion":"foo/v1"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data:  []byte(`{"apiVersion":"foo/v1"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:  []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "/v1", "kind": "Foo"}},
+		},
+		{
+			data:  []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "/v1", "kind": "Foo"}},
+			strict:         true,
+		},
+
+		// missing metadata with unstructured into providing metadata
+		{
+			data:  []byte("{}"),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data:  []byte("{}"),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:  []byte(`{"kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"kind": "Foo"}},
+			// TODO(109023): expect this to error; unstructured decoding currently only requires kind to be set, not apiVersion
+		},
+		{
+			data:  []byte(`{"kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"kind": "Foo"}},
+			strict:         true,
+			// TODO(109023): expect this to error; unstructured decoding currently only requires kind to be set, not apiVersion
+		},
+
+		{
+			data:  []byte(`{"apiVersion":"foo/v1"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data:  []byte(`{"apiVersion":"foo/v1"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:  []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "/v1", "kind": "Foo"}},
+		},
+		{
+			data:  []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "/v1", "kind": "Foo"}},
+			strict:         true,
+		},
+
+		// missing metadata without into, unstructured creater
+		{
+			data:    []byte("{}"),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data:    []byte("{}"),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:    []byte(`{"kind":"Foo"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK: &schema.GroupVersionKind{Kind: "Foo"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'apiVersion' is missing in") },
+		},
+		{
+			data:    []byte(`{"kind":"Foo"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK: &schema.GroupVersionKind{Kind: "Foo"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'apiVersion' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:    []byte(`{"apiVersion":"foo/v1"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data:    []byte(`{"apiVersion":"foo/v1"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:    []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "/v1", "kind": "Foo"}},
+		},
+		{
+			data:    []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "/v1", "kind": "Foo"}},
+			strict:         true,
+		},
+
+		// creator errors
+		{
+			data:       []byte("{}"),
+			defaultGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			creater:    &mockCreater{err: fmt.Errorf("fake error")},
+
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			errFn:       func(err error) bool { return err.Error() == "fake error" },
+		},
+		{
+			data:       []byte("{}"),
+			defaultGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			creater:    &mockCreater{err: fmt.Errorf("fake error")},
+
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			errFn:       func(err error) bool { return err.Error() == "fake error" },
+		},
+		// creator typed
+		{
+			data:           []byte("{}"),
+			defaultGVK:     &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			creater:        &mockCreater{obj: &testDecodable{}},
+			expectedObject: &testDecodable{},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+		},
+		{
+			data:           []byte("{}"),
+			defaultGVK:     &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			creater:        &mockCreater{obj: &testDecodable{}},
+			expectedObject: &testDecodable{},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			strict:         true,
+		},
+
+		// version without group is not defaulted
+		{
+			data:           []byte(`{"apiVersion":"blah"}`),
+			defaultGVK:     &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			creater:        &mockCreater{obj: &testDecodable{}},
+			expectedObject: &testDecodable{TypeMeta: metav1.TypeMeta{APIVersion: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "", Version: "blah"},
+		},
+		// group without version is defaulted
+		{
+			data:           []byte(`{"apiVersion":"other/"}`),
+			defaultGVK:     &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			creater:        &mockCreater{obj: &testDecodable{}},
+			expectedObject: &testDecodable{TypeMeta: metav1.TypeMeta{APIVersion: "other/"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+		},
+		// group version, kind is defaulted
+		{
+			data:           []byte(`{"apiVersion":"other1/blah1"}`),
+			defaultGVK:     &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			creater:        &mockCreater{obj: &testDecodable{}},
+			expectedObject: &testDecodable{TypeMeta: metav1.TypeMeta{APIVersion: "other1/blah1"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other1", Version: "blah1"},
+		},
+		// gvk all provided then not defaulted at all
+		{
+			data:           []byte(`{"kind":"Test","apiVersion":"other/blah"}`),
+			defaultGVK:     &schema.GroupVersionKind{Kind: "Test1", Group: "other1", Version: "blah1"},
+			creater:        &mockCreater{obj: &testDecodable{}},
+			expectedObject: &testDecodable{TypeMeta: metav1.TypeMeta{APIVersion: "other/blah", Kind: "Test"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+		},
+		//gvk defaulting if kind not provided in data and defaultGVK use into's kind
+		{
+			data:           []byte(`{"apiVersion":"b1/c1"}`),
+			into:           &testDecodable{TypeMeta: metav1.TypeMeta{Kind: "a3", APIVersion: "b1/c1"}},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "a3", Group: "b1", Version: "c1"}},
+			defaultGVK:     nil,
+			creater:        &mockCreater{obj: &testDecodable{}},
+			expectedObject: &testDecodable{TypeMeta: metav1.TypeMeta{Kind: "a3", APIVersion: "b1/c1"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "a3", Group: "b1", Version: "c1"},
+		},
+
+		// accept runtime.Unknown as into and bypass creator
+		{
+			data: []byte(`{}`),
+			into: &runtime.Unknown{},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			expectedObject: &runtime.Unknown{
+				Raw:         []byte(`{}`),
+				ContentType: runtime.ContentTypeJSON,
+			},
+		},
+		{
+			data: []byte(`{"test":"object"}`),
+			into: &runtime.Unknown{},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			expectedObject: &runtime.Unknown{
+				Raw:         []byte(`{"test":"object"}`),
+				ContentType: runtime.ContentTypeJSON,
+			},
+		},
+		{
+			data:        []byte(`{"test":"object"}`),
+			into:        &runtime.Unknown{},
+			defaultGVK:  &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &runtime.Unknown{
+				TypeMeta:    runtime.TypeMeta{APIVersion: "other/blah", Kind: "Test"},
+				Raw:         []byte(`{"test":"object"}`),
+				ContentType: runtime.ContentTypeJSON,
+			},
+		},
+
+		// unregistered objects can be decoded into directly
+		{
+			data:        []byte(`{"kind":"Test","apiVersion":"other/blah","value":1,"Other":"test"}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{err: runtime.NewNotRegisteredErrForKind("mock", schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"})},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				TypeMeta: metav1.TypeMeta{APIVersion: "other/blah", Kind: "Test"},
+				Other:    "test",
+				Value:    1,
+			},
+		},
+		// registered types get defaulted by the into object kind
+		{
+			data:        []byte(`{"value":1,"Other":"test"}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				Other: "test",
+				Value: 1,
+			},
+		},
+		// registered types get defaulted by the into object kind even without version, but return an error
+		{
+			data:        []byte(`{"value":1,"Other":"test"}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: ""}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: ""},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'apiVersion' is missing in") },
+			expectedObject: &testDecodable{
+				Other: "test",
+				Value: 1,
+			},
+		},
+		// Error on invalid number
+		{
+			data:        []byte(`{"kind":"Test","apiVersion":"other/blah","interface":1e1000}`),
+			creater:     &mockCreater{obj: &testDecodable{}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `json: cannot unmarshal number 1e1000 into Go struct field testDecodable.interface of type float64`)
+			},
+		},
+		// Unmarshalling is case-sensitive
+		{
+			// "VaLue" should have been "value"
+			data:        []byte(`{"kind":"Test","apiVersion":"other/blah","VaLue":1,"Other":"test"}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{err: runtime.NewNotRegisteredErrForKind("mock", schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"})},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				TypeMeta: metav1.TypeMeta{APIVersion: "other/blah", Kind: "Test"},
+				Other:    "test",
+			},
+		},
+		// Unmarshalling is case-sensitive for big struct.
+		{
+			// "b" should have been "B", "I" should have been "i"
+			data:        []byte(`{"kind":"Test","apiVersion":"other/blah","spec": {"A": 1, "b": 2, "h": 3, "I": 4}}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{err: runtime.NewNotRegisteredErrForKind("mock", schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"})},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				TypeMeta: metav1.TypeMeta{APIVersion: "other/blah", Kind: "Test"},
+				Spec:     DecodableSpec{A: 1, H: 3},
+			},
+		},
+		// Unknown fields should return an error from the strict JSON deserializer.
+		{
+			data:        []byte(`{"unknown": 1}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `unknown field "unknown"`)
+			},
+			strict: true,
+		},
+		// Unknown fields should return an error from the strict YAML deserializer.
+		{
+			data:        []byte("unknown: 1\n"),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `unknown field "unknown"`)
+			},
+			yaml:   true,
+			strict: true,
+		},
+		// Duplicate fields should return an error from the strict JSON deserializer.
+		{
+			data:        []byte(`{"value":1,"value":1}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `duplicate field "value"`)
+			},
+			strict: true,
+		},
+		// Duplicate fields should return an error from the strict YAML deserializer.
+		{
+			data: []byte("value: 1\n" +
+				"value: 1\n"),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `"value" already set in map`)
+			},
+			yaml:   true,
+			strict: true,
+		},
+		// Duplicate fields should return an error from the strict JSON deserializer for unstructured.
+		{
+			data:        []byte(`{"kind":"Custom","value":1,"value":1}`),
+			into:        &unstructured.Unstructured{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Custom"},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `duplicate field "value"`)
+			},
+			strict: true,
+		},
+		// Duplicate fields should return an error from the strict YAML deserializer for unstructured.
+		{
+			data: []byte("kind: Custom\n" +
+				"value: 1\n" +
+				"value: 1\n"),
+			into:        &unstructured.Unstructured{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Custom"},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `"value" already set in map`)
+			},
+			yaml:   true,
+			strict: true,
+		},
+		// Strict JSON decode into unregistered objects directly.
+		{
+			data:        []byte(`{"kind":"Test","apiVersion":"other/blah","value":1,"Other":"test"}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{err: runtime.NewNotRegisteredErrForKind("mock", schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"})},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				TypeMeta: metav1.TypeMeta{APIVersion: "other/blah", Kind: "Test"},
+				Other:    "test",
+				Value:    1,
+			},
+			strict: true,
+		},
+		// Strict YAML decode into unregistered objects directly.
+		{
+			data: []byte("kind: Test\n" +
+				"apiVersion: other/blah\n" +
+				"value: 1\n" +
+				"Other: test\n"),
+			into:        &testDecodable{},
+			typer:       &mockTyper{err: runtime.NewNotRegisteredErrForKind("mock", schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"})},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				TypeMeta: metav1.TypeMeta{APIVersion: "other/blah", Kind: "Test"},
+				Other:    "test",
+				Value:    1,
+			},
+			yaml:   true,
+			strict: true,
+		},
+		// Valid strict JSON decode without GVK.
+		{
+			data:        []byte(`{"value":1234}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				Value: 1234,
+			},
+			strict: true,
+		},
+		// Valid strict YAML decode without GVK.
+		{
+			data:        []byte("value: 1234\n"),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				Value: 1234,
+			},
+			yaml:   true,
+			strict: true,
+		},
+		// Invalid strict JSON, results in json parse error:
+		{
+			data:  []byte("foo"),
+			into:  &unstructured.Unstructured{},
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `json parse error: invalid character 'o'`)
+			},
+			strict: true,
+		},
+		// empty JSON strict, results in missing kind error
+		{
+			data:        []byte("{}"),
+			into:        &unstructured.Unstructured{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `Object 'Kind' is missing`)
+			},
+			strict: true,
+		},
+		// coerce from null
+		{
+			data:           []byte(`{"bool":null,"int":null,"int32":null,"int64":null,"float32":null,"float64":null,"string":null,"array":null,"map":null,"struct":null}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{},
+			strict:         true,
+		},
+		{
+			data:           []byte(`{"bool":null,"int":null,"int32":null,"int64":null,"float32":null,"float64":null,"string":null,"array":null,"map":null,"struct":null}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{},
+			yaml:           true,
+			strict:         true,
+		},
+		// coerce from string
+		{
+			data:           []byte(`{"string":""}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{},
+			strict:         true,
+		},
+		{
+			data:           []byte(`{"string":""}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{},
+			yaml:           true,
+			strict:         true,
+		},
+		// coerce from array
+		{
+			data:           []byte(`{"array":[]}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Array: []string{}},
+			strict:         true,
+		},
+		{
+			data:           []byte(`{"array":[]}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Array: []string{}},
+			yaml:           true,
+			strict:         true,
+		},
+		// coerce from map
+		{
+			data:           []byte(`{"map":{},"struct":{}}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Map: map[string]string{}},
+			strict:         true,
+		},
+		{
+			data:           []byte(`{"map":{},"struct":{}}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Map: map[string]string{}},
+			yaml:           true,
+			strict:         true,
+		},
+		// coerce from int
+		{
+			data:           []byte(`{"int":1,"int32":1,"int64":1,"float32":1,"float64":1}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Int: 1, Int32: 1, Int64: 1, Float32: 1, Float64: 1},
+			strict:         true,
+		},
+		{
+			data:           []byte(`{"int":1,"int32":1,"int64":1,"float32":1,"float64":1}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Int: 1, Int32: 1, Int64: 1, Float32: 1, Float64: 1},
+			yaml:           true,
+			strict:         true,
+		},
+		// coerce from float
+		{
+			data:           []byte(`{"float32":1.0,"float64":1.0}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Float32: 1, Float64: 1},
+			strict:         true,
+		},
+		{
+			data:           []byte(`{"int":1.0,"int32":1.0,"int64":1.0,"float32":1.0,"float64":1.0}`), // floating point gets dropped in yaml -> json step
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Int: 1, Int32: 1, Int64: 1, Float32: 1, Float64: 1},
+			yaml:           true,
+			strict:         true,
+		},
+	}
+
+	logTestCase := func(t *testing.T, tc testCase) {
+		t.Logf("data=%s\n\tinto=%T, yaml=%v, strict=%v", string(tc.data), tc.into, tc.yaml, tc.strict)
+	}
+
+	for i, test := range testCases {
+		var s runtime.Serializer
+		if test.yaml {
+			s = json.NewSerializerWithOptions(json.DefaultMetaFactory, test.creater, test.typer, json.SerializerOptions{Yaml: test.yaml, Pretty: false, Strict: test.strict})
+		} else {
+			s = json.NewSerializerWithOptions(json.DefaultMetaFactory, test.creater, test.typer, json.SerializerOptions{Yaml: test.yaml, Pretty: test.pretty, Strict: test.strict})
+		}
+		obj, gvk, err := s.Decode([]byte(test.data), test.defaultGVK, test.into)
+
+		if !reflect.DeepEqual(test.expectedGVK, gvk) {
+			logTestCase(t, test)
+			t.Errorf("%d: unexpected GVK: %v", i, gvk)
+		}
+
+		switch {
+		case err == nil && test.errFn != nil:
+			logTestCase(t, test)
+			t.Errorf("%d: failed: not getting the expected error", i)
+			continue
+		case err != nil && test.errFn == nil:
+			logTestCase(t, test)
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil:
+			if !test.errFn(err) {
+				logTestCase(t, test)
+				t.Errorf("%d: failed: %v", i, err)
+			}
+			if !runtime.IsStrictDecodingError(err) && obj != nil {
+				logTestCase(t, test)
+				t.Errorf("%d: should have returned nil object", i)
+			}
+			continue
+		}
+
+		if test.into != nil && test.into != obj {
+			logTestCase(t, test)
+			t.Errorf("%d: expected into to be returned: %v", i, obj)
+			continue
+		}
+
+		if !reflect.DeepEqual(test.expectedObject, obj) {
+			logTestCase(t, test)
+			t.Errorf("%d: unexpected object:\n%s", i, diff.ObjectGoPrintSideBySide(test.expectedObject, obj))
+		}
+	}
+}
+
+func TestCacheableObject(t *testing.T) {
+	gvk := schema.GroupVersionKind{Group: "group", Version: "version", Kind: "MockCacheableObject"}
+	creater := &mockCreater{obj: &runtimetesting.MockCacheableObject{}}
+	typer := &mockTyper{gvk: &gvk}
+	serializer := json.NewSerializerWithOptions(json.DefaultMetaFactory, creater, typer, json.SerializerOptions{})
+
+	runtimetesting.CacheableObjectTest(t, serializer)
+}
+
+type mockCreater struct {
+	apiVersion string
+	kind       string
+	err        error
+	obj        runtime.Object
+}
+
+func (c *mockCreater) New(kind schema.GroupVersionKind) (runtime.Object, error) {
+	c.apiVersion, c.kind = kind.GroupVersion().String(), kind.Kind
+	return c.obj, c.err
+}
+
+type mockTyper struct {
+	gvk *schema.GroupVersionKind
+	err error
+}
+
+func (t *mockTyper) ObjectKinds(obj runtime.Object) ([]schema.GroupVersionKind, bool, error) {
+	if t.gvk == nil {
+		return nil, false, t.err
+	}
+	return []schema.GroupVersionKind{*t.gvk}, false, t.err
+}
+
+func (t *mockTyper) Recognizes(_ schema.GroupVersionKind) bool {
+	return false
+}
+
+type testEncodableDuplicateTag struct {
+	metav1.TypeMeta `json:""`
+
+	A1 int `json:"a"`
+	A2 int `json:"a"` //nolint:govet // This is intentional to test that the encoder will not encode two map entries with the same key.
+}
+
+func (testEncodableDuplicateTag) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+type testEncodableTagMatchesUntaggedName struct {
+	metav1.TypeMeta `json:""`
+
+	A       int
+	TaggedA int `json:"A"`
+}
+
+func (testEncodableTagMatchesUntaggedName) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+type staticTextMarshaler int
+
+func (staticTextMarshaler) MarshalText() ([]byte, error) {
+	return []byte("static"), nil
+}
+
+type testEncodableMap[K comparable] map[K]interface{}
+
+func (testEncodableMap[K]) GetObjectKind() schema.ObjectKind {
+	panic("unimplemented")
+}
+
+func (testEncodableMap[K]) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+func TestEncode(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		in   runtime.Object
+		want []byte
+	}{
+		// The Go visibility rules for struct fields are amended for JSON when deciding
+		// which field to marshal or unmarshal. If there are multiple fields at the same
+		// level, and that level is the least nested (and would therefore be the nesting
+		// level selected by the usual Go rules), the following extra rules apply:
+
+		// 1) Of those fields, if any are JSON-tagged, only tagged fields are considered,
+		//    even if there are multiple untagged fields that would otherwise conflict.
+		{
+			name: "only tagged field is considered if any are tagged",
+			in: &testEncodableTagMatchesUntaggedName{
+				A:       1,
+				TaggedA: 2,
+			},
+			want: []byte("{\"A\":2}\n"),
+		},
+		// 2) If there is exactly one field (tagged or not according to the first rule),
+		//    that is selected.
+		// 3) Otherwise there are multiple fields, and all are ignored; no error occurs.
+		{
+			name: "all duplicate fields are ignored",
+			in:   &testEncodableDuplicateTag{},
+			want: []byte("{}\n"),
+		},
+		{
+			name: "text marshaler keys can compare inequal but serialize to duplicates",
+			in: testEncodableMap[staticTextMarshaler]{
+				staticTextMarshaler(1): nil,
+				staticTextMarshaler(2): nil,
+			},
+			want: []byte("{\"static\":null,\"static\":null}\n"),
+		},
+		{
+			name: "time.Time keys can compare inequal but serialize to duplicates because time.Time implements TextMarshaler",
+			in: testEncodableMap[time.Time]{
+				time.Date(2222, 11, 30, 23, 59, 58, 57, time.UTC):              nil,
+				time.Date(2222, 11, 30, 23, 59, 58, 57, time.FixedZone("", 0)): nil,
+			},
+			want: []byte("{\"2222-11-30T23:59:58.000000057Z\":null,\"2222-11-30T23:59:58.000000057Z\":null}\n"),
+		},
+		{
+			name: "metav1.Time keys can compare inequal but serialize to duplicates because metav1.Time embeds time.Time which implements TextMarshaler",
+			in: testEncodableMap[metav1.Time]{
+				metav1.Date(2222, 11, 30, 23, 59, 58, 57, time.UTC):              nil,
+				metav1.Date(2222, 11, 30, 23, 59, 58, 57, time.FixedZone("", 0)): nil,
+			},
+			want: []byte("{\"2222-11-30T23:59:58.000000057Z\":null,\"2222-11-30T23:59:58.000000057Z\":null}\n"),
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var dst bytes.Buffer
+			s := json.NewSerializerWithOptions(json.DefaultMetaFactory, nil, nil, json.SerializerOptions{})
+			if err := s.Encode(tc.in, &dst); err != nil {
+				t.Errorf("unexpected error: %v", err)
+			}
+			if diff := cmp.Diff(tc.want, dst.Bytes()); diff != "" {
+				t.Errorf("unexpected output:\n%s", diff)
+			}
+		})
+	}
+}
+
+// TestRoundtripUnstructuredFloat64 demonstrates that encoding a fractionless float64 value to JSON
+// then decoding into interface{} can produce a value with concrete type int64. This is a
+// consequence of two specific behaviors. First, there is nothing in the JSON encoding of a
+// fractionless float64 value to distinguish it from the JSON encoding of an integer value. Second,
+// if, when unmarshaling into interface{}, the decoder encounters a JSON number with no decimal
+// point in the input, it produces a value with concrete type int64 as long as the number can be
+// precisely represented by an int64.
+func TestRoundtripUnstructuredFractionlessFloat64(t *testing.T) {
+	s := json.NewSerializerWithOptions(json.DefaultMetaFactory, runtime.NewScheme(), runtime.NewScheme(), json.SerializerOptions{})
+
+	initial := &unstructured.Unstructured{Object: map[string]interface{}{
+		"apiVersion":                    "v1",
+		"kind":                          "Test",
+		"with-fraction":                 float64(1.5),
+		"without-fraction":              float64(1),
+		"without-fraction-big-positive": float64(9223372036854776000),
+		"without-fraction-big-negative": float64(-9223372036854776000),
+	}}
+
+	var buf bytes.Buffer
+	if err := s.Encode(initial, &buf); err != nil {
+		t.Fatal(err)
+	}
+
+	final := &unstructured.Unstructured{}
+	got, _, err := s.Decode(buf.Bytes(), nil, final)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != final {
+		t.Fatalf("expected Decode to return target Unstructured object but got: %v", got)
+	}
+
+	expected := &unstructured.Unstructured{Object: map[string]interface{}{
+		"apiVersion":                    "v1",
+		"kind":                          "Test",
+		"with-fraction":                 float64(1.5),
+		"without-fraction":              int64(1), // note the change in concrete type
+		"without-fraction-big-positive": float64(9223372036854776000),
+		"without-fraction-big-negative": float64(-9223372036854776000),
+	}}
+
+	if diff := cmp.Diff(expected, final); diff != "" {
+		t.Fatalf("unexpected diff:\n%s", diff)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/meta.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/meta.go
new file mode 100644
index 0000000000..df3f5f989a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/meta.go
@@ -0,0 +1,63 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// MetaFactory is used to store and retrieve the version and kind
+// information for JSON objects in a serializer.
+type MetaFactory interface {
+	// Interpret should return the version and kind of the wire-format of
+	// the object.
+	Interpret(data []byte) (*schema.GroupVersionKind, error)
+}
+
+// DefaultMetaFactory is a default factory for versioning objects in JSON. The object
+// in memory and in the default JSON serialization will use the "kind" and "apiVersion"
+// fields.
+var DefaultMetaFactory = SimpleMetaFactory{}
+
+// SimpleMetaFactory provides default methods for retrieving the type and version of objects
+// that are identified with an "apiVersion" and "kind" fields in their JSON
+// serialization. It may be parameterized with the names of the fields in memory, or an
+// optional list of base structs to search for those fields in memory.
+type SimpleMetaFactory struct {
+}
+
+// Interpret will return the APIVersion and Kind of the JSON wire-format
+// encoding of an object, or an error.
+func (SimpleMetaFactory) Interpret(data []byte) (*schema.GroupVersionKind, error) {
+	findKind := struct {
+		// +optional
+		APIVersion string `json:"apiVersion,omitempty"`
+		// +optional
+		Kind string `json:"kind,omitempty"`
+	}{}
+	if err := json.Unmarshal(data, &findKind); err != nil {
+		return nil, fmt.Errorf("couldn't get version/kind; json parse error: %v", err)
+	}
+	gv, err := schema.ParseGroupVersion(findKind.APIVersion)
+	if err != nil {
+		return nil, err
+	}
+	return &schema.GroupVersionKind{Group: gv.Group, Version: gv.Version, Kind: findKind.Kind}, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/meta_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/meta_test.go
new file mode 100644
index 0000000000..5c5dda89e6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/meta_test.go
@@ -0,0 +1,45 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import "testing"
+
+func TestSimpleMetaFactoryInterpret(t *testing.T) {
+	factory := SimpleMetaFactory{}
+	gvk, err := factory.Interpret([]byte(`{"apiVersion":"1","kind":"object"}`))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if gvk.Version != "1" || gvk.Kind != "object" {
+		t.Errorf("unexpected interpret: %#v", gvk)
+	}
+
+	// no kind or version
+	gvk, err = factory.Interpret([]byte(`{}`))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if gvk.Version != "" || gvk.Kind != "" {
+		t.Errorf("unexpected interpret: %#v", gvk)
+	}
+
+	// unparsable
+	_, err = factory.Interpret([]byte(`{`))
+	if err == nil {
+		t.Errorf("unexpected non-error")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/negotiated_codec.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/negotiated_codec.go
new file mode 100644
index 0000000000..a42b4a41a8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/negotiated_codec.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serializer
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// TODO: We should split negotiated serializers that we can change versions on from those we can change
+// serialization formats on
+type negotiatedSerializerWrapper struct {
+	info runtime.SerializerInfo
+}
+
+func NegotiatedSerializerWrapper(info runtime.SerializerInfo) runtime.NegotiatedSerializer {
+	return &negotiatedSerializerWrapper{info}
+}
+
+func (n *negotiatedSerializerWrapper) SupportedMediaTypes() []runtime.SerializerInfo {
+	return []runtime.SerializerInfo{n.info}
+}
+
+func (n *negotiatedSerializerWrapper) EncoderForVersion(e runtime.Encoder, _ runtime.GroupVersioner) runtime.Encoder {
+	return e
+}
+
+func (n *negotiatedSerializerWrapper) DecoderToVersion(d runtime.Decoder, _gv runtime.GroupVersioner) runtime.Decoder {
+	return d
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections.go
new file mode 100644
index 0000000000..8db8932fbb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections.go
@@ -0,0 +1,173 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"encoding/binary"
+	"errors"
+	"io"
+	"math/bits"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+var (
+	errFieldCount          = errors.New("expected ListType to have 3 fields")
+	errTypeMetaField       = errors.New("expected TypeMeta field to have TypeMeta type")
+	errTypeMetaProtobufTag = errors.New(`expected TypeMeta protobuf field tag to be ""`)
+	errListMetaField       = errors.New("expected ListMeta field to have ListMeta type")
+	errListMetaProtobufTag = errors.New(`expected ListMeta protobuf field tag to be "bytes,1,opt,name=metadata"`)
+	errItemsProtobufTag    = errors.New(`expected Items protobuf field tag to be "bytes,2,rep,name=items"`)
+	errItemsSizer          = errors.New(`expected Items elements to implement proto.Sizer`)
+)
+
+// getStreamingListData implements list extraction logic for protobuf stream serialization.
+//
+// Reason for a custom logic instead of reusing accessors from meta package:
+// * Validate proto tags to prevent incompatibility with proto standard package.
+// * ListMetaAccessor doesn't distinguish empty from nil value.
+// * TypeAccessor reparsing "apiVersion" and serializing it with "{group}/{version}"
+func getStreamingListData(list runtime.Object) (data streamingListData, err error) {
+	listValue, err := conversion.EnforcePtr(list)
+	if err != nil {
+		return data, err
+	}
+	listType := listValue.Type()
+	if listType.NumField() != 3 {
+		return data, errFieldCount
+	}
+	// TypeMeta: validated, but not returned as is not serialized.
+	_, ok := listValue.Field(0).Interface().(metav1.TypeMeta)
+	if !ok {
+		return data, errTypeMetaField
+	}
+	if listType.Field(0).Tag.Get("protobuf") != "" {
+		return data, errTypeMetaProtobufTag
+	}
+	// ListMeta
+	listMeta, ok := listValue.Field(1).Interface().(metav1.ListMeta)
+	if !ok {
+		return data, errListMetaField
+	}
+	// if we were ever to relax the protobuf tag check we should update the hardcoded `0xa` below when writing ListMeta.
+	if listType.Field(1).Tag.Get("protobuf") != "bytes,1,opt,name=metadata" {
+		return data, errListMetaProtobufTag
+	}
+	data.listMeta = listMeta
+	// Items; if we were ever to relax the protobuf tag check we should update the hardcoded `0x12` below when writing Items.
+	if listType.Field(2).Tag.Get("protobuf") != "bytes,2,rep,name=items" {
+		return data, errItemsProtobufTag
+	}
+	items, err := meta.ExtractList(list)
+	if err != nil {
+		return data, err
+	}
+	data.items = items
+	data.totalSize, data.listMetaSize, data.itemsSizes, err = listSize(listMeta, items)
+	return data, err
+}
+
+type streamingListData struct {
+	// totalSize is the total size of the serialized List object, including their proto headers/size bytes
+	totalSize int
+
+	// listMetaSize caches results from .Size() call to listMeta, doesn't include header bytes (field identifier, size)
+	listMetaSize int
+	listMeta     metav1.ListMeta
+
+	// itemsSizes caches results from .Size() call to items, doesn't include header bytes (field identifier, size)
+	itemsSizes []int
+	items      []runtime.Object
+}
+
+type sizer interface {
+	Size() int
+}
+
+// listSize return size of ListMeta and items to be later used for preallocations.
+// listMetaSize and itemSizes do not include header bytes (field identifier, size).
+func listSize(listMeta metav1.ListMeta, items []runtime.Object) (totalSize, listMetaSize int, itemSizes []int, err error) {
+	// ListMeta
+	listMetaSize = listMeta.Size()
+	totalSize += 1 + sovGenerated(uint64(listMetaSize)) + listMetaSize
+	// Items
+	itemSizes = make([]int, len(items))
+	for i, item := range items {
+		sizer, ok := item.(sizer)
+		if !ok {
+			return totalSize, listMetaSize, nil, errItemsSizer
+		}
+		n := sizer.Size()
+		itemSizes[i] = n
+		totalSize += 1 + sovGenerated(uint64(n)) + n
+	}
+	return totalSize, listMetaSize, itemSizes, nil
+}
+
+func streamingEncodeUnknownList(w io.Writer, unk runtime.Unknown, listData streamingListData, memAlloc runtime.MemoryAllocator) error {
+	_, err := w.Write(protoEncodingPrefix)
+	if err != nil {
+		return err
+	}
+	// encodeList is responsible for encoding the List into the unknown Raw.
+	encodeList := func(writer io.Writer) (int, error) {
+		return streamingEncodeList(writer, listData, memAlloc)
+	}
+	_, err = unk.MarshalToWriter(w, listData.totalSize, encodeList)
+	return err
+}
+
+func streamingEncodeList(w io.Writer, listData streamingListData, memAlloc runtime.MemoryAllocator) (size int, err error) {
+	// headerScratch escapes via w.Write, so allocate it once per call instead of once per item.
+	headerScratch := make([]byte, 1+binary.MaxVarintLen64)
+	// ListMeta; 0xa = (1 << 3) | 2; field number: 1, type: 2 (LEN). https://protobuf.dev/programming-guides/encoding/#structure
+	n, err := doEncodeWithHeader(&listData.listMeta, w, 0xa, listData.listMetaSize, headerScratch, memAlloc)
+	size += n
+	if err != nil {
+		return size, err
+	}
+	// Items; 0x12 = (2 << 3) | 2; field number: 2, type: 2 (LEN). https://protobuf.dev/programming-guides/encoding/#structure
+	for i, item := range listData.items {
+		n, err := doEncodeWithHeader(item, w, 0x12, listData.itemsSizes[i], headerScratch, memAlloc)
+		size += n
+		if err != nil {
+			return size, err
+		}
+	}
+	return size, nil
+}
+
+// sovGenerated is copied from `generated.pb.go` returns size of varint.
+func sovGenerated(v uint64) int {
+	return (bits.Len64(v|1) + 6) / 7
+}
+
+// encodeVarintGenerated is copied from `generated.pb.go` encodes varint.
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections_test.go
new file mode 100644
index 0000000000..826fdc1681
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections_test.go
@@ -0,0 +1,363 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"bytes"
+	"encoding/base64"
+	"io"
+	"math/rand"
+	"os/exec"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"sigs.k8s.io/randfill"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	testapigroupv1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestCollectionsEncoding(t *testing.T) {
+	t.Run("Normal", func(t *testing.T) {
+		testCollectionsEncoding(t, NewSerializer(nil, nil), false)
+	})
+	t.Run("Streaming", func(t *testing.T) {
+		testCollectionsEncoding(t, NewSerializerWithOptions(nil, nil, SerializerOptions{StreamingCollectionsEncoding: true}), true)
+	})
+}
+
+func testCollectionsEncoding(t *testing.T, s *Serializer, streamingEnabled bool) {
+	var remainingItems int64 = 1
+	testCases := []struct {
+		name string
+		in   runtime.Object
+		// expect is base64 encoded protobuf bytes
+		expect string
+	}{
+		{
+			name: "CarpList items nil",
+			in: &testapigroupv1.CarpList{
+				Items: nil,
+			},
+			expect: "azhzAAoECgASABIICgYKABIAGgAaACIA",
+		},
+		{
+			name: "CarpList slice nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: nil,
+						},
+					},
+				},
+			},
+			expect: "azhzAAoECgASABJBCgYKABIAGgASNwoQCgASABoAIgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgAaACIA",
+		},
+		{
+			name: "CarpList map nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: nil,
+						},
+					},
+				},
+			},
+			expect: "azhzAAoECgASABJBCgYKABIAGgASNwoQCgASABoAIgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgAaACIA",
+		},
+		{
+			name: "CarpList items empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{},
+			},
+			expect: "azhzAAoECgASABIICgYKABIAGgAaACIA",
+		},
+		{
+			name: "CarpList slice empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: []testapigroupv1.CarpCondition{},
+						},
+					},
+				},
+			},
+			expect: "azhzAAoECgASABJBCgYKABIAGgASNwoQCgASABoAIgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgAaACIA",
+		},
+		{
+			name: "CarpList map empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: map[string]string{},
+						},
+					},
+				},
+			},
+			expect: "azhzAAoECgASABJBCgYKABIAGgASNwoQCgASABoAIgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgAaACIA",
+		},
+		{
+			name: "List just kind",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind: "List",
+				},
+			},
+			expect: "azhzAAoICgASBExpc3QSCAoGCgASABoAGgAiAA==",
+		},
+		{
+			name: "List just apiVersion",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "v1",
+				},
+			},
+			expect: "azhzAAoGCgJ2MRIAEggKBgoAEgAaABoAIgA=",
+		},
+		{
+			name: "List no elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{},
+			},
+			expect: "azhzAAoKCgJ2MRIETGlzdBIMCgoKABIEMjM0NRoAGgAiAA==",
+		},
+		{
+			name: "List one element with continue",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion:    "2345",
+					Continue:           "abc",
+					RemainingItemCount: &remainingItems,
+				},
+				Items: []testapigroupv1.Carp{
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod",
+						Namespace: "default",
+					}},
+				},
+			},
+			expect: "azhzAAoKCgJ2MRIETGlzdBJUCg8KABIEMjM0NRoDYWJjIAESQQoaCgNwb2QSABoHZGVmYXVsdCIAKgAyADgAQgASFxoAQgBKAFIAWABgAGgAggEAigEAmgEAGgoKABoAIgAqADIAGgAiAA==",
+		},
+		{
+			name: "List two elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod",
+						Namespace: "default",
+					}},
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod2",
+						Namespace: "default2",
+					}},
+				},
+			},
+			expect: "azhzAAoKCgJ2MRIETGlzdBKUAQoKCgASBDIzNDUaABJBChoKA3BvZBIAGgdkZWZhdWx0IgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgASQwocCgRwb2QyEgAaCGRlZmF1bHQyIgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgAaACIA",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			var buf writeCountingBuffer
+			if err := s.Encode(tc.in, &buf); err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			actualBytes := buf.Bytes()
+			expectBytes, err := io.ReadAll(base64.NewDecoder(base64.StdEncoding, bytes.NewBufferString(tc.expect)))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !bytes.Equal(expectBytes, actualBytes) {
+				expectedBytes, err := base64.StdEncoding.DecodeString(tc.expect)
+				if err == nil {
+					t.Errorf("expected:\n%v\ngot:\n%v", expectedBytes, actualBytes)
+				} else {
+					t.Errorf("expected:\n%v\ngot:\n%v", tc.expect, base64.StdEncoding.EncodeToString(actualBytes))
+				}
+				actualProto := dumpProto(t, actualBytes[4:])
+				expectedProto := dumpProto(t, expectBytes[4:])
+				if actualProto != "" && expectedProto != "" {
+					t.Log(cmp.Diff(actualProto, expectedProto))
+				} else {
+					t.Log(cmp.Diff(actualBytes, expectBytes))
+				}
+			}
+			if streamingEnabled && buf.writeCount <= 1 {
+				t.Errorf("expected streaming but Write was called only: %d", buf.writeCount)
+			}
+			if !streamingEnabled && buf.writeCount > 1 {
+				t.Errorf("expected non-streaming but Write was called more than once: %d", buf.writeCount)
+			}
+		})
+	}
+}
+
+// dumpProto does a best-effort dump of the given proto bytes using protoc if it can be found in the path.
+// This is only used when the test has already failed, to try to give more visibility into the diff of the failure.
+func dumpProto(t *testing.T, data []byte) string {
+	t.Helper()
+	protoc, err := exec.LookPath("protoc")
+	if err != nil {
+		t.Logf("cannot find protoc in path to dump proto contents: %v", err)
+		return ""
+	}
+	cmd := exec.Command(protoc, "--decode_raw")
+	cmd.Stdin = bytes.NewBuffer(data)
+	d, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Logf("protoc invocation failed: %v", err)
+		return ""
+	}
+	return string(d)
+}
+
+type writeCountingBuffer struct {
+	writeCount int
+	bytes.Buffer
+}
+
+func (b *writeCountingBuffer) Write(data []byte) (int, error) {
+	b.writeCount++
+	return b.Buffer.Write(data)
+}
+
+func (b *writeCountingBuffer) Reset() {
+	b.writeCount = 0
+	b.Buffer.Reset()
+}
+
+func TestFuzzCollection(t *testing.T) {
+	f := randfill.New()
+	streamingEncoder := NewSerializerWithOptions(nil, nil, SerializerOptions{StreamingCollectionsEncoding: true})
+	streamingBuffer := &bytes.Buffer{}
+	normalEncoder := NewSerializerWithOptions(nil, nil, SerializerOptions{StreamingCollectionsEncoding: false})
+	normalBuffer := &bytes.Buffer{}
+	for i := 0; i < 1000; i++ {
+		list := &testapigroupv1.CarpList{}
+		f.FillNoCustom(list)
+		streamingBuffer.Reset()
+		normalBuffer.Reset()
+		if err := streamingEncoder.Encode(list, streamingBuffer); err != nil {
+			t.Fatal(err)
+		}
+		if err := normalEncoder.Encode(list, normalBuffer); err != nil {
+			t.Fatal(err)
+		}
+		if diff := cmp.Diff(streamingBuffer.String(), normalBuffer.String()); diff != "" {
+			t.Logf("normal: %s", normalBuffer.String())
+			t.Logf("streaming: %s", streamingBuffer.String())
+			t.Fatalf("unexpected output:\n%s", diff)
+		}
+	}
+}
+
+func TestCallsToSize(t *testing.T) {
+	counter := &countingSizer{data: []byte("abba")}
+	listMeta := metav1.ListMeta{}
+	listData := streamingListData{
+		totalSize:    14,
+		listMeta:     listMeta,
+		listMetaSize: listMeta.Size(),
+		itemsSizes:   []int{counter.Size()},
+		items:        []runtime.Object{counter},
+	}
+	err := streamingEncodeUnknownList(io.Discard, runtime.Unknown{}, listData, &runtime.Allocator{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if counter.count != 1 {
+		t.Errorf("Expected only 1 call to sizer, got %d", counter.count)
+	}
+}
+
+type countingSizer struct {
+	data  []byte
+	count int
+}
+
+var _ runtime.ProtobufMarshaller = (*countingSizer)(nil)
+
+func (s *countingSizer) MarshalTo(data []byte) (int, error) {
+	return copy(data, s.data), nil
+}
+func (s *countingSizer) Size() int {
+	s.count++
+	return len(s.data)
+}
+
+func (s *countingSizer) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (s *countingSizer) GetObjectKind() schema.ObjectKind {
+	return nil
+}
+
+func BenchmarkStreamEncodeProtobufCollections(b *testing.B) {
+	disableFuzzFieldsV1 := func(field *metav1.FieldsV1, c randfill.Continue) {}
+	fuzzMap := func(kvs map[string]interface{}, c randfill.Continue) {
+		kvs[c.String(0)] = c.Bool()
+		kvs[c.String(0)] = c.Uint64()
+		kvs[c.String(0)] = c.String(0)
+	}
+	f := randfill.New().RandSource(rand.NewSource(12345)).Funcs(disableFuzzFieldsV1, fuzzMap)
+	carpList := &testapigroupv1.CarpList{}
+	carpList.Items = make([]testapigroupv1.Carp, 1000)
+	for i := range 1000 {
+		f.Fill(&carpList.Items[i])
+	}
+	carpList.Kind = "CarpList"
+	carpList.APIVersion = "testapigroup.k8s.io/v1"
+	carpList.ResourceVersion = "12345"
+
+	encoder := NewSerializerWithOptions(nil, nil, SerializerOptions{StreamingCollectionsEncoding: true})
+	b.Run("CarpList", func(b *testing.B) {
+		var buf bytes.Buffer
+		b.ReportAllocs()
+		b.ResetTimer()
+		for i := 0; i < b.N; i++ {
+			buf.Reset()
+			if err := encoder.Encode(carpList, &buf); err != nil {
+				b.Fatal(err)
+			}
+		}
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/doc.go
new file mode 100644
index 0000000000..381748d69f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/doc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package protobuf provides a Kubernetes serializer for the protobuf format.
+package protobuf
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf.go
new file mode 100644
index 0000000000..93ad95cef3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf.go
@@ -0,0 +1,568 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"net/http"
+	"reflect"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/recognizer"
+	"k8s.io/apimachinery/pkg/util/framer"
+	"k8s.io/klog/v2"
+)
+
+var (
+	// protoEncodingPrefix serves as a magic number for an encoded protobuf message on this serializer. All
+	// proto messages serialized by this schema will be preceded by the bytes 0x6b 0x38 0x73, with the fourth
+	// byte being reserved for the encoding style. The only encoding style defined is 0x00, which means that
+	// the rest of the byte stream is a message of type k8s.io.kubernetes.pkg.runtime.Unknown (proto2).
+	//
+	// See k8s.io/apimachinery/pkg/runtime/generated.proto for details of the runtime.Unknown message.
+	//
+	// This encoding scheme is experimental, and is subject to change at any time.
+	protoEncodingPrefix = []byte{0x6b, 0x38, 0x73, 0x00}
+)
+
+type errNotMarshalable struct {
+	t reflect.Type
+}
+
+func (e errNotMarshalable) Error() string {
+	return fmt.Sprintf("object %v does not implement the protobuf marshalling interface and cannot be encoded to a protobuf message", e.t)
+}
+
+func (e errNotMarshalable) Status() metav1.Status {
+	return metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusNotAcceptable,
+		Reason:  metav1.StatusReason("NotAcceptable"),
+		Message: e.Error(),
+	}
+}
+
+// IsNotMarshalable checks the type of error, returns a boolean true if error is not nil and not marshalable false otherwise
+func IsNotMarshalable(err error) bool {
+	_, ok := err.(errNotMarshalable)
+	return err != nil && ok
+}
+
+// NewSerializer creates a Protobuf serializer that handles encoding versioned objects into the proper wire form. If a typer
+// is passed, the encoded object will have group, version, and kind fields set. If typer is nil, the objects will be written
+// as-is (any type info passed with the object will be used).
+func NewSerializer(creater runtime.ObjectCreater, typer runtime.ObjectTyper) *Serializer {
+	return NewSerializerWithOptions(creater, typer, SerializerOptions{})
+}
+
+// NewSerializerWithOptions creates a Protobuf serializer that handles encoding versioned objects into the proper wire form. If a typer
+// is passed, the encoded object will have group, version, and kind fields set. If typer is nil, the objects will be written
+// as-is (any type info passed with the object will be used).
+func NewSerializerWithOptions(creater runtime.ObjectCreater, typer runtime.ObjectTyper, opts SerializerOptions) *Serializer {
+	return &Serializer{
+		prefix:  protoEncodingPrefix,
+		creater: creater,
+		typer:   typer,
+		options: opts,
+	}
+}
+
+// Serializer handles encoding versioned objects into the proper wire form
+type Serializer struct {
+	prefix  []byte
+	creater runtime.ObjectCreater
+	typer   runtime.ObjectTyper
+
+	options SerializerOptions
+}
+
+// SerializerOptions holds the options which are used to configure a Proto serializer.
+type SerializerOptions struct {
+	// StreamingCollectionsEncoding enables encoding collection, one item at the time, drastically reducing memory needed.
+	StreamingCollectionsEncoding bool
+}
+
+var _ runtime.Serializer = &Serializer{}
+var _ runtime.EncoderWithAllocator = &Serializer{}
+var _ recognizer.RecognizingDecoder = &Serializer{}
+
+const serializerIdentifier runtime.Identifier = "protobuf"
+
+// Decode attempts to convert the provided data into a protobuf message, extract the stored schema kind, apply the provided default
+// gvk, and then load that data into an object matching the desired schema kind or the provided into. If into is *runtime.Unknown,
+// the raw data will be extracted and no decoding will be performed. If into is not registered with the typer, then the object will
+// be straight decoded using normal protobuf unmarshalling (the MarshalTo interface). If into is provided and the original data is
+// not fully qualified with kind/version/group, the type of the into will be used to alter the returned gvk. On success or most
+// errors, the method will return the calculated schema kind.
+func (s *Serializer) Decode(originalData []byte, gvk *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	prefixLen := len(s.prefix)
+	switch {
+	case len(originalData) == 0:
+		// TODO: treat like decoding {} from JSON with defaulting
+		return nil, nil, fmt.Errorf("empty data")
+	case len(originalData) < prefixLen || !bytes.Equal(s.prefix, originalData[:prefixLen]):
+		return nil, nil, fmt.Errorf("provided data does not appear to be a protobuf message, expected prefix %v", s.prefix)
+	case len(originalData) == prefixLen:
+		// TODO: treat like decoding {} from JSON with defaulting
+		return nil, nil, fmt.Errorf("empty body")
+	}
+
+	data := originalData[prefixLen:]
+	unk := runtime.Unknown{}
+	if err := unk.Unmarshal(data); err != nil {
+		return nil, nil, err
+	}
+
+	actual := unk.GroupVersionKind()
+	copyKindDefaults(&actual, gvk)
+
+	if intoUnknown, ok := into.(*runtime.Unknown); ok && intoUnknown != nil {
+		*intoUnknown = unk
+		if ok, _, _ := s.RecognizesData(unk.Raw); ok {
+			intoUnknown.ContentType = runtime.ContentTypeProtobuf
+		}
+		return intoUnknown, &actual, nil
+	}
+
+	if into != nil {
+		types, _, err := s.typer.ObjectKinds(into)
+		switch {
+		case runtime.IsNotRegisteredError(err):
+			unmarshaler, ok := into.(unmarshaler)
+			if !ok {
+				return nil, &actual, errNotMarshalable{reflect.TypeOf(into)}
+			}
+			// top-level unmarshal resets before delegating unmarshaling to the object
+			unmarshaler.Reset()
+			if err := unmarshaler.Unmarshal(unk.Raw); err != nil {
+				return nil, &actual, err
+			}
+			return into, &actual, nil
+		case err != nil:
+			return nil, &actual, err
+		default:
+			copyKindDefaults(&actual, &types[0])
+			// if the result of defaulting did not set a version or group, ensure that at least group is set
+			// (copyKindDefaults will not assign Group if version is already set). This guarantees that the group
+			// of into is set if there is no better information from the caller or object.
+			if len(actual.Version) == 0 && len(actual.Group) == 0 {
+				actual.Group = types[0].Group
+			}
+		}
+	}
+
+	if len(actual.Kind) == 0 {
+		return nil, &actual, runtime.NewMissingKindErr(fmt.Sprintf("%#v", unk.TypeMeta))
+	}
+	if len(actual.Version) == 0 {
+		return nil, &actual, runtime.NewMissingVersionErr(fmt.Sprintf("%#v", unk.TypeMeta))
+	}
+
+	return unmarshalToObject(s.typer, s.creater, &actual, into, unk.Raw)
+}
+
+// EncodeWithAllocator writes an object to the provided writer.
+// In addition, it allows for providing a memory allocator for efficient memory usage during object serialization.
+func (s *Serializer) EncodeWithAllocator(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	return s.encode(obj, w, memAlloc)
+}
+
+// Encode serializes the provided object to the given writer.
+func (s *Serializer) Encode(obj runtime.Object, w io.Writer) error {
+	return s.encode(obj, w, &runtime.SimpleAllocator{})
+}
+
+func (s *Serializer) encode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	if co, ok := obj.(runtime.CacheableObject); ok {
+		return co.CacheEncode(s.Identifier(), func(obj runtime.Object, w io.Writer) error { return s.doEncode(obj, w, memAlloc) }, w)
+	}
+	return s.doEncode(obj, w, memAlloc)
+}
+
+func (s *Serializer) doEncode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	if memAlloc == nil {
+		//nolint:logcheck // Should not be reached in normal operations.
+		klog.Error("a mandatory memory allocator wasn't provided, this might have a negative impact on performance, check invocations of EncodeWithAllocator method, falling back on runtime.SimpleAllocator")
+		memAlloc = &runtime.SimpleAllocator{}
+	}
+	prefixSize := uint64(len(s.prefix))
+
+	var unk runtime.Unknown
+	switch t := obj.(type) {
+	case *runtime.Unknown:
+		estimatedSize := prefixSize + uint64(t.Size())
+		data := memAlloc.Allocate(estimatedSize)
+		i, err := t.MarshalTo(data[prefixSize:])
+		if err != nil {
+			return err
+		}
+		copy(data, s.prefix)
+		_, err = w.Write(data[:prefixSize+uint64(i)])
+		return err
+	default:
+		kind := obj.GetObjectKind().GroupVersionKind()
+		unk = runtime.Unknown{
+			TypeMeta: runtime.TypeMeta{
+				Kind:       kind.Kind,
+				APIVersion: kind.GroupVersion().String(),
+			},
+		}
+	}
+	if s.options.StreamingCollectionsEncoding {
+		listData, err := getStreamingListData(obj)
+		if err == nil {
+			// Doesn't honor custom proto marshaling methods (like json streaming), because all proto objects implement proto methods.
+			return streamingEncodeUnknownList(w, unk, listData, memAlloc)
+		}
+	}
+
+	switch t := obj.(type) {
+	case bufferedMarshaller:
+		// this path performs a single allocation during write only when the Allocator wasn't provided
+		// it also requires the caller to implement the more efficient Size and MarshalToSizedBuffer methods
+		encodedSize := uint64(t.Size())
+		estimatedSize := prefixSize + estimateUnknownSize(&unk, encodedSize)
+		data := memAlloc.Allocate(estimatedSize)
+
+		i, err := unk.NestedMarshalTo(data[prefixSize:], t, encodedSize)
+		if err != nil {
+			return err
+		}
+
+		copy(data, s.prefix)
+
+		_, err = w.Write(data[:prefixSize+uint64(i)])
+		return err
+
+	case unbufferedMarshaller:
+		// this path performs extra allocations
+		data, err := t.Marshal()
+		if err != nil {
+			return err
+		}
+		unk.Raw = data
+
+		estimatedSize := prefixSize + uint64(unk.Size())
+		data = memAlloc.Allocate(estimatedSize)
+
+		i, err := unk.MarshalTo(data[prefixSize:])
+		if err != nil {
+			return err
+		}
+
+		copy(data, s.prefix)
+
+		_, err = w.Write(data[:prefixSize+uint64(i)])
+		return err
+
+	default:
+		// TODO: marshal with a different content type and serializer (JSON for third party objects)
+		return errNotMarshalable{reflect.TypeOf(obj)}
+	}
+}
+
+// Identifier implements runtime.Encoder interface.
+func (s *Serializer) Identifier() runtime.Identifier {
+	return serializerIdentifier
+}
+
+// RecognizesData implements the RecognizingDecoder interface.
+func (s *Serializer) RecognizesData(data []byte) (bool, bool, error) {
+	return bytes.HasPrefix(data, s.prefix), false, nil
+}
+
+// copyKindDefaults defaults dst to the value in src if dst does not have a value set.
+func copyKindDefaults(dst, src *schema.GroupVersionKind) {
+	if src == nil {
+		return
+	}
+	// apply kind and version defaulting from provided default
+	if len(dst.Kind) == 0 {
+		dst.Kind = src.Kind
+	}
+	if len(dst.Version) == 0 && len(src.Version) > 0 {
+		dst.Group = src.Group
+		dst.Version = src.Version
+	}
+}
+
+// bufferedMarshaller describes a more efficient marshalling interface that can avoid allocating multiple
+// byte buffers by pre-calculating the size of the final buffer needed.
+type bufferedMarshaller interface {
+	runtime.ProtobufMarshaller
+}
+
+// Like bufferedMarshaller, but is able to marshal backwards, which is more efficient since it doesn't call Size() as frequently.
+type bufferedReverseMarshaller interface {
+	runtime.ProtobufReverseMarshaller
+}
+
+type unbufferedMarshaller interface {
+	Marshal() ([]byte, error)
+}
+
+// unmarshaler is the subset of gogo Message and Unmarshaler used by unmarshal
+type unmarshaler interface {
+	// Reset() is called on the top-level message before unmarshaling,
+	// and clears all existing data from the message instance.
+	Reset()
+	// Unmarshal decodes from the start of the data into the message.
+	Unmarshal([]byte) error
+}
+
+// estimateUnknownSize returns the expected bytes consumed by a given runtime.Unknown
+// object with a nil RawJSON struct and the expected size of the provided buffer. The
+// returned size will not be correct if RawJSOn is set on unk.
+func estimateUnknownSize(unk *runtime.Unknown, byteSize uint64) uint64 {
+	size := uint64(unk.Size())
+	// protobuf uses 1 byte for the tag, a varint for the length of the array (at most 8 bytes - uint64 - here),
+	// and the size of the array.
+	size += 1 + 8 + byteSize
+	return size
+}
+
+// NewRawSerializer creates a Protobuf serializer that handles encoding versioned objects into the proper wire form. If typer
+// is not nil, the object has the group, version, and kind fields set. This serializer does not provide type information for the
+// encoded object, and thus is not self describing (callers must know what type is being described in order to decode).
+//
+// This encoding scheme is experimental, and is subject to change at any time.
+func NewRawSerializer(creater runtime.ObjectCreater, typer runtime.ObjectTyper) *RawSerializer {
+	return &RawSerializer{
+		creater: creater,
+		typer:   typer,
+	}
+}
+
+// RawSerializer encodes and decodes objects without adding a runtime.Unknown wrapper (objects are encoded without identifying
+// type).
+type RawSerializer struct {
+	creater runtime.ObjectCreater
+	typer   runtime.ObjectTyper
+}
+
+var _ runtime.Serializer = &RawSerializer{}
+
+const rawSerializerIdentifier runtime.Identifier = "raw-protobuf"
+
+// Decode attempts to convert the provided data into a protobuf message, extract the stored schema kind, apply the provided default
+// gvk, and then load that data into an object matching the desired schema kind or the provided into. If into is *runtime.Unknown,
+// the raw data will be extracted and no decoding will be performed. If into is not registered with the typer, then the object will
+// be straight decoded using normal protobuf unmarshalling (the MarshalTo interface). If into is provided and the original data is
+// not fully qualified with kind/version/group, the type of the into will be used to alter the returned gvk. On success or most
+// errors, the method will return the calculated schema kind.
+func (s *RawSerializer) Decode(originalData []byte, gvk *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	if into == nil {
+		return nil, nil, fmt.Errorf("this serializer requires an object to decode into: %#v", s)
+	}
+
+	if len(originalData) == 0 {
+		// TODO: treat like decoding {} from JSON with defaulting
+		return nil, nil, fmt.Errorf("empty data")
+	}
+	data := originalData
+
+	actual := &schema.GroupVersionKind{}
+	copyKindDefaults(actual, gvk)
+
+	if intoUnknown, ok := into.(*runtime.Unknown); ok && intoUnknown != nil {
+		intoUnknown.Raw = data
+		intoUnknown.ContentEncoding = ""
+		intoUnknown.ContentType = runtime.ContentTypeProtobuf
+		intoUnknown.SetGroupVersionKind(*actual)
+		return intoUnknown, actual, nil
+	}
+
+	types, _, err := s.typer.ObjectKinds(into)
+	switch {
+	case runtime.IsNotRegisteredError(err):
+		unmarshaler, ok := into.(unmarshaler)
+		if !ok {
+			return nil, actual, errNotMarshalable{reflect.TypeOf(into)}
+		}
+		// top-level unmarshal resets before delegating unmarshaling to the object
+		unmarshaler.Reset()
+		if err := unmarshaler.Unmarshal(data); err != nil {
+			return nil, actual, err
+		}
+		return into, actual, nil
+	case err != nil:
+		return nil, actual, err
+	default:
+		copyKindDefaults(actual, &types[0])
+		// if the result of defaulting did not set a version or group, ensure that at least group is set
+		// (copyKindDefaults will not assign Group if version is already set). This guarantees that the group
+		// of into is set if there is no better information from the caller or object.
+		if len(actual.Version) == 0 && len(actual.Group) == 0 {
+			actual.Group = types[0].Group
+		}
+	}
+
+	if len(actual.Kind) == 0 {
+		return nil, actual, runtime.NewMissingKindErr("<protobuf encoded body - must provide default type>")
+	}
+	if len(actual.Version) == 0 {
+		return nil, actual, runtime.NewMissingVersionErr("<protobuf encoded body - must provide default type>")
+	}
+
+	return unmarshalToObject(s.typer, s.creater, actual, into, data)
+}
+
+// unmarshalToObject is the common code between decode in the raw and normal serializer.
+func unmarshalToObject(typer runtime.ObjectTyper, creater runtime.ObjectCreater, actual *schema.GroupVersionKind, into runtime.Object, data []byte) (runtime.Object, *schema.GroupVersionKind, error) {
+	// use the target if necessary
+	obj, err := runtime.UseOrCreateObject(typer, creater, *actual, into)
+	if err != nil {
+		return nil, actual, err
+	}
+
+	unmarshaler, ok := obj.(unmarshaler)
+	if !ok {
+		return nil, actual, errNotMarshalable{reflect.TypeOf(obj)}
+	}
+	// top-level unmarshal resets before delegating unmarshaling to the object
+	unmarshaler.Reset()
+	if err := unmarshaler.Unmarshal(data); err != nil {
+		return nil, actual, err
+	}
+	if actual != nil {
+		obj.GetObjectKind().SetGroupVersionKind(*actual)
+	}
+	return obj, actual, nil
+}
+
+// Encode serializes the provided object to the given writer. Overrides is ignored.
+func (s *RawSerializer) Encode(obj runtime.Object, w io.Writer) error {
+	return s.encode(obj, w, &runtime.SimpleAllocator{})
+}
+
+// EncodeWithAllocator writes an object to the provided writer.
+// In addition, it allows for providing a memory allocator for efficient memory usage during object serialization.
+func (s *RawSerializer) EncodeWithAllocator(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	return s.encode(obj, w, memAlloc)
+}
+
+func (s *RawSerializer) encode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	if co, ok := obj.(runtime.CacheableObject); ok {
+		return co.CacheEncode(s.Identifier(), func(obj runtime.Object, w io.Writer) error { return s.doEncode(obj, w, memAlloc) }, w)
+	}
+	return s.doEncode(obj, w, memAlloc)
+}
+
+func (s *RawSerializer) doEncode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	_, err := doEncode(obj, w, nil, memAlloc)
+	return err
+}
+
+func doEncodeWithHeader(obj any, w io.Writer, field byte, precomputedSize int, headerScratch []byte, memAlloc runtime.MemoryAllocator) (size int, err error) {
+	// Field identifier and size
+	header := headerScratch[:1+sovGenerated(uint64(precomputedSize))]
+	header[0] = field
+	encodeVarintGenerated(header, len(header), uint64(precomputedSize))
+	n, err := w.Write(header)
+	size += n
+	if err != nil {
+		return size, err
+	}
+	// Obj
+	n, err = doEncode(obj, w, &precomputedSize, memAlloc)
+	size += n
+	if err != nil {
+		return size, err
+	}
+	if n != precomputedSize {
+		return size, fmt.Errorf("the size value was %d, but doEncode wrote %d bytes to data", precomputedSize, n)
+	}
+	return size, nil
+}
+
+// doEncode encodes provided object into writer using a allocator if possible.
+// Avoids call by object Size if precomputedObjSize is provided.
+// precomputedObjSize should not include header bytes (field identifier, size).
+func doEncode(obj any, w io.Writer, precomputedObjSize *int, memAlloc runtime.MemoryAllocator) (int, error) {
+	if memAlloc == nil {
+		//nolint:logcheck // Should not be reached in normal operations.
+		klog.Error("a mandatory memory allocator wasn't provided, this might have a negative impact on performance, check invocations of EncodeWithAllocator method, falling back on runtime.SimpleAllocator")
+		memAlloc = &runtime.SimpleAllocator{}
+	}
+	switch t := obj.(type) {
+	case bufferedReverseMarshaller:
+		// this path performs a single allocation during write only when the Allocator wasn't provided
+		// it also requires the caller to implement the more efficient Size and MarshalToSizedBuffer methods
+		if precomputedObjSize == nil {
+			s := t.Size()
+			precomputedObjSize = &s
+		}
+		data := memAlloc.Allocate(uint64(*precomputedObjSize))
+
+		n, err := t.MarshalToSizedBuffer(data)
+		if err != nil {
+			return 0, err
+		}
+		return w.Write(data[:n])
+
+	case bufferedMarshaller:
+		// this path performs a single allocation during write only when the Allocator wasn't provided
+		// it also requires the caller to implement the more efficient Size and MarshalTo methods
+		if precomputedObjSize == nil {
+			s := t.Size()
+			precomputedObjSize = &s
+		}
+		data := memAlloc.Allocate(uint64(*precomputedObjSize))
+
+		n, err := t.MarshalTo(data)
+		if err != nil {
+			return 0, err
+		}
+		return w.Write(data[:n])
+
+	case unbufferedMarshaller:
+		// this path performs extra allocations
+		data, err := t.Marshal()
+		if err != nil {
+			return 0, err
+		}
+		return w.Write(data)
+
+	default:
+		return 0, errNotMarshalable{reflect.TypeOf(obj)}
+	}
+}
+
+// Identifier implements runtime.Encoder interface.
+func (s *RawSerializer) Identifier() runtime.Identifier {
+	return rawSerializerIdentifier
+}
+
+// LengthDelimitedFramer is exported variable of type lengthDelimitedFramer
+var LengthDelimitedFramer = lengthDelimitedFramer{}
+
+// Provides length delimited frame reader and writer methods
+type lengthDelimitedFramer struct{}
+
+// NewFrameWriter implements stream framing for this serializer
+func (lengthDelimitedFramer) NewFrameWriter(w io.Writer) io.Writer {
+	return framer.NewLengthDelimitedFrameWriter(w)
+}
+
+// NewFrameReader implements stream framing for this serializer
+func (lengthDelimitedFramer) NewFrameReader(r io.ReadCloser) io.ReadCloser {
+	return framer.NewLengthDelimitedFrameReader(r)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf_test.go
new file mode 100644
index 0000000000..df9a52d5d8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf_test.go
@@ -0,0 +1,180 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"bytes"
+	"reflect"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	testapigroupv1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+)
+
+func TestCacheableObject(t *testing.T) {
+	gvk := schema.GroupVersionKind{Group: "group", Version: "version", Kind: "MockCacheableObject"}
+	creater := &mockCreater{obj: &runtimetesting.MockCacheableObject{}}
+	typer := &mockTyper{gvk: &gvk}
+
+	encoders := []runtime.Encoder{
+		NewSerializer(creater, typer),
+		NewRawSerializer(creater, typer),
+	}
+
+	for _, encoder := range encoders {
+		runtimetesting.CacheableObjectTest(t, encoder)
+	}
+}
+
+type mockCreater struct {
+	apiVersion string
+	kind       string
+	err        error
+	obj        runtime.Object
+}
+
+func (c *mockCreater) New(kind schema.GroupVersionKind) (runtime.Object, error) {
+	c.apiVersion, c.kind = kind.GroupVersion().String(), kind.Kind
+	return c.obj, c.err
+}
+
+type mockTyper struct {
+	gvk *schema.GroupVersionKind
+	err error
+}
+
+func (t *mockTyper) ObjectKinds(obj runtime.Object) ([]schema.GroupVersionKind, bool, error) {
+	if t.gvk == nil {
+		return nil, false, t.err
+	}
+	return []schema.GroupVersionKind{*t.gvk}, false, t.err
+}
+
+func (t *mockTyper) Recognizes(_ schema.GroupVersionKind) bool {
+	return false
+}
+
+func TestSerializerEncodeWithAllocator(t *testing.T) {
+	testCases := []struct {
+		name string
+		obj  runtime.Object
+	}{
+		{
+			name: "encode a bufferedMarshaller obj",
+			obj: &testapigroupv1.Carp{
+				TypeMeta: metav1.TypeMeta{APIVersion: "group/version", Kind: "Carp"},
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "name",
+					Namespace: "namespace",
+				},
+				Spec: testapigroupv1.CarpSpec{
+					Subdomain: "carp.k8s.io",
+				},
+			},
+		},
+
+		{
+			name: "encode a runtime.Unknown obj",
+			obj:  &runtime.Unknown{TypeMeta: runtime.TypeMeta{APIVersion: "group/version", Kind: "Unknown"}, Raw: []byte("hello world")},
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			target := NewSerializer(nil, nil)
+
+			writer := &bytes.Buffer{}
+			if err := target.Encode(tc.obj, writer); err != nil {
+				t.Fatal(err)
+			}
+
+			writer2 := &bytes.Buffer{}
+			alloc := &testAllocator{}
+			if err := target.EncodeWithAllocator(tc.obj, writer2, alloc); err != nil {
+				t.Fatal(err)
+			}
+			if alloc.allocateCount != 1 {
+				t.Fatalf("expected the Allocate method to be called exactly 1 but it was executed: %v times ", alloc.allocateCount)
+			}
+
+			// to ensure compatibility of the new method with the old one, serialized data must be equal
+			// also we are not testing decoding since "roundtripping" is tested elsewhere for all known types
+			if !reflect.DeepEqual(writer.Bytes(), writer2.Bytes()) {
+				t.Fatal("data mismatch, data serialized with the Encode method is different than serialized with the EncodeWithAllocator method")
+			}
+		})
+	}
+}
+
+func TestRawSerializerEncodeWithAllocator(t *testing.T) {
+	testCases := []struct {
+		name string
+		obj  runtime.Object
+	}{
+		{
+			name: "encode a bufferedReverseMarshaller obj",
+			obj: &testapigroupv1.Carp{
+				TypeMeta: metav1.TypeMeta{APIVersion: "group/version", Kind: "Carp"},
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "name",
+					Namespace: "namespace",
+				},
+				Spec: testapigroupv1.CarpSpec{
+					Subdomain: "carp.k8s.io",
+				},
+			},
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			writer := &bytes.Buffer{}
+			target := NewRawSerializer(nil, nil)
+
+			if err := target.Encode(tc.obj, writer); err != nil {
+				t.Fatal(err)
+			}
+
+			writer2 := &bytes.Buffer{}
+			alloc := &testAllocator{}
+			if err := target.EncodeWithAllocator(tc.obj, writer2, alloc); err != nil {
+				t.Fatal(err)
+			}
+			if alloc.allocateCount != 1 {
+				t.Fatalf("expected the Allocate method to be called exactly 1 but it was executed: %v times ", alloc.allocateCount)
+			}
+
+			// to ensure compatibility of the new method with the old one, serialized data must be equal
+			// also we are not testing decoding since "roundtripping" is tested elsewhere for all known types
+			if !reflect.DeepEqual(writer.Bytes(), writer2.Bytes()) {
+				t.Fatal("data mismatch, data serialized with the Encode method is different than serialized with the EncodeWithAllocator method")
+			}
+		})
+	}
+}
+
+type testAllocator struct {
+	buf           []byte
+	allocateCount int
+}
+
+func (ta *testAllocator) Allocate(n uint64) []byte {
+	ta.buf = make([]byte, n)
+	ta.allocateCount++
+	return ta.buf
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/recognizer/recognizer.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/recognizer/recognizer.go
new file mode 100644
index 0000000000..5a6c200dd1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/recognizer/recognizer.go
@@ -0,0 +1,128 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package recognizer
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type RecognizingDecoder interface {
+	runtime.Decoder
+	// RecognizesData should return true if the input provided in the provided reader
+	// belongs to this decoder, or an error if the data could not be read or is ambiguous.
+	// Unknown is true if the data could not be determined to match the decoder type.
+	// Decoders should assume that they can read as much of peek as they need (as the caller
+	// provides) and may return unknown if the data provided is not sufficient to make a
+	// a determination. When peek returns EOF that may mean the end of the input or the
+	// end of buffered input - recognizers should return the best guess at that time.
+	RecognizesData(peek []byte) (ok, unknown bool, err error)
+}
+
+// NewDecoder creates a decoder that will attempt multiple decoders in an order defined
+// by:
+//
+// 1. The decoder implements RecognizingDecoder and identifies the data
+// 2. All other decoders, and any decoder that returned true for unknown.
+//
+// The order passed to the constructor is preserved within those priorities.
+func NewDecoder(decoders ...runtime.Decoder) runtime.Decoder {
+	return &decoder{
+		decoders: decoders,
+	}
+}
+
+type decoder struct {
+	decoders []runtime.Decoder
+}
+
+var _ RecognizingDecoder = &decoder{}
+
+func (d *decoder) RecognizesData(data []byte) (bool, bool, error) {
+	var (
+		lastErr    error
+		anyUnknown bool
+	)
+	for _, r := range d.decoders {
+		switch t := r.(type) {
+		case RecognizingDecoder:
+			ok, unknown, err := t.RecognizesData(data)
+			if err != nil {
+				lastErr = err
+				continue
+			}
+			anyUnknown = anyUnknown || unknown
+			if !ok {
+				continue
+			}
+			return true, false, nil
+		}
+	}
+	return false, anyUnknown, lastErr
+}
+
+func (d *decoder) Decode(data []byte, gvk *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	var (
+		lastErr error
+		skipped []runtime.Decoder
+	)
+
+	// try recognizers, record any decoders we need to give a chance later
+	for _, r := range d.decoders {
+		switch t := r.(type) {
+		case RecognizingDecoder:
+			ok, unknown, err := t.RecognizesData(data)
+			if err != nil {
+				lastErr = err
+				continue
+			}
+			if unknown {
+				skipped = append(skipped, t)
+				continue
+			}
+			if !ok {
+				continue
+			}
+			return r.Decode(data, gvk, into)
+		default:
+			skipped = append(skipped, t)
+		}
+	}
+
+	// try recognizers that returned unknown or didn't recognize their data
+	for _, r := range skipped {
+		out, actual, err := r.Decode(data, gvk, into)
+		if err != nil {
+			// if we got an object back from the decoder, and the
+			// error was a strict decoding error (e.g. unknown or
+			// duplicate fields), we still consider the recognizer
+			// to have understood the object
+			if out == nil || !runtime.IsStrictDecodingError(err) {
+				lastErr = err
+				continue
+			}
+		}
+		return out, actual, err
+	}
+
+	if lastErr == nil {
+		lastErr = fmt.Errorf("no serialization format matched the provided data")
+	}
+	return nil, nil, lastErr
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/recognizer/testing/recognizer_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/recognizer/testing/recognizer_test.go
new file mode 100644
index 0000000000..ac882f8388
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/recognizer/testing/recognizer_test.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+	"k8s.io/apimachinery/pkg/runtime/serializer/recognizer"
+)
+
+type A struct{}
+
+func (A) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+func (a A) DeepCopyObject() runtime.Object {
+	return a
+}
+
+func TestRecognizer(t *testing.T) {
+	s := runtime.NewScheme()
+	s.AddKnownTypes(schema.GroupVersion{Version: "v1"}, &A{})
+	d := recognizer.NewDecoder(
+		json.NewSerializerWithOptions(json.DefaultMetaFactory, s, s, json.SerializerOptions{}),
+		json.NewSerializerWithOptions(json.DefaultMetaFactory, s, s, json.SerializerOptions{Yaml: true}),
+	)
+	out, _, err := d.Decode([]byte(`
+kind: A
+apiVersion: v1
+`), nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Logf("%#v", out)
+
+	out, _, err = d.Decode([]byte(`
+{
+  "kind":"A",
+  "apiVersion":"v1"
+}
+`), nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Logf("%#v", out)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/sparse_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/sparse_test.go
new file mode 100644
index 0000000000..406bc3615d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/sparse_test.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serializer
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"k8s.io/apimachinery/pkg/api/equality"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type FakeV1Obj struct {
+	metav1.TypeMeta
+	metav1.ObjectMeta
+}
+
+func (*FakeV1Obj) DeepCopyObject() runtime.Object {
+	panic("not supported")
+}
+
+type FakeV2DifferentObj struct {
+	metav1.TypeMeta
+	metav1.ObjectMeta
+}
+
+func (*FakeV2DifferentObj) DeepCopyObject() runtime.Object {
+	panic("not supported")
+}
+func TestSparse(t *testing.T) {
+	v1 := schema.GroupVersion{Group: "mygroup", Version: "v1"}
+	v2 := schema.GroupVersion{Group: "mygroup", Version: "v2"}
+
+	scheme := runtime.NewScheme()
+	scheme.AddKnownTypes(v1, &FakeV1Obj{})
+	scheme.AddKnownTypes(v2, &FakeV2DifferentObj{})
+	codecs := NewCodecFactory(scheme)
+
+	srcObj1 := &FakeV1Obj{ObjectMeta: metav1.ObjectMeta{Name: "foo"}}
+	srcObj2 := &FakeV2DifferentObj{ObjectMeta: metav1.ObjectMeta{Name: "foo"}}
+
+	encoder := codecs.LegacyCodec(v2, v1)
+	decoder := codecs.UniversalDecoder(v2, v1)
+
+	srcObj1Bytes, err := runtime.Encode(encoder, srcObj1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Log(string(srcObj1Bytes))
+	srcObj2Bytes, err := runtime.Encode(encoder, srcObj2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Log(string(srcObj2Bytes))
+
+	uncastDstObj1, err := runtime.Decode(decoder, srcObj1Bytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	uncastDstObj2, err := runtime.Decode(decoder, srcObj2Bytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// clear typemeta
+	uncastDstObj1.(*FakeV1Obj).TypeMeta = metav1.TypeMeta{}
+	uncastDstObj2.(*FakeV2DifferentObj).TypeMeta = metav1.TypeMeta{}
+
+	if !equality.Semantic.DeepEqual(srcObj1, uncastDstObj1) {
+		t.Fatal(cmp.Diff(srcObj1, uncastDstObj1))
+	}
+	if !equality.Semantic.DeepEqual(srcObj2, uncastDstObj2) {
+		t.Fatal(cmp.Diff(srcObj2, uncastDstObj2))
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/streaming/streaming.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/streaming/streaming.go
new file mode 100644
index 0000000000..971c46d496
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/streaming/streaming.go
@@ -0,0 +1,136 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package streaming implements encoder and decoder for streams
+// of runtime.Objects over io.Writer/Readers.
+package streaming
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// Encoder is a runtime.Encoder on a stream.
+type Encoder interface {
+	// Encode will write the provided object to the stream or return an error. It obeys the same
+	// contract as runtime.VersionedEncoder.
+	Encode(obj runtime.Object) error
+}
+
+// Decoder is a runtime.Decoder from a stream.
+type Decoder interface {
+	// Decode will return io.EOF when no more objects are available.
+	Decode(defaults *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error)
+	// Close closes the underlying stream.
+	Close() error
+}
+
+// Serializer is a factory for creating encoders and decoders that work over streams.
+type Serializer interface {
+	NewEncoder(w io.Writer) Encoder
+	NewDecoder(r io.ReadCloser) Decoder
+}
+
+type decoder struct {
+	reader    io.ReadCloser
+	decoder   runtime.Decoder
+	buf       []byte
+	maxBytes  int
+	resetRead bool
+}
+
+// NewDecoder creates a streaming decoder that reads object chunks from r and decodes them with d.
+// The reader is expected to return ErrShortRead if the provided buffer is not large enough to read
+// an entire object.
+func NewDecoder(r io.ReadCloser, d runtime.Decoder) Decoder {
+	return &decoder{
+		reader:   r,
+		decoder:  d,
+		buf:      make([]byte, 1024),
+		maxBytes: 16 * 1024 * 1024,
+	}
+}
+
+var ErrObjectTooLarge = fmt.Errorf("object to decode was longer than maximum allowed size")
+
+// Decode reads the next object from the stream and decodes it.
+func (d *decoder) Decode(defaults *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	base := 0
+	for {
+		n, err := d.reader.Read(d.buf[base:])
+		if err == io.ErrShortBuffer {
+			if n == 0 {
+				return nil, nil, fmt.Errorf("got short buffer with n=0, base=%d, cap=%d", base, cap(d.buf))
+			}
+			if d.resetRead {
+				continue
+			}
+			// double the buffer size up to maxBytes
+			if len(d.buf) < d.maxBytes {
+				base += n
+				d.buf = append(d.buf, make([]byte, len(d.buf))...)
+				continue
+			}
+			// must read the rest of the frame (until we stop getting ErrShortBuffer)
+			d.resetRead = true
+			return nil, nil, ErrObjectTooLarge
+		}
+		if err != nil {
+			return nil, nil, err
+		}
+		if d.resetRead {
+			// now that we have drained the large read, continue
+			d.resetRead = false
+			continue
+		}
+		base += n
+		break
+	}
+	return d.decoder.Decode(d.buf[:base], defaults, into)
+}
+
+func (d *decoder) Close() error {
+	return d.reader.Close()
+}
+
+type encoder struct {
+	writer  io.Writer
+	encoder runtime.Encoder
+	buf     *bytes.Buffer
+}
+
+// NewEncoder returns a new streaming encoder.
+func NewEncoder(w io.Writer, e runtime.Encoder) Encoder {
+	return &encoder{
+		writer:  w,
+		encoder: e,
+		buf:     &bytes.Buffer{},
+	}
+}
+
+// Encode writes the provided object to the nested writer.
+func (e *encoder) Encode(obj runtime.Object) error {
+	if err := e.encoder.Encode(obj, e.buf); err != nil {
+		return err
+	}
+	_, err := e.writer.Write(e.buf.Bytes())
+	e.buf.Reset()
+	return err
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/streaming/streaming_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/streaming/streaming_test.go
new file mode 100644
index 0000000000..1721423acc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/streaming/streaming_test.go
@@ -0,0 +1,84 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package streaming
+
+import (
+	"bytes"
+	"io"
+	"io/ioutil"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/framer"
+)
+
+type fakeDecoder struct {
+	got []byte
+	obj runtime.Object
+	err error
+}
+
+func (d *fakeDecoder) Decode(data []byte, gvk *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	d.got = data
+	return d.obj, nil, d.err
+}
+
+func TestEmptyDecoder(t *testing.T) {
+	buf := bytes.NewBuffer([]byte{})
+	d := &fakeDecoder{}
+	_, _, err := NewDecoder(ioutil.NopCloser(buf), d).Decode(nil, nil)
+	if err != io.EOF {
+		t.Fatal(err)
+	}
+}
+
+func TestDecoder(t *testing.T) {
+	frames := [][]byte{
+		make([]byte, 1025),
+		make([]byte, 1024*5),
+		make([]byte, 1024*1024*17),
+		make([]byte, 1025),
+	}
+	pr, pw := io.Pipe()
+	fw := framer.NewLengthDelimitedFrameWriter(pw)
+	go func() {
+		for i := range frames {
+			fw.Write(frames[i])
+		}
+		pw.Close()
+	}()
+
+	r := framer.NewLengthDelimitedFrameReader(pr)
+	d := &fakeDecoder{}
+	dec := NewDecoder(r, d)
+	if _, _, err := dec.Decode(nil, nil); err != nil || !bytes.Equal(d.got, frames[0]) {
+		t.Fatalf("unexpected %v %v", err, len(d.got))
+	}
+	if _, _, err := dec.Decode(nil, nil); err != nil || !bytes.Equal(d.got, frames[1]) {
+		t.Fatalf("unexpected %v %v", err, len(d.got))
+	}
+	if _, _, err := dec.Decode(nil, nil); err != ErrObjectTooLarge || !bytes.Equal(d.got, frames[1]) {
+		t.Fatalf("unexpected %v %v", err, len(d.got))
+	}
+	if _, _, err := dec.Decode(nil, nil); err != nil || !bytes.Equal(d.got, frames[3]) {
+		t.Fatalf("unexpected %v %v", err, len(d.got))
+	}
+	if _, _, err := dec.Decode(nil, nil); err != io.EOF {
+		t.Fatalf("unexpected %v %v", err, len(d.got))
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go
new file mode 100644
index 0000000000..6c86d5e15c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go
@@ -0,0 +1,292 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package versioning
+
+import (
+	"encoding/json"
+	"io"
+	"reflect"
+	"sync"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/klog/v2"
+)
+
+// NewDefaultingCodecForScheme is a convenience method for callers that are using a scheme.
+func NewDefaultingCodecForScheme(
+	// TODO: I should be a scheme interface?
+	scheme *runtime.Scheme,
+	encoder runtime.Encoder,
+	decoder runtime.Decoder,
+	encodeVersion runtime.GroupVersioner,
+	decodeVersion runtime.GroupVersioner,
+) runtime.Codec {
+	return NewCodec(encoder, decoder, runtime.UnsafeObjectConvertor(scheme), scheme, scheme, scheme, encodeVersion, decodeVersion, scheme.Name())
+}
+
+// NewCodec takes objects in their internal versions and converts them to external versions before
+// serializing them. It assumes the serializer provided to it only deals with external versions.
+// This class is also a serializer, but is generally used with a specific version.
+func NewCodec(
+	encoder runtime.Encoder,
+	decoder runtime.Decoder,
+	convertor runtime.ObjectConvertor,
+	creater runtime.ObjectCreater,
+	typer runtime.ObjectTyper,
+	defaulter runtime.ObjectDefaulter,
+	encodeVersion runtime.GroupVersioner,
+	decodeVersion runtime.GroupVersioner,
+	originalSchemeName string,
+) runtime.Codec {
+	internal := &codec{
+		encoder:   encoder,
+		decoder:   decoder,
+		convertor: convertor,
+		creater:   creater,
+		typer:     typer,
+		defaulter: defaulter,
+
+		encodeVersion: encodeVersion,
+		decodeVersion: decodeVersion,
+
+		identifier: identifier(encodeVersion, encoder),
+
+		originalSchemeName: originalSchemeName,
+	}
+	return internal
+}
+
+type codec struct {
+	encoder   runtime.Encoder
+	decoder   runtime.Decoder
+	convertor runtime.ObjectConvertor
+	creater   runtime.ObjectCreater
+	typer     runtime.ObjectTyper
+	defaulter runtime.ObjectDefaulter
+
+	encodeVersion runtime.GroupVersioner
+	decodeVersion runtime.GroupVersioner
+
+	identifier runtime.Identifier
+
+	// originalSchemeName is optional, but when filled in it holds the name of the scheme from which this codec originates
+	originalSchemeName string
+}
+
+var _ runtime.EncoderWithAllocator = &codec{}
+
+var identifiersMap sync.Map
+
+type codecIdentifier struct {
+	EncodeGV string `json:"encodeGV,omitempty"`
+	Encoder  string `json:"encoder,omitempty"`
+	Name     string `json:"name,omitempty"`
+}
+
+// identifier computes Identifier of Encoder based on codec parameters.
+func identifier(encodeGV runtime.GroupVersioner, encoder runtime.Encoder) runtime.Identifier {
+	result := codecIdentifier{
+		Name: "versioning",
+	}
+
+	if encodeGV != nil {
+		result.EncodeGV = encodeGV.Identifier()
+	}
+	if encoder != nil {
+		result.Encoder = string(encoder.Identifier())
+	}
+	if id, ok := identifiersMap.Load(result); ok {
+		return id.(runtime.Identifier)
+	}
+	identifier, err := json.Marshal(result)
+	if err != nil {
+		//nolint:logcheck // Should not be reached.
+		klog.Fatalf("Failed marshaling identifier for codec: %v", err)
+	}
+	identifiersMap.Store(result, runtime.Identifier(identifier))
+	return runtime.Identifier(identifier)
+}
+
+// Decode attempts a decode of the object, then tries to convert it to the internal version. If into is provided and the decoding is
+// successful, the returned runtime.Object will be the value passed as into. Note that this may bypass conversion if you pass an
+// into that matches the serialized version.
+func (c *codec) Decode(data []byte, defaultGVK *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	// If the into object is unstructured and expresses an opinion about its group/version,
+	// create a new instance of the type so we always exercise the conversion path (skips short-circuiting on `into == obj`)
+	decodeInto := into
+	if into != nil {
+		if _, ok := into.(runtime.Unstructured); ok && !into.GetObjectKind().GroupVersionKind().GroupVersion().Empty() {
+			decodeInto = reflect.New(reflect.TypeOf(into).Elem()).Interface().(runtime.Object)
+		}
+	}
+
+	var strictDecodingErrs []error
+	obj, gvk, err := c.decoder.Decode(data, defaultGVK, decodeInto)
+	if err != nil {
+		if strictErr, ok := runtime.AsStrictDecodingError(err); obj != nil && ok {
+			// save the strictDecodingError and let the caller decide what to do with it
+			strictDecodingErrs = append(strictDecodingErrs, strictErr.Errors()...)
+		} else {
+			return nil, gvk, err
+		}
+	}
+
+	if d, ok := obj.(runtime.NestedObjectDecoder); ok {
+		if err := d.DecodeNestedObjects(runtime.WithoutVersionDecoder{Decoder: c.decoder}); err != nil {
+			if strictErr, ok := runtime.AsStrictDecodingError(err); ok {
+				// save the strictDecodingError let and the caller decide what to do with it
+				strictDecodingErrs = append(strictDecodingErrs, strictErr.Errors()...)
+			} else {
+				return nil, gvk, err
+
+			}
+		}
+	}
+
+	// aggregate the strict decoding errors into one
+	var strictDecodingErr error
+	if len(strictDecodingErrs) > 0 {
+		strictDecodingErr = runtime.NewStrictDecodingError(strictDecodingErrs)
+	}
+	// if we specify a target, use generic conversion.
+	if into != nil {
+		// perform defaulting if requested
+		if c.defaulter != nil {
+			c.defaulter.Default(obj)
+		}
+
+		// Short-circuit conversion if the into object is same object
+		if into == obj {
+			return into, gvk, strictDecodingErr
+		}
+
+		if err := c.convertor.Convert(obj, into, c.decodeVersion); err != nil {
+			return nil, gvk, err
+		}
+
+		return into, gvk, strictDecodingErr
+	}
+
+	// perform defaulting if requested
+	if c.defaulter != nil {
+		c.defaulter.Default(obj)
+	}
+
+	out, err := c.convertor.ConvertToVersion(obj, c.decodeVersion)
+	if err != nil {
+		return nil, gvk, err
+	}
+	return out, gvk, strictDecodingErr
+}
+
+// EncodeWithAllocator ensures the provided object is output in the appropriate group and version, invoking
+// conversion if necessary. Unversioned objects (according to the ObjectTyper) are output as is.
+// In addition, it allows for providing a memory allocator for efficient memory usage during object serialization.
+func (c *codec) EncodeWithAllocator(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	return c.encode(obj, w, memAlloc)
+}
+
+// Encode ensures the provided object is output in the appropriate group and version, invoking
+// conversion if necessary. Unversioned objects (according to the ObjectTyper) are output as is.
+func (c *codec) Encode(obj runtime.Object, w io.Writer) error {
+	return c.encode(obj, w, nil)
+}
+
+func (c *codec) encode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	if co, ok := obj.(runtime.CacheableObject); ok {
+		return co.CacheEncode(c.Identifier(), func(obj runtime.Object, w io.Writer) error { return c.doEncode(obj, w, memAlloc) }, w)
+	}
+	return c.doEncode(obj, w, memAlloc)
+}
+
+func (c *codec) doEncode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	encodeFn := c.encoder.Encode
+	if memAlloc != nil {
+		if encoder, supportsAllocator := c.encoder.(runtime.EncoderWithAllocator); supportsAllocator {
+			encodeFn = func(obj runtime.Object, w io.Writer) error {
+				return encoder.EncodeWithAllocator(obj, w, memAlloc)
+			}
+		} else {
+			//nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this.
+			klog.V(6).Infof("a memory allocator was provided but the encoder %s doesn't implement the runtime.EncoderWithAllocator, using regular encoder.Encode method", c.encoder.Identifier())
+		}
+	}
+	switch obj := obj.(type) {
+	case *runtime.Unknown:
+		return encodeFn(obj, w)
+	case runtime.Unstructured:
+		// An unstructured list can contain objects of multiple group version kinds. don't short-circuit just
+		// because the top-level type matches our desired destination type. actually send the object to the converter
+		// to give it a chance to convert the list items if needed.
+		if _, ok := obj.(*unstructured.UnstructuredList); !ok {
+			// avoid conversion roundtrip if GVK is the right one already or is empty (yes, this is a hack, but the old behaviour we rely on in kubectl)
+			objGVK := obj.GetObjectKind().GroupVersionKind()
+			if len(objGVK.Version) == 0 {
+				return encodeFn(obj, w)
+			}
+			targetGVK, ok := c.encodeVersion.KindForGroupVersionKinds([]schema.GroupVersionKind{objGVK})
+			if !ok {
+				return runtime.NewNotRegisteredGVKErrForTarget(c.originalSchemeName, objGVK, c.encodeVersion)
+			}
+			if targetGVK == objGVK {
+				return encodeFn(obj, w)
+			}
+		}
+	}
+
+	gvks, isUnversioned, err := c.typer.ObjectKinds(obj)
+	if err != nil {
+		return err
+	}
+
+	objectKind := obj.GetObjectKind()
+	old := objectKind.GroupVersionKind()
+	// restore the old GVK after encoding
+	defer objectKind.SetGroupVersionKind(old)
+
+	if c.encodeVersion == nil || isUnversioned {
+		if e, ok := obj.(runtime.NestedObjectEncoder); ok {
+			if err := e.EncodeNestedObjects(runtime.WithVersionEncoder{Encoder: c.encoder, ObjectTyper: c.typer}); err != nil {
+				return err
+			}
+		}
+		objectKind.SetGroupVersionKind(gvks[0])
+		return encodeFn(obj, w)
+	}
+
+	// Perform a conversion if necessary
+	out, err := c.convertor.ConvertToVersion(obj, c.encodeVersion)
+	if err != nil {
+		return err
+	}
+
+	if e, ok := out.(runtime.NestedObjectEncoder); ok {
+		if err := e.EncodeNestedObjects(runtime.WithVersionEncoder{Version: c.encodeVersion, Encoder: c.encoder, ObjectTyper: c.typer}); err != nil {
+			return err
+		}
+	}
+
+	// Conversion is responsible for setting the proper group, version, and kind onto the outgoing object
+	return encodeFn(out, w)
+}
+
+// Identifier implements runtime.Encoder interface.
+func (c *codec) Identifier() runtime.Identifier {
+	return c.identifier
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning_test.go
new file mode 100644
index 0000000000..ee12a69adf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning_test.go
@@ -0,0 +1,405 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package versioning
+
+import (
+	"fmt"
+	"io"
+	"io/ioutil"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+	"k8s.io/apimachinery/pkg/util/diff"
+)
+
+type testDecodable struct {
+	Other string
+	Value int `json:"value"`
+	gvk   schema.GroupVersionKind
+}
+
+func (d *testDecodable) GetObjectKind() schema.ObjectKind                { return d }
+func (d *testDecodable) SetGroupVersionKind(gvk schema.GroupVersionKind) { d.gvk = gvk }
+func (d *testDecodable) GroupVersionKind() schema.GroupVersionKind       { return d.gvk }
+func (d *testDecodable) DeepCopyObject() runtime.Object {
+	// no real deepcopy because these tests check for pointer equality
+	return d
+}
+
+type testNestedDecodable struct {
+	Other string
+	Value int `json:"value"`
+
+	gvk          schema.GroupVersionKind
+	nestedCalled bool
+	nestedErr    error
+}
+
+func (d *testNestedDecodable) GetObjectKind() schema.ObjectKind                { return d }
+func (d *testNestedDecodable) SetGroupVersionKind(gvk schema.GroupVersionKind) { d.gvk = gvk }
+func (d *testNestedDecodable) GroupVersionKind() schema.GroupVersionKind       { return d.gvk }
+func (d *testNestedDecodable) DeepCopyObject() runtime.Object {
+	// no real deepcopy because these tests check for pointer equality
+	return d
+}
+
+func (d *testNestedDecodable) EncodeNestedObjects(e runtime.Encoder) error {
+	d.nestedCalled = true
+	return d.nestedErr
+}
+
+func (d *testNestedDecodable) DecodeNestedObjects(_ runtime.Decoder) error {
+	d.nestedCalled = true
+	return d.nestedErr
+}
+
+func TestNestedDecode(t *testing.T) {
+	n := &testNestedDecodable{nestedErr: fmt.Errorf("unable to decode")}
+	decoder := &mockSerializer{obj: n}
+	codec := NewCodec(nil, decoder, nil, nil, nil, nil, nil, nil, "TestNestedDecode")
+	if _, _, err := codec.Decode([]byte(`{}`), nil, n); err != n.nestedErr {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if !n.nestedCalled {
+		t.Errorf("did not invoke nested decoder")
+	}
+}
+
+func TestNestedDecodeStrictDecodingError(t *testing.T) {
+	strictErr := runtime.NewStrictDecodingError([]error{fmt.Errorf("duplicate field")})
+	n := &testNestedDecodable{nestedErr: strictErr}
+	decoder := &mockSerializer{obj: n}
+	codec := NewCodec(nil, decoder, nil, nil, nil, nil, nil, nil, "TestNestedDecode")
+	o, _, err := codec.Decode([]byte(`{}`), nil, n)
+	if strictErr, ok := runtime.AsStrictDecodingError(err); !ok || err != strictErr {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if o != n {
+		t.Errorf("did not successfully decode with strict decoding error: %v", o)
+	}
+	if !n.nestedCalled {
+		t.Errorf("did not invoke nested decoder")
+	}
+}
+
+func TestNestedEncode(t *testing.T) {
+	n := &testNestedDecodable{nestedErr: fmt.Errorf("unable to decode")}
+	n2 := &testNestedDecodable{nestedErr: fmt.Errorf("unable to decode 2")}
+	encoder := &mockSerializer{obj: n}
+	codec := NewCodec(
+		encoder, nil,
+		&checkConvertor{obj: n2, groupVersion: schema.GroupVersion{Group: "other"}},
+		nil,
+		&mockTyper{gvks: []schema.GroupVersionKind{{Kind: "test"}}},
+		nil,
+		schema.GroupVersion{Group: "other"}, nil,
+		"TestNestedEncode",
+	)
+	if err := codec.Encode(n, ioutil.Discard); err != n2.nestedErr {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if n.nestedCalled || !n2.nestedCalled {
+		t.Errorf("did not invoke correct nested decoder")
+	}
+}
+
+func TestNestedEncodeError(t *testing.T) {
+	n := &testNestedDecodable{nestedErr: fmt.Errorf("unable to encode")}
+	gvk1 := schema.GroupVersionKind{Kind: "test", Group: "other", Version: "v1"}
+	gvk2 := schema.GroupVersionKind{Kind: "test", Group: "other", Version: "v2"}
+	n.SetGroupVersionKind(gvk1)
+	encoder := &mockSerializer{obj: n}
+	codec := NewCodec(
+		encoder, nil,
+		&mockConvertor{},
+		nil,
+		&mockTyper{gvks: []schema.GroupVersionKind{gvk1, gvk2}},
+		nil,
+		schema.GroupVersion{Group: "other", Version: "v2"}, nil,
+		"TestNestedEncodeError",
+	)
+	if err := codec.Encode(n, ioutil.Discard); err != n.nestedErr {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if n.GroupVersionKind() != gvk1 {
+		t.Errorf("unexpected gvk of input object: %v", n.GroupVersionKind())
+	}
+}
+
+func TestDecode(t *testing.T) {
+	gvk1 := &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}
+	decodable1 := &testDecodable{}
+	decodable2 := &testDecodable{}
+	decodable3 := &testDecodable{}
+
+	testCases := []struct {
+		serializer runtime.Serializer
+		convertor  runtime.ObjectConvertor
+		creater    runtime.ObjectCreater
+		typer      runtime.ObjectTyper
+		defaulter  runtime.ObjectDefaulter
+		yaml       bool
+		pretty     bool
+
+		encodes, decodes runtime.GroupVersioner
+
+		defaultGVK *schema.GroupVersionKind
+		into       runtime.Object
+
+		errFn          func(error) bool
+		expectedObject runtime.Object
+		sameObject     runtime.Object
+		expectedGVK    *schema.GroupVersionKind
+	}{
+		{
+			serializer:  &mockSerializer{actual: gvk1},
+			convertor:   &checkConvertor{groupVersion: schema.GroupVersion{Group: "other", Version: runtime.APIVersionInternal}},
+			expectedGVK: gvk1,
+			decodes:     schema.GroupVersion{Group: "other", Version: runtime.APIVersionInternal},
+		},
+		{
+			serializer:  &mockSerializer{actual: gvk1, obj: decodable1},
+			convertor:   &checkConvertor{in: decodable1, obj: decodable2, groupVersion: schema.GroupVersion{Group: "other", Version: runtime.APIVersionInternal}},
+			expectedGVK: gvk1,
+			sameObject:  decodable2,
+			decodes:     schema.GroupVersion{Group: "other", Version: runtime.APIVersionInternal},
+		},
+		// defaultGVK.Group is allowed to force a conversion to the destination group
+		{
+			serializer:  &mockSerializer{actual: gvk1, obj: decodable1},
+			defaultGVK:  &schema.GroupVersionKind{Group: "force"},
+			convertor:   &checkConvertor{in: decodable1, obj: decodable2, groupVersion: schema.GroupVersion{Group: "force", Version: runtime.APIVersionInternal}},
+			expectedGVK: gvk1,
+			sameObject:  decodable2,
+			decodes:     schema.GroupVersion{Group: "force", Version: runtime.APIVersionInternal},
+		},
+		// uses direct conversion for into when objects differ
+		{
+			into:        decodable3,
+			serializer:  &mockSerializer{actual: gvk1, obj: decodable1},
+			convertor:   &checkConvertor{in: decodable1, obj: decodable3, directConvert: true},
+			expectedGVK: gvk1,
+			sameObject:  decodable3,
+		},
+		// decode into the same version as the serialized object
+		{
+			decodes: schema.GroupVersions{gvk1.GroupVersion()},
+
+			serializer:     &mockSerializer{actual: gvk1, obj: decodable1},
+			convertor:      &checkConvertor{in: decodable1, obj: decodable1, groupVersion: schema.GroupVersions{{Group: "other", Version: "blah"}}},
+			expectedGVK:    gvk1,
+			expectedObject: decodable1,
+		},
+	}
+
+	for i, test := range testCases {
+		t.Logf("%d", i)
+		s := NewCodec(test.serializer, test.serializer, test.convertor, test.creater, test.typer, test.defaulter, test.encodes, test.decodes, fmt.Sprintf("mock-%d", i))
+		obj, gvk, err := s.Decode([]byte(`{}`), test.defaultGVK, test.into)
+
+		if !reflect.DeepEqual(test.expectedGVK, gvk) {
+			t.Errorf("%d: unexpected GVK: %v", i, gvk)
+		}
+
+		switch {
+		case err == nil && test.errFn != nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil && test.errFn == nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil:
+			if !test.errFn(err) {
+				t.Errorf("%d: failed: %v", i, err)
+			}
+			if obj != nil {
+				t.Errorf("%d: should have returned nil object", i)
+			}
+			continue
+		}
+
+		if test.into != nil && test.into != obj {
+			t.Errorf("%d: expected into to be returned: %v", i, obj)
+			continue
+		}
+
+		switch {
+		case test.expectedObject != nil:
+			if !reflect.DeepEqual(test.expectedObject, obj) {
+				t.Errorf("%d: unexpected object:\n%s", i, diff.ObjectGoPrintSideBySide(test.expectedObject, obj))
+			}
+		case test.sameObject != nil:
+			if test.sameObject != obj {
+				t.Errorf("%d: unexpected object:\n%s", i, diff.ObjectGoPrintSideBySide(test.sameObject, obj))
+			}
+		case obj != nil:
+			t.Errorf("%d: unexpected object: %#v", i, obj)
+		}
+	}
+}
+
+type checkConvertor struct {
+	err           error
+	in, obj       runtime.Object
+	groupVersion  runtime.GroupVersioner
+	directConvert bool
+}
+
+func (c *checkConvertor) Convert(in, out, context interface{}) error {
+	if !c.directConvert {
+		return fmt.Errorf("unexpected call to Convert")
+	}
+	if c.in != nil && c.in != in {
+		return fmt.Errorf("unexpected in: %s", in)
+	}
+	if c.obj != nil && c.obj != out {
+		return fmt.Errorf("unexpected out: %s", out)
+	}
+	return c.err
+}
+func (c *checkConvertor) ConvertToVersion(in runtime.Object, outVersion runtime.GroupVersioner) (out runtime.Object, err error) {
+	if c.directConvert {
+		return nil, fmt.Errorf("unexpected call to ConvertToVersion")
+	}
+	if c.in != nil && c.in != in {
+		return nil, fmt.Errorf("unexpected in: %s", in)
+	}
+	if !reflect.DeepEqual(c.groupVersion, outVersion) {
+		return nil, fmt.Errorf("unexpected outversion: %s (%s)", outVersion, c.groupVersion)
+	}
+	return c.obj, c.err
+}
+func (c *checkConvertor) ConvertFieldLabel(gvk schema.GroupVersionKind, label, value string) (string, string, error) {
+	return "", "", fmt.Errorf("unexpected call to ConvertFieldLabel")
+}
+
+type mockConvertor struct {
+}
+
+func (c *mockConvertor) Convert(in, out, context interface{}) error {
+	return fmt.Errorf("unexpect call to Convert")
+}
+
+func (c *mockConvertor) ConvertToVersion(in runtime.Object, outVersion runtime.GroupVersioner) (out runtime.Object, err error) {
+	objectKind := in.GetObjectKind()
+	inGVK := objectKind.GroupVersionKind()
+	if out, ok := outVersion.KindForGroupVersionKinds([]schema.GroupVersionKind{inGVK}); ok {
+		objectKind.SetGroupVersionKind(out)
+	} else {
+		return nil, fmt.Errorf("unexpected conversion")
+	}
+	return in, nil
+}
+
+func (c *mockConvertor) ConvertFieldLabel(gvk schema.GroupVersionKind, label, value string) (string, string, error) {
+	return "", "", fmt.Errorf("unexpected call to ConvertFieldLabel")
+}
+
+type mockSerializer struct {
+	err            error
+	obj            runtime.Object
+	encodingObjGVK schema.GroupVersionKind
+
+	defaults, actual *schema.GroupVersionKind
+	into             runtime.Object
+}
+
+func (s *mockSerializer) Decode(data []byte, defaults *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	s.defaults = defaults
+	s.into = into
+	return s.obj, s.actual, s.err
+}
+
+func (s *mockSerializer) Encode(obj runtime.Object, w io.Writer) error {
+	s.obj = obj
+	s.encodingObjGVK = obj.GetObjectKind().GroupVersionKind()
+	return s.err
+}
+
+func (s *mockSerializer) Identifier() runtime.Identifier {
+	return runtime.Identifier("mock")
+}
+
+type mockTyper struct {
+	gvks        []schema.GroupVersionKind
+	unversioned bool
+	err         error
+}
+
+func (t *mockTyper) ObjectKinds(obj runtime.Object) ([]schema.GroupVersionKind, bool, error) {
+	return t.gvks, t.unversioned, t.err
+}
+
+func (t *mockTyper) Recognizes(_ schema.GroupVersionKind) bool {
+	return true
+}
+
+func TestDirectCodecEncode(t *testing.T) {
+	serializer := mockSerializer{}
+	typer := mockTyper{
+		gvks: []schema.GroupVersionKind{
+			{
+				Group: "wrong_group",
+				Kind:  "some_kind",
+			},
+			{
+				Group: "expected_group",
+				Kind:  "some_kind",
+			},
+		},
+	}
+
+	c := runtime.WithVersionEncoder{
+		Version:     schema.GroupVersion{Group: "expected_group"},
+		Encoder:     &serializer,
+		ObjectTyper: &typer,
+	}
+	c.Encode(&testDecodable{}, ioutil.Discard)
+	if e, a := "expected_group", serializer.encodingObjGVK.Group; e != a {
+		t.Errorf("expected group to be %v, got %v", e, a)
+	}
+}
+
+func TestCacheableObject(t *testing.T) {
+	gvk1 := schema.GroupVersionKind{Group: "group", Version: "version1", Kind: "MockCacheableObject"}
+	gvk2 := schema.GroupVersionKind{Group: "group", Version: "version2", Kind: "MockCacheableObject"}
+
+	encoder := NewCodec(
+		&mockSerializer{}, &mockSerializer{},
+		&mockConvertor{}, nil,
+		&mockTyper{gvks: []schema.GroupVersionKind{gvk1, gvk2}}, nil,
+		gvk1.GroupVersion(), gvk2.GroupVersion(),
+		"TestCacheableObject")
+
+	runtimetesting.CacheableObjectTest(t, encoder)
+}
+
+func BenchmarkIdentifier(b *testing.B) {
+	encoder := &mockSerializer{}
+	gv := schema.GroupVersion{Group: "group", Version: "version"}
+
+	for i := 0; i < b.N; i++ {
+		id := identifier(gv, encoder)
+		// Avoid optimizing by compiler.
+		if id[0] != '{' {
+			b.Errorf("unexpected identifier: %s", id)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning_unstructured_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning_unstructured_test.go
new file mode 100644
index 0000000000..e47a259f69
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning_unstructured_test.go
@@ -0,0 +1,338 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package versioning
+
+import (
+	"fmt"
+	"io/ioutil"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func buildUnstructuredDecodable(gvk schema.GroupVersionKind) runtime.Object {
+	obj := &unstructured.Unstructured{}
+	obj.SetGroupVersionKind(gvk)
+	return obj
+}
+
+func buildUnstructuredListDecodable(gvk schema.GroupVersionKind) runtime.Object {
+	obj := &unstructured.UnstructuredList{}
+	obj.SetGroupVersionKind(gvk)
+	return obj
+}
+
+func TestEncodeUnstructured(t *testing.T) {
+	v1GVK := schema.GroupVersionKind{
+		Group:   "crispy",
+		Version: "v1",
+		Kind:    "Noxu",
+	}
+	v2GVK := schema.GroupVersionKind{
+		Group:   "crispy",
+		Version: "v2",
+		Kind:    "Noxu",
+	}
+	elseGVK := schema.GroupVersionKind{
+		Group:   "crispy2",
+		Version: "else",
+		Kind:    "Noxu",
+	}
+	elseUnstructuredDecodable := buildUnstructuredDecodable(elseGVK)
+	elseUnstructuredDecodableList := buildUnstructuredListDecodable(elseGVK)
+	v1UnstructuredDecodable := buildUnstructuredDecodable(v1GVK)
+	v1UnstructuredDecodableList := buildUnstructuredListDecodable(v1GVK)
+	v2UnstructuredDecodable := buildUnstructuredDecodable(v2GVK)
+
+	testCases := []struct {
+		name          string
+		convertor     runtime.ObjectConvertor
+		targetVersion runtime.GroupVersioner
+		outObj        runtime.Object
+		typer         runtime.ObjectTyper
+
+		errFunc     func(error) bool
+		expectedObj runtime.Object
+	}{
+		{
+			name: "encode v1 unstructured with v2 encode version",
+			typer: &mockTyper{
+				gvks: []schema.GroupVersionKind{v1GVK},
+			},
+			outObj:        v1UnstructuredDecodable,
+			targetVersion: v2GVK.GroupVersion(),
+			convertor: &checkConvertor{
+				obj:          v2UnstructuredDecodable,
+				groupVersion: v2GVK.GroupVersion(),
+			},
+			expectedObj: v2UnstructuredDecodable,
+		},
+		{
+			name: "both typer and conversion are bypassed when unstructured gvk matches encode gvk",
+			typer: &mockTyper{
+				err: fmt.Errorf("unexpected typer call"),
+			},
+			outObj:        v1UnstructuredDecodable,
+			targetVersion: v1GVK.GroupVersion(),
+			convertor: &checkConvertor{
+				err: fmt.Errorf("unexpected conversion happened"),
+			},
+			expectedObj: v1UnstructuredDecodable,
+		},
+		{
+			name:          "encode will fail when unstructured object's gvk and encode gvk mismatches",
+			outObj:        elseUnstructuredDecodable,
+			targetVersion: v1GVK.GroupVersion(),
+			errFunc: func(err error) bool {
+				return assert.Equal(t, runtime.NewNotRegisteredGVKErrForTarget("noxu-scheme", elseGVK, v1GVK.GroupVersion()), err)
+			},
+		},
+		{
+			name:          "encode with unstructured list's gvk regardless of its elements' gvk",
+			outObj:        elseUnstructuredDecodableList,
+			targetVersion: elseGVK.GroupVersion(),
+		},
+		{
+			name:          "typer fail to recognize unstructured object gvk will fail the encoding",
+			outObj:        elseUnstructuredDecodable,
+			targetVersion: v1GVK.GroupVersion(),
+			typer: &mockTyper{
+				err: fmt.Errorf("invalid obj gvk"),
+			},
+		},
+		{
+			name:          "encoding unstructured object without encode version will fallback to typer suggested version",
+			targetVersion: v1GVK.GroupVersion(),
+			convertor: &checkConvertor{
+				obj:          v1UnstructuredDecodableList,
+				groupVersion: v1GVK.GroupVersion(),
+			},
+			outObj: elseUnstructuredDecodable,
+			typer: &mockTyper{
+				gvks: []schema.GroupVersionKind{v1GVK},
+			},
+		},
+	}
+	for _, testCase := range testCases {
+		serializer := &mockSerializer{}
+		codec := NewCodec(serializer, serializer, testCase.convertor, nil, testCase.typer, nil, testCase.targetVersion, nil, "noxu-scheme")
+		err := codec.Encode(testCase.outObj, ioutil.Discard)
+		if testCase.errFunc != nil {
+			if !testCase.errFunc(err) {
+				t.Errorf("%v: failed: %v", testCase.name, err)
+			}
+			return
+		}
+		assert.NoError(t, err)
+		assert.Equal(t, testCase.expectedObj, serializer.obj)
+	}
+}
+
+type errNotRecognizedGVK struct {
+	failedGVK    schema.GroupVersionKind
+	claimingGVKs []schema.GroupVersionKind
+}
+
+func (e errNotRecognizedGVK) Error() string {
+	return fmt.Sprintf("unrecognized gvk %v, should be one of %v", e.failedGVK, e.claimingGVKs)
+}
+
+type mockUnstructuredNopConvertor struct {
+	claimingGVKs []schema.GroupVersionKind
+}
+
+func (c *mockUnstructuredNopConvertor) recognizeGVK(gvkToCheck schema.GroupVersionKind) error {
+	matched := false
+	for _, gvk := range c.claimingGVKs {
+		if gvk == gvkToCheck {
+			matched = true
+		}
+	}
+	if !matched {
+		return errNotRecognizedGVK{
+			failedGVK:    gvkToCheck,
+			claimingGVKs: c.claimingGVKs,
+		}
+	}
+	return nil
+}
+
+func (c *mockUnstructuredNopConvertor) Convert(in, out, context interface{}) error {
+	inObj := in.(*unstructured.Unstructured)
+	outObj := out.(*unstructured.Unstructured)
+	if err := c.recognizeGVK(outObj.GroupVersionKind()); err != nil {
+		return err
+	}
+	outGVK := outObj.GetObjectKind().GroupVersionKind()
+	*outObj = *inObj.DeepCopy()
+	outObj.GetObjectKind().SetGroupVersionKind(outGVK)
+	return nil
+}
+
+func (c *mockUnstructuredNopConvertor) ConvertToVersion(in runtime.Object, outVersion runtime.GroupVersioner) (runtime.Object, error) {
+	out := in.DeepCopyObject()
+	targetGVK, matched := outVersion.KindForGroupVersionKinds([]schema.GroupVersionKind{in.GetObjectKind().GroupVersionKind()})
+	if !matched {
+		return nil, fmt.Errorf("attempt to convert to mismatched gv %v", outVersion)
+	}
+	if err := c.recognizeGVK(out.GetObjectKind().GroupVersionKind()); err != nil {
+		return nil, err
+	}
+	out.GetObjectKind().SetGroupVersionKind(targetGVK)
+	return out, nil
+}
+
+func (c *mockUnstructuredNopConvertor) ConvertFieldLabel(gvk schema.GroupVersionKind, label, value string) (string, string, error) {
+	return "", "", fmt.Errorf("unexpected call to ConvertFieldLabel")
+}
+
+func TestDecodeUnstructured(t *testing.T) {
+	internalGVK := schema.GroupVersionKind{
+		Group:   "crispy",
+		Version: runtime.APIVersionInternal,
+		Kind:    "Noxu",
+	}
+	v1GVK := schema.GroupVersionKind{
+		Group:   "crispy",
+		Version: "v1",
+		Kind:    "Noxu",
+	}
+	v2GVK := schema.GroupVersionKind{
+		Group:   "crispy",
+		Version: "v2",
+		Kind:    "Noxu",
+	}
+	internalUnstructuredDecodable := buildUnstructuredDecodable(internalGVK)
+	v1UnstructuredDecodable := buildUnstructuredDecodable(v1GVK)
+	v2UnstructuredDecodable := buildUnstructuredDecodable(v2GVK)
+
+	testCases := []struct {
+		name                    string
+		serializer              runtime.Serializer
+		convertor               runtime.ObjectConvertor
+		suggestedConvertVersion runtime.GroupVersioner
+		defaultGVK              *schema.GroupVersionKind
+		intoObj                 runtime.Object
+
+		errFunc                     func(error) bool
+		expectedGVKOfSerializedData *schema.GroupVersionKind
+		expectedOut                 runtime.Object
+	}{
+		{
+			name:       "decode v1 unstructured into non-nil v2 unstructured",
+			serializer: &mockSerializer{actual: &v1GVK, obj: v1UnstructuredDecodable},
+			convertor: &mockUnstructuredNopConvertor{
+				claimingGVKs: []schema.GroupVersionKind{
+					v1GVK, v2GVK,
+				},
+			},
+			suggestedConvertVersion:     v2GVK.GroupVersion(),
+			intoObj:                     v2UnstructuredDecodable,
+			expectedGVKOfSerializedData: &v1GVK,
+			expectedOut:                 v2UnstructuredDecodable,
+		},
+		{
+			name:       "decode v1 unstructured into nil object with v2 version",
+			serializer: &mockSerializer{actual: &v1GVK, obj: v1UnstructuredDecodable},
+			convertor: &mockUnstructuredNopConvertor{
+				claimingGVKs: []schema.GroupVersionKind{
+					v1GVK, v2GVK,
+				},
+			},
+			suggestedConvertVersion:     v2GVK.GroupVersion(),
+			intoObj:                     nil,
+			expectedGVKOfSerializedData: &v1GVK,
+			expectedOut:                 v2UnstructuredDecodable,
+		},
+		{
+			name:       "decode v1 unstructured into non-nil internal unstructured",
+			serializer: &mockSerializer{actual: &v1GVK, obj: v1UnstructuredDecodable},
+			convertor: &mockUnstructuredNopConvertor{
+				claimingGVKs: []schema.GroupVersionKind{
+					v1GVK, v2GVK,
+				},
+			},
+			suggestedConvertVersion: internalGVK.GroupVersion(),
+			intoObj:                 internalUnstructuredDecodable,
+			errFunc: func(err error) bool {
+				notRecognized, ok := err.(errNotRecognizedGVK)
+				if !ok {
+					return false
+				}
+				return assert.Equal(t, notRecognized.failedGVK, internalGVK)
+			},
+		},
+		{
+			name:       "decode v1 unstructured into nil object with internal version",
+			serializer: &mockSerializer{actual: &v1GVK, obj: v1UnstructuredDecodable},
+			convertor: &mockUnstructuredNopConvertor{
+				claimingGVKs: []schema.GroupVersionKind{
+					v1GVK, v2GVK,
+				},
+			},
+			suggestedConvertVersion: internalGVK.GroupVersion(),
+			intoObj:                 nil,
+			errFunc: func(err error) bool {
+				notRecognized, ok := err.(errNotRecognizedGVK)
+				if !ok {
+					return false
+				}
+				return assert.Equal(t, notRecognized.failedGVK, internalGVK)
+			},
+		},
+		{
+			name:       "skip conversion if serializer returns the same unstructured as into",
+			serializer: &mockSerializer{actual: &v1GVK, obj: v1UnstructuredDecodable},
+			convertor: &checkConvertor{
+				err: fmt.Errorf("unexpected conversion happened"),
+			},
+			suggestedConvertVersion:     internalGVK.GroupVersion(),
+			intoObj:                     v1UnstructuredDecodable,
+			expectedGVKOfSerializedData: &v1GVK,
+			expectedOut:                 v1UnstructuredDecodable,
+		},
+		{
+			name:       "invalid convert version makes decoding unstructured fail",
+			serializer: &mockSerializer{actual: &v1GVK, obj: v1UnstructuredDecodable},
+			convertor: &checkConvertor{
+				in:           v1UnstructuredDecodable,
+				groupVersion: internalGVK.GroupVersion(),
+				err:          fmt.Errorf("no matching decode version"),
+			},
+			suggestedConvertVersion: internalGVK.GroupVersion(),
+			errFunc: func(err error) bool {
+				return assert.Equal(t, err, fmt.Errorf("no matching decode version"))
+			},
+		},
+	}
+	for _, testCase := range testCases {
+		codec := NewCodec(testCase.serializer, testCase.serializer, testCase.convertor, nil, nil, nil, nil, testCase.suggestedConvertVersion, "noxu-scheme")
+		actualObj, actualSerializedGVK, err := codec.Decode([]byte(`{}`), testCase.defaultGVK, testCase.intoObj)
+		if testCase.errFunc != nil {
+			if !testCase.errFunc(err) {
+				t.Errorf("%v: failed: %v", testCase.name, err)
+			}
+			return
+		}
+		assert.NoError(t, err)
+		assert.Equal(t, testCase.expectedOut, actualObj, "%v failed", testCase.name)
+		assert.Equal(t, testCase.expectedGVKOfSerializedData, actualSerializedGVK, "%v failed", testCase.name)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/meta.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/meta.go
new file mode 100644
index 0000000000..407a7419a6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/meta.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/yaml"
+)
+
+// DefaultMetaFactory is a default factory for versioning objects in JSON or
+// YAML. The object in memory and in the default serialization will use the
+// "kind" and "apiVersion" fields.
+var DefaultMetaFactory = SimpleMetaFactory{}
+
+// SimpleMetaFactory provides default methods for retrieving the type and version of objects
+// that are identified with an "apiVersion" and "kind" fields in their JSON
+// serialization. It may be parameterized with the names of the fields in memory, or an
+// optional list of base structs to search for those fields in memory.
+type SimpleMetaFactory struct{}
+
+// Interpret will return the APIVersion and Kind of the JSON wire-format
+// encoding of an object, or an error.
+func (SimpleMetaFactory) Interpret(data []byte) (*schema.GroupVersionKind, error) {
+	gvk := runtime.TypeMeta{}
+	if err := yaml.Unmarshal(data, &gvk); err != nil {
+		return nil, fmt.Errorf("could not interpret GroupVersionKind; unmarshal error: %v", err)
+	}
+	gv, err := schema.ParseGroupVersion(gvk.APIVersion)
+	if err != nil {
+		return nil, err
+	}
+	return &schema.GroupVersionKind{Group: gv.Group, Version: gv.Version, Kind: gvk.Kind}, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/meta_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/meta_test.go
new file mode 100644
index 0000000000..ba560008ea
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/meta_test.go
@@ -0,0 +1,160 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestInterpret(t *testing.T) {
+	testCases := []struct {
+		name     string
+		input    string
+		expected *schema.GroupVersionKind
+		errFn    func(error) bool
+	}{
+		{
+			name: "YAMLSuccessfullyInterpretVK",
+			input: `apiVersion: v1
+kind: Service`,
+			expected: &schema.GroupVersionKind{Version: "v1", Kind: "Service"},
+		},
+		{
+			name: "YAMLSuccessfullyInterpretGVK",
+			input: `apiVersion: core/v2
+kind: Deployment`,
+			expected: &schema.GroupVersionKind{Group: "core", Version: "v2", Kind: "Deployment"},
+		},
+		{
+			name:     "YAMLSuccessfullyInterpretV",
+			input:    `apiVersion: v1`,
+			expected: &schema.GroupVersionKind{Version: "v1"},
+		},
+		{
+			name:     "YAMLSuccessfullyInterpretK",
+			input:    `kind: Service`,
+			expected: &schema.GroupVersionKind{Kind: "Service"},
+		},
+		{
+			name:     "YAMLSuccessfullyInterpretEmptyString",
+			input:    ``,
+			expected: &schema.GroupVersionKind{},
+		},
+		{
+			name:     "YAMLSuccessfullyInterpretEmptyDoc",
+			input:    `---`,
+			expected: &schema.GroupVersionKind{},
+		},
+		{
+			name: "YAMLSuccessfullyInterpretMultiDoc",
+			input: `---
+apiVersion: v1
+kind: Service
+---
+apiVersion: v2
+kind: Deployment`,
+			expected: &schema.GroupVersionKind{Version: "v1", Kind: "Service"},
+		},
+		{
+			name:     "YAMLSuccessfullyInterpretOnlyG",
+			input:    `apiVersion: core/`,
+			expected: &schema.GroupVersionKind{Group: "core"},
+		},
+		{
+			name:     "YAMLSuccessfullyWrongFormat",
+			input:    `foo: bar`,
+			expected: &schema.GroupVersionKind{},
+		},
+		{
+			name:  "YAMLFailInterpretWrongSyntax",
+			input: `foo`,
+			errFn: func(err error) bool { return err != nil },
+		},
+		{
+			name:     "JSONSuccessfullyInterpretVK",
+			input:    `{"apiVersion": "v3", "kind": "DaemonSet"}`,
+			expected: &schema.GroupVersionKind{Version: "v3", Kind: "DaemonSet"},
+		},
+		{
+			name:     "JSONSuccessfullyInterpretGVK",
+			input:    `{"apiVersion": "core/v2", "kind": "Deployment"}`,
+			expected: &schema.GroupVersionKind{Group: "core", Version: "v2", Kind: "Deployment"},
+		},
+		{
+			name:     "JSONSuccessfullyInterpretV",
+			input:    `{"apiVersion": "v1"}`,
+			expected: &schema.GroupVersionKind{Version: "v1"},
+		},
+		{
+			name:     "JSONSuccessfullyInterpretK",
+			input:    `{"kind": "Service"}`,
+			expected: &schema.GroupVersionKind{Kind: "Service"},
+		},
+		{
+			name:     "JSONSuccessfullyInterpretEmptyString",
+			input:    ``,
+			expected: &schema.GroupVersionKind{},
+		},
+		{
+			name:     "JSONSuccessfullyInterpretEmptyObject",
+			input:    `{}`,
+			expected: &schema.GroupVersionKind{},
+		},
+		{
+			name: "JSONSuccessfullyInterpretMultiDoc",
+			input: `{"apiVersion": "v1", "kind": "Service"}, 
+{"apiVersion": "v2", "kind": "Deployment"}`,
+			expected: &schema.GroupVersionKind{Version: "v1", Kind: "Service"},
+		},
+		{
+			name:     "JSONSuccessfullyWrongFormat",
+			input:    `{"foo": "bar"}`,
+			expected: &schema.GroupVersionKind{},
+		},
+		{
+			name:  "JSONFailInterpretArray",
+			input: `[]`,
+			errFn: func(err error) bool { return err != nil },
+		},
+		{
+			name:  "JSONFailInterpretWrongSyntax",
+			input: `{"foo"`,
+			errFn: func(err error) bool { return err != nil },
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.name, func(t *testing.T) {
+			actual, err := DefaultMetaFactory.Interpret([]byte(test.input))
+			switch {
+			case test.errFn != nil:
+				if !test.errFn(err) {
+					t.Errorf("unexpected error: %v", err)
+				}
+			case err != nil:
+				t.Errorf("unexpected error: %v", err)
+			case !reflect.DeepEqual(test.expected, actual):
+				t.Errorf("outcome mismatch -- expected: %#v, actual: %#v",
+					test.expected, actual,
+				)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/yaml.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/yaml.go
new file mode 100644
index 0000000000..2fdd1d43d5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/yaml.go
@@ -0,0 +1,46 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/yaml"
+)
+
+// yamlSerializer converts YAML passed to the Decoder methods to JSON.
+type yamlSerializer struct {
+	// the nested serializer
+	runtime.Serializer
+}
+
+// yamlSerializer implements Serializer
+var _ runtime.Serializer = yamlSerializer{}
+
+// NewDecodingSerializer adds YAML decoding support to a serializer that supports JSON.
+func NewDecodingSerializer(jsonSerializer runtime.Serializer) runtime.Serializer {
+	return &yamlSerializer{jsonSerializer}
+}
+
+func (c yamlSerializer) Decode(data []byte, gvk *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	out, err := yaml.ToJSON(data)
+	if err != nil {
+		return nil, nil, err
+	}
+	data = out
+	return c.Serializer.Decode(data, gvk, into)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/yaml_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/yaml_test.go
new file mode 100644
index 0000000000..9a94e4af7a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/yaml_test.go
@@ -0,0 +1,414 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import (
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/yaml"
+	sigsyaml "sigs.k8s.io/yaml"
+)
+
+type testcase struct {
+	name  string
+	data  []byte
+	error string
+
+	benchmark bool
+}
+
+func testcases() []testcase {
+	return []testcase{
+		{
+			name:  "arrays of string aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a ["webwebwebwebwebweb","webwebwebwebwebweb","webwebwebwebwebweb","webwebwebwebwebweb","webwebwebwebwebweb","webwebwebwebwebweb","webwebwebwebwebweb","webwebwebwebwebweb","webwebwebwebwebweb"]
+b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+		},
+		{
+			name:  "arrays of empty string aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a ["","","","","","","","",""]
+b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "arrays of null aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a [null,null,null,null,null,null,null,null,null]
+b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "arrays of zero int aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a [0,0,0,0,0,0,0,0,0]
+b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "arrays of zero float aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a [0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0]
+b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "arrays of big float aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a [1234567890.12345678,1234567890.12345678,1234567890.12345678,1234567890.12345678,1234567890.12345678,1234567890.12345678,1234567890.12345678,1234567890.12345678,1234567890.12345678]
+b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "arrays of bool aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a [true,true,true,true,true,true,true,true,true]
+b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "map key aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a {"verylongkey1":"","verylongkey2":"","verylongkey3":"","verylongkey4":"","verylongkey5":"","verylongkey6":"","verylongkey7":"","verylongkey8":"","verylongkey9":""}
+b: &b {"verylongkey1":*a,"verylongkey2":*a,"verylongkey3":*a,"verylongkey4":*a,"verylongkey5":*a,"verylongkey6":*a,"verylongkey7":*a,"verylongkey8":*a,"verylongkey9":*a}
+c: &c {"verylongkey1":*b,"verylongkey2":*b,"verylongkey3":*b,"verylongkey4":*b,"verylongkey5":*b,"verylongkey6":*b,"verylongkey7":*b,"verylongkey8":*b,"verylongkey9":*b}
+d: &d {"verylongkey1":*c,"verylongkey2":*c,"verylongkey3":*c,"verylongkey4":*c,"verylongkey5":*c,"verylongkey6":*c,"verylongkey7":*c,"verylongkey8":*c,"verylongkey9":*c}
+e: &e {"verylongkey1":*d,"verylongkey2":*d,"verylongkey3":*d,"verylongkey4":*d,"verylongkey5":*d,"verylongkey6":*d,"verylongkey7":*d,"verylongkey8":*d,"verylongkey9":*d}
+f: &f {"verylongkey1":*e,"verylongkey2":*e,"verylongkey3":*e,"verylongkey4":*e,"verylongkey5":*e,"verylongkey6":*e,"verylongkey7":*e,"verylongkey8":*e,"verylongkey9":*e}
+g: &g {"verylongkey1":*f,"verylongkey2":*f,"verylongkey3":*f,"verylongkey4":*f,"verylongkey5":*f,"verylongkey6":*f,"verylongkey7":*f,"verylongkey8":*f,"verylongkey9":*f}
+h: &h {"verylongkey1":*g,"verylongkey2":*g,"verylongkey3":*g,"verylongkey4":*g,"verylongkey5":*g,"verylongkey6":*g,"verylongkey7":*g,"verylongkey8":*g,"verylongkey9":*g}
+i: &i {"verylongkey1":*h,"verylongkey2":*h,"verylongkey3":*h,"verylongkey4":*h,"verylongkey5":*h,"verylongkey6":*h,"verylongkey7":*h,"verylongkey8":*h,"verylongkey9":*h}
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "map value aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a {"1":"verylongmapvalue","2":"verylongmapvalue","3":"verylongmapvalue","4":"verylongmapvalue","5":"verylongmapvalue","6":"verylongmapvalue","7":"verylongmapvalue","8":"verylongmapvalue","9":"verylongmapvalue"}
+b: &b {"1":*a,"2":*a,"3":*a,"4":*a,"5":*a,"6":*a,"7":*a,"8":*a,"9":*a}
+c: &c {"1":*b,"2":*b,"3":*b,"4":*b,"5":*b,"6":*b,"7":*b,"8":*b,"9":*b}
+d: &d {"1":*c,"2":*c,"3":*c,"4":*c,"5":*c,"6":*c,"7":*c,"8":*c,"9":*c}
+e: &e {"1":*d,"2":*d,"3":*d,"4":*d,"5":*d,"6":*d,"7":*d,"8":*d,"9":*d}
+f: &f {"1":*e,"2":*e,"3":*e,"4":*e,"5":*e,"6":*e,"7":*e,"8":*e,"9":*e}
+g: &g {"1":*f,"2":*f,"3":*f,"4":*f,"5":*f,"6":*f,"7":*f,"8":*f,"9":*f}
+h: &h {"1":*g,"2":*g,"3":*g,"4":*g,"5":*g,"6":*g,"7":*g,"8":*g,"9":*g}
+i: &i {"1":*h,"2":*h,"3":*h,"4":*h,"5":*h,"6":*h,"7":*h,"8":*h,"9":*h}
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "nested map aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a {"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}
+b: &b {"1":*a,"2":*a,"3":*a,"4":*a,"5":*a,"6":*a,"7":*a,"8":*a,"9":*a}
+c: &c {"1":*b,"2":*b,"3":*b,"4":*b,"5":*b,"6":*b,"7":*b,"8":*b,"9":*b}
+d: &d {"1":*c,"2":*c,"3":*c,"4":*c,"5":*c,"6":*c,"7":*c,"8":*c,"9":*c}
+e: &e {"1":*d,"2":*d,"3":*d,"4":*d,"5":*d,"6":*d,"7":*d,"8":*d,"9":*d}
+f: &f {"1":*e,"2":*e,"3":*e,"4":*e,"5":*e,"6":*e,"7":*e,"8":*e,"9":*e}
+g: &g {"1":*f,"2":*f,"3":*f,"4":*f,"5":*f,"6":*f,"7":*f,"8":*f,"9":*f}
+h: &h {"1":*g,"2":*g,"3":*g,"4":*g,"5":*g,"6":*g,"7":*g,"8":*g,"9":*g}
+i: &i {"1":*h,"2":*h,"3":*h,"4":*h,"5":*h,"6":*h,"7":*h,"8":*h,"9":*h}
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "nested slice aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[""]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
+b: &b [[[[[[[[[[*a]]]]]]]]],[[[[[[[[[*a]]]]]]]]],[[[[[[[[[*a]]]]]]]]],[[[[[[[[[*a]]]]]]]]],[[[[[[[[[*a]]]]]]]]]]
+c: &c [[[[[[[[[[*b]]]]]]]]],[[[[[[[[[*b]]]]]]]]],[[[[[[[[[*b]]]]]]]]],[[[[[[[[[*b]]]]]]]]],[[[[[[[[[*b]]]]]]]]]]
+d: &d [[[[[[[[[[*c]]]]]]]]],[[[[[[[[[*c]]]]]]]]],[[[[[[[[[*c]]]]]]]]],[[[[[[[[[*c]]]]]]]]],[[[[[[[[[*c]]]]]]]]]]
+e: &e [[[[[[[[[[*d]]]]]]]]],[[[[[[[[[*d]]]]]]]]],[[[[[[[[[*d]]]]]]]]],[[[[[[[[[*d]]]]]]]]],[[[[[[[[[*d]]]]]]]]]]
+f: &f [[[[[[[[[[*e]]]]]]]]],[[[[[[[[[*e]]]]]]]]],[[[[[[[[[*e]]]]]]]]],[[[[[[[[[*e]]]]]]]]],[[[[[[[[[*e]]]]]]]]]]
+g: &g [[[[[[[[[[*f]]]]]]]]],[[[[[[[[[*f]]]]]]]]],[[[[[[[[[*f]]]]]]]]],[[[[[[[[[*f]]]]]]]]],[[[[[[[[[*f]]]]]]]]]]
+h: &h [[[[[[[[[[*g]]]]]]]]],[[[[[[[[[*g]]]]]]]]],[[[[[[[[[*g]]]]]]]]],[[[[[[[[[*g]]]]]]]]],[[[[[[[[[*g]]]]]]]]]]
+i: &i [[[[[[[[[[*h]]]]]]]]],[[[[[[[[[*h]]]]]]]]],[[[[[[[[[*h]]]]]]]]],[[[[[[[[[*h]]]]]]]]],[[[[[[[[[*h]]]]]]]]]]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB map without alias",
+			data:      []byte(`a: &a [{a}` + strings.Repeat(`,{a}`, 3*1024*1024/4) + `]`),
+			benchmark: true,
+		},
+		{
+			name:  "3MB map with alias",
+			error: "excessive aliasing",
+			data: []byte(`
+a: &a [{a}` + strings.Repeat(`,{a}`, 3*1024*1024/4) + `]
+b: &b [*a]`),
+			benchmark: true,
+		},
+		{
+			name:  "deeply nested slices",
+			error: "max depth",
+			data:  []byte(strings.Repeat(`[`, 3*1024*1024)),
+		},
+		{
+			name:  "deeply nested maps",
+			error: "max depth",
+			data:  []byte("x: " + strings.Repeat(`{`, 3*1024*1024)),
+		},
+		{
+			name:  "deeply nested indents",
+			error: "max depth",
+			data:  []byte(strings.Repeat(`- `, 3*1024*1024)),
+		},
+		{
+			name:      "3MB of 1000-indent lines",
+			data:      []byte(strings.Repeat(strings.Repeat(`- `, 1000)+"\n", 3*1024/2)),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of empty slices",
+			data:      []byte(`[` + strings.Repeat(`[],`, 3*1024*1024/3-2) + `[]]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of slices",
+			data:      []byte(`[` + strings.Repeat(`[0],`, 3*1024*1024/4-2) + `[0]]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of empty maps",
+			data:      []byte(`[` + strings.Repeat(`{},`, 3*1024*1024/3-2) + `{}]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of maps",
+			data:      []byte(`[` + strings.Repeat(`{a},`, 3*1024*1024/4-2) + `{a}]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of ints",
+			data:      []byte(`[` + strings.Repeat(`0,`, 3*1024*1024/2-2) + `0]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of floats",
+			data:      []byte(`[` + strings.Repeat(`0.0,`, 3*1024*1024/4-2) + `0.0]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of bools",
+			data:      []byte(`[` + strings.Repeat(`true,`, 3*1024*1024/5-2) + `true]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of empty strings",
+			data:      []byte(`[` + strings.Repeat(`"",`, 3*1024*1024/3-2) + `""]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of strings",
+			data:      []byte(`[` + strings.Repeat(`"abcdefghijklmnopqrstuvwxyz012",`, 3*1024*1024/30-2) + `"abcdefghijklmnopqrstuvwxyz012"]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of nulls",
+			data:      []byte(`[` + strings.Repeat(`null,`, 3*1024*1024/5-2) + `null]`),
+			benchmark: true,
+		},
+	}
+}
+
+var decoders = map[string]func([]byte) ([]byte, error){
+	"sigsyaml": sigsyaml.YAMLToJSON,
+	"utilyaml": yaml.ToJSON,
+}
+
+func TestYAMLLimits(t *testing.T) {
+	for _, tc := range testcases() {
+		if tc.benchmark {
+			continue
+		}
+		t.Run(tc.name, func(t *testing.T) {
+			for decoderName, decoder := range decoders {
+				t.Run(decoderName, func(t *testing.T) {
+					_, err := decoder(tc.data)
+					if len(tc.error) == 0 {
+						if err != nil {
+							t.Errorf("unexpected error: %v", err)
+						}
+					} else {
+						if err == nil || !strings.Contains(err.Error(), tc.error) {
+							t.Errorf("expected %q error, got %v", tc.error, err)
+						}
+					}
+				})
+			}
+		})
+	}
+}
+
+func BenchmarkYAMLLimits(b *testing.B) {
+	for _, tc := range testcases() {
+		b.Run(tc.name, func(b *testing.B) {
+			for decoderName, decoder := range decoders {
+				b.Run(decoderName, func(b *testing.B) {
+					for i := 0; i < b.N; i++ {
+						_, err := decoder(tc.data)
+						if len(tc.error) == 0 {
+							if err != nil {
+								b.Errorf("unexpected error: %v", err)
+							}
+						} else {
+							if err == nil || !strings.Contains(err.Error(), tc.error) {
+								b.Errorf("expected %q error, got %v", tc.error, err)
+							}
+						}
+					}
+				})
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/splice.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/splice.go
new file mode 100644
index 0000000000..2badb7b97f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/splice.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"io"
+)
+
+// Splice is the interface that wraps the Splice method.
+//
+// Splice moves data from given slice without copying the underlying data for
+// efficiency purpose. Therefore, the caller should make sure the underlying
+// data is not changed later.
+type Splice interface {
+	Splice([]byte)
+	io.Writer
+	Reset()
+	Bytes() []byte
+}
+
+// A spliceBuffer implements Splice and io.Writer interfaces.
+type spliceBuffer struct {
+	raw []byte
+	buf *bytes.Buffer
+}
+
+func NewSpliceBuffer() Splice {
+	return &spliceBuffer{}
+}
+
+// Splice implements the Splice interface.
+func (sb *spliceBuffer) Splice(raw []byte) {
+	sb.raw = raw
+}
+
+// Write implements the io.Writer interface.
+func (sb *spliceBuffer) Write(p []byte) (n int, err error) {
+	if sb.buf == nil {
+		sb.buf = &bytes.Buffer{}
+	}
+	return sb.buf.Write(p)
+}
+
+// Reset resets the buffer to be empty.
+func (sb *spliceBuffer) Reset() {
+	if sb.buf != nil {
+		sb.buf.Reset()
+	}
+	sb.raw = nil
+}
+
+// Bytes returns the data held by the buffer.
+func (sb *spliceBuffer) Bytes() []byte {
+	if sb.buf != nil && len(sb.buf.Bytes()) > 0 {
+		return sb.buf.Bytes()
+	}
+	if sb.raw != nil {
+		return sb.raw
+	}
+	return []byte{}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/splice_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/splice_test.go
new file mode 100644
index 0000000000..9d8ca5102d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/splice_test.go
@@ -0,0 +1,121 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime_test
+
+import (
+	"bytes"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func TestSpliceBuffer(t *testing.T) {
+	testBytes0 := []byte{0x01, 0x02, 0x03, 0x04}
+	testBytes1 := []byte{0x04, 0x03, 0x02, 0x02}
+
+	testCases := []struct {
+		name string
+		run  func(sb runtime.Splice, buf *bytes.Buffer)
+	}{
+		{
+			name: "Basic Write",
+			run: func(sb runtime.Splice, buf *bytes.Buffer) {
+				sb.Write(testBytes0)
+				buf.Write(testBytes0)
+			},
+		},
+		{
+			name: "Multiple Writes",
+			run: func(sb runtime.Splice, buf *bytes.Buffer) {
+				for _, b := range testBytes0 {
+					sb.Write([]byte{b})
+					buf.Write([]byte{b})
+				}
+			},
+		},
+		{
+			name: "Write and Reset",
+			run: func(sb runtime.Splice, buf *bytes.Buffer) {
+				sb.Write(testBytes0)
+				buf.Write(testBytes0)
+
+				sb.Reset()
+				buf.Reset()
+			},
+		},
+		{
+			name: "Write/Splice",
+			run: func(sb runtime.Splice, buf *bytes.Buffer) {
+				sb.Splice(testBytes0)
+				buf.Write(testBytes0)
+			},
+		},
+		{
+			name: "Write/Splice and Reset",
+			run: func(sb runtime.Splice, buf *bytes.Buffer) {
+				sb.Splice(testBytes0)
+				buf.Write(testBytes0)
+
+				sb.Reset()
+				buf.Reset()
+			},
+		},
+		{
+			name: "Write/Splice, Reset, Write/Splice",
+			run: func(sb runtime.Splice, buf *bytes.Buffer) {
+				sb.Splice(testBytes0)
+				buf.Write(testBytes0)
+
+				sb.Reset()
+				buf.Reset()
+
+				sb.Splice(testBytes1)
+				buf.Write(testBytes1)
+			},
+		},
+		{
+			name: "Write, Reset, Splice",
+			run: func(sb runtime.Splice, buf *bytes.Buffer) {
+				sb.Write(testBytes0)
+				buf.Write(testBytes0)
+
+				sb.Reset()
+				buf.Reset()
+
+				sb.Splice(testBytes1)
+				buf.Write(testBytes1)
+			},
+		},
+	}
+
+	for _, tt := range testCases {
+		t.Run(tt.name, func(t *testing.T) {
+			sb := runtime.NewSpliceBuffer()
+			buf := &bytes.Buffer{}
+			tt.run(sb, buf)
+
+			if sb.Bytes() == nil {
+				t.Errorf("Unexpected nil")
+			}
+			if string(sb.Bytes()) != string(buf.Bytes()) {
+				t.Errorf("Expected sb.Bytes() == %q, buf.Bytes() == %q", sb.Bytes(), buf.Bytes())
+			}
+		})
+
+	}
+
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator.go
new file mode 100644
index 0000000000..0d5a3e709d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator.go
@@ -0,0 +1,274 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"fmt"
+	"go/ast"
+	"go/doc"
+	"go/parser"
+	"go/token"
+	"io"
+	"reflect"
+	"strconv"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/errors"
+)
+
+// Pair of strings. We keed the name of fields and the doc
+type Pair struct {
+	Name, Doc string
+}
+
+// KubeTypes is an array to represent all available types in a parsed file. [0] is for the type itself
+type KubeTypes []Pair
+
+func astFrom(filePath string) *doc.Package {
+	fset := token.NewFileSet()
+	m := make(map[string]*ast.File)
+
+	f, err := parser.ParseFile(fset, filePath, nil, parser.ParseComments)
+	if err != nil {
+		fmt.Println(err)
+		return nil
+	}
+
+	m[filePath] = f
+	apkg, _ := ast.NewPackage(fset, m, nil, nil)
+
+	return doc.New(apkg, "", 0)
+}
+
+func fmtRawDoc(rawDoc string) string {
+	var buffer bytes.Buffer
+	delPrevChar := func() {
+		if buffer.Len() > 0 {
+			buffer.Truncate(buffer.Len() - 1) // Delete the last " " or "\n"
+		}
+	}
+
+	// Ignore all lines after ---
+	rawDoc = strings.Split(rawDoc, "---")[0]
+
+	for _, line := range strings.Split(rawDoc, "\n") {
+		line = strings.TrimRight(line, " ")
+		leading := strings.TrimLeft(line, " ")
+		switch {
+		case len(line) == 0: // Keep paragraphs
+			delPrevChar()
+			buffer.WriteString("\n\n")
+		case strings.HasPrefix(leading, "TODO"): // Ignore one line TODOs
+		case strings.HasPrefix(leading, "+"): // Ignore instructions to the generators
+		default:
+			if strings.HasPrefix(line, " ") || strings.HasPrefix(line, "\t") {
+				delPrevChar()
+				line = "\n" + line + "\n" // Replace it with newline. This is useful when we have a line with: "Example:\n\tJSON-someting..."
+			} else {
+				line += " "
+			}
+			buffer.WriteString(line)
+		}
+	}
+
+	postDoc := strings.TrimRight(buffer.String(), "\n")
+	postDoc = strings.Replace(postDoc, "\\\"", "\"", -1) // replace user's \" to "
+	postDoc = strings.Replace(postDoc, "\"", "\\\"", -1) // Escape "
+	postDoc = strings.Replace(postDoc, "\n", "\\n", -1)
+	postDoc = strings.Replace(postDoc, "\t", "\\t", -1)
+
+	return postDoc
+}
+
+// fieldName returns the name of the field as it should appear in JSON format
+// "-" indicates that this field is not part of the JSON representation
+func fieldName(field *ast.Field) (string, error) {
+	jsonTag := ""
+	if field.Tag != nil {
+		var jsonTagExists bool
+		tagValue, err := strconv.Unquote(field.Tag.Value)
+		if err != nil {
+			return "", err
+		}
+		jsonTag, jsonTagExists = reflect.StructTag(tagValue).Lookup("json") // Delete first and last quotation
+		// field is embedded, json tag is declared and has an empty name
+		if field.Names == nil && jsonTagExists && (jsonTag == "" || strings.HasPrefix(jsonTag, ",")) {
+			return "-", nil
+		}
+	}
+
+	jsonTag = strings.Split(jsonTag, ",")[0] // This can return "-"
+	if jsonTag == "" {
+		if field.Names != nil {
+			return field.Names[0].Name, nil
+		}
+		return field.Type.(*ast.Ident).Name, nil
+	}
+	return jsonTag, nil
+}
+
+// A buffer of lines that will be written.
+type bufferedLine struct {
+	line        string
+	indentation int
+}
+
+type buffer struct {
+	lines []bufferedLine
+}
+
+func newBuffer() *buffer {
+	return &buffer{
+		lines: make([]bufferedLine, 0),
+	}
+}
+
+func (b *buffer) addLine(line string, indent int) {
+	b.lines = append(b.lines, bufferedLine{line, indent})
+}
+
+func (b *buffer) flushLines(w io.Writer) error {
+	for _, line := range b.lines {
+		indentation := strings.Repeat("\t", line.indentation)
+		fullLine := fmt.Sprintf("%s%s", indentation, line.line)
+		if _, err := io.WriteString(w, fullLine); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func writeFuncHeader(b *buffer, structName string, indent int) {
+	s := fmt.Sprintf("var map_%s = map[string]string {\n", structName)
+	b.addLine(s, indent)
+}
+
+func writeFuncFooter(b *buffer, structName string, indent int) {
+	b.addLine("}\n", indent) // Closes the map definition
+
+	s := fmt.Sprintf("func (%s) SwaggerDoc() map[string]string {\n", structName)
+	b.addLine(s, indent)
+	s = fmt.Sprintf("return map_%s\n", structName)
+	b.addLine(s, indent+1)
+	b.addLine("}\n", indent) // Closes the function definition
+}
+
+func writeMapBody(b *buffer, kubeType []Pair, indent int) {
+	format := "\"%s\": \"%s\",\n"
+	for _, pair := range kubeType {
+		s := fmt.Sprintf(format, pair.Name, pair.Doc)
+		b.addLine(s, indent+2)
+	}
+}
+
+// ParseDocumentationFrom gets all types' documentation and returns them as an
+// array. Each type is again represented as an array (we have to use arrays as we
+// need to be sure for the order of the fields). This function returns fields and
+// struct definitions that have no documentation as {name, ""}.
+func ParseDocumentationFrom(src string) ([]KubeTypes, error) {
+	var docForTypes []KubeTypes
+	var errs []error
+
+	pkg := astFrom(src)
+
+	for _, kubType := range pkg.Types {
+		if structType, ok := kubType.Decl.Specs[0].(*ast.TypeSpec).Type.(*ast.StructType); ok {
+			var ks KubeTypes
+			ks = append(ks, Pair{kubType.Name, fmtRawDoc(kubType.Doc)})
+
+			for _, field := range structType.Fields.List {
+				if n, err := fieldName(field); err != nil {
+					errs = append(errs, err)
+				} else if n != "-" {
+					fieldDoc := fmtRawDoc(field.Doc.Text())
+					ks = append(ks, Pair{n, fieldDoc})
+				}
+			}
+			docForTypes = append(docForTypes, ks)
+		}
+	}
+
+	return docForTypes, errors.NewAggregate(errs)
+}
+
+// WriteSwaggerDocFunc writes a declaration of a function as a string. This function is used in
+// Swagger as a documentation source for structs and theirs fields
+func WriteSwaggerDocFunc(kubeTypes []KubeTypes, w io.Writer) error {
+	for _, kubeType := range kubeTypes {
+		structName := kubeType[0].Name
+		kubeType[0].Name = ""
+
+		// Ignore empty documentation
+		docfulTypes := make(KubeTypes, 0, len(kubeType))
+		for _, pair := range kubeType {
+			if pair.Doc != "" {
+				docfulTypes = append(docfulTypes, pair)
+			}
+		}
+
+		if len(docfulTypes) == 0 {
+			continue // If no fields and the struct have documentation, skip the function definition
+		}
+
+		indent := 0
+		buffer := newBuffer()
+
+		writeFuncHeader(buffer, structName, indent)
+		writeMapBody(buffer, docfulTypes, indent)
+		writeFuncFooter(buffer, structName, indent)
+		buffer.addLine("\n", 0)
+
+		if err := buffer.flushLines(w); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// VerifySwaggerDocsExist writes in a io.Writer a list of structs and fields that
+// are missing of documentation.
+func VerifySwaggerDocsExist(kubeTypes []KubeTypes, w io.Writer) (int, error) {
+	missingDocs := 0
+	buffer := newBuffer()
+
+	for _, kubeType := range kubeTypes {
+		structName := kubeType[0].Name
+		if kubeType[0].Doc == "" {
+			format := "Missing documentation for the struct itself: %s\n"
+			s := fmt.Sprintf(format, structName)
+			buffer.addLine(s, 0)
+			missingDocs++
+		}
+		kubeType = kubeType[1:] // Skip struct definition
+
+		for _, pair := range kubeType { // Iterate only the fields
+			if pair.Doc == "" {
+				format := "In struct: %s, field documentation is missing: %s\n"
+				s := fmt.Sprintf(format, structName, pair.Name)
+				buffer.addLine(s, 0)
+				missingDocs++
+			}
+		}
+	}
+
+	if err := buffer.flushLines(w); err != nil {
+		return -1, err
+	}
+	return missingDocs, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator_test.go
new file mode 100644
index 0000000000..a6f338d311
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator_test.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"testing"
+)
+
+func TestFmtRawDoc(t *testing.T) {
+	tests := []struct {
+		t, expected string
+	}{
+		{"aaa\n  --- asd\n TODO: tooooodo\n toooodoooooo\n", "aaa"},
+		{"aaa\nasd\n TODO: tooooodo\nbbbb\n --- toooodoooooo\n", "aaa asd bbbb"},
+		{" TODO: tooooodo\n", ""},
+		{"Par1\n\nPar2\n\n", "Par1\\n\\nPar2"},
+		{"", ""},
+		{" ", ""},
+		{" \n", ""},
+		{" \n\n ", ""},
+		{"Example:\n\tl1\n\t\tl2\n", "Example:\\n\\tl1\\n\\t\\tl2"},
+	}
+
+	for _, test := range tests {
+		if o := fmtRawDoc(test.t); o != test.expected {
+			t.Fatalf("Expected: %q, got %q", test.expected, o)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/cacheable_object.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/cacheable_object.go
new file mode 100644
index 0000000000..04c9dc8e08
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/cacheable_object.go
@@ -0,0 +1,220 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// nonCacheableTestObject implements json.Marshaler and proto.Marshaler interfaces
+// for mocking purpose.
+// +k8s:deepcopy-gen=false
+type noncacheableTestObject struct {
+	gvk schema.GroupVersionKind
+}
+
+// MarshalJSON implements json.Marshaler interface.
+func (*noncacheableTestObject) MarshalJSON() ([]byte, error) {
+	return []byte("\"json-result\""), nil
+}
+
+// Marshal implements proto.Marshaler interface.
+func (*noncacheableTestObject) Marshal() ([]byte, error) {
+	return []byte("\"proto-result\""), nil
+}
+
+// DeepCopyObject implements runtime.Object interface.
+func (*noncacheableTestObject) DeepCopyObject() runtime.Object {
+	panic("DeepCopy unimplemented for noncacheableTestObject")
+}
+
+// GetObjectKind implements runtime.Object interface.
+func (o *noncacheableTestObject) GetObjectKind() schema.ObjectKind {
+	return o
+}
+
+// GroupVersionKind implements schema.ObjectKind interface.
+func (o *noncacheableTestObject) GroupVersionKind() schema.GroupVersionKind {
+	return o.gvk
+}
+
+// SetGroupVersionKind implements schema.ObjectKind interface.
+func (o *noncacheableTestObject) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	o.gvk = gvk
+}
+
+var _ runtime.CacheableObject = &MockCacheableObject{}
+
+// MochCacheableObject is used to test CacheableObject interface.
+// +k8s:deepcopy-gen=false
+type MockCacheableObject struct {
+	gvk schema.GroupVersionKind
+
+	t *testing.T
+
+	runEncode      bool
+	returnSelf     bool
+	expectedResult string
+	expectedError  error
+
+	intercepted []runtime.Identifier
+}
+
+// DeepCopyObject implements runtime.Object interface.
+func (m *MockCacheableObject) DeepCopyObject() runtime.Object {
+	panic("DeepCopy unimplemented for MockCacheableObject")
+}
+
+// GetObjectKind implements runtime.Object interface.
+func (m *MockCacheableObject) GetObjectKind() schema.ObjectKind {
+	return m
+}
+
+// GroupVersionKind implements schema.ObjectKind interface.
+func (m *MockCacheableObject) GroupVersionKind() schema.GroupVersionKind {
+	return m.gvk
+}
+
+// SetGroupVersionKind implements schema.ObjectKind interface.
+func (m *MockCacheableObject) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	m.gvk = gvk
+}
+
+// Marshal implements proto.Marshaler interface.
+// This is implemented to avoid errors from protobuf serializer.
+func (*MockCacheableObject) Marshal() ([]byte, error) {
+	return []byte("\"proto-result\""), nil
+}
+
+// CacheEncode implements runtime.CacheableObject interface.
+func (m *MockCacheableObject) CacheEncode(id runtime.Identifier, encode func(runtime.Object, io.Writer) error, w io.Writer) error {
+	m.intercepted = append(m.intercepted, id)
+	if m.runEncode {
+		return encode(m.GetObject(), w)
+	}
+	if _, err := w.Write([]byte(m.expectedResult)); err != nil {
+		m.t.Errorf("couldn't write to io.Writer: %v", err)
+	}
+	return m.expectedError
+}
+
+// GetObject implements runtime.CacheableObject interface.
+func (m *MockCacheableObject) GetObject() runtime.Object {
+	if m.returnSelf {
+		return m
+	}
+	gvk := schema.GroupVersionKind{Group: "group", Version: "version", Kind: "noncacheableTestObject"}
+	return &noncacheableTestObject{gvk: gvk}
+}
+
+func (m *MockCacheableObject) interceptedCalls() []runtime.Identifier {
+	return m.intercepted
+}
+
+type testBuffer struct {
+	writer io.Writer
+	t      *testing.T
+	object *MockCacheableObject
+}
+
+// Write implements io.Writer interface.
+func (b *testBuffer) Write(p []byte) (int, error) {
+	// Before writing any byte, check if <object> has already
+	// intercepted any CacheEncode operation.
+	if len(b.object.interceptedCalls()) == 0 {
+		b.t.Errorf("writing to buffer without handling MockCacheableObject")
+	}
+	return b.writer.Write(p)
+}
+
+// CacheableObjectTest implements a test that should be run for every
+// runtime.Encoder interface implementation.
+// It checks whether CacheableObject is properly supported by it.
+func CacheableObjectTest(t *testing.T, e runtime.Encoder) {
+	gvk1 := schema.GroupVersionKind{Group: "group", Version: "version1", Kind: "MockCacheableObject"}
+
+	testCases := []struct {
+		desc           string
+		runEncode      bool
+		returnSelf     bool
+		expectedResult string
+		expectedError  error
+	}{
+		{
+			desc:      "delegate",
+			runEncode: true,
+		},
+		{
+			desc:       "delegate return self",
+			runEncode:  true,
+			returnSelf: true,
+		},
+		{
+			desc:           "cached success",
+			runEncode:      false,
+			expectedResult: "result",
+			expectedError:  nil,
+		},
+		{
+			desc:           "cached failure",
+			runEncode:      false,
+			expectedResult: "",
+			expectedError:  fmt.Errorf("encoding error"),
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			obj := &MockCacheableObject{
+				gvk:            gvk1,
+				t:              t,
+				runEncode:      test.runEncode,
+				returnSelf:     test.returnSelf,
+				expectedResult: test.expectedResult,
+				expectedError:  test.expectedError,
+			}
+			buffer := bytes.NewBuffer(nil)
+			w := &testBuffer{
+				writer: buffer,
+				t:      t,
+				object: obj,
+			}
+
+			if err := e.Encode(obj, w); err != test.expectedError {
+				t.Errorf("unexpected error: %v, expected: %v", err, test.expectedError)
+			}
+			if !test.runEncode {
+				if result := buffer.String(); result != test.expectedResult {
+					t.Errorf("unexpected result: %s, expected: %s", result, test.expectedResult)
+				}
+			}
+			intercepted := obj.interceptedCalls()
+			if len(intercepted) != 1 {
+				t.Fatalf("unexpected number of intercepted calls: %v", intercepted)
+			}
+			if intercepted[0] != e.Identifier() {
+				t.Errorf("unexpected intercepted call: %v, expected: %v", intercepted, e.Identifier())
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/conversion.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/conversion.go
new file mode 100644
index 0000000000..384929b17c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/conversion.go
@@ -0,0 +1,300 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func convertEmbeddedTestToEmbeddedTestExternal(in *EmbeddedTest, out *EmbeddedTestExternal, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.ID = in.ID
+	if err := runtime.Convert_runtime_Object_To_runtime_RawExtension(&in.Object, &out.Object, s); err != nil {
+		return err
+	}
+	if err := runtime.Convert_runtime_Object_To_runtime_RawExtension(&in.EmptyObject, &out.EmptyObject, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+func convertEmbeddedTestExternalToEmbeddedTest(in *EmbeddedTestExternal, out *EmbeddedTest, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.ID = in.ID
+	if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&in.Object, &out.Object, s); err != nil {
+		return err
+	}
+	if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&in.EmptyObject, &out.EmptyObject, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+func convertObjectTestToObjectTestExternal(in *ObjectTest, out *ObjectTestExternal, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.ID = in.ID
+	if in.Items != nil {
+		out.Items = make([]runtime.RawExtension, len(in.Items))
+		for i := range in.Items {
+			if err := runtime.Convert_runtime_Object_To_runtime_RawExtension(&in.Items[i], &out.Items[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
+	return nil
+}
+
+func convertObjectTestExternalToObjectTest(in *ObjectTestExternal, out *ObjectTest, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.ID = in.ID
+	if in.Items != nil {
+		out.Items = make([]runtime.Object, len(in.Items))
+		for i := range in.Items {
+			if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&in.Items[i], &out.Items[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
+	return nil
+}
+
+func convertInternalSimpleToExternalSimple(in *InternalSimple, out *ExternalSimple, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.TestString = in.TestString
+	return nil
+}
+
+func convertExternalSimpleToInternalSimple(in *ExternalSimple, out *InternalSimple, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.TestString = in.TestString
+	return nil
+}
+
+func convertInternalExtensionTypeToExternalExtensionType(in *InternalExtensionType, out *ExternalExtensionType, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	if err := runtime.Convert_runtime_Object_To_runtime_RawExtension(&in.Extension, &out.Extension, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+func convertExternalExtensionTypeToInternalExtensionType(in *ExternalExtensionType, out *InternalExtensionType, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&in.Extension, &out.Extension, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+func convertInternalOptionalExtensionTypeToExternalOptionalExtensionType(in *InternalOptionalExtensionType, out *ExternalOptionalExtensionType, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	if err := runtime.Convert_runtime_Object_To_runtime_RawExtension(&in.Extension, &out.Extension, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+func convertExternalOptionalExtensionTypeToInternalOptionalExtensionType(in *ExternalOptionalExtensionType, out *InternalOptionalExtensionType, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&in.Extension, &out.Extension, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+func convertTestType1ToExternalTestType1(in *TestType1, out *ExternalTestType1, s conversion.Scope) error {
+	out.MyWeirdCustomEmbeddedVersionKindField = in.MyWeirdCustomEmbeddedVersionKindField
+	out.A = in.A
+	out.B = in.B
+	out.C = in.C
+	out.D = in.D
+	out.E = in.E
+	out.F = in.F
+	out.G = in.G
+	out.H = in.H
+	out.I = in.I
+	out.J = in.J
+	out.K = in.K
+	out.L = in.L
+	out.M = in.M
+	if in.N != nil {
+		out.N = make(map[string]ExternalTestType2)
+		for key := range in.N {
+			in, tmp := in.N[key], ExternalTestType2{}
+			if err := convertTestType2ToExternalTestType2(&in, &tmp, s); err != nil {
+				return err
+			}
+			out.N[key] = tmp
+		}
+	} else {
+		out.N = nil
+	}
+	if in.O != nil {
+		out.O = new(ExternalTestType2)
+		if err := convertTestType2ToExternalTestType2(in.O, out.O, s); err != nil {
+			return err
+		}
+	} else {
+		out.O = nil
+	}
+	if in.P != nil {
+		out.P = make([]ExternalTestType2, len(in.P))
+		for i := range in.P {
+			if err := convertTestType2ToExternalTestType2(&in.P[i], &out.P[i], s); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func convertExternalTestType1ToTestType1(in *ExternalTestType1, out *TestType1, s conversion.Scope) error {
+	out.MyWeirdCustomEmbeddedVersionKindField = in.MyWeirdCustomEmbeddedVersionKindField
+	out.A = in.A
+	out.B = in.B
+	out.C = in.C
+	out.D = in.D
+	out.E = in.E
+	out.F = in.F
+	out.G = in.G
+	out.H = in.H
+	out.I = in.I
+	out.J = in.J
+	out.K = in.K
+	out.L = in.L
+	out.M = in.M
+	if in.N != nil {
+		out.N = make(map[string]TestType2)
+		for key := range in.N {
+			in, tmp := in.N[key], TestType2{}
+			if err := convertExternalTestType2ToTestType2(&in, &tmp, s); err != nil {
+				return err
+			}
+			out.N[key] = tmp
+		}
+	} else {
+		out.N = nil
+	}
+	if in.O != nil {
+		out.O = new(TestType2)
+		if err := convertExternalTestType2ToTestType2(in.O, out.O, s); err != nil {
+			return err
+		}
+	} else {
+		out.O = nil
+	}
+	if in.P != nil {
+		out.P = make([]TestType2, len(in.P))
+		for i := range in.P {
+			if err := convertExternalTestType2ToTestType2(&in.P[i], &out.P[i], s); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func convertTestType2ToExternalTestType2(in *TestType2, out *ExternalTestType2, s conversion.Scope) error {
+	out.A = in.A
+	out.B = in.B
+	return nil
+}
+
+func convertExternalTestType2ToTestType2(in *ExternalTestType2, out *TestType2, s conversion.Scope) error {
+	out.A = in.A
+	out.B = in.B
+	return nil
+}
+
+func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddConversionFunc((*EmbeddedTest)(nil), (*EmbeddedTestExternal)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertEmbeddedTestToEmbeddedTestExternal(a.(*EmbeddedTest), b.(*EmbeddedTestExternal), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*EmbeddedTestExternal)(nil), (*EmbeddedTest)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertEmbeddedTestExternalToEmbeddedTest(a.(*EmbeddedTestExternal), b.(*EmbeddedTest), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ObjectTest)(nil), (*ObjectTestExternal)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertObjectTestToObjectTestExternal(a.(*ObjectTest), b.(*ObjectTestExternal), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ObjectTestExternal)(nil), (*ObjectTest)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertObjectTestExternalToObjectTest(a.(*ObjectTestExternal), b.(*ObjectTest), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*InternalSimple)(nil), (*ExternalSimple)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertInternalSimpleToExternalSimple(a.(*InternalSimple), b.(*ExternalSimple), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ExternalSimple)(nil), (*InternalSimple)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertExternalSimpleToInternalSimple(a.(*ExternalSimple), b.(*InternalSimple), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*InternalExtensionType)(nil), (*ExternalExtensionType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertInternalExtensionTypeToExternalExtensionType(a.(*InternalExtensionType), b.(*ExternalExtensionType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ExternalExtensionType)(nil), (*InternalExtensionType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertExternalExtensionTypeToInternalExtensionType(a.(*ExternalExtensionType), b.(*InternalExtensionType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*InternalOptionalExtensionType)(nil), (*ExternalOptionalExtensionType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertInternalOptionalExtensionTypeToExternalOptionalExtensionType(a.(*InternalOptionalExtensionType), b.(*ExternalOptionalExtensionType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ExternalOptionalExtensionType)(nil), (*InternalOptionalExtensionType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertExternalOptionalExtensionTypeToInternalOptionalExtensionType(a.(*ExternalOptionalExtensionType), b.(*InternalOptionalExtensionType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*TestType1)(nil), (*ExternalTestType1)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertTestType1ToExternalTestType1(a.(*TestType1), b.(*ExternalTestType1), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ExternalTestType1)(nil), (*TestType1)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertExternalTestType1ToTestType1(a.(*ExternalTestType1), b.(*TestType1), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*TestType2)(nil), (*ExternalTestType2)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertTestType2ToExternalTestType2(a.(*TestType2), b.(*ExternalTestType2), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ExternalTestType2)(nil), (*TestType2)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertExternalTestType2ToTestType2(a.(*ExternalTestType2), b.(*TestType2), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/doc.go
new file mode 100644
index 0000000000..a490327854
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+
+package testing
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/types.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/types.go
new file mode 100644
index 0000000000..82abf13982
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/types.go
@@ -0,0 +1,336 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/json"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type EmbeddedTest struct {
+	runtime.TypeMeta
+	ID          string
+	Object      runtime.Object
+	EmptyObject runtime.Object
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type EmbeddedTestExternal struct {
+	runtime.TypeMeta `json:""`
+	ID               string               `json:"id,omitempty"`
+	Object           runtime.RawExtension `json:"object,omitempty"`
+	EmptyObject      runtime.RawExtension `json:"emptyObject,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ObjectTest struct {
+	runtime.TypeMeta
+
+	ID    string
+	Items []runtime.Object
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ObjectTestExternal struct {
+	runtime.TypeMeta `yaml:",inline" json:""`
+
+	ID    string                 `json:"id,omitempty"`
+	Items []runtime.RawExtension `json:"items,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type InternalSimple struct {
+	runtime.TypeMeta `json:""`
+	TestString       string `json:"testString"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalSimple struct {
+	runtime.TypeMeta `json:""`
+	TestString       string `json:"testString"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExtensionA struct {
+	runtime.TypeMeta `json:""`
+	TestString       string `json:"testString"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExtensionB struct {
+	runtime.TypeMeta `json:""`
+	TestString       string `json:"testString"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalExtensionType struct {
+	runtime.TypeMeta `json:""`
+	Extension        runtime.RawExtension `json:"extension"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type InternalExtensionType struct {
+	runtime.TypeMeta `json:""`
+	Extension        runtime.Object `json:"extension"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalOptionalExtensionType struct {
+	runtime.TypeMeta `json:""`
+	Extension        runtime.RawExtension `json:"extension,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type InternalOptionalExtensionType struct {
+	runtime.TypeMeta `json:""`
+	Extension        runtime.Object `json:"extension,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type InternalComplex struct {
+	runtime.TypeMeta
+	String    string
+	Integer   int
+	Integer64 int64
+	Int64     int64
+	Bool      bool
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalComplex struct {
+	runtime.TypeMeta `json:""`
+	String           string `json:"string" description:"testing"`
+	Integer          int    `json:"int"`
+	Integer64        int64  `json:",omitempty"`
+	Int64            int64
+	Bool             bool `json:"bool"`
+}
+
+// Test a weird version/kind embedding format.
+// +k8s:deepcopy-gen=false
+type MyWeirdCustomEmbeddedVersionKindField struct {
+	ID         string `json:"ID,omitempty"`
+	APIVersion string `json:"myVersionKey,omitempty"`
+	ObjectKind string `json:"myKindKey,omitempty"`
+	Z          string `json:"Z,omitempty"`
+	Y          uint64 `json:"Y,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type TestType1 struct {
+	MyWeirdCustomEmbeddedVersionKindField `json:""`
+	A                                     string               `json:"A,omitempty"`
+	B                                     int                  `json:"B,omitempty"`
+	C                                     int8                 `json:"C,omitempty"`
+	D                                     int16                `json:"D,omitempty"`
+	E                                     int32                `json:"E,omitempty"`
+	F                                     int64                `json:"F,omitempty"`
+	G                                     uint                 `json:"G,omitempty"`
+	H                                     uint8                `json:"H,omitempty"`
+	I                                     uint16               `json:"I,omitempty"`
+	J                                     uint32               `json:"J,omitempty"`
+	K                                     uint64               `json:"K,omitempty"`
+	L                                     bool                 `json:"L,omitempty"`
+	M                                     map[string]int       `json:"M,omitempty"`
+	N                                     map[string]TestType2 `json:"N,omitempty"`
+	O                                     *TestType2           `json:"O,omitempty"`
+	P                                     []TestType2          `json:"Q,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type TestType2 struct {
+	A string `json:"A,omitempty"`
+	B int    `json:"B,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalTestType2 struct {
+	A string `json:"A,omitempty"`
+	B int    `json:"B,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalTestType1 struct {
+	MyWeirdCustomEmbeddedVersionKindField `json:""`
+	A                                     string                       `json:"A,omitempty"`
+	B                                     int                          `json:"B,omitempty"`
+	C                                     int8                         `json:"C,omitempty"`
+	D                                     int16                        `json:"D,omitempty"`
+	E                                     int32                        `json:"E,omitempty"`
+	F                                     int64                        `json:"F,omitempty"`
+	G                                     uint                         `json:"G,omitempty"`
+	H                                     uint8                        `json:"H,omitempty"`
+	I                                     uint16                       `json:"I,omitempty"`
+	J                                     uint32                       `json:"J,omitempty"`
+	K                                     uint64                       `json:"K,omitempty"`
+	L                                     bool                         `json:"L,omitempty"`
+	M                                     map[string]int               `json:"M,omitempty"`
+	N                                     map[string]ExternalTestType2 `json:"N,omitempty"`
+	O                                     *ExternalTestType2           `json:"O,omitempty"`
+	P                                     []ExternalTestType2          `json:"Q,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalInternalSame struct {
+	MyWeirdCustomEmbeddedVersionKindField `json:""`
+	A                                     TestType2 `json:"A,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type UnversionedType struct {
+	MyWeirdCustomEmbeddedVersionKindField `json:""`
+	A                                     string `json:"A,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type UnknownType struct {
+	MyWeirdCustomEmbeddedVersionKindField `json:""`
+	A                                     string `json:"A,omitempty"`
+}
+
+func (obj *MyWeirdCustomEmbeddedVersionKindField) GetObjectKind() schema.ObjectKind { return obj }
+func (obj *MyWeirdCustomEmbeddedVersionKindField) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	obj.APIVersion, obj.ObjectKind = gvk.ToAPIVersionAndKind()
+}
+func (obj *MyWeirdCustomEmbeddedVersionKindField) GroupVersionKind() schema.GroupVersionKind {
+	return schema.FromAPIVersionAndKind(obj.APIVersion, obj.ObjectKind)
+}
+
+func (obj *TestType2) GetObjectKind() schema.ObjectKind         { return schema.EmptyObjectKind }
+func (obj *ExternalTestType2) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+// +k8s:deepcopy-gen=false
+type Unstructured struct {
+	// Object is a JSON compatible map with string, float, int, bool, []interface{}, or
+	// map[string]interface{}
+	// children.
+	Object map[string]interface{}
+}
+
+var _ runtime.Unstructured = &Unstructured{}
+
+func (obj *Unstructured) GetObjectKind() schema.ObjectKind { return obj }
+
+func (obj *Unstructured) IsList() bool {
+	if obj.Object != nil {
+		_, ok := obj.Object["items"]
+		return ok
+	}
+	return false
+}
+
+func (obj *Unstructured) EachListItem(fn func(runtime.Object) error) error {
+	if obj.Object == nil {
+		return fmt.Errorf("content is not a list")
+	}
+	field, ok := obj.Object["items"]
+	if !ok {
+		return fmt.Errorf("content is not a list")
+	}
+	items, ok := field.([]interface{})
+	if !ok {
+		return nil
+	}
+	for _, item := range items {
+		child, ok := item.(map[string]interface{})
+		if !ok {
+			return fmt.Errorf("items member is not an object")
+		}
+		if err := fn(&Unstructured{Object: child}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (obj *Unstructured) EachListItemWithAlloc(fn func(runtime.Object) error) error {
+	// EachListItem has allocated a new Object for the user, we can use it directly.
+	return obj.EachListItem(fn)
+}
+
+func (obj *Unstructured) NewEmptyInstance() runtime.Unstructured {
+	out := new(Unstructured)
+	if obj != nil {
+		out.SetGroupVersionKind(obj.GroupVersionKind())
+	}
+	return out
+}
+
+func (obj *Unstructured) UnstructuredContent() map[string]interface{} {
+	if obj.Object == nil {
+		return make(map[string]interface{})
+	}
+	return obj.Object
+}
+
+func (obj *Unstructured) SetUnstructuredContent(content map[string]interface{}) {
+	obj.Object = content
+}
+
+// MarshalJSON ensures that the unstructured object produces proper
+// JSON when passed to Go's standard JSON library.
+func (u *Unstructured) MarshalJSON() ([]byte, error) {
+	return json.Marshal(u.Object)
+}
+
+// UnmarshalJSON ensures that the unstructured object properly decodes
+// JSON when passed to Go's standard JSON library.
+func (u *Unstructured) UnmarshalJSON(b []byte) error {
+	return json.Unmarshal(b, &u.Object)
+}
+
+func (in *Unstructured) DeepCopyObject() runtime.Object {
+	return in.DeepCopy()
+}
+
+func (in *Unstructured) DeepCopy() *Unstructured {
+	if in == nil {
+		return nil
+	}
+	out := new(Unstructured)
+	*out = *in
+	out.Object = runtime.DeepCopyJSON(in.Object)
+	return out
+}
+
+func (u *Unstructured) GroupVersionKind() schema.GroupVersionKind {
+	apiVersion, ok := u.Object["apiVersion"].(string)
+	if !ok {
+		return schema.GroupVersionKind{}
+	}
+	gv, err := schema.ParseGroupVersion(apiVersion)
+	if err != nil {
+		return schema.GroupVersionKind{}
+	}
+	kind, ok := u.Object["kind"].(string)
+	if ok {
+		return gv.WithKind(kind)
+	}
+	return schema.GroupVersionKind{}
+}
+
+func (u *Unstructured) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	if u.Object == nil {
+		u.Object = make(map[string]interface{})
+	}
+	u.Object["apiVersion"] = gvk.GroupVersion().String()
+	u.Object["kind"] = gvk.Kind
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/doc.go
new file mode 100644
index 0000000000..229ce237de
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/types.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/types.go
new file mode 100644
index 0000000000..a6c5fef30f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/types.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalSimple struct {
+	runtime.TypeMeta `json:""`
+	TestString       string `json:"testString"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..29f1f7a0a8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/zz_generated.deepcopy.go
@@ -0,0 +1,51 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalSimple) DeepCopyInto(out *ExternalSimple) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalSimple.
+func (in *ExternalSimple) DeepCopy() *ExternalSimple {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalSimple)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalSimple) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/zz_generated.model_name.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/zz_generated.model_name.go
new file mode 100644
index 0000000000..c68af71298
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/zz_generated.model_name.go
@@ -0,0 +1,27 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package v1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ExternalSimple) OpenAPIModelName() string {
+	return "io.k8s.api.testing.v1.ExternalSimple"
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/validation.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/validation.go
new file mode 100644
index 0000000000..bbdfc296cc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/validation.go
@@ -0,0 +1,126 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"context"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+type VersionValidationRunner func(t *testing.T, gv string, versionValidationErrors field.ErrorList)
+
+// RunValidationForEachVersion runs f as a subtest of t for each version of the given unversioned object.
+// Each subtest is named by GroupVersionKind.  Each call to f is provided the field.ErrorList results
+// of converting the unversioned object to a version and validating it.
+//
+// Only autogenerated validation is run. To test both handwritten and autogenerated validation:
+//
+//		RunValidationForEachVersion(t, testCase.pod, func(t *testing.T, versionValidationErrors field.ErrorList) {
+//		  errs := ValidatePod(testCase.obj) // hand written validation
+//	      errs = append(errs, versionValidationErrors...) // generated declarative validation
+//		  // Validate that the errors are what was expected for this test case.
+//		})
+func RunValidationForEachVersion(t *testing.T, scheme *runtime.Scheme, options map[string]bool, unversioned runtime.Object, fn VersionValidationRunner, ignoreConversionErrors bool, subresources ...string) {
+	runValidation(t, scheme, options, unversioned, fn, ignoreConversionErrors, subresources...)
+}
+
+// RunUpdateValidationForEachVersion is like RunValidationForEachVersion but for update validation.
+func RunUpdateValidationForEachVersion(t *testing.T, scheme *runtime.Scheme, options map[string]bool, unversioned, unversionedOld runtime.Object, fn VersionValidationRunner, ignoreConversionErrors bool, subresources ...string) {
+	runUpdateValidation(t, scheme, options, unversioned, unversionedOld, fn, ignoreConversionErrors, subresources...)
+}
+
+func runValidation(t *testing.T, scheme *runtime.Scheme, options map[string]bool, unversioned runtime.Object, fn VersionValidationRunner, ignoreConversionErrors bool, subresources ...string) {
+	unversionedGVKs, _, err := scheme.ObjectKinds(unversioned)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, unversionedGVK := range unversionedGVKs {
+		// skip if passed in unversioned object is not internal.
+		if unversionedGVK.Version != runtime.APIVersionInternal {
+			continue
+		}
+		gvs := scheme.VersionsForGroupKind(unversionedGVK.GroupKind())
+		for _, gv := range gvs {
+			gvk := gv.WithKind(unversionedGVK.Kind)
+			t.Run(gvk.String(), func(t *testing.T) {
+				if gvk.Version != runtime.APIVersionInternal { // skip internal
+					versioned, err := scheme.New(gvk)
+					if err != nil {
+						t.Fatal(err)
+					}
+					err = scheme.Convert(unversioned, versioned, nil)
+					if ignoreConversionErrors && err != nil {
+						t.Skipf("Failed to convert object from internal type to %s: %v", gvk.Version, err)
+					} else if err != nil {
+						t.Fatal(err)
+					}
+					fn(t, gv.String(), scheme.Validate(context.Background(), options, versioned, subresources...))
+				}
+			})
+		}
+	}
+}
+
+func runUpdateValidation(t *testing.T, scheme *runtime.Scheme, options map[string]bool, unversionedNew, unversionedOld runtime.Object, fn VersionValidationRunner, ignoreConversionErrors bool, subresources ...string) {
+	unversionedGVKs, _, err := scheme.ObjectKinds(unversionedNew)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, unversionedGVK := range unversionedGVKs {
+		// skip if passed in unversioned object is not internal.
+		if unversionedGVK.Version != runtime.APIVersionInternal {
+			continue
+		}
+		gvs := scheme.VersionsForGroupKind(unversionedGVK.GroupKind())
+		for _, gv := range gvs {
+			gvk := gv.WithKind(unversionedGVK.Kind)
+			t.Run(gvk.String(), func(t *testing.T) {
+				if gvk.Version != runtime.APIVersionInternal { // skip internal
+					versionedNew, err := scheme.New(gvk)
+					if err != nil {
+						t.Fatal(err)
+					}
+					err = scheme.Convert(unversionedNew, versionedNew, nil)
+					if ignoreConversionErrors && err != nil {
+						t.Skipf("Failed to convert object from internal type to %s: %v", gvk.Version, err)
+					} else if err != nil {
+						t.Fatal(err)
+					}
+					var versionedOld runtime.Object
+					if unversionedOld != nil {
+						versionedOld, err = scheme.New(gvk)
+						if err != nil {
+							t.Fatal(err)
+						}
+
+						err = scheme.Convert(unversionedOld, versionedOld, nil)
+						if ignoreConversionErrors && err != nil {
+							t.Skipf("Failed to convert object from internal type to %s: %v", gvk.Version, err)
+						} else if err != nil {
+							t.Fatal(err)
+						}
+					}
+
+					fn(t, gv.String(), scheme.ValidateUpdate(context.Background(), options, versionedNew, versionedOld, subresources...))
+				}
+			})
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..c0d4419575
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/testing/zz_generated.deepcopy.go
@@ -0,0 +1,630 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package testing
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EmbeddedTest) DeepCopyInto(out *EmbeddedTest) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Object != nil {
+		out.Object = in.Object.DeepCopyObject()
+	}
+	if in.EmptyObject != nil {
+		out.EmptyObject = in.EmptyObject.DeepCopyObject()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EmbeddedTest.
+func (in *EmbeddedTest) DeepCopy() *EmbeddedTest {
+	if in == nil {
+		return nil
+	}
+	out := new(EmbeddedTest)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *EmbeddedTest) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EmbeddedTestExternal) DeepCopyInto(out *EmbeddedTestExternal) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.Object.DeepCopyInto(&out.Object)
+	in.EmptyObject.DeepCopyInto(&out.EmptyObject)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EmbeddedTestExternal.
+func (in *EmbeddedTestExternal) DeepCopy() *EmbeddedTestExternal {
+	if in == nil {
+		return nil
+	}
+	out := new(EmbeddedTestExternal)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *EmbeddedTestExternal) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExtensionA) DeepCopyInto(out *ExtensionA) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtensionA.
+func (in *ExtensionA) DeepCopy() *ExtensionA {
+	if in == nil {
+		return nil
+	}
+	out := new(ExtensionA)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExtensionA) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExtensionB) DeepCopyInto(out *ExtensionB) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtensionB.
+func (in *ExtensionB) DeepCopy() *ExtensionB {
+	if in == nil {
+		return nil
+	}
+	out := new(ExtensionB)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExtensionB) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalComplex) DeepCopyInto(out *ExternalComplex) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalComplex.
+func (in *ExternalComplex) DeepCopy() *ExternalComplex {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalComplex)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalComplex) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalExtensionType) DeepCopyInto(out *ExternalExtensionType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.Extension.DeepCopyInto(&out.Extension)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalExtensionType.
+func (in *ExternalExtensionType) DeepCopy() *ExternalExtensionType {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalExtensionType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalExtensionType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalInternalSame) DeepCopyInto(out *ExternalInternalSame) {
+	*out = *in
+	out.MyWeirdCustomEmbeddedVersionKindField = in.MyWeirdCustomEmbeddedVersionKindField
+	out.A = in.A
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalInternalSame.
+func (in *ExternalInternalSame) DeepCopy() *ExternalInternalSame {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalInternalSame)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalInternalSame) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalOptionalExtensionType) DeepCopyInto(out *ExternalOptionalExtensionType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.Extension.DeepCopyInto(&out.Extension)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalOptionalExtensionType.
+func (in *ExternalOptionalExtensionType) DeepCopy() *ExternalOptionalExtensionType {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalOptionalExtensionType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalOptionalExtensionType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalSimple) DeepCopyInto(out *ExternalSimple) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalSimple.
+func (in *ExternalSimple) DeepCopy() *ExternalSimple {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalSimple)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalSimple) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalTestType1) DeepCopyInto(out *ExternalTestType1) {
+	*out = *in
+	out.MyWeirdCustomEmbeddedVersionKindField = in.MyWeirdCustomEmbeddedVersionKindField
+	if in.M != nil {
+		in, out := &in.M, &out.M
+		*out = make(map[string]int, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.N != nil {
+		in, out := &in.N, &out.N
+		*out = make(map[string]ExternalTestType2, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.O != nil {
+		in, out := &in.O, &out.O
+		*out = new(ExternalTestType2)
+		**out = **in
+	}
+	if in.P != nil {
+		in, out := &in.P, &out.P
+		*out = make([]ExternalTestType2, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalTestType1.
+func (in *ExternalTestType1) DeepCopy() *ExternalTestType1 {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalTestType1)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalTestType1) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalTestType2) DeepCopyInto(out *ExternalTestType2) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalTestType2.
+func (in *ExternalTestType2) DeepCopy() *ExternalTestType2 {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalTestType2)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalTestType2) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InternalComplex) DeepCopyInto(out *InternalComplex) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InternalComplex.
+func (in *InternalComplex) DeepCopy() *InternalComplex {
+	if in == nil {
+		return nil
+	}
+	out := new(InternalComplex)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *InternalComplex) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InternalExtensionType) DeepCopyInto(out *InternalExtensionType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Extension != nil {
+		out.Extension = in.Extension.DeepCopyObject()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InternalExtensionType.
+func (in *InternalExtensionType) DeepCopy() *InternalExtensionType {
+	if in == nil {
+		return nil
+	}
+	out := new(InternalExtensionType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *InternalExtensionType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InternalOptionalExtensionType) DeepCopyInto(out *InternalOptionalExtensionType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Extension != nil {
+		out.Extension = in.Extension.DeepCopyObject()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InternalOptionalExtensionType.
+func (in *InternalOptionalExtensionType) DeepCopy() *InternalOptionalExtensionType {
+	if in == nil {
+		return nil
+	}
+	out := new(InternalOptionalExtensionType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *InternalOptionalExtensionType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InternalSimple) DeepCopyInto(out *InternalSimple) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InternalSimple.
+func (in *InternalSimple) DeepCopy() *InternalSimple {
+	if in == nil {
+		return nil
+	}
+	out := new(InternalSimple)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *InternalSimple) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ObjectTest) DeepCopyInto(out *ObjectTest) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.Object, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				(*out)[i] = (*in)[i].DeepCopyObject()
+			}
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ObjectTest.
+func (in *ObjectTest) DeepCopy() *ObjectTest {
+	if in == nil {
+		return nil
+	}
+	out := new(ObjectTest)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ObjectTest) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ObjectTestExternal) DeepCopyInto(out *ObjectTestExternal) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.RawExtension, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ObjectTestExternal.
+func (in *ObjectTestExternal) DeepCopy() *ObjectTestExternal {
+	if in == nil {
+		return nil
+	}
+	out := new(ObjectTestExternal)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ObjectTestExternal) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType1) DeepCopyInto(out *TestType1) {
+	*out = *in
+	out.MyWeirdCustomEmbeddedVersionKindField = in.MyWeirdCustomEmbeddedVersionKindField
+	if in.M != nil {
+		in, out := &in.M, &out.M
+		*out = make(map[string]int, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.N != nil {
+		in, out := &in.N, &out.N
+		*out = make(map[string]TestType2, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.O != nil {
+		in, out := &in.O, &out.O
+		*out = new(TestType2)
+		**out = **in
+	}
+	if in.P != nil {
+		in, out := &in.P, &out.P
+		*out = make([]TestType2, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType1.
+func (in *TestType1) DeepCopy() *TestType1 {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType1)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType1) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType2) DeepCopyInto(out *TestType2) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType2.
+func (in *TestType2) DeepCopy() *TestType2 {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType2)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType2) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UnknownType) DeepCopyInto(out *UnknownType) {
+	*out = *in
+	out.MyWeirdCustomEmbeddedVersionKindField = in.MyWeirdCustomEmbeddedVersionKindField
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UnknownType.
+func (in *UnknownType) DeepCopy() *UnknownType {
+	if in == nil {
+		return nil
+	}
+	out := new(UnknownType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *UnknownType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UnversionedType) DeepCopyInto(out *UnversionedType) {
+	*out = *in
+	out.MyWeirdCustomEmbeddedVersionKindField = in.MyWeirdCustomEmbeddedVersionKindField
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UnversionedType.
+func (in *UnversionedType) DeepCopy() *UnversionedType {
+	if in == nil {
+		return nil
+	}
+	out := new(UnversionedType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *UnversionedType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/types.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/types.go
new file mode 100644
index 0000000000..6cded88997
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/types.go
@@ -0,0 +1,135 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+// Note that the types provided in this file are not versioned and are intended to be
+// safe to use from within all versions of every API object.
+
+// TypeMeta is shared by all top level objects. The proper way to use it is to inline it in your type,
+// like this:
+//
+//	type MyAwesomeAPIObject struct {
+//	     runtime.TypeMeta    `json:""`
+//	     ... // other fields
+//	}
+//
+// func (obj *MyAwesomeAPIObject) SetGroupVersionKind(gvk *metav1.GroupVersionKind) { metav1.UpdateTypeMeta(obj,gvk) }; GroupVersionKind() *GroupVersionKind
+//
+// TypeMeta is provided here for convenience. You may use it directly from this package or define
+// your own with the same fields.
+//
+// +k8s:deepcopy-gen=false
+// +protobuf=true
+// +k8s:openapi-gen=true
+type TypeMeta struct {
+	// +optional
+	APIVersion string `json:"apiVersion,omitempty" yaml:"apiVersion,omitempty" protobuf:"bytes,1,opt,name=apiVersion"`
+	// +optional
+	Kind string `json:"kind,omitempty" yaml:"kind,omitempty" protobuf:"bytes,2,opt,name=kind"`
+}
+
+const (
+	ContentTypeJSON         string = "application/json"
+	ContentTypeYAML         string = "application/yaml"
+	ContentTypeProtobuf     string = "application/vnd.kubernetes.protobuf"
+	ContentTypeCBOR         string = "application/cbor"     // RFC 8949
+	ContentTypeCBORSequence string = "application/cbor-seq" // RFC 8742
+)
+
+// RawExtension is used to hold extensions in external versions.
+//
+// To use this, make a field which has RawExtension as its type in your external, versioned
+// struct, and Object in your internal struct. You also need to register your
+// various plugin types.
+//
+// // Internal package:
+//
+//	type MyAPIObject struct {
+//		runtime.TypeMeta `json:""`
+//		MyPlugin runtime.Object `json:"myPlugin"`
+//	}
+//
+//	type PluginA struct {
+//		AOption string `json:"aOption"`
+//	}
+//
+// // External package:
+//
+//	type MyAPIObject struct {
+//		runtime.TypeMeta `json:""`
+//		MyPlugin runtime.RawExtension `json:"myPlugin"`
+//	}
+//
+//	type PluginA struct {
+//		AOption string `json:"aOption"`
+//	}
+//
+// // On the wire, the JSON will look something like this:
+//
+//	{
+//		"kind":"MyAPIObject",
+//		"apiVersion":"v1",
+//		"myPlugin": {
+//			"kind":"PluginA",
+//			"aOption":"foo",
+//		},
+//	}
+//
+// So what happens? Decode first uses json or yaml to unmarshal the serialized data into
+// your external MyAPIObject. That causes the raw JSON to be stored, but not unpacked.
+// The next step is to copy (using pkg/conversion) into the internal struct. The runtime
+// package's DefaultScheme has conversion functions installed which will unpack the
+// JSON stored in RawExtension, turning it into the correct object type, and storing it
+// in the Object. (TODO: In the case where the object is of an unknown type, a
+// runtime.Unknown object will be created and stored.)
+//
+// +k8s:deepcopy-gen=true
+// +protobuf=true
+// +k8s:openapi-gen=true
+type RawExtension struct {
+	// Raw is the underlying serialization of this object.
+	//
+	// TODO: Determine how to detect ContentType and ContentEncoding of 'Raw' data.
+	Raw []byte `json:"-" protobuf:"bytes,1,opt,name=raw"`
+	// Object can hold a representation of this extension - useful for working with versioned
+	// structs.
+	Object Object `json:"-"`
+}
+
+// Unknown allows api objects with unknown types to be passed-through. This can be used
+// to deal with the API objects from a plug-in. Unknown objects still have functioning
+// TypeMeta features-- kind, version, etc.
+// TODO: Make this object have easy access to field based accessors and settors for
+// metadata and field mutatation.
+//
+// +k8s:deepcopy-gen=true
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +protobuf=true
+// +k8s:openapi-gen=true
+type Unknown struct {
+	TypeMeta `json:"" protobuf:"bytes,1,opt,name=typeMeta"`
+	// Raw will hold the complete serialized object which couldn't be matched
+	// with a registered type. Most likely, nothing should be done with this
+	// except for passing it through the system.
+	Raw []byte `json:"-" protobuf:"bytes,2,opt,name=raw"`
+	// ContentEncoding is encoding used to encode 'Raw' data.
+	// Unspecified means no encoding.
+	ContentEncoding string `protobuf:"bytes,3,opt,name=contentEncoding"`
+	// ContentType  is serialization method used to serialize 'Raw'.
+	// Unspecified means ContentTypeJSON.
+	ContentType string `protobuf:"bytes,4,opt,name=contentType"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/types_proto.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/types_proto.go
new file mode 100644
index 0000000000..70c4ea8c56
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/types_proto.go
@@ -0,0 +1,218 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"fmt"
+	"io"
+)
+
+// ProtobufReverseMarshaller can precompute size, and marshals to the start of the provided data buffer.
+type ProtobufMarshaller interface {
+	// Size returns the number of bytes a call to MarshalTo would consume.
+	Size() int
+	// MarshalTo marshals to the start of the data buffer, which must be at least as big as Size(),
+	// and returns the number of bytes written, which must be identical to the return value of Size().
+	MarshalTo(data []byte) (int, error)
+}
+
+// ProtobufReverseMarshaller can precompute size, and marshals to the end of the provided data buffer.
+type ProtobufReverseMarshaller interface {
+	// Size returns the number of bytes a call to MarshalToSizedBuffer would consume.
+	Size() int
+	// MarshalToSizedBuffer marshals to the end of the data buffer, which must be at least as big as Size(),
+	// and returns the number of bytes written, which must be identical to the return value of Size().
+	MarshalToSizedBuffer(data []byte) (int, error)
+}
+
+const (
+	typeMetaTag        = 0xa
+	rawTag             = 0x12
+	contentEncodingTag = 0x1a
+	contentTypeTag     = 0x22
+
+	// max length of a varint for a uint64
+	maxUint64VarIntLength = 10
+)
+
+// MarshalToWriter allows a caller to provide a streaming writer for raw bytes,
+// instead of populating them inside the Unknown struct.
+// rawSize is the number of bytes rawWriter will write in a success case.
+// writeRaw is called when it is time to write the raw bytes. It must return `rawSize, nil` or an error.
+func (m *Unknown) MarshalToWriter(w io.Writer, rawSize int, writeRaw func(io.Writer) (int, error)) (int, error) {
+	size := 0
+
+	// reuse the buffer for varint marshaling
+	varintBuffer := make([]byte, maxUint64VarIntLength)
+	writeVarint := func(i int) (int, error) {
+		offset := encodeVarintGenerated(varintBuffer, len(varintBuffer), uint64(i))
+		return w.Write(varintBuffer[offset:])
+	}
+
+	// TypeMeta
+	{
+		n, err := w.Write([]byte{typeMetaTag})
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		typeMetaBytes, err := m.TypeMeta.Marshal()
+		if err != nil {
+			return size, err
+		}
+
+		n, err = writeVarint(len(typeMetaBytes))
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		n, err = w.Write(typeMetaBytes)
+		size += n
+		if err != nil {
+			return size, err
+		}
+	}
+
+	// Raw, delegating write to writeRaw()
+	{
+		n, err := w.Write([]byte{rawTag})
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		n, err = writeVarint(rawSize)
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		n, err = writeRaw(w)
+		size += n
+		if err != nil {
+			return size, err
+		}
+		if n != int(rawSize) {
+			return size, fmt.Errorf("the size value was %d, but encoding wrote %d bytes to data", rawSize, n)
+		}
+	}
+
+	// ContentEncoding
+	{
+		n, err := w.Write([]byte{contentEncodingTag})
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		n, err = writeVarint(len(m.ContentEncoding))
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		n, err = w.Write([]byte(m.ContentEncoding))
+		size += n
+		if err != nil {
+			return size, err
+		}
+	}
+
+	// ContentEncoding
+	{
+		n, err := w.Write([]byte{contentTypeTag})
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		n, err = writeVarint(len(m.ContentType))
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		n, err = w.Write([]byte(m.ContentType))
+		size += n
+		if err != nil {
+			return size, err
+		}
+	}
+	return size, nil
+}
+
+// NestedMarshalTo allows a caller to avoid extra allocations during serialization of an Unknown
+// that will contain an object that implements ProtobufMarshaller or ProtobufReverseMarshaller.
+func (m *Unknown) NestedMarshalTo(data []byte, b ProtobufMarshaller, size uint64) (int, error) {
+	// Calculate the full size of the message.
+	msgSize := m.Size()
+	if b != nil {
+		msgSize += int(size) + sovGenerated(size) + 1
+	}
+
+	// Reverse marshal the fields of m.
+	i := msgSize
+	i -= len(m.ContentType)
+	copy(data[i:], m.ContentType)
+	i = encodeVarintGenerated(data, i, uint64(len(m.ContentType)))
+	i--
+	data[i] = contentTypeTag
+	i -= len(m.ContentEncoding)
+	copy(data[i:], m.ContentEncoding)
+	i = encodeVarintGenerated(data, i, uint64(len(m.ContentEncoding)))
+	i--
+	data[i] = contentEncodingTag
+	if b != nil {
+		if r, ok := b.(ProtobufReverseMarshaller); ok {
+			n1, err := r.MarshalToSizedBuffer(data[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= int(size)
+			if uint64(n1) != size {
+				// programmer error: the Size() method for protobuf does not match the results of LashramOt, which means the proto
+				// struct returned would be wrong.
+				return 0, fmt.Errorf("the Size() value of %T was %d, but NestedMarshalTo wrote %d bytes to data", b, size, n1)
+			}
+		} else {
+			i -= int(size)
+			n1, err := b.MarshalTo(data[i:])
+			if err != nil {
+				return 0, err
+			}
+			if uint64(n1) != size {
+				// programmer error: the Size() method for protobuf does not match the results of MarshalTo, which means the proto
+				// struct returned would be wrong.
+				return 0, fmt.Errorf("the Size() value of %T was %d, but NestedMarshalTo wrote %d bytes to data", b, size, n1)
+			}
+		}
+		i = encodeVarintGenerated(data, i, size)
+		i--
+		data[i] = rawTag
+	}
+	n2, err := m.TypeMeta.MarshalToSizedBuffer(data[:i])
+	if err != nil {
+		return 0, err
+	}
+	i -= n2
+	i = encodeVarintGenerated(data, i, uint64(n2))
+	i--
+	data[i] = typeMetaTag
+	return msgSize - i, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/types_proto_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/types_proto_test.go
new file mode 100644
index 0000000000..50535f0417
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/types_proto_test.go
@@ -0,0 +1,111 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"io"
+	"math"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestVarint(t *testing.T) {
+	varintBuffer := make([]byte, maxUint64VarIntLength)
+	offset := encodeVarintGenerated(varintBuffer, len(varintBuffer), math.MaxUint64)
+	used := len(varintBuffer) - offset
+	if used != maxUint64VarIntLength {
+		t.Fatalf("expected encodeVarintGenerated to use %d bytes to encode MaxUint64, got %d", maxUint64VarIntLength, used)
+	}
+}
+
+func TestNestedMarshalToWriter(t *testing.T) {
+	testcases := []struct {
+		name string
+		raw  []byte
+	}{
+		{
+			name: "zero-length",
+			raw:  []byte{},
+		},
+		{
+			name: "simple",
+			raw:  []byte{0x00, 0x01, 0x02, 0x03},
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			u := &Unknown{
+				ContentType:     "ct",
+				ContentEncoding: "ce",
+				TypeMeta: TypeMeta{
+					APIVersion: "v1",
+					Kind:       "k",
+				},
+			}
+
+			// Marshal normally with Raw inlined
+			u.Raw = tc.raw
+			marshalData, err := u.Marshal()
+			if err != nil {
+				t.Fatal(err)
+			}
+			u.Raw = nil
+
+			// Marshal with NestedMarshalTo
+			nestedMarshalData := make([]byte, len(marshalData))
+			n, err := u.NestedMarshalTo(nestedMarshalData, copyMarshaler(tc.raw), uint64(len(tc.raw)))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if n != len(marshalData) {
+				t.Errorf("NestedMarshalTo returned %d, expected %d", n, len(marshalData))
+			}
+			if e, a := marshalData, nestedMarshalData; !bytes.Equal(e, a) {
+				t.Errorf("NestedMarshalTo and Marshal differ:\n%s", cmp.Diff(e, a))
+			}
+
+			// Streaming marshal with MarshalToWriter
+			buf := bytes.NewBuffer(nil)
+			n, err = u.MarshalToWriter(buf, len(tc.raw), func(w io.Writer) (int, error) {
+				return w.Write(tc.raw)
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if n != len(marshalData) {
+				t.Errorf("MarshalToWriter returned %d, expected %d", n, len(marshalData))
+			}
+			if e, a := marshalData, buf.Bytes(); !bytes.Equal(e, a) {
+				t.Errorf("MarshalToWriter and Marshal differ:\n%s", cmp.Diff(e, a))
+			}
+		})
+	}
+}
+
+type copyMarshaler []byte
+
+func (c copyMarshaler) Size() int {
+	return len(c)
+}
+
+func (c copyMarshaler) MarshalTo(dest []byte) (int, error) {
+	n := copy(dest, []byte(c))
+	return n, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..069ea4f92d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/zz_generated.deepcopy.go
@@ -0,0 +1,76 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package runtime
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RawExtension) DeepCopyInto(out *RawExtension) {
+	*out = *in
+	if in.Raw != nil {
+		in, out := &in.Raw, &out.Raw
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.Object != nil {
+		out.Object = in.Object.DeepCopyObject()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RawExtension.
+func (in *RawExtension) DeepCopy() *RawExtension {
+	if in == nil {
+		return nil
+	}
+	out := new(RawExtension)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Unknown) DeepCopyInto(out *Unknown) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Raw != nil {
+		in, out := &in.Raw, &out.Raw
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Unknown.
+func (in *Unknown) DeepCopy() *Unknown {
+	if in == nil {
+		return nil
+	}
+	out := new(Unknown)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new Object.
+func (in *Unknown) DeepCopyObject() Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/zz_generated.model_name.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/zz_generated.model_name.go
new file mode 100644
index 0000000000..cf3ec4dceb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/runtime/zz_generated.model_name.go
@@ -0,0 +1,92 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package runtime
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Allocator) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.Allocator"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NegotiateError) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.NegotiateError"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NoopDecoder) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.NoopDecoder"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NoopEncoder) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.NoopEncoder"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Pair) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.Pair"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in RawExtension) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.RawExtension"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Scheme) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.Scheme"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SerializerInfo) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.SerializerInfo"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SimpleAllocator) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.SimpleAllocator"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in StreamSerializerInfo) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.StreamSerializerInfo"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TypeMeta) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.TypeMeta"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Unknown) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.Unknown"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WithVersionEncoder) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.WithVersionEncoder"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WithoutVersionDecoder) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.WithoutVersionDecoder"
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/selection/operator.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/selection/operator.go
new file mode 100644
index 0000000000..298f798c43
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/selection/operator.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package selection
+
+// Operator represents a key/field's relationship to value(s).
+// See labels.Requirement and fields.Requirement for more details.
+type Operator string
+
+const (
+	DoesNotExist Operator = "!"
+	Equals       Operator = "="
+	DoubleEquals Operator = "=="
+	In           Operator = "in"
+	NotEquals    Operator = "!="
+	NotIn        Operator = "notin"
+	Exists       Operator = "exists"
+	GreaterThan  Operator = "gt"
+	LessThan     Operator = "lt"
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/accessor.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/accessor.go
new file mode 100644
index 0000000000..fab98ffca4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/accessor.go
@@ -0,0 +1,50 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sharding
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// ResolveFieldValue extracts a metadata field value from a runtime.Object
+// based on the given field path.
+//
+// Field paths use CEL-style object-rooted syntax ("object.metadata.<field>"),
+// which differs from the fieldSelector format ("metadata.<field>"). The
+// "object." prefix anchors the path to the resource being filtered.
+//
+// Supported field paths:
+//   - "object.metadata.uid"
+//   - "object.metadata.namespace"
+func ResolveFieldValue(obj runtime.Object, fieldPath string) (string, error) {
+	accessor, err := meta.Accessor(obj)
+	if err != nil {
+		return "", fmt.Errorf("failed to access object metadata: %w", err)
+	}
+
+	switch fieldPath {
+	case "object.metadata.uid":
+		return string(accessor.GetUID()), nil
+	case "object.metadata.namespace":
+		return accessor.GetNamespace(), nil
+	default:
+		return "", fmt.Errorf("unsupported field path: %q", fieldPath)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/accessor_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/accessor_test.go
new file mode 100644
index 0000000000..bee6d39025
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/accessor_test.go
@@ -0,0 +1,64 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sharding
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func TestResolveFieldValue(t *testing.T) {
+	obj := &testObject{
+		ObjectMeta: metav1.ObjectMeta{
+			UID:       types.UID("test-uid-123"),
+			Name:      "test-name",
+			Namespace: "test-namespace",
+		},
+	}
+
+	tests := []struct {
+		fieldPath string
+		want      string
+		wantErr   bool
+	}{
+		{"object.metadata.uid", "test-uid-123", false},
+		{"object.metadata.namespace", "test-namespace", false},
+		{"object.metadata.name", "", true},
+		{"object.metadata.labels", "", true},
+		{"invalid.path", "", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.fieldPath, func(t *testing.T) {
+			got, err := ResolveFieldValue(obj, tt.fieldPath)
+			if tt.wantErr {
+				if err == nil {
+					t.Errorf("expected error for fieldPath %q", tt.fieldPath)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if got != tt.want {
+				t.Errorf("ResolveFieldValue(%q) = %q, want %q", tt.fieldPath, got, tt.want)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/hash.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/hash.go
new file mode 100644
index 0000000000..ae4dcfe2f6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/hash.go
@@ -0,0 +1,30 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sharding
+
+import (
+	"fmt"
+	"hash/fnv"
+)
+
+// HashField computes a hash of value and returns it
+// as a 16-character lowercase hex string (no "0x" prefix).
+func HashField(value string) string {
+	h := fnv.New64a()
+	h.Write([]byte(value))
+	return fmt.Sprintf("%016x", h.Sum64())
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/hash_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/hash_test.go
new file mode 100644
index 0000000000..750352eef1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/hash_test.go
@@ -0,0 +1,58 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sharding
+
+import (
+	"testing"
+)
+
+func TestHashField(t *testing.T) {
+	tests := []struct {
+		input string
+	}{
+		{""},
+		{"abc"},
+		{"test-uid-12345"},
+		{"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"},
+	}
+
+	for _, tt := range tests {
+		result := HashField(tt.input)
+		if len(result) != 16 {
+			t.Errorf("HashField(%q) returned %q (len %d), expected 16 hex chars", tt.input, result, len(result))
+		}
+		// Verify all chars are hex
+		for _, c := range result {
+			if (c < '0' || c > '9') && (c < 'a' || c > 'f') {
+				t.Errorf("HashField(%q) returned %q which contains non-hex char %q", tt.input, result, string(c))
+			}
+		}
+	}
+
+	// Determinism
+	h1 := HashField("test")
+	h2 := HashField("test")
+	if h1 != h2 {
+		t.Errorf("HashField is not deterministic: %q != %q", h1, h2)
+	}
+
+	// Different inputs produce different outputs
+	h3 := HashField("different")
+	if h1 == h3 {
+		t.Errorf("HashField produced same hash for different inputs: %q", h1)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/selector.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/selector.go
new file mode 100644
index 0000000000..841388a0d7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/selector.go
@@ -0,0 +1,137 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sharding
+
+import (
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// Selector represents a shard selector that can match objects based on
+// hash ranges of their metadata fields. It follows the labels.Selector
+// pattern from the Kubernetes API.
+type Selector interface {
+	// Matches returns true if the given object matches the shard selector.
+	Matches(obj runtime.Object) (bool, error)
+
+	// Empty returns true if the selector matches everything (no filtering).
+	Empty() bool
+
+	// String returns the wire-format string representation that can be
+	// round-tripped through Parse.
+	String() string
+
+	// Requirements returns the list of shard range requirements.
+	Requirements() []ShardRangeRequirement
+
+	// DeepCopySelector returns a deep copy of the selector.
+	DeepCopySelector() Selector
+}
+
+// Everything returns a selector that matches all objects.
+func Everything() Selector {
+	return &everythingSelector{}
+}
+
+type everythingSelector struct{}
+
+func (s *everythingSelector) Matches(_ runtime.Object) (bool, error) { return true, nil }
+func (s *everythingSelector) Empty() bool                            { return true }
+func (s *everythingSelector) String() string                         { return "" }
+func (s *everythingSelector) Requirements() []ShardRangeRequirement  { return nil }
+func (s *everythingSelector) DeepCopySelector() Selector             { return &everythingSelector{} }
+
+// shardSelector implements Selector with one or more shard range requirements.
+type shardSelector struct {
+	requirements []ShardRangeRequirement
+}
+
+func (s *shardSelector) Matches(obj runtime.Object) (bool, error) {
+	if len(s.requirements) == 0 {
+		return true, nil
+	}
+	// All requirements must share the same key so we resolve the field value
+	// and compute the hash once. The parser enforces this, but we verify here
+	// to guard against selectors constructed through other means.
+	key := s.requirements[0].Key
+	for _, req := range s.requirements[1:] {
+		if req.Key != key {
+			return false, fmt.Errorf("inconsistent shard keys: %q vs %q", key, req.Key)
+		}
+	}
+
+	value, err := ResolveFieldValue(obj, key)
+	if err != nil {
+		return false, err
+	}
+	hash := "0x" + HashField(value)
+
+	for _, req := range s.requirements {
+		if !HexLess(hash, req.Start) && HexLess(hash, req.End) {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// HexLess compares two 0x-prefixed lowercase hex strings numerically.
+// Both values must be normalized to 16 hex digits (e.g. "0x0000000000000000"),
+// except for the special upper bound "0x10000000000000000" (2^64) which has 17.
+func HexLess(a, b string) bool {
+	if len(a) != len(b) {
+		return len(a) < len(b)
+	}
+	return a < b
+}
+
+func (s *shardSelector) Empty() bool {
+	return len(s.requirements) == 0
+}
+
+func (s *shardSelector) String() string {
+	parts := make([]string, 0, len(s.requirements))
+	for _, req := range s.requirements {
+		parts = append(parts, fmt.Sprintf("shardRange(%s, '%s', '%s')", req.Key, req.Start, req.End))
+	}
+	return strings.Join(parts, " || ")
+}
+
+func (s *shardSelector) Requirements() []ShardRangeRequirement {
+	result := make([]ShardRangeRequirement, len(s.requirements))
+	copy(result, s.requirements)
+	return result
+}
+
+func (s *shardSelector) DeepCopySelector() Selector {
+	reqs := make([]ShardRangeRequirement, len(s.requirements))
+	copy(reqs, s.requirements)
+	return &shardSelector{requirements: reqs}
+}
+
+// NewSelector creates a Selector from the given requirements.
+// All requirements must use the same Key; this is validated at match time.
+// If no requirements are provided, returns Everything().
+func NewSelector(reqs ...ShardRangeRequirement) Selector {
+	if len(reqs) == 0 {
+		return Everything()
+	}
+	return &shardSelector{
+		requirements: reqs,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/selector_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/selector_test.go
new file mode 100644
index 0000000000..eb5ea63fe9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/selector_test.go
@@ -0,0 +1,141 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sharding
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// testObject is a minimal runtime.Object for testing.
+type testObject struct {
+	metav1.TypeMeta   `json:""`
+	metav1.ObjectMeta `json:"metadata"`
+}
+
+func (t *testObject) DeepCopyObject() runtime.Object {
+	return &testObject{
+		TypeMeta:   t.TypeMeta,
+		ObjectMeta: *t.ObjectMeta.DeepCopy(),
+	}
+}
+
+func TestSelectorMatches(t *testing.T) {
+	obj := &testObject{
+		ObjectMeta: metav1.ObjectMeta{
+			UID:       types.UID("test-uid-123"),
+			Name:      "test-name",
+			Namespace: "test-namespace",
+		},
+	}
+
+	hash := "0x" + HashField("test-uid-123")
+
+	tests := []struct {
+		name      string
+		selector  Selector
+		wantMatch bool
+	}{
+		{
+			name:      "everything matches",
+			selector:  Everything(),
+			wantMatch: true,
+		},
+		{
+			name:      "empty selector matches",
+			selector:  NewSelector(),
+			wantMatch: true,
+		},
+		{
+			name: "full range matches",
+			selector: NewSelector(ShardRangeRequirement{
+				Key:   "object.metadata.uid",
+				Start: "0x0000000000000000",
+				End:   "0x10000000000000000",
+			}),
+			wantMatch: true,
+		},
+		{
+			name: "hash in specific range",
+			selector: NewSelector(ShardRangeRequirement{
+				Key:   "object.metadata.uid",
+				Start: hash,
+				End:   hash + "f", // hash + "f" is always > hash
+			}),
+			wantMatch: true,
+		},
+		{
+			name: "hash below start",
+			selector: NewSelector(ShardRangeRequirement{
+				Key:   "object.metadata.uid",
+				Start: "0xffffffffffffffff",
+				End:   "0x10000000000000000",
+			}),
+			wantMatch: hash >= "0xffffffffffffffff",
+		},
+		{
+			name: "hash at or above end",
+			selector: NewSelector(ShardRangeRequirement{
+				Key:   "object.metadata.uid",
+				Start: "0x0000000000000000",
+				End:   "0x0000000000000001",
+			}),
+			wantMatch: hash < "0x0000000000000001",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			matched, err := tt.selector.Matches(obj)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if matched != tt.wantMatch {
+				t.Errorf("Matches() = %v, want %v (hash=%s)", matched, tt.wantMatch, hash)
+			}
+		})
+	}
+}
+
+func TestSelectorEmpty(t *testing.T) {
+	if !Everything().Empty() {
+		t.Error("Everything() should be empty")
+	}
+	if !NewSelector().Empty() {
+		t.Error("NewSelector() with no args should be empty")
+	}
+
+	sel := NewSelector(ShardRangeRequirement{Key: "object.metadata.uid", Start: "0x0000000000000000", End: "0x8000000000000000"})
+	if sel.Empty() {
+		t.Error("selector with requirement should not be empty")
+	}
+}
+
+func TestSelectorString(t *testing.T) {
+	sel := NewSelector(ShardRangeRequirement{
+		Key:   "object.metadata.uid",
+		Start: "0x00",
+		End:   "0x80",
+	})
+	expected := "shardRange(object.metadata.uid, '0x00', '0x80')"
+	if sel.String() != expected {
+		t.Errorf("String() = %q, want %q", sel.String(), expected)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/types.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/types.go
new file mode 100644
index 0000000000..4684fc497f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/sharding/types.go
@@ -0,0 +1,32 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sharding
+
+// ShardRangeRequirement represents a single shard range requirement.
+// It specifies a field path to hash and a hex range [Start, End) for filtering.
+// The hash space is FNV-1a 64-bit: [0x0000000000000000, 0x10000000000000000).
+// Both Start and End must be specified (no empty/unbounded values).
+type ShardRangeRequirement struct {
+	// Key is the field path, e.g. "object.metadata.uid"
+	Key string
+	// Start is the inclusive lower bound as a 0x-prefixed lowercase hex string.
+	// Minimum value is "0x0000000000000000".
+	Start string
+	// End is the exclusive upper bound as a 0x-prefixed lowercase hex string.
+	// Maximum value is "0x10000000000000000" (2^64).
+	End string
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/api_meta_help_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/api_meta_help_test.go
new file mode 100644
index 0000000000..e6be133111
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/api_meta_help_test.go
@@ -0,0 +1,335 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"sigs.k8s.io/randfill"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metafuzzer "k8s.io/apimachinery/pkg/apis/meta/fuzzer"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	v1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+)
+
+func TestIsList(t *testing.T) {
+	tests := []struct {
+		obj    runtime.Object
+		isList bool
+	}{
+		{&testapigroup.CarpList{}, true},
+		{&testapigroup.Carp{}, false},
+	}
+	for _, item := range tests {
+		if e, a := item.isList, meta.IsListType(item.obj); e != a {
+			t.Errorf("%v: Expected %v, got %v", reflect.TypeOf(item.obj), e, a)
+		}
+	}
+}
+
+func TestExtractList(t *testing.T) {
+	list1 := []runtime.Object{
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+	}
+	list2 := &ListV1{
+		Items: []runtime.RawExtension{
+			{Raw: []byte("foo")},
+			{Raw: []byte("bar")},
+			{Object: &v1.Carp{ObjectMeta: metav1.ObjectMeta{Name: "other"}}},
+		},
+	}
+	list3 := &fakePtrValueList{
+		Items: []*testapigroup.Carp{
+			{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+			{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+		},
+	}
+	list4 := &testapigroup.CarpList{
+		Items: []testapigroup.Carp{
+			{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+			{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+			{ObjectMeta: metav1.ObjectMeta{Name: "3"}},
+		},
+	}
+
+	testCases := []struct {
+		in    runtime.Object
+		out   []interface{}
+		equal bool
+	}{
+		{
+			in:  &List{},
+			out: []interface{}{},
+		},
+		{
+			in:  &ListV1{},
+			out: []interface{}{},
+		},
+		{
+			in:  &List{Items: list1},
+			out: []interface{}{list1[0], list1[1]},
+		},
+		{
+			in:    list2,
+			out:   []interface{}{&runtime.Unknown{Raw: list2.Items[0].Raw}, &runtime.Unknown{Raw: list2.Items[1].Raw}, list2.Items[2].Object},
+			equal: true,
+		},
+		{
+			in:  list3,
+			out: []interface{}{list3.Items[0], list3.Items[1]},
+		},
+		{
+			in:  list4,
+			out: []interface{}{&list4.Items[0], &list4.Items[1], &list4.Items[2]},
+		},
+	}
+	for i, test := range testCases {
+		list, err := meta.ExtractList(test.in)
+		if err != nil {
+			t.Fatalf("%d: extract: Unexpected error %v", i, err)
+		}
+		if e, a := len(test.out), len(list); e != a {
+			t.Fatalf("%d: extract: Expected %v, got %v", i, e, a)
+		}
+		for j, e := range test.out {
+			if e != list[j] {
+				if !test.equal {
+					t.Fatalf("%d: extract: Expected list[%d] to be %#v, but found %#v", i, j, e, list[j])
+				}
+				if !reflect.DeepEqual(e, list[j]) {
+					t.Fatalf("%d: extract: Expected list[%d] to be %#v, but found %#v", i, j, e, list[j])
+				}
+			}
+		}
+	}
+}
+
+func TestEachListItem(t *testing.T) {
+	list1 := []runtime.Object{
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+	}
+	list2 := &ListV1{
+		Items: []runtime.RawExtension{
+			{Raw: []byte("foo")},
+			{Raw: []byte("bar")},
+			{Object: &v1.Carp{ObjectMeta: metav1.ObjectMeta{Name: "other"}}},
+		},
+	}
+	list3 := &fakePtrValueList{
+		Items: []*testapigroup.Carp{
+			{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+			{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+		},
+	}
+	list4 := &testapigroup.CarpList{
+		Items: []testapigroup.Carp{
+			{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+			{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+			{ObjectMeta: metav1.ObjectMeta{Name: "3"}},
+		},
+	}
+
+	testCases := []struct {
+		in  runtime.Object
+		out []interface{}
+	}{
+		{
+			in:  &List{},
+			out: []interface{}{},
+		},
+		{
+			in:  &ListV1{},
+			out: []interface{}{},
+		},
+		{
+			in:  &List{Items: list1},
+			out: []interface{}{list1[0], list1[1]},
+		},
+		{
+			in:  list2,
+			out: []interface{}{nil, nil, list2.Items[2].Object},
+		},
+		{
+			in:  list3,
+			out: []interface{}{list3.Items[0], list3.Items[1]},
+		},
+		{
+			in:  list4,
+			out: []interface{}{&list4.Items[0], &list4.Items[1], &list4.Items[2]},
+		},
+	}
+	for i, test := range testCases {
+		list := []runtime.Object{}
+		err := meta.EachListItem(test.in, func(obj runtime.Object) error {
+			list = append(list, obj)
+			return nil
+		})
+		if err != nil {
+			t.Fatalf("%d: each: Unexpected error %v", i, err)
+		}
+		if e, a := len(test.out), len(list); e != a {
+			t.Fatalf("%d: each: Expected %v, got %v", i, e, a)
+		}
+		for j, e := range test.out {
+			if e != list[j] {
+				t.Fatalf("%d: each: Expected list[%d] to be %#v, but found %#v", i, j, e, list[j])
+			}
+		}
+	}
+}
+
+type fakePtrInterfaceList struct {
+	Items *[]runtime.Object
+}
+
+func (obj fakePtrInterfaceList) GetObjectKind() schema.ObjectKind {
+	return schema.EmptyObjectKind
+}
+func (obj fakePtrInterfaceList) DeepCopyObject() runtime.Object {
+	panic("fakePtrInterfaceList does not support DeepCopy")
+}
+
+func TestExtractListOfInterfacePtrs(t *testing.T) {
+	pl := &fakePtrInterfaceList{
+		Items: &[]runtime.Object{},
+	}
+	list, err := meta.ExtractList(pl)
+	if err != nil {
+		t.Fatalf("Unexpected error %v", err)
+	}
+	if len(list) > 0 {
+		t.Fatalf("Expected empty list, got %#v", list)
+	}
+}
+
+type fakePtrValueList struct {
+	Items []*testapigroup.Carp
+}
+
+func (obj fakePtrValueList) GetObjectKind() schema.ObjectKind {
+	return schema.EmptyObjectKind
+}
+func (obj *fakePtrValueList) DeepCopyObject() runtime.Object {
+	if obj == nil {
+		return nil
+	}
+	clone := fakePtrValueList{
+		Items: make([]*testapigroup.Carp, len(obj.Items)),
+	}
+	for i, carp := range obj.Items {
+		clone.Items[i] = carp.DeepCopy()
+	}
+	return &clone
+}
+
+func TestSetList(t *testing.T) {
+	pl := &testapigroup.CarpList{}
+	list := []runtime.Object{
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "3"}},
+	}
+	err := meta.SetList(pl, list)
+	if err != nil {
+		t.Fatalf("Unexpected error %v", err)
+	}
+	if e, a := len(list), len(pl.Items); e != a {
+		t.Fatalf("Expected %v, got %v", e, a)
+	}
+	for i := range list {
+		if e, a := list[i].(*testapigroup.Carp).Name, pl.Items[i].Name; e != a {
+			t.Fatalf("Expected %v, got %v", e, a)
+		}
+	}
+}
+
+func TestSetListToRuntimeObjectArray(t *testing.T) {
+	pl := &List{}
+	list := []runtime.Object{
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "3"}},
+	}
+	err := meta.SetList(pl, list)
+	if err != nil {
+		t.Fatalf("Unexpected error %v", err)
+	}
+	if e, a := len(list), len(pl.Items); e != a {
+		t.Fatalf("Expected %v, got %v", e, a)
+	}
+	for i := range list {
+		if e, a := list[i], pl.Items[i]; e != a {
+			t.Fatalf("%d: unmatched: %s", i, cmp.Diff(e, a))
+		}
+	}
+}
+
+func TestSetListToMatchingType(t *testing.T) {
+	pl := &unstructured.UnstructuredList{}
+	list := []runtime.Object{
+		&unstructured.Unstructured{Object: map[string]interface{}{"foo": 1}},
+		&unstructured.Unstructured{Object: map[string]interface{}{"foo": 2}},
+		&unstructured.Unstructured{Object: map[string]interface{}{"foo": 3}},
+	}
+	err := meta.SetList(pl, list)
+	if err != nil {
+		t.Fatalf("Unexpected error %v", err)
+	}
+	if e, a := len(list), len(pl.Items); e != a {
+		t.Fatalf("Expected %v, got %v", e, a)
+	}
+	for i := range list {
+		if e, a := list[i], &pl.Items[i]; !reflect.DeepEqual(e, a) {
+			t.Fatalf("%d: unmatched: %s", i, cmp.Diff(e, a))
+		}
+	}
+}
+
+func TestSetExtractListRoundTrip(t *testing.T) {
+	scheme := runtime.NewScheme()
+	codecs := serializer.NewCodecFactory(scheme)
+	fuzzer := randfill.New().NilChance(0).NumElements(1, 5).Funcs(metafuzzer.Funcs(codecs)...).MaxDepth(10)
+	for i := 0; i < 5; i++ {
+		start := &testapigroup.CarpList{}
+		fuzzer.Fill(&start.Items)
+
+		list, err := meta.ExtractList(start)
+		if err != nil {
+			t.Errorf("Unexpected error %v", err)
+			continue
+		}
+		got := &testapigroup.CarpList{}
+		err = meta.SetList(got, list)
+		if err != nil {
+			t.Errorf("Unexpected error %v", err)
+			continue
+		}
+		if e, a := start, got; !reflect.DeepEqual(e, a) {
+			t.Fatalf("Expected %#v, got %#v", e, a)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/api_meta_meta_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/api_meta_meta_test.go
new file mode 100644
index 0000000000..e46c7bc97e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/api_meta_meta_test.go
@@ -0,0 +1,390 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metafuzzer "k8s.io/apimachinery/pkg/apis/meta/fuzzer"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/randfill"
+)
+
+func TestAPIObjectMeta(t *testing.T) {
+	j := &testapigroup.Carp{
+		TypeMeta: metav1.TypeMeta{APIVersion: "/a", Kind: "b"},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:       "bar",
+			Name:            "foo",
+			GenerateName:    "prefix",
+			UID:             "uid",
+			ResourceVersion: "1",
+			SelfLink:        "some/place/only/we/know",
+			Labels:          map[string]string{"foo": "bar"},
+			Annotations:     map[string]string{"x": "y"},
+			Finalizers: []string{
+				"finalizer.1",
+				"finalizer.2",
+			},
+		},
+	}
+	var _ metav1.Object = &j.ObjectMeta
+	var _ metav1.ObjectMetaAccessor = j
+	accessor, err := meta.Accessor(j)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if accessor != metav1.Object(j) {
+		t.Fatalf("should have returned the same pointer: %#v\n\n%#v", accessor, j)
+	}
+	if e, a := "bar", accessor.GetNamespace(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "foo", accessor.GetName(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "prefix", accessor.GetGenerateName(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "uid", string(accessor.GetUID()); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "1", accessor.GetResourceVersion(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "some/place/only/we/know", accessor.GetSelfLink(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := []string{"finalizer.1", "finalizer.2"}, accessor.GetFinalizers(); !reflect.DeepEqual(e, a) {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+
+	typeAccessor, err := meta.TypeAccessor(j)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if e, a := "a", typeAccessor.GetAPIVersion(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "b", typeAccessor.GetKind(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+
+	accessor.SetNamespace("baz")
+	accessor.SetName("bar")
+	accessor.SetGenerateName("generate")
+	accessor.SetUID("other")
+	typeAccessor.SetAPIVersion("c")
+	typeAccessor.SetKind("d")
+	accessor.SetResourceVersion("2")
+	accessor.SetSelfLink("google.com")
+	accessor.SetFinalizers([]string{"finalizer.3"})
+
+	// Prove that accessor changes the original object.
+	if e, a := "baz", j.Namespace; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "bar", j.Name; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "generate", j.GenerateName; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := types.UID("other"), j.UID; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "c", j.APIVersion; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "d", j.Kind; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "2", j.ResourceVersion; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "google.com", j.SelfLink; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := []string{"finalizer.3"}, j.Finalizers; !reflect.DeepEqual(e, a) {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+
+	typeAccessor.SetAPIVersion("d")
+	typeAccessor.SetKind("e")
+	if e, a := "d", j.APIVersion; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "e", j.Kind; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+}
+
+func TestGenericTypeMeta(t *testing.T) {
+	type TypeMeta struct {
+		Kind              string                  `json:"kind,omitempty"`
+		Namespace         string                  `json:"namespace,omitempty"`
+		Name              string                  `json:"name,omitempty"`
+		GenerateName      string                  `json:"generateName,omitempty"`
+		UID               string                  `json:"uid,omitempty"`
+		CreationTimestamp metav1.Time             `json:"creationTimestamp,omitempty,omitzero"`
+		SelfLink          string                  `json:"selfLink,omitempty"`
+		ResourceVersion   string                  `json:"resourceVersion,omitempty"`
+		APIVersion        string                  `json:"apiVersion,omitempty"`
+		Labels            map[string]string       `json:"labels,omitempty"`
+		Annotations       map[string]string       `json:"annotations,omitempty"`
+		OwnerReferences   []metav1.OwnerReference `json:"ownerReferences,omitempty"`
+		Finalizers        []string                `json:"finalizers,omitempty"`
+	}
+
+	j := struct{ TypeMeta }{TypeMeta{APIVersion: "a", Kind: "b"}}
+
+	typeAccessor, err := meta.TypeAccessor(&j)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if e, a := "a", typeAccessor.GetAPIVersion(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "b", typeAccessor.GetKind(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+
+	typeAccessor.SetAPIVersion("c")
+	typeAccessor.SetKind("d")
+
+	if e, a := "c", j.APIVersion; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "d", j.Kind; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+
+	typeAccessor.SetAPIVersion("d")
+	typeAccessor.SetKind("e")
+
+	if e, a := "d", j.APIVersion; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "e", j.Kind; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+}
+
+type InternalTypeMeta struct {
+	Kind               string                  `json:"kind,omitempty"`
+	Namespace          string                  `json:"namespace,omitempty"`
+	Name               string                  `json:"name,omitempty"`
+	GenerateName       string                  `json:"generateName,omitempty"`
+	UID                string                  `json:"uid,omitempty"`
+	CreationTimestamp  metav1.Time             `json:"creationTimestamp,omitempty"`
+	SelfLink           string                  `json:"selfLink,omitempty"`
+	ResourceVersion    string                  `json:"resourceVersion,omitempty"`
+	Continue           string                  `json:"next,omitempty"`
+	RemainingItemCount *int64                  `json:"remainingItemCount,omitempty"`
+	APIVersion         string                  `json:"apiVersion,omitempty"`
+	Labels             map[string]string       `json:"labels,omitempty"`
+	Annotations        map[string]string       `json:"annotations,omitempty"`
+	Finalizers         []string                `json:"finalizers,omitempty"`
+	OwnerReferences    []metav1.OwnerReference `json:"ownerReferences,omitempty"`
+}
+
+func (m *InternalTypeMeta) GetResourceVersion() string     { return m.ResourceVersion }
+func (m *InternalTypeMeta) SetResourceVersion(rv string)   { m.ResourceVersion = rv }
+func (m *InternalTypeMeta) GetSelfLink() string            { return m.SelfLink }
+func (m *InternalTypeMeta) SetSelfLink(link string)        { m.SelfLink = link }
+func (m *InternalTypeMeta) GetContinue() string            { return m.Continue }
+func (m *InternalTypeMeta) SetContinue(c string)           { m.Continue = c }
+func (m *InternalTypeMeta) GetRemainingItemCount() *int64  { return m.RemainingItemCount }
+func (m *InternalTypeMeta) SetRemainingItemCount(c *int64) { m.RemainingItemCount = c }
+
+type MyAPIObject struct {
+	TypeMeta InternalTypeMeta `json:""`
+}
+
+func (obj *MyAPIObject) GetListMeta() metav1.ListInterface { return &obj.TypeMeta }
+
+func (obj *MyAPIObject) GetObjectKind() schema.ObjectKind { return obj }
+func (obj *MyAPIObject) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	obj.TypeMeta.APIVersion, obj.TypeMeta.Kind = gvk.ToAPIVersionAndKind()
+}
+func (obj *MyAPIObject) GroupVersionKind() schema.GroupVersionKind {
+	return schema.FromAPIVersionAndKind(obj.TypeMeta.APIVersion, obj.TypeMeta.Kind)
+}
+func (obj *MyAPIObject) DeepCopyObject() runtime.Object {
+	panic("MyAPIObject does not support DeepCopy")
+}
+
+type MyIncorrectlyMarkedAsAPIObject struct{}
+
+func (obj *MyIncorrectlyMarkedAsAPIObject) GetObjectKind() schema.ObjectKind {
+	return schema.EmptyObjectKind
+}
+func (obj *MyIncorrectlyMarkedAsAPIObject) DeepCopyObject() runtime.Object {
+	panic("MyIncorrectlyMarkedAsAPIObject does not support DeepCopy")
+}
+
+func TestResourceVersionerOfAPI(t *testing.T) {
+	type T struct {
+		runtime.Object
+		Expected string
+	}
+	testCases := map[string]T{
+		"empty api object":                   {&MyAPIObject{}, ""},
+		"api object with version":            {&MyAPIObject{TypeMeta: InternalTypeMeta{ResourceVersion: "1"}}, "1"},
+		"pointer to api object with version": {&MyAPIObject{TypeMeta: InternalTypeMeta{ResourceVersion: "1"}}, "1"},
+	}
+	versioning := meta.NewAccessor()
+	for key, testCase := range testCases {
+		actual, err := versioning.ResourceVersion(testCase.Object)
+		if err != nil {
+			t.Errorf("%s: unexpected error %#v", key, err)
+		}
+		if actual != testCase.Expected {
+			t.Errorf("%s: expected %v, got %v", key, testCase.Expected, actual)
+		}
+	}
+
+	failingCases := map[string]struct {
+		runtime.Object
+		Expected string
+	}{
+		"not a valid object to try": {&MyIncorrectlyMarkedAsAPIObject{}, "1"},
+	}
+	for key, testCase := range failingCases {
+		_, err := versioning.ResourceVersion(testCase.Object)
+		if err == nil {
+			t.Errorf("%s: expected error, got nil", key)
+		}
+	}
+
+	setCases := map[string]struct {
+		runtime.Object
+		Expected string
+	}{
+		"pointer to api object with version": {&MyAPIObject{TypeMeta: InternalTypeMeta{ResourceVersion: "1"}}, "1"},
+	}
+	for key, testCase := range setCases {
+		if err := versioning.SetResourceVersion(testCase.Object, "5"); err != nil {
+			t.Errorf("%s: unexpected error %#v", key, err)
+		}
+		actual, err := versioning.ResourceVersion(testCase.Object)
+		if err != nil {
+			t.Errorf("%s: unexpected error %#v", key, err)
+		}
+		if actual != "5" {
+			t.Errorf("%s: expected %v, got %v", key, "5", actual)
+		}
+	}
+}
+
+type MyAPIObject2 struct {
+	metav1.TypeMeta
+	metav1.ObjectMeta
+}
+
+func getObjectMetaAndOwnerReferences() (myAPIObject2 MyAPIObject2, metaOwnerReferences []metav1.OwnerReference) {
+	scheme := runtime.NewScheme()
+	codecs := serializer.NewCodecFactory(scheme)
+	randfill.New().NilChance(.5).NumElements(1, 5).Funcs(metafuzzer.Funcs(codecs)...).MaxDepth(10).Fill(&myAPIObject2)
+	references := myAPIObject2.ObjectMeta.OwnerReferences
+	// This is necessary for the test to pass because the getter will return a
+	// non-nil slice.
+	metaOwnerReferences = make([]metav1.OwnerReference, 0)
+	for i := 0; i < len(references); i++ {
+		metaOwnerReferences = append(metaOwnerReferences, metav1.OwnerReference{
+			Kind:               references[i].Kind,
+			Name:               references[i].Name,
+			UID:                references[i].UID,
+			APIVersion:         references[i].APIVersion,
+			Controller:         references[i].Controller,
+			BlockOwnerDeletion: references[i].BlockOwnerDeletion,
+		})
+	}
+	if len(references) == 0 {
+		// This is necessary for the test to pass because the setter will make a
+		// non-nil slice.
+		myAPIObject2.ObjectMeta.OwnerReferences = make([]metav1.OwnerReference, 0)
+	}
+	return myAPIObject2, metaOwnerReferences
+}
+
+func testGetOwnerReferences(t *testing.T) {
+	obj, expected := getObjectMetaAndOwnerReferences()
+	accessor, err := meta.Accessor(&obj)
+	if err != nil {
+		t.Error(err)
+	}
+	references := accessor.GetOwnerReferences()
+	if !reflect.DeepEqual(references, expected) {
+		t.Errorf("expect %#v\n got %#v", expected, references)
+	}
+}
+
+func testSetOwnerReferences(t *testing.T) {
+	expected, references := getObjectMetaAndOwnerReferences()
+	obj := MyAPIObject2{}
+	accessor, err := meta.Accessor(&obj)
+	if err != nil {
+		t.Error(err)
+	}
+	accessor.SetOwnerReferences(references)
+	if e, a := expected.ObjectMeta.OwnerReferences, obj.ObjectMeta.OwnerReferences; !reflect.DeepEqual(e, a) {
+		t.Errorf("expect %#v\n got %#v", e, a)
+	}
+}
+
+func TestAccessOwnerReferences(t *testing.T) {
+	fuzzIter := 5
+	for i := 0; i < fuzzIter; i++ {
+		testGetOwnerReferences(t)
+		testSetOwnerReferences(t)
+	}
+}
+
+// BenchmarkAccessorSetFastPath shows the interface fast path
+func BenchmarkAccessorSetFastPath(b *testing.B) {
+	obj := &testapigroup.Carp{
+		TypeMeta: metav1.TypeMeta{APIVersion: "/a", Kind: "b"},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:       "bar",
+			Name:            "foo",
+			GenerateName:    "prefix",
+			UID:             "uid",
+			ResourceVersion: "1",
+			SelfLink:        "some/place/only/we/know",
+			Labels:          map[string]string{"foo": "bar"},
+			Annotations:     map[string]string{"x": "y"},
+		},
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		acc, err := meta.Accessor(obj)
+		if err != nil {
+			b.Fatal(err)
+		}
+		acc.SetNamespace("something")
+	}
+	b.StopTimer()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/apis_meta_v1_unstructed_unstructure_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/apis_meta_v1_unstructed_unstructure_test.go
new file mode 100644
index 0000000000..6b487d3e40
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/apis_meta_v1_unstructed_unstructure_test.go
@@ -0,0 +1,560 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	apitesting "k8s.io/apimachinery/pkg/api/apitesting"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func TestDecodeUnstructured(t *testing.T) {
+	groupVersionString := "v1"
+	rawJson := fmt.Sprintf(`{"kind":"Pod","apiVersion":"%s","metadata":{"name":"test"}}`, groupVersionString)
+	pl := &List{
+		Items: []runtime.Object{
+			&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+			&runtime.Unknown{
+				TypeMeta:    runtime.TypeMeta{Kind: "Pod", APIVersion: groupVersionString},
+				Raw:         []byte(rawJson),
+				ContentType: runtime.ContentTypeJSON,
+			},
+			&runtime.Unknown{
+				TypeMeta:    runtime.TypeMeta{Kind: "", APIVersion: groupVersionString},
+				Raw:         []byte(rawJson),
+				ContentType: runtime.ContentTypeJSON,
+			},
+			&unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"kind":       "Foo",
+					"apiVersion": "Bar",
+					"test":       "value",
+				},
+			},
+		},
+	}
+	if errs := runtime.DecodeList(pl.Items, unstructured.UnstructuredJSONScheme); len(errs) == 1 {
+		t.Fatalf("unexpected error %v", errs)
+	}
+	if pod, ok := pl.Items[1].(*unstructured.Unstructured); !ok || pod.Object["kind"] != "Pod" || pod.Object["metadata"].(map[string]interface{})["name"] != "test" {
+		t.Errorf("object not converted: %#v", pl.Items[1])
+	}
+	if pod, ok := pl.Items[2].(*unstructured.Unstructured); !ok || pod.Object["kind"] != "Pod" || pod.Object["metadata"].(map[string]interface{})["name"] != "test" {
+		t.Errorf("object not converted: %#v", pl.Items[2])
+	}
+}
+
+func TestDecode(t *testing.T) {
+	tcs := []struct {
+		json []byte
+		want runtime.Object
+	}{
+		{
+			json: []byte(`{"apiVersion": "test", "kind": "test_kind"}`),
+			want: &unstructured.Unstructured{
+				Object: map[string]interface{}{"apiVersion": "test", "kind": "test_kind"},
+			},
+		},
+		{
+			json: []byte(`{"apiVersion": "test", "kind": "test_list", "items": []}`),
+			want: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"apiVersion": "test", "kind": "test_list"},
+				Items:  []unstructured.Unstructured{},
+			},
+		},
+		{
+			json: []byte(`{"items": [{"metadata": {"name": "object1", "deletionGracePeriodSeconds": 10}, "apiVersion": "test", "kind": "test_kind"}, {"metadata": {"name": "object2"}, "apiVersion": "test", "kind": "test_kind"}], "apiVersion": "test", "kind": "test_list"}`),
+			want: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"apiVersion": "test", "kind": "test_list"},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"metadata":   map[string]interface{}{"name": "object1", "deletionGracePeriodSeconds": int64(10)},
+							"apiVersion": "test",
+							"kind":       "test_kind",
+						},
+					},
+					{
+						Object: map[string]interface{}{
+							"metadata":   map[string]interface{}{"name": "object2"},
+							"apiVersion": "test",
+							"kind":       "test_kind",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	for _, tc := range tcs {
+		got, _, err := unstructured.UnstructuredJSONScheme.Decode(tc.json, nil, nil)
+		if err != nil {
+			t.Errorf("Unexpected error for %q: %v", string(tc.json), err)
+			continue
+		}
+
+		if !reflect.DeepEqual(got, tc.want) {
+			t.Errorf("Decode(%q) want: %v\ngot: %v", string(tc.json), tc.want, got)
+		}
+	}
+}
+
+func TestUnstructuredGetters(t *testing.T) {
+	trueVar := true
+	ten := int64(10)
+	unstruct := unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"kind":       "test_kind",
+			"apiVersion": "test_version",
+			"metadata": map[string]interface{}{
+				"name":                       "test_name",
+				"namespace":                  "test_namespace",
+				"generateName":               "test_generateName",
+				"uid":                        "test_uid",
+				"resourceVersion":            "test_resourceVersion",
+				"generation":                 ten,
+				"deletionGracePeriodSeconds": ten,
+				"selfLink":                   "test_selfLink",
+				"creationTimestamp":          "2009-11-10T23:00:00Z",
+				"deletionTimestamp":          "2010-11-10T23:00:00Z",
+				"labels": map[string]interface{}{
+					"test_label": "test_value",
+				},
+				"annotations": map[string]interface{}{
+					"test_annotation": "test_value",
+				},
+				"ownerReferences": []interface{}{
+					map[string]interface{}{
+						"kind":       "Pod",
+						"name":       "poda",
+						"apiVersion": "v1",
+						"uid":        "1",
+					},
+					map[string]interface{}{
+						"kind":       "Pod",
+						"name":       "podb",
+						"apiVersion": "v1",
+						"uid":        "2",
+						// though these fields are of type *bool, but when
+						// decoded from JSON, they are unmarshalled as bool.
+						"controller":         true,
+						"blockOwnerDeletion": true,
+					},
+				},
+				"finalizers": []interface{}{
+					"finalizer.1",
+					"finalizer.2",
+				},
+			},
+		},
+	}
+
+	if got, want := unstruct.GetAPIVersion(), "test_version"; got != want {
+		t.Errorf("GetAPIVersions() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetKind(), "test_kind"; got != want {
+		t.Errorf("GetKind() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetNamespace(), "test_namespace"; got != want {
+		t.Errorf("GetNamespace() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetName(), "test_name"; got != want {
+		t.Errorf("GetName() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetGenerateName(), "test_generateName"; got != want {
+		t.Errorf("GetGenerateName() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetUID(), types.UID("test_uid"); got != want {
+		t.Errorf("GetUID() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetResourceVersion(), "test_resourceVersion"; got != want {
+		t.Errorf("GetResourceVersion() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetSelfLink(), "test_selfLink"; got != want {
+		t.Errorf("GetSelfLink() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetCreationTimestamp(), metav1.Date(2009, time.November, 10, 23, 0, 0, 0, time.UTC); !got.Equal(&want) {
+		t.Errorf("GetCreationTimestamp() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetDeletionTimestamp(), metav1.Date(2010, time.November, 10, 23, 0, 0, 0, time.UTC); got == nil || !got.Equal(&want) {
+		t.Errorf("GetDeletionTimestamp() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetLabels(), map[string]string{"test_label": "test_value"}; !reflect.DeepEqual(got, want) {
+		t.Errorf("GetLabels() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetAnnotations(), map[string]string{"test_annotation": "test_value"}; !reflect.DeepEqual(got, want) {
+		t.Errorf("GetAnnotations() = %s, want %s", got, want)
+	}
+	refs := unstruct.GetOwnerReferences()
+	expectedOwnerReferences := []metav1.OwnerReference{
+		{
+			Kind:       "Pod",
+			Name:       "poda",
+			APIVersion: "v1",
+			UID:        "1",
+		},
+		{
+			Kind:               "Pod",
+			Name:               "podb",
+			APIVersion:         "v1",
+			UID:                "2",
+			Controller:         &trueVar,
+			BlockOwnerDeletion: &trueVar,
+		},
+	}
+	if got, want := refs, expectedOwnerReferences; !reflect.DeepEqual(got, want) {
+		t.Errorf("GetOwnerReferences()=%v, want %v", got, want)
+	}
+	if got, want := unstruct.GetFinalizers(), []string{"finalizer.1", "finalizer.2"}; !reflect.DeepEqual(got, want) {
+		t.Errorf("GetFinalizers()=%v, want %v", got, want)
+	}
+	if got, want := unstruct.GetDeletionGracePeriodSeconds(), &ten; !reflect.DeepEqual(got, want) {
+		t.Errorf("GetDeletionGracePeriodSeconds()=%v, want %v", got, want)
+	}
+	if got, want := unstruct.GetGeneration(), ten; !reflect.DeepEqual(got, want) {
+		t.Errorf("GetGeneration()=%v, want %v", got, want)
+	}
+}
+
+func TestUnstructuredSetters(t *testing.T) {
+	unstruct := unstructured.Unstructured{}
+	trueVar := true
+	ten := int64(10)
+
+	want := unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"kind":       "test_kind",
+			"apiVersion": "test_version",
+			"metadata": map[string]interface{}{
+				"name":                       "test_name",
+				"namespace":                  "test_namespace",
+				"generateName":               "test_generateName",
+				"uid":                        "test_uid",
+				"resourceVersion":            "test_resourceVersion",
+				"selfLink":                   "test_selfLink",
+				"creationTimestamp":          "2009-11-10T23:00:00Z",
+				"deletionTimestamp":          "2010-11-10T23:00:00Z",
+				"deletionGracePeriodSeconds": ten,
+				"generation":                 ten,
+				"labels": map[string]interface{}{
+					"test_label": "test_value",
+				},
+				"annotations": map[string]interface{}{
+					"test_annotation": "test_value",
+				},
+				"ownerReferences": []interface{}{
+					map[string]interface{}{
+						"kind":       "Pod",
+						"name":       "poda",
+						"apiVersion": "v1",
+						"uid":        "1",
+					},
+					map[string]interface{}{
+						"kind":               "Pod",
+						"name":               "podb",
+						"apiVersion":         "v1",
+						"uid":                "2",
+						"controller":         true,
+						"blockOwnerDeletion": true,
+					},
+				},
+				"finalizers": []interface{}{
+					"finalizer.1",
+					"finalizer.2",
+				},
+			},
+		},
+	}
+
+	unstruct.SetAPIVersion("test_version")
+	unstruct.SetKind("test_kind")
+	unstruct.SetNamespace("test_namespace")
+	unstruct.SetName("test_name")
+	unstruct.SetGenerateName("test_generateName")
+	unstruct.SetUID(types.UID("test_uid"))
+	unstruct.SetResourceVersion("test_resourceVersion")
+	unstruct.SetSelfLink("test_selfLink")
+	unstruct.SetCreationTimestamp(metav1.Date(2009, time.November, 10, 23, 0, 0, 0, time.UTC))
+	date := metav1.Date(2010, time.November, 10, 23, 0, 0, 0, time.UTC)
+	unstruct.SetDeletionTimestamp(&date)
+	unstruct.SetLabels(map[string]string{"test_label": "test_value"})
+	unstruct.SetAnnotations(map[string]string{"test_annotation": "test_value"})
+	newOwnerReferences := []metav1.OwnerReference{
+		{
+			Kind:       "Pod",
+			Name:       "poda",
+			APIVersion: "v1",
+			UID:        "1",
+		},
+		{
+			Kind:               "Pod",
+			Name:               "podb",
+			APIVersion:         "v1",
+			UID:                "2",
+			Controller:         &trueVar,
+			BlockOwnerDeletion: &trueVar,
+		},
+	}
+	unstruct.SetOwnerReferences(newOwnerReferences)
+	unstruct.SetFinalizers([]string{"finalizer.1", "finalizer.2"})
+	unstruct.SetDeletionGracePeriodSeconds(&ten)
+	unstruct.SetGeneration(ten)
+
+	if !reflect.DeepEqual(unstruct, want) {
+		t.Errorf("Wanted: \n%s\n Got:\n%s", want, unstruct)
+	}
+}
+
+func TestOwnerReferences(t *testing.T) {
+	t.Parallel()
+	trueVar := true
+	falseVar := false
+	refs := []metav1.OwnerReference{
+		{
+			APIVersion: "v2",
+			Kind:       "K2",
+			Name:       "n2",
+			UID:        types.UID("abc1"),
+		},
+		{
+			APIVersion:         "v1",
+			Kind:               "K1",
+			Name:               "n1",
+			UID:                types.UID("abc2"),
+			Controller:         &trueVar,
+			BlockOwnerDeletion: &falseVar,
+		},
+		{
+			APIVersion:         "v3",
+			Kind:               "K3",
+			Name:               "n3",
+			UID:                types.UID("abc3"),
+			Controller:         &falseVar,
+			BlockOwnerDeletion: &trueVar,
+		},
+	}
+	for i, ref := range refs {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			t.Parallel()
+			u1 := unstructured.Unstructured{
+				Object: make(map[string]interface{}),
+			}
+			refsX := []metav1.OwnerReference{ref}
+			u1.SetOwnerReferences(refsX)
+
+			have := u1.GetOwnerReferences()
+			if !reflect.DeepEqual(have, refsX) {
+				t.Errorf("Object references are not the same: %#v != %#v", have, refsX)
+			}
+		})
+	}
+}
+
+func TestUnstructuredListGetters(t *testing.T) {
+	unstruct := unstructured.UnstructuredList{
+		Object: map[string]interface{}{
+			"kind":       "test_kind",
+			"apiVersion": "test_version",
+			"metadata": map[string]interface{}{
+				"resourceVersion": "test_resourceVersion",
+				"selfLink":        "test_selfLink",
+			},
+		},
+	}
+
+	if got, want := unstruct.GetAPIVersion(), "test_version"; got != want {
+		t.Errorf("GetAPIVersions() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetKind(), "test_kind"; got != want {
+		t.Errorf("GetKind() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetResourceVersion(), "test_resourceVersion"; got != want {
+		t.Errorf("GetResourceVersion() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetSelfLink(), "test_selfLink"; got != want {
+		t.Errorf("GetSelfLink() = %s, want %s", got, want)
+	}
+}
+
+func TestUnstructuredListSetters(t *testing.T) {
+	unstruct := unstructured.UnstructuredList{}
+
+	want := unstructured.UnstructuredList{
+		Object: map[string]interface{}{
+			"kind":       "test_kind",
+			"apiVersion": "test_version",
+			"metadata": map[string]interface{}{
+				"resourceVersion": "test_resourceVersion",
+				"selfLink":        "test_selfLink",
+			},
+		},
+	}
+
+	unstruct.SetAPIVersion("test_version")
+	unstruct.SetKind("test_kind")
+	unstruct.SetResourceVersion("test_resourceVersion")
+	unstruct.SetSelfLink("test_selfLink")
+
+	if !reflect.DeepEqual(unstruct, want) {
+		t.Errorf("Wanted: \n%s\n Got:\n%s", unstruct, want)
+	}
+}
+
+func TestDecodeNumbers(t *testing.T) {
+
+	// Start with a valid pod
+	originalJSON := []byte(`{
+		"kind":"Carp",
+		"apiVersion":"v1",
+		"metadata":{"name":"pod","namespace":"foo"},
+		"spec":{
+			"containers":[{"name":"container","image":"container"}],
+			"activeDeadlineSeconds":1000030003
+		}
+	}`)
+
+	pod := &testapigroup.Carp{}
+
+	_, codecs := TestScheme()
+	codec := apitesting.TestCodec(codecs, schema.GroupVersion{Group: "", Version: runtime.APIVersionInternal})
+
+	err := runtime.DecodeInto(codec, originalJSON, pod)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Round-trip with unstructured codec
+	unstructuredObj, err := runtime.Decode(unstructured.UnstructuredJSONScheme, originalJSON)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	roundtripJSON, err := runtime.Encode(unstructured.UnstructuredJSONScheme, unstructuredObj)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Make sure we serialize back out in int form
+	if !strings.Contains(string(roundtripJSON), `"activeDeadlineSeconds":1000030003`) {
+		t.Errorf("Expected %s, got %s", `"activeDeadlineSeconds":1000030003`, string(roundtripJSON))
+	}
+
+	// Decode with structured codec again
+	obj2, err := runtime.Decode(codec, roundtripJSON)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	// ensure pod is still valid
+	pod2, ok := obj2.(*testapigroup.Carp)
+	if !ok {
+		t.Fatalf("expected an *api.Pod, got %#v", obj2)
+	}
+
+	// ensure round-trip preserved large integers
+	if !reflect.DeepEqual(pod, pod2) {
+		t.Fatalf("Expected\n\t%#v, got \n\t%#v", pod, pod2)
+	}
+}
+
+// TestAccessorMethods does opaque roundtrip testing against an Unstructured
+// instance's Object methods to ensure that what is "Set" matches what you
+// subsequently "Get" without any assertions against internal state.
+func TestAccessorMethods(t *testing.T) {
+	int64p := func(i int) *int64 {
+		v := int64(i)
+		return &v
+	}
+	tests := []struct {
+		accessor string
+		val      interface{}
+		nilVal   reflect.Value
+	}{
+		{accessor: "Namespace", val: "foo"},
+		{accessor: "Name", val: "bar"},
+		{accessor: "GenerateName", val: "baz"},
+		{accessor: "UID", val: types.UID("uid")},
+		{accessor: "ResourceVersion", val: "1"},
+		{accessor: "Generation", val: int64(5)},
+		{accessor: "SelfLink", val: "/foo"},
+		// TODO: Handle timestamps, which are being marshalled as UTC and
+		// unmarshalled as Local.
+		// https://github.com/kubernetes/kubernetes/issues/21402
+		// {accessor: "CreationTimestamp", val: someTime},
+		// {accessor: "DeletionTimestamp", val: someTimeP},
+		{accessor: "DeletionTimestamp", nilVal: reflect.ValueOf((*metav1.Time)(nil))},
+		{accessor: "DeletionGracePeriodSeconds", val: int64p(10)},
+		{accessor: "DeletionGracePeriodSeconds", val: int64p(0)},
+		{accessor: "DeletionGracePeriodSeconds", nilVal: reflect.ValueOf((*int64)(nil))},
+		{accessor: "Labels", val: map[string]string{"foo": "bar"}},
+		{accessor: "Annotations", val: map[string]string{"foo": "bar"}},
+		{accessor: "Finalizers", val: []string{"foo"}},
+		{accessor: "OwnerReferences", val: []metav1.OwnerReference{{Name: "foo"}}},
+	}
+	for i, test := range tests {
+		t.Logf("evaluating test %d (%s)", i, test.accessor)
+
+		u := &unstructured.Unstructured{}
+		setter := reflect.ValueOf(u).MethodByName("Set" + test.accessor)
+		getter := reflect.ValueOf(u).MethodByName("Get" + test.accessor)
+
+		args := []reflect.Value{}
+		if test.val != nil {
+			args = append(args, reflect.ValueOf(test.val))
+		} else {
+			args = append(args, test.nilVal)
+		}
+		setter.Call(args)
+
+		ret := getter.Call([]reflect.Value{})
+		actual := ret[0].Interface()
+
+		var expected interface{}
+		if test.val != nil {
+			expected = test.val
+		} else {
+			expected = test.nilVal.Interface()
+		}
+
+		if e, a := expected, actual; !reflect.DeepEqual(e, a) {
+			t.Fatalf("%s: expected %v (%T), got %v (%T)", test.accessor, e, e, a, a)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/coverage/coverage.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/coverage/coverage.go
new file mode 100644
index 0000000000..8482042a4a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/coverage/coverage.go
@@ -0,0 +1,156 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package coverage
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+	"sync"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Rule is one declared field-validation error: error type plus optional origin.
+type Rule struct {
+	ErrorType string
+	Origin    string
+}
+
+// FieldRules maps field path → declared rules for a single Kind.
+type FieldRules map[string][]Rule
+
+// ruleKey is the flat identity of one declared-or-observed rule across the
+// whole test process.
+type ruleKey struct {
+	gvk       schema.GroupVersionKind
+	path      string
+	errorType string
+	origin    string
+}
+
+// indexKeyRe normalizes runtime path subscripts ("[0]", "[my-key]") to "[*]"
+// so observed paths line up with the canonical paths from validation-gen.
+var indexKeyRe = regexp.MustCompile(`\[[^\]]+\]`)
+
+var (
+	rulesMu       sync.Mutex
+	declared      = sets.New[ruleKey]()
+	observed      = sets.New[ruleKey]()
+	nilPathString = (*field.Path)(nil).String()
+)
+
+// RegisterDeclaredRules records the rules declared for one GVK by
+// validation-gen.
+func RegisterDeclaredRules(gvk schema.GroupVersionKind, rules FieldRules) {
+	rulesMu.Lock()
+	defer rulesMu.Unlock()
+	for path, rs := range rules {
+		for _, r := range rs {
+			declared.Insert(ruleKey{gvk: gvk, path: path, errorType: r.ErrorType, origin: r.Origin})
+		}
+	}
+}
+
+// RecordObservedRules marks every error in errs as observed for the given GVK.
+// Idempotent per (GVK, path, errorType, origin). Callers compute the GVK from
+// whatever context they have (e.g., a runtime scheme + request info).
+func RecordObservedRules(gvk schema.GroupVersionKind, errs field.ErrorList) {
+	rulesMu.Lock()
+	defer rulesMu.Unlock()
+	// Runtime errors carry the actual subscript ("spec.items[3]",
+	// "metadata.labels[my-key]"); declared paths use "[*]". Replace every
+	// "[...]" with "[*]" so the lookup in AssertDeclarativeCoverage matches.
+	for _, e := range errs {
+		path := e.Field
+		if path == nilPathString {
+			path = ""
+		}
+		path = indexKeyRe.ReplaceAllString(path, "[*]")
+		observed.Insert(ruleKey{gvk: gvk, path: path, errorType: string(e.Type), origin: e.Origin})
+	}
+}
+
+// AssertDeclarativeCoverage returns nil if every rule registered via
+// RegisterDeclaredRules was observed at least once during this test process;
+// otherwise an error listing the uncovered rules.
+func AssertDeclarativeCoverage() error {
+	rulesMu.Lock()
+	uncovered := declared.Difference(observed).UnsortedList()
+	rulesMu.Unlock()
+	if len(uncovered) == 0 {
+		return nil
+	}
+	return fmt.Errorf("%d uncovered declarative-validation rules:\n%s", len(uncovered), formatUncovered(uncovered))
+}
+
+// formatUncovered renders uncovered rules grouped by GVK, one rule per line.
+// GVKs are sorted by group/version/kind; rules within a GVK by path/errorType/origin.
+//
+// Example:
+//
+//	example.com/v1, Kind=Widget:
+//	  spec.name  FieldValueRequired
+//	  spec.name  FieldValueInvalid origin="format=dns-label"
+func formatUncovered(uncovered []ruleKey) string {
+	gvksToRules := map[schema.GroupVersionKind][]ruleKey{}
+	for _, k := range uncovered {
+		gvksToRules[k.gvk] = append(gvksToRules[k.gvk], k)
+	}
+	gvks := make([]schema.GroupVersionKind, 0, len(gvksToRules))
+	for gvk := range gvksToRules {
+		gvks = append(gvks, gvk)
+	}
+	sort.Slice(gvks, func(i, j int) bool {
+		if gvks[i].Group != gvks[j].Group {
+			return gvks[i].Group < gvks[j].Group
+		}
+		if gvks[i].Version != gvks[j].Version {
+			return gvks[i].Version < gvks[j].Version
+		}
+		return gvks[i].Kind < gvks[j].Kind
+	})
+	var sb strings.Builder
+	for _, gvk := range gvks {
+		gv := gvk.Group + "/" + gvk.Version
+		if gvk.Group == "" {
+			gv = gvk.Version
+		}
+		fmt.Fprintf(&sb, "%s, Kind=%s:\n", gv, gvk.Kind)
+		keys := gvksToRules[gvk]
+		sort.Slice(keys, func(i, j int) bool {
+			if keys[i].path != keys[j].path {
+				return keys[i].path < keys[j].path
+			}
+			if keys[i].errorType != keys[j].errorType {
+				return keys[i].errorType < keys[j].errorType
+			}
+			return keys[i].origin < keys[j].origin
+		})
+		for _, k := range keys {
+			if k.origin != "" {
+				fmt.Fprintf(&sb, "  %s  %s origin=%q\n", k.path, k.errorType, k.origin)
+			} else {
+				fmt.Fprintf(&sb, "  %s  %s\n", k.path, k.errorType)
+			}
+		}
+	}
+	return sb.String()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/runtime_helper_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/runtime_helper_test.go
new file mode 100644
index 0000000000..31e6e7af5c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/runtime_helper_test.go
@@ -0,0 +1,49 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	"testing"
+
+	apitesting "k8s.io/apimachinery/pkg/api/apitesting"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func TestDecodeList(t *testing.T) {
+	pl := List{
+		Items: []runtime.Object{
+			&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+			&runtime.Unknown{
+				TypeMeta:    runtime.TypeMeta{Kind: "Carp", APIVersion: "v1"},
+				Raw:         []byte(`{"kind":"Carp","apiVersion":"` + "v1" + `","metadata":{"name":"test"}}`),
+				ContentType: runtime.ContentTypeJSON,
+			},
+		},
+	}
+
+	_, codecs := TestScheme()
+	Codec := apitesting.TestCodec(codecs, testapigroup.SchemeGroupVersion)
+
+	if errs := runtime.DecodeList(pl.Items, Codec); len(errs) != 0 {
+		t.Fatalf("unexpected error %v", errs)
+	}
+	if pod, ok := pl.Items[1].(*testapigroup.Carp); !ok || pod.Name != "test" {
+		t.Errorf("object not converted: %#v", pl.Items[1])
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/runtime_serializer_protobuf_protobuf_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/runtime_serializer_protobuf_protobuf_test.go
new file mode 100644
index 0000000000..75c26ca8cb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/runtime_serializer_protobuf_protobuf_test.go
@@ -0,0 +1,362 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	"bytes"
+	"encoding/hex"
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/protobuf"
+)
+
+type testObject struct {
+	gvk schema.GroupVersionKind
+}
+
+func (d *testObject) GetObjectKind() schema.ObjectKind                { return d }
+func (d *testObject) SetGroupVersionKind(gvk schema.GroupVersionKind) { d.gvk = gvk }
+func (d *testObject) GroupVersionKind() schema.GroupVersionKind       { return d.gvk }
+func (d *testObject) DeepCopyObject() runtime.Object {
+	panic("testObject does not support DeepCopy")
+}
+
+type testMarshalable struct {
+	testObject
+	data []byte
+	err  error
+}
+
+func (d *testMarshalable) Marshal() ([]byte, error) {
+	return d.data, d.err
+}
+
+func (d *testMarshalable) DeepCopyObject() runtime.Object {
+	panic("testMarshalable does not support DeepCopy")
+}
+
+type testBufferedMarshalable struct {
+	testObject
+	data []byte
+	err  error
+}
+
+func (d *testBufferedMarshalable) Marshal() ([]byte, error) {
+	return nil, fmt.Errorf("not invokable")
+}
+
+func (d *testBufferedMarshalable) MarshalTo(data []byte) (int, error) {
+	copy(data, d.data)
+	return len(d.data), d.err
+}
+
+func (d *testBufferedMarshalable) Size() int {
+	return len(d.data)
+}
+
+func (d *testBufferedMarshalable) DeepCopyObject() runtime.Object {
+	panic("testBufferedMarshalable does not support DeepCopy")
+}
+
+func TestRecognize(t *testing.T) {
+	s := protobuf.NewSerializer(nil, nil)
+	ignores := [][]byte{
+		nil,
+		{},
+		[]byte("k8s"),
+		{0x6b, 0x38, 0x73, 0x01},
+	}
+	for i, data := range ignores {
+		if ok, _, err := s.RecognizesData(data); err != nil || ok {
+			t.Errorf("%d: should not recognize data: %v", i, err)
+		}
+	}
+	recognizes := [][]byte{
+		{0x6b, 0x38, 0x73, 0x00},
+		{0x6b, 0x38, 0x73, 0x00, 0x01},
+	}
+	for i, data := range recognizes {
+		if ok, _, err := s.RecognizesData(data); err != nil || !ok {
+			t.Errorf("%d: should recognize data: %v", i, err)
+		}
+	}
+}
+
+func TestEncode(t *testing.T) {
+	obj1 := &testMarshalable{testObject: testObject{}, data: []byte{}}
+	wire1 := []byte{
+		0x6b, 0x38, 0x73, 0x00, // prefix
+		0x0a, 0x04,
+		0x0a, 0x00, // apiversion
+		0x12, 0x00, // kind
+		0x12, 0x00, // data
+		0x1a, 0x00, // content-type
+		0x22, 0x00, // content-encoding
+	}
+	obj2 := &testMarshalable{
+		testObject: testObject{gvk: schema.GroupVersionKind{Kind: "test", Group: "other", Version: "version"}},
+		data:       []byte{0x01, 0x02, 0x03},
+	}
+	wire2 := []byte{
+		0x6b, 0x38, 0x73, 0x00, // prefix
+		0x0a, 0x15,
+		0x0a, 0x0d, 0x6f, 0x74, 0x68, 0x65, 0x72, 0x2f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, // apiversion
+		0x12, 0x04, 0x74, 0x65, 0x73, 0x74, // kind
+		0x12, 0x03, 0x01, 0x02, 0x03, // data
+		0x1a, 0x00, // content-type
+		0x22, 0x00, // content-encoding
+	}
+
+	err1 := fmt.Errorf("a test error")
+
+	testCases := []struct {
+		obj   runtime.Object
+		data  []byte
+		errFn func(error) bool
+	}{
+		{
+			obj:   &testObject{},
+			errFn: protobuf.IsNotMarshalable,
+		},
+		{
+			obj:  obj1,
+			data: wire1,
+		},
+		{
+			obj:   &testMarshalable{testObject: obj1.testObject, err: err1},
+			errFn: func(err error) bool { return err == err1 },
+		},
+		{
+			// if this test fails, writing the "fast path" marshal is not the same as the "slow path"
+			obj:  &testBufferedMarshalable{testObject: obj1.testObject, data: obj1.data},
+			data: wire1,
+		},
+		{
+			obj:  obj2,
+			data: wire2,
+		},
+		{
+			// if this test fails, writing the "fast path" marshal is not the same as the "slow path"
+			obj:  &testBufferedMarshalable{testObject: obj2.testObject, data: obj2.data},
+			data: wire2,
+		},
+		{
+			obj:   &testBufferedMarshalable{testObject: obj1.testObject, err: err1},
+			errFn: func(err error) bool { return err == err1 },
+		},
+	}
+
+	for i, test := range testCases {
+		s := protobuf.NewSerializer(nil, nil)
+		data, err := runtime.Encode(s, test.obj)
+
+		switch {
+		case err == nil && test.errFn != nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil && test.errFn == nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil:
+			if !test.errFn(err) {
+				t.Errorf("%d: failed: %v", i, err)
+			}
+			if data != nil {
+				t.Errorf("%d: should not have returned nil data", i)
+			}
+			continue
+		}
+
+		if test.data != nil && !bytes.Equal(test.data, data) {
+			t.Errorf("%d: unexpected data:\n%s", i, hex.Dump(data))
+			continue
+		}
+
+		if ok, _, err := s.RecognizesData(data); !ok || err != nil {
+			t.Errorf("%d: did not recognize data generated by call: %v", i, err)
+		}
+	}
+}
+
+func TestProtobufDecode(t *testing.T) {
+	wire1 := []byte{
+		0x6b, 0x38, 0x73, 0x00, // prefix
+		0x0a, 0x04,
+		0x0a, 0x00, // apiversion
+		0x12, 0x00, // kind
+		0x12, 0x00, // data
+		0x1a, 0x00, // content-type
+		0x22, 0x00, // content-encoding
+	}
+	wire2 := []byte{
+		0x6b, 0x38, 0x73, 0x00, // prefix
+		0x0a, 0x15,
+		0x0a, 0x0d, 0x6f, 0x74, 0x68, 0x65, 0x72, 0x2f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, // apiversion
+		0x12, 0x04, 0x74, 0x65, 0x73, 0x74, // kind
+		0x12, 0x07, 0x6b, 0x38, 0x73, 0x00, 0x01, 0x02, 0x03, // data
+		0x1a, 0x00, // content-type
+		0x22, 0x00, // content-encoding
+	}
+
+	testCases := []struct {
+		obj   runtime.Object
+		data  []byte
+		errFn func(error) bool
+	}{
+		{
+			obj:   &runtime.Unknown{},
+			errFn: func(err error) bool { return err.Error() == "empty data" },
+		},
+		{
+			data:  []byte{0x6b},
+			errFn: func(err error) bool { return strings.Contains(err.Error(), "does not appear to be a protobuf message") },
+		},
+		{
+			obj: &runtime.Unknown{
+				Raw: []byte{},
+			},
+			data: wire1,
+		},
+		{
+			obj: &runtime.Unknown{
+				TypeMeta: runtime.TypeMeta{
+					APIVersion: "other/version",
+					Kind:       "test",
+				},
+				// content type is set because the prefix matches the content
+				ContentType: runtime.ContentTypeProtobuf,
+				Raw:         []byte{0x6b, 0x38, 0x73, 0x00, 0x01, 0x02, 0x03},
+			},
+			data: wire2,
+		},
+	}
+
+	for i, test := range testCases {
+		s := protobuf.NewSerializer(nil, nil)
+		unk := &runtime.Unknown{}
+		err := runtime.DecodeInto(s, test.data, unk)
+
+		switch {
+		case err == nil && test.errFn != nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil && test.errFn == nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil:
+			if !test.errFn(err) {
+				t.Errorf("%d: failed: %v", i, err)
+			}
+			continue
+		}
+
+		if !reflect.DeepEqual(unk, test.obj) {
+			t.Errorf("%d: unexpected object:\n%#v", i, unk)
+			continue
+		}
+	}
+}
+
+func TestDecodeObjects(t *testing.T) {
+	obj1 := &v1.Carp{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "cool",
+		},
+		Spec: v1.CarpSpec{
+			Hostname: "coolhost",
+		},
+	}
+	obj1wire, err := obj1.Marshal()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	wire1, err := (&runtime.Unknown{
+		TypeMeta: runtime.TypeMeta{Kind: "Carp", APIVersion: "v1"},
+		Raw:      obj1wire,
+	}).Marshal()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	unk2 := &runtime.Unknown{
+		TypeMeta: runtime.TypeMeta{Kind: "Carp", APIVersion: "v1"},
+	}
+	wire2 := make([]byte, len(wire1)*2)
+	n, err := unk2.NestedMarshalTo(wire2, obj1, uint64(obj1.Size()))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n != len(wire1) || !bytes.Equal(wire1, wire2[:n]) {
+		t.Fatalf("unexpected wire:\n%s", hex.Dump(wire2[:n]))
+	}
+
+	wire1 = append([]byte{0x6b, 0x38, 0x73, 0x00}, wire1...)
+
+	obj1WithKind := obj1.DeepCopyObject()
+	obj1WithKind.GetObjectKind().SetGroupVersionKind(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Carp"})
+	testCases := []struct {
+		obj   runtime.Object
+		data  []byte
+		errFn func(error) bool
+	}{
+		{
+			obj:  obj1WithKind,
+			data: wire1,
+		},
+	}
+	scheme := runtime.NewScheme()
+	for i, test := range testCases {
+		scheme.AddKnownTypes(schema.GroupVersion{Version: "v1"}, &v1.Carp{})
+		require.NoError(t, v1.AddToScheme(scheme))
+		s := protobuf.NewSerializer(scheme, scheme)
+		obj, err := runtime.Decode(s, test.data)
+
+		switch {
+		case err == nil && test.errFn != nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil && test.errFn == nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil:
+			if !test.errFn(err) {
+				t.Errorf("%d: failed: %v", i, err)
+			}
+			if obj != nil {
+				t.Errorf("%d: should not have returned an object", i)
+			}
+			continue
+		}
+
+		if !apiequality.Semantic.DeepEqual(obj, test.obj) {
+			t.Errorf("%d: unexpected object:\n%s", i, cmp.Diff(test.obj, obj))
+			continue
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/runtime_unversioned_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/runtime_unversioned_test.go
new file mode 100644
index 0000000000..fc8c176480
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/runtime_unversioned_test.go
@@ -0,0 +1,97 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+
+	// TODO: Ideally we should create the necessary package structure in e.g.,
+	// pkg/conversion/test/... instead of importing pkg/api here.
+	apitesting "k8s.io/apimachinery/pkg/api/apitesting"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestV1EncodeDecodeStatus(t *testing.T) {
+	status := &metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    200,
+		Reason:  metav1.StatusReasonUnknown,
+		Message: "",
+	}
+
+	_, codecs := TestScheme()
+	codec := apitesting.TestCodec(codecs, schema.GroupVersion{Group: "", Version: runtime.APIVersionInternal})
+
+	encoded, err := runtime.Encode(codec, status)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	typeMeta := metav1.TypeMeta{}
+	if err := json.Unmarshal(encoded, &typeMeta); err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if typeMeta.Kind != "Status" {
+		t.Errorf("Kind is not set to \"Status\". Got %v", string(encoded))
+	}
+	if typeMeta.APIVersion != "v1" {
+		t.Errorf("APIVersion is not set to \"v1\". Got %v", string(encoded))
+	}
+	decoded, err := runtime.Decode(codec, encoded)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if !reflect.DeepEqual(status, decoded) {
+		t.Errorf("expected: %v, got: %v", status, decoded)
+	}
+}
+
+func TestExperimentalEncodeDecodeStatus(t *testing.T) {
+	status := &metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    200,
+		Reason:  metav1.StatusReasonUnknown,
+		Message: "",
+	}
+	_, codecs := TestScheme()
+	expCodec := apitesting.TestCodec(codecs, schema.GroupVersion{Group: "", Version: runtime.APIVersionInternal})
+
+	encoded, err := runtime.Encode(expCodec, status)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	typeMeta := metav1.TypeMeta{}
+	if err := json.Unmarshal(encoded, &typeMeta); err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if typeMeta.Kind != "Status" {
+		t.Errorf("Kind is not set to \"Status\". Got %s", encoded)
+	}
+	if typeMeta.APIVersion != "v1" {
+		t.Errorf("APIVersion is not set to \"\". Got %s", encoded)
+	}
+	decoded, err := runtime.Decode(expCodec, encoded)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if !reflect.DeepEqual(status, decoded) {
+		t.Errorf("expected: %v, got: %v", status, decoded)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/util.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/util.go
new file mode 100644
index 0000000000..9b6dac094e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/util.go
@@ -0,0 +1,70 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	"k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	apiserializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// List and ListV1 should be kept in sync with k8s.io/kubernetes/pkg/api#List
+// and k8s.io/api/core/v1#List.
+//
+// +k8s:deepcopy-gen=true
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type List struct {
+	metav1.TypeMeta
+	metav1.ListMeta
+
+	Items []runtime.Object
+}
+
+// +k8s:deepcopy-gen=true
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ListV1 struct {
+	metav1.TypeMeta `json:""`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	Items []runtime.RawExtension `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func TestScheme() (*runtime.Scheme, apiserializer.CodecFactory) {
+	internalGV := schema.GroupVersion{Group: "", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "", Version: "v1"}
+	scheme := runtime.NewScheme()
+
+	scheme.AddKnownTypes(internalGV,
+		&testapigroup.Carp{},
+		&testapigroup.CarpList{},
+		&List{},
+	)
+	scheme.AddKnownTypes(externalGV,
+		&v1.Carp{},
+		&v1.CarpList{},
+		&List{},
+	)
+	utilruntime.Must(testapigroup.AddToScheme(scheme))
+	utilruntime.Must(v1.AddToScheme(scheme))
+
+	codecs := apiserializer.NewCodecFactory(scheme)
+	return scheme, codecs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..b86d609211
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/test/zz_generated.deepcopy.go
@@ -0,0 +1,94 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package test
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *List) DeepCopyInto(out *List) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.Object, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				(*out)[i] = (*in)[i].DeepCopyObject()
+			}
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new List.
+func (in *List) DeepCopy() *List {
+	if in == nil {
+		return nil
+	}
+	out := new(List)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *List) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListV1) DeepCopyInto(out *ListV1) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.RawExtension, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListV1.
+func (in *ListV1) DeepCopy() *ListV1 {
+	if in == nil {
+		return nil
+	}
+	out := new(ListV1)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ListV1) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/types/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/types/doc.go
new file mode 100644
index 0000000000..783cbcdc8d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/types/doc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package types implements various generic types used throughout kubernetes.
+package types
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/types/namespacedname.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/types/namespacedname.go
new file mode 100644
index 0000000000..db18ce1ce2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/types/namespacedname.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+// NamespacedName comprises a resource name, with a mandatory namespace,
+// rendered as "<namespace>/<name>".  Being a type captures intent and
+// helps make sure that UIDs, namespaced names and non-namespaced names
+// do not get conflated in code.  For most use cases, namespace and name
+// will already have been format validated at the API entry point, so we
+// don't do that here.  Where that's not the case (e.g. in testing),
+// consider using NamespacedNameOrDie() in testing.go in this package.
+
+type NamespacedName struct {
+	Namespace string
+	Name      string
+}
+
+const (
+	Separator = '/'
+)
+
+// String returns the general purpose string representation
+func (n NamespacedName) String() string {
+	return n.Namespace + string(Separator) + n.Name
+}
+
+// MarshalLog emits a struct containing required key/value pair
+func (n NamespacedName) MarshalLog() interface{} {
+	return struct {
+		Name      string `json:"name"`
+		Namespace string `json:"namespace,omitempty"`
+	}{
+		Name:      n.Name,
+		Namespace: n.Namespace,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/types/nodename.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/types/nodename.go
new file mode 100644
index 0000000000..cff9ca6717
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/types/nodename.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+// NodeName is a type that holds a api.Node's Name identifier.
+// Being a type captures intent and helps make sure that the node name
+// is not confused with similar concepts (the hostname, the cloud provider id,
+// the cloud provider name etc)
+//
+// To clarify the various types:
+//
+//   - Node.Name is the Name field of the Node in the API.  This should be stored in a NodeName.
+//     Unfortunately, because Name is part of ObjectMeta, we can't store it as a NodeName at the API level.
+//
+//   - Hostname is the hostname of the local machine (from uname -n).
+//     However, some components allow the user to pass in a --hostname-override flag,
+//     which will override this in most places. In the absence of anything more meaningful,
+//     kubelet will use Hostname as the Node.Name when it creates the Node.
+//
+// * The cloudproviders have the own names: GCE has InstanceName, AWS has InstanceId.
+//
+//	For GCE, InstanceName is the Name of an Instance object in the GCE API.  On GCE, Instance.Name becomes the
+//	Hostname, and thus it makes sense also to use it as the Node.Name.  But that is GCE specific, and it is up
+//	to the cloudprovider how to do this mapping.
+//
+//	For AWS, the InstanceID is not yet suitable for use as a Node.Name, so we actually use the
+//	PrivateDnsName for the Node.Name.  And this is _not_ always the same as the hostname: if
+//	we are using a custom DHCP domain it won't be.
+type NodeName string
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/types/patch.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/types/patch.go
new file mode 100644
index 0000000000..d338cf213d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/types/patch.go
@@ -0,0 +1,31 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+// Similarly to above, these are constants to support HTTP PATCH utilized by
+// both the client and server that didn't make sense for a whole package to be
+// dedicated to.
+type PatchType string
+
+const (
+	JSONPatchType           PatchType = "application/json-patch+json"
+	MergePatchType          PatchType = "application/merge-patch+json"
+	StrategicMergePatchType PatchType = "application/strategic-merge-patch+json"
+	ApplyPatchType          PatchType = ApplyYAMLPatchType
+	ApplyYAMLPatchType      PatchType = "application/apply-patch+yaml"
+	ApplyCBORPatchType      PatchType = "application/apply-patch+cbor"
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/types/uid.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/types/uid.go
new file mode 100644
index 0000000000..869339222e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/types/uid.go
@@ -0,0 +1,22 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+// UID is a type that holds unique ID values, including UUIDs.  Because we
+// don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+// intent and helps make sure that UIDs and names do not get conflated.
+type UID string
diff --git a/vendor/k8s.io/client-go/util/retry/OWNERS b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/OWNERS
similarity index 64%
rename from vendor/k8s.io/client-go/util/retry/OWNERS
rename to hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/OWNERS
index 75736b5aac..e610094242 100644
--- a/vendor/k8s.io/client-go/util/retry/OWNERS
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/OWNERS
@@ -1,4 +1,4 @@
 # See the OWNERS docs at https://go.k8s.io/owners
 
-reviewers:
-  - caesarxuchao
+approvers:
+  - apelisse
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/cache/expiring.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/cache/expiring.go
new file mode 100644
index 0000000000..1396274c7b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/cache/expiring.go
@@ -0,0 +1,202 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cache
+
+import (
+	"container/heap"
+	"sync"
+	"time"
+
+	"k8s.io/utils/clock"
+)
+
+// NewExpiring returns an initialized expiring cache.
+func NewExpiring() *Expiring {
+	return NewExpiringWithClock(clock.RealClock{})
+}
+
+// NewExpiringWithClock is like NewExpiring but allows passing in a custom
+// clock for testing.
+func NewExpiringWithClock(clock clock.Clock) *Expiring {
+	return &Expiring{
+		clock: clock,
+		cache: make(map[interface{}]entry),
+	}
+}
+
+// Expiring is a map whose entries expire after a per-entry timeout.
+type Expiring struct {
+	// AllowExpiredGet causes the expiration check to be skipped on Get.
+	// It should only be used when a key always corresponds to the exact same value.
+	// Thus when this field is true, expired keys are considered valid
+	// until the next call to Set (which causes the GC to run).
+	// It may not be changed concurrently with calls to Get.
+	AllowExpiredGet bool
+
+	clock clock.Clock
+
+	// mu protects the below fields
+	mu sync.RWMutex
+	// cache is the internal map that backs the cache.
+	cache map[interface{}]entry
+	// generation is used as a cheap resource version for cache entries. Cleanups
+	// are scheduled with a key and generation. When the cleanup runs, it first
+	// compares its generation with the current generation of the entry. It
+	// deletes the entry iff the generation matches. This prevents cleanups
+	// scheduled for earlier versions of an entry from deleting later versions of
+	// an entry when Set() is called multiple times with the same key.
+	//
+	// The integer value of the generation of an entry is meaningless.
+	generation uint64
+
+	heap expiringHeap
+}
+
+type entry struct {
+	val        interface{}
+	expiry     time.Time
+	generation uint64
+}
+
+// Get looks up an entry in the cache.
+func (c *Expiring) Get(key interface{}) (val interface{}, ok bool) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	e, ok := c.cache[key]
+	if !ok {
+		return nil, false
+	}
+	if !c.AllowExpiredGet && !c.clock.Now().Before(e.expiry) {
+		return nil, false
+	}
+	return e.val, true
+}
+
+// Set sets a key/value/expiry entry in the map, overwriting any previous entry
+// with the same key. The entry expires at the given expiry time, but its TTL
+// may be lengthened or shortened by additional calls to Set(). Garbage
+// collection of expired entries occurs during calls to Set(), however calls to
+// Get() will not return expired entries that have not yet been garbage
+// collected.
+func (c *Expiring) Set(key interface{}, val interface{}, ttl time.Duration) {
+	now := c.clock.Now()
+	expiry := now.Add(ttl)
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.generation++
+
+	c.cache[key] = entry{
+		val:        val,
+		expiry:     expiry,
+		generation: c.generation,
+	}
+
+	// Run GC inline before pushing the new entry.
+	c.gc(now)
+
+	heap.Push(&c.heap, &expiringHeapEntry{
+		key:        key,
+		expiry:     expiry,
+		generation: c.generation,
+	})
+}
+
+// Delete deletes an entry in the map.
+func (c *Expiring) Delete(key interface{}) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.del(key, 0)
+}
+
+// del deletes the entry for the given key. The generation argument is the
+// generation of the entry that should be deleted. If the generation has been
+// changed (e.g. if a set has occurred on an existing element but the old
+// cleanup still runs), this is a noop. If the generation argument is 0, the
+// entry's generation is ignored and the entry is deleted.
+//
+// del must be called under the write lock.
+func (c *Expiring) del(key interface{}, generation uint64) {
+	e, ok := c.cache[key]
+	if !ok {
+		return
+	}
+	if generation != 0 && generation != e.generation {
+		return
+	}
+	delete(c.cache, key)
+}
+
+// Len returns the number of items in the cache.
+func (c *Expiring) Len() int {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return len(c.cache)
+}
+
+func (c *Expiring) gc(now time.Time) {
+	for {
+		// Return from gc if the heap is empty or the next element is not yet
+		// expired.
+		//
+		// heap[0] is a peek at the next element in the heap, which is not obvious
+		// from looking at the (*expiringHeap).Pop() implementation below.
+		// heap.Pop() swaps the first entry with the last entry of the heap, then
+		// calls (*expiringHeap).Pop() which returns the last element.
+		if len(c.heap) == 0 || now.Before(c.heap[0].expiry) {
+			return
+		}
+		cleanup := heap.Pop(&c.heap).(*expiringHeapEntry)
+		c.del(cleanup.key, cleanup.generation)
+	}
+}
+
+type expiringHeapEntry struct {
+	key        interface{}
+	expiry     time.Time
+	generation uint64
+}
+
+// expiringHeap is a min-heap ordered by expiration time of its entries. The
+// expiring cache uses this as a priority queue to efficiently organize entries
+// which will be garbage collected once they expire.
+type expiringHeap []*expiringHeapEntry
+
+var _ heap.Interface = &expiringHeap{}
+
+func (cq expiringHeap) Len() int {
+	return len(cq)
+}
+
+func (cq expiringHeap) Less(i, j int) bool {
+	return cq[i].expiry.Before(cq[j].expiry)
+}
+
+func (cq expiringHeap) Swap(i, j int) {
+	cq[i], cq[j] = cq[j], cq[i]
+}
+
+func (cq *expiringHeap) Push(c interface{}) {
+	*cq = append(*cq, c.(*expiringHeapEntry))
+}
+
+func (cq *expiringHeap) Pop() interface{} {
+	c := (*cq)[cq.Len()-1]
+	*cq = (*cq)[:cq.Len()-1]
+	return c
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/cache/expiring_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/cache/expiring_test.go
new file mode 100644
index 0000000000..95e803308b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/cache/expiring_test.go
@@ -0,0 +1,321 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cache
+
+import (
+	"context"
+	"math/rand"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+
+	testingclock "k8s.io/utils/clock/testing"
+)
+
+func TestExpiringCache(t *testing.T) {
+	cache := NewExpiring()
+
+	if result, ok := cache.Get("foo"); ok || result != nil {
+		t.Errorf("Expected null, false, got %#v, %v", result, ok)
+	}
+
+	record1 := "bob"
+	record2 := "alice"
+
+	// when empty, record is stored
+	cache.Set("foo", record1, time.Hour)
+	if result, ok := cache.Get("foo"); !ok || result != record1 {
+		t.Errorf("Expected %#v, true, got %#v, %v", record1, result, ok)
+	}
+
+	// newer record overrides
+	cache.Set("foo", record2, time.Hour)
+	if result, ok := cache.Get("foo"); !ok || result != record2 {
+		t.Errorf("Expected %#v, true, got %#v, %v", record2, result, ok)
+	}
+
+	// delete the current value
+	cache.Delete("foo")
+	if result, ok := cache.Get("foo"); ok || result != nil {
+		t.Errorf("Expected null, false, got %#v, %v", result, ok)
+	}
+}
+
+func TestExpiration(t *testing.T) {
+	fc := &testingclock.FakeClock{}
+	c := NewExpiringWithClock(fc)
+
+	c.Set("a", "a", time.Second)
+
+	fc.Step(500 * time.Millisecond)
+	if _, ok := c.Get("a"); !ok {
+		t.Fatalf("we should have found a key")
+	}
+
+	fc.Step(time.Second)
+	if _, ok := c.Get("a"); ok {
+		t.Fatalf("we should not have found a key")
+	}
+
+	c.Set("a", "a", time.Second)
+
+	fc.Step(500 * time.Millisecond)
+	if _, ok := c.Get("a"); !ok {
+		t.Fatalf("we should have found a key")
+	}
+
+	// reset should restart the ttl
+	c.Set("a", "a", time.Second)
+
+	fc.Step(750 * time.Millisecond)
+	if _, ok := c.Get("a"); !ok {
+		t.Fatalf("we should have found a key")
+	}
+
+	// Simulate a race between a reset and cleanup. Assert that del doesn't
+	// remove the key.
+	c.Set("a", "a", time.Second)
+
+	e := c.cache["a"]
+	e.generation++
+	e.expiry = e.expiry.Add(1 * time.Second)
+	c.cache["a"] = e
+
+	fc.Step(1 * time.Second)
+	if _, ok := c.Get("a"); !ok {
+		t.Fatalf("we should have found a key")
+	}
+
+	// Check getting an expired key with and without AllowExpiredGet
+	c.Set("b", "b", time.Second)
+	fc.Step(2 * time.Second)
+	if _, ok := c.Get("b"); ok {
+		t.Fatalf("we should not have found b key")
+	}
+	if count := c.Len(); count != 2 { // b is still in the cache
+		t.Errorf("expected two items got: %d", count)
+	}
+	c.AllowExpiredGet = true
+	if _, ok := c.Get("b"); !ok {
+		t.Fatalf("we should have found b key")
+	}
+	if count := c.Len(); count != 2 { // b is still in the cache
+		t.Errorf("expected two items got: %d", count)
+	}
+	c.Set("c", "c", time.Second)      // set some unrelated key to run gc
+	if count := c.Len(); count != 2 { // only a and c in the cache now
+		t.Errorf("expected two items got: %d", count)
+	}
+	if _, ok := c.Get("b"); ok {
+		t.Fatalf("we should not have found b key")
+	}
+	if _, ok := c.Get("a"); !ok {
+		t.Fatalf("we should have found a key")
+	}
+	if _, ok := c.Get("c"); !ok {
+		t.Fatalf("we should have found c key")
+	}
+}
+
+func TestGarbageCollection(t *testing.T) {
+	fc := &testingclock.FakeClock{}
+
+	type entry struct {
+		key, val string
+		ttl      time.Duration
+	}
+
+	tests := []struct {
+		name string
+		now  time.Time
+		set  []entry
+		want map[string]string
+	}{
+		{
+			name: "two entries just set",
+			now:  fc.Now().Add(0 * time.Second),
+			set: []entry{
+				{"a", "aa", 1 * time.Second},
+				{"b", "bb", 2 * time.Second},
+			},
+			want: map[string]string{
+				"a": "aa",
+				"b": "bb",
+			},
+		},
+		{
+			name: "first entry expired now",
+			now:  fc.Now().Add(1 * time.Second),
+			set: []entry{
+				{"a", "aa", 1 * time.Second},
+				{"b", "bb", 2 * time.Second},
+			},
+			want: map[string]string{
+				"b": "bb",
+			},
+		},
+		{
+			name: "first entry expired half a second ago",
+			now:  fc.Now().Add(1500 * time.Millisecond),
+			set: []entry{
+				{"a", "aa", 1 * time.Second},
+				{"b", "bb", 2 * time.Second},
+			},
+			want: map[string]string{
+				"b": "bb",
+			},
+		},
+		{
+			name: "three entries weird order",
+			now:  fc.Now().Add(1 * time.Second),
+			set: []entry{
+				{"c", "cc", 3 * time.Second},
+				{"a", "aa", 1 * time.Second},
+				{"b", "bb", 2 * time.Second},
+			},
+			want: map[string]string{
+				"b": "bb",
+				"c": "cc",
+			},
+		},
+		{
+			name: "expire multiple entries in one cycle",
+			now:  fc.Now().Add(2500 * time.Millisecond),
+			set: []entry{
+				{"a", "aa", 1 * time.Second},
+				{"b", "bb", 2 * time.Second},
+				{"c", "cc", 3 * time.Second},
+			},
+			want: map[string]string{
+				"c": "cc",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			c := NewExpiringWithClock(fc)
+			for _, e := range test.set {
+				c.Set(e.key, e.val, e.ttl)
+			}
+
+			c.gc(test.now)
+
+			for k, want := range test.want {
+				got, ok := c.Get(k)
+				if !ok {
+					t.Errorf("expected cache to have entry for key=%q but found none", k)
+					continue
+				}
+				if got != want {
+					t.Errorf("unexpected value for key=%q: got=%q, want=%q", k, got, want)
+				}
+			}
+			if got, want := c.Len(), len(test.want); got != want {
+				t.Errorf("unexpected cache size: got=%d, want=%d", got, want)
+			}
+		})
+	}
+}
+
+func BenchmarkExpiringCacheContention(b *testing.B) {
+	b.Run("evict_probablility=100%", func(b *testing.B) {
+		benchmarkExpiringCacheContention(b, 1)
+	})
+	b.Run("evict_probablility=10%", func(b *testing.B) {
+		benchmarkExpiringCacheContention(b, 0.1)
+	})
+	b.Run("evict_probablility=1%", func(b *testing.B) {
+		benchmarkExpiringCacheContention(b, 0.01)
+	})
+}
+
+func benchmarkExpiringCacheContention(b *testing.B, prob float64) {
+	const numKeys = 1 << 16
+	cache := NewExpiring()
+
+	keys := []string{}
+	for i := 0; i < numKeys; i++ {
+		key := uuid.New().String()
+		keys = append(keys, key)
+	}
+
+	b.ResetTimer()
+
+	b.SetParallelism(256)
+	b.RunParallel(func(pb *testing.PB) {
+		rand := rand.New(rand.NewSource(rand.Int63()))
+		for pb.Next() {
+			i := rand.Int31()
+			key := keys[i%numKeys]
+			_, ok := cache.Get(key)
+			if ok {
+				// compare lower bits of sampled i to decide whether we should evict.
+				if rand.Float64() < prob {
+					cache.Delete(key)
+				}
+			} else {
+				cache.Set(key, struct{}{}, 50*time.Millisecond)
+			}
+		}
+	})
+}
+
+func TestStressExpiringCache(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	const numKeys = 1 << 16
+	cache := NewExpiring()
+
+	keys := []string{}
+	for i := 0; i < numKeys; i++ {
+		key := uuid.New().String()
+		keys = append(keys, key)
+	}
+
+	var wg sync.WaitGroup
+	for i := 0; i < 256; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			rand := rand.New(rand.NewSource(rand.Int63()))
+			for {
+				select {
+				case <-ctx.Done():
+					return
+				default:
+				}
+				key := keys[rand.Intn(numKeys)]
+				if _, ok := cache.Get(key); !ok {
+					cache.Set(key, struct{}{}, 50*time.Millisecond)
+				}
+			}
+		}()
+	}
+
+	wg.Wait()
+
+	// trigger a GC with a set and check the cache size.
+	time.Sleep(60 * time.Millisecond)
+	cache.Set("trigger", "gc", time.Second)
+	if cache.Len() != 1 {
+		t.Errorf("unexpected cache size: got=%d, want=1", cache.Len())
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/cache/lruexpirecache.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/cache/lruexpirecache.go
new file mode 100644
index 0000000000..ad486d580f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/cache/lruexpirecache.go
@@ -0,0 +1,173 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cache
+
+import (
+	"container/list"
+	"sync"
+	"time"
+)
+
+// Clock defines an interface for obtaining the current time
+type Clock interface {
+	Now() time.Time
+}
+
+// realClock implements the Clock interface by calling time.Now()
+type realClock struct{}
+
+func (realClock) Now() time.Time { return time.Now() }
+
+// LRUExpireCache is a cache that ensures the mostly recently accessed keys are returned with
+// a ttl beyond which keys are forcibly expired.
+type LRUExpireCache struct {
+	// clock is used to obtain the current time
+	clock Clock
+
+	lock sync.Mutex
+
+	maxSize      int
+	evictionList list.List
+	entries      map[interface{}]*list.Element
+}
+
+// NewLRUExpireCache creates an expiring cache with the given size
+func NewLRUExpireCache(maxSize int) *LRUExpireCache {
+	return NewLRUExpireCacheWithClock(maxSize, realClock{})
+}
+
+// NewLRUExpireCacheWithClock creates an expiring cache with the given size, using the specified clock to obtain the current time.
+func NewLRUExpireCacheWithClock(maxSize int, clock Clock) *LRUExpireCache {
+	if maxSize <= 0 {
+		panic("maxSize must be > 0")
+	}
+
+	return &LRUExpireCache{
+		clock:   clock,
+		maxSize: maxSize,
+		entries: map[interface{}]*list.Element{},
+	}
+}
+
+type cacheEntry struct {
+	key        interface{}
+	value      interface{}
+	expireTime time.Time
+}
+
+// Add adds the value to the cache at key with the specified maximum duration.
+func (c *LRUExpireCache) Add(key interface{}, value interface{}, ttl time.Duration) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	// Key already exists
+	oldElement, ok := c.entries[key]
+	if ok {
+		c.evictionList.MoveToFront(oldElement)
+		oldElement.Value.(*cacheEntry).value = value
+		oldElement.Value.(*cacheEntry).expireTime = c.clock.Now().Add(ttl)
+		return
+	}
+
+	// Make space if necessary
+	if c.evictionList.Len() >= c.maxSize {
+		toEvict := c.evictionList.Back()
+		c.evictionList.Remove(toEvict)
+		delete(c.entries, toEvict.Value.(*cacheEntry).key)
+	}
+
+	// Add new entry
+	entry := &cacheEntry{
+		key:        key,
+		value:      value,
+		expireTime: c.clock.Now().Add(ttl),
+	}
+	element := c.evictionList.PushFront(entry)
+	c.entries[key] = element
+}
+
+// Get returns the value at the specified key from the cache if it exists and is not
+// expired, or returns false.
+func (c *LRUExpireCache) Get(key interface{}) (interface{}, bool) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	element, ok := c.entries[key]
+	if !ok {
+		return nil, false
+	}
+
+	if c.clock.Now().After(element.Value.(*cacheEntry).expireTime) {
+		c.evictionList.Remove(element)
+		delete(c.entries, key)
+		return nil, false
+	}
+
+	c.evictionList.MoveToFront(element)
+
+	return element.Value.(*cacheEntry).value, true
+}
+
+// Remove removes the specified key from the cache if it exists
+func (c *LRUExpireCache) Remove(key interface{}) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	element, ok := c.entries[key]
+	if !ok {
+		return
+	}
+
+	c.evictionList.Remove(element)
+	delete(c.entries, key)
+}
+
+// RemoveAll removes all keys that match predicate.
+func (c *LRUExpireCache) RemoveAll(predicate func(key any) bool) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	for key, element := range c.entries {
+		if predicate(key) {
+			c.evictionList.Remove(element)
+			delete(c.entries, key)
+		}
+	}
+}
+
+// Keys returns all unexpired keys in the cache.
+//
+// Keep in mind that subsequent calls to Get() for any of the returned keys
+// might return "not found".
+//
+// Keys are returned ordered from least recently used to most recently used.
+func (c *LRUExpireCache) Keys() []interface{} {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	now := c.clock.Now()
+
+	val := make([]interface{}, 0, c.evictionList.Len())
+	for element := c.evictionList.Back(); element != nil; element = element.Prev() {
+		// Only return unexpired keys
+		if !now.After(element.Value.(*cacheEntry).expireTime) {
+			val = append(val, element.Value.(*cacheEntry).key)
+		}
+	}
+
+	return val
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/cache/lruexpirecache_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/cache/lruexpirecache_test.go
new file mode 100644
index 0000000000..d6bd7464f7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/cache/lruexpirecache_test.go
@@ -0,0 +1,162 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cache
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	testingclock "k8s.io/utils/clock/testing"
+)
+
+func expectEntry(t *testing.T, c *LRUExpireCache, key interface{}, value interface{}) {
+	t.Helper()
+	result, ok := c.Get(key)
+	if !ok || result != value {
+		t.Errorf("Expected cache[%v]: %v, got %v", key, value, result)
+	}
+}
+
+func expectNotEntry(t *testing.T, c *LRUExpireCache, key interface{}) {
+	t.Helper()
+	if result, ok := c.Get(key); ok {
+		t.Errorf("Expected cache[%v] to be empty, got %v", key, result)
+	}
+}
+
+// Note: Check keys before checking individual entries, because Get() changes
+// the eviction list.
+func assertKeys(t *testing.T, gotKeys, wantKeys []interface{}) {
+	t.Helper()
+	if diff := cmp.Diff(gotKeys, wantKeys); diff != "" {
+		t.Errorf("Wrong result for keys: diff (-got +want):\n%s", diff)
+	}
+}
+
+func TestSimpleGet(t *testing.T) {
+	c := NewLRUExpireCache(10)
+	c.Add("long-lived", "12345", 10*time.Hour)
+
+	assertKeys(t, c.Keys(), []interface{}{"long-lived"})
+
+	expectEntry(t, c, "long-lived", "12345")
+}
+
+func TestSimpleRemove(t *testing.T) {
+	c := NewLRUExpireCache(10)
+	c.Add("long-lived", "12345", 10*time.Hour)
+	c.Remove("long-lived")
+
+	assertKeys(t, c.Keys(), []interface{}{})
+
+	expectNotEntry(t, c, "long-lived")
+}
+
+func TestSimpleRemoveAll(t *testing.T) {
+	c := NewLRUExpireCache(10)
+	c.Add("long-lived", "12345", 10*time.Hour)
+	c.Add("other-long-lived", "12345", 10*time.Hour)
+	c.RemoveAll(func(k any) bool {
+		return k.(string) == "long-lived"
+	})
+
+	assertKeys(t, c.Keys(), []any{"other-long-lived"})
+
+	expectNotEntry(t, c, "long-lived")
+	expectEntry(t, c, "other-long-lived", "12345")
+}
+
+func TestExpiredGet(t *testing.T) {
+	fakeClock := testingclock.NewFakeClock(time.Now())
+	c := NewLRUExpireCacheWithClock(10, fakeClock)
+	c.Add("short-lived", "12345", 1*time.Millisecond)
+	// ensure the entry expired
+	fakeClock.Step(2 * time.Millisecond)
+
+	// Keys() should not return expired keys.
+	assertKeys(t, c.Keys(), []interface{}{})
+
+	expectNotEntry(t, c, "short-lived")
+}
+
+func TestLRUOverflow(t *testing.T) {
+	c := NewLRUExpireCache(4)
+	c.Add("elem1", "1", 10*time.Hour)
+	c.Add("elem2", "2", 10*time.Hour)
+	c.Add("elem3", "3", 10*time.Hour)
+	c.Add("elem4", "4", 10*time.Hour)
+	c.Add("elem5", "5", 10*time.Hour)
+
+	assertKeys(t, c.Keys(), []interface{}{"elem2", "elem3", "elem4", "elem5"})
+
+	expectNotEntry(t, c, "elem1")
+	expectEntry(t, c, "elem2", "2")
+	expectEntry(t, c, "elem3", "3")
+	expectEntry(t, c, "elem4", "4")
+	expectEntry(t, c, "elem5", "5")
+}
+
+func TestAddBringsToFront(t *testing.T) {
+	c := NewLRUExpireCache(4)
+	c.Add("elem1", "1", 10*time.Hour)
+	c.Add("elem2", "2", 10*time.Hour)
+	c.Add("elem3", "3", 10*time.Hour)
+	c.Add("elem4", "4", 10*time.Hour)
+
+	c.Add("elem1", "1-new", 10*time.Hour)
+
+	c.Add("elem5", "5", 10*time.Hour)
+
+	assertKeys(t, c.Keys(), []interface{}{"elem3", "elem4", "elem1", "elem5"})
+
+	expectNotEntry(t, c, "elem2")
+	expectEntry(t, c, "elem1", "1-new")
+	expectEntry(t, c, "elem3", "3")
+	expectEntry(t, c, "elem4", "4")
+	expectEntry(t, c, "elem5", "5")
+}
+
+func TestGetBringsToFront(t *testing.T) {
+	c := NewLRUExpireCache(4)
+	c.Add("elem1", "1", 10*time.Hour)
+	c.Add("elem2", "2", 10*time.Hour)
+	c.Add("elem3", "3", 10*time.Hour)
+	c.Add("elem4", "4", 10*time.Hour)
+
+	c.Get("elem1")
+
+	c.Add("elem5", "5", 10*time.Hour)
+
+	assertKeys(t, c.Keys(), []interface{}{"elem3", "elem4", "elem1", "elem5"})
+
+	expectNotEntry(t, c, "elem2")
+	expectEntry(t, c, "elem1", "1")
+	expectEntry(t, c, "elem3", "3")
+	expectEntry(t, c, "elem4", "4")
+	expectEntry(t, c, "elem5", "5")
+}
+
+func TestLRUKeys(t *testing.T) {
+	c := NewLRUExpireCache(4)
+	c.Add("elem1", "1", 10*time.Hour)
+	c.Add("elem2", "2", 10*time.Hour)
+	c.Add("elem3", "3", 10*time.Hour)
+	c.Add("elem4", "4", 10*time.Hour)
+
+	assertKeys(t, c.Keys(), []interface{}{"elem1", "elem2", "elem3", "elem4"})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/diff/complex_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/diff/complex_test.go
new file mode 100644
index 0000000000..18ac9336e2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/diff/complex_test.go
@@ -0,0 +1,353 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package diff
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+)
+
+// TestDiffWithRealGoCmp is a comprehensive test that compares our Diff with the actual go-cmp Diff
+// across a variety of data structures and types to ensure compatibility.
+func TestDiffWithRealGoCmp(t *testing.T) {
+	// Test with simple types
+	t.Run("SimpleTypes", func(t *testing.T) {
+		testCases := []struct {
+			name string
+			a    interface{}
+			b    interface{}
+		}{
+			{name: "Integers", a: 42, b: 43},
+			{name: "Strings", a: "hello", b: "world"},
+			{name: "Booleans", a: true, b: false},
+			{name: "Floats", a: 3.14, b: 2.71},
+		}
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				ourDiff := Diff(tc.a, tc.b)
+				goCmpDiff := cmp.Diff(tc.a, tc.b)
+
+				t.Logf("Our diff:\n%s\n\nGo-cmp diff:\n%s", ourDiff, goCmpDiff)
+
+				// Verify both diffs are non-empty
+				if ourDiff == "" || goCmpDiff == "" {
+					t.Errorf("Expected non-empty diffs, got ourDiff: %v, goCmpDiff: %v",
+						ourDiff == "", goCmpDiff == "")
+				}
+			})
+		}
+	})
+
+	// Test with a simple struct
+	t.Run("SimpleStruct", func(t *testing.T) {
+		type TestStruct struct {
+			Name string
+			Age  int
+			Tags []string
+			Map  map[string]int
+		}
+
+		a := TestStruct{
+			Name: "Alice",
+			Age:  30,
+			Tags: []string{"tag1", "tag2"},
+			Map:  map[string]int{"a": 1, "b": 2},
+		}
+
+		b := TestStruct{
+			Name: "Bob",
+			Age:  25,
+			Tags: []string{"tag1", "tag3"},
+			Map:  map[string]int{"a": 1, "c": 3},
+		}
+
+		ourDiff := Diff(a, b)
+		goCmpDiff := cmp.Diff(a, b)
+
+		t.Logf("Our diff:\n%s\n\nGo-cmp diff:\n%s", ourDiff, goCmpDiff)
+
+		// Check that our diff contains key differences
+		keyDifferences := []string{
+			"Name", "Alice", "Bob",
+			"Age", "30", "25",
+			"Tags", "tag2", "tag3",
+			"Map", "b", "c",
+		}
+
+		for _, key := range keyDifferences {
+			if !strings.Contains(ourDiff, key) {
+				t.Errorf("Our diff doesn't contain expected key difference: %q", key)
+			}
+		}
+	})
+
+	// Test with a complex nested struct
+	t.Run("ComplexNestedStruct", func(t *testing.T) {
+		type Address struct {
+			Street     string
+			City       string
+			State      string
+			PostalCode string
+			Country    string
+		}
+
+		type Contact struct {
+			Type  string
+			Value string
+		}
+
+		type Person struct {
+			ID        int
+			FirstName string
+			LastName  string
+			Age       int
+			Addresses map[string]Address
+			Contacts  []Contact
+			Metadata  map[string]interface{}
+			CreatedAt time.Time
+		}
+
+		now := time.Now()
+		later := now.Add(24 * time.Hour)
+
+		person1 := Person{
+			ID:        1,
+			FirstName: "John",
+			LastName:  "Doe",
+			Age:       30,
+			Addresses: map[string]Address{
+				"home": {
+					Street:     "123 Main St",
+					City:       "Anytown",
+					State:      "CA",
+					PostalCode: "12345",
+					Country:    "USA",
+				},
+				"work": {
+					Street:     "456 Market St",
+					City:       "Worktown",
+					State:      "CA",
+					PostalCode: "54321",
+					Country:    "USA",
+				},
+			},
+			Contacts: []Contact{
+				{Type: "email", Value: "john.doe@example.com"},
+				{Type: "phone", Value: "555-1234"},
+			},
+			Metadata: map[string]interface{}{
+				"created":    "2023-01-01",
+				"loginCount": 42,
+				"settings": map[string]bool{
+					"notifications": true,
+					"darkMode":      false,
+				},
+			},
+			CreatedAt: now,
+		}
+
+		person2 := Person{
+			ID:        1,
+			FirstName: "John",
+			LastName:  "Smith", // Different
+			Age:       31,      // Different
+			Addresses: map[string]Address{
+				"home": {
+					Street:     "123 Main St",
+					City:       "Anytown",
+					State:      "CA",
+					PostalCode: "12345",
+					Country:    "USA",
+				},
+				// "work" address is missing
+			},
+			Contacts: []Contact{
+				{Type: "email", Value: "john.smith@example.com"}, // Different
+				{Type: "phone", Value: "555-1234"},
+				{Type: "fax", Value: "555-5678"}, // Additional
+			},
+			Metadata: map[string]interface{}{
+				"created":    "2023-01-01",
+				"loginCount": 43, // Different
+				"settings": map[string]bool{
+					"notifications": false, // Different
+					"darkMode":      true,  // Different
+				},
+				"newField": "new value", // New field
+			},
+			CreatedAt: later, // Different
+		}
+
+		ourDiff := Diff(person1, person2)
+		goCmpDiff := cmp.Diff(person1, person2)
+
+		t.Logf("Our diff:\n%s\n\nGo-cmp diff:\n%s", ourDiff, goCmpDiff)
+
+		// Check that our diff contains key differences
+		keyDifferences := []string{
+			"LastName", "Smith",
+			"Age",
+			"Addresses", "work",
+			"Contacts", "john.smith@example.com", "fax",
+			"Metadata", "loginCount", "settings", "notifications", "darkMode", "newField",
+		}
+
+		for _, key := range keyDifferences {
+			if !strings.Contains(ourDiff, key) {
+				t.Errorf("Our diff doesn't contain expected key difference: %q", key)
+			}
+		}
+
+		// Check that both diffs are non-empty
+		if ourDiff == "" || goCmpDiff == "" {
+			t.Errorf("Expected non-empty diffs, got ourDiff: %v, goCmpDiff: %v",
+				ourDiff == "", goCmpDiff == "")
+		}
+	})
+
+	// Test with slices and maps
+	t.Run("SlicesAndMaps", func(t *testing.T) {
+		// Test with slices
+		a1 := []int{1, 2, 3, 4, 5}
+		b1 := []int{1, 2, 6, 4, 7}
+
+		ourDiff1 := Diff(a1, b1)
+		goCmpDiff1 := cmp.Diff(a1, b1)
+
+		t.Logf("Our diff (slices):\n%s\n\nGo-cmp diff (slices):\n%s", ourDiff1, goCmpDiff1)
+
+		// Check that our diff contains the differences
+		if !strings.Contains(ourDiff1, "3") || !strings.Contains(ourDiff1, "6") ||
+			!strings.Contains(ourDiff1, "5") || !strings.Contains(ourDiff1, "7") {
+			t.Errorf("Our diff doesn't contain all expected differences for slices")
+		}
+
+		// Test with maps
+		a2 := map[string]int{"a": 1, "b": 2, "c": 3}
+		b2 := map[string]int{"a": 1, "b": 5, "d": 4}
+
+		ourDiff2 := Diff(a2, b2)
+		goCmpDiff2 := cmp.Diff(a2, b2)
+
+		t.Logf("Our diff (maps):\n%s\n\nGo-cmp diff (maps):\n%s", ourDiff2, goCmpDiff2)
+
+		// Check that our diff contains the differences
+		if !strings.Contains(ourDiff2, "b") || !strings.Contains(ourDiff2, "5") ||
+			!strings.Contains(ourDiff2, "c") || !strings.Contains(ourDiff2, "d") {
+			t.Errorf("Our diff doesn't contain all expected differences for maps")
+		}
+	})
+
+	// Test with unexported fields
+	t.Run("UnexportedFields", func(t *testing.T) {
+		type WithUnexported struct {
+			Exported   int
+			unexported int
+		}
+
+		a := WithUnexported{Exported: 1, unexported: 2}
+		b := WithUnexported{Exported: 3, unexported: 4}
+
+		ourDiff := Diff(a, b)
+		// Use cmpopts.IgnoreUnexported to ignore unexported fields in go-cmp
+		goCmpDiff := cmp.Diff(a, b, cmpopts.IgnoreUnexported(WithUnexported{}))
+
+		t.Logf("Our diff (unexported):\n%s\n\nGo-cmp diff (unexported):\n%s", ourDiff, goCmpDiff)
+
+		// Check that our diff contains only the exported field difference
+		if !strings.Contains(ourDiff, "Exported") || !strings.Contains(ourDiff, "1") || !strings.Contains(ourDiff, "3") {
+			t.Errorf("Our diff doesn't contain the exported field difference")
+		}
+	})
+
+	// Test with embedded structs
+	t.Run("EmbeddedStructs", func(t *testing.T) {
+		type Embedded struct {
+			Value int
+		}
+
+		type Container struct {
+			Embedded
+			Extra string
+		}
+
+		a := Container{Embedded: Embedded{Value: 1}, Extra: "a"}
+		b := Container{Embedded: Embedded{Value: 2}, Extra: "b"}
+
+		ourDiff := Diff(a, b)
+		goCmpDiff := cmp.Diff(a, b)
+
+		t.Logf("Our diff (embedded):\n%s\n\nGo-cmp diff (embedded):\n%s", ourDiff, goCmpDiff)
+
+		// Check that our diff contains the container field difference
+		if !strings.Contains(ourDiff, "Extra") || !strings.Contains(ourDiff, "a") || !strings.Contains(ourDiff, "b") {
+			t.Errorf("Our diff doesn't contain the container field difference")
+		}
+	})
+
+	// Test with interface values of same type
+	t.Run("InterfaceValues", func(t *testing.T) {
+		type Container struct {
+			Value interface{}
+		}
+
+		// Test with same type in interface
+		c := Container{Value: 42}
+		d := Container{Value: 43}
+
+		ourDiff := Diff(c, d)
+		goCmpDiff := cmp.Diff(c, d)
+
+		t.Logf("Our diff (interface same type):\n%s\n\nGo-cmp diff (interface same type):\n%s", ourDiff, goCmpDiff)
+
+		// Check that our diff contains the value difference
+		if !strings.Contains(ourDiff, "42") || !strings.Contains(ourDiff, "43") {
+			t.Errorf("Our diff doesn't contain the value difference for interface values of same type")
+		}
+	})
+
+	// Test with objects that cannot be marshaled to JSON
+	t.Run("UnmarshalableObjects", func(t *testing.T) {
+		// Test with a circular reference, which cannot be marshaled to JSON
+		type Node struct {
+			Value int
+			Next  *Node
+		}
+
+		// Create a circular reference
+		nodeA := &Node{Value: 1}
+		nodeA.Next = nodeA // Points to itself
+
+		nodeB := &Node{Value: 2}
+		nodeB.Next = nodeB // Points to itself
+
+		// This should fall back to using dump.Pretty
+		circularDiff := Diff(nodeA, nodeB)
+
+		t.Logf("Diff for circular references:\n%s", circularDiff)
+
+		// Verify the diff contains the values
+		if !strings.Contains(circularDiff, "1") || !strings.Contains(circularDiff, "2") {
+			t.Errorf("Diff doesn't contain expected value differences for circular references")
+		}
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/diff/diff.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/diff/diff.go
new file mode 100644
index 0000000000..7bfa6088bc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/diff/diff.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package diff
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/pmezard/go-difflib/difflib"
+
+	"k8s.io/utils/dump"
+)
+
+// Diff returns a string representation of the difference between two objects.
+// When built without the usegocmp tag, it uses go-difflib/difflib to generate a
+// unified diff of the objects. It attempts to use JSON serialization first,
+// falling back to an object dump via the dump package if JSON marshaling fails.
+func Diff(a, b any) string {
+
+	aStr, aErr := toPrettyJSON(a)
+	bStr, bErr := toPrettyJSON(b)
+	if aErr != nil || bErr != nil {
+		aStr = dump.Pretty(a)
+		bStr = dump.Pretty(b)
+	}
+
+	diff := difflib.UnifiedDiff{
+		A:       difflib.SplitLines(aStr),
+		B:       difflib.SplitLines(bStr),
+		Context: 3,
+	}
+
+	diffstr, err := difflib.GetUnifiedDiffString(diff)
+	if err != nil {
+		return fmt.Sprintf("error generating diff: %v", err)
+	}
+
+	return diffstr
+}
+
+// toPrettyJSON converts an object to a pretty-printed JSON string.
+func toPrettyJSON(data any) (string, error) {
+	jsonData, err := json.MarshalIndent(data, "", " ")
+	return string(jsonData), err
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/diff/legacy_diff.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/diff/legacy_diff.go
new file mode 100644
index 0000000000..9f0dc2f6ad
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/diff/legacy_diff.go
@@ -0,0 +1,67 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package diff
+
+import (
+	"bytes"
+	"fmt"
+	"strings"
+	"text/tabwriter"
+
+	"k8s.io/utils/dump"
+)
+
+// ObjectGoPrintSideBySide prints a and b as textual dumps side by side,
+// enabling easy visual scanning for mismatches.
+func ObjectGoPrintSideBySide(a, b interface{}) string {
+	sA := dump.Pretty(a)
+	sB := dump.Pretty(b)
+
+	linesA := strings.Split(sA, "\n")
+	linesB := strings.Split(sB, "\n")
+	width := 0
+	for _, s := range linesA {
+		l := len(s)
+		if l > width {
+			width = l
+		}
+	}
+	for _, s := range linesB {
+		l := len(s)
+		if l > width {
+			width = l
+		}
+	}
+	buf := &bytes.Buffer{}
+	w := tabwriter.NewWriter(buf, width, 0, 1, ' ', 0)
+	max := len(linesA)
+	if len(linesB) > max {
+		max = len(linesB)
+	}
+	for i := 0; i < max; i++ {
+		var a, b string
+		if i < len(linesA) {
+			a = linesA[i]
+		}
+		if i < len(linesB) {
+			b = linesB[i]
+		}
+		_, _ = fmt.Fprintf(w, "%s\t%s\n", a, b)
+	}
+	_ = w.Flush()
+	return buf.String()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/dump/dump.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/dump/dump.go
new file mode 100644
index 0000000000..5cf55473c3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/dump/dump.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package dump
+
+import (
+	"k8s.io/utils/dump"
+)
+
+// Deprecated: Use k8s.io/utils/dump.Pretty instead.
+//
+//go:fix inline
+func Pretty(a interface{}) string {
+	return dump.Pretty(a)
+}
+
+// Deprecated: Use k8s.io/utils/dump.ForHash instead.
+//
+//go:fix inline
+func ForHash(a interface{}) string {
+	return dump.ForHash(a)
+}
+
+// Deprecated: Use k8s.io/utils/dump.OneLine instead.
+//
+//go:fix inline
+func OneLine(a interface{}) string {
+	return dump.OneLine(a)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/duration/duration.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/duration/duration.go
new file mode 100644
index 0000000000..a20136a4e5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/duration/duration.go
@@ -0,0 +1,93 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package duration
+
+import (
+	"fmt"
+	"time"
+)
+
+// ShortHumanDuration returns a succinct representation of the provided duration
+// with limited precision for consumption by humans.
+func ShortHumanDuration(d time.Duration) string {
+	// Allow deviation no more than 2 seconds(excluded) to tolerate machine time
+	// inconsistence, it can be considered as almost now.
+	if seconds := int(d.Seconds()); seconds < -1 {
+		return "<invalid>"
+	} else if seconds < 0 {
+		return "0s"
+	} else if seconds < 60 {
+		return fmt.Sprintf("%ds", seconds)
+	} else if minutes := int(d.Minutes()); minutes < 60 {
+		return fmt.Sprintf("%dm", minutes)
+	} else if hours := int(d.Hours()); hours < 24 {
+		return fmt.Sprintf("%dh", hours)
+	} else if hours < 24*365 {
+		return fmt.Sprintf("%dd", hours/24)
+	}
+	return fmt.Sprintf("%dy", int(d.Hours()/24/365))
+}
+
+// HumanDuration returns a succinct representation of the provided duration
+// with limited precision for consumption by humans. It provides ~2-3 significant
+// figures of duration.
+func HumanDuration(d time.Duration) string {
+	// Allow deviation no more than 2 seconds(excluded) to tolerate machine time
+	// inconsistence, it can be considered as almost now.
+	if seconds := int(d.Seconds()); seconds < -1 {
+		return "<invalid>"
+	} else if seconds < 0 {
+		return "0s"
+	} else if seconds < 60*2 {
+		return fmt.Sprintf("%ds", seconds)
+	}
+	minutes := int(d / time.Minute)
+	if minutes < 10 {
+		s := int(d/time.Second) % 60
+		if s == 0 {
+			return fmt.Sprintf("%dm", minutes)
+		}
+		return fmt.Sprintf("%dm%ds", minutes, s)
+	} else if minutes < 60*3 {
+		return fmt.Sprintf("%dm", minutes)
+	}
+	hours := int(d / time.Hour)
+	if hours < 8 {
+		m := int(d/time.Minute) % 60
+		if m == 0 {
+			return fmt.Sprintf("%dh", hours)
+		}
+		return fmt.Sprintf("%dh%dm", hours, m)
+	} else if hours < 48 {
+		return fmt.Sprintf("%dh", hours)
+	} else if hours < 24*8 {
+		h := hours % 24
+		if h == 0 {
+			return fmt.Sprintf("%dd", hours/24)
+		}
+		return fmt.Sprintf("%dd%dh", hours/24, h)
+	} else if hours < 24*365*2 {
+		return fmt.Sprintf("%dd", hours/24)
+	} else if hours < 24*365*8 {
+		dy := int(hours/24) % 365
+		if dy == 0 {
+			return fmt.Sprintf("%dy", hours/24/365)
+		}
+		return fmt.Sprintf("%dy%dd", hours/24/365, dy)
+	}
+	return fmt.Sprintf("%dy", int(hours/24/365))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/duration/duration_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/duration/duration_test.go
new file mode 100644
index 0000000000..ae56b08567
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/duration/duration_test.go
@@ -0,0 +1,133 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package duration
+
+import (
+	"testing"
+	"time"
+)
+
+func TestHumanDuration(t *testing.T) {
+	tests := []struct {
+		d    time.Duration
+		want string
+	}{
+		{d: time.Second, want: "1s"},
+		{d: 70 * time.Second, want: "70s"},
+		{d: 190 * time.Second, want: "3m10s"},
+		{d: 70 * time.Minute, want: "70m"},
+		{d: 47 * time.Hour, want: "47h"},
+		{d: 49 * time.Hour, want: "2d1h"},
+		{d: (8*24 + 2) * time.Hour, want: "8d"},
+		{d: (367 * 24) * time.Hour, want: "367d"},
+		{d: (365*2*24 + 25) * time.Hour, want: "2y1d"},
+		{d: (365*8*24 + 2) * time.Hour, want: "8y"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.d.String(), func(t *testing.T) {
+			if got := HumanDuration(tt.d); got != tt.want {
+				t.Errorf("HumanDuration() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestHumanDurationBoundaries(t *testing.T) {
+	tests := []struct {
+		d    time.Duration
+		want string
+	}{
+		{d: -2 * time.Second, want: "<invalid>"},
+		{d: -2*time.Second + 1, want: "0s"},
+		{d: 0, want: "0s"},
+		{d: time.Second - time.Millisecond, want: "0s"},
+		{d: 2*time.Minute - time.Millisecond, want: "119s"},
+		{d: 2 * time.Minute, want: "2m"},
+		{d: 2*time.Minute + time.Second, want: "2m1s"},
+		{d: 10*time.Minute - time.Millisecond, want: "9m59s"},
+		{d: 10 * time.Minute, want: "10m"},
+		{d: 10*time.Minute + time.Second, want: "10m"},
+		{d: 3*time.Hour - time.Millisecond, want: "179m"},
+		{d: 3 * time.Hour, want: "3h"},
+		{d: 3*time.Hour + time.Minute, want: "3h1m"},
+		{d: 8*time.Hour - time.Millisecond, want: "7h59m"},
+		{d: 8 * time.Hour, want: "8h"},
+		{d: 8*time.Hour + 59*time.Minute, want: "8h"},
+		{d: 2*24*time.Hour - time.Millisecond, want: "47h"},
+		{d: 2 * 24 * time.Hour, want: "2d"},
+		{d: 2*24*time.Hour + time.Hour, want: "2d1h"},
+		{d: 8*24*time.Hour - time.Millisecond, want: "7d23h"},
+		{d: 8 * 24 * time.Hour, want: "8d"},
+		{d: 8*24*time.Hour + 23*time.Hour, want: "8d"},
+		{d: 2*365*24*time.Hour - time.Millisecond, want: "729d"},
+		{d: 2 * 365 * 24 * time.Hour, want: "2y"},
+		{d: 2*365*24*time.Hour + 23*time.Hour, want: "2y"},
+		{d: 2*365*24*time.Hour + 23*time.Hour + 59*time.Minute, want: "2y"},
+		{d: 2*365*24*time.Hour + 24*time.Hour - time.Millisecond, want: "2y"},
+		{d: 2*365*24*time.Hour + 24*time.Hour, want: "2y1d"},
+		{d: 3 * 365 * 24 * time.Hour, want: "3y"},
+		{d: 4 * 365 * 24 * time.Hour, want: "4y"},
+		{d: 5 * 365 * 24 * time.Hour, want: "5y"},
+		{d: 6 * 365 * 24 * time.Hour, want: "6y"},
+		{d: 7 * 365 * 24 * time.Hour, want: "7y"},
+		{d: 8*365*24*time.Hour - time.Millisecond, want: "7y364d"},
+		{d: 8 * 365 * 24 * time.Hour, want: "8y"},
+		{d: 8*365*24*time.Hour + 364*24*time.Hour, want: "8y"},
+		{d: 9 * 365 * 24 * time.Hour, want: "9y"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.d.String(), func(t *testing.T) {
+			if got := HumanDuration(tt.d); got != tt.want {
+				t.Errorf("HumanDuration() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestShortHumanDurationBoundaries(t *testing.T) {
+	tests := []struct {
+		d    time.Duration
+		want string
+	}{
+		{d: -2 * time.Second, want: "<invalid>"},
+		{d: -2*time.Second + 1, want: "0s"},
+		{d: 0, want: "0s"},
+		{d: time.Second - time.Millisecond, want: "0s"},
+		{d: time.Second, want: "1s"},
+		{d: 2*time.Second - time.Millisecond, want: "1s"},
+		{d: time.Minute - time.Millisecond, want: "59s"},
+		{d: time.Minute, want: "1m"},
+		{d: 2*time.Minute - time.Millisecond, want: "1m"},
+		{d: time.Hour - time.Millisecond, want: "59m"},
+		{d: time.Hour, want: "1h"},
+		{d: 2*time.Hour - time.Millisecond, want: "1h"},
+		{d: 24*time.Hour - time.Millisecond, want: "23h"},
+		{d: 24 * time.Hour, want: "1d"},
+		{d: 2*24*time.Hour - time.Millisecond, want: "1d"},
+		{d: 365*24*time.Hour - time.Millisecond, want: "364d"},
+		{d: 365 * 24 * time.Hour, want: "1y"},
+		{d: 2*365*24*time.Hour - time.Millisecond, want: "1y"},
+		{d: 2 * 365 * 24 * time.Hour, want: "2y"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.d.String(), func(t *testing.T) {
+			if got := ShortHumanDuration(tt.d); got != tt.want {
+				t.Errorf("ShortHumanDuration() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/errors/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/errors/doc.go
new file mode 100644
index 0000000000..b3b39bc388
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/errors/doc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package errors implements various utility functions and types around errors.
+package errors
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/errors/errors.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/errors/errors.go
new file mode 100644
index 0000000000..6f458d13d7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/errors/errors.go
@@ -0,0 +1,251 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package errors
+
+import (
+	"errors"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// MessageCountMap contains occurrence for each error message.
+// Deprecated: Not used anymore in the k8s.io codebase, use `errors.Join` instead.
+type MessageCountMap map[string]int
+
+// Aggregate represents an object that contains multiple errors, but does not
+// necessarily have singular semantic meaning.
+// The aggregate can be used with `errors.Is()` to check for the occurrence of
+// a specific error type.
+// Errors.As() is not supported, because the caller presumably cares about a
+// specific error of potentially multiple that match the given type.
+type Aggregate interface {
+	error
+	Errors() []error
+	Is(error) bool
+}
+
+// NewAggregate converts a slice of errors into an Aggregate interface, which
+// is itself an implementation of the error interface.  If the slice is empty,
+// this returns nil.
+// It will check if any of the element of input error list is nil, to avoid
+// nil pointer panic when call Error().
+func NewAggregate(errlist []error) Aggregate {
+	if len(errlist) == 0 {
+		return nil
+	}
+	// In case of input error list contains nil
+	var errs []error
+	for _, e := range errlist {
+		if e != nil {
+			errs = append(errs, e)
+		}
+	}
+	if len(errs) == 0 {
+		return nil
+	}
+	return aggregate(errs)
+}
+
+// This helper implements the error and Errors interfaces.  Keeping it private
+// prevents people from making an aggregate of 0 errors, which is not
+// an error, but does satisfy the error interface.
+type aggregate []error
+
+// Error is part of the error interface.
+func (agg aggregate) Error() string {
+	if len(agg) == 0 {
+		// This should never happen, really.
+		return ""
+	}
+	if len(agg) == 1 {
+		return agg[0].Error()
+	}
+	seenerrs := sets.NewString()
+	result := ""
+	agg.visit(func(err error) bool {
+		msg := err.Error()
+		if seenerrs.Has(msg) {
+			return false
+		}
+		seenerrs.Insert(msg)
+		if len(seenerrs) > 1 {
+			result += ", "
+		}
+		result += msg
+		return false
+	})
+	if len(seenerrs) == 1 {
+		return result
+	}
+	return "[" + result + "]"
+}
+
+func (agg aggregate) Is(target error) bool {
+	return agg.visit(func(err error) bool {
+		return errors.Is(err, target)
+	})
+}
+
+func (agg aggregate) visit(f func(err error) bool) bool {
+	for _, err := range agg {
+		switch err := err.(type) {
+		case aggregate:
+			if match := err.visit(f); match {
+				return match
+			}
+		case Aggregate:
+			for _, nestedErr := range err.Errors() {
+				if match := f(nestedErr); match {
+					return match
+				}
+			}
+		default:
+			if match := f(err); match {
+				return match
+			}
+		}
+	}
+
+	return false
+}
+
+// Errors is part of the Aggregate interface.
+func (agg aggregate) Errors() []error {
+	return []error(agg)
+}
+
+// Matcher is used to match errors.  Returns true if the error matches.
+type Matcher func(error) bool
+
+// FilterOut removes all errors that match any of the matchers from the input
+// error.  If the input is a singular error, only that error is tested.  If the
+// input implements the Aggregate interface, the list of errors will be
+// processed recursively.
+//
+// This can be used, for example, to remove known-OK errors (such as io.EOF or
+// os.PathNotFound) from a list of errors.
+func FilterOut(err error, fns ...Matcher) error {
+	if err == nil {
+		return nil
+	}
+	if agg, ok := err.(Aggregate); ok {
+		return NewAggregate(filterErrors(agg.Errors(), fns...))
+	}
+	if !matchesError(err, fns...) {
+		return err
+	}
+	return nil
+}
+
+// matchesError returns true if any Matcher returns true
+func matchesError(err error, fns ...Matcher) bool {
+	for _, fn := range fns {
+		if fn(err) {
+			return true
+		}
+	}
+	return false
+}
+
+// filterErrors returns any errors (or nested errors, if the list contains
+// nested Errors) for which all fns return false. If no errors
+// remain a nil list is returned. The resulting slice will have all
+// nested slices flattened as a side effect.
+func filterErrors(list []error, fns ...Matcher) []error {
+	result := []error{}
+	for _, err := range list {
+		r := FilterOut(err, fns...)
+		if r != nil {
+			result = append(result, r)
+		}
+	}
+	return result
+}
+
+// Flatten takes an Aggregate, which may hold other Aggregates in arbitrary
+// nesting, and flattens them all into a single Aggregate, recursively.
+func Flatten(agg Aggregate) Aggregate {
+	result := []error{}
+	if agg == nil {
+		return nil
+	}
+	for _, err := range agg.Errors() {
+		if a, ok := err.(Aggregate); ok {
+			r := Flatten(a)
+			if r != nil {
+				result = append(result, r.Errors()...)
+			}
+		} else {
+			if err != nil {
+				result = append(result, err)
+			}
+		}
+	}
+	return NewAggregate(result)
+}
+
+// CreateAggregateFromMessageCountMap converts MessageCountMap Aggregate
+// Deprecated: Not used anymore in the k8s.io codebase, use `errors.Join` instead.
+func CreateAggregateFromMessageCountMap(m MessageCountMap) Aggregate {
+	if m == nil {
+		return nil
+	}
+	result := make([]error, 0, len(m))
+	for errStr, count := range m {
+		var countStr string
+		if count > 1 {
+			countStr = fmt.Sprintf(" (repeated %v times)", count)
+		}
+		result = append(result, fmt.Errorf("%v%v", errStr, countStr))
+	}
+	return NewAggregate(result)
+}
+
+// Reduce will return err or nil, if err is an Aggregate and only has one item,
+// the first item in the aggregate.
+func Reduce(err error) error {
+	if agg, ok := err.(Aggregate); ok && err != nil {
+		switch len(agg.Errors()) {
+		case 1:
+			return agg.Errors()[0]
+		case 0:
+			return nil
+		}
+	}
+	return err
+}
+
+// AggregateGoroutines runs the provided functions in parallel, stuffing all
+// non-nil errors into the returned Aggregate.
+// Returns nil if all the functions complete successfully.
+func AggregateGoroutines(funcs ...func() error) Aggregate {
+	errChan := make(chan error, len(funcs))
+	for _, f := range funcs {
+		go func(f func() error) { errChan <- f() }(f)
+	}
+	errs := make([]error, 0)
+	for i := 0; i < cap(errChan); i++ {
+		if err := <-errChan; err != nil {
+			errs = append(errs, err)
+		}
+	}
+	return NewAggregate(errs)
+}
+
+// ErrPreconditionViolated is returned when the precondition is violated
+var ErrPreconditionViolated = errors.New("precondition is violated")
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/errors/errors_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/errors/errors_test.go
new file mode 100644
index 0000000000..02386aa48d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/errors/errors_test.go
@@ -0,0 +1,530 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package errors
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+	"sort"
+	"testing"
+)
+
+func TestEmptyAggregate(t *testing.T) {
+	var slice []error
+	var agg Aggregate
+	var err error
+
+	agg = NewAggregate(slice)
+	if agg != nil {
+		t.Errorf("expected nil, got %#v", agg)
+	}
+	err = NewAggregate(slice)
+	if err != nil {
+		t.Errorf("expected nil, got %#v", err)
+	}
+
+	// This is not normally possible, but pedantry demands I test it.
+	agg = aggregate(slice) // empty aggregate
+	if s := agg.Error(); s != "" {
+		t.Errorf("expected empty string, got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 0 {
+		t.Errorf("expected empty slice, got %#v", s)
+	}
+	err = agg.(error)
+	if s := err.Error(); s != "" {
+		t.Errorf("expected empty string, got %q", s)
+	}
+}
+
+func TestAggregateWithNil(t *testing.T) {
+	var slice []error
+	slice = []error{nil}
+	var agg Aggregate
+	var err error
+
+	agg = NewAggregate(slice)
+	if agg != nil {
+		t.Errorf("expected nil, got %#v", agg)
+	}
+	err = NewAggregate(slice)
+	if err != nil {
+		t.Errorf("expected nil, got %#v", err)
+	}
+
+	// Append a non-nil error
+	slice = append(slice, fmt.Errorf("err"))
+	agg = NewAggregate(slice)
+	if agg == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := agg.Error(); s != "err" {
+		t.Errorf("expected 'err', got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 1 {
+		t.Errorf("expected one-element slice, got %#v", s)
+	}
+	if s := agg.Errors()[0].Error(); s != "err" {
+		t.Errorf("expected 'err', got %q", s)
+	}
+
+	err = agg.(error)
+	if err == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := err.Error(); s != "err" {
+		t.Errorf("expected 'err', got %q", s)
+	}
+}
+
+func TestSingularAggregate(t *testing.T) {
+	var slice = []error{fmt.Errorf("err")}
+	var agg Aggregate
+	var err error
+
+	agg = NewAggregate(slice)
+	if agg == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := agg.Error(); s != "err" {
+		t.Errorf("expected 'err', got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 1 {
+		t.Errorf("expected one-element slice, got %#v", s)
+	}
+	if s := agg.Errors()[0].Error(); s != "err" {
+		t.Errorf("expected 'err', got %q", s)
+	}
+
+	err = agg.(error)
+	if err == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := err.Error(); s != "err" {
+		t.Errorf("expected 'err', got %q", s)
+	}
+}
+
+func TestPluralAggregate(t *testing.T) {
+	var slice = []error{fmt.Errorf("abc"), fmt.Errorf("123")}
+	var agg Aggregate
+	var err error
+
+	agg = NewAggregate(slice)
+	if agg == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := agg.Error(); s != "[abc, 123]" {
+		t.Errorf("expected '[abc, 123]', got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 2 {
+		t.Errorf("expected two-elements slice, got %#v", s)
+	}
+	if s := agg.Errors()[0].Error(); s != "abc" {
+		t.Errorf("expected '[abc, 123]', got %q", s)
+	}
+
+	err = agg.(error)
+	if err == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := err.Error(); s != "[abc, 123]" {
+		t.Errorf("expected '[abc, 123]', got %q", s)
+	}
+}
+
+func TestDedupeAggregate(t *testing.T) {
+	var slice = []error{fmt.Errorf("abc"), fmt.Errorf("abc")}
+	var agg Aggregate
+
+	agg = NewAggregate(slice)
+	if agg == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := agg.Error(); s != "abc" {
+		t.Errorf("expected 'abc', got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 2 {
+		t.Errorf("expected two-elements slice, got %#v", s)
+	}
+}
+
+func TestDedupePluralAggregate(t *testing.T) {
+	var slice = []error{fmt.Errorf("abc"), fmt.Errorf("abc"), fmt.Errorf("123")}
+	var agg Aggregate
+
+	agg = NewAggregate(slice)
+	if agg == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := agg.Error(); s != "[abc, 123]" {
+		t.Errorf("expected '[abc, 123]', got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 3 {
+		t.Errorf("expected three-elements slice, got %#v", s)
+	}
+}
+
+func TestFlattenAndDedupeAggregate(t *testing.T) {
+	var slice = []error{fmt.Errorf("abc"), fmt.Errorf("abc"), NewAggregate([]error{fmt.Errorf("abc")})}
+	var agg Aggregate
+
+	agg = NewAggregate(slice)
+	if agg == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := agg.Error(); s != "abc" {
+		t.Errorf("expected 'abc', got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 3 {
+		t.Errorf("expected three-elements slice, got %#v", s)
+	}
+}
+
+func TestFlattenAggregate(t *testing.T) {
+	var slice = []error{fmt.Errorf("abc"), fmt.Errorf("abc"), NewAggregate([]error{fmt.Errorf("abc"), fmt.Errorf("def"), NewAggregate([]error{fmt.Errorf("def"), fmt.Errorf("ghi")})})}
+	var agg Aggregate
+
+	agg = NewAggregate(slice)
+	if agg == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := agg.Error(); s != "[abc, def, ghi]" {
+		t.Errorf("expected '[abc, def, ghi]', got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 3 {
+		t.Errorf("expected three-elements slice, got %#v", s)
+	}
+}
+
+func TestFilterOut(t *testing.T) {
+	testCases := []struct {
+		err      error
+		filter   []Matcher
+		expected error
+	}{
+		{
+			nil,
+			[]Matcher{},
+			nil,
+		},
+		{
+			aggregate{},
+			[]Matcher{},
+			nil,
+		},
+		{
+			aggregate{fmt.Errorf("abc")},
+			[]Matcher{},
+			aggregate{fmt.Errorf("abc")},
+		},
+		{
+			aggregate{fmt.Errorf("abc")},
+			[]Matcher{func(err error) bool { return false }},
+			aggregate{fmt.Errorf("abc")},
+		},
+		{
+			aggregate{fmt.Errorf("abc")},
+			[]Matcher{func(err error) bool { return true }},
+			nil,
+		},
+		{
+			aggregate{fmt.Errorf("abc")},
+			[]Matcher{func(err error) bool { return false }, func(err error) bool { return false }},
+			aggregate{fmt.Errorf("abc")},
+		},
+		{
+			aggregate{fmt.Errorf("abc")},
+			[]Matcher{func(err error) bool { return false }, func(err error) bool { return true }},
+			nil,
+		},
+		{
+			aggregate{fmt.Errorf("abc"), fmt.Errorf("def"), fmt.Errorf("ghi")},
+			[]Matcher{func(err error) bool { return err.Error() == "def" }},
+			aggregate{fmt.Errorf("abc"), fmt.Errorf("ghi")},
+		},
+		{
+			aggregate{aggregate{fmt.Errorf("abc")}},
+			[]Matcher{},
+			aggregate{aggregate{fmt.Errorf("abc")}},
+		},
+		{
+			aggregate{aggregate{fmt.Errorf("abc"), aggregate{fmt.Errorf("def")}}},
+			[]Matcher{},
+			aggregate{aggregate{fmt.Errorf("abc"), aggregate{fmt.Errorf("def")}}},
+		},
+		{
+			aggregate{aggregate{fmt.Errorf("abc"), aggregate{fmt.Errorf("def")}}},
+			[]Matcher{func(err error) bool { return err.Error() == "def" }},
+			aggregate{aggregate{fmt.Errorf("abc")}},
+		},
+	}
+	for i, testCase := range testCases {
+		err := FilterOut(testCase.err, testCase.filter...)
+		if !reflect.DeepEqual(testCase.expected, err) {
+			t.Errorf("%d: expected %v, got %v", i, testCase.expected, err)
+		}
+	}
+}
+
+func TestFlatten(t *testing.T) {
+	testCases := []struct {
+		agg      Aggregate
+		expected Aggregate
+	}{
+		{
+			nil,
+			nil,
+		},
+		{
+			aggregate{},
+			nil,
+		},
+		{
+			aggregate{fmt.Errorf("abc")},
+			aggregate{fmt.Errorf("abc")},
+		},
+		{
+			aggregate{fmt.Errorf("abc"), fmt.Errorf("def"), fmt.Errorf("ghi")},
+			aggregate{fmt.Errorf("abc"), fmt.Errorf("def"), fmt.Errorf("ghi")},
+		},
+		{
+			aggregate{aggregate{fmt.Errorf("abc")}},
+			aggregate{fmt.Errorf("abc")},
+		},
+		{
+			aggregate{aggregate{aggregate{fmt.Errorf("abc")}}},
+			aggregate{fmt.Errorf("abc")},
+		},
+		{
+			aggregate{aggregate{fmt.Errorf("abc"), aggregate{fmt.Errorf("def")}}},
+			aggregate{fmt.Errorf("abc"), fmt.Errorf("def")},
+		},
+		{
+			aggregate{aggregate{aggregate{fmt.Errorf("abc")}, fmt.Errorf("def"), aggregate{fmt.Errorf("ghi")}}},
+			aggregate{fmt.Errorf("abc"), fmt.Errorf("def"), fmt.Errorf("ghi")},
+		},
+	}
+	for i, testCase := range testCases {
+		agg := Flatten(testCase.agg)
+		if !reflect.DeepEqual(testCase.expected, agg) {
+			t.Errorf("%d: expected %v, got %v", i, testCase.expected, agg)
+		}
+	}
+}
+
+func TestCreateAggregateFromMessageCountMap(t *testing.T) {
+	testCases := []struct {
+		name     string
+		mcm      MessageCountMap
+		expected Aggregate
+	}{
+		{
+			"input has single instance of one message",
+			MessageCountMap{"abc": 1},
+			aggregate{fmt.Errorf("abc")},
+		},
+		{
+			"input has multiple messages",
+			MessageCountMap{"abc": 2, "ghi": 1},
+			aggregate{fmt.Errorf("abc (repeated 2 times)"), fmt.Errorf("ghi")},
+		},
+		{
+			"input has multiple messages",
+			MessageCountMap{"ghi": 1, "abc": 2},
+			aggregate{fmt.Errorf("abc (repeated 2 times)"), fmt.Errorf("ghi")},
+		},
+	}
+
+	var expected, agg []error
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			if testCase.expected != nil {
+				expected = testCase.expected.Errors()
+				sort.Slice(expected, func(i, j int) bool { return expected[i].Error() < expected[j].Error() })
+			}
+			if testCase.mcm != nil {
+				agg = CreateAggregateFromMessageCountMap(testCase.mcm).Errors()
+				sort.Slice(agg, func(i, j int) bool { return agg[i].Error() < agg[j].Error() })
+			}
+			if !reflect.DeepEqual(expected, agg) {
+				t.Errorf("expected %v, got %v", expected, agg)
+			}
+		})
+	}
+}
+
+func TestAggregateGoroutines(t *testing.T) {
+	testCases := []struct {
+		errs     []error
+		expected map[string]bool // can't compare directly to Aggregate due to non-deterministic ordering
+	}{
+		{
+			[]error{},
+			nil,
+		},
+		{
+			[]error{nil},
+			nil,
+		},
+		{
+			[]error{nil, nil},
+			nil,
+		},
+		{
+			[]error{fmt.Errorf("1")},
+			map[string]bool{"1": true},
+		},
+		{
+			[]error{fmt.Errorf("1"), nil},
+			map[string]bool{"1": true},
+		},
+		{
+			[]error{fmt.Errorf("1"), fmt.Errorf("267")},
+			map[string]bool{"1": true, "267": true},
+		},
+		{
+			[]error{fmt.Errorf("1"), nil, fmt.Errorf("1234")},
+			map[string]bool{"1": true, "1234": true},
+		},
+		{
+			[]error{nil, fmt.Errorf("1"), nil, fmt.Errorf("1234"), fmt.Errorf("22")},
+			map[string]bool{"1": true, "1234": true, "22": true},
+		},
+	}
+	for i, testCase := range testCases {
+		funcs := make([]func() error, len(testCase.errs))
+		for i := range testCase.errs {
+			err := testCase.errs[i]
+			funcs[i] = func() error { return err }
+		}
+		agg := AggregateGoroutines(funcs...)
+		if agg == nil {
+			if len(testCase.expected) > 0 {
+				t.Errorf("%d: expected %v, got nil", i, testCase.expected)
+			}
+			continue
+		}
+		if len(agg.Errors()) != len(testCase.expected) {
+			t.Errorf("%d: expected %d errors in aggregate, got %v", i, len(testCase.expected), agg)
+			continue
+		}
+		for _, err := range agg.Errors() {
+			if !testCase.expected[err.Error()] {
+				t.Errorf("%d: expected %v, got aggregate containing %v", i, testCase.expected, err)
+			}
+		}
+	}
+}
+
+type alwaysMatchingError struct{}
+
+func (_ alwaysMatchingError) Error() string {
+	return "error"
+}
+
+func (_ alwaysMatchingError) Is(_ error) bool {
+	return true
+}
+
+type someError struct{ msg string }
+
+func (se someError) Error() string {
+	if se.msg != "" {
+		return se.msg
+	}
+	return "err"
+}
+
+func TestAggregateWithErrorsIs(t *testing.T) {
+	testCases := []struct {
+		name         string
+		err          error
+		matchAgainst error
+		expectMatch  bool
+	}{
+		{
+			name:         "no match",
+			err:          aggregate{errors.New("my-error"), errors.New("my-other-error")},
+			matchAgainst: fmt.Errorf("no entry %s", "here"),
+		},
+		{
+			name:         "match via .Is()",
+			err:          aggregate{errors.New("forbidden"), alwaysMatchingError{}},
+			matchAgainst: errors.New("unauthorized"),
+			expectMatch:  true,
+		},
+		{
+			name:         "match via equality",
+			err:          aggregate{errors.New("err"), someError{}},
+			matchAgainst: someError{},
+			expectMatch:  true,
+		},
+		{
+			name:         "match via nested aggregate",
+			err:          aggregate{errors.New("closed today"), aggregate{aggregate{someError{}}}},
+			matchAgainst: someError{},
+			expectMatch:  true,
+		},
+		{
+			name:         "match via wrapped aggregate",
+			err:          fmt.Errorf("wrap: %w", aggregate{errors.New("err"), someError{}}),
+			matchAgainst: someError{},
+			expectMatch:  true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := errors.Is(tc.err, tc.matchAgainst)
+			if result != tc.expectMatch {
+				t.Errorf("expected match: %t, got match: %t", tc.expectMatch, result)
+			}
+		})
+	}
+}
+
+type accessTrackingError struct {
+	wasAccessed bool
+}
+
+func (accessTrackingError) Error() string {
+	return "err"
+}
+
+func (ate *accessTrackingError) Is(_ error) bool {
+	ate.wasAccessed = true
+	return true
+}
+
+var _ error = &accessTrackingError{}
+
+func TestErrConfigurationInvalidWithErrorsIsShortCircuitsOnFirstMatch(t *testing.T) {
+	errC := aggregate{&accessTrackingError{}, &accessTrackingError{}}
+	_ = errors.Is(errC, &accessTrackingError{})
+
+	var numAccessed int
+	for _, err := range errC {
+		if ate := err.(*accessTrackingError); ate.wasAccessed {
+			numAccessed++
+		}
+	}
+	if numAccessed != 1 {
+		t.Errorf("expected exactly one error to get accessed, got %d", numAccessed)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/framer/framer.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/framer/framer.go
new file mode 100644
index 0000000000..f18845a417
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/framer/framer.go
@@ -0,0 +1,176 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package framer implements simple frame decoding techniques for an io.ReadCloser
+package framer
+
+import (
+	"encoding/binary"
+	"encoding/json"
+	"io"
+)
+
+type lengthDelimitedFrameWriter struct {
+	w io.Writer
+	h [4]byte
+}
+
+func NewLengthDelimitedFrameWriter(w io.Writer) io.Writer {
+	return &lengthDelimitedFrameWriter{w: w}
+}
+
+// Write writes a single frame to the nested writer, prepending it with the length
+// in bytes of data (as a 4 byte, bigendian uint32).
+func (w *lengthDelimitedFrameWriter) Write(data []byte) (int, error) {
+	binary.BigEndian.PutUint32(w.h[:], uint32(len(data)))
+	n, err := w.w.Write(w.h[:])
+	if err != nil {
+		return 0, err
+	}
+	if n != len(w.h) {
+		return 0, io.ErrShortWrite
+	}
+	return w.w.Write(data)
+}
+
+type lengthDelimitedFrameReader struct {
+	r         io.ReadCloser
+	remaining int
+}
+
+// NewLengthDelimitedFrameReader returns an io.Reader that will decode length-prefixed
+// frames off of a stream.
+//
+// The protocol is:
+//
+//	stream: message ...
+//	message: prefix body
+//	prefix: 4 byte uint32 in BigEndian order, denotes length of body
+//	body: bytes (0..prefix)
+//
+// If the buffer passed to Read is not long enough to contain an entire frame, io.ErrShortRead
+// will be returned along with the number of bytes read.
+func NewLengthDelimitedFrameReader(r io.ReadCloser) io.ReadCloser {
+	return &lengthDelimitedFrameReader{r: r}
+}
+
+// Read attempts to read an entire frame into data. If that is not possible, io.ErrShortBuffer
+// is returned and subsequent calls will attempt to read the last frame. A frame is complete when
+// err is nil.
+func (r *lengthDelimitedFrameReader) Read(data []byte) (int, error) {
+	if r.remaining <= 0 {
+		header := [4]byte{}
+		n, err := io.ReadAtLeast(r.r, header[:4], 4)
+		if err != nil {
+			return 0, err
+		}
+		if n != 4 {
+			return 0, io.ErrUnexpectedEOF
+		}
+		frameLength := int(binary.BigEndian.Uint32(header[:]))
+		r.remaining = frameLength
+	}
+
+	expect := r.remaining
+	max := expect
+	if max > len(data) {
+		max = len(data)
+	}
+	n, err := io.ReadAtLeast(r.r, data[:max], int(max))
+	r.remaining -= n
+	if err != nil {
+		return n, err
+	}
+	if r.remaining > 0 {
+		return n, io.ErrShortBuffer
+	}
+	if n != expect {
+		return n, io.ErrUnexpectedEOF
+	}
+
+	return n, nil
+}
+
+func (r *lengthDelimitedFrameReader) Close() error {
+	return r.r.Close()
+}
+
+type jsonFrameReader struct {
+	r         io.ReadCloser
+	decoder   *json.Decoder
+	remaining []byte
+}
+
+// NewJSONFramedReader returns an io.Reader that will decode individual JSON objects off
+// of a wire.
+//
+// The boundaries between each frame are valid JSON objects. A JSON parsing error will terminate
+// the read.
+func NewJSONFramedReader(r io.ReadCloser) io.ReadCloser {
+	return &jsonFrameReader{
+		r:       r,
+		decoder: json.NewDecoder(r),
+	}
+}
+
+// ReadFrame decodes the next JSON object in the stream, or returns an error. The returned
+// byte slice will be modified the next time ReadFrame is invoked and should not be altered.
+func (r *jsonFrameReader) Read(data []byte) (int, error) {
+	// Return whatever remaining data exists from an in progress frame
+	if n := len(r.remaining); n > 0 {
+		if n <= len(data) {
+			//nolint:staticcheck // SA4006,SA4010 underlying array of data is modified here.
+			data = append(data[0:0], r.remaining...)
+			r.remaining = nil
+			return n, nil
+		}
+
+		n = len(data)
+		//nolint:staticcheck // SA4006,SA4010 underlying array of data is modified here.
+		data = append(data[0:0], r.remaining[:n]...)
+		r.remaining = r.remaining[n:]
+		return n, io.ErrShortBuffer
+	}
+
+	// RawMessage#Unmarshal appends to data - we reset the slice down to 0 and will either see
+	// data written to data, or be larger than data and a different array.
+	m := json.RawMessage(data[:0])
+	if err := r.decoder.Decode(&m); err != nil {
+		return 0, err
+	}
+
+	// If capacity of data is less than length of the message, decoder will allocate a new slice
+	// and set m to it, which means we need to copy the partial result back into data and preserve
+	// the remaining result for subsequent reads.
+	if len(m) > cap(data) {
+		copy(data, m)
+		r.remaining = m[len(data):]
+		return len(data), io.ErrShortBuffer
+	}
+
+	if len(m) > len(data) {
+		// The bytes beyond len(data) were stored in data's underlying array, which we do
+		// not own after this function returns.
+		r.remaining = append([]byte(nil), m[len(data):]...)
+		return len(data), io.ErrShortBuffer
+	}
+
+	return len(m), nil
+}
+
+func (r *jsonFrameReader) Close() error {
+	return r.r.Close()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/framer/framer_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/framer/framer_test.go
new file mode 100644
index 0000000000..7a04fc1b7a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/framer/framer_test.go
@@ -0,0 +1,236 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package framer
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	netutil "k8s.io/apimachinery/pkg/util/net"
+)
+
+func TestRead(t *testing.T) {
+	data := []byte{
+		0x00, 0x00, 0x00, 0x04,
+		0x01, 0x02, 0x03, 0x04,
+		0x00, 0x00, 0x00, 0x03,
+		0x05, 0x06, 0x07,
+		0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x01,
+		0x08,
+	}
+	b := bytes.NewBuffer(data)
+	r := NewLengthDelimitedFrameReader(io.NopCloser(b))
+	buf := make([]byte, 1)
+	if n, err := r.Read(buf); err != io.ErrShortBuffer && n != 1 && bytes.Equal(buf, []byte{0x01}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != io.ErrShortBuffer && n != 1 && bytes.Equal(buf, []byte{0x02}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read the remaining frame
+	buf = make([]byte, 2)
+	if n, err := r.Read(buf); err != nil && n != 2 && bytes.Equal(buf, []byte{0x03, 0x04}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read with buffer equal to frame
+	buf = make([]byte, 3)
+	if n, err := r.Read(buf); err != nil && n != 3 && bytes.Equal(buf, []byte{0x05, 0x06, 0x07}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read empty frame
+	buf = make([]byte, 3)
+	if n, err := r.Read(buf); err != nil && n != 0 && bytes.Equal(buf, []byte{}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read with larger buffer than frame
+	buf = make([]byte, 3)
+	if n, err := r.Read(buf); err != nil && n != 1 && bytes.Equal(buf, []byte{0x08}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read EOF
+	if n, err := r.Read(buf); err != io.EOF && n != 0 {
+		t.Fatalf("unexpected: %v %d", err, n)
+	}
+}
+
+func TestReadLarge(t *testing.T) {
+	data := []byte{
+		0x00, 0x00, 0x00, 0x04,
+		0x01, 0x02, 0x03, 0x04,
+		0x00, 0x00, 0x00, 0x03,
+		0x05, 0x06, 0x07,
+		0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x01,
+		0x08,
+	}
+	b := bytes.NewBuffer(data)
+	r := NewLengthDelimitedFrameReader(io.NopCloser(b))
+	buf := make([]byte, 40)
+	if n, err := r.Read(buf); err != nil && n != 4 && bytes.Equal(buf, []byte{0x01, 0x02, 0x03, 0x04}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != nil && n != 3 && bytes.Equal(buf, []byte{0x05, 0x06, 0x7}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != nil && n != 0 && bytes.Equal(buf, []byte{}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != nil && n != 1 && bytes.Equal(buf, []byte{0x08}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read EOF
+	if n, err := r.Read(buf); err != io.EOF && n != 0 {
+		t.Fatalf("unexpected: %v %d", err, n)
+	}
+}
+
+func TestReadInvalidFrame(t *testing.T) {
+	data := []byte{
+		0x00, 0x00, 0x00, 0x04,
+		0x01, 0x02,
+	}
+	b := bytes.NewBuffer(data)
+	r := NewLengthDelimitedFrameReader(io.NopCloser(b))
+	buf := make([]byte, 1)
+	if n, err := r.Read(buf); err != io.ErrShortBuffer && n != 1 && bytes.Equal(buf, []byte{0x01}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read the remaining frame
+	buf = make([]byte, 3)
+	if n, err := r.Read(buf); err != io.ErrUnexpectedEOF && n != 1 && bytes.Equal(buf, []byte{0x02}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read EOF
+	if n, err := r.Read(buf); err != io.EOF && n != 0 {
+		t.Fatalf("unexpected: %v %d", err, n)
+	}
+}
+
+func TestReadClientTimeout(t *testing.T) {
+	header := []byte{
+		0x00, 0x00, 0x00, 0x04,
+	}
+	data := []byte{
+		0x01, 0x02, 0x03, 0x04,
+		0x00, 0x00, 0x00, 0x03,
+		0x05, 0x06, 0x07,
+		0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x01,
+		0x08,
+	}
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write(header)
+		if flusher, ok := w.(http.Flusher); ok {
+			flusher.Flush()
+		}
+		time.Sleep(1 * time.Second)
+		_, _ = w.Write(data)
+	}))
+	defer server.Close()
+
+	client := &http.Client{
+		Timeout: 500 * time.Millisecond,
+	}
+
+	resp, err := client.Get(server.URL)
+	if err != nil {
+		t.Fatalf("unexpected: %v", err)
+	}
+
+	r := NewLengthDelimitedFrameReader(resp.Body)
+	buf := make([]byte, 1)
+	if n, err := r.Read(buf); err == nil || !netutil.IsTimeout(err) {
+		t.Fatalf("unexpected: %v %d", err, n)
+	}
+}
+
+func TestJSONFrameReader(t *testing.T) {
+	b := bytes.NewBufferString("{\"test\":true}\n1\n[\"a\"]")
+	r := NewJSONFramedReader(io.NopCloser(b))
+	buf := make([]byte, 20)
+	if n, err := r.Read(buf); err != nil || n != 13 || string(buf[:n]) != `{"test":true}` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != nil || n != 1 || string(buf[:n]) != `1` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != nil || n != 5 || string(buf[:n]) != `["a"]` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != io.EOF || n != 0 {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+}
+
+func TestJSONFrameReaderShortBuffer(t *testing.T) {
+	b := bytes.NewBufferString("{\"test\":true}\n1\n[\"a\"]")
+	r := NewJSONFramedReader(io.NopCloser(b))
+	buf := make([]byte, 3)
+
+	if n, err := r.Read(buf); err != io.ErrShortBuffer || n != 3 || string(buf[:n]) != `{"t` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != io.ErrShortBuffer || n != 3 || string(buf[:n]) != `est` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != io.ErrShortBuffer || n != 3 || string(buf[:n]) != `":t` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != io.ErrShortBuffer || n != 3 || string(buf[:n]) != `rue` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != nil || n != 1 || string(buf[:n]) != `}` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+
+	if n, err := r.Read(buf); err != nil || n != 1 || string(buf[:n]) != `1` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+
+	if n, err := r.Read(buf); err != io.ErrShortBuffer || n != 3 || string(buf[:n]) != `["a` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != nil || n != 2 || string(buf[:n]) != `"]` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+
+	if n, err := r.Read(buf); err != io.EOF || n != 0 {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+}
+
+func TestJSONFrameReaderShortBufferNoUnderlyingArrayReuse(t *testing.T) {
+	b := bytes.NewBufferString("{}")
+	r := NewJSONFramedReader(io.NopCloser(b))
+	buf := make([]byte, 1, 2) // cap(buf) > len(buf) && cap(buf) <= len("{}")
+
+	if n, err := r.Read(buf); !errors.Is(err, io.ErrShortBuffer) || n != 1 || string(buf[:n]) != "{" {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	buf = append(buf, make([]byte, 1)...) // stomps the second byte of the backing array
+	if n, err := r.Read(buf[1:]); err != nil || n != 1 || string(buf[1:1+n]) != "}" {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/doc.go
new file mode 100644
index 0000000000..5fdc7955fa
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package httpstream contains compatibility wrappers for streaming transport APIs.
+//
+// Deprecated: use k8s.io/streaming/pkg/httpstream directly.
+package httpstream
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/httpstream.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/httpstream.go
new file mode 100644
index 0000000000..a7c8d897dc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/httpstream.go
@@ -0,0 +1,201 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package httpstream
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+)
+
+const (
+	HeaderConnection               = "Connection"
+	HeaderUpgrade                  = "Upgrade"
+	HeaderProtocolVersion          = "X-Stream-Protocol-Version"
+	HeaderAcceptedProtocolVersions = "X-Accepted-Stream-Protocol-Versions"
+)
+
+// NewStreamHandler defines a function that is called when a new Stream is
+// received. If no error is returned, the Stream is accepted; otherwise,
+// the stream is rejected. After the reply frame has been sent, replySent is closed.
+type NewStreamHandler func(stream Stream, replySent <-chan struct{}) error
+
+// NoOpNewStreamHandler is a stream handler that accepts a new stream and
+// performs no other logic.
+func NoOpNewStreamHandler(stream Stream, replySent <-chan struct{}) error { return nil }
+
+// Dialer knows how to open a streaming connection to a server.
+type Dialer interface {
+
+	// Dial opens a streaming connection to a server using one of the protocols
+	// specified (in order of most preferred to least preferred).
+	Dial(protocols ...string) (Connection, string, error)
+}
+
+// UpgradeRoundTripper is a type of http.RoundTripper that is able to upgrade
+// HTTP requests to support multiplexed bidirectional streams. After RoundTrip()
+// is invoked, if the upgrade is successful, clients may retrieve the upgraded
+// connection by calling UpgradeRoundTripper.Connection().
+type UpgradeRoundTripper interface {
+	http.RoundTripper
+	// NewConnection validates the response and creates a new Connection.
+	NewConnection(resp *http.Response) (Connection, error)
+}
+
+// ResponseUpgrader knows how to upgrade HTTP requests and responses to
+// add streaming support to them.
+type ResponseUpgrader interface {
+	// UpgradeResponse upgrades an HTTP response to one that supports multiplexed
+	// streams. newStreamHandler will be called asynchronously whenever the
+	// other end of the upgraded connection creates a new stream.
+	UpgradeResponse(w http.ResponseWriter, req *http.Request, newStreamHandler NewStreamHandler) Connection
+}
+
+// Connection represents an upgraded HTTP connection.
+type Connection interface {
+	// CreateStream creates a new Stream with the supplied headers.
+	CreateStream(headers http.Header) (Stream, error)
+	// Close resets all streams and closes the connection.
+	Close() error
+	// CloseChan returns a channel that is closed when the underlying connection is closed.
+	CloseChan() <-chan bool
+	// SetIdleTimeout sets the amount of time the connection may remain idle before
+	// it is automatically closed.
+	SetIdleTimeout(timeout time.Duration)
+	// RemoveStreams can be used to remove a set of streams from the Connection.
+	RemoveStreams(streams ...Stream)
+}
+
+// Stream represents a bidirectional communications channel that is part of an
+// upgraded connection.
+type Stream interface {
+	io.ReadWriteCloser
+	// Reset closes both directions of the stream, indicating that neither client
+	// or server can use it any more.
+	Reset() error
+	// Headers returns the headers used to create the stream.
+	Headers() http.Header
+	// Identifier returns the stream's ID.
+	Identifier() uint32
+}
+
+// UpgradeFailureError encapsulates the cause for why the streaming
+// upgrade request failed. Implements error interface.
+type UpgradeFailureError struct {
+	Cause error
+}
+
+func (u *UpgradeFailureError) Error() string {
+	return fmt.Sprintf("unable to upgrade streaming request: %s", u.Cause)
+}
+
+// IsUpgradeFailure returns true if the passed error is (or wrapped error contains)
+// the UpgradeFailureError.
+func IsUpgradeFailure(err error) bool {
+	if err == nil {
+		return false
+	}
+	var upgradeErr *UpgradeFailureError
+	return errors.As(err, &upgradeErr)
+}
+
+// isHTTPSProxyError returns true if error is Gorilla/Websockets HTTPS Proxy dial error;
+// false otherwise (see https://github.com/kubernetes/kubernetes/issues/126134).
+func IsHTTPSProxyError(err error) bool {
+	if err == nil {
+		return false
+	}
+	return strings.Contains(err.Error(), "proxy: unknown scheme: https")
+}
+
+// IsUpgradeRequest returns true if the given request is a connection upgrade request
+func IsUpgradeRequest(req *http.Request) bool {
+	for _, h := range req.Header[http.CanonicalHeaderKey(HeaderConnection)] {
+		if strings.Contains(strings.ToLower(h), strings.ToLower(HeaderUpgrade)) {
+			return true
+		}
+	}
+	return false
+}
+
+func negotiateProtocol(clientProtocols, serverProtocols []string) string {
+	for i := range clientProtocols {
+		for j := range serverProtocols {
+			if clientProtocols[i] == serverProtocols[j] {
+				return clientProtocols[i]
+			}
+		}
+	}
+	return ""
+}
+
+func commaSeparatedHeaderValues(header []string) []string {
+	var parsedClientProtocols []string
+	for i := range header {
+		for _, clientProtocol := range strings.Split(header[i], ",") {
+			if proto := strings.Trim(clientProtocol, " "); len(proto) > 0 {
+				parsedClientProtocols = append(parsedClientProtocols, proto)
+			}
+		}
+	}
+	return parsedClientProtocols
+}
+
+// Handshake performs a subprotocol negotiation. If the client did request a
+// subprotocol, Handshake will select the first common value found in
+// serverProtocols, otherwise it will return an error and write an HTTP BadRequest to the response.
+// If a match is found, Handshake adds a response header indicating the chosen subprotocol.
+// If no match is found, HTTP forbidden is returned, along with a response header containing
+// the list of protocols the server can accept.
+func Handshake(req *http.Request, w http.ResponseWriter, serverProtocols []string) (string, error) {
+	if len(serverProtocols) == 0 {
+		panic(fmt.Errorf("unable to upgrade: serverProtocols is required"))
+	}
+	values, ok := req.Header[http.CanonicalHeaderKey(HeaderProtocolVersion)]
+	if !ok {
+		err := fmt.Errorf("unable to upgrade: header %s does not exist in request with %d headers", HeaderProtocolVersion, len(req.Header))
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return "", err
+	}
+	if len(values) == 0 {
+		err := fmt.Errorf("unable to upgrade: header %s is empty", HeaderProtocolVersion)
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return "", err
+	}
+	clientProtocols := commaSeparatedHeaderValues(values)
+	if len(clientProtocols) == 0 {
+		err := fmt.Errorf("unable to upgrade: header %s contains %s, but no valid protocols", HeaderProtocolVersion, values)
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return "", err
+	}
+
+	negotiatedProtocol := negotiateProtocol(clientProtocols, serverProtocols)
+	if len(negotiatedProtocol) == 0 {
+		for i := range serverProtocols {
+			w.Header().Add(HeaderAcceptedProtocolVersions, serverProtocols[i])
+		}
+		err := fmt.Errorf("unable to upgrade: unable to negotiate protocol: client supports %v, server accepts %v", clientProtocols, serverProtocols)
+		http.Error(w, err.Error(), http.StatusForbidden)
+		return "", err
+	}
+
+	w.Header().Add(HeaderProtocolVersion, negotiatedProtocol)
+	return negotiatedProtocol, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/spdy/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/spdy/doc.go
new file mode 100644
index 0000000000..d03acb0eed
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/spdy/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package spdy contains compatibility wrappers for the SPDY transport stack.
+//
+// Deprecated: use k8s.io/streaming/pkg/httpstream/spdy directly.
+package spdy
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/spdy/spdy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/spdy/spdy.go
new file mode 100644
index 0000000000..37dfe81894
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/spdy/spdy.go
@@ -0,0 +1,236 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package spdy
+
+import (
+	"crypto/tls"
+	"net"
+	"net/http"
+	"net/url"
+	"time"
+
+	apihttpstream "k8s.io/apimachinery/pkg/util/httpstream"
+	streamhttp "k8s.io/streaming/pkg/httpstream"
+	streamspdy "k8s.io/streaming/pkg/httpstream/spdy"
+)
+
+const HeaderSpdy31 = streamspdy.HeaderSpdy31
+
+// SpdyRoundTripper is a compatibility wrapper around the streaming module's
+// SPDY round tripper.
+type SpdyRoundTripper struct {
+	delegate *streamspdy.SpdyRoundTripper
+}
+
+func NewRoundTripper(tlsConfig *tls.Config) (*SpdyRoundTripper, error) {
+	delegate, err := streamspdy.NewRoundTripper(tlsConfig)
+	if err != nil {
+		return nil, err
+	}
+	return &SpdyRoundTripper{delegate: delegate}, nil
+}
+
+func NewRoundTripperWithProxy(tlsConfig *tls.Config, proxier func(*http.Request) (*url.URL, error)) (*SpdyRoundTripper, error) {
+	delegate, err := streamspdy.NewRoundTripperWithProxy(tlsConfig, proxier)
+	if err != nil {
+		return nil, err
+	}
+	return &SpdyRoundTripper{delegate: delegate}, nil
+}
+
+// RoundTripperConfig is a set of options for an SpdyRoundTripper.
+type RoundTripperConfig struct {
+	// TLS configuration used by the round tripper if UpgradeTransport not present.
+	TLS *tls.Config
+	// Proxier is a proxy function invoked on each request. Optional.
+	Proxier func(*http.Request) (*url.URL, error)
+	// PingPeriod is a period for sending SPDY Pings on the connection.
+	// Optional.
+	PingPeriod time.Duration
+	// UpgradeTransport is a subtitute transport used for dialing. If set,
+	// this field will be used instead of "TLS" and "Proxier" for connection creation.
+	// Optional.
+	UpgradeTransport http.RoundTripper
+}
+
+func NewRoundTripperWithConfig(cfg RoundTripperConfig) (*SpdyRoundTripper, error) {
+	delegate, err := streamspdy.NewRoundTripperWithConfig(streamspdy.RoundTripperConfig{
+		TLS:              cfg.TLS,
+		Proxier:          cfg.Proxier,
+		PingPeriod:       cfg.PingPeriod,
+		UpgradeTransport: cfg.UpgradeTransport,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &SpdyRoundTripper{delegate: delegate}, nil
+}
+
+// TLSClientConfig implements pkg/util/net.TLSClientConfigHolder for proper TLS checking during
+// proxying with a spdy roundtripper.
+func (s *SpdyRoundTripper) TLSClientConfig() *tls.Config {
+	return s.delegate.TLSClientConfig()
+}
+
+// Dial opens a network connection for an upgrade request.
+func (s *SpdyRoundTripper) Dial(req *http.Request) (net.Conn, error) {
+	return s.delegate.Dial(req)
+}
+
+// RoundTrip executes a request and upgrades the connection.
+func (s *SpdyRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	return s.delegate.RoundTrip(req)
+}
+
+// NewConnection validates a server upgrade response and prepares the transport.
+func (s *SpdyRoundTripper) NewConnection(resp *http.Response) (apihttpstream.Connection, error) {
+	conn, err := s.delegate.NewConnection(resp)
+	if err != nil {
+		return nil, err
+	}
+	return wrapConnection(conn), nil
+}
+
+type responseUpgraderAdapter struct {
+	delegate streamhttp.ResponseUpgrader
+}
+
+func (r *responseUpgraderAdapter) UpgradeResponse(w http.ResponseWriter, req *http.Request, newStreamHandler apihttpstream.NewStreamHandler) apihttpstream.Connection {
+	conn := r.delegate.UpgradeResponse(w, req, wrapNewStreamHandler(newStreamHandler))
+	return wrapConnection(conn)
+}
+
+func NewResponseUpgrader() apihttpstream.ResponseUpgrader {
+	return &responseUpgraderAdapter{delegate: streamspdy.NewResponseUpgrader()}
+}
+
+func NewResponseUpgraderWithPings(pingPeriod time.Duration) apihttpstream.ResponseUpgrader {
+	return &responseUpgraderAdapter{delegate: streamspdy.NewResponseUpgraderWithPings(pingPeriod)}
+}
+
+func NewClientConnection(conn net.Conn) (apihttpstream.Connection, error) {
+	c, err := streamspdy.NewClientConnection(conn)
+	if err != nil {
+		return nil, err
+	}
+	return wrapConnection(c), nil
+}
+
+func NewClientConnectionWithPings(conn net.Conn, pingPeriod time.Duration) (apihttpstream.Connection, error) {
+	c, err := streamspdy.NewClientConnectionWithPings(conn, pingPeriod)
+	if err != nil {
+		return nil, err
+	}
+	return wrapConnection(c), nil
+}
+
+func NewServerConnection(conn net.Conn, newStreamHandler apihttpstream.NewStreamHandler) (apihttpstream.Connection, error) {
+	c, err := streamspdy.NewServerConnection(conn, wrapNewStreamHandler(newStreamHandler))
+	if err != nil {
+		return nil, err
+	}
+	return wrapConnection(c), nil
+}
+
+func NewServerConnectionWithPings(conn net.Conn, newStreamHandler apihttpstream.NewStreamHandler, pingPeriod time.Duration) (apihttpstream.Connection, error) {
+	c, err := streamspdy.NewServerConnectionWithPings(conn, wrapNewStreamHandler(newStreamHandler), pingPeriod)
+	if err != nil {
+		return nil, err
+	}
+	return wrapConnection(c), nil
+}
+
+type streamAdapter struct {
+	delegate streamhttp.Stream
+}
+
+func (s *streamAdapter) Read(p []byte) (int, error) {
+	return s.delegate.Read(p)
+}
+
+func (s *streamAdapter) Write(p []byte) (int, error) {
+	return s.delegate.Write(p)
+}
+
+func (s *streamAdapter) Close() error {
+	return s.delegate.Close()
+}
+
+func (s *streamAdapter) Reset() error {
+	return s.delegate.Reset()
+}
+
+func (s *streamAdapter) Headers() http.Header {
+	return s.delegate.Headers()
+}
+
+func (s *streamAdapter) Identifier() uint32 {
+	return s.delegate.Identifier()
+}
+
+type connectionAdapter struct {
+	delegate streamhttp.Connection
+}
+
+func (c *connectionAdapter) CreateStream(headers http.Header) (apihttpstream.Stream, error) {
+	stream, err := c.delegate.CreateStream(headers)
+	if err != nil {
+		return nil, err
+	}
+	return &streamAdapter{delegate: stream}, nil
+}
+
+func (c *connectionAdapter) Close() error {
+	return c.delegate.Close()
+}
+
+func (c *connectionAdapter) CloseChan() <-chan bool {
+	return c.delegate.CloseChan()
+}
+
+func (c *connectionAdapter) SetIdleTimeout(timeout time.Duration) {
+	c.delegate.SetIdleTimeout(timeout)
+}
+
+func (c *connectionAdapter) RemoveStreams(streams ...apihttpstream.Stream) {
+	streamingStreams := make([]streamhttp.Stream, 0, len(streams))
+	for _, stream := range streams {
+		if stream == nil {
+			continue
+		}
+		if s, ok := stream.(streamhttp.Stream); ok {
+			streamingStreams = append(streamingStreams, s)
+		}
+	}
+	c.delegate.RemoveStreams(streamingStreams...)
+}
+
+func wrapConnection(conn streamhttp.Connection) apihttpstream.Connection {
+	if conn == nil {
+		return nil
+	}
+	return &connectionAdapter{delegate: conn}
+}
+
+func wrapNewStreamHandler(newStreamHandler apihttpstream.NewStreamHandler) streamhttp.NewStreamHandler {
+	if newStreamHandler == nil {
+		return nil
+	}
+	return func(stream streamhttp.Stream, replySent <-chan struct{}) error {
+		return newStreamHandler(&streamAdapter{delegate: stream}, replySent)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/wsstream/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/wsstream/doc.go
new file mode 100644
index 0000000000..9b07bfbb13
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/wsstream/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package wsstream contains compatibility wrappers for websocket streaming.
+//
+// Deprecated: use k8s.io/streaming/pkg/httpstream/wsstream directly.
+package wsstream
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/wsstream/wsstream.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/wsstream/wsstream.go
new file mode 100644
index 0000000000..73abcdc6ea
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/httpstream/wsstream/wsstream.go
@@ -0,0 +1,92 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wsstream
+
+import (
+	"io"
+	"net/http"
+	"time"
+
+	"golang.org/x/net/websocket"
+
+	"k8s.io/klog/v2"
+	streamws "k8s.io/streaming/pkg/httpstream/wsstream"
+)
+
+const (
+	WebSocketProtocolHeader        = streamws.WebSocketProtocolHeader
+	ChannelWebSocketProtocol       = streamws.ChannelWebSocketProtocol
+	Base64ChannelWebSocketProtocol = streamws.Base64ChannelWebSocketProtocol
+)
+
+type ChannelType = streamws.ChannelType
+
+const (
+	IgnoreChannel    = streamws.IgnoreChannel
+	ReadChannel      = streamws.ReadChannel
+	WriteChannel     = streamws.WriteChannel
+	ReadWriteChannel = streamws.ReadWriteChannel
+)
+
+func IsWebSocketRequest(req *http.Request) bool {
+	return streamws.IsWebSocketRequest(req)
+}
+
+func IsWebSocketRequestWithStreamCloseProtocol(req *http.Request) bool {
+	return streamws.IsWebSocketRequestWithStreamCloseProtocol(req)
+}
+
+func IsWebSocketRequestWithTunnelingProtocol(req *http.Request) bool {
+	return streamws.IsWebSocketRequestWithTunnelingProtocol(req)
+}
+
+func IgnoreReceives(ws *websocket.Conn, timeout time.Duration) {
+	streamws.IgnoreReceives(ws, timeout)
+}
+
+func IgnoreReceivesWithLogger(logger klog.Logger, ws *websocket.Conn, timeout time.Duration) {
+	streamws.IgnoreReceivesWithLogger(logger, ws, timeout)
+}
+
+type ChannelProtocolConfig = streamws.ChannelProtocolConfig
+
+func NewDefaultChannelProtocols(channels []ChannelType) map[string]ChannelProtocolConfig {
+	return streamws.NewDefaultChannelProtocols(channels)
+}
+
+type Conn = streamws.Conn
+
+func NewConn(protocols map[string]ChannelProtocolConfig) *Conn {
+	return streamws.NewConn(protocols)
+}
+
+type ReaderProtocolConfig = streamws.ReaderProtocolConfig
+
+func NewDefaultReaderProtocols() map[string]ReaderProtocolConfig {
+	return streamws.NewDefaultReaderProtocols()
+}
+
+type Reader = streamws.Reader
+
+func NewReader(r io.Reader, ping bool, protocols map[string]ReaderProtocolConfig) *Reader {
+	//nolint:logcheck // Intentionally using the non-contextual variant here.
+	return streamws.NewReader(r, ping, protocols)
+}
+
+func NewReaderWithLogger(logger klog.Logger, r io.Reader, ping bool, protocols map[string]ReaderProtocolConfig) *Reader {
+	return streamws.NewReaderWithLogger(logger, r, ping, protocols)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/generated.pb.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/generated.pb.go
new file mode 100644
index 0000000000..5be552e1eb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/generated.pb.go
@@ -0,0 +1,298 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/apimachinery/pkg/util/intstr/generated.proto
+
+package intstr
+
+import (
+	fmt "fmt"
+
+	io "io"
+	math_bits "math/bits"
+)
+
+func (m *IntOrString) Reset() { *m = IntOrString{} }
+
+func (m *IntOrString) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *IntOrString) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *IntOrString) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.StrVal)
+	copy(dAtA[i:], m.StrVal)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.StrVal)))
+	i--
+	dAtA[i] = 0x1a
+	i = encodeVarintGenerated(dAtA, i, uint64(m.IntVal))
+	i--
+	dAtA[i] = 0x10
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Type))
+	i--
+	dAtA[i] = 0x8
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *IntOrString) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 1 + sovGenerated(uint64(m.Type))
+	n += 1 + sovGenerated(uint64(m.IntVal))
+	l = len(m.StrVal)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozGenerated(x uint64) (n int) {
+	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (m *IntOrString) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: IntOrString: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: IntOrString: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			m.Type = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Type |= Type(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IntVal", wireType)
+			}
+			m.IntVal = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.IntVal |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StrVal", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.StrVal = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipGenerated(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLengthGenerated
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupGenerated
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthGenerated
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+var (
+	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/generated.proto b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/generated.proto
new file mode 100644
index 0000000000..e3d26a59a5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/generated.proto
@@ -0,0 +1,44 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.apimachinery.pkg.util.intstr;
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/apimachinery/pkg/util/intstr";
+
+// IntOrString is a type that can hold an int32 or a string.  When used in
+// JSON or YAML marshalling and unmarshalling, it produces or consumes the
+// inner type.  This allows you to have, for example, a JSON field that can
+// accept a name or number.
+// TODO: Rename to Int32OrString
+//
+// +protobuf=true
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.util.intstr
+message IntOrString {
+  optional int64 type = 1;
+
+  optional int32 intVal = 2;
+
+  optional string strVal = 3;
+}
+
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/instr_fuzz.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/instr_fuzz.go
new file mode 100644
index 0000000000..494325c1f3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/instr_fuzz.go
@@ -0,0 +1,42 @@
+//go:build !notest
+
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package intstr
+
+import (
+	"sigs.k8s.io/randfill"
+)
+
+// RandFill satisfies randfill.NativeSelfFiller
+func (intstr *IntOrString) RandFill(c randfill.Continue) {
+	if intstr == nil {
+		return
+	}
+	if c.Bool() {
+		intstr.Type = Int
+		c.Fill(&intstr.IntVal)
+		intstr.StrVal = ""
+	} else {
+		intstr.Type = String
+		intstr.IntVal = 0
+		c.Fill(&intstr.StrVal)
+	}
+}
+
+// ensure IntOrString implements fuzz.Interface
+var _ randfill.NativeSelfFiller = &IntOrString{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/intstr.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/intstr.go
new file mode 100644
index 0000000000..b0ca3803e4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/intstr.go
@@ -0,0 +1,260 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package intstr
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"math"
+	"runtime/debug"
+	"strconv"
+	"strings"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	"k8s.io/klog/v2"
+)
+
+// IntOrString is a type that can hold an int32 or a string.  When used in
+// JSON or YAML marshalling and unmarshalling, it produces or consumes the
+// inner type.  This allows you to have, for example, a JSON field that can
+// accept a name or number.
+// TODO: Rename to Int32OrString
+//
+// +protobuf=true
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.util.intstr
+type IntOrString struct {
+	Type   Type   `protobuf:"varint,1,opt,name=type,casttype=Type"`
+	IntVal int32  `protobuf:"varint,2,opt,name=intVal"`
+	StrVal string `protobuf:"bytes,3,opt,name=strVal"`
+}
+
+// Type represents the stored type of IntOrString.
+type Type int64
+
+const (
+	Int    Type = iota // The IntOrString holds an int.
+	String             // The IntOrString holds a string.
+)
+
+// FromInt creates an IntOrString object with an int32 value. It is
+// your responsibility not to call this method with a value greater
+// than int32.
+// Deprecated: use FromInt32 instead.
+func FromInt(val int) IntOrString {
+	if val > math.MaxInt32 || val < math.MinInt32 {
+		//nolint:logcheck // Should not be reached.
+		klog.Errorf("value: %d overflows int32\n%s\n", val, debug.Stack())
+	}
+	return IntOrString{Type: Int, IntVal: int32(val)}
+}
+
+// FromInt32 creates an IntOrString object with an int32 value.
+func FromInt32(val int32) IntOrString {
+	return IntOrString{Type: Int, IntVal: val}
+}
+
+// FromString creates an IntOrString object with a string value.
+func FromString(val string) IntOrString {
+	return IntOrString{Type: String, StrVal: val}
+}
+
+// Parse the given string and try to convert it to an int32 integer before
+// setting it as a string value.
+func Parse(val string) IntOrString {
+	i, err := strconv.ParseInt(val, 10, 32)
+	if err != nil {
+		return FromString(val)
+	}
+	return FromInt32(int32(i))
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+func (intstr *IntOrString) UnmarshalJSON(value []byte) error {
+	if value[0] == '"' {
+		intstr.Type = String
+		return json.Unmarshal(value, &intstr.StrVal)
+	}
+	intstr.Type = Int
+	return json.Unmarshal(value, &intstr.IntVal)
+}
+
+func (intstr *IntOrString) UnmarshalCBOR(value []byte) error {
+	if err := cbor.Unmarshal(value, &intstr.StrVal); err == nil {
+		intstr.Type = String
+		return nil
+	}
+
+	if err := cbor.Unmarshal(value, &intstr.IntVal); err != nil {
+		return err
+	}
+
+	intstr.Type = Int
+	return nil
+}
+
+// String returns the string value, or the Itoa of the int value.
+func (intstr *IntOrString) String() string {
+	if intstr == nil {
+		return "<nil>"
+	}
+	if intstr.Type == String {
+		return intstr.StrVal
+	}
+	return strconv.Itoa(intstr.IntValue())
+}
+
+// IntValue returns the IntVal if type Int, or if
+// it is a String, will attempt a conversion to int,
+// returning 0 if a parsing error occurs.
+func (intstr *IntOrString) IntValue() int {
+	if intstr.Type == String {
+		i, _ := strconv.Atoi(intstr.StrVal)
+		return i
+	}
+	return int(intstr.IntVal)
+}
+
+// MarshalJSON implements the json.Marshaller interface.
+func (intstr IntOrString) MarshalJSON() ([]byte, error) {
+	switch intstr.Type {
+	case Int:
+		return json.Marshal(intstr.IntVal)
+	case String:
+		return json.Marshal(intstr.StrVal)
+	default:
+		return []byte{}, fmt.Errorf("impossible IntOrString.Type")
+	}
+}
+
+func (intstr IntOrString) MarshalCBOR() ([]byte, error) {
+	switch intstr.Type {
+	case Int:
+		return cbor.Marshal(intstr.IntVal)
+	case String:
+		return cbor.Marshal(intstr.StrVal)
+	default:
+		return nil, fmt.Errorf("impossible IntOrString.Type")
+	}
+}
+
+// OpenAPISchemaType is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+//
+// See: https://github.com/kubernetes/kube-openapi/tree/master/pkg/generators
+func (IntOrString) OpenAPISchemaType() []string { return []string{"string"} }
+
+// OpenAPISchemaFormat is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+func (IntOrString) OpenAPISchemaFormat() string { return "int-or-string" }
+
+// OpenAPIV3OneOfTypes is used by the kube-openapi generator when constructing
+// the OpenAPI v3 spec of this type.
+func (IntOrString) OpenAPIV3OneOfTypes() []string { return []string{"integer", "string"} }
+
+func ValueOrDefault(intOrPercent *IntOrString, defaultValue IntOrString) *IntOrString {
+	if intOrPercent == nil {
+		return &defaultValue
+	}
+	return intOrPercent
+}
+
+// GetScaledValueFromIntOrPercent is meant to replace GetValueFromIntOrPercent.
+// This method returns a scaled value from an IntOrString type. If the IntOrString
+// is a percentage string value it's treated as a percentage and scaled appropriately
+// in accordance to the total, if it's an int value it's treated as a simple value and
+// if it is a string value which is either non-numeric or numeric but lacking a trailing '%' it returns an error.
+func GetScaledValueFromIntOrPercent(intOrPercent *IntOrString, total int, roundUp bool) (int, error) {
+	if intOrPercent == nil {
+		return 0, errors.New("nil value for IntOrString")
+	}
+	value, isPercent, err := getIntOrPercentValueSafely(intOrPercent)
+	if err != nil {
+		return 0, fmt.Errorf("invalid value for IntOrString: %v", err)
+	}
+	if isPercent {
+		if roundUp {
+			value = int(math.Ceil(float64(value) * (float64(total)) / 100))
+		} else {
+			value = int(math.Floor(float64(value) * (float64(total)) / 100))
+		}
+	}
+	return value, nil
+}
+
+// GetValueFromIntOrPercent was deprecated in favor of
+// GetScaledValueFromIntOrPercent. This method was treating all int as a numeric value and all
+// strings with or without a percent symbol as a percentage value.
+// Deprecated
+func GetValueFromIntOrPercent(intOrPercent *IntOrString, total int, roundUp bool) (int, error) {
+	if intOrPercent == nil {
+		return 0, errors.New("nil value for IntOrString")
+	}
+	value, isPercent, err := getIntOrPercentValue(intOrPercent)
+	if err != nil {
+		return 0, fmt.Errorf("invalid value for IntOrString: %v", err)
+	}
+	if isPercent {
+		if roundUp {
+			value = int(math.Ceil(float64(value) * (float64(total)) / 100))
+		} else {
+			value = int(math.Floor(float64(value) * (float64(total)) / 100))
+		}
+	}
+	return value, nil
+}
+
+// getIntOrPercentValue is a legacy function and only meant to be called by GetValueFromIntOrPercent
+// For a more correct implementation call getIntOrPercentSafely
+func getIntOrPercentValue(intOrStr *IntOrString) (int, bool, error) {
+	switch intOrStr.Type {
+	case Int:
+		return intOrStr.IntValue(), false, nil
+	case String:
+		s := strings.Replace(intOrStr.StrVal, "%", "", -1)
+		v, err := strconv.Atoi(s)
+		if err != nil {
+			return 0, false, fmt.Errorf("invalid value %q: %v", intOrStr.StrVal, err)
+		}
+		return int(v), true, nil
+	}
+	return 0, false, fmt.Errorf("invalid type: neither int nor percentage")
+}
+
+func getIntOrPercentValueSafely(intOrStr *IntOrString) (int, bool, error) {
+	switch intOrStr.Type {
+	case Int:
+		return intOrStr.IntValue(), false, nil
+	case String:
+		isPercent := false
+		s := intOrStr.StrVal
+		if strings.HasSuffix(s, "%") {
+			isPercent = true
+			s = strings.TrimSuffix(intOrStr.StrVal, "%")
+		} else {
+			return 0, false, fmt.Errorf("invalid type: string is not a percentage")
+		}
+		v, err := strconv.Atoi(s)
+		if err != nil {
+			return 0, false, fmt.Errorf("invalid value %q: %v", intOrStr.StrVal, err)
+		}
+		return int(v), isPercent, nil
+	}
+	return 0, false, fmt.Errorf("invalid type: neither int nor percentage")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/intstr_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/intstr_test.go
new file mode 100644
index 0000000000..eb63854bbc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/intstr_test.go
@@ -0,0 +1,568 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package intstr
+
+import (
+	"encoding/json"
+	"fmt"
+	"math"
+	"reflect"
+	"testing"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	"sigs.k8s.io/yaml"
+
+	"github.com/google/go-cmp/cmp"
+	"sigs.k8s.io/randfill"
+)
+
+func TestFromInt(t *testing.T) {
+	i := FromInt(93)
+	if i.Type != Int || i.IntVal != 93 {
+		t.Errorf("Expected IntVal=93, got %+v", i)
+	}
+}
+
+func TestFromInt32(t *testing.T) {
+	i := FromInt32(93)
+	if i.Type != Int || i.IntVal != 93 {
+		t.Errorf("Expected IntVal=93, got %+v", i)
+	}
+}
+
+func TestFromString(t *testing.T) {
+	i := FromString("76")
+	if i.Type != String || i.StrVal != "76" {
+		t.Errorf("Expected StrVal=\"76\", got %+v", i)
+	}
+}
+
+type IntOrStringHolder struct {
+	IOrS IntOrString `json:"val"`
+}
+
+func TestIntOrStringUnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  string
+		result IntOrString
+	}{
+		{"{\"val\": 123}", FromInt32(123)},
+		{"{\"val\": \"123\"}", FromString("123")},
+	}
+
+	for _, c := range cases {
+		var result IntOrStringHolder
+		if err := json.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("Failed to unmarshal input '%v': %v", c.input, err)
+		}
+		if result.IOrS != c.result {
+			t.Errorf("Failed to unmarshal input '%v': expected %+v, got %+v", c.input, c.result, result)
+		}
+	}
+}
+
+func TestIntOrStringMarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  IntOrString
+		result string
+	}{
+		{FromInt32(123), "{\"val\":123}"},
+		{FromString("123"), "{\"val\":\"123\"}"},
+	}
+
+	for _, c := range cases {
+		input := IntOrStringHolder{c.input}
+		result, err := json.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input '%v': %v", input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("Failed to marshal input '%v': expected: %+v, got %q", input, c.result, string(result))
+		}
+	}
+}
+
+func TestIntOrStringMarshalJSONUnmarshalYAML(t *testing.T) {
+	cases := []struct {
+		input IntOrString
+	}{
+		{FromInt32(123)},
+		{FromString("123")},
+	}
+
+	for _, c := range cases {
+		input := IntOrStringHolder{c.input}
+		jsonMarshalled, err := json.Marshal(&input)
+		if err != nil {
+			t.Errorf("1: Failed to marshal input: '%v': %v", input, err)
+		}
+
+		var result IntOrStringHolder
+		err = yaml.Unmarshal(jsonMarshalled, &result)
+		if err != nil {
+			t.Errorf("2: Failed to unmarshal '%+v': %v", string(jsonMarshalled), err)
+		}
+
+		if !reflect.DeepEqual(input, result) {
+			t.Errorf("3: Failed to marshal input '%+v': got %+v", input, result)
+		}
+	}
+}
+
+func TestGetIntFromIntOrString(t *testing.T) {
+	tests := []struct {
+		input      IntOrString
+		expectErr  bool
+		expectVal  int
+		expectPerc bool
+	}{
+		{
+			input:      FromInt32(200),
+			expectErr:  false,
+			expectVal:  200,
+			expectPerc: false,
+		},
+		{
+			input:      FromString("200"),
+			expectErr:  true,
+			expectPerc: false,
+		},
+		{
+			input:      FromString("30%0"),
+			expectErr:  true,
+			expectPerc: false,
+		},
+		{
+			input:      FromString("40%"),
+			expectErr:  false,
+			expectVal:  40,
+			expectPerc: true,
+		},
+		{
+			input:      FromString("%"),
+			expectErr:  true,
+			expectPerc: false,
+		},
+		{
+			input:      FromString("a%"),
+			expectErr:  true,
+			expectPerc: false,
+		},
+		{
+			input:      FromString("a"),
+			expectErr:  true,
+			expectPerc: false,
+		},
+		{
+			input:      FromString("40#"),
+			expectErr:  true,
+			expectPerc: false,
+		},
+		{
+			input:      FromString("40%%"),
+			expectErr:  true,
+			expectPerc: false,
+		},
+	}
+	for _, test := range tests {
+		t.Run("", func(t *testing.T) {
+			value, isPercent, err := getIntOrPercentValueSafely(&test.input)
+			if test.expectVal != value {
+				t.Fatalf("expected value does not match, expected: %d, got: %d", test.expectVal, value)
+			}
+			if test.expectPerc != isPercent {
+				t.Fatalf("expected percent does not match, expected: %t, got: %t", test.expectPerc, isPercent)
+			}
+			if test.expectErr != (err != nil) {
+				t.Fatalf("expected error does not match, expected error: %v, got: %v", test.expectErr, err)
+			}
+		})
+	}
+
+}
+
+func TestGetIntFromIntOrPercent(t *testing.T) {
+	tests := []struct {
+		input     IntOrString
+		total     int
+		roundUp   bool
+		expectErr bool
+		expectVal int
+	}{
+		{
+			input:     FromInt32(123),
+			expectErr: false,
+			expectVal: 123,
+		},
+		{
+			input:     FromString("90%"),
+			total:     100,
+			roundUp:   true,
+			expectErr: false,
+			expectVal: 90,
+		},
+		{
+			input:     FromString("90%"),
+			total:     95,
+			roundUp:   true,
+			expectErr: false,
+			expectVal: 86,
+		},
+		{
+			input:     FromString("90%"),
+			total:     95,
+			roundUp:   false,
+			expectErr: false,
+			expectVal: 85,
+		},
+		{
+			input:     FromString("%"),
+			expectErr: true,
+		},
+		{
+			input:     FromString("90#"),
+			expectErr: true,
+		},
+		{
+			input:     FromString("#%"),
+			expectErr: true,
+		},
+		{
+			input:     FromString("90"),
+			expectErr: true,
+		},
+	}
+
+	for i, test := range tests {
+		t.Logf("test case %d", i)
+		value, err := GetScaledValueFromIntOrPercent(&test.input, test.total, test.roundUp)
+		if test.expectErr && err == nil {
+			t.Errorf("expected error, but got none")
+			continue
+		}
+		if !test.expectErr && err != nil {
+			t.Errorf("unexpected err: %v", err)
+			continue
+		}
+		if test.expectVal != value {
+			t.Errorf("expected %v, but got %v", test.expectVal, value)
+		}
+	}
+}
+
+func TestGetValueFromIntOrPercentNil(t *testing.T) {
+	_, err := GetScaledValueFromIntOrPercent(nil, 0, false)
+	if err == nil {
+		t.Errorf("expected error got none")
+	}
+}
+
+func TestParse(t *testing.T) {
+	tests := []struct {
+		input  string
+		output IntOrString
+	}{
+		{
+			input:  "0",
+			output: IntOrString{Type: Int, IntVal: 0},
+		},
+		{
+			input:  "2147483647", // math.MaxInt32
+			output: IntOrString{Type: Int, IntVal: 2147483647},
+		},
+		{
+			input:  "-2147483648", // math.MinInt32
+			output: IntOrString{Type: Int, IntVal: -2147483648},
+		},
+		{
+			input:  "2147483648", // math.MaxInt32+1
+			output: IntOrString{Type: String, StrVal: "2147483648"},
+		},
+		{
+			input:  "-2147483649", // math.MinInt32-1
+			output: IntOrString{Type: String, StrVal: "-2147483649"},
+		},
+		{
+			input:  "9223372036854775807", // math.MaxInt64
+			output: IntOrString{Type: String, StrVal: "9223372036854775807"},
+		},
+		{
+			input:  "-9223372036854775808", // math.MinInt64
+			output: IntOrString{Type: String, StrVal: "-9223372036854775808"},
+		},
+		{
+			input:  "9223372036854775808", // math.MaxInt64+1
+			output: IntOrString{Type: String, StrVal: "9223372036854775808"},
+		},
+		{
+			input:  "-9223372036854775809", // math.MinInt64-1
+			output: IntOrString{Type: String, StrVal: "-9223372036854775809"},
+		},
+	}
+
+	for i, test := range tests {
+		t.Logf("test case %d", i)
+		value := Parse(test.input)
+		if test.output.Type != value.Type {
+			t.Errorf("expected type %d (%v), but got %d (%v)", test.output.Type, test.output, value.Type, value)
+			continue
+		}
+		if value.Type == Int && test.output.IntVal != value.IntVal {
+			t.Errorf("expected int value %d (%v), but got %d (%v)", test.output.IntVal, test.output, value.IntVal, value)
+			continue
+		}
+		if value.Type == String && test.output.StrVal != value.StrVal {
+			t.Errorf("expected string value %q (%v), but got %q (%v)", test.output.StrVal, test.output, value.StrVal, value)
+		}
+	}
+}
+
+func TestMarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		in            IntOrString
+		want          []byte
+		assertOnError func(*testing.T, error)
+	}{
+		{
+			in: IntOrString{Type: 42},
+			assertOnError: func(t *testing.T, err error) {
+				if err == nil {
+					t.Fatal("expected non-nil error")
+				}
+				const want = "impossible IntOrString.Type"
+				if got := err.Error(); got != want {
+					t.Fatalf("want error message %q, got %q", want, got)
+				}
+			},
+		},
+		{
+			in:   FromString(""),
+			want: []byte{0x40},
+		},
+		{
+			in:   FromString("abc"),
+			want: []byte{0x43, 'a', 'b', 'c'},
+		},
+		{
+			in:   FromInt32(0), // min positive integer representable in one byte
+			want: []byte{0x00},
+		},
+		{
+			in:   FromInt32(23), // max positive integer representable in one byte
+			want: []byte{0x17},
+		},
+		{
+			in:   FromInt32(24), // min positive integer representable in two bytes
+			want: []byte{0x18, 0x18},
+		},
+		{
+			in:   FromInt32(math.MaxUint8), // max positive integer representable in two bytes
+			want: []byte{0x18, 0xff},
+		},
+		{
+			in:   FromInt32(math.MaxUint8 + 1), // min positive integer representable in three bytes
+			want: []byte{0x19, 0x01, 0x00},
+		},
+		{
+			in:   FromInt32(math.MaxUint16), // max positive integer representable in three bytes
+			want: []byte{0x19, 0xff, 0xff},
+		},
+		{
+			in:   FromInt32(math.MaxUint16 + 1), // min positive integer representable in five bytes
+			want: []byte{0x1a, 0x00, 0x01, 0x00, 0x00},
+		},
+		{
+			in:   FromInt32(math.MaxInt32), // max positive integer representable by Go int32
+			want: []byte{0x1a, 0x7f, 0xff, 0xff, 0xff},
+		},
+		{
+			in:   FromInt32(-1), // max negative integer representable in one byte
+			want: []byte{0x20},
+		},
+		{
+			in:   FromInt32(-24), // min negative integer representable in one byte
+			want: []byte{0x37},
+		},
+		{
+			in:   FromInt32(-1 - 24), // max negative integer representable in two bytes
+			want: []byte{0x38, 0x18},
+		},
+		{
+			in:   FromInt32(-1 - math.MaxUint8), // min negative integer representable in two bytes
+			want: []byte{0x38, 0xff},
+		},
+		{
+			in:   FromInt32(-2 - math.MaxUint8), // max negative integer representable in three bytes
+			want: []byte{0x39, 0x01, 0x00},
+		},
+		{
+			in:   FromInt32(-1 - math.MaxUint16), // min negative integer representable in three bytes
+			want: []byte{0x39, 0xff, 0xff},
+		},
+		{
+			in:   FromInt32(-2 - math.MaxUint16), // max negative integer representable in five bytes
+			want: []byte{0x3a, 0x00, 0x01, 0x00, 0x00},
+		},
+		{
+			in:   FromInt32(math.MinInt32), // min negative integer representable by Go int32
+			want: []byte{0x3a, 0x7f, 0xff, 0xff, 0xff},
+		},
+	} {
+		t.Run(fmt.Sprintf("{Type:%d,IntVal:%d,StrVal:%q}", tc.in.Type, tc.in.IntVal, tc.in.StrVal), func(t *testing.T) {
+			got, err := tc.in.MarshalCBOR()
+			if tc.assertOnError != nil {
+				tc.assertOnError(t, err)
+			} else if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if diff := cmp.Diff(got, tc.want); diff != "" {
+				t.Errorf("unexpected difference between expected and actual output:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestUnmarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		in            []byte
+		want          IntOrString
+		assertOnError func(*testing.T, error)
+	}{
+		{
+			in: []byte{0xa0}, // {}
+			assertOnError: func(t *testing.T, err error) {
+				if err == nil {
+					t.Fatal("expected non-nil error")
+				}
+				const want = "cbor: cannot unmarshal map into Go value of type int32"
+				if got := err.Error(); got != want {
+					t.Fatalf("want error message %q, got %q", want, got)
+				}
+
+			},
+		},
+		{
+			in:   []byte{0x40},
+			want: FromString(""),
+		},
+		{
+			in:   []byte{0x43, 'a', 'b', 'c'},
+			want: FromString("abc"),
+		},
+		{
+			in:   []byte{0x00},
+			want: FromInt32(0), // min positive integer representable in one byte
+		},
+		{
+			in:   []byte{0x17},
+			want: FromInt32(23), // max positive integer representable in one byte
+		},
+		{
+			in:   []byte{0x18, 0x18},
+			want: FromInt32(24), // min positive integer representable in two bytes
+		},
+		{
+			in:   []byte{0x18, 0xff},
+			want: FromInt32(math.MaxUint8), // max positive integer representable in two bytes
+		},
+		{
+			in:   []byte{0x19, 0x01, 0x00},
+			want: FromInt32(math.MaxUint8 + 1), // min positive integer representable in three bytes
+		},
+		{
+			in:   []byte{0x19, 0xff, 0xff},
+			want: FromInt32(math.MaxUint16), // max positive integer representable in three bytes
+		},
+		{
+			in:   []byte{0x1a, 0x00, 0x01, 0x00, 0x00},
+			want: FromInt32(math.MaxUint16 + 1), // min positive integer representable in five bytes
+		},
+		{
+			in:   []byte{0x1a, 0x7f, 0xff, 0xff, 0xff},
+			want: FromInt32(math.MaxInt32), // max positive integer representable by Go int32
+		},
+		{
+			in:   []byte{0x20},
+			want: FromInt32(-1), // max negative integer representable in one byte
+		},
+		{
+			in:   []byte{0x37},
+			want: FromInt32(-24), // min negative integer representable in one byte
+		},
+		{
+			in:   []byte{0x38, 0x18},
+			want: FromInt32(-1 - 24), // max negative integer representable in two bytes
+		},
+		{
+			in:   []byte{0x38, 0xff},
+			want: FromInt32(-1 - math.MaxUint8), // min negative integer representable in two bytes
+		},
+		{
+			in:   []byte{0x39, 0x01, 0x00},
+			want: FromInt32(-2 - math.MaxUint8), // max negative integer representable in three bytes
+		},
+		{
+			in:   []byte{0x39, 0xff, 0xff},
+			want: FromInt32(-1 - math.MaxUint16), // min negative integer representable in three bytes
+		},
+		{
+			in:   []byte{0x3a, 0x00, 0x01, 0x00, 0x00},
+			want: FromInt32(-2 - math.MaxUint16), // max negative integer representable in five bytes
+		},
+		{
+			in:   []byte{0x3a, 0x7f, 0xff, 0xff, 0xff},
+			want: FromInt32(math.MinInt32), // min negative integer representable by Go int32
+		},
+	} {
+		t.Run(fmt.Sprintf("{Type:%d,IntVal:%d,StrVal:%q}", tc.want.Type, tc.want.IntVal, tc.want.StrVal), func(t *testing.T) {
+			var got IntOrString
+			err := got.UnmarshalCBOR(tc.in)
+			if tc.assertOnError != nil {
+				tc.assertOnError(t, err)
+			} else if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if diff := cmp.Diff(got, tc.want); diff != "" {
+				t.Errorf("unexpected difference between expected and actual output:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestIntOrStringRoundtripCBOR(t *testing.T) {
+	fuzzer := randfill.New()
+	for i := 0; i < 500; i++ {
+		var initial, final IntOrString
+		fuzzer.Fill(&initial)
+		b, err := cbor.Marshal(initial)
+		if err != nil {
+			t.Errorf("error encoding %v: %v", initial, err)
+			continue
+		}
+		err = cbor.Unmarshal(b, &final)
+		if err != nil {
+			t.Errorf("%v: error decoding %v: %v", initial, string(b), err)
+		}
+		if diff := cmp.Diff(initial, final); diff != "" {
+			diag, err := cbor.Diagnose(b)
+			if err != nil {
+				t.Logf("failed to produce diagnostic encoding of 0x%x: %v", b, err)
+			}
+			t.Errorf("unexpected diff:\n%s\ncbor: %s", diff, diag)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/zz_generated.model_name.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/zz_generated.model_name.go
new file mode 100644
index 0000000000..b2d6e0ae3c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/intstr/zz_generated.model_name.go
@@ -0,0 +1,27 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package intstr
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in IntOrString) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.util.intstr.IntOrString"
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/json/json.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/json/json.go
new file mode 100644
index 0000000000..55dba361c3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/json/json.go
@@ -0,0 +1,121 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+
+	kjson "sigs.k8s.io/json"
+)
+
+// NewEncoder delegates to json.NewEncoder
+// It is only here so this package can be a drop-in for common encoding/json uses
+func NewEncoder(w io.Writer) *json.Encoder {
+	return json.NewEncoder(w)
+}
+
+// Marshal delegates to json.Marshal
+// It is only here so this package can be a drop-in for common encoding/json uses
+func Marshal(v interface{}) ([]byte, error) {
+	return json.Marshal(v)
+}
+
+// limit recursive depth to prevent stack overflow errors
+const maxDepth = 10000
+
+// Unmarshal unmarshals the given data.
+// Object keys are case-sensitive.
+// Numbers decoded into interface{} fields are converted to int64 or float64.
+func Unmarshal(data []byte, v interface{}) error {
+	return kjson.UnmarshalCaseSensitivePreserveInts(data, v)
+}
+
+// ConvertInterfaceNumbers converts any json.Number values to int64 or float64.
+// Values which are map[string]interface{} or []interface{} are recursively visited
+func ConvertInterfaceNumbers(v *interface{}, depth int) error {
+	var err error
+	switch v2 := (*v).(type) {
+	case json.Number:
+		*v, err = convertNumber(v2)
+	case map[string]interface{}:
+		err = ConvertMapNumbers(v2, depth+1)
+	case []interface{}:
+		err = ConvertSliceNumbers(v2, depth+1)
+	}
+	return err
+}
+
+// ConvertMapNumbers traverses the map, converting any json.Number values to int64 or float64.
+// values which are map[string]interface{} or []interface{} are recursively visited
+func ConvertMapNumbers(m map[string]interface{}, depth int) error {
+	if depth > maxDepth {
+		return fmt.Errorf("exceeded max depth of %d", maxDepth)
+	}
+
+	var err error
+	for k, v := range m {
+		switch v := v.(type) {
+		case json.Number:
+			m[k], err = convertNumber(v)
+		case map[string]interface{}:
+			err = ConvertMapNumbers(v, depth+1)
+		case []interface{}:
+			err = ConvertSliceNumbers(v, depth+1)
+		}
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// ConvertSliceNumbers traverses the slice, converting any json.Number values to int64 or float64.
+// values which are map[string]interface{} or []interface{} are recursively visited
+func ConvertSliceNumbers(s []interface{}, depth int) error {
+	if depth > maxDepth {
+		return fmt.Errorf("exceeded max depth of %d", maxDepth)
+	}
+
+	var err error
+	for i, v := range s {
+		switch v := v.(type) {
+		case json.Number:
+			s[i], err = convertNumber(v)
+		case map[string]interface{}:
+			err = ConvertMapNumbers(v, depth+1)
+		case []interface{}:
+			err = ConvertSliceNumbers(v, depth+1)
+		}
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// convertNumber converts a json.Number to an int64 or float64, or returns an error
+func convertNumber(n json.Number) (interface{}, error) {
+	// Attempt to convert to an int64 first
+	if i, err := n.Int64(); err == nil {
+		return i, nil
+	}
+	// Return a float64 (default json.Decode() behavior)
+	// An overflow will return an error
+	return n.Float64()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/json/json_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/json/json_test.go
new file mode 100644
index 0000000000..8caaa274a7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/json/json_test.go
@@ -0,0 +1,418 @@
+//go:build go1.8
+
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	gojson "encoding/json"
+
+	"fmt"
+	"math"
+	"reflect"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+func TestEvaluateTypes(t *testing.T) {
+	testCases := []struct {
+		In   string
+		Data interface{}
+		Out  string
+		Err  bool
+	}{
+		// Invalid syntaxes
+		{
+			In:  `x`,
+			Err: true,
+		},
+		{
+			In:  ``,
+			Err: true,
+		},
+
+		// Null
+		{
+			In:   `null`,
+			Data: nil,
+			Out:  `null`,
+		},
+		// Booleans
+		{
+			In:   `true`,
+			Data: true,
+			Out:  `true`,
+		},
+		{
+			In:   `false`,
+			Data: false,
+			Out:  `false`,
+		},
+
+		// Integers
+		{
+			In:   `0`,
+			Data: int64(0),
+			Out:  `0`,
+		},
+		{
+			In:   `-0`,
+			Data: int64(-0),
+			Out:  `0`,
+		},
+		{
+			In:   `1`,
+			Data: int64(1),
+			Out:  `1`,
+		},
+		{
+			In:   `2147483647`,
+			Data: int64(math.MaxInt32),
+			Out:  `2147483647`,
+		},
+		{
+			In:   `-2147483648`,
+			Data: int64(math.MinInt32),
+			Out:  `-2147483648`,
+		},
+		{
+			In:   `9223372036854775807`,
+			Data: int64(math.MaxInt64),
+			Out:  `9223372036854775807`,
+		},
+		{
+			In:   `-9223372036854775808`,
+			Data: int64(math.MinInt64),
+			Out:  `-9223372036854775808`,
+		},
+
+		// Int overflow
+		{
+			In:   `9223372036854775808`, // MaxInt64 + 1
+			Data: float64(9223372036854775808),
+			Out:  `9223372036854776000`,
+		},
+		{
+			In:   `-9223372036854775809`, // MinInt64 - 1
+			Data: float64(math.MinInt64),
+			Out:  `-9223372036854776000`,
+		},
+
+		// Floats
+		{
+			In:   `0.0`,
+			Data: float64(0),
+			Out:  `0`,
+		},
+		{
+			In:   `-0.0`,
+			Data: float64(-0.0), //nolint:staticcheck // SA4026: in Go, the floating-point literal '-0.0' is the same as '0.0'
+			Out:  `-0`,
+		},
+		{
+			In:   `0.5`,
+			Data: float64(0.5),
+			Out:  `0.5`,
+		},
+		{
+			In:   `1e3`,
+			Data: float64(1e3),
+			Out:  `1000`,
+		},
+		{
+			In:   `1.5`,
+			Data: float64(1.5),
+			Out:  `1.5`,
+		},
+		{
+			In:   `-0.3`,
+			Data: float64(-.3),
+			Out:  `-0.3`,
+		},
+		{
+			// Largest representable float32
+			In:   `3.40282346638528859811704183484516925440e+38`,
+			Data: float64(math.MaxFloat32),
+			Out:  strconv.FormatFloat(math.MaxFloat32, 'g', -1, 64),
+		},
+		{
+			// Smallest float32 without losing precision
+			In:   `1.175494351e-38`,
+			Data: float64(1.175494351e-38),
+			Out:  `1.175494351e-38`,
+		},
+		{
+			// float32 closest to zero
+			In:   `1.401298464324817070923729583289916131280e-45`,
+			Data: float64(math.SmallestNonzeroFloat32),
+			Out:  strconv.FormatFloat(math.SmallestNonzeroFloat32, 'g', -1, 64),
+		},
+		{
+			// Largest representable float64
+			In:   `1.797693134862315708145274237317043567981e+308`,
+			Data: float64(math.MaxFloat64),
+			Out:  strconv.FormatFloat(math.MaxFloat64, 'g', -1, 64),
+		},
+		{
+			// Closest to zero without losing precision
+			In:   `2.2250738585072014e-308`,
+			Data: float64(2.2250738585072014e-308),
+			Out:  `2.2250738585072014e-308`,
+		},
+
+		{
+			// float64 closest to zero
+			In:   `4.940656458412465441765687928682213723651e-324`,
+			Data: float64(math.SmallestNonzeroFloat64),
+			Out:  strconv.FormatFloat(math.SmallestNonzeroFloat64, 'g', -1, 64),
+		},
+
+		{
+			// math.MaxFloat64 + 2 overflow
+			In:  `1.7976931348623159e+308`,
+			Err: true,
+		},
+
+		// Strings
+		{
+			In:   `""`,
+			Data: string(""),
+			Out:  `""`,
+		},
+		{
+			In:   `"0"`,
+			Data: string("0"),
+			Out:  `"0"`,
+		},
+		{
+			In:   `"A"`,
+			Data: string("A"),
+			Out:  `"A"`,
+		},
+		{
+			In:   `"Iñtërnâtiônàlizætiøn"`,
+			Data: string("Iñtërnâtiônàlizætiøn"),
+			Out:  `"Iñtërnâtiônàlizætiøn"`,
+		},
+
+		// Arrays
+		{
+			In:   `[]`,
+			Data: []interface{}{},
+			Out:  `[]`,
+		},
+		{
+			In: `[` + strings.Join([]string{
+				`null`,
+				`true`,
+				`false`,
+				`0`,
+				`9223372036854775807`,
+				`0.0`,
+				`0.5`,
+				`1.0`,
+				`1.797693134862315708145274237317043567981e+308`,
+				`"0"`,
+				`"A"`,
+				`"Iñtërnâtiônàlizætiøn"`,
+				`[null,true,1,1.0,1.5]`,
+				`{"boolkey":true,"floatkey":1.0,"intkey":1,"nullkey":null}`,
+			}, ",") + `]`,
+			Data: []interface{}{
+				nil,
+				true,
+				false,
+				int64(0),
+				int64(math.MaxInt64),
+				float64(0.0),
+				float64(0.5),
+				float64(1.0),
+				float64(math.MaxFloat64),
+				string("0"),
+				string("A"),
+				string("Iñtërnâtiônàlizætiøn"),
+				[]interface{}{nil, true, int64(1), float64(1.0), float64(1.5)},
+				map[string]interface{}{"nullkey": nil, "boolkey": true, "intkey": int64(1), "floatkey": float64(1.0)},
+			},
+			Out: `[` + strings.Join([]string{
+				`null`,
+				`true`,
+				`false`,
+				`0`,
+				`9223372036854775807`,
+				`0`,
+				`0.5`,
+				`1`,
+				strconv.FormatFloat(math.MaxFloat64, 'g', -1, 64),
+				`"0"`,
+				`"A"`,
+				`"Iñtërnâtiônàlizætiøn"`,
+				`[null,true,1,1,1.5]`,
+				`{"boolkey":true,"floatkey":1,"intkey":1,"nullkey":null}`, // gets alphabetized by Marshal
+			}, ",") + `]`,
+		},
+
+		// Maps
+		{
+			In:   `{}`,
+			Data: map[string]interface{}{},
+			Out:  `{}`,
+		},
+		{
+			In:   `{"boolkey":true,"floatkey":1.0,"intkey":1,"nullkey":null}`,
+			Data: map[string]interface{}{"nullkey": nil, "boolkey": true, "intkey": int64(1), "floatkey": float64(1.0)},
+			Out:  `{"boolkey":true,"floatkey":1,"intkey":1,"nullkey":null}`, // gets alphabetized by Marshal
+		},
+	}
+
+	for i, tc := range testCases {
+		t.Run(fmt.Sprintf("%d_map", i), func(t *testing.T) {
+			// decode the input as a map item
+			inputJSON := fmt.Sprintf(`{"data":%s}`, tc.In)
+			expectedJSON := fmt.Sprintf(`{"data":%s}`, tc.Out)
+			m := map[string]interface{}{}
+			err := Unmarshal([]byte(inputJSON), &m)
+			if tc.Err && err != nil {
+				// Expected error
+				return
+			}
+			if err != nil {
+				t.Fatalf("%s: error decoding: %v", tc.In, err)
+			}
+			if tc.Err {
+				t.Fatalf("%s: expected error, got none", tc.In)
+			}
+			data, ok := m["data"]
+			if !ok {
+				t.Fatalf("%s: decoded object missing data key: %#v", tc.In, m)
+			}
+			if !reflect.DeepEqual(tc.Data, data) {
+				t.Fatalf("%s: expected\n\t%#v (%v), got\n\t%#v (%v)", tc.In, tc.Data, reflect.TypeOf(tc.Data), data, reflect.TypeOf(data))
+			}
+
+			outputJSON, err := Marshal(m)
+			if err != nil {
+				t.Fatalf("%s: error encoding: %v", tc.In, err)
+			}
+
+			if expectedJSON != string(outputJSON) {
+				t.Fatalf("%s: expected\n\t%s, got\n\t%s", tc.In, expectedJSON, string(outputJSON))
+			}
+		})
+
+		t.Run(fmt.Sprintf("%d_slice", i), func(t *testing.T) {
+			// decode the input as an array item
+			inputJSON := fmt.Sprintf(`[0,%s]`, tc.In)
+			expectedJSON := fmt.Sprintf(`[0,%s]`, tc.Out)
+			m := []interface{}{}
+			err := Unmarshal([]byte(inputJSON), &m)
+			if tc.Err && err != nil {
+				// Expected error
+				return
+			}
+			if err != nil {
+				t.Fatalf("%s: error decoding: %v", tc.In, err)
+			}
+			if tc.Err {
+				t.Fatalf("%s: expected error, got none", tc.In)
+			}
+			if len(m) != 2 {
+				t.Fatalf("%s: decoded object wasn't the right length: %#v", tc.In, m)
+			}
+			data := m[1]
+			if !reflect.DeepEqual(tc.Data, data) {
+				t.Fatalf("%s: expected\n\t%#v (%v), got\n\t%#v (%v)", tc.In, tc.Data, reflect.TypeOf(tc.Data), data, reflect.TypeOf(data))
+			}
+
+			outputJSON, err := Marshal(m)
+			if err != nil {
+				t.Fatalf("%s: error encoding: %v", tc.In, err)
+			}
+
+			if expectedJSON != string(outputJSON) {
+				t.Fatalf("%s: expected\n\t%s, got\n\t%s", tc.In, expectedJSON, string(outputJSON))
+			}
+		})
+
+		t.Run(fmt.Sprintf("%d_raw", i), func(t *testing.T) {
+			// decode the input as a standalone object
+			inputJSON := tc.In
+			expectedJSON := tc.Out
+			var m interface{}
+			err := Unmarshal([]byte(inputJSON), &m)
+			if tc.Err && err != nil {
+				// Expected error
+				return
+			}
+			if err != nil {
+				t.Fatalf("%s: error decoding: %v", tc.In, err)
+			}
+			if tc.Err {
+				t.Fatalf("%s: expected error, got none", tc.In)
+			}
+			data := m
+			if !reflect.DeepEqual(tc.Data, data) {
+				t.Fatalf("%s: expected\n\t%#v (%v), got\n\t%#v (%v)", tc.In, tc.Data, reflect.TypeOf(tc.Data), data, reflect.TypeOf(data))
+			}
+
+			outputJSON, err := Marshal(m)
+			if err != nil {
+				t.Fatalf("%s: error encoding: %v", tc.In, err)
+			}
+
+			if expectedJSON != string(outputJSON) {
+				t.Fatalf("%s: expected\n\t%s, got\n\t%s", tc.In, expectedJSON, string(outputJSON))
+			}
+		})
+	}
+}
+
+func TestUnmarshalNil(t *testing.T) {
+	{
+		var v *interface{}
+		err := Unmarshal([]byte(`0`), v)
+		goerr := gojson.Unmarshal([]byte(`0`), v)
+		if err == nil || goerr == nil || err.Error() != goerr.Error() {
+			t.Fatalf("expected error matching stdlib, got %v, %v", err, goerr)
+		} else {
+			t.Log(err)
+		}
+	}
+
+	{
+		var v *[]interface{}
+		err := Unmarshal([]byte(`[]`), v)
+		goerr := gojson.Unmarshal([]byte(`[]`), v)
+		if err == nil || goerr == nil || err.Error() != goerr.Error() {
+			t.Fatalf("expected error matching stdlib, got %v, %v", err, goerr)
+		} else {
+			t.Log(err)
+		}
+	}
+
+	{
+		var v *map[string]interface{}
+		err := Unmarshal([]byte(`{}`), v)
+		goerr := gojson.Unmarshal([]byte(`{}`), v)
+		if err == nil || goerr == nil || err.Error() != goerr.Error() {
+			t.Fatalf("expected error matching stdlib, got %v, %v", err, goerr)
+		} else {
+			t.Log(err)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/jsonmergepatch/patch.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/jsonmergepatch/patch.go
new file mode 100644
index 0000000000..786c16e27a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/jsonmergepatch/patch.go
@@ -0,0 +1,160 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package jsonmergepatch
+
+import (
+	"fmt"
+	"reflect"
+
+	"gopkg.in/evanphx/json-patch.v4"
+	"k8s.io/apimachinery/pkg/util/json"
+	"k8s.io/apimachinery/pkg/util/mergepatch"
+)
+
+// Create a 3-way merge patch based-on JSON merge patch.
+// Calculate addition-and-change patch between current and modified.
+// Calculate deletion patch between original and modified.
+func CreateThreeWayJSONMergePatch(original, modified, current []byte, fns ...mergepatch.PreconditionFunc) ([]byte, error) {
+	if len(original) == 0 {
+		original = []byte(`{}`)
+	}
+	if len(modified) == 0 {
+		modified = []byte(`{}`)
+	}
+	if len(current) == 0 {
+		current = []byte(`{}`)
+	}
+
+	addAndChangePatch, err := jsonpatch.CreateMergePatch(current, modified)
+	if err != nil {
+		return nil, err
+	}
+	// Only keep addition and changes
+	addAndChangePatch, addAndChangePatchObj, err := keepOrDeleteNullInJsonPatch(addAndChangePatch, false)
+	if err != nil {
+		return nil, err
+	}
+
+	deletePatch, err := jsonpatch.CreateMergePatch(original, modified)
+	if err != nil {
+		return nil, err
+	}
+	// Only keep deletion
+	deletePatch, deletePatchObj, err := keepOrDeleteNullInJsonPatch(deletePatch, true)
+	if err != nil {
+		return nil, err
+	}
+
+	hasConflicts, err := mergepatch.HasConflicts(addAndChangePatchObj, deletePatchObj)
+	if err != nil {
+		return nil, err
+	}
+	if hasConflicts {
+		return nil, mergepatch.NewErrConflict(mergepatch.ToYAMLOrError(addAndChangePatchObj), mergepatch.ToYAMLOrError(deletePatchObj))
+	}
+	patch, err := jsonpatch.MergePatch(deletePatch, addAndChangePatch)
+	if err != nil {
+		return nil, err
+	}
+
+	var patchMap map[string]interface{}
+	err = json.Unmarshal(patch, &patchMap)
+	if err != nil {
+		return nil, fmt.Errorf("failed to unmarshal patch for precondition check: %s", patch)
+	}
+	meetPreconditions, err := meetPreconditions(patchMap, fns...)
+	if err != nil {
+		return nil, err
+	}
+	if !meetPreconditions {
+		return nil, mergepatch.NewErrPreconditionFailed(patchMap)
+	}
+
+	return patch, nil
+}
+
+// keepOrDeleteNullInJsonPatch takes a json-encoded byte array and a boolean.
+// It returns a filtered object and its corresponding json-encoded byte array.
+// It is a wrapper of func keepOrDeleteNullInObj
+func keepOrDeleteNullInJsonPatch(patch []byte, keepNull bool) ([]byte, map[string]interface{}, error) {
+	var patchMap map[string]interface{}
+	err := json.Unmarshal(patch, &patchMap)
+	if err != nil {
+		return nil, nil, err
+	}
+	filteredMap, err := keepOrDeleteNullInObj(patchMap, keepNull)
+	if err != nil {
+		return nil, nil, err
+	}
+	o, err := json.Marshal(filteredMap)
+	return o, filteredMap, err
+}
+
+// keepOrDeleteNullInObj will keep only the null value and delete all the others,
+// if keepNull is true. Otherwise, it will delete all the null value and keep the others.
+func keepOrDeleteNullInObj(m map[string]interface{}, keepNull bool) (map[string]interface{}, error) {
+	filteredMap := make(map[string]interface{})
+	var err error
+	for key, val := range m {
+		switch {
+		case keepNull && val == nil:
+			filteredMap[key] = nil
+		case val != nil:
+			switch typedVal := val.(type) {
+			case map[string]interface{}:
+				// Explicitly-set empty maps are treated as values instead of empty patches
+				if len(typedVal) == 0 {
+					if !keepNull {
+						filteredMap[key] = typedVal
+					}
+					continue
+				}
+
+				var filteredSubMap map[string]interface{}
+				filteredSubMap, err = keepOrDeleteNullInObj(typedVal, keepNull)
+				if err != nil {
+					return nil, err
+				}
+
+				// If the returned filtered submap was empty, this is an empty patch for the entire subdict, so the key
+				// should not be set
+				if len(filteredSubMap) != 0 {
+					filteredMap[key] = filteredSubMap
+				}
+
+			case []interface{}, string, float64, bool, int64, nil:
+				// Lists are always replaced in Json, no need to check each entry in the list.
+				if !keepNull {
+					filteredMap[key] = val
+				}
+			default:
+				return nil, fmt.Errorf("unknown type: %v", reflect.TypeOf(typedVal))
+			}
+		}
+	}
+	return filteredMap, nil
+}
+
+func meetPreconditions(patchObj map[string]interface{}, fns ...mergepatch.PreconditionFunc) (bool, error) {
+	// Apply the preconditions to the patch, and return an error if any of them fail.
+	for _, fn := range fns {
+		if !fn(patchObj) {
+			return false, fmt.Errorf("precondition failed for: %v", patchObj)
+		}
+	}
+	return true, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/jsonmergepatch/patch_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/jsonmergepatch/patch_test.go
new file mode 100644
index 0000000000..1a9eb0f874
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/jsonmergepatch/patch_test.go
@@ -0,0 +1,747 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package jsonmergepatch
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	jsonpatch "gopkg.in/evanphx/json-patch.v4"
+	"k8s.io/apimachinery/pkg/util/json"
+	"k8s.io/utils/dump"
+	"sigs.k8s.io/yaml"
+)
+
+type FilterNullTestCases struct {
+	TestCases []FilterNullTestCase
+}
+
+type FilterNullTestCase struct {
+	Description         string
+	OriginalObj         map[string]interface{}
+	ExpectedWithNull    map[string]interface{}
+	ExpectedWithoutNull map[string]interface{}
+}
+
+var filterNullTestCaseData = []byte(`
+testCases:
+  - description: nil original
+    originalObj: {}
+    expectedWithNull: {}
+    expectedWithoutNull: {}
+  - description: simple map
+    originalObj:
+      nilKey: null
+      nonNilKey: foo
+    expectedWithNull:
+      nilKey: null
+    expectedWithoutNull:
+      nonNilKey: foo
+  - description: simple map with all nil values
+    originalObj:
+      nilKey1: null
+      nilKey2: null
+    expectedWithNull:
+      nilKey1: null
+      nilKey2: null
+    expectedWithoutNull: {}
+  - description: simple map with all non-nil values
+    originalObj:
+      nonNilKey1: foo
+      nonNilKey2: bar
+    expectedWithNull: {}
+    expectedWithoutNull:
+      nonNilKey1: foo
+      nonNilKey2: bar
+  - description: nested map
+    originalObj:
+      mapKey:
+        nilKey: null
+        nonNilKey: foo
+    expectedWithNull:
+      mapKey:
+        nilKey: null
+    expectedWithoutNull:
+      mapKey:
+        nonNilKey: foo
+  - description: nested map that all subkeys are nil
+    originalObj:
+      mapKey:
+        nilKey1: null
+        nilKey2: null
+    expectedWithNull:
+      mapKey:
+        nilKey1: null
+        nilKey2: null
+    expectedWithoutNull: {}
+  - description: nested map that all subkeys are non-nil
+    originalObj:
+      mapKey:
+        nonNilKey1: foo
+        nonNilKey2: bar
+    expectedWithNull: {}
+    expectedWithoutNull:
+      mapKey:
+        nonNilKey1: foo
+        nonNilKey2: bar
+  - description: explicitly empty map as value
+    originalObj:
+      mapKey: {}
+    expectedWithNull: {}
+    expectedWithoutNull:
+      mapKey: {}
+  - description: explicitly empty nested map
+    originalObj:
+      mapKey:
+        nonNilKey: {}
+    expectedWithNull: {}
+    expectedWithoutNull:
+      mapKey:
+        nonNilKey: {}
+  - description: multiple expliclty empty nested maps
+    originalObj:
+      mapKey:
+        nonNilKey1: {}
+        nonNilKey2: {}
+    expectedWithNull: {}
+    expectedWithoutNull:
+      mapKey:
+        nonNilKey1: {}
+        nonNilKey2: {}
+  - description: nested map with non-null value as empty map
+    originalObj:
+      mapKey:
+        nonNilKey: {}
+        nilKey: null
+    expectedWithNull:
+      mapKey:
+        nilKey: null
+    expectedWithoutNull:
+      mapKey:
+        nonNilKey: {}
+  - description: empty list
+    originalObj:
+      listKey: []
+    expectedWithNull: {}
+    expectedWithoutNull:
+      listKey: []
+  - description: list of primitives
+    originalObj:
+      listKey:
+      - 1
+      - 2
+    expectedWithNull: {}
+    expectedWithoutNull:
+      listKey:
+      - 1
+      - 2
+  - description: list of maps
+    originalObj:
+      listKey:
+      - k1: v1
+      - k2: null
+      - k3: v3
+        k4: null
+    expectedWithNull: {}
+    expectedWithoutNull:
+      listKey:
+      - k1: v1
+      - k2: null
+      - k3: v3
+        k4: null
+  - description: list of different types
+    originalObj:
+      listKey:
+      - k1: v1
+      - k2: null
+      - v3
+    expectedWithNull: {}
+    expectedWithoutNull:
+      listKey:
+      - k1: v1
+      - k2: null
+      - v3
+`)
+
+func TestKeepOrDeleteNullInObj(t *testing.T) {
+	tc := FilterNullTestCases{}
+	err := yaml.Unmarshal(filterNullTestCaseData, &tc)
+	if err != nil {
+		t.Fatalf("can't unmarshal test cases: %s\n", err)
+	}
+
+	for _, test := range tc.TestCases {
+		resultWithNull, err := keepOrDeleteNullInObj(test.OriginalObj, true)
+		if err != nil {
+			t.Errorf("Failed in test case %q when trying to keep null values: %s", test.Description, err)
+		}
+		if !reflect.DeepEqual(test.ExpectedWithNull, resultWithNull) {
+			t.Errorf("Failed in test case %q when trying to keep null values:\nexpected expectedWithNull:\n%+v\nbut got:\n%+v\n", test.Description, test.ExpectedWithNull, resultWithNull)
+		}
+
+		resultWithoutNull, err := keepOrDeleteNullInObj(test.OriginalObj, false)
+		if err != nil {
+			t.Errorf("Failed in test case %q when trying to keep non-null values: %s", test.Description, err)
+		}
+		if !reflect.DeepEqual(test.ExpectedWithoutNull, resultWithoutNull) {
+			t.Errorf("Failed in test case %q when trying to keep non-null values:\n expected expectedWithoutNull:\n%+v\nbut got:\n%+v\n", test.Description, test.ExpectedWithoutNull, resultWithoutNull)
+		}
+	}
+}
+
+type JSONMergePatchTestCases struct {
+	TestCases []JSONMergePatchTestCase
+}
+
+type JSONMergePatchTestCase struct {
+	Description string
+	JSONMergePatchTestCaseData
+}
+
+type JSONMergePatchTestCaseData struct {
+	// Original is the original object (last-applied config in annotation)
+	Original map[string]interface{}
+	// Modified is the modified object (new config we want)
+	Modified map[string]interface{}
+	// Current is the current object (live config in the server)
+	Current map[string]interface{}
+	// ThreeWay is the expected three-way merge patch
+	ThreeWay map[string]interface{}
+	// Result is the expected object after applying the three-way patch on current object.
+	Result map[string]interface{}
+}
+
+var createJSONMergePatchTestCaseData = []byte(`
+testCases:
+  - description: nil original
+    modified:
+      name: 1
+      value: 1
+    current:
+      name: 1
+      other: a
+    threeWay:
+      value: 1
+    result:
+      name: 1
+      value: 1
+      other: a
+  - description: nil patch
+    original:
+      name: 1
+    modified:
+      name: 1
+    current:
+      name: 1
+    threeWay:
+      {}
+    result:
+      name: 1
+  - description: add field to map
+    original:
+      name: 1
+    modified:
+      name: 1
+      value: 1
+    current:
+      name: 1
+      other: a
+    threeWay:
+      value: 1
+    result:
+      name: 1
+      value: 1
+      other: a
+  - description: add field to map with conflict
+    original:
+      name: 1
+    modified:
+      name: 1
+      value: 1
+    current:
+      name: a
+      other: a
+    threeWay:
+      name: 1
+      value: 1
+    result:
+      name: 1
+      value: 1
+      other: a
+  - description: add field and delete field from map
+    original:
+      name: 1
+    modified:
+      value: 1
+    current:
+      name: 1
+      other: a
+    threeWay:
+      name: null
+      value: 1
+    result:
+      value: 1
+      other: a
+  - description: add field and delete field from map with conflict
+    original:
+      name: 1
+    modified:
+      value: 1
+    current:
+      name: a
+      other: a
+    threeWay:
+      name: null
+      value: 1
+    result:
+      value: 1
+      other: a
+  - description: delete field from nested map
+    original:
+      simpleMap:
+        key1: 1
+        key2: 1
+    modified:
+      simpleMap:
+        key1: 1
+    current:
+      simpleMap:
+        key1: 1
+        key2: 1
+        other: a
+    threeWay:
+      simpleMap:
+        key2: null
+    result:
+      simpleMap:
+        key1: 1
+        other: a
+  - description: delete field from nested map with conflict
+    original:
+      simpleMap:
+        key1: 1
+        key2: 1
+    modified:
+      simpleMap:
+        key1: 1
+    current:
+      simpleMap:
+        key1: a
+        key2: 1
+        other: a
+    threeWay:
+      simpleMap:
+        key1: 1
+        key2: null
+    result:
+      simpleMap:
+        key1: 1
+        other: a
+  - description: delete all fields from map
+    original:
+      name: 1
+      value: 1
+    modified: {}
+    current:
+      name: 1
+      value: 1
+      other: a
+    threeWay:
+      name: null
+      value: null
+    result:
+      other: a
+  - description: delete all fields from map with conflict
+    original:
+      name: 1
+      value: 1
+    modified: {}
+    current:
+      name: 1
+      value: a
+      other: a
+    threeWay:
+      name: null
+      value: null
+    result:
+      other: a
+  - description: add field and delete all fields from map
+    original:
+      name: 1
+      value: 1
+    modified:
+      other: a
+    current:
+      name: 1
+      value: 1
+      other: a
+    threeWay:
+      name: null
+      value: null
+    result:
+      other: a
+  - description: add field and delete all fields from map with conflict
+    original:
+      name: 1
+      value: 1
+    modified:
+      other: a
+    current:
+      name: 1
+      value: 1
+      other: b
+    threeWay:
+      name: null
+      value: null
+      other: a
+    result:
+      other: a
+  - description: replace list of scalars
+    original:
+      intList:
+        - 1
+        - 2
+    modified:
+      intList:
+        - 2
+        - 3
+    current:
+      intList:
+        - 1
+        - 2
+    threeWay:
+      intList:
+        - 2
+        - 3
+    result:
+      intList:
+        - 2
+        - 3
+  - description: replace list of scalars with conflict
+    original:
+      intList:
+        - 1
+        - 2
+    modified:
+      intList:
+        - 2
+        - 3
+    current:
+      intList:
+        - 1
+        - 4
+    threeWay:
+      intList:
+        - 2
+        - 3
+    result:
+      intList:
+        - 2
+        - 3
+  - description: patch with different scalar type
+    original:
+      foo: 1
+    modified:
+      foo: true
+    current:
+      foo: 1
+      bar: 2
+    threeWay:
+      foo: true
+    result:
+      foo: true
+      bar: 2
+  - description: patch from scalar to list
+    original:
+      foo: 0
+    modified:
+      foo:
+      - 1
+      - 2
+    current:
+      foo: 0
+      bar: 2
+    threeWay:
+      foo:
+      - 1
+      - 2
+    result:
+      foo:
+      - 1
+      - 2
+      bar: 2
+  - description: patch from list to scalar
+    original:
+      foo:
+      - 1
+      - 2
+    modified:
+      foo: 0
+    current:
+      foo:
+      - 1
+      - 2
+      bar: 2
+    threeWay:
+      foo: 0
+    result:
+      foo: 0
+      bar: 2
+  - description: patch from scalar to map
+    original:
+      foo: 0
+    modified:
+      foo:
+        baz: 1
+    current:
+      foo: 0
+      bar: 2
+    threeWay:
+      foo:
+        baz: 1
+    result:
+      foo:
+        baz: 1
+      bar: 2
+  - description: patch from map to scalar
+    original:
+      foo:
+        baz: 1
+    modified:
+      foo: 0
+    current:
+      foo:
+        baz: 1
+      bar: 2
+    threeWay:
+      foo: 0
+    result:
+      foo: 0
+      bar: 2
+  - description: patch from map to list
+    original:
+      foo:
+        baz: 1
+    modified:
+      foo:
+      - 1
+      - 2
+    current:
+      foo:
+        baz: 1
+      bar: 2
+    threeWay:
+      foo:
+      - 1
+      - 2
+    result:
+      foo:
+      - 1
+      - 2
+      bar: 2
+  - description: patch from list to map
+    original:
+      foo:
+      - 1
+      - 2
+    modified:
+      foo:
+        baz: 0
+    current:
+      foo:
+      - 1
+      - 2
+      bar: 2
+    threeWay:
+      foo:
+        baz: 0
+    result:
+      foo:
+        baz: 0
+      bar: 2
+  - description: patch with different nested types
+    original:
+      foo:
+      - a: true
+      - 2
+      - false
+    modified:
+      foo:
+      - 1
+      - false
+      - b: 1
+    current:
+      foo:
+      - a: true
+      - 2
+      - false
+      bar: 0
+    threeWay:
+      foo:
+      - 1
+      - false
+      - b: 1
+    result:
+      foo:
+      - 1
+      - false
+      - b: 1
+      bar: 0
+  - description: patch array with nil
+    original:
+      foo:
+      - a: true
+      - null
+      - false
+      bar: []
+      drop:
+      - 1
+    modified:
+      foo:
+      - 1
+      - false
+      - b: 1
+      bar:
+      - c
+      - null
+      - null
+      - a
+      drop:
+      - null
+    current:
+      foo:
+      - a: true
+      - 2
+      - false
+      bar:
+      - c
+      - null
+      - null
+      - a
+      drop:
+    threeWay:
+      foo:
+      - 1
+      - false
+      - b: 1
+      drop:
+      - null
+    result:
+      foo:
+      - 1
+      - false
+      - b: 1
+      drop:
+      - null
+      bar:
+      - c
+      - null
+      - null
+      - a
+`)
+
+func TestCreateThreeWayJSONMergePatch(t *testing.T) {
+	tc := JSONMergePatchTestCases{}
+	err := yaml.Unmarshal(createJSONMergePatchTestCaseData, &tc)
+	if err != nil {
+		t.Errorf("can't unmarshal test cases: %s\n", err)
+		return
+	}
+
+	for _, c := range tc.TestCases {
+		testThreeWayPatch(t, c)
+	}
+}
+
+func testThreeWayPatch(t *testing.T, c JSONMergePatchTestCase) {
+	original, modified, current, expected, result := threeWayTestCaseToJSONOrFail(t, c)
+	actual, err := CreateThreeWayJSONMergePatch(original, modified, current)
+	if err != nil {
+		t.Fatalf("error: %s", err)
+	}
+	testPatchCreation(t, expected, actual, c.Description)
+	testPatchApplication(t, current, actual, result, c.Description)
+}
+
+func testPatchCreation(t *testing.T, expected, actual []byte, description string) {
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("error in test case: %s\nexpected patch:\n%s\ngot:\n%s\n",
+			description, jsonToYAMLOrError(expected), jsonToYAMLOrError(actual))
+		return
+	}
+}
+
+func testPatchApplication(t *testing.T, original, patch, expected []byte, description string) {
+	result, err := jsonpatch.MergePatch(original, patch)
+	if err != nil {
+		t.Errorf("error: %s\nin test case: %s\ncannot apply patch:\n%s\nto original:\n%s\n",
+			err, description, jsonToYAMLOrError(patch), jsonToYAMLOrError(original))
+		return
+	}
+
+	if !reflect.DeepEqual(result, expected) {
+		format := "error in test case: %s\npatch application failed:\noriginal:\n%s\npatch:\n%s\nexpected:\n%s\ngot:\n%s\n"
+		t.Errorf(format, description,
+			jsonToYAMLOrError(original), jsonToYAMLOrError(patch),
+			jsonToYAMLOrError(expected), jsonToYAMLOrError(result))
+		return
+	}
+}
+
+func threeWayTestCaseToJSONOrFail(t *testing.T, c JSONMergePatchTestCase) ([]byte, []byte, []byte, []byte, []byte) {
+	return testObjectToJSONOrFail(t, c.Original),
+		testObjectToJSONOrFail(t, c.Modified),
+		testObjectToJSONOrFail(t, c.Current),
+		testObjectToJSONOrFail(t, c.ThreeWay),
+		testObjectToJSONOrFail(t, c.Result)
+}
+
+func testObjectToJSONOrFail(t *testing.T, o map[string]interface{}) []byte {
+	if o == nil {
+		return nil
+	}
+	j, err := toJSON(o)
+	if err != nil {
+		t.Error(err)
+	}
+	return j
+}
+
+func jsonToYAMLOrError(j []byte) string {
+	y, err := jsonToYAML(j)
+	if err != nil {
+		return err.Error()
+	}
+	return string(y)
+}
+
+func toJSON(v interface{}) ([]byte, error) {
+	j, err := json.Marshal(v)
+	if err != nil {
+		return nil, fmt.Errorf("json marshal failed: %v\n%v\n", err, dump.Pretty(v))
+	}
+	return j, nil
+}
+
+func jsonToYAML(j []byte) ([]byte, error) {
+	y, err := yaml.JSONToYAML(j)
+	if err != nil {
+		return nil, fmt.Errorf("json to yaml failed: %v\n%v\n", err, j)
+	}
+	return y, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/endpoints.yaml b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/endpoints.yaml
new file mode 100644
index 0000000000..a667e98342
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/endpoints.yaml
@@ -0,0 +1,7018 @@
+apiVersion: v1
+kind: Endpoints
+metadata:
+  creationTimestamp: '2016-10-04T17:45:58Z'
+  labels:
+    app: my-app
+  name: app-server
+  namespace: default
+  resourceVersion: '184597135'
+  selfLink: /self/link
+  uid: 6826f086-8a5a-11e6-8d09-42010a800005
+subsets:
+- addresses:
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0000
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0001
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0002
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0003
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0004
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0005
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0006
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0007
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0008
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0009
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0010
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0011
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0012
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0013
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0014
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0015
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0016
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0017
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0018
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0019
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0020
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0021
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0022
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0023
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0024
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0025
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0026
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0027
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0028
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0029
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0030
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0031
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0032
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0033
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0034
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0035
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0036
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0037
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0038
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0039
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0040
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0041
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0042
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0043
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0044
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0045
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0046
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0047
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0048
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0049
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0050
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0051
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0052
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0053
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0054
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0055
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0056
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0057
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0058
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0059
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0060
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0061
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0062
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0063
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0064
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0065
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0066
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0067
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0068
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0069
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0070
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0071
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0072
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0073
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0074
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0075
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0076
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0077
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0078
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0079
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0080
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0081
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0082
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0083
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0084
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0085
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0086
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0087
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0088
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0089
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0090
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0091
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0092
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0093
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0094
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0095
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0096
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0097
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0098
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0099
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0100
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0101
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0102
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0103
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0104
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0105
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0106
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0107
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0108
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0109
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0110
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0111
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0112
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0113
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0114
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0115
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0116
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0117
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0118
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0119
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0120
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0121
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0122
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0123
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0124
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0125
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0126
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0127
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0128
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0129
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0130
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0131
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0132
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0133
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0134
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0135
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0136
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0137
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0138
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0139
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0140
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0141
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0142
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0143
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0144
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0145
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0146
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0147
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0148
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0149
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0150
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0151
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0152
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0153
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0154
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0155
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0156
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0157
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0158
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0159
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0160
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0161
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0162
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0163
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0164
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0165
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0166
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0167
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0168
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0169
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0170
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0171
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0172
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0173
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0174
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0175
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0176
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0177
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0178
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0179
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0180
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0181
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0182
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0183
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0184
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0185
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0186
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0187
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0188
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0189
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0190
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0191
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0192
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0193
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0194
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0195
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0196
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0197
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0198
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0199
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0200
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0201
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0202
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0203
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0204
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0205
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0206
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0207
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0208
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0209
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0210
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0211
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0212
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0213
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0214
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0215
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0216
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0217
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0218
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0219
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0220
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0221
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0222
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0223
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0224
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0225
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0226
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0227
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0228
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0229
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0230
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0231
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0232
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0233
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0234
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0235
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0236
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0237
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0238
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0239
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0240
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0241
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0242
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0243
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0244
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0245
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0246
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0247
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0248
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0249
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0250
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0251
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0252
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0253
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0254
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0255
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0256
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0257
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0258
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0259
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0260
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0261
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0262
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0263
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0264
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0265
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0266
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0267
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0268
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0269
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0270
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0271
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0272
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0273
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0274
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0275
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0276
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0277
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0278
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0279
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0280
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0281
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0282
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0283
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0284
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0285
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0286
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0287
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0288
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0289
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0290
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0291
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0292
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0293
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0294
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0295
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0296
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0297
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0298
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0299
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0300
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0301
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0302
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0303
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0304
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0305
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0306
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0307
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0308
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0309
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0310
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0311
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0312
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0313
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0314
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0315
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0316
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0317
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0318
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0319
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0320
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0321
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0322
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0323
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0324
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0325
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0326
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0327
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0328
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0329
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0330
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0331
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0332
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0333
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0334
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0335
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0336
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0337
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0338
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0339
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0340
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0341
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0342
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0343
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0344
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0345
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0346
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0347
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0348
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0349
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0350
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0351
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0352
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0353
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0354
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0355
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0356
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0357
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0358
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0359
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0360
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0361
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0362
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0363
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0364
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0365
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0366
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0367
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0368
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0369
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0370
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0371
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0372
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0373
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0374
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0375
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0376
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0377
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0378
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0379
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0380
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0381
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0382
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0383
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0384
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0385
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0386
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0387
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0388
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0389
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0390
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0391
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0392
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0393
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0394
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0395
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0396
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0397
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0398
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0399
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0400
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0401
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0402
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0403
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0404
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0405
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0406
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0407
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0408
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0409
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0410
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0411
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0412
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0413
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0414
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0415
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0416
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0417
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0418
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0419
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0420
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0421
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0422
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0423
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0424
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0425
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0426
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0427
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0428
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0429
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0430
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0431
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0432
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0433
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0434
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0435
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0436
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0437
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0438
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0439
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0440
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0441
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0442
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0443
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0444
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0445
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0446
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0447
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0448
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0449
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0450
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0451
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0452
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0453
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0454
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0455
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0456
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0457
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0458
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0459
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0460
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0461
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0462
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0463
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0464
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0465
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0466
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0467
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0468
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0469
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0470
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0471
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0472
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0473
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0474
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0475
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0476
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0477
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0478
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0479
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0480
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0481
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0482
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0483
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0484
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0485
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0486
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0487
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0488
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0489
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0490
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0491
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0492
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0493
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0494
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0495
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0496
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0497
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0498
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0499
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0500
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0501
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0502
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0503
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0504
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0505
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0506
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0507
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0508
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0509
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0510
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0511
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0512
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0513
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0514
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0515
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0516
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0517
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0518
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0519
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0520
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0521
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0522
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0523
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0524
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0525
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0526
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0527
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0528
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0529
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0530
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0531
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0532
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0533
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0534
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0535
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0536
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0537
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0538
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0539
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0540
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0541
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0542
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0543
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0544
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0545
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0546
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0547
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0548
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0549
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0550
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0551
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0552
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0553
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0554
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0555
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0556
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0557
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0558
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0559
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0560
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0561
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0562
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0563
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0564
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0565
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0566
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0567
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0568
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0569
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0570
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0571
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0572
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0573
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0574
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0575
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0576
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0577
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0578
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0579
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0580
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0581
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0582
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0583
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0584
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0585
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0586
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0587
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0588
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0589
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0590
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0591
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0592
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0593
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0594
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0595
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0596
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0597
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0598
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0599
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0600
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0601
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0602
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0603
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0604
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0605
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0606
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0607
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0608
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0609
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0610
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0611
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0612
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0613
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0614
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0615
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0616
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0617
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0618
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0619
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0620
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0621
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0622
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0623
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0624
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0625
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0626
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0627
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0628
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0629
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0630
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0631
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0632
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0633
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0634
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0635
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0636
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0637
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0638
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0639
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0640
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0641
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0642
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0643
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0644
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0645
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0646
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0647
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0648
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0649
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0650
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0651
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0652
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0653
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0654
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0655
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0656
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0657
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0658
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0659
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0660
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0661
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0662
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0663
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0664
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0665
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0666
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0667
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0668
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0669
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0670
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0671
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0672
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0673
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0674
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0675
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0676
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0677
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0678
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0679
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0680
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0681
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0682
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0683
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0684
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0685
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0686
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0687
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0688
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0689
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0690
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0691
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0692
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0693
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0694
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0695
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0696
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0697
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0698
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0699
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0700
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0701
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0702
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0703
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0704
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0705
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0706
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0707
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0708
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0709
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0710
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0711
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0712
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0713
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0714
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0715
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0716
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0717
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0718
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0719
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0720
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0721
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0722
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0723
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0724
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0725
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0726
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0727
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0728
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0729
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0730
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0731
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0732
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0733
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0734
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0735
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0736
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0737
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0738
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0739
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0740
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0741
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0742
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0743
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0744
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0745
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0746
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0747
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0748
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0749
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0750
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0751
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0752
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0753
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0754
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0755
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0756
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0757
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0758
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0759
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0760
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0761
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0762
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0763
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0764
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0765
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0766
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0767
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0768
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0769
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0770
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0771
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0772
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0773
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0774
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0775
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0776
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0777
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0778
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0779
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0780
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0781
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0782
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0783
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0784
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0785
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0786
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0787
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0788
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0789
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0790
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0791
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0792
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0793
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0794
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0795
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0796
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0797
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0798
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0799
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0800
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0801
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0802
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0803
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0804
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0805
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0806
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0807
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0808
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0809
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0810
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0811
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0812
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0813
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0814
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0815
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0816
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0817
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0818
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0819
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0820
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0821
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0822
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0823
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0824
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0825
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0826
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0827
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0828
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0829
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0830
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0831
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0832
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0833
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0834
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0835
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0836
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0837
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0838
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0839
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0840
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0841
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0842
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0843
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0844
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0845
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0846
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0847
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0848
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0849
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0850
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0851
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0852
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0853
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0854
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0855
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0856
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0857
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0858
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0859
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0860
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0861
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0862
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0863
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0864
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0865
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0866
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0867
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0868
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0869
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0870
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0871
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0872
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0873
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0874
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0875
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0876
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0877
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0878
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0879
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0880
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0881
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0882
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0883
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0884
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0885
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0886
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0887
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0888
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0889
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0890
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0891
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0892
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0893
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0894
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0895
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0896
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0897
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0898
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0899
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0900
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0901
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0902
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0903
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0904
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0905
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0906
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0907
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0908
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0909
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0910
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0911
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0912
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0913
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0914
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0915
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0916
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0917
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0918
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0919
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0920
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0921
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0922
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0923
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0924
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0925
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0926
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0927
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0928
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0929
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0930
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0931
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0932
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0933
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0934
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0935
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0936
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0937
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0938
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0939
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0940
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0941
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0942
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0943
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0944
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0945
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0946
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0947
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0948
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0949
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0950
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0951
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0952
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0953
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0954
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0955
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0956
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0957
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0958
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0959
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0960
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0961
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0962
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0963
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0964
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0965
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0966
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0967
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0968
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0969
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0970
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0971
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0972
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0973
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0974
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0975
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0976
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0977
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0978
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0979
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0980
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0981
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0982
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0983
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0984
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0985
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0986
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0987
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0988
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0989
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0990
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0991
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0992
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0993
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0994
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0995
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0996
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0997
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0998
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0999
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  ports:
+  - name: port-name
+    port: 8080
+    protocol: TCP
+
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/extract.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/extract.go
new file mode 100644
index 0000000000..ff7dda1a50
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/extract.go
@@ -0,0 +1,107 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// ExtractInto extracts the applied configuration state from object for fieldManager
+// into applyConfiguration. If no managed fields are found for the given fieldManager,
+// no error is returned, but applyConfiguration is left unpopulated. It is possible
+// that no managed fields were found for the fieldManager because other field managers
+// have taken ownership of all the fields previously owned by the fieldManager. It is
+// also possible the fieldManager never owned fields.
+//
+// The provided object MUST bo a root resource object since subresource objects
+// do not contain their own managed fields. For example, an autoscaling.Scale
+// object read from a "scale" subresource does not have any managed fields and so
+// cannot be used as the object.
+//
+// If the fields of a subresource are a subset of the fields of the root object,
+// and their field paths and types are exactly the same, then ExtractInto can be
+// called with the root resource as the object and the subresource as the
+// applyConfiguration. This works for "status", obviously, because status is
+// represented by the exact same object as the root resource. This does NOT
+// work, for example, with the "scale" subresources of Deployment, ReplicaSet and
+// StatefulSet. While the spec.replicas, status.replicas fields are in the same
+// exact field path locations as they are in autoscaling.Scale, the selector
+// fields are in different locations, and are a different type.
+func ExtractInto(object runtime.Object, objectType typed.ParseableType, fieldManager string, applyConfiguration interface{}, subresource string) error {
+	typedObj, err := toTyped(object, objectType)
+	if err != nil {
+		return fmt.Errorf("error converting obj to typed: %w", err)
+	}
+
+	accessor, err := meta.Accessor(object)
+	if err != nil {
+		return fmt.Errorf("error accessing metadata: %w", err)
+	}
+	fieldsEntry, ok := findManagedFields(accessor, fieldManager, subresource)
+	if !ok {
+		return nil
+	}
+	fieldset := &fieldpath.Set{}
+	err = fieldset.FromJSON(fieldsEntry.FieldsV1.GetRawReader())
+	if err != nil {
+		return fmt.Errorf("error marshalling FieldsV1 to JSON: %w", err)
+	}
+
+	u := typedObj.ExtractItems(fieldset.Leaves()).AsValue().Unstructured()
+	m, ok := u.(map[string]interface{})
+	if !ok {
+		return fmt.Errorf("unable to convert managed fields for %s to unstructured, expected map, got %T", fieldManager, u)
+	}
+
+	// set the type meta manually if it doesn't exist to avoid missing kind errors
+	// when decoding from unstructured JSON
+	if _, ok := m["kind"]; !ok && object.GetObjectKind().GroupVersionKind().Kind != "" {
+		m["kind"] = object.GetObjectKind().GroupVersionKind().Kind
+		m["apiVersion"] = object.GetObjectKind().GroupVersionKind().GroupVersion().String()
+	}
+	if err := runtime.DefaultUnstructuredConverter.FromUnstructured(m, applyConfiguration); err != nil {
+		return fmt.Errorf("error extracting into obj from unstructured: %w", err)
+	}
+	return nil
+}
+
+func findManagedFields(accessor metav1.Object, fieldManager string, subresource string) (metav1.ManagedFieldsEntry, bool) {
+	objManagedFields := accessor.GetManagedFields()
+	for _, mf := range objManagedFields {
+		if mf.Manager == fieldManager && mf.Operation == metav1.ManagedFieldsOperationApply && mf.Subresource == subresource {
+			return mf, true
+		}
+	}
+	return metav1.ManagedFieldsEntry{}, false
+}
+
+func toTyped(obj runtime.Object, objectType typed.ParseableType) (*typed.TypedValue, error) {
+	switch o := obj.(type) {
+	case *unstructured.Unstructured:
+		return objectType.FromUnstructured(o.Object)
+	default:
+		return objectType.FromStructured(o)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/extract_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/extract_test.go
new file mode 100644
index 0000000000..50d6273de0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/extract_test.go
@@ -0,0 +1,272 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+
+	"k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	runtimeschema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestExtractInto(t *testing.T) {
+	one := int32(1)
+	parser, err := typed.NewParser(schemaYAML)
+	if err != nil {
+		t.Fatalf("Failed to parse schema: %v", err)
+	}
+	cases := []struct {
+		name          string
+		obj           runtime.Object
+		objType       typed.ParseableType
+		managedFields []metav1.ManagedFieldsEntry // written to object before test is run
+		fieldManager  string
+		expectedOut   interface{}
+		subresource   string
+	}{
+		{
+			name:    "unstructured, no matching manager",
+			obj:     &unstructured.Unstructured{Object: map[string]interface{}{"spec": map[string]interface{}{"replicas": 1}}},
+			objType: parser.Type("io.k8s.api.apps.v1.Deployment"),
+			managedFields: []metav1.ManagedFieldsEntry{
+				applyFieldsEntry("mgr999", `{ "f:spec": { "f:replicas": {}}}`, ""),
+			},
+			fieldManager: "mgr1",
+			expectedOut:  map[string]interface{}{},
+		},
+		{
+			name:    "unstructured, one manager",
+			obj:     &unstructured.Unstructured{Object: map[string]interface{}{"spec": map[string]interface{}{"replicas": 1}}},
+			objType: parser.Type("io.k8s.api.apps.v1.Deployment"),
+			managedFields: []metav1.ManagedFieldsEntry{
+				applyFieldsEntry("mgr1", `{ "f:spec": { "f:replicas": {}}}`, ""),
+			},
+			fieldManager: "mgr1",
+			expectedOut:  map[string]interface{}{"spec": map[string]interface{}{"replicas": 1}},
+		},
+		{
+			name:    "unstructured, multiple manager",
+			obj:     &unstructured.Unstructured{Object: map[string]interface{}{"spec": map[string]interface{}{"paused": true}}},
+			objType: parser.Type("io.k8s.api.apps.v1.Deployment"),
+			managedFields: []metav1.ManagedFieldsEntry{
+				applyFieldsEntry("mgr1", `{ "f:spec": { "f:replicas": {}}}`, ""),
+				applyFieldsEntry("mgr2", `{ "f:spec": { "f:paused": {}}}`, ""),
+			},
+			fieldManager: "mgr2",
+			expectedOut:  map[string]interface{}{"spec": map[string]interface{}{"paused": true}},
+		},
+		{
+			name:    "structured, no matching manager",
+			obj:     &fakeDeployment{Spec: fakeDeploymentSpec{Replicas: &one}},
+			objType: parser.Type("io.k8s.api.apps.v1.Deployment"),
+			managedFields: []metav1.ManagedFieldsEntry{
+				applyFieldsEntry("mgr999", `{ "f:spec": { "f:replicas": {}}}`, ""),
+			},
+			fieldManager: "mgr1",
+			expectedOut:  map[string]interface{}{},
+		},
+		{
+			name:    "structured, one manager",
+			obj:     &fakeDeployment{Spec: fakeDeploymentSpec{Replicas: &one}},
+			objType: parser.Type("io.k8s.api.apps.v1.Deployment"),
+			managedFields: []metav1.ManagedFieldsEntry{
+				applyFieldsEntry("mgr1", `{ "f:spec": { "f:replicas": {}}}`, ""),
+			},
+			fieldManager: "mgr1",
+			expectedOut:  map[string]interface{}{"spec": map[string]interface{}{"replicas": int64(1)}},
+		},
+		{
+			name:    "structured, multiple manager",
+			obj:     &fakeDeployment{Spec: fakeDeploymentSpec{Replicas: &one, Paused: true}},
+			objType: parser.Type("io.k8s.api.apps.v1.Deployment"),
+			managedFields: []metav1.ManagedFieldsEntry{
+				applyFieldsEntry("mgr1", `{ "f:spec": { "f:replicas": {}}}`, ""),
+				applyFieldsEntry("mgr2", `{ "f:spec": { "f:paused": {}}}`, ""),
+			},
+			fieldManager: "mgr2",
+			expectedOut:  map[string]interface{}{"spec": map[string]interface{}{"paused": true}},
+		},
+		{
+			name:    "subresource",
+			obj:     &fakeDeployment{Status: fakeDeploymentStatus{Replicas: &one}},
+			objType: parser.Type("io.k8s.api.apps.v1.Deployment"),
+			managedFields: []metav1.ManagedFieldsEntry{
+				applyFieldsEntry("mgr1", `{ "f:status": { "f:replicas": {}}}`, "status"),
+			},
+			fieldManager: "mgr1",
+			expectedOut:  map[string]interface{}{"status": map[string]interface{}{"replicas": int64(1)}},
+			subresource:  "status",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			out := map[string]interface{}{}
+			accessor, err := meta.Accessor(tc.obj)
+			if err != nil {
+				t.Fatalf("Error accessing object: %v", err)
+			}
+			accessor.SetManagedFields(tc.managedFields)
+			err = ExtractInto(tc.obj, tc.objType, tc.fieldManager, &out, tc.subresource)
+			if err != nil {
+				t.Fatalf("Unexpected extract error: %v", err)
+			}
+			if !equality.Semantic.DeepEqual(out, tc.expectedOut) {
+				t.Fatalf("Expected output did not match actual output: %s", cmp.Diff(out, tc.expectedOut))
+			}
+		})
+	}
+}
+
+func applyFieldsEntry(fieldManager string, fieldsJSON string, subresource string) metav1.ManagedFieldsEntry {
+	return metav1.ManagedFieldsEntry{
+		Manager:     fieldManager,
+		Operation:   metav1.ManagedFieldsOperationApply,
+		APIVersion:  "v1",
+		FieldsType:  "FieldsV1",
+		FieldsV1:    metav1.NewFieldsV1(fieldsJSON),
+		Subresource: subresource,
+	}
+}
+
+type fakeDeployment struct {
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	Spec              fakeDeploymentSpec   `json:"spec"`
+	Status            fakeDeploymentStatus `json:"status"`
+}
+
+type fakeDeploymentSpec struct {
+	Replicas *int32 `json:"replicas"`
+	Paused   bool   `json:"paused,omitempty"`
+}
+
+type fakeDeploymentStatus struct {
+	Replicas *int32 `json:"replicas"`
+}
+
+func (o *fakeDeployment) GetObjectMeta() metav1.ObjectMeta {
+	return o.ObjectMeta
+}
+func (o *fakeDeployment) GetObjectKind() runtimeschema.ObjectKind {
+	return runtimeschema.EmptyObjectKind
+}
+func (o *fakeDeployment) DeepCopyObject() runtime.Object {
+	return o
+}
+
+// trimmed up schema for test purposes
+const schemaYAML = typed.YAMLObject(`types:
+- name: io.k8s.api.apps.v1.Deployment
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+    - name: spec
+      type:
+        namedType: io.k8s.api.apps.v1.DeploymentSpec
+    - name: status
+      type:
+        namedType: io.k8s.api.apps.v1.DeploymentStatus
+- name: io.k8s.api.apps.v1.DeploymentSpec
+  map:
+    fields:
+    - name: paused
+      type:
+        scalar: boolean
+    - name: replicas
+      type:
+        scalar: numeric
+- name: io.k8s.api.apps.v1.DeploymentStatus
+  map:
+    fields:
+    - name: replicas
+      type:
+        scalar: numeric
+- name: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+  map:
+    fields:
+    - name: creationTimestamp
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+    - name: managedFields
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry
+          elementRelationship: atomic
+- name: io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: fieldsType
+      type:
+        scalar: string
+    - name: fieldsV1
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1
+    - name: manager
+      type:
+        scalar: string
+    - name: operation
+      type:
+        scalar: string
+    - name: time
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+    - name: subresource
+      type:
+        scalar: string
+- name: io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1
+  map:
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+- name: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+  scalar: untyped
+- name: __untyped_atomic_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+`)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/fieldmanager.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/fieldmanager.go
new file mode 100644
index 0000000000..b1e621f390
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/fieldmanager.go
@@ -0,0 +1,58 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+)
+
+// FieldManager updates the managed fields and merges applied
+// configurations.
+type FieldManager = internal.FieldManager
+
+// NewDefaultFieldManager creates a new FieldManager that merges apply requests
+// and update managed fields for other types of requests.
+func NewDefaultFieldManager(typeConverter TypeConverter, objectConverter runtime.ObjectConvertor, objectDefaulter runtime.ObjectDefaulter, objectCreater runtime.ObjectCreater, kind schema.GroupVersionKind, hub schema.GroupVersion, subresource string, resetFields map[fieldpath.APIVersion]fieldpath.Filter) (*FieldManager, error) {
+	f, err := internal.NewStructuredMergeManager(typeConverter, objectConverter, objectDefaulter, kind.GroupVersion(), hub, resetFields)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create field manager: %v", err)
+	}
+	return internal.NewDefaultFieldManager(f, typeConverter, objectConverter, objectCreater, kind, subresource), nil
+}
+
+// NewDefaultCRDFieldManager creates a new FieldManager specifically for
+// CRDs. This allows for the possibility of fields which are not defined
+// in models, as well as having no models defined at all.
+func NewDefaultCRDFieldManager(typeConverter TypeConverter, objectConverter runtime.ObjectConvertor, objectDefaulter runtime.ObjectDefaulter, objectCreater runtime.ObjectCreater, kind schema.GroupVersionKind, hub schema.GroupVersion, subresource string, resetFields map[fieldpath.APIVersion]fieldpath.Filter) (_ *FieldManager, err error) {
+	f, err := internal.NewCRDStructuredMergeManager(typeConverter, objectConverter, objectDefaulter, kind.GroupVersion(), hub, resetFields)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create field manager: %v", err)
+	}
+	return internal.NewDefaultFieldManager(f, typeConverter, objectConverter, objectCreater, kind, subresource), nil
+}
+
+func ValidateManagedFields(encodedManagedFields []metav1.ManagedFieldsEntry) error {
+	_, err := internal.DecodeManagedFields(encodedManagedFields)
+	return err
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/fieldmanager_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/fieldmanager_test.go
new file mode 100644
index 0000000000..6ba8dc5679
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/fieldmanager_test.go
@@ -0,0 +1,1139 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	"k8s.io/apimachinery/pkg/util/managedfields/managedfieldstest"
+	yamlutil "k8s.io/apimachinery/pkg/util/yaml"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+	"sigs.k8s.io/yaml"
+)
+
+var fakeTypeConverter = func() managedfields.TypeConverter {
+	data, err := os.ReadFile(filepath.Join(strings.Repeat(".."+string(filepath.Separator), 7),
+		"api", "openapi-spec", "swagger.json"))
+	if err != nil {
+		panic(err)
+	}
+	swag := spec.Swagger{}
+	if err := json.Unmarshal(data, &swag); err != nil {
+		panic(err)
+	}
+	convertedDefs := map[string]*spec.Schema{}
+	for k, v := range swag.Definitions {
+		vCopy := v
+		convertedDefs[k] = &vCopy
+	}
+	typeConverter, err := managedfields.NewTypeConverter(convertedDefs, false)
+	if err != nil {
+		panic(err)
+	}
+	return typeConverter
+}()
+
+// TestUpdateApplyConflict tests that applying to an object, which
+// wasn't created by apply, will give conflicts
+func TestUpdateApplyConflict(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	patch := []byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+		"metadata": {
+			"name": "deployment",
+			"labels": {"app": "nginx"}
+		},
+		"spec": {
+                        "replicas": 3,
+                        "selector": {
+                                "matchLabels": {
+                                         "app": "nginx"
+                                }
+                        },
+                        "template": {
+                                "metadata": {
+                                        "labels": {
+                                                "app": "nginx"
+                                        }
+                                },
+                                "spec": {
+				        "containers": [{
+					        "name":  "nginx",
+					        "image": "nginx:latest"
+				        }]
+                                }
+                        }
+		}
+	}`)
+	newObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal(patch, &newObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	if err := f.Update(newObj, "fieldmanager_test"); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+		"metadata": {
+			"name": "deployment",
+		},
+		"spec": {
+			"replicas": 101,
+		}
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	err := f.Apply(appliedObj, "fieldmanager_conflict", false)
+	if err == nil || !apierrors.IsConflict(err) {
+		t.Fatalf("Expecting to get conflicts but got %v", err)
+	}
+}
+
+func TestApplyStripsFields(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	newObj := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": "apps/v1",
+			"kind":       "Deployment",
+		},
+	}
+
+	newObj.SetName("b")
+	newObj.SetNamespace("b")
+	newObj.SetUID("b")
+	newObj.SetGeneration(0)
+	newObj.SetResourceVersion("b")
+	newObj.SetCreationTimestamp(metav1.NewTime(time.Now()))
+	newObj.SetManagedFields([]metav1.ManagedFieldsEntry{
+		{
+			Manager:    "update",
+			Operation:  metav1.ManagedFieldsOperationApply,
+			APIVersion: "apps/v1",
+		},
+	})
+	if err := f.Update(newObj, "fieldmanager_test"); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	if m := f.ManagedFields(); len(m) != 0 {
+		t.Fatalf("fields did not get stripped: %v", m)
+	}
+}
+
+func TestVersionCheck(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	// patch has 'apiVersion: apps/v1' and live version is apps/v1 -> no errors
+	err := f.Apply(appliedObj, "fieldmanager_test", false)
+	if err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	appliedObj = &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1beta1",
+		"kind": "Deployment",
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	// patch has 'apiVersion: apps/v1beta1' but live version is apps/v1 -> error
+	err = f.Apply(appliedObj, "fieldmanager_test", false)
+	if err == nil {
+		t.Fatalf("expected an error from mismatched patch and live versions")
+	}
+	switch typ := err.(type) {
+	default:
+		t.Fatalf("expected error to be of type %T was %T (%v)", apierrors.StatusError{}, typ, err)
+	case apierrors.APIStatus:
+		if typ.Status().Code != http.StatusBadRequest {
+			t.Fatalf("expected status code to be %d but was %d",
+				http.StatusBadRequest, typ.Status().Code)
+		}
+	}
+}
+
+func TestVersionCheckDoesNotPanic(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	// patch has 'apiVersion: apps/v1' and live version is apps/v1 -> no errors
+	err := f.Apply(appliedObj, "fieldmanager_test", false)
+	if err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	appliedObj = &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	// patch has 'apiVersion: apps/v2' but live version is apps/v1 -> error
+	err = f.Apply(appliedObj, "fieldmanager_test", false)
+	if err == nil {
+		t.Fatalf("expected an error from mismatched patch and live versions")
+	}
+	switch typ := err.(type) {
+	default:
+		t.Fatalf("expected error to be of type %T was %T (%v)", apierrors.StatusError{}, typ, err)
+	case apierrors.APIStatus:
+		if typ.Status().Code != http.StatusBadRequest {
+			t.Fatalf("expected status code to be %d but was %d",
+				http.StatusBadRequest, typ.Status().Code)
+		}
+	}
+}
+
+func TestApplyDoesNotStripLabels(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"))
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"labels": {
+				"a": "b"
+			},
+		}
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	err := f.Apply(appliedObj, "fieldmanager_test", false)
+	if err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	if m := f.ManagedFields(); len(m) != 1 {
+		t.Fatalf("labels shouldn't get stripped on apply: %v", m)
+	}
+}
+
+func getObjectBytes(file string) []byte {
+	s, err := os.ReadFile(file)
+	if err != nil {
+		panic(err)
+	}
+	return s
+}
+
+func TestApplyNewObject(t *testing.T) {
+	tests := []struct {
+		gvk schema.GroupVersionKind
+		obj []byte
+	}{
+		{
+			gvk: schema.FromAPIVersionAndKind("v1", "Pod"),
+			obj: getObjectBytes("pod.yaml"),
+		},
+		{
+			gvk: schema.FromAPIVersionAndKind("v1", "Node"),
+			obj: getObjectBytes("node.yaml"),
+		},
+		{
+			gvk: schema.FromAPIVersionAndKind("v1", "Endpoints"),
+			obj: getObjectBytes("endpoints.yaml"),
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.gvk.String(), func(t *testing.T) {
+			f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, test.gvk)
+
+			appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+			if err := yaml.Unmarshal(test.obj, &appliedObj.Object); err != nil {
+				t.Fatalf("error decoding YAML: %v", err)
+			}
+
+			if err := f.Apply(appliedObj, "fieldmanager_test", false); err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+
+func TestApplyFailsWithManagedFields(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"))
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"managedFields": [
+				{
+				  "manager": "test",
+				}
+			]
+		}
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	err := f.Apply(appliedObj, "fieldmanager_test", false)
+
+	if err == nil {
+		t.Fatalf("successfully applied with set managed fields")
+	}
+}
+
+func TestApplySuccessWithNoManagedFields(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"))
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"labels": {
+				"a": "b"
+			},
+		}
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+	err := f.Apply(appliedObj, "fieldmanager_test", false)
+
+	if err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+}
+
+// Run an update and apply, and make sure that nothing has changed.
+func TestNoOpChanges(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"))
+
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"labels": {
+				"a": "b"
+			},
+			"creationTimestamp": null,
+		}
+	}`), &obj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+	if err := f.Apply(obj.DeepCopyObject(), "fieldmanager_test_apply", false); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+	before := f.Live()
+	// Wait to make sure the timestamp is different
+	time.Sleep(time.Second)
+	// Applying with a different fieldmanager will create an entry..
+	if err := f.Apply(obj.DeepCopyObject(), "fieldmanager_test_apply_other", false); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+	if reflect.DeepEqual(before, f.Live()) {
+		t.Fatalf("Applying no-op apply with new manager didn't change object: \n%v", f.Live())
+	}
+	before = f.Live()
+	// Wait to make sure the timestamp is different
+	time.Sleep(time.Second)
+	if err := f.Update(obj.DeepCopyObject(), "fieldmanager_test_update"); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+	if !reflect.DeepEqual(before, f.Live()) {
+		t.Fatalf("No-op update has changed the object:\n%v\n---\n%v", before, f.Live())
+	}
+	before = f.Live()
+	// Wait to make sure the timestamp is different
+	time.Sleep(time.Second)
+	if err := f.Apply(obj.DeepCopyObject(), "fieldmanager_test_apply", true); err != nil {
+		t.Fatalf("failed to re-apply object: %v", err)
+	}
+	if !reflect.DeepEqual(before, f.Live()) {
+		t.Fatalf("No-op apply has changed the object:\n%v\n---\n%v", before, f.Live())
+	}
+}
+
+// Tests that one can reset the managedFields by sending either an empty
+// list
+func TestResetManagedFieldsEmptyList(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"))
+
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"labels": {
+				"a": "b"
+			},
+		}
+	}`), &obj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+	if err := f.Apply(obj, "fieldmanager_test_apply", false); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"managedFields": [],
+			"labels": {
+				"a": "b"
+			},
+		}
+	}`), &obj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+	if err := f.Update(obj, "update_manager"); err != nil {
+		t.Fatalf("failed to update with empty manager: %v", err)
+	}
+
+	if len(f.ManagedFields()) != 0 {
+		t.Fatalf("failed to reset managedFields: %v", f.ManagedFields())
+	}
+}
+
+// Tests that one can reset the managedFields by sending either a list with one empty item.
+func TestResetManagedFieldsEmptyItem(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"))
+
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"labels": {
+				"a": "b"
+			},
+		}
+	}`), &obj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+	if err := f.Apply(obj, "fieldmanager_test_apply", false); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"managedFields": [{}],
+			"labels": {
+				"a": "b"
+			},
+		}
+	}`), &obj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+	if err := f.Update(obj, "update_manager"); err != nil {
+		t.Fatalf("failed to update with empty manager: %v", err)
+	}
+
+	if len(f.ManagedFields()) != 0 {
+		t.Fatalf("failed to reset managedFields: %v", f.ManagedFields())
+	}
+}
+
+func TestServerSideApplyWithInvalidLastApplied(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	// create object with client-side apply
+	newObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	deployment := []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app-v1
+spec:
+  replicas: 1
+`)
+	if err := yaml.Unmarshal(deployment, &newObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+
+	invalidLastApplied := "invalid-object"
+	if err := internal.SetLastApplied(newObj, invalidLastApplied); err != nil {
+		t.Errorf("failed to set last applied: %v", err)
+	}
+
+	if err := f.Update(newObj, "kubectl-client-side-apply-test"); err != nil {
+		t.Errorf("failed to update object: %v", err)
+	}
+
+	lastApplied, err := getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+	if lastApplied != invalidLastApplied {
+		t.Errorf("expected last applied annotation to be set to %q, but got: %q", invalidLastApplied, lastApplied)
+	}
+
+	// upgrade management of the object from client-side apply to server-side apply
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	appliedDeployment := []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app-v2
+spec:
+  replicas: 100
+`)
+	if err := yaml.Unmarshal(appliedDeployment, &appliedObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+
+	if err := f.Apply(appliedObj, "kubectl", false); err == nil || !apierrors.IsConflict(err) {
+		t.Errorf("expected conflict when applying with invalid last-applied annotation, but got no error for object: \n%+v", appliedObj)
+	}
+
+	lastApplied, err = getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+	if lastApplied != invalidLastApplied {
+		t.Errorf("expected last applied annotation to be NOT be updated, but got: %q", lastApplied)
+	}
+
+	// force server-side apply should work and fix the annotation
+	if err := f.Apply(appliedObj, "kubectl", true); err != nil {
+		t.Errorf("failed to force server-side apply with: %v", err)
+	}
+
+	lastApplied, err = getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+	if lastApplied == invalidLastApplied ||
+		!strings.Contains(lastApplied, "my-app-v2") {
+		t.Errorf("expected last applied annotation to be updated, but got: %q", lastApplied)
+	}
+}
+
+func TestInteropForClientSideApplyAndServerSideApply(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	// create object with client-side apply
+	newObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	deployment := []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-v1
+`)
+	if err := yaml.Unmarshal(deployment, &newObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+	if err := setLastAppliedFromEncoded(newObj, deployment); err != nil {
+		t.Errorf("failed to set last applied: %v", err)
+	}
+
+	if err := f.Update(newObj, "kubectl-client-side-apply-test"); err != nil {
+		t.Errorf("failed to update object: %v", err)
+	}
+	lastApplied, err := getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+	if !strings.Contains(lastApplied, "my-image-v1") {
+		t.Errorf("expected last applied annotation to be set properly, but got: %q", lastApplied)
+	}
+
+	// upgrade management of the object from client-side apply to server-side apply
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	appliedDeployment := []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app-v2 # change
+spec:
+  replicas: 8 # change
+  selector:
+    matchLabels:
+      app: my-app-v2 # change
+  template:
+    metadata:
+      labels:
+        app: my-app-v2 # change
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-v2 # change
+`)
+	if err := yaml.Unmarshal(appliedDeployment, &appliedObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+
+	if err := f.Apply(appliedObj, "kubectl", false); err != nil {
+		t.Errorf("error applying object: %v", err)
+	}
+
+	lastApplied, err = getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+	if !strings.Contains(lastApplied, "my-image-v2") {
+		t.Errorf("expected last applied annotation to be updated, but got: %q", lastApplied)
+	}
+}
+
+func TestNoTrackManagedFieldsForClientSideApply(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	// create object
+	newObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	deployment := []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+`)
+	if err := yaml.Unmarshal(deployment, &newObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+	if err := f.Update(newObj, "test_kubectl_create"); err != nil {
+		t.Errorf("failed to update object: %v", err)
+	}
+	if m := f.ManagedFields(); len(m) == 0 {
+		t.Errorf("expected to have managed fields, but got: %v", m)
+	}
+
+	// stop tracking managed fields
+	newObj = &unstructured.Unstructured{Object: map[string]interface{}{}}
+	deployment = []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  managedFields: [] # stop tracking managed fields
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+`)
+	if err := yaml.Unmarshal(deployment, &newObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+	newObj.SetUID("nonempty")
+	if err := f.Update(newObj, "test_kubectl_replace"); err != nil {
+		t.Errorf("failed to update object: %v", err)
+	}
+	if m := f.ManagedFields(); len(m) != 0 {
+		t.Errorf("expected to have stop tracking managed fields, but got: %v", m)
+	}
+
+	// check that we still don't track managed fields
+	newObj = &unstructured.Unstructured{Object: map[string]interface{}{}}
+	deployment = []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+`)
+	if err := yaml.Unmarshal(deployment, &newObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+	if err := setLastAppliedFromEncoded(newObj, deployment); err != nil {
+		t.Errorf("failed to set last applied: %v", err)
+	}
+	if err := f.Update(newObj, "test_k_client_side_apply"); err != nil {
+		t.Errorf("failed to update object: %v", err)
+	}
+	if m := f.ManagedFields(); len(m) != 0 {
+		t.Errorf("expected to continue to not track managed fields, but got: %v", m)
+	}
+	lastApplied, err := getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+	if !strings.Contains(lastApplied, "my-app") {
+		t.Errorf("expected last applied annotation to be set properly, but got: %q", lastApplied)
+	}
+
+	// start tracking managed fields
+	newObj = &unstructured.Unstructured{Object: map[string]interface{}{}}
+	deployment = []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+`)
+	if err := yaml.Unmarshal(deployment, &newObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+	if err := f.Apply(newObj, "test_server_side_apply_without_upgrade", false); err != nil {
+		t.Errorf("error applying object: %v", err)
+	}
+	if m := f.ManagedFields(); len(m) < 2 {
+		t.Errorf("expected to start tracking managed fields with at least 2 field managers, but got: %v", m)
+	}
+	if e, a := "test_server_side_apply_without_upgrade", f.ManagedFields()[0].Manager; e != a {
+		t.Fatalf("exected first manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+	if e, a := "before-first-apply", f.ManagedFields()[1].Manager; e != a {
+		t.Fatalf("exected second manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	// upgrade management of the object from client-side apply to server-side apply
+	newObj = &unstructured.Unstructured{Object: map[string]interface{}{}}
+	deployment = []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app-v2 # change
+spec:
+  replicas: 8 # change
+`)
+	if err := yaml.Unmarshal(deployment, &newObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+	if err := f.Apply(newObj, "kubectl", false); err != nil {
+		t.Errorf("error applying object: %v", err)
+	}
+	if m := f.ManagedFields(); len(m) == 0 {
+		t.Errorf("expected to track managed fields, but got: %v", m)
+	}
+	lastApplied, err = getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+	if !strings.Contains(lastApplied, "my-app-v2") {
+		t.Errorf("expected last applied annotation to be updated, but got: %q", lastApplied)
+	}
+}
+
+func yamlToJSON(y []byte) (string, error) {
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal(y, &obj.Object); err != nil {
+		return "", fmt.Errorf("error decoding YAML: %v", err)
+	}
+	serialization, err := runtime.Encode(unstructured.UnstructuredJSONScheme, obj)
+	if err != nil {
+		return "", fmt.Errorf("error encoding object: %v", err)
+	}
+	json, err := yamlutil.ToJSON(serialization)
+	if err != nil {
+		return "", fmt.Errorf("error converting to json: %v", err)
+	}
+	return string(json), nil
+}
+
+func setLastAppliedFromEncoded(obj runtime.Object, lastApplied []byte) error {
+	lastAppliedJSON, err := yamlToJSON(lastApplied)
+	if err != nil {
+		return err
+	}
+	return internal.SetLastApplied(obj, lastAppliedJSON)
+}
+
+func getLastApplied(obj runtime.Object) (string, error) {
+	accessor := meta.NewAccessor()
+	annotations, err := accessor.Annotations(obj)
+	if err != nil {
+		return "", fmt.Errorf("failed to access annotations: %v", err)
+	}
+	if annotations == nil {
+		return "", fmt.Errorf("no annotations on obj: %v", obj)
+	}
+
+	lastApplied, ok := annotations[internal.LastAppliedConfigAnnotation]
+	if !ok {
+		return "", fmt.Errorf("expected last applied annotation, but got none for object: %v", obj)
+	}
+	return lastApplied, nil
+}
+
+func TestUpdateViaSubresources(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManagerSubresource(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"), "scale")
+
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"labels": {
+				"a":"b"
+			},
+		}
+	}`), &obj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+	obj.SetManagedFields([]metav1.ManagedFieldsEntry{
+		{
+			Manager:    "test",
+			Operation:  metav1.ManagedFieldsOperationApply,
+			APIVersion: "apps/v1",
+			FieldsType: "FieldsV1",
+			FieldsV1: metav1.NewFieldsV1(
+				`{"f:metadata":{"f:labels":{"f:another_field":{}}}}`,
+			),
+		},
+	})
+
+	// Check that managed fields cannot be changed explicitly via subresources
+	expectedManager := "fieldmanager_test_subresource"
+	if err := f.Update(obj, expectedManager); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	managedFields := f.ManagedFields()
+	if len(managedFields) != 1 {
+		t.Fatalf("Expected new managed fields to have one entry. Got:\n%#v", managedFields)
+	}
+	if managedFields[0].Manager != expectedManager {
+		t.Fatalf("Expected first item to have manager set to: %s. Got: %s", expectedManager, managedFields[0].Manager)
+	}
+
+	// Check that managed fields cannot be reset via subresources
+	newObj := obj.DeepCopy()
+	newObj.SetManagedFields([]metav1.ManagedFieldsEntry{})
+	if err := f.Update(newObj, expectedManager); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+	newManagedFields := f.ManagedFields()
+	if len(newManagedFields) != 1 {
+		t.Fatalf("Expected new managed fields to have one entry. Got:\n%#v", newManagedFields)
+	}
+}
+
+// Ensures that a no-op Apply does not mutate managed fields
+func TestApplyDoesNotChangeManagedFields(t *testing.T) {
+	originalManagedFields := []metav1.ManagedFieldsEntry{}
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter,
+		schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+	newObj := &unstructured.Unstructured{
+		Object: map[string]interface{}{},
+	}
+	appliedObj := &unstructured.Unstructured{
+		Object: map[string]interface{}{},
+	}
+
+	// Convert YAML string inputs to unstructured instances
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+		"metadata": {
+			"name": "deployment",
+			"labels": {"app": "nginx"}
+		},
+		"spec": {
+			"selector": {
+				"matchLabels": {
+					"app": "nginx"
+				}
+			},
+			"template": {
+				"metadata": {
+					"labels": {
+						"app": "nginx"
+					}
+				},
+				"spec": {
+					"containers": [{
+						"name":  "nginx",
+						"image": "nginx:latest"
+					}]
+				}
+			}
+		}
+	}`), &newObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+		"metadata": {
+			"name": "deployment",
+		},
+		"spec": {
+			"replicas": 101,
+		}
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	// Agent A applies initial configuration
+	if err := f.Apply(newObj.DeepCopyObject(), "fieldmanager_z", false); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	// Agent B applies additive configuration
+	if err := f.Apply(appliedObj, "fieldmanager_b", false); err != nil {
+		t.Fatalf("failed to apply object %v", err)
+	}
+
+	// Next, agent A applies the initial configuration again, but we expect
+	// a no-op to managed fields.
+	//
+	// The following update is expected not to change the liveObj, save off
+	//	the fields
+	for _, field := range f.ManagedFields() {
+		originalManagedFields = append(originalManagedFields, *field.DeepCopy())
+	}
+
+	// Make sure timestamp change would be caught
+	time.Sleep(2 * time.Second)
+
+	if err := f.Apply(newObj, "fieldmanager_z", false); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	// ensure that the live object is unchanged
+	if !reflect.DeepEqual(originalManagedFields, f.ManagedFields()) {
+		originalYAML, _ := yaml.Marshal(originalManagedFields)
+		current, _ := yaml.Marshal(f.ManagedFields())
+
+		// should have been a no-op w.r.t. managed fields
+		t.Fatalf("managed fields changed: ORIGINAL\n%v\nCURRENT\n%v",
+			string(originalYAML), string(current))
+	}
+}
+
+// Ensures that a no-op Update does not mutate managed fields
+func TestUpdateDoesNotChangeManagedFields(t *testing.T) {
+	originalManagedFields := []metav1.ManagedFieldsEntry{}
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter,
+		schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+	newObj := &unstructured.Unstructured{
+		Object: map[string]interface{}{},
+	}
+
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+		"metadata": {
+			"name": "deployment",
+			"labels": {"app": "nginx"}
+		},
+		"spec": {
+			"selector": {
+				"matchLabels": {
+					"app": "nginx"
+				}
+			},
+			"template": {
+				"metadata": {
+					"labels": {
+						"app": "nginx"
+					}
+				},
+				"spec": {
+					"containers": [{
+						"name":  "nginx",
+						"image": "nginx:latest"
+					}]
+				}
+			}
+		}
+	}`), &newObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	// Agent A updates with initial configuration
+	if err := f.Update(newObj.DeepCopyObject(), "fieldmanager_z"); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	for _, field := range f.ManagedFields() {
+		originalManagedFields = append(originalManagedFields, *field.DeepCopy())
+	}
+
+	// Make sure timestamp change would be caught
+	time.Sleep(2 * time.Second)
+
+	// If the same exact configuration is updated once again, the
+	// managed fields are not expected to change
+	//
+	// However, a change in field ownership WOULD be a semantic change which
+	// should cause managed fields to change.
+	if err := f.Update(newObj, "fieldmanager_z"); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	// ensure that the live object is unchanged
+	if !reflect.DeepEqual(originalManagedFields, f.ManagedFields()) {
+		originalYAML, _ := yaml.Marshal(originalManagedFields)
+		current, _ := yaml.Marshal(f.ManagedFields())
+
+		// should have been a no-op w.r.t. managed fields
+		t.Fatalf("managed fields changed: ORIGINAL\n%v\nCURRENT\n%v",
+			string(originalYAML), string(current))
+	}
+}
+
+// This test makes sure that the liveObject during a patch does not mutate
+// its managed fields.
+func TestLiveObjectManagedFieldsNotRemoved(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter,
+		schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+	newObj := &unstructured.Unstructured{
+		Object: map[string]interface{}{},
+	}
+	appliedObj := &unstructured.Unstructured{
+		Object: map[string]interface{}{},
+	}
+	// Convert YAML string inputs to unstructured instances
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+		"metadata": {
+			"name": "deployment",
+			"labels": {"app": "nginx"}
+		},
+		"spec": {
+			"selector": {
+				"matchLabels": {
+					"app": "nginx"
+				}
+			},
+			"template": {
+				"metadata": {
+					"labels": {
+						"app": "nginx"
+					}
+				},
+				"spec": {
+					"containers": [{
+						"name":  "nginx",
+						"image": "nginx:latest"
+					}]
+				}
+			}
+		}
+	}`), &newObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+		"metadata": {
+			"name": "deployment",
+		},
+		"spec": {
+			"replicas": 101,
+		}
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	// Agent A applies initial configuration
+	if err := f.Apply(newObj.DeepCopyObject(), "fieldmanager_z", false); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	originalLiveObj := f.Live()
+
+	accessor, err := meta.Accessor(originalLiveObj)
+	if err != nil {
+		panic(fmt.Errorf("couldn't get accessor: %v", err))
+	}
+
+	// Managed fields should not be stripped
+	if len(accessor.GetManagedFields()) == 0 {
+		t.Fatalf("empty managed fields of object which expected nonzero fields")
+	}
+
+	// Agent A applies the exact same configuration
+	if err := f.Apply(appliedObj.DeepCopyObject(), "fieldmanager_z", false); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	accessor, err = meta.Accessor(originalLiveObj)
+	if err != nil {
+		panic(fmt.Errorf("couldn't get accessor: %v", err))
+	}
+
+	// Managed fields should not be stripped
+	if len(accessor.GetManagedFields()) == 0 {
+		t.Fatalf("empty managed fields of object which expected nonzero fields")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/gvkparser.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/gvkparser.go
new file mode 100644
index 0000000000..89e4470548
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/gvkparser.go
@@ -0,0 +1,128 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kube-openapi/pkg/schemaconv"
+	"k8s.io/kube-openapi/pkg/util/proto"
+	smdschema "sigs.k8s.io/structured-merge-diff/v6/schema"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+)
+
+// groupVersionKindExtensionKey is the key used to lookup the
+// GroupVersionKind value for an object definition from the
+// definition's "extensions" map.
+const groupVersionKindExtensionKey = "x-kubernetes-group-version-kind"
+
+// GvkParser contains a Parser that allows introspecting the schema.
+type GvkParser struct {
+	gvks   map[schema.GroupVersionKind]string
+	parser typed.Parser
+}
+
+// Type returns a helper which can produce objects of the given type. Any
+// errors are deferred until a further function is called.
+func (p *GvkParser) Type(gvk schema.GroupVersionKind) *typed.ParseableType {
+	typeName, ok := p.gvks[gvk]
+	if !ok {
+		return nil
+	}
+	t := p.parser.Type(typeName)
+	return &t
+}
+
+// NewGVKParser builds a GVKParser from a proto.Models. This
+// will automatically find the proper version of the object, and the
+// corresponding schema information.
+func NewGVKParser(models proto.Models, preserveUnknownFields bool) (*GvkParser, error) {
+	typeSchema, err := schemaconv.ToSchemaWithPreserveUnknownFields(models, preserveUnknownFields)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert models to schema: %v", err)
+	}
+	parser := GvkParser{
+		gvks: map[schema.GroupVersionKind]string{},
+	}
+	parser.parser = typed.Parser{Schema: smdschema.Schema{Types: typeSchema.Types}}
+	for _, modelName := range models.ListModels() {
+		model := models.LookupModel(modelName)
+		if model == nil {
+			panic(fmt.Sprintf("ListModels returns a model that can't be looked-up for: %v", modelName))
+		}
+		gvkList := parseGroupVersionKind(model)
+		for _, gvk := range gvkList {
+			if len(gvk.Kind) > 0 {
+				_, ok := parser.gvks[gvk]
+				if ok {
+					return nil, fmt.Errorf("duplicate entry for %v", gvk)
+				}
+				parser.gvks[gvk] = modelName
+			}
+		}
+	}
+	return &parser, nil
+}
+
+// Get and parse GroupVersionKind from the extension. Returns empty if it doesn't have one.
+func parseGroupVersionKind(s proto.Schema) []schema.GroupVersionKind {
+	extensions := s.GetExtensions()
+
+	gvkListResult := []schema.GroupVersionKind{}
+
+	// Get the extensions
+	gvkExtension, ok := extensions[groupVersionKindExtensionKey]
+	if !ok {
+		return []schema.GroupVersionKind{}
+	}
+
+	// gvk extension must be a list of at least 1 element.
+	gvkList, ok := gvkExtension.([]interface{})
+	if !ok {
+		return []schema.GroupVersionKind{}
+	}
+
+	for _, gvk := range gvkList {
+		// gvk extension list must be a map with group, version, and
+		// kind fields
+		gvkMap, ok := gvk.(map[interface{}]interface{})
+		if !ok {
+			continue
+		}
+		group, ok := gvkMap["group"].(string)
+		if !ok {
+			continue
+		}
+		version, ok := gvkMap["version"].(string)
+		if !ok {
+			continue
+		}
+		kind, ok := gvkMap["kind"].(string)
+		if !ok {
+			continue
+		}
+
+		gvkListResult = append(gvkListResult, schema.GroupVersionKind{
+			Group:   group,
+			Version: version,
+			Kind:    kind,
+		})
+	}
+
+	return gvkListResult
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/atmostevery.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/atmostevery.go
new file mode 100644
index 0000000000..b75ef7416e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/atmostevery.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"sync"
+	"time"
+)
+
+// AtMostEvery will never run the method more than once every specified
+// duration.
+type AtMostEvery struct {
+	delay    time.Duration
+	lastCall time.Time
+	mutex    sync.Mutex
+}
+
+// NewAtMostEvery creates a new AtMostEvery, that will run the method at
+// most every given duration.
+func NewAtMostEvery(delay time.Duration) *AtMostEvery {
+	return &AtMostEvery{
+		delay: delay,
+	}
+}
+
+// updateLastCall returns true if the lastCall time has been updated,
+// false if it was too early.
+func (s *AtMostEvery) updateLastCall() bool {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+	if time.Since(s.lastCall) < s.delay {
+		return false
+	}
+	s.lastCall = time.Now()
+	return true
+}
+
+// Do will run the method if enough time has passed, and return true.
+// Otherwise, it does nothing and returns false.
+func (s *AtMostEvery) Do(fn func()) bool {
+	if !s.updateLastCall() {
+		return false
+	}
+	fn()
+	return true
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/atmostevery_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/atmostevery_test.go
new file mode 100644
index 0000000000..8dea4add71
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/atmostevery_test.go
@@ -0,0 +1,51 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+)
+
+func TestAtMostEvery(t *testing.T) {
+	duration := time.Second
+	delay := 179 * time.Millisecond
+	atMostEvery := internal.NewAtMostEvery(delay)
+	count := 0
+	exit := time.NewTicker(duration)
+	tick := time.NewTicker(2 * time.Millisecond)
+	defer exit.Stop()
+	defer tick.Stop()
+
+	done := false
+	for !done {
+		select {
+		case <-exit.C:
+			done = true
+		case <-tick.C:
+			atMostEvery.Do(func() {
+				count++
+			})
+		}
+	}
+
+	if expected := int(duration/delay) + 1; count > expected {
+		t.Fatalf("Function called %d times, should have been called less than or equal to %d times", count, expected)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/buildmanagerinfo.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/buildmanagerinfo.go
new file mode 100644
index 0000000000..fa342ca135
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/buildmanagerinfo.go
@@ -0,0 +1,74 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type buildManagerInfoManager struct {
+	fieldManager Manager
+	groupVersion schema.GroupVersion
+	subresource  string
+}
+
+var _ Manager = &buildManagerInfoManager{}
+
+// NewBuildManagerInfoManager creates a new Manager that converts the manager name into a unique identifier
+// combining operation and version for update requests, and just operation for apply requests.
+func NewBuildManagerInfoManager(f Manager, gv schema.GroupVersion, subresource string) Manager {
+	return &buildManagerInfoManager{
+		fieldManager: f,
+		groupVersion: gv,
+		subresource:  subresource,
+	}
+}
+
+// Update implements Manager.
+func (f *buildManagerInfoManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	manager, err := f.buildManagerInfo(manager, metav1.ManagedFieldsOperationUpdate)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to build manager identifier: %v", err)
+	}
+	return f.fieldManager.Update(liveObj, newObj, managed, manager)
+}
+
+// Apply implements Manager.
+func (f *buildManagerInfoManager) Apply(liveObj, appliedObj runtime.Object, managed Managed, manager string, force bool) (runtime.Object, Managed, error) {
+	manager, err := f.buildManagerInfo(manager, metav1.ManagedFieldsOperationApply)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to build manager identifier: %v", err)
+	}
+	return f.fieldManager.Apply(liveObj, appliedObj, managed, manager, force)
+}
+
+func (f *buildManagerInfoManager) buildManagerInfo(prefix string, operation metav1.ManagedFieldsOperationType) (string, error) {
+	managerInfo := metav1.ManagedFieldsEntry{
+		Manager:     prefix,
+		Operation:   operation,
+		APIVersion:  f.groupVersion.String(),
+		Subresource: f.subresource,
+	}
+	if managerInfo.Manager == "" {
+		managerInfo.Manager = "unknown"
+	}
+	return BuildManagerIdentifier(&managerInfo)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/capmanagers.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/capmanagers.go
new file mode 100644
index 0000000000..a9530ff2b4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/capmanagers.go
@@ -0,0 +1,133 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+	"sort"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+type capManagersManager struct {
+	fieldManager          Manager
+	maxUpdateManagers     int
+	oldUpdatesManagerName string
+}
+
+var _ Manager = &capManagersManager{}
+
+// NewCapManagersManager creates a new wrapped FieldManager which ensures that the number of managers from updates
+// does not exceed maxUpdateManagers, by merging some of the oldest entries on each update.
+func NewCapManagersManager(fieldManager Manager, maxUpdateManagers int) Manager {
+	return &capManagersManager{
+		fieldManager:          fieldManager,
+		maxUpdateManagers:     maxUpdateManagers,
+		oldUpdatesManagerName: "ancient-changes",
+	}
+}
+
+// Update implements Manager.
+func (f *capManagersManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	object, managed, err := f.fieldManager.Update(liveObj, newObj, managed, manager)
+	if err != nil {
+		return object, managed, err
+	}
+	if managed, err = f.capUpdateManagers(managed); err != nil {
+		return nil, nil, fmt.Errorf("failed to cap update managers: %v", err)
+	}
+	return object, managed, nil
+}
+
+// Apply implements Manager.
+func (f *capManagersManager) Apply(liveObj, appliedObj runtime.Object, managed Managed, fieldManager string, force bool) (runtime.Object, Managed, error) {
+	return f.fieldManager.Apply(liveObj, appliedObj, managed, fieldManager, force)
+}
+
+// capUpdateManagers merges a number of the oldest update entries into versioned buckets,
+// such that the number of entries from updates does not exceed f.maxUpdateManagers.
+func (f *capManagersManager) capUpdateManagers(managed Managed) (newManaged Managed, err error) {
+	// Gather all entries from updates
+	updaters := []string{}
+	for manager, fields := range managed.Fields() {
+		if !fields.Applied() {
+			updaters = append(updaters, manager)
+		}
+	}
+	if len(updaters) <= f.maxUpdateManagers {
+		return managed, nil
+	}
+
+	// If we have more than the maximum, sort the update entries by time, oldest first.
+	sort.Slice(updaters, func(i, j int) bool {
+		iTime, jTime, iSeconds, jSeconds := managed.Times()[updaters[i]], managed.Times()[updaters[j]], int64(0), int64(0)
+		if iTime != nil {
+			iSeconds = iTime.Unix()
+		}
+		if jTime != nil {
+			jSeconds = jTime.Unix()
+		}
+		if iSeconds != jSeconds {
+			return iSeconds < jSeconds
+		}
+		return updaters[i] < updaters[j]
+	})
+
+	// Merge the oldest updaters with versioned bucket managers until the number of updaters is under the cap
+	versionToFirstManager := map[string]string{}
+	for i, length := 0, len(updaters); i < len(updaters) && length > f.maxUpdateManagers; i++ {
+		manager := updaters[i]
+		vs := managed.Fields()[manager]
+		time := managed.Times()[manager]
+		version := string(vs.APIVersion())
+
+		// Create a new manager identifier for the versioned bucket entry.
+		// The version for this manager comes from the version of the update being merged into the bucket.
+		bucket, err := BuildManagerIdentifier(&metav1.ManagedFieldsEntry{
+			Manager:    f.oldUpdatesManagerName,
+			Operation:  metav1.ManagedFieldsOperationUpdate,
+			APIVersion: version,
+		})
+		if err != nil {
+			return managed, fmt.Errorf("failed to create bucket manager for version %v: %v", version, err)
+		}
+
+		// Merge the fieldets if this is not the first time the version was seen.
+		// Otherwise just record the manager name in versionToFirstManager
+		if first, ok := versionToFirstManager[version]; ok {
+			// If the bucket doesn't exists yet, create one.
+			if _, ok := managed.Fields()[bucket]; !ok {
+				s := managed.Fields()[first]
+				delete(managed.Fields(), first)
+				managed.Fields()[bucket] = s
+			}
+
+			managed.Fields()[bucket] = fieldpath.NewVersionedSet(vs.Set().Union(managed.Fields()[bucket].Set()), vs.APIVersion(), vs.Applied())
+			delete(managed.Fields(), manager)
+			length--
+
+			// Use the time from the update being merged into the bucket, since it is more recent.
+			managed.Times()[bucket] = time
+		} else {
+			versionToFirstManager[version] = manager
+		}
+	}
+
+	return managed, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/capmanagers_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/capmanagers_test.go
new file mode 100644
index 0000000000..366b299a58
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/capmanagers_test.go
@@ -0,0 +1,303 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"testing"
+	"time"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	internaltesting "k8s.io/apimachinery/pkg/util/managedfields/internal/testing"
+	"k8s.io/apimachinery/pkg/util/managedfields/managedfieldstest"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+type fakeManager struct {
+	Manager internal.Manager
+	Error   error
+}
+
+var _ internal.Manager = &fakeManager{}
+
+func (f *fakeManager) Update(liveObj, newObj runtime.Object, managed internal.Managed, manager string) (runtime.Object, internal.Managed, error) {
+	if f.Error != nil {
+		return nil, nil, f.Error
+	}
+	if f.Manager != nil {
+		return f.Manager.Update(liveObj, newObj, managed, manager)
+	}
+	return newObj, managed, nil
+}
+
+func (f *fakeManager) Apply(_, _ runtime.Object, _ internal.Managed, _ string, _ bool) (runtime.Object, internal.Managed, error) {
+	panic("not implemented")
+}
+
+func TestCapManagersManagerMergesEntries(t *testing.T) {
+	f := internaltesting.NewTestFieldManagerImpl(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"),
+		"",
+		func(m internal.Manager) internal.Manager {
+			return internal.NewCapManagersManager(m, 3)
+		})
+
+	podWithLabels := func(labels ...string) runtime.Object {
+		labelMap := map[string]interface{}{}
+		for _, key := range labels {
+			labelMap[key] = "true"
+		}
+		obj := &unstructured.Unstructured{
+			Object: map[string]interface{}{
+				"metadata": map[string]interface{}{
+					"labels": labelMap,
+				},
+			},
+		}
+		obj.SetKind("Pod")
+		obj.SetAPIVersion("v1")
+		return obj
+	}
+
+	if err := f.Update(podWithLabels("one"), "fieldmanager_test_update_1"); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+	expectIdempotence(t, f)
+
+	if err := f.Update(podWithLabels("one", "two"), "fieldmanager_test_update_2"); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+	expectIdempotence(t, f)
+
+	if err := f.Update(podWithLabels("one", "two", "three"), "fieldmanager_test_update_3"); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+	expectIdempotence(t, f)
+
+	if err := f.Update(podWithLabels("one", "two", "three", "four"), "fieldmanager_test_update_4"); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+	expectIdempotence(t, f)
+
+	if e, a := 3, len(f.ManagedFields()); e != a {
+		t.Fatalf("exected %v entries in managedFields, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	if e, a := "ancient-changes", f.ManagedFields()[0].Manager; e != a {
+		t.Fatalf("exected first manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	if e, a := "fieldmanager_test_update_3", f.ManagedFields()[1].Manager; e != a {
+		t.Fatalf("exected second manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	if e, a := "fieldmanager_test_update_4", f.ManagedFields()[2].Manager; e != a {
+		t.Fatalf("exected third manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	expectManagesField(t, f, "ancient-changes", fieldpath.MakePathOrDie("metadata", "labels", "one"))
+	expectManagesField(t, f, "ancient-changes", fieldpath.MakePathOrDie("metadata", "labels", "two"))
+	expectManagesField(t, f, "fieldmanager_test_update_3", fieldpath.MakePathOrDie("metadata", "labels", "three"))
+	expectManagesField(t, f, "fieldmanager_test_update_4", fieldpath.MakePathOrDie("metadata", "labels", "four"))
+}
+
+func TestCapUpdateManagers(t *testing.T) {
+	f := internaltesting.NewTestFieldManagerImpl(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"),
+		"",
+		func(m internal.Manager) internal.Manager {
+			return internal.NewCapManagersManager(m, 3)
+		})
+
+	set := func(fields ...string) *metav1.FieldsV1 {
+		s := fieldpath.NewSet()
+		for _, f := range fields {
+			s.Insert(fieldpath.MakePathOrDie(f))
+		}
+		b, err := s.ToJSON()
+		if err != nil {
+			panic(fmt.Sprintf("error building ManagedFieldsEntry for test: %v", err))
+		}
+		return metav1.NewFieldsV1(string(b))
+	}
+
+	entry := func(name string, version string, order int, fields *metav1.FieldsV1) metav1.ManagedFieldsEntry {
+		return metav1.ManagedFieldsEntry{
+			Manager:    name,
+			APIVersion: version,
+			Operation:  "Update",
+			FieldsType: "FieldsV1",
+			FieldsV1:   fields,
+			Time:       &metav1.Time{Time: time.Time{}.Add(time.Hour * time.Duration(order))},
+		}
+	}
+
+	testCases := []struct {
+		name     string
+		input    []metav1.ManagedFieldsEntry
+		expected []metav1.ManagedFieldsEntry
+	}{
+		{
+			name: "one version, no ancient changes",
+			input: []metav1.ManagedFieldsEntry{
+				entry("update-manager1", "v1", 1, set("a")),
+				entry("update-manager2", "v1", 2, set("b")),
+				entry("update-manager3", "v1", 3, set("c")),
+				entry("update-manager4", "v1", 4, set("d")),
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 2, set("a", "b")),
+				entry("update-manager3", "v1", 3, set("c")),
+				entry("update-manager4", "v1", 4, set("d")),
+			},
+		}, {
+			name: "one version, one ancient changes",
+			input: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 2, set("a", "b")),
+				entry("update-manager3", "v1", 3, set("c")),
+				entry("update-manager4", "v1", 4, set("d")),
+				entry("update-manager5", "v1", 5, set("e")),
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 3, set("a", "b", "c")),
+				entry("update-manager4", "v1", 4, set("d")),
+				entry("update-manager5", "v1", 5, set("e")),
+			},
+		}, {
+			name: "two versions, no ancient changes",
+			input: []metav1.ManagedFieldsEntry{
+				entry("update-manager1", "v1", 1, set("a")),
+				entry("update-manager2", "v2", 2, set("b")),
+				entry("update-manager3", "v1", 3, set("c")),
+				entry("update-manager4", "v1", 4, set("d")),
+				entry("update-manager5", "v1", 5, set("e")),
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				entry("update-manager2", "v2", 2, set("b")),
+				entry("ancient-changes", "v1", 4, set("a", "c", "d")),
+				entry("update-manager5", "v1", 5, set("e")),
+			},
+		}, {
+			name: "three versions, one ancient changes",
+			input: []metav1.ManagedFieldsEntry{
+				entry("update-manager2", "v2", 2, set("b")),
+				entry("ancient-changes", "v1", 4, set("a", "c", "d")),
+				entry("update-manager5", "v1", 5, set("e")),
+				entry("update-manager6", "v3", 6, set("f")),
+				entry("update-manager7", "v2", 7, set("g")),
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 5, set("a", "c", "d", "e")),
+				entry("update-manager6", "v3", 6, set("f")),
+				entry("ancient-changes", "v2", 7, set("b", "g")),
+			},
+		}, {
+			name: "three versions, two ancient changes",
+			input: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 5, set("a", "c", "d", "e")),
+				entry("update-manager6", "v3", 6, set("f")),
+				entry("ancient-changes", "v2", 7, set("b", "g")),
+				entry("update-manager8", "v3", 8, set("h")),
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 5, set("a", "c", "d", "e")),
+				entry("ancient-changes", "v2", 7, set("b", "g")),
+				entry("ancient-changes", "v3", 8, set("f", "h")),
+			},
+		}, {
+			name: "four versions, two ancient changes",
+			input: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 5, set("a", "c", "d", "e")),
+				entry("update-manager6", "v3", 6, set("f")),
+				entry("ancient-changes", "v2", 7, set("b", "g")),
+				entry("update-manager8", "v4", 8, set("h")),
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 5, set("a", "c", "d", "e")),
+				entry("update-manager6", "v3", 6, set("f")),
+				entry("ancient-changes", "v2", 7, set("b", "g")),
+				entry("update-manager8", "v4", 8, set("h")),
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		f.Reset()
+		live := f.Live()
+		accessor, err := meta.Accessor(live)
+		if err != nil {
+			t.Fatalf("%v: couldn't get accessor: %v", tc.name, err)
+		}
+		accessor.SetManagedFields(tc.input)
+		if err := f.Update(live, "no-op-update"); err != nil {
+			t.Fatalf("%v: failed to do no-op update to object: %v", tc.name, err)
+		}
+
+		if e, a := tc.expected, f.ManagedFields(); !apiequality.Semantic.DeepEqual(e, a) {
+			t.Errorf("%v: unexpected value for managedFields:\nexpected: %v\n but got: %v", tc.name, mustMarshal(e), mustMarshal(a))
+		}
+		expectIdempotence(t, f)
+	}
+}
+
+// expectIdempotence does a no-op update and ensures that managedFields doesn't change by calling capUpdateManagers.
+func expectIdempotence(t *testing.T, f managedfieldstest.TestFieldManager) {
+	before := []metav1.ManagedFieldsEntry{}
+	for _, m := range f.ManagedFields() {
+		before = append(before, *m.DeepCopy())
+	}
+
+	if err := f.Update(f.Live(), "no-op-update"); err != nil {
+		t.Fatalf("failed to do no-op update to object: %v", err)
+	}
+
+	if after := f.ManagedFields(); !apiequality.Semantic.DeepEqual(before, after) {
+		t.Fatalf("exected idempotence, but managedFields changed:\nbefore: %v\n after: %v", mustMarshal(before), mustMarshal(after))
+	}
+}
+
+// expectManagesField ensures that manager m currently manages field path p.
+func expectManagesField(t *testing.T, f managedfieldstest.TestFieldManager, m string, p fieldpath.Path) {
+	for _, e := range f.ManagedFields() {
+		if e.Manager == m {
+			var s fieldpath.Set
+			err := s.FromJSON(bytes.NewReader(e.FieldsV1.GetRawBytes()))
+			if err != nil {
+				t.Fatalf("error parsing managedFields for %v: %v: %#v", m, err, f.ManagedFields())
+			}
+			if !s.Has(p) {
+				t.Fatalf("expected managedFields for %v to contain %v, but got:\n%v", m, p.String(), s.String())
+			}
+			return
+		}
+	}
+	t.Fatalf("exected to find manager name %v, but got: %#v", m, f.ManagedFields())
+}
+
+func mustMarshal(i interface{}) string {
+	b, err := json.MarshalIndent(i, "", "  ")
+	if err != nil {
+		panic(fmt.Sprintf("error marshalling %v to json: %v", i, err))
+	}
+	return string(b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/conflict.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/conflict.go
new file mode 100644
index 0000000000..1f07b004de
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/conflict.go
@@ -0,0 +1,89 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+)
+
+// NewConflictError returns an error including details on the requests apply conflicts
+func NewConflictError(conflicts merge.Conflicts) *errors.StatusError {
+	causes := []metav1.StatusCause{}
+	for _, conflict := range conflicts {
+		causes = append(causes, metav1.StatusCause{
+			Type:    metav1.CauseTypeFieldManagerConflict,
+			Message: fmt.Sprintf("conflict with %v", printManager(conflict.Manager)),
+			Field:   conflict.Path.String(),
+		})
+	}
+	return errors.NewApplyConflict(causes, getConflictMessage(conflicts))
+}
+
+func getConflictMessage(conflicts merge.Conflicts) string {
+	if len(conflicts) == 1 {
+		return fmt.Sprintf("Apply failed with 1 conflict: conflict with %v: %v", printManager(conflicts[0].Manager), conflicts[0].Path)
+	}
+
+	m := map[string][]fieldpath.Path{}
+	for _, conflict := range conflicts {
+		m[conflict.Manager] = append(m[conflict.Manager], conflict.Path)
+	}
+
+	uniqueManagers := []string{}
+	for manager := range m {
+		uniqueManagers = append(uniqueManagers, manager)
+	}
+
+	// Print conflicts by sorted managers.
+	sort.Strings(uniqueManagers)
+
+	messages := []string{}
+	for _, manager := range uniqueManagers {
+		messages = append(messages, fmt.Sprintf("conflicts with %v:", printManager(manager)))
+		for _, path := range m[manager] {
+			messages = append(messages, fmt.Sprintf("- %v", path))
+		}
+	}
+	return fmt.Sprintf("Apply failed with %d conflicts: %s", len(conflicts), strings.Join(messages, "\n"))
+}
+
+func printManager(manager string) string {
+	encodedManager := &metav1.ManagedFieldsEntry{}
+	if err := json.Unmarshal([]byte(manager), encodedManager); err != nil {
+		return fmt.Sprintf("%q", manager)
+	}
+	managerStr := fmt.Sprintf("%q", encodedManager.Manager)
+	if encodedManager.Subresource != "" {
+		managerStr = fmt.Sprintf("%s with subresource %q", managerStr, encodedManager.Subresource)
+	}
+	if encodedManager.Operation == metav1.ManagedFieldsOperationUpdate {
+		if encodedManager.Time == nil {
+			return fmt.Sprintf("%s using %v", managerStr, encodedManager.APIVersion)
+		}
+		return fmt.Sprintf("%s using %v at %v", managerStr, encodedManager.APIVersion, encodedManager.Time.UTC().Format(time.RFC3339))
+	}
+	return managerStr
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/conflict_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/conflict_test.go
new file mode 100644
index 0000000000..cf13711253
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/conflict_test.go
@@ -0,0 +1,131 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"net/http"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+)
+
+// TestNewConflictError tests that NewConflictError creates the correct StatusError for a given smd Conflicts
+func TestNewConflictError(t *testing.T) {
+	testCases := []struct {
+		conflict merge.Conflicts
+		expected *errors.StatusError
+	}{
+		{
+			conflict: merge.Conflicts{
+				merge.Conflict{
+					Manager: `{"manager":"foo","operation":"Update","apiVersion":"v1","time":"2001-02-03T04:05:06Z"}`,
+					Path:    fieldpath.MakePathOrDie("spec", "replicas"),
+				},
+			},
+			expected: &errors.StatusError{
+				ErrStatus: metav1.Status{
+					Status: metav1.StatusFailure,
+					Code:   http.StatusConflict,
+					Reason: metav1.StatusReasonConflict,
+					Details: &metav1.StatusDetails{
+						Causes: []metav1.StatusCause{
+							{
+								Type:    metav1.CauseTypeFieldManagerConflict,
+								Message: `conflict with "foo" using v1 at 2001-02-03T04:05:06Z`,
+								Field:   ".spec.replicas",
+							},
+						},
+					},
+					Message: `Apply failed with 1 conflict: conflict with "foo" using v1 at 2001-02-03T04:05:06Z: .spec.replicas`,
+				},
+			},
+		},
+		{
+			conflict: merge.Conflicts{
+				merge.Conflict{
+					Manager: `{"manager":"foo","operation":"Update","apiVersion":"v1","time":"2001-02-03T04:05:06Z"}`,
+					Path:    fieldpath.MakePathOrDie("spec", "replicas"),
+				},
+				merge.Conflict{
+					Manager: `{"manager":"bar","operation":"Apply"}`,
+					Path:    fieldpath.MakePathOrDie("metadata", "labels", "app"),
+				},
+			},
+			expected: &errors.StatusError{
+				ErrStatus: metav1.Status{
+					Status: metav1.StatusFailure,
+					Code:   http.StatusConflict,
+					Reason: metav1.StatusReasonConflict,
+					Details: &metav1.StatusDetails{
+						Causes: []metav1.StatusCause{
+							{
+								Type:    metav1.CauseTypeFieldManagerConflict,
+								Message: `conflict with "foo" using v1 at 2001-02-03T04:05:06Z`,
+								Field:   ".spec.replicas",
+							},
+							{
+								Type:    metav1.CauseTypeFieldManagerConflict,
+								Message: `conflict with "bar"`,
+								Field:   ".metadata.labels.app",
+							},
+						},
+					},
+					Message: `Apply failed with 2 conflicts: conflicts with "bar":
+- .metadata.labels.app
+conflicts with "foo" using v1 at 2001-02-03T04:05:06Z:
+- .spec.replicas`,
+				},
+			},
+		},
+		{
+			conflict: merge.Conflicts{
+				merge.Conflict{
+					Manager: `{"manager":"foo","operation":"Update","subresource":"scale","apiVersion":"v1","time":"2001-02-03T04:05:06Z"}`,
+					Path:    fieldpath.MakePathOrDie("spec", "replicas"),
+				},
+			},
+			expected: &errors.StatusError{
+				ErrStatus: metav1.Status{
+					Status: metav1.StatusFailure,
+					Code:   http.StatusConflict,
+					Reason: metav1.StatusReasonConflict,
+					Details: &metav1.StatusDetails{
+						Causes: []metav1.StatusCause{
+							{
+								Type:    metav1.CauseTypeFieldManagerConflict,
+								Message: `conflict with "foo" with subresource "scale" using v1 at 2001-02-03T04:05:06Z`,
+								Field:   ".spec.replicas",
+							},
+						},
+					},
+					Message: `Apply failed with 1 conflict: conflict with "foo" with subresource "scale" using v1 at 2001-02-03T04:05:06Z: .spec.replicas`,
+				},
+			},
+		},
+	}
+	for _, tc := range testCases {
+		actual := internal.NewConflictError(tc.conflict)
+		if !reflect.DeepEqual(tc.expected, actual) {
+			t.Errorf("Expected to get\n%+v\nbut got\n%+v", tc.expected.ErrStatus, actual.ErrStatus)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager.go
new file mode 100644
index 0000000000..2e2db65561
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager.go
@@ -0,0 +1,213 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+	"reflect"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/klog/v2"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+)
+
+// DefaultMaxUpdateManagers defines the default maximum retained number of managedFields entries from updates
+// if the number of update managers exceeds this, the oldest entries will be merged until the number is below the maximum.
+// TODO(jennybuckley): Determine if this is really the best value. Ideally we wouldn't unnecessarily merge too many entries.
+const DefaultMaxUpdateManagers int = 10
+
+// DefaultTrackOnCreateProbability defines the default probability that the field management of an object
+// starts being tracked from the object's creation, instead of from the first time the object is applied to.
+const DefaultTrackOnCreateProbability float32 = 1
+
+var atMostEverySecond = NewAtMostEvery(time.Second)
+
+// FieldManager updates the managed fields and merges applied
+// configurations.
+type FieldManager struct {
+	fieldManager Manager
+	subresource  string
+}
+
+// NewFieldManager creates a new FieldManager that decodes, manages, then re-encodes managedFields
+// on update and apply requests.
+func NewFieldManager(f Manager, subresource string) *FieldManager {
+	return &FieldManager{fieldManager: f, subresource: subresource}
+}
+
+// newDefaultFieldManager is a helper function which wraps a Manager with certain default logic.
+func NewDefaultFieldManager(f Manager, typeConverter TypeConverter, objectConverter runtime.ObjectConvertor, objectCreater runtime.ObjectCreater, kind schema.GroupVersionKind, subresource string) *FieldManager {
+	return NewFieldManager(
+		NewVersionCheckManager(
+			NewLastAppliedUpdater(
+				NewLastAppliedManager(
+					NewProbabilisticSkipNonAppliedManager(
+						NewCapManagersManager(
+							NewBuildManagerInfoManager(
+								NewManagedFieldsUpdater(
+									NewStripMetaManager(f),
+								), kind.GroupVersion(), subresource,
+							), DefaultMaxUpdateManagers,
+						), objectCreater, DefaultTrackOnCreateProbability,
+					), typeConverter, objectConverter, kind.GroupVersion(),
+				),
+			), kind,
+		), subresource,
+	)
+}
+
+func decodeLiveOrNew(liveObj, newObj runtime.Object, ignoreManagedFieldsFromRequestObject bool) (Managed, error) {
+	liveAccessor, err := meta.Accessor(liveObj)
+	if err != nil {
+		return nil, err
+	}
+
+	// We take the managedFields of the live object in case the request tries to
+	// manually set managedFields via a subresource.
+	if ignoreManagedFieldsFromRequestObject {
+		return emptyManagedFieldsOnErr(DecodeManagedFields(liveAccessor.GetManagedFields()))
+	}
+
+	// If the object doesn't have metadata, we should just return without trying to
+	// set the managedFields at all, so creates/updates/patches will work normally.
+	newAccessor, err := meta.Accessor(newObj)
+	if err != nil {
+		return nil, err
+	}
+
+	if isResetManagedFields(newAccessor.GetManagedFields()) {
+		return NewEmptyManaged(), nil
+	}
+
+	// If the managed field is empty or we failed to decode it,
+	// let's try the live object. This is to prevent clients who
+	// don't understand managedFields from deleting it accidentally.
+	managed, err := DecodeManagedFields(newAccessor.GetManagedFields())
+	if err != nil || len(managed.Fields()) == 0 {
+		return emptyManagedFieldsOnErr(DecodeManagedFields(liveAccessor.GetManagedFields()))
+	}
+	return managed, nil
+}
+
+func emptyManagedFieldsOnErr(managed Managed, err error) (Managed, error) {
+	if err != nil {
+		return NewEmptyManaged(), nil
+	}
+	return managed, nil
+}
+
+// Update is used when the object has already been merged (non-apply
+// use-case), and simply updates the managed fields in the output
+// object.
+func (f *FieldManager) Update(liveObj, newObj runtime.Object, manager string) (object runtime.Object, err error) {
+	// First try to decode the managed fields provided in the update,
+	// This is necessary to allow directly updating managed fields.
+	isSubresource := f.subresource != ""
+	managed, err := decodeLiveOrNew(liveObj, newObj, isSubresource)
+	if err != nil {
+		return newObj, nil
+	}
+
+	RemoveObjectManagedFields(newObj)
+
+	if object, managed, err = f.fieldManager.Update(liveObj, newObj, managed, manager); err != nil {
+		return nil, err
+	}
+
+	if err = EncodeObjectManagedFields(object, managed); err != nil {
+		return nil, fmt.Errorf("failed to encode managed fields: %v", err)
+	}
+
+	return object, nil
+}
+
+// UpdateNoErrors is the same as Update, but it will not return
+// errors. If an error happens, we preserve the managedFields from
+// liveObj.
+func (f *FieldManager) UpdateNoErrors(liveObj, newObj runtime.Object, manager string) runtime.Object {
+	obj, err := f.Update(liveObj, newObj, manager)
+	if err != nil {
+		// Preserve the managedFields from the live object rather than
+		// stripping them entirely, to avoid silent data loss when the
+		// managedFields update fails (e.g. due to an unavailable
+		// conversion webhook).
+		// Note: meta.Accessor for liveObj and newObj below never return an error in this code branch,
+		// because if they would f.Update above would return "newObj, nil". Accordingly, the case
+		// where one of the accessors returns an error is not handled here.
+		if liveAccessor, aErr := meta.Accessor(liveObj); aErr == nil {
+			if newAccessor, aErr := meta.Accessor(newObj); aErr == nil {
+				atMostEverySecond.Do(func() {
+					//nolint:logcheck // Should not be reached.
+					klog.ErrorS(err, "[SHOULD NOT HAPPEN] failed to update managedFields (restored previous managedFields from live object)", "versionKind",
+						newObj.GetObjectKind().GroupVersionKind(), "namespace", newAccessor.GetNamespace(), "name", newAccessor.GetName())
+				})
+				newAccessor.SetManagedFields(liveAccessor.GetManagedFields())
+			}
+		}
+		return newObj
+	}
+	return obj
+}
+
+// Returns true if the managedFields indicate that the user is trying to
+// reset the managedFields, i.e. if the list is non-nil but empty, or if
+// the list has one empty item.
+func isResetManagedFields(managedFields []metav1.ManagedFieldsEntry) bool {
+	if len(managedFields) == 0 {
+		return managedFields != nil
+	}
+
+	if len(managedFields) == 1 {
+		return reflect.DeepEqual(managedFields[0], metav1.ManagedFieldsEntry{})
+	}
+
+	return false
+}
+
+// Apply is used when server-side apply is called, as it merges the
+// object and updates the managed fields.
+func (f *FieldManager) Apply(liveObj, appliedObj runtime.Object, manager string, force bool) (object runtime.Object, err error) {
+	// If the object doesn't have metadata, apply isn't allowed.
+	accessor, err := meta.Accessor(liveObj)
+	if err != nil {
+		return nil, fmt.Errorf("couldn't get accessor: %v", err)
+	}
+
+	// Decode the managed fields in the live object, since it isn't allowed in the patch.
+	managed, err := DecodeManagedFields(accessor.GetManagedFields())
+	if err != nil {
+		return nil, fmt.Errorf("failed to decode managed fields: %v", err)
+	}
+
+	object, managed, err = f.fieldManager.Apply(liveObj, appliedObj, managed, manager, force)
+	if err != nil {
+		if conflicts, ok := err.(merge.Conflicts); ok {
+			return nil, NewConflictError(conflicts)
+		}
+		return nil, err
+	}
+
+	if err = EncodeObjectManagedFields(object, managed); err != nil {
+		return nil, fmt.Errorf("failed to encode managed fields: %v", err)
+	}
+
+	return object, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager_test.go
new file mode 100644
index 0000000000..67ec621532
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager_test.go
@@ -0,0 +1,105 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	internaltesting "k8s.io/apimachinery/pkg/util/managedfields/internal/testing"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+)
+
+func TestFieldManagerUpdateNoErrors(t *testing.T) {
+	fm := &fakeManager{}
+	f := internaltesting.NewTestFieldManagerImpl(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"),
+		"",
+		func(m internal.Manager) internal.Manager {
+			fm.Manager = m
+			return fm
+		})
+
+	podWithLabels := func(labels ...string) runtime.Object {
+		labelMap := map[string]interface{}{}
+		for _, key := range labels {
+			labelMap[key] = "true"
+		}
+		obj := &unstructured.Unstructured{
+			Object: map[string]interface{}{
+				"metadata": map[string]interface{}{
+					"labels": labelMap,
+				},
+			},
+		}
+		obj.SetKind("Pod")
+		obj.SetAPIVersion("v1")
+		return obj
+	}
+
+	f.UpdateNoErrors(podWithLabels("one"), "fieldmanager_test_update_1")
+	if len(f.ManagedFields()) == 0 {
+		t.Fatalf("expected managedFields to be set, but they are empty")
+	}
+
+	before := []metav1.ManagedFieldsEntry{}
+	for _, m := range f.ManagedFields() {
+		before = append(before, *m.DeepCopy())
+	}
+
+	// Inject an error so UpdateNoErrors will hit the error code path.
+	fm.Error = errors.New("test error")
+	f.UpdateNoErrors(podWithLabels("one", "two"), "fieldmanager_test_update_1")
+
+	if after := f.ManagedFields(); !apiequality.Semantic.DeepEqual(before, after) {
+		t.Fatalf("expected idempotence, but managedFields changed:\nbefore: %v\n after: %v", mustMarshal(before), mustMarshal(after))
+	}
+}
+
+var fakeTypeConverter = func() internal.TypeConverter {
+	data, err := os.ReadFile(filepath.Join(
+		strings.Repeat(".."+string(filepath.Separator), 8),
+		"api", "openapi-spec", "swagger.json"))
+	if err != nil {
+		panic(err)
+	}
+	convertedDefs := map[string]*spec.Schema{}
+	spec := spec.Swagger{}
+	if err := json.Unmarshal(data, &spec); err != nil {
+		panic(err)
+	}
+
+	for k, v := range spec.Definitions {
+		vCopy := v
+		convertedDefs[k] = &vCopy
+	}
+
+	typeConverter, err := internal.NewTypeConverter(convertedDefs, false)
+	if err != nil {
+		panic(err)
+	}
+	return typeConverter
+}()
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fields.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fields.go
new file mode 100644
index 0000000000..549412b41d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fields.go
@@ -0,0 +1,46 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+// EmptyFields represents a set with no paths
+// It looks like metav1.Fields{Raw: []byte("{}")}
+var EmptyFields = func() metav1.FieldsV1 {
+	f, err := SetToFields(*fieldpath.NewSet())
+	if err != nil {
+		panic("should never happen")
+	}
+	return f
+}()
+
+// FieldsToSet creates a set paths from an input trie of fields
+func FieldsToSet(f metav1.FieldsV1) (s fieldpath.Set, err error) {
+	err = s.FromJSON(f.GetRawReader())
+	return s, err
+}
+
+// SetToFields creates a trie of fields from an input set of paths
+func SetToFields(s fieldpath.Set) (f metav1.FieldsV1, err error) {
+	raw, err := s.ToJSON()
+	f.SetRawBytes(raw)
+	return f, err
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fields_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fields_test.go
new file mode 100644
index 0000000000..e397d2c681
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fields_test.go
@@ -0,0 +1,143 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+// TestFieldsRoundTrip tests that a fields trie can be round tripped as a path set
+func TestFieldsRoundTrip(t *testing.T) {
+	tests := []metav1.FieldsV1{
+		*metav1.NewFieldsV1(`{"f:metadata":{".":{},"f:name":{}}}`),
+		EmptyFields,
+	}
+
+	for _, test := range tests {
+		set, err := FieldsToSet(test)
+		if err != nil {
+			t.Fatalf("Failed to create path set: %v", err)
+		}
+		output, err := SetToFields(set)
+		if err != nil {
+			t.Fatalf("Failed to create fields trie from path set: %v", err)
+		}
+		if !reflect.DeepEqual(test, output) {
+			t.Fatalf("Expected round-trip:\ninput: %v\noutput: %v", test, output)
+		}
+	}
+}
+
+// TestFieldsToSetError tests that errors are picked up by FieldsToSet
+func TestFieldsToSetError(t *testing.T) {
+	tests := []struct {
+		fields    metav1.FieldsV1
+		errString string
+	}{
+		{
+			fields: *metav1.NewFieldsV1(
+				`{"k:{invalid json}":{"f:name":{},".":{}}}`,
+			),
+			errString: "ReadObjectCB",
+		},
+	}
+
+	for _, test := range tests {
+		_, err := FieldsToSet(test.fields)
+		if err == nil || !strings.Contains(err.Error(), test.errString) {
+			t.Fatalf("Expected error to contain %q but got: %v", test.errString, err)
+		}
+	}
+}
+
+// TestSetToFieldsError tests that errors are picked up by SetToFields
+func TestSetToFieldsError(t *testing.T) {
+	validName := "ok"
+	invalidPath := fieldpath.Path([]fieldpath.PathElement{{}, {FieldName: &validName}})
+
+	tests := []struct {
+		set       fieldpath.Set
+		errString string
+	}{
+		{
+			set:       *fieldpath.NewSet(invalidPath),
+			errString: "invalid PathElement",
+		},
+	}
+
+	for _, test := range tests {
+		_, err := SetToFields(test.set)
+		if err == nil || !strings.Contains(err.Error(), test.errString) {
+			t.Fatalf("Expected error to contain %q but got: %v", test.errString, err)
+		}
+	}
+}
+
+func BenchmarkSetToFields(b *testing.B) {
+	set := fieldpath.NewSet(
+		fieldpath.MakePathOrDie("foo", 0, "bar", "baz"),
+		fieldpath.MakePathOrDie("foo", 0, "bar", "zot"),
+		fieldpath.MakePathOrDie("foo", 0, "bar"),
+		fieldpath.MakePathOrDie("foo", 0),
+		fieldpath.MakePathOrDie("foo", 1, "bar", "baz"),
+		fieldpath.MakePathOrDie("foo", 1, "bar"),
+		fieldpath.MakePathOrDie("qux", fieldpath.KeyByFields("name", "first")),
+		fieldpath.MakePathOrDie("qux", fieldpath.KeyByFields("name", "first"), "bar"),
+		fieldpath.MakePathOrDie("qux", fieldpath.KeyByFields("name", "second"), "bar"),
+	)
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for n := 0; n < b.N; n++ {
+		_, err := SetToFields(*set)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func BenchmarkFieldsToSet(b *testing.B) {
+	set := fieldpath.NewSet(
+		fieldpath.MakePathOrDie("foo", 0, "bar", "baz"),
+		fieldpath.MakePathOrDie("foo", 0, "bar", "zot"),
+		fieldpath.MakePathOrDie("foo", 0, "bar"),
+		fieldpath.MakePathOrDie("foo", 0),
+		fieldpath.MakePathOrDie("foo", 1, "bar", "baz"),
+		fieldpath.MakePathOrDie("foo", 1, "bar"),
+		fieldpath.MakePathOrDie("qux", fieldpath.KeyByFields("name", "first")),
+		fieldpath.MakePathOrDie("qux", fieldpath.KeyByFields("name", "first"), "bar"),
+		fieldpath.MakePathOrDie("qux", fieldpath.KeyByFields("name", "second"), "bar"),
+	)
+	fields, err := SetToFields(*set)
+	if err != nil {
+		b.Fatal(err)
+	}
+	b.ReportAllocs()
+	b.ResetTimer()
+	for n := 0; n < b.N; n++ {
+		_, err := FieldsToSet(fields)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastapplied.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastapplied.go
new file mode 100644
index 0000000000..b00b6b8298
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastapplied.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	apimachineryvalidation "k8s.io/apimachinery/pkg/api/validation"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// LastAppliedConfigAnnotation is the annotation used to store the previous
+// configuration of a resource for use in a three way diff by UpdateApplyAnnotation.
+//
+// This is a copy of the corev1 annotation since we don't want to depend on the whole package.
+const LastAppliedConfigAnnotation = "kubectl.kubernetes.io/last-applied-configuration"
+
+// SetLastApplied sets the last-applied annotation the given value in
+// the object.
+func SetLastApplied(obj runtime.Object, value string) error {
+	accessor, err := meta.Accessor(obj)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't get accessor: %v", err))
+	}
+	var annotations = accessor.GetAnnotations()
+	if annotations == nil {
+		annotations = map[string]string{}
+	}
+	annotations[LastAppliedConfigAnnotation] = value
+	if err := apimachineryvalidation.ValidateAnnotationsSize(annotations); err != nil {
+		delete(annotations, LastAppliedConfigAnnotation)
+	}
+	accessor.SetAnnotations(annotations)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedmanager.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedmanager.go
new file mode 100644
index 0000000000..d58a1108dc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedmanager.go
@@ -0,0 +1,171 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+)
+
+type lastAppliedManager struct {
+	fieldManager    Manager
+	typeConverter   TypeConverter
+	objectConverter runtime.ObjectConvertor
+	groupVersion    schema.GroupVersion
+}
+
+var _ Manager = &lastAppliedManager{}
+
+// NewLastAppliedManager converts the client-side apply annotation to
+// server-side apply managed fields
+func NewLastAppliedManager(fieldManager Manager, typeConverter TypeConverter, objectConverter runtime.ObjectConvertor, groupVersion schema.GroupVersion) Manager {
+	return &lastAppliedManager{
+		fieldManager:    fieldManager,
+		typeConverter:   typeConverter,
+		objectConverter: objectConverter,
+		groupVersion:    groupVersion,
+	}
+}
+
+// Update implements Manager.
+func (f *lastAppliedManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	return f.fieldManager.Update(liveObj, newObj, managed, manager)
+}
+
+// Apply will consider the last-applied annotation
+// for upgrading an object managed by client-side apply to server-side apply
+// without conflicts.
+func (f *lastAppliedManager) Apply(liveObj, newObj runtime.Object, managed Managed, manager string, force bool) (runtime.Object, Managed, error) {
+	newLiveObj, newManaged, newErr := f.fieldManager.Apply(liveObj, newObj, managed, manager, force)
+	// Upgrade the client-side apply annotation only from kubectl server-side-apply.
+	// To opt-out of this behavior, users may specify a different field manager.
+	if manager != "kubectl" {
+		return newLiveObj, newManaged, newErr
+	}
+
+	// Check if we have conflicts
+	if newErr == nil {
+		return newLiveObj, newManaged, newErr
+	}
+	conflicts, ok := newErr.(merge.Conflicts)
+	if !ok {
+		return newLiveObj, newManaged, newErr
+	}
+	conflictSet := conflictsToSet(conflicts)
+
+	// Check if conflicts are allowed due to client-side apply,
+	// and if so, then force apply
+	allowedConflictSet, err := f.allowedConflictsFromLastApplied(liveObj)
+	if err != nil {
+		return newLiveObj, newManaged, newErr
+	}
+	if !conflictSet.Difference(allowedConflictSet).Empty() {
+		newConflicts := conflictsDifference(conflicts, allowedConflictSet)
+		return newLiveObj, newManaged, newConflicts
+	}
+
+	return f.fieldManager.Apply(liveObj, newObj, managed, manager, true)
+}
+
+func (f *lastAppliedManager) allowedConflictsFromLastApplied(liveObj runtime.Object) (*fieldpath.Set, error) {
+	var accessor, err = meta.Accessor(liveObj)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't get accessor: %v", err))
+	}
+
+	// If there is no client-side apply annotation, then there is nothing to do
+	var annotations = accessor.GetAnnotations()
+	if annotations == nil {
+		return nil, fmt.Errorf("no last applied annotation")
+	}
+	var lastApplied, ok = annotations[LastAppliedConfigAnnotation]
+	if !ok || lastApplied == "" {
+		return nil, fmt.Errorf("no last applied annotation")
+	}
+
+	liveObjVersioned, err := f.objectConverter.ConvertToVersion(liveObj, f.groupVersion)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert live obj to versioned: %v", err)
+	}
+
+	liveObjTyped, err := f.typeConverter.ObjectToTyped(liveObjVersioned)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert live obj to typed: %v", err)
+	}
+
+	var lastAppliedObj = &unstructured.Unstructured{Object: map[string]interface{}{}}
+	err = json.Unmarshal([]byte(lastApplied), lastAppliedObj)
+	if err != nil {
+		return nil, fmt.Errorf("failed to decode last applied obj: %v in '%s'", err, lastApplied)
+	}
+
+	if lastAppliedObj.GetAPIVersion() != f.groupVersion.String() {
+		return nil, fmt.Errorf("expected version of last applied to match live object '%s', but got '%s': %v", f.groupVersion.String(), lastAppliedObj.GetAPIVersion(), err)
+	}
+
+	lastAppliedObjTyped, err := f.typeConverter.ObjectToTyped(lastAppliedObj)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert last applied to typed: %v", err)
+	}
+
+	lastAppliedObjFieldSet, err := lastAppliedObjTyped.ToFieldSet()
+	if err != nil {
+		return nil, fmt.Errorf("failed to create fieldset for last applied object: %v", err)
+	}
+
+	comparison, err := lastAppliedObjTyped.Compare(liveObjTyped)
+	if err != nil {
+		return nil, fmt.Errorf("failed to compare last applied object and live object: %v", err)
+	}
+
+	// Remove fields in last applied that are different, added, or missing in
+	// the live object.
+	// Because last-applied fields don't match the live object fields,
+	// then we don't own these fields.
+	lastAppliedObjFieldSet = lastAppliedObjFieldSet.
+		Difference(comparison.Modified).
+		Difference(comparison.Added).
+		Difference(comparison.Removed)
+
+	return lastAppliedObjFieldSet, nil
+}
+
+// TODO: replace with merge.Conflicts.ToSet()
+func conflictsToSet(conflicts merge.Conflicts) *fieldpath.Set {
+	conflictSet := fieldpath.NewSet()
+	for _, conflict := range []merge.Conflict(conflicts) {
+		conflictSet.Insert(conflict.Path)
+	}
+	return conflictSet
+}
+
+func conflictsDifference(conflicts merge.Conflicts, s *fieldpath.Set) merge.Conflicts {
+	newConflicts := []merge.Conflict{}
+	for _, conflict := range []merge.Conflict(conflicts) {
+		if !s.Has(conflict.Path) {
+			newConflicts = append(newConflicts, conflict)
+		}
+	}
+	return newConflicts
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedmanager_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedmanager_test.go
new file mode 100644
index 0000000000..7824409569
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedmanager_test.go
@@ -0,0 +1,1007 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	"k8s.io/apimachinery/pkg/util/managedfields/managedfieldstest"
+	yamlutil "k8s.io/apimachinery/pkg/util/yaml"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+	"sigs.k8s.io/yaml"
+)
+
+type testArgs struct {
+	lastApplied       []byte
+	original          []byte
+	applied           []byte
+	fieldManager      string
+	expectConflictSet *fieldpath.Set
+}
+
+// TestApplyUsingLastAppliedAnnotation tests that applying to an object
+// created with the client-side apply last-applied annotation
+// will not give conflicts
+func TestApplyUsingLastAppliedAnnotation(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	tests := []testArgs{
+		{
+			fieldManager: "kubectl",
+			lastApplied: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-v1
+      - name: my-c2
+        image: my-image2
+`),
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app # missing from last-applied
+spec:
+  replicas: 100 # does not match last-applied
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-v2 # does no match last-applied
+      # note that second container in last-applied is missing
+`),
+			applied: []byte(`
+# test conflicts due to fields not allowed by last-applied
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-new-label # NOT allowed: update label
+spec:
+  replicas: 333 # NOT allowed: update replicas
+  selector:
+    matchLabels:
+      app: my-new-label # allowed: update label
+  template:
+    metadata:
+      labels:
+        app: my-new-label # allowed: update-label
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-new # NOT allowed: update image
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("metadata", "labels", "app"),
+				fieldpath.MakePathOrDie("spec", "replicas"),
+				fieldpath.MakePathOrDie("spec", "template", "spec", "containers", fieldpath.KeyByFields("name", "my-c"), "image"),
+			),
+		},
+		{
+			fieldManager: "kubectl",
+			lastApplied: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100 # does not match last applied
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+			applied: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-new-label
+spec:
+  replicas: 3 # expect conflict
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "replicas"),
+			),
+		},
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+			applied: []byte(`
+# applied object matches original
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+		},
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+			applied: []byte(`
+# test allowed update with no conflicts
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-new-label # update label
+spec:
+  replicas: 333 # update replicas
+  selector:
+    matchLabels:
+      app: my-new-label # update label
+  template:
+    metadata:
+      labels:
+        app: my-new-label # update-label
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+		},
+		{
+			fieldManager: "not_kubectl",
+			lastApplied: []byte(`
+# expect conflicts because field manager is NOT kubectl
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-v1
+`),
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100 # does not match last-applied
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-v2 # does no match last-applied
+`),
+			applied: []byte(`
+# test conflicts due to fields not allowed by last-applied
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-new-label # update label
+spec:
+  replicas: 333 # update replicas
+  selector:
+    matchLabels:
+      app: my-new-label # update label
+  template:
+    metadata:
+      labels:
+        app: my-new-label # update-label
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-new # update image
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("metadata", "labels", "app"),
+				fieldpath.MakePathOrDie("spec", "replicas"),
+				fieldpath.MakePathOrDie("spec", "selector"), // selector is atomic
+				fieldpath.MakePathOrDie("spec", "template", "metadata", "labels", "app"),
+				fieldpath.MakePathOrDie("spec", "template", "spec", "containers", fieldpath.KeyByFields("name", "my-c"), "image"),
+			),
+		},
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+			applied: []byte(`
+# test allowed update with no conflicts
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-new-label
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-new-image # update image
+`),
+		},
+		{
+			fieldManager: "not_kubectl",
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+			applied: []byte(`
+
+# expect changes to fail because field manager is not kubectl
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-new-label # update label
+spec:
+  replicas: 3 # update replicas
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-new-image # update image
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("metadata", "labels", "app"),
+				fieldpath.MakePathOrDie("spec", "replicas"),
+				fieldpath.MakePathOrDie("spec", "template", "spec", "containers", fieldpath.KeyByFields("name", "my-c"), "image"),
+			),
+		},
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 3
+`),
+			applied: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 100 # update replicas
+`),
+		},
+		{
+			fieldManager: "kubectl",
+			lastApplied: []byte(`
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 3
+`),
+			original: []byte(`
+apiVersion: apps/v1 # expect conflict due to apiVersion mismatch with last-applied
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 3
+`),
+			applied: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 100 # update replicas
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "replicas"),
+			),
+		},
+		{
+			fieldManager: "kubectl",
+			lastApplied: []byte(`
+apiVerison: foo
+kind: bar
+spec: expect conflict due to invalid object
+`),
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 3
+`),
+			applied: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 100 # update replicas
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "replicas"),
+			),
+		},
+		{
+			fieldManager: "kubectl",
+			// last-applied is empty
+			lastApplied: []byte{},
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 3
+`),
+			applied: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 100 # update replicas
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "replicas"),
+			),
+		},
+	}
+
+	testConflicts(t, f, tests)
+}
+
+func TestServiceApply(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Service"))
+
+	tests := []testArgs{
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: Service
+metadata:
+  name: test
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 8443
+  selector:
+    old: test
+`),
+			applied: []byte(`
+# All accepted while using the same field manager
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: test
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 8444
+  selector:
+    new: test
+`),
+		},
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: Service
+metadata:
+  name: test
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 8443
+  selector:
+    old: test
+`),
+			applied: []byte(`
+# Allowed to remove selectors while using the same field manager
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: test
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 8444
+  selector: {}
+`),
+		},
+		{
+			fieldManager: "not_kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: Service
+metadata:
+  name: test
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP # TODO: issue - this is a defaulted field, should not be required in a new spec
+    targetPort: 8443
+  selector:
+    old: test
+`),
+			applied: []byte(`
+# test selector update not allowed by last-applied
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: test
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 8444
+  selector:
+    new: test
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "selector"), // selector is atomic
+				fieldpath.MakePathOrDie("spec", "ports", fieldpath.KeyByFields("port", 443, "protocol", "TCP"), "targetPort"),
+			),
+		},
+	}
+
+	testConflicts(t, f, tests)
+}
+
+func TestReplicationControllerApply(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ReplicationController"))
+
+	tests := []testArgs{
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: ReplicationController
+metadata:
+  name: test
+spec:
+  replicas: 0
+  selector:
+    old: test
+`),
+			applied: []byte(`
+# All accepted while using the same field manager
+
+apiVersion: v1
+kind: ReplicationController
+metadata:
+  name: test
+spec:
+  replicas: 3
+  selector:
+    new: test
+`),
+		},
+		{
+			fieldManager: "not_kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: ReplicationController
+metadata:
+  name: test
+spec:
+  replicas: 0
+  selector:
+    old: test
+`),
+			applied: []byte(`
+# test selector update not allowed by last-applied
+
+apiVersion: v1
+kind: ReplicationController
+metadata:
+  name: test
+spec:
+  replicas: 3
+  selector:
+    new: test
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "selector"), // selector is atomic
+				fieldpath.MakePathOrDie("spec", "replicas"),
+			),
+		},
+	}
+
+	testConflicts(t, f, tests)
+}
+
+func TestPodApply(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"))
+
+	tests := []testArgs{
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeName: definetlyControlPlane
+  nodeSelector:
+    node-role.kubernetes.io/master: ""
+`),
+			applied: []byte(`
+# All accepted while using the same field manager
+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeSelector:
+    node-role.kubernetes.io/worker: ""
+`),
+		},
+		{
+			fieldManager: "not_kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeName: definetlyControlPlane
+  nodeSelector:
+    node-role.kubernetes.io/master: ""
+`),
+			applied: []byte(`
+# test selector update not allowed by last-applied
+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeName: definetlyControlPlane
+  nodeSelector:
+    node-role.kubernetes.io/master: ""
+    otherNodeType: ""
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "nodeSelector"), // selector is atomic
+			),
+		},
+		{
+			fieldManager: "not_kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeName: definetlyControlPlane
+  nodeSelector:
+    node-role.kubernetes.io/master: ""
+`),
+			applied: []byte(`
+# purging selector not allowed for different manager
+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeName: another
+  nodeSelector: {}
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "nodeSelector"), // selector is atomic
+				fieldpath.MakePathOrDie("spec", "nodeName"),
+			),
+		},
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeName: definetlyControlPlane
+  nodeSelector:
+    node-role.kubernetes.io/master: ""
+`),
+			applied: []byte(`
+# same manager could purge nodeSelector
+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeName: another
+  nodeSelector: {}
+`),
+		},
+	}
+
+	testConflicts(t, f, tests)
+}
+
+func testConflicts(t *testing.T, f managedfieldstest.TestFieldManager, tests []testArgs) {
+	for i, test := range tests {
+		t.Run(fmt.Sprintf("test %d", i), func(t *testing.T) {
+			f.Reset()
+
+			originalObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+			if err := yaml.Unmarshal(test.original, &originalObj.Object); err != nil {
+				t.Errorf("error decoding YAML: %v", err)
+			}
+
+			if test.lastApplied == nil {
+				test.lastApplied = test.original
+			}
+			if err := setLastAppliedFromEncoded(originalObj, test.lastApplied); err != nil {
+				t.Errorf("failed to set last applied: %v", err)
+			}
+
+			if err := f.Update(originalObj, "test_client_side_apply"); err != nil {
+				t.Errorf("failed to apply object: %v", err)
+			}
+
+			appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+			if err := yaml.Unmarshal(test.applied, &appliedObj.Object); err != nil {
+				t.Errorf("error decoding YAML: %v", err)
+			}
+
+			err := f.Apply(appliedObj, test.fieldManager, false)
+
+			if test.expectConflictSet == nil {
+				if err != nil {
+					t.Errorf("expected no error but got %v", err)
+				}
+			} else {
+				if err == nil || !apierrors.IsConflict(err) {
+					t.Errorf("expected to get conflicts but got %v", err)
+				}
+
+				expectedConflicts := merge.Conflicts{}
+				test.expectConflictSet.Iterate(func(p fieldpath.Path) {
+					expectedConflicts = append(expectedConflicts, merge.Conflict{
+						Manager: fmt.Sprintf(`{"manager":"test_client_side_apply","operation":"Update","apiVersion":"%s"}`, f.APIVersion()),
+						Path:    p,
+					})
+				})
+				expectedConflictErr := internal.NewConflictError(expectedConflicts)
+				if !reflect.DeepEqual(expectedConflictErr, err) {
+					t.Errorf("expected to get\n%+v\nbut got\n%+v", expectedConflictErr, err)
+				}
+
+				// Yet force should resolve all conflicts
+				err = f.Apply(appliedObj, test.fieldManager, true)
+				if err != nil {
+					t.Errorf("unexpected error during force ownership apply: %v", err)
+				}
+
+			}
+
+			// Eventually resource should contain applied changes
+			if !apiequality.Semantic.DeepDerivative(appliedObj, f.Live()) {
+				t.Errorf("expected equal resource: \n%#v, got: \n%#v", appliedObj, f.Live())
+			}
+		})
+	}
+}
+
+func yamlToJSON(y []byte) (string, error) {
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal(y, &obj.Object); err != nil {
+		return "", fmt.Errorf("error decoding YAML: %v", err)
+	}
+	serialization, err := runtime.Encode(unstructured.UnstructuredJSONScheme, obj)
+	if err != nil {
+		return "", fmt.Errorf("error encoding object: %v", err)
+	}
+	json, err := yamlutil.ToJSON(serialization)
+	if err != nil {
+		return "", fmt.Errorf("error converting to json: %v", err)
+	}
+	return string(json), nil
+}
+
+func setLastAppliedFromEncoded(obj runtime.Object, lastApplied []byte) error {
+	lastAppliedJSON, err := yamlToJSON(lastApplied)
+	if err != nil {
+		return err
+	}
+	return internal.SetLastApplied(obj, lastAppliedJSON)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedupdater.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedupdater.go
new file mode 100644
index 0000000000..06e6c5d8ce
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedupdater.go
@@ -0,0 +1,102 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+type lastAppliedUpdater struct {
+	fieldManager Manager
+}
+
+var _ Manager = &lastAppliedUpdater{}
+
+// NewLastAppliedUpdater sets the client-side apply annotation up to date with
+// server-side apply managed fields
+func NewLastAppliedUpdater(fieldManager Manager) Manager {
+	return &lastAppliedUpdater{
+		fieldManager: fieldManager,
+	}
+}
+
+// Update implements Manager.
+func (f *lastAppliedUpdater) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	return f.fieldManager.Update(liveObj, newObj, managed, manager)
+}
+
+// server-side apply managed fields
+func (f *lastAppliedUpdater) Apply(liveObj, newObj runtime.Object, managed Managed, manager string, force bool) (runtime.Object, Managed, error) {
+	liveObj, managed, err := f.fieldManager.Apply(liveObj, newObj, managed, manager, force)
+	if err != nil {
+		return liveObj, managed, err
+	}
+
+	// Sync the client-side apply annotation only from kubectl server-side apply.
+	// To opt-out of this behavior, users may specify a different field manager.
+	//
+	// If the client-side apply annotation doesn't exist,
+	// then continue because we have no annotation to update
+	if manager == "kubectl" && hasLastApplied(liveObj) {
+		lastAppliedValue, err := buildLastApplied(newObj)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to build last-applied annotation: %v", err)
+		}
+		err = SetLastApplied(liveObj, lastAppliedValue)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to set last-applied annotation: %v", err)
+		}
+	}
+	return liveObj, managed, err
+}
+
+func hasLastApplied(obj runtime.Object) bool {
+	var accessor, err = meta.Accessor(obj)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't get accessor: %v", err))
+	}
+	var annotations = accessor.GetAnnotations()
+	if annotations == nil {
+		return false
+	}
+	lastApplied, ok := annotations[LastAppliedConfigAnnotation]
+	return ok && len(lastApplied) > 0
+}
+
+func buildLastApplied(obj runtime.Object) (string, error) {
+	obj = obj.DeepCopyObject()
+
+	var accessor, err = meta.Accessor(obj)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't get accessor: %v", err))
+	}
+
+	// Remove the annotation from the object before encoding the object
+	var annotations = accessor.GetAnnotations()
+	delete(annotations, LastAppliedConfigAnnotation)
+	accessor.SetAnnotations(annotations)
+
+	lastApplied, err := runtime.Encode(unstructured.UnstructuredJSONScheme, obj)
+	if err != nil {
+		return "", fmt.Errorf("couldn't encode object into last applied annotation: %v", err)
+	}
+	return string(lastApplied), nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedupdater_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedupdater_test.go
new file mode 100644
index 0000000000..ede066ea24
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedupdater_test.go
@@ -0,0 +1,268 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	internaltesting "k8s.io/apimachinery/pkg/util/managedfields/internal/testing"
+	"sigs.k8s.io/yaml"
+)
+
+func TestLastAppliedUpdater(t *testing.T) {
+	f := internaltesting.NewTestFieldManagerImpl(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"),
+		"",
+		func(m internal.Manager) internal.Manager {
+			return internal.NewLastAppliedUpdater(m)
+		})
+
+	originalLastApplied := `nonempty`
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	appliedDeployment := []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  annotations:
+    "kubectl.kubernetes.io/last-applied-configuration": "` + originalLastApplied + `"
+  labels:
+    app: my-app
+spec:
+  replicas: 20
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`)
+	if err := yaml.Unmarshal(appliedDeployment, &appliedObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+
+	if err := f.Apply(appliedObj, "NOT-KUBECTL", false); err != nil {
+		t.Errorf("error applying object: %v", err)
+	}
+
+	lastApplied, err := getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+
+	if lastApplied != originalLastApplied {
+		t.Errorf("expected last applied annotation to be %q and NOT be updated, but got: %q", originalLastApplied, lastApplied)
+	}
+
+	if err := f.Apply(appliedObj, "kubectl", false); err != nil {
+		t.Errorf("error applying object: %v", err)
+	}
+
+	lastApplied, err = getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+
+	if lastApplied == originalLastApplied ||
+		!strings.Contains(lastApplied, "my-app") ||
+		!strings.Contains(lastApplied, "my-image") {
+		t.Errorf("expected last applied annotation to be updated, but got: %q", lastApplied)
+	}
+}
+
+func TestLargeLastApplied(t *testing.T) {
+	tests := []struct {
+		name      string
+		oldObject *unstructured.Unstructured
+		newObject *unstructured.Unstructured
+	}{
+		{
+			name: "old object + new object last-applied annotation is too big",
+			oldObject: func() *unstructured.Unstructured {
+				u := &unstructured.Unstructured{}
+				err := json.Unmarshal([]byte(`
+{
+   "metadata": {
+      "name": "large-update-test-cm",
+      "namespace": "default",
+      "annotations": {
+         "kubectl.kubernetes.io/last-applied-configuration": "nonempty"
+      }
+   },
+   "apiVersion": "v1",
+   "kind": "ConfigMap",
+   "data": {
+      "k": "v"
+   }
+}`), &u)
+				if err != nil {
+					panic(err)
+				}
+				return u
+			}(),
+			newObject: func() *unstructured.Unstructured {
+				u := &unstructured.Unstructured{}
+				err := json.Unmarshal([]byte(`
+{
+   "metadata": {
+      "name": "large-update-test-cm",
+      "namespace": "default",
+      "annotations": {
+         "kubectl.kubernetes.io/last-applied-configuration": "nonempty"
+      }
+   },
+   "apiVersion": "v1",
+   "kind": "ConfigMap",
+   "data": {
+      "k": "v"
+   }
+}`), &u)
+				if err != nil {
+					panic(err)
+				}
+				for i := 0; i < 9999; i++ {
+					unique := fmt.Sprintf("this-key-is-very-long-so-as-to-create-a-very-large-serialized-fieldset-%v", i)
+					unstructured.SetNestedField(u.Object, "A", "data", unique)
+				}
+				return u
+			}(),
+		},
+		{
+			name: "old object + new object annotations + new object last-applied annotation is too big",
+			oldObject: func() *unstructured.Unstructured {
+				u := &unstructured.Unstructured{}
+				err := json.Unmarshal([]byte(`
+{
+   "metadata": {
+      "name": "large-update-test-cm",
+      "namespace": "default",
+      "annotations": {
+         "kubectl.kubernetes.io/last-applied-configuration": "nonempty"
+      }
+   },
+   "apiVersion": "v1",
+   "kind": "ConfigMap",
+   "data": {
+      "k": "v"
+   }
+}`), &u)
+				if err != nil {
+					panic(err)
+				}
+				for i := 0; i < 2000; i++ {
+					unique := fmt.Sprintf("this-key-is-very-long-so-as-to-create-a-very-large-serialized-fieldset-%v", i)
+					unstructured.SetNestedField(u.Object, "A", "data", unique)
+				}
+				return u
+			}(),
+			newObject: func() *unstructured.Unstructured {
+				u := &unstructured.Unstructured{}
+				err := json.Unmarshal([]byte(`
+{
+   "metadata": {
+      "name": "large-update-test-cm",
+      "namespace": "default",
+      "annotations": {
+         "kubectl.kubernetes.io/last-applied-configuration": "nonempty"
+      }
+   },
+   "apiVersion": "v1",
+   "kind": "ConfigMap",
+   "data": {
+      "k": "v"
+   }
+}`), &u)
+				if err != nil {
+					panic(err)
+				}
+				for i := 0; i < 2000; i++ {
+					unique := fmt.Sprintf("this-key-is-very-long-so-as-to-create-a-very-large-serialized-fieldset-%v", i)
+					unstructured.SetNestedField(u.Object, "A", "data", unique)
+					unstructured.SetNestedField(u.Object, "A", "metadata", "annotations", unique)
+				}
+				return u
+			}(),
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			f := internaltesting.NewTestFieldManagerImpl(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"),
+				"",
+				func(m internal.Manager) internal.Manager {
+					return internal.NewLastAppliedUpdater(m)
+				})
+
+			if err := f.Apply(test.oldObject, "kubectl", false); err != nil {
+				t.Errorf("Error applying object: %v", err)
+			}
+
+			lastApplied, err := getLastApplied(f.Live())
+			if err != nil {
+				t.Errorf("Failed to access last applied annotation: %v", err)
+			}
+			if len(lastApplied) == 0 || lastApplied == "nonempty" {
+				t.Errorf("Expected an updated last-applied annotation, but got: %q", lastApplied)
+			}
+
+			if err := f.Apply(test.newObject, "kubectl", false); err != nil {
+				t.Errorf("Error applying object: %v", err)
+			}
+
+			accessor := meta.NewAccessor()
+			annotations, err := accessor.Annotations(f.Live())
+			if err != nil {
+				t.Errorf("Failed to access annotations: %v", err)
+			}
+			if annotations == nil {
+				t.Errorf("No annotations on obj: %v", f.Live())
+			}
+			lastApplied, ok := annotations[internal.LastAppliedConfigAnnotation]
+			if ok || len(lastApplied) > 0 {
+				t.Errorf("Expected no last applied annotation, but got last applied with length: %d", len(lastApplied))
+			}
+		})
+	}
+}
+
+func getLastApplied(obj runtime.Object) (string, error) {
+	accessor := meta.NewAccessor()
+	annotations, err := accessor.Annotations(obj)
+	if err != nil {
+		return "", fmt.Errorf("failed to access annotations: %v", err)
+	}
+	if annotations == nil {
+		return "", fmt.Errorf("no annotations on obj: %v", obj)
+	}
+
+	lastApplied, ok := annotations[internal.LastAppliedConfigAnnotation]
+	if !ok {
+		return "", fmt.Errorf("expected last applied annotation, but got none for object: %v", obj)
+	}
+	return lastApplied, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfields.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfields.go
new file mode 100644
index 0000000000..bba2014e20
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfields.go
@@ -0,0 +1,248 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"encoding/json"
+	"fmt"
+	"sort"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+// ManagedInterface groups a fieldpath.ManagedFields together with the timestamps associated with each operation.
+type ManagedInterface interface {
+	// Fields gets the fieldpath.ManagedFields.
+	Fields() fieldpath.ManagedFields
+
+	// Times gets the timestamps associated with each operation.
+	Times() map[string]*metav1.Time
+}
+
+type managedStruct struct {
+	fields fieldpath.ManagedFields
+	times  map[string]*metav1.Time
+}
+
+var _ ManagedInterface = &managedStruct{}
+
+// Fields implements ManagedInterface.
+func (m *managedStruct) Fields() fieldpath.ManagedFields {
+	return m.fields
+}
+
+// Times implements ManagedInterface.
+func (m *managedStruct) Times() map[string]*metav1.Time {
+	return m.times
+}
+
+// NewEmptyManaged creates an empty ManagedInterface.
+func NewEmptyManaged() ManagedInterface {
+	return NewManaged(fieldpath.ManagedFields{}, map[string]*metav1.Time{})
+}
+
+// NewManaged creates a ManagedInterface from a fieldpath.ManagedFields and the timestamps associated with each operation.
+func NewManaged(f fieldpath.ManagedFields, t map[string]*metav1.Time) ManagedInterface {
+	return &managedStruct{
+		fields: f,
+		times:  t,
+	}
+}
+
+// RemoveObjectManagedFields removes the ManagedFields from the object
+// before we merge so that it doesn't appear in the ManagedFields
+// recursively.
+func RemoveObjectManagedFields(obj runtime.Object) {
+	accessor, err := meta.Accessor(obj)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't get accessor: %v", err))
+	}
+	accessor.SetManagedFields(nil)
+}
+
+// EncodeObjectManagedFields converts and stores the fieldpathManagedFields into the objects ManagedFields
+func EncodeObjectManagedFields(obj runtime.Object, managed ManagedInterface) error {
+	accessor, err := meta.Accessor(obj)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't get accessor: %v", err))
+	}
+
+	encodedManagedFields, err := encodeManagedFields(managed)
+	if err != nil {
+		return fmt.Errorf("failed to convert back managed fields to API: %v", err)
+	}
+	accessor.SetManagedFields(encodedManagedFields)
+
+	return nil
+}
+
+// DecodeManagedFields converts ManagedFields from the wire format (api format)
+// to the format used by sigs.k8s.io/structured-merge-diff
+func DecodeManagedFields(encodedManagedFields []metav1.ManagedFieldsEntry) (ManagedInterface, error) {
+	managed := managedStruct{}
+	managed.fields = make(fieldpath.ManagedFields, len(encodedManagedFields))
+	managed.times = make(map[string]*metav1.Time, len(encodedManagedFields))
+
+	for i, encodedVersionedSet := range encodedManagedFields {
+		switch encodedVersionedSet.Operation {
+		case metav1.ManagedFieldsOperationApply, metav1.ManagedFieldsOperationUpdate:
+		default:
+			return nil, fmt.Errorf("operation must be `Apply` or `Update`")
+		}
+		if len(encodedVersionedSet.APIVersion) < 1 {
+			return nil, fmt.Errorf("apiVersion must not be empty")
+		}
+		switch encodedVersionedSet.FieldsType {
+		case "FieldsV1":
+			// Valid case.
+		case "":
+			return nil, fmt.Errorf("missing fieldsType in managed fields entry %d", i)
+		default:
+			return nil, fmt.Errorf("invalid fieldsType %q in managed fields entry %d", encodedVersionedSet.FieldsType, i)
+		}
+		manager, err := BuildManagerIdentifier(&encodedVersionedSet)
+		if err != nil {
+			return nil, fmt.Errorf("error decoding manager from %v: %v", encodedVersionedSet, err)
+		}
+		managed.fields[manager], err = decodeVersionedSet(&encodedVersionedSet)
+		if err != nil {
+			return nil, fmt.Errorf("error decoding versioned set from %v: %v", encodedVersionedSet, err)
+		}
+		managed.times[manager] = encodedVersionedSet.Time
+	}
+	return &managed, nil
+}
+
+// BuildManagerIdentifier creates a manager identifier string from a ManagedFieldsEntry
+func BuildManagerIdentifier(encodedManager *metav1.ManagedFieldsEntry) (manager string, err error) {
+	encodedManagerCopy := *encodedManager
+
+	// Never include fields type in the manager identifier
+	encodedManagerCopy.FieldsType = ""
+
+	// Never include the fields in the manager identifier
+	encodedManagerCopy.FieldsV1 = nil
+
+	// Never include the time in the manager identifier
+	encodedManagerCopy.Time = nil
+
+	// For appliers, don't include the APIVersion in the manager identifier,
+	// so it will always have the same manager identifier each time it applied.
+	if encodedManager.Operation == metav1.ManagedFieldsOperationApply {
+		encodedManagerCopy.APIVersion = ""
+	}
+
+	// Use the remaining fields to build the manager identifier
+	b, err := json.Marshal(&encodedManagerCopy)
+	if err != nil {
+		return "", fmt.Errorf("error marshalling manager identifier: %v", err)
+	}
+
+	return string(b), nil
+}
+
+func decodeVersionedSet(encodedVersionedSet *metav1.ManagedFieldsEntry) (versionedSet fieldpath.VersionedSet, err error) {
+	fields := EmptyFields
+	if encodedVersionedSet.FieldsV1 != nil {
+		fields = *encodedVersionedSet.FieldsV1
+	}
+	set, err := FieldsToSet(fields)
+	if err != nil {
+		return nil, fmt.Errorf("error decoding set: %v", err)
+	}
+	return fieldpath.NewVersionedSet(&set, fieldpath.APIVersion(encodedVersionedSet.APIVersion), encodedVersionedSet.Operation == metav1.ManagedFieldsOperationApply), nil
+}
+
+// encodeManagedFields converts ManagedFields from the format used by
+// sigs.k8s.io/structured-merge-diff to the wire format (api format)
+func encodeManagedFields(managed ManagedInterface) (encodedManagedFields []metav1.ManagedFieldsEntry, err error) {
+	if len(managed.Fields()) == 0 {
+		return nil, nil
+	}
+	encodedManagedFields = []metav1.ManagedFieldsEntry{}
+	for manager := range managed.Fields() {
+		versionedSet := managed.Fields()[manager]
+		v, err := encodeManagerVersionedSet(manager, versionedSet)
+		if err != nil {
+			return nil, fmt.Errorf("error encoding versioned set for %v: %v", manager, err)
+		}
+		if t, ok := managed.Times()[manager]; ok {
+			v.Time = t
+		}
+		encodedManagedFields = append(encodedManagedFields, *v)
+	}
+	return sortEncodedManagedFields(encodedManagedFields)
+}
+
+func sortEncodedManagedFields(encodedManagedFields []metav1.ManagedFieldsEntry) (sortedManagedFields []metav1.ManagedFieldsEntry, err error) {
+	sort.Slice(encodedManagedFields, func(i, j int) bool {
+		p, q := encodedManagedFields[i], encodedManagedFields[j]
+
+		if p.Operation != q.Operation {
+			return p.Operation < q.Operation
+		}
+
+		pSeconds, qSeconds := int64(0), int64(0)
+		if p.Time != nil {
+			pSeconds = p.Time.Unix()
+		}
+		if q.Time != nil {
+			qSeconds = q.Time.Unix()
+		}
+		if pSeconds != qSeconds {
+			return pSeconds < qSeconds
+		}
+
+		if p.Manager != q.Manager {
+			return p.Manager < q.Manager
+		}
+
+		if p.APIVersion != q.APIVersion {
+			return p.APIVersion < q.APIVersion
+		}
+		return p.Subresource < q.Subresource
+	})
+
+	return encodedManagedFields, nil
+}
+
+func encodeManagerVersionedSet(manager string, versionedSet fieldpath.VersionedSet) (encodedVersionedSet *metav1.ManagedFieldsEntry, err error) {
+	encodedVersionedSet = &metav1.ManagedFieldsEntry{}
+
+	// Get as many fields as we can from the manager identifier
+	err = json.Unmarshal([]byte(manager), encodedVersionedSet)
+	if err != nil {
+		return nil, fmt.Errorf("error unmarshalling manager identifier %v: %v", manager, err)
+	}
+
+	// Get the APIVersion, Operation, and Fields from the VersionedSet
+	encodedVersionedSet.APIVersion = string(versionedSet.APIVersion())
+	if versionedSet.Applied() {
+		encodedVersionedSet.Operation = metav1.ManagedFieldsOperationApply
+	}
+	encodedVersionedSet.FieldsType = "FieldsV1"
+	fields, err := SetToFields(*versionedSet.Set())
+	if err != nil {
+		return nil, fmt.Errorf("error encoding set: %v", err)
+	}
+	encodedVersionedSet.FieldsV1 = &fields
+
+	return encodedVersionedSet, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfields_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfields_test.go
new file mode 100644
index 0000000000..2d8cb12405
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfields_test.go
@@ -0,0 +1,520 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"sigs.k8s.io/yaml"
+)
+
+// TestHasFieldsType makes sure that we fail if we don't have a
+// FieldsType set properly.
+func TestHasFieldsType(t *testing.T) {
+	var unmarshaled []metav1.ManagedFieldsEntry
+	if err := yaml.Unmarshal([]byte(`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:field: {}
+  manager: foo
+  operation: Apply
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err != nil {
+		t.Fatalf("did not expect decoding error but got: %v", err)
+	}
+
+	// Invalid fieldsType V2.
+	if err := yaml.Unmarshal([]byte(`- apiVersion: v1
+  fieldsType: FieldsV2
+  fieldsV1:
+    f:field: {}
+  manager: foo
+  operation: Apply
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err == nil {
+		t.Fatal("Expect decoding error but got none")
+	}
+
+	// Missing fieldsType.
+	if err := yaml.Unmarshal([]byte(`- apiVersion: v1
+  fieldsV1:
+    f:field: {}
+  manager: foo
+  operation: Apply
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err == nil {
+		t.Fatal("Expect decoding error but got none")
+	}
+}
+
+// TestHasAPIVersion makes sure that we fail if we don't have an
+// APIVersion set.
+func TestHasAPIVersion(t *testing.T) {
+	var unmarshaled []metav1.ManagedFieldsEntry
+	if err := yaml.Unmarshal([]byte(`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:field: {}
+  manager: foo
+  operation: Apply
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err != nil {
+		t.Fatalf("did not expect decoding error but got: %v", err)
+	}
+
+	// Missing apiVersion.
+	unmarshaled = nil
+	if err := yaml.Unmarshal([]byte(`- fieldsType: FieldsV1
+  fieldsV1:
+    f:field: {}
+  manager: foo
+  operation: Apply
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err == nil {
+		t.Fatal("Expect decoding error but got none")
+	}
+}
+
+// TestHasOperation makes sure that we fail if we don't have an
+// Operation set properly.
+func TestHasOperation(t *testing.T) {
+	var unmarshaled []metav1.ManagedFieldsEntry
+	if err := yaml.Unmarshal([]byte(`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:field: {}
+  manager: foo
+  operation: Apply
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err != nil {
+		t.Fatalf("did not expect decoding error but got: %v", err)
+	}
+
+	// Invalid operation.
+	if err := yaml.Unmarshal([]byte(`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:field: {}
+  manager: foo
+  operation: Invalid
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err == nil {
+		t.Fatal("Expect decoding error but got none")
+	}
+
+	// Missing operation.
+	unmarshaled = nil
+	if err := yaml.Unmarshal([]byte(`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:field: {}
+  manager: foo
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err == nil {
+		t.Fatal("Expect decoding error but got none")
+	}
+}
+
+// TestRoundTripManagedFields will roundtrip ManagedFields from the wire format
+// (api format) to the format used by sigs.k8s.io/structured-merge-diff and back
+func TestRoundTripManagedFields(t *testing.T) {
+	tests := []string{
+		`null
+`,
+		`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    v:3:
+      f:alsoPi: {}
+    v:3.1415:
+      f:pi: {}
+    v:false:
+      f:notTrue: {}
+  manager: foo
+  operation: Update
+  time: "2001-02-03T04:05:06Z"
+- apiVersion: v1beta1
+  fieldsType: FieldsV1
+  fieldsV1:
+    i:5:
+      f:i: {}
+  manager: foo
+  operation: Update
+  time: "2011-12-13T14:15:16Z"
+`,
+		`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:spec:
+      f:containers:
+        k:{"name":"c"}:
+          f:image: {}
+          f:name: {}
+  manager: foo
+  operation: Apply
+`,
+		`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:apiVersion: {}
+    f:kind: {}
+    f:metadata:
+      f:labels:
+        f:app: {}
+      f:name: {}
+    f:spec:
+      f:replicas: {}
+      f:selector:
+        f:matchLabels:
+          f:app: {}
+      f:template:
+        f:medatada:
+          f:labels:
+            f:app: {}
+        f:spec:
+          f:containers:
+            k:{"name":"nginx"}:
+              .: {}
+              f:image: {}
+              f:name: {}
+              f:ports:
+                i:0:
+                  f:containerPort: {}
+  manager: foo
+  operation: Update
+`,
+		`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:allowVolumeExpansion: {}
+    f:apiVersion: {}
+    f:kind: {}
+    f:metadata:
+      f:name: {}
+      f:parameters:
+        f:resturl: {}
+        f:restuser: {}
+        f:secretName: {}
+        f:secretNamespace: {}
+    f:provisioner: {}
+  manager: foo
+  operation: Apply
+`,
+		`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:apiVersion: {}
+    f:kind: {}
+    f:metadata:
+      f:name: {}
+    f:spec:
+      f:group: {}
+      f:names:
+        f:kind: {}
+        f:plural: {}
+        f:shortNames:
+          i:0: {}
+        f:singular: {}
+      f:scope: {}
+      f:versions:
+        k:{"name":"v1"}:
+          f:name: {}
+          f:served: {}
+          f:storage: {}
+  manager: foo
+  operation: Update
+`,
+		`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:spec:
+      f:replicas: {}
+  manager: foo
+  operation: Update
+  subresource: scale
+`,
+	}
+
+	for _, test := range tests {
+		t.Run(test, func(t *testing.T) {
+			var unmarshaled []metav1.ManagedFieldsEntry
+			if err := yaml.Unmarshal([]byte(test), &unmarshaled); err != nil {
+				t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+			}
+			decoded, err := DecodeManagedFields(unmarshaled)
+			if err != nil {
+				t.Fatalf("did not expect decoding error but got: %v", err)
+			}
+			encoded, err := encodeManagedFields(decoded)
+			if err != nil {
+				t.Fatalf("did not expect encoding error but got: %v", err)
+			}
+			marshaled, err := yaml.Marshal(&encoded)
+			if err != nil {
+				t.Fatalf("did not expect yaml marshalling error but got: %v", err)
+			}
+			if !reflect.DeepEqual(string(marshaled), test) {
+				t.Fatalf("expected:\n%v\nbut got:\n%v", test, string(marshaled))
+			}
+		})
+	}
+}
+
+func TestBuildManagerIdentifier(t *testing.T) {
+	tests := []struct {
+		managedFieldsEntry string
+		expected           string
+	}{
+		{
+			managedFieldsEntry: `
+apiVersion: v1
+fieldsV1:
+  f:apiVersion: {}
+manager: foo
+operation: Update
+time: "2001-02-03T04:05:06Z"
+`,
+			expected: "{\"manager\":\"foo\",\"operation\":\"Update\",\"apiVersion\":\"v1\"}",
+		},
+		{
+			managedFieldsEntry: `
+apiVersion: v1
+fieldsV1:
+  f:apiVersion: {}
+manager: foo
+operation: Apply
+time: "2001-02-03T04:05:06Z"
+`,
+			expected: "{\"manager\":\"foo\",\"operation\":\"Apply\"}",
+		},
+		{
+			managedFieldsEntry: `
+apiVersion: v1
+fieldsV1:
+  f:apiVersion: {}
+manager: foo
+operation: Apply
+subresource: scale
+time: "2001-02-03T04:05:06Z"
+`,
+			expected: "{\"manager\":\"foo\",\"operation\":\"Apply\",\"subresource\":\"scale\"}",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.managedFieldsEntry, func(t *testing.T) {
+			var unmarshaled metav1.ManagedFieldsEntry
+			if err := yaml.Unmarshal([]byte(test.managedFieldsEntry), &unmarshaled); err != nil {
+				t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+			}
+			decoded, err := BuildManagerIdentifier(&unmarshaled)
+			if err != nil {
+				t.Fatalf("did not expect decoding error but got: %v", err)
+			}
+			if !reflect.DeepEqual(decoded, test.expected) {
+				t.Fatalf("expected:\n%v\nbut got:\n%v", test.expected, decoded)
+			}
+		})
+	}
+}
+
+func TestSortEncodedManagedFields(t *testing.T) {
+	tests := []struct {
+		name          string
+		managedFields []metav1.ManagedFieldsEntry
+		expected      []metav1.ManagedFieldsEntry
+	}{
+		{
+			name:          "empty",
+			managedFields: []metav1.ManagedFieldsEntry{},
+			expected:      []metav1.ManagedFieldsEntry{},
+		},
+		{
+			name:          "nil",
+			managedFields: nil,
+			expected:      nil,
+		},
+		{
+			name: "remains untouched",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+			},
+		},
+		{
+			name: "manager without time first",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+			},
+		},
+		{
+			name: "manager without time first name last",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+			},
+		},
+		{
+			name: "apply first",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+			},
+		},
+		{
+			name: "newest last",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2002-01-01T01:00:00Z")},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2002-01-01T01:00:00Z")},
+			},
+		},
+		{
+			name: "manager last",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "d", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "d", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+			},
+		},
+		{
+			name: "manager sorted",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "g", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "f", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2002-01-01T01:00:00Z")},
+				{Manager: "i", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "d", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2002-01-01T01:00:00Z")},
+				{Manager: "h", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "e", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2003-01-01T01:00:00Z")},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "g", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "h", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "i", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "d", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2002-01-01T01:00:00Z")},
+				{Manager: "f", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2002-01-01T01:00:00Z")},
+				{Manager: "e", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2003-01-01T01:00:00Z")},
+			},
+		},
+		{
+			name: "sort drops nanoseconds",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: &metav1.Time{Time: time.Date(2000, time.January, 0, 0, 0, 0, 1, time.UTC)}},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationUpdate, Time: &metav1.Time{Time: time.Date(2000, time.January, 0, 0, 0, 0, 2, time.UTC)}},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationUpdate, Time: &metav1.Time{Time: time.Date(2000, time.January, 0, 0, 0, 0, 3, time.UTC)}},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationUpdate, Time: &metav1.Time{Time: time.Date(2000, time.January, 0, 0, 0, 0, 2, time.UTC)}},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationUpdate, Time: &metav1.Time{Time: time.Date(2000, time.January, 0, 0, 0, 0, 3, time.UTC)}},
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: &metav1.Time{Time: time.Date(2000, time.January, 0, 0, 0, 0, 1, time.UTC)}},
+			},
+		},
+		{
+			name: "entries with subresource field",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Subresource: "status"},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Subresource: "scale"},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Subresource: "scale"},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Subresource: "status"},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			sorted, err := sortEncodedManagedFields(test.managedFields)
+			if err != nil {
+				t.Fatalf("did not expect error when sorting but got: %v", err)
+			}
+			if !reflect.DeepEqual(sorted, test.expected) {
+				t.Fatalf("expected:\n%v\nbut got:\n%v", test.expected, sorted)
+			}
+		})
+	}
+}
+
+func parseTimeOrPanic(s string) *metav1.Time {
+	t, err := time.Parse(time.RFC3339, s)
+	if err != nil {
+		panic(fmt.Sprintf("failed to parse time %s, got: %v", s, err))
+	}
+	return &metav1.Time{Time: t.UTC()}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfieldsupdater.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfieldsupdater.go
new file mode 100644
index 0000000000..66215d87a1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfieldsupdater.go
@@ -0,0 +1,82 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+type managedFieldsUpdater struct {
+	fieldManager Manager
+}
+
+var _ Manager = &managedFieldsUpdater{}
+
+// NewManagedFieldsUpdater is responsible for updating the managedfields
+// in the object, updating the time of the operation as necessary. For
+// updates, it uses a hard-coded manager to detect if things have
+// changed, and swaps back the correct manager after the operation is
+// done.
+func NewManagedFieldsUpdater(fieldManager Manager) Manager {
+	return &managedFieldsUpdater{
+		fieldManager: fieldManager,
+	}
+}
+
+// Update implements Manager.
+func (f *managedFieldsUpdater) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	self := "current-operation"
+	object, managed, err := f.fieldManager.Update(liveObj, newObj, managed, self)
+	if err != nil {
+		return object, managed, err
+	}
+
+	// If the current operation took any fields from anything, it means the object changed,
+	// so update the timestamp of the managedFieldsEntry and merge with any previous updates from the same manager
+	if vs, ok := managed.Fields()[self]; ok {
+		delete(managed.Fields(), self)
+
+		if previous, ok := managed.Fields()[manager]; ok {
+			managed.Fields()[manager] = fieldpath.NewVersionedSet(vs.Set().Union(previous.Set()), vs.APIVersion(), vs.Applied())
+		} else {
+			managed.Fields()[manager] = vs
+		}
+
+		managed.Times()[manager] = &metav1.Time{Time: time.Now().UTC()}
+	}
+
+	return object, managed, nil
+}
+
+// Apply implements Manager.
+func (f *managedFieldsUpdater) Apply(liveObj, appliedObj runtime.Object, managed Managed, fieldManager string, force bool) (runtime.Object, Managed, error) {
+	object, managed, err := f.fieldManager.Apply(liveObj, appliedObj, managed, fieldManager, force)
+	if err != nil {
+		return object, managed, err
+	}
+	if object != nil {
+		managed.Times()[fieldManager] = &metav1.Time{Time: time.Now().UTC()}
+	} else {
+		object = liveObj.DeepCopyObject()
+		RemoveObjectManagedFields(object)
+	}
+	return object, managed, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfieldsupdater_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfieldsupdater_test.go
new file mode 100644
index 0000000000..631eed7f7b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfieldsupdater_test.go
@@ -0,0 +1,524 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+	"time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/managedfields/managedfieldstest"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	"sigs.k8s.io/yaml"
+)
+
+func TestManagedFieldsUpdateDoesModifyTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = updateObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+
+	time.Sleep(time.Second)
+
+	err = updateObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "new-value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+
+	if previousManagedFields[0].Time.Equal(newManagedFields[0].Time) {
+		t.Errorf("ManagedFields time has not been updated:\n%v", newManagedFields)
+	}
+}
+
+func TestManagedFieldsApplyDoesModifyTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = applyObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+
+	time.Sleep(time.Second)
+
+	err = applyObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "new-value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+
+	if previousManagedFields[0].Time.Equal(newManagedFields[0].Time) {
+		t.Errorf("ManagedFields time has not been updated:\n%v", newManagedFields)
+	}
+}
+
+func TestManagedFieldsUpdateWithoutChangesDoesNotModifyTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = updateObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+
+	time.Sleep(time.Second)
+
+	err = updateObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+
+	if !previousManagedFields[0].Time.Equal(newManagedFields[0].Time) {
+		t.Errorf("ManagedFields time has changed:\nBefore:\n%v\nAfter:\n%v", previousManagedFields, newManagedFields)
+	}
+}
+
+func TestManagedFieldsApplyWithoutChangesDoesNotModifyTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = applyObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+
+	time.Sleep(time.Second)
+
+	err = applyObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+
+	if !previousManagedFields[0].Time.Equal(newManagedFields[0].Time) {
+		t.Errorf("ManagedFields time has changed:\nBefore:\n%v\nAfter:\n%v", previousManagedFields, newManagedFields)
+	}
+}
+
+func TestNonManagedFieldsUpdateDoesNotModifyTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = updateObject(f, "fieldmanager_a_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_a": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = updateObject(f, "fieldmanager_b_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_b": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+	previousEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range previousManagedFields {
+		previousEntries[entry.Manager] = entry
+	}
+
+	time.Sleep(time.Second)
+
+	err = updateObject(f, "fieldmanager_a_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_a": "value",
+			"key_b": "new-value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+	newEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range newManagedFields {
+		newEntries[entry.Manager] = entry
+	}
+
+	if _, ok := newEntries["fieldmanager_b_test"]; ok {
+		t.Errorf("FieldManager B ManagedFields has changed:\n%v", newEntries["fieldmanager_b_test"])
+	}
+}
+
+func TestNonManagedFieldsApplyDoesNotModifyTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = applyObject(f, "fieldmanager_a_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_a": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = applyObject(f, "fieldmanager_b_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_b": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+	previousEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range previousManagedFields {
+		previousEntries[entry.Manager] = entry
+	}
+
+	time.Sleep(time.Second)
+
+	err = applyObject(f, "fieldmanager_a_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_a": "new-value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+	newEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range newManagedFields {
+		newEntries[entry.Manager] = entry
+	}
+
+	if !previousEntries["fieldmanager_b_test"].Time.Equal(newEntries["fieldmanager_b_test"].Time) {
+		t.Errorf("FieldManager B ManagedFields time changed:\nBefore:\n%v\nAfter:\n%v",
+			previousEntries["fieldmanager_b_test"], newEntries["fieldmanager_b_test"])
+	}
+}
+
+func TestTakingOverManagedFieldsDuringUpdateDoesNotModifyPreviousManagerTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = updateObject(f, "fieldmanager_a_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_a": "value",
+			"key_b": value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+	previousEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range previousManagedFields {
+		previousEntries[entry.Manager] = entry
+	}
+
+	time.Sleep(time.Second)
+
+	err = updateObject(f, "fieldmanager_b_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_b": "new-value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+	newEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range newManagedFields {
+		newEntries[entry.Manager] = entry
+	}
+
+	if !previousEntries["fieldmanager_a_test"].Time.Equal(newEntries["fieldmanager_a_test"].Time) {
+		t.Errorf("FieldManager A ManagedFields time has been updated:\nBefore:\n%v\nAfter:\n%v",
+			previousEntries["fieldmanager_a_test"], newEntries["fieldmanager_a_test"])
+	}
+}
+
+func TestTakingOverManagedFieldsDuringApplyDoesNotModifyPreviousManagerTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = applyObject(f, "fieldmanager_a_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_a": "value",
+			"key_b": value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+	previousEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range previousManagedFields {
+		previousEntries[entry.Manager] = entry
+	}
+
+	time.Sleep(time.Second)
+
+	err = applyObject(f, "fieldmanager_b_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_b": "new-value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+	newEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range newManagedFields {
+		newEntries[entry.Manager] = entry
+	}
+
+	if !previousEntries["fieldmanager_a_test"].Time.Equal(newEntries["fieldmanager_a_test"].Time) {
+		t.Errorf("FieldManager A ManagedFields time has been updated:\nBefore:\n%v\nAfter:\n%v",
+			previousEntries["fieldmanager_a_test"], newEntries["fieldmanager_a_test"])
+	}
+}
+
+type NoopManager struct{}
+
+func (NoopManager) Apply(liveObj, appliedObj runtime.Object, managed internal.Managed, fieldManager string, force bool) (runtime.Object, internal.Managed, error) {
+	return nil, managed, nil
+}
+
+func (NoopManager) Update(liveObj, newObj runtime.Object, managed internal.Managed, manager string) (runtime.Object, internal.Managed, error) {
+	return nil, nil, nil
+}
+
+func updateObject(f managedfieldstest.TestFieldManager, fieldManagerName string, object []byte) error {
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal(object, &obj.Object); err != nil {
+		return fmt.Errorf("error decoding YAML: %v", err)
+	}
+	if err := f.Update(obj, fieldManagerName); err != nil {
+		return fmt.Errorf("failed to update object: %v", err)
+	}
+	return nil
+}
+
+func applyObject(f managedfieldstest.TestFieldManager, fieldManagerName string, object []byte) error {
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal(object, &obj.Object); err != nil {
+		return fmt.Errorf("error decoding YAML: %v", err)
+	}
+	if err := f.Apply(obj, fieldManagerName, true); err != nil {
+		return fmt.Errorf("failed to apply object: %v", err)
+	}
+	return nil
+}
+
+// Ensures that if ManagedFieldsUpdater gets a nil value from its nested manager
+// chain (meaning the operation was a no-op), then the ManagedFieldsUpdater
+// itself will return a copy of the input live object, with its managed fields
+// removed
+func TestNilNewObjectReplacedWithDeepCopyExcludingManagedFields(t *testing.T) {
+	// Initialize our "live object" with some managed fields
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"name": "pod",
+			"labels": {"app": "nginx"},
+			"managedFields": [
+				{
+					"apiVersion": "v1",
+					"fieldsType": "FieldsV1",
+					"fieldsV1": {
+						"f:metadata": {
+							"f:labels": {
+								"f:app": {}
+							}
+						}
+					},
+					"manager": "fieldmanager_test",
+					"operation": "Apply",
+					"time": "2021-11-11T18:41:17Z"
+				}
+			]
+		}
+	}`), &obj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	accessor, err := meta.Accessor(obj)
+	if err != nil {
+		t.Fatalf("couldn't get accessor: %v", err)
+	}
+
+	// Decode the managed fields in the live object, since it isn't allowed in the patch.
+	managed, err := internal.DecodeManagedFields(accessor.GetManagedFields())
+	if err != nil {
+		t.Fatalf("failed to decode managed fields: %v", err)
+	}
+
+	updater := internal.NewManagedFieldsUpdater(NoopManager{})
+
+	newObject, _, err := updater.Apply(obj, obj.DeepCopyObject(), managed, "some_manager", false)
+	if err != nil {
+		t.Fatalf("failed to apply configuration %v", err)
+	}
+
+	if newObject == obj {
+		t.Fatalf("returned newObject must not be the same instance as the passed in liveObj")
+	}
+
+	// Rip off managed fields of live, and check that it is deeply
+	// equal to newObject
+	liveWithoutManaged := obj.DeepCopyObject()
+	internal.RemoveObjectManagedFields(liveWithoutManaged)
+
+	if !reflect.DeepEqual(liveWithoutManaged, newObject) {
+		t.Fatalf("returned newObject must be deeply equal to the input live object, without managed fields")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/manager.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/manager.go
new file mode 100644
index 0000000000..78830d0cf5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/manager.go
@@ -0,0 +1,52 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+// Managed groups a fieldpath.ManagedFields together with the timestamps associated with each operation.
+type Managed interface {
+	// Fields gets the fieldpath.ManagedFields.
+	Fields() fieldpath.ManagedFields
+
+	// Times gets the timestamps associated with each operation.
+	Times() map[string]*metav1.Time
+}
+
+// Manager updates the managed fields and merges applied configurations.
+type Manager interface {
+	// Update is used when the object has already been merged (non-apply
+	// use-case), and simply updates the managed fields in the output
+	// object.
+	//  * `liveObj` is not mutated by this function
+	//  * `newObj` may be mutated by this function
+	// Returns the new object with managedFields removed, and the object's new
+	// proposed managedFields separately.
+	Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error)
+
+	// Apply is used when server-side apply is called, as it merges the
+	// object and updates the managed fields.
+	//  * `liveObj` is not mutated by this function
+	//  * `newObj` may be mutated by this function
+	// Returns the new object with managedFields removed, and the object's new
+	// proposed managedFields separately.
+	Apply(liveObj, appliedObj runtime.Object, managed Managed, fieldManager string, force bool) (runtime.Object, Managed, error)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/pathelement.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/pathelement.go
new file mode 100644
index 0000000000..1b5dddfd70
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/pathelement.go
@@ -0,0 +1,140 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/value"
+)
+
+const (
+	// Field indicates that the content of this path element is a field's name
+	Field = "f"
+
+	// Value indicates that the content of this path element is a field's value
+	Value = "v"
+
+	// Index indicates that the content of this path element is an index in an array
+	Index = "i"
+
+	// Key indicates that the content of this path element is a key value map
+	Key = "k"
+
+	// Separator separates the type of a path element from the contents
+	Separator = ":"
+)
+
+// NewPathElement parses a serialized path element
+func NewPathElement(s string) (fieldpath.PathElement, error) {
+	split := strings.SplitN(s, Separator, 2)
+	if len(split) < 2 {
+		return fieldpath.PathElement{}, fmt.Errorf("missing colon: %v", s)
+	}
+	switch split[0] {
+	case Field:
+		return fieldpath.PathElement{
+			FieldName: &split[1],
+		}, nil
+	case Value:
+		val, err := value.FromJSON([]byte(split[1]))
+		if err != nil {
+			return fieldpath.PathElement{}, err
+		}
+		return fieldpath.PathElement{
+			Value: &val,
+		}, nil
+	case Index:
+		i, err := strconv.Atoi(split[1])
+		if err != nil {
+			return fieldpath.PathElement{}, err
+		}
+		return fieldpath.PathElement{
+			Index: &i,
+		}, nil
+	case Key:
+		kv := map[string]json.RawMessage{}
+		err := json.Unmarshal([]byte(split[1]), &kv)
+		if err != nil {
+			return fieldpath.PathElement{}, err
+		}
+		fields := value.FieldList{}
+		for k, v := range kv {
+			b, err := json.Marshal(v)
+			if err != nil {
+				return fieldpath.PathElement{}, err
+			}
+			val, err := value.FromJSON(b)
+			if err != nil {
+				return fieldpath.PathElement{}, err
+			}
+
+			fields = append(fields, value.Field{
+				Name:  k,
+				Value: val,
+			})
+		}
+		return fieldpath.PathElement{
+			Key: &fields,
+		}, nil
+	default:
+		// Ignore unknown key types
+		return fieldpath.PathElement{}, nil
+	}
+}
+
+// PathElementString serializes a path element
+func PathElementString(pe fieldpath.PathElement) (string, error) {
+	switch {
+	case pe.FieldName != nil:
+		return Field + Separator + *pe.FieldName, nil
+	case pe.Key != nil:
+		kv := map[string]json.RawMessage{}
+		for _, k := range *pe.Key {
+			b, err := value.ToJSON(k.Value)
+			if err != nil {
+				return "", err
+			}
+			m := json.RawMessage{}
+			err = json.Unmarshal(b, &m)
+			if err != nil {
+				return "", err
+			}
+			kv[k.Name] = m
+		}
+		b, err := json.Marshal(kv)
+		if err != nil {
+			return "", err
+		}
+		return Key + ":" + string(b), nil
+	case pe.Value != nil:
+		b, err := value.ToJSON(*pe.Value)
+		if err != nil {
+			return "", err
+		}
+		return Value + ":" + string(b), nil
+	case pe.Index != nil:
+		return Index + ":" + strconv.Itoa(*pe.Index), nil
+	default:
+		return "", errors.New("Invalid type of path element")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/pathelement_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/pathelement_test.go
new file mode 100644
index 0000000000..bd119e03c2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/pathelement_test.go
@@ -0,0 +1,84 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import "testing"
+
+func TestPathElementRoundTrip(t *testing.T) {
+	tests := []string{
+		`i:0`,
+		`i:1234`,
+		`f:`,
+		`f:spec`,
+		`f:more-complicated-string`,
+		`k:{"name":"my-container"}`,
+		`k:{"port":"8080","protocol":"TCP"}`,
+		`k:{"optionalField":null}`,
+		`k:{"jsonField":{"A":1,"B":null,"C":"D","E":{"F":"G"}}}`,
+		`k:{"listField":["1","2","3"]}`,
+		`v:null`,
+		`v:"some-string"`,
+		`v:1234`,
+		`v:{"some":"json"}`,
+	}
+
+	for _, test := range tests {
+		t.Run(test, func(t *testing.T) {
+			pe, err := NewPathElement(test)
+			if err != nil {
+				t.Fatalf("Failed to create path element: %v", err)
+			}
+			output, err := PathElementString(pe)
+			if err != nil {
+				t.Fatalf("Failed to create string from path element: %v", err)
+			}
+			if test != output {
+				t.Fatalf("Expected round-trip:\ninput: %v\noutput: %v", test, output)
+			}
+		})
+	}
+}
+
+func TestPathElementIgnoreUnknown(t *testing.T) {
+	_, err := NewPathElement("r:Hello")
+	if err != nil {
+		t.Fatalf("Unknown qualifiers should be ignored")
+	}
+}
+
+func TestNewPathElementError(t *testing.T) {
+	tests := []string{
+		``,
+		`no-colon`,
+		`i:index is not a number`,
+		`i:1.23`,
+		`i:`,
+		`v:invalid json`,
+		`v:`,
+		`k:invalid json`,
+		`k:{"name":invalid}`,
+	}
+
+	for _, test := range tests {
+		t.Run(test, func(t *testing.T) {
+			_, err := NewPathElement(test)
+			if err == nil {
+				t.Fatalf("Expected error, no error found")
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/runtimetypeconverter.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/runtimetypeconverter.go
new file mode 100644
index 0000000000..366ff73363
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/runtimetypeconverter.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+)
+
+type schemeTypeConverter struct {
+	scheme *runtime.Scheme
+	parser *typed.Parser
+}
+
+var _ TypeConverter = &schemeTypeConverter{}
+
+// NewSchemeTypeConverter creates a TypeConverter that uses the provided scheme to
+// convert between runtime.Objects and TypedValues.
+func NewSchemeTypeConverter(scheme *runtime.Scheme, parser *typed.Parser) TypeConverter {
+	return &schemeTypeConverter{scheme: scheme, parser: parser}
+}
+
+func (tc schemeTypeConverter) ObjectToTyped(obj runtime.Object, opts ...typed.ValidationOptions) (*typed.TypedValue, error) {
+	gvk := obj.GetObjectKind().GroupVersionKind()
+	name, err := tc.scheme.ToOpenAPIDefinitionName(gvk)
+	if err != nil {
+		return nil, err
+	}
+	t := tc.parser.Type(name)
+	switch o := obj.(type) {
+	case *unstructured.Unstructured:
+		return t.FromUnstructured(o.UnstructuredContent(), opts...)
+	default:
+		return t.FromStructured(obj, opts...)
+	}
+}
+
+func (tc schemeTypeConverter) TypedToObject(value *typed.TypedValue) (runtime.Object, error) {
+	vu := value.AsValue().Unstructured()
+	switch o := vu.(type) {
+	case map[string]interface{}:
+		return &unstructured.Unstructured{Object: o}, nil
+	default:
+		return nil, fmt.Errorf("failed to convert value to unstructured for type %T", vu)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/skipnonapplied.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/skipnonapplied.go
new file mode 100644
index 0000000000..15357a34d8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/skipnonapplied.go
@@ -0,0 +1,92 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+	"math/rand"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+type skipNonAppliedManager struct {
+	fieldManager           Manager
+	objectCreater          runtime.ObjectCreater
+	beforeApplyManagerName string
+	probability            float32
+}
+
+var _ Manager = &skipNonAppliedManager{}
+
+// NewSkipNonAppliedManager creates a new wrapped FieldManager that only starts tracking managers after the first apply.
+func NewSkipNonAppliedManager(fieldManager Manager, objectCreater runtime.ObjectCreater) Manager {
+	return NewProbabilisticSkipNonAppliedManager(fieldManager, objectCreater, 0.0)
+}
+
+// NewProbabilisticSkipNonAppliedManager creates a new wrapped FieldManager that starts tracking managers after the first apply,
+// or starts tracking on create with p probability.
+func NewProbabilisticSkipNonAppliedManager(fieldManager Manager, objectCreater runtime.ObjectCreater, p float32) Manager {
+	return &skipNonAppliedManager{
+		fieldManager:           fieldManager,
+		objectCreater:          objectCreater,
+		beforeApplyManagerName: "before-first-apply",
+		probability:            p,
+	}
+}
+
+// Update implements Manager.
+func (f *skipNonAppliedManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	accessor, err := meta.Accessor(liveObj)
+	if err != nil {
+		return newObj, managed, nil
+	}
+
+	// If managed fields is empty, we need to determine whether to skip tracking managed fields.
+	if len(managed.Fields()) == 0 {
+		// Check if the operation is a create, by checking whether lastObj's UID is empty.
+		// If the operation is create, P(tracking managed fields) = f.probability
+		// If the operation is update, skip tracking managed fields, since we already know managed fields is empty.
+		if len(accessor.GetUID()) == 0 {
+			if f.probability <= rand.Float32() {
+				return newObj, managed, nil
+			}
+		} else {
+			return newObj, managed, nil
+		}
+	}
+	return f.fieldManager.Update(liveObj, newObj, managed, manager)
+}
+
+// Apply implements Manager.
+func (f *skipNonAppliedManager) Apply(liveObj, appliedObj runtime.Object, managed Managed, fieldManager string, force bool) (runtime.Object, Managed, error) {
+	if len(managed.Fields()) == 0 {
+		gvk := appliedObj.GetObjectKind().GroupVersionKind()
+		emptyObj, err := f.objectCreater.New(gvk)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to create empty object of type %v: %v", gvk, err)
+		}
+		if unstructured, isUnstructured := emptyObj.(runtime.Unstructured); isUnstructured {
+			unstructured.GetObjectKind().SetGroupVersionKind(gvk)
+		}
+		liveObj, managed, err = f.fieldManager.Update(emptyObj, liveObj, managed, f.beforeApplyManagerName)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to create manager for existing fields: %v", err)
+		}
+	}
+	return f.fieldManager.Apply(liveObj, appliedObj, managed, fieldManager, force)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/skipnonapplied_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/skipnonapplied_test.go
new file mode 100644
index 0000000000..2863a76326
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/skipnonapplied_test.go
@@ -0,0 +1,133 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	internaltesting "k8s.io/apimachinery/pkg/util/managedfields/internal/testing"
+	"sigs.k8s.io/yaml"
+)
+
+func TestNoUpdateBeforeFirstApply(t *testing.T) {
+	f := internaltesting.NewTestFieldManagerImpl(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"), "", func(m internal.Manager) internal.Manager {
+		return internal.NewSkipNonAppliedManager(m, &internaltesting.FakeObjectCreater{})
+	})
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"name": "pod",
+			"labels": {"app": "nginx"}
+		},
+		"spec": {
+			"containers": [{
+				"name":  "nginx",
+				"image": "nginx:latest"
+			}]
+        }
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	if err := f.Apply(appliedObj, "fieldmanager_test_apply", false); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+
+	if e, a := 1, len(f.ManagedFields()); e != a {
+		t.Fatalf("exected %v entries in managedFields, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	if e, a := "fieldmanager_test_apply", f.ManagedFields()[0].Manager; e != a {
+		t.Fatalf("exected manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+}
+
+func TestUpdateBeforeFirstApply(t *testing.T) {
+	f := internaltesting.NewTestFieldManagerImpl(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"), "", func(m internal.Manager) internal.Manager {
+		return internal.NewSkipNonAppliedManager(m, &internaltesting.FakeObjectCreater{})
+	})
+
+	updatedObj := &unstructured.Unstructured{}
+	if err := json.Unmarshal([]byte(`{"kind": "Pod", "apiVersion": "v1", "metadata": {"labels": {"app": "my-nginx"}}}`), updatedObj); err != nil {
+		t.Fatalf("Failed to unmarshal object: %v", err)
+	}
+
+	if err := f.Update(updatedObj, "fieldmanager_test_update"); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+
+	if m := f.ManagedFields(); len(m) != 0 {
+		t.Fatalf("managedFields were tracked on update only: %v", m)
+	}
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"name": "pod",
+			"labels": {"app": "nginx"}
+		},
+		"spec": {
+			"containers": [{
+				"name":  "nginx",
+				"image": "nginx:latest"
+			}]
+        }
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	err := f.Apply(appliedObj, "fieldmanager_test_apply", false)
+	apiStatus, _ := err.(apierrors.APIStatus)
+	if err == nil || !apierrors.IsConflict(err) || len(apiStatus.Status().Details.Causes) != 1 {
+		t.Fatalf("Expecting to get one conflict but got %v", err)
+	}
+
+	if e, a := ".metadata.labels.app", apiStatus.Status().Details.Causes[0].Field; e != a {
+		t.Fatalf("Expecting to conflict on field %q but conflicted on field %q: %v", e, a, err)
+	}
+
+	if e, a := "before-first-apply", apiStatus.Status().Details.Causes[0].Message; !strings.Contains(a, e) {
+		t.Fatalf("Expecting conflict message to contain %q but got %q: %v", e, a, err)
+	}
+
+	if err := f.Apply(appliedObj, "fieldmanager_test_apply", true); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+
+	if e, a := 2, len(f.ManagedFields()); e != a {
+		t.Fatalf("exected %v entries in managedFields, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	if e, a := "fieldmanager_test_apply", f.ManagedFields()[0].Manager; e != a {
+		t.Fatalf("exected first manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	if e, a := "before-first-apply", f.ManagedFields()[1].Manager; e != a {
+		t.Fatalf("exected second manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/stripmeta.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/stripmeta.go
new file mode 100644
index 0000000000..8a2b7e4e63
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/stripmeta.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+type stripMetaManager struct {
+	fieldManager Manager
+
+	// stripSet is the list of fields that should never be part of a mangedFields.
+	stripSet *fieldpath.Set
+}
+
+var _ Manager = &stripMetaManager{}
+
+// NewStripMetaManager creates a new Manager that strips metadata and typemeta fields from the manager's fieldset.
+func NewStripMetaManager(fieldManager Manager) Manager {
+	return &stripMetaManager{
+		fieldManager: fieldManager,
+		stripSet: fieldpath.NewSet(
+			fieldpath.MakePathOrDie("apiVersion"),
+			fieldpath.MakePathOrDie("kind"),
+			fieldpath.MakePathOrDie("metadata"),
+			fieldpath.MakePathOrDie("metadata", "name"),
+			fieldpath.MakePathOrDie("metadata", "namespace"),
+			fieldpath.MakePathOrDie("metadata", "creationTimestamp"),
+			fieldpath.MakePathOrDie("metadata", "selfLink"),
+			fieldpath.MakePathOrDie("metadata", "uid"),
+			fieldpath.MakePathOrDie("metadata", "clusterName"),
+			fieldpath.MakePathOrDie("metadata", "generation"),
+			fieldpath.MakePathOrDie("metadata", "managedFields"),
+			fieldpath.MakePathOrDie("metadata", "resourceVersion"),
+		),
+	}
+}
+
+// Update implements Manager.
+func (f *stripMetaManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	newObj, managed, err := f.fieldManager.Update(liveObj, newObj, managed, manager)
+	if err != nil {
+		return nil, nil, err
+	}
+	f.stripFields(managed.Fields(), manager)
+	return newObj, managed, nil
+}
+
+// Apply implements Manager.
+func (f *stripMetaManager) Apply(liveObj, appliedObj runtime.Object, managed Managed, manager string, force bool) (runtime.Object, Managed, error) {
+	newObj, managed, err := f.fieldManager.Apply(liveObj, appliedObj, managed, manager, force)
+	if err != nil {
+		return nil, nil, err
+	}
+	f.stripFields(managed.Fields(), manager)
+	return newObj, managed, nil
+}
+
+// stripFields removes a predefined set of paths found in typed from managed
+func (f *stripMetaManager) stripFields(managed fieldpath.ManagedFields, manager string) {
+	vs, ok := managed[manager]
+	if ok {
+		if vs == nil {
+			panic(fmt.Sprintf("Found unexpected nil manager which should never happen: %s", manager))
+		}
+		newSet := vs.Set().Difference(f.stripSet)
+		if newSet.Empty() {
+			delete(managed, manager)
+		} else {
+			managed[manager] = fieldpath.NewVersionedSet(newSet, vs.APIVersion(), vs.Applied())
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/structuredmerge.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/structuredmerge.go
new file mode 100644
index 0000000000..8e9a270108
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/structuredmerge.go
@@ -0,0 +1,190 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type structuredMergeManager struct {
+	typeConverter   TypeConverter
+	objectConverter runtime.ObjectConvertor
+	objectDefaulter runtime.ObjectDefaulter
+	groupVersion    schema.GroupVersion
+	hubVersion      schema.GroupVersion
+	updater         merge.Updater
+}
+
+var _ Manager = &structuredMergeManager{}
+
+// NewStructuredMergeManager creates a new Manager that merges apply requests
+// and update managed fields for other types of requests.
+func NewStructuredMergeManager(typeConverter TypeConverter, objectConverter runtime.ObjectConvertor, objectDefaulter runtime.ObjectDefaulter, gv schema.GroupVersion, hub schema.GroupVersion, resetFields map[fieldpath.APIVersion]fieldpath.Filter) (Manager, error) {
+	if typeConverter == nil {
+		return nil, fmt.Errorf("typeconverter must not be nil")
+	}
+	return &structuredMergeManager{
+		typeConverter:   typeConverter,
+		objectConverter: objectConverter,
+		objectDefaulter: objectDefaulter,
+		groupVersion:    gv,
+		hubVersion:      hub,
+		updater: merge.Updater{
+			Converter:    newVersionConverter(typeConverter, objectConverter, hub), // This is the converter provided to SMD from k8s
+			IgnoreFilter: resetFields,
+		},
+	}, nil
+}
+
+// NewCRDStructuredMergeManager creates a new Manager specifically for
+// CRDs. This allows for the possibility of fields which are not defined
+// in models, as well as having no models defined at all.
+func NewCRDStructuredMergeManager(typeConverter TypeConverter, objectConverter runtime.ObjectConvertor, objectDefaulter runtime.ObjectDefaulter, gv schema.GroupVersion, hub schema.GroupVersion, resetFields map[fieldpath.APIVersion]fieldpath.Filter) (_ Manager, err error) {
+	return &structuredMergeManager{
+		typeConverter:   typeConverter,
+		objectConverter: objectConverter,
+		objectDefaulter: objectDefaulter,
+		groupVersion:    gv,
+		hubVersion:      hub,
+		updater: merge.Updater{
+			Converter:    newCRDVersionConverter(typeConverter, objectConverter, hub),
+			IgnoreFilter: resetFields,
+		},
+	}, nil
+}
+
+func objectGVKNN(obj runtime.Object) string {
+	name := "<unknown>"
+	namespace := "<unknown>"
+	if accessor, err := meta.Accessor(obj); err == nil {
+		name = accessor.GetName()
+		namespace = accessor.GetNamespace()
+	}
+
+	return fmt.Sprintf("%v/%v; %v", namespace, name, obj.GetObjectKind().GroupVersionKind())
+}
+
+// Update implements Manager.
+func (f *structuredMergeManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	newObjVersioned, err := f.toVersioned(newObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert new object (%v) to proper version (%v): %v", objectGVKNN(newObj), f.groupVersion, err)
+	}
+	liveObjVersioned, err := f.toVersioned(liveObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert live object (%v) to proper version: %v", objectGVKNN(liveObj), err)
+	}
+	newObjTyped, err := f.typeConverter.ObjectToTyped(newObjVersioned, typed.AllowDuplicates)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert new object (%v) to smd typed: %v", objectGVKNN(newObjVersioned), err)
+	}
+	liveObjTyped, err := f.typeConverter.ObjectToTyped(liveObjVersioned, typed.AllowDuplicates)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert live object (%v) to smd typed: %v", objectGVKNN(liveObjVersioned), err)
+	}
+	apiVersion := fieldpath.APIVersion(f.groupVersion.String())
+
+	// TODO(apelisse) use the first return value when unions are implemented
+	_, managedFields, err := f.updater.Update(liveObjTyped, newObjTyped, apiVersion, managed.Fields(), manager)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to update ManagedFields (%v): %v", objectGVKNN(newObjVersioned), err)
+	}
+	managed = NewManaged(managedFields, managed.Times())
+
+	return newObj, managed, nil
+}
+
+// Apply implements Manager.
+func (f *structuredMergeManager) Apply(liveObj, patchObj runtime.Object, managed Managed, manager string, force bool) (runtime.Object, Managed, error) {
+	// Check that the patch object has the same version as the live object
+	if patchVersion := patchObj.GetObjectKind().GroupVersionKind().GroupVersion(); patchVersion != f.groupVersion {
+		return nil, nil,
+			errors.NewBadRequest(
+				fmt.Sprintf("Incorrect version specified in apply patch. "+
+					"Specified patch version: %s, expected: %s",
+					patchVersion, f.groupVersion))
+	}
+
+	patchObjMeta, err := meta.Accessor(patchObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("couldn't get accessor: %v", err)
+	}
+	if patchObjMeta.GetManagedFields() != nil {
+		return nil, nil, errors.NewBadRequest("metadata.managedFields must be nil")
+	}
+
+	liveObjVersioned, err := f.toVersioned(liveObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert live object (%v) to proper version: %v", objectGVKNN(liveObj), err)
+	}
+
+	// Don't allow duplicates in the applied object.
+	patchObjTyped, err := f.typeConverter.ObjectToTyped(patchObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create typed patch object (%v): %v", objectGVKNN(patchObj), err)
+	}
+
+	liveObjTyped, err := f.typeConverter.ObjectToTyped(liveObjVersioned, typed.AllowDuplicates)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create typed live object (%v): %v", objectGVKNN(liveObjVersioned), err)
+	}
+
+	apiVersion := fieldpath.APIVersion(f.groupVersion.String())
+	newObjTyped, managedFields, err := f.updater.Apply(liveObjTyped, patchObjTyped, apiVersion, managed.Fields(), manager, force)
+	if err != nil {
+		return nil, nil, err
+	}
+	managed = NewManaged(managedFields, managed.Times())
+
+	if newObjTyped == nil {
+		return nil, managed, nil
+	}
+
+	newObj, err := f.typeConverter.TypedToObject(newObjTyped)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert new typed object (%v) to object: %v", objectGVKNN(patchObj), err)
+	}
+
+	newObjVersioned, err := f.toVersioned(newObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert new object (%v) to proper version: %v", objectGVKNN(patchObj), err)
+	}
+	f.objectDefaulter.Default(newObjVersioned)
+
+	newObjUnversioned, err := f.toUnversioned(newObjVersioned)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert to unversioned (%v): %v", objectGVKNN(patchObj), err)
+	}
+	return newObjUnversioned, managed, nil
+}
+
+func (f *structuredMergeManager) toVersioned(obj runtime.Object) (runtime.Object, error) {
+	return f.objectConverter.ConvertToVersion(obj, f.groupVersion)
+}
+
+func (f *structuredMergeManager) toUnversioned(obj runtime.Object) (runtime.Object, error) {
+	return f.objectConverter.ConvertToVersion(obj, f.hubVersion)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/testdata/swagger.json b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/testdata/swagger.json
new file mode 100644
index 0000000000..b067dfc29f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/testdata/swagger.json
@@ -0,0 +1,4195 @@
+{
+  "definitions": {
+    "io.k8s.api.apps.v1.Deployment": {
+      "description": "Deployment enables declarative updates for Pods and ReplicaSets.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object metadata."
+        },
+        "spec": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1.DeploymentSpec",
+          "description": "Specification of the desired behavior of the Deployment."
+        },
+        "status": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1.DeploymentStatus",
+          "description": "Most recently observed status of the Deployment."
+        }
+      },
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "apps",
+          "kind": "Deployment",
+          "version": "v1"
+        }
+      ]
+    },
+    "io.k8s.api.apps.v1.DeploymentCondition": {
+      "description": "DeploymentCondition describes the state of a deployment at a certain point.",
+      "properties": {
+        "lastTransitionTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Last time the condition transitioned from one status to another."
+        },
+        "lastUpdateTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "The last time this condition was updated."
+        },
+        "message": {
+          "description": "A human readable message indicating details about the transition.",
+          "type": "string"
+        },
+        "reason": {
+          "description": "The reason for the condition's last transition.",
+          "type": "string"
+        },
+        "status": {
+          "description": "Status of the condition, one of True, False, Unknown.",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type of deployment condition.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "status"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1.DeploymentSpec": {
+      "description": "DeploymentSpec is the specification of the desired behavior of the Deployment.",
+      "properties": {
+        "minReadySeconds": {
+          "description": "Minimum number of seconds for which a newly created pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready)",
+          "format": "int32",
+          "type": "integer"
+        },
+        "paused": {
+          "description": "Indicates that the deployment is paused.",
+          "type": "boolean"
+        },
+        "progressDeadlineSeconds": {
+          "description": "The maximum time in seconds for a deployment to make progress before it is considered to be failed. The deployment controller will continue to process failed deployments and a condition with a ProgressDeadlineExceeded reason will be surfaced in the deployment status. Note that progress will not be estimated during the time a deployment is paused. Defaults to 600s.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Number of desired pods. This is a pointer to distinguish between explicit zero and not specified. Defaults to 1.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "revisionHistoryLimit": {
+          "description": "The number of old ReplicaSets to retain to allow rollback. This is a pointer to distinguish between explicit zero and not specified. Defaults to 10.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "selector": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector",
+          "description": "Label selector for pods. Existing ReplicaSets whose pods are selected by this will be the ones affected by this deployment. It must match the pod template's labels."
+        },
+        "strategy": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1.DeploymentStrategy",
+          "description": "The deployment strategy to use to replace existing pods with new ones.",
+          "x-kubernetes-patch-strategy": "retainKeys"
+        },
+        "template": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodTemplateSpec",
+          "description": "Template describes the pods that will be created."
+        }
+      },
+      "required": [
+        "selector",
+        "template"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1.DeploymentStatus": {
+      "description": "DeploymentStatus is the most recently observed status of the Deployment.",
+      "properties": {
+        "availableReplicas": {
+          "description": "Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "collisionCount": {
+          "description": "Count of hash collisions for the Deployment. The Deployment controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ReplicaSet.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "conditions": {
+          "description": "Represents the latest available observations of a deployment's current state.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.apps.v1.DeploymentCondition"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "type",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "observedGeneration": {
+          "description": "The generation observed by the deployment controller.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "readyReplicas": {
+          "description": "Total number of ready pods targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment (their labels match the selector).",
+          "format": "int32",
+          "type": "integer"
+        },
+        "unavailableReplicas": {
+          "description": "Total number of unavailable pods targeted by this deployment. This is the total number of pods that are still required for the deployment to have 100% available capacity. They may either be pods that are running but not yet available or pods that still have not been created.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "updatedReplicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment that have the desired template spec.",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1.DeploymentStrategy": {
+      "description": "DeploymentStrategy describes how to replace existing pods with new ones.",
+      "properties": {
+        "rollingUpdate": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1.RollingUpdateDeployment",
+          "description": "Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate."
+        },
+        "type": {
+          "description": "Type of deployment. Can be \"Recreate\" or \"RollingUpdate\". Default is RollingUpdate.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1.RollingUpdateDeployment": {
+      "description": "Spec to control the desired behavior of rolling update.",
+      "properties": {
+        "maxSurge": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be scheduled above the desired number of pods. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). This can not be 0 if MaxUnavailable is 0. Absolute number is calculated from percentage by rounding up. Defaults to 25%. Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when the rolling update starts, such that the total number of old and new pods do not exceed 130% of desired pods. Once old pods have been killed, new ReplicaSet can be scaled up further, ensuring that total number of pods running at any time during the update is at most 130% of desired pods."
+        },
+        "maxUnavailable": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be unavailable during the update. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). Absolute number is calculated from percentage by rounding down. This can not be 0 if MaxSurge is 0. Defaults to 25%. Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods immediately when the rolling update starts. Once new pods are ready, old ReplicaSet can be scaled down further, followed by scaling up the new ReplicaSet, ensuring that the total number of pods available at all times during the update is at least 70% of desired pods."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta1.Deployment": {
+      "description": "DEPRECATED - This group version of Deployment is deprecated by apps/v1beta2/Deployment. See the release notes for more information. Deployment enables declarative updates for Pods and ReplicaSets.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object metadata."
+        },
+        "spec": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta1.DeploymentSpec",
+          "description": "Specification of the desired behavior of the Deployment."
+        },
+        "status": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta1.DeploymentStatus",
+          "description": "Most recently observed status of the Deployment."
+        }
+      },
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "apps",
+          "kind": "Deployment",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "io.k8s.api.apps.v1beta1.DeploymentCondition": {
+      "description": "DeploymentCondition describes the state of a deployment at a certain point.",
+      "properties": {
+        "lastTransitionTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Last time the condition transitioned from one status to another."
+        },
+        "lastUpdateTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "The last time this condition was updated."
+        },
+        "message": {
+          "description": "A human readable message indicating details about the transition.",
+          "type": "string"
+        },
+        "reason": {
+          "description": "The reason for the condition's last transition.",
+          "type": "string"
+        },
+        "status": {
+          "description": "Status of the condition, one of True, False, Unknown.",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type of deployment condition.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "status"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta1.DeploymentRollback": {
+      "description": "DEPRECATED. DeploymentRollback stores the information required to rollback a deployment.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "name": {
+          "description": "Required: This must match the Name of a deployment.",
+          "type": "string"
+        },
+        "rollbackTo": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta1.RollbackConfig",
+          "description": "The config of this deployment rollback."
+        },
+        "updatedAnnotations": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "The annotations to be updated to a deployment",
+          "type": "object"
+        }
+      },
+      "required": [
+        "name",
+        "rollbackTo"
+      ],
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "apps",
+          "kind": "DeploymentRollback",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "io.k8s.api.apps.v1beta1.DeploymentSpec": {
+      "description": "DeploymentSpec is the specification of the desired behavior of the Deployment.",
+      "properties": {
+        "minReadySeconds": {
+          "description": "Minimum number of seconds for which a newly created pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready)",
+          "format": "int32",
+          "type": "integer"
+        },
+        "paused": {
+          "description": "Indicates that the deployment is paused.",
+          "type": "boolean"
+        },
+        "progressDeadlineSeconds": {
+          "description": "The maximum time in seconds for a deployment to make progress before it is considered to be failed. The deployment controller will continue to process failed deployments and a condition with a ProgressDeadlineExceeded reason will be surfaced in the deployment status. Note that progress will not be estimated during the time a deployment is paused. Defaults to 600s.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Number of desired pods. This is a pointer to distinguish between explicit zero and not specified. Defaults to 1.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "revisionHistoryLimit": {
+          "description": "The number of old ReplicaSets to retain to allow rollback. This is a pointer to distinguish between explicit zero and not specified. Defaults to 2.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "rollbackTo": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta1.RollbackConfig",
+          "description": "DEPRECATED. The config this deployment is rolling back to. Will be cleared after rollback is done."
+        },
+        "selector": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector",
+          "description": "Label selector for pods. Existing ReplicaSets whose pods are selected by this will be the ones affected by this deployment."
+        },
+        "strategy": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta1.DeploymentStrategy",
+          "description": "The deployment strategy to use to replace existing pods with new ones.",
+          "x-kubernetes-patch-strategy": "retainKeys"
+        },
+        "template": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodTemplateSpec",
+          "description": "Template describes the pods that will be created."
+        }
+      },
+      "required": [
+        "template"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta1.DeploymentStatus": {
+      "description": "DeploymentStatus is the most recently observed status of the Deployment.",
+      "properties": {
+        "availableReplicas": {
+          "description": "Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "collisionCount": {
+          "description": "Count of hash collisions for the Deployment. The Deployment controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ReplicaSet.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "conditions": {
+          "description": "Represents the latest available observations of a deployment's current state.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.apps.v1beta1.DeploymentCondition"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "type",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "observedGeneration": {
+          "description": "The generation observed by the deployment controller.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "readyReplicas": {
+          "description": "Total number of ready pods targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment (their labels match the selector).",
+          "format": "int32",
+          "type": "integer"
+        },
+        "unavailableReplicas": {
+          "description": "Total number of unavailable pods targeted by this deployment. This is the total number of pods that are still required for the deployment to have 100% available capacity. They may either be pods that are running but not yet available or pods that still have not been created.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "updatedReplicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment that have the desired template spec.",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta1.DeploymentStrategy": {
+      "description": "DeploymentStrategy describes how to replace existing pods with new ones.",
+      "properties": {
+        "rollingUpdate": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta1.RollingUpdateDeployment",
+          "description": "Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate."
+        },
+        "type": {
+          "description": "Type of deployment. Can be \"Recreate\" or \"RollingUpdate\". Default is RollingUpdate.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta1.RollbackConfig": {
+      "description": "DEPRECATED.",
+      "properties": {
+        "revision": {
+          "description": "The revision to rollback to. If set to 0, rollback to the last revision.",
+          "format": "int64",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta1.RollingUpdateDeployment": {
+      "description": "Spec to control the desired behavior of rolling update.",
+      "properties": {
+        "maxSurge": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be scheduled above the desired number of pods. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). This can not be 0 if MaxUnavailable is 0. Absolute number is calculated from percentage by rounding up. Defaults to 25%. Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when the rolling update starts, such that the total number of old and new pods do not exceed 130% of desired pods. Once old pods have been killed, new ReplicaSet can be scaled up further, ensuring that total number of pods running at any time during the update is at most 130% of desired pods."
+        },
+        "maxUnavailable": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be unavailable during the update. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). Absolute number is calculated from percentage by rounding down. This can not be 0 if MaxSurge is 0. Defaults to 25%. Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods immediately when the rolling update starts. Once new pods are ready, old ReplicaSet can be scaled down further, followed by scaling up the new ReplicaSet, ensuring that the total number of pods available at all times during the update is at least 70% of desired pods."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta2.Deployment": {
+      "description": "DEPRECATED - This group version of Deployment is deprecated by apps/v1/Deployment. See the release notes for more information. Deployment enables declarative updates for Pods and ReplicaSets.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object metadata."
+        },
+        "spec": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta2.DeploymentSpec",
+          "description": "Specification of the desired behavior of the Deployment."
+        },
+        "status": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta2.DeploymentStatus",
+          "description": "Most recently observed status of the Deployment."
+        }
+      },
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "apps",
+          "kind": "Deployment",
+          "version": "v1beta2"
+        }
+      ]
+    },
+    "io.k8s.api.apps.v1beta2.DeploymentCondition": {
+      "description": "DeploymentCondition describes the state of a deployment at a certain point.",
+      "properties": {
+        "lastTransitionTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Last time the condition transitioned from one status to another."
+        },
+        "lastUpdateTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "The last time this condition was updated."
+        },
+        "message": {
+          "description": "A human readable message indicating details about the transition.",
+          "type": "string"
+        },
+        "reason": {
+          "description": "The reason for the condition's last transition.",
+          "type": "string"
+        },
+        "status": {
+          "description": "Status of the condition, one of True, False, Unknown.",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type of deployment condition.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "status"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta2.DeploymentSpec": {
+      "description": "DeploymentSpec is the specification of the desired behavior of the Deployment.",
+      "properties": {
+        "minReadySeconds": {
+          "description": "Minimum number of seconds for which a newly created pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready)",
+          "format": "int32",
+          "type": "integer"
+        },
+        "paused": {
+          "description": "Indicates that the deployment is paused.",
+          "type": "boolean"
+        },
+        "progressDeadlineSeconds": {
+          "description": "The maximum time in seconds for a deployment to make progress before it is considered to be failed. The deployment controller will continue to process failed deployments and a condition with a ProgressDeadlineExceeded reason will be surfaced in the deployment status. Note that progress will not be estimated during the time a deployment is paused. Defaults to 600s.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Number of desired pods. This is a pointer to distinguish between explicit zero and not specified. Defaults to 1.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "revisionHistoryLimit": {
+          "description": "The number of old ReplicaSets to retain to allow rollback. This is a pointer to distinguish between explicit zero and not specified. Defaults to 10.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "selector": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector",
+          "description": "Label selector for pods. Existing ReplicaSets whose pods are selected by this will be the ones affected by this deployment. It must match the pod template's labels."
+        },
+        "strategy": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta2.DeploymentStrategy",
+          "description": "The deployment strategy to use to replace existing pods with new ones.",
+          "x-kubernetes-patch-strategy": "retainKeys"
+        },
+        "template": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodTemplateSpec",
+          "description": "Template describes the pods that will be created."
+        }
+      },
+      "required": [
+        "selector",
+        "template"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta2.DeploymentStatus": {
+      "description": "DeploymentStatus is the most recently observed status of the Deployment.",
+      "properties": {
+        "availableReplicas": {
+          "description": "Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "collisionCount": {
+          "description": "Count of hash collisions for the Deployment. The Deployment controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ReplicaSet.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "conditions": {
+          "description": "Represents the latest available observations of a deployment's current state.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.apps.v1beta2.DeploymentCondition"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "type",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "observedGeneration": {
+          "description": "The generation observed by the deployment controller.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "readyReplicas": {
+          "description": "Total number of ready pods targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment (their labels match the selector).",
+          "format": "int32",
+          "type": "integer"
+        },
+        "unavailableReplicas": {
+          "description": "Total number of unavailable pods targeted by this deployment. This is the total number of pods that are still required for the deployment to have 100% available capacity. They may either be pods that are running but not yet available or pods that still have not been created.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "updatedReplicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment that have the desired template spec.",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta2.DeploymentStrategy": {
+      "description": "DeploymentStrategy describes how to replace existing pods with new ones.",
+      "properties": {
+        "rollingUpdate": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta2.RollingUpdateDeployment",
+          "description": "Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate."
+        },
+        "type": {
+          "description": "Type of deployment. Can be \"Recreate\" or \"RollingUpdate\". Default is RollingUpdate.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta2.RollingUpdateDeployment": {
+      "description": "Spec to control the desired behavior of rolling update.",
+      "properties": {
+        "maxSurge": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be scheduled above the desired number of pods. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). This can not be 0 if MaxUnavailable is 0. Absolute number is calculated from percentage by rounding up. Defaults to 25%. Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when the rolling update starts, such that the total number of old and new pods do not exceed 130% of desired pods. Once old pods have been killed, new ReplicaSet can be scaled up further, ensuring that total number of pods running at any time during the update is at most 130% of desired pods."
+        },
+        "maxUnavailable": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be unavailable during the update. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). Absolute number is calculated from percentage by rounding down. This can not be 0 if MaxSurge is 0. Defaults to 25%. Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods immediately when the rolling update starts. Once new pods are ready, old ReplicaSet can be scaled down further, followed by scaling up the new ReplicaSet, ensuring that the total number of pods available at all times during the update is at least 70% of desired pods."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.AWSElasticBlockStoreVolumeSource": {
+      "description": "Represents a Persistent Disk resource in AWS.\n\nAn AWS EBS disk must exist before mounting to a container. The disk must also be in the same AWS zone as the kubelet. An AWS EBS disk can only be mounted as read/write once. AWS EBS volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore",
+          "type": "string"
+        },
+        "partition": {
+          "description": "The partition in the volume that you want to mount. If omitted, the default is to mount by volume name. Examples: For volume /dev/sda1, you specify the partition as \"1\". Similarly, the volume partition for /dev/sda is \"0\" (or you can leave the property empty).",
+          "format": "int32",
+          "type": "integer"
+        },
+        "readOnly": {
+          "description": "Specify \"true\" to force and set the ReadOnly property in VolumeMounts to \"true\". If omitted, the default is \"false\". More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore",
+          "type": "boolean"
+        },
+        "volumeID": {
+          "description": "Unique ID of the persistent disk resource in AWS (Amazon EBS volume). More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore",
+          "type": "string"
+        }
+      },
+      "required": [
+        "volumeID"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Affinity": {
+      "description": "Affinity is a group of affinity scheduling rules.",
+      "properties": {
+        "nodeAffinity": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.NodeAffinity",
+          "description": "Describes node affinity scheduling rules for the pod."
+        },
+        "podAffinity": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodAffinity",
+          "description": "Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s))."
+        },
+        "podAntiAffinity": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodAntiAffinity",
+          "description": "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s))."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.AttachedVolume": {
+      "description": "AttachedVolume describes a volume attached to a node",
+      "properties": {
+        "devicePath": {
+          "description": "DevicePath represents the device path where the volume should be available",
+          "type": "string"
+        },
+        "name": {
+          "description": "Name of the attached volume",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "devicePath"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.AzureDiskVolumeSource": {
+      "description": "AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.",
+      "properties": {
+        "cachingMode": {
+          "description": "Host Caching mode: None, Read Only, Read Write.",
+          "type": "string"
+        },
+        "diskName": {
+          "description": "The Name of the data disk in the blob storage",
+          "type": "string"
+        },
+        "diskURI": {
+          "description": "The URI the data disk in the blob storage",
+          "type": "string"
+        },
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Expected values Shared: multiple blob disks per storage account  Dedicated: single blob disk per storage account  Managed: azure managed data disk (only in managed availability set). defaults to shared",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "diskName",
+        "diskURI"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.AzureFileVolumeSource": {
+      "description": "AzureFile represents an Azure File Service mount on the host and bind mount to the pod.",
+      "properties": {
+        "readOnly": {
+          "description": "Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+          "type": "boolean"
+        },
+        "secretName": {
+          "description": "the name of secret that contains Azure Storage Account Name and Key",
+          "type": "string"
+        },
+        "shareName": {
+          "description": "Share Name",
+          "type": "string"
+        }
+      },
+      "required": [
+        "secretName",
+        "shareName"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.CSIVolumeSource": {
+      "description": "Represents a source location of a volume to mount, managed by an external CSI driver",
+      "properties": {
+        "driver": {
+          "description": "Driver is the name of the CSI driver that handles this volume. Consult with your admin for the correct name as registered in the cluster.",
+          "type": "string"
+        },
+        "fsType": {
+          "description": "Filesystem type to mount. Ex. \"ext4\", \"xfs\", \"ntfs\". If not provided, the empty value is passed to the associated CSI driver which will determine the default filesystem to apply.",
+          "type": "string"
+        },
+        "nodePublishSecretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "NodePublishSecretRef is a reference to the secret object containing sensitive information to pass to the CSI driver to complete the CSI NodePublishVolume and NodeUnpublishVolume calls. This field is optional, and  may be empty if no secret is required. If the secret object contains more than one secret, all secret references are passed."
+        },
+        "readOnly": {
+          "description": "Specifies a read-only configuration for the volume. Defaults to false (read/write).",
+          "type": "boolean"
+        },
+        "volumeAttributes": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "VolumeAttributes stores driver-specific properties that are passed to the CSI driver. Consult your driver's documentation for supported values.",
+          "type": "object"
+        }
+      },
+      "required": [
+        "driver"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Capabilities": {
+      "description": "Adds and removes POSIX capabilities from running containers.",
+      "properties": {
+        "add": {
+          "description": "Added capabilities",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "drop": {
+          "description": "Removed capabilities",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.CephFSVolumeSource": {
+      "description": "Represents a Ceph Filesystem mount that lasts the lifetime of a pod Cephfs volumes do not support ownership management or SELinux relabeling.",
+      "properties": {
+        "monitors": {
+          "description": "Required: Monitors is a collection of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "path": {
+          "description": "Optional: Used as the mounted root, rather than the full Ceph tree, default is /",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it",
+          "type": "boolean"
+        },
+        "secretFile": {
+          "description": "Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it",
+          "type": "string"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "Optional: SecretRef is reference to the authentication secret for User, default is empty. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it"
+        },
+        "user": {
+          "description": "Optional: User is the rados user name, default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it",
+          "type": "string"
+        }
+      },
+      "required": [
+        "monitors"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.CinderVolumeSource": {
+      "description": "Represents a cinder volume resource in Openstack. A Cinder volume must exist before mounting to a container. The volume must also be in the same region as the kubelet. Cinder volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Examples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. More info: https://examples.k8s.io/mysql-cinder-pd/README.md",
+          "type": "boolean"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "Optional: points to a secret object containing parameters used to connect to OpenStack."
+        },
+        "volumeID": {
+          "description": "volume id used to identify the volume in cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md",
+          "type": "string"
+        }
+      },
+      "required": [
+        "volumeID"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ClientIPConfig": {
+      "description": "ClientIPConfig represents the configurations of Client IP based session affinity.",
+      "properties": {
+        "timeoutSeconds": {
+          "description": "timeoutSeconds specifies the seconds of ClientIP type session sticky time. The value must be >0 && <=86400(for 1 day) if ServiceAffinity == \"ClientIP\". Default value is 10800(for 3 hours).",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ComponentCondition": {
+      "description": "Information about the condition of a component.",
+      "properties": {
+        "error": {
+          "description": "Condition error code for a component. For example, a health check error code.",
+          "type": "string"
+        },
+        "message": {
+          "description": "Message about the condition for a component. For example, information about a health check.",
+          "type": "string"
+        },
+        "status": {
+          "description": "Status of the condition for a component. Valid values for \"Healthy\": \"True\", \"False\", or \"Unknown\".",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type of condition for a component. Valid value: \"Healthy\"",
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "status"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ConfigMapEnvSource": {
+      "description": "ConfigMapEnvSource selects a ConfigMap to populate the environment variables with.\n\nThe contents of the target ConfigMap's Data field will represent the key-value pairs as environment variables.",
+      "properties": {
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "optional": {
+          "description": "Specify whether the ConfigMap must be defined",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ConfigMapKeySelector": {
+      "description": "Selects a key from a ConfigMap.",
+      "properties": {
+        "key": {
+          "description": "The key to select.",
+          "type": "string"
+        },
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "optional": {
+          "description": "Specify whether the ConfigMap or its key must be defined",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "key"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ConfigMapNodeConfigSource": {
+      "description": "ConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node.",
+      "properties": {
+        "kubeletConfigKey": {
+          "description": "KubeletConfigKey declares which key of the referenced ConfigMap corresponds to the KubeletConfiguration structure This field is required in all cases.",
+          "type": "string"
+        },
+        "name": {
+          "description": "Name is the metadata.name of the referenced ConfigMap. This field is required in all cases.",
+          "type": "string"
+        },
+        "namespace": {
+          "description": "Namespace is the metadata.namespace of the referenced ConfigMap. This field is required in all cases.",
+          "type": "string"
+        },
+        "resourceVersion": {
+          "description": "ResourceVersion is the metadata.ResourceVersion of the referenced ConfigMap. This field is forbidden in Node.Spec, and required in Node.Status.",
+          "type": "string"
+        },
+        "uid": {
+          "description": "UID is the metadata.UID of the referenced ConfigMap. This field is forbidden in Node.Spec, and required in Node.Status.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "namespace",
+        "name",
+        "kubeletConfigKey"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ConfigMapProjection": {
+      "description": "Adapts a ConfigMap into a projected volume.\n\nThe contents of the target ConfigMap's Data field will be presented in a projected volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths. Note that this is identical to a configmap volume source without the default mode.",
+      "properties": {
+        "items": {
+          "description": "If unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.KeyToPath"
+          },
+          "type": "array"
+        },
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "optional": {
+          "description": "Specify whether the ConfigMap or its keys must be defined",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ConfigMapVolumeSource": {
+      "description": "Adapts a ConfigMap into a volume.\n\nThe contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths. ConfigMap volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "defaultMode": {
+          "description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "items": {
+          "description": "If unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.KeyToPath"
+          },
+          "type": "array"
+        },
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "optional": {
+          "description": "Specify whether the ConfigMap or its keys must be defined",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Container": {
+      "description": "A single application container that you want to run within a pod.",
+      "properties": {
+        "args": {
+          "description": "Arguments to the entrypoint. The container image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "command": {
+          "description": "Entrypoint array. Not executed within a shell. The container image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "env": {
+          "description": "List of environment variables to set in the container. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.EnvVar"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "envFrom": {
+          "description": "List of sources to populate environment variables in the container. The keys defined within a source must be a C_IDENTIFIER. All invalid keys will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.EnvFromSource"
+          },
+          "type": "array"
+        },
+        "image": {
+          "description": "Docker image name. More info: https://kubernetes.io/docs/concepts/containers/images This field is optional to allow higher level config management to default or override container images in workload controllers like Deployments and StatefulSets.",
+          "type": "string"
+        },
+        "imagePullPolicy": {
+          "description": "Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images",
+          "type": "string"
+        },
+        "lifecycle": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Lifecycle",
+          "description": "Actions that the management system should take in response to container lifecycle events. Cannot be updated."
+        },
+        "livenessProbe": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Probe",
+          "description": "Periodic probe of container liveness. Container will be restarted if the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes"
+        },
+        "name": {
+          "description": "Name of the container specified as a DNS_LABEL. Each container in a pod must have a unique name (DNS_LABEL). Cannot be updated.",
+          "type": "string"
+        },
+        "ports": {
+          "description": "List of ports to expose from the container. Exposing a port here gives the system additional information about the network connections a container uses, but is primarily informational. Not specifying a port here DOES NOT prevent that port from being exposed. Any port which is listening on the default \"0.0.0.0\" address inside a container will be accessible from the network. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.ContainerPort"
+          },
+          "type": "array",
+          "x-kubernetes-list-map-keys": [
+            "containerPort",
+            "protocol"
+          ],
+          "x-kubernetes-list-type": "map",
+          "x-kubernetes-patch-merge-key": "containerPort",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "readinessProbe": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Probe",
+          "description": "Periodic probe of container service readiness. Container will be removed from service endpoints if the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes"
+        },
+        "resources": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ResourceRequirements",
+          "description": "Compute Resources required by this container. Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/"
+        },
+        "securityContext": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SecurityContext",
+          "description": "Security options the pod should run with. More info: https://kubernetes.io/docs/concepts/policy/security-context/ More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/"
+        },
+        "startupProbe": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Probe",
+          "description": "StartupProbe indicates that the Pod has successfully initialized. If specified, no other probes are executed until this completes successfully. If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, when it might take a long time to load data or warm a cache, than during steady-state operation. This cannot be updated. This is an alpha feature enabled by the StartupProbe feature flag. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes"
+        },
+        "stdin": {
+          "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this is not set, reads from stdin in the container will always result in EOF. Default is false.",
+          "type": "boolean"
+        },
+        "stdinOnce": {
+          "description": "Whether the container runtime should close the stdin channel after it has been opened by a single attach. When stdin is true the stdin stream will remain open across multiple attach sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the first client attaches to stdin, and then remains open and accepts data until the client disconnects, at which time stdin is closed and remains closed until the container is restarted. If this flag is false, a container processes that reads from stdin will never receive an EOF. Default is false",
+          "type": "boolean"
+        },
+        "terminationMessagePath": {
+          "description": "Optional: Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log. Cannot be updated.",
+          "type": "string"
+        },
+        "terminationMessagePolicy": {
+          "description": "Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.",
+          "type": "string"
+        },
+        "tty": {
+          "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true. Default is false.",
+          "type": "boolean"
+        },
+        "volumeDevices": {
+          "description": "volumeDevices is the list of block devices to be used by the container. This is a beta feature.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.VolumeDevice"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "devicePath",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "volumeMounts": {
+          "description": "Pod volumes to mount into the container's filesystem. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.VolumeMount"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "mountPath",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "workingDir": {
+          "description": "Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. Cannot be updated.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ContainerImage": {
+      "description": "Describe a container image",
+      "properties": {
+        "names": {
+          "description": "Names by which this image is known. e.g. [\"registry.k8s.io/hyperkube:v1.0.7\", \"dockerhub.io/google_containers/hyperkube:v1.0.7\"]",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "sizeBytes": {
+          "description": "The size of the image in bytes.",
+          "format": "int64",
+          "type": "integer"
+        }
+      },
+      "required": [
+        "names"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ContainerPort": {
+      "description": "ContainerPort represents a network port in a single container.",
+      "properties": {
+        "containerPort": {
+          "description": "Number of port to expose on the pod's IP address. This must be a valid port number, 0 < x < 65536.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "hostIP": {
+          "description": "What host IP to bind the external port to.",
+          "type": "string"
+        },
+        "hostPort": {
+          "description": "Number of port to expose on the host. If specified, this must be a valid port number, 0 < x < 65536. If HostNetwork is specified, this must match ContainerPort. Most containers do not need this.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "name": {
+          "description": "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each named port in a pod must have a unique name. Name for the port that can be referred to by services.",
+          "type": "string"
+        },
+        "protocol": {
+          "description": "Protocol for port. Must be UDP, TCP, or SCTP. Defaults to \"TCP\".",
+          "type": "string"
+        }
+      },
+      "required": [
+        "containerPort"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ContainerState": {
+      "description": "ContainerState holds a possible state of container. Only one of its members may be specified. If none of them is specified, the default one is ContainerStateWaiting.",
+      "properties": {
+        "running": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ContainerStateRunning",
+          "description": "Details about a running container"
+        },
+        "terminated": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ContainerStateTerminated",
+          "description": "Details about a terminated container"
+        },
+        "waiting": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ContainerStateWaiting",
+          "description": "Details about a waiting container"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ContainerStateRunning": {
+      "description": "ContainerStateRunning is a running state of a container.",
+      "properties": {
+        "startedAt": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Time at which the container was last (re-)started"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ContainerStateTerminated": {
+      "description": "ContainerStateTerminated is a terminated state of a container.",
+      "properties": {
+        "containerID": {
+          "description": "Container's ID in the format 'docker://<container_id>'",
+          "type": "string"
+        },
+        "exitCode": {
+          "description": "Exit status from the last termination of the container",
+          "format": "int32",
+          "type": "integer"
+        },
+        "finishedAt": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Time at which the container last terminated"
+        },
+        "message": {
+          "description": "Message regarding the last termination of the container",
+          "type": "string"
+        },
+        "reason": {
+          "description": "(brief) reason from the last termination of the container",
+          "type": "string"
+        },
+        "signal": {
+          "description": "Signal from the last termination of the container",
+          "format": "int32",
+          "type": "integer"
+        },
+        "startedAt": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Time at which previous execution of the container started"
+        }
+      },
+      "required": [
+        "exitCode"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ContainerStateWaiting": {
+      "description": "ContainerStateWaiting is a waiting state of a container.",
+      "properties": {
+        "message": {
+          "description": "Message regarding why the container is not yet running.",
+          "type": "string"
+        },
+        "reason": {
+          "description": "(brief) reason the container is not yet running.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ContainerStatus": {
+      "description": "ContainerStatus contains details for the current status of this container.",
+      "properties": {
+        "containerID": {
+          "description": "Container's ID in the format 'docker://<container_id>'.",
+          "type": "string"
+        },
+        "image": {
+          "description": "The image the container is running. More info: https://kubernetes.io/docs/concepts/containers/images",
+          "type": "string"
+        },
+        "imageID": {
+          "description": "ImageID of the container's image.",
+          "type": "string"
+        },
+        "lastState": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ContainerState",
+          "description": "Details about the container's last termination condition."
+        },
+        "name": {
+          "description": "This must be a DNS_LABEL. Each container in a pod must have a unique name. Cannot be updated.",
+          "type": "string"
+        },
+        "ready": {
+          "description": "Specifies whether the container has passed its readiness probe.",
+          "type": "boolean"
+        },
+        "restartCount": {
+          "description": "The number of times the container has been restarted, currently based on the number of dead containers that have not yet been removed. Note that this is calculated from dead containers. But those containers are subject to garbage collection. This value will get capped at 5 by GC.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "started": {
+          "description": "Specifies whether the container has passed its startup probe. Initialized as false, becomes true after startupProbe is considered successful. Resets to false when the container is restarted, or if kubelet loses state temporarily. Is always true when no startupProbe is defined.",
+          "type": "boolean"
+        },
+        "state": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ContainerState",
+          "description": "Details about the container's current condition."
+        }
+      },
+      "required": [
+        "name",
+        "ready",
+        "restartCount",
+        "image",
+        "imageID"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.DownwardAPIProjection": {
+      "description": "Represents downward API info for projecting into a projected volume. Note that this is identical to a downwardAPI volume source without the default mode.",
+      "properties": {
+        "items": {
+          "description": "Items is a list of DownwardAPIVolume file",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.DownwardAPIVolumeFile"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.DownwardAPIVolumeFile": {
+      "description": "DownwardAPIVolumeFile represents information to create the file containing the pod field",
+      "properties": {
+        "fieldRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ObjectFieldSelector",
+          "description": "Required: Selects a field of the pod: only annotations, labels, name and namespace are supported."
+        },
+        "mode": {
+          "description": "Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "path": {
+          "description": "Required: Path is  the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'",
+          "type": "string"
+        },
+        "resourceFieldRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ResourceFieldSelector",
+          "description": "Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported."
+        }
+      },
+      "required": [
+        "path"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.DownwardAPIVolumeSource": {
+      "description": "DownwardAPIVolumeSource represents a volume containing downward API info. Downward API volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "defaultMode": {
+          "description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "items": {
+          "description": "Items is a list of downward API volume file",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.DownwardAPIVolumeFile"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.EmptyDirVolumeSource": {
+      "description": "Represents an empty directory for a pod. Empty directory volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "medium": {
+          "description": "What type of storage medium should back this directory. The default is \"\" which means to use the node's default medium. Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir",
+          "type": "string"
+        },
+        "sizeLimit": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity",
+          "description": "Total amount of local storage required for this EmptyDir volume. The size limit is also applicable for memory medium. The maximum usage on memory medium EmptyDir would be the minimum value between the SizeLimit specified here and the sum of memory limits of all containers in a pod. The default is nil which means that the limit is undefined. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.EnvFromSource": {
+      "description": "EnvFromSource represents the source of a set of ConfigMaps",
+      "properties": {
+        "configMapRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ConfigMapEnvSource",
+          "description": "The ConfigMap to select from"
+        },
+        "prefix": {
+          "description": "An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.",
+          "type": "string"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SecretEnvSource",
+          "description": "The Secret to select from"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.EnvVar": {
+      "description": "EnvVar represents an environment variable present in a Container.",
+      "properties": {
+        "name": {
+          "description": "Name of the environment variable. Must be a C_IDENTIFIER.",
+          "type": "string"
+        },
+        "value": {
+          "description": "Variable references $(VAR_NAME) are expanded using the previous defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to \"\".",
+          "type": "string"
+        },
+        "valueFrom": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.EnvVarSource",
+          "description": "Source for the environment variable's value. Cannot be used if value is not empty."
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.EnvVarSource": {
+      "description": "EnvVarSource represents a source for the value of an EnvVar.",
+      "properties": {
+        "configMapKeyRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ConfigMapKeySelector",
+          "description": "Selects a key of a ConfigMap."
+        },
+        "fieldRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ObjectFieldSelector",
+          "description": "Selects a field of the pod: supports metadata.name, metadata.namespace, metadata.labels, metadata.annotations, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs."
+        },
+        "resourceFieldRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ResourceFieldSelector",
+          "description": "Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported."
+        },
+        "secretKeyRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SecretKeySelector",
+          "description": "Selects a key of a secret in the pod's namespace"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.EphemeralContainer": {
+      "description": "An EphemeralContainer is a container that may be added temporarily to an existing pod for user-initiated activities such as debugging. Ephemeral containers have no resource or scheduling guarantees, and they will not be restarted when they exit or when a pod is removed or restarted. If an ephemeral container causes a pod to exceed its resource allocation, the pod may be evicted. Ephemeral containers may not be added by directly updating the pod spec. They must be added via the pod's ephemeralcontainers subresource, and they will appear in the pod spec once added.",
+      "properties": {
+        "args": {
+          "description": "Arguments to the entrypoint. The container image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "command": {
+          "description": "Entrypoint array. Not executed within a shell. The container image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "env": {
+          "description": "List of environment variables to set in the container. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.EnvVar"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "envFrom": {
+          "description": "List of sources to populate environment variables in the container. The keys defined within a source must be a C_IDENTIFIER. All invalid keys will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.EnvFromSource"
+          },
+          "type": "array"
+        },
+        "image": {
+          "description": "Docker image name. More info: https://kubernetes.io/docs/concepts/containers/images",
+          "type": "string"
+        },
+        "imagePullPolicy": {
+          "description": "Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images",
+          "type": "string"
+        },
+        "lifecycle": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Lifecycle",
+          "description": "Lifecycle is not allowed for ephemeral containers."
+        },
+        "livenessProbe": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Probe",
+          "description": "Probes are not allowed for ephemeral containers."
+        },
+        "name": {
+          "description": "Name of the ephemeral container specified as a DNS_LABEL. This name must be unique among all containers, init containers and ephemeral containers.",
+          "type": "string"
+        },
+        "ports": {
+          "description": "Ports are not allowed for ephemeral containers.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.ContainerPort"
+          },
+          "type": "array"
+        },
+        "readinessProbe": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Probe",
+          "description": "Probes are not allowed for ephemeral containers."
+        },
+        "resources": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ResourceRequirements",
+          "description": "Resources are not allowed for ephemeral containers. Ephemeral containers use spare resources already allocated to the pod."
+        },
+        "securityContext": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SecurityContext",
+          "description": "SecurityContext is not allowed for ephemeral containers."
+        },
+        "startupProbe": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Probe",
+          "description": "Probes are not allowed for ephemeral containers."
+        },
+        "stdin": {
+          "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this is not set, reads from stdin in the container will always result in EOF. Default is false.",
+          "type": "boolean"
+        },
+        "stdinOnce": {
+          "description": "Whether the container runtime should close the stdin channel after it has been opened by a single attach. When stdin is true the stdin stream will remain open across multiple attach sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the first client attaches to stdin, and then remains open and accepts data until the client disconnects, at which time stdin is closed and remains closed until the container is restarted. If this flag is false, a container processes that reads from stdin will never receive an EOF. Default is false",
+          "type": "boolean"
+        },
+        "targetContainerName": {
+          "description": "If set, the name of the container from PodSpec that this ephemeral container targets. The ephemeral container will be run in the namespaces (IPC, PID, etc) of this container. If not set then the ephemeral container is run in whatever namespaces are shared for the pod. Note that the container runtime must support this feature.",
+          "type": "string"
+        },
+        "terminationMessagePath": {
+          "description": "Optional: Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log. Cannot be updated.",
+          "type": "string"
+        },
+        "terminationMessagePolicy": {
+          "description": "Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.",
+          "type": "string"
+        },
+        "tty": {
+          "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true. Default is false.",
+          "type": "boolean"
+        },
+        "volumeDevices": {
+          "description": "volumeDevices is the list of block devices to be used by the container. This is a beta feature.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.VolumeDevice"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "devicePath",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "volumeMounts": {
+          "description": "Pod volumes to mount into the container's filesystem. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.VolumeMount"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "mountPath",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "workingDir": {
+          "description": "Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. Cannot be updated.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ExecAction": {
+      "description": "ExecAction describes a \"run in container\" action.",
+      "properties": {
+        "command": {
+          "description": "Command is the command line to execute inside the container, the working directory for the command  is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.FCVolumeSource": {
+      "description": "Represents a Fibre Channel volume. Fibre Channel volumes can only be mounted as read/write once. Fibre Channel volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.",
+          "type": "string"
+        },
+        "lun": {
+          "description": "Optional: FC target lun number",
+          "format": "int32",
+          "type": "integer"
+        },
+        "readOnly": {
+          "description": "Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+          "type": "boolean"
+        },
+        "targetWWNs": {
+          "description": "Optional: FC target worldwide names (WWNs)",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "wwids": {
+          "description": "Optional: FC volume world wide identifiers (wwids) Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.FlexVolumeSource": {
+      "description": "FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin.",
+      "properties": {
+        "driver": {
+          "description": "Driver is the name of the driver to use for this volume.",
+          "type": "string"
+        },
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". The default filesystem depends on FlexVolume script.",
+          "type": "string"
+        },
+        "options": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Optional: Extra command options if any.",
+          "type": "object"
+        },
+        "readOnly": {
+          "description": "Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+          "type": "boolean"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "Optional: SecretRef is reference to the secret object containing sensitive information to pass to the plugin scripts. This may be empty if no secret object is specified. If the secret object contains more than one secret, all secrets are passed to the plugin scripts."
+        }
+      },
+      "required": [
+        "driver"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.FlockerVolumeSource": {
+      "description": "Represents a Flocker volume mounted by the Flocker agent. One and only one of datasetName and datasetUUID should be set. Flocker volumes do not support ownership management or SELinux relabeling.",
+      "properties": {
+        "datasetName": {
+          "description": "Name of the dataset stored as metadata -> name on the dataset for Flocker should be considered as deprecated",
+          "type": "string"
+        },
+        "datasetUUID": {
+          "description": "UUID of the dataset. This is unique identifier of a Flocker dataset",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.GCEPersistentDiskVolumeSource": {
+      "description": "Represents a Persistent Disk resource in Google Compute Engine.\n\nA GCE PD must exist before mounting to a container. The disk must also be in the same GCE project and zone as the kubelet. A GCE PD can only be mounted as read/write once or read-only many times. GCE PDs support ownership management and SELinux relabeling.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk",
+          "type": "string"
+        },
+        "partition": {
+          "description": "The partition in the volume that you want to mount. If omitted, the default is to mount by volume name. Examples: For volume /dev/sda1, you specify the partition as \"1\". Similarly, the volume partition for /dev/sda is \"0\" (or you can leave the property empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk",
+          "format": "int32",
+          "type": "integer"
+        },
+        "pdName": {
+          "description": "Unique name of the PD resource in GCE. Used to identify the disk in GCE. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "ReadOnly here will force the ReadOnly setting in VolumeMounts. Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "pdName"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.GitRepoVolumeSource": {
+      "description": "Represents a volume that is populated with the contents of a git repository. Git repo volumes do not support ownership management. Git repo volumes support SELinux relabeling.\n\nDEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir into the Pod's container.",
+      "properties": {
+        "directory": {
+          "description": "Target directory name. Must not contain or start with '..'.  If '.' is supplied, the volume directory will be the git repository.  Otherwise, if specified, the volume will contain the git repository in the subdirectory with the given name.",
+          "type": "string"
+        },
+        "repository": {
+          "description": "Repository URL",
+          "type": "string"
+        },
+        "revision": {
+          "description": "Commit hash for the specified revision.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "repository"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.GlusterfsVolumeSource": {
+      "description": "Represents a Glusterfs mount that lasts the lifetime of a pod. Glusterfs volumes do not support ownership management or SELinux relabeling.",
+      "properties": {
+        "endpoints": {
+          "description": "EndpointsName is the endpoint name that details Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod",
+          "type": "string"
+        },
+        "path": {
+          "description": "Path is the Glusterfs volume path. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "ReadOnly here will force the Glusterfs volume to be mounted with read-only permissions. Defaults to false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "endpoints",
+        "path"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.HTTPGetAction": {
+      "description": "HTTPGetAction describes an action based on HTTP Get requests.",
+      "properties": {
+        "host": {
+          "description": "Host name to connect to, defaults to the pod IP. You probably want to set \"Host\" in httpHeaders instead.",
+          "type": "string"
+        },
+        "httpHeaders": {
+          "description": "Custom headers to set in the request. HTTP allows repeated headers.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.HTTPHeader"
+          },
+          "type": "array"
+        },
+        "path": {
+          "description": "Path to access on the HTTP server.",
+          "type": "string"
+        },
+        "port": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "Name or number of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME."
+        },
+        "scheme": {
+          "description": "Scheme to use for connecting to the host. Defaults to HTTP.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "port"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.HTTPHeader": {
+      "description": "HTTPHeader describes a custom header to be used in HTTP probes",
+      "properties": {
+        "name": {
+          "description": "The header field name",
+          "type": "string"
+        },
+        "value": {
+          "description": "The header field value",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "value"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Handler": {
+      "description": "Handler defines a specific action that should be taken",
+      "properties": {
+        "exec": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ExecAction",
+          "description": "One and only one of the following should be specified. Exec specifies the action to take."
+        },
+        "httpGet": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.HTTPGetAction",
+          "description": "HTTPGet specifies the http request to perform."
+        },
+        "tcpSocket": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.TCPSocketAction",
+          "description": "TCPSocket specifies an action involving a TCP port. TCP hooks not yet supported"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.HostAlias": {
+      "description": "HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the pod's hosts file.",
+      "properties": {
+        "hostnames": {
+          "description": "Hostnames for the above IP address.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "ip": {
+          "description": "IP address of the host file entry.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.HostPathVolumeSource": {
+      "description": "Represents a host path mapped into a pod. Host path volumes do not support ownership management or SELinux relabeling.",
+      "properties": {
+        "path": {
+          "description": "Path of the directory on the host. If the path is a symlink, it will follow the link to the real path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type for HostPath Volume Defaults to \"\" More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath",
+          "type": "string"
+        }
+      },
+      "required": [
+        "path"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ISCSIVolumeSource": {
+      "description": "Represents an ISCSI disk. ISCSI volumes can only be mounted as read/write once. ISCSI volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "chapAuthDiscovery": {
+          "description": "whether support iSCSI Discovery CHAP authentication",
+          "type": "boolean"
+        },
+        "chapAuthSession": {
+          "description": "whether support iSCSI Session CHAP authentication",
+          "type": "boolean"
+        },
+        "fsType": {
+          "description": "Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi",
+          "type": "string"
+        },
+        "initiatorName": {
+          "description": "Custom iSCSI Initiator Name. If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface <target portal>:<volume name> will be created for the connection.",
+          "type": "string"
+        },
+        "iqn": {
+          "description": "Target iSCSI Qualified Name.",
+          "type": "string"
+        },
+        "iscsiInterface": {
+          "description": "iSCSI Interface Name that uses an iSCSI transport. Defaults to 'default' (tcp).",
+          "type": "string"
+        },
+        "lun": {
+          "description": "iSCSI Target Lun number.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "portals": {
+          "description": "iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port is other than default (typically TCP ports 860 and 3260).",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "readOnly": {
+          "description": "ReadOnly here will force the ReadOnly setting in VolumeMounts. Defaults to false.",
+          "type": "boolean"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "CHAP Secret for iSCSI target and initiator authentication"
+        },
+        "targetPortal": {
+          "description": "iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port is other than default (typically TCP ports 860 and 3260).",
+          "type": "string"
+        }
+      },
+      "required": [
+        "targetPortal",
+        "iqn",
+        "lun"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.KeyToPath": {
+      "description": "Maps a string key to a path within a volume.",
+      "properties": {
+        "key": {
+          "description": "The key to project.",
+          "type": "string"
+        },
+        "mode": {
+          "description": "Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "path": {
+          "description": "The relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "key",
+        "path"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Lifecycle": {
+      "description": "Lifecycle describes actions that the management system should take in response to container lifecycle events. For the PostStart and PreStop lifecycle handlers, management of the container blocks until the action is complete, unless the container process fails, in which case the handler is aborted.",
+      "properties": {
+        "postStart": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Handler",
+          "description": "PostStart is called immediately after a container is created. If the handler fails, the container is terminated and restarted according to its restart policy. Other management of the container blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks"
+        },
+        "preStop": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Handler",
+          "description": "PreStop is called immediately before a container is terminated due to an API request or management event such as liveness/startup probe failure, preemption, resource contention, etc. The handler is not called if the container crashes or exits. The reason for termination is passed to the handler. The Pod's termination grace period countdown begins before the PreStop hooked is executed. Regardless of the outcome of the handler, the container will eventually terminate within the Pod's termination grace period. Other management of the container blocks until the hook completes or until the termination grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.LocalObjectReference": {
+      "description": "LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.",
+      "properties": {
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.LocalVolumeSource": {
+      "description": "Local represents directly-attached storage with node affinity (Beta feature)",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type to mount. It applies only when the Path is a block device. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". The default value is to auto-select a fileystem if unspecified.",
+          "type": "string"
+        },
+        "path": {
+          "description": "The full path to the volume on the node. It can be either a directory or block device (disk, partition, ...).",
+          "type": "string"
+        }
+      },
+      "required": [
+        "path"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.NFSVolumeSource": {
+      "description": "Represents an NFS mount that lasts the lifetime of a pod. NFS volumes do not support ownership management or SELinux relabeling.",
+      "properties": {
+        "path": {
+          "description": "Path that is exported by the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "ReadOnly here will force the NFS export to be mounted with read-only permissions. Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs",
+          "type": "boolean"
+        },
+        "server": {
+          "description": "Server is the hostname or IP address of the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs",
+          "type": "string"
+        }
+      },
+      "required": [
+        "server",
+        "path"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.NodeAffinity": {
+      "description": "Node affinity is a group of node affinity scheduling rules.",
+      "properties": {
+        "preferredDuringSchedulingIgnoredDuringExecution": {
+          "description": "The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding \"weight\" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.PreferredSchedulingTerm"
+          },
+          "type": "array"
+        },
+        "requiredDuringSchedulingIgnoredDuringExecution": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.NodeSelector",
+          "description": "If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.NodeSelector": {
+      "description": "A node selector represents the union of the results of one or more label queries over a set of nodes; that is, it represents the OR of the selectors represented by the node selector terms.",
+      "properties": {
+        "nodeSelectorTerms": {
+          "description": "Required. A list of node selector terms. The terms are ORed.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.NodeSelectorTerm"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "nodeSelectorTerms"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.NodeSelectorRequirement": {
+      "description": "A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
+      "properties": {
+        "key": {
+          "description": "The label key that the selector applies to.",
+          "type": "string"
+        },
+        "operator": {
+          "description": "Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.",
+          "type": "string"
+        },
+        "values": {
+          "description": "An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "key",
+        "operator"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.NodeSelectorTerm": {
+      "description": "A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.",
+      "properties": {
+        "matchExpressions": {
+          "description": "A list of node selector requirements by node's labels.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.NodeSelectorRequirement"
+          },
+          "type": "array"
+        },
+        "matchFields": {
+          "description": "A list of node selector requirements by node's fields.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.NodeSelectorRequirement"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ObjectFieldSelector": {
+      "description": "ObjectFieldSelector selects an APIVersioned field of an object.",
+      "properties": {
+        "apiVersion": {
+          "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".",
+          "type": "string"
+        },
+        "fieldPath": {
+          "description": "Path of the field to select in the specified API version.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "fieldPath"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ObjectReference": {
+      "description": "ObjectReference contains enough information to let you inspect or modify the referred object.",
+      "properties": {
+        "apiVersion": {
+          "description": "API version of the referent.",
+          "type": "string"
+        },
+        "fieldPath": {
+          "description": "If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: \"spec.containers{name}\" (where \"name\" refers to the name of the container that triggered the event) or if no container name is specified \"spec.containers[2]\" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object.",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "namespace": {
+          "description": "Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/",
+          "type": "string"
+        },
+        "resourceVersion": {
+          "description": "Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency",
+          "type": "string"
+        },
+        "uid": {
+          "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PersistentVolumeClaimVolumeSource": {
+      "description": "PersistentVolumeClaimVolumeSource references the user's PVC in the same namespace. This volume finds the bound PV and mounts that volume for the pod. A PersistentVolumeClaimVolumeSource is, essentially, a wrapper around another type of volume that is owned by someone else (the system).",
+      "properties": {
+        "claimName": {
+          "description": "ClaimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Will force the ReadOnly setting in VolumeMounts. Default false.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "claimName"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PhotonPersistentDiskVolumeSource": {
+      "description": "Represents a Photon Controller persistent disk resource.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.",
+          "type": "string"
+        },
+        "pdID": {
+          "description": "ID that identifies Photon Controller persistent disk",
+          "type": "string"
+        }
+      },
+      "required": [
+        "pdID"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Pod": {
+      "description": "Pod is a collection of containers that can run on a host. This resource is created by clients and scheduled onto hosts.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata"
+        },
+        "spec": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodSpec",
+          "description": "Specification of the desired behavior of the pod. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status"
+        },
+        "status": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodStatus",
+          "description": "Most recently observed status of the pod. This data may not be up to date. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status"
+        }
+      },
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "",
+          "kind": "Pod",
+          "version": "v1"
+        }
+      ]
+    },
+    "io.k8s.api.core.v1.PodAffinity": {
+      "description": "Pod affinity is a group of inter pod affinity scheduling rules.",
+      "properties": {
+        "preferredDuringSchedulingIgnoredDuringExecution": {
+          "description": "The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding \"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.WeightedPodAffinityTerm"
+          },
+          "type": "array"
+        },
+        "requiredDuringSchedulingIgnoredDuringExecution": {
+          "description": "If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.PodAffinityTerm"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodAffinityTerm": {
+      "description": "Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key <topologyKey> matches that of any node on which a pod of the set of pods is running",
+      "properties": {
+        "labelSelector": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector",
+          "description": "A label query over a set of resources, in this case pods."
+        },
+        "namespaces": {
+          "description": "namespaces specifies which namespaces the labelSelector applies to (matches against); null or empty list means \"this pod's namespace\"",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "topologyKey": {
+          "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "topologyKey"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodAntiAffinity": {
+      "description": "Pod anti affinity is a group of inter pod anti affinity scheduling rules.",
+      "properties": {
+        "preferredDuringSchedulingIgnoredDuringExecution": {
+          "description": "The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding \"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.WeightedPodAffinityTerm"
+          },
+          "type": "array"
+        },
+        "requiredDuringSchedulingIgnoredDuringExecution": {
+          "description": "If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.PodAffinityTerm"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodCondition": {
+      "description": "PodCondition contains details for the current condition of this pod.",
+      "properties": {
+        "lastProbeTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Last time we probed the condition."
+        },
+        "lastTransitionTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Last time the condition transitioned from one status to another."
+        },
+        "message": {
+          "description": "Human-readable message indicating details about last transition.",
+          "type": "string"
+        },
+        "reason": {
+          "description": "Unique, one-word, CamelCase reason for the condition's last transition.",
+          "type": "string"
+        },
+        "status": {
+          "description": "Status is the status of the condition. Can be True, False, Unknown. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type is the type of the condition. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions",
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "status"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodDNSConfig": {
+      "description": "PodDNSConfig defines the DNS parameters of a pod in addition to those generated from DNSPolicy.",
+      "properties": {
+        "nameservers": {
+          "description": "A list of DNS name server IP addresses. This will be appended to the base nameservers generated from DNSPolicy. Duplicated nameservers will be removed.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "options": {
+          "description": "A list of DNS resolver options. This will be merged with the base options generated from DNSPolicy. Duplicated entries will be removed. Resolution options given in Options will override those that appear in the base DNSPolicy.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.PodDNSConfigOption"
+          },
+          "type": "array"
+        },
+        "searches": {
+          "description": "A list of DNS search domains for host-name lookup. This will be appended to the base search paths generated from DNSPolicy. Duplicated search paths will be removed.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodDNSConfigOption": {
+      "description": "PodDNSConfigOption defines DNS resolver options of a pod.",
+      "properties": {
+        "name": {
+          "description": "Required.",
+          "type": "string"
+        },
+        "value": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodIP": {
+      "description": "IP address information for entries in the (plural) PodIPs field. Each entry includes:\n   IP: An IP address allocated to the pod. Routable at least within the cluster.",
+      "properties": {
+        "ip": {
+          "description": "ip is an IP address (IPv4 or IPv6) assigned to the pod",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodReadinessGate": {
+      "description": "PodReadinessGate contains the reference to a pod condition",
+      "properties": {
+        "conditionType": {
+          "description": "ConditionType refers to a condition in the pod's condition list with matching type.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "conditionType"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodSecurityContext": {
+      "description": "PodSecurityContext holds pod-level security attributes and common container settings. Some fields are also present in container.securityContext.  Field values of container.securityContext take precedence over field values of PodSecurityContext.",
+      "properties": {
+        "fsGroup": {
+          "description": "A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod:\n\n1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "runAsGroup": {
+          "description": "The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in SecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "runAsNonRoot": {
+          "description": "Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in SecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.",
+          "type": "boolean"
+        },
+        "runAsUser": {
+          "description": "The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "seLinuxOptions": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SELinuxOptions",
+          "description": "The SELinux context to be applied to all containers. If unspecified, the container runtime will allocate a random SELinux context for each container.  May also be set in SecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container."
+        },
+        "supplementalGroups": {
+          "description": "A list of groups applied to the first process run in each container, in addition to the container's primary GID.  If unspecified, no groups will be added to any container.",
+          "items": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "type": "array"
+        },
+        "sysctls": {
+          "description": "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.Sysctl"
+          },
+          "type": "array"
+        },
+        "windowsOptions": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.WindowsSecurityContextOptions",
+          "description": "The Windows specific settings applied to all containers. If unspecified, the options within a container's SecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodSpec": {
+      "description": "PodSpec is a description of a pod.",
+      "properties": {
+        "activeDeadlineSeconds": {
+          "description": "Optional duration in seconds the pod may be active on the node relative to StartTime before the system will actively try to mark it failed and kill associated containers. Value must be a positive integer.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "affinity": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Affinity",
+          "description": "If specified, the pod's scheduling constraints"
+        },
+        "automountServiceAccountToken": {
+          "description": "AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.",
+          "type": "boolean"
+        },
+        "containers": {
+          "description": "List of containers belonging to the pod. Containers cannot currently be added or removed. There must be at least one container in a Pod. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.Container"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "dnsConfig": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodDNSConfig",
+          "description": "Specifies the DNS parameters of a pod. Parameters specified here will be merged to the generated DNS configuration based on DNSPolicy."
+        },
+        "dnsPolicy": {
+          "description": "Set DNS policy for the pod. Defaults to \"ClusterFirst\". Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy. To have DNS options set along with hostNetwork, you have to specify DNS policy explicitly to 'ClusterFirstWithHostNet'.",
+          "type": "string"
+        },
+        "enableServiceLinks": {
+          "description": "EnableServiceLinks indicates whether information about services should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Defaults to true.",
+          "type": "boolean"
+        },
+        "ephemeralContainers": {
+          "description": "List of ephemeral containers run in this pod. Ephemeral containers may be run in an existing pod to perform user-initiated actions such as debugging. This list cannot be specified when creating a pod, and it cannot be modified by updating the pod spec. In order to add an ephemeral container to an existing pod, use the pod's ephemeralcontainers subresource.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.EphemeralContainer"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "hostAliases": {
+          "description": "HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts file if specified. This is only valid for non-hostNetwork pods.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.HostAlias"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "ip",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "hostIPC": {
+          "description": "Use the host's ipc namespace. Optional: Default to false.",
+          "type": "boolean"
+        },
+        "hostNetwork": {
+          "description": "Host networking requested for this pod. Use the host's network namespace. If this option is set, the ports that will be used must be specified. Default to false.",
+          "type": "boolean"
+        },
+        "hostPID": {
+          "description": "Use the host's pid namespace. Optional: Default to false.",
+          "type": "boolean"
+        },
+        "hostname": {
+          "description": "Specifies the hostname of the Pod If not specified, the pod's hostname will be set to a system-defined value.",
+          "type": "string"
+        },
+        "imagePullSecrets": {
+          "description": "ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. If specified, these secrets will be passed to individual puller implementations for them to use. More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "initContainers": {
+          "description": "List of initialization containers belonging to the pod. Init containers are executed in order prior to containers being started. If any init container fails, the pod is considered to have failed and is handled according to its restartPolicy. The name for an init container or normal container must be unique among all containers. Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. The resourceRequirements of an init container are taken into account during scheduling by finding the highest request/limit for each resource type, and then using the max of of that value or the sum of the normal containers. Limits are applied to init containers in a similar fashion. Init containers cannot currently be added or removed. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.Container"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "nodeName": {
+          "description": "NodeName is a request to schedule this pod onto a specific node. If it is non-empty, the scheduler simply schedules this pod onto that node, assuming that it fits resource requirements.",
+          "type": "string"
+        },
+        "nodeSelector": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/",
+          "type": "object"
+        },
+        "overhead": {
+          "additionalProperties": {
+            "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity"
+          },
+          "description": "Overhead represents the resource overhead associated with running a pod for a given RuntimeClass. This field will be autopopulated at admission time by the RuntimeClass admission controller. If the RuntimeClass admission controller is enabled, overhead must not be set in Pod create requests. The RuntimeClass admission controller will reject Pod create requests which have the overhead already set. If RuntimeClass is configured and selected in the PodSpec, Overhead will be set to the value defined in the corresponding RuntimeClass, otherwise it will remain unset and treated as zero. More info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead This field is alpha-level as of Kubernetes v1.16, and is only honored by servers that enable the PodOverhead feature.",
+          "type": "object"
+        },
+        "preemptionPolicy": {
+          "description": "PreemptionPolicy is the Policy for preempting pods with lower priority. One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset. This field is alpha-level and is only honored by servers that enable the NonPreemptingPriority feature.",
+          "type": "string"
+        },
+        "priority": {
+          "description": "The priority value. Various system components use this field to find the priority of the pod. When Priority Admission Controller is enabled, it prevents users from setting this field. The admission controller populates this field from PriorityClassName. The higher the value, the higher the priority.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "priorityClassName": {
+          "description": "If specified, indicates the pod's priority. \"system-node-critical\" and \"system-cluster-critical\" are two special keywords which indicate the highest priorities with the former being the highest priority. Any other name must be defined by creating a PriorityClass object with that name. If not specified, the pod priority will be default or zero if there is no default.",
+          "type": "string"
+        },
+        "readinessGates": {
+          "description": "If specified, all readiness gates will be evaluated for pod readiness. A pod is ready when all its containers are ready AND all conditions specified in the readiness gates have status equal to \"True\" More info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.PodReadinessGate"
+          },
+          "type": "array"
+        },
+        "restartPolicy": {
+          "description": "Restart policy for all containers within the pod. One of Always, OnFailure, Never. Default to Always. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy",
+          "type": "string"
+        },
+        "runtimeClassName": {
+          "description": "RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used to run this pod.  If no RuntimeClass resource matches the named class, the pod will not be run. If unset or empty, the \"legacy\" RuntimeClass will be used, which is an implicit class with an empty definition that uses the default runtime handler. More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class This is a beta feature as of Kubernetes v1.14.",
+          "type": "string"
+        },
+        "schedulerName": {
+          "description": "If specified, the pod will be dispatched by specified scheduler. If not specified, the pod will be dispatched by default scheduler.",
+          "type": "string"
+        },
+        "securityContext": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodSecurityContext",
+          "description": "SecurityContext holds pod-level security attributes and common container settings. Optional: Defaults to empty.  See type description for default values of each field."
+        },
+        "serviceAccount": {
+          "description": "DeprecatedServiceAccount is a deprecated alias for ServiceAccountName. Deprecated: Use serviceAccountName instead.",
+          "type": "string"
+        },
+        "serviceAccountName": {
+          "description": "ServiceAccountName is the name of the ServiceAccount to use to run this pod. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/",
+          "type": "string"
+        },
+        "shareProcessNamespace": {
+          "description": "Share a single process namespace between all of the containers in a pod. When this is set containers will be able to view and signal processes from other containers in the same pod, and the first process in each container will not be assigned PID 1. HostPID and ShareProcessNamespace cannot both be set. Optional: Default to false.",
+          "type": "boolean"
+        },
+        "subdomain": {
+          "description": "If specified, the fully qualified Pod hostname will be \"<hostname>.<subdomain>.<pod namespace>.svc.<cluster domain>\". If not specified, the pod will not have a domainname at all.",
+          "type": "string"
+        },
+        "terminationGracePeriodSeconds": {
+          "description": "Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period will be used instead. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. Defaults to 30 seconds.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "tolerations": {
+          "description": "If specified, the pod's tolerations.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.Toleration"
+          },
+          "type": "array"
+        },
+        "topologySpreadConstraints": {
+          "description": "TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.TopologySpreadConstraint"
+          },
+          "type": "array",
+          "x-kubernetes-list-map-keys": [
+            "topologyKey",
+            "whenUnsatisfiable"
+          ],
+          "x-kubernetes-list-type": "map",
+          "x-kubernetes-patch-merge-key": "topologyKey",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "volumes": {
+          "description": "List of volumes that can be mounted by containers belonging to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.Volume"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge,retainKeys"
+        }
+      },
+      "required": [
+        "containers"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodStatus": {
+      "description": "PodStatus represents information about the status of a pod. Status may trail the actual state of a system, especially if the node that hosts the pod cannot contact the control plane.",
+      "properties": {
+        "conditions": {
+          "description": "Current service state of pod. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.PodCondition"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "type",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "containerStatuses": {
+          "description": "The list has one entry per container in the manifest. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-and-container-status",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.ContainerStatus"
+          },
+          "type": "array"
+        },
+        "ephemeralContainerStatuses": {
+          "description": "Status for any ephemeral containers that have run in this pod.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.ContainerStatus"
+          },
+          "type": "array"
+        },
+        "hostIP": {
+          "description": "IP address of the host to which the pod is assigned. Empty if not yet scheduled.",
+          "type": "string"
+        },
+        "initContainerStatuses": {
+          "description": "The list has one entry per init container in the manifest. The most recent successful init container will have ready = true, the most recently started container will have startTime set. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-and-container-status",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.ContainerStatus"
+          },
+          "type": "array"
+        },
+        "message": {
+          "description": "A human readable message indicating details about why the pod is in this condition.",
+          "type": "string"
+        },
+        "nominatedNodeName": {
+          "description": "nominatedNodeName is set only when this pod preempts other pods on the node, but it cannot be scheduled right away as preemption victims receive their graceful termination periods. This field does not guarantee that the pod will be scheduled on this node. Scheduler may decide to place the pod elsewhere if other nodes become available sooner. Scheduler may also decide to give the resources on this node to a higher priority pod that is created after preemption. As a result, this field may be different than PodSpec.nodeName when the pod is scheduled.",
+          "type": "string"
+        },
+        "phase": {
+          "description": "The phase of a Pod is a simple, high-level summary of where the Pod is in its lifecycle. The conditions array, the reason and message fields, and the individual container status arrays contain more detail about the pod's status. There are five possible phase values:\n\nPending: The pod has been accepted by the Kubernetes system, but one or more of the container images has not been created. This includes time before being scheduled as well as time spent downloading images over the network, which could take a while. Running: The pod has been bound to a node, and all of the containers have been created. At least one container is still running, or is in the process of starting or restarting. Succeeded: All containers in the pod have terminated in success, and will not be restarted. Failed: All containers in the pod have terminated, and at least one container has terminated in failure. The container either exited with non-zero status or was terminated by the system. Unknown: For some reason the state of the pod could not be obtained, typically due to an error in communicating with the host of the pod.\n\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-phase",
+          "type": "string"
+        },
+        "podIP": {
+          "description": "IP address allocated to the pod. Routable at least within the cluster. Empty if not yet allocated.",
+          "type": "string"
+        },
+        "podIPs": {
+          "description": "podIPs holds the IP addresses allocated to the pod. If this field is specified, the 0th entry must match the podIP field. Pods may be allocated at most 1 value for each of IPv4 and IPv6. This list is empty if no IPs have been allocated yet.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.PodIP"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "ip",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "qosClass": {
+          "description": "The Quality of Service (QOS) classification assigned to the pod based on resource requirements See PodQOSClass type for available QOS classes More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-qos/#quality-of-service-classes",
+          "type": "string"
+        },
+        "reason": {
+          "description": "A brief CamelCase message indicating details about why the pod is in this state. e.g. 'Evicted'",
+          "type": "string"
+        },
+        "startTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "RFC 3339 date and time at which the object was acknowledged by the Kubelet. This is before the Kubelet pulled the container image(s) for the pod."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodTemplate": {
+      "description": "PodTemplate describes a template for creating copies of a predefined pod.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata"
+        },
+        "template": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodTemplateSpec",
+          "description": "Template defines the pods that will be created from this pod template. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status"
+        }
+      },
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "",
+          "kind": "PodTemplate",
+          "version": "v1"
+        }
+      ]
+    },
+    "io.k8s.api.core.v1.PodTemplateSpec": {
+      "description": "PodTemplateSpec describes the data a pod should have when created from a template",
+      "properties": {
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata"
+        },
+        "spec": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodSpec",
+          "description": "Specification of the desired behavior of the pod. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PortworxVolumeSource": {
+      "description": "PortworxVolumeSource represents a Portworx volume resource.",
+      "properties": {
+        "fsType": {
+          "description": "FSType represents the filesystem type to mount Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\". Implicitly inferred to be \"ext4\" if unspecified.",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+          "type": "boolean"
+        },
+        "volumeID": {
+          "description": "VolumeID uniquely identifies a Portworx volume",
+          "type": "string"
+        }
+      },
+      "required": [
+        "volumeID"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PreferredSchedulingTerm": {
+      "description": "An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).",
+      "properties": {
+        "preference": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.NodeSelectorTerm",
+          "description": "A node selector term, associated with the corresponding weight."
+        },
+        "weight": {
+          "description": "Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "required": [
+        "weight",
+        "preference"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Probe": {
+      "description": "Probe describes a health check to be performed against a container to determine whether it is alive or ready to receive traffic.",
+      "properties": {
+        "exec": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ExecAction",
+          "description": "One and only one of the following should be specified. Exec specifies the action to take."
+        },
+        "failureThreshold": {
+          "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "httpGet": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.HTTPGetAction",
+          "description": "HTTPGet specifies the http request to perform."
+        },
+        "initialDelaySeconds": {
+          "description": "Number of seconds after the container has started before liveness probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes",
+          "format": "int32",
+          "type": "integer"
+        },
+        "periodSeconds": {
+          "description": "How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "successThreshold": {
+          "description": "Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "tcpSocket": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.TCPSocketAction",
+          "description": "TCPSocket specifies an action involving a TCP port. TCP hooks not yet supported"
+        },
+        "timeoutSeconds": {
+          "description": "Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ProjectedVolumeSource": {
+      "description": "Represents a projected volume source",
+      "properties": {
+        "defaultMode": {
+          "description": "Mode bits to use on created files by default. Must be a value between 0 and 0777. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "sources": {
+          "description": "list of volume projections",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.VolumeProjection"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "sources"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.QuobyteVolumeSource": {
+      "description": "Represents a Quobyte mount that lasts the lifetime of a pod. Quobyte volumes do not support ownership management or SELinux relabeling.",
+      "properties": {
+        "group": {
+          "description": "Group to map volume access to Default is no group",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "ReadOnly here will force the Quobyte volume to be mounted with read-only permissions. Defaults to false.",
+          "type": "boolean"
+        },
+        "registry": {
+          "description": "Registry represents a single or multiple Quobyte Registry services specified as a string as host:port pair (multiple entries are separated with commas) which acts as the central registry for volumes",
+          "type": "string"
+        },
+        "tenant": {
+          "description": "Tenant owning the given Quobyte volume in the Backend Used with dynamically provisioned Quobyte volumes, value is set by the plugin",
+          "type": "string"
+        },
+        "user": {
+          "description": "User to map volume access to Defaults to serivceaccount user",
+          "type": "string"
+        },
+        "volume": {
+          "description": "Volume is a string that references an already created Quobyte volume by name.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "registry",
+        "volume"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.RBDVolumeSource": {
+      "description": "Represents a Rados Block Device mount that lasts the lifetime of a pod. RBD volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd",
+          "type": "string"
+        },
+        "image": {
+          "description": "The rados image name. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it",
+          "type": "string"
+        },
+        "keyring": {
+          "description": "Keyring is the path to key ring for RBDUser. Default is /etc/ceph/keyring. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it",
+          "type": "string"
+        },
+        "monitors": {
+          "description": "A collection of Ceph monitors. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "pool": {
+          "description": "The rados pool name. Default is rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "ReadOnly here will force the ReadOnly setting in VolumeMounts. Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it",
+          "type": "boolean"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "SecretRef is name of the authentication secret for RBDUser. If provided overrides keyring. Default is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it"
+        },
+        "user": {
+          "description": "The rados user name. Default is admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it",
+          "type": "string"
+        }
+      },
+      "required": [
+        "monitors",
+        "image"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ResourceFieldSelector": {
+      "description": "ResourceFieldSelector represents container resources (cpu, memory) and their output format",
+      "properties": {
+        "containerName": {
+          "description": "Container name: required for volumes, optional for env vars",
+          "type": "string"
+        },
+        "divisor": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity",
+          "description": "Specifies the output format of the exposed resources, defaults to \"1\""
+        },
+        "resource": {
+          "description": "Required: resource to select",
+          "type": "string"
+        }
+      },
+      "required": [
+        "resource"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ResourceRequirements": {
+      "description": "ResourceRequirements describes the compute resource requirements.",
+      "properties": {
+        "limits": {
+          "additionalProperties": {
+            "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity"
+          },
+          "description": "Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/",
+          "type": "object"
+        },
+        "requests": {
+          "additionalProperties": {
+            "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity"
+          },
+          "description": "Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/",
+          "type": "object"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.SELinuxOptions": {
+      "description": "SELinuxOptions are the labels to be applied to the container",
+      "properties": {
+        "level": {
+          "description": "Level is SELinux level label that applies to the container.",
+          "type": "string"
+        },
+        "role": {
+          "description": "Role is a SELinux role label that applies to the container.",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type is a SELinux type label that applies to the container.",
+          "type": "string"
+        },
+        "user": {
+          "description": "User is a SELinux user label that applies to the container.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ScaleIOVolumeSource": {
+      "description": "ScaleIOVolumeSource represents a persistent ScaleIO volume",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Default is \"xfs\".",
+          "type": "string"
+        },
+        "gateway": {
+          "description": "The host address of the ScaleIO API Gateway.",
+          "type": "string"
+        },
+        "protectionDomain": {
+          "description": "The name of the ScaleIO Protection Domain for the configured storage.",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+          "type": "boolean"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "SecretRef references to the secret for ScaleIO user and other sensitive information. If this is not provided, Login operation will fail."
+        },
+        "sslEnabled": {
+          "description": "Flag to enable/disable SSL communication with Gateway, default false",
+          "type": "boolean"
+        },
+        "storageMode": {
+          "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned. Default is ThinProvisioned.",
+          "type": "string"
+        },
+        "storagePool": {
+          "description": "The ScaleIO Storage Pool associated with the protection domain.",
+          "type": "string"
+        },
+        "system": {
+          "description": "The name of the storage system as configured in ScaleIO.",
+          "type": "string"
+        },
+        "volumeName": {
+          "description": "The name of a volume already created in the ScaleIO system that is associated with this volume source.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "gateway",
+        "system",
+        "secretRef"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ScopeSelector": {
+      "description": "A scope selector represents the AND of the selectors represented by the scoped-resource selector requirements.",
+      "properties": {
+        "matchExpressions": {
+          "description": "A list of scope selector requirements by scope of the resources.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.ScopedResourceSelectorRequirement"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ScopedResourceSelectorRequirement": {
+      "description": "A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.",
+      "properties": {
+        "operator": {
+          "description": "Represents a scope's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.",
+          "type": "string"
+        },
+        "scopeName": {
+          "description": "The name of the scope that the selector applies to.",
+          "type": "string"
+        },
+        "values": {
+          "description": "An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "scopeName",
+        "operator"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Secret": {
+      "description": "Secret holds secret data of a certain type. The total bytes of the values in the Data field must be less than MaxSecretSize bytes.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "data": {
+          "additionalProperties": {
+            "format": "byte",
+            "type": "string"
+          },
+          "description": "Data contains the secret data. Each key must consist of alphanumeric characters, '-', '_' or '.'. The serialized form of the secret data is a base64 encoded string, representing the arbitrary (possibly non-string) data value here. Described in https://tools.ietf.org/html/rfc4648#section-4",
+          "type": "object"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata"
+        },
+        "stringData": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "stringData allows specifying non-binary secret data in string form. It is provided as a write-only input field for convenience. All keys and values are merged into the data field on write, overwriting any existing values. The stringData field is never output when reading from the API.",
+          "type": "object"
+        },
+        "type": {
+          "description": "Used to facilitate programmatic handling of secret data.",
+          "type": "string"
+        }
+      },
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "",
+          "kind": "Secret",
+          "version": "v1"
+        }
+      ]
+    },
+    "io.k8s.api.core.v1.SecretEnvSource": {
+      "description": "SecretEnvSource selects a Secret to populate the environment variables with.\n\nThe contents of the target Secret's Data field will represent the key-value pairs as environment variables.",
+      "properties": {
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "optional": {
+          "description": "Specify whether the Secret must be defined",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.SecretKeySelector": {
+      "description": "SecretKeySelector selects a key of a Secret.",
+      "properties": {
+        "key": {
+          "description": "The key of the secret to select from.  Must be a valid secret key.",
+          "type": "string"
+        },
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "optional": {
+          "description": "Specify whether the Secret or its key must be defined",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "key"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.SecretProjection": {
+      "description": "Adapts a secret into a projected volume.\n\nThe contents of the target Secret's Data field will be presented in a projected volume as files using the keys in the Data field as the file names. Note that this is identical to a secret volume source without the default mode.",
+      "properties": {
+        "items": {
+          "description": "If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.KeyToPath"
+          },
+          "type": "array"
+        },
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "optional": {
+          "description": "Specify whether the Secret or its key must be defined",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.SecretReference": {
+      "description": "SecretReference represents a Secret Reference. It has enough information to retrieve secret in any namespace",
+      "properties": {
+        "name": {
+          "description": "Name is unique within a namespace to reference a secret resource.",
+          "type": "string"
+        },
+        "namespace": {
+          "description": "Namespace defines the space within which the secret name must be unique.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.SecretVolumeSource": {
+      "description": "Adapts a Secret into a volume.\n\nThe contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names. Secret volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "defaultMode": {
+          "description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "items": {
+          "description": "If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.KeyToPath"
+          },
+          "type": "array"
+        },
+        "optional": {
+          "description": "Specify whether the Secret or its keys must be defined",
+          "type": "boolean"
+        },
+        "secretName": {
+          "description": "Name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.SecurityContext": {
+      "description": "SecurityContext holds security configuration that will be applied to a container. Some fields are present in both SecurityContext and PodSecurityContext.  When both are set, the values in SecurityContext take precedence.",
+      "properties": {
+        "allowPrivilegeEscalation": {
+          "description": "AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN",
+          "type": "boolean"
+        },
+        "capabilities": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Capabilities",
+          "description": "The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime."
+        },
+        "privileged": {
+          "description": "Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false.",
+          "type": "boolean"
+        },
+        "procMount": {
+          "description": "procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled.",
+          "type": "string"
+        },
+        "readOnlyRootFilesystem": {
+          "description": "Whether this container has a read-only root filesystem. Default is false.",
+          "type": "boolean"
+        },
+        "runAsGroup": {
+          "description": "The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "runAsNonRoot": {
+          "description": "Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.",
+          "type": "boolean"
+        },
+        "runAsUser": {
+          "description": "The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "seLinuxOptions": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SELinuxOptions",
+          "description": "The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container.  May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence."
+        },
+        "windowsOptions": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.WindowsSecurityContextOptions",
+          "description": "The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ServiceAccountTokenProjection": {
+      "description": "ServiceAccountTokenProjection represents a projected service account token volume. This projection can be used to insert a service account token into the pods runtime filesystem for use against APIs (Kubernetes API Server or otherwise).",
+      "properties": {
+        "audience": {
+          "description": "Audience is the intended audience of the token. A recipient of a token must identify itself with an identifier specified in the audience of the token, and otherwise should reject the token. The audience defaults to the identifier of the apiserver.",
+          "type": "string"
+        },
+        "expirationSeconds": {
+          "description": "ExpirationSeconds is the requested duration of validity of the service account token. As the token approaches expiration, the kubelet volume plugin will proactively rotate the service account token. The kubelet will start trying to rotate the token if the token is older than 80 percent of its time to live or if the token is older than 24 hours.Defaults to 1 hour and must be at least 10 minutes.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "path": {
+          "description": "Path is the path relative to the mount point of the file to project the token into.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "path"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.SessionAffinityConfig": {
+      "description": "SessionAffinityConfig represents the configurations of session affinity.",
+      "properties": {
+        "clientIP": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ClientIPConfig",
+          "description": "clientIP contains the configurations of Client IP based session affinity."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.StorageOSVolumeSource": {
+      "description": "Represents a StorageOS persistent volume resource.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+          "type": "boolean"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "SecretRef specifies the secret to use for obtaining the StorageOS API credentials.  If not specified, default values will be attempted."
+        },
+        "volumeName": {
+          "description": "VolumeName is the human-readable name of the StorageOS volume.  Volume names are only unique within a namespace.",
+          "type": "string"
+        },
+        "volumeNamespace": {
+          "description": "VolumeNamespace specifies the scope of the volume within StorageOS.  If no namespace is specified then the Pod's namespace will be used.  This allows the Kubernetes name scoping to be mirrored within StorageOS for tighter integration. Set VolumeName to any name to override the default behaviour. Set to \"default\" if you are not using namespaces within StorageOS. Namespaces that do not pre-exist within StorageOS will be created.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Sysctl": {
+      "description": "Sysctl defines a kernel parameter to be set",
+      "properties": {
+        "name": {
+          "description": "Name of a property to set",
+          "type": "string"
+        },
+        "value": {
+          "description": "Value of a property to set",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "value"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.TCPSocketAction": {
+      "description": "TCPSocketAction describes an action based on opening a socket",
+      "properties": {
+        "host": {
+          "description": "Optional: Host name to connect to, defaults to the pod IP.",
+          "type": "string"
+        },
+        "port": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "Number or name of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME."
+        }
+      },
+      "required": [
+        "port"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Toleration": {
+      "description": "The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>.",
+      "properties": {
+        "effect": {
+          "description": "Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.",
+          "type": "string"
+        },
+        "key": {
+          "description": "Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.",
+          "type": "string"
+        },
+        "operator": {
+          "description": "Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category.",
+          "type": "string"
+        },
+        "tolerationSeconds": {
+          "description": "TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "value": {
+          "description": "Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.TopologySelectorLabelRequirement": {
+      "description": "A topology selector requirement is a selector that matches given label. This is an alpha feature and may change in the future.",
+      "properties": {
+        "key": {
+          "description": "The label key that the selector applies to.",
+          "type": "string"
+        },
+        "values": {
+          "description": "An array of string values. One value must match the label to be selected. Each entry in Values is ORed.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "key",
+        "values"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.TopologySelectorTerm": {
+      "description": "A topology selector term represents the result of label queries. A null or empty topology selector term matches no objects. The requirements of them are ANDed. It provides a subset of functionality as NodeSelectorTerm. This is an alpha feature and may change in the future.",
+      "properties": {
+        "matchLabelExpressions": {
+          "description": "A list of topology selector requirements by labels.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.TopologySelectorLabelRequirement"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.TopologySpreadConstraint": {
+      "description": "TopologySpreadConstraint specifies how to spread matching pods among the given topology.",
+      "properties": {
+        "labelSelector": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector",
+          "description": "LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain."
+        },
+        "maxSkew": {
+          "description": "MaxSkew describes the degree to which pods may be unevenly distributed. It's the maximum permitted difference between the number of matching pods in any two topology domains of a given topology type. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 1/1/0: | zone1 | zone2 | zone3 | |   P   |   P   |       | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 1/1/1; scheduling it onto zone1(zone2) would make the ActualSkew(2-0) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. It's a required field. Default value is 1 and 0 is not allowed.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "topologyKey": {
+          "description": "TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each <key, value> as a \"bucket\", and try to put balanced number of pods into each bucket. It's a required field.",
+          "type": "string"
+        },
+        "whenUnsatisfiable": {
+          "description": "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it - ScheduleAnyway tells the scheduler to still schedule it It's considered as \"Unsatisfiable\" if and only if placing incoming pod on any topology violates \"MaxSkew\". For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P |   P   |   P   | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "maxSkew",
+        "topologyKey",
+        "whenUnsatisfiable"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Volume": {
+      "description": "Volume represents a named volume in a pod that may be accessed by any container in the pod.",
+      "properties": {
+        "awsElasticBlockStore": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.AWSElasticBlockStoreVolumeSource",
+          "description": "AWSElasticBlockStore represents an AWS Disk resource that is attached to a kubelet's host machine and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore"
+        },
+        "azureDisk": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.AzureDiskVolumeSource",
+          "description": "AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod."
+        },
+        "azureFile": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.AzureFileVolumeSource",
+          "description": "AzureFile represents an Azure File Service mount on the host and bind mount to the pod."
+        },
+        "cephfs": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.CephFSVolumeSource",
+          "description": "CephFS represents a Ceph FS mount on the host that shares a pod's lifetime"
+        },
+        "cinder": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.CinderVolumeSource",
+          "description": "Cinder represents a cinder volume attached and mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md"
+        },
+        "configMap": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ConfigMapVolumeSource",
+          "description": "ConfigMap represents a configMap that should populate this volume"
+        },
+        "csi": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.CSIVolumeSource",
+          "description": "CSI (Container Storage Interface) represents storage that is handled by an external CSI driver (Alpha feature)."
+        },
+        "downwardAPI": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.DownwardAPIVolumeSource",
+          "description": "DownwardAPI represents downward API about the pod that should populate this volume"
+        },
+        "emptyDir": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.EmptyDirVolumeSource",
+          "description": "EmptyDir represents a temporary directory that shares a pod's lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir"
+        },
+        "fc": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.FCVolumeSource",
+          "description": "FC represents a Fibre Channel resource that is attached to a kubelet's host machine and then exposed to the pod."
+        },
+        "flexVolume": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.FlexVolumeSource",
+          "description": "FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin."
+        },
+        "flocker": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.FlockerVolumeSource",
+          "description": "Flocker represents a Flocker volume attached to a kubelet's host machine. This depends on the Flocker control service being running"
+        },
+        "gcePersistentDisk": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.GCEPersistentDiskVolumeSource",
+          "description": "GCEPersistentDisk represents a GCE Disk resource that is attached to a kubelet's host machine and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk"
+        },
+        "gitRepo": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.GitRepoVolumeSource",
+          "description": "GitRepo represents a git repository at a particular revision. DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir into the Pod's container."
+        },
+        "glusterfs": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.GlusterfsVolumeSource",
+          "description": "Glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md"
+        },
+        "hostPath": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.HostPathVolumeSource",
+          "description": "HostPath represents a pre-existing file or directory on the host machine that is directly exposed to the container. This is generally used for system agents or other privileged things that are allowed to see the host machine. Most containers will NOT need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath"
+        },
+        "iscsi": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ISCSIVolumeSource",
+          "description": "ISCSI represents an ISCSI Disk resource that is attached to a kubelet's host machine and then exposed to the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md"
+        },
+        "name": {
+          "description": "Volume's name. Must be a DNS_LABEL and unique within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "nfs": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.NFSVolumeSource",
+          "description": "NFS represents an NFS mount on the host that shares a pod's lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs"
+        },
+        "persistentVolumeClaim": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PersistentVolumeClaimVolumeSource",
+          "description": "PersistentVolumeClaimVolumeSource represents a reference to a PersistentVolumeClaim in the same namespace. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims"
+        },
+        "photonPersistentDisk": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PhotonPersistentDiskVolumeSource",
+          "description": "PhotonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine"
+        },
+        "portworxVolume": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PortworxVolumeSource",
+          "description": "PortworxVolume represents a portworx volume attached and mounted on kubelets host machine"
+        },
+        "projected": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ProjectedVolumeSource",
+          "description": "Items for all in one resources secrets, configmaps, and downward API"
+        },
+        "quobyte": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.QuobyteVolumeSource",
+          "description": "Quobyte represents a Quobyte mount on the host that shares a pod's lifetime"
+        },
+        "rbd": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.RBDVolumeSource",
+          "description": "RBD represents a Rados Block Device mount on the host that shares a pod's lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md"
+        },
+        "scaleIO": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ScaleIOVolumeSource",
+          "description": "ScaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes."
+        },
+        "secret": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SecretVolumeSource",
+          "description": "Secret represents a secret that should populate this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret"
+        },
+        "storageos": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.StorageOSVolumeSource",
+          "description": "StorageOS represents a StorageOS volume attached and mounted on Kubernetes nodes."
+        },
+        "vsphereVolume": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.VsphereVirtualDiskVolumeSource",
+          "description": "VsphereVolume represents a vSphere volume attached and mounted on kubelets host machine"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.VolumeDevice": {
+      "description": "volumeDevice describes a mapping of a raw block device within a container.",
+      "properties": {
+        "devicePath": {
+          "description": "devicePath is the path inside of the container that the device will be mapped to.",
+          "type": "string"
+        },
+        "name": {
+          "description": "name must match the name of a persistentVolumeClaim in the pod",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "devicePath"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.VolumeMount": {
+      "description": "VolumeMount describes a mounting of a Volume within a container.",
+      "properties": {
+        "mountPath": {
+          "description": "Path within the container at which the volume should be mounted.  Must not contain ':'.",
+          "type": "string"
+        },
+        "mountPropagation": {
+          "description": "mountPropagation determines how mounts are propagated from the host to container and the other way around. When not set, MountPropagationNone is used. This field is beta in 1.10.",
+          "type": "string"
+        },
+        "name": {
+          "description": "This must match the Name of a Volume.",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Mounted read-only if true, read-write otherwise (false or unspecified). Defaults to false.",
+          "type": "boolean"
+        },
+        "subPath": {
+          "description": "Path within the volume from which the container's volume should be mounted. Defaults to \"\" (volume's root).",
+          "type": "string"
+        },
+        "subPathExpr": {
+          "description": "Expanded path within the volume from which the container's volume should be mounted. Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. Defaults to \"\" (volume's root). SubPathExpr and SubPath are mutually exclusive.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "mountPath"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.VolumeNodeAffinity": {
+      "description": "VolumeNodeAffinity defines constraints that limit what nodes this volume can be accessed from.",
+      "properties": {
+        "required": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.NodeSelector",
+          "description": "Required specifies hard node constraints that must be met."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.VolumeProjection": {
+      "description": "Projection that may be projected along with other supported volume types",
+      "properties": {
+        "configMap": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ConfigMapProjection",
+          "description": "information about the configMap data to project"
+        },
+        "downwardAPI": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.DownwardAPIProjection",
+          "description": "information about the downwardAPI data to project"
+        },
+        "secret": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SecretProjection",
+          "description": "information about the secret data to project"
+        },
+        "serviceAccountToken": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ServiceAccountTokenProjection",
+          "description": "information about the serviceAccountToken data to project"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.VsphereVirtualDiskVolumeSource": {
+      "description": "Represents a vSphere volume resource.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.",
+          "type": "string"
+        },
+        "storagePolicyID": {
+          "description": "Storage Policy Based Management (SPBM) profile ID associated with the StoragePolicyName.",
+          "type": "string"
+        },
+        "storagePolicyName": {
+          "description": "Storage Policy Based Management (SPBM) profile name.",
+          "type": "string"
+        },
+        "volumePath": {
+          "description": "Path that identifies vSphere volume vmdk",
+          "type": "string"
+        }
+      },
+      "required": [
+        "volumePath"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.WeightedPodAffinityTerm": {
+      "description": "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)",
+      "properties": {
+        "podAffinityTerm": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodAffinityTerm",
+          "description": "Required. A pod affinity term, associated with the corresponding weight."
+        },
+        "weight": {
+          "description": "weight associated with matching the corresponding podAffinityTerm, in the range 1-100.",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "required": [
+        "weight",
+        "podAffinityTerm"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.WindowsSecurityContextOptions": {
+      "description": "WindowsSecurityContextOptions contain Windows-specific options and credentials.",
+      "properties": {
+        "gmsaCredentialSpec": {
+          "description": "GMSACredentialSpec is where the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field. This field is alpha-level and is only honored by servers that enable the WindowsGMSA feature flag.",
+          "type": "string"
+        },
+        "gmsaCredentialSpecName": {
+          "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use. This field is alpha-level and is only honored by servers that enable the WindowsGMSA feature flag.",
+          "type": "string"
+        },
+        "runAsUserName": {
+          "description": "The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. This field is beta-level and may be disabled with the WindowsRunAsUserName feature flag.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.extensions.v1beta1.Deployment": {
+      "description": "DEPRECATED - This group version of Deployment is deprecated by apps/v1beta2/Deployment. See the release notes for more information. Deployment enables declarative updates for Pods and ReplicaSets.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object metadata."
+        },
+        "spec": {
+          "$ref": "#/definitions/io.k8s.api.extensions.v1beta1.DeploymentSpec",
+          "description": "Specification of the desired behavior of the Deployment."
+        },
+        "status": {
+          "$ref": "#/definitions/io.k8s.api.extensions.v1beta1.DeploymentStatus",
+          "description": "Most recently observed status of the Deployment."
+        }
+      },
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "extensions",
+          "kind": "Deployment",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "io.k8s.api.extensions.v1beta1.DeploymentCondition": {
+      "description": "DeploymentCondition describes the state of a deployment at a certain point.",
+      "properties": {
+        "lastTransitionTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Last time the condition transitioned from one status to another."
+        },
+        "lastUpdateTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "The last time this condition was updated."
+        },
+        "message": {
+          "description": "A human readable message indicating details about the transition.",
+          "type": "string"
+        },
+        "reason": {
+          "description": "The reason for the condition's last transition.",
+          "type": "string"
+        },
+        "status": {
+          "description": "Status of the condition, one of True, False, Unknown.",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type of deployment condition.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "status"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.extensions.v1beta1.DeploymentRollback": {
+      "description": "DEPRECATED. DeploymentRollback stores the information required to rollback a deployment.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "name": {
+          "description": "Required: This must match the Name of a deployment.",
+          "type": "string"
+        },
+        "rollbackTo": {
+          "$ref": "#/definitions/io.k8s.api.extensions.v1beta1.RollbackConfig",
+          "description": "The config of this deployment rollback."
+        },
+        "updatedAnnotations": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "The annotations to be updated to a deployment",
+          "type": "object"
+        }
+      },
+      "required": [
+        "name",
+        "rollbackTo"
+      ],
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "extensions",
+          "kind": "DeploymentRollback",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "io.k8s.api.extensions.v1beta1.DeploymentSpec": {
+      "description": "DeploymentSpec is the specification of the desired behavior of the Deployment.",
+      "properties": {
+        "minReadySeconds": {
+          "description": "Minimum number of seconds for which a newly created pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready)",
+          "format": "int32",
+          "type": "integer"
+        },
+        "paused": {
+          "description": "Indicates that the deployment is paused and will not be processed by the deployment controller.",
+          "type": "boolean"
+        },
+        "progressDeadlineSeconds": {
+          "description": "The maximum time in seconds for a deployment to make progress before it is considered to be failed. The deployment controller will continue to process failed deployments and a condition with a ProgressDeadlineExceeded reason will be surfaced in the deployment status. Note that progress will not be estimated during the time a deployment is paused. This is set to the max value of int32 (i.e. 2147483647) by default, which means \"no deadline\".",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Number of desired pods. This is a pointer to distinguish between explicit zero and not specified. Defaults to 1.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "revisionHistoryLimit": {
+          "description": "The number of old ReplicaSets to retain to allow rollback. This is a pointer to distinguish between explicit zero and not specified. This is set to the max value of int32 (i.e. 2147483647) by default, which means \"retaining all old ReplicaSets\".",
+          "format": "int32",
+          "type": "integer"
+        },
+        "rollbackTo": {
+          "$ref": "#/definitions/io.k8s.api.extensions.v1beta1.RollbackConfig",
+          "description": "DEPRECATED. The config this deployment is rolling back to. Will be cleared after rollback is done."
+        },
+        "selector": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector",
+          "description": "Label selector for pods. Existing ReplicaSets whose pods are selected by this will be the ones affected by this deployment."
+        },
+        "strategy": {
+          "$ref": "#/definitions/io.k8s.api.extensions.v1beta1.DeploymentStrategy",
+          "description": "The deployment strategy to use to replace existing pods with new ones.",
+          "x-kubernetes-patch-strategy": "retainKeys"
+        },
+        "template": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodTemplateSpec",
+          "description": "Template describes the pods that will be created."
+        }
+      },
+      "required": [
+        "template"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.extensions.v1beta1.DeploymentStatus": {
+      "description": "DeploymentStatus is the most recently observed status of the Deployment.",
+      "properties": {
+        "availableReplicas": {
+          "description": "Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "collisionCount": {
+          "description": "Count of hash collisions for the Deployment. The Deployment controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ReplicaSet.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "conditions": {
+          "description": "Represents the latest available observations of a deployment's current state.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.extensions.v1beta1.DeploymentCondition"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "type",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "observedGeneration": {
+          "description": "The generation observed by the deployment controller.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "readyReplicas": {
+          "description": "Total number of ready pods targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment (their labels match the selector).",
+          "format": "int32",
+          "type": "integer"
+        },
+        "unavailableReplicas": {
+          "description": "Total number of unavailable pods targeted by this deployment. This is the total number of pods that are still required for the deployment to have 100% available capacity. They may either be pods that are running but not yet available or pods that still have not been created.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "updatedReplicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment that have the desired template spec.",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.extensions.v1beta1.DeploymentStrategy": {
+      "description": "DeploymentStrategy describes how to replace existing pods with new ones.",
+      "properties": {
+        "rollingUpdate": {
+          "$ref": "#/definitions/io.k8s.api.extensions.v1beta1.RollingUpdateDeployment",
+          "description": "Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate."
+        },
+        "type": {
+          "description": "Type of deployment. Can be \"Recreate\" or \"RollingUpdate\". Default is RollingUpdate.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.extensions.v1beta1.RollbackConfig": {
+      "description": "DEPRECATED.",
+      "properties": {
+        "revision": {
+          "description": "The revision to rollback to. If set to 0, rollback to the last revision.",
+          "format": "int64",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.extensions.v1beta1.RollingUpdateDeployment": {
+      "description": "Spec to control the desired behavior of rolling update.",
+      "properties": {
+        "maxSurge": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be scheduled above the desired number of pods. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). This can not be 0 if MaxUnavailable is 0. Absolute number is calculated from percentage by rounding up. By default, a value of 1 is used. Example: when this is set to 30%, the new RC can be scaled up immediately when the rolling update starts, such that the total number of old and new pods do not exceed 130% of desired pods. Once old pods have been killed, new RC can be scaled up further, ensuring that total number of pods running at any time during the update is at most 130% of desired pods."
+        },
+        "maxUnavailable": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be unavailable during the update. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). Absolute number is calculated from percentage by rounding down. This can not be 0 if MaxSurge is 0. By default, a fixed value of 1 is used. Example: when this is set to 30%, the old RC can be scaled down to 70% of desired pods immediately when the rolling update starts. Once new pods are ready, old RC can be scaled down further, followed by scaling up the new RC, ensuring that the total number of pods available at all times during the update is at least 70% of desired pods."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.api.resource.Quantity": {
+      "description": "Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.\n\nThe serialization format is:\n\n<quantity>        ::= <signedNumber><suffix>\n  (Note that <suffix> may be empty, from the \"\" case in <decimalSI>.)\n<digit>           ::= 0 | 1 | ... | 9 <digits>          ::= <digit> | <digit><digits> <number>          ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign>            ::= \"+\" | \"-\" <signedNumber>    ::= <number> | <sign><number> <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei\n  (International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)\n<decimalSI>       ::= m | \"\" | k | M | G | T | P | E\n  (Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)\n<decimalExponent> ::= \"e\" <signedNumber> | \"E\" <signedNumber>\n\nNo matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.\n\nWhen a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.\n\nBefore serializing, Quantity will be put in \"canonical form\". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:\n  a. No precision is lost\n  b. No fractional digits will be emitted\n  c. The exponent (or suffix) is as large as possible.\nThe sign will be omitted unless the number is negative.\n\nExamples:\n  1.5 will be serialized as \"1500m\"\n  1.5Gi will be serialized as \"1536Mi\"\n\nNote that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.\n\nNon-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)\n\nThis format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.",
+      "type": "string"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": {
+      "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:<name>', where <name> is the name of a field in a struct, or key in a map 'v:<value>', where <value> is the exact json formatted value of a list item 'i:<index>', where <index> is position of a item in a list 'k:<keys>', where <keys> is a map of  a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff",
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector": {
+      "description": "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.",
+      "properties": {
+        "matchExpressions": {
+          "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement"
+          },
+          "type": "array"
+        },
+        "matchLabels": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+          "type": "object"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement": {
+      "description": "A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
+      "properties": {
+        "key": {
+          "description": "key is the label key that the selector applies to.",
+          "type": "string",
+          "x-kubernetes-patch-merge-key": "key",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "operator": {
+          "description": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.",
+          "type": "string"
+        },
+        "values": {
+          "description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "key",
+        "operator"
+      ],
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.ListMeta": {
+      "description": "ListMeta describes metadata that synthetic resources must have, including lists and various status objects. A resource may have only one of {ObjectMeta, ListMeta}.",
+      "properties": {
+        "continue": {
+          "description": "continue may be set if the user set a limit on the number of items returned, and indicates that the server has more data available. The value is opaque and may be used to issue another request to the endpoint that served this list to retrieve the next set of available objects. Continuing a consistent list may not be possible if the server configuration has changed or more than a few minutes have passed. The resourceVersion field returned when using this continue value will be identical to the value in the first response, unless you have received this token from an error message.",
+          "type": "string"
+        },
+        "remainingItemCount": {
+          "description": "remainingItemCount is the number of subsequent items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the field will be left unset and omitted during serialization. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and this field will be left unset and omitted during serialization. Servers older than v1.15 do not set this field. The intended use of the remainingItemCount is *estimating* the size of a collection. Clients should not rely on the remainingItemCount to be set or to be exact.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "resourceVersion": {
+          "description": "String that identifies the server's internal version of this object that can be used by clients to determine when objects have changed. Value must be treated as opaque by clients and passed unmodified back to the server. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency",
+          "type": "string"
+        },
+        "selfLink": {
+          "description": "selfLink is a URL representing this object. Populated by the system. Read-only.\n\nDEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": {
+      "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.",
+          "type": "string"
+        },
+        "fieldsType": {
+          "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"",
+          "type": "string"
+        },
+        "fieldsV1": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1",
+          "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type."
+        },
+        "manager": {
+          "description": "Manager is an identifier of the workflow managing these fields.",
+          "type": "string"
+        },
+        "operation": {
+          "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.",
+          "type": "string"
+        },
+        "time": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Time is timestamp of when these fields were set. It should always be empty if Operation is 'Apply'"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": {
+      "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.",
+      "properties": {
+        "annotations": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations",
+          "type": "object"
+        },
+        "clusterName": {
+          "description": "The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.",
+          "type": "string"
+        },
+        "creationTimestamp": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata"
+        },
+        "deletionGracePeriodSeconds": {
+          "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "deletionTimestamp": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata"
+        },
+        "finalizers": {
+          "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order.  Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "generateName": {
+          "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency",
+          "type": "string"
+        },
+        "generation": {
+          "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "labels": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels",
+          "type": "object"
+        },
+        "managedFields": {
+          "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry"
+          },
+          "type": "array"
+        },
+        "name": {
+          "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names",
+          "type": "string"
+        },
+        "namespace": {
+          "description": "Namespace defines the space within each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces",
+          "type": "string"
+        },
+        "ownerReferences": {
+          "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "uid",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "resourceVersion": {
+          "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency",
+          "type": "string"
+        },
+        "selfLink": {
+          "description": "SelfLink is a URL representing this object. Populated by the system. Read-only.\n\nDEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release.",
+          "type": "string"
+        },
+        "uid": {
+          "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": {
+      "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.",
+      "properties": {
+        "apiVersion": {
+          "description": "API version of the referent.",
+          "type": "string"
+        },
+        "blockOwnerDeletion": {
+          "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.",
+          "type": "boolean"
+        },
+        "controller": {
+          "description": "If true, this reference points to the managing controller.",
+          "type": "boolean"
+        },
+        "kind": {
+          "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names",
+          "type": "string"
+        },
+        "uid": {
+          "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids",
+          "type": "string"
+        }
+      },
+      "required": [
+        "apiVersion",
+        "kind",
+        "name",
+        "uid"
+      ],
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.Time": {
+      "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON.  Wrappers are provided for many of the factory methods that the time package offers.",
+      "format": "date-time",
+      "type": "string"
+    },
+    "io.k8s.apimachinery.pkg.util.intstr.IntOrString": {
+      "description": "IntOrString is a type that can hold an int32 or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a name or number.",
+      "format": "int-or-string",
+      "type": "string"
+    }
+  },
+  "info": {
+    "title": "Kubernetes",
+    "version": "test"
+  },
+  "paths": {
+  },
+  "swagger": "2.0"
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/testing/testfieldmanager.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/testing/testfieldmanager.go
new file mode 100644
index 0000000000..07558232ab
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/testing/testfieldmanager.go
@@ -0,0 +1,167 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"errors"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+)
+
+// FakeObjectCreater implements ObjectCreater, it can create empty
+// objects (unstructured) of the given GVK.
+type FakeObjectCreater struct{}
+
+func (f *FakeObjectCreater) New(gvk schema.GroupVersionKind) (runtime.Object, error) {
+	u := unstructured.Unstructured{Object: map[string]interface{}{}}
+	u.SetAPIVersion(gvk.GroupVersion().String())
+	u.SetKind(gvk.Kind)
+	return &u, nil
+}
+
+// FakeObjectConvertor implements runtime.ObjectConvertor but it
+// actually does nothing but return its input.
+type FakeObjectConvertor struct{}
+
+//nolint:staticcheck,ineffassign // SA4009 backwards compatibility
+func (c *FakeObjectConvertor) Convert(in, out, context interface{}) error {
+	out = in
+	return nil
+}
+
+func (c *FakeObjectConvertor) ConvertToVersion(in runtime.Object, _ runtime.GroupVersioner) (runtime.Object, error) {
+	return in, nil
+}
+
+func (c *FakeObjectConvertor) ConvertFieldLabel(_ schema.GroupVersionKind, _, _ string) (string, string, error) {
+	return "", "", errors.New("not implemented")
+}
+
+// FakeObjectDefaulter implements runtime.Defaulter, but it actually
+// does nothing.
+type FakeObjectDefaulter struct{}
+
+func (d *FakeObjectDefaulter) Default(in runtime.Object) {}
+
+type TestFieldManagerImpl struct {
+	fieldManager *internal.FieldManager
+	apiVersion   string
+	emptyObj     runtime.Object
+	liveObj      runtime.Object
+}
+
+// APIVersion of the object that we're tracking.
+func (f *TestFieldManagerImpl) APIVersion() string {
+	return f.apiVersion
+}
+
+// Reset resets the state of the liveObject by resetting it to an empty object.
+func (f *TestFieldManagerImpl) Reset() {
+	f.liveObj = f.emptyObj.DeepCopyObject()
+}
+
+// Live returns a copy of the current liveObject.
+func (f *TestFieldManagerImpl) Live() runtime.Object {
+	return f.liveObj.DeepCopyObject()
+}
+
+// Apply applies the given object on top of the current liveObj, for the
+// given manager and force flag.
+func (f *TestFieldManagerImpl) Apply(obj runtime.Object, manager string, force bool) error {
+	out, err := f.fieldManager.Apply(f.liveObj, obj, manager, force)
+	if err == nil {
+		f.liveObj = out
+	}
+	return err
+}
+
+// Update will updates the managed fields in the liveObj based on the
+// changes performed by the update.
+func (f *TestFieldManagerImpl) Update(obj runtime.Object, manager string) error {
+	out, err := f.fieldManager.Update(f.liveObj, obj, manager)
+	if err == nil {
+		f.liveObj = out
+	}
+	return err
+}
+
+// UpdateNoErrors is the same as Update, but it will not return errors.
+func (f *TestFieldManagerImpl) UpdateNoErrors(obj runtime.Object, manager string) {
+	f.liveObj = f.fieldManager.UpdateNoErrors(f.liveObj, obj, manager)
+}
+
+// ManagedFields returns the list of existing managed fields for the
+// liveObj.
+func (f *TestFieldManagerImpl) ManagedFields() []metav1.ManagedFieldsEntry {
+	accessor, err := meta.Accessor(f.liveObj)
+	if err != nil {
+		panic(fmt.Errorf("couldn't get accessor: %v", err))
+	}
+
+	return accessor.GetManagedFields()
+}
+
+// NewTestFieldManager creates a new manager for the given GVK.
+func NewTestFieldManagerImpl(typeConverter managedfields.TypeConverter, gvk schema.GroupVersionKind, subresource string, chainFieldManager func(internal.Manager) internal.Manager) *TestFieldManagerImpl {
+	f, err := internal.NewStructuredMergeManager(
+		typeConverter,
+		&FakeObjectConvertor{},
+		&FakeObjectDefaulter{},
+		gvk.GroupVersion(),
+		gvk.GroupVersion(),
+		nil,
+	)
+	if err != nil {
+		panic(err)
+	}
+	live := &unstructured.Unstructured{}
+	live.SetKind(gvk.Kind)
+	live.SetAPIVersion(gvk.GroupVersion().String())
+	// This is different from `internal.NewDefaultFieldManager` because:
+	// 1. We don't want to create a `internal.FieldManager`
+	// 2. We don't want to use the CapManager that is tested separately with
+	// a smaller than the default cap.
+	f = internal.NewVersionCheckManager(
+		internal.NewLastAppliedUpdater(
+			internal.NewLastAppliedManager(
+				internal.NewProbabilisticSkipNonAppliedManager(
+					internal.NewBuildManagerInfoManager(
+						internal.NewManagedFieldsUpdater(
+							internal.NewStripMetaManager(f),
+						), gvk.GroupVersion(), subresource,
+					), &FakeObjectCreater{}, internal.DefaultTrackOnCreateProbability,
+				), typeConverter, &FakeObjectConvertor{}, gvk.GroupVersion(),
+			),
+		), gvk,
+	)
+	if chainFieldManager != nil {
+		f = chainFieldManager(f)
+	}
+	return &TestFieldManagerImpl{
+		fieldManager: internal.NewFieldManager(f, subresource),
+		apiVersion:   gvk.GroupVersion().String(),
+		emptyObj:     live,
+		liveObj:      live.DeepCopyObject(),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter.go
new file mode 100644
index 0000000000..40cc90da78
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter.go
@@ -0,0 +1,211 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kube-openapi/pkg/schemaconv"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+	smdschema "sigs.k8s.io/structured-merge-diff/v6/schema"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+	"sigs.k8s.io/structured-merge-diff/v6/value"
+)
+
+// TypeConverter allows you to convert from runtime.Object to
+// typed.TypedValue and the other way around.
+type TypeConverter interface {
+	ObjectToTyped(runtime.Object, ...typed.ValidationOptions) (*typed.TypedValue, error)
+	TypedToObject(*typed.TypedValue) (runtime.Object, error)
+}
+
+type typeConverter struct {
+	parser map[schema.GroupVersionKind]*typed.ParseableType
+}
+
+var _ TypeConverter = &typeConverter{}
+
+func NewTypeConverter(openapiSpec map[string]*spec.Schema, preserveUnknownFields bool) (TypeConverter, error) {
+	typeSchema, err := schemaconv.ToSchemaFromOpenAPI(openapiSpec, preserveUnknownFields)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert models to schema: %v", err)
+	}
+
+	typeParser := typed.Parser{Schema: smdschema.Schema{Types: typeSchema.Types}}
+	tr := indexModels(&typeParser, openapiSpec)
+
+	return &typeConverter{parser: tr}, nil
+}
+
+func (c *typeConverter) ObjectToTyped(obj runtime.Object, opts ...typed.ValidationOptions) (*typed.TypedValue, error) {
+	gvk := obj.GetObjectKind().GroupVersionKind()
+	t := c.parser[gvk]
+	if t == nil {
+		return nil, NewNoCorrespondingTypeError(gvk)
+	}
+	switch o := obj.(type) {
+	case *unstructured.Unstructured:
+		return t.FromUnstructured(o.UnstructuredContent(), opts...)
+	default:
+		return t.FromStructured(obj, opts...)
+	}
+}
+
+func (c *typeConverter) TypedToObject(value *typed.TypedValue) (runtime.Object, error) {
+	return valueToObject(value.AsValue())
+}
+
+type deducedTypeConverter struct{}
+
+// DeducedTypeConverter is a TypeConverter for CRDs that don't have a
+// schema. It does implement the same interface though (and create the
+// same types of objects), so that everything can still work the same.
+// CRDs are merged with all their fields being "atomic" (lists
+// included).
+func NewDeducedTypeConverter() TypeConverter {
+	return deducedTypeConverter{}
+}
+
+// ObjectToTyped converts an object into a TypedValue with a "deduced type".
+func (deducedTypeConverter) ObjectToTyped(obj runtime.Object, opts ...typed.ValidationOptions) (*typed.TypedValue, error) {
+	switch o := obj.(type) {
+	case *unstructured.Unstructured:
+		return typed.DeducedParseableType.FromUnstructured(o.UnstructuredContent(), opts...)
+	default:
+		return typed.DeducedParseableType.FromStructured(obj, opts...)
+	}
+}
+
+// TypedToObject transforms the typed value into a runtime.Object. That
+// is not specific to deduced type.
+func (deducedTypeConverter) TypedToObject(value *typed.TypedValue) (runtime.Object, error) {
+	return valueToObject(value.AsValue())
+}
+
+func valueToObject(val value.Value) (runtime.Object, error) {
+	vu := val.Unstructured()
+	switch o := vu.(type) {
+	case map[string]interface{}:
+		return &unstructured.Unstructured{Object: o}, nil
+	default:
+		return nil, fmt.Errorf("failed to convert value to unstructured for type %T", vu)
+	}
+}
+
+// GroupVersionOfTypedValue returns the extracted GroupVersion from the TypeMeta
+// fields of a TypedValue, or return false if no TypeMeta fields are found.
+func GroupVersionOfTypedValue(object *typed.TypedValue) (schema.GroupVersion, bool) {
+	val := object.AsValue()
+	if val == nil || !val.IsMap() {
+		return schema.GroupVersion{}, false
+	}
+	apiVersion, ok := val.AsMap().Get("apiVersion")
+	if !ok || !apiVersion.IsString() {
+		return schema.GroupVersion{}, false
+	}
+	groupVersion, err := schema.ParseGroupVersion(apiVersion.AsString())
+	if err != nil {
+		return schema.GroupVersion{}, false
+	}
+	return groupVersion, true
+}
+
+func indexModels(
+	typeParser *typed.Parser,
+	openAPISchemas map[string]*spec.Schema,
+) map[schema.GroupVersionKind]*typed.ParseableType {
+	tr := map[schema.GroupVersionKind]*typed.ParseableType{}
+	for modelName, model := range openAPISchemas {
+		gvkList := parseGroupVersionKind(model.Extensions)
+		if len(gvkList) == 0 {
+			continue
+		}
+
+		parsedType := typeParser.Type(modelName)
+		for _, gvk := range gvkList {
+			if len(gvk.Kind) > 0 {
+				tr[schema.GroupVersionKind(gvk)] = &parsedType
+			}
+		}
+	}
+	return tr
+}
+
+// Get and parse GroupVersionKind from the extension. Returns empty if it doesn't have one.
+func parseGroupVersionKind(extensions map[string]interface{}) []schema.GroupVersionKind {
+	gvkListResult := []schema.GroupVersionKind{}
+
+	// Get the extensions
+	gvkExtension, ok := extensions["x-kubernetes-group-version-kind"]
+	if !ok {
+		return []schema.GroupVersionKind{}
+	}
+
+	// gvk extension must be a list of at least 1 element.
+	gvkList, ok := gvkExtension.([]interface{})
+	if !ok {
+		return []schema.GroupVersionKind{}
+	}
+
+	for _, gvk := range gvkList {
+		var group, version, kind string
+
+		// gvk extension list must be a map with group, version, and
+		// kind fields
+		if gvkMap, ok := gvk.(map[interface{}]interface{}); ok {
+			group, ok = gvkMap["group"].(string)
+			if !ok {
+				continue
+			}
+			version, ok = gvkMap["version"].(string)
+			if !ok {
+				continue
+			}
+			kind, ok = gvkMap["kind"].(string)
+			if !ok {
+				continue
+			}
+
+		} else if gvkMap, ok := gvk.(map[string]interface{}); ok {
+			group, ok = gvkMap["group"].(string)
+			if !ok {
+				continue
+			}
+			version, ok = gvkMap["version"].(string)
+			if !ok {
+				continue
+			}
+			kind, ok = gvkMap["kind"].(string)
+			if !ok {
+				continue
+			}
+		} else {
+			continue
+		}
+
+		gvkListResult = append(gvkListResult, schema.GroupVersionKind{
+			Group:   group,
+			Version: version,
+			Kind:    kind,
+		})
+	}
+
+	return gvkListResult
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter_test.go
new file mode 100644
index 0000000000..e1094bf5f8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter_test.go
@@ -0,0 +1,317 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	smdschema "sigs.k8s.io/structured-merge-diff/v6/schema"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+	"sigs.k8s.io/yaml"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+)
+
+func TestTypeConverter(t *testing.T) {
+	dtc := NewDeducedTypeConverter()
+
+	testCases := []struct {
+		name string
+		yaml string
+	}{
+		{
+			name: "apps/v1.Deployment",
+			yaml: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+  labels:
+    app: nginx
+spec:
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.15.4
+`,
+		}, {
+			name: "extensions/v1beta1.Deployment",
+			yaml: `
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+  labels:
+    app: nginx
+spec:
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.15.4
+`,
+		}, {
+			name: "v1.Pod",
+			yaml: `
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-pod
+  labels:
+    app: nginx
+spec:
+  containers:
+  - name: nginx
+    image: nginx:1.15.4
+`,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(fmt.Sprintf("%v ObjectToTyped with TypeConverter", testCase.name), func(t *testing.T) {
+			testObjectToTyped(t, testTypeConverter, testCase.yaml)
+		})
+		t.Run(fmt.Sprintf("%v ObjectToTyped with DeducedTypeConverter", testCase.name), func(t *testing.T) {
+			testObjectToTyped(t, dtc, testCase.yaml)
+		})
+	}
+}
+
+func testObjectToTyped(t *testing.T, tc TypeConverter, y string) {
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(y), &obj.Object); err != nil {
+		t.Fatalf("Failed to parse yaml object: %v", err)
+	}
+	typed, err := tc.ObjectToTyped(obj)
+	if err != nil {
+		t.Fatalf("Failed to convert object to typed: %v", err)
+	}
+	newObj, err := tc.TypedToObject(typed)
+	if err != nil {
+		t.Fatalf("Failed to convert typed to object: %v", err)
+	}
+	if !reflect.DeepEqual(obj, newObj) {
+		t.Errorf(`Round-trip failed:
+Original object:
+%#v
+Final object:
+%#v`, obj, newObj)
+	}
+}
+
+var result typed.TypedValue
+
+func BenchmarkObjectToTyped(b *testing.B) {
+	y := `
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+  labels:
+    app: nginx
+spec:
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.15.4
+`
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(y), &obj.Object); err != nil {
+		b.Fatalf("Failed to parse yaml object: %v", err)
+	}
+
+	b.ResetTimer()
+	b.ReportAllocs()
+
+	var r *typed.TypedValue
+	for i := 0; i < b.N; i++ {
+		var err error
+		r, err = testTypeConverter.ObjectToTyped(obj)
+		if err != nil {
+			b.Fatalf("Failed to convert object to typed: %v", err)
+		}
+	}
+	result = *r
+}
+
+func TestIndexModels(t *testing.T) {
+	myDefs := map[string]*spec.Schema{
+		// Show empty GVK extension is ignored
+		"def0": {
+			VendorExtensible: spec.VendorExtensible{
+				Extensions: spec.Extensions{
+					"x-kubernetes-group-version-kind": []interface{}{},
+				},
+			},
+		},
+		// Show nil GVK is ignored
+		"def0.0": {
+			VendorExtensible: spec.VendorExtensible{
+				Extensions: spec.Extensions{
+					"x-kubernetes-group-version-kind": nil,
+				},
+			},
+		},
+		// Show this is ignored
+		"def0.1": {},
+		// Show allows binding a single GVK
+		"def1": {
+			VendorExtensible: spec.VendorExtensible{
+				Extensions: spec.Extensions{
+					"x-kubernetes-group-version-kind": []interface{}{
+						map[string]interface{}{
+							"group":   "mygroup",
+							"version": "v1",
+							"kind":    "MyKind",
+						},
+					},
+				},
+			},
+		},
+		// Show allows bindings with two versions
+		"def2": {
+			VendorExtensible: spec.VendorExtensible{
+				Extensions: spec.Extensions{
+					"x-kubernetes-group-version-kind": []interface{}{
+						map[string]interface{}{
+							"group":   "mygroup",
+							"version": "v1",
+							"kind":    "MyOtherKind",
+						},
+						map[string]interface{}{
+							"group":   "mygroup",
+							"version": "v2",
+							"kind":    "MyOtherKind",
+						},
+					},
+				},
+			},
+		},
+		// Show that we can mix and match GVKs from other definitions, and
+		// that both map[interface{}]interface{} and map[string]interface{}
+		// are allowed
+		"def3": {
+			VendorExtensible: spec.VendorExtensible{
+				Extensions: spec.Extensions{
+					"x-kubernetes-group-version-kind": []interface{}{
+						map[string]interface{}{
+							"group":   "mygroup",
+							"version": "v3",
+							"kind":    "MyKind",
+						},
+						map[interface{}]interface{}{
+							"group":   "mygroup",
+							"version": "v3",
+							"kind":    "MyOtherKind",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	myTypes := []smdschema.TypeDef{
+		{
+			Name: "def0",
+			Atom: smdschema.Atom{},
+		},
+		{
+			Name: "def0.1",
+			Atom: smdschema.Atom{},
+		},
+		{
+			Name: "def0.2",
+			Atom: smdschema.Atom{},
+		},
+		{
+			Name: "def1",
+			Atom: smdschema.Atom{},
+		},
+		{
+			Name: "def2",
+			Atom: smdschema.Atom{},
+		},
+		{
+			Name: "def3",
+			Atom: smdschema.Atom{},
+		},
+	}
+
+	parser := typed.Parser{Schema: smdschema.Schema{Types: myTypes}}
+	gvkIndex := indexModels(&parser, myDefs)
+
+	require.Len(t, gvkIndex, 5)
+
+	resultNames := map[schema.GroupVersionKind]string{}
+	for k, v := range gvkIndex {
+		require.NotNil(t, v.TypeRef.NamedType)
+		resultNames[k] = *v.TypeRef.NamedType
+	}
+
+	require.Equal(t, map[schema.GroupVersionKind]string{
+		{
+			Group:   "mygroup",
+			Version: "v1",
+			Kind:    "MyKind",
+		}: "def1",
+		{
+			Group:   "mygroup",
+			Version: "v1",
+			Kind:    "MyOtherKind",
+		}: "def2",
+		{
+			Group:   "mygroup",
+			Version: "v2",
+			Kind:    "MyOtherKind",
+		}: "def2",
+		{
+			Group:   "mygroup",
+			Version: "v3",
+			Kind:    "MyKind",
+		}: "def3",
+		{
+			Group:   "mygroup",
+			Version: "v3",
+			Kind:    "MyOtherKind",
+		}: "def3",
+	}, resultNames)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versioncheck.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versioncheck.go
new file mode 100644
index 0000000000..ee1e2bca70
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versioncheck.go
@@ -0,0 +1,52 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type versionCheckManager struct {
+	fieldManager Manager
+	gvk          schema.GroupVersionKind
+}
+
+var _ Manager = &versionCheckManager{}
+
+// NewVersionCheckManager creates a manager that makes sure that the
+// applied object is in the proper version.
+func NewVersionCheckManager(fieldManager Manager, gvk schema.GroupVersionKind) Manager {
+	return &versionCheckManager{fieldManager: fieldManager, gvk: gvk}
+}
+
+// Update implements Manager.
+func (f *versionCheckManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	// Nothing to do for updates, this is checked in many other places.
+	return f.fieldManager.Update(liveObj, newObj, managed, manager)
+}
+
+// Apply implements Manager.
+func (f *versionCheckManager) Apply(liveObj, appliedObj runtime.Object, managed Managed, fieldManager string, force bool) (runtime.Object, Managed, error) {
+	if gvk := appliedObj.GetObjectKind().GroupVersionKind(); gvk != f.gvk {
+		return nil, nil, errors.NewBadRequest(fmt.Sprintf("invalid object type: %v", gvk))
+	}
+	return f.fieldManager.Apply(liveObj, appliedObj, managed, fieldManager, force)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter.go
new file mode 100644
index 0000000000..917bdcd75f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter.go
@@ -0,0 +1,122 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+)
+
+// versionConverter is an implementation of
+// sigs.k8s.io/structured-merge-diff/merge.Converter
+type versionConverter struct {
+	typeConverter   TypeConverter
+	objectConvertor runtime.ObjectConvertor
+	hubGetter       func(from schema.GroupVersion) schema.GroupVersion
+}
+
+var _ merge.Converter = &versionConverter{}
+
+// NewVersionConverter builds a VersionConverter from a TypeConverter and an ObjectConvertor.
+func newVersionConverter(t TypeConverter, o runtime.ObjectConvertor, h schema.GroupVersion) merge.Converter {
+	return &versionConverter{
+		typeConverter:   t,
+		objectConvertor: o,
+		hubGetter: func(from schema.GroupVersion) schema.GroupVersion {
+			return schema.GroupVersion{
+				Group:   from.Group,
+				Version: h.Version,
+			}
+		},
+	}
+}
+
+// NewCRDVersionConverter builds a VersionConverter for CRDs from a TypeConverter and an ObjectConvertor.
+func newCRDVersionConverter(t TypeConverter, o runtime.ObjectConvertor, h schema.GroupVersion) merge.Converter {
+	return &versionConverter{
+		typeConverter:   t,
+		objectConvertor: o,
+		hubGetter: func(from schema.GroupVersion) schema.GroupVersion {
+			return h
+		},
+	}
+}
+
+// Convert implements sigs.k8s.io/structured-merge-diff/merge.Converter
+func (v *versionConverter) Convert(object *typed.TypedValue, version fieldpath.APIVersion) (*typed.TypedValue, error) {
+	groupVersion, err := schema.ParseGroupVersion(string(version))
+	if err != nil {
+		return object, err
+	}
+
+	// If attempting to convert to the same version as we already have, just return it.
+	if typedVersion, ok := GroupVersionOfTypedValue(object); ok && typedVersion == groupVersion {
+		return object, nil
+	}
+
+	// Convert the smd typed value to a kubernetes object.
+	objectToConvert, err := v.typeConverter.TypedToObject(object)
+	if err != nil {
+		return object, err
+	}
+	fromVersion := objectToConvert.GetObjectKind().GroupVersionKind().GroupVersion()
+
+	// Convert to internal
+	internalObject, err := v.objectConvertor.ConvertToVersion(objectToConvert, v.hubGetter(fromVersion))
+	if err != nil {
+		return object, err
+	}
+
+	// Convert the object into the target version
+	convertedObject, err := v.objectConvertor.ConvertToVersion(internalObject, groupVersion)
+	if err != nil {
+		return object, err
+	}
+
+	// Convert the object back to a smd typed value and return it.
+	return v.typeConverter.ObjectToTyped(convertedObject)
+}
+
+// IsMissingVersionError
+func (v *versionConverter) IsMissingVersionError(err error) bool {
+	return runtime.IsNotRegisteredError(err) || isNoCorrespondingTypeError(err)
+}
+
+type noCorrespondingTypeErr struct {
+	gvk schema.GroupVersionKind
+}
+
+func NewNoCorrespondingTypeError(gvk schema.GroupVersionKind) error {
+	return &noCorrespondingTypeErr{gvk: gvk}
+}
+
+func (k *noCorrespondingTypeErr) Error() string {
+	return fmt.Sprintf("no corresponding type for %v", k.gvk)
+}
+
+func isNoCorrespondingTypeError(err error) bool {
+	if err == nil {
+		return false
+	}
+	_, ok := err.(*noCorrespondingTypeErr)
+	return ok
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter_bench_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter_bench_test.go
new file mode 100644
index 0000000000..d1dd65fe0f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter_bench_test.go
@@ -0,0 +1,197 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+)
+
+// benchDeployment is a structured (reflect-backed) object whose JSON shape is a
+// subset of the apps Deployment schema. Built-in types reach the version
+// converter as reflect-backed typed values, so the pre-fast-path Convert had to
+// deep-copy the whole object via TypedToObject just to read its apiVersion;
+// this type reproduces that cost.
+type benchDeployment struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+}
+
+func (d *benchDeployment) DeepCopyObject() runtime.Object {
+	out := &benchDeployment{TypeMeta: d.TypeMeta}
+	d.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	return out
+}
+
+// structuredDeployment returns a reflect-backed Deployment with n labels and n
+// annotations, exercising the built-in-type code path.
+func structuredDeployment(apiVersion string, n int) runtime.Object {
+	labels, annotations := metaMaps(n)
+	return &benchDeployment{
+		TypeMeta: metav1.TypeMeta{APIVersion: apiVersion, Kind: "Deployment"},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:        "nginx-deployment",
+			Namespace:   "default",
+			Labels:      labels,
+			Annotations: annotations,
+		},
+	}
+}
+
+// unstructuredDeployment returns a value-backed Deployment, exercising the CRD
+// code path (the typed value already holds a map, so TypedToObject is cheap).
+func unstructuredDeployment(apiVersion string, n int) runtime.Object {
+	labels, annotations := metaMaps(n)
+	return &unstructured.Unstructured{Object: map[string]interface{}{
+		"apiVersion": apiVersion,
+		"kind":       "Deployment",
+		"metadata": map[string]interface{}{
+			"name":        "nginx-deployment",
+			"namespace":   "default",
+			"labels":      toInterfaceMap(labels),
+			"annotations": toInterfaceMap(annotations),
+		},
+	}}
+}
+
+func metaMaps(n int) (labels, annotations map[string]string) {
+	labels = make(map[string]string, n)
+	annotations = make(map[string]string, n)
+	for i := range n {
+		labels[fmt.Sprintf("k8s.io/label-%d", i)] = fmt.Sprintf("value-%d", i)
+		annotations[fmt.Sprintf("k8s.io/annotation-%d", i)] = fmt.Sprintf("value-%d", i)
+	}
+	return labels, annotations
+}
+
+func toInterfaceMap(m map[string]string) map[string]interface{} {
+	out := make(map[string]interface{}, len(m))
+	for k, v := range m {
+		out[k] = v
+	}
+	return out
+}
+
+func benchVersionConverter() merge.Converter {
+	oc := fakeObjectConvertorForTestSchema{
+		gvkForVersion("v1beta1"): objForGroupVersion("apps/v1beta1"),
+		gvkForVersion("v1"):      objForGroupVersion("apps/v1"),
+	}
+	return newVersionConverter(testTypeConverter, oc, schema.GroupVersion{Group: "apps", Version: runtime.APIVersionInternal})
+}
+
+var benchBackings = []struct {
+	name  string
+	build func(apiVersion string, n int) runtime.Object
+}{
+	{"structured", structuredDeployment},
+	{"unstructured", unstructuredDeployment},
+}
+
+var benchConversions = []struct {
+	name    string
+	version fieldpath.APIVersion
+}{
+	{"same-version", "apps/v1beta1"},
+	{"cross-version", "apps/v1"},
+}
+
+var benchSizes = []int{0, 10, 100, 1000}
+
+// BenchmarkVersionConverter measures versionConverter.Convert across reflect-backed
+// (built-in) and value-backed (CRD) inputs, for the same-version (fast path) and
+// cross-version (fallback) cases, over a range of object sizes.
+func BenchmarkVersionConverter(b *testing.B) {
+	vc := benchVersionConverter()
+	for _, backing := range benchBackings {
+		for _, conv := range benchConversions {
+			for _, n := range benchSizes {
+				input, err := testTypeConverter.ObjectToTyped(backing.build("apps/v1beta1", n))
+				if err != nil {
+					b.Fatalf("ObjectToTyped(%s, fields=%d): %v", backing.name, n, err)
+				}
+				b.Run(fmt.Sprintf("%s/%s/fields=%d", backing.name, conv.name, n), func(b *testing.B) {
+					b.ReportAllocs()
+					b.ResetTimer()
+					for i := 0; i < b.N; i++ {
+						if _, err := vc.Convert(input, conv.version); err != nil {
+							b.Fatalf("Convert: %v", err)
+						}
+					}
+				})
+			}
+		}
+	}
+}
+
+// TestBenchmarkFastPathEngages guards the benchmark: it confirms the same-version
+// case takes the fast path (no TypedToObject / ConvertToVersion) for both
+// reflect-backed and value-backed inputs, and that the cross-version case does
+// not, so the before/after comparison measures the intended code paths.
+func TestBenchmarkFastPathEngages(t *testing.T) {
+	for _, backing := range benchBackings {
+		t.Run(backing.name, func(t *testing.T) {
+			input, err := testTypeConverter.ObjectToTyped(backing.build("apps/v1beta1", 10))
+			if err != nil {
+				t.Fatalf("ObjectToTyped: %v", err)
+			}
+
+			// Same version: fast path, no materialization or conversion.
+			tc := &countingTypeConverter{TypeConverter: testTypeConverter}
+			oc := &countingObjectConvertor{ObjectConvertor: benchObjectConvertor()}
+			vc := newVersionConverter(tc, oc, schema.GroupVersion{Group: "apps", Version: runtime.APIVersionInternal})
+			out, err := vc.Convert(input, fieldpath.APIVersion("apps/v1beta1"))
+			if err != nil {
+				t.Fatalf("Convert same-version: %v", err)
+			}
+			if out != input {
+				t.Errorf("same-version Convert should return input unchanged")
+			}
+			if tc.typedToObjectCalls != 0 {
+				t.Errorf("same-version Convert called TypedToObject %d times, want 0", tc.typedToObjectCalls)
+			}
+			if oc.convertToVersionCalls != 0 {
+				t.Errorf("same-version Convert called ConvertToVersion %d times, want 0", oc.convertToVersionCalls)
+			}
+
+			// Cross version: fallback path materializes the object.
+			tc = &countingTypeConverter{TypeConverter: testTypeConverter}
+			oc = &countingObjectConvertor{ObjectConvertor: benchObjectConvertor()}
+			vc = newVersionConverter(tc, oc, schema.GroupVersion{Group: "apps", Version: runtime.APIVersionInternal})
+			if _, err := vc.Convert(input, fieldpath.APIVersion("apps/v1")); err != nil {
+				t.Fatalf("Convert cross-version: %v", err)
+			}
+			if tc.typedToObjectCalls == 0 {
+				t.Errorf("cross-version Convert should call TypedToObject")
+			}
+		})
+	}
+}
+
+func benchObjectConvertor() fakeObjectConvertorForTestSchema {
+	return fakeObjectConvertorForTestSchema{
+		gvkForVersion("v1beta1"): objForGroupVersion("apps/v1beta1"),
+		gvkForVersion("v1"):      objForGroupVersion("apps/v1"),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter_test.go
new file mode 100644
index 0000000000..ced691d158
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter_test.go
@@ -0,0 +1,164 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+)
+
+var testTypeConverter = func() TypeConverter {
+	data, err := os.ReadFile(filepath.Join("testdata", "swagger.json"))
+	if err != nil {
+		panic(err)
+	}
+	swag := spec.Swagger{}
+	if err := json.Unmarshal(data, &swag); err != nil {
+		panic(err)
+	}
+
+	convertedDefs := map[string]*spec.Schema{}
+	for k, v := range swag.Definitions {
+		vCopy := v
+		convertedDefs[k] = &vCopy
+	}
+	typeConverter, err := NewTypeConverter(convertedDefs, false)
+	if err != nil {
+		panic(err)
+	}
+	return typeConverter
+}()
+
+// TestVersionConverter tests the version converter
+func TestVersionConverter(t *testing.T) {
+	oc := fakeObjectConvertorForTestSchema{
+		gvkForVersion("v1beta1"): objForGroupVersion("apps/v1beta1"),
+		gvkForVersion("v1"):      objForGroupVersion("apps/v1"),
+	}
+	vc := newVersionConverter(testTypeConverter, oc, schema.GroupVersion{Group: "apps", Version: runtime.APIVersionInternal})
+
+	input, err := testTypeConverter.ObjectToTyped(objForGroupVersion("apps/v1beta1"))
+	if err != nil {
+		t.Fatalf("error creating converting input object to a typed value: %v", err)
+	}
+	expected := objForGroupVersion("apps/v1")
+	output, err := vc.Convert(input, fieldpath.APIVersion("apps/v1"))
+	if err != nil {
+		t.Fatalf("expected err to be nil but got %v", err)
+	}
+	actual, err := testTypeConverter.TypedToObject(output)
+	if err != nil {
+		t.Fatalf("error converting output typed value to an object %v", err)
+	}
+
+	if !reflect.DeepEqual(expected, actual) {
+		t.Fatalf("expected to get %v but got %v", expected, actual)
+	}
+}
+
+func TestVersionConverterSameVersion(t *testing.T) {
+	tc := &countingTypeConverter{TypeConverter: testTypeConverter}
+	oc := &countingObjectConvertor{ObjectConvertor: fakeObjectConvertorForTestSchema{}}
+	vc := newVersionConverter(tc, oc, schema.GroupVersion{Group: "apps", Version: runtime.APIVersionInternal})
+
+	input, err := testTypeConverter.ObjectToTyped(objForGroupVersion("apps/v1beta1"))
+	if err != nil {
+		t.Fatalf("error converting input object to a typed value: %v", err)
+	}
+	output, err := vc.Convert(input, fieldpath.APIVersion("apps/v1beta1"))
+	if err != nil {
+		t.Fatalf("expected err to be nil but got %v", err)
+	}
+	if output != input {
+		t.Errorf("expected same-version conversion to return the input unchanged")
+	}
+	if tc.typedToObjectCalls != 0 {
+		t.Errorf("expected no TypedToObject calls for same-version conversion, got %d", tc.typedToObjectCalls)
+	}
+	if oc.convertToVersionCalls != 0 {
+		t.Errorf("expected no ConvertToVersion calls for same-version conversion, got %d", oc.convertToVersionCalls)
+	}
+}
+
+type countingTypeConverter struct {
+	TypeConverter
+	typedToObjectCalls int
+}
+
+func (c *countingTypeConverter) TypedToObject(value *typed.TypedValue) (runtime.Object, error) {
+	c.typedToObjectCalls++
+	return c.TypeConverter.TypedToObject(value)
+}
+
+type countingObjectConvertor struct {
+	runtime.ObjectConvertor
+	convertToVersionCalls int
+}
+
+func (c *countingObjectConvertor) ConvertToVersion(in runtime.Object, gv runtime.GroupVersioner) (runtime.Object, error) {
+	c.convertToVersionCalls++
+	return c.ObjectConvertor.ConvertToVersion(in, gv)
+}
+
+func gvkForVersion(v string) schema.GroupVersionKind {
+	return schema.GroupVersionKind{
+		Group:   "apps",
+		Version: v,
+		Kind:    "Deployment",
+	}
+}
+
+func objForGroupVersion(gv string) runtime.Object {
+	return &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": gv,
+			"kind":       "Deployment",
+		},
+	}
+}
+
+type fakeObjectConvertorForTestSchema map[schema.GroupVersionKind]runtime.Object
+
+var _ runtime.ObjectConvertor = fakeObjectConvertorForTestSchema{}
+
+func (c fakeObjectConvertorForTestSchema) ConvertToVersion(_ runtime.Object, gv runtime.GroupVersioner) (runtime.Object, error) {
+	allKinds := make([]schema.GroupVersionKind, 0)
+	for kind := range c {
+		allKinds = append(allKinds, kind)
+	}
+	gvk, _ := gv.KindForGroupVersionKinds(allKinds)
+	return c[gvk], nil
+}
+
+func (fakeObjectConvertorForTestSchema) Convert(_, _, _ interface{}) error {
+	return fmt.Errorf("function not implemented")
+}
+
+func (fakeObjectConvertorForTestSchema) ConvertFieldLabel(_ schema.GroupVersionKind, _, _ string) (string, string, error) {
+	return "", "", fmt.Errorf("function not implemented")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/managedfieldstest/testfieldmanager.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/managedfieldstest/testfieldmanager.go
new file mode 100644
index 0000000000..afa7b06df9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/managedfieldstest/testfieldmanager.go
@@ -0,0 +1,94 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfieldstest
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal/testing"
+)
+
+// TestFieldManager is a FieldManager that can be used in test to
+// simulate the behavior of Server-Side Apply and field tracking. This
+// also has a few methods to get a sense of the state of the object.
+//
+// This TestFieldManager uses a series of "fake" objects to simulate
+// some behavior which come with the limitation that you can only use
+// one version since there is no version conversion logic.
+//
+// You can use this rather than NewDefaultTestFieldManager if you want
+// to specify either a sub-resource, or a set of modified Manager to
+// test them specifically.
+type TestFieldManager interface {
+	// APIVersion of the object that we're tracking.
+	APIVersion() string
+	// Reset resets the state of the liveObject by resetting it to an empty object.
+	Reset()
+	// Live returns a copy of the current liveObject.
+	Live() runtime.Object
+	// Apply applies the given object on top of the current liveObj, for the
+	// given manager and force flag.
+	Apply(obj runtime.Object, manager string, force bool) error
+	// Update will updates the managed fields in the liveObj based on the
+	// changes performed by the update.
+	Update(obj runtime.Object, manager string) error
+	// ManagedFields returns the list of existing managed fields for the
+	// liveObj.
+	ManagedFields() []metav1.ManagedFieldsEntry
+}
+
+// NewTestFieldManager returns a new TestFieldManager built for the
+// given gvk, on the main resource.
+func NewTestFieldManager(typeConverter managedfields.TypeConverter, gvk schema.GroupVersionKind) TestFieldManager {
+	return testing.NewTestFieldManagerImpl(typeConverter, gvk, "", nil)
+}
+
+// NewTestFieldManagerSubresource returns a new TestFieldManager built
+// for the given gvk, on the given sub-resource.
+func NewTestFieldManagerSubresource(typeConverter managedfields.TypeConverter, gvk schema.GroupVersionKind, subresource string) TestFieldManager {
+	return testing.NewTestFieldManagerImpl(typeConverter, gvk, subresource, nil)
+
+}
+
+// NewFakeFieldManager creates an actual FieldManager but that doesn't
+// perform any conversion. This is just a convenience for tests to
+// create an actual manager that they can use but in very restricted
+// ways.
+//
+// This is different from the TestFieldManager because it's not meant to
+// assert values, or hold the state, this acts like a normal
+// FieldManager.
+//
+// Also, this only operates on the main-resource, and sub-resource can't
+// be configured.
+func NewFakeFieldManager(typeConverter managedfields.TypeConverter, gvk schema.GroupVersionKind) *managedfields.FieldManager {
+	ffm, err := managedfields.NewDefaultFieldManager(
+		typeConverter,
+		&testing.FakeObjectConvertor{},
+		&testing.FakeObjectDefaulter{},
+		&testing.FakeObjectCreater{},
+		gvk,
+		gvk.GroupVersion(),
+		"",
+		nil)
+	if err != nil {
+		panic(err)
+	}
+	return ffm
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/node.yaml b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/node.yaml
new file mode 100644
index 0000000000..a7f2d54fdf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/node.yaml
@@ -0,0 +1,261 @@
+apiVersion: v1
+kind: Node
+metadata:
+  annotations:
+    container.googleapis.com/instance_id: "123456789321654789"
+    node.alpha.kubernetes.io/ttl: "0"
+    volumes.kubernetes.io/controller-managed-attach-detach: "true"
+  creationTimestamp: "2019-07-09T16:17:29Z"
+  labels:
+    kubernetes.io/arch: amd64
+    beta.kubernetes.io/fluentd-ds-ready: "true"
+    beta.kubernetes.io/instance-type: n1-standard-4
+    kubernetes.io/os: linux
+    cloud.google.com/gke-nodepool: default-pool
+    cloud.google.com/gke-os-distribution: cos
+    failure-domain.beta.kubernetes.io/region: us-central1
+    failure-domain.beta.kubernetes.io/zone: us-central1-b
+    topology.kubernetes.io/region: us-central1
+    topology.kubernetes.io/zone: us-central1-b
+    kubernetes.io/hostname: node-default-pool-something
+  name: node-default-pool-something
+  resourceVersion: "211582541"
+  selfLink: /api/v1/nodes/node-default-pool-something
+  uid: 0c24d0e1-a265-11e9-abe4-42010a80026b
+spec:
+  podCIDR: 10.0.0.1/24
+  providerID: some-provider-id-of-some-sort
+status:
+  addresses:
+  - address: 10.0.0.1
+    type: InternalIP
+  - address: 192.168.0.1
+    type: ExternalIP
+  - address: node-default-pool-something
+    type: Hostname
+  allocatable:
+    cpu: 3920m
+    ephemeral-storage: "104638878617"
+    hugepages-2Mi: "0"
+    memory: 12700100Ki
+    pods: "110"
+  capacity:
+    cpu: "4"
+    ephemeral-storage: 202086868Ki
+    hugepages-2Mi: "0"
+    memory: 15399364Ki
+    pods: "110"
+  conditions:
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:22:08Z"
+    message: containerd is functioning properly
+    reason: FrequentContainerdRestart
+    status: "False"
+    type: FrequentContainerdRestart
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:22:06Z"
+    message: docker overlay2 is functioning properly
+    reason: CorruptDockerOverlay2
+    status: "False"
+    type: CorruptDockerOverlay2
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:22:06Z"
+    message: node is functioning properly
+    reason: UnregisterNetDevice
+    status: "False"
+    type: FrequentUnregisterNetDevice
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:17:04Z"
+    message: kernel has no deadlock
+    reason: KernelHasNoDeadlock
+    status: "False"
+    type: KernelDeadlock
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:17:04Z"
+    message: Filesystem is not read-only
+    reason: FilesystemIsNotReadOnly
+    status: "False"
+    type: ReadonlyFilesystem
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:22:05Z"
+    message: kubelet is functioning properly
+    reason: FrequentKubeletRestart
+    status: "False"
+    type: FrequentKubeletRestart
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:22:06Z"
+    message: docker is functioning properly
+    reason: FrequentDockerRestart
+    status: "False"
+    type: FrequentDockerRestart
+  - lastHeartbeatTime: "2019-07-09T16:17:47Z"
+    lastTransitionTime: "2019-07-09T16:17:47Z"
+    message: RouteController created a route
+    reason: RouteCreated
+    status: "False"
+    type: NetworkUnavailable
+  - lastHeartbeatTime: "2019-09-20T19:32:50Z"
+    lastTransitionTime: "2019-07-09T16:17:29Z"
+    message: kubelet has sufficient disk space available
+    reason: KubeletHasSufficientDisk
+    status: "False"
+    type: OutOfDisk
+  - lastHeartbeatTime: "2019-09-20T19:32:50Z"
+    lastTransitionTime: "2019-07-09T16:17:29Z"
+    message: kubelet has sufficient memory available
+    reason: KubeletHasSufficientMemory
+    status: "False"
+    type: MemoryPressure
+  - lastHeartbeatTime: "2019-09-20T19:32:50Z"
+    lastTransitionTime: "2019-07-09T16:17:29Z"
+    message: kubelet has no disk pressure
+    reason: KubeletHasNoDiskPressure
+    status: "False"
+    type: DiskPressure
+  - lastHeartbeatTime: "2019-09-20T19:32:50Z"
+    lastTransitionTime: "2019-07-09T16:17:29Z"
+    message: kubelet has sufficient PID available
+    reason: KubeletHasSufficientPID
+    status: "False"
+    type: PIDPressure
+  - lastHeartbeatTime: "2019-09-20T19:32:50Z"
+    lastTransitionTime: "2019-07-09T16:17:49Z"
+    message: kubelet is posting ready status
+    reason: KubeletReady
+    status: "True"
+    type: Ready
+  daemonEndpoints:
+    kubeletEndpoint:
+      Port: 10250
+  images:
+  - names:
+    - grafana/grafana@sha256:80e5e113a984d74836aa16f5b4524012099436b1a50df293f00ac6377fb512c8
+    - grafana/grafana:4.4.2
+    sizeBytes: 287008013
+  - names:
+    - registry.k8s.io/node-problem-detector@sha256:f95cab985c26b2f46e9bd43283e0bfa88860c14e0fb0649266babe8b65e9eb2b
+    - registry.k8s.io/node-problem-detector:v0.4.1
+    sizeBytes: 286572743
+  - names:
+    - grafana/grafana@sha256:7ff7f9b2501a5d55b55ce3f58d21771b1c5af1f2a4ab7dbf11bef7142aae7033
+    - grafana/grafana:4.2.0
+    sizeBytes: 277940263
+  - names:
+    - influxdb@sha256:7dddf03376348876ed4bdf33d6dfa3326f45a2bae0930dbd80781a374eb519bc
+    - influxdb:1.2.2
+    sizeBytes: 223948571
+  - names:
+    - gcr.io/stackdriver-agents/stackdriver-logging-agent@sha256:f8d5231b67b9c53f60068b535a11811d29d1b3efd53d2b79f2a2591ea338e4f2
+    - gcr.io/stackdriver-agents/stackdriver-logging-agent:0.6-1.6.0-1
+    sizeBytes: 223242132
+  - names:
+    - nginx@sha256:35779791c05d119df4fe476db8f47c0bee5943c83eba5656a15fc046db48178b
+    - nginx:1.10.1
+    sizeBytes: 180708613
+  - names:
+    - registry.k8s.io/fluentd-elasticsearch@sha256:b8c94527b489fb61d3d81ce5ad7f3ddbb7be71e9620a3a36e2bede2f2e487d73
+    - registry.k8s.io/fluentd-elasticsearch:v2.0.4
+    sizeBytes: 135716379
+  - names:
+    - nginx@sha256:00be67d6ba53d5318cd91c57771530f5251cfbe028b7be2c4b70526f988cfc9f
+    - nginx:latest
+    sizeBytes: 109357355
+  - names:
+    - registry.k8s.io/kubernetes-dashboard-amd64@sha256:dc4026c1b595435ef5527ca598e1e9c4343076926d7d62b365c44831395adbd0
+    - registry.k8s.io/kubernetes-dashboard-amd64:v1.8.3
+    sizeBytes: 102319441
+  - names:
+    - gcr.io/google_containers/kube-proxy:v1.11.10-gke.5
+    - registry.k8s.io/kube-proxy:v1.11.10-gke.5
+    sizeBytes: 102279340
+  - names:
+    - registry.k8s.io/event-exporter@sha256:7f9cd7cb04d6959b0aa960727d04fa86759008048c785397b7b0d9dff0007516
+    - registry.k8s.io/event-exporter:v0.2.3
+    sizeBytes: 94171943
+  - names:
+    - registry.k8s.io/prometheus-to-sd@sha256:6c0c742475363d537ff059136e5d5e4ab1f512ee0fd9b7ca42ea48bc309d1662
+    - registry.k8s.io/prometheus-to-sd:v0.3.1
+    sizeBytes: 88077694
+  - names:
+    - registry.k8s.io/fluentd-gcp-scaler@sha256:a5ace7506d393c4ed65eb2cbb6312c64ab357fcea16dff76b9055bc6e498e5ff
+    - registry.k8s.io/fluentd-gcp-scaler:0.5.1
+    sizeBytes: 86637208
+  - names:
+    - registry.k8s.io/heapster-amd64@sha256:9fae0af136ce0cf4f88393b3670f7139ffc464692060c374d2ae748e13144521
+    - registry.k8s.io/heapster-amd64:v1.6.0-beta.1
+    sizeBytes: 76016169
+  - names:
+    - registry.k8s.io/ingress-glbc-amd64@sha256:31d36bbd9c44caffa135fc78cf0737266fcf25e3cf0cd1c2fcbfbc4f7309cc52
+    - registry.k8s.io/ingress-glbc-amd64:v1.1.1
+    sizeBytes: 67801919
+  - names:
+    - registry.k8s.io/kube-addon-manager@sha256:d53486c3a0b49ebee019932878dc44232735d5622a51dbbdcec7124199020d09
+    - registry.k8s.io/kube-addon-manager:v8.7
+    sizeBytes: 63322109
+  - names:
+    - nginx@sha256:4aacdcf186934dcb02f642579314075910f1855590fd3039d8fa4c9f96e48315
+    - nginx:1.10-alpine
+    sizeBytes: 54042627
+  - names:
+    - registry.k8s.io/cpvpa-amd64@sha256:cfe7b0a11c9c8e18c87b1eb34fef9a7cbb8480a8da11fc2657f78dbf4739f869
+    - registry.k8s.io/cpvpa-amd64:v0.6.0
+    sizeBytes: 51785854
+  - names:
+    - registry.k8s.io/cluster-proportional-autoscaler-amd64@sha256:003f98d9f411ddfa6ff6d539196355e03ddd69fa4ed38c7ffb8fec6f729afe2d
+    - registry.k8s.io/cluster-proportional-autoscaler-amd64:1.1.2-r2
+    sizeBytes: 49648481
+  - names:
+    - registry.k8s.io/ip-masq-agent-amd64@sha256:1ffda57d87901bc01324c82ceb2145fe6a0448d3f0dd9cb65aa76a867cd62103
+    - registry.k8s.io/ip-masq-agent-amd64:v2.1.1
+    sizeBytes: 49612505
+  - names:
+    - registry.k8s.io/k8s-dns-kube-dns-amd64@sha256:b99fc3eee2a9f052f7eb4cc00f15eb12fc405fa41019baa2d6b79847ae7284a8
+    - registry.k8s.io/k8s-dns-kube-dns-amd64:1.14.10
+    sizeBytes: 49549457
+  - names:
+    - registry.k8s.io/rescheduler@sha256:156cfbfd05a5a815206fd2eeb6cbdaf1596d71ea4b415d3a6c43071dd7b99450
+    - registry.k8s.io/rescheduler:v0.4.0
+    sizeBytes: 48973149
+  - names:
+    - registry.k8s.io/event-exporter@sha256:16ca66e2b5dc7a1ce6a5aafcb21d0885828b75cdfc08135430480f7ad2364adc
+    - registry.k8s.io/event-exporter:v0.2.4
+    sizeBytes: 47261019
+  - names:
+    - registry.k8s.io/coredns@sha256:db2bf53126ed1c761d5a41f24a1b82a461c85f736ff6e90542e9522be4757848
+    - registry.k8s.io/coredns:1.1.3
+    sizeBytes: 45587362
+  - names:
+    - prom/prometheus@sha256:483f4c9d7733699ba79facca9f8bcce1cef1af43dfc3e7c5a1882aa85f53cb74
+    - prom/prometheus:v1.1.3
+    sizeBytes: 45493941
+  nodeInfo:
+    architecture: amd64
+    bootID: a32eca78-4ad4-4b76-9252-f143d6c2ae61
+    containerRuntimeVersion: docker://17.3.2
+    kernelVersion: 4.14.127+
+    kubeProxyVersion: v1.11.10-gke.5
+    kubeletVersion: v1.11.10-gke.5
+    machineID: 1739555e5b231057f0f9a0b5fa29511b
+    operatingSystem: linux
+    osImage: Container-Optimized OS from Google
+    systemUUID: 1739555E-5B23-1057-F0F9-A0B5FA29511B
+  volumesAttached:
+  - devicePath: /dev/disk/by-id/b9772-pvc-c787c67d-14d7-11e7-9baf-42010a800049
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-c787c67d-14d7-11e7-9baf-42010a800049
+  - devicePath: /dev/disk/by-id/b9772-pvc-8895a852-fd42-11e6-94d4-42010a800049
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-8895a852-fd42-11e6-94d4-42010a800049
+  - devicePath: /dev/disk/by-id/some-random-clusterb9772-pvc-72e1c7f1-fd41-11e6-94d4-42010a800049
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-72e1c7f1-fd41-11e6-94d4-42010a800049
+  - devicePath: /dev/disk/by-id/some-random-clusterb9772-pvc-c2435a06-14d7-11e7-9baf-42010a800049
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-c2435a06-14d7-11e7-9baf-42010a800049
+  - devicePath: /dev/disk/by-id/some-random-clusterb9772-pvc-8bf50554-fd42-11e6-94d4-42010a800049
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-8bf50554-fd42-11e6-94d4-42010a800049
+  - devicePath: /dev/disk/by-id/some-random-clusterb9772-pvc-8fb5e386-4641-11e7-a490-42010a800283
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-8fb5e386-4641-11e7-a490-42010a800283
+  volumesInUse:
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-72e1c7f1-fd41-11e6-94d4-42010a800049
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-8895a852-fd42-11e6-94d4-42010a800049
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-8bf50554-fd42-11e6-94d4-42010a800049
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-8fb5e386-4641-11e7-a490-42010a800283
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-c2435a06-14d7-11e7-9baf-42010a800049
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-c787c67d-14d7-11e7-9baf-42010a800049
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/pod.yaml b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/pod.yaml
new file mode 100644
index 0000000000..3fb0877d67
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/pod.yaml
@@ -0,0 +1,121 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    app: some-app
+    plugin1: some-value
+    plugin2: some-value
+    plugin3: some-value
+    plugin4: some-value
+  name: some-name
+  namespace: default
+  ownerReferences:
+  - apiVersion: apps/v1
+    blockOwnerDeletion: true
+    controller: true
+    kind: ReplicaSet
+    name: some-name
+    uid: 0a9d2b9e-779e-11e7-b422-42010a8001be
+spec:
+  containers:
+  - args:
+    - one
+    - two
+    - three
+    - four
+    - five
+    - six
+    - seven
+    - eight
+    - nine
+    env:
+    - name: VAR_3
+      valueFrom:
+        secretKeyRef:
+          key: some-other-key
+          name: some-oher-name
+    - name: VAR_2
+      valueFrom:
+        secretKeyRef:
+          key: other-key
+          name: other-name
+    - name: VAR_1
+      valueFrom:
+        secretKeyRef:
+          key: some-key
+          name: some-name
+    image: some-image-name
+    imagePullPolicy: IfNotPresent
+    name: some-name
+    resources:
+      requests:
+        cpu: '0'
+    terminationMessagePath: /dev/termination-log
+    terminationMessagePolicy: File
+    volumeMounts:
+    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+      name: default-token-hu5jz
+      readOnly: true
+  dnsPolicy: ClusterFirst
+  nodeName: node-name
+  priority: 0
+  restartPolicy: Always
+  schedulerName: default-scheduler
+  securityContext: {}
+  serviceAccount: default
+  serviceAccountName: default
+  terminationGracePeriodSeconds: 30
+  tolerations:
+  - effect: NoExecute
+    key: node.kubernetes.io/not-ready
+    operator: Exists
+    tolerationSeconds: 300
+  - effect: NoExecute
+    key: node.kubernetes.io/unreachable
+    operator: Exists
+    tolerationSeconds: 300
+  volumes:
+  - name: default-token-hu5jz
+    secret:
+      defaultMode: 420
+      secretName: default-token-hu5jz
+status:
+  conditions:
+  - lastProbeTime: null
+    lastTransitionTime: '2019-07-08T09:31:18Z'
+    status: 'True'
+    type: Initialized
+  - lastProbeTime: null
+    lastTransitionTime: '2019-07-08T09:41:59Z'
+    status: 'True'
+    type: Ready
+  - lastProbeTime: null
+    lastTransitionTime: null
+    status: 'True'
+    type: ContainersReady
+  - lastProbeTime: null
+    lastTransitionTime: '2019-07-08T09:31:18Z'
+    status: 'True'
+    type: PodScheduled
+  containerStatuses:
+  - containerID: docker://885e82a1ed0b7356541bb410a0126921ac42439607c09875cd8097dd5d7b5376
+    image: some-image-name
+    imageID: docker-pullable://some-image-id
+    lastState:
+      terminated:
+        containerID: docker://d57290f9e00fad626b20d2dd87a3cf69bbc22edae07985374f86a8b2b4e39565
+        exitCode: 255
+        finishedAt: '2019-07-08T09:39:09Z'
+        reason: Error
+        startedAt: '2019-07-08T09:38:54Z'
+    name: name
+    ready: true
+    restartCount: 6
+    state:
+      running:
+        startedAt: '2019-07-08T09:41:59Z'
+  hostIP: 10.0.0.1
+  phase: Running
+  podIP: 10.0.0.1
+  qosClass: BestEffort
+  startTime: '2019-07-08T09:31:18Z'
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/scalehandler.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/scalehandler.go
new file mode 100644
index 0000000000..ca96ca9834
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/scalehandler.go
@@ -0,0 +1,174 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+var (
+	scaleGroupVersion   = schema.GroupVersion{Group: "autoscaling", Version: "v1"}
+	replicasPathInScale = fieldpath.MakePathOrDie("spec", "replicas")
+)
+
+// ResourcePathMappings maps a group/version to its replicas path. The
+// assumption is that all the paths correspond to leaf fields.
+type ResourcePathMappings map[string]fieldpath.Path
+
+// ScaleHandler manages the conversion of managed fields between a main
+// resource and the scale subresource
+type ScaleHandler struct {
+	parentEntries []metav1.ManagedFieldsEntry
+	groupVersion  schema.GroupVersion
+	mappings      ResourcePathMappings
+}
+
+// NewScaleHandler creates a new ScaleHandler
+func NewScaleHandler(parentEntries []metav1.ManagedFieldsEntry, groupVersion schema.GroupVersion, mappings ResourcePathMappings) *ScaleHandler {
+	return &ScaleHandler{
+		parentEntries: parentEntries,
+		groupVersion:  groupVersion,
+		mappings:      mappings,
+	}
+}
+
+// ToSubresource filter the managed fields of the main resource and convert
+// them so that they can be handled by scale.
+// For the managed fields that have a replicas path it performs two changes:
+//  1. APIVersion is changed to the APIVersion of the scale subresource
+//  2. Replicas path of the main resource is transformed to the replicas path of
+//     the scale subresource
+func (h *ScaleHandler) ToSubresource() ([]metav1.ManagedFieldsEntry, error) {
+	managed, err := internal.DecodeManagedFields(h.parentEntries)
+	if err != nil {
+		return nil, err
+	}
+
+	f := fieldpath.ManagedFields{}
+	t := map[string]*metav1.Time{}
+	for manager, versionedSet := range managed.Fields() {
+		path, ok := h.mappings[string(versionedSet.APIVersion())]
+		// Skip the entry if the APIVersion is unknown
+		if !ok || path == nil {
+			continue
+		}
+
+		if versionedSet.Set().Has(path) {
+			newVersionedSet := fieldpath.NewVersionedSet(
+				fieldpath.NewSet(replicasPathInScale),
+				fieldpath.APIVersion(scaleGroupVersion.String()),
+				versionedSet.Applied(),
+			)
+
+			f[manager] = newVersionedSet
+			t[manager] = managed.Times()[manager]
+		}
+	}
+
+	return managedFieldsEntries(internal.NewManaged(f, t))
+}
+
+// ToParent merges `scaleEntries` with the entries of the main resource and
+// transforms them accordingly
+func (h *ScaleHandler) ToParent(scaleEntries []metav1.ManagedFieldsEntry) ([]metav1.ManagedFieldsEntry, error) {
+	decodedParentEntries, err := internal.DecodeManagedFields(h.parentEntries)
+	if err != nil {
+		return nil, err
+	}
+	parentFields := decodedParentEntries.Fields()
+
+	decodedScaleEntries, err := internal.DecodeManagedFields(scaleEntries)
+	if err != nil {
+		return nil, err
+	}
+	scaleFields := decodedScaleEntries.Fields()
+
+	f := fieldpath.ManagedFields{}
+	t := map[string]*metav1.Time{}
+
+	for manager, versionedSet := range parentFields {
+		// Get the main resource "replicas" path
+		path, ok := h.mappings[string(versionedSet.APIVersion())]
+		// Drop the entry if the APIVersion is unknown.
+		if !ok {
+			continue
+		}
+
+		// If the parent entry does not have the replicas path or it is nil, just
+		// keep it as it is. The path is nil for Custom Resources without scale
+		// subresource.
+		if path == nil || !versionedSet.Set().Has(path) {
+			f[manager] = versionedSet
+			t[manager] = decodedParentEntries.Times()[manager]
+			continue
+		}
+
+		if _, ok := scaleFields[manager]; !ok {
+			// "Steal" the replicas path from the main resource entry
+			newSet := versionedSet.Set().Difference(fieldpath.NewSet(path))
+
+			if !newSet.Empty() {
+				newVersionedSet := fieldpath.NewVersionedSet(
+					newSet,
+					versionedSet.APIVersion(),
+					versionedSet.Applied(),
+				)
+				f[manager] = newVersionedSet
+				t[manager] = decodedParentEntries.Times()[manager]
+			}
+		} else {
+			// Field wasn't stolen, let's keep the entry as it is.
+			f[manager] = versionedSet
+			t[manager] = decodedParentEntries.Times()[manager]
+			delete(scaleFields, manager)
+		}
+	}
+
+	for manager, versionedSet := range scaleFields {
+		if !versionedSet.Set().Has(replicasPathInScale) {
+			continue
+		}
+		newVersionedSet := fieldpath.NewVersionedSet(
+			fieldpath.NewSet(h.mappings[h.groupVersion.String()]),
+			fieldpath.APIVersion(h.groupVersion.String()),
+			versionedSet.Applied(),
+		)
+		f[manager] = newVersionedSet
+		t[manager] = decodedParentEntries.Times()[manager]
+	}
+
+	return managedFieldsEntries(internal.NewManaged(f, t))
+}
+
+func managedFieldsEntries(entries internal.ManagedInterface) ([]metav1.ManagedFieldsEntry, error) {
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := internal.EncodeObjectManagedFields(obj, entries); err != nil {
+		return nil, err
+	}
+	accessor, err := meta.Accessor(obj)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't get accessor: %v", err))
+	}
+	return accessor.GetManagedFields(), nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/scalehandler_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/scalehandler_test.go
new file mode 100644
index 0000000000..8b35974ed6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/scalehandler_test.go
@@ -0,0 +1,785 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields
+
+import (
+	"reflect"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+func TestTransformManagedFieldsToSubresource(t *testing.T) {
+	testTime, _ := time.ParseInLocation("2006-Jan-02", "2013-Feb-03", time.Local)
+	managedFieldTime := metav1.NewTime(testTime)
+
+	tests := []struct {
+		desc     string
+		input    []metav1.ManagedFieldsEntry
+		expected []metav1.ManagedFieldsEntry
+	}{
+		{
+			desc: "filter one entry and transform it into a subresource entry",
+			input: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "manager-1",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:another-field":{}}}`),
+				},
+				{
+					Manager:    "manager-2",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Time:       &managedFieldTime,
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "manager-2",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "autoscaling/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Time:       &managedFieldTime,
+				},
+			},
+		},
+		{
+			desc: "transform all entries",
+			input: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "manager-1",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+				{
+					Manager:    "manager-2",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+				{
+					Manager:     "manager-3",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "manager-1",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "autoscaling/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+				{
+					Manager:    "manager-2",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "autoscaling/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+				{
+					Manager:     "manager-3",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc: "drops fields if the api version is unknown",
+			input: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "manager-1",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v10",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+			},
+			expected: nil,
+		},
+	}
+
+	for _, test := range tests {
+		handler := NewScaleHandler(
+			test.input,
+			schema.GroupVersion{Group: "apps", Version: "v1"},
+			defaultMappings(),
+		)
+		subresourceEntries, err := handler.ToSubresource()
+		if err != nil {
+			t.Fatalf("test %q - expected no error but got %v", test.desc, err)
+		}
+
+		if !reflect.DeepEqual(subresourceEntries, test.expected) {
+			t.Fatalf("test %q - expected output to be:\n%v\n\nbut got:\n%v", test.desc, test.expected, subresourceEntries)
+		}
+	}
+}
+
+func TestTransformingManagedFieldsToParent(t *testing.T) {
+	tests := []struct {
+		desc        string
+		parent      []metav1.ManagedFieldsEntry
+		subresource []metav1.ManagedFieldsEntry
+		expected    []metav1.ManagedFieldsEntry
+	}{
+		{
+			desc: "different-managers: apply -> update",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc: "different-managers: apply -> apply",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+			},
+		},
+		{
+			desc: "different-managers: update -> update",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+			},
+		},
+		{
+			desc: "different-managers: update -> apply",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+			},
+		},
+		{
+			desc: "same manager: apply -> apply",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc: "same manager: update -> update",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc: "same manager: update -> apply",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+			},
+		},
+		{
+			desc: "same manager: apply -> update",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc: "subresource doesn't own the path anymore",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:status":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+			},
+		},
+		{
+			desc: "Subresource steals all the fields of the parent resource",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc: "apply without stealing",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "autoscaling/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc: "drops the entry if the api version is unknown",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+				{
+					Manager:    "another-manager",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v10",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "scale",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "autoscaling/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "scale",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			handler := NewScaleHandler(
+				test.parent,
+				schema.GroupVersion{Group: "apps", Version: "v1"},
+				defaultMappings(),
+			)
+			parentEntries, err := handler.ToParent(test.subresource)
+			if err != nil {
+				t.Fatalf("test: %q - expected no error but got %v", test.desc, err)
+			}
+			if !reflect.DeepEqual(parentEntries, test.expected) {
+				t.Fatalf("test: %q - expected output to be:\n%v\n\nbut got:\n%v", test.desc, test.expected, parentEntries)
+			}
+		})
+	}
+}
+
+func TestTransformingManagedFieldsToParentMultiVersion(t *testing.T) {
+	tests := []struct {
+		desc         string
+		groupVersion schema.GroupVersion
+		mappings     ResourcePathMappings
+		parent       []metav1.ManagedFieldsEntry
+		subresource  []metav1.ManagedFieldsEntry
+		expected     []metav1.ManagedFieldsEntry
+	}{
+		{
+			desc:         "multi-version",
+			groupVersion: schema.GroupVersion{Group: "apps", Version: "v1"},
+			mappings: ResourcePathMappings{
+				"apps/v1": fieldpath.MakePathOrDie("spec", "the-replicas"),
+				"apps/v2": fieldpath.MakePathOrDie("spec", "not-the-replicas"),
+			},
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:the-replicas":{},"f:selector":{}}}`),
+				},
+				{
+					Manager:    "test-other",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v2",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:not-the-replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+				{
+					Manager:    "test-other",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v2",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:the-replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc:         "Custom resource without scale subresource, scaling a version with `scale`",
+			groupVersion: schema.GroupVersion{Group: "mygroup", Version: "v1"},
+			mappings: ResourcePathMappings{
+				"mygroup/v1": fieldpath.MakePathOrDie("spec", "the-replicas"),
+				"mygroup/v2": nil,
+			},
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "mygroup/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:the-replicas":{},"f:selector":{}}}`),
+				},
+				{
+					Manager:    "test-other",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "mygroup/v2",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:test-other":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "mygroup/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+				{
+					Manager:    "test-other",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "mygroup/v2",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:test-other":{}}}`),
+				},
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "mygroup/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:the-replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			handler := NewScaleHandler(
+				test.parent,
+				test.groupVersion,
+				test.mappings,
+			)
+			parentEntries, err := handler.ToParent(test.subresource)
+			if err != nil {
+				t.Fatalf("test: %q - expected no error but got %v", test.desc, err)
+			}
+			if !reflect.DeepEqual(parentEntries, test.expected) {
+				t.Fatalf("test: %q - expected output to be:\n%v\n\nbut got:\n%v", test.desc, test.expected, parentEntries)
+			}
+		})
+	}
+}
+
+func defaultMappings() ResourcePathMappings {
+	return ResourcePathMappings{
+		"apps/v1": fieldpath.MakePathOrDie("spec", "replicas"),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/typeconverter.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/typeconverter.go
new file mode 100644
index 0000000000..e706ac8221
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/managedfields/typeconverter.go
@@ -0,0 +1,56 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields
+
+import (
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+)
+
+// TypeConverter allows you to convert from runtime.Object to
+// typed.TypedValue and the other way around.
+type TypeConverter = internal.TypeConverter
+
+// NewDeducedTypeConverter creates a TypeConverter for CRDs that don't
+// have a schema. It does implement the same interface though (and
+// create the same types of objects), so that everything can still work
+// the same. CRDs are merged with all their fields being "atomic" (lists
+// included).
+func NewDeducedTypeConverter() TypeConverter {
+	return internal.NewDeducedTypeConverter()
+}
+
+// NewTypeConverter builds a TypeConverter from a map of OpenAPIV3 schemas.
+// This will automatically find the proper version of the object, and the
+// corresponding schema information.
+// The keys to the map must be consistent with the names
+// used by Refs within the schemas.
+// The schemas should conform to the Kubernetes Structural Schema OpenAPI
+// restrictions found in docs:
+// https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#specifying-a-structural-schema
+func NewTypeConverter(openapiSpec map[string]*spec.Schema, preserveUnknownFields bool) (TypeConverter, error) {
+	return internal.NewTypeConverter(openapiSpec, preserveUnknownFields)
+}
+
+// NewSchemeTypeConverter creates a TypeConverter that uses the provided scheme to
+// convert between runtime.Objects and TypedValues.
+func NewSchemeTypeConverter(scheme *runtime.Scheme, parser *typed.Parser) TypeConverter {
+	return internal.NewSchemeTypeConverter(scheme, parser)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/mergepatch/OWNERS b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/mergepatch/OWNERS
new file mode 100644
index 0000000000..349bc69d65
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/mergepatch/OWNERS
@@ -0,0 +1,6 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+  - pwittrock
+reviewers:
+  - apelisse
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/mergepatch/errors.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/mergepatch/errors.go
new file mode 100644
index 0000000000..16501d5afe
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/mergepatch/errors.go
@@ -0,0 +1,102 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mergepatch
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+)
+
+var (
+	ErrBadJSONDoc                           = errors.New("invalid JSON document")
+	ErrNoListOfLists                        = errors.New("lists of lists are not supported")
+	ErrBadPatchFormatForPrimitiveList       = errors.New("invalid patch format of primitive list")
+	ErrBadPatchFormatForRetainKeys          = errors.New("invalid patch format of retainKeys")
+	ErrBadPatchFormatForSetElementOrderList = errors.New("invalid patch format of setElementOrder list")
+	ErrPatchContentNotMatchRetainKeys       = errors.New("patch content doesn't match retainKeys list")
+	ErrUnsupportedStrategicMergePatchFormat = errors.New("strategic merge patch format is not supported")
+)
+
+func ErrNoMergeKey(m map[string]interface{}, k string) error {
+	return fmt.Errorf("map: %v does not contain declared merge key: %s", m, k)
+}
+
+func ErrBadArgType(expected, actual interface{}) error {
+	return fmt.Errorf("expected a %s, but received a %s",
+		reflect.TypeOf(expected),
+		reflect.TypeOf(actual))
+}
+
+func ErrBadArgKind(expected, actual interface{}) error {
+	var expectedKindString, actualKindString string
+	if expected == nil {
+		expectedKindString = "nil"
+	} else {
+		expectedKindString = reflect.TypeOf(expected).Kind().String()
+	}
+	if actual == nil {
+		actualKindString = "nil"
+	} else {
+		actualKindString = reflect.TypeOf(actual).Kind().String()
+	}
+	return fmt.Errorf("expected a %s, but received a %s", expectedKindString, actualKindString)
+}
+
+func ErrBadPatchType(t interface{}, m map[string]interface{}) error {
+	return fmt.Errorf("unknown patch type: %s in map: %v", t, m)
+}
+
+// IsPreconditionFailed returns true if the provided error indicates
+// a precondition failed.
+func IsPreconditionFailed(err error) bool {
+	_, ok := err.(ErrPreconditionFailed)
+	return ok
+}
+
+type ErrPreconditionFailed struct {
+	message string
+}
+
+func NewErrPreconditionFailed(target map[string]interface{}) ErrPreconditionFailed {
+	s := fmt.Sprintf("precondition failed for: %v", target)
+	return ErrPreconditionFailed{s}
+}
+
+func (err ErrPreconditionFailed) Error() string {
+	return err.message
+}
+
+type ErrConflict struct {
+	message string
+}
+
+func NewErrConflict(patch, current string) ErrConflict {
+	s := fmt.Sprintf("patch:\n%s\nconflicts with changes made from original to current:\n%s\n", patch, current)
+	return ErrConflict{s}
+}
+
+func (err ErrConflict) Error() string {
+	return err.message
+}
+
+// IsConflict returns true if the provided error indicates
+// a conflict between the patch and the current configuration.
+func IsConflict(err error) bool {
+	_, ok := err.(ErrConflict)
+	return ok
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/mergepatch/util.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/mergepatch/util.go
new file mode 100644
index 0000000000..46e3bb75dd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/mergepatch/util.go
@@ -0,0 +1,133 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mergepatch
+
+import (
+	"fmt"
+	"reflect"
+
+	"k8s.io/utils/dump"
+	"sigs.k8s.io/yaml"
+)
+
+// PreconditionFunc asserts that an incompatible change is not present within a patch.
+type PreconditionFunc func(interface{}) bool
+
+// RequireKeyUnchanged returns a precondition function that fails if the provided key
+// is present in the patch (indicating that its value has changed).
+func RequireKeyUnchanged(key string) PreconditionFunc {
+	return func(patch interface{}) bool {
+		patchMap, ok := patch.(map[string]interface{})
+		if !ok {
+			return true
+		}
+
+		// The presence of key means that its value has been changed, so the test fails.
+		_, ok = patchMap[key]
+		return !ok
+	}
+}
+
+// RequireMetadataKeyUnchanged creates a precondition function that fails
+// if the metadata.key is present in the patch (indicating its value
+// has changed).
+func RequireMetadataKeyUnchanged(key string) PreconditionFunc {
+	return func(patch interface{}) bool {
+		patchMap, ok := patch.(map[string]interface{})
+		if !ok {
+			return true
+		}
+		patchMap1, ok := patchMap["metadata"]
+		if !ok {
+			return true
+		}
+		patchMap2, ok := patchMap1.(map[string]interface{})
+		if !ok {
+			return true
+		}
+		_, ok = patchMap2[key]
+		return !ok
+	}
+}
+
+func ToYAMLOrError(v interface{}) string {
+	y, err := toYAML(v)
+	if err != nil {
+		return err.Error()
+	}
+
+	return y
+}
+
+func toYAML(v interface{}) (string, error) {
+	y, err := yaml.Marshal(v)
+	if err != nil {
+		return "", fmt.Errorf("yaml marshal failed:%v\n%v\n", err, dump.Pretty(v))
+	}
+
+	return string(y), nil
+}
+
+// HasConflicts returns true if the left and right JSON interface objects overlap with
+// different values in any key. All keys are required to be strings. Since patches of the
+// same Type have congruent keys, this is valid for multiple patch types. This method
+// supports JSON merge patch semantics.
+//
+// NOTE: Numbers with different types (e.g. int(0) vs int64(0)) will be detected as conflicts.
+// Make sure the unmarshaling of left and right are consistent (e.g. use the same library).
+func HasConflicts(left, right interface{}) (bool, error) {
+	switch typedLeft := left.(type) {
+	case map[string]interface{}:
+		switch typedRight := right.(type) {
+		case map[string]interface{}:
+			for key, leftValue := range typedLeft {
+				rightValue, ok := typedRight[key]
+				if !ok {
+					continue
+				}
+				if conflict, err := HasConflicts(leftValue, rightValue); err != nil || conflict {
+					return conflict, err
+				}
+			}
+
+			return false, nil
+		default:
+			return true, nil
+		}
+	case []interface{}:
+		switch typedRight := right.(type) {
+		case []interface{}:
+			if len(typedLeft) != len(typedRight) {
+				return true, nil
+			}
+
+			for i := range typedLeft {
+				if conflict, err := HasConflicts(typedLeft[i], typedRight[i]); err != nil || conflict {
+					return conflict, err
+				}
+			}
+
+			return false, nil
+		default:
+			return true, nil
+		}
+	case string, float64, bool, int64, nil:
+		return !reflect.DeepEqual(left, right), nil
+	default:
+		return true, fmt.Errorf("unknown type: %v", reflect.TypeOf(left))
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/mergepatch/util_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/mergepatch/util_test.go
new file mode 100644
index 0000000000..e74dfabd4f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/mergepatch/util_test.go
@@ -0,0 +1,136 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mergepatch
+
+import (
+	"fmt"
+	"testing"
+)
+
+func TestHasConflicts(t *testing.T) {
+	testCases := []struct {
+		A   interface{}
+		B   interface{}
+		Ret bool
+	}{
+		{A: "hello", B: "hello", Ret: false},
+		{A: "hello", B: "hell", Ret: true},
+		{A: "hello", B: nil, Ret: true},
+		{A: "hello", B: int64(1), Ret: true},
+		{A: "hello", B: float64(1.0), Ret: true},
+		{A: "hello", B: false, Ret: true},
+		{A: int64(1), B: int64(1), Ret: false},
+		{A: nil, B: nil, Ret: false},
+		{A: false, B: false, Ret: false},
+		{A: float64(3), B: float64(3), Ret: false},
+
+		{A: "hello", B: []interface{}{}, Ret: true},
+		{A: []interface{}{int64(1)}, B: []interface{}{}, Ret: true},
+		{A: []interface{}{}, B: []interface{}{}, Ret: false},
+		{A: []interface{}{int64(1)}, B: []interface{}{int64(1)}, Ret: false},
+		{A: map[string]interface{}{}, B: []interface{}{int64(1)}, Ret: true},
+
+		{A: map[string]interface{}{}, B: map[string]interface{}{"a": int64(1)}, Ret: false},
+		{A: map[string]interface{}{"a": int64(1)}, B: map[string]interface{}{"a": int64(1)}, Ret: false},
+		{A: map[string]interface{}{"a": int64(1)}, B: map[string]interface{}{"a": int64(2)}, Ret: true},
+		{A: map[string]interface{}{"a": int64(1)}, B: map[string]interface{}{"b": int64(2)}, Ret: false},
+
+		{
+			A:   map[string]interface{}{"a": []interface{}{int64(1)}},
+			B:   map[string]interface{}{"a": []interface{}{int64(1)}},
+			Ret: false,
+		},
+		{
+			A:   map[string]interface{}{"a": []interface{}{int64(1)}},
+			B:   map[string]interface{}{"a": []interface{}{}},
+			Ret: true,
+		},
+		{
+			A:   map[string]interface{}{"a": []interface{}{int64(1)}},
+			B:   map[string]interface{}{"a": int64(1)},
+			Ret: true,
+		},
+
+		// Maps and lists with multiple entries.
+		{
+			A:   map[string]interface{}{"a": int64(1), "b": int64(2)},
+			B:   map[string]interface{}{"a": int64(1), "b": int64(0)},
+			Ret: true,
+		},
+		{
+			A:   map[string]interface{}{"a": int64(1), "b": int64(2)},
+			B:   map[string]interface{}{"a": int64(1), "b": int64(2)},
+			Ret: false,
+		},
+		{
+			A:   map[string]interface{}{"a": int64(1), "b": int64(2)},
+			B:   map[string]interface{}{"a": int64(1), "b": int64(0), "c": int64(3)},
+			Ret: true,
+		},
+		{
+			A:   map[string]interface{}{"a": int64(1), "b": int64(2)},
+			B:   map[string]interface{}{"a": int64(1), "b": int64(2), "c": int64(3)},
+			Ret: false,
+		},
+		{
+			A:   map[string]interface{}{"a": []interface{}{int64(1), int64(2)}},
+			B:   map[string]interface{}{"a": []interface{}{int64(1), int64(0)}},
+			Ret: true,
+		},
+		{
+			A:   map[string]interface{}{"a": []interface{}{int64(1), int64(2)}},
+			B:   map[string]interface{}{"a": []interface{}{int64(1), int64(2)}},
+			Ret: false,
+		},
+
+		// Numeric types are not interchangeable.
+		// Callers are expected to ensure numeric types are consistent in 'left' and 'right'.
+		{A: int64(0), B: float64(0), Ret: true},
+		// Other types are not interchangeable.
+		{A: int64(0), B: "0", Ret: true},
+		{A: int64(0), B: nil, Ret: true},
+		{A: int64(0), B: false, Ret: true},
+		{A: "true", B: true, Ret: true},
+		{A: "null", B: nil, Ret: true},
+	}
+
+	for _, testCase := range testCases {
+		testStr := fmt.Sprintf("A = %#v, B = %#v", testCase.A, testCase.B)
+		// Run each test case multiple times if it passes because HasConflicts()
+		// uses map iteration, which returns keys in nondeterministic order.
+		for try := 0; try < 10; try++ {
+			out, err := HasConflicts(testCase.A, testCase.B)
+			if err != nil {
+				t.Errorf("%v: unexpected error: %v", testStr, err)
+				break
+			}
+			if out != testCase.Ret {
+				t.Errorf("%v: expected %t got %t", testStr, testCase.Ret, out)
+				break
+			}
+			out, err = HasConflicts(testCase.B, testCase.A)
+			if err != nil {
+				t.Errorf("%v: unexpected error: %v", testStr, err)
+				break
+			}
+			if out != testCase.Ret {
+				t.Errorf("%v: expected reversed %t got %t", testStr, testCase.Ret, out)
+				break
+			}
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/naming/from_stack.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/naming/from_stack.go
new file mode 100644
index 0000000000..d69bf32caa
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/naming/from_stack.go
@@ -0,0 +1,93 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package naming
+
+import (
+	"fmt"
+	"regexp"
+	goruntime "runtime"
+	"runtime/debug"
+	"strconv"
+	"strings"
+)
+
+// GetNameFromCallsite walks back through the call stack until we find a caller from outside of the ignoredPackages
+// it returns back a shortpath/filename:line to aid in identification of this reflector when it starts logging
+func GetNameFromCallsite(ignoredPackages ...string) string {
+	name := "????"
+	const maxStack = 10
+	for i := 1; i < maxStack; i++ {
+		_, file, line, ok := goruntime.Caller(i)
+		if !ok {
+			file, line, ok = extractStackCreator()
+			if !ok {
+				break
+			}
+			i += maxStack
+		}
+		if hasPackage(file, append(ignoredPackages, "/runtime/asm_")) {
+			continue
+		}
+
+		file = trimPackagePrefix(file)
+		name = fmt.Sprintf("%s:%d", file, line)
+		break
+	}
+	return name
+}
+
+// hasPackage returns true if the file is in one of the ignored packages.
+func hasPackage(file string, ignoredPackages []string) bool {
+	for _, ignoredPackage := range ignoredPackages {
+		if strings.Contains(file, ignoredPackage) {
+			return true
+		}
+	}
+	return false
+}
+
+// trimPackagePrefix reduces duplicate values off the front of a package name.
+func trimPackagePrefix(file string) string {
+	if l := strings.LastIndex(file, "/vendor/"); l >= 0 {
+		return file[l+len("/vendor/"):]
+	}
+	if l := strings.LastIndex(file, "/src/"); l >= 0 {
+		return file[l+5:]
+	}
+	if l := strings.LastIndex(file, "/pkg/"); l >= 0 {
+		return file[l+1:]
+	}
+	return file
+}
+
+var stackCreator = regexp.MustCompile(`(?m)^created by (.*)\n\s+(.*):(\d+) \+0x[[:xdigit:]]+$`)
+
+// extractStackCreator retrieves the goroutine file and line that launched this stack. Returns false
+// if the creator cannot be located.
+// TODO: Go does not expose this via runtime https://github.com/golang/go/issues/11440
+func extractStackCreator() (string, int, bool) {
+	stack := debug.Stack()
+	matches := stackCreator.FindStringSubmatch(string(stack))
+	if len(matches) != 4 {
+		return "", 0, false
+	}
+	line, err := strconv.Atoi(matches[3])
+	if err != nil {
+		return "", 0, false
+	}
+	return matches[2], line, true
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/naming/from_stack_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/naming/from_stack_test.go
new file mode 100644
index 0000000000..0eaafae577
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/naming/from_stack_test.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package naming
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestGetNameFromCallsite(t *testing.T) {
+	tests := []struct {
+		name            string
+		ignoredPackages []string
+		expected        string
+	}{
+		{
+			name:     "simple",
+			expected: "k8s.io/apimachinery/pkg/util/naming/from_stack_test.go:",
+		},
+		{
+			name:            "ignore-package",
+			ignoredPackages: []string{"k8s.io/apimachinery/pkg/util/naming"},
+			expected:        "testing/testing.go:",
+		},
+		{
+			name:            "ignore-file",
+			ignoredPackages: []string{"k8s.io/apimachinery/pkg/util/naming/from_stack_test.go"},
+			expected:        "testing/testing.go:",
+		},
+		{
+			name:            "ignore-multiple",
+			ignoredPackages: []string{"k8s.io/apimachinery/pkg/util/naming/from_stack_test.go", "testing/testing.go"},
+			expected:        "????",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			actual := GetNameFromCallsite(tc.ignoredPackages...)
+			if !strings.HasPrefix(actual, tc.expected) {
+				t.Fatalf("expected string with prefix %q, got %q", tc.expected, actual)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/http.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/http.go
new file mode 100644
index 0000000000..8912804c50
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/http.go
@@ -0,0 +1,704 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"mime"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+	"unicode"
+	"unicode/utf8"
+
+	"golang.org/x/net/http2"
+	"k8s.io/klog/v2"
+	netutils "k8s.io/utils/net"
+)
+
+// JoinPreservingTrailingSlash does a path.Join of the specified elements,
+// preserving any trailing slash on the last non-empty segment
+func JoinPreservingTrailingSlash(elem ...string) string {
+	// do the basic path join
+	result := path.Join(elem...)
+
+	// find the last non-empty segment
+	for i := len(elem) - 1; i >= 0; i-- {
+		if len(elem[i]) > 0 {
+			// if the last segment ended in a slash, ensure our result does as well
+			if strings.HasSuffix(elem[i], "/") && !strings.HasSuffix(result, "/") {
+				result += "/"
+			}
+			break
+		}
+	}
+
+	return result
+}
+
+// IsTimeout returns true if the given error is a network timeout error
+func IsTimeout(err error) bool {
+	var neterr net.Error
+	if errors.As(err, &neterr) {
+		return neterr != nil && neterr.Timeout()
+	}
+	return false
+}
+
+// IsProbableEOF returns true if the given error resembles a connection termination
+// scenario that would justify assuming that the watch is empty.
+// These errors are what the Go http stack returns back to us which are general
+// connection closure errors (strongly correlated) and callers that need to
+// differentiate probable errors in connection behavior between normal "this is
+// disconnected" should use the method.
+func IsProbableEOF(err error) bool {
+	if err == nil {
+		return false
+	}
+	var uerr *url.Error
+	if errors.As(err, &uerr) {
+		err = uerr.Err
+	}
+	msg := err.Error()
+	switch {
+	case err == io.EOF:
+		return true
+	case err == io.ErrUnexpectedEOF:
+		return true
+	case msg == "http: can't write HTTP request on broken connection":
+		return true
+	case strings.Contains(msg, "http2: server sent GOAWAY and closed the connection"):
+		return true
+	case strings.Contains(msg, "connection reset by peer"):
+		return true
+	case strings.Contains(strings.ToLower(msg), "use of closed network connection"):
+		return true
+	}
+	return false
+}
+
+var defaultTransport = http.DefaultTransport.(*http.Transport)
+
+// SetOldTransportDefaults applies the defaults from http.DefaultTransport
+// for the Proxy, Dial, and TLSHandshakeTimeout fields if unset
+func SetOldTransportDefaults(t *http.Transport) *http.Transport {
+	if t.Proxy == nil || isDefault(t.Proxy) {
+		// http.ProxyFromEnvironment doesn't respect CIDRs and that makes it impossible to exclude things like pod and service IPs from proxy settings
+		// ProxierWithNoProxyCIDR allows CIDR rules in NO_PROXY
+		t.Proxy = NewProxierWithNoProxyCIDR(http.ProxyFromEnvironment)
+	}
+	// If no custom dialer is set, use the default context dialer
+	//lint:file-ignore SA1019 Keep supporting deprecated Dial method of custom transports
+	if t.DialContext == nil && t.Dial == nil {
+		t.DialContext = defaultTransport.DialContext
+	}
+	if t.TLSHandshakeTimeout == 0 {
+		t.TLSHandshakeTimeout = defaultTransport.TLSHandshakeTimeout
+	}
+	if t.IdleConnTimeout == 0 {
+		t.IdleConnTimeout = defaultTransport.IdleConnTimeout
+	}
+	return t
+}
+
+// SetTransportDefaults applies the defaults from http.DefaultTransport
+// for the Proxy, Dial, and TLSHandshakeTimeout fields if unset
+func SetTransportDefaults(t *http.Transport) *http.Transport {
+	t = SetOldTransportDefaults(t)
+	// Allow clients to disable http2 if needed.
+	if s := os.Getenv("DISABLE_HTTP2"); len(s) > 0 {
+		//nolint:logcheck // Should be rare, not worth converting.
+		klog.Info("HTTP2 has been explicitly disabled")
+	} else if allowsHTTP2(t) {
+		if err := configureHTTP2Transport(t); err != nil {
+			//nolint:logcheck // Should be rare, not worth converting.
+			klog.Warningf("Transport failed http2 configuration: %v", err)
+		}
+	}
+	return t
+}
+
+func readIdleTimeoutSeconds() int {
+	ret := 30
+	// User can set the readIdleTimeout to 0 to disable the HTTP/2
+	// connection health check.
+	if s := os.Getenv("HTTP2_READ_IDLE_TIMEOUT_SECONDS"); len(s) > 0 {
+		i, err := strconv.Atoi(s)
+		if err != nil {
+			//nolint:logcheck // Should be rare, not worth converting.
+			klog.Warningf("Illegal HTTP2_READ_IDLE_TIMEOUT_SECONDS(%q): %v."+
+				" Default value %d is used", s, err, ret)
+			return ret
+		}
+		ret = i
+	}
+	return ret
+}
+
+func pingTimeoutSeconds() int {
+	ret := 15
+	if s := os.Getenv("HTTP2_PING_TIMEOUT_SECONDS"); len(s) > 0 {
+		i, err := strconv.Atoi(s)
+		if err != nil {
+			//nolint:logcheck // Should be rare, not worth converting.
+			klog.Warningf("Illegal HTTP2_PING_TIMEOUT_SECONDS(%q): %v."+
+				" Default value %d is used", s, err, ret)
+			return ret
+		}
+		ret = i
+	}
+	return ret
+}
+
+func configureHTTP2Transport(t *http.Transport) error {
+	t2, err := http2.ConfigureTransports(t)
+	if err != nil {
+		return err
+	}
+	// The following enables the HTTP/2 connection health check added in
+	// https://github.com/golang/net/pull/55. The health check detects and
+	// closes broken transport layer connections. Without the health check,
+	// a broken connection can linger too long, e.g., a broken TCP
+	// connection will be closed by the Linux kernel after 13 to 30 minutes
+	// by default, which caused
+	// https://github.com/kubernetes/client-go/issues/374 and
+	// https://github.com/kubernetes/kubernetes/issues/87615.
+	t2.ReadIdleTimeout = time.Duration(readIdleTimeoutSeconds()) * time.Second
+	t2.PingTimeout = time.Duration(pingTimeoutSeconds()) * time.Second
+	return nil
+}
+
+func allowsHTTP2(t *http.Transport) bool {
+	if t.TLSClientConfig == nil || len(t.TLSClientConfig.NextProtos) == 0 {
+		// the transport expressed no NextProto preference, allow
+		return true
+	}
+	for _, p := range t.TLSClientConfig.NextProtos {
+		if p == http2.NextProtoTLS {
+			// the transport explicitly allowed http/2
+			return true
+		}
+	}
+	// the transport explicitly set NextProtos and excluded http/2
+	return false
+}
+
+type RoundTripperWrapper interface {
+	http.RoundTripper
+	WrappedRoundTripper() http.RoundTripper
+}
+
+type DialFunc func(ctx context.Context, net, addr string) (net.Conn, error)
+
+func DialerFor(transport http.RoundTripper) (DialFunc, error) {
+	if transport == nil {
+		return nil, nil
+	}
+
+	switch transport := transport.(type) {
+	case *http.Transport:
+		// transport.DialContext takes precedence over transport.Dial
+		if transport.DialContext != nil {
+			return transport.DialContext, nil
+		}
+		// adapt transport.Dial to the DialWithContext signature
+		if transport.Dial != nil {
+			return func(ctx context.Context, net, addr string) (net.Conn, error) {
+				return transport.Dial(net, addr)
+			}, nil
+		}
+		// otherwise return nil
+		return nil, nil
+	case RoundTripperWrapper:
+		return DialerFor(transport.WrappedRoundTripper())
+	default:
+		return nil, fmt.Errorf("unknown transport type: %T", transport)
+	}
+}
+
+// CloseIdleConnectionsFor close idles connections for the Transport.
+// If the Transport is wrapped it iterates over the wrapped round trippers
+// until it finds one that implements the CloseIdleConnections method.
+// If the Transport does not have a CloseIdleConnections method
+// then this function does nothing.
+func CloseIdleConnectionsFor(transport http.RoundTripper) {
+	if transport == nil {
+		return
+	}
+	type closeIdler interface {
+		CloseIdleConnections()
+	}
+
+	switch transport := transport.(type) {
+	case closeIdler:
+		transport.CloseIdleConnections()
+	case RoundTripperWrapper:
+		CloseIdleConnectionsFor(transport.WrappedRoundTripper())
+	default:
+		//nolint:logcheck // Should be rare, not worth converting.
+		klog.Warningf("unknown transport type: %T", transport)
+	}
+}
+
+type TLSClientConfigHolder interface {
+	TLSClientConfig() *tls.Config
+}
+
+func TLSClientConfig(transport http.RoundTripper) (*tls.Config, error) {
+	if transport == nil {
+		return nil, nil
+	}
+
+	switch transport := transport.(type) {
+	case *http.Transport:
+		return transport.TLSClientConfig, nil
+	case TLSClientConfigHolder:
+		return transport.TLSClientConfig(), nil
+	case RoundTripperWrapper:
+		return TLSClientConfig(transport.WrappedRoundTripper())
+	default:
+		return nil, fmt.Errorf("unknown transport type: %T", transport)
+	}
+}
+
+func FormatURL(scheme string, host string, port int, path string) *url.URL {
+	return &url.URL{
+		Scheme: scheme,
+		Host:   net.JoinHostPort(host, strconv.Itoa(port)),
+		Path:   path,
+	}
+}
+
+func GetHTTPClient(req *http.Request) string {
+	if ua := req.UserAgent(); len(ua) != 0 {
+		return ua
+	}
+	return "unknown"
+}
+
+// SourceIPs splits the comma separated X-Forwarded-For header and joins it with
+// the X-Real-Ip header and/or req.RemoteAddr, ignoring invalid IPs.
+// The X-Real-Ip is omitted if it's already present in the X-Forwarded-For chain.
+// The req.RemoteAddr is always the last IP in the returned list.
+// It returns nil if all of these are empty or invalid.
+func SourceIPs(req *http.Request) []net.IP {
+	var srcIPs []net.IP
+
+	hdr := req.Header
+	// First check the X-Forwarded-For header for requests via proxy.
+	hdrForwardedFor := hdr.Get("X-Forwarded-For")
+	if hdrForwardedFor != "" {
+		// X-Forwarded-For can be a csv of IPs in case of multiple proxies.
+		// Use the first valid one.
+		parts := strings.Split(hdrForwardedFor, ",")
+		for _, part := range parts {
+			ip := netutils.ParseIPSloppy(strings.TrimSpace(part))
+			if ip != nil {
+				srcIPs = append(srcIPs, ip)
+			}
+		}
+	}
+
+	// Try the X-Real-Ip header.
+	hdrRealIp := hdr.Get("X-Real-Ip")
+	if hdrRealIp != "" {
+		ip := netutils.ParseIPSloppy(hdrRealIp)
+		// Only append the X-Real-Ip if it's not already contained in the X-Forwarded-For chain.
+		if ip != nil && !containsIP(srcIPs, ip) {
+			srcIPs = append(srcIPs, ip)
+		}
+	}
+
+	// Always include the request Remote Address as it cannot be easily spoofed.
+	var remoteIP net.IP
+	// Remote Address in Go's HTTP server is in the form host:port so we need to split that first.
+	host, _, err := net.SplitHostPort(req.RemoteAddr)
+	if err == nil {
+		remoteIP = netutils.ParseIPSloppy(host)
+	}
+	// Fallback if Remote Address was just IP.
+	if remoteIP == nil {
+		remoteIP = netutils.ParseIPSloppy(req.RemoteAddr)
+	}
+
+	// Don't duplicate remote IP if it's already the last address in the chain.
+	if remoteIP != nil && (len(srcIPs) == 0 || !remoteIP.Equal(srcIPs[len(srcIPs)-1])) {
+		srcIPs = append(srcIPs, remoteIP)
+	}
+
+	return srcIPs
+}
+
+// Checks whether the given IP address is contained in the list of IPs.
+func containsIP(ips []net.IP, ip net.IP) bool {
+	for _, v := range ips {
+		if v.Equal(ip) {
+			return true
+		}
+	}
+	return false
+}
+
+// Extracts and returns the clients IP from the given request.
+// Looks at X-Forwarded-For header, X-Real-Ip header and request.RemoteAddr in that order.
+// Returns nil if none of them are set or is set to an invalid value.
+func GetClientIP(req *http.Request) net.IP {
+	ips := SourceIPs(req)
+	if len(ips) == 0 {
+		return nil
+	}
+	return ips[0]
+}
+
+// Prepares the X-Forwarded-For header for another forwarding hop by appending the previous sender's
+// IP address to the X-Forwarded-For chain.
+func AppendForwardedForHeader(req *http.Request) {
+	// Copied from net/http/httputil/reverseproxy.go:
+	if clientIP, _, err := net.SplitHostPort(req.RemoteAddr); err == nil {
+		// If we aren't the first proxy retain prior
+		// X-Forwarded-For information as a comma+space
+		// separated list and fold multiple headers into one.
+		if prior, ok := req.Header["X-Forwarded-For"]; ok {
+			clientIP = strings.Join(prior, ", ") + ", " + clientIP
+		}
+		req.Header.Set("X-Forwarded-For", clientIP)
+	}
+}
+
+var defaultProxyFuncPointer = fmt.Sprintf("%p", http.ProxyFromEnvironment)
+
+// isDefault checks to see if the transportProxierFunc is pointing to the default one
+func isDefault(transportProxier func(*http.Request) (*url.URL, error)) bool {
+	transportProxierPointer := fmt.Sprintf("%p", transportProxier)
+	return transportProxierPointer == defaultProxyFuncPointer
+}
+
+// NewProxierWithNoProxyCIDR constructs a Proxier function that respects CIDRs in NO_PROXY and delegates if
+// no matching CIDRs are found
+func NewProxierWithNoProxyCIDR(delegate func(req *http.Request) (*url.URL, error)) func(req *http.Request) (*url.URL, error) {
+	// we wrap the default method, so we only need to perform our check if the NO_PROXY (or no_proxy) envvar has a CIDR in it
+	noProxyEnv := os.Getenv("NO_PROXY")
+	if noProxyEnv == "" {
+		noProxyEnv = os.Getenv("no_proxy")
+	}
+	noProxyRules := strings.Split(noProxyEnv, ",")
+
+	cidrs := []*net.IPNet{}
+	for _, noProxyRule := range noProxyRules {
+		_, cidr, _ := netutils.ParseCIDRSloppy(noProxyRule)
+		if cidr != nil {
+			cidrs = append(cidrs, cidr)
+		}
+	}
+
+	if len(cidrs) == 0 {
+		return delegate
+	}
+
+	return func(req *http.Request) (*url.URL, error) {
+		ip := netutils.ParseIPSloppy(req.URL.Hostname())
+		if ip == nil {
+			return delegate(req)
+		}
+
+		for _, cidr := range cidrs {
+			if cidr.Contains(ip) {
+				return nil, nil
+			}
+		}
+
+		return delegate(req)
+	}
+}
+
+// DialerFunc implements Dialer for the provided function.
+type DialerFunc func(req *http.Request) (net.Conn, error)
+
+func (fn DialerFunc) Dial(req *http.Request) (net.Conn, error) {
+	return fn(req)
+}
+
+// Dialer dials a host and writes a request to it.
+type Dialer interface {
+	// Dial connects to the host specified by req's URL, writes the request to the connection, and
+	// returns the opened net.Conn.
+	Dial(req *http.Request) (net.Conn, error)
+}
+
+// CloneRequest creates a shallow copy of the request along with a deep copy of the Headers.
+func CloneRequest(req *http.Request) *http.Request {
+	r := new(http.Request)
+
+	// shallow clone
+	*r = *req
+
+	// deep copy headers
+	r.Header = CloneHeader(req.Header)
+
+	return r
+}
+
+// CloneHeader creates a deep copy of an http.Header.
+func CloneHeader(in http.Header) http.Header {
+	out := make(http.Header, len(in))
+	for key, values := range in {
+		newValues := make([]string, len(values))
+		copy(newValues, values)
+		out[key] = newValues
+	}
+	return out
+}
+
+// WarningHeader contains a single RFC2616 14.46 warnings header
+type WarningHeader struct {
+	// Codeindicates the type of warning. 299 is a miscellaneous persistent warning
+	Code int
+	// Agent contains the name or pseudonym of the server adding the Warning header.
+	// A single "-" is recommended when agent is unknown.
+	Agent string
+	// Warning text
+	Text string
+}
+
+// ParseWarningHeaders extract RFC2616 14.46 warnings headers from the specified set of header values.
+// Multiple comma-separated warnings per header are supported.
+// If errors are encountered on a header, the remainder of that header are skipped and subsequent headers are parsed.
+// Returns successfully parsed warnings and any errors encountered.
+func ParseWarningHeaders(headers []string) ([]WarningHeader, []error) {
+	var (
+		results []WarningHeader
+		errs    []error
+	)
+	for _, header := range headers {
+		for len(header) > 0 {
+			result, remainder, err := ParseWarningHeader(header)
+			if err != nil {
+				errs = append(errs, err)
+				break
+			}
+			results = append(results, result)
+			header = remainder
+		}
+	}
+	return results, errs
+}
+
+var (
+	codeMatcher = regexp.MustCompile(`^[0-9]{3}$`)
+	wordDecoder = &mime.WordDecoder{}
+)
+
+// ParseWarningHeader extracts one RFC2616 14.46 warning from the specified header,
+// returning an error if the header does not contain a correctly formatted warning.
+// Any remaining content in the header is returned.
+func ParseWarningHeader(header string) (result WarningHeader, remainder string, err error) {
+	// https://tools.ietf.org/html/rfc2616#section-14.46
+	//   updated by
+	// https://tools.ietf.org/html/rfc7234#section-5.5
+	//   https://tools.ietf.org/html/rfc7234#appendix-A
+	//     Some requirements regarding production and processing of the Warning
+	//     header fields have been relaxed, as it is not widely implemented.
+	//     Furthermore, the Warning header field no longer uses RFC 2047
+	//     encoding, nor does it allow multiple languages, as these aspects were
+	//     not implemented.
+	//
+	// Format is one of:
+	// warn-code warn-agent "warn-text"
+	// warn-code warn-agent "warn-text" "warn-date"
+	//
+	// warn-code is a three digit number
+	// warn-agent is unquoted and contains no spaces
+	// warn-text is quoted with backslash escaping (RFC2047-encoded according to RFC2616, not encoded according to RFC7234)
+	// warn-date is optional, quoted, and in HTTP-date format (no embedded or escaped quotes)
+	//
+	// additional warnings can optionally be included in the same header by comma-separating them:
+	// warn-code warn-agent "warn-text" "warn-date"[, warn-code warn-agent "warn-text" "warn-date", ...]
+
+	// tolerate leading whitespace
+	header = strings.TrimSpace(header)
+
+	parts := strings.SplitN(header, " ", 3)
+	if len(parts) != 3 {
+		return WarningHeader{}, "", errors.New("invalid warning header: fewer than 3 segments")
+	}
+	code, agent, textDateRemainder := parts[0], parts[1], parts[2]
+
+	// verify code format
+	if !codeMatcher.Match([]byte(code)) {
+		return WarningHeader{}, "", errors.New("invalid warning header: code segment is not 3 digits between 100-299")
+	}
+	codeInt, _ := strconv.ParseInt(code, 10, 64)
+
+	// verify agent presence
+	if len(agent) == 0 {
+		return WarningHeader{}, "", errors.New("invalid warning header: empty agent segment")
+	}
+	if !utf8.ValidString(agent) || hasAnyRunes(agent, unicode.IsControl) {
+		return WarningHeader{}, "", errors.New("invalid warning header: invalid agent")
+	}
+
+	// verify textDateRemainder presence
+	if len(textDateRemainder) == 0 {
+		return WarningHeader{}, "", errors.New("invalid warning header: empty text segment")
+	}
+
+	// extract text
+	text, dateAndRemainder, err := parseQuotedString(textDateRemainder)
+	if err != nil {
+		return WarningHeader{}, "", fmt.Errorf("invalid warning header: %v", err)
+	}
+	// tolerate RFC2047-encoded text from warnings produced according to RFC2616
+	if decodedText, err := wordDecoder.DecodeHeader(text); err == nil {
+		text = decodedText
+	}
+	if !utf8.ValidString(text) || hasAnyRunes(text, unicode.IsControl) {
+		return WarningHeader{}, "", errors.New("invalid warning header: invalid text")
+	}
+	result = WarningHeader{Code: int(codeInt), Agent: agent, Text: text}
+
+	if len(dateAndRemainder) > 0 {
+		if dateAndRemainder[0] == '"' {
+			// consume date
+			foundEndQuote := false
+			for i := 1; i < len(dateAndRemainder); i++ {
+				if dateAndRemainder[i] == '"' {
+					foundEndQuote = true
+					remainder = strings.TrimSpace(dateAndRemainder[i+1:])
+					break
+				}
+			}
+			if !foundEndQuote {
+				return WarningHeader{}, "", errors.New("invalid warning header: unterminated date segment")
+			}
+		} else {
+			remainder = dateAndRemainder
+		}
+	}
+	if len(remainder) > 0 {
+		if remainder[0] == ',' {
+			// consume comma if present
+			remainder = strings.TrimSpace(remainder[1:])
+		} else {
+			return WarningHeader{}, "", errors.New("invalid warning header: unexpected token after warn-date")
+		}
+	}
+
+	return result, remainder, nil
+}
+
+func parseQuotedString(quotedString string) (string, string, error) {
+	if len(quotedString) == 0 {
+		return "", "", errors.New("invalid quoted string: 0-length")
+	}
+
+	if quotedString[0] != '"' {
+		return "", "", errors.New("invalid quoted string: missing initial quote")
+	}
+
+	quotedString = quotedString[1:]
+	var remainder string
+	escaping := false
+	closedQuote := false
+	result := &strings.Builder{}
+loop:
+	for i := 0; i < len(quotedString); i++ {
+		b := quotedString[i]
+		switch b {
+		case '"':
+			if escaping {
+				result.WriteByte(b)
+				escaping = false
+			} else {
+				closedQuote = true
+				remainder = strings.TrimSpace(quotedString[i+1:])
+				break loop
+			}
+		case '\\':
+			if escaping {
+				result.WriteByte(b)
+				escaping = false
+			} else {
+				escaping = true
+			}
+		default:
+			result.WriteByte(b)
+			escaping = false
+		}
+	}
+
+	if !closedQuote {
+		return "", "", errors.New("invalid quoted string: missing closing quote")
+	}
+	return result.String(), remainder, nil
+}
+
+func NewWarningHeader(code int, agent, text string) (string, error) {
+	if code < 0 || code > 999 {
+		return "", errors.New("code must be between 0 and 999")
+	}
+	if len(agent) == 0 {
+		agent = "-"
+	} else if !utf8.ValidString(agent) || strings.ContainsAny(agent, `\"`) || hasAnyRunes(agent, unicode.IsSpace, unicode.IsControl) {
+		return "", errors.New("agent must be valid UTF-8 and must not contain spaces, quotes, backslashes, or control characters")
+	}
+	if !utf8.ValidString(text) || hasAnyRunes(text, unicode.IsControl) {
+		return "", errors.New("text must be valid UTF-8 and must not contain control characters")
+	}
+	return fmt.Sprintf("%03d %s %s", code, agent, makeQuotedString(text)), nil
+}
+
+func hasAnyRunes(s string, runeCheckers ...func(rune) bool) bool {
+	for _, r := range s {
+		for _, checker := range runeCheckers {
+			if checker(r) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func makeQuotedString(s string) string {
+	result := &bytes.Buffer{}
+	// opening quote
+	result.WriteRune('"')
+	for _, c := range s {
+		switch c {
+		case '"', '\\':
+			// escape " and \
+			result.WriteRune('\\')
+			result.WriteRune(c)
+		default:
+			// write everything else as-is
+			result.WriteRune(c)
+		}
+	}
+	// closing quote
+	result.WriteRune('"')
+	return result.String()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/http_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/http_test.go
new file mode 100644
index 0000000000..8cced587d2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/http_test.go
@@ -0,0 +1,958 @@
+//go:build go1.8
+
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	netutils "k8s.io/utils/net"
+)
+
+func TestGetClientIP(t *testing.T) {
+	ipString := "10.0.0.1"
+	ip := netutils.ParseIPSloppy(ipString)
+	invalidIPString := "invalidIPString"
+	testCases := []struct {
+		Request    http.Request
+		ExpectedIP net.IP
+	}{
+		{
+			Request: http.Request{},
+		},
+		{
+			Request: http.Request{
+				Header: map[string][]string{
+					"X-Real-Ip": {ipString},
+				},
+			},
+			ExpectedIP: ip,
+		},
+		{
+			Request: http.Request{
+				Header: map[string][]string{
+					"X-Real-Ip": {invalidIPString},
+				},
+			},
+		},
+		{
+			Request: http.Request{
+				Header: map[string][]string{
+					"X-Forwarded-For": {ipString},
+				},
+			},
+			ExpectedIP: ip,
+		},
+		{
+			Request: http.Request{
+				Header: map[string][]string{
+					"X-Forwarded-For": {invalidIPString},
+				},
+			},
+		},
+		{
+			Request: http.Request{
+				Header: map[string][]string{
+					"X-Forwarded-For": {invalidIPString + "," + ipString},
+				},
+			},
+			ExpectedIP: ip,
+		},
+		{
+			Request: http.Request{
+				// RemoteAddr is in the form host:port
+				RemoteAddr: ipString + ":1234",
+			},
+			ExpectedIP: ip,
+		},
+		{
+			Request: http.Request{
+				RemoteAddr: invalidIPString,
+			},
+		},
+		{
+			Request: http.Request{
+				Header: map[string][]string{
+					"X-Forwarded-For": {invalidIPString},
+				},
+				// RemoteAddr is in the form host:port
+				RemoteAddr: ipString,
+			},
+			ExpectedIP: ip,
+		},
+	}
+
+	for i, test := range testCases {
+		if a, e := GetClientIP(&test.Request), test.ExpectedIP; reflect.DeepEqual(e, a) != true {
+			t.Fatalf("test case %d failed. expected: %v, actual: %v", i, e, a)
+		}
+	}
+}
+
+func TestAppendForwardedForHeader(t *testing.T) {
+	testCases := []struct {
+		addr, forwarded, expected string
+	}{
+		{"1.2.3.4:8000", "", "1.2.3.4"},
+		{"1.2.3.4:8000", "8.8.8.8", "8.8.8.8, 1.2.3.4"},
+		{"1.2.3.4:8000", "8.8.8.8, 1.2.3.4", "8.8.8.8, 1.2.3.4, 1.2.3.4"},
+		{"1.2.3.4:8000", "foo,bar", "foo,bar, 1.2.3.4"},
+	}
+	for i, test := range testCases {
+		req := &http.Request{
+			RemoteAddr: test.addr,
+			Header:     make(http.Header),
+		}
+		if test.forwarded != "" {
+			req.Header.Set("X-Forwarded-For", test.forwarded)
+		}
+
+		AppendForwardedForHeader(req)
+		actual := req.Header.Get("X-Forwarded-For")
+		if actual != test.expected {
+			t.Errorf("[%d] Expected %q, Got %q", i, test.expected, actual)
+		}
+	}
+}
+
+func TestProxierWithNoProxyCIDR(t *testing.T) {
+	testCases := []struct {
+		name    string
+		noProxy string
+		url     string
+
+		expectedDelegated bool
+	}{
+		{
+			name:              "no env",
+			url:               "https://192.168.143.1/api",
+			expectedDelegated: true,
+		},
+		{
+			name:              "no cidr",
+			noProxy:           "192.168.63.1",
+			url:               "https://192.168.143.1/api",
+			expectedDelegated: true,
+		},
+		{
+			name:              "hostname",
+			noProxy:           "192.168.63.0/24,192.168.143.0/24",
+			url:               "https://my-hostname/api",
+			expectedDelegated: true,
+		},
+		{
+			name:              "match second cidr",
+			noProxy:           "192.168.63.0/24,192.168.143.0/24",
+			url:               "https://192.168.143.1/api",
+			expectedDelegated: false,
+		},
+		{
+			name:              "match second cidr with host:port",
+			noProxy:           "192.168.63.0/24,192.168.143.0/24",
+			url:               "https://192.168.143.1:8443/api",
+			expectedDelegated: false,
+		},
+		{
+			name:              "IPv6 cidr",
+			noProxy:           "2001:db8::/48",
+			url:               "https://[2001:db8::1]/api",
+			expectedDelegated: false,
+		},
+		{
+			name:              "IPv6+port cidr",
+			noProxy:           "2001:db8::/48",
+			url:               "https://[2001:db8::1]:8443/api",
+			expectedDelegated: false,
+		},
+		{
+			name:              "IPv6, not matching cidr",
+			noProxy:           "2001:db8::/48",
+			url:               "https://[2001:db8:1::1]/api",
+			expectedDelegated: true,
+		},
+		{
+			name:              "IPv6+port, not matching cidr",
+			noProxy:           "2001:db8::/48",
+			url:               "https://[2001:db8:1::1]:8443/api",
+			expectedDelegated: true,
+		},
+	}
+
+	for _, test := range testCases {
+		t.Setenv("NO_PROXY", test.noProxy)
+		actualDelegated := false
+		proxyFunc := NewProxierWithNoProxyCIDR(func(req *http.Request) (*url.URL, error) {
+			actualDelegated = true
+			return nil, nil
+		})
+
+		req, err := http.NewRequest(http.MethodGet, test.url, nil)
+		if err != nil {
+			t.Errorf("%s: unexpected err: %v", test.name, err)
+			continue
+		}
+		if _, err := proxyFunc(req); err != nil {
+			t.Errorf("%s: unexpected err: %v", test.name, err)
+			continue
+		}
+
+		if test.expectedDelegated != actualDelegated {
+			t.Errorf("%s: expected %v, got %v", test.name, test.expectedDelegated, actualDelegated)
+			continue
+		}
+	}
+}
+
+type fakeTLSClientConfigHolder struct {
+	called bool
+}
+
+func (f *fakeTLSClientConfigHolder) TLSClientConfig() *tls.Config {
+	f.called = true
+	return nil
+}
+func (f *fakeTLSClientConfigHolder) RoundTrip(*http.Request) (*http.Response, error) {
+	return nil, nil
+}
+
+func TestTLSClientConfigHolder(t *testing.T) {
+	rt := &fakeTLSClientConfigHolder{}
+	TLSClientConfig(rt)
+
+	if !rt.called {
+		t.Errorf("didn't find tls config")
+	}
+}
+
+func TestJoinPreservingTrailingSlash(t *testing.T) {
+	tests := []struct {
+		a    string
+		b    string
+		want string
+	}{
+		// All empty
+		{"", "", ""},
+
+		// Empty a
+		{"", "/", "/"},
+		{"", "foo", "foo"},
+		{"", "/foo", "/foo"},
+		{"", "/foo/", "/foo/"},
+
+		// Empty b
+		{"/", "", "/"},
+		{"foo", "", "foo"},
+		{"/foo", "", "/foo"},
+		{"/foo/", "", "/foo/"},
+
+		// Both populated
+		{"/", "/", "/"},
+		{"foo", "foo", "foo/foo"},
+		{"/foo", "/foo", "/foo/foo"},
+		{"/foo/", "/foo/", "/foo/foo/"},
+	}
+	for _, tt := range tests {
+		name := fmt.Sprintf("%q+%q=%q", tt.a, tt.b, tt.want)
+		t.Run(name, func(t *testing.T) {
+			if got := JoinPreservingTrailingSlash(tt.a, tt.b); got != tt.want {
+				t.Errorf("JoinPreservingTrailingSlash() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestAllowsHTTP2(t *testing.T) {
+	testcases := []struct {
+		Name         string
+		Transport    *http.Transport
+		ExpectAllows bool
+	}{
+		{
+			Name:         "empty",
+			Transport:    &http.Transport{},
+			ExpectAllows: true,
+		},
+		{
+			Name:         "empty tlsconfig",
+			Transport:    &http.Transport{TLSClientConfig: &tls.Config{}},
+			ExpectAllows: true,
+		},
+		{
+			Name:         "zero-length NextProtos",
+			Transport:    &http.Transport{TLSClientConfig: &tls.Config{NextProtos: []string{}}},
+			ExpectAllows: true,
+		},
+		{
+			Name:         "includes h2 in NextProtos after",
+			Transport:    &http.Transport{TLSClientConfig: &tls.Config{NextProtos: []string{"http/1.1", "h2"}}},
+			ExpectAllows: true,
+		},
+		{
+			Name:         "includes h2 in NextProtos before",
+			Transport:    &http.Transport{TLSClientConfig: &tls.Config{NextProtos: []string{"h2", "http/1.1"}}},
+			ExpectAllows: true,
+		},
+		{
+			Name:         "includes h2 in NextProtos between",
+			Transport:    &http.Transport{TLSClientConfig: &tls.Config{NextProtos: []string{"http/1.1", "h2", "h3"}}},
+			ExpectAllows: true,
+		},
+		{
+			Name:         "excludes h2 in NextProtos",
+			Transport:    &http.Transport{TLSClientConfig: &tls.Config{NextProtos: []string{"http/1.1"}}},
+			ExpectAllows: false,
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.Name, func(t *testing.T) {
+			allows := allowsHTTP2(tc.Transport)
+			if allows != tc.ExpectAllows {
+				t.Errorf("expected %v, got %v", tc.ExpectAllows, allows)
+			}
+		})
+	}
+}
+
+func TestSourceIPs(t *testing.T) {
+	tests := []struct {
+		name         string
+		realIP       string
+		forwardedFor string
+		remoteAddr   string
+		expected     []string
+	}{{
+		name:     "no headers, missing remoteAddr",
+		expected: []string{},
+	}, {
+		name:       "no headers, just remoteAddr host:port",
+		remoteAddr: "1.2.3.4:555",
+		expected:   []string{"1.2.3.4"},
+	}, {
+		name:       "no headers, just remoteAddr host",
+		remoteAddr: "1.2.3.4",
+		expected:   []string{"1.2.3.4"},
+	}, {
+		name:         "empty forwarded-for chain",
+		forwardedFor: " ",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"1.2.3.4"},
+	}, {
+		name:         "invalid forwarded-for chain",
+		forwardedFor: "garbage garbage values!",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"1.2.3.4"},
+	}, {
+		name:         "partially invalid forwarded-for chain",
+		forwardedFor: "garbage garbage values!,4.5.6.7",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"4.5.6.7", "1.2.3.4"},
+	}, {
+		name:         "valid forwarded-for chain",
+		forwardedFor: "120.120.120.126,2.2.2.2,4.5.6.7",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"120.120.120.126", "2.2.2.2", "4.5.6.7", "1.2.3.4"},
+	}, {
+		name:         "valid forwarded-for chain with redundant remoteAddr",
+		forwardedFor: "2.2.2.2,1.2.3.4",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"2.2.2.2", "1.2.3.4"},
+	}, {
+		name:       "invalid Real-Ip",
+		realIP:     "garbage, just garbage!",
+		remoteAddr: "1.2.3.4",
+		expected:   []string{"1.2.3.4"},
+	}, {
+		name:         "invalid Real-Ip with forwarded-for",
+		realIP:       "garbage, just garbage!",
+		forwardedFor: "2.2.2.2",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"2.2.2.2", "1.2.3.4"},
+	}, {
+		name:       "valid Real-Ip",
+		realIP:     "2.2.2.2",
+		remoteAddr: "1.2.3.4",
+		expected:   []string{"2.2.2.2", "1.2.3.4"},
+	}, {
+		name:       "redundant Real-Ip",
+		realIP:     "1.2.3.4",
+		remoteAddr: "1.2.3.4",
+		expected:   []string{"1.2.3.4"},
+	}, {
+		name:         "valid Real-Ip with forwarded-for",
+		realIP:       "2.2.2.2",
+		forwardedFor: "120.120.120.126,4.5.6.7",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"120.120.120.126", "4.5.6.7", "2.2.2.2", "1.2.3.4"},
+	}, {
+		name:         "redundant Real-Ip with forwarded-for",
+		realIP:       "2.2.2.2",
+		forwardedFor: "120.120.120.126,2.2.2.2,4.5.6.7",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"120.120.120.126", "2.2.2.2", "4.5.6.7", "1.2.3.4"},
+	}, {
+		name:         "full redundancy",
+		realIP:       "1.2.3.4",
+		forwardedFor: "1.2.3.4",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"1.2.3.4"},
+	}, {
+		name:         "full ipv6",
+		realIP:       "abcd:ef01:2345:6789:abcd:ef01:2345:6789",
+		forwardedFor: "aaaa:bbbb:cccc:dddd:eeee:ffff:0:1111,0:1111:2222:3333:4444:5555:6666:7777",
+		remoteAddr:   "aaaa:aaaa:aaaa:aaaa:aaaa:aaaa:aaaa:aaaa",
+		expected: []string{
+			"aaaa:bbbb:cccc:dddd:eeee:ffff:0:1111",
+			"0:1111:2222:3333:4444:5555:6666:7777",
+			"abcd:ef01:2345:6789:abcd:ef01:2345:6789",
+			"aaaa:aaaa:aaaa:aaaa:aaaa:aaaa:aaaa:aaaa",
+		},
+	}, {
+		name:         "mixed ipv4 ipv6",
+		forwardedFor: "aaaa:bbbb:cccc:dddd:eeee:ffff:0:1111,1.2.3.4",
+		remoteAddr:   "0:0:0:0:0:ffff:102:304", // ipv6 equivalent to 1.2.3.4
+		expected: []string{
+			"aaaa:bbbb:cccc:dddd:eeee:ffff:0:1111",
+			"1.2.3.4",
+		},
+	}}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			req, _ := http.NewRequest(http.MethodGet, "https://cluster.k8s.io/apis/foobars/v1/foo/bar", nil)
+			req.RemoteAddr = test.remoteAddr
+			if test.forwardedFor != "" {
+				req.Header.Set("X-Forwarded-For", test.forwardedFor)
+			}
+			if test.realIP != "" {
+				req.Header.Set("X-Real-Ip", test.realIP)
+			}
+
+			actualIPs := SourceIPs(req)
+			actual := make([]string, len(actualIPs))
+			for i, ip := range actualIPs {
+				actual[i] = ip.String()
+			}
+
+			assert.Equal(t, test.expected, actual)
+		})
+	}
+}
+
+func TestParseWarningHeader(t *testing.T) {
+	tests := []struct {
+		name string
+
+		header string
+
+		wantResult    WarningHeader
+		wantRemainder string
+		wantErr       string
+	}{
+		// invalid cases
+		{
+			name:    "empty",
+			header:  ``,
+			wantErr: "fewer than 3 segments",
+		},
+		{
+			name:    "bad code",
+			header:  `A B`,
+			wantErr: "fewer than 3 segments",
+		},
+		{
+			name:    "short code",
+			header:  `1 - "text"`,
+			wantErr: "not 3 digits",
+		},
+		{
+			name:    "bad code",
+			header:  `A - "text"`,
+			wantErr: "not 3 digits",
+		},
+		{
+			name:    "invalid date quoting",
+			header:  `  299 - "text\"\\\a\b\c"  "Tue, 15 Nov 1994 08:12:31 GMT `,
+			wantErr: "unterminated date segment",
+		},
+		{
+			name:    "invalid post-date",
+			header:  `  299 - "text\"\\\a\b\c"  "Tue, 15 Nov 1994 08:12:31 GMT" other`,
+			wantErr: "unexpected token after warn-date",
+		},
+		{
+			name:    "agent control character",
+			header:  "  299 agent\u0000name \"text\"",
+			wantErr: "invalid agent",
+		},
+		{
+			name:    "agent non-utf8 character",
+			header:  "  299 agent\xc5name \"text\"",
+			wantErr: "invalid agent",
+		},
+		{
+			name:    "text control character",
+			header:  "  299 - \"text\u0000\"content",
+			wantErr: "invalid text",
+		},
+		{
+			name:    "text non-utf8 character",
+			header:  "  299 - \"text\xc5\"content",
+			wantErr: "invalid text",
+		},
+
+		// valid cases
+		{
+			name:       "ok",
+			header:     `299 - "text"`,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `text`},
+		},
+		{
+			name:       "ok",
+			header:     `299 - "text\"\\\a\b\c"`,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `text"\abc`},
+		},
+		// big code
+		{
+			name:       "big code",
+			header:     `321 - "text"`,
+			wantResult: WarningHeader{Code: 321, Agent: "-", Text: "text"},
+		},
+		// RFC 2047 decoding
+		{
+			name:       "ok, rfc 2047, iso-8859-1, q",
+			header:     `299 - "=?iso-8859-1?q?this=20is=20some=20text?="`,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `this is some text`},
+		},
+		{
+			name:       "ok, rfc 2047, utf-8, b",
+			header:     `299 - "=?UTF-8?B?VGhpcyBpcyBhIGhvcnNleTog8J+Qjg==?= And =?UTF-8?B?VGhpcyBpcyBhIGhvcnNleTog8J+Qjg==?="`,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `This is a horsey: 🐎 And This is a horsey: 🐎`},
+		},
+		{
+			name:       "ok, rfc 2047, utf-8, q",
+			header:     `299 - "=?UTF-8?Q?This is a \"horsey\": =F0=9F=90=8E?="`,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `This is a "horsey": 🐎`},
+		},
+		{
+			name:       "ok, rfc 2047, unknown charset",
+			header:     `299 - "=?UTF-9?Q?This is a horsey: =F0=9F=90=8E?="`,
+			wantResult: WarningHeader{Code: 299, Agent: "-", Text: `=?UTF-9?Q?This is a horsey: =F0=9F=90=8E?=`},
+		},
+		{
+			name:       "ok with spaces",
+			header:     `  299 - "text\"\\\a\b\c"  `,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `text"\abc`},
+		},
+		{
+			name:       "ok with date",
+			header:     `  299 - "text\"\\\a\b\c"  "Tue, 15 Nov 1994 08:12:31 GMT" `,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `text"\abc`},
+		},
+		{
+			name:       "ok with date and comma",
+			header:     `  299 - "text\"\\\a\b\c"  "Tue, 15 Nov 1994 08:12:31 GMT" , `,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `text"\abc`},
+		},
+		{
+			name:       "ok with comma",
+			header:     `  299 - "text\"\\\a\b\c"  , `,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `text"\abc`},
+		},
+		{
+			name:          "ok with date and comma and remainder",
+			header:        `  299 - "text\"\\\a\b\c"  "Tue, 15 Nov 1994 08:12:31 GMT" , remainder `,
+			wantResult:    WarningHeader{Code: 299, Agent: `-`, Text: `text"\abc`},
+			wantRemainder: "remainder",
+		},
+		{
+			name:          "ok with comma and remainder",
+			header:        `  299 - "text\"\\\a\b\c"  ,remainder text,second remainder`,
+			wantResult:    WarningHeader{Code: 299, Agent: `-`, Text: `text"\abc`},
+			wantRemainder: "remainder text,second remainder",
+		},
+		{
+			name:       "ok with utf-8 content directly in warn-text",
+			header:     ` 299 - "Test of Iñtërnâtiônàlizætiøn,💝🐹🌇⛔" `,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `Test of Iñtërnâtiônàlizætiøn,💝🐹🌇⛔`},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotResult, gotRemainder, err := ParseWarningHeader(tt.header)
+			switch {
+			case err == nil && len(tt.wantErr) > 0:
+				t.Errorf("ParseWarningHeader() no error, expected error %q", tt.wantErr)
+				return
+			case err != nil && len(tt.wantErr) == 0:
+				t.Errorf("ParseWarningHeader() error %q, expected no error", err)
+				return
+			case err != nil && len(tt.wantErr) > 0 && !strings.Contains(err.Error(), tt.wantErr):
+				t.Errorf("ParseWarningHeader() error %q, expected error %q", err, tt.wantErr)
+				return
+			}
+			if err != nil {
+				return
+			}
+			if !reflect.DeepEqual(gotResult, tt.wantResult) {
+				t.Errorf("ParseWarningHeader() gotResult = %#v, want %#v", gotResult, tt.wantResult)
+			}
+			if gotRemainder != tt.wantRemainder {
+				t.Errorf("ParseWarningHeader() gotRemainder = %v, want %v", gotRemainder, tt.wantRemainder)
+			}
+		})
+	}
+}
+
+func TestNewWarningHeader(t *testing.T) {
+	tests := []struct {
+		name string
+
+		code  int
+		agent string
+		text  string
+
+		want    string
+		wantErr string
+	}{
+		// invalid cases
+		{
+			name:    "code too low",
+			code:    -1,
+			agent:   `-`,
+			text:    `example warning`,
+			wantErr: "between 0 and 999",
+		},
+		{
+			name:    "code too high",
+			code:    1000,
+			agent:   `-`,
+			text:    `example warning`,
+			wantErr: "between 0 and 999",
+		},
+		{
+			name:    "agent with space",
+			code:    299,
+			agent:   `test agent`,
+			text:    `example warning`,
+			wantErr: `agent must be valid`,
+		},
+		{
+			name:    "agent with newline",
+			code:    299,
+			agent:   "test\nagent",
+			text:    `example warning`,
+			wantErr: `agent must be valid`,
+		},
+		{
+			name:    "agent with backslash",
+			code:    299,
+			agent:   `test\agent`,
+			text:    `example warning`,
+			wantErr: `agent must be valid`,
+		},
+		{
+			name:    "agent with quote",
+			code:    299,
+			agent:   `test"agent"`,
+			text:    `example warning`,
+			wantErr: `agent must be valid`,
+		},
+		{
+			name:    "agent with control character",
+			code:    299,
+			agent:   "test\u0000agent",
+			text:    `example warning`,
+			wantErr: `agent must be valid`,
+		},
+		{
+			name:    "agent with non-UTF8",
+			code:    299,
+			agent:   "test\xc5agent",
+			text:    `example warning`,
+			wantErr: `agent must be valid`,
+		},
+		{
+			name:    "text with newline",
+			code:    299,
+			agent:   `-`,
+			text:    "Test of new\nline",
+			wantErr: "text must be valid",
+		},
+		{
+			name:    "text with control character",
+			code:    299,
+			agent:   `-`,
+			text:    "Test of control\u0000character",
+			wantErr: "text must be valid",
+		},
+		{
+			name:    "text with non-UTF8",
+			code:    299,
+			agent:   `-`,
+			text:    "Test of control\xc5character",
+			wantErr: "text must be valid",
+		},
+
+		{
+			name:  "valid empty text",
+			code:  299,
+			agent: `-`,
+			text:  ``,
+			want:  `299 - ""`,
+		},
+		{
+			name:  "valid empty agent",
+			code:  299,
+			agent: ``,
+			text:  `example warning`,
+			want:  `299 - "example warning"`,
+		},
+		{
+			name:  "valid low code",
+			code:  1,
+			agent: `-`,
+			text:  `example warning`,
+			want:  `001 - "example warning"`,
+		},
+		{
+			name:  "valid high code",
+			code:  999,
+			agent: `-`,
+			text:  `example warning`,
+			want:  `999 - "example warning"`,
+		},
+		{
+			name:  "valid utf-8",
+			code:  299,
+			agent: `-`,
+			text:  `Test of "Iñtërnâtiônàlizætiøn,💝🐹🌇⛔"`,
+			want:  `299 - "Test of \"Iñtërnâtiônàlizætiøn,💝🐹🌇⛔\""`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := NewWarningHeader(tt.code, tt.agent, tt.text)
+
+			switch {
+			case err == nil && len(tt.wantErr) > 0:
+				t.Fatalf("ParseWarningHeader() no error, expected error %q", tt.wantErr)
+			case err != nil && len(tt.wantErr) == 0:
+				t.Fatalf("ParseWarningHeader() error %q, expected no error", err)
+			case err != nil && len(tt.wantErr) > 0 && !strings.Contains(err.Error(), tt.wantErr):
+				t.Fatalf("ParseWarningHeader() error %q, expected error %q", err, tt.wantErr)
+			}
+			if err != nil {
+				return
+			}
+
+			if got != tt.want {
+				t.Fatalf("NewWarningHeader() = %v, want %v", got, tt.want)
+			}
+
+			roundTrip, remaining, err := ParseWarningHeader(got)
+			if err != nil {
+				t.Fatalf("error roundtripping: %v", err)
+			}
+			if len(remaining) > 0 {
+				t.Fatalf("unexpected remainder roundtripping: %s", remaining)
+			}
+			agent := tt.agent
+			if len(agent) == 0 {
+				agent = "-"
+			}
+			expect := WarningHeader{Code: tt.code, Agent: agent, Text: tt.text}
+			if roundTrip != expect {
+				t.Fatalf("after round trip, want:\n%#v\ngot\n%#v", expect, roundTrip)
+			}
+		})
+	}
+}
+
+func TestParseWarningHeaders(t *testing.T) {
+	tests := []struct {
+		name string
+
+		headers []string
+
+		want     []WarningHeader
+		wantErrs []string
+	}{
+		{
+			name:     "empty",
+			headers:  []string{},
+			want:     nil,
+			wantErrs: []string{},
+		},
+		{
+			name: "multi-header with error",
+			headers: []string{
+				`299 - "warning 1.1",299 - "warning 1.2"`,
+				`299 - "warning 2", 299 - "warning unquoted`,
+				` 299 - "warning 3.1" ,  299 - "warning 3.2" `,
+			},
+			want: []WarningHeader{
+				{Code: 299, Agent: "-", Text: "warning 1.1"},
+				{Code: 299, Agent: "-", Text: "warning 1.2"},
+				{Code: 299, Agent: "-", Text: "warning 2"},
+				{Code: 299, Agent: "-", Text: "warning 3.1"},
+				{Code: 299, Agent: "-", Text: "warning 3.2"},
+			},
+			wantErrs: []string{"invalid warning header: invalid quoted string: missing closing quote"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, gotErrs := ParseWarningHeaders(tt.headers)
+
+			switch {
+			case len(gotErrs) != len(tt.wantErrs):
+				t.Fatalf("ParseWarningHeader() got %v, expected %v", gotErrs, tt.wantErrs)
+			case len(gotErrs) == len(tt.wantErrs) && len(gotErrs) > 0:
+				gotErrStrings := []string{}
+				for _, err := range gotErrs {
+					gotErrStrings = append(gotErrStrings, err.Error())
+				}
+				if !reflect.DeepEqual(gotErrStrings, tt.wantErrs) {
+					t.Fatalf("ParseWarningHeader() got %v, expected %v", gotErrs, tt.wantErrs)
+				}
+			}
+			if len(gotErrs) > 0 {
+				return
+			}
+
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("ParseWarningHeaders() got %#v, want %#v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestIsProbableEOF(t *testing.T) {
+	tests := []struct {
+		name     string
+		err      error
+		expected bool
+	}{
+		{
+			name:     "with no error",
+			expected: false,
+		},
+		{
+			name:     "with EOF error",
+			err:      io.EOF,
+			expected: true,
+		},
+		{
+			name:     "with unexpected EOF error",
+			err:      io.ErrUnexpectedEOF,
+			expected: true,
+		},
+		{
+			name:     "with broken connection error",
+			err:      fmt.Errorf("http: can't write HTTP request on broken connection"),
+			expected: true,
+		},
+		{
+			name:     "with server sent GOAWAY error",
+			err:      fmt.Errorf("error foo - http2: server sent GOAWAY and closed the connection - error bar"),
+			expected: true,
+		},
+		{
+			name:     "with connection reset by peer error",
+			err:      fmt.Errorf("error foo - connection reset by peer - error bar"),
+			expected: true,
+		},
+		{
+			name:     "with use of closed network connection error",
+			err:      fmt.Errorf("error foo - Use of closed network connection - error bar"),
+			expected: true,
+		},
+		{
+			name: "with url error",
+			err: &url.Error{
+				Err: io.ErrUnexpectedEOF,
+			},
+			expected: true,
+		},
+		{
+			name:     "with unrecognized error",
+			err:      fmt.Errorf("error foo"),
+			expected: false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := IsProbableEOF(test.err)
+			assert.Equal(t, test.expected, actual)
+		})
+	}
+}
+
+func TestReadIdleTimeoutSeconds(t *testing.T) {
+	t.Setenv("HTTP2_READ_IDLE_TIMEOUT_SECONDS", "60")
+	if e, a := 60, readIdleTimeoutSeconds(); e != a {
+		t.Errorf("expected %d, got %d", e, a)
+	}
+
+	t.Setenv("HTTP2_READ_IDLE_TIMEOUT_SECONDS", "illegal value")
+	if e, a := 30, readIdleTimeoutSeconds(); e != a {
+		t.Errorf("expected %d, got %d", e, a)
+	}
+}
+
+func TestPingTimeoutSeconds(t *testing.T) {
+	t.Setenv("HTTP2_PING_TIMEOUT_SECONDS", "60")
+	if e, a := 60, pingTimeoutSeconds(); e != a {
+		t.Errorf("expected %d, got %d", e, a)
+	}
+
+	t.Setenv("HTTP2_PING_TIMEOUT_SECONDS", "illegal value")
+	if e, a := 15, pingTimeoutSeconds(); e != a {
+		t.Errorf("expected %d, got %d", e, a)
+	}
+}
+
+func Benchmark_ParseQuotedString(b *testing.B) {
+	str := `"The quick brown" fox jumps over the lazy dog`
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		quoted, remainder, err := parseQuotedString(str)
+		if err != nil {
+			b.Errorf("Unexpected error %s", err)
+		}
+		if quoted != "The quick brown" {
+			b.Errorf("Unexpected quoted string %s", quoted)
+		}
+		if remainder != "fox jumps over the lazy dog" {
+			b.Errorf("Unexpected remainder string %s", quoted)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/interface.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/interface.go
new file mode 100644
index 0000000000..3ccf227af0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/interface.go
@@ -0,0 +1,532 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"bufio"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"net"
+	"os"
+
+	"strings"
+
+	"k8s.io/klog/v2"
+	netutils "k8s.io/utils/net"
+)
+
+type AddressFamily uint
+
+const (
+	familyIPv4 AddressFamily = 4
+	familyIPv6 AddressFamily = 6
+)
+
+type AddressFamilyPreference []AddressFamily
+
+var (
+	preferIPv4 = AddressFamilyPreference{familyIPv4, familyIPv6}
+	preferIPv6 = AddressFamilyPreference{familyIPv6, familyIPv4}
+)
+
+const (
+	// LoopbackInterfaceName is the default name of the loopback interface
+	LoopbackInterfaceName = "lo"
+)
+
+const (
+	ipv4RouteFile = "/proc/net/route"
+	ipv6RouteFile = "/proc/net/ipv6_route"
+)
+
+type Route struct {
+	Interface   string
+	Destination net.IP
+	Gateway     net.IP
+	Family      AddressFamily
+}
+
+type RouteFile struct {
+	name  string
+	parse func(input io.Reader) ([]Route, error)
+}
+
+// noRoutesError can be returned in case of no routes
+type noRoutesError struct {
+	message string
+}
+
+func (e noRoutesError) Error() string {
+	return e.message
+}
+
+// IsNoRoutesError checks if an error is of type noRoutesError
+func IsNoRoutesError(err error) bool {
+	if err == nil {
+		return false
+	}
+	switch err.(type) {
+	case noRoutesError:
+		return true
+	default:
+		return false
+	}
+}
+
+var (
+	v4File = RouteFile{name: ipv4RouteFile, parse: getIPv4DefaultRoutes}
+	v6File = RouteFile{name: ipv6RouteFile, parse: getIPv6DefaultRoutes}
+)
+
+func (rf RouteFile) extract() ([]Route, error) {
+	file, err := os.Open(rf.name)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+	return rf.parse(file)
+}
+
+// getIPv4DefaultRoutes obtains the IPv4 routes, and filters out non-default routes.
+func getIPv4DefaultRoutes(input io.Reader) ([]Route, error) {
+	routes := []Route{}
+	scanner := bufio.NewReader(input)
+	for {
+		line, err := scanner.ReadString('\n')
+		if err == io.EOF {
+			break
+		}
+		//ignore the headers in the route info
+		if strings.HasPrefix(line, "Iface") {
+			continue
+		}
+		fields := strings.Fields(line)
+		// Interested in fields:
+		//  0 - interface name
+		//  1 - destination address
+		//  2 - gateway
+		dest, err := parseIP(fields[1], familyIPv4)
+		if err != nil {
+			return nil, err
+		}
+		gw, err := parseIP(fields[2], familyIPv4)
+		if err != nil {
+			return nil, err
+		}
+		if !dest.Equal(net.IPv4zero) {
+			continue
+		}
+		routes = append(routes, Route{
+			Interface:   fields[0],
+			Destination: dest,
+			Gateway:     gw,
+			Family:      familyIPv4,
+		})
+	}
+	return routes, nil
+}
+
+func getIPv6DefaultRoutes(input io.Reader) ([]Route, error) {
+	routes := []Route{}
+	scanner := bufio.NewReader(input)
+	for {
+		line, err := scanner.ReadString('\n')
+		if err == io.EOF {
+			break
+		}
+		fields := strings.Fields(line)
+		// Interested in fields:
+		//  0 - destination address
+		//  4 - gateway
+		//  9 - interface name
+		dest, err := parseIP(fields[0], familyIPv6)
+		if err != nil {
+			return nil, err
+		}
+		gw, err := parseIP(fields[4], familyIPv6)
+		if err != nil {
+			return nil, err
+		}
+		if !dest.Equal(net.IPv6zero) {
+			continue
+		}
+		if gw.Equal(net.IPv6zero) {
+			continue // loopback
+		}
+		routes = append(routes, Route{
+			Interface:   fields[9],
+			Destination: dest,
+			Gateway:     gw,
+			Family:      familyIPv6,
+		})
+	}
+	return routes, nil
+}
+
+// parseIP takes the hex IP address string from route file and converts it
+// to a net.IP address. For IPv4, the value must be converted to big endian.
+func parseIP(str string, family AddressFamily) (net.IP, error) {
+	if str == "" {
+		return nil, fmt.Errorf("input is nil")
+	}
+	bytes, err := hex.DecodeString(str)
+	if err != nil {
+		return nil, err
+	}
+	if family == familyIPv4 {
+		if len(bytes) != net.IPv4len {
+			return nil, fmt.Errorf("invalid IPv4 address in route")
+		}
+		return net.IP([]byte{bytes[3], bytes[2], bytes[1], bytes[0]}), nil
+	}
+	// Must be IPv6
+	if len(bytes) != net.IPv6len {
+		return nil, fmt.Errorf("invalid IPv6 address in route")
+	}
+	return net.IP(bytes), nil
+}
+
+func isInterfaceUp(logger klog.Logger, intf *net.Interface) bool {
+	if intf == nil {
+		return false
+	}
+	if intf.Flags&net.FlagUp != 0 {
+		logger.V(4).Info("Interface is up", "interface", intf.Name)
+		return true
+	}
+	return false
+}
+
+func isLoopbackOrPointToPoint(intf *net.Interface) bool {
+	return intf.Flags&(net.FlagLoopback|net.FlagPointToPoint) != 0
+}
+
+// getMatchingGlobalIP returns the first valid global unicast address of the given
+// 'family' from the list of 'addrs'.
+func getMatchingGlobalIP(logger klog.Logger, addrs []net.Addr, family AddressFamily) (net.IP, error) {
+	if len(addrs) > 0 {
+		for i := range addrs {
+			logger.V(4).Info("Checking for matching global IP", "address", addrs[i])
+			ip, _, err := netutils.ParseCIDRSloppy(addrs[i].String())
+			if err != nil {
+				return nil, err
+			}
+			if memberOf(ip, family) {
+				if ip.IsGlobalUnicast() {
+					logger.V(4).Info("IP found", "IP", ip)
+					return ip, nil
+				} else {
+					logger.V(4).Info("Non-global unicast address found", "IP", ip)
+				}
+			} else {
+				logger.V(4).Info("IP address has wrong version", "IP", ip, "IPVersion", int(family))
+			}
+
+		}
+	}
+	return nil, nil
+}
+
+// getIPFromInterface gets the IPs on an interface and returns a global unicast address, if any. The
+// interface must be up, the IP must in the family requested, and the IP must be a global unicast address.
+func getIPFromInterface(logger klog.Logger, intfName string, forFamily AddressFamily, nw networkInterfacer) (net.IP, error) {
+	intf, err := nw.InterfaceByName(intfName)
+	if err != nil {
+		return nil, err
+	}
+	if isInterfaceUp(logger, intf) {
+		addrs, err := nw.Addrs(intf)
+		if err != nil {
+			return nil, err
+		}
+		logger.V(4).Info("Found addresses for interface", "interface", intfName, "numAddresses", len(addrs), "addresses", addrs)
+		matchingIP, err := getMatchingGlobalIP(logger, addrs, forFamily)
+		if err != nil {
+			return nil, err
+		}
+		if matchingIP != nil {
+			logger.V(4).Info("Found valid address", "IPVersion", int(forFamily), "IP", matchingIP, "interface", intfName)
+			return matchingIP, nil
+		}
+	}
+	return nil, nil
+}
+
+// getIPFromLoopbackInterface gets the IPs on a loopback interface and returns a global unicast address, if any.
+// The loopback interface must be up, the IP must in the family requested, and the IP must be a global unicast address.
+func getIPFromLoopbackInterface(logger klog.Logger, forFamily AddressFamily, nw networkInterfacer) (net.IP, error) {
+	intfs, err := nw.Interfaces()
+	if err != nil {
+		return nil, err
+	}
+	for _, intf := range intfs {
+		if !isInterfaceUp(logger, &intf) {
+			continue
+		}
+		if intf.Flags&(net.FlagLoopback) != 0 {
+			addrs, err := nw.Addrs(&intf)
+			if err != nil {
+				return nil, err
+			}
+			logger.V(4).Info("Found addresses for interface", "interface", intf.Name, "numAddresses", len(addrs), "addresses", addrs)
+			matchingIP, err := getMatchingGlobalIP(logger, addrs, forFamily)
+			if err != nil {
+				return nil, err
+			}
+			if matchingIP != nil {
+				logger.V(4).Info("Found valid address", "IPVersion", int(forFamily), "IP", matchingIP, "interface", intf.Name)
+				return matchingIP, nil
+			}
+		}
+	}
+	return nil, nil
+}
+
+// memberOf tells if the IP is of the desired family. Used for checking interface addresses.
+func memberOf(ip net.IP, family AddressFamily) bool {
+	if ip.To4() != nil {
+		return family == familyIPv4
+	} else {
+		return family == familyIPv6
+	}
+}
+
+// chooseIPFromHostInterfaces looks at all system interfaces, trying to find one that is up that
+// has a global unicast address (non-loopback, non-link local, non-point2point), and returns the IP.
+// addressFamilies determines whether it prefers IPv4 or IPv6
+func chooseIPFromHostInterfaces(logger klog.Logger, nw networkInterfacer, addressFamilies AddressFamilyPreference) (net.IP, error) {
+	intfs, err := nw.Interfaces()
+	if err != nil {
+		return nil, err
+	}
+	if len(intfs) == 0 {
+		return nil, fmt.Errorf("no interfaces found on host.")
+	}
+	for _, family := range addressFamilies {
+		logger.V(4).Info("Looking for system interface with a global address", "IPVersion", uint(family))
+		for _, intf := range intfs {
+			if !isInterfaceUp(logger, &intf) {
+				logger.V(4).Info("Skipping: interface is down", "interface", intf.Name)
+				continue
+			}
+			if isLoopbackOrPointToPoint(&intf) {
+				logger.V(4).Info("Skipping: is LB or P2P", "interface", intf.Name)
+				continue
+			}
+			addrs, err := nw.Addrs(&intf)
+			if err != nil {
+				return nil, err
+			}
+			if len(addrs) == 0 {
+				logger.V(4).Info("Skipping: no addresses", "interface", intf.Name)
+				continue
+			}
+			for _, addr := range addrs {
+				ip, _, err := netutils.ParseCIDRSloppy(addr.String())
+				if err != nil {
+					return nil, fmt.Errorf("unable to parse CIDR for interface %q: %s", intf.Name, err)
+				}
+				if !memberOf(ip, family) {
+					logger.V(4).Info("Skipping: no address family match", "IP", ip, "interface", intf.Name)
+					continue
+				}
+				// TODO: Decide if should open up to allow IPv6 LLAs in future.
+				if !ip.IsGlobalUnicast() {
+					logger.V(4).Info("Skipping: non-global address", "IP", ip, "interface", intf.Name)
+					continue
+				}
+				logger.V(4).Info("Found global unicast address", "IP", ip, "interface", intf.Name)
+				return ip, nil
+			}
+		}
+	}
+	return nil, fmt.Errorf("no acceptable interface with global unicast address found on host")
+}
+
+// ChooseHostInterface is a method used fetch an IP for a daemon.
+// If there is no routing info file, it will choose a global IP from the system
+// interfaces. Otherwise, it will use IPv4 and IPv6 route information to return the
+// IP of the interface with a gateway on it (with priority given to IPv4). For a node
+// with no internet connection, it returns error.
+//
+//logcheck:context // [ChooseHostInterfaceWithLogger] should be used instead of ChooseHostInterface in code which supports contextual logging.
+func ChooseHostInterface() (net.IP, error) {
+	return ChooseHostInterfaceWithLogger(klog.Background())
+}
+
+// ChooseHostInterfaceWithLogger is a method used fetch an IP for a daemon.
+// If there is no routing info file, it will choose a global IP from the system
+// interfaces. Otherwise, it will use IPv4 and IPv6 route information to return the
+// IP of the interface with a gateway on it (with priority given to IPv4). For a node
+// with no internet connection, it returns error.
+func ChooseHostInterfaceWithLogger(logger klog.Logger) (net.IP, error) {
+	return chooseHostInterface(logger, preferIPv4)
+}
+
+func chooseHostInterface(logger klog.Logger, addressFamilies AddressFamilyPreference) (net.IP, error) {
+	var nw networkInterfacer = networkInterface{}
+	if _, err := os.Stat(ipv4RouteFile); os.IsNotExist(err) {
+		return chooseIPFromHostInterfaces(logger, nw, addressFamilies)
+	}
+	routes, err := getAllDefaultRoutes()
+	if err != nil {
+		return nil, err
+	}
+	return chooseHostInterfaceFromRoute(logger, routes, nw, addressFamilies)
+}
+
+// networkInterfacer defines an interface for several net library functions. Production
+// code will forward to net library functions, and unit tests will override the methods
+// for testing purposes.
+type networkInterfacer interface {
+	InterfaceByName(intfName string) (*net.Interface, error)
+	Addrs(intf *net.Interface) ([]net.Addr, error)
+	Interfaces() ([]net.Interface, error)
+}
+
+// networkInterface implements the networkInterfacer interface for production code, just
+// wrapping the underlying net library function calls.
+type networkInterface struct{}
+
+func (_ networkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return net.InterfaceByName(intfName)
+}
+
+func (_ networkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	return intf.Addrs()
+}
+
+func (_ networkInterface) Interfaces() ([]net.Interface, error) {
+	return net.Interfaces()
+}
+
+// getAllDefaultRoutes obtains IPv4 and IPv6 default routes on the node. If unable
+// to read the IPv4 routing info file, we return an error. If unable to read the IPv6
+// routing info file (which is optional), we'll just use the IPv4 route information.
+// Using all the routing info, if no default routes are found, an error is returned.
+func getAllDefaultRoutes() ([]Route, error) {
+	routes, err := v4File.extract()
+	if err != nil {
+		return nil, err
+	}
+	v6Routes, _ := v6File.extract()
+	routes = append(routes, v6Routes...)
+	if len(routes) == 0 {
+		return nil, noRoutesError{
+			message: fmt.Sprintf("no default routes found in %q or %q", v4File.name, v6File.name),
+		}
+	}
+	return routes, nil
+}
+
+// chooseHostInterfaceFromRoute cycles through each default route provided, looking for a
+// global IP address from the interface for the route. If there are routes but no global
+// address is obtained from the interfaces, it checks if the loopback interface has a global address.
+// addressFamilies determines whether it prefers IPv4 or IPv6
+func chooseHostInterfaceFromRoute(logger klog.Logger, routes []Route, nw networkInterfacer, addressFamilies AddressFamilyPreference) (net.IP, error) {
+	for _, family := range addressFamilies {
+		logger.V(4).Info("Looking for default routes with IP addresses", "IPVersion", uint(family))
+		for _, route := range routes {
+			if route.Family != family {
+				continue
+			}
+			logger.V(4).Info("Default route transits interface", "interface", route.Interface)
+			finalIP, err := getIPFromInterface(logger, route.Interface, family, nw)
+			if err != nil {
+				return nil, err
+			}
+			if finalIP != nil {
+				logger.V(4).Info("Found active IP", "IP", finalIP)
+				return finalIP, nil
+			}
+			// In case of network setups where default routes are present, but network
+			// interfaces use only link-local addresses (e.g. as described in RFC5549).
+			// the global IP is assigned to the loopback interface, and we should use it
+			loopbackIP, err := getIPFromLoopbackInterface(logger, family, nw)
+			if err != nil {
+				return nil, err
+			}
+			if loopbackIP != nil {
+				logger.V(4).Info("Found active IP on Loopback interface", "IP", loopbackIP)
+				return loopbackIP, nil
+			}
+		}
+	}
+	logger.V(4).Info("No active IP found by looking at default routes")
+	return nil, fmt.Errorf("unable to select an IP from default routes.")
+}
+
+// ResolveBindAddress returns the IP address of a daemon, based on the given bindAddress:
+// If bindAddress is unset, it returns the host's default IP, as with ChooseHostInterface().
+// If bindAddress is unspecified or loopback, it returns the default IP of the same
+// address family as bindAddress.
+// Otherwise, it just returns bindAddress.
+//
+//logcheck:context // [ResolveBindAddressWithLogger] should be used instead of ResolveBindAddress in code which supports contextual logging.
+func ResolveBindAddress(bindAddress net.IP) (net.IP, error) {
+	return ResolveBindAddressWithLogger(klog.Background(), bindAddress)
+}
+
+// ResolveBindAddressWithLogger returns the IP address of a daemon, based on the given bindAddress:
+// If bindAddress is unset, it returns the host's default IP, as with ChooseHostInterface().
+// If bindAddress is unspecified or loopback, it returns the default IP of the same
+// address family as bindAddress.
+// Otherwise, it just returns bindAddress.
+func ResolveBindAddressWithLogger(logger klog.Logger, bindAddress net.IP) (net.IP, error) {
+	addressFamilies := preferIPv4
+	if bindAddress != nil && memberOf(bindAddress, familyIPv6) {
+		addressFamilies = preferIPv6
+	}
+
+	if bindAddress == nil || bindAddress.IsUnspecified() || bindAddress.IsLoopback() {
+		hostIP, err := chooseHostInterface(logger, addressFamilies)
+		if err != nil {
+			return nil, err
+		}
+		bindAddress = hostIP
+	}
+	return bindAddress, nil
+}
+
+// ChooseBindAddressForInterface choose a global IP for a specific interface, with priority given to IPv4.
+// This is required in case of network setups where default routes are present, but network
+// interfaces use only link-local addresses (e.g. as described in RFC5549).
+// e.g when using BGP to announce a host IP over link-local ip addresses and this ip address is attached to the lo interface.
+//
+//logcheck:context // [ChooseBindAddressForInterfaceWithLogger] should be used instead of ChooseBindAddressForInterface in code which supports contextual logging.
+func ChooseBindAddressForInterface(intfName string) (net.IP, error) {
+	return ChooseBindAddressForInterfaceWithLogger(klog.Background(), intfName)
+}
+
+// ChooseBindAddressForInterfaceWithLogger choose a global IP for a specific interface, with priority given to IPv4.
+// This is required in case of network setups where default routes are present, but network
+// interfaces use only link-local addresses (e.g. as described in RFC5549).
+// e.g when using BGP to announce a host IP over link-local ip addresses and this ip address is attached to the lo interface.
+func ChooseBindAddressForInterfaceWithLogger(logger klog.Logger, intfName string) (net.IP, error) {
+	var nw networkInterfacer = networkInterface{}
+	for _, family := range preferIPv4 {
+		ip, err := getIPFromInterface(logger, intfName, family, nw)
+		if err != nil {
+			return nil, err
+		}
+		if ip != nil {
+			return ip, nil
+		}
+	}
+	return nil, fmt.Errorf("unable to select an IP from %s network interface", intfName)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/interface_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/interface_test.go
new file mode 100644
index 0000000000..b791aa1090
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/interface_test.go
@@ -0,0 +1,828 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"strings"
+	"testing"
+
+	"k8s.io/klog/v2/ktesting"
+	netutils "k8s.io/utils/net"
+)
+
+const gatewayfirst = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT                                                       
+eth3	00000000	0100FE0A	0003	0	0	1024	00000000	0	0	0                                                                   
+eth3	0000FE0A	00000000	0001	0	0	0	0080FFFF	0	0	0                                                                      
+docker0	000011AC	00000000	0001	0	0	0	0000FFFF	0	0	0                                                                            
+virbr0	007AA8C0	00000000	0001	0	0	0	00FFFFFF	0	0	0
+`
+const gatewaylast = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT  
+docker0	000011AC	00000000	0001	0	0	0	0000FFFF	0	0	0                                                                            
+virbr0	007AA8C0	00000000	0001	0	0	0	00FFFFFF	0	0	0                                                                                                                     
+eth3	0000FE0A	00000000	0001	0	0	0	0080FFFF	0	0	0       
+eth3	00000000	0100FE0A	0003	0	0	1024	00000000	0	0	0                                                                 
+`
+const gatewaymiddle = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT                                                                                                                     
+eth3	0000FE0A	00000000	0001	0	0	0	0080FFFF	0	0	0                                                                      
+docker0	000011AC	00000000	0001	0	0	0	0000FFFF	0	0	0       
+eth3	00000000	0100FE0A	0003	0	0	1024	00000000	0	0	0                                                                         
+virbr0	007AA8C0	00000000	0001	0	0	0	00FFFFFF	0	0	0
+`
+const noInternetConnection = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT                                                       
+docker0	000011AC	00000000	0001	0	0	0	0000FFFF	0	0	0                                                                            
+virbr0	007AA8C0	00000000	0001	0	0	0	00FFFFFF	0	0	0            
+`
+const nothing = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT                                                            
+`
+const badDestination = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT                                                       
+eth3	00000000	0100FE0A	0003	0	0	1024	00000000	0	0	0                                                                   
+eth3	0000FE0AA1	00000000	0001	0	0	0	0080FFFF	0	0	0                                                                      
+docker0	000011AC	00000000	0001	0	0	0	0000FFFF	0	0	0                                                                            
+virbr0	007AA8C0	00000000	0001	0	0	0	00FFFFFF	0	0	0
+`
+const badGateway = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT
+eth3	00000000	0100FE0AA1	0003	0	0	1024	00000000	0	0	0                                                                   
+eth3	0000FE0A	00000000	0001	0	0	0	0080FFFF	0	0	0                                                                      
+docker0	000011AC	00000000	0001	0	0	0	0000FFFF	0	0	0                                                                            
+virbr0	007AA8C0	00000000	0001	0	0	0	00FFFFFF	0	0	0
+`
+const route_Invalidhex = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT
+eth3	00000000	0100FE0AA	0003	0	0	1024	00000000	0	0	0                                                                   
+eth3	0000FE0A	00000000	0001	0	0	0	0080FFFF	0	0	0                                                                      
+docker0	000011AC	00000000	0001	0	0	0	0000FFFF	0	0	0                                                                            
+virbr0	007AA8C0	00000000	0001	0	0	0	00FFFFFF	0	0	0
+`
+
+const v6gatewayfirst = `00000000000000000000000000000000 00 00000000000000000000000000000000 00 20010001000000000000000000000001 00000064 00000000 00000000 00000003 eth3
+20010002000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000100 00000000 00000000 00000001 eth3
+00000000000000000000000000000000 60 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000000 00000000 00200200       lo
+`
+const v6gatewaylast = `20010002000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000100 00000000 00000000 00000001 eth3
+00000000000000000000000000000000 60 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000000 00000000 00200200       lo
+00000000000000000000000000000000 00 00000000000000000000000000000000 00 20010001000000000000000000000001 00000064 00000000 00000000 00000003 eth3
+`
+const v6gatewaymiddle = `20010002000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000100 00000000 00000000 00000001 eth3
+00000000000000000000000000000000 00 00000000000000000000000000000000 00 20010001000000000000000000000001 00000064 00000000 00000000 00000003 eth3
+00000000000000000000000000000000 60 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000000 00000000 00200200       lo
+`
+const v6noDefaultRoutes = `00000000000000000000000000000000 60 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000000 00000000 00200200       lo
+20010001000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000000 00000000 00000001  docker0
+20010002000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000100 00000000 00000000 00000001   eth3
+fe800000000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000100 00000000 00000000 00000001   eth3
+`
+const v6nothing = ``
+const v6badDestination = `2001000200000000 7a 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000000 00000000 00200200       lo
+`
+const v6badGateway = `00000000000000000000000000000000 00 00000000000000000000000000000000 00 200100010000000000000000000000000012 00000064 00000000 00000000 00000003 eth3
+`
+const v6route_Invalidhex = `000000000000000000000000000000000 00 00000000000000000000000000000000 00 fe80000000000000021fcafffea0ec00 00000064 00000000 00000000 00000003 enp1s0f0
+
+`
+
+const (
+	flagUp       = net.FlagUp | net.FlagBroadcast | net.FlagMulticast
+	flagDown     = net.FlagBroadcast | net.FlagMulticast
+	flagLoopback = net.FlagUp | net.FlagLoopback
+	flagP2P      = net.FlagUp | net.FlagPointToPoint
+)
+
+func makeIntf(index int, name string, flags net.Flags) net.Interface {
+	mac := net.HardwareAddr{0, 0x32, 0x7d, 0x69, 0xf7, byte(0x30 + index)}
+	return net.Interface{
+		Index:        index,
+		MTU:          1500,
+		Name:         name,
+		HardwareAddr: mac,
+		Flags:        flags}
+}
+
+var (
+	downIntf     = makeIntf(1, "eth3", flagDown)
+	loopbackIntf = makeIntf(1, "lo", flagLoopback)
+	p2pIntf      = makeIntf(1, "lo", flagP2P)
+	upIntf       = makeIntf(1, "eth3", flagUp)
+)
+
+var (
+	ipv4Route = Route{Interface: "eth3", Destination: netutils.ParseIPSloppy("0.0.0.0"), Gateway: netutils.ParseIPSloppy("10.254.0.1"), Family: familyIPv4}
+	ipv6Route = Route{Interface: "eth3", Destination: netutils.ParseIPSloppy("::"), Gateway: netutils.ParseIPSloppy("2001:1::1"), Family: familyIPv6}
+)
+
+var (
+	noRoutes   = []Route{}
+	routeV4    = []Route{ipv4Route}
+	routeV6    = []Route{ipv6Route}
+	bothRoutes = []Route{ipv4Route, ipv6Route}
+)
+
+func TestGetIPv4Routes(t *testing.T) {
+	testCases := []struct {
+		tcase      string
+		route      string
+		count      int
+		expected   *Route
+		errStrFrag string
+	}{
+		{"gatewayfirst", gatewayfirst, 1, &ipv4Route, ""},
+		{"gatewaymiddle", gatewaymiddle, 1, &ipv4Route, ""},
+		{"gatewaylast", gatewaylast, 1, &ipv4Route, ""},
+		{"no routes", nothing, 0, nil, ""},
+		{"badDestination", badDestination, 0, nil, "invalid IPv4"},
+		{"badGateway", badGateway, 0, nil, "invalid IPv4"},
+		{"route_Invalidhex", route_Invalidhex, 0, nil, "odd length hex string"},
+		{"no default routes", noInternetConnection, 0, nil, ""},
+	}
+	for _, tc := range testCases {
+		r := strings.NewReader(tc.route)
+		routes, err := getIPv4DefaultRoutes(r)
+		if err != nil {
+			if !strings.Contains(err.Error(), tc.errStrFrag) {
+				t.Errorf("case[%s]: Error string %q does not contain %q", tc.tcase, err, tc.errStrFrag)
+			}
+		} else if tc.errStrFrag != "" {
+			t.Errorf("case[%s]: Error %q expected, but not seen", tc.tcase, tc.errStrFrag)
+		} else {
+			if tc.count != len(routes) {
+				t.Errorf("case[%s]: expected %d routes, have %v", tc.tcase, tc.count, routes)
+			} else if tc.count == 1 {
+				if !tc.expected.Gateway.Equal(routes[0].Gateway) {
+					t.Errorf("case[%s]: expected %v, got %v .err : %v", tc.tcase, tc.expected, routes, err)
+				}
+				if !routes[0].Destination.Equal(net.IPv4zero) {
+					t.Errorf("case[%s}: destination is not for default route (not zero)", tc.tcase)
+				}
+
+			}
+		}
+	}
+}
+
+func TestGetIPv6Routes(t *testing.T) {
+	testCases := []struct {
+		tcase      string
+		route      string
+		count      int
+		expected   *Route
+		errStrFrag string
+	}{
+		{"v6 gatewayfirst", v6gatewayfirst, 1, &ipv6Route, ""},
+		{"v6 gatewaymiddle", v6gatewaymiddle, 1, &ipv6Route, ""},
+		{"v6 gatewaylast", v6gatewaylast, 1, &ipv6Route, ""},
+		{"v6 no routes", v6nothing, 0, nil, ""},
+		{"v6 badDestination", v6badDestination, 0, nil, "invalid IPv6"},
+		{"v6 badGateway", v6badGateway, 0, nil, "invalid IPv6"},
+		{"v6 route_Invalidhex", v6route_Invalidhex, 0, nil, "odd length hex string"},
+		{"v6 no default routes", v6noDefaultRoutes, 0, nil, ""},
+	}
+	for _, tc := range testCases {
+		r := strings.NewReader(tc.route)
+		routes, err := getIPv6DefaultRoutes(r)
+		if err != nil {
+			if !strings.Contains(err.Error(), tc.errStrFrag) {
+				t.Errorf("case[%s]: Error string %q does not contain %q", tc.tcase, err, tc.errStrFrag)
+			}
+		} else if tc.errStrFrag != "" {
+			t.Errorf("case[%s]: Error %q expected, but not seen", tc.tcase, tc.errStrFrag)
+		} else {
+			if tc.count != len(routes) {
+				t.Errorf("case[%s]: expected %d routes, have %v", tc.tcase, tc.count, routes)
+			} else if tc.count == 1 {
+				if !tc.expected.Gateway.Equal(routes[0].Gateway) {
+					t.Errorf("case[%s]: expected %v, got %v .err : %v", tc.tcase, tc.expected, routes, err)
+				}
+				if !routes[0].Destination.Equal(net.IPv6zero) {
+					t.Errorf("case[%s}: destination is not for default route (not zero)", tc.tcase)
+				}
+			}
+		}
+	}
+}
+
+func TestParseIP(t *testing.T) {
+	testCases := []struct {
+		tcase    string
+		ip       string
+		family   AddressFamily
+		success  bool
+		expected net.IP
+	}{
+		{"empty", "", familyIPv4, false, nil},
+		{"too short", "AA", familyIPv4, false, nil},
+		{"too long", "0011223344", familyIPv4, false, nil},
+		{"invalid", "invalid!", familyIPv4, false, nil},
+		{"zero", "00000000", familyIPv4, true, net.IP{0, 0, 0, 0}},
+		{"ffff", "FFFFFFFF", familyIPv4, true, net.IP{0xff, 0xff, 0xff, 0xff}},
+		{"valid v4", "12345678", familyIPv4, true, net.IP{120, 86, 52, 18}},
+		{"valid v6", "fe800000000000000000000000000000", familyIPv6, true, net.IP{0xfe, 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}},
+		{"v6 too short", "fe80000000000000021fcafffea0ec0", familyIPv6, false, nil},
+		{"v6 too long", "fe80000000000000021fcafffea0ec002", familyIPv6, false, nil},
+	}
+	for _, tc := range testCases {
+		ip, err := parseIP(tc.ip, tc.family)
+		if !ip.Equal(tc.expected) {
+			t.Errorf("case[%v]: expected %q, got %q . err : %v", tc.tcase, tc.expected, ip, err)
+		}
+	}
+}
+
+func TestIsInterfaceUp(t *testing.T) {
+	logger, _ := ktesting.NewTestContext(t)
+	testCases := []struct {
+		tcase    string
+		intf     *net.Interface
+		expected bool
+	}{
+		{"up", &net.Interface{Index: 0, MTU: 0, Name: "eth3", HardwareAddr: nil, Flags: net.FlagUp}, true},
+		{"down", &net.Interface{Index: 0, MTU: 0, Name: "eth3", HardwareAddr: nil, Flags: 0}, false},
+		{"no interface", nil, false},
+	}
+	for _, tc := range testCases {
+		it := isInterfaceUp(logger, tc.intf)
+		if it != tc.expected {
+			t.Errorf("case[%v]: expected %v, got %v .", tc.tcase, tc.expected, it)
+		}
+	}
+}
+
+type addrStruct struct{ val string }
+
+func (a addrStruct) Network() string {
+	return a.val
+}
+func (a addrStruct) String() string {
+	return a.val
+}
+
+func TestFinalIP(t *testing.T) {
+	logger, _ := ktesting.NewTestContext(t)
+	testCases := []struct {
+		tcase    string
+		addr     []net.Addr
+		family   AddressFamily
+		expected net.IP
+	}{
+		{"no ipv4", []net.Addr{addrStruct{val: "2001::5/64"}}, familyIPv4, nil},
+		{"no ipv6", []net.Addr{addrStruct{val: "10.128.0.4/32"}}, familyIPv6, nil},
+		{"invalidV4CIDR", []net.Addr{addrStruct{val: "10.20.30.40.50/24"}}, familyIPv4, nil},
+		{"invalidV6CIDR", []net.Addr{addrStruct{val: "fe80::2f7:67fff:fe6e:2956/64"}}, familyIPv6, nil},
+		{"loopback", []net.Addr{addrStruct{val: "127.0.0.1/24"}}, familyIPv4, nil},
+		{"loopbackv6", []net.Addr{addrStruct{val: "::1/128"}}, familyIPv6, nil},
+		{"link local v4", []net.Addr{addrStruct{val: "169.254.1.10/16"}}, familyIPv4, nil},
+		{"link local v6", []net.Addr{addrStruct{val: "fe80::2f7:6fff:fe6e:2956/64"}}, familyIPv6, nil},
+		{"ip4", []net.Addr{addrStruct{val: "10.254.12.132/17"}}, familyIPv4, netutils.ParseIPSloppy("10.254.12.132")},
+		{"ip6", []net.Addr{addrStruct{val: "2001::5/64"}}, familyIPv6, netutils.ParseIPSloppy("2001::5")},
+
+		{"no addresses", []net.Addr{}, familyIPv4, nil},
+	}
+	for _, tc := range testCases {
+		ip, err := getMatchingGlobalIP(logger, tc.addr, tc.family)
+		if !ip.Equal(tc.expected) {
+			t.Errorf("case[%v]: expected %v, got %v .err : %v", tc.tcase, tc.expected, ip, err)
+		}
+	}
+}
+
+func TestAddrs(t *testing.T) {
+	var nw networkInterfacer = validNetworkInterface{}
+	intf := net.Interface{Index: 0, MTU: 0, Name: "eth3", HardwareAddr: nil, Flags: 0}
+	addrs, err := nw.Addrs(&intf)
+	if err != nil {
+		t.Errorf("expected no error got : %v", err)
+	}
+	if len(addrs) != 2 {
+		t.Errorf("expected addrs: 2 got null")
+	}
+}
+
+// Has a valid IPv4 address (IPv6 is LLA)
+type validNetworkInterface struct {
+}
+
+func (_ validNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &upIntf, nil
+}
+func (_ validNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{
+		addrStruct{val: "fe80::2f7:6fff:fe6e:2956/64"}, addrStruct{val: "10.254.71.145/17"}}
+	return ifat, nil
+}
+func (_ validNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf}, nil
+}
+
+// Both IPv4 and IPv6 addresses (expecting IPv4 to be used)
+type v4v6NetworkInterface struct {
+}
+
+func (_ v4v6NetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &upIntf, nil
+}
+func (_ v4v6NetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{
+		addrStruct{val: "2001::10/64"}, addrStruct{val: "10.254.71.145/17"}}
+	return ifat, nil
+}
+func (_ v4v6NetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf}, nil
+}
+
+// Interface with only IPv6 address
+type ipv6NetworkInterface struct {
+}
+
+func (_ ipv6NetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &upIntf, nil
+}
+func (_ ipv6NetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{addrStruct{val: "2001::200/64"}}
+	return ifat, nil
+}
+
+func (_ ipv6NetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf}, nil
+}
+
+// Only with link local addresses
+type networkInterfaceWithOnlyLinkLocals struct {
+}
+
+func (_ networkInterfaceWithOnlyLinkLocals) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &upIntf, nil
+}
+func (_ networkInterfaceWithOnlyLinkLocals) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{addrStruct{val: "169.254.162.166/16"}, addrStruct{val: "fe80::200/10"}}
+	return ifat, nil
+}
+func (_ networkInterfaceWithOnlyLinkLocals) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf}, nil
+}
+
+// Unable to get interface(s)
+type failGettingNetworkInterface struct {
+}
+
+func (_ failGettingNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return nil, fmt.Errorf("unable get Interface")
+}
+func (_ failGettingNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	return nil, nil
+}
+func (_ failGettingNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return nil, fmt.Errorf("mock failed getting all interfaces")
+}
+
+// No interfaces
+type noNetworkInterface struct {
+}
+
+func (_ noNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return nil, fmt.Errorf("no such network interface")
+}
+func (_ noNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	return nil, nil
+}
+func (_ noNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{}, nil
+}
+
+// Interface is down
+type downNetworkInterface struct {
+}
+
+func (_ downNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &downIntf, nil
+}
+func (_ downNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{
+		addrStruct{val: "fe80::2f7:6fff:fe6e:2956/64"}, addrStruct{val: "10.254.71.145/17"}}
+	return ifat, nil
+}
+func (_ downNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{downIntf}, nil
+}
+
+// Loopback interface
+type loopbackNetworkInterface struct {
+}
+
+func (_ loopbackNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &loopbackIntf, nil
+}
+func (_ loopbackNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{
+		addrStruct{val: "::1/128"}, addrStruct{val: "127.0.0.1/8"}}
+	return ifat, nil
+}
+func (_ loopbackNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{loopbackIntf}, nil
+}
+
+// Point to point interface
+type p2pNetworkInterface struct {
+}
+
+func (_ p2pNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &p2pIntf, nil
+}
+func (_ p2pNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{
+		addrStruct{val: "::1/128"}, addrStruct{val: "127.0.0.1/8"}}
+	return ifat, nil
+}
+func (_ p2pNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{p2pIntf}, nil
+}
+
+// Interface with link locals and loopback interface with global addresses
+type linkLocalLoopbackNetworkInterface struct {
+}
+
+func (_ linkLocalLoopbackNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	if intfName == LoopbackInterfaceName {
+		return &loopbackIntf, nil
+	}
+	return &upIntf, nil
+}
+func (_ linkLocalLoopbackNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{addrStruct{val: "169.254.162.166/16"}, addrStruct{val: "fe80::200/10"}}
+	if intf.Name == LoopbackInterfaceName {
+		ifat = []net.Addr{addrStruct{val: "::1/128"}, addrStruct{val: "127.0.0.1/8"},
+			// global addresses on loopback interface
+			addrStruct{val: "10.1.1.1/32"}, addrStruct{val: "fd00:1:1::1/128"}}
+	}
+	return ifat, nil
+}
+func (_ linkLocalLoopbackNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf, loopbackIntf}, nil
+}
+
+// Interface and loopback interface with global addresses
+type globalsNetworkInterface struct {
+}
+
+func (_ globalsNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	if intfName == LoopbackInterfaceName {
+		return &loopbackIntf, nil
+	}
+	return &upIntf, nil
+}
+func (_ globalsNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{addrStruct{val: "169.254.162.166/16"}, addrStruct{val: "fe80::200/10"},
+		addrStruct{val: "192.168.1.1/31"}, addrStruct{val: "fd00::200/127"}}
+	if intf.Name == LoopbackInterfaceName {
+		ifat = []net.Addr{addrStruct{val: "::1/128"}, addrStruct{val: "127.0.0.1/8"},
+			// global addresses on loopback interface
+			addrStruct{val: "10.1.1.1/32"}, addrStruct{val: "fd00:1:1::1/128"}}
+	}
+	return ifat, nil
+}
+func (_ globalsNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf, loopbackIntf}, nil
+}
+
+// Unable to get IP addresses for interface
+type networkInterfaceFailGetAddrs struct {
+}
+
+func (_ networkInterfaceFailGetAddrs) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &upIntf, nil
+}
+func (_ networkInterfaceFailGetAddrs) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	return nil, fmt.Errorf("unable to get Addrs")
+}
+func (_ networkInterfaceFailGetAddrs) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf}, nil
+}
+
+// No addresses for interface
+type networkInterfaceWithNoAddrs struct {
+}
+
+func (_ networkInterfaceWithNoAddrs) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &upIntf, nil
+}
+func (_ networkInterfaceWithNoAddrs) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	ifat := []net.Addr{}
+	return ifat, nil
+}
+func (_ networkInterfaceWithNoAddrs) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf}, nil
+}
+
+// Invalid addresses for interface
+type networkInterfaceWithInvalidAddr struct {
+}
+
+func (_ networkInterfaceWithInvalidAddr) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &upIntf, nil
+}
+func (_ networkInterfaceWithInvalidAddr) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{addrStruct{val: "10.20.30.40.50/24"}}
+	return ifat, nil
+}
+func (_ networkInterfaceWithInvalidAddr) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf}, nil
+}
+
+func TestGetIPFromInterface(t *testing.T) {
+	logger, _ := ktesting.NewTestContext(t)
+	testCases := []struct {
+		tcase      string
+		nwname     string
+		family     AddressFamily
+		nw         networkInterfacer
+		expected   net.IP
+		errStrFrag string
+	}{
+		{"ipv4", "eth3", familyIPv4, validNetworkInterface{}, netutils.ParseIPSloppy("10.254.71.145"), ""},
+		{"ipv6", "eth3", familyIPv6, ipv6NetworkInterface{}, netutils.ParseIPSloppy("2001::200"), ""},
+		{"no ipv4", "eth3", familyIPv4, ipv6NetworkInterface{}, nil, ""},
+		{"no ipv6", "eth3", familyIPv6, validNetworkInterface{}, nil, ""},
+		{"I/F down", "eth3", familyIPv4, downNetworkInterface{}, nil, ""},
+		{"I/F get fail", "eth3", familyIPv4, noNetworkInterface{}, nil, "no such network interface"},
+		{"fail get addr", "eth3", familyIPv4, networkInterfaceFailGetAddrs{}, nil, "unable to get Addrs"},
+		{"bad addr", "eth3", familyIPv4, networkInterfaceWithInvalidAddr{}, nil, "invalid CIDR"},
+	}
+	for _, tc := range testCases {
+		ip, err := getIPFromInterface(logger, tc.nwname, tc.family, tc.nw)
+		if err != nil {
+			if !strings.Contains(err.Error(), tc.errStrFrag) {
+				t.Errorf("case[%s]: Error string %q does not contain %q", tc.tcase, err, tc.errStrFrag)
+			}
+		} else if tc.errStrFrag != "" {
+			t.Errorf("case[%s]: Error %q expected, but not seen", tc.tcase, tc.errStrFrag)
+		} else if !ip.Equal(tc.expected) {
+			t.Errorf("case[%v]: expected %v, got %+v .err : %v", tc.tcase, tc.expected, ip, err)
+		}
+	}
+}
+
+func TestGetIPFromLoopbackInterface(t *testing.T) {
+	logger, _ := ktesting.NewTestContext(t)
+	testCases := []struct {
+		tcase      string
+		family     AddressFamily
+		nw         networkInterfacer
+		expected   net.IP
+		errStrFrag string
+	}{
+		{"ipv4", familyIPv4, linkLocalLoopbackNetworkInterface{}, netutils.ParseIPSloppy("10.1.1.1"), ""},
+		{"ipv6", familyIPv6, linkLocalLoopbackNetworkInterface{}, netutils.ParseIPSloppy("fd00:1:1::1"), ""},
+		{"no global ipv4", familyIPv4, loopbackNetworkInterface{}, nil, ""},
+		{"no global ipv6", familyIPv6, loopbackNetworkInterface{}, nil, ""},
+	}
+	for _, tc := range testCases {
+		ip, err := getIPFromLoopbackInterface(logger, tc.family, tc.nw)
+		if err != nil {
+			if !strings.Contains(err.Error(), tc.errStrFrag) {
+				t.Errorf("case[%s]: Error string %q does not contain %q", tc.tcase, err, tc.errStrFrag)
+			}
+		} else if tc.errStrFrag != "" {
+			t.Errorf("case[%s]: Error %q expected, but seen %v", tc.tcase, tc.errStrFrag, err)
+		} else if !ip.Equal(tc.expected) {
+			t.Errorf("case[%v]: expected %v, got %+v .err : %v", tc.tcase, tc.expected, ip, err)
+		}
+	}
+}
+
+func TestChooseHostInterfaceFromRoute(t *testing.T) {
+	logger, _ := ktesting.NewTestContext(t)
+	testCases := []struct {
+		tcase    string
+		routes   []Route
+		nw       networkInterfacer
+		order    AddressFamilyPreference
+		expected net.IP
+	}{
+		{"single-stack ipv4", routeV4, validNetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("10.254.71.145")},
+		{"single-stack ipv4, prefer v6", routeV4, validNetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("10.254.71.145")},
+		{"single-stack ipv6", routeV6, ipv6NetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("2001::200")},
+		{"single-stack ipv6, prefer v6", routeV6, ipv6NetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("2001::200")},
+		{"dual stack", bothRoutes, v4v6NetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("10.254.71.145")},
+		{"dual stack, prefer v6", bothRoutes, v4v6NetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("2001::10")},
+		{"LLA and loopback with global, IPv4", routeV4, linkLocalLoopbackNetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("10.1.1.1")},
+		{"LLA and loopback with global, IPv6", routeV6, linkLocalLoopbackNetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("fd00:1:1::1")},
+		{"LLA and loopback with global, dual stack prefer IPv4", bothRoutes, linkLocalLoopbackNetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("10.1.1.1")},
+		{"LLA and loopback with global, dual stack prefer IPv6", bothRoutes, linkLocalLoopbackNetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("fd00:1:1::1")},
+		{"LLA and loopback with global, no routes", noRoutes, linkLocalLoopbackNetworkInterface{}, preferIPv6, nil},
+		{"interface and loopback with global, IPv4", routeV4, globalsNetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("192.168.1.1")},
+		{"interface and loopback with global, IPv6", routeV6, globalsNetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("fd00::200")},
+		{"interface and loopback with global, dual stack prefer IPv4", bothRoutes, globalsNetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("192.168.1.1")},
+		{"interface and loopback with global, dual stack prefer IPv6", bothRoutes, globalsNetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("fd00::200")},
+		{"interface and loopback with global, no routes", noRoutes, globalsNetworkInterface{}, preferIPv6, nil},
+		{"all LLA", routeV4, networkInterfaceWithOnlyLinkLocals{}, preferIPv4, nil},
+		{"no routes", noRoutes, validNetworkInterface{}, preferIPv4, nil},
+		{"fail get IP", routeV4, networkInterfaceFailGetAddrs{}, preferIPv4, nil},
+	}
+	for _, tc := range testCases {
+		ip, err := chooseHostInterfaceFromRoute(logger, tc.routes, tc.nw, tc.order)
+		if !ip.Equal(tc.expected) {
+			t.Errorf("case[%v]: expected %v, got %+v .err : %v", tc.tcase, tc.expected, ip, err)
+		}
+	}
+}
+
+func TestMemberOf(t *testing.T) {
+	testCases := []struct {
+		tcase    string
+		ip       net.IP
+		family   AddressFamily
+		expected bool
+	}{
+		{"ipv4 is 4", netutils.ParseIPSloppy("10.20.30.40"), familyIPv4, true},
+		{"ipv4 is 6", netutils.ParseIPSloppy("10.10.10.10"), familyIPv6, false},
+		{"ipv6 is 4", netutils.ParseIPSloppy("2001::100"), familyIPv4, false},
+		{"ipv6 is 6", netutils.ParseIPSloppy("2001::100"), familyIPv6, true},
+	}
+	for _, tc := range testCases {
+		if memberOf(tc.ip, tc.family) != tc.expected {
+			t.Errorf("case[%s]: expected %+v", tc.tcase, tc.expected)
+		}
+	}
+}
+
+func TestGetIPFromHostInterfaces(t *testing.T) {
+	logger, _ := ktesting.NewTestContext(t)
+	testCases := []struct {
+		tcase      string
+		nw         networkInterfacer
+		order      AddressFamilyPreference
+		expected   net.IP
+		errStrFrag string
+	}{
+		{"fail get I/Fs", failGettingNetworkInterface{}, preferIPv4, nil, "failed getting all interfaces"},
+		{"no interfaces", noNetworkInterface{}, preferIPv4, nil, "no interfaces"},
+		{"I/F not up", downNetworkInterface{}, preferIPv4, nil, "no acceptable"},
+		{"loopback only", loopbackNetworkInterface{}, preferIPv4, nil, "no acceptable"},
+		{"P2P I/F only", p2pNetworkInterface{}, preferIPv4, nil, "no acceptable"},
+		{"fail get addrs", networkInterfaceFailGetAddrs{}, preferIPv4, nil, "unable to get Addrs"},
+		{"no addresses", networkInterfaceWithNoAddrs{}, preferIPv4, nil, "no acceptable"},
+		{"invalid addr", networkInterfaceWithInvalidAddr{}, preferIPv4, nil, "invalid CIDR"},
+		{"no matches", networkInterfaceWithOnlyLinkLocals{}, preferIPv4, nil, "no acceptable"},
+		{"single-stack ipv4", validNetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("10.254.71.145"), ""},
+		{"single-stack ipv4, prefer ipv6", validNetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("10.254.71.145"), ""},
+		{"single-stack ipv6", ipv6NetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("2001::200"), ""},
+		{"single-stack ipv6, prefer ipv6", ipv6NetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("2001::200"), ""},
+		{"dual stack", v4v6NetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("10.254.71.145"), ""},
+		{"dual stack, prefer ipv6", v4v6NetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("2001::10"), ""},
+	}
+
+	for _, tc := range testCases {
+		ip, err := chooseIPFromHostInterfaces(logger, tc.nw, tc.order)
+		if !ip.Equal(tc.expected) {
+			t.Errorf("case[%s]: expected %+v, got %+v with err : %v", tc.tcase, tc.expected, ip, err)
+		}
+		if err != nil && !strings.Contains(err.Error(), tc.errStrFrag) {
+			t.Errorf("case[%s]: unable to find %q in error string %q", tc.tcase, tc.errStrFrag, err.Error())
+		}
+	}
+}
+
+func makeRouteFile(content string, t *testing.T) (*os.File, error) {
+	routeFile, err := os.CreateTemp("", "route")
+	if err != nil {
+		return nil, err
+	}
+
+	if _, err := routeFile.Write([]byte(content)); err != nil {
+		return routeFile, err
+	}
+	err = routeFile.Close()
+	return routeFile, err
+}
+
+func TestFailGettingIPv4Routes(t *testing.T) {
+	defer func() { v4File.name = ipv4RouteFile }()
+
+	// Try failure to open file (should not occur, as caller ensures we have IPv4 route file, but being thorough)
+	v4File.name = "no-such-file"
+	errStrFrag := "no such file"
+	_, err := v4File.extract()
+	if err == nil {
+		t.Errorf("Expected error trying to read non-existent v4 route file")
+	}
+	if !strings.Contains(err.Error(), errStrFrag) {
+		t.Errorf("Unable to find %q in error string %q", errStrFrag, err.Error())
+	}
+}
+
+func TestFailGettingIPv6Routes(t *testing.T) {
+	defer func() { v6File.name = ipv6RouteFile }()
+
+	// Try failure to open file (this would be ignored by caller)
+	v6File.name = "no-such-file"
+	errStrFrag := "no such file"
+	_, err := v6File.extract()
+	if err == nil {
+		t.Errorf("Expected error trying to read non-existent v6 route file")
+	}
+	if !strings.Contains(err.Error(), errStrFrag) {
+		t.Errorf("Unable to find %q in error string %q", errStrFrag, err.Error())
+	}
+}
+
+func TestGetAllDefaultRoutesFailNoV4RouteFile(t *testing.T) {
+	defer func() { v4File.name = ipv4RouteFile }()
+
+	// Should not occur, as caller ensures we have IPv4 route file, but being thorough
+	v4File.name = "no-such-file"
+	errStrFrag := "no such file"
+	_, err := getAllDefaultRoutes()
+	if err == nil {
+		t.Errorf("Expected error trying to read non-existent v4 route file")
+	}
+	if !strings.Contains(err.Error(), errStrFrag) {
+		t.Errorf("Unable to find %q in error string %q", errStrFrag, err.Error())
+	}
+}
+
+func TestGetAllDefaultRoutes(t *testing.T) {
+	testCases := []struct {
+		tcase      string
+		v4Info     string
+		v6Info     string
+		count      int
+		expected   []Route
+		errStrFrag string
+	}{
+		{"no routes", noInternetConnection, v6noDefaultRoutes, 0, nil, "no default routes"},
+		{"only v4 route", gatewayfirst, v6noDefaultRoutes, 1, routeV4, ""},
+		{"only v6 route", noInternetConnection, v6gatewayfirst, 1, routeV6, ""},
+		{"v4 and v6 routes", gatewayfirst, v6gatewayfirst, 2, bothRoutes, ""},
+	}
+	defer func() {
+		v4File.name = ipv4RouteFile
+		v6File.name = ipv6RouteFile
+	}()
+
+	for _, tc := range testCases {
+		routeFile, err := makeRouteFile(tc.v4Info, t)
+		if routeFile != nil {
+			defer os.Remove(routeFile.Name())
+		}
+		if err != nil {
+			t.Errorf("case[%s]: test setup failure for IPv4 route file: %v", tc.tcase, err)
+		}
+		v4File.name = routeFile.Name()
+		v6routeFile, err := makeRouteFile(tc.v6Info, t)
+		if v6routeFile != nil {
+			defer os.Remove(v6routeFile.Name())
+		}
+		if err != nil {
+			t.Errorf("case[%s]: test setup failure for IPv6 route file: %v", tc.tcase, err)
+		}
+		v6File.name = v6routeFile.Name()
+
+		routes, err := getAllDefaultRoutes()
+		if err != nil {
+			if !strings.Contains(err.Error(), tc.errStrFrag) {
+				t.Errorf("case[%s]: Error string %q does not contain %q", tc.tcase, err, tc.errStrFrag)
+			}
+		} else if tc.errStrFrag != "" {
+			t.Errorf("case[%s]: Error %q expected, but not seen", tc.tcase, tc.errStrFrag)
+		} else {
+			if tc.count != len(routes) {
+				t.Errorf("case[%s]: expected %d routes, have %v", tc.tcase, tc.count, routes)
+			}
+			for i, expected := range tc.expected {
+				if !expected.Gateway.Equal(routes[i].Gateway) {
+					t.Errorf("case[%s]: at %d expected %v, got %v .err : %v", tc.tcase, i, tc.expected, routes, err)
+				}
+				zeroIP := net.IPv4zero
+				if expected.Family == familyIPv6 {
+					zeroIP = net.IPv6zero
+				}
+				if !routes[i].Destination.Equal(zeroIP) {
+					t.Errorf("case[%s}: at %d destination is not for default route (not %v)", tc.tcase, i, zeroIP)
+				}
+			}
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/port_range.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/port_range.go
new file mode 100644
index 0000000000..42ecffcca0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/port_range.go
@@ -0,0 +1,149 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+// PortRange represents a range of TCP/UDP ports.  To represent a single port,
+// set Size to 1.
+type PortRange struct {
+	Base int
+	Size int
+}
+
+// Contains tests whether a given port falls within the PortRange.
+func (pr *PortRange) Contains(p int) bool {
+	return (p >= pr.Base) && ((p - pr.Base) < pr.Size)
+}
+
+// String converts the PortRange to a string representation, which can be
+// parsed by PortRange.Set or ParsePortRange.
+func (pr PortRange) String() string {
+	if pr.Size == 0 {
+		return ""
+	}
+	return fmt.Sprintf("%d-%d", pr.Base, pr.Base+pr.Size-1)
+}
+
+// Set parses a string of the form "value", "min-max", or "min+offset", inclusive at both ends, and
+// sets the PortRange from it.  This is part of the flag.Value and pflag.Value
+// interfaces.
+func (pr *PortRange) Set(value string) error {
+	const (
+		SinglePortNotation = 1 << iota
+		HyphenNotation
+		PlusNotation
+	)
+
+	value = strings.TrimSpace(value)
+	hyphenIndex := strings.Index(value, "-")
+	plusIndex := strings.Index(value, "+")
+
+	if value == "" {
+		pr.Base = 0
+		pr.Size = 0
+		return nil
+	}
+
+	var err error
+	var low, high int
+	var notation int
+
+	if plusIndex == -1 && hyphenIndex == -1 {
+		notation |= SinglePortNotation
+	}
+	if hyphenIndex != -1 {
+		notation |= HyphenNotation
+	}
+	if plusIndex != -1 {
+		notation |= PlusNotation
+	}
+
+	switch notation {
+	case SinglePortNotation:
+		var port int
+		port, err = strconv.Atoi(value)
+		if err != nil {
+			return err
+		}
+		low = port
+		high = port
+	case HyphenNotation:
+		low, err = strconv.Atoi(value[:hyphenIndex])
+		if err != nil {
+			return err
+		}
+		high, err = strconv.Atoi(value[hyphenIndex+1:])
+		if err != nil {
+			return err
+		}
+	case PlusNotation:
+		var offset int
+		low, err = strconv.Atoi(value[:plusIndex])
+		if err != nil {
+			return err
+		}
+		offset, err = strconv.Atoi(value[plusIndex+1:])
+		if err != nil {
+			return err
+		}
+		high = low + offset
+	default:
+		return fmt.Errorf("unable to parse port range: %s", value)
+	}
+
+	if low > 65535 || high > 65535 {
+		return fmt.Errorf("the port range cannot be greater than 65535: %s", value)
+	}
+
+	if high < low {
+		return fmt.Errorf("end port cannot be less than start port: %s", value)
+	}
+
+	pr.Base = low
+	pr.Size = 1 + high - low
+	return nil
+}
+
+// Type returns a descriptive string about this type.  This is part of the
+// pflag.Value interface.
+func (*PortRange) Type() string {
+	return "portRange"
+}
+
+// ParsePortRange parses a string of the form "min-max", inclusive at both
+// ends, and initializes a new PortRange from it.
+func ParsePortRange(value string) (*PortRange, error) {
+	pr := &PortRange{}
+	err := pr.Set(value)
+	if err != nil {
+		return nil, err
+	}
+	return pr, nil
+}
+
+func ParsePortRangeOrDie(value string) *PortRange {
+	pr, err := ParsePortRange(value)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't parse port range %q: %v", value, err))
+	}
+	return pr
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/port_range_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/port_range_test.go
new file mode 100644
index 0000000000..94a1b7f881
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/port_range_test.go
@@ -0,0 +1,77 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"testing"
+
+	flag "github.com/spf13/pflag"
+)
+
+func TestPortRange(t *testing.T) {
+	testCases := []struct {
+		input    string
+		success  bool
+		expected string
+		included int
+		excluded int
+	}{
+		{"100-200", true, "100-200", 200, 201},
+		{" 100-200 ", true, "100-200", 200, 201},
+		{"0-0", true, "0-0", 0, 1},
+		{"", true, "", -1, 0},
+		{"100", true, "100-100", 100, 101},
+		{"100 - 200", false, "", -1, -1},
+		{"-100", false, "", -1, -1},
+		{"100-", false, "", -1, -1},
+		{"200-100", false, "", -1, -1},
+		{"60000-70000", false, "", -1, -1},
+		{"70000-80000", false, "", -1, -1},
+		{"70000+80000", false, "", -1, -1},
+		{"1+0", true, "1-1", 1, 2},
+		{"0+0", true, "0-0", 0, 1},
+		{"1+-1", false, "", -1, -1},
+		{"1-+1", false, "", -1, -1},
+		{"100+200", true, "100-300", 300, 301},
+		{"1+65535", false, "", -1, -1},
+		{"0+65535", true, "0-65535", 65535, 65536},
+	}
+
+	for i := range testCases {
+		tc := &testCases[i]
+		pr := &PortRange{}
+		var f flag.Value = pr
+		err := f.Set(tc.input)
+		if err != nil && tc.success {
+			t.Errorf("expected success, got %q", err)
+			continue
+		} else if err == nil && !tc.success {
+			t.Errorf("expected failure %#v", testCases[i])
+			continue
+		} else if tc.success {
+			if f.String() != tc.expected {
+				t.Errorf("expected %q, got %q", tc.expected, f.String())
+			}
+			if tc.included >= 0 && !pr.Contains(tc.included) {
+				t.Errorf("expected %q to include %d", f.String(), tc.included)
+			}
+			if tc.excluded >= 0 && pr.Contains(tc.excluded) {
+				t.Errorf("expected %q to exclude %d", f.String(), tc.excluded)
+			}
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/port_split.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/port_split.go
new file mode 100644
index 0000000000..f54bb1e71c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/port_split.go
@@ -0,0 +1,78 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+var validSchemes = sets.NewString("http", "https", "")
+
+// SplitSchemeNamePort takes a string of the following forms:
+//   - "<name>",                 returns "",        "<name>","",      true
+//   - "<name>:<port>",          returns "",        "<name>","<port>",true
+//   - "<scheme>:<name>:<port>", returns "<scheme>","<name>","<port>",true
+//
+// Name must be non-empty or valid will be returned false.
+// Scheme must be "http" or "https" if specified
+// Port is returned as a string, and it is not required to be numeric (could be
+// used for a named port, for example).
+func SplitSchemeNamePort(id string) (scheme, name, port string, valid bool) {
+	parts := strings.Split(id, ":")
+	switch len(parts) {
+	case 1:
+		name = parts[0]
+	case 2:
+		name = parts[0]
+		port = parts[1]
+	case 3:
+		scheme = parts[0]
+		name = parts[1]
+		port = parts[2]
+	default:
+		return "", "", "", false
+	}
+
+	if len(name) > 0 && validSchemes.Has(scheme) {
+		return scheme, name, port, true
+	} else {
+		return "", "", "", false
+	}
+}
+
+// JoinSchemeNamePort returns a string that specifies the scheme, name, and port:
+//   - "<name>"
+//   - "<name>:<port>"
+//   - "<scheme>:<name>:<port>"
+//
+// None of the parameters may contain a ':' character
+// Name is required
+// Scheme must be "", "http", or "https"
+func JoinSchemeNamePort(scheme, name, port string) string {
+	if len(scheme) > 0 {
+		// Must include three segments to specify scheme
+		return scheme + ":" + name + ":" + port
+	}
+	if len(port) > 0 {
+		// Must include two segments to specify port
+		return name + ":" + port
+	}
+	// Return name alone
+	return name
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/port_split_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/port_split_test.go
new file mode 100644
index 0000000000..e801bdbea0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/port_split_test.go
@@ -0,0 +1,121 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"testing"
+)
+
+func TestSplitSchemeNamePort(t *testing.T) {
+	table := []struct {
+		in                 string
+		name, port, scheme string
+		valid              bool
+		normalized         bool
+	}{
+		{
+			in:         "aoeu:asdf",
+			name:       "aoeu",
+			port:       "asdf",
+			valid:      true,
+			normalized: true,
+		}, {
+			in:         "http:aoeu:asdf",
+			scheme:     "http",
+			name:       "aoeu",
+			port:       "asdf",
+			valid:      true,
+			normalized: true,
+		}, {
+			in:         "https:aoeu:",
+			scheme:     "https",
+			name:       "aoeu",
+			port:       "",
+			valid:      true,
+			normalized: false,
+		}, {
+			in:         "https:aoeu:asdf",
+			scheme:     "https",
+			name:       "aoeu",
+			port:       "asdf",
+			valid:      true,
+			normalized: true,
+		}, {
+			in:         "aoeu:",
+			name:       "aoeu",
+			valid:      true,
+			normalized: false,
+		}, {
+			in:         "aoeu",
+			name:       "aoeu",
+			valid:      true,
+			normalized: true,
+		}, {
+			in:    ":asdf",
+			valid: false,
+		}, {
+			in:    "aoeu:asdf:htns",
+			valid: false,
+		}, {
+			in:    "http::asdf",
+			valid: false,
+		}, {
+			in:    "http::",
+			valid: false,
+		}, {
+			in:    "",
+			valid: false,
+		},
+	}
+
+	for _, item := range table {
+		scheme, name, port, valid := SplitSchemeNamePort(item.in)
+		if e, a := item.scheme, scheme; e != a {
+			t.Errorf("%q: Wanted %q, got %q", item.in, e, a)
+		}
+		if e, a := item.name, name; e != a {
+			t.Errorf("%q: Wanted %q, got %q", item.in, e, a)
+		}
+		if e, a := item.port, port; e != a {
+			t.Errorf("%q: Wanted %q, got %q", item.in, e, a)
+		}
+		if e, a := item.valid, valid; e != a {
+			t.Errorf("%q: Wanted %t, got %t", item.in, e, a)
+		}
+
+		// Make sure valid items round trip through JoinSchemeNamePort
+		if item.valid {
+			out := JoinSchemeNamePort(scheme, name, port)
+			if item.normalized && out != item.in {
+				t.Errorf("%q: Wanted %s, got %s", item.in, item.in, out)
+			}
+			scheme, name, port, valid := SplitSchemeNamePort(out)
+			if e, a := item.scheme, scheme; e != a {
+				t.Errorf("%q: Wanted %q, got %q", item.in, e, a)
+			}
+			if e, a := item.name, name; e != a {
+				t.Errorf("%q: Wanted %q, got %q", item.in, e, a)
+			}
+			if e, a := item.port, port; e != a {
+				t.Errorf("%q: Wanted %q, got %q", item.in, e, a)
+			}
+			if e, a := item.valid, valid; e != a {
+				t.Errorf("%q: Wanted %t, got %t", item.in, e, a)
+			}
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/testing/http.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/testing/http.go
new file mode 100644
index 0000000000..439bb38140
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/testing/http.go
@@ -0,0 +1,139 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package nettesting contains utilities for testing networking functionality.
+// Don't use these utilities in production code. They have not been security
+// reviewed.
+package nettesting
+
+import (
+	"io"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"sync"
+	"testing"
+)
+
+// NewHTTPProxyHandler returns a new HTTPProxyHandler. It accepts an optional
+// hook which is called early in the handler to export request state. If the
+// hook returns false, the handler returns immediately with a server error.
+// Ensure that this is only used in tests. This code has not been security
+// reviewed.
+func NewHTTPProxyHandler(t testing.TB, hook func(req *http.Request) bool) *HTTPProxyHandler {
+	h := &HTTPProxyHandler{
+		hook: hook,
+		httpProxy: httputil.ReverseProxy{
+			Director: func(req *http.Request) {
+				req.URL.Scheme = "http"
+				req.URL.Host = req.Host
+			},
+		},
+		t: t,
+	}
+	return h
+}
+
+// HTTPProxyHandler implements a simple handler for http_proxy and https_proxy
+// requests for use in testing.
+type HTTPProxyHandler struct {
+	handlerDone sync.WaitGroup
+	hook        func(r *http.Request) bool
+	// httpProxy is the reverse proxy we use for standard http proxy requests.
+	httpProxy httputil.ReverseProxy
+	t         testing.TB
+}
+
+// ServeHTTP handles an HTTP proxy request.
+func (h *HTTPProxyHandler) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+	h.handlerDone.Add(1)
+	defer h.handlerDone.Done()
+
+	if h.hook != nil {
+		if ok := h.hook(req); !ok {
+			rw.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+	}
+
+	b, err := httputil.DumpRequest(req, false)
+	if err != nil {
+		h.t.Logf("Failed to dump request, host=%s: %v", req.Host, err)
+	} else {
+		h.t.Logf("Proxy Request: %s", string(b))
+	}
+
+	if req.Method != http.MethodConnect {
+		h.httpProxy.ServeHTTP(rw, req)
+		return
+	}
+
+	// CONNECT proxy
+
+	sconn, err := net.Dial("tcp", req.Host)
+	if err != nil {
+		h.t.Logf("Failed to dial proxy backend, host=%s: %v", req.Host, err)
+		rw.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+	defer sconn.Close()
+
+	hj, ok := rw.(http.Hijacker)
+	if !ok {
+		h.t.Logf("Can't switch protocols using non-Hijacker ResponseWriter: type=%T, host=%s", rw, req.Host)
+		rw.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	rw.WriteHeader(http.StatusOK)
+
+	conn, brw, err := hj.Hijack()
+	if err != nil {
+		h.t.Logf("Failed to hijack client connection, host=%s: %v", req.Host, err)
+		return
+	}
+	defer conn.Close()
+
+	if err := brw.Flush(); err != nil {
+		h.t.Logf("Failed to flush pending writes to client, host=%s: %v", req.Host, err)
+		return
+	}
+	if _, err := io.Copy(sconn, io.LimitReader(brw, int64(brw.Reader.Buffered()))); err != nil {
+		h.t.Logf("Failed to flush buffered reads to server, host=%s: %v", req.Host, err)
+		return
+	}
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+
+	go func() {
+		defer wg.Done()
+		defer h.t.Logf("Server read close, host=%s", req.Host)
+		io.Copy(conn, sconn)
+	}()
+	go func() {
+		defer wg.Done()
+		defer h.t.Logf("Server write close, host=%s", req.Host)
+		io.Copy(sconn, conn)
+	}()
+
+	wg.Wait()
+	h.t.Logf("Done handling CONNECT request, host=%s", req.Host)
+}
+
+func (h *HTTPProxyHandler) Wait() {
+	h.handlerDone.Wait()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/testing/socket.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/testing/socket.go
new file mode 100644
index 0000000000..4bf868aac8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/testing/socket.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package nettesting contains utilities for testing networking functionality.
+// Don't use these utilities in production code. They have not been security
+// reviewed.
+package nettesting
+
+import (
+	"os"
+	goruntime "runtime"
+	"testing"
+)
+
+// MakeSocketNameForTest returns a socket name to use for the duration of a test.
+// On Operating systems that support abstract sockets, it the name is prefixed with `@` to make it an abstract socket.
+// On Operating systems that do not support abstract sockets, the name is treated as a filename and a cleanup hook is
+// registered to delete the socket at the end of the test.
+func MakeSocketNameForTest(t testing.TB, name string) string {
+	var sockname = name
+	switch goruntime.GOOS {
+	case "darwin", "windows":
+		t.Cleanup(func() { _ = os.Remove(sockname) })
+	default:
+		sockname = "@" + name
+	}
+	return sockname
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/util.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/util.go
new file mode 100644
index 0000000000..1635e69a5c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/util.go
@@ -0,0 +1,63 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"errors"
+	"net"
+	"reflect"
+	"strings"
+	"syscall"
+)
+
+// IPNetEqual checks if the two input IPNets are representing the same subnet.
+// For example,
+//
+//	10.0.0.1/24 and 10.0.0.0/24 are the same subnet.
+//	10.0.0.1/24 and 10.0.0.0/25 are not the same subnet.
+func IPNetEqual(ipnet1, ipnet2 *net.IPNet) bool {
+	if ipnet1 == nil || ipnet2 == nil {
+		return false
+	}
+	if reflect.DeepEqual(ipnet1.Mask, ipnet2.Mask) && ipnet1.Contains(ipnet2.IP) && ipnet2.Contains(ipnet1.IP) {
+		return true
+	}
+	return false
+}
+
+// Returns if the given err is "connection reset by peer" error.
+func IsConnectionReset(err error) bool {
+	var errno syscall.Errno
+	if errors.As(err, &errno) {
+		return errno == syscall.ECONNRESET
+	}
+	return false
+}
+
+// Returns if the given err is "http2: client connection lost" error.
+func IsHTTP2ConnectionLost(err error) bool {
+	return err != nil && strings.Contains(err.Error(), "http2: client connection lost")
+}
+
+// Returns if the given err is "connection refused" error
+func IsConnectionRefused(err error) bool {
+	var errno syscall.Errno
+	if errors.As(err, &errno) {
+		return errno == syscall.ECONNREFUSED
+	}
+	return false
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/util_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/util_test.go
new file mode 100644
index 0000000000..90b14a864c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/net/util_test.go
@@ -0,0 +1,201 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"syscall"
+	"testing"
+	"time"
+
+	"golang.org/x/net/http2"
+
+	netutils "k8s.io/utils/net"
+)
+
+func getIPNet(cidr string) *net.IPNet {
+	_, ipnet, _ := netutils.ParseCIDRSloppy(cidr)
+	return ipnet
+}
+
+func TestIPNetEqual(t *testing.T) {
+	testCases := []struct {
+		ipnet1 *net.IPNet
+		ipnet2 *net.IPNet
+		expect bool
+	}{
+		// null case
+		{
+			getIPNet("10.0.0.1/24"),
+			getIPNet(""),
+			false,
+		},
+		{
+			getIPNet("10.0.0.0/24"),
+			getIPNet("10.0.0.0/24"),
+			true,
+		},
+		{
+			getIPNet("10.0.0.0/24"),
+			getIPNet("10.0.0.1/24"),
+			true,
+		},
+		{
+			getIPNet("10.0.0.0/25"),
+			getIPNet("10.0.0.0/24"),
+			false,
+		},
+		{
+			getIPNet("10.0.1.0/24"),
+			getIPNet("10.0.0.0/24"),
+			false,
+		},
+	}
+
+	for _, tc := range testCases {
+		if tc.expect != IPNetEqual(tc.ipnet1, tc.ipnet2) {
+			t.Errorf("Expect equality of %s and %s be to %v", tc.ipnet1.String(), tc.ipnet2.String(), tc.expect)
+		}
+	}
+}
+
+func TestIsConnectionRefused(t *testing.T) {
+	testCases := []struct {
+		err    error
+		expect bool
+	}{
+		{
+			&url.Error{Err: &net.OpError{Err: syscall.ECONNRESET}},
+			false,
+		},
+		{
+			&url.Error{Err: &net.OpError{Err: syscall.ECONNREFUSED}},
+			true,
+		},
+		{&url.Error{Err: &net.OpError{Err: &os.SyscallError{Err: syscall.ECONNREFUSED}}},
+			true,
+		},
+	}
+
+	for _, tc := range testCases {
+		if result := IsConnectionRefused(tc.err); result != tc.expect {
+			t.Errorf("Expect to be %v, but actual is %v", tc.expect, result)
+		}
+	}
+}
+
+type tcpLB struct {
+	t         *testing.T
+	ln        net.Listener
+	serverURL string
+}
+
+func (lb *tcpLB) handleConnection(in net.Conn, stopCh chan struct{}) {
+	out, err := net.Dial("tcp", lb.serverURL)
+	if err != nil {
+		lb.t.Log(err)
+		return
+	}
+	go io.Copy(out, in)
+	go io.Copy(in, out)
+	<-stopCh
+	if err := out.Close(); err != nil {
+		lb.t.Fatalf("failed to close connection: %v", err)
+	}
+}
+
+func (lb *tcpLB) serve(stopCh chan struct{}) {
+	conn, err := lb.ln.Accept()
+	if err != nil {
+		lb.t.Fatalf("failed to accept: %v", err)
+	}
+	lb.handleConnection(conn, stopCh)
+}
+
+func newLB(t *testing.T, serverURL string) *tcpLB {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("failed to bind: %v", err)
+	}
+	lb := tcpLB{
+		serverURL: serverURL,
+		ln:        ln,
+		t:         t,
+	}
+	return &lb
+}
+
+func TestIsConnectionReset(t *testing.T) {
+	ts := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintf(w, "Hello, %s", r.Proto)
+	}))
+	ts.EnableHTTP2 = true
+	ts.StartTLS()
+	defer ts.Close()
+
+	u, err := url.Parse(ts.URL)
+	if err != nil {
+		t.Fatalf("failed to parse URL from %q: %v", ts.URL, err)
+	}
+	lb := newLB(t, u.Host)
+	defer lb.ln.Close()
+	stopCh, stoppedCh := make(chan struct{}), make(chan struct{})
+	go func() {
+		defer close(stoppedCh)
+		lb.serve(stopCh)
+	}()
+
+	c := ts.Client()
+	transport, ok := ts.Client().Transport.(*http.Transport)
+	if !ok {
+		t.Fatalf("failed to assert *http.Transport")
+	}
+	t2, err := http2.ConfigureTransports(transport)
+	if err != nil {
+		t.Fatalf("failed to configure *http.Transport: %+v", err)
+	}
+	t2.ReadIdleTimeout = time.Second
+	t2.PingTimeout = time.Second
+	resp, err := c.Get("https://" + lb.ln.Addr().String())
+	if err != nil {
+		t.Fatalf("unexpected error: %+v", err)
+	}
+	defer resp.Body.Close()
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatalf("unexpected error: %+v", err)
+	}
+	if string(data) != "Hello, HTTP/2.0" {
+		t.Fatalf("unexpected response: %s", data)
+	}
+
+	// Deliberately let the LB stop proxying traffic for the current
+	// connection. This mimics a broken TCP connection that's not properly
+	// closed.
+	close(stopCh)
+	<-stoppedCh
+	_, err = c.Get("https://" + lb.ln.Addr().String())
+	if !IsHTTP2ConnectionLost(err) {
+		t.Fatalf("expected HTTP2ConnectionLost error, got %v", err)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/portforward/constants.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/portforward/constants.go
new file mode 100644
index 0000000000..6853288156
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/portforward/constants.go
@@ -0,0 +1,24 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package portforward
+
+const (
+	PortForwardV1Name                    = "portforward.k8s.io"
+	WebsocketsSPDYTunnelingPrefix        = "SPDY/3.1+"
+	KubernetesSuffix                     = ".k8s.io"
+	WebsocketsSPDYTunnelingPortForwardV1 = WebsocketsSPDYTunnelingPrefix + PortForwardV1Name
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/dial.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/dial.go
new file mode 100644
index 0000000000..d6ba23d416
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/dial.go
@@ -0,0 +1,122 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+
+	utilnet "k8s.io/apimachinery/pkg/util/net"
+	"k8s.io/apimachinery/third_party/forked/golang/netutil"
+	"k8s.io/klog/v2"
+)
+
+// DialURL will dial the specified URL using the underlying dialer held by the passed
+// RoundTripper. The primary use of this method is to support proxying upgradable connections.
+// For this reason this method will prefer to negotiate http/1.1 if the URL scheme is https.
+// If you wish to ensure ALPN negotiates http2 then set NextProto=[]string{"http2"} in the
+// TLSConfig of the http.Transport
+func DialURL(ctx context.Context, url *url.URL, transport http.RoundTripper) (net.Conn, error) {
+	dialAddr := netutil.CanonicalAddr(url)
+
+	dialer, err := utilnet.DialerFor(transport)
+	if err != nil {
+		klog.FromContext(ctx).V(5).Info("Unable to unwrap transport to get dialer", "type", fmt.Sprintf("%T", transport), "err", err)
+	}
+
+	switch url.Scheme {
+	case "http":
+		if dialer != nil {
+			return dialer(ctx, "tcp", dialAddr)
+		}
+		var d net.Dialer
+		return d.DialContext(ctx, "tcp", dialAddr)
+	case "https":
+		// Get the tls config from the transport if we recognize it
+		tlsConfig, err := utilnet.TLSClientConfig(transport)
+		if err != nil {
+			klog.FromContext(ctx).V(5).Info("Unable to unwrap transport to get at TLS config", "type", fmt.Sprintf("%T", transport), "err", err)
+		}
+
+		if dialer != nil {
+			// We have a dialer; use it to open the connection, then
+			// create a tls client using the connection.
+			netConn, err := dialer(ctx, "tcp", dialAddr)
+			if err != nil {
+				return nil, err
+			}
+			if tlsConfig == nil {
+				// tls.Client requires non-nil config
+				klog.FromContext(ctx).Info("Warning: using custom dialer with no TLSClientConfig, defaulting to InsecureSkipVerify")
+				// tls.Handshake() requires ServerName or InsecureSkipVerify
+				tlsConfig = &tls.Config{
+					InsecureSkipVerify: true,
+				}
+			} else if len(tlsConfig.ServerName) == 0 && !tlsConfig.InsecureSkipVerify {
+				// tls.HandshakeContext() requires ServerName or InsecureSkipVerify
+				// infer the ServerName from the hostname we're connecting to.
+				inferredHost := dialAddr
+				if host, _, err := net.SplitHostPort(dialAddr); err == nil {
+					inferredHost = host
+				}
+				// Make a copy to avoid polluting the provided config
+				tlsConfigCopy := tlsConfig.Clone()
+				tlsConfigCopy.ServerName = inferredHost
+				tlsConfig = tlsConfigCopy
+			}
+
+			// Since this method is primarily used within a "Connection: Upgrade" call we assume the caller is
+			// going to write HTTP/1.1 request to the wire. http2 should not be allowed in the TLSConfig.NextProtos,
+			// so we explicitly set that here. We only do this check if the TLSConfig support http/1.1.
+			if supportsHTTP11(tlsConfig.NextProtos) {
+				tlsConfig = tlsConfig.Clone()
+				tlsConfig.NextProtos = []string{"http/1.1"}
+			}
+
+			tlsConn := tls.Client(netConn, tlsConfig)
+			if err := tlsConn.HandshakeContext(ctx); err != nil {
+				netConn.Close()
+				return nil, err
+			}
+			return tlsConn, nil
+		} else {
+			// Dial.
+			tlsDialer := tls.Dialer{
+				Config: tlsConfig,
+			}
+			return tlsDialer.DialContext(ctx, "tcp", dialAddr)
+		}
+	default:
+		return nil, fmt.Errorf("unknown scheme: %s", url.Scheme)
+	}
+}
+
+func supportsHTTP11(nextProtos []string) bool {
+	if len(nextProtos) == 0 {
+		return true
+	}
+	for _, proto := range nextProtos {
+		if proto == "http/1.1" {
+			return true
+		}
+	}
+	return false
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/dial_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/dial_test.go
new file mode 100644
index 0000000000..488e878b72
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/dial_test.go
@@ -0,0 +1,230 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"reflect"
+	"regexp"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	utilnet "k8s.io/apimachinery/pkg/util/net"
+)
+
+func TestDialURL(t *testing.T) {
+	roots := x509.NewCertPool()
+	if !roots.AppendCertsFromPEM(localhostCert) {
+		t.Fatal("error setting up localhostCert pool")
+	}
+
+	cert, err := tls.X509KeyPair(localhostCert, localhostKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var d net.Dialer
+
+	testcases := map[string]struct {
+		TLSConfig   *tls.Config
+		Dial        utilnet.DialFunc
+		ExpectError string
+		ExpectProto string
+	}{
+		"insecure": {
+			TLSConfig: &tls.Config{InsecureSkipVerify: true},
+		},
+		"secure, no roots": {
+			TLSConfig:   &tls.Config{InsecureSkipVerify: false},
+			ExpectError: "unknown authority|not trusted",
+		},
+		"secure with roots": {
+			TLSConfig: &tls.Config{InsecureSkipVerify: false, RootCAs: roots},
+		},
+		"secure with mismatched server": {
+			TLSConfig:   &tls.Config{InsecureSkipVerify: false, RootCAs: roots, ServerName: "bogus.com"},
+			ExpectError: "not bogus.com",
+		},
+		"secure with matched server": {
+			TLSConfig: &tls.Config{InsecureSkipVerify: false, RootCAs: roots, ServerName: "example.com"},
+		},
+
+		"insecure, custom dial": {
+			TLSConfig: &tls.Config{InsecureSkipVerify: true},
+			Dial:      d.DialContext,
+		},
+		"secure, no roots, custom dial": {
+			TLSConfig:   &tls.Config{InsecureSkipVerify: false},
+			Dial:        d.DialContext,
+			ExpectError: "unknown authority|not trusted",
+		},
+		"secure with roots, custom dial": {
+			TLSConfig: &tls.Config{InsecureSkipVerify: false, RootCAs: roots},
+			Dial:      d.DialContext,
+		},
+		"secure with mismatched server, custom dial": {
+			TLSConfig:   &tls.Config{InsecureSkipVerify: false, RootCAs: roots, ServerName: "bogus.com"},
+			Dial:        d.DialContext,
+			ExpectError: "not bogus.com",
+		},
+		"secure with matched server, custom dial": {
+			TLSConfig: &tls.Config{InsecureSkipVerify: false, RootCAs: roots, ServerName: "example.com"},
+			Dial:      d.DialContext,
+		},
+		"ensure we use http2 if specified": {
+			TLSConfig:   &tls.Config{InsecureSkipVerify: false, RootCAs: roots, ServerName: "example.com", NextProtos: []string{"http2"}},
+			Dial:        d.DialContext,
+			ExpectProto: "http2",
+		},
+		"ensure we use http/1.1 if unspecified": {
+			TLSConfig:   &tls.Config{InsecureSkipVerify: false, RootCAs: roots, ServerName: "example.com"},
+			Dial:        d.DialContext,
+			ExpectProto: "http/1.1",
+		},
+		"ensure we use http/1.1 if available": {
+			TLSConfig:   &tls.Config{InsecureSkipVerify: false, RootCAs: roots, ServerName: "example.com", NextProtos: []string{"http2", "http/1.1"}},
+			Dial:        d.DialContext,
+			ExpectProto: "http/1.1",
+		},
+	}
+
+	for k, tc := range testcases {
+		func() {
+			ts := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {}))
+			defer ts.Close()
+			ts.TLS = &tls.Config{Certificates: []tls.Certificate{cert}, NextProtos: []string{"http2", "http/1.1"}}
+			ts.StartTLS()
+
+			// Make a copy of the config
+			tlsConfigCopy := tc.TLSConfig.Clone()
+			// Clone() mutates the receiver (!), so also call it on the copy
+			tlsConfigCopy.Clone()
+			transport := &http.Transport{
+				DialContext:     tc.Dial,
+				TLSClientConfig: tlsConfigCopy,
+			}
+
+			extractedDial, err := utilnet.DialerFor(transport)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if fmt.Sprintf("%p", extractedDial) != fmt.Sprintf("%p", tc.Dial) {
+				t.Fatalf("%s: Unexpected dial", k)
+			}
+
+			extractedTLSConfig, err := utilnet.TLSClientConfig(transport)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if extractedTLSConfig == nil {
+				t.Fatalf("%s: Expected tlsConfig", k)
+			}
+
+			u, _ := url.Parse(ts.URL)
+			_, p, _ := net.SplitHostPort(u.Host)
+			u.Host = net.JoinHostPort("127.0.0.1", p)
+			conn, err := DialURL(context.Background(), u, transport)
+
+			// Make sure dialing doesn't mutate the transport's TLSConfig
+			if !reflect.DeepEqual(tc.TLSConfig, tlsConfigCopy) {
+				t.Errorf("%s: transport's copy of TLSConfig was mutated\n%s", k, cmp.Diff(tc.TLSConfig, tlsConfigCopy))
+			}
+
+			if err != nil {
+				if tc.ExpectError == "" {
+					t.Errorf("%s: expected no error, got %q", k, err.Error())
+				}
+				if tc.ExpectError != "" && !regexp.MustCompile(tc.ExpectError).MatchString(err.Error()) {
+					t.Errorf("%s: expected error containing %q, got %q", k, tc.ExpectError, err.Error())
+				}
+				return
+			}
+
+			tlsConn := conn.(*tls.Conn)
+			if tc.ExpectProto != "" {
+				if tlsConn.ConnectionState().NegotiatedProtocol != tc.ExpectProto {
+					t.Errorf("%s: expected proto %s, got %s", k, tc.ExpectProto, tlsConn.ConnectionState().NegotiatedProtocol)
+				}
+			}
+
+			conn.Close()
+			if tc.ExpectError != "" {
+				t.Errorf("%s: expected error %q, got none", k, tc.ExpectError)
+			}
+		}()
+	}
+
+}
+
+// localhostCert was generated from crypto/tls/generate_cert.go with the following command:
+//
+//	go run generate_cert.go  --rsa-bits 2048 --host 127.0.0.1,::1,example.com --ca --start-date "Jan 1 00:00:00 1970" --duration=1000000h
+var localhostCert = []byte(`-----BEGIN CERTIFICATE-----
+MIIDGTCCAgGgAwIBAgIRAKfNl1LEAt7nFPYvHBnpv2swDQYJKoZIhvcNAQELBQAw
+EjEQMA4GA1UEChMHQWNtZSBDbzAgFw03MDAxMDEwMDAwMDBaGA8yMDg0MDEyOTE2
+MDAwMFowEjEQMA4GA1UEChMHQWNtZSBDbzCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAKww39FwmV5lDIbAUIAuSYYVtZke6bca1oyq19ZrRL0uavwPXSJm
++Qxt4RKUQhzYhZ/alJp8iRfu/Z+Yv9Beez89dQB9V8YnHj/AX4Jph9lJ2aawWMI6
+AqPLdIzKLQVVvPw+UVKH9x8yy08H/23AIFGyK4Dbht+KZJeUbJQFiGlRFJim8atx
+KA3C9NzCHw6hyhP46jguLl65rcxLMSzcTz97ToG0MP66YEUbsA/YzFTKDwht7ESH
+nRMBnQ4wZfWpvAiXMr3XJGOa3NYJy1A+WkWyrfZO7guwsZ4L6dGqnlPpzA5QkKYx
+H9Z5K1bUaYEi0Yi2ug7Jkvd1HE179nkF7t0CAwEAAaNoMGYwDgYDVR0PAQH/BAQD
+AgKkMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wLgYDVR0R
+BCcwJYILZXhhbXBsZS5jb22HBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZI
+hvcNAQELBQADggEBAAKSQToD1iLujFhQwaLnPVRV6r4nEFVXCxXYtQNEX1DVSKSj
+JYbBGJnL50oc0N4Ar+Spqofm+THkiTQJUzptPtnYIzNpKYdE6+bPwqURWzFEI2OF
+ks3fYZ4ZdbMbmJRo1qPJO34emm4KrOl9aoV0qwp2QyTvHgLroU3icKoe4e7+p4KK
+02Rt3qczHvCKoUnw6m07Ql0n9e7Ncpujcs2A8PaQ1iPX+BVOmvjTVT8y5NSRDzwL
+a2wur8BSZ5E8SVzzvNZJlLSi6BbObQUjALHkjVYm11dWv/BY8jHdt+iFhbNBRASx
+ENuih3pX1Poki1qRYOtB/vAS99E1ORj9zJlUlzo=
+-----END CERTIFICATE-----`)
+
+// localhostKey is the private key for localhostCert.
+var localhostKey = []byte(`-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEArDDf0XCZXmUMhsBQgC5JhhW1mR7ptxrWjKrX1mtEvS5q/A9d
+Imb5DG3hEpRCHNiFn9qUmnyJF+79n5i/0F57Pz11AH1XxiceP8BfgmmH2UnZprBY
+wjoCo8t0jMotBVW8/D5RUof3HzLLTwf/bcAgUbIrgNuG34pkl5RslAWIaVEUmKbx
+q3EoDcL03MIfDqHKE/jqOC4uXrmtzEsxLNxPP3tOgbQw/rpgRRuwD9jMVMoPCG3s
+RIedEwGdDjBl9am8CJcyvdckY5rc1gnLUD5aRbKt9k7uC7Cxngvp0aqeU+nMDlCQ
+pjEf1nkrVtRpgSLRiLa6DsmS93UcTXv2eQXu3QIDAQABAoIBACAYnB+2FWB7BXK4
+tkiuWBYeRdNc58OxxPxDfCgDprR8yoRheMLI3vNqJ+IGsKwf0AiT/c8uF3/WlIAD
+QP3eHqsTEZQdyRaug/zuJt9wPFpMYb2ocWMC3Ssa6Ya0yN+Ns8Rw+UehAHdYSH1a
+yEn03hFcXK+QO/u/GDEJAZQ108+NdznT4ql59tt791d97meNlMVJwkwVf/NqtDqi
+UNx6BvSj5+6MoWjU8hqrYv9pkzP386QRsl70tVH+0LZd5XUZsSyof/IdV1EmfGUR
+5les8tsd+fuo3LaPObksJu+GBwvEStmQPjZjiBUzw0Sx8VYTJfZr7gl2h4mmk/AJ
+F5P+fSECgYEAzwDcJCuYPA8nzVB+ZOM+Wl+3uUKG/Xn8Yx8uWtWU7o9qsJmasLqO
+sLtz1zadPtYOBXsb4H5PisNPuosVEqnthjRwmPhIA3tK/X3UzhnriACCrKpg3Ix0
+uJG2vqpdaPXYxmyTQfI8YSp5X0gTg3R4xQqmbGMyAQg+1NzcGAf+qQ8CgYEA1PKX
+vkxzJuSPsfQYr34fnZRuogANNGUaWCTYMhH6sK8qrJu5RXmEemaraqT/esUUu1fl
+cTAxRqUb8ysexA+RKR848hFkrvAR5M1t6xK2hPuSec1Lm9HNfHoFB7Pa5t7APoJ9
+8NkjNzI0mL9YqYcfJpzfFrxtzfLwlm6B3irS8VMCgYBg3skmUBRcvsbkiO+tLL7I
+MhTbKGvdgNGAXV4m+d5JSWonHKrMW3Fc+Uv7gb5SYn+LRxJDmziD+mR8KowBAO57
+qFys6TtiDbeJKvKERJL5QSvlu5G6hCw3F1GKplUyQiJgsPy0lrR00BieYy9mjAHc
+S+CXxk/nNcGZgYWp5UviNwKBgC7t46kpmfsJRe222LXcOsV0j8kd78sLOPoR7J9k
+PPYxNFtj2jnIZPzAoahYAoGg60e6QDNopoNmIbm+WAJnV9tTKS6XzLOM7rSY3U+A
+CT9XXdl/99i4LOvwzCj9ZxGYJ4/fHDg28j7YzqSXDsgVojTVP4j4L87CamkMo4w9
+rc1HAoGARE2WActS2PF75jRXCjj4SjB/3vOJVGKxrJdoo2HPzY0psTmdJJULOGYZ
+MU1KC4EDzhSfM3juBbEhaZx9NFZOHVp2hxZpg77B5cQXGH6HIiZ20jCNjdcioHl9
+HeVeFG/9rJG0NcQe3pIm9f0EY5JCbzr0fa2tTPV3N9jGHc0sFtI=
+-----END RSA PRIVATE KEY-----
+`)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/doc.go
new file mode 100644
index 0000000000..ea710f6b15
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/doc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package proxy provides transport and upgrade support for proxies.
+package proxy
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/transport.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/transport.go
new file mode 100644
index 0000000000..1c17f53df0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/transport.go
@@ -0,0 +1,272 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"bytes"
+	"compress/flate"
+	"compress/gzip"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"path"
+	"strings"
+
+	"golang.org/x/net/html"
+	"golang.org/x/net/html/atom"
+	"k8s.io/klog/v2"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/util/net"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// atomsToAttrs states which attributes of which tags require URL substitution.
+// Sources: http://www.w3.org/TR/REC-html40/index/attributes.html
+//
+//	http://www.w3.org/html/wg/drafts/html/master/index.html#attributes-1
+var atomsToAttrs = map[atom.Atom]sets.String{
+	atom.A:          sets.NewString("href"),
+	atom.Applet:     sets.NewString("codebase"),
+	atom.Area:       sets.NewString("href"),
+	atom.Audio:      sets.NewString("src"),
+	atom.Base:       sets.NewString("href"),
+	atom.Blockquote: sets.NewString("cite"),
+	atom.Body:       sets.NewString("background"),
+	atom.Button:     sets.NewString("formaction"),
+	atom.Command:    sets.NewString("icon"),
+	atom.Del:        sets.NewString("cite"),
+	atom.Embed:      sets.NewString("src"),
+	atom.Form:       sets.NewString("action"),
+	atom.Frame:      sets.NewString("longdesc", "src"),
+	atom.Head:       sets.NewString("profile"),
+	atom.Html:       sets.NewString("manifest"),
+	atom.Iframe:     sets.NewString("longdesc", "src"),
+	atom.Img:        sets.NewString("longdesc", "src", "usemap"),
+	atom.Input:      sets.NewString("src", "usemap", "formaction"),
+	atom.Ins:        sets.NewString("cite"),
+	atom.Link:       sets.NewString("href"),
+	atom.Object:     sets.NewString("classid", "codebase", "data", "usemap"),
+	atom.Q:          sets.NewString("cite"),
+	atom.Script:     sets.NewString("src"),
+	atom.Source:     sets.NewString("src"),
+	atom.Video:      sets.NewString("poster", "src"),
+
+	// TODO: css URLs hidden in style elements.
+}
+
+// Transport is a transport for text/html content that replaces URLs in html
+// content with the prefix of the proxy server
+type Transport struct {
+	Scheme      string
+	Host        string
+	PathPrepend string
+
+	http.RoundTripper
+}
+
+// RoundTrip implements the http.RoundTripper interface
+func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
+	// Add reverse proxy headers.
+	forwardedURI := path.Join(t.PathPrepend, req.URL.EscapedPath())
+	if strings.HasSuffix(req.URL.Path, "/") {
+		forwardedURI = forwardedURI + "/"
+	}
+	req.Header.Set("X-Forwarded-Uri", forwardedURI)
+	if len(t.Host) > 0 {
+		req.Header.Set("X-Forwarded-Host", t.Host)
+	}
+	if len(t.Scheme) > 0 {
+		req.Header.Set("X-Forwarded-Proto", t.Scheme)
+	}
+
+	rt := t.RoundTripper
+	if rt == nil {
+		rt = http.DefaultTransport
+	}
+	resp, err := rt.RoundTrip(req)
+
+	if err != nil {
+		return nil, errors.NewServiceUnavailable(fmt.Sprintf("error trying to reach service: %v", err))
+	}
+
+	if redirect := resp.Header.Get("Location"); redirect != "" {
+		targetURL, err := url.Parse(redirect)
+		if err != nil {
+			return nil, errors.NewInternalError(fmt.Errorf("error trying to parse Location header: %v", err))
+		}
+		resp.Header.Set("Location", t.rewriteURL(targetURL, req.URL, req.Host))
+		return resp, nil
+	}
+
+	cType := resp.Header.Get("Content-Type")
+	cType = strings.TrimSpace(strings.SplitN(cType, ";", 2)[0])
+	if cType != "text/html" {
+		// Do nothing, simply pass through
+		return resp, nil
+	}
+
+	return t.rewriteResponse(req, resp)
+}
+
+var _ = net.RoundTripperWrapper(&Transport{})
+
+func (rt *Transport) WrappedRoundTripper() http.RoundTripper {
+	return rt.RoundTripper
+}
+
+// rewriteURL rewrites a single URL to go through the proxy, if the URL refers
+// to the same host as sourceURL, which is the page on which the target URL
+// occurred, or if the URL matches the sourceRequestHost.
+func (t *Transport) rewriteURL(url *url.URL, sourceURL *url.URL, sourceRequestHost string) string {
+	// Example:
+	//      When API server processes a proxy request to a service (e.g. /api/v1/namespace/foo/service/bar/proxy/),
+	//      the sourceURL.Host (i.e. req.URL.Host) is the endpoint IP address of the service. The
+	//      sourceRequestHost (i.e. req.Host) is the Host header that specifies the host on which the
+	//      URL is sought, which can be different from sourceURL.Host. For example, if user sends the
+	//      request through "kubectl proxy" locally (i.e. localhost:8001/api/v1/namespace/foo/service/bar/proxy/),
+	//      sourceRequestHost is "localhost:8001".
+	//
+	//      If the service's response URL contains non-empty host, and url.Host is equal to either sourceURL.Host
+	//      or sourceRequestHost, we should not consider the returned URL to be a completely different host.
+	//      It's the API server's responsibility to rewrite a same-host-and-absolute-path URL and append the
+	//      necessary URL prefix (i.e. /api/v1/namespace/foo/service/bar/proxy/).
+	isDifferentHost := url.Host != "" && url.Host != sourceURL.Host && url.Host != sourceRequestHost
+	isRelative := !strings.HasPrefix(url.Path, "/")
+	if isDifferentHost || isRelative {
+		return url.String()
+	}
+
+	// Do not rewrite scheme and host if the Transport has empty scheme and host
+	// when targetURL already contains the sourceRequestHost
+	if !(url.Host == sourceRequestHost && t.Scheme == "" && t.Host == "") {
+		url.Scheme = t.Scheme
+		url.Host = t.Host
+	}
+
+	origPath := url.Path
+	// Do not rewrite URL if the sourceURL already contains the necessary prefix.
+	if strings.HasPrefix(url.Path, t.PathPrepend) {
+		return url.String()
+	}
+	url.Path = path.Join(t.PathPrepend, url.Path)
+	if strings.HasSuffix(origPath, "/") {
+		// Add back the trailing slash, which was stripped by path.Join().
+		url.Path += "/"
+	}
+
+	return url.String()
+}
+
+// rewriteHTML scans the HTML for tags with url-valued attributes, and updates
+// those values with the urlRewriter function. The updated HTML is output to the
+// writer.
+func rewriteHTML(reader io.Reader, writer io.Writer, urlRewriter func(*url.URL) string) error {
+	// Note: This assumes the content is UTF-8.
+	tokenizer := html.NewTokenizer(reader)
+
+	var err error
+	for err == nil {
+		tokenType := tokenizer.Next()
+		switch tokenType {
+		case html.ErrorToken:
+			err = tokenizer.Err()
+		case html.StartTagToken, html.SelfClosingTagToken:
+			token := tokenizer.Token()
+			if urlAttrs, ok := atomsToAttrs[token.DataAtom]; ok {
+				for i, attr := range token.Attr {
+					if urlAttrs.Has(attr.Key) {
+						url, err := url.Parse(attr.Val)
+						if err != nil {
+							// Do not rewrite the URL if it isn't valid.  It is intended not
+							// to error here to prevent the inability to understand the
+							// content of the body to cause a fatal error.
+							continue
+						}
+						token.Attr[i].Val = urlRewriter(url)
+					}
+				}
+			}
+			_, err = writer.Write([]byte(token.String()))
+		default:
+			_, err = writer.Write(tokenizer.Raw())
+		}
+	}
+	if err != io.EOF {
+		return err
+	}
+	return nil
+}
+
+// rewriteResponse modifies an HTML response by updating absolute links referring
+// to the original host to instead refer to the proxy transport.
+func (t *Transport) rewriteResponse(req *http.Request, resp *http.Response) (*http.Response, error) {
+	origBody := resp.Body
+	defer origBody.Close()
+
+	newContent := &bytes.Buffer{}
+	var reader io.Reader = origBody
+	var writer io.Writer = newContent
+	encoding := resp.Header.Get("Content-Encoding")
+	switch encoding {
+	case "gzip":
+		var err error
+		reader, err = gzip.NewReader(reader)
+		if err != nil {
+			return nil, fmt.Errorf("errorf making gzip reader: %v", err)
+		}
+		gzw := gzip.NewWriter(writer)
+		defer gzw.Close()
+		writer = gzw
+	case "deflate":
+		var err error
+		reader = flate.NewReader(reader)
+		flw, err := flate.NewWriter(writer, flate.BestCompression)
+		if err != nil {
+			return nil, fmt.Errorf("errorf making flate writer: %v", err)
+		}
+		defer func() {
+			flw.Close()
+			flw.Flush()
+		}()
+		writer = flw
+	case "":
+		// This is fine
+	default:
+		// Some encoding we don't understand-- don't try to parse this
+		klog.FromContext(req.Context()).Error(nil, "Proxy encountered unknown encoding for text/html, can't understand this so not fixing links", "encoding", encoding)
+		return resp, nil
+	}
+
+	urlRewriter := func(targetUrl *url.URL) string {
+		return t.rewriteURL(targetUrl, req.URL, req.Host)
+	}
+	err := rewriteHTML(reader, writer, urlRewriter)
+	if err != nil {
+		klog.FromContext(req.Context()).Error(err, "Failed to rewrite URLs")
+		return resp, err
+	}
+
+	resp.Body = io.NopCloser(newContent)
+	// Update header node with new content-length
+	// TODO: Remove any hash/signature headers here?
+	resp.Header.Del("Content-Length")
+	resp.ContentLength = int64(newContent.Len())
+
+	return resp, err
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/transport_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/transport_test.go
new file mode 100644
index 0000000000..a50f1e406c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/transport_test.go
@@ -0,0 +1,396 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"bytes"
+	"compress/flate"
+	"compress/gzip"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+)
+
+func parseURLOrDie(inURL string) *url.URL {
+	parsed, err := url.Parse(inURL)
+	if err != nil {
+		panic(err)
+	}
+	return parsed
+}
+
+func TestProxyTransport(t *testing.T) {
+	testTransport := &Transport{
+		Scheme:      "http",
+		Host:        "foo.com",
+		PathPrepend: "/proxy/node/node1:10250",
+	}
+	testTransport2 := &Transport{
+		Scheme:      "https",
+		Host:        "foo.com",
+		PathPrepend: "/proxy/node/node1:8080",
+	}
+	emptyHostTransport := &Transport{
+		Scheme:      "https",
+		PathPrepend: "/proxy/node/node1:10250",
+	}
+	emptySchemeTransport := &Transport{
+		Host:        "foo.com",
+		PathPrepend: "/proxy/node/node1:10250",
+	}
+	emptyHostAndSchemeTransport := &Transport{
+		PathPrepend: "/proxy/node/node1:10250",
+	}
+	type Item struct {
+		input        string
+		sourceURL    string
+		transport    *Transport
+		output       string
+		contentType  string
+		forwardedURI string
+		redirect     string
+		redirectWant string
+		reqHost      string
+	}
+
+	table := map[string]Item{
+		"normal": {
+			input:        `<pre><a href="kubelet.log">kubelet.log</a><a href="/google.log">google.log</a></pre>`,
+			sourceURL:    "http://mynode.com/logs/log.log",
+			transport:    testTransport,
+			output:       `<pre><a href="kubelet.log">kubelet.log</a><a href="http://foo.com/proxy/node/node1:10250/google.log">google.log</a></pre>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"full document": {
+			input:        `<html><header></header><body><pre><a href="kubelet.log">kubelet.log</a><a href="/google.log">google.log</a></pre></body></html>`,
+			sourceURL:    "http://mynode.com/logs/log.log",
+			transport:    testTransport,
+			output:       `<html><header></header><body><pre><a href="kubelet.log">kubelet.log</a><a href="http://foo.com/proxy/node/node1:10250/google.log">google.log</a></pre></body></html>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"trailing slash": {
+			input:        `<pre><a href="kubelet.log">kubelet.log</a><a href="/google.log/">google.log</a></pre>`,
+			sourceURL:    "http://mynode.com/logs/log.log",
+			transport:    testTransport,
+			output:       `<pre><a href="kubelet.log">kubelet.log</a><a href="http://foo.com/proxy/node/node1:10250/google.log/">google.log</a></pre>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"content-type charset": {
+			input:        `<pre><a href="kubelet.log">kubelet.log</a><a href="/google.log">google.log</a></pre>`,
+			sourceURL:    "http://mynode.com/logs/log.log",
+			transport:    testTransport,
+			output:       `<pre><a href="kubelet.log">kubelet.log</a><a href="http://foo.com/proxy/node/node1:10250/google.log">google.log</a></pre>`,
+			contentType:  "text/html; charset=utf-8",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"content-type passthrough": {
+			input:        `<pre><a href="kubelet.log">kubelet.log</a><a href="/google.log">google.log</a></pre>`,
+			sourceURL:    "http://mynode.com/logs/log.log",
+			transport:    testTransport,
+			output:       `<pre><a href="kubelet.log">kubelet.log</a><a href="/google.log">google.log</a></pre>`,
+			contentType:  "text/plain",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"subdir": {
+			input:        `<a href="kubelet.log">kubelet.log</a><a href="/google.log">google.log</a>`,
+			sourceURL:    "http://mynode.com/whatever/apt/somelog.log",
+			transport:    testTransport2,
+			output:       `<a href="kubelet.log">kubelet.log</a><a href="https://foo.com/proxy/node/node1:8080/google.log">google.log</a>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:8080/whatever/apt/somelog.log",
+		},
+		"image": {
+			input:        `<pre><img src="kubernetes.jpg"/><img src="/kubernetes_abs.jpg"/></pre>`,
+			sourceURL:    "http://mynode.com/",
+			transport:    testTransport,
+			output:       `<pre><img src="kubernetes.jpg"/><img src="http://foo.com/proxy/node/node1:10250/kubernetes_abs.jpg"/></pre>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/",
+		},
+		"abs": {
+			input:        `<script src="http://google.com/kubernetes.js"/>`,
+			sourceURL:    "http://mynode.com/any/path/",
+			transport:    testTransport,
+			output:       `<script src="http://google.com/kubernetes.js"/>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/any/path/",
+		},
+		"abs but same host": {
+			input:        `<script src="http://mynode.com/kubernetes.js"/>`,
+			sourceURL:    "http://mynode.com/any/path/",
+			transport:    testTransport,
+			output:       `<script src="http://foo.com/proxy/node/node1:10250/kubernetes.js"/>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/any/path/",
+		},
+		"redirect rel": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    testTransport,
+			redirect:     "/redirected/target/",
+			redirectWant: "http://foo.com/proxy/node/node1:10250/redirected/target/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+		},
+		"redirect abs same host": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    testTransport,
+			redirect:     "http://mynode.com/redirected/target/",
+			redirectWant: "http://foo.com/proxy/node/node1:10250/redirected/target/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+		},
+		"redirect abs other host": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    testTransport,
+			redirect:     "http://example.com/redirected/target/",
+			redirectWant: "http://example.com/redirected/target/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+		},
+		"redirect abs use reqHost no host no scheme": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    emptyHostAndSchemeTransport,
+			redirect:     "http://10.0.0.1:8001/redirected/target/",
+			redirectWant: "http://10.0.0.1:8001/proxy/node/node1:10250/redirected/target/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+			reqHost:      "10.0.0.1:8001",
+		},
+		"source contains the redirect already": {
+			input:        `<pre><a href="kubelet.log">kubelet.log</a><a href="http://foo.com/proxy/node/node1:10250/google.log">google.log</a></pre>`,
+			sourceURL:    "http://foo.com/logs/log.log",
+			transport:    testTransport,
+			output:       `<pre><a href="kubelet.log">kubelet.log</a><a href="http://foo.com/proxy/node/node1:10250/google.log">google.log</a></pre>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"no host": {
+			input:        "<html></html>",
+			sourceURL:    "http://mynode.com/logs/log.log",
+			transport:    emptyHostTransport,
+			output:       "<html></html>",
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"no scheme": {
+			input:        "<html></html>",
+			sourceURL:    "http://mynode.com/logs/log.log",
+			transport:    emptySchemeTransport,
+			output:       "<html></html>",
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"forwarded URI must be escaped": {
+			input:        "<html></html>",
+			sourceURL:    "http://mynode.com/logs/log.log%00<script>alert(1)</script>",
+			transport:    testTransport,
+			output:       "<html></html>",
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log%00%3Cscript%3Ealert%281%29%3C/script%3E",
+		},
+		"redirect rel must be escaped": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    testTransport,
+			redirect:     "/redirected/target/%00<script>alert(1)</script>/",
+			redirectWant: "http://foo.com/proxy/node/node1:10250/redirected/target/%00%3Cscript%3Ealert%281%29%3C/script%3E/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+		},
+		"redirect abs same host must be escaped": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    testTransport,
+			redirect:     "http://mynode.com/redirected/target/%00<script>alert(1)</script>/",
+			redirectWant: "http://foo.com/proxy/node/node1:10250/redirected/target/%00%3Cscript%3Ealert%281%29%3C/script%3E/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+		},
+		"redirect abs other host must be escaped": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    testTransport,
+			redirect:     "http://example.com/redirected/target/%00<script>alert(1)</script>/",
+			redirectWant: "http://example.com/redirected/target/%00%3Cscript%3Ealert%281%29%3C/script%3E/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+		},
+		"redirect abs use reqHost no host no scheme must be escaped": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    emptyHostAndSchemeTransport,
+			redirect:     "http://10.0.0.1:8001/redirected/target/%00<script>alert(1)</script>/",
+			redirectWant: "http://10.0.0.1:8001/proxy/node/node1:10250/redirected/target/%00%3Cscript%3Ealert%281%29%3C/script%3E/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+			reqHost:      "10.0.0.1:8001",
+		},
+	}
+
+	testItem := func(name string, item *Item) {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// Check request headers.
+			if got, want := r.Header.Get("X-Forwarded-Uri"), item.forwardedURI; got != want {
+				t.Errorf("%v: X-Forwarded-Uri = %q, want %q", name, got, want)
+			}
+			if len(item.transport.Host) == 0 {
+				_, present := r.Header["X-Forwarded-Host"]
+				if present {
+					t.Errorf("%v: X-Forwarded-Host header should not be present", name)
+				}
+			} else {
+				if got, want := r.Header.Get("X-Forwarded-Host"), item.transport.Host; got != want {
+					t.Errorf("%v: X-Forwarded-Host = %q, want %q", name, got, want)
+				}
+			}
+			if len(item.transport.Scheme) == 0 {
+				_, present := r.Header["X-Forwarded-Proto"]
+				if present {
+					t.Errorf("%v: X-Forwarded-Proto header should not be present", name)
+				}
+			} else {
+				if got, want := r.Header.Get("X-Forwarded-Proto"), item.transport.Scheme; got != want {
+					t.Errorf("%v: X-Forwarded-Proto = %q, want %q", name, got, want)
+				}
+			}
+
+			// Send response.
+			if item.redirect != "" {
+				http.Redirect(w, r, item.redirect, http.StatusMovedPermanently)
+				return
+			}
+			w.Header().Set("Content-Type", item.contentType)
+			fmt.Fprint(w, item.input)
+		}))
+		defer server.Close()
+
+		// Replace source URL with our test server address.
+		sourceURL := parseURLOrDie(item.sourceURL)
+		serverURL := parseURLOrDie(server.URL)
+		item.input = strings.Replace(item.input, sourceURL.Host, serverURL.Host, -1)
+		item.redirect = strings.Replace(item.redirect, sourceURL.Host, serverURL.Host, -1)
+		sourceURL.Host = serverURL.Host
+
+		req, err := http.NewRequest(http.MethodGet, sourceURL.String(), nil)
+		if err != nil {
+			t.Errorf("%v: Unexpected error: %v", name, err)
+			return
+		}
+		if item.reqHost != "" {
+			req.Host = item.reqHost
+		}
+		resp, err := item.transport.RoundTrip(req)
+		if err != nil {
+			t.Errorf("%v: Unexpected error: %v", name, err)
+			return
+		}
+		if item.redirect != "" {
+			// Check that redirect URLs get rewritten properly.
+			if got, want := resp.Header.Get("Location"), item.redirectWant; got != want {
+				t.Errorf("%v: Location header = %q, want %q", name, got, want)
+			}
+			return
+		}
+		body, err := io.ReadAll(resp.Body)
+		if err != nil {
+			t.Errorf("%v: Unexpected error: %v", name, err)
+			return
+		}
+		if e, a := item.output, string(body); e != a {
+			t.Errorf("%v: expected %v, but got %v", name, e, a)
+		}
+	}
+
+	for name, item := range table {
+		testItem(name, &item)
+	}
+}
+
+func TestRewriteResponse(t *testing.T) {
+	gzipbuf := bytes.NewBuffer(nil)
+	flatebuf := bytes.NewBuffer(nil)
+
+	testTransport := &Transport{
+		Scheme:      "http",
+		Host:        "foo.com",
+		PathPrepend: "/proxy/node/node1:10250",
+	}
+	expected := []string{
+		"short body test",
+		strings.Repeat("long body test", 4097),
+	}
+	test := []struct {
+		encodeType string
+		writer     func(string) *http.Response
+		reader     func(*http.Response) string
+	}{
+		{
+			encodeType: "gzip",
+			writer: func(ept string) *http.Response {
+				gzw := gzip.NewWriter(gzipbuf)
+				defer gzw.Close()
+
+				gzw.Write([]byte(ept))
+				gzw.Flush()
+				return &http.Response{
+					Body: io.NopCloser(gzipbuf),
+				}
+			},
+			reader: func(rep *http.Response) string {
+				reader, _ := gzip.NewReader(rep.Body)
+				s, _ := io.ReadAll(reader)
+				return string(s)
+			},
+		},
+		{
+			encodeType: "deflate",
+			writer: func(ept string) *http.Response {
+				flw, _ := flate.NewWriter(flatebuf, flate.BestCompression)
+				defer flw.Close()
+
+				flw.Write([]byte(ept))
+				flw.Flush()
+				return &http.Response{
+					Body: io.NopCloser(flatebuf),
+				}
+			},
+			reader: func(rep *http.Response) string {
+				reader := flate.NewReader(rep.Body)
+				s, _ := io.ReadAll(reader)
+				return string(s)
+			},
+		},
+	}
+
+	errFn := func(encode string, err error) {
+		t.Errorf("%s failed to read and write: %v", encode, err)
+	}
+	for _, v := range test {
+		request, _ := http.NewRequest(http.MethodGet, "http://mynode.com/", nil)
+		request.Header.Set("Content-Encoding", v.encodeType)
+		request.Header.Add("Accept-Encoding", v.encodeType)
+
+		for _, exp := range expected {
+			resp := v.writer(exp)
+			gotResponse, err := testTransport.rewriteResponse(request, resp)
+
+			if err != nil {
+				errFn(v.encodeType, err)
+			}
+
+			result := v.reader(gotResponse)
+			if result != exp {
+				errFn(v.encodeType, fmt.Errorf("expected %s, get %s", exp, result))
+			}
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/upgradeaware.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/upgradeaware.go
new file mode 100644
index 0000000000..56f6214834
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/upgradeaware.go
@@ -0,0 +1,559 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	utilnet "k8s.io/apimachinery/pkg/util/net"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/streaming/pkg/httpstream"
+
+	"github.com/mxk/go-flowrate/flowrate"
+
+	"k8s.io/klog/v2"
+)
+
+// UpgradeRequestRoundTripper provides an additional method to decorate a request
+// with any authentication or other protocol level information prior to performing
+// an upgrade on the server. Any response will be handled by the intercepting
+// proxy.
+type UpgradeRequestRoundTripper interface {
+	http.RoundTripper
+	// WrapRequest takes a valid HTTP request and returns a suitably altered version
+	// of request with any HTTP level values required to complete the request half of
+	// an upgrade on the server. It does not get a chance to see the response and
+	// should bypass any request side logic that expects to see the response.
+	WrapRequest(*http.Request) (*http.Request, error)
+}
+
+// UpgradeAwareHandler is a handler for proxy requests that may require an upgrade
+type UpgradeAwareHandler struct {
+	// UpgradeRequired will reject non-upgrade connections if true.
+	UpgradeRequired bool
+	// Location is the location of the upstream proxy. It is used as the location to Dial on the upstream server
+	// for upgrade requests unless UseRequestLocationOnUpgrade is true.
+	Location *url.URL
+	// AppendLocationPath determines if the original path of the Location should be appended to the upstream proxy request path
+	AppendLocationPath bool
+	// Transport provides an optional round tripper to use to proxy. If nil, the default proxy transport is used
+	Transport http.RoundTripper
+	// UpgradeTransport, if specified, will be used as the backend transport when upgrade requests are provided.
+	// This allows clients to disable HTTP/2.
+	UpgradeTransport UpgradeRequestRoundTripper
+	// WrapTransport indicates whether the provided Transport should be wrapped with default proxy transport behavior (URL rewriting, X-Forwarded-* header setting)
+	WrapTransport bool
+	// UseRequestLocation will use the incoming request URL when talking to the backend server.
+	UseRequestLocation bool
+	// UseLocationHost overrides the HTTP host header in requests to the backend server to use the Host from Location.
+	// This will override the req.Host field of a request, while UseRequestLocation will override the req.URL field
+	// of a request. The req.URL.Host specifies the server to connect to, while the req.Host field
+	// specifies the Host header value to send in the HTTP request. If this is false, the incoming req.Host header will
+	// just be forwarded to the backend server.
+	UseLocationHost bool
+	// FlushInterval controls how often the standard HTTP proxy will flush content from the upstream.
+	FlushInterval time.Duration
+	// MaxBytesPerSec controls the maximum rate for an upstream connection. No rate is imposed if the value is zero.
+	MaxBytesPerSec int64
+	// Responder is passed errors that occur while setting up proxying.
+	Responder ErrorResponder
+	// Reject to forward redirect response
+	RejectForwardingRedirects bool
+}
+
+const defaultFlushInterval = 200 * time.Millisecond
+
+// ErrorResponder abstracts error reporting to the proxy handler to remove the need to hardcode a particular
+// error format.
+type ErrorResponder interface {
+	Error(w http.ResponseWriter, req *http.Request, err error)
+}
+
+// SimpleErrorResponder is the legacy implementation of ErrorResponder for callers that only
+// service a single request/response per proxy.
+type SimpleErrorResponder interface {
+	Error(err error)
+}
+
+func NewErrorResponder(r SimpleErrorResponder) ErrorResponder {
+	return simpleResponder{r}
+}
+
+type simpleResponder struct {
+	responder SimpleErrorResponder
+}
+
+func (r simpleResponder) Error(w http.ResponseWriter, req *http.Request, err error) {
+	r.responder.Error(err)
+}
+
+// upgradeRequestRoundTripper implements proxy.UpgradeRequestRoundTripper.
+type upgradeRequestRoundTripper struct {
+	http.RoundTripper
+	upgrader http.RoundTripper
+}
+
+var (
+	_ UpgradeRequestRoundTripper  = &upgradeRequestRoundTripper{}
+	_ utilnet.RoundTripperWrapper = &upgradeRequestRoundTripper{}
+)
+
+// WrappedRoundTripper returns the round tripper that a caller would use.
+func (rt *upgradeRequestRoundTripper) WrappedRoundTripper() http.RoundTripper {
+	return rt.RoundTripper
+}
+
+// WriteToRequest calls the nested upgrader and then copies the returned request
+// fields onto the passed request.
+func (rt *upgradeRequestRoundTripper) WrapRequest(req *http.Request) (*http.Request, error) {
+	resp, err := rt.upgrader.RoundTrip(req)
+	if err != nil {
+		return nil, err
+	}
+	return resp.Request, nil
+}
+
+// onewayRoundTripper captures the provided request - which is assumed to have
+// been modified by other round trippers - and then returns a fake response.
+type onewayRoundTripper struct{}
+
+// RoundTrip returns a simple 200 OK response that captures the provided request.
+func (onewayRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	return &http.Response{
+		Status:     "200 OK",
+		StatusCode: http.StatusOK,
+		Body:       io.NopCloser(&bytes.Buffer{}),
+		Request:    req,
+	}, nil
+}
+
+// MirrorRequest is a round tripper that can be called to get back the calling request as
+// the core round tripper in a chain.
+var MirrorRequest http.RoundTripper = onewayRoundTripper{}
+
+// NewUpgradeRequestRoundTripper takes two round trippers - one for the underlying TCP connection, and
+// one that is able to write headers to an HTTP request. The request rt is used to set the request headers
+// and that is written to the underlying connection rt.
+func NewUpgradeRequestRoundTripper(connection, request http.RoundTripper) UpgradeRequestRoundTripper {
+	return &upgradeRequestRoundTripper{
+		RoundTripper: connection,
+		upgrader:     request,
+	}
+}
+
+// normalizeLocation returns the result of parsing the full URL, with scheme set to http if missing
+func normalizeLocation(location *url.URL) *url.URL {
+	normalized, _ := url.Parse(location.String())
+	if len(normalized.Scheme) == 0 {
+		normalized.Scheme = "http"
+	}
+	return normalized
+}
+
+// NewUpgradeAwareHandler creates a new proxy handler with a default flush interval. Responder is required for returning
+// errors to the caller.
+func NewUpgradeAwareHandler(location *url.URL, transport http.RoundTripper, wrapTransport, upgradeRequired bool, responder ErrorResponder) *UpgradeAwareHandler {
+	return &UpgradeAwareHandler{
+		Location:        normalizeLocation(location),
+		Transport:       transport,
+		WrapTransport:   wrapTransport,
+		UpgradeRequired: upgradeRequired,
+		FlushInterval:   defaultFlushInterval,
+		Responder:       responder,
+	}
+}
+
+func proxyRedirectsforRootPath(path string, w http.ResponseWriter, req *http.Request) bool {
+	redirect := false
+	method := req.Method
+
+	// From pkg/genericapiserver/endpoints/handlers/proxy.go#ServeHTTP:
+	// Redirect requests with an empty path to a location that ends with a '/'
+	// This is essentially a hack for https://issue.k8s.io/4958.
+	// Note: Keep this code after tryUpgrade to not break that flow.
+	if len(path) == 0 && (method == http.MethodGet || method == http.MethodHead) {
+		var queryPart string
+		if len(req.URL.RawQuery) > 0 {
+			queryPart = "?" + req.URL.RawQuery
+		}
+		w.Header().Set("Location", req.URL.Path+"/"+queryPart)
+		w.WriteHeader(http.StatusMovedPermanently)
+		redirect = true
+	}
+	return redirect
+}
+
+// ServeHTTP handles the proxy request
+func (h *UpgradeAwareHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
+	if h.tryUpgrade(w, req) {
+		return
+	}
+	if h.UpgradeRequired {
+		h.Responder.Error(w, req, errors.NewBadRequest("Upgrade request required"))
+		return
+	}
+
+	loc := *h.Location
+	loc.RawQuery = req.URL.RawQuery
+
+	// If original request URL ended in '/', append a '/' at the end of the
+	// of the proxy URL
+	if !strings.HasSuffix(loc.Path, "/") && strings.HasSuffix(req.URL.Path, "/") {
+		loc.Path += "/"
+	}
+
+	proxyRedirect := proxyRedirectsforRootPath(loc.Path, w, req)
+	if proxyRedirect {
+		return
+	}
+
+	if h.Transport == nil || h.WrapTransport {
+		h.Transport = h.defaultProxyTransport(req.URL, h.Transport)
+	}
+
+	// WithContext creates a shallow clone of the request with the same context.
+	newReq := req.WithContext(req.Context())
+	newReq.Header = utilnet.CloneHeader(req.Header)
+	if !h.UseRequestLocation {
+		newReq.URL = &loc
+	}
+	if h.UseLocationHost {
+		// exchanging req.Host with the backend location is necessary for backends that act on the HTTP host header (e.g. API gateways),
+		// because req.Host has preference over req.URL.Host in filling this header field
+		newReq.Host = h.Location.Host
+	}
+
+	// create the target location to use for the reverse proxy
+	reverseProxyLocation := &url.URL{Scheme: h.Location.Scheme, Host: h.Location.Host}
+	if h.AppendLocationPath {
+		reverseProxyLocation.Path = h.Location.Path
+	}
+
+	proxy := httputil.NewSingleHostReverseProxy(reverseProxyLocation)
+	proxy.Transport = h.Transport
+	proxy.FlushInterval = h.FlushInterval
+	proxy.ErrorLog = log.New(noSuppressPanicError{}, "", log.LstdFlags)
+	if h.RejectForwardingRedirects {
+		oldModifyResponse := proxy.ModifyResponse
+		proxy.ModifyResponse = func(response *http.Response) error {
+			code := response.StatusCode
+			if code >= 300 && code <= 399 && len(response.Header.Get("Location")) > 0 {
+				// close the original response
+				response.Body.Close()
+				msg := "the backend attempted to redirect this request, which is not permitted"
+				// replace the response
+				*response = http.Response{
+					StatusCode:    http.StatusBadGateway,
+					Status:        fmt.Sprintf("%d %s", response.StatusCode, http.StatusText(response.StatusCode)),
+					Body:          io.NopCloser(strings.NewReader(msg)),
+					ContentLength: int64(len(msg)),
+				}
+			} else {
+				if oldModifyResponse != nil {
+					if err := oldModifyResponse(response); err != nil {
+						return err
+					}
+				}
+			}
+			return nil
+		}
+	}
+	if h.Responder != nil {
+		// if an optional error interceptor/responder was provided wire it
+		// the custom responder might be used for providing a unified error reporting
+		// or supporting retry mechanisms by not sending non-fatal errors to the clients
+		proxy.ErrorHandler = h.Responder.Error
+	}
+	proxy.ServeHTTP(w, newReq)
+}
+
+type noSuppressPanicError struct{}
+
+func (noSuppressPanicError) Write(p []byte) (n int, err error) {
+	// skip "suppressing panic for copyResponse error in test; copy error" error message
+	// that ends up in CI tests on each kube-apiserver termination as noise and
+	// everybody thinks this is fatal.
+	if strings.Contains(string(p), "suppressing panic") {
+		return len(p), nil
+	}
+	return os.Stderr.Write(p)
+}
+
+// tryUpgrade returns true if the request was handled.
+func (h *UpgradeAwareHandler) tryUpgrade(w http.ResponseWriter, req *http.Request) bool {
+	logger := klog.FromContext(req.Context())
+	if !httpstream.IsUpgradeRequest(req) {
+		logger.V(6).Info("Request was not an upgrade")
+		return false
+	}
+
+	var (
+		backendConn net.Conn
+		rawResponse []byte
+		err         error
+	)
+
+	location := *h.Location
+	if h.UseRequestLocation {
+		location = *req.URL
+		location.Scheme = h.Location.Scheme
+		location.Host = h.Location.Host
+		if h.AppendLocationPath {
+			location.Path = singleJoiningSlash(h.Location.Path, location.Path)
+		}
+	}
+
+	clone := utilnet.CloneRequest(req)
+	// Only append X-Forwarded-For in the upgrade path, since httputil.NewSingleHostReverseProxy
+	// handles this in the non-upgrade path.
+	utilnet.AppendForwardedForHeader(clone)
+	logger.V(6).Info("Connecting to backend proxy (direct dial)", "location", &location, "headers", clone.Header)
+	if h.UseLocationHost {
+		clone.Host = h.Location.Host
+	}
+	clone.URL = &location
+	logger.V(6).Info("UpgradeAwareProxy: dialing for SPDY upgrade with headers", "headers", clone.Header)
+	backendConn, err = h.DialForUpgrade(clone)
+	if err != nil {
+		logger.V(6).Info("Proxy connection error", "err", err)
+		h.Responder.Error(w, req, err)
+		return true
+	}
+	defer backendConn.Close()
+
+	// determine the http response code from the backend by reading from rawResponse+backendConn
+	backendHTTPResponse, headerBytes, err := getResponse(io.MultiReader(bytes.NewReader(rawResponse), backendConn))
+	if err != nil {
+		logger.V(6).Info("Proxy connection error", "err", err)
+		h.Responder.Error(w, req, err)
+		return true
+	}
+	if len(headerBytes) > len(rawResponse) {
+		// we read beyond the bytes stored in rawResponse, update rawResponse to the full set of bytes read from the backend
+		rawResponse = headerBytes
+	}
+
+	// If the backend did not upgrade the request, return an error to the client. If the response was
+	// an error, the error is forwarded directly after the connection is hijacked. Otherwise, just
+	// return a generic error here.
+	if backendHTTPResponse.StatusCode != http.StatusSwitchingProtocols && backendHTTPResponse.StatusCode < 400 {
+		err := fmt.Errorf("invalid upgrade response: status code %d", backendHTTPResponse.StatusCode)
+		logger.Error(err, "Proxy upgrade error")
+		h.Responder.Error(w, req, err)
+		return true
+	}
+
+	// Once the connection is hijacked, the ErrorResponder will no longer work, so
+	// hijacking should be the last step in the upgrade.
+	requestHijacker, ok := w.(http.Hijacker)
+	if !ok {
+		logger.Error(nil, "Unable to hijack response writer", "type", fmt.Sprintf("%T", w))
+		h.Responder.Error(w, req, fmt.Errorf("request connection cannot be hijacked: %T", w))
+		return true
+	}
+	requestHijackedConn, _, err := requestHijacker.Hijack()
+	if err != nil {
+		logger.Error(err, "Unable to hijack response")
+		h.Responder.Error(w, req, fmt.Errorf("error hijacking connection: %v", err))
+		return true
+	}
+	defer requestHijackedConn.Close()
+
+	if backendHTTPResponse.StatusCode != http.StatusSwitchingProtocols {
+		// If the backend did not upgrade the request, echo the response from the backend to the client and return, closing the connection.
+		logger.V(6).Info("Proxy upgrade error", "statusCode", backendHTTPResponse.StatusCode)
+		// set read/write deadlines
+		deadline := time.Now().Add(10 * time.Second)
+		backendConn.SetReadDeadline(deadline)
+		requestHijackedConn.SetWriteDeadline(deadline)
+		// write the response to the client
+		err := backendHTTPResponse.Write(requestHijackedConn)
+		if err != nil && !strings.Contains(err.Error(), "use of closed network connection") {
+			logger.Error(err, "Error proxying data from backend to client")
+		}
+		// Indicate we handled the request
+		return true
+	}
+
+	// Forward raw response bytes back to client.
+	if len(rawResponse) > 0 {
+		logger.V(6).Info("Writing to hijacked connection", "length", len(rawResponse))
+		if _, err = requestHijackedConn.Write(rawResponse); err != nil {
+			utilruntime.HandleErrorWithLogger(logger, err, "Error proxying response from backend to client")
+		}
+	}
+
+	// Proxy the connection. This is bidirectional, so we need a goroutine
+	// to copy in each direction. Once one side of the connection exits, we
+	// exit the function which performs cleanup and in the process closes
+	// the other half of the connection in the defer.
+	writerComplete := make(chan struct{})
+	readerComplete := make(chan struct{})
+
+	go func() {
+		var writer io.WriteCloser
+		if h.MaxBytesPerSec > 0 {
+			writer = flowrate.NewWriter(backendConn, h.MaxBytesPerSec)
+		} else {
+			writer = backendConn
+		}
+		_, err := io.Copy(writer, requestHijackedConn)
+		if err != nil && !strings.Contains(err.Error(), "use of closed network connection") {
+			logger.Error(err, "Error proxying data from client to backend")
+		}
+		close(writerComplete)
+	}()
+
+	go func() {
+		var reader io.ReadCloser
+		if h.MaxBytesPerSec > 0 {
+			reader = flowrate.NewReader(backendConn, h.MaxBytesPerSec)
+		} else {
+			reader = backendConn
+		}
+		_, err := io.Copy(requestHijackedConn, reader)
+		if err != nil && !strings.Contains(err.Error(), "use of closed network connection") {
+			logger.Error(err, "Error proxying data from backend to client")
+		}
+		close(readerComplete)
+	}()
+
+	// Wait for one half the connection to exit. Once it does the defer will
+	// clean up the other half of the connection.
+	select {
+	case <-writerComplete:
+	case <-readerComplete:
+	}
+	logger.V(6).Info("Disconnecting from backend proxy", "location", &location, "headers", clone.Header)
+
+	return true
+}
+
+// FIXME: Taken from net/http/httputil/reverseproxy.go as singleJoiningSlash is not exported to be re-used.
+// See-also: https://github.com/golang/go/issues/44290
+func singleJoiningSlash(a, b string) string {
+	aslash := strings.HasSuffix(a, "/")
+	bslash := strings.HasPrefix(b, "/")
+	switch {
+	case aslash && bslash:
+		return a + b[1:]
+	case !aslash && !bslash:
+		return a + "/" + b
+	}
+	return a + b
+}
+
+func (h *UpgradeAwareHandler) DialForUpgrade(req *http.Request) (net.Conn, error) {
+	if h.UpgradeTransport == nil {
+		return dial(req, h.Transport)
+	}
+	updatedReq, err := h.UpgradeTransport.WrapRequest(req)
+	if err != nil {
+		return nil, err
+	}
+	return dial(updatedReq, h.UpgradeTransport)
+}
+
+// getResponseCode reads a http response from the given reader, returns the response,
+// the bytes read from the reader, and any error encountered
+func getResponse(r io.Reader) (*http.Response, []byte, error) {
+	rawResponse := bytes.NewBuffer(make([]byte, 0, 256))
+	// Save the bytes read while reading the response headers into the rawResponse buffer
+	resp, err := http.ReadResponse(bufio.NewReader(io.TeeReader(r, rawResponse)), nil)
+	if err != nil {
+		return nil, nil, err
+	}
+	// return the http response and the raw bytes consumed from the reader in the process
+	return resp, rawResponse.Bytes(), nil
+}
+
+// dial dials the backend at req.URL and writes req to it.
+func dial(req *http.Request, transport http.RoundTripper) (net.Conn, error) {
+	conn, err := DialURL(req.Context(), req.URL, transport)
+	if err != nil {
+		return nil, fmt.Errorf("error dialing backend: %v", err)
+	}
+
+	if err = req.Write(conn); err != nil {
+		conn.Close()
+		return nil, fmt.Errorf("error sending request: %v", err)
+	}
+
+	return conn, err
+}
+
+func (h *UpgradeAwareHandler) defaultProxyTransport(url *url.URL, internalTransport http.RoundTripper) http.RoundTripper {
+	scheme := url.Scheme
+	host := url.Host
+	suffix := h.Location.Path
+	if strings.HasSuffix(url.Path, "/") && !strings.HasSuffix(suffix, "/") {
+		suffix += "/"
+	}
+	pathPrepend := strings.TrimSuffix(url.Path, suffix)
+	rewritingTransport := &Transport{
+		Scheme:       scheme,
+		Host:         host,
+		PathPrepend:  pathPrepend,
+		RoundTripper: internalTransport,
+	}
+	return &corsRemovingTransport{
+		RoundTripper: rewritingTransport,
+	}
+}
+
+// corsRemovingTransport is a wrapper for an internal transport. It removes CORS headers
+// from the internal response.
+// Implements pkg/util/net.RoundTripperWrapper
+type corsRemovingTransport struct {
+	http.RoundTripper
+}
+
+var _ = utilnet.RoundTripperWrapper(&corsRemovingTransport{})
+
+func (rt *corsRemovingTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	resp, err := rt.RoundTripper.RoundTrip(req)
+	if err != nil {
+		return nil, err
+	}
+	removeCORSHeaders(resp)
+	return resp, nil
+}
+
+func (rt *corsRemovingTransport) WrappedRoundTripper() http.RoundTripper {
+	return rt.RoundTripper
+}
+
+// removeCORSHeaders strip CORS headers sent from the backend
+// This should be called on all responses before returning
+func removeCORSHeaders(resp *http.Response) {
+	resp.Header.Del("Access-Control-Allow-Credentials")
+	resp.Header.Del("Access-Control-Allow-Headers")
+	resp.Header.Del("Access-Control-Allow-Methods")
+	resp.Header.Del("Access-Control-Allow-Origin")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/upgradeaware_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/upgradeaware_test.go
new file mode 100644
index 0000000000..4a0f821feb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/proxy/upgradeaware_test.go
@@ -0,0 +1,1261 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"bufio"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/http/httputil"
+	"net/url"
+	"reflect"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"golang.org/x/net/websocket"
+
+	utilnet "k8s.io/apimachinery/pkg/util/net"
+	"k8s.io/streaming/pkg/httpstream"
+)
+
+const fakeStatusCode = 567
+
+type fakeResponder struct {
+	t      *testing.T
+	called bool
+	err    error
+	// called chan error
+	w http.ResponseWriter
+}
+
+func (r *fakeResponder) Error(w http.ResponseWriter, req *http.Request, err error) {
+	if r.called {
+		r.t.Errorf("Error responder called again!\nprevious error: %v\nnew error: %v", r.err, err)
+	}
+
+	w.WriteHeader(fakeStatusCode)
+	_, writeErr := w.Write([]byte(err.Error()))
+	assert.NoError(r.t, writeErr)
+
+	r.called = true
+	r.err = err
+}
+
+type fakeConn struct {
+	err error // The error to return when io is performed over the connection.
+}
+
+func (f *fakeConn) Read([]byte) (int, error)        { return 0, f.err }
+func (f *fakeConn) Write([]byte) (int, error)       { return 0, f.err }
+func (f *fakeConn) Close() error                    { return nil }
+func (fakeConn) LocalAddr() net.Addr                { return nil }
+func (fakeConn) RemoteAddr() net.Addr               { return nil }
+func (fakeConn) SetDeadline(t time.Time) error      { return nil }
+func (fakeConn) SetReadDeadline(t time.Time) error  { return nil }
+func (fakeConn) SetWriteDeadline(t time.Time) error { return nil }
+
+type SimpleBackendHandler struct {
+	requestURL     url.URL
+	requestHost    string
+	requestHeader  http.Header
+	requestBody    []byte
+	requestMethod  string
+	responseBody   string
+	responseHeader map[string]string
+	t              *testing.T
+}
+
+func (s *SimpleBackendHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
+	s.requestURL = *req.URL
+	s.requestHost = req.Host
+	s.requestHeader = req.Header
+	s.requestMethod = req.Method
+	var err error
+	s.requestBody, err = io.ReadAll(req.Body)
+	if err != nil {
+		s.t.Errorf("Unexpected error: %v", err)
+		return
+	}
+
+	if s.responseHeader != nil {
+		for k, v := range s.responseHeader {
+			w.Header().Add(k, v)
+		}
+	}
+	w.Write([]byte(s.responseBody))
+}
+
+func validateParameters(t *testing.T, name string, actual url.Values, expected map[string]string) {
+	for k, v := range expected {
+		actualValue, ok := actual[k]
+		if !ok {
+			t.Errorf("%s: Expected parameter %s not received", name, k)
+			continue
+		}
+		if actualValue[0] != v {
+			t.Errorf("%s: Parameter %s values don't match. Actual: %#v, Expected: %s",
+				name, k, actualValue, v)
+		}
+	}
+}
+
+func validateHeaders(t *testing.T, name string, actual http.Header, expected map[string]string, notExpected []string) {
+	for k, v := range expected {
+		actualValue, ok := actual[k]
+		if !ok {
+			t.Errorf("%s: Expected header %s not received", name, k)
+			continue
+		}
+		if actualValue[0] != v {
+			t.Errorf("%s: Header %s values don't match. Actual: %s, Expected: %s",
+				name, k, actualValue, v)
+		}
+	}
+	if notExpected == nil {
+		return
+	}
+	for _, h := range notExpected {
+		if _, present := actual[h]; present {
+			t.Errorf("%s: unexpected header: %s", name, h)
+		}
+	}
+}
+
+func TestServeHTTP(t *testing.T) {
+	tests := []struct {
+		name                  string
+		method                string
+		requestPath           string
+		expectedPath          string
+		requestBody           string
+		requestParams         map[string]string
+		requestHeader         map[string]string
+		responseHeader        map[string]string
+		expectedRespHeader    map[string]string
+		notExpectedRespHeader []string
+		upgradeRequired       bool
+		appendLocationPath    bool
+		expectError           func(err error) bool
+		useLocationHost       bool
+	}{
+		{
+			name:         "root path, simple get",
+			method:       http.MethodGet,
+			requestPath:  "/",
+			expectedPath: "/",
+		},
+		{
+			name:            "no upgrade header sent",
+			method:          http.MethodGet,
+			requestPath:     "/",
+			upgradeRequired: true,
+			expectError: func(err error) bool {
+				return err != nil && strings.Contains(err.Error(), "Upgrade request required")
+			},
+		},
+		{
+			name:         "simple path, get",
+			method:       http.MethodGet,
+			requestPath:  "/path/to/test",
+			expectedPath: "/path/to/test",
+		},
+		{
+			name:          "request params",
+			method:        http.MethodPost,
+			requestPath:   "/some/path/",
+			expectedPath:  "/some/path/",
+			requestParams: map[string]string{"param1": "value/1", "param2": "value%2"},
+			requestBody:   "test request body",
+		},
+		{
+			name:          "request headers",
+			method:        http.MethodPut,
+			requestPath:   "/some/path",
+			expectedPath:  "/some/path",
+			requestHeader: map[string]string{"Header1": "value1", "Header2": "value2"},
+		},
+		{
+			name:         "empty path - slash should be added",
+			method:       http.MethodGet,
+			requestPath:  "",
+			expectedPath: "/",
+		},
+		{
+			name:         "remove CORS headers",
+			method:       http.MethodGet,
+			requestPath:  "/some/path",
+			expectedPath: "/some/path",
+			responseHeader: map[string]string{
+				"Header1":                      "value1",
+				"Access-Control-Allow-Origin":  "some.server",
+				"Access-Control-Allow-Methods": http.MethodGet},
+			expectedRespHeader: map[string]string{
+				"Header1": "value1",
+			},
+			notExpectedRespHeader: []string{
+				"Access-Control-Allow-Origin",
+				"Access-Control-Allow-Methods",
+			},
+		},
+		{
+			name:            "use location host",
+			method:          http.MethodGet,
+			requestPath:     "/some/path",
+			expectedPath:    "/some/path",
+			useLocationHost: true,
+		},
+		{
+			name:            "use location host - invalid upgrade",
+			method:          http.MethodGet,
+			upgradeRequired: true,
+			requestHeader: map[string]string{
+				httpstream.HeaderConnection: httpstream.HeaderUpgrade,
+			},
+			expectError: func(err error) bool {
+				return err != nil && strings.Contains(err.Error(), "invalid upgrade response: status code 200")
+			},
+			requestPath:     "/some/path",
+			expectedPath:    "/some/path",
+			useLocationHost: true,
+		},
+		{
+			name:               "append server path to request path",
+			method:             http.MethodGet,
+			requestPath:        "/base",
+			expectedPath:       "/base/base",
+			appendLocationPath: true,
+		},
+		{
+			name:               "append server path to request path with ending slash",
+			method:             http.MethodGet,
+			requestPath:        "/base/",
+			expectedPath:       "/base/base/",
+			appendLocationPath: true,
+		},
+		{
+			name:               "don't append server path to request path",
+			method:             http.MethodGet,
+			requestPath:        "/base",
+			expectedPath:       "/base",
+			appendLocationPath: false,
+		},
+	}
+
+	for i, test := range tests {
+		func() {
+			backendResponse := "<html><head></head><body><a href=\"/test/path\">Hello</a></body></html>"
+			backendResponseHeader := test.responseHeader
+			// Test a simple header if not specified in the test
+			if backendResponseHeader == nil && test.expectedRespHeader == nil {
+				backendResponseHeader = map[string]string{"Content-Type": "text/html"}
+				test.expectedRespHeader = map[string]string{"Content-Type": "text/html"}
+			}
+			backendHandler := &SimpleBackendHandler{
+				responseBody:   backendResponse,
+				responseHeader: backendResponseHeader,
+			}
+			backendServer := httptest.NewServer(backendHandler)
+			defer backendServer.Close()
+
+			responder := &fakeResponder{t: t}
+			backendURL, _ := url.Parse(backendServer.URL)
+			backendURL.Path = test.requestPath
+			proxyHandler := NewUpgradeAwareHandler(backendURL, nil, false, test.upgradeRequired, responder)
+			proxyHandler.UseLocationHost = test.useLocationHost
+			proxyHandler.AppendLocationPath = test.appendLocationPath
+			proxyServer := httptest.NewServer(proxyHandler)
+			defer proxyServer.Close()
+			proxyURL, _ := url.Parse(proxyServer.URL)
+			proxyURL.Path = test.requestPath
+			paramValues := url.Values{}
+			for k, v := range test.requestParams {
+				paramValues[k] = []string{v}
+			}
+			proxyURL.RawQuery = paramValues.Encode()
+			var requestBody io.Reader
+			if test.requestBody != "" {
+				requestBody = bytes.NewBufferString(test.requestBody)
+			}
+			req, err := http.NewRequest(test.method, proxyURL.String(), requestBody)
+			if test.requestHeader != nil {
+				header := http.Header{}
+				for k, v := range test.requestHeader {
+					header.Add(k, v)
+				}
+				req.Header = header
+			}
+			if err != nil {
+				t.Errorf("Error creating client request: %v", err)
+			}
+			client := &http.Client{}
+			res, err := client.Do(req)
+			if err != nil {
+				t.Errorf("Error from proxy request: %v", err)
+			}
+
+			// Host
+			if test.useLocationHost && backendHandler.requestHost != backendURL.Host {
+				t.Errorf("Unexpected request host: %s", backendHandler.requestHost)
+			} else if !test.useLocationHost && backendHandler.requestHost == backendURL.Host {
+				t.Errorf("Unexpected request host: %s", backendHandler.requestHost)
+			}
+
+			if test.expectError != nil {
+				if !responder.called {
+					t.Errorf("%d: responder was not invoked", i)
+					return
+				}
+				if !test.expectError(responder.err) {
+					t.Errorf("%d: unexpected error: %v", i, responder.err)
+				}
+				return
+			}
+
+			// Validate backend request
+			// Method
+			if backendHandler.requestMethod != test.method {
+				t.Errorf("Unexpected request method: %s. Expected: %s",
+					backendHandler.requestMethod, test.method)
+			}
+
+			// Body
+			if string(backendHandler.requestBody) != test.requestBody {
+				t.Errorf("Unexpected request body: %s. Expected: %s",
+					string(backendHandler.requestBody), test.requestBody)
+			}
+
+			// Path
+			if backendHandler.requestURL.Path != test.expectedPath {
+				t.Errorf("Unexpected request path: %s", backendHandler.requestURL.Path)
+			}
+			// Parameters
+			validateParameters(t, test.name, backendHandler.requestURL.Query(), test.requestParams)
+
+			// Headers
+			validateHeaders(t, test.name+" backend request", backendHandler.requestHeader,
+				test.requestHeader, nil)
+
+			// Validate proxy response
+
+			// Response Headers
+			validateHeaders(t, test.name+" backend headers", res.Header, test.expectedRespHeader, test.notExpectedRespHeader)
+
+			// Validate Body
+			responseBody, err := io.ReadAll(res.Body)
+			if err != nil {
+				t.Errorf("Unexpected error reading response body: %v", err)
+			}
+			if rb := string(responseBody); rb != backendResponse {
+				t.Errorf("Did not get expected response body: %s. Expected: %s", rb, backendResponse)
+			}
+
+			// Error
+			if responder.called {
+				t.Errorf("Unexpected proxy handler error: %v", responder.err)
+			}
+		}()
+	}
+}
+
+type RoundTripperFunc func(req *http.Request) (*http.Response, error)
+
+func (fn RoundTripperFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return fn(req)
+}
+
+func TestProxyUpgrade(t *testing.T) {
+
+	localhostPool := x509.NewCertPool()
+	if !localhostPool.AppendCertsFromPEM(localhostCert) {
+		t.Errorf("error setting up localhostCert pool")
+	}
+	var d net.Dialer
+
+	testcases := map[string]struct {
+		ServerFunc       func(http.Handler) *httptest.Server
+		ProxyTransport   http.RoundTripper
+		UpgradeTransport UpgradeRequestRoundTripper
+		ExpectedAuth     string
+	}{
+		"http": {
+			ServerFunc:     httptest.NewServer,
+			ProxyTransport: nil,
+		},
+		"both client and server support http2, but force to http/1.1 for upgrade": {
+			ServerFunc: func(h http.Handler) *httptest.Server {
+				cert, err := tls.X509KeyPair(exampleCert, exampleKey)
+				if err != nil {
+					t.Errorf("https (invalid hostname): proxy_test: %v", err)
+				}
+				ts := httptest.NewUnstartedServer(h)
+				ts.TLS = &tls.Config{
+					Certificates: []tls.Certificate{cert},
+					NextProtos:   []string{"http2", "http/1.1"},
+				}
+				ts.StartTLS()
+				return ts
+			},
+			ProxyTransport: utilnet.SetTransportDefaults(&http.Transport{TLSClientConfig: &tls.Config{
+				NextProtos:         []string{"http2", "http/1.1"},
+				InsecureSkipVerify: true,
+			}}),
+		},
+		"https (invalid hostname + InsecureSkipVerify)": {
+			ServerFunc: func(h http.Handler) *httptest.Server {
+				cert, err := tls.X509KeyPair(exampleCert, exampleKey)
+				if err != nil {
+					t.Errorf("https (invalid hostname): proxy_test: %v", err)
+				}
+				ts := httptest.NewUnstartedServer(h)
+				ts.TLS = &tls.Config{
+					Certificates: []tls.Certificate{cert},
+				}
+				ts.StartTLS()
+				return ts
+			},
+			ProxyTransport: utilnet.SetTransportDefaults(&http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}),
+		},
+		"https (valid hostname + RootCAs)": {
+			ServerFunc: func(h http.Handler) *httptest.Server {
+				cert, err := tls.X509KeyPair(localhostCert, localhostKey)
+				if err != nil {
+					t.Errorf("https (valid hostname): proxy_test: %v", err)
+				}
+				ts := httptest.NewUnstartedServer(h)
+				ts.TLS = &tls.Config{
+					Certificates: []tls.Certificate{cert},
+				}
+				ts.StartTLS()
+				return ts
+			},
+			ProxyTransport: utilnet.SetTransportDefaults(&http.Transport{TLSClientConfig: &tls.Config{RootCAs: localhostPool}}),
+		},
+		"https (valid hostname + RootCAs + custom dialer)": {
+			ServerFunc: func(h http.Handler) *httptest.Server {
+				cert, err := tls.X509KeyPair(localhostCert, localhostKey)
+				if err != nil {
+					t.Errorf("https (valid hostname): proxy_test: %v", err)
+				}
+				ts := httptest.NewUnstartedServer(h)
+				ts.TLS = &tls.Config{
+					Certificates: []tls.Certificate{cert},
+				}
+				ts.StartTLS()
+				return ts
+			},
+			ProxyTransport: utilnet.SetTransportDefaults(&http.Transport{DialContext: d.DialContext, TLSClientConfig: &tls.Config{RootCAs: localhostPool}}),
+		},
+		"https (valid hostname + RootCAs + custom dialer + bearer token)": {
+			ServerFunc: func(h http.Handler) *httptest.Server {
+				cert, err := tls.X509KeyPair(localhostCert, localhostKey)
+				if err != nil {
+					t.Errorf("https (valid hostname): proxy_test: %v", err)
+				}
+				ts := httptest.NewUnstartedServer(h)
+				ts.TLS = &tls.Config{
+					Certificates: []tls.Certificate{cert},
+				}
+				ts.StartTLS()
+				return ts
+			},
+			ProxyTransport: utilnet.SetTransportDefaults(&http.Transport{DialContext: d.DialContext, TLSClientConfig: &tls.Config{RootCAs: localhostPool}}),
+			UpgradeTransport: NewUpgradeRequestRoundTripper(
+				utilnet.SetOldTransportDefaults(&http.Transport{DialContext: d.DialContext, TLSClientConfig: &tls.Config{RootCAs: localhostPool}}),
+				RoundTripperFunc(func(req *http.Request) (*http.Response, error) {
+					req = utilnet.CloneRequest(req)
+					req.Header.Set("Authorization", "Bearer 1234")
+					return MirrorRequest.RoundTrip(req)
+				}),
+			),
+			ExpectedAuth: "Bearer 1234",
+		},
+	}
+
+	for k, tc := range testcases {
+		tcName := k
+		backendPath := "/hello"
+		func() { // Cleanup after each test case.
+			backend := http.NewServeMux()
+			backend.Handle("/hello", websocket.Handler(func(ws *websocket.Conn) {
+				if ws.Request().Header.Get("Authorization") != tc.ExpectedAuth {
+					t.Errorf("%s: unexpected headers on request: %v", k, ws.Request().Header)
+					defer ws.Close()
+					ws.Write([]byte("you failed"))
+					return
+				}
+				defer ws.Close()
+				body := make([]byte, 5)
+				ws.Read(body)
+				ws.Write([]byte("hello " + string(body)))
+			}))
+			backend.Handle("/redirect", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				http.Redirect(w, r, "/hello", http.StatusFound)
+			}))
+			backendServer := tc.ServerFunc(backend)
+			defer backendServer.Close()
+
+			serverURL, _ := url.Parse(backendServer.URL)
+			serverURL.Path = backendPath
+			proxyHandler := NewUpgradeAwareHandler(serverURL, tc.ProxyTransport, false, false, &noErrorsAllowed{t: t})
+			proxyHandler.UpgradeTransport = tc.UpgradeTransport
+			proxy := httptest.NewServer(proxyHandler)
+			defer proxy.Close()
+
+			ws, err := websocket.Dial("ws://"+proxy.Listener.Addr().String()+"/some/path", "", "http://127.0.0.1/")
+			if err != nil {
+				t.Fatalf("%s: websocket dial err: %s", tcName, err)
+			}
+			defer ws.Close()
+
+			if _, err := ws.Write([]byte("world")); err != nil {
+				t.Fatalf("%s: write err: %s", tcName, err)
+			}
+
+			response := make([]byte, 20)
+			n, err := ws.Read(response)
+			if err != nil {
+				t.Fatalf("%s: read err: %s", tcName, err)
+			}
+			if e, a := "hello world", string(response[0:n]); e != a {
+				t.Fatalf("%s: expected '%#v', got '%#v'", tcName, e, a)
+			}
+		}()
+	}
+}
+
+type noErrorsAllowed struct {
+	t *testing.T
+}
+
+func (r *noErrorsAllowed) Error(w http.ResponseWriter, req *http.Request, err error) {
+	r.t.Error(err)
+}
+
+func TestProxyUpgradeConnectionErrorResponse(t *testing.T) {
+	var (
+		responder   *fakeResponder
+		expectedErr = errors.New("EXPECTED")
+	)
+	proxy := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		transport := &http.Transport{
+			Proxy: http.ProxyFromEnvironment,
+			DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+				return &fakeConn{err: expectedErr}, nil
+			},
+			MaxIdleConns:          100,
+			IdleConnTimeout:       90 * time.Second,
+			TLSHandshakeTimeout:   10 * time.Second,
+			ExpectContinueTimeout: 1 * time.Second,
+		}
+		responder = &fakeResponder{t: t, w: w}
+		proxyHandler := NewUpgradeAwareHandler(
+			&url.URL{
+				Host: "fake-backend",
+			},
+			transport,
+			false,
+			true,
+			responder,
+		)
+		proxyHandler.ServeHTTP(w, r)
+	}))
+	defer proxy.Close()
+
+	// Send request to proxy server.
+	req, err := http.NewRequest(http.MethodPost, "http://"+proxy.Listener.Addr().String()+"/some/path", nil)
+	require.NoError(t, err)
+	req.Header.Set(httpstream.HeaderConnection, httpstream.HeaderUpgrade)
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	// Expect error response.
+	assert.True(t, responder.called)
+	assert.Equal(t, fakeStatusCode, resp.StatusCode)
+	msg, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	assert.Contains(t, string(msg), expectedErr.Error())
+}
+
+func TestProxyUpgradeErrorResponseTerminates(t *testing.T) {
+	for _, code := range []int{400, 500} {
+		t.Run(fmt.Sprintf("code=%v", code), func(t *testing.T) {
+			// Set up a backend server
+			backend := http.NewServeMux()
+			backend.Handle("/hello", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(code)
+				w.Write([]byte(`some data`))
+			}))
+			backend.Handle("/there", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				t.Error("request to /there")
+			}))
+			backendServer := httptest.NewServer(backend)
+			defer backendServer.Close()
+			backendServerURL, _ := url.Parse(backendServer.URL)
+			backendServerURL.Path = "/hello"
+
+			// Set up a proxy pointing to a specific path on the backend
+			proxyHandler := NewUpgradeAwareHandler(backendServerURL, nil, false, false, &noErrorsAllowed{t: t})
+			proxy := httptest.NewServer(proxyHandler)
+			defer proxy.Close()
+			proxyURL, _ := url.Parse(proxy.URL)
+
+			conn, err := net.Dial("tcp", proxyURL.Host)
+			require.NoError(t, err)
+			bufferedReader := bufio.NewReader(conn)
+
+			// Send upgrade request resulting in a non-101 response from the backend
+			req, _ := http.NewRequest(http.MethodGet, "/", nil)
+			req.Header.Set(httpstream.HeaderConnection, httpstream.HeaderUpgrade)
+			require.NoError(t, req.Write(conn))
+			// Verify we get the correct response and full message body content
+			resp, err := http.ReadResponse(bufferedReader, nil)
+			require.NoError(t, err)
+			data, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			require.Equal(t, resp.StatusCode, code)
+			require.Equal(t, data, []byte(`some data`))
+			resp.Body.Close()
+
+			// try to read from the connection to verify it was closed
+			b := make([]byte, 1)
+			conn.SetReadDeadline(time.Now().Add(time.Second))
+			if _, err := conn.Read(b); err != io.EOF {
+				t.Errorf("expected EOF, got %v", err)
+			}
+
+			// Send another request to another endpoint to verify it is not received
+			req, _ = http.NewRequest(http.MethodGet, "/there", nil)
+			req.Write(conn)
+			// wait to ensure the handler does not receive the request
+			time.Sleep(time.Second)
+
+			// clean up
+			conn.Close()
+		})
+	}
+}
+
+func TestProxyUpgradeErrorResponse(t *testing.T) {
+	for _, code := range []int{200, 300, 302, 307} {
+		t.Run(fmt.Sprintf("code=%v", code), func(t *testing.T) {
+			// Set up a backend server
+			backend := http.NewServeMux()
+			backend.Handle("/hello", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				http.Redirect(w, r, "https://example.com/there", code)
+			}))
+			backendServer := httptest.NewServer(backend)
+			defer backendServer.Close()
+			backendServerURL, _ := url.Parse(backendServer.URL)
+			backendServerURL.Path = "/hello"
+
+			// Set up a proxy pointing to a specific path on the backend
+			proxyHandler := NewUpgradeAwareHandler(backendServerURL, nil, false, false, &fakeResponder{t: t})
+			proxy := httptest.NewServer(proxyHandler)
+			defer proxy.Close()
+			proxyURL, _ := url.Parse(proxy.URL)
+
+			conn, err := net.Dial("tcp", proxyURL.Host)
+			require.NoError(t, err)
+			bufferedReader := bufio.NewReader(conn)
+
+			// Send upgrade request resulting in a non-101 response from the backend
+			req, _ := http.NewRequest(http.MethodGet, "/", nil)
+			req.Header.Set(httpstream.HeaderConnection, httpstream.HeaderUpgrade)
+			require.NoError(t, req.Write(conn))
+			// Verify we get the correct response and full message body content
+			resp, err := http.ReadResponse(bufferedReader, nil)
+			require.NoError(t, err)
+			assert.Equal(t, fakeStatusCode, resp.StatusCode)
+			resp.Body.Close()
+
+			// clean up
+			conn.Close()
+		})
+	}
+}
+
+func TestRejectForwardingRedirectsOption(t *testing.T) {
+	originalBody := []byte(`some data`)
+	testCases := []struct {
+		name                      string
+		rejectForwardingRedirects bool
+		serverStatusCode          int
+		redirect                  string
+		expectStatusCode          int
+		expectBody                []byte
+	}{
+		{
+			name:                      "reject redirection enabled in proxy, backend server sending 200 response",
+			rejectForwardingRedirects: true,
+			serverStatusCode:          200,
+			expectStatusCode:          200,
+			expectBody:                originalBody,
+		},
+		{
+			name:                      "reject redirection enabled in proxy, backend server sending 301 response",
+			rejectForwardingRedirects: true,
+			serverStatusCode:          301,
+			redirect:                  "/",
+			expectStatusCode:          502,
+			expectBody:                []byte(`the backend attempted to redirect this request, which is not permitted`),
+		},
+		{
+			name:                      "reject redirection enabled in proxy, backend server sending 304 response with a location header",
+			rejectForwardingRedirects: true,
+			serverStatusCode:          304,
+			redirect:                  "/",
+			expectStatusCode:          502,
+			expectBody:                []byte(`the backend attempted to redirect this request, which is not permitted`),
+		},
+		{
+			name:                      "reject redirection enabled in proxy, backend server sending 304 response with no location header",
+			rejectForwardingRedirects: true,
+			serverStatusCode:          304,
+			expectStatusCode:          304,
+			expectBody:                []byte{}, // client doesn't read the body for 304 responses
+		},
+		{
+			name:                      "reject redirection disabled in proxy, backend server sending 200 response",
+			rejectForwardingRedirects: false,
+			serverStatusCode:          200,
+			expectStatusCode:          200,
+			expectBody:                originalBody,
+		},
+		{
+			name:                      "reject redirection disabled in proxy, backend server sending 301 response",
+			rejectForwardingRedirects: false,
+			serverStatusCode:          301,
+			redirect:                  "/",
+			expectStatusCode:          301,
+			expectBody:                originalBody,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Set up a backend server
+			backendServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if tc.redirect != "" {
+					w.Header().Set("Location", tc.redirect)
+				}
+				w.WriteHeader(tc.serverStatusCode)
+				w.Write(originalBody)
+			}))
+			defer backendServer.Close()
+			backendServerURL, _ := url.Parse(backendServer.URL)
+
+			// Set up a proxy pointing to the backend
+			proxyHandler := NewUpgradeAwareHandler(backendServerURL, nil, false, false, &fakeResponder{t: t})
+			proxyHandler.RejectForwardingRedirects = tc.rejectForwardingRedirects
+			proxy := httptest.NewServer(proxyHandler)
+			defer proxy.Close()
+			proxyURL, _ := url.Parse(proxy.URL)
+
+			conn, err := net.Dial("tcp", proxyURL.Host)
+			require.NoError(t, err)
+			bufferedReader := bufio.NewReader(conn)
+
+			req, _ := http.NewRequest(http.MethodGet, proxyURL.String(), nil)
+			require.NoError(t, req.Write(conn))
+			// Verify we get the correct response and message body content
+			resp, err := http.ReadResponse(bufferedReader, nil)
+			require.NoError(t, err)
+			assert.Equal(t, tc.expectStatusCode, resp.StatusCode)
+			data, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			assert.Equal(t, tc.expectBody, data)
+			assert.Equal(t, int64(len(tc.expectBody)), resp.ContentLength)
+			resp.Body.Close()
+
+			// clean up
+			conn.Close()
+		})
+	}
+}
+
+func TestDefaultProxyTransport(t *testing.T) {
+	tests := []struct {
+		name,
+		url,
+		location,
+		expectedScheme,
+		expectedHost,
+		expectedPathPrepend string
+	}{
+		{
+			name:                "simple path",
+			url:                 "http://test.server:8080/a/test/location",
+			location:            "http://localhost/location",
+			expectedScheme:      "http",
+			expectedHost:        "test.server:8080",
+			expectedPathPrepend: "/a/test",
+		},
+		{
+			name:                "empty path",
+			url:                 "http://test.server:8080/a/test/",
+			location:            "http://localhost",
+			expectedScheme:      "http",
+			expectedHost:        "test.server:8080",
+			expectedPathPrepend: "/a/test",
+		},
+		{
+			name:                "location ending in slash",
+			url:                 "http://test.server:8080/a/test/",
+			location:            "http://localhost/",
+			expectedScheme:      "http",
+			expectedHost:        "test.server:8080",
+			expectedPathPrepend: "/a/test",
+		},
+	}
+
+	for _, test := range tests {
+		locURL, _ := url.Parse(test.location)
+		URL, _ := url.Parse(test.url)
+		h := NewUpgradeAwareHandler(locURL, nil, false, false, nil)
+		result := h.defaultProxyTransport(URL, nil)
+		transport := result.(*corsRemovingTransport).RoundTripper.(*Transport)
+		if transport.Scheme != test.expectedScheme {
+			t.Errorf("%s: unexpected scheme. Actual: %s, Expected: %s", test.name, transport.Scheme, test.expectedScheme)
+		}
+		if transport.Host != test.expectedHost {
+			t.Errorf("%s: unexpected host. Actual: %s, Expected: %s", test.name, transport.Host, test.expectedHost)
+		}
+		if transport.PathPrepend != test.expectedPathPrepend {
+			t.Errorf("%s: unexpected path prepend. Actual: %s, Expected: %s", test.name, transport.PathPrepend, test.expectedPathPrepend)
+		}
+	}
+}
+
+func TestProxyRequestContentLengthAndTransferEncoding(t *testing.T) {
+	chunk := func(data []byte) []byte {
+		out := &bytes.Buffer{}
+		chunker := httputil.NewChunkedWriter(out)
+		for _, b := range data {
+			if _, err := chunker.Write([]byte{b}); err != nil {
+				panic(err)
+			}
+		}
+		chunker.Close()
+		out.Write([]byte("\r\n"))
+		return out.Bytes()
+	}
+
+	zip := func(data []byte) []byte {
+		out := &bytes.Buffer{}
+		zipper := gzip.NewWriter(out)
+		if _, err := zipper.Write(data); err != nil {
+			panic(err)
+		}
+		zipper.Close()
+		return out.Bytes()
+	}
+
+	sampleData := []byte("abcde")
+
+	table := map[string]struct {
+		reqHeaders http.Header
+		reqBody    []byte
+
+		expectedHeaders http.Header
+		expectedBody    []byte
+	}{
+		"content-length": {
+			reqHeaders: http.Header{
+				"Content-Length": []string{"5"},
+			},
+			reqBody: sampleData,
+
+			expectedHeaders: http.Header{
+				"Content-Length":    []string{"5"},
+				"Content-Encoding":  nil, // none set
+				"Transfer-Encoding": nil, // none set
+			},
+			expectedBody: sampleData,
+		},
+
+		"content-length + gzip content-encoding": {
+			reqHeaders: http.Header{
+				"Content-Length":   []string{strconv.Itoa(len(zip(sampleData)))},
+				"Content-Encoding": []string{"gzip"},
+			},
+			reqBody: zip(sampleData),
+
+			expectedHeaders: http.Header{
+				"Content-Length":    []string{strconv.Itoa(len(zip(sampleData)))},
+				"Content-Encoding":  []string{"gzip"},
+				"Transfer-Encoding": nil, // none set
+			},
+			expectedBody: zip(sampleData),
+		},
+
+		"chunked transfer-encoding": {
+			reqHeaders: http.Header{
+				"Transfer-Encoding": []string{"chunked"},
+			},
+			reqBody: chunk(sampleData),
+
+			expectedHeaders: http.Header{
+				"Content-Length":    nil, // none set
+				"Content-Encoding":  nil, // none set
+				"Transfer-Encoding": nil, // Transfer-Encoding gets removed
+			},
+			expectedBody: sampleData, // sample data is unchunked
+		},
+
+		"chunked transfer-encoding + gzip content-encoding": {
+			reqHeaders: http.Header{
+				"Content-Encoding":  []string{"gzip"},
+				"Transfer-Encoding": []string{"chunked"},
+			},
+			reqBody: chunk(zip(sampleData)),
+
+			expectedHeaders: http.Header{
+				"Content-Length":    nil, // none set
+				"Content-Encoding":  []string{"gzip"},
+				"Transfer-Encoding": nil, // gets removed
+			},
+			expectedBody: zip(sampleData), // sample data is unchunked, but content-encoding is preserved
+		},
+
+		// "Transfer-Encoding: gzip" is not supported by go
+		// See http/transfer.go#fixTransferEncoding (https://golang.org/src/net/http/transfer.go#L427)
+		// Once it is supported, this test case should succeed
+		//
+		// "gzip+chunked transfer-encoding": {
+		// 	reqHeaders: http.Header{
+		// 		"Transfer-Encoding": []string{"chunked,gzip"},
+		// 	},
+		// 	reqBody: chunk(zip(sampleData)),
+		//
+		// 	expectedHeaders: http.Header{
+		// 		"Content-Length":    nil, // no content-length headers
+		// 		"Transfer-Encoding": nil, // Transfer-Encoding gets removed
+		// 	},
+		// 	expectedBody: sampleData,
+		// },
+	}
+
+	successfulResponse := "backend passed tests"
+	for k, item := range table {
+		// Start the downstream server
+		downstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			// Verify headers
+			for header, v := range item.expectedHeaders {
+				if !reflect.DeepEqual(v, req.Header[header]) {
+					t.Errorf("%s: Expected headers for %s to be %v, got %v", k, header, v, req.Header[header])
+				}
+			}
+
+			// Read body
+			body, err := io.ReadAll(req.Body)
+			if err != nil {
+				t.Errorf("%s: unexpected error %v", k, err)
+			}
+			req.Body.Close()
+
+			// Verify length
+			if req.ContentLength > 0 && req.ContentLength != int64(len(body)) {
+				t.Errorf("%s: ContentLength was %d, len(data) was %d", k, req.ContentLength, len(body))
+			}
+
+			// Verify content
+			if !bytes.Equal(item.expectedBody, body) {
+				t.Errorf("%s: Expected %q, got %q", k, string(item.expectedBody), string(body))
+			}
+
+			// Write successful response
+			w.Write([]byte(successfulResponse))
+		}))
+		defer downstreamServer.Close()
+
+		responder := &fakeResponder{t: t}
+		backendURL, _ := url.Parse(downstreamServer.URL)
+		proxyHandler := NewUpgradeAwareHandler(backendURL, nil, false, false, responder)
+		proxyServer := httptest.NewServer(proxyHandler)
+		defer proxyServer.Close()
+
+		// Dial the proxy server
+		conn, err := net.Dial(proxyServer.Listener.Addr().Network(), proxyServer.Listener.Addr().String())
+		if err != nil {
+			t.Errorf("unexpected error %v", err)
+			continue
+		}
+		defer conn.Close()
+
+		// Add standard http 1.1 headers
+		if item.reqHeaders == nil {
+			item.reqHeaders = http.Header{}
+		}
+		item.reqHeaders.Add("Connection", "close")
+		item.reqHeaders.Add("Host", proxyServer.Listener.Addr().String())
+
+		// Write the request headers
+		if _, err := fmt.Fprint(conn, "POST / HTTP/1.1\r\n"); err != nil {
+			t.Fatalf("%s unexpected error %v", k, err)
+		}
+		for header, values := range item.reqHeaders {
+			for _, value := range values {
+				if _, err := fmt.Fprintf(conn, "%s: %s\r\n", header, value); err != nil {
+					t.Fatalf("%s: unexpected error %v", k, err)
+				}
+			}
+		}
+		// Header separator
+		if _, err := fmt.Fprint(conn, "\r\n"); err != nil {
+			t.Fatalf("%s: unexpected error %v", k, err)
+		}
+		// Body
+		if _, err := conn.Write(item.reqBody); err != nil {
+			t.Fatalf("%s: unexpected error %v", k, err)
+		}
+
+		// Read response
+		response, err := io.ReadAll(conn)
+		if err != nil {
+			t.Errorf("%s: unexpected error %v", k, err)
+			continue
+		}
+		if !strings.HasSuffix(string(response), successfulResponse) {
+			t.Errorf("%s: Did not get successful response: %s", k, string(response))
+			continue
+		}
+	}
+}
+
+func TestFlushIntervalHeaders(t *testing.T) {
+	const expected = "hi"
+	stopCh := make(chan struct{})
+	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("MyHeader", expected)
+		w.WriteHeader(200)
+		w.(http.Flusher).Flush()
+		<-stopCh
+	}))
+	defer backend.Close()
+	defer close(stopCh)
+
+	backendURL, err := url.Parse(backend.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	responder := &fakeResponder{t: t}
+	proxyHandler := NewUpgradeAwareHandler(backendURL, nil, false, false, responder)
+
+	frontend := httptest.NewServer(proxyHandler)
+	defer frontend.Close()
+
+	req, _ := http.NewRequest(http.MethodGet, frontend.URL, nil)
+	req.Close = true
+
+	ctx, cancel := context.WithTimeout(req.Context(), 10*time.Second)
+	defer cancel()
+	req = req.WithContext(ctx)
+
+	res, err := frontend.Client().Do(req)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	defer res.Body.Close()
+
+	if res.Header.Get("MyHeader") != expected {
+		t.Errorf("got header %q; expected %q", res.Header.Get("MyHeader"), expected)
+	}
+}
+
+type fakeRT struct {
+	err error
+}
+
+func (frt *fakeRT) RoundTrip(*http.Request) (*http.Response, error) {
+	return nil, frt.err
+}
+
+// TestErrorPropagation checks if the default transport doesn't swallow the errors by providing a fakeResponder that intercepts and stores the error.
+func TestErrorPropagation(t *testing.T) {
+	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		panic("unreachable")
+	}))
+	defer backend.Close()
+
+	backendURL, err := url.Parse(backend.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	responder := &fakeResponder{t: t}
+	expectedErr := errors.New("nasty error")
+	proxyHandler := NewUpgradeAwareHandler(backendURL, &fakeRT{err: expectedErr}, true, false, responder)
+
+	frontend := httptest.NewServer(proxyHandler)
+	defer frontend.Close()
+
+	req, _ := http.NewRequest(http.MethodGet, frontend.URL, nil)
+	req.Close = true
+
+	ctx, cancel := context.WithTimeout(req.Context(), 10*time.Second)
+	defer cancel()
+	req = req.WithContext(ctx)
+
+	res, err := frontend.Client().Do(req)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	defer res.Body.Close()
+	if res.StatusCode != fakeStatusCode {
+		t.Fatalf("unexpected HTTP status code returned: %v, expected: %v", res.StatusCode, fakeStatusCode)
+	}
+	if !strings.Contains(responder.err.Error(), expectedErr.Error()) {
+		t.Fatalf("responder got unexpected error: %v, expected the error to contain %q", responder.err.Error(), expectedErr.Error())
+	}
+}
+
+func TestProxyRedirectsforRootPath(t *testing.T) {
+
+	tests := []struct {
+		name               string
+		method             string
+		requestPath        string
+		expectedHeader     http.Header
+		expectedStatusCode int
+		redirect           bool
+	}{
+		{
+			name:               "root path, simple get",
+			method:             http.MethodGet,
+			requestPath:        "",
+			redirect:           true,
+			expectedStatusCode: 301,
+			expectedHeader: http.Header{
+				"Location": []string{"/"},
+			},
+		},
+		{
+			name:               "root path, simple put",
+			method:             http.MethodPut,
+			requestPath:        "",
+			redirect:           false,
+			expectedStatusCode: 200,
+		},
+		{
+			name:               "root path, simple head",
+			method:             http.MethodHead,
+			requestPath:        "",
+			redirect:           true,
+			expectedStatusCode: 301,
+			expectedHeader: http.Header{
+				"Location": []string{"/"},
+			},
+		},
+		{
+			name:               "root path, simple delete with params",
+			method:             http.MethodDelete,
+			requestPath:        "",
+			redirect:           false,
+			expectedStatusCode: 200,
+		},
+	}
+
+	for _, test := range tests {
+		func() {
+			w := httptest.NewRecorder()
+			req, err := http.NewRequest(test.method, test.requestPath, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			redirect := proxyRedirectsforRootPath(test.requestPath, w, req)
+			if got, want := redirect, test.redirect; got != want {
+				t.Errorf("Expected redirect state %v; got %v", want, got)
+			}
+
+			res := w.Result()
+			if got, want := res.StatusCode, test.expectedStatusCode; got != want {
+				t.Errorf("Expected status code %d; got %d", want, got)
+			}
+
+			if res.StatusCode == 301 && !reflect.DeepEqual(res.Header, test.expectedHeader) {
+				t.Errorf("Expected location header to be %v, got %v", test.expectedHeader, res.Header)
+			}
+		}()
+	}
+}
+
+// exampleCert was generated from crypto/tls/generate_cert.go with the following command:
+//
+//	go run generate_cert.go  --rsa-bits 1024 --host example.com --ca --start-date "Jan 1 00:00:00 1970" --duration=1000000h
+var exampleCert = []byte(`-----BEGIN CERTIFICATE-----
+MIIDADCCAeigAwIBAgIQVHG3Fn9SdWayyLOZKCW1vzANBgkqhkiG9w0BAQsFADAS
+MRAwDgYDVQQKEwdBY21lIENvMCAXDTcwMDEwMTAwMDAwMFoYDzIwODQwMTI5MTYw
+MDAwWjASMRAwDgYDVQQKEwdBY21lIENvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEArTCu9fiIclNgDdWHphewM+JW55dCb5yYGlJgCBvwbOx547M9p+tn
+zm9QOhsdZDHDZsG9tqnWxE2Nc1HpIJyOlfYsOoonpEoG/Ep6nnK91ngj0bn/JlNy
++i/bwU4r97MOukvnOIQez9/D9jAJaOX2+b8/d4lRz9BsqiwJyg+ynZ5tVVYj7aMi
+vXnd6HOnJmtqutOtr3beucJnkd6XbwRkLUcAYATT+ZihOWRbTuKqhCg6zGkJOoUG
+f8sX61JjoilxiURA//ftGVbdTCU3DrmGmardp5NNOHbumMYU8Vhmqgx1Bqxb+9he
+7G42uW5YWYK/GqJzgVPjjlB2dOGj9KrEWQIDAQABo1AwTjAOBgNVHQ8BAf8EBAMC
+AqQwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB/zAWBgNVHREE
+DzANggtleGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAig4AIi9xWs1+pLES
+eeGGdSDoclplFpcbXANnsYYFyLf+8pcWgVi2bOmb2gXMbHFkB07MA82wRJAUTaA+
+2iNXVQMhPCoA7J6ADUbww9doJX2S9HGyArhiV/MhHtE8txzMn2EKNLdhhk3N9rmV
+x/qRbWAY1U2z4BpdrAR87Fe81Nlj7h45csW9K+eS+NgXipiNTIfEShKgCFM8EdxL
+1WXg7r9AvYV3TNDPWTjLsm1rQzzZQ7Uvcf6deWiNodZd8MOT/BFLclDPTK6cF2Hr
+UU4dq6G4kCwMSxWE4cM3HlZ4u1dyIt47VbkP0rtvkBCXx36y+NXYA5lzntchNFZP
+uvEQdw==
+-----END CERTIFICATE-----`)
+
+var exampleKey = []byte(`-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEArTCu9fiIclNgDdWHphewM+JW55dCb5yYGlJgCBvwbOx547M9
+p+tnzm9QOhsdZDHDZsG9tqnWxE2Nc1HpIJyOlfYsOoonpEoG/Ep6nnK91ngj0bn/
+JlNy+i/bwU4r97MOukvnOIQez9/D9jAJaOX2+b8/d4lRz9BsqiwJyg+ynZ5tVVYj
+7aMivXnd6HOnJmtqutOtr3beucJnkd6XbwRkLUcAYATT+ZihOWRbTuKqhCg6zGkJ
+OoUGf8sX61JjoilxiURA//ftGVbdTCU3DrmGmardp5NNOHbumMYU8Vhmqgx1Bqxb
++9he7G42uW5YWYK/GqJzgVPjjlB2dOGj9KrEWQIDAQABAoIBAQClt4CiYaaF5ltx
+wVDjz6TNcJUBUs3CKE+uWAYFnF5Ii1nyU876Pxj8Aaz9fHZ6Kde0GkwiXY7gFOj1
+YHo2tzcELSKS/SEDZcYbYFTGCjq13g1AH74R+SV6WZLn+5m8kPvVrM1ZWap188H5
+bmuCkRDqVmIvShkbRW7EwhC35J9fiuW3majC/sjmsxtxyP6geWmu4f5/Ttqahcdb
+osPZIgIIPzqAkNtkLTi7+meHYI9wlrGhL7XZTwnJ1Oc/Y67zzmbthLYB5YFSLUew
+rXT58jtSjX4gbiQyheBSrWxW08QE4qYg6jJlAdffHhWv72hJW2MCXhuXp8gJs/Do
+XLRHGwSBAoGBAMdNtsbe4yae/QeHUPGxNW0ipa0yoTF6i+VYoxvqiRMzDM3+3L8k
+dgI1rr4330SivqDahMA/odWtM/9rVwJI2B2QhZLMHA0n9ytH007OO9TghgVB12nN
+xosRYBpKdHXyyvV/MUZl7Jux6zKIzRDWOkF95VVYPcAaxJqd1E5/jJ6JAoGBAN51
+QrebA1w/jfydeqQTz1sK01sbO4HYj4qGfo/JarVqGEkm1azeBBPPRnHz3jNKnCkM
+S4PpqRDased3NIcViXlAgoqPqivZ8mQa/Rb146l7WaTErASHsZ023OGrxsr/Ed6N
+P3GrmvxVJjebaFNaQ9sP80dLkpgeas0t2TY8iQNRAoGATOcnx8TpUVW3vNfx29DN
+FLdxxkrq9/SZVn3FMlhlXAsuva3B799ZybB9JNjaRdmmRNsMrkHfaFvU3JHGmRMS
+kRXa9LHdgRYSwZiNaLMbUyDvlce6HxFPswmZU4u3NGvi9KeHk+pwSgN1BaLTvdNr
+1ymE/FF4QlAR3LdZ3JBK6kECgYEA0wW4/CJ31ZIURoW8SNjh4iMqy0nR8SJVR7q9
+Y/hU2TKDRyEnoIwaohAFayNCrLUh3W5kVAXa8roB+OgDVAECH5sqOfZ+HorofD19
+x8II7ESujLZj1whBXDkm3ovsT7QWZ17lyBZZNvQvBKDPHgKKS8udowv1S4fPGENd
+wS07a4ECgYEAwLSbmMIVJme0jFjsp5d1wOGA2Qi2ZwGIAVlsbnJtygrU/hSBfnu8
+VfyJSCgg3fPe7kChWKlfcOebVKSb68LKRsz1Lz1KdbY0HOJFp/cT4lKmDAlRY9gq
+LB4rdf46lV0mUkvd2/oofIbTrzukjQSnyfLawb/2uJGV1IkTcZcn9CI=
+-----END RSA PRIVATE KEY-----`)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/rand/rand.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/rand/rand.go
new file mode 100644
index 0000000000..82a473bb14
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/rand/rand.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package rand provides utilities related to randomization.
+package rand
+
+import (
+	"math/rand"
+	"sync"
+	"time"
+)
+
+var rng = struct {
+	sync.Mutex
+	rand *rand.Rand
+}{
+	rand: rand.New(rand.NewSource(time.Now().UnixNano())),
+}
+
+// Int returns a non-negative pseudo-random int.
+func Int() int {
+	rng.Lock()
+	defer rng.Unlock()
+	return rng.rand.Int()
+}
+
+// Intn generates an integer in range [0,max).
+// By design this should panic if input is invalid, <= 0.
+func Intn(max int) int {
+	rng.Lock()
+	defer rng.Unlock()
+	return rng.rand.Intn(max)
+}
+
+// IntnRange generates an integer in range [min,max).
+// By design this should panic if input is invalid, <= 0.
+func IntnRange(min, max int) int {
+	rng.Lock()
+	defer rng.Unlock()
+	return rng.rand.Intn(max-min) + min
+}
+
+// IntnRange generates an int64 integer in range [min,max).
+// By design this should panic if input is invalid, <= 0.
+func Int63nRange(min, max int64) int64 {
+	rng.Lock()
+	defer rng.Unlock()
+	return rng.rand.Int63n(max-min) + min
+}
+
+// Seed seeds the rng with the provided seed.
+func Seed(seed int64) {
+	rng.Lock()
+	defer rng.Unlock()
+
+	rng.rand = rand.New(rand.NewSource(seed))
+}
+
+// Perm returns, as a slice of n ints, a pseudo-random permutation of the integers [0,n)
+// from the default Source.
+func Perm(n int) []int {
+	rng.Lock()
+	defer rng.Unlock()
+	return rng.rand.Perm(n)
+}
+
+const (
+	// We omit vowels from the set of available characters to reduce the chances
+	// of "bad words" being formed.
+	alphanums = "bcdfghjklmnpqrstvwxz2456789"
+	// No. of bits required to index into alphanums string.
+	alphanumsIdxBits = 5
+	// Mask used to extract last alphanumsIdxBits of an int.
+	alphanumsIdxMask = 1<<alphanumsIdxBits - 1
+	// No. of random letters we can extract from a single int63.
+	maxAlphanumsPerInt = 63 / alphanumsIdxBits
+)
+
+// String generates a random alphanumeric string, without vowels, which is n
+// characters long.  This will panic if n is less than zero.
+// How the random string is created:
+// - we generate random int63's
+// - from each int63, we are extracting multiple random letters by bit-shifting and masking
+// - if some index is out of range of alphanums we neglect it (unlikely to happen multiple times in a row)
+func String(n int) string {
+	b := make([]byte, n)
+	rng.Lock()
+	defer rng.Unlock()
+
+	randomInt63 := rng.rand.Int63()
+	remaining := maxAlphanumsPerInt
+	for i := 0; i < n; {
+		if remaining == 0 {
+			randomInt63, remaining = rng.rand.Int63(), maxAlphanumsPerInt
+		}
+		if idx := int(randomInt63 & alphanumsIdxMask); idx < len(alphanums) {
+			b[i] = alphanums[idx]
+			i++
+		}
+		randomInt63 >>= alphanumsIdxBits
+		remaining--
+	}
+	return string(b)
+}
+
+// SafeEncodeString encodes s using the same characters as rand.String. This reduces the chances of bad words and
+// ensures that strings generated from hash functions appear consistent throughout the API.
+func SafeEncodeString(s string) string {
+	r := make([]byte, len(s))
+	for i, b := range []rune(s) {
+		r[i] = alphanums[(int(b) % len(alphanums))]
+	}
+	return string(r)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/rand/rand_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/rand/rand_test.go
new file mode 100644
index 0000000000..e677aa9750
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/rand/rand_test.go
@@ -0,0 +1,114 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package rand
+
+import (
+	"math/rand"
+	"strings"
+	"testing"
+)
+
+const (
+	maxRangeTestCount = 500
+	testStringLength  = 32
+)
+
+func TestString(t *testing.T) {
+	valid := "bcdfghjklmnpqrstvwxz2456789"
+	for _, l := range []int{0, 1, 2, 10, 123} {
+		s := String(l)
+		if len(s) != l {
+			t.Errorf("expected string of size %d, got %q", l, s)
+		}
+		for _, c := range s {
+			if !strings.ContainsRune(valid, c) {
+				t.Errorf("expected valid characters, got %v", c)
+			}
+		}
+	}
+}
+
+// Confirm that panic occurs on invalid input.
+func TestRangePanic(t *testing.T) {
+	defer func() {
+		if err := recover(); err == nil {
+			t.Errorf("Panic didn't occur!")
+		}
+	}()
+	// Should result in an error...
+	Intn(0)
+}
+
+func TestIntn(t *testing.T) {
+	// 0 is invalid.
+	for _, max := range []int{1, 2, 10, 123} {
+		inrange := Intn(max)
+		if inrange < 0 || inrange > max {
+			t.Errorf("%v out of range (0,%v)", inrange, max)
+		}
+	}
+}
+
+func TestPerm(t *testing.T) {
+	Seed(5)
+	r := rand.New(rand.NewSource(5))
+	for i := 1; i < 20; i++ {
+		actual := Perm(i)
+		expected := r.Perm(i)
+		for j := 0; j < i; j++ {
+			if actual[j] != expected[j] {
+				t.Errorf("Perm call result is unexpected")
+			}
+		}
+	}
+}
+
+func TestIntnRange(t *testing.T) {
+	// 0 is invalid.
+	for min, max := range map[int]int{1: 2, 10: 123, 100: 500} {
+		for i := 0; i < maxRangeTestCount; i++ {
+			inrange := IntnRange(min, max)
+			if inrange < min || inrange >= max {
+				t.Errorf("%v out of range (%v,%v)", inrange, min, max)
+			}
+		}
+	}
+}
+
+func TestInt63nRange(t *testing.T) {
+	// 0 is invalid.
+	for min, max := range map[int64]int64{1: 2, 10: 123, 100: 500} {
+		for i := 0; i < maxRangeTestCount; i++ {
+			inrange := Int63nRange(min, max)
+			if inrange < min || inrange >= max {
+				t.Errorf("%v out of range (%v,%v)", inrange, min, max)
+			}
+		}
+	}
+}
+
+func BenchmarkRandomStringGeneration(b *testing.B) {
+	b.ResetTimer()
+	var s string
+	for i := 0; i < b.N; i++ {
+		s = String(testStringLength)
+	}
+	b.StopTimer()
+	if len(s) == 0 {
+		b.Fatal(s)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/remotecommand/constants.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/remotecommand/constants.go
new file mode 100644
index 0000000000..ba153ee24f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/remotecommand/constants.go
@@ -0,0 +1,67 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package remotecommand
+
+import (
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	DefaultStreamCreationTimeout = 30 * time.Second
+
+	// The SPDY subprotocol "channel.k8s.io" is used for remote command
+	// attachment/execution. This represents the initial unversioned subprotocol,
+	// which has the known bugs https://issues.k8s.io/13394 and
+	// https://issues.k8s.io/13395.
+	StreamProtocolV1Name = "channel.k8s.io"
+
+	// The SPDY subprotocol "v2.channel.k8s.io" is used for remote command
+	// attachment/execution. It is the second version of the subprotocol and
+	// resolves the issues present in the first version.
+	StreamProtocolV2Name = "v2.channel.k8s.io"
+
+	// The SPDY subprotocol "v3.channel.k8s.io" is used for remote command
+	// attachment/execution. It is the third version of the subprotocol and
+	// adds support for resizing container terminals.
+	StreamProtocolV3Name = "v3.channel.k8s.io"
+
+	// The SPDY subprotocol "v4.channel.k8s.io" is used for remote command
+	// attachment/execution. It is the 4th version of the subprotocol and
+	// adds support for exit codes.
+	StreamProtocolV4Name = "v4.channel.k8s.io"
+
+	// The subprotocol "v5.channel.k8s.io" is used for remote command
+	// attachment/execution. It is the 5th version of the subprotocol and
+	// adds support for a CLOSE signal.
+	StreamProtocolV5Name = "v5.channel.k8s.io"
+
+	NonZeroExitCodeReason = metav1.StatusReason("NonZeroExitCode")
+	ExitCodeCauseType     = metav1.CauseType("ExitCode")
+
+	// RemoteCommand stream identifiers. The first three identifiers (for STDIN,
+	// STDOUT, STDERR) are the same as their file descriptors.
+	StreamStdIn  = 0
+	StreamStdOut = 1
+	StreamStdErr = 2
+	StreamErr    = 3
+	StreamResize = 4
+	StreamClose  = 255
+)
+
+var SupportedStreamingProtocols = []string{StreamProtocolV4Name, StreamProtocolV3Name, StreamProtocolV2Name, StreamProtocolV1Name}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/resourceversion/resourceversion.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/resourceversion/resourceversion.go
new file mode 100644
index 0000000000..6f672c4b46
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/resourceversion/resourceversion.go
@@ -0,0 +1,85 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resourceversion
+
+import (
+	"fmt"
+	"strings"
+)
+
+type InvalidResourceVersion struct {
+	rv string
+}
+
+func (i InvalidResourceVersion) Error() string {
+	return fmt.Sprintf("resource version is not well formed: %s", i.rv)
+}
+
+// CompareResourceVersion runs a comparison between two ResourceVersions. This
+// only has semantic meaning when the comparison is done on two objects of the
+// same resource. The return values are:
+//
+//	-1: If RV a < RV b
+//	 0: If RV a == RV b
+//	+1: If RV a > RV b
+//
+// The function will return an error if the resource version is not a properly
+// formatted positive integer, but has no restriction on length. A properly
+// formatted integer will not contain leading zeros or non integer characters.
+// Zero is also considered an invalid value as it is used as a special value in
+// list/watch events and will never be a live resource version.
+func CompareResourceVersion(a, b string) (int, error) {
+	if !isWellFormed(a) {
+		return 0, InvalidResourceVersion{rv: a}
+	}
+	if !isWellFormed(b) {
+		return 0, InvalidResourceVersion{rv: b}
+	}
+	// both are well-formed integer strings with no leading zeros
+	aLen := len(a)
+	bLen := len(b)
+	switch {
+	case aLen < bLen:
+		// shorter is less
+		return -1, nil
+	case aLen > bLen:
+		// longer is greater
+		return 1, nil
+	default:
+		// equal-length compares lexically
+		return strings.Compare(a, b), nil
+	}
+}
+
+func isWellFormed(s string) bool {
+	if len(s) == 0 {
+		return false
+	}
+	if s[0] == '0' {
+		return false
+	}
+	for i := range s {
+		if !isDigit(s[i]) {
+			return false
+		}
+	}
+	return true
+}
+
+func isDigit(b byte) bool {
+	return b >= '0' && b <= '9'
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/resourceversion/resourceversion_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/resourceversion/resourceversion_test.go
new file mode 100644
index 0000000000..dd3785e9ac
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/resourceversion/resourceversion_test.go
@@ -0,0 +1,162 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resourceversion
+
+import (
+	"testing"
+)
+
+func TestCompareResourceVersion(t *testing.T) {
+	testCases := []struct {
+		name     string
+		a        string
+		b        string
+		expected int
+		err      bool
+	}{
+		{
+			name:     "a less than b",
+			a:        "100",
+			b:        "200",
+			expected: -1,
+		},
+		{
+			name: "a is zero, invalid",
+			a:    "0",
+			b:    "1",
+			err:  true,
+		},
+		{
+			name: "both zero",
+			a:    "0",
+			b:    "0",
+			err:  true,
+		},
+		{
+			name:     "a greater than b",
+			a:        "200",
+			b:        "100",
+			expected: 1,
+		},
+		{
+			name: "b is 0, invalid",
+			a:    "1",
+			b:    "0",
+			err:  true,
+		},
+		{
+			name:     "a equal to b small",
+			a:        "1",
+			b:        "1",
+			expected: 0,
+		},
+		{
+			name:     "a equal to b",
+			a:        "100",
+			b:        "100",
+			expected: 0,
+		},
+		{
+			name:     "a shorter than b",
+			a:        "99",
+			b:        "100",
+			expected: -1,
+		},
+		{
+			name:     "a longer than b",
+			a:        "100",
+			b:        "99",
+			expected: 1,
+		},
+		{
+			name:     "a with leading zero",
+			a:        "0100",
+			b:        "100",
+			expected: 0,
+			err:      true,
+		},
+		{
+			name:     "b with leading zero",
+			a:        "100",
+			b:        "0100",
+			expected: 0,
+			err:      true,
+		},
+		{
+			name:     "a empty",
+			a:        "",
+			b:        "100",
+			expected: 0,
+			err:      true,
+		},
+		{
+			name:     "b empty",
+			a:        "100",
+			b:        "",
+			expected: 0,
+			err:      true,
+		},
+		{
+			name: "a non-digit",
+			a:    "100a",
+			b:    "100",
+			err:  true,
+		},
+		{
+			name: "b non-digit",
+			a:    "100",
+			b:    "100a",
+			err:  true,
+		},
+		{
+			name:     "large int a less than b",
+			a:        "99999999999999999999999999999999999999999999999999",
+			b:        "100000000000000000000000000000000000000000000000000",
+			expected: -1,
+		},
+		{
+			name:     "large int a greater than b",
+			a:        "100000000000000000000000000000000000000000000000000",
+			b:        "99999999999999999999999999999999999999999999999999",
+			expected: 1,
+		},
+		{
+			name:     "large int a equal to b",
+			a:        "12345678901234567890123456789012345678901234567890",
+			b:        "12345678901234567890123456789012345678901234567890",
+			expected: 0,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			actual, err := CompareResourceVersion(tc.a, tc.b)
+			if tc.err {
+				if err == nil {
+					t.Fatalf("expected error, but got none")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if actual != tc.expected {
+				t.Errorf("expected %d, got %d", tc.expected, actual)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime.go
new file mode 100644
index 0000000000..38c1f7b03c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime.go
@@ -0,0 +1,326 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net/http"
+	"runtime"
+	"strings"
+	"sync"
+	"time"
+
+	"k8s.io/klog/v2"
+	"k8s.io/klog/v2/textlogger"
+)
+
+var (
+	// ReallyCrash controls the behavior of HandleCrash and defaults to
+	// true. It's exposed so components can optionally set to false
+	// to restore prior behavior. This flag is mostly used for tests to validate
+	// crash conditions.
+	ReallyCrash = true
+)
+
+// PanicHandlers is a list of functions which will be invoked when a panic happens.
+//
+// The code invoking these handlers prepares a contextual logger so that
+// klog.FromContext(ctx) already skips over the panic handler itself and
+// several other intermediate functions, ideally such that the log output
+// is attributed to the code which triggered the panic.
+var PanicHandlers = []func(context.Context, interface{}){logPanic}
+
+// HandleCrash simply catches a crash and logs an error. Meant to be called via
+// defer.  Additional context-specific handlers can be provided, and will be
+// called in case of panic.  HandleCrash actually crashes, after calling the
+// handlers and logging the panic message.
+//
+// E.g., you can provide one or more additional handlers for something like shutting down go routines gracefully.
+//
+// Contextual logging: HandleCrashWithContext or HandleCrashWithLogger should be used instead of HandleCrash in code which supports contextual logging.
+func HandleCrash(additionalHandlers ...func(interface{})) {
+	if r := recover(); r != nil {
+		additionalHandlersWithContext := make([]func(context.Context, interface{}), len(additionalHandlers))
+		for i, handler := range additionalHandlers {
+			additionalHandlersWithContext[i] = func(_ context.Context, r interface{}) {
+				handler(r)
+			}
+		}
+
+		handleCrash(context.Background(), r, additionalHandlersWithContext...)
+	}
+}
+
+// HandleCrashWithContext simply catches a crash and logs an error. Meant to be called via
+// defer.  Additional context-specific handlers can be provided, and will be
+// called in case of panic.  HandleCrash actually crashes, after calling the
+// handlers and logging the panic message.
+//
+// E.g., you can provide one or more additional handlers for something like shutting down go routines gracefully.
+//
+// The context is used to determine how to log.
+func HandleCrashWithContext(ctx context.Context, additionalHandlers ...func(context.Context, interface{})) {
+	if r := recover(); r != nil {
+		handleCrash(ctx, r, additionalHandlers...)
+	}
+}
+
+// HandleCrashWithLogger simply catches a crash and logs an error. Meant to be called via
+// defer.  Additional context-specific handlers can be provided, and will be
+// called in case of panic.  HandleCrash actually crashes, after calling the
+// handlers and logging the panic message.
+//
+// E.g., you can provide one or more additional handlers for something like shutting down go routines gracefully.
+func HandleCrashWithLogger(logger klog.Logger, additionalHandlers ...func(context.Context, interface{})) {
+	if r := recover(); r != nil {
+		ctx := klog.NewContext(context.Background(), logger)
+		handleCrash(ctx, r, additionalHandlers...)
+	}
+}
+
+// handleCrash is the common implementation of the HandleCrash* variants.
+// Having those call a common implementation ensures that the stack depth
+// is the same regardless through which path the handlers get invoked.
+func handleCrash(ctx context.Context, r any, additionalHandlers ...func(context.Context, interface{})) {
+	// We don't really know how many call frames to skip because the Go
+	// panic handler is between us and the code where the panic occurred.
+	// If it's one function (as in Go 1.21), then skipping four levels
+	// gets us to the function which called the `defer HandleCrashWithontext(...)`.
+	logger := klog.FromContext(ctx).WithCallDepth(4)
+	ctx = klog.NewContext(ctx, logger)
+
+	for _, fn := range PanicHandlers {
+		fn(ctx, r)
+	}
+	for _, fn := range additionalHandlers {
+		fn(ctx, r)
+	}
+	if ReallyCrash {
+		// Actually proceed to panic.
+		panic(r)
+	}
+}
+
+// logPanic logs the caller tree when a panic occurs (except in the special case of http.ErrAbortHandler).
+func logPanic(ctx context.Context, r interface{}) {
+	if r == http.ErrAbortHandler {
+		// honor the http.ErrAbortHandler sentinel panic value:
+		//   ErrAbortHandler is a sentinel panic value to abort a handler.
+		//   While any panic from ServeHTTP aborts the response to the client,
+		//   panicking with ErrAbortHandler also suppresses logging of a stack trace to the server's error log.
+		return
+	}
+
+	// Same as stdlib http server code. Manually allocate stack trace buffer size
+	// to prevent excessively large logs
+	const size = 64 << 10
+	stacktrace := make([]byte, size)
+	stacktrace = stacktrace[:runtime.Stack(stacktrace, false)]
+
+	logger := klog.FromContext(ctx)
+
+	// For backwards compatibility, conversion to string
+	// is handled here instead of defering to the logging
+	// backend.
+	if _, ok := r.(string); ok {
+		logger.Error(nil, "Observed a panic", "panic", r, "stacktrace", string(stacktrace))
+	} else {
+		logger.Error(nil, "Observed a panic", "panic", fmt.Sprintf("%v", r), "panicGoValue", fmt.Sprintf("%#v", r), "stacktrace", string(stacktrace))
+	}
+}
+
+// ErrorHandlers is a list of functions which will be invoked when a nonreturnable
+// error occurs.
+// TODO(lavalamp): for testability, this and the below HandleError function
+// should be packaged up into a testable and reusable object.
+var ErrorHandlers = []ErrorHandler{
+	logError,
+	// 1ms was the number folks were able to stomach as a global rate limit.
+	// If you need to log errors more than 1000 times a second, you
+	// should probably consider fixing your code instead. :)
+	backoffError(1 * time.Millisecond),
+}
+
+// ErrorHandler is called indirectly through [HandleError], [HandleErrorWithContext] or [HandleErrorWithLogger].
+// It is passed the same parameters that a structured logging backend needs to log a problem.
+// It follows the semantic described for [HandleErrorWithContext] and [logr.Logger.Error]:
+// - err is optional and may be nil
+// - msg is string that describes the problem
+// - keysAndValues contains additional information that varies between different occurrences of the problem
+//
+// [ErrorToString] can be used to convert these parameters into a single string, using the klog text output.
+type ErrorHandler func(ctx context.Context, err error, msg string, keysAndValues ...interface{})
+
+// ErrorToString takes the parameters passed to [ErrorHandler] and
+// formats them as a string using the klog text output.
+//
+// If any of the values is a multi-line string, then the resulting
+// string also uses line breaks and indention for the sake of readability.
+// Does not include a trailing newline.
+//
+// Use errors.New if an error instead of a string is needed.
+func ErrorToString(err error, msg string, keysAndValues ...interface{}) string {
+	var buffer bytes.Buffer
+	config := textlogger.NewConfig(
+		textlogger.Output(&buffer),
+		textlogger.WithHeader(false),
+	)
+	logger := textlogger.NewLogger(config)
+	logger.Error(err, msg, keysAndValues...)
+	result := buffer.String()
+	result = strings.TrimSpace(result)
+	return result
+}
+
+// HandlerError is a method to invoke when a non-user facing piece of code cannot
+// return an error and needs to indicate it has been ignored. Invoking this method
+// is preferable to logging the error - the default behavior is to log but the
+// errors may be sent to a remote server for analysis.
+//
+// Contextual logging: HandleErrorWithContext should be used instead of HandleError in code which supports contextual logging.
+func HandleError(err error) {
+	// this is sometimes called with a nil error.  We probably shouldn't fail and should do nothing instead
+	if err == nil {
+		return
+	}
+
+	handleError(context.Background(), err, "Unhandled Error")
+}
+
+// HandlerErrorWithContext is a method to invoke when a non-user facing piece of code cannot
+// return an error and needs to indicate it has been ignored. Invoking this method
+// is preferable to logging the error - the default behavior is to log but the
+// errors may be sent to a remote server for analysis. The context is used to
+// determine how to log the error.
+//
+// If contextual logging is enabled, the default log output is equivalent to
+//
+//	logr.FromContext(ctx).WithName("UnhandledError").Error(err, msg, keysAndValues...)
+//
+// Without contextual logging, it is equivalent to:
+//
+//	klog.ErrorS(err, msg, keysAndValues...)
+//
+// In contrast to HandleError, passing nil for the error is still going to
+// trigger a log entry. Don't construct a new error or wrap an error
+// with fmt.Errorf. Instead, add additional information via the mssage
+// and key/value pairs.
+//
+// This variant should be used instead of HandleError because it supports
+// structured, contextual logging. Alternatively, [HandleErrorWithLogger] can
+// be used if a logger is available instead of a context.
+func HandleErrorWithContext(ctx context.Context, err error, msg string, keysAndValues ...interface{}) {
+	handleError(ctx, err, msg, keysAndValues...)
+}
+
+// HandleErrorWithLogger is an alternative to [HandlerErrorWithContext] which accepts
+// a logger for contextual logging.
+func HandleErrorWithLogger(logger klog.Logger, err error, msg string, keysAndValues ...interface{}) {
+	handleError(klog.NewContext(context.Background(), logger), err, msg, keysAndValues...)
+}
+
+// handleError is the common implementation of the HandleError* variants.
+// Using this common implementation ensures that the stack depth
+// is the same regardless through which path the handlers get invoked.
+func handleError(ctx context.Context, err error, msg string, keysAndValues ...interface{}) {
+	for _, fn := range ErrorHandlers {
+		fn(ctx, err, msg, keysAndValues...)
+	}
+}
+
+// logError prints an error with the call stack of the location it was reported.
+// It expects to be called as <caller> -> HandleError[WithContext] -> handleError -> logError.
+func logError(ctx context.Context, err error, msg string, keysAndValues ...interface{}) {
+	logger := klog.FromContext(ctx).WithCallDepth(3)
+	logger = klog.LoggerWithName(logger, "UnhandledError")
+	logger.Error(err, msg, keysAndValues...) //nolint:logcheck // logcheck complains about unknown key/value pairs.
+}
+
+// backoffError blocks if it is called more often than the minPeriod.
+func backoffError(minPeriod time.Duration) ErrorHandler {
+	r := &rudimentaryErrorBackoff{
+		lastErrorTime: time.Now(),
+		minPeriod:     minPeriod,
+	}
+
+	return func(ctx context.Context, err error, msg string, keysAndValues ...interface{}) {
+		r.OnError()
+	}
+}
+
+type rudimentaryErrorBackoff struct {
+	minPeriod time.Duration // immutable
+	// TODO(lavalamp): use the clock for testability. Need to move that
+	// package for that to be accessible here.
+	lastErrorTimeLock sync.Mutex
+	lastErrorTime     time.Time
+}
+
+// OnError will block if it is called more often than the embedded period time.
+// This will prevent overly tight hot error loops.
+func (r *rudimentaryErrorBackoff) OnError() {
+	now := time.Now() // start the timer before acquiring the lock
+	r.lastErrorTimeLock.Lock()
+	d := now.Sub(r.lastErrorTime)
+	r.lastErrorTime = time.Now()
+	r.lastErrorTimeLock.Unlock()
+
+	// Do not sleep with the lock held because that causes all callers of HandleError to block.
+	// We only want the current goroutine to block.
+	// A negative or zero duration causes time.Sleep to return immediately.
+	// If the time moves backwards for any reason, do nothing.
+	time.Sleep(r.minPeriod - d)
+}
+
+// GetCaller returns the caller of the function that calls it.
+func GetCaller() string {
+	var pc [1]uintptr
+	runtime.Callers(3, pc[:])
+	f := runtime.FuncForPC(pc[0])
+	if f == nil {
+		return "Unable to find caller"
+	}
+	return f.Name()
+}
+
+// RecoverFromPanic replaces the specified error with an error containing the
+// original error, and  the call tree when a panic occurs. This enables error
+// handlers to handle errors and panics the same way.
+func RecoverFromPanic(err *error) {
+	if r := recover(); r != nil {
+		// Same as stdlib http server code. Manually allocate stack trace buffer size
+		// to prevent excessively large logs
+		const size = 64 << 10
+		stacktrace := make([]byte, size)
+		stacktrace = stacktrace[:runtime.Stack(stacktrace, false)]
+
+		*err = fmt.Errorf(
+			"recovered from panic %q. (err=%v) Call stack:\n%s",
+			r,
+			*err,
+			stacktrace)
+	}
+}
+
+// Must panics on non-nil errors. Useful to handling programmer level errors.
+func Must(err error) {
+	if err != nil {
+		panic(err)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime_stack_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime_stack_test.go
new file mode 100644
index 0000000000..380ad5b1a5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime_stack_test.go
@@ -0,0 +1,71 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"regexp"
+
+	"k8s.io/klog/v2"
+)
+
+//nolint:logcheck // Several functions are normally not okay in a package.
+func ExampleHandleErrorWithContext() {
+	state := klog.CaptureState()
+	defer state.Restore()
+	var fs flag.FlagSet
+	klog.InitFlags(&fs)
+	for flag, value := range map[string]string{
+		"one_output":  "true",
+		"logtostderr": "false",
+	} {
+		if err := fs.Set(flag, value); err != nil {
+			fmt.Printf("Unexpected error configuring klog: %v", err)
+			return
+		}
+	}
+	var buffer bytes.Buffer
+	klog.SetOutput(&buffer)
+
+	logger := klog.Background()
+	logger = klog.LoggerWithValues(logger, "request", 42)
+	ctx := klog.NewContext(context.Background(), logger)
+
+	// The line number of the next call must be at line 60. Here are some
+	// blank lines that can be removed to keep the line unchanged.
+	//
+	//
+	//
+	//
+	//
+	//
+	HandleErrorWithContext(ctx, errors.New("fake error"), "test")
+
+	klog.Flush()
+	// Strip varying header. Code location should be constant and something
+	// that needs to be tested.
+	output := buffer.String()
+	output = regexp.MustCompile(`^.* ([^[:space:]]*.go:[[:digit:]]*)\] `).ReplaceAllString(output, `xxx $1] `)
+	fmt.Print(output)
+
+	// Output:
+	// xxx runtime_stack_test.go:60] "test" err="fake error" logger="UnhandledError" request=42
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime_test.go
new file mode 100644
index 0000000000..5af48a7a80
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime_test.go
@@ -0,0 +1,349 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"regexp"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	"k8s.io/klog/v2"
+	"k8s.io/klog/v2/textlogger"
+)
+
+func TestHandleCrash(t *testing.T) {
+	defer func() {
+		if x := recover(); x == nil {
+			t.Errorf("Expected a panic to recover from")
+		}
+	}()
+	//nolint:logcheck // Intentionally uses the old API.
+	defer HandleCrash()
+	panic("Test Panic")
+}
+
+func TestCustomHandleCrash(t *testing.T) {
+	old := PanicHandlers
+	defer func() { PanicHandlers = old }()
+	var result interface{}
+	PanicHandlers = []func(context.Context, interface{}){
+		func(_ context.Context, r interface{}) {
+			result = r
+		},
+	}
+	func() {
+		defer func() {
+			if x := recover(); x == nil {
+				t.Errorf("Expected a panic to recover from")
+			}
+		}()
+		//nolint:logcheck // Intentionally uses the old API.
+		defer HandleCrash()
+		panic("test")
+	}()
+	if result != "test" {
+		t.Errorf("did not receive custom handler")
+	}
+}
+
+func TestCustomHandleError(t *testing.T) {
+	old := ErrorHandlers
+	defer func() { ErrorHandlers = old }()
+	var result error
+	ErrorHandlers = []ErrorHandler{
+		func(_ context.Context, err error, msg string, keysAndValues ...interface{}) {
+			result = err
+		},
+	}
+	err := fmt.Errorf("test")
+	//nolint:logcheck // Intentionally uses the old API.
+	HandleError(err)
+	if result != err {
+		t.Errorf("did not receive custom handler")
+	}
+}
+
+func TestHandleCrashLog(t *testing.T) {
+	log, err := captureStderr(func() {
+		defer func() {
+			if r := recover(); r == nil {
+				t.Fatalf("expected a panic to recover from")
+			}
+		}()
+		//nolint:logcheck // Intentionally uses the old API.
+		defer HandleCrash()
+		panic("test panic")
+	})
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	// Example log:
+	//
+	// ...] Observed a panic: test panic
+	// goroutine 6 [running]:
+	// command-line-arguments.logPanic(0x..., 0x...)
+	// 	.../src/k8s.io/kubernetes/staging/src/k8s.io/apimachinery/pkg/util/runtime/runtime.go:69 +0x...
+	lines := strings.Split(log, "\n")
+	if len(lines) < 4 {
+		t.Fatalf("panic log should have 1 line of message, 1 line per goroutine and 2 lines per function call")
+	}
+	t.Logf("Got log output:\n%s", strings.Join(lines, "\n"))
+	if match, _ := regexp.MatchString(`"Observed a panic" panic="test panic"`, lines[0]); !match {
+		t.Errorf("mismatch panic message: %s", lines[0])
+	}
+	// The following regexp's verify that Kubernetes panic log matches Golang stdlib
+	// stacktrace pattern. We need to update these regexp's if stdlib changes its pattern.
+	if match, _ := regexp.MatchString(`goroutine [0-9]+ \[.+\]:`, lines[1]); !match {
+		t.Errorf("mismatch goroutine: %s", lines[1])
+	}
+	if match, _ := regexp.MatchString(`logPanic(.*)`, lines[2]); !match {
+		t.Errorf("mismatch symbolized function name: %s", lines[2])
+	}
+	if match, _ := regexp.MatchString(`runtime\.go:[0-9]+ \+0x`, lines[3]); !match {
+		t.Errorf("mismatch file/line/offset information: %s", lines[3])
+	}
+}
+
+func TestHandleCrashContextual(t *testing.T) {
+	for name, handleCrash := range map[string]func(logger klog.Logger, trigger func(), additionalHandlers ...func(context.Context, interface{})){
+		"WithLogger": func(logger klog.Logger, trigger func(), additionalHandlers ...func(context.Context, interface{})) {
+			logger = logger.WithCallDepth(2) // This function *and* the trigger helper.
+			defer HandleCrashWithLogger(logger, additionalHandlers...)
+			trigger()
+		},
+		"WithContext": func(logger klog.Logger, trigger func(), additionalHandlers ...func(context.Context, interface{})) {
+			logger = logger.WithCallDepth(2)
+			defer HandleCrashWithContext(klog.NewContext(context.Background(), logger), additionalHandlers...)
+			trigger()
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			for name, tt := range map[string]struct {
+				trigger     func()
+				expectPanic string
+			}{
+				"no-panic": {
+					trigger:     func() {},
+					expectPanic: "",
+				},
+				"string-panic": {
+					trigger:     func() { panic("fake") },
+					expectPanic: "fake",
+				},
+				"int-panic": {
+					trigger:     func() { panic(42) },
+					expectPanic: "42",
+				},
+			} {
+				t.Run(name, func(t *testing.T) {
+					var buffer bytes.Buffer
+					timeInUTC := time.Date(2009, 12, 1, 13, 30, 40, 42000, time.UTC)
+					timeString := "1201 13:30:40.000042"
+					logger := textlogger.NewLogger(textlogger.NewConfig(
+						textlogger.FixedTime(timeInUTC),
+						textlogger.Output(&buffer),
+					))
+					ReallyCrash = false
+					defer func() { ReallyCrash = true }()
+
+					handler := func(ctx context.Context, r interface{}) {
+						// Same formatting as in HandleCrash.
+						str, ok := r.(string)
+						if !ok {
+							str = fmt.Sprintf("%v", r)
+						}
+						klog.FromContext(ctx).Info("handler called", "panic", str)
+					}
+
+					_, _, line, _ := runtime.Caller(0)
+					handleCrash(logger, tt.trigger, handler)
+					if tt.expectPanic != "" {
+						assert.Contains(t, buffer.String(), fmt.Sprintf(`E%s %7d runtime_test.go:%d] "Observed a panic" panic=%q`, timeString, os.Getpid(), line+1, tt.expectPanic))
+						assert.Contains(t, buffer.String(), fmt.Sprintf(`I%s %7d runtime_test.go:%d] "handler called" panic=%q
+`, timeString, os.Getpid(), line+1, tt.expectPanic))
+					} else {
+						assert.Empty(t, buffer.String())
+					}
+				})
+			}
+		})
+	}
+}
+
+func TestHandleCrashLogSilenceHTTPErrAbortHandler(t *testing.T) {
+	log, err := captureStderr(func() {
+		defer func() {
+			if r := recover(); r != http.ErrAbortHandler {
+				t.Fatalf("expected to recover from http.ErrAbortHandler")
+			}
+		}()
+		//nolint:logcheck // Intentionally uses the old API.
+		defer HandleCrash()
+		panic(http.ErrAbortHandler)
+	})
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	if len(log) > 0 {
+		t.Fatalf("expected no stderr log, got: %s", log)
+	}
+}
+
+// captureStderr redirects stderr to result string, and then restore stderr from backup
+func captureStderr(f func()) (string, error) {
+	r, w, err := os.Pipe()
+	if err != nil {
+		return "", err
+	}
+	bak := os.Stderr
+	os.Stderr = w
+	defer func() { os.Stderr = bak }()
+
+	resultCh := make(chan string)
+	// copy the output in a separate goroutine so printing can't block indefinitely
+	go func() {
+		var buf bytes.Buffer
+		io.Copy(&buf, r)
+		resultCh <- buf.String()
+	}()
+
+	f()
+	w.Close()
+
+	return <-resultCh, nil
+}
+
+func Test_rudimentaryErrorBackoff_OnError_ParallelSleep(t *testing.T) {
+	r := &rudimentaryErrorBackoff{
+		minPeriod: time.Second,
+	}
+
+	start := make(chan struct{})
+	var wg sync.WaitGroup
+	for i := 0; i < 30; i++ {
+		wg.Add(1)
+		go func() {
+			<-start
+			r.OnError()
+			wg.Done()
+		}()
+	}
+	st := time.Now()
+	close(start)
+	wg.Wait()
+
+	if since := time.Since(st); since > 5*time.Second {
+		t.Errorf("OnError slept for too long: %s", since)
+	}
+}
+
+func TestHandleError(t *testing.T) {
+	for name, handleError := range map[string]func(logger klog.Logger, err error, msg string, keysAndValues ...interface{}){
+		"WithLogger": func(logger klog.Logger, err error, msg string, keysAndValues ...interface{}) {
+			helper, logger := logger.WithCallStackHelper()
+			helper()
+			HandleErrorWithLogger(logger, err, msg, keysAndValues...)
+		},
+		"WithContext": func(logger klog.Logger, err error, msg string, keysAndValues ...interface{}) {
+			helper, logger := logger.WithCallStackHelper()
+			helper()
+			HandleErrorWithContext(klog.NewContext(context.Background(), logger), err, msg, keysAndValues...)
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			for name, tc := range map[string]struct {
+				err           error
+				msg           string
+				keysAndValues []interface{}
+				expectLog     string
+			}{
+				"no-error": {
+					msg:       "hello world",
+					expectLog: `"hello world" logger="UnhandledError"`,
+				},
+				"complex": {
+					err:           errors.New("fake error"),
+					msg:           "ignore",
+					keysAndValues: []interface{}{"a", 1, "b", "c"},
+					expectLog:     `"ignore" err="fake error" logger="UnhandledError" a=1 b="c"`,
+				},
+			} {
+				t.Run(name, func(t *testing.T) {
+					var buffer bytes.Buffer
+					timeInUTC := time.Date(2009, 12, 1, 13, 30, 40, 42000, time.UTC)
+					timeString := "1201 13:30:40.000042"
+					logger := textlogger.NewLogger(textlogger.NewConfig(
+						textlogger.FixedTime(timeInUTC),
+						textlogger.Output(&buffer),
+					))
+
+					_, _, line, _ := runtime.Caller(0)
+					handleError(logger, tc.err, tc.msg, tc.keysAndValues...)
+					assert.Equal(t, fmt.Sprintf("E%s %7d runtime_test.go:%d] %s\n", timeString, os.Getpid(), line+1, tc.expectLog), buffer.String())
+				})
+			}
+		})
+	}
+}
+
+func TestErrorToString(t *testing.T) {
+	for name, tt := range map[string]struct {
+		err          error
+		msg          string
+		kvs          []any
+		expectString string
+	}{
+		"simple": {
+			errors.New("some error"),
+			"Unhandled error",
+			nil,
+			`"Unhandled error" err="some error"`,
+		},
+		"nil-error": {
+			nil,
+			"Some problem occurred",
+			nil,
+			`"Some problem occurred"`,
+		},
+		"keys-and-values": {
+			errors.New("some error"),
+			"Some error occurred",
+			[]any{"str", "foobar", "int", 1, "multiLine", "line 1\nline 2"},
+			`"Some error occurred" err="some error" str="foobar" int=1 multiLine=<
+	line 1
+	line 2
+ >`,
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			actualString := ErrorToString(tt.err, tt.msg, tt.kvs...)
+			assert.Equal(t, tt.expectString, actualString)
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/byte.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/byte.go
new file mode 100644
index 0000000000..4d7a17c3af
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/byte.go
@@ -0,0 +1,137 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+// Byte is a set of bytes, implemented via map[byte]struct{} for minimal memory consumption.
+//
+// Deprecated: use generic Set instead.
+// new ways:
+// s1 := Set[byte]{}
+// s2 := New[byte]()
+type Byte map[byte]Empty
+
+// NewByte creates a Byte from a list of values.
+func NewByte(items ...byte) Byte {
+	return Byte(New[byte](items...))
+}
+
+// ByteKeySet creates a Byte from a keys of a map[byte](? extends interface{}).
+// If the value passed in is not actually a map, this will panic.
+func ByteKeySet[T any](theMap map[byte]T) Byte {
+	return Byte(KeySet(theMap))
+}
+
+// Insert adds items to the set.
+func (s Byte) Insert(items ...byte) Byte {
+	return Byte(cast(s).Insert(items...))
+}
+
+// Delete removes all items from the set.
+func (s Byte) Delete(items ...byte) Byte {
+	return Byte(cast(s).Delete(items...))
+}
+
+// Has returns true if and only if item is contained in the set.
+func (s Byte) Has(item byte) bool {
+	return cast(s).Has(item)
+}
+
+// HasAll returns true if and only if all items are contained in the set.
+func (s Byte) HasAll(items ...byte) bool {
+	return cast(s).HasAll(items...)
+}
+
+// HasAny returns true if any items are contained in the set.
+func (s Byte) HasAny(items ...byte) bool {
+	return cast(s).HasAny(items...)
+}
+
+// Clone returns a new set which is a copy of the current set.
+func (s Byte) Clone() Byte {
+	return Byte(cast(s).Clone())
+}
+
+// Difference returns a set of objects that are not in s2.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.Difference(s2) = {a3}
+// s2.Difference(s1) = {a4, a5}
+func (s1 Byte) Difference(s2 Byte) Byte {
+	return Byte(cast(s1).Difference(cast(s2)))
+}
+
+// SymmetricDifference returns a set of elements which are in either of the sets, but not in their intersection.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.SymmetricDifference(s2) = {a3, a4, a5}
+// s2.SymmetricDifference(s1) = {a3, a4, a5}
+func (s1 Byte) SymmetricDifference(s2 Byte) Byte {
+	return Byte(cast(s1).SymmetricDifference(cast(s2)))
+}
+
+// Union returns a new set which includes items in either s1 or s2.
+// For example:
+// s1 = {a1, a2}
+// s2 = {a3, a4}
+// s1.Union(s2) = {a1, a2, a3, a4}
+// s2.Union(s1) = {a1, a2, a3, a4}
+func (s1 Byte) Union(s2 Byte) Byte {
+	return Byte(cast(s1).Union(cast(s2)))
+}
+
+// Intersection returns a new set which includes the item in BOTH s1 and s2
+// For example:
+// s1 = {a1, a2}
+// s2 = {a2, a3}
+// s1.Intersection(s2) = {a2}
+func (s1 Byte) Intersection(s2 Byte) Byte {
+	return Byte(cast(s1).Intersection(cast(s2)))
+}
+
+// IsSuperset returns true if and only if s1 is a superset of s2.
+func (s1 Byte) IsSuperset(s2 Byte) bool {
+	return cast(s1).IsSuperset(cast(s2))
+}
+
+// Equal returns true if and only if s1 is equal (as a set) to s2.
+// Two sets are equal if their membership is identical.
+// (In practice, this means same elements, order doesn't matter)
+func (s1 Byte) Equal(s2 Byte) bool {
+	return cast(s1).Equal(cast(s2))
+}
+
+// List returns the contents as a sorted byte slice.
+func (s Byte) List() []byte {
+	return List(cast(s))
+}
+
+// UnsortedList returns the slice with contents in random order.
+func (s Byte) UnsortedList() []byte {
+	return cast(s).UnsortedList()
+}
+
+// PopAny returns a single element from the set.
+func (s Byte) PopAny() (byte, bool) {
+	return cast(s).PopAny()
+}
+
+// Len returns the size of the set.
+func (s Byte) Len() int {
+	return len(s)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/doc.go
new file mode 100644
index 0000000000..194883390c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package sets has generic set and specified sets. Generic set will
+// replace specified ones over time. And specific ones are deprecated.
+package sets
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/empty.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/empty.go
new file mode 100644
index 0000000000..fbb1df06d9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/empty.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+// Empty is public since it is used by some internal API objects for conversions between external
+// string arrays and internal sets, and conversion logic requires public types today.
+type Empty struct{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/int.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/int.go
new file mode 100644
index 0000000000..5876fc9deb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/int.go
@@ -0,0 +1,137 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+// Int is a set of ints, implemented via map[int]struct{} for minimal memory consumption.
+//
+// Deprecated: use generic Set instead.
+// new ways:
+// s1 := Set[int]{}
+// s2 := New[int]()
+type Int map[int]Empty
+
+// NewInt creates a Int from a list of values.
+func NewInt(items ...int) Int {
+	return Int(New[int](items...))
+}
+
+// IntKeySet creates a Int from a keys of a map[int](? extends interface{}).
+// If the value passed in is not actually a map, this will panic.
+func IntKeySet[T any](theMap map[int]T) Int {
+	return Int(KeySet(theMap))
+}
+
+// Insert adds items to the set.
+func (s Int) Insert(items ...int) Int {
+	return Int(cast(s).Insert(items...))
+}
+
+// Delete removes all items from the set.
+func (s Int) Delete(items ...int) Int {
+	return Int(cast(s).Delete(items...))
+}
+
+// Has returns true if and only if item is contained in the set.
+func (s Int) Has(item int) bool {
+	return cast(s).Has(item)
+}
+
+// HasAll returns true if and only if all items are contained in the set.
+func (s Int) HasAll(items ...int) bool {
+	return cast(s).HasAll(items...)
+}
+
+// HasAny returns true if any items are contained in the set.
+func (s Int) HasAny(items ...int) bool {
+	return cast(s).HasAny(items...)
+}
+
+// Clone returns a new set which is a copy of the current set.
+func (s Int) Clone() Int {
+	return Int(cast(s).Clone())
+}
+
+// Difference returns a set of objects that are not in s2.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.Difference(s2) = {a3}
+// s2.Difference(s1) = {a4, a5}
+func (s1 Int) Difference(s2 Int) Int {
+	return Int(cast(s1).Difference(cast(s2)))
+}
+
+// SymmetricDifference returns a set of elements which are in either of the sets, but not in their intersection.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.SymmetricDifference(s2) = {a3, a4, a5}
+// s2.SymmetricDifference(s1) = {a3, a4, a5}
+func (s1 Int) SymmetricDifference(s2 Int) Int {
+	return Int(cast(s1).SymmetricDifference(cast(s2)))
+}
+
+// Union returns a new set which includes items in either s1 or s2.
+// For example:
+// s1 = {a1, a2}
+// s2 = {a3, a4}
+// s1.Union(s2) = {a1, a2, a3, a4}
+// s2.Union(s1) = {a1, a2, a3, a4}
+func (s1 Int) Union(s2 Int) Int {
+	return Int(cast(s1).Union(cast(s2)))
+}
+
+// Intersection returns a new set which includes the item in BOTH s1 and s2
+// For example:
+// s1 = {a1, a2}
+// s2 = {a2, a3}
+// s1.Intersection(s2) = {a2}
+func (s1 Int) Intersection(s2 Int) Int {
+	return Int(cast(s1).Intersection(cast(s2)))
+}
+
+// IsSuperset returns true if and only if s1 is a superset of s2.
+func (s1 Int) IsSuperset(s2 Int) bool {
+	return cast(s1).IsSuperset(cast(s2))
+}
+
+// Equal returns true if and only if s1 is equal (as a set) to s2.
+// Two sets are equal if their membership is identical.
+// (In practice, this means same elements, order doesn't matter)
+func (s1 Int) Equal(s2 Int) bool {
+	return cast(s1).Equal(cast(s2))
+}
+
+// List returns the contents as a sorted int slice.
+func (s Int) List() []int {
+	return List(cast(s))
+}
+
+// UnsortedList returns the slice with contents in random order.
+func (s Int) UnsortedList() []int {
+	return cast(s).UnsortedList()
+}
+
+// PopAny returns a single element from the set.
+func (s Int) PopAny() (int, bool) {
+	return cast(s).PopAny()
+}
+
+// Len returns the size of the set.
+func (s Int) Len() int {
+	return len(s)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/int32.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/int32.go
new file mode 100644
index 0000000000..2c640c5d0f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/int32.go
@@ -0,0 +1,137 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+// Int32 is a set of int32s, implemented via map[int32]struct{} for minimal memory consumption.
+//
+// Deprecated: use generic Set instead.
+// new ways:
+// s1 := Set[int32]{}
+// s2 := New[int32]()
+type Int32 map[int32]Empty
+
+// NewInt32 creates a Int32 from a list of values.
+func NewInt32(items ...int32) Int32 {
+	return Int32(New[int32](items...))
+}
+
+// Int32KeySet creates a Int32 from a keys of a map[int32](? extends interface{}).
+// If the value passed in is not actually a map, this will panic.
+func Int32KeySet[T any](theMap map[int32]T) Int32 {
+	return Int32(KeySet(theMap))
+}
+
+// Insert adds items to the set.
+func (s Int32) Insert(items ...int32) Int32 {
+	return Int32(cast(s).Insert(items...))
+}
+
+// Delete removes all items from the set.
+func (s Int32) Delete(items ...int32) Int32 {
+	return Int32(cast(s).Delete(items...))
+}
+
+// Has returns true if and only if item is contained in the set.
+func (s Int32) Has(item int32) bool {
+	return cast(s).Has(item)
+}
+
+// HasAll returns true if and only if all items are contained in the set.
+func (s Int32) HasAll(items ...int32) bool {
+	return cast(s).HasAll(items...)
+}
+
+// HasAny returns true if any items are contained in the set.
+func (s Int32) HasAny(items ...int32) bool {
+	return cast(s).HasAny(items...)
+}
+
+// Clone returns a new set which is a copy of the current set.
+func (s Int32) Clone() Int32 {
+	return Int32(cast(s).Clone())
+}
+
+// Difference returns a set of objects that are not in s2.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.Difference(s2) = {a3}
+// s2.Difference(s1) = {a4, a5}
+func (s1 Int32) Difference(s2 Int32) Int32 {
+	return Int32(cast(s1).Difference(cast(s2)))
+}
+
+// SymmetricDifference returns a set of elements which are in either of the sets, but not in their intersection.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.SymmetricDifference(s2) = {a3, a4, a5}
+// s2.SymmetricDifference(s1) = {a3, a4, a5}
+func (s1 Int32) SymmetricDifference(s2 Int32) Int32 {
+	return Int32(cast(s1).SymmetricDifference(cast(s2)))
+}
+
+// Union returns a new set which includes items in either s1 or s2.
+// For example:
+// s1 = {a1, a2}
+// s2 = {a3, a4}
+// s1.Union(s2) = {a1, a2, a3, a4}
+// s2.Union(s1) = {a1, a2, a3, a4}
+func (s1 Int32) Union(s2 Int32) Int32 {
+	return Int32(cast(s1).Union(cast(s2)))
+}
+
+// Intersection returns a new set which includes the item in BOTH s1 and s2
+// For example:
+// s1 = {a1, a2}
+// s2 = {a2, a3}
+// s1.Intersection(s2) = {a2}
+func (s1 Int32) Intersection(s2 Int32) Int32 {
+	return Int32(cast(s1).Intersection(cast(s2)))
+}
+
+// IsSuperset returns true if and only if s1 is a superset of s2.
+func (s1 Int32) IsSuperset(s2 Int32) bool {
+	return cast(s1).IsSuperset(cast(s2))
+}
+
+// Equal returns true if and only if s1 is equal (as a set) to s2.
+// Two sets are equal if their membership is identical.
+// (In practice, this means same elements, order doesn't matter)
+func (s1 Int32) Equal(s2 Int32) bool {
+	return cast(s1).Equal(cast(s2))
+}
+
+// List returns the contents as a sorted int32 slice.
+func (s Int32) List() []int32 {
+	return List(cast(s))
+}
+
+// UnsortedList returns the slice with contents in random order.
+func (s Int32) UnsortedList() []int32 {
+	return cast(s).UnsortedList()
+}
+
+// PopAny returns a single element from the set.
+func (s Int32) PopAny() (int32, bool) {
+	return cast(s).PopAny()
+}
+
+// Len returns the size of the set.
+func (s Int32) Len() int {
+	return len(s)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/int64.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/int64.go
new file mode 100644
index 0000000000..bf3eb3ffa2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/int64.go
@@ -0,0 +1,137 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+// Int64 is a set of int64s, implemented via map[int64]struct{} for minimal memory consumption.
+//
+// Deprecated: use generic Set instead.
+// new ways:
+// s1 := Set[int64]{}
+// s2 := New[int64]()
+type Int64 map[int64]Empty
+
+// NewInt64 creates a Int64 from a list of values.
+func NewInt64(items ...int64) Int64 {
+	return Int64(New[int64](items...))
+}
+
+// Int64KeySet creates a Int64 from a keys of a map[int64](? extends interface{}).
+// If the value passed in is not actually a map, this will panic.
+func Int64KeySet[T any](theMap map[int64]T) Int64 {
+	return Int64(KeySet(theMap))
+}
+
+// Insert adds items to the set.
+func (s Int64) Insert(items ...int64) Int64 {
+	return Int64(cast(s).Insert(items...))
+}
+
+// Delete removes all items from the set.
+func (s Int64) Delete(items ...int64) Int64 {
+	return Int64(cast(s).Delete(items...))
+}
+
+// Has returns true if and only if item is contained in the set.
+func (s Int64) Has(item int64) bool {
+	return cast(s).Has(item)
+}
+
+// HasAll returns true if and only if all items are contained in the set.
+func (s Int64) HasAll(items ...int64) bool {
+	return cast(s).HasAll(items...)
+}
+
+// HasAny returns true if any items are contained in the set.
+func (s Int64) HasAny(items ...int64) bool {
+	return cast(s).HasAny(items...)
+}
+
+// Clone returns a new set which is a copy of the current set.
+func (s Int64) Clone() Int64 {
+	return Int64(cast(s).Clone())
+}
+
+// Difference returns a set of objects that are not in s2.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.Difference(s2) = {a3}
+// s2.Difference(s1) = {a4, a5}
+func (s1 Int64) Difference(s2 Int64) Int64 {
+	return Int64(cast(s1).Difference(cast(s2)))
+}
+
+// SymmetricDifference returns a set of elements which are in either of the sets, but not in their intersection.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.SymmetricDifference(s2) = {a3, a4, a5}
+// s2.SymmetricDifference(s1) = {a3, a4, a5}
+func (s1 Int64) SymmetricDifference(s2 Int64) Int64 {
+	return Int64(cast(s1).SymmetricDifference(cast(s2)))
+}
+
+// Union returns a new set which includes items in either s1 or s2.
+// For example:
+// s1 = {a1, a2}
+// s2 = {a3, a4}
+// s1.Union(s2) = {a1, a2, a3, a4}
+// s2.Union(s1) = {a1, a2, a3, a4}
+func (s1 Int64) Union(s2 Int64) Int64 {
+	return Int64(cast(s1).Union(cast(s2)))
+}
+
+// Intersection returns a new set which includes the item in BOTH s1 and s2
+// For example:
+// s1 = {a1, a2}
+// s2 = {a2, a3}
+// s1.Intersection(s2) = {a2}
+func (s1 Int64) Intersection(s2 Int64) Int64 {
+	return Int64(cast(s1).Intersection(cast(s2)))
+}
+
+// IsSuperset returns true if and only if s1 is a superset of s2.
+func (s1 Int64) IsSuperset(s2 Int64) bool {
+	return cast(s1).IsSuperset(cast(s2))
+}
+
+// Equal returns true if and only if s1 is equal (as a set) to s2.
+// Two sets are equal if their membership is identical.
+// (In practice, this means same elements, order doesn't matter)
+func (s1 Int64) Equal(s2 Int64) bool {
+	return cast(s1).Equal(cast(s2))
+}
+
+// List returns the contents as a sorted int64 slice.
+func (s Int64) List() []int64 {
+	return List(cast(s))
+}
+
+// UnsortedList returns the slice with contents in random order.
+func (s Int64) UnsortedList() []int64 {
+	return cast(s).UnsortedList()
+}
+
+// PopAny returns a single element from the set.
+func (s Int64) PopAny() (int64, bool) {
+	return cast(s).PopAny()
+}
+
+// Len returns the size of the set.
+func (s Int64) Len() int {
+	return len(s)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/set.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/set.go
new file mode 100644
index 0000000000..ae3d15eb25
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/set.go
@@ -0,0 +1,223 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+import (
+	"cmp"
+	"slices"
+)
+
+// Set is a set of the same type elements, implemented via map[comparable]struct{} for minimal memory consumption.
+type Set[T comparable] map[T]Empty
+
+// cast transforms specified set to generic Set[T].
+func cast[T comparable](s map[T]Empty) Set[T] { return s }
+
+// New creates a Set from a list of values.
+// NOTE: type param must be explicitly instantiated if given items are empty.
+func New[T comparable](items ...T) Set[T] {
+	ss := make(Set[T], len(items))
+	ss.Insert(items...)
+	return ss
+}
+
+// KeySet creates a Set from a keys of a map[comparable](? extends interface{}).
+// If the value passed in is not actually a map, this will panic.
+func KeySet[T comparable, V any](theMap map[T]V) Set[T] {
+	ret := make(Set[T], len(theMap))
+	for keyValue := range theMap {
+		ret.Insert(keyValue)
+	}
+	return ret
+}
+
+// Insert adds items to the set.
+func (s Set[T]) Insert(items ...T) Set[T] {
+	for _, item := range items {
+		s[item] = Empty{}
+	}
+	return s
+}
+
+func Insert[T comparable](set Set[T], items ...T) Set[T] {
+	return set.Insert(items...)
+}
+
+// Delete removes all items from the set.
+func (s Set[T]) Delete(items ...T) Set[T] {
+	for _, item := range items {
+		delete(s, item)
+	}
+	return s
+}
+
+// Clear empties the set.
+// It is preferable to replace the set with a newly constructed set,
+// but not all callers can do that (when there are other references to the map).
+func (s Set[T]) Clear() Set[T] {
+	clear(s)
+	return s
+}
+
+// Has returns true if and only if item is contained in the set.
+func (s Set[T]) Has(item T) bool {
+	_, contained := s[item]
+	return contained
+}
+
+// HasAll returns true if and only if all items are contained in the set.
+func (s Set[T]) HasAll(items ...T) bool {
+	for _, item := range items {
+		if !s.Has(item) {
+			return false
+		}
+	}
+	return true
+}
+
+// HasAny returns true if any items are contained in the set.
+func (s Set[T]) HasAny(items ...T) bool {
+	for _, item := range items {
+		if s.Has(item) {
+			return true
+		}
+	}
+	return false
+}
+
+// Clone returns a new set which is a copy of the current set.
+func (s Set[T]) Clone() Set[T] {
+	result := make(Set[T], len(s))
+	for key := range s {
+		result.Insert(key)
+	}
+	return result
+}
+
+// Difference returns a set of objects that are not in s2.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.Difference(s2) = {a3}
+// s2.Difference(s1) = {a4, a5}
+func (s1 Set[T]) Difference(s2 Set[T]) Set[T] {
+	result := New[T]()
+	for key := range s1 {
+		if !s2.Has(key) {
+			result.Insert(key)
+		}
+	}
+	return result
+}
+
+// SymmetricDifference returns a set of elements which are in either of the sets, but not in their intersection.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.SymmetricDifference(s2) = {a3, a4, a5}
+// s2.SymmetricDifference(s1) = {a3, a4, a5}
+func (s1 Set[T]) SymmetricDifference(s2 Set[T]) Set[T] {
+	return s1.Difference(s2).Union(s2.Difference(s1))
+}
+
+// Union returns a new set which includes items in either s1 or s2.
+// For example:
+// s1 = {a1, a2}
+// s2 = {a3, a4}
+// s1.Union(s2) = {a1, a2, a3, a4}
+// s2.Union(s1) = {a1, a2, a3, a4}
+func (s1 Set[T]) Union(s2 Set[T]) Set[T] {
+	result := s1.Clone()
+	for key := range s2 {
+		result.Insert(key)
+	}
+	return result
+}
+
+// Intersection returns a new set which includes the item in BOTH s1 and s2
+// For example:
+// s1 = {a1, a2}
+// s2 = {a2, a3}
+// s1.Intersection(s2) = {a2}
+func (s1 Set[T]) Intersection(s2 Set[T]) Set[T] {
+	var walk, other Set[T]
+	result := New[T]()
+	if s1.Len() < s2.Len() {
+		walk = s1
+		other = s2
+	} else {
+		walk = s2
+		other = s1
+	}
+	for key := range walk {
+		if other.Has(key) {
+			result.Insert(key)
+		}
+	}
+	return result
+}
+
+// IsSuperset returns true if and only if s1 is a superset of s2.
+func (s1 Set[T]) IsSuperset(s2 Set[T]) bool {
+	for item := range s2 {
+		if !s1.Has(item) {
+			return false
+		}
+	}
+	return true
+}
+
+// Equal returns true if and only if s1 is equal (as a set) to s2.
+// Two sets are equal if their membership is identical.
+// (In practice, this means same elements, order doesn't matter)
+func (s1 Set[T]) Equal(s2 Set[T]) bool {
+	return len(s1) == len(s2) && s1.IsSuperset(s2)
+}
+
+// List returns the contents as a sorted T slice.
+//
+// This is a separate function and not a method because not all types supported
+// by Generic are ordered and only those can be sorted.
+func List[T cmp.Ordered](s Set[T]) []T {
+	res := s.UnsortedList()
+	slices.Sort(res)
+	return res
+}
+
+// UnsortedList returns the slice with contents in random order.
+func (s Set[T]) UnsortedList() []T {
+	res := make([]T, 0, len(s))
+	for key := range s {
+		res = append(res, key)
+	}
+	return res
+}
+
+// PopAny returns a single element from the set.
+func (s Set[T]) PopAny() (T, bool) {
+	for key := range s {
+		s.Delete(key)
+		return key, true
+	}
+	var zeroValue T
+	return zeroValue, false
+}
+
+// Len returns the size of the set.
+func (s Set[T]) Len() int {
+	return len(s)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/set_generic_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/set_generic_test.go
new file mode 100644
index 0000000000..e439a553d0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/set_generic_test.go
@@ -0,0 +1,375 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets_test
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+func TestSet(t *testing.T) {
+	s := sets.Set[string]{}
+	s2 := sets.Set[string]{}
+	if len(s) != 0 {
+		t.Errorf("Expected len=0: %d", len(s))
+	}
+	s.Insert("a", "b")
+	if len(s) != 2 {
+		t.Errorf("Expected len=2: %d", len(s))
+	}
+	s.Insert("c")
+	if s.Has("d") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if !s.Has("a") {
+		t.Errorf("Missing contents: %#v", s)
+	}
+	s.Delete("a")
+	if s.Has("a") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	s.Insert("a")
+	if s.HasAll("a", "b", "d") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if !s.HasAll("a", "b") {
+		t.Errorf("Missing contents: %#v", s)
+	}
+	s2.Insert("a", "b", "d")
+	if s.IsSuperset(s2) {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	s2.Delete("d")
+	if !s.IsSuperset(s2) {
+		t.Errorf("Missing contents: %#v", s)
+	}
+}
+
+func TestSetDeleteMultiples(t *testing.T) {
+	s := sets.Set[string]{}
+	s.Insert("a", "b", "c")
+	if len(s) != 3 {
+		t.Errorf("Expected len=3: %d", len(s))
+	}
+
+	s.Delete("a", "c")
+	if len(s) != 1 {
+		t.Errorf("Expected len=1: %d", len(s))
+	}
+	if s.Has("a") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if s.Has("c") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if !s.Has("b") {
+		t.Errorf("Missing contents: %#v", s)
+	}
+
+}
+
+func TestSetClear(t *testing.T) {
+	s := sets.Set[string]{}
+	s.Insert("a", "b", "c")
+	if s.Len() != 3 {
+		t.Errorf("Expected len=3: %d", s.Len())
+	}
+
+	s.Clear()
+	if s.Len() != 0 {
+		t.Errorf("Expected len=0: %d", s.Len())
+	}
+}
+
+func TestSetClearWithSharedReference(t *testing.T) {
+	s := sets.Set[string]{}
+	s.Insert("a", "b", "c")
+	if s.Len() != 3 {
+		t.Errorf("Expected len=3: %d", s.Len())
+	}
+
+	m := s
+	s.Clear()
+	if s.Len() != 0 {
+		t.Errorf("Expected len=0 on the cleared set: %d", s.Len())
+	}
+	if m.Len() != 0 {
+		t.Errorf("Expected len=0 on the shared reference: %d", m.Len())
+	}
+}
+
+func TestSetClearInSeparateFunction(t *testing.T) {
+	s := sets.Set[string]{}
+	s.Insert("a", "b", "c")
+	if s.Len() != 3 {
+		t.Errorf("Expected len=3: %d", s.Len())
+	}
+
+	clearSetAndAdd(s, "d")
+	if s.Len() != 1 {
+		t.Errorf("Expected len=1: %d", s.Len())
+	}
+	if !s.Has("d") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+}
+
+func clearSetAndAdd[T comparable](s sets.Set[T], a T) {
+	s.Clear()
+	s.Insert(a)
+}
+
+func TestNewSet(t *testing.T) {
+	s := sets.New("a", "b", "c")
+	if len(s) != 3 {
+		t.Errorf("Expected len=3: %d", len(s))
+	}
+	if !s.Has("a") || !s.Has("b") || !s.Has("c") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+}
+
+func TestKeySet(t *testing.T) {
+	m := map[string]int{"a": 1, "b": 2, "c": 3}
+	ss := sets.KeySet[string](m)
+	if !ss.Equal(sets.New("a", "b", "c")) {
+		t.Errorf("Unexpected contents: %#v", sets.List(ss))
+	}
+}
+
+func TestNewEmptySet(t *testing.T) {
+	s := sets.New[string]()
+	if len(s) != 0 {
+		t.Errorf("Expected len=0: %d", len(s))
+	}
+	s.Insert("a", "b", "c")
+	if len(s) != 3 {
+		t.Errorf("Expected len=3: %d", len(s))
+	}
+	if !s.Has("a") || !s.Has("b") || !s.Has("c") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+}
+
+func TestSortedList(t *testing.T) {
+	s := sets.New("z", "y", "x", "a")
+	if !reflect.DeepEqual(sets.List(s), []string{"a", "x", "y", "z"}) {
+		t.Errorf("List gave unexpected result: %#v", sets.List(s))
+	}
+}
+
+func TestSetDifference(t *testing.T) {
+	a := sets.New("1", "2", "3")
+	b := sets.New("1", "2", "4", "5")
+	c := a.Difference(b)
+	d := b.Difference(a)
+	if len(c) != 1 {
+		t.Errorf("Expected len=1: %d", len(c))
+	}
+	if !c.Has("3") {
+		t.Errorf("Unexpected contents: %#v", sets.List(c))
+	}
+	if len(d) != 2 {
+		t.Errorf("Expected len=2: %d", len(d))
+	}
+	if !d.Has("4") || !d.Has("5") {
+		t.Errorf("Unexpected contents: %#v", sets.List(d))
+	}
+}
+
+func TestSetSymmetricDifference(t *testing.T) {
+	a := sets.New("1", "2", "3")
+	b := sets.New("1", "2", "4", "5")
+	c := a.SymmetricDifference(b)
+	d := b.SymmetricDifference(a)
+	if !c.Equal(sets.New("3", "4", "5")) {
+		t.Errorf("Unexpected contents: %#v", sets.List(c))
+	}
+	if !d.Equal(sets.New("3", "4", "5")) {
+		t.Errorf("Unexpected contents: %#v", sets.List(d))
+	}
+}
+
+func TestSetHasAny(t *testing.T) {
+	a := sets.New("1", "2", "3")
+
+	if !a.HasAny("1", "4") {
+		t.Errorf("expected true, got false")
+	}
+
+	if a.HasAny("0", "4") {
+		t.Errorf("expected false, got true")
+	}
+}
+
+func TestSetEquals(t *testing.T) {
+	// Simple case (order doesn't matter)
+	a := sets.New("1", "2")
+	b := sets.New("2", "1")
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	// It is a set; duplicates are ignored
+	b = sets.New("2", "2", "1")
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	// Edge cases around empty sets / empty strings
+	a = sets.New[string]()
+	b = sets.New[string]()
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	b = sets.New("1", "2", "3")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	b = sets.New("1", "2", "")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	// Check for equality after mutation
+	a = sets.New[string]()
+	a.Insert("1")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	a.Insert("2")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	a.Insert("")
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	a.Delete("")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+}
+
+func TestUnion(t *testing.T) {
+	tests := []struct {
+		s1       sets.Set[string]
+		s2       sets.Set[string]
+		expected sets.Set[string]
+	}{
+		{
+			sets.New("1", "2", "3", "4"),
+			sets.New("3", "4", "5", "6"),
+			sets.New("1", "2", "3", "4", "5", "6"),
+		},
+		{
+			sets.New("1", "2", "3", "4"),
+			sets.New[string](),
+			sets.New("1", "2", "3", "4"),
+		},
+		{
+			sets.New[string](),
+			sets.New("1", "2", "3", "4"),
+			sets.New("1", "2", "3", "4"),
+		},
+		{
+			sets.New[string](),
+			sets.New[string](),
+			sets.New[string](),
+		},
+	}
+
+	for _, test := range tests {
+		union := test.s1.Union(test.s2)
+		if union.Len() != test.expected.Len() {
+			t.Errorf("Expected union.Len()=%d but got %d", test.expected.Len(), union.Len())
+		}
+
+		if !union.Equal(test.expected) {
+			t.Errorf("Expected union.Equal(expected) but not true.  union:%v expected:%v", sets.List(union), sets.List(test.expected))
+		}
+	}
+}
+
+func TestIntersection(t *testing.T) {
+	tests := []struct {
+		s1       sets.Set[string]
+		s2       sets.Set[string]
+		expected sets.Set[string]
+	}{
+		{
+			sets.New("1", "2", "3", "4"),
+			sets.New("3", "4", "5", "6"),
+			sets.New("3", "4"),
+		},
+		{
+			sets.New("1", "2", "3", "4"),
+			sets.New("1", "2", "3", "4"),
+			sets.New("1", "2", "3", "4"),
+		},
+		{
+			sets.New("1", "2", "3", "4"),
+			sets.New[string](),
+			sets.New[string](),
+		},
+		{
+			sets.New[string](),
+			sets.New("1", "2", "3", "4"),
+			sets.New[string](),
+		},
+		{
+			sets.New[string](),
+			sets.New[string](),
+			sets.New[string](),
+		},
+	}
+
+	for _, test := range tests {
+		intersection := test.s1.Intersection(test.s2)
+		if intersection.Len() != test.expected.Len() {
+			t.Errorf("Expected intersection.Len()=%d but got %d", test.expected.Len(), intersection.Len())
+		}
+
+		if !intersection.Equal(test.expected) {
+			t.Errorf("Expected intersection.Equal(expected) but not true.  intersection:%v expected:%v", sets.List(intersection), sets.List(intersection))
+		}
+	}
+}
+
+func BenchmarkListSmall(b *testing.B) {
+	s := sets.New("a", "b", "c", "d", "e", "f", "g", "h", "i", "j")
+	for b.Loop() {
+		sets.List(s)
+	}
+}
+
+func BenchmarkListLarge(b *testing.B) {
+	s := make(sets.Set[int], 12345)
+	for i := range 12345 {
+		s.Insert(i * 7)
+	}
+	for b.Loop() {
+		sets.List(s)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/set_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/set_test.go
new file mode 100644
index 0000000000..9f492c1f4b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/set_test.go
@@ -0,0 +1,373 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+import (
+	"fmt"
+	"math/rand"
+	"reflect"
+	"testing"
+)
+
+func TestStringSet(t *testing.T) {
+	s := String{}
+	s2 := String{}
+	if len(s) != 0 {
+		t.Errorf("Expected len=0: %d", len(s))
+	}
+	s.Insert("a", "b")
+	if len(s) != 2 {
+		t.Errorf("Expected len=2: %d", len(s))
+	}
+	s.Insert("c")
+	if s.Has("d") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if !s.Has("a") {
+		t.Errorf("Missing contents: %#v", s)
+	}
+	s.Delete("a")
+	if s.Has("a") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	s.Insert("a")
+	if s.HasAll("a", "b", "d") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if !s.HasAll("a", "b") {
+		t.Errorf("Missing contents: %#v", s)
+	}
+	s2.Insert("a", "b", "d")
+	if s.IsSuperset(s2) {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	s2.Delete("d")
+	if !s.IsSuperset(s2) {
+		t.Errorf("Missing contents: %#v", s)
+	}
+}
+
+func TestStringSetDeleteMultiples(t *testing.T) {
+	s := String{}
+	s.Insert("a", "b", "c")
+	if len(s) != 3 {
+		t.Errorf("Expected len=3: %d", len(s))
+	}
+
+	s.Delete("a", "c")
+	if len(s) != 1 {
+		t.Errorf("Expected len=1: %d", len(s))
+	}
+	if s.Has("a") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if s.Has("c") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if !s.Has("b") {
+		t.Errorf("Missing contents: %#v", s)
+	}
+
+}
+
+func TestNewStringSet(t *testing.T) {
+	s := NewString("a", "b", "c")
+	if len(s) != 3 {
+		t.Errorf("Expected len=3: %d", len(s))
+	}
+	if !s.Has("a") || !s.Has("b") || !s.Has("c") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+}
+
+func TestStringSetList(t *testing.T) {
+	s := NewString("z", "y", "x", "a")
+	if !reflect.DeepEqual(s.List(), []string{"a", "x", "y", "z"}) {
+		t.Errorf("List gave unexpected result: %#v", s.List())
+	}
+}
+
+func TestStringSetDifference(t *testing.T) {
+	a := NewString("1", "2", "3")
+	b := NewString("1", "2", "4", "5")
+	c := a.Difference(b)
+	d := b.Difference(a)
+	if len(c) != 1 {
+		t.Errorf("Expected len=1: %d", len(c))
+	}
+	if !c.Has("3") {
+		t.Errorf("Unexpected contents: %#v", c.List())
+	}
+	if len(d) != 2 {
+		t.Errorf("Expected len=2: %d", len(d))
+	}
+	if !d.Has("4") || !d.Has("5") {
+		t.Errorf("Unexpected contents: %#v", d.List())
+	}
+}
+
+func TestStringSetSymmetricDifference(t *testing.T) {
+	a := NewString("1", "2", "3")
+	b := NewString("1", "2", "4", "5")
+	c := a.SymmetricDifference(b)
+	d := b.SymmetricDifference(a)
+	if !c.Equal(NewString("3", "4", "5")) {
+		t.Errorf("Unexpected contents: %#v", c.List())
+	}
+	if !d.Equal(NewString("3", "4", "5")) {
+		t.Errorf("Unexpected contents: %#v", d.List())
+	}
+}
+
+func TestStringSetHasAny(t *testing.T) {
+	a := NewString("1", "2", "3")
+
+	if !a.HasAny("1", "4") {
+		t.Errorf("expected true, got false")
+	}
+
+	if a.HasAny("0", "4") {
+		t.Errorf("expected false, got true")
+	}
+}
+
+func TestStringSetEquals(t *testing.T) {
+	// Simple case (order doesn't matter)
+	a := NewString("1", "2")
+	b := NewString("2", "1")
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	// It is a set; duplicates are ignored
+	b = NewString("2", "2", "1")
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	// Edge cases around empty sets / empty strings
+	a = NewString()
+	b = NewString()
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	b = NewString("1", "2", "3")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	b = NewString("1", "2", "")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	// Check for equality after mutation
+	a = NewString()
+	a.Insert("1")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	a.Insert("2")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	a.Insert("")
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	a.Delete("")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+}
+
+func TestStringUnion(t *testing.T) {
+	tests := []struct {
+		s1       String
+		s2       String
+		expected String
+	}{
+		{
+			NewString("1", "2", "3", "4"),
+			NewString("3", "4", "5", "6"),
+			NewString("1", "2", "3", "4", "5", "6"),
+		},
+		{
+			NewString("1", "2", "3", "4"),
+			NewString(),
+			NewString("1", "2", "3", "4"),
+		},
+		{
+			NewString(),
+			NewString("1", "2", "3", "4"),
+			NewString("1", "2", "3", "4"),
+		},
+		{
+			NewString(),
+			NewString(),
+			NewString(),
+		},
+	}
+
+	for _, test := range tests {
+		union := test.s1.Union(test.s2)
+		if union.Len() != test.expected.Len() {
+			t.Errorf("Expected union.Len()=%d but got %d", test.expected.Len(), union.Len())
+		}
+
+		if !union.Equal(test.expected) {
+			t.Errorf("Expected union.Equal(expected) but not true.  union:%v expected:%v", union.List(), test.expected.List())
+		}
+	}
+}
+
+func TestStringIntersection(t *testing.T) {
+	tests := []struct {
+		s1       String
+		s2       String
+		expected String
+	}{
+		{
+			NewString("1", "2", "3", "4"),
+			NewString("3", "4", "5", "6"),
+			NewString("3", "4"),
+		},
+		{
+			NewString("1", "2", "3", "4"),
+			NewString("1", "2", "3", "4"),
+			NewString("1", "2", "3", "4"),
+		},
+		{
+			NewString("1", "2", "3", "4"),
+			NewString(),
+			NewString(),
+		},
+		{
+			NewString(),
+			NewString("1", "2", "3", "4"),
+			NewString(),
+		},
+		{
+			NewString(),
+			NewString(),
+			NewString(),
+		},
+	}
+
+	for _, test := range tests {
+		intersection := test.s1.Intersection(test.s2)
+		if intersection.Len() != test.expected.Len() {
+			t.Errorf("Expected intersection.Len()=%d but got %d", test.expected.Len(), intersection.Len())
+		}
+
+		if !intersection.Equal(test.expected) {
+			t.Errorf("Expected intersection.Equal(expected) but not true.  intersection:%v expected:%v", intersection.List(), test.expected.List())
+		}
+	}
+}
+
+type randomStringAlphabet string
+
+func (a randomStringAlphabet) makeString(minLen, maxLen int) string {
+	n := minLen
+	if minLen < maxLen {
+		n += rand.Intn(maxLen - minLen)
+	}
+	var s string
+	for i := 0; i < n; i++ {
+		s += string(a[rand.Intn(len(a))])
+	}
+	return s
+}
+
+var randomStringMaker = randomStringAlphabet("abcdefghijklmnopqrstuvwxyz0123456789")
+
+func BenchmarkStringSet(b *testing.B) {
+	cases := []struct {
+		size         int
+		minStringLen int
+		maxStringLen int
+	}{
+		{20, 10, 20},
+		{50, 10, 30},
+		{100, 20, 40},
+		{500, 20, 50},
+		{1000, 20, 60},
+	}
+
+	for i := range cases {
+		here := cases[i]
+		makeSet := func() String {
+			s := NewString()
+			for j := 0; j < here.size; j++ {
+				s.Insert(randomStringMaker.makeString(here.minStringLen, here.maxStringLen))
+			}
+			return s
+		}
+		operands := make([]String, 500)
+		for i := range operands {
+			operands[i] = makeSet()
+		}
+		randOperand := func() String { return operands[rand.Intn(len(operands))] }
+
+		b.Run(fmt.Sprintf("insert-%v", here.size), func(b *testing.B) {
+			b.ReportAllocs()
+			for i := 0; i < b.N; i++ {
+				makeSet()
+			}
+		})
+
+		b.Run(fmt.Sprintf("key-set-%v", here.size), func(b *testing.B) {
+			b.ReportAllocs()
+			for i := 0; i < b.N; i++ {
+				StringKeySet(randOperand())
+			}
+		})
+
+		b.Run(fmt.Sprintf("has-%v", here.size), func(b *testing.B) {
+			b.ReportAllocs()
+			for i := 0; i < b.N; i++ {
+				randOperand().Has(randomStringMaker.makeString(here.minStringLen, here.maxStringLen))
+			}
+		})
+
+		b.Run(fmt.Sprintf("intersection-%v", here.size), func(b *testing.B) {
+			b.ReportAllocs()
+			for i := 0; i < b.N; i++ {
+				randOperand().Intersection(randOperand())
+			}
+		})
+
+		b.Run(fmt.Sprintf("symmetric-difference-%v", here.size), func(b *testing.B) {
+			b.ReportAllocs()
+			for i := 0; i < b.N; i++ {
+				randOperand().SymmetricDifference(randOperand())
+			}
+		})
+
+		b.Run(fmt.Sprintf("list-%v", here.size), func(b *testing.B) {
+			b.ReportAllocs()
+			for i := 0; i < b.N; i++ {
+				randOperand().List()
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/string.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/string.go
new file mode 100644
index 0000000000..1dab6d13cc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sets/string.go
@@ -0,0 +1,137 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+// String is a set of strings, implemented via map[string]struct{} for minimal memory consumption.
+//
+// Deprecated: use generic Set instead.
+// new ways:
+// s1 := Set[string]{}
+// s2 := New[string]()
+type String map[string]Empty
+
+// NewString creates a String from a list of values.
+func NewString(items ...string) String {
+	return String(New[string](items...))
+}
+
+// StringKeySet creates a String from a keys of a map[string](? extends interface{}).
+// If the value passed in is not actually a map, this will panic.
+func StringKeySet[T any](theMap map[string]T) String {
+	return String(KeySet(theMap))
+}
+
+// Insert adds items to the set.
+func (s String) Insert(items ...string) String {
+	return String(cast(s).Insert(items...))
+}
+
+// Delete removes all items from the set.
+func (s String) Delete(items ...string) String {
+	return String(cast(s).Delete(items...))
+}
+
+// Has returns true if and only if item is contained in the set.
+func (s String) Has(item string) bool {
+	return cast(s).Has(item)
+}
+
+// HasAll returns true if and only if all items are contained in the set.
+func (s String) HasAll(items ...string) bool {
+	return cast(s).HasAll(items...)
+}
+
+// HasAny returns true if any items are contained in the set.
+func (s String) HasAny(items ...string) bool {
+	return cast(s).HasAny(items...)
+}
+
+// Clone returns a new set which is a copy of the current set.
+func (s String) Clone() String {
+	return String(cast(s).Clone())
+}
+
+// Difference returns a set of objects that are not in s2.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.Difference(s2) = {a3}
+// s2.Difference(s1) = {a4, a5}
+func (s1 String) Difference(s2 String) String {
+	return String(cast(s1).Difference(cast(s2)))
+}
+
+// SymmetricDifference returns a set of elements which are in either of the sets, but not in their intersection.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.SymmetricDifference(s2) = {a3, a4, a5}
+// s2.SymmetricDifference(s1) = {a3, a4, a5}
+func (s1 String) SymmetricDifference(s2 String) String {
+	return String(cast(s1).SymmetricDifference(cast(s2)))
+}
+
+// Union returns a new set which includes items in either s1 or s2.
+// For example:
+// s1 = {a1, a2}
+// s2 = {a3, a4}
+// s1.Union(s2) = {a1, a2, a3, a4}
+// s2.Union(s1) = {a1, a2, a3, a4}
+func (s1 String) Union(s2 String) String {
+	return String(cast(s1).Union(cast(s2)))
+}
+
+// Intersection returns a new set which includes the item in BOTH s1 and s2
+// For example:
+// s1 = {a1, a2}
+// s2 = {a2, a3}
+// s1.Intersection(s2) = {a2}
+func (s1 String) Intersection(s2 String) String {
+	return String(cast(s1).Intersection(cast(s2)))
+}
+
+// IsSuperset returns true if and only if s1 is a superset of s2.
+func (s1 String) IsSuperset(s2 String) bool {
+	return cast(s1).IsSuperset(cast(s2))
+}
+
+// Equal returns true if and only if s1 is equal (as a set) to s2.
+// Two sets are equal if their membership is identical.
+// (In practice, this means same elements, order doesn't matter)
+func (s1 String) Equal(s2 String) bool {
+	return cast(s1).Equal(cast(s2))
+}
+
+// List returns the contents as a sorted string slice.
+func (s String) List() []string {
+	return List(cast(s))
+}
+
+// UnsortedList returns the slice with contents in random order.
+func (s String) UnsortedList() []string {
+	return cast(s).UnsortedList()
+}
+
+// PopAny returns a single element from the set.
+func (s String) PopAny() (string, bool) {
+	return cast(s).PopAny()
+}
+
+// Len returns the size of the set.
+func (s String) Len() int {
+	return len(s)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sort/sort.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sort/sort.go
new file mode 100644
index 0000000000..6c2e0eb7a5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sort/sort.go
@@ -0,0 +1,191 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sort
+
+import (
+	"container/heap"
+	"fmt"
+	"sort"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// MergePreservingRelativeOrder performs a topological consensus sort of items from multiple sources.
+// It merges multiple lists of strings into a single list, preserving the relative order of
+// elements within each source list.
+//
+// For any two items, if one appears before the other in any of the input lists,
+// that relative order will be preserved in the output. If no relative ordering is
+// defined between two items, they are sorted lexicographically.
+//
+// The function uses Kahn's algorithm for topological sorting with a min-heap to ensure
+// deterministic output. Items with no dependencies are processed in lexicographic order,
+// guaranteeing consistent results across multiple invocations with the same input.
+//
+// This function contains a shortcut optimization that returns an input list directly
+// if it already contains all unique items. This provides O(n) performance in the best case.
+//
+// Example:
+//   - Input: {{"a", "b", "c"}, {"b", "c"}} returns {"a", "b", "c"}
+//   - Input: {{"a", "c"}, {"b", "c"}} returns {"a", "b", "c"} (lexicographic tie-breaking)
+//   - Input: {{"a", "b"}, {"b", "a"}} returns error (cycle detected)
+//
+// Complexity: O(L*n + V*log(V) + E) where L is the number of lists, n is the average
+// list size, V is the number of unique items, and E is the number of precedence edges.
+//
+// This is useful for creating a stable, consistent ordering when merging data from
+// multiple sources that may have partial but not conflicting orderings.
+func MergePreservingRelativeOrder(inputLists [][]string) []string {
+	if len(inputLists) == 0 {
+		return nil
+	}
+
+	// Build a directed graph of precedence relationships
+	graph := make(map[string]*graphNode)
+	for _, list := range inputLists {
+		for i, item := range list {
+			node := getOrCreateNode(graph, item)
+
+			// Add edge from current item to next item in list
+			if i < len(list)-1 {
+				nextItem := list[i+1]
+				nextNode := getOrCreateNode(graph, nextItem)
+
+				// Only add edge if not already present (avoid incrementing in-degree multiple times)
+				if !node.outEdges.Has(nextItem) {
+					node.outEdges.Insert(nextItem)
+					nextNode.inDegree++
+				}
+			}
+		}
+	}
+
+	// Shortcut: if any input list contains all items (no duplicates), use it
+	allItems := sets.New[string]()
+	for name := range graph {
+		allItems.Insert(name)
+	}
+	for _, list := range inputLists {
+		if len(list) == allItems.Len() && isUnique(list) {
+			return list
+		}
+	}
+
+	// Perform topological sort using Kahn's algorithm with min-heap for determinism
+	result, err := topologicalSort(graph)
+	if err != nil {
+		// This should not happen with valid input, but if it does,
+		// fall back to lexicographic sort to provide some result
+		items := make([]string, 0, len(graph))
+		for name := range graph {
+			items = append(items, name)
+		}
+		sort.Strings(items)
+		return items
+	}
+
+	return result
+}
+
+// getOrCreateNode retrieves or creates a graph node for the given name
+func getOrCreateNode(graph map[string]*graphNode, name string) *graphNode {
+	if graph[name] == nil {
+		graph[name] = &graphNode{
+			outEdges: sets.New[string](),
+			inDegree: 0,
+		}
+	}
+	return graph[name]
+}
+
+// isUnique checks if a list contains no duplicate items
+func isUnique(list []string) bool {
+	seen := make(map[string]bool, len(list))
+	for _, item := range list {
+		if seen[item] {
+			return false
+		}
+		seen[item] = true
+	}
+	return true
+}
+
+// topologicalSort performs Kahn's algorithm with a min-heap for deterministic ordering
+func topologicalSort(graph map[string]*graphNode) ([]string, error) {
+	// Initialize min-heap with all nodes that have no incoming edges
+	pq := &stringMinHeap{}
+	heap.Init(pq)
+
+	for name, node := range graph {
+		if node.inDegree == 0 {
+			heap.Push(pq, name)
+		}
+	}
+
+	result := make([]string, 0, len(graph))
+
+	for pq.Len() > 0 {
+		// Pop item with lowest lexicographic value
+		current := heap.Pop(pq).(string)
+		result = append(result, current)
+
+		currentNode := graph[current]
+
+		// Reduce in-degree for all neighbors
+		for neighbor := range currentNode.outEdges {
+			neighborNode := graph[neighbor]
+			neighborNode.inDegree--
+
+			// If in-degree becomes 0, add to heap
+			if neighborNode.inDegree == 0 {
+				heap.Push(pq, neighbor)
+			}
+		}
+	}
+
+	// Check for cycles
+	if len(result) != len(graph) {
+		return nil, fmt.Errorf("cycle detected in precedence graph: sorted %d items but graph has %d items", len(result), len(graph))
+	}
+
+	return result, nil
+}
+
+// graphNode represents a node in the precedence graph
+type graphNode struct {
+	// Items that should come after this item
+	outEdges sets.Set[string]
+	// Number of items that should come before this item
+	inDegree int
+}
+
+// stringMinHeap implements heap.Interface for strings (min-heap with lexicographic ordering)
+type stringMinHeap []string
+
+func (h stringMinHeap) Len() int           { return len(h) }
+func (h stringMinHeap) Less(i, j int) bool { return h[i] < h[j] }
+func (h stringMinHeap) Swap(i, j int)      { h[i], h[j] = h[j], h[i] }
+func (h *stringMinHeap) Push(x interface{}) {
+	*h = append(*h, x.(string))
+}
+func (h *stringMinHeap) Pop() interface{} {
+	old := *h
+	n := len(old)
+	x := old[n-1]
+	*h = old[0 : n-1]
+	return x
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sort/sort_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sort/sort_test.go
new file mode 100644
index 0000000000..a21b97b5ab
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/sort/sort_test.go
@@ -0,0 +1,148 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sort
+
+import (
+	"testing"
+)
+
+func TestSortDiscoveryGroupsTopo(t *testing.T) {
+	cases := []struct {
+		name  string
+		input [][]string
+		want  []string
+	}{
+		{
+			name: "consensus ordering",
+			input: [][]string{
+				{"A", "B", "C", "D"},
+				{"A", "B", "C", "D"},
+				{"A", "X", "Z", "D"},
+				{"Z", "Y"},
+				{"Q"},
+			},
+			want: []string{"A", "B", "C", "Q", "X", "Z", "D", "Y"},
+		},
+		{
+			name:  "empty input",
+			input: [][]string{},
+			want:  []string{},
+		},
+		{
+			name:  "single peer",
+			input: [][]string{{"foo", "bar", "baz"}},
+			want:  []string{"foo", "bar", "baz"},
+		},
+		{
+			name:  "conflicting orderings",
+			input: [][]string{{"A", "B"}, {"B", "A"}},
+			want:  []string{"A", "B"},
+		},
+		{
+			name:  "empty list merged with non-empty list",
+			input: [][]string{{}, {"A", "B", "C"}},
+			want:  []string{"A", "B", "C"},
+		},
+		{
+			name:  "multiple empty lists merged",
+			input: [][]string{{}, {}, {}},
+			want:  []string{},
+		},
+		{
+			name: "lexical tiebreak at beginning",
+			input: [][]string{
+				{"C", "D", "E"},
+				{"B", "D", "E"},
+				{"A", "D", "E"},
+			},
+			// A, B, C have no precedence constraints, so lexical order
+			want: []string{"A", "B", "C", "D", "E"},
+		},
+		{
+			name: "lexical tiebreak in middle",
+			input: [][]string{
+				{"A", "D", "E"},
+				{"A", "C", "E"},
+				{"A", "B", "E"},
+			},
+			// A comes first (consensus), then B, C, D (lexical), then E (consensus)
+			want: []string{"A", "B", "C", "D", "E"},
+		},
+		{
+			name: "conflicting orderings of 3 lists",
+			input: [][]string{
+				{"A", "B", "C"},
+				{"B", "C", "A"},
+				{"C", "A", "B"},
+			},
+			// Creates cycle: A->B, B->C, C->A
+			// Fallback to lexicographic sort
+			want: []string{"A", "B", "C"},
+		},
+		{
+			name: "conflicting ordering with different list lengths",
+			input: [][]string{
+				{"A", "B", "C", "D"},
+				{"B", "A"},
+				{"C", "D"},
+			},
+			// A->B->C->D from first list, but B->A from second
+			// Creates cycle between A and B
+			// Fallback to lexicographic sort
+			want: []string{"A", "B", "C", "D"},
+		},
+		{
+			name: "conflicting partial lists",
+			input: [][]string{
+				{"A", "B"},
+				{"C", "D"},
+				{"B", "A"},
+			},
+			// A->B from first, B->A from third (cycle)
+			// C->D is independent
+			// Fallback to lexicographic sort
+			want: []string{"A", "B", "C", "D"},
+		},
+		{
+			name: "cycle",
+			input: [][]string{
+				{"A", "B"},
+				{"B", "C"},
+				{"C", "A"},
+			},
+			// Creates cycle: A->B->C->A
+			// Fallback to lexicographic sort
+			want: []string{"A", "B", "C"},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := MergePreservingRelativeOrder(tc.input)
+			if len(got) != len(tc.want) {
+				t.Errorf("length mismatch:\n  got: %d\n  want: %d", len(got), len(tc.want))
+				return
+			}
+			for i := range got {
+				if got[i] != tc.want[i] {
+					t.Errorf("mismatch got: %v\n  want: %v", got, tc.want)
+					return
+				}
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/OWNERS b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/OWNERS
new file mode 100644
index 0000000000..73244449f2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/OWNERS
@@ -0,0 +1,9 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+  - apelisse
+  - pwittrock
+reviewers:
+  - apelisse
+emeritus_approvers:
+  - mengqiy
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/errors.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/errors.go
new file mode 100644
index 0000000000..ab66d04523
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/errors.go
@@ -0,0 +1,49 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package strategicpatch
+
+import (
+	"fmt"
+)
+
+type LookupPatchMetaError struct {
+	Path string
+	Err  error
+}
+
+func (e LookupPatchMetaError) Error() string {
+	return fmt.Sprintf("LookupPatchMetaError(%s): %v", e.Path, e.Err)
+}
+
+type FieldNotFoundError struct {
+	Path  string
+	Field string
+}
+
+func (e FieldNotFoundError) Error() string {
+	return fmt.Sprintf("unable to find api field %q in %s", e.Field, e.Path)
+}
+
+type InvalidTypeError struct {
+	Path     string
+	Expected string
+	Actual   string
+}
+
+func (e InvalidTypeError) Error() string {
+	return fmt.Sprintf("invalid type for %s: got %q, expected %q", e.Path, e.Actual, e.Expected)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/meta.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/meta.go
new file mode 100644
index 0000000000..1bfed1c2ec
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/meta.go
@@ -0,0 +1,283 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package strategicpatch
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/mergepatch"
+	forkedjson "k8s.io/apimachinery/third_party/forked/golang/json"
+	openapi "k8s.io/kube-openapi/pkg/util/proto"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+)
+
+const patchMergeKey = "x-kubernetes-patch-merge-key"
+const patchStrategy = "x-kubernetes-patch-strategy"
+
+type PatchMeta struct {
+	patchStrategies []string
+	patchMergeKey   string
+}
+
+func (pm *PatchMeta) GetPatchStrategies() []string {
+	if pm.patchStrategies == nil {
+		return []string{}
+	}
+	return pm.patchStrategies
+}
+
+func (pm *PatchMeta) SetPatchStrategies(ps []string) {
+	pm.patchStrategies = ps
+}
+
+func (pm *PatchMeta) GetPatchMergeKey() string {
+	return pm.patchMergeKey
+}
+
+func (pm *PatchMeta) SetPatchMergeKey(pmk string) {
+	pm.patchMergeKey = pmk
+}
+
+type LookupPatchMeta interface {
+	// LookupPatchMetadataForStruct gets subschema and the patch metadata (e.g. patch strategy and merge key) for map.
+	LookupPatchMetadataForStruct(key string) (LookupPatchMeta, PatchMeta, error)
+	// LookupPatchMetadataForSlice get subschema and the patch metadata for slice.
+	LookupPatchMetadataForSlice(key string) (LookupPatchMeta, PatchMeta, error)
+	// Get the type name of the field
+	Name() string
+}
+
+type PatchMetaFromStruct struct {
+	T reflect.Type
+}
+
+func NewPatchMetaFromStruct(dataStruct interface{}) (PatchMetaFromStruct, error) {
+	t, err := getTagStructType(dataStruct)
+	return PatchMetaFromStruct{T: t}, err
+}
+
+var _ LookupPatchMeta = PatchMetaFromStruct{}
+
+func (s PatchMetaFromStruct) LookupPatchMetadataForStruct(key string) (LookupPatchMeta, PatchMeta, error) {
+	fieldType, fieldPatchStrategies, fieldPatchMergeKey, err := forkedjson.LookupPatchMetadataForStruct(s.T, key)
+	if err != nil {
+		return nil, PatchMeta{}, err
+	}
+
+	return PatchMetaFromStruct{T: fieldType},
+		PatchMeta{
+			patchStrategies: fieldPatchStrategies,
+			patchMergeKey:   fieldPatchMergeKey,
+		}, nil
+}
+
+func (s PatchMetaFromStruct) LookupPatchMetadataForSlice(key string) (LookupPatchMeta, PatchMeta, error) {
+	subschema, patchMeta, err := s.LookupPatchMetadataForStruct(key)
+	if err != nil {
+		return nil, PatchMeta{}, err
+	}
+	elemPatchMetaFromStruct := subschema.(PatchMetaFromStruct)
+	t := elemPatchMetaFromStruct.T
+
+	var elemType reflect.Type
+	switch t.Kind() {
+	// If t is an array or a slice, get the element type.
+	// If element is still an array or a slice, return an error.
+	// Otherwise, return element type.
+	case reflect.Array, reflect.Slice:
+		elemType = t.Elem()
+		if elemType.Kind() == reflect.Array || elemType.Kind() == reflect.Slice {
+			return nil, PatchMeta{}, errors.New("unexpected slice of slice")
+		}
+	// If t is an pointer, get the underlying element.
+	// If the underlying element is neither an array nor a slice, the pointer is pointing to a slice,
+	// e.g. https://github.com/kubernetes/kubernetes/blob/bc22e206c79282487ea0bf5696d5ccec7e839a76/staging/src/k8s.io/apimachinery/pkg/util/strategicpatch/patch_test.go#L2782-L2822
+	// If the underlying element is either an array or a slice, return its element type.
+	case reflect.Pointer:
+		t = t.Elem()
+		if t.Kind() == reflect.Array || t.Kind() == reflect.Slice {
+			t = t.Elem()
+		}
+		elemType = t
+	default:
+		return nil, PatchMeta{}, fmt.Errorf("expected slice or array type, but got: %s", s.T.Kind().String())
+	}
+
+	return PatchMetaFromStruct{T: elemType}, patchMeta, nil
+}
+
+func (s PatchMetaFromStruct) Name() string {
+	return s.T.Kind().String()
+}
+
+func getTagStructType(dataStruct interface{}) (reflect.Type, error) {
+	if dataStruct == nil {
+		return nil, mergepatch.ErrBadArgKind(struct{}{}, nil)
+	}
+
+	t := reflect.TypeOf(dataStruct)
+	// Get the underlying type for pointers
+	if t.Kind() == reflect.Pointer {
+		t = t.Elem()
+	}
+
+	if t.Kind() != reflect.Struct {
+		return nil, mergepatch.ErrBadArgKind(struct{}{}, dataStruct)
+	}
+
+	return t, nil
+}
+
+func GetTagStructTypeOrDie(dataStruct interface{}) reflect.Type {
+	t, err := getTagStructType(dataStruct)
+	if err != nil {
+		panic(err)
+	}
+	return t
+}
+
+type PatchMetaFromOpenAPIV3 struct {
+	// SchemaList is required to resolve OpenAPI V3 references
+	SchemaList map[string]*spec.Schema
+	Schema     *spec.Schema
+}
+
+func (s PatchMetaFromOpenAPIV3) traverse(key string) (PatchMetaFromOpenAPIV3, error) {
+	if s.Schema == nil {
+		return PatchMetaFromOpenAPIV3{}, nil
+	}
+	if len(s.Schema.Properties) == 0 {
+		return PatchMetaFromOpenAPIV3{}, fmt.Errorf("unable to find api field \"%s\"", key)
+	}
+	subschema, ok := s.Schema.Properties[key]
+	if !ok {
+		return PatchMetaFromOpenAPIV3{}, fmt.Errorf("unable to find api field \"%s\"", key)
+	}
+	return PatchMetaFromOpenAPIV3{SchemaList: s.SchemaList, Schema: &subschema}, nil
+}
+
+func resolve(l *PatchMetaFromOpenAPIV3) error {
+	if len(l.Schema.AllOf) > 0 {
+		l.Schema = &l.Schema.AllOf[0]
+	}
+	if refString := l.Schema.Ref.String(); refString != "" {
+		str := strings.TrimPrefix(refString, "#/components/schemas/")
+		sch, ok := l.SchemaList[str]
+		if ok {
+			l.Schema = sch
+		} else {
+			return fmt.Errorf("unable to resolve %s in OpenAPI V3", refString)
+		}
+	}
+	return nil
+}
+
+func (s PatchMetaFromOpenAPIV3) LookupPatchMetadataForStruct(key string) (LookupPatchMeta, PatchMeta, error) {
+	l, err := s.traverse(key)
+	if err != nil {
+		return l, PatchMeta{}, err
+	}
+	p := PatchMeta{}
+	f, ok := l.Schema.Extensions[patchMergeKey]
+	if ok {
+		p.SetPatchMergeKey(f.(string))
+	}
+	g, ok := l.Schema.Extensions[patchStrategy]
+	if ok {
+		p.SetPatchStrategies(strings.Split(g.(string), ","))
+	}
+
+	err = resolve(&l)
+	return l, p, err
+}
+
+func (s PatchMetaFromOpenAPIV3) LookupPatchMetadataForSlice(key string) (LookupPatchMeta, PatchMeta, error) {
+	l, err := s.traverse(key)
+	if err != nil {
+		return l, PatchMeta{}, err
+	}
+	p := PatchMeta{}
+	f, ok := l.Schema.Extensions[patchMergeKey]
+	if ok {
+		p.SetPatchMergeKey(f.(string))
+	}
+	g, ok := l.Schema.Extensions[patchStrategy]
+	if ok {
+		p.SetPatchStrategies(strings.Split(g.(string), ","))
+	}
+	if l.Schema.Items != nil {
+		l.Schema = l.Schema.Items.Schema
+	}
+	err = resolve(&l)
+	return l, p, err
+}
+
+func (s PatchMetaFromOpenAPIV3) Name() string {
+	schema := s.Schema
+	if len(schema.Type) > 0 {
+		return strings.Join(schema.Type, "")
+	}
+	return "Struct"
+}
+
+type PatchMetaFromOpenAPI struct {
+	Schema openapi.Schema
+}
+
+func NewPatchMetaFromOpenAPI(s openapi.Schema) PatchMetaFromOpenAPI {
+	return PatchMetaFromOpenAPI{Schema: s}
+}
+
+var _ LookupPatchMeta = PatchMetaFromOpenAPI{}
+
+func (s PatchMetaFromOpenAPI) LookupPatchMetadataForStruct(key string) (LookupPatchMeta, PatchMeta, error) {
+	if s.Schema == nil {
+		return &PatchMetaFromOpenAPI{}, PatchMeta{}, nil
+	}
+	kindItem := NewKindItem(key, s.Schema.GetPath())
+	s.Schema.Accept(kindItem)
+
+	err := kindItem.Error()
+	if err != nil {
+		return nil, PatchMeta{}, err
+	}
+	return PatchMetaFromOpenAPI{Schema: kindItem.subschema},
+		kindItem.patchmeta, nil
+}
+
+func (s PatchMetaFromOpenAPI) LookupPatchMetadataForSlice(key string) (LookupPatchMeta, PatchMeta, error) {
+	if s.Schema == nil {
+		return nil, PatchMeta{}, nil
+	}
+	sliceItem := NewSliceItem(key, s.Schema.GetPath())
+	s.Schema.Accept(sliceItem)
+
+	err := sliceItem.Error()
+	if err != nil {
+		return nil, PatchMeta{}, err
+	}
+	return PatchMetaFromOpenAPI{Schema: sliceItem.subschema},
+		sliceItem.patchmeta, nil
+}
+
+func (s PatchMetaFromOpenAPI) Name() string {
+	schema := s.Schema
+	return schema.GetName()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/patch.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/patch.go
new file mode 100644
index 0000000000..71f6b5e875
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/patch.go
@@ -0,0 +1,2253 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package strategicpatch
+
+import (
+	"fmt"
+	"reflect"
+	"sort"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/util/json"
+	"k8s.io/apimachinery/pkg/util/mergepatch"
+)
+
+// An alternate implementation of JSON Merge Patch
+// (https://tools.ietf.org/html/rfc7386) which supports the ability to annotate
+// certain fields with metadata that indicates whether the elements of JSON
+// lists should be merged or replaced.
+//
+// For more information, see the PATCH section of docs/devel/api-conventions.md.
+//
+// Some of the content of this package was borrowed with minor adaptations from
+// evanphx/json-patch and openshift/origin.
+
+const (
+	directiveMarker  = "$patch"
+	deleteDirective  = "delete"
+	replaceDirective = "replace"
+	mergeDirective   = "merge"
+
+	retainKeysStrategy = "retainKeys"
+
+	deleteFromPrimitiveListDirectivePrefix = "$deleteFromPrimitiveList"
+	retainKeysDirective                    = "$" + retainKeysStrategy
+	setElementOrderDirectivePrefix         = "$setElementOrder"
+)
+
+// JSONMap is a representations of JSON object encoded as map[string]interface{}
+// where the children can be either map[string]interface{}, []interface{} or
+// primitive type).
+// Operating on JSONMap representation is much faster as it doesn't require any
+// json marshaling and/or unmarshaling operations.
+type JSONMap map[string]interface{}
+
+type DiffOptions struct {
+	// SetElementOrder determines whether we generate the $setElementOrder parallel list.
+	SetElementOrder bool
+	// IgnoreChangesAndAdditions indicates if we keep the changes and additions in the patch.
+	IgnoreChangesAndAdditions bool
+	// IgnoreDeletions indicates if we keep the deletions in the patch.
+	IgnoreDeletions bool
+	// We introduce a new value retainKeys for patchStrategy.
+	// It indicates that all fields needing to be preserved must be
+	// present in the `retainKeys` list.
+	// And the fields that are present will be merged with live object.
+	// All the missing fields will be cleared when patching.
+	BuildRetainKeysDirective bool
+}
+
+type MergeOptions struct {
+	// MergeParallelList indicates if we are merging the parallel list.
+	// We don't merge parallel list when calling mergeMap() in CreateThreeWayMergePatch()
+	// which is called client-side.
+	// We merge parallel list iff when calling mergeMap() in StrategicMergeMapPatch()
+	// which is called server-side
+	MergeParallelList bool
+	// IgnoreUnmatchedNulls indicates if we should process the unmatched nulls.
+	IgnoreUnmatchedNulls bool
+}
+
+// The following code is adapted from github.com/openshift/origin/pkg/util/jsonmerge.
+// Instead of defining a Delta that holds an original, a patch and a set of preconditions,
+// the reconcile method accepts a set of preconditions as an argument.
+
+// CreateTwoWayMergePatch creates a patch that can be passed to StrategicMergePatch from an original
+// document and a modified document, which are passed to the method as json encoded content. It will
+// return a patch that yields the modified document when applied to the original document, or an error
+// if either of the two documents is invalid.
+func CreateTwoWayMergePatch(original, modified []byte, dataStruct interface{}, fns ...mergepatch.PreconditionFunc) ([]byte, error) {
+	schema, err := NewPatchMetaFromStruct(dataStruct)
+	if err != nil {
+		return nil, err
+	}
+
+	return CreateTwoWayMergePatchUsingLookupPatchMeta(original, modified, schema, fns...)
+}
+
+func CreateTwoWayMergePatchUsingLookupPatchMeta(
+	original, modified []byte, schema LookupPatchMeta, fns ...mergepatch.PreconditionFunc) ([]byte, error) {
+	originalMap := map[string]interface{}{}
+	if len(original) > 0 {
+		if err := json.Unmarshal(original, &originalMap); err != nil {
+			return nil, mergepatch.ErrBadJSONDoc
+		}
+	}
+
+	modifiedMap := map[string]interface{}{}
+	if len(modified) > 0 {
+		if err := json.Unmarshal(modified, &modifiedMap); err != nil {
+			return nil, mergepatch.ErrBadJSONDoc
+		}
+	}
+
+	patchMap, err := CreateTwoWayMergeMapPatchUsingLookupPatchMeta(originalMap, modifiedMap, schema, fns...)
+	if err != nil {
+		return nil, err
+	}
+
+	return json.Marshal(patchMap)
+}
+
+// CreateTwoWayMergeMapPatch creates a patch from an original and modified JSON objects,
+// encoded JSONMap.
+// The serialized version of the map can then be passed to StrategicMergeMapPatch.
+func CreateTwoWayMergeMapPatch(original, modified JSONMap, dataStruct interface{}, fns ...mergepatch.PreconditionFunc) (JSONMap, error) {
+	schema, err := NewPatchMetaFromStruct(dataStruct)
+	if err != nil {
+		return nil, err
+	}
+
+	return CreateTwoWayMergeMapPatchUsingLookupPatchMeta(original, modified, schema, fns...)
+}
+
+func CreateTwoWayMergeMapPatchUsingLookupPatchMeta(original, modified JSONMap, schema LookupPatchMeta, fns ...mergepatch.PreconditionFunc) (JSONMap, error) {
+	diffOptions := DiffOptions{
+		SetElementOrder: true,
+	}
+	patchMap, err := diffMaps(original, modified, schema, diffOptions)
+	if err != nil {
+		return nil, err
+	}
+
+	// Apply the preconditions to the patch, and return an error if any of them fail.
+	for _, fn := range fns {
+		if !fn(patchMap) {
+			return nil, mergepatch.NewErrPreconditionFailed(patchMap)
+		}
+	}
+
+	return patchMap, nil
+}
+
+// Returns a (recursive) strategic merge patch that yields modified when applied to original.
+// Including:
+// - Adding fields to the patch present in modified, missing from original
+// - Setting fields to the patch present in modified and original with different values
+// - Delete fields present in original, missing from modified through
+// - IFF map field - set to nil in patch
+// - IFF list of maps && merge strategy - use deleteDirective for the elements
+// - IFF list of primitives && merge strategy - use parallel deletion list
+// - IFF list of maps or primitives with replace strategy (default) - set patch value to the value in modified
+// - Build $retainKeys directive for fields with retainKeys patch strategy
+func diffMaps(original, modified map[string]interface{}, schema LookupPatchMeta, diffOptions DiffOptions) (map[string]interface{}, error) {
+	patch := map[string]interface{}{}
+
+	// This will be used to build the $retainKeys directive sent in the patch
+	retainKeysList := make([]interface{}, 0, len(modified))
+
+	// Compare each value in the modified map against the value in the original map
+	for key, modifiedValue := range modified {
+		// Get the underlying type for pointers
+		if diffOptions.BuildRetainKeysDirective && modifiedValue != nil {
+			retainKeysList = append(retainKeysList, key)
+		}
+
+		originalValue, ok := original[key]
+		if !ok {
+			// Key was added, so add to patch
+			if !diffOptions.IgnoreChangesAndAdditions {
+				patch[key] = modifiedValue
+			}
+			continue
+		}
+
+		// The patch may have a patch directive
+		// TODO: figure out if we need this. This shouldn't be needed by apply. When would the original map have patch directives in it?
+		foundDirectiveMarker, err := handleDirectiveMarker(key, originalValue, modifiedValue, patch)
+		if err != nil {
+			return nil, err
+		}
+		if foundDirectiveMarker {
+			continue
+		}
+
+		if reflect.TypeOf(originalValue) != reflect.TypeOf(modifiedValue) {
+			// Types have changed, so add to patch
+			if !diffOptions.IgnoreChangesAndAdditions {
+				patch[key] = modifiedValue
+			}
+			continue
+		}
+
+		// Types are the same, so compare values
+		switch originalValueTyped := originalValue.(type) {
+		case map[string]interface{}:
+			modifiedValueTyped := modifiedValue.(map[string]interface{})
+			err = handleMapDiff(key, originalValueTyped, modifiedValueTyped, patch, schema, diffOptions)
+		case []interface{}:
+			modifiedValueTyped := modifiedValue.([]interface{})
+			err = handleSliceDiff(key, originalValueTyped, modifiedValueTyped, patch, schema, diffOptions)
+		default:
+			replacePatchFieldIfNotEqual(key, originalValue, modifiedValue, patch, diffOptions)
+		}
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	updatePatchIfMissing(original, modified, patch, diffOptions)
+	// Insert the retainKeysList iff there are values present in the retainKeysList and
+	// either of the following is true:
+	// - the patch is not empty
+	// - there are additional field in original that need to be cleared
+	if len(retainKeysList) > 0 &&
+		(len(patch) > 0 || hasAdditionalNewField(original, modified)) {
+		patch[retainKeysDirective] = sortScalars(retainKeysList)
+	}
+	return patch, nil
+}
+
+// handleDirectiveMarker handles how to diff directive marker between 2 objects
+func handleDirectiveMarker(key string, originalValue, modifiedValue interface{}, patch map[string]interface{}) (bool, error) {
+	if key == directiveMarker {
+		originalString, ok := originalValue.(string)
+		if !ok {
+			return false, fmt.Errorf("invalid value for special key: %s", directiveMarker)
+		}
+		modifiedString, ok := modifiedValue.(string)
+		if !ok {
+			return false, fmt.Errorf("invalid value for special key: %s", directiveMarker)
+		}
+		if modifiedString != originalString {
+			patch[directiveMarker] = modifiedValue
+		}
+		return true, nil
+	}
+	return false, nil
+}
+
+// handleMapDiff diff between 2 maps `originalValueTyped` and `modifiedValue`,
+// puts the diff in the `patch` associated with `key`
+// key is the key associated with originalValue and modifiedValue.
+// originalValue, modifiedValue are the old and new value respectively.They are both maps
+// patch is the patch map that contains key and the updated value, and it is the parent of originalValue, modifiedValue
+// diffOptions contains multiple options to control how we do the diff.
+func handleMapDiff(key string, originalValue, modifiedValue, patch map[string]interface{},
+	schema LookupPatchMeta, diffOptions DiffOptions) error {
+	subschema, patchMeta, err := schema.LookupPatchMetadataForStruct(key)
+
+	if err != nil {
+		// We couldn't look up metadata for the field
+		// If the values are identical, this doesn't matter, no patch is needed
+		if reflect.DeepEqual(originalValue, modifiedValue) {
+			return nil
+		}
+		// Otherwise, return the error
+		return err
+	}
+	retainKeys, patchStrategy, err := extractRetainKeysPatchStrategy(patchMeta.GetPatchStrategies())
+	if err != nil {
+		return err
+	}
+	diffOptions.BuildRetainKeysDirective = retainKeys
+	switch patchStrategy {
+	// The patch strategic from metadata tells us to replace the entire object instead of diffing it
+	case replaceDirective:
+		if !diffOptions.IgnoreChangesAndAdditions {
+			patch[key] = modifiedValue
+		}
+	default:
+		patchValue, err := diffMaps(originalValue, modifiedValue, subschema, diffOptions)
+		if err != nil {
+			return err
+		}
+		// Maps were not identical, use provided patch value
+		if len(patchValue) > 0 {
+			patch[key] = patchValue
+		}
+	}
+	return nil
+}
+
+// handleSliceDiff diff between 2 slices `originalValueTyped` and `modifiedValue`,
+// puts the diff in the `patch` associated with `key`
+// key is the key associated with originalValue and modifiedValue.
+// originalValue, modifiedValue are the old and new value respectively.They are both slices
+// patch is the patch map that contains key and the updated value, and it is the parent of originalValue, modifiedValue
+// diffOptions contains multiple options to control how we do the diff.
+func handleSliceDiff(key string, originalValue, modifiedValue []interface{}, patch map[string]interface{},
+	schema LookupPatchMeta, diffOptions DiffOptions) error {
+	subschema, patchMeta, err := schema.LookupPatchMetadataForSlice(key)
+	if err != nil {
+		// We couldn't look up metadata for the field
+		// If the values are identical, this doesn't matter, no patch is needed
+		if reflect.DeepEqual(originalValue, modifiedValue) {
+			return nil
+		}
+		// Otherwise, return the error
+		return err
+	}
+	retainKeys, patchStrategy, err := extractRetainKeysPatchStrategy(patchMeta.GetPatchStrategies())
+	if err != nil {
+		return err
+	}
+	switch patchStrategy {
+	// Merge the 2 slices using mergePatchKey
+	case mergeDirective:
+		diffOptions.BuildRetainKeysDirective = retainKeys
+		addList, deletionList, setOrderList, err := diffLists(originalValue, modifiedValue, subschema, patchMeta.GetPatchMergeKey(), diffOptions)
+		if err != nil {
+			return err
+		}
+		if len(addList) > 0 {
+			patch[key] = addList
+		}
+		// generate a parallel list for deletion
+		if len(deletionList) > 0 {
+			parallelDeletionListKey := fmt.Sprintf("%s/%s", deleteFromPrimitiveListDirectivePrefix, key)
+			patch[parallelDeletionListKey] = deletionList
+		}
+		if len(setOrderList) > 0 {
+			parallelSetOrderListKey := fmt.Sprintf("%s/%s", setElementOrderDirectivePrefix, key)
+			patch[parallelSetOrderListKey] = setOrderList
+		}
+	default:
+		replacePatchFieldIfNotEqual(key, originalValue, modifiedValue, patch, diffOptions)
+	}
+	return nil
+}
+
+// replacePatchFieldIfNotEqual updates the patch if original and modified are not deep equal
+// if diffOptions.IgnoreChangesAndAdditions is false.
+// original is the old value, maybe either the live cluster object or the last applied configuration
+// modified is the new value, is always the users new config
+func replacePatchFieldIfNotEqual(key string, original, modified interface{},
+	patch map[string]interface{}, diffOptions DiffOptions) {
+	if diffOptions.IgnoreChangesAndAdditions {
+		// Ignoring changes - do nothing
+		return
+	}
+	if reflect.DeepEqual(original, modified) {
+		// Contents are identical - do nothing
+		return
+	}
+	// Create a patch to replace the old value with the new one
+	patch[key] = modified
+}
+
+// updatePatchIfMissing iterates over `original` when ignoreDeletions is false.
+// Clear the field whose key is not present in `modified`.
+// original is the old value, maybe either the live cluster object or the last applied configuration
+// modified is the new value, is always the users new config
+func updatePatchIfMissing(original, modified, patch map[string]interface{}, diffOptions DiffOptions) {
+	if diffOptions.IgnoreDeletions {
+		// Ignoring deletion - do nothing
+		return
+	}
+	// Add nils for deleted values
+	for key := range original {
+		if _, found := modified[key]; !found {
+			patch[key] = nil
+		}
+	}
+}
+
+// validateMergeKeyInLists checks if each map in the list has the mentryerge key.
+func validateMergeKeyInLists(mergeKey string, lists ...[]interface{}) error {
+	for _, list := range lists {
+		for _, item := range list {
+			m, ok := item.(map[string]interface{})
+			if !ok {
+				return mergepatch.ErrBadArgType(m, item)
+			}
+			if _, ok = m[mergeKey]; !ok {
+				return mergepatch.ErrNoMergeKey(m, mergeKey)
+			}
+		}
+	}
+	return nil
+}
+
+// normalizeElementOrder sort `patch` list by `patchOrder` and sort `serverOnly` list by `serverOrder`.
+// Then it merges the 2 sorted lists.
+// It guarantee the relative order in the patch list and in the serverOnly list is kept.
+// `patch` is a list of items in the patch, and `serverOnly` is a list of items in the live object.
+// `patchOrder` is the order we want `patch` list to have and
+// `serverOrder` is the order we want `serverOnly` list to have.
+// kind is the kind of each item in the lists `patch` and `serverOnly`.
+func normalizeElementOrder(patch, serverOnly, patchOrder, serverOrder []interface{}, mergeKey string, kind reflect.Kind) ([]interface{}, error) {
+	patch, err := normalizeSliceOrder(patch, patchOrder, mergeKey, kind)
+	if err != nil {
+		return nil, err
+	}
+	serverOnly, err = normalizeSliceOrder(serverOnly, serverOrder, mergeKey, kind)
+	if err != nil {
+		return nil, err
+	}
+	all := mergeSortedSlice(serverOnly, patch, serverOrder, mergeKey, kind)
+
+	return all, nil
+}
+
+// mergeSortedSlice merges the 2 sorted lists by serverOrder with best effort.
+// It will insert each item in `left` list to `right` list. In most cases, the 2 lists will be interleaved.
+// The relative order of left and right are guaranteed to be kept.
+// They have higher precedence than the order in the live list.
+// The place for a item in `left` is found by:
+// scan from the place of last insertion in `right` to the end of `right`,
+// the place is before the first item that is greater than the item we want to insert.
+// example usage: using server-only items as left and patch items as right. We insert server-only items
+// to patch list. We use the order of live object as record for comparison.
+func mergeSortedSlice(left, right, serverOrder []interface{}, mergeKey string, kind reflect.Kind) []interface{} {
+	// Returns if l is less than r, and if both have been found.
+	// If l and r both present and l is in front of r, l is less than r.
+	less := func(l, r interface{}) (bool, bool) {
+		li := index(serverOrder, l, mergeKey, kind)
+		ri := index(serverOrder, r, mergeKey, kind)
+		if li >= 0 && ri >= 0 {
+			return li < ri, true
+		} else {
+			return false, false
+		}
+	}
+
+	// left and right should be non-overlapping.
+	size := len(left) + len(right)
+	i, j := 0, 0
+	s := make([]interface{}, size, size)
+
+	for k := 0; k < size; k++ {
+		if i >= len(left) && j < len(right) {
+			// have items left in `right` list
+			s[k] = right[j]
+			j++
+		} else if j >= len(right) && i < len(left) {
+			// have items left in `left` list
+			s[k] = left[i]
+			i++
+		} else {
+			// compare them if i and j are both in bound
+			less, foundBoth := less(left[i], right[j])
+			if foundBoth && less {
+				s[k] = left[i]
+				i++
+			} else {
+				s[k] = right[j]
+				j++
+			}
+		}
+	}
+	return s
+}
+
+// index returns the index of the item in the given items, or -1 if it doesn't exist
+// l must NOT be a slice of slices, this should be checked before calling.
+func index(l []interface{}, valToLookUp interface{}, mergeKey string, kind reflect.Kind) int {
+	var getValFn func(interface{}) interface{}
+	// Get the correct `getValFn` based on item `kind`.
+	// It should return the value of merge key for maps and
+	// return the item for other kinds.
+	switch kind {
+	case reflect.Map:
+		getValFn = func(item interface{}) interface{} {
+			typedItem, ok := item.(map[string]interface{})
+			if !ok {
+				return nil
+			}
+			val := typedItem[mergeKey]
+			return val
+		}
+	default:
+		getValFn = func(item interface{}) interface{} {
+			return item
+		}
+	}
+
+	for i, v := range l {
+		if getValFn(valToLookUp) == getValFn(v) {
+			return i
+		}
+	}
+	return -1
+}
+
+// extractToDeleteItems takes a list and
+// returns 2 lists: one contains items that should be kept and the other contains items to be deleted.
+func extractToDeleteItems(l []interface{}) ([]interface{}, []interface{}, error) {
+	var nonDelete, toDelete []interface{}
+	for _, v := range l {
+		m, ok := v.(map[string]interface{})
+		if !ok {
+			return nil, nil, mergepatch.ErrBadArgType(m, v)
+		}
+
+		directive, foundDirective := m[directiveMarker]
+		if foundDirective && directive == deleteDirective {
+			toDelete = append(toDelete, v)
+		} else {
+			nonDelete = append(nonDelete, v)
+		}
+	}
+	return nonDelete, toDelete, nil
+}
+
+// normalizeSliceOrder sort `toSort` list by `order`
+func normalizeSliceOrder(toSort, order []interface{}, mergeKey string, kind reflect.Kind) ([]interface{}, error) {
+	var toDelete []interface{}
+	if kind == reflect.Map {
+		// make sure each item in toSort, order has merge key
+		err := validateMergeKeyInLists(mergeKey, toSort, order)
+		if err != nil {
+			return nil, err
+		}
+		toSort, toDelete, err = extractToDeleteItems(toSort)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	sort.SliceStable(toSort, func(i, j int) bool {
+		if ii := index(order, toSort[i], mergeKey, kind); ii >= 0 {
+			if ij := index(order, toSort[j], mergeKey, kind); ij >= 0 {
+				return ii < ij
+			}
+		}
+		return true
+	})
+	toSort = append(toSort, toDelete...)
+	return toSort, nil
+}
+
+// Returns a (recursive) strategic merge patch, a parallel deletion list if necessary and
+// another list to set the order of the list
+// Only list of primitives with merge strategy will generate a parallel deletion list.
+// These two lists should yield modified when applied to original, for lists with merge semantics.
+func diffLists(original, modified []interface{}, schema LookupPatchMeta, mergeKey string, diffOptions DiffOptions) ([]interface{}, []interface{}, []interface{}, error) {
+	if len(original) == 0 {
+		// Both slices are empty - do nothing
+		if len(modified) == 0 || diffOptions.IgnoreChangesAndAdditions {
+			return nil, nil, nil, nil
+		}
+
+		// Old slice was empty - add all elements from the new slice
+		return modified, nil, nil, nil
+	}
+
+	elementType, err := sliceElementType(original, modified)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	var patchList, deleteList, setOrderList []interface{}
+	kind := elementType.Kind()
+	switch kind {
+	case reflect.Map:
+		patchList, deleteList, err = diffListsOfMaps(original, modified, schema, mergeKey, diffOptions)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+		patchList, err = normalizeSliceOrder(patchList, modified, mergeKey, kind)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+		orderSame, err := isOrderSame(original, modified, mergeKey)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+		// append the deletions to the end of the patch list.
+		patchList = append(patchList, deleteList...)
+		deleteList = nil
+		// generate the setElementOrder list when there are content changes or order changes
+		if diffOptions.SetElementOrder &&
+			((!diffOptions.IgnoreChangesAndAdditions && (len(patchList) > 0 || !orderSame)) ||
+				(!diffOptions.IgnoreDeletions && len(patchList) > 0)) {
+			// Generate a list of maps that each item contains only the merge key.
+			setOrderList = make([]interface{}, len(modified))
+			for i, v := range modified {
+				typedV := v.(map[string]interface{})
+				setOrderList[i] = map[string]interface{}{
+					mergeKey: typedV[mergeKey],
+				}
+			}
+		}
+	case reflect.Slice:
+		// Lists of Lists are not permitted by the api
+		return nil, nil, nil, mergepatch.ErrNoListOfLists
+	default:
+		patchList, deleteList, err = diffListsOfScalars(original, modified, diffOptions)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+		patchList, err = normalizeSliceOrder(patchList, modified, mergeKey, kind)
+		// generate the setElementOrder list when there are content changes or order changes
+		if diffOptions.SetElementOrder && ((!diffOptions.IgnoreDeletions && len(deleteList) > 0) ||
+			(!diffOptions.IgnoreChangesAndAdditions && !reflect.DeepEqual(original, modified))) {
+			setOrderList = modified
+		}
+	}
+	return patchList, deleteList, setOrderList, err
+}
+
+// isOrderSame checks if the order in a list has changed
+func isOrderSame(original, modified []interface{}, mergeKey string) (bool, error) {
+	if len(original) != len(modified) {
+		return false, nil
+	}
+	for i, modifiedItem := range modified {
+		equal, err := mergeKeyValueEqual(original[i], modifiedItem, mergeKey)
+		if err != nil || !equal {
+			return equal, err
+		}
+	}
+	return true, nil
+}
+
+// diffListsOfScalars returns 2 lists, the first one is addList and the second one is deletionList.
+// Argument diffOptions.IgnoreChangesAndAdditions controls if calculate addList. true means not calculate.
+// Argument diffOptions.IgnoreDeletions controls if calculate deletionList. true means not calculate.
+// original may be changed, but modified is guaranteed to not be changed
+func diffListsOfScalars(original, modified []interface{}, diffOptions DiffOptions) ([]interface{}, []interface{}, error) {
+	modifiedCopy := make([]interface{}, len(modified))
+	copy(modifiedCopy, modified)
+	// Sort the scalars for easier calculating the diff
+	originalScalars := sortScalars(original)
+	modifiedScalars := sortScalars(modifiedCopy)
+
+	originalIndex, modifiedIndex := 0, 0
+	addList := []interface{}{}
+	deletionList := []interface{}{}
+
+	for {
+		originalInBounds := originalIndex < len(originalScalars)
+		modifiedInBounds := modifiedIndex < len(modifiedScalars)
+		if !originalInBounds && !modifiedInBounds {
+			break
+		}
+		// we need to compare the string representation of the scalar,
+		// because the scalar is an interface which doesn't support either < or >
+		// And that's how func sortScalars compare scalars.
+		var originalString, modifiedString string
+		var originalValue, modifiedValue interface{}
+		if originalInBounds {
+			originalValue = originalScalars[originalIndex]
+			originalString = fmt.Sprintf("%v", originalValue)
+		}
+		if modifiedInBounds {
+			modifiedValue = modifiedScalars[modifiedIndex]
+			modifiedString = fmt.Sprintf("%v", modifiedValue)
+		}
+
+		originalV, modifiedV := compareListValuesAtIndex(originalInBounds, modifiedInBounds, originalString, modifiedString)
+		switch {
+		case originalV == nil && modifiedV == nil:
+			originalIndex++
+			modifiedIndex++
+		case originalV != nil && modifiedV == nil:
+			if !diffOptions.IgnoreDeletions {
+				deletionList = append(deletionList, originalValue)
+			}
+			originalIndex++
+		case originalV == nil && modifiedV != nil:
+			if !diffOptions.IgnoreChangesAndAdditions {
+				addList = append(addList, modifiedValue)
+			}
+			modifiedIndex++
+		default:
+			return nil, nil, fmt.Errorf("Unexpected returned value from compareListValuesAtIndex: %v and %v", originalV, modifiedV)
+		}
+	}
+
+	return addList, deduplicateScalars(deletionList), nil
+}
+
+// If first return value is non-nil, list1 contains an element not present in list2
+// If second return value is non-nil, list2 contains an element not present in list1
+func compareListValuesAtIndex(list1Inbounds, list2Inbounds bool, list1Value, list2Value string) (interface{}, interface{}) {
+	bothInBounds := list1Inbounds && list2Inbounds
+	switch {
+	// scalars are identical
+	case bothInBounds && list1Value == list2Value:
+		return nil, nil
+	// only list2 is in bound
+	case !list1Inbounds:
+		fallthrough
+	// list2 has additional scalar
+	case bothInBounds && list1Value > list2Value:
+		return nil, list2Value
+	// only original is in bound
+	case !list2Inbounds:
+		fallthrough
+	// original has additional scalar
+	case bothInBounds && list1Value < list2Value:
+		return list1Value, nil
+	default:
+		return nil, nil
+	}
+}
+
+// diffListsOfMaps takes a pair of lists and
+// returns a (recursive) strategic merge patch list contains additions and changes and
+// a deletion list contains deletions
+func diffListsOfMaps(original, modified []interface{}, schema LookupPatchMeta, mergeKey string, diffOptions DiffOptions) ([]interface{}, []interface{}, error) {
+	patch := make([]interface{}, 0, len(modified))
+	deletionList := make([]interface{}, 0, len(original))
+
+	originalSorted, err := sortMergeListsByNameArray(original, schema, mergeKey, false)
+	if err != nil {
+		return nil, nil, err
+	}
+	modifiedSorted, err := sortMergeListsByNameArray(modified, schema, mergeKey, false)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	originalIndex, modifiedIndex := 0, 0
+	for {
+		originalInBounds := originalIndex < len(originalSorted)
+		modifiedInBounds := modifiedIndex < len(modifiedSorted)
+		bothInBounds := originalInBounds && modifiedInBounds
+		if !originalInBounds && !modifiedInBounds {
+			break
+		}
+
+		var originalElementMergeKeyValueString, modifiedElementMergeKeyValueString string
+		var originalElementMergeKeyValue, modifiedElementMergeKeyValue interface{}
+		var originalElement, modifiedElement map[string]interface{}
+		if originalInBounds {
+			originalElement, originalElementMergeKeyValue, err = getMapAndMergeKeyValueByIndex(originalIndex, mergeKey, originalSorted)
+			if err != nil {
+				return nil, nil, err
+			}
+			originalElementMergeKeyValueString = fmt.Sprintf("%v", originalElementMergeKeyValue)
+		}
+		if modifiedInBounds {
+			modifiedElement, modifiedElementMergeKeyValue, err = getMapAndMergeKeyValueByIndex(modifiedIndex, mergeKey, modifiedSorted)
+			if err != nil {
+				return nil, nil, err
+			}
+			modifiedElementMergeKeyValueString = fmt.Sprintf("%v", modifiedElementMergeKeyValue)
+		}
+
+		switch {
+		case bothInBounds && ItemMatchesOriginalAndModifiedSlice(originalElementMergeKeyValueString, modifiedElementMergeKeyValueString):
+			// Merge key values are equal, so recurse
+			patchValue, err := diffMaps(originalElement, modifiedElement, schema, diffOptions)
+			if err != nil {
+				return nil, nil, err
+			}
+			if len(patchValue) > 0 {
+				patchValue[mergeKey] = modifiedElementMergeKeyValue
+				patch = append(patch, patchValue)
+			}
+			originalIndex++
+			modifiedIndex++
+		// only modified is in bound
+		case !originalInBounds:
+			fallthrough
+		// modified has additional map
+		case bothInBounds && ItemAddedToModifiedSlice(originalElementMergeKeyValueString, modifiedElementMergeKeyValueString):
+			if !diffOptions.IgnoreChangesAndAdditions {
+				patch = append(patch, modifiedElement)
+			}
+			modifiedIndex++
+		// only original is in bound
+		case !modifiedInBounds:
+			fallthrough
+		// original has additional map
+		case bothInBounds && ItemRemovedFromModifiedSlice(originalElementMergeKeyValueString, modifiedElementMergeKeyValueString):
+			if !diffOptions.IgnoreDeletions {
+				// Item was deleted, so add delete directive
+				deletionList = append(deletionList, CreateDeleteDirective(mergeKey, originalElementMergeKeyValue))
+			}
+			originalIndex++
+		}
+	}
+
+	return patch, deletionList, nil
+}
+
+// getMapAndMergeKeyValueByIndex return a map in the list and its merge key value given the index of the map.
+func getMapAndMergeKeyValueByIndex(index int, mergeKey string, listOfMaps []interface{}) (map[string]interface{}, interface{}, error) {
+	m, ok := listOfMaps[index].(map[string]interface{})
+	if !ok {
+		return nil, nil, mergepatch.ErrBadArgType(m, listOfMaps[index])
+	}
+
+	val, ok := m[mergeKey]
+	if !ok {
+		return nil, nil, mergepatch.ErrNoMergeKey(m, mergeKey)
+	}
+	return m, val, nil
+}
+
+// StrategicMergePatch applies a strategic merge patch. The patch and the original document
+// must be json encoded content. A patch can be created from an original and a modified document
+// by calling CreateStrategicMergePatch.
+func StrategicMergePatch(original, patch []byte, dataStruct interface{}) ([]byte, error) {
+	schema, err := NewPatchMetaFromStruct(dataStruct)
+	if err != nil {
+		return nil, err
+	}
+
+	return StrategicMergePatchUsingLookupPatchMeta(original, patch, schema)
+}
+
+func StrategicMergePatchUsingLookupPatchMeta(original, patch []byte, schema LookupPatchMeta) ([]byte, error) {
+	originalMap, err := handleUnmarshal(original)
+	if err != nil {
+		return nil, err
+	}
+	patchMap, err := handleUnmarshal(patch)
+	if err != nil {
+		return nil, err
+	}
+
+	result, err := StrategicMergeMapPatchUsingLookupPatchMeta(originalMap, patchMap, schema)
+	if err != nil {
+		return nil, err
+	}
+
+	return json.Marshal(result)
+}
+
+func handleUnmarshal(j []byte) (map[string]interface{}, error) {
+	if j == nil {
+		j = []byte("{}")
+	}
+
+	m := map[string]interface{}{}
+	err := json.Unmarshal(j, &m)
+	if err != nil {
+		return nil, mergepatch.ErrBadJSONDoc
+	}
+	return m, nil
+}
+
+// StrategicMergeMapPatch applies a strategic merge patch. The original and patch documents
+// must be JSONMap. A patch can be created from an original and modified document by
+// calling CreateTwoWayMergeMapPatch.
+// Warning: the original and patch JSONMap objects are mutated by this function and should not be reused.
+func StrategicMergeMapPatch(original, patch JSONMap, dataStruct interface{}) (JSONMap, error) {
+	schema, err := NewPatchMetaFromStruct(dataStruct)
+	if err != nil {
+		return nil, err
+	}
+
+	// We need the go struct tags `patchMergeKey` and `patchStrategy` for fields that support a strategic merge patch.
+	// For native resources, we can easily figure out these tags since we know the fields.
+
+	// Because custom resources are decoded as Unstructured and because we're missing the metadata about how to handle
+	// each field in a strategic merge patch, we can't find the go struct tags. Hence, we can't easily  do a strategic merge
+	// for custom resources. So we should fail fast and return an error.
+	if _, ok := dataStruct.(*unstructured.Unstructured); ok {
+		return nil, mergepatch.ErrUnsupportedStrategicMergePatchFormat
+	}
+
+	return StrategicMergeMapPatchUsingLookupPatchMeta(original, patch, schema)
+}
+
+func StrategicMergeMapPatchUsingLookupPatchMeta(original, patch JSONMap, schema LookupPatchMeta) (JSONMap, error) {
+	mergeOptions := MergeOptions{
+		MergeParallelList:    true,
+		IgnoreUnmatchedNulls: true,
+	}
+	return mergeMap(original, patch, schema, mergeOptions)
+}
+
+// MergeStrategicMergeMapPatchUsingLookupPatchMeta merges strategic merge
+// patches retaining `null` fields and parallel lists. If 2 patches change the
+// same fields and the latter one will override the former one. If you don't
+// want that happen, you need to run func MergingMapsHaveConflicts before
+// merging these patches. Applying the resulting merged merge patch to a JSONMap
+// yields the same as merging each strategic merge patch to the JSONMap in
+// succession.
+func MergeStrategicMergeMapPatchUsingLookupPatchMeta(schema LookupPatchMeta, patches ...JSONMap) (JSONMap, error) {
+	mergeOptions := MergeOptions{
+		MergeParallelList:    false,
+		IgnoreUnmatchedNulls: false,
+	}
+	merged := JSONMap{}
+	var err error
+	for _, patch := range patches {
+		merged, err = mergeMap(merged, patch, schema, mergeOptions)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return merged, nil
+}
+
+// handleDirectiveInMergeMap handles the patch directive when merging 2 maps.
+func handleDirectiveInMergeMap(directive interface{}, patch map[string]interface{}) (map[string]interface{}, error) {
+	if directive == replaceDirective {
+		// If the patch contains "$patch: replace", don't merge it, just use the
+		// patch directly. Later on, we can add a single level replace that only
+		// affects the map that the $patch is in.
+		delete(patch, directiveMarker)
+		return patch, nil
+	}
+
+	if directive == deleteDirective {
+		// If the patch contains "$patch: delete", don't merge it, just return
+		//  an empty map.
+		return map[string]interface{}{}, nil
+	}
+
+	return nil, mergepatch.ErrBadPatchType(directive, patch)
+}
+
+func containsDirectiveMarker(item interface{}) bool {
+	m, ok := item.(map[string]interface{})
+	if ok {
+		if _, foundDirectiveMarker := m[directiveMarker]; foundDirectiveMarker {
+			return true
+		}
+	}
+	return false
+}
+
+func mergeKeyValueEqual(left, right interface{}, mergeKey string) (bool, error) {
+	if len(mergeKey) == 0 {
+		return left == right, nil
+	}
+	typedLeft, ok := left.(map[string]interface{})
+	if !ok {
+		return false, mergepatch.ErrBadArgType(typedLeft, left)
+	}
+	typedRight, ok := right.(map[string]interface{})
+	if !ok {
+		return false, mergepatch.ErrBadArgType(typedRight, right)
+	}
+	mergeKeyLeft, ok := typedLeft[mergeKey]
+	if !ok {
+		return false, mergepatch.ErrNoMergeKey(typedLeft, mergeKey)
+	}
+	mergeKeyRight, ok := typedRight[mergeKey]
+	if !ok {
+		return false, mergepatch.ErrNoMergeKey(typedRight, mergeKey)
+	}
+	return mergeKeyLeft == mergeKeyRight, nil
+}
+
+// extractKey trims the prefix and return the original key
+func extractKey(s, prefix string) (string, error) {
+	substrings := strings.SplitN(s, "/", 2)
+	if len(substrings) <= 1 || substrings[0] != prefix {
+		switch prefix {
+		case deleteFromPrimitiveListDirectivePrefix:
+			return "", mergepatch.ErrBadPatchFormatForPrimitiveList
+		case setElementOrderDirectivePrefix:
+			return "", mergepatch.ErrBadPatchFormatForSetElementOrderList
+		default:
+			return "", fmt.Errorf("fail to find unknown prefix %q in %s\n", prefix, s)
+		}
+	}
+	return substrings[1], nil
+}
+
+// validatePatchUsingSetOrderList verifies:
+// the relative order of any two items in the setOrderList list matches that in the patch list.
+// the items in the patch list must be a subset or the same as the $setElementOrder list (deletions are ignored).
+func validatePatchWithSetOrderList(patchList, setOrderList interface{}, mergeKey string) error {
+	typedSetOrderList, ok := setOrderList.([]interface{})
+	if !ok {
+		return mergepatch.ErrBadPatchFormatForSetElementOrderList
+	}
+	typedPatchList, ok := patchList.([]interface{})
+	if !ok {
+		return mergepatch.ErrBadPatchFormatForSetElementOrderList
+	}
+	if len(typedSetOrderList) == 0 || len(typedPatchList) == 0 {
+		return nil
+	}
+
+	var nonDeleteList []interface{}
+	var err error
+	if len(mergeKey) > 0 {
+		nonDeleteList, _, err = extractToDeleteItems(typedPatchList)
+		if err != nil {
+			return err
+		}
+	} else {
+		nonDeleteList = typedPatchList
+	}
+
+	patchIndex, setOrderIndex := 0, 0
+	for patchIndex < len(nonDeleteList) && setOrderIndex < len(typedSetOrderList) {
+		if containsDirectiveMarker(nonDeleteList[patchIndex]) {
+			patchIndex++
+			continue
+		}
+		mergeKeyEqual, err := mergeKeyValueEqual(nonDeleteList[patchIndex], typedSetOrderList[setOrderIndex], mergeKey)
+		if err != nil {
+			return err
+		}
+		if mergeKeyEqual {
+			patchIndex++
+		}
+		setOrderIndex++
+	}
+	// If patchIndex is inbound but setOrderIndex if out of bound mean there are items mismatching between the patch list and setElementOrder list.
+	// the second check is a sanity check, and should always be true if the first is true.
+	if patchIndex < len(nonDeleteList) && setOrderIndex >= len(typedSetOrderList) {
+		return fmt.Errorf("The order in patch list:\n%v\n doesn't match %s list:\n%v\n", typedPatchList, setElementOrderDirectivePrefix, setOrderList)
+	}
+	return nil
+}
+
+// preprocessDeletionListForMerging preprocesses the deletion list.
+// it returns shouldContinue, isDeletionList, noPrefixKey
+func preprocessDeletionListForMerging(key string, original map[string]interface{},
+	patchVal interface{}, mergeDeletionList bool) (bool, bool, string, error) {
+	// If found a parallel list for deletion and we are going to merge the list,
+	// overwrite the key to the original key and set flag isDeleteList
+	foundParallelListPrefix := strings.HasPrefix(key, deleteFromPrimitiveListDirectivePrefix)
+	if foundParallelListPrefix {
+		if !mergeDeletionList {
+			original[key] = patchVal
+			return true, false, "", nil
+		}
+		originalKey, err := extractKey(key, deleteFromPrimitiveListDirectivePrefix)
+		return false, true, originalKey, err
+	}
+	return false, false, "", nil
+}
+
+// applyRetainKeysDirective looks for a retainKeys directive and applies to original
+// - if no directive exists do nothing
+// - if directive is found, clear keys in original missing from the directive list
+// - validate that all keys present in the patch are present in the retainKeys directive
+// note: original may be another patch request, e.g. applying the add+modified patch to the deletions patch. In this case it may have directives
+func applyRetainKeysDirective(original, patch map[string]interface{}, options MergeOptions) error {
+	retainKeysInPatch, foundInPatch := patch[retainKeysDirective]
+	if !foundInPatch {
+		return nil
+	}
+	// cleanup the directive
+	delete(patch, retainKeysDirective)
+
+	if !options.MergeParallelList {
+		// If original is actually a patch, make sure the retainKeys directives are the same in both patches if present in both.
+		// If not present in the original patch, copy from the modified patch.
+		retainKeysInOriginal, foundInOriginal := original[retainKeysDirective]
+		if foundInOriginal {
+			if !reflect.DeepEqual(retainKeysInOriginal, retainKeysInPatch) {
+				// This error actually should never happen.
+				return fmt.Errorf("%v and %v are not deep equal: this may happen when calculating the 3-way diff patch", retainKeysInOriginal, retainKeysInPatch)
+			}
+		} else {
+			original[retainKeysDirective] = retainKeysInPatch
+		}
+		return nil
+	}
+
+	retainKeysList, ok := retainKeysInPatch.([]interface{})
+	if !ok {
+		return mergepatch.ErrBadPatchFormatForRetainKeys
+	}
+
+	// validate patch to make sure all fields in the patch are present in the retainKeysList.
+	// The map is used only as a set, the value is never referenced
+	m := map[interface{}]struct{}{}
+	for _, v := range retainKeysList {
+		m[v] = struct{}{}
+	}
+	for k, v := range patch {
+		if v == nil || strings.HasPrefix(k, deleteFromPrimitiveListDirectivePrefix) ||
+			strings.HasPrefix(k, setElementOrderDirectivePrefix) {
+			continue
+		}
+		// If there is an item present in the patch but not in the retainKeys list,
+		// the patch is invalid.
+		if _, found := m[k]; !found {
+			return mergepatch.ErrBadPatchFormatForRetainKeys
+		}
+	}
+
+	// clear not present fields
+	for k := range original {
+		if _, found := m[k]; !found {
+			delete(original, k)
+		}
+	}
+	return nil
+}
+
+// mergePatchIntoOriginal processes $setElementOrder list.
+// When not merging the directive, it will make sure $setElementOrder list exist only in original.
+// When merging the directive, it will try to find the $setElementOrder list and
+// its corresponding patch list, validate it and merge it.
+// Then, sort them by the relative order in setElementOrder, patch list and live list.
+// The precedence is $setElementOrder > order in patch list > order in live list.
+// This function will delete the item after merging it to prevent process it again in the future.
+// Ref: https://git.k8s.io/design-proposals-archive/cli/preserve-order-in-strategic-merge-patch.md
+func mergePatchIntoOriginal(original, patch map[string]interface{}, schema LookupPatchMeta, mergeOptions MergeOptions) error {
+	for key, patchV := range patch {
+		// Do nothing if there is no ordering directive
+		if !strings.HasPrefix(key, setElementOrderDirectivePrefix) {
+			continue
+		}
+
+		setElementOrderInPatch := patchV
+		// Copies directive from the second patch (`patch`) to the first patch (`original`)
+		// and checks they are equal and delete the directive in the second patch
+		if !mergeOptions.MergeParallelList {
+			setElementOrderListInOriginal, ok := original[key]
+			if ok {
+				// check if the setElementOrder list in original and the one in patch matches
+				if !reflect.DeepEqual(setElementOrderListInOriginal, setElementOrderInPatch) {
+					return mergepatch.ErrBadPatchFormatForSetElementOrderList
+				}
+			} else {
+				// move the setElementOrder list from patch to original
+				original[key] = setElementOrderInPatch
+			}
+		}
+		delete(patch, key)
+
+		var (
+			ok                                          bool
+			originalFieldValue, patchFieldValue, merged []interface{}
+			patchStrategy                               string
+			patchMeta                                   PatchMeta
+			subschema                                   LookupPatchMeta
+		)
+		typedSetElementOrderList, ok := setElementOrderInPatch.([]interface{})
+		if !ok {
+			return mergepatch.ErrBadArgType(typedSetElementOrderList, setElementOrderInPatch)
+		}
+		// Trim the setElementOrderDirectivePrefix to get the key of the list field in original.
+		originalKey, err := extractKey(key, setElementOrderDirectivePrefix)
+		if err != nil {
+			return err
+		}
+		// try to find the list with `originalKey` in `original` and `modified` and merge them.
+		originalList, foundOriginal := original[originalKey]
+		patchList, foundPatch := patch[originalKey]
+		if foundOriginal {
+			originalFieldValue, ok = originalList.([]interface{})
+			if !ok {
+				return mergepatch.ErrBadArgType(originalFieldValue, originalList)
+			}
+		}
+		if foundPatch {
+			patchFieldValue, ok = patchList.([]interface{})
+			if !ok {
+				return mergepatch.ErrBadArgType(patchFieldValue, patchList)
+			}
+		}
+		subschema, patchMeta, err = schema.LookupPatchMetadataForSlice(originalKey)
+		if err != nil {
+			return err
+		}
+		_, patchStrategy, err = extractRetainKeysPatchStrategy(patchMeta.GetPatchStrategies())
+		if err != nil {
+			return err
+		}
+		// Check for consistency between the element order list and the field it applies to
+		err = validatePatchWithSetOrderList(patchFieldValue, typedSetElementOrderList, patchMeta.GetPatchMergeKey())
+		if err != nil {
+			return err
+		}
+
+		switch {
+		case foundOriginal && !foundPatch:
+			// no change to list contents
+			merged = originalFieldValue
+		case !foundOriginal && foundPatch:
+			// list was added
+			v, keep := removeDirectives(patchFieldValue)
+			if !keep {
+				// Shouldn't be possible since patchFieldValue is a slice
+				continue
+			}
+
+			merged = v.([]interface{})
+		case foundOriginal && foundPatch:
+			merged, err = mergeSliceHandler(originalList, patchList, subschema,
+				patchStrategy, patchMeta.GetPatchMergeKey(), false, mergeOptions)
+			if err != nil {
+				return err
+			}
+		case !foundOriginal && !foundPatch:
+			continue
+		}
+
+		// Split all items into patch items and server-only items and then enforce the order.
+		var patchItems, serverOnlyItems []interface{}
+		if len(patchMeta.GetPatchMergeKey()) == 0 {
+			// Primitives doesn't need merge key to do partitioning.
+			patchItems, serverOnlyItems = partitionPrimitivesByPresentInList(merged, typedSetElementOrderList)
+
+		} else {
+			// Maps need merge key to do partitioning.
+			patchItems, serverOnlyItems, err = partitionMapsByPresentInList(merged, typedSetElementOrderList, patchMeta.GetPatchMergeKey())
+			if err != nil {
+				return err
+			}
+		}
+
+		elementType, err := sliceElementType(originalFieldValue, patchFieldValue)
+		if err != nil {
+			return err
+		}
+		kind := elementType.Kind()
+		// normalize merged list
+		// typedSetElementOrderList contains all the relative order in typedPatchList,
+		// so don't need to use typedPatchList
+		both, err := normalizeElementOrder(patchItems, serverOnlyItems, typedSetElementOrderList, originalFieldValue, patchMeta.GetPatchMergeKey(), kind)
+		if err != nil {
+			return err
+		}
+		original[originalKey] = both
+		// delete patch list from patch to prevent process again in the future
+		delete(patch, originalKey)
+	}
+	return nil
+}
+
+// partitionPrimitivesByPresentInList partitions elements into 2 slices, the first containing items present in partitionBy, the other not.
+func partitionPrimitivesByPresentInList(original, partitionBy []interface{}) ([]interface{}, []interface{}) {
+	patch := make([]interface{}, 0, len(original))
+	serverOnly := make([]interface{}, 0, len(original))
+	inPatch := map[interface{}]bool{}
+	for _, v := range partitionBy {
+		inPatch[v] = true
+	}
+	for _, v := range original {
+		if !inPatch[v] {
+			serverOnly = append(serverOnly, v)
+		} else {
+			patch = append(patch, v)
+		}
+	}
+	return patch, serverOnly
+}
+
+// partitionMapsByPresentInList partitions elements into 2 slices, the first containing items present in partitionBy, the other not.
+func partitionMapsByPresentInList(original, partitionBy []interface{}, mergeKey string) ([]interface{}, []interface{}, error) {
+	patch := make([]interface{}, 0, len(original))
+	serverOnly := make([]interface{}, 0, len(original))
+	for _, v := range original {
+		typedV, ok := v.(map[string]interface{})
+		if !ok {
+			return nil, nil, mergepatch.ErrBadArgType(typedV, v)
+		}
+		mergeKeyValue, foundMergeKey := typedV[mergeKey]
+		if !foundMergeKey {
+			return nil, nil, mergepatch.ErrNoMergeKey(typedV, mergeKey)
+		}
+		_, _, found, err := findMapInSliceBasedOnKeyValue(partitionBy, mergeKey, mergeKeyValue)
+		if err != nil {
+			return nil, nil, err
+		}
+		if !found {
+			serverOnly = append(serverOnly, v)
+		} else {
+			patch = append(patch, v)
+		}
+	}
+	return patch, serverOnly, nil
+}
+
+// Removes directives from an object and returns value to use instead and whether
+// or not the field/index should even be kept
+// May modify input
+func removeDirectives(obj interface{}) (interface{}, bool) {
+	if obj == nil {
+		return obj, true
+	} else if typedV, ok := obj.(map[string]interface{}); ok {
+		if _, hasDirective := typedV[directiveMarker]; hasDirective {
+			return nil, false
+		}
+
+		for k, v := range typedV {
+			var keep bool
+			typedV[k], keep = removeDirectives(v)
+			if !keep {
+				delete(typedV, k)
+			}
+		}
+		return typedV, true
+	} else if typedV, ok := obj.([]interface{}); ok {
+		var res []interface{}
+		if typedV != nil {
+			// Make sure res is non-nil if patch is non-nil
+			res = []interface{}{}
+		}
+		for _, v := range typedV {
+			if newV, keep := removeDirectives(v); keep {
+				res = append(res, newV)
+			}
+		}
+		return res, true
+	} else {
+		return obj, true
+	}
+}
+
+// Merge fields from a patch map into the original map. Note: This may modify
+// both the original map and the patch because getting a deep copy of a map in
+// golang is highly non-trivial.
+// flag mergeOptions.MergeParallelList controls if using the parallel list to delete or keeping the list.
+// If patch contains any null field (e.g. field_1: null) that is not
+// present in original, then to propagate it to the end result use
+// mergeOptions.IgnoreUnmatchedNulls == false.
+func mergeMap(original, patch map[string]interface{}, schema LookupPatchMeta, mergeOptions MergeOptions) (map[string]interface{}, error) {
+	if v, ok := patch[directiveMarker]; ok {
+		return handleDirectiveInMergeMap(v, patch)
+	}
+
+	// nil is an accepted value for original to simplify logic in other places.
+	// If original is nil, replace it with an empty map and then apply the patch.
+	if original == nil {
+		original = map[string]interface{}{}
+	}
+
+	err := applyRetainKeysDirective(original, patch, mergeOptions)
+	if err != nil {
+		return nil, err
+	}
+
+	// Process $setElementOrder list and other lists sharing the same key.
+	// When not merging the directive, it will make sure $setElementOrder list exist only in original.
+	// When merging the directive, it will process $setElementOrder and its patch list together.
+	// This function will delete the merged elements from patch so they will not be reprocessed
+	err = mergePatchIntoOriginal(original, patch, schema, mergeOptions)
+	if err != nil {
+		return nil, err
+	}
+
+	// Start merging the patch into the original.
+	for k, patchV := range patch {
+		skipProcessing, isDeleteList, noPrefixKey, err := preprocessDeletionListForMerging(k, original, patchV, mergeOptions.MergeParallelList)
+		if err != nil {
+			return nil, err
+		}
+		if skipProcessing {
+			continue
+		}
+		if len(noPrefixKey) > 0 {
+			k = noPrefixKey
+		}
+
+		// If the value of this key is null, delete the key if it exists in the
+		// original. Otherwise, check if we want to preserve it or skip it.
+		// Preserving the null value is useful when we want to send an explicit
+		// delete to the API server.
+		// In some cases, this may lead to inconsistent behavior with create.
+		// ref: https://github.com/kubernetes/kubernetes/issues/123304
+		// To avoid breaking compatibility,
+		// we made corresponding changes on the client side to ensure that the create and patch behaviors are idempotent.
+		if patchV == nil {
+			delete(original, k)
+			if mergeOptions.IgnoreUnmatchedNulls {
+				continue
+			}
+		}
+
+		_, ok := original[k]
+		if !ok {
+			if !isDeleteList {
+				// If it's not in the original document, just take the patch value.
+				if mergeOptions.IgnoreUnmatchedNulls {
+					discardNullValuesFromPatch(patchV)
+				}
+				original[k], ok = removeDirectives(patchV)
+				if !ok {
+					delete(original, k)
+				}
+			}
+			continue
+		}
+
+		originalType := reflect.TypeOf(original[k])
+		patchType := reflect.TypeOf(patchV)
+		if originalType != patchType {
+			if !isDeleteList {
+				if mergeOptions.IgnoreUnmatchedNulls {
+					discardNullValuesFromPatch(patchV)
+				}
+				original[k], ok = removeDirectives(patchV)
+				if !ok {
+					delete(original, k)
+				}
+			}
+			continue
+		}
+		// If they're both maps or lists, recurse into the value.
+		switch originalType.Kind() {
+		case reflect.Map:
+			subschema, patchMeta, err2 := schema.LookupPatchMetadataForStruct(k)
+			if err2 != nil {
+				return nil, err2
+			}
+			_, patchStrategy, err2 := extractRetainKeysPatchStrategy(patchMeta.GetPatchStrategies())
+			if err2 != nil {
+				return nil, err2
+			}
+			original[k], err = mergeMapHandler(original[k], patchV, subschema, patchStrategy, mergeOptions)
+		case reflect.Slice:
+			subschema, patchMeta, err2 := schema.LookupPatchMetadataForSlice(k)
+			if err2 != nil {
+				return nil, err2
+			}
+			_, patchStrategy, err2 := extractRetainKeysPatchStrategy(patchMeta.GetPatchStrategies())
+			if err2 != nil {
+				return nil, err2
+			}
+			original[k], err = mergeSliceHandler(original[k], patchV, subschema, patchStrategy, patchMeta.GetPatchMergeKey(), isDeleteList, mergeOptions)
+		default:
+			original[k], ok = removeDirectives(patchV)
+			if !ok {
+				// if patchV itself is a directive, then don't keep it
+				delete(original, k)
+			}
+		}
+		if err != nil {
+			return nil, err
+		}
+	}
+	return original, nil
+}
+
+// discardNullValuesFromPatch discards all null property values from patch.
+// It traverses all slices and map types.
+func discardNullValuesFromPatch(patchV interface{}) {
+	switch patchV := patchV.(type) {
+	case map[string]interface{}:
+		for k, v := range patchV {
+			if v == nil {
+				delete(patchV, k)
+			} else {
+				discardNullValuesFromPatch(v)
+			}
+		}
+	case []interface{}:
+		for _, v := range patchV {
+			discardNullValuesFromPatch(v)
+		}
+	}
+}
+
+// mergeMapHandler handles how to merge `patchV` whose key is `key` with `original` respecting
+// fieldPatchStrategy and mergeOptions.
+func mergeMapHandler(original, patch interface{}, schema LookupPatchMeta,
+	fieldPatchStrategy string, mergeOptions MergeOptions) (map[string]interface{}, error) {
+	typedOriginal, typedPatch, err := mapTypeAssertion(original, patch)
+	if err != nil {
+		return nil, err
+	}
+
+	if fieldPatchStrategy != replaceDirective {
+		return mergeMap(typedOriginal, typedPatch, schema, mergeOptions)
+	} else {
+		return typedPatch, nil
+	}
+}
+
+// mergeSliceHandler handles how to merge `patchV` whose key is `key` with `original` respecting
+// fieldPatchStrategy, fieldPatchMergeKey, isDeleteList and mergeOptions.
+func mergeSliceHandler(original, patch interface{}, schema LookupPatchMeta,
+	fieldPatchStrategy, fieldPatchMergeKey string, isDeleteList bool, mergeOptions MergeOptions) ([]interface{}, error) {
+	typedOriginal, typedPatch, err := sliceTypeAssertion(original, patch)
+	if err != nil {
+		return nil, err
+	}
+
+	// Delete lists are handled the same way regardless of what the field's patch strategy is
+	if fieldPatchStrategy == mergeDirective || isDeleteList {
+		return mergeSlice(typedOriginal, typedPatch, schema, fieldPatchMergeKey, mergeOptions, isDeleteList)
+	} else {
+		return typedPatch, nil
+	}
+}
+
+// Merge two slices together. Note: This may modify both the original slice and
+// the patch because getting a deep copy of a slice in golang is highly
+// non-trivial.
+func mergeSlice(original, patch []interface{}, schema LookupPatchMeta, mergeKey string, mergeOptions MergeOptions, isDeleteList bool) ([]interface{}, error) {
+	if len(original) == 0 && len(patch) == 0 {
+		return original, nil
+	}
+
+	// All the values must be of the same type, but not a list.
+	t, err := sliceElementType(original, patch)
+	if err != nil {
+		return nil, err
+	}
+
+	var merged []interface{}
+	kind := t.Kind()
+	// If the elements are not maps, merge the slices of scalars.
+	if kind != reflect.Map {
+		if mergeOptions.MergeParallelList && isDeleteList {
+			return deleteFromSlice(original, patch), nil
+		}
+		// Maybe in the future add a "concat" mode that doesn't
+		// deduplicate.
+		both := append(original, patch...)
+		merged = deduplicateScalars(both)
+
+	} else {
+		if mergeKey == "" {
+			return nil, fmt.Errorf("cannot merge lists without merge key for %s", schema.Name())
+		}
+
+		original, patch, err = mergeSliceWithSpecialElements(original, patch, mergeKey)
+		if err != nil {
+			return nil, err
+		}
+
+		merged, err = mergeSliceWithoutSpecialElements(original, patch, mergeKey, schema, mergeOptions)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// enforce the order
+	var patchItems, serverOnlyItems []interface{}
+	if len(mergeKey) == 0 {
+		patchItems, serverOnlyItems = partitionPrimitivesByPresentInList(merged, patch)
+	} else {
+		patchItems, serverOnlyItems, err = partitionMapsByPresentInList(merged, patch, mergeKey)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return normalizeElementOrder(patchItems, serverOnlyItems, patch, original, mergeKey, kind)
+}
+
+// mergeSliceWithSpecialElements handles special elements with directiveMarker
+// before merging the slices. It returns a updated `original` and a patch without special elements.
+// original and patch must be slices of maps, they should be checked before calling this function.
+func mergeSliceWithSpecialElements(original, patch []interface{}, mergeKey string) ([]interface{}, []interface{}, error) {
+	patchWithoutSpecialElements := []interface{}{}
+	replace := false
+	for _, v := range patch {
+		typedV := v.(map[string]interface{})
+		patchType, ok := typedV[directiveMarker]
+		if !ok {
+			patchWithoutSpecialElements = append(patchWithoutSpecialElements, v)
+		} else {
+			switch patchType {
+			case deleteDirective:
+				mergeValue, ok := typedV[mergeKey]
+				if ok {
+					var err error
+					original, err = deleteMatchingEntries(original, mergeKey, mergeValue)
+					if err != nil {
+						return nil, nil, err
+					}
+				} else {
+					return nil, nil, mergepatch.ErrNoMergeKey(typedV, mergeKey)
+				}
+			case replaceDirective:
+				replace = true
+				// Continue iterating through the array to prune any other $patch elements.
+			case mergeDirective:
+				return nil, nil, fmt.Errorf("merging lists cannot yet be specified in the patch")
+			default:
+				return nil, nil, mergepatch.ErrBadPatchType(patchType, typedV)
+			}
+		}
+	}
+	if replace {
+		return patchWithoutSpecialElements, nil, nil
+	}
+	return original, patchWithoutSpecialElements, nil
+}
+
+// delete all matching entries (based on merge key) from a merging list
+func deleteMatchingEntries(original []interface{}, mergeKey string, mergeValue interface{}) ([]interface{}, error) {
+	for {
+		_, originalKey, found, err := findMapInSliceBasedOnKeyValue(original, mergeKey, mergeValue)
+		if err != nil {
+			return nil, err
+		}
+
+		if !found {
+			break
+		}
+		// Delete the element at originalKey.
+		original = append(original[:originalKey], original[originalKey+1:]...)
+	}
+	return original, nil
+}
+
+// mergeSliceWithoutSpecialElements merges slices with non-special elements.
+// original and patch must be slices of maps, they should be checked before calling this function.
+func mergeSliceWithoutSpecialElements(original, patch []interface{}, mergeKey string, schema LookupPatchMeta, mergeOptions MergeOptions) ([]interface{}, error) {
+	for _, v := range patch {
+		typedV := v.(map[string]interface{})
+		mergeValue, ok := typedV[mergeKey]
+		if !ok {
+			return nil, mergepatch.ErrNoMergeKey(typedV, mergeKey)
+		}
+
+		// If we find a value with this merge key value in original, merge the
+		// maps. Otherwise append onto original.
+		originalMap, originalKey, found, err := findMapInSliceBasedOnKeyValue(original, mergeKey, mergeValue)
+		if err != nil {
+			return nil, err
+		}
+
+		if found {
+			var mergedMaps interface{}
+			var err error
+			// Merge into original.
+			mergedMaps, err = mergeMap(originalMap, typedV, schema, mergeOptions)
+			if err != nil {
+				return nil, err
+			}
+
+			original[originalKey] = mergedMaps
+		} else {
+			original = append(original, v)
+		}
+	}
+	return original, nil
+}
+
+// deleteFromSlice uses the parallel list to delete the items in a list of scalars
+func deleteFromSlice(current, toDelete []interface{}) []interface{} {
+	toDeleteMap := map[interface{}]interface{}{}
+	processed := make([]interface{}, 0, len(current))
+	for _, v := range toDelete {
+		toDeleteMap[v] = true
+	}
+	for _, v := range current {
+		if _, found := toDeleteMap[v]; !found {
+			processed = append(processed, v)
+		}
+	}
+	return processed
+}
+
+// This method no longer panics if any element of the slice is not a map.
+func findMapInSliceBasedOnKeyValue(m []interface{}, key string, value interface{}) (map[string]interface{}, int, bool, error) {
+	for k, v := range m {
+		typedV, ok := v.(map[string]interface{})
+		if !ok {
+			return nil, 0, false, fmt.Errorf("value for key %v is not a map", k)
+		}
+
+		valueToMatch, ok := typedV[key]
+		if ok && valueToMatch == value {
+			return typedV, k, true, nil
+		}
+	}
+
+	return nil, 0, false, nil
+}
+
+// This function takes a JSON map and sorts all the lists that should be merged
+// by key. This is needed by tests because in JSON, list order is significant,
+// but in Strategic Merge Patch, merge lists do not have significant order.
+// Sorting the lists allows for order-insensitive comparison of patched maps.
+func sortMergeListsByName(mapJSON []byte, schema LookupPatchMeta) ([]byte, error) {
+	var m map[string]interface{}
+	err := json.Unmarshal(mapJSON, &m)
+	if err != nil {
+		return nil, mergepatch.ErrBadJSONDoc
+	}
+
+	newM, err := sortMergeListsByNameMap(m, schema)
+	if err != nil {
+		return nil, err
+	}
+
+	return json.Marshal(newM)
+}
+
+// Function sortMergeListsByNameMap recursively sorts the merge lists by its mergeKey in a map.
+func sortMergeListsByNameMap(s map[string]interface{}, schema LookupPatchMeta) (map[string]interface{}, error) {
+	newS := map[string]interface{}{}
+	for k, v := range s {
+		if k == retainKeysDirective {
+			typedV, ok := v.([]interface{})
+			if !ok {
+				return nil, mergepatch.ErrBadPatchFormatForRetainKeys
+			}
+			v = sortScalars(typedV)
+		} else if strings.HasPrefix(k, deleteFromPrimitiveListDirectivePrefix) {
+			typedV, ok := v.([]interface{})
+			if !ok {
+				return nil, mergepatch.ErrBadPatchFormatForPrimitiveList
+			}
+			v = sortScalars(typedV)
+		} else if strings.HasPrefix(k, setElementOrderDirectivePrefix) {
+			_, ok := v.([]interface{})
+			if !ok {
+				return nil, mergepatch.ErrBadPatchFormatForSetElementOrderList
+			}
+		} else if k != directiveMarker {
+			// recurse for map and slice.
+			switch typedV := v.(type) {
+			case map[string]interface{}:
+				subschema, _, err := schema.LookupPatchMetadataForStruct(k)
+				if err != nil {
+					return nil, err
+				}
+				v, err = sortMergeListsByNameMap(typedV, subschema)
+				if err != nil {
+					return nil, err
+				}
+			case []interface{}:
+				subschema, patchMeta, err := schema.LookupPatchMetadataForSlice(k)
+				if err != nil {
+					return nil, err
+				}
+				_, patchStrategy, err := extractRetainKeysPatchStrategy(patchMeta.GetPatchStrategies())
+				if err != nil {
+					return nil, err
+				}
+				if patchStrategy == mergeDirective {
+					var err error
+					v, err = sortMergeListsByNameArray(typedV, subschema, patchMeta.GetPatchMergeKey(), true)
+					if err != nil {
+						return nil, err
+					}
+				}
+			}
+		}
+
+		newS[k] = v
+	}
+
+	return newS, nil
+}
+
+// Function sortMergeListsByNameMap recursively sorts the merge lists by its mergeKey in an array.
+func sortMergeListsByNameArray(s []interface{}, schema LookupPatchMeta, mergeKey string, recurse bool) ([]interface{}, error) {
+	if len(s) == 0 {
+		return s, nil
+	}
+
+	// We don't support lists of lists yet.
+	t, err := sliceElementType(s)
+	if err != nil {
+		return nil, err
+	}
+
+	// If the elements are not maps...
+	if t.Kind() != reflect.Map {
+		// Sort the elements, because they may have been merged out of order.
+		return deduplicateAndSortScalars(s), nil
+	}
+
+	// Elements are maps - if one of the keys of the map is a map or a
+	// list, we may need to recurse into it.
+	newS := []interface{}{}
+	for _, elem := range s {
+		if recurse {
+			typedElem := elem.(map[string]interface{})
+			newElem, err := sortMergeListsByNameMap(typedElem, schema)
+			if err != nil {
+				return nil, err
+			}
+
+			newS = append(newS, newElem)
+		} else {
+			newS = append(newS, elem)
+		}
+	}
+
+	// Sort the maps.
+	newS = sortMapsBasedOnField(newS, mergeKey)
+	return newS, nil
+}
+
+func sortMapsBasedOnField(m []interface{}, fieldName string) []interface{} {
+	mapM := mapSliceFromSlice(m)
+	ss := SortableSliceOfMaps{mapM, fieldName}
+	sort.Sort(ss)
+	newS := sliceFromMapSlice(ss.s)
+	return newS
+}
+
+func mapSliceFromSlice(m []interface{}) []map[string]interface{} {
+	newM := []map[string]interface{}{}
+	for _, v := range m {
+		vt := v.(map[string]interface{})
+		newM = append(newM, vt)
+	}
+
+	return newM
+}
+
+func sliceFromMapSlice(s []map[string]interface{}) []interface{} {
+	newS := []interface{}{}
+	for _, v := range s {
+		newS = append(newS, v)
+	}
+
+	return newS
+}
+
+type SortableSliceOfMaps struct {
+	s []map[string]interface{}
+	k string // key to sort on
+}
+
+func (ss SortableSliceOfMaps) Len() int {
+	return len(ss.s)
+}
+
+func (ss SortableSliceOfMaps) Less(i, j int) bool {
+	iStr := fmt.Sprintf("%v", ss.s[i][ss.k])
+	jStr := fmt.Sprintf("%v", ss.s[j][ss.k])
+	return sort.StringsAreSorted([]string{iStr, jStr})
+}
+
+func (ss SortableSliceOfMaps) Swap(i, j int) {
+	ss.s[i], ss.s[j] = ss.s[j], ss.s[i]
+}
+
+func deduplicateAndSortScalars(s []interface{}) []interface{} {
+	s = deduplicateScalars(s)
+	return sortScalars(s)
+}
+
+func sortScalars(s []interface{}) []interface{} {
+	ss := SortableSliceOfScalars{s}
+	sort.Sort(ss)
+	return ss.s
+}
+
+func deduplicateScalars(s []interface{}) []interface{} {
+	// Clever algorithm to deduplicate.
+	length := len(s) - 1
+	for i := 0; i < length; i++ {
+		for j := i + 1; j <= length; j++ {
+			if s[i] == s[j] {
+				s[j] = s[length]
+				s = s[0:length]
+				length--
+				j--
+			}
+		}
+	}
+
+	return s
+}
+
+type SortableSliceOfScalars struct {
+	s []interface{}
+}
+
+func (ss SortableSliceOfScalars) Len() int {
+	return len(ss.s)
+}
+
+func (ss SortableSliceOfScalars) Less(i, j int) bool {
+	iStr := fmt.Sprintf("%v", ss.s[i])
+	jStr := fmt.Sprintf("%v", ss.s[j])
+	return sort.StringsAreSorted([]string{iStr, jStr})
+}
+
+func (ss SortableSliceOfScalars) Swap(i, j int) {
+	ss.s[i], ss.s[j] = ss.s[j], ss.s[i]
+}
+
+// Returns the type of the elements of N slice(s). If the type is different,
+// another slice or undefined, returns an error.
+func sliceElementType(slices ...[]interface{}) (reflect.Type, error) {
+	var prevType reflect.Type
+	for _, s := range slices {
+		// Go through elements of all given slices and make sure they are all the same type.
+		for _, v := range s {
+			currentType := reflect.TypeOf(v)
+			if prevType == nil {
+				prevType = currentType
+				// We don't support lists of lists yet.
+				if prevType.Kind() == reflect.Slice {
+					return nil, mergepatch.ErrNoListOfLists
+				}
+			} else {
+				if prevType != currentType {
+					return nil, fmt.Errorf("list element types are not identical: %v", fmt.Sprint(slices))
+				}
+				prevType = currentType
+			}
+		}
+	}
+
+	if prevType == nil {
+		return nil, fmt.Errorf("no elements in any of the given slices")
+	}
+
+	return prevType, nil
+}
+
+// MergingMapsHaveConflicts returns true if the left and right JSON interface
+// objects overlap with different values in any key. All keys are required to be
+// strings. Since patches of the same Type have congruent keys, this is valid
+// for multiple patch types. This method supports strategic merge patch semantics.
+func MergingMapsHaveConflicts(left, right map[string]interface{}, schema LookupPatchMeta) (bool, error) {
+	return mergingMapFieldsHaveConflicts(left, right, schema, "", "")
+}
+
+func mergingMapFieldsHaveConflicts(
+	left, right interface{},
+	schema LookupPatchMeta,
+	fieldPatchStrategy, fieldPatchMergeKey string,
+) (bool, error) {
+	switch leftType := left.(type) {
+	case map[string]interface{}:
+		rightType, ok := right.(map[string]interface{})
+		if !ok {
+			return true, nil
+		}
+		leftMarker, okLeft := leftType[directiveMarker]
+		rightMarker, okRight := rightType[directiveMarker]
+		// if one or the other has a directive marker,
+		// then we need to consider that before looking at the individual keys,
+		// since a directive operates on the whole map.
+		if okLeft || okRight {
+			// if one has a directive marker and the other doesn't,
+			// then we have a conflict, since one is deleting or replacing the whole map,
+			// and the other is doing things to individual keys.
+			if okLeft != okRight {
+				return true, nil
+			}
+			// if they both have markers, but they are not the same directive,
+			// then we have a conflict because they're doing different things to the map.
+			if leftMarker != rightMarker {
+				return true, nil
+			}
+		}
+		if fieldPatchStrategy == replaceDirective {
+			return false, nil
+		}
+		// Check the individual keys.
+		return mapsHaveConflicts(leftType, rightType, schema)
+
+	case []interface{}:
+		rightType, ok := right.([]interface{})
+		if !ok {
+			return true, nil
+		}
+		return slicesHaveConflicts(leftType, rightType, schema, fieldPatchStrategy, fieldPatchMergeKey)
+	case string, float64, bool, int64, nil:
+		return !reflect.DeepEqual(left, right), nil
+	default:
+		return true, fmt.Errorf("unknown type: %v", reflect.TypeOf(left))
+	}
+}
+
+func mapsHaveConflicts(typedLeft, typedRight map[string]interface{}, schema LookupPatchMeta) (bool, error) {
+	for key, leftValue := range typedLeft {
+		if key != directiveMarker && key != retainKeysDirective {
+			if rightValue, ok := typedRight[key]; ok {
+				var subschema LookupPatchMeta
+				var patchMeta PatchMeta
+				var patchStrategy string
+				var err error
+				switch leftValue.(type) {
+				case []interface{}:
+					subschema, patchMeta, err = schema.LookupPatchMetadataForSlice(key)
+					if err != nil {
+						return true, err
+					}
+					_, patchStrategy, err = extractRetainKeysPatchStrategy(patchMeta.patchStrategies)
+					if err != nil {
+						return true, err
+					}
+				case map[string]interface{}:
+					subschema, patchMeta, err = schema.LookupPatchMetadataForStruct(key)
+					if err != nil {
+						return true, err
+					}
+					_, patchStrategy, err = extractRetainKeysPatchStrategy(patchMeta.patchStrategies)
+					if err != nil {
+						return true, err
+					}
+				}
+
+				if hasConflicts, err := mergingMapFieldsHaveConflicts(leftValue, rightValue,
+					subschema, patchStrategy, patchMeta.GetPatchMergeKey()); hasConflicts {
+					return true, err
+				}
+			}
+		}
+	}
+
+	return false, nil
+}
+
+func slicesHaveConflicts(
+	typedLeft, typedRight []interface{},
+	schema LookupPatchMeta,
+	fieldPatchStrategy, fieldPatchMergeKey string,
+) (bool, error) {
+	elementType, err := sliceElementType(typedLeft, typedRight)
+	if err != nil {
+		return true, err
+	}
+
+	if fieldPatchStrategy == mergeDirective {
+		// Merging lists of scalars have no conflicts by definition
+		// So we only need to check further if the elements are maps
+		if elementType.Kind() != reflect.Map {
+			return false, nil
+		}
+
+		// Build a map for each slice and then compare the two maps
+		leftMap, err := sliceOfMapsToMapOfMaps(typedLeft, fieldPatchMergeKey)
+		if err != nil {
+			return true, err
+		}
+
+		rightMap, err := sliceOfMapsToMapOfMaps(typedRight, fieldPatchMergeKey)
+		if err != nil {
+			return true, err
+		}
+
+		return mapsOfMapsHaveConflicts(leftMap, rightMap, schema)
+	}
+
+	// Either we don't have type information, or these are non-merging lists
+	if len(typedLeft) != len(typedRight) {
+		return true, nil
+	}
+
+	// Sort scalar slices to prevent ordering issues
+	// We have no way to sort non-merging lists of maps
+	if elementType.Kind() != reflect.Map {
+		typedLeft = deduplicateAndSortScalars(typedLeft)
+		typedRight = deduplicateAndSortScalars(typedRight)
+	}
+
+	// Compare the slices element by element in order
+	// This test will fail if the slices are not sorted
+	for i := range typedLeft {
+		if hasConflicts, err := mergingMapFieldsHaveConflicts(typedLeft[i], typedRight[i], schema, "", ""); hasConflicts {
+			return true, err
+		}
+	}
+
+	return false, nil
+}
+
+func sliceOfMapsToMapOfMaps(slice []interface{}, mergeKey string) (map[string]interface{}, error) {
+	result := make(map[string]interface{}, len(slice))
+	for _, value := range slice {
+		typedValue, ok := value.(map[string]interface{})
+		if !ok {
+			return nil, fmt.Errorf("invalid element type in merging list:%v", slice)
+		}
+
+		mergeValue, ok := typedValue[mergeKey]
+		if !ok {
+			return nil, fmt.Errorf("cannot find merge key `%s` in merging list element:%v", mergeKey, typedValue)
+		}
+
+		result[fmt.Sprintf("%s", mergeValue)] = typedValue
+	}
+
+	return result, nil
+}
+
+func mapsOfMapsHaveConflicts(typedLeft, typedRight map[string]interface{}, schema LookupPatchMeta) (bool, error) {
+	for key, leftValue := range typedLeft {
+		if rightValue, ok := typedRight[key]; ok {
+			if hasConflicts, err := mergingMapFieldsHaveConflicts(leftValue, rightValue, schema, "", ""); hasConflicts {
+				return true, err
+			}
+		}
+	}
+
+	return false, nil
+}
+
+// CreateThreeWayMergePatch reconciles a modified configuration with an original configuration,
+// while preserving any changes or deletions made to the original configuration in the interim,
+// and not overridden by the current configuration. All three documents must be passed to the
+// method as json encoded content. It will return a strategic merge patch, or an error if any
+// of the documents is invalid, or if there are any preconditions that fail against the modified
+// configuration, or, if overwrite is false and there are conflicts between the modified and current
+// configurations. Conflicts are defined as keys changed differently from original to modified
+// than from original to current. In other words, a conflict occurs if modified changes any key
+// in a way that is different from how it is changed in current (e.g., deleting it, changing its
+// value). We also propagate values fields that do not exist in original but are explicitly
+// defined in modified.
+func CreateThreeWayMergePatch(original, modified, current []byte, schema LookupPatchMeta, overwrite bool, fns ...mergepatch.PreconditionFunc) ([]byte, error) {
+	originalMap := map[string]interface{}{}
+	if len(original) > 0 {
+		if err := json.Unmarshal(original, &originalMap); err != nil {
+			return nil, mergepatch.ErrBadJSONDoc
+		}
+	}
+
+	modifiedMap := map[string]interface{}{}
+	if len(modified) > 0 {
+		if err := json.Unmarshal(modified, &modifiedMap); err != nil {
+			return nil, mergepatch.ErrBadJSONDoc
+		}
+	}
+
+	currentMap := map[string]interface{}{}
+	if len(current) > 0 {
+		if err := json.Unmarshal(current, &currentMap); err != nil {
+			return nil, mergepatch.ErrBadJSONDoc
+		}
+	}
+
+	// The patch is the difference from current to modified without deletions, plus deletions
+	// from original to modified. To find it, we compute deletions, which are the deletions from
+	// original to modified, and delta, which is the difference from current to modified without
+	// deletions, and then apply delta to deletions as a patch, which should be strictly additive.
+	deltaMapDiffOptions := DiffOptions{
+		IgnoreDeletions: true,
+		SetElementOrder: true,
+	}
+	deltaMap, err := diffMaps(currentMap, modifiedMap, schema, deltaMapDiffOptions)
+	if err != nil {
+		return nil, err
+	}
+	deletionsMapDiffOptions := DiffOptions{
+		SetElementOrder:           true,
+		IgnoreChangesAndAdditions: true,
+	}
+	deletionsMap, err := diffMaps(originalMap, modifiedMap, schema, deletionsMapDiffOptions)
+	if err != nil {
+		return nil, err
+	}
+
+	mergeOptions := MergeOptions{}
+	patchMap, err := mergeMap(deletionsMap, deltaMap, schema, mergeOptions)
+	if err != nil {
+		return nil, err
+	}
+
+	// Apply the preconditions to the patch, and return an error if any of them fail.
+	for _, fn := range fns {
+		if !fn(patchMap) {
+			return nil, mergepatch.NewErrPreconditionFailed(patchMap)
+		}
+	}
+
+	// If overwrite is false, and the patch contains any keys that were changed differently,
+	// then return a conflict error.
+	if !overwrite {
+		changeMapDiffOptions := DiffOptions{}
+		changedMap, err := diffMaps(originalMap, currentMap, schema, changeMapDiffOptions)
+		if err != nil {
+			return nil, err
+		}
+
+		hasConflicts, err := MergingMapsHaveConflicts(patchMap, changedMap, schema)
+		if err != nil {
+			return nil, err
+		}
+
+		if hasConflicts {
+			return nil, mergepatch.NewErrConflict(mergepatch.ToYAMLOrError(patchMap), mergepatch.ToYAMLOrError(changedMap))
+		}
+	}
+
+	return json.Marshal(patchMap)
+}
+
+func ItemAddedToModifiedSlice(original, modified string) bool { return original > modified }
+
+func ItemRemovedFromModifiedSlice(original, modified string) bool { return original < modified }
+
+func ItemMatchesOriginalAndModifiedSlice(original, modified string) bool { return original == modified }
+
+func CreateDeleteDirective(mergeKey string, mergeKeyValue interface{}) map[string]interface{} {
+	return map[string]interface{}{mergeKey: mergeKeyValue, directiveMarker: deleteDirective}
+}
+
+func mapTypeAssertion(original, patch interface{}) (map[string]interface{}, map[string]interface{}, error) {
+	typedOriginal, ok := original.(map[string]interface{})
+	if !ok {
+		return nil, nil, mergepatch.ErrBadArgType(typedOriginal, original)
+	}
+	typedPatch, ok := patch.(map[string]interface{})
+	if !ok {
+		return nil, nil, mergepatch.ErrBadArgType(typedPatch, patch)
+	}
+	return typedOriginal, typedPatch, nil
+}
+
+func sliceTypeAssertion(original, patch interface{}) ([]interface{}, []interface{}, error) {
+	typedOriginal, ok := original.([]interface{})
+	if !ok {
+		return nil, nil, mergepatch.ErrBadArgType(typedOriginal, original)
+	}
+	typedPatch, ok := patch.([]interface{})
+	if !ok {
+		return nil, nil, mergepatch.ErrBadArgType(typedPatch, patch)
+	}
+	return typedOriginal, typedPatch, nil
+}
+
+// extractRetainKeysPatchStrategy process patch strategy, which is a string may contains multiple
+// patch strategies separated by ",". It returns a boolean var indicating if it has
+// retainKeys strategies and a string for the other strategy.
+func extractRetainKeysPatchStrategy(strategies []string) (bool, string, error) {
+	switch len(strategies) {
+	case 0:
+		return false, "", nil
+	case 1:
+		singleStrategy := strategies[0]
+		switch singleStrategy {
+		case retainKeysStrategy:
+			return true, "", nil
+		default:
+			return false, singleStrategy, nil
+		}
+	case 2:
+		switch {
+		case strategies[0] == retainKeysStrategy:
+			return true, strategies[1], nil
+		case strategies[1] == retainKeysStrategy:
+			return true, strategies[0], nil
+		default:
+			return false, "", fmt.Errorf("unexpected patch strategy: %v", strategies)
+		}
+	default:
+		return false, "", fmt.Errorf("unexpected patch strategy: %v", strategies)
+	}
+}
+
+// hasAdditionalNewField returns if original map has additional key with non-nil value than modified.
+func hasAdditionalNewField(original, modified map[string]interface{}) bool {
+	for k, v := range original {
+		if v == nil {
+			continue
+		}
+		if _, found := modified[k]; !found {
+			return true
+		}
+	}
+	return false
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/patch_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/patch_test.go
new file mode 100644
index 0000000000..fe88937c57
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/patch_test.go
@@ -0,0 +1,7061 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package strategicpatch
+
+import (
+	"fmt"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"sigs.k8s.io/yaml"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/json"
+	"k8s.io/apimachinery/pkg/util/mergepatch"
+	"k8s.io/apimachinery/pkg/util/sets"
+	sptest "k8s.io/apimachinery/pkg/util/strategicpatch/testing"
+	"k8s.io/utils/dump"
+)
+
+var (
+	fakeMergeItemSchema     = sptest.Fake{Path: filepath.Join("testdata", "swagger-merge-item.json")}
+	fakePrecisionItemSchema = sptest.Fake{Path: filepath.Join("testdata", "swagger-precision-item.json")}
+
+	fakeMergeItemV3Schema     = sptest.OpenAPIV3Getter{Path: filepath.Join("testdata", "swagger-merge-item-v3.json")}
+	fakePrecisionItemV3Schema = sptest.OpenAPIV3Getter{Path: filepath.Join("testdata", "swagger-precision-item-v3.json")}
+)
+
+type SortMergeListTestCases struct {
+	TestCases []SortMergeListTestCase
+}
+
+type SortMergeListTestCase struct {
+	Description string
+	Original    map[string]interface{}
+	Sorted      map[string]interface{}
+}
+
+type StrategicMergePatchTestCases struct {
+	TestCases []StrategicMergePatchTestCase
+}
+
+type StrategicMergePatchTestCase struct {
+	Description string
+	StrategicMergePatchTestCaseData
+}
+
+type StrategicMergePatchRawTestCase struct {
+	Description string
+	StrategicMergePatchRawTestCaseData
+}
+
+type StrategicMergePatchTestCaseData struct {
+	// Original is the original object (last-applied config in annotation)
+	Original map[string]interface{}
+	// Modified is the modified object (new config we want)
+	Modified map[string]interface{}
+	// Current is the current object (live config in the server)
+	Current map[string]interface{}
+	// TwoWay is the expected two-way merge patch diff between original and modified
+	TwoWay map[string]interface{}
+	// ThreeWay is the expected three-way merge patch
+	ThreeWay map[string]interface{}
+	// Result is the expected object after applying the three-way patch on current object.
+	Result map[string]interface{}
+	// TwoWayResult is the expected object after applying the two-way patch on current object.
+	// If nil, Modified is used.
+	TwoWayResult map[string]interface{}
+}
+
+// The meaning of each field is the same as StrategicMergePatchTestCaseData's.
+// The difference is that all the fields in StrategicMergePatchRawTestCaseData are json-encoded data.
+type StrategicMergePatchRawTestCaseData struct {
+	Original      []byte
+	Modified      []byte
+	Current       []byte
+	TwoWay        []byte
+	ThreeWay      []byte
+	Result        []byte
+	TwoWayResult  []byte
+	ExpectedError string
+}
+
+type MergeItem struct {
+	Name                  string               `json:"name,omitempty"`
+	Value                 string               `json:"value,omitempty"`
+	Other                 string               `json:"other,omitempty"`
+	MergingList           []MergeItem          `json:"mergingList,omitempty" patchStrategy:"merge" patchMergeKey:"name"`
+	NonMergingList        []MergeItem          `json:"nonMergingList,omitempty"`
+	MergingIntList        []int                `json:"mergingIntList,omitempty" patchStrategy:"merge"`
+	NonMergingIntList     []int                `json:"nonMergingIntList,omitempty"`
+	MergeItemPtr          *MergeItem           `json:"mergeItemPtr,omitempty" patchStrategy:"merge" patchMergeKey:"name"`
+	SimpleMap             map[string]string    `json:"simpleMap,omitempty"`
+	ReplacingItem         runtime.RawExtension `json:"replacingItem,omitempty" patchStrategy:"replace"`
+	JSONItem              struct{ Raw []byte } `json:"jsonItem,omitempty"`
+	RetainKeysMap         RetainKeysMergeItem  `json:"retainKeysMap,omitempty" patchStrategy:"retainKeys"`
+	RetainKeysMergingList []MergeItem          `json:"retainKeysMergingList,omitempty" patchStrategy:"merge,retainKeys" patchMergeKey:"name"`
+}
+
+type RetainKeysMergeItem struct {
+	Name           string            `json:"name,omitempty"`
+	Value          string            `json:"value,omitempty"`
+	Other          string            `json:"other,omitempty"`
+	SimpleMap      map[string]string `json:"simpleMap,omitempty"`
+	MergingIntList []int             `json:"mergingIntList,omitempty" patchStrategy:"merge"`
+	MergingList    []MergeItem       `json:"mergingList,omitempty" patchStrategy:"merge" patchMergeKey:"name"`
+	NonMergingList []MergeItem       `json:"nonMergingList,omitempty"`
+}
+
+var (
+	mergeItem             MergeItem
+	mergeItemStructSchema = PatchMetaFromStruct{T: GetTagStructTypeOrDie(mergeItem)}
+)
+
+// These are test cases for SortMergeList, used to assert that it (recursively)
+// sorts both merging and non merging lists correctly.
+var sortMergeListTestCaseData = []byte(`
+testCases:
+  - description: sort one list of maps
+    original:
+      mergingList:
+        - name: 1
+        - name: 3
+        - name: 2
+    sorted:
+      mergingList:
+        - name: 1
+        - name: 2
+        - name: 3
+  - description: sort lists of maps but not nested lists of maps
+    original:
+      mergingList:
+        - name: 2
+          nonMergingList:
+            - name: 1
+            - name: 3
+            - name: 2
+        - name: 1
+          nonMergingList:
+            - name: 2
+            - name: 1
+    sorted:
+      mergingList:
+        - name: 1
+          nonMergingList:
+            - name: 2
+            - name: 1
+        - name: 2
+          nonMergingList:
+            - name: 1
+            - name: 3
+            - name: 2
+  - description: sort lists of maps and nested lists of maps
+    original:
+      mergingList:
+        - name: 2
+          mergingList:
+            - name: 1
+            - name: 3
+            - name: 2
+        - name: 1
+          mergingList:
+            - name: 2
+            - name: 1
+    sorted:
+      mergingList:
+        - name: 1
+          mergingList:
+            - name: 1
+            - name: 2
+        - name: 2
+          mergingList:
+            - name: 1
+            - name: 2
+            - name: 3
+  - description: merging list should NOT sort when nested in non merging list
+    original:
+      nonMergingList:
+        - name: 2
+          mergingList:
+            - name: 1
+            - name: 3
+            - name: 2
+        - name: 1
+          mergingList:
+            - name: 2
+            - name: 1
+    sorted:
+      nonMergingList:
+        - name: 2
+          mergingList:
+            - name: 1
+            - name: 3
+            - name: 2
+        - name: 1
+          mergingList:
+            - name: 2
+            - name: 1
+  - description: sort very nested list of maps
+    fieldTypes:
+    original:
+      mergingList:
+        - mergingList:
+            - mergingList:
+                - name: 2
+                - name: 1
+    sorted:
+      mergingList:
+        - mergingList:
+            - mergingList:
+                - name: 1
+                - name: 2
+  - description: sort nested lists of ints
+    original:
+      mergingList:
+        - name: 2
+          mergingIntList:
+            - 1
+            - 3
+            - 2
+        - name: 1
+          mergingIntList:
+            - 2
+            - 1
+    sorted:
+      mergingList:
+        - name: 1
+          mergingIntList:
+            - 1
+            - 2
+        - name: 2
+          mergingIntList:
+            - 1
+            - 2
+            - 3
+  - description: sort nested pointers of ints
+    original:
+      mergeItemPtr:
+        - name: 2
+          mergingIntList:
+            - 1
+            - 3
+            - 2
+        - name: 1
+          mergingIntList:
+            - 2
+            - 1
+    sorted:
+      mergeItemPtr:
+        - name: 1
+          mergingIntList:
+            - 1
+            - 2
+        - name: 2
+          mergingIntList:
+            - 1
+            - 2
+            - 3
+  - description: sort merging list by pointer
+    original:
+      mergeItemPtr:
+        - name: 1
+        - name: 3
+        - name: 2
+    sorted:
+      mergeItemPtr:
+        - name: 1
+        - name: 2
+        - name: 3
+`)
+
+func TestSortMergeLists(t *testing.T) {
+	mergeItemOpenapiSchema := PatchMetaFromOpenAPI{
+		Schema: sptest.GetSchemaOrDie(&fakeMergeItemSchema, "mergeItem"),
+	}
+	mergeItemOpenapiV3Schema := PatchMetaFromOpenAPIV3{
+		SchemaList: fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas,
+		Schema:     fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas["mergeItem"],
+	}
+	schemas := []LookupPatchMeta{
+		mergeItemStructSchema,
+		mergeItemOpenapiSchema,
+		mergeItemOpenapiV3Schema,
+	}
+
+	tc := SortMergeListTestCases{}
+	err := yaml.Unmarshal(sortMergeListTestCaseData, &tc)
+	if err != nil {
+		t.Errorf("can't unmarshal test cases: %s\n", err)
+		return
+	}
+
+	for _, schema := range schemas {
+		for _, c := range tc.TestCases {
+			temp := testObjectToJSONOrFail(t, c.Original)
+			got := sortJsonOrFail(t, temp, c.Description, schema)
+			expected := testObjectToJSONOrFail(t, c.Sorted)
+			if !reflect.DeepEqual(got, expected) {
+				t.Errorf("using %s error in test case: %s\ncannot sort object:\n%s\nexpected:\n%s\ngot:\n%s\n",
+					getSchemaType(schema), c.Description, mergepatch.ToYAMLOrError(c.Original), mergepatch.ToYAMLOrError(c.Sorted), jsonToYAMLOrError(got))
+			}
+		}
+	}
+}
+
+// These are test cases for StrategicMergePatch that cannot be generated using
+// CreateTwoWayMergePatch because it may be one of the following cases:
+// - not use the replace directive.
+// - generate duplicate integers for a merging list patch.
+// - generate empty merging lists.
+// - use patch format from an old client.
+var customStrategicMergePatchTestCaseData = []byte(`
+testCases:
+  - description: unique scalars when merging lists
+    original:
+      mergingIntList:
+        - 1
+        - 2
+    twoWay:
+      mergingIntList:
+        - 2
+        - 3
+    modified:
+      mergingIntList:
+        - 1
+        - 2
+        - 3
+  - description: delete map from nested map
+    original:
+      simpleMap:
+        key1: 1
+        key2: 1
+    twoWay:
+      simpleMap:
+        $patch: delete
+    modified:
+      simpleMap:
+        {}
+  - description: delete all items from merging list
+    original:
+      mergingList:
+        - name: 1
+        - name: 2
+    twoWay:
+      mergingList:
+        - $patch: replace
+    modified:
+      mergingList: []
+  - description: merge empty merging lists
+    original:
+      mergingList: []
+    twoWay:
+      mergingList: []
+    modified:
+      mergingList: []
+  - description: delete all keys from map
+    original:
+      name: 1
+      value: 1
+    twoWay:
+      $patch: replace
+    modified: {}
+  - description: add key and delete all keys from map
+    original:
+      name: 1
+      value: 1
+    twoWay:
+      other: a
+      $patch: replace
+    modified:
+      other: a
+  - description: delete all duplicate entries in a merging list
+    original:
+      mergingList:
+        - name: 1
+        - name: 1
+        - name: 2
+          value: a
+        - name: 3
+        - name: 3
+    twoWay:
+      mergingList:
+        - name: 1
+          $patch: delete
+        - name: 3
+          $patch: delete
+    modified:
+      mergingList:
+        - name: 2
+          value: a
+  - description: retainKeys map can add a field when no retainKeys directive present
+    original:
+      retainKeysMap:
+        name: foo
+    twoWay:
+      retainKeysMap:
+        value: bar
+    modified:
+      retainKeysMap:
+        name: foo
+        value: bar
+  - description: retainKeys map can change a field when no retainKeys directive present
+    original:
+      retainKeysMap:
+        name: foo
+        value: a
+    twoWay:
+      retainKeysMap:
+        value: b
+    modified:
+      retainKeysMap:
+        name: foo
+        value: b
+  - description: retainKeys map can delete a field when no retainKeys directive present
+    original:
+      retainKeysMap:
+        name: foo
+        value: a
+    twoWay:
+      retainKeysMap:
+        value: null
+    modified:
+      retainKeysMap:
+        name: foo
+  - description: retainKeys map merge an empty map
+    original:
+      retainKeysMap:
+        name: foo
+        value: a
+    twoWay:
+      retainKeysMap: {}
+    modified:
+      retainKeysMap:
+        name: foo
+        value: a
+  - description: retainKeys list can add a field when no retainKeys directive present
+    original:
+      retainKeysMergingList:
+      - name: bar
+      - name: foo
+    twoWay:
+      retainKeysMergingList:
+      - name: foo
+        value: a
+    modified:
+      retainKeysMergingList:
+      - name: bar
+      - name: foo
+        value: a
+  - description: retainKeys list can change a field when no retainKeys directive present
+    original:
+      retainKeysMergingList:
+      - name: bar
+      - name: foo
+        value: a
+    twoWay:
+      retainKeysMergingList:
+      - name: foo
+        value: b
+    modified:
+      retainKeysMergingList:
+      - name: bar
+      - name: foo
+        value: b
+  - description: retainKeys list can delete a field when no retainKeys directive present
+    original:
+      retainKeysMergingList:
+      - name: bar
+      - name: foo
+        value: a
+    twoWay:
+      retainKeysMergingList:
+      - name: foo
+        value: null
+    modified:
+      retainKeysMergingList:
+      - name: bar
+      - name: foo
+  - description: preserve the order from the patch in a merging list
+    original:
+      mergingList:
+        - name: 1
+        - name: 2
+          value: b
+        - name: 3
+    twoWay:
+      mergingList:
+        - name: 3
+          value: c
+        - name: 1
+          value: a
+        - name: 2
+          other: x
+    modified:
+      mergingList:
+        - name: 3
+          value: c
+        - name: 1
+          value: a
+        - name: 2
+          value: b
+          other: x
+  - description: preserve the order from the patch in a merging list 2
+    original:
+      mergingList:
+        - name: 1
+        - name: 2
+          value: b
+        - name: 3
+    twoWay:
+      mergingList:
+        - name: 3
+          value: c
+        - name: 1
+          value: a
+    modified:
+      mergingList:
+        - name: 2
+          value: b
+        - name: 3
+          value: c
+        - name: 1
+          value: a
+  - description: preserve the order from the patch in a merging int list
+    original:
+      mergingIntList:
+        - 1
+        - 2
+        - 3
+    twoWay:
+      mergingIntList:
+        - 3
+        - 1
+        - 2
+    modified:
+      mergingIntList:
+        - 3
+        - 1
+        - 2
+  - description: preserve the order from the patch in a merging int list
+    original:
+      mergingIntList:
+        - 1
+        - 2
+        - 3
+    twoWay:
+      mergingIntList:
+        - 3
+        - 1
+    modified:
+      mergingIntList:
+        - 2
+        - 3
+        - 1
+`)
+
+var customStrategicMergePatchRawTestCases = []StrategicMergePatchRawTestCase{
+	{
+		Description: "$setElementOrder contains item that is not present in the list to be merged",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 3
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 3
+  - name: 2
+  - name: 1
+mergingList:
+  - name: 3
+    value: 3
+  - name: 1
+    value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 3
+    value: 3
+  - name: 1
+    value: 1
+`),
+		},
+	},
+	{
+		Description: "$setElementOrder contains item that is not present in the int list to be merged",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 3
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 3
+  - 2
+  - 1
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 3
+  - 1
+`),
+		},
+	},
+	{
+		Description: "should check if order in $setElementOrder and patch list match",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 3
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 3
+    value: 3
+  - name: 1
+    value: 1
+`),
+			ExpectedError: "doesn't match",
+		},
+	},
+	{
+		Description: "$setElementOrder contains item that is not present in the int list to be merged",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 3
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+  - 3
+mergingIntList:
+  - 3
+  - 1
+`),
+			ExpectedError: "doesn't match",
+		},
+	},
+	{
+		Description: "missing merge key should error out",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: a
+`),
+			TwoWay: []byte(`
+mergingList:
+  - value: b
+`),
+			ExpectedError: "does not contain declared merge key",
+		},
+	},
+	{
+		Description: "$deleteFromPrimitiveList of nonexistent item in primitive list should not add the item to the list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			TwoWay: []byte(`
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+		},
+	},
+	{
+		Description: "$deleteFromPrimitiveList on empty primitive list should not add the item to the list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+`),
+			TwoWay: []byte(`
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+`),
+		},
+	},
+	{
+		Description: "$deleteFromPrimitiveList on nonexistent primitive list should not add the primitive list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+foo:
+  - bar
+`),
+			TwoWay: []byte(`
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+foo:
+  - bar
+`),
+		},
+	},
+	{
+		Description: "$deleteFromPrimitiveList should delete item from a list with merge patch strategy",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			TwoWay: []byte(`
+$deleteFromPrimitiveList/mergingIntList:
+  - 2
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 1
+  - 3
+`),
+		},
+	},
+	{
+		Description: "$deleteFromPrimitiveList should delete item from a list without merge patch strategy",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+nonMergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			TwoWay: []byte(`
+$deleteFromPrimitiveList/nonMergingIntList:
+  - 2
+`),
+			Modified: []byte(`
+nonMergingIntList:
+  - 1
+  - 3
+`),
+		},
+	},
+}
+
+func TestCustomStrategicMergePatch(t *testing.T) {
+	mergeItemOpenapiSchema := PatchMetaFromOpenAPI{
+		Schema: sptest.GetSchemaOrDie(&fakeMergeItemSchema, "mergeItem"),
+	}
+	mergeItemOpenapiV3Schema := PatchMetaFromOpenAPIV3{
+		SchemaList: fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas,
+		Schema:     fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas["mergeItem"],
+	}
+	schemas := []LookupPatchMeta{
+		mergeItemStructSchema,
+		mergeItemOpenapiSchema,
+		mergeItemOpenapiV3Schema,
+	}
+
+	tc := StrategicMergePatchTestCases{}
+	err := yaml.Unmarshal(customStrategicMergePatchTestCaseData, &tc)
+	if err != nil {
+		t.Errorf("can't unmarshal test cases: %v\n", err)
+		return
+	}
+
+	for _, c := range tc.TestCases {
+		t.Run(c.Description, func(t *testing.T) {
+			for _, schema := range schemas {
+				t.Run(schema.Name(), func(t *testing.T) {
+					original, expectedTwoWayPatch, _, expectedResult := twoWayTestCaseToJSONOrFail(t, c, schema)
+					testPatchApplication(t, original, expectedTwoWayPatch, expectedResult, c.Description, "", schema)
+				})
+
+				for _, c := range customStrategicMergePatchRawTestCases {
+					original, expectedTwoWayPatch, _, expectedResult := twoWayRawTestCaseToJSONOrFail(t, c)
+					testPatchApplication(t, original, expectedTwoWayPatch, expectedResult, c.Description, c.ExpectedError, schema)
+				}
+			}
+		})
+	}
+}
+
+// These are test cases for StrategicMergePatch, to assert that applying  a patch
+// yields the correct outcome. They are also test cases for CreateTwoWayMergePatch
+// and CreateThreeWayMergePatch, to assert that they both generate the correct patch
+// for the given set of input documents.
+var createStrategicMergePatchTestCaseData = []byte(`
+testCases:
+  - description: nil original
+    twoWay:
+      name: 1
+      value: 1
+    modified:
+      name: 1
+      value: 1
+    current:
+      name: 1
+      other: a
+    threeWay:
+      value: 1
+    result:
+      name: 1
+      value: 1
+      other: a
+  - description: nil patch
+    original:
+      name: 1
+    twoWay:
+      {}
+    modified:
+      name: 1
+    current:
+      name: 1
+    threeWay:
+      {}
+    result:
+      name: 1
+  - description: add field to map
+    original:
+      name: 1
+    twoWay:
+      value: 1
+    modified:
+      name: 1
+      value: 1
+    current:
+      name: 1
+      other: a
+    threeWay:
+      value: 1
+    result:
+      name: 1
+      value: 1
+      other: a
+  - description: add field to map with conflict
+    original:
+      name: 1
+    twoWay:
+      value: 1
+    modified:
+      name: 1
+      value: 1
+    current:
+      name: a
+      other: a
+    threeWay:
+      name: 1
+      value: 1
+    result:
+      name: 1
+      value: 1
+      other: a
+  - description: add field and delete field from map
+    original:
+      name: 1
+    twoWay:
+      name: null
+      value: 1
+    modified:
+      value: 1
+    current:
+      name: 1
+      other: a
+    threeWay:
+      name: null
+      value: 1
+    result:
+      value: 1
+      other: a
+  - description: add field and delete field from map with conflict
+    original:
+      name: 1
+    twoWay:
+      name: null
+      value: 1
+    modified:
+      value: 1
+    current:
+      name: a
+      other: a
+    threeWay:
+      name: null
+      value: 1
+    result:
+      value: 1
+      other: a
+  - description: delete field from nested map
+    original:
+      simpleMap:
+        key1: 1
+        key2: 1
+    twoWay:
+      simpleMap:
+        key2: null
+    modified:
+      simpleMap:
+        key1: 1
+    current:
+      simpleMap:
+        key1: 1
+        key2: 1
+        other: a
+    threeWay:
+      simpleMap:
+        key2: null
+    result:
+      simpleMap:
+        key1: 1
+        other: a
+  - description: delete field from nested map with conflict
+    original:
+      simpleMap:
+        key1: 1
+        key2: 1
+    twoWay:
+      simpleMap:
+        key2: null
+    modified:
+      simpleMap:
+        key1: 1
+    current:
+      simpleMap:
+        key1: a
+        key2: 1
+        other: a
+    threeWay:
+      simpleMap:
+        key1: 1
+        key2: null
+    result:
+      simpleMap:
+        key1: 1
+        other: a
+  - description: delete all fields from map
+    original:
+      name: 1
+      value: 1
+    twoWay:
+      name: null
+      value: null
+    modified: {}
+    current:
+      name: 1
+      value: 1
+      other: a
+    threeWay:
+      name: null
+      value: null
+    result:
+      other: a
+  - description: delete all fields from map with conflict
+    original:
+      name: 1
+      value: 1
+    twoWay:
+      name: null
+      value: null
+    modified: {}
+    current:
+      name: 1
+      value: a
+      other: a
+    threeWay:
+      name: null
+      value: null
+    result:
+      other: a
+  - description: add field and delete all fields from map
+    original:
+      name: 1
+      value: 1
+    twoWay:
+      name: null
+      value: null
+      other: a
+    modified:
+      other: a
+    current:
+      name: 1
+      value: 1
+      other: a
+    threeWay:
+      name: null
+      value: null
+    result:
+      other: a
+  - description: add field and delete all fields from map with conflict
+    original:
+      name: 1
+      value: 1
+    twoWay:
+      name: null
+      value: null
+      other: a
+    modified:
+      other: a
+    current:
+      name: 1
+      value: 1
+      other: b
+    threeWay:
+      name: null
+      value: null
+      other: a
+    result:
+      other: a
+  - description: replace list of scalars
+    original:
+      nonMergingIntList:
+        - 1
+        - 2
+    twoWay:
+      nonMergingIntList:
+        - 2
+        - 3
+    modified:
+      nonMergingIntList:
+        - 2
+        - 3
+    current:
+      nonMergingIntList:
+        - 1
+        - 2
+    threeWay:
+      nonMergingIntList:
+        - 2
+        - 3
+    result:
+      nonMergingIntList:
+        - 2
+        - 3
+  - description: replace list of scalars with conflict
+    original:
+      nonMergingIntList:
+        - 1
+        - 2
+    twoWay:
+      nonMergingIntList:
+        - 2
+        - 3
+    modified:
+      nonMergingIntList:
+        - 2
+        - 3
+    current:
+      nonMergingIntList:
+        - 1
+        - 4
+    threeWay:
+      nonMergingIntList:
+        - 2
+        - 3
+    result:
+      nonMergingIntList:
+        - 2
+        - 3
+  - description: delete all maps from merging list
+    original:
+      mergingList:
+        - name: 1
+        - name: 2
+    twoWay:
+      mergingList:
+        - name: 1
+          $patch: delete
+        - name: 2
+          $patch: delete
+    modified:
+      mergingList: []
+    current:
+      mergingList:
+        - name: 1
+        - name: 2
+    threeWay:
+      mergingList:
+        - name: 1
+          $patch: delete
+        - name: 2
+          $patch: delete
+    result:
+      mergingList: []
+  - description: delete all maps from merging list with conflict
+    original:
+      mergingList:
+        - name: 1
+        - name: 2
+    twoWay:
+      mergingList:
+        - name: 1
+          $patch: delete
+        - name: 2
+          $patch: delete
+    modified:
+      mergingList: []
+    current:
+      mergingList:
+        - name: 1
+          other: a
+        - name: 2
+          other: b
+    threeWay:
+      mergingList:
+        - name: 1
+          $patch: delete
+        - name: 2
+          $patch: delete
+    result:
+      mergingList: []
+  - description: delete all maps from empty merging list
+    original:
+      mergingList:
+        - name: 1
+        - name: 2
+    twoWay:
+      mergingList:
+        - name: 1
+          $patch: delete
+        - name: 2
+          $patch: delete
+    modified:
+      mergingList: []
+    current:
+      mergingList: []
+    threeWay:
+      mergingList:
+        - name: 1
+          $patch: delete
+        - name: 2
+          $patch: delete
+    result:
+      mergingList: []
+  - description: merge empty merging lists
+    original:
+      mergingList: []
+    twoWay:
+      {}
+    modified:
+      mergingList: []
+    current:
+      mergingList: []
+    threeWay:
+      {}
+    result:
+      mergingList: []
+  - description: defined null values should propagate overwrite current fields (with conflict)
+    original:
+      name: 2
+    twoWay:
+      name: 1
+      value: 1
+      other: null
+    twoWayResult:
+      name: 1
+      value: 1
+    modified:
+      name: 1
+      value: 1
+      other: null
+    current:
+      name: a
+      other: a
+    threeWay:
+      name: 1
+      value: 1
+      other: null
+    result:
+      name: 1
+      value: 1
+  - description: defined null values should propagate removing original fields
+    original:
+      name: original-name
+      value: original-value
+    current:
+      name: original-name
+      value: original-value
+      other: current-other
+    modified:
+      name: modified-name
+      value: null
+    twoWay:
+      name: modified-name
+      value: null
+    twoWayResult:
+      name: modified-name
+    threeWay:
+      name: modified-name
+      value: null
+    result:
+      name: modified-name
+      other: current-other
+  - description: nil patch with retainKeys map
+    original:
+      name: a
+      retainKeysMap:
+        name: foo
+    current:
+      name: a
+      value: b
+      retainKeysMap:
+        name: foo
+    modified:
+      name: a
+      retainKeysMap:
+        name: foo
+    twoWay: {}
+    threeWay: {}
+    result:
+      name: a
+      value: b
+      retainKeysMap:
+        name: foo
+  - description: retainKeys map with no change should not be present
+    original:
+      name: a
+      retainKeysMap:
+        name: foo
+    current:
+      name: a
+      other: c
+      retainKeysMap:
+        name: foo
+    modified:
+      name: a
+      value: b
+      retainKeysMap:
+        name: foo
+    twoWay:
+      value: b
+    threeWay:
+      value: b
+    result:
+      name: a
+      value: b
+      other: c
+      retainKeysMap:
+        name: foo
+`)
+
+var strategicMergePatchRawTestCases = []StrategicMergePatchRawTestCase{
+	{
+		Description: "nested patch merge with empty list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+name: hi
+`),
+			Current: []byte(`
+name: hi
+mergingList:
+- name: hello2
+`),
+			Modified: []byte(`
+name: hi
+mergingList:
+- name: hello
+- $patch: delete
+  name: doesntexist
+`),
+			TwoWay: []byte(`
+mergingList:
+- name: hello
+- $patch: delete
+  name: doesntexist
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+- name: hello
+- name: doesntexist
+mergingList:
+- name: hello
+`),
+			TwoWayResult: []byte(`
+name: hi
+mergingList:
+- name: hello
+`),
+			Result: []byte(`
+name: hi
+mergingList:
+- name: hello
+- name: hello2
+`),
+		},
+	},
+	{
+		Description: "delete items in lists of scalars",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 4
+`),
+		},
+	},
+	{
+		Description: "delete all duplicate items in lists of scalars",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 3
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 3
+  - 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 4
+`),
+		},
+	},
+	{
+		Description: "add and delete items in lists of scalars",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+  - 4
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+mergingIntList:
+  - 4
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 4
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+  - 4
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 4
+`),
+		},
+	},
+	{
+		Description: "merge lists of maps",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 1
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 1
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 1
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+			Result: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+  - name: 3
+    value: 3
+`),
+		},
+	},
+	{
+		Description: "merge lists of maps with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 3
+    value: 3
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 3
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+  - name: 3
+    value: 3
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 3
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+  - name: 3
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add duplicate field to map in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`{}`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add an item that already exists in current object in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: a
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 3
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: a
+  - name: 2
+  - name: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    value: a
+    other: x
+  - name: 2
+  - name: 3
+`),
+			ThreeWay: []byte(`{}`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: a
+    other: x
+  - name: 2
+  - name: 3
+`),
+		},
+	},
+	{
+		Description: "add duplicate field to map in merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 3
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 2
+    value: 2
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "replace map field value in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: a
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: a
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: a
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: a
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "replace map field value in merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: a
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: a
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    value: 3
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: a
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: a
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "delete map from merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 1
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 1
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "delete map from merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 1
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 1
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "delete missing map from merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 1
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 1
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "delete missing map from merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 1
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 3
+    other: a
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 2
+  - name: 1
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+  - name: 3
+    other: a
+`),
+		},
+	},
+	{
+		Description: "add map and delete map from merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 3
+  - name: 1
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+  - name: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    other: b
+  - name: 4
+    other: c
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 3
+  - name: 1
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    other: b
+  - name: 4
+    other: c
+  - name: 3
+`),
+		},
+	},
+	{
+		Description: "add map and delete map from merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 3
+  - name: 1
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+  - name: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 4
+    other: c
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 2
+  - name: 3
+  - name: 1
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 4
+    other: c
+  - name: 2
+  - name: 3
+`),
+		},
+	},
+	{
+		Description: "delete field from map in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "delete field from map in merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    value: a
+    other: a
+  - name: 2
+    value: 2
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+`),
+		},
+	},
+	{
+		Description: "delete missing field from map in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "delete missing field from map in merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+  - name: 2
+    value: 2
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "replace non merging list nested in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    nonMergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    nonMergingList:
+      - name: 1
+        value: 1
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "replace non merging list nested in merging list with value conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    nonMergingList:
+      - name: 1
+        value: c
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    nonMergingList:
+      - name: 1
+        value: 1
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "replace non merging list nested in merging list with deletion conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    nonMergingList:
+      - name: 2
+        value: 2
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    nonMergingList:
+      - name: 1
+        value: 1
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list nested in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 1
+      - name: 2
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 1
+      - name: 2
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list nested in merging list with value conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 1
+      - name: 2
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 1
+        value: a
+        other: c
+      - name: 2
+        value: b
+        other: d
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 1
+      - name: 2
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 1
+        value: 1
+        other: c
+      - name: 2
+        value: 2
+        other: d
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list nested in merging list with deletion conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 1
+      - name: 2
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 2
+        value: 2
+        other: d
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 1
+      - name: 2
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+        other: d
+  - name: 2
+    other: b
+`),
+		},
+	},
+
+	{
+		Description: "add field to map in merging list nested in merging list with deletion conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 2
+      - name: 1
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 2
+        value: 2
+      - name: 1
+        value: 1
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 2
+        value: 2
+        other: d
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 2
+      - name: 1
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 2
+        value: 2
+        other: d
+      - name: 1
+        value: 1
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add map to merging list by pointer",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergeItemPtr:
+  - name: 1
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - name: 2
+`),
+			Modified: []byte(`
+mergeItemPtr:
+  - name: 1
+  - name: 2
+`),
+			Current: []byte(`
+mergeItemPtr:
+  - name: 1
+    other: a
+  - name: 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - name: 2
+`),
+			Result: []byte(`
+mergeItemPtr:
+  - name: 1
+    other: a
+  - name: 2
+  - name: 3
+`),
+		},
+	},
+	{
+		Description: "add map to merging list by pointer with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergeItemPtr:
+  - name: 1
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - name: 2
+`),
+			Modified: []byte(`
+mergeItemPtr:
+  - name: 1
+  - name: 2
+`),
+			Current: []byte(`
+mergeItemPtr:
+  - name: 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - name: 1
+  - name: 2
+`),
+			Result: []byte(`
+mergeItemPtr:
+  - name: 1
+  - name: 2
+  - name: 3
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list by pointer",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergeItemPtr:
+  - name: 1
+    mergeItemPtr:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - $setElementOrder/mergeItemPtr:
+      - name: 1
+      - name: 2
+    name: 1
+    mergeItemPtr:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergeItemPtr:
+  - name: 1
+    mergeItemPtr:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			Current: []byte(`
+mergeItemPtr:
+  - name: 1
+    other: a
+    mergeItemPtr:
+      - name: 1
+        other: a
+      - name: 2
+        value: 2
+        other: b
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - $setElementOrder/mergeItemPtr:
+      - name: 1
+      - name: 2
+    name: 1
+    mergeItemPtr:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergeItemPtr:
+  - name: 1
+    other: a
+    mergeItemPtr:
+      - name: 1
+        value: 1
+        other: a
+      - name: 2
+        value: 2
+        other: b
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list by pointer with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergeItemPtr:
+  - name: 1
+    mergeItemPtr:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - $setElementOrder/mergeItemPtr:
+      - name: 1
+      - name: 2
+    name: 1
+    mergeItemPtr:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergeItemPtr:
+  - name: 1
+    mergeItemPtr:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			Current: []byte(`
+mergeItemPtr:
+  - name: 1
+    other: a
+    mergeItemPtr:
+      - name: 1
+        value: a
+      - name: 2
+        value: 2
+        other: b
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - $setElementOrder/mergeItemPtr:
+      - name: 1
+      - name: 2
+    name: 1
+    mergeItemPtr:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergeItemPtr:
+  - name: 1
+    other: a
+    mergeItemPtr:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+        other: b
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "merge lists of scalars",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+- 1
+- 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+- 1
+- 2
+- 3
+mergingIntList:
+- 3
+`),
+			Modified: []byte(`
+mergingIntList:
+- 1
+- 2
+- 3
+`),
+			Current: []byte(`
+mergingIntList:
+- 1
+- 2
+- 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+- 1
+- 2
+- 3
+mergingIntList:
+- 3
+`),
+			Result: []byte(`
+mergingIntList:
+- 1
+- 2
+- 3
+- 4
+`),
+		},
+	},
+	{
+		Description: "add duplicate field to map in merging int list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+  - 3
+mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			ThreeWay: []byte(`{}`),
+			Result: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+		},
+	},
+	// test case for setElementOrder
+	{
+		Description: "add an item in a list of primitives and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+- 1
+- 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+- 3
+- 1
+- 2
+mergingIntList:
+- 3
+`),
+			Modified: []byte(`
+mergingIntList:
+- 3
+- 1
+- 2
+`),
+			Current: []byte(`
+mergingIntList:
+- 1
+- 4
+- 2
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+- 3
+- 1
+- 2
+mergingIntList:
+- 3
+`),
+			Result: []byte(`
+mergingIntList:
+- 3
+- 1
+- 4
+- 2
+`),
+		},
+	},
+	{
+		Description: "delete an item in a list of primitives and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+- 1
+- 2
+- 3
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+- 2
+- 1
+$deleteFromPrimitiveList/mergingIntList:
+- 3
+`),
+			Modified: []byte(`
+mergingIntList:
+- 2
+- 1
+`),
+			Current: []byte(`
+mergingIntList:
+- 1
+- 2
+- 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+- 2
+- 1
+$deleteFromPrimitiveList/mergingIntList:
+- 3
+`),
+			Result: []byte(`
+mergingIntList:
+- 2
+- 1
+`),
+		},
+	},
+	{
+		Description: "add an item in a list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 3
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 3
+    value: 3
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 3
+    value: 3
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 3
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 3
+    value: 3
+`),
+			Result: []byte(`
+mergingList:
+  - name: 3
+    value: 3
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add multiple items in a list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 4
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 4
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+    other: b
+  - name: 3
+    value: 3
+`),
+		},
+	},
+	{
+		Description: "delete an item in a list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 3
+    value: 3
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 1
+mergingList:
+  - name: 3
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+  - name: 1
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+  - name: 3
+    value: 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 1
+mergingList:
+  - name: 3
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+    other: b
+  - name: 1
+    other: a
+`),
+		},
+	},
+	{
+		Description: "change an item in a list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 3
+    value: 3
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 3
+  - name: 1
+mergingList:
+  - name: 3
+    value: x
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+  - name: 3
+    value: x
+  - name: 1
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+  - name: 3
+    value: 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 3
+  - name: 1
+mergingList:
+  - name: 3
+    value: x
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+    other: b
+  - name: 3
+    value: x
+  - name: 1
+    other: a
+`),
+		},
+	},
+	{
+		Description: "add and delete an item in a list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 3
+    value: 3
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 2
+  - name: 1
+mergingList:
+  - name: 4
+    value: 4
+  - name: 3
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+  - name: 1
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+  - name: 3
+    value: 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 2
+  - name: 1
+mergingList:
+  - name: 4
+    value: 4
+  - name: 3
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+    other: b
+  - name: 1
+    other: a
+`),
+		},
+	},
+	{
+		Description: "set elements order in a list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 2
+  - name: 3
+  - name: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+  - name: 1
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 2
+  - name: 3
+  - name: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+  - name: 1
+    other: a
+`),
+		},
+	},
+	{
+		Description: "set elements order in a list with server-only items",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 2
+  - name: 3
+  - name: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+  - name: 1
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+  - name: 9
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 2
+  - name: 3
+  - name: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+  - name: 1
+    other: a
+  - name: 9
+`),
+		},
+	},
+	{
+		Description: "set elements order in a list with server-only items 2",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 1
+  - name: 4
+  - name: 3
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+  - name: 1
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+  - name: 9
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 1
+  - name: 4
+  - name: 3
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+  - name: 1
+    other: a
+  - name: 9
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+		},
+	},
+	{
+		Description: "set elements order in a list with server-only items 3",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 1
+  - name: 4
+  - name: 3
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+  - name: 1
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+  - name: 7
+  - name: 9
+  - name: 8
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 1
+  - name: 4
+  - name: 3
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+  - name: 1
+    other: a
+  - name: 7
+  - name: 9
+  - name: 8
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+		},
+	},
+	{
+		Description: "add an item in a int list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 3
+  - 1
+  - 2
+mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 3
+  - 1
+  - 2
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 3
+  - 1
+  - 2
+mergingIntList:
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 3
+  - 1
+  - 2
+`),
+		},
+	},
+	{
+		Description: "add multiple items in a int list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 4
+  - 2
+  - 3
+mergingIntList:
+  - 4
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 1
+  - 4
+  - 2
+  - 3
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 4
+  - 2
+  - 3
+mergingIntList:
+  - 4
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 1
+  - 4
+  - 2
+  - 3
+`),
+		},
+	},
+	{
+		Description: "delete an item in a int list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 3
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 2
+  - 1
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 2
+  - 1
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 2
+  - 1
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 2
+  - 1
+`),
+		},
+	},
+	{
+		Description: "add and delete an item in a int list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 3
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 4
+  - 2
+  - 1
+mergingIntList:
+  - 4
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 4
+  - 2
+  - 1
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 4
+  - 2
+  - 1
+mergingIntList:
+  - 4
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 4
+  - 2
+  - 1
+`),
+		},
+	},
+	{
+		Description: "set elements order in a int list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 3
+  - 4
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 3
+  - 4
+  - 2
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+`),
+			Result: []byte(`
+mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+`),
+		},
+	},
+	{
+		Description: "set elements order in a int list with server-only items",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 3
+  - 4
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 3
+  - 4
+  - 2
+  - 9
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+`),
+			Result: []byte(`
+mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+  - 9
+`),
+		},
+	},
+	{
+		Description: "set elements order in a int list with server-only items 2",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 4
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 2
+  - 1
+  - 4
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 2
+  - 1
+  - 4
+  - 3
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 9
+  - 3
+  - 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 2
+  - 1
+  - 4
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 2
+  - 1
+  - 9
+  - 4
+  - 3
+`),
+		},
+	},
+	{
+		Description: "set elements order in a int list with server-only items 3",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 4
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 2
+  - 1
+  - 4
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 2
+  - 1
+  - 4
+  - 3
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 7
+  - 9
+  - 8
+  - 3
+  - 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 2
+  - 1
+  - 4
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 2
+  - 1
+  - 7
+  - 9
+  - 8
+  - 4
+  - 3
+`),
+		},
+	},
+	{
+		// This test case is used just to demonstrate the behavior when dealing with a list with duplicate
+		Description: "behavior of set element order for a merging list with duplicate",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+- name: 1
+- name: 2
+  value: dup1
+- name: 3
+- name: 2
+  value: dup2
+- name: 4
+`),
+			Current: []byte(`
+mergingList:
+- name: 1
+- name: 2
+  value: dup1
+- name: 3
+- name: 2
+  value: dup2
+- name: 4
+`),
+			Modified: []byte(`
+mergingList:
+- name: 2
+  value: dup1
+- name: 1
+- name: 4
+- name: 3
+- name: 2
+  value: dup2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+- name: 2
+- name: 1
+- name: 4
+- name: 3
+- name: 2
+`),
+			TwoWayResult: []byte(`
+mergingList:
+- name: 2
+  value: dup1
+- name: 2
+  value: dup2
+- name: 1
+- name: 4
+- name: 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+- name: 2
+- name: 1
+- name: 4
+- name: 3
+- name: 2
+`),
+			Result: []byte(`
+mergingList:
+- name: 2
+  value: dup1
+- name: 2
+  value: dup2
+- name: 1
+- name: 4
+- name: 3
+`),
+		},
+	},
+	{
+		// This test case is used just to demonstrate the behavior when dealing with a list with duplicate
+		Description: "behavior of set element order for a merging int list with duplicate",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+- 1
+- 2
+- 3
+- 2
+- 4
+`),
+			Current: []byte(`
+mergingIntList:
+- 1
+- 2
+- 3
+- 2
+- 4
+`),
+			Modified: []byte(`
+mergingIntList:
+- 2
+- 1
+- 4
+- 3
+- 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+- 2
+- 1
+- 4
+- 3
+- 2
+`),
+			TwoWayResult: []byte(`
+mergingIntList:
+- 2
+- 2
+- 1
+- 4
+- 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+- 2
+- 1
+- 4
+- 3
+- 2
+`),
+			Result: []byte(`
+mergingIntList:
+- 2
+- 2
+- 1
+- 4
+- 3
+`),
+		},
+	},
+	{
+		Description: "retainKeys map should clear defaulted field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`{}`),
+			Current: []byte(`
+retainKeysMap:
+  value: foo
+`),
+			Modified: []byte(`
+retainKeysMap:
+  other: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  other: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - other
+  other: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  other: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map should clear defaulted field with conflict (discriminated union)",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`{}`),
+			Current: []byte(`
+retainKeysMap:
+  name: type1
+  value: foo
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: type2
+  other: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  name: type2
+  other: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - other
+  name: type2
+  other: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: type2
+  other: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map adds a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map adds a field and clear a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  other: a
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+  value: null
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+  value: null
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes a field and clears a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  other: a
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+  value: null
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+  value: null
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+`),
+		},
+	},
+	{
+		Description: "retainKeys map clears a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  other: a
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			TwoWay: []byte(`{}`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map nested map with no change",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  simpleMap:
+    key1: a
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  simpleMap:
+    key1: a
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  value: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+`),
+		},
+	},
+	{
+		Description: "retainKeys map adds a field in a nested map",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key3: c
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key2: b
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key2: b
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key2: b
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key2: b
+    key3: c
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes a field in a nested map",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key2: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key2: b
+    key3: c
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key2: null
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key2: null
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key3: c
+`),
+		},
+	},
+	{
+		Description: "retainKeys map changes a field in a nested map",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key2: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key2: b
+    key3: c
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: x
+    key2: b
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key1: x
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key1: x
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: x
+    key2: b
+    key3: c
+`),
+		},
+	},
+	{
+		Description: "retainKeys map changes a field in a nested map with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: old
+    key2: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: new
+    key2: b
+    key3: c
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: modified
+    key2: b
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key1: modified
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key1: modified
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: modified
+    key2: b
+    key3: c
+`),
+		},
+	},
+	{
+		Description: "retainKeys map replaces non-merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: c
+  - name: b
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - nonMergingList
+    - value
+  nonMergingList:
+  - name: a
+  - name: c
+  - name: b
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - nonMergingList
+    - value
+  nonMergingList:
+  - name: a
+  - name: c
+  - name: b
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: c
+  - name: b
+`),
+		},
+	},
+	{
+		Description: "retainKeys map nested non-merging list with no change",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - nonMergingList
+    - value
+  value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - nonMergingList
+    - value
+  value: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+		},
+	},
+	{
+		Description: "retainKeys map nested non-merging list with no change with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+  - name: c
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - nonMergingList
+    - value
+  value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - nonMergingList
+    - value
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes nested non-merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+  nonMergingList: null
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+  nonMergingList: null
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map delete nested non-merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+  - name: c
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+  nonMergingList: null
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+  nonMergingList: null
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map nested merging int list with no change",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  mergingIntList:
+  - 1
+  - 2
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingIntList
+    - name
+    - value
+  value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingIntList
+    - name
+    - value
+  $setElementOrder/mergingIntList:
+    - 1
+    - 2
+  value: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+		},
+	},
+	{
+		Description: "retainKeys map adds an item in nested merging int list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 4
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $setElementOrder/mergingIntList:
+    - 1
+    - 2
+    - 4
+  $retainKeys:
+    - mergingIntList
+    - name
+  mergingIntList:
+  - 4
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $setElementOrder/mergingIntList:
+    - 1
+    - 2
+    - 4
+  $retainKeys:
+    - mergingIntList
+    - name
+  mergingIntList:
+  - 4
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 4
+  - 3
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes an item in nested merging int list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 4
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 3
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingIntList
+    - name
+  $deleteFromPrimitiveList/mergingIntList:
+  - 2
+  $setElementOrder/mergingIntList:
+    - 1
+    - 3
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingIntList
+    - name
+  $deleteFromPrimitiveList/mergingIntList:
+  - 2
+  $setElementOrder/mergingIntList:
+    - 1
+    - 3
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 3
+  - 4
+`),
+		},
+	},
+	{
+		Description: "retainKeys map adds an item and deletes an item in nested merging int list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 4
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 3
+  - 5
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingIntList
+    - name
+  mergingIntList:
+  - 5
+  $deleteFromPrimitiveList/mergingIntList:
+  - 2
+  $setElementOrder/mergingIntList:
+    - 1
+    - 3
+    - 5
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingIntList
+    - name
+  mergingIntList:
+  - 5
+  $deleteFromPrimitiveList/mergingIntList:
+  - 2
+  $setElementOrder/mergingIntList:
+    - 1
+    - 3
+    - 5
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 3
+  - 5
+  - 4
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes nested merging int list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+  mergingIntList: null
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+  mergingIntList: null
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+`),
+		},
+	},
+	{
+		Description: "retainKeys map nested merging list with no change",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+  - name: c
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  mergingList:
+  - name: a
+  - name: b
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+    - value
+  value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+    - value
+  $setElementOrder/mergingList:
+    - name: a
+    - name: b
+  value: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  mergingList:
+  - name: a
+  - name: b
+  - name: c
+`),
+		},
+	},
+	{
+		Description: "retainKeys map adds an item in nested merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+  - name: x
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+  - name: c
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+  $setElementOrder/mergingList:
+    - name: a
+    - name: b
+    - name: c
+  mergingList:
+  - name: c
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+  $setElementOrder/mergingList:
+    - name: a
+    - name: b
+    - name: c
+  mergingList:
+  - name: c
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+  - name: c
+  - name: x
+`),
+		},
+	},
+	{
+		Description: "retainKeys map changes an item in nested merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+    value: foo
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+    value: foo
+  - name: x
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+    value: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+  $setElementOrder/mergingList:
+    - name: a
+    - name: b
+  mergingList:
+  - name: b
+    value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+  $setElementOrder/mergingList:
+    - name: a
+    - name: b
+  mergingList:
+  - name: b
+    value: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+    value: bar
+  - name: x
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes nested merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+  mergingList: null
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+  mergingList: null
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes an item in nested merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+  - name: x
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+  $setElementOrder/mergingList:
+    - name: a
+  mergingList:
+  - name: b
+    $patch: delete
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+  $setElementOrder/mergingList:
+    - name: a
+  mergingList:
+  - name: b
+    $patch: delete
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: x
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps clears a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+  other: x
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+			TwoWay: []byte(`{}`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps clears a field with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: old
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: new
+  other: x
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: modified
+`),
+			TwoWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: modified
+`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: modified
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: modified
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps changes a field and clear a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: old
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: old
+  other: x
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: new
+`),
+			TwoWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: new
+`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: new
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: new
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps changes a field and clear a field with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: old
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: modified
+  other: x
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: new
+`),
+			TwoWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: new
+`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: new
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: new
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps adds a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+			TwoWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: a
+`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: a
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps adds a field and clear a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  other: x
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+			TwoWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: a
+`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: a
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps deletes a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+`),
+			TwoWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+  name: foo
+  value: null
+`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+  name: foo
+  value: null
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps deletes a field and clear a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+  other: x
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+`),
+			TwoWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+  name: foo
+  value: null
+`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+  name: foo
+  value: null
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+`),
+		},
+	},
+	{
+		Description: "delete and reorder in one list, reorder in another",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+- name: a
+  value: a
+- name: b
+  value: b
+mergeItemPtr:
+- name: c
+  value: c
+- name: d
+  value: d
+`),
+			Current: []byte(`
+mergingList:
+- name: a
+  value: a
+- name: b
+  value: b
+mergeItemPtr:
+- name: c
+  value: c
+- name: d
+  value: d
+`),
+			Modified: []byte(`
+mergingList:
+- name: b
+  value: b
+mergeItemPtr:
+- name: d
+  value: d
+- name: c
+  value: c
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+- name: b
+$setElementOrder/mergeItemPtr:
+- name: d
+- name: c
+mergingList:
+- $patch: delete
+  name: a
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+- name: b
+$setElementOrder/mergeItemPtr:
+- name: d
+- name: c
+mergingList:
+- $patch: delete
+  name: a
+`),
+			Result: []byte(`
+mergingList:
+- name: b
+  value: b
+mergeItemPtr:
+- name: d
+  value: d
+- name: c
+  value: c
+`),
+		},
+	},
+}
+
+func TestStrategicMergePatch(t *testing.T) {
+	testStrategicMergePatchWithCustomArgumentsUsingStruct(t, "bad struct",
+		"{}", "{}", []byte("<THIS IS NOT A STRUCT>"), mergepatch.ErrBadArgKind(struct{}{}, []byte{}))
+
+	mergeItemOpenapiSchema := PatchMetaFromOpenAPI{
+		Schema: sptest.GetSchemaOrDie(&fakeMergeItemSchema, "mergeItem"),
+	}
+	mergeItemOpenapiV3Schema := PatchMetaFromOpenAPIV3{
+		SchemaList: fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas,
+		Schema:     fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas["mergeItem"],
+	}
+	schemas := []LookupPatchMeta{
+		mergeItemStructSchema,
+		mergeItemOpenapiSchema,
+		mergeItemOpenapiV3Schema,
+	}
+
+	tc := StrategicMergePatchTestCases{}
+	err := yaml.Unmarshal(createStrategicMergePatchTestCaseData, &tc)
+	if err != nil {
+		t.Errorf("can't unmarshal test cases: %s\n", err)
+		return
+	}
+
+	for _, schema := range schemas {
+		t.Run(schema.Name(), func(t *testing.T) {
+
+			testStrategicMergePatchWithCustomArguments(t, "bad original",
+				"<THIS IS NOT JSON>", "{}", schema, mergepatch.ErrBadJSONDoc)
+			testStrategicMergePatchWithCustomArguments(t, "bad patch",
+				"{}", "<THIS IS NOT JSON>", schema, mergepatch.ErrBadJSONDoc)
+			testStrategicMergePatchWithCustomArguments(t, "nil struct",
+				"{}", "{}", nil, mergepatch.ErrBadArgKind(struct{}{}, nil))
+
+			for _, c := range tc.TestCases {
+				t.Run(c.Description+"/TwoWay", func(t *testing.T) {
+					testTwoWayPatch(t, c, schema)
+				})
+				t.Run(c.Description+"/ThreeWay", func(t *testing.T) {
+					testThreeWayPatch(t, c, schema)
+				})
+			}
+		})
+
+		// run multiple times to exercise different map traversal orders
+		for i := 0; i < 10; i++ {
+			for _, c := range strategicMergePatchRawTestCases {
+				t.Run(c.Description+"/TwoWay", func(t *testing.T) {
+					testTwoWayPatchForRawTestCase(t, c, schema)
+				})
+				t.Run(c.Description+"/ThreeWay", func(t *testing.T) {
+					testThreeWayPatchForRawTestCase(t, c, schema)
+				})
+			}
+		}
+	}
+}
+
+func testStrategicMergePatchWithCustomArgumentsUsingStruct(t *testing.T, description, original, patch string, dataStruct interface{}, expected error) {
+	schema, actual := NewPatchMetaFromStruct(dataStruct)
+	// If actual is not nil, check error. If errors match, return.
+	if actual != nil {
+		checkErrorsEqual(t, description, expected, actual, schema)
+		return
+	}
+	testStrategicMergePatchWithCustomArguments(t, description, original, patch, schema, expected)
+}
+
+func testStrategicMergePatchWithCustomArguments(t *testing.T, description, original, patch string, schema LookupPatchMeta, expected error) {
+	_, actual := StrategicMergePatch([]byte(original), []byte(patch), schema)
+	checkErrorsEqual(t, description, expected, actual, schema)
+}
+
+func checkErrorsEqual(t *testing.T, description string, expected, actual error, schema LookupPatchMeta) {
+	if actual != expected {
+		if actual == nil {
+			t.Errorf("using %s expected error: %s\ndid not occur in test case: %s", getSchemaType(schema), expected, description)
+			return
+		}
+
+		if expected == nil || actual.Error() != expected.Error() {
+			t.Errorf("using %s unexpected error: %s\noccurred in test case: %s", getSchemaType(schema), actual, description)
+			return
+		}
+	}
+}
+
+func testTwoWayPatch(t *testing.T, c StrategicMergePatchTestCase, schema LookupPatchMeta) {
+	original, expectedPatch, modified, expectedResult := twoWayTestCaseToJSONOrFail(t, c, schema)
+
+	actualPatch, err := CreateTwoWayMergePatchUsingLookupPatchMeta(original, modified, schema)
+	if err != nil {
+		t.Errorf("using %s error: %s\nin test case: %s\ncannot create two way patch: %s:\n%s\n",
+			getSchemaType(schema), err, c.Description, original, mergepatch.ToYAMLOrError(c.StrategicMergePatchTestCaseData))
+		return
+	}
+
+	testPatchCreation(t, expectedPatch, actualPatch, c.Description)
+	testPatchApplication(t, original, actualPatch, expectedResult, c.Description, "", schema)
+}
+
+func testTwoWayPatchForRawTestCase(t *testing.T, c StrategicMergePatchRawTestCase, schema LookupPatchMeta) {
+	original, expectedPatch, modified, expectedResult := twoWayRawTestCaseToJSONOrFail(t, c)
+
+	actualPatch, err := CreateTwoWayMergePatchUsingLookupPatchMeta(original, modified, schema)
+	if err != nil {
+		t.Errorf("error: %s\nin test case: %s\ncannot create two way patch:\noriginal:%s\ntwoWay:%s\nmodified:%s\ncurrent:%s\nthreeWay:%s\nresult:%s\n",
+			err, c.Description, c.Original, c.TwoWay, c.Modified, c.Current, c.ThreeWay, c.Result)
+		return
+	}
+
+	testPatchCreation(t, expectedPatch, actualPatch, c.Description)
+	testPatchApplication(t, original, actualPatch, expectedResult, c.Description, c.ExpectedError, schema)
+}
+
+func twoWayTestCaseToJSONOrFail(t *testing.T, c StrategicMergePatchTestCase, schema LookupPatchMeta) ([]byte, []byte, []byte, []byte) {
+	expectedResult := c.TwoWayResult
+	if expectedResult == nil {
+		expectedResult = c.Modified
+	}
+	return sortJsonOrFail(t, testObjectToJSONOrFail(t, c.Original), c.Description, schema),
+		sortJsonOrFail(t, testObjectToJSONOrFail(t, c.TwoWay), c.Description, schema),
+		sortJsonOrFail(t, testObjectToJSONOrFail(t, c.Modified), c.Description, schema),
+		sortJsonOrFail(t, testObjectToJSONOrFail(t, expectedResult), c.Description, schema)
+}
+
+func twoWayRawTestCaseToJSONOrFail(t *testing.T, c StrategicMergePatchRawTestCase) ([]byte, []byte, []byte, []byte) {
+	expectedResult := c.TwoWayResult
+	if expectedResult == nil {
+		expectedResult = c.Modified
+	}
+	return yamlToJSONOrError(t, c.Original),
+		yamlToJSONOrError(t, c.TwoWay),
+		yamlToJSONOrError(t, c.Modified),
+		yamlToJSONOrError(t, expectedResult)
+}
+
+func testThreeWayPatch(t *testing.T, c StrategicMergePatchTestCase, schema LookupPatchMeta) {
+	original, modified, current, expected, result := threeWayTestCaseToJSONOrFail(t, c, schema)
+	actual, err := CreateThreeWayMergePatch(original, modified, current, schema, false)
+	if err != nil {
+		if !mergepatch.IsConflict(err) {
+			t.Errorf("using %s error: %s\nin test case: %s\ncannot create three way patch:\n%s\n",
+				getSchemaType(schema), err, c.Description, mergepatch.ToYAMLOrError(c.StrategicMergePatchTestCaseData))
+			return
+		}
+
+		if !strings.Contains(c.Description, "conflict") {
+			t.Errorf("using %s unexpected conflict: %s\nin test case: %s\ncannot create three way patch:\n%s\n",
+				getSchemaType(schema), err, c.Description, mergepatch.ToYAMLOrError(c.StrategicMergePatchTestCaseData))
+			return
+		}
+
+		if len(c.Result) > 0 {
+			actual, err := CreateThreeWayMergePatch(original, modified, current, schema, true)
+			if err != nil {
+				t.Errorf("using %s error: %s\nin test case: %s\ncannot force three way patch application:\n%s\n",
+					getSchemaType(schema), err, c.Description, mergepatch.ToYAMLOrError(c.StrategicMergePatchTestCaseData))
+				return
+			}
+
+			testPatchCreation(t, expected, actual, c.Description)
+			testPatchApplication(t, current, actual, result, c.Description, "", schema)
+		}
+
+		return
+	}
+
+	if strings.Contains(c.Description, "conflict") || len(c.Result) < 1 {
+		t.Errorf("using %s error in test case: %s\nexpected conflict did not occur:\n%s\n",
+			getSchemaType(schema), c.Description, mergepatch.ToYAMLOrError(c.StrategicMergePatchTestCaseData))
+		return
+	}
+
+	testPatchCreation(t, expected, actual, c.Description)
+	testPatchApplication(t, current, actual, result, c.Description, "", schema)
+}
+
+func testThreeWayPatchForRawTestCase(t *testing.T, c StrategicMergePatchRawTestCase, schema LookupPatchMeta) {
+	original, modified, current, expected, result := threeWayRawTestCaseToJSONOrFail(t, c)
+	actual, err := CreateThreeWayMergePatch(original, modified, current, schema, false)
+	if err != nil {
+		if !mergepatch.IsConflict(err) {
+			t.Errorf("using %s error: %s\nin test case: %s\ncannot create three way patch:\noriginal:%s\ntwoWay:%s\nmodified:%s\ncurrent:%s\nthreeWay:%s\nresult:%s\n",
+				getSchemaType(schema), err, c.Description, c.Original, c.TwoWay, c.Modified, c.Current, c.ThreeWay, c.Result)
+			return
+		}
+
+		if !strings.Contains(c.Description, "conflict") {
+			t.Errorf("using %s unexpected conflict: %s\nin test case: %s\ncannot create three way patch:\noriginal:%s\ntwoWay:%s\nmodified:%s\ncurrent:%s\nthreeWay:%s\nresult:%s\n",
+				getSchemaType(schema), err, c.Description, c.Original, c.TwoWay, c.Modified, c.Current, c.ThreeWay, c.Result)
+			return
+		}
+
+		if len(c.Result) > 0 {
+			actual, err := CreateThreeWayMergePatch(original, modified, current, schema, true)
+			if err != nil {
+				t.Errorf("using %s error: %s\nin test case: %s\ncannot force three way patch application:\noriginal:%s\ntwoWay:%s\nmodified:%s\ncurrent:%s\nthreeWay:%s\nresult:%s\n",
+					getSchemaType(schema), err, c.Description, c.Original, c.TwoWay, c.Modified, c.Current, c.ThreeWay, c.Result)
+				return
+			}
+
+			testPatchCreation(t, expected, actual, c.Description)
+			testPatchApplication(t, current, actual, result, c.Description, c.ExpectedError, schema)
+		}
+
+		return
+	}
+
+	if strings.Contains(c.Description, "conflict") || len(c.Result) < 1 {
+		t.Errorf("using %s error: %s\nin test case: %s\nexpected conflict did not occur:\noriginal:%s\ntwoWay:%s\nmodified:%s\ncurrent:%s\nthreeWay:%s\nresult:%s\n",
+			getSchemaType(schema), err, c.Description, c.Original, c.TwoWay, c.Modified, c.Current, c.ThreeWay, c.Result)
+		return
+	}
+
+	testPatchCreation(t, expected, actual, c.Description)
+	testPatchApplication(t, current, actual, result, c.Description, c.ExpectedError, schema)
+}
+
+func threeWayTestCaseToJSONOrFail(t *testing.T, c StrategicMergePatchTestCase, schema LookupPatchMeta) ([]byte, []byte, []byte, []byte, []byte) {
+	return sortJsonOrFail(t, testObjectToJSONOrFail(t, c.Original), c.Description, schema),
+		sortJsonOrFail(t, testObjectToJSONOrFail(t, c.Modified), c.Description, schema),
+		sortJsonOrFail(t, testObjectToJSONOrFail(t, c.Current), c.Description, schema),
+		sortJsonOrFail(t, testObjectToJSONOrFail(t, c.ThreeWay), c.Description, schema),
+		sortJsonOrFail(t, testObjectToJSONOrFail(t, c.Result), c.Description, schema)
+}
+
+func threeWayRawTestCaseToJSONOrFail(t *testing.T, c StrategicMergePatchRawTestCase) ([]byte, []byte, []byte, []byte, []byte) {
+	return yamlToJSONOrError(t, c.Original),
+		yamlToJSONOrError(t, c.Modified),
+		yamlToJSONOrError(t, c.Current),
+		yamlToJSONOrError(t, c.ThreeWay),
+		yamlToJSONOrError(t, c.Result)
+}
+
+func testPatchCreation(t *testing.T, expected, actual []byte, description string) {
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("error in test case: %s\nexpected patch:\n%s\ngot:\n%s\n",
+			description, jsonToYAMLOrError(expected), jsonToYAMLOrError(actual))
+		return
+	}
+}
+
+func testPatchApplication(t *testing.T, original, patch, expected []byte, description, expectedError string, schema LookupPatchMeta) {
+	result, err := StrategicMergePatchUsingLookupPatchMeta(original, patch, schema)
+	if len(expectedError) != 0 {
+		if err != nil && strings.Contains(err.Error(), expectedError) {
+			return
+		}
+		t.Errorf("using %s expected error should contain:\n%s\nin test case: %s\nbut got:\n%s\n", getSchemaType(schema), expectedError, description, err)
+	}
+	if err != nil {
+		t.Errorf("using %s error: %s\nin test case: %s\ncannot apply patch:\n%s\nto original:\n%s\n",
+			getSchemaType(schema), err, description, jsonToYAMLOrError(patch), jsonToYAMLOrError(original))
+		return
+	}
+
+	if !reflect.DeepEqual(result, expected) {
+		format := "using error in test case: %s\npatch application failed:\noriginal:\n%s\npatch:\n%s\nexpected:\n%s\ngot:\n%s\n"
+		t.Errorf(format, description,
+			jsonToYAMLOrError(original), jsonToYAMLOrError(patch),
+			jsonToYAMLOrError(expected), jsonToYAMLOrError(result))
+		return
+	}
+}
+
+func testObjectToJSONOrFail(t *testing.T, o map[string]interface{}) []byte {
+	if o == nil {
+		return nil
+	}
+
+	j, err := toJSON(o)
+	if err != nil {
+		t.Error(err)
+	}
+	return j
+}
+
+func sortJsonOrFail(t *testing.T, j []byte, description string, schema LookupPatchMeta) []byte {
+	if j == nil {
+		return nil
+	}
+	r, err := sortMergeListsByName(j, schema)
+	if err != nil {
+		t.Errorf("using %s error: %s\n in test case: %s\ncannot sort object:\n%s\n", getSchemaType(schema), err, description, j)
+		return nil
+	}
+
+	return r
+}
+
+func getSchemaType(schema LookupPatchMeta) string {
+	return reflect.TypeOf(schema).String()
+}
+
+func jsonToYAMLOrError(j []byte) string {
+	y, err := jsonToYAML(j)
+	if err != nil {
+		return err.Error()
+	}
+
+	return string(y)
+}
+
+func toJSON(v interface{}) ([]byte, error) {
+	j, err := json.Marshal(v)
+	if err != nil {
+		return nil, fmt.Errorf("json marshal failed: %v\n%v\n", err, dump.Pretty(v))
+	}
+
+	return j, nil
+}
+
+func jsonToYAML(j []byte) ([]byte, error) {
+	y, err := yaml.JSONToYAML(j)
+	if err != nil {
+		return nil, fmt.Errorf("json to yaml failed: %v\n%v\n", err, j)
+	}
+
+	return y, nil
+}
+
+func yamlToJSON(y []byte) ([]byte, error) {
+	j, err := yaml.YAMLToJSON(y)
+	if err != nil {
+		return nil, fmt.Errorf("yaml to json failed: %v\n%v\n", err, y)
+	}
+
+	return j, nil
+}
+
+func yamlToJSONOrError(t *testing.T, y []byte) []byte {
+	j, err := yamlToJSON(y)
+	if err != nil {
+		t.Errorf("%v", err)
+	}
+
+	return j
+}
+
+type PrecisionItem struct {
+	Name    string  `json:"name,omitempty"`
+	Int32   int32   `json:"int32,omitempty"`
+	Int64   int64   `json:"int64,omitempty"`
+	Float32 float32 `json:"float32,omitempty"`
+	Float64 float64 `json:"float64,omitempty"`
+}
+
+var (
+	precisionItem             PrecisionItem
+	precisionItemStructSchema = PatchMetaFromStruct{T: GetTagStructTypeOrDie(precisionItem)}
+)
+
+func TestNumberConversion(t *testing.T) {
+	testcases := map[string]struct {
+		Old            string
+		New            string
+		ExpectedPatch  string
+		ExpectedResult string
+	}{
+		"empty": {
+			Old:            `{}`,
+			New:            `{}`,
+			ExpectedPatch:  `{}`,
+			ExpectedResult: `{}`,
+		},
+		"int32 medium": {
+			Old:            `{"int32":1000000}`,
+			New:            `{"int32":1000000,"name":"newname"}`,
+			ExpectedPatch:  `{"name":"newname"}`,
+			ExpectedResult: `{"int32":1000000,"name":"newname"}`,
+		},
+		"int32 max": {
+			Old:            `{"int32":2147483647}`,
+			New:            `{"int32":2147483647,"name":"newname"}`,
+			ExpectedPatch:  `{"name":"newname"}`,
+			ExpectedResult: `{"int32":2147483647,"name":"newname"}`,
+		},
+		"int64 medium": {
+			Old:            `{"int64":1000000}`,
+			New:            `{"int64":1000000,"name":"newname"}`,
+			ExpectedPatch:  `{"name":"newname"}`,
+			ExpectedResult: `{"int64":1000000,"name":"newname"}`,
+		},
+		"int64 max": {
+			Old:            `{"int64":9223372036854775807}`,
+			New:            `{"int64":9223372036854775807,"name":"newname"}`,
+			ExpectedPatch:  `{"name":"newname"}`,
+			ExpectedResult: `{"int64":9223372036854775807,"name":"newname"}`,
+		},
+		"float32 max": {
+			Old:            `{"float32":3.4028234663852886e+38}`,
+			New:            `{"float32":3.4028234663852886e+38,"name":"newname"}`,
+			ExpectedPatch:  `{"name":"newname"}`,
+			ExpectedResult: `{"float32":3.4028234663852886e+38,"name":"newname"}`,
+		},
+		"float64 max": {
+			Old:            `{"float64":1.7976931348623157e+308}`,
+			New:            `{"float64":1.7976931348623157e+308,"name":"newname"}`,
+			ExpectedPatch:  `{"name":"newname"}`,
+			ExpectedResult: `{"float64":1.7976931348623157e+308,"name":"newname"}`,
+		},
+	}
+
+	precisionItemOpenapiSchema := PatchMetaFromOpenAPI{
+		Schema: sptest.GetSchemaOrDie(&fakePrecisionItemSchema, "precisionItem"),
+	}
+	precisionItemOpenapiV3Schema := PatchMetaFromOpenAPIV3{
+		SchemaList: fakePrecisionItemV3Schema.SchemaOrDie().Components.Schemas,
+		Schema:     fakePrecisionItemV3Schema.SchemaOrDie().Components.Schemas["precisionItem"],
+	}
+	precisionItemSchemas := []LookupPatchMeta{
+		precisionItemStructSchema,
+		precisionItemOpenapiSchema,
+		precisionItemOpenapiV3Schema,
+	}
+
+	for _, schema := range precisionItemSchemas {
+		for k, tc := range testcases {
+			patch, err := CreateTwoWayMergePatchUsingLookupPatchMeta([]byte(tc.Old), []byte(tc.New), schema)
+			if err != nil {
+				t.Errorf("using %s in testcase %s: unexpected error %v", getSchemaType(schema), k, err)
+				continue
+			}
+			if tc.ExpectedPatch != string(patch) {
+				t.Errorf("using %s in testcase %s: expected %s, got %s", getSchemaType(schema), k, tc.ExpectedPatch, string(patch))
+				continue
+			}
+
+			result, err := StrategicMergePatchUsingLookupPatchMeta([]byte(tc.Old), patch, schema)
+			if err != nil {
+				t.Errorf("using %s in testcase %s: unexpected error %v", getSchemaType(schema), k, err)
+				continue
+			}
+			if tc.ExpectedResult != string(result) {
+				t.Errorf("using %s in testcase %s: expected %s, got %s", getSchemaType(schema), k, tc.ExpectedResult, string(result))
+				continue
+			}
+		}
+	}
+}
+
+var replaceRawExtensionPatchTestCases = []StrategicMergePatchRawTestCase{
+	{
+		Description: "replace RawExtension field, rest unchanched",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+name: my-object
+value: some-value
+other: current-other
+replacingItem:
+  Some: Generic
+  Yaml: Inside
+  The: RawExtension
+  Field: Period
+`),
+			Current: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+replacingItem:
+  Some: Generic
+  Yaml: Inside
+  The: RawExtension
+  Field: Period
+`),
+			Modified: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			TwoWay: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			TwoWayResult: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			ThreeWay: []byte(`
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			Result: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+		},
+	},
+	{
+		Description: "replace RawExtension field and merge list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+replacingItem:
+  Some: Generic
+  Yaml: Inside
+  The: RawExtension
+  Field: Period
+`),
+			Current: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 3
+replacingItem:
+  Some: Generic
+  Yaml: Inside
+  The: RawExtension
+  Field: Period
+`),
+			Modified: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 2
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 2
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			TwoWayResult: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 2
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 2
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			Result: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+		},
+	},
+}
+
+func TestReplaceWithRawExtension(t *testing.T) {
+	mergeItemOpenapiSchema := PatchMetaFromOpenAPI{
+		Schema: sptest.GetSchemaOrDie(&fakeMergeItemSchema, "mergeItem"),
+	}
+	mergeItemOpenapiV3Schema := PatchMetaFromOpenAPIV3{
+		SchemaList: fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas,
+		Schema:     fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas["mergeItem"],
+	}
+	schemas := []LookupPatchMeta{
+		mergeItemStructSchema,
+		mergeItemOpenapiSchema,
+		mergeItemOpenapiV3Schema,
+	}
+
+	for _, schema := range schemas {
+		for _, c := range replaceRawExtensionPatchTestCases {
+			testTwoWayPatchForRawTestCase(t, c, schema)
+			testThreeWayPatchForRawTestCase(t, c, schema)
+		}
+	}
+}
+
+func TestUnknownField(t *testing.T) {
+	testcases := map[string]struct {
+		Original string
+		Current  string
+		Modified string
+
+		ExpectedTwoWay         string
+		ExpectedTwoWayErr      string
+		ExpectedTwoWayResult   string
+		ExpectedThreeWay       string
+		ExpectedThreeWayErr    string
+		ExpectedThreeWayResult string
+	}{
+		// cases we can successfully strategically merge
+		"no diff": {
+			Original: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Current:  `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Modified: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+
+			ExpectedTwoWay:         `{}`,
+			ExpectedTwoWayResult:   `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			ExpectedThreeWay:       `{}`,
+			ExpectedThreeWayResult: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+		},
+		"no diff even if modified null": {
+			Original: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Current:  `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Modified: `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":{"key":null},"name":"foo","scalar":true}`,
+
+			ExpectedTwoWay:         `{"complex_nullable":{"key":null}}`,
+			ExpectedTwoWayResult:   `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":{},"name":"foo","scalar":true}`,
+			ExpectedThreeWay:       `{"complex_nullable":{"key":null}}`,
+			ExpectedThreeWayResult: `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":{},"name":"foo","scalar":true}`,
+		},
+		"discard nulls in nested and adds not nulls": {
+			Original: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Current:  `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Modified: `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":{"key":{"keynotnull":"value","keynull":null}},"name":"foo","scalar":true}`,
+
+			ExpectedTwoWay:         `{"complex_nullable":{"key":{"keynotnull":"value","keynull":null}}}`,
+			ExpectedTwoWayResult:   `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":{"key":{"keynotnull":"value"}},"name":"foo","scalar":true}`,
+			ExpectedThreeWay:       `{"complex_nullable":{"key":{"keynotnull":"value","keynull":null}}}`,
+			ExpectedThreeWayResult: `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":{"key":{"keynotnull":"value"}},"name":"foo","scalar":true}`,
+		},
+		"discard if modified all nulls": {
+			Original: `{}`,
+			Current:  `{}`,
+			Modified: `{"complex":{"nested":null}}`,
+
+			ExpectedTwoWay:         `{"complex":{"nested":null}}`,
+			ExpectedTwoWayResult:   `{"complex":{}}`,
+			ExpectedThreeWay:       `{"complex":{"nested":null}}`,
+			ExpectedThreeWayResult: `{"complex":{}}`,
+		},
+		"add only not nulls": {
+			Original: `{}`,
+			Current:  `{}`,
+			Modified: `{"complex":{"nested":null,"nested2":"foo"}}`,
+
+			ExpectedTwoWay:         `{"complex":{"nested":null,"nested2":"foo"}}`,
+			ExpectedTwoWayResult:   `{"complex":{"nested2":"foo"}}`,
+			ExpectedThreeWay:       `{"complex":{"nested":null,"nested2":"foo"}}`,
+			ExpectedThreeWayResult: `{"complex":{"nested2":"foo"}}`,
+		},
+		"null values in original are preserved": {
+			Original: `{"thing":null}`,
+			Current:  `{"thing":null}`,
+			Modified: `{"nested":{"value":5},"thing":null}`,
+
+			ExpectedTwoWay:         `{"nested":{"value":5}}`,
+			ExpectedTwoWayResult:   `{"nested":{"value":5},"thing":null}`,
+			ExpectedThreeWay:       `{"nested":{"value":5}}`,
+			ExpectedThreeWayResult: `{"nested":{"value":5},"thing":null}`,
+		},
+		"nested null values in original are preserved": {
+			Original: `{"complex":{"key":null},"thing":null}`,
+			Current:  `{"complex":{"key":null},"thing":null}`,
+			Modified: `{"complex":{"key":null},"nested":{"value":5},"thing":null}`,
+
+			ExpectedTwoWay:         `{"nested":{"value":5}}`,
+			ExpectedTwoWayResult:   `{"complex":{"key":null},"nested":{"value":5},"thing":null}`,
+			ExpectedThreeWay:       `{"nested":{"value":5}}`,
+			ExpectedThreeWayResult: `{"complex":{"key":null},"nested":{"value":5},"thing":null}`,
+		},
+		"add empty slices": {
+			Original: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Current:  `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Modified: `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":[],"name":"foo","scalar":true}`,
+
+			ExpectedTwoWay:         `{"complex_nullable":[]}`,
+			ExpectedTwoWayResult:   `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":[],"name":"foo","scalar":true}`,
+			ExpectedThreeWay:       `{"complex_nullable":[]}`,
+			ExpectedThreeWayResult: `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":[],"name":"foo","scalar":true}`,
+		},
+		"filter nulls from nested slices": {
+			Original: `{}`,
+			Current:  `{}`,
+			Modified: `{"complex_nullable":[{"inner_one":{"key_one":"foo","key_two":null}}]}`,
+
+			ExpectedTwoWay:         `{"complex_nullable":[{"inner_one":{"key_one":"foo","key_two":null}}]}`,
+			ExpectedTwoWayResult:   `{"complex_nullable":[{"inner_one":{"key_one":"foo"}}]}`,
+			ExpectedThreeWay:       `{"complex_nullable":[{"inner_one":{"key_one":"foo","key_two":null}}]}`,
+			ExpectedThreeWayResult: `{"complex_nullable":[{"inner_one":{"key_one":"foo"}}]}`,
+		},
+		"filter if slice is all empty": {
+			Original: `{}`,
+			Current:  `{}`,
+			Modified: `{"complex_nullable":[{"inner_one":{"key_one":null,"key_two":null}}]}`,
+
+			ExpectedTwoWay:         `{"complex_nullable":[{"inner_one":{"key_one":null,"key_two":null}}]}`,
+			ExpectedTwoWayResult:   `{"complex_nullable":[{"inner_one":{}}]}`,
+			ExpectedThreeWay:       `{"complex_nullable":[{"inner_one":{"key_one":null,"key_two":null}}]}`,
+			ExpectedThreeWayResult: `{"complex_nullable":[{"inner_one":{}}]}`,
+		},
+		"not filter nulls from non-associative slice": {
+			Original: `{}`,
+			Current:  `{}`,
+			Modified: `{"complex_nullable":["key1",null,"key2"]}`,
+
+			ExpectedTwoWay:         `{"complex_nullable":["key1",null,"key2"]}`,
+			ExpectedTwoWayResult:   `{"complex_nullable":["key1",null,"key2"]}`,
+			ExpectedThreeWay:       `{"complex_nullable":["key1",null,"key2"]}`,
+			ExpectedThreeWayResult: `{"complex_nullable":["key1",null,"key2"]}`,
+		},
+		"added only": {
+			Original: `{"name":"foo"}`,
+			Current:  `{"name":"foo"}`,
+			Modified: `{"name":"foo","scalar":true,"complex":{"nested":true},"array":[1,2,3]}`,
+
+			ExpectedTwoWay:         `{"array":[1,2,3],"complex":{"nested":true},"scalar":true}`,
+			ExpectedTwoWayResult:   `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			ExpectedThreeWay:       `{"array":[1,2,3],"complex":{"nested":true},"scalar":true}`,
+			ExpectedThreeWayResult: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+		},
+		"removed only": {
+			Original: `{"name":"foo","scalar":true,"complex":{"nested":true}}`,
+			Current:  `{"name":"foo","scalar":true,"complex":{"nested":true},"array":[1,2,3]}`,
+			Modified: `{"name":"foo"}`,
+
+			ExpectedTwoWay:         `{"complex":null,"scalar":null}`,
+			ExpectedTwoWayResult:   `{"name":"foo"}`,
+			ExpectedThreeWay:       `{"complex":null,"scalar":null}`,
+			ExpectedThreeWayResult: `{"array":[1,2,3],"name":"foo"}`,
+		},
+
+		// cases we cannot successfully strategically merge (expect errors)
+		"diff": {
+			Original: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Current:  `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Modified: `{"array":[1,2,3],"complex":{"nested":false},"name":"foo","scalar":true}`,
+
+			ExpectedTwoWayErr:   `unable to find api field`,
+			ExpectedThreeWayErr: `unable to find api field`,
+		},
+
+		"json": {
+			Original: `{"name":"foo","jsonItem":{"nested":{"nested2":{"nested3":{}}}}}`,
+			Current:  `{"name":"foo","jsonItem":{"nested":{"nested2":{"nested3":{}}}}}`,
+			Modified: `{"name":"foo","jsonItem":{"nested":{"nested2":{"nested3":{"a":"b"}}}}}`,
+
+			ExpectedTwoWay:         `{"jsonItem":{"nested":{"nested2":{"nested3":{"a":"b"}}}}}`,
+			ExpectedTwoWayResult:   `{"jsonItem":{"nested":{"nested2":{"nested3":{"a":"b"}}}},"name":"foo"}`,
+			ExpectedThreeWay:       `{"jsonItem":{"nested":{"nested2":{"nested3":{"a":"b"}}}}}`,
+			ExpectedThreeWayResult: `{"jsonItem":{"nested":{"nested2":{"nested3":{"a":"b"}}}},"name":"foo"}`,
+			ExpectedTwoWayErr:      `unable to find api field`,
+			ExpectedThreeWayErr:    `unable to find api field`,
+		},
+	}
+
+	mergeItemOpenapiSchema := PatchMetaFromOpenAPI{
+		Schema: sptest.GetSchemaOrDie(&fakeMergeItemSchema, "mergeItem"),
+	}
+	mergeItemOpenapiV3Schema := PatchMetaFromOpenAPIV3{
+		SchemaList: fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas,
+		Schema:     fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas["mergeItem"],
+	}
+	schemas := []LookupPatchMeta{
+		mergeItemStructSchema,
+		mergeItemOpenapiSchema,
+		mergeItemOpenapiV3Schema,
+	}
+
+	for _, k := range sets.StringKeySet(testcases).List() {
+		t.Run(k, func(t *testing.T) {
+			tc := testcases[k]
+			for _, schema := range schemas {
+				t.Run(schema.Name()+"/TwoWay", func(t *testing.T) {
+					twoWay, err := CreateTwoWayMergePatchUsingLookupPatchMeta([]byte(tc.Original), []byte(tc.Modified), schema)
+					if err != nil {
+						if len(tc.ExpectedTwoWayErr) == 0 {
+							t.Errorf("using %s in testcase %s: error making two-way patch: %v", getSchemaType(schema), k, err)
+						}
+						if !strings.Contains(err.Error(), tc.ExpectedTwoWayErr) {
+							t.Errorf("using %s in testcase %s: expected error making two-way patch to contain '%s', got %s", getSchemaType(schema), k, tc.ExpectedTwoWayErr, err)
+						}
+						return
+					}
+
+					if string(twoWay) != tc.ExpectedTwoWay {
+						t.Errorf("using %s in testcase %s: expected two-way patch:\n\t%s\ngot\n\t%s", getSchemaType(schema), k, string(tc.ExpectedTwoWay), string(twoWay))
+						return
+					}
+
+					twoWayResult, err := StrategicMergePatchUsingLookupPatchMeta([]byte(tc.Original), twoWay, schema)
+					if err != nil {
+						t.Errorf("using %s in testcase %s: error applying two-way patch: %v", getSchemaType(schema), k, err)
+						return
+					}
+					if string(twoWayResult) != tc.ExpectedTwoWayResult {
+						t.Errorf("using %s in testcase %s: expected two-way result:\n\t%s\ngot\n\t%s", getSchemaType(schema), k, string(tc.ExpectedTwoWayResult), string(twoWayResult))
+						return
+					}
+				})
+
+				t.Run(schema.Name()+"/ThreeWay", func(t *testing.T) {
+					threeWay, err := CreateThreeWayMergePatch([]byte(tc.Original), []byte(tc.Modified), []byte(tc.Current), schema, false)
+					if err != nil {
+						if len(tc.ExpectedThreeWayErr) == 0 {
+							t.Errorf("using %s in testcase %s: error making three-way patch: %v", getSchemaType(schema), k, err)
+						} else if !strings.Contains(err.Error(), tc.ExpectedThreeWayErr) {
+							t.Errorf("using %s in testcase %s: expected error making three-way patch to contain '%s', got %s", getSchemaType(schema), k, tc.ExpectedThreeWayErr, err)
+						}
+						return
+					}
+
+					if string(threeWay) != tc.ExpectedThreeWay {
+						t.Errorf("using %s in testcase %s: expected three-way patch:\n\t%s\ngot\n\t%s", getSchemaType(schema), k, string(tc.ExpectedThreeWay), string(threeWay))
+						return
+					}
+
+					threeWayResult, err := StrategicMergePatchUsingLookupPatchMeta([]byte(tc.Current), threeWay, schema)
+					if err != nil {
+						t.Errorf("using %s in testcase %s: error applying three-way patch: %v", getSchemaType(schema), k, err)
+						return
+					} else if string(threeWayResult) != tc.ExpectedThreeWayResult {
+						t.Errorf("using %s in testcase %s: expected three-way result:\n\t%s\ngot\n\t%s", getSchemaType(schema), k, string(tc.ExpectedThreeWayResult), string(threeWayResult))
+						return
+					}
+				})
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-merge-item-v3.json b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-merge-item-v3.json
new file mode 100644
index 0000000000..f5178156e2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-merge-item-v3.json
@@ -0,0 +1,183 @@
+{
+  "openapi": "3.0",
+  "info": {
+    "title": "StrategicMergePatchTestingMergeItem",
+    "version": "v3.0"
+  },
+  "paths": {},
+  "components": {
+    "schemas": {
+      "mergeItem": {
+        "description": "MergeItem is type definition for testing strategic merge.",
+        "required": [],
+        "properties": {
+          "name": {
+            "description": "Name field.",
+            "type": "string"
+          },
+          "value": {
+            "description": "Value field.",
+            "type": "string"
+          },
+          "other": {
+            "description": "Other field.",
+            "type": "string"
+          },
+          "mergingList": {
+            "description": "MergingList field.",
+            "type": "array",
+            "items": {
+              "default": {},
+              "allOf": [
+                {"$ref": "#/components/schemas/mergeItem"}
+              ]
+            },
+            "x-kubernetes-patch-merge-key": "name",
+            "x-kubernetes-patch-strategy": "merge"
+          },
+          "nonMergingList": {
+            "description": "NonMergingList field.",
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/mergeItem"
+            }
+          },
+          "mergingIntList": {
+            "description": "MergingIntList field.",
+            "type": "array",
+            "items": {
+              "type": "integer",
+              "format": "int32"
+            },
+            "x-kubernetes-patch-strategy": "merge"
+          },
+          "nonMergingIntList": {
+            "description": "NonMergingIntList field.",
+            "type": "array",
+            "items": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          "mergeItemPtr": {
+            "description": "MergeItemPtr field.",
+            "allOf": [
+              {"$ref": "#/components/schemas/mergeItem"}
+            ],
+            "x-kubernetes-patch-merge-key": "name",
+            "x-kubernetes-patch-strategy": "merge"
+          },
+          "simpleMap": {
+            "description": "SimpleMap field.",
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
+          },
+          "replacingItem": {
+            "description": "ReplacingItem field.",
+            "allOf": [
+              {"$ref": "#/components/schemas/io.k8s.apimachinery.pkg.runtime.RawExtension"}
+            ],
+            "x-kubernetes-patch-strategy": "replace"
+          },
+          "retainKeysMap": {
+            "description": "RetainKeysMap field.",
+            "allOf": [
+              {"$ref": "#/components/schemas/retainKeysMergeItem"}
+            ],
+            "x-kubernetes-patch-strategy": "retainKeys"
+          },
+          "retainKeysMergingList": {
+            "description": "RetainKeysMergingList field.",
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/mergeItem"
+            },
+            "x-kubernetes-patch-merge-key": "name",
+            "x-kubernetes-patch-strategy": "merge,retainKeys"
+          },
+          "jsonItem": {
+            "description": "Values are the chart values."
+          }
+        },
+        "x-kubernetes-group-version-kind": [
+          {
+            "group": "fake-group",
+            "kind": "mergeItem",
+            "version": "some-version"
+          }
+        ]
+      },
+      "retainKeysMergeItem": {
+        "description": "RetainKeysMergeItem is type definition for testing strategic merge.",
+        "required": [],
+        "properties": {
+          "name": {
+            "description": "Name field.",
+            "type": "string"
+          },
+          "value": {
+            "description": "Value field.",
+            "type": "string"
+          },
+          "other": {
+            "description": "Other field.",
+            "type": "string"
+          },
+          "simpleMap": {
+            "description": "SimpleMap field.",
+            "items": {
+              "type": "string"
+            }
+          },
+          "mergingList": {
+            "description": "MergingList field.",
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/mergeItem"
+            },
+            "x-kubernetes-patch-merge-key": "name",
+            "x-kubernetes-patch-strategy": "merge"
+          },
+          "nonMergingList": {
+            "description": "NonMergingList field.",
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/mergeItem"
+            }
+          },
+          "mergingIntList": {
+            "description": "MergingIntList field.",
+            "type": "array",
+            "items": {
+              "type": "integer",
+              "format": "int32"
+            },
+            "x-kubernetes-patch-strategy": "merge"
+          }
+        },
+        "x-kubernetes-group-version-kind": [
+          {
+            "group": "fake-group",
+            "kind": "retainKeysMergeItem",
+            "version": "some-version"
+          }
+        ]
+      },
+      "io.k8s.apimachinery.pkg.runtime.RawExtension": {
+        "description": "RawExtension is used to hold extensions in external versions.",
+        "required": [
+          "Raw"
+        ],
+        "properties": {
+          "Raw": {
+            "description": "Raw is the underlying serialization of this object.",
+            "type": "string",
+            "format": "byte"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-merge-item.json b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-merge-item.json
new file mode 100644
index 0000000000..c5abe757ec
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-merge-item.json
@@ -0,0 +1,173 @@
+{
+  "swagger": "2.0",
+  "info": {
+    "title": "StrategicMergePatchTestingMergeItem",
+    "version": "v1.9.0"
+  },
+  "paths": {},
+  "definitions": {
+    "mergeItem": {
+      "description": "MergeItem is type definition for testing strategic merge.",
+      "required": [],
+      "properties": {
+        "name": {
+          "description": "Name field.",
+          "type": "string"
+        },
+        "value": {
+          "description": "Value field.",
+          "type": "string"
+        },
+        "other": {
+          "description": "Other field.",
+          "type": "string"
+        },
+        "mergingList": {
+          "description": "MergingList field.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/mergeItem"
+          },
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "nonMergingList": {
+          "description": "NonMergingList field.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/mergeItem"
+          }
+        },
+        "mergingIntList": {
+          "description": "MergingIntList field.",
+          "type": "array",
+          "items": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "nonMergingIntList": {
+          "description": "NonMergingIntList field.",
+          "type": "array",
+          "items": {
+            "type": "integer",
+            "format": "int32"
+          }
+        },
+        "mergeItemPtr": {
+          "description": "MergeItemPtr field.",
+          "$ref": "#/definitions/mergeItem",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "simpleMap": {
+          "description": "SimpleMap field.",
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+        "replacingItem": {
+          "description": "ReplacingItem field.",
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.runtime.RawExtension",
+          "x-kubernetes-patch-strategy": "replace"
+        },
+        "retainKeysMap": {
+          "description": "RetainKeysMap field.",
+          "$ref": "#/definitions/retainKeysMergeItem",
+          "x-kubernetes-patch-strategy": "retainKeys"
+        },
+        "retainKeysMergingList": {
+          "description": "RetainKeysMergingList field.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/mergeItem"
+          },
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge,retainKeys"
+        },
+        "jsonItem": {
+          "description": "JSON field",
+        }
+      },
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "fake-group",
+          "kind": "mergeItem",
+          "version": "some-version"
+        }
+      ]
+    },
+    "retainKeysMergeItem": {
+      "description": "RetainKeysMergeItem is type definition for testing strategic merge.",
+      "required": [],
+      "properties": {
+        "name": {
+          "description": "Name field.",
+          "type": "string"
+        },
+        "value": {
+          "description": "Value field.",
+          "type": "string"
+        },
+        "other": {
+          "description": "Other field.",
+          "type": "string"
+        },
+        "simpleMap": {
+          "description": "SimpleMap field.",
+          "additionalProperties": "object",
+          "items": {
+            "type": "string"
+          }
+        },
+        "mergingList": {
+          "description": "MergingList field.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/mergeItem"
+          },
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "nonMergingList": {
+          "description": "NonMergingList field.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/mergeItem"
+          }
+        },
+        "mergingIntList": {
+          "description": "MergingIntList field.",
+          "type": "array",
+          "items": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "x-kubernetes-patch-strategy": "merge"
+        }
+      },
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "fake-group",
+          "kind": "retainKeysMergeItem",
+          "version": "some-version"
+        }
+      ]
+    },
+    "io.k8s.apimachinery.pkg.runtime.RawExtension": {
+      "description": "RawExtension is used to hold extensions in external versions.",
+      "required": [
+        "Raw"
+      ],
+      "properties": {
+        "Raw": {
+          "description": "Raw is the underlying serialization of this object.",
+          "type": "string",
+          "format": "byte"
+        }
+      }
+    }
+  }
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-precision-item-v3.json b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-precision-item-v3.json
new file mode 100644
index 0000000000..0101c41028
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-precision-item-v3.json
@@ -0,0 +1,49 @@
+{
+  "openapi": "3.0",
+  "info": {
+    "title": "StrategicMergePatchTestingPrecisionItem",
+    "version": "v1.9.0"
+  },
+  "paths": {},
+  "components": {
+    "schemas": {
+      "precisionItem": {
+        "description": "PrecisionItem is type definition for testing strategic merge.",
+        "required": [],
+        "properties": {
+          "name": {
+            "description": "Name field.",
+            "type": "string"
+          },
+          "int32": {
+            "description": "Int32 field.",
+            "type": "integer",
+            "format": "int32"
+          },
+          "int64": {
+            "description": "Int64 field.",
+            "type": "integer",
+            "format": "int64"
+          },
+          "float32": {
+            "description": "Float32 field.",
+            "type": "number",
+            "format": "float32"
+          },
+          "float64": {
+            "description": "Float64 field.",
+            "type": "number",
+            "format": "float64"
+          }
+        },
+        "x-kubernetes-group-version-kind": [
+          {
+            "group": "fake-group",
+            "kind": "precisionItem",
+            "version": "some-version"
+          }
+        ]
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-precision-item.json b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-precision-item.json
new file mode 100644
index 0000000000..a35ae31f65
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-precision-item.json
@@ -0,0 +1,47 @@
+{
+  "swagger": "2.0",
+  "info": {
+    "title": "StrategicMergePatchTestingPrecisionItem",
+    "version": "v1.9.0"
+  },
+  "paths": {},
+  "definitions": {
+    "precisionItem": {
+      "description": "PrecisionItem is type definition for testing strategic merge.",
+      "required": [],
+      "properties": {
+        "name": {
+          "description": "Name field.",
+          "type": "string"
+        },
+        "int32": {
+          "description": "Int32 field.",
+          "type": "integer",
+          "format": "int32"
+        },
+        "int64": {
+          "description": "Int64 field.",
+          "type": "integer",
+          "format": "int64"
+        },
+        "float32": {
+          "description": "Float32 field.",
+          "type": "number",
+          "format": "float32"
+        },
+        "float64": {
+          "description": "Float64 field.",
+          "type": "number",
+          "format": "float64"
+        }
+      },
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "fake-group",
+          "kind": "precisionItem",
+          "version": "some-version"
+        }
+      ]
+    }
+  }
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testing/openapi.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testing/openapi.go
new file mode 100644
index 0000000000..ae8fbfafac
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testing/openapi.go
@@ -0,0 +1,74 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"os"
+	"sync"
+
+	openapi_v2 "github.com/google/gnostic-models/openapiv2"
+	openapi "k8s.io/kube-openapi/pkg/util/proto"
+)
+
+// Fake opens and returns a openapi swagger from a file Path. It will
+// parse only once and then return the same copy everytime.
+type Fake struct {
+	Path string
+
+	once     sync.Once
+	document *openapi_v2.Document
+	err      error
+}
+
+// OpenAPISchema returns the openapi document and a potential error.
+func (f *Fake) OpenAPISchema() (*openapi_v2.Document, error) {
+	f.once.Do(func() {
+		_, err := os.Stat(f.Path)
+		if err != nil {
+			f.err = err
+			return
+		}
+		spec, err := os.ReadFile(f.Path)
+		if err != nil {
+			f.err = err
+			return
+		}
+		f.document, f.err = openapi_v2.ParseDocument(spec)
+	})
+	return f.document, f.err
+}
+
+func getSchema(f *Fake, model string) (openapi.Schema, error) {
+	s, err := f.OpenAPISchema()
+	if err != nil {
+		return nil, err
+	}
+	m, err := openapi.NewOpenAPIData(s)
+	if err != nil {
+		return nil, err
+	}
+	return m.LookupModel(model), nil
+}
+
+// GetSchemaOrDie returns the openapi schema.
+func GetSchemaOrDie(f *Fake, model string) openapi.Schema {
+	s, err := getSchema(f, model)
+	if err != nil {
+		panic(err)
+	}
+	return s
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testing/openapi3.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testing/openapi3.go
new file mode 100644
index 0000000000..895522b31a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testing/openapi3.go
@@ -0,0 +1,65 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"os"
+	"sync"
+
+	"k8s.io/kube-openapi/pkg/spec3"
+)
+
+type OpenAPIV3Getter struct {
+	Path      string
+	once      sync.Once
+	bytes     []byte
+	openapiv3 spec3.OpenAPI
+}
+
+func (f *OpenAPIV3Getter) SchemaBytesOrDie() []byte {
+	f.once.Do(func() {
+		_, err := os.Stat(f.Path)
+		if err != nil {
+			panic(err)
+		}
+		spec, err := os.ReadFile(f.Path)
+		if err != nil {
+			panic(err)
+		}
+		f.bytes = spec
+	})
+	return f.bytes
+}
+
+func (f *OpenAPIV3Getter) SchemaOrDie() *spec3.OpenAPI {
+	f.once.Do(func() {
+		_, err := os.Stat(f.Path)
+		if err != nil {
+			panic(err)
+		}
+		spec, err := os.ReadFile(f.Path)
+		if err != nil {
+			panic(err)
+		}
+
+		err = f.openapiv3.UnmarshalJSON(spec)
+		if err != nil {
+			panic(err)
+		}
+	})
+	return &f.openapiv3
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/types.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/types.go
new file mode 100644
index 0000000000..f84d65aacb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/types.go
@@ -0,0 +1,193 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package strategicpatch
+
+import (
+	"errors"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/mergepatch"
+	openapi "k8s.io/kube-openapi/pkg/util/proto"
+)
+
+const (
+	patchStrategyOpenapiextensionKey = "x-kubernetes-patch-strategy"
+	patchMergeKeyOpenapiextensionKey = "x-kubernetes-patch-merge-key"
+)
+
+type LookupPatchItem interface {
+	openapi.SchemaVisitor
+
+	Error() error
+	Path() *openapi.Path
+}
+
+type kindItem struct {
+	key          string
+	path         *openapi.Path
+	err          error
+	patchmeta    PatchMeta
+	subschema    openapi.Schema
+	hasVisitKind bool
+}
+
+func NewKindItem(key string, path *openapi.Path) *kindItem {
+	return &kindItem{
+		key:  key,
+		path: path,
+	}
+}
+
+var _ LookupPatchItem = &kindItem{}
+
+func (item *kindItem) Error() error {
+	return item.err
+}
+
+func (item *kindItem) Path() *openapi.Path {
+	return item.path
+}
+
+func (item *kindItem) VisitPrimitive(schema *openapi.Primitive) {
+	item.err = errors.New("expected kind, but got primitive")
+}
+
+func (item *kindItem) VisitArray(schema *openapi.Array) {
+	item.err = errors.New("expected kind, but got slice")
+}
+
+func (item *kindItem) VisitMap(schema *openapi.Map) {
+	item.err = errors.New("expected kind, but got map")
+}
+
+func (item *kindItem) VisitReference(schema openapi.Reference) {
+	if !item.hasVisitKind {
+		schema.SubSchema().Accept(item)
+	}
+}
+
+func (item *kindItem) VisitKind(schema *openapi.Kind) {
+	subschema, ok := schema.Fields[item.key]
+	if !ok {
+		item.err = FieldNotFoundError{Path: schema.GetPath().String(), Field: item.key}
+		return
+	}
+
+	mergeKey, patchStrategies, err := parsePatchMetadata(subschema.GetExtensions())
+	if err != nil {
+		item.err = err
+		return
+	}
+	item.patchmeta = PatchMeta{
+		patchStrategies: patchStrategies,
+		patchMergeKey:   mergeKey,
+	}
+	item.subschema = subschema
+}
+
+type sliceItem struct {
+	key          string
+	path         *openapi.Path
+	err          error
+	patchmeta    PatchMeta
+	subschema    openapi.Schema
+	hasVisitKind bool
+}
+
+func NewSliceItem(key string, path *openapi.Path) *sliceItem {
+	return &sliceItem{
+		key:  key,
+		path: path,
+	}
+}
+
+var _ LookupPatchItem = &sliceItem{}
+
+func (item *sliceItem) Error() error {
+	return item.err
+}
+
+func (item *sliceItem) Path() *openapi.Path {
+	return item.path
+}
+
+func (item *sliceItem) VisitPrimitive(schema *openapi.Primitive) {
+	item.err = errors.New("expected slice, but got primitive")
+}
+
+func (item *sliceItem) VisitArray(schema *openapi.Array) {
+	if !item.hasVisitKind {
+		item.err = errors.New("expected visit kind first, then visit array")
+	}
+	subschema := schema.SubType
+	item.subschema = subschema
+}
+
+func (item *sliceItem) VisitMap(schema *openapi.Map) {
+	item.err = errors.New("expected slice, but got map")
+}
+
+func (item *sliceItem) VisitReference(schema openapi.Reference) {
+	if !item.hasVisitKind {
+		schema.SubSchema().Accept(item)
+	} else {
+		item.subschema = schema.SubSchema()
+	}
+}
+
+func (item *sliceItem) VisitKind(schema *openapi.Kind) {
+	subschema, ok := schema.Fields[item.key]
+	if !ok {
+		item.err = FieldNotFoundError{Path: schema.GetPath().String(), Field: item.key}
+		return
+	}
+
+	mergeKey, patchStrategies, err := parsePatchMetadata(subschema.GetExtensions())
+	if err != nil {
+		item.err = err
+		return
+	}
+	item.patchmeta = PatchMeta{
+		patchStrategies: patchStrategies,
+		patchMergeKey:   mergeKey,
+	}
+	item.hasVisitKind = true
+	subschema.Accept(item)
+}
+
+func parsePatchMetadata(extensions map[string]interface{}) (string, []string, error) {
+	ps, foundPS := extensions[patchStrategyOpenapiextensionKey]
+	var patchStrategies []string
+	var mergeKey, patchStrategy string
+	var ok bool
+	if foundPS {
+		patchStrategy, ok = ps.(string)
+		if ok {
+			patchStrategies = strings.Split(patchStrategy, ",")
+		} else {
+			return "", nil, mergepatch.ErrBadArgType(patchStrategy, ps)
+		}
+	}
+	mk, foundMK := extensions[patchMergeKeyOpenapiextensionKey]
+	if foundMK {
+		mergeKey, ok = mk.(string)
+		if !ok {
+			return "", nil, mergepatch.ErrBadArgType(mergeKey, mk)
+		}
+	}
+	return mergeKey, patchStrategies, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/uuid/uuid.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/uuid/uuid.go
new file mode 100644
index 0000000000..1fa351aab6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/uuid/uuid.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package uuid
+
+import (
+	"github.com/google/uuid"
+
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func NewUUID() types.UID {
+	return types.UID(uuid.New().String())
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/OWNERS b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/OWNERS
new file mode 100644
index 0000000000..4023732476
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/OWNERS
@@ -0,0 +1,11 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+# Disable inheritance as this is an api owners file
+options:
+  no_parent_owners: true
+approvers:
+  - api-approvers
+reviewers:
+  - api-reviewers
+labels:
+  - kind/api-change
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go
new file mode 100644
index 0000000000..1a18b27666
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go
@@ -0,0 +1,397 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package field
+
+import (
+	"fmt"
+	"reflect"
+	"regexp"
+	"strings"
+)
+
+// NormalizationRule holds a pre-compiled regular expression and its replacement string
+// for normalizing field paths.
+type NormalizationRule struct {
+	Regexp      *regexp.Regexp
+	Replacement string
+}
+
+// ErrorMatcher is a helper for comparing Error objects.
+type ErrorMatcher struct {
+	// TODO(thockin): consider whether type is ever NOT required, maybe just
+	// assume it.
+	matchType bool
+	// TODO(thockin): consider whether field could be assumed - if the
+	// "want" error has a nil field, don't match on field.
+	matchField bool
+	// TODO(thockin): consider whether value could be assumed - if the
+	// "want" error has a nil value, don't match on value.
+	matchValue                    bool
+	matchOrigin                   bool
+	matchDetail                   func(want, got string) bool
+	requireOriginWhenInvalid      bool
+	matchValidationStabilityLevel bool
+	matchSource                   bool
+	matchAncestorShortCircuit     bool
+	matchShortCircuit             bool
+	// normalizationRules holds the pre-compiled regex patterns for path normalization.
+	normalizationRules []NormalizationRule
+}
+
+// isChildPath returns true if child is a descendant path of parent.
+// It avoids false positives like "spec.containers" being a child of "spec.container"
+// by explicitly checking for '.' or '[' path separators.
+func isChildPath(parent, child string) bool {
+	// "" as parent path not supported. It can un-intentionally match with any path.
+	// theoretically system errors can be matched with any path errors.
+	if len(parent) == 0 {
+		return false
+	}
+	if len(child) <= len(parent) {
+		return false
+	}
+	if child[:len(parent)] != parent {
+		return false
+	}
+	sep := child[len(parent)]
+	return sep == '.' || sep == '['
+}
+
+// Matches returns true if the two Error objects match according to the
+// configured criteria. When field normalization is configured, only the
+// "got" error's field path is normalized (to bring older API versions up
+// to the internal/latest format), while "want" is assumed to already be
+// in the canonical internal API format.
+func (m ErrorMatcher) Matches(want, got *Error) bool {
+	gotField := got.Field
+	if want.Field != gotField {
+		gotField = m.normalizePath(gotField)
+	}
+	if m.matchAncestorShortCircuit {
+		if got.ShortCircuit && (isChildPath(gotField, want.Field) || isChildPath(got.Field, want.Field)) {
+			return true
+		}
+	}
+
+	if m.matchType && want.Type != got.Type {
+		return false
+	}
+	if m.matchField && want.Field != gotField {
+		return false
+	}
+	if m.matchValue && !reflect.DeepEqual(want.BadValue, got.BadValue) {
+		return false
+	}
+
+	if m.matchOrigin {
+		if want.Origin != got.Origin {
+			return false
+		}
+		if m.requireOriginWhenInvalid && want.Type == ErrorTypeInvalid {
+			if want.Origin == "" || got.Origin == "" {
+				return false
+			}
+		}
+	}
+	if m.matchDetail != nil && !m.matchDetail(want.Detail, got.Detail) {
+		return false
+	}
+	if m.matchValidationStabilityLevel && want.ValidationStabilityLevel != got.ValidationStabilityLevel {
+		return false
+	}
+	if m.matchSource && want.FromImperative != got.FromImperative {
+		return false
+	}
+	if m.matchShortCircuit && want.ShortCircuit != got.ShortCircuit {
+		return false
+	}
+
+	return true
+}
+
+// normalizePath applies configured path normalization rules.
+func (m ErrorMatcher) normalizePath(path string) string {
+	for _, rule := range m.normalizationRules {
+		normalized := rule.Regexp.ReplaceAllString(path, rule.Replacement)
+		if normalized != path {
+			// Only apply the first matching rule.
+			return normalized
+		}
+	}
+	return path
+}
+
+// Render returns a string representation of the specified Error object,
+// according to the criteria configured in the ErrorMatcher.
+func (m ErrorMatcher) Render(e *Error) string {
+	buf := strings.Builder{}
+
+	comma := func() {
+		if buf.Len() > 0 {
+			buf.WriteString(", ")
+		}
+	}
+
+	if m.matchType {
+		comma()
+		fmt.Fprintf(&buf, "Type=%q", e.Type)
+	}
+	if m.matchField {
+		comma()
+		if normalized := m.normalizePath(e.Field); normalized != e.Field {
+			fmt.Fprintf(&buf, "Field=%q (aka %q)", normalized, e.Field)
+		} else {
+			fmt.Fprintf(&buf, "Field=%q", e.Field)
+		}
+	}
+	if m.matchValue {
+		comma()
+		if s, ok := e.BadValue.(string); ok {
+			fmt.Fprintf(&buf, "Value=%q", s)
+		} else {
+			rv := reflect.ValueOf(e.BadValue)
+			if rv.Kind() == reflect.Pointer && !rv.IsNil() {
+				rv = rv.Elem()
+			}
+			if rv.IsValid() && rv.CanInterface() {
+				fmt.Fprintf(&buf, "Value=%v", rv.Interface())
+			} else {
+				fmt.Fprintf(&buf, "Value=%v", e.BadValue)
+			}
+		}
+	}
+	if m.matchOrigin || m.requireOriginWhenInvalid && e.Type == ErrorTypeInvalid {
+		comma()
+		fmt.Fprintf(&buf, "Origin=%q", e.Origin)
+	}
+	if m.matchDetail != nil {
+		comma()
+		fmt.Fprintf(&buf, "Detail=%q", e.Detail)
+	}
+	if m.matchValidationStabilityLevel {
+		comma()
+		fmt.Fprintf(&buf, "ValidationStabilityLevel=%s", e.ValidationStabilityLevel)
+	}
+	if m.matchSource {
+		comma()
+		fmt.Fprintf(&buf, "FromImperative=%t", e.FromImperative)
+	}
+	if m.matchShortCircuit {
+		comma()
+		fmt.Fprintf(&buf, "ShortCircuit=%t", e.ShortCircuit)
+	}
+	return "{" + buf.String() + "}"
+}
+
+// Exactly returns a derived ErrorMatcher which matches all fields exactly.
+func (m ErrorMatcher) Exactly() ErrorMatcher {
+	return m.ByType().ByField().ByValue().ByOrigin().ByDetailExact()
+}
+
+// ByType returns a derived ErrorMatcher which also matches by type.
+func (m ErrorMatcher) ByType() ErrorMatcher {
+	m.matchType = true
+	return m
+}
+
+// ByField returns a derived ErrorMatcher which also matches by field path.
+// If you need to mutate the field path (e.g. to normalize across versions),
+// see ByFieldNormalized.
+func (m ErrorMatcher) ByField() ErrorMatcher {
+	m.matchField = true
+	return m
+}
+
+// ByFieldNormalized returns a derived ErrorMatcher which also matches by field path
+// after applying normalization rules to the actual (got) error's field path.
+// This allows matching field paths from older API versions against the canonical
+// internal API format.
+//
+// The normalization rules are applied ONLY to the "got" error's field path, bringing
+// older API version field paths up to the latest/internal format. The "want" error
+// is assumed to always be in the internal API format (latest).
+//
+// The rules slice holds pre-compiled regular expressions and their replacement strings.
+//
+// Example:
+//
+//	rules := []NormalizationRule{
+//	  {
+//	    Regexp:      regexp.MustCompile(`spec\.devices\.requests\[(\d+)\]\.allocationMode`),
+//	    Replacement: "spec.devices.requests[$1].exactly.allocationMode",
+//	  },
+//	}
+//	matcher := ErrorMatcher{}.ByFieldNormalized(rules)
+func (m ErrorMatcher) ByFieldNormalized(rules []NormalizationRule) ErrorMatcher {
+	m.matchField = true
+	m.normalizationRules = rules
+	return m
+}
+
+// ByValue returns a derived ErrorMatcher which also matches by the errant
+// value.
+func (m ErrorMatcher) ByValue() ErrorMatcher {
+	m.matchValue = true
+	return m
+}
+
+// ByOrigin returns a derived ErrorMatcher which also matches by the origin.
+// When this is used and an origin is set in the error, the matcher will
+// consider all expected errors with the same origin to be a match. The only
+// expception to this is when it finds two errors which are exactly identical,
+// which is too suspicious to ignore. This multi-matching allows tests to
+// express a single expectation ("I set the X field to an invalid value, and I
+// expect an error from origin Y") without having to know exactly how many
+// errors might be returned, or in what order, or with what wording.
+func (m ErrorMatcher) ByOrigin() ErrorMatcher {
+	m.matchOrigin = true
+	return m
+}
+
+// RequireOriginWhenInvalid returns a derived ErrorMatcher which also requires
+// the Origin field to be set when the Type is Invalid and the matcher is
+// matching by Origin.
+func (m ErrorMatcher) RequireOriginWhenInvalid() ErrorMatcher {
+	m.requireOriginWhenInvalid = true
+	return m
+}
+
+// BySource returns a derived ErrorMatcher which also matches by the error origination
+// value of field errors.
+func (m ErrorMatcher) BySource() ErrorMatcher {
+	m.matchSource = true
+	return m
+}
+
+// MatchAncestorShortCircuit returns a derived ErrorMatcher which also matches when the "got" error short-circuited at an ancestor of the "want" error's field path.
+func (m ErrorMatcher) MatchAncestorShortCircuit() ErrorMatcher {
+	m.matchAncestorShortCircuit = true
+	return m
+}
+
+// MatchShortCircuit returns a derived ErrorMatcher which also matches by the ShortCircuit value.
+func (m ErrorMatcher) MatchShortCircuit() ErrorMatcher {
+	m.matchShortCircuit = true
+	return m
+}
+
+// ByValidationStabilityLevel returns a derived ErrorMatcher which also matches by the validation stability level
+// value of field errors.
+func (m ErrorMatcher) ByValidationStabilityLevel() ErrorMatcher {
+	m.matchValidationStabilityLevel = true
+	return m
+}
+
+// ByDetailExact returns a derived ErrorMatcher which also matches errors by
+// the exact detail string.
+func (m ErrorMatcher) ByDetailExact() ErrorMatcher {
+	m.matchDetail = func(want, got string) bool {
+		return got == want
+	}
+	return m
+}
+
+// ByDetailSubstring returns a derived ErrorMatcher which also matches errors
+// by a substring of the detail string.
+func (m ErrorMatcher) ByDetailSubstring() ErrorMatcher {
+	m.matchDetail = func(want, got string) bool {
+		return strings.Contains(got, want)
+	}
+	return m
+}
+
+// ByDetailRegexp returns a derived ErrorMatcher which also matches errors by a
+// regular expression of the detail string, where the "want" string is assumed
+// to be a valid regular expression.
+func (m ErrorMatcher) ByDetailRegexp() ErrorMatcher {
+	m.matchDetail = func(want, got string) bool {
+		return regexp.MustCompile(want).MatchString(got)
+	}
+	return m
+}
+
+// TestIntf lets users pass a testing.T while not coupling this package to Go's
+// testing package.
+type TestIntf interface {
+	Helper()
+	Errorf(format string, args ...any)
+}
+
+// Test compares two ErrorLists by the criteria configured in this matcher, and
+// fails the test if they don't match. The "want" errors are expected to be in
+// the internal API format (latest), while "got" errors may be from any API version
+// and will be normalized if field normalization rules are configured.
+//
+// If matching by origin is enabled and the error has a non-empty origin, a given
+// "want" error can match multiple "got" errors, and they will all be consumed.
+// The only exception to this is if the matcher got multiple identical (in every way,
+// even those not being matched on) errors, which is likely to indicate a bug.
+// This doesn't support matchAncestorShortCircuit as it it not needed to be used in the tests.
+func (m ErrorMatcher) Test(tb TestIntf, want, got ErrorList) {
+	tb.Helper()
+
+	if m.matchAncestorShortCircuit {
+		tb.Errorf("matchAncestorShortCircuit is not supported for test")
+	}
+	exactly := m.Exactly() // makes a copy
+
+	// If we ever find an EXACT duplicate error, it's almost certainly a bug
+	// worth reporting. If we ever find a use-case where this is not a bug, we
+	// can revisit this assumption.
+	seen := map[string]bool{}
+	for _, g := range got {
+		key := exactly.Render(g)
+		if seen[key] {
+			tb.Errorf("exact duplicate error:\n%s", key)
+		}
+		seen[key] = true
+	}
+
+	remaining := got
+	for _, w := range want {
+		tmp := make(ErrorList, 0, len(remaining))
+		matched := false
+		for i, g := range remaining {
+			if m.Matches(w, g) {
+				matched = true
+				if m.matchOrigin && w.Origin != "" {
+					// When origin is included in the match, we allow multiple
+					// matches against the same wanted error, so that tests
+					// can be insulated from the exact number, order, and
+					// wording of cases that might return more than one error.
+					continue
+				} else {
+					// Single-match, save the rest of the "got" errors and move
+					// on to the next "want" error.
+					tmp = append(tmp, remaining[i+1:]...)
+					break
+				}
+			} else {
+				tmp = append(tmp, g)
+			}
+		}
+		if !matched {
+			tb.Errorf("expected an error matching:\n%s", m.Render(w))
+		}
+		remaining = tmp
+	}
+	if len(remaining) > 0 {
+		for _, e := range remaining {
+			tb.Errorf("unmatched error:\n%s", exactly.Render(e))
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/error_matcher_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/error_matcher_test.go
new file mode 100644
index 0000000000..bf7a94e3ae
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/error_matcher_test.go
@@ -0,0 +1,789 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package field
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+func TestErrorMatcher_Matches(t *testing.T) {
+	baseErr := func() *Error {
+		return &Error{
+			Type:     ErrorTypeInvalid,
+			Field:    "field",
+			BadValue: "value",
+			Detail:   "detail",
+			Origin:   "origin",
+		}
+	}
+
+	testCases := []struct {
+		name      string
+		matcher   ErrorMatcher
+		wantedErr func() *Error
+		actualErr *Error
+		matches   bool
+	}{{
+		name:      "ByType: match",
+		matcher:   ErrorMatcher{}.ByType(),
+		wantedErr: baseErr,
+		actualErr: &Error{Type: ErrorTypeInvalid},
+		matches:   true,
+	}, {
+		name:      "ByType: no match",
+		matcher:   ErrorMatcher{}.ByType(),
+		wantedErr: baseErr,
+		actualErr: &Error{Type: ErrorTypeRequired},
+		matches:   false,
+	}, {
+		name:      "ByField: match",
+		matcher:   ErrorMatcher{}.ByField(),
+		wantedErr: baseErr,
+		actualErr: &Error{Field: "field"},
+		matches:   true,
+	}, {
+		name:      "ByField: no match",
+		matcher:   ErrorMatcher{}.ByField(),
+		wantedErr: baseErr,
+		actualErr: &Error{Field: "other"},
+		matches:   false,
+	}, {
+		name: "ByFieldNormalized: older API to latest",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "f[0].x.a"
+			return e
+		},
+		actualErr: &Error{Field: "f[0].a"},
+		matches:   true,
+	}, {
+		name: "ByFieldNormalized: both latest format",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "f[0].x.a"
+			return e
+		},
+		actualErr: &Error{Field: "f[0].x.a"},
+		matches:   true,
+	}, {
+		name: "ByFieldNormalized: different index",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "f[0].x.a"
+			return e
+		},
+		actualErr: &Error{Field: "f[1].a"},
+		matches:   false,
+	}, {
+		name: "ByFieldNormalized: multiple patterns",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.b`), Replacement: "f[$1].x.b"},
+		}),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "f[2].x.b"
+			return e
+		},
+		actualErr: &Error{Field: "f[2].b"},
+		matches:   true,
+	}, {
+		name: "ByFieldNormalized: no normalization needed",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "other.field"
+			return e
+		},
+		actualErr: &Error{Field: "other.field"},
+		matches:   true,
+	}, {
+		name:      "ByValue: match",
+		matcher:   ErrorMatcher{}.ByValue(),
+		wantedErr: baseErr,
+		actualErr: &Error{BadValue: "value"},
+		matches:   true,
+	}, {
+		name:      "ByValue: no match",
+		matcher:   ErrorMatcher{}.ByValue(),
+		wantedErr: baseErr,
+		actualErr: &Error{BadValue: "other"},
+		matches:   false,
+	}, {
+		name:      "ByOrigin: match",
+		matcher:   ErrorMatcher{}.ByOrigin(),
+		wantedErr: baseErr,
+		actualErr: &Error{Origin: "origin"},
+		matches:   true,
+	}, {
+		name:      "ByOrigin: no match",
+		matcher:   ErrorMatcher{}.ByOrigin(),
+		wantedErr: baseErr,
+		actualErr: &Error{Origin: "other"},
+		matches:   false,
+	}, {
+		name:      "ByDetailExact: match",
+		matcher:   ErrorMatcher{}.ByDetailExact(),
+		wantedErr: baseErr,
+		actualErr: &Error{Detail: "detail"},
+		matches:   true,
+	}, {
+		name:      "ByDetailExact: no match",
+		matcher:   ErrorMatcher{}.ByDetailExact(),
+		wantedErr: baseErr,
+		actualErr: &Error{Detail: "other"},
+		matches:   false,
+	}, {
+		name:    "ByDetailSubstring: match empty",
+		matcher: ErrorMatcher{}.ByDetailSubstring(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = ""
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailSubstring: match full",
+		matcher: ErrorMatcher{}.ByDetailSubstring(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "is the"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailSubstring: match start",
+		matcher: ErrorMatcher{}.ByDetailSubstring(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "this is"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailSubstring: match middle",
+		matcher: ErrorMatcher{}.ByDetailSubstring(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "is the"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailSubstring: match end",
+		matcher: ErrorMatcher{}.ByDetailSubstring(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "the detail"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailSubstring: no match",
+		matcher: ErrorMatcher{}.ByDetailSubstring(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "is not the"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   false,
+	}, {
+		name:    "ByDetailRegexp: match empty",
+		matcher: ErrorMatcher{}.ByDetailRegexp(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = ".*"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailRegexp: match full",
+		matcher: ErrorMatcher{}.ByDetailRegexp(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "^this is the detail$"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailRegexp: match start",
+		matcher: ErrorMatcher{}.ByDetailRegexp(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "^this is"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailRegexp: match middle",
+		matcher: ErrorMatcher{}.ByDetailRegexp(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "is the"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailRegexp: match end",
+		matcher: ErrorMatcher{}.ByDetailRegexp(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "the detail$"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailRegexp: match parts",
+		matcher: ErrorMatcher{}.ByDetailRegexp(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "^this .* .* detail$"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailRegexp: no match",
+		matcher: ErrorMatcher{}.ByDetailRegexp(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "is not the"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   false,
+	}, {
+		name:      "Exactly: match",
+		matcher:   ErrorMatcher{}.Exactly(),
+		wantedErr: baseErr,
+		actualErr: baseErr(),
+		matches:   true,
+	}, {
+		name:      "Exactly: no match (type)",
+		matcher:   ErrorMatcher{}.Exactly(),
+		wantedErr: baseErr,
+		actualErr: &Error{Type: ErrorTypeRequired, Field: "field", BadValue: "value", Detail: "detail", Origin: "origin"},
+		matches:   false,
+	}, {
+		name:      "RequireOriginWhenInvalid: match",
+		matcher:   ErrorMatcher{}.ByOrigin().RequireOriginWhenInvalid(),
+		wantedErr: baseErr,
+		actualErr: &Error{Type: ErrorTypeInvalid, Origin: "origin"},
+		matches:   true,
+	}, {
+		name:      "RequireOriginWhenInvalid: no match (missing origin)",
+		matcher:   ErrorMatcher{}.ByOrigin().RequireOriginWhenInvalid(),
+		wantedErr: baseErr,
+		actualErr: &Error{Type: ErrorTypeInvalid},
+		matches:   false,
+	}, {
+		name:    "BySource: match",
+		matcher: ErrorMatcher{}.BySource(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.FromImperative = true
+			return e
+		},
+		actualErr: &Error{FromImperative: true},
+		matches:   true,
+	}, {
+		name:    "BySource: no match",
+		matcher: ErrorMatcher{}.BySource(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.FromImperative = true
+			return e
+		},
+		actualErr: &Error{FromImperative: false},
+		matches:   false,
+	}, {
+		name:    "MatchShortCircuit: match",
+		matcher: ErrorMatcher{}.MatchShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.ShortCircuit = true
+			return e
+		},
+		actualErr: &Error{ShortCircuit: true},
+		matches:   true,
+	}, {
+		name:    "MatchShortCircuit: no match",
+		matcher: ErrorMatcher{}.MatchShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.ShortCircuit = true
+			return e
+		},
+		actualErr: &Error{ShortCircuit: false},
+		matches:   false,
+	}, {
+		name:    "MatchAncestorShortCircuit: child field match",
+		matcher: ErrorMatcher{}.ByType().ByField().MatchAncestorShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "field.child"
+			e.Type = ErrorTypeRequired // child error can be a different type
+			return e
+		},
+		actualErr: &Error{Field: "field", Type: ErrorTypeInvalid, Origin: "immutable", ShortCircuit: true}, // parent error short-circuited
+		matches:   true,
+	}, {
+		name:    "MatchAncestorShortCircuit: array child match",
+		matcher: ErrorMatcher{}.ByType().ByField().MatchAncestorShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "field[0]"
+			e.Type = ErrorTypeRequired
+			return e
+		},
+		actualErr: &Error{Field: "field", Type: ErrorTypeInvalid, Origin: "immutable", ShortCircuit: true},
+		matches:   true,
+	}, {
+		name:    "MatchAncestorShortCircuit: not a child",
+		matcher: ErrorMatcher{}.ByType().ByField().MatchAncestorShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "other.child"
+			return e
+		},
+		actualErr: &Error{Field: "field", Type: ErrorTypeInvalid, Origin: "immutable", ShortCircuit: true},
+		matches:   false,
+	}, {
+		name:    "MatchAncestorShortCircuit: substring but not child",
+		matcher: ErrorMatcher{}.ByType().ByField().MatchAncestorShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "field_other"
+			return e
+		},
+		actualErr: &Error{Field: "field", Type: ErrorTypeInvalid, Origin: "immutable", ShortCircuit: true},
+		matches:   false,
+	}, {
+		name:    "MatchAncestorShortCircuit: parent path is empty string",
+		matcher: ErrorMatcher{}.ByType().ByField().MatchAncestorShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "field.child"
+			return e
+		},
+		actualErr: &Error{Field: "", Type: ErrorTypeInvalid, Origin: "immutable", ShortCircuit: true},
+		matches:   false,
+	}, {
+		name: "MatchAncestorShortCircuit: child field match with normalized parent",
+		matcher: ErrorMatcher{}.ByType().ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}).MatchAncestorShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "f[0].x.a.child"
+			e.Type = ErrorTypeRequired
+			return e
+		},
+		actualErr: &Error{Field: "f[0].a", Type: ErrorTypeInvalid, Origin: "immutable", ShortCircuit: true},
+		matches:   true,
+	}, {
+		name: "MatchAncestorShortCircuit: child field match with unnormalized parent",
+		matcher: ErrorMatcher{}.ByType().ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}).MatchAncestorShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "f[0].a.child"
+			e.Type = ErrorTypeRequired
+			return e
+		},
+		actualErr: &Error{Field: "f[0].a", Type: ErrorTypeInvalid, Origin: "immutable", ShortCircuit: true},
+		matches:   true,
+	}}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.matcher.Matches(tc.wantedErr(), tc.actualErr) != tc.matches {
+				t.Errorf("Matches() = %v, want %v", !tc.matches, tc.matches)
+			}
+		})
+	}
+}
+
+// fakeTestIntf is used to test the testing support.
+type fakeTestIntf struct {
+	errs []string
+}
+
+var _ TestIntf = &fakeTestIntf{}
+
+func (*fakeTestIntf) Helper() {}
+
+func (ft *fakeTestIntf) Errorf(format string, args ...any) {
+	ft.errs = append(ft.errs, fmt.Sprintf(format, args...))
+}
+
+func TestErrorMatcher_Test(t *testing.T) {
+	testCases := []struct {
+		name           string
+		matcher        ErrorMatcher
+		want           ErrorList
+		got            ErrorList
+		expectedErrors []string
+		expectedLogs   []string
+	}{{
+		name:    "no origin: perfect match",
+		matcher: ErrorMatcher{}.ByField(),
+		want:    ErrorList{Invalid(NewPath("f"), nil, "")},
+		got:     ErrorList{Invalid(NewPath("f"), "v", "d")},
+	}, {
+		name:           "no origin: got too few errors",
+		matcher:        ErrorMatcher{}.ByField(),
+		want:           ErrorList{Invalid(NewPath("f"), nil, "")},
+		got:            ErrorList{},
+		expectedErrors: []string{"expected an error matching:"},
+	}, {
+		name:           "no origin: got too many errors",
+		matcher:        ErrorMatcher{}.ByField(),
+		want:           ErrorList{},
+		got:            ErrorList{Invalid(NewPath("f"), "v", "d")},
+		expectedErrors: []string{"unmatched error:"},
+	}, {
+		name:           "no origin: got wrong errors",
+		matcher:        ErrorMatcher{}.ByField(),
+		want:           ErrorList{Invalid(NewPath("f1"), nil, "")},
+		got:            ErrorList{Invalid(NewPath("f2"), "v", "d")},
+		expectedErrors: []string{"expected an error matching:", "unmatched error:"},
+	}, {
+		name: "with normalization: older API to latest",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}),
+		want: ErrorList{Invalid(NewPath("f").Index(0).Child("x", "a"), nil, "")},
+		got:  ErrorList{Invalid(NewPath("f").Index(0).Child("a"), "v", "d")},
+	}, {
+		name: "with normalization: both latest",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}),
+		want: ErrorList{Invalid(NewPath("f").Index(0).Child("x", "a"), nil, "")},
+		got:  ErrorList{Invalid(NewPath("f").Index(0).Child("x", "a"), "v", "d")},
+	}, {
+		name: "with normalization: multiple",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.b`), Replacement: "f[$1].x.b"},
+		}),
+		want: ErrorList{
+			Invalid(NewPath("f").Index(0).Child("x", "a"), nil, ""),
+			Invalid(NewPath("f").Index(1).Child("x", "b"), nil, ""),
+		},
+		got: ErrorList{
+			Invalid(NewPath("f").Index(0).Child("a"), "v1", "d1"),
+			Invalid(NewPath("f").Index(1).Child("b"), "v2", "d2"),
+		},
+	}, {
+		name: "with normalization: no match",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}),
+		want:           ErrorList{Invalid(NewPath("f").Index(0).Child("x", "a"), nil, "")},
+		got:            ErrorList{Invalid(NewPath("f").Index(1).Child("a"), "v", "d")},
+		expectedErrors: []string{"expected an error matching:", "unmatched error:"},
+	}, {
+		name:    "validation level: match",
+		matcher: ErrorMatcher{}.ByValidationStabilityLevel(),
+		want:    ErrorList{{}}.MarkAlpha(),
+		got:     ErrorList{{}}.MarkAlpha(),
+	}, {
+		name:           "validation level: no match",
+		matcher:        ErrorMatcher{}.ByValidationStabilityLevel(),
+		want:           ErrorList{{}}.MarkAlpha(),
+		got:            ErrorList{{}}.MarkBeta(),
+		expectedErrors: []string{"expected an error matching:", "unmatched error:"},
+	}, {
+		name:    "by source: match",
+		matcher: ErrorMatcher{}.BySource(),
+		want:    ErrorList{{FromImperative: true}},
+		got:     ErrorList{{FromImperative: true}},
+	}, {
+		name:           "by source: no match",
+		matcher:        ErrorMatcher{}.BySource(),
+		want:           ErrorList{{FromImperative: true}},
+		got:            ErrorList{{FromImperative: false}},
+		expectedErrors: []string{"expected an error matching:", "unmatched error:"},
+	}, {
+		name:    "with origin: single match",
+		matcher: ErrorMatcher{}.ByField().ByOrigin(),
+		want:    ErrorList{Invalid(NewPath("f"), nil, "").WithOrigin("o")},
+		got:     ErrorList{Invalid(NewPath("f"), "v", "d").WithOrigin("o")},
+	}, {
+		name:    "with origin: multiple matches, different details",
+		matcher: ErrorMatcher{}.ByField().ByOrigin(),
+		want: ErrorList{
+			Invalid(NewPath("f1"), nil, "").WithOrigin("o"),
+			Invalid(NewPath("f2"), nil, "").WithOrigin("o"),
+		},
+		got: ErrorList{
+			Invalid(NewPath("f1"), "v", "d1").WithOrigin("o"),
+			Invalid(NewPath("f2"), "v", "d1").WithOrigin("o"),
+			Invalid(NewPath("f1"), "v", "d2").WithOrigin("o"),
+			Invalid(NewPath("f2"), "v", "d2").WithOrigin("o"),
+		},
+	}, {
+		name:    "with origin: multiple matches, same exact error",
+		matcher: ErrorMatcher{}.ByField().ByOrigin(),
+		want: ErrorList{
+			Invalid(NewPath("f1"), nil, "").WithOrigin("o"),
+			Invalid(NewPath("f2"), nil, "").WithOrigin("o"),
+		},
+		got: ErrorList{
+			Invalid(NewPath("f1"), "v", "d").WithOrigin("o"),
+			Invalid(NewPath("f1"), "v", "d").WithOrigin("o"),
+			Invalid(NewPath("f2"), "v", "d").WithOrigin("o"),
+			Invalid(NewPath("f2"), "v", "d").WithOrigin("o"),
+		},
+		expectedErrors: []string{"exact duplicate error:", "exact duplicate error:"},
+	}, {
+		name:    "match short circuit: match",
+		matcher: ErrorMatcher{}.MatchShortCircuit(),
+		want:    ErrorList{{ShortCircuit: true}},
+		got:     ErrorList{{ShortCircuit: true}},
+	}, {
+		name:           "match short circuit: no match",
+		matcher:        ErrorMatcher{}.MatchShortCircuit(),
+		want:           ErrorList{{ShortCircuit: true}},
+		got:            ErrorList{{ShortCircuit: false}},
+		expectedErrors: []string{"expected an error matching:", "unmatched error:"},
+	}}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			fakeT := &fakeTestIntf{}
+			tc.matcher.Test(fakeT, tc.want, tc.got)
+			if want, got := len(tc.expectedErrors), len(fakeT.errs); got != want {
+				if got == 0 {
+					t.Errorf("expected %d errors, got %d", want, got)
+				} else {
+					q := make([]string, len(fakeT.errs))
+					for i, err := range fakeT.errs {
+						q[i] = fmt.Sprintf("%q", err)
+					}
+					t.Errorf("expected %d errors, got %d:\n%s", want, got, strings.Join(q, "\n"))
+				}
+			} else {
+				for i := range tc.expectedErrors {
+					if !strings.HasPrefix(fakeT.errs[i], tc.expectedErrors[i]) {
+						t.Errorf("error %d: expected prefix %q, got %q", i, tc.expectedErrors[i], fakeT.errs[i])
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestErrorMatcher_Render(t *testing.T) {
+	testCases := []struct {
+		name     string
+		matcher  ErrorMatcher
+		err      *Error
+		expected string
+	}{
+		{
+			name:     "empty matcher",
+			matcher:  ErrorMatcher{},
+			err:      Invalid(NewPath("field"), "value", "detail"),
+			expected: "{}",
+		},
+		{
+			name:     "single field - type",
+			matcher:  ErrorMatcher{}.ByType(),
+			err:      Invalid(NewPath("field"), "value", "detail"),
+			expected: `{Type="Invalid value"}`,
+		},
+		{
+			name:     "single field - value with string",
+			matcher:  ErrorMatcher{}.ByValue(),
+			err:      Invalid(NewPath("field"), "string_value", "detail"),
+			expected: `{Value="string_value"}`,
+		},
+		{
+			name:     "single field - value with nil",
+			matcher:  ErrorMatcher{}.ByValue(),
+			err:      Invalid(NewPath("field"), nil, "detail"),
+			expected: `{Value=<nil>}`,
+		},
+		{
+			name:     "multiple fields",
+			matcher:  ErrorMatcher{}.ByType().ByField().ByValue(),
+			err:      Invalid(NewPath("field"), "value", "detail"),
+			expected: `{Type="Invalid value", Field="field", Value="value"}`,
+		},
+		{
+			name:     "all fields",
+			matcher:  ErrorMatcher{}.ByType().ByField().ByValue().ByOrigin().ByDetailExact(),
+			err:      Invalid(NewPath("field"), "value", "detail").WithOrigin("origin"),
+			expected: `{Type="Invalid value", Field="field", Value="value", Origin="origin", Detail="detail"}`,
+		},
+		{
+			name: "with normalization: normalized",
+			matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+				{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+			}),
+			err:      Invalid(NewPath("f").Index(0).Child("a"), "value", "detail"),
+			expected: `{Field="f[0].x.a" (aka "f[0].a")}`,
+		},
+		{
+			name: "with normalization: no normalization",
+			matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+				{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+			}),
+			err:      Invalid(NewPath("other", "field"), "value", "detail"),
+			expected: `{Field="other.field"}`,
+		},
+		{
+			name: "with normalization: already normalized",
+			matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+				{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+			}),
+			err:      Invalid(NewPath("f").Index(0).Child("x", "a"), "value", "detail"),
+			expected: `{Field="f[0].x.a"}`,
+		},
+		{
+			name:     "requireOriginWhenInvalid with origin",
+			matcher:  ErrorMatcher{}.ByOrigin().RequireOriginWhenInvalid(),
+			err:      Invalid(NewPath("field"), "value", "detail").WithOrigin("origin"),
+			expected: `{Origin="origin"}`,
+		},
+		{
+			name:     "different error types",
+			matcher:  ErrorMatcher{}.ByType().ByValue(),
+			err:      Required(NewPath("field"), "detail"),
+			expected: `{Type="Required value", Value=""}`,
+		},
+		{
+			name:    "with from imperative",
+			matcher: ErrorMatcher{}.BySource(),
+			err: func() *Error {
+				e := Invalid(NewPath("field"), "value", "detail")
+				e.FromImperative = true
+				return e
+			}(),
+			expected: `{FromImperative=true}`,
+		},
+		{
+			name:    "all fields with from imperative",
+			matcher: ErrorMatcher{}.ByType().ByField().ByValue().ByOrigin().ByDetailExact().BySource(),
+			err: func() *Error {
+				e := Invalid(NewPath("field"), "value", "detail").WithOrigin("origin")
+				e.FromImperative = true
+				return e
+			}(),
+			expected: `{Type="Invalid value", Field="field", Value="value", Origin="origin", Detail="detail", FromImperative=true}`,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := tc.matcher.Render(tc.err)
+			if result != tc.expected {
+				t.Errorf("Render() = %v, want %v", result, tc.expected)
+			}
+		})
+	}
+}
+
+func TestIsChildPath(t *testing.T) {
+	testCases := []struct {
+		name     string
+		parent   string
+		child    string
+		expected bool
+	}{
+		{
+			name:     "child is a descendant array element",
+			parent:   "spec.containers",
+			child:    "spec.containers[0]",
+			expected: true,
+		},
+		{
+			name:     "child is a subfield",
+			parent:   "spec.container",
+			child:    "spec.container.name",
+			expected: true,
+		},
+		{
+			name:     "not a child, just common prefix",
+			parent:   "spec.container",
+			child:    "spec.containers",
+			expected: false,
+		},
+		{
+			name:     "parent is empty",
+			parent:   "",
+			child:    "spec.containers",
+			expected: false,
+		},
+		{
+			name:     "child is shorter than parent",
+			parent:   "spec.containers",
+			child:    "spec",
+			expected: false,
+		},
+		{
+			name:     "child is equal to parent",
+			parent:   "spec.containers",
+			child:    "spec.containers",
+			expected: false,
+		},
+		{
+			name:     "child does not match parent prefix",
+			parent:   "spec.containers",
+			child:    "status.conditions",
+			expected: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := isChildPath(tc.parent, tc.child)
+			if result != tc.expected {
+				t.Errorf("isChildPath(%q, %q) = %v, want %v", tc.parent, tc.child, result, tc.expected)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/errors.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/errors.go
new file mode 100644
index 0000000000..0d00acb42d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/errors.go
@@ -0,0 +1,635 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package field
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// Error is an implementation of the 'error' interface, which represents a
+// field-level validation error.
+type Error struct {
+	Type     ErrorType
+	Field    string
+	BadValue interface{}
+	Detail   string
+
+	// Origin uniquely identifies where this error was generated from. It is used in testing to
+	// compare expected errors against actual errors without relying on exact detail string matching.
+	// This allows tests to verify the correct validation logic triggered the error
+	// regardless of how the error message might be formatted or localized.
+	//
+	// The value should be either:
+	// - A simple camelCase identifier (e.g., "maximum", "maxItems")
+	// - A structured format using "format=<dash-style-identifier>" for validation errors related to specific formats
+	//   (e.g. "format=k8s-short-name")
+	//
+	// If the Origin corresponds to an existing declarative validation tag or JSON Schema keyword,
+	// use that same name for consistency.
+	//
+	// Origin should be set in the most deeply nested validation function that
+	// can still identify the unique source of the error.
+	Origin string
+
+	// CoveredByDeclarative is true when this error is covered by declarative
+	// validation. This field is to identify errors from imperative validation
+	// that should also be caught by declarative validation.
+	CoveredByDeclarative bool
+
+	// FromImperative denotes these errors are originating from  the hand written validations.
+	FromImperative bool
+
+	// ShortCircuit denotes that this error prevents further validation of the current field's children.
+	ShortCircuit bool
+
+	// ShortCircuitedInDeclarative denotes this error is covered by declarative validation. But not returned by declarative validation due to a short circuiting behavior for the current input.
+	ShortCircuitedInDeclarative bool
+
+	// ValidationStabilityLevel denotes the validation stability level of the declarative validation from this error is returned. This should be used in the declarative validations only.
+	ValidationStabilityLevel ValidationStabilityLevel
+}
+
+// ValidationStabilityLevel denotes the stability level of a validation.
+type ValidationStabilityLevel int
+
+const (
+	stabilityLevelUnknown ValidationStabilityLevel = iota
+	stabilityLevelAlpha
+	stabilityLevelBeta
+)
+
+func (v ValidationStabilityLevel) String() string {
+	switch v {
+	case stabilityLevelAlpha:
+		return "alpha"
+	case stabilityLevelBeta:
+		return "beta"
+	default:
+		return "unknown"
+	}
+}
+
+var _ error = &Error{}
+
+// IsAlpha returns true if the error is an alpha validation error.
+func (e *Error) IsAlpha() bool {
+	return e.ValidationStabilityLevel == stabilityLevelAlpha
+}
+
+// IsBeta returns true if the error is a beta validation error.
+func (e *Error) IsBeta() bool {
+	return e.ValidationStabilityLevel == stabilityLevelBeta
+}
+
+// Error implements the error interface.
+func (e *Error) Error() string {
+	return fmt.Sprintf("%s: %s", e.Field, e.ErrorBody())
+}
+
+type OmitValueType struct{}
+
+var omitValue = OmitValueType{}
+
+// ErrorBody returns the error message without the field name.  This is useful
+// for building nice-looking higher-level error reporting.
+func (e *Error) ErrorBody() string {
+	var s string
+	switch e.Type {
+	case ErrorTypeRequired, ErrorTypeForbidden, ErrorTypeTooLong, ErrorTypeTooShort, ErrorTypeInternal:
+		s = e.Type.String()
+	case ErrorTypeInvalid, ErrorTypeTypeInvalid, ErrorTypeNotSupported,
+		ErrorTypeNotFound, ErrorTypeDuplicate, ErrorTypeTooMany, ErrorTypeTooFew:
+		if e.BadValue == omitValue {
+			s = e.Type.String()
+			break
+		}
+		switch t := e.BadValue.(type) {
+		case int64, int32, float64, float32, bool:
+			// use simple printer for simple types
+			s = fmt.Sprintf("%s: %v", e.Type, t)
+		case string:
+			s = fmt.Sprintf("%s: %q", e.Type, t)
+		default:
+			// use more complex techniques to render more complex types
+			valstr := ""
+			jb, err := json.Marshal(e.BadValue)
+			if err == nil {
+				// best case
+				valstr = string(jb)
+			} else if stringer, ok := e.BadValue.(fmt.Stringer); ok {
+				// anything that defines String() is better than raw struct
+				valstr = stringer.String()
+			} else {
+				// worst case - fallback to raw struct
+				// TODO: internal types have panic guards against json.Marshalling to prevent
+				// accidental use of internal types in external serialized form.  For now, use
+				// %#v, although it would be better to show a more expressive output in the future
+				valstr = fmt.Sprintf("%#v", e.BadValue)
+			}
+			s = fmt.Sprintf("%s: %s", e.Type, valstr)
+		}
+	default:
+		internal := InternalError(nil, fmt.Errorf("unhandled error code: %s: please report this", e.Type))
+		s = internal.ErrorBody()
+	}
+	if len(e.Detail) != 0 {
+		s += fmt.Sprintf(": %s", e.Detail)
+	}
+
+	return s
+}
+
+// WithOrigin adds origin information to the FieldError
+func (e *Error) WithOrigin(o string) *Error {
+	e.Origin = o
+	return e
+}
+
+// MarkCoveredByDeclarative marks the error as covered by declarative validation.
+func (e *Error) MarkCoveredByDeclarative() *Error {
+	e.CoveredByDeclarative = true
+	return e
+}
+
+// ErrorType is a machine readable value providing more detail about why
+// a field is invalid.  These values are expected to match 1-1 with
+// CauseType in api/types.go.
+type ErrorType string
+
+// TODO: These values are duplicated in api/types.go, but there's a circular dep.  Fix it.
+const (
+	// ErrorTypeNotFound is used to report failure to find a requested value
+	// (e.g. looking up an ID).  See NotFound().
+	ErrorTypeNotFound ErrorType = "FieldValueNotFound"
+	// ErrorTypeRequired is used to report required values that are not
+	// provided (e.g. empty strings, null values, or empty arrays).  See
+	// Required().
+	ErrorTypeRequired ErrorType = "FieldValueRequired"
+	// ErrorTypeDuplicate is used to report collisions of values that must be
+	// unique (e.g. unique IDs).  See Duplicate().
+	ErrorTypeDuplicate ErrorType = "FieldValueDuplicate"
+	// ErrorTypeInvalid is used to report malformed values (e.g. failed regex
+	// match, too long, out of bounds).  See Invalid().
+	ErrorTypeInvalid ErrorType = "FieldValueInvalid"
+	// ErrorTypeNotSupported is used to report unknown values for enumerated
+	// fields (e.g. a list of valid values).  See NotSupported().
+	ErrorTypeNotSupported ErrorType = "FieldValueNotSupported"
+	// ErrorTypeForbidden is used to report valid (as per formatting rules)
+	// values which would be accepted under some conditions, but which are not
+	// permitted by the current conditions (such as security policy).  See
+	// Forbidden().
+	ErrorTypeForbidden ErrorType = "FieldValueForbidden"
+	// ErrorTypeTooLong is used to report that the given value is too long.
+	// This is similar to ErrorTypeInvalid, but the error will not include the
+	// too-long value.  See TooLong().
+	ErrorTypeTooLong ErrorType = "FieldValueTooLong"
+	// ErrorTypeTooMany is used to report "too many". This is used to
+	// report that a given list has too many items. This is similar to FieldValueTooLong,
+	// but the error indicates quantity instead of length.
+	ErrorTypeTooMany ErrorType = "FieldValueTooMany"
+	// ErrorTypeTooFew is used to report "too few". This is used to
+	// report that a given list has too few items. This is similar to FieldValueTooLong,
+	// but the error indicates quantity instead of length.
+	ErrorTypeTooFew ErrorType = "FieldValueTooFew"
+	// ErrorTypeInternal is used to report other errors that are not related
+	// to user input.  See InternalError().
+	ErrorTypeInternal ErrorType = "InternalError"
+	// ErrorTypeTypeInvalid is for the value did not match the schema type for that field
+	ErrorTypeTypeInvalid ErrorType = "FieldValueTypeInvalid"
+	// ErrorTypeTooShort is used to report that the given value is too short.
+	// This is similar to ErrorTypeInvalid. See TooShort().
+	ErrorTypeTooShort ErrorType = "FieldValueTooShort"
+)
+
+// String converts a ErrorType into its corresponding canonical error message.
+func (t ErrorType) String() string {
+	switch t {
+	case ErrorTypeNotFound:
+		return "Not found"
+	case ErrorTypeRequired:
+		return "Required value"
+	case ErrorTypeDuplicate:
+		return "Duplicate value"
+	case ErrorTypeInvalid:
+		return "Invalid value"
+	case ErrorTypeNotSupported:
+		return "Unsupported value"
+	case ErrorTypeForbidden:
+		return "Forbidden"
+	case ErrorTypeTooLong:
+		return "Too long"
+	case ErrorTypeTooMany:
+		return "Too many"
+	case ErrorTypeTooFew:
+		return "Too few"
+	case ErrorTypeInternal:
+		return "Internal error"
+	case ErrorTypeTypeInvalid:
+		return "Invalid value"
+	case ErrorTypeTooShort:
+		return "Too short"
+	default:
+		return fmt.Sprintf("<unknown error %q>", string(t))
+	}
+}
+
+// TypeInvalid returns a *Error indicating "type is invalid"
+func TypeInvalid(field *Path, value interface{}, detail string) *Error {
+	return &Error{
+		Type:     ErrorTypeTypeInvalid,
+		Field:    field.String(),
+		BadValue: value,
+		Detail:   detail,
+	}
+}
+
+// NotFound returns a *Error indicating "value not found".  This is
+// used to report failure to find a requested value (e.g. looking up an ID).
+func NotFound(field *Path, value interface{}) *Error {
+	return &Error{
+		Type:     ErrorTypeNotFound,
+		Field:    field.String(),
+		BadValue: value,
+	}
+}
+
+// Required returns a *Error indicating "value required".  This is used
+// to report required values that are not provided (e.g. empty strings, null
+// values, or empty arrays).
+func Required(field *Path, detail string) *Error {
+	return &Error{
+		Type:     ErrorTypeRequired,
+		Field:    field.String(),
+		Detail:   detail,
+		BadValue: "",
+	}
+}
+
+// Duplicate returns a *Error indicating "duplicate value".  This is
+// used to report collisions of values that must be unique (e.g. names or IDs).
+func Duplicate(field *Path, value interface{}) *Error {
+	return &Error{
+		Type:     ErrorTypeDuplicate,
+		Field:    field.String(),
+		BadValue: value,
+	}
+}
+
+// Invalid returns a *Error indicating "invalid value".  This is used
+// to report malformed values (e.g. failed regex match, too long, out of bounds).
+func Invalid(field *Path, value interface{}, detail string) *Error {
+	return &Error{
+		Type:     ErrorTypeInvalid,
+		Field:    field.String(),
+		BadValue: value,
+		Detail:   detail,
+	}
+
+}
+
+// NotSupported returns a *Error indicating "unsupported value".
+// This is used to report unknown values for enumerated fields (e.g. a list of
+// valid values).
+func NotSupported[T ~string](field *Path, value interface{}, validValues []T) *Error {
+	detail := ""
+	if len(validValues) > 0 {
+		quotedValues := make([]string, len(validValues))
+		for i, v := range validValues {
+			quotedValues[i] = strconv.Quote(fmt.Sprint(v))
+		}
+		detail = "supported values: " + strings.Join(quotedValues, ", ")
+	}
+	return &Error{
+		Type:     ErrorTypeNotSupported,
+		Field:    field.String(),
+		BadValue: value,
+		Detail:   detail,
+	}
+}
+
+// Forbidden returns a *Error indicating "forbidden".  This is used to
+// report valid (as per formatting rules) values which would be accepted under
+// some conditions, but which are not permitted by current conditions (e.g.
+// security policy).
+func Forbidden(field *Path, detail string) *Error {
+	return &Error{
+		Type:     ErrorTypeForbidden,
+		Field:    field.String(),
+		Detail:   detail,
+		BadValue: "",
+	}
+}
+
+// TooLong returns a *Error indicating "too long".  This is used to report that
+// the given value is too long.  This is similar to Invalid, but the returned
+// error will not include the too-long value. If maxLength is negative, it will
+// be included in the message.  The value argument is not used.
+func TooLong(field *Path, _ interface{}, maxLength int) *Error {
+	var msg string
+	if maxLength >= 0 {
+		bs := "bytes"
+		if maxLength == 1 {
+			bs = "byte"
+		}
+		msg = fmt.Sprintf("may not be more than %d %s", maxLength, bs)
+	} else {
+		msg = "value is too long"
+	}
+	return &Error{
+		Type:     ErrorTypeTooLong,
+		Field:    field.String(),
+		BadValue: "<value omitted>",
+		Detail:   msg,
+	}
+}
+
+// TooLongCharacters returns a *Error indicating "too long".  This is used to report that
+// the given value is too long in characters (including multi-byte characters).
+// This is similar to Invalid, but the returned  error will not include the too-long value.
+// If maxLength is negative, it will be included in the message. The value argument is not used.
+func TooLongCharacters[T ~string](field *Path, _ T, maxLength int) *Error {
+	var msg string
+	if maxLength >= 0 {
+		bs := "characters"
+		if maxLength == 1 {
+			bs = "character"
+		}
+		msg = fmt.Sprintf("may not be more than %d %s", maxLength, bs)
+	} else {
+		msg = "value is too long"
+	}
+	return &Error{
+		Type:     ErrorTypeTooLong,
+		Field:    field.String(),
+		BadValue: "<value omitted>",
+		Detail:   msg,
+	}
+}
+
+// TooLongMaxLength returns a *Error indicating "too long".
+// Deprecated: Use TooLong instead.
+func TooLongMaxLength(field *Path, value interface{}, maxLength int) *Error {
+	return TooLong(field, "", maxLength)
+}
+
+// TooMany returns a *Error indicating "too many". This is used to
+// report that a given list has too many items. This is similar to TooLong,
+// but the returned error indicates quantity instead of length.
+func TooMany(field *Path, actualQuantity, maxQuantity int) *Error {
+	var msg string
+
+	if maxQuantity >= 0 {
+		is := "items"
+		if maxQuantity == 1 {
+			is = "item"
+		}
+		msg = fmt.Sprintf("must have at most %d %s", maxQuantity, is)
+	} else {
+		msg = "has too many items"
+	}
+
+	var actual interface{}
+	if actualQuantity >= 0 {
+		actual = actualQuantity
+	} else {
+		actual = omitValue
+	}
+
+	return &Error{
+		Type:     ErrorTypeTooMany,
+		Field:    field.String(),
+		BadValue: actual,
+		Detail:   msg,
+	}
+}
+
+// InternalError returns a *Error indicating "internal error".  This is used
+// to signal that an error was found that was not directly related to user
+// input.  The err argument must be non-nil.
+func InternalError(field *Path, err error) *Error {
+	return &Error{
+		Type:     ErrorTypeInternal,
+		Field:    field.String(),
+		BadValue: err,
+		Detail:   err.Error(),
+	}
+}
+
+// TooShort returns a *Error indicating "too short".  This is used to report that
+// the given value is too short in characters. This is similar to Invalid.
+// If minLength is non-negative, it will  be included in the message.
+func TooShort[T ~string](field *Path, value T, minLength int) *Error {
+	var msg string
+	if minLength >= 0 {
+		bs := "characters"
+		if minLength == 1 {
+			bs = "character"
+		}
+		msg = fmt.Sprintf("must be at least %d %s", minLength, bs)
+	} else {
+		msg = "value is too short"
+	}
+	return &Error{
+		Type:     ErrorTypeTooShort,
+		Field:    field.String(),
+		BadValue: value,
+		Detail:   msg,
+	}
+}
+
+// ErrorList holds a set of Errors.  It is plausible that we might one day have
+// non-field errors in this same umbrella package, but for now we don't, so
+// we can keep it simple and leave ErrorList here.
+type ErrorList []*Error
+
+// NewErrorTypeMatcher returns an errors.Matcher that returns true
+// if the provided error is a Error and has the provided ErrorType.
+func NewErrorTypeMatcher(t ErrorType) utilerrors.Matcher {
+	return func(err error) bool {
+		if e, ok := err.(*Error); ok {
+			return e.Type == t
+		}
+		return false
+	}
+}
+
+// WithOrigin sets the origin for all errors in the list and returns the updated list.
+func (list ErrorList) WithOrigin(origin string) ErrorList {
+	for _, err := range list {
+		err.Origin = origin
+	}
+	return list
+}
+
+// MarkCoveredByDeclarative marks all errors in the list as covered by declarative validation.
+func (list ErrorList) MarkCoveredByDeclarative() ErrorList {
+	for _, err := range list {
+		err.CoveredByDeclarative = true
+	}
+	return list
+}
+
+// PrefixDetail adds a prefix to the Detail for all errors in the list and returns the updated list.
+func (list ErrorList) PrefixDetail(prefix string) ErrorList {
+	for _, err := range list {
+		err.Detail = prefix + err.Detail
+	}
+	return list
+}
+
+// ToAggregate converts the ErrorList into an errors.Aggregate.
+func (list ErrorList) ToAggregate() utilerrors.Aggregate {
+	if len(list) == 0 {
+		return nil
+	}
+	errs := make([]error, 0, len(list))
+	errorMsgs := sets.NewString()
+	for _, err := range list {
+		msg := fmt.Sprintf("%v", err)
+		if errorMsgs.Has(msg) {
+			continue
+		}
+		errorMsgs.Insert(msg)
+		errs = append(errs, err)
+	}
+	return utilerrors.NewAggregate(errs)
+}
+
+func fromAggregate(agg utilerrors.Aggregate) ErrorList {
+	errs := agg.Errors()
+	list := make(ErrorList, len(errs))
+	for i := range errs {
+		list[i] = errs[i].(*Error)
+	}
+	return list
+}
+
+// Filter removes items from the ErrorList that match the provided fns.
+func (list ErrorList) Filter(fns ...utilerrors.Matcher) ErrorList {
+	err := utilerrors.FilterOut(list.ToAggregate(), fns...)
+	if err == nil {
+		return nil
+	}
+	// FilterOut takes an Aggregate and returns an Aggregate
+	return fromAggregate(err.(utilerrors.Aggregate))
+}
+
+// ExtractCoveredByDeclarative returns a new ErrorList containing only the errors that should be covered by declarative validation.
+func (list ErrorList) ExtractCoveredByDeclarative() ErrorList {
+	newList := ErrorList{}
+	for _, err := range list {
+		if err.CoveredByDeclarative {
+			newList = append(newList, err)
+		}
+	}
+	return newList
+}
+
+// MarkAlpha marks the error as an alpha validation error.
+func (e *Error) MarkAlpha() *Error {
+	e.ValidationStabilityLevel = stabilityLevelAlpha
+	return e
+}
+
+// MarkShortCircuitedInDV marks that this error is not returned by declarative validations, because DV returns before running the current validation. Handwritten validations still return it.
+func (e *Error) MarkShortCircuitedInDV() *Error {
+	e.ShortCircuitedInDeclarative = true
+	return e
+}
+
+// MarkAlpha marks the errors as alpha validation errors.
+func (list ErrorList) MarkAlpha() ErrorList {
+	for _, err := range list {
+		err.ValidationStabilityLevel = stabilityLevelAlpha
+	}
+	return list
+}
+
+// MarkBeta marks the error as a beta validation error.
+func (e *Error) MarkBeta() *Error {
+	e.ValidationStabilityLevel = stabilityLevelBeta
+	return e
+}
+
+// MarkBeta marks the errors as beta validation errors.
+func (list ErrorList) MarkBeta() ErrorList {
+	for _, err := range list {
+		err.ValidationStabilityLevel = stabilityLevelBeta
+	}
+	return list
+}
+
+func (e *Error) MarkFromImperative() *Error {
+	e.FromImperative = true
+	return e
+}
+
+func (list ErrorList) MarkFromImperative() ErrorList {
+	for _, err := range list {
+		err.FromImperative = true
+	}
+	return list
+}
+
+// MarkShortCircuit marks the errors as short-circuit errors.
+func (list ErrorList) MarkShortCircuit() ErrorList {
+	for _, err := range list {
+		err.ShortCircuit = true
+	}
+	return list
+}
+
+// RemoveCoveredByDeclarative returns a new ErrorList containing only the errors that should not be covered by declarative validation.
+func (list ErrorList) RemoveCoveredByDeclarative() ErrorList {
+	newList := ErrorList{}
+	for _, err := range list {
+		if !err.CoveredByDeclarative {
+			newList = append(newList, err)
+		}
+	}
+	return newList
+}
+
+// TooFew returns a *Error indicating "too few". This is used to
+// report that a given list has too few items. This is similar to TooLong,
+// but the returned error indicates quantity instead of length.
+func TooFew(field *Path, actualQuantity, minQuantity int) *Error {
+	var msg string
+
+	if minQuantity >= 0 {
+		is := "items"
+		if minQuantity == 1 {
+			is = "item"
+		}
+		msg = fmt.Sprintf("must have at least %d %s", minQuantity, is)
+	} else {
+		msg = "has too few items"
+	}
+
+	return &Error{
+		Type:     ErrorTypeTooFew,
+		Field:    field.String(),
+		BadValue: actualQuantity,
+		Detail:   msg,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/errors_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/errors_test.go
new file mode 100644
index 0000000000..229595d900
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/errors_test.go
@@ -0,0 +1,725 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package field
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+	"time"
+
+	"k8s.io/utils/ptr"
+)
+
+func TestMakeFuncs(t *testing.T) {
+	testCases := []struct {
+		fn       func() *Error
+		expected ErrorType
+	}{
+		{
+			func() *Error { return Invalid(NewPath("f"), "v", "d") },
+			ErrorTypeInvalid,
+		},
+		{
+			func() *Error { return NotSupported[string](NewPath("f"), "v", nil) },
+			ErrorTypeNotSupported,
+		},
+		{
+			func() *Error { return Duplicate(NewPath("f"), "v") },
+			ErrorTypeDuplicate,
+		},
+		{
+			func() *Error { return NotFound(NewPath("f"), "v") },
+			ErrorTypeNotFound,
+		},
+		{
+			func() *Error { return Required(NewPath("f"), "d") },
+			ErrorTypeRequired,
+		},
+		{
+			func() *Error { return InternalError(NewPath("f"), fmt.Errorf("e")) },
+			ErrorTypeInternal,
+		},
+	}
+
+	for _, testCase := range testCases {
+		err := testCase.fn()
+		if err.Type != testCase.expected {
+			t.Errorf("expected Type %q, got %q", testCase.expected, err.Type)
+		}
+	}
+}
+
+func TestToAggregate(t *testing.T) {
+	testCases := struct {
+		ErrList         []ErrorList
+		NumExpectedErrs []int
+	}{
+		[]ErrorList{
+			nil,
+			{},
+			{Invalid(NewPath("f"), "v", "d")},
+			{Invalid(NewPath("f"), "v", "d"), Invalid(NewPath("f"), "v", "d")},
+			{Invalid(NewPath("f"), "v", "d"), InternalError(NewPath(""), fmt.Errorf("e"))},
+		},
+		[]int{
+			0,
+			0,
+			1,
+			1,
+			2,
+		},
+	}
+
+	if len(testCases.ErrList) != len(testCases.NumExpectedErrs) {
+		t.Errorf("Mismatch: length of NumExpectedErrs does not match length of ErrList")
+	}
+	for i, tc := range testCases.ErrList {
+		agg := tc.ToAggregate()
+		numErrs := 0
+
+		if agg != nil {
+			numErrs = len(agg.Errors())
+		}
+		if numErrs != testCases.NumExpectedErrs[i] {
+			t.Errorf("[%d] Expected %d, got %d", i, testCases.NumExpectedErrs[i], numErrs)
+		}
+
+		if len(tc) == 0 {
+			if agg != nil {
+				t.Errorf("[%d] Expected nil, got %#v", i, agg)
+			}
+		} else if agg == nil {
+			t.Errorf("[%d] Expected non-nil", i)
+		}
+	}
+}
+
+func TestErrListFilter(t *testing.T) {
+	list := ErrorList{
+		Invalid(NewPath("test.field"), "", ""),
+		Invalid(NewPath("field.test"), "", ""),
+		Duplicate(NewPath("test"), "value"),
+	}
+	if len(list.Filter(NewErrorTypeMatcher(ErrorTypeDuplicate))) != 2 {
+		t.Errorf("should not filter")
+	}
+	if len(list.Filter(NewErrorTypeMatcher(ErrorTypeInvalid))) != 1 {
+		t.Errorf("should filter")
+	}
+}
+
+func TestErrorOrigin(t *testing.T) {
+	err := Invalid(NewPath("field"), "value", "detail")
+
+	// Test WithOrigin
+	newErr := err.WithOrigin("origin1")
+	if newErr.Origin != "origin1" {
+		t.Errorf("Expected Origin to be 'origin1', got '%s'", newErr.Origin)
+	}
+	if err.Origin != "origin1" {
+		t.Errorf("Expected Origin to be 'origin1', got '%s'", err.Origin)
+	}
+}
+
+func TestErrorListOrigin(t *testing.T) {
+	// Create an ErrorList with multiple errors
+	list := ErrorList{
+		Invalid(NewPath("field1"), "value1", "detail1"),
+		Invalid(NewPath("field2"), "value2", "detail2"),
+		Required(NewPath("field3"), "detail3"),
+	}
+
+	// Test WithOrigin
+	newList := list.WithOrigin("origin1")
+	// Check that WithOrigin returns the modified list
+	for i, err := range newList {
+		if err.Origin != "origin1" {
+			t.Errorf("Error %d: Expected Origin to be 'origin2', got '%s'", i, err.Origin)
+		}
+	}
+
+	// Check that the original list was also modified (WithOrigin modifies and returns the same list)
+	for i, err := range list {
+		if err.Origin != "origin1" {
+			t.Errorf("Error %d: Expected original list Origin to be 'origin2', got '%s'", i, err.Origin)
+		}
+	}
+}
+
+func TestErrorMarkDeclarative(t *testing.T) {
+	// Test for single Error
+	err := Invalid(NewPath("field"), "value", "detail")
+	if err.CoveredByDeclarative {
+		t.Errorf("New error should not be declarative by default")
+	}
+
+	// Mark as declarative
+	err.MarkCoveredByDeclarative() //nolint:errcheck // The "error" here is not an unexpected error from the function.
+	if !err.CoveredByDeclarative {
+		t.Errorf("Error should be declarative after marking")
+	}
+}
+
+func TestErrorListMarkDeclarative(t *testing.T) {
+	// Test for ErrorList
+	list := ErrorList{
+		Invalid(NewPath("field1"), "value1", "detail1"),
+		Invalid(NewPath("field2"), "value2", "detail2"),
+	}
+
+	// Verify none are declarative by default
+	for i, err := range list {
+		if err.CoveredByDeclarative {
+			t.Errorf("Error %d should not be declarative by default", i)
+		}
+	}
+
+	// Mark list as declarative
+	list.MarkCoveredByDeclarative()
+
+	// Verify all errors in the list are now declarative
+	for i, err := range list {
+		if !err.CoveredByDeclarative {
+			t.Errorf("Error %d should be declarative after marking the list", i)
+		}
+	}
+}
+
+func TestErrorMarkFromImperative(t *testing.T) {
+	// Test for single Error
+	err := Invalid(NewPath("field"), "value", "detail")
+	if err.FromImperative {
+		t.Errorf("New error should not be from imperative by default")
+	}
+
+	// Mark as FromImperative
+	err.MarkFromImperative() //nolint:errcheck // The "error" here is not an unexpected error from the function.
+	if !err.FromImperative {
+		t.Errorf("Error should be from imperative after marking")
+	}
+}
+
+func TestErrorListMarkFromImperative(t *testing.T) {
+	// Test for ErrorList
+	list := ErrorList{
+		Invalid(NewPath("field1"), "value1", "detail1"),
+		Invalid(NewPath("field2"), "value2", "detail2"),
+	}
+
+	// Verify none are from imperative by default
+	for i, err := range list {
+		if err.FromImperative {
+			t.Errorf("Error %d should not be from imperative by default", i)
+		}
+	}
+
+	// Mark list as from imperative
+	list.MarkFromImperative()
+
+	// Verify all errors in the list are now from imperative
+	for i, err := range list {
+		if !err.FromImperative {
+			t.Errorf("Error %d should be from imperative after marking the list", i)
+		}
+	}
+}
+
+func TestErrorListExtractCoveredByDeclarative(t *testing.T) {
+	testCases := []struct {
+		list         ErrorList
+		expectedList ErrorList
+	}{
+		{
+			ErrorList{},
+			ErrorList{},
+		},
+		{
+			ErrorList{Invalid(NewPath("field1"), nil, "")},
+			ErrorList{},
+		},
+		{
+			ErrorList{Invalid(NewPath("field1"), nil, "").MarkCoveredByDeclarative(), Required(NewPath("field2"), "detail2")},
+			ErrorList{Invalid(NewPath("field1"), nil, "").MarkCoveredByDeclarative()},
+		},
+	}
+
+	for _, tc := range testCases {
+		got := tc.list.ExtractCoveredByDeclarative()
+		if !reflect.DeepEqual(got, tc.expectedList) {
+			t.Errorf("For list %v, expected %v, got %v", tc.list, tc.expectedList, got)
+		}
+	}
+}
+
+func TestErrorListRemoveCoveredByDeclarative(t *testing.T) {
+	testCases := []struct {
+		list         ErrorList
+		expectedList ErrorList
+	}{
+		{
+			ErrorList{},
+			ErrorList{},
+		},
+		{
+			ErrorList{Invalid(NewPath("field1"), nil, "").MarkCoveredByDeclarative(), Required(NewPath("field2"), "detail2")},
+			ErrorList{Required(NewPath("field2"), "detail2")},
+		},
+	}
+
+	for _, tc := range testCases {
+		got := tc.list.RemoveCoveredByDeclarative()
+		if !reflect.DeepEqual(got, tc.expectedList) {
+			t.Errorf("For list %v, expected %v, got %v", tc.list, tc.expectedList, got)
+		}
+	}
+}
+
+func TestErrorFormatting(t *testing.T) {
+	cases := []struct {
+		name   string
+		input  *Error
+		expect string
+	}{{
+		name: "required",
+		input: &Error{
+			Type:                 ErrorTypeRequired,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Required value: the details`,
+	}, {
+		name:   "required func",
+		input:  Required(NewPath("path.to.field"), "the details"),
+		expect: `path.to.field: Required value: the details`,
+	}, {
+		name: "forbidden",
+		input: &Error{
+			Type:                 ErrorTypeForbidden,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Forbidden: the details`,
+	}, {
+		name:   "forbidden func",
+		input:  Forbidden(NewPath("path.to.field"), "the details"),
+		expect: `path.to.field: Forbidden: the details`,
+	}, {
+		name: "too long",
+		input: &Error{
+			Type:                 ErrorTypeTooLong,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Too long: the details`,
+	}, {
+		name:   "too long func(1)",
+		input:  TooLong(NewPath("path.to.field"), "the value", 1),
+		expect: `path.to.field: Too long: may not be more than 1 byte`,
+	}, {
+		name:   "too long func(2)",
+		input:  TooLong(NewPath("path.to.field"), "the value", 2),
+		expect: `path.to.field: Too long: may not be more than 2 bytes`,
+	}, {
+		name:   "too long func(-1)",
+		input:  TooLong(NewPath("path.to.field"), "the value", -1),
+		expect: `path.to.field: Too long: value is too long`,
+	}, {
+		name: "too many",
+		input: &Error{
+			Type:                 ErrorTypeTooMany,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Too many: "the value": the details`,
+	}, {
+		name:   "too many func(2, 1)",
+		input:  TooMany(NewPath("path.to.field"), 2, 1),
+		expect: `path.to.field: Too many: 2: must have at most 1 item`,
+	}, {
+		name:   "too many func(3, 2)",
+		input:  TooMany(NewPath("path.to.field"), 3, 2),
+		expect: `path.to.field: Too many: 3: must have at most 2 items`,
+	}, {
+		name:   "too many func(2, -1)",
+		input:  TooMany(NewPath("path.to.field"), 2, -1),
+		expect: `path.to.field: Too many: 2: has too many items`,
+	}, {
+		name:   "too many func(-1, 1)",
+		input:  TooMany(NewPath("path.to.field"), -1, 1),
+		expect: `path.to.field: Too many: must have at most 1 item`,
+	}, {
+		name: "internal error",
+		input: &Error{
+			Type:                 ErrorTypeInternal,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Internal error: the details`,
+	}, {
+		name:   "internal error func",
+		input:  InternalError(NewPath("path.to.field"), fmt.Errorf("the error")),
+		expect: `path.to.field: Internal error: the error`,
+	}, {
+		name: "invalid string",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: "the value": the details`,
+	}, {
+		name: "invalid string type",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             StringType("the value"),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: "the value": the details`,
+	}, {
+		name: "invalid int",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             -42,
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: -42: the details`,
+	}, {
+		name: "invalid bool",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             true,
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: true: the details`,
+	}, {
+		name: "invalid struct",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             mkTinyStruct(),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: {"stringField":"stringval","intField":9376,"boolField":true}: the details`,
+	}, {
+		name: "invalid list",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             []string{"one", "two", "three"},
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: ["one","two","three"]: the details`,
+	}, {
+		name: "invalid map",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             map[string]int{"one": 1, "two": 2, "three": 3},
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: {"one":1,"three":3,"two":2}: the details`,
+	}, {
+		name: "invalid time",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             time.Time{},
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: "0001-01-01T00:00:00Z": the details`,
+	}, {
+		name: "invalid omitValue",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             omitValue,
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: the details`,
+	}, {
+		name: "invalid untyped nil",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             nil,
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: null: the details`,
+	}, {
+		name: "invalid typed nil",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             (*string)(nil),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: null: the details`,
+	}, {
+		name: "invalid string ptr",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             ptr.To("the value"),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: "the value": the details`,
+	}, {
+		name: "invalid string type ptr",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             ptr.To(StringType("the value")),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: "the value": the details`,
+	}, {
+		name: "invalid int ptr",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             ptr.To(-42),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: -42: the details`,
+	}, {
+		name: "invalid bool ptr",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             ptr.To(true),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: true: the details`,
+	}, {
+		name: "invalid struct ptr",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             ptr.To(mkTinyStruct()),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: {"stringField":"stringval","intField":9376,"boolField":true}: the details`,
+	}, {
+		name: "invalid list ptr",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             ptr.To([]string{"one", "two", "three"}),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: ["one","two","three"]: the details`,
+	}, {
+		name: "invalid map ptr",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             ptr.To(map[string]int{"one": 1, "two": 2, "three": 3}),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: {"one":1,"three":3,"two":2}: the details`,
+	}, {
+		name:   "invalid func",
+		input:  Invalid(NewPath("path.to.field"), "the value", "the details"),
+		expect: `path.to.field: Invalid value: "the value": the details`,
+	}, {
+		name: "not found",
+		input: &Error{
+			Type:                 ErrorTypeNotFound,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Not found: "the value": the details`,
+	}, {
+		name: "not supported",
+		input: &Error{
+			Type:                 ErrorTypeNotSupported,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Unsupported value: "the value": the details`,
+	}, {
+		name:   "not supported func",
+		input:  NotSupported(NewPath("path.to.field"), "the value", []string{"val1", "val2"}),
+		expect: `path.to.field: Unsupported value: "the value": supported values: "val1", "val2"`,
+	}, {
+		name: "duplicate",
+		input: &Error{
+			Type:                 ErrorTypeDuplicate,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Duplicate value: "the value": the details`,
+	}, {
+		name:   "duplicate func",
+		input:  Duplicate(NewPath("path.to.field"), "the value"),
+		expect: `path.to.field: Duplicate value: "the value"`,
+	}, {
+		name: "type invalid",
+		input: &Error{
+			Type:                 ErrorTypeTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: "the value": the details`,
+	}, {
+		name:   "type invalid func",
+		input:  TypeInvalid(NewPath("path.to.field"), "the value", "the details"),
+		expect: `path.to.field: Invalid value: "the value": the details`,
+	}, {
+		name: "failed marshal stringer",
+		input: &Error{
+			Type:                 ErrorTypeTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             SelfMarshalerStringer{"invisible"},
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: magic: the details`,
+	}, {
+		name: "failed marshal non-stringer",
+		input: &Error{
+			Type:                 ErrorTypeTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             SelfMarshalerNonStringer{"visible"},
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: field.SelfMarshalerNonStringer{S:"visible"}: the details`,
+	}, {
+		name: "unknown error type",
+		input: &Error{
+			Type:                 "not real",
+			Field:                "path.to.field",
+			BadValue:             SelfMarshalerNonStringer{"visible"},
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Internal error: unhandled error code: <unknown error "not real">: please report this: the details`,
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := tc.input.Error()
+			if want := tc.expect; result != want {
+				t.Errorf("wrong error string:\n  expected: %q\n       got: %q", want, result)
+			}
+		})
+	}
+}
+
+type StringType string
+
+type TinyStruct struct {
+	StringField string `json:"stringField"`
+	IntField    int    `json:"intField"`
+	BoolField   bool   `json:"boolField"`
+}
+
+func mkTinyStruct() TinyStruct {
+	return TinyStruct{
+		StringField: "stringval",
+		IntField:    9376,
+		BoolField:   true,
+	}
+}
+
+type SelfMarshalerStringer struct{ S string }
+
+func (SelfMarshalerStringer) MarshalJSON() ([]byte, error) {
+	return nil, fmt.Errorf("this always fails")
+}
+
+func (SelfMarshalerStringer) String() string {
+	return "magic"
+}
+
+type SelfMarshalerNonStringer struct{ S string }
+
+func (SelfMarshalerNonStringer) MarshalJSON() ([]byte, error) {
+	return nil, fmt.Errorf("this always fails")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/path.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/path.go
new file mode 100644
index 0000000000..daccb05890
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/path.go
@@ -0,0 +1,117 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package field
+
+import (
+	"bytes"
+	"fmt"
+	"strconv"
+)
+
+type pathOptions struct {
+	path *Path
+}
+
+// PathOption modifies a pathOptions
+type PathOption func(o *pathOptions)
+
+// WithPath generates a PathOption
+func WithPath(p *Path) PathOption {
+	return func(o *pathOptions) {
+		o.path = p
+	}
+}
+
+// ToPath produces *Path from a set of PathOption
+func ToPath(opts ...PathOption) *Path {
+	c := &pathOptions{}
+	for _, opt := range opts {
+		opt(c)
+	}
+	return c.path
+}
+
+// Path represents the path from some root to a particular field.
+type Path struct {
+	name   string // the name of this field or "" if this is an index
+	index  string // if name == "", this is a subscript (index or map key) of the previous element
+	parent *Path  // nil if this is the root element
+}
+
+// NewPath creates a root Path object.
+func NewPath(name string, moreNames ...string) *Path {
+	r := &Path{name: name, parent: nil}
+	for _, anotherName := range moreNames {
+		r = &Path{name: anotherName, parent: r}
+	}
+	return r
+}
+
+// Root returns the root element of this Path.
+func (p *Path) Root() *Path {
+	for ; p.parent != nil; p = p.parent {
+		// Do nothing.
+	}
+	return p
+}
+
+// Child creates a new Path that is a child of the method receiver.
+func (p *Path) Child(name string, moreNames ...string) *Path {
+	r := NewPath(name, moreNames...)
+	r.Root().parent = p
+	return r
+}
+
+// Index indicates that the previous Path is to be subscripted by an int.
+// This sets the same underlying value as Key.
+func (p *Path) Index(index int) *Path {
+	return &Path{index: strconv.Itoa(index), parent: p}
+}
+
+// Key indicates that the previous Path is to be subscripted by a string.
+// This sets the same underlying value as Index.
+func (p *Path) Key(key string) *Path {
+	return &Path{index: key, parent: p}
+}
+
+// String produces a string representation of the Path.
+func (p *Path) String() string {
+	if p == nil {
+		return "<nil>"
+	}
+	// make a slice to iterate
+	elems := []*Path{}
+	for ; p != nil; p = p.parent {
+		elems = append(elems, p)
+	}
+
+	// iterate, but it has to be backwards
+	buf := bytes.NewBuffer(nil)
+	for i := range elems {
+		p := elems[len(elems)-1-i]
+		if p.parent != nil && len(p.name) > 0 {
+			// This is either the root or it is a subscript.
+			buf.WriteString(".")
+		}
+		if len(p.name) > 0 {
+			buf.WriteString(p.name)
+		} else {
+			fmt.Fprintf(buf, "[%s]", p.index)
+		}
+	}
+	return buf.String()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/path_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/path_test.go
new file mode 100644
index 0000000000..d2f568c36f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/field/path_test.go
@@ -0,0 +1,123 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package field
+
+import "testing"
+
+func TestPath(t *testing.T) {
+	testCases := []struct {
+		op       func(*Path) *Path
+		expected string
+	}{
+		{
+			func(p *Path) *Path { return p },
+			"root",
+		},
+		{
+			func(p *Path) *Path { return p.Child("first") },
+			"root.first",
+		},
+		{
+			func(p *Path) *Path { return p.Child("second") },
+			"root.first.second",
+		},
+		{
+			func(p *Path) *Path { return p.Index(0) },
+			"root.first.second[0]",
+		},
+		{
+			func(p *Path) *Path { return p.Child("third") },
+			"root.first.second[0].third",
+		},
+		{
+			func(p *Path) *Path { return p.Index(93) },
+			"root.first.second[0].third[93]",
+		},
+		{
+			func(p *Path) *Path { return p.parent },
+			"root.first.second[0].third",
+		},
+		{
+			func(p *Path) *Path { return p.parent },
+			"root.first.second[0]",
+		},
+		{
+			func(p *Path) *Path { return p.Key("key") },
+			"root.first.second[0][key]",
+		},
+	}
+
+	root := NewPath("root")
+	p := root
+	for i, tc := range testCases {
+		p = tc.op(p)
+		if p.String() != tc.expected {
+			t.Errorf("[%d] Expected %q, got %q", i, tc.expected, p.String())
+		}
+		if p.Root() != root {
+			t.Errorf("[%d] Wrong root: %#v", i, p.Root())
+		}
+	}
+}
+
+func TestPathMultiArg(t *testing.T) {
+	testCases := []struct {
+		op       func(*Path) *Path
+		expected string
+	}{
+		{
+			func(p *Path) *Path { return p },
+			"root.first",
+		},
+		{
+			func(p *Path) *Path { return p.Child("second", "third") },
+			"root.first.second.third",
+		},
+		{
+			func(p *Path) *Path { return p.Index(0) },
+			"root.first.second.third[0]",
+		},
+		{
+			func(p *Path) *Path { return p.parent },
+			"root.first.second.third",
+		},
+		{
+			func(p *Path) *Path { return p.parent },
+			"root.first.second",
+		},
+		{
+			func(p *Path) *Path { return p.parent },
+			"root.first",
+		},
+		{
+			func(p *Path) *Path { return p.parent },
+			"root",
+		},
+	}
+
+	root := NewPath("root", "first")
+	p := root
+	for i, tc := range testCases {
+		p = tc.op(p)
+		if p.String() != tc.expected {
+			t.Errorf("[%d] Expected %q, got %q", i, tc.expected, p.String())
+		}
+		if p.Root() != root.Root() {
+			t.Errorf("[%d] Wrong root: %#v", i, p.Root())
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/ip.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/ip.go
new file mode 100644
index 0000000000..95f4e6218f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/ip.go
@@ -0,0 +1,280 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"fmt"
+	"net"
+	"net/netip"
+	"slices"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/klog/v2"
+	netutils "k8s.io/utils/net"
+)
+
+func parseIP(fldPath *field.Path, value string, strictValidation bool) (net.IP, field.ErrorList) {
+	var allErrors field.ErrorList
+
+	ip := netutils.ParseIPSloppy(value)
+	if ip == nil {
+		allErrors = append(allErrors, field.Invalid(fldPath, value, "must be a valid IP address, (e.g. 10.9.8.7 or 2001:db8::ffff)"))
+		return nil, allErrors
+	}
+
+	if strictValidation {
+		addr, err := netip.ParseAddr(value)
+		if err != nil {
+			// If netutils.ParseIPSloppy parsed it, but netip.ParseAddr
+			// doesn't, then it must have illegal leading 0s.
+			allErrors = append(allErrors, field.Invalid(fldPath, value, "must not have leading 0s"))
+		}
+		if addr.Is4In6() {
+			allErrors = append(allErrors, field.Invalid(fldPath, value, "must not be an IPv4-mapped IPv6 address"))
+		}
+	}
+
+	return ip, allErrors
+}
+
+// IsValidIPForLegacyField tests that the argument is a valid IP address for a "legacy"
+// API field that predates strict IP validation. In particular, this allows IPs that are
+// not in canonical form (e.g., "FE80:0:0:0:0:0:0:0abc" instead of "fe80::abc").
+//
+// If strictValidation is false, this also allows IPs in certain invalid or ambiguous
+// formats:
+//
+//  1. IPv4 IPs are allowed to have leading "0"s in octets (e.g. "010.002.003.004").
+//     Historically, net.ParseIP (and later netutils.ParseIPSloppy) simply ignored leading
+//     "0"s in IPv4 addresses, but most libc-based software treats 0-prefixed IPv4 octets
+//     as octal, meaning different software might interpret the same string as two
+//     different IPs, potentially leading to security issues. (Current net.ParseIP and
+//     netip.ParseAddr simply reject inputs with leading "0"s.)
+//
+//  2. IPv4-mapped IPv6 IPs (e.g. "::ffff:1.2.3.4") are allowed. These can also lead to
+//     different software interpreting the value in different ways, because they may be
+//     treated as IPv4 by some software and IPv6 by other software. (net.ParseIP and
+//     netip.ParseAddr both allow these, but there are no use cases for representing IPv4
+//     addresses as IPv4-mapped IPv6 addresses in Kubernetes.)
+//
+// Alternatively, when validating an update to an existing field, you can pass a list of
+// IP values from the old object that should be accepted if they appear in the new object
+// even if they are not valid.
+//
+// This function should only be used to validate the existing fields that were
+// historically validated in this way, and strictValidation should be true unless the
+// StrictIPCIDRValidation feature gate is disabled. Use IsValidIP for parsing new fields.
+func IsValidIPForLegacyField(fldPath *field.Path, value string, strictValidation bool, validOldIPs []string) field.ErrorList {
+	if slices.Contains(validOldIPs, value) {
+		return nil
+	}
+	_, allErrors := parseIP(fldPath, value, strictValidation)
+	return allErrors.WithOrigin("format=ip-sloppy")
+}
+
+// IsValidIP tests that the argument is a valid IP address, according to current
+// Kubernetes standards for IP address validation.
+func IsValidIP(fldPath *field.Path, value string) field.ErrorList {
+	ip, allErrors := parseIP(fldPath, value, true)
+	if len(allErrors) != 0 {
+		return allErrors.WithOrigin("format=ip-strict")
+	}
+
+	if value != ip.String() {
+		allErrors = append(allErrors, field.Invalid(fldPath, value, fmt.Sprintf("must be in canonical form (%q)", ip.String())))
+	}
+	return allErrors.WithOrigin("format=ip-strict")
+}
+
+// GetWarningsForIP returns warnings for IP address values in non-standard forms. This
+// should only be used with fields that are validated with IsValidIPForLegacyField().
+func GetWarningsForIP(fldPath *field.Path, value string) []string {
+	ip := netutils.ParseIPSloppy(value)
+	if ip == nil {
+		//nolint:logcheck // Should not be reached.
+		klog.ErrorS(nil, "GetWarningsForIP called on value that was not validated with IsValidIPForLegacyField", "field", fldPath, "value", value)
+		return nil
+	}
+
+	addr, _ := netip.ParseAddr(value)
+	if !addr.IsValid() || addr.Is4In6() {
+		// This catches 2 cases: leading 0s (if ParseIPSloppy() accepted it but
+		// ParseAddr() doesn't) or IPv4-mapped IPv6 (.Is4In6()). Either way,
+		// re-stringifying the net.IP value will give the preferred form.
+		return []string{
+			fmt.Sprintf("%s: non-standard IP address %q is invalid: use %q", fldPath, value, ip.String()),
+		}
+	}
+
+	// If ParseIPSloppy() and ParseAddr() both accept it then it's fully valid, though
+	// it may be non-canonical.
+	if addr.Is6() && addr.String() != value {
+		return []string{
+			fmt.Sprintf("%s: IPv6 address %q should be in RFC 5952 canonical format (%q)", fldPath, value, addr.String()),
+		}
+	}
+
+	return nil
+}
+
+func parseCIDR(fldPath *field.Path, value string, strictValidation bool) (*net.IPNet, field.ErrorList) {
+	var allErrors field.ErrorList
+
+	_, ipnet, err := netutils.ParseCIDRSloppy(value)
+	if err != nil {
+		allErrors = append(allErrors, field.Invalid(fldPath, value, "must be a valid CIDR value, (e.g. 10.9.8.0/24 or 2001:db8::/64)"))
+		return nil, allErrors
+	}
+
+	if strictValidation {
+		prefix, err := netip.ParsePrefix(value)
+		if err != nil {
+			// If netutils.ParseCIDRSloppy parsed it, but netip.ParsePrefix
+			// doesn't, then it must have illegal leading 0s (either in the
+			// IP part or the prefix).
+			allErrors = append(allErrors, field.Invalid(fldPath, value, "must not have leading 0s in IP or prefix length"))
+		} else if prefix.Addr().Is4In6() {
+			allErrors = append(allErrors, field.Invalid(fldPath, value, "must not have an IPv4-mapped IPv6 address"))
+		} else if prefix.Addr() != prefix.Masked().Addr() {
+			allErrors = append(allErrors, field.Invalid(fldPath, value, "must not have bits set beyond the prefix length"))
+		}
+	}
+
+	return ipnet, allErrors
+}
+
+// IsValidCIDRForLegacyField tests that the argument is a valid CIDR value for a "legacy"
+// API field that predates strict IP validation. In particular, this allows IPs that are
+// not in canonical form (e.g., "FE80:0abc:0:0:0:0:0:0/64" instead of "fe80:abc::/64").
+//
+// If strictValidation is false, this also allows CIDR values in certain invalid or
+// ambiguous formats:
+//
+//  1. The IP part of the CIDR value is parsed as with IsValidIPForLegacyField with
+//     strictValidation=false.
+//
+//  2. The CIDR value is allowed to be either a "subnet"/"mask" (with the lower bits after
+//     the prefix length all being 0), or an "interface address" as with `ip addr` (with a
+//     complete IP address and associated subnet length). With strict validation, the
+//     value is required to be in "subnet"/"mask" form.
+//
+//  3. The prefix length is allowed to have leading 0s.
+//
+// Alternatively, when validating an update to an existing field, you can pass a list of
+// CIDR values from the old object that should be accepted if they appear in the new
+// object even if they are not valid.
+//
+// This function should only be used to validate the existing fields that were
+// historically validated in this way, and strictValidation should be true unless the
+// StrictIPCIDRValidation feature gate is disabled. Use IsValidCIDR or
+// IsValidInterfaceAddress for parsing new fields.
+func IsValidCIDRForLegacyField(fldPath *field.Path, value string, strictValidation bool, validOldCIDRs []string) field.ErrorList {
+	if slices.Contains(validOldCIDRs, value) {
+		return nil
+	}
+
+	_, allErrors := parseCIDR(fldPath, value, strictValidation)
+	return allErrors
+}
+
+// IsValidCIDR tests that the argument is a valid CIDR value, according to current
+// Kubernetes standards for CIDR validation. This function is only for
+// "subnet"/"mask"-style CIDR values (e.g., "192.168.1.0/24", with no bits set beyond the
+// prefix length). Use IsValidInterfaceAddress for "ifaddr"-style CIDR values.
+func IsValidCIDR(fldPath *field.Path, value string) field.ErrorList {
+	ipnet, allErrors := parseCIDR(fldPath, value, true)
+	if len(allErrors) != 0 {
+		return allErrors
+	}
+
+	if value != ipnet.String() {
+		allErrors = append(allErrors, field.Invalid(fldPath, value, fmt.Sprintf("must be in canonical form (%q)", ipnet.String())))
+	}
+	return allErrors
+}
+
+// GetWarningsForCIDR returns warnings for CIDR values in non-standard forms. This should
+// only be used with fields that are validated with IsValidCIDRForLegacyField().
+func GetWarningsForCIDR(fldPath *field.Path, value string) []string {
+	ip, ipnet, err := netutils.ParseCIDRSloppy(value)
+	if err != nil {
+		//nolint:logcheck // Should not be reached.
+		klog.ErrorS(err, "GetWarningsForCIDR called on value that was not validated with IsValidCIDRForLegacyField", "field", fldPath, "value", value)
+		return nil
+	}
+
+	var warnings []string
+
+	// Check for bits set after prefix length
+	if !ip.Equal(ipnet.IP) {
+		_, addrlen := ipnet.Mask.Size()
+		singleIPCIDR := fmt.Sprintf("%s/%d", ip.String(), addrlen)
+		warnings = append(warnings,
+			fmt.Sprintf("%s: CIDR value %q is ambiguous in this context (should be %q or %q?)", fldPath, value, ipnet.String(), singleIPCIDR),
+		)
+	}
+
+	prefix, _ := netip.ParsePrefix(value)
+	addr := prefix.Addr()
+	if !prefix.IsValid() || addr.Is4In6() {
+		// This catches 2 cases: leading 0s (if ParseCIDRSloppy() accepted it but
+		// ParsePrefix() doesn't) or IPv4-mapped IPv6 (.Is4In6()). Either way,
+		// re-stringifying the net.IPNet value will give the preferred form.
+		warnings = append(warnings,
+			fmt.Sprintf("%s: non-standard CIDR value %q is invalid: use %q", fldPath, value, ipnet.String()),
+		)
+	}
+
+	// If ParseCIDRSloppy() and ParsePrefix() both accept it then it's fully valid,
+	// though it may be non-canonical. But only check this if there are no other
+	// warnings, since either of the other warnings would also cause a round-trip
+	// failure.
+	if len(warnings) == 0 && addr.Is6() && prefix.String() != value {
+		warnings = append(warnings,
+			fmt.Sprintf("%s: IPv6 CIDR value %q should be in RFC 5952 canonical format (%q)", fldPath, value, prefix.String()),
+		)
+	}
+
+	return warnings
+}
+
+// IsValidInterfaceAddress tests that the argument is a valid "ifaddr"-style CIDR value in
+// canonical form (e.g., "192.168.1.5/24", with a complete IP address and associated
+// subnet length). Use IsValidCIDR for "subnet"/"mask"-style CIDR values (e.g.,
+// "192.168.1.0/24").
+func IsValidInterfaceAddress(fldPath *field.Path, value string) field.ErrorList {
+	var allErrors field.ErrorList
+	ip, ipnet, err := netutils.ParseCIDRSloppy(value)
+	if err != nil {
+		allErrors = append(allErrors, field.Invalid(fldPath, value, "must be a valid address in CIDR form, (e.g. 10.9.8.7/24 or 2001:db8::1/64)"))
+		return allErrors
+	}
+
+	// The canonical form of `value` is not `ipnet.String()`, because `ipnet` doesn't
+	// include the bits after the prefix. We need to construct the canonical form
+	// ourselves from `ip` and `ipnet.Mask`.
+	maskSize, _ := ipnet.Mask.Size()
+	if netutils.IsIPv4(ip) && maskSize > net.IPv4len*8 {
+		// "::ffff:192.168.0.1/120" -> "192.168.0.1/24"
+		maskSize -= (net.IPv6len - net.IPv4len) * 8
+	}
+	canonical := fmt.Sprintf("%s/%d", ip.String(), maskSize)
+	if value != canonical {
+		allErrors = append(allErrors, field.Invalid(fldPath, value, fmt.Sprintf("must be in canonical form (%q)", canonical)))
+	}
+	return allErrors
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/ip_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/ip_test.go
new file mode 100644
index 0000000000..a96ced3cad
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/ip_test.go
@@ -0,0 +1,709 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestIsValidIP(t *testing.T) {
+	testCases := []struct {
+		name string
+		in   string
+
+		err             string
+		legacyErr       string
+		legacyStrictErr string
+	}{
+		// GOOD VALUES
+		{
+			name: "ipv4",
+			in:   "1.2.3.4",
+		},
+		{
+			name: "ipv4, all zeros",
+			in:   "0.0.0.0",
+		},
+		{
+			name: "ipv4, max",
+			in:   "255.255.255.255",
+		},
+		{
+			name: "ipv6",
+			in:   "1234::abcd",
+		},
+		{
+			name: "ipv6, all zeros, collapsed",
+			in:   "::",
+		},
+		{
+			name: "ipv6, max",
+			in:   "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff",
+		},
+
+		// NON-CANONICAL VALUES
+		{
+			name: "ipv6, all zeros, expanded (non-canonical)",
+			in:   "0:0:0:0:0:0:0:0",
+
+			err: `must be in canonical form ("::")`,
+		},
+		{
+			name: "ipv6, leading 0s (non-canonical)",
+			in:   "0001:002:03:4::",
+
+			err: `must be in canonical form ("1:2:3:4::")`,
+		},
+		{
+			name: "ipv6, capital letters (non-canonical)",
+			in:   "1234::ABCD",
+
+			err: `must be in canonical form ("1234::abcd")`,
+		},
+
+		// GOOD WITH LEGACY VALIDATION, BAD WITH STRICT VALIDATION
+		{
+			name: "ipv4 with leading 0s",
+			in:   "1.1.1.01",
+
+			err:             "must not have leading 0s",
+			legacyErr:       "",
+			legacyStrictErr: "must not have leading 0s",
+		},
+		{
+			name: "ipv4-in-ipv6 value",
+			in:   "::ffff:1.1.1.1",
+
+			err:             "must not be an IPv4-mapped IPv6 address",
+			legacyErr:       "",
+			legacyStrictErr: "must not be an IPv4-mapped IPv6 address",
+		},
+
+		// BAD VALUES
+		{
+			name: "empty string",
+			in:   "",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "junk",
+			in:   "aaaaaaa",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "domain name",
+			in:   "myhost.mydomain",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "cidr",
+			in:   "1.2.3.0/24",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "ipv4 with out-of-range octets",
+			in:   "1.2.3.400",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "ipv4 with negative octets",
+			in:   "-1.0.0.0",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "ipv6 with out-of-range segment",
+			in:   "2001:db8::10005",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "ipv4:port",
+			in:   "1.2.3.4:80",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "ipv6 with brackets",
+			in:   "[2001:db8::1]",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "[ipv6]:port",
+			in:   "[2001:db8::1]:80",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "host:port",
+			in:   "example.com:80",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "ipv6 with zone",
+			in:   "1234::abcd%eth0",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "ipv4 with zone",
+			in:   "169.254.0.0%eth0",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+	}
+
+	var badIPs []string
+	for _, tc := range testCases {
+		if tc.legacyStrictErr != "" {
+			badIPs = append(badIPs, tc.in)
+		}
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := IsValidIP(field.NewPath(""), tc.in)
+			if tc.err == "" {
+				if len(errs) != 0 {
+					t.Errorf("expected %q to be valid but got: %v", tc.in, errs)
+				}
+			} else {
+				if len(errs) != 1 {
+					t.Errorf("expected %q to have 1 error but got: %v", tc.in, errs)
+				} else if !strings.Contains(errs[0].Detail, tc.err) {
+					t.Errorf("expected error for %q to contain %q but got: %q", tc.in, tc.err, errs[0].Detail)
+				}
+			}
+
+			errs = IsValidIPForLegacyField(field.NewPath(""), tc.in, false, nil)
+			if tc.legacyErr == "" {
+				if len(errs) != 0 {
+					t.Errorf("expected %q to be valid according to IsValidIPForLegacyField but got: %v", tc.in, errs)
+				}
+			} else {
+				if len(errs) != 1 {
+					t.Errorf("expected %q to have 1 error from IsValidIPForLegacyField but got: %v", tc.in, errs)
+				} else if !strings.Contains(errs[0].Detail, tc.legacyErr) {
+					t.Errorf("expected error from IsValidIPForLegacyField for %q to contain %q but got: %q", tc.in, tc.legacyErr, errs[0].Detail)
+				}
+			}
+
+			errs = IsValidIPForLegacyField(field.NewPath(""), tc.in, true, nil)
+			if tc.legacyStrictErr == "" {
+				if len(errs) != 0 {
+					t.Errorf("expected %q to be valid according to IsValidIPForLegacyField with strict validation, but got: %v", tc.in, errs)
+				}
+			} else {
+				if len(errs) != 1 {
+					t.Errorf("expected %q to have 1 error from IsValidIPForLegacyField with strict validation, but got: %v", tc.in, errs)
+				} else if !strings.Contains(errs[0].Detail, tc.legacyStrictErr) {
+					t.Errorf("expected error from IsValidIPForLegacyField with strict validation for %q to contain %q but got: %q", tc.in, tc.legacyStrictErr, errs[0].Detail)
+				}
+			}
+
+			errs = IsValidIPForLegacyField(field.NewPath(""), tc.in, true, badIPs)
+			if len(errs) != 0 {
+				t.Errorf("expected %q to be accepted when using validOldIPs, but got: %v", tc.in, errs)
+			}
+		})
+	}
+}
+
+func TestGetWarningsForIP(t *testing.T) {
+	tests := []struct {
+		name      string
+		fieldPath *field.Path
+		address   string
+		want      []string
+	}{
+		{
+			name:      "IPv4 No failures",
+			address:   "192.12.2.2",
+			fieldPath: field.NewPath("spec").Child("clusterIPs").Index(0),
+			want:      nil,
+		},
+		{
+			name:      "IPv6 No failures",
+			address:   "2001:db8::2",
+			fieldPath: field.NewPath("spec").Child("clusterIPs").Index(0),
+			want:      nil,
+		},
+		{
+			name:      "IPv4 with leading zeros",
+			address:   "192.012.2.2",
+			fieldPath: field.NewPath("spec").Child("clusterIPs").Index(0),
+			want: []string{
+				`spec.clusterIPs[0]: non-standard IP address "192.012.2.2" is invalid: use "192.12.2.2"`,
+			},
+		},
+		{
+			name:      "IPv4-mapped IPv6",
+			address:   "::ffff:192.12.2.2",
+			fieldPath: field.NewPath("spec").Child("clusterIPs").Index(0),
+			want: []string{
+				`spec.clusterIPs[0]: non-standard IP address "::ffff:192.12.2.2" is invalid: use "192.12.2.2"`,
+			},
+		},
+		{
+			name:      "IPv6 non-canonical format",
+			address:   "2001:db8:0:0::2",
+			fieldPath: field.NewPath("spec").Child("loadBalancerIP"),
+			want: []string{
+				`spec.loadBalancerIP: IPv6 address "2001:db8:0:0::2" should be in RFC 5952 canonical format ("2001:db8::2")`,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := GetWarningsForIP(tt.fieldPath, tt.address); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("getWarningsForIP() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestIsValidCIDR(t *testing.T) {
+	testCases := []struct {
+		name string
+		in   string
+
+		err             string
+		legacyErr       string
+		legacyStrictErr string
+	}{
+		// GOOD VALUES
+		{
+			name: "ipv4",
+			in:   "1.0.0.0/8",
+		},
+		{
+			name: "ipv4, all IPs",
+			in:   "0.0.0.0/0",
+		},
+		{
+			name: "ipv4, single IP",
+			in:   "1.1.1.1/32",
+		},
+		{
+			name: "ipv6",
+			in:   "2001:4860:4860::/48",
+		},
+		{
+			name: "ipv6, all IPs",
+			in:   "::/0",
+		},
+		{
+			name: "ipv6, single IP",
+			in:   "::1/128",
+		},
+
+		// NON-CANONICAL VALUES
+		{
+			name: "ipv6, extra 0s (non-canonical)",
+			in:   "2a00:79e0:2:0::/64",
+
+			err: `must be in canonical form ("2a00:79e0:2::/64")`,
+		},
+		{
+			name: "ipv6, capital letters (non-canonical)",
+			in:   "2001:DB8::/64",
+
+			err: `must be in canonical form ("2001:db8::/64")`,
+		},
+
+		// GOOD WITH LEGACY VALIDATION, BAD WITH STRICT VALIDATION
+		{
+			name: "ipv4 with leading 0s",
+			in:   "1.1.01.0/24",
+
+			err:             "must not have leading 0s in IP",
+			legacyErr:       "",
+			legacyStrictErr: "must not have leading 0s in IP",
+		},
+		{
+			name: "ipv4-in-ipv6 with ipv4-sized prefix",
+			in:   "::ffff:1.1.1.0/24",
+
+			err:             "must not have an IPv4-mapped IPv6 address",
+			legacyErr:       "",
+			legacyStrictErr: "must not have an IPv4-mapped IPv6 address",
+		},
+		{
+			name: "ipv4-in-ipv6 with ipv6-sized prefix",
+			in:   "::ffff:1.1.1.0/120",
+
+			err:             "must not have an IPv4-mapped IPv6 address",
+			legacyErr:       "",
+			legacyStrictErr: "must not have an IPv4-mapped IPv6 address",
+		},
+		{
+			name: "ipv4 ifaddr",
+			in:   "1.2.3.4/24",
+
+			err:             "must not have bits set beyond the prefix length",
+			legacyErr:       "",
+			legacyStrictErr: "must not have bits set beyond the prefix length",
+		},
+		{
+			name: "ipv6 ifaddr",
+			in:   "2001:db8::1/64",
+
+			err:             "must not have bits set beyond the prefix length",
+			legacyErr:       "",
+			legacyStrictErr: "must not have bits set beyond the prefix length",
+		},
+		{
+			name: "prefix length with leading 0s",
+			in:   "192.168.0.0/016",
+
+			err:             "must not have leading 0s",
+			legacyErr:       "",
+			legacyStrictErr: "must not have leading 0s",
+		},
+
+		// BAD VALUES
+		{
+			name: "empty string",
+			in:   "",
+
+			err:             "must be a valid CIDR value",
+			legacyErr:       "must be a valid CIDR value",
+			legacyStrictErr: "must be a valid CIDR value",
+		},
+		{
+			name: "junk",
+			in:   "aaaaaaa",
+
+			err:             "must be a valid CIDR value",
+			legacyErr:       "must be a valid CIDR value",
+			legacyStrictErr: "must be a valid CIDR value",
+		},
+		{
+			name: "IP address",
+			in:   "1.2.3.4",
+
+			err:             "must be a valid CIDR value",
+			legacyErr:       "must be a valid CIDR value",
+			legacyStrictErr: "must be a valid CIDR value",
+		},
+		{
+			name: "partial URL",
+			in:   "192.168.0.1/healthz",
+
+			err:             "must be a valid CIDR value",
+			legacyErr:       "must be a valid CIDR value",
+			legacyStrictErr: "must be a valid CIDR value",
+		},
+		{
+			name: "partial URL 2",
+			in:   "192.168.0.1/0/99",
+
+			err:             "must be a valid CIDR value",
+			legacyErr:       "must be a valid CIDR value",
+			legacyStrictErr: "must be a valid CIDR value",
+		},
+		{
+			name: "negative prefix length",
+			in:   "192.168.0.0/-16",
+
+			err:             "must be a valid CIDR value",
+			legacyErr:       "must be a valid CIDR value",
+			legacyStrictErr: "must be a valid CIDR value",
+		},
+		{
+			name: "prefix length with sign",
+			in:   "192.168.0.0/+16",
+
+			err:             "must be a valid CIDR value",
+			legacyErr:       "must be a valid CIDR value",
+			legacyStrictErr: "must be a valid CIDR value",
+		},
+	}
+
+	var badCIDRs []string
+	for _, tc := range testCases {
+		if tc.legacyStrictErr != "" {
+			badCIDRs = append(badCIDRs, tc.in)
+		}
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := IsValidCIDR(field.NewPath(""), tc.in)
+			if tc.err == "" {
+				if len(errs) != 0 {
+					t.Errorf("expected %q to be valid but got: %v", tc.in, errs)
+				}
+			} else {
+				if len(errs) != 1 {
+					t.Errorf("expected %q to have 1 error but got: %v", tc.in, errs)
+				} else if !strings.Contains(errs[0].Detail, tc.err) {
+					t.Errorf("expected error for %q to contain %q but got: %q", tc.in, tc.err, errs[0].Detail)
+				}
+			}
+
+			errs = IsValidCIDRForLegacyField(field.NewPath(""), tc.in, false, nil)
+			if tc.legacyErr == "" {
+				if len(errs) != 0 {
+					t.Errorf("expected %q to be valid according to IsValidCIDRForLegacyField but got: %v", tc.in, errs)
+				}
+			} else {
+				if len(errs) != 1 {
+					t.Errorf("expected %q to have 1 error from IsValidCIDRForLegacyField but got: %v", tc.in, errs)
+				} else if !strings.Contains(errs[0].Detail, tc.legacyErr) {
+					t.Errorf("expected error for %q from IsValidCIDRForLegacyField to contain %q but got: %q", tc.in, tc.legacyErr, errs[0].Detail)
+				}
+			}
+
+			errs = IsValidCIDRForLegacyField(field.NewPath(""), tc.in, true, nil)
+			if tc.legacyStrictErr == "" {
+				if len(errs) != 0 {
+					t.Errorf("expected %q to be valid according to IsValidCIDRForLegacyField with strict validation but got: %v", tc.in, errs)
+				}
+			} else {
+				if len(errs) != 1 {
+					t.Errorf("expected %q to have 1 error from IsValidCIDRForLegacyField with strict validation but got: %v", tc.in, errs)
+				} else if !strings.Contains(errs[0].Detail, tc.legacyStrictErr) {
+					t.Errorf("expected error for %q from IsValidCIDRForLegacyField with strict validation to contain %q but got: %q", tc.in, tc.legacyStrictErr, errs[0].Detail)
+				}
+			}
+
+			errs = IsValidCIDRForLegacyField(field.NewPath(""), tc.in, true, badCIDRs)
+			if len(errs) != 0 {
+				t.Errorf("expected %q to be accepted when using validOldCIDRs, but got: %v", tc.in, errs)
+			}
+		})
+	}
+}
+
+func TestGetWarningsForCIDR(t *testing.T) {
+	tests := []struct {
+		name      string
+		fieldPath *field.Path
+		cidr      string
+		want      []string
+	}{
+		{
+			name:      "IPv4 No failures",
+			cidr:      "192.12.2.0/24",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want:      nil,
+		},
+		{
+			name:      "IPv6 No failures",
+			cidr:      "2001:db8::/64",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want:      nil,
+		},
+		{
+			name:      "IPv4 with leading zeros",
+			cidr:      "192.012.2.0/24",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want: []string{
+				`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "192.012.2.0/24" is invalid: use "192.12.2.0/24"`,
+			},
+		},
+		{
+			name:      "leading zeros in prefix length",
+			cidr:      "192.12.2.0/024",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want: []string{
+				`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "192.12.2.0/024" is invalid: use "192.12.2.0/24"`,
+			},
+		},
+		{
+			name:      "IPv4-mapped IPv6",
+			cidr:      "::ffff:192.12.2.0/120",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want: []string{
+				`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "::ffff:192.12.2.0/120" is invalid: use "192.12.2.0/24"`,
+			},
+		},
+		{
+			name:      "bits after prefix length",
+			cidr:      "192.12.2.8/24",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want: []string{
+				`spec.loadBalancerSourceRanges[0]: CIDR value "192.12.2.8/24" is ambiguous in this context (should be "192.12.2.0/24" or "192.12.2.8/32"?)`,
+			},
+		},
+		{
+			name:      "multiple problems",
+			cidr:      "192.012.2.8/24",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want: []string{
+				`spec.loadBalancerSourceRanges[0]: CIDR value "192.012.2.8/24" is ambiguous in this context (should be "192.12.2.0/24" or "192.12.2.8/32"?)`,
+				`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "192.012.2.8/24" is invalid: use "192.12.2.0/24"`,
+			},
+		},
+		{
+			name:      "IPv6 non-canonical format",
+			cidr:      "2001:db8:0:0::/64",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want: []string{
+				`spec.loadBalancerSourceRanges[0]: IPv6 CIDR value "2001:db8:0:0::/64" should be in RFC 5952 canonical format ("2001:db8::/64")`,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := GetWarningsForCIDR(tt.fieldPath, tt.cidr); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("getWarningsForCIDR() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestIsValidInterfaceAddress(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		in   string
+		err  string
+	}{
+		// GOOD VALUES
+		{
+			name: "ipv4",
+			in:   "1.2.3.4/24",
+		},
+		{
+			name: "ipv4, single IP",
+			in:   "1.1.1.1/32",
+		},
+		{
+			name: "ipv6",
+			in:   "2001:4860:4860::1/48",
+		},
+		{
+			name: "ipv6, single IP",
+			in:   "::1/128",
+		},
+
+		// BAD VALUES
+		{
+			name: "empty string",
+			in:   "",
+			err:  "must be a valid address in CIDR form",
+		},
+		{
+			name: "junk",
+			in:   "aaaaaaa",
+			err:  "must be a valid address in CIDR form",
+		},
+		{
+			name: "IP address",
+			in:   "1.2.3.4",
+			err:  "must be a valid address in CIDR form",
+		},
+		{
+			name: "partial URL",
+			in:   "192.168.0.1/healthz",
+			err:  "must be a valid address in CIDR form",
+		},
+		{
+			name: "partial URL 2",
+			in:   "192.168.0.1/0/99",
+			err:  "must be a valid address in CIDR form",
+		},
+		{
+			name: "negative prefix length",
+			in:   "192.168.0.0/-16",
+			err:  "must be a valid address in CIDR form",
+		},
+		{
+			name: "prefix length with sign",
+			in:   "192.168.0.0/+16",
+			err:  "must be a valid address in CIDR form",
+		},
+		{
+			name: "ipv6 non-canonical",
+			in:   "2001:0:0:0::0BCD/64",
+			err:  `must be in canonical form ("2001::bcd/64")`,
+		},
+		{
+			name: "ipv4 with leading 0s",
+			in:   "1.1.01.002/24",
+			err:  `must be in canonical form ("1.1.1.2/24")`,
+		},
+		{
+			name: "ipv4-in-ipv6 with ipv4-sized prefix",
+			in:   "::ffff:1.1.1.1/24",
+			err:  `must be in canonical form ("1.1.1.1/24")`,
+		},
+		{
+			name: "ipv4-in-ipv6 with ipv6-sized prefix",
+			in:   "::ffff:1.1.1.1/120",
+			err:  `must be in canonical form ("1.1.1.1/24")`,
+		},
+		{
+			name: "prefix length with leading 0s",
+			in:   "192.168.0.5/016",
+			err:  `must be in canonical form ("192.168.0.5/16")`,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := IsValidInterfaceAddress(field.NewPath(""), tc.in)
+			if tc.err == "" {
+				if len(errs) != 0 {
+					t.Errorf("expected %q to be valid but got: %v", tc.in, errs)
+				}
+			} else {
+				if len(errs) != 1 {
+					t.Errorf("expected %q to have 1 error but got: %v", tc.in, errs)
+				} else if !strings.Contains(errs[0].Detail, tc.err) {
+					t.Errorf("expected error for %q to contain %q but got: %q", tc.in, tc.err, errs[0].Detail)
+				}
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/validation.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/validation.go
new file mode 100644
index 0000000000..352ff19ae5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/validation.go
@@ -0,0 +1,468 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"fmt"
+	"math"
+	"regexp"
+	"strings"
+	"unicode"
+
+	"k8s.io/apimachinery/pkg/api/validate/content"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// IsQualifiedName tests whether the value passed is what Kubernetes calls a
+// "qualified name".  This is a format used in various places throughout the
+// system.  If the value is not valid, a list of error strings is returned.
+// Otherwise an empty list (or nil) is returned.
+// Deprecated: Use k8s.io/apimachinery/pkg/api/validate/content.IsQualifiedName instead.
+var IsQualifiedName = content.IsLabelKey
+
+// IsFullyQualifiedName checks if the name is fully qualified. This is similar
+// to IsFullyQualifiedDomainName but requires a minimum of 3 segments instead of
+// 2 and does not accept a trailing . as valid.
+// TODO: This function is deprecated and preserved until all callers migrate to
+// IsFullyQualifiedDomainName; please don't add new callers.
+func IsFullyQualifiedName(fldPath *field.Path, name string) field.ErrorList {
+	var allErrors field.ErrorList
+	if len(name) == 0 {
+		return append(allErrors, field.Required(fldPath, ""))
+	}
+	if errs := IsDNS1123Subdomain(name); len(errs) > 0 {
+		return append(allErrors, field.Invalid(fldPath, name, strings.Join(errs, ",")))
+	}
+	if len(strings.Split(name, ".")) < 3 {
+		return append(allErrors, field.Invalid(fldPath, name, "should be a domain with at least three segments separated by dots"))
+	}
+	return allErrors
+}
+
+// IsFullyQualifiedDomainName checks if the domain name is fully qualified. This
+// is similar to IsFullyQualifiedName but only requires a minimum of 2 segments
+// instead of 3 and accepts a trailing . as valid.
+func IsFullyQualifiedDomainName(fldPath *field.Path, name string) field.ErrorList {
+	var allErrors field.ErrorList
+	if len(name) == 0 {
+		return append(allErrors, field.Required(fldPath, ""))
+	}
+	if strings.HasSuffix(name, ".") {
+		name = name[:len(name)-1]
+	}
+	if errs := IsDNS1123Subdomain(name); len(errs) > 0 {
+		return append(allErrors, field.Invalid(fldPath, name, strings.Join(errs, ",")))
+	}
+	if len(strings.Split(name, ".")) < 2 {
+		return append(allErrors, field.Invalid(fldPath, name, "should be a domain with at least two segments separated by dots"))
+	}
+	for _, label := range strings.Split(name, ".") {
+		if errs := IsDNS1123Label(label); len(errs) > 0 {
+			return append(allErrors, field.Invalid(fldPath, label, strings.Join(errs, ",")))
+		}
+	}
+	return allErrors
+}
+
+// Allowed characters in an HTTP Path as defined by RFC 3986. A HTTP path may
+// contain:
+// * unreserved characters (alphanumeric, '-', '.', '_', '~')
+// * percent-encoded octets
+// * sub-delims ("!", "$", "&", "'", "(", ")", "*", "+", ",", ";", "=")
+// * a colon character (":")
+const httpPathFmt string = `[A-Za-z0-9/\-._~%!$&'()*+,;=:]+`
+
+var httpPathRegexp = regexp.MustCompile("^" + httpPathFmt + "$")
+
+// IsDomainPrefixedPath checks if the given string is a domain-prefixed path
+// (e.g. acme.io/foo). All characters before the first "/" must be a valid
+// subdomain as defined by RFC 1123. All characters trailing the first "/" must
+// be valid HTTP Path characters as defined by RFC 3986.
+func IsDomainPrefixedPath(fldPath *field.Path, dpPath string) field.ErrorList {
+	var allErrs field.ErrorList
+	if len(dpPath) == 0 {
+		return append(allErrs, field.Required(fldPath, ""))
+	}
+
+	segments := strings.SplitN(dpPath, "/", 2)
+	if len(segments) != 2 || len(segments[0]) == 0 || len(segments[1]) == 0 {
+		return append(allErrs, field.Invalid(fldPath, dpPath, "must be a domain-prefixed path (such as \"acme.io/foo\")"))
+	}
+
+	host := segments[0]
+	for _, err := range IsDNS1123Subdomain(host) {
+		allErrs = append(allErrs, field.Invalid(fldPath, host, err))
+	}
+
+	path := segments[1]
+	if !httpPathRegexp.MatchString(path) {
+		return append(allErrs, field.Invalid(fldPath, path, RegexError("Invalid path", httpPathFmt)))
+	}
+
+	return allErrs
+}
+
+// IsDomainPrefixedKey checks if the given key string is a domain-prefixed key
+// (e.g. acme.io/foo). All characters before the first "/" must be a valid
+// subdomain as defined by RFC 1123. All characters trailing the first "/" must
+// be non-empty and match the regex ^([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$.
+func IsDomainPrefixedKey(fldPath *field.Path, key string) field.ErrorList {
+	var allErrs field.ErrorList
+	if len(key) == 0 {
+		return append(allErrs, field.Required(fldPath, ""))
+	}
+	for _, errMessages := range content.IsLabelKey(key) {
+		allErrs = append(allErrs, field.Invalid(fldPath, key, errMessages))
+	}
+
+	if len(allErrs) > 0 {
+		return allErrs
+	}
+
+	segments := strings.Split(key, "/")
+	if len(segments) != 2 {
+		return append(allErrs, field.Invalid(fldPath, key, "must be a domain-prefixed key (such as \"acme.io/foo\")"))
+	}
+
+	return allErrs
+}
+
+// LabelValueMaxLength is a label's max length
+// Deprecated: Use k8s.io/apimachinery/pkg/api/validate/content.LabelValueMaxLength instead.
+const LabelValueMaxLength int = content.LabelValueMaxLength
+
+// IsValidLabelValue tests whether the value passed is a valid label value.  If
+// the value is not valid, a list of error strings is returned.  Otherwise an
+// empty list (or nil) is returned.
+// Deprecated: Use k8s.io/apimachinery/pkg/api/validate/content.IsLabelValue instead.
+var IsValidLabelValue = content.IsLabelValue
+
+const dns1123LabelFmt string = "[a-z0-9]([-a-z0-9]*[a-z0-9])?"
+const dns1123LabelFmtWithUnderscore string = "_?[a-z0-9]([-_a-z0-9]*[a-z0-9])?"
+
+const dns1123LabelErrMsg string = "a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character"
+
+// DNS1123LabelMaxLength is a label's max length in DNS (RFC 1123)
+const DNS1123LabelMaxLength int = 63
+
+var dns1123LabelRegexp = regexp.MustCompile("^" + dns1123LabelFmt + "$")
+
+// IsDNS1123Label tests for a string that conforms to the definition of a label in
+// DNS (RFC 1123).
+func IsDNS1123Label(value string) []string {
+	var errs []string
+	if len(value) > DNS1123LabelMaxLength {
+		errs = append(errs, MaxLenError(DNS1123LabelMaxLength))
+	}
+	if !dns1123LabelRegexp.MatchString(value) {
+		if dns1123SubdomainRegexp.MatchString(value) {
+			// It was a valid subdomain and not a valid label.  Since we
+			// already checked length, it must be dots.
+			errs = append(errs, "must not contain dots")
+		} else {
+			errs = append(errs, RegexError(dns1123LabelErrMsg, dns1123LabelFmt, "my-name", "123-abc"))
+		}
+	}
+	return errs
+}
+
+const dns1123SubdomainFmt string = dns1123LabelFmt + "(\\." + dns1123LabelFmt + ")*"
+const dns1123SubdomainErrorMsg string = "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character"
+
+const dns1123SubdomainFmtWithUnderscore string = dns1123LabelFmtWithUnderscore + "(\\." + dns1123LabelFmtWithUnderscore + ")*"
+const dns1123SubdomainErrorMsgFG string = "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '_', '-' or '.', and must start and end with an alphanumeric character"
+
+// DNS1123SubdomainMaxLength is a subdomain's max length in DNS (RFC 1123)
+const DNS1123SubdomainMaxLength int = 253
+
+var dns1123SubdomainRegexp = regexp.MustCompile("^" + dns1123SubdomainFmt + "$")
+var dns1123SubdomainRegexpWithUnderscore = regexp.MustCompile("^" + dns1123SubdomainFmtWithUnderscore + "$")
+
+// IsDNS1123Subdomain tests for a string that conforms to the definition of a
+// subdomain in DNS (RFC 1123).
+func IsDNS1123Subdomain(value string) []string {
+	var errs []string
+	if len(value) > DNS1123SubdomainMaxLength {
+		errs = append(errs, MaxLenError(DNS1123SubdomainMaxLength))
+	}
+	if !dns1123SubdomainRegexp.MatchString(value) {
+		errs = append(errs, RegexError(dns1123SubdomainErrorMsg, dns1123SubdomainFmt, "example.com"))
+	}
+	return errs
+}
+
+// IsDNS1123SubdomainWithUnderscore tests for a string that conforms to the definition of a
+// subdomain in DNS (RFC 1123), but allows the use of an underscore in the string
+func IsDNS1123SubdomainWithUnderscore(value string) []string {
+	var errs []string
+	if len(value) > DNS1123SubdomainMaxLength {
+		errs = append(errs, MaxLenError(DNS1123SubdomainMaxLength))
+	}
+	if !dns1123SubdomainRegexpWithUnderscore.MatchString(value) {
+		errs = append(errs, RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com"))
+	}
+	return errs
+}
+
+const dns1035LabelFmt string = "[a-z]([-a-z0-9]*[a-z0-9])?"
+const dns1035LabelErrMsg string = "a DNS-1035 label must consist of lower case alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character"
+
+// DNS1035LabelMaxLength is a label's max length in DNS (RFC 1035)
+const DNS1035LabelMaxLength int = 63
+
+var dns1035LabelRegexp = regexp.MustCompile("^" + dns1035LabelFmt + "$")
+
+// IsDNS1035Label tests for a string that conforms to the definition of a label in
+// DNS (RFC 1035).
+func IsDNS1035Label(value string) []string {
+	var errs []string
+	if len(value) > DNS1035LabelMaxLength {
+		errs = append(errs, MaxLenError(DNS1035LabelMaxLength))
+	}
+	if !dns1035LabelRegexp.MatchString(value) {
+		errs = append(errs, RegexError(dns1035LabelErrMsg, dns1035LabelFmt, "my-name", "abc-123"))
+	}
+	return errs
+}
+
+// wildcard definition - RFC 1034 section 4.3.3.
+// examples:
+// - valid: *.bar.com, *.foo.bar.com
+// - invalid: *.*.bar.com, *.foo.*.com, *bar.com, f*.bar.com, *
+const wildcardDNS1123SubdomainFmt = "\\*\\." + dns1123SubdomainFmt
+const wildcardDNS1123SubdomainErrMsg = "a wildcard DNS-1123 subdomain must start with '*.', followed by a valid DNS subdomain, which must consist of lower case alphanumeric characters, '-' or '.' and end with an alphanumeric character"
+
+// IsWildcardDNS1123Subdomain tests for a string that conforms to the definition of a
+// wildcard subdomain in DNS (RFC 1034 section 4.3.3).
+func IsWildcardDNS1123Subdomain(value string) []string {
+	wildcardDNS1123SubdomainRegexp := regexp.MustCompile("^" + wildcardDNS1123SubdomainFmt + "$")
+
+	var errs []string
+	if len(value) > DNS1123SubdomainMaxLength {
+		errs = append(errs, MaxLenError(DNS1123SubdomainMaxLength))
+	}
+	if !wildcardDNS1123SubdomainRegexp.MatchString(value) {
+		errs = append(errs, RegexError(wildcardDNS1123SubdomainErrMsg, wildcardDNS1123SubdomainFmt, "*.example.com"))
+	}
+	return errs
+}
+
+// IsCIdentifier tests for a string that conforms the definition of an identifier
+// in C. This checks the format, but not the length.
+// Deprecated: Use k8s.io/apimachinery/pkg/api/validate/content.IsCIdentifier instead.
+var IsCIdentifier = content.IsCIdentifier
+
+// IsValidPortNum tests that the argument is a valid, non-zero port number.
+func IsValidPortNum(port int) []string {
+	if 1 <= port && port <= 65535 {
+		return nil
+	}
+	return []string{InclusiveRangeError(1, 65535)}
+}
+
+// IsInRange tests that the argument is in an inclusive range.
+func IsInRange(value int, min int, max int) []string {
+	if value >= min && value <= max {
+		return nil
+	}
+	return []string{InclusiveRangeError(min, max)}
+}
+
+// Now in libcontainer UID/GID limits is 0 ~ 1<<31 - 1
+// TODO: once we have a type for UID/GID we should make these that type.
+const (
+	minUserID  = 0
+	maxUserID  = math.MaxInt32
+	minGroupID = 0
+	maxGroupID = math.MaxInt32
+)
+
+// IsValidGroupID tests that the argument is a valid Unix GID.
+func IsValidGroupID(gid int64) []string {
+	if minGroupID <= gid && gid <= maxGroupID {
+		return nil
+	}
+	return []string{InclusiveRangeError(minGroupID, maxGroupID)}
+}
+
+// IsValidUserID tests that the argument is a valid Unix UID.
+func IsValidUserID(uid int64) []string {
+	if minUserID <= uid && uid <= maxUserID {
+		return nil
+	}
+	return []string{InclusiveRangeError(minUserID, maxUserID)}
+}
+
+var portNameCharsetRegex = regexp.MustCompile("^[-a-z0-9]+$")
+var portNameOneLetterRegexp = regexp.MustCompile("[a-z]")
+
+// IsValidPortName check that the argument is valid syntax. It must be
+// non-empty and no more than 15 characters long. It may contain only [-a-z0-9]
+// and must contain at least one letter [a-z]. It must not start or end with a
+// hyphen, nor contain adjacent hyphens.
+//
+// Note: We only allow lower-case characters, even though RFC 6335 is case
+// insensitive.
+func IsValidPortName(port string) []string {
+	var errs []string
+	if len(port) > 15 {
+		errs = append(errs, MaxLenError(15))
+	}
+	if !portNameCharsetRegex.MatchString(port) {
+		errs = append(errs, "must contain only alpha-numeric characters (a-z, 0-9), and hyphens (-)")
+	}
+	if !portNameOneLetterRegexp.MatchString(port) {
+		errs = append(errs, "must contain at least one letter (a-z)")
+	}
+	if strings.Contains(port, "--") {
+		errs = append(errs, "must not contain consecutive hyphens")
+	}
+	if len(port) > 0 && (port[0] == '-' || port[len(port)-1] == '-') {
+		errs = append(errs, "must not begin or end with a hyphen")
+	}
+	return errs
+}
+
+const percentFmt string = "[0-9]+%"
+const percentErrMsg string = "a valid percent string must be a numeric string followed by an ending '%'"
+
+var percentRegexp = regexp.MustCompile("^" + percentFmt + "$")
+
+// IsValidPercent checks that string is in the form of a percentage
+func IsValidPercent(percent string) []string {
+	if !percentRegexp.MatchString(percent) {
+		return []string{RegexError(percentErrMsg, percentFmt, "1%", "93%")}
+	}
+	return nil
+}
+
+const httpHeaderNameFmt string = "[-A-Za-z0-9]+"
+const httpHeaderNameErrMsg string = "a valid HTTP header must consist of alphanumeric characters or '-'"
+
+var httpHeaderNameRegexp = regexp.MustCompile("^" + httpHeaderNameFmt + "$")
+
+// IsHTTPHeaderName checks that a string conforms to the Go HTTP library's
+// definition of a valid header field name (a stricter subset than RFC7230).
+func IsHTTPHeaderName(value string) []string {
+	if !httpHeaderNameRegexp.MatchString(value) {
+		return []string{RegexError(httpHeaderNameErrMsg, httpHeaderNameFmt, "X-Header-Name")}
+	}
+	return nil
+}
+
+const envVarNameFmt = "[-._a-zA-Z][-._a-zA-Z0-9]*"
+const envVarNameFmtErrMsg string = "a valid environment variable name must consist of alphabetic characters, digits, '_', '-', or '.', and must not start with a digit"
+
+// TODO(hirazawaui): Rename this when the RelaxedEnvironmentVariableValidation gate is removed.
+const relaxedEnvVarNameFmtErrMsg string = "a valid environment variable name must consist only of printable ASCII characters other than '='"
+
+var envVarNameRegexp = regexp.MustCompile("^" + envVarNameFmt + "$")
+
+// IsEnvVarName tests if a string is a valid environment variable name.
+func IsEnvVarName(value string) []string {
+	var errs []string
+	if !envVarNameRegexp.MatchString(value) {
+		errs = append(errs, RegexError(envVarNameFmtErrMsg, envVarNameFmt, "my.env-name", "MY_ENV.NAME", "MyEnvName1"))
+	}
+
+	errs = append(errs, hasChDirPrefix(value)...)
+	return errs
+}
+
+// IsRelaxedEnvVarName tests if a string is a valid environment variable name.
+func IsRelaxedEnvVarName(value string) []string {
+	var errs []string
+
+	if len(value) == 0 {
+		errs = append(errs, "environment variable name "+EmptyError())
+	}
+
+	for _, r := range value {
+		if r > unicode.MaxASCII || !unicode.IsPrint(r) || r == '=' {
+			errs = append(errs, relaxedEnvVarNameFmtErrMsg)
+			break
+		}
+	}
+
+	return errs
+}
+
+const configMapKeyFmt = `[-._a-zA-Z0-9]+`
+const configMapKeyErrMsg string = "a valid config key must consist of alphanumeric characters, '-', '_' or '.'"
+
+var configMapKeyRegexp = regexp.MustCompile("^" + configMapKeyFmt + "$")
+
+// IsConfigMapKey tests for a string that is a valid key for a ConfigMap or Secret
+func IsConfigMapKey(value string) []string {
+	var errs []string
+	if len(value) > DNS1123SubdomainMaxLength {
+		errs = append(errs, MaxLenError(DNS1123SubdomainMaxLength))
+	}
+	if !configMapKeyRegexp.MatchString(value) {
+		errs = append(errs, RegexError(configMapKeyErrMsg, configMapKeyFmt, "key.name", "KEY_NAME", "key-name"))
+	}
+	errs = append(errs, hasChDirPrefix(value)...)
+	return errs
+}
+
+// MaxLenError returns a string explanation of a "string too long" validation
+// failure.
+func MaxLenError(length int) string {
+	return fmt.Sprintf("must be no more than %d characters", length)
+}
+
+// RegexError returns a string explanation of a regex validation failure.
+func RegexError(msg string, fmt string, examples ...string) string {
+	if len(examples) == 0 {
+		return msg + " (regex used for validation is '" + fmt + "')"
+	}
+	msg += " (e.g. "
+	for i := range examples {
+		if i > 0 {
+			msg += " or "
+		}
+		msg += "'" + examples[i] + "', "
+	}
+	msg += "regex used for validation is '" + fmt + "')"
+	return msg
+}
+
+// EmptyError returns a string explanation of a "must not be empty" validation
+// failure.
+func EmptyError() string {
+	return "must be non-empty"
+}
+
+// InclusiveRangeError returns a string explanation of a numeric "must be
+// between" validation failure.
+func InclusiveRangeError(lo, hi int) string {
+	return fmt.Sprintf(`must be between %d and %d, inclusive`, lo, hi)
+}
+
+func hasChDirPrefix(value string) []string {
+	var errs []string
+	switch {
+	case value == ".":
+		errs = append(errs, `must not be '.'`)
+	case value == "..":
+		errs = append(errs, `must not be '..'`)
+	case strings.HasPrefix(value, ".."):
+		errs = append(errs, `must not start with '..'`)
+	}
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/validation_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/validation_test.go
new file mode 100644
index 0000000000..7affccfb29
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/validation/validation_test.go
@@ -0,0 +1,764 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestIsDNS1123Label(t *testing.T) {
+	goodValues := []string{
+		"a", "ab", "abc", "a1", "a-1", "a--1--2--b",
+		"0", "01", "012", "1a", "1-a", "1--a--b--2",
+		strings.Repeat("a", 63),
+	}
+	for _, val := range goodValues {
+		if msgs := IsDNS1123Label(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"", "A", "ABC", "aBc", "A1", "A-1", "1-A",
+		"-", "a-", "-a", "1-", "-1",
+		"_", "a_", "_a", "a_b", "1_", "_1", "1_2",
+		".", "a.", ".a", "a.b", "1.", ".1", "1.2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2",
+		strings.Repeat("a", 64),
+	}
+	for _, val := range badValues {
+		if msgs := IsDNS1123Label(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
+
+func TestIsDNS1123Subdomain(t *testing.T) {
+	goodValues := []string{
+		"a", "ab", "abc", "a1", "a-1", "a--1--2--b",
+		"0", "01", "012", "1a", "1-a", "1--a--b--2",
+		"a.a", "ab.a", "abc.a", "a1.a", "a-1.a", "a--1--2--b.a",
+		"a.1", "ab.1", "abc.1", "a1.1", "a-1.1", "a--1--2--b.1",
+		"0.a", "01.a", "012.a", "1a.a", "1-a.a", "1--a--b--2",
+		"0.1", "01.1", "012.1", "1a.1", "1-a.1", "1--a--b--2.1",
+		"a.b.c.d.e", "aa.bb.cc.dd.ee", "1.2.3.4.5", "11.22.33.44.55",
+		strings.Repeat("a", 253),
+	}
+	for _, val := range goodValues {
+		if msgs := IsDNS1123Subdomain(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"", "A", "ABC", "aBc", "A1", "A-1", "1-A",
+		"-", "a-", "-a", "1-", "-1",
+		"_", "a_", "_a", "a_b", "1_", "_1", "1_2",
+		".", "a.", ".a", "a..b", "1.", ".1", "1..2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2",
+		"A.a", "aB.a", "ab.A", "A1.a", "a1.A",
+		"A.1", "aB.1", "A1.1", "1A.1",
+		"0.A", "01.A", "012.A", "1A.a", "1a.A",
+		"A.B.C.D.E", "AA.BB.CC.DD.EE", "a.B.c.d.e", "aa.bB.cc.dd.ee",
+		"a@b", "a,b", "a_b", "a;b",
+		"a:b", "a%b", "a?b", "a$b",
+		strings.Repeat("a", 254),
+	}
+	for _, val := range badValues {
+		if msgs := IsDNS1123Subdomain(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
+
+func TestIsDNS1035Label(t *testing.T) {
+	goodValues := []string{
+		"a", "ab", "abc", "a1", "a-1", "a--1--2--b",
+		strings.Repeat("a", 63),
+	}
+	for _, val := range goodValues {
+		if msgs := IsDNS1035Label(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"0", "01", "012", "1a", "1-a", "1--a--b--2",
+		"", "A", "ABC", "aBc", "A1", "A-1", "1-A",
+		"-", "a-", "-a", "1-", "-1",
+		"_", "a_", "_a", "a_b", "1_", "_1", "1_2",
+		".", "a.", ".a", "a.b", "1.", ".1", "1.2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2",
+		strings.Repeat("a", 64),
+	}
+	for _, val := range badValues {
+		if msgs := IsDNS1035Label(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
+
+func TestIsValidPortNum(t *testing.T) {
+	goodValues := []int{1, 2, 1000, 16384, 32768, 65535}
+	for _, val := range goodValues {
+		if msgs := IsValidPortNum(val); len(msgs) != 0 {
+			t.Errorf("expected true for %d, got %v", val, msgs)
+		}
+	}
+
+	badValues := []int{0, -1, 65536, 100000}
+	for _, val := range badValues {
+		if msgs := IsValidPortNum(val); len(msgs) == 0 {
+			t.Errorf("expected false for %d", val)
+		}
+	}
+}
+
+func TestIsInRange(t *testing.T) {
+	goodValues := []struct {
+		value int
+		min   int
+		max   int
+	}{{1, 0, 10}, {5, 5, 20}, {25, 10, 25}}
+	for _, val := range goodValues {
+		if msgs := IsInRange(val.value, val.min, val.max); len(msgs) > 0 {
+			t.Errorf("expected no errors for %#v, but got %v", val, msgs)
+		}
+	}
+
+	badValues := []struct {
+		value int
+		min   int
+		max   int
+	}{{1, 2, 10}, {5, -4, 2}, {25, 100, 120}}
+	for _, val := range badValues {
+		if msgs := IsInRange(val.value, val.min, val.max); len(msgs) == 0 {
+			t.Errorf("expected errors for %#v", val)
+		}
+	}
+}
+
+func createGroupIDs(ids ...int64) []int64 {
+	var output []int64
+	for _, id := range ids {
+		output = append(output, int64(id))
+	}
+	return output
+}
+
+func createUserIDs(ids ...int64) []int64 {
+	var output []int64
+	for _, id := range ids {
+		output = append(output, int64(id))
+	}
+	return output
+}
+
+func TestIsValidGroupID(t *testing.T) {
+	goodValues := createGroupIDs(0, 1, 1000, 65535, 2147483647)
+	for _, val := range goodValues {
+		if msgs := IsValidGroupID(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%d': %v", val, msgs)
+		}
+	}
+
+	badValues := createGroupIDs(-1, -1003, 2147483648, 4147483647)
+	for _, val := range badValues {
+		if msgs := IsValidGroupID(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%d'", val)
+		}
+	}
+}
+
+func TestIsValidUserID(t *testing.T) {
+	goodValues := createUserIDs(0, 1, 1000, 65535, 2147483647)
+	for _, val := range goodValues {
+		if msgs := IsValidUserID(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%d': %v", val, msgs)
+		}
+	}
+
+	badValues := createUserIDs(-1, -1003, 2147483648, 4147483647)
+	for _, val := range badValues {
+		if msgs := IsValidUserID(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%d'", val)
+		}
+	}
+}
+
+func TestIsValidPortName(t *testing.T) {
+	goodValues := []string{"telnet", "re-mail-ck", "pop3", "a", "a-1", "1-a", "a-1-b-2-c", "1-a-2-b-3"}
+	for _, val := range goodValues {
+		if msgs := IsValidPortName(val); len(msgs) != 0 {
+			t.Errorf("expected true for %q: %v", val, msgs)
+		}
+	}
+
+	badValues := []string{"longerthan15characters", "", strings.Repeat("a", 16), "12345", "1-2-3-4", "-begin", "end-", "two--hyphens", "whois++"}
+	for _, val := range badValues {
+		if msgs := IsValidPortName(val); len(msgs) == 0 {
+			t.Errorf("expected false for %q", val)
+		}
+	}
+}
+
+func TestIsQualifiedName(t *testing.T) {
+	successCases := []string{
+		"simple",
+		"now-with-dashes",
+		"1-starts-with-num",
+		"1234",
+		"simple/simple",
+		"now-with-dashes/simple",
+		"now-with-dashes/now-with-dashes",
+		"now.with.dots/simple",
+		"now-with.dashes-and.dots/simple",
+		"1-num.2-num/3-num",
+		"1234/5678",
+		"1.2.3.4/5678",
+		"Uppercase_Is_OK_123",
+		"example.com/Uppercase_Is_OK_123",
+		"requests.storage-foo",
+		strings.Repeat("a", 63),
+		strings.Repeat("a", 253) + "/" + strings.Repeat("b", 63),
+	}
+	for i := range successCases {
+		if errs := IsQualifiedName(successCases[i]); len(errs) != 0 {
+			t.Errorf("case[%d]: %q: expected success: %v", i, successCases[i], errs)
+		}
+	}
+
+	errorCases := []string{
+		"nospecialchars%^=@",
+		"cantendwithadash-",
+		"-cantstartwithadash-",
+		"only/one/slash",
+		"Example.com/abc",
+		"example_com/abc",
+		"example.com/",
+		"/simple",
+		strings.Repeat("a", 64),
+		strings.Repeat("a", 254) + "/abc",
+	}
+	for i := range errorCases {
+		if errs := IsQualifiedName(errorCases[i]); len(errs) == 0 {
+			t.Errorf("case[%d]: %q: expected failure", i, errorCases[i])
+		}
+	}
+}
+
+func TestIsValidLabelValue(t *testing.T) {
+	successCases := []string{
+		"simple",
+		"now-with-dashes",
+		"1-starts-with-num",
+		"end-with-num-1",
+		"1234",                  // only num
+		strings.Repeat("a", 63), // to the limit
+		"",                      // empty value
+	}
+	for i := range successCases {
+		if errs := IsValidLabelValue(successCases[i]); len(errs) != 0 {
+			t.Errorf("case %s expected success: %v", successCases[i], errs)
+		}
+	}
+
+	errorCases := []string{
+		"nospecialchars%^=@",
+		"Tama-nui-te-rā.is.Māori.sun",
+		"\\backslashes\\are\\bad",
+		"-starts-with-dash",
+		"ends-with-dash-",
+		".starts.with.dot",
+		"ends.with.dot.",
+		strings.Repeat("a", 64), // over the limit
+	}
+	for i := range errorCases {
+		if errs := IsValidLabelValue(errorCases[i]); len(errs) == 0 {
+			t.Errorf("case[%d] expected failure", i)
+		}
+	}
+}
+
+func TestIsHTTPHeaderName(t *testing.T) {
+	goodValues := []string{
+		// Common ones
+		"Accept-Encoding", "Host", "If-Modified-Since", "X-Forwarded-For",
+		// Weirdo, but still conforming names
+		"a", "ab", "abc", "a1", "-a", "a-", "a-b", "a-1", "a--1--2--b", "--abc-123",
+		"A", "AB", "AbC", "A1", "-A", "A-", "A-B", "A-1", "A--1--2--B", "--123-ABC",
+	}
+	for _, val := range goodValues {
+		if msgs := IsHTTPHeaderName(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"Host:", "X-Forwarded-For:", "X-@Home",
+		"", "_", "a_", "_a", "1_", "1_2", ".", "a.", ".a", "a.b", "1.", ".1", "1.2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2", "#a#", "^", ",", ";", "=", "<",
+		"?", "@", "{",
+	}
+	for _, val := range badValues {
+		if msgs := IsHTTPHeaderName(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
+
+func TestIsValidPercent(t *testing.T) {
+	goodValues := []string{
+		"0%",
+		"00000%",
+		"1%",
+		"01%",
+		"99%",
+		"100%",
+		"101%",
+	}
+	for _, val := range goodValues {
+		if msgs := IsValidPercent(val); len(msgs) != 0 {
+			t.Errorf("expected true for %q: %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"",
+		"0",
+		"100",
+		"0.0%",
+		"99.9%",
+		"hundred",
+		" 1%",
+		"1% ",
+		"-0%",
+		"-1%",
+		"+1%",
+	}
+	for _, val := range badValues {
+		if msgs := IsValidPercent(val); len(msgs) == 0 {
+			t.Errorf("expected false for %q", val)
+		}
+	}
+}
+
+func TestIsConfigMapKey(t *testing.T) {
+	successCases := []string{
+		"a",
+		"good",
+		"good-good",
+		"still.good",
+		"this.is.also.good",
+		".so.is.this",
+		"THIS_IS_GOOD",
+		"so_is_this_17",
+	}
+
+	for i := range successCases {
+		if errs := IsConfigMapKey(successCases[i]); len(errs) != 0 {
+			t.Errorf("[%d] expected success: %v", i, errs)
+		}
+	}
+
+	failureCases := []string{
+		".",
+		"..",
+		"..bad",
+		"b*d",
+		"bad!&bad",
+	}
+
+	for i := range failureCases {
+		if errs := IsConfigMapKey(failureCases[i]); len(errs) == 0 {
+			t.Errorf("[%d] expected failure", i)
+		}
+	}
+}
+
+func TestIsWildcardDNS1123Subdomain(t *testing.T) {
+	goodValues := []string{
+		"*.example.com",
+		"*.bar.com",
+		"*.foo.bar.com",
+	}
+	for _, val := range goodValues {
+		if errs := IsWildcardDNS1123Subdomain(val); len(errs) != 0 {
+			t.Errorf("expected no errors for %q: %v", val, errs)
+		}
+	}
+
+	badValues := []string{
+		"*.*.bar.com",
+		"*.foo.*.com",
+		"*bar.com",
+		"f*.bar.com",
+		"*",
+	}
+	for _, val := range badValues {
+		if errs := IsWildcardDNS1123Subdomain(val); len(errs) == 0 {
+			t.Errorf("expected errors for %q", val)
+		}
+	}
+}
+
+func TestIsFullyQualifiedDomainName(t *testing.T) {
+	goodValues := []string{
+		"a.com",
+		"k8s.io",
+		"dev.k8s.io",
+		"dev.k8s.io.",
+		"foo.example.com",
+		"this.is.a.really.long.fqdn",
+		"bbc.co.uk",
+		"10.0.0.1", // DNS labels can start with numbers and there is no requirement for letters.
+		"hyphens-are-good.k8s.io",
+		strings.Repeat("a", 63) + ".k8s.io",
+		strings.Repeat("a", 63) + "." + strings.Repeat("b", 63) + "." + strings.Repeat("c", 63) + "." + strings.Repeat("d", 54) + ".k8s.io",
+	}
+	for _, val := range goodValues {
+		if err := IsFullyQualifiedDomainName(field.NewPath(""), val).ToAggregate(); err != nil {
+			t.Errorf("expected no errors for %q: %v", val, err)
+		}
+	}
+
+	badValues := []string{
+		".",
+		"...",
+		".io",
+		"com",
+		".com",
+		"Dev.k8s.io",
+		".foo.example.com",
+		"*.example.com",
+		"*.bar.com",
+		"*.foo.bar.com",
+		"underscores_are_bad.k8s.io",
+		"foo@bar.example.com",
+		"http://foo.example.com",
+		strings.Repeat("a", 64) + ".k8s.io",
+		strings.Repeat("a", 63) + "." + strings.Repeat("b", 63) + "." + strings.Repeat("c", 63) + "." + strings.Repeat("d", 55) + ".k8s.io",
+	}
+	for _, val := range badValues {
+		if err := IsFullyQualifiedDomainName(field.NewPath(""), val).ToAggregate(); err == nil {
+			t.Errorf("expected errors for %q", val)
+		}
+	}
+}
+
+func TestIsFullyQualifiedName(t *testing.T) {
+	goodValues := []string{
+		"dev.k8s.io",
+		"foo.example.com",
+		"this.is.a.really.long.fqdn",
+		"bbc.co.uk",
+		"10.0.0.1", // DNS labels can start with numbers and there is no requirement for letters.
+		"hyphens-are-good.k8s.io",
+		strings.Repeat("a", 246) + ".k8s.io",
+	}
+	for _, val := range goodValues {
+		if err := IsFullyQualifiedName(field.NewPath(""), val).ToAggregate(); err != nil {
+			t.Errorf("expected no errors for %q: %v", val, err)
+		}
+	}
+
+	badValues := []string{
+		"...",
+		"dev.k8s.io.",
+		".io",
+		"Dev.k8s.io",
+		"k8s.io",
+		"*.example.com",
+		"*.bar.com",
+		"*.foo.bar.com",
+		"underscores_are_bad.k8s.io",
+		"foo@bar.example.com",
+		"http://foo.example.com",
+		strings.Repeat("a", 247) + ".k8s.io",
+	}
+	for _, val := range badValues {
+		if err := IsFullyQualifiedName(field.NewPath(""), val).ToAggregate(); err == nil {
+			t.Errorf("expected errors for %q", val)
+		}
+	}
+
+	messageTests := []struct {
+		name       string
+		targetName string
+		err        string
+	}{{
+		name:       "name needs to be fully qualified, i.e., contains at least 2 dots",
+		targetName: "k8s.io",
+		err:        "should be a domain with at least three segments separated by dots",
+	}, {
+		name:       "name should not include scheme",
+		targetName: "http://foo.k8s.io",
+		err:        "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters",
+	}, {
+		name:       "email should be invalid",
+		targetName: "example@foo.k8s.io",
+		err:        "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters",
+	}, {
+		name:       "name cannot be empty",
+		targetName: "",
+		err:        "Required value",
+	}, {
+		name:       "name must conform to RFC 1123",
+		targetName: "A.B.C",
+		err:        "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters",
+	}}
+	for _, tc := range messageTests {
+		err := IsFullyQualifiedName(field.NewPath(""), tc.targetName).ToAggregate()
+		switch {
+		case tc.err == "" && err != nil:
+			t.Errorf("%q: unexpected error: %v", tc.name, err)
+		case tc.err != "" && err == nil:
+			t.Errorf("%q: unexpected no error, expected %s", tc.name, tc.err)
+		case tc.err != "" && err != nil && !strings.Contains(err.Error(), tc.err):
+			t.Errorf("%q: expected %s, got %v", tc.name, tc.err, err)
+		}
+	}
+}
+
+func TestIsDomainPrefixedPath(t *testing.T) {
+	goodValues := []string{
+		"a/b",
+		"a/b/c/d",
+		"a.com/foo",
+		"a.b.c.d/foo",
+		"k8s.io/foo/bar",
+		"k8s.io/FOO/BAR",
+		"dev.k8s.io/more/path",
+		"this.is.a.really.long.fqdn/even/longer/path/just/because",
+		"bbc.co.uk/path/goes/here",
+		"10.0.0.1/foo",
+		"hyphens-are-good.k8s.io/and-in-paths-too",
+		strings.Repeat("a", 240) + ".k8s.io/a",
+		"k8s.io/" + strings.Repeat("a", 240),
+	}
+	for _, val := range goodValues {
+		if err := IsDomainPrefixedPath(field.NewPath(""), val).ToAggregate(); err != nil {
+			t.Errorf("expected no errors for %q: %v", val, err)
+		}
+	}
+
+	badValues := []string{
+		".",
+		"...",
+		"/b",
+		"com",
+		".com",
+		"a.b.c.d/foo?a=b",
+		"a.b.c.d/foo#a",
+		"Dev.k8s.io",
+		".foo.example.com",
+		"*.example.com",
+		"example.com/foo{}[]@^`",
+		"underscores_are_bad.k8s.io",
+		"underscores_are_bad.k8s.io/foo",
+		"foo@bar.example.com",
+		"foo@bar.example.com/foo",
+		strings.Repeat("a", 247) + ".k8s.io",
+	}
+	for _, val := range badValues {
+		if err := IsDomainPrefixedPath(field.NewPath(""), val).ToAggregate(); err == nil {
+			t.Errorf("expected errors for %q", val)
+		}
+	}
+}
+
+func TestIsRelaxedEnvVarName(t *testing.T) {
+	goodValues := []string{
+		"-", ":", "_", "+a", ">a", "<a",
+		"a.", "a..", "*a", "%a", "?a",
+		"a:a", "a_a", "aAz", "~a", "|a",
+		"a0a", "a9", "/a", "a ", "#a",
+		"0a", "0 a", "'a", "(a", "@a",
+	}
+	for _, val := range goodValues {
+		if msgs := IsRelaxedEnvVarName(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"", "=", "a=", "1=a", "a=b", "#%=&&",
+		string(rune(1)) + "abc", string(rune(130)) + "abc",
+		"Ç ç", "Ä ä", "Ñ ñ", "Ø ø",
+	}
+
+	for _, val := range badValues {
+		if msgs := IsRelaxedEnvVarName(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
+
+func TestIsDNS1123SubdomainWithUnderscore(t *testing.T) {
+	tests := []struct {
+		name     string
+		value    string
+		expected []string
+	}{
+		{
+			name:     "valid subdomain",
+			value:    "example.com",
+			expected: nil,
+		},
+		{
+			name:     "valid subdomain with underscore",
+			value:    "_example.com",
+			expected: nil,
+		},
+		{
+			name:     "valid subdomain with multiple segments",
+			value:    "sub._example.com",
+			expected: nil,
+		},
+		{
+			name:     "valid subdomain with hyphen",
+			value:    "sub-domain.example.com",
+			expected: nil,
+		},
+		{
+			name:     "valid subdomain with underscore in middle",
+			value:    "sub_domain.example.com",
+			expected: nil,
+		},
+		{
+			name:     "empty string",
+			value:    "",
+			expected: []string{RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+		{
+			name:     "invalid uppercase characters",
+			value:    "Example.com",
+			expected: []string{RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+		{
+			name:     "invalid starting character",
+			value:    "-example.com",
+			expected: []string{RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+		{
+			name:     "invalid ending character",
+			value:    "example.com-",
+			expected: []string{RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+		{
+			name:     "invalid characters",
+			value:    "example@.com",
+			expected: []string{RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+		{
+			name:     "too long subdomain",
+			value:    "a." + string(make([]byte, 251)) + ".com",
+			expected: []string{MaxLenError(DNS1123SubdomainMaxLength), RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+		{
+			name:     "multiple dots",
+			value:    "example..com",
+			expected: []string{RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+		{
+			name:     "underscore only",
+			value:    "_",
+			expected: []string{RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := IsDNS1123SubdomainWithUnderscore(tt.value)
+			if !reflect.DeepEqual(result, tt.expected) {
+				t.Errorf("IsDNS1123SubdomainWithUnderscore(%q) = %v; want %v", tt.value, result, tt.expected)
+			}
+		})
+	}
+}
+
+func TestIsDomainPrefixedKey(t *testing.T) {
+	tests := []struct {
+		name     string
+		value    string
+		expected field.ErrorList
+	}{
+		{
+			name:     "valid domain-prefixed key 1",
+			value:    "example.com/foo",
+			expected: nil,
+		},
+		{
+			name:     "valid domain-prefixed key  2",
+			value:    "example/com",
+			expected: nil,
+		},
+		{
+			name:     "invalid key 1",
+			value:    "example",
+			expected: field.ErrorList{field.Invalid(field.NewPath("test"), "example", "must be a domain-prefixed key (such as \"acme.io/foo\")")},
+		},
+		{
+			name:     "invalid key 2",
+			value:    "example/foo/bar",
+			expected: field.ErrorList{field.Invalid(field.NewPath("test"), "example/foo/bar", "a valid label key must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')")},
+		},
+		{
+			name:     "invalid key 3",
+			value:    "/example/foo",
+			expected: field.ErrorList{field.Invalid(field.NewPath("test"), "/example/foo", "a valid label key must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')")},
+		},
+		{
+			name:     "invalid key 4",
+			value:    "",
+			expected: field.ErrorList{field.Required(field.NewPath("test"), "")},
+		},
+		{
+			name:     "invalid key 5",
+			value:    "example.com/_e",
+			expected: field.ErrorList{field.Invalid(field.NewPath("test"), "example.com/_e", "name part must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]')")},
+		},
+		{
+			name:     "invalid key 6",
+			value:    "example.com/e_",
+			expected: field.ErrorList{field.Invalid(field.NewPath("test"), "example.com/e_", "name part must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]')")},
+		},
+		{
+			name:     "invalid key 7",
+			value:    "example.com/e?",
+			expected: field.ErrorList{field.Invalid(field.NewPath("test"), "example.com/e?", "name part must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]')")},
+		},
+		{
+			name:     "invalid key 8",
+			value:    "example.com/e_$",
+			expected: field.ErrorList{field.Invalid(field.NewPath("test"), "example.com/e_$", "name part must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]')")},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := IsDomainPrefixedKey(field.NewPath("test"), tt.value)
+			if !reflect.DeepEqual(result, tt.expected) {
+				t.Errorf("IsDomainPrefixedKey(%q) = %v; want %v", tt.value, result, tt.expected)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/version/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/version/doc.go
new file mode 100644
index 0000000000..da88813da2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/version/doc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package version provides utilities for version number comparisons
+package version
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/version/version.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/version/version.go
new file mode 100644
index 0000000000..72c0769e6c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/version/version.go
@@ -0,0 +1,484 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package version
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+
+	apimachineryversion "k8s.io/apimachinery/pkg/version"
+)
+
+// Version is an opaque representation of a version number
+type Version struct {
+	components    []uint
+	semver        bool
+	preRelease    string
+	buildMetadata string
+}
+
+var (
+	// versionMatchRE splits a version string into numeric and "extra" parts
+	versionMatchRE = regexp.MustCompile(`^\s*v?([0-9]+(?:\.[0-9]+)*)(.*)*$`)
+	// extraMatchRE splits the "extra" part of versionMatchRE into semver pre-release and build metadata; it does not validate the "no leading zeroes" constraint for pre-release
+	extraMatchRE = regexp.MustCompile(`^(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?\s*$`)
+)
+
+func parse(str string, semver bool) (*Version, error) {
+	parts := versionMatchRE.FindStringSubmatch(str)
+	if parts == nil {
+		return nil, fmt.Errorf("could not parse %q as version", str)
+	}
+	numbers, extra := parts[1], parts[2]
+
+	components := strings.Split(numbers, ".")
+	if (semver && len(components) != 3) || (!semver && len(components) < 2) {
+		return nil, fmt.Errorf("illegal version string %q", str)
+	}
+
+	v := &Version{
+		components: make([]uint, len(components)),
+		semver:     semver,
+	}
+	for i, comp := range components {
+		if (i == 0 || semver) && strings.HasPrefix(comp, "0") && comp != "0" {
+			return nil, fmt.Errorf("illegal zero-prefixed version component %q in %q", comp, str)
+		}
+		num, err := strconv.ParseUint(comp, 10, 0)
+		if err != nil {
+			return nil, fmt.Errorf("illegal non-numeric version component %q in %q: %v", comp, str, err)
+		}
+		v.components[i] = uint(num)
+	}
+
+	if semver && extra != "" {
+		extraParts := extraMatchRE.FindStringSubmatch(extra)
+		if extraParts == nil {
+			return nil, fmt.Errorf("could not parse pre-release/metadata (%s) in version %q", extra, str)
+		}
+		v.preRelease, v.buildMetadata = extraParts[1], extraParts[2]
+
+		for _, comp := range strings.Split(v.preRelease, ".") {
+			if _, err := strconv.ParseUint(comp, 10, 0); err == nil {
+				if strings.HasPrefix(comp, "0") && comp != "0" {
+					return nil, fmt.Errorf("illegal zero-prefixed version component %q in %q", comp, str)
+				}
+			}
+		}
+	}
+
+	return v, nil
+}
+
+// HighestSupportedVersion returns the highest supported version
+// This function assumes that the highest supported version must be v1.x.
+func HighestSupportedVersion(versions []string) (*Version, error) {
+	if len(versions) == 0 {
+		return nil, errors.New("empty array for supported versions")
+	}
+
+	var (
+		highestSupportedVersion *Version
+		theErr                  error
+	)
+
+	for i := len(versions) - 1; i >= 0; i-- {
+		currentHighestVer, err := ParseGeneric(versions[i])
+		if err != nil {
+			theErr = err
+			continue
+		}
+
+		if currentHighestVer.Major() > 1 {
+			continue
+		}
+
+		if highestSupportedVersion == nil || highestSupportedVersion.LessThan(currentHighestVer) {
+			highestSupportedVersion = currentHighestVer
+		}
+	}
+
+	if highestSupportedVersion == nil {
+		return nil, fmt.Errorf(
+			"could not find a highest supported version from versions (%v) reported: %+v",
+			versions, theErr)
+	}
+
+	if highestSupportedVersion.Major() != 1 {
+		return nil, fmt.Errorf("highest supported version reported is %v, must be v1.x", highestSupportedVersion)
+	}
+
+	return highestSupportedVersion, nil
+}
+
+// ParseGeneric parses a "generic" version string. The version string must consist of two
+// or more dot-separated numeric fields (the first of which can't have leading zeroes),
+// followed by arbitrary uninterpreted data (which need not be separated from the final
+// numeric field by punctuation). For convenience, leading and trailing whitespace is
+// ignored, and the version can be preceded by the letter "v". See also ParseSemantic.
+func ParseGeneric(str string) (*Version, error) {
+	return parse(str, false)
+}
+
+// MustParseGeneric is like ParseGeneric except that it panics on error
+func MustParseGeneric(str string) *Version {
+	v, err := ParseGeneric(str)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// Parse tries to do ParseSemantic first to keep more information.
+// If ParseSemantic fails, it would just do ParseGeneric.
+func Parse(str string) (*Version, error) {
+	v, err := parse(str, true)
+	if err != nil {
+		return parse(str, false)
+	}
+	return v, err
+}
+
+// MustParse is like Parse except that it panics on error
+func MustParse(str string) *Version {
+	v, err := Parse(str)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// ParseMajorMinor parses a "generic" version string and returns a version with the major and minor version.
+func ParseMajorMinor(str string) (*Version, error) {
+	v, err := ParseGeneric(str)
+	if err != nil {
+		return nil, err
+	}
+	return MajorMinor(v.Major(), v.Minor()), nil
+}
+
+// MustParseMajorMinor is like ParseMajorMinor except that it panics on error
+func MustParseMajorMinor(str string) *Version {
+	v, err := ParseMajorMinor(str)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// ParseSemantic parses a version string that exactly obeys the syntax and semantics of
+// the "Semantic Versioning" specification (http://semver.org/) (although it ignores
+// leading and trailing whitespace, and allows the version to be preceded by "v"). For
+// version strings that are not guaranteed to obey the Semantic Versioning syntax, use
+// ParseGeneric.
+func ParseSemantic(str string) (*Version, error) {
+	return parse(str, true)
+}
+
+// MustParseSemantic is like ParseSemantic except that it panics on error
+func MustParseSemantic(str string) *Version {
+	v, err := ParseSemantic(str)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// MajorMinor returns a version with the provided major and minor version.
+func MajorMinor(major, minor uint) *Version {
+	return &Version{components: []uint{major, minor}}
+}
+
+// Major returns the major release number
+func (v *Version) Major() uint {
+	return v.components[0]
+}
+
+// Minor returns the minor release number
+func (v *Version) Minor() uint {
+	return v.components[1]
+}
+
+// Patch returns the patch release number if v is a Semantic Version, or 0
+func (v *Version) Patch() uint {
+	if len(v.components) < 3 {
+		return 0
+	}
+	return v.components[2]
+}
+
+// BuildMetadata returns the build metadata, if v is a Semantic Version, or ""
+func (v *Version) BuildMetadata() string {
+	return v.buildMetadata
+}
+
+// PreRelease returns the prerelease metadata, if v is a Semantic Version, or ""
+func (v *Version) PreRelease() string {
+	return v.preRelease
+}
+
+// Components returns the version number components
+func (v *Version) Components() []uint {
+	return v.components
+}
+
+// WithMajor returns copy of the version object with requested major number
+func (v *Version) WithMajor(major uint) *Version {
+	result := *v
+	result.components = []uint{major, v.Minor(), v.Patch()}
+	return &result
+}
+
+// WithMinor returns copy of the version object with requested minor number
+func (v *Version) WithMinor(minor uint) *Version {
+	result := *v
+	result.components = []uint{v.Major(), minor, v.Patch()}
+	return &result
+}
+
+// SubtractMinor returns the version with offset from the original minor, with the same major and no patch.
+// If -offset >= current minor, the minor would be 0.
+func (v *Version) OffsetMinor(offset int) *Version {
+	var minor uint
+	if offset >= 0 {
+		minor = v.Minor() + uint(offset)
+	} else {
+		diff := uint(-offset)
+		if diff < v.Minor() {
+			minor = v.Minor() - diff
+		}
+	}
+	return MajorMinor(v.Major(), minor)
+}
+
+// SubtractMinor returns the version diff minor versions back, with the same major and no patch.
+// If diff >= current minor, the minor would be 0.
+func (v *Version) SubtractMinor(diff uint) *Version {
+	return v.OffsetMinor(-int(diff))
+}
+
+// AddMinor returns the version diff minor versions forward, with the same major and no patch.
+func (v *Version) AddMinor(diff uint) *Version {
+	return v.OffsetMinor(int(diff))
+}
+
+// WithPatch returns copy of the version object with requested patch number
+func (v *Version) WithPatch(patch uint) *Version {
+	result := *v
+	result.components = []uint{v.Major(), v.Minor(), patch}
+	return &result
+}
+
+// WithPreRelease returns copy of the version object with requested prerelease
+func (v *Version) WithPreRelease(preRelease string) *Version {
+	if len(preRelease) == 0 {
+		return v
+	}
+	result := *v
+	result.components = []uint{v.Major(), v.Minor(), v.Patch()}
+	result.preRelease = preRelease
+	return &result
+}
+
+// WithBuildMetadata returns copy of the version object with requested buildMetadata
+func (v *Version) WithBuildMetadata(buildMetadata string) *Version {
+	result := *v
+	result.components = []uint{v.Major(), v.Minor(), v.Patch()}
+	result.buildMetadata = buildMetadata
+	return &result
+}
+
+// String converts a Version back to a string; note that for versions parsed with
+// ParseGeneric, this will not include the trailing uninterpreted portion of the version
+// number.
+func (v *Version) String() string {
+	if v == nil {
+		return "<nil>"
+	}
+	var buffer bytes.Buffer
+
+	for i, comp := range v.components {
+		if i > 0 {
+			buffer.WriteString(".")
+		}
+		buffer.WriteString(fmt.Sprintf("%d", comp))
+	}
+	if v.preRelease != "" {
+		buffer.WriteString("-")
+		buffer.WriteString(v.preRelease)
+	}
+	if v.buildMetadata != "" {
+		buffer.WriteString("+")
+		buffer.WriteString(v.buildMetadata)
+	}
+
+	return buffer.String()
+}
+
+// compareInternal returns -1 if v is less than other, 1 if it is greater than other, or 0
+// if they are equal
+func (v *Version) compareInternal(other *Version) int {
+
+	vLen := len(v.components)
+	oLen := len(other.components)
+	for i := 0; i < vLen && i < oLen; i++ {
+		switch {
+		case other.components[i] < v.components[i]:
+			return 1
+		case other.components[i] > v.components[i]:
+			return -1
+		}
+	}
+
+	// If components are common but one has more items and they are not zeros, it is bigger
+	switch {
+	case oLen < vLen && !onlyZeros(v.components[oLen:]):
+		return 1
+	case oLen > vLen && !onlyZeros(other.components[vLen:]):
+		return -1
+	}
+
+	if !v.semver || !other.semver {
+		return 0
+	}
+
+	switch {
+	case v.preRelease == "" && other.preRelease != "":
+		return 1
+	case v.preRelease != "" && other.preRelease == "":
+		return -1
+	case v.preRelease == other.preRelease: // includes case where both are ""
+		return 0
+	}
+
+	vPR := strings.Split(v.preRelease, ".")
+	oPR := strings.Split(other.preRelease, ".")
+	for i := 0; i < len(vPR) && i < len(oPR); i++ {
+		vNum, err := strconv.ParseUint(vPR[i], 10, 0)
+		if err == nil {
+			oNum, err := strconv.ParseUint(oPR[i], 10, 0)
+			if err == nil {
+				switch {
+				case oNum < vNum:
+					return 1
+				case oNum > vNum:
+					return -1
+				default:
+					continue
+				}
+			}
+		}
+		if oPR[i] < vPR[i] {
+			return 1
+		} else if oPR[i] > vPR[i] {
+			return -1
+		}
+	}
+
+	switch {
+	case len(oPR) < len(vPR):
+		return 1
+	case len(oPR) > len(vPR):
+		return -1
+	}
+
+	return 0
+}
+
+// returns false if array contain any non-zero element
+func onlyZeros(array []uint) bool {
+	for _, num := range array {
+		if num != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+// EqualTo tests if a version is equal to a given version.
+func (v *Version) EqualTo(other *Version) bool {
+	if v == nil {
+		return other == nil
+	}
+	if other == nil {
+		return false
+	}
+	return v.compareInternal(other) == 0
+}
+
+// AtLeast tests if a version is at least equal to a given minimum version. If both
+// Versions are Semantic Versions, this will use the Semantic Version comparison
+// algorithm. Otherwise, it will compare only the numeric components, with non-present
+// components being considered "0" (ie, "1.4" is equal to "1.4.0").
+func (v *Version) AtLeast(min *Version) bool {
+	return v.compareInternal(min) != -1
+}
+
+// LessThan tests if a version is less than a given version. (It is exactly the opposite
+// of AtLeast, for situations where asking "is v too old?" makes more sense than asking
+// "is v new enough?".)
+func (v *Version) LessThan(other *Version) bool {
+	return v.compareInternal(other) == -1
+}
+
+// GreaterThan tests if a version is greater than a given version.
+func (v *Version) GreaterThan(other *Version) bool {
+	return v.compareInternal(other) == 1
+}
+
+// Compare compares v against a version string (which will be parsed as either Semantic
+// or non-Semantic depending on v). On success it returns -1 if v is less than other, 1 if
+// it is greater than other, or 0 if they are equal.
+func (v *Version) Compare(other string) (int, error) {
+	ov, err := parse(other, v.semver)
+	if err != nil {
+		return 0, err
+	}
+	return v.compareInternal(ov), nil
+}
+
+// WithInfo returns copy of the version object.
+// Deprecated: The Info field has been removed from the Version struct. This method no longer modifies the Version object.
+func (v *Version) WithInfo(info apimachineryversion.Info) *Version {
+	result := *v
+	return &result
+}
+
+// Info returns the version information of a component.
+// Deprecated: Use Info() from effective version instead.
+func (v *Version) Info() *apimachineryversion.Info {
+	if v == nil {
+		return nil
+	}
+	// in case info is empty, or the major and minor in info is different from the actual major and minor
+	return &apimachineryversion.Info{
+		Major:      Itoa(v.Major()),
+		Minor:      Itoa(v.Minor()),
+		GitVersion: v.String(),
+	}
+}
+
+func Itoa(i uint) string {
+	if i == 0 {
+		return ""
+	}
+	return strconv.Itoa(int(i))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/version/version_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/version/version_test.go
new file mode 100644
index 0000000000..a3345ddfdd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/version/version_test.go
@@ -0,0 +1,550 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package version
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+)
+
+type testItem struct {
+	version    string
+	unparsed   string
+	equalsPrev bool
+}
+
+func testOne(v *Version, item, prev testItem) error {
+	str := v.String()
+	if item.unparsed == "" {
+		if str != item.version {
+			return fmt.Errorf("bad round-trip: %q -> %q", item.version, str)
+		}
+	} else {
+		if str != item.unparsed {
+			return fmt.Errorf("bad unparse: %q -> %q, expected %q", item.version, str, item.unparsed)
+		}
+	}
+
+	if prev.version != "" {
+		cmp, err := v.Compare(prev.version)
+		if err != nil {
+			return fmt.Errorf("unexpected parse error: %v", err)
+		}
+		rv, err := parse(prev.version, v.semver)
+		if err != nil {
+			return fmt.Errorf("unexpected parse error: %v", err)
+		}
+		rcmp, err := rv.Compare(item.version)
+		if err != nil {
+			return fmt.Errorf("unexpected parse error: %v", err)
+		}
+
+		switch {
+		case cmp == -1:
+			return fmt.Errorf("unexpected ordering %q < %q", item.version, prev.version)
+		case cmp == 0 && !item.equalsPrev:
+			return fmt.Errorf("unexpected comparison %q == %q", item.version, prev.version)
+		case cmp == 1 && item.equalsPrev:
+			return fmt.Errorf("unexpected comparison %q != %q", item.version, prev.version)
+		case cmp != -rcmp:
+			return fmt.Errorf("unexpected reverse comparison %q <=> %q %v %v %v %v", item.version, prev.version, cmp, rcmp, v.Components(), rv.Components())
+		}
+	}
+
+	return nil
+}
+
+func TestSemanticVersions(t *testing.T) {
+	tests := []testItem{
+		// This is every version string that appears in the 2.0 semver spec,
+		// sorted in strictly increasing order except as noted.
+		{version: "0.1.0"},
+		{version: "1.0.0-0.3.7"},
+		{version: "1.0.0-alpha"},
+		{version: "1.0.0-alpha+001", equalsPrev: true},
+		{version: "1.0.0-alpha.1"},
+		{version: "1.0.0-alpha.beta"},
+		{version: "1.0.0-beta"},
+		{version: "1.0.0-beta+exp.sha.5114f85", equalsPrev: true},
+		{version: "1.0.0-beta.2"},
+		{version: "1.0.0-beta.11"},
+		{version: "1.0.0-rc.1"},
+		{version: "1.0.0-x.7.z.92"},
+		{version: "1.0.0"},
+		{version: "1.0.0+20130313144700", equalsPrev: true},
+		{version: "1.8.0-alpha.3"},
+		{version: "1.8.0-alpha.3.673+73326ef01d2d7c"},
+		{version: "1.9.0"},
+		{version: "1.10.0"},
+		{version: "1.11.0"},
+		{version: "2.0.0"},
+		{version: "2.1.0"},
+		{version: "2.1.1"},
+		{version: "42.0.0"},
+
+		// We also allow whitespace and "v" prefix
+		{version: "   42.0.0", unparsed: "42.0.0", equalsPrev: true},
+		{version: "\t42.0.0  ", unparsed: "42.0.0", equalsPrev: true},
+		{version: "43.0.0-1", unparsed: "43.0.0-1"},
+		{version: "43.0.0-1  ", unparsed: "43.0.0-1", equalsPrev: true},
+		{version: "v43.0.0-1", unparsed: "43.0.0-1", equalsPrev: true},
+		{version: "  v43.0.0", unparsed: "43.0.0"},
+		{version: " 43.0.0 ", unparsed: "43.0.0", equalsPrev: true},
+	}
+
+	var prev testItem
+	for _, item := range tests {
+		v, err := ParseSemantic(item.version)
+		if err != nil {
+			t.Errorf("unexpected parse error: %v", err)
+			continue
+		}
+		err = testOne(v, item, prev)
+		if err != nil {
+			t.Errorf("%v", err)
+		}
+		prev = item
+	}
+}
+
+func TestBadSemanticVersions(t *testing.T) {
+	tests := []string{
+		// "MUST take the form X.Y.Z"
+		"1",
+		"1.2",
+		"1.2.3.4",
+		".2.3",
+		"1..3",
+		"1.2.",
+		"",
+		"..",
+		// "where X, Y, and Z are non-negative integers"
+		"-1.2.3",
+		"1.-2.3",
+		"1.2.-3",
+		"1a.2.3",
+		"1.2a.3",
+		"1.2.3a",
+		"a1.2.3",
+		"a.b.c",
+		"1 .2.3",
+		"1. 2.3",
+		// "and MUST NOT contain leading zeroes."
+		"01.2.3",
+		"1.02.3",
+		"1.2.03",
+		// "[pre-release] identifiers MUST comprise only ASCII alphanumerics and hyphen"
+		"1.2.3-/",
+		// "[pre-release] identifiers MUST NOT be empty"
+		"1.2.3-",
+		"1.2.3-.",
+		"1.2.3-foo.",
+		"1.2.3-.foo",
+		// "Numeric [pre-release] identifiers MUST NOT include leading zeroes"
+		"1.2.3-01",
+		// "[build metadata] identifiers MUST comprise only ASCII alphanumerics and hyphen"
+		"1.2.3+/",
+		// "[build metadata] identifiers MUST NOT be empty"
+		"1.2.3+",
+		"1.2.3+.",
+		"1.2.3+foo.",
+		"1.2.3+.foo",
+
+		// whitespace/"v"-prefix checks
+		"v 1.2.3",
+		"vv1.2.3",
+	}
+
+	for i := range tests {
+		_, err := ParseSemantic(tests[i])
+		if err == nil {
+			t.Errorf("unexpected success parsing invalid semver %q", tests[i])
+		}
+	}
+}
+
+func TestGenericVersions(t *testing.T) {
+	tests := []testItem{
+		// This is all of the strings from TestSemanticVersions, plus some strings
+		// from TestBadSemanticVersions that should parse as generic versions,
+		// plus some additional strings.
+		{version: "0.1.0", unparsed: "0.1.0"},
+		{version: "1.0.0-0.3.7", unparsed: "1.0.0"},
+		{version: "1.0.0-alpha", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0-alpha+001", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0-alpha.1", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0-alpha.beta", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0.beta", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0-beta+exp.sha.5114f85", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0.beta.2", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0.beta.11", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0.rc.1", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0-x.7.z.92", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0+20130313144700", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.2", unparsed: "1.2"},
+		{version: "1.2a.3", unparsed: "1.2", equalsPrev: true},
+		{version: "1.2.3", unparsed: "1.2.3"},
+		{version: "1.2.3.0", unparsed: "1.2.3.0", equalsPrev: true},
+		{version: "1.2.3a", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.3-foo.", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.3-.foo", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.3-01", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.3+", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.3+foo.", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.3+.foo", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.02.3", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.03", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.003", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.3.4", unparsed: "1.2.3.4"},
+		{version: "1.2.3.4b3", unparsed: "1.2.3.4", equalsPrev: true},
+		{version: "1.2.3.4.5", unparsed: "1.2.3.4.5"},
+		{version: "1.9.0", unparsed: "1.9.0"},
+		{version: "1.9.0.0.0.0.0.0", unparsed: "1.9.0.0.0.0.0.0", equalsPrev: true},
+		{version: "1.10.0", unparsed: "1.10.0"},
+		{version: "1.11.0", unparsed: "1.11.0"},
+		{version: "1.11.0.0.5", unparsed: "1.11.0.0.5"},
+		{version: "2.0.0", unparsed: "2.0.0"},
+		{version: "2.1.0", unparsed: "2.1.0"},
+		{version: "2.1.1", unparsed: "2.1.1"},
+		{version: "42.0.0", unparsed: "42.0.0"},
+		{version: "   42.0.0", unparsed: "42.0.0", equalsPrev: true},
+		{version: "\t42.0.0  ", unparsed: "42.0.0", equalsPrev: true},
+		{version: "42.0.0-1", unparsed: "42.0.0", equalsPrev: true},
+		{version: "42.0.0-1  ", unparsed: "42.0.0", equalsPrev: true},
+		{version: "v42.0.0-1", unparsed: "42.0.0", equalsPrev: true},
+		{version: "  v43.0.0", unparsed: "43.0.0"},
+		{version: " 43.0.0 ", unparsed: "43.0.0", equalsPrev: true},
+	}
+
+	var prev testItem
+	for _, item := range tests {
+		v, err := ParseGeneric(item.version)
+		if err != nil {
+			t.Errorf("unexpected parse error: %v", err)
+			continue
+		}
+		err = testOne(v, item, prev)
+		if err != nil {
+			t.Errorf("%v", err)
+		}
+		prev = item
+	}
+}
+
+func TestBadGenericVersions(t *testing.T) {
+	tests := []string{
+		"1",
+		"01.2.3",
+		"-1.2.3",
+		"1.-2.3",
+		".2.3",
+		"1..3",
+		"1a.2.3",
+		"a1.2.3",
+		"1 .2.3",
+		"1. 2.3",
+		"1.bob",
+		"bob",
+		"v 1.2.3",
+		"vv1.2.3",
+		"",
+		".",
+	}
+
+	for i := range tests {
+		_, err := ParseGeneric(tests[i])
+		if err == nil {
+			t.Errorf("unexpected success parsing invalid version %q", tests[i])
+		}
+	}
+}
+
+func TestComponents(t *testing.T) {
+
+	var tests = []struct {
+		version               string
+		semver                bool
+		expectedComponents    []uint
+		expectedMajor         uint
+		expectedMinor         uint
+		expectedPatch         uint
+		expectedPreRelease    string
+		expectedBuildMetadata string
+	}{
+		{
+			version:            "1.0.2",
+			semver:             true,
+			expectedComponents: []uint{1, 0, 2},
+			expectedMajor:      1,
+			expectedMinor:      0,
+			expectedPatch:      2,
+		},
+		{
+			version:               "1.0.2-alpha+001",
+			semver:                true,
+			expectedComponents:    []uint{1, 0, 2},
+			expectedMajor:         1,
+			expectedMinor:         0,
+			expectedPatch:         2,
+			expectedPreRelease:    "alpha",
+			expectedBuildMetadata: "001",
+		},
+		{
+			version:            "1.2",
+			semver:             false,
+			expectedComponents: []uint{1, 2},
+			expectedMajor:      1,
+			expectedMinor:      2,
+		},
+		{
+			version:               "1.0.2-beta+exp.sha.5114f85",
+			semver:                true,
+			expectedComponents:    []uint{1, 0, 2},
+			expectedMajor:         1,
+			expectedMinor:         0,
+			expectedPatch:         2,
+			expectedPreRelease:    "beta",
+			expectedBuildMetadata: "exp.sha.5114f85",
+		},
+	}
+
+	for _, test := range tests {
+		version, _ := parse(test.version, test.semver)
+		if !reflect.DeepEqual(test.expectedComponents, version.Components()) {
+			t.Error("parse returned un'expected components")
+		}
+		if test.expectedMajor != version.Major() {
+			t.Errorf("parse returned version.Major %d, expected %d", test.expectedMajor, version.Major())
+		}
+		if test.expectedMinor != version.Minor() {
+			t.Errorf("parse returned version.Minor %d, expected %d", test.expectedMinor, version.Minor())
+		}
+		if test.expectedPatch != version.Patch() {
+			t.Errorf("parse returned version.Patch %d, expected %d", test.expectedPatch, version.Patch())
+		}
+		if test.expectedPreRelease != version.PreRelease() {
+			t.Errorf("parse returned version.PreRelease %s, expected %s", test.expectedPreRelease, version.PreRelease())
+		}
+		if test.expectedBuildMetadata != version.BuildMetadata() {
+			t.Errorf("parse returned version.BuildMetadata %s, expected %s", test.expectedBuildMetadata, version.BuildMetadata())
+		}
+	}
+}
+
+func TestHighestSupportedVersion(t *testing.T) {
+	testCases := []struct {
+		versions                        []string
+		expectedHighestSupportedVersion string
+		shouldFail                      bool
+	}{
+		{
+			versions:                        []string{"v1.0.0"},
+			expectedHighestSupportedVersion: "1.0.0",
+			shouldFail:                      false,
+		},
+		{
+			versions:   []string{"0.3.0"},
+			shouldFail: true,
+		},
+		{
+			versions:   []string{"0.2.0"},
+			shouldFail: true,
+		},
+		{
+			versions:                        []string{"1.0.0"},
+			expectedHighestSupportedVersion: "1.0.0",
+			shouldFail:                      false,
+		},
+		{
+			versions:   []string{"v0.3.0"},
+			shouldFail: true,
+		},
+		{
+			versions:   []string{"v0.2.0"},
+			shouldFail: true,
+		},
+		{
+			versions:   []string{"0.2.0", "v0.3.0"},
+			shouldFail: true,
+		},
+		{
+			versions:                        []string{"0.2.0", "v1.0.0"},
+			expectedHighestSupportedVersion: "1.0.0",
+			shouldFail:                      false,
+		},
+		{
+			versions:                        []string{"0.2.0", "v1.2.3"},
+			expectedHighestSupportedVersion: "1.2.3",
+			shouldFail:                      false,
+		},
+		{
+			versions:                        []string{"v1.2.3", "v0.3.0"},
+			expectedHighestSupportedVersion: "1.2.3",
+			shouldFail:                      false,
+		},
+		{
+			versions:                        []string{"v1.2.3", "v0.3.0", "2.0.1"},
+			expectedHighestSupportedVersion: "1.2.3",
+			shouldFail:                      false,
+		},
+		{
+			versions:                        []string{"v1.2.3", "4.9.12", "v0.3.0", "2.0.1"},
+			expectedHighestSupportedVersion: "1.2.3",
+			shouldFail:                      false,
+		},
+		{
+			versions:                        []string{"4.9.12", "2.0.1"},
+			expectedHighestSupportedVersion: "",
+			shouldFail:                      true,
+		},
+		{
+			versions:                        []string{"v1.2.3", "boo", "v0.3.0", "2.0.1"},
+			expectedHighestSupportedVersion: "1.2.3",
+			shouldFail:                      false,
+		},
+		{
+			versions:                        []string{},
+			expectedHighestSupportedVersion: "",
+			shouldFail:                      true,
+		},
+		{
+			versions:                        []string{"var", "boo", "foo"},
+			expectedHighestSupportedVersion: "",
+			shouldFail:                      true,
+		},
+	}
+
+	for _, tc := range testCases {
+		// Arrange & Act
+		actual, err := HighestSupportedVersion(tc.versions)
+
+		// Assert
+		if tc.shouldFail && err == nil {
+			t.Fatalf("expecting highestSupportedVersion to fail, but got nil error for testcase: %#v", tc)
+		}
+		if !tc.shouldFail && err != nil {
+			t.Fatalf("unexpected error during ValidatePlugin for testcase: %#v\r\n err:%v", tc, err)
+		}
+		if tc.expectedHighestSupportedVersion != "" {
+			result, err := actual.Compare(tc.expectedHighestSupportedVersion)
+			if err != nil {
+				t.Fatalf("comparison failed with %v for testcase %#v", err, tc)
+			}
+			if result != 0 {
+				t.Fatalf("expectedHighestSupportedVersion %v, but got %v for tc: %#v", tc.expectedHighestSupportedVersion, actual, tc)
+			}
+		}
+	}
+}
+
+func TestOffsetMinor(t *testing.T) {
+	var tests = []struct {
+		version            string
+		diff               int
+		expectedComponents []uint
+	}{
+		{
+			version:            "1.0.2",
+			diff:               -3,
+			expectedComponents: []uint{1, 0},
+		},
+		{
+			version:            "1.3.2-alpha+001",
+			diff:               -2,
+			expectedComponents: []uint{1, 1},
+		},
+		{
+			version:            "1.3.2-alpha+001",
+			diff:               -3,
+			expectedComponents: []uint{1, 0},
+		},
+		{
+			version:            "1.20",
+			diff:               -5,
+			expectedComponents: []uint{1, 15},
+		},
+		{
+			version:            "1.20",
+			diff:               5,
+			expectedComponents: []uint{1, 25},
+		},
+	}
+
+	for _, test := range tests {
+		version, _ := ParseGeneric(test.version)
+		if !reflect.DeepEqual(test.expectedComponents, version.OffsetMinor(test.diff).Components()) {
+			t.Error("parse returned un'expected components")
+		}
+	}
+}
+
+func TestParse(t *testing.T) {
+
+	var tests = []struct {
+		version               string
+		expectErr             bool
+		expectedComponents    []uint
+		expectedPreRelease    string
+		expectedBuildMetadata string
+	}{
+		{
+			version:            "1.0.2",
+			expectedComponents: []uint{1, 0, 2},
+		},
+		{
+			version:               "1.0.2-alpha+001",
+			expectedComponents:    []uint{1, 0, 2},
+			expectedPreRelease:    "alpha",
+			expectedBuildMetadata: "001",
+		},
+		{
+			version:            "1.2",
+			expectedComponents: []uint{1, 2},
+		},
+		{
+			version:               "1.0.2-beta+exp.sha.5114f85",
+			expectedComponents:    []uint{1, 0, 2},
+			expectedPreRelease:    "beta",
+			expectedBuildMetadata: "exp.sha.5114f85",
+		},
+		{
+			version:   "a.b.c",
+			expectErr: true,
+		},
+	}
+
+	for _, test := range tests {
+		version, err := Parse(test.version)
+		if test.expectErr {
+			if err == nil {
+				t.Fatalf("got no err, expected err")
+			}
+			continue
+		}
+		if !reflect.DeepEqual(test.expectedComponents, version.Components()) {
+			t.Error("parse returned un'expected components")
+		}
+		if test.expectedPreRelease != version.PreRelease() {
+			t.Errorf("parse returned version.PreRelease %s, expected %s", test.expectedPreRelease, version.PreRelease())
+		}
+		if test.expectedBuildMetadata != version.BuildMetadata() {
+			t.Errorf("parse returned version.BuildMetadata %s, expected %s", test.expectedBuildMetadata, version.BuildMetadata())
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/backoff.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/backoff.go
new file mode 100644
index 0000000000..177be09a95
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/backoff.go
@@ -0,0 +1,518 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"math"
+	"sync"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/utils/clock"
+)
+
+// Backoff holds parameters applied to a Backoff function.
+type Backoff struct {
+	// The initial duration.
+	Duration time.Duration
+	// Duration is multiplied by factor each iteration, if factor is not zero
+	// and the limits imposed by Steps and Cap have not been reached.
+	// Should not be negative.
+	// The jitter does not contribute to the updates to the duration parameter.
+	Factor float64
+	// The sleep at each iteration is the duration plus an additional
+	// amount chosen uniformly at random from the interval between
+	// zero and `jitter*duration`.
+	Jitter float64
+	// The remaining number of iterations in which the duration
+	// parameter may change (but progress can be stopped earlier by
+	// hitting the cap). If not positive, the duration is not
+	// changed. Used for exponential backoff in combination with
+	// Factor and Cap.
+	Steps int
+	// A limit on revised values of the duration parameter. If a
+	// multiplication by the factor parameter would make the duration
+	// exceed the cap then the duration is set to the cap and the
+	// steps parameter is set to zero.
+	Cap time.Duration
+}
+
+// Step returns an amount of time to sleep determined by the original
+// Duration and Jitter. The backoff is mutated to update its Steps and
+// Duration. A nil Backoff always has a zero-duration step.
+func (b *Backoff) Step() time.Duration {
+	if b == nil {
+		return 0
+	}
+	var nextDuration time.Duration
+	nextDuration, b.Duration, b.Steps = delay(b.Steps, b.Duration, b.Cap, b.Factor, b.Jitter)
+	return nextDuration
+}
+
+// DelayFunc returns a function that will compute the next interval to
+// wait given the arguments in b. It does not mutate the original backoff
+// but the function is safe to use only from a single goroutine.
+func (b Backoff) DelayFunc() DelayFunc {
+	steps := b.Steps
+	duration := b.Duration
+	cap := b.Cap
+	factor := b.Factor
+	jitter := b.Jitter
+
+	return func() time.Duration {
+		var nextDuration time.Duration
+		// jitter is applied per step and is not cumulative over multiple steps
+		nextDuration, duration, steps = delay(steps, duration, cap, factor, jitter)
+		return nextDuration
+	}
+}
+
+// Timer returns a timer implementation appropriate to this backoff's parameters
+// for use with wait functions.
+func (b Backoff) Timer() Timer {
+	if b.Steps > 1 || b.Jitter != 0 {
+		return &variableTimer{new: internalClock.NewTimer, fn: b.DelayFunc()}
+	}
+	if b.Duration > 0 {
+		return &fixedTimer{new: internalClock.NewTicker, interval: b.Duration}
+	}
+	return newNoopTimer()
+}
+
+// delay implements the core delay algorithm used in this package.
+func delay(steps int, duration, cap time.Duration, factor, jitter float64) (_ time.Duration, next time.Duration, nextSteps int) {
+	// when steps is non-positive, do not alter the base duration
+	if steps < 1 {
+		if jitter > 0 {
+			return Jitter(duration, jitter), duration, 0
+		}
+		return duration, duration, 0
+	}
+	steps--
+
+	// calculate the next step's interval
+	if factor != 0 {
+		next = time.Duration(float64(duration) * factor)
+		if cap > 0 && next > cap {
+			next = cap
+			steps = 0
+		}
+	} else {
+		next = duration
+	}
+
+	// add jitter for this step
+	if jitter > 0 {
+		duration = Jitter(duration, jitter)
+	}
+
+	return duration, next, steps
+
+}
+
+// DelayWithReset returns a DelayFunc that will return the appropriate next interval to
+// wait. Every resetInterval the backoff parameters are reset to their initial state.
+// This method is safe to invoke from multiple goroutines, but all calls will advance
+// the backoff state when Factor is set. If Factor is zero, this method is the same as
+// invoking b.DelayFunc() since Steps has no impact without Factor. If resetInterval is
+// zero no backoff will be performed as the same calling DelayFunc with a zero factor
+// and steps.
+func (b Backoff) DelayWithReset(c clock.Clock, resetInterval time.Duration) DelayFunc {
+	if b.Factor <= 0 {
+		return b.DelayFunc()
+	}
+	if resetInterval <= 0 {
+		b.Steps = 0
+		b.Factor = 0
+		return b.DelayFunc()
+	}
+	return (&backoffManager{
+		backoff:        b,
+		initialBackoff: b,
+		resetInterval:  resetInterval,
+
+		clock:     c,
+		lastStart: c.Now(),
+		timer:     nil,
+	}).Step
+}
+
+// Until loops until stop channel is closed, running f every period.
+//
+// Until is syntactic sugar on top of JitterUntil with zero jitter factor and
+// with sliding = true (which means the timer for period starts after the f
+// completes).
+//
+// Contextual logging: UntilWithContext should be used instead of Until in code which supports contextual logging.
+func Until(f func(), period time.Duration, stopCh <-chan struct{}) {
+	JitterUntil(f, period, 0.0, true, stopCh)
+}
+
+// UntilWithContext loops until context is done, running f every period.
+//
+// UntilWithContext is syntactic sugar on top of JitterUntilWithContext
+// with zero jitter factor and with sliding = true (which means the timer
+// for period starts after the f completes).
+func UntilWithContext(ctx context.Context, f func(context.Context), period time.Duration) {
+	JitterUntilWithContext(ctx, f, period, 0.0, true)
+}
+
+// NonSlidingUntil loops until stop channel is closed, running f every
+// period.
+//
+// NonSlidingUntil is syntactic sugar on top of JitterUntil with zero jitter
+// factor, with sliding = false (meaning the timer for period starts at the same
+// time as the function starts).
+//
+// Contextual logging: NonSlidingUntilWithContext should be used instead of NonSlidingUntil in code which supports contextual logging.
+func NonSlidingUntil(f func(), period time.Duration, stopCh <-chan struct{}) {
+	JitterUntil(f, period, 0.0, false, stopCh)
+}
+
+// NonSlidingUntilWithContext loops until context is done, running f every
+// period.
+//
+// NonSlidingUntilWithContext is syntactic sugar on top of JitterUntilWithContext
+// with zero jitter factor, with sliding = false (meaning the timer for period
+// starts at the same time as the function starts).
+func NonSlidingUntilWithContext(ctx context.Context, f func(context.Context), period time.Duration) {
+	JitterUntilWithContext(ctx, f, period, 0.0, false)
+}
+
+// JitterUntil loops until stop channel is closed, running f every period.
+//
+// If jitterFactor is positive, the period is jittered before every run of f.
+// If jitterFactor is not positive, the period is unchanged and not jittered.
+//
+// If sliding is true, the period is computed after f runs. If it is false then
+// period includes the runtime for f.
+//
+// Close stopCh to stop. f may not be invoked if stop channel is already
+// closed. Pass NeverStop to if you don't want it stop.
+//
+// Contextual logging: JitterUntilWithContext should be used instead of JitterUntil in code which supports contextual logging.
+func JitterUntil(f func(), period time.Duration, jitterFactor float64, sliding bool, stopCh <-chan struct{}) {
+	BackoffUntil(f, NewJitteredBackoffManager(period, jitterFactor, &clock.RealClock{}), sliding, stopCh)
+}
+
+// JitterUntilWithContext loops until context is done, running f every period.
+//
+// If jitterFactor is positive, the period is jittered before every run of f.
+// If jitterFactor is not positive, the period is unchanged and not jittered.
+//
+// If sliding is true, the period is computed after f runs. If it is false then
+// period includes the runtime for f.
+//
+// Cancel context to stop. f may not be invoked if context is already done.
+func JitterUntilWithContext(ctx context.Context, f func(context.Context), period time.Duration, jitterFactor float64, sliding bool) {
+	BackoffUntilWithContext(ctx, f, NewJitteredBackoffManager(period, jitterFactor, &clock.RealClock{}), sliding)
+}
+
+// BackoffUntil loops until stop channel is closed, run f every duration given by BackoffManager.
+//
+// If sliding is true, the period is computed after f runs. If it is false then
+// period includes the runtime for f.
+//
+// Contextual logging: BackoffUntilWithContext should be used instead of BackoffUntil in code which supports contextual logging.
+func BackoffUntil(f func(), backoff BackoffManager, sliding bool, stopCh <-chan struct{}) {
+	BackoffUntilWithContext(ContextForChannel(stopCh), func(context.Context) { f() }, backoff, sliding)
+}
+
+// BackoffUntilWithContext loops until context is done, run f every duration given by BackoffManager.
+//
+// If sliding is true, the period is computed after f runs. If it is false then
+// period includes the runtime for f.
+func BackoffUntilWithContext(ctx context.Context, f func(ctx context.Context), backoff BackoffManager, sliding bool) {
+	var t clock.Timer
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		default:
+		}
+
+		if !sliding {
+			t = backoff.Backoff()
+		}
+
+		func() {
+			defer runtime.HandleCrashWithContext(ctx)
+			f(ctx)
+		}()
+
+		if sliding {
+			t = backoff.Backoff()
+		}
+
+		// NOTE: b/c there is no priority selection in golang
+		// it is possible for this to race, meaning we could
+		// trigger t.C and stopCh, and t.C select falls through.
+		// In order to mitigate we re-check stopCh at the beginning
+		// of every loop to prevent extra executions of f().
+		select {
+		case <-ctx.Done():
+			if !t.Stop() {
+				<-t.C()
+			}
+			return
+		case <-t.C():
+		}
+	}
+}
+
+// backoffManager provides simple backoff behavior in a threadsafe manner to a caller.
+type backoffManager struct {
+	backoff        Backoff
+	initialBackoff Backoff
+	resetInterval  time.Duration
+
+	clock clock.Clock
+
+	lock      sync.Mutex
+	lastStart time.Time
+	timer     clock.Timer
+}
+
+// Step returns the expected next duration to wait.
+func (b *backoffManager) Step() time.Duration {
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	switch {
+	case b.resetInterval == 0:
+		b.backoff = b.initialBackoff
+	case b.clock.Now().Sub(b.lastStart) > b.resetInterval:
+		b.backoff = b.initialBackoff
+		b.lastStart = b.clock.Now()
+	}
+	return b.backoff.Step()
+}
+
+// Backoff implements BackoffManager.Backoff, it returns a timer so caller can block on the timer
+// for exponential backoff. The returned timer must be drained before calling Backoff() the second
+// time.
+func (b *backoffManager) Backoff() clock.Timer {
+	b.lock.Lock()
+	defer b.lock.Unlock()
+	if b.timer == nil {
+		b.timer = b.clock.NewTimer(b.Step())
+	} else {
+		b.timer.Reset(b.Step())
+	}
+	return b.timer
+}
+
+// Timer returns a new Timer instance that shares the clock and the reset behavior with all other
+// timers.
+func (b *backoffManager) Timer() Timer {
+	return DelayFunc(b.Step).Timer(b.clock)
+}
+
+// BackoffManager manages backoff with a particular scheme based on its underlying implementation.
+type BackoffManager interface {
+	// Backoff returns a shared clock.Timer that is Reset on every invocation. This method is not
+	// safe for use from multiple threads. It returns a timer for backoff, and caller shall backoff
+	// until Timer.C() drains. If the second Backoff() is called before the timer from the first
+	// Backoff() call finishes, the first timer will NOT be drained and result in undetermined
+	// behavior.
+	Backoff() clock.Timer
+}
+
+// Deprecated: Will be removed when the legacy polling functions are removed.
+type exponentialBackoffManagerImpl struct {
+	backoff              *Backoff
+	backoffTimer         clock.Timer
+	lastBackoffStart     time.Time
+	initialBackoff       time.Duration
+	backoffResetDuration time.Duration
+	clock                clock.Clock
+}
+
+// NewExponentialBackoffManager returns a manager for managing exponential backoff. Each backoff is jittered and
+// backoff will not exceed the given max. If the backoff is not called within resetDuration, the backoff is reset.
+// This backoff manager is used to reduce load during upstream unhealthiness.
+//
+// Deprecated: Will be removed when the legacy Poll methods are removed. Callers should construct a
+// Backoff struct, use DelayWithReset() to get a DelayFunc that periodically resets itself, and then
+// invoke Timer() when calling wait.BackoffUntil.
+//
+// Instead of:
+//
+//	bm := wait.NewExponentialBackoffManager(init, max, reset, factor, jitter, clock)
+//	...
+//	wait.BackoffUntil(..., bm.Backoff, ...)
+//
+// Use:
+//
+//	delayFn := wait.Backoff{
+//	  Duration: init,
+//	  Cap:      max,
+//	  Steps:    int(math.Ceil(float64(max) / float64(init))), // now a required argument
+//	  Factor:   factor,
+//	  Jitter:   jitter,
+//	}.DelayWithReset(reset, clock)
+//	wait.BackoffUntil(..., delayFn.Timer(), ...)
+func NewExponentialBackoffManager(initBackoff, maxBackoff, resetDuration time.Duration, backoffFactor, jitter float64, c clock.Clock) BackoffManager {
+	return &exponentialBackoffManagerImpl{
+		backoff: &Backoff{
+			Duration: initBackoff,
+			Factor:   backoffFactor,
+			Jitter:   jitter,
+
+			// the current impl of wait.Backoff returns Backoff.Duration once steps are used up, which is not
+			// what we ideally need here, we set it to max int and assume we will never use up the steps
+			Steps: math.MaxInt32,
+			Cap:   maxBackoff,
+		},
+		backoffTimer:         nil,
+		initialBackoff:       initBackoff,
+		lastBackoffStart:     c.Now(),
+		backoffResetDuration: resetDuration,
+		clock:                c,
+	}
+}
+
+func (b *exponentialBackoffManagerImpl) getNextBackoff() time.Duration {
+	if b.clock.Now().Sub(b.lastBackoffStart) > b.backoffResetDuration {
+		b.backoff.Steps = math.MaxInt32
+		b.backoff.Duration = b.initialBackoff
+	}
+	b.lastBackoffStart = b.clock.Now()
+	return b.backoff.Step()
+}
+
+// Backoff implements BackoffManager.Backoff, it returns a timer so caller can block on the timer for exponential backoff.
+// The returned timer must be drained before calling Backoff() the second time
+func (b *exponentialBackoffManagerImpl) Backoff() clock.Timer {
+	if b.backoffTimer == nil {
+		b.backoffTimer = b.clock.NewTimer(b.getNextBackoff())
+	} else {
+		b.backoffTimer.Reset(b.getNextBackoff())
+	}
+	return b.backoffTimer
+}
+
+// Deprecated: Will be removed when the legacy polling functions are removed.
+type jitteredBackoffManagerImpl struct {
+	clock        clock.Clock
+	duration     time.Duration
+	jitter       float64
+	backoffTimer clock.Timer
+}
+
+// NewJitteredBackoffManager returns a BackoffManager that backoffs with given duration plus given jitter. If the jitter
+// is negative, backoff will not be jittered.
+//
+// Deprecated: Will be removed when the legacy Poll methods are removed. Callers should construct a
+// Backoff struct and invoke Timer() when calling wait.BackoffUntil.
+//
+// Instead of:
+//
+//	bm := wait.NewJitteredBackoffManager(duration, jitter, clock)
+//	...
+//	wait.BackoffUntil(..., bm.Backoff, ...)
+//
+// Use:
+//
+//	wait.BackoffUntil(..., wait.Backoff{Duration: duration, Jitter: jitter}.Timer(), ...)
+func NewJitteredBackoffManager(duration time.Duration, jitter float64, c clock.Clock) BackoffManager {
+	return &jitteredBackoffManagerImpl{
+		clock:        c,
+		duration:     duration,
+		jitter:       jitter,
+		backoffTimer: nil,
+	}
+}
+
+func (j *jitteredBackoffManagerImpl) getNextBackoff() time.Duration {
+	jitteredPeriod := j.duration
+	if j.jitter > 0.0 {
+		jitteredPeriod = Jitter(j.duration, j.jitter)
+	}
+	return jitteredPeriod
+}
+
+// Backoff implements BackoffManager.Backoff, it returns a timer so caller can block on the timer for jittered backoff.
+// The returned timer must be drained before calling Backoff() the second time
+func (j *jitteredBackoffManagerImpl) Backoff() clock.Timer {
+	backoff := j.getNextBackoff()
+	if j.backoffTimer == nil {
+		j.backoffTimer = j.clock.NewTimer(backoff)
+	} else {
+		j.backoffTimer.Reset(backoff)
+	}
+	return j.backoffTimer
+}
+
+// ExponentialBackoff repeats a condition check with exponential backoff.
+//
+// It repeatedly checks the condition and then sleeps, using `backoff.Step()`
+// to determine the length of the sleep and adjust Duration and Steps.
+// Stops and returns as soon as:
+// 1. the condition check returns true or an error,
+// 2. `backoff.Steps` checks of the condition have been done, or
+// 3. a sleep truncated by the cap on duration has been completed.
+// In case (1) the returned error is what the condition function returned.
+// In all other cases, ErrWaitTimeout is returned.
+//
+// Since backoffs are often subject to cancellation, we recommend using
+// ExponentialBackoffWithContext and passing a context to the method.
+func ExponentialBackoff(backoff Backoff, condition ConditionFunc) error {
+	for backoff.Steps > 0 {
+		if ok, err := runConditionWithCrashProtection(condition); err != nil || ok {
+			return err
+		}
+		if backoff.Steps == 1 {
+			break
+		}
+		time.Sleep(backoff.Step())
+	}
+	return ErrWaitTimeout
+}
+
+// ExponentialBackoffWithContext repeats a condition check with exponential backoff.
+// It immediately returns an error if the condition returns an error, the context is cancelled
+// or hits the deadline, or if the maximum attempts defined in backoff is exceeded (ErrWaitTimeout).
+// If an error is returned by the condition the backoff stops immediately. The condition will
+// never be invoked more than backoff.Steps times.
+func ExponentialBackoffWithContext(ctx context.Context, backoff Backoff, condition ConditionWithContextFunc) error {
+	for backoff.Steps > 0 {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+
+		if ok, err := runConditionWithCrashProtectionWithContext(ctx, condition); err != nil || ok {
+			return err
+		}
+
+		if backoff.Steps == 1 {
+			break
+		}
+
+		waitBeforeRetry := backoff.Step()
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-time.After(waitBeforeRetry):
+		}
+	}
+
+	return ErrWaitTimeout
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/delay.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/delay.go
new file mode 100644
index 0000000000..1d3dcaa74e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/delay.go
@@ -0,0 +1,51 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"k8s.io/utils/clock"
+)
+
+// DelayFunc returns the next time interval to wait.
+type DelayFunc func() time.Duration
+
+// Timer takes an arbitrary delay function and returns a timer that can handle arbitrary interval changes.
+// Use Backoff{...}.Timer() for simple delays and more efficient timers.
+func (fn DelayFunc) Timer(c clock.Clock) Timer {
+	return &variableTimer{fn: fn, new: c.NewTimer}
+}
+
+// Until takes an arbitrary delay function and runs until cancelled or the condition indicates exit. This
+// offers all of the functionality of the methods in this package.
+func (fn DelayFunc) Until(ctx context.Context, immediate, sliding bool, condition ConditionWithContextFunc) error {
+	return loopConditionUntilContext(ctx, &variableTimer{fn: fn, new: internalClock.NewTimer}, immediate, sliding, condition)
+}
+
+// Concurrent returns a version of this DelayFunc that is safe for use by multiple goroutines that
+// wish to share a single delay timer.
+func (fn DelayFunc) Concurrent() DelayFunc {
+	var lock sync.Mutex
+	return func() time.Duration {
+		lock.Lock()
+		defer lock.Unlock()
+		return fn()
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/doc.go
new file mode 100644
index 0000000000..ff89dc170e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package wait provides tools for polling or listening for changes
+// to a condition.
+package wait
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/error.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/error.go
new file mode 100644
index 0000000000..dd75801d82
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/error.go
@@ -0,0 +1,96 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"errors"
+)
+
+// ErrWaitTimeout is returned when the condition was not satisfied in time.
+//
+// Deprecated: This type will be made private in favor of Interrupted()
+// for checking errors or ErrorInterrupted(err) for returning a wrapped error.
+var ErrWaitTimeout = ErrorInterrupted(errors.New("timed out waiting for the condition"))
+
+// Interrupted returns true if the error indicates a Poll, ExponentialBackoff, or
+// Until loop exited for any reason besides the condition returning true or an
+// error. A loop is considered interrupted if the calling context is cancelled,
+// the context reaches its deadline, or a backoff reaches its maximum allowed
+// steps.
+//
+// Callers should use this method instead of comparing the error value directly to
+// ErrWaitTimeout, as methods that cancel a context may not return that error.
+//
+// Instead of:
+//
+//	err := wait.Poll(...)
+//	if err == wait.ErrWaitTimeout {
+//	    log.Infof("Wait for operation exceeded")
+//	} else ...
+//
+// Use:
+//
+//	err := wait.Poll(...)
+//	if wait.Interrupted(err) {
+//	    log.Infof("Wait for operation exceeded")
+//	} else ...
+func Interrupted(err error) bool {
+	switch {
+	case errors.Is(err, errWaitTimeout),
+		errors.Is(err, context.Canceled),
+		errors.Is(err, context.DeadlineExceeded):
+		return true
+	default:
+		return false
+	}
+}
+
+// errInterrupted
+type errInterrupted struct {
+	cause error
+}
+
+// ErrorInterrupted returns an error that indicates the wait was ended
+// early for a given reason. If no cause is provided a generic error
+// will be used but callers are encouraged to provide a real cause for
+// clarity in debugging.
+func ErrorInterrupted(cause error) error {
+	switch cause.(type) {
+	case errInterrupted:
+		// no need to wrap twice since errInterrupted is only needed
+		// once in a chain
+		return cause
+	default:
+		return errInterrupted{cause}
+	}
+}
+
+// errWaitTimeout is the private version of the previous ErrWaitTimeout
+// and is private to prevent direct comparison. Use ErrorInterrupted(err)
+// to get an error that will return true for Interrupted(err).
+var errWaitTimeout = errInterrupted{}
+
+func (e errInterrupted) Unwrap() error        { return e.cause }
+func (e errInterrupted) Is(target error) bool { return target == errWaitTimeout }
+func (e errInterrupted) Error() string {
+	if e.cause == nil {
+		// returns the same error message as historical behavior
+		return "timed out waiting for the condition"
+	}
+	return e.cause.Error()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/error_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/error_test.go
new file mode 100644
index 0000000000..0c96f06198
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/error_test.go
@@ -0,0 +1,144 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+)
+
+type errWrapper struct {
+	wrapped error
+}
+
+func (w errWrapper) Unwrap() error {
+	return w.wrapped
+}
+func (w errWrapper) Error() string {
+	return fmt.Sprintf("wrapped: %v", w.wrapped)
+}
+
+type errNotWrapper struct {
+	wrapped error
+}
+
+func (w errNotWrapper) Error() string {
+	return fmt.Sprintf("wrapped: %v", w.wrapped)
+}
+
+func TestInterrupted(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{
+			err:  ErrWaitTimeout,
+			want: true,
+		},
+		{
+			err:  context.Canceled,
+			want: true,
+		}, {
+			err:  context.DeadlineExceeded,
+			want: true,
+		},
+		{
+			err:  errWrapper{ErrWaitTimeout},
+			want: true,
+		},
+		{
+			err:  errWrapper{context.Canceled},
+			want: true,
+		},
+		{
+			err:  errWrapper{context.DeadlineExceeded},
+			want: true,
+		},
+		{
+			err:  ErrorInterrupted(nil),
+			want: true,
+		},
+		{
+			err:  ErrorInterrupted(errors.New("unknown")),
+			want: true,
+		},
+		{
+			err:  ErrorInterrupted(context.Canceled),
+			want: true,
+		},
+		{
+			err:  ErrorInterrupted(ErrWaitTimeout),
+			want: true,
+		},
+
+		{
+			err: nil,
+		},
+		{
+			err: errors.New("not a cancellation"),
+		},
+		{
+			err: errNotWrapper{ErrWaitTimeout},
+		},
+		{
+			err: errNotWrapper{context.Canceled},
+		},
+		{
+			err: errNotWrapper{context.DeadlineExceeded},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := Interrupted(tt.err); got != tt.want {
+				t.Errorf("Interrupted() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestErrorInterrupted(t *testing.T) {
+	internalErr := errInterrupted{}
+	if ErrorInterrupted(internalErr) != internalErr {
+		t.Fatalf("error should not be wrapped twice")
+	}
+
+	internalErr = errInterrupted{errInterrupted{}}
+	if ErrorInterrupted(internalErr) != internalErr {
+		t.Fatalf("object should be identical")
+	}
+
+	in := errors.New("test")
+	actual, expected := ErrorInterrupted(in), (errInterrupted{in})
+	if actual != expected {
+		t.Fatalf("did not wrap error")
+	}
+	if !errors.Is(actual, errWaitTimeout) {
+		t.Fatalf("does not obey errors.Is contract")
+	}
+	if actual.Error() != in.Error() {
+		t.Fatalf("unexpected error output")
+	}
+	if !Interrupted(actual) {
+		t.Fatalf("is not Interrupted")
+	}
+	if Interrupted(in) {
+		t.Fatalf("should not be Interrupted")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/loop.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/loop.go
new file mode 100644
index 0000000000..9f9b929ffa
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/loop.go
@@ -0,0 +1,95 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// loopConditionUntilContext executes the provided condition at intervals defined by
+// the provided timer until the provided context is cancelled, the condition returns
+// true, or the condition returns an error. If sliding is true, the period is computed
+// after condition runs. If it is false then period includes the runtime for condition.
+// If immediate is false the first delay happens before any call to condition, if
+// immediate is true the condition will be invoked before waiting and guarantees that
+// the condition is invoked at least once, regardless of whether the context has been
+// cancelled. The returned error is the error returned by the last condition or the
+// context error if the context was terminated.
+//
+// This is the common loop construct for all polling in the wait package.
+func loopConditionUntilContext(ctx context.Context, t Timer, immediate, sliding bool, condition ConditionWithContextFunc) error {
+	defer t.Stop()
+
+	var timeCh <-chan time.Time
+	doneCh := ctx.Done()
+
+	if !sliding {
+		timeCh = t.C()
+	}
+
+	// if immediate is true the condition is
+	// guaranteed to be executed at least once,
+	// if we haven't requested immediate execution, delay once
+	if immediate {
+		if ok, err := func() (bool, error) {
+			defer runtime.HandleCrashWithContext(ctx)
+			return condition(ctx)
+		}(); err != nil || ok {
+			return err
+		}
+	}
+
+	if sliding {
+		timeCh = t.C()
+	}
+
+	for {
+
+		// Wait for either the context to be cancelled or the next invocation be called
+		select {
+		case <-doneCh:
+			return ctx.Err()
+		case <-timeCh:
+		}
+
+		// IMPORTANT: Because there is no channel priority selection in golang
+		// it is possible for very short timers to "win" the race in the previous select
+		// repeatedly even when the context has been canceled.  We therefore must
+		// explicitly check for context cancellation on every loop and exit if true to
+		// guarantee that we don't invoke condition more than once after context has
+		// been cancelled.
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+
+		if !sliding {
+			t.Next()
+		}
+		if ok, err := func() (bool, error) {
+			defer runtime.HandleCrashWithContext(ctx)
+			return condition(ctx)
+		}(); err != nil || ok {
+			return err
+		}
+		if sliding {
+			t.Next()
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/loop_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/loop_test.go
new file mode 100644
index 0000000000..63bfa8540f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/loop_test.go
@@ -0,0 +1,535 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"k8s.io/utils/clock"
+	testingclock "k8s.io/utils/clock/testing"
+)
+
+func timerWithClock(t Timer, c clock.WithTicker) Timer {
+	switch t := t.(type) {
+	case *fixedTimer:
+		t.new = c.NewTicker
+	case *variableTimer:
+		t.new = c.NewTimer
+	default:
+		panic("unrecognized timer type, cannot inject clock")
+	}
+	return t
+}
+
+func Test_loopConditionWithContextImmediateDelay(t *testing.T) {
+	fakeClock := testingclock.NewFakeClock(time.Time{})
+	backoff := Backoff{Duration: time.Second}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	expectedError := errors.New("Expected error")
+	var attempt int
+	f := ConditionFunc(func() (bool, error) {
+		attempt++
+		return false, expectedError
+	})
+
+	doneCh := make(chan struct{})
+	go func() {
+		defer close(doneCh)
+		if err := loopConditionUntilContext(ctx, timerWithClock(backoff.Timer(), fakeClock), false, true, f.WithContext()); err == nil || err != expectedError {
+			t.Errorf("unexpected error: %v", err)
+		}
+	}()
+
+	for !fakeClock.HasWaiters() {
+		time.Sleep(time.Microsecond)
+	}
+
+	fakeClock.Step(time.Second - time.Millisecond)
+	if attempt != 0 {
+		t.Fatalf("should still be waiting for condition")
+	}
+	fakeClock.Step(2 * time.Millisecond)
+
+	select {
+	case <-doneCh:
+	case <-time.After(time.Second):
+		t.Fatalf("should have exited after a single loop")
+	}
+	if attempt != 1 {
+		t.Fatalf("expected attempt")
+	}
+}
+
+func Test_loopConditionUntilContext_semantic(t *testing.T) {
+	defaultCallback := func(_ int) (bool, error) {
+		return false, nil
+	}
+
+	conditionErr := errors.New("condition failed")
+
+	tests := []struct {
+		name               string
+		immediate          bool
+		sliding            bool
+		context            func() (context.Context, context.CancelFunc)
+		callback           func(calls int) (bool, error)
+		cancelContextAfter int
+		attemptsExpected   int
+		errExpected        error
+		timer              Timer
+	}{
+		{
+			name: "condition successful is only one attempt",
+			callback: func(attempts int) (bool, error) {
+				return true, nil
+			},
+			attemptsExpected: 1,
+		},
+		{
+			name: "delayed condition successful causes return and attempts",
+			callback: func(attempts int) (bool, error) {
+				return attempts > 1, nil
+			},
+			attemptsExpected: 2,
+		},
+		{
+			name: "delayed condition successful causes return and attempts many times",
+			callback: func(attempts int) (bool, error) {
+				return attempts >= 100, nil
+			},
+			attemptsExpected: 100,
+		},
+		{
+			name: "condition returns error even if ok is true",
+			callback: func(_ int) (bool, error) {
+				return true, conditionErr
+			},
+			attemptsExpected: 1,
+			errExpected:      conditionErr,
+		},
+		{
+			name: "condition exits after an error",
+			callback: func(_ int) (bool, error) {
+				return false, conditionErr
+			},
+			attemptsExpected: 1,
+			errExpected:      conditionErr,
+		},
+		{
+			name:             "context already canceled no attempts expected",
+			context:          cancelledContext,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      context.Canceled,
+		},
+		{
+			name:    "context already canceled condition success and immediate 1 attempt expected",
+			context: cancelledContext,
+			callback: func(_ int) (bool, error) {
+				return true, nil
+			},
+			immediate:        true,
+			attemptsExpected: 1,
+		},
+		{
+			name:    "context already canceled condition fail and immediate 1 attempt expected",
+			context: cancelledContext,
+			callback: func(_ int) (bool, error) {
+				return false, conditionErr
+			},
+			immediate:        true,
+			attemptsExpected: 1,
+			errExpected:      conditionErr,
+		},
+		{
+			name:             "context already canceled and immediate 1 attempt expected",
+			context:          cancelledContext,
+			callback:         defaultCallback,
+			immediate:        true,
+			attemptsExpected: 1,
+			errExpected:      context.Canceled,
+		},
+		{
+			name:               "context cancelled after 5 attempts",
+			context:            defaultContext,
+			callback:           defaultCallback,
+			cancelContextAfter: 5,
+			attemptsExpected:   5,
+			errExpected:        context.Canceled,
+		},
+		{
+			name:               "context cancelled and immediate after 5 attempts",
+			context:            defaultContext,
+			callback:           defaultCallback,
+			immediate:          true,
+			cancelContextAfter: 5,
+			attemptsExpected:   5,
+			errExpected:        context.Canceled,
+		},
+		{
+			name:             "context at deadline and immediate 1 attempt expected",
+			context:          deadlinedContext,
+			callback:         defaultCallback,
+			immediate:        true,
+			attemptsExpected: 1,
+			errExpected:      context.DeadlineExceeded,
+		},
+		{
+			name:             "context at deadline no attempts expected",
+			context:          deadlinedContext,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      context.DeadlineExceeded,
+		},
+		{
+			name:      "context canceled before the second execution and immediate",
+			immediate: true,
+			context: func() (context.Context, context.CancelFunc) {
+				return context.WithTimeout(context.Background(), time.Second)
+			},
+			callback: func(attempts int) (bool, error) {
+				return false, nil
+			},
+			attemptsExpected: 1,
+			errExpected:      context.DeadlineExceeded,
+			timer:            Backoff{Duration: 2 * time.Second}.Timer(),
+		},
+		{
+			name:      "immediate and long duration of condition and sliding false",
+			immediate: true,
+			sliding:   false,
+			context: func() (context.Context, context.CancelFunc) {
+				return context.WithTimeout(context.Background(), time.Second)
+			},
+			callback: func(attempts int) (bool, error) {
+				if attempts >= 4 {
+					return true, nil
+				}
+				time.Sleep(time.Second / 5)
+				return false, nil
+			},
+			attemptsExpected: 4,
+			timer:            Backoff{Duration: time.Second / 5, Jitter: 0.001}.Timer(),
+		},
+		{
+			name:      "immediate and long duration of condition and sliding true",
+			immediate: true,
+			sliding:   true,
+			context: func() (context.Context, context.CancelFunc) {
+				return context.WithTimeout(context.Background(), time.Second)
+			},
+			callback: func(attempts int) (bool, error) {
+				if attempts >= 4 {
+					return true, nil
+				}
+				time.Sleep(time.Second / 5)
+				return false, nil
+			},
+			errExpected:      context.DeadlineExceeded,
+			attemptsExpected: 3,
+			timer:            Backoff{Duration: time.Second / 5, Jitter: 0.001}.Timer(),
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			contextFn := test.context
+			if contextFn == nil {
+				contextFn = defaultContext
+			}
+			ctx, cancel := contextFn()
+			defer cancel()
+
+			timer := test.timer
+			if timer == nil {
+				timer = Backoff{Duration: time.Microsecond}.Timer()
+			}
+			attempts := 0
+			err := loopConditionUntilContext(ctx, timer, test.immediate, test.sliding, func(_ context.Context) (bool, error) {
+				attempts++
+				defer func() {
+					if test.cancelContextAfter > 0 && test.cancelContextAfter == attempts {
+						cancel()
+					}
+				}()
+				return test.callback(attempts)
+			})
+
+			if test.errExpected != err {
+				t.Errorf("expected error: %v but got: %v", test.errExpected, err)
+			}
+
+			if test.attemptsExpected != attempts {
+				t.Errorf("expected attempts count: %d but got: %d", test.attemptsExpected, attempts)
+			}
+		})
+	}
+}
+
+type timerWrapper struct {
+	timer   clock.Timer
+	resets  []time.Duration
+	onReset func(d time.Duration)
+}
+
+func (w *timerWrapper) C() <-chan time.Time { return w.timer.C() }
+func (w *timerWrapper) Stop() bool          { return w.timer.Stop() }
+func (w *timerWrapper) Reset(d time.Duration) bool {
+	w.resets = append(w.resets, d)
+	b := w.timer.Reset(d)
+	if w.onReset != nil {
+		w.onReset(d)
+	}
+	return b
+}
+
+func Test_loopConditionUntilContext_timings(t *testing.T) {
+	// Verify that timings returned by the delay func are passed to the timer, and that
+	// the timer advancing is enough to drive the state machine. Not a deep verification
+	// of the behavior of the loop, but tests that we drive the scenario to completion.
+	tests := []struct {
+		name               string
+		delayFn            DelayFunc
+		immediate          bool
+		sliding            bool
+		context            func() (context.Context, context.CancelFunc)
+		callback           func(calls int, lastInterval time.Duration) (bool, error)
+		cancelContextAfter int
+		attemptsExpected   int
+		errExpected        error
+		expectedIntervals  func(t *testing.T, delays []time.Duration, delaysRequested []time.Duration)
+	}{
+		{
+			name:    "condition success",
+			delayFn: Backoff{Duration: time.Second, Steps: 2, Factor: 2.0, Jitter: 0}.DelayFunc(),
+			callback: func(attempts int, _ time.Duration) (bool, error) {
+				return true, nil
+			},
+			attemptsExpected: 1,
+			expectedIntervals: func(t *testing.T, delays []time.Duration, delaysRequested []time.Duration) {
+				if reflect.DeepEqual(delays, []time.Duration{time.Second, 2 * time.Second}) {
+					return
+				}
+				if reflect.DeepEqual(delaysRequested, []time.Duration{time.Second}) {
+					return
+				}
+			},
+		},
+		{
+			name:      "condition success and immediate",
+			immediate: true,
+			delayFn:   Backoff{Duration: time.Second, Steps: 2, Factor: 2.0, Jitter: 0}.DelayFunc(),
+			callback: func(attempts int, _ time.Duration) (bool, error) {
+				return true, nil
+			},
+			attemptsExpected: 1,
+			expectedIntervals: func(t *testing.T, delays []time.Duration, delaysRequested []time.Duration) {
+				if reflect.DeepEqual(delays, []time.Duration{time.Second}) {
+					return
+				}
+				if reflect.DeepEqual(delaysRequested, []time.Duration{}) {
+					return
+				}
+			},
+		},
+		{
+			name:    "condition success and sliding",
+			sliding: true,
+			delayFn: Backoff{Duration: time.Second, Steps: 2, Factor: 2.0, Jitter: 0}.DelayFunc(),
+			callback: func(attempts int, _ time.Duration) (bool, error) {
+				return true, nil
+			},
+			attemptsExpected: 1,
+			expectedIntervals: func(t *testing.T, delays []time.Duration, delaysRequested []time.Duration) {
+				if reflect.DeepEqual(delays, []time.Duration{time.Second}) {
+					return
+				}
+				if !reflect.DeepEqual(delays, delaysRequested) {
+					t.Fatalf("sliding non-immediate should have equal delays: %v", cmp.Diff(delays, delaysRequested))
+				}
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%s/sliding=%t/immediate=%t", test.name, test.sliding, test.immediate), func(t *testing.T) {
+			contextFn := test.context
+			if contextFn == nil {
+				contextFn = defaultContext
+			}
+			ctx, cancel := contextFn()
+			defer cancel()
+
+			fakeClock := &testingclock.FakeClock{}
+			var fakeTimers []*timerWrapper
+			timerFn := func(d time.Duration) clock.Timer {
+				t := fakeClock.NewTimer(d)
+				fakeClock.Step(d + 1)
+				w := &timerWrapper{timer: t, resets: []time.Duration{d}, onReset: func(d time.Duration) {
+					fakeClock.Step(d + 1)
+				}}
+				fakeTimers = append(fakeTimers, w)
+				return w
+			}
+
+			delayFn := test.delayFn
+			if delayFn == nil {
+				delayFn = Backoff{Duration: time.Microsecond}.DelayFunc()
+			}
+			var delays []time.Duration
+			wrappedDelayFn := func() time.Duration {
+				d := delayFn()
+				delays = append(delays, d)
+				return d
+			}
+			timer := &variableTimer{fn: wrappedDelayFn, new: timerFn}
+
+			attempts := 0
+			err := loopConditionUntilContext(ctx, timer, test.immediate, test.sliding, func(_ context.Context) (bool, error) {
+				attempts++
+				defer func() {
+					if test.cancelContextAfter > 0 && test.cancelContextAfter == attempts {
+						cancel()
+					}
+				}()
+				lastInterval := time.Duration(-1)
+				if len(delays) > 0 {
+					lastInterval = delays[len(delays)-1]
+				}
+				return test.callback(attempts, lastInterval)
+			})
+
+			if test.errExpected != err {
+				t.Errorf("expected error: %v but got: %v", test.errExpected, err)
+			}
+
+			if test.attemptsExpected != attempts {
+				t.Errorf("expected attempts count: %d but got: %d", test.attemptsExpected, attempts)
+			}
+			switch len(fakeTimers) {
+			case 0:
+				test.expectedIntervals(t, delays, nil)
+			case 1:
+				test.expectedIntervals(t, delays, fakeTimers[0].resets)
+			default:
+				t.Fatalf("expected zero or one timers: %#v", fakeTimers)
+			}
+		})
+	}
+}
+
+// Test_loopConditionUntilContext_timings runs actual timing loops and calculates the delta. This
+// test depends on high precision wakeups which depends on low CPU contention so it is not a
+// candidate to run during normal unit test execution (nor is it a benchmark or example). Instead,
+// it can be run manually if there is a scenario where we suspect the timings are off and other
+// tests haven't caught it. A final sanity test that would have to be run serially in isolation.
+func Test_loopConditionUntilContext_Elapsed(t *testing.T) {
+	const maxAttempts = 10
+	// TODO: this may be too aggressive, but the overhead should be minor
+	const estimatedLoopOverhead = time.Millisecond
+	// estimate how long this delay can be
+	intervalMax := func(backoff Backoff) time.Duration {
+		d := backoff.Duration
+		if backoff.Jitter > 0 {
+			d += time.Duration(backoff.Jitter * float64(d))
+		}
+		return d
+	}
+	// estimate how short this delay can be
+	intervalMin := func(backoff Backoff) time.Duration {
+		d := backoff.Duration
+		return d
+	}
+
+	// Because timing is dependent other factors in test environments, such as
+	// whether the OS or go runtime scheduler wake the timers, excess duration
+	// is logged by default and can be converted to a fatal error for testing.
+	// fail := t.Fatalf
+	fail := t.Logf
+
+	for _, test := range []struct {
+		name    string
+		backoff Backoff
+		t       reflect.Type
+	}{
+		{name: "variable timer with jitter", backoff: Backoff{Duration: time.Millisecond, Jitter: 1.0}, t: reflect.TypeOf(&variableTimer{})},
+		{name: "fixed timer", backoff: Backoff{Duration: time.Millisecond}, t: reflect.TypeOf(&fixedTimer{})},
+		{name: "no-op timer", backoff: Backoff{}, t: reflect.TypeOf(noopTimer{})},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			var attempts int
+			start := time.Now()
+			timer := test.backoff.Timer()
+			if test.t != reflect.ValueOf(timer).Type() {
+				t.Fatalf("unexpected timer type %T: expected %v", timer, test.t)
+			}
+			if err := loopConditionUntilContext(context.Background(), timer, false, false, func(_ context.Context) (bool, error) {
+				attempts++
+				if attempts > maxAttempts {
+					t.Fatalf("should not reach %d attempts", maxAttempts+1)
+				}
+				return attempts >= maxAttempts, nil
+			}); err != nil {
+				t.Fatal(err)
+			}
+			duration := time.Since(start)
+			if min := maxAttempts * intervalMin(test.backoff); duration < min {
+				fail("elapsed duration %v < expected min duration %v", duration, min)
+			}
+			if max := maxAttempts * (intervalMax(test.backoff) + estimatedLoopOverhead); duration > max {
+				fail("elapsed duration %v > expected max duration %v", duration, max)
+			}
+		})
+	}
+}
+
+func Benchmark_loopConditionUntilContext_ZeroDuration(b *testing.B) {
+	ctx := context.Background()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		attempts := 0
+		if err := loopConditionUntilContext(ctx, Backoff{Duration: 0}.Timer(), true, false, func(_ context.Context) (bool, error) {
+			attempts++
+			return attempts >= 100, nil
+		}); err != nil {
+			b.Fatalf("unexpected err: %v", err)
+		}
+	}
+}
+
+func Benchmark_loopConditionUntilContext_ShortDuration(b *testing.B) {
+	ctx := context.Background()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		attempts := 0
+		if err := loopConditionUntilContext(ctx, Backoff{Duration: time.Microsecond}.Timer(), true, false, func(_ context.Context) (bool, error) {
+			attempts++
+			return attempts >= 100, nil
+		}); err != nil {
+			b.Fatalf("unexpected err: %v", err)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/poll.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/poll.go
new file mode 100644
index 0000000000..231d4c3842
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/poll.go
@@ -0,0 +1,315 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"time"
+)
+
+// PollUntilContextCancel tries a condition func until it returns true, an error, or the context
+// is cancelled or hits a deadline. condition will be invoked after the first interval if the
+// context is not cancelled first. The returned error will be from ctx.Err(), the condition's
+// err return value, or nil. If invoking condition takes longer than interval the next condition
+// will be invoked immediately. When using very short intervals, condition may be invoked multiple
+// times before a context cancellation is detected. If immediate is true, condition will be
+// invoked before waiting and guarantees that condition is invoked at least once, regardless of
+// whether the context has been cancelled.
+func PollUntilContextCancel(ctx context.Context, interval time.Duration, immediate bool, condition ConditionWithContextFunc) error {
+	return loopConditionUntilContext(ctx, Backoff{Duration: interval}.Timer(), immediate, false, condition)
+}
+
+// PollUntilContextTimeout will terminate polling after timeout duration by setting a context
+// timeout. This is provided as a convenience function for callers not currently executing under
+// a deadline and is equivalent to:
+//
+//	deadlineCtx, deadlineCancel := context.WithTimeout(ctx, timeout)
+//	err := PollUntilContextCancel(deadlineCtx, interval, immediate, condition)
+//
+// The deadline context will be cancelled if the Poll succeeds before the timeout, simplifying
+// inline usage. All other behavior is identical to PollUntilContextCancel.
+func PollUntilContextTimeout(ctx context.Context, interval, timeout time.Duration, immediate bool, condition ConditionWithContextFunc) error {
+	deadlineCtx, deadlineCancel := context.WithTimeout(ctx, timeout)
+	defer deadlineCancel()
+	return loopConditionUntilContext(deadlineCtx, Backoff{Duration: interval}.Timer(), immediate, false, condition)
+}
+
+// Poll tries a condition func until it returns true, an error, or the timeout
+// is reached.
+//
+// Poll always waits the interval before the run of 'condition'.
+// 'condition' will always be invoked at least once.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// If you want to Poll something forever, see PollInfinite.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextTimeout.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func Poll(interval, timeout time.Duration, condition ConditionFunc) error {
+	return PollWithContext(context.Background(), interval, timeout, condition.WithContext())
+}
+
+// PollWithContext tries a condition func until it returns true, an error,
+// or when the context expires or the timeout is reached, whichever
+// happens first.
+//
+// PollWithContext always waits the interval before the run of 'condition'.
+// 'condition' will always be invoked at least once.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// If you want to Poll something forever, see PollInfinite.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextTimeout.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollWithContext(ctx context.Context, interval, timeout time.Duration, condition ConditionWithContextFunc) error {
+	return poll(ctx, false, poller(interval, timeout), condition)
+}
+
+// PollUntil tries a condition func until it returns true, an error or stopCh is
+// closed.
+//
+// PollUntil always waits interval before the first run of 'condition'.
+// 'condition' will always be invoked at least once.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollUntil(interval time.Duration, condition ConditionFunc, stopCh <-chan struct{}) error {
+	return PollUntilWithContext(ContextForChannel(stopCh), interval, condition.WithContext())
+}
+
+// PollUntilWithContext tries a condition func until it returns true,
+// an error or the specified context is cancelled or expired.
+//
+// PollUntilWithContext always waits interval before the first run of 'condition'.
+// 'condition' will always be invoked at least once.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollUntilWithContext(ctx context.Context, interval time.Duration, condition ConditionWithContextFunc) error {
+	return poll(ctx, false, poller(interval, 0), condition)
+}
+
+// PollInfinite tries a condition func until it returns true or an error
+//
+// PollInfinite always waits the interval before the run of 'condition'.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollInfinite(interval time.Duration, condition ConditionFunc) error {
+	return PollInfiniteWithContext(context.Background(), interval, condition.WithContext())
+}
+
+// PollInfiniteWithContext tries a condition func until it returns true or an error
+//
+// PollInfiniteWithContext always waits the interval before the run of 'condition'.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollInfiniteWithContext(ctx context.Context, interval time.Duration, condition ConditionWithContextFunc) error {
+	return poll(ctx, false, poller(interval, 0), condition)
+}
+
+// PollImmediate tries a condition func until it returns true, an error, or the timeout
+// is reached.
+//
+// PollImmediate always checks 'condition' before waiting for the interval. 'condition'
+// will always be invoked at least once.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// If you want to immediately Poll something forever, see PollImmediateInfinite.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextTimeout.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollImmediate(interval, timeout time.Duration, condition ConditionFunc) error {
+	return PollImmediateWithContext(context.Background(), interval, timeout, condition.WithContext())
+}
+
+// PollImmediateWithContext tries a condition func until it returns true, an error,
+// or the timeout is reached or the specified context expires, whichever happens first.
+//
+// PollImmediateWithContext always checks 'condition' before waiting for the interval.
+// 'condition' will always be invoked at least once.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// If you want to immediately Poll something forever, see PollImmediateInfinite.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextTimeout.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollImmediateWithContext(ctx context.Context, interval, timeout time.Duration, condition ConditionWithContextFunc) error {
+	return poll(ctx, true, poller(interval, timeout), condition)
+}
+
+// PollImmediateUntil tries a condition func until it returns true, an error or stopCh is closed.
+//
+// PollImmediateUntil runs the 'condition' before waiting for the interval.
+// 'condition' will always be invoked at least once.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollImmediateUntil(interval time.Duration, condition ConditionFunc, stopCh <-chan struct{}) error {
+	return PollImmediateUntilWithContext(ContextForChannel(stopCh), interval, condition.WithContext())
+}
+
+// PollImmediateUntilWithContext tries a condition func until it returns true,
+// an error or the specified context is cancelled or expired.
+//
+// PollImmediateUntilWithContext runs the 'condition' before waiting for the interval.
+// 'condition' will always be invoked at least once.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollImmediateUntilWithContext(ctx context.Context, interval time.Duration, condition ConditionWithContextFunc) error {
+	return poll(ctx, true, poller(interval, 0), condition)
+}
+
+// PollImmediateInfinite tries a condition func until it returns true or an error
+//
+// PollImmediateInfinite runs the 'condition' before waiting for the interval.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollImmediateInfinite(interval time.Duration, condition ConditionFunc) error {
+	return PollImmediateInfiniteWithContext(context.Background(), interval, condition.WithContext())
+}
+
+// PollImmediateInfiniteWithContext tries a condition func until it returns true
+// or an error or the specified context gets cancelled or expired.
+//
+// PollImmediateInfiniteWithContext runs the 'condition' before waiting for the interval.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollImmediateInfiniteWithContext(ctx context.Context, interval time.Duration, condition ConditionWithContextFunc) error {
+	return poll(ctx, true, poller(interval, 0), condition)
+}
+
+// Internally used, each of the public 'Poll*' function defined in this
+// package should invoke this internal function with appropriate parameters.
+// ctx: the context specified by the caller, for infinite polling pass
+// a context that never gets cancelled or expired.
+// immediate: if true, the 'condition' will be invoked before waiting for the interval,
+// in this case 'condition' will always be invoked at least once.
+// wait: user specified WaitFunc function that controls at what interval the condition
+// function should be invoked periodically and whether it is bound by a timeout.
+// condition: user specified ConditionWithContextFunc function.
+//
+// Deprecated: will be removed in favor of loopConditionUntilContext.
+func poll(ctx context.Context, immediate bool, wait waitWithContextFunc, condition ConditionWithContextFunc) error {
+	if immediate {
+		done, err := runConditionWithCrashProtectionWithContext(ctx, condition)
+		if err != nil {
+			return err
+		}
+		if done {
+			return nil
+		}
+	}
+
+	select {
+	case <-ctx.Done():
+		// returning ctx.Err() will break backward compatibility, use new PollUntilContext*
+		// methods instead
+		return ErrWaitTimeout
+	default:
+		return waitForWithContext(ctx, wait, condition)
+	}
+}
+
+// poller returns a WaitFunc that will send to the channel every interval until
+// timeout has elapsed and then closes the channel.
+//
+// Over very short intervals you may receive no ticks before the channel is
+// closed. A timeout of 0 is interpreted as an infinity, and in such a case
+// it would be the caller's responsibility to close the done channel.
+// Failure to do so would result in a leaked goroutine.
+//
+// Output ticks are not buffered. If the channel is not ready to receive an
+// item, the tick is skipped.
+//
+// Deprecated: Will be removed in a future release.
+func poller(interval, timeout time.Duration) waitWithContextFunc {
+	return waitWithContextFunc(func(ctx context.Context) <-chan struct{} {
+		ch := make(chan struct{})
+
+		go func() {
+			defer close(ch)
+
+			tick := time.NewTicker(interval)
+			defer tick.Stop()
+
+			var after <-chan time.Time
+			if timeout != 0 {
+				// time.After is more convenient, but it
+				// potentially leaves timers around much longer
+				// than necessary if we exit early.
+				timer := time.NewTimer(timeout)
+				after = timer.C
+				defer timer.Stop()
+			}
+
+			for {
+				select {
+				case <-tick.C:
+					// If the consumer isn't ready for this signal drop it and
+					// check the other channels.
+					select {
+					case ch <- struct{}{}:
+					default:
+					}
+				case <-after:
+					return
+				case <-ctx.Done():
+					return
+				}
+			}
+		}()
+
+		return ch
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/timer.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/timer.go
new file mode 100644
index 0000000000..3efba32132
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/timer.go
@@ -0,0 +1,121 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"time"
+
+	"k8s.io/utils/clock"
+)
+
+// Timer abstracts how wait functions interact with time runtime efficiently. Test
+// code may implement this interface directly but package consumers are encouraged
+// to use the Backoff type as the primary mechanism for acquiring a Timer. The
+// interface is a simplification of clock.Timer to prevent misuse. Timers are not
+// expected to be safe for calls from multiple goroutines.
+type Timer interface {
+	// C returns a channel that will receive a struct{} each time the timer fires.
+	// The channel should not be waited on after Stop() is invoked. It is allowed
+	// to cache the returned value of C() for the lifetime of the Timer.
+	C() <-chan time.Time
+	// Next is invoked by wait functions to signal timers that the next interval
+	// should begin. You may only use Next() if you have drained the channel C().
+	// You should not call Next() after Stop() is invoked.
+	Next()
+	// Stop releases the timer. It is safe to invoke if no other methods have been
+	// called.
+	Stop()
+}
+
+type noopTimer struct {
+	closedCh <-chan time.Time
+}
+
+// newNoopTimer creates a timer with a unique channel to avoid contention
+// for the channel's lock across multiple unrelated timers.
+func newNoopTimer() noopTimer {
+	ch := make(chan time.Time)
+	close(ch)
+	return noopTimer{closedCh: ch}
+}
+
+func (t noopTimer) C() <-chan time.Time {
+	return t.closedCh
+}
+func (noopTimer) Next() {}
+func (noopTimer) Stop() {}
+
+type variableTimer struct {
+	fn  DelayFunc
+	t   clock.Timer
+	new func(time.Duration) clock.Timer
+}
+
+func (t *variableTimer) C() <-chan time.Time {
+	if t.t == nil {
+		d := t.fn()
+		t.t = t.new(d)
+	}
+	return t.t.C()
+}
+func (t *variableTimer) Next() {
+	if t.t == nil {
+		return
+	}
+	d := t.fn()
+	t.t.Reset(d)
+}
+func (t *variableTimer) Stop() {
+	if t.t == nil {
+		return
+	}
+	t.t.Stop()
+	t.t = nil
+}
+
+type fixedTimer struct {
+	interval time.Duration
+	t        clock.Ticker
+	new      func(time.Duration) clock.Ticker
+}
+
+func (t *fixedTimer) C() <-chan time.Time {
+	if t.t == nil {
+		t.t = t.new(t.interval)
+	}
+	return t.t.C()
+}
+func (t *fixedTimer) Next() {
+	// no-op for fixed timers
+}
+func (t *fixedTimer) Stop() {
+	if t.t == nil {
+		return
+	}
+	t.t.Stop()
+	t.t = nil
+}
+
+var (
+	// RealTimer can be passed to methods that need a clock.Timer.
+	RealTimer = clock.RealClock{}.NewTimer
+)
+
+var (
+	// internalClock is used for test injection of clocks
+	internalClock = clock.RealClock{}
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/wait.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/wait.go
new file mode 100644
index 0000000000..7379a8d5ac
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/wait.go
@@ -0,0 +1,228 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"math/rand"
+	"sync"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// For any test of the style:
+//
+//	...
+//	<- time.After(timeout):
+//	   t.Errorf("Timed out")
+//
+// The value for timeout should effectively be "forever." Obviously we don't want our tests to truly lock up forever, but 30s
+// is long enough that it is effectively forever for the things that can slow down a run on a heavily contended machine
+// (GC, seeks, etc), but not so long as to make a developer ctrl-c a test run if they do happen to break that test.
+var ForeverTestTimeout = time.Second * 30
+
+// NeverStop may be passed to Until to make it never stop.
+var NeverStop <-chan struct{} = make(chan struct{})
+
+// Group allows to start a group of goroutines and wait for their completion.
+type Group struct {
+	wg sync.WaitGroup
+}
+
+func (g *Group) Wait() {
+	g.wg.Wait()
+}
+
+// StartWithChannel starts f in a new goroutine in the group.
+// stopCh is passed to f as an argument. f should stop when stopCh is available.
+func (g *Group) StartWithChannel(stopCh <-chan struct{}, f func(stopCh <-chan struct{})) {
+	g.Start(func() {
+		f(stopCh)
+	})
+}
+
+// StartWithContext starts f in a new goroutine in the group.
+// ctx is passed to f as an argument. f should stop when ctx.Done() is available.
+func (g *Group) StartWithContext(ctx context.Context, f func(context.Context)) {
+	g.Start(func() {
+		f(ctx)
+	})
+}
+
+// Start starts f in a new goroutine in the group.
+func (g *Group) Start(f func()) {
+	g.wg.Add(1)
+	go func() {
+		defer g.wg.Done()
+		f()
+	}()
+}
+
+// Forever calls f every period for ever.
+//
+// Forever is syntactic sugar on top of Until.
+func Forever(f func(), period time.Duration) {
+	Until(f, period, NeverStop)
+}
+
+// jitterRand is a dedicated random source for jitter calculations.
+// It defaults to rand.Float64, but is a package variable so it can be overridden to make unit tests deterministic.
+var jitterRand = rand.Float64
+
+// Jitter returns a time.Duration between duration and duration + maxFactor *
+// duration.
+//
+// This allows clients to avoid converging on periodic behavior. If maxFactor
+// is 0.0, a suggested default value will be chosen.
+func Jitter(duration time.Duration, maxFactor float64) time.Duration {
+	if maxFactor <= 0.0 {
+		maxFactor = 1.0
+	}
+	wait := duration + time.Duration(jitterRand()*maxFactor*float64(duration))
+	return wait
+}
+
+// ConditionFunc returns true if the condition is satisfied, or an error
+// if the loop should be aborted.
+type ConditionFunc func() (done bool, err error)
+
+// ConditionWithContextFunc returns true if the condition is satisfied, or an error
+// if the loop should be aborted.
+//
+// The caller passes along a context that can be used by the condition function.
+type ConditionWithContextFunc func(context.Context) (done bool, err error)
+
+// WithContext converts a ConditionFunc into a ConditionWithContextFunc
+func (cf ConditionFunc) WithContext() ConditionWithContextFunc {
+	return func(context.Context) (done bool, err error) {
+		return cf()
+	}
+}
+
+// ContextForChannel provides a context that will be treated as cancelled
+// when the provided parentCh is closed. The implementation returns
+// context.Canceled for Err() if and only if the parentCh is closed.
+func ContextForChannel(parentCh <-chan struct{}) context.Context {
+	return channelContext{stopCh: parentCh}
+}
+
+var _ context.Context = channelContext{}
+
+// channelContext will behave as if the context were cancelled when stopCh is
+// closed.
+type channelContext struct {
+	stopCh <-chan struct{}
+}
+
+func (c channelContext) Done() <-chan struct{} { return c.stopCh }
+func (c channelContext) Err() error {
+	select {
+	case <-c.stopCh:
+		return context.Canceled
+	default:
+		return nil
+	}
+}
+func (c channelContext) Deadline() (time.Time, bool) { return time.Time{}, false }
+func (c channelContext) Value(key any) any           { return nil }
+
+// runConditionWithCrashProtection runs a ConditionFunc with crash protection.
+//
+// Deprecated: Will be removed when the legacy polling methods are removed.
+func runConditionWithCrashProtection(condition ConditionFunc) (bool, error) {
+	//nolint:logcheck // Already deprecated.
+	defer runtime.HandleCrash()
+	return condition()
+}
+
+// runConditionWithCrashProtectionWithContext runs a ConditionWithContextFunc
+// with crash protection.
+//
+// Deprecated: Will be removed when the legacy polling methods are removed.
+func runConditionWithCrashProtectionWithContext(ctx context.Context, condition ConditionWithContextFunc) (bool, error) {
+	defer runtime.HandleCrashWithContext(ctx)
+	return condition(ctx)
+}
+
+// waitFunc creates a channel that receives an item every time a test
+// should be executed and is closed when the last test should be invoked.
+//
+// Deprecated: Will be removed in a future release in favor of
+// loopConditionUntilContext.
+type waitFunc func(done <-chan struct{}) <-chan struct{}
+
+// WithContext converts the WaitFunc to an equivalent WaitWithContextFunc
+func (w waitFunc) WithContext() waitWithContextFunc {
+	return func(ctx context.Context) <-chan struct{} {
+		return w(ctx.Done())
+	}
+}
+
+// waitWithContextFunc creates a channel that receives an item every time a test
+// should be executed and is closed when the last test should be invoked.
+//
+// When the specified context gets cancelled or expires the function
+// stops sending item and returns immediately.
+//
+// Deprecated: Will be removed in a future release in favor of
+// loopConditionUntilContext.
+type waitWithContextFunc func(ctx context.Context) <-chan struct{}
+
+// waitForWithContext continually checks 'fn' as driven by 'wait'.
+//
+// waitForWithContext gets a channel from 'wait()”, and then invokes 'fn'
+// once for every value placed on the channel and once more when the
+// channel is closed. If the channel is closed and 'fn'
+// returns false without error, waitForWithContext returns ErrWaitTimeout.
+//
+// If 'fn' returns an error the loop ends and that error is returned. If
+// 'fn' returns true the loop ends and nil is returned.
+//
+// context.Canceled will be returned if the ctx.Done() channel is closed
+// without fn ever returning true.
+//
+// When the ctx.Done() channel is closed, because the golang `select` statement is
+// "uniform pseudo-random", the `fn` might still run one or multiple times,
+// though eventually `waitForWithContext` will return.
+//
+// Deprecated: Will be removed in a future release in favor of
+// loopConditionUntilContext.
+func waitForWithContext(ctx context.Context, wait waitWithContextFunc, fn ConditionWithContextFunc) error {
+	waitCtx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	c := wait(waitCtx)
+	for {
+		select {
+		case _, open := <-c:
+			ok, err := runConditionWithCrashProtectionWithContext(ctx, fn)
+			if err != nil {
+				return err
+			}
+			if ok {
+				return nil
+			}
+			if !open {
+				return ErrWaitTimeout
+			}
+		case <-ctx.Done():
+			// returning ctx.Err() will break backward compatibility, use new PollUntilContext*
+			// methods instead
+			return ErrWaitTimeout
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/wait_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/wait_test.go
new file mode 100644
index 0000000000..39c5d29910
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/wait/wait_test.go
@@ -0,0 +1,1575 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math/rand"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/utils/clock"
+	testingclock "k8s.io/utils/clock/testing"
+)
+
+func TestUntil(t *testing.T) {
+	ch := make(chan struct{})
+	close(ch)
+	Until(func() {
+		t.Fatal("should not have been invoked")
+	}, 0, ch)
+
+	ch = make(chan struct{})
+	called := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		Until(func() {
+			called <- struct{}{}
+		}, 0, ch)
+		close(called)
+	}()
+	<-called
+	close(ch)
+	<-called
+	wg.Wait()
+}
+
+func TestUntilWithContext(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.TODO())
+	cancel()
+	UntilWithContext(ctx, func(context.Context) {
+		t.Fatal("should not have been invoked")
+	}, 0)
+
+	ctx, cancel = context.WithCancel(context.TODO())
+	called := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		UntilWithContext(ctx, func(context.Context) {
+			called <- struct{}{}
+		}, 0)
+		close(called)
+	}()
+	<-called
+	cancel()
+	<-called
+	wg.Wait()
+}
+
+func TestNonSlidingUntil(t *testing.T) {
+	ch := make(chan struct{})
+	close(ch)
+	NonSlidingUntil(func() {
+		t.Fatal("should not have been invoked")
+	}, 0, ch)
+
+	ch = make(chan struct{})
+	called := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		NonSlidingUntil(func() {
+			called <- struct{}{}
+		}, 0, ch)
+		close(called)
+	}()
+	<-called
+	close(ch)
+	<-called
+	wg.Wait()
+}
+
+func TestNonSlidingUntilWithContext(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.TODO())
+	cancel()
+	NonSlidingUntilWithContext(ctx, func(context.Context) {
+		t.Fatal("should not have been invoked")
+	}, 0)
+
+	ctx, cancel = context.WithCancel(context.TODO())
+	called := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		NonSlidingUntilWithContext(ctx, func(context.Context) {
+			called <- struct{}{}
+		}, 0)
+		close(called)
+	}()
+	<-called
+	cancel()
+	<-called
+	wg.Wait()
+}
+
+func TestUntilReturnsImmediately(t *testing.T) {
+	now := time.Now()
+	ch := make(chan struct{})
+	var attempts int
+	Until(func() {
+		attempts++
+		if attempts > 1 {
+			t.Fatalf("invoked after close of channel")
+		}
+		close(ch)
+	}, 30*time.Second, ch)
+	if now.Add(25 * time.Second).Before(time.Now()) {
+		t.Errorf("Until did not return immediately when the stop chan was closed inside the func")
+	}
+}
+
+func TestJitterUntil(t *testing.T) {
+	ch := make(chan struct{})
+	// if a channel is closed JitterUntil never calls function f
+	// and returns immediately
+	close(ch)
+	JitterUntil(func() {
+		t.Fatal("should not have been invoked")
+	}, 0, 1.0, true, ch)
+
+	ch = make(chan struct{})
+	called := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		JitterUntil(func() {
+			called <- struct{}{}
+		}, 0, 1.0, true, ch)
+		close(called)
+	}()
+	<-called
+	close(ch)
+	<-called
+	wg.Wait()
+}
+
+func TestJitterUntilWithContext(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.TODO())
+	cancel()
+	JitterUntilWithContext(ctx, func(context.Context) {
+		t.Fatal("should not have been invoked")
+	}, 0, 1.0, true)
+
+	ctx, cancel = context.WithCancel(context.TODO())
+	called := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		JitterUntilWithContext(ctx, func(context.Context) {
+			called <- struct{}{}
+		}, 0, 1.0, true)
+		close(called)
+	}()
+	<-called
+	cancel()
+	<-called
+	wg.Wait()
+}
+
+func TestJitterUntilReturnsImmediately(t *testing.T) {
+	now := time.Now()
+	ch := make(chan struct{})
+	JitterUntil(func() {
+		close(ch)
+	}, 30*time.Second, 1.0, true, ch)
+	if now.Add(25 * time.Second).Before(time.Now()) {
+		t.Errorf("JitterUntil did not return immediately when the stop chan was closed inside the func")
+	}
+}
+
+func TestJitterUntilRecoversPanic(t *testing.T) {
+	// Save and restore crash handlers
+	originalReallyCrash := runtime.ReallyCrash
+	originalHandlers := runtime.PanicHandlers
+	defer func() {
+		runtime.ReallyCrash = originalReallyCrash
+		runtime.PanicHandlers = originalHandlers
+	}()
+
+	called := 0
+	handled := 0
+
+	// Hook up a custom crash handler to ensure it is called when a jitter function panics
+	runtime.ReallyCrash = false
+	runtime.PanicHandlers = []func(context.Context, interface{}){
+		func(_ context.Context, p interface{}) {
+			handled++
+		},
+	}
+
+	ch := make(chan struct{})
+	JitterUntil(func() {
+		called++
+		if called > 2 {
+			close(ch)
+			return
+		}
+		panic("TestJitterUntilRecoversPanic")
+	}, time.Millisecond, 1.0, true, ch)
+
+	if called != 3 {
+		t.Errorf("Expected panic recovers")
+	}
+}
+
+func TestJitterUntilNegativeFactor(t *testing.T) {
+	now := time.Now()
+	ch := make(chan struct{})
+	called := make(chan struct{})
+	received := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		JitterUntil(func() {
+			called <- struct{}{}
+			<-received
+		}, time.Second, -30.0, true, ch)
+	}()
+	// first loop
+	<-called
+	received <- struct{}{}
+	// second loop
+	<-called
+	close(ch)
+	received <- struct{}{}
+
+	// it should take at most 2 seconds + some overhead, not 3
+	if now.Add(3 * time.Second).Before(time.Now()) {
+		t.Errorf("JitterUntil did not returned after predefined period with negative jitter factor when the stop chan was closed inside the func")
+	}
+	wg.Wait()
+}
+
+func TestExponentialBackoff(t *testing.T) {
+	// exits immediately
+	i := 0
+	err := ExponentialBackoff(Backoff{Factor: 1.0}, func() (bool, error) {
+		i++
+		return false, nil
+	})
+	if err != ErrWaitTimeout || i != 0 {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	opts := Backoff{Factor: 1.0, Steps: 3}
+
+	// waits up to steps
+	i = 0
+	err = ExponentialBackoff(opts, func() (bool, error) {
+		i++
+		return false, nil
+	})
+	if err != ErrWaitTimeout || i != opts.Steps {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	// returns immediately
+	i = 0
+	err = ExponentialBackoff(opts, func() (bool, error) {
+		i++
+		return true, nil
+	})
+	if err != nil || i != 1 {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	// returns immediately on error
+	testErr := fmt.Errorf("some other error")
+	err = ExponentialBackoff(opts, func() (bool, error) {
+		return false, testErr
+	})
+	if err != testErr {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	// invoked multiple times
+	i = 1
+	err = ExponentialBackoff(opts, func() (bool, error) {
+		if i < opts.Steps {
+			i++
+			return false, nil
+		}
+		return true, nil
+	})
+	if err != nil || i != opts.Steps {
+		t.Errorf("unexpected error: %v", err)
+	}
+}
+
+func TestPoller(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	w := poller(time.Millisecond, 2*time.Millisecond)
+	ch := w(ctx)
+	count := 0
+DRAIN:
+	for {
+		select {
+		case _, open := <-ch:
+			if !open {
+				break DRAIN
+			}
+			count++
+		case <-time.After(ForeverTestTimeout):
+			t.Errorf("unexpected timeout after poll")
+		}
+	}
+	if count > 3 {
+		t.Errorf("expected up to three values, got %d", count)
+	}
+}
+
+type fakePoller struct {
+	max  int
+	used int32 // accessed with atomics
+	wg   sync.WaitGroup
+}
+
+func fakeTicker(max int, used *int32, doneFunc func()) waitFunc {
+	return func(done <-chan struct{}) <-chan struct{} {
+		ch := make(chan struct{})
+		go func() {
+			defer doneFunc()
+			defer close(ch)
+			for i := 0; i < max; i++ {
+				select {
+				case ch <- struct{}{}:
+				case <-done:
+					return
+				}
+				if used != nil {
+					atomic.AddInt32(used, 1)
+				}
+			}
+		}()
+		return ch
+	}
+}
+
+func (fp *fakePoller) GetwaitFunc() waitFunc {
+	fp.wg.Add(1)
+	return fakeTicker(fp.max, &fp.used, fp.wg.Done)
+}
+
+func TestPoll(t *testing.T) {
+	invocations := 0
+	f := ConditionWithContextFunc(func(ctx context.Context) (bool, error) {
+		invocations++
+		return true, nil
+	})
+	fp := fakePoller{max: 1}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	if err := poll(ctx, false, fp.GetwaitFunc().WithContext(), f); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	fp.wg.Wait()
+	if invocations != 1 {
+		t.Errorf("Expected exactly one invocation, got %d", invocations)
+	}
+	used := atomic.LoadInt32(&fp.used)
+	if used != 1 {
+		t.Errorf("Expected exactly one tick, got %d", used)
+	}
+}
+
+func TestPollError(t *testing.T) {
+	expectedError := errors.New("Expected error")
+	f := ConditionFunc(func() (bool, error) {
+		return false, expectedError
+	})
+	fp := fakePoller{max: 1}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	if err := poll(ctx, false, fp.GetwaitFunc().WithContext(), f.WithContext()); err == nil || err != expectedError {
+		t.Fatalf("Expected error %v, got none %v", expectedError, err)
+	}
+	fp.wg.Wait()
+	used := atomic.LoadInt32(&fp.used)
+	if used != 1 {
+		t.Errorf("Expected exactly one tick, got %d", used)
+	}
+}
+
+func TestPollImmediate(t *testing.T) {
+	invocations := 0
+	f := ConditionFunc(func() (bool, error) {
+		invocations++
+		return true, nil
+	})
+	fp := fakePoller{max: 0}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	if err := poll(ctx, true, fp.GetwaitFunc().WithContext(), f.WithContext()); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	// We don't need to wait for fp.wg, as pollImmediate shouldn't call waitFunc at all.
+	if invocations != 1 {
+		t.Errorf("Expected exactly one invocation, got %d", invocations)
+	}
+	used := atomic.LoadInt32(&fp.used)
+	if used != 0 {
+		t.Errorf("Expected exactly zero ticks, got %d", used)
+	}
+}
+
+func TestPollImmediateError(t *testing.T) {
+	expectedError := errors.New("Expected error")
+	f := ConditionFunc(func() (bool, error) {
+		return false, expectedError
+	})
+	fp := fakePoller{max: 0}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	if err := poll(ctx, true, fp.GetwaitFunc().WithContext(), f.WithContext()); err == nil || err != expectedError {
+		t.Fatalf("Expected error %v, got none %v", expectedError, err)
+	}
+	// We don't need to wait for fp.wg, as pollImmediate shouldn't call waitFunc at all.
+	used := atomic.LoadInt32(&fp.used)
+	if used != 0 {
+		t.Errorf("Expected exactly zero ticks, got %d", used)
+	}
+}
+
+func TestPollForever(t *testing.T) {
+	ch := make(chan struct{})
+	errc := make(chan error, 1)
+	done := make(chan struct{}, 1)
+	complete := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		f := ConditionFunc(func() (bool, error) {
+			ch <- struct{}{}
+			select {
+			case <-done:
+				return true, nil
+			default:
+			}
+			return false, nil
+		})
+
+		if err := PollInfinite(time.Microsecond, f); err != nil {
+			errc <- fmt.Errorf("unexpected error %v", err)
+		}
+
+		close(ch)
+		complete <- struct{}{}
+	}()
+
+	// ensure the condition is opened
+	<-ch
+
+	// ensure channel sends events
+	for i := 0; i < 10; i++ {
+		select {
+		case _, open := <-ch:
+			if !open {
+				if len(errc) != 0 {
+					t.Fatalf("did not expect channel to be closed, %v", <-errc)
+				}
+				t.Fatal("did not expect channel to be closed")
+			}
+		case <-time.After(ForeverTestTimeout):
+			t.Fatalf("channel did not return at least once within the poll interval")
+		}
+	}
+
+	// at most one poll notification should be sent once we return from the condition
+	done <- struct{}{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		for i := 0; i < 2; i++ {
+			_, open := <-ch
+			if !open {
+				return
+			}
+		}
+		t.Error("expected closed channel after two iterations")
+	}()
+	<-complete
+
+	if len(errc) != 0 {
+		t.Fatal(<-errc)
+	}
+	wg.Wait()
+}
+
+func Test_waitFor(t *testing.T) {
+	var invocations int
+	testCases := map[string]struct {
+		F       ConditionFunc
+		Ticks   int
+		Invoked int
+		Err     bool
+	}{
+		"invoked once": {
+			ConditionFunc(func() (bool, error) {
+				invocations++
+				return true, nil
+			}),
+			2,
+			1,
+			false,
+		},
+		"invoked and returns a timeout": {
+			ConditionFunc(func() (bool, error) {
+				invocations++
+				return false, nil
+			}),
+			2,
+			3, // the contract of waitFor() says the func is called once more at the end of the wait
+			true,
+		},
+		"returns immediately on error": {
+			ConditionFunc(func() (bool, error) {
+				invocations++
+				return false, errors.New("test")
+			}),
+			2,
+			1,
+			true,
+		},
+	}
+	for k, c := range testCases {
+		invocations = 0
+		ticker := fakeTicker(c.Ticks, nil, func() {})
+		err := func() error {
+			done := make(chan struct{})
+			defer close(done)
+			ctx := ContextForChannel(done)
+			return waitForWithContext(ctx, ticker.WithContext(), c.F.WithContext())
+		}()
+		switch {
+		case c.Err && err == nil:
+			t.Errorf("%s: Expected error, got nil", k)
+			continue
+		case !c.Err && err != nil:
+			t.Errorf("%s: Expected no error, got: %#v", k, err)
+			continue
+		}
+		if invocations != c.Invoked {
+			t.Errorf("%s: Expected %d invocations, got %d", k, c.Invoked, invocations)
+		}
+	}
+}
+
+// Test_waitForWithEarlyClosing_waitFunc tests WaitFor when the waitFunc closes its channel. The WaitFor should
+// always return ErrWaitTimeout.
+func Test_waitForWithEarlyClosing_waitFunc(t *testing.T) {
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+
+	ctx := ContextForChannel(stopCh)
+	start := time.Now()
+	err := waitForWithContext(ctx, func(ctx context.Context) <-chan struct{} {
+		c := make(chan struct{})
+		close(c)
+		return c
+	}, func(_ context.Context) (bool, error) {
+		return false, nil
+	})
+	duration := time.Since(start)
+
+	// The waitFor should return immediately, so the duration is close to 0s.
+	if duration >= ForeverTestTimeout/2 {
+		t.Errorf("expected short timeout duration")
+	}
+	if err != ErrWaitTimeout {
+		t.Errorf("expected ErrWaitTimeout from WaitFunc")
+	}
+}
+
+// Test_waitForWithClosedChannel tests waitFor when it receives a closed channel. The waitFor should
+// always return ErrWaitTimeout.
+func Test_waitForWithClosedChannel(t *testing.T) {
+	stopCh := make(chan struct{})
+	close(stopCh)
+	c := make(chan struct{})
+	defer close(c)
+	ctx := ContextForChannel(stopCh)
+
+	start := time.Now()
+	err := waitForWithContext(ctx, func(_ context.Context) <-chan struct{} {
+		return c
+	}, func(_ context.Context) (bool, error) {
+		return false, nil
+	})
+	duration := time.Since(start)
+	// The waitFor should return immediately, so the duration is close to 0s.
+	if duration >= ForeverTestTimeout/2 {
+		t.Errorf("expected short timeout duration")
+	}
+	// The interval of the poller is ForeverTestTimeout, so the waitFor should always return ErrWaitTimeout.
+	if err != ErrWaitTimeout {
+		t.Errorf("expected ErrWaitTimeout from WaitFunc")
+	}
+}
+
+// Test_waitForWithContextCancelsContext verifies that after the condition func returns true,
+// waitForWithContext cancels the context it supplies to the WaitWithContextFunc.
+func Test_waitForWithContextCancelsContext(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	waitFn := poller(time.Millisecond, ForeverTestTimeout)
+
+	var ctxPassedToWait context.Context
+	waitForWithContext(ctx, func(ctx context.Context) <-chan struct{} {
+		ctxPassedToWait = ctx
+		return waitFn(ctx)
+	}, func(ctx context.Context) (bool, error) {
+		time.Sleep(10 * time.Millisecond)
+		return true, nil
+	})
+	// The polling goroutine should be closed after waitForWithContext returning.
+	if ctxPassedToWait.Err() != context.Canceled {
+		t.Errorf("expected the context passed to waitForWithContext to be closed with: %v, but got: %v", context.Canceled, ctxPassedToWait.Err())
+	}
+}
+
+func TestPollUntil(t *testing.T) {
+	stopCh := make(chan struct{})
+	called := make(chan bool)
+	pollDone := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		PollUntil(time.Microsecond, ConditionFunc(func() (bool, error) {
+			called <- true
+			return false, nil
+		}), stopCh)
+
+		close(pollDone)
+	}()
+
+	// make sure we're called once
+	<-called
+	// this should trigger a "done"
+	close(stopCh)
+
+	go func() {
+		// release the condition func if needed
+		for range called {
+		}
+	}()
+
+	// make sure we finished the poll
+	<-pollDone
+	close(called)
+	wg.Wait()
+}
+
+func TestBackoff_Step(t *testing.T) {
+	tests := []struct {
+		initial *Backoff
+		want    []time.Duration
+	}{
+		{initial: nil, want: []time.Duration{0, 0, 0, 0}},
+		{initial: &Backoff{Duration: time.Second, Steps: -1}, want: []time.Duration{time.Second, time.Second, time.Second}},
+		{initial: &Backoff{Duration: time.Second, Steps: 0}, want: []time.Duration{time.Second, time.Second, time.Second}},
+		{initial: &Backoff{Duration: time.Second, Steps: 1}, want: []time.Duration{time.Second, time.Second, time.Second}},
+		{initial: &Backoff{Duration: time.Second, Factor: 1.0, Steps: 1}, want: []time.Duration{time.Second, time.Second, time.Second}},
+		{initial: &Backoff{Duration: time.Second, Factor: 2, Steps: 3}, want: []time.Duration{1 * time.Second, 2 * time.Second, 4 * time.Second}},
+		{initial: &Backoff{Duration: time.Second, Factor: 2, Steps: 3, Cap: 3 * time.Second}, want: []time.Duration{1 * time.Second, 2 * time.Second, 3 * time.Second}},
+		{initial: &Backoff{Duration: time.Second, Factor: 2, Steps: 2, Cap: 3 * time.Second, Jitter: 0.5}, want: []time.Duration{2 * time.Second, 3 * time.Second, 3 * time.Second}},
+		{initial: &Backoff{Duration: time.Second, Factor: 2, Steps: 6, Jitter: 4}, want: []time.Duration{1 * time.Second, 2 * time.Second, 4 * time.Second, 8 * time.Second, 16 * time.Second, 32 * time.Second}},
+	}
+	for seed := int64(0); seed < 5; seed++ {
+		for _, tt := range tests {
+			var initial *Backoff
+			if tt.initial != nil {
+				copied := *tt.initial
+				initial = &copied
+			} else {
+				initial = nil
+			}
+			t.Run(fmt.Sprintf("%#v seed=%d", initial, seed), func(t *testing.T) {
+				jitterRand = rand.New(rand.NewSource(seed)).Float64
+				for i := 0; i < len(tt.want); i++ {
+					got := initial.Step()
+					t.Logf("[%d]=%s", i, got)
+					if initial != nil && initial.Jitter > 0 {
+						if got == tt.want[i] {
+							// this is statistically unlikely to happen by chance
+							t.Errorf("Backoff.Step(%d) = %v, no jitter", i, got)
+							continue
+						}
+						diff := float64(tt.want[i]-got) / float64(tt.want[i])
+						if diff > initial.Jitter {
+							t.Errorf("Backoff.Step(%d) = %v, want %v, outside range", i, got, tt.want)
+							continue
+						}
+					} else {
+						if got != tt.want[i] {
+							t.Errorf("Backoff.Step(%d) = %v, want %v", i, got, tt.want)
+							continue
+						}
+					}
+				}
+			})
+		}
+	}
+}
+
+func TestContextForChannel(t *testing.T) {
+	var wg sync.WaitGroup
+	parentCh := make(chan struct{})
+	done := make(chan struct{})
+
+	for i := 0; i < 3; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			ctx := ContextForChannel(parentCh)
+			<-ctx.Done()
+		}()
+	}
+
+	go func() {
+		wg.Wait()
+		close(done)
+	}()
+
+	// Closing parent channel should cancel all children contexts
+	close(parentCh)
+
+	select {
+	case <-done:
+	case <-time.After(ForeverTestTimeout):
+		t.Errorf("unexpected timeout waiting for parent to cancel child contexts")
+	}
+}
+
+func TestExponentialBackoffManagerGetNextBackoff(t *testing.T) {
+	fc := testingclock.NewFakeClock(time.Now())
+	backoff := NewExponentialBackoffManager(1, 10, 10, 2.0, 0.0, fc)
+	durations := []time.Duration{1, 2, 4, 8, 10, 10, 10}
+	for i := 0; i < len(durations); i++ {
+		generatedBackoff := backoff.(*exponentialBackoffManagerImpl).getNextBackoff()
+		if generatedBackoff != durations[i] {
+			t.Errorf("unexpected %d-th backoff: %d, expecting %d", i, generatedBackoff, durations[i])
+		}
+	}
+
+	fc.Step(11)
+	resetDuration := backoff.(*exponentialBackoffManagerImpl).getNextBackoff()
+	if resetDuration != 1 {
+		t.Errorf("after reset, backoff should be 1, but got %d", resetDuration)
+	}
+}
+
+func TestJitteredBackoffManagerGetNextBackoff(t *testing.T) {
+	// positive jitter
+	backoffMgr := NewJitteredBackoffManager(1, 1, testingclock.NewFakeClock(time.Now()))
+	for i := 0; i < 5; i++ {
+		backoff := backoffMgr.(*jitteredBackoffManagerImpl).getNextBackoff()
+		if backoff < 1 || backoff > 2 {
+			t.Errorf("backoff out of range: %d", backoff)
+		}
+	}
+
+	// negative jitter, shall be a fixed backoff
+	backoffMgr = NewJitteredBackoffManager(1, -1, testingclock.NewFakeClock(time.Now()))
+	backoff := backoffMgr.(*jitteredBackoffManagerImpl).getNextBackoff()
+	if backoff != 1 {
+		t.Errorf("backoff should be 1, but got %d", backoff)
+	}
+}
+
+func TestJitterBackoffManagerWithRealClock(t *testing.T) {
+	backoffMgr := NewJitteredBackoffManager(1*time.Millisecond, 0, &clock.RealClock{})
+	for i := 0; i < 5; i++ {
+		start := time.Now()
+		<-backoffMgr.Backoff().C()
+		passed := time.Since(start)
+		if passed < 1*time.Millisecond {
+			t.Errorf("backoff should be at least 1ms, but got %s", passed.String())
+		}
+	}
+}
+
+func TestExponentialBackoffManagerWithRealClock(t *testing.T) {
+	// backoff at least 1ms, 2ms, 4ms, 8ms, 10ms, 10ms, 10ms
+	durationFactors := []time.Duration{1, 2, 4, 8, 10, 10, 10}
+	backoffMgr := NewExponentialBackoffManager(1*time.Millisecond, 10*time.Millisecond, 1*time.Hour, 2.0, 0.0, &clock.RealClock{})
+
+	for i := range durationFactors {
+		start := time.Now()
+		<-backoffMgr.Backoff().C()
+		passed := time.Since(start)
+		if passed < durationFactors[i]*time.Millisecond {
+			t.Errorf("backoff should be at least %d ms, but got %s", durationFactors[i], passed.String())
+		}
+	}
+}
+
+func TestBackoffDelayWithResetExponential(t *testing.T) {
+	fc := testingclock.NewFakeClock(time.Now())
+	backoff := Backoff{Duration: 1, Cap: 10, Factor: 2.0, Jitter: 0.0, Steps: 10}.DelayWithReset(fc, 10)
+	durations := []time.Duration{1, 2, 4, 8, 10, 10, 10}
+	for i := 0; i < len(durations); i++ {
+		generatedBackoff := backoff()
+		if generatedBackoff != durations[i] {
+			t.Errorf("unexpected %d-th backoff: %d, expecting %d", i, generatedBackoff, durations[i])
+		}
+	}
+
+	fc.Step(11)
+	resetDuration := backoff()
+	if resetDuration != 1 {
+		t.Errorf("after reset, backoff should be 1, but got %d", resetDuration)
+	}
+}
+
+func TestBackoffDelayWithResetEmpty(t *testing.T) {
+	fc := testingclock.NewFakeClock(time.Now())
+	backoff := Backoff{Duration: 1, Cap: 10, Factor: 2.0, Jitter: 0.0, Steps: 10}.DelayWithReset(fc, 0)
+	// we reset to initial duration because the resetInterval is 0, immediate
+	durations := []time.Duration{1, 1, 1, 1, 1, 1, 1}
+	for i := 0; i < len(durations); i++ {
+		generatedBackoff := backoff()
+		if generatedBackoff != durations[i] {
+			t.Errorf("unexpected %d-th backoff: %d, expecting %d", i, generatedBackoff, durations[i])
+		}
+	}
+
+	fc.Step(11)
+	resetDuration := backoff()
+	if resetDuration != 1 {
+		t.Errorf("after reset, backoff should be 1, but got %d", resetDuration)
+	}
+}
+
+func TestBackoffDelayWithResetJitter(t *testing.T) {
+	// positive jitter
+	backoff := Backoff{Duration: 1, Jitter: 1}.DelayWithReset(testingclock.NewFakeClock(time.Now()), 0)
+	for i := 0; i < 5; i++ {
+		value := backoff()
+		if value < 1 || value > 2 {
+			t.Errorf("backoff out of range: %d", value)
+		}
+	}
+
+	// negative jitter, shall be a fixed backoff
+	backoff = Backoff{Duration: 1, Jitter: -1}.DelayWithReset(testingclock.NewFakeClock(time.Now()), 0)
+	value := backoff()
+	if value != 1 {
+		t.Errorf("backoff should be 1, but got %d", value)
+	}
+}
+
+func TestBackoffDelayWithResetWithRealClockJitter(t *testing.T) {
+	backoff := Backoff{Duration: 1 * time.Millisecond, Jitter: 0}.DelayWithReset(&clock.RealClock{}, 0)
+	for i := 0; i < 5; i++ {
+		start := time.Now()
+		<-RealTimer(backoff()).C()
+		passed := time.Since(start)
+		if passed < 1*time.Millisecond {
+			t.Errorf("backoff should be at least 1ms, but got %s", passed.String())
+		}
+	}
+}
+
+func TestBackoffDelayWithResetWithRealClockExponential(t *testing.T) {
+	// backoff at least 1ms, 2ms, 4ms, 8ms, 10ms, 10ms, 10ms
+	durationFactors := []time.Duration{1, 2, 4, 8, 10, 10, 10}
+	backoff := Backoff{Duration: 1 * time.Millisecond, Cap: 10 * time.Millisecond, Factor: 2.0, Jitter: 0.0, Steps: 10}.DelayWithReset(&clock.RealClock{}, 1*time.Hour)
+
+	for i := range durationFactors {
+		start := time.Now()
+		<-RealTimer(backoff()).C()
+		passed := time.Since(start)
+		if passed < durationFactors[i]*time.Millisecond {
+			t.Errorf("backoff should be at least %d ms, but got %s", durationFactors[i], passed.String())
+		}
+	}
+}
+
+func defaultContext() (context.Context, context.CancelFunc) {
+	return context.WithCancel(context.Background())
+}
+func cancelledContext() (context.Context, context.CancelFunc) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	return ctx, cancel
+}
+func deadlinedContext() (context.Context, context.CancelFunc) {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Millisecond)
+	for ctx.Err() != context.DeadlineExceeded {
+		time.Sleep(501 * time.Microsecond)
+	}
+	return ctx, cancel
+}
+
+func TestExponentialBackoffWithContext(t *testing.T) {
+	defaultCallback := func(_ int) (bool, error) {
+		return false, nil
+	}
+
+	conditionErr := errors.New("condition failed")
+
+	tests := []struct {
+		name               string
+		steps              int
+		zeroDuration       bool
+		context            func() (context.Context, context.CancelFunc)
+		callback           func(calls int) (bool, error)
+		cancelContextAfter int
+		attemptsExpected   int
+		errExpected        error
+	}{
+		{
+			name:             "no attempts expected with zero backoff steps",
+			steps:            0,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:             "condition returns false with single backoff step",
+			steps:            1,
+			callback:         defaultCallback,
+			attemptsExpected: 1,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:  "condition returns true with single backoff step",
+			steps: 1,
+			callback: func(_ int) (bool, error) {
+				return true, nil
+			},
+			attemptsExpected: 1,
+			errExpected:      nil,
+		},
+		{
+			name:             "condition always returns false with multiple backoff steps",
+			steps:            5,
+			callback:         defaultCallback,
+			attemptsExpected: 5,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:  "condition returns true after certain attempts with multiple backoff steps",
+			steps: 5,
+			callback: func(attempts int) (bool, error) {
+				if attempts == 3 {
+					return true, nil
+				}
+				return false, nil
+			},
+			attemptsExpected: 3,
+			errExpected:      nil,
+		},
+		{
+			name:  "condition returns error no further attempts expected",
+			steps: 5,
+			callback: func(_ int) (bool, error) {
+				return true, conditionErr
+			},
+			attemptsExpected: 1,
+			errExpected:      conditionErr,
+		},
+		{
+			name:             "context already canceled no attempts expected",
+			steps:            5,
+			context:          cancelledContext,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      context.Canceled,
+		},
+		{
+			name:             "context at deadline no attempts expected",
+			steps:            5,
+			context:          deadlinedContext,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      context.DeadlineExceeded,
+		},
+		{
+			name:             "no attempts expected with zero backoff steps",
+			steps:            0,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:             "condition returns false with single backoff step",
+			steps:            1,
+			callback:         defaultCallback,
+			attemptsExpected: 1,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:  "condition returns true with single backoff step",
+			steps: 1,
+			callback: func(_ int) (bool, error) {
+				return true, nil
+			},
+			attemptsExpected: 1,
+			errExpected:      nil,
+		},
+		{
+			name:               "condition always returns false with multiple backoff steps but is cancelled at step 4",
+			steps:              5,
+			callback:           defaultCallback,
+			attemptsExpected:   4,
+			cancelContextAfter: 4,
+			errExpected:        context.Canceled,
+		},
+		{
+			name:         "condition returns true after certain attempts with multiple backoff steps and zero duration",
+			steps:        5,
+			zeroDuration: true,
+			callback: func(attempts int) (bool, error) {
+				if attempts == 3 {
+					return true, nil
+				}
+				return false, nil
+			},
+			attemptsExpected: 3,
+			errExpected:      nil,
+		},
+		{
+			name:  "condition returns error no further attempts expected",
+			steps: 5,
+			callback: func(_ int) (bool, error) {
+				return true, conditionErr
+			},
+			attemptsExpected: 1,
+			errExpected:      conditionErr,
+		},
+		{
+			name:             "context already canceled no attempts expected",
+			steps:            5,
+			context:          cancelledContext,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      context.Canceled,
+		},
+		{
+			name:             "context at deadline no attempts expected",
+			steps:            5,
+			context:          deadlinedContext,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      context.DeadlineExceeded,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			backoff := Backoff{
+				Duration: 1 * time.Microsecond,
+				Factor:   1.0,
+				Steps:    test.steps,
+			}
+			if test.zeroDuration {
+				backoff.Duration = 0
+			}
+
+			contextFn := test.context
+			if contextFn == nil {
+				contextFn = defaultContext
+			}
+			ctx, cancel := contextFn()
+			defer cancel()
+
+			attempts := 0
+			err := ExponentialBackoffWithContext(ctx, backoff, func(_ context.Context) (bool, error) {
+				attempts++
+				defer func() {
+					if test.cancelContextAfter > 0 && test.cancelContextAfter == attempts {
+						cancel()
+					}
+				}()
+				return test.callback(attempts)
+			})
+
+			if test.errExpected != err {
+				t.Errorf("expected error: %v but got: %v", test.errExpected, err)
+			}
+
+			if test.attemptsExpected != attempts {
+				t.Errorf("expected attempts count: %d but got: %d", test.attemptsExpected, attempts)
+			}
+		})
+	}
+}
+
+func BenchmarkExponentialBackoffWithContext(b *testing.B) {
+	backoff := Backoff{
+		Duration: 0,
+		Factor:   0,
+		Steps:    101,
+	}
+	ctx := context.Background()
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		attempts := 0
+		if err := ExponentialBackoffWithContext(ctx, backoff, func(_ context.Context) (bool, error) {
+			attempts++
+			return attempts >= 100, nil
+		}); err != nil {
+			b.Fatalf("unexpected err: %v", err)
+		}
+	}
+}
+
+func TestPollImmediateUntilWithContext(t *testing.T) {
+	fakeErr := errors.New("my error")
+	tests := []struct {
+		name                         string
+		condition                    func(int) ConditionWithContextFunc
+		context                      func() (context.Context, context.CancelFunc)
+		cancelContextAfterNthAttempt int
+		errExpected                  error
+		attemptsExpected             int
+	}{
+		{
+			name: "condition throws error on immediate attempt, no retry is attempted",
+			condition: func(int) ConditionWithContextFunc {
+				return func(context.Context) (done bool, err error) {
+					return false, fakeErr
+				}
+			},
+			errExpected:      fakeErr,
+			attemptsExpected: 1,
+		},
+		{
+			name: "condition returns done=true on immediate attempt, no retry is attempted",
+			condition: func(int) ConditionWithContextFunc {
+				return func(context.Context) (done bool, err error) {
+					return true, nil
+				}
+			},
+			errExpected:      nil,
+			attemptsExpected: 1,
+		},
+		{
+			name: "condition returns done=false on immediate attempt, context is already cancelled, no retry is attempted",
+			condition: func(int) ConditionWithContextFunc {
+				return func(context.Context) (done bool, err error) {
+					return false, nil
+				}
+			},
+			context:          cancelledContext,
+			errExpected:      ErrWaitTimeout, // this should be context.Canceled but that would break callers that assume all errors are ErrWaitTimeout
+			attemptsExpected: 1,
+		},
+		{
+			name: "condition returns done=false on immediate attempt, context is not cancelled, retry is attempted",
+			condition: func(attempts int) ConditionWithContextFunc {
+				return func(context.Context) (done bool, err error) {
+					// let first 3 attempts fail and the last one succeed
+					if attempts <= 3 {
+						return false, nil
+					}
+					return true, nil
+				}
+			},
+			errExpected:      nil,
+			attemptsExpected: 4,
+		},
+		{
+			name: "condition always returns done=false, context gets cancelled after N attempts",
+			condition: func(attempts int) ConditionWithContextFunc {
+				return func(ctx context.Context) (done bool, err error) {
+					return false, nil
+				}
+			},
+			cancelContextAfterNthAttempt: 4,
+			errExpected:                  ErrWaitTimeout, // this should be context.Canceled, but this method cannot change
+			attemptsExpected:             4,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			contextFn := test.context
+			if contextFn == nil {
+				contextFn = defaultContext
+			}
+			ctx, cancel := contextFn()
+			defer cancel()
+
+			var attempts int
+			conditionWrapper := func(ctx context.Context) (done bool, err error) {
+				attempts++
+				defer func() {
+					if test.cancelContextAfterNthAttempt == attempts {
+						cancel()
+					}
+				}()
+
+				c := test.condition(attempts)
+				return c(ctx)
+			}
+
+			err := PollImmediateUntilWithContext(ctx, time.Millisecond, conditionWrapper)
+			if test.errExpected != err {
+				t.Errorf("Expected error: %v, but got: %v", test.errExpected, err)
+			}
+			if test.attemptsExpected != attempts {
+				t.Errorf("Expected ConditionFunc to be invoked: %d times, but got: %d", test.attemptsExpected, attempts)
+			}
+		})
+	}
+}
+
+func Test_waitForWithContext(t *testing.T) {
+	fakeErr := errors.New("fake error")
+	tests := []struct {
+		name             string
+		context          func() (context.Context, context.CancelFunc)
+		condition        ConditionWithContextFunc
+		waitFunc         func() waitFunc
+		attemptsExpected int
+		errExpected      error
+	}{
+		{
+			name:    "condition returns done=true on first attempt, no retry is attempted",
+			context: defaultContext,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return true, nil
+			}),
+			waitFunc:         func() waitFunc { return fakeTicker(2, nil, func() {}) },
+			attemptsExpected: 1,
+			errExpected:      nil,
+		},
+		{
+			name:    "condition always returns done=false, timeout error expected",
+			context: defaultContext,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc: func() waitFunc { return fakeTicker(2, nil, func() {}) },
+			// the contract of waitForWithContext() says the func is called once more at the end of the wait
+			attemptsExpected: 3,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:    "condition returns an error on first attempt, the error is returned",
+			context: defaultContext,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, fakeErr
+			}),
+			waitFunc:         func() waitFunc { return fakeTicker(2, nil, func() {}) },
+			attemptsExpected: 1,
+			errExpected:      fakeErr,
+		},
+		{
+			name:    "context is cancelled, context cancelled error expected",
+			context: cancelledContext,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc: func() waitFunc {
+				return func(done <-chan struct{}) <-chan struct{} {
+					ch := make(chan struct{})
+					// never tick on this channel
+					return ch
+				}
+			},
+			attemptsExpected: 0,
+			errExpected:      ErrWaitTimeout,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			var attempts int
+			conditionWrapper := func(ctx context.Context) (done bool, err error) {
+				attempts++
+				return test.condition(ctx)
+			}
+
+			ticker := test.waitFunc()
+			err := func() error {
+				contextFn := test.context
+				if contextFn == nil {
+					contextFn = defaultContext
+				}
+				ctx, cancel := contextFn()
+				defer cancel()
+
+				return waitForWithContext(ctx, ticker.WithContext(), conditionWrapper)
+			}()
+
+			if test.errExpected != err {
+				t.Errorf("Expected error: %v, but got: %v", test.errExpected, err)
+			}
+			if test.attemptsExpected != attempts {
+				t.Errorf("Expected %d invocations, got %d", test.attemptsExpected, attempts)
+			}
+		})
+	}
+}
+
+func Test_poll(t *testing.T) {
+	fakeErr := errors.New("fake error")
+	tests := []struct {
+		name               string
+		context            func() (context.Context, context.CancelFunc)
+		immediate          bool
+		waitFunc           func() waitFunc
+		condition          ConditionWithContextFunc
+		cancelContextAfter int
+		attemptsExpected   int
+		errExpected        error
+	}{
+		{
+			name:      "immediate is true, condition returns an error",
+			immediate: true,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, fakeErr
+			}),
+			waitFunc:         nil,
+			attemptsExpected: 1,
+			errExpected:      fakeErr,
+		},
+		{
+			name:      "immediate is true, condition returns true",
+			immediate: true,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return true, nil
+			}),
+			waitFunc:         nil,
+			attemptsExpected: 1,
+			errExpected:      nil,
+		},
+		{
+			name:      "immediate is true, context is cancelled, condition return false",
+			immediate: true,
+			context:   cancelledContext,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc:         nil,
+			attemptsExpected: 1,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:      "immediate is false, context is cancelled",
+			immediate: false,
+			context:   cancelledContext,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc:         nil,
+			attemptsExpected: 0,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:      "immediate is false, condition returns an error",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, fakeErr
+			}),
+			waitFunc:         func() waitFunc { return fakeTicker(5, nil, func() {}) },
+			attemptsExpected: 1,
+			errExpected:      fakeErr,
+		},
+		{
+			name:      "immediate is false, condition returns true",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return true, nil
+			}),
+			waitFunc:         func() waitFunc { return fakeTicker(5, nil, func() {}) },
+			attemptsExpected: 1,
+			errExpected:      nil,
+		},
+		{
+			name:      "immediate is false, ticker channel is closed, condition returns true",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return true, nil
+			}),
+			waitFunc: func() waitFunc {
+				return func(done <-chan struct{}) <-chan struct{} {
+					ch := make(chan struct{})
+					close(ch)
+					return ch
+				}
+			},
+			attemptsExpected: 1,
+			errExpected:      nil,
+		},
+		{
+			name:      "immediate is false, ticker channel is closed, condition returns error",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, fakeErr
+			}),
+			waitFunc: func() waitFunc {
+				return func(done <-chan struct{}) <-chan struct{} {
+					ch := make(chan struct{})
+					close(ch)
+					return ch
+				}
+			},
+			attemptsExpected: 1,
+			errExpected:      fakeErr,
+		},
+		{
+			name:      "immediate is false, ticker channel is closed, condition returns false",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc: func() waitFunc {
+				return func(done <-chan struct{}) <-chan struct{} {
+					ch := make(chan struct{})
+					close(ch)
+					return ch
+				}
+			},
+			attemptsExpected: 1,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:      "condition always returns false, timeout error expected",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc: func() waitFunc { return fakeTicker(2, nil, func() {}) },
+			// the contract of waitForWithContext() says the func is called once more at the end of the wait
+			attemptsExpected: 3,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:      "context is cancelled after N attempts, timeout error expected",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc: func() waitFunc {
+				return func(done <-chan struct{}) <-chan struct{} {
+					ch := make(chan struct{})
+					// just tick twice
+					go func() {
+						ch <- struct{}{}
+						ch <- struct{}{}
+					}()
+					return ch
+				}
+			},
+			cancelContextAfter: 2,
+			attemptsExpected:   2,
+			errExpected:        ErrWaitTimeout,
+		},
+		{
+			name:      "context is cancelled after N attempts, context error not expected (legacy behavior)",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc: func() waitFunc {
+				return func(done <-chan struct{}) <-chan struct{} {
+					ch := make(chan struct{})
+					// just tick twice
+					go func() {
+						ch <- struct{}{}
+						ch <- struct{}{}
+					}()
+					return ch
+				}
+			},
+			cancelContextAfter: 2,
+			attemptsExpected:   2,
+			errExpected:        ErrWaitTimeout,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			var attempts int
+			ticker := waitFunc(func(done <-chan struct{}) <-chan struct{} {
+				return nil
+			})
+			if test.waitFunc != nil {
+				ticker = test.waitFunc()
+			}
+			err := func() error {
+				contextFn := test.context
+				if contextFn == nil {
+					contextFn = defaultContext
+				}
+				ctx, cancel := contextFn()
+				defer cancel()
+
+				conditionWrapper := func(ctx context.Context) (done bool, err error) {
+					attempts++
+
+					defer func() {
+						if test.cancelContextAfter == attempts {
+							cancel()
+						}
+					}()
+
+					return test.condition(ctx)
+				}
+
+				return poll(ctx, test.immediate, ticker.WithContext(), conditionWrapper)
+			}()
+
+			if test.errExpected != err {
+				t.Errorf("Expected error: %v, but got: %v", test.errExpected, err)
+			}
+			if test.attemptsExpected != attempts {
+				t.Errorf("Expected %d invocations, got %d", test.attemptsExpected, attempts)
+			}
+		})
+	}
+}
+
+func Benchmark_poll(b *testing.B) {
+	ctx := context.Background()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		attempts := 0
+		if err := poll(ctx, true, poller(time.Microsecond, 0), func(_ context.Context) (bool, error) {
+			attempts++
+			return attempts >= 100, nil
+		}); err != nil {
+			b.Fatalf("unexpected err: %v", err)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/waitgroup/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/waitgroup/doc.go
new file mode 100644
index 0000000000..6eb7903a73
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/waitgroup/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package waitgroup implements SafeWaitGroup wrap of sync.WaitGroup.
+// Add with positive delta when waiting will fail, to prevent sync.WaitGroup race issue.
+package waitgroup
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/waitgroup/ratelimited_waitgroup.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/waitgroup/ratelimited_waitgroup.go
new file mode 100644
index 0000000000..8766390fc2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/waitgroup/ratelimited_waitgroup.go
@@ -0,0 +1,134 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package waitgroup
+
+import (
+	"context"
+	"fmt"
+	"sync"
+)
+
+// RateLimiter abstracts the rate limiter used by RateLimitedSafeWaitGroup.
+// The implementation must be thread-safe.
+type RateLimiter interface {
+	Wait(ctx context.Context) error
+}
+
+// RateLimiterFactoryFunc is used by the RateLimitedSafeWaitGroup to create a new
+// instance of a RateLimiter that will be used to rate limit the return rate
+// of the active number of request(s). 'count' is the number of requests in
+// flight that are expected to invoke 'Done' on this wait group.
+type RateLimiterFactoryFunc func(count int) (RateLimiter, context.Context, context.CancelFunc)
+
+// RateLimitedSafeWaitGroup must not be copied after first use.
+type RateLimitedSafeWaitGroup struct {
+	wg sync.WaitGroup
+	// Once Wait is initiated, all consecutive Done invocation will be
+	// rate limited using this rate limiter.
+	limiter RateLimiter
+	stopCtx context.Context
+
+	mu sync.Mutex
+	// wait indicate whether Wait is called, if true,
+	// then any Add with positive delta will return error.
+	wait bool
+	// number of request(s) currently using the wait group
+	count int
+}
+
+// Add adds delta, which may be negative, similar to sync.WaitGroup.
+// If Add with a positive delta happens after Wait, it will return error,
+// which prevent unsafe Add.
+func (wg *RateLimitedSafeWaitGroup) Add(delta int) error {
+	wg.mu.Lock()
+	defer wg.mu.Unlock()
+
+	if wg.wait && delta > 0 {
+		return fmt.Errorf("add with positive delta after Wait is forbidden")
+	}
+	wg.wg.Add(delta)
+	wg.count += delta
+	return nil
+}
+
+// Done decrements the WaitGroup counter, rate limiting is applied only
+// when the wait group is in waiting mode.
+func (wg *RateLimitedSafeWaitGroup) Done() {
+	var limiter RateLimiter
+	func() {
+		wg.mu.Lock()
+		defer wg.mu.Unlock()
+
+		wg.count -= 1
+		if wg.wait {
+			// we are using the limiter outside the scope of the lock
+			limiter = wg.limiter
+		}
+	}()
+
+	defer wg.wg.Done()
+	if limiter != nil {
+		limiter.Wait(wg.stopCtx)
+	}
+}
+
+// Wait blocks until the WaitGroup counter is zero or a hard limit has elapsed.
+// It returns the number of active request(s) accounted for at the time Wait
+// has been invoked, number of request(s) that have drianed (done using the
+// wait group immediately before Wait returns).
+// Ideally, the both numbers returned should be equal, to indicate that all
+// request(s) using the wait group have released their lock.
+func (wg *RateLimitedSafeWaitGroup) Wait(limiterFactory RateLimiterFactoryFunc) (int, int, error) {
+	if limiterFactory == nil {
+		return 0, 0, fmt.Errorf("rate limiter factory must be specified")
+	}
+
+	var cancel context.CancelFunc
+	var countNow, countAfter int
+	func() {
+		wg.mu.Lock()
+		defer wg.mu.Unlock()
+
+		wg.limiter, wg.stopCtx, cancel = limiterFactory(wg.count)
+		countNow = wg.count
+		wg.wait = true
+	}()
+
+	defer cancel()
+	// there should be a hard stop, in case request(s) are not responsive
+	// enough to invoke Done before the grace period is over.
+	waitDoneCh := make(chan struct{})
+	go func() {
+		defer close(waitDoneCh)
+		wg.wg.Wait()
+	}()
+
+	var err error
+	select {
+	case <-wg.stopCtx.Done():
+		err = wg.stopCtx.Err()
+	case <-waitDoneCh:
+	}
+
+	func() {
+		wg.mu.Lock()
+		defer wg.mu.Unlock()
+
+		countAfter = wg.count
+	}()
+	return countNow, countAfter, err
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/waitgroup/ratelimited_waitgroup_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/waitgroup/ratelimited_waitgroup_test.go
new file mode 100644
index 0000000000..dcaefe44a4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/waitgroup/ratelimited_waitgroup_test.go
@@ -0,0 +1,320 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package waitgroup
+
+import (
+	"context"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"golang.org/x/time/rate"
+	"k8s.io/apimachinery/pkg/util/wait"
+)
+
+func TestRateLimitedSafeWaitGroup(t *testing.T) {
+	// we want to keep track of how many times rate limiter Wait method is
+	// being invoked, both before and after the wait group is in waiting mode.
+	limiter := &limiterWrapper{}
+
+	// we expect the context passed by the factory to be used
+	var cancelInvoked int
+	factory := &factory{
+		limiter: limiter,
+		grace:   2 * time.Second,
+		ctx:     context.Background(),
+		cancel: func() {
+			cancelInvoked++
+		},
+	}
+	target := &rateLimitedSafeWaitGroupWrapper{
+		RateLimitedSafeWaitGroup: &RateLimitedSafeWaitGroup{limiter: limiter},
+	}
+
+	// two set of requests
+	//  - n1: this set will finish using this waitgroup before Wait is invoked
+	//  - n2: this set will be in flight after Wait is invoked
+	n1, n2 := 100, 101
+
+	// so we know when all requests in n1 are done using the waitgroup
+	n1DoneWG := sync.WaitGroup{}
+
+	// so we know when all requests in n2 have called Add,
+	// but not finished with the waitgroup yet.
+	// this will allow the test to invoke 'Wait' once all requests
+	// in n2 have called `Add`, but none has called `Done` yet.
+	n2BeforeWaitWG := sync.WaitGroup{}
+	// so we know when all requests in n2 have called Done and
+	// are finished using the waitgroup
+	n2DoneWG := sync.WaitGroup{}
+
+	startCh, blockedCh := make(chan struct{}), make(chan struct{})
+	n1DoneWG.Add(n1)
+	for i := 0; i < n1; i++ {
+		go func() {
+			defer n1DoneWG.Done()
+			<-startCh
+
+			target.Add(1)
+			// let's finish using the waitgroup immediately
+			target.Done()
+		}()
+	}
+
+	n2BeforeWaitWG.Add(n2)
+	n2DoneWG.Add(n2)
+	for i := 0; i < n2; i++ {
+		go func() {
+			func() {
+				defer n2BeforeWaitWG.Done()
+				<-startCh
+
+				target.Add(1)
+			}()
+
+			func() {
+				defer n2DoneWG.Done()
+				// let's wait for the test to instruct the requests in n2
+				// that it is time to finish using the waitgroup.
+				<-blockedCh
+
+				target.Done()
+			}()
+		}()
+	}
+
+	// initially the count should be zero
+	if count := target.Count(); count != 0 {
+		t.Errorf("expected count to be zero, but got: %d", count)
+	}
+	// start the test
+	close(startCh)
+	// wait for the first set of requests (n1) to be done
+	n1DoneWG.Wait()
+
+	// after the first set of requests (n1) are done, the count should be zero
+	if invoked := limiter.invoked(); invoked != 0 {
+		t.Errorf("expected no call to rate limiter before Wait is called, but got: %d", invoked)
+	}
+
+	// make sure all requetss in the second group (n2) have started using the
+	// waitgroup (Add invoked) but no request is done using the waitgroup yet.
+	n2BeforeWaitWG.Wait()
+
+	// count should be n2, since every request in n2 is still using the waitgroup
+	if count := target.Count(); count != n2 {
+		t.Errorf("expected count to be: %d, but got: %d", n2, count)
+	}
+
+	// time for us to mark the waitgroup as `Waiting`
+	waitDoneCh := make(chan waitResult)
+	go func() {
+		factory.grace = 2 * time.Second
+		before, after, err := target.Wait(factory.NewRateLimiter)
+		waitDoneCh <- waitResult{before: before, after: after, err: err}
+	}()
+
+	// make sure there is no flake in the test due to this race condition
+	var waitingGot bool
+	wait.PollImmediate(500*time.Millisecond, wait.ForeverTestTimeout, func() (done bool, err error) {
+		if waiting := target.Waiting(); waiting {
+			waitingGot = true
+			return true, nil
+		}
+		return false, nil
+	})
+	// verify that the waitgroup is in 'Waiting' mode
+	if !waitingGot {
+		t.Errorf("expected to be in waiting")
+	}
+
+	// we should not allow any new request to use this waitgroup any longer
+	if err := target.Add(1); err == nil ||
+		!strings.Contains(err.Error(), "add with positive delta after Wait is forbidden") {
+		t.Errorf("expected Add to return error while in waiting mode: %v", err)
+	}
+
+	// make sure that RateLimitedSafeWaitGroup passes the right
+	// request count to the limiter factory.
+	if factory.countGot != n2 {
+		t.Errorf("expected count passed to factory to be: %d, but got: %d", n2, factory.countGot)
+	}
+
+	// indicate to all requests (each request in n2) that are
+	// currently using this waitgroup that they can go ahead
+	// and invoke 'Done' to finish using this waitgroup.
+	close(blockedCh)
+	n2DoneWG.Wait()
+
+	if invoked := limiter.invoked(); invoked != n2 {
+		t.Errorf("expected rate limiter to be called %d times, but got: %d", n2, invoked)
+	}
+
+	waitResult := <-waitDoneCh
+	if count := target.Count(); count != 0 {
+		t.Errorf("expected count to be zero, but got: %d", count)
+	}
+	if waitResult.before != n2 {
+		t.Errorf("expected count before Wait to be: %d, but got: %d", n2, waitResult.before)
+	}
+	if waitResult.after != 0 {
+		t.Errorf("expected count after Wait to be zero, but got: %d", waitResult.after)
+	}
+	if cancelInvoked != 1 {
+		t.Errorf("expected context cancel to be invoked once, but got: %d", cancelInvoked)
+	}
+}
+
+func TestRateLimitedSafeWaitGroupWithHardTimeout(t *testing.T) {
+	target := &rateLimitedSafeWaitGroupWrapper{
+		RateLimitedSafeWaitGroup: &RateLimitedSafeWaitGroup{},
+	}
+	n := 10
+	wg := sync.WaitGroup{}
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func() {
+			defer wg.Done()
+			target.Add(1)
+		}()
+	}
+
+	wg.Wait()
+	if count := target.Count(); count != n {
+		t.Errorf("expected count to be: %d, but got: %d", n, count)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	activeAt, activeNow, err := target.Wait(func(count int) (RateLimiter, context.Context, context.CancelFunc) {
+		return nil, ctx, cancel
+	})
+	if activeAt != n {
+		t.Errorf("expected active at Wait to be: %d, but got: %d", n, activeAt)
+	}
+	if activeNow != n {
+		t.Errorf("expected active after Wait to be: %d, but got: %d", n, activeNow)
+	}
+	if err != context.Canceled {
+		t.Errorf("expected error: %v, but got: %v", context.Canceled, err)
+	}
+}
+
+func TestRateLimitedSafeWaitGroupWithBurstOfOne(t *testing.T) {
+	target := &rateLimitedSafeWaitGroupWrapper{
+		RateLimitedSafeWaitGroup: &RateLimitedSafeWaitGroup{},
+	}
+	n := 200
+	grace := 5 * time.Second
+	wg := sync.WaitGroup{}
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func() {
+			defer wg.Done()
+			target.Add(1)
+		}()
+	}
+	wg.Wait()
+
+	waitingCh := make(chan struct{})
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func() {
+			defer wg.Done()
+
+			<-waitingCh
+			target.Done()
+		}()
+	}
+	defer wg.Wait()
+
+	now := time.Now()
+	t.Logf("Wait starting, N=%d, grace: %s, at: %s", n, grace, now)
+	activeAt, activeNow, err := target.Wait(func(count int) (RateLimiter, context.Context, context.CancelFunc) {
+		defer close(waitingCh)
+		// no deadline in context, Wait will wait forever, we want to measure
+		// how long it takes for the requests to drain.
+		return rate.NewLimiter(rate.Limit(n/int(grace.Seconds())), 1), context.Background(), func() {}
+	})
+	took := time.Since(now)
+	t.Logf("Wait finished, count(before): %d, count(after): %d, took: %s, err: %v", activeAt, activeNow, took, err)
+
+	// in CPU starved environment, the go routines may not finish in time
+	if took > 2*grace {
+		t.Errorf("expected Wait to take: %s, but it took: %s", grace, took)
+	}
+}
+
+type waitResult struct {
+	before, after int
+	err           error
+}
+
+type rateLimitedSafeWaitGroupWrapper struct {
+	*RateLimitedSafeWaitGroup
+}
+
+// used by test only
+func (wg *rateLimitedSafeWaitGroupWrapper) Count() int {
+	wg.mu.Lock()
+	defer wg.mu.Unlock()
+
+	return wg.count
+}
+func (wg *rateLimitedSafeWaitGroupWrapper) Waiting() bool {
+	wg.mu.Lock()
+	defer wg.mu.Unlock()
+
+	return wg.wait
+}
+
+type limiterWrapper struct {
+	delegate RateLimiter
+	lock     sync.Mutex
+	invokedN int
+}
+
+func (w *limiterWrapper) invoked() int {
+	w.lock.Lock()
+	defer w.lock.Unlock()
+	return w.invokedN
+}
+func (w *limiterWrapper) Wait(ctx context.Context) error {
+	w.lock.Lock()
+	w.invokedN++
+	w.lock.Unlock()
+
+	if w.delegate != nil {
+		w.delegate.Wait(ctx)
+	}
+	return nil
+}
+
+type factory struct {
+	limiter  *limiterWrapper
+	grace    time.Duration
+	ctx      context.Context
+	cancel   context.CancelFunc
+	countGot int
+}
+
+func (f *factory) NewRateLimiter(count int) (RateLimiter, context.Context, context.CancelFunc) {
+	f.countGot = count
+	f.limiter.delegate = rate.NewLimiter(rate.Limit(count/int(f.grace.Seconds())), 20)
+	return f.limiter, f.ctx, f.cancel
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/waitgroup/waitgroup.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/waitgroup/waitgroup.go
new file mode 100644
index 0000000000..e080a5e92f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/waitgroup/waitgroup.go
@@ -0,0 +1,57 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package waitgroup
+
+import (
+	"fmt"
+	"sync"
+)
+
+// SafeWaitGroup must not be copied after first use.
+type SafeWaitGroup struct {
+	wg sync.WaitGroup
+	mu sync.RWMutex
+	// wait indicate whether Wait is called, if true,
+	// then any Add with positive delta will return error.
+	wait bool
+}
+
+// Add adds delta, which may be negative, similar to sync.WaitGroup.
+// If Add with a positive delta happens after Wait, it will return error,
+// which prevent unsafe Add.
+func (wg *SafeWaitGroup) Add(delta int) error {
+	wg.mu.RLock()
+	defer wg.mu.RUnlock()
+	if wg.wait && delta > 0 {
+		return fmt.Errorf("add with positive delta after Wait is forbidden")
+	}
+	wg.wg.Add(delta)
+	return nil
+}
+
+// Done decrements the WaitGroup counter.
+func (wg *SafeWaitGroup) Done() {
+	wg.wg.Done()
+}
+
+// Wait blocks until the WaitGroup counter is zero.
+func (wg *SafeWaitGroup) Wait() {
+	wg.mu.Lock()
+	wg.wait = true
+	wg.mu.Unlock()
+	wg.wg.Wait()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/waitgroup/waitgroup_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/waitgroup/waitgroup_test.go
new file mode 100644
index 0000000000..b5b7557b85
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/waitgroup/waitgroup_test.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package waitgroup test cases reference golang sync.WaitGroup https://golang.org/src/sync/waitgroup_test.go.
+package waitgroup
+
+import (
+	"testing"
+)
+
+func TestWaitGroup(t *testing.T) {
+	wg1 := &SafeWaitGroup{}
+	wg2 := &SafeWaitGroup{}
+	n := 16
+	wg1.Add(n)
+	wg2.Add(n)
+	exited := make(chan bool, n)
+	for i := 0; i != n; i++ {
+		go func(i int) {
+			wg1.Done()
+			wg2.Wait()
+			exited <- true
+		}(i)
+	}
+	wg1.Wait()
+	for i := 0; i != n; i++ {
+		select {
+		case <-exited:
+			t.Fatal("SafeWaitGroup released group too soon")
+		default:
+		}
+		wg2.Done()
+	}
+	for i := 0; i != n; i++ {
+		<-exited // Will block if barrier fails to unlock someone.
+	}
+}
+
+func TestWaitGroupAddFail(t *testing.T) {
+	wg := &SafeWaitGroup{}
+	wg.Add(1)
+	wg.Done()
+	wg.Wait()
+	if err := wg.Add(1); err == nil {
+		t.Errorf("Should return error when add positive after Wait")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/yaml/decoder.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/yaml/decoder.go
new file mode 100644
index 0000000000..66bf31eea1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/yaml/decoder.go
@@ -0,0 +1,485 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+
+	jsonutil "k8s.io/apimachinery/pkg/util/json"
+
+	"sigs.k8s.io/yaml"
+)
+
+// Unmarshal unmarshals the given data
+// If v is a *map[string]interface{}, *[]interface{}, or *interface{} numbers
+// are converted to int64 or float64
+func Unmarshal(data []byte, v interface{}) error {
+	preserveIntFloat := func(d *json.Decoder) *json.Decoder {
+		d.UseNumber()
+		return d
+	}
+	switch v := v.(type) {
+	case *map[string]interface{}:
+		if err := yaml.Unmarshal(data, v, preserveIntFloat); err != nil {
+			return err
+		}
+		return jsonutil.ConvertMapNumbers(*v, 0)
+	case *[]interface{}:
+		if err := yaml.Unmarshal(data, v, preserveIntFloat); err != nil {
+			return err
+		}
+		return jsonutil.ConvertSliceNumbers(*v, 0)
+	case *interface{}:
+		if err := yaml.Unmarshal(data, v, preserveIntFloat); err != nil {
+			return err
+		}
+		return jsonutil.ConvertInterfaceNumbers(v, 0)
+	default:
+		return yaml.Unmarshal(data, v)
+	}
+}
+
+// UnmarshalStrict unmarshals the given data
+// strictly (erroring when there are duplicate fields).
+func UnmarshalStrict(data []byte, v interface{}) error {
+	preserveIntFloat := func(d *json.Decoder) *json.Decoder {
+		d.UseNumber()
+		return d
+	}
+	switch v := v.(type) {
+	case *map[string]interface{}:
+		if err := yaml.UnmarshalStrict(data, v, preserveIntFloat); err != nil {
+			return err
+		}
+		return jsonutil.ConvertMapNumbers(*v, 0)
+	case *[]interface{}:
+		if err := yaml.UnmarshalStrict(data, v, preserveIntFloat); err != nil {
+			return err
+		}
+		return jsonutil.ConvertSliceNumbers(*v, 0)
+	case *interface{}:
+		if err := yaml.UnmarshalStrict(data, v, preserveIntFloat); err != nil {
+			return err
+		}
+		return jsonutil.ConvertInterfaceNumbers(v, 0)
+	default:
+		return yaml.UnmarshalStrict(data, v)
+	}
+}
+
+// ToJSON converts a single YAML document into a JSON document
+// or returns an error. If the document appears to be JSON the
+// YAML decoding path is not used (so that error messages are
+// JSON specific).
+func ToJSON(data []byte) ([]byte, error) {
+	if IsJSONBuffer(data) {
+		return data, nil
+	}
+	return yaml.YAMLToJSON(data)
+}
+
+// YAMLToJSONDecoder decodes YAML documents from an io.Reader by
+// separating individual documents. It first converts the YAML
+// body to JSON, then unmarshals the JSON.
+type YAMLToJSONDecoder struct {
+	reader      Reader
+	inputOffset int
+}
+
+// NewYAMLToJSONDecoder decodes YAML documents from the provided
+// stream in chunks by converting each document (as defined by
+// the YAML spec) into its own chunk, converting it to JSON via
+// yaml.YAMLToJSON, and then passing it to json.Decoder.
+func NewYAMLToJSONDecoder(r io.Reader) *YAMLToJSONDecoder {
+	reader := bufio.NewReader(r)
+	return &YAMLToJSONDecoder{
+		reader: NewYAMLReader(reader),
+	}
+}
+
+// Decode reads a YAML document as JSON from the stream or returns
+// an error. The decoding rules match json.Unmarshal, not
+// yaml.Unmarshal.
+func (d *YAMLToJSONDecoder) Decode(into interface{}) error {
+	bytes, err := d.reader.Read()
+	if err != nil && err != io.EOF { //nolint:errorlint
+		return err
+	}
+
+	if len(bytes) != 0 {
+		err := yaml.Unmarshal(bytes, into)
+		if err != nil {
+			return YAMLSyntaxError{err}
+		}
+	}
+	d.inputOffset += len(bytes)
+	return err
+}
+
+func (d *YAMLToJSONDecoder) InputOffset() int {
+	return d.inputOffset
+}
+
+// YAMLDecoder reads chunks of objects and returns ErrShortBuffer if
+// the data is not sufficient.
+type YAMLDecoder struct {
+	r         io.ReadCloser
+	scanner   *bufio.Scanner
+	remaining []byte
+}
+
+// NewDocumentDecoder decodes YAML documents from the provided
+// stream in chunks by converting each document (as defined by
+// the YAML spec) into its own chunk. io.ErrShortBuffer will be
+// returned if the entire buffer could not be read to assist
+// the caller in framing the chunk.
+func NewDocumentDecoder(r io.ReadCloser) io.ReadCloser {
+	scanner := bufio.NewScanner(r)
+	// the size of initial allocation for buffer 4k
+	buf := make([]byte, 4*1024)
+	// the maximum size used to buffer a token 5M
+	scanner.Buffer(buf, 5*1024*1024)
+	scanner.Split(splitYAMLDocument)
+	return &YAMLDecoder{
+		r:       r,
+		scanner: scanner,
+	}
+}
+
+// Read reads the previous slice into the buffer, or attempts to read
+// the next chunk.
+// TODO: switch to readline approach.
+func (d *YAMLDecoder) Read(data []byte) (n int, err error) {
+	left := len(d.remaining)
+	if left == 0 {
+		// return the next chunk from the stream
+		if !d.scanner.Scan() {
+			err := d.scanner.Err()
+			if err == nil {
+				err = io.EOF
+			}
+			return 0, err
+		}
+		out := d.scanner.Bytes()
+		d.remaining = out
+		left = len(out)
+	}
+
+	// fits within data
+	if left <= len(data) {
+		copy(data, d.remaining)
+		d.remaining = nil
+		return left, nil
+	}
+
+	// caller will need to reread
+	copy(data, d.remaining[:len(data)])
+	d.remaining = d.remaining[len(data):]
+	return len(data), io.ErrShortBuffer
+}
+
+func (d *YAMLDecoder) Close() error {
+	return d.r.Close()
+}
+
+const yamlSeparator = "\n---"
+const separator = "---"
+
+// splitYAMLDocument is a bufio.SplitFunc for splitting YAML streams into individual documents.
+func splitYAMLDocument(data []byte, atEOF bool) (advance int, token []byte, err error) {
+	if atEOF && len(data) == 0 {
+		return 0, nil, nil
+	}
+	sep := len([]byte(yamlSeparator))
+	if i := bytes.Index(data, []byte(yamlSeparator)); i >= 0 {
+		// We have a potential document terminator
+		i += sep
+		after := data[i:]
+		if len(after) == 0 {
+			// we can't read any more characters
+			if atEOF {
+				return len(data), data[:len(data)-sep], nil
+			}
+			return 0, nil, nil
+		}
+		if j := bytes.IndexByte(after, '\n'); j >= 0 {
+			return i + j + 1, data[0 : i-sep], nil
+		}
+		return 0, nil, nil
+	}
+	// If we're at EOF, we have a final, non-terminated line. Return it.
+	if atEOF {
+		return len(data), data, nil
+	}
+	// Request more data.
+	return 0, nil, nil
+}
+
+// YAMLOrJSONDecoder attempts to decode a stream of JSON or YAML documents.
+// While JSON is YAML, the way Go's JSON decode defines a multi-document stream
+// is a series of JSON objects (e.g. {}{}), but YAML defines a multi-document
+// stream as a series of documents separated by "---".
+//
+// This decoder will attempt to decode the stream as JSON first, and if that
+// fails, it will switch to YAML. Once it determines the stream is JSON (by
+// finding a non-YAML-delimited series of objects), it will not switch to YAML.
+// Once it switches to YAML it will not switch back to JSON.
+type YAMLOrJSONDecoder struct {
+	json         *json.Decoder
+	jsonConsumed int64 // of the stream total, how much was JSON?
+	yaml         *YAMLToJSONDecoder
+	yamlConsumed int64 // of the stream total, how much was YAML?
+	stream       *StreamReader
+	count        int // how many objects have been decoded
+}
+
+type JSONSyntaxError struct {
+	Offset int64
+	Err    error
+}
+
+func (e JSONSyntaxError) Error() string {
+	return fmt.Sprintf("json: offset %d: %s", e.Offset, e.Err.Error())
+}
+
+type YAMLSyntaxError struct {
+	err error
+}
+
+func (e YAMLSyntaxError) Error() string {
+	return e.err.Error()
+}
+
+// NewYAMLOrJSONDecoder returns a decoder that will process YAML documents
+// or JSON documents from the given reader as a stream. bufferSize determines
+// how far into the stream the decoder will look to figure out whether this
+// is a JSON stream (has whitespace followed by an open brace).
+func NewYAMLOrJSONDecoder(r io.Reader, bufferSize int) *YAMLOrJSONDecoder {
+	d := &YAMLOrJSONDecoder{}
+
+	reader, _, mightBeJSON := GuessJSONStream(r, bufferSize)
+	d.stream = reader
+	if mightBeJSON {
+		d.json = json.NewDecoder(reader)
+	} else {
+		d.yaml = NewYAMLToJSONDecoder(reader)
+	}
+	return d
+}
+
+// Decode unmarshals the next object from the underlying stream into the
+// provide object, or returns an error.
+func (d *YAMLOrJSONDecoder) Decode(into interface{}) error {
+	// Because we don't know if this is a JSON or YAML stream, a failure from
+	// both decoders is ambiguous. When in doubt, it will return the error from
+	// the JSON decoder.  Unfortunately, this means that if the first document
+	// is invalid YAML, the error won't be awesome.
+	// TODO: the errors from YAML are not great, we could improve them a lot.
+	var firstErr error
+	if d.json != nil {
+		err := d.json.Decode(into)
+		if err == nil {
+			d.count++
+			consumed := d.json.InputOffset() - d.jsonConsumed
+			d.stream.Consume(int(consumed))
+			d.jsonConsumed += consumed
+			return nil
+		}
+		if err == io.EOF { //nolint:errorlint
+			return err
+		}
+		var syntax *json.SyntaxError
+		if ok := errors.As(err, &syntax); ok {
+			firstErr = JSONSyntaxError{
+				Offset: syntax.Offset,
+				Err:    syntax,
+			}
+		} else {
+			firstErr = err
+		}
+		if d.count > 1 {
+			// If we found 0 or 1 JSON object(s), this stream is still
+			// ambiguous.  But if we found more than 1 JSON object, then this
+			// is an unambiguous JSON stream, and we should not switch to YAML.
+			return err
+		}
+		// If JSON decoding hits the end of one object and then fails on the
+		// next, it leaves any leading whitespace in the buffer, which can
+		// confuse the YAML decoder. We just eat any whitespace we find, up to
+		// and including the first newline.
+		d.stream.Rewind()
+		if err := d.consumeWhitespace(); err == nil {
+			d.yaml = NewYAMLToJSONDecoder(d.stream)
+		}
+		d.json = nil
+	}
+	if d.yaml != nil {
+		err := d.yaml.Decode(into)
+		if err == nil {
+			d.count++
+			consumed := int64(d.yaml.InputOffset()) - d.yamlConsumed
+			d.stream.Consume(int(consumed))
+			d.yamlConsumed += consumed
+			return nil
+		}
+		if err == io.EOF { //nolint:errorlint
+			return err
+		}
+		if firstErr == nil {
+			firstErr = err
+		}
+	}
+	if firstErr != nil {
+		return firstErr
+	}
+	return fmt.Errorf("decoding failed as both JSON and YAML")
+}
+
+func (d *YAMLOrJSONDecoder) consumeWhitespace() error {
+	consumed := 0
+	for {
+		buf, err := d.stream.ReadN(4)
+		if err != nil && err == io.EOF { //nolint:errorlint
+			return err
+		}
+		r, sz := utf8.DecodeRune(buf)
+		if r == utf8.RuneError || sz == 0 {
+			return fmt.Errorf("invalid utf8 rune")
+		}
+		d.stream.RewindN(len(buf) - sz)
+		if !unicode.IsSpace(r) {
+			d.stream.RewindN(sz)
+			d.stream.Consume(consumed)
+			return nil
+		}
+		consumed += sz
+		if r == '\n' {
+			d.stream.Consume(consumed)
+			return nil
+		}
+		if err == io.EOF { //nolint:errorlint
+			break
+		}
+	}
+	return io.EOF
+}
+
+type Reader interface {
+	Read() ([]byte, error)
+}
+
+type YAMLReader struct {
+	reader Reader
+}
+
+func NewYAMLReader(r *bufio.Reader) *YAMLReader {
+	return &YAMLReader{
+		reader: &LineReader{reader: r},
+	}
+}
+
+// Read returns a full YAML document.
+func (r *YAMLReader) Read() ([]byte, error) {
+	var buffer bytes.Buffer
+	for {
+		line, err := r.reader.Read()
+		if err != nil && err != io.EOF { //nolint:errorlint
+			return nil, err
+		}
+
+		sep := len([]byte(separator))
+		if i := bytes.Index(line, []byte(separator)); i == 0 {
+			// We have a potential document terminator
+			i += sep
+			trimmed := strings.TrimSpace(string(line[i:]))
+			// We only allow comments and spaces following the yaml doc separator, otherwise we'll return an error
+			if len(trimmed) > 0 && string(trimmed[0]) != "#" {
+				return nil, YAMLSyntaxError{
+					err: fmt.Errorf("invalid Yaml document separator: %s", trimmed),
+				}
+			}
+			if buffer.Len() != 0 {
+				return buffer.Bytes(), nil
+			}
+			if err == io.EOF { //nolint:errorlint
+				return nil, err
+			}
+		}
+		if err == io.EOF { //nolint:errorlint
+			if buffer.Len() != 0 {
+				// If we're at EOF, we have a final, non-terminated line. Return it.
+				return buffer.Bytes(), nil
+			}
+			return nil, err
+		}
+		buffer.Write(line)
+	}
+}
+
+type LineReader struct {
+	reader *bufio.Reader
+}
+
+// Read returns a single line (with '\n' ended) from the underlying reader.
+// An error is returned iff there is an error with the underlying reader.
+func (r *LineReader) Read() ([]byte, error) {
+	var (
+		isPrefix bool  = true
+		err      error = nil
+		line     []byte
+		buffer   bytes.Buffer
+	)
+
+	for isPrefix && err == nil {
+		line, isPrefix, err = r.reader.ReadLine()
+		buffer.Write(line)
+	}
+	buffer.WriteByte('\n')
+	return buffer.Bytes(), err
+}
+
+// GuessJSONStream scans the provided reader up to size, looking
+// for an open brace indicating this is JSON. It will return the
+// bufio.Reader it creates for the consumer.
+func GuessJSONStream(r io.Reader, size int) (*StreamReader, []byte, bool) {
+	buffer := NewStreamReader(r, size)
+	b, _ := buffer.Peek(size)
+	return buffer, b, IsJSONBuffer(b)
+}
+
+// IsJSONBuffer scans the provided buffer, looking
+// for an open brace indicating this is JSON.
+func IsJSONBuffer(buf []byte) bool {
+	return hasPrefix(buf, jsonPrefix)
+}
+
+var jsonPrefix = []byte("{")
+
+// Return true if the first non-whitespace bytes in buf is
+// prefix.
+func hasPrefix(buf []byte, prefix []byte) bool {
+	trim := bytes.TrimLeftFunc(buf, unicode.IsSpace)
+	return bytes.HasPrefix(trim, prefix)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/yaml/decoder_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/yaml/decoder_test.go
new file mode 100644
index 0000000000..60a5ec80f4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/yaml/decoder_test.go
@@ -0,0 +1,559 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"math/rand"
+	"reflect"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+func TestYAMLDecoderReadBytesLength(t *testing.T) {
+	d := `---
+stuff: 1
+	test-foo: 1
+`
+	testCases := []struct {
+		bufLen    int
+		expectLen int
+		expectErr error
+	}{
+		{len(d), len(d), nil},
+		{len(d) + 10, len(d), nil},
+		{len(d) - 10, len(d) - 10, io.ErrShortBuffer},
+	}
+
+	for i, testCase := range testCases {
+		r := NewDocumentDecoder(io.NopCloser(bytes.NewReader([]byte(d))))
+		b := make([]byte, testCase.bufLen)
+		n, err := r.Read(b)
+		if err != testCase.expectErr || n != testCase.expectLen {
+			t.Fatalf("%d: unexpected body: %d / %v", i, n, err)
+		}
+	}
+}
+
+func TestBigYAML(t *testing.T) {
+	d := `
+stuff: 1
+`
+	maxLen := 5 * 1024 * 1024
+	bufferLen := 4 * 1024
+	//  maxLen 5 M
+	dd := strings.Repeat(d, 512*1024)
+	r := NewDocumentDecoder(io.NopCloser(bytes.NewReader([]byte(dd[:maxLen-1]))))
+	b := make([]byte, bufferLen)
+	n, err := r.Read(b)
+	if err != io.ErrShortBuffer {
+		t.Fatalf("expected ErrShortBuffer: %d / %v", n, err)
+	}
+	b = make([]byte, maxLen)
+	n, err = r.Read(b)
+	if err != nil {
+		t.Fatalf("expected nil: %d / %v", n, err)
+	}
+	r = NewDocumentDecoder(io.NopCloser(bytes.NewReader([]byte(dd))))
+	b = make([]byte, maxLen)
+	n, err = r.Read(b)
+	if err != bufio.ErrTooLong {
+		t.Fatalf("bufio.Scanner: token too long: %d / %v", n, err)
+	}
+}
+
+func TestYAMLDecoderCallsAfterErrShortBufferRestOfFrame(t *testing.T) {
+	d := `---
+stuff: 1
+	test-foo: 1`
+	r := NewDocumentDecoder(io.NopCloser(bytes.NewReader([]byte(d))))
+	b := make([]byte, 12)
+	n, err := r.Read(b)
+	if err != io.ErrShortBuffer || n != 12 {
+		t.Fatalf("expected ErrShortBuffer: %d / %v", n, err)
+	}
+	expected := "---\nstuff: 1"
+	if string(b) != expected {
+		t.Fatalf("expected bytes read to be: %s  got: %s", expected, string(b))
+	}
+	b = make([]byte, 13)
+	n, err = r.Read(b)
+	if err != nil || n != 13 {
+		t.Fatalf("expected nil: %d / %v", n, err)
+	}
+	expected = "\n\ttest-foo: 1"
+	if string(b) != expected {
+		t.Fatalf("expected bytes read to be: '%s'  got: '%s'", expected, string(b))
+	}
+	b = make([]byte, 15)
+	n, err = r.Read(b)
+	if err != io.EOF || n != 0 { //nolint:errorlint
+		t.Fatalf("expected EOF: %d / %v", n, err)
+	}
+}
+
+func TestSplitYAMLDocument(t *testing.T) {
+	testCases := []struct {
+		input  string
+		atEOF  bool
+		expect string
+		adv    int
+	}{
+		{"foo", true, "foo", 3},
+		{"fo", false, "", 0},
+
+		{"---", true, "---", 3},
+		{"---\n", true, "---\n", 4},
+		{"---\n", false, "", 0},
+
+		{"\n---\n", false, "", 5},
+		{"\n---\n", true, "", 5},
+
+		{"abc\n---\ndef", true, "abc", 8},
+		{"def", true, "def", 3},
+		{"", true, "", 0},
+	}
+	for i, testCase := range testCases {
+		adv, token, err := splitYAMLDocument([]byte(testCase.input), testCase.atEOF)
+		if err != nil {
+			t.Errorf("%d: unexpected error: %v", i, err)
+			continue
+		}
+		if adv != testCase.adv {
+			t.Errorf("%d: advance did not match: %d %d", i, testCase.adv, adv)
+		}
+		if testCase.expect != string(token) {
+			t.Errorf("%d: token did not match: %q %q", i, testCase.expect, string(token))
+		}
+	}
+}
+
+func TestGuessJSON(t *testing.T) {
+	if r, _, isJSON := GuessJSONStream(bytes.NewReader([]byte(" \n{}")), 100); !isJSON {
+		t.Fatalf("expected stream to be JSON")
+	} else {
+		b := make([]byte, 30)
+		n, err := r.Read(b)
+		if err != nil || n != 4 {
+			t.Fatalf("unexpected body: %d / %v", n, err)
+		}
+		if string(b[:n]) != " \n{}" {
+			t.Fatalf("unexpected body: %q", string(b[:n]))
+		}
+	}
+}
+
+func TestScanYAML(t *testing.T) {
+	s := bufio.NewScanner(bytes.NewReader([]byte(`---
+stuff: 1
+
+---
+  `)))
+	s.Split(splitYAMLDocument)
+	if !s.Scan() {
+		t.Fatalf("should have been able to scan")
+	}
+	t.Logf("scan: %s", s.Text())
+	if !s.Scan() {
+		t.Fatalf("should have been able to scan")
+	}
+	t.Logf("scan: %s", s.Text())
+	if s.Scan() {
+		t.Fatalf("scan should have been done")
+	}
+	if s.Err() != nil {
+		t.Fatalf("err should have been nil: %v", s.Err())
+	}
+}
+
+func TestDecodeYAML(t *testing.T) {
+	s := NewYAMLToJSONDecoder(bytes.NewReader([]byte(`---
+stuff: 1
+
+---   
+  `)))
+	obj := generic{}
+	if err := s.Decode(&obj); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if fmt.Sprintf("%#v", obj) != `yaml.generic{"stuff":1}` {
+		t.Errorf("unexpected object: %#v", obj)
+	}
+	obj = generic{}
+	if err := s.Decode(&obj); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(obj) != 0 {
+		t.Fatalf("unexpected object: %#v", obj)
+	}
+	obj = generic{}
+	if err := s.Decode(&obj); err != io.EOF { //nolint:errorlint
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func TestDecodeYAMLSeparatorValidation(t *testing.T) {
+	s := NewYAMLToJSONDecoder(bytes.NewReader([]byte(`---
+stuff: 1
+---    # Make sure termination happen with inline comment
+stuff: 2
+---
+stuff: 3
+--- Make sure uncommented content results YAMLSyntaxError
+
+ `)))
+	obj := generic{}
+	if err := s.Decode(&obj); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if fmt.Sprintf("%#v", obj) != `yaml.generic{"stuff":1}` {
+		t.Errorf("unexpected object: %#v", obj)
+	}
+	obj = generic{}
+	if err := s.Decode(&obj); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if fmt.Sprintf("%#v", obj) != `yaml.generic{"stuff":2}` {
+		t.Errorf("unexpected object: %#v", obj)
+	}
+	obj = generic{}
+	err := s.Decode(&obj)
+	if err == nil {
+		t.Fatalf("expected YamlSyntaxError, got nil instead")
+	}
+	if _, ok := err.(YAMLSyntaxError); !ok {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func TestDecodeBrokenYAML(t *testing.T) {
+	s := NewYAMLOrJSONDecoder(bytes.NewReader([]byte(`---
+stuff: 1
+		test-foo: 1
+
+---
+  `)), 100)
+	obj := generic{}
+	err := s.Decode(&obj)
+	if err == nil {
+		t.Fatal("expected error with yaml: violate, got no error")
+	}
+	fmt.Printf("err: %s\n", err.Error())
+	if !strings.Contains(err.Error(), "yaml: line 3:") {
+		t.Fatalf("expected %q to have 'yaml: line 3:' found a tab character", err.Error())
+	}
+}
+
+func TestDecodeBrokenJSON(t *testing.T) {
+	s := NewYAMLOrJSONDecoder(bytes.NewReader([]byte(`{
+	"foo": {
+		"stuff": 1
+		"otherStuff": 2
+	}
+}
+  `)), 100)
+	obj := generic{}
+	err := s.Decode(&obj)
+	if err == nil {
+		t.Fatal("expected error with json: prefix, got no error")
+	}
+	const msg = `json: .*invalid character.*".*after object key:value pair`
+	if matched, _ := regexp.MatchString(msg, err.Error()); !matched {
+		t.Fatalf("expected string matching %q, got %q", msg, err.Error())
+	}
+}
+
+type generic map[string]interface{}
+
+func TestYAMLOrJSONDecoder(t *testing.T) {
+	testCases := []struct {
+		input  string
+		buffer int
+		isJSON bool
+		err    bool
+		out    []generic
+	}{
+		{` {"1":2}{"3":4}`, 2, true, false, []generic{
+			{"1": 2},
+			{"3": 4},
+		}},
+		{" \n{}", 3, true, false, []generic{
+			{},
+		}},
+		{" \na: b", 2, false, false, []generic{
+			{"a": "b"},
+		}},
+		{" \n{\"a\": \"b\"}", 2, false, true, []generic{
+			{"a": "b"},
+		}},
+		{" \n{\"a\": \"b\"}", 3, true, false, []generic{
+			{"a": "b"},
+		}},
+		{`   {"a":"b"}`, 100, true, false, []generic{
+			{"a": "b"},
+		}},
+		{"", 1, false, false, []generic{}},
+		{"foo: bar\n---\nbaz: biz", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz"},
+		}},
+		{"---\nfoo: bar\n--- # with Comment\nbaz: biz", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz"},
+		}},
+		// Spaces for indent, tabs are not allowed in YAML.
+		{"foo:\n  field: bar\n---\nbaz:\n  field: biz", 100, false, false, []generic{
+			{"foo": map[string]any{"field": "bar"}},
+			{"baz": map[string]any{"field": "biz"}},
+		}},
+		{"foo: bar\n---\n", 100, false, false, []generic{
+			{"foo": "bar"},
+		}},
+		{"foo: bar\n---", 100, false, false, []generic{
+			{"foo": "bar"},
+		}},
+		{"foo: bar\n--", 100, false, true, []generic{
+			{"foo": "bar"},
+		}},
+		{"foo: bar\n-", 100, false, true, []generic{
+			{"foo": "bar"},
+		}},
+		{"foo: bar\n", 100, false, false, []generic{
+			{"foo": "bar"},
+		}},
+		// First document is JSON, second is YAML
+		{"{\"foo\": \"bar\"}\n---\n{baz: biz}", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz"},
+		}},
+		// First document is JSON, second is YAML but with smaller size.
+		{"{\"foo\": \"bar\"}\n---\na: b", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"a": "b"},
+		}},
+		// First document is JSON, second is YAML,but with smaller size and
+		// trailing whitespace.
+		{"{\"foo\": \"bar\"}    \n---\na: b", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"a": "b"},
+		}},
+		// First document is JSON, second is YAML, longer than the buffer
+		{"{\"foo\": \"bar\"}\n---\n{baz: biz0123456780123456780123456780123456780123456789}", 20, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz0123456780123456780123456780123456780123456789"},
+		}},
+		// First document is JSON, then whitespace, then YAML
+		{"{\"foo\": \"bar\"}    \n---\n{baz: biz}", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz"},
+		}},
+		// First document is YAML, second is JSON
+		{"{foo: bar}\n---\n{\"baz\": \"biz\"}", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz"},
+		}},
+		// First document is JSON, second is YAML, using spaces
+		{"{\n  \"foo\": \"bar\"\n}\n---\n{\n  baz: biz\n}", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz"},
+		}},
+		// First document is JSON, second is YAML, using tabs
+		{"{\n\t\"foo\": \"bar\"\n}\n---\n{\n\tbaz: biz\n}", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz"},
+		}},
+		// First 2 documents are JSON, third is YAML (stream is JSON)
+		{"{\"foo\": \"bar\"}\n{\"baz\": \"biz\"}\n---\n{qux: zrb}", 100, true, true, nil},
+	}
+	for i, testCase := range testCases {
+		decoder := NewYAMLOrJSONDecoder(bytes.NewReader([]byte(testCase.input)), testCase.buffer)
+		objs := []generic{}
+
+		var err error
+		for {
+			out := make(generic)
+			err = decoder.Decode(&out)
+			if err != nil {
+				break
+			}
+			objs = append(objs, out)
+		}
+		if err != io.EOF { //nolint:errorlint
+			switch {
+			case testCase.err && err == nil:
+				t.Errorf("%d: unexpected non-error", i)
+				continue
+			case !testCase.err && err != nil:
+				t.Errorf("%d: unexpected error: %v", i, err)
+				continue
+			case err != nil:
+				continue
+			}
+		}
+		switch {
+		case decoder.yaml != nil:
+			if testCase.isJSON {
+				t.Errorf("%d: expected JSON decoder, got YAML", i)
+			}
+		case decoder.json != nil:
+			if !testCase.isJSON {
+				t.Errorf("%d: expected YAML decoder, got JSON", i)
+			}
+		}
+		if fmt.Sprintf("%#v", testCase.out) != fmt.Sprintf("%#v", objs) {
+			t.Errorf("%d: objects were not equal: \n%#v\n%#v", i, testCase.out, objs)
+		}
+	}
+}
+
+func TestReadSingleLongLine(t *testing.T) {
+	testReadLines(t, []int{128 * 1024})
+}
+
+func TestReadRandomLineLengths(t *testing.T) {
+	minLength := 100
+	maxLength := 96 * 1024
+	maxLines := 100
+
+	lineLengths := make([]int, maxLines)
+	for i := 0; i < maxLines; i++ {
+		lineLengths[i] = rand.Intn(maxLength-minLength) + minLength
+	}
+
+	testReadLines(t, lineLengths)
+}
+
+func testReadLines(t *testing.T, lineLengths []int) {
+	var (
+		lines       [][]byte
+		inputStream []byte
+	)
+	for _, lineLength := range lineLengths {
+		inputLine := make([]byte, lineLength+1)
+		for i := 0; i < lineLength; i++ {
+			char := rand.Intn('z'-'A') + 'A'
+			inputLine[i] = byte(char)
+		}
+		inputLine[len(inputLine)-1] = '\n'
+		lines = append(lines, inputLine)
+	}
+	for _, line := range lines {
+		inputStream = append(inputStream, line...)
+	}
+
+	// init Reader
+	reader := bufio.NewReader(bytes.NewReader(inputStream))
+	lineReader := &LineReader{reader: reader}
+
+	// read lines
+	var readLines [][]byte
+	for range lines {
+		bytes, err := lineReader.Read()
+		if err != nil && err != io.EOF { //nolint:errorlint
+			t.Fatalf("failed to read lines: %v", err)
+		}
+		readLines = append(readLines, bytes)
+	}
+
+	// validate
+	for i := range lines {
+		if len(lines[i]) != len(readLines[i]) {
+			t.Fatalf("expected line length: %d, but got %d", len(lines[i]), len(readLines[i]))
+		}
+		if !reflect.DeepEqual(lines[i], readLines[i]) {
+			t.Fatalf("expected line: %v, but got %v", lines[i], readLines[i])
+		}
+	}
+}
+
+func TestTypedJSONOrYamlErrors(t *testing.T) {
+	s := NewYAMLOrJSONDecoder(bytes.NewReader([]byte(`{
+	"foo": {
+		"stuff": 1
+		"otherStuff": 2
+	}
+}
+  `)), 100)
+	obj := generic{}
+	err := s.Decode(&obj)
+	if err == nil {
+		t.Fatal("expected error with json: prefix, got no error")
+	}
+	if _, ok := err.(JSONSyntaxError); !ok {
+		t.Fatalf("expected %q to be of type JSONSyntaxError", err.Error())
+	}
+
+	s = NewYAMLOrJSONDecoder(bytes.NewReader([]byte(`---
+stuff: 1
+		test-foo: 1
+
+---
+  `)), 100)
+	obj = generic{}
+	err = s.Decode(&obj)
+	if err == nil {
+		t.Fatal("expected error with yaml: prefix, got no error")
+	}
+	if _, ok := err.(YAMLSyntaxError); !ok {
+		t.Fatalf("expected %q to be of type YAMLSyntaxError", err.Error())
+	}
+}
+
+func TestUnmarshal(t *testing.T) {
+	mapWithIntegerBytes := []byte(`replicas: 1`)
+	mapWithInteger := make(map[string]interface{})
+	if err := Unmarshal(mapWithIntegerBytes, &mapWithInteger); err != nil {
+		t.Fatalf("unexpected error unmarshaling yaml: %v", err)
+	}
+	if _, ok := mapWithInteger["replicas"].(int64); !ok {
+		t.Fatalf(`Expected number in map to be int64 but got "%T"`, mapWithInteger["replicas"])
+	}
+
+	sliceWithIntegerBytes := []byte(`- 1`)
+	var sliceWithInteger []interface{}
+	if err := Unmarshal(sliceWithIntegerBytes, &sliceWithInteger); err != nil {
+		t.Fatalf("unexpected error unmarshaling yaml: %v", err)
+	}
+	if _, ok := sliceWithInteger[0].(int64); !ok {
+		t.Fatalf(`Expected number in slice to be int64 but got "%T"`, sliceWithInteger[0])
+	}
+
+	integerBytes := []byte(`1`)
+	var integer interface{}
+	if err := Unmarshal(integerBytes, &integer); err != nil {
+		t.Fatalf("unexpected error unmarshaling yaml: %v", err)
+	}
+	if _, ok := integer.(int64); !ok {
+		t.Fatalf(`Expected number to be int64 but got "%T"`, integer)
+	}
+
+	otherTypeBytes := []byte(`123: 2`)
+	otherType := make(map[int]interface{})
+	if err := Unmarshal(otherTypeBytes, &otherType); err != nil {
+		t.Fatalf("unexpected error unmarshaling yaml: %v", err)
+	}
+	if _, ok := otherType[123].(int64); ok {
+		t.Fatalf(`Expected number not to be converted to int64`)
+	}
+	if _, ok := otherType[123].(float64); !ok {
+		t.Fatalf(`Expected number to be float64 but got "%T"`, otherType[123])
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/yaml/stream_reader.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/yaml/stream_reader.go
new file mode 100644
index 0000000000..d06991057f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/yaml/stream_reader.go
@@ -0,0 +1,130 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import "io"
+
+// StreamReader is a reader designed for consuming streams of variable-length
+// messages. It buffers data until it is explicitly consumed, and can be
+// rewound to re-read previous data.
+type StreamReader struct {
+	r           io.Reader
+	buf         []byte
+	head        int // current read offset into buf
+	ttlConsumed int // number of bytes which have been consumed
+}
+
+// NewStreamReader creates a new StreamReader wrapping the provided
+// io.Reader.
+func NewStreamReader(r io.Reader, size int) *StreamReader {
+	if size == 0 {
+		size = 4096
+	}
+	return &StreamReader{
+		r:   r,
+		buf: make([]byte, 0, size), // Start with a reasonable capacity
+	}
+}
+
+// Read implements io.Reader. It first returns any buffered data after the
+// current offset, and if that's exhausted, reads from the underlying reader
+// and buffers the data. The returned data is not considered consumed until the
+// Consume method is called.
+func (r *StreamReader) Read(p []byte) (n int, err error) {
+	// If we have buffered data, return it
+	if r.head < len(r.buf) {
+		n = copy(p, r.buf[r.head:])
+		r.head += n
+		return n, nil
+	}
+
+	// If we've already hit EOF, return it
+	if r.r == nil {
+		return 0, io.EOF
+	}
+
+	// Read from the underlying reader
+	n, err = r.r.Read(p)
+	if n > 0 {
+		r.buf = append(r.buf, p[:n]...)
+		r.head += n
+	}
+	if err == nil {
+		return n, nil
+	}
+	if err == io.EOF {
+		// Store that we've hit EOF by setting r to nil
+		r.r = nil
+	}
+	return n, err
+}
+
+// ReadN reads exactly n bytes from the reader, blocking until all bytes are
+// read or an error occurs. If an error occurs, the number of bytes read is
+// returned along with the error. If EOF is hit before n bytes are read, this
+// will return the bytes read so far, along with io.EOF. The returned data is
+// not considered consumed until the Consume method is called.
+func (r *StreamReader) ReadN(want int) ([]byte, error) {
+	ret := make([]byte, want)
+	off := 0
+	for off < want {
+		n, err := r.Read(ret[off:])
+		if err != nil {
+			return ret[:off+n], err
+		}
+		off += n
+	}
+	return ret, nil
+}
+
+// Peek returns the next n bytes without advancing the reader. The returned
+// bytes are valid until the next call to Consume.
+func (r *StreamReader) Peek(n int) ([]byte, error) {
+	buf, err := r.ReadN(n)
+	r.RewindN(len(buf))
+	if err != nil {
+		return buf, err
+	}
+	return buf, nil
+}
+
+// Rewind resets the reader to the beginning of the buffered data.
+func (r *StreamReader) Rewind() {
+	r.head = 0
+}
+
+// RewindN rewinds the reader by n bytes. If n is greater than the current
+// buffer, the reader is rewound to the beginning of the buffer.
+func (r *StreamReader) RewindN(n int) {
+	r.head -= min(n, r.head)
+}
+
+// Consume discards up to n bytes of previously read data from the beginning of
+// the buffer. Once consumed, that data is no longer available for rewinding.
+// If n is greater than the current buffer, the buffer is cleared. Consume
+// never consume data from the underlying reader.
+func (r *StreamReader) Consume(n int) {
+	n = min(n, len(r.buf))
+	r.buf = r.buf[n:]
+	r.head -= n
+	r.ttlConsumed += n
+}
+
+// Consumed returns the number of bytes consumed from the input reader.
+func (r *StreamReader) Consumed() int {
+	return r.ttlConsumed
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/yaml/stream_reader_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/yaml/stream_reader_test.go
new file mode 100644
index 0000000000..b010610c47
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/util/yaml/stream_reader_test.go
@@ -0,0 +1,388 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import (
+	"io"
+	"strings"
+	"testing"
+)
+
+// srt = StreamReaderTest
+type srtStep struct {
+	op       string
+	expected string
+	err      error
+	size     int
+}
+
+func srtRead(size int, expected string, err error) srtStep {
+	return srtStep{op: "Read", size: size, expected: expected, err: err}
+}
+func srtReadN(size int, expected string, err error) srtStep {
+	return srtStep{op: "ReadN", size: size, expected: expected, err: err}
+}
+func srtPeek(size int, expected string, err error) srtStep {
+	return srtStep{op: "Peek", size: size, expected: expected, err: err}
+}
+func srtRewind() srtStep {
+	return srtStep{op: "Rewind"}
+}
+func srtRewindN(size int) srtStep {
+	return srtStep{op: "RewindN", size: size}
+}
+func srtConsume(size int) srtStep {
+	return srtStep{op: "Consume", size: size}
+}
+func srtConsumed(exp int) srtStep {
+	return srtStep{op: "Consumed", size: exp}
+}
+
+func srtRun(t *testing.T, reader *StreamReader, steps []srtStep) {
+	t.Helper()
+
+	checkRead := func(i int, step srtStep, buf []byte, err error) {
+		t.Helper()
+		if err != nil && step.err == nil {
+			t.Errorf("step %d: unexpected error: %v", i, err)
+		} else if err == nil && step.err != nil {
+			t.Errorf("step %d: expected error %v", i, step.err)
+		} else if err != nil && err != step.err { //nolint:errorlint
+			t.Errorf("step %d: expected error %v, got %v", i, step.err, err)
+		}
+		if got := string(buf); got != step.expected {
+			t.Errorf("step %d: expected %q, got %q", i, step.expected, got)
+		}
+	}
+
+	for i, step := range steps {
+		switch step.op {
+		case "Read":
+			buf := make([]byte, step.size)
+			n, err := reader.Read(buf)
+			buf = buf[:n]
+			checkRead(i, step, buf, err)
+		case "ReadN":
+			buf, err := reader.ReadN(step.size)
+			checkRead(i, step, buf, err)
+		case "Peek":
+			buf, err := reader.Peek(step.size)
+			checkRead(i, step, buf, err)
+		case "Rewind":
+			reader.Rewind()
+		case "RewindN":
+			reader.RewindN(step.size)
+		case "Consume":
+			reader.Consume(step.size)
+		case "Consumed":
+			if n := reader.Consumed(); n != step.size {
+				t.Errorf("step %d: expected %d consumed, got %d", i, step.size, n)
+			}
+		default:
+			t.Fatalf("step %d: unknown operation %q", i, step.op)
+		}
+	}
+}
+
+func TestStreamReader_Read(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		steps []srtStep
+	}{{
+		name:  "empty input",
+		input: "",
+		steps: []srtStep{
+			srtRead(1, "", io.EOF),
+			srtRead(1, "", io.EOF), // still EOF
+		},
+	}, {
+		name:  "simple reads",
+		input: "0123456789",
+		steps: []srtStep{
+			srtRead(5, "01234", nil),
+			srtRead(5, "56789", nil),
+			srtRead(1, "", io.EOF),
+		},
+	}, {
+		name:  "short read at EOF",
+		input: "0123456789",
+		steps: []srtStep{
+			srtRead(8, "01234567", nil),
+			srtRead(8, "89", nil), // short read, no error
+			srtRead(1, "", io.EOF),
+		},
+	}, {
+		name:  "short reads from buffer",
+		input: "0123456789",
+		steps: []srtStep{
+			srtRead(3, "012", nil), // fill buffer
+			srtRewind(),
+			srtRead(4, "012", nil), // short read from buffer
+			srtRewind(),
+			srtRead(4, "012", nil),  // still short
+			srtRead(4, "3456", nil), // from reader
+			srtRewind(),
+			srtRead(10, "0123456", nil), // short read from buffer
+		},
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewStreamReader(strings.NewReader(tt.input), 4) // small initial buffer
+			srtRun(t, reader, tt.steps)
+		})
+	}
+}
+
+func TestStreamReader_Rewind(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		steps []srtStep
+	}{{
+		name:  "simple read and rewind",
+		input: "0123456789",
+		steps: []srtStep{
+			srtRead(4, "0123", nil),
+			srtRead(4, "4567", nil),
+			srtRead(4, "89", nil),
+			srtRead(1, "", io.EOF),
+			srtRewind(),
+			srtRead(4, "0123", nil),
+			srtRead(4, "4567", nil),
+			srtRead(4, "89", nil),
+			srtRead(1, "", io.EOF),
+		},
+	}, {
+		name:  "multiple rewinds",
+		input: "01234",
+		steps: []srtStep{
+			srtRead(2, "01", nil),
+			srtRewind(),
+			srtRead(2, "01", nil),
+			srtRead(2, "23", nil),
+			srtRewind(),
+			srtRead(2, "01", nil),
+			srtRead(2, "23", nil),
+			srtRead(2, "4", nil),
+			srtRead(1, "", io.EOF),
+			srtRewind(),
+			srtRead(100, "01234", nil),
+			srtRead(1, "", io.EOF),
+		},
+	}, {
+		name:  "empty input",
+		input: "",
+		steps: []srtStep{
+			srtRead(1, "", io.EOF),
+			srtRewind(),
+			srtRead(1, "", io.EOF),
+		},
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewStreamReader(strings.NewReader(tt.input), 4) // small initial buffer
+			srtRun(t, reader, tt.steps)
+		})
+	}
+}
+
+func TestStreamReader_RewindN(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		steps []srtStep
+	}{{
+		name:  "simple rewindn",
+		input: "0123456789",
+		steps: []srtStep{
+			srtRead(4, "0123", nil),
+			srtRead(4, "4567", nil),
+			srtRead(4, "89", nil),
+			srtRead(1, "", io.EOF),
+			srtRewindN(4),
+			srtRead(2, "67", nil),
+			srtRewindN(4),
+			srtRead(10, "456789", nil),
+			srtRead(1, "", io.EOF),
+		},
+	}, {
+		name:  "empty input",
+		input: "",
+		steps: []srtStep{
+			srtRead(1, "", io.EOF),
+			srtRewindN(100),
+			srtRead(1, "", io.EOF),
+		},
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewStreamReader(strings.NewReader(tt.input), 4) // small initial buffer
+			srtRun(t, reader, tt.steps)
+		})
+	}
+}
+
+func TestStreamReader_Consume(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		steps []srtStep
+	}{{
+		name:  "simple consume",
+		input: "0123456789",
+		steps: []srtStep{
+			srtConsumed(0),
+			srtRead(4, "0123", nil),
+			srtRead(4, "4567", nil),
+			srtConsume(2), // drops 01
+			srtConsumed(2),
+			srtRead(4, "89", nil),
+			srtRead(1, "", io.EOF),
+			srtRewind(),
+			srtRead(5, "23456", nil),
+			srtRead(5, "789", nil),
+			srtRead(1, "", io.EOF),
+			srtConsumed(2),
+		},
+	}, {
+		name:  "consume too much",
+		input: "01234",
+		steps: []srtStep{
+			srtConsumed(0),
+			srtRead(5, "01234", nil),
+			srtConsume(5),
+			srtConsumed(5),
+			srtConsume(5),
+			srtConsumed(5),
+			srtRead(1, "", io.EOF),
+			srtConsume(5),
+			srtConsumed(5),
+			srtRead(1, "", io.EOF),
+			srtConsumed(5),
+		},
+	}, {
+		name:  "empty input",
+		input: "",
+		steps: []srtStep{
+			srtConsumed(0),
+			srtConsume(5),
+			srtRead(1, "", io.EOF),
+			srtConsumed(0),
+		},
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewStreamReader(strings.NewReader(tt.input), 4) // small initial buffer
+			srtRun(t, reader, tt.steps)
+		})
+	}
+}
+
+func TestStreamReader_ReadN(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		steps []srtStep
+	}{{
+		name:  "short read full readN",
+		input: "0123456789",
+		steps: []srtStep{
+			srtRead(3, "012", nil), // fill buffer
+			srtRewind(),
+			srtRead(5, "012", nil), // short read from buffer
+			srtRewind(),
+			srtReadN(5, "01234", nil), // full readN
+			srtRewind(),
+			srtRead(10, "01234", nil), // short read from buffer
+			srtRewind(),
+			srtReadN(10, "0123456789", nil), // full readN
+			srtRewind(),
+			srtRead(10, "0123456789", nil), // full read from buffer
+			srtRead(1, "", io.EOF),
+		},
+	}, {
+		name:  "short read consume readN",
+		input: "0123456789",
+		steps: []srtStep{
+			srtRead(3, "012", nil), // fill buffer
+			srtRewind(),
+			srtRead(4, "012", nil), // short read from buffer
+			srtConsume(1),
+			srtRewind(),
+			srtRead(4, "12", nil), // short read from buffer
+			srtRewind(),
+			srtReadN(4, "1234", nil), // full read
+			srtConsume(1),
+			srtRewind(),
+			srtRead(4, "234", nil), // short read from buffer
+			srtRewind(),
+			srtReadN(10, "23456789", io.EOF), // short readN, EOF
+			srtRewind(),
+			srtRead(10, "23456789", nil), // full read from buffer
+			srtRead(1, "", io.EOF),
+		},
+	}, {
+		name:  "empty input",
+		input: "",
+		steps: []srtStep{
+			srtReadN(1, "", io.EOF),
+		},
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewStreamReader(strings.NewReader(tt.input), 4) // small initial buffer
+			srtRun(t, reader, tt.steps)
+		})
+	}
+}
+
+func TestStreamReader_Peek(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		steps []srtStep
+	}{{
+		name:  "simple peek",
+		input: "0123456789",
+		steps: []srtStep{
+			srtPeek(3, "012", nil), // fill buffer
+			srtRead(5, "012", nil), // short read from buffer
+			srtRewind(),
+			srtPeek(6, "012345", nil),  // fill buffer
+			srtRead(10, "012345", nil), // short read from buffer
+		},
+	}, {
+		name:  "empty input",
+		input: "",
+		steps: []srtStep{
+			srtPeek(1, "", io.EOF),
+		},
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewStreamReader(strings.NewReader(tt.input), 0)
+			srtRun(t, reader, tt.steps)
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/version/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/version/doc.go
new file mode 100644
index 0000000000..70e3f76b23
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/version/doc.go
@@ -0,0 +1,22 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.version
+//
+
+// Package version supplies the type for version information.
+package version
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/version/helpers.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/version/helpers.go
new file mode 100644
index 0000000000..5e041d6f3f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/version/helpers.go
@@ -0,0 +1,88 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package version
+
+import (
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+type versionType int
+
+const (
+	// Bigger the version type number, higher priority it is
+	versionTypeAlpha versionType = iota
+	versionTypeBeta
+	versionTypeGA
+)
+
+var kubeVersionRegex = regexp.MustCompile("^v([\\d]+)(?:(alpha|beta)([\\d]+))?$")
+
+func parseKubeVersion(v string) (majorVersion int, vType versionType, minorVersion int, ok bool) {
+	var err error
+	submatches := kubeVersionRegex.FindStringSubmatch(v)
+	if len(submatches) != 4 {
+		return 0, 0, 0, false
+	}
+	switch submatches[2] {
+	case "alpha":
+		vType = versionTypeAlpha
+	case "beta":
+		vType = versionTypeBeta
+	case "":
+		vType = versionTypeGA
+	default:
+		return 0, 0, 0, false
+	}
+	if majorVersion, err = strconv.Atoi(submatches[1]); err != nil {
+		return 0, 0, 0, false
+	}
+	if vType != versionTypeGA {
+		if minorVersion, err = strconv.Atoi(submatches[3]); err != nil {
+			return 0, 0, 0, false
+		}
+	}
+	return majorVersion, vType, minorVersion, true
+}
+
+// CompareKubeAwareVersionStrings compares two kube-like version strings.
+// Kube-like version strings are starting with a v, followed by a major version, optional "alpha" or "beta" strings
+// followed by a minor version (e.g. v1, v2beta1). Versions will be sorted based on GA/alpha/beta first and then major
+// and minor versions. e.g. v2, v1, v1beta2, v1beta1, v1alpha1.
+func CompareKubeAwareVersionStrings(v1, v2 string) int {
+	if v1 == v2 {
+		return 0
+	}
+	v1major, v1type, v1minor, ok1 := parseKubeVersion(v1)
+	v2major, v2type, v2minor, ok2 := parseKubeVersion(v2)
+	switch {
+	case !ok1 && !ok2:
+		return strings.Compare(v2, v1)
+	case !ok1 && ok2:
+		return -1
+	case ok1 && !ok2:
+		return 1
+	}
+	if v1type != v2type {
+		return int(v1type) - int(v2type)
+	}
+	if v1major != v2major {
+		return v1major - v2major
+	}
+	return v1minor - v2minor
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/version/helpers_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/version/helpers_test.go
new file mode 100644
index 0000000000..a98ed70e2a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/version/helpers_test.go
@@ -0,0 +1,121 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package version
+
+import (
+	"testing"
+)
+
+func TestCompareKubeAwareVersionStrings(t *testing.T) {
+	tests := []*struct {
+		v1, v2          string
+		expectedGreater bool
+	}{
+		{"v1", "v2", false},
+		{"v2", "v1", true},
+		{"v10", "v2", true},
+		{"v1", "v2alpha1", true},
+		{"v1", "v2beta1", true},
+		{"v1alpha2", "v1alpha1", true},
+		{"v1beta1", "v2alpha3", true},
+		{"v1alpha10", "v1alpha2", true},
+		{"v1beta10", "v1beta2", true},
+		{"foo", "v1beta2", false},
+		{"bar", "foo", true},
+		{"version1", "version2", true},  // Non kube-like versions are sorted alphabetically
+		{"version1", "version10", true}, // Non kube-like versions are sorted alphabetically
+	}
+
+	for _, tc := range tests {
+		if e, a := tc.expectedGreater, CompareKubeAwareVersionStrings(tc.v1, tc.v2) > 0; e != a {
+			if e {
+				t.Errorf("expected %s to be greater than %s", tc.v1, tc.v2)
+			} else {
+				t.Errorf("expected %s to be less than %s", tc.v1, tc.v2)
+			}
+		}
+	}
+}
+
+func Test_parseKubeVersion(t *testing.T) {
+	tests := []struct {
+		name             string
+		v                string
+		wantMajorVersion int
+		wantVType        versionType
+		wantMinorVersion int
+		wantOk           bool
+	}{
+		{
+			name:             "invalid version for ga",
+			v:                "v1.1",
+			wantMajorVersion: 0,
+			wantVType:        0,
+			wantMinorVersion: 0,
+			wantOk:           false,
+		},
+		{
+			name:             "invalid version for alpha",
+			v:                "v1alpha1.1",
+			wantMajorVersion: 0,
+			wantVType:        0,
+			wantMinorVersion: 0,
+			wantOk:           false,
+		},
+		{
+			name:             "alpha version",
+			v:                "v1alpha1",
+			wantMajorVersion: 1,
+			wantVType:        0,
+			wantMinorVersion: 1,
+			wantOk:           true,
+		},
+		{
+			name:             "beta version",
+			v:                "v2beta10",
+			wantMajorVersion: 2,
+			wantVType:        1,
+			wantMinorVersion: 10,
+			wantOk:           true,
+		},
+		{
+			name:             "ga version",
+			v:                "v3",
+			wantMajorVersion: 3,
+			wantVType:        2,
+			wantMinorVersion: 0,
+			wantOk:           true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotMajorVersion, gotVType, gotMinorVersion, gotOk := parseKubeVersion(tt.v)
+			if gotMajorVersion != tt.wantMajorVersion {
+				t.Errorf("parseKubeVersion() gotMajorVersion = %v, want %v", gotMajorVersion, tt.wantMajorVersion)
+			}
+			if gotVType != tt.wantVType {
+				t.Errorf("parseKubeVersion() gotVType = %v, want %v", gotVType, tt.wantVType)
+			}
+			if gotMinorVersion != tt.wantMinorVersion {
+				t.Errorf("parseKubeVersion() gotMinorVersion = %v, want %v", gotMinorVersion, tt.wantMinorVersion)
+			}
+			if gotOk != tt.wantOk {
+				t.Errorf("parseKubeVersion() gotOk = %v, want %v", gotOk, tt.wantOk)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/version/types.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/version/types.go
new file mode 100644
index 0000000000..6a18f9e91d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/version/types.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package version
+
+// Info contains versioning information.
+// TODO: Add []string of api versions supported? It's still unclear
+// how we'll want to distribute that information.
+type Info struct {
+	// Major is the major version of the binary version
+	Major string `json:"major"`
+	// Minor is the minor version of the binary version
+	Minor string `json:"minor"`
+	// EmulationMajor is the major version of the emulation version
+	EmulationMajor string `json:"emulationMajor,omitempty"`
+	// EmulationMinor is the minor version of the emulation version
+	EmulationMinor string `json:"emulationMinor,omitempty"`
+	// MinCompatibilityMajor is the major version of the minimum compatibility version
+	MinCompatibilityMajor string `json:"minCompatibilityMajor,omitempty"`
+	// MinCompatibilityMinor is the minor version of the minimum compatibility version
+	MinCompatibilityMinor string `json:"minCompatibilityMinor,omitempty"`
+	GitVersion            string `json:"gitVersion"`
+	GitCommit             string `json:"gitCommit"`
+	GitTreeState          string `json:"gitTreeState"`
+	BuildDate             string `json:"buildDate"`
+	GoVersion             string `json:"goVersion"`
+	Compiler              string `json:"compiler"`
+	Platform              string `json:"platform"`
+}
+
+// String returns info as a human-friendly version string.
+func (info Info) String() string {
+	return info.GitVersion
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/version/zz_generated.model_name.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/version/zz_generated.model_name.go
new file mode 100644
index 0000000000..e5a6d395ad
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/version/zz_generated.model_name.go
@@ -0,0 +1,27 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package version
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Info) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.version.Info"
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/doc.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/doc.go
new file mode 100644
index 0000000000..5fde5e7427
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package watch contains a generic watchable interface, and a fake for
+// testing code that uses the watch interface.
+package watch
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/filter.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/filter.go
new file mode 100644
index 0000000000..a5735a0b47
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/filter.go
@@ -0,0 +1,104 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch
+
+import (
+	"sync"
+)
+
+// FilterFunc should take an event, possibly modify it in some way, and return
+// the modified event. If the event should be ignored, then return keep=false.
+type FilterFunc func(in Event) (out Event, keep bool)
+
+// Filter passes all events through f before allowing them to pass on.
+// Putting a filter on a watch, as an unavoidable side-effect due to the way
+// go channels work, effectively causes the watch's event channel to have its
+// queue length increased by one.
+//
+// WARNING: filter has a fatal flaw, in that it can't properly update the
+// Type field (Add/Modified/Deleted) to reflect items beginning to pass the
+// filter when they previously didn't.
+func Filter(w Interface, f FilterFunc) Interface {
+	fw := &filteredWatch{
+		incoming: w,
+		result:   make(chan Event),
+		f:        f,
+	}
+	go fw.loop()
+	return fw
+}
+
+type filteredWatch struct {
+	incoming Interface
+	result   chan Event
+	f        FilterFunc
+}
+
+// ResultChan returns a channel which will receive filtered events.
+func (fw *filteredWatch) ResultChan() <-chan Event {
+	return fw.result
+}
+
+// Stop stops the upstream watch, which will eventually stop this watch.
+func (fw *filteredWatch) Stop() {
+	fw.incoming.Stop()
+}
+
+// loop waits for new values, filters them, and resends them.
+func (fw *filteredWatch) loop() {
+	defer close(fw.result)
+	for event := range fw.incoming.ResultChan() {
+		filtered, keep := fw.f(event)
+		if keep {
+			fw.result <- filtered
+		}
+	}
+}
+
+// Recorder records all events that are sent from the watch until it is closed.
+type Recorder struct {
+	Interface
+
+	lock   sync.Mutex
+	events []Event
+}
+
+var _ Interface = &Recorder{}
+
+// NewRecorder wraps an Interface and records any changes sent across it.
+func NewRecorder(w Interface) *Recorder {
+	r := &Recorder{}
+	r.Interface = Filter(w, r.record)
+	return r
+}
+
+// record is a FilterFunc and tracks each received event.
+func (r *Recorder) record(in Event) (Event, bool) {
+	r.lock.Lock()
+	defer r.lock.Unlock()
+	r.events = append(r.events, in)
+	return in, true
+}
+
+// Events returns a copy of the events sent across this recorder.
+func (r *Recorder) Events() []Event {
+	r.lock.Lock()
+	defer r.lock.Unlock()
+	copied := make([]Event, len(r.events))
+	copy(copied, r.events)
+	return copied
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/filter_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/filter_test.go
new file mode 100644
index 0000000000..106e06b46f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/filter_test.go
@@ -0,0 +1,114 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch_test
+
+import (
+	"reflect"
+	"testing"
+
+	. "k8s.io/apimachinery/pkg/watch"
+)
+
+func TestFilter(t *testing.T) {
+	table := []Event{
+		{Type: Added, Object: testType("foo")},
+		{Type: Added, Object: testType("bar")},
+		{Type: Added, Object: testType("baz")},
+		{Type: Added, Object: testType("qux")},
+		{Type: Added, Object: testType("zoo")},
+	}
+
+	source := NewFake()
+	filtered := Filter(source, func(e Event) (Event, bool) {
+		return e, e.Object.(testType)[0] != 'b'
+	})
+
+	go func() {
+		for _, item := range table {
+			source.Action(item.Type, item.Object)
+		}
+		source.Stop()
+	}()
+
+	var got []string
+	for {
+		event, ok := <-filtered.ResultChan()
+		if !ok {
+			break
+		}
+		got = append(got, string(event.Object.(testType)))
+	}
+
+	if e, a := []string{"foo", "qux", "zoo"}, got; !reflect.DeepEqual(e, a) {
+		t.Errorf("got %v, wanted %v", e, a)
+	}
+}
+
+func TestFilterStop(t *testing.T) {
+	source := NewFake()
+	filtered := Filter(source, func(e Event) (Event, bool) {
+		return e, e.Object.(testType)[0] != 'b'
+	})
+
+	go func() {
+		source.Add(testType("foo"))
+		filtered.Stop()
+	}()
+
+	var got []string
+	for {
+		event, ok := <-filtered.ResultChan()
+		if !ok {
+			break
+		}
+		got = append(got, string(event.Object.(testType)))
+	}
+
+	if e, a := []string{"foo"}, got; !reflect.DeepEqual(e, a) {
+		t.Errorf("got %v, wanted %v", e, a)
+	}
+}
+
+func TestRecorder(t *testing.T) {
+	events := []Event{
+		{Type: Added, Object: testType("foo")},
+		{Type: Added, Object: testType("bar")},
+		{Type: Added, Object: testType("baz")},
+		{Type: Added, Object: testType("qux")},
+		{Type: Added, Object: testType("zoo")},
+	}
+
+	source := NewFake()
+	go func() {
+		for _, item := range events {
+			source.Action(item.Type, item.Object)
+		}
+		source.Stop()
+	}()
+
+	recorder := NewRecorder(source)
+	for {
+		_, ok := <-recorder.Interface.ResultChan()
+		if !ok {
+			break
+		}
+	}
+	recordedEvents := recorder.Events()
+	if !reflect.DeepEqual(recordedEvents, events) {
+		t.Errorf("got %v, expected %v", recordedEvents, events)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/mux.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/mux.go
new file mode 100644
index 0000000000..d51f9567e4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/mux.go
@@ -0,0 +1,320 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch
+
+import (
+	"fmt"
+	"sync"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// FullChannelBehavior controls how the Broadcaster reacts if a watcher's watch
+// channel is full.
+type FullChannelBehavior int
+
+const (
+	WaitIfChannelFull FullChannelBehavior = iota
+	DropIfChannelFull
+)
+
+// Buffer the incoming queue a little bit even though it should rarely ever accumulate
+// anything, just in case a few events are received in such a short window that
+// Broadcaster can't move them onto the watchers' queues fast enough.
+const incomingQueueLength = 25
+
+// Broadcaster distributes event notifications among any number of watchers. Every event
+// is delivered to every watcher.
+type Broadcaster struct {
+	watchers     map[int64]*broadcasterWatcher
+	nextWatcher  int64
+	distributing sync.WaitGroup
+
+	// incomingBlock allows us to ensure we don't race and end up sending events
+	// to a closed channel following a broadcaster shutdown.
+	incomingBlock sync.Mutex
+	incoming      chan Event
+	stopped       chan struct{}
+
+	// How large to make watcher's channel.
+	watchQueueLength int
+	// If one of the watch channels is full, don't wait for it to become empty.
+	// Instead just deliver it to the watchers that do have space in their
+	// channels and move on to the next event.
+	// It's more fair to do this on a per-watcher basis than to do it on the
+	// "incoming" channel, which would allow one slow watcher to prevent all
+	// other watchers from getting new events.
+	fullChannelBehavior FullChannelBehavior
+}
+
+// NewBroadcaster creates a new Broadcaster. queueLength is the maximum number of events to queue per watcher.
+// It is guaranteed that events will be distributed in the order in which they occur,
+// but the order in which a single event is distributed among all of the watchers is unspecified.
+func NewBroadcaster(queueLength int, fullChannelBehavior FullChannelBehavior) *Broadcaster {
+	m := &Broadcaster{
+		watchers:            map[int64]*broadcasterWatcher{},
+		incoming:            make(chan Event, incomingQueueLength),
+		stopped:             make(chan struct{}),
+		watchQueueLength:    queueLength,
+		fullChannelBehavior: fullChannelBehavior,
+	}
+	m.distributing.Add(1)
+	go m.loop()
+	return m
+}
+
+// NewLongQueueBroadcaster functions nearly identically to NewBroadcaster,
+// except that the incoming queue is the same size as the outgoing queues
+// (specified by queueLength).
+func NewLongQueueBroadcaster(queueLength int, fullChannelBehavior FullChannelBehavior) *Broadcaster {
+	m := &Broadcaster{
+		watchers:            map[int64]*broadcasterWatcher{},
+		incoming:            make(chan Event, queueLength),
+		stopped:             make(chan struct{}),
+		watchQueueLength:    queueLength,
+		fullChannelBehavior: fullChannelBehavior,
+	}
+	m.distributing.Add(1)
+	go m.loop()
+	return m
+}
+
+const internalRunFunctionMarker = "internal-do-function"
+
+// a function type we can shoehorn into the queue.
+type functionFakeRuntimeObject func()
+
+func (obj functionFakeRuntimeObject) GetObjectKind() schema.ObjectKind {
+	return schema.EmptyObjectKind
+}
+func (obj functionFakeRuntimeObject) DeepCopyObject() runtime.Object {
+	if obj == nil {
+		return nil
+	}
+	// funcs are immutable. Hence, just return the original func.
+	return obj
+}
+
+// Execute f, blocking the incoming queue (and waiting for it to drain first).
+// The purpose of this terrible hack is so that watchers added after an event
+// won't ever see that event, and will always see any event after they are
+// added.
+func (m *Broadcaster) blockQueue(f func()) {
+	m.incomingBlock.Lock()
+	defer m.incomingBlock.Unlock()
+	select {
+	case <-m.stopped:
+		return
+	default:
+	}
+	var wg sync.WaitGroup
+	wg.Add(1)
+	m.incoming <- Event{
+		Type: internalRunFunctionMarker,
+		Object: functionFakeRuntimeObject(func() {
+			defer wg.Done()
+			f()
+		}),
+	}
+	wg.Wait()
+}
+
+// Watch adds a new watcher to the list and returns an Interface for it.
+// Note: new watchers will only receive new events. They won't get an entire history
+// of previous events. It will block until the watcher is actually added to the
+// broadcaster.
+func (m *Broadcaster) Watch() (Interface, error) {
+	var w *broadcasterWatcher
+	m.blockQueue(func() {
+		id := m.nextWatcher
+		m.nextWatcher++
+		w = &broadcasterWatcher{
+			result:  make(chan Event, m.watchQueueLength),
+			stopped: make(chan struct{}),
+			id:      id,
+			m:       m,
+		}
+		m.watchers[id] = w
+	})
+	if w == nil {
+		return nil, fmt.Errorf("broadcaster already stopped")
+	}
+	return w, nil
+}
+
+// WatchWithPrefix adds a new watcher to the list and returns an Interface for it. It sends
+// queuedEvents down the new watch before beginning to send ordinary events from Broadcaster.
+// The returned watch will have a queue length that is at least large enough to accommodate
+// all of the items in queuedEvents. It will block until the watcher is actually added to
+// the broadcaster.
+func (m *Broadcaster) WatchWithPrefix(queuedEvents []Event) (Interface, error) {
+	var w *broadcasterWatcher
+	m.blockQueue(func() {
+		id := m.nextWatcher
+		m.nextWatcher++
+		length := m.watchQueueLength
+		if n := len(queuedEvents) + 1; n > length {
+			length = n
+		}
+		w = &broadcasterWatcher{
+			result:  make(chan Event, length),
+			stopped: make(chan struct{}),
+			id:      id,
+			m:       m,
+		}
+		m.watchers[id] = w
+		for _, e := range queuedEvents {
+			w.result <- e
+		}
+	})
+	if w == nil {
+		return nil, fmt.Errorf("broadcaster already stopped")
+	}
+	return w, nil
+}
+
+// stopWatching stops the given watcher and removes it from the list.
+func (m *Broadcaster) stopWatching(id int64) {
+	m.blockQueue(func() {
+		w, ok := m.watchers[id]
+		if !ok {
+			// No need to do anything, it's already been removed from the list.
+			return
+		}
+		delete(m.watchers, id)
+		close(w.result)
+	})
+}
+
+// closeAll disconnects all watchers (presumably in response to a Shutdown call).
+func (m *Broadcaster) closeAll() {
+	for _, w := range m.watchers {
+		close(w.result)
+	}
+	// Delete everything from the map, since presence/absence in the map is used
+	// by stopWatching to avoid double-closing the channel.
+	m.watchers = map[int64]*broadcasterWatcher{}
+}
+
+// Action distributes the given event among all watchers.
+func (m *Broadcaster) Action(action EventType, obj runtime.Object) error {
+	m.incomingBlock.Lock()
+	defer m.incomingBlock.Unlock()
+	select {
+	case <-m.stopped:
+		return fmt.Errorf("broadcaster already stopped")
+	default:
+	}
+
+	m.incoming <- Event{action, obj}
+	return nil
+}
+
+// Action distributes the given event among all watchers, or drops it on the floor
+// if too many incoming actions are queued up.  Returns true if the action was sent,
+// false if dropped.
+func (m *Broadcaster) ActionOrDrop(action EventType, obj runtime.Object) (bool, error) {
+	m.incomingBlock.Lock()
+	defer m.incomingBlock.Unlock()
+
+	// Ensure that if the broadcaster is stopped we do not send events to it.
+	select {
+	case <-m.stopped:
+		return false, fmt.Errorf("broadcaster already stopped")
+	default:
+	}
+
+	select {
+	case m.incoming <- Event{action, obj}:
+		return true, nil
+	default:
+		return false, nil
+	}
+}
+
+// Shutdown disconnects all watchers (but any queued events will still be distributed).
+// You must not call Action or Watch* after calling Shutdown. This call blocks
+// until all events have been distributed through the outbound channels. Note
+// that since they can be buffered, this means that the watchers might not
+// have received the data yet as it can remain sitting in the buffered
+// channel. It will block until the broadcaster stop request is actually executed
+func (m *Broadcaster) Shutdown() {
+	m.blockQueue(func() {
+		close(m.stopped)
+		close(m.incoming)
+	})
+	m.distributing.Wait()
+}
+
+// loop receives from m.incoming and distributes to all watchers.
+func (m *Broadcaster) loop() {
+	// Deliberately not catching crashes here. Yes, bring down the process if there's a
+	// bug in watch.Broadcaster.
+	for event := range m.incoming {
+		if event.Type == internalRunFunctionMarker {
+			event.Object.(functionFakeRuntimeObject)()
+			continue
+		}
+		m.distribute(event)
+	}
+	m.closeAll()
+	m.distributing.Done()
+}
+
+// distribute sends event to all watchers. Blocking.
+func (m *Broadcaster) distribute(event Event) {
+	if m.fullChannelBehavior == DropIfChannelFull {
+		for _, w := range m.watchers {
+			select {
+			case w.result <- event:
+			case <-w.stopped:
+			default: // Don't block if the event can't be queued.
+			}
+		}
+	} else {
+		for _, w := range m.watchers {
+			select {
+			case w.result <- event:
+			case <-w.stopped:
+			}
+		}
+	}
+}
+
+// broadcasterWatcher handles a single watcher of a broadcaster
+type broadcasterWatcher struct {
+	result  chan Event
+	stopped chan struct{}
+	stop    sync.Once
+	id      int64
+	m       *Broadcaster
+}
+
+// ResultChan returns a channel to use for waiting on events.
+func (mw *broadcasterWatcher) ResultChan() <-chan Event {
+	return mw.result
+}
+
+// Stop stops watching and removes mw from its list.
+// It will block until the watcher stop request is actually executed
+func (mw *broadcasterWatcher) Stop() {
+	mw.stop.Do(func() {
+		close(mw.stopped)
+		mw.m.stopWatching(mw.id)
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/mux_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/mux_test.go
new file mode 100644
index 0000000000..9b46ce77e9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/mux_test.go
@@ -0,0 +1,291 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch
+
+import (
+	"reflect"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/wait"
+)
+
+type myType struct {
+	ID    string
+	Value string
+}
+
+func (obj *myType) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+func (obj *myType) DeepCopyObject() runtime.Object {
+	if obj == nil {
+		return nil
+	}
+	clone := *obj
+	return &clone
+}
+
+func TestBroadcaster(t *testing.T) {
+	table := []Event{
+		{Type: Added, Object: &myType{"foo", "hello world 1"}},
+		{Type: Added, Object: &myType{"bar", "hello world 2"}},
+		{Type: Modified, Object: &myType{"foo", "goodbye world 3"}},
+		{Type: Deleted, Object: &myType{"bar", "hello world 4"}},
+	}
+
+	// The broadcaster we're testing
+	m := NewBroadcaster(0, WaitIfChannelFull)
+
+	// Add a bunch of watchers
+	const testWatchers = 2
+	wg := sync.WaitGroup{}
+	wg.Add(testWatchers)
+	for i := 0; i < testWatchers; i++ {
+		w, err := m.Watch()
+		if err != nil {
+			t.Fatalf("Unable start event watcher: '%v' (will not retry!)", err)
+		}
+		// Verify that each watcher gets the events in the correct order
+		go func(watcher int, w Interface) {
+			tableLine := 0
+			for {
+				event, ok := <-w.ResultChan()
+				if !ok {
+					break
+				}
+				if e, a := table[tableLine], event; !reflect.DeepEqual(e, a) {
+					t.Errorf("Watcher %v, line %v: Expected (%v, %#v), got (%v, %#v)",
+						watcher, tableLine, e.Type, e.Object, a.Type, a.Object)
+				} else {
+					t.Logf("Got (%v, %#v)", event.Type, event.Object)
+				}
+				tableLine++
+			}
+			wg.Done()
+		}(i, w)
+	}
+
+	for i, item := range table {
+		t.Logf("Sending %v", i)
+		m.Action(item.Type, item.Object)
+	}
+
+	m.Shutdown()
+
+	wg.Wait()
+}
+
+func TestBroadcasterWatcherClose(t *testing.T) {
+	m := NewBroadcaster(0, WaitIfChannelFull)
+	w, err := m.Watch()
+	if err != nil {
+		t.Fatalf("Unable start event watcher: '%v' (will not retry!)", err)
+	}
+	w2, err := m.Watch()
+	if err != nil {
+		t.Fatalf("Unable start event watcher: '%v' (will not retry!)", err)
+	}
+	w.Stop()
+	m.Shutdown()
+	if _, open := <-w.ResultChan(); open {
+		t.Errorf("Stop didn't work?")
+	}
+	if _, open := <-w2.ResultChan(); open {
+		t.Errorf("Shutdown didn't work?")
+	}
+	// Extra stops don't hurt things
+	w.Stop()
+	w2.Stop()
+}
+
+func TestBroadcasterWatcherStopDeadlock(t *testing.T) {
+	done := make(chan bool)
+	m := NewBroadcaster(0, WaitIfChannelFull)
+	w, err := m.Watch()
+	if err != nil {
+		t.Fatalf("Unable start event watcher: '%v' (will not retry!)", err)
+	}
+	w2, err := m.Watch()
+	if err != nil {
+		t.Fatalf("Unable start event watcher: '%v' (will not retry!)", err)
+	}
+	go func(w0, w1 Interface) {
+		// We know Broadcaster is in the distribute loop once one watcher receives
+		// an event. Stop the other watcher while distribute is trying to
+		// send to it.
+		select {
+		case <-w0.ResultChan():
+			w1.Stop()
+		case <-w1.ResultChan():
+			w0.Stop()
+		}
+		close(done)
+	}(w, w2)
+	m.Action(Added, &myType{})
+	select {
+	case <-time.After(wait.ForeverTestTimeout):
+		t.Error("timeout: deadlocked")
+	case <-done:
+	}
+	m.Shutdown()
+}
+
+func TestBroadcasterDropIfChannelFull(t *testing.T) {
+	m := NewBroadcaster(1, DropIfChannelFull)
+
+	event1 := Event{Type: Added, Object: &myType{"foo", "hello world 1"}}
+	event2 := Event{Type: Added, Object: &myType{"bar", "hello world 2"}}
+
+	// Add a couple watchers
+	watches := make([]Interface, 2)
+	var err error
+	for i := range watches {
+		watches[i], err = m.Watch()
+		if err != nil {
+			t.Fatalf("Unable start event watcher: '%v' (will not retry!)", err)
+		}
+	}
+
+	// Send a couple events before closing the broadcast channel.
+	t.Log("Sending event 1")
+	m.Action(event1.Type, event1.Object)
+	t.Log("Sending event 2")
+	m.Action(event2.Type, event2.Object)
+	m.Shutdown()
+
+	// Pull events from the queue.
+	wg := sync.WaitGroup{}
+	wg.Add(len(watches))
+	for i := range watches {
+		// Verify that each watcher only gets the first event because its watch
+		// queue of length one was full from the first one.
+		go func(watcher int, w Interface) {
+			defer wg.Done()
+			e1, ok := <-w.ResultChan()
+			if !ok {
+				t.Errorf("Watcher %v failed to retrieve first event.", watcher)
+			}
+			if e, a := event1, e1; !reflect.DeepEqual(e, a) {
+				t.Errorf("Watcher %v: Expected (%v, %#v), got (%v, %#v)",
+					watcher, e.Type, e.Object, a.Type, a.Object)
+			}
+			t.Logf("Got (%v, %#v)", e1.Type, e1.Object)
+			e2, ok := <-w.ResultChan()
+			if ok {
+				t.Errorf("Watcher %v received second event (%v, %#v) even though it shouldn't have.",
+					watcher, e2.Type, e2.Object)
+			}
+		}(i, watches[i])
+	}
+	wg.Wait()
+}
+
+func BenchmarkBroadCaster(b *testing.B) {
+	event1 := Event{Type: Added, Object: &myType{"foo", "hello world 1"}}
+	m := NewBroadcaster(0, WaitIfChannelFull)
+	b.ResetTimer()
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			m.Action(event1.Type, event1.Object)
+		}
+	})
+	b.StopTimer()
+}
+
+func TestBroadcasterWatchAfterShutdown(t *testing.T) {
+	event1 := Event{Type: Added, Object: &myType{"foo", "hello world 1"}}
+	event2 := Event{Type: Added, Object: &myType{"bar", "hello world 2"}}
+
+	m := NewBroadcaster(0, WaitIfChannelFull)
+	m.Shutdown()
+
+	_, err := m.Watch()
+	assert.EqualError(t, err, "broadcaster already stopped", "Watch should report error id broadcaster is shutdown")
+
+	_, err = m.WatchWithPrefix([]Event{event1, event2})
+	assert.EqualError(t, err, "broadcaster already stopped", "WatchWithPrefix should report error id broadcaster is shutdown")
+}
+
+func TestBroadcasterSendEventAfterShutdown(t *testing.T) {
+	m := NewBroadcaster(1, DropIfChannelFull)
+
+	event := Event{Type: Added, Object: &myType{"foo", "hello world"}}
+
+	// Add a couple watchers
+	watches := make([]Interface, 2)
+	for i := range watches {
+		watches[i], _ = m.Watch()
+	}
+	m.Shutdown()
+
+	// Send a couple events after closing the broadcast channel.
+	t.Log("Sending event")
+
+	err := m.Action(event.Type, event.Object)
+	assert.EqualError(t, err, "broadcaster already stopped", "ActionOrDrop should report error id broadcaster is shutdown")
+
+	sendOnClosed, err := m.ActionOrDrop(event.Type, event.Object)
+	assert.False(t, sendOnClosed, "ActionOrDrop should return false if broadcaster is already shutdown")
+	assert.EqualError(t, err, "broadcaster already stopped", "ActionOrDrop should report error id broadcaster is shutdown")
+}
+
+// Test this since we see usage patterns where the broadcaster and watchers are
+// stopped simultaneously leading to races.
+func TestBroadcasterShutdownRace(t *testing.T) {
+	m := NewBroadcaster(1, WaitIfChannelFull)
+	stopCh := make(chan struct{})
+
+	// Add a bunch of watchers
+	const testWatchers = 2
+	for i := 0; i < testWatchers; i++ {
+		i := i
+
+		_, err := m.Watch()
+		if err != nil {
+			t.Fatalf("Unable start event watcher: '%v' (will not retry!)", err)
+		}
+		// This is how we force the watchers to close down independently of the
+		// eventbroadcaster, see real usage pattern in startRecordingEvents()
+		go func() {
+			<-stopCh
+			t.Log("Stopping Watchers")
+			m.stopWatching(int64(i))
+		}()
+	}
+
+	event := Event{Type: Added, Object: &myType{"foo", "hello world"}}
+	err := m.Action(event.Type, event.Object)
+	if err != nil {
+		t.Fatalf("error sending event: %v", err)
+	}
+
+	// Manually simulate m.Shutdown() but change it to force a race scenario
+	// 1. Close watcher stopchannel, so watchers are closed independently of the
+	// eventBroadcaster
+	// 2. Shutdown the m.incoming slightly Before m.stopped so that the watcher's
+	// call of Blockqueue can pass the m.stopped check.
+	m.blockQueue(func() {
+		close(stopCh)
+		close(m.incoming)
+		time.Sleep(1 * time.Millisecond)
+		close(m.stopped)
+	})
+	m.distributing.Wait()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/streamwatcher.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/streamwatcher.go
new file mode 100644
index 0000000000..b422ca9f55
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/streamwatcher.go
@@ -0,0 +1,145 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch
+
+import (
+	"fmt"
+	"io"
+	"sync"
+
+	"k8s.io/klog/v2"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/net"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// Decoder allows StreamWatcher to watch any stream for which a Decoder can be written.
+type Decoder interface {
+	// Decode should return the type of event, the decoded object, or an error.
+	// An error will cause StreamWatcher to call Close(). Decode should block until
+	// it has data or an error occurs.
+	Decode() (action EventType, object runtime.Object, err error)
+
+	// Close should close the underlying io.Reader, signalling to the source of
+	// the stream that it is no longer being watched. Close() must cause any
+	// outstanding call to Decode() to return with an error of some sort.
+	Close()
+}
+
+// Reporter hides the details of how an error is turned into a runtime.Object for
+// reporting on a watch stream since this package may not import a higher level report.
+type Reporter interface {
+	// AsObject must convert err into a valid runtime.Object for the watch stream.
+	AsObject(err error) runtime.Object
+}
+
+// StreamWatcher turns any stream for which you can write a Decoder interface
+// into a watch.Interface.
+type StreamWatcher struct {
+	logger klog.Logger
+	sync.Mutex
+	source   Decoder
+	reporter Reporter
+	result   chan Event
+	done     chan struct{}
+}
+
+// NewStreamWatcher creates a StreamWatcher from the given decoder.
+//
+// Contextual logging: NewStreamWatcherWithLogger should be used instead of NewStreamWatcher in code which supports contextual logging.
+func NewStreamWatcher(d Decoder, r Reporter) *StreamWatcher {
+	return NewStreamWatcherWithLogger(klog.Background(), d, r)
+}
+
+// NewStreamWatcherWithLogger creates a StreamWatcher from the given decoder and logger.
+func NewStreamWatcherWithLogger(logger klog.Logger, d Decoder, r Reporter) *StreamWatcher {
+	sw := &StreamWatcher{
+		logger:   logger,
+		source:   d,
+		reporter: r,
+		// It's easy for a consumer to add buffering via an extra
+		// goroutine/channel, but impossible for them to remove it,
+		// so nonbuffered is better.
+		result: make(chan Event),
+		// If the watcher is externally stopped there is no receiver anymore
+		// and the send operations on the result channel, especially the
+		// error reporting might block forever.
+		// Therefore a dedicated stop channel is used to resolve this blocking.
+		done: make(chan struct{}),
+	}
+	go sw.receive()
+	return sw
+}
+
+// ResultChan implements Interface.
+func (sw *StreamWatcher) ResultChan() <-chan Event {
+	return sw.result
+}
+
+// Stop implements Interface.
+func (sw *StreamWatcher) Stop() {
+	// Call Close() exactly once by locking and setting a flag.
+	sw.Lock()
+	defer sw.Unlock()
+	// closing a closed channel always panics, therefore check before closing
+	select {
+	case <-sw.done:
+	default:
+		close(sw.done)
+		sw.source.Close()
+	}
+}
+
+// receive reads result from the decoder in a loop and sends down the result channel.
+func (sw *StreamWatcher) receive() {
+	defer utilruntime.HandleCrashWithLogger(sw.logger)
+	defer close(sw.result)
+	defer sw.Stop()
+	for {
+		action, obj, err := sw.source.Decode()
+		if err != nil {
+			switch err {
+			case io.EOF:
+				// watch closed normally
+			case io.ErrUnexpectedEOF:
+				sw.logger.V(1).Info("Unexpected EOF during watch stream event decoding", "err", err)
+			default:
+				if net.IsProbableEOF(err) || net.IsTimeout(err) {
+					sw.logger.V(5).Info("Unable to decode an event from the watch stream", "err", err)
+				} else {
+					select {
+					case <-sw.done:
+					case sw.result <- Event{
+						Type:   Error,
+						Object: sw.reporter.AsObject(fmt.Errorf("unable to decode an event from the watch stream: %v", err)),
+					}:
+					}
+				}
+			}
+			return
+		}
+		select {
+		case <-sw.done:
+			return
+		case sw.result <- Event{
+			Type:   action,
+			Object: obj,
+		}:
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/streamwatcher_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/streamwatcher_test.go
new file mode 100644
index 0000000000..e6f68f6679
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/streamwatcher_test.go
@@ -0,0 +1,124 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch_test
+
+import (
+	"fmt"
+	"io"
+	"reflect"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	. "k8s.io/apimachinery/pkg/watch"
+)
+
+type fakeDecoder struct {
+	items chan Event
+	err   error
+}
+
+func (f fakeDecoder) Decode() (action EventType, object runtime.Object, err error) {
+	if f.err != nil {
+		return "", nil, f.err
+	}
+	item, open := <-f.items
+	if !open {
+		return action, nil, io.EOF
+	}
+	return item.Type, item.Object, nil
+}
+
+func (f fakeDecoder) Close() {
+	if f.items != nil {
+		close(f.items)
+	}
+}
+
+type fakeReporter struct {
+	err error
+}
+
+func (f *fakeReporter) AsObject(err error) runtime.Object {
+	f.err = err
+	return runtime.Unstructured(nil)
+}
+
+func TestStreamWatcher(t *testing.T) {
+	table := []Event{
+		{Type: Added, Object: testType("foo")},
+	}
+
+	fd := fakeDecoder{items: make(chan Event, 5)}
+	//nolint:logcheck // Intentionally uses the old API.
+	sw := NewStreamWatcher(fd, nil)
+
+	for _, item := range table {
+		fd.items <- item
+		got, open := <-sw.ResultChan()
+		if !open {
+			t.Errorf("unexpected early close")
+		}
+		if e, a := item, got; !reflect.DeepEqual(e, a) {
+			t.Errorf("expected %v, got %v", e, a)
+		}
+	}
+
+	sw.Stop()
+	_, open := <-sw.ResultChan()
+	if open {
+		t.Errorf("Unexpected failure to close")
+	}
+}
+
+func TestStreamWatcherError(t *testing.T) {
+	fd := fakeDecoder{err: fmt.Errorf("test error")}
+	fr := &fakeReporter{}
+	//nolint:logcheck // Intentionally uses the old API.
+	sw := NewStreamWatcher(fd, fr)
+	evt, ok := <-sw.ResultChan()
+	if !ok {
+		t.Fatalf("unexpected close")
+	}
+	if evt.Type != Error || evt.Object != runtime.Unstructured(nil) {
+		t.Fatalf("unexpected object: %#v", evt)
+	}
+	_, ok = <-sw.ResultChan()
+	if ok {
+		t.Fatalf("unexpected open channel")
+	}
+
+	sw.Stop()
+	_, ok = <-sw.ResultChan()
+	if ok {
+		t.Fatalf("unexpected open channel")
+	}
+}
+
+func TestStreamWatcherRace(t *testing.T) {
+	fd := fakeDecoder{err: fmt.Errorf("test error")}
+	fr := &fakeReporter{}
+	//nolint:logcheck // Intentionally uses the old API.
+	sw := NewStreamWatcher(fd, fr)
+	time.Sleep(10 * time.Millisecond)
+	sw.Stop()
+	time.Sleep(10 * time.Millisecond)
+	_, ok := <-sw.ResultChan()
+	if ok {
+		t.Fatalf("unexpected pending send")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/watch.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/watch.go
new file mode 100644
index 0000000000..251459834b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/watch.go
@@ -0,0 +1,377 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch
+
+import (
+	"fmt"
+	"sync"
+
+	"k8s.io/klog/v2"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/utils/ptr"
+)
+
+// Interface can be implemented by anything that knows how to watch and report changes.
+type Interface interface {
+	// Stop tells the producer that the consumer is done watching, so the
+	// producer should stop sending events and close the result channel. The
+	// consumer should keep watching for events until the result channel is
+	// closed.
+	//
+	// Because some implementations may create channels when constructed, Stop
+	// must always be called, even if the consumer has not yet called
+	// ResultChan().
+	//
+	// Only the consumer should call Stop(), not the producer. If the producer
+	// errors and needs to stop the watch prematurely, it should instead send
+	// an error event and close the result channel.
+	Stop()
+
+	// ResultChan returns a channel which will receive events from the event
+	// producer. If an error occurs or Stop() is called, the producer must
+	// close this channel and release any resources used by the watch.
+	// Closing the result channel tells the consumer that no more events will be
+	// sent.
+	ResultChan() <-chan Event
+}
+
+// EventType defines the possible types of events.
+type EventType string
+
+const (
+	Added    EventType = "ADDED"
+	Modified EventType = "MODIFIED"
+	Deleted  EventType = "DELETED"
+	Bookmark EventType = "BOOKMARK"
+	Error    EventType = "ERROR"
+)
+
+var (
+	DefaultChanSize int32 = 100
+)
+
+// Event represents a single event to a watched resource.
+// +k8s:deepcopy-gen=true
+type Event struct {
+	Type EventType
+
+	// Object is:
+	//  * If Type is Added or Modified: the new state of the object.
+	//  * If Type is Deleted: the state of the object immediately before deletion.
+	//  * If Type is Bookmark: the object (instance of a type being watched) where
+	//    only ResourceVersion field is set. On successful restart of watch from a
+	//    bookmark resourceVersion, client is guaranteed to not get repeat event
+	//    nor miss any events.
+	//  * If Type is Error: *api.Status is recommended; other types may make sense
+	//    depending on context.
+	Object runtime.Object
+}
+
+type emptyWatch chan Event
+
+// NewEmptyWatch returns a watch interface that returns no results and is closed.
+// May be used in certain error conditions where no information is available but
+// an error is not warranted.
+func NewEmptyWatch() Interface {
+	ch := make(chan Event)
+	close(ch)
+	return emptyWatch(ch)
+}
+
+// Stop implements Interface
+func (w emptyWatch) Stop() {
+}
+
+// ResultChan implements Interface
+func (w emptyWatch) ResultChan() <-chan Event {
+	return chan Event(w)
+}
+
+// FakeWatcher lets you test anything that consumes a watch.Interface; threadsafe.
+type FakeWatcher struct {
+	logger  klog.Logger
+	result  chan Event
+	stopped bool
+	sync.Mutex
+}
+
+var _ Interface = &FakeWatcher{}
+
+// Contextual logging: NewFakeWithOptions and a logger in the FakeOptions should be used instead in code which supports contextual logging.
+func NewFake() *FakeWatcher {
+	return NewFakeWithOptions(FakeOptions{})
+}
+
+// Contextual logging: NewFakeWithOptions and a logger in the FakeOptions should be used instead in code which supports contextual logging.
+func NewFakeWithChanSize(size int, blocking bool) *FakeWatcher {
+	return NewFakeWithOptions(FakeOptions{ChannelSize: size})
+}
+
+func NewFakeWithOptions(options FakeOptions) *FakeWatcher {
+	return &FakeWatcher{
+		logger: ptr.Deref(options.Logger, klog.Background()),
+		result: make(chan Event, options.ChannelSize),
+	}
+}
+
+type FakeOptions struct {
+	Logger      *klog.Logger
+	ChannelSize int
+}
+
+// Stop implements Interface.Stop().
+func (f *FakeWatcher) Stop() {
+	f.Lock()
+	defer f.Unlock()
+	if !f.stopped {
+		f.logger.V(4).Info("Stopping fake watcher")
+		close(f.result)
+		f.stopped = true
+	}
+}
+
+func (f *FakeWatcher) IsStopped() bool {
+	f.Lock()
+	defer f.Unlock()
+	return f.stopped
+}
+
+// Reset prepares the watcher to be reused.
+func (f *FakeWatcher) Reset() {
+	f.Lock()
+	defer f.Unlock()
+	f.stopped = false
+	f.result = make(chan Event)
+}
+
+func (f *FakeWatcher) ResultChan() <-chan Event {
+	return f.result
+}
+
+// Add sends an add event.
+func (f *FakeWatcher) Add(obj runtime.Object) {
+	f.result <- Event{Added, obj}
+}
+
+// Modify sends a modify event.
+func (f *FakeWatcher) Modify(obj runtime.Object) {
+	f.result <- Event{Modified, obj}
+}
+
+// Delete sends a delete event.
+func (f *FakeWatcher) Delete(lastValue runtime.Object) {
+	f.result <- Event{Deleted, lastValue}
+}
+
+// Error sends an Error event.
+func (f *FakeWatcher) Error(errValue runtime.Object) {
+	f.result <- Event{Error, errValue}
+}
+
+// Action sends an event of the requested type, for table-based testing.
+func (f *FakeWatcher) Action(action EventType, obj runtime.Object) {
+	f.result <- Event{action, obj}
+}
+
+// RaceFreeFakeWatcher lets you test anything that consumes a watch.Interface; threadsafe.
+type RaceFreeFakeWatcher struct {
+	logger  klog.Logger
+	result  chan Event
+	Stopped bool
+	sync.Mutex
+}
+
+var _ Interface = &RaceFreeFakeWatcher{}
+
+// Contextual logging: RaceFreeFakeWatcherWithLogger should be used instead of NewRaceFreeFake in code which supports contextual logging.
+func NewRaceFreeFake() *RaceFreeFakeWatcher {
+	return NewRaceFreeFakeWithLogger(klog.Background())
+}
+
+func NewRaceFreeFakeWithLogger(logger klog.Logger) *RaceFreeFakeWatcher {
+	return &RaceFreeFakeWatcher{
+		logger: logger,
+		result: make(chan Event, DefaultChanSize),
+	}
+}
+
+// Stop implements Interface.Stop().
+func (f *RaceFreeFakeWatcher) Stop() {
+	f.Lock()
+	defer f.Unlock()
+	if !f.Stopped {
+		f.logger.V(4).Info("Stopping fake watcher")
+		close(f.result)
+		f.Stopped = true
+	}
+}
+
+func (f *RaceFreeFakeWatcher) IsStopped() bool {
+	f.Lock()
+	defer f.Unlock()
+	return f.Stopped
+}
+
+// Reset prepares the watcher to be reused.
+func (f *RaceFreeFakeWatcher) Reset() {
+	f.Lock()
+	defer f.Unlock()
+	f.Stopped = false
+	f.result = make(chan Event, DefaultChanSize)
+}
+
+func (f *RaceFreeFakeWatcher) ResultChan() <-chan Event {
+	f.Lock()
+	defer f.Unlock()
+	return f.result
+}
+
+// Add sends an add event.
+func (f *RaceFreeFakeWatcher) Add(obj runtime.Object) {
+	f.Lock()
+	defer f.Unlock()
+	if !f.Stopped {
+		select {
+		case f.result <- Event{Added, obj}:
+			return
+		default:
+			panic(fmt.Errorf("channel full"))
+		}
+	}
+}
+
+// Modify sends a modify event.
+func (f *RaceFreeFakeWatcher) Modify(obj runtime.Object) {
+	f.Lock()
+	defer f.Unlock()
+	if !f.Stopped {
+		select {
+		case f.result <- Event{Modified, obj}:
+			return
+		default:
+			panic(fmt.Errorf("channel full"))
+		}
+	}
+}
+
+// Delete sends a delete event.
+func (f *RaceFreeFakeWatcher) Delete(lastValue runtime.Object) {
+	f.Lock()
+	defer f.Unlock()
+	if !f.Stopped {
+		select {
+		case f.result <- Event{Deleted, lastValue}:
+			return
+		default:
+			panic(fmt.Errorf("channel full"))
+		}
+	}
+}
+
+// Error sends an Error event.
+func (f *RaceFreeFakeWatcher) Error(errValue runtime.Object) {
+	f.Lock()
+	defer f.Unlock()
+	if !f.Stopped {
+		select {
+		case f.result <- Event{Error, errValue}:
+			return
+		default:
+			panic(fmt.Errorf("channel full"))
+		}
+	}
+}
+
+// Action sends an event of the requested type, for table-based testing.
+func (f *RaceFreeFakeWatcher) Action(action EventType, obj runtime.Object) {
+	f.Lock()
+	defer f.Unlock()
+	if !f.Stopped {
+		select {
+		case f.result <- Event{action, obj}:
+			return
+		default:
+			panic(fmt.Errorf("channel full"))
+		}
+	}
+}
+
+// ProxyWatcher lets you wrap your channel in watch Interface. threadsafe.
+type ProxyWatcher struct {
+	result chan Event
+	stopCh chan struct{}
+
+	mutex   sync.Mutex
+	stopped bool
+}
+
+var _ Interface = &ProxyWatcher{}
+
+// NewProxyWatcher creates new ProxyWatcher by wrapping a channel
+func NewProxyWatcher(ch chan Event) *ProxyWatcher {
+	return &ProxyWatcher{
+		result:  ch,
+		stopCh:  make(chan struct{}),
+		stopped: false,
+	}
+}
+
+// Stop implements Interface
+func (pw *ProxyWatcher) Stop() {
+	pw.mutex.Lock()
+	defer pw.mutex.Unlock()
+	if !pw.stopped {
+		pw.stopped = true
+		close(pw.stopCh)
+	}
+}
+
+// Stopping returns true if Stop() has been called
+func (pw *ProxyWatcher) Stopping() bool {
+	pw.mutex.Lock()
+	defer pw.mutex.Unlock()
+	return pw.stopped
+}
+
+// ResultChan implements Interface
+func (pw *ProxyWatcher) ResultChan() <-chan Event {
+	return pw.result
+}
+
+// StopChan returns stop channel
+func (pw *ProxyWatcher) StopChan() <-chan struct{} {
+	return pw.stopCh
+}
+
+// MockWatcher implements watch.Interface with mockable functions.
+type MockWatcher struct {
+	StopFunc       func()
+	ResultChanFunc func() <-chan Event
+}
+
+var _ Interface = &MockWatcher{}
+
+// Stop calls StopFunc
+func (mw MockWatcher) Stop() {
+	mw.StopFunc()
+}
+
+// ResultChan calls ResultChanFunc
+func (mw MockWatcher) ResultChan() <-chan Event {
+	return mw.ResultChanFunc()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/watch_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/watch_test.go
new file mode 100644
index 0000000000..4fb159b0dd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/watch_test.go
@@ -0,0 +1,175 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch_test
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	. "k8s.io/apimachinery/pkg/watch"
+)
+
+type testType string
+
+func (obj testType) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+func (obj testType) DeepCopyObject() runtime.Object   { return obj }
+
+func TestFake(t *testing.T) {
+	f := NewFake()
+
+	table := []struct {
+		t EventType
+		s testType
+	}{
+		{Added, testType("foo")},
+		{Modified, testType("qux")},
+		{Modified, testType("bar")},
+		{Deleted, testType("bar")},
+		{Error, testType("error: blah")},
+	}
+
+	// Prove that f implements Interface by phrasing this as a function.
+	consumer := func(w Interface) {
+		for _, expect := range table {
+			got, ok := <-w.ResultChan()
+			if !ok {
+				t.Fatalf("closed early")
+			}
+			if e, a := expect.t, got.Type; e != a {
+				t.Fatalf("Expected %v, got %v", e, a)
+			}
+			if a, ok := got.Object.(testType); !ok || a != expect.s {
+				t.Fatalf("Expected %v, got %v", expect.s, a)
+			}
+		}
+		_, stillOpen := <-w.ResultChan()
+		if stillOpen {
+			t.Fatal("Never stopped")
+		}
+	}
+
+	sender := func() {
+		f.Add(testType("foo"))
+		f.Action(Modified, testType("qux"))
+		f.Modify(testType("bar"))
+		f.Delete(testType("bar"))
+		f.Error(testType("error: blah"))
+		f.Stop()
+	}
+
+	go sender()
+	consumer(f)
+}
+
+func TestRaceFreeFake(t *testing.T) {
+	f := NewRaceFreeFake()
+
+	table := []struct {
+		t EventType
+		s testType
+	}{
+		{Added, testType("foo")},
+		{Modified, testType("qux")},
+		{Modified, testType("bar")},
+		{Deleted, testType("bar")},
+		{Error, testType("error: blah")},
+	}
+
+	// Prove that f implements Interface by phrasing this as a function.
+	consumer := func(w Interface) {
+		for _, expect := range table {
+			got, ok := <-w.ResultChan()
+			if !ok {
+				t.Fatalf("closed early")
+			}
+			if e, a := expect.t, got.Type; e != a {
+				t.Fatalf("Expected %v, got %v", e, a)
+			}
+			if a, ok := got.Object.(testType); !ok || a != expect.s {
+				t.Fatalf("Expected %v, got %v", expect.s, a)
+			}
+		}
+		_, stillOpen := <-w.ResultChan()
+		if stillOpen {
+			t.Fatal("Never stopped")
+		}
+	}
+
+	sender := func() {
+		f.Add(testType("foo"))
+		f.Action(Modified, testType("qux"))
+		f.Modify(testType("bar"))
+		f.Delete(testType("bar"))
+		f.Error(testType("error: blah"))
+		f.Stop()
+	}
+
+	go sender()
+	consumer(f)
+}
+
+func TestEmpty(t *testing.T) {
+	w := NewEmptyWatch()
+	_, ok := <-w.ResultChan()
+	if ok {
+		t.Errorf("unexpected result channel result")
+	}
+	w.Stop()
+	_, ok = <-w.ResultChan()
+	if ok {
+		t.Errorf("unexpected result channel result")
+	}
+}
+
+func TestProxyWatcher(t *testing.T) {
+	events := []Event{
+		{Added, testType("foo")},
+		{Modified, testType("qux")},
+		{Modified, testType("bar")},
+		{Deleted, testType("bar")},
+		{Error, testType("error: blah")},
+	}
+
+	ch := make(chan Event, len(events))
+	w := NewProxyWatcher(ch)
+
+	for _, e := range events {
+		ch <- e
+	}
+
+	for _, e := range events {
+		g := <-w.ResultChan()
+		if !reflect.DeepEqual(e, g) {
+			t.Errorf("Expected %#v, got %#v", e, g)
+			continue
+		}
+	}
+
+	w.Stop()
+
+	select {
+	// Closed channel always reads immediately
+	case <-w.StopChan():
+	default:
+		t.Error("Channel isn't closed")
+	}
+
+	// Test double close
+	w.Stop()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..dd27d4526f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/pkg/watch/zz_generated.deepcopy.go
@@ -0,0 +1,41 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package watch
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Event) DeepCopyInto(out *Event) {
+	*out = *in
+	if in.Object != nil {
+		out.Object = in.Object.DeepCopyObject()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Event.
+func (in *Event) DeepCopy() *Event {
+	if in == nil {
+		return nil
+	}
+	out := new(Event)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/LICENSE b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/LICENSE
new file mode 100644
index 0000000000..6a66aea5ea
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/LICENSE
@@ -0,0 +1,27 @@
+Copyright (c) 2009 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/PATENTS b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/PATENTS
new file mode 100644
index 0000000000..733099041f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/PATENTS
@@ -0,0 +1,22 @@
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/json/OWNERS b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/json/OWNERS
new file mode 100644
index 0000000000..349bc69d65
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/json/OWNERS
@@ -0,0 +1,6 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+  - pwittrock
+reviewers:
+  - apelisse
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/json/fields.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/json/fields.go
new file mode 100644
index 0000000000..5b8514b3fa
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/json/fields.go
@@ -0,0 +1,513 @@
+// Copyright 2013 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package json is forked from the Go standard library to enable us to find the
+// field of a struct that a given JSON key maps to.
+package json
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"sort"
+	"strings"
+	"sync"
+	"unicode"
+	"unicode/utf8"
+)
+
+const (
+	patchStrategyTagKey = "patchStrategy"
+	patchMergeKeyTagKey = "patchMergeKey"
+)
+
+// Finds the patchStrategy and patchMergeKey struct tag fields on a given
+// struct field given the struct type and the JSON name of the field.
+// It returns field type, a slice of patch strategies, merge key and error.
+// TODO: fix the returned errors to be introspectable.
+func LookupPatchMetadataForStruct(t reflect.Type, jsonField string) (
+	elemType reflect.Type, patchStrategies []string, patchMergeKey string, e error) {
+	if t.Kind() == reflect.Pointer {
+		t = t.Elem()
+	}
+
+	if t.Kind() != reflect.Struct {
+		e = fmt.Errorf("merging an object in json but data type is not struct, instead is: %s",
+			t.Kind().String())
+		return
+	}
+	jf := []byte(jsonField)
+	// Find the field that the JSON library would use.
+	var f *field
+	fields := cachedTypeFields(t)
+	for i := range fields {
+		ff := &fields[i]
+		if bytes.Equal(ff.nameBytes, jf) {
+			f = ff
+			break
+		}
+		// Do case-insensitive comparison.
+		if f == nil && ff.equalFold(ff.nameBytes, jf) {
+			f = ff
+		}
+	}
+	if f != nil {
+		// Find the reflect.Value of the most preferential struct field.
+		tjf := t.Field(f.index[0])
+		// we must navigate down all the anonymously included structs in the chain
+		for i := 1; i < len(f.index); i++ {
+			tjf = tjf.Type.Field(f.index[i])
+		}
+		patchStrategy := tjf.Tag.Get(patchStrategyTagKey)
+		patchMergeKey = tjf.Tag.Get(patchMergeKeyTagKey)
+		patchStrategies = strings.Split(patchStrategy, ",")
+		elemType = tjf.Type
+		return
+	}
+	e = fmt.Errorf("unable to find api field in struct %s for the json field %q", t.Name(), jsonField)
+	return
+}
+
+// A field represents a single field found in a struct.
+type field struct {
+	name      string
+	nameBytes []byte                 // []byte(name)
+	equalFold func(s, t []byte) bool // bytes.EqualFold or equivalent
+
+	tag bool
+	// index is the sequence of indexes from the containing type fields to this field.
+	// it is a slice because anonymous structs will need multiple navigation steps to correctly
+	// resolve the proper fields
+	index     []int
+	typ       reflect.Type
+	omitEmpty bool
+	quoted    bool
+}
+
+func (f field) String() string {
+	return fmt.Sprintf("{name: %s, type: %v, tag: %v, index: %v, omitEmpty: %v, quoted: %v}", f.name, f.typ, f.tag, f.index, f.omitEmpty, f.quoted)
+}
+
+func fillField(f field) field {
+	f.nameBytes = []byte(f.name)
+	f.equalFold = foldFunc(f.nameBytes)
+	return f
+}
+
+// byName sorts field by name, breaking ties with depth,
+// then breaking ties with "name came from json tag", then
+// breaking ties with index sequence.
+type byName []field
+
+func (x byName) Len() int { return len(x) }
+
+func (x byName) Swap(i, j int) { x[i], x[j] = x[j], x[i] }
+
+func (x byName) Less(i, j int) bool {
+	if x[i].name != x[j].name {
+		return x[i].name < x[j].name
+	}
+	if len(x[i].index) != len(x[j].index) {
+		return len(x[i].index) < len(x[j].index)
+	}
+	if x[i].tag != x[j].tag {
+		return x[i].tag
+	}
+	return byIndex(x).Less(i, j)
+}
+
+// byIndex sorts field by index sequence.
+type byIndex []field
+
+func (x byIndex) Len() int { return len(x) }
+
+func (x byIndex) Swap(i, j int) { x[i], x[j] = x[j], x[i] }
+
+func (x byIndex) Less(i, j int) bool {
+	for k, xik := range x[i].index {
+		if k >= len(x[j].index) {
+			return false
+		}
+		if xik != x[j].index[k] {
+			return xik < x[j].index[k]
+		}
+	}
+	return len(x[i].index) < len(x[j].index)
+}
+
+// typeFields returns a list of fields that JSON should recognize for the given type.
+// The algorithm is breadth-first search over the set of structs to include - the top struct
+// and then any reachable anonymous structs.
+func typeFields(t reflect.Type) []field {
+	// Anonymous fields to explore at the current level and the next.
+	current := []field{}
+	next := []field{{typ: t}}
+
+	// Count of queued names for current level and the next.
+	count := map[reflect.Type]int{}
+	nextCount := map[reflect.Type]int{}
+
+	// Types already visited at an earlier level.
+	visited := map[reflect.Type]bool{}
+
+	// Fields found.
+	var fields []field
+
+	for len(next) > 0 {
+		current, next = next, current[:0]
+		count, nextCount = nextCount, map[reflect.Type]int{}
+
+		for _, f := range current {
+			if visited[f.typ] {
+				continue
+			}
+			visited[f.typ] = true
+
+			// Scan f.typ for fields to include.
+			for i := 0; i < f.typ.NumField(); i++ {
+				sf := f.typ.Field(i)
+				if sf.PkgPath != "" { // unexported
+					continue
+				}
+				tag := sf.Tag.Get("json")
+				if tag == "-" {
+					continue
+				}
+				name, opts := parseTag(tag)
+				if !isValidTag(name) {
+					name = ""
+				}
+				index := make([]int, len(f.index)+1)
+				copy(index, f.index)
+				index[len(f.index)] = i
+
+				ft := sf.Type
+				if ft.Name() == "" && ft.Kind() == reflect.Pointer {
+					// Follow pointer.
+					ft = ft.Elem()
+				}
+
+				// Record found field and index sequence.
+				if name != "" || !sf.Anonymous || ft.Kind() != reflect.Struct {
+					tagged := name != ""
+					if name == "" {
+						name = sf.Name
+					}
+					fields = append(fields, fillField(field{
+						name:      name,
+						tag:       tagged,
+						index:     index,
+						typ:       ft,
+						omitEmpty: opts.Contains("omitempty"),
+						quoted:    opts.Contains("string"),
+					}))
+					if count[f.typ] > 1 {
+						// If there were multiple instances, add a second,
+						// so that the annihilation code will see a duplicate.
+						// It only cares about the distinction between 1 or 2,
+						// so don't bother generating any more copies.
+						fields = append(fields, fields[len(fields)-1])
+					}
+					continue
+				}
+
+				// Record new anonymous struct to explore in next round.
+				nextCount[ft]++
+				if nextCount[ft] == 1 {
+					next = append(next, fillField(field{name: ft.Name(), index: index, typ: ft}))
+				}
+			}
+		}
+	}
+
+	sort.Sort(byName(fields))
+
+	// Delete all fields that are hidden by the Go rules for embedded fields,
+	// except that fields with JSON tags are promoted.
+
+	// The fields are sorted in primary order of name, secondary order
+	// of field index length. Loop over names; for each name, delete
+	// hidden fields by choosing the one dominant field that survives.
+	out := fields[:0]
+	for advance, i := 0, 0; i < len(fields); i += advance {
+		// One iteration per name.
+		// Find the sequence of fields with the name of this first field.
+		fi := fields[i]
+		name := fi.name
+		for advance = 1; i+advance < len(fields); advance++ {
+			fj := fields[i+advance]
+			if fj.name != name {
+				break
+			}
+		}
+		if advance == 1 { // Only one field with this name
+			out = append(out, fi)
+			continue
+		}
+		dominant, ok := dominantField(fields[i : i+advance])
+		if ok {
+			out = append(out, dominant)
+		}
+	}
+
+	fields = out
+	sort.Sort(byIndex(fields))
+
+	return fields
+}
+
+// dominantField looks through the fields, all of which are known to
+// have the same name, to find the single field that dominates the
+// others using Go's embedding rules, modified by the presence of
+// JSON tags. If there are multiple top-level fields, the boolean
+// will be false: This condition is an error in Go and we skip all
+// the fields.
+func dominantField(fields []field) (field, bool) {
+	// The fields are sorted in increasing index-length order. The winner
+	// must therefore be one with the shortest index length. Drop all
+	// longer entries, which is easy: just truncate the slice.
+	length := len(fields[0].index)
+	tagged := -1 // Index of first tagged field.
+	for i, f := range fields {
+		if len(f.index) > length {
+			fields = fields[:i]
+			break
+		}
+		if f.tag {
+			if tagged >= 0 {
+				// Multiple tagged fields at the same level: conflict.
+				// Return no field.
+				return field{}, false
+			}
+			tagged = i
+		}
+	}
+	if tagged >= 0 {
+		return fields[tagged], true
+	}
+	// All remaining fields have the same length. If there's more than one,
+	// we have a conflict (two fields named "X" at the same level) and we
+	// return no field.
+	if len(fields) > 1 {
+		return field{}, false
+	}
+	return fields[0], true
+}
+
+var fieldCache struct {
+	sync.RWMutex
+	m map[reflect.Type][]field
+}
+
+// cachedTypeFields is like typeFields but uses a cache to avoid repeated work.
+func cachedTypeFields(t reflect.Type) []field {
+	fieldCache.RLock()
+	f := fieldCache.m[t]
+	fieldCache.RUnlock()
+	if f != nil {
+		return f
+	}
+
+	// Compute fields without lock.
+	// Might duplicate effort but won't hold other computations back.
+	f = typeFields(t)
+	if f == nil {
+		f = []field{}
+	}
+
+	fieldCache.Lock()
+	if fieldCache.m == nil {
+		fieldCache.m = map[reflect.Type][]field{}
+	}
+	fieldCache.m[t] = f
+	fieldCache.Unlock()
+	return f
+}
+
+func isValidTag(s string) bool {
+	if s == "" {
+		return false
+	}
+	for _, c := range s {
+		switch {
+		case strings.ContainsRune("!#$%&()*+-./:<=>?@[]^_{|}~ ", c):
+			// Backslash and quote chars are reserved, but
+			// otherwise any punctuation chars are allowed
+			// in a tag name.
+		default:
+			if !unicode.IsLetter(c) && !unicode.IsDigit(c) {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+const (
+	caseMask     = ^byte(0x20) // Mask to ignore case in ASCII.
+	kelvin       = '\u212a'
+	smallLongEss = '\u017f'
+)
+
+// foldFunc returns one of four different case folding equivalence
+// functions, from most general (and slow) to fastest:
+//
+// 1) bytes.EqualFold, if the key s contains any non-ASCII UTF-8
+// 2) equalFoldRight, if s contains special folding ASCII ('k', 'K', 's', 'S')
+// 3) asciiEqualFold, no special, but includes non-letters (including _)
+// 4) simpleLetterEqualFold, no specials, no non-letters.
+//
+// The letters S and K are special because they map to 3 runes, not just 2:
+//  * S maps to s and to U+017F 'ſ' Latin small letter long s
+//  * k maps to K and to U+212A 'K' Kelvin sign
+// See http://play.golang.org/p/tTxjOc0OGo
+//
+// The returned function is specialized for matching against s and
+// should only be given s. It's not curried for performance reasons.
+func foldFunc(s []byte) func(s, t []byte) bool {
+	nonLetter := false
+	special := false // special letter
+	for _, b := range s {
+		if b >= utf8.RuneSelf {
+			return bytes.EqualFold
+		}
+		upper := b & caseMask
+		if upper < 'A' || upper > 'Z' {
+			nonLetter = true
+		} else if upper == 'K' || upper == 'S' {
+			// See above for why these letters are special.
+			special = true
+		}
+	}
+	if special {
+		return equalFoldRight
+	}
+	if nonLetter {
+		return asciiEqualFold
+	}
+	return simpleLetterEqualFold
+}
+
+// equalFoldRight is a specialization of bytes.EqualFold when s is
+// known to be all ASCII (including punctuation), but contains an 's',
+// 'S', 'k', or 'K', requiring a Unicode fold on the bytes in t.
+// See comments on foldFunc.
+func equalFoldRight(s, t []byte) bool {
+	for _, sb := range s {
+		if len(t) == 0 {
+			return false
+		}
+		tb := t[0]
+		if tb < utf8.RuneSelf {
+			if sb != tb {
+				sbUpper := sb & caseMask
+				if 'A' <= sbUpper && sbUpper <= 'Z' {
+					if sbUpper != tb&caseMask {
+						return false
+					}
+				} else {
+					return false
+				}
+			}
+			t = t[1:]
+			continue
+		}
+		// sb is ASCII and t is not. t must be either kelvin
+		// sign or long s; sb must be s, S, k, or K.
+		tr, size := utf8.DecodeRune(t)
+		switch sb {
+		case 's', 'S':
+			if tr != smallLongEss {
+				return false
+			}
+		case 'k', 'K':
+			if tr != kelvin {
+				return false
+			}
+		default:
+			return false
+		}
+		t = t[size:]
+
+	}
+	if len(t) > 0 {
+		return false
+	}
+	return true
+}
+
+// asciiEqualFold is a specialization of bytes.EqualFold for use when
+// s is all ASCII (but may contain non-letters) and contains no
+// special-folding letters.
+// See comments on foldFunc.
+func asciiEqualFold(s, t []byte) bool {
+	if len(s) != len(t) {
+		return false
+	}
+	for i, sb := range s {
+		tb := t[i]
+		if sb == tb {
+			continue
+		}
+		if ('a' <= sb && sb <= 'z') || ('A' <= sb && sb <= 'Z') {
+			if sb&caseMask != tb&caseMask {
+				return false
+			}
+		} else {
+			return false
+		}
+	}
+	return true
+}
+
+// simpleLetterEqualFold is a specialization of bytes.EqualFold for
+// use when s is all ASCII letters (no underscores, etc) and also
+// doesn't contain 'k', 'K', 's', or 'S'.
+// See comments on foldFunc.
+func simpleLetterEqualFold(s, t []byte) bool {
+	if len(s) != len(t) {
+		return false
+	}
+	for i, b := range s {
+		if b&caseMask != t[i]&caseMask {
+			return false
+		}
+	}
+	return true
+}
+
+// tagOptions is the string following a comma in a struct field's "json"
+// tag, or the empty string. It does not include the leading comma.
+type tagOptions string
+
+// parseTag splits a struct field's json tag into its name and
+// comma-separated options.
+func parseTag(tag string) (string, tagOptions) {
+	if idx := strings.Index(tag, ","); idx != -1 {
+		return tag[:idx], tagOptions(tag[idx+1:])
+	}
+	return tag, tagOptions("")
+}
+
+// Contains reports whether a comma-separated list of options
+// contains a particular substr flag. substr must be surrounded by a
+// string boundary or commas.
+func (o tagOptions) Contains(optionName string) bool {
+	if len(o) == 0 {
+		return false
+	}
+	s := string(o)
+	for s != "" {
+		var next string
+		i := strings.Index(s, ",")
+		if i >= 0 {
+			s, next = s[:i], s[i+1:]
+		}
+		if s == optionName {
+			return true
+		}
+		s = next
+	}
+	return false
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/json/fields_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/json/fields_test.go
new file mode 100644
index 0000000000..33b78bc43c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/json/fields_test.go
@@ -0,0 +1,30 @@
+package json
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestLookupPtrToStruct(t *testing.T) {
+	type Elem struct {
+		Key   string
+		Value string
+	}
+	type Outer struct {
+		Inner []Elem `json:"inner" patchStrategy:"merge" patchMergeKey:"key"`
+	}
+	outer := &Outer{}
+	elemType, patchStrategies, patchMergeKey, err := LookupPatchMetadataForStruct(reflect.TypeOf(outer), "inner")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if elemType != reflect.TypeOf([]Elem{}) {
+		t.Errorf("elemType = %v, want: %v", elemType, reflect.TypeOf([]Elem{}))
+	}
+	if !reflect.DeepEqual(patchStrategies, []string{"merge"}) {
+		t.Errorf("patchStrategies = %v, want: %v", patchStrategies, []string{"merge"})
+	}
+	if patchMergeKey != "key" {
+		t.Errorf("patchMergeKey = %v, want: %v", patchMergeKey, "key")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/netutil/addr.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/netutil/addr.go
new file mode 100644
index 0000000000..bd26f427e3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/netutil/addr.go
@@ -0,0 +1,28 @@
+package netutil
+
+import (
+	"net/url"
+	"strings"
+)
+
+// FROM: http://golang.org/src/net/http/client.go
+// Given a string of the form "host", "host:port", or "[ipv6::address]:port",
+// return true if the string includes a port.
+func hasPort(s string) bool { return strings.LastIndex(s, ":") > strings.LastIndex(s, "]") }
+
+// FROM: http://golang.org/src/net/http/transport.go
+var portMap = map[string]string{
+	"http":   "80",
+	"https":  "443",
+	"socks5": "1080",
+}
+
+// FROM: http://golang.org/src/net/http/transport.go
+// canonicalAddr returns url.Host but always with a ":port" suffix
+func CanonicalAddr(url *url.URL) string {
+	addr := url.Host
+	if !hasPort(addr) {
+		return addr + ":" + portMap[url.Scheme]
+	}
+	return addr
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/reflect/deep_equal.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/reflect/deep_equal.go
new file mode 100644
index 0000000000..bb0fa55f21
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/reflect/deep_equal.go
@@ -0,0 +1,434 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package reflect is a fork of go's standard library reflection package, which
+// allows for deep equal with equality functions defined.
+package reflect
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+)
+
+// Equalities is a map from type to a function comparing two values of
+// that type.
+type Equalities map[reflect.Type]reflect.Value
+
+// For convenience, panics on errors
+func EqualitiesOrDie(funcs ...interface{}) Equalities {
+	e := Equalities{}
+	if err := e.AddFuncs(funcs...); err != nil {
+		panic(err)
+	}
+	return e
+}
+
+// AddFuncs is a shortcut for multiple calls to AddFunc.
+func (e Equalities) AddFuncs(funcs ...interface{}) error {
+	for _, f := range funcs {
+		if err := e.AddFunc(f); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// AddFunc uses func as an equality function: it must take
+// two parameters of the same type, and return a boolean.
+func (e Equalities) AddFunc(eqFunc interface{}) error {
+	fv := reflect.ValueOf(eqFunc)
+	ft := fv.Type()
+	if ft.Kind() != reflect.Func {
+		return fmt.Errorf("expected func, got: %v", ft)
+	}
+	if ft.NumIn() != 2 {
+		return fmt.Errorf("expected two 'in' params, got: %v", ft)
+	}
+	if ft.NumOut() != 1 {
+		return fmt.Errorf("expected one 'out' param, got: %v", ft)
+	}
+	if ft.In(0) != ft.In(1) {
+		return fmt.Errorf("expected arg 1 and 2 to have same type, but got %v", ft)
+	}
+	var forReturnType bool
+	boolType := reflect.TypeOf(forReturnType)
+	if ft.Out(0) != boolType {
+		return fmt.Errorf("expected bool return, got: %v", ft)
+	}
+	e[ft.In(0)] = fv
+	return nil
+}
+
+// Below here is forked from go's reflect/deepequal.go
+
+// During deepValueEqual, must keep track of checks that are
+// in progress.  The comparison algorithm assumes that all
+// checks in progress are true when it reencounters them.
+// Visited comparisons are stored in a map indexed by visit.
+type visit struct {
+	a1  uintptr
+	a2  uintptr
+	typ reflect.Type
+}
+
+// unexportedTypePanic is thrown when you use this DeepEqual on something that has an
+// unexported type. It indicates a programmer error, so should not occur at runtime,
+// which is why it's not public and thus impossible to catch.
+type unexportedTypePanic []reflect.Type
+
+func (u unexportedTypePanic) Error() string { return u.String() }
+func (u unexportedTypePanic) String() string {
+	strs := make([]string, len(u))
+	for i, t := range u {
+		strs[i] = fmt.Sprintf("%v", t)
+	}
+	return "an unexported field was encountered, nested like this: " + strings.Join(strs, " -> ")
+}
+
+func makeUsefulPanic(v reflect.Value) {
+	if x := recover(); x != nil {
+		if u, ok := x.(unexportedTypePanic); ok {
+			u = append(unexportedTypePanic{v.Type()}, u...)
+			x = u
+		}
+		panic(x)
+	}
+}
+
+// Tests for deep equality using reflected types. The map argument tracks
+// comparisons that have already been seen, which allows short circuiting on
+// recursive types.
+// equateNilAndEmpty controls whether empty maps/slices are equivalent to nil
+func (e Equalities) deepValueEqual(v1, v2 reflect.Value, visited map[visit]bool, equateNilAndEmpty bool, depth int) bool {
+	defer makeUsefulPanic(v1)
+
+	if !v1.IsValid() || !v2.IsValid() {
+		return v1.IsValid() == v2.IsValid()
+	}
+	if v1.Type() != v2.Type() {
+		return false
+	}
+	if fv, ok := e[v1.Type()]; ok {
+		return fv.Call([]reflect.Value{v1, v2})[0].Bool()
+	}
+
+	hard := func(k reflect.Kind) bool {
+		switch k {
+		case reflect.Array, reflect.Map, reflect.Slice, reflect.Struct:
+			return true
+		}
+		return false
+	}
+
+	if v1.CanAddr() && v2.CanAddr() && hard(v1.Kind()) {
+		addr1 := v1.UnsafeAddr()
+		addr2 := v2.UnsafeAddr()
+		if addr1 > addr2 {
+			// Canonicalize order to reduce number of entries in visited.
+			addr1, addr2 = addr2, addr1
+		}
+
+		// Short circuit if references are identical ...
+		if addr1 == addr2 {
+			return true
+		}
+
+		// ... or already seen
+		typ := v1.Type()
+		v := visit{addr1, addr2, typ}
+		if visited[v] {
+			return true
+		}
+
+		// Remember for later.
+		visited[v] = true
+	}
+
+	switch v1.Kind() {
+	case reflect.Array:
+		// We don't need to check length here because length is part of
+		// an array's type, which has already been filtered for.
+		for i := 0; i < v1.Len(); i++ {
+			if !e.deepValueEqual(v1.Index(i), v2.Index(i), visited, equateNilAndEmpty, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.Slice:
+		if equateNilAndEmpty {
+			if (v1.IsNil() || v1.Len() == 0) != (v2.IsNil() || v2.Len() == 0) {
+				return false
+			}
+
+			if v1.IsNil() || v1.Len() == 0 {
+				return true
+			}
+		} else {
+			if v1.IsNil() != v2.IsNil() {
+				return false
+			}
+
+			// Optimize nil and empty cases
+			// Two lists that are BOTH nil are equal
+			// No need to check v2 is nil since v1.IsNil == v2.IsNil from above
+			if v1.IsNil() {
+				return true
+			}
+
+			// Two lists that are both empty and both non nil are equal
+			if v1.Len() == 0 && v2.Len() == 0 {
+				return true
+			}
+		}
+		if v1.Len() != v2.Len() {
+			return false
+		}
+		if v1.Pointer() == v2.Pointer() {
+			return true
+		}
+		for i := 0; i < v1.Len(); i++ {
+			if !e.deepValueEqual(v1.Index(i), v2.Index(i), visited, equateNilAndEmpty, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.Interface:
+		if v1.IsNil() || v2.IsNil() {
+			return v1.IsNil() == v2.IsNil()
+		}
+		return e.deepValueEqual(v1.Elem(), v2.Elem(), visited, equateNilAndEmpty, depth+1)
+	case reflect.Ptr:
+		return e.deepValueEqual(v1.Elem(), v2.Elem(), visited, equateNilAndEmpty, depth+1)
+	case reflect.Struct:
+		for i, n := 0, v1.NumField(); i < n; i++ {
+			if !e.deepValueEqual(v1.Field(i), v2.Field(i), visited, equateNilAndEmpty, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.Map:
+		if equateNilAndEmpty {
+			if (v1.IsNil() || v1.Len() == 0) != (v2.IsNil() || v2.Len() == 0) {
+				return false
+			}
+			if v1.IsNil() || v1.Len() == 0 {
+				return true
+			}
+		} else {
+			if v1.IsNil() != v2.IsNil() {
+				return false
+			}
+
+			// Optimize nil and empty cases
+			// Two maps that are BOTH nil are equal
+			// No need to check v2 is nil since v1.IsNil == v2.IsNil from above
+			if v1.IsNil() {
+				return true
+			}
+
+			// Two maps that are both empty and both non nil are equal
+			if v1.Len() == 0 && v2.Len() == 0 {
+				return true
+			}
+		}
+		if v1.Len() != v2.Len() {
+			return false
+		}
+		if v1.Pointer() == v2.Pointer() {
+			return true
+		}
+		for _, k := range v1.MapKeys() {
+			if !e.deepValueEqual(v1.MapIndex(k), v2.MapIndex(k), visited, equateNilAndEmpty, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.Func:
+		if v1.IsNil() && v2.IsNil() {
+			return true
+		}
+		// Can't do better than this:
+		return false
+	default:
+		// Normal equality suffices
+		if !v1.CanInterface() || !v2.CanInterface() {
+			panic(unexportedTypePanic{})
+		}
+		return v1.Interface() == v2.Interface()
+	}
+}
+
+// DeepEqual is like reflect.DeepEqual, but focused on semantic equality
+// instead of memory equality.
+//
+// It will use e's equality functions if it finds types that match.
+//
+// An empty slice *is* equal to a nil slice for our purposes; same for maps.
+//
+// Unexported field members cannot be compared and will cause an informative panic; you must add an Equality
+// function for these types.
+func (e Equalities) DeepEqual(a1, a2 interface{}) bool {
+	return e.deepEqual(a1, a2, true)
+}
+
+func (e Equalities) DeepEqualWithNilDifferentFromEmpty(a1, a2 interface{}) bool {
+	return e.deepEqual(a1, a2, false)
+}
+
+func (e Equalities) deepEqual(a1, a2 interface{}, equateNilAndEmpty bool) bool {
+	if a1 == nil || a2 == nil {
+		return a1 == a2
+	}
+	v1 := reflect.ValueOf(a1)
+	v2 := reflect.ValueOf(a2)
+	if v1.Type() != v2.Type() {
+		return false
+	}
+	return e.deepValueEqual(v1, v2, make(map[visit]bool), equateNilAndEmpty, 0)
+}
+
+func (e Equalities) deepValueDerive(v1, v2 reflect.Value, visited map[visit]bool, depth int) bool {
+	defer makeUsefulPanic(v1)
+
+	if !v1.IsValid() || !v2.IsValid() {
+		return v1.IsValid() == v2.IsValid()
+	}
+	if v1.Type() != v2.Type() {
+		return false
+	}
+	if fv, ok := e[v1.Type()]; ok {
+		return fv.Call([]reflect.Value{v1, v2})[0].Bool()
+	}
+
+	hard := func(k reflect.Kind) bool {
+		switch k {
+		case reflect.Array, reflect.Map, reflect.Slice, reflect.Struct:
+			return true
+		}
+		return false
+	}
+
+	if v1.CanAddr() && v2.CanAddr() && hard(v1.Kind()) {
+		addr1 := v1.UnsafeAddr()
+		addr2 := v2.UnsafeAddr()
+		if addr1 > addr2 {
+			// Canonicalize order to reduce number of entries in visited.
+			addr1, addr2 = addr2, addr1
+		}
+
+		// Short circuit if references are identical ...
+		if addr1 == addr2 {
+			return true
+		}
+
+		// ... or already seen
+		typ := v1.Type()
+		v := visit{addr1, addr2, typ}
+		if visited[v] {
+			return true
+		}
+
+		// Remember for later.
+		visited[v] = true
+	}
+
+	switch v1.Kind() {
+	case reflect.Array:
+		// We don't need to check length here because length is part of
+		// an array's type, which has already been filtered for.
+		for i := 0; i < v1.Len(); i++ {
+			if !e.deepValueDerive(v1.Index(i), v2.Index(i), visited, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.Slice:
+		if v1.IsNil() || v1.Len() == 0 {
+			return true
+		}
+		if v1.Len() > v2.Len() {
+			return false
+		}
+		if v1.Pointer() == v2.Pointer() {
+			return true
+		}
+		for i := 0; i < v1.Len(); i++ {
+			if !e.deepValueDerive(v1.Index(i), v2.Index(i), visited, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.String:
+		if v1.Len() == 0 {
+			return true
+		}
+		if v1.Len() > v2.Len() {
+			return false
+		}
+		return v1.String() == v2.String()
+	case reflect.Interface:
+		if v1.IsNil() {
+			return true
+		}
+		return e.deepValueDerive(v1.Elem(), v2.Elem(), visited, depth+1)
+	case reflect.Pointer:
+		if v1.IsNil() {
+			return true
+		}
+		return e.deepValueDerive(v1.Elem(), v2.Elem(), visited, depth+1)
+	case reflect.Struct:
+		for i, n := 0, v1.NumField(); i < n; i++ {
+			if !e.deepValueDerive(v1.Field(i), v2.Field(i), visited, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.Map:
+		if v1.IsNil() || v1.Len() == 0 {
+			return true
+		}
+		if v1.Len() > v2.Len() {
+			return false
+		}
+		if v1.Pointer() == v2.Pointer() {
+			return true
+		}
+		for _, k := range v1.MapKeys() {
+			if !e.deepValueDerive(v1.MapIndex(k), v2.MapIndex(k), visited, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.Func:
+		if v1.IsNil() && v2.IsNil() {
+			return true
+		}
+		// Can't do better than this:
+		return false
+	default:
+		// Normal equality suffices
+		if !v1.CanInterface() || !v2.CanInterface() {
+			panic(unexportedTypePanic{})
+		}
+		return v1.Interface() == v2.Interface()
+	}
+}
+
+// DeepDerivative is similar to DeepEqual except that unset fields in a1 are
+// ignored (not compared). This allows us to focus on the fields that matter to
+// the semantic comparison.
+//
+// The unset fields include a nil pointer and an empty string.
+func (e Equalities) DeepDerivative(a1, a2 interface{}) bool {
+	if a1 == nil {
+		return true
+	}
+	v1 := reflect.ValueOf(a1)
+	v2 := reflect.ValueOf(a2)
+	if v1.Type() != v2.Type() {
+		return false
+	}
+	return e.deepValueDerive(v1, v2, make(map[visit]bool), 0)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/reflect/deep_equal_test.go b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/reflect/deep_equal_test.go
new file mode 100644
index 0000000000..6e1e6d0d38
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/apimachinery/third_party/forked/golang/reflect/deep_equal_test.go
@@ -0,0 +1,163 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package reflect
+
+import (
+	"testing"
+)
+
+func TestEqualities(t *testing.T) {
+	e := Equalities{}
+	type Bar struct {
+		X int
+	}
+	type Baz struct {
+		Y Bar
+	}
+	type Zap struct {
+		A []int
+		B map[string][]int
+	}
+	err := e.AddFuncs(
+		func(a, b int) bool {
+			return a+1 == b
+		},
+		func(a, b Bar) bool {
+			return a.X*10 == b.X
+		},
+	)
+	if err != nil {
+		t.Fatalf("Unexpected: %v", err)
+	}
+
+	type Foo struct {
+		X int
+	}
+
+	table := []struct {
+		a, b                               interface{}
+		deepEqual                          bool // Expected result for DeepEqual
+		deepEqualWithNilDifferentFromEmpty bool // Expected result for DeepEqualWithNilDifferentFromEmpty
+	}{
+		// Custom equality functions
+		{1, 2, true, true},
+		{2, 1, false, false},
+		{"foo", "fo", false, false},
+		{"foo", "foo", true, true},
+		{"foo", "foobar", false, false},
+		{Foo{1}, Foo{2}, true, true},
+		{Foo{2}, Foo{1}, false, false},
+		{Bar{1}, Bar{10}, true, true},
+		{&Bar{1}, &Bar{10}, true, true},
+		{Baz{Bar{1}}, Baz{Bar{10}}, true, true},
+		// Arrays
+		{[...]string{}, [...]string{"1", "2", "3"}, false, false},
+		{[...]string{"1"}, [...]string{"1", "2", "3"}, false, false},
+		{[...]string{"1", "2", "3"}, [...]string{}, false, false},
+		{[...]string{"1", "2", "3"}, [...]string{"1", "2", "3"}, true, true},
+		// Maps with custom equality
+		{map[string]int{"foo": 1}, map[string]int{}, false, false},
+		{map[string]int{"foo": 1}, map[string]int{"foo": 2}, true, true},
+		{map[string]int{"foo": 2}, map[string]int{"foo": 1}, false, false},
+		{map[string]int{"foo": 1}, map[string]int{"foo": 2, "bar": 6}, false, false},
+		{map[string]int{"foo": 1, "bar": 6}, map[string]int{"foo": 2}, false, false},
+		// Nil vs empty (DeepEqual treats as equal, DeepEqualWithNilDifferentFromEmpty treats as different)
+		{map[string]int{}, map[string]int(nil), true, false},
+		{[]string(nil), []string(nil), true, true},
+		{[]string{}, []string(nil), true, false},
+		{[]string(nil), []string{}, true, false},
+		{[]int{}, []int(nil), true, false},
+		// Nil vs filled (both functions should return false)
+		{[]string{"1"}, []string(nil), false, false},
+		// Empty vs filled (both functions should return false)
+		{[]string{}, []string{"1"}, false, false},
+		{[]string{}, []string{"1", "2", "3"}, false, false},
+		{[]int{}, []int{1, 2, 3}, false, false},
+		{map[string]int{}, map[string]int{"foo": 1}, false, false},
+		// Filled vs empty (both functions should return false)
+		{[]string{"1"}, []string{}, false, false},
+		{[]string{"1"}, []string{"1", "2", "3"}, false, false},
+		{[]string{"1", "2", "3"}, []string{}, false, false},
+		{[]int{1, 2, 3}, []int{}, false, false},
+		{map[string]int{"foo": 1}, map[string]int{}, false, false},
+		// Nested nil/empty (DeepEqual treats as equal, DeepEqualWithNilDifferentFromEmpty treats as different)
+		{map[string][]int{}, map[string][]int(nil), true, false},
+		{map[string][]int{"foo": nil}, map[string][]int{"foo": {}}, true, false},
+		{Zap{A: nil, B: map[string][]int{"foo": nil}}, Zap{A: []int{}, B: map[string][]int{"foo": {}}}, true, false},
+	}
+
+	for _, item := range table {
+		if e, a := item.deepEqual, e.DeepEqual(item.a, item.b); e != a {
+			t.Errorf("DeepEqual: Expected (%+v == %+v) == %v, but got %v", item.a, item.b, e, a)
+		}
+		if e, a := item.deepEqualWithNilDifferentFromEmpty, e.DeepEqualWithNilDifferentFromEmpty(item.a, item.b); e != a {
+			t.Errorf("DeepEqualWithNilDifferentFromEmpty: Expected (%+v == %+v) == %v, but got %v", item.a, item.b, e, a)
+		}
+	}
+}
+
+func TestDerivatives(t *testing.T) {
+	e := Equalities{}
+	type Bar struct {
+		X int
+	}
+	type Baz struct {
+		Y Bar
+	}
+	err := e.AddFuncs(
+		func(a, b int) bool {
+			return a+1 == b
+		},
+		func(a, b Bar) bool {
+			return a.X*10 == b.X
+		},
+	)
+	if err != nil {
+		t.Fatalf("Unexpected: %v", err)
+	}
+
+	type Foo struct {
+		X int
+	}
+
+	table := []struct {
+		a, b  interface{}
+		equal bool
+	}{
+		{1, 2, true},
+		{2, 1, false},
+		{"foo", "fo", false},
+		{"foo", "foo", true},
+		{"foo", "foobar", false},
+		{Foo{1}, Foo{2}, true},
+		{Foo{2}, Foo{1}, false},
+		{Bar{1}, Bar{10}, true},
+		{&Bar{1}, &Bar{10}, true},
+		{Baz{Bar{1}}, Baz{Bar{10}}, true},
+		{[...]string{}, [...]string{"1", "2", "3"}, false},
+		{[...]string{"1"}, [...]string{"1", "2", "3"}, false},
+		{[...]string{"1", "2", "3"}, [...]string{}, false},
+		{[...]string{"1", "2", "3"}, [...]string{"1", "2", "3"}, true},
+		{map[string]int{"foo": 1}, map[string]int{}, false},
+		{map[string]int{"foo": 1}, map[string]int{"foo": 2}, true},
+		{map[string]int{"foo": 2}, map[string]int{"foo": 1}, false},
+		{map[string]int{"foo": 1}, map[string]int{"foo": 2, "bar": 6}, true},
+		{map[string]int{"foo": 1, "bar": 6}, map[string]int{"foo": 2}, false},
+		{map[string]int{}, map[string]int(nil), true},
+		{[]string(nil), []string(nil), true},
+		{[]string{}, []string(nil), true},
+		{[]string(nil), []string{}, true},
+		{[]string{"1"}, []string(nil), false},
+		{[]string{}, []string{"1", "2", "3"}, true},
+		{[]string{"1"}, []string{"1", "2", "3"}, true},
+		{[]string{"1", "2", "3"}, []string{}, false},
+	}
+
+	for _, item := range table {
+		if e, a := item.equal, e.DeepDerivative(item.a, item.b); e != a {
+			t.Errorf("Expected (%+v ~ %+v) == %v, but got %v", item.a, item.b, e, a)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/.github/PULL_REQUEST_TEMPLATE.md b/hack/tools/code-generator/third_party/k8s.io/code-generator/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000000..e7e5eb834b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,2 @@
+Sorry, we do not accept changes directly against this repository. Please see
+CONTRIBUTING.md for information on where and how to contribute instead.
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/CONTRIBUTING.md b/hack/tools/code-generator/third_party/k8s.io/code-generator/CONTRIBUTING.md
new file mode 100644
index 0000000000..76625b7bc9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/CONTRIBUTING.md
@@ -0,0 +1,7 @@
+# Contributing guidelines
+
+Do not open pull requests directly against this repository, they will be ignored. Instead, please open pull requests against [kubernetes/kubernetes](https://git.k8s.io/kubernetes/).  Please follow the same [contributing guide](https://git.k8s.io/kubernetes/CONTRIBUTING.md) you would follow for any other pull request made to kubernetes/kubernetes.
+
+This repository is published from [kubernetes/kubernetes/staging/src/k8s.io/code-generator](https://git.k8s.io/kubernetes/staging/src/k8s.io/code-generator) by the [kubernetes publishing-bot](https://git.k8s.io/publishing-bot).
+
+Please see [Staging Directory and Publishing](https://git.k8s.io/community/contributors/devel/sig-architecture/staging.md) for more information
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/LICENSE b/hack/tools/code-generator/third_party/k8s.io/code-generator/LICENSE
new file mode 100644
index 0000000000..d645695673
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/OWNERS b/hack/tools/code-generator/third_party/k8s.io/code-generator/OWNERS
new file mode 100644
index 0000000000..d16e47e85d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/OWNERS
@@ -0,0 +1,16 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+  - deads2k
+  - jpbetz
+  - wojtek-t
+  - sttts
+reviewers:
+  - deads2k
+  - wojtek-t
+  - sttts
+labels:
+  - sig/api-machinery
+  - area/code-generation
+emeritus_approvers:
+  - lavalamp
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/README.md b/hack/tools/code-generator/third_party/k8s.io/code-generator/README.md
new file mode 100644
index 0000000000..aacc4f816f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/README.md
@@ -0,0 +1,34 @@
+> ⚠️ **This is an automatically published [staged repository](https://git.k8s.io/kubernetes/staging#external-repository-staging-area) for Kubernetes**.   
+> Contributions, including issues and pull requests, should be made to the main Kubernetes repository: [https://github.com/kubernetes/kubernetes](https://github.com/kubernetes/kubernetes).  
+> This repository is read-only for importing, and not used for direct contributions.  
+> See [CONTRIBUTING.md](./CONTRIBUTING.md) for more details.
+
+# code-generator
+
+Golang code-generators used to implement [Kubernetes-style API types](https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md).
+
+## Purpose
+
+These code-generators can be used
+- in the context of [CustomResourceDefinition](https://kubernetes.io/docs/tasks/access-kubernetes-api/extend-api-custom-resource-definitions/) to build native, versioned clients,
+  informers and other helpers
+- in the context of [User-provider API Servers](https://github.com/kubernetes/apiserver) to build conversions between internal and versioned types, defaulters, protobuf codecs,
+  internal and versioned clients and informers.
+
+## Resources
+- The example [sample controller](https://github.com/kubernetes/sample-controller) shows a code example of a controller that uses the clients, listers and informers generated by this library.
+- The article [Kubernetes Deep Dive: Code Generation for CustomResources](https://cloud.redhat.com/blog/kubernetes-deep-dive-code-generation-customresources/) gives a step by step instruction on how to use this library.
+
+## Usage
+
+The examples above are dated. The current recommended script to use is [kube_codegen.sh](kube_codegen.sh).
+
+## Compatibility
+
+HEAD of this repo will match HEAD of k8s.io/apiserver, k8s.io/apimachinery, and k8s.io/client-go.
+
+## Where does it come from?
+
+`code-generator` is synced from https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/code-generator.
+Code changes are made in that location, merged into `k8s.io/kubernetes` and later synced here.
+
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/SECURITY_CONTACTS b/hack/tools/code-generator/third_party/k8s.io/code-generator/SECURITY_CONTACTS
new file mode 100644
index 0000000000..f6003980fc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/SECURITY_CONTACTS
@@ -0,0 +1,16 @@
+# Defined below are the security contacts for this repo.
+#
+# They are the contact point for the Product Security Committee to reach out
+# to for triaging and handling of incoming issues.
+#
+# The below names agree to abide by the
+# [Embargo Policy](https://git.k8s.io/security/private-distributors-list.md#embargo-policy)
+# and will be removed and replaced if they violate that agreement.
+#
+# DO NOT REPORT SECURITY VULNERABILITIES DIRECTLY TO THESE NAMES, FOLLOW THE
+# INSTRUCTIONS AT https://kubernetes.io/security/
+
+cheftako
+deads2k
+lavalamp
+sttts
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/args/args.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/args/args.go
new file mode 100644
index 0000000000..487b936e6f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/args/args.go
@@ -0,0 +1,95 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package args
+
+import (
+	"fmt"
+
+	"github.com/spf13/pflag"
+	"k8s.io/code-generator/pkg/apidefinitions"
+	"k8s.io/gengo/v2/types"
+)
+
+// Args is a wrapper for arguments to applyconfiguration-gen.
+type Args struct {
+	OutputDir string // must be a directory path
+	OutputPkg string // must be a Go import-path
+
+	GoHeaderFile string
+
+	// ExternalApplyConfigurations provides the locations of externally generated
+	// apply configuration types for types referenced by the go structs provided as input.
+	// Locations are provided as a comma separated list of <package>.<typeName>:<applyconfiguration-package>
+	// entries.
+	//
+	// E.g. if a type references appsv1.Deployment, the location of its apply configuration should
+	// be provided:
+	//   k8s.io/api/apps/v1.Deployment:k8s.io/client-go/applyconfigurations/apps/v1
+	//
+	// meta/v1 types (TypeMeta and ObjectMeta) are always included and do not need to be passed in.
+	ExternalApplyConfigurations map[types.Name]string
+
+	OpenAPISchemaFilePath string
+
+	apidefinitions.LintArgs
+}
+
+// New returns default arguments for the generator.
+func New() *Args {
+	return &Args{
+		ExternalApplyConfigurations: map[types.Name]string{
+			// Always include the applyconfigurations we've generated in client-go. They are sufficient for the vast majority of use cases.
+			{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "Condition"}:                "k8s.io/client-go/applyconfigurations/meta/v1",
+			{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "DeleteOptions"}:            "k8s.io/client-go/applyconfigurations/meta/v1",
+			{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "LabelSelector"}:            "k8s.io/client-go/applyconfigurations/meta/v1",
+			{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "LabelSelectorRequirement"}: "k8s.io/client-go/applyconfigurations/meta/v1",
+			{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "ManagedFieldsEntry"}:       "k8s.io/client-go/applyconfigurations/meta/v1",
+			{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "ObjectMeta"}:               "k8s.io/client-go/applyconfigurations/meta/v1",
+			{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "OwnerReference"}:           "k8s.io/client-go/applyconfigurations/meta/v1",
+			{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "TypeMeta"}:                 "k8s.io/client-go/applyconfigurations/meta/v1",
+		},
+	}
+}
+
+func (args *Args) AddFlags(fs *pflag.FlagSet, inputBase string) {
+	fs.StringVar(&args.OutputDir, "output-dir", "",
+		"the base directory under which to generate results")
+	fs.StringVar(&args.OutputPkg, "output-pkg", args.OutputPkg,
+		"the Go import-path of the generated results")
+	fs.StringVar(&args.GoHeaderFile, "go-header-file", "",
+		"the path to a file containing boilerplate header text; the string \"YEAR\" will be replaced with the current 4-digit year")
+	fs.Var(NewExternalApplyConfigurationValue(&args.ExternalApplyConfigurations, nil), "external-applyconfigurations",
+		"list of comma separated external apply configurations locations in <type-package>.<type-name>:<applyconfiguration-package> form."+
+			"For example: k8s.io/api/apps/v1.Deployment:k8s.io/client-go/applyconfigurations/apps/v1")
+	fs.StringVar(&args.OpenAPISchemaFilePath, "openapi-schema", "",
+		"path to the openapi schema containing all the types that apply configurations will be generated for")
+	apidefinitions.AddFlags(&args.LintArgs, fs)
+}
+
+// Validate checks the given arguments.
+func (args *Args) Validate() error {
+	if len(args.OutputDir) == 0 {
+		return fmt.Errorf("--output-dir must be specified")
+	}
+	if len(args.OutputPkg) == 0 {
+		return fmt.Errorf("--output-pkg must be specified")
+	}
+	if err := apidefinitions.ValidateFlags(args.LintRules); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/args/externaltypes.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/args/externaltypes.go
new file mode 100644
index 0000000000..fd9b609899
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/args/externaltypes.go
@@ -0,0 +1,122 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package args
+
+import (
+	"bytes"
+	"encoding/csv"
+	"flag"
+	"fmt"
+	"strings"
+
+	"k8s.io/gengo/v2/types"
+)
+
+type externalApplyConfigurationValue struct {
+	externals *map[types.Name]string
+}
+
+func NewExternalApplyConfigurationValue(externals *map[types.Name]string, def []string) *externalApplyConfigurationValue {
+	val := new(externalApplyConfigurationValue)
+	val.externals = externals
+	if def != nil {
+		if err := val.set(def); err != nil {
+			panic(err)
+		}
+	}
+	return val
+}
+
+var _ flag.Value = &externalApplyConfigurationValue{}
+
+func (s *externalApplyConfigurationValue) set(vs []string) error {
+	for _, input := range vs {
+		typ, pkg, err := parseExternalMapping(input)
+		if err != nil {
+			return err
+		}
+		if _, ok := (*s.externals)[typ]; ok {
+			return fmt.Errorf("duplicate type found in --external-applyconfigurations: %v", typ)
+		}
+		(*s.externals)[typ] = pkg
+	}
+
+	return nil
+}
+
+func (s *externalApplyConfigurationValue) Set(val string) error {
+	vs, err := readAsCSV(val)
+	if err != nil {
+		return err
+	}
+	if err := s.set(vs); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *externalApplyConfigurationValue) Type() string {
+	return "string"
+}
+
+func (s *externalApplyConfigurationValue) String() string {
+	var strs []string
+	for k, v := range *s.externals {
+		strs = append(strs, fmt.Sprintf("%s.%s:%s", k.Package, k.Name, v))
+	}
+	str, _ := writeAsCSV(strs)
+	return "[" + str + "]"
+}
+
+func readAsCSV(val string) ([]string, error) {
+	if val == "" {
+		return []string{}, nil
+	}
+	stringReader := strings.NewReader(val)
+	csvReader := csv.NewReader(stringReader)
+	return csvReader.Read()
+}
+
+func writeAsCSV(vals []string) (string, error) {
+	b := &bytes.Buffer{}
+	w := csv.NewWriter(b)
+	err := w.Write(vals)
+	if err != nil {
+		return "", err
+	}
+	w.Flush()
+	return strings.TrimSuffix(b.String(), "\n"), nil
+}
+
+func parseExternalMapping(mapping string) (typ types.Name, pkg string, err error) {
+	parts := strings.Split(mapping, ":")
+	if len(parts) != 2 {
+		return types.Name{}, "", fmt.Errorf("expected string of the form <package>.<typeName>:<applyconfiguration-package> but got %s", mapping)
+	}
+	packageTypeStr := parts[0]
+	pkg = parts[1]
+	// need to split on the *last* dot, since k8s.io (and other valid packages) have a dot in it
+	lastDot := strings.LastIndex(packageTypeStr, ".")
+	if lastDot == -1 || lastDot == len(packageTypeStr)-1 {
+		return types.Name{}, "", fmt.Errorf("expected package and type of the form <package>.<typeName> but got %s", packageTypeStr)
+	}
+	structPkg := packageTypeStr[:lastDot]
+	structType := packageTypeStr[lastDot+1:]
+
+	return types.Name{Package: structPkg, Name: structType}, pkg, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/applyconfiguration.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/applyconfiguration.go
new file mode 100644
index 0000000000..47834b4233
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/applyconfiguration.go
@@ -0,0 +1,565 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"fmt"
+	"io"
+	"path"
+	"slices"
+	"sort"
+	"strings"
+
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/klog/v2"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/code-generator/cmd/client-gen/generators/util"
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+)
+
+// applyConfigurationGenerator produces apply configurations for a given GroupVersion and type.
+type applyConfigurationGenerator struct {
+	generator.GoGenerator
+	// outPkgBase is the base package, under which the "internal" and GV-specific subdirs live
+	outPkgBase   string // must be a Go import-path
+	localPkg     string
+	groupVersion clientgentypes.GroupVersion
+	applyConfig  applyConfig
+	imports      namer.ImportTracker
+	refGraph     refGraph
+	openAPIType  *string // if absent, extraction function cannot be generated
+}
+
+var _ generator.Generator = &applyConfigurationGenerator{}
+
+func (g *applyConfigurationGenerator) Filter(_ *generator.Context, t *types.Type) bool {
+	return t == g.applyConfig.Type
+}
+
+func (g *applyConfigurationGenerator) Namers(*generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw":          namer.NewRawNamer(g.localPkg, g.imports),
+		"singularKind": namer.NewPublicNamer(0),
+	}
+}
+
+func (g *applyConfigurationGenerator) Imports(*generator.Context) (imports []string) {
+	return g.imports.ImportLines()
+}
+
+// TypeParams provides a struct that an apply configuration
+// is generated for as well as the apply configuration details
+// and types referenced by the struct.
+type TypeParams struct {
+	Struct      *types.Type
+	ApplyConfig applyConfig
+	Tags        util.Tags
+	APIVersion  string
+	ExtractInto *types.Type
+	ParserFunc  *types.Type
+	OpenAPIType *string
+}
+
+type memberParams struct {
+	TypeParams
+	Member     types.Member
+	MemberType *types.Type
+	JSONTags   JSONTags
+	ArgType    *types.Type   // only set for maps and slices
+	EmbeddedIn *memberParams // parent embedded member, if any
+}
+
+func (g *applyConfigurationGenerator) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+
+	klog.V(5).Infof("processing type %v", t)
+	typeParams := TypeParams{
+		Struct:      t,
+		ApplyConfig: g.applyConfig,
+		Tags:        genclientTags(t),
+		APIVersion:  g.groupVersion.ToAPIVersion(),
+		ExtractInto: extractInto,
+		ParserFunc:  types.Ref(path.Join(g.outPkgBase, "internal"), "Parser"),
+		OpenAPIType: g.openAPIType,
+	}
+
+	if err := g.generateStruct(sw, typeParams); err != nil {
+		return fmt.Errorf("failed to generate apply configuration struct for %s: %w", t.Name, err)
+	}
+
+	if typeParams.Tags.GenerateClient {
+		if typeParams.Tags.NonNamespaced {
+			sw.Do(clientgenTypeConstructorNonNamespaced, typeParams)
+		} else {
+			sw.Do(clientgenTypeConstructorNamespaced, typeParams)
+		}
+		if typeParams.OpenAPIType != nil {
+			g.generateClientgenExtract(sw, typeParams)
+		}
+	} else {
+		if hasTypeMetaField(t) {
+			sw.Do(constructorWithTypeMeta, typeParams)
+		} else {
+			sw.Do(constructor, typeParams)
+		}
+	}
+
+	if typeParams.Tags.GenerateClient || hasTypeMetaField(t) {
+		g.generateIsApplyConfiguration(typeParams.ApplyConfig.ApplyConfiguration, sw)
+	}
+	g.generateWithFuncs(t, typeParams, sw, nil, &[]string{})
+	g.generateGetters(t, typeParams, sw, nil)
+	return sw.Error()
+}
+
+func hasTypeMetaField(t *types.Type) bool {
+	for _, member := range t.Members {
+		if typeMeta.Name == member.Type.Name && member.Embedded {
+			return true
+		}
+	}
+	return false
+}
+
+func blocklisted(t *types.Type, member types.Member) bool {
+	if objectMeta.Name == t.Name && member.Name == "ManagedFields" {
+		return true
+	}
+	if objectMeta.Name == t.Name && member.Name == "SelfLink" {
+		return true
+	}
+	// Hide any fields which are en route to deletion.
+	if strings.HasPrefix(member.Name, "ZZZ_") {
+		return true
+	}
+	return false
+}
+
+func needsGetter(t *types.Type, member types.Member) bool {
+	// Needed when applying an ApplyConfiguration
+	return (objectMeta.Name == t.Name && (member.Name == "Name" || member.Name == "Namespace")) ||
+		(typeMeta.Name == t.Name && (member.Name == "Kind" || member.Name == "APIVersion"))
+}
+
+func (g *applyConfigurationGenerator) generateGetters(t *types.Type, typeParams TypeParams, sw *generator.SnippetWriter, embed *memberParams) {
+	for _, member := range t.Members {
+		if blocklisted(t, member) {
+			continue
+		}
+		memberType := g.refGraph.applyConfigForType(member.Type)
+		if g.refGraph.isApplyConfig(member.Type) {
+			memberType = &types.Type{Kind: types.Pointer, Elem: memberType}
+		}
+		if jsonTags, ok := lookupJSONTags(member); ok {
+			memberParams := memberParams{
+				TypeParams: typeParams,
+				Member:     member,
+				MemberType: memberType,
+				JSONTags:   jsonTags,
+				EmbeddedIn: embed,
+			}
+			if memberParams.Member.Embedded {
+				g.generateGetters(member.Type, typeParams, sw, &memberParams)
+				continue
+			}
+
+			if needsGetter(t, member) {
+				g.generateMemberGetter(sw, memberParams)
+			}
+		}
+	}
+}
+
+func (g *applyConfigurationGenerator) generateWithFuncs(t *types.Type, typeParams TypeParams, sw *generator.SnippetWriter, embed *memberParams,
+	generated *[]string) {
+	for _, member := range t.Members {
+		if blocklisted(t, member) {
+			continue
+		}
+		memberType := g.refGraph.applyConfigForType(member.Type)
+		if g.refGraph.isApplyConfig(member.Type) {
+			memberType = &types.Type{Kind: types.Pointer, Elem: memberType}
+		}
+		if jsonTags, ok := lookupJSONTags(member); ok {
+			if slices.Contains(*generated, member.Name) {
+				klog.V(5).Infof("With%s already generated on %s, skipping\n", member.Name, t.Name)
+				continue
+			}
+			*generated = append(*generated, member.Name)
+			memberParams := memberParams{
+				TypeParams: typeParams,
+				Member:     member,
+				MemberType: memberType,
+				JSONTags:   jsonTags,
+				EmbeddedIn: embed,
+			}
+			if memberParams.Member.Embedded {
+				g.generateWithFuncs(member.Type, typeParams, sw, &memberParams, generated)
+				if !jsonTags.inline {
+					// non-inlined embeds are nillable and need a "ensure exists" utility function
+					sw.Do(ensureEmbedExists, memberParams)
+				}
+				continue
+			}
+
+			// For slices where the items are generated apply configuration types, accept varargs of
+			// pointers of the type as "with" function arguments so the "with" function can be used like so:
+			// WithFoos(Foo().WithName("x"), Foo().WithName("y"))
+			if t := deref(member.Type); t.Kind == types.Slice && g.refGraph.isApplyConfig(t.Elem) {
+				memberParams.ArgType = &types.Type{Kind: types.Pointer, Elem: memberType.Elem}
+				g.generateMemberWithForSlice(sw, member, memberParams)
+				continue
+			}
+			// Note: There are no maps where the values are generated apply configurations (because
+			// associative lists are used instead). So if a type like this is ever introduced, the
+			// default "with" function generator will produce a working (but not entirely convenient "with" function)
+			// that would be used like so:
+			// WithMap(map[string]FooApplyConfiguration{*Foo().WithName("x")})
+
+			switch memberParams.Member.Type.Kind {
+			case types.Slice:
+				memberParams.ArgType = memberType.Elem
+				g.generateMemberWithForSlice(sw, member, memberParams)
+			case types.Map:
+				g.generateMemberWithForMap(sw, memberParams)
+			default:
+				g.generateMemberWith(sw, memberParams)
+			}
+		}
+	}
+}
+
+func (g *applyConfigurationGenerator) generateStruct(sw *generator.SnippetWriter, typeParams TypeParams) error {
+	sw.Do("// $.ApplyConfig.ApplyConfiguration|public$ represents a declarative configuration of the $.ApplyConfig.Type|public$ type for use\n", typeParams)
+	sw.Do("// with apply.\n", typeParams)
+	structComments := commentsWithoutMarkers(append(typeParams.Struct.SecondClosestCommentLines, typeParams.Struct.CommentLines...))
+	if len(structComments) > 0 {
+		sw.Do("//\n", typeParams)
+		if err := sw.Append(strings.NewReader(structComments)); err != nil {
+			return fmt.Errorf("failed to write comments for struct %s: %w", typeParams.Struct.Name, err)
+		}
+	}
+	sw.Do("type $.ApplyConfig.ApplyConfiguration|public$ struct {\n", typeParams)
+	for _, structMember := range typeParams.Struct.Members {
+		if blocklisted(typeParams.Struct, structMember) {
+			continue
+		}
+		if structMemberTags, ok := lookupJSONTags(structMember); ok {
+			if !structMemberTags.inline {
+				structMemberTags.omitempty = true
+			}
+			params := memberParams{
+				TypeParams: typeParams,
+				Member:     structMember,
+				MemberType: g.refGraph.applyConfigForType(structMember.Type),
+				JSONTags:   structMemberTags,
+			}
+
+			if err := sw.Append(strings.NewReader(commentsWithoutMarkers(structMember.CommentLines))); err != nil {
+				return fmt.Errorf("failed to write comments for member %s: %w", structMember.Name, err)
+			}
+			if structMember.Embedded {
+				if structMemberTags.inline {
+					sw.Do("$.MemberType|raw$ `json:\"$.JSONTags$\"`\n", params)
+				} else {
+					sw.Do("*$.MemberType|raw$ `json:\"$.JSONTags$\"`\n", params)
+				}
+			} else if isNillable(structMember.Type) {
+				sw.Do("$.Member.Name$ $.MemberType|raw$ `json:\"$.JSONTags$\"`\n", params)
+			} else {
+				sw.Do("$.Member.Name$ *$.MemberType|raw$ `json:\"$.JSONTags$\"`\n", params)
+			}
+		}
+	}
+	sw.Do("}\n", typeParams)
+
+	return nil
+}
+
+func (g *applyConfigurationGenerator) generateIsApplyConfiguration(t *types.Type, sw *generator.SnippetWriter) {
+	sw.Do(`
+func (b $.|public$) IsApplyConfiguration() {}
+`, t)
+}
+
+func deref(t *types.Type) *types.Type {
+	for t.Kind == types.Pointer {
+		t = t.Elem
+	}
+	return t
+}
+
+func isNillable(t *types.Type) bool {
+	return t.Kind == types.Slice || t.Kind == types.Map
+}
+
+// commentsWithoutMarkers removes comment lines that start with '+' as they are codegen markers
+// and ensures all comments have the proper // prefix
+func commentsWithoutMarkers(comments []string) string {
+	b := strings.Builder{}
+	for _, comment := range comments {
+		trimmed := strings.TrimSpace(comment)
+		if strings.HasPrefix(trimmed, "+") {
+			continue
+		}
+
+		b.WriteString("// " + trimmed + "\n")
+	}
+	return b.String()
+}
+
+func (g *applyConfigurationGenerator) generateMemberWith(sw *generator.SnippetWriter, memberParams memberParams) {
+	sw.Do("// With$.Member.Name$ sets the $.Member.Name$ field in the declarative configuration to the given value\n", memberParams)
+	sw.Do("// and returns the receiver, so that objects can be built by chaining \"With\" function invocations.\n", memberParams)
+	sw.Do("// If called multiple times, the $.Member.Name$ field is set to the value of the last call.\n", memberParams)
+	sw.Do("func (b *$.ApplyConfig.ApplyConfiguration|public$) With$.Member.Name$(value $.MemberType|raw$) *$.ApplyConfig.ApplyConfiguration|public$ {\n", memberParams)
+	g.ensureEmbedExistsIfApplicable(sw, memberParams)
+	if g.refGraph.isApplyConfig(memberParams.Member.Type) || isNillable(memberParams.Member.Type) {
+		sw.Do("b$if ne .EmbeddedIn nil$$if ne .EmbeddedIn.MemberType.Name.Name \"\"$.$.EmbeddedIn.MemberType.Name.Name$$else if ne .EmbeddedIn.MemberType.Elem nil$.$.EmbeddedIn.MemberType.Elem.Name.Name$$end$$end$.$.Member.Name$ = value\n", memberParams)
+	} else {
+		sw.Do("b$if ne .EmbeddedIn nil$$if ne .EmbeddedIn.MemberType.Name.Name \"\"$.$.EmbeddedIn.MemberType.Name.Name$$else if ne .EmbeddedIn.MemberType.Elem nil$.$.EmbeddedIn.MemberType.Elem.Name.Name$$end$$end$.$.Member.Name$ = &value\n", memberParams)
+	}
+	sw.Do("  return b\n", memberParams)
+	sw.Do("}\n", memberParams)
+}
+
+func (g *applyConfigurationGenerator) generateMemberGetter(sw *generator.SnippetWriter, memberParams memberParams) {
+	sw.Do("// Get$.Member.Name$ retrieves the value of the $.Member.Name$ field in the declarative configuration.\n", memberParams)
+	if g.refGraph.isApplyConfig(memberParams.Member.Type) || isNillable(memberParams.Member.Type) {
+		sw.Do("func (b *$.ApplyConfig.ApplyConfiguration|public$) Get$.Member.Name$() $.MemberType|raw$ {\n", memberParams)
+	} else {
+		sw.Do("func (b *$.ApplyConfig.ApplyConfiguration|public$) Get$.Member.Name$() *$.MemberType|raw$ {\n", memberParams)
+	}
+	g.ensureEmbedExistsIfApplicable(sw, memberParams)
+	sw.Do("  return b$if ne .EmbeddedIn nil$$if ne .EmbeddedIn.MemberType.Name.Name \"\"$.$.EmbeddedIn.MemberType.Name.Name$$else if ne .EmbeddedIn.MemberType.Elem nil$.$.EmbeddedIn.MemberType.Elem.Name.Name$$end$$end$.$.Member.Name$\n", memberParams)
+	sw.Do("}\n", memberParams)
+}
+
+func (g *applyConfigurationGenerator) generateMemberWithForSlice(sw *generator.SnippetWriter, member types.Member, memberParams memberParams) {
+	memberIsPointerToSlice := member.Type.Kind == types.Pointer
+	if memberIsPointerToSlice {
+		sw.Do(ensureNonEmbedSliceExists, memberParams)
+	}
+
+	sw.Do("// With$.Member.Name$ adds the given value to the $.Member.Name$ field in the declarative configuration\n", memberParams)
+	sw.Do("// and returns the receiver, so that objects can be build by chaining \"With\" function invocations.\n", memberParams)
+	sw.Do("// If called multiple times, values provided by each call will be appended to the $.Member.Name$ field.\n", memberParams)
+	sw.Do("func (b *$.ApplyConfig.ApplyConfiguration|public$) With$.Member.Name$(values ...$.ArgType|raw$) *$.ApplyConfig.ApplyConfiguration|public$ {\n", memberParams)
+	g.ensureEmbedExistsIfApplicable(sw, memberParams)
+
+	if memberIsPointerToSlice {
+		sw.Do("b.ensure$.MemberType.Elem|public$Exists()\n", memberParams)
+	}
+
+	sw.Do("  for i := range values {\n", memberParams)
+	if memberParams.ArgType.Kind == types.Pointer {
+		sw.Do("if values[i] == nil {\n", memberParams)
+		sw.Do("  panic(\"nil value passed to With$.Member.Name$\")\n", memberParams)
+		sw.Do("}\n", memberParams)
+
+		if memberIsPointerToSlice {
+			sw.Do("*b$if ne .EmbeddedIn nil$$if ne .EmbeddedIn.MemberType.Name.Name \"\"$.$.EmbeddedIn.MemberType.Name.Name$$else if ne .EmbeddedIn.MemberType.Elem nil$.$.EmbeddedIn.MemberType.Elem.Name.Name$$end$$end$.$.Member.Name$ = append(*b$if ne .EmbeddedIn nil$$if ne .EmbeddedIn.MemberType.Name.Name \"\"$.$.EmbeddedIn.MemberType.Name.Name$$else if ne .EmbeddedIn.MemberType.Elem nil$.$.EmbeddedIn.MemberType.Elem.Name.Name$$end$$end$.$.Member.Name$, *values[i])\n", memberParams)
+		} else {
+			sw.Do("b$if ne .EmbeddedIn nil$$if ne .EmbeddedIn.MemberType.Name.Name \"\"$.$.EmbeddedIn.MemberType.Name.Name$$else if ne .EmbeddedIn.MemberType.Elem nil$.$.EmbeddedIn.MemberType.Elem.Name.Name$$end$$end$.$.Member.Name$ = append(b$if ne .EmbeddedIn nil$$if ne .EmbeddedIn.MemberType.Name.Name \"\"$.$.EmbeddedIn.MemberType.Name.Name$$else if ne .EmbeddedIn.MemberType.Elem nil$.$.EmbeddedIn.MemberType.Elem.Name.Name$$end$$end$.$.Member.Name$, *values[i])\n", memberParams)
+		}
+	} else {
+		if memberIsPointerToSlice {
+			sw.Do("*b$if ne .EmbeddedIn nil$$if ne .EmbeddedIn.MemberType.Name.Name \"\"$.$.EmbeddedIn.MemberType.Name.Name$$else if ne .EmbeddedIn.MemberType.Elem nil$.$.EmbeddedIn.MemberType.Elem.Name.Name$$end$$end$.$.Member.Name$ = append(*b$if ne .EmbeddedIn nil$$if ne .EmbeddedIn.MemberType.Name.Name \"\"$.$.EmbeddedIn.MemberType.Name.Name$$else if ne .EmbeddedIn.MemberType.Elem nil$.$.EmbeddedIn.MemberType.Elem.Name.Name$$end$$end$.$.Member.Name$, values[i])\n", memberParams)
+		} else {
+			sw.Do("b$if ne .EmbeddedIn nil$$if ne .EmbeddedIn.MemberType.Name.Name \"\"$.$.EmbeddedIn.MemberType.Name.Name$$else if ne .EmbeddedIn.MemberType.Elem nil$.$.EmbeddedIn.MemberType.Elem.Name.Name$$end$$end$.$.Member.Name$ = append(b$if ne .EmbeddedIn nil$$if ne .EmbeddedIn.MemberType.Name.Name \"\"$.$.EmbeddedIn.MemberType.Name.Name$$else if ne .EmbeddedIn.MemberType.Elem nil$.$.EmbeddedIn.MemberType.Elem.Name.Name$$end$$end$.$.Member.Name$, values[i])\n", memberParams)
+		}
+	}
+	sw.Do("  }\n", memberParams)
+	sw.Do("  return b\n", memberParams)
+	sw.Do("}\n", memberParams)
+}
+
+func (g *applyConfigurationGenerator) generateMemberWithForMap(sw *generator.SnippetWriter, memberParams memberParams) {
+	sw.Do("// With$.Member.Name$ puts the entries into the $.Member.Name$ field in the declarative configuration\n", memberParams)
+	sw.Do("// and returns the receiver, so that objects can be build by chaining \"With\" function invocations.\n", memberParams)
+	sw.Do("// If called multiple times, the entries provided by each call will be put on the $.Member.Name$ field,\n", memberParams)
+	sw.Do("// overwriting an existing map entries in $.Member.Name$ field with the same key.\n", memberParams)
+	sw.Do("func (b *$.ApplyConfig.ApplyConfiguration|public$) With$.Member.Name$(entries $.MemberType|raw$) *$.ApplyConfig.ApplyConfiguration|public$ {\n", memberParams)
+	g.ensureEmbedExistsIfApplicable(sw, memberParams)
+	sw.Do("  if b$if ne .EmbeddedIn nil$$if ne .EmbeddedIn.MemberType.Name.Name \"\"$.$.EmbeddedIn.MemberType.Name.Name$$else if ne .EmbeddedIn.MemberType.Elem nil$.$.EmbeddedIn.MemberType.Elem.Name.Name$$end$$end$.$.Member.Name$ == nil && len(entries) > 0 {\n", memberParams)
+	sw.Do("    b$if ne .EmbeddedIn nil$$if ne .EmbeddedIn.MemberType.Name.Name \"\"$.$.EmbeddedIn.MemberType.Name.Name$$else if ne .EmbeddedIn.MemberType.Elem nil$.$.EmbeddedIn.MemberType.Elem.Name.Name$$end$$end$.$.Member.Name$ = make($.MemberType|raw$, len(entries))\n", memberParams)
+	sw.Do("  }\n", memberParams)
+	sw.Do("  for k, v := range entries {\n", memberParams)
+	sw.Do("    b$if ne .EmbeddedIn nil$$if ne .EmbeddedIn.MemberType.Name.Name \"\"$.$.EmbeddedIn.MemberType.Name.Name$$else if ne .EmbeddedIn.MemberType.Elem nil$.$.EmbeddedIn.MemberType.Elem.Name.Name$$end$$end$.$.Member.Name$[k] = v\n", memberParams)
+	sw.Do("  }\n", memberParams)
+	sw.Do("  return b\n", memberParams)
+	sw.Do("}\n", memberParams)
+}
+
+func (g *applyConfigurationGenerator) ensureEmbedExistsIfApplicable(sw *generator.SnippetWriter, memberParams memberParams) {
+	// Embedded types that are not inlined must be nillable so they are not included in the apply configuration
+	// when all their fields are omitted.
+	if memberParams.EmbeddedIn != nil && !memberParams.EmbeddedIn.JSONTags.inline {
+		sw.Do("b.ensure$.MemberType.Elem|public$Exists()\n", memberParams.EmbeddedIn)
+	}
+}
+
+var ensureEmbedExists = `
+func (b *$.ApplyConfig.ApplyConfiguration|public$) ensure$.MemberType.Elem|public$Exists() {
+  if b.$.MemberType.Elem|public$ == nil {
+    b.$.MemberType.Elem|public$ = &$.MemberType.Elem|raw${}
+  }
+}
+`
+
+var ensureNonEmbedSliceExists = `
+func (b *$.ApplyConfig.ApplyConfiguration|public$) ensure$.MemberType.Elem|public$Exists() {
+  if b.$.Member.Name$ == nil {
+    b.$.Member.Name$ = &[]$.MemberType.Elem|raw${}
+  }
+}
+`
+
+var clientgenTypeConstructorNamespaced = `
+// $.ApplyConfig.Type|public$ constructs a declarative configuration of the $.ApplyConfig.Type|public$ type for use with
+// apply.
+func $.ApplyConfig.Type|public$(name, namespace string) *$.ApplyConfig.ApplyConfiguration|public$ {
+  b := &$.ApplyConfig.ApplyConfiguration|public${}
+  b.WithName(name)
+  b.WithNamespace(namespace)
+  b.WithKind("$.ApplyConfig.Type|singularKind$")
+  b.WithAPIVersion("$.APIVersion$")
+  return b
+}
+`
+
+var clientgenTypeConstructorNonNamespaced = `
+// $.ApplyConfig.Type|public$ constructs a declarative configuration of the $.ApplyConfig.Type|public$ type for use with
+// apply.
+func $.ApplyConfig.Type|public$(name string) *$.ApplyConfig.ApplyConfiguration|public$ {
+  b := &$.ApplyConfig.ApplyConfiguration|public${}
+  b.WithName(name)
+  b.WithKind("$.ApplyConfig.Type|singularKind$")
+  b.WithAPIVersion("$.APIVersion$")
+  return b
+}
+`
+
+var constructorWithTypeMeta = `
+// $.ApplyConfig.ApplyConfiguration|public$ constructs a declarative configuration of the $.ApplyConfig.Type|public$ type for use with
+// apply.
+func $.ApplyConfig.Type|public$() *$.ApplyConfig.ApplyConfiguration|public$ {
+  b := &$.ApplyConfig.ApplyConfiguration|public${}
+  b.WithKind("$.ApplyConfig.Type|singularKind$")
+  b.WithAPIVersion("$.APIVersion$")
+  return b
+}
+`
+
+var titler = cases.Title(language.Und)
+
+var constructor = `
+// $.ApplyConfig.ApplyConfiguration|public$ constructs a declarative configuration of the $.ApplyConfig.Type|public$ type for use with
+// apply.
+func $.ApplyConfig.Type|public$() *$.ApplyConfig.ApplyConfiguration|public$ {
+  return &$.ApplyConfig.ApplyConfiguration|public${}
+}
+`
+
+func (g *applyConfigurationGenerator) generateClientgenExtract(sw *generator.SnippetWriter, typeParams TypeParams) {
+	subresources := g.collectSubresources(typeParams)
+
+	sw.Do(`
+// Extract$.ApplyConfig.Type|public$From extracts the applied configuration owned by fieldManager from
+// $.Struct|private$ for the specified subresource. Pass an empty string for subresource to extract 
+// the main resource. Common subresources include "status", "scale", etc.
+// $.Struct|private$ must be a unmodified $.Struct|public$ API object that was retrieved from the Kubernetes API.
+// Extract$.ApplyConfig.Type|public$From provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func Extract$.ApplyConfig.Type|public$From($.Struct|private$ *$.Struct|raw$, fieldManager string, subresource string) (*$.ApplyConfig.ApplyConfiguration|public$, error) {
+	b := &$.ApplyConfig.ApplyConfiguration|public${}
+	err := $.ExtractInto|raw$($.Struct|private$, $.ParserFunc|raw$().Type("$.OpenAPIType$"), fieldManager, b, subresource)
+	if err != nil {
+		return nil, err
+	}
+	b.WithName($.Struct|private$.Name)
+`, typeParams)
+	if !typeParams.Tags.NonNamespaced {
+		sw.Do("	b.WithNamespace($.Struct|private$.Namespace)\n", typeParams)
+	}
+	sw.Do(`
+	b.WithKind("$.ApplyConfig.Type|singularKind$")
+	b.WithAPIVersion("$.APIVersion$")
+	return b, nil
+}
+`, typeParams)
+
+	sw.Do(`
+// Extract$.ApplyConfig.Type|public$ extracts the applied configuration owned by fieldManager from
+// $.Struct|private$. If no managedFields are found in $.Struct|private$ for fieldManager, a
+// $.ApplyConfig.ApplyConfiguration|public$ is returned with only the Name, Namespace (if applicable),
+// APIVersion and Kind populated. It is possible that no managed fields were found for because other
+// field managers have taken ownership of all the fields previously owned by fieldManager, or because
+// the fieldManager never owned fields any fields.
+// $.Struct|private$ must be a unmodified $.Struct|public$ API object that was retrieved from the Kubernetes API.
+// Extract$.ApplyConfig.Type|public$ provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func Extract$.ApplyConfig.Type|public$($.Struct|private$ *$.Struct|raw$, fieldManager string) (*$.ApplyConfig.ApplyConfiguration|public$, error) {
+	return Extract$.ApplyConfig.Type|public$From($.Struct|private$, fieldManager, "")
+}
+`, typeParams)
+
+	for _, subresource := range subresources {
+		sw.Do(`
+// Extract$.ApplyConfig.Type|public$$.SubresourceName$ extracts the applied configuration owned by fieldManager from
+// $.Struct|private$ for the $.Subresource$ subresource.
+func Extract$.ApplyConfig.Type|public$$.SubresourceName$($.Struct|private$ *$.Struct|raw$, fieldManager string) (*$.ApplyConfig.ApplyConfiguration|public$, error) {
+	return Extract$.ApplyConfig.Type|public$From($.Struct|private$, fieldManager, "$.Subresource$")
+}
+`, map[string]interface{}{
+			"ApplyConfig":     typeParams.ApplyConfig,
+			"Struct":          typeParams.Struct,
+			"SubresourceName": titler.String(subresource),
+			"Subresource":     subresource,
+		})
+	}
+}
+
+func (g *applyConfigurationGenerator) collectSubresources(typeParams TypeParams) []string {
+	subresources := sets.New[string]()
+	if !typeParams.Tags.NoStatus {
+		// Do we even have a status?
+		for _, member := range typeParams.Struct.Members {
+			if member.Name == "Status" {
+				subresources.Insert("status")
+				break
+			}
+		}
+	}
+
+	for _, ext := range typeParams.Tags.Extensions {
+		if ext.SubResourcePath != "" {
+			subresources.Insert(ext.SubResourcePath)
+		}
+	}
+
+	sorted := subresources.UnsortedList()
+	sort.Strings(sorted)
+	return sorted
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/internal.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/internal.go
new file mode 100644
index 0000000000..b17d2a48ac
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/internal.go
@@ -0,0 +1,98 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"io"
+
+	yaml "go.yaml.in/yaml/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/kube-openapi/pkg/schemaconv"
+)
+
+// utilGenerator generates the ForKind() utility function.
+type internalGenerator struct {
+	generator.GoGenerator
+	outputPackage string
+	imports       namer.ImportTracker
+	typeModels    *typeModels
+	filtered      bool
+}
+
+var _ generator.Generator = &internalGenerator{}
+
+func (g *internalGenerator) Filter(*generator.Context, *types.Type) bool {
+	// generate file exactly once
+	if !g.filtered {
+		g.filtered = true
+		return true
+	}
+	return false
+}
+
+func (g *internalGenerator) Namers(*generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw":          namer.NewRawNamer(g.outputPackage, g.imports),
+		"singularKind": namer.NewPublicNamer(0),
+	}
+}
+
+func (g *internalGenerator) Imports(*generator.Context) (imports []string) {
+	return g.imports.ImportLines()
+}
+
+func (g *internalGenerator) GenerateType(c *generator.Context, _ *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "{{", "}}")
+
+	schema, err := schemaconv.ToSchema(g.typeModels.models)
+	if err != nil {
+		return err
+	}
+	schemaYAML, err := yaml.Marshal(schema)
+	if err != nil {
+		return err
+	}
+	sw.Do(schemaBlock, map[string]interface{}{
+		"schemaYAML":   string(schemaYAML),
+		"smdParser":    smdParser,
+		"smdNewParser": smdNewParser,
+		"fmtSprintf":   fmtSprintf,
+		"syncOnce":     syncOnce,
+		"yamlObject":   yamlObject,
+	})
+
+	return sw.Error()
+}
+
+var schemaBlock = `
+func Parser() *{{.smdParser|raw}} {
+	parserOnce.Do(func() {
+		var err error
+		parser, err = {{.smdNewParser|raw}}(schemaYAML)
+		if err != nil {
+			panic({{.fmtSprintf|raw}}("Failed to parse schema: %v", err))
+		}
+	})
+	return parser
+}
+
+var parserOnce {{.syncOnce|raw}}
+var parser *{{.smdParser|raw}}
+var schemaYAML = {{.yamlObject|raw}}(` + "`{{.schemaYAML}}`" + `)
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/jsontagutil.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/jsontagutil.go
new file mode 100644
index 0000000000..e400e0c750
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/jsontagutil.go
@@ -0,0 +1,97 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"reflect"
+	"strings"
+
+	"k8s.io/gengo/v2/types"
+)
+
+// TODO: This implements the same functionality as https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/runtime/converter.go#L236
+// but is based on the highly efficient approach from https://golang.org/src/encoding/json/encode.go
+
+// JSONTags represents a go json field tag.
+type JSONTags struct {
+	name      string
+	omit      bool
+	inline    bool
+	omitempty bool
+}
+
+func (t JSONTags) String() string {
+	var tag string
+	if !t.inline {
+		tag += t.name
+	}
+	if t.omitempty {
+		tag += ",omitempty"
+	}
+	return tag
+}
+
+func lookupJSONTags(m types.Member) (JSONTags, bool) {
+	tag, exists := reflect.StructTag(m.Tags).Lookup("json")
+	if !exists || tag == "-" {
+		return JSONTags{}, false
+	}
+	name, opts := parseTag(tag)
+	inline := m.Embedded && name == ""
+	if name == "" {
+		name = m.Name
+	}
+	return JSONTags{
+		name:      name,
+		omit:      false,
+		inline:    inline,
+		omitempty: opts.Contains("omitempty"),
+	}, true
+}
+
+type tagOptions string
+
+// parseTag splits a struct field's json tag into its name and
+// comma-separated options.
+func parseTag(tag string) (string, tagOptions) {
+	if idx := strings.Index(tag, ","); idx != -1 {
+		return tag[:idx], tagOptions(tag[idx+1:])
+	}
+	return tag, ""
+}
+
+// Contains reports whether a comma-separated listAlias of options
+// contains a particular substr flag. substr must be surrounded by a
+// string boundary or commas.
+func (o tagOptions) Contains(optionName string) bool {
+	if len(o) == 0 {
+		return false
+	}
+	s := string(o)
+	for s != "" {
+		var next string
+		i := strings.Index(s, ",")
+		if i >= 0 {
+			s, next = s[:i], s[i+1:]
+		}
+		if s == optionName {
+			return true
+		}
+		s = next
+	}
+	return false
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/openapi.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/openapi.go
new file mode 100644
index 0000000000..c67325b2f8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/openapi.go
@@ -0,0 +1,196 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+
+	openapiv2 "github.com/google/gnostic-models/openapiv2"
+
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/kube-openapi/pkg/util"
+	utilproto "k8s.io/kube-openapi/pkg/util/proto"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+)
+
+type typeModels struct {
+	models           utilproto.Models
+	gvkToOpenAPIType map[clientgentypes.GroupVersionKind]string
+}
+
+func newTypeModels(openAPISchemaFilePath string, pkgTypes map[string]*types.Package) (*typeModels, error) {
+	if len(openAPISchemaFilePath) == 0 {
+		return emptyModels, nil // No Extract<type>() functions will be generated.
+	}
+
+	rawOpenAPISchema, err := os.ReadFile(openAPISchemaFilePath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read openapi-schema file: %w", err)
+	}
+
+	// Read in the provided openAPI schema.
+	openAPISchema := &spec.Swagger{}
+	err = json.Unmarshal(rawOpenAPISchema, openAPISchema)
+	if err != nil {
+		return nil, fmt.Errorf("failed to unmarshal typeModels JSON: %w", err)
+	}
+
+	// Build a mapping from openAPI type name to GVK.
+	// Find the root types needed by by client-go for apply.
+	gvkToOpenAPIType := map[clientgentypes.GroupVersionKind]string{}
+	rootDefs := map[string]spec.Schema{}
+	for _, p := range pkgTypes {
+		gv, err := groupVersion(p)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse comments of package %s: %w", p.Name, err)
+		}
+		for _, t := range p.Types {
+			tags := genclientTags(t)
+			hasApply := tags.HasVerb("apply") || tags.HasVerb("applyStatus")
+			if tags.GenerateClient && hasApply {
+				openAPIType := util.ToRESTFriendlyName(typeName(t))
+				gvk := gv.WithKind(clientgentypes.Kind(t.Name.Name))
+				rootDefs[openAPIType] = openAPISchema.Definitions[openAPIType]
+				gvkToOpenAPIType[gvk] = openAPIType
+			}
+		}
+	}
+
+	// Trim the schema down to just the types needed by client-go for apply.
+	requiredDefs := make(map[string]spec.Schema)
+	for name, def := range rootDefs {
+		requiredDefs[name] = def
+		findReferenced(&def, openAPISchema.Definitions, requiredDefs)
+	}
+	openAPISchema.Definitions = requiredDefs
+
+	// Convert the openAPI schema to the models format and validate it.
+	models, err := toValidatedModels(openAPISchema)
+	if err != nil {
+		return nil, err
+	}
+	return &typeModels{models: models, gvkToOpenAPIType: gvkToOpenAPIType}, nil
+}
+
+var emptyModels = &typeModels{
+	models:           &utilproto.Definitions{},
+	gvkToOpenAPIType: map[clientgentypes.GroupVersionKind]string{},
+}
+
+func toValidatedModels(openAPISchema *spec.Swagger) (utilproto.Models, error) {
+	// openapi_v2.ParseDocument only accepts a []byte of the JSON or YAML file to be parsed.
+	// so we do an inefficient marshal back to json and then read it back in as yaml
+	// but get the benefit of running the models through utilproto.NewOpenAPIData to
+	// validate all the references between types
+	rawMinimalOpenAPISchema, err := json.Marshal(openAPISchema)
+	if err != nil {
+		return nil, fmt.Errorf("failed to unmarshal openAPI as JSON: %w", err)
+	}
+
+	document, err := openapiv2.ParseDocument(rawMinimalOpenAPISchema)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse OpenAPI document for file: %w", err)
+	}
+	// Construct the models and validate all references are valid.
+	models, err := utilproto.NewOpenAPIData(document)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create OpenAPI models for file: %w", err)
+	}
+	return models, nil
+}
+
+// findReferenced recursively finds all schemas referenced from the given def.
+// toValidatedModels makes sure no references get missed.
+func findReferenced(def *spec.Schema, allSchemas, referencedOut map[string]spec.Schema) {
+	// follow $ref, if any
+	refPtr := def.Ref.GetPointer()
+	if refPtr != nil && !refPtr.IsEmpty() {
+		name := refPtr.String()
+		if !strings.HasPrefix(name, "/definitions/") {
+			return
+		}
+		name = strings.TrimPrefix(name, "/definitions/")
+		schema, ok := allSchemas[name]
+		if !ok {
+			panic(fmt.Sprintf("allSchemas schema is missing referenced type: %s", name))
+		}
+		if _, ok := referencedOut[name]; !ok {
+			referencedOut[name] = schema
+			findReferenced(&schema, allSchemas, referencedOut)
+		}
+	}
+
+	// follow any nested schemas
+	if def.Items != nil {
+		if def.Items.Schema != nil {
+			findReferenced(def.Items.Schema, allSchemas, referencedOut)
+		}
+		for _, item := range def.Items.Schemas {
+			findReferenced(&item, allSchemas, referencedOut)
+		}
+	}
+	if def.AllOf != nil {
+		for _, s := range def.AllOf {
+			findReferenced(&s, allSchemas, referencedOut)
+		}
+	}
+	if def.AnyOf != nil {
+		for _, s := range def.AnyOf {
+			findReferenced(&s, allSchemas, referencedOut)
+		}
+	}
+	if def.OneOf != nil {
+		for _, s := range def.OneOf {
+			findReferenced(&s, allSchemas, referencedOut)
+		}
+	}
+	if def.Not != nil {
+		findReferenced(def.Not, allSchemas, referencedOut)
+	}
+	if def.Properties != nil {
+		for _, prop := range def.Properties {
+			findReferenced(&prop, allSchemas, referencedOut)
+		}
+	}
+	if def.AdditionalProperties != nil && def.AdditionalProperties.Schema != nil {
+		findReferenced(def.AdditionalProperties.Schema, allSchemas, referencedOut)
+	}
+	if def.PatternProperties != nil {
+		for _, s := range def.PatternProperties {
+			findReferenced(&s, allSchemas, referencedOut)
+		}
+	}
+	if def.Dependencies != nil {
+		for _, d := range def.Dependencies {
+			if d.Schema != nil {
+				findReferenced(d.Schema, allSchemas, referencedOut)
+			}
+		}
+	}
+	if def.AdditionalItems != nil && def.AdditionalItems.Schema != nil {
+		findReferenced(def.AdditionalItems.Schema, allSchemas, referencedOut)
+	}
+	if def.Definitions != nil {
+		for _, s := range def.Definitions {
+			findReferenced(&s, allSchemas, referencedOut)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/refgraph.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/refgraph.go
new file mode 100644
index 0000000000..8b46755298
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/refgraph.go
@@ -0,0 +1,175 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"k8s.io/gengo/v2/types"
+
+	"k8s.io/code-generator/cmd/client-gen/generators/util"
+)
+
+// refGraph maps existing types to the package the corresponding applyConfig types will be generated in
+// so that references between apply configurations can be correctly generated.
+type refGraph map[types.Name]string
+
+// refGraphForReachableTypes returns a refGraph that contains all reachable types from
+// the root clientgen types of the provided packages.
+func refGraphForReachableTypes(universe types.Universe, pkgTypes map[string]*types.Package, initialTypes map[types.Name]string) refGraph {
+	var refs refGraph = initialTypes
+
+	// Include only types that are reachable from the root clientgen types.
+	// We don't want to generate apply configurations for types that are not reachable from a root
+	// clientgen type.
+	reachableTypes := map[types.Name]*types.Type{}
+	for _, p := range pkgTypes {
+		for _, t := range p.Types {
+			tags := genclientTags(t)
+			hasApply := tags.HasVerb("apply") || tags.HasVerb("applyStatus")
+			if tags.GenerateClient && hasApply {
+				findReachableTypes(t, reachableTypes)
+			}
+			// If any apply extensions have custom inputs, add them.
+			for _, extension := range tags.Extensions {
+				if extension.HasVerb("apply") {
+					if len(extension.InputTypeOverride) > 0 {
+						inputType := *t
+						if name, pkg := extension.Input(); len(pkg) > 0 {
+							inputType = *(universe.Type(types.Name{Package: pkg, Name: name}))
+						} else {
+							inputType.Name.Name = extension.InputTypeOverride
+						}
+						findReachableTypes(&inputType, reachableTypes)
+					}
+				}
+			}
+		}
+	}
+	for pkg, p := range pkgTypes {
+		for _, t := range p.Types {
+			if _, ok := reachableTypes[t.Name]; !ok {
+				continue
+			}
+			if requiresApplyConfiguration(t) {
+				refs[t.Name] = pkg
+			}
+		}
+	}
+
+	return refs
+}
+
+// applyConfigForType find the type used in the generate apply configurations for a field.
+// This may either be an existing type or one of the other generated applyConfig types.
+func (t refGraph) applyConfigForType(field *types.Type) *types.Type {
+	switch field.Kind {
+	case types.Struct:
+		if pkg, ok := t[field.Name]; ok { // TODO(jpbetz): Refs to types defined in a separate system (e.g. TypeMeta if generating a 3rd party controller) end up referencing the go struct, not the apply configuration type
+			return types.Ref(pkg, field.Name.Name+ApplyConfigurationTypeSuffix)
+		}
+		return field
+	case types.Map:
+		if _, ok := t[field.Elem.Name]; ok {
+			return &types.Type{
+				Kind: types.Map,
+				Elem: t.applyConfigForType(field.Elem),
+				Key:  t.applyConfigForType(field.Key),
+			}
+		}
+		return field
+	case types.Slice:
+		if _, ok := t[field.Elem.Name]; ok {
+			return &types.Type{
+				Kind: types.Slice,
+				Elem: t.applyConfigForType(field.Elem),
+			}
+		}
+		return field
+	case types.Pointer:
+		return t.applyConfigForType(field.Elem)
+	default:
+		return field
+	}
+}
+
+func (t refGraph) isApplyConfig(field *types.Type) bool {
+	switch field.Kind {
+	case types.Struct:
+		_, ok := t[field.Name]
+		return ok
+	case types.Pointer:
+		return t.isApplyConfig(field.Elem)
+	}
+	return false
+}
+
+// genclientTags returns the genclient Tags for the given type.
+func genclientTags(t *types.Type) util.Tags {
+	return util.MustParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...))
+}
+
+// findReachableTypes finds all types transitively reachable from a given root type, including
+// the root type itself.
+func findReachableTypes(t *types.Type, referencedTypes map[types.Name]*types.Type) {
+	if _, ok := referencedTypes[t.Name]; ok {
+		return
+	}
+	referencedTypes[t.Name] = t
+
+	if t.Elem != nil {
+		findReachableTypes(t.Elem, referencedTypes)
+	}
+	if t.Underlying != nil {
+		findReachableTypes(t.Underlying, referencedTypes)
+	}
+	if t.Key != nil {
+		findReachableTypes(t.Key, referencedTypes)
+	}
+	for _, m := range t.Members {
+		findReachableTypes(m.Type, referencedTypes)
+	}
+}
+
+// excludeTypes contains well known types that we do not generate apply configurations for.
+// Hard coding because we only have two, very specific types that serve a special purpose
+// in the type system here.
+var excludeTypes = map[types.Name]struct{}{
+	rawExtension.Name: {},
+	unknown.Name:      {},
+	// DO NOT ADD TO THIS LIST. If we need to exclude other types, we should consider allowing the
+	// go type declarations to be annotated as excluded from this generator.
+}
+
+// requiresApplyConfiguration returns true if a type applyConfig should be generated for the given type.
+// types applyConfig are only generated for struct types that contain fields with json tags.
+func requiresApplyConfiguration(t *types.Type) bool {
+	for t.Kind == types.Alias {
+		t = t.Underlying
+	}
+	if t.Kind != types.Struct {
+		return false
+	}
+	if _, ok := excludeTypes[t.Name]; ok {
+		return false
+	}
+	var hasJSONTaggedMembers bool
+	for _, member := range t.Members {
+		if _, ok := lookupJSONTags(member); ok {
+			hasJSONTaggedMembers = true
+		}
+	}
+	return hasJSONTaggedMembers
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/targets.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/targets.go
new file mode 100644
index 0000000000..73c3f2cb27
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/targets.go
@@ -0,0 +1,332 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"fmt"
+	"path"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/klog/v2"
+
+	"k8s.io/code-generator/cmd/applyconfiguration-gen/args"
+	"k8s.io/code-generator/cmd/client-gen/generators/util"
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+	"k8s.io/code-generator/pkg/apidefinitions"
+	genutil "k8s.io/code-generator/pkg/util"
+)
+
+const (
+	// ApplyConfigurationTypeSuffix is the suffix of generated apply configuration types.
+	ApplyConfigurationTypeSuffix = "ApplyConfiguration"
+)
+
+// NameSystems returns the name system used by the generators in this package.
+func NameSystems() namer.NameSystems {
+	return namer.NameSystems{
+		"public":  namer.NewPublicNamer(0),
+		"private": namer.NewPrivateNamer(0),
+		"raw":     namer.NewRawNamer("", nil),
+	}
+}
+
+// DefaultNameSystem returns the default name system for ordering the types to be
+// processed by the generators in this package.
+func DefaultNameSystem() string {
+	return "public"
+}
+
+// GetTargets makes the client target definition.
+func GetTargets(context *generator.Context, args *args.Args) []generator.Target {
+	boilerplate, err := gengo.GoBoilerplate(args.GoHeaderFile, "", gengo.StdGeneratedBy)
+	if err != nil {
+		klog.Fatalf("Failed loading boilerplate: %v", err)
+	}
+
+	var idOpts []apidefinitions.Option
+	if len(args.LintRules) > 0 {
+		idOpts = append(idOpts, apidefinitions.WithLintRules(args.LintRules...))
+	}
+
+	pkgTypes := packageTypesForInputs(context, args.OutputPkg, idOpts)
+	initialTypes := args.ExternalApplyConfigurations
+	refs := refGraphForReachableTypes(context.Universe, pkgTypes, initialTypes)
+	typeModels, err := newTypeModels(args.OpenAPISchemaFilePath, pkgTypes)
+	if err != nil {
+		klog.Fatalf("Failed build type models from typeModels %s: %v", args.OpenAPISchemaFilePath, err)
+	}
+
+	groupVersions := make(map[string]clientgentypes.GroupVersions)
+	groupGoNames := make(map[string]string)
+	applyConfigsForGroupVersion := make(map[clientgentypes.GroupVersion][]applyConfig)
+
+	var targetList []generator.Target
+	for pkg, p := range pkgTypes {
+		gv, err := groupVersion(p)
+		if err != nil {
+			klog.Fatalf("Failed to parse comments of package %s: %v", p.Name, err)
+		}
+
+		var toGenerate []applyConfig
+		for _, t := range p.Types {
+			// If we don't have an ObjectMeta field, we lack the information required to make the Apply or ApplyStatus call
+			// to the kube-apiserver, so we don't need to generate the type at all
+			clientTags := genclientTags(t)
+			if clientTags.GenerateClient && !hasObjectMetaField(t) {
+				klog.V(5).Infof("skipping type %v because does not have ObjectMeta", t)
+				continue
+			}
+			gvk := gv.WithKind(clientgentypes.Kind(t.Name.Name))
+			openAPIName := typeModels.gvkToOpenAPIType[gvk]
+
+			if typePkg, ok := refs[t.Name]; ok {
+				toGenerate = append(toGenerate, applyConfig{
+					Type:               t,
+					ApplyConfiguration: types.Ref(typePkg, t.Name.Name+ApplyConfigurationTypeSuffix),
+					OpenAPIName:        openAPIName,
+				})
+			}
+		}
+		if len(toGenerate) == 0 {
+			continue // Don't generate empty packages
+		}
+		sort.Sort(applyConfigSort(toGenerate))
+
+		// Apparently we allow the groupName to be overridden in a way that it
+		// no longer maps to a Go package by name.  So we have to figure out
+		// the offset of this particular output package (pkg) from the base
+		// output package (args.OutputPkg).
+		pkgSubdir := strings.TrimPrefix(pkg, args.OutputPkg+"/")
+
+		// generate the apply configurations
+		targetList = append(targetList,
+			targetForApplyConfigurationsPackage(
+				args.OutputDir, args.OutputPkg, pkgSubdir,
+				boilerplate, gv, toGenerate, refs, typeModels))
+
+		// group all the generated apply configurations by gv so ForKind() can be generated
+		groupPackageName := gv.Group.NonEmpty()
+		groupVersionsEntry, ok := groupVersions[groupPackageName]
+		if !ok {
+			groupVersionsEntry = clientgentypes.GroupVersions{
+				PackageName: groupPackageName,
+				Group:       gv.Group,
+			}
+		}
+		groupVersionsEntry.Versions = append(groupVersionsEntry.Versions, clientgentypes.PackageVersion{
+			Version: gv.Version,
+			Package: path.Clean(p.Path),
+		})
+
+		groupGoNames[groupPackageName], err = goName(gv, p)
+		if err != nil {
+			klog.Fatalf("Failed to parse comments of group package %s: %v", groupPackageName, err)
+		}
+		applyConfigsForGroupVersion[gv] = toGenerate
+		groupVersions[groupPackageName] = groupVersionsEntry
+	}
+
+	// generate ForKind() utility function
+	targetList = append(targetList,
+		targetForUtils(args.OutputDir, args.OutputPkg,
+			boilerplate, groupVersions, applyConfigsForGroupVersion, groupGoNames, typeModels))
+	// generate internal embedded schema, required for generated Extract functions
+	targetList = append(targetList,
+		targetForInternal(args.OutputDir, args.OutputPkg,
+			boilerplate, typeModels))
+
+	return targetList
+}
+
+func typeName(t *types.Type) string {
+	typePackage := t.Name.Package
+	return fmt.Sprintf("%s.%s", typePackage, t.Name.Name)
+}
+
+func targetForApplyConfigurationsPackage(outputDirBase, outputPkgBase, pkgSubdir string, boilerplate []byte, gv clientgentypes.GroupVersion, typesToGenerate []applyConfig, refs refGraph, models *typeModels) generator.Target {
+	outputDir := filepath.Join(outputDirBase, pkgSubdir)
+	outputPkg := path.Join(outputPkgBase, pkgSubdir)
+
+	return &generator.SimpleTarget{
+		PkgName:       gv.Version.PackageName(),
+		PkgPath:       outputPkg,
+		PkgDir:        outputDir,
+		HeaderComment: boilerplate,
+		GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+			for _, toGenerate := range typesToGenerate {
+				var openAPIType *string
+				gvk := gv.WithKind(clientgentypes.Kind(toGenerate.Type.Name.Name))
+				if v, ok := models.gvkToOpenAPIType[gvk]; ok {
+					openAPIType = &v
+				}
+
+				generators = append(generators, &applyConfigurationGenerator{
+					GoGenerator: generator.GoGenerator{
+						OutputFilename: strings.ToLower(toGenerate.Type.Name.Name) + ".go",
+					},
+					outPkgBase:   outputPkgBase,
+					localPkg:     outputPkg,
+					groupVersion: gv,
+					applyConfig:  toGenerate,
+					imports:      generator.NewImportTrackerForPackage(outputPkg),
+					refGraph:     refs,
+					openAPIType:  openAPIType,
+				})
+			}
+			return generators
+		},
+	}
+}
+
+func targetForUtils(outputDirBase, outputPkgBase string, boilerplate []byte, groupVersions map[string]clientgentypes.GroupVersions,
+	applyConfigsForGroupVersion map[clientgentypes.GroupVersion][]applyConfig, groupGoNames map[string]string, models *typeModels) generator.Target {
+	return &generator.SimpleTarget{
+		PkgName:       path.Base(outputPkgBase),
+		PkgPath:       outputPkgBase,
+		PkgDir:        outputDirBase,
+		HeaderComment: boilerplate,
+		GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+			generators = append(generators, &utilGenerator{
+				GoGenerator: generator.GoGenerator{
+					OutputFilename: "utils.go",
+				},
+				outputPackage:        outputPkgBase,
+				imports:              generator.NewImportTrackerForPackage(outputPkgBase),
+				groupVersions:        groupVersions,
+				typesForGroupVersion: applyConfigsForGroupVersion,
+				groupGoNames:         groupGoNames,
+				typeModels:           models,
+			})
+			return generators
+		},
+	}
+}
+
+func targetForInternal(outputDirBase, outputPkgBase string, boilerplate []byte, models *typeModels) generator.Target {
+	outputDir := filepath.Join(outputDirBase, "internal")
+	outputPkg := path.Join(outputPkgBase, "internal")
+	return &generator.SimpleTarget{
+		PkgName:       path.Base(outputPkg),
+		PkgPath:       outputPkg,
+		PkgDir:        outputDir,
+		HeaderComment: boilerplate,
+		GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+			generators = append(generators, &internalGenerator{
+				GoGenerator: generator.GoGenerator{
+					OutputFilename: "internal.go",
+				},
+				outputPackage: outputPkgBase,
+				imports:       generator.NewImportTrackerForPackage(outputPkg),
+				typeModels:    models,
+			})
+			return generators
+		},
+	}
+}
+
+func goName(gv clientgentypes.GroupVersion, p *types.Package) (string, error) {
+	goName := namer.IC(strings.Split(gv.Group.NonEmpty(), ".")[0])
+	override, err := genutil.ExtractCommentTagsWithoutArguments("+", []string{"groupGoName"}, p.Comments)
+
+	if err != nil {
+		return goName, err
+	}
+	if values, ok := override["groupGoName"]; ok {
+		goName = namer.IC(values[0])
+	}
+
+	return goName, nil
+}
+
+func packageTypesForInputs(context *generator.Context, outPkgBase string, idOpts []apidefinitions.Option) map[string]*types.Package {
+	pkgTypes := map[string]*types.Package{}
+	for _, inputDir := range context.Inputs {
+		p := context.Universe.Package(inputDir)
+		info, err := apidefinitions.Identify(p, apidefinitions.ApplyConfiguration, idOpts...)
+		if err != nil {
+			klog.Fatal(err)
+		}
+		if !info.ShouldGenerate() {
+			continue
+		}
+		internal := isInternalPackage(p)
+		if internal {
+			klog.Warningf("Skipping internal package: %s", p.Path)
+			continue
+		}
+		// This is how the client generator finds the package we are creating. It uses the API package name, not the group name.
+		// This matches the approach of the client-gen, so the two generator can work together.
+		// For example, if openshift/api/cloudnetwork/v1 contains an apigroup cloud.network.openshift.io, the client-gen
+		// builds a package called cloudnetwork/v1 to contain it. This change makes the applyconfiguration-gen use the same.
+		_, gvPackageString := util.ParsePathGroupVersion(p.Path)
+		pkg := path.Join(outPkgBase, strings.ToLower(gvPackageString))
+		pkgTypes[pkg] = p
+	}
+	return pkgTypes
+}
+
+func groupVersion(p *types.Package) (gv clientgentypes.GroupVersion, err error) {
+	parts := strings.Split(p.Path, "/")
+	gv.Group = clientgentypes.Group(parts[len(parts)-2])
+	gv.Version = clientgentypes.Version(parts[len(parts)-1])
+
+	// If there's a comment of the form "// +groupName=somegroup" or
+	// "// +groupName=somegroup.foo.bar.io", use the first field (somegroup) as the name of the
+	// group when generating.
+	override, ok, err := apidefinitions.GroupNameForPackage(p.Comments)
+	if err != nil {
+		return gv, err
+	}
+	if ok {
+		gv.Group = clientgentypes.Group(override)
+	}
+
+	return gv, nil
+}
+
+// isInternalPackage returns true if the package is an internal package
+func isInternalPackage(p *types.Package) bool {
+	for _, t := range p.Types {
+		for _, member := range t.Members {
+			if member.Name == "ObjectMeta" {
+				return isInternal(member)
+			}
+		}
+	}
+	return false
+}
+
+// isInternal returns true if the tags for a member do not contain a json tag
+func isInternal(m types.Member) bool {
+	_, ok := lookupJSONTags(m)
+	return !ok
+}
+
+func hasObjectMetaField(t *types.Type) bool {
+	for _, member := range t.Members {
+		if objectMeta.Name == member.Type.Name && member.Embedded {
+			return true
+		}
+	}
+	return false
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/types.go
new file mode 100644
index 0000000000..2f9fc783c4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/types.go
@@ -0,0 +1,37 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import "k8s.io/gengo/v2/types"
+
+var (
+	fmtSprintf             = types.Ref("fmt", "Sprintf")
+	syncOnce               = types.Ref("sync", "Once")
+	applyConfiguration     = types.Ref("k8s.io/apimachinery/pkg/runtime", "ApplyConfiguration")
+	groupVersionKind       = types.Ref("k8s.io/apimachinery/pkg/runtime/schema", "GroupVersionKind")
+	typeMeta               = types.Ref("k8s.io/apimachinery/pkg/apis/meta/v1", "TypeMeta")
+	objectMeta             = types.Ref("k8s.io/apimachinery/pkg/apis/meta/v1", "ObjectMeta")
+	rawExtension           = types.Ref("k8s.io/apimachinery/pkg/runtime", "RawExtension")
+	unknown                = types.Ref("k8s.io/apimachinery/pkg/runtime", "Unknown")
+	extractInto            = types.Ref("k8s.io/apimachinery/pkg/util/managedfields", "ExtractInto")
+	typeConverter          = types.Ref("k8s.io/apimachinery/pkg/util/managedfields", "TypeConverter")
+	newSchemeTypeConverter = types.Ref("k8s.io/apimachinery/pkg/util/managedfields", "NewSchemeTypeConverter")
+	runtimeScheme          = types.Ref("k8s.io/apimachinery/pkg/runtime", "Scheme")
+	smdNewParser           = types.Ref("sigs.k8s.io/structured-merge-diff/v6/typed", "NewParser")
+	smdParser              = types.Ref("sigs.k8s.io/structured-merge-diff/v6/typed", "Parser")
+	yamlObject             = types.Ref("sigs.k8s.io/structured-merge-diff/v6/typed", "YAMLObject")
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/util.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/util.go
new file mode 100644
index 0000000000..d8db28fa14
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/generators/util.go
@@ -0,0 +1,177 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"io"
+	"path"
+	"sort"
+	"strings"
+
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+)
+
+// utilGenerator generates the ForKind() utility function.
+type utilGenerator struct {
+	generator.GoGenerator
+	outputPackage        string
+	imports              namer.ImportTracker
+	groupVersions        map[string]clientgentypes.GroupVersions
+	groupGoNames         map[string]string
+	typesForGroupVersion map[clientgentypes.GroupVersion][]applyConfig
+	filtered             bool
+	typeModels           *typeModels
+}
+
+var _ generator.Generator = &utilGenerator{}
+
+func (g *utilGenerator) Filter(*generator.Context, *types.Type) bool {
+	// generate file exactly once
+	if !g.filtered {
+		g.filtered = true
+		return true
+	}
+	return false
+}
+
+func (g *utilGenerator) Namers(*generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw":          namer.NewRawNamer(g.outputPackage, g.imports),
+		"singularKind": namer.NewPublicNamer(0),
+	}
+}
+
+func (g *utilGenerator) Imports(*generator.Context) (imports []string) {
+	return g.imports.ImportLines()
+}
+
+type group struct {
+	GroupGoName string
+	Name        string
+	Versions    []*version
+}
+
+type groupSort []group
+
+func (g groupSort) Len() int { return len(g) }
+func (g groupSort) Less(i, j int) bool {
+	return strings.ToLower(g[i].Name) < strings.ToLower(g[j].Name)
+}
+func (g groupSort) Swap(i, j int) { g[i], g[j] = g[j], g[i] }
+
+type version struct {
+	Name      string
+	GoName    string
+	Resources []applyConfig
+}
+
+type versionSort []*version
+
+func (v versionSort) Len() int { return len(v) }
+func (v versionSort) Less(i, j int) bool {
+	return strings.ToLower(v[i].Name) < strings.ToLower(v[j].Name)
+}
+func (v versionSort) Swap(i, j int) { v[i], v[j] = v[j], v[i] }
+
+type applyConfig struct {
+	Type               *types.Type
+	ApplyConfiguration *types.Type
+	OpenAPIName        string
+}
+
+type applyConfigSort []applyConfig
+
+func (v applyConfigSort) Len() int { return len(v) }
+func (v applyConfigSort) Less(i, j int) bool {
+	return strings.ToLower(v[i].Type.Name.Name) < strings.ToLower(v[j].Type.Name.Name)
+}
+func (v applyConfigSort) Swap(i, j int) { v[i], v[j] = v[j], v[i] }
+
+func (g *utilGenerator) GenerateType(c *generator.Context, _ *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "{{", "}}")
+
+	var groups []group
+	schemeGVs := make(map[*version]*types.Type)
+
+	for groupPackageName, groupVersions := range g.groupVersions {
+		group := group{
+			GroupGoName: g.groupGoNames[groupPackageName],
+			Name:        groupVersions.Group.NonEmpty(),
+			Versions:    []*version{},
+		}
+		for _, v := range groupVersions.Versions {
+			gv := clientgentypes.GroupVersion{Group: groupVersions.Group, Version: v.Version}
+			version := &version{
+				Name:      v.Version.NonEmpty(),
+				GoName:    namer.IC(v.Version.NonEmpty()),
+				Resources: g.typesForGroupVersion[gv],
+			}
+			schemeGVs[version] = c.Universe.Variable(types.Name{
+				Package: g.typesForGroupVersion[gv][0].Type.Name.Package,
+				Name:    "SchemeGroupVersion",
+			})
+			group.Versions = append(group.Versions, version)
+		}
+		sort.Sort(versionSort(group.Versions))
+		groups = append(groups, group)
+	}
+	sort.Sort(groupSort(groups))
+
+	m := map[string]interface{}{
+		"applyConfiguration":     applyConfiguration,
+		"groups":                 groups,
+		"internalParser":         types.Ref(path.Join(g.outputPackage, "internal"), "Parser"),
+		"runtimeScheme":          runtimeScheme,
+		"schemeGVs":              schemeGVs,
+		"schemaGroupVersionKind": groupVersionKind,
+		"typeConverter":          typeConverter,
+		"newSchemeTypeConverter": newSchemeTypeConverter,
+	}
+	sw.Do(forKindFunc, m)
+	sw.Do(newTypeConverterFunc, m)
+
+	return sw.Error()
+}
+
+var newTypeConverterFunc = `
+func NewTypeConverter(scheme *{{.runtimeScheme|raw}}) {{.typeConverter|raw}} {
+	return {{.newSchemeTypeConverter|raw}}(scheme, {{.internalParser|raw}}())
+}
+`
+
+var forKindFunc = `
+// ForKind returns an apply configuration type for the given GroupVersionKind, or nil if no
+// apply configuration type exists for the given GroupVersionKind.
+func ForKind(kind {{.schemaGroupVersionKind|raw}}) interface{} {
+	switch kind {
+		{{range $group := .groups -}}{{$GroupGoName := .GroupGoName -}}
+			{{range $version := .Versions -}}
+	// Group={{$group.Name}}, Version={{.Name}}
+				{{range .Resources -}}
+	case {{index $.schemeGVs $version|raw}}.WithKind("{{.Type|singularKind}}"):
+		return &{{.ApplyConfiguration|raw}}{}
+				{{end}}
+			{{end}}
+		{{end -}}
+	}
+	return nil
+}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/main.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/main.go
new file mode 100644
index 0000000000..f6b03f8877
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/applyconfiguration-gen/main.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// applyconfiguration-gen is a tool for auto-generating apply builder functions.
+package main
+
+import (
+	"flag"
+
+	"github.com/spf13/pflag"
+	"k8s.io/code-generator/cmd/applyconfiguration-gen/args"
+	"k8s.io/code-generator/cmd/applyconfiguration-gen/generators"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/klog/v2"
+)
+
+func main() {
+	klog.InitFlags(nil)
+	args := args.New()
+	args.AddFlags(pflag.CommandLine, "k8s.io/kubernetes/pkg/apis") // TODO: move this input path out of applyconfiguration-gen
+	if err := flag.Set("logtostderr", "true"); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+	pflag.Parse()
+
+	if err := args.Validate(); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+
+	myTargets := func(context *generator.Context) []generator.Target {
+		return generators.GetTargets(context, args)
+	}
+
+	// Run it.
+	if err := gengo.Execute(
+		generators.NameSystems(),
+		generators.DefaultNameSystem(),
+		myTargets,
+		gengo.StdBuildTag,
+		pflag.Args(),
+	); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+	klog.V(2).Info("Completed successfully.")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/OWNERS b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/OWNERS
new file mode 100644
index 0000000000..967eb2a7bb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/OWNERS
@@ -0,0 +1,11 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+  - wojtek-t
+  - caesarxuchao
+reviewers:
+  - wojtek-t
+  - caesarxuchao
+  - jpbetz
+emeritus_approvers:
+  - lavalamp
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/README.md b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/README.md
new file mode 100644
index 0000000000..b8206127ff
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/README.md
@@ -0,0 +1,2 @@
+See [generating-clientset.md](https://git.k8s.io/community/contributors/devel/sig-api-machinery/generating-clientset.md)
+
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/args/args.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/args/args.go
new file mode 100644
index 0000000000..9ea1d0bf36
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/args/args.go
@@ -0,0 +1,154 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package args
+
+import (
+	"fmt"
+
+	"github.com/spf13/pflag"
+
+	"k8s.io/code-generator/cmd/client-gen/types"
+	"k8s.io/code-generator/pkg/apidefinitions"
+)
+
+type Args struct {
+	// The directory for the generated results.
+	OutputDir string
+
+	// The Go import-path of the generated results.
+	OutputPkg string
+
+	// The boilerplate header for Go files.
+	GoHeaderFile string
+
+	// A sorted list of group versions to generate. For each of them the package path is found
+	// in GroupVersionToInputPath.
+	Groups []types.GroupVersions
+
+	// Overrides for which types should be included in the client.
+	IncludedTypesOverrides map[types.GroupVersion][]string
+
+	// ClientsetName is the name of the clientset to be generated. It's
+	// populated from command-line arguments.
+	ClientsetName string
+	// ClientsetAPIPath is the default API HTTP path for generated clients.
+	ClientsetAPIPath string
+	// ClientsetOnly determines if we should generate the clients for groups and
+	// types along with the clientset. It's populated from command-line
+	// arguments.
+	ClientsetOnly bool
+	// FakeClient determines if client-gen generates the fake clients.
+	FakeClient bool
+	// PluralExceptions specify list of exceptions used when pluralizing certain types.
+	// For example 'Endpoints:Endpoints', otherwise the pluralizer will generate 'Endpointes'.
+	PluralExceptions []string
+
+	// ApplyConfigurationPackage is the package of apply builders generated by
+	// applyconfiguration-gen.
+	// If non-empty, Apply functions are generated for each type and reference the apply builders.
+	// If empty (""), Apply functions are not generated.
+	ApplyConfigurationPackage string
+
+	// PrefersProtobuf determines if the generated clientset uses protobuf for API requests.
+	PrefersProtobuf bool
+
+	apidefinitions.LintArgs
+}
+
+func New() *Args {
+	return &Args{
+		ClientsetName:             "internalclientset",
+		ClientsetAPIPath:          "/apis",
+		ClientsetOnly:             false,
+		FakeClient:                true,
+		ApplyConfigurationPackage: "",
+	}
+}
+
+func (args *Args) AddFlags(fs *pflag.FlagSet, inputBase string) {
+	gvsBuilder := NewGroupVersionsBuilder(&args.Groups)
+	fs.StringVar(&args.OutputDir, "output-dir", "",
+		"the base directory under which to generate results")
+	fs.StringVar(&args.OutputPkg, "output-pkg", args.OutputPkg,
+		"the Go import-path of the generated results")
+	fs.StringVar(&args.GoHeaderFile, "go-header-file", "",
+		"the path to a file containing boilerplate header text; the string \"YEAR\" will be replaced with the current 4-digit year")
+	fs.Var(NewGVPackagesValue(gvsBuilder, nil), "input",
+		`group/versions that client-gen will generate clients for. At most one version per group is allowed. Specified in the format "group1/version1,group2/version2...".`)
+	fs.Var(NewGVTypesValue(&args.IncludedTypesOverrides, []string{}), "included-types-overrides",
+		"list of group/version/type for which client should be generated. By default, client is generated for all types which have genclient in types.go. This overrides that. For each groupVersion in this list, only the types mentioned here will be included. The default check of genclient will be used for other group versions.")
+	fs.Var(NewInputBasePathValue(gvsBuilder, inputBase), "input-base",
+		"base path to look for the api group.")
+	fs.StringVarP(&args.ClientsetName, "clientset-name", "n", args.ClientsetName,
+		"the name of the generated clientset package.")
+	fs.StringVarP(&args.ClientsetAPIPath, "clientset-api-path", "", args.ClientsetAPIPath,
+		"the value of default API HTTP path, starting with / and without trailing /.")
+	fs.BoolVar(&args.ClientsetOnly, "clientset-only", args.ClientsetOnly,
+		"when set, client-gen only generates the clientset shell, without generating the individual typed clients")
+	fs.BoolVar(&args.FakeClient, "fake-clientset", args.FakeClient,
+		"when set, client-gen will generate the fake clientset that can be used in tests")
+	fs.StringSliceVar(&args.PluralExceptions, "plural-exceptions", args.PluralExceptions,
+		"list of comma separated plural exception definitions in Type:PluralizedType form")
+	fs.StringVar(&args.ApplyConfigurationPackage, "apply-configuration-package", args.ApplyConfigurationPackage,
+		"optional package of apply configurations, generated by applyconfiguration-gen, that are required to generate Apply functions for each type in the clientset. By default Apply functions are not generated.")
+	fs.BoolVar(&args.PrefersProtobuf, "prefers-protobuf", args.PrefersProtobuf,
+		"when set, client-gen will generate a clientset that uses protobuf for API requests")
+	apidefinitions.AddFlags(&args.LintArgs, fs)
+
+	// support old flags
+	fs.SetNormalizeFunc(mapFlagName("clientset-path", "output-pkg", fs.GetNormalizeFunc()))
+}
+
+func (args *Args) Validate() error {
+	if len(args.OutputDir) == 0 {
+		return fmt.Errorf("--output-dir must be specified")
+	}
+	if len(args.OutputPkg) == 0 {
+		return fmt.Errorf("--output-pkg must be specified")
+	}
+	if len(args.ClientsetName) == 0 {
+		return fmt.Errorf("--clientset-name must be specified")
+	}
+	if len(args.ClientsetAPIPath) == 0 {
+		return fmt.Errorf("--clientset-api-path cannot be empty")
+	}
+	if err := apidefinitions.ValidateFlags(args.LintRules); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// GroupVersionPackages returns a map from GroupVersion to the package with the types.go.
+func (args *Args) GroupVersionPackages() map[types.GroupVersion]string {
+	res := map[types.GroupVersion]string{}
+	for _, pkg := range args.Groups {
+		for _, v := range pkg.Versions {
+			res[types.GroupVersion{Group: pkg.Group, Version: v.Version}] = v.Package
+		}
+	}
+	return res
+}
+
+func mapFlagName(from, to string, old func(fs *pflag.FlagSet, name string) pflag.NormalizedName) func(fs *pflag.FlagSet, name string) pflag.NormalizedName {
+	return func(fs *pflag.FlagSet, name string) pflag.NormalizedName {
+		if name == from {
+			name = to
+		}
+		return old(fs, name)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/args/gvpackages.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/args/gvpackages.go
new file mode 100644
index 0000000000..f5e7f4063a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/args/gvpackages.go
@@ -0,0 +1,175 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package args
+
+import (
+	"bytes"
+	"encoding/csv"
+	"flag"
+	"path"
+	"sort"
+	"strings"
+
+	"k8s.io/code-generator/cmd/client-gen/generators/util"
+	"k8s.io/code-generator/cmd/client-gen/types"
+)
+
+type inputBasePathValue struct {
+	builder *groupVersionsBuilder
+}
+
+var _ flag.Value = &inputBasePathValue{}
+
+func NewInputBasePathValue(builder *groupVersionsBuilder, def string) *inputBasePathValue {
+	v := &inputBasePathValue{
+		builder: builder,
+	}
+	v.Set(def)
+	return v
+}
+
+func (s *inputBasePathValue) Set(val string) error {
+	s.builder.importBasePath = val
+	return s.builder.update()
+}
+
+func (s *inputBasePathValue) Type() string {
+	return "string"
+}
+
+func (s *inputBasePathValue) String() string {
+	return s.builder.importBasePath
+}
+
+type gvPackagesValue struct {
+	builder *groupVersionsBuilder
+	groups  []string
+	changed bool
+}
+
+func NewGVPackagesValue(builder *groupVersionsBuilder, def []string) *gvPackagesValue {
+	gvp := new(gvPackagesValue)
+	gvp.builder = builder
+	if def != nil {
+		if err := gvp.set(def); err != nil {
+			panic(err)
+		}
+	}
+	return gvp
+}
+
+var _ flag.Value = &gvPackagesValue{}
+
+func (s *gvPackagesValue) set(vs []string) error {
+	if s.changed {
+		s.groups = append(s.groups, vs...)
+	} else {
+		s.groups = append([]string(nil), vs...)
+	}
+
+	s.builder.groups = s.groups
+	return s.builder.update()
+}
+
+func (s *gvPackagesValue) Set(val string) error {
+	vs, err := readAsCSV(val)
+	if err != nil {
+		return err
+	}
+	if err := s.set(vs); err != nil {
+		return err
+	}
+	s.changed = true
+	return nil
+}
+
+func (s *gvPackagesValue) Type() string {
+	return "stringSlice"
+}
+
+func (s *gvPackagesValue) String() string {
+	str, _ := writeAsCSV(s.groups)
+	return "[" + str + "]"
+}
+
+type groupVersionsBuilder struct {
+	value          *[]types.GroupVersions
+	groups         []string
+	importBasePath string
+}
+
+func NewGroupVersionsBuilder(groups *[]types.GroupVersions) *groupVersionsBuilder {
+	return &groupVersionsBuilder{
+		value: groups,
+	}
+}
+
+func (p *groupVersionsBuilder) update() error {
+	var seenGroups = make(map[types.Group]*types.GroupVersions)
+	for _, v := range p.groups {
+		pth, gvString := util.ParsePathGroupVersion(v)
+		gv, err := types.ToGroupVersion(gvString)
+		if err != nil {
+			return err
+		}
+
+		versionPkg := types.PackageVersion{Package: path.Join(p.importBasePath, pth, gv.Group.NonEmpty(), gv.Version.String()), Version: gv.Version}
+		if group, ok := seenGroups[gv.Group]; ok {
+			vers := group.Versions
+			vers = append(vers, versionPkg)
+			seenGroups[gv.Group].Versions = vers
+		} else {
+			seenGroups[gv.Group] = &types.GroupVersions{
+				PackageName: gv.Group.NonEmpty(),
+				Group:       gv.Group,
+				Versions:    []types.PackageVersion{versionPkg},
+			}
+		}
+	}
+
+	var groupNames []string
+	for groupName := range seenGroups {
+		groupNames = append(groupNames, groupName.String())
+	}
+	sort.Strings(groupNames)
+	*p.value = []types.GroupVersions{}
+	for _, groupName := range groupNames {
+		*p.value = append(*p.value, *seenGroups[types.Group(groupName)])
+	}
+
+	return nil
+}
+
+func readAsCSV(val string) ([]string, error) {
+	if val == "" {
+		return []string{}, nil
+	}
+	stringReader := strings.NewReader(val)
+	csvReader := csv.NewReader(stringReader)
+	return csvReader.Read()
+}
+
+func writeAsCSV(vals []string) (string, error) {
+	b := &bytes.Buffer{}
+	w := csv.NewWriter(b)
+	err := w.Write(vals)
+	if err != nil {
+		return "", err
+	}
+	w.Flush()
+	return strings.TrimSuffix(b.String(), "\n"), nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/args/gvpackages_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/args/gvpackages_test.go
new file mode 100644
index 0000000000..3f7eb8902e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/args/gvpackages_test.go
@@ -0,0 +1,116 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package args
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/spf13/pflag"
+
+	"k8s.io/code-generator/cmd/client-gen/types"
+)
+
+func TestGVPackageFlag(t *testing.T) {
+	tests := []struct {
+		args           []string
+		def            []string
+		importBasePath string
+		expected       map[types.GroupVersion]string
+		expectedGroups []types.GroupVersions
+		parseError     string
+	}{
+		{
+			args:           []string{},
+			expected:       map[types.GroupVersion]string{},
+			expectedGroups: []types.GroupVersions{},
+		},
+		{
+			args: []string{"foo/bar/v1", "foo/bar/v2", "foo/bar/", "foo/v1"},
+			expectedGroups: []types.GroupVersions{
+				{PackageName: "bar", Group: types.Group("bar"), Versions: []types.PackageVersion{
+					{Version: "v1", Package: "foo/bar/v1"},
+					{Version: "v2", Package: "foo/bar/v2"},
+					{Version: "", Package: "foo/bar"},
+				}},
+				{PackageName: "foo", Group: types.Group("foo"), Versions: []types.PackageVersion{
+					{Version: "v1", Package: "foo/v1"},
+				}},
+			},
+		},
+		{
+			args: []string{"foo/bar/v1", "foo/bar/v2", "foo/bar/", "foo/v1"},
+			def:  []string{"foo/bar/v1alpha1", "foo/v1"},
+			expectedGroups: []types.GroupVersions{
+				{PackageName: "bar", Group: types.Group("bar"), Versions: []types.PackageVersion{
+					{Version: "v1", Package: "foo/bar/v1"},
+					{Version: "v2", Package: "foo/bar/v2"},
+					{Version: "", Package: "foo/bar"},
+				}},
+				{PackageName: "foo", Group: types.Group("foo"), Versions: []types.PackageVersion{
+					{Version: "v1", Package: "foo/v1"},
+				}},
+			},
+		},
+		{
+			args: []string{"api/v1", "api"},
+			expectedGroups: []types.GroupVersions{
+				{PackageName: "api", Group: types.Group("api"), Versions: []types.PackageVersion{
+					{Version: "v1", Package: "api/v1"},
+					{Version: "", Package: "api"},
+				}},
+			},
+		},
+		{
+			args:           []string{"foo/v1"},
+			importBasePath: "k8s.io/api",
+			expectedGroups: []types.GroupVersions{
+				{PackageName: "foo", Group: types.Group("foo"), Versions: []types.PackageVersion{
+					{Version: "v1", Package: "k8s.io/api/foo/v1"},
+				}},
+			},
+		},
+	}
+	for i, test := range tests {
+		fs := pflag.NewFlagSet("testGVPackage", pflag.ContinueOnError)
+		groups := []types.GroupVersions{}
+		builder := NewGroupVersionsBuilder(&groups)
+		fs.Var(NewGVPackagesValue(builder, test.def), "input", "usage")
+		fs.Var(NewInputBasePathValue(builder, test.importBasePath), "input-base-path", "usage")
+
+		args := []string{}
+		for _, a := range test.args {
+			args = append(args, fmt.Sprintf("--input=%s", a))
+		}
+
+		err := fs.Parse(args)
+		if test.parseError != "" {
+			if err == nil {
+				t.Errorf("%d: expected error %q, got nil", i, test.parseError)
+			} else if !strings.Contains(err.Error(), test.parseError) {
+				t.Errorf("%d: expected error %q, got %q", i, test.parseError, err)
+			}
+		} else if err != nil {
+			t.Errorf("%d: expected nil error, got %v", i, err)
+		}
+		if !reflect.DeepEqual(groups, test.expectedGroups) {
+			t.Errorf("%d: expected groups %+v, got groups %+v", i, test.expectedGroups, groups)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/args/gvtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/args/gvtype.go
new file mode 100644
index 0000000000..e4e3ccb536
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/args/gvtype.go
@@ -0,0 +1,110 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package args
+
+import (
+	"flag"
+	"fmt"
+	"strings"
+
+	"k8s.io/code-generator/cmd/client-gen/types"
+)
+
+type gvTypeValue struct {
+	gvToTypes *map[types.GroupVersion][]string
+	changed   bool
+}
+
+func NewGVTypesValue(gvToTypes *map[types.GroupVersion][]string, def []string) *gvTypeValue {
+	gvt := new(gvTypeValue)
+	gvt.gvToTypes = gvToTypes
+	if def != nil {
+		if err := gvt.set(def); err != nil {
+			panic(err)
+		}
+	}
+	return gvt
+}
+
+var _ flag.Value = &gvTypeValue{}
+
+func (s *gvTypeValue) set(vs []string) error {
+	if !s.changed {
+		*s.gvToTypes = map[types.GroupVersion][]string{}
+	}
+
+	for _, input := range vs {
+		gvString, typeStr, err := parseGroupVersionType(input)
+		if err != nil {
+			return err
+		}
+		gv, err := types.ToGroupVersion(gvString)
+		if err != nil {
+			return err
+		}
+		types, ok := (*s.gvToTypes)[gv]
+		if !ok {
+			types = []string{}
+		}
+		types = append(types, typeStr)
+		(*s.gvToTypes)[gv] = types
+	}
+
+	return nil
+}
+
+func (s *gvTypeValue) Set(val string) error {
+	vs, err := readAsCSV(val)
+	if err != nil {
+		return err
+	}
+	if err := s.set(vs); err != nil {
+		return err
+	}
+	s.changed = true
+	return nil
+}
+
+func (s *gvTypeValue) Type() string {
+	return "stringSlice"
+}
+
+func (s *gvTypeValue) String() string {
+	strs := make([]string, 0, len(*s.gvToTypes))
+	for gv, ts := range *s.gvToTypes {
+		for _, t := range ts {
+			strs = append(strs, gv.Group.String()+"/"+gv.Version.String()+"/"+t)
+		}
+	}
+	str, _ := writeAsCSV(strs)
+	return "[" + str + "]"
+}
+
+func parseGroupVersionType(gvtString string) (gvString string, typeStr string, err error) {
+	invalidFormatErr := fmt.Errorf("invalid value: %s, should be of the form group/version/type", gvtString)
+	subs := strings.Split(gvtString, "/")
+	length := len(subs)
+	switch length {
+	case 2:
+		// gvtString of the form group/type, e.g. api/Service,extensions/ReplicaSet
+		return subs[0] + "/", subs[1], nil
+	case 3:
+		return strings.Join(subs[:length-1], "/"), subs[length-1], nil
+	default:
+		return "", "", invalidFormatErr
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/client_generator.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/client_generator.go
new file mode 100644
index 0000000000..65dafc82ec
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/client_generator.go
@@ -0,0 +1,461 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package generators has the generators for the client-gen utility.
+package generators
+
+import (
+	"fmt"
+	"path"
+	"path/filepath"
+	"strings"
+
+	"k8s.io/code-generator/cmd/client-gen/args"
+	"k8s.io/code-generator/cmd/client-gen/generators/fake"
+	"k8s.io/code-generator/cmd/client-gen/generators/scheme"
+	"k8s.io/code-generator/cmd/client-gen/generators/util"
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+	"k8s.io/code-generator/pkg/apidefinitions"
+	codegennamer "k8s.io/code-generator/pkg/namer"
+	genutil "k8s.io/code-generator/pkg/util"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+
+	"k8s.io/klog/v2"
+)
+
+// NameSystems returns the name system used by the generators in this package.
+func NameSystems(pluralExceptions map[string]string) namer.NameSystems {
+	lowercaseNamer := namer.NewAllLowercasePluralNamer(pluralExceptions)
+
+	publicNamer := &ExceptionNamer{
+		Exceptions: map[string]string{
+			// these exceptions are used to deconflict the generated code
+			// you can put your fully qualified package like
+			// to generate a name that doesn't conflict with your group.
+			// "k8s.io/apis/events/v1beta1.Event": "EventResource"
+		},
+		KeyFunc: func(t *types.Type) string {
+			return t.Name.Package + "." + t.Name.Name
+		},
+		Delegate: namer.NewPublicNamer(0),
+	}
+	privateNamer := &ExceptionNamer{
+		Exceptions: map[string]string{
+			// these exceptions are used to deconflict the generated code
+			// you can put your fully qualified package like
+			// to generate a name that doesn't conflict with your group.
+			// "k8s.io/apis/events/v1beta1.Event": "eventResource"
+		},
+		KeyFunc: func(t *types.Type) string {
+			return t.Name.Package + "." + t.Name.Name
+		},
+		Delegate: namer.NewPrivateNamer(0),
+	}
+	publicPluralNamer := &ExceptionNamer{
+		Exceptions: map[string]string{
+			// these exceptions are used to deconflict the generated code
+			// you can put your fully qualified package like
+			// to generate a name that doesn't conflict with your group.
+			// "k8s.io/apis/events/v1beta1.Event": "EventResource"
+		},
+		KeyFunc: func(t *types.Type) string {
+			return t.Name.Package + "." + t.Name.Name
+		},
+		Delegate: namer.NewPublicPluralNamer(pluralExceptions),
+	}
+	privatePluralNamer := &ExceptionNamer{
+		Exceptions: map[string]string{
+			// you can put your fully qualified package like
+			// to generate a name that doesn't conflict with your group.
+			// "k8s.io/apis/events/v1beta1.Event": "eventResource"
+			// these exceptions are used to deconflict the generated code
+			"k8s.io/apis/events/v1beta1.Event":        "eventResources",
+			"k8s.io/kubernetes/pkg/apis/events.Event": "eventResources",
+		},
+		KeyFunc: func(t *types.Type) string {
+			return t.Name.Package + "." + t.Name.Name
+		},
+		Delegate: namer.NewPrivatePluralNamer(pluralExceptions),
+	}
+
+	return namer.NameSystems{
+		"singularKind":       namer.NewPublicNamer(0),
+		"public":             publicNamer,
+		"private":            privateNamer,
+		"raw":                namer.NewRawNamer("", nil),
+		"publicPlural":       publicPluralNamer,
+		"privatePlural":      privatePluralNamer,
+		"allLowercasePlural": lowercaseNamer,
+		"resource":           codegennamer.NewTagOverrideNamer("resourceName", lowercaseNamer),
+	}
+}
+
+// ExceptionNamer allows you specify exceptional cases with exact names.  This allows you to have control
+// for handling various conflicts, like group and resource names for instance.
+type ExceptionNamer struct {
+	Exceptions map[string]string
+	KeyFunc    func(*types.Type) string
+
+	Delegate namer.Namer
+}
+
+// Name provides the requested name for a type.
+func (n *ExceptionNamer) Name(t *types.Type) string {
+	key := n.KeyFunc(t)
+	if exception, ok := n.Exceptions[key]; ok {
+		return exception
+	}
+	return n.Delegate.Name(t)
+}
+
+// DefaultNameSystem returns the default name system for ordering the types to be
+// processed by the generators in this package.
+func DefaultNameSystem() string {
+	return "public"
+}
+
+func targetForGroup(gv clientgentypes.GroupVersion, typeList []*types.Type, clientsetDir, clientsetPkg string, groupPkgName string, groupGoName string, apiPath string, inputPkg string, applyBuilderPkg string, boilerplate []byte, prefersProtobuf bool) generator.Target {
+	subdir := []string{"typed", strings.ToLower(groupPkgName), strings.ToLower(gv.Version.NonEmpty())}
+	gvDir := filepath.Join(clientsetDir, filepath.Join(subdir...))
+	gvPkg := path.Join(clientsetPkg, path.Join(subdir...))
+
+	return &generator.SimpleTarget{
+		PkgName:       strings.ToLower(gv.Version.NonEmpty()),
+		PkgPath:       gvPkg,
+		PkgDir:        gvDir,
+		HeaderComment: boilerplate,
+		PkgDocComment: []byte("// This package has the automatically generated typed clients.\n"),
+		// GeneratorsFunc returns a list of generators. Each generator makes a
+		// single file.
+		GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+			generators = []generator.Generator{
+				// Always generate a "doc.go" file.
+				generator.GoGenerator{OutputFilename: "doc.go"},
+			}
+			// Since we want a file per type that we generate a client for, we
+			// have to provide a function for this.
+			for _, t := range typeList {
+				generators = append(generators, &genClientForType{
+					GoGenerator: generator.GoGenerator{
+						OutputFilename: strings.ToLower(c.Namers["private"].Name(t)) + ".go",
+					},
+					outputPackage:             gvPkg,
+					inputPackage:              inputPkg,
+					clientsetPackage:          clientsetPkg,
+					applyConfigurationPackage: applyBuilderPkg,
+					group:                     gv.Group.NonEmpty(),
+					version:                   gv.Version.String(),
+					groupGoName:               groupGoName,
+					prefersProtobuf:           prefersProtobuf,
+					typeToMatch:               t,
+					imports:                   generator.NewImportTrackerForPackage(gvPkg),
+				})
+			}
+
+			generators = append(generators, &genGroup{
+				GoGenerator: generator.GoGenerator{
+					OutputFilename: groupPkgName + "_client.go",
+				},
+				outputPackage:    gvPkg,
+				inputPackage:     inputPkg,
+				clientsetPackage: clientsetPkg,
+				group:            gv.Group.NonEmpty(),
+				version:          gv.Version.String(),
+				groupGoName:      groupGoName,
+				apiPath:          apiPath,
+				types:            typeList,
+				imports:          generator.NewImportTrackerForPackage(gvPkg),
+			})
+
+			expansionFileName := "generated_expansion.go"
+			generators = append(generators, &genExpansion{
+				groupPackagePath: gvDir,
+				GoGenerator: generator.GoGenerator{
+					OutputFilename: expansionFileName,
+				},
+				types: typeList,
+			})
+
+			return generators
+		},
+		FilterFunc: func(c *generator.Context, t *types.Type) bool {
+			return util.MustParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...)).GenerateClient
+		},
+	}
+}
+
+func targetForClientset(args *args.Args, clientsetDir, clientsetPkg string, groupGoNames map[clientgentypes.GroupVersion]string, boilerplate []byte) generator.Target {
+	return &generator.SimpleTarget{
+		PkgName:       args.ClientsetName,
+		PkgPath:       clientsetPkg,
+		PkgDir:        clientsetDir,
+		HeaderComment: boilerplate,
+		// GeneratorsFunc returns a list of generators. Each generator generates a
+		// single file.
+		GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+			generators = []generator.Generator{
+				&genClientset{
+					GoGenerator: generator.GoGenerator{
+						OutputFilename: "clientset.go",
+					},
+					groups:           args.Groups,
+					groupGoNames:     groupGoNames,
+					clientsetPackage: clientsetPkg,
+					imports:          generator.NewImportTrackerForPackage(clientsetPkg),
+				},
+			}
+			return generators
+		},
+	}
+}
+
+func targetForScheme(args *args.Args, clientsetDir, clientsetPkg string, groupGoNames map[clientgentypes.GroupVersion]string, boilerplate []byte) generator.Target {
+	schemeDir := filepath.Join(clientsetDir, "scheme")
+	schemePkg := path.Join(clientsetPkg, "scheme")
+
+	// create runtime.Registry for internal client because it has to know about group versions
+	internalClient := false
+NextGroup:
+	for _, group := range args.Groups {
+		for _, v := range group.Versions {
+			if v.String() == "" {
+				internalClient = true
+				break NextGroup
+			}
+		}
+	}
+
+	return &generator.SimpleTarget{
+		PkgName:       "scheme",
+		PkgPath:       schemePkg,
+		PkgDir:        schemeDir,
+		HeaderComment: boilerplate,
+		PkgDocComment: []byte("// This package contains the scheme of the automatically generated clientset.\n"),
+		// GeneratorsFunc returns a list of generators. Each generator generates a
+		// single file.
+		GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+			generators = []generator.Generator{
+				// Always generate a "doc.go" file.
+				generator.GoGenerator{OutputFilename: "doc.go"},
+
+				&scheme.GenScheme{
+					GoGenerator: generator.GoGenerator{
+						OutputFilename: "register.go",
+					},
+					InputPackages:  args.GroupVersionPackages(),
+					OutputPkg:      schemePkg,
+					OutputPath:     schemeDir,
+					Groups:         args.Groups,
+					GroupGoNames:   groupGoNames,
+					ImportTracker:  generator.NewImportTrackerForPackage(schemePkg),
+					CreateRegistry: internalClient,
+				},
+			}
+			return generators
+		},
+	}
+}
+
+// applyGroupOverrides applies group name overrides to each package, if applicable. If there is a
+// comment of the form "// +groupName=somegroup" or "// +groupName=somegroup.foo.bar.io", use the
+// first field (somegroup) as the name of the group in Go code, e.g. as the func name in a clientset.
+func applyGroupOverrides(universe types.Universe, args *args.Args) error {
+	// Create a map from "old GV" to "new GV" so we know what changes we need to make.
+	changes := make(map[clientgentypes.GroupVersion]clientgentypes.GroupVersion)
+	for gv, inputDir := range args.GroupVersionPackages() {
+		p := universe.Package(inputDir)
+		override, ok, err := apidefinitions.GroupNameForPackage(p.Comments)
+		if err != nil {
+			return err
+		}
+		if ok {
+			newGV := clientgentypes.GroupVersion{
+				Group:   clientgentypes.Group(override),
+				Version: gv.Version,
+			}
+			changes[gv] = newGV
+		}
+	}
+
+	// Modify args.Groups based on the groupName overrides.
+	newGroups := make([]clientgentypes.GroupVersions, 0, len(args.Groups))
+	for _, gvs := range args.Groups {
+		gv := clientgentypes.GroupVersion{
+			Group:   gvs.Group,
+			Version: gvs.Versions[0].Version, // we only need a version, and the first will do
+		}
+		if newGV, ok := changes[gv]; ok {
+			// There's an override, so use it.
+			newGVS := clientgentypes.GroupVersions{
+				PackageName: gvs.PackageName,
+				Group:       newGV.Group,
+				Versions:    gvs.Versions,
+			}
+			newGroups = append(newGroups, newGVS)
+		} else {
+			// No override.
+			newGroups = append(newGroups, gvs)
+		}
+	}
+	args.Groups = newGroups
+	return nil
+}
+
+// Because we try to assemble inputs from an input-base and a set of
+// group-version arguments, sometimes that comes in as a filesystem path.  This
+// function rewrites them all as their canonical Go import-paths.
+//
+// TODO: Change this tool to just take inputs as Go "patterns" like every other
+// gengo tool, then extract GVs from those.
+func sanitizePackagePaths(context *generator.Context, args *args.Args) error {
+	for i := range args.Groups {
+		pkg := &args.Groups[i]
+		for j := range pkg.Versions {
+			ver := &pkg.Versions[j]
+			input := ver.Package
+			p := context.Universe[input]
+			if p == nil || p.Name == "" {
+				pkgs, err := context.FindPackages(input)
+				if err != nil {
+					return fmt.Errorf("can't find input package %q: %w", input, err)
+				}
+				p = context.Universe[pkgs[0]]
+				if p == nil {
+					return fmt.Errorf("can't find input package %q in universe", input)
+				}
+				ver.Package = p.Path
+			}
+		}
+	}
+	return nil
+}
+
+// GetTargets makes the client target definition.
+func GetTargets(context *generator.Context, args *args.Args) []generator.Target {
+	boilerplate, err := gengo.GoBoilerplate(args.GoHeaderFile, "", gengo.StdGeneratedBy)
+	if err != nil {
+		klog.Fatalf("Failed loading boilerplate: %v", err)
+	}
+
+	includedTypesOverrides := args.IncludedTypesOverrides
+
+	if err := sanitizePackagePaths(context, args); err != nil {
+		klog.Fatalf("cannot sanitize inputs: %v", err)
+	}
+	if err := applyGroupOverrides(context.Universe, args); err != nil {
+		klog.Fatalf("cannot apply group overrides: %v", err)
+	}
+
+	var idOpts []apidefinitions.Option
+	if len(args.LintRules) > 0 {
+		idOpts = append(idOpts, apidefinitions.WithLintRules(args.LintRules...))
+	}
+
+	gvToTypes := map[clientgentypes.GroupVersion][]*types.Type{}
+	groupGoNames := make(map[clientgentypes.GroupVersion]string)
+	for gv, inputDir := range args.GroupVersionPackages() {
+		p := context.Universe.Package(inputDir)
+
+		info, err := apidefinitions.Identify(p, apidefinitions.Client, idOpts...)
+		if err != nil {
+			klog.Fatal(err)
+		}
+		if !info.ShouldGenerate() {
+			continue
+		}
+
+		// If there's a comment of the form "// +groupGoName=SomeUniqueShortName", use that as
+		// the Go group identifier in CamelCase. It defaults
+		groupGoNames[gv] = namer.IC(strings.Split(gv.Group.NonEmpty(), ".")[0])
+		override, err := genutil.ExtractCommentTagsWithoutArguments("+", []string{"groupGoName"}, p.Comments)
+		if err != nil {
+			klog.Fatalf("cannot extract groupGoName tags: %v", err)
+		}
+		if override["groupGoName"] != nil {
+			groupGoNames[gv] = namer.IC(override["groupGoName"][0])
+		}
+
+		for n, t := range p.Types {
+			// filter out types which are not included in user specified overrides.
+			typesOverride, ok := includedTypesOverrides[gv]
+			if ok {
+				found := false
+				for _, typeStr := range typesOverride {
+					if typeStr == n {
+						found = true
+						break
+					}
+				}
+				if !found {
+					continue
+				}
+			} else {
+				// User has not specified any override for this group version.
+				// filter out types which don't have genclient.
+				if tags := util.MustParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...)); !tags.GenerateClient {
+					continue
+				}
+			}
+			if _, found := gvToTypes[gv]; !found {
+				gvToTypes[gv] = []*types.Type{}
+			}
+			gvToTypes[gv] = append(gvToTypes[gv], t)
+		}
+	}
+
+	clientsetDir := filepath.Join(args.OutputDir, args.ClientsetName)
+	clientsetPkg := path.Join(args.OutputPkg, args.ClientsetName)
+
+	var targetList []generator.Target
+
+	targetList = append(targetList,
+		targetForClientset(args, clientsetDir, clientsetPkg, groupGoNames, boilerplate))
+	targetList = append(targetList,
+		targetForScheme(args, clientsetDir, clientsetPkg, groupGoNames, boilerplate))
+	if args.FakeClient {
+		targetList = append(targetList,
+			fake.TargetForClientset(args, clientsetDir, clientsetPkg, args.ApplyConfigurationPackage, groupGoNames, boilerplate))
+	}
+
+	// If --clientset-only=true, we don't regenerate the individual typed clients.
+	if args.ClientsetOnly {
+		return []generator.Target(targetList)
+	}
+
+	orderer := namer.Orderer{Namer: namer.NewPrivateNamer(0)}
+	gvPackages := args.GroupVersionPackages()
+	for _, group := range args.Groups {
+		for _, version := range group.Versions {
+			gv := clientgentypes.GroupVersion{Group: group.Group, Version: version.Version}
+			types := gvToTypes[gv]
+			inputPath := gvPackages[gv]
+			targetList = append(targetList,
+				targetForGroup(
+					gv, orderer.OrderTypes(types), clientsetDir, clientsetPkg,
+					group.PackageName, groupGoNames[gv], args.ClientsetAPIPath,
+					inputPath, args.ApplyConfigurationPackage, boilerplate, args.PrefersProtobuf))
+			if args.FakeClient {
+				targetList = append(targetList,
+					fake.TargetForGroup(gv, orderer.OrderTypes(types), clientsetDir, clientsetPkg, group.PackageName, groupGoNames[gv], inputPath, args.ApplyConfigurationPackage, boilerplate))
+			}
+		}
+	}
+
+	return targetList
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/fake/fake_client_generator.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/fake/fake_client_generator.go
new file mode 100644
index 0000000000..935efec21a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/fake/fake_client_generator.go
@@ -0,0 +1,132 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fake
+
+import (
+	"path"
+	"path/filepath"
+	"strings"
+
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/types"
+
+	"k8s.io/code-generator/cmd/client-gen/args"
+	scheme "k8s.io/code-generator/cmd/client-gen/generators/scheme"
+	"k8s.io/code-generator/cmd/client-gen/generators/util"
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+)
+
+func TargetForGroup(gv clientgentypes.GroupVersion, typeList []*types.Type, clientsetDir, clientsetPkg string, groupPkgName string, groupGoName string, inputPkg string, applyBuilderPackage string, boilerplate []byte) generator.Target {
+	// TODO: should make this a function, called by here and in client-generator.go
+	subdir := []string{"typed", strings.ToLower(groupPkgName), strings.ToLower(gv.Version.NonEmpty())}
+	outputDir := filepath.Join(clientsetDir, filepath.Join(subdir...), "fake")
+	outputPkg := path.Join(clientsetPkg, path.Join(subdir...), "fake")
+	realClientPkg := path.Join(clientsetPkg, path.Join(subdir...))
+
+	return &generator.SimpleTarget{
+		PkgName:       "fake",
+		PkgPath:       outputPkg,
+		PkgDir:        outputDir,
+		HeaderComment: boilerplate,
+		PkgDocComment: []byte("// Package fake has the automatically generated clients.\n"),
+		// GeneratorsFunc returns a list of generators. Each generator makes a
+		// single file.
+		GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+			generators = []generator.Generator{
+				// Always generate a "doc.go" file.
+				generator.GoGenerator{OutputFilename: "doc.go"},
+			}
+			// Since we want a file per type that we generate a client for, we
+			// have to provide a function for this.
+			for _, t := range typeList {
+				generators = append(generators, &genFakeForType{
+					GoGenerator: generator.GoGenerator{
+						OutputFilename: "fake_" + strings.ToLower(c.Namers["private"].Name(t)) + ".go",
+					},
+					outputPackage:             outputPkg,
+					realClientPackage:         realClientPkg,
+					inputPackage:              inputPkg,
+					version:                   gv.Version.String(),
+					groupGoName:               groupGoName,
+					typeToMatch:               t,
+					imports:                   generator.NewImportTrackerForPackage(outputPkg),
+					applyConfigurationPackage: applyBuilderPackage,
+				})
+			}
+
+			generators = append(generators, &genFakeForGroup{
+				GoGenerator: generator.GoGenerator{
+					OutputFilename: "fake_" + groupPkgName + "_client.go",
+				},
+				outputPackage:     outputPkg,
+				realClientPackage: realClientPkg,
+				version:           gv.Version.String(),
+				groupGoName:       groupGoName,
+				types:             typeList,
+				imports:           generator.NewImportTrackerForPackage(outputPkg),
+			})
+			return generators
+		},
+		FilterFunc: func(c *generator.Context, t *types.Type) bool {
+			return util.MustParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...)).GenerateClient
+		},
+	}
+}
+
+func TargetForClientset(args *args.Args, clientsetDir, clientsetPkg string, applyConfigurationPkg string, groupGoNames map[clientgentypes.GroupVersion]string, boilerplate []byte) generator.Target {
+	return &generator.SimpleTarget{
+		// TODO: we'll generate fake clientset for different release in the future.
+		// Package name and path are hard coded for now.
+		PkgName:       "fake",
+		PkgPath:       path.Join(clientsetPkg, "fake"),
+		PkgDir:        filepath.Join(clientsetDir, "fake"),
+		HeaderComment: boilerplate,
+		PkgDocComment: []byte("// This package has the automatically generated fake clientset.\n"),
+		// GeneratorsFunc returns a list of generators. Each generator generates a
+		// single file.
+		GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+			generators = []generator.Generator{
+				// Always generate a "doc.go" file.
+				generator.GoGenerator{OutputFilename: "doc.go"},
+
+				&genClientset{
+					GoGenerator: generator.GoGenerator{
+						OutputFilename: "clientset_generated.go",
+					},
+					groups:                    args.Groups,
+					groupGoNames:              groupGoNames,
+					fakeClientsetPackage:      clientsetPkg,
+					imports:                   generator.NewImportTrackerForPackage(clientsetPkg),
+					realClientsetPackage:      clientsetPkg,
+					applyConfigurationPackage: applyConfigurationPkg,
+				},
+				&scheme.GenScheme{
+					GoGenerator: generator.GoGenerator{
+						OutputFilename: "register.go",
+					},
+					InputPackages: args.GroupVersionPackages(),
+					OutputPkg:     clientsetPkg,
+					Groups:        args.Groups,
+					GroupGoNames:  groupGoNames,
+					ImportTracker: generator.NewImportTrackerForPackage(clientsetPkg),
+					PrivateScheme: true,
+				},
+			}
+			return generators
+		},
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/fake/generator_fake_for_clientset.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/fake/generator_fake_for_clientset.go
new file mode 100644
index 0000000000..3343942cf6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/fake/generator_fake_for_clientset.go
@@ -0,0 +1,238 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fake
+
+import (
+	"fmt"
+	"io"
+	"path"
+	"strings"
+
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+)
+
+// genClientset generates a package for a clientset.
+type genClientset struct {
+	generator.GoGenerator
+	groups               []clientgentypes.GroupVersions
+	groupGoNames         map[clientgentypes.GroupVersion]string
+	fakeClientsetPackage string // must be a Go import-path
+	imports              namer.ImportTracker
+	clientsetGenerated   bool
+	// the import path of the generated real clientset.
+	realClientsetPackage      string // must be a Go import-path
+	applyConfigurationPackage string
+}
+
+var _ generator.Generator = &genClientset{}
+
+func (g *genClientset) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.fakeClientsetPackage, g.imports),
+	}
+}
+
+// We only want to call GenerateType() once.
+func (g *genClientset) Filter(c *generator.Context, t *types.Type) bool {
+	ret := !g.clientsetGenerated
+	g.clientsetGenerated = true
+	return ret
+}
+
+func (g *genClientset) Imports(c *generator.Context) (imports []string) {
+	imports = append(imports, g.imports.ImportLines()...)
+	for _, group := range g.groups {
+		for _, version := range group.Versions {
+			groupClientPackage := path.Join(g.fakeClientsetPackage, "typed", strings.ToLower(group.PackageName), strings.ToLower(version.NonEmpty()))
+			fakeGroupClientPackage := path.Join(groupClientPackage, "fake")
+
+			groupAlias := strings.ToLower(g.groupGoNames[clientgentypes.GroupVersion{Group: group.Group, Version: version.Version}])
+			imports = append(imports, fmt.Sprintf("%s%s \"%s\"", groupAlias, strings.ToLower(version.NonEmpty()), groupClientPackage))
+			imports = append(imports, fmt.Sprintf("fake%s%s \"%s\"", groupAlias, strings.ToLower(version.NonEmpty()), fakeGroupClientPackage))
+		}
+	}
+	// the package that has the clientset Interface
+	imports = append(imports, fmt.Sprintf("clientset \"%s\"", g.realClientsetPackage))
+	// imports for the code in commonTemplate
+	imports = append(imports,
+		"k8s.io/client-go/testing",
+		"k8s.io/client-go/discovery",
+		"fakediscovery \"k8s.io/client-go/discovery/fake\"",
+		"k8s.io/apimachinery/pkg/runtime",
+		"k8s.io/apimachinery/pkg/watch",
+		"metav1 \"k8s.io/apimachinery/pkg/apis/meta/v1\"",
+	)
+
+	return
+}
+
+func (g *genClientset) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	generateApply := len(g.applyConfigurationPackage) > 0
+
+	// TODO: We actually don't need any type information to generate the clientset,
+	// perhaps we can adapt the go2ild framework to this kind of usage.
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+
+	allGroups := clientgentypes.ToGroupVersionInfo(g.groups, g.groupGoNames)
+
+	sw.Do(common, nil)
+
+	if generateApply {
+		sw.Do(managedFieldsClientset, map[string]any{
+			"newTypeConverter": types.Ref(g.applyConfigurationPackage, "NewTypeConverter"),
+		})
+	}
+
+	sw.Do(checkImpl, nil)
+
+	for _, group := range allGroups {
+		m := map[string]interface{}{
+			"group":        group.Group,
+			"version":      group.Version,
+			"PackageAlias": group.PackageAlias,
+			"GroupGoName":  group.GroupGoName,
+			"Version":      namer.IC(group.Version.String()),
+		}
+
+		sw.Do(clientsetInterfaceImplTemplate, m)
+	}
+
+	return sw.Error()
+}
+
+// This part of code is version-independent, unchanging.
+
+var managedFieldsClientset = `
+// NewClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+//
+// Compared to NewSimpleClientset, the Clientset returned here supports field tracking and thus
+// server-side apply. Beware though that support in that for CRDs is missing
+// (https://github.com/kubernetes/kubernetes/issues/126850).
+func NewClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewFieldManagedObjectTracker(
+		scheme,
+		codecs.UniversalDecoder(),
+		$.newTypeConverter|raw$(scheme),
+	)
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{tracker: o}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+        var opts metav1.ListOptions
+        if watchAction, ok := action.(testing.WatchActionImpl); ok {
+            opts = watchAction.ListOptions
+        }
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns, opts)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+`
+
+var common = `
+// NewSimpleClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any field management, validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+func NewSimpleClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewObjectTracker(scheme, codecs.UniversalDecoder())
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{tracker: o}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+        var opts metav1.ListOptions
+        if watchAction, ok := action.(testing.WatchActionImpl); ok {
+            opts = watchAction.ListOptions
+        }
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns, opts)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
+// Clientset implements clientset.Interface. Meant to be embedded into a
+// struct to get a default implementation. This makes faking out just the method
+// you want to test easier.
+type Clientset struct {
+	testing.Fake
+	discovery *fakediscovery.FakeDiscovery
+	tracker testing.ObjectTracker
+}
+
+func (c *Clientset) Discovery() discovery.DiscoveryInterfaces {
+	return c.discovery
+}
+
+func (c *Clientset) Tracker() testing.ObjectTracker {
+	return c.tracker
+}
+
+// IsWatchListSemanticsUnSupported informs the reflector that this client
+// doesn't support WatchList semantics.
+//
+// This is a synthetic method whose sole purpose is to satisfy the optional
+// interface check performed by the reflector.
+// Returning true signals that WatchList can NOT be used.
+// No additional logic is implemented here.
+func (c *Clientset) IsWatchListSemanticsUnSupported() bool {
+	return true
+}
+`
+
+var checkImpl = `
+var (
+	_ clientset.Interface = &Clientset{}
+	_ testing.FakeClient  = &Clientset{}
+)
+`
+
+var clientsetInterfaceImplTemplate = `
+// $.GroupGoName$$.Version$ retrieves the $.GroupGoName$$.Version$Client
+func (c *Clientset) $.GroupGoName$$.Version$() $.PackageAlias$.$.GroupGoName$$.Version$Interface {
+	return &fake$.PackageAlias$.Fake$.GroupGoName$$.Version${Fake: &c.Fake}
+}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/fake/generator_fake_for_group.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/fake/generator_fake_for_group.go
new file mode 100644
index 0000000000..04c586a0ed
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/fake/generator_fake_for_group.go
@@ -0,0 +1,131 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fake
+
+import (
+	"fmt"
+	"io"
+	"path"
+	"strings"
+
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+
+	"k8s.io/code-generator/cmd/client-gen/generators/util"
+)
+
+// genFakeForGroup produces a file for a group client, e.g. ExtensionsClient for the extension group.
+type genFakeForGroup struct {
+	generator.GoGenerator
+	outputPackage     string // must be a Go import-path
+	realClientPackage string // must be a Go import-path
+	version           string
+	groupGoName       string
+	// types in this group
+	types   []*types.Type
+	imports namer.ImportTracker
+	// If the genGroup has been called. This generator should only execute once.
+	called bool
+}
+
+var _ generator.Generator = &genFakeForGroup{}
+
+// We only want to call GenerateType() once per group.
+func (g *genFakeForGroup) Filter(c *generator.Context, t *types.Type) bool {
+	if !g.called {
+		g.called = true
+		return true
+	}
+	return false
+}
+
+func (g *genFakeForGroup) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.outputPackage, g.imports),
+	}
+}
+
+func (g *genFakeForGroup) Imports(c *generator.Context) (imports []string) {
+	imports = g.imports.ImportLines()
+	if len(g.types) != 0 {
+		imports = append(imports, fmt.Sprintf("%s \"%s\"", strings.ToLower(path.Base(g.realClientPackage)), g.realClientPackage))
+	}
+	return imports
+}
+
+func (g *genFakeForGroup) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+
+	m := map[string]interface{}{
+		"GroupGoName":         g.groupGoName,
+		"Version":             namer.IC(g.version),
+		"Fake":                c.Universe.Type(types.Name{Package: "k8s.io/client-go/testing", Name: "Fake"}),
+		"RESTClientInterface": c.Universe.Type(types.Name{Package: "k8s.io/client-go/rest", Name: "Interface"}),
+		"RESTClient":          c.Universe.Type(types.Name{Package: "k8s.io/client-go/rest", Name: "RESTClient"}),
+		"FakeClient":          c.Universe.Type(types.Name{Package: "k8s.io/client-go/gentype", Name: "FakeClient"}),
+		"NewFakeClient":       c.Universe.Function(types.Name{Package: "k8s.io/client-go/gentype", Name: "NewFakeClient"}),
+	}
+
+	sw.Do(groupClientTemplate, m)
+	for _, t := range g.types {
+		tags, err := util.ParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...))
+		if err != nil {
+			return err
+		}
+		wrapper := map[string]interface{}{
+			"type":              t,
+			"GroupGoName":       g.groupGoName,
+			"Version":           namer.IC(g.version),
+			"realClientPackage": strings.ToLower(path.Base(g.realClientPackage)),
+		}
+		if tags.NonNamespaced {
+			sw.Do(getterImplNonNamespaced, wrapper)
+			continue
+		}
+		sw.Do(getterImplNamespaced, wrapper)
+	}
+	sw.Do(getRESTClient, m)
+	return sw.Error()
+}
+
+var groupClientTemplate = `
+type Fake$.GroupGoName$$.Version$ struct {
+	*$.Fake|raw$
+}
+`
+
+var getterImplNamespaced = `
+func (c *Fake$.GroupGoName$$.Version$) $.type|publicPlural$(namespace string) $.realClientPackage$.$.type|public$Interface {
+	return newFake$.type|publicPlural$(c, namespace)
+}
+`
+
+var getterImplNonNamespaced = `
+func (c *Fake$.GroupGoName$$.Version$) $.type|publicPlural$() $.realClientPackage$.$.type|public$Interface {
+	return newFake$.type|publicPlural$(c)
+}
+`
+
+var getRESTClient = `
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *Fake$.GroupGoName$$.Version$) RESTClient() $.RESTClientInterface|raw$ {
+	var ret *$.RESTClient|raw$
+	return ret
+}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/fake/generator_fake_for_type.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/fake/generator_fake_for_type.go
new file mode 100644
index 0000000000..6c1410039e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/fake/generator_fake_for_type.go
@@ -0,0 +1,543 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fake
+
+import (
+	"io"
+	"path"
+	"strings"
+
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
+
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+
+	"k8s.io/code-generator/cmd/client-gen/generators/util"
+)
+
+// genFakeForType produces a file for each top-level type.
+type genFakeForType struct {
+	generator.GoGenerator
+	outputPackage             string // Must be a Go import-path
+	realClientPackage         string // Must be a Go import-path
+	version                   string
+	groupGoName               string
+	inputPackage              string
+	typeToMatch               *types.Type
+	imports                   namer.ImportTracker
+	applyConfigurationPackage string
+}
+
+var _ generator.Generator = &genFakeForType{}
+
+var titler = cases.Title(language.Und)
+
+// Filter ignores all but one type because we're making a single file per type.
+func (g *genFakeForType) Filter(c *generator.Context, t *types.Type) bool { return t == g.typeToMatch }
+
+func (g *genFakeForType) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.outputPackage, g.imports),
+	}
+}
+
+func (g *genFakeForType) Imports(c *generator.Context) (imports []string) {
+	return g.imports.ImportLines()
+}
+
+// GenerateType makes the body of a file implementing the individual typed client for type t.
+func (g *genFakeForType) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+	tags, err := util.ParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...))
+	if err != nil {
+		return err
+	}
+
+	const pkgClientGoTesting = "k8s.io/client-go/testing"
+	m := map[string]interface{}{
+		"type":                t,
+		"inputType":           t,
+		"resultType":          t,
+		"subresourcePath":     "",
+		"namespaced":          !tags.NonNamespaced,
+		"GroupGoName":         g.groupGoName,
+		"Version":             namer.IC(g.version),
+		"realClientInterface": c.Universe.Type(types.Name{Package: g.realClientPackage, Name: t.Name.Name + "Interface"}),
+		"SchemeGroupVersion":  c.Universe.Type(types.Name{Package: t.Name.Package, Name: "SchemeGroupVersion"}),
+		"CreateOptions":       c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "CreateOptions"}),
+		"DeleteOptions":       c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "DeleteOptions"}),
+		"GetOptions":          c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "GetOptions"}),
+		"ListOptions":         c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "ListOptions"}),
+		"PatchOptions":        c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "PatchOptions"}),
+		"ApplyOptions":        c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "ApplyOptions"}),
+		"UpdateOptions":       c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "UpdateOptions"}),
+		"PatchType":           c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/types", Name: "PatchType"}),
+		"ApplyPatchType":      c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/types", Name: "ApplyPatchType"}),
+		"watchInterface":      c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/watch", Name: "Interface"}),
+		"jsonMarshal":         c.Universe.Type(types.Name{Package: "encoding/json", Name: "Marshal"}),
+		"fmtErrorf":           c.Universe.Type(types.Name{Package: "fmt", Name: "Errorf"}),
+		"contextContext":      c.Universe.Type(types.Name{Package: "context", Name: "Context"}),
+
+		"NewRootListActionWithOptions":              c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewRootListActionWithOptions"}),
+		"NewListActionWithOptions":                  c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewListActionWithOptions"}),
+		"NewRootGetActionWithOptions":               c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewRootGetActionWithOptions"}),
+		"NewGetActionWithOptions":                   c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewGetActionWithOptions"}),
+		"NewRootDeleteActionWithOptions":            c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewRootDeleteActionWithOptions"}),
+		"NewDeleteActionWithOptions":                c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewDeleteActionWithOptions"}),
+		"NewRootUpdateActionWithOptions":            c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewRootUpdateActionWithOptions"}),
+		"NewUpdateActionWithOptions":                c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewUpdateActionWithOptions"}),
+		"NewRootCreateActionWithOptions":            c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewRootCreateActionWithOptions"}),
+		"NewCreateActionWithOptions":                c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewCreateActionWithOptions"}),
+		"NewRootWatchActionWithOptions":             c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewRootWatchActionWithOptions"}),
+		"NewWatchActionWithOptions":                 c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewWatchActionWithOptions"}),
+		"NewCreateSubresourceActionWithOptions":     c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewCreateSubresourceActionWithOptions"}),
+		"NewRootCreateSubresourceActionWithOptions": c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewRootCreateSubresourceActionWithOptions"}),
+		"NewUpdateSubresourceActionWithOptions":     c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewUpdateSubresourceActionWithOptions"}),
+		"NewGetSubresourceActionWithOptions":        c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewGetSubresourceActionWithOptions"}),
+		"NewRootGetSubresourceActionWithOptions":    c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewRootGetSubresourceActionWithOptions"}),
+		"NewRootUpdateSubresourceActionWithOptions": c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewRootUpdateSubresourceActionWithOptions"}),
+		"NewRootPatchSubresourceActionWithOptions":  c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewRootPatchSubresourceActionWithOptions"}),
+		"NewPatchSubresourceActionWithOptions":      c.Universe.Function(types.Name{Package: pkgClientGoTesting, Name: "NewPatchSubresourceActionWithOptions"}),
+		"FakeClient":                                c.Universe.Type(types.Name{Package: "k8s.io/client-go/gentype", Name: "FakeClient"}),
+		"NewFakeClient":                             c.Universe.Function(types.Name{Package: "k8s.io/client-go/gentype", Name: "NewFakeClient"}),
+		"FakeClientWithApply":                       c.Universe.Type(types.Name{Package: "k8s.io/client-go/gentype", Name: "FakeClientWithApply"}),
+		"NewFakeClientWithApply":                    c.Universe.Function(types.Name{Package: "k8s.io/client-go/gentype", Name: "NewFakeClientWithApply"}),
+		"FakeClientWithList":                        c.Universe.Type(types.Name{Package: "k8s.io/client-go/gentype", Name: "FakeClientWithList"}),
+		"NewFakeClientWithList":                     c.Universe.Function(types.Name{Package: "k8s.io/client-go/gentype", Name: "NewFakeClientWithList"}),
+		"FakeClientWithListAndApply":                c.Universe.Type(types.Name{Package: "k8s.io/client-go/gentype", Name: "FakeClientWithListAndApply"}),
+		"NewFakeClientWithListAndApply":             c.Universe.Function(types.Name{Package: "k8s.io/client-go/gentype", Name: "NewFakeClientWithListAndApply"}),
+	}
+
+	generateApply := len(g.applyConfigurationPackage) > 0
+	if generateApply {
+		// Generated apply builder type references required for generated Apply function
+		_, gvString := util.ParsePathGroupVersion(g.inputPackage)
+		m["inputApplyConfig"] = types.Ref(path.Join(g.applyConfigurationPackage, gvString), t.Name.Name+"ApplyConfiguration")
+	}
+
+	listableOrAppliable := noList | noApply
+
+	if !tags.NoVerbs && tags.HasVerb("list") {
+		listableOrAppliable |= withList
+	}
+
+	if !tags.NoVerbs && tags.HasVerb("apply") && generateApply {
+		listableOrAppliable |= withApply
+	}
+
+	sw.Do(structType[listableOrAppliable], m)
+	sw.Do(newStruct[listableOrAppliable], m)
+
+	if tags.NoVerbs {
+		return sw.Error()
+	}
+
+	_, typeGVString := util.ParsePathGroupVersion(g.inputPackage)
+
+	// generate extended client methods
+	for _, e := range tags.Extensions {
+		if e.HasVerb("apply") && !generateApply {
+			continue
+		}
+		inputType := *t
+		resultType := *t
+		inputGVString := typeGVString
+		if len(e.InputTypeOverride) > 0 {
+			if name, pkg := e.Input(); len(pkg) > 0 {
+				_, inputGVString = util.ParsePathGroupVersion(pkg)
+				newType := c.Universe.Type(types.Name{Package: pkg, Name: name})
+				inputType = *newType
+			} else {
+				inputType.Name.Name = e.InputTypeOverride
+			}
+		}
+		if len(e.ResultTypeOverride) > 0 {
+			if name, pkg := e.Result(); len(pkg) > 0 {
+				newType := c.Universe.Type(types.Name{Package: pkg, Name: name})
+				resultType = *newType
+			} else {
+				resultType.Name.Name = e.ResultTypeOverride
+			}
+		}
+		m["inputType"] = &inputType
+		m["resultType"] = &resultType
+		m["subresourcePath"] = e.SubResourcePath
+		if e.HasVerb("apply") {
+			m["inputApplyConfig"] = types.Ref(path.Join(g.applyConfigurationPackage, inputGVString), inputType.Name.Name+"ApplyConfiguration")
+		}
+
+		if e.HasVerb("get") {
+			if e.IsSubresource() {
+				sw.Do(adjustTemplate(e.VerbName, e.VerbType, getSubresourceTemplate), m)
+			} else {
+				sw.Do(adjustTemplate(e.VerbName, e.VerbType, getTemplate), m)
+			}
+		}
+
+		if e.HasVerb("list") {
+			sw.Do(adjustTemplate(e.VerbName, e.VerbType, listTemplate), m)
+		}
+
+		// TODO: Figure out schemantic for watching a sub-resource.
+		if e.HasVerb("watch") {
+			sw.Do(adjustTemplate(e.VerbName, e.VerbType, watchTemplate), m)
+		}
+
+		if e.HasVerb("create") {
+			if e.IsSubresource() {
+				sw.Do(adjustTemplate(e.VerbName, e.VerbType, createSubresourceTemplate), m)
+			} else {
+				sw.Do(adjustTemplate(e.VerbName, e.VerbType, createTemplate), m)
+			}
+		}
+
+		if e.HasVerb("update") {
+			if e.IsSubresource() {
+				sw.Do(adjustTemplate(e.VerbName, e.VerbType, updateSubresourceTemplate), m)
+			} else {
+				sw.Do(adjustTemplate(e.VerbName, e.VerbType, updateTemplate), m)
+			}
+		}
+
+		// TODO: Figure out schemantic for deleting a sub-resource (what arguments
+		// are passed, does it need two names? etc.
+		if e.HasVerb("delete") {
+			sw.Do(adjustTemplate(e.VerbName, e.VerbType, deleteTemplate), m)
+		}
+
+		if e.HasVerb("patch") {
+			sw.Do(adjustTemplate(e.VerbName, e.VerbType, patchTemplate), m)
+		}
+
+		if e.HasVerb("apply") && generateApply {
+			if e.IsSubresource() {
+				sw.Do(adjustTemplate(e.VerbName, e.VerbType, applySubresourceTemplate), m)
+			} else {
+				sw.Do(adjustTemplate(e.VerbName, e.VerbType, applyTemplate), m)
+			}
+		}
+	}
+
+	return sw.Error()
+}
+
+// adjustTemplate adjust the origin verb template using the expansion name.
+// TODO: Make the verbs in templates parametrized so the strings.Replace() is
+// not needed.
+func adjustTemplate(name, verbType, template string) string {
+	return strings.ReplaceAll(template, " "+titler.String(verbType), " "+name)
+}
+
+// struct and constructor variants
+const (
+	// The following values are bits in a bitmask.
+	// The values which can be set indicate list support and apply support;
+	// to make the declarations easier to read (like a truth table), corresponding zero-values
+	// are also declared.
+	noList   = 0
+	noApply  = 0
+	withList = 1 << iota
+	withApply
+)
+
+// The following string slices are similar to maps, but with combinable keys used as indices.
+// Each entry defines whether it supports lists and/or apply; each bit is then toggled:
+// * noList, noApply: index 0;
+// * withList, noApply: index 1;
+// * noList, withApply: index 2;
+// * withList, withApply: index 3.
+// Go enforces index unicity in these kinds of declarations.
+
+// struct declarations
+var structType = []string{
+	noList | noApply: `
+	// fake$.type|publicPlural$ implements $.type|public$Interface
+	type fake$.type|publicPlural$ struct {
+		*$.FakeClient|raw$[*$.type|raw$]
+		Fake *Fake$.GroupGoName$$.Version$
+	}
+	`,
+	withList | noApply: `
+	// fake$.type|publicPlural$ implements $.type|public$Interface
+	type fake$.type|publicPlural$ struct {
+		*$.FakeClientWithList|raw$[*$.type|raw$, *$.type|raw$List]
+		Fake *Fake$.GroupGoName$$.Version$
+	}
+	`,
+	noList | withApply: `
+	// fake$.type|publicPlural$ implements $.type|public$Interface
+	type fake$.type|publicPlural$ struct {
+		*$.FakeClientWithApply|raw$[*$.type|raw$, *$.inputApplyConfig|raw$]
+		Fake *Fake$.GroupGoName$$.Version$
+	}
+	`,
+	withList | withApply: `
+	// fake$.type|publicPlural$ implements $.type|public$Interface
+	type fake$.type|publicPlural$ struct {
+		*$.FakeClientWithListAndApply|raw$[*$.type|raw$, *$.type|raw$List, *$.inputApplyConfig|raw$]
+		Fake *Fake$.GroupGoName$$.Version$
+	}
+	`,
+}
+
+// Constructors for the struct, in all variants
+var newStruct = []string{
+	noList | noApply: `
+	func newFake$.type|publicPlural$(fake *Fake$.GroupGoName$$.Version$$if .namespaced$, namespace string$end$) $.realClientInterface|raw$ {
+		return &fake$.type|publicPlural${
+			$.NewFakeClient|raw$[*$.type|raw$](
+				fake.Fake,
+				$if .namespaced$namespace$else$""$end$,
+				$.SchemeGroupVersion|raw$.WithResource("$.type|resource$"),
+				$.SchemeGroupVersion|raw$.WithKind("$.type|singularKind$"),
+				func() *$.type|raw$ {return &$.type|raw${}},
+			),
+			fake,
+		}
+	}
+	`,
+	noList | withApply: `
+	func newFake$.type|publicPlural$(fake *Fake$.GroupGoName$$.Version$$if .namespaced$, namespace string$end$) $.realClientInterface|raw$ {
+		return &fake$.type|publicPlural${
+			$.NewFakeClientWithApply|raw$[*$.type|raw$, *$.inputApplyConfig|raw$](
+				fake.Fake,
+				$if .namespaced$namespace$else$""$end$,
+				$.SchemeGroupVersion|raw$.WithResource("$.type|resource$"),
+				$.SchemeGroupVersion|raw$.WithKind("$.type|singularKind$"),
+				func() *$.type|raw$ {return &$.type|raw${}},
+			),
+			fake,
+		}
+	}
+	`,
+	withList | noApply: `
+	func newFake$.type|publicPlural$(fake *Fake$.GroupGoName$$.Version$$if .namespaced$, namespace string$end$) $.realClientInterface|raw$ {
+		return &fake$.type|publicPlural${
+			$.NewFakeClientWithList|raw$[*$.type|raw$, *$.type|raw$List](
+				fake.Fake,
+				$if .namespaced$namespace$else$""$end$,
+				$.SchemeGroupVersion|raw$.WithResource("$.type|resource$"),
+				$.SchemeGroupVersion|raw$.WithKind("$.type|singularKind$"),
+				func() *$.type|raw$ {return &$.type|raw${}},
+				func() *$.type|raw$List {return &$.type|raw$List{}},
+				func(dst, src *$.type|raw$List) {dst.ListMeta = src.ListMeta},
+				func(list *$.type|raw$List) []*$.type|raw$ {return gentype.ToPointerSlice(list.Items)},
+				func(list *$.type|raw$List, items []*$.type|raw$) {list.Items = gentype.FromPointerSlice(items)},
+			),
+			fake,
+		}
+	}
+	`,
+	withList | withApply: `
+	func newFake$.type|publicPlural$(fake *Fake$.GroupGoName$$.Version$$if .namespaced$, namespace string$end$) $.realClientInterface|raw$ {
+		return &fake$.type|publicPlural${
+			$.NewFakeClientWithListAndApply|raw$[*$.type|raw$, *$.type|raw$List, *$.inputApplyConfig|raw$](
+				fake.Fake,
+				$if .namespaced$namespace$else$""$end$,
+				$.SchemeGroupVersion|raw$.WithResource("$.type|resource$"),
+				$.SchemeGroupVersion|raw$.WithKind("$.type|singularKind$"),
+				func() *$.type|raw$ {return &$.type|raw${}},
+				func() *$.type|raw$List {return &$.type|raw$List{}},
+				func(dst, src *$.type|raw$List) {dst.ListMeta = src.ListMeta},
+				func(list *$.type|raw$List) []*$.type|raw$ {return gentype.ToPointerSlice(list.Items)},
+				func(list *$.type|raw$List, items []*$.type|raw$) {list.Items = gentype.FromPointerSlice(items)},
+			),
+			fake,
+		}
+	}
+	`,
+}
+
+var listTemplate = `
+// List takes label and field selectors, and returns the list of $.type|publicPlural$ that match those selectors.
+func (c *fake$.type|publicPlural$) List(ctx $.contextContext|raw$, opts $.ListOptions|raw$) (result *$.type|raw$List, err error) {
+	emptyResult := &$.type|raw$List{}
+	obj, err := c.Fake.
+		$if .namespaced$Invokes($.NewListActionWithOptions|raw$(c.Resource(), c.Kind(), c.Namespace(), opts), emptyResult)
+		$else$Invokes($.NewRootListActionWithOptions|raw$(c.Resource(), c.Kind(), opts), emptyResult)$end$
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*$.type|raw$List), err
+}
+`
+
+var getTemplate = `
+// Get takes name of the $.type|private$, and returns the corresponding $.resultType|private$ object, and an error if there is any.
+func (c *fake$.type|publicPlural$) Get(ctx $.contextContext|raw$, name string, options $.GetOptions|raw$) (result *$.resultType|raw$, err error) {
+	emptyResult := &$.resultType|raw${}
+	obj, err := c.Fake.
+		$if .namespaced$Invokes($.NewGetActionWithOptions|raw$(c.Resource(), c.Namespace(), name, options), emptyResult)
+		$else$Invokes($.NewRootGetActionWithOptions|raw$(c.Resource(), name, options), emptyResult)$end$
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*$.resultType|raw$), err
+}
+`
+
+var getSubresourceTemplate = `
+// Get takes name of the $.type|private$, and returns the corresponding $.resultType|private$ object, and an error if there is any.
+func (c *fake$.type|publicPlural$) Get(ctx $.contextContext|raw$, $.type|private$Name string, options $.GetOptions|raw$) (result *$.resultType|raw$, err error) {
+	emptyResult := &$.resultType|raw${}
+	obj, err := c.Fake.
+		$if .namespaced$Invokes($.NewGetSubresourceActionWithOptions|raw$(c.Resource(), c.Namespace(), "$.subresourcePath$", $.type|private$Name, options), emptyResult)
+		$else$Invokes($.NewRootGetSubresourceActionWithOptions|raw$(c.Resource(), "$.subresourcePath$", $.type|private$Name, options), emptyResult)$end$
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*$.resultType|raw$), err
+}
+`
+
+var deleteTemplate = `
+// Delete takes name of the $.type|private$ and deletes it. Returns an error if one occurs.
+func (c *fake$.type|publicPlural$) Delete(ctx $.contextContext|raw$, name string, opts $.DeleteOptions|raw$) error {
+	_, err := c.Fake.
+		$if .namespaced$Invokes($.NewDeleteActionWithOptions|raw$(c.Resource(), c.Namespace(), name, opts), &$.type|raw${})
+		$else$Invokes($.NewRootDeleteActionWithOptions|raw$(c.Resource(), name, opts), &$.type|raw${})$end$
+	return err
+}
+`
+
+var createTemplate = `
+// Create takes the representation of a $.inputType|private$ and creates it.  Returns the server's representation of the $.resultType|private$, and an error, if there is any.
+func (c *fake$.type|publicPlural$) Create(ctx $.contextContext|raw$, $.inputType|private$ *$.inputType|raw$, opts $.CreateOptions|raw$) (result *$.resultType|raw$, err error) {
+	emptyResult := &$.resultType|raw${}
+	obj, err := c.Fake.
+		$if .namespaced$Invokes($.NewCreateActionWithOptions|raw$(c.Resource(), c.Namespace(), $.inputType|private$, opts), emptyResult)
+		$else$Invokes($.NewRootCreateActionWithOptions|raw$(c.Resource(), $.inputType|private$, opts), emptyResult)$end$
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*$.resultType|raw$), err
+}
+`
+
+var createSubresourceTemplate = `
+// Create takes the representation of a $.inputType|private$ and creates it.  Returns the server's representation of the $.resultType|private$, and an error, if there is any.
+func (c *fake$.type|publicPlural$) Create(ctx $.contextContext|raw$, $.type|private$Name string, $.inputType|private$ *$.inputType|raw$, opts $.CreateOptions|raw$) (result *$.resultType|raw$, err error) {
+	emptyResult := &$.resultType|raw${}
+	obj, err := c.Fake.
+		$if .namespaced$Invokes($.NewCreateSubresourceActionWithOptions|raw$(c.Resource(), $.type|private$Name, "$.subresourcePath$", c.Namespace(), $.inputType|private$, opts), emptyResult)
+		$else$Invokes($.NewRootCreateSubresourceActionWithOptions|raw$(c.Resource(), $.type|private$Name, "$.subresourcePath$", $.inputType|private$, opts), emptyResult)$end$
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*$.resultType|raw$), err
+}
+`
+
+var updateTemplate = `
+// Update takes the representation of a $.inputType|private$ and updates it. Returns the server's representation of the $.resultType|private$, and an error, if there is any.
+func (c *fake$.type|publicPlural$) Update(ctx $.contextContext|raw$, $.inputType|private$ *$.inputType|raw$, opts $.UpdateOptions|raw$) (result *$.resultType|raw$, err error) {
+	emptyResult := &$.resultType|raw${}
+	obj, err := c.Fake.
+		$if .namespaced$Invokes($.NewUpdateActionWithOptions|raw$(c.Resource(), c.Namespace(), $.inputType|private$, opts), emptyResult)
+		$else$Invokes($.NewRootUpdateActionWithOptions|raw$(c.Resource(), $.inputType|private$, opts), emptyResult)$end$
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*$.resultType|raw$), err
+}
+`
+
+var updateSubresourceTemplate = `
+// Update takes the representation of a $.inputType|private$ and updates it. Returns the server's representation of the $.resultType|private$, and an error, if there is any.
+func (c *fake$.type|publicPlural$) Update(ctx $.contextContext|raw$, $.type|private$Name string, $.inputType|private$ *$.inputType|raw$, opts $.UpdateOptions|raw$) (result *$.resultType|raw$, err error) {
+	emptyResult := &$.resultType|raw${}
+	obj, err := c.Fake.
+		$if .namespaced$Invokes($.NewUpdateSubresourceActionWithOptions|raw$(c.Resource(), "$.subresourcePath$", c.Namespace(), $.inputType|private$, opts), &$.inputType|raw${})
+		$else$Invokes($.NewRootUpdateSubresourceActionWithOptions|raw$(c.Resource(), "$.subresourcePath$", $.inputType|private$, opts), emptyResult)$end$
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*$.resultType|raw$), err
+}
+`
+
+var watchTemplate = `
+// Watch returns a $.watchInterface|raw$ that watches the requested $.type|privatePlural$.
+func (c *fake$.type|publicPlural$) Watch(ctx $.contextContext|raw$, opts $.ListOptions|raw$) ($.watchInterface|raw$, error) {
+	return c.Fake.
+		$if .namespaced$InvokesWatch($.NewWatchActionWithOptions|raw$(c.Resource(), c.Namespace(), opts))
+		$else$InvokesWatch($.NewRootWatchActionWithOptions|raw$(c.Resource(), opts))$end$
+}
+`
+
+var patchTemplate = `
+// Patch applies the patch and returns the patched $.resultType|private$.
+func (c *fake$.type|publicPlural$) Patch(ctx $.contextContext|raw$, name string, pt $.PatchType|raw$, data []byte, opts $.PatchOptions|raw$, subresources ...string) (result *$.resultType|raw$, err error) {
+	emptyResult := &$.resultType|raw${}
+	obj, err := c.Fake.
+		$if .namespaced$Invokes($.NewPatchSubresourceActionWithOptions|raw$(c.Resource(), c.Namespace(), name, pt, data, opts, subresources... ), emptyResult)
+		$else$Invokes($.NewRootPatchSubresourceActionWithOptions|raw$(c.Resource(), name, pt, data, opts, subresources...), emptyResult)$end$
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*$.resultType|raw$), err
+}
+`
+
+var applyTemplate = `
+// Apply takes the given apply declarative configuration, applies it and returns the applied $.resultType|private$.
+func (c *fake$.type|publicPlural$) Apply(ctx $.contextContext|raw$, $.inputType|private$ *$.inputApplyConfig|raw$, opts $.ApplyOptions|raw$) (result *$.resultType|raw$, err error) {
+	if $.inputType|private$ == nil {
+		return nil, $.fmtErrorf|raw$("$.inputType|private$ provided to Apply must not be nil")
+	}
+	data, err := $.jsonMarshal|raw$($.inputType|private$)
+	if err != nil {
+		return nil, err
+	}
+	name := $.inputType|private$.Name
+	if name == nil {
+		return nil, $.fmtErrorf|raw$("$.inputType|private$.Name must be provided to Apply")
+	}
+	emptyResult := &$.resultType|raw${}
+	obj, err := c.Fake.
+		$if .namespaced$Invokes($.NewPatchSubresourceActionWithOptions|raw$(c.Resource(), c.Namespace(), *name, $.ApplyPatchType|raw$, data, opts.ToPatchOptions()), emptyResult)
+		$else$Invokes($.NewRootPatchSubresourceActionWithOptions|raw$(c.Resource(), *name, $.ApplyPatchType|raw$, data, opts.ToPatchOptions()), emptyResult)$end$
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*$.resultType|raw$), err
+}
+`
+
+var applySubresourceTemplate = `
+// Apply takes top resource name and the apply declarative configuration for $.subresourcePath$,
+// applies it and returns the applied $.resultType|private$, and an error, if there is any.
+func (c *fake$.type|publicPlural$) Apply(ctx $.contextContext|raw$, $.type|private$Name string, $.inputType|private$ *$.inputApplyConfig|raw$, opts $.ApplyOptions|raw$) (result *$.resultType|raw$, err error) {
+	if $.inputType|private$ == nil {
+		return nil, $.fmtErrorf|raw$("$.inputType|private$ provided to Apply must not be nil")
+	}
+	data, err := $.jsonMarshal|raw$($.inputType|private$)
+	if err != nil {
+		return nil, err
+	}
+	emptyResult := &$.resultType|raw${}
+	obj, err := c.Fake.
+		$if .namespaced$Invokes($.NewPatchSubresourceActionWithOptions|raw$(c.Resource(), c.Namespace(), $.type|private$Name, $.ApplyPatchType|raw$, data, opts.ToPatchOptions(), "$.inputType|private$"), emptyResult)
+		$else$Invokes($.NewRootPatchSubresourceActionWithOptions|raw$(c.Resource(), $.type|private$Name, $.ApplyPatchType|raw$, data, opts.ToPatchOptions(), "$.inputType|private$"), emptyResult)$end$
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*$.resultType|raw$), err
+}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/generator_for_clientset.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/generator_for_clientset.go
new file mode 100644
index 0000000000..7609c907b2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/generator_for_clientset.go
@@ -0,0 +1,210 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"fmt"
+	"io"
+	"path"
+	"strings"
+
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+)
+
+// genClientset generates a package for a clientset.
+type genClientset struct {
+	generator.GoGenerator
+	groups             []clientgentypes.GroupVersions
+	groupGoNames       map[clientgentypes.GroupVersion]string
+	clientsetPackage   string // must be a Go import-path
+	imports            namer.ImportTracker
+	clientsetGenerated bool
+}
+
+var _ generator.Generator = &genClientset{}
+
+func (g *genClientset) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.clientsetPackage, g.imports),
+	}
+}
+
+// We only want to call GenerateType() once.
+func (g *genClientset) Filter(c *generator.Context, t *types.Type) bool {
+	ret := !g.clientsetGenerated
+	g.clientsetGenerated = true
+	return ret
+}
+
+func (g *genClientset) Imports(c *generator.Context) (imports []string) {
+	imports = append(imports, g.imports.ImportLines()...)
+	for _, group := range g.groups {
+		for _, version := range group.Versions {
+			typedClientPath := path.Join(g.clientsetPackage, "typed", strings.ToLower(group.PackageName), strings.ToLower(version.NonEmpty()))
+			groupAlias := strings.ToLower(g.groupGoNames[clientgentypes.GroupVersion{Group: group.Group, Version: version.Version}])
+			imports = append(imports, fmt.Sprintf("%s%s \"%s\"", groupAlias, strings.ToLower(version.NonEmpty()), typedClientPath))
+		}
+	}
+	return
+}
+
+func (g *genClientset) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	// TODO: We actually don't need any type information to generate the clientset,
+	// perhaps we can adapt the go2ild framework to this kind of usage.
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+
+	allGroups := clientgentypes.ToGroupVersionInfo(g.groups, g.groupGoNames)
+	m := map[string]interface{}{
+		"allGroups":                            allGroups,
+		"fmtErrorf":                            c.Universe.Type(types.Name{Package: "fmt", Name: "Errorf"}),
+		"Config":                               c.Universe.Type(types.Name{Package: "k8s.io/client-go/rest", Name: "Config"}),
+		"DefaultKubernetesUserAgent":           c.Universe.Function(types.Name{Package: "k8s.io/client-go/rest", Name: "DefaultKubernetesUserAgent"}),
+		"RESTClientInterface":                  c.Universe.Type(types.Name{Package: "k8s.io/client-go/rest", Name: "Interface"}),
+		"RESTHTTPClientFor":                    c.Universe.Function(types.Name{Package: "k8s.io/client-go/rest", Name: "HTTPClientFor"}),
+		"DiscoveryInterfaces":                  c.Universe.Type(types.Name{Package: "k8s.io/client-go/discovery", Name: "DiscoveryInterfaces"}),
+		"DiscoveryClient":                      c.Universe.Type(types.Name{Package: "k8s.io/client-go/discovery", Name: "DiscoveryClient"}),
+		"httpClient":                           c.Universe.Type(types.Name{Package: "net/http", Name: "Client"}),
+		"NewDiscoveryClientForConfigAndClient": c.Universe.Function(types.Name{Package: "k8s.io/client-go/discovery", Name: "NewDiscoveryClientForConfigAndClient"}),
+		"NewDiscoveryClientForConfigOrDie":     c.Universe.Function(types.Name{Package: "k8s.io/client-go/discovery", Name: "NewDiscoveryClientForConfigOrDie"}),
+		"NewDiscoveryClient":                   c.Universe.Function(types.Name{Package: "k8s.io/client-go/discovery", Name: "NewDiscoveryClient"}),
+		"flowcontrolNewTokenBucketRateLimiter": c.Universe.Function(types.Name{Package: "k8s.io/client-go/util/flowcontrol", Name: "NewTokenBucketRateLimiter"}),
+	}
+	sw.Do(clientsetInterface, m)
+	sw.Do(clientsetTemplate, m)
+	for _, g := range allGroups {
+		sw.Do(clientsetInterfaceImplTemplate, g)
+	}
+	sw.Do(getDiscoveryTemplate, m)
+	sw.Do(newClientsetForConfigTemplate, m)
+	sw.Do(newClientsetForConfigAndClientTemplate, m)
+	sw.Do(newClientsetForConfigOrDieTemplate, m)
+	sw.Do(newClientsetForRESTClientTemplate, m)
+
+	return sw.Error()
+}
+
+var clientsetInterface = `
+type Interface interface {
+	Discovery() $.DiscoveryInterfaces|raw$
+    $range .allGroups$$.GroupGoName$$.Version$() $.PackageAlias$.$.GroupGoName$$.Version$Interface
+	$end$
+}
+`
+
+var clientsetTemplate = `
+// Clientset contains the clients for groups.
+type Clientset struct {
+	*$.DiscoveryClient|raw$
+    $range .allGroups$$.LowerCaseGroupGoName$$.Version$ *$.PackageAlias$.$.GroupGoName$$.Version$Client
+    $end$
+}
+`
+
+var clientsetInterfaceImplTemplate = `
+// $.GroupGoName$$.Version$ retrieves the $.GroupGoName$$.Version$Client
+func (c *Clientset) $.GroupGoName$$.Version$() $.PackageAlias$.$.GroupGoName$$.Version$Interface {
+	return c.$.LowerCaseGroupGoName$$.Version$
+}
+`
+
+var getDiscoveryTemplate = `
+// Discovery retrieves the DiscoveryClient
+func (c *Clientset) Discovery() $.DiscoveryInterfaces|raw$ {
+	if c == nil {
+		return nil
+	}
+	return c.DiscoveryClient
+}
+`
+
+var newClientsetForConfigTemplate = `
+// NewForConfig creates a new Clientset for the given config.
+// If config's RateLimiter is not set and QPS and Burst are acceptable, 
+// NewForConfig will generate a rate-limiter in configShallowCopy.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *$.Config|raw$) (*Clientset, error) {
+	configShallowCopy := *c
+
+	if configShallowCopy.UserAgent == "" {
+		configShallowCopy.UserAgent = $.DefaultKubernetesUserAgent|raw$()
+	}
+
+	// share the transport between all clients
+	httpClient, err := $.RESTHTTPClientFor|raw$(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewForConfigAndClient(&configShallowCopy, httpClient)
+}
+`
+
+var newClientsetForConfigAndClientTemplate = `
+// NewForConfigAndClient creates a new Clientset for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfigAndClient will generate a rate-limiter in configShallowCopy.
+func NewForConfigAndClient(c *$.Config|raw$, httpClient *$.httpClient|raw$) (*Clientset, error) {
+	configShallowCopy := *c
+	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
+		if configShallowCopy.Burst <= 0 {
+			return nil, $.fmtErrorf|raw$("burst is required to be greater than 0 when RateLimiter is not set and QPS is set to greater than 0")
+		}
+		configShallowCopy.RateLimiter = $.flowcontrolNewTokenBucketRateLimiter|raw$(configShallowCopy.QPS, configShallowCopy.Burst)
+	}
+
+	var cs Clientset
+	var err error
+$range .allGroups$    cs.$.LowerCaseGroupGoName$$.Version$, err =$.PackageAlias$.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err!=nil {
+		return nil, err
+	}
+$end$
+	cs.DiscoveryClient, err = $.NewDiscoveryClientForConfigAndClient|raw$(&configShallowCopy, httpClient)
+	if err!=nil {
+		return nil, err
+	}
+	return &cs, nil
+}
+`
+
+var newClientsetForConfigOrDieTemplate = `
+// NewForConfigOrDie creates a new Clientset for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *$.Config|raw$) *Clientset {
+	cs, err := NewForConfig(c)
+	if err!=nil {
+		panic(err)
+	}
+	return cs
+}
+`
+
+var newClientsetForRESTClientTemplate = `
+// New creates a new Clientset for the given RESTClient.
+func New(c $.RESTClientInterface|raw$) *Clientset {
+	var cs Clientset
+$range .allGroups$    cs.$.LowerCaseGroupGoName$$.Version$ =$.PackageAlias$.New(c)
+$end$
+	cs.DiscoveryClient = $.NewDiscoveryClient|raw$(c)
+	return &cs
+}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/generator_for_expansion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/generator_for_expansion.go
new file mode 100644
index 0000000000..5971cc5bcd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/generator_for_expansion.go
@@ -0,0 +1,54 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/types"
+)
+
+// genExpansion produces a file for a group client, e.g. ExtensionsClient for the extension group.
+type genExpansion struct {
+	generator.GoGenerator
+	groupPackagePath string
+	// types in a group
+	types []*types.Type
+}
+
+// We only want to call GenerateType() once per group.
+func (g *genExpansion) Filter(c *generator.Context, t *types.Type) bool {
+	return len(g.types) == 0 || t == g.types[0]
+}
+
+func (g *genExpansion) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+	for _, t := range g.types {
+		if _, err := os.Stat(filepath.Join(g.groupPackagePath, strings.ToLower(t.Name.Name+"_expansion.go"))); os.IsNotExist(err) {
+			sw.Do(expansionInterfaceTemplate, t)
+		}
+	}
+	return sw.Error()
+}
+
+var expansionInterfaceTemplate = `
+type $.|public$Expansion interface {}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/generator_for_group.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/generator_for_group.go
new file mode 100644
index 0000000000..ae86da8380
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/generator_for_group.go
@@ -0,0 +1,260 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"io"
+	"path"
+
+	"k8s.io/code-generator/cmd/client-gen/generators/util"
+	"k8s.io/code-generator/pkg/apidefinitions"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+)
+
+// genGroup produces a file for a group client, e.g. ExtensionsClient for the extension group.
+type genGroup struct {
+	generator.GoGenerator
+	outputPackage string
+	group         string
+	version       string
+	groupGoName   string
+	apiPath       string
+	// types in this group
+	types            []*types.Type
+	imports          namer.ImportTracker
+	inputPackage     string
+	clientsetPackage string // must be a Go import-path
+	// If the genGroup has been called. This generator should only execute once.
+	called bool
+}
+
+var _ generator.Generator = &genGroup{}
+
+// We only want to call GenerateType() once per group.
+func (g *genGroup) Filter(c *generator.Context, t *types.Type) bool {
+	if !g.called {
+		g.called = true
+		return true
+	}
+	return false
+}
+
+func (g *genGroup) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.outputPackage, g.imports),
+	}
+}
+
+func (g *genGroup) Imports(c *generator.Context) (imports []string) {
+	imports = append(imports, g.imports.ImportLines()...)
+	return
+}
+
+func (g *genGroup) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+
+	// allow user to define a group name that's different from the one parsed from the directory.
+	p := c.Universe.Package(g.inputPackage)
+	groupName := g.group
+	override, ok, err := apidefinitions.GroupNameForPackage(p.Comments)
+	if err != nil {
+		return err
+	}
+	if ok {
+		groupName = override
+	}
+
+	apiPath := `"` + g.apiPath + `"`
+	if groupName == "" {
+		apiPath = `"/api"`
+	}
+	schemePackage := path.Join(g.clientsetPackage, "scheme")
+	m := map[string]interface{}{
+		"version":                            g.version,
+		"groupName":                          groupName,
+		"GroupGoName":                        g.groupGoName,
+		"Version":                            namer.IC(g.version),
+		"types":                              g.types,
+		"apiPath":                            apiPath,
+		"httpClient":                         c.Universe.Type(types.Name{Package: "net/http", Name: "Client"}),
+		"schemaGroupVersion":                 c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/runtime/schema", Name: "GroupVersion"}),
+		"runtimeAPIVersionInternal":          c.Universe.Variable(types.Name{Package: "k8s.io/apimachinery/pkg/runtime", Name: "APIVersionInternal"}),
+		"restConfig":                         c.Universe.Type(types.Name{Package: "k8s.io/client-go/rest", Name: "Config"}),
+		"restDefaultKubernetesUserAgent":     c.Universe.Function(types.Name{Package: "k8s.io/client-go/rest", Name: "DefaultKubernetesUserAgent"}),
+		"restRESTClientInterface":            c.Universe.Type(types.Name{Package: "k8s.io/client-go/rest", Name: "Interface"}),
+		"RESTHTTPClientFor":                  c.Universe.Function(types.Name{Package: "k8s.io/client-go/rest", Name: "HTTPClientFor"}),
+		"restRESTClientFor":                  c.Universe.Function(types.Name{Package: "k8s.io/client-go/rest", Name: "RESTClientFor"}),
+		"restRESTClientForConfigAndClient":   c.Universe.Function(types.Name{Package: "k8s.io/client-go/rest", Name: "RESTClientForConfigAndClient"}),
+		"restCodecFactoryForGeneratedClient": c.Universe.Function(types.Name{Package: "k8s.io/client-go/rest", Name: "CodecFactoryForGeneratedClient"}),
+		"SchemeGroupVersion":                 c.Universe.Variable(types.Name{Package: g.inputPackage, Name: "SchemeGroupVersion"}),
+		"SchemePrioritizedVersionsForGroup":  c.Universe.Variable(types.Name{Package: schemePackage, Name: "Scheme.PrioritizedVersionsForGroup"}),
+		"Codecs":                             c.Universe.Variable(types.Name{Package: schemePackage, Name: "Codecs"}),
+		"Scheme":                             c.Universe.Variable(types.Name{Package: schemePackage, Name: "Scheme"}),
+	}
+	sw.Do(groupInterfaceTemplate, m)
+	sw.Do(groupClientTemplate, m)
+	for _, t := range g.types {
+		tags, err := util.ParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...))
+		if err != nil {
+			return err
+		}
+		wrapper := map[string]interface{}{
+			"type":        t,
+			"GroupGoName": g.groupGoName,
+			"Version":     namer.IC(g.version),
+		}
+		if tags.NonNamespaced {
+			sw.Do(getterImplNonNamespaced, wrapper)
+		} else {
+			sw.Do(getterImplNamespaced, wrapper)
+		}
+	}
+	sw.Do(newClientForConfigTemplate, m)
+	sw.Do(newClientForConfigAndClientTemplate, m)
+	sw.Do(newClientForConfigOrDieTemplate, m)
+	sw.Do(newClientForRESTClientTemplate, m)
+	if g.version == "" {
+		sw.Do(setInternalVersionClientDefaultsTemplate, m)
+	} else {
+		sw.Do(setClientDefaultsTemplate, m)
+	}
+	sw.Do(getRESTClient, m)
+
+	return sw.Error()
+}
+
+var groupInterfaceTemplate = `
+type $.GroupGoName$$.Version$Interface interface {
+    RESTClient() $.restRESTClientInterface|raw$
+    $range .types$ $.|publicPlural$Getter
+    $end$
+}
+`
+
+var groupClientTemplate = `
+// $.GroupGoName$$.Version$Client is used to interact with features provided by the $.groupName$ group.
+type $.GroupGoName$$.Version$Client struct {
+	restClient $.restRESTClientInterface|raw$
+}
+`
+
+var getterImplNamespaced = `
+func (c *$.GroupGoName$$.Version$Client) $.type|publicPlural$(namespace string) $.type|public$Interface {
+	return new$.type|publicPlural$(c, namespace)
+}
+`
+
+var getterImplNonNamespaced = `
+func (c *$.GroupGoName$$.Version$Client) $.type|publicPlural$() $.type|public$Interface {
+	return new$.type|publicPlural$(c)
+}
+`
+
+var newClientForConfigTemplate = `
+// NewForConfig creates a new $.GroupGoName$$.Version$Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *$.restConfig|raw$) (*$.GroupGoName$$.Version$Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := $.RESTHTTPClientFor|raw$(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+`
+
+var newClientForConfigAndClientTemplate = `
+// NewForConfigAndClient creates a new $.GroupGoName$$.Version$Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *$.restConfig|raw$, h *$.httpClient|raw$) (*$.GroupGoName$$.Version$Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := $.restRESTClientForConfigAndClient|raw$(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &$.GroupGoName$$.Version$Client{client}, nil
+}
+`
+
+var newClientForConfigOrDieTemplate = `
+// NewForConfigOrDie creates a new $.GroupGoName$$.Version$Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *$.restConfig|raw$) *$.GroupGoName$$.Version$Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+`
+
+var getRESTClient = `
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *$.GroupGoName$$.Version$Client) RESTClient() $.restRESTClientInterface|raw$ {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
+`
+
+var newClientForRESTClientTemplate = `
+// New creates a new $.GroupGoName$$.Version$Client for the given RESTClient.
+func New(c $.restRESTClientInterface|raw$) *$.GroupGoName$$.Version$Client {
+	return &$.GroupGoName$$.Version$Client{c}
+}
+`
+
+var setInternalVersionClientDefaultsTemplate = `
+func setConfigDefaults(config *$.restConfig|raw$) {
+	config.APIPath = $.apiPath$
+	if config.UserAgent == "" {
+		config.UserAgent = $.restDefaultKubernetesUserAgent|raw$()
+	}
+	if config.GroupVersion == nil || config.GroupVersion.Group != $.SchemePrioritizedVersionsForGroup|raw$("$.groupName$")[0].Group {
+		gv := $.SchemePrioritizedVersionsForGroup|raw$("$.groupName$")[0]
+		config.GroupVersion = &gv
+	}
+	config.NegotiatedSerializer = $.restCodecFactoryForGeneratedClient|raw$($.Scheme|raw$, $.Codecs|raw$)
+
+	if config.QPS == 0 {
+		config.QPS = 5
+	}
+	if config.Burst == 0 {
+		config.Burst = 10
+	}
+}
+`
+
+var setClientDefaultsTemplate = `
+func setConfigDefaults(config *$.restConfig|raw$) {
+	gv := $.SchemeGroupVersion|raw$
+	config.GroupVersion =  &gv
+	config.APIPath = $.apiPath$
+	config.NegotiatedSerializer = $.restCodecFactoryForGeneratedClient|raw$($.Scheme|raw$, $.Codecs|raw$).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = $.restDefaultKubernetesUserAgent|raw$()
+	}
+}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/generator_for_type.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/generator_for_type.go
new file mode 100644
index 0000000000..5853cff033
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/generator_for_type.go
@@ -0,0 +1,842 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"io"
+	"path"
+	"strings"
+
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
+
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+
+	"k8s.io/code-generator/cmd/client-gen/generators/util"
+)
+
+// genClientForType produces a file for each top-level type.
+type genClientForType struct {
+	generator.GoGenerator
+	outputPackage             string // must be a Go import-path
+	inputPackage              string
+	clientsetPackage          string // must be a Go import-path
+	applyConfigurationPackage string // must be a Go import-path
+	group                     string
+	version                   string
+	groupGoName               string
+	prefersProtobuf           bool
+	typeToMatch               *types.Type
+	imports                   namer.ImportTracker
+}
+
+var _ generator.Generator = &genClientForType{}
+
+var titler = cases.Title(language.Und)
+
+// Filter ignores all but one type because we're making a single file per type.
+func (g *genClientForType) Filter(c *generator.Context, t *types.Type) bool {
+	return t == g.typeToMatch
+}
+
+func (g *genClientForType) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.outputPackage, g.imports),
+	}
+}
+
+func (g *genClientForType) Imports(c *generator.Context) (imports []string) {
+	return g.imports.ImportLines()
+}
+
+// Ideally, we'd like genStatus to return true if there is a subresource path
+// registered for "status" in the API server, but we do not have that
+// information, so genStatus returns true if the type has a status field.
+func genStatus(t *types.Type) bool {
+	// Default to true if we have a Status member
+	hasStatus := false
+	for _, m := range t.Members {
+		if m.Name == "Status" {
+			hasStatus = true
+			break
+		}
+	}
+	return hasStatus && !util.MustParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...)).NoStatus
+}
+
+// GenerateType makes the body of a file implementing the individual typed client for type t.
+func (g *genClientForType) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	generateApply := len(g.applyConfigurationPackage) > 0
+	defaultVerbTemplates := buildDefaultVerbTemplates(generateApply)
+	subresourceDefaultVerbTemplates := buildSubresourceDefaultVerbTemplates(generateApply)
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+	pkg := path.Base(t.Name.Package)
+	tags, err := util.ParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...))
+	if err != nil {
+		return err
+	}
+	type extendedInterfaceMethod struct {
+		template string
+		args     map[string]interface{}
+	}
+	_, typeGVString := util.ParsePathGroupVersion(g.inputPackage)
+	extendedMethods := []extendedInterfaceMethod{}
+	for _, e := range tags.Extensions {
+		if e.HasVerb("apply") && !generateApply {
+			continue
+		}
+		inputType := *t
+		resultType := *t
+		inputGVString := typeGVString
+		// TODO: Extract this to some helper method as this code is copied into
+		// 2 other places.
+		if len(e.InputTypeOverride) > 0 {
+			if name, pkg := e.Input(); len(pkg) > 0 {
+				_, inputGVString = util.ParsePathGroupVersion(pkg)
+				newType := c.Universe.Type(types.Name{Package: pkg, Name: name})
+				inputType = *newType
+			} else {
+				inputType.Name.Name = e.InputTypeOverride
+			}
+		}
+		if len(e.ResultTypeOverride) > 0 {
+			if name, pkg := e.Result(); len(pkg) > 0 {
+				newType := c.Universe.Type(types.Name{Package: pkg, Name: name})
+				resultType = *newType
+			} else {
+				resultType.Name.Name = e.ResultTypeOverride
+			}
+		}
+		var updatedVerbtemplate string
+		if _, exists := subresourceDefaultVerbTemplates[e.VerbType]; e.IsSubresource() && exists {
+			updatedVerbtemplate = e.VerbName + "(" + strings.TrimPrefix(subresourceDefaultVerbTemplates[e.VerbType], titler.String(e.VerbType)+"(")
+		} else {
+			updatedVerbtemplate = e.VerbName + "(" + strings.TrimPrefix(defaultVerbTemplates[e.VerbType], titler.String(e.VerbType)+"(")
+		}
+		extendedMethod := extendedInterfaceMethod{
+			template: updatedVerbtemplate,
+			args: map[string]interface{}{
+				"type":          t,
+				"inputType":     &inputType,
+				"resultType":    &resultType,
+				"CreateOptions": c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "CreateOptions"}),
+				"GetOptions":    c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "GetOptions"}),
+				"ListOptions":   c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "ListOptions"}),
+				"UpdateOptions": c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "UpdateOptions"}),
+				"ApplyOptions":  c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "ApplyOptions"}),
+				"PatchType":     c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/types", Name: "PatchType"}),
+				"PatchOptions":  c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "PatchOptions"}),
+				"context":       c.Universe.Type(types.Name{Package: "context", Name: "Context"}),
+			},
+		}
+		if e.HasVerb("apply") {
+			extendedMethod.args["inputApplyConfig"] = types.Ref(path.Join(g.applyConfigurationPackage, inputGVString), inputType.Name.Name+"ApplyConfiguration")
+		}
+		extendedMethods = append(extendedMethods, extendedMethod)
+	}
+	m := map[string]interface{}{
+		"type":                      t,
+		"inputType":                 t,
+		"resultType":                t,
+		"package":                   pkg,
+		"Package":                   namer.IC(pkg),
+		"namespaced":                !tags.NonNamespaced,
+		"Group":                     namer.IC(g.group),
+		"subresource":               false,
+		"subresourcePath":           "",
+		"GroupGoName":               g.groupGoName,
+		"prefersProtobuf":           g.prefersProtobuf,
+		"Version":                   namer.IC(g.version),
+		"CreateOptions":             c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "CreateOptions"}),
+		"DeleteOptions":             c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "DeleteOptions"}),
+		"GetOptions":                c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "GetOptions"}),
+		"ListOptions":               c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "ListOptions"}),
+		"PatchOptions":              c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "PatchOptions"}),
+		"ApplyOptions":              c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "ApplyOptions"}),
+		"UpdateOptions":             c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "UpdateOptions"}),
+		"PatchType":                 c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/types", Name: "PatchType"}),
+		"watchInterface":            c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/watch", Name: "Interface"}),
+		"RESTClientInterface":       c.Universe.Type(types.Name{Package: "k8s.io/client-go/rest", Name: "Interface"}),
+		"schemeParameterCodec":      c.Universe.Variable(types.Name{Package: path.Join(g.clientsetPackage, "scheme"), Name: "ParameterCodec"}),
+		"fmtErrorf":                 c.Universe.Function(types.Name{Package: "fmt", Name: "Errorf"}),
+		"klogWarningf":              c.Universe.Function(types.Name{Package: "k8s.io/klog/v2", Name: "Warningf"}),
+		"context":                   c.Universe.Type(types.Name{Package: "context", Name: "Context"}),
+		"timeDuration":              c.Universe.Type(types.Name{Package: "time", Name: "Duration"}),
+		"timeSecond":                c.Universe.Type(types.Name{Package: "time", Name: "Second"}),
+		"applyNewRequest":           c.Universe.Function(types.Name{Package: "k8s.io/client-go/util/apply", Name: "NewRequest"}),
+		"Client":                    c.Universe.Type(types.Name{Package: "k8s.io/client-go/gentype", Name: "Client"}),
+		"ClientWithList":            c.Universe.Type(types.Name{Package: "k8s.io/client-go/gentype", Name: "ClientWithList"}),
+		"ClientWithApply":           c.Universe.Type(types.Name{Package: "k8s.io/client-go/gentype", Name: "ClientWithApply"}),
+		"ClientWithListAndApply":    c.Universe.Type(types.Name{Package: "k8s.io/client-go/gentype", Name: "ClientWithListAndApply"}),
+		"NewClient":                 c.Universe.Function(types.Name{Package: "k8s.io/client-go/gentype", Name: "NewClient"}),
+		"NewClientWithApply":        c.Universe.Function(types.Name{Package: "k8s.io/client-go/gentype", Name: "NewClientWithApply"}),
+		"NewClientWithList":         c.Universe.Function(types.Name{Package: "k8s.io/client-go/gentype", Name: "NewClientWithList"}),
+		"NewClientWithListAndApply": c.Universe.Function(types.Name{Package: "k8s.io/client-go/gentype", Name: "NewClientWithListAndApply"}),
+	}
+
+	if generateApply {
+		// Generated apply configuration type references required for generated Apply function
+		_, gvString := util.ParsePathGroupVersion(g.inputPackage)
+		m["inputApplyConfig"] = types.Ref(path.Join(g.applyConfigurationPackage, gvString), t.Name.Name+"ApplyConfiguration")
+	}
+
+	sw.Do(getterComment, m)
+	if tags.NonNamespaced {
+		sw.Do(getterNonNamespaced, m)
+	} else {
+		sw.Do(getterNamespaced, m)
+	}
+
+	sw.Do(interfaceTemplate1, m)
+	if !tags.NoVerbs {
+		if !genStatus(t) {
+			tags.SkipVerbs = append(tags.SkipVerbs, "updateStatus")
+			tags.SkipVerbs = append(tags.SkipVerbs, "applyStatus")
+		}
+		interfaceSuffix := ""
+		if len(extendedMethods) > 0 {
+			interfaceSuffix = "\n"
+		}
+		sw.Do("\n"+generateInterface(defaultVerbTemplates, tags)+interfaceSuffix, m)
+		// add extended verbs into interface
+		for _, v := range extendedMethods {
+			sw.Do(v.template+interfaceSuffix, v.args)
+		}
+
+	}
+	sw.Do(interfaceTemplate4, m)
+
+	structNamespaced := namespaced
+	if tags.NonNamespaced {
+		structNamespaced = nonNamespaced
+	}
+
+	if tags.NoVerbs {
+		sw.Do(structType[noList|noApply], m)
+		sw.Do(newStruct[structNamespaced|noList|noApply], m)
+
+		return sw.Error()
+	}
+
+	listableOrAppliable := noList | noApply
+
+	if tags.HasVerb("list") {
+		listableOrAppliable |= withList
+	}
+
+	if tags.HasVerb("apply") && generateApply {
+		listableOrAppliable |= withApply
+	}
+
+	sw.Do(structType[listableOrAppliable], m)
+	sw.Do(newStruct[structNamespaced|listableOrAppliable], m)
+
+	// generate expansion methods
+	for _, e := range tags.Extensions {
+		if e.HasVerb("apply") && !generateApply {
+			continue
+		}
+		inputType := *t
+		resultType := *t
+		inputGVString := typeGVString
+		if len(e.InputTypeOverride) > 0 {
+			if name, pkg := e.Input(); len(pkg) > 0 {
+				_, inputGVString = util.ParsePathGroupVersion(pkg)
+				newType := c.Universe.Type(types.Name{Package: pkg, Name: name})
+				inputType = *newType
+			} else {
+				inputType.Name.Name = e.InputTypeOverride
+			}
+		}
+		if len(e.ResultTypeOverride) > 0 {
+			if name, pkg := e.Result(); len(pkg) > 0 {
+				newType := c.Universe.Type(types.Name{Package: pkg, Name: name})
+				resultType = *newType
+			} else {
+				resultType.Name.Name = e.ResultTypeOverride
+			}
+		}
+		m["inputType"] = &inputType
+		m["resultType"] = &resultType
+		m["subresourcePath"] = e.SubResourcePath
+		m["verb"] = e.VerbName
+		if e.HasVerb("apply") {
+			m["inputApplyConfig"] = types.Ref(path.Join(g.applyConfigurationPackage, inputGVString), inputType.Name.Name+"ApplyConfiguration")
+		}
+
+		if e.HasVerb("get") {
+			if e.IsSubresource() {
+				sw.Do(getSubresourceTemplate, m)
+			} else {
+				sw.Do(getTemplate, m)
+			}
+		}
+
+		if e.HasVerb("list") {
+			if e.IsSubresource() {
+				sw.Do(listSubresourceTemplate, m)
+			} else {
+				sw.Do(listTemplate, m)
+			}
+		}
+
+		// TODO: Figure out schemantic for watching a sub-resource.
+		if e.HasVerb("watch") {
+			sw.Do(watchTemplate, m)
+		}
+
+		if e.HasVerb("create") {
+			if e.IsSubresource() {
+				sw.Do(createSubresourceTemplate, m)
+			} else {
+				sw.Do(createTemplate, m)
+			}
+		}
+
+		if e.HasVerb("update") {
+			if e.IsSubresource() {
+				sw.Do(updateSubresourceTemplate, m)
+			} else {
+				sw.Do(updateTemplate, m)
+			}
+		}
+
+		// TODO: Figure out schemantic for deleting a sub-resource (what arguments
+		// are passed, does it need two names? etc.
+		if e.HasVerb("delete") {
+			sw.Do(deleteTemplate, m)
+		}
+
+		if e.HasVerb("patch") {
+			sw.Do(patchTemplate, m)
+		}
+
+		if e.HasVerb("apply") {
+			if e.IsSubresource() {
+				sw.Do(applySubresourceTemplate, m)
+			} else {
+				sw.Do(applyTemplate, m)
+			}
+		}
+	}
+
+	return sw.Error()
+}
+
+func generateInterface(defaultVerbTemplates map[string]string, tags util.Tags) string {
+	// need an ordered list here to guarantee order of generated methods.
+	out := []string{}
+	for _, m := range util.SupportedVerbs {
+		if tags.HasVerb(m) && len(defaultVerbTemplates[m]) > 0 {
+			out = append(out, defaultVerbTemplates[m])
+		}
+	}
+	return strings.Join(out, "\n")
+}
+
+func buildSubresourceDefaultVerbTemplates(generateApply bool) map[string]string {
+	m := map[string]string{
+		"create": `Create(ctx $.context|raw$, $.type|private$Name string, $.inputType|private$ *$.inputType|raw$, opts $.CreateOptions|raw$) (*$.resultType|raw$, error)`,
+		"list":   `List(ctx $.context|raw$, $.type|private$Name string, opts $.ListOptions|raw$) (*$.resultType|raw$List, error)`,
+		"update": `Update(ctx $.context|raw$, $.type|private$Name string, $.inputType|private$ *$.inputType|raw$, opts $.UpdateOptions|raw$) (*$.resultType|raw$, error)`,
+		"get":    `Get(ctx $.context|raw$, $.type|private$Name string, options $.GetOptions|raw$) (*$.resultType|raw$, error)`,
+	}
+	if generateApply {
+		m["apply"] = `Apply(ctx $.context|raw$, $.type|private$Name string, $.inputType|private$ *$.inputApplyConfig|raw$, opts $.ApplyOptions|raw$) (*$.resultType|raw$, error)`
+	}
+	return m
+}
+
+func buildDefaultVerbTemplates(generateApply bool) map[string]string {
+	m := map[string]string{
+		"create": `Create(ctx $.context|raw$, $.inputType|private$ *$.inputType|raw$, opts $.CreateOptions|raw$) (*$.resultType|raw$, error)`,
+		"update": `Update(ctx $.context|raw$, $.inputType|private$ *$.inputType|raw$, opts $.UpdateOptions|raw$) (*$.resultType|raw$, error)`,
+		"updateStatus": `// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+UpdateStatus(ctx $.context|raw$, $.inputType|private$ *$.type|raw$, opts $.UpdateOptions|raw$) (*$.type|raw$, error)`,
+		"delete":           `Delete(ctx $.context|raw$, name string, opts $.DeleteOptions|raw$) error`,
+		"deleteCollection": `DeleteCollection(ctx $.context|raw$, opts $.DeleteOptions|raw$, listOpts $.ListOptions|raw$) error`,
+		"get":              `Get(ctx $.context|raw$, name string, opts $.GetOptions|raw$) (*$.resultType|raw$, error)`,
+		"list":             `List(ctx $.context|raw$, opts $.ListOptions|raw$) (*$.resultType|raw$List, error)`,
+		"watch":            `Watch(ctx $.context|raw$, opts $.ListOptions|raw$) ($.watchInterface|raw$, error)`,
+		"patch":            `Patch(ctx $.context|raw$, name string, pt $.PatchType|raw$, data []byte, opts $.PatchOptions|raw$, subresources ...string) (result *$.resultType|raw$, err error)`,
+	}
+	if generateApply {
+		m["apply"] = `Apply(ctx $.context|raw$, $.inputType|private$ *$.inputApplyConfig|raw$, opts $.ApplyOptions|raw$) (result *$.resultType|raw$, err error)`
+		m["applyStatus"] = `// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+ApplyStatus(ctx $.context|raw$, $.inputType|private$ *$.inputApplyConfig|raw$, opts $.ApplyOptions|raw$) (result *$.resultType|raw$, err error)`
+	}
+	return m
+}
+
+// group client will implement this interface.
+var getterComment = `
+// $.type|publicPlural$Getter has a method to return a $.type|public$Interface.
+// A group's client should implement this interface.`
+
+var getterNamespaced = `
+type $.type|publicPlural$Getter interface {
+	$.type|publicPlural$(namespace string) $.type|public$Interface
+}
+`
+
+var getterNonNamespaced = `
+type $.type|publicPlural$Getter interface {
+	$.type|publicPlural$() $.type|public$Interface
+}
+`
+
+// this type's interface, typed client will implement this interface.
+var interfaceTemplate1 = `
+// $.type|public$Interface has methods to work with $.type|public$ resources.
+type $.type|public$Interface interface {`
+
+var interfaceTemplate4 = `
+	$.type|public$Expansion
+}
+`
+
+// struct and constructor variants
+const (
+	// The following values are bits in a bitmask.
+	// The values which can be set indicate namespace support, list support, and apply support;
+	// to make the declarations easier to read (like a truth table), corresponding zero-values
+	// are also declared.
+	namespaced    = 0
+	noList        = 0
+	noApply       = 0
+	nonNamespaced = 1 << iota
+	withList
+	withApply
+)
+
+// The following string slices are similar to maps, but with combinable keys used as indices.
+// Each entry defines whether it supports lists and/or apply, and if namespacedness matters,
+// namespaces; each bit is then toggled:
+// * noList, noApply: index 0;
+// * withList, noApply: index 2;
+// * noList, withApply: index 4;
+// * withList, withApply: index 6.
+// When namespacedness matters, the namespaced variants are the same as the above, and
+// the non-namespaced variants are offset by 1.
+// Go enforces index unicity in these kinds of declarations.
+
+// struct declarations
+// Namespacedness does not matter
+var structType = []string{
+	noList | noApply: `
+	// $.type|privatePlural$ implements $.type|public$Interface
+	type $.type|privatePlural$ struct {
+		*$.Client|raw$[*$.resultType|raw$]
+	}
+	`,
+	withList | noApply: `
+	// $.type|privatePlural$ implements $.type|public$Interface
+	type $.type|privatePlural$ struct {
+		*$.ClientWithList|raw$[*$.resultType|raw$, *$.resultType|raw$List]
+	}
+	`,
+	noList | withApply: `
+	// $.type|privatePlural$ implements $.type|public$Interface
+	type $.type|privatePlural$ struct {
+		*$.ClientWithApply|raw$[*$.resultType|raw$, *$.inputApplyConfig|raw$]
+	}
+	`,
+	withList | withApply: `
+	// $.type|privatePlural$ implements $.type|public$Interface
+	type $.type|privatePlural$ struct {
+		*$.ClientWithListAndApply|raw$[*$.resultType|raw$, *$.resultType|raw$List, *$.inputApplyConfig|raw$]
+	}
+	`,
+}
+
+// Constructors for the struct, in all variants
+// Namespacedness matters
+var newStruct = []string{
+	namespaced | noList | noApply: `
+	// new$.type|publicPlural$ returns a $.type|publicPlural$
+	func new$.type|publicPlural$(c *$.GroupGoName$$.Version$Client, namespace string) *$.type|privatePlural$ {
+		return &$.type|privatePlural${
+			$.NewClient|raw$[*$.resultType|raw$](
+				"$.type|resource$",
+				c.RESTClient(),
+				$.schemeParameterCodec|raw$,
+				namespace,
+				func() *$.resultType|raw$ { return &$.resultType|raw${} },
+				$if .prefersProtobuf$gentype.PrefersProtobuf[*$.resultType|raw$](),$end$
+			),
+		}
+	}
+	`,
+	namespaced | noList | withApply: `
+	// new$.type|publicPlural$ returns a $.type|publicPlural$
+	func new$.type|publicPlural$(c *$.GroupGoName$$.Version$Client, namespace string) *$.type|privatePlural$ {
+		return &$.type|privatePlural${
+			$.NewClientWithApply|raw$[*$.resultType|raw$, *$.inputApplyConfig|raw$](
+				"$.type|resource$",
+				c.RESTClient(),
+				$.schemeParameterCodec|raw$,
+				namespace,
+				func() *$.resultType|raw$ { return &$.resultType|raw${} },
+				$if .prefersProtobuf$gentype.PrefersProtobuf[*$.resultType|raw$](),$end$
+			),
+		}
+	}
+	`,
+	namespaced | withList | noApply: `
+	// new$.type|publicPlural$ returns a $.type|publicPlural$
+	func new$.type|publicPlural$(c *$.GroupGoName$$.Version$Client, namespace string) *$.type|privatePlural$ {
+		return &$.type|privatePlural${
+			$.NewClientWithList|raw$[*$.resultType|raw$, *$.resultType|raw$List](
+				"$.type|resource$",
+				c.RESTClient(),
+				$.schemeParameterCodec|raw$,
+				namespace,
+				func() *$.resultType|raw$ { return &$.resultType|raw${} },
+				func() *$.resultType|raw$List { return &$.resultType|raw$List{} },
+				$if .prefersProtobuf$gentype.PrefersProtobuf[*$.resultType|raw$](),$end$
+			),
+		}
+	}
+	`,
+	namespaced | withList | withApply: `
+	// new$.type|publicPlural$ returns a $.type|publicPlural$
+	func new$.type|publicPlural$(c *$.GroupGoName$$.Version$Client, namespace string) *$.type|privatePlural$ {
+		return &$.type|privatePlural${
+			$.NewClientWithListAndApply|raw$[*$.resultType|raw$, *$.resultType|raw$List, *$.inputApplyConfig|raw$](
+				"$.type|resource$",
+				c.RESTClient(),
+				$.schemeParameterCodec|raw$,
+				namespace,
+				func() *$.resultType|raw$ { return &$.resultType|raw${} },
+				func() *$.resultType|raw$List { return &$.resultType|raw$List{} },
+				$if .prefersProtobuf$gentype.PrefersProtobuf[*$.resultType|raw$](),$end$
+			),
+		}
+	}
+	`,
+	nonNamespaced | noList | noApply: `
+	// new$.type|publicPlural$ returns a $.type|publicPlural$
+	func new$.type|publicPlural$(c *$.GroupGoName$$.Version$Client) *$.type|privatePlural$ {
+		return &$.type|privatePlural${
+			$.NewClient|raw$[*$.resultType|raw$](
+				"$.type|resource$",
+				c.RESTClient(),
+				$.schemeParameterCodec|raw$,
+				"",
+				func() *$.resultType|raw$ { return &$.resultType|raw${} },
+				$if .prefersProtobuf$gentype.PrefersProtobuf[*$.resultType|raw$](),$end$
+			),
+		}
+	}
+	`,
+	nonNamespaced | noList | withApply: `
+	// new$.type|publicPlural$ returns a $.type|publicPlural$
+	func new$.type|publicPlural$(c *$.GroupGoName$$.Version$Client) *$.type|privatePlural$ {
+		return &$.type|privatePlural${
+			$.NewClientWithApply|raw$[*$.resultType|raw$, *$.inputApplyConfig|raw$](
+				"$.type|resource$",
+				c.RESTClient(),
+				$.schemeParameterCodec|raw$,
+				"",
+				func() *$.resultType|raw$ { return &$.resultType|raw${} },
+				$if .prefersProtobuf$gentype.PrefersProtobuf[*$.resultType|raw$](),$end$
+			),
+		}
+	}
+	`,
+	nonNamespaced | withList | noApply: `
+	// new$.type|publicPlural$ returns a $.type|publicPlural$
+	func new$.type|publicPlural$(c *$.GroupGoName$$.Version$Client) *$.type|privatePlural$ {
+		return &$.type|privatePlural${
+			$.NewClientWithList|raw$[*$.resultType|raw$, *$.resultType|raw$List](
+				"$.type|resource$",
+				c.RESTClient(),
+				$.schemeParameterCodec|raw$,
+				"",
+				func() *$.resultType|raw$ { return &$.resultType|raw${} },
+				func() *$.resultType|raw$List { return &$.resultType|raw$List{} },
+				$if .prefersProtobuf$gentype.PrefersProtobuf[*$.resultType|raw$](),$end$
+			),
+		}
+	}
+	`,
+	nonNamespaced | withList | withApply: `
+	// new$.type|publicPlural$ returns a $.type|publicPlural$
+	func new$.type|publicPlural$(c *$.GroupGoName$$.Version$Client) *$.type|privatePlural$ {
+		return &$.type|privatePlural${
+			$.NewClientWithListAndApply|raw$[*$.resultType|raw$, *$.resultType|raw$List, *$.inputApplyConfig|raw$](
+				"$.type|resource$",
+				c.RESTClient(),
+				$.schemeParameterCodec|raw$,
+				"",
+				func() *$.resultType|raw$ { return &$.resultType|raw${} },
+				func() *$.resultType|raw$List { return &$.resultType|raw$List{} },
+				$if .prefersProtobuf$gentype.PrefersProtobuf[*$.resultType|raw$](),$end$
+			),
+		}
+	}
+	`,
+}
+
+var listTemplate = `
+// $.verb$ takes label and field selectors, and returns the list of $.resultType|publicPlural$ that match those selectors.
+func (c *$.type|privatePlural$) $.verb$(ctx $.context|raw$, opts $.ListOptions|raw$) (result *$.resultType|raw$List, err error) {
+	var timeout $.timeDuration|raw$
+	if opts.TimeoutSeconds != nil{
+		timeout = $.timeDuration|raw$(*opts.TimeoutSeconds) * $.timeSecond|raw$
+	}
+	result = &$.resultType|raw$List{}
+	err = c.GetClient().Get().
+		$if .prefersProtobuf$UseProtobufAsDefault().$end$
+		$if .namespaced$Namespace(c.GetNamespace()).$end$
+		Resource("$.type|resource$").
+		VersionedParams(&opts, $.schemeParameterCodec|raw$).
+		Timeout(timeout).
+		Do(ctx).
+		Into(result)
+	return
+}
+`
+
+var listSubresourceTemplate = `
+// $.verb$ takes $.type|raw$ name, label and field selectors, and returns the list of $.resultType|publicPlural$ that match those selectors.
+func (c *$.type|privatePlural$) $.verb$(ctx $.context|raw$, $.type|private$Name string, opts $.ListOptions|raw$) (result *$.resultType|raw$List, err error) {
+	var timeout $.timeDuration|raw$
+	if opts.TimeoutSeconds != nil{
+		timeout = $.timeDuration|raw$(*opts.TimeoutSeconds) * $.timeSecond|raw$
+	}
+	result = &$.resultType|raw$List{}
+	err = c.GetClient().Get().
+		$if .prefersProtobuf$UseProtobufAsDefault().$end$
+		$if .namespaced$Namespace(c.GetNamespace()).$end$
+		Resource("$.type|resource$").
+		Name($.type|private$Name).
+		SubResource("$.subresourcePath$").
+		VersionedParams(&opts, $.schemeParameterCodec|raw$).
+		Timeout(timeout).
+		Do(ctx).
+		Into(result)
+	return
+}
+`
+
+var getTemplate = `
+// $.verb$ takes name of the $.type|private$, and returns the corresponding $.resultType|private$ object, and an error if there is any.
+func (c *$.type|privatePlural$) $.verb$(ctx $.context|raw$, name string, options $.GetOptions|raw$) (result *$.resultType|raw$, err error) {
+	result = &$.resultType|raw${}
+	err = c.GetClient().Get().
+		$if .prefersProtobuf$UseProtobufAsDefault().$end$
+		$if .namespaced$Namespace(c.GetNamespace()).$end$
+		Resource("$.type|resource$").
+		Name(name).
+		VersionedParams(&options, $.schemeParameterCodec|raw$).
+		Do(ctx).
+		Into(result)
+	return
+}
+`
+
+var getSubresourceTemplate = `
+// $.verb$ takes name of the $.type|private$, and returns the corresponding $.resultType|raw$ object, and an error if there is any.
+func (c *$.type|privatePlural$) $.verb$(ctx $.context|raw$, $.type|private$Name string, options $.GetOptions|raw$) (result *$.resultType|raw$, err error) {
+	result = &$.resultType|raw${}
+	err = c.GetClient().Get().
+		$if .prefersProtobuf$UseProtobufAsDefault().$end$
+		$if .namespaced$Namespace(c.GetNamespace()).$end$
+		Resource("$.type|resource$").
+		Name($.type|private$Name).
+		SubResource("$.subresourcePath$").
+		VersionedParams(&options, $.schemeParameterCodec|raw$).
+		Do(ctx).
+		Into(result)
+	return
+}
+`
+
+var deleteTemplate = `
+// $.verb$ takes name of the $.type|private$ and deletes it. Returns an error if one occurs.
+func (c *$.type|privatePlural$) $.verb$(ctx $.context|raw$, name string, opts $.DeleteOptions|raw$) error {
+	return c.GetClient().Delete().
+		$if .prefersProtobuf$UseProtobufAsDefault().$end$
+		$if .namespaced$Namespace(c.GetNamespace()).$end$
+		Resource("$.type|resource$").
+		Name(name).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+`
+
+var createSubresourceTemplate = `
+// $.verb$ takes the representation of a $.inputType|private$ and creates it.  Returns the server's representation of the $.resultType|private$, and an error, if there is any.
+func (c *$.type|privatePlural$) $.verb$(ctx $.context|raw$, $.type|private$Name string, $.inputType|private$ *$.inputType|raw$, opts $.CreateOptions|raw$) (result *$.resultType|raw$, err error) {
+	result = &$.resultType|raw${}
+	err = c.GetClient().Post().
+		$if .prefersProtobuf$UseProtobufAsDefault().$end$
+		$if .namespaced$Namespace(c.GetNamespace()).$end$
+		Resource("$.type|resource$").
+		Name($.type|private$Name).
+		SubResource("$.subresourcePath$").
+		VersionedParams(&opts, $.schemeParameterCodec|raw$).
+		Body($.inputType|private$).
+		Do(ctx).
+		Into(result)
+	return
+}
+`
+
+var createTemplate = `
+// $.verb$ takes the representation of a $.inputType|private$ and creates it.  Returns the server's representation of the $.resultType|private$, and an error, if there is any.
+func (c *$.type|privatePlural$) $.verb$(ctx $.context|raw$, $.inputType|private$ *$.inputType|raw$, opts $.CreateOptions|raw$) (result *$.resultType|raw$, err error) {
+	result = &$.resultType|raw${}
+	err = c.GetClient().Post().
+		$if .prefersProtobuf$UseProtobufAsDefault().$end$
+		$if .namespaced$Namespace(c.GetNamespace()).$end$
+		Resource("$.type|resource$").
+		VersionedParams(&opts, $.schemeParameterCodec|raw$).
+		Body($.inputType|private$).
+		Do(ctx).
+		Into(result)
+	return
+}
+`
+
+var updateSubresourceTemplate = `
+// $.verb$ takes the top resource name and the representation of a $.inputType|private$ and updates it. Returns the server's representation of the $.resultType|private$, and an error, if there is any.
+func (c *$.type|privatePlural$) $.verb$(ctx $.context|raw$, $.type|private$Name string, $.inputType|private$ *$.inputType|raw$, opts $.UpdateOptions|raw$) (result *$.resultType|raw$, err error) {
+	result = &$.resultType|raw${}
+	err = c.GetClient().Put().
+		$if .prefersProtobuf$UseProtobufAsDefault().$end$
+		$if .namespaced$Namespace(c.GetNamespace()).$end$
+		Resource("$.type|resource$").
+		Name($.type|private$Name).
+		SubResource("$.subresourcePath$").
+		VersionedParams(&opts, $.schemeParameterCodec|raw$).
+		Body($.inputType|private$).
+		Do(ctx).
+		Into(result)
+	return
+}
+`
+
+var updateTemplate = `
+// $.verb$ takes the representation of a $.inputType|private$ and updates it. Returns the server's representation of the $.resultType|private$, and an error, if there is any.
+func (c *$.type|privatePlural$) $.verb$(ctx $.context|raw$, $.inputType|private$ *$.inputType|raw$, opts $.UpdateOptions|raw$) (result *$.resultType|raw$, err error) {
+	result = &$.resultType|raw${}
+	err = c.GetClient().Put().
+		$if .prefersProtobuf$UseProtobufAsDefault().$end$
+		$if .namespaced$Namespace(c.GetNamespace()).$end$
+		Resource("$.type|resource$").
+		Name($.inputType|private$.Name).
+		VersionedParams(&opts, $.schemeParameterCodec|raw$).
+		Body($.inputType|private$).
+		Do(ctx).
+		Into(result)
+	return
+}
+`
+
+var watchTemplate = `
+// $.verb$ returns a $.watchInterface|raw$ that watches the requested $.type|privatePlural$.
+func (c *$.type|privatePlural$) $.verb$(ctx $.context|raw$, opts $.ListOptions|raw$) ($.watchInterface|raw$, error) {
+	var timeout $.timeDuration|raw$
+	if opts.TimeoutSeconds != nil{
+		timeout = $.timeDuration|raw$(*opts.TimeoutSeconds) * $.timeSecond|raw$
+	}
+	opts.Watch = true
+	return c.GetClient().Get().
+		$if .prefersProtobuf$UseProtobufAsDefault().$end$
+		$if .namespaced$Namespace(c.GetNamespace()).$end$
+		VersionedParams(&opts, $.schemeParameterCodec|raw$).
+		Timeout(timeout).
+		Watch(ctx)
+}
+`
+var patchTemplate = `
+// $.verb$ applies the patch and returns the patched $.resultType|private$.
+func (c *$.type|privatePlural$) $.verb$(ctx $.context|raw$, name string, pt $.PatchType|raw$, data []byte, opts $.PatchOptions|raw$, subresources ...string) (result *$.resultType|raw$, err error) {
+	result = &$.resultType|raw${}
+	err = c.GetClient().Patch(pt).
+		$if .prefersProtobuf$UseProtobufAsDefault().$end$
+		$if .namespaced$Namespace(c.GetNamespace()).$end$
+		Resource("$.type|resource$").
+		Name(name).
+		SubResource(subresources...).
+		VersionedParams(&opts, $.schemeParameterCodec|raw$).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}
+`
+
+var applyTemplate = `
+// $.verb$ takes the given apply declarative configuration, applies it and returns the applied $.resultType|private$.
+func (c *$.type|privatePlural$) $.verb$(ctx $.context|raw$, $.inputType|private$ *$.inputApplyConfig|raw$, opts $.ApplyOptions|raw$) (result *$.resultType|raw$, err error) {
+	if $.inputType|private$ == nil {
+		return nil, $.fmtErrorf|raw$("$.inputType|private$ provided to $.verb$ must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	name := $.inputType|private$.Name
+	if name == nil {
+		return nil, $.fmtErrorf|raw$("$.inputType|private$.Name must be provided to $.verb$")
+	}
+	request, err := $.applyNewRequest|raw$(c.GetClient(), $.inputType|private$)
+	if err != nil {
+		return nil, err
+	}
+	result = &$.resultType|raw${}
+	err = request.
+		$if .prefersProtobuf$UseProtobufAsDefault().$end$
+		$if .namespaced$Namespace(c.GetNamespace()).$end$
+		Resource("$.type|resource$").
+		Name(*name).
+		VersionedParams(&patchOpts, $.schemeParameterCodec|raw$).
+		Do(ctx).
+		Into(result)
+	return
+}
+`
+
+var applySubresourceTemplate = `
+// $.verb$ takes top resource name and the apply declarative configuration for $.subresourcePath$,
+// applies it and returns the applied $.resultType|private$, and an error, if there is any.
+func (c *$.type|privatePlural$) $.verb$(ctx $.context|raw$, $.type|private$Name string, $.inputType|private$ *$.inputApplyConfig|raw$, opts $.ApplyOptions|raw$) (result *$.resultType|raw$, err error) {
+	if $.inputType|private$ == nil {
+		return nil, $.fmtErrorf|raw$("$.inputType|private$ provided to $.verb$ must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	request, err := $.applyNewRequest|raw$(c.GetClient(), $.inputType|private$)
+	if err != nil {
+		return nil, err
+	}
+
+	result = &$.resultType|raw${}
+	err = request.
+		$if .prefersProtobuf$UseProtobufAsDefault().$end$
+		$if .namespaced$Namespace(c.GetNamespace()).$end$
+		Resource("$.type|resource$").
+		Name($.type|private$Name).
+		SubResource("$.subresourcePath$").
+		VersionedParams(&patchOpts, $.schemeParameterCodec|raw$).
+		Do(ctx).
+		Into(result)
+	return
+}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/scheme/generator_for_scheme.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/scheme/generator_for_scheme.go
new file mode 100644
index 0000000000..7229055799
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/scheme/generator_for_scheme.go
@@ -0,0 +1,187 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scheme
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+)
+
+// GenScheme produces a package for a clientset with the scheme, codecs and parameter codecs.
+type GenScheme struct {
+	generator.GoGenerator
+	OutputPkg       string // Must be a Go import-path
+	OutputPath      string // optional
+	Groups          []clientgentypes.GroupVersions
+	GroupGoNames    map[clientgentypes.GroupVersion]string
+	InputPackages   map[clientgentypes.GroupVersion]string
+	ImportTracker   namer.ImportTracker
+	PrivateScheme   bool
+	CreateRegistry  bool
+	schemeGenerated bool
+}
+
+func (g *GenScheme) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.OutputPkg, g.ImportTracker),
+	}
+}
+
+// We only want to call GenerateType() once.
+func (g *GenScheme) Filter(c *generator.Context, t *types.Type) bool {
+	ret := !g.schemeGenerated
+	g.schemeGenerated = true
+	return ret
+}
+
+func (g *GenScheme) Imports(c *generator.Context) (imports []string) {
+	imports = append(imports, g.ImportTracker.ImportLines()...)
+	for _, group := range g.Groups {
+		for _, version := range group.Versions {
+			packagePath := g.InputPackages[clientgentypes.GroupVersion{Group: group.Group, Version: version.Version}]
+			groupAlias := strings.ToLower(g.GroupGoNames[clientgentypes.GroupVersion{Group: group.Group, Version: version.Version}])
+			if g.CreateRegistry {
+				// import the install package for internal clientsets instead of the type package with register.go
+				if version.Version != "" {
+					packagePath = path.Dir(packagePath)
+				}
+				packagePath = path.Join(packagePath, "install")
+
+				imports = append(imports, fmt.Sprintf("%s \"%s\"", groupAlias, packagePath))
+				break
+			} else {
+				imports = append(imports, fmt.Sprintf("%s%s \"%s\"", groupAlias, strings.ToLower(version.Version.NonEmpty()), packagePath))
+			}
+		}
+	}
+	return
+}
+
+func (g *GenScheme) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+
+	allGroupVersions := clientgentypes.ToGroupVersionInfo(g.Groups, g.GroupGoNames)
+	allInstallGroups := clientgentypes.ToGroupInstallPackages(g.Groups, g.GroupGoNames)
+
+	m := map[string]interface{}{
+		"publicScheme":              !g.PrivateScheme,
+		"allGroupVersions":          allGroupVersions,
+		"allInstallGroups":          allInstallGroups,
+		"customRegister":            false,
+		"runtimeNewParameterCodec":  c.Universe.Function(types.Name{Package: "k8s.io/apimachinery/pkg/runtime", Name: "NewParameterCodec"}),
+		"runtimeNewScheme":          c.Universe.Function(types.Name{Package: "k8s.io/apimachinery/pkg/runtime", Name: "NewScheme"}),
+		"serializerNewCodecFactory": c.Universe.Function(types.Name{Package: "k8s.io/apimachinery/pkg/runtime/serializer", Name: "NewCodecFactory"}),
+		"runtimeScheme":             c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/runtime", Name: "Scheme"}),
+		"runtimeSchemeBuilder":      c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/runtime", Name: "SchemeBuilder"}),
+		"runtimeUtilMust":           c.Universe.Function(types.Name{Package: "k8s.io/apimachinery/pkg/util/runtime", Name: "Must"}),
+		"schemaGroupVersion":        c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/runtime/schema", Name: "GroupVersion"}),
+		"metav1AddToGroupVersion":   c.Universe.Function(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "AddToGroupVersion"}),
+	}
+	globals := map[string]string{
+		"Scheme":         "Scheme",
+		"Codecs":         "Codecs",
+		"ParameterCodec": "ParameterCodec",
+		"Registry":       "Registry",
+	}
+	for k, v := range globals {
+		if g.PrivateScheme {
+			m[k] = strings.ToLower(v[0:1]) + v[1:]
+		} else {
+			m[k] = v
+		}
+	}
+
+	sw.Do(globalsTemplate, m)
+
+	if g.OutputPath != "" {
+		if _, err := os.Stat(filepath.Join(g.OutputPath, strings.ToLower("register_custom.go"))); err == nil {
+			m["customRegister"] = true
+		}
+	}
+
+	if g.CreateRegistry {
+		sw.Do(registryRegistration, m)
+	} else {
+		sw.Do(simpleRegistration, m)
+	}
+
+	return sw.Error()
+}
+
+var globalsTemplate = `
+var $.Scheme$ = $.runtimeNewScheme|raw$()
+var $.Codecs$ = $.serializerNewCodecFactory|raw$($.Scheme$)
+$if .publicScheme$var $.ParameterCodec$ = $.runtimeNewParameterCodec|raw$($.Scheme$)$end -$`
+
+var registryRegistration = `
+
+func init() {
+	$.metav1AddToGroupVersion|raw$($.Scheme$, $.schemaGroupVersion|raw${Version: "v1"})
+	Install($.Scheme$)
+}
+
+// Install registers the API group and adds types to a scheme
+func Install(scheme *$.runtimeScheme|raw$) {
+	$- range .allInstallGroups$
+	$.InstallPackageAlias$.Install(scheme)
+	$- end$
+	$if .customRegister$
+	ExtraInstall(scheme)
+	$end -$
+}
+`
+
+var simpleRegistration = `
+var localSchemeBuilder = $.runtimeSchemeBuilder|raw${
+	$- range .allGroupVersions$
+	$.PackageAlias$.AddToScheme,
+	$- end$
+	$if .customRegister$
+	ExtraAddToScheme,
+	$end -$
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//   import (
+//     "k8s.io/client-go/kubernetes"
+//     clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//     aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//   )
+//
+//   kclientset, _ := kubernetes.NewForConfig(c)
+//   _ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	$.metav1AddToGroupVersion|raw$($.Scheme$, $.schemaGroupVersion|raw${Version: "v1"})
+	$.runtimeUtilMust|raw$(AddToScheme($.Scheme$))
+}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/util/gvpackages.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/util/gvpackages.go
new file mode 100644
index 0000000000..fcc1950909
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/util/gvpackages.go
@@ -0,0 +1,30 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import "strings"
+
+func ParsePathGroupVersion(pgvString string) (gvPath string, gvString string) {
+	subs := strings.Split(pgvString, "/")
+	length := len(subs)
+	switch length {
+	case 0, 1, 2:
+		return "", pgvString
+	default:
+		return strings.Join(subs[:length-2], "/"), strings.Join(subs[length-2:], "/")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/util/tags.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/util/tags.go
new file mode 100644
index 0000000000..5218dfad3b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/util/tags.go
@@ -0,0 +1,344 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"k8s.io/gengo/v2"
+)
+
+var supportedTags = []string{
+	"genclient",
+	"genclient:nonNamespaced",
+	"genclient:noVerbs",
+	"genclient:onlyVerbs",
+	"genclient:skipVerbs",
+	"genclient:noStatus",
+	"genclient:readonly",
+	"genclient:method",
+}
+
+// SupportedVerbs is a list of supported verbs for +onlyVerbs and +skipVerbs.
+var SupportedVerbs = []string{
+	"create",
+	"update",
+	"updateStatus",
+	"delete",
+	"deleteCollection",
+	"get",
+	"list",
+	"watch",
+	"patch",
+	"apply",
+	"applyStatus",
+}
+
+// ReadonlyVerbs represents a list of read-only verbs.
+var ReadonlyVerbs = []string{
+	"get",
+	"list",
+	"watch",
+}
+
+// genClientPrefix is the default prefix for all genclient tags.
+const genClientPrefix = "genclient:"
+
+// unsupportedExtensionVerbs is a list of verbs we don't support generating
+// extension client functions for.
+var unsupportedExtensionVerbs = []string{
+	"updateStatus",
+	"deleteCollection",
+	"watch",
+	"delete",
+}
+
+// inputTypeSupportedVerbs is a list of verb types that supports overriding the
+// input argument type.
+var inputTypeSupportedVerbs = []string{
+	"create",
+	"update",
+	"apply",
+}
+
+// resultTypeSupportedVerbs is a list of verb types that supports overriding the
+// resulting type.
+var resultTypeSupportedVerbs = []string{
+	"create",
+	"update",
+	"get",
+	"list",
+	"patch",
+	"apply",
+}
+
+// Extensions allows to extend the default set of client verbs
+// (CRUD+watch+patch+list+deleteCollection) for a given type with custom defined
+// verbs. Custom verbs can have custom input and result types and also allow to
+// use a sub-resource in a request instead of top-level resource type.
+//
+// Example:
+//
+// +genclient:method=UpdateScale,verb=update,subresource=scale,input=Scale,result=Scale
+//
+// type ReplicaSet struct { ... }
+//
+// The 'method=UpdateScale' is the name of the client function.
+// The 'verb=update' here means the client function will use 'PUT' action.
+// The 'subresource=scale' means we will use SubResource template to generate this client function.
+// The 'input' is the input type used for creation (function argument).
+// The 'result' (not needed in this case) is the result type returned from the
+// client function.
+type extension struct {
+	// VerbName is the name of the custom verb (Scale, Instantiate, etc..)
+	VerbName string
+	// VerbType is the type of the verb (only verbs from SupportedVerbs are
+	// supported)
+	VerbType string
+	// SubResourcePath defines a path to a sub-resource to use in the request.
+	// (optional)
+	SubResourcePath string
+	// InputTypeOverride overrides the input parameter type for the verb. By
+	// default the original type is used. Overriding the input type only works for
+	// "create" and "update" verb types. The given type must exists in the same
+	// package as the original type.
+	// (optional)
+	InputTypeOverride string
+	// ResultTypeOverride overrides the resulting object type for the verb. By
+	// default the original type is used. Overriding the result type works.
+	// (optional)
+	ResultTypeOverride string
+}
+
+// IsSubresource indicates if this extension should generate the sub-resource.
+func (e *extension) IsSubresource() bool {
+	return len(e.SubResourcePath) > 0
+}
+
+// HasVerb checks if the extension matches the given verb.
+func (e *extension) HasVerb(verb string) bool {
+	return e.VerbType == verb
+}
+
+// Input returns the input override package path and the type.
+func (e *extension) Input() (string, string) {
+	parts := strings.Split(e.InputTypeOverride, ".")
+	return parts[len(parts)-1], strings.Join(parts[0:len(parts)-1], ".")
+}
+
+// Result returns the result override package path and the type.
+func (e *extension) Result() (string, string) {
+	parts := strings.Split(e.ResultTypeOverride, ".")
+	return parts[len(parts)-1], strings.Join(parts[0:len(parts)-1], ".")
+}
+
+// Tags represents a genclient configuration for a single type.
+type Tags struct {
+	// +genclient
+	GenerateClient bool
+	// +genclient:nonNamespaced
+	NonNamespaced bool
+	// +genclient:noStatus
+	NoStatus bool
+	// +genclient:noVerbs
+	NoVerbs bool
+	// +genclient:skipVerbs=get,update
+	// +genclient:onlyVerbs=create,delete
+	SkipVerbs []string
+	// +genclient:method=UpdateScale,verb=update,subresource=scale,input=Scale,result=Scale
+	Extensions []extension
+}
+
+// HasVerb returns true if we should include the given verb in final client interface and
+// generate the function for it.
+func (t Tags) HasVerb(verb string) bool {
+	if len(t.SkipVerbs) == 0 {
+		return true
+	}
+	for _, s := range t.SkipVerbs {
+		if verb == s {
+			return false
+		}
+	}
+	return true
+}
+
+// MustParseClientGenTags calls ParseClientGenTags but instead of returning error it panics.
+func MustParseClientGenTags(lines []string) Tags {
+	tags, err := ParseClientGenTags(lines)
+	if err != nil {
+		panic(err.Error())
+	}
+	return tags
+}
+
+// ParseClientGenTags parse the provided genclient tags and validates that no unknown
+// tags are provided.
+func ParseClientGenTags(lines []string) (Tags, error) {
+	ret := Tags{}
+	values := gengo.ExtractCommentTags("+", lines)
+	var value []string
+	value, ret.GenerateClient = values["genclient"]
+	// Check the old format and error when used to avoid generating client when //+genclient=false
+	if len(value) > 0 && len(value[0]) > 0 {
+		return ret, fmt.Errorf("+genclient=%s is invalid, use //+genclient if you want to generate client or omit it when you want to disable generation", value)
+	}
+	_, ret.NonNamespaced = values[genClientPrefix+"nonNamespaced"]
+	// Check the old format and error when used
+	if value := values["nonNamespaced"]; len(value) > 0 && len(value[0]) > 0 {
+		return ret, fmt.Errorf("+nonNamespaced=%s is invalid, use //+genclient:nonNamespaced instead", value[0])
+	}
+	_, ret.NoVerbs = values[genClientPrefix+"noVerbs"]
+	_, ret.NoStatus = values[genClientPrefix+"noStatus"]
+	onlyVerbs := []string{}
+	if _, isReadonly := values[genClientPrefix+"readonly"]; isReadonly {
+		onlyVerbs = ReadonlyVerbs
+	}
+	// Check the old format and error when used
+	if value := values["readonly"]; len(value) > 0 && len(value[0]) > 0 {
+		return ret, fmt.Errorf("+readonly=%s is invalid, use //+genclient:readonly instead", value[0])
+	}
+	if v, exists := values[genClientPrefix+"skipVerbs"]; exists {
+		ret.SkipVerbs = strings.Split(v[0], ",")
+	}
+	if v, exists := values[genClientPrefix+"onlyVerbs"]; exists || len(onlyVerbs) > 0 {
+		if len(v) > 0 {
+			onlyVerbs = append(onlyVerbs, strings.Split(v[0], ",")...)
+		}
+		skipVerbs := []string{}
+		for _, m := range SupportedVerbs {
+			skip := true
+			for _, o := range onlyVerbs {
+				if o == m {
+					skip = false
+					break
+				}
+			}
+			// Check for conflicts
+			for _, v := range skipVerbs {
+				if v == m {
+					return ret, fmt.Errorf("verb %q used both in genclient:skipVerbs and genclient:onlyVerbs", v)
+				}
+			}
+			if skip {
+				skipVerbs = append(skipVerbs, m)
+			}
+		}
+		ret.SkipVerbs = skipVerbs
+	}
+	var err error
+	if ret.Extensions, err = parseClientExtensions(values); err != nil {
+		return ret, err
+	}
+	return ret, validateClientGenTags(values)
+}
+
+func parseClientExtensions(tags map[string][]string) ([]extension, error) {
+	var ret []extension
+	for name, values := range tags {
+		if !strings.HasPrefix(name, genClientPrefix+"method") {
+			continue
+		}
+		for _, value := range values {
+			// the value comes in this form: "Foo,verb=create"
+			ext := extension{}
+			parts := strings.Split(value, ",")
+			if len(parts) == 0 {
+				return nil, fmt.Errorf("invalid of empty extension verb name: %q", value)
+			}
+			// The first part represents the name of the extension
+			ext.VerbName = parts[0]
+			if len(ext.VerbName) == 0 {
+				return nil, fmt.Errorf("must specify a verb name (// +genclient:method=Foo,verb=create)")
+			}
+			// Parse rest of the arguments
+			params := parts[1:]
+			for _, p := range params {
+				parts := strings.Split(p, "=")
+				if len(parts) != 2 {
+					return nil, fmt.Errorf("invalid extension tag specification %q", p)
+				}
+				key, val := strings.TrimSpace(parts[0]), strings.TrimSpace(parts[1])
+				if len(val) == 0 {
+					return nil, fmt.Errorf("empty value of %q for %q extension", key, ext.VerbName)
+				}
+				switch key {
+				case "verb":
+					ext.VerbType = val
+				case "subresource":
+					ext.SubResourcePath = val
+				case "input":
+					ext.InputTypeOverride = val
+				case "result":
+					ext.ResultTypeOverride = val
+				default:
+					return nil, fmt.Errorf("unknown extension configuration key %q", key)
+				}
+			}
+			// Validate resulting extension configuration
+			if len(ext.VerbType) == 0 {
+				return nil, fmt.Errorf("verb type must be specified (use '// +genclient:method=%s,verb=create')", ext.VerbName)
+			}
+			if len(ext.ResultTypeOverride) > 0 {
+				supported := false
+				for _, v := range resultTypeSupportedVerbs {
+					if ext.VerbType == v {
+						supported = true
+						break
+					}
+				}
+				if !supported {
+					return nil, fmt.Errorf("%s: result type is not supported for %q verbs (supported verbs: %#v)", ext.VerbName, ext.VerbType, resultTypeSupportedVerbs)
+				}
+			}
+			if len(ext.InputTypeOverride) > 0 {
+				supported := false
+				for _, v := range inputTypeSupportedVerbs {
+					if ext.VerbType == v {
+						supported = true
+						break
+					}
+				}
+				if !supported {
+					return nil, fmt.Errorf("%s: input type is not supported for %q verbs (supported verbs: %#v)", ext.VerbName, ext.VerbType, inputTypeSupportedVerbs)
+				}
+			}
+			for _, t := range unsupportedExtensionVerbs {
+				if ext.VerbType == t {
+					return nil, fmt.Errorf("verb %q is not supported by extension generator", ext.VerbType)
+				}
+			}
+			ret = append(ret, ext)
+		}
+	}
+	return ret, nil
+}
+
+// validateTags validates that only supported genclient tags were provided.
+func validateClientGenTags(values map[string][]string) error {
+	for _, k := range supportedTags {
+		delete(values, k)
+	}
+	for key := range values {
+		if strings.HasPrefix(key, strings.TrimSuffix(genClientPrefix, ":")) {
+			return errors.New("unknown tag detected: " + key)
+		}
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/util/tags_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/util/tags_test.go
new file mode 100644
index 0000000000..b9ffcfbbba
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/generators/util/tags_test.go
@@ -0,0 +1,148 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestParseTags(t *testing.T) {
+	testCases := map[string]struct {
+		lines       []string
+		expectTags  Tags
+		expectError bool
+	}{
+		"genclient": {
+			lines:      []string{`+genclient`},
+			expectTags: Tags{GenerateClient: true},
+		},
+		"genclient=true": {
+			lines:       []string{`+genclient=true`},
+			expectError: true,
+		},
+		"nonNamespaced=true": {
+			lines:       []string{`+genclient=true`, `+nonNamespaced=true`},
+			expectError: true,
+		},
+		"readonly=true": {
+			lines:       []string{`+genclient=true`, `+readonly=true`},
+			expectError: true,
+		},
+		"genclient:nonNamespaced": {
+			lines:      []string{`+genclient`, `+genclient:nonNamespaced`},
+			expectTags: Tags{GenerateClient: true, NonNamespaced: true},
+		},
+		"genclient:noVerbs": {
+			lines:      []string{`+genclient`, `+genclient:noVerbs`},
+			expectTags: Tags{GenerateClient: true, NoVerbs: true},
+		},
+		"genclient:noStatus": {
+			lines:      []string{`+genclient`, `+genclient:noStatus`},
+			expectTags: Tags{GenerateClient: true, NoStatus: true},
+		},
+		"genclient:onlyVerbs": {
+			lines:      []string{`+genclient`, `+genclient:onlyVerbs=create,delete`},
+			expectTags: Tags{GenerateClient: true, SkipVerbs: []string{"update", "updateStatus", "deleteCollection", "get", "list", "watch", "patch", "apply", "applyStatus"}},
+		},
+		"genclient:readonly": {
+			lines:      []string{`+genclient`, `+genclient:readonly`},
+			expectTags: Tags{GenerateClient: true, SkipVerbs: []string{"create", "update", "updateStatus", "delete", "deleteCollection", "patch", "apply", "applyStatus"}},
+		},
+		"genclient:conflict": {
+			lines:       []string{`+genclient`, `+genclient:onlyVerbs=create`, `+genclient:skipVerbs=create`},
+			expectError: true,
+		},
+		"genclient:invalid": {
+			lines:       []string{`+genclient`, `+genclient:invalid`},
+			expectError: true,
+		},
+	}
+	for key, c := range testCases {
+		result, err := ParseClientGenTags(c.lines)
+		if err != nil && !c.expectError {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if !c.expectError && !reflect.DeepEqual(result, c.expectTags) {
+			t.Errorf("[%s] expected %#v to be %#v", key, result, c.expectTags)
+		}
+	}
+}
+
+func TestParseTagsExtension(t *testing.T) {
+	testCases := map[string]struct {
+		lines              []string
+		expectedExtensions []extension
+		expectError        bool
+	}{
+		"simplest extension": {
+			lines:              []string{`+genclient:method=Foo,verb=create`},
+			expectedExtensions: []extension{{VerbName: "Foo", VerbType: "create"}},
+		},
+		"multiple extensions": {
+			lines:              []string{`+genclient:method=Foo,verb=create`, `+genclient:method=Bar,verb=get`},
+			expectedExtensions: []extension{{VerbName: "Foo", VerbType: "create"}, {VerbName: "Bar", VerbType: "get"}},
+		},
+		"extension without verb": {
+			lines:       []string{`+genclient:method`},
+			expectError: true,
+		},
+		"extension without verb type": {
+			lines:       []string{`+genclient:method=Foo`},
+			expectError: true,
+		},
+		"sub-resource extension": {
+			lines:              []string{`+genclient:method=Foo,verb=create,subresource=bar`},
+			expectedExtensions: []extension{{VerbName: "Foo", VerbType: "create", SubResourcePath: "bar"}},
+		},
+		"output type extension": {
+			lines:              []string{`+genclient:method=Foos,verb=list,result=Bars`},
+			expectedExtensions: []extension{{VerbName: "Foos", VerbType: "list", ResultTypeOverride: "Bars"}},
+		},
+		"input type extension": {
+			lines:              []string{`+genclient:method=Foo,verb=update,input=Bar`},
+			expectedExtensions: []extension{{VerbName: "Foo", VerbType: "update", InputTypeOverride: "Bar"}},
+		},
+		"unknown verb type extension": {
+			lines:              []string{`+genclient:method=Foo,verb=explode`},
+			expectedExtensions: nil,
+			expectError:        true,
+		},
+		"invalid verb extension": {
+			lines:              []string{`+genclient:method=Foo,unknown=bar`},
+			expectedExtensions: nil,
+			expectError:        true,
+		},
+		"empty verb extension subresource": {
+			lines:              []string{`+genclient:method=Foo,verb=get,subresource=`},
+			expectedExtensions: nil,
+			expectError:        true,
+		},
+	}
+	for key, c := range testCases {
+		result, err := ParseClientGenTags(c.lines)
+		if err != nil && !c.expectError {
+			t.Fatalf("[%s] unexpected error: %v", key, err)
+		}
+		if err != nil && c.expectError {
+			t.Logf("[%s] got expected error: %+v", key, err)
+		}
+		if !c.expectError && !reflect.DeepEqual(result.Extensions, c.expectedExtensions) {
+			t.Errorf("[%s] expected %#+v to be %#+v", key, result.Extensions, c.expectedExtensions)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/main.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/main.go
new file mode 100644
index 0000000000..0afda40f5e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/main.go
@@ -0,0 +1,70 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// client-gen makes the individual typed clients using gengo.
+package main
+
+import (
+	"flag"
+	"slices"
+
+	"github.com/spf13/pflag"
+	"k8s.io/klog/v2"
+
+	"k8s.io/code-generator/cmd/client-gen/args"
+	"k8s.io/code-generator/cmd/client-gen/generators"
+	"k8s.io/code-generator/pkg/util"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+)
+
+func main() {
+	klog.InitFlags(nil)
+	args := args.New()
+
+	args.AddFlags(pflag.CommandLine, "k8s.io/kubernetes/pkg/apis") // TODO: move this input path out of client-gen
+	flag.Set("logtostderr", "true")
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+	pflag.Parse()
+
+	// add group version package as input dirs for gengo
+	inputPkgs := []string{}
+	for _, pkg := range args.Groups {
+		for _, v := range pkg.Versions {
+			inputPkgs = append(inputPkgs, v.Package)
+		}
+	}
+	// ensure stable code generation output
+	slices.Sort(inputPkgs)
+
+	if err := args.Validate(); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+
+	myTargets := func(context *generator.Context) []generator.Target {
+		return generators.GetTargets(context, args)
+	}
+
+	if err := gengo.Execute(
+		generators.NameSystems(util.PluralExceptionListToMapOrDie(args.PluralExceptions)),
+		generators.DefaultNameSystem(),
+		myTargets,
+		gengo.StdBuildTag,
+		inputPkgs,
+	); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/types/helpers.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/types/helpers.go
new file mode 100644
index 0000000000..c84a775317
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/types/helpers.go
@@ -0,0 +1,121 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+
+	"k8s.io/gengo/v2/namer"
+)
+
+// ToGroupVersion turns "group/version" string into a GroupVersion struct. It reports error
+// if it cannot parse the string.
+func ToGroupVersion(gv string) (GroupVersion, error) {
+	// this can be the internal version for the legacy kube types
+	// TODO once we've cleared the last uses as strings, this special case should be removed.
+	if (len(gv) == 0) || (gv == "/") {
+		return GroupVersion{}, nil
+	}
+
+	switch strings.Count(gv, "/") {
+	case 0:
+		return GroupVersion{Group(gv), ""}, nil
+	case 1:
+		i := strings.Index(gv, "/")
+		return GroupVersion{Group(gv[:i]), Version(gv[i+1:])}, nil
+	default:
+		return GroupVersion{}, fmt.Errorf("unexpected GroupVersion string: %v", gv)
+	}
+}
+
+type sortableSliceOfVersions []string
+
+func (a sortableSliceOfVersions) Len() int      { return len(a) }
+func (a sortableSliceOfVersions) Swap(i, j int) { a[i], a[j] = a[j], a[i] }
+func (a sortableSliceOfVersions) Less(i, j int) bool {
+	vi, vj := strings.TrimLeft(a[i], "v"), strings.TrimLeft(a[j], "v")
+	major := regexp.MustCompile("^[0-9]+")
+	viMajor, vjMajor := major.FindString(vi), major.FindString(vj)
+	viRemaining, vjRemaining := strings.TrimLeft(vi, viMajor), strings.TrimLeft(vj, vjMajor)
+	switch {
+	case len(viRemaining) == 0 && len(vjRemaining) == 0:
+		return viMajor < vjMajor
+	case len(viRemaining) == 0 && len(vjRemaining) != 0:
+		// stable version is greater than unstable version
+		return false
+	case len(viRemaining) != 0 && len(vjRemaining) == 0:
+		// stable version is greater than unstable version
+		return true
+	}
+	// neither are stable versions
+	if viMajor != vjMajor {
+		return viMajor < vjMajor
+	}
+	// assuming at most we have one alpha or one beta version, so if vi contains "alpha", it's the lesser one.
+	return strings.Contains(viRemaining, "alpha")
+}
+
+// Determine the default version among versions. If a user calls a group client
+// without specifying the version (e.g., c.CoreV1(), instead of c.CoreV1()), the
+// default version will be returned.
+func defaultVersion(versions []PackageVersion) Version {
+	var versionStrings []string
+	for _, version := range versions {
+		versionStrings = append(versionStrings, version.Version.String())
+	}
+	sort.Sort(sortableSliceOfVersions(versionStrings))
+	return Version(versionStrings[len(versionStrings)-1])
+}
+
+// ToGroupVersionInfo is a helper function used by generators for groups.
+func ToGroupVersionInfo(groups []GroupVersions, groupGoNames map[GroupVersion]string) []GroupVersionInfo {
+	var groupVersionPackages []GroupVersionInfo
+	for _, group := range groups {
+		for _, version := range group.Versions {
+			groupGoName := groupGoNames[GroupVersion{Group: group.Group, Version: version.Version}]
+			groupVersionPackages = append(groupVersionPackages, GroupVersionInfo{
+				Group:                Group(namer.IC(group.Group.NonEmpty())),
+				Version:              Version(namer.IC(version.Version.String())),
+				PackageAlias:         strings.ToLower(groupGoName + version.Version.NonEmpty()),
+				GroupGoName:          groupGoName,
+				LowerCaseGroupGoName: namer.IL(groupGoName),
+			})
+		}
+	}
+	return groupVersionPackages
+}
+
+func ToGroupInstallPackages(groups []GroupVersions, groupGoNames map[GroupVersion]string) []GroupInstallPackage {
+	var groupInstallPackages []GroupInstallPackage
+	for _, group := range groups {
+		defaultVersion := defaultVersion(group.Versions)
+		groupGoName := groupGoNames[GroupVersion{Group: group.Group, Version: defaultVersion}]
+		groupInstallPackages = append(groupInstallPackages, GroupInstallPackage{
+			Group:               Group(namer.IC(group.Group.NonEmpty())),
+			InstallPackageAlias: strings.ToLower(groupGoName),
+		})
+	}
+	return groupInstallPackages
+}
+
+// NormalizeGroupVersion calls normalizes the GroupVersion.
+// func NormalizeGroupVersion(gv GroupVersion) GroupVersion {
+// 	 return GroupVersion{Group: gv.Group.NonEmpty(), Version: gv.Version, NonEmptyVersion: normalization.Version(gv.Version)}
+// }
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/types/helpers_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/types/helpers_test.go
new file mode 100644
index 0000000000..dec62dff21
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/types/helpers_test.go
@@ -0,0 +1,32 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+import (
+	"reflect"
+	"sort"
+	"testing"
+)
+
+func TestVersionSort(t *testing.T) {
+	unsortedVersions := []string{"v4beta1", "v2beta1", "v2alpha1", "v3", "v1"}
+	expected := []string{"v2alpha1", "v2beta1", "v4beta1", "v1", "v3"}
+	sort.Sort(sortableSliceOfVersions(unsortedVersions))
+	if !reflect.DeepEqual(unsortedVersions, expected) {
+		t.Errorf("expected %#v\ngot %#v", expected, unsortedVersions)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/types/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/types/types.go
new file mode 100644
index 0000000000..df030e8459
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/client-gen/types/types.go
@@ -0,0 +1,109 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+import "strings"
+
+type Version string
+
+func (v Version) String() string {
+	return string(v)
+}
+
+func (v Version) NonEmpty() string {
+	if v == "" {
+		return "internalVersion"
+	}
+	return v.String()
+}
+
+func (v Version) PackageName() string {
+	return strings.ToLower(v.NonEmpty())
+}
+
+type Group string
+
+func (g Group) String() string {
+	return string(g)
+}
+
+func (g Group) NonEmpty() string {
+	if g == "" {
+		return "core"
+	}
+	return string(g)
+}
+
+func (g Group) PackageName() string {
+	parts := strings.Split(g.NonEmpty(), ".")
+	if parts[0] == "internal" && len(parts) > 1 {
+		return strings.ToLower(parts[1] + parts[0])
+	}
+	return strings.ToLower(parts[0])
+}
+
+type Kind string
+
+type PackageVersion struct {
+	Version
+	// The fully qualified package, e.g. k8s.io/kubernetes/pkg/apis/apps, where the types.go is found.
+	Package string
+}
+
+type GroupVersion struct {
+	Group   Group
+	Version Version
+}
+
+type GroupVersionKind struct {
+	Group   Group
+	Version Version
+	Kind    Kind
+}
+
+func (gv GroupVersion) ToAPIVersion() string {
+	if len(gv.Group) > 0 && gv.Group != "" {
+		return gv.Group.String() + "/" + gv.Version.String()
+	} else {
+		return gv.Version.String()
+	}
+}
+
+func (gv GroupVersion) WithKind(kind Kind) GroupVersionKind {
+	return GroupVersionKind{Group: gv.Group, Version: gv.Version, Kind: kind}
+}
+
+type GroupVersions struct {
+	// The name of the package for this group, e.g. apps.
+	PackageName string
+	Group       Group
+	Versions    []PackageVersion
+}
+
+// GroupVersionInfo contains all the info around a group version.
+type GroupVersionInfo struct {
+	Group                Group
+	Version              Version
+	PackageAlias         string
+	GroupGoName          string
+	LowerCaseGroupGoName string
+}
+
+type GroupInstallPackage struct {
+	Group               Group
+	InstallPackageAlias string
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/conversion-gen/args/args.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/conversion-gen/args/args.go
new file mode 100644
index 0000000000..5727858326
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/conversion-gen/args/args.go
@@ -0,0 +1,102 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package args
+
+import (
+	"fmt"
+
+	"github.com/spf13/pflag"
+
+	"k8s.io/code-generator/pkg/apidefinitions"
+	"k8s.io/gengo/v2"
+)
+
+// DefaultBasePeerDirs are the peer-dirs nearly everybody will use, i.e. those coming from
+// apimachinery.
+var DefaultBasePeerDirs = []string{
+	"k8s.io/apimachinery/pkg/apis/meta/v1",
+	"k8s.io/apimachinery/pkg/conversion",
+	"k8s.io/apimachinery/pkg/runtime",
+}
+
+type Args struct {
+	// The filename of the generated results.
+	OutputFile string
+
+	// Base peer dirs which nearly everybody will use, i.e. outside of Kubernetes core. Peer dirs
+	// are declared to make the generator pick up manually written conversion funcs from external
+	// packages.
+	BasePeerDirs []string
+
+	// Custom peer dirs which are application specific. Peer dirs are declared to make the
+	// generator pick up manually written conversion funcs from external packages.
+	ExtraPeerDirs []string
+
+	// SkipUnsafe indicates whether to generate unsafe conversions to improve the efficiency
+	// of these operations. The unsafe operation is a direct pointer assignment via unsafe
+	// (within the allowed uses of unsafe) and is equivalent to a proposed Golang change to
+	// allow structs that are identical to be assigned to each other.
+	SkipUnsafe bool
+
+	// GoHeaderFile is the path to a boilerplate header file for generated
+	// code.
+	GoHeaderFile string
+
+	// GeneratedBuildTag is the tag used to identify code generated by execution
+	// of this type. Each generator should use a different tag, and different
+	// groups of generators (external API that depends on Kube generations) should
+	// keep tags distinct as well.
+	GeneratedBuildTag string
+
+	apidefinitions.LintArgs
+}
+
+// New returns default arguments for the generator.
+func New() *Args {
+	return &Args{
+		BasePeerDirs:      DefaultBasePeerDirs,
+		SkipUnsafe:        false,
+		GeneratedBuildTag: gengo.StdBuildTag,
+	}
+}
+
+// AddFlags add the generator flags to the flag set.
+func (args *Args) AddFlags(fs *pflag.FlagSet) {
+	fs.StringVar(&args.OutputFile, "output-file", "generated.conversion.go",
+		"the name of the file to be generated")
+	fs.StringSliceVar(&args.BasePeerDirs, "base-peer-dirs", args.BasePeerDirs,
+		"Comma-separated list of apimachinery import paths which are considered, after tag-specified peers, for conversions. Only change these if you have very good reasons.")
+	fs.StringSliceVar(&args.ExtraPeerDirs, "extra-peer-dirs", args.ExtraPeerDirs,
+		"Application specific comma-separated list of import paths which are considered, after tag-specified peers and base-peer-dirs, for conversions.")
+	fs.BoolVar(&args.SkipUnsafe, "skip-unsafe", args.SkipUnsafe,
+		"If true, will not generate code using unsafe pointer conversions; resulting code may be slower.")
+	fs.StringVar(&args.GoHeaderFile, "go-header-file", "",
+		"the path to a file containing boilerplate header text; the string \"YEAR\" will be replaced with the current 4-digit year")
+	fs.StringVar(&args.GeneratedBuildTag, "build-tag", args.GeneratedBuildTag, "A Go build tag to use to identify files generated by this command. Should be unique.")
+	apidefinitions.AddFlags(&args.LintArgs, fs)
+}
+
+// Validate checks the given arguments.
+func (args *Args) Validate() error {
+	if len(args.OutputFile) == 0 {
+		return fmt.Errorf("--output-file must be specified")
+	}
+	if err := apidefinitions.ValidateFlags(args.LintRules); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/conversion-gen/generators/conversion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/conversion-gen/generators/conversion.go
new file mode 100644
index 0000000000..f6e5c0d6e4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/conversion-gen/generators/conversion.go
@@ -0,0 +1,1352 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"path"
+	"reflect"
+	"sort"
+	"strings"
+
+	"k8s.io/code-generator/cmd/conversion-gen/args"
+	"k8s.io/code-generator/pkg/apidefinitions"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/klog/v2"
+)
+
+// These are the comment tags that carry parameters for conversion generation.
+const (
+	// e.g., "+k8s:conversion-gen=<peer-pkg>" in doc.go, where <peer-pkg> is the
+	// import path of the package the peer types are defined in.
+	// e.g., "+k8s:conversion-gen=false" in a type's comment will let
+	// conversion-gen skip that type.
+	tagName = "k8s:conversion-gen"
+	// e.g. "+k8s:conversion-gen:explicit-from=net/url.Values" in the type comment
+	// will result in generating conversion from net/url.Values.
+	explicitFromTagName = "k8s:conversion-gen:explicit-from"
+)
+
+func extractTagValues(tagName string, comments []string) ([]string, error) {
+	tags, err := gengo.ExtractFunctionStyleCommentTags("+", []string{tagName}, comments)
+	if err != nil {
+		return nil, err
+	}
+	tagList, exists := tags[tagName]
+	if !exists {
+		return nil, nil
+	}
+	values := make([]string, len(tagList))
+	for i, v := range tagList {
+		values[i] = v.Value
+	}
+	return values, nil
+}
+
+func extractTag(comments []string) ([]string, error) {
+	return extractTagValues(tagName, comments)
+}
+
+func extractExplicitFromTag(comments []string) ([]string, error) {
+	return extractTagValues(explicitFromTagName, comments)
+}
+
+func isCopyOnly(comments []string) (bool, error) {
+	values, err := extractTagValues("k8s:conversion-fn", comments)
+	if err != nil {
+		return false, err
+	}
+	return len(values) == 1 && values[0] == "copy-only", nil
+}
+
+func isDrop(comments []string) (bool, error) {
+	values, err := extractTagValues("k8s:conversion-fn", comments)
+	if err != nil {
+		return false, err
+	}
+	return len(values) == 1 && values[0] == "drop", nil
+}
+
+// TODO: This is created only to reduce number of changes in a single PR.
+// Remove it and use PublicNamer instead.
+func conversionNamer() *namer.NameStrategy {
+	return &namer.NameStrategy{
+		Join: func(pre string, in []string, post string) string {
+			return strings.Join(in, "_")
+		},
+		PrependPackageNames: 1,
+	}
+}
+
+func defaultFnNamer() *namer.NameStrategy {
+	return &namer.NameStrategy{
+		Prefix: "SetDefaults_",
+		Join: func(pre string, in []string, post string) string {
+			return pre + strings.Join(in, "_") + post
+		},
+	}
+}
+
+// NameSystems returns the name system used by the generators in this package.
+func NameSystems() namer.NameSystems {
+	return namer.NameSystems{
+		"public":    conversionNamer(),
+		"raw":       namer.NewRawNamer("", nil),
+		"defaultfn": defaultFnNamer(),
+	}
+}
+
+// DefaultNameSystem returns the default name system for ordering the types to be
+// processed by the generators in this package.
+func DefaultNameSystem() string {
+	return "public"
+}
+
+func getPeerTypeFor(context *generator.Context, t *types.Type, potenialPeerPkgs []string) *types.Type {
+	for _, ppp := range potenialPeerPkgs {
+		p := context.Universe.Package(ppp)
+		if p == nil {
+			continue
+		}
+		if p.Has(t.Name.Name) {
+			return p.Type(t.Name.Name)
+		}
+	}
+	return nil
+}
+
+type conversionPair struct {
+	inType  *types.Type
+	outType *types.Type
+}
+
+// All of the types in conversions map are of type "DeclarationOf" with
+// the underlying type being "Func".
+type conversionFuncMap map[conversionPair]*types.Type
+
+// Returns all manually-defined conversion functions in the package.
+func getManualConversionFunctions(context *generator.Context, pkg *types.Package, manualMap conversionFuncMap) {
+	if pkg == nil {
+		klog.Warning("Skipping nil package passed to getManualConversionFunctions")
+		return
+	}
+	klog.V(3).Infof("Scanning for conversion functions in %v", pkg.Path)
+
+	scopeName := types.Ref(conversionPackagePath, "Scope").Name
+	errorName := types.Ref("", "error").Name
+	buffer := &bytes.Buffer{}
+	sw := generator.NewSnippetWriter(buffer, context, "$", "$")
+
+	for _, f := range pkg.Functions {
+		if f.Underlying == nil || f.Underlying.Kind != types.Func {
+			klog.Errorf("Malformed function: %#v", f)
+			continue
+		}
+		if f.Underlying.Signature == nil {
+			klog.Errorf("Function without signature: %#v", f)
+			continue
+		}
+		klog.V(6).Infof("Considering function %s", f.Name)
+		signature := f.Underlying.Signature
+		// Check whether the function is conversion function.
+		// Note that all of them have signature:
+		// func Convert_inType_To_outType(inType, outType, conversion.Scope) error
+		if signature.Receiver != nil {
+			klog.V(6).Infof("%s has a receiver", f.Name)
+			continue
+		}
+		if len(signature.Parameters) != 3 || signature.Parameters[2].Type.Name != scopeName {
+			klog.V(6).Infof("%s has wrong parameters", f.Name)
+			continue
+		}
+		if len(signature.Results) != 1 || signature.Results[0].Type.Name != errorName {
+			klog.V(6).Infof("%s has wrong results", f.Name)
+			continue
+		}
+		inType := signature.Parameters[0].Type
+		outType := signature.Parameters[1].Type
+		if inType.Kind != types.Pointer || outType.Kind != types.Pointer {
+			klog.V(6).Infof("%s has wrong parameter types", f.Name)
+			continue
+		}
+		// Now check if the name satisfies the convention.
+		// TODO: This should call the Namer directly.
+		args := argsFromType(inType.Elem, outType.Elem)
+		sw.Do("Convert_$.inType|public$_To_$.outType|public$", args)
+		if f.Name.Name == buffer.String() {
+			klog.V(2).Infof("Found conversion function %s", f.Name)
+			key := conversionPair{inType.Elem, outType.Elem}
+			// We might scan the same package twice, and that's OK.
+			if v, ok := manualMap[key]; ok && v != nil && v.Name.Package != pkg.Path {
+				panic(fmt.Sprintf("duplicate static conversion defined: %s -> %s from:\n%s.%s\n%s.%s", key.inType, key.outType, v.Name.Package, v.Name.Name, f.Name.Package, f.Name.Name))
+			}
+			manualMap[key] = f
+		} else {
+			// prevent user error when they don't get the correct conversion signature
+			if strings.HasPrefix(f.Name.Name, "Convert_") {
+				klog.Errorf("Rename function %s %s -> %s to match expected conversion signature", f.Name.Package, f.Name.Name, buffer.String())
+			}
+			klog.V(3).Infof("%s has wrong name", f.Name)
+		}
+		buffer.Reset()
+	}
+}
+
+func GetTargets(context *generator.Context, args *args.Args) []generator.Target {
+	boilerplate, err := gengo.GoBoilerplate(args.GoHeaderFile, args.GeneratedBuildTag, gengo.StdGeneratedBy)
+	if err != nil {
+		klog.Fatalf("Failed loading boilerplate: %v", err)
+	}
+
+	var idOpts []apidefinitions.Option
+	if len(args.LintRules) > 0 {
+		idOpts = append(idOpts, apidefinitions.WithLintRules(args.LintRules...))
+	}
+
+	targetList := []generator.Target{}
+
+	// Accumulate pre-existing conversion functions.
+	// TODO: This is too ad-hoc.  We need a better way.
+	manualConversions := conversionFuncMap{}
+
+	// Record types that are memory equivalent. A type is memory equivalent
+	// if it has the same memory layout and no nested manual conversion is
+	// defined.
+	// TODO: in the future, relax the nested manual conversion requirement
+	//   if we can show that a large enough types are memory identical but
+	//   have non-trivial conversion
+	memoryEquivalentTypes := equalMemoryTypes{}
+
+	// First load other "input" packages.  We do this as a single call because
+	// it is MUCH faster.
+	filteredInputs := make([]string, 0, len(context.Inputs))
+	otherPkgs := make([]string, 0, len(context.Inputs))
+	pkgToPeers := map[string][]string{}
+	pkgToExternal := map[string]string{}
+
+	for _, i := range context.Inputs {
+		klog.V(3).Infof("considering pkg %q", i)
+		pkg := context.Universe[i]
+
+		info, err := apidefinitions.Identify(pkg, apidefinitions.Conversion, idOpts...)
+		if err != nil {
+			klog.Fatal(err)
+		}
+		if !info.ShouldGenerate() {
+			klog.V(3).Infof("  no tag")
+			continue
+		}
+		filteredInputs = append(filteredInputs, i)
+
+		// Sole +k8s:conversion-gen=false: emit only the package's
+		// hand-written conversions, no peer-driven standard conversions.
+		if !info.IsExplicitOnly() {
+			peerPkgs := info.PeerPackages()
+			klog.V(3).Infof("  peers: %q", peerPkgs)
+			pkgToPeers[i] = peerPkgs
+			otherPkgs = append(otherPkgs, peerPkgs...)
+		}
+
+		externalTypes := info.ExternalTypes()
+		if externalTypes != i {
+			klog.V(3).Infof("  external types: %q", externalTypes)
+			otherPkgs = append(otherPkgs, externalTypes)
+		}
+		pkgToExternal[i] = externalTypes
+	}
+
+	// Make sure explicit peer-packages are added.
+	peers := args.BasePeerDirs
+	peers = append(peers, args.ExtraPeerDirs...)
+	if expanded, err := context.FindPackages(peers...); err != nil {
+		klog.Fatalf("cannot find peer packages: %v", err)
+	} else {
+		otherPkgs = append(otherPkgs, expanded...)
+		// for each pkg, add these extras, too
+		for k := range pkgToPeers {
+			pkgToPeers[k] = append(pkgToPeers[k], expanded...)
+		}
+	}
+
+	if len(otherPkgs) > 0 {
+		if _, err := context.LoadPackages(otherPkgs...); err != nil {
+			klog.Fatalf("cannot load packages: %v", err)
+		}
+	}
+	// update context.Order to the latest context.Universe
+	orderer := namer.Orderer{Namer: namer.NewPublicNamer(1)}
+	context.Order = orderer.OrderUniverse(context.Universe)
+
+	// Look for conversion functions in the peer-packages.
+	for _, pp := range otherPkgs {
+		p := context.Universe[pp]
+		if p == nil {
+			klog.Fatalf("failed to find pkg: %s", pp)
+		}
+		getManualConversionFunctions(context, p, manualConversions)
+	}
+
+	// We are generating conversions only for packages that are explicitly
+	// passed as InputDir.
+	for _, i := range filteredInputs {
+		klog.V(3).Infof("considering pkg %q", i)
+		pkg := context.Universe[i]
+
+		// Add conversion and defaulting functions.
+		getManualConversionFunctions(context, pkg, manualConversions)
+
+		// Find the right input pkg, which might not be this one.
+		externalTypes := pkgToExternal[i]
+
+		// typesPkg is where the versioned types are defined. Sometimes it is
+		// different from pkg. For example, kubernetes core/v1 types are defined
+		// in k8s.io/api/core/v1, while pkg is at pkg/api/v1.
+		typesPkg := context.Universe[externalTypes]
+
+		unsafeEquality := TypesEqual(memoryEquivalentTypes)
+		if args.SkipUnsafe {
+			unsafeEquality = noEquality{}
+		}
+
+		targetList = append(targetList,
+			&generator.SimpleTarget{
+				PkgName:       path.Base(pkg.Path),
+				PkgPath:       pkg.Path,
+				PkgDir:        pkg.Dir, // output pkg is the same as the input
+				HeaderComment: boilerplate,
+				FilterFunc: func(c *generator.Context, t *types.Type) bool {
+					return t.Name.Package == typesPkg.Path
+				},
+				GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+					return []generator.Generator{
+						NewGenConversion(args.OutputFile, typesPkg.Path, pkg.Path, manualConversions, pkgToPeers[pkg.Path], unsafeEquality),
+					}
+				},
+			})
+	}
+
+	// If there is a manual conversion defined between two types, exclude it
+	// from being a candidate for unsafe conversion
+	for k, v := range manualConversions {
+		copyOnly, err := isCopyOnly(v.CommentLines)
+		if err != nil {
+			klog.Errorf("error extracting tags: %v", err)
+		} else if copyOnly {
+			klog.V(4).Infof("Conversion function %s will not block memory copy because it is copy-only", v.Name)
+			continue
+		}
+		// this type should be excluded from all equivalence, because the converter must be called.
+		memoryEquivalentTypes.Skip(k.inType, k.outType)
+	}
+
+	return targetList
+}
+
+type equalMemoryTypes map[conversionPair]bool
+
+func (e equalMemoryTypes) Skip(a, b *types.Type) {
+	e[conversionPair{a, b}] = false
+	e[conversionPair{b, a}] = false
+}
+
+func (e equalMemoryTypes) Equal(a, b *types.Type) bool {
+	equal, _ := e.cachingEqual(a, b, nil)
+	return equal
+}
+
+// cachingEqual recursively compares a and b for memory equality,
+// using a cache of previously computed results, and caching the result before returning when possible.
+// alreadyVisitedStack is used to check for cycles during recursion.
+// The returned cacheable boolean tells the caller whether the equal result is a definitive answer that can be safely cached,
+// or if it's a temporary assumption made to break a cycle in a recursively defined type.
+func (e equalMemoryTypes) cachingEqual(a, b *types.Type, alreadyVisitedStack []*types.Type) (equal, cacheable bool) {
+	if a == b {
+		return true, true
+	}
+	if equal, ok := e[conversionPair{a, b}]; ok {
+		return equal, true
+	}
+	if equal, ok := e[conversionPair{b, a}]; ok {
+		return equal, true
+	}
+	result, cacheable := e.equal(a, b, alreadyVisitedStack)
+	if cacheable {
+		e[conversionPair{a, b}] = result
+		e[conversionPair{b, a}] = result
+	}
+	return result, cacheable
+}
+
+// equal recursively compares a and b for memory equality.
+// alreadyVisitedStack is used to check for cycles during recursion.
+// The returned cacheable boolean tells the caller whether the equal result is a definitive answer that can be safely cached,
+// or if it's a temporary assumption made to break a cycle in a recursively defined type.
+func (e equalMemoryTypes) equal(a, b *types.Type, alreadyVisitedStack []*types.Type) (equal, cacheable bool) {
+	in, out := unwrapAlias(a), unwrapAlias(b)
+	switch {
+	case in == out:
+		return true, true
+	case in.Kind == out.Kind:
+		for _, v := range alreadyVisitedStack {
+			if v == in {
+				// if the type was visited in this stack already, return early to avoid infinite recursion, but do not cache the results
+				return true, false
+			}
+		}
+		alreadyVisitedStack = append(alreadyVisitedStack, in)
+
+		switch in.Kind {
+		case types.Struct:
+			if len(in.Members) != len(out.Members) {
+				return false, true
+			}
+			cacheable = true
+			for i, inMember := range in.Members {
+				outMember := out.Members[i]
+				memberEqual, memberCacheable := e.cachingEqual(inMember.Type, outMember.Type, alreadyVisitedStack)
+				if !memberEqual {
+					return false, true
+				}
+				if !memberCacheable {
+					cacheable = false
+				}
+			}
+			return true, cacheable
+		case types.Pointer:
+			return e.cachingEqual(in.Elem, out.Elem, alreadyVisitedStack)
+		case types.Map:
+			keyEqual, keyCacheable := e.cachingEqual(in.Key, out.Key, alreadyVisitedStack)
+			valueEqual, valueCacheable := e.cachingEqual(in.Elem, out.Elem, alreadyVisitedStack)
+			return keyEqual && valueEqual, keyCacheable && valueCacheable
+		case types.Slice:
+			return e.cachingEqual(in.Elem, out.Elem, alreadyVisitedStack)
+		case types.Interface:
+			// TODO: determine whether the interfaces are actually equivalent - for now, they must have the
+			// same type.
+			return false, true
+		case types.Builtin:
+			return in.Name.Name == out.Name.Name, true
+		}
+	}
+	return false, true
+}
+
+func findMember(t *types.Type, name string) (types.Member, bool) {
+	if t.Kind != types.Struct {
+		return types.Member{}, false
+	}
+	for _, member := range t.Members {
+		if member.Name == name {
+			return member, true
+		}
+	}
+	return types.Member{}, false
+}
+
+// unwrapAlias recurses down aliased types to find the bedrock type.
+func unwrapAlias(in *types.Type) *types.Type {
+	for in.Kind == types.Alias {
+		in = in.Underlying
+	}
+	return in
+}
+
+const (
+	runtimePackagePath    = "k8s.io/apimachinery/pkg/runtime"
+	conversionPackagePath = "k8s.io/apimachinery/pkg/conversion"
+)
+
+type noEquality struct{}
+
+func (noEquality) Equal(_, _ *types.Type) bool { return false }
+
+type TypesEqual interface {
+	Equal(a, b *types.Type) bool
+}
+
+// genConversion produces a file with a autogenerated conversions.
+type genConversion struct {
+	generator.GoGenerator
+	// the package that contains the types that conversion func are going to be
+	// generated for
+	typesPackage string
+	// the package that the conversion funcs are going to be output to
+	outputPackage string
+	// packages that contain the peer of types in typesPacakge
+	peerPackages        []string
+	manualConversions   conversionFuncMap
+	imports             namer.ImportTracker
+	types               []*types.Type
+	explicitConversions []conversionPair
+	skippedFields       map[*types.Type][]string
+	useUnsafe           TypesEqual
+}
+
+func NewGenConversion(outputFilename, typesPackage, outputPackage string, manualConversions conversionFuncMap, peerPkgs []string, useUnsafe TypesEqual) generator.Generator {
+	return &genConversion{
+		GoGenerator: generator.GoGenerator{
+			OutputFilename: outputFilename,
+		},
+		typesPackage:        typesPackage,
+		outputPackage:       outputPackage,
+		peerPackages:        peerPkgs,
+		manualConversions:   manualConversions,
+		imports:             generator.NewImportTrackerForPackage(outputPackage),
+		types:               []*types.Type{},
+		explicitConversions: []conversionPair{},
+		skippedFields:       map[*types.Type][]string{},
+		useUnsafe:           useUnsafe,
+	}
+}
+
+func (g *genConversion) Namers(c *generator.Context) namer.NameSystems {
+	// Have the raw namer for this file track what it imports.
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.outputPackage, g.imports),
+		"publicIT": &namerPlusImportTracking{
+			delegate: conversionNamer(),
+			tracker:  g.imports,
+		},
+	}
+}
+
+type namerPlusImportTracking struct {
+	delegate namer.Namer
+	tracker  namer.ImportTracker
+}
+
+func (n *namerPlusImportTracking) Name(t *types.Type) string {
+	n.tracker.AddType(t)
+	return n.delegate.Name(t)
+}
+
+func (g *genConversion) convertibleOnlyWithinPackage(inType, outType *types.Type) bool {
+	var t *types.Type
+	var other *types.Type
+	if inType.Name.Package == g.typesPackage {
+		t, other = inType, outType
+	} else {
+		t, other = outType, inType
+	}
+
+	if t.Name.Package != g.typesPackage {
+		return false
+	}
+	// If the type has opted out, skip it.
+	tagvals, err := extractTag(t.CommentLines)
+	if err != nil {
+		klog.Errorf("Type %v: error extracting tags: %v", t, err)
+		return false
+	}
+
+	if tagvals != nil {
+		if tagvals[0] != "false" {
+			klog.Fatalf("Type %v: unsupported %s value: %q", t, tagName, tagvals[0])
+		}
+		klog.V(2).Infof("type %v requests no conversion generation, skipping", t)
+		return false
+	}
+	// TODO: Consider generating functions for other kinds too.
+	if t.Kind != types.Struct {
+		return false
+	}
+	// Also, filter out private types.
+	if namer.IsPrivateGoName(other.Name.Name) {
+		return false
+	}
+	return true
+}
+
+func getExplicitFromTypes(t *types.Type) []types.Name {
+	comments := t.SecondClosestCommentLines
+	comments = append(comments, t.CommentLines...)
+	result := []types.Name{}
+	paths, err := extractExplicitFromTag(comments)
+	if err != nil {
+		klog.Errorf("Error extracting explicit-from tag for %v: %v", t.Name, err)
+		return result
+	}
+	for _, path := range paths {
+		items := strings.Split(path, ".")
+		if len(items) != 2 {
+			klog.Errorf("Unexpected k8s:conversion-gen:explicit-from tag: %s", path)
+			continue
+		}
+		switch {
+		case items[0] == "net/url" && items[1] == "Values":
+		default:
+			klog.Fatalf("Not supported k8s:conversion-gen:explicit-from tag: %s", path)
+		}
+		result = append(result, types.Name{Package: items[0], Name: items[1]})
+	}
+	return result
+}
+
+func (g *genConversion) Filter(c *generator.Context, t *types.Type) bool {
+	convertibleWithPeer := func() bool {
+		peerType := getPeerTypeFor(c, t, g.peerPackages)
+		if peerType == nil {
+			return false
+		}
+		if !g.convertibleOnlyWithinPackage(t, peerType) {
+			return false
+		}
+		g.types = append(g.types, t)
+		return true
+	}()
+
+	explicitlyConvertible := func() bool {
+		inTypes := getExplicitFromTypes(t)
+		if len(inTypes) == 0 {
+			return false
+		}
+		for i := range inTypes {
+			pair := conversionPair{
+				inType:  &types.Type{Name: inTypes[i]},
+				outType: t,
+			}
+			g.explicitConversions = append(g.explicitConversions, pair)
+		}
+		return true
+	}()
+
+	return convertibleWithPeer || explicitlyConvertible
+}
+
+func (g *genConversion) isOtherPackage(pkg string) bool {
+	if pkg == g.outputPackage {
+		return false
+	}
+	if strings.HasSuffix(pkg, `"`+g.outputPackage+`"`) {
+		return false
+	}
+	return true
+}
+
+func (g *genConversion) Imports(c *generator.Context) (imports []string) {
+	var importLines []string
+	for _, singleImport := range g.imports.ImportLines() {
+		if g.isOtherPackage(singleImport) {
+			importLines = append(importLines, singleImport)
+		}
+	}
+	return importLines
+}
+
+func argsFromType(inType, outType *types.Type) generator.Args {
+	return generator.Args{
+		"inType":  inType,
+		"outType": outType,
+	}
+}
+
+const nameTmpl = "Convert_$.inType|publicIT$_To_$.outType|publicIT$"
+
+func (g *genConversion) preexists(inType, outType *types.Type) (*types.Type, bool) {
+	function, ok := g.manualConversions[conversionPair{inType, outType}]
+	return function, ok
+}
+
+func (g *genConversion) preexistsPointers(inType, outType *types.Type) (*types.Type, bool) {
+	if inType.Kind != types.Pointer {
+		return nil, false
+	}
+	if outType.Kind != types.Pointer {
+		return nil, false
+	}
+	return g.preexists(inType.Elem, outType.Elem)
+}
+
+func (g *genConversion) Init(c *generator.Context, w io.Writer) error {
+	klogV := klog.V(6)
+	if klogV.Enabled() {
+		if m, ok := g.useUnsafe.(equalMemoryTypes); ok {
+			var result []string
+			klogV.Info("All objects without identical memory layout:")
+			for k, v := range m {
+				if v {
+					continue
+				}
+				result = append(result, fmt.Sprintf("  %s -> %s = %t", k.inType, k.outType, v))
+			}
+			sort.Strings(result)
+			for _, s := range result {
+				klogV.Info(s)
+			}
+		}
+	}
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+	sw.Do("func init() {\n", nil)
+	sw.Do("localSchemeBuilder.Register(RegisterConversions)\n", nil)
+	sw.Do("}\n", nil)
+
+	scheme := c.Universe.Type(types.Name{Package: runtimePackagePath, Name: "Scheme"})
+	schemePtr := &types.Type{
+		Kind: types.Pointer,
+		Elem: scheme,
+	}
+	sw.Do("// RegisterConversions adds conversion functions to the given scheme.\n", nil)
+	sw.Do("// Public to allow building arbitrary schemes.\n", nil)
+	sw.Do("func RegisterConversions(s $.|raw$) error {\n", schemePtr)
+	for _, t := range g.types {
+		peerType := getPeerTypeFor(c, t, g.peerPackages)
+		if _, found := g.preexists(t, peerType); !found {
+			args := argsFromType(t, peerType).With("Scope", types.Ref(conversionPackagePath, "Scope"))
+			sw.Do("if err := s.AddGeneratedConversionFunc((*$.inType|raw$)(nil), (*$.outType|raw$)(nil), func(a, b interface{}, scope $.Scope|raw$) error { return "+nameTmpl+"(a.(*$.inType|raw$), b.(*$.outType|raw$), scope) }); err != nil { return err }\n", args)
+		}
+		if _, found := g.preexists(peerType, t); !found {
+			args := argsFromType(peerType, t).With("Scope", types.Ref(conversionPackagePath, "Scope"))
+			sw.Do("if err := s.AddGeneratedConversionFunc((*$.inType|raw$)(nil), (*$.outType|raw$)(nil), func(a, b interface{}, scope $.Scope|raw$) error { return "+nameTmpl+"(a.(*$.inType|raw$), b.(*$.outType|raw$), scope) }); err != nil { return err }\n", args)
+		}
+	}
+
+	for i := range g.explicitConversions {
+		args := argsFromType(g.explicitConversions[i].inType, g.explicitConversions[i].outType).With("Scope", types.Ref(conversionPackagePath, "Scope"))
+		sw.Do("if err := s.AddGeneratedConversionFunc((*$.inType|raw$)(nil), (*$.outType|raw$)(nil), func(a, b interface{}, scope $.Scope|raw$) error { return "+nameTmpl+"(a.(*$.inType|raw$), b.(*$.outType|raw$), scope) }); err != nil { return err }\n", args)
+	}
+
+	var pairs []conversionPair
+	for pair, t := range g.manualConversions {
+		if t.Name.Package != g.outputPackage {
+			continue
+		}
+		pairs = append(pairs, pair)
+	}
+	// sort by name of the conversion function
+	sort.Slice(pairs, func(i, j int) bool {
+		return g.manualConversions[pairs[i]].Name.Name < g.manualConversions[pairs[j]].Name.Name
+	})
+	for _, pair := range pairs {
+		args := argsFromType(pair.inType, pair.outType).With("Scope", types.Ref(conversionPackagePath, "Scope")).With("fn", g.manualConversions[pair])
+		sw.Do("if err := s.AddConversionFunc((*$.inType|raw$)(nil), (*$.outType|raw$)(nil), func(a, b interface{}, scope $.Scope|raw$) error { return $.fn|raw$(a.(*$.inType|raw$), b.(*$.outType|raw$), scope) }); err != nil { return err }\n", args)
+	}
+
+	sw.Do("return nil\n", nil)
+	sw.Do("}\n\n", nil)
+	return sw.Error()
+}
+
+func (g *genConversion) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	klog.V(5).Infof("generating for type %v", t)
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+
+	if peerType := getPeerTypeFor(c, t, g.peerPackages); peerType != nil {
+		g.generateConversion(t, peerType, sw)
+		g.generateConversion(peerType, t, sw)
+	}
+
+	for _, inTypeName := range getExplicitFromTypes(t) {
+		inPkg, ok := c.Universe[inTypeName.Package]
+		if !ok {
+			klog.Errorf("Unrecognized package: %s", inTypeName.Package)
+			continue
+		}
+		inType, ok := inPkg.Types[inTypeName.Name]
+		if !ok {
+			klog.Errorf("Unrecognized type in package %s: %s", inTypeName.Package, inTypeName.Name)
+			continue
+		}
+		switch {
+		case inType.Name.Package == "net/url" && inType.Name.Name == "Values":
+			g.generateFromURLValues(inType, t, sw)
+		default:
+			klog.Errorf("Not supported input type: %#v", inType.Name)
+		}
+	}
+
+	return sw.Error()
+}
+
+func (g *genConversion) generateConversion(inType, outType *types.Type, sw *generator.SnippetWriter) {
+	args := argsFromType(inType, outType).
+		With("Scope", types.Ref(conversionPackagePath, "Scope"))
+
+	sw.Do("func auto"+nameTmpl+"(in *$.inType|raw$, out *$.outType|raw$, s $.Scope|raw$) error {\n", args)
+	g.generateFor(inType, outType, sw)
+	sw.Do("return nil\n", nil)
+	sw.Do("}\n\n", nil)
+
+	if _, found := g.preexists(inType, outType); found {
+		// There is a public manual Conversion method: use it.
+	} else if skipped := g.skippedFields[inType]; len(skipped) != 0 {
+		// The inType had some fields we could not generate.
+		klog.Errorf("Warning: could not find nor generate a final Conversion function for %v -> %v", inType, outType)
+		klog.Errorf("  the following fields need manual conversion:")
+		for _, f := range skipped {
+			klog.Errorf("      - %v", f)
+		}
+	} else {
+		// Emit a public conversion function.
+		sw.Do("// "+nameTmpl+" is an autogenerated conversion function.\n", args)
+		sw.Do("func "+nameTmpl+"(in *$.inType|raw$, out *$.outType|raw$, s $.Scope|raw$) error {\n", args)
+		sw.Do("return auto"+nameTmpl+"(in, out, s)\n", args)
+		sw.Do("}\n\n", nil)
+	}
+}
+
+// we use the system of shadowing 'in' and 'out' so that the same code is valid
+// at any nesting level. This makes the autogenerator easy to understand, and
+// the compiler shouldn't care.
+func (g *genConversion) generateFor(inType, outType *types.Type, sw *generator.SnippetWriter) {
+	klog.V(4).Infof("generating %v -> %v", inType, outType)
+	var f func(*types.Type, *types.Type, *generator.SnippetWriter)
+
+	switch inType.Kind {
+	case types.Builtin:
+		f = g.doBuiltin
+	case types.Map:
+		f = g.doMap
+	case types.Slice:
+		f = g.doSlice
+	case types.Struct:
+		f = g.doStruct
+	case types.Pointer:
+		f = g.doPointer
+	case types.Alias:
+		f = g.doAlias
+	default:
+		f = g.doUnknown
+	}
+
+	f(inType, outType, sw)
+}
+
+func (g *genConversion) doBuiltin(inType, outType *types.Type, sw *generator.SnippetWriter) {
+	if inType == outType {
+		sw.Do("*out = *in\n", nil)
+	} else {
+		sw.Do("*out = $.|raw$(*in)\n", outType)
+	}
+}
+
+func (g *genConversion) doMap(inType, outType *types.Type, sw *generator.SnippetWriter) {
+	sw.Do("*out = make($.|raw$, len(*in))\n", outType)
+	if isDirectlyAssignable(inType.Key, outType.Key) {
+		sw.Do("for key, val := range *in {\n", nil)
+		if isDirectlyAssignable(inType.Elem, outType.Elem) {
+			if inType.Key == outType.Key {
+				sw.Do("(*out)[key] = ", nil)
+			} else {
+				sw.Do("(*out)[$.|raw$(key)] = ", outType.Key)
+			}
+			if inType.Elem == outType.Elem {
+				sw.Do("val\n", nil)
+			} else {
+				sw.Do("$.|raw$(val)\n", outType.Elem)
+			}
+		} else {
+			conversionExists := true
+			conditionalConversionExists := false
+			if function, ok := g.preexists(inType.Elem, outType.Elem); ok {
+				sw.Do("newVal := new($.|raw$)\n", outType.Elem)
+				sw.Do("if err := $.|raw$(&val, newVal, s); err != nil {\n", function)
+			} else if function, ok := g.preexistsPointers(inType.Elem, outType.Elem); ok {
+				sw.Do("newVal := new($.|raw$)\n", outType.Elem)
+				sw.Do("if val != nil {\n", nil)
+				sw.Do("*newVal = new($.|raw$)\n", outType.Elem.Elem)
+				sw.Do("if err := $.|raw$(val, *newVal, s); err != nil {\n", function)
+				conditionalConversionExists = true
+			} else if g.convertibleOnlyWithinPackage(inType.Elem, outType.Elem) {
+				sw.Do("newVal := new($.|raw$)\n", outType.Elem)
+				sw.Do("if err := "+nameTmpl+"(&val, newVal, s); err != nil {\n", argsFromType(inType.Elem, outType.Elem))
+			} else {
+				args := argsFromType(inType.Elem, outType.Elem)
+				sw.Do("// FIXME: Provide conversion function to convert $.inType|raw$ to $.outType|raw$\n", args)
+				sw.Do("compileErrorOnMissingConversion()\n", nil)
+				conversionExists = false
+			}
+			if conversionExists {
+				sw.Do("return err\n", nil)
+				sw.Do("}\n", nil)
+				if conditionalConversionExists {
+					sw.Do("}\n", nil)
+				}
+				if inType.Key == outType.Key {
+					sw.Do("(*out)[key] = *newVal\n", nil)
+				} else {
+					sw.Do("(*out)[$.|raw$(key)] = *newVal\n", outType.Key)
+				}
+			}
+		}
+	} else {
+		// TODO: Implement it when necessary.
+		sw.Do("for range *in {\n", nil)
+		sw.Do("// FIXME: Converting unassignable keys unsupported $.|raw$\n", inType.Key)
+	}
+	sw.Do("}\n", nil)
+}
+
+func (g *genConversion) doSlice(inType, outType *types.Type, sw *generator.SnippetWriter) {
+	sw.Do("*out = make($.|raw$, len(*in))\n", outType)
+	if inType.Elem == outType.Elem && inType.Elem.Kind == types.Builtin {
+		sw.Do("copy(*out, *in)\n", nil)
+	} else {
+		sw.Do("for i := range *in {\n", nil)
+		if isDirectlyAssignable(inType.Elem, outType.Elem) {
+			if inType.Elem == outType.Elem {
+				sw.Do("(*out)[i] = (*in)[i]\n", nil)
+			} else {
+				sw.Do("(*out)[i] = $.|raw$((*in)[i])\n", outType.Elem)
+			}
+		} else {
+			conversionExists := true
+			conditionalConversionExists := false
+			if function, ok := g.preexists(inType.Elem, outType.Elem); ok {
+				sw.Do("if err := $.|raw$(&(*in)[i], &(*out)[i], s); err != nil {\n", function)
+			} else if function, ok := g.preexistsPointers(inType.Elem, outType.Elem); ok {
+				sw.Do("if (*in)[i] != nil {\n", nil)
+				sw.Do("(*out)[i] = new($.|raw$)\n", outType.Elem.Elem)
+				sw.Do("if err := $.|raw$((*in)[i], (*out)[i], s); err != nil {\n", function)
+				conditionalConversionExists = true
+			} else if g.convertibleOnlyWithinPackage(inType.Elem, outType.Elem) {
+				sw.Do("if err := "+nameTmpl+"(&(*in)[i], &(*out)[i], s); err != nil {\n", argsFromType(inType.Elem, outType.Elem))
+			} else {
+				args := argsFromType(inType.Elem, outType.Elem)
+				sw.Do("// FIXME: Provide conversion function to convert $.inType|raw$ to $.outType|raw$\n", args)
+				sw.Do("compileErrorOnMissingConversion()\n", nil)
+				conversionExists = false
+			}
+			if conversionExists {
+				sw.Do("return err\n", nil)
+				sw.Do("}\n", nil)
+				if conditionalConversionExists {
+					sw.Do("}\n", nil)
+				}
+			}
+		}
+		sw.Do("}\n", nil)
+	}
+}
+
+func (g *genConversion) doStruct(inType, outType *types.Type, sw *generator.SnippetWriter) {
+	ok, err := g.canUseMemoryCopyConversion(inType, outType)
+	if err != nil {
+		klog.Errorf("Type %v: error checking for direct-copy conversion: %v", inType, err)
+	}
+	if ok {
+		args := argsFromType(inType, outType).
+			With("Pointer", types.Ref("unsafe", "Pointer"))
+		sw.Do("*out = *(*$.outType|raw$)($.Pointer|raw$(in))\n", args)
+		return
+	}
+	for _, inMember := range inType.Members {
+		tagvals, err := extractTag(inMember.CommentLines)
+		if err != nil {
+			klog.Errorf("Member %v.%v: error extracting tags: %v", inType, inMember.Name, err)
+		}
+		if tagvals != nil && tagvals[0] == "false" {
+			// This field is excluded from conversion.
+			sw.Do("// INFO: in."+inMember.Name+" opted out of conversion generation\n", nil)
+			continue
+		}
+		outMember, found := findMember(outType, inMember.Name)
+		if !found {
+			// This field doesn't exist in the peer.
+			sw.Do("// WARNING: in."+inMember.Name+" requires manual conversion: does not exist in peer-type\n", nil)
+			g.skippedFields[inType] = append(g.skippedFields[inType], inMember.Name)
+			continue
+		}
+
+		if namer.IsPrivateGoName(inMember.Name) && g.outputPackage != inType.Name.Package {
+			sw.Do("// WARNING: in."+inMember.Name+" is not exported and cannot be read\n", nil)
+			g.skippedFields[inType] = append(g.skippedFields[inType], inMember.Name)
+			continue
+		}
+		if namer.IsPrivateGoName(outMember.Name) && g.outputPackage != outType.Name.Package {
+			sw.Do("// WARNING: out."+inMember.Name+" is not exported and cannot be set\n", nil)
+			g.skippedFields[inType] = append(g.skippedFields[inType], inMember.Name)
+			continue
+		}
+
+		inMemberType, outMemberType := inMember.Type, outMember.Type
+		// create a copy of both underlying types but give them the top level alias name (since aliases
+		// are assignable)
+		if underlying := unwrapAlias(inMemberType); underlying != inMemberType {
+			copied := *underlying
+			copied.Name = inMemberType.Name
+			inMemberType = &copied
+		}
+		if underlying := unwrapAlias(outMemberType); underlying != outMemberType {
+			copied := *underlying
+			copied.Name = outMemberType.Name
+			outMemberType = &copied
+		}
+
+		args := argsFromType(inMemberType, outMemberType).With("name", inMember.Name)
+
+		// try a direct memory copy for any type that has exactly equivalent values
+		if g.useUnsafe.Equal(inMemberType, outMemberType) {
+			args = args.
+				With("Pointer", types.Ref("unsafe", "Pointer")).
+				With("SliceHeader", types.Ref("reflect", "SliceHeader"))
+			switch inMemberType.Kind {
+			case types.Pointer:
+				sw.Do("out.$.name$ = ($.outType|raw$)($.Pointer|raw$(in.$.name$))\n", args)
+				continue
+			case types.Map:
+				sw.Do("out.$.name$ = *(*$.outType|raw$)($.Pointer|raw$(&in.$.name$))\n", args)
+				continue
+			case types.Slice:
+				sw.Do("out.$.name$ = *(*$.outType|raw$)($.Pointer|raw$(&in.$.name$))\n", args)
+				continue
+			}
+		}
+
+		// check based on the top level name, not the underlying names
+		if function, ok := g.preexists(inMember.Type, outMember.Type); ok {
+			dropFn, err := isDrop(function.CommentLines)
+			if err != nil {
+				klog.Errorf("Error extracting drop tag for function %s: %v", function.Name, err)
+			} else if dropFn {
+				continue
+			}
+			// copy-only functions that are directly assignable can be inlined instead of invoked.
+			// As an example, conversion functions exist that allow types with private fields to be
+			// correctly copied between types. These functions are equivalent to a memory assignment,
+			// and are necessary for the reflection path, but should not block memory conversion.
+			// Convert_unversioned_Time_to_unversioned_Time is an example of this logic.
+			copyOnly, copyErr := isCopyOnly(function.CommentLines)
+			if copyErr != nil {
+				klog.Errorf("Error extracting copy-only tag for function %s: %v", function.Name, copyErr)
+				copyOnly = false
+			}
+			if !copyOnly || !g.isFastConversion(inMemberType, outMemberType) {
+				args["function"] = function
+				sw.Do("if err := $.function|raw$(&in.$.name$, &out.$.name$, s); err != nil {\n", args)
+				sw.Do("return err\n", nil)
+				sw.Do("}\n", nil)
+				continue
+			}
+			klog.V(2).Infof("Skipped function %s because it is copy-only and we can use direct assignment", function.Name)
+		}
+
+		// If we can't auto-convert, punt before we emit any code.
+		if inMemberType.Kind != outMemberType.Kind {
+			sw.Do("// WARNING: in."+inMember.Name+" requires manual conversion: inconvertible types ("+
+				inMemberType.String()+" vs "+outMemberType.String()+")\n", nil)
+			g.skippedFields[inType] = append(g.skippedFields[inType], inMember.Name)
+			continue
+		}
+
+		switch inMemberType.Kind {
+		case types.Builtin:
+			if inMemberType == outMemberType {
+				sw.Do("out.$.name$ = in.$.name$\n", args)
+			} else {
+				sw.Do("out.$.name$ = $.outType|raw$(in.$.name$)\n", args)
+			}
+		case types.Map, types.Slice, types.Pointer:
+			if g.isDirectlyAssignable(inMemberType, outMemberType) {
+				sw.Do("out.$.name$ = in.$.name$\n", args)
+				continue
+			}
+
+			sw.Do("if in.$.name$ != nil {\n", args)
+			sw.Do("in, out := &in.$.name$, &out.$.name$\n", args)
+			g.generateFor(inMemberType, outMemberType, sw)
+			sw.Do("} else {\n", nil)
+			sw.Do("out.$.name$ = nil\n", args)
+			sw.Do("}\n", nil)
+		case types.Struct:
+			if g.isDirectlyAssignable(inMemberType, outMemberType) {
+				sw.Do("out.$.name$ = in.$.name$\n", args)
+				continue
+			}
+			conversionExists := true
+			if g.convertibleOnlyWithinPackage(inMemberType, outMemberType) {
+				sw.Do("if err := "+nameTmpl+"(&in.$.name$, &out.$.name$, s); err != nil {\n", args)
+			} else {
+				args := argsFromType(inMemberType, outMemberType)
+				sw.Do("// FIXME: Provide conversion function to convert $.inType|raw$ to $.outType|raw$\n", args)
+				sw.Do("compileErrorOnMissingConversion()\n", nil)
+				conversionExists = false
+			}
+			if conversionExists {
+				sw.Do("return err\n", nil)
+				sw.Do("}\n", nil)
+			}
+		case types.Alias:
+			if isDirectlyAssignable(inMemberType, outMemberType) {
+				if inMemberType == outMemberType {
+					sw.Do("out.$.name$ = in.$.name$\n", args)
+				} else {
+					sw.Do("out.$.name$ = $.outType|raw$(in.$.name$)\n", args)
+				}
+			} else {
+				conversionExists := true
+				if g.convertibleOnlyWithinPackage(inMemberType, outMemberType) {
+					sw.Do("if err := "+nameTmpl+"(&in.$.name$, &out.$.name$, s); err != nil {\n", args)
+				} else {
+					args := argsFromType(inMemberType, outMemberType)
+					sw.Do("// FIXME: Provide conversion function to convert $.inType|raw$ to $.outType|raw$\n", args)
+					sw.Do("compileErrorOnMissingConversion()\n", nil)
+					conversionExists = false
+				}
+				if conversionExists {
+					sw.Do("return err\n", nil)
+					sw.Do("}\n", nil)
+				}
+			}
+		default:
+			conversionExists := true
+			if g.convertibleOnlyWithinPackage(inMemberType, outMemberType) {
+				sw.Do("if err := "+nameTmpl+"(&in.$.name$, &out.$.name$, s); err != nil {\n", args)
+			} else {
+				args := argsFromType(inMemberType, outMemberType)
+				sw.Do("// FIXME: Provide conversion function to convert $.inType|raw$ to $.outType|raw$\n", args)
+				sw.Do("compileErrorOnMissingConversion()\n", nil)
+				conversionExists = false
+			}
+			if conversionExists {
+				sw.Do("return err\n", nil)
+				sw.Do("}\n", nil)
+			}
+		}
+	}
+}
+
+// canUseMemoryCopyConversion reports whether two struct types can be converted
+// with a single unsafe memory copy rather than field-by-field conversion. This
+// returns true only for structs that are both memory-identical and do not have any
+// manual conversions (except copy-only conversions, which are allowed).
+func (g *genConversion) canUseMemoryCopyConversion(inType, outType *types.Type) (bool, error) {
+	if !g.useUnsafe.Equal(inType, outType) {
+		return false, nil
+	}
+	for _, inMember := range inType.Members {
+		tagvals, err := extractTag(inMember.CommentLines)
+		if err != nil {
+			return false, err
+		}
+		if len(tagvals) > 0 && tagvals[0] == "false" {
+			return false, nil // opted out of conversion-gen
+		}
+		outMember, found := findMember(outType, inMember.Name)
+		if !found {
+			return false, nil
+		}
+
+		if namer.IsPrivateGoName(inMember.Name) && g.outputPackage != inType.Name.Package {
+			return false, nil
+		}
+		if namer.IsPrivateGoName(outMember.Name) && g.outputPackage != outType.Name.Package {
+			return false, nil
+		}
+		// Bail out if there is a manual conversion other than 'copy-only'.
+		if function, ok := g.preexists(inMember.Type, outMember.Type); ok {
+			copyOnly, err := isCopyOnly(function.CommentLines)
+			if err != nil || !copyOnly {
+				return false, err
+			}
+		}
+	}
+	return true, nil
+}
+
+func (g *genConversion) isFastConversion(inType, outType *types.Type) bool {
+	switch inType.Kind {
+	case types.Builtin:
+		return true
+	case types.Map, types.Slice, types.Pointer, types.Struct, types.Alias:
+		return g.isDirectlyAssignable(inType, outType)
+	default:
+		return false
+	}
+}
+
+func (g *genConversion) isDirectlyAssignable(inType, outType *types.Type) bool {
+	return unwrapAlias(inType) == unwrapAlias(outType)
+}
+
+func (g *genConversion) doPointer(inType, outType *types.Type, sw *generator.SnippetWriter) {
+	sw.Do("*out = new($.Elem|raw$)\n", outType)
+	if isDirectlyAssignable(inType.Elem, outType.Elem) {
+		if inType.Elem == outType.Elem {
+			sw.Do("**out = **in\n", nil)
+		} else {
+			sw.Do("**out = $.|raw$(**in)\n", outType.Elem)
+		}
+	} else {
+		conversionExists := true
+		if function, ok := g.preexists(inType.Elem, outType.Elem); ok {
+			sw.Do("if err := $.|raw$(*in, *out, s); err != nil {\n", function)
+		} else if g.convertibleOnlyWithinPackage(inType.Elem, outType.Elem) {
+			sw.Do("if err := "+nameTmpl+"(*in, *out, s); err != nil {\n", argsFromType(inType.Elem, outType.Elem))
+		} else {
+			args := argsFromType(inType.Elem, outType.Elem)
+			sw.Do("// FIXME: Provide conversion function to convert $.inType|raw$ to $.outType|raw$\n", args)
+			sw.Do("compileErrorOnMissingConversion()\n", nil)
+			conversionExists = false
+		}
+		if conversionExists {
+			sw.Do("return err\n", nil)
+			sw.Do("}\n", nil)
+		}
+	}
+}
+
+func (g *genConversion) doAlias(inType, outType *types.Type, sw *generator.SnippetWriter) {
+	// TODO: Add support for aliases.
+	g.doUnknown(inType, outType, sw)
+}
+
+func (g *genConversion) doUnknown(inType, outType *types.Type, sw *generator.SnippetWriter) {
+	sw.Do("// FIXME: Type $.|raw$ is unsupported.\n", inType)
+}
+
+func (g *genConversion) generateFromURLValues(inType, outType *types.Type, sw *generator.SnippetWriter) {
+	args := generator.Args{
+		"inType":  inType,
+		"outType": outType,
+		"Scope":   types.Ref(conversionPackagePath, "Scope"),
+	}
+	sw.Do("func auto"+nameTmpl+"(in *$.inType|raw$, out *$.outType|raw$, s $.Scope|raw$) error {\n", args)
+	for _, outMember := range outType.Members {
+		tagvals, err := extractTag(outMember.CommentLines)
+		if err != nil {
+			klog.Errorf("Member %v.%v: error extracting tags: %v", outType, outMember.Name, err)
+		}
+		if tagvals != nil && tagvals[0] == "false" {
+			// This field is excluded from conversion.
+			sw.Do("// INFO: in."+outMember.Name+" opted out of conversion generation\n", nil)
+			continue
+		}
+		jsonTag := reflect.StructTag(outMember.Tags).Get("json")
+		index := strings.Index(jsonTag, ",")
+		if index == -1 {
+			index = len(jsonTag)
+		}
+		if index == 0 {
+			memberArgs := generator.Args{
+				"name": outMember.Name,
+			}
+			sw.Do("// WARNING: Field $.name$ does not have json tag, skipping.\n\n", memberArgs)
+			continue
+		}
+		memberArgs := generator.Args{
+			"name": outMember.Name,
+			"tag":  jsonTag[:index],
+		}
+		sw.Do("if values, ok := map[string][]string(*in)[\"$.tag$\"]; ok && len(values) > 0 {\n", memberArgs)
+		g.fromValuesEntry(inType.Underlying.Elem, outMember, sw)
+		sw.Do("} else {\n", nil)
+		g.setZeroValue(outMember, sw)
+		sw.Do("}\n", nil)
+	}
+	sw.Do("return nil\n", nil)
+	sw.Do("}\n\n", nil)
+
+	if _, found := g.preexists(inType, outType); found {
+		// There is a public manual Conversion method: use it.
+	} else {
+		// Emit a public conversion function.
+		sw.Do("// "+nameTmpl+" is an autogenerated conversion function.\n", args)
+		sw.Do("func "+nameTmpl+"(in *$.inType|raw$, out *$.outType|raw$, s $.Scope|raw$) error {\n", args)
+		sw.Do("return auto"+nameTmpl+"(in, out, s)\n", args)
+		sw.Do("}\n\n", nil)
+	}
+}
+
+func (g *genConversion) fromValuesEntry(inType *types.Type, outMember types.Member, sw *generator.SnippetWriter) {
+	memberArgs := generator.Args{
+		"name": outMember.Name,
+		"type": outMember.Type,
+	}
+	if function, ok := g.preexists(inType, outMember.Type); ok {
+		args := memberArgs.With("function", function)
+		sw.Do("if err := $.function|raw$(&values, &out.$.name$, s); err != nil {\n", args)
+		sw.Do("return err\n", nil)
+		sw.Do("}\n", nil)
+		return
+	}
+	switch {
+	case outMember.Type == types.String:
+		sw.Do("out.$.name$ = values[0]\n", memberArgs)
+	case g.useUnsafe.Equal(inType, outMember.Type):
+		args := memberArgs.With("Pointer", types.Ref("unsafe", "Pointer"))
+		switch inType.Kind {
+		case types.Pointer:
+			sw.Do("out.$.name$ = ($.type|raw$)($.Pointer|raw$(&values))\n", args)
+		case types.Map, types.Slice:
+			sw.Do("out.$.name$ = *(*$.type|raw$)($.Pointer|raw$(&values))\n", args)
+		default:
+			// TODO: Support other types to allow more auto-conversions.
+			sw.Do("// FIXME: out.$.name$ is of not yet supported type and requires manual conversion\n", memberArgs)
+		}
+	default:
+		// TODO: Support other types to allow more auto-conversions.
+		sw.Do("// FIXME: out.$.name$ is of not yet supported type and requires manual conversion\n", memberArgs)
+	}
+}
+
+func (g *genConversion) setZeroValue(outMember types.Member, sw *generator.SnippetWriter) {
+	outMemberType := unwrapAlias(outMember.Type)
+	memberArgs := generator.Args{
+		"name":  outMember.Name,
+		"alias": outMember.Type,
+		"type":  outMemberType,
+	}
+
+	switch outMemberType.Kind {
+	case types.Builtin:
+		switch outMemberType {
+		case types.String:
+			sw.Do("out.$.name$ = \"\"\n", memberArgs)
+		case types.Int64, types.Int32, types.Int16, types.Int, types.Uint64, types.Uint32, types.Uint16, types.Uint:
+			sw.Do("out.$.name$ = 0\n", memberArgs)
+		case types.Uintptr, types.Byte:
+			sw.Do("out.$.name$ = 0\n", memberArgs)
+		case types.Float64, types.Float32, types.Float:
+			sw.Do("out.$.name$ = 0\n", memberArgs)
+		case types.Bool:
+			sw.Do("out.$.name$ = false\n", memberArgs)
+		default:
+			sw.Do("// FIXME: out.$.name$ is of unsupported type and requires manual conversion\n", memberArgs)
+		}
+	case types.Struct:
+		if outMemberType == outMember.Type {
+			sw.Do("out.$.name$ = $.type|raw${}\n", memberArgs)
+		} else {
+			sw.Do("out.$.name$ = $.alias|raw$($.type|raw${})\n", memberArgs)
+		}
+	case types.Map, types.Slice, types.Pointer:
+		sw.Do("out.$.name$ = nil\n", memberArgs)
+	case types.Alias:
+		// outMemberType was already unwrapped from aliases - so that should never happen.
+		sw.Do("// FIXME: unexpected error for out.$.name$\n", memberArgs)
+	case types.Interface, types.Array:
+		sw.Do("out.$.name$ = nil\n", memberArgs)
+	default:
+		sw.Do("// FIXME: out.$.name$ is of unsupported type and requires manual conversion\n", memberArgs)
+	}
+}
+
+func isDirectlyAssignable(inType, outType *types.Type) bool {
+	// TODO: This should maybe check for actual assignability between the two
+	// types, rather than superficial traits that happen to indicate it is
+	// assignable in the ways we currently use this code.
+	return inType.IsAssignable() && (inType.IsPrimitive() || isSamePackage(inType, outType))
+}
+
+func isSamePackage(inType, outType *types.Type) bool {
+	return inType.Name.Package == outType.Name.Package
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/conversion-gen/generators/conversion_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/conversion-gen/generators/conversion_test.go
new file mode 100644
index 0000000000..49f636430b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/conversion-gen/generators/conversion_test.go
@@ -0,0 +1,234 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"testing"
+
+	"k8s.io/gengo/v2/types"
+)
+
+func builtin(name string) *types.Type {
+	return &types.Type{Name: types.Name{Name: name}, Kind: types.Builtin}
+}
+
+func structOf(pkg, name string, members ...types.Member) *types.Type {
+	return &types.Type{
+		Name:    types.Name{Package: pkg, Name: name},
+		Kind:    types.Struct,
+		Members: members,
+	}
+}
+
+func field(name string, t *types.Type, comments ...string) types.Member {
+	return types.Member{Name: name, Type: t, CommentLines: comments}
+}
+
+func conversionFn(comments ...string) *types.Type {
+	return &types.Type{Name: types.Name{Name: "ConversionFunc"}, CommentLines: comments}
+}
+
+func TestCanUseMemoryCopyConversion(t *testing.T) {
+	str := builtin("string")
+	i := builtin("int")
+	meta := structOf("meta", "TypeMeta", field("Kind", str))
+	metaExt := structOf("ext", "TypeMeta", field("Kind", str))
+	metaInt := structOf("int", "TypeMeta", field("Kind", str))
+	metaAlias := &types.Type{Name: types.Name{Package: "ext", Name: "MetaAlias"}, Kind: types.Alias, Underlying: metaExt}
+
+	level2Ext := structOf("ext", "Level2", field("Value", str))
+	level2Int := structOf("int", "Level2", field("Value", str))
+	level1Ext := structOf("ext", "Level1", field("Level2", level2Ext))
+	level1Int := structOf("int", "Level1", field("Level2", level2Int))
+	aSpecExt := structOf("ext", "ASpec", field("Level1", level1Ext))
+	aSpecInt := structOf("int", "ASpec", field("Level1", level1Int))
+	aExt := structOf("ext", "A", field("Spec", aSpecExt))
+	aInt := structOf("int", "A", field("Spec", aSpecInt))
+
+	tests := []struct {
+		name              string
+		outputPackage     string
+		manualConversions conversionFuncMap
+		in                *types.Type
+		out               *types.Type
+		want              bool
+		wantErr           string
+	}{
+		{
+			name: "identical",
+			in:   structOf("ext", "T", field("Name", str), field("Age", i)),
+			out:  structOf("int", "T", field("Name", str), field("Age", i)),
+			want: true,
+		},
+		{
+			name: "not identical",
+			in:   structOf("ext", "T", field("Name", str)),
+			out:  structOf("int", "T", field("Identifier", str)),
+			want: false,
+		},
+		{
+			name: "empty struct",
+			in:   structOf("ext", "T"),
+			out:  structOf("int", "T"),
+			want: true,
+		},
+		{
+			name: "member opted out of conversion generation",
+			in:   structOf("ext", "T", field("Name", str, "+k8s:conversion-gen=false")),
+			out:  structOf("int", "T", field("Name", str)),
+			want: false,
+		},
+		{
+			name: "member missing in peer",
+			in:   structOf("ext", "T", field("Name", str), field("Extra", i)),
+			out:  structOf("int", "T", field("Name", str)),
+			want: false,
+		},
+		{
+			name:          "unexported member, output package internal",
+			outputPackage: "int",
+			in:            structOf("ext", "T", field("secret", str)),
+			out:           structOf("int", "T", field("secret", str)),
+			want:          false,
+		},
+		{
+			name:          "unexported member, output package is external",
+			outputPackage: "ext",
+			in:            structOf("ext", "T", field("secret", str)),
+			out:           structOf("int", "T", field("secret", str)),
+			want:          false,
+		},
+		{
+			name:          "unexported member, but conversion happens inside package",
+			outputPackage: "p",
+			in:            structOf("p", "T", field("secret", str)),
+			out:           structOf("p", "T", field("secret", str)),
+			want:          true,
+		},
+		{
+			name:              "member has a dropping manual conversion",
+			manualConversions: conversionFuncMap{{meta, meta}: conversionFn("+k8s:conversion-fn=drop")},
+			in:                structOf("ext", "T", field("Meta", meta)),
+			out:               structOf("int", "T", field("Meta", meta)),
+			want:              false,
+		},
+		{
+			name:              "member has a manual conversion",
+			manualConversions: conversionFuncMap{{meta, meta}: conversionFn()},
+			in:                structOf("ext", "T", field("Meta", meta)),
+			out:               structOf("int", "T", field("Meta", meta)),
+			want:              false,
+		},
+		{
+			name:              "member has a copy-only manual conversion",
+			manualConversions: conversionFuncMap{{meta, meta}: conversionFn("+k8s:conversion-fn=copy-only")},
+			in:                structOf("ext", "T", field("Meta", meta)),
+			out:               structOf("int", "T", field("Meta", meta)),
+			want:              true,
+		},
+		{
+			name:              "identical types: drop is honored",
+			manualConversions: conversionFuncMap{{metaExt, metaInt}: conversionFn("+k8s:conversion-fn=drop")},
+			in:                structOf("ext", "T", field("Meta", metaExt)),
+			out:               structOf("int", "T", field("Meta", metaInt)),
+			want:              false,
+		},
+		{
+			name:              "identical types: copy-only",
+			manualConversions: conversionFuncMap{{metaExt, metaInt}: conversionFn("+k8s:conversion-fn=copy-only")},
+			in:                structOf("ext", "T", field("Meta", metaExt)),
+			out:               structOf("int", "T", field("Meta", metaInt)),
+			want:              true,
+		},
+		{
+			name:              "conversion on alias, not underlying type",
+			manualConversions: conversionFuncMap{{metaAlias, metaAlias}: conversionFn("+k8s:conversion-fn=drop")},
+			in:                structOf("ext", "T", field("Meta", metaAlias)),
+			out:               structOf("int", "T", field("Meta", metaAlias)),
+			want:              false,
+		},
+		{
+			name:    "tag parse error",
+			in:      structOf("ext", "T", field("Name", str, "+k8s:conversion-gen(a, b)=false")),
+			out:     structOf("int", "T", field("Name", str)),
+			wantErr: "multiple arguments must use 'name: value' syntax",
+		},
+		{
+			name: "equalMemoryTypes compare: identical",
+			in:   structOf("ext", "T", field("Name", str)),
+			out:  structOf("int", "T", field("Name", str)),
+			want: true,
+		},
+		{
+			name: "equalMemoryTypes compare: not identical",
+			in:   structOf("ext", "T", field("Name", str)),
+			out:  structOf("int", "T", field("Name", i)),
+			want: false,
+		},
+		{
+			name: "two members: not identical",
+			in:   structOf("ext", "T", field("OK", str), field("Bad", i, "+k8s:conversion-gen=false")),
+			out:  structOf("int", "T", field("OK", str), field("Bad", i)),
+			want: false,
+		},
+		{
+			name: "conversion-gen=true does not opt out",
+			in:   structOf("ext", "T", field("Name", str, "+k8s:conversion-gen=true")),
+			out:  structOf("int", "T", field("Name", str)),
+			want: true,
+		},
+		{
+			name:              "nested manual conversion blocks memory copy at every ancestor",
+			manualConversions: conversionFuncMap{{level2Ext, level2Int}: conversionFn()},
+			in:                aExt,
+			out:               aInt,
+			want:              false,
+		},
+		{
+			name:              "nested copy-only conversion does not block memory copy",
+			manualConversions: conversionFuncMap{{level2Ext, level2Int}: conversionFn("+k8s:conversion-fn=copy-only")},
+			in:                aExt,
+			out:               aInt,
+			want:              true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			useUnsafe := equalMemoryTypes{}
+			for pair, fn := range tt.manualConversions {
+				copyOnly, _ := isCopyOnly(fn.CommentLines)
+				if copyOnly {
+					continue
+				}
+				useUnsafe.Skip(pair.inType, pair.outType)
+			}
+			g := &genConversion{
+				outputPackage:     tt.outputPackage,
+				manualConversions: tt.manualConversions,
+				useUnsafe:         useUnsafe,
+			}
+			gotOK, err := g.canUseMemoryCopyConversion(tt.in, tt.out)
+			if err != nil && err.Error() != tt.wantErr {
+				t.Fatalf("canUseMemoryCopyConversion() error = %v, wantErr = %v", err, tt.wantErr)
+			}
+			if gotOK != tt.want {
+				t.Errorf("canUseMemoryCopyConversion() = %v, want %v", gotOK, tt.want)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/conversion-gen/main.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/conversion-gen/main.go
new file mode 100644
index 0000000000..5aec5025d5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/conversion-gen/main.go
@@ -0,0 +1,137 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// conversion-gen is a tool for auto-generating functions that convert
+// between internal and external types.  A general conversion code
+// generation task involves three sets of packages: (1) a set of
+// packages containing internal types, (2) a single package containing
+// the external types, and (3) a single destination package (i.e.,
+// where the generated conversion functions go, and where the
+// developer-authored conversion functions are).  The packages
+// containing the internal types play the role known as "peer
+// packages" in the general code-generation framework of Kubernetes.
+//
+// For each conversion task, `conversion-gen` will generate functions
+// that efficiently convert between same-name types in the two
+// (internal, external) packages.  The generated functions include
+// ones named
+//
+//	autoConvert_<pkg1>_<type>_To_<pkg2>_<type>
+//
+// for each such pair of types --- both with (pkg1,pkg2) =
+// (internal,external) and (pkg1,pkg2) = (external,internal).  The
+// generated conversion functions recurse on the structure of the data
+// types.  For structs, source and destination fields are matched up
+// according to name; if a source field has no corresponding
+// destination or there is a fundamental mismatch in the type of the
+// field then the generated autoConvert_... function has just a
+// warning comment about that field.  The generated conversion
+// functions use standard value assignment wherever possible.  For
+// compound types, the generated conversion functions call the
+// `Convert...` functions for the subsidiary types.
+//
+// For each pair of types `conversion-gen` will also generate a
+// function named
+//
+//	Convert_<pkg1>_<type>_To_<pkg2>_<type>
+//
+// if both of two conditions are met: (1) the destination package does
+// not contain a function of that name in a non-generated file and (2)
+// the generation of the corresponding autoConvert_...  function did
+// not run into trouble with a missing or fundamentally differently
+// typed field.  A generated Convert_... function simply calls the
+// corresponding `autoConvert...` function.  `conversion_gen` also
+// generates a function that updates a given `runtime.Scheme` by
+// registering all the Convert_... functions found and generated.
+// Thus developers can override the generated behavior for selected
+// type pairs by putting the desired Convert_... functions in
+// non-generated files.  Further, developers are practically required
+// to override the generated behavior when there are missing or
+// fundamentally differently typed fields.
+//
+// `conversion-gen` will scan its `--input-dirs`, looking at the
+// package defined in each of those directories for comment tags that
+// define a conversion code generation task.  A package requests
+// conversion code generation by including one or more comment in the
+// package's `doc.go` file (currently anywhere in that file is
+// acceptable, but the recommended location is above the `package`
+// statement), of the form:
+//
+//	// +k8s:conversion-gen=<import-path-of-internal-package>
+//
+// This introduces a conversion task, for which the destination
+// package is the one containing the file with the tag and the tag
+// identifies a package containing internal types.  If there is also a
+// tag of the form
+//
+//	// +k8s:conversion-gen-external-types=<import-path-of-external-package>
+//
+// then it identifies the package containing the external types;
+// otherwise they are in the destination package.
+//
+// For each conversion code generation task, the full set of internal
+// packages (AKA peer packages) consists of the ones specified in the
+// `k8s:conversion-gen` tags PLUS any specified in the
+// `--base-peer-dirs` and `--extra-peer-dirs` flags on the command
+// line.
+//
+// When generating for a package, individual types or fields of structs may opt
+// out of Conversion generation by specifying a comment on the of the form:
+//
+//	// +k8s:conversion-gen=false
+package main
+
+import (
+	"flag"
+
+	"github.com/spf13/pflag"
+	"k8s.io/klog/v2"
+
+	generatorargs "k8s.io/code-generator/cmd/conversion-gen/args"
+	"k8s.io/code-generator/cmd/conversion-gen/generators"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+)
+
+func main() {
+	klog.InitFlags(nil)
+	args := generatorargs.New()
+
+	args.AddFlags(pflag.CommandLine)
+	flag.Set("logtostderr", "true")
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+	pflag.Parse()
+
+	if err := args.Validate(); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+
+	myTargets := func(context *generator.Context) []generator.Target {
+		return generators.GetTargets(context, args)
+	}
+
+	// Run it.
+	if err := gengo.Execute(
+		generators.NameSystems(),
+		generators.DefaultNameSystem(),
+		myTargets,
+		args.GeneratedBuildTag,
+		pflag.Args(),
+	); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+	klog.V(2).Info("Completed successfully.")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/args/args.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/args/args.go
new file mode 100644
index 0000000000..90080c391d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/args/args.go
@@ -0,0 +1,57 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package args
+
+import (
+	"fmt"
+
+	"github.com/spf13/pflag"
+
+	"k8s.io/code-generator/pkg/apidefinitions"
+)
+
+type Args struct {
+	OutputFile   string
+	GoHeaderFile string
+
+	apidefinitions.LintArgs
+}
+
+// New returns default arguments for the generator.
+func New() *Args {
+	return &Args{}
+}
+
+// AddFlags add the generator flags to the flag set.
+func (args *Args) AddFlags(fs *pflag.FlagSet) {
+	fs.StringVar(&args.OutputFile, "output-file", "generated.deepcopy.go",
+		"the name of the file to be generated")
+	fs.StringVar(&args.GoHeaderFile, "go-header-file", "",
+		"the path to a file containing boilerplate header text; the string \"YEAR\" will be replaced with the current 4-digit year")
+	apidefinitions.AddFlags(&args.LintArgs, fs)
+}
+
+// Validate checks the given arguments.
+func (args *Args) Validate() error {
+	if len(args.OutputFile) == 0 {
+		return fmt.Errorf("--output-file must be specified")
+	}
+	if err := apidefinitions.ValidateFlags(args.LintRules); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/generators/deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/generators/deepcopy.go
new file mode 100644
index 0000000000..e1ed4f3c0d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/generators/deepcopy.go
@@ -0,0 +1,921 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"fmt"
+	"io"
+	"path"
+	"sort"
+	"strings"
+
+	"k8s.io/code-generator/cmd/deepcopy-gen/args"
+	"k8s.io/code-generator/pkg/apidefinitions"
+	genutil "k8s.io/code-generator/pkg/util"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/klog/v2"
+)
+
+// This is the comment tag that carries parameters for deep-copy generation.
+const (
+	tagEnabledName              = "k8s:deepcopy-gen"
+	interfacesTagName           = tagEnabledName + ":interfaces"
+	interfacesNonPointerTagName = tagEnabledName + ":nonpointer-interfaces" // attach the DeepCopy<Interface> methods to the
+)
+
+// Known values for the comment tag.
+const tagValuePackage = "package"
+
+// enabledTagValue holds parameters from a tagName tag.
+type enabledTagValue struct {
+	value    string
+	register bool
+}
+
+func extractEnabledTypeTag(t *types.Type) *enabledTagValue {
+	comments := append(append([]string{}, t.SecondClosestCommentLines...), t.CommentLines...)
+	return extractEnabledTag(comments)
+}
+
+func extractEnabledTag(comments []string) *enabledTagValue {
+	tags, err := genutil.ExtractCommentTagsWithoutArguments("+", []string{tagEnabledName}, comments)
+	if err != nil {
+		klog.Fatalf("Error extracting %s tags: %v", tagEnabledName, err)
+	}
+	if tags[tagEnabledName] == nil {
+		// No match for the tag.
+		return nil
+	}
+	// If there are multiple values, abort.
+	if len(tags[tagEnabledName]) > 1 {
+		klog.Fatalf("Found %d %s tags: %q", len(tags[tagEnabledName]), tagEnabledName, tags[tagEnabledName])
+	}
+
+	// If we got here we are returning something.
+	tag := &enabledTagValue{}
+
+	// Get the primary value.
+	parts := strings.Split(tags[tagEnabledName][0], ",")
+	if len(parts) >= 1 {
+		tag.value = parts[0]
+	}
+
+	// Parse extra arguments.
+	parts = parts[1:]
+	for i := range parts {
+		kv := strings.SplitN(parts[i], "=", 2)
+		k := kv[0]
+		v := ""
+		if len(kv) == 2 {
+			v = kv[1]
+		}
+		switch k {
+		case "register":
+			if v != "false" {
+				tag.register = true
+			}
+		default:
+			klog.Fatalf("Unsupported %s param: %q", tagEnabledName, parts[i])
+		}
+	}
+	return tag
+}
+
+// TODO: This is created only to reduce number of changes in a single PR.
+// Remove it and use PublicNamer instead.
+func deepCopyNamer() *namer.NameStrategy {
+	return &namer.NameStrategy{
+		Join: func(pre string, in []string, post string) string {
+			return strings.Join(in, "_")
+		},
+		PrependPackageNames: 1,
+	}
+}
+
+// NameSystems returns the name system used by the generators in this package.
+func NameSystems() namer.NameSystems {
+	return namer.NameSystems{
+		"public": deepCopyNamer(),
+		"raw":    namer.NewRawNamer("", nil),
+	}
+}
+
+// DefaultNameSystem returns the default name system for ordering the types to be
+// processed by the generators in this package.
+func DefaultNameSystem() string {
+	return "public"
+}
+
+func GetTargets(context *generator.Context, args *args.Args) []generator.Target {
+	boilerplate, err := gengo.GoBoilerplate(args.GoHeaderFile, gengo.StdBuildTag, gengo.StdGeneratedBy)
+	if err != nil {
+		klog.Fatalf("Failed loading boilerplate: %v", err)
+	}
+
+	var idOpts []apidefinitions.Option
+	if len(args.LintRules) > 0 {
+		idOpts = append(idOpts, apidefinitions.WithLintRules(args.LintRules...))
+	}
+
+	targetList := []generator.Target{}
+
+	for _, i := range context.Inputs {
+		klog.V(3).Infof("considering pkg %q", i)
+		pkg := context.Universe[i]
+
+		info, err := apidefinitions.Identify(pkg, apidefinitions.Deepcopy, idOpts...)
+		if err != nil {
+			klog.Fatal(err)
+		}
+		if !info.ShouldGenerate() {
+			klog.V(3).Infof("  inactive (no +k8s:deepcopy-gen, no type-level opt-in, or =false)")
+			continue
+		}
+
+		// extractEnabledTag also parses the comma-separated subparams
+		// (e.g. ",register=true"), which Target.Values does not.
+		ptag := extractEnabledTag(pkg.Comments)
+		ptagValue := ""
+		ptagRegister := false
+		if ptag != nil {
+			ptagValue = ptag.value
+			if ptagValue != tagValuePackage {
+				klog.Fatalf("Package %v: unsupported %s value: %q", i, tagEnabledName, ptagValue)
+			}
+			ptagRegister = ptag.register
+			klog.V(3).Infof("  tag.value: %q, tag.register: %t", ptagValue, ptagRegister)
+		} else {
+			klog.V(3).Infof("  no tag")
+		}
+
+		// If the pkg-scoped tag says to generate, we can skip scanning types.
+		pkgNeedsGeneration := (ptagValue == tagValuePackage)
+		if !pkgNeedsGeneration {
+			// If the pkg-scoped tag did not exist, scan all types for one that
+			// explicitly wants generation. Ensure all types that want generation
+			// can be copied.
+			var uncopyable []string
+			for _, t := range pkg.Types {
+				klog.V(3).Infof("  considering type %q", t.Name.String())
+				ttag := extractEnabledTypeTag(t)
+				if ttag != nil && ttag.value == "true" {
+					klog.V(3).Infof("    tag=true")
+					if !copyableType(t) {
+						uncopyable = append(uncopyable, fmt.Sprintf("%v", t))
+					} else {
+						pkgNeedsGeneration = true
+					}
+				}
+			}
+			if len(uncopyable) > 0 {
+				klog.Fatalf("Types requested deepcopy generation but are not copyable: %s",
+					strings.Join(uncopyable, ", "))
+			}
+		} else {
+			// Don't write empty files
+			hasCopyable := false
+			for _, t := range pkg.Types {
+				if copyableType(t) {
+					hasCopyable = true
+					break
+				}
+			}
+			if !hasCopyable {
+				klog.V(3).Infof("  no copyable types; skipping")
+				pkgNeedsGeneration = false
+			}
+		}
+
+		if pkgNeedsGeneration {
+			klog.V(3).Infof("Package %q needs generation", i)
+			targetList = append(targetList,
+				&generator.SimpleTarget{
+					PkgName:       strings.Split(path.Base(pkg.Path), ".")[0],
+					PkgPath:       pkg.Path,
+					PkgDir:        pkg.Dir, // output pkg is the same as the input
+					HeaderComment: boilerplate,
+					FilterFunc: func(c *generator.Context, t *types.Type) bool {
+						return t.Name.Package == pkg.Path
+					},
+					GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+						return []generator.Generator{
+							NewGenDeepCopy(args.OutputFile, pkg.Path, (ptagValue == tagValuePackage), ptagRegister),
+						}
+					},
+				})
+		}
+	}
+	return targetList
+}
+
+// genDeepCopy produces a file with autogenerated deep-copy functions.
+type genDeepCopy struct {
+	generator.GoGenerator
+	targetPackage string
+	allTypes      bool
+	registerTypes bool
+	imports       namer.ImportTracker
+	typesForInit  []*types.Type
+}
+
+func NewGenDeepCopy(outputFilename, targetPackage string, allTypes, registerTypes bool) generator.Generator {
+	return &genDeepCopy{
+		GoGenerator: generator.GoGenerator{
+			OutputFilename: outputFilename,
+		},
+		targetPackage: targetPackage,
+		allTypes:      allTypes,
+		registerTypes: registerTypes,
+		imports:       generator.NewImportTrackerForPackage(targetPackage),
+		typesForInit:  make([]*types.Type, 0),
+	}
+}
+
+func (g *genDeepCopy) Namers(c *generator.Context) namer.NameSystems {
+	// Have the raw namer for this file track what it imports.
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.targetPackage, g.imports),
+	}
+}
+
+func (g *genDeepCopy) Filter(c *generator.Context, t *types.Type) bool {
+	// Filter out types not being processed or not copyable within the package.
+	enabled := g.allTypes
+	if !enabled {
+		ttag := extractEnabledTypeTag(t)
+		if ttag != nil && ttag.value == "true" {
+			enabled = true
+		}
+	}
+	if !enabled {
+		return false
+	}
+	if !copyableType(t) {
+		klog.V(3).Infof("Type %v is not copyable", t)
+		return false
+	}
+	klog.V(3).Infof("Type %v is copyable", t)
+	g.typesForInit = append(g.typesForInit, t)
+	return true
+}
+
+// deepCopyMethod returns the signature of a DeepCopy() method, nil or an error
+// if the type does not match. This allows more efficient deep copy
+// implementations to be defined by the type's author.  The correct signature
+// for a type T is:
+//
+//	func (t T) DeepCopy() T
+//
+// or:
+//
+//	func (t *T) DeepCopy() *T
+func deepCopyMethod(t *types.Type) (*types.Signature, error) {
+	f, found := t.Methods["DeepCopy"]
+	if !found {
+		return nil, nil
+	}
+	if len(f.Signature.Parameters) != 0 {
+		return nil, fmt.Errorf("type %v: invalid DeepCopy signature, expected no parameters", t)
+	}
+	if len(f.Signature.Results) != 1 {
+		return nil, fmt.Errorf("type %v: invalid DeepCopy signature, expected exactly one result", t)
+	}
+
+	ptrResult := f.Signature.Results[0].Type.Kind == types.Pointer && f.Signature.Results[0].Type.Elem.Name == t.Name
+	nonPtrResult := f.Signature.Results[0].Type.Name == t.Name
+
+	if !ptrResult && !nonPtrResult {
+		return nil, fmt.Errorf("type %v: invalid DeepCopy signature, expected to return %s or *%s", t, t.Name.Name, t.Name.Name)
+	}
+
+	ptrRcvr := f.Signature.Receiver != nil && f.Signature.Receiver.Kind == types.Pointer && f.Signature.Receiver.Elem.Name == t.Name
+	nonPtrRcvr := f.Signature.Receiver != nil && f.Signature.Receiver.Name == t.Name
+
+	if ptrRcvr && !ptrResult {
+		return nil, fmt.Errorf("type %v: invalid DeepCopy signature, expected a *%s result for a *%s receiver", t, t.Name.Name, t.Name.Name)
+	}
+	if nonPtrRcvr && !nonPtrResult {
+		return nil, fmt.Errorf("type %v: invalid DeepCopy signature, expected a %s result for a %s receiver", t, t.Name.Name, t.Name.Name)
+	}
+
+	return f.Signature, nil
+}
+
+// deepCopyMethodOrDie returns the signatrue of a DeepCopy method, nil or calls klog.Fatalf
+// if the type does not match.
+func deepCopyMethodOrDie(t *types.Type) *types.Signature {
+	ret, err := deepCopyMethod(t)
+	if err != nil {
+		klog.Fatal(err)
+	}
+	return ret
+}
+
+// deepCopyIntoMethod returns the signature of a DeepCopyInto() method, nil or an error
+// if the type is wrong. DeepCopyInto allows more efficient deep copy
+// implementations to be defined by the type's author.  The correct signature
+// for a type T is:
+//
+//	func (t T) DeepCopyInto(t *T)
+//
+// or:
+//
+//	func (t *T) DeepCopyInto(t *T)
+func deepCopyIntoMethod(t *types.Type) (*types.Signature, error) {
+	f, found := t.Methods["DeepCopyInto"]
+	if !found {
+		return nil, nil
+	}
+	if len(f.Signature.Parameters) != 1 {
+		return nil, fmt.Errorf("type %v: invalid DeepCopy signature, expected exactly one parameter", t)
+	}
+	if len(f.Signature.Results) != 0 {
+		return nil, fmt.Errorf("type %v: invalid DeepCopy signature, expected no result type", t)
+	}
+
+	ptrParam := f.Signature.Parameters[0].Type.Kind == types.Pointer && f.Signature.Parameters[0].Type.Elem.Name == t.Name
+
+	if !ptrParam {
+		return nil, fmt.Errorf("type %v: invalid DeepCopy signature, expected parameter of type *%s", t, t.Name.Name)
+	}
+
+	ptrRcvr := f.Signature.Receiver != nil && f.Signature.Receiver.Kind == types.Pointer && f.Signature.Receiver.Elem.Name == t.Name
+	nonPtrRcvr := f.Signature.Receiver != nil && f.Signature.Receiver.Name == t.Name
+
+	if !ptrRcvr && !nonPtrRcvr {
+		// this should never happen
+		return nil, fmt.Errorf("type %v: invalid DeepCopy signature, expected a receiver of type %s or *%s", t, t.Name.Name, t.Name.Name)
+	}
+
+	return f.Signature, nil
+}
+
+// deepCopyIntoMethodOrDie returns the signature of a DeepCopyInto() method, nil or calls klog.Fatalf
+// if the type is wrong.
+func deepCopyIntoMethodOrDie(t *types.Type) *types.Signature {
+	ret, err := deepCopyIntoMethod(t)
+	if err != nil {
+		klog.Fatal(err)
+	}
+	return ret
+}
+
+func copyableType(t *types.Type) bool {
+	// If the type opts out of copy-generation, stop.
+	ttag := extractEnabledTypeTag(t)
+	if ttag != nil && ttag.value == "false" {
+		return false
+	}
+
+	// Filter out private types.
+	if namer.IsPrivateGoName(t.Name.Name) {
+		return false
+	}
+
+	if t.Kind == types.Alias {
+		// if the underlying built-in is not deepcopy-able, deepcopy is opt-in through definition of custom methods.
+		// Note that aliases of builtins, maps, slices can have deepcopy methods.
+		if deepCopyMethodOrDie(t) != nil || deepCopyIntoMethodOrDie(t) != nil {
+			return true
+		} else {
+			return t.Underlying.Kind != types.Builtin || copyableType(t.Underlying)
+		}
+	}
+
+	if t.Kind != types.Struct {
+		return false
+	}
+
+	return true
+}
+
+func underlyingType(t *types.Type) *types.Type {
+	for t.Kind == types.Alias {
+		t = t.Underlying
+	}
+	return t
+}
+
+func (g *genDeepCopy) isOtherPackage(pkg string) bool {
+	if pkg == g.targetPackage {
+		return false
+	}
+	if strings.HasSuffix(pkg, "\""+g.targetPackage+"\"") {
+		return false
+	}
+	return true
+}
+
+func (g *genDeepCopy) Imports(c *generator.Context) (imports []string) {
+	importLines := []string{}
+	for _, singleImport := range g.imports.ImportLines() {
+		if g.isOtherPackage(singleImport) {
+			importLines = append(importLines, singleImport)
+		}
+	}
+	return importLines
+}
+
+func argsFromType(ts ...*types.Type) generator.Args {
+	a := generator.Args{
+		"type": ts[0],
+	}
+	for i, t := range ts {
+		a[fmt.Sprintf("type%d", i+1)] = t
+	}
+	return a
+}
+
+func (g *genDeepCopy) Init(c *generator.Context, w io.Writer) error {
+	return nil
+}
+
+func (g *genDeepCopy) needsGeneration(t *types.Type) bool {
+	tag := extractEnabledTypeTag(t)
+	tv := ""
+	if tag != nil {
+		tv = tag.value
+		if tv != "true" && tv != "false" {
+			klog.Fatalf("Type %v: unsupported %s value: %q", t, tagEnabledName, tag.value)
+		}
+	}
+	if g.allTypes && tv == "false" {
+		// The whole package is being generated, but this type has opted out.
+		klog.V(2).Infof("Not generating for type %v because type opted out", t)
+		return false
+	}
+	if !g.allTypes && tv != "true" {
+		// The whole package is NOT being generated, and this type has NOT opted in.
+		klog.V(2).Infof("Not generating for type %v because type did not opt in", t)
+		return false
+	}
+	return true
+}
+
+func extractInterfacesTag(t *types.Type) []string {
+	var result []string
+	comments := append(append([]string{}, t.SecondClosestCommentLines...), t.CommentLines...)
+	tags, err := genutil.ExtractCommentTagsWithoutArguments("+", []string{interfacesTagName}, comments)
+	if err != nil {
+		klog.Fatalf("Error extracting %s tags: %v", interfacesTagName, err)
+	}
+	for _, v := range tags[interfacesTagName] {
+		if len(v) == 0 {
+			continue
+		}
+		intfs := strings.Split(v, ",")
+		for _, intf := range intfs {
+			if intf == "" {
+				continue
+			}
+			result = append(result, intf)
+		}
+	}
+	return result
+}
+
+func extractNonPointerInterfaces(t *types.Type) (bool, error) {
+	comments := append(append([]string{}, t.SecondClosestCommentLines...), t.CommentLines...)
+	tags, err := genutil.ExtractCommentTagsWithoutArguments("+", []string{interfacesNonPointerTagName}, comments)
+	if err != nil {
+		return false, fmt.Errorf("failed to parse comments: %w", err)
+	}
+
+	values := tags[interfacesNonPointerTagName]
+	if len(values) == 0 {
+		return false, nil
+	}
+	result := values[0] == "true"
+	for _, v := range values {
+		if v == "true" != result {
+			return false, fmt.Errorf("contradicting %v value %q found to previous value %v", interfacesNonPointerTagName, v, result)
+		}
+	}
+	return result, nil
+}
+
+func (g *genDeepCopy) deepCopyableInterfacesInner(c *generator.Context, t *types.Type) ([]*types.Type, error) {
+	if t.Kind != types.Struct {
+		return nil, nil
+	}
+
+	intfs := extractInterfacesTag(t)
+
+	var ts []*types.Type
+	for _, intf := range intfs {
+		t := types.ParseFullyQualifiedName(intf)
+		klog.V(3).Infof("Loading package for interface %v", intf)
+		_, err := c.LoadPackages(t.Package)
+		if err != nil {
+			return nil, err
+		}
+		intfT := c.Universe.Type(t)
+		if intfT == nil {
+			return nil, fmt.Errorf("unknown type %q in %s tag of type %s", intf, interfacesTagName, intfT)
+		}
+		if intfT.Kind != types.Interface {
+			return nil, fmt.Errorf("type %q in %s tag of type %s is not an interface, but: %q", intf, interfacesTagName, t, intfT.Kind)
+		}
+		g.imports.AddType(intfT)
+		ts = append(ts, intfT)
+	}
+
+	return ts, nil
+}
+
+// deepCopyableInterfaces returns the interface types to implement and whether they apply to a non-pointer receiver.
+func (g *genDeepCopy) deepCopyableInterfaces(c *generator.Context, t *types.Type) ([]*types.Type, bool, error) {
+	ts, err := g.deepCopyableInterfacesInner(c, t)
+	if err != nil {
+		return nil, false, err
+	}
+
+	set := map[string]*types.Type{}
+	for _, t := range ts {
+		set[t.String()] = t
+	}
+
+	result := []*types.Type{}
+	for _, t := range set {
+		result = append(result, t)
+	}
+
+	TypeSlice(result).Sort() // we need a stable sorting because it determines the order in generation
+
+	nonPointerReceiver, err := extractNonPointerInterfaces(t)
+	if err != nil {
+		return nil, false, err
+	}
+
+	return result, nonPointerReceiver, nil
+}
+
+type TypeSlice []*types.Type
+
+func (s TypeSlice) Len() int           { return len(s) }
+func (s TypeSlice) Less(i, j int) bool { return s[i].String() < s[j].String() }
+func (s TypeSlice) Swap(i, j int)      { s[i], s[j] = s[j], s[i] }
+func (s TypeSlice) Sort()              { sort.Sort(s) }
+
+func (g *genDeepCopy) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	if !g.needsGeneration(t) {
+		return nil
+	}
+	klog.V(2).Infof("Generating deepcopy functions for type %v", t)
+
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+	args := argsFromType(t)
+
+	if deepCopyIntoMethodOrDie(t) == nil {
+		sw.Do("// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.\n", args)
+		if isReference(t) {
+			sw.Do("func (in $.type|raw$) DeepCopyInto(out *$.type|raw$) {\n", args)
+			sw.Do("{in:=&in\n", nil)
+		} else {
+			sw.Do("func (in *$.type|raw$) DeepCopyInto(out *$.type|raw$) {\n", args)
+		}
+		if deepCopyMethodOrDie(t) != nil {
+			if t.Methods["DeepCopy"].Signature.Receiver.Kind == types.Pointer {
+				sw.Do("clone := in.DeepCopy()\n", nil)
+				sw.Do("*out = *clone\n", nil)
+			} else {
+				sw.Do("*out = in.DeepCopy()\n", nil)
+			}
+			sw.Do("return\n", nil)
+		} else {
+			g.generateFor(t, sw)
+			sw.Do("return\n", nil)
+		}
+		if isReference(t) {
+			sw.Do("}\n", nil)
+		}
+		sw.Do("}\n\n", nil)
+	}
+
+	if deepCopyMethodOrDie(t) == nil {
+		sw.Do("// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new $.type|raw$.\n", args)
+		if isReference(t) {
+			sw.Do("func (in $.type|raw$) DeepCopy() $.type|raw$ {\n", args)
+		} else {
+			sw.Do("func (in *$.type|raw$) DeepCopy() *$.type|raw$ {\n", args)
+		}
+		sw.Do("if in == nil { return nil }\n", nil)
+		sw.Do("out := new($.type|raw$)\n", args)
+		sw.Do("in.DeepCopyInto(out)\n", nil)
+		if isReference(t) {
+			sw.Do("return *out\n", nil)
+		} else {
+			sw.Do("return out\n", nil)
+		}
+		sw.Do("}\n\n", nil)
+	}
+
+	intfs, nonPointerReceiver, err := g.deepCopyableInterfaces(c, t)
+	if err != nil {
+		return err
+	}
+	for _, intf := range intfs {
+		sw.Do(fmt.Sprintf("// DeepCopy%s is an autogenerated deepcopy function, copying the receiver, creating a new $.type2|raw$.\n", intf.Name.Name), argsFromType(t, intf))
+		if nonPointerReceiver {
+			sw.Do(fmt.Sprintf("func (in $.type|raw$) DeepCopy%s() $.type2|raw$ {\n", intf.Name.Name), argsFromType(t, intf))
+			sw.Do("return *in.DeepCopy()", nil)
+			sw.Do("}\n\n", nil)
+		} else {
+			sw.Do(fmt.Sprintf("func (in *$.type|raw$) DeepCopy%s() $.type2|raw$ {\n", intf.Name.Name), argsFromType(t, intf))
+			sw.Do("if c := in.DeepCopy(); c != nil {\n", nil)
+			sw.Do("return c\n", nil)
+			sw.Do("}\n", nil)
+			sw.Do("return nil\n", nil)
+			sw.Do("}\n\n", nil)
+		}
+	}
+
+	return sw.Error()
+}
+
+// isReference return true for pointer, maps, slices and aliases of those.
+func isReference(t *types.Type) bool {
+	if t.Kind == types.Pointer || t.Kind == types.Map || t.Kind == types.Slice {
+		return true
+	}
+	return t.Kind == types.Alias && isReference(underlyingType(t))
+}
+
+// we use the system of shadowing 'in' and 'out' so that the same code is valid
+// at any nesting level. This makes the autogenerator easy to understand, and
+// the compiler shouldn't care.
+func (g *genDeepCopy) generateFor(t *types.Type, sw *generator.SnippetWriter) {
+	// derive inner types if t is an alias. We call the do* methods below with the alias type.
+	// basic rule: generate according to inner type, but construct objects with the alias type.
+	ut := underlyingType(t)
+
+	var f func(*types.Type, *generator.SnippetWriter)
+	switch ut.Kind {
+	case types.Builtin:
+		f = g.doBuiltin
+	case types.Map:
+		f = g.doMap
+	case types.Slice:
+		f = g.doSlice
+	case types.Struct:
+		f = g.doStruct
+	case types.Pointer:
+		f = g.doPointer
+	case types.Interface:
+		// interfaces are handled in-line in the other cases
+		klog.Fatalf("Hit an interface type %v. This should never happen.", t)
+	case types.Alias:
+		// can never happen because we branch on the underlying type which is never an alias
+		klog.Fatalf("Hit an alias type %v. This should never happen.", t)
+	default:
+		klog.Fatalf("Hit an unsupported type %v.", t)
+	}
+	f(t, sw)
+}
+
+// doBuiltin generates code for a builtin or an alias to a builtin. The generated code is
+// is the same for both cases, i.e. it's the code for the underlying type.
+func (g *genDeepCopy) doBuiltin(t *types.Type, sw *generator.SnippetWriter) {
+	if deepCopyMethodOrDie(t) != nil || deepCopyIntoMethodOrDie(t) != nil {
+		sw.Do("*out = in.DeepCopy()\n", nil)
+		return
+	}
+
+	sw.Do("*out = *in\n", nil)
+}
+
+// doMap generates code for a map or an alias to a map. The generated code is
+// is the same for both cases, i.e. it's the code for the underlying type.
+func (g *genDeepCopy) doMap(t *types.Type, sw *generator.SnippetWriter) {
+	ut := underlyingType(t)
+	uet := underlyingType(ut.Elem)
+
+	if deepCopyMethodOrDie(t) != nil || deepCopyIntoMethodOrDie(t) != nil {
+		sw.Do("*out = in.DeepCopy()\n", nil)
+		return
+	}
+
+	if !ut.Key.IsAssignable() {
+		klog.Fatalf("Hit an unsupported type %v for: %v", uet, t)
+	}
+
+	sw.Do("*out = make($.|raw$, len(*in))\n", t)
+	sw.Do("for key, val := range *in {\n", nil)
+	dc, dci := deepCopyMethodOrDie(ut.Elem), deepCopyIntoMethodOrDie(ut.Elem)
+	switch {
+	case dc != nil || dci != nil:
+		// Note: a DeepCopy exists because it is added if DeepCopyInto is manually defined
+		leftPointer := ut.Elem.Kind == types.Pointer
+		rightPointer := !isReference(ut.Elem)
+		if dc != nil {
+			rightPointer = dc.Results[0].Type.Kind == types.Pointer
+		}
+		if leftPointer == rightPointer {
+			sw.Do("(*out)[key] = val.DeepCopy()\n", nil)
+		} else if leftPointer {
+			sw.Do("x := val.DeepCopy()\n", nil)
+			sw.Do("(*out)[key] = &x\n", nil)
+		} else {
+			sw.Do("(*out)[key] = *val.DeepCopy()\n", nil)
+		}
+	case ut.Elem.IsAnonymousStruct(): // not uet here because it needs type cast
+		sw.Do("(*out)[key] = val\n", nil)
+	case uet.IsAssignable():
+		sw.Do("(*out)[key] = val\n", nil)
+	case uet.Kind == types.Interface:
+		// Note: do not generate code that won't compile as `DeepCopyinterface{}()` is not a valid function
+		if uet.Name.Name == "interface{}" {
+			klog.Fatalf("DeepCopy of %q is unsupported. Instead, use named interfaces with DeepCopy<named-interface> as one of the methods.", uet.Name.Name)
+		}
+		sw.Do("if val == nil {(*out)[key]=nil} else {\n", nil)
+		// Note: if t.Elem has been an alias "J" of an interface "I" in Go, we will see it
+		// as kind Interface of name "J" here, i.e. generate val.DeepCopyJ(). The golang
+		// parser does not give us the underlying interface name. So we cannot do any better.
+		sw.Do(fmt.Sprintf("(*out)[key] = val.DeepCopy%s()\n", uet.Name.Name), nil)
+		sw.Do("}\n", nil)
+	case uet.Kind == types.Slice || uet.Kind == types.Map || uet.Kind == types.Pointer:
+		sw.Do("var outVal $.|raw$\n", uet)
+		sw.Do("if val == nil { (*out)[key] = nil } else {\n", nil)
+		sw.Do("in, out := &val, &outVal\n", uet)
+		g.generateFor(ut.Elem, sw)
+		sw.Do("}\n", nil)
+		sw.Do("(*out)[key] = outVal\n", nil)
+	case uet.Kind == types.Struct:
+		sw.Do("(*out)[key] = *val.DeepCopy()\n", uet)
+	default:
+		klog.Fatalf("Hit an unsupported type %v for %v", uet, t)
+	}
+	sw.Do("}\n", nil)
+}
+
+// doSlice generates code for a slice or an alias to a slice. The generated code is
+// is the same for both cases, i.e. it's the code for the underlying type.
+func (g *genDeepCopy) doSlice(t *types.Type, sw *generator.SnippetWriter) {
+	ut := underlyingType(t)
+	uet := underlyingType(ut.Elem)
+
+	if deepCopyMethodOrDie(t) != nil || deepCopyIntoMethodOrDie(t) != nil {
+		sw.Do("*out = in.DeepCopy()\n", nil)
+		return
+	}
+
+	sw.Do("*out = make($.|raw$, len(*in))\n", t)
+	if deepCopyMethodOrDie(ut.Elem) != nil || deepCopyIntoMethodOrDie(ut.Elem) != nil {
+		sw.Do("for i := range *in {\n", nil)
+		// Note: a DeepCopyInto exists because it is added if DeepCopy is manually defined
+		sw.Do("(*in)[i].DeepCopyInto(&(*out)[i])\n", nil)
+		sw.Do("}\n", nil)
+	} else if uet.Kind == types.Builtin || uet.IsAssignable() {
+		sw.Do("copy(*out, *in)\n", nil)
+	} else {
+		sw.Do("for i := range *in {\n", nil)
+		if uet.Kind == types.Slice || uet.Kind == types.Map || uet.Kind == types.Pointer || deepCopyMethodOrDie(ut.Elem) != nil || deepCopyIntoMethodOrDie(ut.Elem) != nil {
+			sw.Do("if (*in)[i] != nil {\n", nil)
+			sw.Do("in, out := &(*in)[i], &(*out)[i]\n", nil)
+			g.generateFor(ut.Elem, sw)
+			sw.Do("}\n", nil)
+		} else if uet.Kind == types.Interface {
+			// Note: do not generate code that won't compile as `DeepCopyinterface{}()` is not a valid function
+			if uet.Name.Name == "interface{}" {
+				klog.Fatalf("DeepCopy of %q is unsupported. Instead, use named interfaces with DeepCopy<named-interface> as one of the methods.", uet.Name.Name)
+			}
+			sw.Do("if (*in)[i] != nil {\n", nil)
+			// Note: if t.Elem has been an alias "J" of an interface "I" in Go, we will see it
+			// as kind Interface of name "J" here, i.e. generate val.DeepCopyJ(). The golang
+			// parser does not give us the underlying interface name. So we cannot do any better.
+			sw.Do(fmt.Sprintf("(*out)[i] = (*in)[i].DeepCopy%s()\n", uet.Name.Name), nil)
+			sw.Do("}\n", nil)
+		} else if uet.Kind == types.Struct {
+			sw.Do("(*in)[i].DeepCopyInto(&(*out)[i])\n", nil)
+		} else {
+			klog.Fatalf("Hit an unsupported type %v for %v", uet, t)
+		}
+		sw.Do("}\n", nil)
+	}
+}
+
+// doStruct generates code for a struct or an alias to a struct. The generated code is
+// is the same for both cases, i.e. it's the code for the underlying type.
+func (g *genDeepCopy) doStruct(t *types.Type, sw *generator.SnippetWriter) {
+	ut := underlyingType(t)
+
+	if deepCopyMethodOrDie(t) != nil || deepCopyIntoMethodOrDie(t) != nil {
+		sw.Do("*out = in.DeepCopy()\n", nil)
+		return
+	}
+
+	// Simple copy covers a lot of cases.
+	sw.Do("*out = *in\n", nil)
+
+	// Now fix-up fields as needed.
+	for _, m := range ut.Members {
+		ft := m.Type
+		uft := underlyingType(ft)
+
+		args := generator.Args{
+			"type": ft,
+			"kind": ft.Kind,
+			"name": m.Name,
+		}
+		dc, dci := deepCopyMethodOrDie(ft), deepCopyIntoMethodOrDie(ft)
+		switch {
+		case dc != nil || dci != nil:
+			// Note: a DeepCopyInto exists because it is added if DeepCopy is manually defined
+			leftPointer := ft.Kind == types.Pointer
+			rightPointer := !isReference(ft)
+			if dc != nil {
+				rightPointer = dc.Results[0].Type.Kind == types.Pointer
+			}
+			if leftPointer == rightPointer {
+				sw.Do("out.$.name$ = in.$.name$.DeepCopy()\n", args)
+			} else if leftPointer {
+				sw.Do("x := in.$.name$.DeepCopy()\n", args)
+				sw.Do("out.$.name$ =  = &x\n", args)
+			} else {
+				sw.Do("in.$.name$.DeepCopyInto(&out.$.name$)\n", args)
+			}
+		case uft.Kind == types.Builtin:
+			// the initial *out = *in was enough
+		case uft.Kind == types.Map, uft.Kind == types.Slice, uft.Kind == types.Pointer:
+			// Fixup non-nil reference-semantic types.
+			sw.Do("if in.$.name$ != nil {\n", args)
+			sw.Do("in, out := &in.$.name$, &out.$.name$\n", args)
+			g.generateFor(ft, sw)
+			sw.Do("}\n", nil)
+		case uft.Kind == types.Array:
+			sw.Do("out.$.name$ = in.$.name$\n", args)
+		case uft.Kind == types.Struct:
+			if ft.IsAssignable() {
+				sw.Do("out.$.name$ = in.$.name$\n", args)
+			} else {
+				sw.Do("in.$.name$.DeepCopyInto(&out.$.name$)\n", args)
+			}
+		case uft.Kind == types.Interface:
+			// Note: do not generate code that won't compile as `DeepCopyinterface{}()` is not a valid function
+			if uft.Name.Name == "interface{}" {
+				klog.Fatalf("DeepCopy of %q is unsupported. Instead, use named interfaces with DeepCopy<named-interface> as one of the methods.", uft.Name.Name)
+			}
+			sw.Do("if in.$.name$ != nil {\n", args)
+			// Note: if t.Elem has been an alias "J" of an interface "I" in Go, we will see it
+			// as kind Interface of name "J" here, i.e. generate val.DeepCopyJ(). The golang
+			// parser does not give us the underlying interface name. So we cannot do any better.
+			sw.Do(fmt.Sprintf("out.$.name$ = in.$.name$.DeepCopy%s()\n", uft.Name.Name), args)
+			sw.Do("}\n", nil)
+		default:
+			klog.Fatalf("Hit an unsupported type '%v' for '%v', from %v.%v", uft, ft, t, m.Name)
+		}
+	}
+}
+
+// doPointer generates code for a pointer or an alias to a pointer. The generated code is
+// is the same for both cases, i.e. it's the code for the underlying type.
+func (g *genDeepCopy) doPointer(t *types.Type, sw *generator.SnippetWriter) {
+	ut := underlyingType(t)
+	uet := underlyingType(ut.Elem)
+
+	dc, dci := deepCopyMethodOrDie(ut.Elem), deepCopyIntoMethodOrDie(ut.Elem)
+	switch {
+	case dc != nil || dci != nil:
+		rightPointer := !isReference(ut.Elem)
+		if dc != nil {
+			rightPointer = dc.Results[0].Type.Kind == types.Pointer
+		}
+		if rightPointer {
+			sw.Do("*out = (*in).DeepCopy()\n", nil)
+		} else {
+			sw.Do("x := (*in).DeepCopy()\n", nil)
+			sw.Do("*out = &x\n", nil)
+		}
+	case uet.IsAssignable():
+		sw.Do("*out = new($.Elem|raw$)\n", ut)
+		sw.Do("**out = **in", nil)
+	case uet.Kind == types.Map, uet.Kind == types.Slice, uet.Kind == types.Pointer:
+		sw.Do("*out = new($.Elem|raw$)\n", ut)
+		sw.Do("if **in != nil {\n", nil)
+		sw.Do("in, out := *in, *out\n", nil)
+		g.generateFor(uet, sw)
+		sw.Do("}\n", nil)
+	case uet.Kind == types.Struct:
+		sw.Do("*out = new($.Elem|raw$)\n", ut)
+		sw.Do("(*in).DeepCopyInto(*out)\n", nil)
+	default:
+		klog.Fatalf("Hit an unsupported type %v for %v", uet, t)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/generators/deepcopy_targets_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/generators/deepcopy_targets_test.go
new file mode 100644
index 0000000000..c6d5024eab
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/generators/deepcopy_targets_test.go
@@ -0,0 +1,223 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"reflect"
+	"sort"
+	"testing"
+
+	"k8s.io/code-generator/cmd/deepcopy-gen/args"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/types"
+)
+
+// copyableStruct returns a struct type with a single primitive int32 field.
+// copyableType in deepcopy.go accepts a non-private struct kind.
+func copyableStruct(pkgPath, name string, comments []string) *types.Type {
+	return &types.Type{
+		Name:         types.Name{Package: pkgPath, Name: name},
+		Kind:         types.Struct,
+		CommentLines: comments,
+		Members: []types.Member{
+			{Name: "X", Type: types.Int32},
+		},
+	}
+}
+
+func TestGetTargets(t *testing.T) {
+	type pkgSpec struct {
+		path     string
+		comments []string
+		// types maps type-name to its CommentLines (a copyable struct is
+		// synthesized for each entry). nil means no types in the package.
+		types map[string][]string
+	}
+
+	cases := []struct {
+		name     string
+		pkgs     []pkgSpec
+		wantPkgs []string
+		// wantAllTypes maps PkgPath -> expected genDeepCopy.allTypes value.
+		wantAllTypes map[string]bool
+		// wantRegister maps PkgPath -> expected genDeepCopy.registerTypes value.
+		wantRegister map[string]bool
+	}{
+		{
+			name: "package tag with copyable struct activates",
+			pkgs: []pkgSpec{
+				{
+					path:     "example.com/pkg/a",
+					comments: []string{"+k8s:deepcopy-gen=package"},
+					types:    map[string][]string{"T": nil},
+				},
+			},
+			wantPkgs:     []string{"example.com/pkg/a"},
+			wantAllTypes: map[string]bool{"example.com/pkg/a": true},
+			wantRegister: map[string]bool{"example.com/pkg/a": false},
+		},
+		{
+			name: "package tag with register=false activates with register=false",
+			pkgs: []pkgSpec{
+				{
+					path:     "example.com/pkg/b",
+					comments: []string{"+k8s:deepcopy-gen=package,register=false"},
+					types:    map[string][]string{"T": nil},
+				},
+			},
+			wantPkgs:     []string{"example.com/pkg/b"},
+			wantAllTypes: map[string]bool{"example.com/pkg/b": true},
+			wantRegister: map[string]bool{"example.com/pkg/b": false},
+		},
+		{
+			name: "package tag with register=true activates with register=true",
+			pkgs: []pkgSpec{
+				{
+					path:     "example.com/pkg/c",
+					comments: []string{"+k8s:deepcopy-gen=package,register=true"},
+					types:    map[string][]string{"T": nil},
+				},
+			},
+			wantPkgs:     []string{"example.com/pkg/c"},
+			wantAllTypes: map[string]bool{"example.com/pkg/c": true},
+			wantRegister: map[string]bool{"example.com/pkg/c": true},
+		},
+		{
+			name: "package opted out is skipped",
+			pkgs: []pkgSpec{
+				{
+					path:     "example.com/pkg/d",
+					comments: []string{"+k8s:deepcopy-gen=false"},
+					types:    map[string][]string{"T": nil},
+				},
+			},
+			wantPkgs: nil,
+		},
+		{
+			name: "no package tag but type opts in activates",
+			pkgs: []pkgSpec{
+				{
+					path: "example.com/pkg/e",
+					types: map[string][]string{
+						"T": {"+k8s:deepcopy-gen=true"},
+					},
+				},
+			},
+			wantPkgs:     []string{"example.com/pkg/e"},
+			wantAllTypes: map[string]bool{"example.com/pkg/e": false},
+			wantRegister: map[string]bool{"example.com/pkg/e": false},
+		},
+		{
+			name: "package tag but no copyable types is skipped",
+			pkgs: []pkgSpec{
+				{
+					path:     "example.com/pkg/f",
+					comments: []string{"+k8s:deepcopy-gen=package"},
+					types:    nil,
+				},
+			},
+			wantPkgs: nil,
+		},
+		{
+			name: "no tag and no opt-in types is skipped",
+			pkgs: []pkgSpec{
+				{
+					path:  "example.com/pkg/g",
+					types: map[string][]string{"T": nil},
+				},
+			},
+			wantPkgs: nil,
+		},
+		// Ecosystem regression: a third-party generator's tag in the same
+		// doc.go must NOT cause deepcopy-gen to fail. The deepcopy-gen
+		// tag still activates as expected.
+		{
+			name: "foreign third-party generator tag is ignored",
+			pkgs: []pkgSpec{
+				{
+					path: "example.com/pkg/h",
+					comments: []string{
+						"+k8s:my-custom-gen=value",
+						"+k8s:deepcopy-gen=package",
+					},
+					types: map[string][]string{"T": nil},
+				},
+			},
+			wantPkgs:     []string{"example.com/pkg/h"},
+			wantAllTypes: map[string]bool{"example.com/pkg/h": true},
+			wantRegister: map[string]bool{"example.com/pkg/h": false},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			universe := types.Universe{}
+			var inputs []string
+			for _, ps := range tc.pkgs {
+				pkg := &types.Package{
+					Path:     ps.path,
+					Dir:      ps.path,
+					Name:     "pkg",
+					Comments: ps.comments,
+					Types:    map[string]*types.Type{},
+				}
+				for tname, tcomments := range ps.types {
+					pkg.Types[tname] = copyableStruct(ps.path, tname, tcomments)
+				}
+				universe[ps.path] = pkg
+				inputs = append(inputs, ps.path)
+			}
+
+			ctx := &generator.Context{
+				Universe: universe,
+				Inputs:   inputs,
+			}
+
+			result := GetTargets(ctx, args.New())
+
+			var gotPkgs []string
+			for _, tgt := range result {
+				gotPkgs = append(gotPkgs, tgt.Path())
+			}
+			sort.Strings(gotPkgs)
+			want := append([]string(nil), tc.wantPkgs...)
+			sort.Strings(want)
+			if !reflect.DeepEqual(gotPkgs, want) {
+				t.Errorf("PkgPaths = %v, want %v", gotPkgs, want)
+			}
+
+			for _, tgt := range result {
+				gens := tgt.Generators(ctx)
+				if len(gens) != 1 {
+					t.Errorf("pkg %q: got %d generators, want 1", tgt.Path(), len(gens))
+					continue
+				}
+				gdc, ok := gens[0].(*genDeepCopy)
+				if !ok {
+					t.Errorf("pkg %q: generator type = %T, want *genDeepCopy", tgt.Path(), gens[0])
+					continue
+				}
+				if want, ok := tc.wantAllTypes[tgt.Path()]; ok && gdc.allTypes != want {
+					t.Errorf("pkg %q: allTypes = %v, want %v", tgt.Path(), gdc.allTypes, want)
+				}
+				if want, ok := tc.wantRegister[tgt.Path()]; ok && gdc.registerTypes != want {
+					t.Errorf("pkg %q: registerTypes = %v, want %v", tgt.Path(), gdc.registerTypes, want)
+				}
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/generators/deepcopy_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/generators/deepcopy_test.go
new file mode 100644
index 0000000000..f1c3427db1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/generators/deepcopy_test.go
@@ -0,0 +1,696 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/gengo/v2/types"
+)
+
+func Test_deepCopyMethod(t *testing.T) {
+	testCases := []struct {
+		typ    types.Type
+		expect bool
+		error  bool
+	}{
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				// No DeepCopy method.
+				Methods: map[string]*types.Type{},
+			},
+			expect: false,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// No DeepCopy method.
+					"method": {
+						Name: types.Name{Package: "pkgname", Name: "func()"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver: &types.Type{
+								Kind: types.Pointer,
+								Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							},
+							Parameters: []*types.ParamResult{},
+							Results:    []*types.ParamResult{},
+						},
+					},
+				},
+			},
+			expect: false,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// Wrong signature (no result).
+					"DeepCopy": {
+						Name: types.Name{Package: "pkgname", Name: "func()"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver: &types.Type{
+								Kind: types.Pointer,
+								Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							},
+							Parameters: []*types.ParamResult{},
+							Results:    []*types.ParamResult{},
+						},
+					},
+				},
+			},
+			expect: false,
+			error:  true,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// Wrong signature (wrong result).
+					"DeepCopy": {
+						Name: types.Name{Package: "pkgname", Name: "func() int"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver: &types.Type{
+								Kind: types.Pointer,
+								Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							},
+							Parameters: []*types.ParamResult{},
+							Results: []*types.ParamResult{
+								{
+									Type: &types.Type{Name: types.Name{Name: "int"}, Kind: types.Builtin},
+								},
+							},
+						},
+					},
+				},
+			},
+			expect: false,
+			error:  true,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// Wrong signature with pointer receiver, but non-pointer result.
+					"DeepCopy": {
+						Name: types.Name{Package: "pkgname", Name: "func() pkgname.typename"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver: &types.Type{
+								Kind: types.Pointer,
+								Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							},
+							Parameters: []*types.ParamResult{},
+							Results: []*types.ParamResult{
+								{
+									Type: &types.Type{
+										Name: types.Name{Package: "pkgname", Name: "typename"},
+										Kind: types.Builtin,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			expect: false,
+			error:  true,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// Wrong signature with non-pointer receiver, but pointer result.
+					"DeepCopy": {
+						Name: types.Name{Package: "pkgname", Name: "func() pkgname.typename"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver:   &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							Parameters: []*types.ParamResult{},
+							Results: []*types.ParamResult{
+								{
+									Type: &types.Type{
+										Kind: types.Pointer,
+										Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			expect: false,
+			error:  true,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// Correct signature with non-pointer receiver.
+					"DeepCopy": {
+						Name: types.Name{Package: "pkgname", Name: "func() pkgname.typename"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver:   &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							Parameters: []*types.ParamResult{},
+							Results: []*types.ParamResult{
+								{
+									Type: &types.Type{
+										Name: types.Name{Package: "pkgname", Name: "typename"},
+										Kind: types.Builtin,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			expect: true,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// Correct signature with pointer receiver.
+					"DeepCopy": {
+						Name: types.Name{Package: "pkgname", Name: "func() pkgname.typename"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver: &types.Type{
+								Kind: types.Pointer,
+								Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							},
+							Parameters: []*types.ParamResult{},
+							Results: []*types.ParamResult{
+								{
+									Type: &types.Type{
+										Kind: types.Pointer,
+										Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			expect: true,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// Wrong signature (has params).
+					"DeepCopy": {
+						Name: types.Name{Package: "pkgname", Name: "func(int) pkgname.typename"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver: &types.Type{
+								Kind: types.Pointer,
+								Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							},
+							Parameters: []*types.ParamResult{
+								{
+									Type: &types.Type{
+										Name: types.Name{Name: "int"},
+										Kind: types.Builtin,
+									},
+								},
+							},
+							Results: []*types.ParamResult{
+								{
+									Type: &types.Type{
+										Name: types.Name{Package: "pkgname", Name: "typename"},
+										Kind: types.Builtin,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			expect: false,
+			error:  true,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// Wrong signature (extra results).
+					"DeepCopy": {
+						Name: types.Name{Package: "pkgname", Name: "func() (pkgname.typename, int)"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver: &types.Type{
+								Kind: types.Pointer,
+								Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							},
+							Parameters: []*types.ParamResult{},
+							Results: []*types.ParamResult{
+								{
+									Type: &types.Type{
+										Name: types.Name{Package: "pkgname", Name: "typename"},
+										Kind: types.Builtin,
+									},
+								},
+								{
+									Type: &types.Type{
+										Name: types.Name{Name: "int"},
+										Kind: types.Builtin,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			expect: false,
+			error:  true,
+		},
+	}
+
+	for i, tc := range testCases {
+		r, err := deepCopyMethod(&tc.typ)
+		if tc.error && err == nil {
+			t.Errorf("case[%d]: expected an error, got none", i)
+		} else if !tc.error && err != nil {
+			t.Errorf("case[%d]: expected no error, got: %v", i, err)
+		} else if !tc.error && (r != nil) != tc.expect {
+			t.Errorf("case[%d]: expected result %v, got: %v", i, tc.expect, r)
+		}
+	}
+}
+
+func Test_deepCopyIntoMethod(t *testing.T) {
+	testCases := []struct {
+		typ    types.Type
+		expect bool
+		error  bool
+	}{
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				// No DeepCopyInto method.
+				Methods: map[string]*types.Type{},
+			},
+			expect: false,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// No DeepCopyInto method.
+					"method": {
+						Name: types.Name{Package: "pkgname", Name: "func()"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver: &types.Type{
+								Kind: types.Pointer,
+								Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							},
+							Parameters: []*types.ParamResult{},
+							Results:    []*types.ParamResult{},
+						},
+					},
+				},
+			},
+			expect: false,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// Wrong signature (no parameter).
+					"DeepCopyInto": {
+						Name: types.Name{Package: "pkgname", Name: "func()"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver: &types.Type{
+								Kind: types.Pointer,
+								Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							},
+							Parameters: []*types.ParamResult{},
+							Results:    []*types.ParamResult{},
+						},
+					},
+				},
+			},
+			expect: false,
+			error:  true,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// Wrong signature (unexpected result).
+					"DeepCopyInto": {
+						Name: types.Name{Package: "pkgname", Name: "func(*pkgname.typename) int"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver: &types.Type{
+								Kind: types.Pointer,
+								Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							},
+							Parameters: []*types.ParamResult{
+								{
+									Type: &types.Type{
+										Kind: types.Pointer,
+										Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+									},
+								},
+							},
+							Results: []*types.ParamResult{
+								{
+									Type: &types.Type{
+										Name: types.Name{Name: "int"},
+										Kind: types.Builtin,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			expect: false,
+			error:  true,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// Wrong signature (non-pointer parameter, pointer receiver).
+					"DeepCopyInto": {
+						Name: types.Name{Package: "pkgname", Name: "func(pkgname.typename)"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver: &types.Type{
+								Kind: types.Pointer,
+								Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							},
+							Parameters: []*types.ParamResult{
+								{
+									Type: &types.Type{
+										Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+								},
+							},
+							Results: []*types.ParamResult{},
+						},
+					},
+				},
+			},
+			expect: false,
+			error:  true,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// Wrong signature (non-pointer parameter, non-pointer receiver).
+					"DeepCopyInto": {
+						Name: types.Name{Package: "pkgname", Name: "func(pkgname.typename)"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							Parameters: []*types.ParamResult{
+								{
+
+									Type: &types.Type{
+										Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+								},
+							},
+							Results: []*types.ParamResult{},
+						},
+					},
+				},
+			},
+			expect: false,
+			error:  true,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// Correct signature with non-pointer receiver.
+					"DeepCopyInto": {
+						Name: types.Name{Package: "pkgname", Name: "func(*pkgname.typename)"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							Parameters: []*types.ParamResult{
+								{
+									Type: &types.Type{
+										Kind: types.Pointer,
+										Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+									},
+								},
+							},
+							Results: []*types.ParamResult{},
+						},
+					},
+				},
+			},
+			expect: true,
+		},
+		{
+			typ: types.Type{
+				Name: types.Name{Package: "pkgname", Name: "typename"},
+				Kind: types.Builtin,
+				Methods: map[string]*types.Type{
+					// Correct signature with pointer receiver.
+					"DeepCopyInto": {
+						Name: types.Name{Package: "pkgname", Name: "func(*pkgname.typename)"},
+						Kind: types.Func,
+						Signature: &types.Signature{
+							Receiver: &types.Type{
+								Kind: types.Pointer,
+								Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+							},
+							Parameters: []*types.ParamResult{
+								{
+									Type: &types.Type{
+										Kind: types.Pointer,
+										Elem: &types.Type{Kind: types.Struct, Name: types.Name{Package: "pkgname", Name: "typename"}},
+									},
+								},
+							},
+							Results: []*types.ParamResult{},
+						},
+					},
+				},
+			},
+			expect: true,
+		},
+	}
+
+	for i, tc := range testCases {
+		r, err := deepCopyIntoMethod(&tc.typ)
+		if tc.error && err == nil {
+			t.Errorf("case[%d]: expected an error, got none", i)
+		} else if !tc.error && err != nil {
+			t.Errorf("case[%d]: expected no error, got: %v", i, err)
+		} else if !tc.error && (r != nil) != tc.expect {
+			t.Errorf("case[%d]: expected result %v, got: %v", i, tc.expect, r)
+		}
+	}
+}
+
+func Test_extractTagParams(t *testing.T) {
+	testCases := []struct {
+		comments []string
+		expect   *enabledTagValue
+	}{
+		{
+			comments: []string{
+				"Human comment",
+			},
+			expect: nil,
+		},
+		{
+			comments: []string{
+				"Human comment",
+				"+k8s:deepcopy-gen",
+			},
+			expect: &enabledTagValue{
+				value:    "",
+				register: false,
+			},
+		},
+		{
+			comments: []string{
+				"Human comment",
+				"+k8s:deepcopy-gen=package",
+			},
+			expect: &enabledTagValue{
+				value:    "package",
+				register: false,
+			},
+		},
+		{
+			comments: []string{
+				"Human comment",
+				"+k8s:deepcopy-gen=package,register",
+			},
+			expect: &enabledTagValue{
+				value:    "package",
+				register: true,
+			},
+		},
+		{
+			comments: []string{
+				"Human comment",
+				"+k8s:deepcopy-gen=package,register=true",
+			},
+			expect: &enabledTagValue{
+				value:    "package",
+				register: true,
+			},
+		},
+		{
+			comments: []string{
+				"Human comment",
+				"+k8s:deepcopy-gen=package,register=false",
+			},
+			expect: &enabledTagValue{
+				value:    "package",
+				register: false,
+			},
+		},
+	}
+
+	for i, tc := range testCases {
+		r := extractEnabledTag(tc.comments)
+		if r == nil && tc.expect != nil {
+			t.Errorf("case[%d]: expected non-nil", i)
+		}
+		if r != nil && tc.expect == nil {
+			t.Errorf("case[%d]: expected nil, got %v", i, *r)
+		}
+		if r != nil && *r != *tc.expect {
+			t.Errorf("case[%d]: expected %v, got %v", i, *tc.expect, *r)
+		}
+	}
+}
+
+func Test_extractInterfacesTag(t *testing.T) {
+	testCases := []struct {
+		comments, secondComments []string
+		expect                   []string
+	}{
+		{
+			comments: []string{},
+			expect:   nil,
+		},
+		{
+			comments: []string{
+				"+k8s:deepcopy-gen:interfaces=k8s.io/kubernetes/runtime.Object",
+			},
+			expect: []string{
+				"k8s.io/kubernetes/runtime.Object",
+			},
+		},
+		{
+			comments: []string{
+				"+k8s:deepcopy-gen:interfaces=k8s.io/kubernetes/runtime.Object",
+				"+k8s:deepcopy-gen:interfaces=k8s.io/kubernetes/runtime.List",
+			},
+			expect: []string{
+				"k8s.io/kubernetes/runtime.Object",
+				"k8s.io/kubernetes/runtime.List",
+			},
+		},
+		{
+			comments: []string{
+				"+k8s:deepcopy-gen:interfaces=k8s.io/kubernetes/runtime.Object",
+				"+k8s:deepcopy-gen:interfaces=k8s.io/kubernetes/runtime.Object",
+			},
+			expect: []string{
+				"k8s.io/kubernetes/runtime.Object",
+				"k8s.io/kubernetes/runtime.Object",
+			},
+		},
+		{
+			secondComments: []string{
+				"+k8s:deepcopy-gen:interfaces=k8s.io/kubernetes/runtime.Object",
+			},
+			expect: []string{
+				"k8s.io/kubernetes/runtime.Object",
+			},
+		},
+		{
+			comments: []string{
+				"+k8s:deepcopy-gen:interfaces=k8s.io/kubernetes/runtime.Object",
+			},
+			secondComments: []string{
+				"+k8s:deepcopy-gen:interfaces=k8s.io/kubernetes/runtime.List",
+			},
+			expect: []string{
+				"k8s.io/kubernetes/runtime.List",
+				"k8s.io/kubernetes/runtime.Object",
+			},
+		},
+		{
+			comments: []string{
+				"+k8s:deepcopy-gen:interfaces=k8s.io/kubernetes/runtime.Object",
+			},
+			secondComments: []string{
+				"+k8s:deepcopy-gen:interfaces=k8s.io/kubernetes/runtime.Object",
+			},
+			expect: []string{
+				"k8s.io/kubernetes/runtime.Object",
+				"k8s.io/kubernetes/runtime.Object",
+			},
+		},
+	}
+
+	for i, tc := range testCases {
+		typ := &types.Type{
+			CommentLines:              tc.comments,
+			SecondClosestCommentLines: tc.secondComments,
+		}
+		r := extractInterfacesTag(typ)
+		if r == nil && tc.expect != nil {
+			t.Errorf("case[%d]: expected non-nil", i)
+		}
+		if r != nil && tc.expect == nil {
+			t.Errorf("case[%d]: expected nil, got %v", i, r)
+		}
+		if r != nil && !reflect.DeepEqual(r, tc.expect) {
+			t.Errorf("case[%d]: expected %v, got %v", i, tc.expect, r)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/main.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/main.go
new file mode 100644
index 0000000000..aaa3155a01
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/main.go
@@ -0,0 +1,110 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// deepcopy-gen is a tool for auto-generating DeepCopy functions.
+//
+// Given a list of input directories, it will generate DeepCopy and
+// DeepCopyInto methods that efficiently perform a full deep-copy of each type.
+// If these methods already exist (are predefined by the developer), they are
+// used instead of generating new ones.  Generated code will use standard value
+// assignment whenever possible.  If that is not possible it will try to call
+// its own generated copy function for the type.  Failing that, it will fall
+// back on `conversion.Cloner.DeepCopy(val)` to make the copy.  The resulting
+// file will be stored in the same directory as the processed source package.
+//
+// If interfaces are referenced in types, it is expected that corresponding
+// DeepCopyInterfaceName methods exist, e.g. DeepCopyObject for runtime.Object.
+// These can be predefined by the developer or generated through tags, see
+// below.  They must be added to the interfaces themselves manually, e.g.
+//
+//	type Object interface {
+//	  ...
+//	  DeepCopyObject() Object
+//	}
+//
+// Generation is governed by comment tags in the source.  Any package may
+// request DeepCopy generation by including a comment in the file-comments of
+// one file, of the form:
+//
+//	// +k8s:deepcopy-gen=package
+//
+// DeepCopy functions can be generated for individual types, rather than the
+// entire package by specifying a comment on the type definition of the form:
+//
+//	// +k8s:deepcopy-gen=true
+//
+// When generating for a whole package, individual types may opt out of
+// DeepCopy generation by specifying a comment on the type definition of the
+// form:
+//
+//	// +k8s:deepcopy-gen=false
+//
+// Additional DeepCopyInterfaceName methods can be generated by specifying a
+// comment on the type definition of the form:
+//
+//	// +k8s:deepcopy-gen:interfaces=k8s.io/kubernetes/runtime.Object,k8s.io/kubernetes/runtime.List
+//
+// This leads to the generation of DeepCopyObject and DeepCopyList with the given
+// interfaces as return types. We say that the tagged type implements deepcopy for the
+// interfaces.
+//
+// The deepcopy funcs for interfaces using "+k8s:deepcopy-gen:interfaces" use the pointer
+// of the type as receiver. For those special cases where the non-pointer object should
+// implement the interface, this can be done with:
+//
+//	// +k8s:deepcopy-gen:nonpointer-interfaces=true
+package main
+
+import (
+	"flag"
+
+	"github.com/spf13/pflag"
+	"k8s.io/code-generator/cmd/deepcopy-gen/args"
+	"k8s.io/code-generator/cmd/deepcopy-gen/generators"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/klog/v2"
+)
+
+func main() {
+	klog.InitFlags(nil)
+	args := args.New()
+
+	args.AddFlags(pflag.CommandLine)
+	flag.Set("logtostderr", "true")
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+	pflag.Parse()
+
+	if err := args.Validate(); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+
+	myTargets := func(context *generator.Context) []generator.Target {
+		return generators.GetTargets(context, args)
+	}
+
+	// Run it.
+	if err := gengo.Execute(
+		generators.NameSystems(),
+		generators.DefaultNameSystem(),
+		myTargets,
+		gengo.StdBuildTag,
+		pflag.Args(),
+	); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+	klog.V(2).Info("Completed successfully.")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/aliases/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/aliases/doc.go
new file mode 100644
index 0000000000..d007d34f78
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/aliases/doc.go
@@ -0,0 +1,89 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+
+// This is a test package.
+package aliases
+
+// Note: the following AliasInterface and AliasAliasInterface +k8s:deepcopy-gen:interfaces tags
+// are necessary because Golang flattens interface alias in the type system. I.e. an alias J of
+// an interface I is actually equivalent to I. So support deepcopies of those aliases, we have
+// to implement all aliases of that interface.
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/code-generator/cmd/deepcopy-gen/output_tests/aliases.Interface
+// +k8s:deepcopy-gen:interfaces=k8s.io/code-generator/cmd/deepcopy-gen/output_tests/aliases.AliasInterface
+// +k8s:deepcopy-gen:interfaces=k8s.io/code-generator/cmd/deepcopy-gen/output_tests/aliases.AliasAliasInterface
+type Foo struct {
+	X int
+}
+
+type Interface interface {
+	DeepCopyInterface() Interface
+	DeepCopyAliasInterface() AliasInterface
+	DeepCopyAliasAliasInterface() AliasAliasInterface
+}
+
+type Builtin int
+type Slice []int
+type Pointer *int
+type PointerAlias *Builtin
+type Struct Foo
+type Map map[string]int
+
+type FooAlias Foo
+type FooSlice []Foo
+type FooPointer *Foo
+type FooMap map[string]Foo
+
+type AliasBuiltin Builtin
+type AliasSlice Slice
+type AliasPointer Pointer
+type AliasStruct Struct
+type AliasMap Map
+
+type AliasInterface Interface
+type AliasAliasInterface AliasInterface
+type AliasInterfaceMap map[string]AliasInterface
+type AliasInterfaceSlice []AliasInterface
+
+// Aliases
+type Ttest struct {
+	Builtin      Builtin
+	Slice        Slice
+	Pointer      Pointer
+	PointerAlias PointerAlias
+	Struct       Struct
+	Map          Map
+	SliceSlice   []Slice
+	MapSlice     map[string]Slice
+
+	FooAlias   FooAlias
+	FooSlice   FooSlice
+	FooPointer FooPointer
+	FooMap     FooMap
+
+	AliasBuiltin AliasBuiltin
+	AliasSlice   AliasSlice
+	AliasPointer AliasPointer
+	AliasStruct  AliasStruct
+	AliasMap     AliasMap
+
+	AliasInterface      AliasInterface
+	AliasAliasInterface AliasAliasInterface
+	AliasInterfaceMap   AliasInterfaceMap
+	AliasInterfaceSlice AliasInterfaceSlice
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/aliases/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/aliases/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..e7c6827f02
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/aliases/zz_generated.deepcopy.go
@@ -0,0 +1,413 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package aliases
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in AliasInterfaceMap) DeepCopyInto(out *AliasInterfaceMap) {
+	{
+		in := &in
+		*out = make(AliasInterfaceMap, len(*in))
+		for key, val := range *in {
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				(*out)[key] = val.DeepCopyAliasInterface()
+			}
+		}
+		return
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AliasInterfaceMap.
+func (in AliasInterfaceMap) DeepCopy() AliasInterfaceMap {
+	if in == nil {
+		return nil
+	}
+	out := new(AliasInterfaceMap)
+	in.DeepCopyInto(out)
+	return *out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in AliasInterfaceSlice) DeepCopyInto(out *AliasInterfaceSlice) {
+	{
+		in := &in
+		*out = make(AliasInterfaceSlice, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				(*out)[i] = (*in)[i].DeepCopyAliasInterface()
+			}
+		}
+		return
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AliasInterfaceSlice.
+func (in AliasInterfaceSlice) DeepCopy() AliasInterfaceSlice {
+	if in == nil {
+		return nil
+	}
+	out := new(AliasInterfaceSlice)
+	in.DeepCopyInto(out)
+	return *out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in AliasMap) DeepCopyInto(out *AliasMap) {
+	{
+		in := &in
+		*out = make(AliasMap, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+		return
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AliasMap.
+func (in AliasMap) DeepCopy() AliasMap {
+	if in == nil {
+		return nil
+	}
+	out := new(AliasMap)
+	in.DeepCopyInto(out)
+	return *out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in AliasSlice) DeepCopyInto(out *AliasSlice) {
+	{
+		in := &in
+		*out = make(AliasSlice, len(*in))
+		copy(*out, *in)
+		return
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AliasSlice.
+func (in AliasSlice) DeepCopy() AliasSlice {
+	if in == nil {
+		return nil
+	}
+	out := new(AliasSlice)
+	in.DeepCopyInto(out)
+	return *out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AliasStruct) DeepCopyInto(out *AliasStruct) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AliasStruct.
+func (in *AliasStruct) DeepCopy() *AliasStruct {
+	if in == nil {
+		return nil
+	}
+	out := new(AliasStruct)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Foo) DeepCopyInto(out *Foo) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Foo.
+func (in *Foo) DeepCopy() *Foo {
+	if in == nil {
+		return nil
+	}
+	out := new(Foo)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyAliasAliasInterface is an autogenerated deepcopy function, copying the receiver, creating a new AliasAliasInterface.
+func (in *Foo) DeepCopyAliasAliasInterface() AliasAliasInterface {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyAliasInterface is an autogenerated deepcopy function, copying the receiver, creating a new AliasInterface.
+func (in *Foo) DeepCopyAliasInterface() AliasInterface {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new Interface.
+func (in *Foo) DeepCopyInterface() Interface {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FooAlias) DeepCopyInto(out *FooAlias) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FooAlias.
+func (in *FooAlias) DeepCopy() *FooAlias {
+	if in == nil {
+		return nil
+	}
+	out := new(FooAlias)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in FooMap) DeepCopyInto(out *FooMap) {
+	{
+		in := &in
+		*out = make(FooMap, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+		return
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FooMap.
+func (in FooMap) DeepCopy() FooMap {
+	if in == nil {
+		return nil
+	}
+	out := new(FooMap)
+	in.DeepCopyInto(out)
+	return *out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in FooSlice) DeepCopyInto(out *FooSlice) {
+	{
+		in := &in
+		*out = make(FooSlice, len(*in))
+		copy(*out, *in)
+		return
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FooSlice.
+func (in FooSlice) DeepCopy() FooSlice {
+	if in == nil {
+		return nil
+	}
+	out := new(FooSlice)
+	in.DeepCopyInto(out)
+	return *out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in Map) DeepCopyInto(out *Map) {
+	{
+		in := &in
+		*out = make(Map, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+		return
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Map.
+func (in Map) DeepCopy() Map {
+	if in == nil {
+		return nil
+	}
+	out := new(Map)
+	in.DeepCopyInto(out)
+	return *out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in Slice) DeepCopyInto(out *Slice) {
+	{
+		in := &in
+		*out = make(Slice, len(*in))
+		copy(*out, *in)
+		return
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Slice.
+func (in Slice) DeepCopy() Slice {
+	if in == nil {
+		return nil
+	}
+	out := new(Slice)
+	in.DeepCopyInto(out)
+	return *out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Struct) DeepCopyInto(out *Struct) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Struct.
+func (in *Struct) DeepCopy() *Struct {
+	if in == nil {
+		return nil
+	}
+	out := new(Struct)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Ttest) DeepCopyInto(out *Ttest) {
+	*out = *in
+	if in.Slice != nil {
+		in, out := &in.Slice, &out.Slice
+		*out = make(Slice, len(*in))
+		copy(*out, *in)
+	}
+	if in.Pointer != nil {
+		in, out := &in.Pointer, &out.Pointer
+		*out = new(int)
+		**out = **in
+	}
+	if in.PointerAlias != nil {
+		in, out := &in.PointerAlias, &out.PointerAlias
+		*out = new(Builtin)
+		**out = **in
+	}
+	out.Struct = in.Struct
+	if in.Map != nil {
+		in, out := &in.Map, &out.Map
+		*out = make(Map, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.SliceSlice != nil {
+		in, out := &in.SliceSlice, &out.SliceSlice
+		*out = make([]Slice, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = make(Slice, len(*in))
+				copy(*out, *in)
+			}
+		}
+	}
+	if in.MapSlice != nil {
+		in, out := &in.MapSlice, &out.MapSlice
+		*out = make(map[string]Slice, len(*in))
+		for key, val := range *in {
+			var outVal []int
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = make(Slice, len(*in))
+				copy(*out, *in)
+			}
+			(*out)[key] = outVal
+		}
+	}
+	out.FooAlias = in.FooAlias
+	if in.FooSlice != nil {
+		in, out := &in.FooSlice, &out.FooSlice
+		*out = make(FooSlice, len(*in))
+		copy(*out, *in)
+	}
+	if in.FooPointer != nil {
+		in, out := &in.FooPointer, &out.FooPointer
+		*out = new(Foo)
+		**out = **in
+	}
+	if in.FooMap != nil {
+		in, out := &in.FooMap, &out.FooMap
+		*out = make(FooMap, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.AliasSlice != nil {
+		in, out := &in.AliasSlice, &out.AliasSlice
+		*out = make(AliasSlice, len(*in))
+		copy(*out, *in)
+	}
+	if in.AliasPointer != nil {
+		in, out := &in.AliasPointer, &out.AliasPointer
+		*out = new(int)
+		**out = **in
+	}
+	out.AliasStruct = in.AliasStruct
+	if in.AliasMap != nil {
+		in, out := &in.AliasMap, &out.AliasMap
+		*out = make(AliasMap, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.AliasInterface != nil {
+		out.AliasInterface = in.AliasInterface.DeepCopyAliasInterface()
+	}
+	if in.AliasAliasInterface != nil {
+		out.AliasAliasInterface = in.AliasAliasInterface.DeepCopyAliasAliasInterface()
+	}
+	if in.AliasInterfaceMap != nil {
+		in, out := &in.AliasInterfaceMap, &out.AliasInterfaceMap
+		*out = make(AliasInterfaceMap, len(*in))
+		for key, val := range *in {
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				(*out)[key] = val.DeepCopyAliasInterface()
+			}
+		}
+	}
+	if in.AliasInterfaceSlice != nil {
+		in, out := &in.AliasInterfaceSlice, &out.AliasInterfaceSlice
+		*out = make(AliasInterfaceSlice, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				(*out)[i] = (*in)[i].DeepCopyAliasInterface()
+			}
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Ttest.
+func (in *Ttest) DeepCopy() *Ttest {
+	if in == nil {
+		return nil
+	}
+	out := new(Ttest)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/builtins/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/builtins/doc.go
new file mode 100644
index 0000000000..34097c84df
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/builtins/doc.go
@@ -0,0 +1,35 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+
+// This is a test package.
+package builtins
+
+type Ttest struct {
+	Byte byte
+	// Int8    int8 // TODO: int8 becomes byte in SnippetWriter
+	Int16   int16
+	Int32   int32
+	Int64   int64
+	Uint8   uint8
+	Uint16  uint16
+	Uint32  uint32
+	Uint64  uint64
+	Float32 float32
+	Float64 float64
+	String  string
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/builtins/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/builtins/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..afc71ffb07
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/builtins/zz_generated.deepcopy.go
@@ -0,0 +1,38 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package builtins
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Ttest) DeepCopyInto(out *Ttest) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Ttest.
+func (in *Ttest) DeepCopy() *Ttest {
+	if in == nil {
+		return nil
+	}
+	out := new(Ttest)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/generate.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/generate.go
new file mode 100644
index 0000000000..9ae99ee9ba
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/generate.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+//go:generate go run k8s.io/code-generator/cmd/deepcopy-gen --output-file zz_generated.deepcopy.go --go-header-file=../../../examples/hack/boilerplate.go.txt k8s.io/code-generator/cmd/deepcopy-gen/output_tests/...
+package outputtests
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/interface_fuzzer.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/interface_fuzzer.go
new file mode 100644
index 0000000000..d6f960f1dd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/interface_fuzzer.go
@@ -0,0 +1,131 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package outputtests
+
+import (
+	"sigs.k8s.io/randfill"
+
+	"k8s.io/code-generator/cmd/deepcopy-gen/output_tests/aliases"
+	"k8s.io/code-generator/cmd/deepcopy-gen/output_tests/interfaces"
+)
+
+// interfaceFuzzers contains fuzzer that set all interface to nil because our
+// JSON deepcopy does not work with it.
+// TODO: test also interface deepcopy
+var interfaceFuzzers = []interface{}{
+	func(s *aliases.AliasAliasInterface, c randfill.Continue) {
+		if c.Bool() {
+			*s = nil
+		} else {
+			*s = &aliasAliasInterfaceInstance{X: c.Int()}
+		}
+	},
+	func(s *aliases.AliasInterface, c randfill.Continue) {
+		if c.Bool() {
+			*s = nil
+		} else {
+			*s = &aliasAliasInterfaceInstance{X: c.Int()}
+		}
+	},
+	func(s *aliases.Interface, c randfill.Continue) {
+		if c.Bool() {
+			*s = nil
+		} else {
+			*s = &aliasAliasInterfaceInstance{X: c.Int()}
+		}
+	},
+	func(s *aliases.AliasInterfaceMap, c randfill.Continue) {
+		if c.Bool() {
+			*s = nil
+		} else {
+			*s = make(aliases.AliasInterfaceMap)
+			for i := 0; i < c.Intn(3); i++ {
+				if c.Bool() {
+					(*s)[c.String(0)] = nil
+				} else {
+					(*s)[c.String(0)] = &aliasAliasInterfaceInstance{X: c.Int()}
+				}
+			}
+		}
+
+	},
+	func(s *aliases.AliasInterfaceSlice, c randfill.Continue) {
+		if c.Bool() {
+			*s = nil
+		} else {
+			*s = make(aliases.AliasInterfaceSlice, 0)
+			for i := 0; i < c.Intn(3); i++ {
+				if c.Bool() {
+					*s = append(*s, nil)
+				} else {
+					*s = append(*s, &aliasAliasInterfaceInstance{X: c.Int()})
+				}
+			}
+		}
+	},
+	func(s *interfaces.Inner, c randfill.Continue) {
+		if c.Bool() {
+			*s = nil
+		} else {
+			*s = &interfacesInnerInstance{X: c.Float64()}
+		}
+	},
+}
+
+type aliasAliasInterfaceInstance struct {
+	X int
+}
+
+func (i *aliasAliasInterfaceInstance) DeepCopyInterface() aliases.Interface {
+	if i == nil {
+		return nil
+	}
+
+	return &aliasAliasInterfaceInstance{X: i.X}
+}
+
+func (i *aliasAliasInterfaceInstance) DeepCopyAliasInterface() aliases.AliasInterface {
+	if i == nil {
+		return nil
+	}
+
+	return &aliasAliasInterfaceInstance{X: i.X}
+}
+
+func (i *aliasAliasInterfaceInstance) DeepCopyAliasAliasInterface() aliases.AliasAliasInterface {
+	if i == nil {
+		return nil
+	}
+
+	return &aliasAliasInterfaceInstance{X: i.X}
+}
+
+type interfacesInnerInstance struct {
+	X float64
+}
+
+func (i *interfacesInnerInstance) DeepCopyInner() interfaces.Inner {
+	if i == nil {
+		return nil
+	}
+
+	return &interfacesInnerInstance{X: i.X}
+}
+
+func (i *interfacesInnerInstance) Function() float64 {
+	return i.X
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/interfaces/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/interfaces/doc.go
new file mode 100644
index 0000000000..2d01f2e601
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/interfaces/doc.go
@@ -0,0 +1,29 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+
+// This is a test package.
+package interfaces
+
+type Inner interface {
+	Function() float64
+	DeepCopyInner() Inner
+}
+
+type Ttest struct {
+	I []Inner
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/interfaces/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/interfaces/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..abaa51b163
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/interfaces/zz_generated.deepcopy.go
@@ -0,0 +1,47 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package interfaces
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Ttest) DeepCopyInto(out *Ttest) {
+	*out = *in
+	if in.I != nil {
+		in, out := &in.I, &out.I
+		*out = make([]Inner, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				(*out)[i] = (*in)[i].DeepCopyInner()
+			}
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Ttest.
+func (in *Ttest) DeepCopy() *Ttest {
+	if in == nil {
+		return nil
+	}
+	out := new(Ttest)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/maps/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/maps/doc.go
new file mode 100644
index 0000000000..01871e44d4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/maps/doc.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+
+// This is a test package.
+package maps
+
+type Ttest struct {
+	Byte map[string]byte
+	// Int8    map[string]int8 //TODO: int8 becomes byte in SnippetWriter
+	Int16        map[string]int16
+	Int32        map[string]int32
+	Int64        map[string]int64
+	Uint8        map[string]uint8
+	Uint16       map[string]uint16
+	Uint32       map[string]uint32
+	Uint64       map[string]uint64
+	Float32      map[string]float32
+	Float64      map[string]float64
+	String       map[string]string
+	StringPtr    map[string]*string
+	StringPtrPtr map[string]**string
+	Map          map[string]map[string]string
+	MapPtr       map[string]*map[string]string
+	Slice        map[string][]string
+	SlicePtr     map[string]*[]string
+	Struct       map[string]Ttest
+	StructPtr    map[string]*Ttest
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/maps/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/maps/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..77103245a7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/maps/zz_generated.deepcopy.go
@@ -0,0 +1,243 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package maps
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Ttest) DeepCopyInto(out *Ttest) {
+	*out = *in
+	if in.Byte != nil {
+		in, out := &in.Byte, &out.Byte
+		*out = make(map[string]byte, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Int16 != nil {
+		in, out := &in.Int16, &out.Int16
+		*out = make(map[string]int16, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Int32 != nil {
+		in, out := &in.Int32, &out.Int32
+		*out = make(map[string]int32, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Int64 != nil {
+		in, out := &in.Int64, &out.Int64
+		*out = make(map[string]int64, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Uint8 != nil {
+		in, out := &in.Uint8, &out.Uint8
+		*out = make(map[string]byte, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Uint16 != nil {
+		in, out := &in.Uint16, &out.Uint16
+		*out = make(map[string]uint16, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Uint32 != nil {
+		in, out := &in.Uint32, &out.Uint32
+		*out = make(map[string]uint32, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Uint64 != nil {
+		in, out := &in.Uint64, &out.Uint64
+		*out = make(map[string]uint64, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Float32 != nil {
+		in, out := &in.Float32, &out.Float32
+		*out = make(map[string]float32, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Float64 != nil {
+		in, out := &in.Float64, &out.Float64
+		*out = make(map[string]float64, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.String != nil {
+		in, out := &in.String, &out.String
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.StringPtr != nil {
+		in, out := &in.StringPtr, &out.StringPtr
+		*out = make(map[string]*string, len(*in))
+		for key, val := range *in {
+			var outVal *string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = new(string)
+				**out = **in
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.StringPtrPtr != nil {
+		in, out := &in.StringPtrPtr, &out.StringPtrPtr
+		*out = make(map[string]**string, len(*in))
+		for key, val := range *in {
+			var outVal **string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = new(*string)
+				if **in != nil {
+					in, out := *in, *out
+					*out = new(string)
+					**out = **in
+				}
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.Map != nil {
+		in, out := &in.Map, &out.Map
+		*out = make(map[string]map[string]string, len(*in))
+		for key, val := range *in {
+			var outVal map[string]string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = make(map[string]string, len(*in))
+				for key, val := range *in {
+					(*out)[key] = val
+				}
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.MapPtr != nil {
+		in, out := &in.MapPtr, &out.MapPtr
+		*out = make(map[string]*map[string]string, len(*in))
+		for key, val := range *in {
+			var outVal *map[string]string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = new(map[string]string)
+				if **in != nil {
+					in, out := *in, *out
+					*out = make(map[string]string, len(*in))
+					for key, val := range *in {
+						(*out)[key] = val
+					}
+				}
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.Slice != nil {
+		in, out := &in.Slice, &out.Slice
+		*out = make(map[string][]string, len(*in))
+		for key, val := range *in {
+			var outVal []string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = make([]string, len(*in))
+				copy(*out, *in)
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.SlicePtr != nil {
+		in, out := &in.SlicePtr, &out.SlicePtr
+		*out = make(map[string]*[]string, len(*in))
+		for key, val := range *in {
+			var outVal *[]string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = new([]string)
+				if **in != nil {
+					in, out := *in, *out
+					*out = make([]string, len(*in))
+					copy(*out, *in)
+				}
+			}
+			(*out)[key] = outVal
+		}
+	}
+	if in.Struct != nil {
+		in, out := &in.Struct, &out.Struct
+		*out = make(map[string]Ttest, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	if in.StructPtr != nil {
+		in, out := &in.StructPtr, &out.StructPtr
+		*out = make(map[string]*Ttest, len(*in))
+		for key, val := range *in {
+			var outVal *Ttest
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = new(Ttest)
+				(*in).DeepCopyInto(*out)
+			}
+			(*out)[key] = outVal
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Ttest.
+func (in *Ttest) DeepCopy() *Ttest {
+	if in == nil {
+		return nil
+	}
+	out := new(Ttest)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/otherpkg/interfaces.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/otherpkg/interfaces.go
new file mode 100644
index 0000000000..980fab0131
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/otherpkg/interfaces.go
@@ -0,0 +1,25 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package otherpkg
+
+type Object interface {
+	DeepCopyObject() Object
+}
+
+type List interface {
+	DeepCopyList() List
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/output_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/output_test.go
new file mode 100644
index 0000000000..957aee6135
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/output_test.go
@@ -0,0 +1,173 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package outputtests
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	"sigs.k8s.io/randfill"
+
+	"k8s.io/code-generator/cmd/deepcopy-gen/output_tests/aliases"
+	"k8s.io/code-generator/cmd/deepcopy-gen/output_tests/builtins"
+	"k8s.io/code-generator/cmd/deepcopy-gen/output_tests/interfaces"
+	"k8s.io/code-generator/cmd/deepcopy-gen/output_tests/maps"
+	"k8s.io/code-generator/cmd/deepcopy-gen/output_tests/pointer"
+	"k8s.io/code-generator/cmd/deepcopy-gen/output_tests/slices"
+	"k8s.io/code-generator/cmd/deepcopy-gen/output_tests/structs"
+	"k8s.io/utils/dump"
+)
+
+func TestWithValueFuzzer(t *testing.T) {
+	tests := []interface{}{
+		aliases.Ttest{},
+		builtins.Ttest{},
+		interfaces.Ttest{},
+		maps.Ttest{},
+		pointer.Ttest{},
+		slices.Ttest{},
+		structs.Ttest{},
+	}
+
+	fuzzer := randfill.New()
+	fuzzer.NilChance(0.5)
+	fuzzer.NumElements(0, 2)
+	fuzzer.Funcs(interfaceFuzzers...)
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%T", test), func(t *testing.T) {
+			N := 1000
+			for i := 0; i < N; i++ {
+				original := reflect.New(reflect.TypeOf(test)).Interface()
+
+				fuzzer.Fill(original)
+
+				reflectCopy := ReflectDeepCopy(original)
+
+				if !reflect.DeepEqual(original, reflectCopy) {
+					t.Errorf("original and reflectCopy are different:\n\n  original = %s\n\n  jsonCopy = %s", dump.Pretty(original), dump.Pretty(reflectCopy))
+				}
+
+				deepCopy := reflect.ValueOf(original).MethodByName("DeepCopy").Call(nil)[0].Interface()
+
+				if !reflect.DeepEqual(original, deepCopy) {
+					t.Fatalf("original and deepCopy are different:\n\n  original = %s\n\n  deepCopy() = %s", dump.Pretty(original), dump.Pretty(deepCopy))
+				}
+
+				ValueFuzz(original)
+
+				if !reflect.DeepEqual(reflectCopy, deepCopy) {
+					t.Fatalf("reflectCopy and deepCopy are different:\n\n  origin = %s\n\n  jsonCopy() = %s", dump.Pretty(original), dump.Pretty(deepCopy))
+				}
+			}
+		})
+	}
+}
+
+func BenchmarkReflectDeepCopy(b *testing.B) {
+	fourtytwo := "fourtytwo"
+	fourtytwoPtr := &fourtytwo
+	var nilMap map[string]string
+	var nilSlice []string
+	mapPtr := &map[string]string{"0": "fourtytwo", "1": "fourtytwo"}
+	slicePtr := &[]string{"fourtytwo", "fourtytwo", "fourtytwo"}
+	structPtr := &pointer.Ttest{
+		Builtin: &fourtytwo,
+		Ptr:     &fourtytwoPtr,
+	}
+
+	tests := []interface{}{
+		maps.Ttest{
+			Byte:         map[string]byte{"0": 42, "1": 42, "3": 42},
+			Int16:        map[string]int16{"0": 42, "1": 42, "3": 42},
+			Int32:        map[string]int32{"0": 42, "1": 42, "3": 42},
+			Int64:        map[string]int64{"0": 42, "1": 42, "3": 42},
+			Uint8:        map[string]uint8{"0": 42, "1": 42, "3": 42},
+			Uint16:       map[string]uint16{"0": 42, "1": 42, "3": 42},
+			Uint32:       map[string]uint32{"0": 42, "1": 42, "3": 42},
+			Uint64:       map[string]uint64{"0": 42, "1": 42, "3": 42},
+			Float32:      map[string]float32{"0": 42.0, "1": 42.0, "3": 42.0},
+			Float64:      map[string]float64{"0": 42, "1": 42, "3": 42},
+			String:       map[string]string{"0": "fourtytwo", "1": "fourtytwo", "3": "fourtytwo"},
+			StringPtr:    map[string]*string{"0": &fourtytwo, "1": &fourtytwo, "3": &fourtytwo},
+			StringPtrPtr: map[string]**string{"0": &fourtytwoPtr, "1": &fourtytwoPtr, "3": &fourtytwoPtr},
+			Map:          map[string]map[string]string{"0": nil, "1": {"a": fourtytwo, "b": fourtytwo}, "3": {}},
+			MapPtr:       map[string]*map[string]string{"0": nil, "1": {"a": fourtytwo, "b": fourtytwo}, "3": &nilMap},
+			Slice:        map[string][]string{"0": nil, "1": {"a", "b"}, "2": {}},
+			SlicePtr:     map[string]*[]string{"0": nil, "1": {"a", "b"}, "2": &nilSlice},
+			Struct:       map[string]maps.Ttest{"0": {}, "1": {Byte: map[string]byte{"0": 42, "1": 42, "3": 42}}},
+			StructPtr:    map[string]*maps.Ttest{"0": nil, "1": {}, "2": {Byte: map[string]byte{"0": 42, "1": 42, "3": 42}}},
+		},
+		slices.Ttest{
+			Byte:         []byte{42, 42, 42},
+			Int16:        []int16{42, 42, 42},
+			Int32:        []int32{42, 42, 42},
+			Int64:        []int64{42, 42, 42},
+			Uint8:        []uint8{42, 42, 42},
+			Uint16:       []uint16{42, 42, 42},
+			Uint32:       []uint32{42, 42, 42},
+			Uint64:       []uint64{42, 42, 42},
+			Float32:      []float32{42.0, 42.0, 42.0},
+			Float64:      []float64{42, 42, 42},
+			String:       []string{"fourtytwo", "fourtytwo", "fourtytwo"},
+			StringPtr:    []*string{&fourtytwo, &fourtytwo, &fourtytwo},
+			StringPtrPtr: []**string{&fourtytwoPtr, &fourtytwoPtr, &fourtytwoPtr},
+			Map:          []map[string]string{nil, {"a": fourtytwo, "b": fourtytwo}, {}},
+			MapPtr:       []*map[string]string{nil, {"a": fourtytwo, "b": fourtytwo}, &nilMap},
+			Slice:        [][]string{nil, {"a", "b"}, {}},
+			SlicePtr:     []*[]string{nil, {"a", "b"}, &nilSlice},
+			Struct:       []slices.Ttest{{}, {Byte: []byte{42, 42, 42}}},
+			StructPtr:    []*slices.Ttest{nil, {}, {Byte: []byte{42, 42, 42}}},
+		},
+		pointer.Ttest{
+			Builtin:  &fourtytwo,
+			Ptr:      &fourtytwoPtr,
+			Map:      &map[string]string{"0": "fourtytwo", "1": "fourtytwo"},
+			Slice:    &[]string{"fourtytwo", "fourtytwo", "fourtytwo"},
+			MapPtr:   &mapPtr,
+			SlicePtr: &slicePtr,
+			Struct: &pointer.Ttest{
+				Builtin: &fourtytwo,
+				Ptr:     &fourtytwoPtr,
+			},
+			StructPtr: &structPtr,
+		},
+	}
+
+	fuzzer := randfill.New()
+	fuzzer.NilChance(0.5)
+	fuzzer.NumElements(0, 2)
+	fuzzer.Funcs(interfaceFuzzers...)
+
+	for _, test := range tests {
+		b.Run(fmt.Sprintf("%T", test), func(b *testing.B) {
+			for i := 0; i < b.N; i++ {
+				switch t := test.(type) {
+				case maps.Ttest:
+					t.DeepCopy()
+				case slices.Ttest:
+					t.DeepCopy()
+				case pointer.Ttest:
+					t.DeepCopy()
+				default:
+					b.Fatalf("missing type case in switch for %T", t)
+				}
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/pointer/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/pointer/doc.go
new file mode 100644
index 0000000000..fd461101b1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/pointer/doc.go
@@ -0,0 +1,31 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+
+// This is a test package.
+package pointer
+
+type Ttest struct {
+	Builtin   *string
+	Ptr       **string
+	Map       *map[string]string
+	Slice     *[]string
+	MapPtr    **map[string]string
+	SlicePtr  **[]string
+	Struct    *Ttest
+	StructPtr **Ttest
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/pointer/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/pointer/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..ceb9a52dcf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/pointer/zz_generated.deepcopy.go
@@ -0,0 +1,114 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package pointer
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Ttest) DeepCopyInto(out *Ttest) {
+	*out = *in
+	if in.Builtin != nil {
+		in, out := &in.Builtin, &out.Builtin
+		*out = new(string)
+		**out = **in
+	}
+	if in.Ptr != nil {
+		in, out := &in.Ptr, &out.Ptr
+		*out = new(*string)
+		if **in != nil {
+			in, out := *in, *out
+			*out = new(string)
+			**out = **in
+		}
+	}
+	if in.Map != nil {
+		in, out := &in.Map, &out.Map
+		*out = new(map[string]string)
+		if **in != nil {
+			in, out := *in, *out
+			*out = make(map[string]string, len(*in))
+			for key, val := range *in {
+				(*out)[key] = val
+			}
+		}
+	}
+	if in.Slice != nil {
+		in, out := &in.Slice, &out.Slice
+		*out = new([]string)
+		if **in != nil {
+			in, out := *in, *out
+			*out = make([]string, len(*in))
+			copy(*out, *in)
+		}
+	}
+	if in.MapPtr != nil {
+		in, out := &in.MapPtr, &out.MapPtr
+		*out = new(*map[string]string)
+		if **in != nil {
+			in, out := *in, *out
+			*out = new(map[string]string)
+			if **in != nil {
+				in, out := *in, *out
+				*out = make(map[string]string, len(*in))
+				for key, val := range *in {
+					(*out)[key] = val
+				}
+			}
+		}
+	}
+	if in.SlicePtr != nil {
+		in, out := &in.SlicePtr, &out.SlicePtr
+		*out = new(*[]string)
+		if **in != nil {
+			in, out := *in, *out
+			*out = new([]string)
+			if **in != nil {
+				in, out := *in, *out
+				*out = make([]string, len(*in))
+				copy(*out, *in)
+			}
+		}
+	}
+	if in.Struct != nil {
+		in, out := &in.Struct, &out.Struct
+		*out = new(Ttest)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.StructPtr != nil {
+		in, out := &in.StructPtr, &out.StructPtr
+		*out = new(*Ttest)
+		if **in != nil {
+			in, out := *in, *out
+			*out = new(Ttest)
+			(*in).DeepCopyInto(*out)
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Ttest.
+func (in *Ttest) DeepCopy() *Ttest {
+	if in == nil {
+		return nil
+	}
+	out := new(Ttest)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/reflect_deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/reflect_deepcopy.go
new file mode 100644
index 0000000000..ffb3241af8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/reflect_deepcopy.go
@@ -0,0 +1,81 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package outputtests
+
+import (
+	"fmt"
+	"reflect"
+)
+
+// ReflectDeepCopy deep copies the object using reflection.
+func ReflectDeepCopy(in interface{}) interface{} {
+	return reflectDeepCopy(reflect.ValueOf(in)).Interface()
+}
+
+func reflectDeepCopy(src reflect.Value) reflect.Value {
+	switch src.Kind() {
+	case reflect.Interface, reflect.Ptr, reflect.Map, reflect.Slice:
+		if src.IsNil() {
+			return src
+		}
+	}
+
+	switch src.Kind() {
+	case reflect.Chan, reflect.Func, reflect.UnsafePointer, reflect.Uintptr:
+		panic(fmt.Sprintf("cannot deep copy kind: %s", src.Kind()))
+	case reflect.Array:
+		dst := reflect.New(src.Type())
+		for i := 0; i < src.Len(); i++ {
+			dst.Elem().Index(i).Set(reflectDeepCopy(src.Index(i)))
+		}
+		return dst.Elem()
+	case reflect.Interface:
+		return reflectDeepCopy(src.Elem())
+	case reflect.Map:
+		dst := reflect.MakeMap(src.Type())
+		for _, k := range src.MapKeys() {
+			dst.SetMapIndex(k, reflectDeepCopy(src.MapIndex(k)))
+		}
+		return dst
+	case reflect.Ptr:
+		dst := reflect.New(src.Type().Elem())
+		dst.Elem().Set(reflectDeepCopy(src.Elem()))
+		return dst
+	case reflect.Slice:
+		dst := reflect.MakeSlice(src.Type(), 0, src.Len())
+		for i := 0; i < src.Len(); i++ {
+			dst = reflect.Append(dst, reflectDeepCopy(src.Index(i)))
+		}
+		return dst
+	case reflect.Struct:
+		dst := reflect.New(src.Type())
+		for i := 0; i < src.NumField(); i++ {
+			if !dst.Elem().Field(i).CanSet() {
+				// Can't set private fields. At this point, the
+				// best we can do is a shallow copy. For
+				// example, time.Time is a value type with
+				// private members that can be shallow copied.
+				return src
+			}
+			dst.Elem().Field(i).Set(reflectDeepCopy(src.Field(i)))
+		}
+		return dst.Elem()
+	default:
+		// Value types like numbers, booleans, and strings.
+		return src
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/slices/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/slices/doc.go
new file mode 100644
index 0000000000..183d73628c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/slices/doc.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+
+// This is a test package.
+package slices
+
+type Ttest struct {
+	Byte []byte
+	// Int8    []int8 //TODO: int8 becomes byte in SnippetWriter
+	Int16        []int16
+	Int32        []int32
+	Int64        []int64
+	Uint8        []uint8
+	Uint16       []uint16
+	Uint32       []uint32
+	Uint64       []uint64
+	Float32      []float32
+	Float64      []float64
+	String       []string
+	StringPtr    []*string
+	StringPtrPtr []**string
+	Map          []map[string]string
+	MapPtr       []*map[string]string
+	Slice        [][]string
+	SlicePtr     []*[]string
+	Struct       []Ttest
+	StructPtr    []*Ttest
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/slices/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/slices/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..04d4276a9d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/slices/zz_generated.deepcopy.go
@@ -0,0 +1,193 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package slices
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Ttest) DeepCopyInto(out *Ttest) {
+	*out = *in
+	if in.Byte != nil {
+		in, out := &in.Byte, &out.Byte
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.Int16 != nil {
+		in, out := &in.Int16, &out.Int16
+		*out = make([]int16, len(*in))
+		copy(*out, *in)
+	}
+	if in.Int32 != nil {
+		in, out := &in.Int32, &out.Int32
+		*out = make([]int32, len(*in))
+		copy(*out, *in)
+	}
+	if in.Int64 != nil {
+		in, out := &in.Int64, &out.Int64
+		*out = make([]int64, len(*in))
+		copy(*out, *in)
+	}
+	if in.Uint8 != nil {
+		in, out := &in.Uint8, &out.Uint8
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.Uint16 != nil {
+		in, out := &in.Uint16, &out.Uint16
+		*out = make([]uint16, len(*in))
+		copy(*out, *in)
+	}
+	if in.Uint32 != nil {
+		in, out := &in.Uint32, &out.Uint32
+		*out = make([]uint32, len(*in))
+		copy(*out, *in)
+	}
+	if in.Uint64 != nil {
+		in, out := &in.Uint64, &out.Uint64
+		*out = make([]uint64, len(*in))
+		copy(*out, *in)
+	}
+	if in.Float32 != nil {
+		in, out := &in.Float32, &out.Float32
+		*out = make([]float32, len(*in))
+		copy(*out, *in)
+	}
+	if in.Float64 != nil {
+		in, out := &in.Float64, &out.Float64
+		*out = make([]float64, len(*in))
+		copy(*out, *in)
+	}
+	if in.String != nil {
+		in, out := &in.String, &out.String
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.StringPtr != nil {
+		in, out := &in.StringPtr, &out.StringPtr
+		*out = make([]*string, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(string)
+				**out = **in
+			}
+		}
+	}
+	if in.StringPtrPtr != nil {
+		in, out := &in.StringPtrPtr, &out.StringPtrPtr
+		*out = make([]**string, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(*string)
+				if **in != nil {
+					in, out := *in, *out
+					*out = new(string)
+					**out = **in
+				}
+			}
+		}
+	}
+	if in.Map != nil {
+		in, out := &in.Map, &out.Map
+		*out = make([]map[string]string, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = make(map[string]string, len(*in))
+				for key, val := range *in {
+					(*out)[key] = val
+				}
+			}
+		}
+	}
+	if in.MapPtr != nil {
+		in, out := &in.MapPtr, &out.MapPtr
+		*out = make([]*map[string]string, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(map[string]string)
+				if **in != nil {
+					in, out := *in, *out
+					*out = make(map[string]string, len(*in))
+					for key, val := range *in {
+						(*out)[key] = val
+					}
+				}
+			}
+		}
+	}
+	if in.Slice != nil {
+		in, out := &in.Slice, &out.Slice
+		*out = make([][]string, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = make([]string, len(*in))
+				copy(*out, *in)
+			}
+		}
+	}
+	if in.SlicePtr != nil {
+		in, out := &in.SlicePtr, &out.SlicePtr
+		*out = make([]*[]string, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new([]string)
+				if **in != nil {
+					in, out := *in, *out
+					*out = make([]string, len(*in))
+					copy(*out, *in)
+				}
+			}
+		}
+	}
+	if in.Struct != nil {
+		in, out := &in.Struct, &out.Struct
+		*out = make([]Ttest, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.StructPtr != nil {
+		in, out := &in.StructPtr, &out.StructPtr
+		*out = make([]*Ttest, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(Ttest)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Ttest.
+func (in *Ttest) DeepCopy() *Ttest {
+	if in == nil {
+		return nil
+	}
+	out := new(Ttest)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/structs/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/structs/doc.go
new file mode 100644
index 0000000000..7e40800b23
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/structs/doc.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+
+// This is a test package.
+package structs
+
+type Inner struct {
+	Byte byte
+	// Int8    int8 //TODO: int8 becomes byte in SnippetWriter
+	Int16   int16
+	Int32   int32
+	Int64   int64
+	Uint8   uint8
+	Uint16  uint16
+	Uint32  uint32
+	Uint64  uint64
+	Float32 float32
+	Float64 float64
+	String  string
+}
+
+type Ttest struct {
+	Inner1 Inner
+	Inner2 Inner
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/structs/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/structs/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..992f9b9c2d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/structs/zz_generated.deepcopy.go
@@ -0,0 +1,56 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package structs
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Inner) DeepCopyInto(out *Inner) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Inner.
+func (in *Inner) DeepCopy() *Inner {
+	if in == nil {
+		return nil
+	}
+	out := new(Inner)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Ttest) DeepCopyInto(out *Ttest) {
+	*out = *in
+	out.Inner1 = in.Inner1
+	out.Inner2 = in.Inner2
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Ttest.
+func (in *Ttest) DeepCopy() *Ttest {
+	if in == nil {
+		return nil
+	}
+	out := new(Ttest)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/value_fuzzer.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/value_fuzzer.go
new file mode 100644
index 0000000000..6104aa3cb1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/value_fuzzer.go
@@ -0,0 +1,86 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package outputtests
+
+import (
+	"reflect"
+)
+
+// ValueFuzz recursively changes all basic type values in an object. Any kind of references will not
+// be touched, i.e. the addresses of slices, maps, pointers will stay unchanged.
+func ValueFuzz(obj interface{}) {
+	valueFuzz(reflect.ValueOf(obj))
+}
+
+func valueFuzz(obj reflect.Value) {
+	switch obj.Kind() {
+	case reflect.Array:
+		for i := 0; i < obj.Len(); i++ {
+			valueFuzz(obj.Index(i))
+		}
+	case reflect.Slice:
+		if obj.IsNil() {
+			// TODO: set non-nil value
+		} else {
+			for i := 0; i < obj.Len(); i++ {
+				valueFuzz(obj.Index(i))
+			}
+		}
+	case reflect.Interface, reflect.Ptr:
+		if obj.IsNil() {
+			// TODO: set non-nil value
+		} else {
+			valueFuzz(obj.Elem())
+		}
+	case reflect.Struct:
+		for i, n := 0, obj.NumField(); i < n; i++ {
+			valueFuzz(obj.Field(i))
+		}
+	case reflect.Map:
+		if obj.IsNil() {
+			// TODO: set non-nil value
+		} else {
+			for _, k := range obj.MapKeys() {
+				// map values are not addressable. We need a copy.
+				v := obj.MapIndex(k)
+				copy := reflect.New(v.Type())
+				copy.Elem().Set(v)
+				valueFuzz(copy.Elem())
+				obj.SetMapIndex(k, copy.Elem())
+			}
+			// TODO: set some new value
+		}
+	case reflect.Func: // ignore, we don't have function types in our API
+	default:
+		if !obj.CanSet() {
+			return
+		}
+		switch obj.Kind() {
+		case reflect.String:
+			obj.SetString(obj.String() + "x")
+		case reflect.Bool:
+			obj.SetBool(!obj.Bool())
+		case reflect.Float32, reflect.Float64:
+			obj.SetFloat(obj.Float()*2.0 + 1.0)
+		case reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64, reflect.Int:
+			obj.SetInt(obj.Int() + 1)
+		case reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uint:
+			obj.SetUint(obj.Uint() + 1)
+		default:
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/a.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/a.go
new file mode 100644
index 0000000000..fbebe86424
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/a.go
@@ -0,0 +1,171 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wholepkg
+
+import "k8s.io/code-generator/cmd/deepcopy-gen/output_tests/otherpkg"
+
+// Trivial
+type StructEmpty struct{}
+
+// Only primitives
+type StructPrimitives struct {
+	BoolField   bool
+	IntField    int
+	StringField string
+	FloatField  float64
+}
+type StructPrimitivesAlias StructPrimitives
+type StructEmbedStructPrimitives struct {
+	StructPrimitives
+}
+type StructEmbedInt struct {
+	int //nolint:unused
+}
+type StructStructPrimitives struct {
+	StructField StructPrimitives
+}
+
+// Manual DeepCopy method
+type ManualStruct struct {
+	StringField string
+}
+
+func (m ManualStruct) DeepCopy() ManualStruct {
+	return m
+}
+
+type ManualStructAlias ManualStruct
+
+type StructEmbedManualStruct struct {
+	ManualStruct
+}
+
+// Only pointers to primitives
+type StructPrimitivePointers struct {
+	BoolPtrField   *bool
+	IntPtrField    *int
+	StringPtrField *string
+	FloatPtrField  *float64
+}
+type StructPrimitivePointersAlias StructPrimitivePointers
+type StructEmbedStructPrimitivePointers struct {
+	StructPrimitivePointers
+}
+type StructEmbedPointer struct {
+	*int
+}
+type StructStructPrimitivePointers struct {
+	StructField StructPrimitivePointers
+}
+
+// Manual DeepCopy method
+type ManualSlice []string
+
+func (m ManualSlice) DeepCopy() ManualSlice {
+	r := make(ManualSlice, len(m))
+	copy(r, m)
+	return r
+}
+
+// Slices
+type StructSlices struct {
+	SliceBoolField                         []bool
+	SliceByteField                         []byte
+	SliceIntField                          []int
+	SliceStringField                       []string
+	SliceFloatField                        []float64
+	SliceStructPrimitivesField             []StructPrimitives
+	SliceStructPrimitivesAliasField        []StructPrimitivesAlias
+	SliceStructPrimitivePointersField      []StructPrimitivePointers
+	SliceStructPrimitivePointersAliasField []StructPrimitivePointersAlias
+	SliceSliceIntField                     [][]int
+	SliceManualStructField                 []ManualStruct
+	ManualSliceField                       ManualSlice
+}
+type StructSlicesAlias StructSlices
+type StructEmbedStructSlices struct {
+	StructSlices
+}
+type StructStructSlices struct {
+	StructField StructSlices
+}
+
+// Everything
+type StructEverything struct {
+	BoolField                 bool
+	IntField                  int
+	StringField               string
+	FloatField                float64
+	StructField               StructPrimitives
+	EmptyStructField          StructEmpty
+	ManualStructField         ManualStruct
+	ManualStructAliasField    ManualStructAlias
+	BoolPtrField              *bool
+	IntPtrField               *int
+	StringPtrField            *string
+	FloatPtrField             *float64
+	PrimitivePointersField    StructPrimitivePointers
+	ManualStructPtrField      *ManualStruct
+	ManualStructAliasPtrField *ManualStructAlias
+	SliceBoolField            []bool
+	SliceByteField            []byte
+	SliceIntField             []int
+	SliceStringField          []string
+	SliceFloatField           []float64
+	SlicesField               StructSlices
+	SliceManualStructField    []ManualStruct
+	ManualSliceField          ManualSlice
+}
+
+// An Object
+// +k8s:deepcopy-gen:interfaces=k8s.io/code-generator/cmd/deepcopy-gen/output_tests/otherpkg.Object
+type StructExplicitObject struct {
+	x int //nolint:unused
+}
+
+// An Object which is used a non-pointer
+// +k8s:deepcopy-gen:interfaces=k8s.io/code-generator/cmd/deepcopy-gen/output_tests/otherpkg.Object
+// +k8s:deepcopy-gen:nonpointer-interfaces=true
+type StructNonPointerExplicitObject struct {
+	x int //nolint:unused
+}
+
+// +k8s:deepcopy-gen=false
+type StructTypeMeta struct {
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/code-generator/cmd/deepcopy-gen/output_tests/otherpkg.Object
+// +k8s:deepcopy-gen:interfaces=k8s.io/code-generator/cmd/deepcopy-gen/output_tests/otherpkg.List
+type StructObjectAndList struct {
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/code-generator/cmd/deepcopy-gen/output_tests/otherpkg.Object
+// +k8s:deepcopy-gen:interfaces=k8s.io/code-generator/cmd/deepcopy-gen/output_tests/otherpkg.Object
+type StructObjectAndObject struct {
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg.Selector
+// +k8s:deepcopy-gen:interfaces=k8s.io/code-generator/cmd/deepcopy-gen/output_tests/otherpkg.Object
+type StructExplicitSelectorExplicitObject struct {
+	StructTypeMeta
+}
+
+type StructInterfaces struct {
+	ObjectField    otherpkg.Object
+	NilObjectField otherpkg.Object
+	SelectorField  Selector
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/b.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/b.go
new file mode 100644
index 0000000000..3eb8c01fc8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/b.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wholepkg
+
+// Another type in another file.
+type StructB struct{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/deepcopy_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/deepcopy_test.go
new file mode 100644
index 0000000000..0f66a1d0d0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/deepcopy_test.go
@@ -0,0 +1,145 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wholepkg
+
+import (
+	"reflect"
+	"testing"
+
+	"sigs.k8s.io/randfill"
+)
+
+func TestDeepCopyPrimitives(t *testing.T) {
+	x := StructPrimitives{}
+	y := StructPrimitives{}
+
+	if !reflect.DeepEqual(&x, &y) {
+		t.Errorf("objects should be equal to start, but are not")
+	}
+
+	fuzzer := randfill.New()
+	fuzzer.Fill(&x)
+	fuzzer.Fill(&y)
+
+	if reflect.DeepEqual(&x, &y) {
+		t.Errorf("objects should not be equal, but are")
+	}
+
+	x.DeepCopyInto(&y)
+	if !reflect.DeepEqual(&x, &y) {
+		t.Errorf("objects should be equal, but are not")
+	}
+}
+
+func TestDeepCopyInterfaceFields(t *testing.T) {
+	x := StructInterfaces{}
+	y := StructInterfaces{}
+
+	if !reflect.DeepEqual(&x, &y) {
+		t.Errorf("objects should be equal to start, but are not")
+	}
+
+	fuzzer := randfill.New()
+
+	obj := StructExplicitObject{}
+	fuzzer.Fill(&obj)
+	x.ObjectField = &obj
+
+	sel := StructExplicitSelectorExplicitObject{}
+	fuzzer.Fill(&sel)
+	x.SelectorField = &sel
+
+	if reflect.DeepEqual(&x, &y) {
+		t.Errorf("objects should not be equal, but are")
+	}
+
+	x.DeepCopyInto(&y)
+	if !reflect.DeepEqual(&x, &y) {
+		t.Errorf("objects should be equal, but are not")
+	}
+}
+
+func TestNilCopy(t *testing.T) {
+	var x *StructB
+	y := x.DeepCopy()
+	if y != nil {
+		t.Errorf("Expected nil as deepcopy of nil, got %+v", y)
+	}
+}
+
+func assertMethod(t *testing.T, typ reflect.Type, name string) {
+	if _, found := typ.MethodByName(name); !found {
+		t.Errorf("StructExplicitObject must have %v method", name)
+	}
+}
+
+func assertNotMethod(t *testing.T, typ reflect.Type, name string) {
+	if _, found := typ.MethodByName(name); found {
+		t.Errorf("%v must not have %v method", typ, name)
+	}
+}
+
+func TestInterfaceTypes(t *testing.T) {
+	explicitObject := reflect.TypeOf(&StructExplicitObject{})
+	assertMethod(t, explicitObject, "DeepCopyObject")
+
+	typeMeta := reflect.TypeOf(&StructTypeMeta{})
+	assertNotMethod(t, typeMeta, "DeepCopy")
+
+	objectAndList := reflect.TypeOf(&StructObjectAndList{})
+	assertMethod(t, objectAndList, "DeepCopyObject")
+	assertMethod(t, objectAndList, "DeepCopyList")
+
+	objectAndObject := reflect.TypeOf(&StructObjectAndObject{})
+	assertMethod(t, objectAndObject, "DeepCopyObject")
+
+	explicitSelectorExplicitObject := reflect.TypeOf(&StructExplicitSelectorExplicitObject{})
+	assertMethod(t, explicitSelectorExplicitObject, "DeepCopySelector")
+	assertMethod(t, explicitSelectorExplicitObject, "DeepCopyObject")
+}
+
+func TestInterfaceDeepCopy(t *testing.T) {
+	x := StructExplicitObject{}
+
+	fuzzer := randfill.New()
+	fuzzer.Fill(&x)
+
+	yObj := x.DeepCopyObject()
+	y, ok := yObj.(*StructExplicitObject)
+	if !ok {
+		t.Fatalf("epxected StructExplicitObject from StructExplicitObject.DeepCopyObject, got: %t", yObj)
+	}
+	if !reflect.DeepEqual(y, &x) {
+		t.Error("objects should be equal, but are not")
+	}
+}
+
+func TestInterfaceNonPointerDeepCopy(t *testing.T) {
+	x := StructNonPointerExplicitObject{}
+
+	fuzzer := randfill.New()
+	fuzzer.Fill(&x)
+
+	yObj := x.DeepCopyObject()
+	y, ok := yObj.(StructNonPointerExplicitObject)
+	if !ok {
+		t.Fatalf("epxected StructNonPointerExplicitObject from StructNonPointerExplicitObject.DeepCopyObject, got: %t", yObj)
+	}
+	if !reflect.DeepEqual(y, x) {
+		t.Error("objects should be equal, but are not")
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/doc.go
new file mode 100644
index 0000000000..10399986f8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+
+// This is a test package.
+package wholepkg
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/interfaces.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/interfaces.go
new file mode 100644
index 0000000000..e5b3c7de40
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/interfaces.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wholepkg
+
+type Selector interface {
+	DeepCopySelector() Selector
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..0c7b4699e2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/deepcopy-gen/output_tests/wholepkg/zz_generated.deepcopy.go
@@ -0,0 +1,761 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package wholepkg
+
+import (
+	otherpkg "k8s.io/code-generator/cmd/deepcopy-gen/output_tests/otherpkg"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in ManualSlice) DeepCopyInto(out *ManualSlice) {
+	{
+		in := &in
+		*out = in.DeepCopy()
+		return
+	}
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ManualStruct) DeepCopyInto(out *ManualStruct) {
+	*out = in.DeepCopy()
+	return
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ManualStructAlias) DeepCopyInto(out *ManualStructAlias) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManualStructAlias.
+func (in *ManualStructAlias) DeepCopy() *ManualStructAlias {
+	if in == nil {
+		return nil
+	}
+	out := new(ManualStructAlias)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructB) DeepCopyInto(out *StructB) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructB.
+func (in *StructB) DeepCopy() *StructB {
+	if in == nil {
+		return nil
+	}
+	out := new(StructB)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructEmbedInt) DeepCopyInto(out *StructEmbedInt) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructEmbedInt.
+func (in *StructEmbedInt) DeepCopy() *StructEmbedInt {
+	if in == nil {
+		return nil
+	}
+	out := new(StructEmbedInt)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructEmbedManualStruct) DeepCopyInto(out *StructEmbedManualStruct) {
+	*out = *in
+	out.ManualStruct = in.ManualStruct.DeepCopy()
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructEmbedManualStruct.
+func (in *StructEmbedManualStruct) DeepCopy() *StructEmbedManualStruct {
+	if in == nil {
+		return nil
+	}
+	out := new(StructEmbedManualStruct)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructEmbedPointer) DeepCopyInto(out *StructEmbedPointer) {
+	*out = *in
+	if in.int != nil {
+		in, out := &in.int, &out.int
+		*out = new(int)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructEmbedPointer.
+func (in *StructEmbedPointer) DeepCopy() *StructEmbedPointer {
+	if in == nil {
+		return nil
+	}
+	out := new(StructEmbedPointer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructEmbedStructPrimitivePointers) DeepCopyInto(out *StructEmbedStructPrimitivePointers) {
+	*out = *in
+	in.StructPrimitivePointers.DeepCopyInto(&out.StructPrimitivePointers)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructEmbedStructPrimitivePointers.
+func (in *StructEmbedStructPrimitivePointers) DeepCopy() *StructEmbedStructPrimitivePointers {
+	if in == nil {
+		return nil
+	}
+	out := new(StructEmbedStructPrimitivePointers)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructEmbedStructPrimitives) DeepCopyInto(out *StructEmbedStructPrimitives) {
+	*out = *in
+	out.StructPrimitives = in.StructPrimitives
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructEmbedStructPrimitives.
+func (in *StructEmbedStructPrimitives) DeepCopy() *StructEmbedStructPrimitives {
+	if in == nil {
+		return nil
+	}
+	out := new(StructEmbedStructPrimitives)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructEmbedStructSlices) DeepCopyInto(out *StructEmbedStructSlices) {
+	*out = *in
+	in.StructSlices.DeepCopyInto(&out.StructSlices)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructEmbedStructSlices.
+func (in *StructEmbedStructSlices) DeepCopy() *StructEmbedStructSlices {
+	if in == nil {
+		return nil
+	}
+	out := new(StructEmbedStructSlices)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructEmpty) DeepCopyInto(out *StructEmpty) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructEmpty.
+func (in *StructEmpty) DeepCopy() *StructEmpty {
+	if in == nil {
+		return nil
+	}
+	out := new(StructEmpty)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructEverything) DeepCopyInto(out *StructEverything) {
+	*out = *in
+	out.StructField = in.StructField
+	out.EmptyStructField = in.EmptyStructField
+	out.ManualStructField = in.ManualStructField.DeepCopy()
+	out.ManualStructAliasField = in.ManualStructAliasField
+	if in.BoolPtrField != nil {
+		in, out := &in.BoolPtrField, &out.BoolPtrField
+		*out = new(bool)
+		**out = **in
+	}
+	if in.IntPtrField != nil {
+		in, out := &in.IntPtrField, &out.IntPtrField
+		*out = new(int)
+		**out = **in
+	}
+	if in.StringPtrField != nil {
+		in, out := &in.StringPtrField, &out.StringPtrField
+		*out = new(string)
+		**out = **in
+	}
+	if in.FloatPtrField != nil {
+		in, out := &in.FloatPtrField, &out.FloatPtrField
+		*out = new(float64)
+		**out = **in
+	}
+	in.PrimitivePointersField.DeepCopyInto(&out.PrimitivePointersField)
+	if in.ManualStructPtrField != nil {
+		in, out := &in.ManualStructPtrField, &out.ManualStructPtrField
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	if in.ManualStructAliasPtrField != nil {
+		in, out := &in.ManualStructAliasPtrField, &out.ManualStructAliasPtrField
+		*out = new(ManualStructAlias)
+		**out = **in
+	}
+	if in.SliceBoolField != nil {
+		in, out := &in.SliceBoolField, &out.SliceBoolField
+		*out = make([]bool, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceByteField != nil {
+		in, out := &in.SliceByteField, &out.SliceByteField
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceIntField != nil {
+		in, out := &in.SliceIntField, &out.SliceIntField
+		*out = make([]int, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceStringField != nil {
+		in, out := &in.SliceStringField, &out.SliceStringField
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceFloatField != nil {
+		in, out := &in.SliceFloatField, &out.SliceFloatField
+		*out = make([]float64, len(*in))
+		copy(*out, *in)
+	}
+	in.SlicesField.DeepCopyInto(&out.SlicesField)
+	if in.SliceManualStructField != nil {
+		in, out := &in.SliceManualStructField, &out.SliceManualStructField
+		*out = make([]ManualStruct, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	out.ManualSliceField = in.ManualSliceField.DeepCopy()
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructEverything.
+func (in *StructEverything) DeepCopy() *StructEverything {
+	if in == nil {
+		return nil
+	}
+	out := new(StructEverything)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructExplicitObject) DeepCopyInto(out *StructExplicitObject) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructExplicitObject.
+func (in *StructExplicitObject) DeepCopy() *StructExplicitObject {
+	if in == nil {
+		return nil
+	}
+	out := new(StructExplicitObject)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new otherpkg.Object.
+func (in *StructExplicitObject) DeepCopyObject() otherpkg.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructExplicitSelectorExplicitObject) DeepCopyInto(out *StructExplicitSelectorExplicitObject) {
+	*out = *in
+	out.StructTypeMeta = in.StructTypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructExplicitSelectorExplicitObject.
+func (in *StructExplicitSelectorExplicitObject) DeepCopy() *StructExplicitSelectorExplicitObject {
+	if in == nil {
+		return nil
+	}
+	out := new(StructExplicitSelectorExplicitObject)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new otherpkg.Object.
+func (in *StructExplicitSelectorExplicitObject) DeepCopyObject() otherpkg.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopySelector is an autogenerated deepcopy function, copying the receiver, creating a new Selector.
+func (in *StructExplicitSelectorExplicitObject) DeepCopySelector() Selector {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructInterfaces) DeepCopyInto(out *StructInterfaces) {
+	*out = *in
+	if in.ObjectField != nil {
+		out.ObjectField = in.ObjectField.DeepCopyObject()
+	}
+	if in.NilObjectField != nil {
+		out.NilObjectField = in.NilObjectField.DeepCopyObject()
+	}
+	if in.SelectorField != nil {
+		out.SelectorField = in.SelectorField.DeepCopySelector()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructInterfaces.
+func (in *StructInterfaces) DeepCopy() *StructInterfaces {
+	if in == nil {
+		return nil
+	}
+	out := new(StructInterfaces)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructNonPointerExplicitObject) DeepCopyInto(out *StructNonPointerExplicitObject) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructNonPointerExplicitObject.
+func (in *StructNonPointerExplicitObject) DeepCopy() *StructNonPointerExplicitObject {
+	if in == nil {
+		return nil
+	}
+	out := new(StructNonPointerExplicitObject)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new otherpkg.Object.
+func (in StructNonPointerExplicitObject) DeepCopyObject() otherpkg.Object {
+	return *in.DeepCopy()
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructObjectAndList) DeepCopyInto(out *StructObjectAndList) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructObjectAndList.
+func (in *StructObjectAndList) DeepCopy() *StructObjectAndList {
+	if in == nil {
+		return nil
+	}
+	out := new(StructObjectAndList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyList is an autogenerated deepcopy function, copying the receiver, creating a new otherpkg.List.
+func (in *StructObjectAndList) DeepCopyList() otherpkg.List {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new otherpkg.Object.
+func (in *StructObjectAndList) DeepCopyObject() otherpkg.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructObjectAndObject) DeepCopyInto(out *StructObjectAndObject) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructObjectAndObject.
+func (in *StructObjectAndObject) DeepCopy() *StructObjectAndObject {
+	if in == nil {
+		return nil
+	}
+	out := new(StructObjectAndObject)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new otherpkg.Object.
+func (in *StructObjectAndObject) DeepCopyObject() otherpkg.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructPrimitivePointers) DeepCopyInto(out *StructPrimitivePointers) {
+	*out = *in
+	if in.BoolPtrField != nil {
+		in, out := &in.BoolPtrField, &out.BoolPtrField
+		*out = new(bool)
+		**out = **in
+	}
+	if in.IntPtrField != nil {
+		in, out := &in.IntPtrField, &out.IntPtrField
+		*out = new(int)
+		**out = **in
+	}
+	if in.StringPtrField != nil {
+		in, out := &in.StringPtrField, &out.StringPtrField
+		*out = new(string)
+		**out = **in
+	}
+	if in.FloatPtrField != nil {
+		in, out := &in.FloatPtrField, &out.FloatPtrField
+		*out = new(float64)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructPrimitivePointers.
+func (in *StructPrimitivePointers) DeepCopy() *StructPrimitivePointers {
+	if in == nil {
+		return nil
+	}
+	out := new(StructPrimitivePointers)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructPrimitivePointersAlias) DeepCopyInto(out *StructPrimitivePointersAlias) {
+	*out = *in
+	if in.BoolPtrField != nil {
+		in, out := &in.BoolPtrField, &out.BoolPtrField
+		*out = new(bool)
+		**out = **in
+	}
+	if in.IntPtrField != nil {
+		in, out := &in.IntPtrField, &out.IntPtrField
+		*out = new(int)
+		**out = **in
+	}
+	if in.StringPtrField != nil {
+		in, out := &in.StringPtrField, &out.StringPtrField
+		*out = new(string)
+		**out = **in
+	}
+	if in.FloatPtrField != nil {
+		in, out := &in.FloatPtrField, &out.FloatPtrField
+		*out = new(float64)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructPrimitivePointersAlias.
+func (in *StructPrimitivePointersAlias) DeepCopy() *StructPrimitivePointersAlias {
+	if in == nil {
+		return nil
+	}
+	out := new(StructPrimitivePointersAlias)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructPrimitives) DeepCopyInto(out *StructPrimitives) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructPrimitives.
+func (in *StructPrimitives) DeepCopy() *StructPrimitives {
+	if in == nil {
+		return nil
+	}
+	out := new(StructPrimitives)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructPrimitivesAlias) DeepCopyInto(out *StructPrimitivesAlias) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructPrimitivesAlias.
+func (in *StructPrimitivesAlias) DeepCopy() *StructPrimitivesAlias {
+	if in == nil {
+		return nil
+	}
+	out := new(StructPrimitivesAlias)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructSlices) DeepCopyInto(out *StructSlices) {
+	*out = *in
+	if in.SliceBoolField != nil {
+		in, out := &in.SliceBoolField, &out.SliceBoolField
+		*out = make([]bool, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceByteField != nil {
+		in, out := &in.SliceByteField, &out.SliceByteField
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceIntField != nil {
+		in, out := &in.SliceIntField, &out.SliceIntField
+		*out = make([]int, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceStringField != nil {
+		in, out := &in.SliceStringField, &out.SliceStringField
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceFloatField != nil {
+		in, out := &in.SliceFloatField, &out.SliceFloatField
+		*out = make([]float64, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceStructPrimitivesField != nil {
+		in, out := &in.SliceStructPrimitivesField, &out.SliceStructPrimitivesField
+		*out = make([]StructPrimitives, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceStructPrimitivesAliasField != nil {
+		in, out := &in.SliceStructPrimitivesAliasField, &out.SliceStructPrimitivesAliasField
+		*out = make([]StructPrimitivesAlias, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceStructPrimitivePointersField != nil {
+		in, out := &in.SliceStructPrimitivePointersField, &out.SliceStructPrimitivePointersField
+		*out = make([]StructPrimitivePointers, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.SliceStructPrimitivePointersAliasField != nil {
+		in, out := &in.SliceStructPrimitivePointersAliasField, &out.SliceStructPrimitivePointersAliasField
+		*out = make([]StructPrimitivePointersAlias, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.SliceSliceIntField != nil {
+		in, out := &in.SliceSliceIntField, &out.SliceSliceIntField
+		*out = make([][]int, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = make([]int, len(*in))
+				copy(*out, *in)
+			}
+		}
+	}
+	if in.SliceManualStructField != nil {
+		in, out := &in.SliceManualStructField, &out.SliceManualStructField
+		*out = make([]ManualStruct, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	out.ManualSliceField = in.ManualSliceField.DeepCopy()
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructSlices.
+func (in *StructSlices) DeepCopy() *StructSlices {
+	if in == nil {
+		return nil
+	}
+	out := new(StructSlices)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructSlicesAlias) DeepCopyInto(out *StructSlicesAlias) {
+	*out = *in
+	if in.SliceBoolField != nil {
+		in, out := &in.SliceBoolField, &out.SliceBoolField
+		*out = make([]bool, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceByteField != nil {
+		in, out := &in.SliceByteField, &out.SliceByteField
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceIntField != nil {
+		in, out := &in.SliceIntField, &out.SliceIntField
+		*out = make([]int, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceStringField != nil {
+		in, out := &in.SliceStringField, &out.SliceStringField
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceFloatField != nil {
+		in, out := &in.SliceFloatField, &out.SliceFloatField
+		*out = make([]float64, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceStructPrimitivesField != nil {
+		in, out := &in.SliceStructPrimitivesField, &out.SliceStructPrimitivesField
+		*out = make([]StructPrimitives, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceStructPrimitivesAliasField != nil {
+		in, out := &in.SliceStructPrimitivesAliasField, &out.SliceStructPrimitivesAliasField
+		*out = make([]StructPrimitivesAlias, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceStructPrimitivePointersField != nil {
+		in, out := &in.SliceStructPrimitivePointersField, &out.SliceStructPrimitivePointersField
+		*out = make([]StructPrimitivePointers, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.SliceStructPrimitivePointersAliasField != nil {
+		in, out := &in.SliceStructPrimitivePointersAliasField, &out.SliceStructPrimitivePointersAliasField
+		*out = make([]StructPrimitivePointersAlias, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.SliceSliceIntField != nil {
+		in, out := &in.SliceSliceIntField, &out.SliceSliceIntField
+		*out = make([][]int, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = make([]int, len(*in))
+				copy(*out, *in)
+			}
+		}
+	}
+	if in.SliceManualStructField != nil {
+		in, out := &in.SliceManualStructField, &out.SliceManualStructField
+		*out = make([]ManualStruct, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	out.ManualSliceField = in.ManualSliceField.DeepCopy()
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructSlicesAlias.
+func (in *StructSlicesAlias) DeepCopy() *StructSlicesAlias {
+	if in == nil {
+		return nil
+	}
+	out := new(StructSlicesAlias)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructStructPrimitivePointers) DeepCopyInto(out *StructStructPrimitivePointers) {
+	*out = *in
+	in.StructField.DeepCopyInto(&out.StructField)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructStructPrimitivePointers.
+func (in *StructStructPrimitivePointers) DeepCopy() *StructStructPrimitivePointers {
+	if in == nil {
+		return nil
+	}
+	out := new(StructStructPrimitivePointers)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructStructPrimitives) DeepCopyInto(out *StructStructPrimitives) {
+	*out = *in
+	out.StructField = in.StructField
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructStructPrimitives.
+func (in *StructStructPrimitives) DeepCopy() *StructStructPrimitives {
+	if in == nil {
+		return nil
+	}
+	out := new(StructStructPrimitives)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructStructSlices) DeepCopyInto(out *StructStructSlices) {
+	*out = *in
+	in.StructField.DeepCopyInto(&out.StructField)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructStructSlices.
+func (in *StructStructSlices) DeepCopy() *StructStructSlices {
+	if in == nil {
+		return nil
+	}
+	out := new(StructStructSlices)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/args/args.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/args/args.go
new file mode 100644
index 0000000000..1163a2bd28
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/args/args.go
@@ -0,0 +1,71 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package args
+
+import (
+	"fmt"
+
+	"github.com/spf13/pflag"
+
+	"k8s.io/code-generator/pkg/apidefinitions"
+	"k8s.io/gengo/v2"
+)
+
+type Args struct {
+	OutputFile    string
+	ExtraPeerDirs []string // Always consider these as last-ditch possibilities for conversions.
+	GoHeaderFile  string
+
+	// GeneratedBuildTag is the tag used to identify code generated by execution
+	// of this type. Each generator should use a different tag, and different
+	// groups of generators (external API that depends on Kube generations) should
+	// keep tags distinct as well.
+	GeneratedBuildTag string
+
+	apidefinitions.LintArgs
+}
+
+// New returns default arguments for the generator.
+func New() *Args {
+	return &Args{
+		GeneratedBuildTag: gengo.StdBuildTag,
+	}
+}
+
+// AddFlags add the generator flags to the flag set.
+func (args *Args) AddFlags(fs *pflag.FlagSet) {
+	fs.StringVar(&args.OutputFile, "output-file", "generated.defaults.go",
+		"the name of the file to be generated")
+	fs.StringSliceVar(&args.ExtraPeerDirs, "extra-peer-dirs", args.ExtraPeerDirs,
+		"Comma-separated list of import paths which are considered, after tag-specified peers, for conversions.")
+	fs.StringVar(&args.GoHeaderFile, "go-header-file", "",
+		"the path to a file containing boilerplate header text; the string \"YEAR\" will be replaced with the current 4-digit year")
+	fs.StringVar(&args.GeneratedBuildTag, "build-tag", args.GeneratedBuildTag, "A Go build tag to use to identify files generated by this command. Should be unique.")
+	apidefinitions.AddFlags(&args.LintArgs, fs)
+}
+
+// Validate checks the given arguments.
+func (args *Args) Validate() error {
+	if len(args.OutputFile) == 0 {
+		return fmt.Errorf("--output-file must be specified")
+	}
+	if err := apidefinitions.ValidateFlags(args.LintRules); err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/generators/defaulter.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/generators/defaulter.go
new file mode 100644
index 0000000000..488f88714e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/generators/defaulter.go
@@ -0,0 +1,1294 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"path"
+	"reflect"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"k8s.io/code-generator/cmd/defaulter-gen/args"
+	"k8s.io/code-generator/pkg/apidefinitions"
+	genutil "k8s.io/code-generator/pkg/util"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/klog/v2"
+)
+
+var typeZeroValue = map[string]interface{}{
+	"uint":        0.,
+	"uint8":       0.,
+	"uint16":      0.,
+	"uint32":      0.,
+	"uint64":      0.,
+	"int":         0.,
+	"int8":        0.,
+	"int16":       0.,
+	"int32":       0.,
+	"int64":       0.,
+	"byte":        0.,
+	"float64":     0.,
+	"float32":     0.,
+	"bool":        false,
+	"time.Time":   "",
+	"string":      "",
+	"integer":     0.,
+	"number":      0.,
+	"boolean":     false,
+	"[]byte":      "", // base64 encoded characters
+	"interface{}": interface{}(nil),
+}
+
+// These are the comment tags that carry parameters for defaulter generation.
+const tagName = "k8s:defaulter-gen"
+const defaultTagName = "default"
+
+func extractDefaultTag(comments []string) ([]string, error) {
+	tags, err := genutil.ExtractCommentTagsWithoutArguments("+", []string{defaultTagName}, comments)
+	if err != nil {
+		return nil, err
+	}
+	return tags[defaultTagName], nil
+}
+
+func extractTag(comments []string) ([]string, bool) {
+	tags, err := genutil.ExtractCommentTagsWithoutArguments("+", []string{tagName}, comments)
+	if err != nil {
+		klog.Fatalf("Error extracting %s tag: %v", tagName, err)
+	}
+
+	values, found := tags[tagName]
+	if !found || len(values) == 0 {
+		return nil, false
+	}
+
+	return values, true
+}
+
+// defaulterMatchType returns the values to be defaulted for pkg, or false
+// if defaulter-gen should not run.
+func defaulterMatchType(pkg *types.Package, idOpts []apidefinitions.Option) ([]string, bool) {
+	info, err := apidefinitions.Identify(pkg, apidefinitions.Defaulter, idOpts...)
+	if err != nil {
+		klog.Fatal(err)
+	}
+	if !info.ShouldGenerate() {
+		return nil, false
+	}
+	return info.TypeFilters(), true
+}
+
+func checkTag(comments []string, require ...string) (bool, error) {
+	tags, err := genutil.ExtractCommentTagsWithoutArguments("+", []string{tagName}, comments)
+	if err != nil {
+		return false, err
+	}
+
+	if len(require) == 0 {
+		return len(tags[tagName]) == 1 && tags[tagName][0] == "", nil
+	}
+	return reflect.DeepEqual(tags[tagName], require), nil
+}
+
+func defaultFnNamer() *namer.NameStrategy {
+	return &namer.NameStrategy{
+		Prefix: "SetDefaults_",
+		Join: func(pre string, in []string, post string) string {
+			return pre + strings.Join(in, "_") + post
+		},
+	}
+}
+
+func objectDefaultFnNamer() *namer.NameStrategy {
+	return &namer.NameStrategy{
+		Prefix: "SetObjectDefaults_",
+		Join: func(pre string, in []string, post string) string {
+			return pre + strings.Join(in, "_") + post
+		},
+	}
+}
+
+// NameSystems returns the name system used by the generators in this package.
+func NameSystems() namer.NameSystems {
+	return namer.NameSystems{
+		"public":          namer.NewPublicNamer(1),
+		"raw":             namer.NewRawNamer("", nil),
+		"defaultfn":       defaultFnNamer(),
+		"objectdefaultfn": objectDefaultFnNamer(),
+	}
+}
+
+// DefaultNameSystem returns the default name system for ordering the types to be
+// processed by the generators in this package.
+func DefaultNameSystem() string {
+	return "public"
+}
+
+// defaults holds the declared defaulting functions for a given type (all defaulting functions
+// are expected to be func(1))
+type defaults struct {
+	// object is the defaulter function for a top level type (typically one with TypeMeta) that
+	// invokes all child defaulters. May be nil if the object defaulter has not yet been generated.
+	object *types.Type
+	// base is a defaulter function defined for a type SetDefaults_Pod which does not invoke all
+	// child defaults - the base defaulter alone is insufficient to default a type
+	base *types.Type
+	// additional is zero or more defaulter functions of the form SetDefaults_Pod_XXXX that can be
+	// included in the Object defaulter.
+	additional []*types.Type
+}
+
+// All of the types in conversions map are of type "DeclarationOf" with
+// the underlying type being "Func".
+type defaulterFuncMap map[*types.Type]defaults
+
+// Returns all manually-defined defaulting functions in the package.
+func getManualDefaultingFunctions(context *generator.Context, pkg *types.Package, manualMap defaulterFuncMap) {
+	buffer := &bytes.Buffer{}
+	sw := generator.NewSnippetWriter(buffer, context, "$", "$")
+
+	for _, f := range pkg.Functions {
+		if f.Underlying == nil || f.Underlying.Kind != types.Func {
+			klog.Errorf("Malformed function: %#v", f)
+			continue
+		}
+		if f.Underlying.Signature == nil {
+			klog.Errorf("Function without signature: %#v", f)
+			continue
+		}
+		signature := f.Underlying.Signature
+		// Check whether the function is defaulting function.
+		// Note that all of them have signature:
+		// object: func SetObjectDefaults_inType(*inType)
+		// base: func SetDefaults_inType(*inType)
+		// additional: func SetDefaults_inType_Qualifier(*inType)
+		if signature.Receiver != nil {
+			continue
+		}
+		if len(signature.Parameters) != 1 {
+			continue
+		}
+		if len(signature.Results) != 0 {
+			continue
+		}
+		inType := signature.Parameters[0].Type
+		if inType.Kind != types.Pointer {
+			continue
+		}
+		// Check if this is the primary defaulter.
+		args := defaultingArgsFromType(inType.Elem)
+		sw.Do("$.inType|defaultfn$", args)
+		switch {
+		case f.Name.Name == buffer.String():
+			key := inType.Elem
+			// We might scan the same package twice, and that's OK.
+			v, ok := manualMap[key]
+			if ok && v.base != nil && v.base.Name.Package != pkg.Path {
+				panic(fmt.Sprintf("duplicate static defaulter defined: %#v", key))
+			}
+			v.base = f
+			manualMap[key] = v
+			klog.V(6).Infof("found base defaulter function for %s from %s", key.Name, f.Name)
+		// Is one of the additional defaulters - a top level defaulter on a type that is
+		// also invoked.
+		case strings.HasPrefix(f.Name.Name, buffer.String()+"_"):
+			key := inType.Elem
+			v, ok := manualMap[key]
+			if ok {
+				exists := false
+				for _, existing := range v.additional {
+					if existing.Name == f.Name {
+						exists = true
+						break
+					}
+				}
+				if exists {
+					continue
+				}
+			}
+			v.additional = append(v.additional, f)
+			manualMap[key] = v
+			klog.V(6).Infof("found additional defaulter function for %s from %s", key.Name, f.Name)
+		}
+		buffer.Reset()
+		sw.Do("$.inType|objectdefaultfn$", args)
+		if f.Name.Name == buffer.String() {
+			key := inType.Elem
+			// We might scan the same package twice, and that's OK.
+			v, ok := manualMap[key]
+			if ok && v.base != nil && v.base.Name.Package != pkg.Path {
+				panic(fmt.Sprintf("duplicate static defaulter defined: %#v", key))
+			}
+			v.object = f
+			manualMap[key] = v
+			klog.V(6).Infof("found object defaulter function for %s from %s", key.Name, f.Name)
+		}
+		buffer.Reset()
+	}
+}
+
+func GetTargets(context *generator.Context, args *args.Args) []generator.Target {
+	boilerplate, err := gengo.GoBoilerplate(args.GoHeaderFile, args.GeneratedBuildTag, gengo.StdGeneratedBy)
+	if err != nil {
+		klog.Fatalf("Failed loading boilerplate: %v", err)
+	}
+
+	var idOpts []apidefinitions.Option
+	if len(args.LintRules) > 0 {
+		idOpts = append(idOpts, apidefinitions.WithLintRules(args.LintRules...))
+	}
+
+	targetList := []generator.Target{}
+
+	// Accumulate pre-existing default functions.
+	// TODO: This is too ad-hoc.  We need a better way.
+	existingDefaulters := defaulterFuncMap{}
+
+	buffer := &bytes.Buffer{}
+	sw := generator.NewSnippetWriter(buffer, context, "$", "$")
+
+	// First load other "input" packages.  We do this as a single call because
+	// it is MUCH faster.
+	inputPkgs := make([]string, 0, len(context.Inputs))
+	pkgToInput := map[string]string{}
+	for _, i := range context.Inputs {
+		klog.V(5).Infof("considering pkg %q", i)
+		pkg := context.Universe[i]
+
+		info, err := apidefinitions.Identify(pkg, apidefinitions.Defaulter, idOpts...)
+		if err != nil {
+			klog.Fatal(err)
+		}
+		if !info.ShouldGenerate() {
+			continue
+		}
+
+		// +k8s:defaulter-gen-input may direct the generator at types in
+		// a different package than the one where defaulters will be emitted.
+		inputPath := info.ExternalTypes()
+		if inputPath != pkg.Path {
+			klog.V(5).Infof("  input pkg %v", inputPath)
+			inputPkgs = append(inputPkgs, inputPath)
+			pkgToInput[i] = inputPath
+		} else {
+			pkgToInput[i] = i
+		}
+	}
+
+	// Make sure explicit peer-packages are added.
+	var peerPkgs []string
+	for _, pkg := range args.ExtraPeerDirs {
+		// In case someone specifies a peer as a path into vendor, convert
+		// it to its "real" package path.
+		if i := strings.Index(pkg, "/vendor/"); i != -1 {
+			pkg = pkg[i+len("/vendor/"):]
+		}
+		peerPkgs = append(peerPkgs, pkg)
+	}
+	if expanded, err := context.FindPackages(peerPkgs...); err != nil {
+		klog.Fatalf("cannot find peer packages: %v", err)
+	} else {
+		peerPkgs = expanded // now in fully canonical form
+	}
+	inputPkgs = append(inputPkgs, peerPkgs...)
+
+	if len(inputPkgs) > 0 {
+		if _, err := context.LoadPackages(inputPkgs...); err != nil {
+			klog.Fatalf("cannot load packages: %v", err)
+		}
+	}
+	// update context.Order to the latest context.Universe
+	orderer := namer.Orderer{Namer: namer.NewPublicNamer(1)}
+	context.Order = orderer.OrderUniverse(context.Universe)
+
+	for _, i := range context.Inputs {
+		pkg := context.Universe[i]
+
+		// typesPkg is where the types that needs defaulter are defined.
+		// Sometimes it is different from pkg. For example, kubernetes core/v1
+		// types are defined in k8s.io/api/core/v1, while the pkg which holds
+		// defaulter code is at k/k/pkg/api/v1.
+		typesPkg := pkg
+
+		// Add defaulting functions.
+		getManualDefaultingFunctions(context, pkg, existingDefaulters)
+
+		// Also look for defaulting functions in peer-packages.
+		for _, pp := range peerPkgs {
+			getManualDefaultingFunctions(context, context.Universe[pp], existingDefaulters)
+		}
+
+		typesWith, found := defaulterMatchType(pkg, idOpts)
+		if !found {
+			klog.V(2).InfoS("  did not find required tag", "tag", tagName)
+			continue
+		}
+		shouldCreateObjectDefaulterFn := func(t *types.Type) bool {
+			if defaults, ok := existingDefaulters[t]; ok && defaults.object != nil {
+				// A default generator is defined
+				baseTypeName := "<unknown>"
+				if defaults.base != nil {
+					baseTypeName = defaults.base.Name.String()
+				}
+				klog.V(5).Infof("  an object defaulter already exists as %s", baseTypeName)
+				return false
+			}
+			// opt-out
+			optOut, err := checkTag(t.SecondClosestCommentLines, "false")
+			if err != nil {
+				klog.Fatalf("Error extracting %s tags: %v", tagName, err)
+			}
+			if optOut {
+				return false
+			}
+			// opt-in
+			optIn, err := checkTag(t.SecondClosestCommentLines, "true")
+			if err != nil {
+				klog.Fatalf("Error extracting %s tags: %v", tagName, err)
+			}
+			if optIn {
+				return true
+			}
+			// For every k8s:defaulter-gen tag at the package level, interpret the value as a
+			// field name (like TypeMeta, ListMeta, ObjectMeta) and trigger defaulter generation
+			// for any type with any of the matching field names. Provides a more useful package
+			// level defaulting than global (because we only need defaulters on a subset of objects -
+			// usually those with TypeMeta).
+			if t.Kind == types.Struct && len(typesWith) > 0 {
+				for _, field := range t.Members {
+					for _, s := range typesWith {
+						if field.Name == s {
+							return true
+						}
+					}
+				}
+			}
+			return false
+		}
+
+		// Find the right input pkg, which might not be this one.
+		inputPath := pkgToInput[i]
+		typesPkg = context.Universe[inputPath]
+
+		newDefaulters := defaulterFuncMap{}
+		for _, t := range typesPkg.Types {
+			if !shouldCreateObjectDefaulterFn(t) {
+				continue
+			}
+			if namer.IsPrivateGoName(t.Name.Name) {
+				// We won't be able to convert to a private type.
+				klog.V(5).Infof("  found a type %v, but it is a private name", t)
+				continue
+			}
+
+			// create a synthetic type we can use during generation
+			newDefaulters[t] = defaults{}
+		}
+
+		// only generate defaulters for objects that actually have defined defaulters
+		// prevents empty defaulters from being registered
+		for {
+			promoted := 0
+			for t, d := range newDefaulters {
+				if d.object != nil {
+					continue
+				}
+				if newCallTreeForType(existingDefaulters, newDefaulters).build(t, true) != nil {
+					args := defaultingArgsFromType(t)
+					sw.Do("$.inType|objectdefaultfn$", args)
+					newDefaulters[t] = defaults{
+						object: &types.Type{
+							Name: types.Name{
+								Package: pkg.Path,
+								Name:    buffer.String(),
+							},
+							Kind: types.Func,
+						},
+					}
+					buffer.Reset()
+					promoted++
+				}
+			}
+			if promoted != 0 {
+				continue
+			}
+
+			// prune any types that were not used
+			for t, d := range newDefaulters {
+				if d.object == nil {
+					klog.V(6).Infof("did not generate defaulter for %s because no child defaulters were registered", t.Name)
+					delete(newDefaulters, t)
+				}
+			}
+			break
+		}
+
+		if len(newDefaulters) == 0 {
+			klog.V(5).Infof("no defaulters in package %s", pkg.Name)
+			if _, hasTag := extractTag(pkg.Comments); !hasTag {
+				continue
+			}
+		}
+
+		targetList = append(targetList,
+			&generator.SimpleTarget{
+				PkgName:       path.Base(pkg.Path),
+				PkgPath:       pkg.Path,
+				PkgDir:        pkg.Dir, // output pkg is the same as the input
+				HeaderComment: boilerplate,
+
+				FilterFunc: func(c *generator.Context, t *types.Type) bool {
+					return t.Name.Package == typesPkg.Path
+				},
+
+				GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+					return []generator.Generator{
+						NewGenDefaulter(args.OutputFile, typesPkg.Path, pkg.Path, existingDefaulters, newDefaulters, peerPkgs),
+					}
+				},
+			})
+	}
+	return targetList
+}
+
+// callTreeForType contains fields necessary to build a tree for types.
+type callTreeForType struct {
+	existingDefaulters     defaulterFuncMap
+	newDefaulters          defaulterFuncMap
+	currentlyBuildingTypes map[*types.Type]bool
+}
+
+func newCallTreeForType(existingDefaulters, newDefaulters defaulterFuncMap) *callTreeForType {
+	return &callTreeForType{
+		existingDefaulters:     existingDefaulters,
+		newDefaulters:          newDefaulters,
+		currentlyBuildingTypes: make(map[*types.Type]bool),
+	}
+}
+
+// resolveType follows pointers and aliases of `t` until reaching the first
+// non-pointer type in `t's` herarchy
+func resolveTypeAndDepth(t *types.Type) (*types.Type, int) {
+	var prev *types.Type
+	depth := 0
+	for prev != t {
+		prev = t
+		if t.Kind == types.Alias {
+			t = t.Underlying
+		} else if t.Kind == types.Pointer {
+			t = t.Elem
+			depth += 1
+		}
+	}
+	return t, depth
+}
+
+// getPointerElementPath follows pointers and aliases to returns all
+// pointer elements in the path from the given type, to its base value type.
+//
+// Example:
+//
+//	type MyString string
+//	type MyStringPointer *MyString
+//	type MyStringPointerPointer *MyStringPointer
+//	type MyStringAlias MyStringPointer
+//	type MyStringAliasPointer *MyStringAlias
+//	type MyStringAliasDoublePointer **MyStringAlias
+//
+//	t		  				   | defaultPointerElementPath(t)
+//	---------------------------|----------------------------------------
+//	MyString                   | []
+//	MyStringPointer            | [MyString]
+//	MyStringPointerPointer     | [MyStringPointer, MyString]
+//	MyStringAlias              | [MyStringPointer, MyString]
+//	MyStringAliasPointer       | [MyStringAlias, MyStringPointer, MyString]
+//	MyStringAliasDoublePointer | [*MyStringAlias, MyStringAlias, MyStringPointer, MyString]
+func getPointerElementPath(t *types.Type) []*types.Type {
+	var path []*types.Type
+	for t != nil {
+		switch t.Kind {
+		case types.Alias:
+			t = t.Underlying
+		case types.Pointer:
+			t = t.Elem
+			path = append(path, t)
+		default:
+			t = nil
+		}
+	}
+	return path
+}
+
+// getNestedDefault returns the first default value when resolving alias types
+func getNestedDefault(t *types.Type) (string, error) {
+	var prev *types.Type
+	for prev != t {
+		prev = t
+		defaultMap, err := extractDefaultTag(t.CommentLines)
+		if err != nil {
+			return "", err
+		}
+		if len(defaultMap) == 1 && defaultMap[0] != "" {
+			return defaultMap[0], nil
+		}
+		if t.Kind == types.Alias {
+			t = t.Underlying
+		} else if t.Kind == types.Pointer {
+			t = t.Elem
+		}
+	}
+	return "", nil
+}
+
+var refRE = regexp.MustCompile(`^ref\((?P<reference>[^"]+)\)$`)
+var refREIdentIndex = refRE.SubexpIndex("reference")
+
+// parseSymbolReference looks for strings that match one of the following:
+//   - ref(Ident)
+//   - ref(pkgpath.Ident)
+//     If the input string matches either of these, it will return the (optional)
+//     pkgpath, the Ident, and true.  Otherwise it will return empty strings and
+//     false.
+func parseSymbolReference(s, sourcePackage string) (types.Name, bool) {
+	matches := refRE.FindStringSubmatch(s)
+	if len(matches) < refREIdentIndex || matches[refREIdentIndex] == "" {
+		return types.Name{}, false
+	}
+
+	contents := matches[refREIdentIndex]
+	name := types.ParseFullyQualifiedName(contents)
+	if len(name.Package) == 0 {
+		name.Package = sourcePackage
+	}
+	return name, true
+}
+
+func populateDefaultValue(node *callNode, t *types.Type, tags string, commentLines []string, commentPackage string) *callNode {
+	defaultMap, err := extractDefaultTag(commentLines)
+	if err != nil {
+		klog.Fatalf("Error extracting default tag: %v", err)
+	}
+
+	var defaultString string
+	if len(defaultMap) == 1 {
+		defaultString = defaultMap[0]
+	} else if len(defaultMap) > 1 {
+		klog.Fatalf("Found more than one default tag for %v", t.Kind)
+	}
+
+	baseT, depth := resolveTypeAndDepth(t)
+	if depth > 0 && defaultString == "" {
+		defaultString, err = getNestedDefault(t)
+		if err != nil {
+			klog.Fatalf("Error extracting nested default tag: %v", err)
+		}
+	}
+
+	if len(defaultString) == 0 {
+		return node
+	}
+	var symbolReference types.Name
+	var defaultValue interface{}
+	if id, ok := parseSymbolReference(defaultString, commentPackage); ok {
+		symbolReference = id
+		defaultString = ""
+	} else if err := json.Unmarshal([]byte(defaultString), &defaultValue); err != nil {
+		klog.Fatalf("Failed to unmarshal default: %v", err)
+	}
+
+	if defaultValue != nil {
+		zero := typeZeroValue[t.String()]
+		if reflect.DeepEqual(defaultValue, zero) {
+			// If the default value annotation matches the default value for the type,
+			// do not generate any defaulting function
+			return node
+		}
+	}
+
+	// callNodes are not automatically generated for primitive types. Generate one if the callNode does not exist
+	if node == nil {
+		node = &callNode{}
+		node.markerOnly = true
+	}
+
+	node.defaultIsPrimitive = baseT.IsPrimitive()
+	node.defaultType = baseT
+	node.defaultTopLevelType = t
+	node.defaultValue.InlineConstant = defaultString
+	node.defaultValue.SymbolReference = symbolReference
+	return node
+}
+
+// build creates a tree of paths to fields (based on how they would be accessed in Go - pointer, elem,
+// slice, or key) and the functions that should be invoked on each field. An in-order traversal of the resulting tree
+// can be used to generate a Go function that invokes each nested function on the appropriate type. The return
+// value may be nil if there are no functions to call on type or the type is a primitive (Defaulters can only be
+// invoked on structs today). When root is true this function will not use a newDefaulter. existingDefaulters should
+// contain all defaulting functions by type defined in code - newDefaulters should contain all object defaulters
+// that could be or will be generated. If newDefaulters has an entry for a type, but the 'object' field is nil,
+// this function skips adding that defaulter - this allows us to avoid generating object defaulter functions for
+// list types that call empty defaulters.
+func (c *callTreeForType) build(t *types.Type, root bool) *callNode {
+	parent := &callNode{}
+
+	if root {
+		// the root node is always a pointer
+		parent.elem = true
+	}
+
+	defaults := c.existingDefaulters[t]
+	newDefaults, generated := c.newDefaulters[t]
+	switch {
+	case !root && generated && newDefaults.object != nil:
+		parent.call = append(parent.call, newDefaults.object)
+		// if we will be generating the defaulter, it by definition is a covering
+		// defaulter, so we halt recursion
+		klog.V(6).Infof("the defaulter %s will be generated as an object defaulter", t.Name)
+		return parent
+
+	case defaults.object != nil:
+		// object defaulters are always covering
+		parent.call = append(parent.call, defaults.object)
+		return parent
+
+	case defaults.base != nil:
+		parent.call = append(parent.call, defaults.base)
+		// if the base function indicates it "covers" (it already includes defaulters)
+		// we can halt recursion
+		isCovers, err := checkTag(defaults.base.CommentLines, "covers")
+		if err != nil {
+			klog.Fatalf("error extracting %s tag: %v", tagName, err)
+		}
+		if isCovers {
+			klog.V(6).Infof("the defaulter %s indicates it covers all sub generators", t.Name)
+			return parent
+		}
+	}
+
+	// base has been added already, now add any additional defaulters defined for this object
+	parent.call = append(parent.call, defaults.additional...)
+
+	// if the type already exists, don't build the tree for it and don't generate anything.
+	// This is used to avoid recursion for nested recursive types.
+	if c.currentlyBuildingTypes[t] {
+		return nil
+	}
+	// if type doesn't exist, mark it as existing
+	c.currentlyBuildingTypes[t] = true
+
+	defer func() {
+		// The type will now acts as a parent, not a nested recursive type.
+		// We can now build the tree for it safely.
+		c.currentlyBuildingTypes[t] = false
+	}()
+
+	switch t.Kind {
+	case types.Pointer:
+		if child := c.build(t.Elem, false); child != nil {
+			child.elem = true
+			parent.children = append(parent.children, *child)
+		}
+	case types.Slice, types.Array:
+		if child := c.build(t.Elem, false); child != nil {
+			child.index = true
+			if t.Elem.Kind == types.Pointer {
+				child.elem = true
+			}
+			parent.children = append(parent.children, *child)
+		} else if member := populateDefaultValue(nil, t.Elem, "", t.Elem.CommentLines, t.Elem.Name.Package); member != nil {
+			member.index = true
+			parent.children = append(parent.children, *member)
+		}
+	case types.Map:
+		if child := c.build(t.Elem, false); child != nil {
+			child.key = true
+			parent.children = append(parent.children, *child)
+		} else if member := populateDefaultValue(nil, t.Elem, "", t.Elem.CommentLines, t.Elem.Name.Package); member != nil {
+			member.key = true
+			parent.children = append(parent.children, *member)
+		}
+
+	case types.Struct:
+		for _, field := range t.Members {
+			name := field.Name
+			if len(name) == 0 {
+				if field.Type.Kind == types.Pointer {
+					name = field.Type.Elem.Name.Name
+				} else {
+					name = field.Type.Name.Name
+				}
+			}
+			if child := c.build(field.Type, false); child != nil {
+				child.field = name
+				populateDefaultValue(child, field.Type, field.Tags, field.CommentLines, field.Type.Name.Package)
+				parent.children = append(parent.children, *child)
+			} else if member := populateDefaultValue(nil, field.Type, field.Tags, field.CommentLines, t.Name.Package); member != nil {
+				member.field = name
+				parent.children = append(parent.children, *member)
+			}
+		}
+	case types.Alias:
+		if child := c.build(t.Underlying, false); child != nil {
+			parent.children = append(parent.children, *child)
+		}
+	}
+	if len(parent.children) == 0 && len(parent.call) == 0 {
+		// klog.V(6).Infof("decided type %s needs no generation", t.Name)
+		return nil
+	}
+	return parent
+}
+
+const (
+	runtimePackagePath    = "k8s.io/apimachinery/pkg/runtime"
+	conversionPackagePath = "k8s.io/apimachinery/pkg/conversion"
+)
+
+// genDefaulter produces a file with a autogenerated conversions.
+type genDefaulter struct {
+	generator.GoGenerator
+	typesPackage       string
+	outputPackage      string
+	peerPackages       []string
+	newDefaulters      defaulterFuncMap
+	existingDefaulters defaulterFuncMap
+	imports            namer.ImportTracker
+	typesForInit       []*types.Type
+}
+
+func NewGenDefaulter(outputFilename, typesPackage, outputPackage string, existingDefaulters, newDefaulters defaulterFuncMap, peerPkgs []string) generator.Generator {
+	return &genDefaulter{
+		GoGenerator: generator.GoGenerator{
+			OutputFilename: outputFilename,
+		},
+		typesPackage:       typesPackage,
+		outputPackage:      outputPackage,
+		peerPackages:       peerPkgs,
+		newDefaulters:      newDefaulters,
+		existingDefaulters: existingDefaulters,
+		imports:            generator.NewImportTrackerForPackage(outputPackage),
+		typesForInit:       make([]*types.Type, 0),
+	}
+}
+
+func (g *genDefaulter) Namers(c *generator.Context) namer.NameSystems {
+	// Have the raw namer for this file track what it imports.
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.outputPackage, g.imports),
+	}
+}
+
+func (g *genDefaulter) isOtherPackage(pkg string) bool {
+	if pkg == g.outputPackage {
+		return false
+	}
+	if strings.HasSuffix(pkg, `"`+g.outputPackage+`"`) {
+		return false
+	}
+	return true
+}
+
+func (g *genDefaulter) Filter(c *generator.Context, t *types.Type) bool {
+	defaults, ok := g.newDefaulters[t]
+	if !ok || defaults.object == nil {
+		return false
+	}
+	g.typesForInit = append(g.typesForInit, t)
+	return true
+}
+
+func (g *genDefaulter) Imports(c *generator.Context) (imports []string) {
+	var importLines []string
+	for _, singleImport := range g.imports.ImportLines() {
+		if g.isOtherPackage(singleImport) {
+			importLines = append(importLines, singleImport)
+		}
+	}
+	return importLines
+}
+
+func (g *genDefaulter) Init(c *generator.Context, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+
+	scheme := c.Universe.Type(types.Name{Package: runtimePackagePath, Name: "Scheme"})
+	schemePtr := &types.Type{
+		Kind: types.Pointer,
+		Elem: scheme,
+	}
+	sw.Do("// RegisterDefaults adds defaulters functions to the given scheme.\n", nil)
+	sw.Do("// Public to allow building arbitrary schemes.\n", nil)
+	sw.Do("// All generated defaulters are covering - they call all nested defaulters.\n", nil)
+	sw.Do("func RegisterDefaults(scheme $.|raw$) error {\n", schemePtr)
+	for _, t := range g.typesForInit {
+		args := defaultingArgsFromType(t)
+		sw.Do("scheme.AddTypeDefaultingFunc(&$.inType|raw${}, func(obj interface{}) { $.inType|objectdefaultfn$(obj.(*$.inType|raw$)) })\n", args)
+	}
+	sw.Do("return nil\n", nil)
+	sw.Do("}\n\n", nil)
+	return sw.Error()
+}
+
+func (g *genDefaulter) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	if _, ok := g.newDefaulters[t]; !ok {
+		return nil
+	}
+
+	klog.V(5).Infof("generating for type %v", t)
+
+	callTree := newCallTreeForType(g.existingDefaulters, g.newDefaulters).build(t, true)
+	if callTree == nil {
+		klog.V(5).Infof("  no defaulters defined")
+		return nil
+	}
+	i := 0
+	callTree.VisitInOrder(func(ancestors []*callNode, current *callNode) {
+		if ref := &current.defaultValue.SymbolReference; len(ref.Name) > 0 {
+			// Ensure package for symbol is imported in output generation
+			g.imports.AddSymbol(*ref)
+
+			// Rewrite the fully qualified name using the local package name
+			// from the imports
+			ref.Package = g.imports.LocalNameOf(ref.Package)
+		}
+
+		if len(current.call) == 0 {
+			return
+		}
+		path := callPath(append(ancestors, current))
+		klog.V(5).Infof("  %d: %s", i, path)
+		i++
+	})
+
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+	g.generateDefaulter(c, t, callTree, sw)
+	return sw.Error()
+}
+
+func defaultingArgsFromType(inType *types.Type) generator.Args {
+	return generator.Args{
+		"inType": inType,
+	}
+}
+
+func (g *genDefaulter) generateDefaulter(c *generator.Context, inType *types.Type, callTree *callNode, sw *generator.SnippetWriter) {
+	sw.Do("func $.inType|objectdefaultfn$(in *$.inType|raw$) {\n", defaultingArgsFromType(inType))
+	callTree.WriteMethod(c, "in", 0, nil, sw)
+	sw.Do("}\n\n", nil)
+}
+
+// callNode represents an entry in a tree of Go type accessors - the path from the root to a leaf represents
+// how in Go code an access would be performed. For example, if a defaulting function exists on a container
+// lifecycle hook, to invoke that defaulter correctly would require this Go code:
+//
+//	for i := range pod.Spec.Containers {
+//	  o := &pod.Spec.Containers[i]
+//	  if o.LifecycleHook != nil {
+//	    SetDefaults_LifecycleHook(o.LifecycleHook)
+//	  }
+//	}
+//
+// That would be represented by a call tree like:
+//
+//	callNode
+//	  field: "Spec"
+//	  children:
+//	  - field: "Containers"
+//	    children:
+//	    - index: true
+//	      children:
+//	      - field: "LifecycleHook"
+//	        elem: true
+//	        call:
+//	        - SetDefaults_LifecycleHook
+//
+// which we can traverse to build that Go struct (you must call the field Spec, then Containers, then range over
+// that field, then check whether the LifecycleHook field is nil, before calling SetDefaults_LifecycleHook on
+// the pointer to that field).
+type callNode struct {
+	// field is the name of the Go member to access
+	field string
+	// key is true if this is a map and we must range over the key and values
+	key bool
+	// index is true if this is a slice and we must range over the slice values
+	index bool
+	// elem is true if the previous elements refer to a pointer (typically just field)
+	elem bool
+
+	// call is all of the functions that must be invoked on this particular node, in order
+	call []*types.Type
+	// children is the child call nodes that must also be traversed
+	children []callNode
+
+	// defaultValue is the defaultValue of a callNode struct
+	// Only primitive types and pointer types are eligible to have a default value
+	defaultValue defaultValue
+
+	// defaultIsPrimitive is used to determine how to assign the default value.
+	// Primitive types will be directly assigned while complex types will use JSON unmarshalling
+	defaultIsPrimitive bool
+
+	// markerOnly is true if the callNode exists solely to fill in a default value
+	markerOnly bool
+
+	// defaultType is the transitive underlying/element type of the node.
+	// The provided default value literal or reference is expected to be
+	// convertible to this type.
+	//
+	// e.g:
+	//	node type = *string 			-> 	defaultType = string
+	//	node type = StringPointerAlias 	-> 	defaultType = string
+	// Only populated if defaultIsPrimitive is true
+	defaultType *types.Type
+
+	// defaultTopLevelType is the final type the value should resolve to
+	// This is in constrast with default type, which resolves aliases and pointers.
+	defaultTopLevelType *types.Type
+}
+
+type defaultValue struct {
+	// The value was written directly in the marker comment and
+	// has been parsed as JSON
+	InlineConstant string
+	// The name of the symbol relative to the parsed package path
+	// i.e. k8s.io/pkg.apis.v1.Foo if from another package or simply `Foo`
+	// if within the same package.
+	SymbolReference types.Name
+}
+
+func (d defaultValue) IsEmpty() bool {
+	resolved := d.Resolved()
+	return resolved == ""
+}
+
+func (d defaultValue) Resolved() string {
+	if len(d.InlineConstant) > 0 {
+		return d.InlineConstant
+	}
+	return d.SymbolReference.String()
+}
+
+// CallNodeVisitorFunc is a function for visiting a call tree. ancestors is the list of all parents
+// of this node to the root of the tree - will be empty at the root.
+type CallNodeVisitorFunc func(ancestors []*callNode, node *callNode)
+
+func (n *callNode) VisitInOrder(fn CallNodeVisitorFunc) {
+	n.visitInOrder(nil, fn)
+}
+
+func (n *callNode) visitInOrder(ancestors []*callNode, fn CallNodeVisitorFunc) {
+	fn(ancestors, n)
+	ancestors = append(ancestors, n)
+	for i := range n.children {
+		n.children[i].visitInOrder(ancestors, fn)
+	}
+}
+
+var (
+	indexVariables = "ijklmnop"
+	localVariables = "abcdefgh"
+)
+
+// varsForDepth creates temporary variables guaranteed to be unique within lexical Go scopes
+// of this depth in a function. It uses canonical Go loop variables for the first 7 levels
+// and then resorts to uglier prefixes.
+func varsForDepth(depth int) (index, local string) {
+	if depth > len(indexVariables) {
+		index = fmt.Sprintf("i%d", depth)
+	} else {
+		index = indexVariables[depth : depth+1]
+	}
+	if depth > len(localVariables) {
+		local = fmt.Sprintf("local%d", depth)
+	} else {
+		local = localVariables[depth : depth+1]
+	}
+	return
+}
+
+// writeCalls generates a list of function calls based on the calls field for the provided variable
+// name and pointer.
+func (n *callNode) writeCalls(varName string, isVarPointer bool, sw *generator.SnippetWriter) {
+	accessor := varName
+	if !isVarPointer {
+		accessor = "&" + accessor
+	}
+	for _, fn := range n.call {
+		sw.Do("$.fn|raw$($.var$)\n", generator.Args{
+			"fn":  fn,
+			"var": accessor,
+		})
+	}
+}
+
+func getTypeZeroValue(t string) (interface{}, error) {
+	defaultZero, ok := typeZeroValue[t]
+	if !ok {
+		return nil, fmt.Errorf("cannot find zero value for type %v in typeZeroValue", t)
+	}
+
+	// To generate the code for empty string, they must be quoted
+	if defaultZero == "" {
+		defaultZero = strconv.Quote(defaultZero.(string))
+	}
+	return defaultZero, nil
+}
+
+func (n *callNode) writeDefaulter(c *generator.Context, varName string, index string, isVarPointer bool, sw *generator.SnippetWriter) {
+	if n.defaultValue.IsEmpty() {
+		return
+	}
+
+	jsonUnmarshalType := c.Universe.Type(types.Name{Package: "encoding/json", Name: "Unmarshal"})
+
+	args := generator.Args{
+		"defaultValue":  n.defaultValue.Resolved(),
+		"varName":       varName,
+		"index":         index,
+		"varTopType":    n.defaultTopLevelType,
+		"jsonUnmarshal": jsonUnmarshalType,
+	}
+
+	variablePlaceholder := ""
+
+	if n.index {
+		// Defaulting for array
+		variablePlaceholder = "$.varName$[$.index$]"
+	} else if n.key {
+		// Defaulting for map
+		variablePlaceholder = "$.varName$[$.index$]"
+		mapDefaultVar := args["index"].(string) + "_default"
+		args["mapDefaultVar"] = mapDefaultVar
+	} else {
+		// Defaulting for primitive type
+		variablePlaceholder = "$.varName$"
+	}
+
+	// defaultIsPrimitive is true if the type or underlying type (in an array/map) is primitive
+	// or is a pointer to a primitive type
+	// (Eg: int, map[string]*string, []int)
+	if n.defaultIsPrimitive {
+		// If the default value is a primitive when the assigned type is a pointer
+		// keep using the address-of operator on the primitive value until the types match
+		if pointerPath := getPointerElementPath(n.defaultTopLevelType); len(pointerPath) > 0 {
+			// If the destination is a pointer, the last element in
+			// defaultDepth is the element type of the bottommost pointer:
+			// the base type of our default value.
+			destElemType := pointerPath[len(pointerPath)-1]
+			pointerArgs := args.WithArgs(generator.Args{
+				"varDepth":     len(pointerPath),
+				"baseElemType": destElemType,
+			})
+
+			sw.Do(fmt.Sprintf("if %s == nil {\n", variablePlaceholder), pointerArgs)
+			if len(n.defaultValue.InlineConstant) > 0 {
+				// If default value is a literal then it can be assigned via var stmt
+				sw.Do("var ptrVar$.varDepth$ $.baseElemType|raw$ = $.defaultValue$\n", pointerArgs)
+			} else {
+				// If default value is not a literal then it may need to be casted
+				// to the base type of the destination pointer
+				sw.Do("ptrVar$.varDepth$ := $.baseElemType|raw$($.defaultValue$)\n", pointerArgs)
+			}
+
+			for i := len(pointerPath); i >= 1; i-- {
+				dest := fmt.Sprintf("ptrVar%d", i-1)
+				assignment := ":="
+				if i == 1 {
+					// Last assignment is into the storage destination
+					dest = variablePlaceholder
+					assignment = "="
+				}
+
+				sourceType := "*" + destElemType.String()
+				if i == len(pointerPath) {
+					// Initial value is not a pointer
+					sourceType = destElemType.String()
+				}
+				destElemType = pointerPath[i-1]
+
+				// Cannot include `dest` into args since its value may be
+				// `variablePlaceholder` which is a template, not a value
+				elementArgs := pointerArgs.WithArgs(generator.Args{
+					"assignment":   assignment,
+					"source":       fmt.Sprintf("ptrVar%d", i),
+					"destElemType": destElemType,
+				})
+
+				// Skip cast if type is exact match
+				if destElemType.String() == sourceType {
+					sw.Do(fmt.Sprintf("%v $.assignment$ &$.source$\n", dest), elementArgs)
+				} else {
+					sw.Do(fmt.Sprintf("%v $.assignment$ (*$.destElemType|raw$)(&$.source$)\n", dest), elementArgs)
+				}
+			}
+		} else {
+			// For primitive types, nil checks cannot be used and the zero value must be determined
+			defaultZero, err := getTypeZeroValue(n.defaultType.String())
+			if err != nil {
+				klog.Error(err)
+			}
+			args["defaultZero"] = defaultZero
+
+			sw.Do(fmt.Sprintf("if %s == $.defaultZero$ {\n", variablePlaceholder), args)
+
+			if len(n.defaultValue.InlineConstant) > 0 {
+				sw.Do(fmt.Sprintf("%s = $.defaultValue$", variablePlaceholder), args)
+			} else {
+				sw.Do(fmt.Sprintf("%s = $.varTopType|raw$($.defaultValue$)", variablePlaceholder), args)
+			}
+		}
+	} else {
+		sw.Do(fmt.Sprintf("if %s == nil {\n", variablePlaceholder), args)
+		// Map values are not directly addressable and we need a temporary variable to do json unmarshalling
+		// This applies to maps with non-primitive values (eg: map[string]SubStruct)
+		if n.key {
+			sw.Do("$.mapDefaultVar$ := $.varName$[$.index$]\n", args)
+			sw.Do("if err := $.jsonUnmarshal|raw$([]byte(`$.defaultValue$`), &$.mapDefaultVar$); err != nil {\n", args)
+		} else {
+			variablePointer := variablePlaceholder
+			if !isVarPointer {
+				variablePointer = "&" + variablePointer
+			}
+			sw.Do(fmt.Sprintf("if err := $.jsonUnmarshal|raw$([]byte(`$.defaultValue$`), %s); err != nil {\n", variablePointer), args)
+		}
+		sw.Do("panic(err)\n", nil)
+		sw.Do("}\n", nil)
+		if n.key {
+			sw.Do("$.varName$[$.index$] = $.mapDefaultVar$\n", args)
+		}
+	}
+	sw.Do("}\n", nil)
+}
+
+// WriteMethod performs an in-order traversal of the calltree, generating loops and if blocks as necessary
+// to correctly turn the call tree into a method body that invokes all calls on all child nodes of the call tree.
+// Depth is used to generate local variables at the proper depth.
+func (n *callNode) WriteMethod(c *generator.Context, varName string, depth int, ancestors []*callNode, sw *generator.SnippetWriter) {
+	// if len(n.call) > 0 {
+	// 	sw.Do(fmt.Sprintf("// %s\n", callPath(append(ancestors, n)).String()), nil)
+	// }
+
+	if len(n.field) > 0 {
+		varName = varName + "." + n.field
+	}
+
+	index, local := varsForDepth(depth)
+	vars := generator.Args{
+		"index": index,
+		"local": local,
+		"var":   varName,
+	}
+
+	isPointer := n.elem && !n.index
+	if isPointer && len(ancestors) > 0 {
+		sw.Do("if $.var$ != nil {\n", vars)
+	}
+
+	switch {
+	case n.index:
+		sw.Do("for $.index$ := range $.var$ {\n", vars)
+		if !n.markerOnly {
+			if n.elem {
+				sw.Do("$.local$ := $.var$[$.index$]\n", vars)
+			} else {
+				sw.Do("$.local$ := &$.var$[$.index$]\n", vars)
+			}
+		}
+
+		n.writeDefaulter(c, varName, index, isPointer, sw)
+		n.writeCalls(local, true, sw)
+		for i := range n.children {
+			n.children[i].WriteMethod(c, local, depth+1, append(ancestors, n), sw)
+		}
+		sw.Do("}\n", nil)
+	case n.key:
+		if !n.defaultValue.IsEmpty() {
+			// Map keys are typed and cannot share the same index variable as arrays and other maps
+			index = index + "_" + ancestors[len(ancestors)-1].field
+			vars["index"] = index
+			sw.Do("for $.index$ := range $.var$ {\n", vars)
+			n.writeDefaulter(c, varName, index, isPointer, sw)
+			sw.Do("}\n", nil)
+		}
+	default:
+		n.writeDefaulter(c, varName, index, isPointer, sw)
+		n.writeCalls(varName, isPointer, sw)
+		for i := range n.children {
+			n.children[i].WriteMethod(c, varName, depth, append(ancestors, n), sw)
+		}
+	}
+
+	if isPointer && len(ancestors) > 0 {
+		sw.Do("}\n", nil)
+	}
+}
+
+type callPath []*callNode
+
+// String prints a representation of a callPath that roughly approximates what a Go accessor
+// would look like. Used for debugging only.
+func (path callPath) String() string {
+	if len(path) == 0 {
+		return "<none>"
+	}
+	var parts []string
+	for _, p := range path {
+		last := len(parts) - 1
+		switch {
+		case p.elem:
+			if len(parts) > 0 {
+				parts[last] = "*" + parts[last]
+			} else {
+				parts = append(parts, "*")
+			}
+		case p.index:
+			if len(parts) > 0 {
+				parts[last] += "[i]"
+			} else {
+				parts = append(parts, "[i]")
+			}
+		case p.key:
+			if len(parts) > 0 {
+				parts[last] += "[key]"
+			} else {
+				parts = append(parts, "[key]")
+			}
+		default:
+			if len(p.field) > 0 {
+				parts = append(parts, p.field)
+			} else {
+				parts = append(parts, "<root>")
+			}
+		}
+	}
+	var calls []string
+	for _, fn := range path[len(path)-1].call {
+		calls = append(calls, fn.Name.String())
+	}
+	if len(calls) == 0 {
+		calls = append(calls, "<none>")
+	}
+
+	return strings.Join(parts, ".") + " calls " + strings.Join(calls, ", ")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/main.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/main.go
new file mode 100644
index 0000000000..0250c1328f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/main.go
@@ -0,0 +1,83 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// defaulter-gen is a tool for auto-generating Defaulter functions.
+//
+// Given a list of input directories, it will scan for top level types
+// and generate efficient defaulters for an entire object from the sum
+// of the SetDefault_* methods contained in the object tree.
+//
+// Generation is governed by comment tags in the source.  Any package may
+// request defaulter generation by including one or more comment tags at
+// the package comment level:
+//
+//	// +k8s:defaulter-gen=<field-name-to-flag>
+//
+// which will create defaulters for any type that contains the provided
+// field name (if the type has defaulters). Any type may request explicit
+// defaulting by providing the comment tag:
+//
+//	// +k8s:defaulter-gen=true|false
+//
+// An existing defaulter method (`SetDefaults_TYPE`) can provide the
+// comment tag:
+//
+//	// +k8s:defaulter-gen=covers
+//
+// to indicate that the defaulter does not or should not call any nested
+// defaulters.
+package main
+
+import (
+	"flag"
+
+	"github.com/spf13/pflag"
+	"k8s.io/code-generator/cmd/defaulter-gen/args"
+	"k8s.io/code-generator/cmd/defaulter-gen/generators"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/klog/v2"
+)
+
+func main() {
+	klog.InitFlags(nil)
+	args := args.New()
+
+	args.AddFlags(pflag.CommandLine)
+	flag.Set("logtostderr", "true")
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+	pflag.Parse()
+
+	if err := args.Validate(); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+
+	myTargets := func(context *generator.Context) []generator.Target {
+		return generators.GetTargets(context, args)
+	}
+
+	// Run it.
+	if err := gengo.Execute(
+		generators.NameSystems(),
+		generators.DefaultNameSystem(),
+		myTargets,
+		args.GeneratedBuildTag,
+		pflag.Args(),
+	); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+	klog.V(2).Info("Completed successfully.")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/empty/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/empty/doc.go
new file mode 100644
index 0000000000..2b338eec93
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/empty/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:defaulter-gen=covers
+
+// This is a test package.
+package empty
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/empty/type.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/empty/type.go
new file mode 100644
index 0000000000..707e6fa4a6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/empty/type.go
@@ -0,0 +1,29 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package empty
+
+// Only test
+type Ttest struct {
+	BoolField   bool
+	IntField    int
+	StringField string
+	FloatField  float64
+}
+
+type TypeMeta struct {
+	Fortest bool
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/empty/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/empty/zz_generated.defaults.go
new file mode 100644
index 0000000000..4c6ab363bc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/empty/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package empty
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/generate.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/generate.go
new file mode 100644
index 0000000000..486ddacf80
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/generate.go
@@ -0,0 +1,27 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Ignore this file to prevent zz_generated for this package
+
+//go:generate go run k8s.io/code-generator/cmd/defaulter-gen --output-file zz_generated.defaults.go --go-header-file=../../../examples/hack/boilerplate.go.txt k8s.io/code-generator/cmd/defaulter-gen/output_tests/...
+package outputtests
+
+import (
+	// For go-generate
+	_ "k8s.io/code-generator/cmd/defaulter-gen/generators"
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/defaults.go
new file mode 100644
index 0000000000..7e27d5412b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/defaults.go
@@ -0,0 +1,32 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package marker
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+//nolint:unused
+func addDefaultingFuncs(scheme *runtime.Scheme) error {
+	return RegisterDefaults(scheme)
+}
+
+func SetDefaults_DefaultedWithFunction(obj *DefaultedWithFunction) {
+	if obj.S1 == "" {
+		obj.S1 = "default_function"
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/doc.go
new file mode 100644
index 0000000000..6db42e14e7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:defaulter-gen=TypeMeta
+
+// This is a test package.
+package marker
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external/constant.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external/constant.go
new file mode 100644
index 0000000000..d04b8e02bf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external/constant.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package external
+
+// Used for test with multiple packages of the same name
+const AConstant string = "AConstantString"
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external/external/constant.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external/external/constant.go
new file mode 100644
index 0000000000..494da10541
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external/external/constant.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package external
+
+// Used for test with multiple packages of the same name
+const AnotherConstant string = "AnotherConstantString"
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external2/type.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external2/type.go
new file mode 100644
index 0000000000..df0b94bcbd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external2/type.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package external2
+
+type String string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external3/constant.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external3/constant.go
new file mode 100644
index 0000000000..a97f469841
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external3/constant.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package external3
+
+import "k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external2"
+
+type StringPointer *external2.String
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/fake_deepcopy_conversion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/fake_deepcopy_conversion.go
new file mode 100644
index 0000000000..5ccc12b63e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/fake_deepcopy_conversion.go
@@ -0,0 +1,107 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package marker
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func (in *Defaulted) DeepCopy() *Defaulted {
+	if in == nil {
+		return nil
+	}
+	out := new(Defaulted)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *Defaulted) DeepCopyInto(out *Defaulted) {
+	*out = *in
+}
+
+func (in *Defaulted) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+func (in *DefaultedOmitempty) DeepCopy() *DefaultedOmitempty {
+	if in == nil {
+		return nil
+	}
+	out := new(DefaultedOmitempty)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *DefaultedOmitempty) DeepCopyInto(out *DefaultedOmitempty) {
+	*out = *in
+}
+
+func (in *DefaultedOmitempty) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+func (in *DefaultedWithFunction) DeepCopy() *DefaultedWithFunction {
+	if in == nil {
+		return nil
+	}
+	out := new(DefaultedWithFunction)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *DefaultedWithFunction) DeepCopyInto(out *DefaultedWithFunction) {
+	*out = *in
+}
+
+func (in *DefaultedWithFunction) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+func (in *Defaulted) GetObjectKind() schema.ObjectKind              { return schema.EmptyObjectKind }
+func (in *DefaultedOmitempty) GetObjectKind() schema.ObjectKind     { return schema.EmptyObjectKind }
+func (in *DefaultedWithFunction) GetObjectKind() schema.ObjectKind  { return schema.EmptyObjectKind }
+func (in *DefaultedWithReference) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+func (in *DefaultedWithReference) DeepCopy() *DefaultedWithReference {
+	if in == nil {
+		return nil
+	}
+	out := new(DefaultedWithReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *DefaultedWithReference) DeepCopyInto(out *DefaultedWithReference) {
+	*out = *in
+}
+
+func (in *DefaultedWithReference) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/marker_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/marker_test.go
new file mode 100644
index 0000000000..c86f1e1d49
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/marker_test.go
@@ -0,0 +1,409 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package marker
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external"
+	externalexternal "k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external/external"
+	"k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external2"
+	"k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external3"
+	"k8s.io/utils/ptr"
+)
+
+var (
+	defaultInt32 int32 = 32
+	defaultInt64 int64 = 64
+)
+
+func Test_Marker(t *testing.T) {
+	testcases := []struct {
+		name string
+		in   Defaulted
+		out  Defaulted
+	}{
+		{
+			name: "default",
+			in:   Defaulted{},
+			out: Defaulted{
+				StringDefault:      "bar",
+				StringEmptyDefault: "",
+				StringEmpty:        "",
+				StringPointer:      ptr.To("default"),
+				Int64:              &defaultInt64,
+				Int32:              &defaultInt32,
+				IntDefault:         1,
+				IntEmptyDefault:    0,
+				IntEmpty:           0,
+				FloatDefault:       0.5,
+				FloatEmptyDefault:  0.0,
+				FloatEmpty:         0.0,
+				List: []Item{
+					ptr.To("foo"),
+					ptr.To("bar"),
+				},
+				Sub: &SubStruct{
+					S: "foo",
+					I: 5,
+				},
+				OtherSub: SubStruct{
+					S: "",
+					I: 1,
+				},
+				StructList: []SubStruct{
+					{
+						S: "foo1",
+						I: 1,
+					},
+					{
+						S: "foo2",
+						I: 1,
+					},
+				},
+				PtrStructList: []*SubStruct{
+					{
+						S: "foo1",
+						I: 1,
+					},
+					{
+						S: "foo2",
+						I: 1,
+					},
+				},
+				StringList: []string{
+					"foo",
+				},
+				Map: map[string]Item{
+					"foo": ptr.To("bar"),
+				},
+				StructMap: map[string]SubStruct{
+					"foo": {
+						S: "string",
+						I: 1,
+					},
+				},
+				PtrStructMap: map[string]*SubStruct{
+					"foo": {
+						S: "string",
+						I: 1,
+					},
+				},
+				AliasPtr: ptr.To("banana"),
+			},
+		},
+		{
+			name: "values-omitempty",
+			in: Defaulted{
+				StringDefault: "changed",
+				IntDefault:    5,
+			},
+			out: Defaulted{
+				StringDefault:      "changed",
+				StringEmptyDefault: "",
+				StringEmpty:        "",
+				StringPointer:      ptr.To("default"),
+				Int64:              &defaultInt64,
+				Int32:              &defaultInt32,
+				IntDefault:         5,
+				IntEmptyDefault:    0,
+				IntEmpty:           0,
+				FloatDefault:       0.5,
+				FloatEmptyDefault:  0.0,
+				FloatEmpty:         0.0,
+				List: []Item{
+					ptr.To("foo"),
+					ptr.To("bar"),
+				},
+				Sub: &SubStruct{
+					S: "foo",
+					I: 5,
+				},
+				StructList: []SubStruct{
+					{
+						S: "foo1",
+						I: 1,
+					},
+					{
+						S: "foo2",
+						I: 1,
+					},
+				},
+				PtrStructList: []*SubStruct{
+					{
+						S: "foo1",
+						I: 1,
+					},
+					{
+						S: "foo2",
+						I: 1,
+					},
+				},
+				StringList: []string{
+					"foo",
+				},
+				OtherSub: SubStruct{
+					S: "",
+					I: 1,
+				},
+				Map: map[string]Item{
+					"foo": ptr.To("bar"),
+				},
+				StructMap: map[string]SubStruct{
+					"foo": {
+						S: "string",
+						I: 1,
+					},
+				},
+				PtrStructMap: map[string]*SubStruct{
+					"foo": {
+						S: "string",
+						I: 1,
+					},
+				},
+				AliasPtr: ptr.To("banana"),
+			},
+		},
+		{
+			name: "lists",
+			in: Defaulted{
+				List: []Item{
+					nil,
+					ptr.To("bar"),
+				},
+			},
+			out: Defaulted{
+				StringDefault:      "bar",
+				StringEmptyDefault: "",
+				StringEmpty:        "",
+				StringPointer:      ptr.To("default"),
+				Int64:              &defaultInt64,
+				Int32:              &defaultInt32,
+				IntDefault:         1,
+				IntEmptyDefault:    0,
+				IntEmpty:           0,
+				FloatDefault:       0.5,
+				FloatEmptyDefault:  0.0,
+				FloatEmpty:         0.0,
+				List: []Item{
+					ptr.To("apple"),
+					ptr.To("bar"),
+				},
+				Sub: &SubStruct{
+					S: "foo",
+					I: 5,
+				},
+				StructList: []SubStruct{
+					{
+						S: "foo1",
+						I: 1,
+					},
+					{
+						S: "foo2",
+						I: 1,
+					},
+				},
+				PtrStructList: []*SubStruct{
+					{
+						S: "foo1",
+						I: 1,
+					},
+					{
+						S: "foo2",
+						I: 1,
+					},
+				},
+				StringList: []string{
+					"foo",
+				},
+				OtherSub: SubStruct{
+					S: "",
+					I: 1,
+				},
+				Map: map[string]Item{
+					"foo": ptr.To("bar"),
+				},
+				StructMap: map[string]SubStruct{
+					"foo": {
+						S: "string",
+						I: 1,
+					},
+				},
+				PtrStructMap: map[string]*SubStruct{
+					"foo": {
+						S: "string",
+						I: 1,
+					},
+				},
+				AliasPtr: ptr.To("banana"),
+			},
+		},
+		{
+			name: "stringmap",
+			in: Defaulted{
+				Map: map[string]Item{
+					"foo": nil,
+					"bar": ptr.To("banana"),
+				},
+			},
+			out: Defaulted{
+				StringDefault:      "bar",
+				StringEmptyDefault: "",
+				StringEmpty:        "",
+				StringPointer:      ptr.To("default"),
+				Int64:              &defaultInt64,
+				Int32:              &defaultInt32,
+				IntDefault:         1,
+				IntEmptyDefault:    0,
+				IntEmpty:           0,
+				FloatDefault:       0.5,
+				FloatEmptyDefault:  0.0,
+				FloatEmpty:         0.0,
+				List: []Item{
+					ptr.To("foo"),
+					ptr.To("bar"),
+				},
+				Sub: &SubStruct{
+					S: "foo",
+					I: 5,
+				},
+				StructList: []SubStruct{
+					{
+						S: "foo1",
+						I: 1,
+					},
+					{
+						S: "foo2",
+						I: 1,
+					},
+				},
+				PtrStructList: []*SubStruct{
+					{
+						S: "foo1",
+						I: 1,
+					},
+					{
+						S: "foo2",
+						I: 1,
+					},
+				},
+				StringList: []string{
+					"foo",
+				},
+				OtherSub: SubStruct{
+					S: "",
+					I: 1,
+				},
+				Map: map[string]Item{
+					"foo": ptr.To("apple"),
+					"bar": ptr.To("banana"),
+				},
+				StructMap: map[string]SubStruct{
+					"foo": {
+						S: "string",
+						I: 1,
+					},
+				},
+				PtrStructMap: map[string]*SubStruct{
+					"foo": {
+						S: "string",
+						I: 1,
+					},
+				},
+				AliasPtr: ptr.To("banana"),
+			},
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			SetObjectDefaults_Defaulted(&tc.in)
+			if diff := cmp.Diff(tc.out, tc.in); len(diff) > 0 {
+				t.Errorf("Error: Expected and actual output are different \n %s\n", diff)
+			}
+		})
+	}
+}
+
+func Test_DefaultingFunction(t *testing.T) {
+	in := DefaultedWithFunction{}
+	SetObjectDefaults_DefaultedWithFunction(&in)
+	out := DefaultedWithFunction{
+		S1: "default_function",
+		S2: "default_marker",
+	}
+	if diff := cmp.Diff(out, in); len(diff) > 0 {
+		t.Errorf("Error: Expected and actual output are different \n %s\n", diff)
+	}
+
+}
+
+func Test_DefaultingReference(t *testing.T) {
+	dv := DefaultedValueItem(SomeValue)
+	SomeDefault := SomeDefault
+	SomeValue := SomeValue
+
+	ptrVar9 := string(SomeValue)
+	ptrVar8 := &ptrVar9
+	ptrVar7 := (*B1)(&ptrVar8)
+	ptrVar6 := (*B2)(&ptrVar7)
+	ptrVar5 := &ptrVar6
+	ptrVar4 := &ptrVar5
+	ptrVar3 := &ptrVar4
+	ptrVar2 := (*B3)(&ptrVar3)
+	ptrVar1 := &ptrVar2
+
+	var external2Str = external2.String(SomeValue)
+
+	testcases := []struct {
+		name string
+		in   DefaultedWithReference
+		out  DefaultedWithReference
+	}{
+		{
+			name: "default",
+			in:   DefaultedWithReference{},
+			out: DefaultedWithReference{
+				AliasPointerInside:              Item(&SomeDefault),
+				AliasOverride:                   Item(&SomeDefault),
+				AliasConvertDefaultPointer:      &dv,
+				AliasPointerDefault:             &dv,
+				PointerAliasDefault:             Item(ptr.To("apple")),
+				AliasNonPointer:                 SomeValue,
+				AliasPointer:                    &SomeValue,
+				SymbolReference:                 SomeDefault,
+				SameNamePackageSymbolReference1: external.AConstant,
+				SameNamePackageSymbolReference2: externalexternal.AnotherConstant,
+				PointerConversion:               (*B4)(&ptrVar1),
+				PointerConversionValue:          (B4)(ptrVar1),
+				FullyQualifiedLocalSymbol:       string(SomeValue),
+				ImportFromAliasCast:             external3.StringPointer(&external2Str),
+			},
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			SetObjectDefaults_DefaultedWithReference(&tc.in)
+			if diff := cmp.Diff(tc.out, tc.in); len(diff) > 0 {
+				t.Errorf("Error: Expected and actual output are different \n %s\n", diff)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/type.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/type.go
new file mode 100644
index 0000000000..0658ba217c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/type.go
@@ -0,0 +1,265 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package marker
+
+import (
+	"k8s.io/code-generator/cmd/defaulter-gen/output_tests/empty"
+	"k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external3"
+)
+
+type Defaulted struct {
+	empty.TypeMeta
+
+	// +default="bar"
+	StringDefault string
+
+	// Default is forced to empty string
+	// Specifying the default is a no-op
+	// +default=""
+	StringEmptyDefault string
+
+	// Not specifying a default still defaults for non-omitempty
+	StringEmpty string
+
+	// +default="default"
+	StringPointer *string
+
+	// +default=64
+	Int64 *int64
+
+	// +default=32
+	Int32 *int32
+
+	// +default=1
+	IntDefault int
+
+	// +default=0
+	IntEmptyDefault int
+
+	// Default is forced to 0
+	IntEmpty int
+
+	// +default=0.5
+	FloatDefault float64
+
+	// +default=0.0
+	FloatEmptyDefault float64
+
+	FloatEmpty float64
+
+	// +default=["foo", "bar"]
+	List []Item
+	// +default={"s": "foo", "i": 5}
+	Sub *SubStruct
+
+	//+default=[{"s": "foo1", "i": 1}, {"s": "foo2"}]
+	StructList []SubStruct
+
+	//+default=[{"s": "foo1", "i": 1}, {"s": "foo2"}]
+	PtrStructList []*SubStruct
+
+	//+default=["foo"]
+	StringList []string
+
+	// Default is forced to empty struct
+	OtherSub SubStruct
+
+	// +default={"foo": "bar"}
+	Map map[string]Item
+
+	// +default={"foo": {"S": "string", "I": 1}}
+	StructMap map[string]SubStruct
+
+	// +default={"foo": {"S": "string", "I": 1}}
+	PtrStructMap map[string]*SubStruct
+
+	// A default specified here overrides the default for the Item type
+	// +default="banana"
+	AliasPtr Item
+}
+
+type DefaultedOmitempty struct {
+	empty.TypeMeta `json:",omitempty"`
+
+	// +default="bar"
+	StringDefault string `json:",omitempty"`
+
+	// Default is forced to empty string
+	// Specifying the default is a no-op
+	// +default=""
+	StringEmptyDefault string `json:",omitempty"`
+
+	// Not specifying a default still defaults for non-omitempty
+	StringEmpty string `json:",omitempty"`
+
+	// +default="default"
+	StringPointer *string `json:",omitempty"`
+
+	// +default=64
+	Int64 *int64 `json:",omitempty"`
+
+	// +default=32
+	Int32 *int32 `json:",omitempty"`
+
+	// +default=1
+	IntDefault int `json:",omitempty"`
+
+	// +default=0
+	IntEmptyDefault int `json:",omitempty"`
+
+	// Default is forced to 0
+	IntEmpty int `json:",omitempty"`
+
+	// +default=0.5
+	FloatDefault float64 `json:",omitempty"`
+
+	// +default=0.0
+	FloatEmptyDefault float64 `json:",omitempty"`
+
+	FloatEmpty float64 `json:",omitempty"`
+
+	// +default=["foo", "bar"]
+	List []Item `json:",omitempty"`
+	// +default={"s": "foo", "i": 5}
+	Sub *SubStruct `json:",omitempty"`
+
+	//+default=[{"s": "foo1", "i": 1}, {"s": "foo2"}]
+	StructList []SubStruct `json:",omitempty"`
+
+	//+default=[{"s": "foo1", "i": 1}, {"s": "foo2"}]
+	PtrStructList []*SubStruct `json:",omitempty"`
+
+	//+default=["foo"]
+	StringList []string `json:",omitempty"`
+
+	// Default is forced to empty struct
+	OtherSub SubStruct `json:",omitempty"`
+
+	// +default={"foo": "bar"}
+	Map map[string]Item `json:",omitempty"`
+
+	// +default={"foo": {"S": "string", "I": 1}}
+	StructMap map[string]SubStruct `json:",omitempty"`
+
+	// +default={"foo": {"S": "string", "I": 1}}
+	PtrStructMap map[string]*SubStruct `json:",omitempty"`
+
+	// A default specified here overrides the default for the Item type
+	// +default="banana"
+	AliasPtr Item `json:",omitempty"`
+}
+
+const SomeDefault = "ACoolConstant"
+
+// +default="apple"
+type Item *string
+
+type ValueItem string
+
+// +default=ref(SomeValue)
+type DefaultedValueItem ValueItem
+type PointerValueItem *DefaultedValueItem
+
+type ItemDefaultWiped Item
+
+const SomeValue ValueItem = "Value"
+
+type SubStruct struct {
+	S string
+	// +default=1
+	I int `json:"I,omitempty"`
+}
+
+type DefaultedWithFunction struct {
+	empty.TypeMeta
+	// +default="default_marker"
+	S1 string `json:"S1,omitempty"`
+	// +default="default_marker"
+	S2 string `json:"S2,omitempty"`
+}
+
+type DefaultedWithReference struct {
+	empty.TypeMeta
+
+	// Shows that if we have an alias that is a pointer and have a default
+	// that is a value convertible to that pointer we can still use it
+	// +default=ref(SomeValue)
+	AliasConvertDefaultPointer PointerValueItem
+
+	// Shows that default defined on a nested type is not respected through
+	// an alias
+	AliasWipedDefault ItemDefaultWiped
+
+	// A default defined on a pointer-valued alias is respected
+	PointerAliasDefault Item
+
+	// Can have alias that is a pointer to type of constant
+	// +default=ref(SomeDefault)
+	AliasPointerInside Item
+
+	// Can override default specified on an alias
+	// +default=ref(SomeDefault)
+	AliasOverride Item
+
+	// Type-level default is not respected unless a pointer
+	AliasNonPointerDefault DefaultedValueItem `json:",omitempty"`
+
+	// Type-level default is not respected unless a pointer
+	AliasPointerDefault *DefaultedValueItem
+
+	// Can have value typed alias
+	// +default=ref(SomeValue)
+	AliasNonPointer ValueItem `json:",omitempty"`
+
+	// Can have a pointer to an alias whose default is a non-pointer value
+	// +default=ref(SomeValue)
+	AliasPointer *ValueItem `json:",omitempty"`
+
+	// Basic ref usage example
+	// +default=ref(SomeDefault)
+	SymbolReference string `json:",omitempty"`
+
+	// +default=ref(k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external.AConstant)
+	SameNamePackageSymbolReference1 string `json:",omitempty"`
+
+	// +default=ref(k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external/external.AnotherConstant)
+	SameNamePackageSymbolReference2 string `json:",omitempty"`
+
+	// Should convert ValueItem -> string then up to B4 through addressOf and
+	// casting
+	// +default=ref(SomeValue)
+	PointerConversion *B4
+
+	// +default=ref(SomeValue)
+	PointerConversionValue B4
+
+	// +default=ref(k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker.SomeValue)
+	FullyQualifiedLocalSymbol string
+
+	// Construction of external3.StringPointer requires importing external2
+	// Test that generator can handle it
+	// +default=ref(SomeValue)
+	ImportFromAliasCast external3.StringPointer
+}
+
+// Super complicated hierarchy of aliases which includes multiple pointers,
+// and sibling types.
+type B0 *string
+type B1 B0
+type B2 *B1
+type B3 ****B2
+type B4 **B3
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/zz_generated.defaults.go
new file mode 100644
index 0000000000..0add63d4cd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/zz_generated.defaults.go
@@ -0,0 +1,325 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package marker
+
+import (
+	json "encoding/json"
+
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	external "k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external"
+	externalexternal "k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external/external"
+	external2 "k8s.io/code-generator/cmd/defaulter-gen/output_tests/marker/external2"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	scheme.AddTypeDefaultingFunc(&Defaulted{}, func(obj interface{}) { SetObjectDefaults_Defaulted(obj.(*Defaulted)) })
+	scheme.AddTypeDefaultingFunc(&DefaultedOmitempty{}, func(obj interface{}) { SetObjectDefaults_DefaultedOmitempty(obj.(*DefaultedOmitempty)) })
+	scheme.AddTypeDefaultingFunc(&DefaultedWithFunction{}, func(obj interface{}) { SetObjectDefaults_DefaultedWithFunction(obj.(*DefaultedWithFunction)) })
+	scheme.AddTypeDefaultingFunc(&DefaultedWithReference{}, func(obj interface{}) { SetObjectDefaults_DefaultedWithReference(obj.(*DefaultedWithReference)) })
+	return nil
+}
+
+func SetObjectDefaults_Defaulted(in *Defaulted) {
+	if in.StringDefault == "" {
+		in.StringDefault = "bar"
+	}
+	if in.StringPointer == nil {
+		var ptrVar1 string = "default"
+		in.StringPointer = &ptrVar1
+	}
+	if in.Int64 == nil {
+		var ptrVar1 int64 = 64
+		in.Int64 = &ptrVar1
+	}
+	if in.Int32 == nil {
+		var ptrVar1 int32 = 32
+		in.Int32 = &ptrVar1
+	}
+	if in.IntDefault == 0 {
+		in.IntDefault = 1
+	}
+	if in.FloatDefault == 0 {
+		in.FloatDefault = 0.5
+	}
+	if in.List == nil {
+		if err := json.Unmarshal([]byte(`["foo", "bar"]`), &in.List); err != nil {
+			panic(err)
+		}
+	}
+	for i := range in.List {
+		if in.List[i] == nil {
+			var ptrVar1 string = "apple"
+			in.List[i] = &ptrVar1
+		}
+	}
+	if in.Sub == nil {
+		if err := json.Unmarshal([]byte(`{"s": "foo", "i": 5}`), &in.Sub); err != nil {
+			panic(err)
+		}
+	}
+	if in.Sub != nil {
+		if in.Sub.I == 0 {
+			in.Sub.I = 1
+		}
+	}
+	if in.StructList == nil {
+		if err := json.Unmarshal([]byte(`[{"s": "foo1", "i": 1}, {"s": "foo2"}]`), &in.StructList); err != nil {
+			panic(err)
+		}
+	}
+	for i := range in.StructList {
+		a := &in.StructList[i]
+		if a.I == 0 {
+			a.I = 1
+		}
+	}
+	if in.PtrStructList == nil {
+		if err := json.Unmarshal([]byte(`[{"s": "foo1", "i": 1}, {"s": "foo2"}]`), &in.PtrStructList); err != nil {
+			panic(err)
+		}
+	}
+	for i := range in.PtrStructList {
+		a := in.PtrStructList[i]
+		if a != nil {
+			if a.I == 0 {
+				a.I = 1
+			}
+		}
+	}
+	if in.StringList == nil {
+		if err := json.Unmarshal([]byte(`["foo"]`), &in.StringList); err != nil {
+			panic(err)
+		}
+	}
+	if in.OtherSub.I == 0 {
+		in.OtherSub.I = 1
+	}
+	if in.Map == nil {
+		if err := json.Unmarshal([]byte(`{"foo": "bar"}`), &in.Map); err != nil {
+			panic(err)
+		}
+	}
+	for i_Map := range in.Map {
+		if in.Map[i_Map] == nil {
+			var ptrVar1 string = "apple"
+			in.Map[i_Map] = &ptrVar1
+		}
+	}
+	if in.StructMap == nil {
+		if err := json.Unmarshal([]byte(`{"foo": {"S": "string", "I": 1}}`), &in.StructMap); err != nil {
+			panic(err)
+		}
+	}
+	if in.PtrStructMap == nil {
+		if err := json.Unmarshal([]byte(`{"foo": {"S": "string", "I": 1}}`), &in.PtrStructMap); err != nil {
+			panic(err)
+		}
+	}
+	if in.AliasPtr == nil {
+		var ptrVar1 string = "banana"
+		in.AliasPtr = &ptrVar1
+	}
+}
+
+func SetObjectDefaults_DefaultedOmitempty(in *DefaultedOmitempty) {
+	if in.StringDefault == "" {
+		in.StringDefault = "bar"
+	}
+	if in.StringPointer == nil {
+		var ptrVar1 string = "default"
+		in.StringPointer = &ptrVar1
+	}
+	if in.Int64 == nil {
+		var ptrVar1 int64 = 64
+		in.Int64 = &ptrVar1
+	}
+	if in.Int32 == nil {
+		var ptrVar1 int32 = 32
+		in.Int32 = &ptrVar1
+	}
+	if in.IntDefault == 0 {
+		in.IntDefault = 1
+	}
+	if in.FloatDefault == 0 {
+		in.FloatDefault = 0.5
+	}
+	if in.List == nil {
+		if err := json.Unmarshal([]byte(`["foo", "bar"]`), &in.List); err != nil {
+			panic(err)
+		}
+	}
+	for i := range in.List {
+		if in.List[i] == nil {
+			var ptrVar1 string = "apple"
+			in.List[i] = &ptrVar1
+		}
+	}
+	if in.Sub == nil {
+		if err := json.Unmarshal([]byte(`{"s": "foo", "i": 5}`), &in.Sub); err != nil {
+			panic(err)
+		}
+	}
+	if in.Sub != nil {
+		if in.Sub.I == 0 {
+			in.Sub.I = 1
+		}
+	}
+	if in.StructList == nil {
+		if err := json.Unmarshal([]byte(`[{"s": "foo1", "i": 1}, {"s": "foo2"}]`), &in.StructList); err != nil {
+			panic(err)
+		}
+	}
+	for i := range in.StructList {
+		a := &in.StructList[i]
+		if a.I == 0 {
+			a.I = 1
+		}
+	}
+	if in.PtrStructList == nil {
+		if err := json.Unmarshal([]byte(`[{"s": "foo1", "i": 1}, {"s": "foo2"}]`), &in.PtrStructList); err != nil {
+			panic(err)
+		}
+	}
+	for i := range in.PtrStructList {
+		a := in.PtrStructList[i]
+		if a != nil {
+			if a.I == 0 {
+				a.I = 1
+			}
+		}
+	}
+	if in.StringList == nil {
+		if err := json.Unmarshal([]byte(`["foo"]`), &in.StringList); err != nil {
+			panic(err)
+		}
+	}
+	if in.OtherSub.I == 0 {
+		in.OtherSub.I = 1
+	}
+	if in.Map == nil {
+		if err := json.Unmarshal([]byte(`{"foo": "bar"}`), &in.Map); err != nil {
+			panic(err)
+		}
+	}
+	for i_Map := range in.Map {
+		if in.Map[i_Map] == nil {
+			var ptrVar1 string = "apple"
+			in.Map[i_Map] = &ptrVar1
+		}
+	}
+	if in.StructMap == nil {
+		if err := json.Unmarshal([]byte(`{"foo": {"S": "string", "I": 1}}`), &in.StructMap); err != nil {
+			panic(err)
+		}
+	}
+	if in.PtrStructMap == nil {
+		if err := json.Unmarshal([]byte(`{"foo": {"S": "string", "I": 1}}`), &in.PtrStructMap); err != nil {
+			panic(err)
+		}
+	}
+	if in.AliasPtr == nil {
+		var ptrVar1 string = "banana"
+		in.AliasPtr = &ptrVar1
+	}
+}
+
+func SetObjectDefaults_DefaultedWithFunction(in *DefaultedWithFunction) {
+	SetDefaults_DefaultedWithFunction(in)
+	if in.S1 == "" {
+		in.S1 = "default_marker"
+	}
+	if in.S2 == "" {
+		in.S2 = "default_marker"
+	}
+}
+
+func SetObjectDefaults_DefaultedWithReference(in *DefaultedWithReference) {
+	if in.AliasConvertDefaultPointer == nil {
+		ptrVar1 := DefaultedValueItem(SomeValue)
+		in.AliasConvertDefaultPointer = &ptrVar1
+	}
+	if in.PointerAliasDefault == nil {
+		var ptrVar1 string = "apple"
+		in.PointerAliasDefault = &ptrVar1
+	}
+	if in.AliasPointerInside == nil {
+		ptrVar1 := string(SomeDefault)
+		in.AliasPointerInside = &ptrVar1
+	}
+	if in.AliasOverride == nil {
+		ptrVar1 := string(SomeDefault)
+		in.AliasOverride = &ptrVar1
+	}
+	if in.AliasPointerDefault == nil {
+		ptrVar1 := DefaultedValueItem(SomeValue)
+		in.AliasPointerDefault = &ptrVar1
+	}
+	if in.AliasNonPointer == "" {
+		in.AliasNonPointer = ValueItem(SomeValue)
+	}
+	if in.AliasPointer == nil {
+		ptrVar1 := ValueItem(SomeValue)
+		in.AliasPointer = &ptrVar1
+	}
+	if in.SymbolReference == "" {
+		in.SymbolReference = string(SomeDefault)
+	}
+	if in.SameNamePackageSymbolReference1 == "" {
+		in.SameNamePackageSymbolReference1 = string(external.AConstant)
+	}
+	if in.SameNamePackageSymbolReference2 == "" {
+		in.SameNamePackageSymbolReference2 = string(externalexternal.AnotherConstant)
+	}
+	if in.PointerConversion == nil {
+		ptrVar9 := string(SomeValue)
+		ptrVar8 := &ptrVar9
+		ptrVar7 := (*B1)(&ptrVar8)
+		ptrVar6 := (*B2)(&ptrVar7)
+		ptrVar5 := &ptrVar6
+		ptrVar4 := &ptrVar5
+		ptrVar3 := &ptrVar4
+		ptrVar2 := (*B3)(&ptrVar3)
+		ptrVar1 := &ptrVar2
+		in.PointerConversion = (*B4)(&ptrVar1)
+	}
+	if in.PointerConversionValue == nil {
+		ptrVar8 := string(SomeValue)
+		ptrVar7 := &ptrVar8
+		ptrVar6 := (*B1)(&ptrVar7)
+		ptrVar5 := (*B2)(&ptrVar6)
+		ptrVar4 := &ptrVar5
+		ptrVar3 := &ptrVar4
+		ptrVar2 := &ptrVar3
+		ptrVar1 := (*B3)(&ptrVar2)
+		in.PointerConversionValue = &ptrVar1
+	}
+	if in.FullyQualifiedLocalSymbol == "" {
+		in.FullyQualifiedLocalSymbol = string(SomeValue)
+	}
+	if in.ImportFromAliasCast == nil {
+		ptrVar1 := external2.String(SomeValue)
+		in.ImportFromAliasCast = &ptrVar1
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/pointer/defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/pointer/defaults.go
new file mode 100644
index 0000000000..e656f5037c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/pointer/defaults.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package pointer
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+//nolint:unused
+func addDefaultingFuncs(scheme *runtime.Scheme) error {
+	return RegisterDefaults(scheme)
+}
+
+func SetDefaults_Tpointer(obj *Tpointer) {
+	if obj.BoolField == nil {
+		obj.BoolField = new(bool)
+		*obj.BoolField = true
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/pointer/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/pointer/doc.go
new file mode 100644
index 0000000000..4e2e7d7e0f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/pointer/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:defaulter-gen=TypeMeta
+
+// This is a test package.
+package pointer
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/pointer/fake_deepcopy_conversion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/pointer/fake_deepcopy_conversion.go
new file mode 100644
index 0000000000..c74e764bb8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/pointer/fake_deepcopy_conversion.go
@@ -0,0 +1,82 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package pointer
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Tpointer) DeepCopyInto(out *Tpointer) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.BoolField != nil {
+		in, out := &in.BoolField, &out.BoolField
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Tpointer.
+func (in *Tpointer) DeepCopy() *Tpointer {
+	if in == nil {
+		return nil
+	}
+	out := new(Tpointer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *Tpointer) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Ttest) DeepCopyInto(out *Ttest) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.NTP.DeepCopyInto(&out.NTP)
+	if in.Tp != nil {
+		in, out := &in.Tp, &out.Tp
+		*out = new(Tpointer)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Ttest.
+func (in *Ttest) DeepCopy() *Ttest {
+	if in == nil {
+		return nil
+	}
+	out := new(Ttest)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *Ttest) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+func (in *Tpointer) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+func (in *Ttest) GetObjectKind() schema.ObjectKind    { return schema.EmptyObjectKind }
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/pointer/type.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/pointer/type.go
new file mode 100644
index 0000000000..5398a42aae
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/pointer/type.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package pointer
+
+import (
+	"k8s.io/code-generator/cmd/defaulter-gen/output_tests/empty"
+)
+
+type Tpointer struct {
+	empty.TypeMeta
+	BoolField *bool
+}
+
+// Only test
+type Ttest struct {
+	empty.TypeMeta
+	NTP Tpointer
+	Tp  *Tpointer
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/pointer/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/pointer/zz_generated.defaults.go
new file mode 100644
index 0000000000..8bee913dbf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/pointer/zz_generated.defaults.go
@@ -0,0 +1,46 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package pointer
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	scheme.AddTypeDefaultingFunc(&Tpointer{}, func(obj interface{}) { SetObjectDefaults_Tpointer(obj.(*Tpointer)) })
+	scheme.AddTypeDefaultingFunc(&Ttest{}, func(obj interface{}) { SetObjectDefaults_Ttest(obj.(*Ttest)) })
+	return nil
+}
+
+func SetObjectDefaults_Tpointer(in *Tpointer) {
+	SetDefaults_Tpointer(in)
+}
+
+func SetObjectDefaults_Ttest(in *Ttest) {
+	SetObjectDefaults_Tpointer(&in.NTP)
+	if in.Tp != nil {
+		SetObjectDefaults_Tpointer(in.Tp)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/slices/defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/slices/defaults.go
new file mode 100644
index 0000000000..21a2ee25c3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/slices/defaults.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package slices
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+//nolint:unused
+func addDefaultingFuncs(scheme *runtime.Scheme) error {
+	return RegisterDefaults(scheme)
+}
+
+func SetDefaults_Ttest(obj *Ttest) {
+	if obj.BoolField == nil {
+		obj.BoolField = new(bool)
+		*obj.BoolField = true
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/slices/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/slices/doc.go
new file mode 100644
index 0000000000..39e61fb390
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/slices/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:defaulter-gen=TypeMeta
+
+// This is a test package.
+package slices
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/slices/fake_deepcopy_conversion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/slices/fake_deepcopy_conversion.go
new file mode 100644
index 0000000000..ab07e3da7c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/slices/fake_deepcopy_conversion.go
@@ -0,0 +1,118 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package slices
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Ttest) DeepCopyInto(out *Ttest) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.BoolField != nil {
+		in, out := &in.BoolField, &out.BoolField
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Ttest.
+func (in *Ttest) DeepCopy() *Ttest {
+	if in == nil {
+		return nil
+	}
+	out := new(Ttest)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *Ttest) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TtestList) DeepCopyInto(out *TtestList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Ttest, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TtestList.
+func (in *TtestList) DeepCopy() *TtestList {
+	if in == nil {
+		return nil
+	}
+	out := new(TtestList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *TtestList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TtestPointerList) DeepCopyInto(out *TtestPointerList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]*Ttest, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(Ttest)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TtestPointerList.
+func (in *TtestPointerList) DeepCopy() *TtestPointerList {
+	if in == nil {
+		return nil
+	}
+	out := new(TtestPointerList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *TtestPointerList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+func (in *Ttest) GetObjectKind() schema.ObjectKind            { return schema.EmptyObjectKind }
+func (in *TtestList) GetObjectKind() schema.ObjectKind        { return schema.EmptyObjectKind }
+func (in *TtestPointerList) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/slices/type.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/slices/type.go
new file mode 100644
index 0000000000..0b0a79f4f6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/slices/type.go
@@ -0,0 +1,37 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package slices
+
+import (
+	"k8s.io/code-generator/cmd/defaulter-gen/output_tests/empty"
+)
+
+// Only test
+type Ttest struct {
+	empty.TypeMeta
+	BoolField *bool
+}
+
+type TtestList struct {
+	empty.TypeMeta
+	Items []Ttest
+}
+
+type TtestPointerList struct {
+	empty.TypeMeta
+	Items []*Ttest
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/slices/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/slices/zz_generated.defaults.go
new file mode 100644
index 0000000000..a7d6e2678f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/slices/zz_generated.defaults.go
@@ -0,0 +1,56 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package slices
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	scheme.AddTypeDefaultingFunc(&Ttest{}, func(obj interface{}) { SetObjectDefaults_Ttest(obj.(*Ttest)) })
+	scheme.AddTypeDefaultingFunc(&TtestList{}, func(obj interface{}) { SetObjectDefaults_TtestList(obj.(*TtestList)) })
+	scheme.AddTypeDefaultingFunc(&TtestPointerList{}, func(obj interface{}) { SetObjectDefaults_TtestPointerList(obj.(*TtestPointerList)) })
+	return nil
+}
+
+func SetObjectDefaults_Ttest(in *Ttest) {
+	SetDefaults_Ttest(in)
+}
+
+func SetObjectDefaults_TtestList(in *TtestList) {
+	for i := range in.Items {
+		a := &in.Items[i]
+		SetObjectDefaults_Ttest(a)
+	}
+}
+
+func SetObjectDefaults_TtestPointerList(in *TtestPointerList) {
+	for i := range in.Items {
+		a := in.Items[i]
+		if a != nil {
+			SetObjectDefaults_Ttest(a)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/wholepkg/defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/wholepkg/defaults.go
new file mode 100644
index 0000000000..bcfdde1a32
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/wholepkg/defaults.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wholepkg
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+//nolint:unused
+func addDefaultingFuncs(scheme *runtime.Scheme) error {
+	return RegisterDefaults(scheme)
+}
+
+func SetDefaults_StructPrimitives(obj *StructPrimitives) {
+	if obj.BoolField == nil {
+		obj.BoolField = new(bool)
+		*obj.BoolField = true
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/wholepkg/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/wholepkg/doc.go
new file mode 100644
index 0000000000..7e9a651f35
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/wholepkg/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:defaulter-gen=TypeMeta
+
+// This is a test package.
+package wholepkg
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/wholepkg/fake_deepcopy_conversion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/wholepkg/fake_deepcopy_conversion.go
new file mode 100644
index 0000000000..e896bf7268
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/wholepkg/fake_deepcopy_conversion.go
@@ -0,0 +1,315 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wholepkg
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructEverything) DeepCopyInto(out *StructEverything) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.BoolPtrField != nil {
+		in, out := &in.BoolPtrField, &out.BoolPtrField
+		*out = new(bool)
+		**out = **in
+	}
+	if in.IntPtrField != nil {
+		in, out := &in.IntPtrField, &out.IntPtrField
+		*out = new(int)
+		**out = **in
+	}
+	if in.StringPtrField != nil {
+		in, out := &in.StringPtrField, &out.StringPtrField
+		*out = new(string)
+		**out = **in
+	}
+	if in.FloatPtrField != nil {
+		in, out := &in.FloatPtrField, &out.FloatPtrField
+		*out = new(float64)
+		**out = **in
+	}
+	in.PointerStructField.DeepCopyInto(&out.PointerStructField)
+	if in.SliceBoolField != nil {
+		in, out := &in.SliceBoolField, &out.SliceBoolField
+		*out = make([]bool, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceByteField != nil {
+		in, out := &in.SliceByteField, &out.SliceByteField
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceIntField != nil {
+		in, out := &in.SliceIntField, &out.SliceIntField
+		*out = make([]int, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceStringField != nil {
+		in, out := &in.SliceStringField, &out.SliceStringField
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceFloatField != nil {
+		in, out := &in.SliceFloatField, &out.SliceFloatField
+		*out = make([]float64, len(*in))
+		copy(*out, *in)
+	}
+	in.SlicesStructField.DeepCopyInto(&out.SlicesStructField)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructEverything.
+func (in *StructEverything) DeepCopy() *StructEverything {
+	if in == nil {
+		return nil
+	}
+	out := new(StructEverything)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *StructEverything) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructPointer) DeepCopyInto(out *StructPointer) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.PointerStructPrimitivesField.DeepCopyInto(&out.PointerStructPrimitivesField)
+	if in.PointerPointerStructPrimitivesField != nil {
+		in, out := &in.PointerPointerStructPrimitivesField, &out.PointerPointerStructPrimitivesField
+		*out = new(StructPrimitives)
+		(*in).DeepCopyInto(*out)
+	}
+	in.PointerStructPrimitivesAliasField.DeepCopyInto(&out.PointerStructPrimitivesAliasField)
+	in.PointerPointerStructPrimitivesAliasField.DeepCopyInto(&out.PointerPointerStructPrimitivesAliasField)
+	in.PointerStructStructPrimitives.DeepCopyInto(&out.PointerStructStructPrimitives)
+	if in.PointerPointerStructStructPrimitives != nil {
+		in, out := &in.PointerPointerStructStructPrimitives, &out.PointerPointerStructStructPrimitives
+		*out = new(StructStructPrimitives)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructPointer.
+func (in *StructPointer) DeepCopy() *StructPointer {
+	if in == nil {
+		return nil
+	}
+	out := new(StructPointer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *StructPointer) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructPrimitives) DeepCopyInto(out *StructPrimitives) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.BoolField != nil {
+		in, out := &in.BoolField, &out.BoolField
+		*out = new(bool)
+		**out = **in
+	}
+	if in.IntField != nil {
+		in, out := &in.IntField, &out.IntField
+		*out = new(int)
+		**out = **in
+	}
+	if in.StringField != nil {
+		in, out := &in.StringField, &out.StringField
+		*out = new(string)
+		**out = **in
+	}
+	if in.FloatField != nil {
+		in, out := &in.FloatField, &out.FloatField
+		*out = new(float64)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructPrimitives.
+func (in *StructPrimitives) DeepCopy() *StructPrimitives {
+	if in == nil {
+		return nil
+	}
+	out := new(StructPrimitives)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *StructPrimitives) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructPrimitivesAlias) DeepCopyInto(out *StructPrimitivesAlias) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.BoolField != nil {
+		in, out := &in.BoolField, &out.BoolField
+		*out = new(bool)
+		**out = **in
+	}
+	if in.IntField != nil {
+		in, out := &in.IntField, &out.IntField
+		*out = new(int)
+		**out = **in
+	}
+	if in.StringField != nil {
+		in, out := &in.StringField, &out.StringField
+		*out = new(string)
+		**out = **in
+	}
+	if in.FloatField != nil {
+		in, out := &in.FloatField, &out.FloatField
+		*out = new(float64)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructPrimitivesAlias.
+func (in *StructPrimitivesAlias) DeepCopy() *StructPrimitivesAlias {
+	if in == nil {
+		return nil
+	}
+	out := new(StructPrimitivesAlias)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructSlices) DeepCopyInto(out *StructSlices) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.SliceStructPrimitivesField != nil {
+		in, out := &in.SliceStructPrimitivesField, &out.SliceStructPrimitivesField
+		*out = make([]StructPrimitives, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.SlicePointerStructPrimitivesField != nil {
+		in, out := &in.SlicePointerStructPrimitivesField, &out.SlicePointerStructPrimitivesField
+		*out = make([]*StructPrimitives, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(StructPrimitives)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.SliceStructPrimitivesAliasField != nil {
+		in, out := &in.SliceStructPrimitivesAliasField, &out.SliceStructPrimitivesAliasField
+		*out = make([]StructPrimitivesAlias, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.SlicePointerStructPrimitivesAliasField != nil {
+		in, out := &in.SlicePointerStructPrimitivesAliasField, &out.SlicePointerStructPrimitivesAliasField
+		*out = make([]*StructPrimitivesAlias, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(StructPrimitivesAlias)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.SliceStructStructPrimitives != nil {
+		in, out := &in.SliceStructStructPrimitives, &out.SliceStructStructPrimitives
+		*out = make([]StructStructPrimitives, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.SlicePointerStructStructPrimitives != nil {
+		in, out := &in.SlicePointerStructStructPrimitives, &out.SlicePointerStructStructPrimitives
+		*out = make([]*StructStructPrimitives, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(StructStructPrimitives)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructSlices.
+func (in *StructSlices) DeepCopy() *StructSlices {
+	if in == nil {
+		return nil
+	}
+	out := new(StructSlices)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *StructSlices) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StructStructPrimitives) DeepCopyInto(out *StructStructPrimitives) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.StructField.DeepCopyInto(&out.StructField)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StructStructPrimitives.
+func (in *StructStructPrimitives) DeepCopy() *StructStructPrimitives {
+	if in == nil {
+		return nil
+	}
+	out := new(StructStructPrimitives)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *StructStructPrimitives) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+func (in *StructEverything) GetObjectKind() schema.ObjectKind       { return schema.EmptyObjectKind }
+func (in *StructPointer) GetObjectKind() schema.ObjectKind          { return schema.EmptyObjectKind }
+func (in *StructPrimitives) GetObjectKind() schema.ObjectKind       { return schema.EmptyObjectKind }
+func (in *StructSlices) GetObjectKind() schema.ObjectKind           { return schema.EmptyObjectKind }
+func (in *StructStructPrimitives) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/wholepkg/type.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/wholepkg/type.go
new file mode 100644
index 0000000000..80a83b7465
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/wholepkg/type.go
@@ -0,0 +1,74 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wholepkg
+
+import (
+	"k8s.io/code-generator/cmd/defaulter-gen/output_tests/empty"
+)
+
+// Only primitives
+type StructPrimitives struct {
+	empty.TypeMeta
+	BoolField   *bool
+	IntField    *int
+	StringField *string
+	FloatField  *float64
+}
+type StructPrimitivesAlias StructPrimitives
+
+type StructStructPrimitives struct {
+	empty.TypeMeta
+	StructField StructPrimitives
+}
+
+// Pointer
+type StructPointer struct {
+	empty.TypeMeta
+	PointerStructPrimitivesField             StructPrimitives
+	PointerPointerStructPrimitivesField      *StructPrimitives
+	PointerStructPrimitivesAliasField        StructPrimitivesAlias
+	PointerPointerStructPrimitivesAliasField StructPrimitivesAlias
+	PointerStructStructPrimitives            StructStructPrimitives
+	PointerPointerStructStructPrimitives     *StructStructPrimitives
+}
+
+// Slices
+type StructSlices struct {
+	empty.TypeMeta
+	SliceStructPrimitivesField             []StructPrimitives
+	SlicePointerStructPrimitivesField      []*StructPrimitives
+	SliceStructPrimitivesAliasField        []StructPrimitivesAlias
+	SlicePointerStructPrimitivesAliasField []*StructPrimitivesAlias
+	SliceStructStructPrimitives            []StructStructPrimitives
+	SlicePointerStructStructPrimitives     []*StructStructPrimitives
+}
+
+// Everything
+type StructEverything struct {
+	empty.TypeMeta
+	BoolPtrField       *bool
+	IntPtrField        *int
+	StringPtrField     *string
+	FloatPtrField      *float64
+	PointerStructField StructPointer
+	SliceBoolField     []bool
+	SliceByteField     []byte
+	SliceIntField      []int
+	SliceStringField   []string
+	SliceFloatField    []float64
+	SlicesStructField  StructSlices
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/wholepkg/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/wholepkg/zz_generated.defaults.go
new file mode 100644
index 0000000000..26c7991bde
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/defaulter-gen/output_tests/wholepkg/zz_generated.defaults.go
@@ -0,0 +1,85 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package wholepkg
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	scheme.AddTypeDefaultingFunc(&StructEverything{}, func(obj interface{}) { SetObjectDefaults_StructEverything(obj.(*StructEverything)) })
+	scheme.AddTypeDefaultingFunc(&StructPointer{}, func(obj interface{}) { SetObjectDefaults_StructPointer(obj.(*StructPointer)) })
+	scheme.AddTypeDefaultingFunc(&StructPrimitives{}, func(obj interface{}) { SetObjectDefaults_StructPrimitives(obj.(*StructPrimitives)) })
+	scheme.AddTypeDefaultingFunc(&StructSlices{}, func(obj interface{}) { SetObjectDefaults_StructSlices(obj.(*StructSlices)) })
+	scheme.AddTypeDefaultingFunc(&StructStructPrimitives{}, func(obj interface{}) { SetObjectDefaults_StructStructPrimitives(obj.(*StructStructPrimitives)) })
+	return nil
+}
+
+func SetObjectDefaults_StructEverything(in *StructEverything) {
+	SetObjectDefaults_StructPointer(&in.PointerStructField)
+	SetObjectDefaults_StructSlices(&in.SlicesStructField)
+}
+
+func SetObjectDefaults_StructPointer(in *StructPointer) {
+	SetObjectDefaults_StructPrimitives(&in.PointerStructPrimitivesField)
+	if in.PointerPointerStructPrimitivesField != nil {
+		SetObjectDefaults_StructPrimitives(in.PointerPointerStructPrimitivesField)
+	}
+	SetObjectDefaults_StructStructPrimitives(&in.PointerStructStructPrimitives)
+	if in.PointerPointerStructStructPrimitives != nil {
+		SetObjectDefaults_StructStructPrimitives(in.PointerPointerStructStructPrimitives)
+	}
+}
+
+func SetObjectDefaults_StructPrimitives(in *StructPrimitives) {
+	SetDefaults_StructPrimitives(in)
+}
+
+func SetObjectDefaults_StructSlices(in *StructSlices) {
+	for i := range in.SliceStructPrimitivesField {
+		a := &in.SliceStructPrimitivesField[i]
+		SetObjectDefaults_StructPrimitives(a)
+	}
+	for i := range in.SlicePointerStructPrimitivesField {
+		a := in.SlicePointerStructPrimitivesField[i]
+		if a != nil {
+			SetObjectDefaults_StructPrimitives(a)
+		}
+	}
+	for i := range in.SliceStructStructPrimitives {
+		a := &in.SliceStructStructPrimitives[i]
+		SetObjectDefaults_StructStructPrimitives(a)
+	}
+	for i := range in.SlicePointerStructStructPrimitives {
+		a := in.SlicePointerStructStructPrimitives[i]
+		if a != nil {
+			SetObjectDefaults_StructStructPrimitives(a)
+		}
+	}
+}
+
+func SetObjectDefaults_StructStructPrimitives(in *StructStructPrimitives) {
+	SetObjectDefaults_StructPrimitives(&in.StructField)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/.gitignore b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/.gitignore
new file mode 100644
index 0000000000..0e9aa466bb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/.gitignore
@@ -0,0 +1 @@
+go-to-protobuf
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/OWNERS b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/OWNERS
new file mode 100644
index 0000000000..af7e2ec4c7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/OWNERS
@@ -0,0 +1,6 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+  - smarterclayton
+reviewers:
+  - smarterclayton
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/main.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/main.go
new file mode 100644
index 0000000000..009973389b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/main.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// go-to-protobuf generates a Protobuf IDL from a Go struct, respecting any
+// existing IDL tags on the Go struct.
+package main
+
+import (
+	goflag "flag"
+
+	flag "github.com/spf13/pflag"
+	"k8s.io/code-generator/cmd/go-to-protobuf/protobuf"
+	"k8s.io/klog/v2"
+)
+
+var g = protobuf.New()
+
+func init() {
+	klog.InitFlags(nil)
+	g.BindFlags(flag.CommandLine)
+	goflag.Set("logtostderr", "true")
+	flag.CommandLine.AddGoFlagSet(goflag.CommandLine)
+}
+
+func main() {
+	flag.Parse()
+	protobuf.Run(g)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/cmd.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/cmd.go
new file mode 100644
index 0000000000..067dfed0c1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/cmd.go
@@ -0,0 +1,465 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// go-to-protobuf generates a Protobuf IDL from a Go struct, respecting any
+// existing IDL tags on the Go struct.
+package protobuf
+
+import (
+	"bytes"
+	"fmt"
+	"log"
+	"os/exec"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	flag "github.com/spf13/pflag"
+
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/parser"
+	"k8s.io/gengo/v2/types"
+)
+
+type Generator struct {
+	GoHeaderFile         string
+	APIMachineryPackages string
+	Packages             string
+	OutputDir            string
+	ProtoImport          []string
+	Conditional          string
+	Clean                bool
+	OnlyIDL              bool
+	KeepGogoproto        bool
+	DropGogoGo           bool
+	SkipGeneratedRewrite bool
+	DropEmbeddedFields   string
+}
+
+func New() *Generator {
+	defaultSourceTree := "."
+	return &Generator{
+		OutputDir: defaultSourceTree,
+		APIMachineryPackages: strings.Join([]string{
+			`+k8s.io/apimachinery/pkg/util/intstr`,
+			`+k8s.io/apimachinery/pkg/api/resource`,
+			`+k8s.io/apimachinery/pkg/runtime/schema`,
+			`+k8s.io/apimachinery/pkg/runtime`,
+			`k8s.io/apimachinery/pkg/apis/meta/v1`,
+			`k8s.io/apimachinery/pkg/apis/meta/v1beta1`,
+			`k8s.io/apimachinery/pkg/apis/testapigroup/v1`,
+		}, ","),
+		Packages:           "",
+		DropEmbeddedFields: "k8s.io/apimachinery/pkg/apis/meta/v1.TypeMeta",
+		DropGogoGo:         true,
+	}
+}
+
+func (g *Generator) BindFlags(flag *flag.FlagSet) {
+	flag.StringVarP(&g.GoHeaderFile, "go-header-file", "h", "", "File containing boilerplate header text. The string YEAR will be replaced with the current 4-digit year.")
+	flag.StringVarP(&g.Packages, "packages", "p", g.Packages, "comma-separated list of directories to get input types from. Directories prefixed with '-' are not generated, directories prefixed with '+' only create types with explicit IDL instructions.")
+	flag.StringVar(&g.APIMachineryPackages, "apimachinery-packages", g.APIMachineryPackages, "comma-separated list of directories to get apimachinery input types from which are needed by any API. Directories prefixed with '-' are not generated, directories prefixed with '+' only create types with explicit IDL instructions.")
+	flag.StringVar(&g.OutputDir, "output-dir", g.OutputDir, "The base directory under which to generate results.")
+	flag.StringSliceVar(&g.ProtoImport, "proto-import", g.ProtoImport, "A search path for imported protobufs (may be repeated).")
+	flag.StringVar(&g.Conditional, "conditional", g.Conditional, "An optional Golang build tag condition to add to the generated Go code")
+	flag.BoolVar(&g.Clean, "clean", g.Clean, "If true, remove all generated files for the specified Packages.")
+	flag.BoolVar(&g.OnlyIDL, "only-idl", g.OnlyIDL, "If true, only generate the IDL for each package.")
+	flag.BoolVar(&g.KeepGogoproto, "keep-gogoproto", g.KeepGogoproto, "If true, the generated IDL will contain gogoprotobuf extensions which are normally removed")
+	flag.BoolVar(&g.SkipGeneratedRewrite, "skip-generated-rewrite", g.SkipGeneratedRewrite, "If true, skip fixing up the generated.pb.go file (debugging only).")
+	flag.BoolVar(&g.DropGogoGo, "drop-gogo-go", g.DropGogoGo, "Drop all references to gogo packages in generated code")
+	flag.StringVar(&g.DropEmbeddedFields, "drop-embedded-fields", g.DropEmbeddedFields, "Comma-delimited list of embedded Go types to omit from generated protobufs")
+}
+
+// This roughly models gengo/v2.Execute.
+func Run(g *Generator) {
+	// Roughly models gengo/v2.newBuilder.
+
+	p := parser.NewWithOptions(parser.Options{BuildTags: []string{"proto"}})
+
+	var allInputs []string
+	if len(g.APIMachineryPackages) != 0 {
+		allInputs = append(allInputs, strings.Split(g.APIMachineryPackages, ",")...)
+	}
+	if len(g.Packages) != 0 {
+		allInputs = append(allInputs, strings.Split(g.Packages, ",")...)
+	}
+	if len(allInputs) == 0 {
+		log.Fatalf("Both apimachinery-packages and packages are empty. At least one package must be specified.")
+	}
+
+	if g.DropGogoGo && g.SkipGeneratedRewrite {
+		log.Fatalf("--drop-gogo-go=true and --skip-generated-rewrite=true are mutually exclusive")
+	}
+
+	// Build up a list of packages to load from all the inputs.  Track the
+	// special modifiers for each.  NOTE: This does not support pkg/... syntax.
+	type modifier struct {
+		allTypes bool
+		output   bool
+		name     string
+	}
+	inputModifiers := map[string]modifier{}
+	packages := make([]string, 0, len(allInputs))
+
+	for _, d := range allInputs {
+		modifier := modifier{allTypes: true, output: true}
+
+		switch {
+		case strings.HasPrefix(d, "+"):
+			d = d[1:]
+			modifier.allTypes = false
+		case strings.HasPrefix(d, "-"):
+			d = d[1:]
+			modifier.output = false
+		}
+		name := protoSafePackage(d)
+		parts := strings.SplitN(d, "=", 2)
+		if len(parts) > 1 {
+			d = parts[0]
+			name = parts[1]
+		}
+		modifier.name = name
+
+		packages = append(packages, d)
+		inputModifiers[d] = modifier
+	}
+
+	// Load all the packages at once.
+	if err := p.LoadPackages(packages...); err != nil {
+		log.Fatalf("Unable to load packages: %v", err)
+	}
+
+	c, err := generator.NewContext(
+		p,
+		namer.NameSystems{
+			"public": namer.NewPublicNamer(3),
+		},
+		"public",
+	)
+	if err != nil {
+		log.Fatalf("Failed making a context: %v", err)
+	}
+
+	c.FileTypes["protoidl"] = NewProtoFile()
+
+	// Roughly models gengo/v2.Execute calling the
+	// tool-provided Targets() callback.
+
+	boilerplate, err := gengo.GoBoilerplate(g.GoHeaderFile, "", "")
+	if err != nil {
+		log.Fatalf("Failed loading boilerplate (consider using the go-header-file flag): %v", err)
+	}
+
+	omitTypes := map[types.Name]struct{}{}
+	for _, t := range strings.Split(g.DropEmbeddedFields, ",") {
+		name := types.Name{}
+		if i := strings.LastIndex(t, "."); i != -1 {
+			name.Package, name.Name = t[:i], t[i+1:]
+		} else {
+			name.Name = t
+		}
+		if len(name.Name) == 0 {
+			log.Fatalf("--drop-embedded-types requires names in the form of [GOPACKAGE.]TYPENAME: %v", t)
+		}
+		omitTypes[name] = struct{}{}
+	}
+
+	protobufNames := NewProtobufNamer()
+	outputPackages := []generator.Target{}
+	nonOutputPackages := map[string]struct{}{}
+
+	for _, input := range c.Inputs {
+		mod, found := inputModifiers[input]
+		if !found {
+			log.Fatalf("BUG: can't find input modifiers for %q", input)
+		}
+		pkg := c.Universe[input]
+		protopkg := newProtobufPackage(pkg.Path, pkg.Dir, mod.name, mod.allTypes, omitTypes)
+		header := append([]byte{}, boilerplate...)
+		header = append(header, protopkg.HeaderComment...)
+		protopkg.HeaderComment = header
+		protobufNames.Add(protopkg)
+		if mod.output {
+			outputPackages = append(outputPackages, protopkg)
+		} else {
+			nonOutputPackages[mod.name] = struct{}{}
+		}
+	}
+	c.Namers["proto"] = protobufNames
+
+	for _, p := range outputPackages {
+		if err := p.(*protobufPackage).Clean(); err != nil {
+			log.Fatalf("Unable to clean package %s: %v", p.Name(), err)
+		}
+	}
+
+	if g.Clean {
+		return
+	}
+
+	// order package by imports, importees first
+	deps := deps(c, protobufNames.packages)
+	order, err := importOrder(deps)
+	if err != nil {
+		log.Fatalf("Failed to order packages by imports: %v", err)
+	}
+	topologicalPos := map[string]int{}
+	for i, p := range order {
+		topologicalPos[p] = i
+	}
+	sort.Sort(positionOrder{topologicalPos, protobufNames.packages})
+
+	var localOutputPackages []generator.Target
+	for _, p := range protobufNames.packages {
+		if _, ok := nonOutputPackages[p.Name()]; ok {
+			// if we're not outputting the package, don't include it in either package list
+			continue
+		}
+		localOutputPackages = append(localOutputPackages, p)
+	}
+
+	if err := protobufNames.AssignTypesToPackages(c); err != nil {
+		log.Fatalf("Failed to identify Common types: %v", err)
+	}
+
+	if err := c.ExecuteTargets(localOutputPackages); err != nil {
+		log.Fatalf("Failed executing local generator: %v", err)
+	}
+
+	if g.OnlyIDL {
+		return
+	}
+
+	if _, err := exec.LookPath("protoc"); err != nil {
+		log.Fatalf("Unable to find 'protoc': %v", err)
+	}
+
+	searchArgs := []string{"-I", ".", "-I", g.OutputDir}
+	if len(g.ProtoImport) != 0 {
+		for _, s := range g.ProtoImport {
+			searchArgs = append(searchArgs, "-I", s)
+		}
+	}
+	// Despite docs saying that `--gogo_out=paths=source_relative:.` will
+	// output the .pb.go file to the same directory as the .proto file, it
+	// doesn't. Given example.com/foo/bar.proto (found in one of the -I paths
+	// above), the output becomes
+	// $output_base/example.com/foo/example.com/foo/bar.pb.go - basically
+	// useless.  Users should set the output-dir to a single dir under which
+	// all the packages in question live (e.g. staging/src in kubernetes).
+	// Alternately, we could generate into a temp path and then move the
+	// resulting file back to the input dir, but that seems brittle in other
+	// ways.
+	args := searchArgs
+	args = append(args, fmt.Sprintf("--gogo_out=%s", g.OutputDir))
+
+	buf := &bytes.Buffer{}
+	if len(g.Conditional) > 0 {
+		fmt.Fprintf(buf, "// +build %s\n\n", g.Conditional)
+	}
+	buf.Write(boilerplate)
+
+	for _, outputPackage := range outputPackages {
+		p := outputPackage.(*protobufPackage)
+
+		path := filepath.Join(g.OutputDir, p.ImportPath())
+		outputPath := filepath.Join(g.OutputDir, p.OutputPath())
+
+		// generate the gogoprotobuf protoc
+		cmd := exec.Command("protoc", append(args, path)...)
+		out, err := cmd.CombinedOutput()
+		if err != nil {
+			log.Println(strings.Join(cmd.Args, " "))
+			log.Println(string(out))
+			log.Fatalf("Unable to run protoc on %s: %v", p.Name(), err)
+		}
+
+		if g.SkipGeneratedRewrite {
+			continue
+		}
+
+		// alter the generated protobuf file to remove the generated types (but leave the serializers) and rewrite the
+		// package statement to match the desired package name
+		if err := RewriteGeneratedGogoProtobufFile(outputPath, p.ExtractGeneratedType, p.OptionalTypeName, buf.Bytes(), g.DropGogoGo); err != nil {
+			log.Fatalf("Unable to rewrite generated %s: %v", outputPath, err)
+		}
+
+		outputPaths := []string{outputPath}
+
+		// sort imports
+		cmd = exec.Command("goimports", append([]string{"-w"}, outputPaths...)...)
+		out, err = cmd.CombinedOutput()
+		if len(out) > 0 {
+			log.Print(string(out))
+		}
+		if err != nil {
+			log.Println(strings.Join(cmd.Args, " "))
+			log.Fatalf("Unable to rewrite imports for %s: %v", p.Name(), err)
+		}
+
+		// format and simplify the generated file
+		cmd = exec.Command("gofmt", append([]string{"-s", "-w"}, outputPaths...)...)
+		out, err = cmd.CombinedOutput()
+		if len(out) > 0 {
+			log.Print(string(out))
+		}
+		if err != nil {
+			log.Println(strings.Join(cmd.Args, " "))
+			log.Fatalf("Unable to apply gofmt for %s: %v", p.Name(), err)
+		}
+	}
+
+	if g.SkipGeneratedRewrite {
+		return
+	}
+
+	if !g.KeepGogoproto {
+		// generate, but do so without gogoprotobuf extensions
+		for _, outputPackage := range outputPackages {
+			p := outputPackage.(*protobufPackage)
+			p.OmitGogo = true
+		}
+		if err := c.ExecuteTargets(localOutputPackages); err != nil {
+			log.Fatalf("Failed executing local generator: %v", err)
+		}
+	}
+
+	for _, outputPackage := range outputPackages {
+		p := outputPackage.(*protobufPackage)
+
+		if len(p.StructTags) == 0 {
+			continue
+		}
+
+		pattern := filepath.Join(g.OutputDir, p.Path(), "*.go")
+		files, err := filepath.Glob(pattern)
+		if err != nil {
+			log.Fatalf("Can't glob pattern %q: %v", pattern, err)
+		}
+
+		for _, s := range files {
+			if strings.HasSuffix(s, "_test.go") {
+				continue
+			}
+			if err := RewriteTypesWithProtobufStructTags(s, p.StructTags); err != nil {
+				log.Fatalf("Unable to rewrite with struct tags %s: %v", s, err)
+			}
+		}
+	}
+}
+
+func deps(c *generator.Context, pkgs []*protobufPackage) map[string][]string {
+	ret := map[string][]string{}
+	for _, p := range pkgs {
+		pkg, ok := c.Universe[p.Path()]
+		if !ok {
+			log.Fatalf("Unrecognized package: %s", p.Path())
+		}
+
+		for _, d := range pkg.Imports {
+			ret[p.Path()] = append(ret[p.Path()], d.Path)
+		}
+	}
+	return ret
+}
+
+// given a set of pkg->[]deps, return the order that ensures all deps are processed before the things that depend on them
+func importOrder(deps map[string][]string) ([]string, error) {
+	// add all nodes and edges
+	var remainingNodes = map[string]struct{}{}
+	var graph = map[edge]struct{}{}
+	for to, froms := range deps {
+		remainingNodes[to] = struct{}{}
+		for _, from := range froms {
+			remainingNodes[from] = struct{}{}
+			graph[edge{from: from, to: to}] = struct{}{}
+		}
+	}
+
+	// find initial nodes without any dependencies
+	sorted := findAndRemoveNodesWithoutDependencies(remainingNodes, graph)
+	for i := 0; i < len(sorted); i++ {
+		node := sorted[i]
+		removeEdgesFrom(node, graph)
+		sorted = append(sorted, findAndRemoveNodesWithoutDependencies(remainingNodes, graph)...)
+	}
+	if len(remainingNodes) > 0 {
+		return nil, fmt.Errorf("cycle: remaining nodes: %#v, remaining edges: %#v", remainingNodes, graph)
+	}
+	// for _, n := range sorted {
+	// 	 fmt.Println("topological order", n)
+	// }
+	return sorted, nil
+}
+
+// edge describes a from->to relationship in a graph
+type edge struct {
+	from string
+	to   string
+}
+
+// findAndRemoveNodesWithoutDependencies finds nodes in the given set which are not pointed to by any edges in the graph,
+// removes them from the set of nodes, and returns them in sorted order
+func findAndRemoveNodesWithoutDependencies(nodes map[string]struct{}, graph map[edge]struct{}) []string {
+	roots := []string{}
+	// iterate over all nodes as potential "to" nodes
+	for node := range nodes {
+		incoming := false
+		// iterate over all remaining edges
+		for edge := range graph {
+			// if there's any edge to the node we care about, it's not a root
+			if edge.to == node {
+				incoming = true
+				break
+			}
+		}
+		// if there are no incoming edges, remove from the set of remaining nodes and add to our results
+		if !incoming {
+			delete(nodes, node)
+			roots = append(roots, node)
+		}
+	}
+	sort.Strings(roots)
+	return roots
+}
+
+// removeEdgesFrom removes any edges from the graph where edge.from == node
+func removeEdgesFrom(node string, graph map[edge]struct{}) {
+	for edge := range graph {
+		if edge.from == node {
+			delete(graph, edge)
+		}
+	}
+}
+
+type positionOrder struct {
+	pos      map[string]int
+	elements []*protobufPackage
+}
+
+func (o positionOrder) Len() int {
+	return len(o.elements)
+}
+
+func (o positionOrder) Less(i, j int) bool {
+	return o.pos[o.elements[i].Path()] < o.pos[o.elements[j].Path()]
+}
+
+func (o positionOrder) Swap(i, j int) {
+	o.elements[i], o.elements[j] = o.elements[j], o.elements[i]
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/cmd_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/cmd_test.go
new file mode 100644
index 0000000000..c6b6717638
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/cmd_test.go
@@ -0,0 +1,65 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestImportOrder(t *testing.T) {
+	testcases := []struct {
+		Name      string
+		Input     map[string][]string
+		Expect    []string
+		ExpectErr bool
+	}{
+		{
+			Name:   "empty",
+			Input:  nil,
+			Expect: []string{},
+		},
+		{
+			Name:   "simple",
+			Input:  map[string][]string{"apps": {"core", "extensions", "meta"}, "extensions": {"core", "meta"}, "core": {"meta"}},
+			Expect: []string{"meta", "core", "extensions", "apps"},
+		},
+		{
+			Name:      "cycle",
+			Input:     map[string][]string{"apps": {"core", "extensions", "meta"}, "extensions": {"core", "meta"}, "core": {"meta", "apps"}},
+			ExpectErr: true,
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.Name, func(t *testing.T) {
+			order, err := importOrder(tc.Input)
+			if err != nil {
+				if !tc.ExpectErr {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				return
+			}
+			if tc.ExpectErr {
+				t.Fatalf("expected error, got none")
+			}
+			if !reflect.DeepEqual(order, tc.Expect) {
+				t.Fatalf("expected %v, got %v", tc.Expect, order)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/generator.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/generator.go
new file mode 100644
index 0000000000..64634da849
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/generator.go
@@ -0,0 +1,778 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"fmt"
+	"io"
+	"log"
+	"reflect"
+	"sort"
+	"strconv"
+	"strings"
+
+	genutil "k8s.io/code-generator/pkg/util"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/klog/v2"
+)
+
+// genProtoIDL produces a .proto IDL.
+type genProtoIDL struct {
+	// This base type is close enough to what we need, if we redefine some
+	// methods.
+	generator.GoGenerator
+	localPackage   types.Name
+	localGoPackage types.Name
+	imports        namer.ImportTracker
+
+	generateAll    bool
+	omitGogo       bool
+	omitFieldTypes map[types.Name]struct{}
+}
+
+func (g *genProtoIDL) PackageVars(c *generator.Context) []string {
+	if g.omitGogo {
+		return []string{
+			fmt.Sprintf("option go_package = %q;", g.localGoPackage.Package),
+		}
+	}
+	return []string{
+		"option (gogoproto.marshaler_all) = true;",
+		"option (gogoproto.stable_marshaler_all) = true;",
+		"option (gogoproto.sizer_all) = true;",
+		"option (gogoproto.goproto_stringer_all) = false;",
+		"option (gogoproto.stringer_all) = true;",
+		"option (gogoproto.unmarshaler_all) = true;",
+		"option (gogoproto.goproto_unrecognized_all) = false;",
+		"option (gogoproto.goproto_enum_prefix_all) = false;",
+		"option (gogoproto.goproto_getters_all) = false;",
+		fmt.Sprintf("option go_package = %q;", g.localGoPackage.Package),
+	}
+}
+
+func (g *genProtoIDL) Filename() string { return g.OutputFilename + ".proto" }
+
+func (g *genProtoIDL) FileType() string { return "protoidl" }
+
+func (g *genProtoIDL) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		// The local namer returns the correct protobuf name for a proto type
+		// in the context of a package
+		"local": localNamer{g.localPackage},
+	}
+}
+
+// Filter ignores types that are identified as not exportable.
+func (g *genProtoIDL) Filter(c *generator.Context, t *types.Type) bool {
+	tags, err := genutil.ExtractCommentTagsWithoutArguments("+", []string{"protobuf"}, t.CommentLines)
+	if err != nil {
+		klog.Fatalf(`Error extracting tag "protobuf": %v`, err)
+	}
+	if tags["protobuf"] != nil {
+		if tags["protobuf"][0] == "false" {
+			// Type specified "false".
+			return false
+		}
+		if tags["protobuf"][0] == "true" {
+			// Type specified "true".
+			return true
+		}
+		klog.Fatalf(`Comment tag "protobuf" must be true or false, found: %q`, tags["protobuf"][0])
+	}
+	if !g.generateAll {
+		// We're not generating everything.
+		return false
+	}
+	seen := map[*types.Type]bool{}
+	ok := isProtoable(seen, t)
+	return ok
+}
+
+func isProtoable(seen map[*types.Type]bool, t *types.Type) bool {
+	if seen[t] {
+		// be optimistic in the case of type cycles.
+		return true
+	}
+	seen[t] = true
+	switch t.Kind {
+	case types.Builtin:
+		return true
+	case types.Alias:
+		return isProtoable(seen, t.Underlying)
+	case types.Slice, types.Pointer:
+		return isProtoable(seen, t.Elem)
+	case types.Map:
+		return isProtoable(seen, t.Key) && isProtoable(seen, t.Elem)
+	case types.Struct:
+		if len(t.Members) == 0 {
+			return true
+		}
+		for _, m := range t.Members {
+			if isProtoable(seen, m.Type) {
+				return true
+			}
+		}
+		return false
+	case types.Func, types.Chan:
+		return false
+	case types.DeclarationOf, types.Unknown, types.Unsupported:
+		return false
+	case types.Interface:
+		return false
+	default:
+		log.Printf("WARNING: type %q is not portable: %s", t.Kind, t.Name)
+		return false
+	}
+}
+
+// isOptionalAlias should return true if the specified type has an underlying type
+// (is an alias) of a map or slice and has the comment tag protobuf.nullable=true,
+// indicating that the type should be nullable in protobuf.
+func isOptionalAlias(t *types.Type) bool {
+	if t.Underlying == nil || (t.Underlying.Kind != types.Map && t.Underlying.Kind != types.Slice) {
+		return false
+	}
+	return extractBoolTagOrDie("protobuf.nullable", t.CommentLines)
+}
+
+func (g *genProtoIDL) Imports(c *generator.Context) (imports []string) {
+	lines := []string{}
+	// TODO: this could be expressed more cleanly
+	for _, line := range g.imports.ImportLines() {
+		if g.omitGogo && line == "github.com/gogo/protobuf/gogoproto/gogo.proto" {
+			continue
+		}
+		lines = append(lines, line)
+	}
+	return lines
+}
+
+// GenerateType makes the body of a file implementing a set for type t.
+func (g *genProtoIDL) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+	b := bodyGen{
+		locator: &protobufLocator{
+			namer:    c.Namers["proto"].(ProtobufFromGoNamer),
+			tracker:  g.imports,
+			universe: c.Universe,
+
+			localGoPackage: g.localGoPackage.Package,
+		},
+		localPackage: g.localPackage,
+
+		omitGogo:       g.omitGogo,
+		omitFieldTypes: g.omitFieldTypes,
+
+		t: t,
+	}
+	switch t.Kind {
+	case types.Alias:
+		return b.doAlias(sw)
+	case types.Struct:
+		return b.doStruct(sw)
+	default:
+		return b.unknown()
+	}
+}
+
+// ProtobufFromGoNamer finds the protobuf name of a type (and its package, and
+// the package path) from its Go name.
+type ProtobufFromGoNamer interface {
+	GoNameToProtoName(name types.Name) types.Name
+}
+
+type ProtobufLocator interface {
+	ProtoTypeFor(t *types.Type) (*types.Type, error)
+	GoTypeForName(name types.Name) *types.Type
+	CastTypeName(name types.Name) string
+}
+
+type protobufLocator struct {
+	namer    ProtobufFromGoNamer
+	tracker  namer.ImportTracker
+	universe types.Universe
+
+	localGoPackage string
+}
+
+// CastTypeName returns the cast type name of a Go type
+// TODO: delegate to a new localgo namer?
+func (p protobufLocator) CastTypeName(name types.Name) string {
+	if name.Package == p.localGoPackage {
+		return name.Name
+	}
+	return name.String()
+}
+
+func (p protobufLocator) GoTypeForName(name types.Name) *types.Type {
+	if len(name.Package) == 0 {
+		name.Package = p.localGoPackage
+	}
+	return p.universe.Type(name)
+}
+
+// ProtoTypeFor locates a Protobuf type for the provided Go type (if possible).
+func (p protobufLocator) ProtoTypeFor(t *types.Type) (*types.Type, error) {
+	// we've already converted the type, or it's a map
+	if t.Kind == types.Protobuf || t.Kind == types.Map {
+		p.tracker.AddType(t)
+		return t, nil
+	}
+	// it's a fundamental type
+	if t, ok := isFundamentalProtoType(t); ok {
+		p.tracker.AddType(t)
+		return t, nil
+	}
+	// it's a message
+	if t.Kind == types.Struct || isOptionalAlias(t) {
+		t := &types.Type{
+			Name: p.namer.GoNameToProtoName(t.Name),
+			Kind: types.Protobuf,
+
+			CommentLines: t.CommentLines,
+		}
+		p.tracker.AddType(t)
+		return t, nil
+	}
+	return nil, errUnrecognizedType
+}
+
+type bodyGen struct {
+	locator        ProtobufLocator
+	localPackage   types.Name
+	omitGogo       bool
+	omitFieldTypes map[types.Name]struct{}
+
+	t *types.Type
+}
+
+func (b bodyGen) unknown() error {
+	return fmt.Errorf("not sure how to generate: %#v", b.t)
+}
+
+func (b bodyGen) doAlias(sw *generator.SnippetWriter) error {
+	if !isOptionalAlias(b.t) {
+		return nil
+	}
+
+	var kind string
+	switch b.t.Underlying.Kind {
+	case types.Map:
+		kind = "map"
+	default:
+		kind = "slice"
+	}
+	optional := &types.Type{
+		Name: b.t.Name,
+		Kind: types.Struct,
+
+		CommentLines:              b.t.CommentLines,
+		SecondClosestCommentLines: b.t.SecondClosestCommentLines,
+		Members: []types.Member{
+			{
+				Name:         "Items",
+				CommentLines: []string{fmt.Sprintf("items, if empty, will result in an empty %s\n", kind)},
+				Type:         b.t.Underlying,
+			},
+		},
+	}
+	nested := b
+	nested.t = optional
+	return nested.doStruct(sw)
+}
+
+func (b bodyGen) doStruct(sw *generator.SnippetWriter) error {
+	if len(b.t.Name.Name) == 0 {
+		return nil
+	}
+	if namer.IsPrivateGoName(b.t.Name.Name) {
+		return nil
+	}
+
+	var alias *types.Type
+	var fields []protoField
+	options := []string{}
+	allOptions := gengo.ExtractCommentTags("+", b.t.CommentLines)
+	for k, v := range allOptions {
+		switch {
+		case strings.HasPrefix(k, "protobuf.options."):
+			key := strings.TrimPrefix(k, "protobuf.options.")
+			switch key {
+			case "marshal":
+				if v[0] == "false" {
+					if !b.omitGogo {
+						options = append(options,
+							"(gogoproto.marshaler) = false",
+							"(gogoproto.unmarshaler) = false",
+							"(gogoproto.sizer) = false",
+						)
+					}
+				}
+			default:
+				if !b.omitGogo || !strings.HasPrefix(key, "(gogoproto.") {
+					if key == "(gogoproto.goproto_stringer)" && v[0] == "false" {
+						options = append(options, "(gogoproto.stringer) = false")
+					}
+					options = append(options, fmt.Sprintf("%s = %s", key, v[0]))
+				}
+			}
+		// protobuf.as allows a type to have the same message contents as another Go type
+		case k == "protobuf.as":
+			fields = nil
+			if alias = b.locator.GoTypeForName(types.Name{Name: v[0]}); alias == nil {
+				return fmt.Errorf("type %v references alias %q which does not exist", b.t, v[0])
+			}
+		// protobuf.embed instructs the generator to use the named type in this package
+		// as an embedded message.
+		case k == "protobuf.embed":
+			fields = []protoField{
+				{
+					Tag:  1,
+					Name: v[0],
+					Type: &types.Type{
+						Name: types.Name{
+							Name:    v[0],
+							Package: b.localPackage.Package,
+							Path:    b.localPackage.Path,
+						},
+					},
+				},
+			}
+		}
+	}
+	if alias == nil {
+		alias = b.t
+	}
+
+	// If we don't explicitly embed anything, generate fields by traversing fields.
+	if fields == nil {
+		memberFields, err := membersToFields(b.locator, alias, b.localPackage, b.omitFieldTypes)
+		if err != nil {
+			return fmt.Errorf("type %v cannot be converted to protobuf: %v", b.t, err)
+		}
+		fields = memberFields
+	}
+
+	out := sw.Out()
+	genComment(out, b.t.CommentLines, "")
+	sw.Do(`message $.Name.Name$ {
+`, b.t)
+
+	if len(options) > 0 {
+		sort.Strings(options)
+		for _, s := range options {
+			fmt.Fprintf(out, "  option %s;\n", s)
+		}
+		fmt.Fprintln(out)
+	}
+
+	for i, field := range fields {
+		genComment(out, field.CommentLines, "  ")
+		fmt.Fprintf(out, "  ")
+		switch {
+		case field.Map:
+		case field.Repeated:
+			fmt.Fprintf(out, "repeated ")
+		case field.Required:
+			fmt.Fprintf(out, "required ")
+		default:
+			fmt.Fprintf(out, "optional ")
+		}
+		sw.Do(`$.Type|local$ $.Name$ = $.Tag$`, field)
+		if len(field.Extras) > 0 {
+			extras := []string{}
+			for k, v := range field.Extras {
+				if b.omitGogo && strings.HasPrefix(k, "(gogoproto.") {
+					continue
+				}
+				extras = append(extras, fmt.Sprintf("%s = %s", k, v))
+			}
+			sort.Strings(extras)
+			if len(extras) > 0 {
+				fmt.Fprintf(out, " [")
+				fmt.Fprint(out, strings.Join(extras, ", "))
+				fmt.Fprintf(out, "]")
+			}
+		}
+		fmt.Fprintf(out, ";\n")
+		if i != len(fields)-1 {
+			fmt.Fprintf(out, "\n")
+		}
+	}
+	fmt.Fprintf(out, "}\n\n")
+	return nil
+}
+
+type protoField struct {
+	LocalPackage types.Name
+
+	Tag      int
+	Name     string
+	Type     *types.Type
+	Map      bool
+	Repeated bool
+	Optional bool
+	Required bool
+	Nullable bool
+	Extras   map[string]string
+
+	CommentLines []string
+}
+
+var (
+	errUnrecognizedType = fmt.Errorf("did not recognize the provided type")
+)
+
+func isFundamentalProtoType(t *types.Type) (*types.Type, bool) {
+	// TODO: when we enable proto3, also include other fundamental types in the google.protobuf package
+	// switch {
+	// case t.Kind == types.Struct && t.Name == types.Name{Package: "time", Name: "Time"}:
+	// 	return &types.Type{
+	// 		Kind: types.Protobuf,
+	// 		Name: types.Name{Path: "google/protobuf/timestamp.proto", Package: "google.protobuf", Name: "Timestamp"},
+	// 	}, true
+	// }
+	switch t.Kind {
+	case types.Slice:
+		if t.Elem.Name.Name == "byte" && len(t.Elem.Name.Package) == 0 {
+			return &types.Type{Name: types.Name{Name: "bytes"}, Kind: types.Protobuf}, true
+		}
+	case types.Builtin:
+		switch t.Name.Name {
+		case "string", "uint32", "int32", "uint64", "int64", "bool":
+			return &types.Type{Name: types.Name{Name: t.Name.Name}, Kind: types.Protobuf}, true
+		case "int":
+			return &types.Type{Name: types.Name{Name: "int64"}, Kind: types.Protobuf}, true
+		case "uint":
+			return &types.Type{Name: types.Name{Name: "uint64"}, Kind: types.Protobuf}, true
+		case "float64", "float":
+			return &types.Type{Name: types.Name{Name: "double"}, Kind: types.Protobuf}, true
+		case "float32":
+			return &types.Type{Name: types.Name{Name: "float"}, Kind: types.Protobuf}, true
+		case "uintptr":
+			return &types.Type{Name: types.Name{Name: "uint64"}, Kind: types.Protobuf}, true
+		}
+		// TODO: complex?
+	}
+	return t, false
+}
+
+func memberTypeToProtobufField(locator ProtobufLocator, field *protoField, t *types.Type) error {
+	var err error
+	switch t.Kind {
+	case types.Protobuf:
+		field.Type, err = locator.ProtoTypeFor(t)
+	case types.Builtin:
+		field.Type, err = locator.ProtoTypeFor(t)
+	case types.Map:
+		valueField := &protoField{}
+		if err := memberTypeToProtobufField(locator, valueField, t.Elem); err != nil {
+			return err
+		}
+		keyField := &protoField{}
+		if err := memberTypeToProtobufField(locator, keyField, t.Key); err != nil {
+			return err
+		}
+		// All other protobuf types have kind types.Protobuf, so setting types.Map
+		// here would be very misleading.
+		field.Type = &types.Type{
+			Kind: types.Protobuf,
+			Key:  keyField.Type,
+			Elem: valueField.Type,
+		}
+		if !strings.HasPrefix(t.Name.Name, "map[") {
+			field.Extras["(gogoproto.casttype)"] = strconv.Quote(locator.CastTypeName(t.Name))
+		}
+		if k, ok := keyField.Extras["(gogoproto.casttype)"]; ok {
+			field.Extras["(gogoproto.castkey)"] = k
+		}
+		if v, ok := valueField.Extras["(gogoproto.casttype)"]; ok {
+			field.Extras["(gogoproto.castvalue)"] = v
+		}
+		field.Map = true
+	case types.Pointer:
+		if err := memberTypeToProtobufField(locator, field, t.Elem); err != nil {
+			return err
+		}
+		field.Nullable = true
+	case types.Alias:
+		if isOptionalAlias(t) {
+			field.Type, err = locator.ProtoTypeFor(t)
+			field.Nullable = true
+		} else {
+			if err := memberTypeToProtobufField(locator, field, t.Underlying); err != nil {
+				log.Printf("failed to alias: %s %s: err %v", t.Name, t.Underlying.Name, err)
+				return err
+			}
+			// If this is not an alias to a slice, cast to the alias
+			if !field.Repeated {
+				if field.Extras == nil {
+					field.Extras = make(map[string]string)
+				}
+				field.Extras["(gogoproto.casttype)"] = strconv.Quote(locator.CastTypeName(t.Name))
+			}
+		}
+	case types.Slice:
+		if t.Elem.Name.Name == "byte" && len(t.Elem.Name.Package) == 0 {
+			field.Type = &types.Type{Name: types.Name{Name: "bytes"}, Kind: types.Protobuf}
+			return nil
+		}
+		if err := memberTypeToProtobufField(locator, field, t.Elem); err != nil {
+			return err
+		}
+		field.Repeated = true
+	case types.Struct:
+		if len(t.Name.Name) == 0 {
+			return errUnrecognizedType
+		}
+		field.Type, err = locator.ProtoTypeFor(t)
+		field.Nullable = false
+	default:
+		return errUnrecognizedType
+	}
+	return err
+}
+
+// protobufTagToField extracts information from an existing protobuf tag
+func protobufTagToField(tag string, field *protoField, m types.Member, t *types.Type, localPackage types.Name) error {
+	if len(tag) == 0 || tag == "-" {
+		return nil
+	}
+
+	// protobuf:"bytes,3,opt,name=Id,customtype=github.com/gogo/protobuf/test.Uuid"
+	parts := strings.Split(tag, ",")
+	if len(parts) < 3 {
+		return fmt.Errorf("member %q of %q malformed 'protobuf' tag, not enough segments", m.Name, t.Name)
+	}
+	protoTag, err := strconv.Atoi(parts[1])
+	if err != nil {
+		return fmt.Errorf("member %q of %q malformed 'protobuf' tag, field ID is %q which is not an integer: %w", m.Name, t.Name, parts[1], err)
+	}
+	field.Tag = protoTag
+
+	// In general there is doesn't make sense to parse the protobuf tags to get the type,
+	// as all auto-generated once will have wire type "bytes", "varint" or "fixed64".
+	// However, sometimes we explicitly set them to have a custom serialization, e.g.:
+	//   type Time struct {
+	//     time.Time `protobuf:"Timestamp,1,req,name=time"`
+	//   }
+	// to force the generator to use a given type (that we manually wrote serialization &
+	// deserialization methods for).
+	switch parts[0] {
+	case "varint", "fixed32", "fixed64", "bytes", "group":
+	default:
+		var name types.Name
+		if last := strings.LastIndex(parts[0], "."); last != -1 {
+			prefix := parts[0][:last]
+			name = types.Name{
+				Name:    parts[0][last+1:],
+				Package: prefix,
+				Path:    strings.ReplaceAll(prefix, ".", "/"),
+			}
+		} else {
+			name = types.Name{
+				Name:    parts[0],
+				Package: localPackage.Package,
+				Path:    localPackage.Path,
+			}
+		}
+		field.Type = &types.Type{
+			Name: name,
+			Kind: types.Protobuf,
+		}
+	}
+
+	protoExtra := make(map[string]string)
+	for i, extra := range parts[3:] {
+		parts := strings.SplitN(extra, "=", 2)
+		if len(parts) != 2 {
+			return fmt.Errorf("member %q of %q malformed 'protobuf' tag, tag %d should be key=value, got %q", m.Name, t.Name, i+4, extra)
+		}
+		switch parts[0] {
+		case "name":
+			protoExtra[parts[0]] = parts[1]
+		case "casttype", "castkey", "castvalue":
+			parts[0] = fmt.Sprintf("(gogoproto.%s)", parts[0])
+			protoExtra[parts[0]] = strconv.Quote(parts[1])
+		}
+	}
+
+	field.Extras = protoExtra
+	if name, ok := protoExtra["name"]; ok {
+		field.Name = name
+		delete(protoExtra, "name")
+	}
+
+	return nil
+}
+
+func membersToFields(locator ProtobufLocator, t *types.Type, localPackage types.Name, omitFieldTypes map[types.Name]struct{}) ([]protoField, error) {
+	fields := []protoField{}
+
+	for _, m := range t.Members {
+		if namer.IsPrivateGoName(m.Name) {
+			// skip private fields
+			continue
+		}
+		if _, ok := omitFieldTypes[types.Name{Name: m.Type.Name.Name, Package: m.Type.Name.Package}]; ok {
+			continue
+		}
+		tags := reflect.StructTag(m.Tags)
+		field := protoField{
+			LocalPackage: localPackage,
+
+			Tag:    -1,
+			Extras: make(map[string]string),
+		}
+
+		protobufTag := tags.Get("protobuf")
+		if protobufTag == "-" {
+			continue
+		}
+
+		if err := protobufTagToField(protobufTag, &field, m, t, localPackage); err != nil {
+			return nil, err
+		}
+
+		// extract information from JSON field tag
+		if tag, _ := tags.Lookup("json"); len(tag) > 0 {
+			parts := strings.Split(tag, ",")
+			if len(field.Name) == 0 && len(parts[0]) != 0 {
+				field.Name = parts[0]
+			}
+			if field.Tag == -1 && field.Name == "-" {
+				continue
+			}
+		}
+
+		if field.Type == nil {
+			if err := memberTypeToProtobufField(locator, &field, m.Type); err != nil {
+				return nil, fmt.Errorf("unable to embed type %q as field %q in %q: %v", m.Type, field.Name, t.Name, err)
+			}
+		}
+		if len(field.Name) == 0 {
+			field.Name = namer.IL(m.Name)
+		}
+
+		if field.Map && field.Repeated {
+			// maps cannot be repeated
+			field.Repeated = false
+			field.Nullable = true
+		}
+
+		if !field.Nullable {
+			field.Extras["(gogoproto.nullable)"] = "false"
+		}
+		if (field.Type.Name.Name == "bytes" && field.Type.Name.Package == "") || (field.Repeated && field.Type.Name.Package == "" && namer.IsPrivateGoName(field.Type.Name.Name)) {
+			delete(field.Extras, "(gogoproto.nullable)")
+		}
+		if field.Name != m.Name {
+			field.Extras["(gogoproto.customname)"] = strconv.Quote(m.Name)
+		}
+		field.CommentLines = m.CommentLines
+		fields = append(fields, field)
+	}
+
+	// assign tags
+	highest := 0
+	byTag := make(map[int]*protoField)
+	// fields are in Go struct order, which we preserve
+	for i := range fields {
+		field := &fields[i]
+		tag := field.Tag
+		if tag != -1 {
+			if existing, ok := byTag[tag]; ok {
+				return nil, fmt.Errorf("field %q and %q both have tag %d", field.Name, existing.Name, tag)
+			}
+			byTag[tag] = field
+		}
+		if tag > highest {
+			highest = tag
+		}
+	}
+	// starting from the highest observed tag, assign new field tags
+	for i := range fields {
+		field := &fields[i]
+		if field.Tag != -1 {
+			continue
+		}
+		highest++
+		field.Tag = highest
+		byTag[field.Tag] = field
+	}
+	return fields, nil
+}
+
+func genComment(out io.Writer, lines []string, indent string) {
+	for {
+		l := len(lines)
+		if l == 0 || len(lines[l-1]) != 0 {
+			break
+		}
+		lines = lines[:l-1]
+	}
+	for _, c := range lines {
+		if len(c) == 0 {
+			fmt.Fprintf(out, "%s//\n", indent) // avoid trailing whitespace
+			continue
+		}
+		fmt.Fprintf(out, "%s// %s\n", indent, c)
+	}
+}
+
+func formatProtoFile(source []byte) ([]byte, error) {
+	// TODO; Is there any protobuf formatter?
+	return source, nil
+}
+
+func assembleProtoFile(w io.Writer, f *generator.File) {
+	w.Write(f.Header)
+
+	fmt.Fprint(w, "syntax = \"proto2\";\n\n")
+
+	if len(f.PackageName) > 0 {
+		fmt.Fprintf(w, "package %s;\n\n", f.PackageName)
+	}
+
+	if len(f.Imports) > 0 {
+		imports := []string{}
+		for i := range f.Imports {
+			imports = append(imports, i)
+		}
+		sort.Strings(imports)
+		for _, s := range imports {
+			fmt.Fprintf(w, "import %q;\n", s)
+		}
+		fmt.Fprint(w, "\n")
+	}
+
+	if f.Vars.Len() > 0 {
+		fmt.Fprintf(w, "%s\n", f.Vars.String())
+	}
+
+	w.Write(f.Body.Bytes())
+}
+
+func NewProtoFile() *generator.DefaultFileType {
+	return &generator.DefaultFileType{
+		Format:   formatProtoFile,
+		Assemble: assembleProtoFile,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/import_tracker.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/import_tracker.go
new file mode 100644
index 0000000000..0031c9bd83
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/import_tracker.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+)
+
+type ImportTracker struct {
+	namer.DefaultImportTracker
+}
+
+func NewImportTracker(local types.Name, typesToAdd ...*types.Type) *ImportTracker {
+	tracker := namer.NewDefaultImportTracker(local)
+	tracker.IsInvalidType = func(t *types.Type) bool { return t.Kind != types.Protobuf }
+	tracker.LocalName = func(name types.Name) string { return name.Package }
+	tracker.PrintImport = func(path, name string) string { return path }
+
+	tracker.AddTypes(typesToAdd...)
+	return &ImportTracker{
+		DefaultImportTracker: tracker,
+	}
+}
+
+// AddNullable ensures that support for the nullable Gogo-protobuf extension is added.
+func (tracker *ImportTracker) AddNullable() {
+	tracker.AddType(&types.Type{
+		Kind: types.Protobuf,
+		Name: types.Name{
+			Name:    "nullable",
+			Package: "gogoproto",
+			Path:    "github.com/gogo/protobuf/gogoproto/gogo.proto",
+		},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/namer.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/namer.go
new file mode 100644
index 0000000000..2ad0a9537e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/namer.go
@@ -0,0 +1,206 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+)
+
+type localNamer struct {
+	localPackage types.Name
+}
+
+func (n localNamer) Name(t *types.Type) string {
+	if t.Key != nil && t.Elem != nil {
+		return fmt.Sprintf("map<%s, %s>", n.Name(t.Key), n.Name(t.Elem))
+	}
+	if len(n.localPackage.Package) != 0 && n.localPackage.Package == t.Name.Package {
+		return t.Name.Name
+	}
+	// For non-local and non-fundamental types, use an absolute reference
+	// see https://protobuf.com/docs/language-spec#type-references
+	if strings.Contains(t.Name.Package, ".") {
+		return fmt.Sprintf(".%s", t.Name)
+	}
+	return t.Name.String()
+}
+
+type protobufNamer struct {
+	packages []*protobufPackage
+	// The key here is a Go import-path.
+	packagesByPath map[string]*protobufPackage
+}
+
+func NewProtobufNamer() *protobufNamer {
+	return &protobufNamer{
+		packagesByPath: make(map[string]*protobufPackage),
+	}
+}
+
+func (n *protobufNamer) Name(t *types.Type) string {
+	if t.Kind == types.Map {
+		return fmt.Sprintf("map<%s, %s>", n.Name(t.Key), n.Name(t.Elem))
+	}
+	return t.Name.String()
+}
+
+func (n *protobufNamer) Add(p *protobufPackage) {
+	if _, ok := n.packagesByPath[p.Path()]; !ok {
+		n.packagesByPath[p.Path()] = p
+		n.packages = append(n.packages, p)
+	}
+}
+
+func (n *protobufNamer) GoNameToProtoName(name types.Name) types.Name {
+	if p, ok := n.packagesByPath[name.Package]; ok {
+		return types.Name{
+			Name:    name.Name,
+			Package: p.Name(),
+			Path:    p.ImportPath(),
+		}
+	}
+	for _, p := range n.packages {
+		if _, ok := p.FilterTypes[name]; ok {
+			return types.Name{
+				Name:    name.Name,
+				Package: p.Name(),
+				Path:    p.ImportPath(),
+			}
+		}
+	}
+	return types.Name{Name: name.Name}
+}
+
+func protoSafePackage(name string) string {
+	pkg := strings.ReplaceAll(name, "/", ".")
+	return strings.ReplaceAll(pkg, "-", "_")
+}
+
+type typeNameSet map[types.Name]*protobufPackage
+
+// assignGoTypeToProtoPackage looks for Go and Protobuf types that are referenced by a type in
+// a package. It will not recurse into protobuf types.
+func assignGoTypeToProtoPackage(p *protobufPackage, t *types.Type, local, global typeNameSet, optional map[types.Name]struct{}) {
+	newT, isProto := isFundamentalProtoType(t)
+	if isProto {
+		t = newT
+	}
+	if otherP, ok := global[t.Name]; ok {
+		if _, ok := local[t.Name]; !ok {
+			p.Imports.AddType(&types.Type{
+				Kind: types.Protobuf,
+				Name: otherP.ProtoTypeName(),
+			})
+		}
+		return
+	}
+	if t.Name.Package == p.Path() {
+		// Associate types only to their own package
+		global[t.Name] = p
+	}
+	if _, ok := local[t.Name]; ok {
+		return
+	}
+	// don't recurse into existing proto types
+	if isProto {
+		p.Imports.AddType(t)
+		return
+	}
+
+	local[t.Name] = p
+	for _, m := range t.Members {
+		if namer.IsPrivateGoName(m.Name) {
+			continue
+		}
+		field := &protoField{}
+		tag := reflect.StructTag(m.Tags).Get("protobuf")
+		if tag == "-" {
+			continue
+		}
+		if err := protobufTagToField(tag, field, m, t, p.ProtoTypeName()); err == nil && field.Type != nil {
+			assignGoTypeToProtoPackage(p, field.Type, local, global, optional)
+			continue
+		}
+		assignGoTypeToProtoPackage(p, m.Type, local, global, optional)
+	}
+	// TODO: should methods be walked?
+	if t.Elem != nil {
+		assignGoTypeToProtoPackage(p, t.Elem, local, global, optional)
+	}
+	if t.Key != nil {
+		assignGoTypeToProtoPackage(p, t.Key, local, global, optional)
+	}
+	if t.Underlying != nil {
+		if t.Kind == types.Alias && isOptionalAlias(t) {
+			optional[t.Name] = struct{}{}
+		}
+		assignGoTypeToProtoPackage(p, t.Underlying, local, global, optional)
+	}
+}
+
+// isTypeApplicableToProtobuf checks to see if a type is relevant for protobuf processing.
+// Currently, it filters out functions and private types.
+func isTypeApplicableToProtobuf(t *types.Type) bool {
+	// skip functions -- we don't care about them for protobuf
+	if t.Kind == types.Func || (t.Kind == types.DeclarationOf && t.Underlying.Kind == types.Func) {
+		return false
+	}
+	// skip private types
+	if namer.IsPrivateGoName(t.Name.Name) {
+		return false
+	}
+
+	return true
+}
+
+func (n *protobufNamer) AssignTypesToPackages(c *generator.Context) error {
+	global := make(typeNameSet)
+	for _, p := range n.packages {
+		local := make(typeNameSet)
+		optional := make(map[types.Name]struct{})
+		p.Imports = NewImportTracker(p.ProtoTypeName())
+		for _, t := range c.Order {
+			if t.Name.Package != p.Path() {
+				continue
+			}
+			if !isTypeApplicableToProtobuf(t) {
+				// skip types that we don't care about, like functions
+				continue
+			}
+			assignGoTypeToProtoPackage(p, t, local, global, optional)
+		}
+		p.FilterTypes = make(map[types.Name]struct{})
+		p.LocalNames = make(map[string]struct{})
+		p.OptionalTypeNames = make(map[string]struct{})
+		for k, v := range local {
+			if v == p {
+				p.FilterTypes[k] = struct{}{}
+				p.LocalNames[k.Name] = struct{}{}
+				if _, ok := optional[k]; ok {
+					p.OptionalTypeNames[k.Name] = struct{}{}
+				}
+			}
+		}
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/namer_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/namer_test.go
new file mode 100644
index 0000000000..0ee71f80be
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/namer_test.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import "testing"
+
+func TestProtoSafePackage(t *testing.T) {
+	tests := []struct {
+		pkg      string
+		expected string
+	}{
+		{
+			pkg:      "foo",
+			expected: "foo",
+		},
+		{
+			pkg:      "foo/bar",
+			expected: "foo.bar",
+		},
+		{
+			pkg:      "foo/bar/baz",
+			expected: "foo.bar.baz",
+		},
+		{
+			pkg:      "foo/bar-baz/x/y-z/q",
+			expected: "foo.bar_baz.x.y_z.q",
+		},
+	}
+
+	for _, test := range tests {
+		actual := protoSafePackage(test.pkg)
+		if e, a := test.expected, actual; e != a {
+			t.Errorf("%s: expected %s, got %s", test.pkg, e, a)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/package.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/package.go
new file mode 100644
index 0000000000..b31a7c4dd7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/package.go
@@ -0,0 +1,205 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"fmt"
+	"go/ast"
+	"log"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/types"
+)
+
+func newProtobufPackage(packagePath, packageDir, packageName string, generateAll bool, omitFieldTypes map[types.Name]struct{}) *protobufPackage {
+	pkg := &protobufPackage{
+		SimpleTarget: generator.SimpleTarget{
+			// The protobuf package name (foo.bar.baz)
+			PkgName:       packageName,
+			PkgPath:       packagePath,
+			PkgDir:        packageDir,
+			HeaderComment: []byte("// This file was autogenerated by go-to-protobuf. Do not edit it manually!\n\n"),
+			PkgDocComment: []byte(fmt.Sprintf("// Package %s is an autogenerated protobuf IDL.\n", packageName)),
+		},
+		GenerateAll:    generateAll,
+		OmitFieldTypes: omitFieldTypes,
+	}
+	pkg.FilterFunc = pkg.filterFunc
+	pkg.GeneratorsFunc = pkg.generatorsFunc
+	return pkg
+}
+
+// protobufPackage contains the protobuf implementation of Package.
+type protobufPackage struct {
+	generator.SimpleTarget
+
+	// If true, generate protobuf serializations for all public types.
+	// If false, only generate protobuf serializations for structs that
+	// request serialization.
+	GenerateAll bool
+
+	// A list of types to filter to; if not specified all types will be included.
+	FilterTypes map[types.Name]struct{}
+
+	// If true, omit any gogoprotobuf extensions not defined as types.
+	OmitGogo bool
+
+	// A list of field types that will be excluded from the output struct
+	OmitFieldTypes map[types.Name]struct{}
+
+	// A list of names that this package exports
+	LocalNames map[string]struct{}
+
+	// A list of type names in this package that will need marshaller rewriting
+	// to remove synthetic protobuf fields.
+	OptionalTypeNames map[string]struct{}
+
+	// A list of struct tags to generate onto named struct fields
+	StructTags map[string]map[string]string
+
+	// An import tracker for this package
+	Imports *ImportTracker
+}
+
+func (p *protobufPackage) Clean() error {
+	for _, s := range []string{p.ImportPath(), p.OutputPath()} {
+		if err := os.Remove(filepath.Join(p.Dir(), filepath.Base(s))); err != nil && !os.IsNotExist(err) {
+			return err
+		}
+	}
+	return nil
+}
+
+func (p *protobufPackage) ProtoTypeName() types.Name {
+	return types.Name{
+		Name:    p.Path(),       // the go path "foo/bar/baz"
+		Package: p.Name(),       // the protobuf package "foo.bar.baz"
+		Path:    p.ImportPath(), // the path of the import to get the proto
+	}
+}
+
+func (p *protobufPackage) filterFunc(c *generator.Context, t *types.Type) bool {
+	switch t.Kind {
+	case types.Func, types.Chan:
+		return false
+	case types.Struct:
+		if t.Name.Name == "struct{}" {
+			return false
+		}
+	case types.Builtin:
+		return false
+	case types.Alias:
+		if !isOptionalAlias(t) {
+			return false
+		}
+	case types.Slice, types.Array, types.Map:
+		return false
+	case types.Pointer:
+		return false
+	}
+	if _, ok := isFundamentalProtoType(t); ok {
+		return false
+	}
+	_, ok := p.FilterTypes[t.Name]
+	return ok
+}
+
+func (p *protobufPackage) HasGoType(name string) bool {
+	_, ok := p.LocalNames[name]
+	return ok
+}
+
+func (p *protobufPackage) OptionalTypeName(name string) bool {
+	_, ok := p.OptionalTypeNames[name]
+	return ok
+}
+
+func (p *protobufPackage) ExtractGeneratedType(t *ast.TypeSpec) bool {
+	if !p.HasGoType(t.Name.Name) {
+		return false
+	}
+
+	switch s := t.Type.(type) {
+	case *ast.StructType:
+		for i, f := range s.Fields.List {
+			if len(f.Tag.Value) == 0 {
+				continue
+			}
+			tag := strings.Trim(f.Tag.Value, "`")
+			protobufTag := reflect.StructTag(tag).Get("protobuf")
+			if len(protobufTag) == 0 {
+				continue
+			}
+			if len(f.Names) > 1 {
+				log.Printf("WARNING: struct %s field %d %s: defined multiple names but single protobuf tag", t.Name.Name, i, f.Names[0].Name)
+				// TODO hard error?
+			}
+			if p.StructTags == nil {
+				p.StructTags = make(map[string]map[string]string)
+			}
+			m := p.StructTags[t.Name.Name]
+			if m == nil {
+				m = make(map[string]string)
+				p.StructTags[t.Name.Name] = m
+			}
+			m[f.Names[0].Name] = tag
+		}
+	default:
+		log.Printf("WARNING: unexpected Go AST type definition: %#v", t)
+	}
+
+	return true
+}
+
+func (p *protobufPackage) generatorsFunc(c *generator.Context) []generator.Generator {
+	generators := []generator.Generator{}
+
+	p.Imports.AddNullable()
+
+	generators = append(generators, &genProtoIDL{
+		GoGenerator: generator.GoGenerator{
+			OutputFilename: "generated", // the extension is added later
+		},
+		localPackage:   types.Name{Package: p.Name(), Path: p.Path()},
+		localGoPackage: types.Name{Package: p.Path(), Name: p.GoPackageName()},
+		imports:        p.Imports,
+		generateAll:    p.GenerateAll,
+		omitGogo:       p.OmitGogo,
+		omitFieldTypes: p.OmitFieldTypes,
+	})
+	return generators
+}
+
+func (p *protobufPackage) GoPackageName() string {
+	return filepath.Base(p.Path())
+}
+
+func (p *protobufPackage) ImportPath() string {
+	return filepath.Join(p.Path(), "generated.proto")
+}
+
+func (p *protobufPackage) OutputPath() string {
+	return filepath.Join(p.Path(), "generated.pb.go")
+}
+
+var (
+	_ = generator.Target(&protobufPackage{})
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/parser.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/parser.go
new file mode 100644
index 0000000000..3753c27c9a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/parser.go
@@ -0,0 +1,615 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"go/ast"
+	"go/format"
+	"go/parser"
+	"go/printer"
+	"go/token"
+	"os"
+	"reflect"
+	"strings"
+
+	customreflect "k8s.io/code-generator/third_party/forked/golang/reflect"
+)
+
+func rewriteFile(name string, header []byte, rewriteFn func(*token.FileSet, *ast.File) error) error {
+	fset := token.NewFileSet()
+	src, err := os.ReadFile(name)
+	if err != nil {
+		return err
+	}
+	file, err := parser.ParseFile(fset, name, src, parser.DeclarationErrors|parser.ParseComments)
+	if err != nil {
+		return err
+	}
+
+	if err := rewriteFn(fset, file); err != nil {
+		return err
+	}
+
+	b := &bytes.Buffer{}
+	b.Write(header)
+	if err := printer.Fprint(b, fset, file); err != nil {
+		return err
+	}
+
+	body, err := format.Source(b.Bytes())
+	if err != nil {
+		return err
+	}
+
+	f, err := os.OpenFile(name, os.O_WRONLY|os.O_TRUNC, 0644)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	if _, err := f.Write(body); err != nil {
+		return err
+	}
+	return f.Close()
+}
+
+// ExtractFunc extracts information from the provided TypeSpec and returns true if the type should be
+// removed from the destination file.
+type ExtractFunc func(*ast.TypeSpec) bool
+
+// OptionalFunc returns true if the provided local name is a type that has protobuf.nullable=true
+// and should have its marshal functions adjusted to remove the 'Items' accessor.
+type OptionalFunc func(name string) bool
+
+func RewriteGeneratedGogoProtobufFile(file string, extractFn ExtractFunc, optionalFn OptionalFunc, header []byte, dropGogo bool) error {
+	return rewriteFile(file, header, func(fset *token.FileSet, file *ast.File) error {
+		cmap := ast.NewCommentMap(fset, file, file.Comments)
+
+		// transform methods that point to optional maps or slices
+		for _, d := range file.Decls {
+			rewriteOptionalMethods(d, optionalFn)
+		}
+		if dropGogo {
+			// transform references to gogo sort util
+			var oldSortImport string
+			var usedSort bool
+			for _, d := range file.Decls {
+				oldSortImport, usedSort = rewriteGogoSortImport(d)
+				if usedSort {
+					break
+				}
+			}
+			if usedSort {
+				for _, d := range file.Decls {
+					rewriteGogoSort(d, oldSortImport, "sort")
+				}
+			}
+		}
+
+		// remove types that are already declared
+		decls := []ast.Decl{}
+		for _, d := range file.Decls {
+			if dropExistingTypeDeclarations(d, extractFn) {
+				continue
+			}
+			if dropEmptyImportDeclarations(d) {
+				continue
+			}
+			// remove all but required functions
+			if dropGogo && dropUnusedGo(d) {
+				continue
+			}
+			decls = append(decls, d)
+		}
+		file.Decls = decls
+
+		// remove unmapped comments
+		file.Comments = cmap.Filter(file).Comments()
+		return nil
+	})
+}
+
+// rewriteGogoSortImport rewrites an import of "github.com/gogo/protobuf/sortkeys" to "sort",
+// and returns the original package alias and true if the rewrite occurred.
+// Returns "", false if the decl is not an import decl, or does not contain an import of "github.com/gogo/protobuf/sortkeys",
+func rewriteGogoSortImport(decl ast.Decl) (string, bool) {
+	t, ok := decl.(*ast.GenDecl)
+	if !ok {
+		return "", false
+	}
+	if t.Tok != token.IMPORT {
+		return "", false
+	}
+	for _, s := range t.Specs {
+		if spec, ok := s.(*ast.ImportSpec); ok {
+			if spec.Path != nil && spec.Path.Value == `"github.com/gogo/protobuf/sortkeys"` {
+				// switch gogo sort to stdlib sort
+				spec.Path.Value = `"sort"`
+				oldName := "sortkeys"
+				if spec.Name != nil {
+					oldName = spec.Name.Name
+				}
+				spec.Name = nil
+				return oldName, true
+			}
+		}
+	}
+	return "", false
+}
+
+// rewriteGogoSort walks the AST, replacing use of the oldSortImport package with newSortImport
+func rewriteGogoSort(decl ast.Decl, oldSortImport, newSortImport string) {
+	t, ok := decl.(*ast.FuncDecl)
+	if !ok {
+		return
+	}
+	ast.Walk(replacePackageVisitor{oldPackage: oldSortImport, newPackage: newSortImport}, t.Body)
+}
+
+// keepFuncs is an allowlist of top-level func decls we should keep
+var keepFuncs = map[string]bool{
+	// generated helpers
+	"sovGenerated":           true,
+	"sozGenerated":           true,
+	"skipGenerated":          true,
+	"encodeVarintGenerated":  true,
+	"valueToStringGenerated": true,
+
+	// unmarshal
+	"Reset":     true,
+	"Unmarshal": true,
+
+	// marshal
+	"Size":                 true,
+	"Marshal":              true,
+	"MarshalTo":            true,
+	"MarshalToSizedBuffer": true,
+
+	// other widely used methods
+	"String": true,
+}
+
+// keepVars is an allowlist of top-level var decls we should keep
+var keepVars = map[string]bool{
+	"ErrInvalidLengthGenerated":        true,
+	"ErrIntOverflowGenerated":          true,
+	"ErrUnexpectedEndOfGroupGenerated": true,
+}
+
+// dropUnusedGo returns true if the top-level decl should be dropped.
+// Has the following behavior for different decl types:
+// * import: decl is rewritten to drop gogo package imports. Returns true if all imports in the decl were gogo imports, false if non-gogo imports remain.
+// * var: decl is rewritten to drop vars not in the keepVars allowlist. Returns true if all vars in the decl were removed, false if allowlisted vars remain.
+// * const: returns true
+// * type: returns true
+// * func: returns true if the func is not in the keepFuncs allowlist and should be dropped.
+// * other: returns false
+func dropUnusedGo(decl ast.Decl) bool {
+	switch t := decl.(type) {
+	case *ast.GenDecl:
+		switch t.Tok {
+		case token.IMPORT:
+			specs := []ast.Spec{}
+			for _, s := range t.Specs {
+				if spec, ok := s.(*ast.ImportSpec); ok {
+					if spec.Path == nil || !strings.HasPrefix(spec.Path.Value, `"github.com/gogo/protobuf/`) {
+						specs = append(specs, spec)
+					}
+				}
+			}
+			if len(specs) == 0 {
+				return true
+			}
+			t.Specs = specs
+			return false
+		case token.CONST:
+			// drop all const declarations
+			return true
+		case token.VAR:
+			specs := []ast.Spec{}
+			for _, s := range t.Specs {
+				if spec, ok := s.(*ast.ValueSpec); ok {
+					if keepVars[spec.Names[0].Name] {
+						specs = append(specs, spec)
+					}
+				}
+			}
+			if len(specs) == 0 {
+				return true
+			}
+			t.Specs = specs
+			return false
+		case token.TYPE:
+			// drop all type declarations
+			return true
+		}
+	case *ast.FuncDecl:
+		name := ""
+		if t.Name != nil {
+			name = t.Name.Name
+		}
+		return !keepFuncs[name]
+	default:
+		return false
+	}
+	return false
+}
+
+// rewriteOptionalMethods makes specific mutations to marshaller methods that belong to types identified
+// as being "optional" (they may be nil on the wire). This allows protobuf to serialize a map or slice and
+// properly discriminate between empty and nil (which is not possible in protobuf).
+// TODO: move into upstream gogo-protobuf once https://github.com/gogo/protobuf/issues/181
+// has agreement
+func rewriteOptionalMethods(decl ast.Decl, isOptional OptionalFunc) {
+	if t, ok := decl.(*ast.FuncDecl); ok {
+		ident, ptr, ok := receiver(t)
+		if !ok {
+			return
+		}
+
+		// correct initialization of the form `m.Field = &OptionalType{}` to
+		// `m.Field = OptionalType{}`
+		if t.Name.Name == "Unmarshal" {
+			ast.Walk(optionalAssignmentVisitor{fn: isOptional}, t.Body)
+		}
+
+		if !isOptional(ident.Name) {
+			return
+		}
+
+		switch t.Name.Name {
+		case "Unmarshal":
+			ast.Walk(&optionalItemsVisitor{}, t.Body)
+		case "MarshalTo", "Size", "String", "MarshalToSizedBuffer":
+			ast.Walk(&optionalItemsVisitor{}, t.Body)
+			fallthrough
+		case "Marshal":
+			// if the method has a pointer receiver, set it back to a normal receiver
+			if ptr {
+				t.Recv.List[0].Type = ident
+			}
+		}
+	}
+}
+
+type optionalAssignmentVisitor struct {
+	fn OptionalFunc
+}
+
+// Visit walks the provided node, transforming field initializations of the form
+// m.Field = &OptionalType{} -> m.Field = OptionalType{}
+func (v optionalAssignmentVisitor) Visit(n ast.Node) ast.Visitor {
+	if t, ok := n.(*ast.AssignStmt); ok {
+		if len(t.Lhs) == 1 && len(t.Rhs) == 1 {
+			if !isFieldSelector(t.Lhs[0], "m", "") {
+				return nil
+			}
+			unary, ok := t.Rhs[0].(*ast.UnaryExpr)
+			if !ok || unary.Op != token.AND {
+				return nil
+			}
+			composite, ok := unary.X.(*ast.CompositeLit)
+			if !ok || composite.Type == nil || len(composite.Elts) != 0 {
+				return nil
+			}
+			if ident, ok := composite.Type.(*ast.Ident); ok && v.fn(ident.Name) {
+				t.Rhs[0] = composite
+			}
+		}
+		return nil
+	}
+	return v
+}
+
+type optionalItemsVisitor struct{}
+
+// Visit walks the provided node, looking for specific patterns to transform that match
+// the effective outcome of turning struct{ map[x]y || []x } into map[x]y or []x.
+func (v *optionalItemsVisitor) Visit(n ast.Node) ast.Visitor {
+	switch t := n.(type) {
+	case *ast.RangeStmt:
+		if isFieldSelector(t.X, "m", "Items") {
+			t.X = &ast.Ident{Name: "m"}
+		}
+	case *ast.AssignStmt:
+		if len(t.Lhs) == 1 && len(t.Rhs) == 1 {
+			switch lhs := t.Lhs[0].(type) {
+			case *ast.IndexExpr:
+				if isFieldSelector(lhs.X, "m", "Items") {
+					lhs.X = &ast.StarExpr{X: &ast.Ident{Name: "m"}}
+				}
+			default:
+				if isFieldSelector(t.Lhs[0], "m", "Items") {
+					t.Lhs[0] = &ast.StarExpr{X: &ast.Ident{Name: "m"}}
+				}
+			}
+			if rhs, ok := t.Rhs[0].(*ast.CallExpr); ok {
+				if ident, ok := rhs.Fun.(*ast.Ident); ok && ident.Name == "append" {
+					ast.Walk(v, rhs)
+					if len(rhs.Args) > 0 {
+						if arg, ok := rhs.Args[0].(*ast.Ident); ok {
+							if arg.Name == "m" {
+								rhs.Args[0] = &ast.StarExpr{X: &ast.Ident{Name: "m"}}
+							}
+						}
+					}
+					return nil
+				}
+			}
+		}
+	case *ast.IfStmt:
+		if cond, ok := t.Cond.(*ast.BinaryExpr); ok {
+			if cond.Op == token.EQL {
+				if isFieldSelector(cond.X, "m", "Items") && isIdent(cond.Y, "nil") {
+					cond.X = &ast.StarExpr{X: &ast.Ident{Name: "m"}}
+				}
+			}
+		}
+		if t.Init != nil {
+			// Find form:
+			// if err := m[len(m.Items)-1].Unmarshal(data[iNdEx:postIndex]); err != nil {
+			// 	return err
+			// }
+			if s, ok := t.Init.(*ast.AssignStmt); ok {
+				if call, ok := s.Rhs[0].(*ast.CallExpr); ok {
+					if sel, ok := call.Fun.(*ast.SelectorExpr); ok {
+						if x, ok := sel.X.(*ast.IndexExpr); ok {
+							// m[] -> (*m)[]
+							if sel2, ok := x.X.(*ast.SelectorExpr); ok {
+								if ident, ok := sel2.X.(*ast.Ident); ok && ident.Name == "m" {
+									x.X = &ast.StarExpr{X: &ast.Ident{Name: "m"}}
+								}
+							}
+							// len(m.Items) -> len(*m)
+							if bin, ok := x.Index.(*ast.BinaryExpr); ok {
+								if call2, ok := bin.X.(*ast.CallExpr); ok && len(call2.Args) == 1 {
+									if isFieldSelector(call2.Args[0], "m", "Items") {
+										call2.Args[0] = &ast.StarExpr{X: &ast.Ident{Name: "m"}}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	case *ast.IndexExpr:
+		if isFieldSelector(t.X, "m", "Items") {
+			t.X = &ast.Ident{Name: "m"}
+			return nil
+		}
+	case *ast.CallExpr:
+		changed := false
+		for i := range t.Args {
+			if isFieldSelector(t.Args[i], "m", "Items") {
+				t.Args[i] = &ast.Ident{Name: "m"}
+				changed = true
+			}
+		}
+		if changed {
+			return nil
+		}
+	}
+	return v
+}
+
+func isFieldSelector(n ast.Expr, name, field string) bool {
+	s, ok := n.(*ast.SelectorExpr)
+	if !ok || s.Sel == nil || (field != "" && s.Sel.Name != field) {
+		return false
+	}
+	return isIdent(s.X, name)
+}
+
+func isIdent(n ast.Expr, value string) bool {
+	ident, ok := n.(*ast.Ident)
+	return ok && ident.Name == value
+}
+
+func receiver(f *ast.FuncDecl) (ident *ast.Ident, pointer bool, ok bool) {
+	if f.Recv == nil || len(f.Recv.List) != 1 {
+		return nil, false, false
+	}
+	switch t := f.Recv.List[0].Type.(type) {
+	case *ast.StarExpr:
+		identity, ok := t.X.(*ast.Ident)
+		if !ok {
+			return nil, false, false
+		}
+		return identity, true, true
+	case *ast.Ident:
+		return t, false, true
+	}
+	return nil, false, false
+}
+
+// dropExistingTypeDeclarations removes any type declaration for which extractFn returns true. The function
+// returns true if the entire declaration should be dropped.
+func dropExistingTypeDeclarations(decl ast.Decl, extractFn ExtractFunc) bool {
+	if t, ok := decl.(*ast.GenDecl); ok {
+		if t.Tok != token.TYPE {
+			return false
+		}
+		specs := []ast.Spec{}
+		for _, s := range t.Specs {
+			if spec, ok := s.(*ast.TypeSpec); ok {
+				if extractFn(spec) {
+					continue
+				}
+				specs = append(specs, spec)
+			}
+		}
+		if len(specs) == 0 {
+			return true
+		}
+		t.Specs = specs
+	}
+	return false
+}
+
+// dropEmptyImportDeclarations strips any generated but no-op imports from the generated code
+// to prevent generation from being able to define side-effects.  The function returns true
+// if the entire declaration should be dropped.
+func dropEmptyImportDeclarations(decl ast.Decl) bool {
+	if t, ok := decl.(*ast.GenDecl); ok {
+		if t.Tok != token.IMPORT {
+			return false
+		}
+		specs := []ast.Spec{}
+		for _, s := range t.Specs {
+			if spec, ok := s.(*ast.ImportSpec); ok {
+				if spec.Name != nil && spec.Name.Name == "_" {
+					continue
+				}
+				specs = append(specs, spec)
+			}
+		}
+		if len(specs) == 0 {
+			return true
+		}
+		t.Specs = specs
+	}
+	return false
+}
+
+func RewriteTypesWithProtobufStructTags(name string, structTags map[string]map[string]string) error {
+	return rewriteFile(name, []byte{}, func(fset *token.FileSet, file *ast.File) error {
+		allErrs := []error{}
+
+		// set any new struct tags
+		for _, d := range file.Decls {
+			if errs := updateStructTags(d, structTags, []string{"protobuf"}); len(errs) > 0 {
+				allErrs = append(allErrs, errs...)
+			}
+		}
+
+		if len(allErrs) > 0 {
+			var s string
+			for _, err := range allErrs {
+				s += err.Error() + "\n"
+			}
+			return errors.New(s)
+		}
+		return nil
+	})
+}
+
+func getFieldName(expr ast.Expr, structname string) (name string, err error) {
+	for {
+		switch t := expr.(type) {
+		case *ast.Ident:
+			return t.Name, nil
+		case *ast.SelectorExpr:
+			return t.Sel.Name, nil
+		case *ast.StarExpr:
+			expr = t.X
+		default:
+			return "", fmt.Errorf("unable to get name for tag from struct %q, field %#v", structname, t)
+		}
+	}
+}
+
+func updateStructTags(decl ast.Decl, structTags map[string]map[string]string, toCopy []string) []error {
+	var errs []error
+	t, ok := decl.(*ast.GenDecl)
+	if !ok {
+		return nil
+	}
+	if t.Tok != token.TYPE {
+		return nil
+	}
+
+	for _, s := range t.Specs {
+		spec, ok := s.(*ast.TypeSpec)
+		if !ok {
+			continue
+		}
+		typeName := spec.Name.Name
+		fieldTags, ok := structTags[typeName]
+		if !ok {
+			continue
+		}
+		st, ok := spec.Type.(*ast.StructType)
+		if !ok {
+			continue
+		}
+
+		for i := range st.Fields.List {
+			f := st.Fields.List[i]
+			var name string
+			var err error
+			if len(f.Names) == 0 {
+				name, err = getFieldName(f.Type, spec.Name.Name)
+				if err != nil {
+					errs = append(errs, err)
+					continue
+				}
+			} else {
+				name = f.Names[0].Name
+			}
+			value, ok := fieldTags[name]
+			if !ok {
+				continue
+			}
+			var tags customreflect.StructTags
+			if f.Tag != nil {
+				oldTags, err := customreflect.ParseStructTags(strings.Trim(f.Tag.Value, "`"))
+				if err != nil {
+					errs = append(errs, fmt.Errorf("unable to read struct tag from struct %q, field %q: %v", spec.Name.Name, name, err))
+					continue
+				}
+				tags = oldTags
+			}
+			for _, name := range toCopy {
+				// don't overwrite existing tags
+				if tags.Has(name) {
+					continue
+				}
+				// append new tags
+				if v := reflect.StructTag(value).Get(name); len(v) > 0 {
+					tags = append(tags, customreflect.StructTag{Name: name, Value: v})
+				}
+			}
+			if len(tags) == 0 {
+				continue
+			}
+			if f.Tag == nil {
+				f.Tag = &ast.BasicLit{}
+			}
+			f.Tag.Value = tags.String()
+		}
+	}
+	return errs
+}
+
+type replacePackageVisitor struct {
+	oldPackage string
+	newPackage string
+}
+
+// Visit walks the provided node, transforming references to the old package to the new package.
+func (v replacePackageVisitor) Visit(n ast.Node) ast.Visitor {
+	if e, ok := n.(*ast.SelectorExpr); ok {
+		if i, ok := e.X.(*ast.Ident); ok && i.Name == v.oldPackage {
+			i.Name = v.newPackage
+		}
+		return nil
+	}
+	return v
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/parser_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/parser_test.go
new file mode 100644
index 0000000000..db765a30c2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/parser_test.go
@@ -0,0 +1,119 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"go/ast"
+	"testing"
+)
+
+/*
+	struct fields in go AST:
+
+     type Struct struct {
+		// fields with a direct field Name as <Ident>
+        A X  // regular fields
+        B *X // pointer fields
+        C    // embedded type field
+
+        // qualified embedded type fields use an <SelExpr> in the AST
+        v1.TypeMeta // X=v1, Sel=TypeMeta
+
+        // fields without a direct name, but
+        // a <StarExpr> in the go-AST
+        *D   // type field embedded as pointer
+        *v1.ListMeta   // qualified type field embedded as pointer
+                       // with <StarExpr> pointing to <SelExpr>
+     }
+*/
+
+func TestProtoParser(t *testing.T) {
+	ident := ast.NewIdent("FieldName")
+	tests := []struct {
+		expr ast.Expr
+		err  bool
+	}{
+		// valid struct field expressions
+		{
+			expr: ident,
+			err:  false,
+		},
+		{
+			expr: &ast.SelectorExpr{
+				Sel: ident,
+			},
+			err: false,
+		},
+		{
+			expr: &ast.StarExpr{
+				X: ident,
+			},
+			err: false,
+		},
+		{
+			expr: &ast.StarExpr{
+				X: &ast.StarExpr{
+					X: ident,
+				},
+			},
+			err: false,
+		},
+		{
+			expr: &ast.StarExpr{
+				X: &ast.SelectorExpr{
+					Sel: ident,
+				},
+			},
+			err: false,
+		},
+
+		// something else should provide an error
+		{
+			expr: &ast.KeyValueExpr{
+				Key:   ident,
+				Colon: 0,
+				Value: ident,
+			},
+			err: true,
+		},
+		{
+			expr: &ast.StarExpr{
+				X: &ast.KeyValueExpr{
+					Key:   ident,
+					Colon: 0,
+					Value: ident,
+				},
+			},
+			err: true,
+		},
+	}
+
+	for _, test := range tests {
+		actual, err := getFieldName(test.expr, "Struct")
+		if !test.err {
+			if err != nil {
+				t.Errorf("%s: unexpected error %s", test.expr, err)
+			} else if actual != ident.Name {
+				t.Errorf("%s: expected %s, got %s", test.expr, ident.Name, actual)
+			}
+		} else {
+			if err == nil {
+				t.Errorf("%s: expected error did not occur, got %s instead", test.expr, actual)
+			}
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/tags.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/tags.go
new file mode 100644
index 0000000000..44ca07d1a8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protobuf/tags.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"k8s.io/gengo/v2"
+	"k8s.io/klog/v2"
+)
+
+// extractBoolTagOrDie gets the comment-tags for the key and asserts that, if
+// it exists, the value is boolean.  If the tag did not exist, it returns
+// false.
+func extractBoolTagOrDie(key string, lines []string) bool {
+	val, err := gengo.ExtractSingleBoolCommentTag("+", key, false, lines)
+	if err != nil {
+		klog.Fatal(err)
+	}
+	return val
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protoc-gen-gogo/main.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protoc-gen-gogo/main.go
new file mode 100644
index 0000000000..a08512bce3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/go-to-protobuf/protoc-gen-gogo/main.go
@@ -0,0 +1,51 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package main defines the protoc-gen-gogo binary we use to generate our proto go files,
+// as well as takes dependencies on the correct gogo/protobuf packages for godeps.
+package main
+
+import (
+	"strings"
+
+	"github.com/gogo/protobuf/vanity/command"
+
+	// dependencies that are required for our packages
+	_ "github.com/gogo/protobuf/gogoproto"
+	_ "github.com/gogo/protobuf/proto"
+	_ "github.com/gogo/protobuf/sortkeys"
+)
+
+func main() {
+	// read input
+	request := command.Read()
+
+	// if we're given paths as inputs, generate .pb.go files based on those paths
+	for _, file := range request.FileToGenerate {
+		if strings.Contains(file, "/") {
+			if request.Parameter != nil {
+				*request.Parameter += ",paths=source_relative"
+			} else {
+				param := "paths=source_relative"
+				request.Parameter = &param
+			}
+			break
+		}
+	}
+
+	// generate
+	command.Write(command.Generate(request))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/args/args.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/args/args.go
new file mode 100644
index 0000000000..a3b6dd9079
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/args/args.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package args
+
+import (
+	"fmt"
+
+	"github.com/spf13/pflag"
+
+	"k8s.io/code-generator/pkg/apidefinitions"
+)
+
+// Args is used by the gengo framework to pass args specific to this generator.
+type Args struct {
+	OutputDir                 string // must be a directory path
+	OutputPkg                 string // must be a Go import-path
+	GoHeaderFile              string
+	VersionedClientSetPackage string // must be a Go import-path
+	InternalClientSetPackage  string // must be a Go import-path
+	ListersPackage            string // must be a Go import-path
+	SingleDirectory           bool
+
+	// PluralExceptions define a list of pluralizer exceptions in Type:PluralType format.
+	// The default list is "Endpoints:Endpoints"
+	PluralExceptions []string
+
+	apidefinitions.LintArgs
+}
+
+// New returns default arguments for the generator.
+func New() *Args {
+	return &Args{
+		SingleDirectory: false,
+	}
+}
+
+// AddFlags add the generator flags to the flag set.
+func (args *Args) AddFlags(fs *pflag.FlagSet) {
+	fs.StringVar(&args.OutputDir, "output-dir", "",
+		"the base directory under which to generate results")
+	fs.StringVar(&args.OutputPkg, "output-pkg", args.OutputPkg,
+		"the Go import-path of the generated results")
+	fs.StringVar(&args.GoHeaderFile, "go-header-file", "",
+		"the path to a file containing boilerplate header text; the string \"YEAR\" will be replaced with the current 4-digit year")
+	fs.StringVar(&args.InternalClientSetPackage, "internal-clientset-package", args.InternalClientSetPackage,
+		"the Go import-path of the internal clientset to use")
+	fs.StringVar(&args.VersionedClientSetPackage, "versioned-clientset-package", args.VersionedClientSetPackage,
+		"the Go import-path of the versioned clientset to use")
+	fs.StringVar(&args.ListersPackage, "listers-package", args.ListersPackage,
+		"the Go import-path of the listers to use")
+	fs.BoolVar(&args.SingleDirectory, "single-directory", args.SingleDirectory,
+		"if true, omit the intermediate \"internalversion\" and \"externalversions\" subdirectories")
+	fs.StringSliceVar(&args.PluralExceptions, "plural-exceptions", args.PluralExceptions,
+		"list of comma separated plural exception definitions in Type:PluralizedType format")
+	apidefinitions.AddFlags(&args.LintArgs, fs)
+}
+
+// Validate checks the given arguments.
+func (args *Args) Validate() error {
+	if len(args.OutputDir) == 0 {
+		return fmt.Errorf("--output-dir must be specified")
+	}
+	if len(args.OutputPkg) == 0 {
+		return fmt.Errorf("--output-pkg must be specified")
+	}
+	if len(args.VersionedClientSetPackage) == 0 {
+		return fmt.Errorf("--versioned-clientset-package must be specified")
+	}
+	if len(args.ListersPackage) == 0 {
+		return fmt.Errorf("--listers-package must be specified")
+	}
+	if err := apidefinitions.ValidateFlags(args.LintRules); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/factory.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/factory.go
new file mode 100644
index 0000000000..b8157d36b0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/factory.go
@@ -0,0 +1,419 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"io"
+	"path"
+
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+
+	"k8s.io/klog/v2"
+)
+
+// factoryGenerator produces a file of listers for a given GroupVersion and
+// type.
+type factoryGenerator struct {
+	generator.GoGenerator
+	outputPackage             string
+	imports                   namer.ImportTracker
+	groupVersions             map[string]clientgentypes.GroupVersions
+	gvGoNames                 map[string]string
+	clientSetPackage          string
+	internalInterfacesPackage string
+	filtered                  bool
+}
+
+var _ generator.Generator = &factoryGenerator{}
+
+func (g *factoryGenerator) Filter(c *generator.Context, t *types.Type) bool {
+	if !g.filtered {
+		g.filtered = true
+		return true
+	}
+	return false
+}
+
+func (g *factoryGenerator) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.outputPackage, g.imports),
+	}
+}
+
+func (g *factoryGenerator) Imports(c *generator.Context) (imports []string) {
+	imports = append(imports, g.imports.ImportLines()...)
+	return
+}
+
+func (g *factoryGenerator) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "{{", "}}")
+
+	klog.V(5).Infof("processing type %v", t)
+
+	gvInterfaces := make(map[string]*types.Type)
+	gvNewFuncs := make(map[string]*types.Type)
+	for groupPkgName := range g.groupVersions {
+		gvInterfaces[groupPkgName] = c.Universe.Type(types.Name{Package: path.Join(g.outputPackage, groupPkgName), Name: "Interface"})
+		gvNewFuncs[groupPkgName] = c.Universe.Function(types.Name{Package: path.Join(g.outputPackage, groupPkgName), Name: "New"})
+	}
+	m := map[string]interface{}{
+		"cacheDoneChecker":               c.Universe.Type(cacheDoneChecker),
+		"cacheInformerName":              c.Universe.Type(cacheInformerName),
+		"cacheSharedIndexInformer":       c.Universe.Type(cacheSharedIndexInformer),
+		"cacheSyncResult":                c.Universe.Type(cacheSyncResult),
+		"cacheTransformFunc":             c.Universe.Type(cacheTransformFunc),
+		"cacheWaitFor":                   c.Universe.Function(cacheWaitForFunc),
+		"contextContext":                 c.Universe.Type(contextContext),
+		"contextCause":                   c.Universe.Function(contextCauseFunc),
+		"fmtErrorf":                      c.Universe.Function(fmtErrorfFunc),
+		"groupVersions":                  g.groupVersions,
+		"gvInterfaces":                   gvInterfaces,
+		"gvNewFuncs":                     gvNewFuncs,
+		"gvGoNames":                      g.gvGoNames,
+		"interfacesNewInformerFunc":      c.Universe.Type(types.Name{Package: g.internalInterfacesPackage, Name: "NewInformerFunc"}),
+		"interfacesTweakListOptionsFunc": c.Universe.Type(types.Name{Package: g.internalInterfacesPackage, Name: "TweakListOptionsFunc"}),
+		"informerFactoryInterface":       c.Universe.Type(types.Name{Package: g.internalInterfacesPackage, Name: "SharedInformerFactory"}),
+		"clientSetInterface":             c.Universe.Type(types.Name{Package: g.clientSetPackage, Name: "Interface"}),
+		"reflectType":                    c.Universe.Type(reflectType),
+		"runtimeObject":                  c.Universe.Type(runtimeObject),
+		"schemaGroupVersionResource":     c.Universe.Type(schemaGroupVersionResource),
+		"stringsBuilder":                 c.Universe.Type(stringsBuilder),
+		"syncMutex":                      c.Universe.Type(syncMutex),
+		"timeDuration":                   c.Universe.Type(timeDuration),
+		"namespaceAll":                   c.Universe.Type(metav1NamespaceAll),
+		"object":                         c.Universe.Type(metav1Object),
+		"waitContextForChannel":          c.Universe.Function(waitContextForChannelFunc),
+	}
+
+	sw.Do(sharedInformerFactoryStruct, m)
+	sw.Do(sharedInformerFactoryInterface, m)
+
+	return sw.Error()
+}
+
+var sharedInformerFactoryStruct = `
+// SharedInformerOption defines the functional option type for SharedInformerFactory.
+type SharedInformerOption func(*sharedInformerFactory) *sharedInformerFactory
+
+type sharedInformerFactory struct {
+	client {{.clientSetInterface|raw}}
+	namespace string
+	tweakListOptions {{.interfacesTweakListOptionsFunc|raw}}
+	lock {{.syncMutex|raw}}
+	defaultResync {{.timeDuration|raw}}
+	customResync map[{{.reflectType|raw}}]{{.timeDuration|raw}}
+	transform {{.cacheTransformFunc|raw}}
+	informerName *{{.cacheInformerName|raw}}
+
+	informers map[{{.reflectType|raw}}]{{.cacheSharedIndexInformer|raw}}
+	// startedInformers is used for tracking which informers have been started.
+	// This allows Start() to be called multiple times safely.
+	startedInformers map[{{.reflectType|raw}}]bool
+	// wg tracks how many goroutines were started.
+	wg sync.WaitGroup
+	// shuttingDown is true when Shutdown has been called. It may still be running
+	// because it needs to wait for goroutines.
+	shuttingDown bool
+}
+
+// WithCustomResyncConfig sets a custom resync period for the specified informer types.
+func WithCustomResyncConfig(resyncConfig map[{{.object|raw}}]{{.timeDuration|raw}}) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		for k, v := range resyncConfig {
+			factory.customResync[reflect.TypeOf(k)] = v
+		}
+		return factory
+	}
+}
+
+// WithTweakListOptions sets a custom filter on all listers of the configured SharedInformerFactory.
+func WithTweakListOptions(tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.tweakListOptions = tweakListOptions
+		return factory
+	}
+}
+
+// WithNamespace limits the SharedInformerFactory to the specified namespace.
+func WithNamespace(namespace string) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.namespace = namespace
+		return factory
+	}
+}
+
+// WithTransform sets a transform on all informers.
+func WithTransform(transform {{.cacheTransformFunc|raw}}) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.transform = transform
+		return factory
+	}
+}
+
+// WithInformerName sets the InformerName for informer identity used in metrics.
+// The InformerName must be created via cache.NewInformerName() at startup,
+// which validates global uniqueness. Each informer type will register its
+// GVR under this name.
+func WithInformerName(informerName *{{.cacheInformerName|raw}}) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.informerName = informerName
+		return factory
+	}
+}
+
+func (f *sharedInformerFactory) InformerName() *{{.cacheInformerName|raw}} {
+	return f.informerName
+}
+
+// NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces.
+func NewSharedInformerFactory(client {{.clientSetInterface|raw}}, defaultResync {{.timeDuration|raw}}) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync)
+}
+
+// NewFilteredSharedInformerFactory constructs a new instance of sharedInformerFactory.
+// Listers obtained via this SharedInformerFactory will be subject to the same filters
+// as specified here.
+//
+// Deprecated: Please use NewSharedInformerFactoryWithOptions instead
+func NewFilteredSharedInformerFactory(client {{.clientSetInterface|raw}}, defaultResync {{.timeDuration|raw}}, namespace string, tweakListOptions {{.interfacesTweakListOptionsFunc|raw}}) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync, WithNamespace(namespace), WithTweakListOptions(tweakListOptions))
+}
+
+// NewSharedInformerFactoryWithOptions constructs a new instance of a SharedInformerFactory with additional options.
+func NewSharedInformerFactoryWithOptions(client {{.clientSetInterface|raw}}, defaultResync {{.timeDuration|raw}}, options ...SharedInformerOption) SharedInformerFactory {
+	factory := &sharedInformerFactory{
+		client:           client,
+		namespace:        v1.NamespaceAll,
+		defaultResync:    defaultResync,
+		informers:        make(map[{{.reflectType|raw}}]{{.cacheSharedIndexInformer|raw}}),
+		startedInformers: make(map[{{.reflectType|raw}}]bool),
+		customResync:     make(map[{{.reflectType|raw}}]{{.timeDuration|raw}}),
+	}
+
+	// Apply all options
+	for _, opt := range options {
+		factory = opt(factory)
+	}
+
+	return factory
+}
+
+func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
+	f.StartWithContext({{.waitContextForChannel|raw}}(stopCh))
+}
+
+func (f *sharedInformerFactory) StartWithContext(ctx {{.contextContext|raw}}) {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	if f.shuttingDown {
+		return
+	}
+
+	for informerType, informer := range f.informers {
+		if !f.startedInformers[informerType] {
+			f.wg.Go(func() {
+				informer.RunWithContext(ctx)
+			})
+			f.startedInformers[informerType] = true
+		}
+	}
+}
+
+func (f *sharedInformerFactory) Shutdown() {
+	f.lock.Lock()
+	f.shuttingDown = true
+	f.lock.Unlock()
+
+
+	// Will return immediately if there is nothing to wait for.
+	f.wg.Wait()
+	f.informerName.Release()
+}
+
+func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
+	result := f.WaitForCacheSyncWithContext(wait.ContextForChannel(stopCh))
+	return result.Synced
+}
+
+func (f *sharedInformerFactory) WaitForCacheSyncWithContext(ctx context.Context) {{.cacheSyncResult|raw}} {
+	informers := func() map[{{.reflectType|raw}}]{{.cacheSharedIndexInformer|raw}} {
+		f.lock.Lock()
+		defer f.lock.Unlock()
+
+		informers := map[{{.reflectType|raw}}]{{.cacheSharedIndexInformer|raw}}{}
+		for informerType, informer := range f.informers {
+			if f.startedInformers[informerType] {
+				informers[informerType] = informer
+			}
+		}
+		return informers
+	}()
+
+	// Wait for informers to sync, without polling.
+	cacheSyncs := make([]{{.cacheDoneChecker|raw}}, 0, len(informers))
+	for _, informer := range informers {
+		cacheSyncs = append(cacheSyncs, informer.HasSyncedChecker())
+	}
+	{{.cacheWaitFor|raw}}(ctx, "" /* no logging */, cacheSyncs...)
+
+	res := {{.cacheSyncResult|raw}} {
+		Synced: make(map[{{.reflectType|raw}}]bool, len(informers)),
+	}
+	failed := false
+	for informType, informer := range informers {
+		hasSynced := informer.HasSynced()
+		if !hasSynced {
+			failed = true
+		}
+		res.Synced[informType] = hasSynced
+	}
+	if failed {
+		// context.Cause is more informative than ctx.Err().
+		// This must be non-nil, otherwise WaitFor wouldn't have stopped
+		// prematurely.
+		res.Err = {{.contextCause|raw}}(ctx)
+	}
+
+	return res
+}
+
+// InformerFor returns the SharedIndexInformer for obj using an internal
+// client.
+func (f *sharedInformerFactory) InformerFor(obj {{.runtimeObject|raw}}, newFunc {{.interfacesNewInformerFunc|raw}}) {{.cacheSharedIndexInformer|raw}} {
+  f.lock.Lock()
+  defer f.lock.Unlock()
+
+  informerType := reflect.TypeOf(obj)
+  informer, exists := f.informers[informerType]
+  if exists {
+    return informer
+  }
+
+  resyncPeriod, exists := f.customResync[informerType]
+  if !exists {
+    resyncPeriod = f.defaultResync
+  }
+
+  informer = newFunc(f.client, resyncPeriod)
+  if f.transform != nil {
+    informer.SetTransform(f.transform)
+  }
+  f.informers[informerType] = informer
+
+  return informer
+}
+`
+
+var sharedInformerFactoryInterface = `
+// SharedInformerFactory provides shared informers for resources in all known
+// API group versions.
+//
+// It is typically used like this:
+//
+//	ctx, cancel := context.WithCancel(context.Background())
+//	defer cancel()
+//	factory := NewSharedInformerFactory(client, resyncPeriod)
+//	defer factory.Shutdown()    // Returns immediately if nothing was started.
+//	genericInformer := factory.ForResource(resource)
+//	typedInformer := factory.SomeAPIGroup().V1().SomeType()
+//	handle, err := typeInformer.Informer().AddEventHandler(...)
+//	if err != nil {
+//	    return fmt.Errorf("register event handler: %v", err)
+//	}
+//	defer typeInformer.Informer().RemoveEventHandler(handle) // Avoids leaking goroutines.
+//	factory.StartWithContext(ctx)                            // Start processing these informers.
+//	synced := factory.WaitForCacheSyncWithContext(ctx)
+//	if err := synced.AsError(); err != nil {
+//	    return err
+//	}
+//	for v := range synced {
+//	    // Only if desired log some information similar to this.
+//	    fmt.Fprintf(os.Stdout, "cache synced: %s", v)
+//	}
+//
+//	// Also make sure that all of the initial cache events have been delivered.
+//	if !WaitFor(ctx, "event handler sync", handle.HasSyncedChecker()) {
+//	    // Must have failed because of context.
+//	    return fmt.Errorf("sync event handler: %w", context.Cause(ctx))
+//	}
+//
+//	// Creating informers can also be created after Start, but then
+//	// Start must be called again:
+//	anotherGenericInformer := factory.ForResource(resource)
+//	factory.StartWithContext(ctx)
+type SharedInformerFactory interface {
+	{{.informerFactoryInterface|raw}}
+
+	// Start initializes all requested informers. They are handled in goroutines
+	// which run until the stop channel gets closed.
+	// Warning: Start does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	//
+	// Contextual logging: StartWithContext should be used instead of Start in code which supports contextual logging.
+	Start(stopCh <-chan struct{})
+
+	// StartWithContext initializes all requested informers. They are handled in goroutines
+	// which run until the context gets canceled.
+	// Warning: StartWithContext does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	StartWithContext(ctx context.Context)
+
+	// Shutdown marks a factory as shutting down. At that point no new
+	// informers can be started anymore and Start will return without
+	// doing anything.
+	//
+	// In addition, Shutdown blocks until all goroutines have terminated. For that
+	// to happen, the close channel(s) that they were started with must be closed,
+	// either before Shutdown gets called or while it is waiting.
+	//
+	// Shutdown may be called multiple times, even concurrently. All such calls will
+	// block until all goroutines have terminated.
+	Shutdown()
+
+	// WaitForCacheSync blocks until all started informers' caches were synced
+	// or the stop channel gets closed.
+	//
+	// Contextual logging: WaitForCacheSyncWithContext should be used instead of WaitForCacheSync in code which supports contextual logging. It also returns a more useful result.
+	WaitForCacheSync(stopCh <-chan struct{}) map[{{.reflectType|raw}}]bool
+
+	// WaitForCacheSyncWithContext blocks until all started informers' caches were synced
+	// or the context gets canceled.
+	WaitForCacheSyncWithContext(ctx {{.contextContext|raw}}) {{.cacheSyncResult|raw}}
+
+	// ForResource gives generic access to a shared informer of the matching type.
+	ForResource(resource {{.schemaGroupVersionResource|raw}}) (GenericInformer, error)
+
+	// InformerFor returns the SharedIndexInformer for obj using an internal
+	// client.
+	InformerFor(obj {{.runtimeObject|raw}}, newFunc {{.interfacesNewInformerFunc|raw}}) {{.cacheSharedIndexInformer|raw}}
+
+	{{$gvInterfaces := .gvInterfaces}}
+	{{$gvGoNames := .gvGoNames}}
+	{{range $groupName, $group := .groupVersions}}{{index $gvGoNames $groupName}}() {{index $gvInterfaces $groupName|raw}}
+	{{end}}
+}
+
+{{$gvNewFuncs := .gvNewFuncs}}
+{{$gvGoNames := .gvGoNames}}
+{{range $groupPkgName, $group := .groupVersions}}
+func (f *sharedInformerFactory) {{index $gvGoNames $groupPkgName}}() {{index $gvInterfaces $groupPkgName|raw}} {
+  return {{index $gvNewFuncs $groupPkgName|raw}}(f, f.namespace, f.tweakListOptions)
+}
+{{end}}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/factoryinterface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/factoryinterface.go
new file mode 100644
index 0000000000..e59b8bcc5f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/factoryinterface.go
@@ -0,0 +1,111 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"io"
+
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+
+	"k8s.io/klog/v2"
+)
+
+// factoryInterfaceGenerator produces a file of interfaces used to break a dependency cycle for
+// informer registration
+type factoryInterfaceGenerator struct {
+	generator.GoGenerator
+	outputPackage    string
+	imports          namer.ImportTracker
+	clientSetPackage string
+	filtered         bool
+}
+
+var _ generator.Generator = &factoryInterfaceGenerator{}
+
+func (g *factoryInterfaceGenerator) Filter(c *generator.Context, t *types.Type) bool {
+	if !g.filtered {
+		g.filtered = true
+		return true
+	}
+	return false
+}
+
+func (g *factoryInterfaceGenerator) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.outputPackage, g.imports),
+	}
+}
+
+func (g *factoryInterfaceGenerator) Imports(c *generator.Context) (imports []string) {
+	imports = append(imports, g.imports.ImportLines()...)
+	return
+}
+
+func (g *factoryInterfaceGenerator) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "{{", "}}")
+
+	klog.V(5).Infof("processing type %v", t)
+
+	m := map[string]interface{}{
+		"cacheIndexers":            c.Universe.Type(cacheIndexers),
+		"cacheInformerName":        c.Universe.Type(cacheInformerName),
+		"cacheSharedIndexInformer": c.Universe.Type(cacheSharedIndexInformer),
+		"clientSetPackage":         c.Universe.Type(types.Name{Package: g.clientSetPackage, Name: "Interface"}),
+		"runtimeObject":            c.Universe.Type(runtimeObject),
+		"timeDuration":             c.Universe.Type(timeDuration),
+		"v1ListOptions":            c.Universe.Type(v1ListOptions),
+	}
+
+	sw.Do(externalSharedInformerFactoryInterface, m)
+
+	return sw.Error()
+}
+
+var externalSharedInformerFactoryInterface = `
+// NewInformerFunc takes {{.clientSetPackage|raw}} and {{.timeDuration|raw}} to return a SharedIndexInformer.
+type NewInformerFunc func({{.clientSetPackage|raw}}, {{.timeDuration|raw}}) cache.SharedIndexInformer
+
+// SharedInformerFactory a small interface to allow for adding an informer without an import cycle
+type SharedInformerFactory interface {
+	Start(stopCh <-chan struct{})
+	InformerFor(obj {{.runtimeObject|raw}}, newFunc NewInformerFunc) {{.cacheSharedIndexInformer|raw}}
+	InformerName() *{{.cacheInformerName|raw}}
+}
+
+// TweakListOptionsFunc is a function that transforms a {{.v1ListOptions|raw}}.
+type TweakListOptionsFunc func(*{{.v1ListOptions|raw}})
+
+// InformerOptions holds the options for creating an informer.
+type InformerOptions struct {
+	// ResyncPeriod is the resync period for this informer.
+	// If not set, defaults to 0 (no resync).
+	ResyncPeriod {{.timeDuration|raw}}
+
+	// Indexers are the indexers for this informer.
+	Indexers {{.cacheIndexers|raw}}
+
+	// InformerName is used to uniquely identify this informer for metrics.
+	// If not set, metrics will not be published for this informer.
+	// Use cache.NewInformerName() to create an InformerName at startup.
+	InformerName *{{.cacheInformerName|raw}}
+
+	// TweakListOptions is an optional function to modify the list options.
+	TweakListOptions TweakListOptionsFunc
+}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/generic.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/generic.go
new file mode 100644
index 0000000000..e863b1d2fd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/generic.go
@@ -0,0 +1,184 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"io"
+	"sort"
+	"strings"
+
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+	codegennamer "k8s.io/code-generator/pkg/namer"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+)
+
+// genericGenerator generates the generic informer.
+type genericGenerator struct {
+	generator.GoGenerator
+	outputPackage        string
+	imports              namer.ImportTracker
+	groupVersions        map[string]clientgentypes.GroupVersions
+	groupGoNames         map[string]string
+	pluralExceptions     map[string]string
+	typesForGroupVersion map[clientgentypes.GroupVersion][]*types.Type
+	filtered             bool
+}
+
+var _ generator.Generator = &genericGenerator{}
+
+func (g *genericGenerator) Filter(c *generator.Context, t *types.Type) bool {
+	if !g.filtered {
+		g.filtered = true
+		return true
+	}
+	return false
+}
+
+func (g *genericGenerator) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw":                namer.NewRawNamer(g.outputPackage, g.imports),
+		"allLowercasePlural": namer.NewAllLowercasePluralNamer(g.pluralExceptions),
+		"publicPlural":       namer.NewPublicPluralNamer(g.pluralExceptions),
+		"resource":           codegennamer.NewTagOverrideNamer("resourceName", namer.NewAllLowercasePluralNamer(g.pluralExceptions)),
+	}
+}
+
+func (g *genericGenerator) Imports(c *generator.Context) (imports []string) {
+	imports = append(imports, g.imports.ImportLines()...)
+	return
+}
+
+type group struct {
+	GroupGoName string
+	Name        string
+	Versions    []*version
+}
+
+type groupSort []group
+
+func (g groupSort) Len() int { return len(g) }
+func (g groupSort) Less(i, j int) bool {
+	return strings.ToLower(g[i].Name) < strings.ToLower(g[j].Name)
+}
+func (g groupSort) Swap(i, j int) { g[i], g[j] = g[j], g[i] }
+
+type version struct {
+	Name      string
+	GoName    string
+	Resources []*types.Type
+}
+
+type versionSort []*version
+
+func (v versionSort) Len() int { return len(v) }
+func (v versionSort) Less(i, j int) bool {
+	return strings.ToLower(v[i].Name) < strings.ToLower(v[j].Name)
+}
+func (v versionSort) Swap(i, j int) { v[i], v[j] = v[j], v[i] }
+
+func (g *genericGenerator) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "{{", "}}")
+
+	groups := []group{}
+	schemeGVs := make(map[*version]*types.Type)
+
+	orderer := namer.Orderer{Namer: namer.NewPrivateNamer(0)}
+	for groupPackageName, groupVersions := range g.groupVersions {
+		group := group{
+			GroupGoName: g.groupGoNames[groupPackageName],
+			Name:        groupVersions.Group.NonEmpty(),
+			Versions:    []*version{},
+		}
+		for _, v := range groupVersions.Versions {
+			gv := clientgentypes.GroupVersion{Group: groupVersions.Group, Version: v.Version}
+			version := &version{
+				Name:      v.Version.NonEmpty(),
+				GoName:    namer.IC(v.Version.NonEmpty()),
+				Resources: orderer.OrderTypes(g.typesForGroupVersion[gv]),
+			}
+			func() {
+				schemeGVs[version] = c.Universe.Variable(types.Name{Package: g.typesForGroupVersion[gv][0].Name.Package, Name: "SchemeGroupVersion"})
+			}()
+			group.Versions = append(group.Versions, version)
+		}
+		sort.Sort(versionSort(group.Versions))
+		groups = append(groups, group)
+	}
+	sort.Sort(groupSort(groups))
+
+	m := map[string]interface{}{
+		"cacheGenericLister":         c.Universe.Type(cacheGenericLister),
+		"cacheNewGenericLister":      c.Universe.Function(cacheNewGenericLister),
+		"cacheSharedIndexInformer":   c.Universe.Type(cacheSharedIndexInformer),
+		"fmtErrorf":                  c.Universe.Type(fmtErrorfFunc),
+		"groups":                     groups,
+		"schemeGVs":                  schemeGVs,
+		"schemaGroupResource":        c.Universe.Type(schemaGroupResource),
+		"schemaGroupVersionResource": c.Universe.Type(schemaGroupVersionResource),
+	}
+
+	sw.Do(genericInformer, m)
+	sw.Do(forResource, m)
+
+	return sw.Error()
+}
+
+var genericInformer = `
+// GenericInformer is type of SharedIndexInformer which will locate and delegate to other
+// sharedInformers based on type
+type GenericInformer interface {
+	Informer() {{.cacheSharedIndexInformer|raw}}
+	Lister() {{.cacheGenericLister|raw}}
+}
+
+type genericInformer struct {
+	informer {{.cacheSharedIndexInformer|raw}}
+	resource {{.schemaGroupResource|raw}}
+}
+
+// Informer returns the SharedIndexInformer.
+func (f *genericInformer) Informer() {{.cacheSharedIndexInformer|raw}} {
+	return f.informer
+}
+
+// Lister returns the GenericLister.
+func (f *genericInformer) Lister() {{.cacheGenericLister|raw}} {
+	return {{.cacheNewGenericLister|raw}}(f.Informer().GetIndexer(), f.resource)
+}
+`
+
+var forResource = `
+// ForResource gives generic access to a shared informer of the matching type
+// TODO extend this to unknown resources with a client pool
+func (f *sharedInformerFactory) ForResource(resource {{.schemaGroupVersionResource|raw}}) (GenericInformer, error) {
+	switch resource {
+		{{range $group := .groups -}}{{$GroupGoName := .GroupGoName -}}
+			{{range $version := .Versions -}}
+	// Group={{$group.Name}}, Version={{.Name}}
+				{{range .Resources -}}
+	case {{index $.schemeGVs $version|raw}}.WithResource("{{.|resource}}"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.{{$GroupGoName}}().{{$version.GoName}}().{{.|publicPlural}}().Informer()}, nil
+				{{end}}
+			{{end}}
+		{{end -}}
+	}
+
+	return nil, {{.fmtErrorf|raw}}("no informer found for %v", resource)
+}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/groupinterface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/groupinterface.go
new file mode 100644
index 0000000000..5342e25d97
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/groupinterface.go
@@ -0,0 +1,118 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"io"
+	"path"
+	"strings"
+
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+)
+
+// groupInterfaceGenerator generates the per-group interface file.
+type groupInterfaceGenerator struct {
+	generator.GoGenerator
+	outputPackage             string
+	imports                   namer.ImportTracker
+	groupVersions             clientgentypes.GroupVersions
+	filtered                  bool
+	internalInterfacesPackage string
+}
+
+var _ generator.Generator = &groupInterfaceGenerator{}
+
+func (g *groupInterfaceGenerator) Filter(c *generator.Context, t *types.Type) bool {
+	if !g.filtered {
+		g.filtered = true
+		return true
+	}
+	return false
+}
+
+func (g *groupInterfaceGenerator) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.outputPackage, g.imports),
+	}
+}
+
+func (g *groupInterfaceGenerator) Imports(c *generator.Context) (imports []string) {
+	imports = append(imports, g.imports.ImportLines()...)
+	return
+}
+
+type versionData struct {
+	Name      string
+	Interface *types.Type
+	New       *types.Type
+}
+
+func (g *groupInterfaceGenerator) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+
+	versions := make([]versionData, 0, len(g.groupVersions.Versions))
+	for _, version := range g.groupVersions.Versions {
+		gv := clientgentypes.GroupVersion{Group: g.groupVersions.Group, Version: version.Version}
+		versionPackage := path.Join(g.outputPackage, strings.ToLower(gv.Version.NonEmpty()))
+		iface := c.Universe.Type(types.Name{Package: versionPackage, Name: "Interface"})
+		versions = append(versions, versionData{
+			Name:      namer.IC(version.Version.NonEmpty()),
+			Interface: iface,
+			New:       c.Universe.Function(types.Name{Package: versionPackage, Name: "New"}),
+		})
+	}
+	m := map[string]interface{}{
+		"interfacesTweakListOptionsFunc":  c.Universe.Type(types.Name{Package: g.internalInterfacesPackage, Name: "TweakListOptionsFunc"}),
+		"interfacesSharedInformerFactory": c.Universe.Type(types.Name{Package: g.internalInterfacesPackage, Name: "SharedInformerFactory"}),
+		"versions":                        versions,
+	}
+
+	sw.Do(groupTemplate, m)
+
+	return sw.Error()
+}
+
+var groupTemplate = `
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	$range .versions -$
+		// $.Name$ provides access to shared informers for resources in $.Name$.
+		$.Name$() $.Interface|raw$
+	$end$
+}
+
+type group struct {
+	factory $.interfacesSharedInformerFactory|raw$
+	namespace string
+	tweakListOptions  $.interfacesTweakListOptionsFunc|raw$
+}
+
+// New returns a new Interface.
+func New(f $.interfacesSharedInformerFactory|raw$, namespace string, tweakListOptions $.interfacesTweakListOptionsFunc|raw$) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+$range .versions$
+// $.Name$ returns a new $.Interface|raw$.
+func (g *group) $.Name$() $.Interface|raw$ {
+	return $.New|raw$(g.factory, g.namespace, g.tweakListOptions)
+}
+$end$
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/informer.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/informer.go
new file mode 100644
index 0000000000..4a95162d33
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/informer.go
@@ -0,0 +1,331 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+
+	"k8s.io/code-generator/cmd/client-gen/generators/util"
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+
+	"k8s.io/klog/v2"
+)
+
+// informerGenerator produces a file of listers for a given GroupVersion and
+// type.
+type informerGenerator struct {
+	generator.GoGenerator
+	outputPackage             string
+	groupPkgName              string
+	groupVersion              clientgentypes.GroupVersion
+	groupGoName               string
+	typeToGenerate            *types.Type
+	imports                   namer.ImportTracker
+	clientSetPackage          string
+	listersPackage            string
+	internalInterfacesPackage string
+}
+
+var _ generator.Generator = &informerGenerator{}
+
+func (g *informerGenerator) Filter(c *generator.Context, t *types.Type) bool {
+	return t == g.typeToGenerate
+}
+
+func (g *informerGenerator) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.outputPackage, g.imports),
+	}
+}
+
+func (g *informerGenerator) Imports(c *generator.Context) (imports []string) {
+	imports = append(imports, g.imports.ImportLines()...)
+	return
+}
+
+func (g *informerGenerator) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+
+	klog.V(5).Infof("processing type %v", t)
+
+	listerPackage := fmt.Sprintf("%s/%s/%s", g.listersPackage, g.groupPkgName, strings.ToLower(g.groupVersion.Version.NonEmpty()))
+	clientSetInterface := c.Universe.Type(types.Name{Package: g.clientSetPackage, Name: "Interface"})
+	informerFor := "InformerFor"
+
+	tags, err := util.ParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...))
+	if err != nil {
+		return err
+	}
+
+	m := map[string]interface{}{
+		"apiScheme":                                   c.Universe.Type(apiScheme),
+		"cacheDeletedObject":                          c.Universe.Type(cacheDeletedObject),
+		"cacheIndexers":                               c.Universe.Type(cacheIndexers),
+		"cacheListWatch":                              c.Universe.Type(cacheListWatch),
+		"cacheMetaNamespaceIndexFunc":                 c.Universe.Function(cacheMetaNamespaceIndexFunc),
+		"cacheNamespaceIndex":                         c.Universe.Variable(cacheNamespaceIndex),
+		"cacheNewSharedIndexInformer":                 c.Universe.Function(cacheNewSharedIndexInformer),
+		"cacheNewTypedSharedIndexInformer":            c.Universe.Function(cacheNewTypedSharedIndexInformer),
+		"cacheNewSharedIndexInformerWithOptions":      c.Universe.Function(cacheNewSharedIndexInformerWithOptions),
+		"cacheSharedIndexInformer":                    c.Universe.Type(cacheSharedIndexInformer),
+		"cacheTypedFilteringResourceEventHandler":     c.Universe.Type(cacheTypedFilteringResourceEventHandler),
+		"cacheTypedResourceEventHandlerDetailedFuncs": c.Universe.Type(cacheTypedResourceEventHandlerDetailedFuncs),
+		"cacheTypedResourceEventHandlerFuncs":         c.Universe.Type(cacheTypedResourceEventHandlerFuncs),
+		"cacheTypedIndexers":                          c.Universe.Type(cacheTypedIndexers),
+		"cacheTypedIndexersToIndexers":                c.Universe.Type(cacheTypedIndexersToIndexers),
+		"cacheTypedSharedIndexInformer":               c.Universe.Type(cacheTypedSharedIndexInformer),
+		"cacheSharedIndexInformerOptions":             c.Universe.Type(cacheSharedIndexInformerOptions),
+		"cacheToListWatcherWithWatchListSemantics":    c.Universe.Function(cacheToListWatcherWithWatchListSemanticsFunc),
+		"cacheInformerName":                           c.Universe.Type(cacheInformerName),
+		"clientSetInterface":                          clientSetInterface,
+		"contextContext":                              c.Universe.Type(contextContext),
+		"contextBackground":                           c.Universe.Function(contextBackgroundFunc),
+		"group":                                       namer.IC(g.groupGoName),
+		"groupName":                                   g.groupVersion.Group.String(),
+		"informerFor":                                 informerFor,
+		"interfacesInformerOptions":                   c.Universe.Type(types.Name{Package: g.internalInterfacesPackage, Name: "InformerOptions"}),
+		"interfacesTweakListOptionsFunc":              c.Universe.Type(types.Name{Package: g.internalInterfacesPackage, Name: "TweakListOptionsFunc"}),
+		"interfacesSharedInformerFactory":             c.Universe.Type(types.Name{Package: g.internalInterfacesPackage, Name: "SharedInformerFactory"}),
+		"listOptions":                                 c.Universe.Type(listOptions),
+		"lister":                                      c.Universe.Type(types.Name{Package: listerPackage, Name: t.Name.Name + "Lister"}),
+		"namespaceAll":                                c.Universe.Type(metav1NamespaceAll),
+		"namespaced":                                  !tags.NonNamespaced,
+		"newLister":                                   c.Universe.Function(types.Name{Package: listerPackage, Name: "New" + t.Name.Name + "Lister"}),
+		"resourceName":                                strings.ToLower(t.Name.Name) + "s",
+		"runtimeObject":                               c.Universe.Type(runtimeObject),
+		"schemaGroupVersionResource":                  c.Universe.Type(schemaGroupVersionResource),
+		"timeDuration":                                c.Universe.Type(timeDuration),
+		"type":                                        t,
+		"v1ListOptions":                               c.Universe.Type(v1ListOptions),
+		"version":                                     namer.IC(g.groupVersion.Version.String()),
+		"versionName":                                 g.groupVersion.Version.String(),
+		"watchInterface":                              c.Universe.Type(watchInterface),
+	}
+
+	sw.Do(typeInformerInterface, m)
+	sw.Do(typeInformerStruct, m)
+	sw.Do(typeInformerPublicConstructor, m)
+	sw.Do(typeFilteredInformerPublicConstructor, m)
+	sw.Do(typeInformerPublicConstructorWithOptions, m)
+	sw.Do(typeInformerConstructor, m)
+	sw.Do(typeInformerInformer, m)
+	sw.Do(typeInformerLister, m)
+	sw.Do(typeInformerToTypedInformer, m)
+	sw.Do(typeInformerToIndexInformer, m)
+
+	return sw.Error()
+}
+
+var typeInformerInterface = `
+// $.type|public$Informer provides access to a shared informer and lister for
+// $.type|publicPlural$. Prefer using the type-safe variant (see [Typed$.type|public$Informer]).
+type $.type|public$Informer interface {
+	Informer() $.cacheSharedIndexInformer|raw$
+	Lister() $.lister|raw$
+}
+
+// Typed$.type|public$Informer provides access to a shared informer and lister for
+// $.type|publicPlural$, including the type-safe TypedInformer variant.
+// It is a superset of $.type|public$Informer.
+type Typed$.type|public$Informer interface {
+	Informer() $.cacheSharedIndexInformer|raw$
+	TypedInformer() $.type|public$IndexInformer
+	Lister() $.lister|raw$
+}
+
+// $.type|public$IndexInformer is a wrapper around the underlying [$.cacheSharedIndexInformer|raw$]
+// with type-safe variants of several methods.
+type $.type|public$IndexInformer $.cacheTypedSharedIndexInformer|raw$[*$.type|raw$]
+
+// $.type|public$HandlerFuncs is a specialization of [$.cacheTypedResourceEventHandlerFuncs|raw$] for $.type|public$.
+type $.type|public$HandlerFuncs = $.cacheTypedResourceEventHandlerFuncs|raw$[*$.type|raw$]
+
+// $.type|public$DetailedHandlerFuncs is a specialization of [$.cacheTypedResourceEventHandlerDetailedFuncs|raw$] for $.type|public$.
+type $.type|public$DetailedHandlerFuncs = $.cacheTypedResourceEventHandlerDetailedFuncs|raw$[*$.type|raw$]
+
+// $.type|public$FilteringHandler is a specialization of [$.cacheTypedFilteringResourceEventHandler|raw$] for $.type|public$.
+type $.type|public$FilteringHandler = $.cacheTypedFilteringResourceEventHandler|raw$[*$.type|raw$]
+
+// $.type|public$Indexers is a specialization of [$.cacheTypedIndexers|raw$] for $.type|public$.
+type $.type|public$Indexers = $.cacheTypedIndexers|raw$[*$.type|raw$]
+
+// Deleted$.type|public$ is a specialization of [$.cacheDeletedObject|raw$] for $.type|public$.
+type Deleted$.type|public$ = $.cacheDeletedObject|raw$[*$.type|raw$]
+`
+
+var typeInformerStruct = `
+type $.type|private$Informer struct {
+	factory $.interfacesSharedInformerFactory|raw$
+	tweakListOptions $.interfacesTweakListOptionsFunc|raw$
+	$if .namespaced$namespace string$end$
+}
+`
+
+var typeInformerPublicConstructor = `
+// New$.type|public$Informer constructs a new informer for $.type|public$ type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTyped$.type|public$Informer]).
+func New$.type|public$Informer(client $.clientSetInterface|raw$$if .namespaced$, namespace string$end$, resyncPeriod $.timeDuration|raw$, indexers $.cacheIndexers|raw$) $.cacheSharedIndexInformer|raw$ {
+	return New$.type|public$InformerWithOptions(client$if .namespaced$, namespace$end$, $.interfacesInformerOptions|raw${ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTyped$.type|public$Informer constructs a new informer for $.type|public$ type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTyped$.type|public$Informer(client $.clientSetInterface|raw$$if .namespaced$, namespace string$end$, resyncPeriod $.timeDuration|raw$, indexers $.type|public$Indexers) $.type|public$IndexInformer {
+	return NewTyped$.type|public$InformerWithOptions(client$if .namespaced$, namespace$end$, $.interfacesInformerOptions|raw${ResyncPeriod: resyncPeriod, Indexers: $.cacheTypedIndexersToIndexers|raw$(indexers)})
+}
+`
+
+var typeFilteredInformerPublicConstructor = `
+// NewFiltered$.type|public$Informer constructs a new informer for $.type|public$ type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFiltered$.type|public$Informer]).
+func NewFiltered$.type|public$Informer(client $.clientSetInterface|raw$$if .namespaced$, namespace string$end$, resyncPeriod $.timeDuration|raw$, indexers $.cacheIndexers|raw$, tweakListOptions $.interfacesTweakListOptionsFunc|raw$) $.cacheSharedIndexInformer|raw$ {
+	return NewTyped$.type|public$InformerWithOptions(client$if .namespaced$, namespace$end$, $.interfacesInformerOptions|raw${ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFiltered$.type|public$Informer constructs a new informer for $.type|public$ type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFiltered$.type|public$Informer(client $.clientSetInterface|raw$$if .namespaced$, namespace string$end$, resyncPeriod $.timeDuration|raw$, indexers $.type|public$Indexers, tweakListOptions $.interfacesTweakListOptionsFunc|raw$) $.type|public$IndexInformer {
+	return NewTyped$.type|public$InformerWithOptions(client$if .namespaced$, namespace$end$, $.interfacesInformerOptions|raw${ResyncPeriod: resyncPeriod, Indexers: $.cacheTypedIndexersToIndexers|raw$(indexers), TweakListOptions: tweakListOptions})
+}
+`
+
+var typeInformerPublicConstructorWithOptions = `
+// New$.type|public$InformerWithOptions constructs a new informer for $.type|public$ type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTyped$.type|public$InformerWithOptions]).
+func New$.type|public$InformerWithOptions(client $.clientSetInterface|raw$$if .namespaced$, namespace string$end$, options $.interfacesInformerOptions|raw$) $.cacheSharedIndexInformer|raw$ {
+	return NewTyped$.type|public$InformerWithOptions(client$if .namespaced$, namespace$end$, options)
+}
+
+// NewTyped$.type|public$InformerWithOptions constructs a new informer for $.type|public$ type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTyped$.type|public$InformerWithOptions(client $.clientSetInterface|raw$$if .namespaced$, namespace string$end$, options $.interfacesInformerOptions|raw$) $.type|public$IndexInformer {
+	gvr := $.schemaGroupVersionResource|raw${Group: "$.groupName$", Version: "$.versionName$", Resource: "$.resourceName$"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return $.cacheNewTypedSharedIndexInformer|raw$[*$.type|raw$]($.cacheNewSharedIndexInformerWithOptions|raw$(
+		$.cacheToListWatcherWithWatchListSemantics|raw$(&$.cacheListWatch|raw${
+			ListFunc: func(opts $.v1ListOptions|raw$) ($.runtimeObject|raw$, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.$.group$$.version$().$.type|publicPlural$($if .namespaced$namespace$end$).List($.contextBackground|raw$(), opts)
+			},
+			WatchFunc: func(opts $.v1ListOptions|raw$) ($.watchInterface|raw$, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.$.group$$.version$().$.type|publicPlural$($if .namespaced$namespace$end$).Watch($.contextBackground|raw$(), opts)
+			},
+			ListWithContextFunc: func(ctx $.contextContext|raw$, opts $.v1ListOptions|raw$) ($.runtimeObject|raw$, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.$.group$$.version$().$.type|publicPlural$($if .namespaced$namespace$end$).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx $.contextContext|raw$, opts $.v1ListOptions|raw$) ($.watchInterface|raw$, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.$.group$$.version$().$.type|publicPlural$($if .namespaced$namespace$end$).Watch(ctx, opts)
+			},
+		}, client),
+		&$.type|raw${},
+		$.cacheSharedIndexInformerOptions|raw${
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+`
+
+var typeInformerConstructor = `
+func (f *$.type|private$Informer) defaultInformer(client $.clientSetInterface|raw$, resyncPeriod $.timeDuration|raw$) $.cacheSharedIndexInformer|raw$ {
+	return NewTyped$.type|public$InformerWithOptions(client$if .namespaced$, f.namespace$end$, $.interfacesInformerOptions|raw${ResyncPeriod: resyncPeriod, Indexers: $.cacheIndexers|raw${$.cacheNamespaceIndex|raw$: $.cacheMetaNamespaceIndexFunc|raw$}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+`
+
+var typeInformerInformer = `
+func (f *$.type|private$Informer) Informer() $.cacheSharedIndexInformer|raw$ {
+	return f.TypedInformer()
+}
+
+func (f *$.type|private$Informer) TypedInformer() $.type|public$IndexInformer {
+	return $.cacheNewTypedSharedIndexInformer|raw$[*$.type|raw$](f.factory.$.informerFor$(&$.type|raw${}, f.defaultInformer))
+}
+`
+
+var typeInformerLister = `
+func (f *$.type|private$Informer) Lister() $.lister|raw$ {
+	return $.newLister|raw$(f.Informer().GetIndexer())
+}
+`
+
+var typeInformerToTypedInformer = `
+// ToTyped$.type|public$Informer converts an untyped informer into a Typed$.type|public$Informer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *$.type|public$. If that is not the case, calling type-safe methods of the returned
+// Typed$.type|public$Informer leads to runtime panics. A safer alternative is to pass
+// around a Typed$.type|public$Informer instances that was obtained from a
+// SharedInformerFactory.
+func ToTyped$.type|public$Informer(informer $.type|public$Informer) Typed$.type|public$Informer {
+	if informer, ok := informer.(Typed$.type|public$Informer); ok {
+		return informer
+	}
+	return &$.type|private$TypedInformerAdapter{informer}
+}
+
+type $.type|private$TypedInformerAdapter struct {
+	$.type|public$Informer
+}
+
+func (a *$.type|private$TypedInformerAdapter) TypedInformer() $.type|public$IndexInformer {
+	return $.cacheNewTypedSharedIndexInformer|raw$[*$.type|raw$](a.Informer())
+}
+`
+
+var typeInformerToIndexInformer = `
+// To$.type|public$IndexInformer converts an untyped informer into a $.type|public$IndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *$.type|public$. If that is not the case, calling type-safe methods of the returned
+// $.type|public$IndexInformer leads to runtime panics. A safer alternative is to pass
+// around a $.type|public$IndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func To$.type|public$IndexInformer(informer $.cacheSharedIndexInformer|raw$) $.type|public$IndexInformer {
+	if informer, ok := informer.($.type|public$IndexInformer); ok {
+		return informer
+	}
+	return $.cacheNewTypedSharedIndexInformer|raw$[*$.type|raw$](informer)
+}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/targets.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/targets.go
new file mode 100644
index 0000000000..0f916d6bf1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/targets.go
@@ -0,0 +1,395 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"fmt"
+	"path"
+	"path/filepath"
+	"strings"
+
+	"k8s.io/code-generator/cmd/client-gen/generators/util"
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+	"k8s.io/code-generator/cmd/informer-gen/args"
+	"k8s.io/code-generator/pkg/apidefinitions"
+	genutil "k8s.io/code-generator/pkg/util"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/klog/v2"
+)
+
+// NameSystems returns the name system used by the generators in this package.
+func NameSystems(pluralExceptions map[string]string) namer.NameSystems {
+	return namer.NameSystems{
+		"public":             namer.NewPublicNamer(0),
+		"private":            namer.NewPrivateNamer(0),
+		"raw":                namer.NewRawNamer("", nil),
+		"publicPlural":       namer.NewPublicPluralNamer(pluralExceptions),
+		"allLowercasePlural": namer.NewAllLowercasePluralNamer(pluralExceptions),
+		"lowercaseSingular":  &lowercaseSingularNamer{},
+	}
+}
+
+// lowercaseSingularNamer implements Namer
+type lowercaseSingularNamer struct{}
+
+// Name returns t's name in all lowercase.
+func (n *lowercaseSingularNamer) Name(t *types.Type) string {
+	return strings.ToLower(t.Name.Name)
+}
+
+// DefaultNameSystem returns the default name system for ordering the types to be
+// processed by the generators in this package.
+func DefaultNameSystem() string {
+	return "public"
+}
+
+// objectMetaForPackage returns the type of ObjectMeta used by package p.
+func objectMetaForPackage(p *types.Package) (*types.Type, bool, error) {
+	generatingForPackage := false
+	for _, t := range p.Types {
+		if !util.MustParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...)).GenerateClient {
+			continue
+		}
+		generatingForPackage = true
+		for _, member := range t.Members {
+			if member.Name == "ObjectMeta" {
+				return member.Type, isInternal(member), nil
+			}
+		}
+	}
+	if generatingForPackage {
+		return nil, false, fmt.Errorf("unable to find ObjectMeta for any types in package %s", p.Path)
+	}
+	return nil, false, nil
+}
+
+// isInternal returns true if the tags for a member do not contain a json tag
+func isInternal(m types.Member) bool {
+	return !strings.Contains(m.Tags, "json")
+}
+
+const subdirForInternalInterfaces = "internalinterfaces"
+
+// GetTargets makes the client target definition.
+func GetTargets(context *generator.Context, args *args.Args) []generator.Target {
+	boilerplate, err := gengo.GoBoilerplate(args.GoHeaderFile, "", gengo.StdGeneratedBy)
+	if err != nil {
+		klog.Fatalf("Failed loading boilerplate: %v", err)
+	}
+
+	internalVersionOutputDir := args.OutputDir
+	internalVersionOutputPkg := args.OutputPkg
+	externalVersionOutputDir := args.OutputDir
+	externalVersionOutputPkg := args.OutputPkg
+	if !args.SingleDirectory {
+		internalVersionOutputDir = filepath.Join(internalVersionOutputDir, "internalversion")
+		internalVersionOutputPkg = path.Join(internalVersionOutputPkg, "internalversion")
+		externalVersionOutputDir = filepath.Join(externalVersionOutputDir, "externalversions")
+		externalVersionOutputPkg = path.Join(externalVersionOutputPkg, "externalversions")
+	}
+
+	var idOpts []apidefinitions.Option
+	if len(args.LintRules) > 0 {
+		idOpts = append(idOpts, apidefinitions.WithLintRules(args.LintRules...))
+	}
+
+	var targetList []generator.Target
+	typesForGroupVersion := make(map[clientgentypes.GroupVersion][]*types.Type)
+
+	externalGroupVersions := make(map[string]clientgentypes.GroupVersions)
+	internalGroupVersions := make(map[string]clientgentypes.GroupVersions)
+	groupGoNames := make(map[string]string)
+	for _, inputPkg := range context.Inputs {
+		p := context.Universe.Package(inputPkg)
+
+		info, err := apidefinitions.Identify(p, apidefinitions.Informer, idOpts...)
+		if err != nil {
+			klog.Fatal(err)
+		}
+		if !info.ShouldGenerate() {
+			continue
+		}
+
+		objectMeta, internal, err := objectMetaForPackage(p)
+		if err != nil {
+			klog.Fatal(err)
+		}
+		if objectMeta == nil {
+			// no types in this package had genclient
+			continue
+		}
+
+		var gv clientgentypes.GroupVersion
+		var targetGroupVersions map[string]clientgentypes.GroupVersions
+
+		if internal {
+			lastSlash := strings.LastIndex(p.Path, "/")
+			if lastSlash == -1 {
+				klog.Fatalf("error constructing internal group version for package %q", p.Path)
+			}
+			gv.Group = clientgentypes.Group(p.Path[lastSlash+1:])
+			targetGroupVersions = internalGroupVersions
+		} else {
+			parts := strings.Split(p.Path, "/")
+			gv.Group = clientgentypes.Group(parts[len(parts)-2])
+			gv.Version = clientgentypes.Version(parts[len(parts)-1])
+			targetGroupVersions = externalGroupVersions
+		}
+		groupPackageName := gv.Group.NonEmpty()
+		gvPackage := path.Clean(p.Path)
+
+		// If there's a comment of the form "// +groupName=somegroup" or
+		// "// +groupName=somegroup.foo.bar.io", use the first field (somegroup) as the name of the
+		// group when generating.
+		override, ok, err := apidefinitions.GroupNameForPackage(p.Comments)
+		if err != nil {
+			klog.Fatalf("error resolving group name: %v", err)
+		}
+		if ok {
+			gv.Group = clientgentypes.Group(override)
+		}
+
+		// If there's a comment of the form "// +groupGoName=SomeUniqueShortName", use that as
+		// the Go group identifier in CamelCase. It defaults
+		groupGoNames[groupPackageName] = namer.IC(strings.Split(gv.Group.NonEmpty(), ".")[0])
+		goName, err := genutil.ExtractCommentTagsWithoutArguments("+", []string{"groupGoName"}, p.Comments)
+		if err != nil {
+			klog.Fatalf("error extracting groupGoName tags: %v", err)
+		}
+		if goName["groupGoName"] != nil {
+			groupGoNames[groupPackageName] = namer.IC(goName["groupGoName"][0])
+		}
+
+		var typesToGenerate []*types.Type
+		for _, t := range p.Types {
+			tags := util.MustParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...))
+			if !tags.GenerateClient || tags.NoVerbs || !tags.HasVerb("list") || !tags.HasVerb("watch") {
+				continue
+			}
+
+			typesToGenerate = append(typesToGenerate, t)
+
+			if _, ok := typesForGroupVersion[gv]; !ok {
+				typesForGroupVersion[gv] = []*types.Type{}
+			}
+			typesForGroupVersion[gv] = append(typesForGroupVersion[gv], t)
+		}
+		if len(typesToGenerate) == 0 {
+			continue
+		}
+
+		groupVersionsEntry, ok := targetGroupVersions[groupPackageName]
+		if !ok {
+			groupVersionsEntry = clientgentypes.GroupVersions{
+				PackageName: groupPackageName,
+				Group:       gv.Group,
+			}
+		}
+		groupVersionsEntry.Versions = append(groupVersionsEntry.Versions, clientgentypes.PackageVersion{Version: gv.Version, Package: gvPackage})
+		targetGroupVersions[groupPackageName] = groupVersionsEntry
+
+		orderer := namer.Orderer{Namer: namer.NewPrivateNamer(0)}
+		typesToGenerate = orderer.OrderTypes(typesToGenerate)
+
+		if internal {
+			targetList = append(targetList,
+				versionTarget(
+					internalVersionOutputDir, internalVersionOutputPkg,
+					groupPackageName, gv, groupGoNames[groupPackageName],
+					boilerplate, typesToGenerate,
+					args.InternalClientSetPackage, args.ListersPackage))
+		} else {
+			targetList = append(targetList,
+				versionTarget(
+					externalVersionOutputDir, externalVersionOutputPkg,
+					groupPackageName, gv, groupGoNames[groupPackageName],
+					boilerplate, typesToGenerate,
+					args.VersionedClientSetPackage, args.ListersPackage))
+		}
+	}
+
+	if len(externalGroupVersions) != 0 {
+		targetList = append(targetList,
+			factoryInterfaceTarget(
+				externalVersionOutputDir, externalVersionOutputPkg,
+				boilerplate, args.VersionedClientSetPackage))
+		targetList = append(targetList,
+			factoryTarget(
+				externalVersionOutputDir, externalVersionOutputPkg,
+				boilerplate, groupGoNames, genutil.PluralExceptionListToMapOrDie(args.PluralExceptions),
+				externalGroupVersions, args.VersionedClientSetPackage, typesForGroupVersion))
+		for _, gvs := range externalGroupVersions {
+			targetList = append(targetList,
+				groupTarget(externalVersionOutputDir, externalVersionOutputPkg, gvs, boilerplate))
+		}
+	}
+
+	if len(internalGroupVersions) != 0 {
+		targetList = append(targetList,
+			factoryInterfaceTarget(internalVersionOutputDir, internalVersionOutputPkg, boilerplate, args.InternalClientSetPackage))
+		targetList = append(targetList,
+			factoryTarget(
+				internalVersionOutputDir, internalVersionOutputPkg,
+				boilerplate, groupGoNames, genutil.PluralExceptionListToMapOrDie(args.PluralExceptions),
+				internalGroupVersions, args.InternalClientSetPackage, typesForGroupVersion))
+		for _, gvs := range internalGroupVersions {
+			targetList = append(targetList,
+				groupTarget(internalVersionOutputDir, internalVersionOutputPkg, gvs, boilerplate))
+		}
+	}
+
+	return targetList
+}
+
+func factoryTarget(outputDirBase, outputPkgBase string, boilerplate []byte, groupGoNames, pluralExceptions map[string]string, groupVersions map[string]clientgentypes.GroupVersions, clientSetPackage string,
+	typesForGroupVersion map[clientgentypes.GroupVersion][]*types.Type) generator.Target {
+	return &generator.SimpleTarget{
+		PkgName:       path.Base(outputDirBase),
+		PkgPath:       outputPkgBase,
+		PkgDir:        outputDirBase,
+		HeaderComment: boilerplate,
+		GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+			generators = append(generators, &factoryGenerator{
+				GoGenerator: generator.GoGenerator{
+					OutputFilename: "factory.go",
+				},
+				outputPackage:             outputPkgBase,
+				imports:                   generator.NewImportTrackerForPackage(outputPkgBase),
+				groupVersions:             groupVersions,
+				clientSetPackage:          clientSetPackage,
+				internalInterfacesPackage: path.Join(outputPkgBase, subdirForInternalInterfaces),
+				gvGoNames:                 groupGoNames,
+			})
+
+			generators = append(generators, &genericGenerator{
+				GoGenerator: generator.GoGenerator{
+					OutputFilename: "generic.go",
+				},
+				outputPackage:        outputPkgBase,
+				imports:              generator.NewImportTrackerForPackage(outputPkgBase),
+				groupVersions:        groupVersions,
+				pluralExceptions:     pluralExceptions,
+				typesForGroupVersion: typesForGroupVersion,
+				groupGoNames:         groupGoNames,
+			})
+
+			return generators
+		},
+	}
+}
+
+func factoryInterfaceTarget(outputDirBase, outputPkgBase string, boilerplate []byte, clientSetPackage string) generator.Target {
+	outputDir := filepath.Join(outputDirBase, subdirForInternalInterfaces)
+	outputPkg := path.Join(outputPkgBase, subdirForInternalInterfaces)
+
+	return &generator.SimpleTarget{
+		PkgName:       path.Base(outputDir),
+		PkgPath:       outputPkg,
+		PkgDir:        outputDir,
+		HeaderComment: boilerplate,
+		GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+			generators = append(generators, &factoryInterfaceGenerator{
+				GoGenerator: generator.GoGenerator{
+					OutputFilename: "factory_interfaces.go",
+				},
+				outputPackage:    outputPkg,
+				imports:          generator.NewImportTrackerForPackage(outputPkg),
+				clientSetPackage: clientSetPackage,
+			})
+
+			return generators
+		},
+	}
+}
+
+func groupTarget(outputDirBase, outputPackageBase string, groupVersions clientgentypes.GroupVersions, boilerplate []byte) generator.Target {
+	outputDir := filepath.Join(outputDirBase, groupVersions.PackageName)
+	outputPkg := path.Join(outputPackageBase, groupVersions.PackageName)
+	groupPkgName := strings.Split(string(groupVersions.PackageName), ".")[0]
+
+	return &generator.SimpleTarget{
+		PkgName:       groupPkgName,
+		PkgPath:       outputPkg,
+		PkgDir:        outputDir,
+		HeaderComment: boilerplate,
+		GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+			generators = append(generators, &groupInterfaceGenerator{
+				GoGenerator: generator.GoGenerator{
+					OutputFilename: "interface.go",
+				},
+				outputPackage:             outputPkg,
+				groupVersions:             groupVersions,
+				imports:                   generator.NewImportTrackerForPackage(outputPkg),
+				internalInterfacesPackage: path.Join(outputPackageBase, subdirForInternalInterfaces),
+			})
+			return generators
+		},
+		FilterFunc: func(c *generator.Context, t *types.Type) bool {
+			tags := util.MustParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...))
+			return tags.GenerateClient && tags.HasVerb("list") && tags.HasVerb("watch")
+		},
+	}
+}
+
+func versionTarget(outputDirBase, outputPkgBase string, groupPkgName string, gv clientgentypes.GroupVersion, groupGoName string, boilerplate []byte, typesToGenerate []*types.Type, clientSetPackage, listersPackage string) generator.Target {
+	subdir := []string{groupPkgName, strings.ToLower(gv.Version.NonEmpty())}
+	outputDir := filepath.Join(outputDirBase, filepath.Join(subdir...))
+	outputPkg := path.Join(outputPkgBase, path.Join(subdir...))
+
+	return &generator.SimpleTarget{
+		PkgName:       strings.ToLower(gv.Version.NonEmpty()),
+		PkgPath:       outputPkg,
+		PkgDir:        outputDir,
+		HeaderComment: boilerplate,
+		GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+			generators = append(generators, &versionInterfaceGenerator{
+				GoGenerator: generator.GoGenerator{
+					OutputFilename: "interface.go",
+				},
+				outputPackage:             outputPkg,
+				imports:                   generator.NewImportTrackerForPackage(outputPkg),
+				types:                     typesToGenerate,
+				internalInterfacesPackage: path.Join(outputPkgBase, subdirForInternalInterfaces),
+			})
+
+			for _, t := range typesToGenerate {
+				generators = append(generators, &informerGenerator{
+					GoGenerator: generator.GoGenerator{
+						OutputFilename: strings.ToLower(t.Name.Name) + ".go",
+					},
+					outputPackage:             outputPkg,
+					groupPkgName:              groupPkgName,
+					groupVersion:              gv,
+					groupGoName:               groupGoName,
+					typeToGenerate:            t,
+					imports:                   generator.NewImportTrackerForPackage(outputPkg),
+					clientSetPackage:          clientSetPackage,
+					listersPackage:            listersPackage,
+					internalInterfacesPackage: path.Join(outputPkgBase, subdirForInternalInterfaces),
+				})
+			}
+			return generators
+		},
+		FilterFunc: func(c *generator.Context, t *types.Type) bool {
+			tags := util.MustParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...))
+			return tags.GenerateClient && tags.HasVerb("list") && tags.HasVerb("watch")
+		},
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/types.go
new file mode 100644
index 0000000000..b0e7302fad
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/types.go
@@ -0,0 +1,64 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import "k8s.io/gengo/v2/types"
+
+var (
+	apiScheme                                    = types.Name{Package: "k8s.io/kubernetes/pkg/api/legacyscheme", Name: "Scheme"}
+	cacheDeletedObject                           = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "DeletedObject"}
+	cacheDoneChecker                             = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "DoneChecker"}
+	cacheGenericLister                           = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "GenericLister"}
+	cacheIndexers                                = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "Indexers"}
+	cacheInformerName                            = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "InformerName"}
+	cacheListWatch                               = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "ListWatch"}
+	cacheMetaNamespaceIndexFunc                  = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "MetaNamespaceIndexFunc"}
+	cacheNamespaceIndex                          = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "NamespaceIndex"}
+	cacheNewGenericLister                        = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "NewGenericLister"}
+	cacheNewSharedIndexInformer                  = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "NewSharedIndexInformer"}
+	cacheNewSharedIndexInformerWithOptions       = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "NewSharedIndexInformerWithOptions"}
+	cacheNewTypedSharedIndexInformer             = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "NewTypedSharedIndexInformer"}
+	cacheSharedIndexInformer                     = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "SharedIndexInformer"}
+	cacheTypedFilteringResourceEventHandler      = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "TypedFilteringResourceEventHandler"}
+	cacheTypedResourceEventHandlerDetailedFuncs  = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "TypedResourceEventHandlerDetailedFuncs"}
+	cacheTypedResourceEventHandlerFuncs          = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "TypedResourceEventHandlerFuncs"}
+	cacheTypedIndexers                           = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "TypedIndexers"}
+	cacheTypedIndexersToIndexers                 = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "TypedIndexersToIndexers"}
+	cacheTypedSharedIndexInformer                = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "TypedSharedIndexInformer"}
+	cacheSharedIndexInformerOptions              = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "SharedIndexInformerOptions"}
+	cacheSyncResult                              = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "SyncResult"}
+	cacheTransformFunc                           = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "TransformFunc"}
+	cacheToListWatcherWithWatchListSemanticsFunc = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "ToListWatcherWithWatchListSemantics"}
+	cacheWaitForFunc                             = types.Name{Package: "k8s.io/client-go/tools/cache", Name: "WaitFor"}
+	contextBackgroundFunc                        = types.Name{Package: "context", Name: "Background"}
+	contextCauseFunc                             = types.Name{Package: "context", Name: "Cause"}
+	contextContext                               = types.Name{Package: "context", Name: "Context"}
+	fmtErrorfFunc                                = types.Name{Package: "fmt", Name: "Errorf"}
+	listOptions                                  = types.Name{Package: "k8s.io/kubernetes/pkg/apis/core", Name: "ListOptions"}
+	reflectType                                  = types.Name{Package: "reflect", Name: "Type"}
+	runtimeObject                                = types.Name{Package: "k8s.io/apimachinery/pkg/runtime", Name: "Object"}
+	schemaGroupResource                          = types.Name{Package: "k8s.io/apimachinery/pkg/runtime/schema", Name: "GroupResource"}
+	schemaGroupVersionResource                   = types.Name{Package: "k8s.io/apimachinery/pkg/runtime/schema", Name: "GroupVersionResource"}
+	stringsBuilder                               = types.Name{Package: "strings", Name: "Builder"}
+	syncMutex                                    = types.Name{Package: "sync", Name: "Mutex"}
+	timeDuration                                 = types.Name{Package: "time", Name: "Duration"}
+	v1ListOptions                                = types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "ListOptions"}
+	metav1NamespaceAll                           = types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "NamespaceAll"}
+	metav1Object                                 = types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "Object"}
+	waitContextForChannelFunc                    = types.Name{Package: "k8s.io/apimachinery/pkg/util/wait", Name: "ContextForChannel"}
+	watchInterface                               = types.Name{Package: "k8s.io/apimachinery/pkg/watch", Name: "Interface"}
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/versioninterface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/versioninterface.go
new file mode 100644
index 0000000000..d130ba5b3a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/generators/versioninterface.go
@@ -0,0 +1,109 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"io"
+
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+
+	"k8s.io/code-generator/cmd/client-gen/generators/util"
+)
+
+// versionInterfaceGenerator generates the per-version interface file.
+type versionInterfaceGenerator struct {
+	generator.GoGenerator
+	outputPackage             string
+	imports                   namer.ImportTracker
+	types                     []*types.Type
+	filtered                  bool
+	internalInterfacesPackage string
+}
+
+var _ generator.Generator = &versionInterfaceGenerator{}
+
+func (g *versionInterfaceGenerator) Filter(c *generator.Context, t *types.Type) bool {
+	if !g.filtered {
+		g.filtered = true
+		return true
+	}
+	return false
+}
+
+func (g *versionInterfaceGenerator) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.outputPackage, g.imports),
+	}
+}
+
+func (g *versionInterfaceGenerator) Imports(c *generator.Context) (imports []string) {
+	imports = append(imports, g.imports.ImportLines()...)
+	return
+}
+
+func (g *versionInterfaceGenerator) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+
+	m := map[string]interface{}{
+		"interfacesTweakListOptionsFunc":  c.Universe.Type(types.Name{Package: g.internalInterfacesPackage, Name: "TweakListOptionsFunc"}),
+		"interfacesSharedInformerFactory": c.Universe.Type(types.Name{Package: g.internalInterfacesPackage, Name: "SharedInformerFactory"}),
+		"types":                           g.types,
+	}
+
+	sw.Do(versionTemplate, m)
+	for _, typeDef := range g.types {
+		tags, err := util.ParseClientGenTags(append(typeDef.SecondClosestCommentLines, typeDef.CommentLines...))
+		if err != nil {
+			return err
+		}
+		m["namespaced"] = !tags.NonNamespaced
+		m["type"] = typeDef
+		sw.Do(versionFuncTemplate, m)
+	}
+
+	return sw.Error()
+}
+
+var versionTemplate = `
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	$range .types -$
+		// $.|publicPlural$ returns a $.|public$Informer.
+		$.|publicPlural$() Typed$.|public$Informer
+	$end$
+}
+
+type version struct {
+	factory $.interfacesSharedInformerFactory|raw$
+	namespace string
+	tweakListOptions $.interfacesTweakListOptionsFunc|raw$
+}
+
+// New returns a new Interface.
+func New(f $.interfacesSharedInformerFactory|raw$, namespace string, tweakListOptions $.interfacesTweakListOptionsFunc|raw$) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+`
+
+var versionFuncTemplate = `
+// $.type|publicPlural$ returns a Typed$.type|public$Informer.
+func (v *version) $.type|publicPlural$() Typed$.type|public$Informer {
+	return &$.type|private$Informer{factory: v.factory$if .namespaced$, namespace: v.namespace$end$, tweakListOptions: v.tweakListOptions}
+}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/main.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/main.go
new file mode 100644
index 0000000000..b0fc48517b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/informer-gen/main.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"flag"
+
+	"github.com/spf13/pflag"
+	"k8s.io/code-generator/cmd/informer-gen/args"
+	"k8s.io/code-generator/cmd/informer-gen/generators"
+	"k8s.io/code-generator/pkg/util"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/klog/v2"
+)
+
+func main() {
+	klog.InitFlags(nil)
+	args := args.New()
+
+	args.AddFlags(pflag.CommandLine)
+	flag.Set("logtostderr", "true")
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+	pflag.Parse()
+
+	if err := args.Validate(); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+
+	myTargets := func(context *generator.Context) []generator.Target {
+		return generators.GetTargets(context, args)
+	}
+
+	// Run it.
+	if err := gengo.Execute(
+		generators.NameSystems(util.PluralExceptionListToMapOrDie(args.PluralExceptions)),
+		generators.DefaultNameSystem(),
+		myTargets,
+		gengo.StdBuildTag,
+		pflag.Args(),
+	); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+	klog.V(2).Info("Completed successfully.")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/lister-gen/args/args.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/lister-gen/args/args.go
new file mode 100644
index 0000000000..899ea6c664
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/lister-gen/args/args.go
@@ -0,0 +1,70 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package args
+
+import (
+	"fmt"
+
+	"github.com/spf13/pflag"
+
+	"k8s.io/code-generator/pkg/apidefinitions"
+)
+
+// Args is used by the gengo framework to pass args specific to this generator.
+type Args struct {
+	OutputDir    string // must be a directory path
+	OutputPkg    string // must be a Go import-path
+	GoHeaderFile string
+
+	// PluralExceptions specify list of exceptions used when pluralizing certain types.
+	// For example 'Endpoints:Endpoints', otherwise the pluralizer will generate 'Endpointes'.
+	PluralExceptions []string
+
+	apidefinitions.LintArgs
+}
+
+// New returns default arguments for the generator.
+func New() *Args {
+	return &Args{}
+}
+
+// AddFlags add the generator flags to the flag set.
+func (args *Args) AddFlags(fs *pflag.FlagSet) {
+	fs.StringVar(&args.OutputDir, "output-dir", "",
+		"the base directory under which to generate results")
+	fs.StringVar(&args.OutputPkg, "output-pkg", "",
+		"the base Go import-path under which to generate results")
+	fs.StringSliceVar(&args.PluralExceptions, "plural-exceptions", args.PluralExceptions,
+		"list of comma separated plural exception definitions in Type:PluralizedType format")
+	fs.StringVar(&args.GoHeaderFile, "go-header-file", "",
+		"the path to a file containing boilerplate header text; the string \"YEAR\" will be replaced with the current 4-digit year")
+	apidefinitions.AddFlags(&args.LintArgs, fs)
+}
+
+// Validate checks the given arguments.
+func (args *Args) Validate() error {
+	if len(args.OutputDir) == 0 {
+		return fmt.Errorf("--output-dir must be specified")
+	}
+	if len(args.OutputPkg) == 0 {
+		return fmt.Errorf("--output-pkg must be specified")
+	}
+	if err := apidefinitions.ValidateFlags(args.LintRules); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/lister-gen/generators/expansion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/lister-gen/generators/expansion.go
new file mode 100644
index 0000000000..4755f2ed1e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/lister-gen/generators/expansion.go
@@ -0,0 +1,73 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/klog/v2"
+
+	"k8s.io/code-generator/cmd/client-gen/generators/util"
+)
+
+// expansionGenerator produces a file for a expansion interfaces.
+type expansionGenerator struct {
+	generator.GoGenerator
+	outputPath string
+	types      []*types.Type
+}
+
+// We only want to call GenerateType() once per group.
+func (g *expansionGenerator) Filter(c *generator.Context, t *types.Type) bool {
+	return t == g.types[0]
+}
+
+func (g *expansionGenerator) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+	for _, t := range g.types {
+		tags := util.MustParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...))
+		manualFile := filepath.Join(g.outputPath, strings.ToLower(t.Name.Name+"_expansion.go"))
+		if _, err := os.Stat(manualFile); err == nil {
+			klog.V(4).Infof("file %q exists, not generating", manualFile)
+		} else if os.IsNotExist(err) {
+			sw.Do(expansionInterfaceTemplate, t)
+			if !tags.NonNamespaced {
+				sw.Do(namespacedExpansionInterfaceTemplate, t)
+			}
+		} else {
+			return err
+		}
+	}
+	return sw.Error()
+}
+
+var expansionInterfaceTemplate = `
+// $.|public$ListerExpansion allows custom methods to be added to
+// $.|public$Lister.
+type $.|public$ListerExpansion interface {}
+`
+
+var namespacedExpansionInterfaceTemplate = `
+// $.|public$NamespaceListerExpansion allows custom methods to be added to
+// $.|public$NamespaceLister.
+type $.|public$NamespaceListerExpansion interface {}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/lister-gen/generators/lister.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/lister-gen/generators/lister.go
new file mode 100644
index 0000000000..8f9623bcb2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/lister-gen/generators/lister.go
@@ -0,0 +1,351 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"fmt"
+	"io"
+	"path"
+	"path/filepath"
+	"strings"
+
+	"k8s.io/code-generator/cmd/client-gen/generators/util"
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+	"k8s.io/code-generator/cmd/lister-gen/args"
+	"k8s.io/code-generator/pkg/apidefinitions"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/klog/v2"
+)
+
+// NameSystems returns the name system used by the generators in this package.
+func NameSystems(pluralExceptions map[string]string) namer.NameSystems {
+	return namer.NameSystems{
+		"public":             namer.NewPublicNamer(0),
+		"private":            namer.NewPrivateNamer(0),
+		"raw":                namer.NewRawNamer("", nil),
+		"publicPlural":       namer.NewPublicPluralNamer(pluralExceptions),
+		"allLowercasePlural": namer.NewAllLowercasePluralNamer(pluralExceptions),
+		"lowercaseSingular":  &lowercaseSingularNamer{},
+	}
+}
+
+// lowercaseSingularNamer implements Namer
+type lowercaseSingularNamer struct{}
+
+// Name returns t's name in all lowercase.
+func (n *lowercaseSingularNamer) Name(t *types.Type) string {
+	return strings.ToLower(t.Name.Name)
+}
+
+// DefaultNameSystem returns the default name system for ordering the types to be
+// processed by the generators in this package.
+func DefaultNameSystem() string {
+	return "public"
+}
+
+// GetTargets makes the client target definition.
+func GetTargets(context *generator.Context, args *args.Args) []generator.Target {
+	boilerplate, err := gengo.GoBoilerplate(args.GoHeaderFile, "", gengo.StdGeneratedBy)
+	if err != nil {
+		klog.Fatalf("Failed loading boilerplate: %v", err)
+	}
+
+	var idOpts []apidefinitions.Option
+	if len(args.LintRules) > 0 {
+		idOpts = append(idOpts, apidefinitions.WithLintRules(args.LintRules...))
+	}
+
+	var targetList []generator.Target
+	for _, inputPkg := range context.Inputs {
+		p := context.Universe.Package(inputPkg)
+
+		info, err := apidefinitions.Identify(p, apidefinitions.Lister, idOpts...)
+		if err != nil {
+			klog.Fatal(err)
+		}
+		if !info.ShouldGenerate() {
+			continue
+		}
+
+		objectMeta, internal, err := objectMetaForPackage(p)
+		if err != nil {
+			klog.Fatal(err)
+		}
+		if objectMeta == nil {
+			// no types in this package had genclient
+			continue
+		}
+
+		var gv clientgentypes.GroupVersion
+		var internalGVPkg string
+
+		if internal {
+			lastSlash := strings.LastIndex(p.Path, "/")
+			if lastSlash == -1 {
+				klog.Fatalf("error constructing internal group version for package %q", p.Path)
+			}
+			gv.Group = clientgentypes.Group(p.Path[lastSlash+1:])
+			internalGVPkg = p.Path
+		} else {
+			parts := strings.Split(p.Path, "/")
+			gv.Group = clientgentypes.Group(parts[len(parts)-2])
+			gv.Version = clientgentypes.Version(parts[len(parts)-1])
+
+			internalGVPkg = strings.Join(parts[0:len(parts)-1], "/")
+		}
+		groupPackageName := strings.ToLower(gv.Group.NonEmpty())
+
+		// If there's a comment of the form "// +groupName=somegroup" or
+		// "// +groupName=somegroup.foo.bar.io", use the first field (somegroup) as the name of the
+		// group when generating.
+		override, ok, err := apidefinitions.GroupNameForPackage(p.Comments)
+		if err != nil {
+			klog.Fatalf("error resolving group name: %v", err)
+		}
+		if ok {
+			gv.Group = clientgentypes.Group(strings.SplitN(override, ".", 2)[0])
+		}
+
+		var typesToGenerate []*types.Type
+		for _, t := range p.Types {
+			tags := util.MustParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...))
+			if !tags.GenerateClient || !tags.HasVerb("list") || !tags.HasVerb("get") {
+				continue
+			}
+			typesToGenerate = append(typesToGenerate, t)
+		}
+		if len(typesToGenerate) == 0 {
+			continue
+		}
+		orderer := namer.Orderer{Namer: namer.NewPrivateNamer(0)}
+		typesToGenerate = orderer.OrderTypes(typesToGenerate)
+
+		subdir := []string{groupPackageName, strings.ToLower(gv.Version.NonEmpty())}
+		outputDir := filepath.Join(args.OutputDir, filepath.Join(subdir...))
+		outputPkg := path.Join(args.OutputPkg, path.Join(subdir...))
+		targetList = append(targetList, &generator.SimpleTarget{
+			PkgName:       strings.ToLower(gv.Version.NonEmpty()),
+			PkgPath:       outputPkg,
+			PkgDir:        outputDir,
+			HeaderComment: boilerplate,
+			FilterFunc: func(c *generator.Context, t *types.Type) bool {
+				tags := util.MustParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...))
+				return tags.GenerateClient && tags.HasVerb("list") && tags.HasVerb("get")
+			},
+			GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+				generators = append(generators, &expansionGenerator{
+					GoGenerator: generator.GoGenerator{
+						OutputFilename: "expansion_generated.go",
+					},
+					outputPath: outputDir,
+					types:      typesToGenerate,
+				})
+
+				for _, t := range typesToGenerate {
+					generators = append(generators, &listerGenerator{
+						GoGenerator: generator.GoGenerator{
+							OutputFilename: strings.ToLower(t.Name.Name) + ".go",
+						},
+						outputPackage:  outputPkg,
+						groupVersion:   gv,
+						internalGVPkg:  internalGVPkg,
+						typeToGenerate: t,
+						imports:        generator.NewImportTrackerForPackage(outputPkg),
+						objectMeta:     objectMeta,
+					})
+				}
+				return generators
+			},
+		})
+	}
+
+	return targetList
+}
+
+// objectMetaForPackage returns the type of ObjectMeta used by package p.
+func objectMetaForPackage(p *types.Package) (*types.Type, bool, error) {
+	generatingForPackage := false
+	for _, t := range p.Types {
+		// filter out types which don't have genclient.
+		if !util.MustParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...)).GenerateClient {
+			continue
+		}
+		generatingForPackage = true
+		for _, member := range t.Members {
+			if member.Name == "ObjectMeta" {
+				return member.Type, isInternal(member), nil
+			}
+		}
+	}
+	if generatingForPackage {
+		return nil, false, fmt.Errorf("unable to find ObjectMeta for any types in package %s", p.Path)
+	}
+	return nil, false, nil
+}
+
+// isInternal returns true if the tags for a member do not contain a json tag
+func isInternal(m types.Member) bool {
+	return !strings.Contains(m.Tags, "json")
+}
+
+// listerGenerator produces a file of listers for a given GroupVersion and
+// type.
+type listerGenerator struct {
+	generator.GoGenerator
+	outputPackage  string
+	groupVersion   clientgentypes.GroupVersion
+	internalGVPkg  string
+	typeToGenerate *types.Type
+	imports        namer.ImportTracker
+	objectMeta     *types.Type
+}
+
+var _ generator.Generator = &listerGenerator{}
+
+func (g *listerGenerator) Filter(c *generator.Context, t *types.Type) bool {
+	return t == g.typeToGenerate
+}
+
+func (g *listerGenerator) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.outputPackage, g.imports),
+	}
+}
+
+func (g *listerGenerator) Imports(c *generator.Context) (imports []string) {
+	imports = append(imports, g.imports.ImportLines()...)
+	return
+}
+
+func (g *listerGenerator) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+
+	klog.V(5).Infof("processing type %v", t)
+	m := map[string]interface{}{
+		"Resource":               c.Universe.Function(types.Name{Package: t.Name.Package, Name: "Resource"}),
+		"labelsSelector":         c.Universe.Function(types.Name{Package: "k8s.io/apimachinery/pkg/labels", Name: "Selector"}),
+		"listersResourceIndexer": c.Universe.Function(types.Name{Package: "k8s.io/client-go/listers", Name: "ResourceIndexer"}),
+		"listersNew":             c.Universe.Function(types.Name{Package: "k8s.io/client-go/listers", Name: "New"}),
+		"listersNewNamespaced":   c.Universe.Function(types.Name{Package: "k8s.io/client-go/listers", Name: "NewNamespaced"}),
+		"cacheIndexer":           c.Universe.Type(types.Name{Package: "k8s.io/client-go/tools/cache", Name: "Indexer"}),
+		"type":                   t,
+		"objectMeta":             g.objectMeta,
+	}
+
+	tags, err := util.ParseClientGenTags(append(t.SecondClosestCommentLines, t.CommentLines...))
+	if err != nil {
+		return err
+	}
+
+	if tags.NonNamespaced {
+		sw.Do(typeListerInterfaceNonNamespaced, m)
+	} else {
+		sw.Do(typeListerInterface, m)
+	}
+
+	sw.Do(typeListerStruct, m)
+	sw.Do(typeListerConstructor, m)
+
+	if tags.NonNamespaced {
+		return sw.Error()
+	}
+
+	sw.Do(typeListerNamespaceLister, m)
+	sw.Do(namespaceListerInterface, m)
+	sw.Do(namespaceListerStruct, m)
+
+	return sw.Error()
+}
+
+var typeListerInterface = `
+// $.type|public$Lister helps list $.type|publicPlural$.
+// All objects returned here must be treated as read-only.
+type $.type|public$Lister interface {
+	// List lists all $.type|publicPlural$ in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector $.labelsSelector|raw$) (ret []*$.type|raw$, err error)
+	// $.type|publicPlural$ returns an object that can list and get $.type|publicPlural$.
+	$.type|publicPlural$(namespace string) $.type|public$NamespaceLister
+	$.type|public$ListerExpansion
+}
+`
+
+var typeListerInterfaceNonNamespaced = `
+// $.type|public$Lister helps list $.type|publicPlural$.
+// All objects returned here must be treated as read-only.
+type $.type|public$Lister interface {
+	// List lists all $.type|publicPlural$ in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector $.labelsSelector|raw$) (ret []*$.type|raw$, err error)
+	// Get retrieves the $.type|public$ from the index for a given name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*$.type|raw$, error)
+	$.type|public$ListerExpansion
+}
+`
+
+// This embeds a typed resource indexer instead of aliasing, so that the struct
+// is available as a receiver for methods specific to the generated type
+// (from the corresponding expansion interface).
+var typeListerStruct = `
+// $.type|private$Lister implements the $.type|public$Lister interface.
+type $.type|private$Lister struct {
+	$.listersResourceIndexer|raw$[*$.type|raw$]
+}
+`
+
+var typeListerConstructor = `
+// New$.type|public$Lister returns a new $.type|public$Lister.
+func New$.type|public$Lister(indexer $.cacheIndexer|raw$) $.type|public$Lister {
+	return &$.type|private$Lister{$.listersNew|raw$[*$.type|raw$](indexer, $.Resource|raw$("$.type|lowercaseSingular$"))}
+}
+`
+
+var typeListerNamespaceLister = `
+// $.type|publicPlural$ returns an object that can list and get $.type|publicPlural$.
+func (s *$.type|private$Lister) $.type|publicPlural$(namespace string) $.type|public$NamespaceLister {
+	return $.type|private$NamespaceLister{$.listersNewNamespaced|raw$[*$.type|raw$](s.ResourceIndexer, namespace)}
+}
+`
+
+var namespaceListerInterface = `
+// $.type|public$NamespaceLister helps list and get $.type|publicPlural$.
+// All objects returned here must be treated as read-only.
+type $.type|public$NamespaceLister interface {
+	// List lists all $.type|publicPlural$ in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector $.labelsSelector|raw$) (ret []*$.type|raw$, err error)
+	// Get retrieves the $.type|public$ from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*$.type|raw$, error)
+	$.type|public$NamespaceListerExpansion
+}
+`
+
+// This embeds a typed namespaced resource indexer instead of aliasing, so that the struct
+// is available as a receiver for methods specific to the generated type
+// (from the corresponding expansion interface).
+var namespaceListerStruct = `
+// $.type|private$NamespaceLister implements the $.type|public$NamespaceLister
+// interface.
+type $.type|private$NamespaceLister struct {
+	$.listersResourceIndexer|raw$[*$.type|raw$]
+}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/lister-gen/main.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/lister-gen/main.go
new file mode 100644
index 0000000000..8dde18bab9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/lister-gen/main.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"flag"
+
+	"github.com/spf13/pflag"
+	"k8s.io/code-generator/cmd/lister-gen/args"
+	"k8s.io/code-generator/cmd/lister-gen/generators"
+	"k8s.io/code-generator/pkg/util"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/klog/v2"
+)
+
+func main() {
+	klog.InitFlags(nil)
+	args := args.New()
+
+	args.AddFlags(pflag.CommandLine)
+	flag.Set("logtostderr", "true")
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+	pflag.Parse()
+
+	if err := args.Validate(); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+
+	myTargets := func(context *generator.Context) []generator.Target {
+		return generators.GetTargets(context, args)
+	}
+
+	// Run it.
+	if err := gengo.Execute(
+		generators.NameSystems(util.PluralExceptionListToMapOrDie(args.PluralExceptions)),
+		generators.DefaultNameSystem(),
+		myTargets,
+		gengo.StdBuildTag,
+		pflag.Args(),
+	); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+	klog.V(2).Info("Completed successfully.")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/args/args.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/args/args.go
new file mode 100644
index 0000000000..b4448303cc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/args/args.go
@@ -0,0 +1,57 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package args
+
+import (
+	"fmt"
+
+	"github.com/spf13/pflag"
+
+	"k8s.io/code-generator/pkg/apidefinitions"
+)
+
+type Args struct {
+	OutputFile   string
+	GoHeaderFile string
+
+	apidefinitions.LintArgs
+}
+
+// New returns default arguments for the generator.
+func New() *Args {
+	return &Args{}
+}
+
+// AddFlags add the generator flags to the flag set.
+func (args *Args) AddFlags(fs *pflag.FlagSet) {
+	fs.StringVar(&args.OutputFile, "output-file", "generated.prerelease_lifecycle.go",
+		"the name of the file to be generated")
+	fs.StringVar(&args.GoHeaderFile, "go-header-file", "",
+		"the path to a file containing boilerplate header text; the string \"YEAR\" will be replaced with the current 4-digit year")
+	apidefinitions.AddFlags(&args.LintArgs, fs)
+}
+
+// Validate checks the given arguments.
+func (args *Args) Validate() error {
+	if len(args.OutputFile) == 0 {
+		return fmt.Errorf("--output-file must be specified")
+	}
+	if err := apidefinitions.ValidateFlags(args.LintRules); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/main.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/main.go
new file mode 100644
index 0000000000..717b6b0761
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/main.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// prerelease-lifecycle-gen is a tool for auto-generating api-status.csv files.
+//
+// Given a list of input directories, it will create a zz_api_status.go file for all beta APIs which indicates the kinds,
+// the release it was introduced, the release it will be deprecated, and the release it will be removed.
+//
+// Generation is governed by comment tags in the source.  Any package may
+// request Status generation by including a comment in the file-comments of
+// one file, of the form:
+//
+//	// +k8s:prerelease-lifecycle-gen=true
+//
+// // +k8s:prerelease-lifecycle-gen:introduced=1.19
+// // +k8s:prerelease-lifecycle-gen:deprecated=1.22
+// // +k8s:prerelease-lifecycle-gen:removed=1.25
+// // +k8s:prerelease-lifecycle-gen:replacement=wardle.example.com,v1,Flunder
+//
+// Note that registration is a whole-package option, and is not available for
+// individual types.
+package main
+
+import (
+	"flag"
+
+	"github.com/spf13/pflag"
+	"k8s.io/code-generator/cmd/prerelease-lifecycle-gen/args"
+	statusgenerators "k8s.io/code-generator/cmd/prerelease-lifecycle-gen/prerelease-lifecycle-generators"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/klog/v2"
+)
+
+func main() {
+	klog.InitFlags(nil)
+	args := args.New()
+
+	args.AddFlags(pflag.CommandLine)
+	flag.Set("logtostderr", "true")
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+	pflag.Parse()
+
+	if err := args.Validate(); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+
+	myTargets := func(context *generator.Context) []generator.Target {
+		return statusgenerators.GetTargets(context, args)
+	}
+
+	// Run it.
+	if err := gengo.Execute(
+		statusgenerators.NameSystems(),
+		statusgenerators.DefaultNameSystem(),
+		myTargets,
+		gengo.StdBuildTag,
+		pflag.Args(),
+	); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+	klog.V(2).Info("Completed successfully.")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/prerelease-lifecycle-generators/status.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/prerelease-lifecycle-generators/status.go
new file mode 100644
index 0000000000..13f834dbf2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/prerelease-lifecycle-generators/status.go
@@ -0,0 +1,486 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package prereleaselifecyclegenerators
+
+import (
+	"fmt"
+	"io"
+	"path"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"k8s.io/code-generator/cmd/prerelease-lifecycle-gen/args"
+	"k8s.io/code-generator/pkg/apidefinitions"
+	genutil "k8s.io/code-generator/pkg/util"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+
+	"k8s.io/klog/v2"
+)
+
+// This is the comment tag that carries parameters for API status generation.  Because the cadence is fixed, we can predict
+// with near certainty when this lifecycle happens as the API is introduced.
+const (
+	tagEnabledName    = "k8s:prerelease-lifecycle-gen"
+	introducedTagName = tagEnabledName + ":introduced"
+	deprecatedTagName = tagEnabledName + ":deprecated"
+	removedTagName    = tagEnabledName + ":removed"
+
+	replacementTagName = tagEnabledName + ":replacement"
+)
+
+// enabledTagValue holds parameters from a tagName tag.
+type tagValue struct {
+	value string
+}
+
+func extractEnabledTypeTag(t *types.Type) *tagValue {
+	comments := append(append([]string{}, t.SecondClosestCommentLines...), t.CommentLines...)
+	return extractTag(tagEnabledName, comments)
+}
+
+func tagExists(tagName string, t *types.Type) bool {
+	comments := append(append([]string{}, t.SecondClosestCommentLines...), t.CommentLines...)
+	rawTag := extractTag(tagName, comments)
+	return rawTag != nil
+}
+
+func extractKubeVersionTag(tagName string, t *types.Type) (*tagValue, int, int, error) {
+	comments := append(append([]string{}, t.SecondClosestCommentLines...), t.CommentLines...)
+	rawTag := extractTag(tagName, comments)
+	if rawTag == nil || len(rawTag.value) == 0 {
+		return nil, -1, -1, fmt.Errorf("%v missing %v=Version tag", t, tagName)
+	}
+
+	splitValue := strings.Split(rawTag.value, ".")
+	if len(splitValue) != 2 || len(splitValue[0]) == 0 || len(splitValue[1]) == 0 {
+		return nil, -1, -1, fmt.Errorf("%v format must match %v=xx.yy tag", t, tagName)
+	}
+	major, err := strconv.ParseInt(splitValue[0], 10, 32)
+	if err != nil {
+		return nil, -1, -1, fmt.Errorf("%v format must match %v=xx.yy : %w", t, tagName, err)
+	}
+	minor, err := strconv.ParseInt(splitValue[1], 10, 32)
+	if err != nil {
+		return nil, -1, -1, fmt.Errorf("%v format must match %v=xx.yy : %w", t, tagName, err)
+	}
+
+	return rawTag, int(major), int(minor), nil
+}
+
+func extractIntroducedTag(t *types.Type) (*tagValue, int, int, error) {
+	return extractKubeVersionTag(introducedTagName, t)
+}
+
+func extractDeprecatedTag(t *types.Type) (*tagValue, int, int, error) {
+	return extractKubeVersionTag(deprecatedTagName, t)
+}
+
+func extractRemovedTag(t *types.Type) (*tagValue, int, int, error) {
+	return extractKubeVersionTag(removedTagName, t)
+}
+
+func extractReplacementTag(t *types.Type) (group, version, kind string, hasReplacement bool, err error) {
+	comments := append(append([]string{}, t.SecondClosestCommentLines...), t.CommentLines...)
+
+	tags, err := genutil.ExtractCommentTagsWithoutArguments("+", []string{replacementTagName}, comments)
+	if err != nil {
+		return "", "", "", false, fmt.Errorf("failed to parse comments: %w", err)
+	}
+	tagVals := tags[replacementTagName]
+	if len(tagVals) == 0 {
+		// No match for the tag.
+		return "", "", "", false, nil
+	}
+	// If there are multiple values, abort.
+	if len(tagVals) > 1 {
+		return "", "", "", false, fmt.Errorf("found %d %s tags: %q", len(tagVals), replacementTagName, tagVals)
+	}
+	tagValue := tagVals[0]
+	parts := strings.Split(tagValue, ",")
+	if len(parts) != 3 {
+		return "", "", "", false, fmt.Errorf(`%s value must be "<group>,<version>,<kind>", got %q`, replacementTagName, tagValue)
+	}
+	group, version, kind = parts[0], parts[1], parts[2]
+	if len(version) == 0 || len(kind) == 0 {
+		return "", "", "", false, fmt.Errorf(`%s value must be "<group>,<version>,<kind>", got %q`, replacementTagName, tagValue)
+	}
+	// sanity check the group
+	if strings.ToLower(group) != group {
+		return "", "", "", false, fmt.Errorf(`replacement group must be all lower-case, got %q`, group)
+	}
+	// sanity check the version
+	if !strings.HasPrefix(version, "v") || strings.ToLower(version) != version {
+		return "", "", "", false, fmt.Errorf(`replacement version must start with "v" and be all lower-case, got %q`, version)
+	}
+	// sanity check the kind
+	if strings.ToUpper(kind[:1]) != kind[:1] {
+		return "", "", "", false, fmt.Errorf(`replacement kind must start with uppercase-letter, got %q`, kind)
+	}
+	return group, version, kind, true, nil
+}
+
+func extractTag(tagName string, comments []string) *tagValue {
+	tags, err := genutil.ExtractCommentTagsWithoutArguments("+", []string{tagName}, comments)
+	if err != nil {
+		klog.Fatalf("Error extracting %s tags: %v", tagName, err)
+	}
+	if tags[tagName] == nil {
+		// No match for the tag.
+		return nil
+	}
+	// If there are multiple values, abort.
+	if len(tags[tagName]) > 1 {
+		klog.Fatalf("Found %d %s tags: %q", len(tags[tagName]), tagName, tags[tagName])
+	}
+
+	// If we got here we are returning something.
+	tag := &tagValue{}
+
+	// Get the primary value.
+	parts := strings.Split(tags[tagName][0], ",")
+	if len(parts) >= 1 {
+		tag.value = parts[0]
+	}
+
+	// Parse extra arguments.
+	parts = parts[1:]
+	for i := range parts {
+		kv := strings.SplitN(parts[i], "=", 2)
+		k := kv[0]
+		if k != "" {
+			klog.Fatalf("Unsupported %s param: %q", tagName, parts[i])
+		}
+	}
+	return tag
+}
+
+// NameSystems returns the name system used by the generators in this package.
+func NameSystems() namer.NameSystems {
+	return namer.NameSystems{
+		"public": namer.NewPublicNamer(1),
+		"raw":    namer.NewRawNamer("", nil),
+	}
+}
+
+// DefaultNameSystem returns the default name system for ordering the types to be
+// processed by the generators in this package.
+func DefaultNameSystem() string {
+	return "public"
+}
+
+// GetTargets makes the target definition.
+func GetTargets(context *generator.Context, args *args.Args) []generator.Target {
+	boilerplate, err := gengo.GoBoilerplate(args.GoHeaderFile, gengo.StdBuildTag, gengo.StdGeneratedBy)
+	if err != nil {
+		klog.Fatalf("Failed loading boilerplate: %v", err)
+	}
+
+	var idOpts []apidefinitions.Option
+	if len(args.LintRules) > 0 {
+		idOpts = append(idOpts, apidefinitions.WithLintRules(args.LintRules...))
+	}
+
+	targetList := []generator.Target{}
+
+	for _, i := range context.Inputs {
+		klog.V(5).Infof("considering pkg %q", i)
+		pkg := context.Universe[i]
+
+		info, err := apidefinitions.Identify(pkg, apidefinitions.PrereleaseLifecycle, idOpts...)
+		if err != nil {
+			klog.Fatal(err)
+		}
+		if !info.ShouldGenerate() {
+			klog.V(5).Infof("  not enabled")
+			continue
+		}
+		klog.V(3).Infof("generating package %q", pkg.Path)
+
+		targetList = append(targetList,
+			&generator.SimpleTarget{
+				PkgName:       strings.Split(path.Base(pkg.Path), ".")[0],
+				PkgPath:       pkg.Path,
+				PkgDir:        pkg.Dir, // output pkg is the same as the input
+				HeaderComment: boilerplate,
+				FilterFunc: func(c *generator.Context, t *types.Type) bool {
+					return t.Name.Package == pkg.Path
+				},
+				GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+					return []generator.Generator{
+						NewPrereleaseLifecycleGen(args.OutputFile, pkg.Path),
+					}
+				},
+			})
+	}
+	return targetList
+}
+
+// genDeepCopy produces a file with autogenerated deep-copy functions.
+type genPreleaseLifecycle struct {
+	generator.GoGenerator
+	targetPackage string
+	imports       namer.ImportTracker
+	typesForInit  []*types.Type
+}
+
+// NewPrereleaseLifecycleGen creates a generator for the prerelease-lifecycle-generator
+func NewPrereleaseLifecycleGen(outputFilename, targetPackage string) generator.Generator {
+	return &genPreleaseLifecycle{
+		GoGenerator: generator.GoGenerator{
+			OutputFilename: outputFilename,
+		},
+		targetPackage: targetPackage,
+		imports:       generator.NewImportTracker(),
+		typesForInit:  make([]*types.Type, 0),
+	}
+}
+
+func (g *genPreleaseLifecycle) Namers(c *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"public":       namer.NewPublicNamer(1),
+		"intrapackage": namer.NewPublicNamer(0),
+		"raw":          namer.NewRawNamer("", nil),
+	}
+}
+
+func (g *genPreleaseLifecycle) Filter(c *generator.Context, t *types.Type) bool {
+	// Filter out types not being processed or not copyable within the package.
+	if !isAPIType(t) {
+		klog.V(2).Infof("Type %v is not a valid target for status", t)
+		return false
+	}
+	g.typesForInit = append(g.typesForInit, t)
+	return true
+}
+
+// versionMethod returns the signature of an <methodName>() method, nil or an error
+// if the type is wrong. Introduced() allows more efficient deep copy
+// implementations to be defined by the type's author.  The correct signature
+//
+//	func (t *T) <methodName>() string
+func versionMethod(methodName string, t *types.Type) (*types.Signature, error) {
+	f, found := t.Methods[methodName]
+	if !found {
+		return nil, nil
+	}
+	if len(f.Signature.Parameters) != 0 {
+		return nil, fmt.Errorf("type %v: invalid  %v signature, expected no parameters", t, methodName)
+	}
+	if len(f.Signature.Results) != 2 {
+		return nil, fmt.Errorf("type %v: invalid  %v signature, expected exactly two result types", t, methodName)
+	}
+
+	ptrRcvr := f.Signature.Receiver != nil && f.Signature.Receiver.Kind == types.Pointer && f.Signature.Receiver.Elem.Name == t.Name
+	nonPtrRcvr := f.Signature.Receiver != nil && f.Signature.Receiver.Name == t.Name
+
+	if !ptrRcvr && !nonPtrRcvr {
+		// this should never happen
+		return nil, fmt.Errorf("type %v: invalid %v signature, expected a receiver of type %s or *%s", t, methodName, t.Name.Name, t.Name.Name)
+	}
+
+	return f.Signature, nil
+}
+
+// versionedMethodOrDie returns the signature of a <methodName>() method, nil or calls klog.Fatalf
+// if the type is wrong.
+func versionedMethodOrDie(methodName string, t *types.Type) *types.Signature {
+	ret, err := versionMethod(methodName, t)
+	if err != nil {
+		klog.Fatal(err)
+	}
+	return ret
+}
+
+// isAPIType indicates whether or not a type could be used to serve an API.  That means, "does it have TypeMeta".
+// This doesn't mean the type is served, but we will handle all TypeMeta types.
+func isAPIType(t *types.Type) bool {
+	// Filter out private types.
+	if namer.IsPrivateGoName(t.Name.Name) {
+		return false
+	}
+
+	if t.Kind != types.Struct {
+		return false
+	}
+
+	for _, currMember := range t.Members {
+		if currMember.Embedded && currMember.Name == "TypeMeta" {
+			return true
+		}
+	}
+
+	if t.Kind == types.Alias {
+		return isAPIType(t.Underlying)
+	}
+
+	return false
+}
+
+func (g *genPreleaseLifecycle) isOtherPackage(pkg string) bool {
+	if pkg == g.targetPackage {
+		return false
+	}
+	if strings.HasSuffix(pkg, "\""+g.targetPackage+"\"") {
+		return false
+	}
+	return true
+}
+
+func (g *genPreleaseLifecycle) Imports(c *generator.Context) (imports []string) {
+	importLines := []string{}
+	for _, singleImport := range g.imports.ImportLines() {
+		if g.isOtherPackage(singleImport) {
+			importLines = append(importLines, singleImport)
+		}
+	}
+	return importLines
+}
+
+var (
+	isGAVersionRegex = regexp.MustCompile(`^v\d+$`)
+)
+
+func (g *genPreleaseLifecycle) argsFromType(c *generator.Context, t *types.Type) (generator.Args, error) {
+	a := generator.Args{
+		"type": t,
+	}
+	_, introducedMajor, introducedMinor, err := extractIntroducedTag(t)
+	if err != nil {
+		return nil, err
+	}
+
+	// Take version from package last segment.
+	// Use heuristic to determine whether the package is GA or prerelease.
+	// If the package is GA, the version matches the format vN where N is a number.
+	version := path.Base(t.Name.Package)
+	isGAVersion := isGAVersionRegex.MatchString(version)
+
+	a = a.
+		With("introducedMajor", introducedMajor).
+		With("introducedMinor", introducedMinor)
+
+	// compute based on our policy
+	hasDeprecated := tagExists(deprecatedTagName, t)
+	hasRemoved := tagExists(removedTagName, t)
+
+	deprecatedMajor := introducedMajor
+	deprecatedMinor := introducedMinor + 3
+	// if someone intentionally override the deprecation release
+	if hasDeprecated {
+		_, deprecatedMajor, deprecatedMinor, err = extractDeprecatedTag(t)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if !isGAVersion || hasDeprecated {
+		a = a.
+			With("deprecatedMajor", deprecatedMajor).
+			With("deprecatedMinor", deprecatedMinor)
+	}
+
+	// compute based on our policy
+	removedMajor := deprecatedMajor
+	removedMinor := deprecatedMinor + 3
+	// if someone intentionally override the removed release
+	if hasRemoved {
+		_, removedMajor, removedMinor, err = extractRemovedTag(t)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if !isGAVersion || hasRemoved {
+		a = a.
+			With("removedMajor", removedMajor).
+			With("removedMinor", removedMinor)
+	}
+
+	replacementGroup, replacementVersion, replacementKind, hasReplacement, err := extractReplacementTag(t)
+	if err != nil {
+		return nil, err
+	}
+	if hasReplacement {
+		gvkType := c.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/runtime/schema", Name: "GroupVersionKind"})
+		g.imports.AddType(gvkType)
+		a = a.
+			With("replacementGroup", replacementGroup).
+			With("replacementVersion", replacementVersion).
+			With("replacementKind", replacementKind).
+			With("GroupVersionKind", gvkType)
+	}
+
+	return a, nil
+}
+
+func (g *genPreleaseLifecycle) Init(c *generator.Context, w io.Writer) error {
+	return nil
+}
+
+func (g *genPreleaseLifecycle) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	klog.V(3).Infof("Generating prerelease-lifecycle for type %v", t)
+
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+	args, err := g.argsFromType(c, t)
+	if err != nil {
+		return err
+	}
+
+	if versionedMethodOrDie("APILifecycleIntroduced", t) == nil {
+		sw.Do("// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.\n", args)
+		sw.Do("// It is controlled by \""+introducedTagName+"\" tags in types.go.\n", args)
+		sw.Do("func (in *$.type|intrapackage$) APILifecycleIntroduced() (major, minor int) {\n", args)
+		sw.Do("    return $.introducedMajor$, $.introducedMinor$\n", args)
+		sw.Do("}\n\n", nil)
+	}
+
+	if _, hasDeprecated := args["deprecatedMajor"]; hasDeprecated {
+		if versionedMethodOrDie("APILifecycleDeprecated", t) == nil {
+			sw.Do("// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.\n", args)
+			sw.Do("// It is controlled by \""+deprecatedTagName+"\" tags in types.go or  \""+introducedTagName+"\" plus three minor.\n", args)
+			sw.Do("func (in *$.type|intrapackage$) APILifecycleDeprecated() (major, minor int) {\n", args)
+			sw.Do("    return $.deprecatedMajor$, $.deprecatedMinor$\n", args)
+			sw.Do("}\n\n", nil)
+		}
+	}
+
+	if _, hasReplacement := args["replacementKind"]; hasReplacement {
+		if versionedMethodOrDie("APILifecycleReplacement", t) == nil {
+			sw.Do("// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.\n", args)
+			sw.Do("// It is controlled by \""+replacementTagName+"=<group>,<version>,<kind>\" tags in types.go.\n", args)
+			sw.Do("func (in *$.type|intrapackage$) APILifecycleReplacement() ($.GroupVersionKind|raw$) {\n", args)
+			sw.Do("    return $.GroupVersionKind|raw${Group:\"$.replacementGroup$\", Version:\"$.replacementVersion$\", Kind:\"$.replacementKind$\"}\n", args)
+			sw.Do("}\n\n", nil)
+		}
+	}
+
+	if _, hasRemoved := args["removedMajor"]; hasRemoved {
+		if versionedMethodOrDie("APILifecycleRemoved", t) == nil {
+			sw.Do("// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.\n", args)
+			sw.Do("// It is controlled by \""+removedTagName+"\" tags in types.go or  \""+deprecatedTagName+"\" plus three minor.\n", args)
+			sw.Do("func (in *$.type|intrapackage$) APILifecycleRemoved() (major, minor int) {\n", args)
+			sw.Do("    return $.removedMajor$, $.removedMinor$\n", args)
+			sw.Do("}\n\n", nil)
+		}
+	}
+
+	return sw.Error()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/prerelease-lifecycle-generators/status_targets_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/prerelease-lifecycle-generators/status_targets_test.go
new file mode 100644
index 0000000000..f811f04f8c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/prerelease-lifecycle-generators/status_targets_test.go
@@ -0,0 +1,168 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package prereleaselifecyclegenerators
+
+import (
+	"sort"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"k8s.io/code-generator/cmd/prerelease-lifecycle-gen/args"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/types"
+)
+
+func TestGetTargets(t *testing.T) {
+	cases := []struct {
+		name     string
+		pkgs     map[string]*types.Package
+		inputs   []string
+		wantPkgs []string
+	}{
+		{
+			name: "enabled package activates",
+			pkgs: map[string]*types.Package{
+				"example.com/api/v1": {
+					Path:     "example.com/api/v1",
+					Dir:      "/tmp/example/api/v1",
+					Comments: []string{"+k8s:prerelease-lifecycle-gen=true"},
+				},
+			},
+			inputs:   []string{"example.com/api/v1"},
+			wantPkgs: []string{"example.com/api/v1"},
+		},
+		{
+			name: "sole =false opts out",
+			pkgs: map[string]*types.Package{
+				"example.com/api/v1": {
+					Path:     "example.com/api/v1",
+					Dir:      "/tmp/example/api/v1",
+					Comments: []string{"+k8s:prerelease-lifecycle-gen=false"},
+				},
+			},
+			inputs:   []string{"example.com/api/v1"},
+			wantPkgs: nil,
+		},
+		{
+			name: "no relevant tag is skipped",
+			pkgs: map[string]*types.Package{
+				"example.com/api/v1": {
+					Path:     "example.com/api/v1",
+					Dir:      "/tmp/example/api/v1",
+					Comments: []string{"+groupName=example.com"},
+				},
+			},
+			inputs:   []string{"example.com/api/v1"},
+			wantPkgs: nil,
+		},
+		{
+			name: "enabled with introduced subtag activates",
+			pkgs: map[string]*types.Package{
+				"example.com/api/v1beta1": {
+					Path: "example.com/api/v1beta1",
+					Dir:  "/tmp/example/api/v1beta1",
+					Comments: []string{
+						"+k8s:prerelease-lifecycle-gen=true",
+						"+k8s:prerelease-lifecycle-gen:introduced=1.30",
+					},
+				},
+			},
+			inputs:   []string{"example.com/api/v1beta1"},
+			wantPkgs: []string{"example.com/api/v1beta1"},
+		},
+		// Ecosystem regression: a third-party generator's tag in the same
+		// doc.go must NOT cause prerelease-gen to fail or skip.
+		{
+			name: "foreign third-party generator tag is ignored",
+			pkgs: map[string]*types.Package{
+				"example.com/api/v1": {
+					Path: "example.com/api/v1",
+					Dir:  "/tmp/example/api/v1",
+					Comments: []string{
+						"+k8s:my-custom-gen=value",
+						"+k8s:prerelease-lifecycle-gen=true",
+					},
+				},
+			},
+			inputs:   []string{"example.com/api/v1"},
+			wantPkgs: []string{"example.com/api/v1"},
+		},
+		{
+			name: "mix of all cases",
+			pkgs: map[string]*types.Package{
+				"example.com/enabled/v1": {
+					Path:     "example.com/enabled/v1",
+					Dir:      "/tmp/enabled/v1",
+					Comments: []string{"+k8s:prerelease-lifecycle-gen=true"},
+				},
+				"example.com/optedout/v1": {
+					Path:     "example.com/optedout/v1",
+					Dir:      "/tmp/optedout/v1",
+					Comments: []string{"+k8s:prerelease-lifecycle-gen=false"},
+				},
+				"example.com/untagged/v1": {
+					Path:     "example.com/untagged/v1",
+					Dir:      "/tmp/untagged/v1",
+					Comments: []string{"+groupName=example.com"},
+				},
+				"example.com/withsubtag/v1beta1": {
+					Path: "example.com/withsubtag/v1beta1",
+					Dir:  "/tmp/withsubtag/v1beta1",
+					Comments: []string{
+						"+k8s:prerelease-lifecycle-gen=true",
+						"+k8s:prerelease-lifecycle-gen:introduced=1.30",
+					},
+				},
+			},
+			inputs: []string{
+				"example.com/enabled/v1",
+				"example.com/optedout/v1",
+				"example.com/untagged/v1",
+				"example.com/withsubtag/v1beta1",
+			},
+			wantPkgs: []string{
+				"example.com/enabled/v1",
+				"example.com/withsubtag/v1beta1",
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := &generator.Context{
+				Universe: types.Universe(tc.pkgs),
+				Inputs:   tc.inputs,
+			}
+			a := &args.Args{OutputFile: "zz_generated.prerelease_lifecycle.go"}
+
+			got := GetTargets(ctx, a)
+
+			var gotPkgs []string
+			for _, tgt := range got {
+				gotPkgs = append(gotPkgs, tgt.Path())
+			}
+			sort.Strings(gotPkgs)
+			want := append([]string(nil), tc.wantPkgs...)
+			sort.Strings(want)
+
+			if diff := cmp.Diff(want, gotPkgs); diff != "" {
+				t.Errorf("GetTargets package paths mismatch (-want +got):\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/prerelease-lifecycle-generators/status_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/prerelease-lifecycle-generators/status_test.go
new file mode 100644
index 0000000000..96e392047e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/prerelease-lifecycle-gen/prerelease-lifecycle-generators/status_test.go
@@ -0,0 +1,798 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package prereleaselifecyclegenerators
+
+import (
+	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/klog/v2"
+)
+
+var mockType = &types.Type{
+	CommentLines: []string{
+		"RandomType defines a random structure in Kubernetes",
+		"It should be used just when you need something different than 42",
+	},
+	SecondClosestCommentLines: []string{},
+}
+
+func TestArgsFromType(t *testing.T) {
+	type testcase struct {
+		name          string
+		t             *types.Type
+		expected      generator.Args
+		expectedError string
+	}
+
+	tests := []testcase{
+		{
+			name: "no comments",
+			t: &types.Type{
+				Name: types.Name{
+					Name:    "Simple",
+					Package: "k8s.io/apis/core/v1",
+				},
+			},
+			expectedError: `missing`,
+		},
+		{
+			name: "GA type",
+			t: &types.Type{
+				Name: types.Name{
+					Name:    "Simple",
+					Package: "k8s.io/apis/core/v1",
+				},
+				CommentLines: []string{
+					"+k8s:prerelease-lifecycle-gen:introduced=1.5",
+				},
+			},
+			expected: generator.Args{
+				"introducedMajor": 1,
+				"introducedMinor": 5,
+			},
+		},
+		{
+			name: "GA type v2",
+			t: &types.Type{
+				Name: types.Name{
+					Name:    "Simple",
+					Package: "k8s.io/apis/core/v2",
+				},
+				CommentLines: []string{
+					"+k8s:prerelease-lifecycle-gen:introduced=1.5",
+				},
+			},
+			expected: generator.Args{
+				"introducedMajor": 1,
+				"introducedMinor": 5,
+			},
+		},
+		{
+			name: "GA type - explicit deprecated",
+			t: &types.Type{
+				Name: types.Name{
+					Name:    "Simple",
+					Package: "k8s.io/apis/core/v1",
+				},
+				CommentLines: []string{
+					"+k8s:prerelease-lifecycle-gen:introduced=1.5",
+					"+k8s:prerelease-lifecycle-gen:deprecated=1.7",
+				},
+			},
+			expected: generator.Args{
+				"introducedMajor": 1,
+				"introducedMinor": 5,
+				"deprecatedMajor": 1,
+				"deprecatedMinor": 7,
+			},
+		},
+		{
+			name: "GA type - explicit removed",
+			t: &types.Type{
+				Name: types.Name{
+					Name:    "Simple",
+					Package: "k8s.io/apis/core/v1",
+				},
+				CommentLines: []string{
+					"+k8s:prerelease-lifecycle-gen:introduced=1.5",
+					"+k8s:prerelease-lifecycle-gen:removed=1.9",
+				},
+			},
+			expected: generator.Args{
+				"introducedMajor": 1,
+				"introducedMinor": 5,
+				"removedMajor":    1,
+				"removedMinor":    9,
+			},
+		},
+		{
+			name: "GA type - explicit",
+			t: &types.Type{
+				Name: types.Name{
+					Name:    "Simple",
+					Package: "k8s.io/apis/core/v1",
+				},
+				CommentLines: []string{
+					"+k8s:prerelease-lifecycle-gen:introduced=1.5",
+					"+k8s:prerelease-lifecycle-gen:deprecated=1.7",
+					"+k8s:prerelease-lifecycle-gen:removed=1.9",
+				},
+			},
+			expected: generator.Args{
+				"introducedMajor": 1,
+				"introducedMinor": 5,
+				"deprecatedMajor": 1,
+				"deprecatedMinor": 7,
+				"removedMajor":    1,
+				"removedMinor":    9,
+			},
+		},
+		{
+			name: "beta type - defaulted",
+			t: &types.Type{
+				Name: types.Name{
+					Name:    "Simple",
+					Package: "k8s.io/apis/core/v1beta1",
+				},
+				CommentLines: []string{
+					"+k8s:prerelease-lifecycle-gen:introduced=1.5",
+				},
+			},
+			expected: generator.Args{
+				"introducedMajor": 1,
+				"introducedMinor": 5,
+				"deprecatedMajor": 1,
+				"deprecatedMinor": 8,
+				"removedMajor":    1,
+				"removedMinor":    11,
+			},
+		},
+		{
+			name: "beta type - explicit",
+			t: &types.Type{
+				Name: types.Name{
+					Name:    "Simple",
+					Package: "k8s.io/apis/core/v1beta1",
+				},
+				CommentLines: []string{
+					"+k8s:prerelease-lifecycle-gen:introduced=1.5",
+					"+k8s:prerelease-lifecycle-gen:deprecated=1.7",
+					"+k8s:prerelease-lifecycle-gen:removed=1.9",
+				},
+			},
+			expected: generator.Args{
+				"introducedMajor": 1,
+				"introducedMinor": 5,
+				"deprecatedMajor": 1,
+				"deprecatedMinor": 7,
+				"removedMajor":    1,
+				"removedMinor":    9,
+			},
+		},
+		{
+			name: "beta type - explicit deprecated only",
+			t: &types.Type{
+				Name: types.Name{
+					Name:    "Simple",
+					Package: "k8s.io/apis/core/v1beta1",
+				},
+				CommentLines: []string{
+					"+k8s:prerelease-lifecycle-gen:introduced=1.5",
+					"+k8s:prerelease-lifecycle-gen:deprecated=1.7",
+				},
+			},
+			expected: generator.Args{
+				"introducedMajor": 1,
+				"introducedMinor": 5,
+				"deprecatedMajor": 1,
+				"deprecatedMinor": 7,
+				"removedMajor":    1,
+				"removedMinor":    10,
+			},
+		},
+		{
+			name: "beta type - explicit removed only",
+			t: &types.Type{
+				Name: types.Name{
+					Name:    "Simple",
+					Package: "k8s.io/apis/core/v1beta1",
+				},
+				CommentLines: []string{
+					"+k8s:prerelease-lifecycle-gen:introduced=1.5",
+					"+k8s:prerelease-lifecycle-gen:removed=1.9",
+				},
+			},
+			expected: generator.Args{
+				"introducedMajor": 1,
+				"introducedMinor": 5,
+				"deprecatedMajor": 1,
+				"deprecatedMinor": 8,
+				"removedMajor":    1,
+				"removedMinor":    9,
+			},
+		},
+		{
+			name: "alpha type - defaulted",
+			t: &types.Type{
+				Name: types.Name{
+					Name:    "Simple",
+					Package: "k8s.io/apis/core/v1alpha1",
+				},
+				CommentLines: []string{
+					"+k8s:prerelease-lifecycle-gen:introduced=1.5",
+				},
+			},
+			expected: generator.Args{
+				"introducedMajor": 1,
+				"introducedMinor": 5,
+				"deprecatedMajor": 1,
+				"deprecatedMinor": 8,
+				"removedMajor":    1,
+				"removedMinor":    11,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if test.expected != nil {
+				test.expected["type"] = test.t
+			}
+			gen := genPreleaseLifecycle{}
+			args, err := gen.argsFromType(nil, test.t)
+			if test.expectedError != "" {
+				if err == nil {
+					t.Errorf("expected error, got none")
+				} else if !strings.Contains(err.Error(), test.expectedError) {
+					t.Errorf("expected error %q, got %q", test.expectedError, err.Error())
+				}
+				return
+			}
+			if err != nil {
+				t.Errorf("unexpected error: %v", err)
+			}
+			if diff := cmp.Diff(test.expected, args); diff != "" {
+				t.Error(diff)
+			}
+		})
+	}
+}
+
+func Test_extractKubeVersionTag(t *testing.T) {
+	oldKlogOsExit := klog.OsExit
+	defer func() {
+		klog.OsExit = oldKlogOsExit
+	}()
+	klog.OsExit = customExit
+
+	tests := []struct {
+		name        string
+		tagName     string
+		tagComments []string
+		wantValue   *tagValue
+		wantMajor   int
+		wantMinor   int
+		wantErr     bool
+		wantFatal   bool
+	}{
+		{
+			name:    "not found tag should generate an error",
+			tagName: "someVersionTag:version",
+			tagComments: []string{
+				"+someOtherTag:version=1.5",
+			},
+			wantValue: nil,
+			wantErr:   true,
+		},
+		{
+			name:    "found tag should return correctly",
+			tagName: "someVersionTag:version",
+			tagComments: []string{
+				"+someVersionTag:version=1.5",
+			},
+			wantValue: &tagValue{
+				value: "1.5",
+			},
+			wantMajor: 1,
+			wantMinor: 5,
+			wantErr:   false,
+		},
+		{
+			name:    "multiple declarations of same tag should return an error",
+			tagName: "someVersionTag:version",
+			tagComments: []string{
+				"+someVersionTag:version=1.5",
+				"+someVersionTag:version=v1.7",
+			},
+			wantValue: nil,
+			wantFatal: true,
+		},
+		{
+			name:    "multiple values on same tag should return an error",
+			tagName: "someVersionTag:version",
+			tagComments: []string{
+				"+someVersionTag:version=1.5,something",
+			},
+			wantValue: nil,
+			wantFatal: true,
+		},
+		{
+			name:    "wrong tag major value should return an error",
+			tagName: "someVersionTag:version",
+			tagComments: []string{
+				"+someVersionTag:version=.5",
+			},
+			wantErr: true,
+		},
+		{
+			name:    "wrong tag minor value should return an error",
+			tagName: "someVersionTag:version",
+			tagComments: []string{
+				"+someVersionTag:version=1.",
+			},
+			wantErr: true,
+		},
+		{
+			name:    "wrong tag format should return an error",
+			tagName: "someVersionTag:version",
+			tagComments: []string{
+				"+someVersionTag:version=1.5.7",
+			},
+			wantErr: true,
+		},
+		{
+			name:    "wrong tag major int value should return an error",
+			tagName: "someVersionTag:version",
+			tagComments: []string{
+				"+someVersionTag:version=blah.5",
+			},
+			wantErr: true,
+		},
+		{
+			name:    "wrong tag minor int value should return an error",
+			tagName: "someVersionTag:version",
+			tagComments: []string{
+				"+someVersionTag:version=1.blah",
+			},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			mockType.SecondClosestCommentLines = tt.tagComments
+			gotTag, gotMajor, gotMinor, err, fatalErr := safeExtractKubeVersionTag(tt.tagName, mockType)
+			if (fatalErr != nil) != tt.wantFatal {
+				t.Errorf("extractKubeVersionTag() fatalErr = %v, wantFatal %v", fatalErr, tt.wantFatal)
+				return
+			}
+			if tt.wantFatal {
+				return
+			}
+			if (err != nil) != tt.wantErr {
+				t.Errorf("extractKubeVersionTag() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if tt.wantErr {
+				return
+			}
+			if !reflect.DeepEqual(gotTag, tt.wantValue) {
+				t.Errorf("extractKubeVersionTag() got = %v, want %v", gotTag, tt.wantValue)
+			}
+			if gotMajor != tt.wantMajor {
+				t.Errorf("extractKubeVersionTag() got1 = %v, want %v", gotMajor, tt.wantMajor)
+			}
+			if gotMinor != tt.wantMinor {
+				t.Errorf("extractKubeVersionTag() got2 = %v, want %v", gotMinor, tt.wantMinor)
+			}
+		})
+	}
+}
+
+func customExit(exitCode int) {
+	panic(strconv.Itoa(exitCode))
+}
+
+func safeExtractKubeVersionTag(tagName string, t *types.Type) (value *tagValue, major int, minor int, err error, localErr error) {
+	defer func() {
+		if e := recover(); e != nil {
+			localErr = fmt.Errorf("extractKubeVersionTag returned error: %v", e)
+		}
+	}()
+	value, major, minor, err = extractKubeVersionTag(tagName, t)
+	return
+}
+
+func safeExtractTag(t *testing.T, tagName string, comments []string) (value *tagValue, err error) {
+	defer func() {
+		if e := recover(); e != nil {
+			err = fmt.Errorf("extractTag returned error: %v", e)
+		}
+	}()
+	value = extractTag(tagName, comments)
+	return
+}
+
+func Test_extractTag(t *testing.T) {
+	oldKlogOsExit := klog.OsExit
+	defer func() {
+		klog.OsExit = oldKlogOsExit
+	}()
+	klog.OsExit = customExit
+
+	comments := []string{
+		"+variable=7",
+		"+anotherVariable=8",
+		"+yetAnotherVariable=9",
+		"variableWithoutMarker=10",
+		"+variableWithoutValue",
+		"+variable=11",
+		"+multi-valuedVariable=12,13,14",
+		"+strangeVariable=15,=16",
+	}
+
+	tests := []struct {
+		name         string
+		tagComments  []string
+		variableName string
+		wantError    bool
+		wantValue    *tagValue
+	}{
+		{
+			name:         "variable with explicit value",
+			tagComments:  comments,
+			variableName: "anotherVariable",
+			wantValue:    &tagValue{value: "8"},
+		},
+		{
+			name:         "variable without explicit value",
+			tagComments:  comments,
+			variableName: "variableWithoutValue",
+			wantValue:    &tagValue{value: ""},
+		},
+		{
+			name:         "variable not present in comments",
+			tagComments:  comments,
+			variableName: "variableOutOfNowhere",
+			wantValue:    nil,
+		},
+		{
+			name:         "variable without marker test",
+			tagComments:  comments,
+			variableName: "variableWithoutMarker",
+			wantValue:    nil,
+		},
+		{
+			name:         "abort duplicated variable",
+			tagComments:  comments,
+			variableName: "variable",
+			wantError:    true,
+			wantValue:    nil,
+		},
+		{
+			name:         "abort variable with multiple values",
+			tagComments:  comments,
+			variableName: "multi-valuedVariable",
+			wantError:    true,
+			wantValue:    nil,
+		},
+		{
+			name:         "this test documents strange behaviour", // TODO: Is this behaviour intended?
+			tagComments:  comments,
+			variableName: "strangeVariable",
+			wantValue:    &tagValue{value: "15"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotTag, err := safeExtractTag(t, tt.variableName, tt.tagComments)
+			if (err != nil) != tt.wantError {
+				t.Errorf("extractTag() err = %v, wantError = %v.", gotTag, tt.wantError)
+				return
+			}
+			if tt.wantError {
+				return
+			}
+			if !reflect.DeepEqual(gotTag, tt.wantValue) {
+				t.Errorf("extractTag() got = %v, want %v", gotTag, tt.wantValue)
+			}
+		})
+	}
+}
+
+func Test_extractEnabledTypeTag(t *testing.T) {
+	someComments := []string{
+		"+variable=7",
+		"+k8s:prerelease-lifecycle-gen=8",
+	}
+	moreComments := []string{
+		"+yetAnotherVariable=9",
+		"variableWithoutMarker=10",
+		"+variableWithoutValue",
+		"+variable=11",
+		"+multi-valuedVariable=12,13,14",
+	}
+
+	tests := []struct {
+		name      string
+		mockType  *types.Type
+		wantValue *tagValue
+	}{
+		{
+			name:      "desired info in main comments",
+			mockType:  &types.Type{CommentLines: someComments, SecondClosestCommentLines: moreComments},
+			wantValue: &tagValue{value: "8"},
+		},
+		{
+			name:      "secondary comments empty",
+			mockType:  &types.Type{CommentLines: someComments},
+			wantValue: &tagValue{value: "8"},
+		},
+		{
+			name:      "main comments empty",
+			mockType:  &types.Type{SecondClosestCommentLines: someComments},
+			wantValue: &tagValue{value: "8"},
+		},
+		{
+			name:      "lack of desired info, empty secondary comments",
+			mockType:  &types.Type{CommentLines: moreComments},
+			wantValue: nil,
+		},
+		{
+			name:      "lack of desired info, empty main comments",
+			mockType:  &types.Type{SecondClosestCommentLines: moreComments},
+			wantValue: nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotTag := extractEnabledTypeTag(tt.mockType)
+			if !reflect.DeepEqual(gotTag, tt.wantValue) {
+				t.Errorf("extractEnabledTypeTag() got = %v, want %v", gotTag, tt.wantValue)
+			}
+		})
+	}
+}
+
+func Test_extractReplacementTag(t *testing.T) {
+	replacementTag := "+k8s:prerelease-lifecycle-gen:replacement"
+	tests := []struct {
+		name               string
+		mainComments       []string
+		secondaryComments  []string
+		wantGroup          string
+		wantVersion        string
+		wantKind           string
+		wantHasReplacement bool
+		wantErr            bool
+	}{
+		{
+			name:               "no replacement tag",
+			mainComments:       []string{"randomText=7"},
+			secondaryComments:  []string{"importantFlag=8.8.8.8"},
+			wantGroup:          "",
+			wantVersion:        "",
+			wantKind:           "",
+			wantHasReplacement: false,
+			wantErr:            false,
+		},
+		{
+			name:               "replacement tag correct",
+			mainComments:       []string{fmt.Sprintf("%v=my_group,v1,KindOf", replacementTag)},
+			secondaryComments:  []string{},
+			wantGroup:          "my_group",
+			wantVersion:        "v1",
+			wantKind:           "KindOf",
+			wantHasReplacement: true,
+			wantErr:            false,
+		},
+		{
+			name:               "correct replacement tag in secondary comments",
+			mainComments:       []string{},
+			secondaryComments:  []string{fmt.Sprintf("%v=my_group,v1,KindOf", replacementTag)},
+			wantGroup:          "my_group",
+			wantVersion:        "v1",
+			wantKind:           "KindOf",
+			wantHasReplacement: true,
+			wantErr:            false,
+		},
+		{
+			name:               "4 values instead of 3",
+			mainComments:       []string{fmt.Sprintf("%v=my_group,v1,KindOf,subKind", replacementTag)},
+			secondaryComments:  []string{},
+			wantGroup:          "",
+			wantVersion:        "",
+			wantKind:           "",
+			wantHasReplacement: false,
+			wantErr:            true,
+		},
+		{
+			name:               "4 values instead of 3 in secondary comments",
+			mainComments:       []string{},
+			secondaryComments:  []string{fmt.Sprintf("%v=my_group,v1,KindOf,subKind", replacementTag)},
+			wantGroup:          "",
+			wantVersion:        "",
+			wantKind:           "",
+			wantHasReplacement: false,
+			wantErr:            true,
+		},
+		{
+			name:               "2 values instead of 3",
+			mainComments:       []string{fmt.Sprintf("%v=my_group,v1", replacementTag)},
+			secondaryComments:  []string{},
+			wantGroup:          "",
+			wantVersion:        "",
+			wantKind:           "",
+			wantHasReplacement: false,
+			wantErr:            true,
+		},
+		{
+			name:               "group name not all upper",
+			mainComments:       []string{fmt.Sprintf("%v=myGroup,v1,KindOf", replacementTag)},
+			secondaryComments:  []string{},
+			wantGroup:          "",
+			wantVersion:        "",
+			wantKind:           "",
+			wantHasReplacement: false,
+			wantErr:            true,
+		},
+		{
+			name:               "version name does not start with v",
+			mainComments:       []string{fmt.Sprintf("%v=my_group,bestVersion,KindOf", replacementTag)},
+			secondaryComments:  []string{},
+			wantGroup:          "",
+			wantVersion:        "",
+			wantKind:           "",
+			wantHasReplacement: false,
+			wantErr:            true,
+		},
+		{
+			name:               "kind name does not start with capital",
+			mainComments:       []string{fmt.Sprintf("%v=my_group,v1,kindOf", replacementTag)},
+			secondaryComments:  []string{},
+			wantGroup:          "",
+			wantVersion:        "",
+			wantKind:           "",
+			wantHasReplacement: false,
+			wantErr:            true,
+		},
+		{
+			name:               "empty group name", // TODO: is it a valid input or a bug?
+			mainComments:       []string{fmt.Sprintf("%v=,v1,KindOf", replacementTag)},
+			secondaryComments:  []string{},
+			wantGroup:          "",
+			wantVersion:        "v1",
+			wantKind:           "KindOf",
+			wantHasReplacement: true,
+			wantErr:            false,
+		},
+		{
+			name:               "empty version",
+			mainComments:       []string{fmt.Sprintf("%v=my_group,,KindOf", replacementTag)},
+			secondaryComments:  []string{},
+			wantGroup:          "",
+			wantVersion:        "",
+			wantKind:           "",
+			wantHasReplacement: false,
+			wantErr:            true,
+		},
+		{
+			name:               "empty kind",
+			mainComments:       []string{fmt.Sprintf("%v=my_group,v1,", replacementTag)},
+			secondaryComments:  []string{},
+			wantGroup:          "",
+			wantVersion:        "",
+			wantKind:           "",
+			wantHasReplacement: false,
+			wantErr:            true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			replacementGroup, replacementVersion, replacementKind, hasReplacement, err := extractReplacementTag(&types.Type{
+				CommentLines:              tt.mainComments,
+				SecondClosestCommentLines: tt.secondaryComments,
+			})
+			if replacementGroup != tt.wantGroup {
+				t.Errorf("extractReplacementTag() group got = %v, want %v", replacementGroup, tt.wantGroup)
+			}
+			if replacementVersion != tt.wantVersion {
+				t.Errorf("extractReplacementTag() version got = %v, want %v", replacementVersion, tt.wantVersion)
+			}
+			if replacementKind != tt.wantKind {
+				t.Errorf("extractReplacementTag() kind got = %v, want %v", replacementKind, tt.wantKind)
+			}
+			if hasReplacement != tt.wantHasReplacement {
+				t.Errorf("extractReplacementTag() hasReplacement got = %v, want %v", hasReplacement, tt.wantHasReplacement)
+			}
+			if (err != nil) != tt.wantErr {
+				t.Errorf("extractReplacementTag() err got = %v, want %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func Test_isAPIType(t *testing.T) {
+	tests := []struct {
+		name string
+		t    *types.Type
+		want bool
+	}{
+		{
+			name: "private name is not apitype",
+			want: false,
+			t: &types.Type{
+				Name: types.Name{
+					Name: "notpublic",
+				},
+			},
+		},
+		{
+			name: "non struct is not apitype",
+			want: false,
+			t: &types.Type{
+				Name: types.Name{
+					Name: "Public",
+				},
+				Kind: types.Slice,
+			},
+		},
+		{
+			name: "contains member type",
+			want: true,
+			t: &types.Type{
+				Name: types.Name{
+					Name: "Public",
+				},
+				Kind: types.Struct,
+				Members: []types.Member{
+					{
+						Embedded: true,
+						Name:     "TypeMeta",
+					},
+				},
+			},
+		},
+
+		{
+			name: "contains no type",
+			want: false,
+			t: &types.Type{
+				Name: types.Name{
+					Name: "Public",
+				},
+				Kind: types.Struct,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isAPIType(tt.t); got != tt.want {
+				t.Errorf("isAPIType() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/args/args.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/args/args.go
new file mode 100644
index 0000000000..70e2b1d739
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/args/args.go
@@ -0,0 +1,57 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package args
+
+import (
+	"fmt"
+
+	"github.com/spf13/pflag"
+	"k8s.io/code-generator/pkg/apidefinitions"
+)
+
+type Args struct {
+	OutputFile   string
+	GoHeaderFile string
+
+	apidefinitions.LintArgs
+}
+
+// New returns default arguments for the generator.
+func New() *Args {
+	return &Args{}
+}
+
+// AddFlags add the generator flags to the flag set.
+func (args *Args) AddFlags(fs *pflag.FlagSet) {
+	fs.StringVar(&args.OutputFile, "output-file", "generated.register.go",
+		"the name of the file to be generated")
+	fs.StringVar(&args.GoHeaderFile, "go-header-file", "",
+		"the path to a file containing boilerplate header text; the string \"YEAR\" will be replaced with the current 4-digit year")
+	apidefinitions.AddFlags(&args.LintArgs, fs)
+}
+
+// Validate checks the given arguments.
+func (args *Args) Validate() error {
+	if len(args.OutputFile) == 0 {
+		return fmt.Errorf("output file base name cannot be empty")
+	}
+	if err := apidefinitions.ValidateFlags(args.LintRules); err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/generators/register_external.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/generators/register_external.go
new file mode 100644
index 0000000000..4c3fd37e90
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/generators/register_external.go
@@ -0,0 +1,122 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"io"
+	"sort"
+
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+)
+
+type registerExternalGenerator struct {
+	generator.GoGenerator
+	outputPackage   string
+	gv              clientgentypes.GroupVersion
+	typesToGenerate []*types.Type
+	imports         namer.ImportTracker
+}
+
+var _ generator.Generator = &registerExternalGenerator{}
+
+func (g *registerExternalGenerator) Filter(_ *generator.Context, _ *types.Type) bool {
+	return false
+}
+
+func (g *registerExternalGenerator) Imports(c *generator.Context) (imports []string) {
+	return g.imports.ImportLines()
+}
+
+func (g *registerExternalGenerator) Namers(_ *generator.Context) namer.NameSystems {
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.outputPackage, g.imports),
+	}
+}
+
+func (g *registerExternalGenerator) Finalize(context *generator.Context, w io.Writer) error {
+	typesToGenerateOnlyNames := make([]string, len(g.typesToGenerate))
+	for index, typeToGenerate := range g.typesToGenerate {
+		typesToGenerateOnlyNames[index] = typeToGenerate.Name.Name
+	}
+
+	// sort the list of types to register, so that the generator produces stable output
+	sort.Strings(typesToGenerateOnlyNames)
+
+	sw := generator.NewSnippetWriter(w, context, "$", "$")
+	m := map[string]interface{}{
+		"groupName":           g.gv.Group,
+		"version":             g.gv.Version,
+		"types":               typesToGenerateOnlyNames,
+		"addToGroupVersion":   context.Universe.Function(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "AddToGroupVersion"}),
+		"groupVersion":        context.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/apis/meta/v1", Name: "GroupVersion"}),
+		"schemaGroupVersion":  context.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/runtime/schema", Name: "GroupVersion"}),
+		"schemaGroupResource": context.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/runtime/schema", Name: "GroupResource"}),
+		"scheme":              context.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/runtime", Name: "Scheme"}),
+		"schemeBuilder":       context.Universe.Type(types.Name{Package: "k8s.io/apimachinery/pkg/runtime", Name: "SchemeBuilder"}),
+	}
+	sw.Do(registerExternalTypesTemplate, m)
+	return sw.Error()
+}
+
+var registerExternalTypesTemplate = `
+// GroupName specifies the group name used to register the objects.
+const GroupName = "$.groupName$"
+
+// GroupVersion specifies the group and the version used to register the objects.
+var GroupVersion = $.groupVersion|raw${Group: GroupName, Version: "$.version$"}
+
+// SchemeGroupVersion is group version used to register these objects
+//
+// Deprecated: use GroupVersion instead.
+var SchemeGroupVersion = $.schemaGroupVersion|raw${Group: GroupName, Version: "$.version$"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) $.schemaGroupResource|raw$ {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      $.schemeBuilder|raw$
+	localSchemeBuilder = &SchemeBuilder
+    // Deprecated: use Install instead
+	AddToScheme        = localSchemeBuilder.AddToScheme
+	Install            = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *$.scheme|raw$) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+    $range .types -$
+        &$.${},
+    $end$
+	)
+    // AddToGroupVersion allows the serialization of client types like ListOptions.
+	$.addToGroupVersion|raw$(scheme, SchemeGroupVersion)
+	return nil
+}
+`
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/generators/targets.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/generators/targets.go
new file mode 100644
index 0000000000..9d66e20d96
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/generators/targets.go
@@ -0,0 +1,162 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"fmt"
+	"os"
+	"path"
+	"strings"
+
+	"k8s.io/klog/v2"
+
+	clientgentypes "k8s.io/code-generator/cmd/client-gen/types"
+	"k8s.io/code-generator/cmd/register-gen/args"
+	"k8s.io/code-generator/pkg/apidefinitions"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+)
+
+// NameSystems returns the name system used by the generators in this package.
+func NameSystems() namer.NameSystems {
+	return namer.NameSystems{}
+}
+
+// DefaultNameSystem returns the default name system for ordering the types to be
+// processed by the generators in this package.
+func DefaultNameSystem() string {
+	return "public"
+}
+
+// GetTargets makes targets to generate.
+func GetTargets(context *generator.Context, args *args.Args) []generator.Target {
+	boilerplate, err := gengo.GoBoilerplate(args.GoHeaderFile, gengo.StdBuildTag, gengo.StdGeneratedBy)
+	if err != nil {
+		klog.Fatalf("Failed loading boilerplate: %v", err)
+	}
+
+	var idOpts []apidefinitions.Option
+	if len(args.LintRules) > 0 {
+		idOpts = append(idOpts, apidefinitions.WithLintRules(args.LintRules...))
+	}
+
+	targetList := []generator.Target{}
+	for _, input := range context.Inputs {
+		pkg := context.Universe.Package(input)
+		if !isRegisterGenTarget(pkg, idOpts) {
+			continue
+		}
+		internal, err := isInternal(pkg)
+		if err != nil {
+			klog.V(5).Infof("skipping the generation of %s file, due to err %v", args.OutputFile, err)
+			continue
+		}
+		if internal {
+			klog.V(5).Infof("skipping the generation of %s file because %s package contains internal types, note that internal types don't have \"json\" tags", args.OutputFile, pkg.Name)
+			continue
+		}
+		registerFileName := "register.go"
+		searchPath := path.Join(pkg.Dir, registerFileName)
+		if _, err := os.Stat(path.Join(searchPath)); err == nil {
+			klog.V(5).Infof("skipping the generation of %s file because %s already exists in the path %s", args.OutputFile, registerFileName, searchPath)
+			continue
+		} else if err != nil && !os.IsNotExist(err) {
+			klog.Fatalf("an error %v has occurred while checking if %s exists", err, registerFileName)
+		}
+
+		gv := clientgentypes.GroupVersion{}
+		{
+			pathParts := strings.Split(pkg.Path, "/")
+			if len(pathParts) < 2 {
+				klog.Errorf("the path of the package must contain the group name and the version, path = %s", pkg.Path)
+				continue
+			}
+			gv.Group = clientgentypes.Group(pathParts[len(pathParts)-2])
+			gv.Version = clientgentypes.Version(pathParts[len(pathParts)-1])
+
+			// if there is a comment of the form "// +groupName=somegroup" or "// +groupName=somegroup.foo.bar.io",
+			// extract the fully qualified API group name from it and overwrite the group inferred from the package path
+			override, ok, err := apidefinitions.GroupNameForPackage(pkg.Comments)
+			if err != nil {
+				klog.Fatalf("error resolving group name: %v", err)
+			}
+			if ok {
+				klog.V(5).Infof("overriding the group name with = %s", override)
+				gv.Group = clientgentypes.Group(override)
+			}
+		}
+
+		typesToRegister := []*types.Type{}
+		for _, t := range pkg.Types {
+			klog.V(5).Infof("considering type = %s", t.Name.String())
+			for _, typeMember := range t.Members {
+				if typeMember.Name == "TypeMeta" && typeMember.Embedded {
+					typesToRegister = append(typesToRegister, t)
+				}
+			}
+		}
+
+		targetList = append(targetList,
+			&generator.SimpleTarget{
+				PkgName:       pkg.Name,
+				PkgPath:       pkg.Path, // output to same pkg as input
+				PkgDir:        pkg.Dir,  // output to same pkg as input
+				HeaderComment: boilerplate,
+				GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+					return []generator.Generator{
+						&registerExternalGenerator{
+							GoGenerator: generator.GoGenerator{
+								OutputFilename: args.OutputFile,
+							},
+							gv:              gv,
+							typesToGenerate: typesToRegister,
+							outputPackage:   pkg.Path,
+							imports:         generator.NewImportTrackerForPackage(pkg.Path),
+						},
+					}
+				},
+			})
+	}
+
+	return targetList
+}
+
+// isRegisterGenTarget reports whether pkg has opted in to register-gen.
+// Activation rules are encoded in apidefinitions.Register's Spec
+// (Boolean ActivationTag with a +groupName= fallback).
+func isRegisterGenTarget(pkg *types.Package, idOpts []apidefinitions.Option) bool {
+	info, err := apidefinitions.Identify(pkg, apidefinitions.Register, idOpts...)
+	if err != nil {
+		klog.Fatal(err)
+	}
+	return info.ShouldGenerate()
+}
+
+// isInternal determines whether the given package
+// contains the internal types or not
+func isInternal(p *types.Package) (bool, error) {
+	for _, t := range p.Types {
+		for _, member := range t.Members {
+			if member.Name == "TypeMeta" {
+				return !strings.Contains(member.Tags, "json"), nil
+			}
+		}
+	}
+	return false, fmt.Errorf("unable to find TypeMeta for any types in package %s", p.Path)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/generators/targets_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/generators/targets_test.go
new file mode 100644
index 0000000000..e3febf5eb0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/generators/targets_test.go
@@ -0,0 +1,229 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package generators
+
+import (
+	"os"
+	"path/filepath"
+	"sort"
+	"testing"
+
+	"k8s.io/code-generator/cmd/register-gen/args"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/types"
+)
+
+func TestGetTargets(t *testing.T) {
+	type pkgSpec struct {
+		path     string
+		dir      string // optional; will use t.TempDir() if needRegisterFile
+		comments []string
+		// typeMembers describes a single struct type in the package. nil means no types.
+		typeMembers []types.Member
+		// needRegisterFile, when true, creates dir/register.go before invoking GetTargets.
+		needRegisterFile bool
+	}
+
+	externalTypeMeta := []types.Member{
+		{Name: "TypeMeta", Embedded: true, Tags: `json:",inline"`},
+	}
+	internalTypeMeta := []types.Member{
+		{Name: "TypeMeta", Embedded: true},
+	}
+
+	cases := []struct {
+		name        string
+		pkgs        []pkgSpec
+		wantPaths   []string          // package paths expected in returned targets, sorted
+		wantGroups  map[string]string // pkgPath -> expected group
+		wantHasType map[string]bool   // pkgPath -> whether typesToGenerate is non-empty
+	}{
+		{
+			name: "external pkg with +groupName activates",
+			pkgs: []pkgSpec{{
+				path:        "k8s.io/api/foo/v1",
+				comments:    []string{"+groupName=foo.k8s.io"},
+				typeMembers: externalTypeMeta,
+			}},
+			wantPaths:   []string{"k8s.io/api/foo/v1"},
+			wantGroups:  map[string]string{"k8s.io/api/foo/v1": "foo.k8s.io"},
+			wantHasType: map[string]bool{"k8s.io/api/foo/v1": true},
+		},
+		{
+			name: "external pkg with +k8s:register-gen=false is opted out",
+			pkgs: []pkgSpec{{
+				path:        "k8s.io/api/foo/v1",
+				comments:    []string{"+k8s:register-gen=false"},
+				typeMembers: externalTypeMeta,
+			}},
+			wantPaths: nil,
+		},
+		{
+			name: "opt-out wins over +groupName",
+			pkgs: []pkgSpec{{
+				path:        "k8s.io/api/foo/v1",
+				comments:    []string{"+groupName=foo.k8s.io", "+k8s:register-gen=false"},
+				typeMembers: externalTypeMeta,
+			}},
+			wantPaths: nil,
+		},
+		{
+			name: "no +groupName and no +k8s:register-gen tag is skipped",
+			pkgs: []pkgSpec{{
+				path:        "k8s.io/api/foo/v1",
+				typeMembers: externalTypeMeta,
+			}},
+			wantPaths: nil,
+		},
+		{
+			// isInternal returns an error when the package has no TypeMeta-
+			// bearing types at all, and GetTargets treats that error as a skip.
+			name: "+groupName but no TypeMeta types is skipped (isInternal errors)",
+			pkgs: []pkgSpec{{
+				path:     "k8s.io/api/foo/v1",
+				comments: []string{"+groupName=foo.k8s.io"},
+			}},
+			wantPaths: nil,
+		},
+		{
+			name: "internal pkg (TypeMeta without json tag) is skipped",
+			pkgs: []pkgSpec{{
+				path:        "k8s.io/api/foo/v1",
+				comments:    []string{"+groupName=foo"},
+				typeMembers: internalTypeMeta,
+			}},
+			wantPaths: nil,
+		},
+		{
+			name: "pkg with existing register.go is skipped",
+			pkgs: []pkgSpec{{
+				path:             "k8s.io/api/foo/v1",
+				comments:         []string{"+groupName=foo.k8s.io"},
+				typeMembers:      externalTypeMeta,
+				needRegisterFile: true,
+			}},
+			wantPaths: nil,
+		},
+		// Ecosystem regression: a third-party generator's tag in the same
+		// doc.go must NOT cause register-gen to fail. The +groupName= still
+		// activates as expected.
+		{
+			name: "foreign third-party generator tag is ignored",
+			pkgs: []pkgSpec{{
+				path: "k8s.io/api/foo/v1",
+				comments: []string{
+					"+k8s:my-custom-gen=value",
+					"+groupName=foo.k8s.io",
+				},
+				typeMembers: externalTypeMeta,
+			}},
+			wantPaths:   []string{"k8s.io/api/foo/v1"},
+			wantGroups:  map[string]string{"k8s.io/api/foo/v1": "foo.k8s.io"},
+			wantHasType: map[string]bool{"k8s.io/api/foo/v1": true},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			universe := types.Universe{}
+			ctx := &generator.Context{
+				Universe: universe,
+			}
+			for i, ps := range tc.pkgs {
+				dir := ps.dir
+				if dir == "" {
+					dir = t.TempDir()
+				}
+				if ps.needRegisterFile {
+					f, err := os.Create(filepath.Join(dir, "register.go"))
+					if err != nil {
+						t.Fatalf("creating register.go for pkg[%d]: %v", i, err)
+					}
+					if err := f.Close(); err != nil {
+						t.Fatalf("closing register.go for pkg[%d]: %v", i, err)
+					}
+				}
+				p := universe.Package(ps.path)
+				p.Name = filepath.Base(ps.path)
+				p.Dir = dir
+				p.Comments = ps.comments
+				if ps.typeMembers != nil {
+					p.Types["MyType"] = &types.Type{
+						Name:    types.Name{Package: ps.path, Name: "MyType"},
+						Kind:    types.Struct,
+						Members: ps.typeMembers,
+					}
+				}
+				ctx.Inputs = append(ctx.Inputs, ps.path)
+			}
+
+			a := &args.Args{OutputFile: "zz_generated.register.go"}
+			got := GetTargets(ctx, a)
+
+			gotPaths := make([]string, 0, len(got))
+			for _, g := range got {
+				gotPaths = append(gotPaths, g.Path())
+			}
+			sort.Strings(gotPaths)
+			wantPaths := append([]string(nil), tc.wantPaths...)
+			sort.Strings(wantPaths)
+			if !equalStrSlice(gotPaths, wantPaths) {
+				t.Fatalf("target paths: got %v, want %v", gotPaths, wantPaths)
+			}
+
+			// Verify per-package group and typesToGenerate by exercising the
+			// generator function the SimpleTarget would run.
+			for _, tgt := range got {
+				st, ok := tgt.(*generator.SimpleTarget)
+				if !ok {
+					t.Fatalf("%s: target is %T, want *generator.SimpleTarget", tgt.Path(), tgt)
+				}
+				gens := st.GeneratorsFunc(ctx)
+				if len(gens) != 1 {
+					t.Fatalf("%s: got %d generators, want 1", tgt.Path(), len(gens))
+				}
+				rg, ok := gens[0].(*registerExternalGenerator)
+				if !ok {
+					t.Fatalf("%s: generator is %T, want *registerExternalGenerator", tgt.Path(), gens[0])
+				}
+				if want, ok := tc.wantGroups[tgt.Path()]; ok {
+					if string(rg.gv.Group) != want {
+						t.Errorf("%s: group = %q, want %q", tgt.Path(), rg.gv.Group, want)
+					}
+				}
+				if want, ok := tc.wantHasType[tgt.Path()]; ok {
+					hasType := len(rg.typesToGenerate) > 0
+					if hasType != want {
+						t.Errorf("%s: hasType = %v, want %v (typesToGenerate=%v)", tgt.Path(), hasType, want, rg.typesToGenerate)
+					}
+				}
+			}
+		})
+	}
+}
+
+func equalStrSlice(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/main.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/main.go
new file mode 100644
index 0000000000..ac28f87fb7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/main.go
@@ -0,0 +1,56 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"flag"
+
+	"github.com/spf13/pflag"
+	"k8s.io/code-generator/cmd/register-gen/args"
+	"k8s.io/code-generator/cmd/register-gen/generators"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/klog/v2"
+)
+
+func main() {
+	klog.InitFlags(nil)
+	args := args.New()
+	args.AddFlags(pflag.CommandLine)
+	flag.Set("logtostderr", "true")
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+
+	pflag.Parse()
+	if err := args.Validate(); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+
+	myTargets := func(context *generator.Context) []generator.Target {
+		return generators.GetTargets(context, args)
+	}
+
+	if err := gengo.Execute(
+		generators.NameSystems(),
+		generators.DefaultNameSystem(),
+		myTargets,
+		gengo.StdBuildTag,
+		pflag.Args(),
+	); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+	klog.V(2).Info("Completed successfully.")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/output_tests/generate.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/output_tests/generate.go
new file mode 100644
index 0000000000..efbf7791a5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/output_tests/generate.go
@@ -0,0 +1,20 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+//go:generate go run k8s.io/code-generator/cmd/register-gen --output-file zz_generated.register.go --go-header-file=../../../examples/hack/boilerplate.go.txt k8s.io/code-generator/cmd/register-gen/output_tests/...
+package outputtests
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/output_tests/simpletype/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/output_tests/simpletype/v1/doc.go
new file mode 100644
index 0000000000..6c1622a73b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/output_tests/simpletype/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:register-gen=simpletype
+// +k8s:deepcopy-gen=false
+
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/output_tests/simpletype/v1/fake_deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/output_tests/simpletype/v1/fake_deepcopy.go
new file mode 100644
index 0000000000..c35312d268
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/output_tests/simpletype/v1/fake_deepcopy.go
@@ -0,0 +1,44 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SimpleType) DeepCopyInto(out *SimpleType) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Inner.
+func (in *SimpleType) DeepCopy() *SimpleType {
+	if in == nil {
+		return nil
+	}
+	out := new(SimpleType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *SimpleType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/output_tests/simpletype/v1/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/output_tests/simpletype/v1/types.go
new file mode 100644
index 0000000000..53d28cc5c8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/output_tests/simpletype/v1/types.go
@@ -0,0 +1,25 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type SimpleType struct {
+	metav1.TypeMeta `json:""`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/output_tests/simpletype/v1/zz_generated.register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/output_tests/simpletype/v1/zz_generated.register.go
new file mode 100644
index 0000000000..f4fdd30b6a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/register-gen/output_tests/simpletype/v1/zz_generated.register.go
@@ -0,0 +1,70 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by register-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName specifies the group name used to register the objects.
+const GroupName = "simpletype"
+
+// GroupVersion specifies the group and the version used to register the objects.
+var GroupVersion = metav1.GroupVersion{Group: GroupName, Version: "v1"}
+
+// SchemeGroupVersion is group version used to register these objects
+//
+// Deprecated: use GroupVersion instead.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	// Deprecated: use Install instead
+	AddToScheme = localSchemeBuilder.AddToScheme
+	Install     = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&SimpleType{},
+	)
+	// AddToGroupVersion allows the serialization of client types like ListOptions.
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/lint.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/lint.go
new file mode 100644
index 0000000000..63e54e755e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/lint.go
@@ -0,0 +1,157 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"sort"
+
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/klog/v2"
+)
+
+// linter is a struct that holds the state of the linting process.
+// It contains a map of types that have been linted, a list of linting rules,
+// and a list of errors that occurred during the linting process.
+type linter struct {
+	linted map[*types.Type]bool
+	rules  []lintRule
+	// lintErrors is all the errors, grouped by type, that occurred during the
+	// linting process.
+	lintErrors map[*types.Type][]error
+}
+
+// lintRule is a function that validates a slice of comments.
+// container is the type containing the element being linted (e.g. the Struct when linting a Field).
+// It may be nil if the element is top-level (e.g. a Type definition).
+// t is the type of the element being linted (e.g. the Field's type, or the Type itself).
+// It returns a string as an error message if the comments are invalid,
+// and an error there is an error happened during the linting process.
+type lintRule func(container *types.Type, t *types.Type, tags []codetags.Tag) (string, error)
+
+func (l *linter) AddError(t *types.Type, field, msg string) {
+	var err error
+	if field == "" {
+		err = fmt.Errorf("%s", msg)
+	} else {
+		err = fmt.Errorf("field %s: %s", field, msg)
+	}
+	l.lintErrors[t] = append(l.lintErrors[t], err)
+}
+
+func newLinter(rules ...lintRule) *linter {
+	if len(rules) == 0 {
+		klog.Errorf("rules are not passed to the linter")
+	}
+	return &linter{
+		linted:     make(map[*types.Type]bool),
+		rules:      rules,
+		lintErrors: map[*types.Type][]error{},
+	}
+}
+
+func (l *linter) lintType(t *types.Type) error {
+	if _, ok := l.linted[t]; ok {
+		return nil
+	}
+	l.linted[t] = true
+
+	if t.CommentLines != nil {
+		extracted := codetags.Extract("+", t.CommentLines)
+		if _, ok := extracted["k8s:validation-gen-nolint"]; ok {
+			return nil
+		}
+		klog.V(5).Infof("linting type %s", t.Name.String())
+		lintErrs, err := l.lintComments(t, t, t.CommentLines)
+		if err != nil {
+			return err
+		}
+		for _, lintErr := range lintErrs {
+			l.AddError(t, "", lintErr)
+		}
+	}
+	switch t.Kind {
+	case types.Alias:
+		// Recursively lint the underlying type of the alias.
+		if err := l.lintType(t.Underlying); err != nil {
+			return err
+		}
+	case types.Struct:
+		// Recursively lint each member of the struct.
+		for _, member := range t.Members {
+			klog.V(5).Infof("linting comments for field %s of type %s", member.String(), t.Name.String())
+			lintErrs, err := l.lintComments(t, member.Type, member.CommentLines)
+			if err != nil {
+				return err
+			}
+			for _, lintErr := range lintErrs {
+				l.AddError(t, member.Name, lintErr)
+			}
+			if err := l.lintType(member.Type); err != nil {
+				return err
+			}
+		}
+	case types.Slice, types.Array, types.Pointer:
+		// Recursively lint the element type of the slice or array.
+		if err := l.lintType(t.Elem); err != nil {
+			return err
+		}
+	case types.Map:
+		// Recursively lint the key and element types of the map.
+		if err := l.lintType(t.Key); err != nil {
+			return err
+		}
+		if err := l.lintType(t.Elem); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// lintComments runs all registered rules on a slice of comments.
+func (l *linter) lintComments(container *types.Type, t *types.Type, comments []string) ([]string, error) {
+	var lintErrs []string
+	var tags []codetags.Tag
+
+	extracted := codetags.Extract("+", comments)
+	keys := make([]string, 0, len(extracted))
+	for k := range extracted {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+
+	for _, tagName := range keys {
+		lines := extracted[tagName]
+		t, err := codetags.ParseAll(lines)
+		if err != nil {
+			// If parsing fails, it means it is not a valid tag.
+			continue
+		}
+		tags = append(tags, t...)
+	}
+
+	for _, rule := range l.rules {
+		if msg, err := rule(container, t, tags); err != nil {
+			return nil, err
+		} else if msg != "" {
+			lintErrs = append(lintErrs, msg)
+		}
+	}
+
+	return lintErrs, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/lint_rules.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/lint_rules.go
new file mode 100644
index 0000000000..7320369498
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/lint_rules.go
@@ -0,0 +1,379 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"fmt"
+	"path"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/code-generator/cmd/validation-gen/validators"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+func checkAlphaBetaUsage(tag codetags.Tag, isRoot bool) (string, error) {
+	if tag.Name == "k8s:alpha" || tag.Name == "k8s:beta" {
+		if !isRoot {
+			return fmt.Sprintf("tag %q can't be used in between", tag.Name), nil
+		}
+		if tag.ValueTag == nil {
+			return fmt.Sprintf("tag %q requires a validation tag as its value payload", tag.Name), nil
+		}
+	}
+
+	if tag.ValueTag != nil {
+		return checkAlphaBetaUsage(*tag.ValueTag, false)
+	}
+	return "", nil
+}
+
+// alphaBetaPrefix enforces that +k8s:alpha and +k8s:beta tags are always used as prefix to
+func alphaBetaPrefix() lintRule {
+	return func(container *types.Type, t *types.Type, tags []codetags.Tag) (string, error) {
+		for _, tag := range tags {
+			// Only check alpha/beta tags or validation tags.
+			if msg, err := checkAlphaBetaUsage(tag, true); err != nil || msg != "" {
+				return msg, err
+			}
+		}
+		return "", nil
+	}
+}
+
+// checkTagStability recursively checks that a tag and its nested tags
+// satisfy the stability requirements of the context.
+func checkTagStability(tag codetags.Tag, contextLevel validators.TagStabilityLevel) (string, error) {
+	tagStability, err := validators.GetStability(tag.Name)
+	// all DV tags have stability, if a tag doesn't have stability then it is not a valid DV tag.
+	if err != nil {
+		return "", nil
+	}
+	cmpOrder, err := tagStability.Compare(contextLevel)
+	if err != nil {
+		return "", err
+	}
+	if cmpOrder < 0 {
+		return fmt.Sprintf("tag %q with stability level %q cannot be used in %s validation", tag.Name, tagStability, contextLevel), nil
+	}
+	if tag.ValueTag != nil {
+		return checkTagStability(*tag.ValueTag, contextLevel)
+	}
+	return "", nil
+}
+
+// validationStability enforces stability level constraints on tags.
+func validationStability() lintRule {
+	return func(container *types.Type, t *types.Type, tags []codetags.Tag) (string, error) {
+		pkgPath := t.Name.Package
+		if container != nil {
+			pkgPath = container.Name.Package
+		}
+
+		// Unprefixed validations are normally required to be Stable.
+		// In Alpha packages, we allow Alpha-level and Beta-level validations
+		// without a prefix. In Beta packages, we allow Beta-level validations
+		// without a prefix.
+		defaultContextLevel := validators.TagStabilityLevelStable
+		// APIVersion is the last element of the package path.
+		apiVersion := path.Base(pkgPath)
+		if strings.Contains(apiVersion, "alpha") {
+			defaultContextLevel = validators.TagStabilityLevelAlpha
+		} else if strings.Contains(apiVersion, "beta") {
+			defaultContextLevel = validators.TagStabilityLevelBeta
+		}
+
+		for _, tag := range tags {
+			contextLevel := defaultContextLevel
+			tagToCheck := tag
+
+			// For stability level tags, set the stability context for the inner validation,
+			// overriding the package-level default.
+			if tag.Name == "k8s:alpha" || tag.Name == "k8s:beta" {
+				if tag.Name == "k8s:alpha" {
+					contextLevel = validators.TagStabilityLevelAlpha
+				} else {
+					contextLevel = validators.TagStabilityLevelBeta
+				}
+				if tag.ValueTag == nil {
+					continue
+				}
+				tagToCheck = *tag.ValueTag
+			}
+
+			// For feature gate tags, we allow developers to use nested beta validation tags
+			// without forcing validation authors to write redundant handwritten code (bypassing the
+			// declarative validation equivalence check), we automatically relax the stability
+			// context to Beta if the current context is Stable.
+			if tagToCheck.Name == "k8s:ifEnabled" || tagToCheck.Name == "k8s:ifDisabled" {
+				if contextLevel == validators.TagStabilityLevelStable {
+					contextLevel = validators.TagStabilityLevelBeta
+				}
+			}
+
+			msg, err := checkTagStability(tagToCheck, contextLevel)
+			if err != nil {
+				return "", err
+			}
+			if msg != "" {
+				return msg, nil
+			}
+		}
+		return "", nil
+	}
+}
+
+// hasTag recursively checks if a tag with given name exists in the tag tree.
+func hasTag(tags []codetags.Tag, name string) bool {
+	for _, tag := range tags {
+		if tag.Name == name {
+			return true
+		}
+		// Also check conditional tags value
+		if tag.ValueTag != nil && hasTag([]codetags.Tag{*tag.ValueTag}, name) {
+			return true
+		}
+	}
+	return false
+}
+
+// hasRequirednessTag returns true if tags contain +k8s:optional, +k8s:required, or +k8s:forbidden.
+func hasRequirednessTag(tags []codetags.Tag) bool {
+	return hasTag(tags, "k8s:optional") || hasTag(tags, "k8s:required") || hasTag(tags, "k8s:forbidden")
+}
+
+// hasNonOpaqueValidationTag returns true if tags contain any registered validation tag that is not opaqueType.
+func hasNonOpaqueValidationTag(extractor validators.ValidationExtractor, chainTags sets.Set[string], tags []codetags.Tag) bool {
+	for _, tag := range tags {
+		if tag.Name == "k8s:optional" || tag.Name == "k8s:opaqueType" {
+			continue
+		}
+		if chainTags.Has(tag.Name) {
+			if tag.ValueTag != nil && hasNonOpaqueValidationTag(extractor, chainTags, []codetags.Tag{*tag.ValueTag}) {
+				return true
+			}
+			continue
+		}
+		// Check if it's a known validation tag.
+		if extractor.IsKnownTag(tag.Name) {
+			return true
+		}
+	}
+	return false
+}
+
+// requiredAndOptional checks that fields (pointers, slices, maps, arrays) with validation
+// (either direct or transitive) explicitly declare +k8s:optional or +k8s:required.
+func requiredAndOptional(extractor validators.ValidationExtractor) lintRule {
+	chainTags := sets.New[string]()
+	for _, doc := range extractor.Docs() {
+		if doc.PayloadsType == codetags.ValueTypeTag {
+			chainTags.Insert(doc.Tag)
+		}
+	}
+
+	type opacity struct {
+		typ, key, val bool
+	}
+
+	filterTags := func(tags []codetags.Tag) []codetags.Tag {
+		var filtered []codetags.Tag
+		for _, tag := range tags {
+			if extractor.IsKnownTag(tag.Name) {
+				filtered = append(filtered, tag)
+			}
+		}
+		return filtered
+	}
+
+	type cacheKey struct {
+		t  *types.Type
+		op opacity
+	}
+	hasValidation := make(map[cacheKey]*bool)
+
+	// returns hasValidation, hasCycle, error
+	var hasTransitiveValidation func(t *types.Type, op opacity) (bool, bool, error)
+	hasTransitiveValidation = func(t *types.Type, op opacity) (bool, bool, error) {
+		if op.typ {
+			return false, false, nil
+		}
+
+		ck := cacheKey{t, op}
+		visitedVal, visited := hasValidation[ck]
+		if visited {
+			if visitedVal == nil {
+				return false, true, nil // cycle detected
+			}
+			return *visitedVal, false, nil
+		}
+		hasValidation[ck] = nil
+
+		tTags, err := extractor.ExtractTags(validators.Context{Scope: validators.ScopeType, Type: t}, t.CommentLines)
+		if err != nil {
+			return false, false, err
+		}
+
+		typeVals, err := extractor.ExtractValidations(
+			validators.Context{Scope: validators.ScopeType, Type: t},
+			filterTags(tTags)...,
+		)
+		if err != nil {
+			return false, false, err
+		}
+
+		op.typ = op.typ || typeVals.OpaqueType
+		op.key = op.key || typeVals.OpaqueKeyType
+		op.val = op.val || typeVals.OpaqueValType
+
+		if op.typ {
+			hasVal := false
+			hasValidation[ck] = &hasVal
+			return false, false, nil
+		}
+
+		if typeVals.HasEmitable() {
+			hasVal := true
+			hasValidation[ck] = &hasVal
+			return true, false, nil
+		}
+
+		var hasVal, cycleBroken bool
+		switch t.Kind {
+		case types.Alias:
+			hasVal, cycleBroken, err = hasTransitiveValidation(t.Underlying, op)
+		case types.Slice, types.Array:
+			hasVal, cycleBroken, err = hasTransitiveValidation(t.Elem, opacity{typ: op.val})
+		case types.Map:
+			kVal, cbKey, err := hasTransitiveValidation(t.Key, opacity{typ: op.key})
+			if err != nil {
+				return false, false, err
+			}
+			eVal, cbVal, err := hasTransitiveValidation(t.Elem, opacity{typ: op.val})
+			if err != nil {
+				return false, false, err
+			}
+			hasVal = kVal || eVal
+			cycleBroken = cbKey || cbVal
+		case types.Pointer:
+			hasVal, cycleBroken, err = hasTransitiveValidation(t.Elem, op)
+		case types.Struct:
+			for _, m := range t.Members {
+				mTags, err := extractor.ExtractTags(validators.Context{Scope: validators.ScopeField, Type: m.Type}, m.CommentLines)
+				if err != nil {
+					return false, false, err
+				}
+				if hasNonOpaqueValidationTag(extractor, chainTags, mTags) {
+					hasVal = true
+					break
+				}
+				fieldVals, err := extractor.ExtractValidations(
+					validators.Context{Scope: validators.ScopeField, Type: m.Type},
+					filterTags(mTags)...,
+				)
+				if err != nil {
+					return false, false, err
+				}
+				mOp := opacity{
+					typ: op.typ || fieldVals.OpaqueType,
+					key: op.key || fieldVals.OpaqueKeyType,
+					val: op.val || fieldVals.OpaqueValType,
+				}
+				hv, cb, err := hasTransitiveValidation(m.Type, mOp)
+				if err != nil {
+					return false, false, err
+				}
+				cycleBroken = cycleBroken || cb
+				if hv {
+					hasVal = true
+					break
+				}
+			}
+		}
+
+		if err != nil {
+			return false, false, err
+		}
+
+		if !cycleBroken {
+			hasValidation[ck] = &hasVal
+		} else {
+			delete(hasValidation, ck)
+		}
+		return hasVal, cycleBroken, nil
+	}
+
+	return func(container *types.Type, t *types.Type, tags []codetags.Tag) (string, error) {
+		// We only care about fields in a struct. Skip if linting the struct itself.
+		if container == nil || container.Kind != types.Struct || container == t {
+			return "", nil
+		}
+
+		// Skip non-pointer structs (and aliases to them) as they don't support requiredness tags.
+		underlying := t
+		for underlying.Kind == types.Alias {
+			underlying = underlying.Underlying
+		}
+		if underlying.Kind == types.Struct {
+			return "", nil
+		}
+
+		// Check if already has requiredness tag
+		if hasRequirednessTag(tags) {
+			return "", nil
+		}
+
+		// Check if it has validation (direct or active transitive)
+		if hasNonOpaqueValidationTag(extractor, chainTags, tags) {
+			return "field with validation must have +k8s:optional, +k8s:required or +k8s:forbidden", nil
+		}
+
+		fieldVals, err := extractor.ExtractValidations(
+			validators.Context{Scope: validators.ScopeField, Type: t},
+			filterTags(tags)...,
+		)
+		if err != nil {
+			return fmt.Sprintf("invalid validation tags: %v", err), nil
+		}
+
+		topOp := opacity{
+			typ: fieldVals.OpaqueType,
+			key: fieldVals.OpaqueKeyType,
+			val: fieldVals.OpaqueValType,
+		}
+
+		hasTransitiveVal, _, err := hasTransitiveValidation(t, topOp)
+		if err != nil {
+			return fmt.Sprintf("invalid validation tags: %v", err), nil
+		}
+
+		if hasTransitiveVal {
+			return "field with validation must have +k8s:optional, +k8s:required or +k8s:forbidden", nil
+		}
+
+		return "", nil
+	}
+}
+
+func lintRules(extractor validators.ValidationExtractor) []lintRule {
+	return []lintRule{
+		alphaBetaPrefix(),
+		validationStability(),
+		requiredAndOptional(extractor),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/lint_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/lint_test.go
new file mode 100644
index 0000000000..77d8dd941c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/lint_test.go
@@ -0,0 +1,1022 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"errors"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/code-generator/cmd/validation-gen/validators"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/types"
+)
+
+func ruleAlwaysPass(container *types.Type, t *types.Type, tags []codetags.Tag) (string, error) {
+	return "", nil
+}
+
+func ruleAlwaysFail(container *types.Type, t *types.Type, tags []codetags.Tag) (string, error) {
+	return "lintfail", nil
+}
+
+func ruleAlwaysErr(container *types.Type, t *types.Type, tags []codetags.Tag) (string, error) {
+	return "", errors.New("linterr")
+}
+
+func mkCountRule(counter *int, realRule lintRule) lintRule {
+	return func(container *types.Type, t *types.Type, tags []codetags.Tag) (string, error) {
+		(*counter)++
+		return realRule(container, t, tags)
+	}
+}
+
+var validator = validators.InitGlobalValidator(&generator.Context{}, nil)
+
+func TestLintCommentsRuleInvocation(t *testing.T) {
+	tests := []struct {
+		name              string
+		rules             []lintRule
+		commentLineGroups [][]string
+		wantErr           bool
+		wantCount         int
+	}{
+		{
+			name:              "0 rules, 0 comments",
+			rules:             []lintRule{},
+			commentLineGroups: [][]string{},
+			wantErr:           false,
+			wantCount:         0,
+		},
+		{
+			name:              "1 rule, 1 comment",
+			rules:             []lintRule{ruleAlwaysPass},
+			commentLineGroups: [][]string{{"comment"}},
+			wantErr:           false,
+			wantCount:         1,
+		},
+		{
+			name:              "3 rules, 3 comments",
+			rules:             []lintRule{ruleAlwaysPass, ruleAlwaysFail, ruleAlwaysErr},
+			commentLineGroups: [][]string{{"comment1"}, {"comment2"}, {"comment3"}},
+			wantErr:           true,
+			wantCount:         9,
+		},
+		{
+			name:              "1 rule, 1 comment, rule fails",
+			rules:             []lintRule{ruleAlwaysFail},
+			commentLineGroups: [][]string{{"comment"}},
+			wantErr:           false,
+			wantCount:         1,
+		},
+		{
+			name:              "1 rule, 1 comment, rule errors",
+			rules:             []lintRule{ruleAlwaysErr},
+			commentLineGroups: [][]string{{"comment"}},
+			wantErr:           true,
+			wantCount:         1,
+		},
+		{
+			name:              "3 rules, 1 comment, rule errors in the middle",
+			rules:             []lintRule{ruleAlwaysPass, ruleAlwaysErr, ruleAlwaysFail},
+			commentLineGroups: [][]string{{"comment"}},
+			wantErr:           true,
+			wantCount:         2,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			counter := 0
+			rules := make([]lintRule, len(tt.rules))
+			for i, rule := range tt.rules {
+				rules[i] = mkCountRule(&counter, rule)
+			}
+			l := newLinter(rules...)
+			for _, commentLines := range tt.commentLineGroups {
+				_, err := l.lintComments(nil, nil, commentLines)
+				gotErr := err != nil
+				if gotErr != tt.wantErr {
+					t.Errorf("lintComments() error = %v, wantErr %v", err, tt.wantErr)
+				}
+			}
+			if counter != tt.wantCount {
+				t.Errorf("expected %d rule invocations, got %d", tt.wantCount, counter)
+			}
+		})
+	}
+}
+
+func TestRuleAlphaBetaPrefix(t *testing.T) {
+	tests := []struct {
+		name     string
+		comments []string
+		wantMsg  string
+	}{
+		{
+			name:     "valid alpha prefix",
+			comments: []string{"+k8s:alpha=+k8s:required"},
+			wantMsg:  "",
+		},
+		{
+			name:     "valid beta prefix",
+			comments: []string{"+k8s:beta=+k8s:required"},
+			wantMsg:  "",
+		},
+		{
+			name:     "invalid alpha prefix (no value)",
+			comments: []string{"+k8s:alpha"},
+			wantMsg:  `tag "k8s:alpha" requires a validation tag as its value payload`,
+		},
+		{
+			name:     "invalid beta prefix (no value)",
+			comments: []string{"+k8s:beta"},
+			wantMsg:  `tag "k8s:beta" requires a validation tag as its value payload`,
+		},
+		{
+			name:     "invalid alpha prefix (value not tag)",
+			comments: []string{"+k8s:alpha=foo"},
+			wantMsg:  `tag "k8s:alpha" requires a validation tag as its value payload`,
+		},
+		{
+			name:     "invalid usage of alpha prefix",
+			comments: []string{`+k8s:item(type: "Approved")=+k8s:alpha=+k8s:zeroOrOneOfMember`},
+			wantMsg:  `tag "k8s:alpha" can't be used in between`,
+		},
+		{
+			name:     "nested alpha in item",
+			comments: []string{`+k8s:item=+k8s:alpha=+k8s:required`},
+			wantMsg:  `tag "k8s:alpha" can't be used in between`,
+		},
+		{
+			name:     "alpha nested in listType",
+			comments: []string{`+k8s:listType=+k8s:alpha=+k8s:required`},
+			wantMsg:  `tag "k8s:alpha" can't be used in between`,
+		},
+		{
+			name:     "deeply nested alpha",
+			comments: []string{`+k8s:item=+k8s:listType=+k8s:alpha=+k8s:required`},
+			wantMsg:  `tag "k8s:alpha" can't be used in between`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tags, _ := validator.ExtractTags(validators.Context{}, tt.comments)
+			msg, err := alphaBetaPrefix()(nil, nil, tags)
+			if err != nil {
+				t.Errorf("unexpected error: %v", err)
+			} else if msg != tt.wantMsg {
+				t.Errorf("got %q, want %q", msg, tt.wantMsg)
+			}
+		})
+	}
+}
+
+func TestRuleStability(t *testing.T) {
+	tests := []struct {
+		name     string
+		comments []string
+		pkg      string
+		wantMsg  string
+	}{
+		{
+			name:     "stable context, stable tag",
+			comments: []string{"+k8s:required"}, // Stable
+			wantMsg:  "",
+		},
+		{
+			name:     "beta context, stable tag",
+			comments: []string{"+k8s:beta=+k8s:required"}, // Beta context, Stable tag
+			wantMsg:  "",
+		},
+		{
+			name:     "alpha context, stable tag",
+			comments: []string{"+k8s:alpha=+k8s:required"}, // Alpha context, Stable tag
+			wantMsg:  "",
+		},
+		{
+			name:     "alpha context, alpha tag",
+			comments: []string{"+k8s:alpha=+k8s:validateTrueAlpha"}, // Alpha context, Alpha tag
+			wantMsg:  "",
+		},
+		{
+			name:     "stable context, alpha tag",
+			comments: []string{"+k8s:validateTrueAlpha"}, // Stable context, Alpha tag
+			wantMsg:  `tag "k8s:validateTrueAlpha" with stability level "Alpha" cannot be used in Stable validation`,
+		},
+		{
+			name:     "beta context, alpha tag",
+			comments: []string{"+k8s:beta=+k8s:validateTrueAlpha"}, // Beta context, Alpha tag
+			wantMsg:  `tag "k8s:validateTrueAlpha" with stability level "Alpha" cannot be used in Beta validation`,
+		},
+		{
+			name:     "alpha pkg context, beta tag (allowed)",
+			comments: []string{"+k8s:validateTrueBeta"}, // Beta tag in Alpha package
+			pkg:      "k8s.io/api/apps/v1alpha1",
+			wantMsg:  "",
+		},
+		{
+			name:     "alpha pkg context, alpha tag (allowed)",
+			comments: []string{"+k8s:validateTrueAlpha"}, // Alpha tag in Alpha package
+			pkg:      "k8s.io/api/apps/v1alpha1",
+			wantMsg:  "",
+		},
+		{
+			name:     "beta pkg context, beta tag (allowed)",
+			comments: []string{"+k8s:validateTrueBeta"}, // Beta tag in Beta package
+			pkg:      "k8s.io/api/apps/v1beta1",
+			wantMsg:  "",
+		},
+		{
+			name:     "beta pkg context, alpha tag (fails)",
+			comments: []string{"+k8s:validateTrueAlpha"}, // Alpha tag in Beta package
+			pkg:      "k8s.io/api/apps/v1beta1",
+			wantMsg:  `tag "k8s:validateTrueAlpha" with stability level "Alpha" cannot be used in Beta validation`,
+		},
+		{
+			name:     "ifEnabled context allows beta tag",
+			comments: []string{"+k8s:ifEnabled(SomeFeature)=+k8s:validateTrueBeta"}, // Beta tag in ifEnabled
+			wantMsg:  "",
+		},
+		{
+			name:     "ifEnabled context fails alpha tag",
+			comments: []string{"+k8s:ifEnabled(SomeFeature)=+k8s:validateTrueAlpha"}, // Alpha tag in ifEnabled
+			wantMsg:  `tag "k8s:validateTrueAlpha" with stability level "Alpha" cannot be used in Beta validation`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dummyType := &types.Type{Name: types.Name{Package: tt.pkg, Name: "Dummy"}}
+			rule := validationStability()
+			tags, _ := validator.ExtractTags(validators.Context{}, tt.comments)
+			msg, err := rule(nil, dummyType, tags)
+			if err != nil {
+				t.Errorf("unexpected error: %v", err)
+			} else if msg != tt.wantMsg {
+				t.Errorf("got %q, want %q", msg, tt.wantMsg)
+			}
+		})
+	}
+}
+
+func TestLintType(t *testing.T) {
+	tests := []struct {
+		name        string
+		typeToLint  *types.Type
+		wantCount   int
+		expectError bool
+	}{
+		{
+			name: "No comments",
+			typeToLint: &types.Type{
+				Name:         types.Name{Package: "testpkg", Name: "TestType"},
+				CommentLines: nil,
+			},
+			wantCount:   0,
+			expectError: false,
+		},
+		{
+			name: "Valid comments",
+			typeToLint: &types.Type{
+				Name:         types.Name{Package: "testpkg", Name: "TestType"},
+				CommentLines: []string{"+k8s:optional"},
+			},
+			wantCount:   1,
+			expectError: false,
+		},
+		{
+			name: "Pointer type",
+			typeToLint: &types.Type{
+				Name:         types.Name{Package: "testpkg", Name: "TestPointer"},
+				Kind:         types.Pointer,
+				Elem:         &types.Type{Name: types.Name{Package: "testpkg", Name: "ElemType"}, CommentLines: []string{"+k8s:optional"}},
+				CommentLines: []string{"+k8s:optional"},
+			},
+			wantCount:   2,
+			expectError: false,
+		},
+		{
+			name: "Slice of pointers",
+			typeToLint: &types.Type{
+				Name: types.Name{Package: "testpkg", Name: "TestSlice"},
+				Kind: types.Slice,
+				Elem: &types.Type{
+					Name:         types.Name{Package: "testpkg", Name: "PointerElem"},
+					Kind:         types.Pointer,
+					Elem:         &types.Type{Name: types.Name{Package: "testpkg", Name: "ElemType"}, CommentLines: []string{"+k8s:optional"}},
+					CommentLines: []string{"+k8s:optional"},
+				},
+				CommentLines: []string{"+k8s:optional"},
+			},
+			wantCount:   3,
+			expectError: false,
+		},
+		{
+			name: "Map to pointers",
+			typeToLint: &types.Type{
+				Name: types.Name{Package: "testpkg", Name: "TestMap"},
+				Kind: types.Map,
+				Key:  &types.Type{Name: types.Name{Package: "testpkg", Name: "KeyType"}, CommentLines: []string{"+k8s:required"}},
+				Elem: &types.Type{
+					Name:         types.Name{Package: "testpkg", Name: "PointerElem"},
+					Kind:         types.Pointer,
+					Elem:         &types.Type{Name: types.Name{Package: "testpkg", Name: "ElemType"}, CommentLines: []string{"+k8s:optional"}},
+					CommentLines: []string{"+k8s:optional"},
+				},
+				CommentLines: []string{"+k8s:optional"},
+			},
+			wantCount:   4,
+			expectError: false,
+		},
+		{
+			name: "Alias to pointers",
+			typeToLint: &types.Type{
+				Name: types.Name{Package: "testpkg", Name: "TestAlias"},
+				Kind: types.Alias,
+				Underlying: &types.Type{
+					Name:         types.Name{Package: "testpkg", Name: "PointerElem"},
+					Kind:         types.Pointer,
+					Elem:         &types.Type{Name: types.Name{Package: "testpkg", Name: "ElemType"}, CommentLines: []string{"+k8s:optional"}},
+					CommentLines: []string{"+k8s:optional"},
+				},
+				CommentLines: []string{"+k8s:optional"},
+			},
+			wantCount:   3,
+			expectError: false,
+		},
+		{
+			name: "Struct with members",
+			typeToLint: &types.Type{
+				Name: types.Name{Package: "testpkg", Name: "TestStruct"},
+				Kind: types.Struct,
+				Members: []types.Member{
+					{
+						Name:         "Field1",
+						Type:         &types.Type{Name: types.Name{Package: "testpkg", Name: "FieldType"}},
+						CommentLines: []string{"+k8s:optional"},
+					},
+					{
+						Name:         "Field2",
+						Type:         &types.Type{Name: types.Name{Package: "testpkg", Name: "FieldType"}},
+						CommentLines: []string{"+k8s:required"},
+					},
+				},
+			},
+			wantCount:   2,
+			expectError: false,
+		},
+		{
+			name: "Nested types",
+			typeToLint: &types.Type{
+				Name: types.Name{Package: "testpkg", Name: "TestStruct"},
+				Kind: types.Struct,
+				Members: []types.Member{
+					{
+						Name: "Field1",
+						Type: &types.Type{
+							Name:         types.Name{Package: "testpkg", Name: "NestedStruct"},
+							Kind:         types.Struct,
+							CommentLines: []string{"+k8s:optional"},
+							Members: []types.Member{
+								{
+									Name:         "NestedField1",
+									Type:         &types.Type{Name: types.Name{Package: "testpkg", Name: "NestedFieldType"}},
+									CommentLines: []string{"+k8s:required"},
+								},
+							},
+						},
+					},
+				},
+			},
+			wantCount:   3,
+			expectError: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			counter := 0
+			rules := []lintRule{mkCountRule(&counter, ruleAlwaysPass)}
+			l := newLinter(rules...)
+			if err := l.lintType(tt.typeToLint); err != nil {
+				t.Fatal(err)
+			}
+			gotErr := len(l.lintErrors) > 0
+			if gotErr != tt.expectError {
+				t.Errorf("LintType() errors = %v, expectError %v", l.lintErrors, tt.expectError)
+			}
+			if counter != tt.wantCount {
+				t.Errorf("expected %d rule invocations, got %d", tt.wantCount, counter)
+			}
+		})
+	}
+}
+
+func TestHasAnyValidationTag(t *testing.T) {
+	tests := []struct {
+		name     string
+		comments []string
+		want     bool
+	}{
+		{
+			name:     "empty",
+			comments: []string{},
+			want:     false,
+		},
+		{
+			name:     "no k8s tags",
+			comments: []string{"just a comment"},
+			want:     false,
+		},
+		{
+			name:     "optional only",
+			comments: []string{"+k8s:optional"},
+			want:     false,
+		},
+		{
+			name:     "required only",
+			comments: []string{"+k8s:required"},
+			want:     true,
+		},
+		{
+			name:     "forbidden only",
+			comments: []string{"+k8s:forbidden"},
+			want:     true,
+		},
+		{
+			name:     "unrecognized k8s tag",
+			comments: []string{"+k8s:openapi-gen=true"},
+			want:     false,
+		},
+		{
+			name:     "minimum tag",
+			comments: []string{"+k8s:minimum=0"},
+			want:     true,
+		},
+		{
+			name:     "enum tag",
+			comments: []string{"+k8s:enum"},
+			want:     true,
+		},
+		{
+			name:     "mixed with optional",
+			comments: []string{"+k8s:optional", "+k8s:minimum=0"},
+			want:     true,
+		},
+	}
+
+	chainTags := sets.New[string]()
+	for _, doc := range validator.Docs() {
+		if doc.PayloadsType == codetags.ValueTypeTag {
+			chainTags.Insert(doc.Tag)
+		}
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tags, _ := validator.ExtractTags(validators.Context{}, tt.comments)
+			if got := hasNonOpaqueValidationTag(validator, chainTags, tags); got != tt.want {
+				t.Errorf("hasNonOpaqueValidationTag() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestHasRequirednessTag(t *testing.T) {
+	tests := []struct {
+		name     string
+		comments []string
+		want     bool
+	}{
+		{
+			name:     "empty",
+			comments: []string{},
+			want:     false,
+		},
+		{
+			name:     "no requireness",
+			comments: []string{"+k8s:minimum=0"},
+			want:     false,
+		},
+		{
+			name:     "optional",
+			comments: []string{"+k8s:optional"},
+			want:     true,
+		},
+		{
+			name:     "required",
+			comments: []string{"+k8s:required"},
+			want:     true,
+		},
+		{
+			name:     "optional with value",
+			comments: []string{"+k8s:optional=true"},
+			want:     true,
+		},
+		{
+			name:     "conditional optional",
+			comments: []string{`+k8s:alpha(since:"1.35")=+k8s:optional`},
+			want:     true,
+		},
+		{
+			name:     "conditional required",
+			comments: []string{`+k8s:alpha(since:"1.35")=+k8s:required`},
+			want:     true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tags, _ := validator.ExtractTags(validators.Context{}, tt.comments)
+			if got := hasRequirednessTag(tags); got != tt.want {
+				t.Errorf("hasRequirednessTag() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestLintRequiredness(t *testing.T) {
+	sharedAlias := testAlias("MyAlias", testSlice(testStruct("Inner", []types.Member{
+		testField("Bar", testType("int"), "+k8s:minimum=0"),
+	})))
+
+	tests := []struct {
+		name       string
+		typeToLint *types.Type
+		wantError  string
+	}{
+		{
+			name: "pointer field without validation - no error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testPtr(testType("string"))),
+			}),
+			wantError: "",
+		},
+		{
+			name: "pointer field with direct validation, no requireness - error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testPtr(testType("int")), "+k8s:minimum=0"),
+			}),
+			wantError: "field Foo: field with validation must have +k8s:optional, +k8s:required or +k8s:forbidden",
+		},
+		{
+			name: "pointer field with transitive validation, no requireness - error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testPtr(
+					testStruct("Inner", []types.Member{
+						testField("Bar", testType("int"), "+k8s:minimum=0"),
+					}),
+				)),
+			}),
+			wantError: "field Foo: field with validation must have +k8s:optional, +k8s:required or +k8s:forbidden",
+		},
+		{
+			name: "pointer field with validation and +k8s:optional - no error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testPtr(testType("int")), "+k8s:optional", "+k8s:minimum=0"),
+			}),
+			wantError: "",
+		},
+		{
+			name: "slice field with validation, no requireness - error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Items", testSlice(testType("string")), "+k8s:maxItems=10"),
+			}),
+			wantError: "field Items: field with validation must have +k8s:optional, +k8s:required or +k8s:forbidden",
+		},
+		{
+			name: "map field with validation, no requireness - error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Data", testMap(testType("string"), testType("string")), "+k8s:maxItems=5"),
+			}),
+			wantError: "field Data: field with validation must have +k8s:optional, +k8s:required or +k8s:forbidden",
+		},
+		{
+			name: "non-pointer struct field with validation - no error (exempt)",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Nested", testStruct("Inner", nil, "+k8s:minimum=0")),
+			}),
+			wantError: "",
+		},
+		{
+			name: "recursive type with pointer to self - no infinite loop",
+			typeToLint: func() *types.Type {
+				t := testStruct("Node", nil)
+				t.Members = []types.Member{
+					testField("Next", testPtr(t), "+k8s:optional"),
+				}
+				return t
+			}(),
+			wantError: "",
+		},
+		{
+			name: "recursive type with pointer to self - no infinite loop, missing required validation",
+			typeToLint: func() *types.Type {
+				t := testStruct("Node", nil)
+				t.Members = []types.Member{
+					testField("Next", testPtr(t), "+k8s:immutable"),
+				}
+				return t
+			}(),
+			wantError: "field Next: field with validation must have +k8s:optional, +k8s:required or +k8s:forbidden",
+		},
+		{
+			name: "recursive type with validation - detects validation on first visit",
+			typeToLint: func() *types.Type {
+				t := testStruct("Node", nil, "+k8s:immutable")
+				t.Members = []types.Member{
+					testField("Next", testPtr(t), "+k8s:optional"),
+				}
+				return t
+			}(),
+			wantError: "",
+		},
+		{
+			name: "array field with transitive validation, no requiredNess - error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Arr", testArray(testStruct("Inner", []types.Member{
+					testField("Bar", testType("int"), "+k8s:minimum=0"),
+				}))),
+			}),
+			wantError: "field Arr: field with validation must have +k8s:optional, +k8s:required or +k8s:forbidden",
+		},
+		{
+			name: "pointer field with transitive validation but marked opaqueType - no error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testPtr(
+					testStruct("Inner", []types.Member{
+						testField("Bar", testType("int"), "+k8s:minimum=0"),
+					}),
+				), "+k8s:opaqueType"),
+			}),
+			wantError: "",
+		},
+		{
+			name: "pointer to alias field with transitive validation but marked opaqueType - no error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testPtr(
+					testAlias("MyAlias",
+						testStruct("Inner", []types.Member{
+							testField("Bar", testType("int"), "+k8s:minimum=0"),
+						}),
+					),
+				), "+k8s:opaqueType"),
+			}),
+			wantError: "",
+		},
+		{
+			name: "alias field (to slice) with transitive validation but marked opaqueType - no error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testAlias("MyAlias",
+					testSlice(
+						testStruct("Inner", []types.Member{
+							testField("Bar", testType("int"), "+k8s:minimum=0"),
+						}),
+					),
+				), "+k8s:opaqueType"),
+			}),
+			wantError: "",
+		},
+		{
+			name: "slice field with transitive validation marked opaqueValType - no error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testSlice(
+					testStruct("Inner", []types.Member{
+						testField("Bar", testType("int"), "+k8s:minimum=0"),
+					}),
+				), "+k8s:eachVal=+k8s:opaqueType"),
+			}),
+			wantError: "",
+		},
+		{
+			name: "array field with transitive validation marked opaqueValType - no error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testArray(
+					testStruct("Inner", []types.Member{
+						testField("Bar", testType("int"), "+k8s:minimum=0"),
+					}),
+				), "+k8s:eachVal=+k8s:opaqueType"),
+			}),
+			wantError: "",
+		},
+		{
+			name: "map field with transitive validation on key, marked opaqueKeyType - no error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testMap(
+					testAlias("KeyType", types.String, "+k8s:minLength=1"),
+					types.String,
+				), "+k8s:eachKey=+k8s:opaqueType"),
+			}),
+			wantError: "",
+		},
+		{
+			name: "map field with transitive validation on key, not marked opaqueKeyType - error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testMap(
+					testAlias("KeyType", types.String, "+k8s:minLength=1"),
+					types.String,
+				)),
+			}),
+			wantError: "field Foo: field with validation must have +k8s:optional, +k8s:required or +k8s:forbidden",
+		},
+		{
+			name: "map field with transitive validation on value, marked opaqueValType - no error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testMap(
+					types.String,
+					testStruct("Inner", []types.Member{
+						testField("Bar", testType("int"), "+k8s:minimum=0"),
+					}),
+				), "+k8s:eachVal=+k8s:opaqueType"),
+			}),
+			wantError: "",
+		},
+		{
+			name: "map field with transitive validation on both, both marked opaque - no error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testMap(
+					testAlias("KeyType", types.String, "+k8s:minLength=1"),
+					testStruct("Inner", []types.Member{
+						testField("Bar", testType("int"), "+k8s:minimum=0"),
+					}),
+				), "+k8s:eachKey=+k8s:opaqueType", "+k8s:eachVal=+k8s:opaqueType"),
+			}),
+			wantError: "",
+		},
+		{
+			name: "map field with transitive validation on both, only key marked opaque - error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testMap(
+					testAlias("KeyType", types.String, "+k8s:minLength=1"),
+					testStruct("Inner", []types.Member{
+						testField("Bar", testType("int"), "+k8s:minimum=0"),
+					}),
+				), "+k8s:eachKey=+k8s:opaqueType"),
+			}),
+			wantError: "field Foo: field with validation must have +k8s:optional, +k8s:required or +k8s:forbidden",
+		},
+		{
+			name: "map field with transitive validation on both, only value marked opaque - error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testMap(
+					testAlias("KeyType", types.String, "+k8s:minLength=1"),
+					testStruct("Inner", []types.Member{
+						testField("Bar", testType("int"), "+k8s:minimum=0"),
+					}),
+				), "+k8s:eachVal=+k8s:opaqueType"),
+			}),
+			wantError: "field Foo: field with validation must have +k8s:optional, +k8s:required or +k8s:forbidden",
+		},
+		{
+			name: "pointer field with nested opaque field - bypasses transitive validation",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testPtr(
+					testStruct("Inner", []types.Member{
+						testField("Bar", testPtr(
+							testStruct("NestedInner", []types.Member{
+								testField("Val", testType("int"), "+k8s:minimum=0"),
+							}),
+						), "+k8s:opaqueType"),
+					}),
+				)),
+			}),
+			wantError: "",
+		},
+		{
+			name: "alias field (to slice) with transitive validation but no opacity tags on type - error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testAlias("MyAlias",
+					testSlice(
+						testStruct("Inner", []types.Member{
+							testField("Bar", testType("int"), "+k8s:minimum=0"),
+						}),
+					),
+				)),
+			}),
+			wantError: "field Foo: field with validation must have +k8s:optional, +k8s:required or +k8s:forbidden",
+		},
+		{
+			name: "alias field (to slice) with transitive validation and eachVal marked opaque on the field - no error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testAlias("MyAlias",
+					testSlice(
+						testStruct("Inner", []types.Member{
+							testField("Bar", testType("int"), "+k8s:minimum=0"),
+						}),
+					),
+				), "+k8s:eachVal=+k8s:opaqueType"),
+			}),
+			wantError: "",
+		},
+		{
+			name: "alias field (to slice) with transitive validation and eachVal marked opaque on the type definition - no error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testAlias("MyAlias",
+					testSlice(
+						testStruct("Inner", []types.Member{
+							testField("Bar", testType("int"), "+k8s:minimum=0"),
+						}),
+					),
+					"+k8s:eachVal=+k8s:opaqueType",
+				)),
+			}),
+			wantError: "",
+		},
+		{
+			name: "pointer to alias field (to slice) with transitive validation, eachVal marked opaque on type definition - no error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testPtr(
+					testAlias("MyAlias",
+						testSlice(
+							testStruct("Inner", []types.Member{
+								testField("Bar", testType("int"), "+k8s:minimum=0"),
+							}),
+						),
+						"+k8s:eachVal=+k8s:opaqueType",
+					),
+				)),
+			}),
+			wantError: "",
+		},
+		{
+			name: "alias field (to map) with transitive validation, eachVal marked opaque on type definition - no error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testAlias("MyAlias",
+					testMap(
+						types.String,
+						testStruct("Inner", []types.Member{
+							testField("Bar", testType("int"), "+k8s:minimum=0"),
+						}),
+					),
+					"+k8s:eachVal=+k8s:opaqueType",
+				)),
+			}),
+			wantError: "",
+		},
+		{
+			name: "pointer to alias field (to struct) with transitive validation, opaqueType marked on type definition - no error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testPtr(
+					testAlias("MyAlias",
+						testStruct("Inner", []types.Member{
+							testField("Bar", testType("int"), "+k8s:minimum=0"),
+						}),
+						"+k8s:opaqueType",
+					),
+				)),
+			}),
+			wantError: "",
+		},
+		{
+			name: "alias field (to slice) with local validation tag and elements marked opaque on the type definition - reports error",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Widgets", testAlias("WidgetList",
+					testSlice(
+						testStruct("Inner", []types.Member{
+							testField("Bar", testType("int"), "+k8s:minimum=0"),
+						}),
+					),
+					"+k8s:maxItems=100",
+					"+k8s:eachVal=+k8s:opaqueType",
+				)),
+			}),
+			wantError: "field Widgets: field with validation must have +k8s:optional, +k8s:required or +k8s:forbidden",
+		},
+		{
+			name: "pointer field with transitive malformed tag on alias type definition - reports error as lint warning instead of crashing",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testPtr(
+					testAlias("MyString", testType("string"), "+k8s:minimum=0"),
+				)),
+			}),
+			wantError: "field Foo: invalid validation tags: tag \"k8s:minimum\": can only be used on integer types (pkg.MyString -> string)",
+		},
+		{
+			name: "pointer field with transitive malformed tag on struct type definition - reports error as lint warning instead of crashing",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", testPtr(
+					testStruct("MyStruct", []types.Member{
+						testField("Bar", testType("int")),
+					}, "+k8s:minimum=0"),
+				)),
+			}),
+			wantError: "field Foo: invalid validation tags: tag \"k8s:minimum\": can only be used on integer types (pkg.MyStruct)",
+		},
+		{
+			name: "same alias used with different opacity contexts caches correctly",
+			typeToLint: testStruct("T", []types.Member{
+				testField("Foo", sharedAlias, "+k8s:opaqueType"),
+				testField("Bar", sharedAlias),
+			}),
+			wantError: "field Bar: field with validation must have +k8s:optional, +k8s:required or +k8s:forbidden",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			l := newLinter(requiredAndOptional(validator))
+			if err := l.lintType(tt.typeToLint); err != nil {
+				t.Fatalf("lintType() unexpected error: %v", err)
+			}
+			errs := l.lintErrors[tt.typeToLint]
+			if len(errs) > 1 {
+				t.Fatalf("got %d errors, but expected 0 or 1 error: %v", len(errs), errs)
+			}
+			var gotError string
+			if len(errs) == 1 {
+				gotError = errs[0].Error()
+			}
+			if gotError != tt.wantError {
+				t.Errorf("lintRequiredness() error = %q, want %q", gotError, tt.wantError)
+			}
+		})
+	}
+}
+
+func testType(name string, comments ...string) *types.Type {
+	return &types.Type{
+		Name:         types.Name{Package: "", Name: name},
+		Kind:         types.Builtin,
+		CommentLines: comments,
+	}
+}
+
+func testPtr(elem *types.Type, comments ...string) *types.Type {
+	return &types.Type{
+		Name:         types.Name{Package: "pkg", Name: elem.Name.Name + "Ptr"},
+		Kind:         types.Pointer,
+		Elem:         elem,
+		CommentLines: comments,
+	}
+}
+
+func testStruct(name string, members []types.Member, comments ...string) *types.Type {
+	return &types.Type{
+		Name:         types.Name{Package: "pkg", Name: name},
+		Kind:         types.Struct,
+		Members:      members,
+		CommentLines: comments,
+	}
+}
+
+func testField(name string, fieldType *types.Type, comments ...string) types.Member {
+	return types.Member{
+		Name:         name,
+		Type:         fieldType,
+		CommentLines: comments,
+	}
+}
+
+func testSlice(elem *types.Type, comments ...string) *types.Type {
+	return &types.Type{
+		Name:         types.Name{Package: "pkg", Name: "[]" + elem.Name.Name},
+		Kind:         types.Slice,
+		Elem:         elem,
+		CommentLines: comments,
+	}
+}
+
+func testArray(elem *types.Type, comments ...string) *types.Type {
+	return &types.Type{
+		Name:         types.Name{Package: "pkg", Name: "array_" + elem.Name.Name},
+		Kind:         types.Array,
+		Elem:         elem,
+		CommentLines: comments,
+	}
+}
+
+func testMap(key, val *types.Type, comments ...string) *types.Type {
+	return &types.Type{
+		Name:         types.Name{Package: "pkg", Name: "map_" + key.Name.Name + "_" + val.Name.Name},
+		Kind:         types.Map,
+		Key:          key,
+		Elem:         val,
+		CommentLines: comments,
+	}
+}
+
+func testAlias(name string, underlying *types.Type, comments ...string) *types.Type {
+	return &types.Type{
+		Name:         types.Name{Package: "pkg", Name: name},
+		Kind:         types.Alias,
+		Underlying:   underlying,
+		CommentLines: comments,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/main.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/main.go
new file mode 100644
index 0000000000..4385d38381
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/main.go
@@ -0,0 +1,193 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// validation-gen is a tool for auto-generating Validation functions.
+package main
+
+import (
+	"bytes"
+	"cmp"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"os"
+	"slices"
+
+	"github.com/spf13/pflag"
+
+	"k8s.io/code-generator/cmd/validation-gen/validators"
+	"k8s.io/code-generator/pkg/apidefinitions"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/klog/v2"
+)
+
+func main() {
+	klog.InitFlags(nil)
+	args := &Args{}
+
+	args.AddFlags(pflag.CommandLine)
+	if err := flag.Set("logtostderr", "true"); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+	pflag.Parse()
+
+	if err := args.Validate(); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+
+	if args.PrintDocs {
+		printDocs()
+		os.Exit(0)
+	}
+
+	myTargets := func(context *generator.Context) []generator.Target {
+		return GetTargets(context, args)
+	}
+
+	// Run it.
+	if err := gengo.Execute(
+		NameSystems(),
+		DefaultNameSystem(),
+		myTargets,
+		gengo.StdBuildTag,
+		pflag.Args(),
+	); err != nil {
+		klog.Fatalf("Error: %v", err)
+	}
+	klog.V(2).Info("Completed successfully.")
+}
+
+type Args struct {
+	OutputFile   string
+	ReadOnlyPkgs []string // Always consider these as last-ditch possibilities for validations.
+	GoHeaderFile string
+	PrintDocs    bool
+	// TestOutputRoot, when non-empty, enables coverage test fixture
+	// generation. For each Kind with declared rules, emits a test directory
+	// at <TestOutputRoot>/<short-group>/<lowercase(kind)>/ containing one
+	// <TestOutputFilePrefix><version>_test.go per version plus a shared
+	// <TestOutputFilePrefix>main_test.go.
+	TestOutputRoot string
+
+	// TestOutputFilePrefix is prepended to every emitted test fixture
+	// filename. Empty by default; consumers that mark generated files via a
+	// linguist-generated gitattributes pattern (e.g. "zz_generated.") set
+	// this to that prefix.
+	TestOutputFilePrefix string
+
+	// TestAllowlist, when non-empty, is the path to a YAML file of
+	// rule-level filters to exclude from fixture generation. Each entry has
+	// fields apiVersion, kind, path, errorType, origin (use "*" to wildcard
+	// kind/path/errorType/origin) plus a required reason.
+	TestAllowlist string
+
+	apidefinitions.LintArgs
+}
+
+// AddFlags add the generator flags to the flag set.
+func (args *Args) AddFlags(fs *pflag.FlagSet) {
+	fs.StringVar(&args.OutputFile, "output-file", "generated.validations.go",
+		"the name of the file to be generated")
+	fs.StringSliceVar(&args.ReadOnlyPkgs, "readonly-pkg", args.ReadOnlyPkgs,
+		"the import path of a package whose validation can be used by generated code, but is not being generated for")
+	fs.StringVar(&args.GoHeaderFile, "go-header-file", "",
+		"the path to a file containing boilerplate header text; the string \"YEAR\" will be replaced with the current 4-digit year")
+	fs.BoolVar(&args.PrintDocs, "docs", false,
+		"print documentation for supported declarative validations, and then exit")
+	fs.StringVar(&args.TestOutputRoot, "test-output-root", "",
+		"if non-empty, also emit declarative-validation coverage test fixtures under this path, organized as <root>/<group>/<lowercase(kind)>/<file-prefix>{<version>,main}_test.go")
+	fs.StringVar(&args.TestOutputFilePrefix, "test-output-file-prefix", "",
+		"prefix prepended to every emitted test fixture filename; useful for marking files via a linguist-generated gitattributes pattern (e.g. \"zz_generated.\")")
+	fs.StringVar(&args.TestAllowlist, "test-allowlist", "",
+		"path to a YAML config file of rule-level filters to exclude from coverage fixture generation; only meaningful with --test-output-root")
+	apidefinitions.AddFlags(&args.LintArgs, fs)
+}
+
+// Validate checks the given arguments.
+func (args *Args) Validate() error {
+	if len(args.OutputFile) == 0 {
+		return fmt.Errorf("--output-file must be specified")
+	}
+	if args.TestAllowlist != "" && args.TestOutputRoot == "" {
+		return fmt.Errorf("--test-allowlist is only meaningful with --test-output-root")
+	}
+	if args.TestOutputFilePrefix != "" && args.TestOutputRoot == "" {
+		return fmt.Errorf("--test-output-file-prefix is only meaningful with --test-output-root")
+	}
+
+	if err := apidefinitions.ValidateFlags(args.LintRules); err != nil {
+		return err
+	}
+	return nil
+}
+
+func printDocs() {
+	// We need a fake context to init the validator plugins.
+	c := &generator.Context{
+		Namers:    namer.NameSystems{},
+		Universe:  types.Universe{},
+		FileTypes: map[string]generator.FileType{},
+	}
+
+	// Initialize all registered validators.
+	validator := validators.InitGlobalValidator(c, nil)
+
+	docs := validator.Docs()
+	for i := range docs {
+		d := &docs[i]
+		slices.Sort(d.Scopes)
+		if d.Usage == "" {
+			// Try to generate a usage string if none was provided.
+			usage := d.Tag
+			if len(d.Args) > 0 {
+				usage += "("
+				for i := range d.Args {
+					if i > 0 {
+						usage += ", "
+					}
+					usage += d.Args[i].Description
+				}
+				usage += ")"
+			}
+			if len(d.Payloads) > 0 {
+				usage += "="
+				if len(d.Payloads) == 1 {
+					usage += d.Payloads[0].Description
+				} else {
+					usage += "<payload>"
+				}
+			}
+			d.Usage = usage
+		}
+	}
+	slices.SortFunc(docs, func(a, b validators.TagDoc) int {
+		return cmp.Compare(a.Tag, b.Tag)
+	})
+
+	var buf bytes.Buffer
+	encoder := json.NewEncoder(&buf)
+	encoder.SetEscapeHTML(false)
+	encoder.SetIndent("", "    ")
+	if err := encoder.Encode(docs); err != nil {
+		klog.Fatalf("failed to marshal docs: %v", err)
+	}
+
+	fmt.Println(buf.String())
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/_codegenignore/other/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/_codegenignore/other/doc.go
new file mode 100644
index 0000000000..6e0cb7b4b5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/_codegenignore/other/doc.go
@@ -0,0 +1,36 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=*
+
+// This is a test package.  It exists to demonstrate references to types that
+// are not part of the gengo args.  Even though this package purports to have
+// validations, it is outside of the args used when generating output_tests,
+// and so the generated could should NOT descend into these.
+// +k8s:validation-gen-nolint
+package other
+
+// +k8s:validateFalse="you should not see this outside of this pkg"
+type StringType string
+
+// +k8s:validateFalse="you should not see this outside of this pkg"
+type IntType int
+
+// +k8s:validateFalse="you should not see this outside of this pkg"
+type StructType struct {
+	// +k8s:validateFalse="you should not see this outside of this pkg"
+	StringField string `json:"stringField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/trivial/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/trivial/doc.go
new file mode 100644
index 0000000000..13a64d2919
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/trivial/doc.go
@@ -0,0 +1,36 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Note: this selects all types in the package.
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package trivial
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type T1 struct{}
+
+type T2 struct{}
+
+type E1 string
+
+type E2 string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/trivial/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/trivial/testdata/validate-false.json
new file mode 100644
index 0000000000..9e26dfeeb6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/trivial/testdata/validate-false.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/trivial/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/trivial/zz_generated.validations.go
new file mode 100644
index 0000000000..7fa85b5807
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/trivial/zz_generated.validations.go
@@ -0,0 +1,22 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package trivial
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/trivial/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/trivial/zz_generated.validations_test.go
new file mode 100644
index 0000000000..510f04e229
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/trivial/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package trivial
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_field_validations/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_field_validations/doc.go
new file mode 100644
index 0000000000..bb1ffb53b9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_field_validations/doc.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Note: this selects all types in the package.
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package withfieldvalidations
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type T1 struct {
+	// +k8s:validateFalse="field T1.S"
+	S string `json:"s"`
+	// +k8s:validateFalse="field T1.T2"
+	T2 T2 `json:"t2"`
+	// +k8s:validateFalse="field T1.T3"
+	T3 T3 `json:"t3"`
+}
+
+// Note: this has validations and is linked into T1.
+type T2 struct {
+	// +k8s:validateFalse="field T2.S"
+	S string `json:"s"`
+}
+
+// Note: this has no validations and is linked into T1.
+type T3 struct {
+	S string `json:"s"`
+}
+
+// Note: this has validations and is not linked into T1.
+type T4 struct {
+	// +k8s:validateFalse="field T4.S"
+	S string `json:"s"`
+}
+
+// Note: this has no validations and is not linked into T1.
+type T5 struct {
+	S string `json:"s"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_field_validations/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_field_validations/testdata/validate-false.json
new file mode 100644
index 0000000000..65581342cf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_field_validations/testdata/validate-false.json
@@ -0,0 +1,26 @@
+{
+  "*withfieldvalidations.T1": {
+    "s": [
+      "field T1.S"
+    ],
+    "t2": [
+      "field T1.T2"
+    ],
+    "t2.s": [
+      "field T2.S"
+    ],
+    "t3": [
+      "field T1.T3"
+    ]
+  },
+  "*withfieldvalidations.T2": {
+    "s": [
+      "field T2.S"
+    ]
+  },
+  "*withfieldvalidations.T4": {
+    "s": [
+      "field T4.S"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_field_validations/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_field_validations/zz_generated.validations.go
new file mode 100644
index 0000000000..6165600d00
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_field_validations/zz_generated.validations.go
@@ -0,0 +1,235 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package withfieldvalidations
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T2
+	scheme.AddValidationFunc(
+		(*T2)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T2(
+					ctx, op, nil, /* fldPath */
+					obj.(*T2),
+					safe.Cast[*T2](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T4
+	scheme.AddValidationFunc(
+		(*T4)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T4(
+					ctx, op, nil, /* fldPath */
+					obj.(*T4),
+					safe.Cast[*T4](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	{ // field T1.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.T2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.T2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T2 {
+				return &oldObj.T2
+			})
+		errs = append(errs, fn(fldPath.Child("t2"), &obj.T2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.T3
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T3,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.T3"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T3 {
+				return &oldObj.T3
+			})
+		errs = append(errs, fn(fldPath.Child("t3"), &obj.T3, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T2 validates an instance of T2 according
+// to declarative validation rules in the API schema.
+func Validate_T2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T2) (errs field.ErrorList) {
+
+	{ // field T2.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T4 validates an instance of T4 according
+// to declarative validation rules in the API schema.
+func Validate_T4(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T4) (errs field.ErrorList) {
+
+	{ // field T4.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T4.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T4) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_field_validations/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_field_validations/zz_generated.validations_test.go
new file mode 100644
index 0000000000..d96d788694
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_field_validations/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package withfieldvalidations
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_type_validations/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_type_validations/doc.go
new file mode 100644
index 0000000000..68b6ad8cdc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_type_validations/doc.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Note: this selects all types in the package.
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package withtypevalidations
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// +k8s:validateFalse="type T1"
+type T1 struct {
+	// +k8s:validateFalse="field T1.S"
+	S string `json:"s"`
+}
+
+// Note: this has no validations.
+type T2 struct{}
+
+// +k8s:validateFalse="type E1"
+type E1 string
+
+// Note: this has no validations.
+type E2 string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_type_validations/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_type_validations/testdata/validate-false.json
new file mode 100644
index 0000000000..54d46424b6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_type_validations/testdata/validate-false.json
@@ -0,0 +1,15 @@
+{
+  "*withtypevalidations.E1": {
+    "": [
+      "type E1"
+    ]
+  },
+  "*withtypevalidations.T1": {
+    "": [
+      "type T1"
+    ],
+    "s": [
+      "field T1.S"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_type_validations/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_type_validations/zz_generated.validations.go
new file mode 100644
index 0000000000..0fb3e785ea
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_type_validations/zz_generated.validations.go
@@ -0,0 +1,121 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package withtypevalidations
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type E1
+	scheme.AddValidationFunc(
+		(*E1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_E1(
+					ctx, op, nil, /* fldPath */
+					obj.(*E1),
+					safe.Cast[*E1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_E1 validates an instance of E1 according
+// to declarative validation rules in the API schema.
+func Validate_E1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *E1) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type E1"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T1"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field T1.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_type_validations/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_type_validations/zz_generated.validations_test.go
new file mode 100644
index 0000000000..97db075d26
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/all_types_match/with_type_validations/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package withtypevalidations
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cohorts/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cohorts/doc.go
new file mode 100644
index 0000000000..21c04730f2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cohorts/doc.go
@@ -0,0 +1,56 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package cohorts
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Note: the following are out of order on purpose.
+// They should be emitted as:
+//   - T {ShortCircuit,Regular}
+//   - T c2 {ShortCircuit,Regular}
+//   - T c1 {ShortCircuit,Regular}
+//
+// +k8s:validateFalse(cohort: "c2")="type T c2 Regular"
+// +k8s:validateFalse(cohort: "c1")="type T c1 Regular"
+// +k8s:validateFalse(cohort: "c1", flags: "ShortCircuit")="type T c1 ShortCircuit"
+// +k8s:validateFalse(cohort: "c2", flags: "ShortCircuit")="type T c2 ShortCircuit"
+// +k8s:validateFalse="type T Regular"
+// +k8s:validateFalse(flags: "ShortCircuit")="type T ShortCircuit"
+type T struct {
+	TypeMeta int
+
+	// Note: the following are out of order on purpose.
+	// They should be emitted as:
+	//   - T.S {ShortCircuit,Regular}
+	//   - T.S c2 {ShortCircuit,Regular}
+	//   - T.S c1 {ShortCircuit,Regular}
+	// +k8s:validateFalse(cohort: "c2")="field T.S c2 Regular"
+	// +k8s:validateFalse(cohort: "c1")="field T.S c1 Regular"
+	// +k8s:validateFalse(cohort: "c1", flags: "ShortCircuit")="field T.S c1 ShortCircuit"
+	// +k8s:validateFalse(cohort: "c2", flags: "ShortCircuit")="field T.S c2 ShortCircuit"
+	// +k8s:validateFalse="field T.S Regular"
+	// +k8s:validateFalse(flags: "ShortCircuit")="field T.S ShortCircuit"
+	S string `json:"s"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cohorts/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cohorts/testdata/validate-false.json
new file mode 100644
index 0000000000..ad04e39912
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cohorts/testdata/validate-false.json
@@ -0,0 +1,7 @@
+{
+  "*cohorts.T": {
+    "": [
+      "type T ShortCircuit"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cohorts/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cohorts/zz_generated.validations.go
new file mode 100644
index 0000000000..bbb5c6c8a9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cohorts/zz_generated.validations.go
@@ -0,0 +1,163 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package cohorts
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T
+	scheme.AddValidationFunc(
+		(*T)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T(
+					ctx, op, nil, /* fldPath */
+					obj.(*T),
+					safe.Cast[*T](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T validates an instance of T according
+// to declarative validation rules in the API schema.
+func Validate_T(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T) (errs field.ErrorList) {
+
+	earlyReturn := false
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+		errs = append(errs, e...)
+		earlyReturn = true
+	}
+	if earlyReturn {
+		return // do not proceed
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T Regular"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	func() { // cohort = "c2"
+		earlyReturn := false
+		if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T c2 ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+			errs = append(errs, e...)
+			earlyReturn = true
+		}
+		if earlyReturn {
+			return // do not proceed
+		}
+		if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T c2 Regular"); len(e) != 0 {
+			errs = append(errs, e...)
+		}
+	}()
+	func() { // cohort = "c1"
+		earlyReturn := false
+		if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T c1 ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+			errs = append(errs, e...)
+			earlyReturn = true
+		}
+		if earlyReturn {
+			return // do not proceed
+		}
+		if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T c1 Regular"); len(e) != 0 {
+			errs = append(errs, e...)
+		}
+	}()
+
+	// field T.TypeMeta has no validation
+
+	{ // field T.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T.S ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T.S Regular"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "c2"
+				earlyReturn := false
+				if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T.S c2 ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+					errs = append(errs, e...)
+					earlyReturn = true
+				}
+				if earlyReturn {
+					return // do not proceed
+				}
+				if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T.S c2 Regular"); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			func() { // cohort = "c1"
+				earlyReturn := false
+				if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T.S c1 ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+					errs = append(errs, e...)
+					earlyReturn = true
+				}
+				if earlyReturn {
+					return // do not proceed
+				}
+				if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T.S c1 Regular"); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cohorts/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cohorts/zz_generated.validations_test.go
new file mode 100644
index 0000000000..e9214fd3eb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cohorts/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package cohorts
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cross_pkg/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cross_pkg/doc.go
new file mode 100644
index 0000000000..a369311265
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cross_pkg/doc.go
@@ -0,0 +1,123 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+//nolint:unused
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package crosspkg
+
+import (
+	"k8s.io/code-generator/cmd/validation-gen/output_tests/_codegenignore/other"
+	"k8s.io/code-generator/cmd/validation-gen/output_tests/primitives"
+	"k8s.io/code-generator/cmd/validation-gen/output_tests/typedefs"
+	"k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+var localSchemeBuilder = testscheme.New()
+
+type T1 struct {
+	TypeMeta int
+
+	// +k8s:validateTrue="field T1.PrimitivesT1"
+	PrimitivesT1 primitives.T1 `json:"primitivest1"`
+	// +k8s:validateTrue="field T1.PrimitivesT1Ptr"
+	PrimitivesT1Ptr *primitives.T1 `json:"primitivest1Ptr"`
+	// +k8s:validateTrue="field T1.PrimitivesT2"
+	PrimitivesT2 primitives.T2 `json:"primitivest2"`
+	// +k8s:validateTrue="field T1.PrimitivesT2Ptr"
+	PrimitivesT2Ptr *primitives.T1 `json:"primitivest2Ptr"`
+	// +k8s:validateTrue="field T1.PrimitivesT3"
+	PrimitivesT3 primitives.T3 `json:"primitivest3"`
+	// +k8s:validateTrue="field T1.PrimitivesT3Ptr"
+	PrimitivesT3Ptr *primitives.T1 `json:"primitivest3Ptr"`
+	// T4 and T5 are not root types in that pkg and are not linked into any
+	// root type's transitive graph, so they have no functions.
+
+	// +k8s:validateTrue="field T1.TypedefsE1"
+	TypedefsE1 typedefs.E1 `json:"typedefse1"`
+	// +k8s:validateTrue="field T1.TypedefsE1Ptr"
+	TypedefsE1Ptr *typedefs.E1 `json:"typedefse1Ptr"`
+	// +k8s:validateTrue="field T1.TypedefsE2"
+	TypedefsE2 typedefs.E2 `json:"typedefse2"`
+	// +k8s:validateTrue="field T1.TypedefsE2Ptr"
+	TypedefsE2Ptr *typedefs.E2 `json:"typedefse2Ptr"`
+	// +k8s:validateTrue="field T1.TypedefsE3"
+	TypedefsE3 typedefs.E3 `json:"typedefse3"`
+	// +k8s:validateTrue="field T1.TypedefsE3Ptr"
+	TypedefsE3Ptr *typedefs.E3 `json:"typedefse3Ptr"`
+	// +k8s:validateTrue="field T1.TypedefsE4"
+	TypedefsE4 typedefs.E4 `json:"typedefse4"`
+	// +k8s:validateTrue="field T1.TypedefsE4Ptr"
+	TypedefsE4Ptr *typedefs.E4 `json:"typedefse4Ptr"`
+
+	// +k8s:validateTrue="field T1.OtherString"
+	// +k8s:opaqueType
+	OtherString other.StringType `json:"otherString"`
+	// +k8s:validateTrue="field T1.OtherStringPtr"
+	// +k8s:opaqueType
+	OtherStringPtr *other.StringType `json:"otherStringPtr"`
+	// +k8s:validateTrue="field T1.OtherInt"
+	// +k8s:opaqueType
+	OtherInt other.IntType `json:"otherInt"`
+	// +k8s:validateTrue="field T1.OtherIntPtr"
+	// +k8s:opaqueType
+	OtherIntPtr *other.IntType `json:"otherIntPtr"`
+	// +k8s:validateTrue="field T1.OtherStruct"
+	// +k8s:opaqueType
+	OtherStruct other.StructType `json:"otherStruct"`
+	// +k8s:validateTrue="field T1.OtherStructPtr"
+	// +k8s:opaqueType
+	OtherStructPtr *other.StructType `json:"otherStructPtr"`
+
+	// +k8s:validateTrue="field T1.SliceOfOtherStruct"
+	// +k8s:eachVal=+k8s:validateTrue="field T1.SliceOfOtherStruct values"
+	// +k8s:eachVal=+k8s:opaqueType
+	SliceOfOtherStruct []other.StructType `json:"sliceOfOtherStruct"`
+
+	// +k8s:validateTrue="field T1.ListMapOfOtherStruct"
+	// +k8s:eachVal=+k8s:validateTrue="field T1.SliceOfOtherStruct values"
+	// +k8s:listType=map
+	// +k8s:listMapKey=stringField
+	// +k8s:eachVal=+k8s:opaqueType
+	ListMapOfOtherStruct []other.StructType `json:"listMapOfOtherStruct"`
+
+	// +k8s:validateTrue="field T1.MapOfOtherStringToOtherStruct"
+	// +k8s:eachKey=+k8s:validateTrue="field T1.MapOfOtherStringToOtherStruct keys"
+	// +k8s:eachVal=+k8s:validateTrue="field T1.MapOfOtherStringToOtherStruct values"
+	// +k8s:eachKey=+k8s:opaqueType
+	// +k8s:eachVal=+k8s:opaqueType
+	MapOfOtherStringToOtherStruct map[other.StringType]other.StructType `json:"mapOfOtherStringToOtherStruct"`
+}
+
+// TODO: the validateFalse test fixture doesn't handle map and slice types, and
+// fixing it requires fixing randfill.  That is a tomorrow problem.  For now, the
+// following types have been tested to fail without +k8s:opaqueType.
+
+/*
+// +k8s:validateTrue="type TypedefSliceOther"
+// +k8s:eachVal=+k8s:opaqueType
+type TypedefSliceOther []other.StructType
+
+// +k8s:validateTrue="type TypedefMapOther"
+// +k8s:eachKey=+k8s:opaqueType
+// +k8s:eachVal=+k8s:opaqueType
+type TypedefMapOther map[other.StringType]other.StructType
+*/
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cross_pkg/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cross_pkg/testdata/validate-false.json
new file mode 100644
index 0000000000..4793b76adb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cross_pkg/testdata/validate-false.json
@@ -0,0 +1,202 @@
+{
+  "*crosspkg.T1": {
+    "primitivest1.anothert2.b": [
+      "field T2.B"
+    ],
+    "primitivest1.anothert2.f": [
+      "field T2.F"
+    ],
+    "primitivest1.anothert2.i": [
+      "field T2.I"
+    ],
+    "primitivest1.anothert2.s": [
+      "field T2.S"
+    ],
+    "primitivest1.b": [
+      "field T1.B"
+    ],
+    "primitivest1.f": [
+      "field T1.F"
+    ],
+    "primitivest1.i": [
+      "field T1.I"
+    ],
+    "primitivest1.s": [
+      "field T1.S"
+    ],
+    "primitivest1.t2": [
+      "field T1.T2"
+    ],
+    "primitivest1.t2.b": [
+      "field T2.B"
+    ],
+    "primitivest1.t2.f": [
+      "field T2.F"
+    ],
+    "primitivest1.t2.i": [
+      "field T2.I"
+    ],
+    "primitivest1.t2.s": [
+      "field T2.S"
+    ],
+    "primitivest1Ptr.anothert2.b": [
+      "field T2.B"
+    ],
+    "primitivest1Ptr.anothert2.f": [
+      "field T2.F"
+    ],
+    "primitivest1Ptr.anothert2.i": [
+      "field T2.I"
+    ],
+    "primitivest1Ptr.anothert2.s": [
+      "field T2.S"
+    ],
+    "primitivest1Ptr.b": [
+      "field T1.B"
+    ],
+    "primitivest1Ptr.f": [
+      "field T1.F"
+    ],
+    "primitivest1Ptr.i": [
+      "field T1.I"
+    ],
+    "primitivest1Ptr.s": [
+      "field T1.S"
+    ],
+    "primitivest1Ptr.t2": [
+      "field T1.T2"
+    ],
+    "primitivest1Ptr.t2.b": [
+      "field T2.B"
+    ],
+    "primitivest1Ptr.t2.f": [
+      "field T2.F"
+    ],
+    "primitivest1Ptr.t2.i": [
+      "field T2.I"
+    ],
+    "primitivest1Ptr.t2.s": [
+      "field T2.S"
+    ],
+    "primitivest2.b": [
+      "field T2.B"
+    ],
+    "primitivest2.f": [
+      "field T2.F"
+    ],
+    "primitivest2.i": [
+      "field T2.I"
+    ],
+    "primitivest2.s": [
+      "field T2.S"
+    ],
+    "primitivest2Ptr.anothert2.b": [
+      "field T2.B"
+    ],
+    "primitivest2Ptr.anothert2.f": [
+      "field T2.F"
+    ],
+    "primitivest2Ptr.anothert2.i": [
+      "field T2.I"
+    ],
+    "primitivest2Ptr.anothert2.s": [
+      "field T2.S"
+    ],
+    "primitivest2Ptr.b": [
+      "field T1.B"
+    ],
+    "primitivest2Ptr.f": [
+      "field T1.F"
+    ],
+    "primitivest2Ptr.i": [
+      "field T1.I"
+    ],
+    "primitivest2Ptr.s": [
+      "field T1.S"
+    ],
+    "primitivest2Ptr.t2": [
+      "field T1.T2"
+    ],
+    "primitivest2Ptr.t2.b": [
+      "field T2.B"
+    ],
+    "primitivest2Ptr.t2.f": [
+      "field T2.F"
+    ],
+    "primitivest2Ptr.t2.i": [
+      "field T2.I"
+    ],
+    "primitivest2Ptr.t2.s": [
+      "field T2.S"
+    ],
+    "primitivest3Ptr.anothert2.b": [
+      "field T2.B"
+    ],
+    "primitivest3Ptr.anothert2.f": [
+      "field T2.F"
+    ],
+    "primitivest3Ptr.anothert2.i": [
+      "field T2.I"
+    ],
+    "primitivest3Ptr.anothert2.s": [
+      "field T2.S"
+    ],
+    "primitivest3Ptr.b": [
+      "field T1.B"
+    ],
+    "primitivest3Ptr.f": [
+      "field T1.F"
+    ],
+    "primitivest3Ptr.i": [
+      "field T1.I"
+    ],
+    "primitivest3Ptr.s": [
+      "field T1.S"
+    ],
+    "primitivest3Ptr.t2": [
+      "field T1.T2"
+    ],
+    "primitivest3Ptr.t2.b": [
+      "field T2.B"
+    ],
+    "primitivest3Ptr.t2.f": [
+      "field T2.F"
+    ],
+    "primitivest3Ptr.t2.i": [
+      "field T2.I"
+    ],
+    "primitivest3Ptr.t2.s": [
+      "field T2.S"
+    ],
+    "typedefse1": [
+      "type E1"
+    ],
+    "typedefse1Ptr": [
+      "type E1"
+    ],
+    "typedefse2": [
+      "type E2"
+    ],
+    "typedefse2Ptr": [
+      "type E2"
+    ],
+    "typedefse3": [
+      "type E3"
+    ],
+    "typedefse3Ptr": [
+      "type E3"
+    ],
+    "typedefse4": [
+      "type E4"
+    ],
+    "typedefse4.s": [
+      "field T2.S"
+    ],
+    "typedefse4Ptr": [
+      "type E4"
+    ],
+    "typedefse4Ptr.s": [
+      "field T2.S"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cross_pkg/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cross_pkg/zz_generated.validations.go
new file mode 100644
index 0000000000..012b7b67b6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cross_pkg/zz_generated.validations.go
@@ -0,0 +1,679 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package crosspkg
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	other "k8s.io/code-generator/cmd/validation-gen/output_tests/_codegenignore/other"
+	primitives "k8s.io/code-generator/cmd/validation-gen/output_tests/primitives"
+	typedefs "k8s.io/code-generator/cmd/validation-gen/output_tests/typedefs"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	// field T1.TypeMeta has no validation
+
+	{ // field T1.PrimitivesT1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *primitives.T1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.PrimitivesT1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, primitives.Validate_T1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *primitives.T1 {
+				return &oldObj.PrimitivesT1
+			})
+		errs = append(errs, fn(fldPath.Child("primitivest1"), &obj.PrimitivesT1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PrimitivesT1Ptr
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *primitives.T1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.PrimitivesT1Ptr"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, primitives.Validate_T1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *primitives.T1 {
+				return oldObj.PrimitivesT1Ptr
+			})
+		errs = append(errs, fn(fldPath.Child("primitivest1Ptr"), obj.PrimitivesT1Ptr, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PrimitivesT2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *primitives.T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.PrimitivesT2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, primitives.Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *primitives.T2 {
+				return &oldObj.PrimitivesT2
+			})
+		errs = append(errs, fn(fldPath.Child("primitivest2"), &obj.PrimitivesT2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PrimitivesT2Ptr
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *primitives.T1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.PrimitivesT2Ptr"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, primitives.Validate_T1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *primitives.T1 {
+				return oldObj.PrimitivesT2Ptr
+			})
+		errs = append(errs, fn(fldPath.Child("primitivest2Ptr"), obj.PrimitivesT2Ptr, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PrimitivesT3
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *primitives.T3,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.PrimitivesT3"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *primitives.T3 {
+				return &oldObj.PrimitivesT3
+			})
+		errs = append(errs, fn(fldPath.Child("primitivest3"), &obj.PrimitivesT3, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PrimitivesT3Ptr
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *primitives.T1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.PrimitivesT3Ptr"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, primitives.Validate_T1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *primitives.T1 {
+				return oldObj.PrimitivesT3Ptr
+			})
+		errs = append(errs, fn(fldPath.Child("primitivest3Ptr"), obj.PrimitivesT3Ptr, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.TypedefsE1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *typedefs.E1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.TypedefsE1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, typedefs.Validate_E1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *typedefs.E1 {
+				return &oldObj.TypedefsE1
+			})
+		errs = append(errs, fn(fldPath.Child("typedefse1"), &obj.TypedefsE1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.TypedefsE1Ptr
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *typedefs.E1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.TypedefsE1Ptr"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, typedefs.Validate_E1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *typedefs.E1 {
+				return oldObj.TypedefsE1Ptr
+			})
+		errs = append(errs, fn(fldPath.Child("typedefse1Ptr"), obj.TypedefsE1Ptr, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.TypedefsE2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *typedefs.E2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.TypedefsE2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, typedefs.Validate_E2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *typedefs.E2 {
+				return &oldObj.TypedefsE2
+			})
+		errs = append(errs, fn(fldPath.Child("typedefse2"), &obj.TypedefsE2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.TypedefsE2Ptr
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *typedefs.E2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.TypedefsE2Ptr"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, typedefs.Validate_E2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *typedefs.E2 {
+				return oldObj.TypedefsE2Ptr
+			})
+		errs = append(errs, fn(fldPath.Child("typedefse2Ptr"), obj.TypedefsE2Ptr, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.TypedefsE3
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *typedefs.E3,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.TypedefsE3"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, typedefs.Validate_E3(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *typedefs.E3 {
+				return &oldObj.TypedefsE3
+			})
+		errs = append(errs, fn(fldPath.Child("typedefse3"), &obj.TypedefsE3, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.TypedefsE3Ptr
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *typedefs.E3,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.TypedefsE3Ptr"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, typedefs.Validate_E3(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *typedefs.E3 {
+				return oldObj.TypedefsE3Ptr
+			})
+		errs = append(errs, fn(fldPath.Child("typedefse3Ptr"), obj.TypedefsE3Ptr, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.TypedefsE4
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *typedefs.E4,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.TypedefsE4"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, typedefs.Validate_E4(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *typedefs.E4 {
+				return &oldObj.TypedefsE4
+			})
+		errs = append(errs, fn(fldPath.Child("typedefse4"), &obj.TypedefsE4, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.TypedefsE4Ptr
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *typedefs.E4,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.TypedefsE4Ptr"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, typedefs.Validate_E4(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *typedefs.E4 {
+				return oldObj.TypedefsE4Ptr
+			})
+		errs = append(errs, fn(fldPath.Child("typedefse4Ptr"), obj.TypedefsE4Ptr, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.OtherString
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *other.StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.OtherString"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *other.StringType {
+				return &oldObj.OtherString
+			})
+		errs = append(errs, fn(fldPath.Child("otherString"), &obj.OtherString, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.OtherStringPtr
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *other.StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.OtherStringPtr"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *other.StringType {
+				return oldObj.OtherStringPtr
+			})
+		errs = append(errs, fn(fldPath.Child("otherStringPtr"), obj.OtherStringPtr, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.OtherInt
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *other.IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.OtherInt"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *other.IntType {
+				return &oldObj.OtherInt
+			})
+		errs = append(errs, fn(fldPath.Child("otherInt"), &obj.OtherInt, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.OtherIntPtr
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *other.IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.OtherIntPtr"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *other.IntType {
+				return oldObj.OtherIntPtr
+			})
+		errs = append(errs, fn(fldPath.Child("otherIntPtr"), obj.OtherIntPtr, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.OtherStruct
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *other.StructType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.OtherStruct"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *other.StructType {
+				return &oldObj.OtherStruct
+			})
+		errs = append(errs, fn(fldPath.Child("otherStruct"), &obj.OtherStruct, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.OtherStructPtr
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *other.StructType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.OtherStructPtr"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *other.StructType {
+				return oldObj.OtherStructPtr
+			})
+		errs = append(errs, fn(fldPath.Child("otherStructPtr"), obj.OtherStructPtr, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.SliceOfOtherStruct
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []other.StructType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.SliceOfOtherStruct"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *other.StructType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.SliceOfOtherStruct values")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) []other.StructType {
+				return oldObj.SliceOfOtherStruct
+			})
+		errs = append(errs, fn(fldPath.Child("sliceOfOtherStruct"), obj.SliceOfOtherStruct, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.ListMapOfOtherStruct
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []other.StructType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.ListMapOfOtherStruct"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *other.StructType, b *other.StructType) bool { return a.StringField == b.StringField }, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *other.StructType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.SliceOfOtherStruct values")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *other.StructType, b *other.StructType) bool { return a.StringField == b.StringField }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) []other.StructType {
+				return oldObj.ListMapOfOtherStruct
+			})
+		errs = append(errs, fn(fldPath.Child("listMapOfOtherStruct"), obj.ListMapOfOtherStruct, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.MapOfOtherStringToOtherStruct
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[other.StringType]other.StructType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *other.StringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.MapOfOtherStringToOtherStruct keys")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.MapOfOtherStringToOtherStruct"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *other.StructType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.MapOfOtherStringToOtherStruct values")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) map[other.StringType]other.StructType {
+				return oldObj.MapOfOtherStringToOtherStruct
+			})
+		errs = append(errs, fn(fldPath.Child("mapOfOtherStringToOtherStruct"), obj.MapOfOtherStringToOtherStruct, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cross_pkg/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cross_pkg/zz_generated.validations_test.go
new file mode 100644
index 0000000000..0988aa7296
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/cross_pkg/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package crosspkg
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations/doc.go
new file mode 100644
index 0000000000..f72747773b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations/doc.go
@@ -0,0 +1,113 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+// +k8s:validation-gen-test-targets
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package elidenovalidations
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type T1 struct {
+	TypeMeta int
+
+	HasTypeVal HasTypeVal `json:"hasTypeVal"`
+
+	HasFieldVal HasFieldVal `json:"hasFieldVal"`
+
+	HasNoVal HasNoVal `json:"hasNoVal"`
+
+	// +k8s:validateFalse="field T1.HasNoValFieldVal"
+	HasNoValFieldVal HasNoVal `json:"hasNoValFieldVal"`
+
+	ValidatedSlice  TypedefSliceWithValidations  `json:"validatedSlice"`
+	ValidatedMap    TypedefMapWithValidations    `json:"validatedMap"`
+	ValidatedMapKey TypedefMapWithKeyValidations `json:"validatedMapKey"`
+
+	DeepValidatedSlice DeepTypedefSlice `json:"deepValidatedSlice"`
+	DeepValidatedMap   DeepTypedefMap   `json:"deepValidatedMap"`
+
+	DoubleDeepValidatedSlice DoubleDeepTypedefSlice `json:"doubleDeepValidatedSlice           "`
+	DoubleDeepValidatedMap   DoubleDeepTypedefMap   `json:"doubleDeepValidatedMap"`
+}
+
+// +k8s:validateFalse="type HasTypeVal"
+type HasTypeVal struct {
+	// Note: no field validation.
+	S string `json:"s"`
+}
+
+// Note: no type validation.
+type HasFieldVal struct {
+	// +k8s:validateFalse="field HasFieldVal.S"
+	S string `json:"s"`
+}
+
+// Note: no type validation.
+type HasNoVal struct {
+	// Note: no field validation.
+	S string `json:"s"`
+}
+
+// +k8s:validateFalse="type HasTypeValNotLinked"
+type HasTypeValNotLinked struct {
+	// Note: no field validation.
+	S string `json:"s"`
+}
+
+// Note: no type validation.
+type HasFieldValNotLinked struct {
+	// +k8s:validateFalse="field HasFieldValNotLinked.S"
+	S string `json:"s"`
+}
+
+// Note: no type validation.
+type HasNoValNotLinked struct {
+	// Note: no field validation.
+	S string `json:"s"`
+}
+
+// +k8s:validateFalse="type OtherStruct"
+type OtherStruct struct {
+	S string `json:"s"`
+}
+
+// +k8s:validateFalse="type ValidatedKeyType"
+type ValidatedKeyType string
+
+type TypedefSliceWithValidations []OtherStruct
+
+type TypedefMapWithValidations map[string]OtherStruct
+
+type TypedefMapWithKeyValidations map[ValidatedKeyType]string
+
+// FIXME: The following validation is not being generated for DoubleDeepTypedefSlice.
+// Validation-gen is ignoring this validation, because Go directly translates
+// DoubleDeepTypedefSlice to TypedefSliceWithValidations.
+// +k8s:eachVal=+k8s:validateFalse="type DeepTypedefSlice"
+type DeepTypedefSlice TypedefSliceWithValidations
+
+type DeepTypedefMap TypedefMapWithValidations
+
+type DoubleDeepTypedefSlice DeepTypedefSlice
+
+type DoubleDeepTypedefMap DeepTypedefMap
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations/testdata/validate-false.json
new file mode 100644
index 0000000000..70fda952fd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations/testdata/validate-false.json
@@ -0,0 +1,55 @@
+{
+  "*elidenovalidations.T1": {
+    "deepValidatedMap[%ɜ¤0ȻG炕炎鷖Ʊ]": [
+      "type OtherStruct"
+    ],
+    "deepValidatedMap[tƓ晲銩靨能鷸ȳ琍殪]": [
+      "type OtherStruct"
+    ],
+    "deepValidatedSlice[0]": [
+      "type DeepTypedefSlice",
+      "type OtherStruct"
+    ],
+    "deepValidatedSlice[1]": [
+      "type DeepTypedefSlice",
+      "type OtherStruct"
+    ],
+    "doubleDeepValidatedMap[滧ǖvq]": [
+      "type OtherStruct"
+    ],
+    "doubleDeepValidatedMap[黰¢ơđ?ȵɓf*Z迖瓼轊]": [
+      "type OtherStruct"
+    ],
+    "doubleDeepValidatedSlice           [0]": [
+      "type OtherStruct"
+    ],
+    "doubleDeepValidatedSlice           [1]": [
+      "type OtherStruct"
+    ],
+    "hasFieldVal.s": [
+      "field HasFieldVal.S"
+    ],
+    "hasNoValFieldVal": [
+      "field T1.HasNoValFieldVal"
+    ],
+    "hasTypeVal": [
+      "type HasTypeVal"
+    ],
+    "validatedMapKey": [
+      "type ValidatedKeyType",
+      "type ValidatedKeyType"
+    ],
+    "validatedMap[ʅȀʙĄĥ腲ʤaLJ趴]": [
+      "type OtherStruct"
+    ],
+    "validatedMap[赖{³*Ę鄏þƿ髈儱Ŀ蒫÷K]": [
+      "type OtherStruct"
+    ],
+    "validatedSlice[0]": [
+      "type OtherStruct"
+    ],
+    "validatedSlice[1]": [
+      "type OtherStruct"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations/zz_generated.validations.go
new file mode 100644
index 0000000000..fb41e0374c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations/zz_generated.validations.go
@@ -0,0 +1,471 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package elidenovalidations
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_DeepTypedefMap validates an instance of DeepTypedefMap according
+// to declarative validation rules in the API schema.
+func Validate_DeepTypedefMap(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj DeepTypedefMap) (errs field.ErrorList) {
+
+	// iterate the map and call the value type's validation function
+	if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_OtherStruct); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_DeepTypedefSlice validates an instance of DeepTypedefSlice according
+// to declarative validation rules in the API schema.
+func Validate_DeepTypedefSlice(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj DeepTypedefSlice) (errs field.ErrorList) {
+
+	if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type DeepTypedefSlice")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// iterate the list and call the type's validation function
+	if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_OtherStruct); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_DoubleDeepTypedefMap validates an instance of DoubleDeepTypedefMap according
+// to declarative validation rules in the API schema.
+func Validate_DoubleDeepTypedefMap(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj DoubleDeepTypedefMap) (errs field.ErrorList) {
+
+	// iterate the map and call the value type's validation function
+	if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_OtherStruct); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_DoubleDeepTypedefSlice validates an instance of DoubleDeepTypedefSlice according
+// to declarative validation rules in the API schema.
+func Validate_DoubleDeepTypedefSlice(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj DoubleDeepTypedefSlice) (errs field.ErrorList) {
+
+	// iterate the list and call the type's validation function
+	if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_OtherStruct); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_HasFieldVal validates an instance of HasFieldVal according
+// to declarative validation rules in the API schema.
+func Validate_HasFieldVal(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *HasFieldVal) (errs field.ErrorList) {
+
+	{ // field HasFieldVal.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field HasFieldVal.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *HasFieldVal) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_HasTypeVal validates an instance of HasTypeVal according
+// to declarative validation rules in the API schema.
+func Validate_HasTypeVal(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *HasTypeVal) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type HasTypeVal"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field HasTypeVal.S has no validation
+	return errs
+}
+
+// Validate_OtherStruct validates an instance of OtherStruct according
+// to declarative validation rules in the API schema.
+func Validate_OtherStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OtherStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type OtherStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field OtherStruct.S has no validation
+	return errs
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	// field T1.TypeMeta has no validation
+
+	{ // field T1.HasTypeVal
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *HasTypeVal,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_HasTypeVal(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *HasTypeVal {
+				return &oldObj.HasTypeVal
+			})
+		errs = append(errs, fn(fldPath.Child("hasTypeVal"), &obj.HasTypeVal, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.HasFieldVal
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *HasFieldVal,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_HasFieldVal(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *HasFieldVal {
+				return &oldObj.HasFieldVal
+			})
+		errs = append(errs, fn(fldPath.Child("hasFieldVal"), &obj.HasFieldVal, oldVal, oldObj != nil)...)
+	}
+
+	// field T1.HasNoVal has no validation
+
+	{ // field T1.HasNoValFieldVal
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *HasNoVal,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.HasNoValFieldVal"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *HasNoVal {
+				return &oldObj.HasNoValFieldVal
+			})
+		errs = append(errs, fn(fldPath.Child("hasNoValFieldVal"), &obj.HasNoValFieldVal, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.ValidatedSlice
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj TypedefSliceWithValidations,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_TypedefSliceWithValidations(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) TypedefSliceWithValidations {
+				return oldObj.ValidatedSlice
+			})
+		errs = append(errs, fn(fldPath.Child("validatedSlice"), obj.ValidatedSlice, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.ValidatedMap
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj TypedefMapWithValidations,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_TypedefMapWithValidations(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) TypedefMapWithValidations {
+				return oldObj.ValidatedMap
+			})
+		errs = append(errs, fn(fldPath.Child("validatedMap"), obj.ValidatedMap, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.ValidatedMapKey
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj TypedefMapWithKeyValidations,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_TypedefMapWithKeyValidations(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) TypedefMapWithKeyValidations {
+				return oldObj.ValidatedMapKey
+			})
+		errs = append(errs, fn(fldPath.Child("validatedMapKey"), obj.ValidatedMapKey, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.DeepValidatedSlice
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj DeepTypedefSlice,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DeepTypedefSlice(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) DeepTypedefSlice {
+				return oldObj.DeepValidatedSlice
+			})
+		errs = append(errs, fn(fldPath.Child("deepValidatedSlice"), obj.DeepValidatedSlice, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.DeepValidatedMap
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj DeepTypedefMap,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DeepTypedefMap(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) DeepTypedefMap {
+				return oldObj.DeepValidatedMap
+			})
+		errs = append(errs, fn(fldPath.Child("deepValidatedMap"), obj.DeepValidatedMap, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.DoubleDeepValidatedSlice
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj DoubleDeepTypedefSlice,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DoubleDeepTypedefSlice(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) DoubleDeepTypedefSlice {
+				return oldObj.DoubleDeepValidatedSlice
+			})
+		errs = append(errs, fn(fldPath.Child("doubleDeepValidatedSlice           "), obj.DoubleDeepValidatedSlice, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.DoubleDeepValidatedMap
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj DoubleDeepTypedefMap,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DoubleDeepTypedefMap(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) DoubleDeepTypedefMap {
+				return oldObj.DoubleDeepValidatedMap
+			})
+		errs = append(errs, fn(fldPath.Child("doubleDeepValidatedMap"), obj.DoubleDeepValidatedMap, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_TypedefMapWithKeyValidations validates an instance of TypedefMapWithKeyValidations according
+// to declarative validation rules in the API schema.
+func Validate_TypedefMapWithKeyValidations(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj TypedefMapWithKeyValidations) (errs field.ErrorList) {
+
+	// iterate the map and call the key type's validation function
+	if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj, Validate_ValidatedKeyType); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_TypedefMapWithValidations validates an instance of TypedefMapWithValidations according
+// to declarative validation rules in the API schema.
+func Validate_TypedefMapWithValidations(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj TypedefMapWithValidations) (errs field.ErrorList) {
+
+	// iterate the map and call the value type's validation function
+	if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_OtherStruct); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_TypedefSliceWithValidations validates an instance of TypedefSliceWithValidations according
+// to declarative validation rules in the API schema.
+func Validate_TypedefSliceWithValidations(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj TypedefSliceWithValidations) (errs field.ErrorList) {
+
+	// iterate the list and call the type's validation function
+	if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_OtherStruct); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ValidatedKeyType validates an instance of ValidatedKeyType according
+// to declarative validation rules in the API schema.
+func Validate_ValidatedKeyType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ValidatedKeyType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type ValidatedKeyType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations/zz_generated.validations_coverage_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations/zz_generated.validations_coverage_test.go
new file mode 100644
index 0000000000..f9d260d46a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations/zz_generated.validations_coverage_test.go
@@ -0,0 +1,81 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package elidenovalidations
+
+import (
+	fmt "fmt"
+	os "os"
+	testing "testing"
+
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	coverage "k8s.io/apimachinery/pkg/test/coverage"
+)
+
+func init() {
+	coverage.RegisterDeclaredRules(
+		schema.GroupVersionKind{Group: "k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations", Version: "elidenovalidations", Kind: "T1"},
+		coverage.FieldRules{
+			"deepValidatedMap[*]": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"deepValidatedSlice[*]": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"doubleDeepValidatedMap[*]": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"doubleDeepValidatedSlice           [*]": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"hasFieldVal.s": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"hasNoValFieldVal": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"hasTypeVal": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"validatedMapKey": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"validatedMap[*]": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"validatedSlice[*]": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+		},
+	)
+}
+
+func TestMain(m *testing.M) {
+	code := m.Run()
+	if err := coverage.AssertDeclarativeCoverage(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		if code == 0 {
+			code = 1
+		}
+	}
+	os.Exit(code)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations/zz_generated.validations_test.go
new file mode 100644
index 0000000000..c8a8a7fb06
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/elide_no_validations/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package elidenovalidations
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/embedded/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/embedded/doc.go
new file mode 100644
index 0000000000..bbfbed6fdf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/embedded/doc.go
@@ -0,0 +1,48 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package embedded
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type T1 struct {
+	TypeMeta int
+
+	// NOTE: It's weird to have IntField in both, but Go allows it.
+	T2  `json:""`
+	*T3 `json:""`
+}
+
+type T2 struct {
+	// +k8s:validateFalse="T2.IntField"
+	IntField int `json:"intField"`
+}
+
+type T3 struct {
+	// +k8s:validateFalse="T3.StringField"
+	StringField string `json:"stringField"`
+
+	// +k8s:validateFalse="T3.IntField"
+	IntField int `json:"intField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/embedded/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/embedded/testdata/validate-false.json
new file mode 100644
index 0000000000..6c05395412
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/embedded/testdata/validate-false.json
@@ -0,0 +1,13 @@
+{
+  "*embedded.T1": {
+    "T2.intField": [
+      "T2.IntField"
+    ],
+    "T3.intField": [
+      "T3.IntField"
+    ],
+    "T3.stringField": [
+      "T3.StringField"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/embedded/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/embedded/zz_generated.validations.go
new file mode 100644
index 0000000000..c6be187574
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/embedded/zz_generated.validations.go
@@ -0,0 +1,201 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package embedded
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	// field T1.TypeMeta has no validation
+
+	{ // field T1.T2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T2 {
+				return &oldObj.T2
+			})
+		errs = append(errs, fn(safe.Value(fldPath, func() *field.Path { return fldPath.Child("T2") }), &obj.T2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.T3
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T3,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T3(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T3 {
+				return oldObj.T3
+			})
+		errs = append(errs, fn(safe.Value(fldPath, func() *field.Path { return fldPath.Child("T3") }), obj.T3, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T2 validates an instance of T2 according
+// to declarative validation rules in the API schema.
+func Validate_T2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T2) (errs field.ErrorList) {
+
+	{ // field T2.IntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T2.IntField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *int {
+				return &oldObj.IntField
+			})
+		errs = append(errs, fn(fldPath.Child("intField"), &obj.IntField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T3 validates an instance of T3 according
+// to declarative validation rules in the API schema.
+func Validate_T3(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T3) (errs field.ErrorList) {
+
+	{ // field T3.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T3.StringField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T3) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T3.IntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T3.IntField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T3) *int {
+				return &oldObj.IntField
+			})
+		errs = append(errs, fn(fldPath.Child("intField"), &obj.IntField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/embedded/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/embedded/zz_generated.validations_test.go
new file mode 100644
index 0000000000..a71c048db4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/embedded/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package embedded
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/generate.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/generate.go
new file mode 100644
index 0000000000..14fd870eba
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/generate.go
@@ -0,0 +1,22 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Ignore this file to prevent zz_generated for this package
+
+//go:generate go run k8s.io/code-generator/cmd/validation-gen --output-file zz_generated.validations.go --go-header-file=../../../examples/hack/boilerplate.go.txt ./...
+package outputtests
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/keys/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/keys/doc.go
new file mode 100644
index 0000000000..0e396c7cf5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/keys/doc.go
@@ -0,0 +1,65 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package keys
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// +k8s:validateFalse="type Struct"
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field Struct.MapField"
+	// +k8s:eachKey=+k8s:validateFalse="field Struct.MapField(keys)"
+	MapField map[string]string `json:"mapField"`
+
+	// +k8s:validateFalse="field Struct.MapTypedefField"
+	// +k8s:eachKey=+k8s:validateFalse="field Struct.MapTypedefField(keys)"
+	MapTypedefField map[UnvalidatedStringType]string `json:"mapTypedefField"`
+
+	// +k8s:validateFalse="field Struct.MapValidatedTypedefField"
+	// +k8s:eachKey=+k8s:validateFalse="field Struct.MapValidatedTypedefField(keys)"
+	MapValidatedTypedefField map[ValidatedStringType]string `json:"mapValidatedTypedefField"`
+
+	// +k8s:validateFalse="field Struct.MapTypeField"
+	// +k8s:eachKey=+k8s:validateFalse="field Struct.MapTypeField(keys)"
+	MapTypeField UnvalidatedMapType `json:"mapTypeField"`
+
+	// +k8s:validateFalse="field Struct.ValidatedMapTypeField"
+	// +k8s:eachKey=+k8s:validateFalse="field Struct.ValidatedMapTypeField(keys)"
+	ValidatedMapTypeField ValidatedMapType `json:"validatedMapTypeField"`
+}
+
+// Note: no validations.
+type UnvalidatedStringType string
+
+// +k8s:validateFalse="ValidatedStringType"
+type ValidatedStringType string
+
+// Note: no validations.
+type UnvalidatedMapType map[string]string
+
+// +k8s:validateFalse="ValidatedMapType"
+// +k8s:eachKey=+k8s:validateFalse="type ValidatedMapType(keys)"
+type ValidatedMapType map[string]string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/keys/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/keys/testdata/validate-false.json
new file mode 100644
index 0000000000..e8cf6cebfa
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/keys/testdata/validate-false.json
@@ -0,0 +1,37 @@
+{
+  "*keys.Struct": {
+    "": [
+      "type Struct"
+    ],
+    "mapField": [
+      "field Struct.MapField",
+      "field Struct.MapField(keys)",
+      "field Struct.MapField(keys)"
+    ],
+    "mapTypeField": [
+      "field Struct.MapTypeField",
+      "field Struct.MapTypeField(keys)",
+      "field Struct.MapTypeField(keys)"
+    ],
+    "mapTypedefField": [
+      "field Struct.MapTypedefField",
+      "field Struct.MapTypedefField(keys)",
+      "field Struct.MapTypedefField(keys)"
+    ],
+    "mapValidatedTypedefField": [
+      "ValidatedStringType",
+      "ValidatedStringType",
+      "field Struct.MapValidatedTypedefField",
+      "field Struct.MapValidatedTypedefField(keys)",
+      "field Struct.MapValidatedTypedefField(keys)"
+    ],
+    "validatedMapTypeField": [
+      "ValidatedMapType",
+      "field Struct.ValidatedMapTypeField",
+      "field Struct.ValidatedMapTypeField(keys)",
+      "field Struct.ValidatedMapTypeField(keys)",
+      "type ValidatedMapType(keys)",
+      "type ValidatedMapType(keys)"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/keys/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/keys/zz_generated.validations.go
new file mode 100644
index 0000000000..d79569aa2b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/keys/zz_generated.validations.go
@@ -0,0 +1,260 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package keys
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type Struct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField(keys)")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[UnvalidatedStringType]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *UnvalidatedStringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypedefField(keys)")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[UnvalidatedStringType]string {
+				return oldObj.MapTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapTypedefField"), obj.MapTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapValidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[ValidatedStringType]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ValidatedStringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapValidatedTypedefField(keys)")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapValidatedTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the key type's validation function
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj, Validate_ValidatedStringType); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[ValidatedStringType]string {
+				return oldObj.MapValidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapValidatedTypedefField"), obj.MapValidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapTypeField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj UnvalidatedMapType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypeField(keys)")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypeField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) UnvalidatedMapType {
+				return oldObj.MapTypeField
+			})
+		errs = append(errs, fn(fldPath.Child("mapTypeField"), obj.MapTypeField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ValidatedMapTypeField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj ValidatedMapType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ValidatedMapTypeField(keys)")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ValidatedMapTypeField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ValidatedMapType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) ValidatedMapType {
+				return oldObj.ValidatedMapTypeField
+			})
+		errs = append(errs, fn(fldPath.Child("validatedMapTypeField"), obj.ValidatedMapTypeField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ValidatedMapType validates an instance of ValidatedMapType according
+// to declarative validation rules in the API schema.
+func Validate_ValidatedMapType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj ValidatedMapType) (errs field.ErrorList) {
+
+	if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type ValidatedMapType(keys)")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "ValidatedMapType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ValidatedStringType validates an instance of ValidatedStringType according
+// to declarative validation rules in the API schema.
+func Validate_ValidatedStringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ValidatedStringType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "ValidatedStringType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/keys/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/keys/zz_generated.validations_test.go
new file mode 100644
index 0000000000..7cc3aa090f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/keys/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package keys
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/doc.go
new file mode 100644
index 0000000000..a8017edc07
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/doc.go
@@ -0,0 +1,55 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package mapofprimitive
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// +k8s:validateFalse="type Struct"
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field Struct.MapField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapField[*]"
+	MapField map[string]string `json:"mapField"`
+
+	// +k8s:validateFalse="field Struct.MapTypedefField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapTypedefField[*]"
+	MapTypedefField map[string]StringType `json:"mapTypedefField"`
+
+	UnvalidatedMapField map[string]string `json:"UnvalidatedMapField"`
+
+	// +k8s:validateFalse="field Struct.MapPtrField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrField[*]"
+	MapPtrField map[string]*string `json:"mapPtrField"`
+
+	// +k8s:validateFalse="field Struct.MapPtrTypedefField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrTypedefField[*]"
+	MapPtrTypedefField map[string]*StringType `json:"mapPtrTypedefField"`
+
+	UnvalidatedMapPtrField map[string]*string `json:"UnvalidatedMapPtrField"`
+}
+
+// +k8s:validateFalse="type StringType"
+type StringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/testdata/validate-false.json
new file mode 100644
index 0000000000..b7758a6448
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/testdata/validate-false.json
@@ -0,0 +1,47 @@
+{
+  "*mapofprimitive.Struct": {
+    "": [
+      "type Struct"
+    ],
+    "mapField": [
+      "field Struct.MapField"
+    ],
+    "mapField[ÀYǎ3g成oɜH偩j0âȰ]": [
+      "field Struct.MapField[*]"
+    ],
+    "mapField[岯Ȉ\u0026\u003c沲3]": [
+      "field Struct.MapField[*]"
+    ],
+    "mapPtrField": [
+      "field Struct.MapPtrField"
+    ],
+    "mapPtrField[`ȝ懿沇]": [
+      "field Struct.MapPtrField[*]"
+    ],
+    "mapPtrField[ǝ祇Fæƭō]": [
+      "field Struct.MapPtrField[*]"
+    ],
+    "mapPtrTypedefField": [
+      "field Struct.MapPtrTypedefField"
+    ],
+    "mapPtrTypedefField[ʈ劉j蕓ư銩6ij憏歅%ɜ¤0Ȼ]": [
+      "field Struct.MapPtrTypedefField[*]",
+      "type StringType"
+    ],
+    "mapPtrTypedefField[剛ň=Z?ǿ\u003c]": [
+      "field Struct.MapPtrTypedefField[*]",
+      "type StringType"
+    ],
+    "mapTypedefField": [
+      "field Struct.MapTypedefField"
+    ],
+    "mapTypedefField[V噘¢\u003eóDz岋笨Gń條ģ]": [
+      "field Struct.MapTypedefField[*]",
+      "type StringType"
+    ],
+    "mapTypedefField[þƿ髈儱Ŀ蒫÷K鬣壈]": [
+      "field Struct.MapTypedefField[*]",
+      "type StringType"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/zz_generated.validations.go
new file mode 100644
index 0000000000..a4c8f92c3a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/zz_generated.validations.go
@@ -0,0 +1,232 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package mapofprimitive
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_StringType validates an instance of StringType according
+// to declarative validation rules in the API schema.
+func Validate_StringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StringType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type StringType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type Struct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_StringType); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]StringType {
+				return oldObj.MapTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapTypedefField"), obj.MapTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.UnvalidatedMapField has no validation
+
+	{ // field Struct.MapPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]*string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrMapNoNils[string, string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]*string {
+				return oldObj.MapPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("mapPtrField"), obj.MapPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapPtrTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]*StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrMapNoNils[string, StringType](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_StringType); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]*StringType {
+				return oldObj.MapPtrTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapPtrTypedefField"), obj.MapPtrTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.UnvalidatedMapPtrField has no validation
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/zz_generated.validations_test.go
new file mode 100644
index 0000000000..c25381762f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package mapofprimitive
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/doc.go
new file mode 100644
index 0000000000..2f771fb1de
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/doc.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package mapofstruct
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// +k8s:validateFalse="type Struct"
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field Struct.MapField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapField[*]"
+	MapField map[string]OtherStruct `json:"mapField"`
+
+	// +k8s:validateFalse="field Struct.MapTypedefField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapTypedefField[*]"
+	MapTypedefField map[string]OtherTypedefStruct `json:"mapTypedefField"`
+
+	UnvalidatedMapField map[string]UnvalidatedStruct `json:"UnvalidatedMapField"`
+
+	// +k8s:validateFalse="field Struct.MapPtrField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrField[*]"
+	MapPtrField map[string]*OtherStruct `json:"mapPtrField"`
+
+	// +k8s:validateFalse="field Struct.MapPtrTypedefField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrTypedefField[*]"
+	MapPtrTypedefField map[string]*OtherTypedefStruct `json:"mapPtrTypedefField"`
+
+	UnvalidatedMapPtrField map[string]*UnvalidatedStruct `json:"UnvalidatedMapPtrField"`
+}
+
+// +k8s:validateFalse="type OtherStruct"
+type OtherStruct struct{}
+
+// +k8s:validateFalse="type OtherTypedefStruct"
+type OtherTypedefStruct OtherStruct
+
+type UnvalidatedStruct struct{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/testdata/validate-false.json
new file mode 100644
index 0000000000..2253b92760
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/testdata/validate-false.json
@@ -0,0 +1,51 @@
+{
+  "*mapofstruct.Struct": {
+    "": [
+      "type Struct"
+    ],
+    "mapField": [
+      "field Struct.MapField"
+    ],
+    "mapField[岯Ȉ\u0026\u003c沲3]": [
+      "field Struct.MapField[*]",
+      "type OtherStruct"
+    ],
+    "mapField[铃]3g!fȺ苬ĥəƣ]": [
+      "field Struct.MapField[*]",
+      "type OtherStruct"
+    ],
+    "mapPtrField": [
+      "field Struct.MapPtrField"
+    ],
+    "mapPtrField[\u003eóDz岋笨Gń條]": [
+      "field Struct.MapPtrField[*]",
+      "type OtherStruct"
+    ],
+    "mapPtrField[]": [
+      "field Struct.MapPtrField[*]",
+      "type OtherStruct"
+    ],
+    "mapPtrTypedefField": [
+      "field Struct.MapPtrTypedefField"
+    ],
+    "mapPtrTypedefField[v$蛷)讻IeYF墄[C_睿ȉǫ蹟t´]": [
+      "field Struct.MapPtrTypedefField[*]",
+      "type OtherTypedefStruct"
+    ],
+    "mapPtrTypedefField[ș$0đ\u003eƯ]ɹȽ東]": [
+      "field Struct.MapPtrTypedefField[*]",
+      "type OtherTypedefStruct"
+    ],
+    "mapTypedefField": [
+      "field Struct.MapTypedefField"
+    ],
+    "mapTypedefField[]": [
+      "field Struct.MapTypedefField[*]",
+      "type OtherTypedefStruct"
+    ],
+    "mapTypedefField[x飖Ǒp!ǪŰ]": [
+      "field Struct.MapTypedefField[*]",
+      "type OtherTypedefStruct"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/zz_generated.validations.go
new file mode 100644
index 0000000000..ebe69b0254
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/zz_generated.validations.go
@@ -0,0 +1,253 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package mapofstruct
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_OtherStruct validates an instance of OtherStruct according
+// to declarative validation rules in the API schema.
+func Validate_OtherStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OtherStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type OtherStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_OtherTypedefStruct validates an instance of OtherTypedefStruct according
+// to declarative validation rules in the API schema.
+func Validate_OtherTypedefStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OtherTypedefStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type OtherTypedefStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type Struct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_OtherStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]OtherStruct {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]OtherTypedefStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherTypedefStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_OtherTypedefStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]OtherTypedefStruct {
+				return oldObj.MapTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapTypedefField"), obj.MapTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.UnvalidatedMapField has no validation
+
+	{ // field Struct.MapPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]*OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrMapNoNils[string, OtherStruct](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_OtherStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]*OtherStruct {
+				return oldObj.MapPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("mapPtrField"), obj.MapPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapPtrTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]*OtherTypedefStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrMapNoNils[string, OtherTypedefStruct](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherTypedefStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_OtherTypedefStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]*OtherTypedefStruct {
+				return oldObj.MapPtrTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapPtrTypedefField"), obj.MapPtrTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.UnvalidatedMapPtrField has no validation
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/zz_generated.validations_test.go
new file mode 100644
index 0000000000..fab636bc7a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package mapofstruct
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/multiple_validations/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/multiple_validations/doc.go
new file mode 100644
index 0000000000..bdd9f638fe
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/multiple_validations/doc.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package multiplevalidations
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// +k8s:validateFalse="type Struct"
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field Struct.MapField #1"
+	// +k8s:validateFalse="field Struct.MapField #2"
+	// +k8s:eachKey=+k8s:validateFalse="field Struct.MapField(keys) #1"
+	// +k8s:eachKey=+k8s:validateFalse="field Struct.MapField(keys) #2"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapField[*] #1"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapField[*] #2"
+	MapField map[string]string `json:"mapField"`
+
+	UnvalidatedMapField []string `json:"UnvalidatedMapField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/multiple_validations/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/multiple_validations/testdata/validate-false.json
new file mode 100644
index 0000000000..ea27e9a111
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/multiple_validations/testdata/validate-false.json
@@ -0,0 +1,23 @@
+{
+  "*multiplevalidations.Struct": {
+    "": [
+      "type Struct"
+    ],
+    "mapField": [
+      "field Struct.MapField #1",
+      "field Struct.MapField #2",
+      "field Struct.MapField(keys) #1",
+      "field Struct.MapField(keys) #1",
+      "field Struct.MapField(keys) #2",
+      "field Struct.MapField(keys) #2"
+    ],
+    "mapField[ÀYǎ3g成oɜH偩j0âȰ]": [
+      "field Struct.MapField[*] #1",
+      "field Struct.MapField[*] #2"
+    ],
+    "mapField[岯Ȉ\u0026\u003c沲3]": [
+      "field Struct.MapField[*] #1",
+      "field Struct.MapField[*] #2"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/multiple_validations/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/multiple_validations/zz_generated.validations.go
new file mode 100644
index 0000000000..2578e4ca88
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/multiple_validations/zz_generated.validations.go
@@ -0,0 +1,124 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package multiplevalidations
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type Struct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField(keys) #1")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField(keys) #2")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField #1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField #2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField[*] #1")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField[*] #2")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.UnvalidatedMapField has no validation
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/multiple_validations/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/multiple_validations/zz_generated.validations_test.go
new file mode 100644
index 0000000000..d30e8f8db8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/multiple_validations/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package multiplevalidations
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/doc.go
new file mode 100644
index 0000000000..a4b62cc13e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/doc.go
@@ -0,0 +1,77 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package typedeftomap
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Note: no validation here
+type UnvalidatedType map[string]string
+
+// Note: no validation here
+type UnvalidatedPtrType map[string]*string
+
+// +k8s:validateFalse="type MapType"
+// +k8s:eachVal=+k8s:validateFalse="type MapType[*]"
+type MapType map[string]string
+
+// +k8s:validateFalse="type MapPtrType"
+// +k8s:eachVal=+k8s:validateFalse="type MapPtrType[*]"
+type MapPtrType map[string]*string
+
+// +k8s:validateFalse="type MapTypedefType"
+// +k8s:eachVal=+k8s:validateFalse="type MapTypedefType[*]"
+type MapTypedefType map[string]StringType
+
+// +k8s:validateFalse="type MapPtrTypedefType"
+// +k8s:eachVal=+k8s:validateFalse="type MapPtrTypedefType[*]"
+type MapPtrTypedefType map[string]*StringType
+
+// +k8s:validateFalse="type StringType"
+type StringType string
+
+// +k8s:validateFalse="type Struct"
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field Struct.MapField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapField[*]"
+	MapField MapType `json:"mapField"`
+
+	// +k8s:validateFalse="field Struct.MapTypedefField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapTypedefField[*]"
+	MapTypedefField MapTypedefType `json:"mapTypedefField"`
+
+	UnvalidatedMapField UnvalidatedType `json:"UnvalidatedMapField"`
+
+	// +k8s:validateFalse="field Struct.MapPtrField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrField[*]"
+	MapPtrField MapPtrType `json:"mapPtrField"`
+
+	// +k8s:validateFalse="field Struct.MapPtrTypedefField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrTypedefField[*]"
+	MapPtrTypedefField MapPtrTypedefType `json:"mapPtrTypedefField"`
+
+	UnvalidatedMapPtrField UnvalidatedPtrType `json:"UnvalidatedMapPtrField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/testdata/validate-false.json
new file mode 100644
index 0000000000..65a321116f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/testdata/validate-false.json
@@ -0,0 +1,59 @@
+{
+  "*typedeftomap.Struct": {
+    "": [
+      "type Struct"
+    ],
+    "mapField": [
+      "field Struct.MapField",
+      "type MapType"
+    ],
+    "mapField[ÀYǎ3g成oɜH偩j0âȰ]": [
+      "field Struct.MapField[*]",
+      "type MapType[*]"
+    ],
+    "mapField[岯Ȉ\u0026\u003c沲3]": [
+      "field Struct.MapField[*]",
+      "type MapType[*]"
+    ],
+    "mapPtrField": [
+      "field Struct.MapPtrField",
+      "type MapPtrType"
+    ],
+    "mapPtrField[`ȝ懿沇]": [
+      "field Struct.MapPtrField[*]",
+      "type MapPtrType[*]"
+    ],
+    "mapPtrField[ǝ祇Fæƭō]": [
+      "field Struct.MapPtrField[*]",
+      "type MapPtrType[*]"
+    ],
+    "mapPtrTypedefField": [
+      "field Struct.MapPtrTypedefField",
+      "type MapPtrTypedefType"
+    ],
+    "mapPtrTypedefField[ʈ劉j蕓ư銩6ij憏歅%ɜ¤0Ȼ]": [
+      "field Struct.MapPtrTypedefField[*]",
+      "type MapPtrTypedefType[*]",
+      "type StringType"
+    ],
+    "mapPtrTypedefField[剛ň=Z?ǿ\u003c]": [
+      "field Struct.MapPtrTypedefField[*]",
+      "type MapPtrTypedefType[*]",
+      "type StringType"
+    ],
+    "mapTypedefField": [
+      "field Struct.MapTypedefField",
+      "type MapTypedefType"
+    ],
+    "mapTypedefField[V噘¢\u003eóDz岋笨Gń條ģ]": [
+      "field Struct.MapTypedefField[*]",
+      "type MapTypedefType[*]",
+      "type StringType"
+    ],
+    "mapTypedefField[þƿ髈儱Ŀ蒫÷K鬣壈]": [
+      "field Struct.MapTypedefField[*]",
+      "type MapTypedefType[*]",
+      "type StringType"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/zz_generated.validations.go
new file mode 100644
index 0000000000..15a29c153d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/zz_generated.validations.go
@@ -0,0 +1,318 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package typedeftomap
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_MapPtrType validates an instance of MapPtrType according
+// to declarative validation rules in the API schema.
+func Validate_MapPtrType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj MapPtrType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapPtrType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapPtrType[*]")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_MapPtrTypedefType validates an instance of MapPtrTypedefType according
+// to declarative validation rules in the API schema.
+func Validate_MapPtrTypedefType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj MapPtrTypedefType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapPtrTypedefType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapPtrTypedefType[*]")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// iterate the map and call the value type's validation function
+	if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_StringType); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_MapType validates an instance of MapType according
+// to declarative validation rules in the API schema.
+func Validate_MapType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj MapType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapType[*]")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_MapTypedefType validates an instance of MapTypedefType according
+// to declarative validation rules in the API schema.
+func Validate_MapTypedefType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj MapTypedefType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapTypedefType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapTypedefType[*]")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// iterate the map and call the value type's validation function
+	if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_StringType); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_StringType validates an instance of StringType according
+// to declarative validation rules in the API schema.
+func Validate_StringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StringType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type StringType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type Struct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj MapType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_MapType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) MapType {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj MapTypedefType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_MapTypedefType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) MapTypedefType {
+				return oldObj.MapTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapTypedefField"), obj.MapTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.UnvalidatedMapField has no validation
+
+	{ // field Struct.MapPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj MapPtrType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrMapNoNils[string, string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_MapPtrType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) MapPtrType {
+				return oldObj.MapPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("mapPtrField"), obj.MapPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapPtrTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj MapPtrTypedefType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrMapNoNils[string, StringType](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_MapPtrTypedefType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) MapPtrTypedefType {
+				return oldObj.MapPtrTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapPtrTypedefField"), obj.MapPtrTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.UnvalidatedMapPtrField has no validation
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/zz_generated.validations_test.go
new file mode 100644
index 0000000000..d04e460740
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package typedeftomap
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/consumer/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/consumer/doc.go
new file mode 100644
index 0000000000..b71be252dc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/consumer/doc.go
@@ -0,0 +1,27 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Its types reference ../types; validators must call the canonical (registered) copy.
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package consumer
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/consumer/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/consumer/types.go
new file mode 100644
index 0000000000..6158792959
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/consumer/types.go
@@ -0,0 +1,25 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package consumer
+
+import "k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/types"
+
+type Consumer struct {
+	TypeMeta int
+
+	Shared types.T2 `json:"shared"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/consumer/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/consumer/zz_generated.validations.go
new file mode 100644
index 0000000000..7025a9c8d2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/consumer/zz_generated.validations.go
@@ -0,0 +1,90 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package consumer
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	registered "k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/registered"
+	types "k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/types"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Consumer
+	scheme.AddValidationFunc(
+		(*Consumer)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Consumer(
+					ctx, op, nil, /* fldPath */
+					obj.(*Consumer),
+					safe.Cast[*Consumer](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Consumer validates an instance of Consumer according
+// to declarative validation rules in the API schema.
+func Validate_Consumer(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Consumer) (errs field.ErrorList) {
+
+	// field Consumer.TypeMeta has no validation
+
+	{ // field Consumer.Shared
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *types.T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, registered.Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Consumer) *types.T2 {
+				return &oldObj.Shared
+			})
+		errs = append(errs, fn(fldPath.Child("shared"), &obj.Shared, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/external/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/external/doc.go
new file mode 100644
index 0000000000..e1f9c1e0f0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/external/doc.go
@@ -0,0 +1,24 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// A non-registering copy of ../types' validators, selecting all types via *.
+// +k8s:validation-gen=*
+// +k8s:validation-gen-input=k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/types
+// +k8s:validation-gen-scheme-registry=nil
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package external
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/external/validation_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/external/validation_test.go
new file mode 100644
index 0000000000..fa271ca9c0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/external/validation_test.go
@@ -0,0 +1,50 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package external
+
+import (
+	"context"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/registered"
+	"k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/types"
+)
+
+// TestSelfContained runs this non-registering package's validators via direct
+// calls (no scheme) and checks they agree with the registered copy.
+func TestSelfContained(t *testing.T) {
+	ctx := context.Background()
+	matcher := field.ErrorMatcher{}.ByField().ByDetailExact()
+
+	// Shared types must match the registered copy.
+	obj := &types.T1{List: []types.T2{{}, {}}}
+	ext := Validate_T1(ctx, operation.Operation{}, nil, obj, nil)
+	if len(ext) == 0 {
+		t.Fatalf("expected validation errors from Validate_T1, got none")
+	}
+	reg := registered.Validate_T1(ctx, operation.Operation{}, nil, obj, nil)
+	matcher.Test(t, reg, ext)
+
+	// T3 is selected only by external; registered has no Validate_T3.
+	got := Validate_T3(ctx, operation.Operation{}, nil, &types.T3{}, nil)
+	want := field.ErrorList{
+		field.Invalid(field.NewPath("s"), nil, "forced failure: field T3.S"),
+	}
+	matcher.Test(t, want, got)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/external/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/external/zz_generated.validations.go
new file mode 100644
index 0000000000..816b2e3cc3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/external/zz_generated.validations.go
@@ -0,0 +1,167 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package external
+
+import (
+	context "context"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	types "k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/types"
+)
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *types.T1) (errs field.ErrorList) {
+
+	// field types.T1.TypeMeta has no validation
+
+	{ // field types.T1.T2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *types.T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.T2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *types.T1) *types.T2 {
+				return &oldObj.T2
+			})
+		errs = append(errs, fn(fldPath.Child("t2"), &obj.T2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field types.T1.List
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []types.T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *types.T2) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.List[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_T2); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *types.T1) []types.T2 {
+				return oldObj.List
+			})
+		errs = append(errs, fn(fldPath.Child("list"), obj.List, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T2 validates an instance of T2 according
+// to declarative validation rules in the API schema.
+func Validate_T2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *types.T2) (errs field.ErrorList) {
+
+	{ // field types.T2.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *types.T2) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T3 validates an instance of T3 according
+// to declarative validation rules in the API schema.
+func Validate_T3(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *types.T3) (errs field.ErrorList) {
+
+	{ // field types.T3.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T3.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *types.T3) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/registered/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/registered/doc.go
new file mode 100644
index 0000000000..9f87aeceef
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/registered/doc.go
@@ -0,0 +1,28 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// The registered (canonical) copy of ../types' validators.
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-input=k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/types
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package registered
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/registered/validation_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/registered/validation_test.go
new file mode 100644
index 0000000000..98e5aa632a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/registered/validation_test.go
@@ -0,0 +1,33 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package registered
+
+import (
+	"testing"
+
+	"k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/types"
+)
+
+// Test runs the registering copy through its scheme.
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&types.T1{}).ExpectValidateFalseByPath(map[string][]string{
+		"t2":   {"field T1.T2"},
+		"t2.s": {"field T2.S"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/registered/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/registered/zz_generated.validations.go
new file mode 100644
index 0000000000..47ff25fa02
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/registered/zz_generated.validations.go
@@ -0,0 +1,159 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package registered
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	types "k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/types"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*types.T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*types.T1),
+					safe.Cast[*types.T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *types.T1) (errs field.ErrorList) {
+
+	// field types.T1.TypeMeta has no validation
+
+	{ // field types.T1.T2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *types.T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.T2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *types.T1) *types.T2 {
+				return &oldObj.T2
+			})
+		errs = append(errs, fn(fldPath.Child("t2"), &obj.T2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field types.T1.List
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []types.T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *types.T2) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.List[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_T2); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *types.T1) []types.T2 {
+				return oldObj.List
+			})
+		errs = append(errs, fn(fldPath.Child("list"), obj.List, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T2 validates an instance of T2 according
+// to declarative validation rules in the API schema.
+func Validate_T2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *types.T2) (errs field.ErrorList) {
+
+	{ // field types.T2.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *types.T2) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/types/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/types/types.go
new file mode 100644
index 0000000000..75c7f058b4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_packages/types/types.go
@@ -0,0 +1,40 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package types holds the shared input types generated into ../registered and
+// ../external and referenced by ../consumer.
+package types
+
+type T1 struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field T1.T2"
+	T2 T2 `json:"t2"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field T1.List[*]"
+	List []T2 `json:"list"`
+}
+
+type T2 struct {
+	// +k8s:validateFalse="field T2.S"
+	S string `json:"s"`
+}
+
+// T3 has no TypeMeta, so only external's validation-gen=* selects it.
+type T3 struct {
+	// +k8s:validateFalse="field T3.S"
+	S string `json:"s"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_tags/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_tags/doc.go
new file mode 100644
index 0000000000..b92b11fcc9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_tags/doc.go
@@ -0,0 +1,58 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package multipletags
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// validateTrue should sort after validateFalse, but all the validateFalse
+// should retain their order.
+
+// +k8s:validateTrue="type T1 #0"
+// +k8s:validateFalse="type T1 #1"
+// +k8s:validateFalse="type T1 #2"
+// +k8s:validateFalse="type T1 #3"
+type T1 struct {
+	TypeMeta int
+	// +k8s:validateTrue="field T1.S true"
+	// +k8s:validateFalse="field T1.S false #1"
+	// +k8s:validateFalse="field T1.S false #2"
+	// +k8s:validateFalse="field T1.S false #3"
+	S string `json:"s"`
+	// +k8s:validateTrue="field T1.T2 true"
+	// +k8s:validateFalse="field T1.T2 false #1"
+	// +k8s:validateFalse="field T1.T2 false #2"
+	// +k8s:validateFalse="field T1.T2 false #3"
+	T2 T2 `json:"t2"`
+}
+
+// +k8s:validateTrue="type T2 true"
+// +k8s:validateFalse="type T2 false #1"
+// +k8s:validateFalse="type T2 false #2"
+type T2 struct {
+	// +k8s:validateTrue="field T2.S true"
+	// +k8s:validateFalse="field T2.S false #1"
+	// +k8s:validateFalse="field T2.S false #2"
+	S string `json:"s"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_tags/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_tags/testdata/validate-false.json
new file mode 100644
index 0000000000..7b8a6fec4a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_tags/testdata/validate-false.json
@@ -0,0 +1,25 @@
+{
+  "*multipletags.T1": {
+    "": [
+      "type T1 #1",
+      "type T1 #2",
+      "type T1 #3"
+    ],
+    "s": [
+      "field T1.S false #1",
+      "field T1.S false #2",
+      "field T1.S false #3"
+    ],
+    "t2": [
+      "field T1.T2 false #1",
+      "field T1.T2 false #2",
+      "field T1.T2 false #3",
+      "type T2 false #1",
+      "type T2 false #2"
+    ],
+    "t2.s": [
+      "field T2.S false #1",
+      "field T2.S false #2"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_tags/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_tags/zz_generated.validations.go
new file mode 100644
index 0000000000..5b1416b359
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_tags/zz_generated.validations.go
@@ -0,0 +1,197 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package multipletags
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T1 #1"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T1 #2"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T1 #3"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "type T1 #0"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field T1.TypeMeta has no validation
+
+	{ // field T1.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.S false #1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.S false #2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.S false #3"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.S true"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.T2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.T2 false #1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.T2 false #2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.T2 false #3"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.T2 true"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T2 {
+				return &oldObj.T2
+			})
+		errs = append(errs, fn(fldPath.Child("t2"), &obj.T2, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T2 validates an instance of T2 according
+// to declarative validation rules in the API schema.
+func Validate_T2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T2) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T2 false #1"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T2 false #2"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "type T2 true"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field T2.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.S false #1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.S false #2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T2.S true"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_tags/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_tags/zz_generated.validations_test.go
new file mode 100644
index 0000000000..c3e7bd7643
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/multiple_tags/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package multipletags
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/no_generation/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/no_generation/doc.go
new file mode 100644
index 0000000000..a7063c8b0c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/no_generation/doc.go
@@ -0,0 +1,45 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Note: validation generation is not enabled.
+
+// Package nogeneration is a test package.
+//
+// +k8s:validation-gen-nolint
+//
+//nolint:unused
+package nogeneration
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type T1 struct {
+	// +k8s:validateFalse="from field T1.S"
+	S string
+	// +k8s:validateFalse="from field T1.T2"
+	T2 T2
+}
+
+type T2 struct {
+	// +k8s:validateFalse="from field T2.S"
+	S string
+}
+
+type private struct {
+	// +k8s:validateFalse="from field private.S"
+	S string
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/no_types_match/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/no_types_match/doc.go
new file mode 100644
index 0000000000..9e83aafd30
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/no_types_match/doc.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Note: no types match this.
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package notypesmatch
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type T1 struct {
+	// +k8s:validateFalse="from field T1.S"
+	S string
+	// +k8s:validateFalse="from field T1.T2"
+	T2 T2
+}
+
+type T2 struct {
+	// +k8s:validateFalse="from field T2.S"
+	S string
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/no_types_match/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/no_types_match/testdata/validate-false.json
new file mode 100644
index 0000000000..9e26dfeeb6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/no_types_match/testdata/validate-false.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/no_types_match/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/no_types_match/zz_generated.validations.go
new file mode 100644
index 0000000000..e754b00e83
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/no_types_match/zz_generated.validations.go
@@ -0,0 +1,22 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package notypesmatch
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/no_types_match/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/no_types_match/zz_generated.validations_test.go
new file mode 100644
index 0000000000..d065ce1373
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/no_types_match/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package notypesmatch
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/trivial/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/trivial/doc.go
new file mode 100644
index 0000000000..357ae69cdc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/trivial/doc.go
@@ -0,0 +1,30 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package trivial
+
+type T1 struct {
+	TypeMeta int
+}
+
+type T2 struct{}
+
+type E1 string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/trivial/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/trivial/zz_generated.validations.go
new file mode 100644
index 0000000000..7fa85b5807
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/trivial/zz_generated.validations.go
@@ -0,0 +1,22 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package trivial
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_field_validations/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_field_validations/doc.go
new file mode 100644
index 0000000000..cd04410ced
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_field_validations/doc.go
@@ -0,0 +1,79 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package withfieldvalidations
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type T1 struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field T1.S"
+	S string `json:"s"`
+	// +k8s:validateFalse="field T1.T2"
+	T2 T2 `json:"t2"`
+	// +k8s:validateFalse="field T1.T3"
+	T3 T3 `json:"t3"`
+
+	// +k8s:validateFalse="field T1.E1"
+	E1 E1 `json:"e1"`
+	// +k8s:validateFalse="field T1.E2"
+	E2 E2 `json:"e2"`
+}
+
+// Note: this has validations and is linked into T1.
+type T2 struct {
+	// +k8s:validateFalse="field T2.S"
+	S string `json:"s"`
+}
+
+// Note: this has no validations and is linked into T1.
+type T3 struct {
+	S string `json:"s"`
+}
+
+// Note: this has validations and is not linked into T1.
+type T4 struct {
+	// +k8s:validateFalse="field T4.S"
+	S string `json:"s"`
+}
+
+// Note: this has no validations and is not linked into T1.
+type T5 struct {
+	S string `json:"s"`
+}
+
+// Note: this has validations and is linked into T1.
+// +k8s:validateFalse="type E1"
+type E1 string
+
+// Note: this has no validations and is linked into T1.
+type E2 string
+
+// Note: this has validations and is not linked into T1.
+// +k8s:validateFalse="field type E3"
+type E3 string
+
+// Note: this has no validations and is not linked into T1.
+type E4 string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_field_validations/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_field_validations/testdata/validate-false.json
new file mode 100644
index 0000000000..1f9f7529be
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_field_validations/testdata/validate-false.json
@@ -0,0 +1,23 @@
+{
+  "*withfieldvalidations.T1": {
+    "e1": [
+      "field T1.E1",
+      "type E1"
+    ],
+    "e2": [
+      "field T1.E2"
+    ],
+    "s": [
+      "field T1.S"
+    ],
+    "t2": [
+      "field T1.T2"
+    ],
+    "t2.s": [
+      "field T2.S"
+    ],
+    "t3": [
+      "field T1.T3"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_field_validations/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_field_validations/zz_generated.validations.go
new file mode 100644
index 0000000000..7ce6c6c862
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_field_validations/zz_generated.validations.go
@@ -0,0 +1,237 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package withfieldvalidations
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_E1 validates an instance of E1 according
+// to declarative validation rules in the API schema.
+func Validate_E1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *E1) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type E1"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	// field T1.TypeMeta has no validation
+
+	{ // field T1.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.T2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.T2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T2 {
+				return &oldObj.T2
+			})
+		errs = append(errs, fn(fldPath.Child("t2"), &obj.T2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.T3
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T3,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.T3"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T3 {
+				return &oldObj.T3
+			})
+		errs = append(errs, fn(fldPath.Child("t3"), &obj.T3, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.E1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *E1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.E1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_E1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *E1 {
+				return &oldObj.E1
+			})
+		errs = append(errs, fn(fldPath.Child("e1"), &obj.E1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.E2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *E2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.E2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *E2 {
+				return &oldObj.E2
+			})
+		errs = append(errs, fn(fldPath.Child("e2"), &obj.E2, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T2 validates an instance of T2 according
+// to declarative validation rules in the API schema.
+func Validate_T2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T2) (errs field.ErrorList) {
+
+	{ // field T2.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_field_validations/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_field_validations/zz_generated.validations_test.go
new file mode 100644
index 0000000000..d96d788694
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_field_validations/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package withfieldvalidations
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_type_validations/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_type_validations/doc.go
new file mode 100644
index 0000000000..a439eda809
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_type_validations/doc.go
@@ -0,0 +1,38 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package withtypevalidations
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// +k8s:validateFalse="type T1"
+type T1 struct {
+	TypeMeta int
+}
+
+// Note: this has no validations.
+type T2 struct{}
+
+// +k8s:validateFalse="type E1"
+type E1 string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_type_validations/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_type_validations/testdata/validate-false.json
new file mode 100644
index 0000000000..4129153986
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_type_validations/testdata/validate-false.json
@@ -0,0 +1,7 @@
+{
+  "*withtypevalidations.T1": {
+    "": [
+      "type T1"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_type_validations/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_type_validations/zz_generated.validations.go
new file mode 100644
index 0000000000..1508bd7134
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_type_validations/zz_generated.validations.go
@@ -0,0 +1,70 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package withtypevalidations
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T1"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field T1.TypeMeta has no validation
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_type_validations/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_type_validations/zz_generated.validations_test.go
new file mode 100644
index 0000000000..97db075d26
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/one_type_match/with_type_validations/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package withtypevalidations
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/structs/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/structs/doc.go
new file mode 100644
index 0000000000..d159e24691
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/structs/doc.go
@@ -0,0 +1,123 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package structs
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Tother struct {
+	// +k8s:validateFalse="Tother, no flags"
+	OS string `json:"os"`
+}
+
+// Treat these as 4 bits, and ensure all combinations
+//   bit 0: no flags
+//   bit 1: ShortCircuit
+
+// Note: No validations.
+type T00 struct {
+	TypeMeta int
+	S        string  `json:"s"`
+	PS       *string `json:"ps"`
+	T        Tother  `json:"t"`
+	PT       *Tother `json:"pt"`
+}
+
+// +k8s:validateFalse="T01, no flags"
+type T01 struct {
+	TypeMeta int
+	// +k8s:validateFalse="T01.S, no flags"
+	S string `json:"s"`
+	// +k8s:validateFalse="T01.PS, no flags"
+	PS *string `json:"ps"`
+	// +k8s:validateFalse="T01.T, no flags"
+	T Tother `json:"t"`
+	// +k8s:validateFalse="T01.PT, no flags"
+	PT *Tother `json:"pt"`
+}
+
+// +k8s:validateFalse(flags: "ShortCircuit")="T02, ShortCircuit"
+type T02 struct {
+	TypeMeta int
+	// +k8s:validateFalse(flags: "ShortCircuit")="T02.S, ShortCircuit"
+	S string `json:"s"`
+	// +k8s:validateFalse(flags: "ShortCircuit")="T02.PS, ShortCircuit"
+	PS *string `json:"ps"`
+	// +k8s:validateFalse(flags: "ShortCircuit")="T02.T, ShortCircuit"
+	T Tother `json:"t"`
+	// +k8s:validateFalse(flags: "ShortCircuit")="T02.PT, ShortCircuit"
+	PT *Tother `json:"pt"`
+}
+
+// +k8s:validateFalse="T03, no flags"
+// +k8s:validateFalse(flags: "ShortCircuit")="T03, ShortCircuit"
+type T03 struct {
+	TypeMeta int
+	// +k8s:validateFalse="T03.S, no flags"
+	// +k8s:validateFalse(flags: "ShortCircuit")="T03.S, ShortCircuit"
+	S string `json:"s"`
+	// +k8s:validateFalse="T03.PS, no flags"
+	// +k8s:validateFalse(flags: "ShortCircuit")="T03.PS, ShortCircuit"
+	PS *string `json:"ps"`
+	// +k8s:validateFalse="T03.T, no flags"
+	// +k8s:validateFalse(flags: "ShortCircuit")="T03.T, ShortCircuit"
+	T Tother `json:"t"`
+	// +k8s:validateFalse="T03.PT, no flags"
+	// +k8s:validateFalse(flags: "ShortCircuit")="T03.PT, ShortCircuit"
+	PT *Tother `json:"pt"`
+}
+
+// Note: these are intentionally in the wrong final order.
+// +k8s:validateFalse="TMultiple, no flags 1"
+// +k8s:validateFalse(flags: "ShortCircuit")="TMultiple, ShortCircuit 1"
+// +k8s:validateFalse="T0, string payload"
+// +k8s:validateFalse="TMultiple, no flags 2"
+// +k8s:validateFalse(flags: "ShortCircuit")="TMultiple, ShortCircuit 2"
+type TMultiple struct {
+	TypeMeta int
+	// +k8s:validateFalse="TMultiple.S, no flags 1"
+	// +k8s:validateFalse(flags: "ShortCircuit")="TMultiple.S, ShortCircuit 1"
+	// +k8s:validateFalse="T0, string payload"
+	// +k8s:validateFalse="TMultiple.S, no flags 2"
+	// +k8s:validateFalse(flags: "ShortCircuit")="TMultiple.S, ShortCircuit 2"
+	S string `json:"s"`
+	// +k8s:validateFalse="TMultiple.PS, no flags 1"
+	// +k8s:validateFalse(flags: "ShortCircuit")="TMultiple.PS, ShortCircuit 1"
+	// +k8s:validateFalse="T0, string payload"
+	// +k8s:validateFalse="TMultiple.PS, no flags 2"
+	// +k8s:validateFalse(flags: "ShortCircuit")="TMultiple.PS, ShortCircuit 2"
+	PS *string `json:"ps"`
+	// +k8s:validateFalse="TMultiple.T, no flags 1"
+	// +k8s:validateFalse(flags: "ShortCircuit")="TMultiple.T, ShortCircuit 1"
+	// +k8s:validateFalse="T0, string payload"
+	// +k8s:validateFalse="TMultiple.T, no flags 2"
+	// +k8s:validateFalse(flags: "ShortCircuit")="TMultiple.T, ShortCircuit 2"
+	T Tother `json:"t"`
+	// +k8s:validateFalse="TMultiple.PT, no flags 1"
+	// +k8s:validateFalse(flags: "ShortCircuit")="TMultiple.PT, ShortCircuit 1"
+	// +k8s:validateFalse="T0, string payload"
+	// +k8s:validateFalse="TMultiple.PT, no flags 2"
+	// +k8s:validateFalse(flags: "ShortCircuit")="TMultiple.PT, ShortCircuit 2"
+	PT *Tother `json:"pt"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/structs/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/structs/testdata/validate-false.json
new file mode 100644
index 0000000000..f1fd2b1edf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/structs/testdata/validate-false.json
@@ -0,0 +1,49 @@
+{
+  "*structs.T00": {
+    "pt.os": [
+      "Tother, no flags"
+    ],
+    "t.os": [
+      "Tother, no flags"
+    ]
+  },
+  "*structs.T01": {
+    "": [
+      "T01, no flags"
+    ],
+    "ps": [
+      "T01.PS, no flags"
+    ],
+    "pt": [
+      "T01.PT, no flags"
+    ],
+    "pt.os": [
+      "Tother, no flags"
+    ],
+    "s": [
+      "T01.S, no flags"
+    ],
+    "t": [
+      "T01.T, no flags"
+    ],
+    "t.os": [
+      "Tother, no flags"
+    ]
+  },
+  "*structs.T02": {
+    "": [
+      "T02, ShortCircuit"
+    ]
+  },
+  "*structs.T03": {
+    "": [
+      "T03, ShortCircuit"
+    ]
+  },
+  "*structs.TMultiple": {
+    "": [
+      "TMultiple, ShortCircuit 1",
+      "TMultiple, ShortCircuit 2"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/structs/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/structs/zz_generated.validations.go
new file mode 100644
index 0000000000..24024aa54b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/structs/zz_generated.validations.go
@@ -0,0 +1,821 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package structs
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T00
+	scheme.AddValidationFunc(
+		(*T00)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T00(
+					ctx, op, nil, /* fldPath */
+					obj.(*T00),
+					safe.Cast[*T00](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T01
+	scheme.AddValidationFunc(
+		(*T01)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T01(
+					ctx, op, nil, /* fldPath */
+					obj.(*T01),
+					safe.Cast[*T01](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T02
+	scheme.AddValidationFunc(
+		(*T02)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T02(
+					ctx, op, nil, /* fldPath */
+					obj.(*T02),
+					safe.Cast[*T02](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T03
+	scheme.AddValidationFunc(
+		(*T03)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T03(
+					ctx, op, nil, /* fldPath */
+					obj.(*T03),
+					safe.Cast[*T03](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type TMultiple
+	scheme.AddValidationFunc(
+		(*TMultiple)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_TMultiple(
+					ctx, op, nil, /* fldPath */
+					obj.(*TMultiple),
+					safe.Cast[*TMultiple](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T00 validates an instance of T00 according
+// to declarative validation rules in the API schema.
+func Validate_T00(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T00) (errs field.ErrorList) {
+
+	// field T00.TypeMeta has no validation
+	// field T00.S has no validation
+	// field T00.PS has no validation
+
+	{ // field T00.T
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Tother,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Tother(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T00) *Tother {
+				return &oldObj.T
+			})
+		errs = append(errs, fn(fldPath.Child("t"), &obj.T, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T00.PT
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Tother,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Tother(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T00) *Tother {
+				return oldObj.PT
+			})
+		errs = append(errs, fn(fldPath.Child("pt"), obj.PT, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T01 validates an instance of T01 according
+// to declarative validation rules in the API schema.
+func Validate_T01(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T01) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T01, no flags"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field T01.TypeMeta has no validation
+
+	{ // field T01.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T01.S, no flags"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T01) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T01.PS
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T01.PS, no flags"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T01) *string {
+				return oldObj.PS
+			})
+		errs = append(errs, fn(fldPath.Child("ps"), obj.PS, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T01.T
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Tother,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T01.T, no flags"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Tother(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T01) *Tother {
+				return &oldObj.T
+			})
+		errs = append(errs, fn(fldPath.Child("t"), &obj.T, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T01.PT
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Tother,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T01.PT, no flags"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Tother(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T01) *Tother {
+				return oldObj.PT
+			})
+		errs = append(errs, fn(fldPath.Child("pt"), obj.PT, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T02 validates an instance of T02 according
+// to declarative validation rules in the API schema.
+func Validate_T02(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T02) (errs field.ErrorList) {
+
+	earlyReturn := false
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T02, ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+		errs = append(errs, e...)
+		earlyReturn = true
+	}
+	if earlyReturn {
+		return // do not proceed
+	}
+
+	// field T02.TypeMeta has no validation
+
+	{ // field T02.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T02.S, ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T02) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T02.PS
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T02.PS, ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T02) *string {
+				return oldObj.PS
+			})
+		errs = append(errs, fn(fldPath.Child("ps"), obj.PS, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T02.T
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Tother,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T02.T, ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Tother(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T02) *Tother {
+				return &oldObj.T
+			})
+		errs = append(errs, fn(fldPath.Child("t"), &obj.T, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T02.PT
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Tother,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T02.PT, ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Tother(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T02) *Tother {
+				return oldObj.PT
+			})
+		errs = append(errs, fn(fldPath.Child("pt"), obj.PT, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T03 validates an instance of T03 according
+// to declarative validation rules in the API schema.
+func Validate_T03(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T03) (errs field.ErrorList) {
+
+	earlyReturn := false
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T03, ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+		errs = append(errs, e...)
+		earlyReturn = true
+	}
+	if earlyReturn {
+		return // do not proceed
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T03, no flags"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field T03.TypeMeta has no validation
+
+	{ // field T03.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T03.S, ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T03.S, no flags"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T03) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T03.PS
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T03.PS, ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T03.PS, no flags"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T03) *string {
+				return oldObj.PS
+			})
+		errs = append(errs, fn(fldPath.Child("ps"), obj.PS, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T03.T
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Tother,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T03.T, ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T03.T, no flags"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Tother(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T03) *Tother {
+				return &oldObj.T
+			})
+		errs = append(errs, fn(fldPath.Child("t"), &obj.T, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T03.PT
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Tother,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T03.PT, ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T03.PT, no flags"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Tother(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T03) *Tother {
+				return oldObj.PT
+			})
+		errs = append(errs, fn(fldPath.Child("pt"), obj.PT, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_TMultiple validates an instance of TMultiple according
+// to declarative validation rules in the API schema.
+func Validate_TMultiple(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *TMultiple) (errs field.ErrorList) {
+
+	earlyReturn := false
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple, ShortCircuit 1").MarkShortCircuit(); len(e) != 0 {
+		errs = append(errs, e...)
+		earlyReturn = true
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple, ShortCircuit 2").MarkShortCircuit(); len(e) != 0 {
+		errs = append(errs, e...)
+		earlyReturn = true
+	}
+	if earlyReturn {
+		return // do not proceed
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple, no flags 1"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T0, string payload"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple, no flags 2"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field TMultiple.TypeMeta has no validation
+
+	{ // field TMultiple.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.S, ShortCircuit 1").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.S, ShortCircuit 2").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.S, no flags 1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T0, string payload"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.S, no flags 2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *TMultiple) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	{ // field TMultiple.PS
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.PS, ShortCircuit 1").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.PS, ShortCircuit 2").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.PS, no flags 1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T0, string payload"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.PS, no flags 2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *TMultiple) *string {
+				return oldObj.PS
+			})
+		errs = append(errs, fn(fldPath.Child("ps"), obj.PS, oldVal, oldObj != nil)...)
+	}
+
+	{ // field TMultiple.T
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Tother,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.T, ShortCircuit 1").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.T, ShortCircuit 2").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.T, no flags 1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T0, string payload"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.T, no flags 2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Tother(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *TMultiple) *Tother {
+				return &oldObj.T
+			})
+		errs = append(errs, fn(fldPath.Child("t"), &obj.T, oldVal, oldObj != nil)...)
+	}
+
+	{ // field TMultiple.PT
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Tother,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.PT, ShortCircuit 1").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.PT, ShortCircuit 2").MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.PT, no flags 1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "T0, string payload"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "TMultiple.PT, no flags 2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Tother(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *TMultiple) *Tother {
+				return oldObj.PT
+			})
+		errs = append(errs, fn(fldPath.Child("pt"), obj.PT, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_Tother validates an instance of Tother according
+// to declarative validation rules in the API schema.
+func Validate_Tother(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Tother) (errs field.ErrorList) {
+
+	{ // field Tother.OS
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "Tother, no flags"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Tother) *string {
+				return &oldObj.OS
+			})
+		errs = append(errs, fn(fldPath.Child("os"), &obj.OS, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/structs/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/structs/zz_generated.validations_test.go
new file mode 100644
index 0000000000..9e1134fb4c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/structs/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package structs
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/typedefs/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/typedefs/doc.go
new file mode 100644
index 0000000000..84186fd7d5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/typedefs/doc.go
@@ -0,0 +1,52 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package typedefs
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Treat these as 4 bits, and ensure all combinations
+//   bit 0: no flags
+//   bit 1: ShortCircuit
+
+// Note: No validations.
+type E00 string
+
+// +k8s:validateFalse="E01, no flags"
+type E01 string
+
+// +k8s:validateFalse(flags: "ShortCircuit")="E02, ShortCircuit"
+type E02 string
+
+// +k8s:validateFalse="E03, no flags"
+// +k8s:validateFalse(flags: "ShortCircuit")="E03, ShortCircuit"
+type E03 string
+
+// Note: these are intentionally in the wrong final order.
+// +k8s:validateFalse="EMultiple, no flags 1"
+// +k8s:validateFalse(flags: "ShortCircuit")="EMultiple, ShortCircuit 1"
+// +k8s:validateFalse="E0, string payload"
+// +k8s:validateFalse="EMultiple, no flags 2"
+// +k8s:validateFalse(flags: "ShortCircuit")="EMultiple, ShortCircuit 2"
+type EMultiple string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/typedefs/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/typedefs/testdata/validate-false.json
new file mode 100644
index 0000000000..eb000238a3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/typedefs/testdata/validate-false.json
@@ -0,0 +1,23 @@
+{
+  "*typedefs.E01": {
+    "": [
+      "E01, no flags"
+    ]
+  },
+  "*typedefs.E02": {
+    "": [
+      "E02, ShortCircuit"
+    ]
+  },
+  "*typedefs.E03": {
+    "": [
+      "E03, ShortCircuit"
+    ]
+  },
+  "*typedefs.EMultiple": {
+    "": [
+      "EMultiple, ShortCircuit 1",
+      "EMultiple, ShortCircuit 2"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/typedefs/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/typedefs/zz_generated.validations.go
new file mode 100644
index 0000000000..e9bcf409bf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/typedefs/zz_generated.validations.go
@@ -0,0 +1,184 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package typedefs
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type E01
+	scheme.AddValidationFunc(
+		(*E01)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_E01(
+					ctx, op, nil, /* fldPath */
+					obj.(*E01),
+					safe.Cast[*E01](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type E02
+	scheme.AddValidationFunc(
+		(*E02)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_E02(
+					ctx, op, nil, /* fldPath */
+					obj.(*E02),
+					safe.Cast[*E02](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type E03
+	scheme.AddValidationFunc(
+		(*E03)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_E03(
+					ctx, op, nil, /* fldPath */
+					obj.(*E03),
+					safe.Cast[*E03](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type EMultiple
+	scheme.AddValidationFunc(
+		(*EMultiple)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_EMultiple(
+					ctx, op, nil, /* fldPath */
+					obj.(*EMultiple),
+					safe.Cast[*EMultiple](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_E01 validates an instance of E01 according
+// to declarative validation rules in the API schema.
+func Validate_E01(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *E01) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "E01, no flags"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_E02 validates an instance of E02 according
+// to declarative validation rules in the API schema.
+func Validate_E02(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *E02) (errs field.ErrorList) {
+
+	earlyReturn := false
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "E02, ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+		errs = append(errs, e...)
+		earlyReturn = true
+	}
+	if earlyReturn {
+		return // do not proceed
+	}
+
+	return errs
+}
+
+// Validate_E03 validates an instance of E03 according
+// to declarative validation rules in the API schema.
+func Validate_E03(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *E03) (errs field.ErrorList) {
+
+	earlyReturn := false
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "E03, ShortCircuit").MarkShortCircuit(); len(e) != 0 {
+		errs = append(errs, e...)
+		earlyReturn = true
+	}
+	if earlyReturn {
+		return // do not proceed
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "E03, no flags"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_EMultiple validates an instance of EMultiple according
+// to declarative validation rules in the API schema.
+func Validate_EMultiple(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *EMultiple) (errs field.ErrorList) {
+
+	earlyReturn := false
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "EMultiple, ShortCircuit 1").MarkShortCircuit(); len(e) != 0 {
+		errs = append(errs, e...)
+		earlyReturn = true
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "EMultiple, ShortCircuit 2").MarkShortCircuit(); len(e) != 0 {
+		errs = append(errs, e...)
+		earlyReturn = true
+	}
+	if earlyReturn {
+		return // do not proceed
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "EMultiple, no flags 1"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "E0, string payload"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "EMultiple, no flags 2"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/typedefs/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/typedefs/zz_generated.validations_test.go
new file mode 100644
index 0000000000..13aa49d8a1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ordering/typedefs/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package typedefs
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/pointers/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/pointers/doc.go
new file mode 100644
index 0000000000..9e6b34c945
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/pointers/doc.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package pointers
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type T1 struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field T1.PS"
+	PS *string `json:"ps"`
+	// +k8s:validateFalse="field T1.PI"
+	PI *int `json:"pi"`
+	// +k8s:validateFalse="field T1.PB"
+	PB *bool `json:"pb"`
+	// +k8s:validateFalse="field T1.PF"
+	PF *float64 `json:"pf"`
+
+	// +k8s:validateFalse="field T1.PT2"
+	PT2 *T2 `json:"pt2"`
+
+	// Duplicate types with no validation.
+	AnotherPS *string  `json:"anotherps"`
+	AnotherPI *int     `json:"anotherpi"`
+	AnotherPB *bool    `json:"anotherpb"`
+	AnotherPF *float64 `json:"anotherpf"`
+}
+
+// Note: This has validations and is linked into the type-graph of T1.
+type T2 struct {
+	// +k8s:validateFalse="field T2.PS"
+	PS *string `json:"ps"`
+	// +k8s:validateFalse="field T2.PI"
+	PI *int `json:"pi"`
+	// +k8s:validateFalse="field T2.PB"
+	PB *bool `json:"pb"`
+	// +k8s:validateFalse="field T2.PF"
+	PF *float64 `json:"pf"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/pointers/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/pointers/testdata/validate-false.json
new file mode 100644
index 0000000000..28909a7e39
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/pointers/testdata/validate-false.json
@@ -0,0 +1,31 @@
+{
+  "*pointers.T1": {
+    "pb": [
+      "field T1.PB"
+    ],
+    "pf": [
+      "field T1.PF"
+    ],
+    "pi": [
+      "field T1.PI"
+    ],
+    "ps": [
+      "field T1.PS"
+    ],
+    "pt2": [
+      "field T1.PT2"
+    ],
+    "pt2.pb": [
+      "field T2.PB"
+    ],
+    "pt2.pf": [
+      "field T2.PF"
+    ],
+    "pt2.pi": [
+      "field T2.PI"
+    ],
+    "pt2.ps": [
+      "field T2.PS"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/pointers/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/pointers/zz_generated.validations.go
new file mode 100644
index 0000000000..ae10feeeb3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/pointers/zz_generated.validations.go
@@ -0,0 +1,299 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package pointers
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	// field T1.TypeMeta has no validation
+
+	{ // field T1.PS
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.PS"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *string {
+				return oldObj.PS
+			})
+		errs = append(errs, fn(fldPath.Child("ps"), obj.PS, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PI
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.PI"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *int {
+				return oldObj.PI
+			})
+		errs = append(errs, fn(fldPath.Child("pi"), obj.PI, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PB
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.PB"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *bool {
+				return oldObj.PB
+			})
+		errs = append(errs, fn(fldPath.Child("pb"), obj.PB, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PF
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *float64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.PF"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *float64 {
+				return oldObj.PF
+			})
+		errs = append(errs, fn(fldPath.Child("pf"), obj.PF, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PT2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.PT2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T2 {
+				return oldObj.PT2
+			})
+		errs = append(errs, fn(fldPath.Child("pt2"), obj.PT2, oldVal, oldObj != nil)...)
+	}
+
+	// field T1.AnotherPS has no validation
+	// field T1.AnotherPI has no validation
+	// field T1.AnotherPB has no validation
+	// field T1.AnotherPF has no validation
+	return errs
+}
+
+// Validate_T2 validates an instance of T2 according
+// to declarative validation rules in the API schema.
+func Validate_T2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T2) (errs field.ErrorList) {
+
+	{ // field T2.PS
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.PS"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *string {
+				return oldObj.PS
+			})
+		errs = append(errs, fn(fldPath.Child("ps"), obj.PS, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T2.PI
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.PI"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *int {
+				return oldObj.PI
+			})
+		errs = append(errs, fn(fldPath.Child("pi"), obj.PI, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T2.PB
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.PB"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *bool {
+				return oldObj.PB
+			})
+		errs = append(errs, fn(fldPath.Child("pb"), obj.PB, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T2.PF
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *float64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.PF"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *float64 {
+				return oldObj.PF
+			})
+		errs = append(errs, fn(fldPath.Child("pf"), obj.PF, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/pointers/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/pointers/zz_generated.validations_test.go
new file mode 100644
index 0000000000..b1ab618180
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/pointers/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package pointers
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/primitives/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/primitives/doc.go
new file mode 100644
index 0000000000..329c1c86b3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/primitives/doc.go
@@ -0,0 +1,93 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package primitives
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type T1 struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field T1.S"
+	S string `json:"s"`
+	// +k8s:validateFalse="field T1.I"
+	I int `json:"i"`
+	// +k8s:validateFalse="field T1.B"
+	B bool `json:"b"`
+	// +k8s:validateFalse="field T1.F"
+	F float64 `json:"f"`
+
+	// +k8s:validateFalse="field T1.T2"
+	T2 T2 `json:"t2"`
+
+	// No internal validations.
+	T3 T3 `json:"t3"`
+
+	// Duplicate types with no validation.
+	AnotherS  string  `json:"anothers"`
+	AnotherI  int     `json:"anotheri"`
+	AnotherB  bool    `json:"anotherb"`
+	AnotherF  float64 `json:"anotherf"`
+	AnotherT2 T2      `json:"anothert2"`
+}
+
+// Note: This has validations and is linked into the type-graph of T1.
+type T2 struct {
+	// +k8s:validateFalse="field T2.S"
+	S string `json:"s"`
+	// +k8s:validateFalse="field T2.I"
+	I int `json:"i"`
+	// +k8s:validateFalse="field T2.B"
+	B bool `json:"b"`
+	// +k8s:validateFalse="field T2.F"
+	F float64 `json:"f"`
+}
+
+// Note: This has no validations and is linked into the type-graph of T1.
+type T3 struct {
+	S string  `json:"s"`
+	I int     `json:"i"`
+	B bool    `json:"b"`
+	F float64 `json:"f"`
+}
+
+// Note: This has validations and is not linked into the type-graph of T1.
+type T4 struct {
+	// +k8s:validateFalse="field T4.S"
+	S string `json:"s"`
+	// +k8s:validateFalse="field T4.I"
+	I int `json:"i"`
+	// +k8s:validateFalse="field T4.B"
+	B bool `json:"b"`
+	// +k8s:validateFalse="field T4.F"
+	F float64 `json:"f"`
+}
+
+// Note: This has no validations and is not linked into the type-graph of T1.
+type T5 struct {
+	S string  `json:"s"`
+	I int     `json:"i"`
+	B bool    `json:"b"`
+	F float64 `json:"f"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/primitives/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/primitives/testdata/validate-false.json
new file mode 100644
index 0000000000..0046190d7b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/primitives/testdata/validate-false.json
@@ -0,0 +1,43 @@
+{
+  "*primitives.T1": {
+    "anothert2.b": [
+      "field T2.B"
+    ],
+    "anothert2.f": [
+      "field T2.F"
+    ],
+    "anothert2.i": [
+      "field T2.I"
+    ],
+    "anothert2.s": [
+      "field T2.S"
+    ],
+    "b": [
+      "field T1.B"
+    ],
+    "f": [
+      "field T1.F"
+    ],
+    "i": [
+      "field T1.I"
+    ],
+    "s": [
+      "field T1.S"
+    ],
+    "t2": [
+      "field T1.T2"
+    ],
+    "t2.b": [
+      "field T2.B"
+    ],
+    "t2.f": [
+      "field T2.F"
+    ],
+    "t2.i": [
+      "field T2.I"
+    ],
+    "t2.s": [
+      "field T2.S"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/primitives/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/primitives/zz_generated.validations.go
new file mode 100644
index 0000000000..5a6620c4cb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/primitives/zz_generated.validations.go
@@ -0,0 +1,322 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package primitives
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	// field T1.TypeMeta has no validation
+
+	{ // field T1.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.I
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.I"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *int {
+				return &oldObj.I
+			})
+		errs = append(errs, fn(fldPath.Child("i"), &obj.I, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.B
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.B"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *bool {
+				return &oldObj.B
+			})
+		errs = append(errs, fn(fldPath.Child("b"), &obj.B, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.F
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *float64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.F"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *float64 {
+				return &oldObj.F
+			})
+		errs = append(errs, fn(fldPath.Child("f"), &obj.F, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.T2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.T2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T2 {
+				return &oldObj.T2
+			})
+		errs = append(errs, fn(fldPath.Child("t2"), &obj.T2, oldVal, oldObj != nil)...)
+	}
+
+	// field T1.T3 has no validation
+	// field T1.AnotherS has no validation
+	// field T1.AnotherI has no validation
+	// field T1.AnotherB has no validation
+	// field T1.AnotherF has no validation
+
+	{ // field T1.AnotherT2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T2 {
+				return &oldObj.AnotherT2
+			})
+		errs = append(errs, fn(fldPath.Child("anothert2"), &obj.AnotherT2, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T2 validates an instance of T2 according
+// to declarative validation rules in the API schema.
+func Validate_T2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T2) (errs field.ErrorList) {
+
+	{ // field T2.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T2.I
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.I"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *int {
+				return &oldObj.I
+			})
+		errs = append(errs, fn(fldPath.Child("i"), &obj.I, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T2.B
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.B"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *bool {
+				return &oldObj.B
+			})
+		errs = append(errs, fn(fldPath.Child("b"), &obj.B, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T2.F
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *float64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.F"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *float64 {
+				return &oldObj.F
+			})
+		errs = append(errs, fn(fldPath.Child("f"), &obj.F, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/primitives/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/primitives/zz_generated.validations_test.go
new file mode 100644
index 0000000000..550334b185
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/primitives/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package primitives
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/public_private/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/public_private/doc.go
new file mode 100644
index 0000000000..73e0b93122
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/public_private/doc.go
@@ -0,0 +1,46 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// Package publicprivate is a test package.
+//
+// +k8s:validation-gen-nolint
+//
+//nolint:unused,govet,staticcheck // govet disables structtag check, which checks for use of tags on private fields; staticcheck calls out SA5008: unexported struct field cannot have non-ignored `json:"private"`
+package publicprivate
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type T1 struct {
+	// +k8s:validateFalse="field T1.Public"
+	Public string `json:"public"`
+
+	// +k8s:validateFalse="field T1.private"
+	private string `json:"private"`
+}
+
+type private struct {
+	// +k8s:validateFalse="field private.Public"
+	Public string `json:"public"`
+
+	// +k8s:validateFalse="field private.private"
+	private string `json:"private"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/public_private/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/public_private/testdata/validate-false.json
new file mode 100644
index 0000000000..1deaa60b1e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/public_private/testdata/validate-false.json
@@ -0,0 +1,7 @@
+{
+  "*publicprivate.T1": {
+    "public": [
+      "field T1.Public"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/public_private/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/public_private/zz_generated.validations.go
new file mode 100644
index 0000000000..0a00b42c7f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/public_private/zz_generated.validations.go
@@ -0,0 +1,89 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package publicprivate
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	{ // field T1.Public
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.Public"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *string {
+				return &oldObj.Public
+			})
+		errs = append(errs, fn(fldPath.Child("public"), &obj.Public, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/public_private/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/public_private/zz_generated.validations_test.go
new file mode 100644
index 0000000000..12bc22d0a5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/public_private/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package publicprivate
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc.go
new file mode 100644
index 0000000000..74beb7963a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc.go
@@ -0,0 +1,54 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-deep-equal-func=k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func.CustomDeepEqual
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package deepequalfunc
+
+import (
+	"reflect"
+
+	"k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+var localSchemeBuilder = testscheme.New()
+
+var CustomDeepEqualCalls int
+
+func CustomDeepEqual(a, b any) bool {
+	CustomDeepEqualCalls++
+	return reflect.DeepEqual(a, b)
+}
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field Struct.NonComparableField"
+	NonComparableField NonComparableStruct `json:"nonComparableField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapField[*]"
+	MapField map[string]NonComparableStruct `json:"mapField"`
+}
+
+// +k8s:validateFalse="type NonComparableStruct"
+type NonComparableStruct struct {
+	// Ptr makes it not direct-comparable
+	Ptr *int `json:"ptr"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc_test.go
new file mode 100644
index 0000000000..595e71d26c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc_test.go
@@ -0,0 +1,71 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package deepequalfunc
+
+import (
+	"testing"
+)
+
+func TestDeepEqualFunc(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Create
+	val1 := 10
+	obj := &Struct{
+		NonComparableField: NonComparableStruct{Ptr: &val1},
+		MapField: map[string]NonComparableStruct{
+			"a": {Ptr: &val1},
+		},
+	}
+	st.Value(obj).ExpectValidateFalseByPath(map[string][]string{
+		"nonComparableField": {"field Struct.NonComparableField", "type NonComparableStruct"},
+		"mapField[a]":        {"field Struct.MapField[*]", "type NonComparableStruct"},
+	})
+
+	// Update with same values should ratchet (skip validation) using CustomDeepEqual
+	CustomDeepEqualCalls = 0
+	oldObj := &Struct{
+		NonComparableField: NonComparableStruct{Ptr: &val1},
+		MapField: map[string]NonComparableStruct{
+			"a": {Ptr: &val1},
+		},
+	}
+	newObj := &Struct{
+		NonComparableField: NonComparableStruct{Ptr: &val1},
+		MapField: map[string]NonComparableStruct{
+			"a": {Ptr: &val1},
+		},
+	}
+	st.Value(newObj).OldValue(oldObj).ExpectValid()
+	if CustomDeepEqualCalls == 0 {
+		t.Errorf("expected CustomDeepEqual to be called during update ratcheting, got %d calls", CustomDeepEqualCalls)
+	}
+
+	// Update with a new map key added: old key "a" ratchets via deepEqualImpl_ -> CustomDeepEqual,
+	// only new key "b" fails.
+	val2 := 20
+	updateObj := &Struct{
+		NonComparableField: NonComparableStruct{Ptr: &val1},
+		MapField: map[string]NonComparableStruct{
+			"a": {Ptr: &val1},
+			"b": {Ptr: &val2},
+		},
+	}
+	st.Value(updateObj).OldValue(oldObj).ExpectValidateFalseByPath(map[string][]string{
+		"mapField[b]": {"field Struct.MapField[*]", "type NonComparableStruct"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/zz_generated.validations.go
new file mode 100644
index 0000000000..2ec646bb0e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/zz_generated.validations.go
@@ -0,0 +1,143 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package deepequalfunc
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_NonComparableStruct validates an instance of NonComparableStruct according
+// to declarative validation rules in the API schema.
+func Validate_NonComparableStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *NonComparableStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type NonComparableStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field NonComparableStruct.Ptr has no validation
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.NonComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *NonComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if CustomDeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.NonComparableField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_NonComparableStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *NonComparableStruct {
+				return &oldObj.NonComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("nonComparableField"), &obj.NonComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]NonComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if CustomDeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_NonComparableStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]NonComparableStruct {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
+func deepEqualImpl_[T any](a, b T) bool {
+	return CustomDeepEqual(a, b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/default_behavior/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/default_behavior/doc.go
new file mode 100644
index 0000000000..d42ff19ee4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/default_behavior/doc.go
@@ -0,0 +1,154 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package defaultbehavior
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type StructPrimitive struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field intField"
+	IntField int `json:"intField"`
+
+	// +k8s:optional
+	// +k8s:validateFalse="field intPtrField"
+	IntPtrField *int `json:"intPtrField"`
+}
+
+type StructSlice struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field sliceField"
+	SliceField []S `json:"sliceField"`
+
+	// +k8s:validateFalse="field typedefSliceField"
+	TypeDefSliceField MySlice `json:"typedefSliceField"`
+}
+
+type StructMap struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field mapKeyField"
+	MapKeyField map[S]string `json:"mapKeyField"`
+
+	// +k8s:validateFalse="field mapValueField"
+	MapValueField map[string]S `json:"mapValueField"`
+
+	// +k8s:validateFalse="field aliasMapKeyTypeField"
+	AliasMapKeyTypeField AliasMapKeyType `json:"aliasMapKeyTypeField"`
+
+	// +k8s:validateFalse="field aliasMapValueTypeField"
+	AliasMapValueTypeField AliasMapValueType `json:"aliasMapValueTypeField"`
+}
+
+type StructStruct struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field directComparableStructField"
+	DirectComparableStructField DirectComparableStruct `json:"directComparableStructField"`
+
+	// +k8s:validateFalse="field nonDirectComparableStructField"
+	NonDirectComparableStructField NonDirectComparableStruct `json:"nonDirectComparableStructField"`
+
+	// +k8s:validateFalse="field directComparableStructPtrField"
+	DirectComparableStructPtr *DirectComparableStruct `json:"directComparableStructPtrField"`
+
+	// +k8s:validateFalse="field nonDirectComparableStructPtrField"
+	NonDirectComparableStructPtr *NonDirectComparableStruct `json:"nonDirectComparableStructPtrField"`
+
+	// +k8s:validateFalse="field DirectComparableStruct"
+	DirectComparableStruct
+
+	// +k8s:validateFalse="field NonDirectComparableStruct"
+	NonDirectComparableStruct
+}
+
+type StructEmbedded struct {
+	TypeMeta int
+	// +k8s:validateFalse="field DirectComparableStruct"
+	DirectComparableStruct `json:"directComparableStruct"`
+
+	// +k8s:validateFalse="field NonDirectComparableStruct"
+	NonDirectComparableStruct `json:"nonDirectComparableStruct"`
+
+	// +k8s:validateFalse="field NestedDirectComparableStructField"
+	NestedDirectComparableStructField NestedDirectComparableStruct `json:"nestedDirectComparableStructField"`
+
+	// +k8s:validateFalse="field NestedNonDirectComparableStructField"
+	NestedNonDirectComparableStructField NestedNonDirectComparableStruct `json:"nestedNonDirectComparableStructField"`
+}
+
+// +k8s:validateFalse="type TypeDefStruct"
+type TypeDefStruct struct{}
+
+// +k8s:validateFalse="type MySlice"
+type MySlice []int
+
+// +k8s:validateFalse="type S"
+type S string
+
+// +k8s:validateFalse="type MapKeyType"
+type AliasMapKeyType MapKeyType
+
+// +k8s:validateFalse="type MapValueType"
+type AliasMapValueType MapValueType
+
+// no validation
+type MapKeyType map[S]string
+
+// no validation
+type MapValueType map[string]S
+
+// +k8s:validateFalse="type DirectComparableStruct"
+type DirectComparableStruct struct {
+	// +k8s:validateFalse="field intField"
+	IntField int `json:"intField"`
+}
+
+// +k8s:validateFalse="type NonDirectComparableStruct"
+type NonDirectComparableStruct struct {
+	// +k8s:validateFalse="field intPtrField"
+	IntPtrField *int `json:"intPtrField"`
+}
+
+// +k8s:validateFalse="type NestedDirectComparableStruct"
+type NestedDirectComparableStruct struct {
+	// +k8s:validateFalse="field directComparableStructField"
+	DirectComparableStructField DirectComparableStruct `json:"directComparableStructField"`
+}
+
+// +k8s:validateFalse="type NestedNonDirectComparableStruct"
+type NestedNonDirectComparableStruct struct {
+	// +k8s:validateFalse="field nonDirectComparableStructField"
+	NonDirectComparableStructField NonDirectComparableStruct `json:"nonDirectComparableStructField"`
+}
+
+type MixComparableStruct struct {
+	TypeMeta int
+
+	Primitive string `json:"Primitive"`
+
+	// +k8s:validateFalse="field NonComparable"
+	NonComparable []string `json:"NonComparable"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/default_behavior/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/default_behavior/doc_test.go
new file mode 100644
index 0000000000..c4bdcd2738
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/default_behavior/doc_test.go
@@ -0,0 +1,186 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package defaultbehavior
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test_StructPrimitive(t *testing.T) {
+	mkTest := func() *StructPrimitive {
+		return &StructPrimitive{
+			IntField:    1,
+			IntPtrField: ptr.To(1), // Different pointers each call, but same value.
+		}
+	}
+
+	st := localSchemeBuilder.Test(t)
+	st.Value(mkTest()).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Invalid(field.NewPath("intField"), "", ""),
+		field.Invalid(field.NewPath("intPtrField"), "", ""),
+	})
+	st.Value(mkTest()).OldValue(mkTest()).ExpectValid()
+}
+
+func Test_StructSlice(t *testing.T) {
+	mkTest := func() *StructSlice {
+		return &StructSlice{
+			SliceField:        []S{""},
+			TypeDefSliceField: MySlice{1},
+		}
+	}
+
+	st := localSchemeBuilder.Test(t)
+	st.Value(mkTest()).ExpectValidateFalseByPath(map[string][]string{
+		"sliceField":        {"field sliceField"},
+		"sliceField[0]":     {"type S"},
+		"typedefSliceField": {"field typedefSliceField", "type MySlice"},
+	})
+
+	st.Value(mkTest()).OldValue(mkTest()).ExpectValid()
+}
+
+func Test_StructMap(t *testing.T) {
+	mkTest := func() *StructMap {
+		return &StructMap{
+			MapKeyField:            map[S]string{S("k"): "v"},
+			MapValueField:          map[string]S{"k": "v"},
+			AliasMapKeyTypeField:   AliasMapKeyType{"k": "v"},
+			AliasMapValueTypeField: AliasMapValueType{"k": "v"},
+		}
+	}
+
+	st := localSchemeBuilder.Test(t)
+	st.Value(mkTest()).ExpectValidateFalseByPath(map[string][]string{
+		"aliasMapKeyTypeField":      {"field aliasMapKeyTypeField", "type MapKeyType", "type S"},
+		"aliasMapValueTypeField":    {"field aliasMapValueTypeField", "type MapValueType"},
+		"aliasMapValueTypeField[k]": {"type S"},
+		"mapKeyField":               {"field mapKeyField", "type S"},
+		"mapValueField":             {"field mapValueField"},
+		"mapValueField[k]":          {"type S"},
+	})
+
+	st.Value(mkTest()).OldValue(mkTest()).ExpectValid()
+}
+
+func Test_StructStruct(t *testing.T) {
+	mkTest := func() *StructStruct {
+		return &StructStruct{
+			DirectComparableStructField: DirectComparableStruct{
+				IntField: 1,
+			},
+			NonDirectComparableStructField: NonDirectComparableStruct{
+				IntPtrField: ptr.To(1),
+			},
+			DirectComparableStructPtr: &DirectComparableStruct{
+				IntField: 1,
+			},
+			NonDirectComparableStructPtr: &NonDirectComparableStruct{
+				IntPtrField: ptr.To(1),
+			},
+		}
+	}
+
+	st := localSchemeBuilder.Test(t)
+	st.Value(mkTest()).ExpectValidateFalseByPath(map[string][]string{
+		"directComparableStructField":                   {"field directComparableStructField", "type DirectComparableStruct"},
+		"directComparableStructField.intField":          {"field intField"},
+		"nonDirectComparableStructField":                {"field nonDirectComparableStructField", "type NonDirectComparableStruct"},
+		"nonDirectComparableStructField.intPtrField":    {"field intPtrField"},
+		"directComparableStructPtrField":                {"field directComparableStructPtrField", "type DirectComparableStruct"},
+		"directComparableStructPtrField.intField":       {"field intField"},
+		"nonDirectComparableStructPtrField":             {"field nonDirectComparableStructPtrField", "type NonDirectComparableStruct"},
+		"nonDirectComparableStructPtrField.intPtrField": {"field intPtrField"},
+		"DirectComparableStruct":                        {"field DirectComparableStruct", "type DirectComparableStruct"},
+		"DirectComparableStruct.intField":               {"field intField"},
+		"NonDirectComparableStruct":                     {"field NonDirectComparableStruct", "type NonDirectComparableStruct"},
+		"NonDirectComparableStruct.intPtrField":         {"field intPtrField"},
+	})
+
+	st.Value(mkTest()).OldValue(mkTest()).ExpectValid()
+}
+
+func Test_StructEmbedded(t *testing.T) {
+	mkTest := func() *StructEmbedded {
+		return &StructEmbedded{
+			DirectComparableStruct: DirectComparableStruct{
+				IntField: 1,
+			},
+			NonDirectComparableStruct: NonDirectComparableStruct{
+				IntPtrField: ptr.To(1),
+			},
+			NestedDirectComparableStructField: NestedDirectComparableStruct{
+				DirectComparableStructField: DirectComparableStruct{
+					IntField: 1,
+				},
+			},
+			NestedNonDirectComparableStructField: NestedNonDirectComparableStruct{
+				NonDirectComparableStructField: NonDirectComparableStruct{
+					IntPtrField: ptr.To(1),
+				},
+			},
+		}
+	}
+
+	st := localSchemeBuilder.Test(t)
+	st.Value(mkTest()).ExpectValidateFalseByPath(map[string][]string{
+		"directComparableStruct": {
+			"field DirectComparableStruct", "type DirectComparableStruct",
+		},
+		"directComparableStruct.intField": {
+			"field intField",
+		},
+		"nonDirectComparableStruct": {
+			"field NonDirectComparableStruct", "type NonDirectComparableStruct",
+		},
+		"nonDirectComparableStruct.intPtrField": {
+			"field intPtrField",
+		},
+		"nestedDirectComparableStructField": {
+			"field NestedDirectComparableStructField", "type NestedDirectComparableStruct",
+		},
+		"nestedDirectComparableStructField.directComparableStructField": {
+			"field directComparableStructField", "type DirectComparableStruct",
+		},
+		"nestedDirectComparableStructField.directComparableStructField.intField": {
+			"field intField",
+		},
+		"nestedNonDirectComparableStructField": {
+			"field NestedNonDirectComparableStructField", "type NestedNonDirectComparableStruct",
+		},
+		"nestedNonDirectComparableStructField.nonDirectComparableStructField": {
+			"field nonDirectComparableStructField", "type NonDirectComparableStruct",
+		},
+		"nestedNonDirectComparableStructField.nonDirectComparableStructField.intPtrField": {
+			"field intPtrField",
+		},
+	})
+
+	st.Value(mkTest()).OldValue(mkTest()).ExpectValid()
+}
+
+func Test_Mix(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+	st.Value(&MixComparableStruct{
+		Primitive: "a",
+	}).OldValue(nil).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Invalid(field.NewPath("NonComparable"), "", ""),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/default_behavior/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/default_behavior/zz_generated.validations.go
new file mode 100644
index 0000000000..87b4a3a8fd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/default_behavior/zz_generated.validations.go
@@ -0,0 +1,914 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package defaultbehavior
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type MixComparableStruct
+	scheme.AddValidationFunc(
+		(*MixComparableStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_MixComparableStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*MixComparableStruct),
+					safe.Cast[*MixComparableStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type StructEmbedded
+	scheme.AddValidationFunc(
+		(*StructEmbedded)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_StructEmbedded(
+					ctx, op, nil, /* fldPath */
+					obj.(*StructEmbedded),
+					safe.Cast[*StructEmbedded](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type StructMap
+	scheme.AddValidationFunc(
+		(*StructMap)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_StructMap(
+					ctx, op, nil, /* fldPath */
+					obj.(*StructMap),
+					safe.Cast[*StructMap](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type StructPrimitive
+	scheme.AddValidationFunc(
+		(*StructPrimitive)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_StructPrimitive(
+					ctx, op, nil, /* fldPath */
+					obj.(*StructPrimitive),
+					safe.Cast[*StructPrimitive](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type StructSlice
+	scheme.AddValidationFunc(
+		(*StructSlice)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_StructSlice(
+					ctx, op, nil, /* fldPath */
+					obj.(*StructSlice),
+					safe.Cast[*StructSlice](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type StructStruct
+	scheme.AddValidationFunc(
+		(*StructStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_StructStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*StructStruct),
+					safe.Cast[*StructStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_AliasMapKeyType validates an instance of AliasMapKeyType according
+// to declarative validation rules in the API schema.
+func Validate_AliasMapKeyType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj AliasMapKeyType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapKeyType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// iterate the map and call the key type's validation function
+	if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj, Validate_S); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_AliasMapValueType validates an instance of AliasMapValueType according
+// to declarative validation rules in the API schema.
+func Validate_AliasMapValueType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj AliasMapValueType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapValueType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// iterate the map and call the value type's validation function
+	if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_S); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_DirectComparableStruct validates an instance of DirectComparableStruct according
+// to declarative validation rules in the API schema.
+func Validate_DirectComparableStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DirectComparableStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type DirectComparableStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field DirectComparableStruct.IntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field intField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DirectComparableStruct) *int {
+				return &oldObj.IntField
+			})
+		errs = append(errs, fn(fldPath.Child("intField"), &obj.IntField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_MixComparableStruct validates an instance of MixComparableStruct according
+// to declarative validation rules in the API schema.
+func Validate_MixComparableStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MixComparableStruct) (errs field.ErrorList) {
+
+	// field MixComparableStruct.TypeMeta has no validation
+	// field MixComparableStruct.Primitive has no validation
+
+	{ // field MixComparableStruct.NonComparable
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field NonComparable"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MixComparableStruct) []string {
+				return oldObj.NonComparable
+			})
+		errs = append(errs, fn(fldPath.Child("NonComparable"), obj.NonComparable, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_MySlice validates an instance of MySlice according
+// to declarative validation rules in the API schema.
+func Validate_MySlice(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj MySlice) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MySlice"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_NestedDirectComparableStruct validates an instance of NestedDirectComparableStruct according
+// to declarative validation rules in the API schema.
+func Validate_NestedDirectComparableStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *NestedDirectComparableStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type NestedDirectComparableStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field NestedDirectComparableStruct.DirectComparableStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DirectComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field directComparableStructField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DirectComparableStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NestedDirectComparableStruct) *DirectComparableStruct {
+				return &oldObj.DirectComparableStructField
+			})
+		errs = append(errs, fn(fldPath.Child("directComparableStructField"), &obj.DirectComparableStructField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_NestedNonDirectComparableStruct validates an instance of NestedNonDirectComparableStruct according
+// to declarative validation rules in the API schema.
+func Validate_NestedNonDirectComparableStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *NestedNonDirectComparableStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type NestedNonDirectComparableStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field NestedNonDirectComparableStruct.NonDirectComparableStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *NonDirectComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field nonDirectComparableStructField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_NonDirectComparableStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NestedNonDirectComparableStruct) *NonDirectComparableStruct {
+				return &oldObj.NonDirectComparableStructField
+			})
+		errs = append(errs, fn(fldPath.Child("nonDirectComparableStructField"), &obj.NonDirectComparableStructField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_NonDirectComparableStruct validates an instance of NonDirectComparableStruct according
+// to declarative validation rules in the API schema.
+func Validate_NonDirectComparableStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *NonDirectComparableStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type NonDirectComparableStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field NonDirectComparableStruct.IntPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field intPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NonDirectComparableStruct) *int {
+				return oldObj.IntPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("intPtrField"), obj.IntPtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_S validates an instance of S according
+// to declarative validation rules in the API schema.
+func Validate_S(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *S) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type S"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_StructEmbedded validates an instance of StructEmbedded according
+// to declarative validation rules in the API schema.
+func Validate_StructEmbedded(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StructEmbedded) (errs field.ErrorList) {
+
+	// field StructEmbedded.TypeMeta has no validation
+
+	{ // field StructEmbedded.DirectComparableStruct
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DirectComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field DirectComparableStruct"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DirectComparableStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructEmbedded) *DirectComparableStruct {
+				return &oldObj.DirectComparableStruct
+			})
+		errs = append(errs, fn(fldPath.Child("directComparableStruct"), &obj.DirectComparableStruct, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructEmbedded.NonDirectComparableStruct
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *NonDirectComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field NonDirectComparableStruct"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_NonDirectComparableStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructEmbedded) *NonDirectComparableStruct {
+				return &oldObj.NonDirectComparableStruct
+			})
+		errs = append(errs, fn(fldPath.Child("nonDirectComparableStruct"), &obj.NonDirectComparableStruct, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructEmbedded.NestedDirectComparableStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *NestedDirectComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field NestedDirectComparableStructField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_NestedDirectComparableStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructEmbedded) *NestedDirectComparableStruct {
+				return &oldObj.NestedDirectComparableStructField
+			})
+		errs = append(errs, fn(fldPath.Child("nestedDirectComparableStructField"), &obj.NestedDirectComparableStructField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructEmbedded.NestedNonDirectComparableStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *NestedNonDirectComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field NestedNonDirectComparableStructField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_NestedNonDirectComparableStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructEmbedded) *NestedNonDirectComparableStruct {
+				return &oldObj.NestedNonDirectComparableStructField
+			})
+		errs = append(errs, fn(fldPath.Child("nestedNonDirectComparableStructField"), &obj.NestedNonDirectComparableStructField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_StructMap validates an instance of StructMap according
+// to declarative validation rules in the API schema.
+func Validate_StructMap(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StructMap) (errs field.ErrorList) {
+
+	// field StructMap.TypeMeta has no validation
+
+	{ // field StructMap.MapKeyField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[S]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field mapKeyField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the key type's validation function
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj, Validate_S); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructMap) map[S]string {
+				return oldObj.MapKeyField
+			})
+		errs = append(errs, fn(fldPath.Child("mapKeyField"), obj.MapKeyField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructMap.MapValueField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]S,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field mapValueField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_S); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructMap) map[string]S {
+				return oldObj.MapValueField
+			})
+		errs = append(errs, fn(fldPath.Child("mapValueField"), obj.MapValueField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructMap.AliasMapKeyTypeField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj AliasMapKeyType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field aliasMapKeyTypeField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_AliasMapKeyType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructMap) AliasMapKeyType {
+				return oldObj.AliasMapKeyTypeField
+			})
+		errs = append(errs, fn(fldPath.Child("aliasMapKeyTypeField"), obj.AliasMapKeyTypeField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructMap.AliasMapValueTypeField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj AliasMapValueType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field aliasMapValueTypeField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_AliasMapValueType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructMap) AliasMapValueType {
+				return oldObj.AliasMapValueTypeField
+			})
+		errs = append(errs, fn(fldPath.Child("aliasMapValueTypeField"), obj.AliasMapValueTypeField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_StructPrimitive validates an instance of StructPrimitive according
+// to declarative validation rules in the API schema.
+func Validate_StructPrimitive(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StructPrimitive) (errs field.ErrorList) {
+
+	// field StructPrimitive.TypeMeta has no validation
+
+	{ // field StructPrimitive.IntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field intField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructPrimitive) *int {
+				return &oldObj.IntField
+			})
+		errs = append(errs, fn(fldPath.Child("intField"), &obj.IntField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructPrimitive.IntPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field intPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructPrimitive) *int {
+				return oldObj.IntPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("intPtrField"), obj.IntPtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_StructSlice validates an instance of StructSlice according
+// to declarative validation rules in the API schema.
+func Validate_StructSlice(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StructSlice) (errs field.ErrorList) {
+
+	// field StructSlice.TypeMeta has no validation
+
+	{ // field StructSlice.SliceField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []S,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field sliceField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_S); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructSlice) []S {
+				return oldObj.SliceField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceField"), obj.SliceField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructSlice.TypeDefSliceField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj MySlice,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field typedefSliceField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_MySlice(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructSlice) MySlice {
+				return oldObj.TypeDefSliceField
+			})
+		errs = append(errs, fn(fldPath.Child("typedefSliceField"), obj.TypeDefSliceField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_StructStruct validates an instance of StructStruct according
+// to declarative validation rules in the API schema.
+func Validate_StructStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StructStruct) (errs field.ErrorList) {
+
+	// field StructStruct.TypeMeta has no validation
+
+	{ // field StructStruct.DirectComparableStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DirectComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field directComparableStructField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DirectComparableStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructStruct) *DirectComparableStruct {
+				return &oldObj.DirectComparableStructField
+			})
+		errs = append(errs, fn(fldPath.Child("directComparableStructField"), &obj.DirectComparableStructField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructStruct.NonDirectComparableStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *NonDirectComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field nonDirectComparableStructField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_NonDirectComparableStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructStruct) *NonDirectComparableStruct {
+				return &oldObj.NonDirectComparableStructField
+			})
+		errs = append(errs, fn(fldPath.Child("nonDirectComparableStructField"), &obj.NonDirectComparableStructField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructStruct.DirectComparableStructPtr
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DirectComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field directComparableStructPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DirectComparableStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructStruct) *DirectComparableStruct {
+				return oldObj.DirectComparableStructPtr
+			})
+		errs = append(errs, fn(fldPath.Child("directComparableStructPtrField"), obj.DirectComparableStructPtr, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructStruct.NonDirectComparableStructPtr
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *NonDirectComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field nonDirectComparableStructPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_NonDirectComparableStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructStruct) *NonDirectComparableStruct {
+				return oldObj.NonDirectComparableStructPtr
+			})
+		errs = append(errs, fn(fldPath.Child("nonDirectComparableStructPtrField"), obj.NonDirectComparableStructPtr, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructStruct.DirectComparableStruct
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DirectComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field DirectComparableStruct"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DirectComparableStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructStruct) *DirectComparableStruct {
+				return &oldObj.DirectComparableStruct
+			})
+		errs = append(errs, fn(safe.Value(fldPath, func() *field.Path { return fldPath.Child("DirectComparableStruct") }), &obj.DirectComparableStruct, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructStruct.NonDirectComparableStruct
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *NonDirectComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field NonDirectComparableStruct"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_NonDirectComparableStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructStruct) *NonDirectComparableStruct {
+				return &oldObj.NonDirectComparableStruct
+			})
+		errs = append(errs, fn(safe.Value(fldPath, func() *field.Path { return fldPath.Child("NonDirectComparableStruct") }), &obj.NonDirectComparableStruct, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/doc.go
new file mode 100644
index 0000000000..ffeb0126cc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/doc.go
@@ -0,0 +1,122 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package list
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type StructSlice struct {
+	TypeMeta int
+
+	// +k8s:eachVal=+k8s:validateFalse="field AtomicSliceStringField[*]"
+	AtomicSliceStringField []StringType `json:"atomicSliceStringField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field AtomicSliceTypeField[*]"
+	AtomicSliceTypeField IntSliceType `json:"atomicSliceTypeField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field AtomicSliceComparableField[*]"
+	AtomicSliceComparableField []ComparableStruct `json:"atomicSliceComparableField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field AtomicSliceNonComparableField[*]"
+	AtomicSliceNonComparableField []NonComparableStruct `json:"atomicSliceNonComparableField"`
+
+	// +k8s:listType=set
+	// +k8s:eachVal=+k8s:validateFalse="field SetSliceComparableField[*]"
+	SetSliceComparableField []ComparableStruct `json:"setSliceComparableField"`
+
+	// +k8s:listType=set
+	// +k8s:eachVal=+k8s:validateFalse="field SetSliceNonComparableField[*]"
+	SetSliceNonComparableField []NonComparableStruct `json:"setSliceNonComparableField"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:eachVal=+k8s:validateFalse="field MapSliceComparableField[*]"
+	MapSliceComparableField []ComparableStructWithKey `json:"mapSliceComparableField"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:eachVal=+k8s:validateFalse="field MapSliceNonComparableField[*]"
+	MapSliceNonComparableField []NonComparableStructWithKey `json:"mapSliceNonComparableField"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:eachVal=+k8s:validateFalse="field MapSlicePtrKeyField[*]"
+	MapSlicePtrKeyField []PtrKeyStruct `json:"mapSlicePtrKeyField"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key1
+	// +k8s:listMapKey=key2
+	// +k8s:eachVal=+k8s:validateFalse="field MapSliceMixedKeyField[*]"
+	MapSliceMixedKeyField []MixedKeyStruct `json:"mapSliceMixedKeyField"`
+}
+
+type StringType string
+type IntSliceType []int
+
+type ComparableStruct struct {
+	IntField int `json:"intField"`
+}
+
+// +k8s:validateFalse="type NonComparableStruct"
+type NonComparableStruct struct {
+	IntPtrField *int `json:"intPtrField"`
+}
+
+type ComparableStructWithKey struct {
+	Key      string `json:"key"`
+	IntField int    `json:"intField"`
+}
+
+// +k8s:validateFalse="type NonComparableStructWithKey"
+type NonComparableStructWithKey struct {
+	Key         string `json:"key"`
+	IntPtrField *int   `json:"intPtrField"`
+}
+
+// +k8s:validateFalse="type PtrKeyStruct"
+type PtrKeyStruct struct {
+	Key  *string `json:"key"`
+	Data string  `json:"data"`
+}
+
+// +k8s:validateFalse="type MixedKeyStruct"
+type MixedKeyStruct struct {
+	Key1 *string `json:"key1"`
+	Key2 string  `json:"key2"`
+	Data string  `json:"data"`
+}
+
+type Item struct {
+	Key string `json:"key"`
+
+	// +k8s:validateFalse="field Data"
+	Data map[string]string `json:"data"`
+}
+
+type ItemList struct {
+	TypeMeta int
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	Items []Item `json:"items"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/doc_test.go
new file mode 100644
index 0000000000..2621278ee9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/doc_test.go
@@ -0,0 +1,117 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package list
+
+import (
+	"testing"
+
+	"k8s.io/utils/ptr"
+)
+
+func Test_StructSlice(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	invalidStructSlice := &StructSlice{
+		AtomicSliceStringField:        []StringType{""},
+		AtomicSliceTypeField:          IntSliceType{1},
+		AtomicSliceComparableField:    []ComparableStruct{{IntField: 1}},
+		AtomicSliceNonComparableField: []NonComparableStruct{{IntPtrField: ptr.To(1)}},
+		SetSliceComparableField:       []ComparableStruct{{IntField: 1}},
+		SetSliceNonComparableField:    []NonComparableStruct{{IntPtrField: ptr.To(1)}},
+		MapSliceComparableField:       []ComparableStructWithKey{{Key: "x", IntField: 1}},
+		MapSliceNonComparableField:    []NonComparableStructWithKey{{Key: "x", IntPtrField: ptr.To(1)}},
+		MapSlicePtrKeyField:           []PtrKeyStruct{{Key: ptr.To("x"), Data: "y"}},
+		MapSliceMixedKeyField:         []MixedKeyStruct{{Key1: ptr.To("x"), Key2: "y", Data: "z"}},
+	}
+	st.Value(invalidStructSlice).ExpectValidateFalseByPath(map[string][]string{
+		"atomicSliceStringField[0]":        {"field AtomicSliceStringField[*]"},
+		"atomicSliceTypeField[0]":          {"field AtomicSliceTypeField[*]"},
+		"atomicSliceComparableField[0]":    {"field AtomicSliceComparableField[*]"},
+		"atomicSliceNonComparableField[0]": {"field AtomicSliceNonComparableField[*]", "type NonComparableStruct"},
+		"setSliceComparableField[0]":       {"field SetSliceComparableField[*]"},
+		"setSliceNonComparableField[0]":    {"field SetSliceNonComparableField[*]", "type NonComparableStruct"},
+		"mapSliceComparableField[0]":       {"field MapSliceComparableField[*]"},
+		"mapSliceNonComparableField[0]":    {"field MapSliceNonComparableField[*]", "type NonComparableStructWithKey"},
+		"mapSlicePtrKeyField[0]":           {"field MapSlicePtrKeyField[*]", "type PtrKeyStruct"},
+		"mapSliceMixedKeyField[0]":         {"field MapSliceMixedKeyField[*]", "type MixedKeyStruct"},
+	})
+
+	// No changes.
+	st.Value(&invalidStructSlice).OldValue(&invalidStructSlice).ExpectValid()
+
+	//  Removed elements - errors on atomic.
+	st.Value(&StructSlice{
+		AtomicSliceStringField:        []StringType{""},
+		AtomicSliceTypeField:          IntSliceType{1},
+		AtomicSliceComparableField:    []ComparableStruct{{IntField: 1}},
+		AtomicSliceNonComparableField: []NonComparableStruct{{IntPtrField: ptr.To(1)}},
+		SetSliceComparableField:       []ComparableStruct{{IntField: 1}},
+		SetSliceNonComparableField:    []NonComparableStruct{{IntPtrField: ptr.To(1)}},
+		MapSliceComparableField:       []ComparableStructWithKey{{Key: "x", IntField: 1}},
+		MapSliceNonComparableField:    []NonComparableStructWithKey{{Key: "x", IntPtrField: ptr.To(1)}},
+		MapSlicePtrKeyField:           []PtrKeyStruct{{Key: ptr.To("x"), Data: "y"}},
+		MapSliceMixedKeyField:         []MixedKeyStruct{{Key1: ptr.To("x"), Key2: "y", Data: "z"}},
+	}).OldValue(&StructSlice{
+		AtomicSliceStringField:        []StringType{"", "x"},
+		AtomicSliceTypeField:          IntSliceType{1, 2},
+		AtomicSliceComparableField:    []ComparableStruct{{IntField: 2}, {IntField: 1}},
+		AtomicSliceNonComparableField: []NonComparableStruct{{IntPtrField: ptr.To(2)}, {IntPtrField: ptr.To(1)}},
+		SetSliceComparableField:       []ComparableStruct{{IntField: 2}, {IntField: 1}},
+		SetSliceNonComparableField:    []NonComparableStruct{{IntPtrField: ptr.To(2)}, {IntPtrField: ptr.To(1)}},
+		MapSliceComparableField:       []ComparableStructWithKey{{Key: "y", IntField: 2}, {Key: "x", IntField: 1}},
+		MapSliceNonComparableField:    []NonComparableStructWithKey{{Key: "y", IntPtrField: ptr.To(2)}, {Key: "x", IntPtrField: ptr.To(1)}},
+		MapSlicePtrKeyField:           []PtrKeyStruct{{Key: ptr.To("a"), Data: "b"}, {Key: ptr.To("x"), Data: "y"}},
+		MapSliceMixedKeyField:         []MixedKeyStruct{{Key1: ptr.To("a"), Key2: "b", Data: "c"}, {Key1: ptr.To("x"), Key2: "y", Data: "z"}},
+	}).ExpectValidateFalseByPath(map[string][]string{"atomicSliceStringField[0]": {"field AtomicSliceStringField[*]"},
+		"atomicSliceTypeField[0]":          {"field AtomicSliceTypeField[*]"},
+		"atomicSliceComparableField[0]":    {"field AtomicSliceComparableField[*]"},
+		"atomicSliceNonComparableField[0]": {"field AtomicSliceNonComparableField[*]", "type NonComparableStruct"},
+	})
+
+	// Same data, different order.
+	st.Value(&StructSlice{
+		SetSliceComparableField:    []ComparableStruct{{IntField: 2}, {IntField: 1}},
+		SetSliceNonComparableField: []NonComparableStruct{{IntPtrField: ptr.To(2)}, {IntPtrField: ptr.To(1)}},
+		MapSliceComparableField:    []ComparableStructWithKey{{Key: "y", IntField: 2}, {Key: "x", IntField: 1}},
+		MapSliceNonComparableField: []NonComparableStructWithKey{{Key: "y", IntPtrField: ptr.To(2)}, {Key: "x", IntPtrField: ptr.To(1)}},
+		MapSlicePtrKeyField:        []PtrKeyStruct{{Key: ptr.To("b"), Data: "2"}, {Key: ptr.To("a"), Data: "1"}},
+		MapSliceMixedKeyField:      []MixedKeyStruct{{Key1: ptr.To("b"), Key2: "2", Data: "B"}, {Key1: ptr.To("a"), Key2: "1", Data: "A"}},
+	}).OldValue(&StructSlice{
+		SetSliceComparableField:    []ComparableStruct{{IntField: 1}, {IntField: 2}},
+		SetSliceNonComparableField: []NonComparableStruct{{IntPtrField: ptr.To(1)}, {IntPtrField: ptr.To(2)}},
+		MapSliceComparableField:    []ComparableStructWithKey{{Key: "x", IntField: 1}, {Key: "y", IntField: 2}},
+		MapSliceNonComparableField: []NonComparableStructWithKey{{Key: "x", IntPtrField: ptr.To(1)}, {Key: "y", IntPtrField: ptr.To(2)}},
+		MapSlicePtrKeyField:        []PtrKeyStruct{{Key: ptr.To("a"), Data: "1"}, {Key: ptr.To("b"), Data: "2"}},
+		MapSliceMixedKeyField:      []MixedKeyStruct{{Key1: ptr.To("a"), Key2: "1", Data: "A"}, {Key1: ptr.To("b"), Key2: "2", Data: "B"}},
+	}).ExpectValid()
+}
+
+func Test_Items(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&ItemList{
+		Items: []Item{
+			{Key: "valid2"},
+		},
+	}).OldValue(&ItemList{
+		Items: []Item{
+			{Key: "valid1"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"items[0].data": {"field Data"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/zz_generated.validations.go
new file mode 100644
index 0000000000..9b6ecf48a5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/zz_generated.validations.go
@@ -0,0 +1,562 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package list
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type ItemList
+	scheme.AddValidationFunc(
+		(*ItemList)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ItemList(
+					ctx, op, nil, /* fldPath */
+					obj.(*ItemList),
+					safe.Cast[*ItemList](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type StructSlice
+	scheme.AddValidationFunc(
+		(*StructSlice)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_StructSlice(
+					ctx, op, nil, /* fldPath */
+					obj.(*StructSlice),
+					safe.Cast[*StructSlice](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Item validates an instance of Item according
+// to declarative validation rules in the API schema.
+func Validate_Item(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Item) (errs field.ErrorList) {
+
+	// field Item.Key has no validation
+
+	{ // field Item.Data
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Data"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Item) map[string]string {
+				return oldObj.Data
+			})
+		errs = append(errs, fn(fldPath.Child("data"), obj.Data, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ItemList validates an instance of ItemList according
+// to declarative validation rules in the API schema.
+func Validate_ItemList(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ItemList) (errs field.ErrorList) {
+
+	// field ItemList.TypeMeta has no validation
+
+	{ // field ItemList.Items
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Item,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Item, b *Item) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *Item, b *Item) bool { return a.Key == b.Key }, deepEqualImpl_, Validate_Item); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ItemList) []Item {
+				return oldObj.Items
+			})
+		errs = append(errs, fn(fldPath.Child("items"), obj.Items, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_MixedKeyStruct validates an instance of MixedKeyStruct according
+// to declarative validation rules in the API schema.
+func Validate_MixedKeyStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MixedKeyStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MixedKeyStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field MixedKeyStruct.Key1 has no validation
+	// field MixedKeyStruct.Key2 has no validation
+	// field MixedKeyStruct.Data has no validation
+	return errs
+}
+
+// Validate_NonComparableStruct validates an instance of NonComparableStruct according
+// to declarative validation rules in the API schema.
+func Validate_NonComparableStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *NonComparableStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type NonComparableStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field NonComparableStruct.IntPtrField has no validation
+	return errs
+}
+
+// Validate_NonComparableStructWithKey validates an instance of NonComparableStructWithKey according
+// to declarative validation rules in the API schema.
+func Validate_NonComparableStructWithKey(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *NonComparableStructWithKey) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type NonComparableStructWithKey"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field NonComparableStructWithKey.Key has no validation
+	// field NonComparableStructWithKey.IntPtrField has no validation
+	return errs
+}
+
+// Validate_PtrKeyStruct validates an instance of PtrKeyStruct according
+// to declarative validation rules in the API schema.
+func Validate_PtrKeyStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *PtrKeyStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type PtrKeyStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field PtrKeyStruct.Key has no validation
+	// field PtrKeyStruct.Data has no validation
+	return errs
+}
+
+// Validate_StructSlice validates an instance of StructSlice according
+// to declarative validation rules in the API schema.
+func Validate_StructSlice(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StructSlice) (errs field.ErrorList) {
+
+	// field StructSlice.TypeMeta has no validation
+
+	{ // field StructSlice.AtomicSliceStringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field AtomicSliceStringField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructSlice) []StringType {
+				return oldObj.AtomicSliceStringField
+			})
+		errs = append(errs, fn(fldPath.Child("atomicSliceStringField"), obj.AtomicSliceStringField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructSlice.AtomicSliceTypeField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj IntSliceType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field AtomicSliceTypeField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructSlice) IntSliceType {
+				return oldObj.AtomicSliceTypeField
+			})
+		errs = append(errs, fn(fldPath.Child("atomicSliceTypeField"), obj.AtomicSliceTypeField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructSlice.AtomicSliceComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ComparableStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field AtomicSliceComparableField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructSlice) []ComparableStruct {
+				return oldObj.AtomicSliceComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("atomicSliceComparableField"), obj.AtomicSliceComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructSlice.AtomicSliceNonComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []NonComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field AtomicSliceNonComparableField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_NonComparableStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructSlice) []NonComparableStruct {
+				return oldObj.AtomicSliceNonComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("atomicSliceNonComparableField"), obj.AtomicSliceNonComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructSlice.SetSliceComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ComparableStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field SetSliceComparableField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructSlice) []ComparableStruct {
+				return oldObj.SetSliceComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("setSliceComparableField"), obj.SetSliceComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructSlice.SetSliceNonComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []NonComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field SetSliceNonComparableField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, nil, Validate_NonComparableStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructSlice) []NonComparableStruct {
+				return oldObj.SetSliceNonComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("setSliceNonComparableField"), obj.SetSliceNonComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructSlice.MapSliceComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ComparableStructWithKey,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *ComparableStructWithKey, b *ComparableStructWithKey) bool { return a.Key == b.Key }, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ComparableStructWithKey) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapSliceComparableField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *ComparableStructWithKey, b *ComparableStructWithKey) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructSlice) []ComparableStructWithKey {
+				return oldObj.MapSliceComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("mapSliceComparableField"), obj.MapSliceComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructSlice.MapSliceNonComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []NonComparableStructWithKey,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *NonComparableStructWithKey, b *NonComparableStructWithKey) bool { return a.Key == b.Key }, deepEqualImpl_,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStructWithKey) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapSliceNonComparableField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *NonComparableStructWithKey, b *NonComparableStructWithKey) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *NonComparableStructWithKey, b *NonComparableStructWithKey) bool { return a.Key == b.Key }, deepEqualImpl_, Validate_NonComparableStructWithKey); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructSlice) []NonComparableStructWithKey {
+				return oldObj.MapSliceNonComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("mapSliceNonComparableField"), obj.MapSliceNonComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructSlice.MapSlicePtrKeyField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []PtrKeyStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *PtrKeyStruct, b *PtrKeyStruct) bool {
+					return ((a.Key == nil && b.Key == nil) || (a.Key != nil && b.Key != nil && *a.Key == *b.Key))
+				}, deepEqualImpl_,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *PtrKeyStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapSlicePtrKeyField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *PtrKeyStruct, b *PtrKeyStruct) bool {
+					return ((a.Key == nil && b.Key == nil) || (a.Key != nil && b.Key != nil && *a.Key == *b.Key))
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *PtrKeyStruct, b *PtrKeyStruct) bool {
+					return ((a.Key == nil && b.Key == nil) || (a.Key != nil && b.Key != nil && *a.Key == *b.Key))
+				}, deepEqualImpl_, Validate_PtrKeyStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructSlice) []PtrKeyStruct {
+				return oldObj.MapSlicePtrKeyField
+			})
+		errs = append(errs, fn(fldPath.Child("mapSlicePtrKeyField"), obj.MapSlicePtrKeyField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructSlice.MapSliceMixedKeyField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MixedKeyStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *MixedKeyStruct, b *MixedKeyStruct) bool {
+					return ((a.Key1 == nil && b.Key1 == nil) || (a.Key1 != nil && b.Key1 != nil && *a.Key1 == *b.Key1)) && a.Key2 == b.Key2
+				}, deepEqualImpl_,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MixedKeyStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapSliceMixedKeyField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MixedKeyStruct, b *MixedKeyStruct) bool {
+					return ((a.Key1 == nil && b.Key1 == nil) || (a.Key1 != nil && b.Key1 != nil && *a.Key1 == *b.Key1)) && a.Key2 == b.Key2
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *MixedKeyStruct, b *MixedKeyStruct) bool {
+					return ((a.Key1 == nil && b.Key1 == nil) || (a.Key1 != nil && b.Key1 != nil && *a.Key1 == *b.Key1)) && a.Key2 == b.Key2
+				}, deepEqualImpl_, Validate_MixedKeyStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructSlice) []MixedKeyStruct {
+				return oldObj.MapSliceMixedKeyField
+			})
+		errs = append(errs, fn(fldPath.Child("mapSliceMixedKeyField"), obj.MapSliceMixedKeyField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
+func deepEqualImpl_[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachkey/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachkey/doc.go
new file mode 100644
index 0000000000..dc7ea87ee3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachkey/doc.go
@@ -0,0 +1,51 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package eachkey
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:eachKey=+k8s:validateFalse="field Struct.MapField(keys)"
+	MapField map[string]string `json:"mapField"`
+
+	// +k8s:eachKey=+k8s:validateFalse="field Struct.MapTypedefField(keys)"
+	MapTypedefField map[UnvalidatedStringType]string `json:"mapTypedefField"`
+
+	// +k8s:eachKey=+k8s:validateFalse="field Struct.MapValidatedTypedefField(keys)"
+	MapValidatedTypedefField map[ValidatedStringType]string `json:"mapValidatedTypedefField"`
+
+	// +k8s:eachKey=+k8s:validateFalse="field Struct.ValidatedMapTypeField(keys)"
+	ValidatedMapTypeField ValidatedMapType `json:"validatedMapTypeField"`
+}
+
+// Note: no validations.
+type UnvalidatedStringType string
+
+// +k8s:validateFalse="ValidatedStringType"
+type ValidatedStringType string
+
+// +k8s:eachKey=+k8s:validateFalse="type ValidatedMapType(keys)"
+type ValidatedMapType map[string]string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachkey/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachkey/doc_test.go
new file mode 100644
index 0000000000..18c8ccc90d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachkey/doc_test.go
@@ -0,0 +1,51 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+package eachkey
+
+import (
+	"testing"
+)
+
+func Test_Struct(t *testing.T) {
+	mkTest := func() *Struct {
+		return &Struct{
+			MapField: map[string]string{"x": "y"},
+			MapTypedefField: map[UnvalidatedStringType]string{
+				"x": "y",
+			},
+			MapValidatedTypedefField: map[ValidatedStringType]string{
+				"x": "y",
+			},
+			ValidatedMapTypeField: map[string]string{
+				"x": "y",
+			},
+		}
+	}
+	st := localSchemeBuilder.Test(t)
+	st.Value(mkTest()).ExpectValidateFalseByPath(map[string][]string{
+		"mapField":                 {"field Struct.MapField(keys)"},
+		"mapTypedefField":          {"field Struct.MapTypedefField(keys)"},
+		"mapValidatedTypedefField": {"ValidatedStringType", "field Struct.MapValidatedTypedefField(keys)"},
+		"validatedMapTypeField":    {"field Struct.ValidatedMapTypeField(keys)", "type ValidatedMapType(keys)"},
+	})
+
+	st.Value(mkTest()).OldValue(mkTest()).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachkey/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachkey/zz_generated.validations.go
new file mode 100644
index 0000000000..5405676afc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachkey/zz_generated.validations.go
@@ -0,0 +1,211 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package eachkey
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField(keys)")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[UnvalidatedStringType]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *UnvalidatedStringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypedefField(keys)")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[UnvalidatedStringType]string {
+				return oldObj.MapTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapTypedefField"), obj.MapTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapValidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[ValidatedStringType]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ValidatedStringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapValidatedTypedefField(keys)")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the key type's validation function
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj, Validate_ValidatedStringType); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[ValidatedStringType]string {
+				return oldObj.MapValidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapValidatedTypedefField"), obj.MapValidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ValidatedMapTypeField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj ValidatedMapType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ValidatedMapTypeField(keys)")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ValidatedMapType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) ValidatedMapType {
+				return oldObj.ValidatedMapTypeField
+			})
+		errs = append(errs, fn(fldPath.Child("validatedMapTypeField"), obj.ValidatedMapTypeField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ValidatedMapType validates an instance of ValidatedMapType according
+// to declarative validation rules in the API schema.
+func Validate_ValidatedMapType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj ValidatedMapType) (errs field.ErrorList) {
+
+	if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type ValidatedMapType(keys)")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ValidatedStringType validates an instance of ValidatedStringType according
+// to declarative validation rules in the API schema.
+func Validate_ValidatedStringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ValidatedStringType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "ValidatedStringType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/doc.go
new file mode 100644
index 0000000000..b452c393f2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/doc.go
@@ -0,0 +1,52 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package eachval
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type StructWithMaps struct {
+	TypeMeta int
+
+	// +k8s:eachVal=+k8s:validateFalse="field MapTest.MapPrimitiveField[*]"
+	MapPrimitiveField map[string]string `json:"mapPrimitiveField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field MapTest.MapTypedefField[*]"
+	MapTypedefField map[string]StringType `json:"mapTypedefField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field MapTest.MapComparableStructField[*]"
+	MapComparableStructField map[string]ComparableStruct `json:"mapComparableStructField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field MapTest.MapNonComparableStructField[*]"
+	MapNonComparableStructField map[string]NonComparableStruct `json:"mapNonComparableStructField"`
+}
+
+type StringType string
+
+type ComparableStruct struct {
+	IntField int `json:"intField"`
+}
+
+type NonComparableStruct struct {
+	IntPtrField *int `json:"intPtrField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/doc_test.go
new file mode 100644
index 0000000000..554b384d6e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/doc_test.go
@@ -0,0 +1,52 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+package eachval
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test_StructWithMaps(t *testing.T) {
+	mkTest := func() *StructWithMaps {
+		return &StructWithMaps{
+			MapPrimitiveField: map[string]string{"x": "y"},
+			MapTypedefField:   map[string]StringType{"x": "y"},
+			MapComparableStructField: map[string]ComparableStruct{
+				"x": {IntField: 1},
+			},
+			MapNonComparableStructField: map[string]NonComparableStruct{
+				"x": {IntPtrField: ptr.To(1)},
+			},
+		}
+	}
+
+	st := localSchemeBuilder.Test(t)
+	st.Value(mkTest()).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Invalid(field.NewPath("mapPrimitiveField[x]"), "y", ""),
+		field.Invalid(field.NewPath("mapTypedefField[x]"), "y", ""),
+		field.Invalid(field.NewPath("mapComparableStructField[x]"), "", ""),
+		field.Invalid(field.NewPath("mapNonComparableStructField[x]"), "", ""),
+	})
+	st.Value(mkTest()).OldValue(mkTest()).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/zz_generated.validations.go
new file mode 100644
index 0000000000..183797afbb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/zz_generated.validations.go
@@ -0,0 +1,181 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package eachval
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type StructWithMaps
+	scheme.AddValidationFunc(
+		(*StructWithMaps)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_StructWithMaps(
+					ctx, op, nil, /* fldPath */
+					obj.(*StructWithMaps),
+					safe.Cast[*StructWithMaps](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_StructWithMaps validates an instance of StructWithMaps according
+// to declarative validation rules in the API schema.
+func Validate_StructWithMaps(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StructWithMaps) (errs field.ErrorList) {
+
+	// field StructWithMaps.TypeMeta has no validation
+
+	{ // field StructWithMaps.MapPrimitiveField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapTest.MapPrimitiveField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructWithMaps) map[string]string {
+				return oldObj.MapPrimitiveField
+			})
+		errs = append(errs, fn(fldPath.Child("mapPrimitiveField"), obj.MapPrimitiveField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructWithMaps.MapTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapTest.MapTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructWithMaps) map[string]StringType {
+				return oldObj.MapTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapTypedefField"), obj.MapTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructWithMaps.MapComparableStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]ComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ComparableStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapTest.MapComparableStructField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructWithMaps) map[string]ComparableStruct {
+				return oldObj.MapComparableStructField
+			})
+		errs = append(errs, fn(fldPath.Child("mapComparableStructField"), obj.MapComparableStructField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructWithMaps.MapNonComparableStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]NonComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapTest.MapNonComparableStructField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructWithMaps) map[string]NonComparableStruct {
+				return oldObj.MapNonComparableStructField
+			})
+		errs = append(errs, fn(fldPath.Child("mapNonComparableStructField"), obj.MapNonComparableStructField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
+func deepEqualImpl_[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/subfield/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/subfield/doc.go
new file mode 100644
index 0000000000..c8ed5b4503
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/subfield/doc.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package subfield
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:subfield(intField)=+k8s:validateFalse="field IntField"
+	// +k8s:subfield(intPtrField)=+k8s:validateFalse="field IntPtrField"
+	SubStructField SubStruct `json:"subStructField"`
+}
+
+type SubStruct struct {
+	IntField    int  `json:"intField"`
+	IntPtrField *int `json:"intPtrField"`
+}
+
+// +k8s:subfield(intField)=+k8s:validateFalse="field IntField"
+// +k8s:subfield(intPtrField)=+k8s:validateFalse="field IntPtrField"
+type StructWithSubfield struct {
+	TypeMeta    int
+	IntField    int  `json:"intField"`
+	IntPtrField *int `json:"intPtrField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/subfield/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/subfield/doc_test.go
new file mode 100644
index 0000000000..0b093937d7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/subfield/doc_test.go
@@ -0,0 +1,70 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+package subfield
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestStruct(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+	st.Value(&Struct{
+		SubStructField: SubStruct{
+			IntField:    1,
+			IntPtrField: ptr.To(1),
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Invalid(field.NewPath("subStructField").Child("intField"), 1, "field IntField"),
+		field.Invalid(field.NewPath("subStructField").Child("intPtrField"), 1, "field IntPtrField"),
+	})
+
+	st.Value(&StructWithSubfield{
+		IntField:    1,
+		IntPtrField: ptr.To(1),
+	}).OldValue(&StructWithSubfield{
+		IntField:    1,
+		IntPtrField: ptr.To(1),
+	}).ExpectValid()
+}
+
+func TestStructWithSubfield(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+	st.Value(&StructWithSubfield{
+		IntField:    1,
+		IntPtrField: ptr.To(1),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Invalid(field.NewPath("intField"), 1, "field IntField"),
+		field.Invalid(field.NewPath("intPtrField"), 1, "field IntPtrField"),
+	})
+
+	st.Value(&StructWithSubfield{
+		TypeMeta:    1,
+		IntField:    1,
+		IntPtrField: ptr.To(1),
+	}).OldValue(&StructWithSubfield{
+		TypeMeta:    1,
+		IntField:    1,
+		IntPtrField: ptr.To(1),
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/subfield/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/subfield/zz_generated.validations.go
new file mode 100644
index 0000000000..767718e2a2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/subfield/zz_generated.validations.go
@@ -0,0 +1,153 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package subfield
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type StructWithSubfield
+	scheme.AddValidationFunc(
+		(*StructWithSubfield)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_StructWithSubfield(
+					ctx, op, nil, /* fldPath */
+					obj.(*StructWithSubfield),
+					safe.Cast[*StructWithSubfield](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.SubStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *SubStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "intField"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "intField",
+					func(o *SubStruct) *int { return &o.IntField }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field IntField")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			func() { // cohort = "intPtrField"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "intPtrField",
+					func(o *SubStruct) *int { return o.IntPtrField }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field IntPtrField")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *SubStruct {
+				return &oldObj.SubStructField
+			})
+		errs = append(errs, fn(fldPath.Child("subStructField"), &obj.SubStructField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_StructWithSubfield validates an instance of StructWithSubfield according
+// to declarative validation rules in the API schema.
+func Validate_StructWithSubfield(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StructWithSubfield) (errs field.ErrorList) {
+
+	func() { // cohort = "intField"
+		if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "intField",
+			func(o *StructWithSubfield) *int { return &o.IntField }, validate.DirectEqual,
+			func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+				return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field IntField")
+			}); len(e) != 0 {
+			errs = append(errs, e...)
+		}
+	}()
+	func() { // cohort = "intPtrField"
+		if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "intPtrField",
+			func(o *StructWithSubfield) *int { return o.IntPtrField }, validate.DirectEqual,
+			func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+				return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field IntPtrField")
+			}); len(e) != 0 {
+			errs = append(errs, e...)
+		}
+	}()
+
+	// field StructWithSubfield.TypeMeta has no validation
+	// field StructWithSubfield.IntField has no validation
+	// field StructWithSubfield.IntPtrField has no validation
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/doc.go
new file mode 100644
index 0000000000..ba0aa986b0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/doc.go
@@ -0,0 +1,74 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package maps
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// This test case is carefully constructed to test recursion. We don't want to
+// add more `validateFalse` tags because the bug that motivated this test
+// wasn't looking deep enough into the recursion tree.
+//
+// Expectations:
+// * We should emit validation for T1 because T3 has validation.
+// * We should emit validation for T2 because it uses T1, which has validation.
+// * We should emit validation for T3 because it has validation.
+// * We should emit validation for T4 because it uses T3, which has validation.
+// * T1 should call T2 and T3.
+// * T2 should call eachVal(T1).
+// * T3 should call T4.
+// * T4 should call eachVal(T3).
+// * T5 and T6 hold a map of themselves, reached via T1 so the map type is
+//   still being discovered when its own field is processed.
+
+type T1 struct {
+	T2 T2            `json:"t2"`
+	T3 T3            `json:"t3"`
+	T5 map[string]T5 `json:"t5"`
+	T6 map[string]T6 `json:"t6"`
+}
+
+type T2 struct {
+	MT1 map[string]T1 `json:"mt1"`
+}
+
+// +k8s:validateFalse="type T3"
+type T3 struct {
+	T4 T4 `json:"t4"`
+}
+
+type T4 struct {
+	MT3 map[string]T3 `json:"mt3"`
+}
+
+type T5 struct {
+	// +k8s:validateFalse="type T5.T5"
+	T5 map[string]T5 `json:"t5"`
+}
+
+type T6 struct {
+	// +k8s:validateFalse="type T6.S"
+	S  string        `json:"s"`
+	T6 map[string]T6 `json:"t6"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/testdata/validate-false.json
new file mode 100644
index 0000000000..61c61b2d39
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/testdata/validate-false.json
@@ -0,0 +1,677 @@
+{
+  "*maps.T1": {
+    "t2.mt1[+].t2.mt1[_;熱_ɬ泌Ʀ妺眏ĮBȖ鯡].t3": [
+      "type T3"
+    ],
+    "t2.mt1[+].t2.mt1[_;熱_ɬ泌Ʀ妺眏ĮBȖ鯡].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[+].t2.mt1[_;熱_ɬ泌Ʀ妺眏ĮBȖ鯡].t6[].s": [
+      "type T6.S"
+    ],
+    "t2.mt1[+].t2.mt1[ʍctƓ晲].t3": [
+      "type T3"
+    ],
+    "t2.mt1[+].t2.mt1[ʍctƓ晲].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[+].t2.mt1[ʍctƓ晲].t6[].s": [
+      "type T6.S"
+    ],
+    "t2.mt1[+].t3": [
+      "type T3"
+    ],
+    "t2.mt1[+].t3.t4.mt3[ǿ\u003cɀEɡđ]": [
+      "type T3"
+    ],
+    "t2.mt1[+].t3.t4.mt3[能鷸ȳ琍殪\"g]": [
+      "type T3"
+    ],
+    "t2.mt1[+].t5[+ʙ堠齦].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[+].t5[+ʙ堠齦].t5[e自侾^x索Ŗb$ž駥xa豘].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[+].t5[+ʙ堠齦].t5[ý譎颻滧ǖvq灊摒嫸yĵȲ梚鿱o].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[+].t5[Z?bư/L卟Ƒ»].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[+].t5[Z?bư/L卟Ƒ»].t5[ũ答B].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[+].t5[Z?bư/L卟Ƒ»].t5[巭蜏恝墜ǔ爡絵/].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[+].t6[q7狭姫].s": [
+      "type T6.S"
+    ],
+    "t2.mt1[+].t6[q7狭姫].t6[ĩ}賹8秈卅Uʓ].s": [
+      "type T6.S"
+    ],
+    "t2.mt1[+].t6[q7狭姫].t6[Ƈÿ櫌駘\u0026鮫嫁k掝¦{\"].s": [
+      "type T6.S"
+    ],
+    "t2.mt1[+].t6[趸鸎|烈膞`蠯].s": [
+      "type T6.S"
+    ],
+    "t2.mt1[+].t6[趸鸎|烈膞`蠯].t6[uɸ¢\u003c1馺蕰×Oǝ硭ɜ]ƠX,預].s": [
+      "type T6.S"
+    ],
+    "t2.mt1[+].t6[趸鸎|烈膞`蠯].t6[Ȓ彃\u003erSʐ礕EɌ魆ʚ簬Ķ].s": [
+      "type T6.S"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[ǪŰM旰綷罨袢捺悲ȅ].t3": [
+      "type T3"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[ǪŰM旰綷罨袢捺悲ȅ].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[ǪŰM旰綷罨袢捺悲ȅ].t6[].s": [
+      "type T6.S"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[鎑鎢屃裂ÀYǎ3].t3": [
+      "type T3"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[鎑鎢屃裂ÀYǎ3].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[鎑鎢屃裂ÀYǎ3].t6[].s": [
+      "type T6.S"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t3": [
+      "type T3"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t3.t4.mt3[av$蛷)讻]": [
+      "type T3"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t3.t4.mt3[烱ęssĂZ稈V噘¢\u003eóDz岋笨Gń條]": [
+      "type T3"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[eYF墄[C_睿ȉǫ蹟t´].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[eYF墄[C_睿ȉǫ蹟t´].t5[Ƣ板鋩伸~槱¡rŔ綂2暮斚嬆ʅȀ].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[eYF墄[C_睿ȉǫ蹟t´].t5[ș$0đ\u003eƯ]ɹȽ東].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[w飃m=Sx].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[w飃m=Sx].t5[Gčü櫒}眙+ËQLuVǭz瘯霡豐Ȭ-].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[w飃m=Sx].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[`ȝ懿沇].s": [
+      "type T6.S"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[`ȝ懿沇].t6[6ɀk諮Ȃ遃ɸ0_榣ǝ祇Fæƭ].s": [
+      "type T6.S"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[`ȝ懿沇].t6[].s": [
+      "type T6.S"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[跮ɽ溢煮FɀÄf渂硹譯].s": [
+      "type T6.S"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[跮ɽ溢煮FɀÄf渂硹譯].t6[uvȭƹ棳ɷk].s": [
+      "type T6.S"
+    ],
+    "t2.mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[跮ɽ溢煮FɀÄf渂硹譯].t6[蕓ư銩6ij憏].s": [
+      "type T6.S"
+    ],
+    "t3": [
+      "type T3"
+    ],
+    "t3.t4.mt3[ǣ侹rC綹l\"Ęłė僫ĿƳ犿]": [
+      "type T3"
+    ],
+    "t3.t4.mt3[ǣ侹rC綹l\"Ęłė僫ĿƳ犿].t4.mt3[Eɧ]": [
+      "type T3"
+    ],
+    "t3.t4.mt3[ǣ侹rC綹l\"Ęłė僫ĿƳ犿].t4.mt3[榋:$?ʐiÅ圁椯ĤɹN匛9唟摴aĹƵ]": [
+      "type T3"
+    ],
+    "t3.t4.mt3[ʁƂ埢1_匘!v5轱苤犄4y]": [
+      "type T3"
+    ],
+    "t3.t4.mt3[ʁƂ埢1_匘!v5轱苤犄4y].t4.mt3[Ĕ1B]": [
+      "type T3"
+    ],
+    "t3.t4.mt3[ʁƂ埢1_匘!v5轱苤犄4y].t4.mt3[ɂƚ浻WEȕ]": [
+      "type T3"
+    ],
+    "t5[I坬繣ʦȜ].t5": [
+      "type T5.T5"
+    ],
+    "t5[I坬繣ʦȜ].t5[D6üɁ].t5": [
+      "type T5.T5"
+    ],
+    "t5[I坬繣ʦȜ].t5[D6üɁ].t5[5ʠ稑z].t5": [
+      "type T5.T5"
+    ],
+    "t5[I坬繣ʦȜ].t5[D6üɁ].t5[5ʠ稑z].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t5[I坬繣ʦȜ].t5[D6üɁ].t5[å偔7鉰竡弓Ū駢].t5": [
+      "type T5.T5"
+    ],
+    "t5[I坬繣ʦȜ].t5[D6üɁ].t5[å偔7鉰竡弓Ū駢].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t5[I坬繣ʦȜ].t5[ɡ鱣ɥʘ].t5": [
+      "type T5.T5"
+    ],
+    "t5[I坬繣ʦȜ].t5[ɡ鱣ɥʘ].t5[1i茅飱Ï^ʥ甅俹玄8ñɧű袡].t5": [
+      "type T5.T5"
+    ],
+    "t5[I坬繣ʦȜ].t5[ɡ鱣ɥʘ].t5[1i茅飱Ï^ʥ甅俹玄8ñɧű袡].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t5[I坬繣ʦȜ].t5[ɡ鱣ɥʘ].t5[皸ąp垊渂ċ0ʦ+椎;ř4臨栱].t5": [
+      "type T5.T5"
+    ],
+    "t5[I坬繣ʦȜ].t5[ɡ鱣ɥʘ].t5[皸ąp垊渂ċ0ʦ+椎;ř4臨栱].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t5[ʔ搪ŷ臹裂fɥǻŎB\u003e嫡g|妯C\u003e揕].t5": [
+      "type T5.T5"
+    ],
+    "t5[ʔ搪ŷ臹裂fɥǻŎB\u003e嫡g|妯C\u003e揕].t5[œ鸽=UPIªL2ĉ鯙Ĭ=].t5": [
+      "type T5.T5"
+    ],
+    "t5[ʔ搪ŷ臹裂fɥǻŎB\u003e嫡g|妯C\u003e揕].t5[œ鸽=UPIªL2ĉ鯙Ĭ=].t5[u].t5": [
+      "type T5.T5"
+    ],
+    "t5[ʔ搪ŷ臹裂fɥǻŎB\u003e嫡g|妯C\u003e揕].t5[œ鸽=UPIªL2ĉ鯙Ĭ=].t5[u].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t5[ʔ搪ŷ臹裂fɥǻŎB\u003e嫡g|妯C\u003e揕].t5[œ鸽=UPIªL2ĉ鯙Ĭ=].t5[ʫ嗼ÿá\\+4纵e%Ȕ諜].t5": [
+      "type T5.T5"
+    ],
+    "t5[ʔ搪ŷ臹裂fɥǻŎB\u003e嫡g|妯C\u003e揕].t5[œ鸽=UPIªL2ĉ鯙Ĭ=].t5[ʫ嗼ÿá\\+4纵e%Ȕ諜].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t5[ʔ搪ŷ臹裂fɥǻŎB\u003e嫡g|妯C\u003e揕].t5[臒nj1].t5": [
+      "type T5.T5"
+    ],
+    "t5[ʔ搪ŷ臹裂fɥǻŎB\u003e嫡g|妯C\u003e揕].t5[臒nj1].t5[*'%Ƿɋ媌廜Ś闋UǾ沲胑ǁ唪].t5": [
+      "type T5.T5"
+    ],
+    "t5[ʔ搪ŷ臹裂fɥǻŎB\u003e嫡g|妯C\u003e揕].t5[臒nj1].t5[*'%Ƿɋ媌廜Ś闋UǾ沲胑ǁ唪].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t5[ʔ搪ŷ臹裂fɥǻŎB\u003e嫡g|妯C\u003e揕].t5[臒nj1].t5[ĝ尸Å袕5誄X^疒zP椚ƍ鷾髣蠾Hǣ].t5": [
+      "type T5.T5"
+    ],
+    "t5[ʔ搪ŷ臹裂fɥǻŎB\u003e嫡g|妯C\u003e揕].t5[臒nj1].t5[ĝ尸Å袕5誄X^疒zP椚ƍ鷾髣蠾Hǣ].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t6[n9Š5詈aJ礵覞蔳磉!訫åqDZ駧ŋ`].s": [
+      "type T6.S"
+    ],
+    "t6[n9Š5詈aJ礵覞蔳磉!訫åqDZ駧ŋ`].t6[E嵥~ƆŎƹMVDz甋U慕當鮁].s": [
+      "type T6.S"
+    ],
+    "t6[n9Š5詈aJ礵覞蔳磉!訫åqDZ駧ŋ`].t6[E嵥~ƆŎƹMVDz甋U慕當鮁].t6[\\ƱZ\u003cs啘İƊ阼Ŝ¾0Nj].s": [
+      "type T6.S"
+    ],
+    "t6[n9Š5詈aJ礵覞蔳磉!訫åqDZ駧ŋ`].t6[E嵥~ƆŎƹMVDz甋U慕當鮁].t6[\\ƱZ\u003cs啘İƊ阼Ŝ¾0Nj].t6[].s": [
+      "type T6.S"
+    ],
+    "t6[n9Š5詈aJ礵覞蔳磉!訫åqDZ駧ŋ`].t6[E嵥~ƆŎƹMVDz甋U慕當鮁].t6[Ɛ].s": [
+      "type T6.S"
+    ],
+    "t6[n9Š5詈aJ礵覞蔳磉!訫åqDZ駧ŋ`].t6[E嵥~ƆŎƹMVDz甋U慕當鮁].t6[Ɛ].t6[].s": [
+      "type T6.S"
+    ],
+    "t6[n9Š5詈aJ礵覞蔳磉!訫åqDZ駧ŋ`].t6[產].s": [
+      "type T6.S"
+    ],
+    "t6[n9Š5詈aJ礵覞蔳磉!訫åqDZ駧ŋ`].t6[產].t6[/ƹ)pʖ竰].s": [
+      "type T6.S"
+    ],
+    "t6[n9Š5詈aJ礵覞蔳磉!訫åqDZ駧ŋ`].t6[產].t6[/ƹ)pʖ竰].t6[].s": [
+      "type T6.S"
+    ],
+    "t6[n9Š5詈aJ礵覞蔳磉!訫åqDZ駧ŋ`].t6[產].t6[燊a戉RɤƯæ榐].s": [
+      "type T6.S"
+    ],
+    "t6[n9Š5詈aJ礵覞蔳磉!訫åqDZ駧ŋ`].t6[產].t6[燊a戉RɤƯæ榐].t6[].s": [
+      "type T6.S"
+    ],
+    "t6[qÞ滇śĬƬǿ鸀Ĕ耀]ʮ樇軄].s": [
+      "type T6.S"
+    ],
+    "t6[qÞ滇śĬƬǿ鸀Ĕ耀]ʮ樇軄].t6[;ǜŻğr蜌].s": [
+      "type T6.S"
+    ],
+    "t6[qÞ滇śĬƬǿ鸀Ĕ耀]ʮ樇軄].t6[;ǜŻğr蜌].t6[辛].s": [
+      "type T6.S"
+    ],
+    "t6[qÞ滇śĬƬǿ鸀Ĕ耀]ʮ樇軄].t6[;ǜŻğr蜌].t6[辛].t6[].s": [
+      "type T6.S"
+    ],
+    "t6[qÞ滇śĬƬǿ鸀Ĕ耀]ʮ樇軄].t6[;ǜŻğr蜌].t6[颢c慽wikɮ5Y羁n蛣[鿱挹ñ].s": [
+      "type T6.S"
+    ],
+    "t6[qÞ滇śĬƬǿ鸀Ĕ耀]ʮ樇軄].t6[;ǜŻğr蜌].t6[颢c慽wikɮ5Y羁n蛣[鿱挹ñ].t6[].s": [
+      "type T6.S"
+    ],
+    "t6[qÞ滇śĬƬǿ鸀Ĕ耀]ʮ樇軄].t6[勝ǃ滪Ĉ³œ!閍0ʤ悕A1HMĴ!].s": [
+      "type T6.S"
+    ],
+    "t6[qÞ滇śĬƬǿ鸀Ĕ耀]ʮ樇軄].t6[勝ǃ滪Ĉ³œ!閍0ʤ悕A1HMĴ!].t6[:].s": [
+      "type T6.S"
+    ],
+    "t6[qÞ滇śĬƬǿ鸀Ĕ耀]ʮ樇軄].t6[勝ǃ滪Ĉ³œ!閍0ʤ悕A1HMĴ!].t6[:].t6[].s": [
+      "type T6.S"
+    ],
+    "t6[qÞ滇śĬƬǿ鸀Ĕ耀]ʮ樇軄].t6[勝ǃ滪Ĉ³œ!閍0ʤ悕A1HMĴ!].t6[Ȩ\u003e5咓Yȧâ{Uu缜犌菑ȃ環?钗Ǜ@].s": [
+      "type T6.S"
+    ],
+    "t6[qÞ滇śĬƬǿ鸀Ĕ耀]ʮ樇軄].t6[勝ǃ滪Ĉ³œ!閍0ʤ悕A1HMĴ!].t6[Ȩ\u003e5咓Yȧâ{Uu缜犌菑ȃ環?钗Ǜ@].t6[].s": [
+      "type T6.S"
+    ]
+  },
+  "*maps.T2": {
+    "mt1[,預].t2.mt1[şÅ9č傯ŤÑ珒¥ Ş!].t2.mt1[].t3": [
+      "type T3"
+    ],
+    "mt1[,預].t2.mt1[şÅ9č傯ŤÑ珒¥ Ş!].t3": [
+      "type T3"
+    ],
+    "mt1[,預].t2.mt1[şÅ9č傯ŤÑ珒¥ Ş!].t5[Fȓ¹謃售ʒȳ倲].t5": [
+      "type T5.T5"
+    ],
+    "mt1[,預].t2.mt1[şÅ9č傯ŤÑ珒¥ Ş!].t5[烼kƶ坋w剶ŷƇÿ櫌].t5": [
+      "type T5.T5"
+    ],
+    "mt1[,預].t2.mt1[şÅ9č傯ŤÑ珒¥ Ş!].t6[f].s": [
+      "type T6.S"
+    ],
+    "mt1[,預].t2.mt1[şÅ9č傯ŤÑ珒¥ Ş!].t6[ĩ}賹8秈卅Uʓ].s": [
+      "type T6.S"
+    ],
+    "mt1[,預].t2.mt1[侹rC綹l].t2.mt1[].t3": [
+      "type T3"
+    ],
+    "mt1[,預].t2.mt1[侹rC綹l].t3": [
+      "type T3"
+    ],
+    "mt1[,預].t2.mt1[侹rC綹l].t5[Eɧ].t5": [
+      "type T5.T5"
+    ],
+    "mt1[,預].t2.mt1[侹rC綹l].t5[ʭ郲騦Ɉ 炗颺].t5": [
+      "type T5.T5"
+    ],
+    "mt1[,預].t2.mt1[侹rC綹l].t6[Å圁椯Ĥɹ].s": [
+      "type T6.S"
+    ],
+    "mt1[,預].t2.mt1[侹rC綹l].t6[莡OĈ½ǝ].s": [
+      "type T6.S"
+    ],
+    "mt1[,預].t3": [
+      "type T3"
+    ],
+    "mt1[,預].t3.t4.mt3[匛9唟摴aĹƵ龁Ű慤T.偱袗zŒâ]": [
+      "type T3"
+    ],
+    "mt1[,預].t3.t4.mt3[苤犄4y±]": [
+      "type T3"
+    ],
+    "mt1[,預].t5[³ƒIʛŰSƆ檓Ò]0OKs褴ɧ櫎6].t5": [
+      "type T5.T5"
+    ],
+    "mt1[,預].t5[³ƒIʛŰSƆ檓Ò]0OKs褴ɧ櫎6].t5[Vȯ蓏靍p工ɃɎĨ\u003c愒Īdz橩m峻ĉ椦蘁].t5": [
+      "type T5.T5"
+    ],
+    "mt1[,預].t5[³ƒIʛŰSƆ檓Ò]0OKs褴ɧ櫎6].t5[Vȯ蓏靍p工ɃɎĨ\u003c愒Īdz橩m峻ĉ椦蘁].t5[].t5": [
+      "type T5.T5"
+    ],
+    "mt1[,預].t5[³ƒIʛŰSƆ檓Ò]0OKs褴ɧ櫎6].t5[a悦ƪW悩].t5": [
+      "type T5.T5"
+    ],
+    "mt1[,預].t5[³ƒIʛŰSƆ檓Ò]0OKs褴ɧ櫎6].t5[a悦ƪW悩].t5[].t5": [
+      "type T5.T5"
+    ],
+    "mt1[,預].t5[ƚ浻WEȕCX鏫oȼ$鹰ŭU4fAČ].t5": [
+      "type T5.T5"
+    ],
+    "mt1[,預].t5[ƚ浻WEȕCX鏫oȼ$鹰ŭU4fAČ].t5[].t5": [
+      "type T5.T5"
+    ],
+    "mt1[,預].t5[ƚ浻WEȕCX鏫oȼ$鹰ŭU4fAČ].t5[].t5[].t5": [
+      "type T5.T5"
+    ],
+    "mt1[,預].t5[ƚ浻WEȕCX鏫oȼ$鹰ŭU4fAČ].t5[Ģ笼[Mu穆期ƫ\\^lɠǂƾɬ].t5": [
+      "type T5.T5"
+    ],
+    "mt1[,預].t5[ƚ浻WEȕCX鏫oȼ$鹰ŭU4fAČ].t5[Ģ笼[Mu穆期ƫ\\^lɠǂƾɬ].t5[].t5": [
+      "type T5.T5"
+    ],
+    "mt1[,預].t6[5誄X^疒zP椚].s": [
+      "type T6.S"
+    ],
+    "mt1[,預].t6[5誄X^疒zP椚].t6[kȿM].s": [
+      "type T6.S"
+    ],
+    "mt1[,預].t6[5誄X^疒zP椚].t6[kȿM].t6[].s": [
+      "type T6.S"
+    ],
+    "mt1[,預].t6[5誄X^疒zP椚].t6[ʦȜ吶ɡ鱣ɥ].s": [
+      "type T6.S"
+    ],
+    "mt1[,預].t6[5誄X^疒zP椚].t6[ʦȜ吶ɡ鱣ɥ].t6[].s": [
+      "type T6.S"
+    ],
+    "mt1[,預].t6[嶆s\u003eɨ$ʮ秺].s": [
+      "type T6.S"
+    ],
+    "mt1[,預].t6[嶆s\u003eɨ$ʮ秺].t6[å偔7鉰竡弓Ū駢].s": [
+      "type T6.S"
+    ],
+    "mt1[,預].t6[嶆s\u003eɨ$ʮ秺].t6[å偔7鉰竡弓Ū駢].t6[].s": [
+      "type T6.S"
+    ],
+    "mt1[,預].t6[嶆s\u003eɨ$ʮ秺].t6[詈aJ礵覞蔳磉!訫åqDZ駧ŋ`].s": [
+      "type T6.S"
+    ],
+    "mt1[,預].t6[嶆s\u003eɨ$ʮ秺].t6[詈aJ礵覞蔳磉!訫åqDZ駧ŋ`].t6[].s": [
+      "type T6.S"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[F墄[C_睿ȉǫ蹟t´ûș$0đ\u003e].t2.mt1[].t3": [
+      "type T3"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[F墄[C_睿ȉǫ蹟t´ûș$0đ\u003e].t3": [
+      "type T3"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[F墄[C_睿ȉǫ蹟t´ûș$0đ\u003e].t5[].t5": [
+      "type T5.T5"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[F墄[C_睿ȉǫ蹟t´ûș$0đ\u003e].t5[ɹȽ東潇澍ȣ1ȖɥmeCʊ].t5": [
+      "type T5.T5"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[F墄[C_睿ȉǫ蹟t´ûș$0đ\u003e].t6[炄闌剾溏嶪滢w飃m=Sx蘳Gč].s": [
+      "type T6.S"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[F墄[C_睿ȉǫ蹟t´ûș$0đ\u003e].t6[霳鸻ȉĔȹ$Ievɥʈ摨aƈŲɩ].s": [
+      "type T6.S"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[鎑鎢屃裂ÀYǎ3].t2.mt1[].t3": [
+      "type T3"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[鎑鎢屃裂ÀYǎ3].t3": [
+      "type T3"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[鎑鎢屃裂ÀYǎ3].t5[ǪŰM旰綷罨袢捺悲ȅ].t5": [
+      "type T5.T5"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[鎑鎢屃裂ÀYǎ3].t5[巆Åʛ,^籿].t5": [
+      "type T5.T5"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[鎑鎢屃裂ÀYǎ3].t6[|2諱4~轱:Ž].s": [
+      "type T6.S"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t2.mt1[鎑鎢屃裂ÀYǎ3].t6[濓\u003c鈡鶭ŁPyÌ祆tkƺƠ].s": [
+      "type T6.S"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t3": [
+      "type T3"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t3.t4.mt3[]": [
+      "type T3"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t3.t4.mt3[h婉Ţ飦tD6]": [
+      "type T3"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[k].t5": [
+      "type T5.T5"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[k].t5[_榣ǝ祇Fæƭō跮ɽ].t5": [
+      "type T5.T5"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[k].t5[_榣ǝ祇Fæƭō跮ɽ].t5[].t5": [
+      "type T5.T5"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[k].t5[Ȃ遃ɸ].t5": [
+      "type T5.T5"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[k].t5[Ȃ遃ɸ].t5[].t5": [
+      "type T5.T5"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[煮FɀÄf渂硹譯匬襧*].t5": [
+      "type T5.T5"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[煮FɀÄf渂硹譯匬襧*].t5[¤0ȻG炕炎鷖Ʊ腘愫躧ǏȬ¹ʍc].t5": [
+      "type T5.T5"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[煮FɀÄf渂硹譯匬襧*].t5[¤0ȻG炕炎鷖Ʊ腘愫躧ǏȬ¹ʍc].t5[].t5": [
+      "type T5.T5"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[煮FɀÄf渂硹譯匬襧*].t5[机Ȱ晸ʈ劉j蕓ư銩6ij憏歅%].t5": [
+      "type T5.T5"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[煮FɀÄf渂硹譯匬襧*].t5[机Ȱ晸ʈ劉j蕓ư銩6ij憏歅%].t5[].t5": [
+      "type T5.T5"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[ʩ@蚿Ī炕杭剛ň=Z?ǿ\u003cɀ].s": [
+      "type T6.S"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[ʩ@蚿Ī炕杭剛ň=Z?ǿ\u003cɀ].t6[Ɂɯz剩Ʉö宰岮3瓯].s": [
+      "type T6.S"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[ʩ@蚿Ī炕杭剛ň=Z?ǿ\u003cɀ].t6[Ɂɯz剩Ʉö宰岮3瓯].t6[].s": [
+      "type T6.S"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[ʩ@蚿Ī炕杭剛ň=Z?ǿ\u003cɀ].t6[ʙ堠].s": [
+      "type T6.S"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[ʩ@蚿Ī炕杭剛ň=Z?ǿ\u003cɀ].t6[ʙ堠].t6[].s": [
+      "type T6.S"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[轊`JT瘮Q].s": [
+      "type T6.S"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[轊`JT瘮Q].t6[Ȳ梚鿱o糛趸鸎|烈膞`蠯)Þ宅p葤Ø/].s": [
+      "type T6.S"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[轊`JT瘮Q].t6[Ȳ梚鿱o糛趸鸎|烈膞`蠯)Þ宅p葤Ø/].t6[].s": [
+      "type T6.S"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[轊`JT瘮Q].t6[ȿ].s": [
+      "type T6.S"
+    ],
+    "mt1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t6[轊`JT瘮Q].t6[ȿ].t6[].s": [
+      "type T6.S"
+    ]
+  },
+  "*maps.T3": {
+    "": [
+      "type T3"
+    ],
+    "t4.mt3[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ]": [
+      "type T3"
+    ],
+    "t4.mt3[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t4.mt3[!Ǫ]": [
+      "type T3"
+    ],
+    "t4.mt3[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t4.mt3[鎑鎢屃裂ÀYǎ3]": [
+      "type T3"
+    ],
+    "t4.mt3[ɜH偩j0âȰ轷N巆Åʛ]": [
+      "type T3"
+    ],
+    "t4.mt3[ɜH偩j0âȰ轷N巆Åʛ].t4.mt3[^籿Ź]": [
+      "type T3"
+    ],
+    "t4.mt3[ɜH偩j0âȰ轷N巆Åʛ].t4.mt3[稈V]": [
+      "type T3"
+    ]
+  },
+  "*maps.T4": {
+    "mt3[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ]": [
+      "type T3"
+    ],
+    "mt3[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t4.mt3[成oɜH偩j0âȰ轷N巆Åʛ,^籿]": [
+      "type T3"
+    ],
+    "mt3[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t4.mt3[成oɜH偩j0âȰ轷N巆Åʛ,^籿].t4.mt3[]": [
+      "type T3"
+    ],
+    "mt3[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t4.mt3[鎑鎢屃裂ÀYǎ3]": [
+      "type T3"
+    ],
+    "mt3[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t4.mt3[鎑鎢屃裂ÀYǎ3].t4.mt3[]": [
+      "type T3"
+    ],
+    "mt3[濓\u003c鈡鶭ŁPyÌ祆tkƺƠ]": [
+      "type T3"
+    ],
+    "mt3[濓\u003c鈡鶭ŁPyÌ祆tkƺƠ].t4.mt3[v$蛷)讻IeYF墄[C_睿ȉǫ蹟t´]": [
+      "type T3"
+    ],
+    "mt3[濓\u003c鈡鶭ŁPyÌ祆tkƺƠ].t4.mt3[v$蛷)讻IeYF墄[C_睿ȉǫ蹟t´].t4.mt3[]": [
+      "type T3"
+    ],
+    "mt3[濓\u003c鈡鶭ŁPyÌ祆tkƺƠ].t4.mt3[ș$0đ\u003eƯ]ɹȽ東]": [
+      "type T3"
+    ],
+    "mt3[濓\u003c鈡鶭ŁPyÌ祆tkƺƠ].t4.mt3[ș$0đ\u003eƯ]ɹȽ東].t4.mt3[]": [
+      "type T3"
+    ]
+  },
+  "*maps.T5": {
+    "t5": [
+      "type T5.T5"
+    ],
+    "t5[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5": [
+      "type T5.T5"
+    ],
+    "t5[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[v$蛷)讻IeYF墄[C_睿ȉǫ蹟t´].t5": [
+      "type T5.T5"
+    ],
+    "t5[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[v$蛷)讻IeYF墄[C_睿ȉǫ蹟t´].t5[ș$0đ\u003eƯ]ɹȽ東].t5": [
+      "type T5.T5"
+    ],
+    "t5[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[v$蛷)讻IeYF墄[C_睿ȉǫ蹟t´].t5[ș$0đ\u003eƯ]ɹȽ東].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t5[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[v$蛷)讻IeYF墄[C_睿ȉǫ蹟t´].t5[澍ȣ].t5": [
+      "type T5.T5"
+    ],
+    "t5[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[v$蛷)讻IeYF墄[C_睿ȉǫ蹟t´].t5[澍ȣ].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t5[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[鎑鎢屃裂ÀYǎ3].t5": [
+      "type T5.T5"
+    ],
+    "t5[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[鎑鎢屃裂ÀYǎ3].t5[成oɜH偩j0âȰ轷N巆Åʛ,^籿].t5": [
+      "type T5.T5"
+    ],
+    "t5[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[鎑鎢屃裂ÀYǎ3].t5[成oɜH偩j0âȰ轷N巆Åʛ,^籿].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t5[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[鎑鎢屃裂ÀYǎ3].t5[濓\u003c鈡鶭ŁPyÌ祆tkƺƠ].t5": [
+      "type T5.T5"
+    ],
+    "t5[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].t5[鎑鎢屃裂ÀYǎ3].t5[濓\u003c鈡鶭ŁPyÌ祆tkƺƠ].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t5[ȖɥmeCʊ ].t5": [
+      "type T5.T5"
+    ],
+    "t5[ȖɥmeCʊ ].t5[Sx蘳Gčü櫒}眙+].t5": [
+      "type T5.T5"
+    ],
+    "t5[ȖɥmeCʊ ].t5[Sx蘳Gčü櫒}眙+].t5[LuVǭz瘯霡].t5": [
+      "type T5.T5"
+    ],
+    "t5[ȖɥmeCʊ ].t5[Sx蘳Gčü櫒}眙+].t5[LuVǭz瘯霡].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t5[ȖɥmeCʊ ].t5[Sx蘳Gčü櫒}眙+].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t5[ȖɥmeCʊ ].t5[Sx蘳Gčü櫒}眙+].t5[].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t5[ȖɥmeCʊ ].t5[闌剾溏].t5": [
+      "type T5.T5"
+    ],
+    "t5[ȖɥmeCʊ ].t5[闌剾溏].t5[m].t5": [
+      "type T5.T5"
+    ],
+    "t5[ȖɥmeCʊ ].t5[闌剾溏].t5[m].t5[].t5": [
+      "type T5.T5"
+    ],
+    "t5[ȖɥmeCʊ ].t5[闌剾溏].t5[滢w].t5": [
+      "type T5.T5"
+    ],
+    "t5[ȖɥmeCʊ ].t5[闌剾溏].t5[滢w].t5[].t5": [
+      "type T5.T5"
+    ]
+  },
+  "*maps.T6": {
+    "s": [
+      "type T6.S"
+    ],
+    "t6[h婉Ţ飦tD6].s": [
+      "type T6.S"
+    ],
+    "t6[h婉Ţ飦tD6].t6[].s": [
+      "type T6.S"
+    ],
+    "t6[h婉Ţ飦tD6].t6[].t6[*Z迖瓼轊`JT瘮Q8ý譎].s": [
+      "type T6.S"
+    ],
+    "t6[h婉Ţ飦tD6].t6[].t6[*Z迖瓼轊`JT瘮Q8ý譎].t6[].s": [
+      "type T6.S"
+    ],
+    "t6[h婉Ţ飦tD6].t6[].t6[\u003c巭蜏恝墜ǔ爡].s": [
+      "type T6.S"
+    ],
+    "t6[h婉Ţ飦tD6].t6[].t6[\u003c巭蜏恝墜ǔ爡].t6[].s": [
+      "type T6.S"
+    ],
+    "t6[苬ĥəƣ[x飖Ǒp!ǪŰM旰綷罨袢].s": [
+      "type T6.S"
+    ],
+    "t6[苬ĥəƣ[x飖Ǒp!ǪŰM旰綷罨袢].t6[Åʛ,^籿Ź濓].s": [
+      "type T6.S"
+    ],
+    "t6[苬ĥəƣ[x飖Ǒp!ǪŰM旰綷罨袢].t6[Åʛ,^籿Ź濓].t6[2諱4].s": [
+      "type T6.S"
+    ],
+    "t6[苬ĥəƣ[x飖Ǒp!ǪŰM旰綷罨袢].t6[Åʛ,^籿Ź濓].t6[2諱4].t6[].s": [
+      "type T6.S"
+    ],
+    "t6[苬ĥəƣ[x飖Ǒp!ǪŰM旰綷罨袢].t6[Åʛ,^籿Ź濓].t6[睿ȉǫ蹟t´ûș$0].s": [
+      "type T6.S"
+    ],
+    "t6[苬ĥəƣ[x飖Ǒp!ǪŰM旰綷罨袢].t6[Åʛ,^籿Ź濓].t6[睿ȉǫ蹟t´ûș$0].t6[].s": [
+      "type T6.S"
+    ],
+    "t6[苬ĥəƣ[x飖Ǒp!ǪŰM旰綷罨袢].t6[蒫÷K鬣壈gƢ板鋩伸~槱¡r].s": [
+      "type T6.S"
+    ],
+    "t6[苬ĥəƣ[x飖Ǒp!ǪŰM旰綷罨袢].t6[蒫÷K鬣壈gƢ板鋩伸~槱¡r].t6[ 炄闌剾溏嶪滢w].s": [
+      "type T6.S"
+    ],
+    "t6[苬ĥəƣ[x飖Ǒp!ǪŰM旰綷罨袢].t6[蒫÷K鬣壈gƢ板鋩伸~槱¡r].t6[ 炄闌剾溏嶪滢w].t6[].s": [
+      "type T6.S"
+    ],
+    "t6[苬ĥəƣ[x飖Ǒp!ǪŰM旰綷罨袢].t6[蒫÷K鬣壈gƢ板鋩伸~槱¡r].t6[].s": [
+      "type T6.S"
+    ],
+    "t6[苬ĥəƣ[x飖Ǒp!ǪŰM旰綷罨袢].t6[蒫÷K鬣壈gƢ板鋩伸~槱¡r].t6[].t6[].s": [
+      "type T6.S"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/zz_generated.validations.go
new file mode 100644
index 0000000000..0c9ae1e747
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/zz_generated.validations.go
@@ -0,0 +1,433 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package maps
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T2
+	scheme.AddValidationFunc(
+		(*T2)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T2(
+					ctx, op, nil, /* fldPath */
+					obj.(*T2),
+					safe.Cast[*T2](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T3
+	scheme.AddValidationFunc(
+		(*T3)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T3(
+					ctx, op, nil, /* fldPath */
+					obj.(*T3),
+					safe.Cast[*T3](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T4
+	scheme.AddValidationFunc(
+		(*T4)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T4(
+					ctx, op, nil, /* fldPath */
+					obj.(*T4),
+					safe.Cast[*T4](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T5
+	scheme.AddValidationFunc(
+		(*T5)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T5(
+					ctx, op, nil, /* fldPath */
+					obj.(*T5),
+					safe.Cast[*T5](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T6
+	scheme.AddValidationFunc(
+		(*T6)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T6(
+					ctx, op, nil, /* fldPath */
+					obj.(*T6),
+					safe.Cast[*T6](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	{ // field T1.T2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T2 {
+				return &oldObj.T2
+			})
+		errs = append(errs, fn(fldPath.Child("t2"), &obj.T2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.T3
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T3,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T3(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T3 {
+				return &oldObj.T3
+			})
+		errs = append(errs, fn(fldPath.Child("t3"), &obj.T3, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.T5
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]T5,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T5); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) map[string]T5 {
+				return oldObj.T5
+			})
+		errs = append(errs, fn(fldPath.Child("t5"), obj.T5, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.T6
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]T6,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T6); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) map[string]T6 {
+				return oldObj.T6
+			})
+		errs = append(errs, fn(fldPath.Child("t6"), obj.T6, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T2 validates an instance of T2 according
+// to declarative validation rules in the API schema.
+func Validate_T2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T2) (errs field.ErrorList) {
+
+	{ // field T2.MT1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]T1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) map[string]T1 {
+				return oldObj.MT1
+			})
+		errs = append(errs, fn(fldPath.Child("mt1"), obj.MT1, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T3 validates an instance of T3 according
+// to declarative validation rules in the API schema.
+func Validate_T3(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T3) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T3"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field T3.T4
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T4,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T4(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T3) *T4 {
+				return &oldObj.T4
+			})
+		errs = append(errs, fn(fldPath.Child("t4"), &obj.T4, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T4 validates an instance of T4 according
+// to declarative validation rules in the API schema.
+func Validate_T4(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T4) (errs field.ErrorList) {
+
+	{ // field T4.MT3
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]T3,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T3); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T4) map[string]T3 {
+				return oldObj.MT3
+			})
+		errs = append(errs, fn(fldPath.Child("mt3"), obj.MT3, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T5 validates an instance of T5 according
+// to declarative validation rules in the API schema.
+func Validate_T5(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T5) (errs field.ErrorList) {
+
+	{ // field T5.T5
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]T5,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T5.T5"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T5); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T5) map[string]T5 {
+				return oldObj.T5
+			})
+		errs = append(errs, fn(fldPath.Child("t5"), obj.T5, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T6 validates an instance of T6 according
+// to declarative validation rules in the API schema.
+func Validate_T6(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T6) (errs field.ErrorList) {
+
+	{ // field T6.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T6.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T6) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T6.T6
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]T6,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T6); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T6) map[string]T6 {
+				return oldObj.T6
+			})
+		errs = append(errs, fn(fldPath.Child("t6"), obj.T6, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
+func deepEqualImpl_[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/zz_generated.validations_test.go
new file mode 100644
index 0000000000..12393a0ccd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package maps
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/pointers/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/pointers/doc.go
new file mode 100644
index 0000000000..a05d714336
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/pointers/doc.go
@@ -0,0 +1,70 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package pointers
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// This test case is carefully constructed to test recursion. We don't want to
+// add more `validateFalse` tags because we want to test the recursion.
+//
+// Expectations:
+// * We should emit validation for T1 because it uses T2 which uses T3, which has validation.
+// * We should emit validation for T2 because it uses T3, which has validation.
+// * We should emit validation for T3 because it has validation.
+// * We should NOT emit validation for T4.
+// * T1 should call optional(T1), T2 and optional(T2).
+// * T2 should call optional(T1), optional(T2), and optional(T3).
+
+type T1 struct {
+	// +k8s:optional
+	PT1 *T1 `json:"pt1"`
+
+	T2 T2 `json:"t2"`
+
+	// +k8s:optional
+	PT2 *T2 `json:"pt2"`
+}
+
+type T2 struct {
+	// +k8s:optional
+	PT1 *T1 `json:"pt1"`
+
+	// +k8s:optional
+	PT2 *T2 `json:"pt2"`
+
+	// +k8s:optional
+	PT3 *T3 `json:"pt3"`
+}
+
+// +k8s:validateFalse="type T3"
+type T3 struct {
+	I int `json:"i"`
+}
+
+// NOTE: no validations.
+type T4 struct {
+	// NOTE: no validations.
+	PT4 *T4 `json:"pt4"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/pointers/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/pointers/testdata/validate-false.json
new file mode 100644
index 0000000000..5b94982940
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/pointers/testdata/validate-false.json
@@ -0,0 +1,110 @@
+{
+  "*pointers.T1": {
+    "pt1.pt1.pt2.pt3": [
+      "type T3"
+    ],
+    "pt1.pt1.t2.pt3": [
+      "type T3"
+    ],
+    "pt1.pt2.pt2.pt3": [
+      "type T3"
+    ],
+    "pt1.pt2.pt3": [
+      "type T3"
+    ],
+    "pt1.t2.pt1.t2.pt3": [
+      "type T3"
+    ],
+    "pt1.t2.pt2.pt3": [
+      "type T3"
+    ],
+    "pt1.t2.pt3": [
+      "type T3"
+    ],
+    "pt2.pt1.pt2.pt3": [
+      "type T3"
+    ],
+    "pt2.pt1.t2.pt3": [
+      "type T3"
+    ],
+    "pt2.pt2.pt2.pt3": [
+      "type T3"
+    ],
+    "pt2.pt2.pt3": [
+      "type T3"
+    ],
+    "pt2.pt3": [
+      "type T3"
+    ],
+    "t2.pt1.pt1.t2.pt3": [
+      "type T3"
+    ],
+    "t2.pt1.pt2.pt3": [
+      "type T3"
+    ],
+    "t2.pt1.t2.pt2.pt3": [
+      "type T3"
+    ],
+    "t2.pt1.t2.pt3": [
+      "type T3"
+    ],
+    "t2.pt2.pt1.t2.pt3": [
+      "type T3"
+    ],
+    "t2.pt2.pt2.pt3": [
+      "type T3"
+    ],
+    "t2.pt2.pt3": [
+      "type T3"
+    ],
+    "t2.pt3": [
+      "type T3"
+    ]
+  },
+  "*pointers.T2": {
+    "pt1.pt1.pt2.pt3": [
+      "type T3"
+    ],
+    "pt1.pt1.t2.pt3": [
+      "type T3"
+    ],
+    "pt1.pt2.pt2.pt3": [
+      "type T3"
+    ],
+    "pt1.pt2.pt3": [
+      "type T3"
+    ],
+    "pt1.t2.pt1.t2.pt3": [
+      "type T3"
+    ],
+    "pt1.t2.pt2.pt3": [
+      "type T3"
+    ],
+    "pt1.t2.pt3": [
+      "type T3"
+    ],
+    "pt2.pt1.pt2.pt3": [
+      "type T3"
+    ],
+    "pt2.pt1.t2.pt3": [
+      "type T3"
+    ],
+    "pt2.pt2.pt2.pt3": [
+      "type T3"
+    ],
+    "pt2.pt2.pt3": [
+      "type T3"
+    ],
+    "pt2.pt3": [
+      "type T3"
+    ],
+    "pt3": [
+      "type T3"
+    ]
+  },
+  "*pointers.T3": {
+    "": [
+      "type T3"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/pointers/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/pointers/zz_generated.validations.go
new file mode 100644
index 0000000000..4bb115f2b6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/pointers/zz_generated.validations.go
@@ -0,0 +1,291 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package pointers
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T2
+	scheme.AddValidationFunc(
+		(*T2)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T2(
+					ctx, op, nil, /* fldPath */
+					obj.(*T2),
+					safe.Cast[*T2](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T3
+	scheme.AddValidationFunc(
+		(*T3)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T3(
+					ctx, op, nil, /* fldPath */
+					obj.(*T3),
+					safe.Cast[*T3](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	{ // field T1.PT1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T1 {
+				return oldObj.PT1
+			})
+		errs = append(errs, fn(fldPath.Child("pt1"), obj.PT1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.T2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T2 {
+				return &oldObj.T2
+			})
+		errs = append(errs, fn(fldPath.Child("t2"), &obj.T2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PT2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T2 {
+				return oldObj.PT2
+			})
+		errs = append(errs, fn(fldPath.Child("pt2"), obj.PT2, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T2 validates an instance of T2 according
+// to declarative validation rules in the API schema.
+func Validate_T2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T2) (errs field.ErrorList) {
+
+	{ // field T2.PT1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *T1 {
+				return oldObj.PT1
+			})
+		errs = append(errs, fn(fldPath.Child("pt1"), obj.PT1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T2.PT2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *T2 {
+				return oldObj.PT2
+			})
+		errs = append(errs, fn(fldPath.Child("pt2"), obj.PT2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T2.PT3
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T3,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T3(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *T3 {
+				return oldObj.PT3
+			})
+		errs = append(errs, fn(fldPath.Child("pt3"), obj.PT3, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T3 validates an instance of T3 according
+// to declarative validation rules in the API schema.
+func Validate_T3(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T3) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T3"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field T3.I has no validation
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/pointers/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/pointers/zz_generated.validations_test.go
new file mode 100644
index 0000000000..b1ab618180
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/pointers/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package pointers
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/slices/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/slices/doc.go
new file mode 100644
index 0000000000..1059682c6e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/slices/doc.go
@@ -0,0 +1,74 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package slices
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// This test case is carefully constructed to test recursion. We don't want to
+// add more `validateFalse` tags because the bug that motivated this test
+// wasn't looking deep enough into the recursion tree.
+//
+// Expectations:
+// * We should emit validation for T1 because T3 has validation.
+// * We should emit validation for T2 because it uses T1, which has validation.
+// * We should emit validation for T3 because it has validation.
+// * We should emit validation for T4 because it uses T3, which has validation.
+// * T1 should call T2 and T3.
+// * T2 should call eachVal(T1).
+// * T3 should call T4.
+// * T4 should call eachVal(T3).
+// * T5 and T6 hold a slice of themselves, reached via T1 so the slice type is
+//   still being discovered when its own field is processed.
+
+type T1 struct {
+	T2 T2   `json:"t2"`
+	T3 T3   `json:"t3"`
+	T5 []T5 `json:"t5"`
+	T6 []T6 `json:"t6"`
+}
+
+type T2 struct {
+	ST1 []T1 `json:"st1"`
+}
+
+// +k8s:validateFalse="type T3"
+type T3 struct {
+	T4 T4 `json:"t4"`
+}
+
+type T4 struct {
+	ST3 []T3 `json:"st3"`
+}
+
+type T5 struct {
+	// +k8s:validateFalse="type T5.T5"
+	T5 []T5 `json:"t5"`
+}
+
+type T6 struct {
+	// +k8s:validateFalse="type T6.S"
+	S  string `json:"s"`
+	T6 []T6   `json:"t6"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/slices/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/slices/testdata/validate-false.json
new file mode 100644
index 0000000000..8e3fe9e590
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/slices/testdata/validate-false.json
@@ -0,0 +1,884 @@
+{
+  "*slices.T1": {
+    "t2.st1[0].t2.st1[0].t3": [
+      "type T3"
+    ],
+    "t2.st1[0].t2.st1[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[0].t2.st1[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[0].t2.st1[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t2.st1[0].t2.st1[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t2.st1[0].t2.st1[1].t3": [
+      "type T3"
+    ],
+    "t2.st1[0].t2.st1[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[0].t2.st1[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[0].t2.st1[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t2.st1[0].t2.st1[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t2.st1[0].t3": [
+      "type T3"
+    ],
+    "t2.st1[0].t3.t4.st3[0]": [
+      "type T3"
+    ],
+    "t2.st1[0].t3.t4.st3[1]": [
+      "type T3"
+    ],
+    "t2.st1[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[0].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[0].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[0].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[0].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t2.st1[0].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t2.st1[0].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t2.st1[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t2.st1[0].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t2.st1[0].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t2.st1[1].t2.st1[0].t3": [
+      "type T3"
+    ],
+    "t2.st1[1].t2.st1[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[1].t2.st1[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[1].t2.st1[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t2.st1[1].t2.st1[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t2.st1[1].t2.st1[1].t3": [
+      "type T3"
+    ],
+    "t2.st1[1].t2.st1[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[1].t2.st1[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[1].t2.st1[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t2.st1[1].t2.st1[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t2.st1[1].t3": [
+      "type T3"
+    ],
+    "t2.st1[1].t3.t4.st3[0]": [
+      "type T3"
+    ],
+    "t2.st1[1].t3.t4.st3[1]": [
+      "type T3"
+    ],
+    "t2.st1[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[1].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[1].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[1].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[1].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t2.st1[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t2.st1[1].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t2.st1[1].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t2.st1[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t2.st1[1].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t2.st1[1].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t3": [
+      "type T3"
+    ],
+    "t3.t4.st3[0]": [
+      "type T3"
+    ],
+    "t3.t4.st3[0].t4.st3[0]": [
+      "type T3"
+    ],
+    "t3.t4.st3[0].t4.st3[1]": [
+      "type T3"
+    ],
+    "t3.t4.st3[1]": [
+      "type T3"
+    ],
+    "t3.t4.st3[1].t4.st3[0]": [
+      "type T3"
+    ],
+    "t3.t4.st3[1].t4.st3[1]": [
+      "type T3"
+    ],
+    "t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[0].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[0].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[0].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[0].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[1].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[1].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[1].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[1].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[0].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[0].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[0].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[0].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[1].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[1].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[1].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[1].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[0].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[0].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[0].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[0].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[1].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[1].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[1].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[1].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[0].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[0].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[0].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[0].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[1].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[1].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[1].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[1].t6[1].t6[1].s": [
+      "type T6.S"
+    ]
+  },
+  "*slices.T2": {
+    "st1[0].t2.st1[0].t2.st1[0].t3": [
+      "type T3"
+    ],
+    "st1[0].t2.st1[0].t2.st1[1].t3": [
+      "type T3"
+    ],
+    "st1[0].t2.st1[0].t3": [
+      "type T3"
+    ],
+    "st1[0].t2.st1[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t2.st1[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t2.st1[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[0].t2.st1[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[0].t2.st1[1].t2.st1[0].t3": [
+      "type T3"
+    ],
+    "st1[0].t2.st1[1].t2.st1[1].t3": [
+      "type T3"
+    ],
+    "st1[0].t2.st1[1].t3": [
+      "type T3"
+    ],
+    "st1[0].t2.st1[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t2.st1[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t2.st1[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[0].t2.st1[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[0].t3": [
+      "type T3"
+    ],
+    "st1[0].t3.t4.st3[0]": [
+      "type T3"
+    ],
+    "st1[0].t3.t4.st3[1]": [
+      "type T3"
+    ],
+    "st1[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t5[0].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t5[0].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t5[0].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t5[0].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t5[1].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t5[1].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t5[1].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t5[1].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[0].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[0].t6[0].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[0].t6[0].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[0].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[0].t6[0].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[0].t6[0].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[0].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[0].t6[1].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[0].t6[1].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[0].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[0].t6[1].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[0].t6[1].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[1].t2.st1[0].t2.st1[0].t3": [
+      "type T3"
+    ],
+    "st1[1].t2.st1[0].t2.st1[1].t3": [
+      "type T3"
+    ],
+    "st1[1].t2.st1[0].t3": [
+      "type T3"
+    ],
+    "st1[1].t2.st1[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t2.st1[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t2.st1[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[1].t2.st1[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[1].t2.st1[1].t2.st1[0].t3": [
+      "type T3"
+    ],
+    "st1[1].t2.st1[1].t2.st1[1].t3": [
+      "type T3"
+    ],
+    "st1[1].t2.st1[1].t3": [
+      "type T3"
+    ],
+    "st1[1].t2.st1[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t2.st1[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t2.st1[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[1].t2.st1[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[1].t3": [
+      "type T3"
+    ],
+    "st1[1].t3.t4.st3[0]": [
+      "type T3"
+    ],
+    "st1[1].t3.t4.st3[1]": [
+      "type T3"
+    ],
+    "st1[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t5[0].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t5[0].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t5[0].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t5[0].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t5[1].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t5[1].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t5[1].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t5[1].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "st1[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[1].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[1].t6[0].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[1].t6[0].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[1].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[1].t6[0].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[1].t6[0].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[1].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[1].t6[1].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[1].t6[1].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[1].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "st1[1].t6[1].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "st1[1].t6[1].t6[1].t6[1].s": [
+      "type T6.S"
+    ]
+  },
+  "*slices.T3": {
+    "": [
+      "type T3"
+    ],
+    "t4.st3[0]": [
+      "type T3"
+    ],
+    "t4.st3[0].t4.st3[0]": [
+      "type T3"
+    ],
+    "t4.st3[0].t4.st3[1]": [
+      "type T3"
+    ],
+    "t4.st3[1]": [
+      "type T3"
+    ],
+    "t4.st3[1].t4.st3[0]": [
+      "type T3"
+    ],
+    "t4.st3[1].t4.st3[1]": [
+      "type T3"
+    ]
+  },
+  "*slices.T4": {
+    "st3[0]": [
+      "type T3"
+    ],
+    "st3[0].t4.st3[0]": [
+      "type T3"
+    ],
+    "st3[0].t4.st3[0].t4.st3[0]": [
+      "type T3"
+    ],
+    "st3[0].t4.st3[0].t4.st3[1]": [
+      "type T3"
+    ],
+    "st3[0].t4.st3[1]": [
+      "type T3"
+    ],
+    "st3[0].t4.st3[1].t4.st3[0]": [
+      "type T3"
+    ],
+    "st3[0].t4.st3[1].t4.st3[1]": [
+      "type T3"
+    ],
+    "st3[1]": [
+      "type T3"
+    ],
+    "st3[1].t4.st3[0]": [
+      "type T3"
+    ],
+    "st3[1].t4.st3[0].t4.st3[0]": [
+      "type T3"
+    ],
+    "st3[1].t4.st3[0].t4.st3[1]": [
+      "type T3"
+    ],
+    "st3[1].t4.st3[1]": [
+      "type T3"
+    ],
+    "st3[1].t4.st3[1].t4.st3[0]": [
+      "type T3"
+    ],
+    "st3[1].t4.st3[1].t4.st3[1]": [
+      "type T3"
+    ]
+  },
+  "*slices.T5": {
+    "t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[0].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[0].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[0].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[0].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[1].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[1].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[1].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[0].t5[1].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[0].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[0].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[0].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[0].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[1].t5[0].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[1].t5[0].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[1].t5[1].t5[0].t5": [
+      "type T5.T5"
+    ],
+    "t5[1].t5[1].t5[1].t5[1].t5": [
+      "type T5.T5"
+    ]
+  },
+  "*slices.T6": {
+    "s": [
+      "type T6.S"
+    ],
+    "t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[0].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[0].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[0].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[0].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[1].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[1].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[1].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[0].t6[1].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[0].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[0].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[0].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[0].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[1].t6[0].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[1].t6[0].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[1].t6[1].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[1].t6[1].t6[0].s": [
+      "type T6.S"
+    ],
+    "t6[1].t6[1].t6[1].t6[1].s": [
+      "type T6.S"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/slices/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/slices/zz_generated.validations.go
new file mode 100644
index 0000000000..955e4d94ae
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/slices/zz_generated.validations.go
@@ -0,0 +1,428 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package slices
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T2
+	scheme.AddValidationFunc(
+		(*T2)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T2(
+					ctx, op, nil, /* fldPath */
+					obj.(*T2),
+					safe.Cast[*T2](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T3
+	scheme.AddValidationFunc(
+		(*T3)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T3(
+					ctx, op, nil, /* fldPath */
+					obj.(*T3),
+					safe.Cast[*T3](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T4
+	scheme.AddValidationFunc(
+		(*T4)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T4(
+					ctx, op, nil, /* fldPath */
+					obj.(*T4),
+					safe.Cast[*T4](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T5
+	scheme.AddValidationFunc(
+		(*T5)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T5(
+					ctx, op, nil, /* fldPath */
+					obj.(*T5),
+					safe.Cast[*T5](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T6
+	scheme.AddValidationFunc(
+		(*T6)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T6(
+					ctx, op, nil, /* fldPath */
+					obj.(*T6),
+					safe.Cast[*T6](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	{ // field T1.T2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T2 {
+				return &oldObj.T2
+			})
+		errs = append(errs, fn(fldPath.Child("t2"), &obj.T2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.T3
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T3,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T3(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T3 {
+				return &oldObj.T3
+			})
+		errs = append(errs, fn(fldPath.Child("t3"), &obj.T3, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.T5
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []T5,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_T5); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) []T5 {
+				return oldObj.T5
+			})
+		errs = append(errs, fn(fldPath.Child("t5"), obj.T5, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.T6
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []T6,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_T6); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) []T6 {
+				return oldObj.T6
+			})
+		errs = append(errs, fn(fldPath.Child("t6"), obj.T6, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T2 validates an instance of T2 according
+// to declarative validation rules in the API schema.
+func Validate_T2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T2) (errs field.ErrorList) {
+
+	{ // field T2.ST1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []T1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_T1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) []T1 {
+				return oldObj.ST1
+			})
+		errs = append(errs, fn(fldPath.Child("st1"), obj.ST1, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T3 validates an instance of T3 according
+// to declarative validation rules in the API schema.
+func Validate_T3(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T3) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T3"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field T3.T4
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T4,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T4(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T3) *T4 {
+				return &oldObj.T4
+			})
+		errs = append(errs, fn(fldPath.Child("t4"), &obj.T4, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T4 validates an instance of T4 according
+// to declarative validation rules in the API schema.
+func Validate_T4(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T4) (errs field.ErrorList) {
+
+	{ // field T4.ST3
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []T3,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_T3); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T4) []T3 {
+				return oldObj.ST3
+			})
+		errs = append(errs, fn(fldPath.Child("st3"), obj.ST3, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T5 validates an instance of T5 according
+// to declarative validation rules in the API schema.
+func Validate_T5(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T5) (errs field.ErrorList) {
+
+	{ // field T5.T5
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []T5,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T5.T5"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_T5); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T5) []T5 {
+				return oldObj.T5
+			})
+		errs = append(errs, fn(fldPath.Child("t5"), obj.T5, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T6 validates an instance of T6 according
+// to declarative validation rules in the API schema.
+func Validate_T6(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T6) (errs field.ErrorList) {
+
+	{ // field T6.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T6.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T6) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T6.T6
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []T6,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_T6); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T6) []T6 {
+				return oldObj.T6
+			})
+		errs = append(errs, fn(fldPath.Child("t6"), obj.T6, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/slices/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/slices/zz_generated.validations_test.go
new file mode 100644
index 0000000000..231d9cd808
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/slices/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package slices
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/multiple_validations/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/multiple_validations/doc.go
new file mode 100644
index 0000000000..89dac1835e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/multiple_validations/doc.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package multiplevalidations
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// +k8s:validateFalse="type Struct #1"
+// +k8s:validateFalse="type Struct #2"
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field Struct.ListField #1"
+	// +k8s:validateFalse="field Struct.ListField #2"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListField[*] #1"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListField[*] #2"
+	ListField []string `json:"listField"`
+
+	UnvalidatedListField []string `json:"UnvalidatedListField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/multiple_validations/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/multiple_validations/testdata/validate-false.json
new file mode 100644
index 0000000000..4748ab66de
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/multiple_validations/testdata/validate-false.json
@@ -0,0 +1,20 @@
+{
+  "*multiplevalidations.Struct": {
+    "": [
+      "type Struct #1",
+      "type Struct #2"
+    ],
+    "listField": [
+      "field Struct.ListField #1",
+      "field Struct.ListField #2"
+    ],
+    "listField[0]": [
+      "field Struct.ListField[*] #1",
+      "field Struct.ListField[*] #2"
+    ],
+    "listField[1]": [
+      "field Struct.ListField[*] #1",
+      "field Struct.ListField[*] #2"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/multiple_validations/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/multiple_validations/zz_generated.validations.go
new file mode 100644
index 0000000000..f11b354e2b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/multiple_validations/zz_generated.validations.go
@@ -0,0 +1,115 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package multiplevalidations
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type Struct #1"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type Struct #2"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ListField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListField #1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListField #2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListField[*] #1")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListField[*] #2")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.ListField
+			})
+		errs = append(errs, fn(fldPath.Child("listField"), obj.ListField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.UnvalidatedListField has no validation
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/multiple_validations/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/multiple_validations/zz_generated.validations_test.go
new file mode 100644
index 0000000000..d30e8f8db8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/multiple_validations/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package multiplevalidations
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_primitive/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_primitive/doc.go
new file mode 100644
index 0000000000..a9326f0939
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_primitive/doc.go
@@ -0,0 +1,55 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package sliceofprimitive
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// +k8s:validateFalse="type Struct"
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field Struct.ListField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListField[*]"
+	ListField []string `json:"listField"`
+
+	// +k8s:validateFalse="field Struct.ListTypedefField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListTypedefField[*]"
+	ListTypedefField []StringType `json:"listTypedefField"`
+
+	UnvalidatedListField []string `json:"UnvalidatedListField"`
+
+	// +k8s:validateFalse="field Struct.ListPtrField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListPtrField[*]"
+	ListPtrField []*string `json:"listPtrField"`
+
+	// +k8s:validateFalse="field Struct.ListPtrTypedefField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListPtrTypedefField[*]"
+	ListPtrTypedefField []*StringType `json:"listPtrTypedefField"`
+
+	UnvalidatedListPtrField []*string `json:"UnvalidatedListPtrField"`
+}
+
+// +k8s:validateFalse="type StringType"
+type StringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_primitive/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_primitive/testdata/validate-false.json
new file mode 100644
index 0000000000..87074928f3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_primitive/testdata/validate-false.json
@@ -0,0 +1,47 @@
+{
+  "*sliceofprimitive.Struct": {
+    "": [
+      "type Struct"
+    ],
+    "listField": [
+      "field Struct.ListField"
+    ],
+    "listField[0]": [
+      "field Struct.ListField[*]"
+    ],
+    "listField[1]": [
+      "field Struct.ListField[*]"
+    ],
+    "listPtrField": [
+      "field Struct.ListPtrField"
+    ],
+    "listPtrField[0]": [
+      "field Struct.ListPtrField[*]"
+    ],
+    "listPtrField[1]": [
+      "field Struct.ListPtrField[*]"
+    ],
+    "listPtrTypedefField": [
+      "field Struct.ListPtrTypedefField"
+    ],
+    "listPtrTypedefField[0]": [
+      "field Struct.ListPtrTypedefField[*]",
+      "type StringType"
+    ],
+    "listPtrTypedefField[1]": [
+      "field Struct.ListPtrTypedefField[*]",
+      "type StringType"
+    ],
+    "listTypedefField": [
+      "field Struct.ListTypedefField"
+    ],
+    "listTypedefField[0]": [
+      "field Struct.ListTypedefField[*]",
+      "type StringType"
+    ],
+    "listTypedefField[1]": [
+      "field Struct.ListTypedefField[*]",
+      "type StringType"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_primitive/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_primitive/zz_generated.validations.go
new file mode 100644
index 0000000000..c7493222be
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_primitive/zz_generated.validations.go
@@ -0,0 +1,232 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package sliceofprimitive
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_StringType validates an instance of StringType according
+// to declarative validation rules in the API schema.
+func Validate_StringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StringType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type StringType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type Struct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ListField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.ListField
+			})
+		errs = append(errs, fn(fldPath.Child("listField"), obj.ListField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_StringType); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []StringType {
+				return oldObj.ListTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("listTypedefField"), obj.ListTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.UnvalidatedListField has no validation
+
+	{ // field Struct.ListPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []*string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrSliceNoNils[string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListPtrField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []*string {
+				return oldObj.ListPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("listPtrField"), obj.ListPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListPtrTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []*StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrSliceNoNils[StringType](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListPtrTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListPtrTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_StringType); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []*StringType {
+				return oldObj.ListPtrTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("listPtrTypedefField"), obj.ListPtrTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.UnvalidatedListPtrField has no validation
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_primitive/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_primitive/zz_generated.validations_test.go
new file mode 100644
index 0000000000..71ff7b5fb6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_primitive/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package sliceofprimitive
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_struct/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_struct/doc.go
new file mode 100644
index 0000000000..553928bb6e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_struct/doc.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package sliceofstruct
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// +k8s:validateFalse="type Struct"
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field Struct.ListField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListField[*]"
+	ListField []OtherStruct `json:"listField"`
+
+	// +k8s:validateFalse="field Struct.ListTypedefField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListTypedefField[*]"
+	ListTypedefField []OtherTypedefStruct `json:"listTypedefField"`
+
+	UnvalidatedListField []UnvalidatedStruct `json:"UnvalidatedListField"`
+
+	// +k8s:validateFalse="field Struct.ListPtrField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListPtrField[*]"
+	ListPtrField []*OtherStruct `json:"listPtrField"`
+
+	// +k8s:validateFalse="field Struct.ListPtrTypedefField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListPtrTypedefField[*]"
+	ListPtrTypedefField []*OtherTypedefStruct `json:"listPtrTypedefField"`
+
+	UnvalidatedListPtrField []*UnvalidatedStruct `json:"UnvalidatedListPtrField"`
+}
+
+// +k8s:validateFalse="type OtherStruct"
+type OtherStruct struct{}
+
+// +k8s:validateFalse="type OtherTypedefStruct"
+type OtherTypedefStruct OtherStruct
+
+type UnvalidatedStruct struct{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_struct/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_struct/testdata/validate-false.json
new file mode 100644
index 0000000000..40abecfbd0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_struct/testdata/validate-false.json
@@ -0,0 +1,51 @@
+{
+  "*sliceofstruct.Struct": {
+    "": [
+      "type Struct"
+    ],
+    "listField": [
+      "field Struct.ListField"
+    ],
+    "listField[0]": [
+      "field Struct.ListField[*]",
+      "type OtherStruct"
+    ],
+    "listField[1]": [
+      "field Struct.ListField[*]",
+      "type OtherStruct"
+    ],
+    "listPtrField": [
+      "field Struct.ListPtrField"
+    ],
+    "listPtrField[0]": [
+      "field Struct.ListPtrField[*]",
+      "type OtherStruct"
+    ],
+    "listPtrField[1]": [
+      "field Struct.ListPtrField[*]",
+      "type OtherStruct"
+    ],
+    "listPtrTypedefField": [
+      "field Struct.ListPtrTypedefField"
+    ],
+    "listPtrTypedefField[0]": [
+      "field Struct.ListPtrTypedefField[*]",
+      "type OtherTypedefStruct"
+    ],
+    "listPtrTypedefField[1]": [
+      "field Struct.ListPtrTypedefField[*]",
+      "type OtherTypedefStruct"
+    ],
+    "listTypedefField": [
+      "field Struct.ListTypedefField"
+    ],
+    "listTypedefField[0]": [
+      "field Struct.ListTypedefField[*]",
+      "type OtherTypedefStruct"
+    ],
+    "listTypedefField[1]": [
+      "field Struct.ListTypedefField[*]",
+      "type OtherTypedefStruct"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_struct/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_struct/zz_generated.validations.go
new file mode 100644
index 0000000000..165b63c999
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_struct/zz_generated.validations.go
@@ -0,0 +1,253 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package sliceofstruct
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_OtherStruct validates an instance of OtherStruct according
+// to declarative validation rules in the API schema.
+func Validate_OtherStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OtherStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type OtherStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_OtherTypedefStruct validates an instance of OtherTypedefStruct according
+// to declarative validation rules in the API schema.
+func Validate_OtherTypedefStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OtherTypedefStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type OtherTypedefStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type Struct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ListField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_OtherStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherStruct {
+				return oldObj.ListField
+			})
+		errs = append(errs, fn(fldPath.Child("listField"), obj.ListField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherTypedefStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherTypedefStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_OtherTypedefStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherTypedefStruct {
+				return oldObj.ListTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("listTypedefField"), obj.ListTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.UnvalidatedListField has no validation
+
+	{ // field Struct.ListPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []*OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrSliceNoNils[OtherStruct](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListPtrField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_OtherStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []*OtherStruct {
+				return oldObj.ListPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("listPtrField"), obj.ListPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListPtrTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []*OtherTypedefStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrSliceNoNils[OtherTypedefStruct](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListPtrTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherTypedefStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListPtrTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_OtherTypedefStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []*OtherTypedefStruct {
+				return oldObj.ListPtrTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("listPtrTypedefField"), obj.ListPtrTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.UnvalidatedListPtrField has no validation
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_struct/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_struct/zz_generated.validations_test.go
new file mode 100644
index 0000000000..afb01f7e9d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/slice_of_struct/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package sliceofstruct
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/typedef_to_slice/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/typedef_to_slice/doc.go
new file mode 100644
index 0000000000..180fac50d1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/typedef_to_slice/doc.go
@@ -0,0 +1,77 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package typedeftoslice
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Note: no validation here
+type UnvalidatedType []string
+
+// Note: no validation here
+type UnvalidatedPtrType []*string
+
+// +k8s:validateFalse="type ListType"
+// +k8s:eachVal=+k8s:validateFalse="type ListType[*]"
+type ListType []string
+
+// +k8s:validateFalse="type ListPtrType"
+// +k8s:eachVal=+k8s:validateFalse="type ListPtrType[*]"
+type ListPtrType []*string
+
+// +k8s:validateFalse="type ListTypedefType"
+// +k8s:eachVal=+k8s:validateFalse="type ListTypedefType[*]"
+type ListTypedefType []StringType
+
+// +k8s:validateFalse="type ListPtrTypedefType"
+// +k8s:eachVal=+k8s:validateFalse="type ListPtrTypedefType[*]"
+type ListPtrTypedefType []*StringType
+
+// +k8s:validateFalse="type StringType"
+type StringType string
+
+// +k8s:validateFalse="type Struct"
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field Struct.ListField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListField[*]"
+	ListField ListType `json:"listField"`
+
+	// +k8s:validateFalse="field Struct.ListTypedefField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListTypedefField[*]"
+	ListTypedefField ListTypedefType `json:"listTypedefField"`
+
+	UnvalidatedListField UnvalidatedType `json:"UnvalidatedListField"`
+
+	// +k8s:validateFalse="field Struct.ListPtrField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListPtrField[*]"
+	ListPtrField ListPtrType `json:"listPtrField"`
+
+	// +k8s:validateFalse="field Struct.ListPtrTypedefField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListPtrTypedefField[*]"
+	ListPtrTypedefField ListPtrTypedefType `json:"listPtrTypedefField"`
+
+	UnvalidatedListPtrField UnvalidatedPtrType `json:"UnvalidatedListPtrField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/typedef_to_slice/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/typedef_to_slice/testdata/validate-false.json
new file mode 100644
index 0000000000..4900cb15e7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/typedef_to_slice/testdata/validate-false.json
@@ -0,0 +1,59 @@
+{
+  "*typedeftoslice.Struct": {
+    "": [
+      "type Struct"
+    ],
+    "listField": [
+      "field Struct.ListField",
+      "type ListType"
+    ],
+    "listField[0]": [
+      "field Struct.ListField[*]",
+      "type ListType[*]"
+    ],
+    "listField[1]": [
+      "field Struct.ListField[*]",
+      "type ListType[*]"
+    ],
+    "listPtrField": [
+      "field Struct.ListPtrField",
+      "type ListPtrType"
+    ],
+    "listPtrField[0]": [
+      "field Struct.ListPtrField[*]",
+      "type ListPtrType[*]"
+    ],
+    "listPtrField[1]": [
+      "field Struct.ListPtrField[*]",
+      "type ListPtrType[*]"
+    ],
+    "listPtrTypedefField": [
+      "field Struct.ListPtrTypedefField",
+      "type ListPtrTypedefType"
+    ],
+    "listPtrTypedefField[0]": [
+      "field Struct.ListPtrTypedefField[*]",
+      "type ListPtrTypedefType[*]",
+      "type StringType"
+    ],
+    "listPtrTypedefField[1]": [
+      "field Struct.ListPtrTypedefField[*]",
+      "type ListPtrTypedefType[*]",
+      "type StringType"
+    ],
+    "listTypedefField": [
+      "field Struct.ListTypedefField",
+      "type ListTypedefType"
+    ],
+    "listTypedefField[0]": [
+      "field Struct.ListTypedefField[*]",
+      "type ListTypedefType[*]",
+      "type StringType"
+    ],
+    "listTypedefField[1]": [
+      "field Struct.ListTypedefField[*]",
+      "type ListTypedefType[*]",
+      "type StringType"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/typedef_to_slice/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/typedef_to_slice/zz_generated.validations.go
new file mode 100644
index 0000000000..55243d6c16
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/typedef_to_slice/zz_generated.validations.go
@@ -0,0 +1,318 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package typedeftoslice
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_ListPtrType validates an instance of ListPtrType according
+// to declarative validation rules in the API schema.
+func Validate_ListPtrType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj ListPtrType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type ListPtrType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type ListPtrType[*]")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ListPtrTypedefType validates an instance of ListPtrTypedefType according
+// to declarative validation rules in the API schema.
+func Validate_ListPtrTypedefType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj ListPtrTypedefType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type ListPtrTypedefType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type ListPtrTypedefType[*]")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// iterate the list and call the type's validation function
+	if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_StringType); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ListType validates an instance of ListType according
+// to declarative validation rules in the API schema.
+func Validate_ListType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj ListType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type ListType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type ListType[*]")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ListTypedefType validates an instance of ListTypedefType according
+// to declarative validation rules in the API schema.
+func Validate_ListTypedefType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj ListTypedefType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type ListTypedefType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type ListTypedefType[*]")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// iterate the list and call the type's validation function
+	if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_StringType); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_StringType validates an instance of StringType according
+// to declarative validation rules in the API schema.
+func Validate_StringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StringType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type StringType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type Struct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ListField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj ListType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ListType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) ListType {
+				return oldObj.ListField
+			})
+		errs = append(errs, fn(fldPath.Child("listField"), obj.ListField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj ListTypedefType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ListTypedefType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) ListTypedefType {
+				return oldObj.ListTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("listTypedefField"), obj.ListTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.UnvalidatedListField has no validation
+
+	{ // field Struct.ListPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj ListPtrType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrSliceNoNils[string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListPtrField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ListPtrType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) ListPtrType {
+				return oldObj.ListPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("listPtrField"), obj.ListPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListPtrTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj ListPtrTypedefType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrSliceNoNils[StringType](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListPtrTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListPtrTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ListPtrTypedefType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) ListPtrTypedefType {
+				return oldObj.ListPtrTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("listPtrTypedefField"), obj.ListPtrTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.UnvalidatedListPtrField has no validation
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/typedef_to_slice/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/typedef_to_slice/zz_generated.validations_test.go
new file mode 100644
index 0000000000..4ae2887d51
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/slices/typedef_to_slice/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package typedeftoslice
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/README.md b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/README.md
new file mode 100644
index 0000000000..d1b6b0a309
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/README.md
@@ -0,0 +1,7 @@
+# Tag tests
+
+Tests in this directory are intended to validate specific tags, rather than
+general behavior of the code generator. Some tags are deeply integrated into
+the code-generation and will end up with similar tests elsewhere.
+
+These test cases should be as focused as possible.
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/customvalidation/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/customvalidation/doc.go
new file mode 100644
index 0000000000..9e1b73af03
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/customvalidation/doc.go
@@ -0,0 +1,72 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package customvalidation
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// +k8s:customValidation
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:customValidation
+	StringField string `json:"stringField"`
+
+	// Combined with a declarative tag: both validations run on this field.
+	// +k8s:maxLength=3
+	// +k8s:customValidation
+	MaxLengthField string `json:"maxLengthField"`
+
+	// StringType is custom-validated wherever it appears via traversal.
+	TypedefField      StringType            `json:"typedefField"`
+	TypedefPtrField   *StringType           `json:"typedefPtrField,omitempty"`
+	TypedefSliceField []StringType          `json:"typedefSliceField,omitempty"`
+	TypedefMapField   map[string]StringType `json:"typedefMapField,omitempty"`
+
+	StructField OtherStruct `json:"structField"`
+}
+
+// +k8s:customValidation
+type StringType string
+
+type OtherStruct struct {
+	// +k8s:customValidation
+	StringField string `json:"stringField"`
+}
+
+// OptionStruct demonstrates custom validation gated behind a feature option.
+type OptionStruct struct {
+	TypeMeta int
+
+	// +k8s:ifEnabled(FeatureX)=+k8s:customValidation
+	StringField string `json:"stringField"`
+}
+
+// EachStruct demonstrates custom validation (via the StringType element type)
+// coexisting with a declarative per-element check applied by eachVal.
+type EachStruct struct {
+	TypeMeta int
+
+	// +k8s:eachVal=+k8s:maxLength=3
+	SliceField []StringType `json:"sliceField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/customvalidation/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/customvalidation/doc_test.go
new file mode 100644
index 0000000000..7b8c9b650a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/customvalidation/doc_test.go
@@ -0,0 +1,87 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package customvalidation
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+	matcher := field.ErrorMatcher{}.ByType().ByField()
+
+	mk := func() *Struct {
+		return &Struct{
+			StringField:       "s",
+			MaxLengthField:    "toolong", // longer than maxLength=3
+			TypedefField:      "t",
+			TypedefPtrField:   new(StringType("p")),
+			TypedefSliceField: []StringType{"e"},
+			TypedefMapField:   map[string]StringType{"k": "m"},
+			StructField:       OtherStruct{StringField: "n"},
+		}
+	}
+
+	// On create, custom validation runs at every scope/shape: root type, a field,
+	// a field combined with maxLength, the reusable type (field/pointer/list
+	// element), and a nested-struct field.
+	st.Value(mk()).ExpectMatches(matcher, field.ErrorList{
+		field.Invalid(nil, nil, ""),
+		field.Invalid(field.NewPath("stringField"), nil, ""),
+		field.Invalid(field.NewPath("maxLengthField"), nil, ""),
+		field.TooLongCharacters(field.NewPath("maxLengthField"), "", 3),
+		field.Invalid(field.NewPath("typedefField"), nil, ""),
+		field.Invalid(field.NewPath("typedefPtrField"), nil, ""),
+		field.Invalid(field.NewPath("typedefSliceField").Index(0), nil, ""),
+		field.Invalid(field.NewPath("typedefMapField").Key("k"), nil, ""),
+		field.Invalid(field.NewPath("structField", "stringField"), nil, ""),
+	})
+
+	// On a no-op update, field and embedded calls are skipped (value unchanged);
+	// the root type-scoped call still runs (the framework does not skip it).
+	st.Value(mk()).OldValue(mk()).ExpectMatches(matcher, field.ErrorList{
+		field.Invalid(nil, nil, ""),
+	})
+}
+
+// TestIfEnabled covers custom validation gated by a feature option via ifEnabled.
+func TestIfEnabled(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+	matcher := field.ErrorMatcher{}.ByType().ByField()
+
+	// Option disabled: the gated custom validation does not run.
+	st.Value(&OptionStruct{}).Opts(map[string]bool{"FeatureX": false}).ExpectValid()
+
+	// Option enabled: the custom validation runs.
+	st.Value(&OptionStruct{}).Opts(map[string]bool{"FeatureX": true}).ExpectMatches(matcher, field.ErrorList{
+		field.Invalid(field.NewPath("stringField"), nil, ""),
+	})
+}
+
+// TestEachVal covers custom validation (via the element type) coexisting with a
+// declarative per-element check applied by eachVal.
+func TestEachVal(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+	matcher := field.ErrorMatcher{}.ByType().ByField()
+
+	st.Value(&EachStruct{SliceField: []StringType{"toolong"}}).ExpectMatches(matcher, field.ErrorList{
+		field.Invalid(field.NewPath("sliceField").Index(0), nil, ""),         // custom, via StringType
+		field.TooLongCharacters(field.NewPath("sliceField").Index(0), "", 3), // eachVal maxLength
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/customvalidation/validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/customvalidation/validations.go
new file mode 100644
index 0000000000..a6cebee217
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/customvalidation/validations.go
@@ -0,0 +1,52 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package customvalidation
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// These functions are structural markers, not real rules: each emits one error
+// at the path it is called with, so tests can assert where the generated
+// traversal invokes custom validation.
+
+func ValidateCustom_Struct(_ context.Context, _ operation.Operation, fldPath *field.Path, _, _ *Struct) field.ErrorList {
+	return field.ErrorList{field.Invalid(fldPath, nil, "ValidateCustom_Struct")}
+}
+
+func ValidateCustom_Struct_StringField(_ context.Context, _ operation.Operation, fldPath *field.Path, _, _ *string) field.ErrorList {
+	return field.ErrorList{field.Invalid(fldPath, nil, "ValidateCustom_Struct_StringField")}
+}
+
+func ValidateCustom_Struct_MaxLengthField(_ context.Context, _ operation.Operation, fldPath *field.Path, _, _ *string) field.ErrorList {
+	return field.ErrorList{field.Invalid(fldPath, nil, "ValidateCustom_Struct_MaxLengthField")}
+}
+
+func ValidateCustom_StringType(_ context.Context, _ operation.Operation, fldPath *field.Path, _, _ *StringType) field.ErrorList {
+	return field.ErrorList{field.Invalid(fldPath, nil, "ValidateCustom_StringType")}
+}
+
+func ValidateCustom_OtherStruct_StringField(_ context.Context, _ operation.Operation, fldPath *field.Path, _, _ *string) field.ErrorList {
+	return field.ErrorList{field.Invalid(fldPath, nil, "ValidateCustom_OtherStruct_StringField")}
+}
+
+func ValidateCustom_OptionStruct_StringField(_ context.Context, _ operation.Operation, fldPath *field.Path, _, _ *string) field.ErrorList {
+	return field.ErrorList{field.Invalid(fldPath, nil, "ValidateCustom_OptionStruct_StringField")}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/customvalidation/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/customvalidation/zz_generated.validations.go
new file mode 100644
index 0000000000..028fb87da0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/customvalidation/zz_generated.validations.go
@@ -0,0 +1,396 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package customvalidation
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type EachStruct
+	scheme.AddValidationFunc(
+		(*EachStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_EachStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*EachStruct),
+					safe.Cast[*EachStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type OptionStruct
+	scheme.AddValidationFunc(
+		(*OptionStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_OptionStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*OptionStruct),
+					safe.Cast[*OptionStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_EachStruct validates an instance of EachStruct according
+// to declarative validation rules in the API schema.
+func Validate_EachStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *EachStruct) (errs field.ErrorList) {
+
+	// field EachStruct.TypeMeta has no validation
+
+	{ // field EachStruct.SliceField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+					return validate.MaxLength(ctx, op, fldPath, obj, oldObj, 3)
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_StringType); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *EachStruct) []StringType {
+				return oldObj.SliceField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceField"), obj.SliceField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_OptionStruct validates an instance of OptionStruct according
+// to declarative validation rules in the API schema.
+func Validate_OptionStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OptionStruct) (errs field.ErrorList) {
+
+	// field OptionStruct.TypeMeta has no validation
+
+	{ // field OptionStruct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true, // custom validation
+				ValidateCustom_OptionStruct_StringField); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *OptionStruct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_OtherStruct validates an instance of OtherStruct according
+// to declarative validation rules in the API schema.
+func Validate_OtherStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OtherStruct) (errs field.ErrorList) {
+
+	{ // field OtherStruct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// custom validation
+			if e := ValidateCustom_OtherStruct_StringField(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *OtherStruct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_StringType validates an instance of StringType according
+// to declarative validation rules in the API schema.
+func Validate_StringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StringType) (errs field.ErrorList) {
+
+	// custom validation
+	if e := ValidateCustom_StringType(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// custom validation
+	if e := ValidateCustom_Struct(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// custom validation
+			if e := ValidateCustom_Struct_StringField(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MaxLengthField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// custom validation
+			if e := ValidateCustom_Struct_MaxLengthField(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.MaxLength(ctx, op, fldPath, obj, oldObj, 3); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.MaxLengthField
+			})
+		errs = append(errs, fn(fldPath.Child("maxLengthField"), &obj.MaxLengthField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_StringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *StringType {
+				return &oldObj.TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("typedefField"), &obj.TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.TypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_StringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *StringType {
+				return oldObj.TypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("typedefPtrField"), obj.TypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.TypedefSliceField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_StringType); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []StringType {
+				return oldObj.TypedefSliceField
+			})
+		errs = append(errs, fn(fldPath.Child("typedefSliceField"), obj.TypedefSliceField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.TypedefMapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_StringType); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]StringType {
+				return oldObj.TypedefMapField
+			})
+		errs = append(errs, fn(fldPath.Child("typedefMapField"), obj.TypedefMapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_OtherStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *OtherStruct {
+				return &oldObj.StructField
+			})
+		errs = append(errs, fn(fldPath.Child("structField"), &obj.StructField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentforbidden/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentforbidden/doc.go
new file mode 100644
index 0000000000..3cdbc060f9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentforbidden/doc.go
@@ -0,0 +1,106 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package dependentforbidden
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Basic one-to-one dependency.
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:optional
+	// +k8s:dependentForbidden("dependent")
+	Trigger *string `json:"trigger"`
+
+	// +k8s:optional
+	Dependent *string `json:"dependent"`
+
+	// +k8s:optional
+	OtherField *string `json:"otherField"`
+}
+
+// One trigger, many dependents (repeated tags).
+type MultiDependent struct {
+	TypeMeta int
+
+	// +k8s:optional
+	// +k8s:dependentForbidden("dependentA")
+	// +k8s:dependentForbidden("dependentB")
+	Trigger *string `json:"trigger"`
+
+	// +k8s:optional
+	DependentA *string `json:"dependentA"`
+
+	// +k8s:optional
+	DependentB *string `json:"dependentB"`
+}
+
+// Many triggers, one dependent.
+type MultiTrigger struct {
+	TypeMeta int
+
+	// +k8s:optional
+	// +k8s:dependentForbidden("dependent")
+	TriggerA *string `json:"triggerA"`
+
+	// +k8s:optional
+	// +k8s:dependentForbidden("dependent")
+	TriggerB *string `json:"triggerB"`
+
+	// +k8s:optional
+	Dependent *string `json:"dependent"`
+}
+
+// All four "is set" extractor kinds.
+type AllKinds struct {
+	TypeMeta int
+
+	// +k8s:optional
+	// +k8s:dependentForbidden("ptrDep")
+	PtrTrigger *string `json:"ptrTrigger"`
+
+	// +k8s:optional
+	PtrDep *string `json:"ptrDep"`
+
+	// +k8s:optional
+	// +k8s:dependentForbidden("sliceDep")
+	SliceTrigger []string `json:"sliceTrigger"`
+
+	// +k8s:optional
+	SliceDep []string `json:"sliceDep"`
+
+	// +k8s:optional
+	// +k8s:dependentForbidden("mapDep")
+	MapTrigger map[string]string `json:"mapTrigger"`
+
+	// +k8s:optional
+	MapDep map[string]string `json:"mapDep"`
+
+	// +k8s:optional
+	// +k8s:dependentForbidden("intDep")
+	IntTrigger int `json:"intTrigger"`
+
+	// +k8s:optional
+	IntDep int `json:"intDep"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentforbidden/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentforbidden/doc_test.go
new file mode 100644
index 0000000000..97ed55641b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentforbidden/doc_test.go
@@ -0,0 +1,122 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package dependentforbidden
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestStruct(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// One-directional: dependent alone is fine.
+	st.Value(&Struct{Dependent: new("d")}).ExpectValid()
+
+	// Trigger alone is fine.
+	st.Value(&Struct{Trigger: new("t")}).ExpectValid()
+
+	// Both set → forbidden.
+	st.Value(&Struct{Trigger: new("t"), Dependent: new("d")}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{
+			field.Forbidden(field.NewPath("dependent"), "").WithOrigin("dependentForbidden"),
+		},
+	)
+
+	// Ratchet: unrelated field changed, trigger and dependent set-ness unchanged → skip.
+	st.Value(&Struct{Trigger: new("t"), Dependent: new("d"), OtherField: new("new")}).
+		OldValue(&Struct{Trigger: new("t"), Dependent: new("d"), OtherField: new("old")}).
+		ExpectValid()
+
+	// Ratchet: trigger value changed but set-ness unchanged → skip.
+	st.Value(&Struct{Trigger: new("t"), Dependent: new("d")}).
+		OldValue(&Struct{Trigger: new("old"), Dependent: new("d")}).
+		ExpectValid()
+
+	// Newly set dependent → fire.
+	st.Value(&Struct{Trigger: new("t"), Dependent: new("d")}).
+		OldValue(&Struct{Trigger: new("t")}).
+		ExpectMatches(
+			field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+			field.ErrorList{
+				field.Forbidden(field.NewPath("dependent"), "").WithOrigin("dependentForbidden"),
+			},
+		)
+}
+
+func TestMultiDependent(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Repeated tags → independent implications, each at its own dependent path.
+	st.Value(&MultiDependent{Trigger: new("t"), DependentA: new("a"), DependentB: new("b")}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{
+			field.Forbidden(field.NewPath("dependentA"), "").WithOrigin("dependentForbidden"),
+			field.Forbidden(field.NewPath("dependentB"), "").WithOrigin("dependentForbidden"),
+		},
+	)
+}
+
+func TestMultiTrigger(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Distinct triggers → independent implications at the same path.
+	// ByOrigin absorbs both actuals.
+	st.Value(&MultiTrigger{TriggerA: new("a"), TriggerB: new("b"), Dependent: new("d")}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{
+			field.Forbidden(field.NewPath("dependent"), "").WithOrigin("dependentForbidden"),
+		},
+	)
+}
+
+func TestAllKinds(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Each kind's extractor fires when both trigger and dependent are set.
+	st.Value(&AllKinds{
+		PtrTrigger:   new("t"),
+		PtrDep:       new("d"),
+		SliceTrigger: []string{"x"},
+		SliceDep:     []string{"y"},
+		MapTrigger:   map[string]string{"k": "v"},
+		MapDep:       map[string]string{"k": "v"},
+		IntTrigger:   1,
+		IntDep:       1,
+	}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{
+			field.Forbidden(field.NewPath("ptrDep"), "").WithOrigin("dependentForbidden"),
+			field.Forbidden(field.NewPath("sliceDep"), "").WithOrigin("dependentForbidden"),
+			field.Forbidden(field.NewPath("mapDep"), "").WithOrigin("dependentForbidden"),
+			field.Forbidden(field.NewPath("intDep"), "").WithOrigin("dependentForbidden"),
+		},
+	)
+
+	// Triggers set but dependents "not set" (empty slice/map, zero int, nil ptr) → valid.
+	st.Value(&AllKinds{
+		PtrTrigger:   new("t"),
+		SliceTrigger: []string{"x"},
+		MapTrigger:   map[string]string{"k": "v"},
+		IntTrigger:   1,
+		SliceDep:     []string{},
+		MapDep:       map[string]string{},
+		IntDep:       0,
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentforbidden/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentforbidden/zz_generated.validations.go
new file mode 100644
index 0000000000..c241db1947
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentforbidden/zz_generated.validations.go
@@ -0,0 +1,763 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package dependentforbidden
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type AllKinds
+	scheme.AddValidationFunc(
+		(*AllKinds)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_AllKinds(
+					ctx, op, nil, /* fldPath */
+					obj.(*AllKinds),
+					safe.Cast[*AllKinds](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type MultiDependent
+	scheme.AddValidationFunc(
+		(*MultiDependent)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_MultiDependent(
+					ctx, op, nil, /* fldPath */
+					obj.(*MultiDependent),
+					safe.Cast[*MultiDependent](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type MultiTrigger
+	scheme.AddValidationFunc(
+		(*MultiTrigger)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_MultiTrigger(
+					ctx, op, nil, /* fldPath */
+					obj.(*MultiTrigger),
+					safe.Cast[*MultiTrigger](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_AllKinds validates an instance of AllKinds according
+// to declarative validation rules in the API schema.
+func Validate_AllKinds(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *AllKinds) (errs field.ErrorList) {
+
+	if e := validate.DependentForbidden(ctx, op, fldPath, obj, oldObj, "ptrTrigger",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.PtrTrigger != nil
+		}, "ptrDep",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.PtrDep != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.DependentForbidden(ctx, op, fldPath, obj, oldObj, "sliceTrigger",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.SliceTrigger) != 0
+		}, "sliceDep",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.SliceDep) != 0
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.DependentForbidden(ctx, op, fldPath, obj, oldObj, "mapTrigger",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.MapTrigger) != 0
+		}, "mapDep",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.MapDep) != 0
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.DependentForbidden(ctx, op, fldPath, obj, oldObj, "intTrigger",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			var z int
+			return obj.IntTrigger != z
+		}, "intDep",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			var z int
+			return obj.IntDep != z
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field AllKinds.TypeMeta has no validation
+
+	{ // field AllKinds.PtrTrigger
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) *string {
+				return oldObj.PtrTrigger
+			})
+		errs = append(errs, fn(fldPath.Child("ptrTrigger"), obj.PtrTrigger, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AllKinds.PtrDep
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) *string {
+				return oldObj.PtrDep
+			})
+		errs = append(errs, fn(fldPath.Child("ptrDep"), obj.PtrDep, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AllKinds.SliceTrigger
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) []string {
+				return oldObj.SliceTrigger
+			})
+		errs = append(errs, fn(fldPath.Child("sliceTrigger"), obj.SliceTrigger, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AllKinds.SliceDep
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) []string {
+				return oldObj.SliceDep
+			})
+		errs = append(errs, fn(fldPath.Child("sliceDep"), obj.SliceDep, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AllKinds.MapTrigger
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) map[string]string {
+				return oldObj.MapTrigger
+			})
+		errs = append(errs, fn(fldPath.Child("mapTrigger"), obj.MapTrigger, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AllKinds.MapDep
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) map[string]string {
+				return oldObj.MapDep
+			})
+		errs = append(errs, fn(fldPath.Child("mapDep"), obj.MapDep, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AllKinds.IntTrigger
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) *int {
+				return &oldObj.IntTrigger
+			})
+		errs = append(errs, fn(fldPath.Child("intTrigger"), &obj.IntTrigger, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AllKinds.IntDep
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) *int {
+				return &oldObj.IntDep
+			})
+		errs = append(errs, fn(fldPath.Child("intDep"), &obj.IntDep, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_MultiDependent validates an instance of MultiDependent according
+// to declarative validation rules in the API schema.
+func Validate_MultiDependent(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MultiDependent) (errs field.ErrorList) {
+
+	if e := validate.DependentForbidden(ctx, op, fldPath, obj, oldObj, "trigger",
+		func(obj *MultiDependent) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Trigger != nil
+		}, "dependentA",
+		func(obj *MultiDependent) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.DependentA != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.DependentForbidden(ctx, op, fldPath, obj, oldObj, "trigger",
+		func(obj *MultiDependent) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Trigger != nil
+		}, "dependentB",
+		func(obj *MultiDependent) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.DependentB != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field MultiDependent.TypeMeta has no validation
+
+	{ // field MultiDependent.Trigger
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MultiDependent) *string {
+				return oldObj.Trigger
+			})
+		errs = append(errs, fn(fldPath.Child("trigger"), obj.Trigger, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MultiDependent.DependentA
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MultiDependent) *string {
+				return oldObj.DependentA
+			})
+		errs = append(errs, fn(fldPath.Child("dependentA"), obj.DependentA, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MultiDependent.DependentB
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MultiDependent) *string {
+				return oldObj.DependentB
+			})
+		errs = append(errs, fn(fldPath.Child("dependentB"), obj.DependentB, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_MultiTrigger validates an instance of MultiTrigger according
+// to declarative validation rules in the API schema.
+func Validate_MultiTrigger(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MultiTrigger) (errs field.ErrorList) {
+
+	if e := validate.DependentForbidden(ctx, op, fldPath, obj, oldObj, "triggerA",
+		func(obj *MultiTrigger) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.TriggerA != nil
+		}, "dependent",
+		func(obj *MultiTrigger) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Dependent != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.DependentForbidden(ctx, op, fldPath, obj, oldObj, "triggerB",
+		func(obj *MultiTrigger) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.TriggerB != nil
+		}, "dependent",
+		func(obj *MultiTrigger) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Dependent != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field MultiTrigger.TypeMeta has no validation
+
+	{ // field MultiTrigger.TriggerA
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MultiTrigger) *string {
+				return oldObj.TriggerA
+			})
+		errs = append(errs, fn(fldPath.Child("triggerA"), obj.TriggerA, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MultiTrigger.TriggerB
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MultiTrigger) *string {
+				return oldObj.TriggerB
+			})
+		errs = append(errs, fn(fldPath.Child("triggerB"), obj.TriggerB, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MultiTrigger.Dependent
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MultiTrigger) *string {
+				return oldObj.Dependent
+			})
+		errs = append(errs, fn(fldPath.Child("dependent"), obj.Dependent, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.DependentForbidden(ctx, op, fldPath, obj, oldObj, "trigger",
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Trigger != nil
+		}, "dependent",
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Dependent != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Trigger
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.Trigger
+			})
+		errs = append(errs, fn(fldPath.Child("trigger"), obj.Trigger, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Dependent
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.Dependent
+			})
+		errs = append(errs, fn(fldPath.Child("dependent"), obj.Dependent, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.OtherField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.OtherField
+			})
+		errs = append(errs, fn(fldPath.Child("otherField"), obj.OtherField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentrequired/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentrequired/doc.go
new file mode 100644
index 0000000000..598c99baaa
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentrequired/doc.go
@@ -0,0 +1,106 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package dependentrequired
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Basic one-to-one dependency.
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:optional
+	// +k8s:dependentRequired("dependent")
+	Trigger *string `json:"trigger"`
+
+	// +k8s:optional
+	Dependent *string `json:"dependent"`
+
+	// +k8s:optional
+	OtherField *string `json:"otherField"`
+}
+
+// One trigger, many dependents (repeated tags).
+type MultiDependent struct {
+	TypeMeta int
+
+	// +k8s:optional
+	// +k8s:dependentRequired("dependentA")
+	// +k8s:dependentRequired("dependentB")
+	Trigger *string `json:"trigger"`
+
+	// +k8s:optional
+	DependentA *string `json:"dependentA"`
+
+	// +k8s:optional
+	DependentB *string `json:"dependentB"`
+}
+
+// Many triggers, one dependent.
+type MultiTrigger struct {
+	TypeMeta int
+
+	// +k8s:optional
+	// +k8s:dependentRequired("dependent")
+	TriggerA *string `json:"triggerA"`
+
+	// +k8s:optional
+	// +k8s:dependentRequired("dependent")
+	TriggerB *string `json:"triggerB"`
+
+	// +k8s:optional
+	Dependent *string `json:"dependent"`
+}
+
+// All four "is set" extractor kinds.
+type AllKinds struct {
+	TypeMeta int
+
+	// +k8s:optional
+	// +k8s:dependentRequired("ptrDep")
+	PtrTrigger *string `json:"ptrTrigger"`
+
+	// +k8s:optional
+	PtrDep *string `json:"ptrDep"`
+
+	// +k8s:optional
+	// +k8s:dependentRequired("sliceDep")
+	SliceTrigger []string `json:"sliceTrigger"`
+
+	// +k8s:optional
+	SliceDep []string `json:"sliceDep"`
+
+	// +k8s:optional
+	// +k8s:dependentRequired("mapDep")
+	MapTrigger map[string]string `json:"mapTrigger"`
+
+	// +k8s:optional
+	MapDep map[string]string `json:"mapDep"`
+
+	// +k8s:optional
+	// +k8s:dependentRequired("intDep")
+	IntTrigger int `json:"intTrigger"`
+
+	// +k8s:optional
+	IntDep int `json:"intDep"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentrequired/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentrequired/doc_test.go
new file mode 100644
index 0000000000..8b4bc8e3ff
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentrequired/doc_test.go
@@ -0,0 +1,113 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package dependentrequired
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestStruct(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// One-directional: dependent alone is fine.
+	st.Value(&Struct{Dependent: ptr.To("d")}).ExpectValid()
+
+	st.Value(&Struct{Trigger: ptr.To("t"), Dependent: ptr.To("d")}).ExpectValid()
+
+	st.Value(&Struct{Trigger: ptr.To("t")}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{
+			field.Required(field.NewPath("dependent"), "").WithOrigin("dependentRequired"),
+		},
+	)
+
+	// Ratchet: unrelated field changed, trigger and dependent set-ness unchanged → skip.
+	st.Value(&Struct{Trigger: ptr.To("t"), OtherField: ptr.To("new")}).
+		OldValue(&Struct{Trigger: ptr.To("t"), OtherField: ptr.To("old")}).
+		ExpectValid()
+
+	// Ratchet: trigger value changed but set-ness unchanged → skip (same rationale as union).
+	st.Value(&Struct{Trigger: ptr.To("t")}).
+		OldValue(&Struct{Trigger: ptr.To("old")}).
+		ExpectValid()
+
+	// Newly cleared dependent → fire.
+	st.Value(&Struct{Trigger: ptr.To("t")}).
+		OldValue(&Struct{Trigger: ptr.To("t"), Dependent: ptr.To("d")}).
+		ExpectMatches(
+			field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+			field.ErrorList{
+				field.Required(field.NewPath("dependent"), "").WithOrigin("dependentRequired"),
+			},
+		)
+}
+
+func TestMultiDependent(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Repeated tags → independent implications, each at its own dependent path.
+	st.Value(&MultiDependent{Trigger: ptr.To("t")}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{
+			field.Required(field.NewPath("dependentA"), "").WithOrigin("dependentRequired"),
+			field.Required(field.NewPath("dependentB"), "").WithOrigin("dependentRequired"),
+		},
+	)
+}
+
+func TestMultiTrigger(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Distinct triggers → independent implications at the same path.
+	// ByOrigin absorbs both actuals.
+	st.Value(&MultiTrigger{TriggerA: ptr.To("a"), TriggerB: ptr.To("b")}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{
+			field.Required(field.NewPath("dependent"), "").WithOrigin("dependentRequired"),
+		},
+	)
+}
+
+func TestAllKinds(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Each kind's extractor fires.
+	st.Value(&AllKinds{
+		PtrTrigger:   ptr.To("t"),
+		SliceTrigger: []string{"x"},
+		MapTrigger:   map[string]string{"k": "v"},
+		IntTrigger:   1,
+	}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{
+			field.Required(field.NewPath("ptrDep"), "").WithOrigin("dependentRequired"),
+			field.Required(field.NewPath("sliceDep"), "").WithOrigin("dependentRequired"),
+			field.Required(field.NewPath("mapDep"), "").WithOrigin("dependentRequired"),
+			field.Required(field.NewPath("intDep"), "").WithOrigin("dependentRequired"),
+		},
+	)
+
+	// Empty slice/map and zero int = "not set".
+	st.Value(&AllKinds{
+		SliceTrigger: []string{},
+		MapTrigger:   map[string]string{},
+		IntTrigger:   0,
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentrequired/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentrequired/zz_generated.validations.go
new file mode 100644
index 0000000000..b9306e3f49
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/dependentrequired/zz_generated.validations.go
@@ -0,0 +1,763 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package dependentrequired
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type AllKinds
+	scheme.AddValidationFunc(
+		(*AllKinds)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_AllKinds(
+					ctx, op, nil, /* fldPath */
+					obj.(*AllKinds),
+					safe.Cast[*AllKinds](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type MultiDependent
+	scheme.AddValidationFunc(
+		(*MultiDependent)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_MultiDependent(
+					ctx, op, nil, /* fldPath */
+					obj.(*MultiDependent),
+					safe.Cast[*MultiDependent](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type MultiTrigger
+	scheme.AddValidationFunc(
+		(*MultiTrigger)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_MultiTrigger(
+					ctx, op, nil, /* fldPath */
+					obj.(*MultiTrigger),
+					safe.Cast[*MultiTrigger](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_AllKinds validates an instance of AllKinds according
+// to declarative validation rules in the API schema.
+func Validate_AllKinds(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *AllKinds) (errs field.ErrorList) {
+
+	if e := validate.DependentRequired(ctx, op, fldPath, obj, oldObj, "ptrTrigger",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.PtrTrigger != nil
+		}, "ptrDep",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.PtrDep != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.DependentRequired(ctx, op, fldPath, obj, oldObj, "sliceTrigger",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.SliceTrigger) != 0
+		}, "sliceDep",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.SliceDep) != 0
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.DependentRequired(ctx, op, fldPath, obj, oldObj, "mapTrigger",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.MapTrigger) != 0
+		}, "mapDep",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.MapDep) != 0
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.DependentRequired(ctx, op, fldPath, obj, oldObj, "intTrigger",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			var z int
+			return obj.IntTrigger != z
+		}, "intDep",
+		func(obj *AllKinds) bool {
+			if obj == nil {
+				return false
+			}
+			var z int
+			return obj.IntDep != z
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field AllKinds.TypeMeta has no validation
+
+	{ // field AllKinds.PtrTrigger
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) *string {
+				return oldObj.PtrTrigger
+			})
+		errs = append(errs, fn(fldPath.Child("ptrTrigger"), obj.PtrTrigger, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AllKinds.PtrDep
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) *string {
+				return oldObj.PtrDep
+			})
+		errs = append(errs, fn(fldPath.Child("ptrDep"), obj.PtrDep, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AllKinds.SliceTrigger
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) []string {
+				return oldObj.SliceTrigger
+			})
+		errs = append(errs, fn(fldPath.Child("sliceTrigger"), obj.SliceTrigger, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AllKinds.SliceDep
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) []string {
+				return oldObj.SliceDep
+			})
+		errs = append(errs, fn(fldPath.Child("sliceDep"), obj.SliceDep, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AllKinds.MapTrigger
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) map[string]string {
+				return oldObj.MapTrigger
+			})
+		errs = append(errs, fn(fldPath.Child("mapTrigger"), obj.MapTrigger, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AllKinds.MapDep
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) map[string]string {
+				return oldObj.MapDep
+			})
+		errs = append(errs, fn(fldPath.Child("mapDep"), obj.MapDep, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AllKinds.IntTrigger
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) *int {
+				return &oldObj.IntTrigger
+			})
+		errs = append(errs, fn(fldPath.Child("intTrigger"), &obj.IntTrigger, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AllKinds.IntDep
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllKinds) *int {
+				return &oldObj.IntDep
+			})
+		errs = append(errs, fn(fldPath.Child("intDep"), &obj.IntDep, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_MultiDependent validates an instance of MultiDependent according
+// to declarative validation rules in the API schema.
+func Validate_MultiDependent(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MultiDependent) (errs field.ErrorList) {
+
+	if e := validate.DependentRequired(ctx, op, fldPath, obj, oldObj, "trigger",
+		func(obj *MultiDependent) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Trigger != nil
+		}, "dependentA",
+		func(obj *MultiDependent) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.DependentA != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.DependentRequired(ctx, op, fldPath, obj, oldObj, "trigger",
+		func(obj *MultiDependent) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Trigger != nil
+		}, "dependentB",
+		func(obj *MultiDependent) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.DependentB != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field MultiDependent.TypeMeta has no validation
+
+	{ // field MultiDependent.Trigger
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MultiDependent) *string {
+				return oldObj.Trigger
+			})
+		errs = append(errs, fn(fldPath.Child("trigger"), obj.Trigger, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MultiDependent.DependentA
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MultiDependent) *string {
+				return oldObj.DependentA
+			})
+		errs = append(errs, fn(fldPath.Child("dependentA"), obj.DependentA, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MultiDependent.DependentB
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MultiDependent) *string {
+				return oldObj.DependentB
+			})
+		errs = append(errs, fn(fldPath.Child("dependentB"), obj.DependentB, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_MultiTrigger validates an instance of MultiTrigger according
+// to declarative validation rules in the API schema.
+func Validate_MultiTrigger(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MultiTrigger) (errs field.ErrorList) {
+
+	if e := validate.DependentRequired(ctx, op, fldPath, obj, oldObj, "triggerA",
+		func(obj *MultiTrigger) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.TriggerA != nil
+		}, "dependent",
+		func(obj *MultiTrigger) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Dependent != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.DependentRequired(ctx, op, fldPath, obj, oldObj, "triggerB",
+		func(obj *MultiTrigger) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.TriggerB != nil
+		}, "dependent",
+		func(obj *MultiTrigger) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Dependent != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field MultiTrigger.TypeMeta has no validation
+
+	{ // field MultiTrigger.TriggerA
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MultiTrigger) *string {
+				return oldObj.TriggerA
+			})
+		errs = append(errs, fn(fldPath.Child("triggerA"), obj.TriggerA, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MultiTrigger.TriggerB
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MultiTrigger) *string {
+				return oldObj.TriggerB
+			})
+		errs = append(errs, fn(fldPath.Child("triggerB"), obj.TriggerB, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MultiTrigger.Dependent
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MultiTrigger) *string {
+				return oldObj.Dependent
+			})
+		errs = append(errs, fn(fldPath.Child("dependent"), obj.Dependent, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.DependentRequired(ctx, op, fldPath, obj, oldObj, "trigger",
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Trigger != nil
+		}, "dependent",
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Dependent != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Trigger
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.Trigger
+			})
+		errs = append(errs, fn(fldPath.Child("trigger"), obj.Trigger, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Dependent
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.Dependent
+			})
+		errs = append(errs, fn(fldPath.Child("dependent"), obj.Dependent, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.OtherField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.OtherField
+			})
+		errs = append(errs, fn(fldPath.Child("otherField"), obj.OtherField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachkey/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachkey/doc.go
new file mode 100644
index 0000000000..aa630a2623
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachkey/doc.go
@@ -0,0 +1,57 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package eachkey
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:eachKey=+k8s:validateFalse="Struct.MapField(keys)"
+	MapField map[string]string `json:"mapField"`
+
+	// +k8s:eachKey=+k8s:validateFalse="Struct.MapTypedefField(keys)"
+	MapTypedefField map[UnvalidatedStringType]string `json:"mapTypedefField"`
+
+	// +k8s:eachKey=+k8s:validateFalse="Struct.MapValidatedTypedefField(keys)"
+	MapValidatedTypedefField map[ValidatedStringType]string `json:"mapValidatedTypedefField"`
+
+	// +k8s:eachKey=+k8s:validateFalse="Struct.MapTypeField(keys)"
+	MapTypeField UnvalidatedMapType `json:"mapTypeField"`
+
+	// +k8s:eachKey=+k8s:validateFalse="Struct.ValidatedMapTypeField(keys)"
+	ValidatedMapTypeField ValidatedMapType `json:"validatedMapTypeField"`
+}
+
+// Note: no validations.
+type UnvalidatedStringType string
+
+// +k8s:validateFalse="ValidatedStringType"
+type ValidatedStringType string
+
+// Note: no validations.
+type UnvalidatedMapType map[string]string
+
+// +k8s:eachKey=+k8s:validateFalse="ValidatedMapType(keys)"
+type ValidatedMapType map[string]string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachkey/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachkey/doc_test.go
new file mode 100644
index 0000000000..fa9a48ae34
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachkey/doc_test.go
@@ -0,0 +1,58 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package eachkey
+
+import (
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values.
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		MapField:                 map[string]string{"a": "A", "b": "B"},
+		MapTypedefField:          map[UnvalidatedStringType]string{"a": "A", "b": "B"},
+		MapValidatedTypedefField: map[ValidatedStringType]string{"a": "A", "b": "B"},
+		MapTypeField:             UnvalidatedMapType{"a": "A", "b": "B"},
+		ValidatedMapTypeField:    ValidatedMapType{"a": "A", "b": "B"},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"mapField": {
+			"Struct.MapField(keys)",
+			"Struct.MapField(keys)",
+		},
+		"mapTypedefField": {
+			"Struct.MapTypedefField(keys)",
+			"Struct.MapTypedefField(keys)",
+		},
+		"mapValidatedTypedefField": {
+			"Struct.MapValidatedTypedefField(keys)", "ValidatedStringType",
+			"Struct.MapValidatedTypedefField(keys)", "ValidatedStringType",
+		},
+		"mapTypeField": {
+			"Struct.MapTypeField(keys)",
+			"Struct.MapTypeField(keys)",
+		},
+		"validatedMapTypeField": {
+			"Struct.ValidatedMapTypeField(keys)", "ValidatedMapType(keys)",
+			"Struct.ValidatedMapTypeField(keys)", "ValidatedMapType(keys)",
+		},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachkey/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachkey/zz_generated.validations.go
new file mode 100644
index 0000000000..8a25f46579
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachkey/zz_generated.validations.go
@@ -0,0 +1,238 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package eachkey
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "Struct.MapField(keys)")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[UnvalidatedStringType]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *UnvalidatedStringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "Struct.MapTypedefField(keys)")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[UnvalidatedStringType]string {
+				return oldObj.MapTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapTypedefField"), obj.MapTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapValidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[ValidatedStringType]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ValidatedStringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "Struct.MapValidatedTypedefField(keys)")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the key type's validation function
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj, Validate_ValidatedStringType); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[ValidatedStringType]string {
+				return oldObj.MapValidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapValidatedTypedefField"), obj.MapValidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapTypeField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj UnvalidatedMapType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "Struct.MapTypeField(keys)")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) UnvalidatedMapType {
+				return oldObj.MapTypeField
+			})
+		errs = append(errs, fn(fldPath.Child("mapTypeField"), obj.MapTypeField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ValidatedMapTypeField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj ValidatedMapType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "Struct.ValidatedMapTypeField(keys)")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ValidatedMapType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) ValidatedMapType {
+				return oldObj.ValidatedMapTypeField
+			})
+		errs = append(errs, fn(fldPath.Child("validatedMapTypeField"), obj.ValidatedMapTypeField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ValidatedMapType validates an instance of ValidatedMapType according
+// to declarative validation rules in the API schema.
+func Validate_ValidatedMapType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj ValidatedMapType) (errs field.ErrorList) {
+
+	if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "ValidatedMapType(keys)")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ValidatedStringType validates an instance of ValidatedStringType according
+// to declarative validation rules in the API schema.
+func Validate_ValidatedStringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ValidatedStringType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "ValidatedStringType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc.go
new file mode 100644
index 0000000000..dfa903970c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc.go
@@ -0,0 +1,41 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package mapofpointers
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapField[*]"
+	MapField map[string]*OtherStruct `json:"mapField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPrimitiveField[*]"
+	MapPrimitiveField map[string]*string `json:"mapPrimitiveField"`
+}
+
+// +k8s:validateFalse="type OtherStruct"
+type OtherStruct struct {
+	Value string `json:"value"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc_test.go
new file mode 100644
index 0000000000..b9e93fe566
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc_test.go
@@ -0,0 +1,52 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mapofpointers
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// 1. Zero values should be valid
+	st.Value(&Struct{
+		// All zero values.
+	}).ExpectValid()
+
+	// 2. Non-nil elements trigger validation errors
+	st.Value(&Struct{
+		MapField:          map[string]*OtherStruct{"k1": {}, "k2": {}},
+		MapPrimitiveField: map[string]*string{"k1": new("a"), "k2": new("b")},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"mapField[k1]":          {"field Struct.MapField[*]", "type OtherStruct"},
+		"mapField[k2]":          {"field Struct.MapField[*]", "type OtherStruct"},
+		"mapPrimitiveField[k1]": {"field Struct.MapPrimitiveField[*]"},
+		"mapPrimitiveField[k2]": {"field Struct.MapPrimitiveField[*]"},
+	})
+
+	// 3. Nil elements trigger Required errors from PtrMapNoNils
+	st.Value(&Struct{
+		MapField:          map[string]*OtherStruct{"k1": nil},
+		MapPrimitiveField: map[string]*string{"k1": nil},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Required(field.NewPath("mapField").Key("k1"), ""),
+		field.Required(field.NewPath("mapPrimitiveField").Key("k1"), ""),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/zz_generated.validations.go
new file mode 100644
index 0000000000..641eb0e3fc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/zz_generated.validations.go
@@ -0,0 +1,156 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package mapofpointers
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_OtherStruct validates an instance of OtherStruct according
+// to declarative validation rules in the API schema.
+func Validate_OtherStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OtherStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type OtherStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field OtherStruct.Value has no validation
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]*OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrMapNoNils[string, OtherStruct](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_OtherStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]*OtherStruct {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapPrimitiveField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]*string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrMapNoNils[string, string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPrimitiveField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]*string {
+				return oldObj.MapPrimitiveField
+			})
+		errs = append(errs, fn(fldPath.Child("mapPrimitiveField"), obj.MapPrimitiveField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_primitive/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_primitive/doc.go
new file mode 100644
index 0000000000..d9739bb1dd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_primitive/doc.go
@@ -0,0 +1,38 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package mapofprimitive
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapField[*]"
+	MapField map[string]string `json:"mapField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapTypedefField[*]"
+	MapTypedefField map[string]StringType `json:"mapTypedefField"`
+}
+
+type StringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_primitive/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_primitive/doc_test.go
new file mode 100644
index 0000000000..05f4678f70
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_primitive/doc_test.go
@@ -0,0 +1,39 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mapofprimitive
+
+import (
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values.
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		MapField:        map[string]string{"a": "A", "b": "B"},
+		MapTypedefField: map[string]StringType{"a": "A", "b": "B"},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"mapField[a]":        {"field Struct.MapField[*]"},
+		"mapField[b]":        {"field Struct.MapField[*]"},
+		"mapTypedefField[a]": {"field Struct.MapTypedefField[*]"},
+		"mapTypedefField[b]": {"field Struct.MapTypedefField[*]"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_primitive/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_primitive/zz_generated.validations.go
new file mode 100644
index 0000000000..6fbbf43955
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_primitive/zz_generated.validations.go
@@ -0,0 +1,122 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package mapofprimitive
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]StringType {
+				return oldObj.MapTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapTypedefField"), obj.MapTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_struct/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_struct/doc.go
new file mode 100644
index 0000000000..3c65b1566e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_struct/doc.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package mapofstruct
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapField[*]"
+	MapField map[string]OtherStruct `json:"mapField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapTypedefField[*]"
+	MapTypedefField map[string]OtherTypedefStruct `json:"mapTypedefField"`
+}
+
+type OtherStruct struct{}
+
+type OtherTypedefStruct OtherStruct
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_struct/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_struct/doc_test.go
new file mode 100644
index 0000000000..155826edcb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_struct/doc_test.go
@@ -0,0 +1,39 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mapofstruct
+
+import (
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values.
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		MapField:        map[string]OtherStruct{"a": {}, "b": {}},
+		MapTypedefField: map[string]OtherTypedefStruct{"a": {}, "b": {}},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"mapField[a]":        {"field Struct.MapField[*]"},
+		"mapField[b]":        {"field Struct.MapField[*]"},
+		"mapTypedefField[a]": {"field Struct.MapTypedefField[*]"},
+		"mapTypedefField[b]": {"field Struct.MapTypedefField[*]"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_struct/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_struct/zz_generated.validations.go
new file mode 100644
index 0000000000..db212ac2c1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_struct/zz_generated.validations.go
@@ -0,0 +1,122 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package mapofstruct
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]OtherStruct {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]OtherTypedefStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherTypedefStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]OtherTypedefStruct {
+				return oldObj.MapTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapTypedefField"), obj.MapTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_pointers/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_pointers/doc.go
new file mode 100644
index 0000000000..d3de3f36eb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_pointers/doc.go
@@ -0,0 +1,41 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package sliceofpointers
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListField[*]"
+	ListField []*OtherStruct `json:"listField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListPrimitiveField[*]"
+	ListPrimitiveField []*string `json:"listPrimitiveField"`
+}
+
+// +k8s:validateFalse="type OtherStruct"
+type OtherStruct struct {
+	Value string `json:"value"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_pointers/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_pointers/doc_test.go
new file mode 100644
index 0000000000..f0d0af6c69
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_pointers/doc_test.go
@@ -0,0 +1,52 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sliceofpointers
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// 1. Zero values should be valid
+	st.Value(&Struct{
+		// All zero values.
+	}).ExpectValid()
+
+	// 2. Non-nil elements trigger validation errors
+	st.Value(&Struct{
+		ListField:          []*OtherStruct{{}, {}},
+		ListPrimitiveField: []*string{new("a"), new("b")},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"listField[0]":          {"field Struct.ListField[*]", "type OtherStruct"},
+		"listField[1]":          {"field Struct.ListField[*]", "type OtherStruct"},
+		"listPrimitiveField[0]": {"field Struct.ListPrimitiveField[*]"},
+		"listPrimitiveField[1]": {"field Struct.ListPrimitiveField[*]"},
+	})
+
+	// 3. Nil elements trigger Required errors from EachPtrSliceVal
+	st.Value(&Struct{
+		ListField:          []*OtherStruct{nil},
+		ListPrimitiveField: []*string{nil},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Required(field.NewPath("listField").Index(0), ""),
+		field.Required(field.NewPath("listPrimitiveField").Index(0), ""),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_pointers/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_pointers/zz_generated.validations.go
new file mode 100644
index 0000000000..457639f3e2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_pointers/zz_generated.validations.go
@@ -0,0 +1,156 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package sliceofpointers
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_OtherStruct validates an instance of OtherStruct according
+// to declarative validation rules in the API schema.
+func Validate_OtherStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OtherStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type OtherStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field OtherStruct.Value has no validation
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ListField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []*OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrSliceNoNils[OtherStruct](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_OtherStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []*OtherStruct {
+				return oldObj.ListField
+			})
+		errs = append(errs, fn(fldPath.Child("listField"), obj.ListField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListPrimitiveField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []*string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrSliceNoNils[string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListPrimitiveField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []*string {
+				return oldObj.ListPrimitiveField
+			})
+		errs = append(errs, fn(fldPath.Child("listPrimitiveField"), obj.ListPrimitiveField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_primitive/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_primitive/doc.go
new file mode 100644
index 0000000000..0746127c9b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_primitive/doc.go
@@ -0,0 +1,38 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package sliceofprimitive
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListField[*]"
+	ListField []string `json:"listField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListTypedefField[*]"
+	ListTypedefField []StringType `json:"listTypedefField"`
+}
+
+type StringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_primitive/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_primitive/doc_test.go
new file mode 100644
index 0000000000..cd226444ea
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_primitive/doc_test.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sliceofprimitive
+
+import (
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values.
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		ListField:        []string{"zero", "one"},
+		ListTypedefField: []StringType{StringType("zero"), StringType("one")},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"listField[0]":        {"field Struct.ListField[*]"},
+		"listField[1]":        {"field Struct.ListField[*]"},
+		"listTypedefField[0]": {"field Struct.ListTypedefField[*]"},
+		"listTypedefField[1]": {"field Struct.ListTypedefField[*]"},
+	})
+
+	// Test validation ratcheting.
+	st.Value(&Struct{
+		ListField:        []string{"zero", "one"},
+		ListTypedefField: []StringType{StringType("zero"), StringType("one")},
+	}).OldValue(&Struct{
+		// Same data, different order - should still fail.
+		ListField:        []string{"one", "zero"},
+		ListTypedefField: []StringType{StringType("one"), StringType("zero")},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"listField[0]":        {"field Struct.ListField[*]"},
+		"listField[1]":        {"field Struct.ListField[*]"},
+		"listTypedefField[0]": {"field Struct.ListTypedefField[*]"},
+		"listTypedefField[1]": {"field Struct.ListTypedefField[*]"},
+	})
+
+	st.Value(&Struct{
+		ListField:        []string{"zero", "one"},
+		ListTypedefField: []StringType{StringType("zero"), StringType("one")},
+	}).OldValue(&Struct{
+		ListField:        []string{"zero", "one"},
+		ListTypedefField: []StringType{StringType("zero"), StringType("one")},
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_primitive/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_primitive/zz_generated.validations.go
new file mode 100644
index 0000000000..03b166441b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_primitive/zz_generated.validations.go
@@ -0,0 +1,122 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package sliceofprimitive
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ListField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.ListField
+			})
+		errs = append(errs, fn(fldPath.Child("listField"), obj.ListField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []StringType {
+				return oldObj.ListTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("listTypedefField"), obj.ListTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_struct/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_struct/doc.go
new file mode 100644
index 0000000000..2a0cfa867c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_struct/doc.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package sliceofstruct
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListField[*]"
+	ListField []OtherStruct `json:"listField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListTypedefField[*]"
+	ListTypedefField []OtherTypedefStruct `json:"listTypedefField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListNonComparableField[*]"
+	ListNonComparableField []NonComparableStruct `json:"listNonComparableField"`
+}
+
+type OtherStruct struct{}
+
+type OtherTypedefStruct OtherStruct
+
+type NonComparableStruct struct {
+	SliceField []string `json:"sliceField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_struct/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_struct/doc_test.go
new file mode 100644
index 0000000000..0dde83d4f4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_struct/doc_test.go
@@ -0,0 +1,63 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sliceofstruct
+
+import (
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values.
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		ListField:        []OtherStruct{{}, {}},
+		ListTypedefField: []OtherTypedefStruct{{}, {}},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"listField[0]":        {"field Struct.ListField[*]"},
+		"listField[1]":        {"field Struct.ListField[*]"},
+		"listTypedefField[0]": {"field Struct.ListTypedefField[*]"},
+		"listTypedefField[1]": {"field Struct.ListTypedefField[*]"},
+	})
+	st.Value(&Struct{
+		ListNonComparableField: []NonComparableStruct{{SliceField: []string{"zero", "one"}}, {SliceField: []string{"three", "four"}}},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"listNonComparableField[0]": {"field Struct.ListNonComparableField[*]"},
+		"listNonComparableField[1]": {"field Struct.ListNonComparableField[*]"},
+	})
+
+	// Test validation ratcheting.
+	st.Value(&Struct{
+		ListField:        []OtherStruct{{}, {}},
+		ListTypedefField: []OtherTypedefStruct{{}, {}},
+	}).OldValue(&Struct{
+		ListField:        []OtherStruct{{}, {}},
+		ListTypedefField: []OtherTypedefStruct{{}, {}},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		// New element exists in old value, but this is not a set.
+		ListNonComparableField: []NonComparableStruct{{SliceField: []string{"three", "four"}}},
+	}).OldValue(&Struct{
+		ListNonComparableField: []NonComparableStruct{{SliceField: []string{"zero", "one"}}, {SliceField: []string{"three", "four"}}},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"listNonComparableField[0]": {"field Struct.ListNonComparableField[*]"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_struct/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_struct/zz_generated.validations.go
new file mode 100644
index 0000000000..921e605e4b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/slice_of_struct/zz_generated.validations.go
@@ -0,0 +1,149 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package sliceofstruct
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ListField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherStruct {
+				return oldObj.ListField
+			})
+		errs = append(errs, fn(fldPath.Child("listField"), obj.ListField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherTypedefStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherTypedefStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherTypedefStruct {
+				return oldObj.ListTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("listTypedefField"), obj.ListTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListNonComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []NonComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListNonComparableField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []NonComparableStruct {
+				return oldObj.ListNonComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("listNonComparableField"), obj.ListNonComparableField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_map/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_map/doc.go
new file mode 100644
index 0000000000..c66f9cedbd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_map/doc.go
@@ -0,0 +1,52 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package typedeftomap
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Note: no validation here
+type UnvalidatedType map[string]string
+
+// +k8s:eachVal=+k8s:validateFalse="type MapType[*]"
+type MapType map[string]string
+
+// Note: no validation here
+type UnvalidatedPtrType map[string]*string
+
+// +k8s:validateFalse="type StringType"
+type StringType string
+
+// +k8s:eachVal=+k8s:validateFalse="type MapTypedefType[*]"
+type MapTypedefType map[string]StringType
+
+// +k8s:validateFalse="type Struct"
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapField[*]"
+	MapField MapType `json:"mapField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapTypedefField[*]"
+	MapTypedefField MapTypedefType `json:"mapTypedefField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_map/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_map/doc_test.go
new file mode 100644
index 0000000000..a2dce9633b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_map/doc_test.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package typedeftomap
+
+import (
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values.
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"": {"type Struct"},
+	})
+
+	st.Value(&Struct{
+		MapField:        MapType{"a": "A", "b": "B"},
+		MapTypedefField: MapTypedefType{"a": StringType("A"), "b": StringType("B")},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"":                   {"type Struct"},
+		"mapField[a]":        {"type MapType[*]", "field Struct.MapField[*]"},
+		"mapField[b]":        {"type MapType[*]", "field Struct.MapField[*]"},
+		"mapTypedefField[a]": {"type MapTypedefType[*]", "field Struct.MapTypedefField[*]", "type StringType"},
+		"mapTypedefField[b]": {"type MapTypedefType[*]", "field Struct.MapTypedefField[*]", "type StringType"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_map/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_map/zz_generated.validations.go
new file mode 100644
index 0000000000..a1ecc1812c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_map/zz_generated.validations.go
@@ -0,0 +1,180 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package typedeftomap
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_MapType validates an instance of MapType according
+// to declarative validation rules in the API schema.
+func Validate_MapType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj MapType) (errs field.ErrorList) {
+
+	if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapType[*]")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_MapTypedefType validates an instance of MapTypedefType according
+// to declarative validation rules in the API schema.
+func Validate_MapTypedefType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj MapTypedefType) (errs field.ErrorList) {
+
+	if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapTypedefType[*]")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// iterate the map and call the value type's validation function
+	if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_StringType); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_StringType validates an instance of StringType according
+// to declarative validation rules in the API schema.
+func Validate_StringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StringType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type StringType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type Struct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj MapType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_MapType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) MapType {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj MapTypedefType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_MapTypedefType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) MapTypedefType {
+				return oldObj.MapTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapTypedefField"), obj.MapTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_slice/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_slice/doc.go
new file mode 100644
index 0000000000..91870d7eec
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_slice/doc.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package typedeftoslice
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Note: no validation here
+type UnvalidatedType []string
+
+// +k8s:eachVal=+k8s:validateFalse="type ListType[*]"
+type ListType []string
+
+// Note: no validation here
+type UnvalidatedPtrType []*string
+
+type StringType string
+
+// +k8s:eachVal=+k8s:validateFalse="type ListTypedefType[*]"
+type ListTypedefType []StringType
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListField[*]"
+	ListField ListType `json:"listField"`
+
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListTypedefField[*]"
+	ListTypedefField ListTypedefType `json:"listTypedefField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_slice/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_slice/doc_test.go
new file mode 100644
index 0000000000..6978d1155f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_slice/doc_test.go
@@ -0,0 +1,39 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package typedeftoslice
+
+import (
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values.
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		ListField:        ListType{"zero", "one"},
+		ListTypedefField: ListTypedefType{StringType("zero"), StringType("one")},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"listField[0]":        {"type ListType[*]", "field Struct.ListField[*]"},
+		"listField[1]":        {"type ListType[*]", "field Struct.ListField[*]"},
+		"listTypedefField[0]": {"type ListTypedefType[*]", "field Struct.ListTypedefField[*]"},
+		"listTypedefField[1]": {"type ListTypedefType[*]", "field Struct.ListTypedefField[*]"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_slice/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_slice/zz_generated.validations.go
new file mode 100644
index 0000000000..3d3bc63e3e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/typedef_to_slice/zz_generated.validations.go
@@ -0,0 +1,158 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package typedeftoslice
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_ListType validates an instance of ListType according
+// to declarative validation rules in the API schema.
+func Validate_ListType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj ListType) (errs field.ErrorList) {
+
+	if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type ListType[*]")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ListTypedefType validates an instance of ListTypedefType according
+// to declarative validation rules in the API schema.
+func Validate_ListTypedefType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj ListTypedefType) (errs field.ErrorList) {
+
+	if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type ListTypedefType[*]")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ListField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj ListType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ListType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) ListType {
+				return oldObj.ListField
+			})
+		errs = append(errs, fn(fldPath.Child("listField"), obj.ListField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj ListTypedefType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListTypedefField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ListTypedefType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) ListTypedefType {
+				return oldObj.ListTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("listTypedefField"), obj.ListTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/doc.go
new file mode 100644
index 0000000000..85cbc0fd81
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/doc.go
@@ -0,0 +1,65 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package enum
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	Enum0Field    Enum0  `json:"enum0Field"`
+	Enum0PtrField *Enum0 `json:"enum0PtrField"`
+
+	Enum1Field    Enum1  `json:"enum1Field"`
+	Enum1PtrField *Enum1 `json:"enum1PtrField"`
+
+	Enum2Field    Enum2  `json:"enum2Field"`
+	Enum2PtrField *Enum2 `json:"enum2PtrField"`
+
+	NotEnumField    NotEnum  `json:"notEnumField"`
+	NotEnumPtrField *NotEnum `json:"notEnumPtrField"`
+}
+
+// +k8s:enum
+type Enum0 string // Note: this enum has no values
+
+// +k8s:enum
+type Enum1 string // Note: this enum has 1 value
+
+const (
+	E1V1 Enum1 = "e1v1"
+)
+
+// +k8s:enum
+type Enum2 string // Note: this enum has 2 values
+
+const (
+	E2V1 Enum2 = "e2v1"
+	E2V2 Enum2 = "e2v2"
+)
+
+// Note: this is not an enum because the const values are of type Enum2, and
+// because go elides intermediate typedefs (this is modelled as "NotEnum" ->
+// "string" in the AST).
+type NotEnum Enum2
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/doc_test.go
new file mode 100644
index 0000000000..3c558371c8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/doc_test.go
@@ -0,0 +1,68 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package enum
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero vals
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("enum0Field"), Enum0(""), []Enum0{}),
+		field.NotSupported(field.NewPath("enum1Field"), Enum1(""), []Enum1{E1V1}),
+		field.NotSupported(field.NewPath("enum2Field"), Enum2(""), []Enum2{E2V1, E2V2}),
+	})
+
+	st.Value(&Struct{
+		Enum0Field:      "",                // no valid value exists
+		Enum0PtrField:   ptr.To(Enum0("")), // no valid value exists
+		Enum1Field:      E1V1,
+		Enum1PtrField:   ptr.To(E1V1),
+		Enum2Field:      E2V1,
+		Enum2PtrField:   ptr.To(E2V1),
+		NotEnumField:    "x",
+		NotEnumPtrField: ptr.To(NotEnum("x")),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("enum0Field"), Enum0(""), []Enum0{}),
+		field.NotSupported(field.NewPath("enum0PtrField"), Enum0(""), []Enum0{}),
+	})
+
+	st.Value(&Struct{
+		Enum0Field:      "x",                // no valid value exists
+		Enum0PtrField:   ptr.To(Enum0("x")), // no valid value exists
+		Enum1Field:      "x",
+		Enum1PtrField:   ptr.To(Enum1("x")),
+		Enum2Field:      "x",
+		Enum2PtrField:   ptr.To(Enum2("x")),
+		NotEnumField:    "x",
+		NotEnumPtrField: ptr.To(NotEnum("x")),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("enum0Field"), Enum0("x"), []Enum0{}),
+		field.NotSupported(field.NewPath("enum0PtrField"), Enum0("x"), []Enum0{}),
+		field.NotSupported(field.NewPath("enum1Field"), Enum1("x"), []Enum1{E1V1}),
+		field.NotSupported(field.NewPath("enum1PtrField"), Enum1("x"), []Enum1{E1V1}),
+		field.NotSupported(field.NewPath("enum2Field"), Enum2("x"), []Enum2{E2V1, E2V2}),
+		field.NotSupported(field.NewPath("enum2PtrField"), Enum2("x"), []Enum2{E2V1, E2V2}),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/options/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/options/doc.go
new file mode 100644
index 0000000000..67484e8d5a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/options/doc.go
@@ -0,0 +1,111 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package options
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	Enum0Field    Enum0  `json:"enum0Field"`
+	Enum0PtrField *Enum0 `json:"enum0PtrField"`
+
+	Enum1Field    Enum1  `json:"enum1Field"`
+	Enum1PtrField *Enum1 `json:"enum1PtrField"`
+
+	Enum2Field    Enum2  `json:"enum2Field"`
+	Enum2PtrField *Enum2 `json:"enum2PtrField"`
+
+	NotEnumField    NotEnum  `json:"notEnumField"`
+	NotEnumPtrField *NotEnum `json:"notEnumPtrField"`
+
+	EnumWithExcludeField    EnumWithExclude  `json:"enumWithExcludeField"`
+	EnumWithExcludePtrField *EnumWithExclude `json:"enumWithExcludePtrField"`
+}
+
+type ConditionalStruct struct {
+	TypeMeta int
+
+	ConditionalEnumField    ConditionalEnum  `json:"conditionalEnumField"`
+	ConditionalEnumPtrField *ConditionalEnum `json:"conditionalEnumPtrField"`
+}
+
+// +k8s:enum
+type Enum0 string // Note: this enum has no values
+
+// +k8s:enum
+type Enum1 string // Note: this enum has 1 value
+
+const (
+	E1V1 Enum1 = "e1v1"
+)
+
+// +k8s:enum
+type Enum2 string // Note: this enum has 2 values
+
+const (
+	E2V1 Enum2 = "e2v1"
+	E2V2 Enum2 = "e2v2"
+)
+
+// Note: this is not an enum because the const values are of type Enum2, and
+// because go elides intermediate typedefs (this is modelled as "NotEnum" ->
+// "string" in the AST).
+type NotEnum Enum2
+
+// +k8s:enum
+type EnumWithExclude string
+
+const (
+	EnumWithExclude1 EnumWithExclude = "enumWithExclude1"
+
+	// +k8s:enumExclude
+	EnumWithExclude2 EnumWithExclude = "enumWithExclude2"
+)
+
+// +k8s:enum
+type ConditionalEnum string
+
+const (
+	// +k8s:ifEnabled(FeatureA)=+k8s:enumExclude
+	ConditionalA ConditionalEnum = "A"
+
+	// +k8s:ifDisabled(FeatureB)=+k8s:enumExclude
+	ConditionalB ConditionalEnum = "B"
+
+	// This value is always included.
+	ConditionalC ConditionalEnum = "C"
+
+	// +k8s:ifEnabled(FeatureA)=+k8s:enumExclude
+	// +k8s:ifEnabled(FeatureB)=+k8s:enumExclude
+	ConditionalD ConditionalEnum = "D"
+
+	// +k8s:ifDisabled(FeatureC)=+k8s:enumExclude
+	// +k8s:ifDisabled(FeatureD)=+k8s:enumExclude
+	ConditionalE ConditionalEnum = "E"
+
+	// +k8s:ifDisabled(FeatureC)=+k8s:enumExclude
+	// +k8s:ifEnabled(FeatureD)=+k8s:enumExclude
+	ConditionalF ConditionalEnum = "F"
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/options/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/options/doc_test.go
new file mode 100644
index 0000000000..88d15c8a63
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/options/doc_test.go
@@ -0,0 +1,206 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package options
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// opts declares all options this type references, enabling the named ones.
+	opts := func(enabled ...string) map[string]bool {
+		m := map[string]bool{"FeatureA": false, "FeatureB": false, "FeatureC": false, "FeatureD": false}
+		for _, e := range enabled {
+			m[e] = true
+		}
+		return m
+	}
+
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "",
+	}).Opts(opts()).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum(""), []ConditionalEnum{ConditionalA, ConditionalC, ConditionalD}),
+	})
+
+	// Scenario 1: No options (default)
+	// Valid values: A, C, D
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "B",
+	}).Opts(opts()).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("B"), []ConditionalEnum{ConditionalA, ConditionalC, ConditionalD}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "E",
+	}).Opts(opts()).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("E"), []ConditionalEnum{ConditionalA, ConditionalC, ConditionalD}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "F",
+	}).Opts(opts()).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("F"), []ConditionalEnum{ConditionalA, ConditionalC, ConditionalD}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "A",
+	}).Opts(opts()).ExpectValid()
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "C",
+	}).Opts(opts()).ExpectValid()
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "D",
+	}).Opts(opts()).ExpectValid()
+
+	// Scenario 2: FeatureA enabled
+	// Valid values: C
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "A",
+	}).Opts(opts("FeatureA")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("A"), []ConditionalEnum{ConditionalC}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "B",
+	}).Opts(opts("FeatureA")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("B"), []ConditionalEnum{ConditionalC}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "D",
+	}).Opts(opts("FeatureA")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("D"), []ConditionalEnum{ConditionalC}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "E",
+	}).Opts(opts("FeatureA")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("E"), []ConditionalEnum{ConditionalC}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "F",
+	}).Opts(opts("FeatureA")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("F"), []ConditionalEnum{ConditionalC}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "C",
+	}).Opts(opts("FeatureA")).ExpectValid()
+
+	// Scenario 3: FeatureB enabled
+	// Valid values: A, B, C
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "D",
+	}).Opts(opts("FeatureB")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("D"), []ConditionalEnum{ConditionalA, ConditionalB, ConditionalC}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "E",
+	}).Opts(opts("FeatureB")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("E"), []ConditionalEnum{ConditionalA, ConditionalB, ConditionalC}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "F",
+	}).Opts(opts("FeatureB")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("F"), []ConditionalEnum{ConditionalA, ConditionalB, ConditionalC}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "A",
+	}).Opts(opts("FeatureB")).ExpectValid()
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "B",
+	}).Opts(opts("FeatureB")).ExpectValid()
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "C",
+	}).Opts(opts("FeatureB")).ExpectValid()
+
+	// Scenario 4: FeatureA and FeatureB enabled
+	// Valid values: B, C
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "A",
+	}).Opts(opts("FeatureA", "FeatureB")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("A"), []ConditionalEnum{ConditionalB, ConditionalC}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "D",
+	}).Opts(opts("FeatureA", "FeatureB")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("D"), []ConditionalEnum{ConditionalB, ConditionalC}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "E",
+	}).Opts(opts("FeatureA", "FeatureB")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("E"), []ConditionalEnum{ConditionalB, ConditionalC}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "F",
+	}).Opts(opts("FeatureA", "FeatureB")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("F"), []ConditionalEnum{ConditionalB, ConditionalC}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "B",
+	}).Opts(opts("FeatureA", "FeatureB")).ExpectValid()
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "C",
+	}).Opts(opts("FeatureA", "FeatureB")).ExpectValid()
+
+	// Scenario 5: FeatureC and FeatureD enabled
+	// Valid values: A, C, D, E
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "B",
+	}).Opts(opts("FeatureC", "FeatureD")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("B"), []ConditionalEnum{ConditionalA, ConditionalC, ConditionalD, ConditionalE}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "F",
+	}).Opts(opts("FeatureC", "FeatureD")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("F"), []ConditionalEnum{ConditionalA, ConditionalC, ConditionalD, ConditionalE}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "A",
+	}).Opts(opts("FeatureC", "FeatureD")).ExpectValid()
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "C",
+	}).Opts(opts("FeatureC", "FeatureD")).ExpectValid()
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "D",
+	}).Opts(opts("FeatureC", "FeatureD")).ExpectValid()
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "E",
+	}).Opts(opts("FeatureC", "FeatureD")).ExpectValid()
+
+	// Scenario 6: FeatureB and FeatureC enabled
+	// Valid values: A, B, C, F
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "D",
+	}).Opts(opts("FeatureB", "FeatureC")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("D"), []ConditionalEnum{ConditionalA, ConditionalB, ConditionalC, ConditionalF}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "E",
+	}).Opts(opts("FeatureB", "FeatureC")).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.NotSupported(field.NewPath("conditionalEnumField"), ConditionalEnum("E"), []ConditionalEnum{ConditionalA, ConditionalB, ConditionalC, ConditionalF}),
+	})
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "A",
+	}).Opts(opts("FeatureB", "FeatureC")).ExpectValid()
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "B",
+	}).Opts(opts("FeatureB", "FeatureC")).ExpectValid()
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "C",
+	}).Opts(opts("FeatureB", "FeatureC")).ExpectValid()
+	st.Value(&ConditionalStruct{
+		ConditionalEnumField: "F",
+	}).Opts(opts("FeatureB", "FeatureC")).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/options/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/options/zz_generated.validations.go
new file mode 100644
index 0000000000..65ae23c9a6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/options/zz_generated.validations.go
@@ -0,0 +1,442 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package options
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	sets "k8s.io/apimachinery/pkg/util/sets"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type ConditionalStruct
+	scheme.AddValidationFunc(
+		(*ConditionalStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ConditionalStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*ConditionalStruct),
+					safe.Cast[*ConditionalStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var exclusionsForConditionalEnum = []validate.EnumExclusion[ConditionalEnum]{
+
+	{
+		Value:       ConditionalA,
+		Option:      "FeatureA",
+		ExcludeWhen: true,
+	},
+
+	{
+		Value:       ConditionalB,
+		Option:      "FeatureB",
+		ExcludeWhen: false,
+	},
+
+	{
+		Value:       ConditionalD,
+		Option:      "FeatureA",
+		ExcludeWhen: true,
+	},
+
+	{
+		Value:       ConditionalD,
+		Option:      "FeatureB",
+		ExcludeWhen: true,
+	},
+
+	{
+		Value:       ConditionalE,
+		Option:      "FeatureC",
+		ExcludeWhen: false,
+	},
+
+	{
+		Value:       ConditionalE,
+		Option:      "FeatureD",
+		ExcludeWhen: false,
+	},
+
+	{
+		Value:       ConditionalF,
+		Option:      "FeatureC",
+		ExcludeWhen: false,
+	},
+
+	{
+		Value:       ConditionalF,
+		Option:      "FeatureD",
+		ExcludeWhen: true,
+	},
+}
+var symbolsForConditionalEnum = sets.New(ConditionalA, ConditionalB, ConditionalC, ConditionalD, ConditionalE, ConditionalF)
+
+// Validate_ConditionalEnum validates an instance of ConditionalEnum according
+// to declarative validation rules in the API schema.
+func Validate_ConditionalEnum(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ConditionalEnum) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForConditionalEnum, exclusionsForConditionalEnum); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ConditionalStruct validates an instance of ConditionalStruct according
+// to declarative validation rules in the API schema.
+func Validate_ConditionalStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ConditionalStruct) (errs field.ErrorList) {
+
+	// field ConditionalStruct.TypeMeta has no validation
+
+	{ // field ConditionalStruct.ConditionalEnumField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ConditionalEnum,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ConditionalEnum(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ConditionalStruct) *ConditionalEnum {
+				return &oldObj.ConditionalEnumField
+			})
+		errs = append(errs, fn(fldPath.Child("conditionalEnumField"), &obj.ConditionalEnumField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ConditionalStruct.ConditionalEnumPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ConditionalEnum,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ConditionalEnum(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ConditionalStruct) *ConditionalEnum {
+				return oldObj.ConditionalEnumPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("conditionalEnumPtrField"), obj.ConditionalEnumPtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var symbolsForEnum0 = sets.New[Enum0]()
+
+// Validate_Enum0 validates an instance of Enum0 according
+// to declarative validation rules in the API schema.
+func Validate_Enum0(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Enum0) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForEnum0, nil); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+var symbolsForEnum1 = sets.New(E1V1)
+
+// Validate_Enum1 validates an instance of Enum1 according
+// to declarative validation rules in the API schema.
+func Validate_Enum1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Enum1) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForEnum1, nil); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+var symbolsForEnum2 = sets.New(E2V1, E2V2)
+
+// Validate_Enum2 validates an instance of Enum2 according
+// to declarative validation rules in the API schema.
+func Validate_Enum2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Enum2) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForEnum2, nil); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+var symbolsForEnumWithExclude = sets.New(EnumWithExclude1)
+
+// Validate_EnumWithExclude validates an instance of EnumWithExclude according
+// to declarative validation rules in the API schema.
+func Validate_EnumWithExclude(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *EnumWithExclude) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForEnumWithExclude, nil); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Enum0Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Enum0,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Enum0(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Enum0 {
+				return &oldObj.Enum0Field
+			})
+		errs = append(errs, fn(fldPath.Child("enum0Field"), &obj.Enum0Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Enum0PtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Enum0,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Enum0(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Enum0 {
+				return oldObj.Enum0PtrField
+			})
+		errs = append(errs, fn(fldPath.Child("enum0PtrField"), obj.Enum0PtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Enum1Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Enum1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Enum1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Enum1 {
+				return &oldObj.Enum1Field
+			})
+		errs = append(errs, fn(fldPath.Child("enum1Field"), &obj.Enum1Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Enum1PtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Enum1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Enum1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Enum1 {
+				return oldObj.Enum1PtrField
+			})
+		errs = append(errs, fn(fldPath.Child("enum1PtrField"), obj.Enum1PtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Enum2Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Enum2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Enum2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Enum2 {
+				return &oldObj.Enum2Field
+			})
+		errs = append(errs, fn(fldPath.Child("enum2Field"), &obj.Enum2Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Enum2PtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Enum2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Enum2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Enum2 {
+				return oldObj.Enum2PtrField
+			})
+		errs = append(errs, fn(fldPath.Child("enum2PtrField"), obj.Enum2PtrField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.NotEnumField has no validation
+	// field Struct.NotEnumPtrField has no validation
+
+	{ // field Struct.EnumWithExcludeField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *EnumWithExclude,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_EnumWithExclude(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *EnumWithExclude {
+				return &oldObj.EnumWithExcludeField
+			})
+		errs = append(errs, fn(fldPath.Child("enumWithExcludeField"), &obj.EnumWithExcludeField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.EnumWithExcludePtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *EnumWithExclude,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_EnumWithExclude(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *EnumWithExclude {
+				return oldObj.EnumWithExcludePtrField
+			})
+		errs = append(errs, fn(fldPath.Child("enumWithExcludePtrField"), obj.EnumWithExcludePtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/zz_generated.validations.go
new file mode 100644
index 0000000000..2cfeb7c5a0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/enum/zz_generated.validations.go
@@ -0,0 +1,247 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package enum
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	sets "k8s.io/apimachinery/pkg/util/sets"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var symbolsForEnum0 = sets.New[Enum0]()
+
+// Validate_Enum0 validates an instance of Enum0 according
+// to declarative validation rules in the API schema.
+func Validate_Enum0(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Enum0) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForEnum0, nil); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+var symbolsForEnum1 = sets.New(E1V1)
+
+// Validate_Enum1 validates an instance of Enum1 according
+// to declarative validation rules in the API schema.
+func Validate_Enum1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Enum1) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForEnum1, nil); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+var symbolsForEnum2 = sets.New(E2V1, E2V2)
+
+// Validate_Enum2 validates an instance of Enum2 according
+// to declarative validation rules in the API schema.
+func Validate_Enum2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Enum2) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForEnum2, nil); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Enum0Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Enum0,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Enum0(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Enum0 {
+				return &oldObj.Enum0Field
+			})
+		errs = append(errs, fn(fldPath.Child("enum0Field"), &obj.Enum0Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Enum0PtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Enum0,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Enum0(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Enum0 {
+				return oldObj.Enum0PtrField
+			})
+		errs = append(errs, fn(fldPath.Child("enum0PtrField"), obj.Enum0PtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Enum1Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Enum1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Enum1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Enum1 {
+				return &oldObj.Enum1Field
+			})
+		errs = append(errs, fn(fldPath.Child("enum1Field"), &obj.Enum1Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Enum1PtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Enum1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Enum1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Enum1 {
+				return oldObj.Enum1PtrField
+			})
+		errs = append(errs, fn(fldPath.Child("enum1PtrField"), obj.Enum1PtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Enum2Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Enum2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Enum2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Enum2 {
+				return &oldObj.Enum2Field
+			})
+		errs = append(errs, fn(fldPath.Child("enum2Field"), &obj.Enum2Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Enum2PtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Enum2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Enum2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Enum2 {
+				return oldObj.Enum2PtrField
+			})
+		errs = append(errs, fn(fldPath.Child("enum2PtrField"), obj.Enum2PtrField, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.NotEnumField has no validation
+	// field Struct.NotEnumPtrField has no validation
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/forbidden/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/forbidden/doc.go
new file mode 100644
index 0000000000..b859772d11
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/forbidden/doc.go
@@ -0,0 +1,91 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package forbidden
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:forbidden
+	StringField string `json:"stringField"`
+
+	// +k8s:forbidden
+	StringPtrField *string `json:"stringPtrField"`
+
+	// +k8s:forbidden
+	StringTypedefField StringType `json:"stringTypedefField"`
+
+	// +k8s:forbidden
+	StringTypedefPtrField *StringType `json:"stringTypedefPtrField"`
+
+	// +k8s:forbidden
+	IntField int `json:"intField"`
+
+	// +k8s:forbidden
+	IntPtrField *int `json:"intPtrField"`
+
+	// +k8s:forbidden
+	IntTypedefField IntType `json:"intTypedefField"`
+
+	// +k8s:forbidden
+	IntTypedefPtrField *IntType `json:"intTypedefPtrField"`
+
+	// +k8s:forbidden
+	BoolField bool `json:"boolField"`
+
+	// +k8s:forbidden
+	FloatField float64 `json:"floatField"`
+
+	// +k8s:forbidden
+	ByteField byte `json:"byteField"`
+
+	// +k8s:forbidden
+	OtherStructPtrField *OtherStruct `json:"otherStructPtrField"`
+
+	// +k8s:forbidden
+	SliceField []string `json:"sliceField"`
+
+	// +k8s:forbidden
+	SliceTypedefField SliceType `json:"sliceTypedefField"`
+
+	// +k8s:forbidden
+	ByteArrayField []byte `json:"byteArrayField"`
+
+	// +k8s:forbidden
+	MapField map[string]string `json:"mapField"`
+
+	// +k8s:forbidden
+	MapTypedefField MapType `json:"mapTypedefField"`
+}
+
+type StringType string
+
+type IntType int
+
+type OtherStruct struct{}
+
+type SliceType []string
+
+type MapType map[string]string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/forbidden/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/forbidden/doc_test.go
new file mode 100644
index 0000000000..dba35b5865
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/forbidden/doc_test.go
@@ -0,0 +1,91 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package forbidden
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero-values (nil slices/maps).
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		// Explicit zero-values and empty slices/maps.
+		StringField:           "",
+		StringPtrField:        nil,
+		StringTypedefField:    "",
+		StringTypedefPtrField: nil,
+		IntField:              0,
+		IntPtrField:           nil,
+		IntTypedefField:       0,
+		IntTypedefPtrField:    nil,
+		BoolField:             false,
+		FloatField:            0.0,
+		ByteField:             0,
+		OtherStructPtrField:   nil,
+		SliceField:            []string{},
+		SliceTypedefField:     SliceType{},
+		ByteArrayField:        []byte{},
+		MapField:              map[string]string{},
+		MapTypedefField:       MapType{},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		StringField:           "abc",
+		StringPtrField:        ptr.To("xyz"),
+		StringTypedefField:    StringType("abc"),
+		StringTypedefPtrField: ptr.To(StringType("xyz")),
+		IntField:              123,
+		IntPtrField:           ptr.To(456),
+		IntTypedefField:       IntType(123),
+		IntTypedefPtrField:    ptr.To(IntType(456)),
+		BoolField:             true,
+		FloatField:            1.23,
+		ByteField:             'a',
+		OtherStructPtrField:   &OtherStruct{},
+		SliceField:            []string{"a", "b"},
+		SliceTypedefField:     SliceType([]string{"a", "b"}),
+		ByteArrayField:        []byte("abc"),
+		MapField:              map[string]string{"a": "b", "c": "d"},
+		MapTypedefField:       MapType(map[string]string{"a": "b", "c": "d"}),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Forbidden(field.NewPath("stringField"), ""),
+		field.Forbidden(field.NewPath("stringPtrField"), ""),
+		field.Forbidden(field.NewPath("stringTypedefField"), ""),
+		field.Forbidden(field.NewPath("stringTypedefPtrField"), ""),
+		field.Forbidden(field.NewPath("intField"), ""),
+		field.Forbidden(field.NewPath("intPtrField"), ""),
+		field.Forbidden(field.NewPath("intTypedefField"), ""),
+		field.Forbidden(field.NewPath("intTypedefPtrField"), ""),
+		field.Forbidden(field.NewPath("boolField"), ""),
+		field.Forbidden(field.NewPath("floatField"), ""),
+		field.Forbidden(field.NewPath("byteField"), ""),
+		field.Forbidden(field.NewPath("otherStructPtrField"), ""),
+		field.Forbidden(field.NewPath("sliceField"), ""),
+		field.Forbidden(field.NewPath("sliceTypedefField"), ""),
+		field.Forbidden(field.NewPath("byteArrayField"), ""),
+		field.Forbidden(field.NewPath("mapField"), ""),
+		field.Forbidden(field.NewPath("mapTypedefField"), ""),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/forbidden/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/forbidden/zz_generated.validations.go
new file mode 100644
index 0000000000..c17760fb4d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/forbidden/zz_generated.validations.go
@@ -0,0 +1,612 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package forbidden
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.StringPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("stringPtrField"), obj.StringPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *StringType {
+				return &oldObj.StringTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("stringTypedefField"), &obj.StringTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *StringType {
+				return oldObj.StringTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("stringTypedefPtrField"), obj.StringTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return &oldObj.IntField
+			})
+		errs = append(errs, fn(fldPath.Child("intField"), &obj.IntField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return oldObj.IntPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("intPtrField"), obj.IntPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *IntType {
+				return &oldObj.IntTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("intTypedefField"), &obj.IntTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *IntType {
+				return oldObj.IntTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("intTypedefPtrField"), obj.IntTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.BoolField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *bool {
+				return &oldObj.BoolField
+			})
+		errs = append(errs, fn(fldPath.Child("boolField"), &obj.BoolField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.FloatField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *float64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *float64 {
+				return &oldObj.FloatField
+			})
+		errs = append(errs, fn(fldPath.Child("floatField"), &obj.FloatField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ByteField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *byte,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *byte {
+				return &oldObj.ByteField
+			})
+		errs = append(errs, fn(fldPath.Child("byteField"), &obj.ByteField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.OtherStructPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *OtherStruct {
+				return oldObj.OtherStructPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("otherStructPtrField"), obj.OtherStructPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.SliceField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceField"), obj.SliceField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj SliceType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) SliceType {
+				return oldObj.SliceTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceTypedefField"), obj.SliceTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ByteArrayField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []byte,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []byte {
+				return oldObj.ByteArrayField
+			})
+		errs = append(errs, fn(fldPath.Child("byteArrayField"), obj.ByteArrayField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj MapType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) MapType {
+				return oldObj.MapTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapTypedefField"), obj.MapTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-extended-resource-name/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-extended-resource-name/doc.go
new file mode 100644
index 0000000000..feb9464f90
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-extended-resource-name/doc.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package k8sextendedresourcename
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// MyType is a struct that contains a field with the extended-resource-name format.
+// +k8s:validation:Required
+type MyType struct {
+	TypeMeta int
+	// +k8s:optional
+	// +k8s:format=k8s-extended-resource-name
+	NameField string `json:"nameField"`
+	// +k8s:optional
+	// +k8s:format=k8s-extended-resource-name
+	NamePtrField *string `json:"namePtrField"`
+	// Note: no validation here
+	NameTypedefField NameStringType `json:"nameTypedefField"`
+}
+
+// +k8s:format=k8s-extended-resource-name
+type NameStringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-extended-resource-name/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-extended-resource-name/doc_test.go
new file mode 100644
index 0000000000..5fc2b07b3d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-extended-resource-name/doc_test.go
@@ -0,0 +1,68 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package k8sextendedresourcename
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestK8sExtendedResourceName(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&MyType{
+		NameField:        "example.com/my-resource",
+		NamePtrField:     ptr.To("my-domain.org/foo"),
+		NameTypedefField: "example.com/another-resource",
+	}).ExpectValid()
+
+	st.Value(&MyType{
+		NameField:        "example.com/my_resource",
+		NamePtrField:     ptr.To("example.com/My-Resource"),
+		NameTypedefField: "example.com/my.resource",
+	}).ExpectValid()
+
+	invalidStruct := &MyType{
+		NameField:        "kubernetes.io/my-resource",
+		NamePtrField:     ptr.To("requests.example.com/my-resource"),
+		NameTypedefField: "my-resource",
+	}
+	st.Value(invalidStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("nameField"), invalidStruct.NameField, "a qualified name must not be a reserved name").WithOrigin("format=k8s-extended-resource-name"),
+		field.Invalid(field.NewPath("namePtrField"), *invalidStruct.NamePtrField, "a qualified name must not have a reserved prefix").WithOrigin("format=k8s-extended-resource-name"),
+		field.Invalid(field.NewPath("nameTypedefField"), invalidStruct.NameTypedefField, "a qualified name must be a valid domain prefix and a name separated by a slash").WithOrigin("format=k8s-extended-resource-name"),
+	})
+	// Test validation ratcheting
+	st.Value(invalidStruct).OldValue(invalidStruct).ExpectValid()
+
+	const commonDetail = "a valid extended resource name must consist of a domain name prefix and a path segment separated by a slash, where the path segment consists of alphanumeric characters, '-', and must start and end with an alphanumeric character, and the domain name prefix is a valid DNS subdomain name, with the exception that 'requests' is a valid domain name prefix"
+	invalidStruct = &MyType{
+		NameField:        "example.com/my-resource-",
+		NamePtrField:     ptr.To("example.com/-my-resource"),
+		NameTypedefField: "example.com/",
+	}
+	st.Value(invalidStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("nameField"), invalidStruct.NameField, commonDetail).WithOrigin("format=k8s-extended-resource-name"),
+		field.Invalid(field.NewPath("namePtrField"), *invalidStruct.NamePtrField, commonDetail).WithOrigin("format=k8s-extended-resource-name"),
+		field.Invalid(field.NewPath("nameTypedefField"), invalidStruct.NameTypedefField, commonDetail).WithOrigin("format=k8s-extended-resource-name"),
+	})
+
+	// Test validation ratcheting
+	st.Value(invalidStruct).OldValue(invalidStruct).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-extended-resource-name/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-extended-resource-name/zz_generated.validations.go
new file mode 100644
index 0000000000..24f4676422
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-extended-resource-name/zz_generated.validations.go
@@ -0,0 +1,164 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package k8sextendedresourcename
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type MyType
+	scheme.AddValidationFunc(
+		(*MyType)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_MyType(
+					ctx, op, nil, /* fldPath */
+					obj.(*MyType),
+					safe.Cast[*MyType](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_MyType validates an instance of MyType according
+// to declarative validation rules in the API schema.
+func Validate_MyType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MyType) (errs field.ErrorList) {
+
+	// field MyType.TypeMeta has no validation
+
+	{ // field MyType.NameField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ExtendedResourceName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MyType) *string {
+				return &oldObj.NameField
+			})
+		errs = append(errs, fn(fldPath.Child("nameField"), &obj.NameField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MyType.NamePtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ExtendedResourceName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MyType) *string {
+				return oldObj.NamePtrField
+			})
+		errs = append(errs, fn(fldPath.Child("namePtrField"), obj.NamePtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MyType.NameTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *NameStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_NameStringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MyType) *NameStringType {
+				return &oldObj.NameTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("nameTypedefField"), &obj.NameTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_NameStringType validates an instance of NameStringType according
+// to declarative validation rules in the API schema.
+func Validate_NameStringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *NameStringType) (errs field.ErrorList) {
+
+	if e := validate.ExtendedResourceName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-key/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-key/doc.go
new file mode 100644
index 0000000000..ab98664e30
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-key/doc.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// Package format is the internal version of the API.
+// +k8s:validation:internal
+// +k8s:validation-gen-nolint
+package format
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:format=k8s-label-key
+	LabelKeyField string `json:"labelKeyField"`
+
+	// +k8s:format=k8s-label-key
+	LabelKeyPtrField *string `json:"labelKeyPtrField"`
+
+	// Note: no validation here
+	LabelKeyTypedefField LabelKeyStringType `json:"labelKeyTypedefField"`
+}
+
+// +k8s:format=k8s-label-key
+type LabelKeyStringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-key/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-key/doc_test.go
new file mode 100644
index 0000000000..a5e2012c3d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-key/doc_test.go
@@ -0,0 +1,81 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package format
+
+import (
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	validCases := []string{
+		"simple",
+		"now-with-dashes",
+		"1-starts-with-num",
+		"1234",
+		"simple.com/simple",
+		"now-with-dashes.com/simple",
+		"now.with.dots.com/simple",
+		"now-with.dashes-and.dots.com/simple",
+		"1-num.2-num.com/3-num",
+		"1234.com/5678",
+		"1.2.3.4/5678",
+		"Uppercase_Is_OK_123",
+		"example.com/Uppercase_Is_OK_123",
+		"requests.storage-foo",
+		strings.Repeat("a", 63),
+		strings.Repeat("a", 253) + "/" + strings.Repeat("b", 63),
+	}
+
+	for _, s := range validCases {
+		st.Value(&Struct{
+			LabelKeyField:        s,
+			LabelKeyPtrField:     ptr.To(s),
+			LabelKeyTypedefField: LabelKeyStringType(s),
+		}).ExpectValid()
+	}
+
+	invalidCases := []string{
+		"nospecialchars%^=@",
+		"cantendwithadash-",
+		"-cantstartwithadash-",
+		"only/one/slash",
+		"Example.com/abc",
+		"example_com/abc",
+		"example.com/",
+		"/simple",
+		strings.Repeat("a", 64),
+		strings.Repeat("a", 254) + "/abc",
+	}
+
+	for _, s := range invalidCases {
+		st.Value(&Struct{
+			LabelKeyField:        s,
+			LabelKeyPtrField:     ptr.To(s),
+			LabelKeyTypedefField: LabelKeyStringType(s),
+		}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+			field.Invalid(field.NewPath("labelKeyField"), nil, "").WithOrigin("format=k8s-label-key"),
+			field.Invalid(field.NewPath("labelKeyPtrField"), nil, "").WithOrigin("format=k8s-label-key"),
+			field.Invalid(field.NewPath("labelKeyTypedefField"), nil, "").WithOrigin("format=k8s-label-key"),
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-key/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-key/zz_generated.validations.go
new file mode 100644
index 0000000000..5f117fd460
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-key/zz_generated.validations.go
@@ -0,0 +1,150 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package format
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_LabelKeyStringType validates an instance of LabelKeyStringType according
+// to declarative validation rules in the API schema.
+func Validate_LabelKeyStringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *LabelKeyStringType) (errs field.ErrorList) {
+
+	if e := validate.LabelKey(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.LabelKeyField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.LabelKey(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.LabelKeyField
+			})
+		errs = append(errs, fn(fldPath.Child("labelKeyField"), &obj.LabelKeyField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.LabelKeyPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.LabelKey(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.LabelKeyPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("labelKeyPtrField"), obj.LabelKeyPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.LabelKeyTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *LabelKeyStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_LabelKeyStringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *LabelKeyStringType {
+				return &oldObj.LabelKeyTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("labelKeyTypedefField"), &obj.LabelKeyTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-value/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-value/doc.go
new file mode 100644
index 0000000000..23644363c1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-value/doc.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package format
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:format=k8s-label-value
+	LabelValueField string `json:"labelValueField"`
+
+	// +k8s:format=k8s-label-value
+	LabelValuePtrField *string `json:"labelValuePtrField"`
+
+	// Note: no validation here
+	LabelValueTypedefField LabelValueStringType `json:"labelValueTypedefField"`
+}
+
+// +k8s:format=k8s-label-value
+type LabelValueStringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-value/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-value/doc_test.go
new file mode 100644
index 0000000000..ec92bc7f84
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-value/doc_test.go
@@ -0,0 +1,85 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package format
+
+import (
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	validCases := []struct {
+		name  string
+		value string
+	}{
+		{"valid value", "valid-value"},
+		{"valid value with dots", "valid.value"},
+		{"valid value with underscores", "valid_value"},
+		{"valid single character value", "a"},
+		{"valid value with numbers", "123-abc"},
+		{"valid uppercase characters", "Valid-Value"},
+		{"valid: max length", "a" + strings.Repeat("b", 61) + "c"}, // 63 characters
+		{"valid: empty string", ""},
+	}
+
+	for _, tc := range validCases {
+		t.Run(tc.name, func(t *testing.T) {
+			st.Value(&Struct{
+				LabelValueField:        tc.value,
+				LabelValuePtrField:     ptr.To(tc.value),
+				LabelValueTypedefField: LabelValueStringType(tc.value),
+			}).ExpectValid()
+		})
+	}
+
+	invalidCases := []struct {
+		name  string
+		value string
+	}{
+		{"invalid: starts with dash", "-invalid-value"},
+		{"invalid: ends with dash", "invalid-value-"},
+		{"invalid: starts with dot", ".invalid.value"},
+		{"invalid: ends with dot", "invalid.value."},
+		{"invalid: starts with underscore", "_invalid_value"},
+		{"invalid: ends with underscore", "invalid_value_"},
+		{"invalid: contains special characters", "invalid@value"},
+		{"invalid: contains spaces", "Not a LabelValue"},
+		{"invalid: too long", "a" + strings.Repeat("b", 62) + "c"}, // 64 characters
+	}
+
+	for _, tc := range invalidCases {
+		t.Run(tc.name, func(t *testing.T) {
+			invalidStruct := &Struct{
+				LabelValueField:        tc.value,
+				LabelValuePtrField:     ptr.To(tc.value),
+				LabelValueTypedefField: LabelValueStringType(tc.value),
+			}
+			st.Value(invalidStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+				field.Invalid(field.NewPath("labelValueField"), nil, "").WithOrigin("format=k8s-label-value"),
+				field.Invalid(field.NewPath("labelValuePtrField"), nil, "").WithOrigin("format=k8s-label-value"),
+				field.Invalid(field.NewPath("labelValueTypedefField"), nil, "").WithOrigin("format=k8s-label-value"),
+			})
+			// Test validation ratcheting
+			st.Value(invalidStruct).OldValue(invalidStruct).ExpectValid()
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-value/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-value/zz_generated.validations.go
new file mode 100644
index 0000000000..d877b74f22
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-label-value/zz_generated.validations.go
@@ -0,0 +1,150 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package format
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_LabelValueStringType validates an instance of LabelValueStringType according
+// to declarative validation rules in the API schema.
+func Validate_LabelValueStringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *LabelValueStringType) (errs field.ErrorList) {
+
+	if e := validate.LabelValue(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.LabelValueField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.LabelValue(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.LabelValueField
+			})
+		errs = append(errs, fn(fldPath.Child("labelValueField"), &obj.LabelValueField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.LabelValuePtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.LabelValue(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.LabelValuePtrField
+			})
+		errs = append(errs, fn(fldPath.Child("labelValuePtrField"), obj.LabelValuePtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.LabelValueTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *LabelValueStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_LabelValueStringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *LabelValueStringType {
+				return &oldObj.LabelValueTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("labelValueTypedefField"), &obj.LabelValueTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name-caseless/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name-caseless/doc.go
new file mode 100644
index 0000000000..8100a756d9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name-caseless/doc.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package format
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:format=k8s-long-name-caseless
+	LongNameField string `json:"longNameField"`
+
+	// +k8s:format=k8s-long-name-caseless
+	LongNamePtrField *string `json:"longNamePtrField"`
+
+	// Note: no validation here
+	LongNameTypedefField LongNameStringType `json:"longNameTypedefField"`
+}
+
+// +k8s:format=k8s-long-name-caseless
+type LongNameStringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name-caseless/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name-caseless/doc_test.go
new file mode 100644
index 0000000000..eafa6eaa81
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name-caseless/doc_test.go
@@ -0,0 +1,72 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package format
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestCaseless(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		LongNameField:        "foo.bar",
+		LongNamePtrField:     ptr.To("foo.bar"),
+		LongNameTypedefField: "foo.bar",
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		LongNameField:        "1.2.3.4",
+		LongNamePtrField:     ptr.To("1.2.3.4"),
+		LongNameTypedefField: "1.2.3.4",
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		LongNameField:        "Foo.Bar",
+		LongNamePtrField:     ptr.To("Foo.Bar"),
+		LongNameTypedefField: "Foo.Bar",
+	}).ExpectValid()
+
+	invalidStruct := &Struct{
+		LongNameField:        "",
+		LongNamePtrField:     ptr.To(""),
+		LongNameTypedefField: "",
+	}
+	st.Value(invalidStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("longNameField"), nil, "").WithOrigin("format=k8s-long-name-caseless"),
+		field.Invalid(field.NewPath("longNamePtrField"), nil, "").WithOrigin("format=k8s-long-name-caseless"),
+		field.Invalid(field.NewPath("longNameTypedefField"), nil, "").WithOrigin("format=k8s-long-name-caseless"),
+	})
+	// Test validation ratcheting
+	st.Value(invalidStruct).OldValue(invalidStruct).ExpectValid()
+
+	invalidStruct = &Struct{
+		LongNameField:        "Not a LongName",
+		LongNamePtrField:     ptr.To("Not a LongName"),
+		LongNameTypedefField: "Not a LongName",
+	}
+	st.Value(invalidStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("longNameField"), nil, "").WithOrigin("format=k8s-long-name-caseless"),
+		field.Invalid(field.NewPath("longNamePtrField"), nil, "").WithOrigin("format=k8s-long-name-caseless"),
+		field.Invalid(field.NewPath("longNameTypedefField"), nil, "").WithOrigin("format=k8s-long-name-caseless"),
+	})
+	// Test validation ratcheting
+	st.Value(invalidStruct).OldValue(invalidStruct).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name-caseless/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name-caseless/zz_generated.validations.go
new file mode 100644
index 0000000000..07cbe34e2d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name-caseless/zz_generated.validations.go
@@ -0,0 +1,150 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package format
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_LongNameStringType validates an instance of LongNameStringType according
+// to declarative validation rules in the API schema.
+func Validate_LongNameStringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *LongNameStringType) (errs field.ErrorList) {
+
+	if e := validate.LongNameCaseless(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.LongNameField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.LongNameCaseless(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.LongNameField
+			})
+		errs = append(errs, fn(fldPath.Child("longNameField"), &obj.LongNameField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.LongNamePtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.LongNameCaseless(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.LongNamePtrField
+			})
+		errs = append(errs, fn(fldPath.Child("longNamePtrField"), obj.LongNamePtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.LongNameTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *LongNameStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_LongNameStringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *LongNameStringType {
+				return &oldObj.LongNameTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("longNameTypedefField"), &obj.LongNameTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name/k8s-long-name/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name/k8s-long-name/doc.go
new file mode 100644
index 0000000000..0c8fe2f74f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name/k8s-long-name/doc.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package format
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:format=k8s-long-name
+	LongNameField string `json:"longNameField"`
+
+	// +k8s:format=k8s-long-name
+	LongNamePtrField *string `json:"longNamePtrField"`
+
+	// Note: no validation here
+	LongNameTypedefField LongNameStringType `json:"longNameTypedefField"`
+}
+
+// +k8s:format=k8s-long-name
+type LongNameStringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name/k8s-long-name/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name/k8s-long-name/doc_test.go
new file mode 100644
index 0000000000..b0edb4da8d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name/k8s-long-name/doc_test.go
@@ -0,0 +1,66 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package format
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		LongNameField:        "foo.bar",
+		LongNamePtrField:     ptr.To("foo.bar"),
+		LongNameTypedefField: "foo.bar",
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		LongNameField:        "1.2.3.4",
+		LongNamePtrField:     ptr.To("1.2.3.4"),
+		LongNameTypedefField: "1.2.3.4",
+	}).ExpectValid()
+
+	invalidStruct := &Struct{
+		LongNameField:        "",
+		LongNamePtrField:     ptr.To(""),
+		LongNameTypedefField: "",
+	}
+	st.Value(invalidStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("longNameField"), nil, "").WithOrigin("format=k8s-long-name"),
+		field.Invalid(field.NewPath("longNamePtrField"), nil, "").WithOrigin("format=k8s-long-name"),
+		field.Invalid(field.NewPath("longNameTypedefField"), nil, "").WithOrigin("format=k8s-long-name"),
+	})
+	// Test validation ratcheting
+	st.Value(invalidStruct).OldValue(invalidStruct).ExpectValid()
+
+	invalidStruct = &Struct{
+		LongNameField:        "Not a LongName",
+		LongNamePtrField:     ptr.To("Not a LongName"),
+		LongNameTypedefField: "Not a LongName",
+	}
+	st.Value(invalidStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("longNameField"), nil, "").WithOrigin("format=k8s-long-name"),
+		field.Invalid(field.NewPath("longNamePtrField"), nil, "").WithOrigin("format=k8s-long-name"),
+		field.Invalid(field.NewPath("longNameTypedefField"), nil, "").WithOrigin("format=k8s-long-name"),
+	})
+	// Test validation ratcheting
+	st.Value(invalidStruct).OldValue(invalidStruct).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name/k8s-long-name/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name/k8s-long-name/zz_generated.validations.go
new file mode 100644
index 0000000000..d7171e86a8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-long-name/k8s-long-name/zz_generated.validations.go
@@ -0,0 +1,150 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package format
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_LongNameStringType validates an instance of LongNameStringType according
+// to declarative validation rules in the API schema.
+func Validate_LongNameStringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *LongNameStringType) (errs field.ErrorList) {
+
+	if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.LongNameField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.LongNameField
+			})
+		errs = append(errs, fn(fldPath.Child("longNameField"), &obj.LongNameField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.LongNamePtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.LongNamePtrField
+			})
+		errs = append(errs, fn(fldPath.Child("longNamePtrField"), obj.LongNamePtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.LongNameTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *LongNameStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_LongNameStringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *LongNameStringType {
+				return &oldObj.LongNameTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("longNameTypedefField"), &obj.LongNameTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-prefixed-label-key/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-prefixed-label-key/doc.go
new file mode 100644
index 0000000000..3b4e2609f8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-prefixed-label-key/doc.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// Package format is the internal version of the API.
+// +k8s:validation:internal
+// +k8s:validation-gen-nolint
+package format
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:format=k8s-prefixed-label-key
+	PrefixedLabelKeyField string `json:"prefixedLabelKeyField"`
+
+	// +k8s:format=k8s-prefixed-label-key
+	PrefixedLabelKeyPtrField *string `json:"prefixedLabelKeyPtrField"`
+
+	// Note: no validation here
+	PrefixedLabelKeyTypedefField PrefixedLabelKeyStringType `json:"prefixedLabelKeyTypedefField"`
+}
+
+// +k8s:format=k8s-prefixed-label-key
+type PrefixedLabelKeyStringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-prefixed-label-key/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-prefixed-label-key/doc_test.go
new file mode 100644
index 0000000000..85d9322f6b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-prefixed-label-key/doc_test.go
@@ -0,0 +1,80 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package format
+
+import (
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	validCases := []string{
+		"simple.com/simple",
+		"now-with-dashes.com/simple",
+		"now.with.dots.com/simple",
+		"now-with.dashes-and.dots.com/simple",
+		"1-num.2-num.com/3-num",
+		"1234.com/5678",
+		"1.2.3.4/5678",
+		"example.com/Uppercase_Is_OK_123",
+		strings.Repeat("a", 253) + "/" + strings.Repeat("b", 63),
+	}
+
+	for _, s := range validCases {
+		st.Value(&Struct{
+			PrefixedLabelKeyField:        s,
+			PrefixedLabelKeyPtrField:     new(s),
+			PrefixedLabelKeyTypedefField: PrefixedLabelKeyStringType(s),
+		}).ExpectValid()
+	}
+
+	invalidCases := []string{
+		"simple",
+		"now-with-dashes",
+		"1-starts-with-num",
+		"1234",
+		"Uppercase_Is_OK_123",
+		"requests.storage-foo",
+		strings.Repeat("a", 63),
+		"nospecialchars%^=@",
+		"cantendwithadash-",
+		"-cantstartwithadash-",
+		"only/one/slash",
+		"Example.com/abc",
+		"example_com/abc",
+		"example.com/",
+		"/simple",
+		strings.Repeat("a", 64),
+		strings.Repeat("a", 254) + "/abc",
+	}
+
+	for _, s := range invalidCases {
+		st.Value(&Struct{
+			PrefixedLabelKeyField:        s,
+			PrefixedLabelKeyPtrField:     new(s),
+			PrefixedLabelKeyTypedefField: PrefixedLabelKeyStringType(s),
+		}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+			field.Invalid(field.NewPath("prefixedLabelKeyField"), nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+			field.Invalid(field.NewPath("prefixedLabelKeyPtrField"), nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+			field.Invalid(field.NewPath("prefixedLabelKeyTypedefField"), nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-prefixed-label-key/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-prefixed-label-key/zz_generated.validations.go
new file mode 100644
index 0000000000..77b7255fa4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-prefixed-label-key/zz_generated.validations.go
@@ -0,0 +1,150 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package format
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_PrefixedLabelKeyStringType validates an instance of PrefixedLabelKeyStringType according
+// to declarative validation rules in the API schema.
+func Validate_PrefixedLabelKeyStringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *PrefixedLabelKeyStringType) (errs field.ErrorList) {
+
+	if e := validate.PrefixedLabelKey(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.PrefixedLabelKeyField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.PrefixedLabelKey(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.PrefixedLabelKeyField
+			})
+		errs = append(errs, fn(fldPath.Child("prefixedLabelKeyField"), &obj.PrefixedLabelKeyField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.PrefixedLabelKeyPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.PrefixedLabelKey(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.PrefixedLabelKeyPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("prefixedLabelKeyPtrField"), obj.PrefixedLabelKeyPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.PrefixedLabelKeyTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *PrefixedLabelKeyStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_PrefixedLabelKeyStringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *PrefixedLabelKeyStringType {
+				return &oldObj.PrefixedLabelKeyTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("prefixedLabelKeyTypedefField"), &obj.PrefixedLabelKeyTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-fully-qualified-name/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-fully-qualified-name/doc.go
new file mode 100644
index 0000000000..4297d4a018
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-fully-qualified-name/doc.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package fullyqualifiedname
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:format=k8s-resource-fully-qualified-name
+	FullyQualifiedNameField string `json:"fullyQualifiedNameField"`
+
+	// +k8s:format=k8s-resource-fully-qualified-name
+	FullyQualifiedNamePtrField *string `json:"fullyQualifiedNamePtrField"`
+
+	// Note: no validation here
+	FullyQualifiedNameTypedefField FullyQualifiedNameStringType `json:"fullyQualifiedNameTypedefField"`
+}
+
+// +k8s:format=k8s-resource-fully-qualified-name
+type FullyQualifiedNameStringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-fully-qualified-name/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-fully-qualified-name/doc_test.go
new file mode 100644
index 0000000000..6d4768b74f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-fully-qualified-name/doc_test.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fullyqualifiedname
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestFullyQualifiedName(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		FullyQualifiedNameField:        "my-prefix/my_name",
+		FullyQualifiedNamePtrField:     ptr.To("my-prefix/my_name"),
+		FullyQualifiedNameTypedefField: "my-prefix/my_name",
+	}).ExpectValid()
+
+	invalidStruct := &Struct{
+		FullyQualifiedNameField:        "my_name",
+		FullyQualifiedNamePtrField:     ptr.To(""),
+		FullyQualifiedNameTypedefField: "my-prefix/",
+	}
+	st.Value(invalidStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByOrigin().ByField(), field.ErrorList{
+		field.Invalid(field.NewPath("fullyQualifiedNameField"), "my_name", "a fully qualified name must be a domain and a name separated by a slash").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		field.Invalid(field.NewPath("fullyQualifiedNamePtrField"), "", "a valid C identifier must start with alphabetic character or '_', followed by a string of alphanumeric characters or '_'").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		field.Invalid(field.NewPath("fullyQualifiedNameTypedefField"), "my-prefix/", "name must not be empty").WithOrigin("format=k8s-resource-fully-qualified-name"),
+	})
+	// Test validation ratcheting
+	st.Value(invalidStruct).OldValue(invalidStruct).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-fully-qualified-name/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-fully-qualified-name/zz_generated.validations.go
new file mode 100644
index 0000000000..3ac7fe8dde
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-fully-qualified-name/zz_generated.validations.go
@@ -0,0 +1,150 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package fullyqualifiedname
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_FullyQualifiedNameStringType validates an instance of FullyQualifiedNameStringType according
+// to declarative validation rules in the API schema.
+func Validate_FullyQualifiedNameStringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *FullyQualifiedNameStringType) (errs field.ErrorList) {
+
+	if e := validate.ResourceFullyQualifiedName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.FullyQualifiedNameField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.ResourceFullyQualifiedName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.FullyQualifiedNameField
+			})
+		errs = append(errs, fn(fldPath.Child("fullyQualifiedNameField"), &obj.FullyQualifiedNameField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.FullyQualifiedNamePtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.ResourceFullyQualifiedName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.FullyQualifiedNamePtrField
+			})
+		errs = append(errs, fn(fldPath.Child("fullyQualifiedNamePtrField"), obj.FullyQualifiedNamePtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.FullyQualifiedNameTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *FullyQualifiedNameStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_FullyQualifiedNameStringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *FullyQualifiedNameStringType {
+				return &oldObj.FullyQualifiedNameTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("fullyQualifiedNameTypedefField"), &obj.FullyQualifiedNameTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-pool-name/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-pool-name/doc.go
new file mode 100644
index 0000000000..0513cda543
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-pool-name/doc.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package format
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:format=k8s-resource-pool-name
+	ResourcePoolNameField string `json:"resourcePoolNameField"`
+
+	// +k8s:format=k8s-resource-pool-name
+	ResourcePoolNamePtrField *string `json:"resourcePoolNamePtrField"`
+
+	// Note: no validation here
+	ResourcePoolNameTypedefField ResourcePoolNameStringType `json:"resourcePoolNameTypedefField"`
+}
+
+// +k8s:format=k8s-resource-pool-name
+type ResourcePoolNameStringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-pool-name/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-pool-name/doc_test.go
new file mode 100644
index 0000000000..eeab15e530
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-pool-name/doc_test.go
@@ -0,0 +1,80 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +output_tests
+package format
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		ResourcePoolNameField:        "foo.bar",
+		ResourcePoolNamePtrField:     ptr.To("foo.bar"),
+		ResourcePoolNameTypedefField: "foo.bar",
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		ResourcePoolNameField:        "1.2.3.4",
+		ResourcePoolNamePtrField:     ptr.To("1.2.3.4"),
+		ResourcePoolNameTypedefField: "1.2.3.4",
+	}).ExpectValid()
+
+	invalidStruct := &Struct{
+		ResourcePoolNameField:        "",
+		ResourcePoolNamePtrField:     ptr.To(""),
+		ResourcePoolNameTypedefField: "",
+	}
+	st.Value(invalidStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("resourcePoolNameField"), nil, "").WithOrigin("format=k8s-resource-pool-name"),
+		field.Invalid(field.NewPath("resourcePoolNamePtrField"), nil, "").WithOrigin("format=k8s-resource-pool-name"),
+		field.Invalid(field.NewPath("resourcePoolNameTypedefField"), nil, "").WithOrigin("format=k8s-resource-pool-name"),
+	})
+	// Test validation ratcheting
+	st.Value(invalidStruct).OldValue(invalidStruct).ExpectValid()
+
+	invalidStruct = &Struct{
+		ResourcePoolNameField:        "Not a ResourcePoolName",
+		ResourcePoolNamePtrField:     ptr.To("Not a ResourcePoolName"),
+		ResourcePoolNameTypedefField: "Not a ResourcePoolName",
+	}
+	st.Value(invalidStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("resourcePoolNameField"), nil, "").WithOrigin("format=k8s-resource-pool-name"),
+		field.Invalid(field.NewPath("resourcePoolNamePtrField"), nil, "").WithOrigin("format=k8s-resource-pool-name"),
+		field.Invalid(field.NewPath("resourcePoolNameTypedefField"), nil, "").WithOrigin("format=k8s-resource-pool-name"),
+	})
+	// Test validation ratcheting
+	st.Value(invalidStruct).OldValue(invalidStruct).ExpectValid()
+
+	invalidStruct = &Struct{
+		ResourcePoolNameField:        "a..b",
+		ResourcePoolNamePtrField:     ptr.To("a..b"),
+		ResourcePoolNameTypedefField: "a..b",
+	}
+	st.Value(invalidStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("resourcePoolNameField"), nil, "").WithOrigin("format=k8s-resource-pool-name"),
+		field.Invalid(field.NewPath("resourcePoolNamePtrField"), nil, "").WithOrigin("format=k8s-resource-pool-name"),
+		field.Invalid(field.NewPath("resourcePoolNameTypedefField"), nil, "").WithOrigin("format=k8s-resource-pool-name"),
+	})
+	// Test validation ratcheting
+	st.Value(invalidStruct).OldValue(invalidStruct).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-pool-name/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-pool-name/zz_generated.validations.go
new file mode 100644
index 0000000000..4e210e06ae
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-resource-pool-name/zz_generated.validations.go
@@ -0,0 +1,150 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package format
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_ResourcePoolNameStringType validates an instance of ResourcePoolNameStringType according
+// to declarative validation rules in the API schema.
+func Validate_ResourcePoolNameStringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ResourcePoolNameStringType) (errs field.ErrorList) {
+
+	if e := validate.ResourcePoolName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ResourcePoolNameField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.ResourcePoolName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.ResourcePoolNameField
+			})
+		errs = append(errs, fn(fldPath.Child("resourcePoolNameField"), &obj.ResourcePoolNameField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ResourcePoolNamePtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.ResourcePoolName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.ResourcePoolNamePtrField
+			})
+		errs = append(errs, fn(fldPath.Child("resourcePoolNamePtrField"), obj.ResourcePoolNamePtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ResourcePoolNameTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ResourcePoolNameStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ResourcePoolNameStringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *ResourcePoolNameStringType {
+				return &oldObj.ResourcePoolNameTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("resourcePoolNameTypedefField"), &obj.ResourcePoolNameTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-short-name/k8s-short-name/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-short-name/k8s-short-name/doc.go
new file mode 100644
index 0000000000..5ef598fff6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-short-name/k8s-short-name/doc.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package format
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:format=k8s-short-name
+	ShortNameField string `json:"shortNameField"`
+
+	// +k8s:format=k8s-short-name
+	ShortNamePtrField *string `json:"shortNamePtrField"`
+
+	// Note: no validation here
+	ShortNameTypedefField ShortNameStringType `json:"shortNameTypedefField"`
+}
+
+// +k8s:format=k8s-short-name
+type ShortNameStringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-short-name/k8s-short-name/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-short-name/k8s-short-name/doc_test.go
new file mode 100644
index 0000000000..bd37ba61f4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-short-name/k8s-short-name/doc_test.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package format
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		ShortNameField:        "foo-bar",
+		ShortNamePtrField:     ptr.To("foo-bar"),
+		ShortNameTypedefField: "foo-bar",
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		ShortNameField:        "1234",
+		ShortNamePtrField:     ptr.To("1234"),
+		ShortNameTypedefField: "1234",
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		ShortNameField:        "",
+		ShortNamePtrField:     ptr.To(""),
+		ShortNameTypedefField: "",
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("shortNameField"), nil, "").WithOrigin("format=k8s-short-name"),
+		field.Invalid(field.NewPath("shortNamePtrField"), nil, "").WithOrigin("format=k8s-short-name"),
+		field.Invalid(field.NewPath("shortNameTypedefField"), nil, "").WithOrigin("format=k8s-short-name"),
+	})
+
+	st.Value(&Struct{
+		ShortNameField:        "Not a DNS label",
+		ShortNamePtrField:     ptr.To("Not a DNS label"),
+		ShortNameTypedefField: "Not a DNS label",
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("shortNameField"), nil, "").WithOrigin("format=k8s-short-name"),
+		field.Invalid(field.NewPath("shortNamePtrField"), nil, "").WithOrigin("format=k8s-short-name"),
+		field.Invalid(field.NewPath("shortNameTypedefField"), nil, "").WithOrigin("format=k8s-short-name"),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-short-name/k8s-short-name/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-short-name/k8s-short-name/zz_generated.validations.go
new file mode 100644
index 0000000000..e6053ed46d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-short-name/k8s-short-name/zz_generated.validations.go
@@ -0,0 +1,150 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package format
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_ShortNameStringType validates an instance of ShortNameStringType according
+// to declarative validation rules in the API schema.
+func Validate_ShortNameStringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ShortNameStringType) (errs field.ErrorList) {
+
+	if e := validate.ShortName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ShortNameField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.ShortName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.ShortNameField
+			})
+		errs = append(errs, fn(fldPath.Child("shortNameField"), &obj.ShortNameField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ShortNamePtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.ShortName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.ShortNamePtrField
+			})
+		errs = append(errs, fn(fldPath.Child("shortNamePtrField"), obj.ShortNamePtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ShortNameTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ShortNameStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ShortNameStringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *ShortNameStringType {
+				return &oldObj.ShortNameTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("shortNameTypedefField"), &obj.ShortNameTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-uuid/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-uuid/doc.go
new file mode 100644
index 0000000000..f3eb4ff709
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-uuid/doc.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package k8suuid
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// MyType is a struct that contains a field with the uuid format.
+// +k8s:validation:Required
+type MyType struct {
+	TypeMeta int
+	// +k8s:optional
+	// +k8s:format=k8s-uuid
+	UUIDField string `json:"uuidField"`
+	// +k8s:optional
+	// +k8s:format=k8s-uuid
+	UUIDPtrField *string `json:"uuidPtrField"`
+	// Note: no validation here
+	UUIDTypedefField UUIDStringType `json:"uuidTypedefField"`
+}
+
+// +k8s:format=k8s-uuid
+type UUIDStringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-uuid/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-uuid/doc_test.go
new file mode 100644
index 0000000000..095439575c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-uuid/doc_test.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package k8suuid
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestK8sUUID(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&MyType{
+		UUIDField:        "123e4567-e89b-12d3-a456-426614174000",
+		UUIDPtrField:     ptr.To("123e4567-e89b-12d3-a456-426614174000"),
+		UUIDTypedefField: "123e4567-e89b-12d3-a456-426614174000",
+	}).ExpectValid()
+
+	invalidStruct := &MyType{
+		UUIDField:        "123E4567-E89B-12D3-A456-426614174000",
+		UUIDPtrField:     ptr.To("123E4567-E89B-12D3-A456-426614174000"),
+		UUIDTypedefField: "123E4567-E89B-12D3-A456-426614174000",
+	}
+	st.Value(invalidStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("uuidField"), nil, "").WithOrigin("format=k8s-uuid"),
+		field.Invalid(field.NewPath("uuidPtrField"), nil, "").WithOrigin("format=k8s-uuid"),
+		field.Invalid(field.NewPath("uuidTypedefField"), nil, "").WithOrigin("format=k8s-uuid"),
+	})
+	// Test validation ratcheting
+	st.Value(invalidStruct).OldValue(invalidStruct).ExpectValid()
+
+	invalidStruct = &MyType{
+		UUIDField:        "not-a-uuid",
+		UUIDPtrField:     ptr.To("not-a-uuid"),
+		UUIDTypedefField: "not-a-uuid",
+	}
+	st.Value(invalidStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("uuidField"), nil, "").WithOrigin("format=k8s-uuid"),
+		field.Invalid(field.NewPath("uuidPtrField"), nil, "").WithOrigin("format=k8s-uuid"),
+		field.Invalid(field.NewPath("uuidTypedefField"), nil, "").WithOrigin("format=k8s-uuid"),
+	})
+	// Test validation ratcheting
+	st.Value(invalidStruct).OldValue(invalidStruct).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-uuid/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-uuid/zz_generated.validations.go
new file mode 100644
index 0000000000..f0b45cba9c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/format/k8s-uuid/zz_generated.validations.go
@@ -0,0 +1,164 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package k8suuid
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type MyType
+	scheme.AddValidationFunc(
+		(*MyType)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_MyType(
+					ctx, op, nil, /* fldPath */
+					obj.(*MyType),
+					safe.Cast[*MyType](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_MyType validates an instance of MyType according
+// to declarative validation rules in the API schema.
+func Validate_MyType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MyType) (errs field.ErrorList) {
+
+	// field MyType.TypeMeta has no validation
+
+	{ // field MyType.UUIDField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.UUID(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MyType) *string {
+				return &oldObj.UUIDField
+			})
+		errs = append(errs, fn(fldPath.Child("uuidField"), &obj.UUIDField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MyType.UUIDPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.UUID(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MyType) *string {
+				return oldObj.UUIDPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("uuidPtrField"), obj.UUIDPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MyType.UUIDTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *UUIDStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_UUIDStringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MyType) *UUIDStringType {
+				return &oldObj.UUIDTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("uuidTypedefField"), &obj.UUIDTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_UUIDStringType validates an instance of UUIDStringType according
+// to declarative validation rules in the API schema.
+func Validate_UUIDStringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *UUIDStringType) (errs field.ErrorList) {
+
+	if e := validate.UUID(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/immutable/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/immutable/doc.go
new file mode 100644
index 0000000000..1f6a236f53
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/immutable/doc.go
@@ -0,0 +1,70 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package immutable
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:immutable
+	StringField string `json:"stringField"`
+
+	// +k8s:immutable
+	StringPtrField *string `json:"stringPtrField"`
+
+	// +k8s:immutable
+	StructField ComparableStruct `json:"structField"`
+
+	// +k8s:immutable
+	StructPtrField *ComparableStruct `json:"structPtrField"`
+
+	// +k8s:immutable
+	NonComparableStructField NonComparableStruct `json:"noncomparableStructField"`
+
+	// +k8s:immutable
+	NonComparableStructPtrField *NonComparableStruct `json:"noncomparableStructPtrField"`
+
+	// +k8s:immutable
+	SliceField []string `json:"sliceField"`
+
+	// +k8s:immutable
+	MapField map[string]string `json:"mapField"`
+
+	ImmutableField ImmutableType `json:"immutableField"`
+
+	ImmutablePtrField *ImmutableType `json:"immutablePtrField"`
+}
+
+type ComparableStruct struct {
+	StringField    string  `json:"stringField"`
+	StringPtrField *string `json:"stringPtrField"`
+}
+
+type NonComparableStruct struct {
+	SliceField []string `json:"sliceField"`
+}
+
+// +k8s:immutable
+type ImmutableType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/immutable/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/immutable/doc_test.go
new file mode 100644
index 0000000000..8134fe35d2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/immutable/doc_test.go
@@ -0,0 +1,79 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package immutable
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	structA := Struct{
+		StringField:                 "aaa",
+		StringPtrField:              ptr.To("aaa"),
+		StructField:                 ComparableStruct{"bbb", ptr.To("BBB")},
+		StructPtrField:              ptr.To(ComparableStruct{"bbb", ptr.To("BBB")}),
+		NonComparableStructField:    NonComparableStruct{[]string{"ccc"}},
+		NonComparableStructPtrField: ptr.To(NonComparableStruct{[]string{"ccc"}}),
+		SliceField:                  []string{"ddd"},
+		MapField:                    map[string]string{"eee": "eee"},
+		ImmutableField:              "fff",
+		ImmutablePtrField:           ptr.To(ImmutableType("fff")),
+	}
+
+	structA2 := structA // dup of A but with different pointer values
+	structA2.StringPtrField = ptr.To(*structA2.StringPtrField)
+	structA2.StructField.StringPtrField = ptr.To("BBB")
+	structA2.StructPtrField = ptr.To(*structA2.StructPtrField)
+	structA2.StructPtrField.StringPtrField = ptr.To("BBB")
+	structA2.NonComparableStructPtrField = ptr.To(*structA2.NonComparableStructPtrField)
+	structA2.ImmutablePtrField = ptr.To(*structA2.ImmutablePtrField)
+
+	structB := Struct{
+		StringField:                 "uuu",
+		StringPtrField:              ptr.To("uuu"),
+		StructField:                 ComparableStruct{"vvv", ptr.To("VVV")},
+		StructPtrField:              ptr.To(ComparableStruct{"vvv", ptr.To("VVV")}),
+		NonComparableStructField:    NonComparableStruct{[]string{"www"}},
+		NonComparableStructPtrField: ptr.To(NonComparableStruct{[]string{"www"}}),
+		SliceField:                  []string{"xxx"},
+		MapField:                    map[string]string{"yyy": "yyy"},
+		ImmutableField:              "zzz",
+		ImmutablePtrField:           ptr.To(ImmutableType("zzz")),
+	}
+
+	st.Value(&structA).OldValue(&structA).ExpectValid()
+	st.Value(&structA).OldValue(&structA2).ExpectValid()
+	st.Value(&structA2).OldValue(&structA).ExpectValid()
+
+	st.Value(&structA).OldValue(&structB).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().MatchShortCircuit(), field.ErrorList{
+		field.Invalid(field.NewPath("stringField"), nil, "").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("stringPtrField"), nil, "").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("structField"), nil, "").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("structPtrField"), nil, "").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("noncomparableStructField"), nil, "").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("noncomparableStructPtrField"), nil, "").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("sliceField"), nil, "").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("mapField"), nil, "").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("immutableField"), nil, "").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("immutablePtrField"), nil, "").WithOrigin("immutable"),
+	}.MarkShortCircuit())
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/immutable/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/immutable/zz_generated.validations.go
new file mode 100644
index 0000000000..a0c82a0e6d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/immutable/zz_generated.validations.go
@@ -0,0 +1,362 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package immutable
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_ImmutableType validates an instance of ImmutableType according
+// to declarative validation rules in the API schema.
+func Validate_ImmutableType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ImmutableType) (errs field.ErrorList) {
+
+	earlyReturn := false
+	if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+		errs = append(errs, e...)
+		earlyReturn = true
+	}
+	if earlyReturn {
+		return // do not proceed
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.StringPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("stringPtrField"), obj.StringPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *ComparableStruct {
+				return &oldObj.StructField
+			})
+		errs = append(errs, fn(fldPath.Child("structField"), &obj.StructField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StructPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *ComparableStruct {
+				return oldObj.StructPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("structPtrField"), obj.StructPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.NonComparableStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *NonComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *NonComparableStruct {
+				return &oldObj.NonComparableStructField
+			})
+		errs = append(errs, fn(fldPath.Child("noncomparableStructField"), &obj.NonComparableStructField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.NonComparableStructPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *NonComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *NonComparableStruct {
+				return oldObj.NonComparableStructPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("noncomparableStructPtrField"), obj.NonComparableStructPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.SliceField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceField"), obj.SliceField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ImmutableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ImmutableType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ImmutableType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *ImmutableType {
+				return &oldObj.ImmutableField
+			})
+		errs = append(errs, fn(fldPath.Child("immutableField"), &obj.ImmutableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ImmutablePtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ImmutableType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ImmutableType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *ImmutableType {
+				return oldObj.ImmutablePtrField
+			})
+		errs = append(errs, fn(fldPath.Child("immutablePtrField"), obj.ImmutablePtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/immutable_transitions/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/immutable_transitions/doc.go
new file mode 100644
index 0000000000..bbfad88616
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/immutable_transitions/doc.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package transitions
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int `json:"typeMeta"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key1
+	// +k8s:item(key1: a)=+k8s:immutable
+	// +k8s:item(key1: b)=+k8s:subfield(stringField)=+k8s:immutable
+	ListField []Item `json:"listField"`
+}
+
+type Item struct {
+	Key1        string `json:"key1"`
+	StringField string `json:"stringField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/immutable_transitions/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/immutable_transitions/doc_test.go
new file mode 100644
index 0000000000..f6b86edd8e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/immutable_transitions/doc_test.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package transitions
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	old := &Struct{
+		ListField: []Item{
+			{Key1: "a", StringField: "s1"},
+			{Key1: "b", StringField: "s2"},
+			{Key1: "c", StringField: "s3"},
+		},
+	}
+
+	new := &Struct{
+		ListField: []Item{
+			{Key1: "a", StringField: "changed"},
+			{Key1: "b", StringField: "changed"},
+			{Key1: "c", StringField: "changed"},
+		},
+	}
+
+	st.Value(new).OldValue(old).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("listField").Index(0), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listField").Index(1).Child("stringField"), nil, "immutable").WithOrigin("immutable"),
+	})
+
+	st.Value(new).OldValue(&Struct{ListField: []Item{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("listField").Index(0), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listField").Index(1).Child("stringField"), nil, "immutable").WithOrigin("immutable"),
+	})
+
+	// Test that "c" can change independently
+	st.Value(&Struct{
+		ListField: []Item{
+			{Key1: "a", StringField: "s1"},
+			{Key1: "b", StringField: "s2"},
+			{Key1: "c", StringField: "changed"},
+		},
+	}).OldValue(old).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/immutable_transitions/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/immutable_transitions/zz_generated.validations.go
new file mode 100644
index 0000000000..1c1fbd8e12
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/immutable_transitions/zz_generated.validations.go
@@ -0,0 +1,120 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package transitions
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ListField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Item,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Item, b *Item) bool { return a.Key1 == b.Key1 }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key1": "a"}"
+				earlyReturn := false
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *Item) bool { return item.Key1 == "a" }, validate.DirectEqual, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+					errs = append(errs, e...)
+					earlyReturn = true
+				}
+				if earlyReturn {
+					return // do not proceed
+				}
+			}()
+			func() { // cohort = "{"key1": "b"}"
+				earlyReturn := false
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *Item) bool { return item.Key1 == "b" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *Item) field.ErrorList {
+						return validate.Subfield(ctx, op, fldPath, obj, oldObj, "stringField",
+							func(o *Item) *string { return &o.StringField }, validate.DirectEqual, validate.Immutable)
+					}).MarkShortCircuit(); len(e) != 0 {
+					errs = append(errs, e...)
+					earlyReturn = true
+				}
+				if earlyReturn {
+					return // do not proceed
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []Item {
+				return oldObj.ListField
+			})
+		errs = append(errs, fn(fldPath.Child("listField"), obj.ListField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/doc.go
new file mode 100644
index 0000000000..57b2298405
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/doc.go
@@ -0,0 +1,78 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package multiplekeys
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int `json:"typeMeta"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=stringKey
+	// +k8s:listMapKey=intKey
+	// +k8s:listMapKey=boolKey
+	// +k8s:item(stringKey: "target", intKey: 42, boolKey: true)=+k8s:validateFalse="item Items[stringKey=target,intKey=42,boolKey=true] 1"
+	// +k8s:item(stringKey: "target", intKey: 42, boolKey: true)=+k8s:validateFalse="item Items[stringKey=target,intKey=42,boolKey=true] 2"
+	Items []Item `json:"items"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=stringKey
+	// +k8s:listMapKey=intKey
+	// +k8s:listMapKey=boolKey
+	// +k8s:item(boolKey: true, stringKey: "target", intKey: 42)=+k8s:validateFalse="item OutOfOrder[boolKey=42,stringKey=target,intKey=42]"
+	OutOfOrder []Item `json:"outOfOrder"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=stringKey
+	// +k8s:listMapKey=intKey
+	// +k8s:listMapKey=boolKey
+	// +k8s:item(stringKey: "target-ptr", intKey: 42, boolKey: true)=+k8s:validateFalse="item PtrItems[stringKey=target-ptr,intKey=42,boolKey=true]"
+	PtrItems []PtrItem `json:"ptrItems"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=stringPtrKey
+	// +k8s:listMapKey=stringKey
+	// +k8s:item(stringPtrKey: "target-ptr", stringKey: "target")=+k8s:validateFalse="item MixedPtrItems"
+	MixedPtrItems []MixedPtrItem `json:"mixedPtrItems"`
+}
+
+type Item struct {
+	StringKey string `json:"stringKey"`
+	IntKey    int    `json:"intKey"`
+	BoolKey   bool   `json:"boolKey"`
+	Data      string `json:"data"`
+}
+
+type PtrItem struct {
+	StringKey *string `json:"stringKey"`
+	IntKey    int     `json:"intKey"`
+	BoolKey   bool    `json:"boolKey"`
+	Data      string  `json:"data"`
+}
+
+type MixedPtrItem struct {
+	StringPtrKey *string `json:"stringPtrKey"`
+	StringKey    string  `json:"stringKey"`
+	Data         string  `json:"data"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/doc_test.go
new file mode 100644
index 0000000000..4354b83923
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/doc_test.go
@@ -0,0 +1,102 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package multiplekeys
+
+import (
+	"testing"
+
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		Items: []Item{},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Items: nil,
+	}).ExpectValid()
+
+	oldStruct := &Struct{Items: nil}
+	newStruct := &Struct{Items: []Item{}}
+	st.Value(newStruct).OldValue(oldStruct).ExpectValid()
+	st.Value(oldStruct).OldValue(newStruct).ExpectValid()
+
+	st.Value(&Struct{
+		Items: []Item{
+			{StringKey: "target", IntKey: 42, BoolKey: true, Data: "match"},
+			{StringKey: "target", IntKey: 42, BoolKey: false, Data: "no match, bool differs"},
+			{StringKey: "target", IntKey: 99, BoolKey: true, Data: "no match, int differs"},
+			{StringKey: "other", IntKey: 42, BoolKey: true, Data: "no match, string differs"},
+			{StringKey: "other", IntKey: 99, BoolKey: false, Data: "no match, all different"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`items[0]`: {
+			"item Items[stringKey=target,intKey=42,boolKey=true] 1",
+			"item Items[stringKey=target,intKey=42,boolKey=true] 2",
+		},
+	})
+
+	st.Value(&Struct{
+		Items: []Item{
+			{StringKey: "a", IntKey: 1, BoolKey: false, Data: "d1"},
+			{StringKey: "b", IntKey: 2, BoolKey: true, Data: "d2"},
+			{StringKey: "c", IntKey: 3, BoolKey: false, Data: "d3"},
+		},
+	}).ExpectValid()
+
+	// Test ratcheting.
+	st.Value(&Struct{
+		Items: []Item{
+			{StringKey: "target", IntKey: 42, BoolKey: true},
+			{StringKey: "changed", IntKey: 2, BoolKey: false},
+		},
+	}).OldValue(&Struct{
+		Items: []Item{
+			{StringKey: "target", IntKey: 42, BoolKey: true},
+			{StringKey: "other", IntKey: 1, BoolKey: false},
+		},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		PtrItems: []PtrItem{
+			{StringKey: ptr.To("target-ptr"), IntKey: 42, BoolKey: true, Data: "match"},
+			{StringKey: ptr.To("target-ptr"), IntKey: 42, BoolKey: false, Data: "no match, bool differs"},
+			{StringKey: ptr.To("target-ptr"), IntKey: 99, BoolKey: true, Data: "no match, int differs"},
+			{StringKey: ptr.To("other"), IntKey: 42, BoolKey: true, Data: "no match, string differs"},
+			{StringKey: nil, IntKey: 42, BoolKey: true, Data: "no match, nil string"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`ptrItems[0]`: {
+			"item PtrItems[stringKey=target-ptr,intKey=42,boolKey=true]",
+		},
+	})
+
+	st.Value(&Struct{
+		MixedPtrItems: []MixedPtrItem{
+			{StringPtrKey: ptr.To("target-ptr"), StringKey: "target", Data: "match"},
+			{StringPtrKey: ptr.To("target-ptr"), StringKey: "other", Data: "no match"},
+			{StringPtrKey: nil, StringKey: "target", Data: "no match"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`mixedPtrItems[0]`: {
+			"item MixedPtrItems",
+		},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/zz_generated.validations.go
new file mode 100644
index 0000000000..78c8f3462e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/zz_generated.validations.go
@@ -0,0 +1,232 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package multiplekeys
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Items
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Item,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Item, b *Item) bool {
+					return a.StringKey == b.StringKey && a.IntKey == b.IntKey && a.BoolKey == b.BoolKey
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"stringKey": "target", "intKey": 42, "boolKey": true}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *Item) bool { return item.StringKey == "target" && item.IntKey == 42 && item.BoolKey == true }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *Item) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item Items[stringKey=target,intKey=42,boolKey=true] 1")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *Item) bool { return item.StringKey == "target" && item.IntKey == 42 && item.BoolKey == true }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *Item) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item Items[stringKey=target,intKey=42,boolKey=true] 2")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []Item {
+				return oldObj.Items
+			})
+		errs = append(errs, fn(fldPath.Child("items"), obj.Items, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.OutOfOrder
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Item,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Item, b *Item) bool {
+					return a.StringKey == b.StringKey && a.IntKey == b.IntKey && a.BoolKey == b.BoolKey
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"boolKey": true, "stringKey": "target", "intKey": 42}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *Item) bool { return item.StringKey == "target" && item.IntKey == 42 && item.BoolKey == true }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *Item) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item OutOfOrder[boolKey=42,stringKey=target,intKey=42]")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []Item {
+				return oldObj.OutOfOrder
+			})
+		errs = append(errs, fn(fldPath.Child("outOfOrder"), obj.OutOfOrder, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.PtrItems
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []PtrItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *PtrItem, b *PtrItem) bool {
+					return ((a.StringKey == nil && b.StringKey == nil) || (a.StringKey != nil && b.StringKey != nil && *a.StringKey == *b.StringKey)) && a.IntKey == b.IntKey && a.BoolKey == b.BoolKey
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"stringKey": "target-ptr", "intKey": 42, "boolKey": true}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *PtrItem) bool {
+						return item.StringKey != nil && *item.StringKey == "target-ptr" && item.IntKey == 42 && item.BoolKey == true
+					}, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *PtrItem) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item PtrItems[stringKey=target-ptr,intKey=42,boolKey=true]")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []PtrItem {
+				return oldObj.PtrItems
+			})
+		errs = append(errs, fn(fldPath.Child("ptrItems"), obj.PtrItems, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MixedPtrItems
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MixedPtrItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MixedPtrItem, b *MixedPtrItem) bool {
+					return ((a.StringPtrKey == nil && b.StringPtrKey == nil) || (a.StringPtrKey != nil && b.StringPtrKey != nil && *a.StringPtrKey == *b.StringPtrKey)) && a.StringKey == b.StringKey
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"stringPtrKey": "target-ptr", "stringKey": "target"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *MixedPtrItem) bool {
+						return item.StringPtrKey != nil && *item.StringPtrKey == "target-ptr" && item.StringKey == "target"
+					}, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MixedPtrItem) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item MixedPtrItems")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []MixedPtrItem {
+				return oldObj.MixedPtrItems
+			})
+		errs = append(errs, fn(fldPath.Child("mixedPtrItems"), obj.MixedPtrItems, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
+func deepEqualImpl_[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/doc.go
new file mode 100644
index 0000000000..5eaf7ae2ba
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/doc.go
@@ -0,0 +1,113 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package singlekey
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int `json:"typeMeta"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:item(key: "target")=+k8s:validateFalse="item Items[key=target] 1"
+	// +k8s:item(key: "target")=+k8s:validateFalse="item Items[key=target] 2"
+	Items []Item `json:"items"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=intField
+	// +k8s:item(intField: 42)=+k8s:validateFalse="item IntKeyItems[intField=42] 1"
+	// +k8s:item(intField: 42)=+k8s:validateFalse="item IntKeyItems[intField=42] 2"
+	IntKeyItems []IntKeyItem `json:"intKeyItems"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=boolField
+	// +k8s:item(boolField: true)=+k8s:validateFalse="item BoolKeyItems[boolField=true] 1"
+	// +k8s:item(boolField: true)=+k8s:validateFalse="item BoolKeyItems[boolField=true] 2"
+	BoolKeyItems []BoolKeyItem `json:"boolKeyItems"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=id
+	// +k8s:item(id: "typedef-target")=+k8s:validateFalse="item TypedefItems[id=typedef-target] 1"
+	// +k8s:item(id: "typedef-target")=+k8s:validateFalse="item TypedefItems[id=typedef-target] 2"
+	TypedefItems TypedefItemList `json:"typedefItems"`
+
+	// Test atomic + unique=map + item combination
+	// +k8s:listType=atomic
+	// +k8s:unique=map
+	// +k8s:listMapKey=key
+	// +k8s:item(key: "target")=+k8s:validateFalse="item AtomicUniqueMapItems[key=target]"
+	AtomicUniqueMapItems []Item `json:"atomicUniqueMapItems"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:item(key: "target-ptr")=+k8s:validateFalse="item PtrKeyItems[key=target-ptr]"
+	PtrKeyItems []PtrKeyItem `json:"ptrKeyItems"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:item(key: "target")=+k8s:validateFalse="item PointerItems[key=target]"
+	PointerItems []*Item `json:"pointerItems"`
+}
+
+type StructWithNestedTypedef struct {
+	TypeMeta int `json:"typeMeta"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:item(key: "nested-target")=+k8s:validateFalse="item NestedItems[key=nested-target]"
+	NestedItems []NestedTypedefItem `json:"nestedItems"`
+}
+
+type Item struct {
+	Key  string `json:"key"`
+	Data string `json:"data"`
+}
+
+type IntKeyItem struct {
+	IntField int    `json:"intField"`
+	Data     string `json:"data"`
+}
+
+type BoolKeyItem struct {
+	BoolField bool   `json:"boolField"`
+	Data      string `json:"data"`
+}
+
+type TypedefItem struct {
+	ID          string `json:"id"`
+	Description string `json:"description"`
+}
+
+type TypedefItemList []TypedefItem
+
+type StringAlias string
+type NestedTypedefItem struct {
+	Key  StringAlias `json:"key"`
+	Name string      `json:"name"`
+}
+
+type PtrKeyItem struct {
+	Key  *string `json:"key"`
+	Data string  `json:"data"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/doc_test.go
new file mode 100644
index 0000000000..9a7efe2ba8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/doc_test.go
@@ -0,0 +1,197 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package singlekey
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		Items: []Item{
+			{Key: "a", Data: "d1"},
+			{Key: "target", Data: "d2"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`items[1]`: {
+			"item Items[key=target] 1",
+			"item Items[key=target] 2",
+		},
+	})
+
+	st.Value(&Struct{
+		Items: []Item{
+			{Key: "a", Data: "d1"},
+			{Key: "b", Data: "d2"},
+		},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Items: []Item{},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Items: nil,
+	}).ExpectValid()
+
+	oldStruct := &Struct{Items: nil}
+	newStruct := &Struct{Items: []Item{}}
+	st.Value(newStruct).OldValue(oldStruct).ExpectValid()
+	st.Value(oldStruct).OldValue(newStruct).ExpectValid()
+
+	st.Value(&Struct{
+		IntKeyItems: []IntKeyItem{
+			{IntField: 10, Data: "d1"},
+			{IntField: 42, Data: "d2"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`intKeyItems[1]`: {
+			"item IntKeyItems[intField=42] 1",
+			"item IntKeyItems[intField=42] 2",
+		},
+	})
+
+	st.Value(&Struct{
+		BoolKeyItems: []BoolKeyItem{
+			{BoolField: false, Data: "d1"},
+			{BoolField: true, Data: "d2"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`boolKeyItems[1]`: {
+			"item BoolKeyItems[boolField=true] 1",
+			"item BoolKeyItems[boolField=true] 2",
+		},
+	})
+
+	// Test typedef slice.
+	st.Value(&Struct{
+		TypedefItems: TypedefItemList{
+			{ID: "a", Description: "d1"},
+			{ID: "typedef-target", Description: "d2"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`typedefItems[1]`: {
+			"item TypedefItems[id=typedef-target] 1",
+			"item TypedefItems[id=typedef-target] 2",
+		},
+	})
+
+	st.Value(&Struct{
+		TypedefItems: TypedefItemList{
+			{ID: "a", Description: "d1"},
+			{ID: "b", Description: "d2"},
+		},
+	}).ExpectValid()
+
+	// Test nested typedef.
+	st.Value(&StructWithNestedTypedef{
+		NestedItems: []NestedTypedefItem{
+			{Key: "a", Name: "n1"},
+			{Key: "nested-target", Name: "n2"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`nestedItems[1]`: {"item NestedItems[key=nested-target]"},
+	})
+
+	st.Value(&StructWithNestedTypedef{
+		NestedItems: []NestedTypedefItem{
+			{Key: "a", Name: "n1"},
+			{Key: "b", Name: "n2"},
+		},
+	}).ExpectValid()
+
+	// Test atomic + unique=map + item combination
+	st.Value(&Struct{
+		AtomicUniqueMapItems: []Item{
+			{Key: "a", Data: "d1"},
+			{Key: "target", Data: "d2"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`atomicUniqueMapItems[1]`: {
+			"item AtomicUniqueMapItems[key=target]",
+		},
+	})
+
+	st.Value(&Struct{
+		AtomicUniqueMapItems: []Item{
+			{Key: "a", Data: "d1"},
+			{Key: "b", Data: "d2"},
+		},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		AtomicUniqueMapItems: []Item{},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		AtomicUniqueMapItems: nil,
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		PtrKeyItems: []PtrKeyItem{
+			{Key: ptr.To("a"), Data: "d1"},
+			{Key: ptr.To("target-ptr"), Data: "d2"},
+			{Key: nil, Data: "d3"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`ptrKeyItems[1]`: {
+			"item PtrKeyItems[key=target-ptr]",
+		},
+	})
+
+	st.Value(&Struct{
+		PtrKeyItems: []PtrKeyItem{
+			{Key: ptr.To("a"), Data: "d1"},
+			{Key: ptr.To("b"), Data: "d2"},
+			{Key: nil, Data: "d3"},
+		},
+	}).ExpectValid()
+
+	// Test pointer items (PtrSliceItem)
+	st.Value(&Struct{
+		PointerItems: []*Item{
+			{Key: "a", Data: "d1"},
+			{Key: "target", Data: "d2"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`pointerItems[1]`: {
+			"item PointerItems[key=target]",
+		},
+	})
+
+	st.Value(&Struct{
+		PointerItems: []*Item{
+			{Key: "a", Data: "d1"},
+			{Key: "b", Data: "d2"},
+		},
+	}).ExpectValid()
+
+	// Nil element in list should trigger Required error
+	st.Value(&Struct{
+		PointerItems: []*Item{
+			{Key: "a", Data: "d1"},
+			nil,
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Required(field.NewPath("pointerItems").Index(1), ""),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/zz_generated.validations.go
new file mode 100644
index 0000000000..9556a06894
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/zz_generated.validations.go
@@ -0,0 +1,417 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package singlekey
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type StructWithNestedTypedef
+	scheme.AddValidationFunc(
+		(*StructWithNestedTypedef)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_StructWithNestedTypedef(
+					ctx, op, nil, /* fldPath */
+					obj.(*StructWithNestedTypedef),
+					safe.Cast[*StructWithNestedTypedef](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Items
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Item,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Item, b *Item) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key": "target"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *Item) bool { return item.Key == "target" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *Item) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item Items[key=target] 1")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *Item) bool { return item.Key == "target" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *Item) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item Items[key=target] 2")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []Item {
+				return oldObj.Items
+			})
+		errs = append(errs, fn(fldPath.Child("items"), obj.Items, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntKeyItems
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []IntKeyItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *IntKeyItem, b *IntKeyItem) bool { return a.IntField == b.IntField }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"intField": 42}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *IntKeyItem) bool { return item.IntField == 42 }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *IntKeyItem) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item IntKeyItems[intField=42] 1")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *IntKeyItem) bool { return item.IntField == 42 }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *IntKeyItem) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item IntKeyItems[intField=42] 2")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []IntKeyItem {
+				return oldObj.IntKeyItems
+			})
+		errs = append(errs, fn(fldPath.Child("intKeyItems"), obj.IntKeyItems, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.BoolKeyItems
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []BoolKeyItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *BoolKeyItem, b *BoolKeyItem) bool { return a.BoolField == b.BoolField }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"boolField": true}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *BoolKeyItem) bool { return item.BoolField == true }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *BoolKeyItem) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item BoolKeyItems[boolField=true] 1")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *BoolKeyItem) bool { return item.BoolField == true }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *BoolKeyItem) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item BoolKeyItems[boolField=true] 2")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []BoolKeyItem {
+				return oldObj.BoolKeyItems
+			})
+		errs = append(errs, fn(fldPath.Child("boolKeyItems"), obj.BoolKeyItems, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.TypedefItems
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj TypedefItemList,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *TypedefItem, b *TypedefItem) bool { return a.ID == b.ID }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"id": "typedef-target"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *TypedefItem) bool { return item.ID == "typedef-target" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *TypedefItem) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item TypedefItems[id=typedef-target] 1")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *TypedefItem) bool { return item.ID == "typedef-target" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *TypedefItem) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item TypedefItems[id=typedef-target] 2")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) TypedefItemList {
+				return oldObj.TypedefItems
+			})
+		errs = append(errs, fn(fldPath.Child("typedefItems"), obj.TypedefItems, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.AtomicUniqueMapItems
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Item,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Item, b *Item) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key": "target"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *Item) bool { return item.Key == "target" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *Item) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item AtomicUniqueMapItems[key=target]")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []Item {
+				return oldObj.AtomicUniqueMapItems
+			})
+		errs = append(errs, fn(fldPath.Child("atomicUniqueMapItems"), obj.AtomicUniqueMapItems, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.PtrKeyItems
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []PtrKeyItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *PtrKeyItem, b *PtrKeyItem) bool {
+					return ((a.Key == nil && b.Key == nil) || (a.Key != nil && b.Key != nil && *a.Key == *b.Key))
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key": "target-ptr"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *PtrKeyItem) bool { return item.Key != nil && *item.Key == "target-ptr" }, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *PtrKeyItem) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item PtrKeyItems[key=target-ptr]")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []PtrKeyItem {
+				return oldObj.PtrKeyItems
+			})
+		errs = append(errs, fn(fldPath.Child("ptrKeyItems"), obj.PtrKeyItems, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.PointerItems
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []*Item,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrSliceNoNils[Item](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.PtrSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Item, b *Item) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key": "target"}"
+				if e := validate.PtrSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *Item) bool { return item.Key == "target" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *Item) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item PointerItems[key=target]")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []*Item {
+				return oldObj.PointerItems
+			})
+		errs = append(errs, fn(fldPath.Child("pointerItems"), obj.PointerItems, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_StructWithNestedTypedef validates an instance of StructWithNestedTypedef according
+// to declarative validation rules in the API schema.
+func Validate_StructWithNestedTypedef(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StructWithNestedTypedef) (errs field.ErrorList) {
+
+	// field StructWithNestedTypedef.TypeMeta has no validation
+
+	{ // field StructWithNestedTypedef.NestedItems
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []NestedTypedefItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *NestedTypedefItem, b *NestedTypedefItem) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key": "nested-target"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *NestedTypedefItem) bool { return item.Key == "nested-target" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NestedTypedefItem) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item NestedItems[key=nested-target]")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructWithNestedTypedef) []NestedTypedefItem {
+				return oldObj.NestedItems
+			})
+		errs = append(errs, fn(fldPath.Child("nestedItems"), obj.NestedItems, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
+func deepEqualImpl_[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/subfield/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/subfield/doc.go
new file mode 100644
index 0000000000..7f1a779669
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/subfield/doc.go
@@ -0,0 +1,51 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package subfield
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int `json:"typeMeta"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:item(key: "target")=+k8s:subfield(stringField)=+k8s:validateFalse="item Items[key=target].stringField"
+	Items []Item `json:"items"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:item(key: "ratchet")=+k8s:subfield(status)=+k8s:neq="forbidden"
+	RatchetItems []RatchetItem `json:"ratchetItems"`
+}
+
+type Item struct {
+	Key         string `json:"key"`
+	StringField string `json:"stringField"`
+}
+
+type RatchetItem struct {
+	Key     string `json:"key"`
+	Status  string `json:"status"`
+	Version int    `json:"version"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/subfield/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/subfield/doc_test.go
new file mode 100644
index 0000000000..7ecbbca0c5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/subfield/doc_test.go
@@ -0,0 +1,80 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package subfield
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		Items: []Item{
+			{Key: "other", StringField: "anything"},
+			{Key: "target", StringField: "fails"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`items[1].stringField`: {"item Items[key=target].stringField"},
+	})
+
+	st.Value(&Struct{
+		Items: []Item{
+			{Key: "other", StringField: "anything"},
+		},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		RatchetItems: []RatchetItem{
+			{Key: "ratchet", Status: "forbidden", Version: 1},
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring(), field.ErrorList{
+		field.Invalid(field.NewPath("ratchetItems").Index(0).Child("status"), nil, ""),
+	})
+
+	st.Value(&Struct{
+		RatchetItems: []RatchetItem{
+			{Key: "ratchet", Status: "allowed", Version: 1},
+		},
+	}).ExpectValid()
+
+	oldStruct := &Struct{
+		RatchetItems: []RatchetItem{
+			{Key: "ratchet", Status: "forbidden", Version: 1},
+		},
+	}
+	newStruct := &Struct{
+		RatchetItems: []RatchetItem{
+			{Key: "ratchet", Status: "forbidden", Version: 2},
+		},
+	}
+	st.Value(newStruct).OldValue(oldStruct).ExpectValid()
+
+	st.Value(&Struct{
+		RatchetItems: []RatchetItem{
+			{Key: "ratchet", Status: "forbidden", Version: 2},
+		},
+	}).OldValue(&Struct{
+		RatchetItems: []RatchetItem{
+			{Key: "ratchet", Status: "allowed", Version: 1},
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring(), field.ErrorList{
+		field.Invalid(field.NewPath("ratchetItems").Index(0).Child("status"), nil, ""),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/subfield/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/subfield/zz_generated.validations.go
new file mode 100644
index 0000000000..a21068e067
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/subfield/zz_generated.validations.go
@@ -0,0 +1,146 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package subfield
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Items
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Item,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Item, b *Item) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key": "target"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *Item) bool { return item.Key == "target" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *Item) field.ErrorList {
+						return validate.Subfield(ctx, op, fldPath, obj, oldObj, "stringField",
+							func(o *Item) *string { return &o.StringField }, validate.DirectEqual,
+							func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+								return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item Items[key=target].stringField")
+							})
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []Item {
+				return oldObj.Items
+			})
+		errs = append(errs, fn(fldPath.Child("items"), obj.Items, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.RatchetItems
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []RatchetItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *RatchetItem, b *RatchetItem) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key": "ratchet"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *RatchetItem) bool { return item.Key == "ratchet" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *RatchetItem) field.ErrorList {
+						return validate.Subfield(ctx, op, fldPath, obj, oldObj, "status",
+							func(o *RatchetItem) *string { return &o.Status }, validate.DirectEqual,
+							func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+								return validate.NEQ(ctx, op, fldPath, obj, oldObj, "forbidden")
+							})
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []RatchetItem {
+				return oldObj.RatchetItems
+			})
+		errs = append(errs, fn(fldPath.Child("ratchetItems"), obj.RatchetItems, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/typedef/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/typedef/doc.go
new file mode 100644
index 0000000000..b9458b5177
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/typedef/doc.go
@@ -0,0 +1,70 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package typedef
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int `json:"typeMeta"`
+
+	TypedefItems       ItemList      `json:"typedefItems"`
+	NestedTypedefItems ItemListAlias `json:"nestedTypedefItems"`
+
+	// +k8s:item(id: "field-target")=+k8s:validateFalse="item DualItems[id=field-target] from field"
+	DualItems DualItemList `json:"dualItems"`
+
+	// +k8s:item(id: "target")=+k8s:validateFalse="item ConflictingItems[id=target] from field"
+	ConflictingItems ConflictingItemList `json:"conflictingItems"`
+}
+
+type Item struct {
+	Key  string `json:"key"`
+	Data string `json:"data"`
+}
+
+// +k8s:listType=map
+// +k8s:listMapKey=key
+// +k8s:item(key: "immutable")=+k8s:immutable
+// +k8s:item(key: "validated")=+k8s:validateFalse="item ItemList[key=validated]"
+type ItemList []Item
+
+// +k8s:listType=map
+// +k8s:listMapKey=key
+// +k8s:item(key: "aliased")=+k8s:validateFalse="item ItemListAlias[key=aliased]"
+type ItemListAlias ItemList
+
+type DualItem struct {
+	ID   string `json:"id"`
+	Name string `json:"name"`
+}
+
+// +k8s:listType=map
+// +k8s:listMapKey=id
+// +k8s:item(id: "typedef-target")=+k8s:validateFalse="item DualItems[id=typedef-target] from typedef"
+type DualItemList []DualItem
+
+// +k8s:listType=map
+// +k8s:listMapKey=id
+// +k8s:item(id: "target")=+k8s:validateFalse="item ConflictingItems[id=target] from typedef"
+type ConflictingItemList []DualItem
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/typedef/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/typedef/doc_test.go
new file mode 100644
index 0000000000..d823a2f361
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/typedef/doc_test.go
@@ -0,0 +1,93 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package typedef
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		TypedefItems: ItemList{
+			{Key: "a", Data: "d1"},
+			{Key: "b", Data: "d2"},
+		},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		TypedefItems: ItemList{
+			{Key: "a", Data: "d1"},
+			{Key: "validated", Data: "d2"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`typedefItems[1]`: {"item ItemList[key=validated]"},
+	})
+
+	// Test immutability on typedef.
+	oldStruct := &Struct{
+		TypedefItems: ItemList{
+			{Key: "immutable", Data: "original"},
+		},
+	}
+	newStruct := &Struct{
+		TypedefItems: ItemList{
+			{Key: "immutable", Data: "changed"},
+		},
+	}
+	st.Value(newStruct).OldValue(oldStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("typedefItems").Index(0), nil, "immutable").WithOrigin("immutable"),
+	})
+
+	// Test nested typedef (typedef of typedef).
+	st.Value(&Struct{
+		NestedTypedefItems: ItemListAlias{
+			{Key: "normal", Data: "d1"},
+			{Key: "aliased", Data: "d2"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`nestedTypedefItems[1]`: {"item ItemListAlias[key=aliased]"},
+	})
+
+	// Test tag on field and typedef.
+	st.Value(&Struct{
+		DualItems: DualItemList{
+			{ID: "a", Name: "n1"},
+			{ID: "typedef-target", Name: "n2"},
+			{ID: "field-target", Name: "n3"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`dualItems[1]`: {"item DualItems[id=typedef-target] from typedef"},
+		`dualItems[2]`: {"item DualItems[id=field-target] from field"},
+	})
+
+	// Test tag on field and typedef with same key.
+	st.Value(&Struct{
+		ConflictingItems: ConflictingItemList{
+			{ID: "a", Name: "n1"},
+			{ID: "target", Name: "n2"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`conflictingItems[1]`: {
+			"item ConflictingItems[id=target] from typedef",
+			"item ConflictingItems[id=target] from field",
+		},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/typedef/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/typedef/zz_generated.validations.go
new file mode 100644
index 0000000000..a84a4bbd3b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/typedef/zz_generated.validations.go
@@ -0,0 +1,283 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package typedef
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_ConflictingItemList validates an instance of ConflictingItemList according
+// to declarative validation rules in the API schema.
+func Validate_ConflictingItemList(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj ConflictingItemList) (errs field.ErrorList) {
+
+	// lists with map semantics require unique keys
+	if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+		func(a *DualItem, b *DualItem) bool { return a.ID == b.ID }); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	func() { // cohort = "{"id": "target"}"
+		if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+			func(item *DualItem) bool { return item.ID == "target" }, validate.DirectEqual,
+			func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *DualItem) field.ErrorList {
+				return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item ConflictingItems[id=target] from typedef")
+			}); len(e) != 0 {
+			errs = append(errs, e...)
+		}
+	}()
+
+	return errs
+}
+
+// Validate_DualItemList validates an instance of DualItemList according
+// to declarative validation rules in the API schema.
+func Validate_DualItemList(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj DualItemList) (errs field.ErrorList) {
+
+	// lists with map semantics require unique keys
+	if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+		func(a *DualItem, b *DualItem) bool { return a.ID == b.ID }); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	func() { // cohort = "{"id": "typedef-target"}"
+		if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+			func(item *DualItem) bool { return item.ID == "typedef-target" }, validate.DirectEqual,
+			func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *DualItem) field.ErrorList {
+				return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item DualItems[id=typedef-target] from typedef")
+			}); len(e) != 0 {
+			errs = append(errs, e...)
+		}
+	}()
+
+	return errs
+}
+
+// Validate_ItemList validates an instance of ItemList according
+// to declarative validation rules in the API schema.
+func Validate_ItemList(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj ItemList) (errs field.ErrorList) {
+
+	// lists with map semantics require unique keys
+	if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+		func(a *Item, b *Item) bool { return a.Key == b.Key }); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	func() { // cohort = "{"key": "immutable"}"
+		earlyReturn := false
+		if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+			func(item *Item) bool { return item.Key == "immutable" }, validate.DirectEqual, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+			errs = append(errs, e...)
+			earlyReturn = true
+		}
+		if earlyReturn {
+			return // do not proceed
+		}
+	}()
+	func() { // cohort = "{"key": "validated"}"
+		if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+			func(item *Item) bool { return item.Key == "validated" }, validate.DirectEqual,
+			func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *Item) field.ErrorList {
+				return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item ItemList[key=validated]")
+			}); len(e) != 0 {
+			errs = append(errs, e...)
+		}
+	}()
+
+	return errs
+}
+
+// Validate_ItemListAlias validates an instance of ItemListAlias according
+// to declarative validation rules in the API schema.
+func Validate_ItemListAlias(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj ItemListAlias) (errs field.ErrorList) {
+
+	// lists with map semantics require unique keys
+	if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+		func(a *Item, b *Item) bool { return a.Key == b.Key }); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	func() { // cohort = "{"key": "aliased"}"
+		if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+			func(item *Item) bool { return item.Key == "aliased" }, validate.DirectEqual,
+			func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *Item) field.ErrorList {
+				return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item ItemListAlias[key=aliased]")
+			}); len(e) != 0 {
+			errs = append(errs, e...)
+		}
+	}()
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.TypedefItems
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj ItemList,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ItemList(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) ItemList {
+				return oldObj.TypedefItems
+			})
+		errs = append(errs, fn(fldPath.Child("typedefItems"), obj.TypedefItems, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.NestedTypedefItems
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj ItemListAlias,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ItemListAlias(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) ItemListAlias {
+				return oldObj.NestedTypedefItems
+			})
+		errs = append(errs, fn(fldPath.Child("nestedTypedefItems"), obj.NestedTypedefItems, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.DualItems
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj DualItemList,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "{"id": "field-target"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *DualItem) bool { return item.ID == "field-target" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *DualItem) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item DualItems[id=field-target] from field")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			// call the type's validation function
+			errs = append(errs, Validate_DualItemList(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) DualItemList {
+				return oldObj.DualItems
+			})
+		errs = append(errs, fn(fldPath.Child("dualItems"), obj.DualItems, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ConflictingItems
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj ConflictingItemList,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "{"id": "target"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *DualItem) bool { return item.ID == "target" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *DualItem) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item ConflictingItems[id=target] from field")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			// call the type's validation function
+			errs = append(errs, Validate_ConflictingItemList(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) ConflictingItemList {
+				return oldObj.ConflictingItems
+			})
+		errs = append(errs, fn(fldPath.Child("conflictingItems"), obj.ConflictingItems, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/simple/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/simple/doc.go
new file mode 100644
index 0000000000..22221781ca
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/simple/doc.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package unionsimple
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int `json:"typeMeta"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:item(name: "succeeded")=+k8s:unionMember
+	// +k8s:item(name: "failed")=+k8s:unionMember
+	Tasks []Task `json:"tasks"`
+}
+
+type Task struct {
+	Name  string `json:"name"`
+	State string `json:"state"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/simple/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/simple/doc_test.go
new file mode 100644
index 0000000000..0b527b5db5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/simple/doc_test.go
@@ -0,0 +1,64 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unionsimple
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		Tasks: []Task{
+			{Name: "succeeded", State: "Succeeded"},
+			{Name: "other", State: "Other"},
+		},
+	}).ExpectValid()
+
+	invalidBothSet := &Struct{
+		Tasks: []Task{
+			{Name: "succeeded", State: "Succeeded"},
+			{Name: "failed", State: "Failed"},
+		},
+	}
+
+	st.Value(invalidBothSet).ExpectMatches(
+		field.ErrorMatcher{},
+		field.ErrorList{
+			field.Invalid(field.NewPath("tasks"), "{Tasks[{\"name\": \"failed\"}], Tasks[{\"name\": \"succeeded\"}]}",
+				"must specify exactly one of: `Tasks[{\"name\": \"succeeded\"}]`, `Tasks[{\"name\": \"failed\"}]`"),
+		},
+	)
+
+	invalidEmpty := &Struct{
+		Tasks: []Task{},
+	}
+	st.Value(invalidEmpty).ExpectMatches(
+		field.ErrorMatcher{},
+		field.ErrorList{
+			field.Invalid(field.NewPath("tasks"), "",
+				"must specify one of: `Tasks[{\"name\": \"succeeded\"}]`, `Tasks[{\"name\": \"failed\"}]`"),
+		},
+	)
+
+	// Test ratcheting.
+	st.Value(invalidEmpty).OldValue(invalidEmpty).ExpectValid()
+	st.Value(invalidBothSet).OldValue(invalidBothSet).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/simple/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/simple/zz_generated.validations.go
new file mode 100644
index 0000000000..b248852530
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/simple/zz_generated.validations.go
@@ -0,0 +1,115 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package unionsimple
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_item_union_simple_Struct_tasks_ = validate.NewUnionMembership(validate.NewUnionMember("tasks[{\"name\": \"succeeded\"}]"), validate.NewUnionMember("tasks[{\"name\": \"failed\"}]"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Tasks
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Task,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_item_union_simple_Struct_tasks_,
+				func(list []Task) bool {
+					for i := range list {
+						if list[i].Name == "failed" {
+							return true
+						}
+					}
+					return false
+				},
+				func(list []Task) bool {
+					for i := range list {
+						if list[i].Name == "succeeded" {
+							return true
+						}
+					}
+					return false
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Task, b *Task) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []Task {
+				return oldObj.Tasks
+			})
+		errs = append(errs, fn(fldPath.Child("tasks"), obj.Tasks, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/typedef/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/typedef/doc.go
new file mode 100644
index 0000000000..905c7cb252
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/typedef/doc.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package uniontypedef
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int `json:"typeMeta"`
+
+	Tasks TaskList `json:"tasks"`
+}
+
+// +k8s:listType=map
+// +k8s:listMapKey=name
+// +k8s:item(name: "succeeded")=+k8s:unionMember
+// +k8s:item(name: "failed")=+k8s:unionMember
+type TaskList []Task
+
+type Task struct {
+	Name  string `json:"name"`
+	State string `json:"state"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/typedef/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/typedef/doc_test.go
new file mode 100644
index 0000000000..9cde647731
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/typedef/doc_test.go
@@ -0,0 +1,65 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package uniontypedef
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		Tasks: TaskList{
+			{Name: "succeeded", State: "Succeeded"},
+			{Name: "other", State: "Other"},
+		},
+	}).ExpectValid()
+
+	invalidBothSet := &Struct{
+		Tasks: []Task{
+			{Name: "succeeded", State: "Succeeded"},
+			{Name: "failed", State: "Failed"},
+		},
+	}
+
+	st.Value(invalidBothSet).ExpectMatches(
+		field.ErrorMatcher{},
+		field.ErrorList{
+			field.Invalid(field.NewPath("tasks"), "{TaskList[{\"name\": \"failed\"}], TaskList[{\"name\": \"succeeded\"}]}",
+				"must specify exactly one of: `TaskList[{\"name\": \"succeeded\"}]`, `TaskList[{\"name\": \"failed\"}]`"),
+		},
+	)
+
+	invalidEmpty := &Struct{
+		Tasks: TaskList{},
+	}
+	st.Value(invalidEmpty).ExpectMatches(
+		field.ErrorMatcher{},
+		field.ErrorList{
+			field.Invalid(field.NewPath("tasks"), "",
+				"must specify one of: `TaskList[{\"name\": \"succeeded\"}]`, `TaskList[{\"name\": \"failed\"}]`"),
+		},
+	)
+
+	// Test ratcheting.
+	st.Value(invalidEmpty).OldValue(invalidEmpty).ExpectValid()
+
+	st.Value(invalidBothSet).OldValue(invalidBothSet).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/typedef/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/typedef/zz_generated.validations.go
new file mode 100644
index 0000000000..d57d0c2568
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/union/typedef/zz_generated.validations.go
@@ -0,0 +1,126 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package uniontypedef
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Tasks
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj TaskList,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_TaskList(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) TaskList {
+				return oldObj.Tasks
+			})
+		errs = append(errs, fn(fldPath.Child("tasks"), obj.Tasks, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_item_union_typedef_TaskList_ = validate.NewUnionMembership(validate.NewUnionMember("TaskList[{\"name\": \"succeeded\"}]"), validate.NewUnionMember("TaskList[{\"name\": \"failed\"}]"))
+
+// Validate_TaskList validates an instance of TaskList according
+// to declarative validation rules in the API schema.
+func Validate_TaskList(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj TaskList) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_item_union_typedef_TaskList_,
+		func(list TaskList) bool {
+			for i := range list {
+				if list[i].Name == "failed" {
+					return true
+				}
+			}
+			return false
+		},
+		func(list TaskList) bool {
+			for i := range list {
+				if list[i].Name == "succeeded" {
+					return true
+				}
+			}
+			return false
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	// lists with map semantics require unique keys
+	if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+		func(a *Task, b *Task) bool { return a.Name == b.Name }); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/simple/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/simple/doc.go
new file mode 100644
index 0000000000..acb8d1192b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/simple/doc.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package zeroroneofsimple
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int `json:"typeMeta"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:item(name: "succeeded")=+k8s:zeroOrOneOfMember
+	// +k8s:item(name: "failed")=+k8s:zeroOrOneOfMember
+	Tasks []Task `json:"tasks"`
+}
+
+type Task struct {
+	Name  string `json:"name"`
+	State string `json:"state"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/simple/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/simple/doc_test.go
new file mode 100644
index 0000000000..a2ace70a13
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/simple/doc_test.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package zeroroneofsimple
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		Tasks: []Task{
+			{Name: "other", State: "Other"},
+		},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Tasks: []Task{
+			{Name: "succeeded", State: "Succeeded"},
+		},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Tasks: []Task{},
+	}).ExpectValid()
+
+	invalidBothSet := &Struct{
+		Tasks: []Task{
+			{Name: "succeeded", State: "Succeeded"},
+			{Name: "failed", State: "Failed"},
+		},
+	}
+	st.Value(invalidBothSet).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{
+			field.Invalid(field.NewPath("tasks"), nil, "").WithOrigin("zeroOrOneOf"),
+		},
+	)
+
+	// Test ratcheting.
+	st.Value(invalidBothSet).OldValue(invalidBothSet).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/simple/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/simple/zz_generated.validations.go
new file mode 100644
index 0000000000..5edb55fdaa
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/simple/zz_generated.validations.go
@@ -0,0 +1,115 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package zeroroneofsimple
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_item_zerorooneof_simple_Struct_tasks_ = validate.NewUnionMembership(validate.NewUnionMember("tasks[{\"name\": \"succeeded\"}]"), validate.NewUnionMember("tasks[{\"name\": \"failed\"}]"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Tasks
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Task,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.ZeroOrOneOfUnion(ctx, op, fldPath, obj, oldObj, zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_item_zerorooneof_simple_Struct_tasks_,
+				func(list []Task) bool {
+					for i := range list {
+						if list[i].Name == "failed" {
+							return true
+						}
+					}
+					return false
+				},
+				func(list []Task) bool {
+					for i := range list {
+						if list[i].Name == "succeeded" {
+							return true
+						}
+					}
+					return false
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Task, b *Task) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []Task {
+				return oldObj.Tasks
+			})
+		errs = append(errs, fn(fldPath.Child("tasks"), obj.Tasks, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/typedef/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/typedef/doc.go
new file mode 100644
index 0000000000..9d9d213c00
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/typedef/doc.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package zeroroneooftypedef
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int `json:"typeMeta"`
+
+	Tasks TaskList `json:"tasks"`
+}
+
+// +k8s:listType=map
+// +k8s:listMapKey=name
+// +k8s:item(name: "succeeded")=+k8s:zeroOrOneOfMember
+// +k8s:item(name: "failed")=+k8s:zeroOrOneOfMember
+type TaskList []Task
+
+type Task struct {
+	Name  string `json:"name"`
+	State string `json:"state"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/typedef/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/typedef/doc_test.go
new file mode 100644
index 0000000000..b0b8ce0c39
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/typedef/doc_test.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package zeroroneooftypedef
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		Tasks: TaskList{
+			{Name: "other", State: "Other"},
+		},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Tasks: TaskList{
+			{Name: "succeeded", State: "Succeeded"},
+			{Name: "other", State: "Other"},
+		},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Tasks: TaskList{},
+	}).ExpectValid()
+
+	invalidBothSet := &Struct{
+		Tasks: TaskList{
+			{Name: "succeeded", State: "Succeeded"},
+			{Name: "failed", State: "Failed"},
+		},
+	}
+
+	st.Value(invalidBothSet).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{
+			field.Invalid(field.NewPath("tasks"), nil, "").WithOrigin("zeroOrOneOf"),
+		},
+	)
+
+	// Test ratcheting.
+	st.Value(invalidBothSet).OldValue(invalidBothSet).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/typedef/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/typedef/zz_generated.validations.go
new file mode 100644
index 0000000000..7438212137
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/zerorooneof/typedef/zz_generated.validations.go
@@ -0,0 +1,126 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package zeroroneooftypedef
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Tasks
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj TaskList,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_TaskList(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) TaskList {
+				return oldObj.Tasks
+			})
+		errs = append(errs, fn(fldPath.Child("tasks"), obj.Tasks, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_item_zerorooneof_typedef_TaskList_ = validate.NewUnionMembership(validate.NewUnionMember("TaskList[{\"name\": \"succeeded\"}]"), validate.NewUnionMember("TaskList[{\"name\": \"failed\"}]"))
+
+// Validate_TaskList validates an instance of TaskList according
+// to declarative validation rules in the API schema.
+func Validate_TaskList(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj TaskList) (errs field.ErrorList) {
+
+	if e := validate.ZeroOrOneOfUnion(ctx, op, fldPath, obj, oldObj, zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_item_zerorooneof_typedef_TaskList_,
+		func(list TaskList) bool {
+			for i := range list {
+				if list[i].Name == "failed" {
+					return true
+				}
+			}
+			return false
+		},
+		func(list TaskList) bool {
+			for i := range list {
+				if list[i].Name == "succeeded" {
+					return true
+				}
+			}
+			return false
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	// lists with map semantics require unique keys
+	if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+		func(a *Task, b *Task) bool { return a.Name == b.Name }); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/atomicslice/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/atomicslice/doc.go
new file mode 100644
index 0000000000..2cf3a6f135
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/atomicslice/doc.go
@@ -0,0 +1,54 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// +k8s:validation-gen-nolint
+package atomicslice
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type AtomicSliceStruct struct {
+	TypeMeta int
+
+	// Case: Standard eachVal
+	// +k8s:listType=atomic
+	// +k8s:eachVal=+k8s:minimum=10
+	Standard []int `json:"standard"`
+
+	// Case: Alpha eachVal
+	// +k8s:listType=atomic
+	// +k8s:alpha=+k8s:eachVal=+k8s:minimum=10
+	Alpha []int `json:"Alpha"`
+
+	// Case: Beta eachVal
+	// +k8s:listType=atomic
+	// +k8s:beta=+k8s:eachVal=+k8s:minimum=10
+	Beta []int `json:"Beta"`
+
+	// Case: Standard eachVal, Alpha validation
+	// +k8s:listType=atomic
+	// +k8s:eachVal=+k8s:alpha=+k8s:minimum=10
+	AlphaValidation []int `json:"AlphaValidation"`
+
+	// Case: Standard eachVal, Beta validation
+	// +k8s:listType=atomic
+	// +k8s:eachVal=+k8s:beta=+k8s:minimum=10
+	BetaValidation []int `json:"BetaValidation"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/atomicslice/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/atomicslice/doc_test.go
new file mode 100644
index 0000000000..3193ec10ca
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/atomicslice/doc_test.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package atomicslice
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestAtomicSlice(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&AtomicSliceStruct{
+		Standard:        []int{5},
+		Alpha:           []int{5},
+		Beta:            []int{5},
+		AlphaValidation: []int{5},
+		BetaValidation:  []int{5},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		// Case: Standard -> Normal Error
+		field.Invalid(field.NewPath("standard").Index(0), 5, "").WithOrigin("minimum"),
+
+		// Case: Alpha eachVal -> Alpha Error
+		field.Invalid(field.NewPath("Alpha").Index(0), 5, "").WithOrigin("minimum").MarkAlpha(),
+
+		// Case: Beta eachVal -> Beta Error
+		field.Invalid(field.NewPath("Beta").Index(0), 5, "").WithOrigin("minimum").MarkBeta(),
+
+		// Case: Standard eachVal, Alpha validation -> Alpha Error
+		field.Invalid(field.NewPath("AlphaValidation").Index(0), 5, "").WithOrigin("minimum").MarkAlpha(),
+
+		// Case: Standard eachVal, Beta validation -> Beta Error
+		field.Invalid(field.NewPath("BetaValidation").Index(0), 5, "").WithOrigin("minimum").MarkBeta(),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/atomicslice/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/atomicslice/zz_generated.validations.go
new file mode 100644
index 0000000000..05becedac1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/atomicslice/zz_generated.validations.go
@@ -0,0 +1,203 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package atomicslice
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type AtomicSliceStruct
+	scheme.AddValidationFunc(
+		(*AtomicSliceStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_AtomicSliceStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*AtomicSliceStruct),
+					safe.Cast[*AtomicSliceStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_AtomicSliceStruct validates an instance of AtomicSliceStruct according
+// to declarative validation rules in the API schema.
+func Validate_AtomicSliceStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *AtomicSliceStruct) (errs field.ErrorList) {
+
+	// field AtomicSliceStruct.TypeMeta has no validation
+
+	{ // field AtomicSliceStruct.Standard
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+					return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10)
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AtomicSliceStruct) []int {
+				return oldObj.Standard
+			})
+		errs = append(errs, fn(fldPath.Child("standard"), obj.Standard, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AtomicSliceStruct.Alpha
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+					return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10)
+				}).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AtomicSliceStruct) []int {
+				return oldObj.Alpha
+			})
+		errs = append(errs, fn(fldPath.Child("Alpha"), obj.Alpha, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AtomicSliceStruct.Beta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+					return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10)
+				}).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AtomicSliceStruct) []int {
+				return oldObj.Beta
+			})
+		errs = append(errs, fn(fldPath.Child("Beta"), obj.Beta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AtomicSliceStruct.AlphaValidation
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+					return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10).MarkAlpha()
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AtomicSliceStruct) []int {
+				return oldObj.AlphaValidation
+			})
+		errs = append(errs, fn(fldPath.Child("AlphaValidation"), obj.AlphaValidation, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AtomicSliceStruct.BetaValidation
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+					return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10).MarkBeta()
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AtomicSliceStruct) []int {
+				return oldObj.BetaValidation
+			})
+		errs = append(errs, fn(fldPath.Child("BetaValidation"), obj.BetaValidation, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/enums/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/enums/doc.go
new file mode 100644
index 0000000000..149c5cfbef
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/enums/doc.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// +k8s:validation-gen-nolint
+package enums
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	EnumField Enum `json:"enumField"`
+
+	EnumFieldBeta BetaEnum `json:"enumFieldBeta"`
+}
+
+// +k8s:alpha=+k8s:enum
+type Enum string
+
+const (
+	EnumA Enum = "A"
+)
+
+// +k8s:beta=+k8s:enum
+type BetaEnum string
+
+const (
+	BetaEnumA BetaEnum = "A"
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/enums/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/enums/doc_test.go
new file mode 100644
index 0000000000..3a2fca9742
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/enums/doc_test.go
@@ -0,0 +1,57 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package enums
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestAlpha(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		EnumField:     "A",
+		EnumFieldBeta: "A",
+	}).ExpectValid()
+
+	// Test failures marked as alpha
+	st.Value(&Struct{
+		EnumField:     "B",
+		EnumFieldBeta: "A",
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.NotSupported(field.NewPath("enumField"), Enum("B"), []string{"A"}).MarkAlpha(),
+	})
+}
+
+func TestBeta(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		EnumField:     "A",
+		EnumFieldBeta: "A",
+	}).ExpectValid()
+
+	// Test failures marked as beta
+	st.Value(&Struct{
+		EnumField:     "A",
+		EnumFieldBeta: "B",
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.NotSupported(field.NewPath("enumFieldBeta"), BetaEnum("B"), []string{"A"}).MarkBeta(),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/enums/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/enums/zz_generated.validations.go
new file mode 100644
index 0000000000..423c2131bf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/enums/zz_generated.validations.go
@@ -0,0 +1,142 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package enums
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	sets "k8s.io/apimachinery/pkg/util/sets"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var symbolsForBetaEnum = sets.New(BetaEnumA)
+
+// Validate_BetaEnum validates an instance of BetaEnum according
+// to declarative validation rules in the API schema.
+func Validate_BetaEnum(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *BetaEnum) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForBetaEnum, nil).MarkBeta(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+var symbolsForEnum = sets.New(EnumA)
+
+// Validate_Enum validates an instance of Enum according
+// to declarative validation rules in the API schema.
+func Validate_Enum(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Enum) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForEnum, nil).MarkAlpha(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.EnumField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Enum,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Enum(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Enum {
+				return &oldObj.EnumField
+			})
+		errs = append(errs, fn(fldPath.Child("enumField"), &obj.EnumField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.EnumFieldBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *BetaEnum,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_BetaEnum(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *BetaEnum {
+				return &oldObj.EnumFieldBeta
+			})
+		errs = append(errs, fn(fldPath.Child("enumFieldBeta"), &obj.EnumFieldBeta, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listkeys/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listkeys/doc.go
new file mode 100644
index 0000000000..f5f0b43ceb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listkeys/doc.go
@@ -0,0 +1,118 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// +k8s:validation-gen-nolint
+package listkeys
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type MapItem struct {
+	Key   string `json:"key"`
+	Value int    `json:"value"`
+}
+
+type MultiKeyItem struct {
+	Key1  string `json:"key1"`
+	Key2  int    `json:"key2"`
+	Value int    `json:"value"`
+}
+
+type ListKeyStruct struct {
+	TypeMeta int
+
+	// Case: Alpha listType, Standard Key
+	// +k8s:alpha=+k8s:listType=map
+	// +k8s:listMapKey=key
+	AlphaListTypeStandardKey []MapItem `json:"alphaListTypeStandardKey"`
+
+	// Case: Standard listType, Alpha Key
+	// +k8s:listType=map
+	// +k8s:alpha=+k8s:listMapKey=key
+	StandardListTypeAlphaKey []MapItem `json:"standardListTypeAlphaKey"`
+
+	// Case: Alpha listType, Alpha Key
+	// +k8s:alpha=+k8s:listType=map
+	// +k8s:alpha=+k8s:listMapKey=key
+	AlphaListTypeAlphaKey []MapItem `json:"alphaListTypeAlphaKey"`
+
+	// Case: Standard listType, Alpha Key1, Standard Key2
+	// +k8s:listType=map
+	// +k8s:alpha=+k8s:listMapKey=key1
+	// +k8s:listMapKey=key2
+	StandardListTypeMixedKeys1 []MultiKeyItem `json:"standardListTypeMixedKeys1"`
+
+	// Case: Standard listType, Standard Key1, Alpha Key2
+	// +k8s:listType=map
+	// +k8s:listMapKey=key1
+	// +k8s:alpha=+k8s:listMapKey=key2
+	StandardListTypeMixedKeys2 []MultiKeyItem `json:"standardListTypeMixedKeys2"`
+
+	// Case: Alpha listType, Alpha Key1, Standard Key2
+	// +k8s:alpha=+k8s:listType=map
+	// +k8s:alpha=+k8s:listMapKey=key1
+	// +k8s:listMapKey=key2
+	AlphaListTypeMixedKeys1 []MultiKeyItem `json:"alphaListTypeMixedKeys1"`
+
+	// Case: Alpha listType, Standard Key1, Alpha Key2
+	// +k8s:alpha=+k8s:listType=map
+	// +k8s:listMapKey=key1
+	// +k8s:alpha=+k8s:listMapKey=key2
+	AlphaListTypeMixedKeys2 []MultiKeyItem `json:"alphaListTypeMixedKeys2"`
+
+	// Case: Standard listType, Beta Key1, Standard Key2
+	// +k8s:listType=map
+	// +k8s:beta=+k8s:listMapKey=key1
+	// +k8s:listMapKey=key2
+	StandardListTypeMixedKeysBeta1 []MultiKeyItem `json:"standardListTypeMixedKeysBeta1"`
+
+	// Case: Standard listType, Standard Key1, Beta Key2
+	// +k8s:listType=map
+	// +k8s:listMapKey=key1
+	// +k8s:beta=+k8s:listMapKey=key2
+	StandardListTypeMixedKeysBeta2 []MultiKeyItem `json:"standardListTypeMixedKeysBeta2"`
+
+	// Case: Beta listType, Beta Key1, Standard Key2
+	// +k8s:beta=+k8s:listType=map
+	// +k8s:beta=+k8s:listMapKey=key1
+	// +k8s:listMapKey=key2
+	BetaListTypeMixedKeys1 []MultiKeyItem `json:"betaListTypeMixedKeys1"`
+
+	// Case: Beta listType, Standard Key1, Beta Key2
+	// +k8s:beta=+k8s:listType=map
+	// +k8s:listMapKey=key1
+	// +k8s:beta=+k8s:listMapKey=key2
+	BetaListTypeMixedKeys2 []MultiKeyItem `json:"betaListTypeMixedKeys2"`
+
+	// Case: Beta listType, Standard Key
+	// +k8s:beta=+k8s:listType=map
+	// +k8s:listMapKey=key
+	BetaListTypeStandardKey []MapItem `json:"betaListTypeStandardKey"`
+
+	// Case: Standard listType, Beta Key
+	// +k8s:listType=map
+	// +k8s:beta=+k8s:listMapKey=key
+	StandardListTypeBetaKey []MapItem `json:"standardListTypeBetaKey"`
+
+	// Case: Beta listType, Beta Key
+	// +k8s:beta=+k8s:listType=map
+	// +k8s:beta=+k8s:listMapKey=key
+	BetaListTypeBetaKey []MapItem `json:"betaListTypeBetaKey"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listkeys/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listkeys/doc_test.go
new file mode 100644
index 0000000000..b18ccd769c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listkeys/doc_test.go
@@ -0,0 +1,147 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package listkeys
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestListKeys(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&ListKeyStruct{
+		// Case 1: Alpha listType, Standard Key
+		AlphaListTypeStandardKey: []MapItem{
+			{Key: "a", Value: 1},
+			{Key: "a", Value: 2},
+		},
+		// Case 2: Standard listType, Alpha Key
+		StandardListTypeAlphaKey: []MapItem{
+			{Key: "b", Value: 1},
+			{Key: "b", Value: 2},
+		},
+		// Case 3: Alpha listType, Alpha Key
+		AlphaListTypeAlphaKey: []MapItem{
+			{Key: "c", Value: 1},
+			{Key: "c", Value: 2},
+		},
+		// Case 4: Standard listType, Alpha Key1, Standard Key2
+		StandardListTypeMixedKeys1: []MultiKeyItem{
+			{Key1: "d", Key2: 1, Value: 1},
+			{Key1: "d", Key2: 1, Value: 2},
+		},
+		// Case 5: Standard listType, Standard Key1, Alpha Key2
+		StandardListTypeMixedKeys2: []MultiKeyItem{
+			{Key1: "e", Key2: 1, Value: 1},
+			{Key1: "e", Key2: 1, Value: 2},
+		},
+		// Case 6: Alpha listType, Alpha Key1, Standard Key2
+		AlphaListTypeMixedKeys1: []MultiKeyItem{
+			{Key1: "f", Key2: 1, Value: 1},
+			{Key1: "f", Key2: 1, Value: 2},
+		},
+		// Case 7: Alpha listType, Standard Key1, Alpha Key2
+		AlphaListTypeMixedKeys2: []MultiKeyItem{
+			{Key1: "g", Key2: 1, Value: 1},
+			{Key1: "g", Key2: 1, Value: 2},
+		},
+
+		// Case 11: Standard listType, Beta Key1, Standard Key2
+		StandardListTypeMixedKeysBeta1: []MultiKeyItem{
+			{Key1: "k", Key2: 1, Value: 1},
+			{Key1: "k", Key2: 1, Value: 2},
+		},
+		// Case 12: Standard listType, Standard Key1, Beta Key2
+		StandardListTypeMixedKeysBeta2: []MultiKeyItem{
+			{Key1: "l", Key2: 1, Value: 1},
+			{Key1: "l", Key2: 1, Value: 2},
+		},
+		// Case 13: Beta listType, Beta Key1, Standard Key2
+		BetaListTypeMixedKeys1: []MultiKeyItem{
+			{Key1: "m", Key2: 1, Value: 1},
+			{Key1: "m", Key2: 1, Value: 2},
+		},
+		// Case 14: Beta listType, Standard Key1, Beta Key2
+		BetaListTypeMixedKeys2: []MultiKeyItem{
+			{Key1: "n", Key2: 1, Value: 1},
+			{Key1: "n", Key2: 1, Value: 2},
+		},
+
+		// Case 8: Beta listType, Standard Key
+		BetaListTypeStandardKey: []MapItem{
+			{Key: "h", Value: 1},
+			{Key: "h", Value: 2},
+		},
+		// Case 9: Standard listType, Beta Key
+		StandardListTypeBetaKey: []MapItem{
+			{Key: "i", Value: 1},
+			{Key: "i", Value: 2},
+		},
+		// Case 10: Beta listType, Beta Key
+		BetaListTypeBetaKey: []MapItem{
+			{Key: "j", Value: 1},
+			{Key: "j", Value: 2},
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		// Case 1: Alpha listType, Standard Key -> Alpha Error
+		field.Duplicate(field.NewPath("alphaListTypeStandardKey").Index(1), MapItem{Key: "a", Value: 2}).MarkAlpha(),
+
+		// Case 2: Standard listType, Alpha Key -> Normal Error
+		// The alpha key is treated as a functional key for the list validation.
+		field.Duplicate(field.NewPath("standardListTypeAlphaKey").Index(1), MapItem{Key: "b", Value: 2}),
+
+		// Case 3: Alpha listType, Alpha Key -> Alpha Error
+		field.Duplicate(field.NewPath("alphaListTypeAlphaKey").Index(1), MapItem{Key: "c", Value: 2}).MarkAlpha(),
+
+		// Case 4: Standard listType, Alpha Key1, Standard Key2 -> Normal Error
+		// Both keys participate in the uniqueness check.
+		field.Duplicate(field.NewPath("standardListTypeMixedKeys1").Index(1), MultiKeyItem{Key1: "d", Key2: 1, Value: 2}),
+
+		// Case 5: Standard listType, Standard Key1, Alpha Key2 -> Normal Error
+		field.Duplicate(field.NewPath("standardListTypeMixedKeys2").Index(1), MultiKeyItem{Key1: "e", Key2: 1, Value: 2}),
+
+		// Case 6: Alpha listType, Alpha Key1, Standard Key2 -> Alpha Error
+		field.Duplicate(field.NewPath("alphaListTypeMixedKeys1").Index(1), MultiKeyItem{Key1: "f", Key2: 1, Value: 2}).MarkAlpha(),
+
+		// Case 7: Alpha listType, Standard Key1, Alpha Key2 -> Alpha Error
+		field.Duplicate(field.NewPath("alphaListTypeMixedKeys2").Index(1), MultiKeyItem{Key1: "g", Key2: 1, Value: 2}).MarkAlpha(),
+
+		// Case 11: Standard listType, Beta Key1, Standard Key2 -> Normal Error
+		field.Duplicate(field.NewPath("standardListTypeMixedKeysBeta1").Index(1), MultiKeyItem{Key1: "k", Key2: 1, Value: 2}),
+
+		// Case 12: Standard listType, Standard Key1, Beta Key2 -> Normal Error
+		field.Duplicate(field.NewPath("standardListTypeMixedKeysBeta2").Index(1), MultiKeyItem{Key1: "l", Key2: 1, Value: 2}),
+
+		// Case 13: Beta listType, Beta Key1, Standard Key2 -> Beta Error
+		field.Duplicate(field.NewPath("betaListTypeMixedKeys1").Index(1), MultiKeyItem{Key1: "m", Key2: 1, Value: 2}).MarkBeta(),
+
+		// Case 14: Beta listType, Standard Key1, Beta Key2 -> Beta Error
+		field.Duplicate(field.NewPath("betaListTypeMixedKeys2").Index(1), MultiKeyItem{Key1: "n", Key2: 1, Value: 2}).MarkBeta(),
+
+		// Case 8: Beta listType, Standard Key -> Beta Error
+		field.Duplicate(field.NewPath("betaListTypeStandardKey").Index(1), MapItem{Key: "h", Value: 2}).MarkBeta(),
+
+		// Case 9: Standard listType, Beta Key -> Normal Error
+		// The beta key is treated as a functional key for the list validation.
+		field.Duplicate(field.NewPath("standardListTypeBetaKey").Index(1), MapItem{Key: "i", Value: 2}),
+
+		// Case 10: Beta listType, Beta Key -> Beta Error
+		field.Duplicate(field.NewPath("betaListTypeBetaKey").Index(1), MapItem{Key: "j", Value: 2}).MarkBeta(),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listkeys/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listkeys/zz_generated.validations.go
new file mode 100644
index 0000000000..03459d0929
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listkeys/zz_generated.validations.go
@@ -0,0 +1,432 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package listkeys
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type ListKeyStruct
+	scheme.AddValidationFunc(
+		(*ListKeyStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ListKeyStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*ListKeyStruct),
+					safe.Cast[*ListKeyStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_ListKeyStruct validates an instance of ListKeyStruct according
+// to declarative validation rules in the API schema.
+func Validate_ListKeyStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ListKeyStruct) (errs field.ErrorList) {
+
+	// field ListKeyStruct.TypeMeta has no validation
+
+	{ // field ListKeyStruct.AlphaListTypeStandardKey
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MapItem, b *MapItem) bool { return a.Key == b.Key }).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListKeyStruct) []MapItem {
+				return oldObj.AlphaListTypeStandardKey
+			})
+		errs = append(errs, fn(fldPath.Child("alphaListTypeStandardKey"), obj.AlphaListTypeStandardKey, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListKeyStruct.StandardListTypeAlphaKey
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MapItem, b *MapItem) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListKeyStruct) []MapItem {
+				return oldObj.StandardListTypeAlphaKey
+			})
+		errs = append(errs, fn(fldPath.Child("standardListTypeAlphaKey"), obj.StandardListTypeAlphaKey, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListKeyStruct.AlphaListTypeAlphaKey
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MapItem, b *MapItem) bool { return a.Key == b.Key }).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListKeyStruct) []MapItem {
+				return oldObj.AlphaListTypeAlphaKey
+			})
+		errs = append(errs, fn(fldPath.Child("alphaListTypeAlphaKey"), obj.AlphaListTypeAlphaKey, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListKeyStruct.StandardListTypeMixedKeys1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MultiKeyItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MultiKeyItem, b *MultiKeyItem) bool { return a.Key1 == b.Key1 && a.Key2 == b.Key2 }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListKeyStruct) []MultiKeyItem {
+				return oldObj.StandardListTypeMixedKeys1
+			})
+		errs = append(errs, fn(fldPath.Child("standardListTypeMixedKeys1"), obj.StandardListTypeMixedKeys1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListKeyStruct.StandardListTypeMixedKeys2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MultiKeyItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MultiKeyItem, b *MultiKeyItem) bool { return a.Key2 == b.Key2 && a.Key1 == b.Key1 }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListKeyStruct) []MultiKeyItem {
+				return oldObj.StandardListTypeMixedKeys2
+			})
+		errs = append(errs, fn(fldPath.Child("standardListTypeMixedKeys2"), obj.StandardListTypeMixedKeys2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListKeyStruct.AlphaListTypeMixedKeys1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MultiKeyItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MultiKeyItem, b *MultiKeyItem) bool { return a.Key1 == b.Key1 && a.Key2 == b.Key2 }).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListKeyStruct) []MultiKeyItem {
+				return oldObj.AlphaListTypeMixedKeys1
+			})
+		errs = append(errs, fn(fldPath.Child("alphaListTypeMixedKeys1"), obj.AlphaListTypeMixedKeys1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListKeyStruct.AlphaListTypeMixedKeys2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MultiKeyItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MultiKeyItem, b *MultiKeyItem) bool { return a.Key2 == b.Key2 && a.Key1 == b.Key1 }).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListKeyStruct) []MultiKeyItem {
+				return oldObj.AlphaListTypeMixedKeys2
+			})
+		errs = append(errs, fn(fldPath.Child("alphaListTypeMixedKeys2"), obj.AlphaListTypeMixedKeys2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListKeyStruct.StandardListTypeMixedKeysBeta1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MultiKeyItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MultiKeyItem, b *MultiKeyItem) bool { return a.Key1 == b.Key1 && a.Key2 == b.Key2 }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListKeyStruct) []MultiKeyItem {
+				return oldObj.StandardListTypeMixedKeysBeta1
+			})
+		errs = append(errs, fn(fldPath.Child("standardListTypeMixedKeysBeta1"), obj.StandardListTypeMixedKeysBeta1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListKeyStruct.StandardListTypeMixedKeysBeta2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MultiKeyItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MultiKeyItem, b *MultiKeyItem) bool { return a.Key2 == b.Key2 && a.Key1 == b.Key1 }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListKeyStruct) []MultiKeyItem {
+				return oldObj.StandardListTypeMixedKeysBeta2
+			})
+		errs = append(errs, fn(fldPath.Child("standardListTypeMixedKeysBeta2"), obj.StandardListTypeMixedKeysBeta2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListKeyStruct.BetaListTypeMixedKeys1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MultiKeyItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MultiKeyItem, b *MultiKeyItem) bool { return a.Key1 == b.Key1 && a.Key2 == b.Key2 }).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListKeyStruct) []MultiKeyItem {
+				return oldObj.BetaListTypeMixedKeys1
+			})
+		errs = append(errs, fn(fldPath.Child("betaListTypeMixedKeys1"), obj.BetaListTypeMixedKeys1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListKeyStruct.BetaListTypeMixedKeys2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MultiKeyItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MultiKeyItem, b *MultiKeyItem) bool { return a.Key2 == b.Key2 && a.Key1 == b.Key1 }).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListKeyStruct) []MultiKeyItem {
+				return oldObj.BetaListTypeMixedKeys2
+			})
+		errs = append(errs, fn(fldPath.Child("betaListTypeMixedKeys2"), obj.BetaListTypeMixedKeys2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListKeyStruct.BetaListTypeStandardKey
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MapItem, b *MapItem) bool { return a.Key == b.Key }).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListKeyStruct) []MapItem {
+				return oldObj.BetaListTypeStandardKey
+			})
+		errs = append(errs, fn(fldPath.Child("betaListTypeStandardKey"), obj.BetaListTypeStandardKey, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListKeyStruct.StandardListTypeBetaKey
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MapItem, b *MapItem) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListKeyStruct) []MapItem {
+				return oldObj.StandardListTypeBetaKey
+			})
+		errs = append(errs, fn(fldPath.Child("standardListTypeBetaKey"), obj.StandardListTypeBetaKey, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListKeyStruct.BetaListTypeBetaKey
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MapItem, b *MapItem) bool { return a.Key == b.Key }).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListKeyStruct) []MapItem {
+				return oldObj.BetaListTypeBetaKey
+			})
+		errs = append(errs, fn(fldPath.Child("betaListTypeBetaKey"), obj.BetaListTypeBetaKey, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listmapitem/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listmapitem/doc.go
new file mode 100644
index 0000000000..864a390dc1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listmapitem/doc.go
@@ -0,0 +1,80 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// +k8s:validation-gen-nolint
+package listmapitem
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type MapItem struct {
+	Key   string `json:"key"`
+	Value int    `json:"value"`
+}
+
+type InnerItem struct {
+	Value int `json:"value"`
+}
+
+type ListMapItemStruct struct {
+	TypeMeta int
+
+	// Case: Standard Item
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:item(key: "foo")=+k8s:subfield(value)=+k8s:minimum=10
+	StandardItem []MapItem `json:"standardItem"`
+
+	// Case: Alpha Item tag
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:alpha=+k8s:item(key: "foo")=+k8s:subfield(value)=+k8s:minimum=10
+	AlphaItemTag []MapItem `json:"alphaItemTag"`
+
+	// Case: Alpha validation
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:item(key: "foo")=+k8s:subfield(value)=+k8s:alpha=+k8s:minimum=10
+	AlphaValidation []MapItem `json:"alphaValidation"`
+
+	// Case: Double Alpha
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:alpha=+k8s:item(key: "foo")=+k8s:subfield(value)=+k8s:alpha=+k8s:minimum=10
+	DoubleAlpha []MapItem `json:"doubleAlpha"`
+
+	// Case: Beta Item tag
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:beta=+k8s:item(key: "foo")=+k8s:subfield(value)=+k8s:minimum=10
+	BetaItemTag []MapItem `json:"betaItemTag"`
+
+	// Case: Beta validation
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:item(key: "foo")=+k8s:subfield(value)=+k8s:beta=+k8s:minimum=10
+	BetaValidation []MapItem `json:"betaValidation"`
+
+	// Case: Double Beta
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:beta=+k8s:item(key: "foo")=+k8s:subfield(value)=+k8s:beta=+k8s:minimum=10
+	DoubleBeta []MapItem `json:"doubleBeta"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listmapitem/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listmapitem/doc_test.go
new file mode 100644
index 0000000000..282da8b0ff
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listmapitem/doc_test.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package listmapitem
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestListMapItem(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&ListMapItemStruct{
+		StandardItem:    []MapItem{{Key: "foo", Value: 5}},
+		AlphaItemTag:    []MapItem{{Key: "foo", Value: 5}},
+		AlphaValidation: []MapItem{{Key: "foo", Value: 5}},
+		DoubleAlpha:     []MapItem{{Key: "foo", Value: 5}},
+
+		BetaItemTag:    []MapItem{{Key: "foo", Value: 5}},
+		BetaValidation: []MapItem{{Key: "foo", Value: 5}},
+		DoubleBeta:     []MapItem{{Key: "foo", Value: 5}},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		// Case 1: Standard Item -> Normal Error
+		field.Invalid(field.NewPath("standardItem").Index(0).Child("value"), 5, "").WithOrigin("minimum"),
+
+		// Case 2: Alpha Item tag -> Alpha Error
+		field.Invalid(field.NewPath("alphaItemTag").Index(0).Child("value"), 5, "").WithOrigin("minimum").MarkAlpha(),
+
+		// Case 3: Alpha validation -> Alpha Error
+		field.Invalid(field.NewPath("alphaValidation").Index(0).Child("value"), 5, "").WithOrigin("minimum").MarkAlpha(),
+
+		// Case 4: Double Alpha -> Alpha Error
+		field.Invalid(field.NewPath("doubleAlpha").Index(0).Child("value"), 5, "").WithOrigin("minimum").MarkAlpha(),
+
+		// Case 5: Beta Item tag -> Beta Error
+		field.Invalid(field.NewPath("betaItemTag").Index(0).Child("value"), 5, "").WithOrigin("minimum").MarkBeta(),
+
+		// Case 6: Beta validation -> Beta Error
+		field.Invalid(field.NewPath("betaValidation").Index(0).Child("value"), 5, "").WithOrigin("minimum").MarkBeta(),
+
+		// Case 7: Double Beta -> Beta Error
+		field.Invalid(field.NewPath("doubleBeta").Index(0).Child("value"), 5, "").WithOrigin("minimum").MarkBeta(),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listmapitem/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listmapitem/zz_generated.validations.go
new file mode 100644
index 0000000000..ce12c926e1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listmapitem/zz_generated.validations.go
@@ -0,0 +1,341 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package listmapitem
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type ListMapItemStruct
+	scheme.AddValidationFunc(
+		(*ListMapItemStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ListMapItemStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*ListMapItemStruct),
+					safe.Cast[*ListMapItemStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_ListMapItemStruct validates an instance of ListMapItemStruct according
+// to declarative validation rules in the API schema.
+func Validate_ListMapItemStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ListMapItemStruct) (errs field.ErrorList) {
+
+	// field ListMapItemStruct.TypeMeta has no validation
+
+	{ // field ListMapItemStruct.StandardItem
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MapItem, b *MapItem) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key": "foo"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *MapItem) bool { return item.Key == "foo" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MapItem) field.ErrorList {
+						return validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+							func(o *MapItem) *int { return &o.Value }, validate.DirectEqual,
+							func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+								return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10)
+							})
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListMapItemStruct) []MapItem {
+				return oldObj.StandardItem
+			})
+		errs = append(errs, fn(fldPath.Child("standardItem"), obj.StandardItem, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListMapItemStruct.AlphaItemTag
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MapItem, b *MapItem) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key": "foo"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *MapItem) bool { return item.Key == "foo" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MapItem) field.ErrorList {
+						return validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+							func(o *MapItem) *int { return &o.Value }, validate.DirectEqual,
+							func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+								return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10)
+							})
+					}).MarkAlpha(); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListMapItemStruct) []MapItem {
+				return oldObj.AlphaItemTag
+			})
+		errs = append(errs, fn(fldPath.Child("alphaItemTag"), obj.AlphaItemTag, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListMapItemStruct.AlphaValidation
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MapItem, b *MapItem) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key": "foo"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *MapItem) bool { return item.Key == "foo" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MapItem) field.ErrorList {
+						return validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+							func(o *MapItem) *int { return &o.Value }, validate.DirectEqual,
+							func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+								return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10).MarkAlpha()
+							})
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListMapItemStruct) []MapItem {
+				return oldObj.AlphaValidation
+			})
+		errs = append(errs, fn(fldPath.Child("alphaValidation"), obj.AlphaValidation, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListMapItemStruct.DoubleAlpha
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MapItem, b *MapItem) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key": "foo"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *MapItem) bool { return item.Key == "foo" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MapItem) field.ErrorList {
+						return validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+							func(o *MapItem) *int { return &o.Value }, validate.DirectEqual,
+							func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+								return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10).MarkAlpha()
+							})
+					}).MarkAlpha(); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListMapItemStruct) []MapItem {
+				return oldObj.DoubleAlpha
+			})
+		errs = append(errs, fn(fldPath.Child("doubleAlpha"), obj.DoubleAlpha, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListMapItemStruct.BetaItemTag
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MapItem, b *MapItem) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key": "foo"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *MapItem) bool { return item.Key == "foo" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MapItem) field.ErrorList {
+						return validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+							func(o *MapItem) *int { return &o.Value }, validate.DirectEqual,
+							func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+								return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10)
+							})
+					}).MarkBeta(); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListMapItemStruct) []MapItem {
+				return oldObj.BetaItemTag
+			})
+		errs = append(errs, fn(fldPath.Child("betaItemTag"), obj.BetaItemTag, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListMapItemStruct.BetaValidation
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MapItem, b *MapItem) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key": "foo"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *MapItem) bool { return item.Key == "foo" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MapItem) field.ErrorList {
+						return validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+							func(o *MapItem) *int { return &o.Value }, validate.DirectEqual,
+							func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+								return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10).MarkBeta()
+							})
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListMapItemStruct) []MapItem {
+				return oldObj.BetaValidation
+			})
+		errs = append(errs, fn(fldPath.Child("betaValidation"), obj.BetaValidation, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListMapItemStruct.DoubleBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MapItem, b *MapItem) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key": "foo"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *MapItem) bool { return item.Key == "foo" }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MapItem) field.ErrorList {
+						return validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+							func(o *MapItem) *int { return &o.Value }, validate.DirectEqual,
+							func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+								return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10).MarkBeta()
+							})
+					}).MarkBeta(); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListMapItemStruct) []MapItem {
+				return oldObj.DoubleBeta
+			})
+		errs = append(errs, fn(fldPath.Child("doubleBeta"), obj.DoubleBeta, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listset/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listset/doc.go
new file mode 100644
index 0000000000..5676d6e733
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listset/doc.go
@@ -0,0 +1,72 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// +k8s:validation-gen-nolint
+package listset
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type ListSetStruct struct {
+	TypeMeta int
+
+	// Case: Alpha listType=set
+	// +k8s:alpha=+k8s:listType=set
+	Set []ComplexSetItem `json:"set"`
+
+	// Case: Beta listType=set
+	// +k8s:beta=+k8s:listType=set
+	BetaSet []ComplexSetItem `json:"betaSet"`
+
+	// Case: Chained subfield validation
+	// +k8s:listType=set
+	// +k8s:eachVal=+k8s:subfield(value)=+k8s:alpha=+k8s:minimum=10
+	ChainedSubfieldSet []SimpleSetItem `json:"chainedSubfieldSet"`
+
+	// Case: Alpha listType=set, Beta item validation
+	// +k8s:alpha=+k8s:listType=set
+	SetBetaItem []ComplexSetItemBeta `json:"setBetaItem"`
+
+	// Case: Beta listType=set, Beta item validation
+	// +k8s:beta=+k8s:listType=set
+	BetaSetBetaItem []ComplexSetItemBeta `json:"betaSetBetaItem"`
+
+	// Case: Chained subfield validation (Beta)
+	// +k8s:listType=set
+	// +k8s:eachVal=+k8s:subfield(value)=+k8s:beta=+k8s:minimum=10
+	ChainedSubfieldSetBeta []SimpleSetItem `json:"chainedSubfieldSetBeta"`
+}
+
+type ComplexSetItem struct {
+	// +k8s:alpha=+k8s:minimum=10
+	Value     int    `json:"value"`
+	StringVal string `json:"stringVal"`
+}
+
+type ComplexSetItemBeta struct {
+	// +k8s:beta=+k8s:minimum=10
+	Value     int    `json:"value"`
+	StringVal string `json:"stringVal"`
+}
+
+type SimpleSetItem struct {
+	Value     int    `json:"value"`
+	StringVal string `json:"stringVal"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listset/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listset/doc_test.go
new file mode 100644
index 0000000000..24ffc0e147
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listset/doc_test.go
@@ -0,0 +1,70 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package listset
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestListSet(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&ListSetStruct{
+		Set: []ComplexSetItem{
+			{StringVal: "abc", Value: 10},
+			{StringVal: "abc", Value: 10}, // Duplicate value (alpha)
+		},
+		BetaSet: []ComplexSetItem{
+			{StringVal: "abc", Value: 10},
+			{StringVal: "abc", Value: 10}, // Duplicate value (beta)
+		},
+		ChainedSubfieldSet: []SimpleSetItem{
+			{StringVal: "def", Value: 9}, // Value 9 < 10 (alpha)
+		},
+		SetBetaItem: []ComplexSetItemBeta{
+			{StringVal: "ghi", Value: 10},
+			{StringVal: "ghi", Value: 10}, // Duplicate value (alpha)
+		},
+		BetaSetBetaItem: []ComplexSetItemBeta{
+			{StringVal: "jkl", Value: 10},
+			{StringVal: "jkl", Value: 10}, // Duplicate value (beta)
+		},
+		ChainedSubfieldSetBeta: []SimpleSetItem{
+			{StringVal: "mno", Value: 9}, // Value 9 < 10 (beta)
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		// Set: Duplicate value is SHADOWED
+		field.Duplicate(field.NewPath("set").Index(1), ComplexSetItem{StringVal: "abc", Value: 10}).MarkAlpha(),
+
+		// BetaSet: Duplicate value is SHADOWED
+		field.Duplicate(field.NewPath("betaSet").Index(1), ComplexSetItem{StringVal: "abc", Value: 10}).MarkBeta(),
+
+		// ChainedSubfieldSet: Value 9 < 10 is SHADOWED
+		field.Invalid(field.NewPath("chainedSubfieldSet").Index(0).Child("value"), 9, "").WithOrigin("minimum").MarkAlpha(),
+
+		// SetBetaItem: Duplicate value is SHADOWED (Alpha list)
+		field.Duplicate(field.NewPath("setBetaItem").Index(1), ComplexSetItemBeta{StringVal: "ghi", Value: 10}).MarkAlpha(),
+
+		// BetaSetBetaItem: Duplicate value is SHADOWED (Beta list)
+		field.Duplicate(field.NewPath("betaSetBetaItem").Index(1), ComplexSetItemBeta{StringVal: "jkl", Value: 10}).MarkBeta(),
+
+		// ChainedSubfieldSetBeta: Value 9 < 10 is SHADOWED (Beta item)
+		field.Invalid(field.NewPath("chainedSubfieldSetBeta").Index(0).Child("value"), 9, "").WithOrigin("minimum").MarkBeta(),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listset/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listset/zz_generated.validations.go
new file mode 100644
index 0000000000..cacb1561e3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/listset/zz_generated.validations.go
@@ -0,0 +1,322 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package listset
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type ListSetStruct
+	scheme.AddValidationFunc(
+		(*ListSetStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ListSetStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*ListSetStruct),
+					safe.Cast[*ListSetStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_ComplexSetItem validates an instance of ComplexSetItem according
+// to declarative validation rules in the API schema.
+func Validate_ComplexSetItem(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ComplexSetItem) (errs field.ErrorList) {
+
+	{ // field ComplexSetItem.Value
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 10).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ComplexSetItem) *int {
+				return &oldObj.Value
+			})
+		errs = append(errs, fn(fldPath.Child("value"), &obj.Value, oldVal, oldObj != nil)...)
+	}
+
+	// field ComplexSetItem.StringVal has no validation
+	return errs
+}
+
+// Validate_ComplexSetItemBeta validates an instance of ComplexSetItemBeta according
+// to declarative validation rules in the API schema.
+func Validate_ComplexSetItemBeta(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ComplexSetItemBeta) (errs field.ErrorList) {
+
+	{ // field ComplexSetItemBeta.Value
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 10).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ComplexSetItemBeta) *int {
+				return &oldObj.Value
+			})
+		errs = append(errs, fn(fldPath.Child("value"), &obj.Value, oldVal, oldObj != nil)...)
+	}
+
+	// field ComplexSetItemBeta.StringVal has no validation
+	return errs
+}
+
+// Validate_ListSetStruct validates an instance of ListSetStruct according
+// to declarative validation rules in the API schema.
+func Validate_ListSetStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ListSetStruct) (errs field.ErrorList) {
+
+	// field ListSetStruct.TypeMeta has no validation
+
+	{ // field ListSetStruct.Set
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ComplexSetItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, nil, Validate_ComplexSetItem); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListSetStruct) []ComplexSetItem {
+				return oldObj.Set
+			})
+		errs = append(errs, fn(fldPath.Child("set"), obj.Set, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListSetStruct.BetaSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ComplexSetItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, nil, Validate_ComplexSetItem); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListSetStruct) []ComplexSetItem {
+				return oldObj.BetaSet
+			})
+		errs = append(errs, fn(fldPath.Child("betaSet"), obj.BetaSet, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListSetStruct.ChainedSubfieldSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []SimpleSetItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *SimpleSetItem) field.ErrorList {
+					return validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+						func(o *SimpleSetItem) *int { return &o.Value }, validate.DirectEqual,
+						func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+							return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10).MarkAlpha()
+						})
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListSetStruct) []SimpleSetItem {
+				return oldObj.ChainedSubfieldSet
+			})
+		errs = append(errs, fn(fldPath.Child("chainedSubfieldSet"), obj.ChainedSubfieldSet, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListSetStruct.SetBetaItem
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ComplexSetItemBeta,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, nil, Validate_ComplexSetItemBeta); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListSetStruct) []ComplexSetItemBeta {
+				return oldObj.SetBetaItem
+			})
+		errs = append(errs, fn(fldPath.Child("setBetaItem"), obj.SetBetaItem, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListSetStruct.BetaSetBetaItem
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ComplexSetItemBeta,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, nil, Validate_ComplexSetItemBeta); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListSetStruct) []ComplexSetItemBeta {
+				return oldObj.BetaSetBetaItem
+			})
+		errs = append(errs, fn(fldPath.Child("betaSetBetaItem"), obj.BetaSetBetaItem, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ListSetStruct.ChainedSubfieldSetBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []SimpleSetItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *SimpleSetItem) field.ErrorList {
+					return validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+						func(o *SimpleSetItem) *int { return &o.Value }, validate.DirectEqual,
+						func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+							return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10).MarkBeta()
+						})
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ListSetStruct) []SimpleSetItem {
+				return oldObj.ChainedSubfieldSetBeta
+			})
+		errs = append(errs, fn(fldPath.Child("chainedSubfieldSetBeta"), obj.ChainedSubfieldSetBeta, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/mapvalidation/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/mapvalidation/doc.go
new file mode 100644
index 0000000000..a69b892f17
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/mapvalidation/doc.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// +k8s:validation-gen-nolint
+package mapvalidation
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type MapValidationStruct struct {
+	TypeMeta int
+
+	// Case: Standard eachVal
+	// +k8s:eachVal=+k8s:maxLength=2
+	StandardEachVal map[string]string `json:"standardEachVal"`
+
+	// Case: Alpha eachVal
+	// +k8s:alpha=+k8s:eachVal=+k8s:maxLength=2
+	AlphaEachVal map[string]string `json:"AlphaEachVal"`
+
+	// Case: Beta eachVal
+	// +k8s:beta=+k8s:eachVal=+k8s:maxLength=2
+	BetaEachVal map[string]string `json:"BetaEachVal"`
+
+	// Case: Standard eachKey
+	// +k8s:eachKey=+k8s:maxLength=2
+	StandardEachKey map[string]string `json:"standardEachKey"`
+
+	// Case: Alpha eachKey
+	// +k8s:alpha=+k8s:eachKey=+k8s:maxLength=2
+	AlphaEachKey map[string]string `json:"AlphaEachKey"`
+
+	// Case: Beta eachKey
+	// +k8s:beta=+k8s:eachKey=+k8s:maxLength=2
+	BetaEachKey map[string]string `json:"BetaEachKey"`
+
+	// Case: Alpha Validation
+	// +k8s:eachVal=+k8s:alpha=+k8s:maxLength=2
+	AlphaValidation map[string]string `json:"AlphaValidation"`
+
+	// Case: Beta Validation
+	// +k8s:eachVal=+k8s:beta=+k8s:maxLength=2
+	BetaValidation map[string]string `json:"BetaValidation"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/mapvalidation/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/mapvalidation/doc_test.go
new file mode 100644
index 0000000000..b8239c06e5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/mapvalidation/doc_test.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mapvalidation
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestMapValidation(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&MapValidationStruct{
+		StandardEachVal: map[string]string{"a": "foo"},
+		AlphaEachVal:    map[string]string{"a": "foo"},
+		BetaEachVal:     map[string]string{"a": "foo"},
+		StandardEachKey: map[string]string{"foo": "a"},
+		AlphaEachKey:    map[string]string{"foo": "a"},
+		BetaEachKey:     map[string]string{"foo": "a"},
+		AlphaValidation: map[string]string{"a": "foo"},
+		BetaValidation:  map[string]string{"a": "foo"},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		// Case: Standard eachVal -> Normal Error
+		field.TooLong(field.NewPath("standardEachVal").Key("a"), "foo", 2).WithOrigin("maxLength"),
+
+		// Case: Alpha eachVal -> Alpha Error
+		field.TooLong(field.NewPath("AlphaEachVal").Key("a"), "foo", 2).WithOrigin("maxLength").MarkAlpha(),
+
+		// Case: Beta eachVal -> Beta Error
+		field.TooLong(field.NewPath("BetaEachVal").Key("a"), "foo", 2).WithOrigin("maxLength").MarkBeta(),
+
+		// Case: Standard eachKey -> Normal Error
+		field.TooLong(field.NewPath("standardEachKey"), "foo", 2).WithOrigin("maxLength"),
+
+		// Case: Alpha eachKey -> Alpha Error
+		field.TooLong(field.NewPath("AlphaEachKey"), "foo", 2).WithOrigin("maxLength").MarkAlpha(),
+
+		// Case: Beta eachKey -> Beta Error
+		field.TooLong(field.NewPath("BetaEachKey"), "foo", 2).WithOrigin("maxLength").MarkBeta(),
+
+		// Case: Alpha Validation -> Alpha Error
+		field.TooLong(field.NewPath("AlphaValidation").Key("a"), "foo", 2).WithOrigin("maxLength").MarkAlpha(),
+
+		// Case: Beta Validation -> Beta Error
+		field.TooLong(field.NewPath("BetaValidation").Key("a"), "foo", 2).WithOrigin("maxLength").MarkBeta(),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/mapvalidation/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/mapvalidation/zz_generated.validations.go
new file mode 100644
index 0000000000..1de20c27d7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/mapvalidation/zz_generated.validations.go
@@ -0,0 +1,284 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package mapvalidation
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type MapValidationStruct
+	scheme.AddValidationFunc(
+		(*MapValidationStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_MapValidationStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*MapValidationStruct),
+					safe.Cast[*MapValidationStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_MapValidationStruct validates an instance of MapValidationStruct according
+// to declarative validation rules in the API schema.
+func Validate_MapValidationStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MapValidationStruct) (errs field.ErrorList) {
+
+	// field MapValidationStruct.TypeMeta has no validation
+
+	{ // field MapValidationStruct.StandardEachVal
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.MaxLength(ctx, op, fldPath, obj, oldObj, 2)
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MapValidationStruct) map[string]string {
+				return oldObj.StandardEachVal
+			})
+		errs = append(errs, fn(fldPath.Child("standardEachVal"), obj.StandardEachVal, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MapValidationStruct.AlphaEachVal
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.MaxLength(ctx, op, fldPath, obj, oldObj, 2)
+				}).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MapValidationStruct) map[string]string {
+				return oldObj.AlphaEachVal
+			})
+		errs = append(errs, fn(fldPath.Child("AlphaEachVal"), obj.AlphaEachVal, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MapValidationStruct.BetaEachVal
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.MaxLength(ctx, op, fldPath, obj, oldObj, 2)
+				}).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MapValidationStruct) map[string]string {
+				return oldObj.BetaEachVal
+			})
+		errs = append(errs, fn(fldPath.Child("BetaEachVal"), obj.BetaEachVal, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MapValidationStruct.StandardEachKey
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.MaxLength(ctx, op, fldPath, obj, oldObj, 2)
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MapValidationStruct) map[string]string {
+				return oldObj.StandardEachKey
+			})
+		errs = append(errs, fn(fldPath.Child("standardEachKey"), obj.StandardEachKey, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MapValidationStruct.AlphaEachKey
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.MaxLength(ctx, op, fldPath, obj, oldObj, 2)
+				}).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MapValidationStruct) map[string]string {
+				return oldObj.AlphaEachKey
+			})
+		errs = append(errs, fn(fldPath.Child("AlphaEachKey"), obj.AlphaEachKey, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MapValidationStruct.BetaEachKey
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.MaxLength(ctx, op, fldPath, obj, oldObj, 2)
+				}).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MapValidationStruct) map[string]string {
+				return oldObj.BetaEachKey
+			})
+		errs = append(errs, fn(fldPath.Child("BetaEachKey"), obj.BetaEachKey, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MapValidationStruct.AlphaValidation
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.MaxLength(ctx, op, fldPath, obj, oldObj, 2).MarkAlpha()
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MapValidationStruct) map[string]string {
+				return oldObj.AlphaValidation
+			})
+		errs = append(errs, fn(fldPath.Child("AlphaValidation"), obj.AlphaValidation, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MapValidationStruct.BetaValidation
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.MaxLength(ctx, op, fldPath, obj, oldObj, 2).MarkBeta()
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MapValidationStruct) map[string]string {
+				return oldObj.BetaValidation
+			})
+		errs = append(errs, fn(fldPath.Child("BetaValidation"), obj.BetaValidation, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/modes/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/modes/doc.go
new file mode 100644
index 0000000000..7492f5d075
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/modes/doc.go
@@ -0,0 +1,103 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// +k8s:validation-gen-nolint
+package modes
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type AlphaStruct struct {
+	TypeMeta int
+
+	// +k8s:alpha=+k8s:modeDiscriminator
+	D1 string `json:"d1"`
+
+	// +k8s:alpha=+k8s:ifMode("A")=+k8s:required
+	FieldA *string `json:"fieldA,omitempty"`
+
+	// +k8s:alpha=+k8s:ifMode("B")=+k8s:required
+	FieldB *string `json:"fieldB,omitempty"`
+}
+
+type BetaStruct struct {
+	TypeMeta int
+
+	// +k8s:beta=+k8s:modeDiscriminator
+	D1 string `json:"d1"`
+
+	// +k8s:beta=+k8s:ifMode("A")=+k8s:required
+	FieldA *string `json:"fieldA,omitempty"`
+
+	// +k8s:beta=+k8s:ifMode("B")=+k8s:required
+	FieldB *string `json:"fieldB,omitempty"`
+}
+
+type MixedLevels struct {
+	TypeMeta int
+
+	// +k8s:modeDiscriminator
+	Mode string `json:"mode"`
+
+	// +k8s:alpha=+k8s:ifMode("A")=+k8s:required
+	A *string `json:"a,omitempty"`
+
+	// +k8s:beta=+k8s:ifMode("B")=+k8s:required
+	B *string `json:"b,omitempty"`
+}
+
+type CrossLevels struct {
+	TypeMeta int
+
+	// +k8s:beta=+k8s:modeDiscriminator
+	Kind string `json:"kind"`
+
+	// +k8s:alpha=+k8s:ifMode("A")=+k8s:required
+	A *string `json:"a,omitempty"`
+
+	// +k8s:alpha=+k8s:ifMode("B")=+k8s:required
+	B *string `json:"b,omitempty"`
+}
+
+type SameFieldMixed struct {
+	TypeMeta int
+
+	// +k8s:modeDiscriminator
+	Mode string `json:"mode"`
+
+	// +k8s:alpha=+k8s:ifMode("A")=+k8s:required
+	// +k8s:beta=+k8s:ifMode("B")=+k8s:required
+	Value *string `json:"value,omitempty"`
+}
+
+// SameValueMixedPayloads tests that multiple payload validations on the same
+// discriminator value can have different stability levels.
+type SameValueMixedPayloads struct {
+	TypeMeta int
+
+	// +k8s:modeDiscriminator
+	Mode string `json:"mode"`
+
+	// +k8s:alpha=+k8s:ifMode("A")=+k8s:required
+	// +k8s:beta=+k8s:ifMode("A")=+k8s:minLength=3
+	Value *string `json:"value,omitempty"`
+}
+
+type TypeMeta int
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/modes/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/modes/doc_test.go
new file mode 100644
index 0000000000..5b00f8e18f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/modes/doc_test.go
@@ -0,0 +1,162 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestAlpha(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Valid: mode A with FieldA set
+	st.Value(&AlphaStruct{D1: "A", FieldA: ptr.To("val")}).ExpectValid()
+
+	// Invalid: mode A with FieldA missing (required), should be stability level alpha
+	st.Value(&AlphaStruct{D1: "A"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Required(field.NewPath("fieldA"), "").MarkAlpha(),
+	})
+
+	// Invalid: mode A with FieldB set (forbidden), should be stability level alpha
+	st.Value(&AlphaStruct{D1: "A", FieldA: ptr.To("val"), FieldB: ptr.To("val")}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Forbidden(field.NewPath("fieldB"), "").MarkAlpha(),
+	})
+
+	// Valid: mode B with FieldB set
+	st.Value(&AlphaStruct{D1: "B", FieldB: ptr.To("val")}).ExpectValid()
+
+	// Invalid: mode B with FieldB missing (required), should be stability level alpha
+	st.Value(&AlphaStruct{D1: "B"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Required(field.NewPath("fieldB"), "").MarkAlpha(),
+	})
+}
+
+func TestBeta(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Valid: mode A with FieldA set
+	st.Value(&BetaStruct{D1: "A", FieldA: ptr.To("val")}).ExpectValid()
+
+	// Invalid: mode A with FieldA missing (required), should be stability level beta
+	st.Value(&BetaStruct{D1: "A"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Required(field.NewPath("fieldA"), "").MarkBeta(),
+	})
+
+	// Invalid: mode A with FieldB set (forbidden), should be stability level beta
+	st.Value(&BetaStruct{D1: "A", FieldA: ptr.To("val"), FieldB: ptr.To("val")}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Forbidden(field.NewPath("fieldB"), "").MarkBeta(),
+	})
+
+	// Valid: mode B with FieldB set
+	st.Value(&BetaStruct{D1: "B", FieldB: ptr.To("val")}).ExpectValid()
+
+	// Invalid: mode B with FieldB missing (required), should be stability level beta
+	st.Value(&BetaStruct{D1: "B"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Required(field.NewPath("fieldB"), "").MarkBeta(),
+	})
+}
+
+func TestMixedLevels(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Valid cases
+	st.Value(&MixedLevels{Mode: "A", A: ptr.To("val")}).ExpectValid()
+	st.Value(&MixedLevels{Mode: "B", B: ptr.To("val")}).ExpectValid()
+
+	// Mode=A, missing A -> alpha error (field A is alpha-gated)
+	st.Value(&MixedLevels{Mode: "A"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Required(field.NewPath("a"), "").MarkAlpha(),
+	})
+
+	// Mode=B, missing B -> beta error (field B is beta-gated)
+	st.Value(&MixedLevels{Mode: "B"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Required(field.NewPath("b"), "").MarkBeta(),
+	})
+
+	// Mode=A with B set (forbidden) -> beta error (field B's +k8s:modeDiscriminator is beta)
+	st.Value(&MixedLevels{Mode: "A", A: ptr.To("val"), B: ptr.To("val")}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Forbidden(field.NewPath("b"), "").MarkBeta(),
+	})
+
+	// Mode=B with A set (forbidden) -> alpha error (field A's +k8s:modeDiscriminator is alpha)
+	st.Value(&MixedLevels{Mode: "B", A: ptr.To("val"), B: ptr.To("val")}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Forbidden(field.NewPath("a"), "").MarkAlpha(),
+	})
+}
+
+func TestCrossLevels(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Valid cases
+	st.Value(&CrossLevels{Kind: "A", A: ptr.To("val")}).ExpectValid()
+	st.Value(&CrossLevels{Kind: "B", B: ptr.To("val")}).ExpectValid()
+
+	// Kind=A, missing A -> alpha error (field A is alpha-gated, discriminator is beta)
+	st.Value(&CrossLevels{Kind: "A"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Required(field.NewPath("a"), "").MarkAlpha(),
+	})
+
+	// Kind=B, missing B -> alpha error (field B is alpha-gated, discriminator is beta)
+	st.Value(&CrossLevels{Kind: "B"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Required(field.NewPath("b"), "").MarkAlpha(),
+	})
+
+	// Kind=A with B set (forbidden) -> alpha error (field B's member tag is alpha)
+	st.Value(&CrossLevels{Kind: "A", A: ptr.To("val"), B: ptr.To("val")}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Forbidden(field.NewPath("b"), "").MarkAlpha(),
+	})
+}
+
+func TestSameFieldMixed(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Valid cases
+	st.Value(&SameFieldMixed{Mode: "A", Value: ptr.To("val")}).ExpectValid()
+	st.Value(&SameFieldMixed{Mode: "B", Value: ptr.To("val")}).ExpectValid()
+
+	// Mode=A, missing Value -> alpha error (member("A") is alpha-gated)
+	st.Value(&SameFieldMixed{Mode: "A"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Required(field.NewPath("value"), "").MarkAlpha(),
+	})
+
+	// Mode=B, missing Value -> beta error (member("B") is beta-gated)
+	st.Value(&SameFieldMixed{Mode: "B"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Required(field.NewPath("value"), "").MarkBeta(),
+	})
+}
+
+// TestSameValueMixedPayloads verifies that multiple payload validations on
+// the same discriminator value can have different stability levels.
+func TestSameValueMixedPayloads(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Valid: Mode=A with Value set and long enough
+	st.Value(&SameValueMixedPayloads{Mode: "A", Value: ptr.To("abc")}).ExpectValid()
+
+	// Mode=A, missing Value -> alpha error (required is alpha-gated)
+	st.Value(&SameValueMixedPayloads{Mode: "A"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Required(field.NewPath("value"), "").MarkAlpha(),
+	})
+
+	// Mode=A, Value too short -> beta error (minLength is beta-gated)
+	st.Value(&SameValueMixedPayloads{Mode: "A", Value: ptr.To("ab")}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.TooShort(field.NewPath("value"), "", 3).MarkBeta(),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/modes/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/modes/zz_generated.validations.go
new file mode 100644
index 0000000000..d04788c865
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/modes/zz_generated.validations.go
@@ -0,0 +1,510 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package modes
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type AlphaStruct
+	scheme.AddValidationFunc(
+		(*AlphaStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_AlphaStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*AlphaStruct),
+					safe.Cast[*AlphaStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type BetaStruct
+	scheme.AddValidationFunc(
+		(*BetaStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_BetaStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*BetaStruct),
+					safe.Cast[*BetaStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type CrossLevels
+	scheme.AddValidationFunc(
+		(*CrossLevels)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_CrossLevels(
+					ctx, op, nil, /* fldPath */
+					obj.(*CrossLevels),
+					safe.Cast[*CrossLevels](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type MixedLevels
+	scheme.AddValidationFunc(
+		(*MixedLevels)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_MixedLevels(
+					ctx, op, nil, /* fldPath */
+					obj.(*MixedLevels),
+					safe.Cast[*MixedLevels](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type SameFieldMixed
+	scheme.AddValidationFunc(
+		(*SameFieldMixed)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_SameFieldMixed(
+					ctx, op, nil, /* fldPath */
+					obj.(*SameFieldMixed),
+					safe.Cast[*SameFieldMixed](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type SameValueMixedPayloads
+	scheme.AddValidationFunc(
+		(*SameValueMixedPayloads)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_SameValueMixedPayloads(
+					ctx, op, nil, /* fldPath */
+					obj.(*SameValueMixedPayloads),
+					safe.Cast[*SameValueMixedPayloads](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_AlphaStruct validates an instance of AlphaStruct according
+// to declarative validation rules in the API schema.
+func Validate_AlphaStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *AlphaStruct) (errs field.ErrorList) {
+
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldA",
+		func(obj *AlphaStruct) *string { return obj.FieldA },
+		func(obj *AlphaStruct) string { return obj.D1 }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha()...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "A",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldB",
+		func(obj *AlphaStruct) *string { return obj.FieldB },
+		func(obj *AlphaStruct) string { return obj.D1 }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha()...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "B",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field AlphaStruct.TypeMeta has no validation
+	// field AlphaStruct.D1 has no validation
+	// field AlphaStruct.FieldA has no validation
+	// field AlphaStruct.FieldB has no validation
+	return errs
+}
+
+// Validate_BetaStruct validates an instance of BetaStruct according
+// to declarative validation rules in the API schema.
+func Validate_BetaStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *BetaStruct) (errs field.ErrorList) {
+
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldA",
+		func(obj *BetaStruct) *string { return obj.FieldA },
+		func(obj *BetaStruct) string { return obj.D1 }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "A",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldB",
+		func(obj *BetaStruct) *string { return obj.FieldB },
+		func(obj *BetaStruct) string { return obj.D1 }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "B",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field BetaStruct.TypeMeta has no validation
+	// field BetaStruct.D1 has no validation
+	// field BetaStruct.FieldA has no validation
+	// field BetaStruct.FieldB has no validation
+	return errs
+}
+
+// Validate_CrossLevels validates an instance of CrossLevels according
+// to declarative validation rules in the API schema.
+func Validate_CrossLevels(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *CrossLevels) (errs field.ErrorList) {
+
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "a",
+		func(obj *CrossLevels) *string { return obj.A },
+		func(obj *CrossLevels) string { return obj.Kind }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha()...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "A",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "b",
+		func(obj *CrossLevels) *string { return obj.B },
+		func(obj *CrossLevels) string { return obj.Kind }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha()...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "B",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field CrossLevels.TypeMeta has no validation
+	// field CrossLevels.Kind has no validation
+	// field CrossLevels.A has no validation
+	// field CrossLevels.B has no validation
+	return errs
+}
+
+// Validate_MixedLevels validates an instance of MixedLevels according
+// to declarative validation rules in the API schema.
+func Validate_MixedLevels(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MixedLevels) (errs field.ErrorList) {
+
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "a",
+		func(obj *MixedLevels) *string { return obj.A },
+		func(obj *MixedLevels) string { return obj.Mode }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha()...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "A",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "b",
+		func(obj *MixedLevels) *string { return obj.B },
+		func(obj *MixedLevels) string { return obj.Mode }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "B",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field MixedLevels.TypeMeta has no validation
+	// field MixedLevels.Mode has no validation
+	// field MixedLevels.A has no validation
+	// field MixedLevels.B has no validation
+	return errs
+}
+
+// Validate_SameFieldMixed validates an instance of SameFieldMixed according
+// to declarative validation rules in the API schema.
+func Validate_SameFieldMixed(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *SameFieldMixed) (errs field.ErrorList) {
+
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "value",
+		func(obj *SameFieldMixed) *string { return obj.Value },
+		func(obj *SameFieldMixed) string { return obj.Mode }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj)...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "A",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+
+			{
+				Value: "B",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field SameFieldMixed.TypeMeta has no validation
+	// field SameFieldMixed.Mode has no validation
+	// field SameFieldMixed.Value has no validation
+	return errs
+}
+
+// Validate_SameValueMixedPayloads validates an instance of SameValueMixedPayloads according
+// to declarative validation rules in the API schema.
+func Validate_SameValueMixedPayloads(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *SameValueMixedPayloads) (errs field.ErrorList) {
+
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "value",
+		func(obj *SameValueMixedPayloads) *string { return obj.Value },
+		func(obj *SameValueMixedPayloads) string { return obj.Mode }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj)...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "A",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					errs = append(errs, validate.MinLength(ctx, op, fldPath, obj, oldObj, 3).MarkBeta()...)
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field SameValueMixedPayloads.TypeMeta has no validation
+	// field SameValueMixedPayloads.Mode has no validation
+	// field SameValueMixedPayloads.Value has no validation
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/optionalrequired/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/optionalrequired/doc.go
new file mode 100644
index 0000000000..f9e86247f7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/optionalrequired/doc.go
@@ -0,0 +1,35 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// +k8s:validation-gen-nolint
+package optionalrequired
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:alpha=+k8s:required
+	RequiredField *string `json:"requiredField"`
+
+	// +k8s:beta=+k8s:required
+	RequiredFieldBeta *string `json:"requiredFieldBeta"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/optionalrequired/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/optionalrequired/doc_test.go
new file mode 100644
index 0000000000..92cb8ee44c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/optionalrequired/doc_test.go
@@ -0,0 +1,64 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package optionalrequired
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestAlpha(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		RequiredField:     ptr.To("val"),
+		RequiredFieldBeta: ptr.To("val"),
+	}).ExpectValid()
+
+	// Test failures marked as alpha
+	st.Value(&Struct{
+		RequiredField:     nil,
+		RequiredFieldBeta: ptr.To("val"),
+	}).OldValue(&Struct{
+		RequiredField:     ptr.To("old"),
+		RequiredFieldBeta: ptr.To("old"),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Required(field.NewPath("requiredField"), "").MarkAlpha(),
+	})
+}
+
+func TestBeta(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		RequiredField:     ptr.To("val"),
+		RequiredFieldBeta: ptr.To("val"),
+	}).ExpectValid()
+
+	// Test failures marked as beta
+	st.Value(&Struct{
+		RequiredField:     ptr.To("val"),
+		RequiredFieldBeta: nil,
+	}).OldValue(&Struct{
+		RequiredField:     ptr.To("old"),
+		RequiredFieldBeta: ptr.To("old"),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Required(field.NewPath("requiredFieldBeta"), "").MarkBeta(),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/optionalrequired/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/optionalrequired/zz_generated.validations.go
new file mode 100644
index 0000000000..4e5bd59230
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/optionalrequired/zz_generated.validations.go
@@ -0,0 +1,125 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package optionalrequired
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.RequiredField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.RequiredField
+			})
+		errs = append(errs, fn(fldPath.Child("requiredField"), obj.RequiredField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.RequiredFieldBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.RequiredFieldBeta
+			})
+		errs = append(errs, fn(fldPath.Child("requiredFieldBeta"), obj.RequiredFieldBeta, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/doc.go
new file mode 100644
index 0000000000..e7a66fcd53
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/doc.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// +k8s:validation-gen-nolint
+package simple
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:alpha=+k8s:minimum=10
+	IntField int `json:"intField"`
+
+	// +k8s:beta=+k8s:minimum=10
+	IntFieldBeta int `json:"intFieldBeta"`
+
+	// +k8s:alpha=+k8s:maxLength=5
+	StringField string `json:"stringField"`
+
+	// +k8s:beta=+k8s:maxLength=5
+	StringFieldBeta string `json:"stringFieldBeta"`
+
+	// +k8s:alpha=+k8s:maxItems=2
+	SliceField []string `json:"sliceField"`
+
+	// +k8s:beta=+k8s:maxItems=2
+	SliceFieldBeta []string `json:"sliceFieldBeta"`
+
+	// +k8s:alpha=+k8s:format=k8s-uuid
+	UUIDField string `json:"uuidField"`
+
+	// +k8s:beta=+k8s:format=k8s-uuid
+	UUIDFieldBeta string `json:"uuidFieldBeta"`
+
+	// +k8s:alpha=+k8s:immutable
+	ImmutableField string `json:"immutableField"`
+
+	// +k8s:beta=+k8s:immutable
+	ImmutableFieldBeta string `json:"immutableFieldBeta"`
+}
+
+type SpecialValidationStruct struct {
+	TypeMeta int
+
+	// +k8s:alpha=+k8s:neq=5
+	NEQField int `json:"neqField"`
+
+	// +k8s:beta=+k8s:neq=5
+	NEQFieldBeta int `json:"neqFieldBeta"`
+
+	// +k8s:alpha=+k8s:forbidden
+	ForbiddenField *string `json:"forbiddenField"`
+
+	// +k8s:beta=+k8s:forbidden
+	ForbiddenFieldBeta *string `json:"forbiddenFieldBeta"`
+
+	// +k8s:alpha=+k8s:update=NoModify
+	UpdateField string `json:"updateField"`
+
+	// +k8s:beta=+k8s:update=NoModify
+	UpdateFieldBeta string `json:"updateFieldBeta"`
+}
+
+type StructWithValidateFalse struct {
+	TypeMeta int
+
+	// +k8s:alpha=+k8s:validateFalse="always fails"
+	ValidateFalse *string `json:"validateFalse"`
+
+	// +k8s:beta=+k8s:validateFalse="always fails"
+	ValidateFalseBeta *string `json:"validateFalseBeta"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/doc_test.go
new file mode 100644
index 0000000000..d768f825c4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/doc_test.go
@@ -0,0 +1,140 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package simple
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestAlpha(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		IntField:           10,
+		StringField:        "abc",
+		SliceField:         []string{"a", "b"},
+		UUIDField:          "a0a2a2d2-0b87-4964-a123-78d00a8787a6",
+		ImmutableField:     "foo",
+		IntFieldBeta:       10,
+		StringFieldBeta:    "abc",
+		SliceFieldBeta:     []string{"a", "b"},
+		UUIDFieldBeta:      "a0a2a2d2-0b87-4964-a123-78d00a8787a6",
+		ImmutableFieldBeta: "foo",
+	}).ExpectValid()
+
+	// Test failures marked as alpha
+	st.Value(&Struct{
+		IntField:           5,
+		StringField:        "too-long",
+		SliceField:         []string{"a", "b", "c"},
+		UUIDField:          "not-a-uuid",
+		ImmutableField:     "bar",
+		IntFieldBeta:       10,
+		StringFieldBeta:    "abc",
+		SliceFieldBeta:     []string{"a", "b"},
+		UUIDFieldBeta:      "a0a2a2d2-0b87-4964-a123-78d00a8787a6",
+		ImmutableFieldBeta: "foo",
+	}).OldValue(&Struct{
+		ImmutableField:     "foo",
+		ImmutableFieldBeta: "foo",
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(field.NewPath("intField"), 5, "").WithOrigin("minimum").MarkAlpha(),
+		field.TooLong(field.NewPath("stringField"), "too-long", 5).WithOrigin("maxLength").MarkAlpha(),
+		field.TooMany(field.NewPath("sliceField"), 3, 2).WithOrigin("maxItems").MarkAlpha(),
+		field.Invalid(field.NewPath("uuidField"), "not-a-uuid", "").WithOrigin("format=k8s-uuid").MarkAlpha(),
+		field.Invalid(field.NewPath("immutableField"), "bar", "").WithOrigin("immutable").MarkAlpha(),
+	})
+}
+
+func TestBeta(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		IntField:           10,
+		StringField:        "abc",
+		SliceField:         []string{"a", "b"},
+		UUIDField:          "a0a2a2d2-0b87-4964-a123-78d00a8787a6",
+		ImmutableField:     "foo",
+		IntFieldBeta:       10,
+		StringFieldBeta:    "abc",
+		SliceFieldBeta:     []string{"a", "b"},
+		UUIDFieldBeta:      "a0a2a2d2-0b87-4964-a123-78d00a8787a6",
+		ImmutableFieldBeta: "foo",
+	}).ExpectValid()
+
+	// Test failures marked as beta
+	st.Value(&Struct{
+		IntField:           10,
+		StringField:        "abc",
+		SliceField:         []string{"a", "b"},
+		UUIDField:          "a0a2a2d2-0b87-4964-a123-78d00a8787a6",
+		ImmutableField:     "foo",
+		IntFieldBeta:       5,
+		StringFieldBeta:    "too-long",
+		SliceFieldBeta:     []string{"a", "b", "c"},
+		UUIDFieldBeta:      "not-a-uuid",
+		ImmutableFieldBeta: "bar",
+	}).OldValue(&Struct{
+		ImmutableField:     "foo",
+		ImmutableFieldBeta: "foo",
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(field.NewPath("intFieldBeta"), 5, "").WithOrigin("minimum").MarkBeta(),
+		field.TooLong(field.NewPath("stringFieldBeta"), "too-long", 5).WithOrigin("maxLength").MarkBeta(),
+		field.TooMany(field.NewPath("sliceFieldBeta"), 3, 2).WithOrigin("maxItems").MarkBeta(),
+		field.Invalid(field.NewPath("uuidFieldBeta"), "not-a-uuid", "").WithOrigin("format=k8s-uuid").MarkBeta(),
+		field.Invalid(field.NewPath("immutableFieldBeta"), "bar", "").WithOrigin("immutable").MarkBeta(),
+	})
+}
+
+func TestSpecialValidationStruct(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&SpecialValidationStruct{
+		NEQField:     10,
+		NEQFieldBeta: 10,
+	}).ExpectValid()
+
+	st.Value(&SpecialValidationStruct{
+		NEQField:           5,
+		NEQFieldBeta:       5,
+		ForbiddenField:     ptr.To("val"),
+		ForbiddenFieldBeta: ptr.To("val"),
+		UpdateField:        "new",
+		UpdateFieldBeta:    "new",
+	}).OldValue(&SpecialValidationStruct{
+		UpdateField:     "old",
+		UpdateFieldBeta: "old",
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(field.NewPath("neqField"), 5, "must not be 5").WithOrigin("neq").MarkAlpha(),
+		field.Invalid(field.NewPath("neqFieldBeta"), 5, "must not be 5").WithOrigin("neq").MarkBeta(),
+		field.Forbidden(field.NewPath("forbiddenField"), "").MarkAlpha(),
+		field.Forbidden(field.NewPath("forbiddenFieldBeta"), "").MarkBeta(),
+		field.Invalid(field.NewPath("updateField"), "new", "field cannot be modified once set").WithOrigin("update").MarkAlpha(),
+		field.Invalid(field.NewPath("updateFieldBeta"), "new", "field cannot be modified once set").WithOrigin("update").MarkBeta(),
+	})
+
+	st.Value(&StructWithValidateFalse{
+		ValidateFalse:     ptr.To("val"),
+		ValidateFalseBeta: ptr.To("val"),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(field.NewPath("validateFalse"), "val", "always fails").MarkAlpha(),
+		field.Invalid(field.NewPath("validateFalseBeta"), "val", "always fails").MarkBeta(),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/zz_generated.validations.go
new file mode 100644
index 0000000000..c176df16c8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/zz_generated.validations.go
@@ -0,0 +1,600 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package simple
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type SpecialValidationStruct
+	scheme.AddValidationFunc(
+		(*SpecialValidationStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_SpecialValidationStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*SpecialValidationStruct),
+					safe.Cast[*SpecialValidationStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type StructWithValidateFalse
+	scheme.AddValidationFunc(
+		(*StructWithValidateFalse)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_StructWithValidateFalse(
+					ctx, op, nil, /* fldPath */
+					obj.(*StructWithValidateFalse),
+					safe.Cast[*StructWithValidateFalse](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_SpecialValidationStruct validates an instance of SpecialValidationStruct according
+// to declarative validation rules in the API schema.
+func Validate_SpecialValidationStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *SpecialValidationStruct) (errs field.ErrorList) {
+
+	// field SpecialValidationStruct.TypeMeta has no validation
+
+	{ // field SpecialValidationStruct.NEQField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.NEQ(ctx, op, fldPath, obj, oldObj, 5).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *SpecialValidationStruct) *int {
+				return &oldObj.NEQField
+			})
+		errs = append(errs, fn(fldPath.Child("neqField"), &obj.NEQField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field SpecialValidationStruct.NEQFieldBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.NEQ(ctx, op, fldPath, obj, oldObj, 5).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *SpecialValidationStruct) *int {
+				return &oldObj.NEQFieldBeta
+			})
+		errs = append(errs, fn(fldPath.Child("neqFieldBeta"), &obj.NEQFieldBeta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field SpecialValidationStruct.ForbiddenField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *SpecialValidationStruct) *string {
+				return oldObj.ForbiddenField
+			})
+		errs = append(errs, fn(fldPath.Child("forbiddenField"), obj.ForbiddenField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field SpecialValidationStruct.ForbiddenFieldBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *SpecialValidationStruct) *string {
+				return oldObj.ForbiddenFieldBeta
+			})
+		errs = append(errs, fn(fldPath.Child("forbiddenFieldBeta"), obj.ForbiddenFieldBeta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field SpecialValidationStruct.UpdateField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a string, b string) bool { return a == b }, validate.NoModify).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *SpecialValidationStruct) *string {
+				return &oldObj.UpdateField
+			})
+		errs = append(errs, fn(fldPath.Child("updateField"), &obj.UpdateField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field SpecialValidationStruct.UpdateFieldBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a string, b string) bool { return a == b }, validate.NoModify).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *SpecialValidationStruct) *string {
+				return &oldObj.UpdateFieldBeta
+			})
+		errs = append(errs, fn(fldPath.Child("updateFieldBeta"), &obj.UpdateFieldBeta, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.IntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 10).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return &oldObj.IntField
+			})
+		errs = append(errs, fn(fldPath.Child("intField"), &obj.IntField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntFieldBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 10).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return &oldObj.IntFieldBeta
+			})
+		errs = append(errs, fn(fldPath.Child("intFieldBeta"), &obj.IntFieldBeta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxLength(ctx, op, fldPath, obj, oldObj, 5).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringFieldBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxLength(ctx, op, fldPath, obj, oldObj, 5).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.StringFieldBeta
+			})
+		errs = append(errs, fn(fldPath.Child("stringFieldBeta"), &obj.StringFieldBeta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 2).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.SliceField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceField"), obj.SliceField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceFieldBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 2).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.SliceFieldBeta
+			})
+		errs = append(errs, fn(fldPath.Child("sliceFieldBeta"), obj.SliceFieldBeta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.UUIDField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.UUID(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.UUIDField
+			})
+		errs = append(errs, fn(fldPath.Child("uuidField"), &obj.UUIDField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.UUIDFieldBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.UUID(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.UUIDFieldBeta
+			})
+		errs = append(errs, fn(fldPath.Child("uuidFieldBeta"), &obj.UUIDFieldBeta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ImmutableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.ImmutableField
+			})
+		errs = append(errs, fn(fldPath.Child("immutableField"), &obj.ImmutableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ImmutableFieldBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.ImmutableFieldBeta
+			})
+		errs = append(errs, fn(fldPath.Child("immutableFieldBeta"), &obj.ImmutableFieldBeta, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_StructWithValidateFalse validates an instance of StructWithValidateFalse according
+// to declarative validation rules in the API schema.
+func Validate_StructWithValidateFalse(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StructWithValidateFalse) (errs field.ErrorList) {
+
+	// field StructWithValidateFalse.TypeMeta has no validation
+
+	{ // field StructWithValidateFalse.ValidateFalse
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "always fails").MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructWithValidateFalse) *string {
+				return oldObj.ValidateFalse
+			})
+		errs = append(errs, fn(fldPath.Child("validateFalse"), obj.ValidateFalse, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructWithValidateFalse.ValidateFalseBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "always fails").MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructWithValidateFalse) *string {
+				return oldObj.ValidateFalseBeta
+			})
+		errs = append(errs, fn(fldPath.Child("validateFalseBeta"), obj.ValidateFalseBeta, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/structs/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/structs/doc.go
new file mode 100644
index 0000000000..5a5aeecfe7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/structs/doc.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// +k8s:validation-gen-nolint
+package structs
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type MixedStruct struct {
+	TypeMeta int
+
+	// +k8s:minimum=5
+	// +k8s:alpha=+k8s:minimum=10
+	IntField int `json:"intField"`
+
+	// +k8s:minimum=5
+	// +k8s:beta=+k8s:minimum=10
+	IntFieldBeta int `json:"intFieldBeta"`
+
+	// +k8s:maxItems=5
+	// +k8s:alpha=+k8s:maxItems=3
+	ListField []string `json:"listField"`
+
+	// +k8s:maxItems=5
+	// +k8s:beta=+k8s:maxItems=3
+	ListFieldBeta []string `json:"listFieldBeta"`
+}
+
+type ConditionalStruct struct {
+	TypeMeta int
+
+	// +k8s:alpha=+k8s:ifEnabled(MyFeature)=+k8s:minimum=10
+	ConditionalField int `json:"conditionalField"`
+
+	// +k8s:beta=+k8s:ifEnabled(MyFeature)=+k8s:minimum=10
+	ConditionalFieldBeta int `json:"conditionalFieldBeta"`
+
+	// +k8s:alpha=+k8s:alpha=+k8s:minimum=20
+	RecursiveAlpha int `json:"recursiveAlpha"`
+
+	// +k8s:beta=+k8s:beta=+k8s:minimum=20
+	RecursiveBeta int `json:"recursiveBeta"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/structs/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/structs/doc_test.go
new file mode 100644
index 0000000000..6f16c50071
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/structs/doc_test.go
@@ -0,0 +1,92 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package structs
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestMixed(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Valid case (meets both normal and alpha requirements)
+	st.Value(&MixedStruct{
+		IntField:      15,
+		IntFieldBeta:  15,
+		ListField:     []string{"a", "b", "c"},
+		ListFieldBeta: []string{"a", "b", "c"},
+	}).ExpectValid()
+
+	// Fails alpha validation but passes normal validation
+	// IntField: 5 <= 8 < 10 (alpha fails)
+	// ListField: 3 < 4 <= 5 (alpha fails)
+	st.Value(&MixedStruct{
+		IntField:      8,
+		IntFieldBeta:  8,
+		ListField:     []string{"a", "b", "c", "d"},
+		ListFieldBeta: []string{"a", "b", "c", "d"},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(field.NewPath("intField"), 8, "").WithOrigin("minimum").MarkAlpha(),
+		field.Invalid(field.NewPath("intFieldBeta"), 8, "").WithOrigin("minimum").MarkBeta(),
+		field.TooMany(field.NewPath("listField"), 4, 3).WithOrigin("maxItems").MarkAlpha(),
+		field.TooMany(field.NewPath("listFieldBeta"), 4, 3).WithOrigin("maxItems").MarkBeta(),
+	})
+
+	// Fails both normal and alpha validation
+	// IntField: 4 < 5 (normal fails) AND 4 < 10 (alpha fails)
+	// ListField: 6 > 5 (normal fails) AND 6 > 3 (alpha fails)
+	st.Value(&MixedStruct{
+		IntField:      4,
+		IntFieldBeta:  4,
+		ListField:     []string{"a", "b", "c", "d", "e", "f"},
+		ListFieldBeta: []string{"a", "b", "c", "d", "e", "f"},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(field.NewPath("intField"), 4, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("intField"), 4, "").WithOrigin("minimum").MarkAlpha(),
+		field.Invalid(field.NewPath("intFieldBeta"), 4, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("intFieldBeta"), 4, "").WithOrigin("minimum").MarkBeta(),
+		field.TooMany(field.NewPath("listField"), 6, 5).WithOrigin("maxItems"),
+		field.TooMany(field.NewPath("listField"), 6, 3).WithOrigin("maxItems").MarkAlpha(),
+		field.TooMany(field.NewPath("listFieldBeta"), 6, 5).WithOrigin("maxItems"),
+		field.TooMany(field.NewPath("listFieldBeta"), 6, 3).WithOrigin("maxItems").MarkBeta(),
+	})
+}
+
+func TestConditionalStruct(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&ConditionalStruct{
+		ConditionalField:     15,
+		ConditionalFieldBeta: 15,
+		RecursiveAlpha:       25,
+		RecursiveBeta:        25,
+	}).Opts(map[string]bool{"MyFeature": true}).ExpectValid()
+
+	st.Value(&ConditionalStruct{
+		ConditionalField:     5,
+		ConditionalFieldBeta: 5,
+		RecursiveAlpha:       10,
+		RecursiveBeta:        10,
+	}).Opts(map[string]bool{"MyFeature": true}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(field.NewPath("conditionalField"), 5, "").WithOrigin("minimum").MarkAlpha(),
+		field.Invalid(field.NewPath("conditionalFieldBeta"), 5, "").WithOrigin("minimum").MarkBeta(),
+		field.Invalid(field.NewPath("recursiveAlpha"), 10, "").WithOrigin("minimum").MarkAlpha(),
+		field.Invalid(field.NewPath("recursiveBeta"), 10, "").WithOrigin("minimum").MarkBeta(),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/structs/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/structs/zz_generated.validations.go
new file mode 100644
index 0000000000..f17ea18372
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/structs/zz_generated.validations.go
@@ -0,0 +1,316 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package structs
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type ConditionalStruct
+	scheme.AddValidationFunc(
+		(*ConditionalStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ConditionalStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*ConditionalStruct),
+					safe.Cast[*ConditionalStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type MixedStruct
+	scheme.AddValidationFunc(
+		(*MixedStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_MixedStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*MixedStruct),
+					safe.Cast[*MixedStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_ConditionalStruct validates an instance of ConditionalStruct according
+// to declarative validation rules in the API schema.
+func Validate_ConditionalStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ConditionalStruct) (errs field.ErrorList) {
+
+	// field ConditionalStruct.TypeMeta has no validation
+
+	{ // field ConditionalStruct.ConditionalField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "MyFeature", true,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+					return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10)
+				}).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ConditionalStruct) *int {
+				return &oldObj.ConditionalField
+			})
+		errs = append(errs, fn(fldPath.Child("conditionalField"), &obj.ConditionalField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ConditionalStruct.ConditionalFieldBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "MyFeature", true,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+					return validate.Minimum(ctx, op, fldPath, obj, oldObj, 10)
+				}).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ConditionalStruct) *int {
+				return &oldObj.ConditionalFieldBeta
+			})
+		errs = append(errs, fn(fldPath.Child("conditionalFieldBeta"), &obj.ConditionalFieldBeta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ConditionalStruct.RecursiveAlpha
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 20).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ConditionalStruct) *int {
+				return &oldObj.RecursiveAlpha
+			})
+		errs = append(errs, fn(fldPath.Child("recursiveAlpha"), &obj.RecursiveAlpha, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ConditionalStruct.RecursiveBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 20).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ConditionalStruct) *int {
+				return &oldObj.RecursiveBeta
+			})
+		errs = append(errs, fn(fldPath.Child("recursiveBeta"), &obj.RecursiveBeta, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_MixedStruct validates an instance of MixedStruct according
+// to declarative validation rules in the API schema.
+func Validate_MixedStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MixedStruct) (errs field.ErrorList) {
+
+	// field MixedStruct.TypeMeta has no validation
+
+	{ // field MixedStruct.IntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 10).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 5); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MixedStruct) *int {
+				return &oldObj.IntField
+			})
+		errs = append(errs, fn(fldPath.Child("intField"), &obj.IntField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MixedStruct.IntFieldBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 10).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 5); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MixedStruct) *int {
+				return &oldObj.IntFieldBeta
+			})
+		errs = append(errs, fn(fldPath.Child("intFieldBeta"), &obj.IntFieldBeta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MixedStruct.ListField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 3).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 5).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MixedStruct) []string {
+				return oldObj.ListField
+			})
+		errs = append(errs, fn(fldPath.Child("listField"), obj.ListField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MixedStruct.ListFieldBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 3).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 5).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MixedStruct) []string {
+				return oldObj.ListFieldBeta
+			})
+		errs = append(errs, fn(fldPath.Child("listFieldBeta"), obj.ListFieldBeta, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/subfields/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/subfields/doc.go
new file mode 100644
index 0000000000..df4b88e397
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/subfields/doc.go
@@ -0,0 +1,48 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// +k8s:validation-gen-nolint
+package subfields
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:alpha=+k8s:subfield(inner)=+k8s:minimum=5
+	Subfield SubStruct `json:"subfield"`
+
+	// +k8s:beta=+k8s:subfield(inner)=+k8s:minimum=5
+	SubfieldBeta SubStruct `json:"subfieldBeta"`
+
+	// +k8s:alpha=+k8s:subfield(z1)=+k8s:zeroOrOneOfMember
+	// +k8s:alpha=+k8s:subfield(z2)=+k8s:zeroOrOneOfMember
+	UnionField SubUnion `json:"unionField"`
+}
+
+type SubStruct struct {
+	Inner int `json:"inner"`
+}
+
+type SubUnion struct {
+	Z1 *int `json:"z1"`
+	Z2 *int `json:"z2"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/subfields/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/subfields/doc_test.go
new file mode 100644
index 0000000000..f4e62109e2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/subfields/doc_test.go
@@ -0,0 +1,71 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package subfields
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestAlpha(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		Subfield:     SubStruct{Inner: 5},
+		SubfieldBeta: SubStruct{Inner: 5},
+	}).ExpectValid()
+
+	// Test failures marked as alpha
+	st.Value(&Struct{
+		Subfield:     SubStruct{Inner: 1},
+		SubfieldBeta: SubStruct{Inner: 5},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(field.NewPath("subfield", "inner"), 1, "").WithOrigin("minimum").MarkAlpha(),
+	})
+
+	one := 1
+	st.Value(&Struct{
+		Subfield:     SubStruct{Inner: 5},
+		SubfieldBeta: SubStruct{Inner: 5},
+		UnionField: SubUnion{
+			Z1: &one,
+			Z2: &one,
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(field.NewPath("unionField"), &SubUnion{
+			Z1: &one, Z2: &one,
+		}, "only one of z1, z2 may be specified").WithOrigin("zeroOrOneOf").MarkAlpha(),
+	})
+}
+
+func TestBeta(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		Subfield:     SubStruct{Inner: 5},
+		SubfieldBeta: SubStruct{Inner: 5},
+	}).ExpectValid()
+
+	// Test failures marked as beta
+	st.Value(&Struct{
+		Subfield:     SubStruct{Inner: 5},
+		SubfieldBeta: SubStruct{Inner: 1},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(field.NewPath("subfieldBeta", "inner"), 1, "").WithOrigin("minimum").MarkBeta(),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/subfields/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/subfields/zz_generated.validations.go
new file mode 100644
index 0000000000..b316c2b067
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/subfields/zz_generated.validations.go
@@ -0,0 +1,166 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package subfields
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_levels_subfields_Struct_unionField_ = validate.NewUnionMembership(validate.NewUnionMember("z1"), validate.NewUnionMember("z2"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Subfield
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *SubStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "inner"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "inner",
+					func(o *SubStruct) *int { return &o.Inner }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+						return validate.Minimum(ctx, op, fldPath, obj, oldObj, 5)
+					}).MarkAlpha(); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *SubStruct {
+				return &oldObj.Subfield
+			})
+		errs = append(errs, fn(fldPath.Child("subfield"), &obj.Subfield, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SubfieldBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *SubStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "inner"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "inner",
+					func(o *SubStruct) *int { return &o.Inner }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *int) field.ErrorList {
+						return validate.Minimum(ctx, op, fldPath, obj, oldObj, 5)
+					}).MarkBeta(); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *SubStruct {
+				return &oldObj.SubfieldBeta
+			})
+		errs = append(errs, fn(fldPath.Child("subfieldBeta"), &obj.SubfieldBeta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.UnionField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *SubUnion,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.ZeroOrOneOfUnion(ctx, op, fldPath, obj, oldObj, zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_levels_subfields_Struct_unionField_,
+				func(obj *SubUnion) bool {
+					if obj == nil {
+						return false
+					}
+					return obj.Z1 != nil
+				},
+				func(obj *SubUnion) bool {
+					if obj == nil {
+						return false
+					}
+					return obj.Z2 != nil
+				}).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *SubUnion {
+				return &oldObj.UnionField
+			})
+		errs = append(errs, fn(fldPath.Child("unionField"), &obj.UnionField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/unions/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/unions/doc.go
new file mode 100644
index 0000000000..04a441f844
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/unions/doc.go
@@ -0,0 +1,130 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// +k8s:validation-gen-nolint
+package unions
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:alpha=+k8s:unionDiscriminator
+	D D `json:"d"`
+
+	// +k8s:alpha=+k8s:unionMember
+	// +k8s:optional
+	M1 *M1 `json:"m1"`
+
+	// +k8s:alpha(since:"1.35")=+k8s:unionMember
+	// +k8s:optional
+	M2 *M2 `json:"m2"`
+}
+
+type UnionStructBeta struct {
+	TypeMeta int
+
+	// +k8s:beta=+k8s:unionDiscriminator
+	DBeta BetaD `json:"dBeta"`
+
+	// +k8s:beta=+k8s:unionMember
+	// +k8s:optional
+	M1Beta *BetaM1 `json:"m1Beta"`
+
+	// +k8s:beta(since:"1.35")=+k8s:unionMember
+	// +k8s:optional
+	M2Beta *BetaM2 `json:"m2Beta"`
+}
+
+type MyStruct struct {
+	TypeMeta int
+
+	// +k8s:alpha=+k8s:zeroOrOneOfMember
+	// +k8s:optional
+	Z1 *Z1 `json:"z1"`
+
+	// +k8s:alpha=+k8s:zeroOrOneOfMember
+	// +k8s:optional
+	Z2 *Z2 `json:"z2"`
+}
+
+type MyStructBeta struct {
+	TypeMeta int
+
+	// +k8s:beta=+k8s:zeroOrOneOfMember
+	// +k8s:optional
+	Z1Beta *BetaZ1 `json:"z1Beta"`
+
+	// +k8s:beta=+k8s:zeroOrOneOfMember
+	// +k8s:optional
+	Z2Beta *BetaZ2 `json:"z2Beta"`
+}
+
+type D string
+
+const (
+	DM1 D = "M1"
+	DM2 D = "M2"
+)
+
+type M1 struct{}
+type M2 struct{}
+
+type BetaD string
+
+const (
+	BetaDM1 BetaD = "M1Beta"
+	BetaDM2 BetaD = "M2Beta"
+)
+
+type BetaM1 struct{}
+type BetaM2 struct{}
+
+type Z1 struct{}
+type Z2 struct{}
+
+type BetaZ1 struct{}
+type BetaZ2 struct{}
+
+type MyListStruct struct {
+	TypeMeta int
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:alpha=+k8s:item(name: "succeeded")=+k8s:zeroOrOneOfMember
+	// +k8s:alpha=+k8s:item(name: "failed")=+k8s:zeroOrOneOfMember
+	Tasks []Task `json:"tasks"`
+}
+
+type MyListStructBeta struct {
+	TypeMeta int
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:beta=+k8s:item(name: "succeeded")=+k8s:zeroOrOneOfMember
+	// +k8s:beta=+k8s:item(name: "failed")=+k8s:zeroOrOneOfMember
+	TasksBeta []Task `json:"tasksBeta"`
+}
+
+type Task struct {
+	Name  string `json:"name"`
+	State string `json:"state"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/unions/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/unions/doc_test.go
new file mode 100644
index 0000000000..a4aa873e75
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/unions/doc_test.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unions
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestAlpha(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		D:  DM1,
+		M1: &M1{},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		D:  DM1,
+		M1: nil, // required by discriminator
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(field.NewPath("m1"), nil, "").WithOrigin("union").MarkAlpha(),
+	})
+
+	st.Value(&MyStruct{
+		Z1: &Z1{},
+		Z2: &Z2{},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(nil, &MyStruct{
+			Z1: &Z1{}, Z2: &Z2{},
+		}, "only one of z1, z2 may be specified").WithOrigin("zeroOrOneOf").MarkAlpha(),
+	})
+
+	st.Value(&MyListStruct{
+		Tasks: []Task{
+			{Name: "succeeded", State: "Succeeded"},
+			{Name: "failed", State: "Failed"},
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(field.NewPath("tasks"), nil, "").WithOrigin("zeroOrOneOf").MarkAlpha(),
+	})
+}
+
+func TestBeta(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&UnionStructBeta{
+		DBeta:  BetaDM1,
+		M1Beta: &BetaM1{},
+	}).ExpectValid()
+
+	st.Value(&UnionStructBeta{
+		DBeta:  BetaDM1,
+		M1Beta: nil, // required by discriminator
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(field.NewPath("m1Beta"), nil, "").WithOrigin("union").MarkBeta(),
+	})
+
+	st.Value(&MyStructBeta{
+		Z1Beta: &BetaZ1{},
+		Z2Beta: &BetaZ2{},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(nil, &MyStructBeta{
+			Z1Beta: &BetaZ1{}, Z2Beta: &BetaZ2{},
+		}, "only one of z1Beta, z2Beta may be specified").WithOrigin("zeroOrOneOf").MarkBeta(),
+	})
+
+	st.Value(&MyListStructBeta{
+		TasksBeta: []Task{
+			{Name: "succeeded", State: "Succeeded"},
+			{Name: "failed", State: "Failed"},
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Invalid(field.NewPath("tasksBeta"), nil, "").WithOrigin("zeroOrOneOf").MarkBeta(),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/unions/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/unions/zz_generated.validations.go
new file mode 100644
index 0000000000..a58f73f119
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/unions/zz_generated.validations.go
@@ -0,0 +1,602 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package unions
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type MyListStruct
+	scheme.AddValidationFunc(
+		(*MyListStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_MyListStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*MyListStruct),
+					safe.Cast[*MyListStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type MyListStructBeta
+	scheme.AddValidationFunc(
+		(*MyListStructBeta)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_MyListStructBeta(
+					ctx, op, nil, /* fldPath */
+					obj.(*MyListStructBeta),
+					safe.Cast[*MyListStructBeta](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type MyStruct
+	scheme.AddValidationFunc(
+		(*MyStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_MyStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*MyStruct),
+					safe.Cast[*MyStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type MyStructBeta
+	scheme.AddValidationFunc(
+		(*MyStructBeta)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_MyStructBeta(
+					ctx, op, nil, /* fldPath */
+					obj.(*MyStructBeta),
+					safe.Cast[*MyStructBeta](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type UnionStructBeta
+	scheme.AddValidationFunc(
+		(*UnionStructBeta)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_UnionStructBeta(
+					ctx, op, nil, /* fldPath */
+					obj.(*UnionStructBeta),
+					safe.Cast[*UnionStructBeta](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_levels_unions_MyListStruct_tasks_ = validate.NewUnionMembership(validate.NewUnionMember("tasks[{\"name\": \"succeeded\"}]"), validate.NewUnionMember("tasks[{\"name\": \"failed\"}]"))
+
+// Validate_MyListStruct validates an instance of MyListStruct according
+// to declarative validation rules in the API schema.
+func Validate_MyListStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MyListStruct) (errs field.ErrorList) {
+
+	// field MyListStruct.TypeMeta has no validation
+
+	{ // field MyListStruct.Tasks
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Task,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.ZeroOrOneOfUnion(ctx, op, fldPath, obj, oldObj, zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_levels_unions_MyListStruct_tasks_,
+				func(list []Task) bool {
+					for i := range list {
+						if list[i].Name == "failed" {
+							return true
+						}
+					}
+					return false
+				},
+				func(list []Task) bool {
+					for i := range list {
+						if list[i].Name == "succeeded" {
+							return true
+						}
+					}
+					return false
+				}).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Task, b *Task) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MyListStruct) []Task {
+				return oldObj.Tasks
+			})
+		errs = append(errs, fn(fldPath.Child("tasks"), obj.Tasks, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_levels_unions_MyListStructBeta_tasksBeta_ = validate.NewUnionMembership(validate.NewUnionMember("tasksBeta[{\"name\": \"succeeded\"}]"), validate.NewUnionMember("tasksBeta[{\"name\": \"failed\"}]"))
+
+// Validate_MyListStructBeta validates an instance of MyListStructBeta according
+// to declarative validation rules in the API schema.
+func Validate_MyListStructBeta(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MyListStructBeta) (errs field.ErrorList) {
+
+	// field MyListStructBeta.TypeMeta has no validation
+
+	{ // field MyListStructBeta.TasksBeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Task,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.ZeroOrOneOfUnion(ctx, op, fldPath, obj, oldObj, zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_levels_unions_MyListStructBeta_tasksBeta_,
+				func(list []Task) bool {
+					for i := range list {
+						if list[i].Name == "failed" {
+							return true
+						}
+					}
+					return false
+				},
+				func(list []Task) bool {
+					for i := range list {
+						if list[i].Name == "succeeded" {
+							return true
+						}
+					}
+					return false
+				}).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Task, b *Task) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MyListStructBeta) []Task {
+				return oldObj.TasksBeta
+			})
+		errs = append(errs, fn(fldPath.Child("tasksBeta"), obj.TasksBeta, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_levels_unions_MyStruct_ = validate.NewUnionMembership(validate.NewUnionMember("z1"), validate.NewUnionMember("z2"))
+
+// Validate_MyStruct validates an instance of MyStruct according
+// to declarative validation rules in the API schema.
+func Validate_MyStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MyStruct) (errs field.ErrorList) {
+
+	if e := validate.ZeroOrOneOfUnion(ctx, op, fldPath, obj, oldObj, zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_levels_unions_MyStruct_,
+		func(obj *MyStruct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Z1 != nil
+		},
+		func(obj *MyStruct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Z2 != nil
+		}).MarkAlpha(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field MyStruct.TypeMeta has no validation
+
+	{ // field MyStruct.Z1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Z1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MyStruct) *Z1 {
+				return oldObj.Z1
+			})
+		errs = append(errs, fn(fldPath.Child("z1"), obj.Z1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MyStruct.Z2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Z2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MyStruct) *Z2 {
+				return oldObj.Z2
+			})
+		errs = append(errs, fn(fldPath.Child("z2"), obj.Z2, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_levels_unions_MyStructBeta_ = validate.NewUnionMembership(validate.NewUnionMember("z1Beta"), validate.NewUnionMember("z2Beta"))
+
+// Validate_MyStructBeta validates an instance of MyStructBeta according
+// to declarative validation rules in the API schema.
+func Validate_MyStructBeta(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MyStructBeta) (errs field.ErrorList) {
+
+	if e := validate.ZeroOrOneOfUnion(ctx, op, fldPath, obj, oldObj, zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_levels_unions_MyStructBeta_,
+		func(obj *MyStructBeta) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Z1Beta != nil
+		},
+		func(obj *MyStructBeta) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Z2Beta != nil
+		}).MarkBeta(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field MyStructBeta.TypeMeta has no validation
+
+	{ // field MyStructBeta.Z1Beta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *BetaZ1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MyStructBeta) *BetaZ1 {
+				return oldObj.Z1Beta
+			})
+		errs = append(errs, fn(fldPath.Child("z1Beta"), obj.Z1Beta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field MyStructBeta.Z2Beta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *BetaZ2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *MyStructBeta) *BetaZ2 {
+				return oldObj.Z2Beta
+			})
+		errs = append(errs, fn(fldPath.Child("z2Beta"), obj.Z2Beta, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_levels_unions_Struct_ = validate.NewDiscriminatedUnionMembership("d", validate.NewDiscriminatedUnionMember("m1", "M1"), validate.NewDiscriminatedUnionMember("m2", "M2"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.DiscriminatedUnion(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_levels_unions_Struct_,
+		func(obj *Struct) string {
+			if obj == nil {
+				return ""
+			}
+			return string(obj.D)
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M1 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M2 != nil
+		}).MarkAlpha(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+	// field Struct.D has no validation
+
+	{ // field Struct.M1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M1 {
+				return oldObj.M1
+			})
+		errs = append(errs, fn(fldPath.Child("m1"), obj.M1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.M2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M2 {
+				return oldObj.M2
+			})
+		errs = append(errs, fn(fldPath.Child("m2"), obj.M2, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_levels_unions_UnionStructBeta_ = validate.NewDiscriminatedUnionMembership("dBeta", validate.NewDiscriminatedUnionMember("m1Beta", "M1Beta"), validate.NewDiscriminatedUnionMember("m2Beta", "M2Beta"))
+
+// Validate_UnionStructBeta validates an instance of UnionStructBeta according
+// to declarative validation rules in the API schema.
+func Validate_UnionStructBeta(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *UnionStructBeta) (errs field.ErrorList) {
+
+	if e := validate.DiscriminatedUnion(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_levels_unions_UnionStructBeta_,
+		func(obj *UnionStructBeta) string {
+			if obj == nil {
+				return ""
+			}
+			return string(obj.DBeta)
+		},
+		func(obj *UnionStructBeta) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M1Beta != nil
+		},
+		func(obj *UnionStructBeta) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M2Beta != nil
+		}).MarkBeta(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field UnionStructBeta.TypeMeta has no validation
+	// field UnionStructBeta.DBeta has no validation
+
+	{ // field UnionStructBeta.M1Beta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *BetaM1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UnionStructBeta) *BetaM1 {
+				return oldObj.M1Beta
+			})
+		errs = append(errs, fn(fldPath.Child("m1Beta"), obj.M1Beta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UnionStructBeta.M2Beta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *BetaM2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UnionStructBeta) *BetaM2 {
+				return oldObj.M2Beta
+			})
+		errs = append(errs, fn(fldPath.Child("m2Beta"), obj.M2Beta, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/uniquetag/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/uniquetag/doc.go
new file mode 100644
index 0000000000..715adcbf56
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/uniquetag/doc.go
@@ -0,0 +1,37 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// +k8s:validation-gen-nolint
+package uniquetag
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type UniqueStruct struct {
+	TypeMeta int
+
+	// +k8s:listType=atomic
+	// +k8s:alpha=+k8s:unique=set
+	AlphaUniqueSet []string `json:"alphaUniqueSet"`
+
+	// +k8s:listType=atomic
+	// +k8s:beta=+k8s:unique=set
+	BetaUniqueSet []string `json:"betaUniqueSet"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/uniquetag/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/uniquetag/doc_test.go
new file mode 100644
index 0000000000..a37747ed01
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/uniquetag/doc_test.go
@@ -0,0 +1,35 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package uniquetag
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestMisc(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&UniqueStruct{
+		AlphaUniqueSet: []string{"a", "a"},
+		BetaUniqueSet:  []string{"a", "a"},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByValidationStabilityLevel(), field.ErrorList{
+		field.Duplicate(field.NewPath("alphaUniqueSet").Index(1), "a").MarkAlpha(),
+		field.Duplicate(field.NewPath("betaUniqueSet").Index(1), "a").MarkBeta(),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/uniquetag/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/uniquetag/zz_generated.validations.go
new file mode 100644
index 0000000000..1c3237948a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/uniquetag/zz_generated.validations.go
@@ -0,0 +1,118 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package uniquetag
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type UniqueStruct
+	scheme.AddValidationFunc(
+		(*UniqueStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_UniqueStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*UniqueStruct),
+					safe.Cast[*UniqueStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_UniqueStruct validates an instance of UniqueStruct according
+// to declarative validation rules in the API schema.
+func Validate_UniqueStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *UniqueStruct) (errs field.ErrorList) {
+
+	// field UniqueStruct.TypeMeta has no validation
+
+	{ // field UniqueStruct.AlphaUniqueSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UniqueStruct) []string {
+				return oldObj.AlphaUniqueSet
+			})
+		errs = append(errs, fn(fldPath.Child("alphaUniqueSet"), obj.AlphaUniqueSet, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UniqueStruct.BetaUniqueSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UniqueStruct) []string {
+				return oldObj.BetaUniqueSet
+			})
+		errs = append(errs, fn(fldPath.Child("betaUniqueSet"), obj.BetaUniqueSet, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/doc.go
new file mode 100644
index 0000000000..389055bd70
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/doc.go
@@ -0,0 +1,100 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package multiplekeys
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key1Field
+	// +k8s:listMapKey=key2Field
+	// +k8s:eachVal=+k8s:immutable
+	ListField []OtherStruct `json:"listField"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key1Field
+	// +k8s:listMapKey=key2Field
+	// +k8s:eachVal=+k8s:immutable
+	ListTypedefField []OtherTypedefStruct `json:"listTypedefField"`
+
+	// +k8s:eachVal=+k8s:immutable
+	TypedefField ListType `json:"typedefField"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key1Field
+	// +k8s:listMapKey=key2Field
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListComparableField[*]"
+	ListComparableField []OtherStruct `json:"listComparableField"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key1Field
+	// +k8s:listMapKey=key2Field
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListNonComparableField[*]"
+	ListNonComparableField []NonComparableStruct `json:"listNonComparableField"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=key1Field
+	// +k8s:listMapKey=key2Field
+	// +k8s:item(key1Field: "target-ptr", key2Field: 42)=+k8s:validateFalse="item ListPtrKeyField[key1Field=target-ptr,key2Field=42]"
+	ListPtrKeyField []PtrKeyStruct `json:"listPtrKeyField"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=stringPtrKey
+	// +k8s:listMapKey=stringKey
+	// +k8s:item(stringPtrKey: "target-ptr", stringKey: "target")=+k8s:validateFalse="item ListMixedPtrKeyField"
+	ListMixedPtrKeyField []MixedPtrKeyStruct `json:"listMixedPtrKeyField"`
+}
+
+type OtherStruct struct {
+	Key1Field string `json:"key1Field"`
+	Key2Field int    `json:"key2Field"`
+	DataField string `json:"dataField"`
+}
+
+type OtherTypedefStruct OtherStruct
+
+type NonComparableStruct struct {
+	Key1Field string   `json:"key1Field"`
+	Key2Field int      `json:"key2Field"`
+	DataField []string `json:"dataField"`
+}
+
+// +k8s:listType=map
+// +k8s:listMapKey=key1Field
+// +k8s:listMapKey=key2Field
+type ListType []OtherStruct
+
+type PtrKeyStruct struct {
+	Key1Field *string `json:"key1Field"`
+	Key2Field int     `json:"key2Field"`
+	DataField string  `json:"dataField"`
+}
+
+type MixedPtrKeyStruct struct {
+	StringPtrKey *string `json:"stringPtrKey"`
+	StringKey    string  `json:"stringKey"`
+	DataField    string  `json:"dataField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/doc_test.go
new file mode 100644
index 0000000000..bb41132f25
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/doc_test.go
@@ -0,0 +1,201 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package multiplekeys
+
+import (
+	"testing"
+
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestUniqueness(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		ListField: []OtherStruct{
+			{"key1", 1, "one"}, // unique
+			{"key2", 2, "two"}, // dup
+			{"key2", 2, "two"},
+		},
+		ListTypedefField: []OtherTypedefStruct{
+			{"key1", 1, "one"}, // unique
+			{"key2", 2, "two"}, // dup
+			{"key2", 2, "two"},
+		},
+		TypedefField: ListType{
+			{"key1", 1, "one"}, // unique
+			{"key2", 2, "two"}, // dup
+			{"key2", 2, "two"},
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Duplicate(field.NewPath("listField").Index(2), nil),
+		field.Duplicate(field.NewPath("listTypedefField").Index(2), nil),
+		field.Duplicate(field.NewPath("typedefField").Index(2), nil),
+	})
+}
+
+func TestUpdateCorrelation(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	structA1 := Struct{
+		ListField: []OtherStruct{
+			{"key1", 1, "one"},
+			{"key2", 2, "two"},
+		},
+		ListTypedefField: []OtherTypedefStruct{
+			{"key1", 1, "one"},
+			{"key2", 2, "two"},
+		},
+		TypedefField: ListType{
+			{"key1", 1, "one"},
+			{"key2", 2, "two"},
+		},
+	}
+
+	// Same data, different order.
+	structA2 := Struct{
+		ListField: []OtherStruct{
+			{"key2", 2, "two"},
+			{"key1", 1, "one"},
+		},
+		ListTypedefField: []OtherTypedefStruct{
+			{"key2", 2, "two"},
+			{"key1", 1, "one"},
+		},
+		TypedefField: ListType{
+			{"key2", 2, "two"},
+			{"key1", 1, "one"},
+		},
+	}
+
+	// Different data.
+	structB := Struct{
+		ListField: []OtherStruct{
+			{"key3", 3, "THREE"},
+			{"key1", 1, "ONE"},
+			{"key2", 2, "TWO"},
+		},
+		ListTypedefField: []OtherTypedefStruct{
+			{"key3", 3, "THREE"},
+			{"key1", 1, "ONE"},
+			{"key2", 2, "TWO"},
+		},
+		TypedefField: ListType{
+			{"key3", 3, "THREE"},
+			{"key1", 1, "ONE"},
+			{"key2", 2, "TWO"},
+		},
+	}
+
+	st.Value(&structA1).OldValue(&structA2).ExpectValid()
+
+	st.Value(&structA2).OldValue(&structA1).ExpectValid()
+
+	st.Value(&structA1).OldValue(&structB).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("listField").Index(0), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listField").Index(1), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listTypedefField").Index(0), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listTypedefField").Index(1), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("typedefField").Index(0), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("typedefField").Index(1), nil, "immutable").WithOrigin("immutable"),
+	})
+
+	st.Value(&structB).OldValue(&structA1).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("listField").Index(0), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listField").Index(1), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listField").Index(2), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listTypedefField").Index(0), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listTypedefField").Index(1), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listTypedefField").Index(2), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("typedefField").Index(0), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("typedefField").Index(1), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("typedefField").Index(2), nil, "immutable").WithOrigin("immutable"),
+	})
+}
+
+func TestRatcheting(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	struct1 := Struct{
+		ListComparableField: []OtherStruct{
+			{"key1", 1, "one"},
+			{"key2", 2, "two"},
+		},
+		ListNonComparableField: []NonComparableStruct{
+			{"key1", 1, []string{"one"}},
+			{"key2", 2, []string{"two"}},
+		},
+	}
+
+	// Same data, different order.
+	struct2 := Struct{
+		ListComparableField: []OtherStruct{
+			{"key2", 2, "two"},
+			{"key1", 1, "one"},
+		},
+		ListNonComparableField: []NonComparableStruct{
+			{"key2", 2, []string{"two"}},
+			{"key1", 1, []string{"one"}},
+		},
+	}
+
+	st.Value(&struct1).ExpectValidateFalseByPath(map[string][]string{
+		"listComparableField[0]":    {"field Struct.ListComparableField[*]"},
+		"listComparableField[1]":    {"field Struct.ListComparableField[*]"},
+		"listNonComparableField[0]": {"field Struct.ListNonComparableField[*]"},
+		"listNonComparableField[1]": {"field Struct.ListNonComparableField[*]"},
+	})
+	st.Value(&struct1).OldValue(&struct2).ExpectValid()
+	st.Value(&struct2).OldValue(&struct1).ExpectValid()
+}
+
+func TestItemWithPtrKey(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		ListPtrKeyField: []PtrKeyStruct{
+			{Key1Field: ptr.To("target-ptr"), Key2Field: 42, DataField: "match"},
+			{Key1Field: ptr.To("target-ptr"), Key2Field: 99, DataField: "no match, int differs"},
+			{Key1Field: ptr.To("other"), Key2Field: 42, DataField: "no match, string differs"},
+			{Key1Field: nil, Key2Field: 42, DataField: "no match, nil string"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`listPtrKeyField[0]`: {
+			"item ListPtrKeyField[key1Field=target-ptr,key2Field=42]",
+		},
+	})
+
+	st.Value(&Struct{
+		ListPtrKeyField: []PtrKeyStruct{
+			{Key1Field: ptr.To("other"), Key2Field: 42, DataField: "d1"},
+			{Key1Field: nil, Key2Field: 99, DataField: "d2"},
+		},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		ListMixedPtrKeyField: []MixedPtrKeyStruct{
+			{StringPtrKey: ptr.To("target-ptr"), StringKey: "target", DataField: "match"},
+			{StringPtrKey: ptr.To("target-ptr"), StringKey: "other", DataField: "no match"},
+			{StringPtrKey: nil, StringKey: "target", DataField: "no match"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		`listMixedPtrKeyField[0]`: {
+			"item ListMixedPtrKeyField",
+		},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/zz_generated.validations.go
new file mode 100644
index 0000000000..bd1654a64c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/zz_generated.validations.go
@@ -0,0 +1,354 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package multiplekeys
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_ListType validates an instance of ListType according
+// to declarative validation rules in the API schema.
+func Validate_ListType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj ListType) (errs field.ErrorList) {
+
+	// lists with map semantics require unique keys
+	if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+		func(a *OtherStruct, b *OtherStruct) bool {
+			return a.Key1Field == b.Key1Field && a.Key2Field == b.Key2Field
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ListField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherStruct, b *OtherStruct) bool {
+					return a.Key1Field == b.Key1Field && a.Key2Field == b.Key2Field
+				}, validate.DirectEqual, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherStruct, b *OtherStruct) bool {
+					return a.Key1Field == b.Key1Field && a.Key2Field == b.Key2Field
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherStruct {
+				return oldObj.ListField
+			})
+		errs = append(errs, fn(fldPath.Child("listField"), obj.ListField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherTypedefStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherTypedefStruct, b *OtherTypedefStruct) bool {
+					return a.Key1Field == b.Key1Field && a.Key2Field == b.Key2Field
+				}, validate.DirectEqual, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherTypedefStruct, b *OtherTypedefStruct) bool {
+					return a.Key1Field == b.Key1Field && a.Key2Field == b.Key2Field
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherTypedefStruct {
+				return oldObj.ListTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("listTypedefField"), obj.ListTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj ListType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherStruct, b *OtherStruct) bool {
+					return a.Key1Field == b.Key1Field && a.Key2Field == b.Key2Field
+				}, validate.DirectEqual, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ListType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) ListType {
+				return oldObj.TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("typedefField"), obj.TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherStruct, b *OtherStruct) bool {
+					return a.Key1Field == b.Key1Field && a.Key2Field == b.Key2Field
+				}, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListComparableField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherStruct, b *OtherStruct) bool {
+					return a.Key1Field == b.Key1Field && a.Key2Field == b.Key2Field
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherStruct {
+				return oldObj.ListComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("listComparableField"), obj.ListComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListNonComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []NonComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *NonComparableStruct, b *NonComparableStruct) bool {
+					return a.Key1Field == b.Key1Field && a.Key2Field == b.Key2Field
+				}, deepEqualImpl_,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListNonComparableField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *NonComparableStruct, b *NonComparableStruct) bool {
+					return a.Key1Field == b.Key1Field && a.Key2Field == b.Key2Field
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []NonComparableStruct {
+				return oldObj.ListNonComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("listNonComparableField"), obj.ListNonComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListPtrKeyField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []PtrKeyStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *PtrKeyStruct, b *PtrKeyStruct) bool {
+					return ((a.Key1Field == nil && b.Key1Field == nil) || (a.Key1Field != nil && b.Key1Field != nil && *a.Key1Field == *b.Key1Field)) && a.Key2Field == b.Key2Field
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"key1Field": "target-ptr", "key2Field": 42}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *PtrKeyStruct) bool {
+						return item.Key1Field != nil && *item.Key1Field == "target-ptr" && item.Key2Field == 42
+					}, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *PtrKeyStruct) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item ListPtrKeyField[key1Field=target-ptr,key2Field=42]")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []PtrKeyStruct {
+				return oldObj.ListPtrKeyField
+			})
+		errs = append(errs, fn(fldPath.Child("listPtrKeyField"), obj.ListPtrKeyField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListMixedPtrKeyField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []MixedPtrKeyStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *MixedPtrKeyStruct, b *MixedPtrKeyStruct) bool {
+					return ((a.StringPtrKey == nil && b.StringPtrKey == nil) || (a.StringPtrKey != nil && b.StringPtrKey != nil && *a.StringPtrKey == *b.StringPtrKey)) && a.StringKey == b.StringKey
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			func() { // cohort = "{"stringPtrKey": "target-ptr", "stringKey": "target"}"
+				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+					func(item *MixedPtrKeyStruct) bool {
+						return item.StringPtrKey != nil && *item.StringPtrKey == "target-ptr" && item.StringKey == "target"
+					}, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MixedPtrKeyStruct) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item ListMixedPtrKeyField")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []MixedPtrKeyStruct {
+				return oldObj.ListMixedPtrKeyField
+			})
+		errs = append(errs, fn(fldPath.Child("listMixedPtrKeyField"), obj.ListMixedPtrKeyField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
+func deepEqualImpl_[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/doc.go
new file mode 100644
index 0000000000..08e46ea2e7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/doc.go
@@ -0,0 +1,78 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package singlekey
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=keyField
+	// +k8s:eachVal=+k8s:immutable
+	ListField []OtherStruct `json:"listField"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=keyField
+	// +k8s:eachVal=+k8s:immutable
+	ListTypedefField []OtherTypedefStruct `json:"listTypedefField"`
+
+	// +k8s:eachVal=+k8s:immutable
+	TypedefField ListType `json:"typedefField"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=keyField
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListComparableField[*]"
+	ListComparableField []OtherStruct `json:"listComparableField"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=keyField
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListNonComparableField[*]"
+	ListNonComparableField []NonComparableStruct `json:"listNonComparableField"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=keyField
+	ListPtrKeyField []PtrKeyStruct `json:"listPtrKeyField"`
+}
+
+type OtherStruct struct {
+	KeyField  string `json:"keyField"`
+	DataField string `json:"dataField"`
+}
+
+type OtherTypedefStruct OtherStruct
+
+type NonComparableStruct struct {
+	KeyField       string  `json:"keyField"`
+	StringPtrField *string `json:"stringPtrField"`
+}
+
+type PtrKeyStruct struct {
+	KeyField  *string `json:"keyField"`
+	DataField string  `json:"dataField"`
+}
+
+// +k8s:listType=map
+// +k8s:listMapKey=keyField
+type ListType []OtherStruct
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/doc_test.go
new file mode 100644
index 0000000000..01a2a782a9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/doc_test.go
@@ -0,0 +1,181 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package singlekey
+
+import (
+	"testing"
+
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestUniqueness(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		ListField: []OtherStruct{
+			{"key1", "one"},
+			{"key2", "two"},
+			{"key2", "two"},
+		},
+		ListTypedefField: []OtherTypedefStruct{
+			{"key1", "one"},
+			{"key2", "two"},
+			{"key2", "two"},
+		},
+		TypedefField: ListType{
+			{"key1", "one"},
+			{"key2", "two"},
+			{"key2", "two"},
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Duplicate(field.NewPath("listField").Index(2), nil),
+		field.Duplicate(field.NewPath("listTypedefField").Index(2), nil),
+		field.Duplicate(field.NewPath("typedefField").Index(2), nil),
+	})
+}
+
+func TestUpdateCorrelation(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	structA1 := Struct{
+		ListField: []OtherStruct{
+			{"key1", "one"},
+			{"key2", "two"},
+		},
+		ListTypedefField: []OtherTypedefStruct{
+			{"key1", "one"},
+			{"key2", "two"},
+		},
+		TypedefField: ListType{
+			{"key1", "one"},
+			{"key2", "two"},
+		},
+	}
+
+	// Same data, different order.
+	structA2 := Struct{
+		ListField: []OtherStruct{
+			{"key2", "two"},
+			{"key1", "one"},
+		},
+		ListTypedefField: []OtherTypedefStruct{
+			{"key2", "two"},
+			{"key1", "one"},
+		},
+		TypedefField: ListType{
+			{"key2", "two"},
+			{"key1", "one"},
+		},
+	}
+
+	// Different data.
+	structB := Struct{
+		ListField: []OtherStruct{
+			{"key3", "THREE"},
+			{"key1", "ONE"},
+			{"key2", "TWO"},
+		},
+		ListTypedefField: []OtherTypedefStruct{
+			{"key3", "THREE"},
+			{"key1", "ONE"},
+			{"key2", "TWO"},
+		},
+		TypedefField: ListType{
+			{"key3", "THREE"},
+			{"key1", "ONE"},
+			{"key2", "TWO"},
+		},
+	}
+
+	st.Value(&structA1).OldValue(&structA2).ExpectValid()
+
+	st.Value(&structA2).OldValue(&structA1).ExpectValid()
+
+	st.Value(&structA1).OldValue(&structB).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("listField").Index(0), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listField").Index(1), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listTypedefField").Index(0), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listTypedefField").Index(1), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("typedefField").Index(0), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("typedefField").Index(1), nil, "immutable").WithOrigin("immutable"),
+	})
+
+	st.Value(&structB).OldValue(&structA1).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("listField").Index(0), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listField").Index(1), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listField").Index(2), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listTypedefField").Index(0), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listTypedefField").Index(1), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("listTypedefField").Index(2), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("typedefField").Index(0), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("typedefField").Index(1), nil, "immutable").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("typedefField").Index(2), nil, "immutable").WithOrigin("immutable"),
+	})
+}
+
+func TestRatcheting(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	struct1 := Struct{
+		ListComparableField: []OtherStruct{
+			{"key1", "one"},
+			{"key2", "two"},
+		},
+		ListNonComparableField: []NonComparableStruct{
+			{"key1", ptr.To("one")},
+			{"key2", ptr.To("two")},
+		},
+	}
+
+	// Same data, different order.
+	struct2 := Struct{
+		ListComparableField: []OtherStruct{
+			{"key2", "two"},
+			{"key1", "one"},
+		},
+		ListNonComparableField: []NonComparableStruct{
+			{"key2", ptr.To("two")},
+			{"key1", ptr.To("one")},
+		},
+	}
+	st.Value(&struct1).ExpectValidateFalseByPath(map[string][]string{
+		"listComparableField[0]":    {"field Struct.ListComparableField[*]"},
+		"listComparableField[1]":    {"field Struct.ListComparableField[*]"},
+		"listNonComparableField[0]": {"field Struct.ListNonComparableField[*]"},
+		"listNonComparableField[1]": {"field Struct.ListNonComparableField[*]"},
+	})
+	st.Value(&struct1).OldValue(&struct2).ExpectValid()
+	st.Value(&struct2).OldValue(&struct1).ExpectValid()
+}
+
+func TestUniquenessPtrKey(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		ListPtrKeyField: []PtrKeyStruct{
+			{ptr.To("key1"), "one"},
+			{ptr.To("key2"), "two"},
+			{ptr.To("key2"), "three"}, // duplicate key
+			{nil, "four"},
+			{nil, "five"}, // duplicate nil key
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Duplicate(field.NewPath("listPtrKeyField").Index(2), nil),
+		field.Duplicate(field.NewPath("listPtrKeyField").Index(4), nil),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/zz_generated.validations.go
new file mode 100644
index 0000000000..fb48c34721
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/zz_generated.validations.go
@@ -0,0 +1,284 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package singlekey
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_ListType validates an instance of ListType according
+// to declarative validation rules in the API schema.
+func Validate_ListType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj ListType) (errs field.ErrorList) {
+
+	// lists with map semantics require unique keys
+	if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+		func(a *OtherStruct, b *OtherStruct) bool { return a.KeyField == b.KeyField }); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ListField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherStruct, b *OtherStruct) bool { return a.KeyField == b.KeyField }, validate.DirectEqual, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherStruct, b *OtherStruct) bool { return a.KeyField == b.KeyField }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherStruct {
+				return oldObj.ListField
+			})
+		errs = append(errs, fn(fldPath.Child("listField"), obj.ListField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherTypedefStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherTypedefStruct, b *OtherTypedefStruct) bool { return a.KeyField == b.KeyField }, validate.DirectEqual, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherTypedefStruct, b *OtherTypedefStruct) bool { return a.KeyField == b.KeyField }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherTypedefStruct {
+				return oldObj.ListTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("listTypedefField"), obj.ListTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj ListType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherStruct, b *OtherStruct) bool { return a.KeyField == b.KeyField }, validate.DirectEqual, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ListType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) ListType {
+				return oldObj.TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("typedefField"), obj.TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherStruct, b *OtherStruct) bool { return a.KeyField == b.KeyField }, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListComparableField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherStruct, b *OtherStruct) bool { return a.KeyField == b.KeyField }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherStruct {
+				return oldObj.ListComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("listComparableField"), obj.ListComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListNonComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []NonComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *NonComparableStruct, b *NonComparableStruct) bool { return a.KeyField == b.KeyField }, deepEqualImpl_,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListNonComparableField[*]")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *NonComparableStruct, b *NonComparableStruct) bool { return a.KeyField == b.KeyField }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []NonComparableStruct {
+				return oldObj.ListNonComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("listNonComparableField"), obj.ListNonComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListPtrKeyField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []PtrKeyStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *PtrKeyStruct, b *PtrKeyStruct) bool {
+					return ((a.KeyField == nil && b.KeyField == nil) || (a.KeyField != nil && b.KeyField != nil && *a.KeyField == *b.KeyField))
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []PtrKeyStruct {
+				return oldObj.ListPtrKeyField
+			})
+		errs = append(errs, fn(fldPath.Child("listPtrKeyField"), obj.ListPtrKeyField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
+func deepEqualImpl_[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/doc.go
new file mode 100644
index 0000000000..50560cf2b8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/doc.go
@@ -0,0 +1,88 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package listset
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:listType=set
+	SliceStringField []string `json:"sliceStringField"`
+
+	// +k8s:listType=set
+	SliceIntField []int `json:"sliceIntField"`
+
+	// +k8s:listType=set
+	SliceComparableField []ComparableStruct `json:"sliceComparableField"`
+
+	// +k8s:listType=set
+	SliceNonComparableField []NonComparableStruct `json:"sliceNonComparableField"`
+
+	// +k8s:listType=set
+	SliceFalselyComparableField []FalselyComparableStruct `json:"sliceFalselyComparableField"`
+}
+
+type ImmutableStruct struct {
+	TypeMeta int
+
+	// +k8s:eachVal=+k8s:immutable
+	SliceComparableField []ComparableStruct `json:"sliceComparableField"`
+
+	// +k8s:listType=set
+	// +k8s:eachVal=+k8s:immutable
+	SliceSetComparableField []ComparableStruct `json:"sliceSetComparableField"`
+
+	// +k8s:eachVal=+k8s:immutable
+	SliceNonComparableField []NonComparableStruct `json:"sliceNonComparableField"`
+
+	// +k8s:listType=set
+	// +k8s:eachVal=+k8s:immutable
+	SliceSetNonComparableField []NonComparableStruct `json:"sliceSetNonComparableField"`
+
+	// +k8s:eachVal=+k8s:immutable
+	SlicePrimitiveField []int `json:"slicePrimitiveField"`
+
+	// +k8s:listType=set
+	// +k8s:eachVal=+k8s:immutable
+	SliceSetPrimitiveField []int `json:"sliceSetPrimitiveField"`
+
+	// +k8s:listType=set
+	// +k8s:eachVal=+k8s:immutable
+	SliceSetFalselyComparableField []FalselyComparableStruct `json:"sliceSetFalselyComparableField"`
+}
+
+type ComparableStruct struct {
+	StringField string `json:"stringField"`
+}
+
+type NonComparableStruct struct {
+	SliceField []string `json:"sliceField"`
+}
+
+// FalselyComparableStruct contains a pointer field which makes Go's == operator
+// only compare the pointers, not the underlying values
+type FalselyComparableStruct struct {
+	StringPtrField *string `json:"stringPtrField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/doc_test.go
new file mode 100644
index 0000000000..a04c007b0e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/doc_test.go
@@ -0,0 +1,94 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package listset
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{}).ExpectValid()
+
+	st.Value(&Struct{
+		SliceStringField:     []string{"aaa", "bbb"},
+		SliceIntField:        []int{1, 2},
+		SliceComparableField: []ComparableStruct{{"aaa"}, {"bbb"}},
+		SliceNonComparableField: []NonComparableStruct{
+			{[]string{"aaa", "bbb"}},
+			{[]string{"bbb", "aaa"}},
+		},
+	}).ExpectValid()
+
+	ptrS1 := ptr.To("same value")
+	ptrS2 := ptr.To("same value")
+	st.Value(&Struct{
+		SliceStringField:     []string{"aaa", "bbb", "ccc", "ccc", "bbb", "aaa"},
+		SliceIntField:        []int{1, 2, 3, 3, 2, 1},
+		SliceComparableField: []ComparableStruct{{"aaa"}, {"bbb"}, {"ccc"}, {"ccc"}, {"bbb"}, {"aaa"}},
+		SliceNonComparableField: []NonComparableStruct{
+			{[]string{"aaa", "111"}},
+			{[]string{"bbb", "222"}},
+			{[]string{"ccc", "333"}},
+			{[]string{"ccc", "333"}},
+			{[]string{"bbb", "222"}},
+			{[]string{"aaa", "111"}},
+		},
+		SliceFalselyComparableField: []FalselyComparableStruct{
+			{StringPtrField: ptrS1},
+			{StringPtrField: ptrS2},
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Duplicate(field.NewPath("sliceStringField").Index(3), nil),
+		field.Duplicate(field.NewPath("sliceStringField").Index(4), nil),
+		field.Duplicate(field.NewPath("sliceStringField").Index(5), nil),
+		field.Duplicate(field.NewPath("sliceIntField").Index(3), nil),
+		field.Duplicate(field.NewPath("sliceIntField").Index(4), nil),
+		field.Duplicate(field.NewPath("sliceIntField").Index(5), nil),
+		field.Duplicate(field.NewPath("sliceComparableField").Index(3), nil),
+		field.Duplicate(field.NewPath("sliceComparableField").Index(4), nil),
+		field.Duplicate(field.NewPath("sliceComparableField").Index(5), nil),
+		field.Duplicate(field.NewPath("sliceNonComparableField").Index(3), nil),
+		field.Duplicate(field.NewPath("sliceNonComparableField").Index(4), nil),
+		field.Duplicate(field.NewPath("sliceNonComparableField").Index(5), nil),
+		field.Duplicate(field.NewPath("sliceFalselyComparableField").Index(1), nil),
+	})
+}
+
+func TestSetCorrelation(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	structNew := ImmutableStruct{SliceSetComparableField: []ComparableStruct{{"aaa"}, {"bbb"}}}
+	structOld := ImmutableStruct{SliceSetComparableField: []ComparableStruct{{"bbb"}, {"aaa"}}}
+	st.Value(&structNew).OldValue(&structOld).ExpectValid()
+
+	structNew = ImmutableStruct{SliceSetNonComparableField: []NonComparableStruct{{[]string{"aaa"}}, {[]string{"bbb"}}}}
+	structOld = ImmutableStruct{SliceSetNonComparableField: []NonComparableStruct{{[]string{"bbb"}}, {[]string{"aaa"}}}}
+	st.Value(&structNew).OldValue(&structOld).ExpectValid()
+
+	structNew = ImmutableStruct{SliceSetPrimitiveField: []int{1, 2}}
+	structOld = ImmutableStruct{SliceSetPrimitiveField: []int{2, 1}}
+	st.Value(&structNew).OldValue(&structOld).ExpectValid()
+
+	structNew = ImmutableStruct{SliceSetFalselyComparableField: []FalselyComparableStruct{{StringPtrField: ptr.To("same value")}}}
+	structOld = ImmutableStruct{SliceSetFalselyComparableField: []FalselyComparableStruct{{StringPtrField: ptr.To("same value")}}}
+	st.Value(&structNew).OldValue(&structOld).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/zz_generated.validations.go
new file mode 100644
index 0000000000..77b155ffdd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/zz_generated.validations.go
@@ -0,0 +1,443 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package listset
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type ImmutableStruct
+	scheme.AddValidationFunc(
+		(*ImmutableStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ImmutableStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*ImmutableStruct),
+					safe.Cast[*ImmutableStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_ImmutableStruct validates an instance of ImmutableStruct according
+// to declarative validation rules in the API schema.
+func Validate_ImmutableStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ImmutableStruct) (errs field.ErrorList) {
+
+	// field ImmutableStruct.TypeMeta has no validation
+
+	{ // field ImmutableStruct.SliceComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ImmutableStruct) []ComparableStruct {
+				return oldObj.SliceComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceComparableField"), obj.SliceComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ImmutableStruct.SliceSetComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, nil, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ImmutableStruct) []ComparableStruct {
+				return oldObj.SliceSetComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceSetComparableField"), obj.SliceSetComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ImmutableStruct.SliceNonComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []NonComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ImmutableStruct) []NonComparableStruct {
+				return oldObj.SliceNonComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceNonComparableField"), obj.SliceNonComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ImmutableStruct.SliceSetNonComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []NonComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, nil, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ImmutableStruct) []NonComparableStruct {
+				return oldObj.SliceSetNonComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceSetNonComparableField"), obj.SliceSetNonComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ImmutableStruct.SlicePrimitiveField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ImmutableStruct) []int {
+				return oldObj.SlicePrimitiveField
+			})
+		errs = append(errs, fn(fldPath.Child("slicePrimitiveField"), obj.SlicePrimitiveField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ImmutableStruct.SliceSetPrimitiveField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, nil, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ImmutableStruct) []int {
+				return oldObj.SliceSetPrimitiveField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceSetPrimitiveField"), obj.SliceSetPrimitiveField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ImmutableStruct.SliceSetFalselyComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []FalselyComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, nil, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ImmutableStruct) []FalselyComparableStruct {
+				return oldObj.SliceSetFalselyComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceSetFalselyComparableField"), obj.SliceSetFalselyComparableField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.SliceStringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.SliceStringField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceStringField"), obj.SliceStringField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceIntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []int {
+				return oldObj.SliceIntField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceIntField"), obj.SliceIntField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []ComparableStruct {
+				return oldObj.SliceComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceComparableField"), obj.SliceComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceNonComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []NonComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []NonComparableStruct {
+				return oldObj.SliceNonComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceNonComparableField"), obj.SliceNonComparableField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceFalselyComparableField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []FalselyComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []FalselyComparableStruct {
+				return oldObj.SliceFalselyComparableField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceFalselyComparableField"), obj.SliceFalselyComparableField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
+func deepEqualImpl_[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxbytes/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxbytes/doc.go
new file mode 100644
index 0000000000..6859a1c5c5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxbytes/doc.go
@@ -0,0 +1,81 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package maxbytes
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:maxBytes=0
+	Max0Field string `json:"max0Field"`
+
+	// +k8s:maxBytes=0
+	Max0PtrField *string `json:"max0PtrField"`
+
+	// +k8s:maxBytes=10
+	Max10Field string `json:"max10Field"`
+
+	// +k8s:maxBytes=10
+	Max10PtrField *string `json:"max10PtrField"`
+
+	// +k8s:maxBytes=0
+	Max0UnvalidatedTypedefField UnvalidatedStringType `json:"max0UnvalidatedTypedefField"`
+
+	// +k8s:maxBytes=0
+	Max0UnvalidatedTypedefPtrField *UnvalidatedStringType `json:"max0UnvalidatedTypedefPtrField"`
+
+	// +k8s:maxBytes=10
+	Max10UnvalidatedTypedefField UnvalidatedStringType `json:"max10UnvalidatedTypedefField"`
+
+	// +k8s:maxBytes=10
+	Max10UnvalidatedTypedefPtrField *UnvalidatedStringType `json:"max10UnvalidatedTypedefPtrField"`
+
+	// Note: no validation here
+	Max0ValidatedTypedefField Max0Type `json:"max0ValidatedTypedefField"`
+
+	// Note: no validation here
+	Max0ValidatedTypedefPtrField *Max0Type `json:"max0ValidatedTypedefPtrField"`
+
+	// Note: no validation here
+	Max10ValidatedTypedefField Max10Type `json:"max10ValidatedTypedefField"`
+
+	// Note: no validation here
+	Max10ValidatedTypedefPtrField *Max10Type `json:"max10ValidatedTypedefPtrField"`
+}
+
+// Note: no validation here
+type UnvalidatedStringType string
+
+// This tests that markers on type definitions
+// are pulled through the validations of fields
+// that use the type definition.
+// +k8s:maxBytes=0
+type Max0Type string
+
+// This tests that markers on type definitions
+// are pulled through the validations of fields
+// that use the type definition.
+// +k8s:maxBytes=10
+type Max10Type string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxbytes/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxbytes/doc_test.go
new file mode 100644
index 0000000000..47bc3f416d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxbytes/doc_test.go
@@ -0,0 +1,118 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package maxbytes
+
+import (
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max10Field:                      strings.Repeat("x", 1),
+		Max10PtrField:                   ptr.To(strings.Repeat("x", 1)),
+		Max10UnvalidatedTypedefField:    UnvalidatedStringType(strings.Repeat("x", 1)),
+		Max10UnvalidatedTypedefPtrField: ptr.To(UnvalidatedStringType(strings.Repeat("x", 1))),
+		Max10ValidatedTypedefField:      Max10Type(strings.Repeat("x", 1)),
+		Max10ValidatedTypedefPtrField:   ptr.To(Max10Type(strings.Repeat("x", 1))),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max10Field:                      strings.Repeat("x", 9),
+		Max10PtrField:                   ptr.To(strings.Repeat("x", 9)),
+		Max10UnvalidatedTypedefField:    UnvalidatedStringType(strings.Repeat("x", 9)),
+		Max10UnvalidatedTypedefPtrField: ptr.To(UnvalidatedStringType(strings.Repeat("x", 9))),
+		Max10ValidatedTypedefField:      Max10Type(strings.Repeat("x", 9)),
+		Max10ValidatedTypedefPtrField:   ptr.To(Max10Type(strings.Repeat("x", 9))),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max10Field:                      strings.Repeat("x", 10),
+		Max10PtrField:                   ptr.To(strings.Repeat("x", 10)),
+		Max10UnvalidatedTypedefField:    UnvalidatedStringType(strings.Repeat("x", 10)),
+		Max10UnvalidatedTypedefPtrField: ptr.To(UnvalidatedStringType(strings.Repeat("x", 10))),
+		Max10ValidatedTypedefField:      Max10Type(strings.Repeat("x", 10)),
+		Max10ValidatedTypedefPtrField:   ptr.To(Max10Type(strings.Repeat("x", 10))),
+	}).ExpectValid()
+
+	testVal := &Struct{
+		Max0Field:                       strings.Repeat("x", 1),
+		Max0PtrField:                    ptr.To(strings.Repeat("x", 1)),
+		Max10Field:                      strings.Repeat("x", 11),
+		Max10PtrField:                   ptr.To(strings.Repeat("x", 11)),
+		Max0UnvalidatedTypedefField:     UnvalidatedStringType(strings.Repeat("x", 1)),
+		Max0UnvalidatedTypedefPtrField:  ptr.To(UnvalidatedStringType(strings.Repeat("x", 1))),
+		Max10UnvalidatedTypedefField:    UnvalidatedStringType(strings.Repeat("x", 11)),
+		Max10UnvalidatedTypedefPtrField: ptr.To(UnvalidatedStringType(strings.Repeat("x", 11))),
+		Max0ValidatedTypedefField:       Max0Type(strings.Repeat("x", 1)),
+		Max0ValidatedTypedefPtrField:    ptr.To(Max0Type(strings.Repeat("x", 1))),
+		Max10ValidatedTypedefField:      Max10Type(strings.Repeat("x", 11)),
+		Max10ValidatedTypedefPtrField:   ptr.To(Max10Type(strings.Repeat("x", 11))),
+	}
+	st.Value(testVal).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooLong(field.NewPath("max0Field"), "", 0),
+		field.TooLong(field.NewPath("max0PtrField"), "", 0),
+		field.TooLong(field.NewPath("max10Field"), "", 10),
+		field.TooLong(field.NewPath("max10PtrField"), "", 10),
+		field.TooLong(field.NewPath("max0UnvalidatedTypedefField"), "", 0),
+		field.TooLong(field.NewPath("max0UnvalidatedTypedefPtrField"), "", 0),
+		field.TooLong(field.NewPath("max10UnvalidatedTypedefField"), "", 10),
+		field.TooLong(field.NewPath("max10UnvalidatedTypedefPtrField"), "", 10),
+		field.TooLong(field.NewPath("max0ValidatedTypedefField"), "", 0),
+		field.TooLong(field.NewPath("max0ValidatedTypedefPtrField"), "", 0),
+		field.TooLong(field.NewPath("max10ValidatedTypedefField"), "", 10),
+		field.TooLong(field.NewPath("max10ValidatedTypedefPtrField"), "", 10),
+	})
+
+	// Test validation ratcheting
+	st.Value(&Struct{
+		Max0Field:                       strings.Repeat("x", 1),
+		Max0PtrField:                    ptr.To(strings.Repeat("x", 1)),
+		Max10Field:                      strings.Repeat("x", 11),
+		Max10PtrField:                   ptr.To(strings.Repeat("x", 11)),
+		Max0UnvalidatedTypedefField:     UnvalidatedStringType(strings.Repeat("x", 1)),
+		Max0UnvalidatedTypedefPtrField:  ptr.To(UnvalidatedStringType(strings.Repeat("x", 1))),
+		Max10UnvalidatedTypedefField:    UnvalidatedStringType(strings.Repeat("x", 11)),
+		Max10UnvalidatedTypedefPtrField: ptr.To(UnvalidatedStringType(strings.Repeat("x", 11))),
+		Max0ValidatedTypedefField:       Max0Type(strings.Repeat("x", 1)),
+		Max0ValidatedTypedefPtrField:    ptr.To(Max0Type(strings.Repeat("x", 1))),
+		Max10ValidatedTypedefField:      Max10Type(strings.Repeat("x", 11)),
+		Max10ValidatedTypedefPtrField:   ptr.To(Max10Type(strings.Repeat("x", 11))),
+	}).OldValue(&Struct{
+		Max0Field:                       strings.Repeat("x", 1),
+		Max0PtrField:                    ptr.To(strings.Repeat("x", 1)),
+		Max10Field:                      strings.Repeat("x", 11),
+		Max10PtrField:                   ptr.To(strings.Repeat("x", 11)),
+		Max0UnvalidatedTypedefField:     UnvalidatedStringType(strings.Repeat("x", 1)),
+		Max0UnvalidatedTypedefPtrField:  ptr.To(UnvalidatedStringType(strings.Repeat("x", 1))),
+		Max10UnvalidatedTypedefField:    UnvalidatedStringType(strings.Repeat("x", 11)),
+		Max10UnvalidatedTypedefPtrField: ptr.To(UnvalidatedStringType(strings.Repeat("x", 11))),
+		Max0ValidatedTypedefField:       Max0Type(strings.Repeat("x", 1)),
+		Max0ValidatedTypedefPtrField:    ptr.To(Max0Type(strings.Repeat("x", 1))),
+		Max10ValidatedTypedefField:      Max10Type(strings.Repeat("x", 11)),
+		Max10ValidatedTypedefPtrField:   ptr.To(Max10Type(strings.Repeat("x", 11))),
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxbytes/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxbytes/zz_generated.validations.go
new file mode 100644
index 0000000000..2235d12c35
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxbytes/zz_generated.validations.go
@@ -0,0 +1,373 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package maxbytes
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Max0Type validates an instance of Max0Type according
+// to declarative validation rules in the API schema.
+func Validate_Max0Type(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Max0Type) (errs field.ErrorList) {
+
+	if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Max10Type validates an instance of Max10Type according
+// to declarative validation rules in the API schema.
+func Validate_Max10Type(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Max10Type) (errs field.ErrorList) {
+
+	if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Max0Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.Max0Field
+			})
+		errs = append(errs, fn(fldPath.Child("max0Field"), &obj.Max0Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max0PtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.Max0PtrField
+			})
+		errs = append(errs, fn(fldPath.Child("max0PtrField"), obj.Max0PtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.Max10Field
+			})
+		errs = append(errs, fn(fldPath.Child("max10Field"), &obj.Max10Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10PtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.Max10PtrField
+			})
+		errs = append(errs, fn(fldPath.Child("max10PtrField"), obj.Max10PtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max0UnvalidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *UnvalidatedStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *UnvalidatedStringType {
+				return &oldObj.Max0UnvalidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("max0UnvalidatedTypedefField"), &obj.Max0UnvalidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max0UnvalidatedTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *UnvalidatedStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *UnvalidatedStringType {
+				return oldObj.Max0UnvalidatedTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("max0UnvalidatedTypedefPtrField"), obj.Max0UnvalidatedTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10UnvalidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *UnvalidatedStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *UnvalidatedStringType {
+				return &oldObj.Max10UnvalidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("max10UnvalidatedTypedefField"), &obj.Max10UnvalidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10UnvalidatedTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *UnvalidatedStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *UnvalidatedStringType {
+				return oldObj.Max10UnvalidatedTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("max10UnvalidatedTypedefPtrField"), obj.Max10UnvalidatedTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max0ValidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Max0Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Max0Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Max0Type {
+				return &oldObj.Max0ValidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("max0ValidatedTypedefField"), &obj.Max0ValidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max0ValidatedTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Max0Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Max0Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Max0Type {
+				return oldObj.Max0ValidatedTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("max0ValidatedTypedefPtrField"), obj.Max0ValidatedTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10ValidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Max10Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Max10Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Max10Type {
+				return &oldObj.Max10ValidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("max10ValidatedTypedefField"), &obj.Max10ValidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10ValidatedTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Max10Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Max10Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Max10Type {
+				return oldObj.Max10ValidatedTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("max10ValidatedTypedefPtrField"), obj.Max10ValidatedTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maximum/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maximum/doc.go
new file mode 100644
index 0000000000..e2a6bfae1f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maximum/doc.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package maximum
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:maximum=1
+	IntField int `json:"intField"`
+	// +k8s:maximum=1
+	IntPtrField *int `json:"intPtrField"`
+
+	// "int8" becomes "byte" somewhere in gengo.  We don't need it so just skip it.
+
+	// +k8s:maximum=1
+	Int16Field int16 `json:"int16Field"`
+	// +k8s:maximum=1
+	Int32Field int32 `json:"int32Field"`
+	// +k8s:maximum=1
+	Int64Field int64 `json:"int64Field"`
+
+	// +k8s:maximum=1
+	UintField uint `json:"uintField"`
+	// +k8s:maximum=1
+	UintPtrField *uint `json:"uintPtrField"`
+
+	// +k8s:maximum=1
+	Uint16Field uint16 `json:"uint16Field"`
+	// +k8s:maximum=1
+	Uint32Field uint32 `json:"uint32Field"`
+	// +k8s:maximum=1
+	Uint64Field uint64 `json:"uint64Field"`
+
+	TypedefField    IntType  `json:"typedefField"`
+	TypedefPtrField *IntType `json:"typedefPtrField"`
+}
+
+// +k8s:maximum=1
+type IntType int
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maximum/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maximum/doc_test.go
new file mode 100644
index 0000000000..fcc154d0a4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maximum/doc_test.go
@@ -0,0 +1,100 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package maximum
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// invalid values (greater than maximum=1)
+		IntField:        2,
+		IntPtrField:     ptr.To(2),
+		Int16Field:      2,
+		Int32Field:      2,
+		Int64Field:      2,
+		UintField:       2,
+		Uint16Field:     2,
+		Uint32Field:     2,
+		Uint64Field:     2,
+		UintPtrField:    ptr.To(uint(2)),
+		TypedefField:    IntType(2),
+		TypedefPtrField: ptr.To(IntType(2)),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring(), field.ErrorList{
+		field.Invalid(field.NewPath("intField"), nil, ""),
+		field.Invalid(field.NewPath("intPtrField"), nil, ""),
+		field.Invalid(field.NewPath("int16Field"), nil, ""),
+		field.Invalid(field.NewPath("int32Field"), nil, ""),
+		field.Invalid(field.NewPath("int64Field"), nil, ""),
+		field.Invalid(field.NewPath("uintField"), nil, ""),
+		field.Invalid(field.NewPath("uintPtrField"), nil, ""),
+		field.Invalid(field.NewPath("uint16Field"), nil, ""),
+		field.Invalid(field.NewPath("uint32Field"), nil, ""),
+		field.Invalid(field.NewPath("uint64Field"), nil, ""),
+		field.Invalid(field.NewPath("typedefField"), nil, ""),
+		field.Invalid(field.NewPath("typedefPtrField"), nil, ""),
+	})
+	// Test validation ratcheting
+	st.Value(&Struct{
+		IntField:        2,
+		IntPtrField:     ptr.To(2),
+		Int16Field:      2,
+		Int32Field:      2,
+		Int64Field:      2,
+		UintField:       2,
+		Uint16Field:     2,
+		Uint32Field:     2,
+		Uint64Field:     2,
+		UintPtrField:    ptr.To(uint(2)),
+		TypedefField:    IntType(2),
+		TypedefPtrField: ptr.To(IntType(2)),
+	}).OldValue(&Struct{
+		IntField:        2,
+		IntPtrField:     ptr.To(2),
+		Int16Field:      2,
+		Int32Field:      2,
+		Int64Field:      2,
+		UintField:       2,
+		Uint16Field:     2,
+		Uint32Field:     2,
+		Uint64Field:     2,
+		UintPtrField:    ptr.To(uint(2)),
+		TypedefField:    IntType(2),
+		TypedefPtrField: ptr.To(IntType(2)),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		IntField:        1,
+		IntPtrField:     ptr.To(1),
+		Int16Field:      1,
+		Int32Field:      1,
+		Int64Field:      1,
+		UintField:       1,
+		Uint16Field:     1,
+		Uint32Field:     1,
+		Uint64Field:     1,
+		UintPtrField:    ptr.To(uint(1)),
+		TypedefField:    IntType(1),
+		TypedefPtrField: ptr.To(IntType(1)),
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maximum/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maximum/zz_generated.validations.go
new file mode 100644
index 0000000000..0e745e3ee8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maximum/zz_generated.validations.go
@@ -0,0 +1,364 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package maximum
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_IntType validates an instance of IntType according
+// to declarative validation rules in the API schema.
+func Validate_IntType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *IntType) (errs field.ErrorList) {
+
+	if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.IntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return &oldObj.IntField
+			})
+		errs = append(errs, fn(fldPath.Child("intField"), &obj.IntField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return oldObj.IntPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("intPtrField"), obj.IntPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Int16Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int16,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int16 {
+				return &oldObj.Int16Field
+			})
+		errs = append(errs, fn(fldPath.Child("int16Field"), &obj.Int16Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Int32Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int32,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int32 {
+				return &oldObj.Int32Field
+			})
+		errs = append(errs, fn(fldPath.Child("int32Field"), &obj.Int32Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Int64Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int64 {
+				return &oldObj.Int64Field
+			})
+		errs = append(errs, fn(fldPath.Child("int64Field"), &obj.Int64Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.UintField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *uint,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *uint {
+				return &oldObj.UintField
+			})
+		errs = append(errs, fn(fldPath.Child("uintField"), &obj.UintField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.UintPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *uint,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *uint {
+				return oldObj.UintPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("uintPtrField"), obj.UintPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Uint16Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *uint16,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *uint16 {
+				return &oldObj.Uint16Field
+			})
+		errs = append(errs, fn(fldPath.Child("uint16Field"), &obj.Uint16Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Uint32Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *uint32,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *uint32 {
+				return &oldObj.Uint32Field
+			})
+		errs = append(errs, fn(fldPath.Child("uint32Field"), &obj.Uint32Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Uint64Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *uint64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *uint64 {
+				return &oldObj.Uint64Field
+			})
+		errs = append(errs, fn(fldPath.Child("uint64Field"), &obj.Uint64Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_IntType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *IntType {
+				return &oldObj.TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("typedefField"), &obj.TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.TypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_IntType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *IntType {
+				return oldObj.TypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("typedefPtrField"), obj.TypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_primitive/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_primitive/doc.go
new file mode 100644
index 0000000000..fb2b2607f8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_primitive/doc.go
@@ -0,0 +1,44 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package sliceofprimitive
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:maxItems=0
+	Max0Field []int `json:"max0Field"`
+
+	// +k8s:maxItems=10
+	Max10Field []int `json:"max10Field"`
+
+	// +k8s:maxItems=0
+	Max0TypedefField []IntType `json:"max0TypedefField"`
+
+	// +k8s:maxItems=10
+	Max10TypedefField []IntType `json:"max10TypedefField"`
+}
+
+type IntType int
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_primitive/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_primitive/doc_test.go
new file mode 100644
index 0000000000..6611443de0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_primitive/doc_test.go
@@ -0,0 +1,79 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sliceofprimitive
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max0Field:         make([]int, 0),
+		Max10Field:        make([]int, 0),
+		Max0TypedefField:  make([]IntType, 0),
+		Max10TypedefField: make([]IntType, 0),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max10Field:        make([]int, 1),
+		Max10TypedefField: make([]IntType, 1),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max10Field:        make([]int, 9),
+		Max10TypedefField: make([]IntType, 9),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max10Field:        make([]int, 10),
+		Max10TypedefField: make([]IntType, 10),
+	}).ExpectValid()
+
+	testVal := &Struct{
+		Max0Field:         make([]int, 1),
+		Max10Field:        make([]int, 11),
+		Max0TypedefField:  make([]IntType, 1),
+		Max10TypedefField: make([]IntType, 11),
+	}
+	st.Value(testVal).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooMany(field.NewPath("max0Field"), 1, 0),
+		field.TooMany(field.NewPath("max10Field"), 11, 10),
+		field.TooMany(field.NewPath("max0TypedefField"), 1, 0),
+		field.TooMany(field.NewPath("max10TypedefField"), 11, 10),
+	})
+	// Test validation ratcheting
+	st.Value(&Struct{
+		Max0Field:         make([]int, 1),
+		Max10Field:        make([]int, 11),
+		Max0TypedefField:  make([]IntType, 1),
+		Max10TypedefField: make([]IntType, 11),
+	}).OldValue(&Struct{
+		Max0Field:         make([]int, 1),
+		Max10Field:        make([]int, 11),
+		Max0TypedefField:  make([]IntType, 1),
+		Max10TypedefField: make([]IntType, 11),
+	}).ExpectValid()
+
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_primitive/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_primitive/zz_generated.validations.go
new file mode 100644
index 0000000000..02a2bc11d1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_primitive/zz_generated.validations.go
@@ -0,0 +1,184 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package sliceofprimitive
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Max0Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 0).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []int {
+				return oldObj.Max0Field
+			})
+		errs = append(errs, fn(fldPath.Child("max0Field"), obj.Max0Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 10).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []int {
+				return oldObj.Max10Field
+			})
+		errs = append(errs, fn(fldPath.Child("max10Field"), obj.Max10Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max0TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 0).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []IntType {
+				return oldObj.Max0TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("max0TypedefField"), obj.Max0TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 10).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []IntType {
+				return oldObj.Max10TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("max10TypedefField"), obj.Max10TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_struct/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_struct/doc.go
new file mode 100644
index 0000000000..88c53d05a7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_struct/doc.go
@@ -0,0 +1,46 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package sliceofstruct
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:maxItems=0
+	Max0Field []OtherStruct `json:"max0Field"`
+
+	// +k8s:maxItems=10
+	Max10Field []OtherStruct `json:"max10Field"`
+
+	// +k8s:maxItems=0
+	Max0TypedefField []OtherTypedefStruct `json:"max0TypedefField"`
+
+	// +k8s:maxItems=10
+	Max10TypedefField []OtherTypedefStruct `json:"max10TypedefField"`
+}
+
+type OtherStruct struct{}
+
+type OtherTypedefStruct OtherStruct
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_struct/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_struct/doc_test.go
new file mode 100644
index 0000000000..ce38b50a75
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_struct/doc_test.go
@@ -0,0 +1,78 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sliceofstruct
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max0Field:         make([]OtherStruct, 0),
+		Max10Field:        make([]OtherStruct, 0),
+		Max0TypedefField:  make([]OtherTypedefStruct, 0),
+		Max10TypedefField: make([]OtherTypedefStruct, 0),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max10Field:        make([]OtherStruct, 1),
+		Max10TypedefField: make([]OtherTypedefStruct, 1),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max10Field:        make([]OtherStruct, 9),
+		Max10TypedefField: make([]OtherTypedefStruct, 9),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max10Field:        make([]OtherStruct, 10),
+		Max10TypedefField: make([]OtherTypedefStruct, 10),
+	}).ExpectValid()
+
+	testVal := &Struct{
+		Max0Field:         make([]OtherStruct, 1),
+		Max10Field:        make([]OtherStruct, 11),
+		Max0TypedefField:  make([]OtherTypedefStruct, 1),
+		Max10TypedefField: make([]OtherTypedefStruct, 11),
+	}
+	st.Value(testVal).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooMany(field.NewPath("max0Field"), 1, 0),
+		field.TooMany(field.NewPath("max10Field"), 11, 10),
+		field.TooMany(field.NewPath("max0TypedefField"), 1, 0),
+		field.TooMany(field.NewPath("max10TypedefField"), 11, 10),
+	})
+	// Test validation ratcheting
+	st.Value(&Struct{
+		Max0Field:         make([]OtherStruct, 1),
+		Max10Field:        make([]OtherStruct, 11),
+		Max0TypedefField:  make([]OtherTypedefStruct, 1),
+		Max10TypedefField: make([]OtherTypedefStruct, 11),
+	}).OldValue(&Struct{
+		Max0Field:         make([]OtherStruct, 1),
+		Max10Field:        make([]OtherStruct, 11),
+		Max0TypedefField:  make([]OtherTypedefStruct, 1),
+		Max10TypedefField: make([]OtherTypedefStruct, 11),
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_struct/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_struct/zz_generated.validations.go
new file mode 100644
index 0000000000..2151d39a4b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/slice_of_struct/zz_generated.validations.go
@@ -0,0 +1,184 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package sliceofstruct
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Max0Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 0).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherStruct {
+				return oldObj.Max0Field
+			})
+		errs = append(errs, fn(fldPath.Child("max0Field"), obj.Max0Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 10).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherStruct {
+				return oldObj.Max10Field
+			})
+		errs = append(errs, fn(fldPath.Child("max10Field"), obj.Max10Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max0TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherTypedefStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 0).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherTypedefStruct {
+				return oldObj.Max0TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("max0TypedefField"), obj.Max0TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherTypedefStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 10).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherTypedefStruct {
+				return oldObj.Max10TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("max10TypedefField"), obj.Max10TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/typedef_to_slice/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/typedef_to_slice/doc.go
new file mode 100644
index 0000000000..9cdc452269
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/typedef_to_slice/doc.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package typedeftoslice
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Note: no validation here
+type UnvalidatedType []int
+
+// +k8s:maxItems=0
+type Max0Type []int
+
+// +k8s:maxItems=10
+type Max10Type []int
+
+// Note: no validation here
+type UnvalidatedPtrType []*int
+
+type SliceType []int
+
+// +k8s:maxItems=0
+type Max0TypedefType SliceType
+
+// +k8s:maxItems=10
+type Max10TypedefType SliceType
+
+type Struct struct {
+	TypeMeta int
+
+	UnvalidatedField UnvalidatedType `json:"unvalidatedField"`
+
+	Max0Field Max0Type `json:"max0Field"`
+
+	Max10Field Max10Type `json:"max10Field"`
+
+	Max0TypedefField Max0TypedefType `json:"max0TypedefField"`
+
+	Max10TypedefField Max10TypedefType `json:"max10TypedefField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/typedef_to_slice/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/typedef_to_slice/doc_test.go
new file mode 100644
index 0000000000..b5fe133e2d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/typedef_to_slice/doc_test.go
@@ -0,0 +1,85 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package typedeftoslice
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		UnvalidatedField:  make(UnvalidatedType, 0),
+		Max0Field:         make(Max0Type, 0),
+		Max10Field:        make(Max10Type, 0),
+		Max0TypedefField:  make(Max0TypedefType, 0),
+		Max10TypedefField: make(Max10TypedefType, 0),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		UnvalidatedField:  make(UnvalidatedType, 1),
+		Max10Field:        make(Max10Type, 1),
+		Max10TypedefField: make(Max10TypedefType, 1),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		UnvalidatedField:  make(UnvalidatedType, 9),
+		Max10Field:        make(Max10Type, 9),
+		Max10TypedefField: make(Max10TypedefType, 9),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		UnvalidatedField:  make(UnvalidatedType, 10),
+		Max10Field:        make(Max10Type, 10),
+		Max10TypedefField: make(Max10TypedefType, 10),
+	}).ExpectValid()
+
+	testVal := &Struct{
+		UnvalidatedField:  make(UnvalidatedType, 11),
+		Max0Field:         make(Max0Type, 1),
+		Max10Field:        make(Max10Type, 11),
+		Max0TypedefField:  make(Max0TypedefType, 1),
+		Max10TypedefField: make(Max10TypedefType, 11),
+	}
+	st.Value(testVal).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooMany(field.NewPath("max0Field"), 1, 0),
+		field.TooMany(field.NewPath("max10Field"), 11, 10),
+		field.TooMany(field.NewPath("max0TypedefField"), 1, 0),
+		field.TooMany(field.NewPath("max10TypedefField"), 11, 10),
+	})
+	// Test validation ratcheting
+	st.Value(&Struct{
+		UnvalidatedField:  make(UnvalidatedType, 1),
+		Max0Field:         make(Max0Type, 1),
+		Max10Field:        make(Max10Type, 11),
+		Max0TypedefField:  make(Max0TypedefType, 1),
+		Max10TypedefField: make(Max10TypedefType, 11),
+	}).OldValue(&Struct{
+		UnvalidatedField:  make(UnvalidatedType, 1),
+		Max0Field:         make(Max0Type, 1),
+		Max10Field:        make(Max10Type, 11),
+		Max0TypedefField:  make(Max0TypedefType, 1),
+		Max10TypedefField: make(Max10TypedefType, 11),
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/typedef_to_slice/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/typedef_to_slice/zz_generated.validations.go
new file mode 100644
index 0000000000..633b156ccd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxitems/typedef_to_slice/zz_generated.validations.go
@@ -0,0 +1,229 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package typedeftoslice
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Max0Type validates an instance of Max0Type according
+// to declarative validation rules in the API schema.
+func Validate_Max0Type(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj Max0Type) (errs field.ErrorList) {
+
+	earlyReturn := false
+	if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 0).MarkShortCircuit(); len(e) != 0 {
+		errs = append(errs, e...)
+		earlyReturn = true
+	}
+	if earlyReturn {
+		return // do not proceed
+	}
+
+	return errs
+}
+
+// Validate_Max0TypedefType validates an instance of Max0TypedefType according
+// to declarative validation rules in the API schema.
+func Validate_Max0TypedefType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj Max0TypedefType) (errs field.ErrorList) {
+
+	earlyReturn := false
+	if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 0).MarkShortCircuit(); len(e) != 0 {
+		errs = append(errs, e...)
+		earlyReturn = true
+	}
+	if earlyReturn {
+		return // do not proceed
+	}
+
+	return errs
+}
+
+// Validate_Max10Type validates an instance of Max10Type according
+// to declarative validation rules in the API schema.
+func Validate_Max10Type(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj Max10Type) (errs field.ErrorList) {
+
+	earlyReturn := false
+	if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 10).MarkShortCircuit(); len(e) != 0 {
+		errs = append(errs, e...)
+		earlyReturn = true
+	}
+	if earlyReturn {
+		return // do not proceed
+	}
+
+	return errs
+}
+
+// Validate_Max10TypedefType validates an instance of Max10TypedefType according
+// to declarative validation rules in the API schema.
+func Validate_Max10TypedefType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj Max10TypedefType) (errs field.ErrorList) {
+
+	earlyReturn := false
+	if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 10).MarkShortCircuit(); len(e) != 0 {
+		errs = append(errs, e...)
+		earlyReturn = true
+	}
+	if earlyReturn {
+		return // do not proceed
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+	// field Struct.UnvalidatedField has no validation
+
+	{ // field Struct.Max0Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj Max0Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Max0Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) Max0Type {
+				return oldObj.Max0Field
+			})
+		errs = append(errs, fn(fldPath.Child("max0Field"), obj.Max0Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj Max10Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Max10Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) Max10Type {
+				return oldObj.Max10Field
+			})
+		errs = append(errs, fn(fldPath.Child("max10Field"), obj.Max10Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max0TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj Max0TypedefType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Max0TypedefType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) Max0TypedefType {
+				return oldObj.Max0TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("max0TypedefField"), obj.Max0TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj Max10TypedefType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Max10TypedefType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) Max10TypedefType {
+				return oldObj.Max10TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("max10TypedefField"), obj.Max10TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxlength/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxlength/doc.go
new file mode 100644
index 0000000000..0dad754cde
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxlength/doc.go
@@ -0,0 +1,75 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package maxlength
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:maxLength=0
+	Max0Field string `json:"max0Field"`
+
+	// +k8s:maxLength=0
+	Max0PtrField *string `json:"max0PtrField"`
+
+	// +k8s:maxLength=10
+	Max10Field string `json:"max10Field"`
+
+	// +k8s:maxLength=10
+	Max10PtrField *string `json:"max10PtrField"`
+
+	// +k8s:maxLength=0
+	Max0UnvalidatedTypedefField UnvalidatedStringType `json:"max0UnvalidatedTypedefField"`
+
+	// +k8s:maxLength=0
+	Max0UnvalidatedTypedefPtrField *UnvalidatedStringType `json:"max0UnvalidatedTypedefPtrField"`
+
+	// +k8s:maxLength=10
+	Max10UnvalidatedTypedefField UnvalidatedStringType `json:"max10UnvalidatedTypedefField"`
+
+	// +k8s:maxLength=10
+	Max10UnvalidatedTypedefPtrField *UnvalidatedStringType `json:"max10UnvalidatedTypedefPtrField"`
+
+	// Note: no validation here
+	Max0ValidatedTypedefField Max0Type `json:"max0ValidatedTypedefField"`
+
+	// Note: no validation here
+	Max0ValidatedTypedefPtrField *Max0Type `json:"max0ValidatedTypedefPtrField"`
+
+	// Note: no validation here
+	Max10ValidatedTypedefField Max10Type `json:"max10ValidatedTypedefField"`
+
+	// Note: no validation here
+	Max10ValidatedTypedefPtrField *Max10Type `json:"max10ValidatedTypedefPtrField"`
+}
+
+// Note: no validation here
+type UnvalidatedStringType string
+
+// +k8s:maxLength=0
+type Max0Type string
+
+// +k8s:maxLength=10
+type Max10Type string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxlength/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxlength/doc_test.go
new file mode 100644
index 0000000000..88b489db08
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxlength/doc_test.go
@@ -0,0 +1,118 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package maxlength
+
+import (
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max10Field:                      strings.Repeat("x", 1),
+		Max10PtrField:                   ptr.To(strings.Repeat("x", 1)),
+		Max10UnvalidatedTypedefField:    UnvalidatedStringType(strings.Repeat("x", 1)),
+		Max10UnvalidatedTypedefPtrField: ptr.To(UnvalidatedStringType(strings.Repeat("x", 1))),
+		Max10ValidatedTypedefField:      Max10Type(strings.Repeat("x", 1)),
+		Max10ValidatedTypedefPtrField:   ptr.To(Max10Type(strings.Repeat("x", 1))),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max10Field:                      strings.Repeat("x", 9),
+		Max10PtrField:                   ptr.To(strings.Repeat("x", 9)),
+		Max10UnvalidatedTypedefField:    UnvalidatedStringType(strings.Repeat("x", 9)),
+		Max10UnvalidatedTypedefPtrField: ptr.To(UnvalidatedStringType(strings.Repeat("x", 9))),
+		Max10ValidatedTypedefField:      Max10Type(strings.Repeat("x", 9)),
+		Max10ValidatedTypedefPtrField:   ptr.To(Max10Type(strings.Repeat("x", 9))),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max10Field:                      strings.Repeat("x", 10),
+		Max10PtrField:                   ptr.To(strings.Repeat("x", 10)),
+		Max10UnvalidatedTypedefField:    UnvalidatedStringType(strings.Repeat("x", 10)),
+		Max10UnvalidatedTypedefPtrField: ptr.To(UnvalidatedStringType(strings.Repeat("x", 10))),
+		Max10ValidatedTypedefField:      Max10Type(strings.Repeat("x", 10)),
+		Max10ValidatedTypedefPtrField:   ptr.To(Max10Type(strings.Repeat("x", 10))),
+	}).ExpectValid()
+
+	testVal := &Struct{
+		Max0Field:                       strings.Repeat("x", 1),
+		Max0PtrField:                    ptr.To(strings.Repeat("x", 1)),
+		Max10Field:                      strings.Repeat("x", 11),
+		Max10PtrField:                   ptr.To(strings.Repeat("x", 11)),
+		Max0UnvalidatedTypedefField:     UnvalidatedStringType(strings.Repeat("x", 1)),
+		Max0UnvalidatedTypedefPtrField:  ptr.To(UnvalidatedStringType(strings.Repeat("x", 1))),
+		Max10UnvalidatedTypedefField:    UnvalidatedStringType(strings.Repeat("x", 11)),
+		Max10UnvalidatedTypedefPtrField: ptr.To(UnvalidatedStringType(strings.Repeat("x", 11))),
+		Max0ValidatedTypedefField:       Max0Type(strings.Repeat("x", 1)),
+		Max0ValidatedTypedefPtrField:    ptr.To(Max0Type(strings.Repeat("x", 1))),
+		Max10ValidatedTypedefField:      Max10Type(strings.Repeat("x", 11)),
+		Max10ValidatedTypedefPtrField:   ptr.To(Max10Type(strings.Repeat("x", 11))),
+	}
+	st.Value(testVal).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooLongCharacters(field.NewPath("max0Field"), "", 0),
+		field.TooLongCharacters(field.NewPath("max0PtrField"), "", 0),
+		field.TooLongCharacters(field.NewPath("max10Field"), "", 10),
+		field.TooLongCharacters(field.NewPath("max10PtrField"), "", 10),
+		field.TooLongCharacters(field.NewPath("max0UnvalidatedTypedefField"), "", 0),
+		field.TooLongCharacters(field.NewPath("max0UnvalidatedTypedefPtrField"), "", 0),
+		field.TooLongCharacters(field.NewPath("max10UnvalidatedTypedefField"), "", 10),
+		field.TooLongCharacters(field.NewPath("max10UnvalidatedTypedefPtrField"), "", 10),
+		field.TooLongCharacters(field.NewPath("max0ValidatedTypedefField"), "", 0),
+		field.TooLongCharacters(field.NewPath("max0ValidatedTypedefPtrField"), "", 0),
+		field.TooLongCharacters(field.NewPath("max10ValidatedTypedefField"), "", 10),
+		field.TooLongCharacters(field.NewPath("max10ValidatedTypedefPtrField"), "", 10),
+	})
+
+	// Test validation ratcheting
+	st.Value(&Struct{
+		Max0Field:                       strings.Repeat("x", 1),
+		Max0PtrField:                    ptr.To(strings.Repeat("x", 1)),
+		Max10Field:                      strings.Repeat("x", 11),
+		Max10PtrField:                   ptr.To(strings.Repeat("x", 11)),
+		Max0UnvalidatedTypedefField:     UnvalidatedStringType(strings.Repeat("x", 1)),
+		Max0UnvalidatedTypedefPtrField:  ptr.To(UnvalidatedStringType(strings.Repeat("x", 1))),
+		Max10UnvalidatedTypedefField:    UnvalidatedStringType(strings.Repeat("x", 11)),
+		Max10UnvalidatedTypedefPtrField: ptr.To(UnvalidatedStringType(strings.Repeat("x", 11))),
+		Max0ValidatedTypedefField:       Max0Type(strings.Repeat("x", 1)),
+		Max0ValidatedTypedefPtrField:    ptr.To(Max0Type(strings.Repeat("x", 1))),
+		Max10ValidatedTypedefField:      Max10Type(strings.Repeat("x", 11)),
+		Max10ValidatedTypedefPtrField:   ptr.To(Max10Type(strings.Repeat("x", 11))),
+	}).OldValue(&Struct{
+		Max0Field:                       strings.Repeat("x", 1),
+		Max0PtrField:                    ptr.To(strings.Repeat("x", 1)),
+		Max10Field:                      strings.Repeat("x", 11),
+		Max10PtrField:                   ptr.To(strings.Repeat("x", 11)),
+		Max0UnvalidatedTypedefField:     UnvalidatedStringType(strings.Repeat("x", 1)),
+		Max0UnvalidatedTypedefPtrField:  ptr.To(UnvalidatedStringType(strings.Repeat("x", 1))),
+		Max10UnvalidatedTypedefField:    UnvalidatedStringType(strings.Repeat("x", 11)),
+		Max10UnvalidatedTypedefPtrField: ptr.To(UnvalidatedStringType(strings.Repeat("x", 11))),
+		Max0ValidatedTypedefField:       Max0Type(strings.Repeat("x", 1)),
+		Max0ValidatedTypedefPtrField:    ptr.To(Max0Type(strings.Repeat("x", 1))),
+		Max10ValidatedTypedefField:      Max10Type(strings.Repeat("x", 11)),
+		Max10ValidatedTypedefPtrField:   ptr.To(Max10Type(strings.Repeat("x", 11))),
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxlength/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxlength/zz_generated.validations.go
new file mode 100644
index 0000000000..4af518a536
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxlength/zz_generated.validations.go
@@ -0,0 +1,373 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package maxlength
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Max0Type validates an instance of Max0Type according
+// to declarative validation rules in the API schema.
+func Validate_Max0Type(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Max0Type) (errs field.ErrorList) {
+
+	if e := validate.MaxLength(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Max10Type validates an instance of Max10Type according
+// to declarative validation rules in the API schema.
+func Validate_Max10Type(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Max10Type) (errs field.ErrorList) {
+
+	if e := validate.MaxLength(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Max0Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxLength(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.Max0Field
+			})
+		errs = append(errs, fn(fldPath.Child("max0Field"), &obj.Max0Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max0PtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxLength(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.Max0PtrField
+			})
+		errs = append(errs, fn(fldPath.Child("max0PtrField"), obj.Max0PtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxLength(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.Max10Field
+			})
+		errs = append(errs, fn(fldPath.Child("max10Field"), &obj.Max10Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10PtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxLength(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.Max10PtrField
+			})
+		errs = append(errs, fn(fldPath.Child("max10PtrField"), obj.Max10PtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max0UnvalidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *UnvalidatedStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxLength(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *UnvalidatedStringType {
+				return &oldObj.Max0UnvalidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("max0UnvalidatedTypedefField"), &obj.Max0UnvalidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max0UnvalidatedTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *UnvalidatedStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxLength(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *UnvalidatedStringType {
+				return oldObj.Max0UnvalidatedTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("max0UnvalidatedTypedefPtrField"), obj.Max0UnvalidatedTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10UnvalidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *UnvalidatedStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxLength(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *UnvalidatedStringType {
+				return &oldObj.Max10UnvalidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("max10UnvalidatedTypedefField"), &obj.Max10UnvalidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10UnvalidatedTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *UnvalidatedStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MaxLength(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *UnvalidatedStringType {
+				return oldObj.Max10UnvalidatedTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("max10UnvalidatedTypedefPtrField"), obj.Max10UnvalidatedTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max0ValidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Max0Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Max0Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Max0Type {
+				return &oldObj.Max0ValidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("max0ValidatedTypedefField"), &obj.Max0ValidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max0ValidatedTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Max0Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Max0Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Max0Type {
+				return oldObj.Max0ValidatedTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("max0ValidatedTypedefPtrField"), obj.Max0ValidatedTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10ValidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Max10Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Max10Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Max10Type {
+				return &oldObj.Max10ValidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("max10ValidatedTypedefField"), &obj.Max10ValidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10ValidatedTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Max10Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Max10Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Max10Type {
+				return oldObj.Max10ValidatedTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("max10ValidatedTypedefPtrField"), obj.Max10ValidatedTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxproperties/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxproperties/doc.go
new file mode 100644
index 0000000000..8009ab4020
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxproperties/doc.go
@@ -0,0 +1,44 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-nolint
+
+// This is a test package.
+package maxproperties
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:maxProperties=0
+	Max0Field map[string]string `json:"max0Field"`
+
+	// +k8s:maxProperties=10
+	Max10Field map[string]string `json:"max10Field"`
+
+	// +k8s:maxProperties=0
+	Max0TypedefKeyField map[StringKey]string `json:"max0TypedefKeyField"`
+
+	// +k8s:maxProperties=10
+	Max10TypedefKeyField map[StringKey]string `json:"max10TypedefKeyField"`
+}
+
+type StringKey string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxproperties/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxproperties/doc_test.go
new file mode 100644
index 0000000000..825cb64e77
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxproperties/doc_test.go
@@ -0,0 +1,97 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package maxproperties
+
+import (
+	"fmt"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max0Field:            generateMapStringStringWithLength(0),
+		Max10Field:           generateMapStringStringWithLength(0),
+		Max0TypedefKeyField:  generateMapStringKeyStringWithLength(0),
+		Max10TypedefKeyField: generateMapStringKeyStringWithLength(0),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max10Field:           generateMapStringStringWithLength(1),
+		Max10TypedefKeyField: generateMapStringKeyStringWithLength(1),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max10Field:           generateMapStringStringWithLength(9),
+		Max10TypedefKeyField: generateMapStringKeyStringWithLength(9),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max10Field:           generateMapStringStringWithLength(10),
+		Max10TypedefKeyField: generateMapStringKeyStringWithLength(10),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Max0Field:            generateMapStringStringWithLength(1),
+		Max10Field:           generateMapStringStringWithLength(11),
+		Max0TypedefKeyField:  generateMapStringKeyStringWithLength(1),
+		Max10TypedefKeyField: generateMapStringKeyStringWithLength(11),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooMany(field.NewPath("max0Field"), 1, 0),
+		field.TooMany(field.NewPath("max10Field"), 11, 10),
+		field.TooMany(field.NewPath("max0TypedefKeyField"), 1, 0),
+		field.TooMany(field.NewPath("max10TypedefKeyField"), 11, 10),
+	})
+
+	// Test validation ratcheting
+	st.Value(&Struct{
+		Max0Field:            generateMapStringStringWithLength(1),
+		Max10Field:           generateMapStringStringWithLength(11),
+		Max0TypedefKeyField:  generateMapStringKeyStringWithLength(1),
+		Max10TypedefKeyField: generateMapStringKeyStringWithLength(11),
+	}).OldValue(&Struct{
+		Max0Field:            generateMapStringStringWithLength(1),
+		Max10Field:           generateMapStringStringWithLength(11),
+		Max0TypedefKeyField:  generateMapStringKeyStringWithLength(1),
+		Max10TypedefKeyField: generateMapStringKeyStringWithLength(11),
+	}).ExpectValid()
+}
+
+func generateMapStringStringWithLength(n int) map[string]string {
+	out := make(map[string]string)
+	for i := range n {
+		str := fmt.Sprintf("%d", i)
+		out[str] = str
+	}
+	return out
+}
+
+func generateMapStringKeyStringWithLength(n int) map[StringKey]string {
+	out := make(map[StringKey]string)
+	for i := range n {
+		str := fmt.Sprintf("%d", i)
+		out[StringKey(str)] = str
+	}
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxproperties/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxproperties/zz_generated.validations.go
new file mode 100644
index 0000000000..9ded68564f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/maxproperties/zz_generated.validations.go
@@ -0,0 +1,184 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package maxproperties
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Max0Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxProperties(ctx, op, fldPath, obj, oldObj, 0).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.Max0Field
+			})
+		errs = append(errs, fn(fldPath.Child("max0Field"), obj.Max0Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxProperties(ctx, op, fldPath, obj, oldObj, 10).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.Max10Field
+			})
+		errs = append(errs, fn(fldPath.Child("max10Field"), obj.Max10Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max0TypedefKeyField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[StringKey]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxProperties(ctx, op, fldPath, obj, oldObj, 0).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[StringKey]string {
+				return oldObj.Max0TypedefKeyField
+			})
+		errs = append(errs, fn(fldPath.Child("max0TypedefKeyField"), obj.Max0TypedefKeyField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Max10TypedefKeyField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[StringKey]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxProperties(ctx, op, fldPath, obj, oldObj, 10).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[StringKey]string {
+				return oldObj.Max10TypedefKeyField
+			})
+		errs = append(errs, fn(fldPath.Child("max10TypedefKeyField"), obj.Max10TypedefKeyField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minimum/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minimum/doc.go
new file mode 100644
index 0000000000..2b18dc7af1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minimum/doc.go
@@ -0,0 +1,124 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package minimum
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type BasicStruct struct {
+	TypeMeta int
+
+	// +k8s:minimum=1
+	IntField int `json:"intField"`
+	// +k8s:minimum=1
+	IntPtrField *int `json:"intPtrField"`
+
+	// "int8" becomes "byte" somewhere in gengo.  We don't need it so just skip it.
+
+	// +k8s:minimum=1
+	Int16Field int16 `json:"int16Field"`
+	// +k8s:minimum=1
+	Int32Field int32 `json:"int32Field"`
+	// +k8s:minimum=1
+	Int64Field int64 `json:"int64Field"`
+
+	// +k8s:minimum=1
+	UintField uint `json:"uintField"`
+	// +k8s:minimum=1
+	UintPtrField *uint `json:"uintPtrField"`
+
+	// +k8s:minimum=1
+	Uint16Field uint16 `json:"uint16Field"`
+	// +k8s:minimum=1
+	Uint32Field uint32 `json:"uint32Field"`
+	// +k8s:minimum=1
+	Uint64Field uint64 `json:"uint64Field"`
+
+	TypedefField    IntType  `json:"typedefField"`
+	TypedefPtrField *IntType `json:"typedefPtrField"`
+}
+
+type OptionalStruct struct {
+	TypeMeta int
+
+	// +k8s:optional
+	// +k8s:minimum=1
+	OptionalIntField int `json:"optionalIntField"`
+
+	// +k8s:optional
+	// +k8s:minimum=1
+	OptionalIntPtrField *int `json:"optionalIntPtrField"`
+
+	// +k8s:optional
+	OptionalTypedefField IntType `json:"optionalTypedefField"`
+
+	// +k8s:optional
+	OptionalTypedefPtrField *IntType `json:"optionalTypedefPtrField"`
+}
+
+type RequiredStruct struct {
+	TypeMeta int
+
+	// +k8s:required
+	// +k8s:minimum=1
+	RequiredIntField int `json:"requiredIntField"`
+
+	// +k8s:required
+	// +k8s:minimum=1
+	RequiredIntPtrField *int `json:"requiredIntPtrField"`
+
+	// +k8s:required
+	RequiredTypedefField IntType `json:"requiredTypedefField"`
+
+	// +k8s:required
+	RequiredTypedefPtrField *IntType `json:"requiredTypedefPtrField"`
+}
+
+type NegativeMinimumStruct struct {
+	TypeMeta int
+
+	// +k8s:minimum=-10
+	NegativeMinimumField int `json:"negativeMinimumField"`
+
+	// +k8s:minimum=-10
+	NegativeMinimumPtrField *int `json:"negativeMinimumPtrField"`
+
+	// +k8s:optional
+	// +k8s:minimum=-10
+	OptionalNegativeMinimumField int `json:"optionalNegativeMinimumField"`
+
+	// +k8s:optional
+	// +k8s:minimum=-10
+	OptionalNegativeMinimumPtrField *int `json:"optionalNegativeMinimumPtrField"`
+
+	// +k8s:required
+	// +k8s:minimum=-10
+	RequiredNegativeMinimumField int `json:"requiredNegativeMinimumField"`
+
+	// +k8s:required
+	// +k8s:minimum=-10
+	RequiredNegativeMinimumPtrField *int `json:"requiredNegativeMinimumPtrField"`
+}
+
+// +k8s:minimum=1
+type IntType int
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minimum/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minimum/doc_test.go
new file mode 100644
index 0000000000..6f6425e4ac
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minimum/doc_test.go
@@ -0,0 +1,340 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package minimum
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestBasicStruct(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Test that zero values are rejected because they are below the minimum of 1.
+	st.Value(&BasicStruct{
+		// all zero values
+		IntPtrField:     ptr.To(0),
+		UintPtrField:    ptr.To(uint(0)),
+		TypedefPtrField: ptr.To(IntType(0)),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("intField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("intPtrField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("int16Field"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("int32Field"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("int64Field"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("uintField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("uintPtrField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("uint16Field"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("uint32Field"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("uint64Field"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("typedefField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("typedefPtrField"), nil, "").WithOrigin("minimum"),
+	})
+
+	// Test validation ratcheting: unchanged invalid data is allowed.
+	st.Value(&BasicStruct{
+		IntPtrField:     ptr.To(0),
+		UintPtrField:    ptr.To(uint(0)),
+		TypedefPtrField: ptr.To(IntType(0)),
+	}).OldValue(&BasicStruct{
+		IntPtrField:     ptr.To(0),
+		UintPtrField:    ptr.To(uint(0)),
+		TypedefPtrField: ptr.To(IntType(0)),
+	}).ExpectValid()
+
+	// Changed invalid data is still rejected.
+	st.Value(&BasicStruct{
+		IntField:        -1,
+		IntPtrField:     ptr.To(-1),
+		Int16Field:      -1,
+		Int32Field:      -1,
+		Int64Field:      -1,
+		TypedefField:    IntType(-1),
+		TypedefPtrField: ptr.To(IntType(-1)),
+	}).OldValue(&BasicStruct{
+		IntField:        0,
+		IntPtrField:     ptr.To(0),
+		Int16Field:      0,
+		Int32Field:      0,
+		Int64Field:      0,
+		TypedefField:    IntType(0),
+		TypedefPtrField: ptr.To(IntType(0)),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("intField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("intPtrField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("int16Field"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("int32Field"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("int64Field"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("typedefField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("typedefPtrField"), nil, "").WithOrigin("minimum"),
+	})
+
+	// Test that values meeting the minimum of 1 are valid.
+	st.Value(&BasicStruct{
+		IntField:        1,
+		IntPtrField:     ptr.To(1),
+		Int16Field:      1,
+		Int32Field:      1,
+		Int64Field:      1,
+		UintField:       1,
+		Uint16Field:     1,
+		Uint32Field:     1,
+		Uint64Field:     1,
+		UintPtrField:    ptr.To(uint(1)),
+		TypedefField:    IntType(1),
+		TypedefPtrField: ptr.To(IntType(1)),
+	}).ExpectValid()
+}
+
+func TestOptionalStruct(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Test that explicitly provided zero values for optional pointers are still validated against minimum.
+	st.Value(&OptionalStruct{
+		// zero values
+		OptionalIntPtrField:     ptr.To(0),
+		OptionalTypedefPtrField: ptr.To(IntType(0)),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("optionalIntPtrField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("optionalTypedefPtrField"), nil, "").WithOrigin("minimum"),
+	})
+
+	// Test that omitting an optional pointer field (nil) short-circuits minimum validation.
+	st.Value(&OptionalStruct{
+		// OptionalIntField is zero and OptionalIntPtrField is nil, so optional
+		// short-circuits before minimum runs.
+	}).ExpectValid()
+
+	// Test validation ratcheting: unchanged invalid data is allowed.
+	st.Value(&OptionalStruct{
+		OptionalIntField:        -1,
+		OptionalIntPtrField:     ptr.To(-1),
+		OptionalTypedefField:    IntType(-1),
+		OptionalTypedefPtrField: ptr.To(IntType(-1)),
+	}).OldValue(&OptionalStruct{
+		OptionalIntField:        -1,
+		OptionalIntPtrField:     ptr.To(-1),
+		OptionalTypedefField:    IntType(-1),
+		OptionalTypedefPtrField: ptr.To(IntType(-1)),
+	}).ExpectValid()
+
+	// Changed invalid data is still rejected.
+	st.Value(&OptionalStruct{
+		OptionalIntField:        -2,
+		OptionalIntPtrField:     ptr.To(-2),
+		OptionalTypedefField:    IntType(-2),
+		OptionalTypedefPtrField: ptr.To(IntType(-2)),
+	}).OldValue(&OptionalStruct{
+		OptionalIntField:        -1,
+		OptionalIntPtrField:     ptr.To(-1),
+		OptionalTypedefField:    IntType(-1),
+		OptionalTypedefPtrField: ptr.To(IntType(-1)),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("optionalIntField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("optionalIntPtrField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("optionalTypedefField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("optionalTypedefPtrField"), nil, "").WithOrigin("minimum"),
+	})
+
+	// Test that values meeting the minimum of 1 are valid.
+	st.Value(&OptionalStruct{
+		OptionalIntField:        1,
+		OptionalIntPtrField:     ptr.To(1),
+		OptionalTypedefField:    IntType(1),
+		OptionalTypedefPtrField: ptr.To(IntType(1)),
+	}).ExpectValid()
+
+	// Test that invalid values below the minimum are rejected.
+	st.Value(&OptionalStruct{
+		OptionalIntField:        -1,
+		OptionalIntPtrField:     ptr.To(-1),
+		OptionalTypedefField:    IntType(-1),
+		OptionalTypedefPtrField: ptr.To(IntType(-1)),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("optionalIntField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("optionalIntPtrField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("optionalTypedefField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("optionalTypedefPtrField"), nil, "").WithOrigin("minimum"),
+	})
+}
+
+func TestRequiredStruct(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Test that explicitly provided zero values for pointers are validated against minimum,
+	// while zero values for non-pointers trigger required validation.
+	st.Value(&RequiredStruct{
+		// zero values
+		RequiredIntField:        0,
+		RequiredIntPtrField:     ptr.To(0),
+		RequiredTypedefField:    IntType(0),
+		RequiredTypedefPtrField: ptr.To(IntType(0)),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Required(field.NewPath("requiredIntField"), ""),
+		field.Invalid(field.NewPath("requiredIntPtrField"), nil, "").WithOrigin("minimum"),
+		field.Required(field.NewPath("requiredTypedefField"), ""),
+		field.Invalid(field.NewPath("requiredTypedefPtrField"), nil, "").WithOrigin("minimum"),
+	})
+
+	// Test that omitted required pointer fields (nil) emit field.Required and short-circuit minimum validation.
+	st.Value(&RequiredStruct{
+		// RequiredIntField is zero and RequiredIntPtrField is nil.
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Required(field.NewPath("requiredIntField"), ""),
+		field.Required(field.NewPath("requiredIntPtrField"), ""),
+		field.Required(field.NewPath("requiredTypedefField"), ""),
+		field.Required(field.NewPath("requiredTypedefPtrField"), ""),
+	})
+
+	// Test validation ratcheting: unchanged invalid data is allowed.
+	st.Value(&RequiredStruct{
+		RequiredIntField:        0,
+		RequiredIntPtrField:     ptr.To(0),
+		RequiredTypedefField:    IntType(0),
+		RequiredTypedefPtrField: ptr.To(IntType(0)),
+	}).OldValue(&RequiredStruct{
+		RequiredIntField:        0,
+		RequiredIntPtrField:     ptr.To(0),
+		RequiredTypedefField:    IntType(0),
+		RequiredTypedefPtrField: ptr.To(IntType(0)),
+	}).ExpectValid()
+
+	// Changed invalid data is still rejected.
+	st.Value(&RequiredStruct{
+		RequiredIntField:        -1,
+		RequiredIntPtrField:     ptr.To(-1),
+		RequiredTypedefField:    IntType(-1),
+		RequiredTypedefPtrField: ptr.To(IntType(-1)),
+	}).OldValue(&RequiredStruct{
+		RequiredIntField:        0,
+		RequiredIntPtrField:     ptr.To(0),
+		RequiredTypedefField:    IntType(0),
+		RequiredTypedefPtrField: ptr.To(IntType(0)),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("requiredIntField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("requiredIntPtrField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("requiredTypedefField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("requiredTypedefPtrField"), nil, "").WithOrigin("minimum"),
+	})
+
+	// Test that values meeting the minimum of 1 are valid.
+	st.Value(&RequiredStruct{
+		RequiredIntField:        1,
+		RequiredIntPtrField:     ptr.To(1),
+		RequiredTypedefField:    IntType(1),
+		RequiredTypedefPtrField: ptr.To(IntType(1)),
+	}).ExpectValid()
+
+	// Test that invalid values below the minimum are rejected.
+	st.Value(&RequiredStruct{
+		RequiredIntField:        -1,
+		RequiredIntPtrField:     ptr.To(-1),
+		RequiredTypedefField:    IntType(-1),
+		RequiredTypedefPtrField: ptr.To(IntType(-1)),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("requiredIntField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("requiredIntPtrField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("requiredTypedefField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("requiredTypedefPtrField"), nil, "").WithOrigin("minimum"),
+	})
+}
+
+func TestNegativeMinimumStruct(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Test that zero values for required pointers are validated against the negative minimum,
+	// while zero values for non-pointers trigger required validation.
+	st.Value(&NegativeMinimumStruct{
+		// zero values (valid for -10)
+		NegativeMinimumPtrField:         ptr.To(0),
+		OptionalNegativeMinimumPtrField: ptr.To(0),
+		RequiredNegativeMinimumField:    0,
+		RequiredNegativeMinimumPtrField: ptr.To(0),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Required(field.NewPath("requiredNegativeMinimumField"), ""),
+	})
+
+	// Test that valid values at the negative minimum boundary (-10) are accepted.
+	st.Value(&NegativeMinimumStruct{
+		NegativeMinimumField:            -10,
+		NegativeMinimumPtrField:         ptr.To(-10),
+		OptionalNegativeMinimumField:    -10,
+		OptionalNegativeMinimumPtrField: ptr.To(-10),
+		RequiredNegativeMinimumField:    -10,
+		RequiredNegativeMinimumPtrField: ptr.To(-10),
+	}).ExpectValid()
+
+	// Test validation ratcheting: unchanged invalid data is allowed.
+	st.Value(&NegativeMinimumStruct{
+		NegativeMinimumField:            -11,
+		NegativeMinimumPtrField:         ptr.To(-11),
+		OptionalNegativeMinimumField:    -11,
+		OptionalNegativeMinimumPtrField: ptr.To(-11),
+		RequiredNegativeMinimumField:    -11,
+		RequiredNegativeMinimumPtrField: ptr.To(-11),
+	}).OldValue(&NegativeMinimumStruct{
+		NegativeMinimumField:            -11,
+		NegativeMinimumPtrField:         ptr.To(-11),
+		OptionalNegativeMinimumField:    -11,
+		OptionalNegativeMinimumPtrField: ptr.To(-11),
+		RequiredNegativeMinimumField:    -11,
+		RequiredNegativeMinimumPtrField: ptr.To(-11),
+	}).ExpectValid()
+
+	// Changed invalid data is still rejected.
+	st.Value(&NegativeMinimumStruct{
+		NegativeMinimumField:            -12,
+		NegativeMinimumPtrField:         ptr.To(-12),
+		OptionalNegativeMinimumField:    -12,
+		OptionalNegativeMinimumPtrField: ptr.To(-12),
+		RequiredNegativeMinimumField:    -12,
+		RequiredNegativeMinimumPtrField: ptr.To(-12),
+	}).OldValue(&NegativeMinimumStruct{
+		NegativeMinimumField:            -11,
+		NegativeMinimumPtrField:         ptr.To(-11),
+		OptionalNegativeMinimumField:    -11,
+		OptionalNegativeMinimumPtrField: ptr.To(-11),
+		RequiredNegativeMinimumField:    -11,
+		RequiredNegativeMinimumPtrField: ptr.To(-11),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("negativeMinimumField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("negativeMinimumPtrField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("optionalNegativeMinimumField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("optionalNegativeMinimumPtrField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("requiredNegativeMinimumField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("requiredNegativeMinimumPtrField"), nil, "").WithOrigin("minimum"),
+	})
+
+	// Test that invalid values below the negative minimum (-10) are rejected.
+	st.Value(&NegativeMinimumStruct{
+		NegativeMinimumField:            -11,
+		NegativeMinimumPtrField:         ptr.To(-11),
+		OptionalNegativeMinimumField:    -11,
+		OptionalNegativeMinimumPtrField: ptr.To(-11),
+		RequiredNegativeMinimumField:    -11,
+		RequiredNegativeMinimumPtrField: ptr.To(-11),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("negativeMinimumField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("negativeMinimumPtrField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("optionalNegativeMinimumField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("optionalNegativeMinimumPtrField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("requiredNegativeMinimumField"), nil, "").WithOrigin("minimum"),
+		field.Invalid(field.NewPath("requiredNegativeMinimumPtrField"), nil, "").WithOrigin("minimum"),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minimum/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minimum/zz_generated.validations.go
new file mode 100644
index 0000000000..22218842f3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minimum/zz_generated.validations.go
@@ -0,0 +1,864 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package minimum
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type BasicStruct
+	scheme.AddValidationFunc(
+		(*BasicStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_BasicStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*BasicStruct),
+					safe.Cast[*BasicStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type NegativeMinimumStruct
+	scheme.AddValidationFunc(
+		(*NegativeMinimumStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_NegativeMinimumStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*NegativeMinimumStruct),
+					safe.Cast[*NegativeMinimumStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type OptionalStruct
+	scheme.AddValidationFunc(
+		(*OptionalStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_OptionalStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*OptionalStruct),
+					safe.Cast[*OptionalStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type RequiredStruct
+	scheme.AddValidationFunc(
+		(*RequiredStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_RequiredStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*RequiredStruct),
+					safe.Cast[*RequiredStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_BasicStruct validates an instance of BasicStruct according
+// to declarative validation rules in the API schema.
+func Validate_BasicStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *BasicStruct) (errs field.ErrorList) {
+
+	// field BasicStruct.TypeMeta has no validation
+
+	{ // field BasicStruct.IntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *BasicStruct) *int {
+				return &oldObj.IntField
+			})
+		errs = append(errs, fn(fldPath.Child("intField"), &obj.IntField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field BasicStruct.IntPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *BasicStruct) *int {
+				return oldObj.IntPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("intPtrField"), obj.IntPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field BasicStruct.Int16Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int16,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *BasicStruct) *int16 {
+				return &oldObj.Int16Field
+			})
+		errs = append(errs, fn(fldPath.Child("int16Field"), &obj.Int16Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field BasicStruct.Int32Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int32,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *BasicStruct) *int32 {
+				return &oldObj.Int32Field
+			})
+		errs = append(errs, fn(fldPath.Child("int32Field"), &obj.Int32Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field BasicStruct.Int64Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *BasicStruct) *int64 {
+				return &oldObj.Int64Field
+			})
+		errs = append(errs, fn(fldPath.Child("int64Field"), &obj.Int64Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field BasicStruct.UintField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *uint,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *BasicStruct) *uint {
+				return &oldObj.UintField
+			})
+		errs = append(errs, fn(fldPath.Child("uintField"), &obj.UintField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field BasicStruct.UintPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *uint,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *BasicStruct) *uint {
+				return oldObj.UintPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("uintPtrField"), obj.UintPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field BasicStruct.Uint16Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *uint16,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *BasicStruct) *uint16 {
+				return &oldObj.Uint16Field
+			})
+		errs = append(errs, fn(fldPath.Child("uint16Field"), &obj.Uint16Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field BasicStruct.Uint32Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *uint32,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *BasicStruct) *uint32 {
+				return &oldObj.Uint32Field
+			})
+		errs = append(errs, fn(fldPath.Child("uint32Field"), &obj.Uint32Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field BasicStruct.Uint64Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *uint64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *BasicStruct) *uint64 {
+				return &oldObj.Uint64Field
+			})
+		errs = append(errs, fn(fldPath.Child("uint64Field"), &obj.Uint64Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field BasicStruct.TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_IntType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *BasicStruct) *IntType {
+				return &oldObj.TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("typedefField"), &obj.TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field BasicStruct.TypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_IntType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *BasicStruct) *IntType {
+				return oldObj.TypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("typedefPtrField"), obj.TypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_IntType validates an instance of IntType according
+// to declarative validation rules in the API schema.
+func Validate_IntType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *IntType) (errs field.ErrorList) {
+
+	if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_NegativeMinimumStruct validates an instance of NegativeMinimumStruct according
+// to declarative validation rules in the API schema.
+func Validate_NegativeMinimumStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *NegativeMinimumStruct) (errs field.ErrorList) {
+
+	// field NegativeMinimumStruct.TypeMeta has no validation
+
+	{ // field NegativeMinimumStruct.NegativeMinimumField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, -10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NegativeMinimumStruct) *int {
+				return &oldObj.NegativeMinimumField
+			})
+		errs = append(errs, fn(fldPath.Child("negativeMinimumField"), &obj.NegativeMinimumField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field NegativeMinimumStruct.NegativeMinimumPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, -10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NegativeMinimumStruct) *int {
+				return oldObj.NegativeMinimumPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("negativeMinimumPtrField"), obj.NegativeMinimumPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field NegativeMinimumStruct.OptionalNegativeMinimumField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, -10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NegativeMinimumStruct) *int {
+				return &oldObj.OptionalNegativeMinimumField
+			})
+		errs = append(errs, fn(fldPath.Child("optionalNegativeMinimumField"), &obj.OptionalNegativeMinimumField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field NegativeMinimumStruct.OptionalNegativeMinimumPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, -10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NegativeMinimumStruct) *int {
+				return oldObj.OptionalNegativeMinimumPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("optionalNegativeMinimumPtrField"), obj.OptionalNegativeMinimumPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field NegativeMinimumStruct.RequiredNegativeMinimumField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, -10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NegativeMinimumStruct) *int {
+				return &oldObj.RequiredNegativeMinimumField
+			})
+		errs = append(errs, fn(fldPath.Child("requiredNegativeMinimumField"), &obj.RequiredNegativeMinimumField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field NegativeMinimumStruct.RequiredNegativeMinimumPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, -10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NegativeMinimumStruct) *int {
+				return oldObj.RequiredNegativeMinimumPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("requiredNegativeMinimumPtrField"), obj.RequiredNegativeMinimumPtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_OptionalStruct validates an instance of OptionalStruct according
+// to declarative validation rules in the API schema.
+func Validate_OptionalStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OptionalStruct) (errs field.ErrorList) {
+
+	// field OptionalStruct.TypeMeta has no validation
+
+	{ // field OptionalStruct.OptionalIntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *OptionalStruct) *int {
+				return &oldObj.OptionalIntField
+			})
+		errs = append(errs, fn(fldPath.Child("optionalIntField"), &obj.OptionalIntField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field OptionalStruct.OptionalIntPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *OptionalStruct) *int {
+				return oldObj.OptionalIntPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("optionalIntPtrField"), obj.OptionalIntPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field OptionalStruct.OptionalTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_IntType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *OptionalStruct) *IntType {
+				return &oldObj.OptionalTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("optionalTypedefField"), &obj.OptionalTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field OptionalStruct.OptionalTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_IntType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *OptionalStruct) *IntType {
+				return oldObj.OptionalTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("optionalTypedefPtrField"), obj.OptionalTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_RequiredStruct validates an instance of RequiredStruct according
+// to declarative validation rules in the API schema.
+func Validate_RequiredStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *RequiredStruct) (errs field.ErrorList) {
+
+	// field RequiredStruct.TypeMeta has no validation
+
+	{ // field RequiredStruct.RequiredIntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *RequiredStruct) *int {
+				return &oldObj.RequiredIntField
+			})
+		errs = append(errs, fn(fldPath.Child("requiredIntField"), &obj.RequiredIntField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field RequiredStruct.RequiredIntPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *RequiredStruct) *int {
+				return oldObj.RequiredIntPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("requiredIntPtrField"), obj.RequiredIntPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field RequiredStruct.RequiredTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_IntType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *RequiredStruct) *IntType {
+				return &oldObj.RequiredTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("requiredTypedefField"), &obj.RequiredTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field RequiredStruct.RequiredTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_IntType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *RequiredStruct) *IntType {
+				return oldObj.RequiredTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("requiredTypedefPtrField"), obj.RequiredTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_primitive/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_primitive/doc.go
new file mode 100644
index 0000000000..a59a296bf6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_primitive/doc.go
@@ -0,0 +1,44 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package sliceofprimitive
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:minItems=0
+	Min0Field []int `json:"min0Field"`
+
+	// +k8s:minItems=10
+	Min10Field []int `json:"min10Field"`
+
+	// +k8s:minItems=0
+	Min0TypedefField []IntType `json:"min0TypedefField"`
+
+	// +k8s:minItems=10
+	Min10TypedefField []IntType `json:"min10TypedefField"`
+}
+
+type IntType int
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_primitive/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_primitive/doc_test.go
new file mode 100644
index 0000000000..12b092016d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_primitive/doc_test.go
@@ -0,0 +1,87 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sliceofprimitive
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 0, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 0, 10),
+	})
+
+	st.Value(&Struct{
+		Min0Field:         make([]int, 0),
+		Min10Field:        make([]int, 0),
+		Min0TypedefField:  make([]IntType, 0),
+		Min10TypedefField: make([]IntType, 0),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 0, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 0, 10),
+	})
+
+	st.Value(&Struct{
+		Min10Field:        make([]int, 1),
+		Min10TypedefField: make([]IntType, 1),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 1, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 1, 10),
+	})
+
+	st.Value(&Struct{
+		Min10Field:        make([]int, 9),
+		Min10TypedefField: make([]IntType, 9),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 9, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 9, 10),
+	})
+
+	st.Value(&Struct{
+		Min10Field:        make([]int, 10),
+		Min10TypedefField: make([]IntType, 10),
+	}).ExpectValid()
+
+	testVal := &Struct{
+		Min0Field:         make([]int, 1),
+		Min10Field:        make([]int, 11),
+		Min0TypedefField:  make([]IntType, 1),
+		Min10TypedefField: make([]IntType, 11),
+	}
+	st.Value(testVal).ExpectValid()
+
+	// Test validation ratcheting
+	st.Value(&Struct{
+		Min0Field:         make([]int, 1),
+		Min10Field:        make([]int, 1),
+		Min0TypedefField:  make([]IntType, 1),
+		Min10TypedefField: make([]IntType, 1),
+	}).OldValue(&Struct{
+		Min0Field:         make([]int, 1),
+		Min10Field:        make([]int, 1),
+		Min0TypedefField:  make([]IntType, 1),
+		Min10TypedefField: make([]IntType, 1),
+	}).ExpectValid()
+
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_primitive/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_primitive/zz_generated.validations.go
new file mode 100644
index 0000000000..936c8efef3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_primitive/zz_generated.validations.go
@@ -0,0 +1,164 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package sliceofprimitive
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Min0Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MinItems(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []int {
+				return oldObj.Min0Field
+			})
+		errs = append(errs, fn(fldPath.Child("min0Field"), obj.Min0Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min10Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MinItems(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []int {
+				return oldObj.Min10Field
+			})
+		errs = append(errs, fn(fldPath.Child("min10Field"), obj.Min10Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min0TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MinItems(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []IntType {
+				return oldObj.Min0TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("min0TypedefField"), obj.Min0TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min10TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MinItems(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []IntType {
+				return oldObj.Min10TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("min10TypedefField"), obj.Min10TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_struct/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_struct/doc.go
new file mode 100644
index 0000000000..d2c18683f7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_struct/doc.go
@@ -0,0 +1,46 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package sliceofstruct
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:minItems=0
+	Min0Field []OtherStruct `json:"min0Field"`
+
+	// +k8s:minItems=10
+	Min10Field []OtherStruct `json:"min10Field"`
+
+	// +k8s:minItems=0
+	Min0TypedefField []OtherTypedefStruct `json:"min0TypedefField"`
+
+	// +k8s:minItems=10
+	Min10TypedefField []OtherTypedefStruct `json:"min10TypedefField"`
+}
+
+type OtherStruct struct{}
+
+type OtherTypedefStruct OtherStruct
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_struct/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_struct/doc_test.go
new file mode 100644
index 0000000000..110b293761
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_struct/doc_test.go
@@ -0,0 +1,87 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sliceofstruct
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 0, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 0, 10),
+	})
+
+	st.Value(&Struct{
+		Min0Field:         make([]OtherStruct, 0),
+		Min10Field:        make([]OtherStruct, 0),
+		Min0TypedefField:  make([]OtherTypedefStruct, 0),
+		Min10TypedefField: make([]OtherTypedefStruct, 0),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 0, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 0, 10),
+	})
+
+	st.Value(&Struct{
+		Min10Field:        make([]OtherStruct, 1),
+		Min10TypedefField: make([]OtherTypedefStruct, 1),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 1, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 1, 10),
+	})
+
+	st.Value(&Struct{
+		Min10Field:        make([]OtherStruct, 9),
+		Min10TypedefField: make([]OtherTypedefStruct, 9),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 9, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 9, 10),
+	})
+
+	st.Value(&Struct{
+		Min10Field:        make([]OtherStruct, 10),
+		Min10TypedefField: make([]OtherTypedefStruct, 10),
+	}).ExpectValid()
+
+	testVal := &Struct{
+		Min0Field:         make([]OtherStruct, 1),
+		Min10Field:        make([]OtherStruct, 11),
+		Min0TypedefField:  make([]OtherTypedefStruct, 1),
+		Min10TypedefField: make([]OtherTypedefStruct, 11),
+	}
+	st.Value(testVal).ExpectValid()
+
+	// Test validation ratcheting
+	st.Value(&Struct{
+		Min0Field:         make([]OtherStruct, 1),
+		Min10Field:        make([]OtherStruct, 1),
+		Min0TypedefField:  make([]OtherTypedefStruct, 1),
+		Min10TypedefField: make([]OtherTypedefStruct, 1),
+	}).OldValue(&Struct{
+		Min0Field:         make([]OtherStruct, 1),
+		Min10Field:        make([]OtherStruct, 1),
+		Min0TypedefField:  make([]OtherTypedefStruct, 1),
+		Min10TypedefField: make([]OtherTypedefStruct, 1),
+	}).ExpectValid()
+
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_struct/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_struct/zz_generated.validations.go
new file mode 100644
index 0000000000..0e7aae045a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/slice_of_struct/zz_generated.validations.go
@@ -0,0 +1,164 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package sliceofstruct
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Min0Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MinItems(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherStruct {
+				return oldObj.Min0Field
+			})
+		errs = append(errs, fn(fldPath.Child("min0Field"), obj.Min0Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min10Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MinItems(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherStruct {
+				return oldObj.Min10Field
+			})
+		errs = append(errs, fn(fldPath.Child("min10Field"), obj.Min10Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min0TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherTypedefStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MinItems(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherTypedefStruct {
+				return oldObj.Min0TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("min0TypedefField"), obj.Min0TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min10TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherTypedefStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MinItems(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherTypedefStruct {
+				return oldObj.Min10TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("min10TypedefField"), obj.Min10TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/typedef_to_slice/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/typedef_to_slice/doc.go
new file mode 100644
index 0000000000..1c73fa6e91
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/typedef_to_slice/doc.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package typedeftoslice
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Note: no validation here
+type UnvalidatedType []int
+
+// +k8s:minItems=0
+type Min0Type []int
+
+// +k8s:minItems=10
+type Min10Type []int
+
+// Note: no validation here
+type UnvalidatedPtrType []*int
+
+type SliceType []int
+
+// +k8s:minItems=0
+type Min0TypedefType SliceType
+
+// +k8s:minItems=10
+type Min10TypedefType SliceType
+
+type Struct struct {
+	TypeMeta int
+
+	UnvalidatedField UnvalidatedType `json:"unvalidatedField"`
+
+	Min0Field Min0Type `json:"min0Field"`
+
+	Min10Field Min10Type `json:"min10Field"`
+
+	Min0TypedefField Min0TypedefType `json:"min0TypedefField"`
+
+	Min10TypedefField Min10TypedefType `json:"min10TypedefField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/typedef_to_slice/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/typedef_to_slice/doc_test.go
new file mode 100644
index 0000000000..e82ebcb7e3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/typedef_to_slice/doc_test.go
@@ -0,0 +1,87 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package typedeftoslice
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 0, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 0, 10),
+	})
+
+	st.Value(&Struct{
+		Min0Field:         make(Min0Type, 0),
+		Min10Field:        make(Min10Type, 0),
+		Min0TypedefField:  make(Min0TypedefType, 0),
+		Min10TypedefField: make(Min10TypedefType, 0),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 0, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 0, 10),
+	})
+
+	st.Value(&Struct{
+		Min10Field:        make(Min10Type, 1),
+		Min10TypedefField: make(Min10TypedefType, 1),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 1, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 1, 10),
+	})
+
+	st.Value(&Struct{
+		Min10Field:        make(Min10Type, 9),
+		Min10TypedefField: make(Min10TypedefType, 9),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 9, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 9, 10),
+	})
+
+	st.Value(&Struct{
+		Min10Field:        make(Min10Type, 10),
+		Min10TypedefField: make(Min10TypedefType, 10),
+	}).ExpectValid()
+
+	testVal := &Struct{
+		Min0Field:         make(Min0Type, 1),
+		Min10Field:        make(Min10Type, 11),
+		Min0TypedefField:  make(Min0TypedefType, 1),
+		Min10TypedefField: make(Min10TypedefType, 11),
+	}
+	st.Value(testVal).ExpectValid()
+
+	// Test validation ratcheting
+	st.Value(&Struct{
+		Min0Field:         make(Min0Type, 1),
+		Min10Field:        make(Min10Type, 1),
+		Min0TypedefField:  make(Min0TypedefType, 1),
+		Min10TypedefField: make(Min10TypedefType, 1),
+	}).OldValue(&Struct{
+		Min0Field:         make(Min0Type, 1),
+		Min10Field:        make(Min10Type, 1),
+		Min0TypedefField:  make(Min0TypedefType, 1),
+		Min10TypedefField: make(Min10TypedefType, 1),
+	}).ExpectValid()
+
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/typedef_to_slice/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/typedef_to_slice/zz_generated.validations.go
new file mode 100644
index 0000000000..cb10223c31
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minitems/typedef_to_slice/zz_generated.validations.go
@@ -0,0 +1,209 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package typedeftoslice
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Min0Type validates an instance of Min0Type according
+// to declarative validation rules in the API schema.
+func Validate_Min0Type(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj Min0Type) (errs field.ErrorList) {
+
+	if e := validate.MinItems(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Min0TypedefType validates an instance of Min0TypedefType according
+// to declarative validation rules in the API schema.
+func Validate_Min0TypedefType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj Min0TypedefType) (errs field.ErrorList) {
+
+	if e := validate.MinItems(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Min10Type validates an instance of Min10Type according
+// to declarative validation rules in the API schema.
+func Validate_Min10Type(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj Min10Type) (errs field.ErrorList) {
+
+	if e := validate.MinItems(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Min10TypedefType validates an instance of Min10TypedefType according
+// to declarative validation rules in the API schema.
+func Validate_Min10TypedefType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj Min10TypedefType) (errs field.ErrorList) {
+
+	if e := validate.MinItems(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+	// field Struct.UnvalidatedField has no validation
+
+	{ // field Struct.Min0Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj Min0Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Min0Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) Min0Type {
+				return oldObj.Min0Field
+			})
+		errs = append(errs, fn(fldPath.Child("min0Field"), obj.Min0Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min10Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj Min10Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Min10Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) Min10Type {
+				return oldObj.Min10Field
+			})
+		errs = append(errs, fn(fldPath.Child("min10Field"), obj.Min10Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min0TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj Min0TypedefType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Min0TypedefType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) Min0TypedefType {
+				return oldObj.Min0TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("min0TypedefField"), obj.Min0TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min10TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj Min10TypedefType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Min10TypedefType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) Min10TypedefType {
+				return oldObj.Min10TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("min10TypedefField"), obj.Min10TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minlength/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minlength/doc.go
new file mode 100644
index 0000000000..ec68de8ec0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minlength/doc.go
@@ -0,0 +1,105 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+package minlength
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:alpha=+k8s:minLength=0
+	// +k8s:optional
+	Min0PtrField *string `json:"min0PtrField"`
+
+	// +k8s:alpha=+k8s:minLength=2
+	// +k8s:optional
+	Min2Field string `json:"min2Field"`
+
+	// +k8s:alpha=+k8s:minLength=2
+	// +k8s:optional
+	Min2PtrField *string `json:"min2PtrField"`
+
+	// +k8s:alpha=+k8s:minLength=10
+	// +k8s:optional
+	Min10Field string `json:"min10Field"`
+
+	// +k8s:alpha=+k8s:minLength=10
+	// +k8s:optional
+	Min10PtrField *string `json:"min10PtrField"`
+
+	// +k8s:alpha=+k8s:minLength=2
+	// +k8s:optional
+	Min2UnvalidatedTypedefField UnvalidatedStringType `json:"min2UnvalidatedTypedefField"`
+
+	// +k8s:alpha=+k8s:minLength=2
+	// +k8s:optional
+	Min2UnvalidatedTypedefPtrField *UnvalidatedStringType `json:"min2UnvalidatedTypedefPtrField"`
+
+	// +k8s:alpha=+k8s:minLength=10
+	// +k8s:optional
+	Min10UnvalidatedTypedefField UnvalidatedStringType `json:"min10UnvalidatedTypedefField"`
+
+	// +k8s:alpha=+k8s:minLength=10
+	// +k8s:optional
+	Min10UnvalidatedTypedefPtrField *UnvalidatedStringType `json:"min10UnvalidatedTypedefPtrField"`
+
+	// Note: no minlength validation here
+	// +k8s:optional
+	Min2ValidatedTypedefField Min2Type `json:"min2ValidatedTypedefField"`
+
+	// Note: no minlength validation here
+	// +k8s:optional
+	Min2ValidatedTypedefPtrField *Min2Type `json:"min2ValidatedTypedefPtrField"`
+
+	// Note: no minlength validation here
+	// +k8s:optional
+	Min10ValidatedTypedefField Min10Type `json:"min10ValidatedTypedefField"`
+
+	// Note: no minlength validation here
+	// +k8s:optional
+	Min10ValidatedTypedefPtrField *Min10Type `json:"min10ValidatedTypedefPtrField"`
+
+	// +k8s:alpha=+k8s:minLength=2
+	// +k8s:optional
+	Min2UnvalidatedStringAliasField UnvalidatedStringAlias `json:"min2UnvalidatedStringAliasField"`
+
+	// +k8s:alpha=+k8s:minLength=2
+	// +k8s:optional
+	Min2UnvalidatedStringAliasPtrField *UnvalidatedStringAlias `json:"min2UnvalidatedStringAliasPtrField"`
+}
+
+// Note: no validation here
+type UnvalidatedStringType string
+
+// Note: no validation here
+type UnvalidatedStringAlias = string
+
+// Tests that min length markers on typedefs
+// appropriately propagate to fields that use this type
+// +k8s:alpha=+k8s:minLength=2
+type Min2Type string
+
+// Tests that min length markers on typedefs
+// appropriately propagate to fields that use this type
+// +k8s:alpha=+k8s:minLength=10
+type Min10Type string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minlength/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minlength/doc_test.go
new file mode 100644
index 0000000000..408a47cc63
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minlength/doc_test.go
@@ -0,0 +1,160 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package minlength
+
+import (
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		Min2Field:                          strings.Repeat("x", 1),
+		Min2PtrField:                       ptr.To(strings.Repeat("x", 1)),
+		Min2UnvalidatedTypedefField:        UnvalidatedStringType(strings.Repeat("x", 1)),
+		Min2UnvalidatedTypedefPtrField:     ptr.To(UnvalidatedStringType(strings.Repeat("x", 1))),
+		Min2ValidatedTypedefField:          Min2Type(strings.Repeat("x", 1)),
+		Min2ValidatedTypedefPtrField:       ptr.To(Min2Type(strings.Repeat("x", 1))),
+		Min10Field:                         strings.Repeat("x", 1),
+		Min10PtrField:                      ptr.To(strings.Repeat("x", 1)),
+		Min10UnvalidatedTypedefField:       UnvalidatedStringType(strings.Repeat("x", 1)),
+		Min10UnvalidatedTypedefPtrField:    ptr.To(UnvalidatedStringType(strings.Repeat("x", 1))),
+		Min10ValidatedTypedefField:         Min10Type(strings.Repeat("x", 1)),
+		Min10ValidatedTypedefPtrField:      ptr.To(Min10Type(strings.Repeat("x", 1))),
+		Min2UnvalidatedStringAliasField:    strings.Repeat("x", 1),
+		Min2UnvalidatedStringAliasPtrField: ptr.To(strings.Repeat("x", 1)),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooShort(field.NewPath("min10Field"), "", 10),
+		field.TooShort(field.NewPath("min10PtrField"), "", 10),
+		field.TooShort(field.NewPath("min10UnvalidatedTypedefField"), "", 10),
+		field.TooShort(field.NewPath("min10UnvalidatedTypedefPtrField"), "", 10),
+		field.TooShort(field.NewPath("min10ValidatedTypedefField"), "", 10),
+		field.TooShort(field.NewPath("min10ValidatedTypedefPtrField"), "", 10),
+		field.TooShort(field.NewPath("min2Field"), "x", 2),
+		field.TooShort(field.NewPath("min2PtrField"), "x", 2),
+		field.TooShort(field.NewPath("min2UnvalidatedTypedefField"), "x", 2),
+		field.TooShort(field.NewPath("min2UnvalidatedTypedefPtrField"), "x", 2),
+		field.TooShort(field.NewPath("min2ValidatedTypedefField"), "x", 2),
+		field.TooShort(field.NewPath("min2ValidatedTypedefPtrField"), "x", 2),
+		field.TooShort(field.NewPath("min2UnvalidatedStringAliasField"), "x", 2),
+		field.TooShort(field.NewPath("min2UnvalidatedStringAliasPtrField"), "x", 2),
+	})
+
+	st.Value(&Struct{
+		Min2Field:                          strings.Repeat("x", 1),
+		Min2PtrField:                       ptr.To(strings.Repeat("x", 1)),
+		Min2UnvalidatedTypedefField:        UnvalidatedStringType(strings.Repeat("x", 1)),
+		Min2UnvalidatedTypedefPtrField:     ptr.To(UnvalidatedStringType(strings.Repeat("x", 1))),
+		Min2ValidatedTypedefField:          Min2Type(strings.Repeat("x", 1)),
+		Min2ValidatedTypedefPtrField:       ptr.To(Min2Type(strings.Repeat("x", 1))),
+		Min10Field:                         strings.Repeat("x", 9),
+		Min10PtrField:                      ptr.To(strings.Repeat("x", 9)),
+		Min10UnvalidatedTypedefField:       UnvalidatedStringType(strings.Repeat("x", 9)),
+		Min10UnvalidatedTypedefPtrField:    ptr.To(UnvalidatedStringType(strings.Repeat("x", 9))),
+		Min10ValidatedTypedefField:         Min10Type(strings.Repeat("x", 9)),
+		Min10ValidatedTypedefPtrField:      ptr.To(Min10Type(strings.Repeat("x", 9))),
+		Min2UnvalidatedStringAliasField:    strings.Repeat("x", 1),
+		Min2UnvalidatedStringAliasPtrField: ptr.To(strings.Repeat("x", 1)),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooShort(field.NewPath("min10Field"), "", 10),
+		field.TooShort(field.NewPath("min10PtrField"), "", 10),
+		field.TooShort(field.NewPath("min10UnvalidatedTypedefField"), "", 10),
+		field.TooShort(field.NewPath("min10UnvalidatedTypedefPtrField"), "", 10),
+		field.TooShort(field.NewPath("min10ValidatedTypedefField"), "", 10),
+		field.TooShort(field.NewPath("min10ValidatedTypedefPtrField"), "", 10),
+		field.TooShort(field.NewPath("min2Field"), "x", 2),
+		field.TooShort(field.NewPath("min2PtrField"), "x", 2),
+		field.TooShort(field.NewPath("min2UnvalidatedTypedefField"), "x", 2),
+		field.TooShort(field.NewPath("min2UnvalidatedTypedefPtrField"), "x", 2),
+		field.TooShort(field.NewPath("min2ValidatedTypedefField"), "x", 2),
+		field.TooShort(field.NewPath("min2ValidatedTypedefPtrField"), "x", 2),
+		field.TooShort(field.NewPath("min2UnvalidatedStringAliasField"), "x", 2),
+		field.TooShort(field.NewPath("min2UnvalidatedStringAliasPtrField"), "x", 2),
+	})
+
+	st.Value(&Struct{
+		Min2Field:                          strings.Repeat("x", 2),
+		Min2PtrField:                       ptr.To(strings.Repeat("x", 2)),
+		Min2UnvalidatedTypedefField:        UnvalidatedStringType(strings.Repeat("x", 2)),
+		Min2UnvalidatedTypedefPtrField:     ptr.To(UnvalidatedStringType(strings.Repeat("x", 2))),
+		Min2ValidatedTypedefField:          Min2Type(strings.Repeat("x", 2)),
+		Min10Field:                         strings.Repeat("x", 10),
+		Min10PtrField:                      ptr.To(strings.Repeat("x", 10)),
+		Min10UnvalidatedTypedefField:       UnvalidatedStringType(strings.Repeat("x", 10)),
+		Min10UnvalidatedTypedefPtrField:    ptr.To(UnvalidatedStringType(strings.Repeat("x", 10))),
+		Min10ValidatedTypedefField:         Min10Type(strings.Repeat("x", 10)),
+		Min10ValidatedTypedefPtrField:      ptr.To(Min10Type(strings.Repeat("x", 10))),
+		Min2UnvalidatedStringAliasField:    strings.Repeat("x", 2),
+		Min2UnvalidatedStringAliasPtrField: ptr.To(strings.Repeat("x", 2)),
+	}).ExpectValid()
+
+	testVal := &Struct{
+		Min2Field:                          strings.Repeat("x", 3),
+		Min2PtrField:                       ptr.To(strings.Repeat("x", 3)),
+		Min10Field:                         strings.Repeat("x", 11),
+		Min10PtrField:                      ptr.To(strings.Repeat("x", 11)),
+		Min2UnvalidatedTypedefField:        UnvalidatedStringType(strings.Repeat("x", 3)),
+		Min2UnvalidatedTypedefPtrField:     ptr.To(UnvalidatedStringType(strings.Repeat("x", 3))),
+		Min10UnvalidatedTypedefField:       UnvalidatedStringType(strings.Repeat("x", 11)),
+		Min10UnvalidatedTypedefPtrField:    ptr.To(UnvalidatedStringType(strings.Repeat("x", 11))),
+		Min2ValidatedTypedefField:          Min2Type(strings.Repeat("x", 3)),
+		Min2ValidatedTypedefPtrField:       ptr.To(Min2Type(strings.Repeat("x", 3))),
+		Min10ValidatedTypedefField:         Min10Type(strings.Repeat("x", 11)),
+		Min10ValidatedTypedefPtrField:      ptr.To(Min10Type(strings.Repeat("x", 11))),
+		Min2UnvalidatedStringAliasField:    strings.Repeat("x", 3),
+		Min2UnvalidatedStringAliasPtrField: ptr.To(strings.Repeat("x", 3)),
+	}
+	st.Value(testVal).ExpectValid()
+
+	// Test validation ratcheting
+	st.Value(&Struct{
+		Min2Field:                       strings.Repeat("x", 2),
+		Min2PtrField:                    ptr.To(strings.Repeat("x", 2)),
+		Min10Field:                      strings.Repeat("x", 11),
+		Min10PtrField:                   ptr.To(strings.Repeat("x", 11)),
+		Min2UnvalidatedTypedefField:     UnvalidatedStringType(strings.Repeat("x", 2)),
+		Min2UnvalidatedTypedefPtrField:  ptr.To(UnvalidatedStringType(strings.Repeat("x", 2))),
+		Min10UnvalidatedTypedefField:    UnvalidatedStringType(strings.Repeat("x", 11)),
+		Min10UnvalidatedTypedefPtrField: ptr.To(UnvalidatedStringType(strings.Repeat("x", 11))),
+		Min2ValidatedTypedefField:       Min2Type(strings.Repeat("x", 2)),
+		Min2ValidatedTypedefPtrField:    ptr.To(Min2Type(strings.Repeat("x", 2))),
+		Min10ValidatedTypedefField:      Min10Type(strings.Repeat("x", 11)),
+		Min10ValidatedTypedefPtrField:   ptr.To(Min10Type(strings.Repeat("x", 11))),
+	}).OldValue(&Struct{
+		Min2Field:                       strings.Repeat("x", 1),
+		Min2PtrField:                    ptr.To(strings.Repeat("x", 1)),
+		Min10Field:                      strings.Repeat("x", 9),
+		Min10PtrField:                   ptr.To(strings.Repeat("x", 1)),
+		Min2UnvalidatedTypedefField:     UnvalidatedStringType(strings.Repeat("x", 1)),
+		Min2UnvalidatedTypedefPtrField:  ptr.To(UnvalidatedStringType(strings.Repeat("x", 1))),
+		Min10UnvalidatedTypedefField:    UnvalidatedStringType(strings.Repeat("x", 9)),
+		Min10UnvalidatedTypedefPtrField: ptr.To(UnvalidatedStringType(strings.Repeat("x", 9))),
+		Min2ValidatedTypedefField:       Min2Type(strings.Repeat("x", 1)),
+		Min2ValidatedTypedefPtrField:    ptr.To(Min2Type(strings.Repeat("x", 1))),
+		Min10ValidatedTypedefField:      Min10Type(strings.Repeat("x", 9)),
+		Min10ValidatedTypedefPtrField:   ptr.To(Min10Type(strings.Repeat("x", 9))),
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minlength/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minlength/zz_generated.validations.go
new file mode 100644
index 0000000000..e5a87695cd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minlength/zz_generated.validations.go
@@ -0,0 +1,551 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package minlength
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Min10Type validates an instance of Min10Type according
+// to declarative validation rules in the API schema.
+func Validate_Min10Type(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Min10Type) (errs field.ErrorList) {
+
+	if e := validate.MinLength(ctx, op, fldPath, obj, oldObj, 10).MarkAlpha(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Min2Type validates an instance of Min2Type according
+// to declarative validation rules in the API schema.
+func Validate_Min2Type(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Min2Type) (errs field.ErrorList) {
+
+	if e := validate.MinLength(ctx, op, fldPath, obj, oldObj, 2).MarkAlpha(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Min0PtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.Min0PtrField
+			})
+		errs = append(errs, fn(fldPath.Child("min0PtrField"), obj.Min0PtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min2Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.MinLength(ctx, op, fldPath, obj, oldObj, 2).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.Min2Field
+			})
+		errs = append(errs, fn(fldPath.Child("min2Field"), &obj.Min2Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min2PtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.MinLength(ctx, op, fldPath, obj, oldObj, 2).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.Min2PtrField
+			})
+		errs = append(errs, fn(fldPath.Child("min2PtrField"), obj.Min2PtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min10Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.MinLength(ctx, op, fldPath, obj, oldObj, 10).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.Min10Field
+			})
+		errs = append(errs, fn(fldPath.Child("min10Field"), &obj.Min10Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min10PtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.MinLength(ctx, op, fldPath, obj, oldObj, 10).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.Min10PtrField
+			})
+		errs = append(errs, fn(fldPath.Child("min10PtrField"), obj.Min10PtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min2UnvalidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *UnvalidatedStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.MinLength(ctx, op, fldPath, obj, oldObj, 2).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *UnvalidatedStringType {
+				return &oldObj.Min2UnvalidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("min2UnvalidatedTypedefField"), &obj.Min2UnvalidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min2UnvalidatedTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *UnvalidatedStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.MinLength(ctx, op, fldPath, obj, oldObj, 2).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *UnvalidatedStringType {
+				return oldObj.Min2UnvalidatedTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("min2UnvalidatedTypedefPtrField"), obj.Min2UnvalidatedTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min10UnvalidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *UnvalidatedStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.MinLength(ctx, op, fldPath, obj, oldObj, 10).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *UnvalidatedStringType {
+				return &oldObj.Min10UnvalidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("min10UnvalidatedTypedefField"), &obj.Min10UnvalidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min10UnvalidatedTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *UnvalidatedStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.MinLength(ctx, op, fldPath, obj, oldObj, 10).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *UnvalidatedStringType {
+				return oldObj.Min10UnvalidatedTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("min10UnvalidatedTypedefPtrField"), obj.Min10UnvalidatedTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min2ValidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Min2Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Min2Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Min2Type {
+				return &oldObj.Min2ValidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("min2ValidatedTypedefField"), &obj.Min2ValidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min2ValidatedTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Min2Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Min2Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Min2Type {
+				return oldObj.Min2ValidatedTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("min2ValidatedTypedefPtrField"), obj.Min2ValidatedTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min10ValidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Min10Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Min10Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Min10Type {
+				return &oldObj.Min10ValidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("min10ValidatedTypedefField"), &obj.Min10ValidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min10ValidatedTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Min10Type,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Min10Type(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Min10Type {
+				return oldObj.Min10ValidatedTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("min10ValidatedTypedefPtrField"), obj.Min10ValidatedTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min2UnvalidatedStringAliasField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.MinLength(ctx, op, fldPath, obj, oldObj, 2).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.Min2UnvalidatedStringAliasField
+			})
+		errs = append(errs, fn(fldPath.Child("min2UnvalidatedStringAliasField"), &obj.Min2UnvalidatedStringAliasField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min2UnvalidatedStringAliasPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.MinLength(ctx, op, fldPath, obj, oldObj, 2).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.Min2UnvalidatedStringAliasPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("min2UnvalidatedStringAliasPtrField"), obj.Min2UnvalidatedStringAliasPtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minproperties/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minproperties/doc.go
new file mode 100644
index 0000000000..d551a30e23
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minproperties/doc.go
@@ -0,0 +1,44 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package minproperties
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:minProperties=0
+	Min0Field map[string]string `json:"min0Field"`
+
+	// +k8s:minProperties=10
+	Min10Field map[string]string `json:"min10Field"`
+
+	// +k8s:minProperties=0
+	Min0TypedefField map[string]StringType `json:"min0TypedefField"`
+
+	// +k8s:minProperties=10
+	Min10TypedefField map[string]StringType `json:"min10TypedefField"`
+}
+
+type StringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minproperties/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minproperties/doc_test.go
new file mode 100644
index 0000000000..2af306b0f3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minproperties/doc_test.go
@@ -0,0 +1,123 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package minproperties
+
+import (
+	"fmt"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 0, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 0, 10),
+	})
+
+	st.Value(&Struct{
+		Min0Field:         make(map[string]string, 0),
+		Min10Field:        make(map[string]string, 0),
+		Min0TypedefField:  make(map[string]StringType, 0),
+		Min10TypedefField: make(map[string]StringType, 0),
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 0, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 0, 10),
+	})
+
+	min10Field1 := make(map[string]string)
+	min10TypedefField1 := make(map[string]StringType)
+	for i := range 1 {
+		min10Field1[fmt.Sprintf("k%d", i)] = "v"
+		min10TypedefField1[fmt.Sprintf("k%d", i)] = "v"
+	}
+
+	st.Value(&Struct{
+		Min10Field:        min10Field1,
+		Min10TypedefField: min10TypedefField1,
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 1, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 1, 10),
+	})
+
+	min10Field9 := make(map[string]string)
+	min10TypedefField9 := make(map[string]StringType)
+	for i := range 9 {
+		min10Field9[fmt.Sprintf("k%d", i)] = "v"
+		min10TypedefField9[fmt.Sprintf("k%d", i)] = "v"
+	}
+
+	st.Value(&Struct{
+		Min10Field:        min10Field9,
+		Min10TypedefField: min10TypedefField9,
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooFew(field.NewPath("min10Field"), 9, 10),
+		field.TooFew(field.NewPath("min10TypedefField"), 9, 10),
+	})
+
+	min10Field10 := make(map[string]string)
+	min10TypedefField10 := make(map[string]StringType)
+	for i := range 10 {
+		min10Field10[fmt.Sprintf("k%d", i)] = "v"
+		min10TypedefField10[fmt.Sprintf("k%d", i)] = "v"
+	}
+
+	st.Value(&Struct{
+		Min10Field:        min10Field10,
+		Min10TypedefField: min10TypedefField10,
+	}).ExpectValid()
+
+	min0Field1 := make(map[string]string)
+	min10Field11 := make(map[string]string)
+	min0TypedefField1 := make(map[string]StringType)
+	min10TypedefField11 := make(map[string]StringType)
+
+	for i := range 1 {
+		min0Field1[fmt.Sprintf("k%d", i)] = "v"
+		min0TypedefField1[fmt.Sprintf("k%d", i)] = "v"
+	}
+	for i := range 11 {
+		min10Field11[fmt.Sprintf("k%d", i)] = "v"
+		min10TypedefField11[fmt.Sprintf("k%d", i)] = "v"
+	}
+
+	testVal := &Struct{
+		Min0Field:         min0Field1,
+		Min10Field:        min10Field11,
+		Min0TypedefField:  min0TypedefField1,
+		Min10TypedefField: min10TypedefField11,
+	}
+	st.Value(testVal).ExpectValid()
+
+	// Test validation ratcheting
+	st.Value(&Struct{
+		Min0Field:         min0Field1,
+		Min10Field:        min10Field11,
+		Min0TypedefField:  min0TypedefField1,
+		Min10TypedefField: min10TypedefField11,
+	}).OldValue(&Struct{
+		Min0Field:         min0Field1,
+		Min10Field:        min10Field1,
+		Min0TypedefField:  min0TypedefField1,
+		Min10TypedefField: min10TypedefField1,
+	}).ExpectValid()
+
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minproperties/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minproperties/zz_generated.validations.go
new file mode 100644
index 0000000000..2488fbeda4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/minproperties/zz_generated.validations.go
@@ -0,0 +1,164 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package minproperties
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Min0Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MinProperties(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.Min0Field
+			})
+		errs = append(errs, fn(fldPath.Child("min0Field"), obj.Min0Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min10Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MinProperties(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.Min10Field
+			})
+		errs = append(errs, fn(fldPath.Child("min10Field"), obj.Min10Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min0TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MinProperties(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]StringType {
+				return oldObj.Min0TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("min0TypedefField"), obj.Min0TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Min10TypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.MinProperties(ctx, op, fldPath, obj, oldObj, 10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]StringType {
+				return oldObj.Min10TypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("min10TypedefField"), obj.Min10TypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/doc.go
new file mode 100644
index 0000000000..c97bdf4e73
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/doc.go
@@ -0,0 +1,115 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package mode
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type StrictUnion struct {
+	TypeMeta int
+
+	// +k8s:modeDiscriminator
+	D1 string `json:"d1"`
+
+	// +k8s:ifMode("A")=+k8s:required
+	FieldA *string `json:"fieldA,omitempty"`
+
+	// +k8s:ifMode("B")=+k8s:required
+	FieldB *string `json:"fieldB,omitempty"`
+}
+
+type SharedField struct {
+	TypeMeta int
+
+	// +k8s:modeDiscriminator
+	D1 string `json:"d1"`
+
+	// Valid in A and B, implicitly forbidden in C.
+	// +k8s:ifMode("A")=+k8s:optional
+	// +k8s:ifMode("B")=+k8s:optional
+	FieldA *string `json:"fieldA,omitempty"`
+}
+
+type ChainedValidation struct {
+	TypeMeta int
+
+	// +k8s:modeDiscriminator
+	D1 string `json:"d1"`
+
+	// In mode A, it is required AND must have maxLength 5.
+	// +k8s:ifMode("A")=+k8s:required
+	// +k8s:ifMode("A")=+k8s:maxLength=5
+	FieldA *string `json:"fieldA,omitempty"`
+}
+
+type ImplicitForbidden struct {
+	TypeMeta int
+
+	// +k8s:modeDiscriminator
+	D1 string `json:"d1"`
+
+	// Field is only mentioned for mode A. Mode B should implicitly forbid it.
+	// +k8s:ifMode("A")=+k8s:optional
+	FieldA *string `json:"fieldA,omitempty"`
+}
+
+type NonStringDiscriminator struct {
+	TypeMeta int
+
+	// +k8s:modeDiscriminator(modality:"Bool")
+	D1 bool `json:"d1"`
+
+	// +k8s:ifMode(modality:"Bool", mode:"true")=+k8s:required
+	FieldA *string `json:"fieldA,omitempty"`
+}
+
+type MultipleDiscriminators struct {
+	TypeMeta int
+
+	// +k8s:modeDiscriminator(modality:"D1")
+	D1 string `json:"d1"`
+
+	// +k8s:modeDiscriminator(modality:"D2")
+	D2 string `json:"d2"`
+
+	// +k8s:ifMode(modality:"D1", mode:"A")=+k8s:required
+	FieldA *string `json:"fieldA,omitempty"`
+
+	// +k8s:ifMode(modality:"D2", mode:"B")=+k8s:required
+	FieldB *string `json:"fieldB,omitempty"`
+}
+
+type Collections struct {
+	TypeMeta int
+
+	// +k8s:modeDiscriminator
+	D1 string `json:"d1"`
+
+	// +k8s:ifMode("A")=+k8s:optional
+	ListField []string `json:"listField,omitempty"`
+
+	// +k8s:ifMode("A")=+k8s:optional
+	MapField map[string]string `json:"mapField,omitempty"`
+}
+
+type TypeMeta int
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/doc_test.go
new file mode 100644
index 0000000000..94cfbc66a4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/doc_test.go
@@ -0,0 +1,195 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mode
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestStrictUnion(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Mode A: FieldA required, FieldB implicitly forbidden
+	st.Value(&StrictUnion{D1: "A", FieldA: ptr.To("val")}).ExpectValid()
+	st.Value(&StrictUnion{D1: "A"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Required(field.NewPath("fieldA"), ""),
+	})
+	st.Value(&StrictUnion{D1: "A", FieldA: ptr.To("val"), FieldB: ptr.To("val")}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Forbidden(field.NewPath("fieldB"), ""),
+	})
+
+	// Mode B: FieldA implicitly forbidden, FieldB required
+	st.Value(&StrictUnion{D1: "B", FieldB: ptr.To("val")}).ExpectValid()
+	st.Value(&StrictUnion{D1: "B"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Required(field.NewPath("fieldB"), ""),
+	})
+	st.Value(&StrictUnion{D1: "B", FieldA: ptr.To("val"), FieldB: ptr.To("val")}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Forbidden(field.NewPath("fieldA"), ""),
+	})
+}
+
+func TestSharedField(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Valid (optional) in A and B
+	st.Value(&SharedField{D1: "A"}).ExpectValid()
+	st.Value(&SharedField{D1: "A", FieldA: ptr.To("val")}).ExpectValid()
+	st.Value(&SharedField{D1: "B"}).ExpectValid()
+	st.Value(&SharedField{D1: "B", FieldA: ptr.To("val")}).ExpectValid()
+
+	// Forbidden in C
+	st.Value(&SharedField{D1: "C", FieldA: ptr.To("val")}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Forbidden(field.NewPath("fieldA"), ""),
+	})
+}
+
+func TestChainedValidation(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Mode A: Required AND maxLength 5
+	st.Value(&ChainedValidation{D1: "A", FieldA: ptr.To("abc")}).ExpectValid()
+	st.Value(&ChainedValidation{D1: "A"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Required(field.NewPath("fieldA"), ""),
+	})
+	st.Value(&ChainedValidation{D1: "A", FieldA: ptr.To("too-long")}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooLong(field.NewPath("fieldA"), "too-long", 5),
+	})
+
+	// Mode B: Unlisted, so implicitly forbidden
+	st.Value(&ChainedValidation{D1: "B", FieldA: ptr.To("val")}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Forbidden(field.NewPath("fieldA"), ""),
+	})
+}
+
+func TestImplicitForbidden(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Mode A: Optional
+	st.Value(&ImplicitForbidden{D1: "A"}).ExpectValid()
+	st.Value(&ImplicitForbidden{D1: "A", FieldA: ptr.To("val")}).ExpectValid()
+
+	// Mode B: Not listed, so implicitly Forbidden
+	st.Value(&ImplicitForbidden{D1: "B", FieldA: ptr.To("val")}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Forbidden(field.NewPath("fieldA"), ""),
+	})
+}
+
+func TestNonStringDiscriminator(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Bool mode
+	st.Value(&NonStringDiscriminator{D1: true, FieldA: ptr.To("val")}).ExpectValid()
+	st.Value(&NonStringDiscriminator{D1: true}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Required(field.NewPath("fieldA"), ""),
+	})
+	st.Value(&NonStringDiscriminator{D1: false, FieldA: ptr.To("val")}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Forbidden(field.NewPath("fieldA"), ""),
+	})
+}
+
+func TestMultipleDiscriminators(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&MultipleDiscriminators{
+		D1:     "A",
+		D2:     "B",
+		FieldA: ptr.To("valA"),
+		FieldB: ptr.To("valB"),
+	}).ExpectValid()
+
+	st.Value(&MultipleDiscriminators{
+		D1: "A",
+		D2: "B",
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Required(field.NewPath("fieldA"), ""),
+		field.Required(field.NewPath("fieldB"), ""),
+	})
+}
+
+func TestCollections(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Mode A: Collections are valid (optional)
+	st.Value(&Collections{
+		D1: "A",
+	}).ExpectValid()
+
+	st.Value(&Collections{
+		D1:        "A",
+		ListField: []string{"item"},
+		MapField:  map[string]string{"key": "val"},
+	}).ExpectValid()
+
+	// Mode B: Unlisted, so implicitly forbidden
+	st.Value(&Collections{
+		D1:        "B",
+		ListField: []string{"item"},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Forbidden(field.NewPath("listField"), ""),
+	})
+
+	st.Value(&Collections{
+		D1:       "B",
+		MapField: map[string]string{"key": "val"},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Forbidden(field.NewPath("mapField"), ""),
+	})
+}
+
+func TestRatcheting(t *testing.T) {
+	mkTest := func() *ChainedValidation {
+		return &ChainedValidation{
+			D1:     "A",
+			FieldA: ptr.To("too-long-string"),
+		}
+	}
+
+	st := localSchemeBuilder.Test(t)
+
+	// 1. New object is invalid
+	st.Value(mkTest()).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooLong(field.NewPath("fieldA"), "too-long-string", 5),
+	})
+
+	// 2. Unchanged update is valid (ratcheting)
+	st.Value(mkTest()).OldValue(mkTest()).ExpectValid()
+
+	// 3. Changed value re-validates (and fails)
+	mkDifferent := func() *ChainedValidation {
+		return &ChainedValidation{
+			D1:     "A",
+			FieldA: ptr.To("also-too-long"),
+		}
+	}
+	st.Value(mkTest()).OldValue(mkDifferent()).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooLong(field.NewPath("fieldA"), "too-long-string", 5),
+	})
+
+	// 4. Changed discriminator re-validates (and fails)
+	mkDifferentDisc := func() *ChainedValidation {
+		return &ChainedValidation{
+			D1:     "B", // Discriminator changed from B -> A
+			FieldA: ptr.To("too-long-string"),
+		}
+	}
+	st.Value(mkTest()).OldValue(mkDifferentDisc()).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.TooLong(field.NewPath("fieldA"), "too-long-string", 5),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/zz_generated.validations.go
new file mode 100644
index 0000000000..d3968299c2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/zz_generated.validations.go
@@ -0,0 +1,539 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package mode
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type ChainedValidation
+	scheme.AddValidationFunc(
+		(*ChainedValidation)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ChainedValidation(
+					ctx, op, nil, /* fldPath */
+					obj.(*ChainedValidation),
+					safe.Cast[*ChainedValidation](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type Collections
+	scheme.AddValidationFunc(
+		(*Collections)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Collections(
+					ctx, op, nil, /* fldPath */
+					obj.(*Collections),
+					safe.Cast[*Collections](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ImplicitForbidden
+	scheme.AddValidationFunc(
+		(*ImplicitForbidden)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ImplicitForbidden(
+					ctx, op, nil, /* fldPath */
+					obj.(*ImplicitForbidden),
+					safe.Cast[*ImplicitForbidden](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type MultipleDiscriminators
+	scheme.AddValidationFunc(
+		(*MultipleDiscriminators)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_MultipleDiscriminators(
+					ctx, op, nil, /* fldPath */
+					obj.(*MultipleDiscriminators),
+					safe.Cast[*MultipleDiscriminators](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type NonStringDiscriminator
+	scheme.AddValidationFunc(
+		(*NonStringDiscriminator)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_NonStringDiscriminator(
+					ctx, op, nil, /* fldPath */
+					obj.(*NonStringDiscriminator),
+					safe.Cast[*NonStringDiscriminator](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type SharedField
+	scheme.AddValidationFunc(
+		(*SharedField)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_SharedField(
+					ctx, op, nil, /* fldPath */
+					obj.(*SharedField),
+					safe.Cast[*SharedField](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type StrictUnion
+	scheme.AddValidationFunc(
+		(*StrictUnion)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_StrictUnion(
+					ctx, op, nil, /* fldPath */
+					obj.(*StrictUnion),
+					safe.Cast[*StrictUnion](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_ChainedValidation validates an instance of ChainedValidation according
+// to declarative validation rules in the API schema.
+func Validate_ChainedValidation(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ChainedValidation) (errs field.ErrorList) {
+
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldA",
+		func(obj *ChainedValidation) *string { return obj.FieldA },
+		func(obj *ChainedValidation) string { return obj.D1 }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj)...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "A",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					errs = append(errs, validate.MaxLength(ctx, op, fldPath, obj, oldObj, 5)...)
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field ChainedValidation.TypeMeta has no validation
+	// field ChainedValidation.D1 has no validation
+	// field ChainedValidation.FieldA has no validation
+	return errs
+}
+
+// Validate_Collections validates an instance of Collections according
+// to declarative validation rules in the API schema.
+func Validate_Collections(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Collections) (errs field.ErrorList) {
+
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "listField",
+		func(obj *Collections) []string { return obj.ListField },
+		func(obj *Collections) string { return obj.D1 }, deepEqualImpl_,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenSlice(ctx, op, fldPath, obj, oldObj)...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[[]string, string]{
+
+			{
+				Value: "A",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "mapField",
+		func(obj *Collections) map[string]string { return obj.MapField },
+		func(obj *Collections) string { return obj.D1 }, deepEqualImpl_,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenMap(ctx, op, fldPath, obj, oldObj)...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[map[string]string, string]{
+
+			{
+				Value: "A",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.OptionalMap(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Collections.TypeMeta has no validation
+	// field Collections.D1 has no validation
+	// field Collections.ListField has no validation
+	// field Collections.MapField has no validation
+	return errs
+}
+
+// Validate_ImplicitForbidden validates an instance of ImplicitForbidden according
+// to declarative validation rules in the API schema.
+func Validate_ImplicitForbidden(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ImplicitForbidden) (errs field.ErrorList) {
+
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldA",
+		func(obj *ImplicitForbidden) *string { return obj.FieldA },
+		func(obj *ImplicitForbidden) string { return obj.D1 }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj)...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "A",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field ImplicitForbidden.TypeMeta has no validation
+	// field ImplicitForbidden.D1 has no validation
+	// field ImplicitForbidden.FieldA has no validation
+	return errs
+}
+
+// Validate_MultipleDiscriminators validates an instance of MultipleDiscriminators according
+// to declarative validation rules in the API schema.
+func Validate_MultipleDiscriminators(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MultipleDiscriminators) (errs field.ErrorList) {
+
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldA",
+		func(obj *MultipleDiscriminators) *string { return obj.FieldA },
+		func(obj *MultipleDiscriminators) string { return obj.D1 }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj)...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "A",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldB",
+		func(obj *MultipleDiscriminators) *string { return obj.FieldB },
+		func(obj *MultipleDiscriminators) string { return obj.D2 }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj)...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "B",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field MultipleDiscriminators.TypeMeta has no validation
+	// field MultipleDiscriminators.D1 has no validation
+	// field MultipleDiscriminators.D2 has no validation
+	// field MultipleDiscriminators.FieldA has no validation
+	// field MultipleDiscriminators.FieldB has no validation
+	return errs
+}
+
+// Validate_NonStringDiscriminator validates an instance of NonStringDiscriminator according
+// to declarative validation rules in the API schema.
+func Validate_NonStringDiscriminator(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *NonStringDiscriminator) (errs field.ErrorList) {
+
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldA",
+		func(obj *NonStringDiscriminator) *string { return obj.FieldA },
+		func(obj *NonStringDiscriminator) bool { return obj.D1 }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj)...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, bool]{
+
+			{
+				Value: true,
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field NonStringDiscriminator.TypeMeta has no validation
+	// field NonStringDiscriminator.D1 has no validation
+	// field NonStringDiscriminator.FieldA has no validation
+	return errs
+}
+
+// Validate_SharedField validates an instance of SharedField according
+// to declarative validation rules in the API schema.
+func Validate_SharedField(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *SharedField) (errs field.ErrorList) {
+
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldA",
+		func(obj *SharedField) *string { return obj.FieldA },
+		func(obj *SharedField) string { return obj.D1 }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj)...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "A",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+
+			{
+				Value: "B",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field SharedField.TypeMeta has no validation
+	// field SharedField.D1 has no validation
+	// field SharedField.FieldA has no validation
+	return errs
+}
+
+// Validate_StrictUnion validates an instance of StrictUnion according
+// to declarative validation rules in the API schema.
+func Validate_StrictUnion(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StrictUnion) (errs field.ErrorList) {
+
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldA",
+		func(obj *StrictUnion) *string { return obj.FieldA },
+		func(obj *StrictUnion) string { return obj.D1 }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj)...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "A",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldB",
+		func(obj *StrictUnion) *string { return obj.FieldB },
+		func(obj *StrictUnion) string { return obj.D1 }, validate.DirectEqual,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			errs := field.ErrorList{}
+			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj)...)
+			return errs
+		},
+		[]validate.DiscriminatedRule[*string, string]{
+
+			{
+				Value: "B",
+				Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					earlyReturn := false
+					if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+						errs = append(errs, e...)
+						earlyReturn = true
+					}
+					if earlyReturn {
+						return errs
+					}
+					return errs
+				},
+			},
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field StrictUnion.TypeMeta has no validation
+	// field StrictUnion.D1 has no validation
+	// field StrictUnion.FieldA has no validation
+	// field StrictUnion.FieldB has no validation
+	return errs
+}
+
+// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
+func deepEqualImpl_[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/doc.go
new file mode 100644
index 0000000000..f72f2a9ebf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/doc.go
@@ -0,0 +1,82 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package monotonic
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:minimum=0
+	// +k8s:monotonic
+	IntField int `json:"intField"`
+
+	// +k8s:minimum=0
+	// +k8s:monotonic
+	Int64Field int64 `json:"int64Field"`
+
+	// +k8s:minimum=0
+	// +k8s:monotonic
+	Uint64Field uint64 `json:"uint64Field"`
+
+	// +k8s:optional
+	// +k8s:minimum=0
+	// +k8s:update=NoUnset
+	// +k8s:monotonic
+	IntPtrField *int `json:"intPtrField"`
+
+	MonotonicField MonotonicType `json:"monotonicField"`
+
+	MonotonicPtrField *MonotonicType `json:"monotonicPtrField"`
+
+	// +k8s:optional
+	// +k8s:minimum=0
+	// +k8s:update=NoUnset
+	// +k8s:monotonic
+	OptionalInt int `json:"optionalInt,omitempty"`
+
+	// +k8s:required
+	// +k8s:minimum=0
+	// +k8s:monotonic
+	RequiredInt int `json:"requiredInt"`
+
+	// +k8s:optional
+	// +k8s:minimum=0
+	// +k8s:update=NoUnset
+	// +k8s:monotonic
+	OptionalIntPtr *int `json:"optionalIntPtr"`
+
+	// +k8s:required
+	// +k8s:minimum=0
+	// +k8s:monotonic
+	RequiredIntPtr *int `json:"requiredIntPtr"`
+
+	// +k8s:minimum=-10
+	// +k8s:monotonic
+	NegativeInt int `json:"negativeInt"`
+}
+
+// +k8s:minimum=0
+// +k8s:monotonic
+type MonotonicType int
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/doc_test.go
new file mode 100644
index 0000000000..bc24167466
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/doc_test.go
@@ -0,0 +1,140 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package monotonic
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	structOrig := Struct{
+		IntField:          10,
+		Int64Field:        20,
+		Uint64Field:       30,
+		IntPtrField:       new(40),
+		MonotonicField:    50,
+		MonotonicPtrField: new(MonotonicType(60)),
+		OptionalInt:       10,
+		RequiredInt:       10,
+		OptionalIntPtr:    new(10),
+		RequiredIntPtr:    new(10),
+		NegativeInt:       0,
+	}
+
+	structIncrease := Struct{
+		IntField:          11,
+		Int64Field:        21,
+		Uint64Field:       31,
+		IntPtrField:       new(41),
+		MonotonicField:    51,
+		MonotonicPtrField: new(MonotonicType(61)),
+		OptionalInt:       11,
+		RequiredInt:       11,
+		OptionalIntPtr:    new(11),
+		RequiredIntPtr:    new(11),
+		NegativeInt:       5,
+	}
+
+	structDecrease := Struct{
+		IntField:          9,
+		Int64Field:        19,
+		Uint64Field:       29,
+		IntPtrField:       new(39),
+		MonotonicField:    49,
+		MonotonicPtrField: new(MonotonicType(59)),
+		OptionalInt:       9,
+		RequiredInt:       9,
+		OptionalIntPtr:    new(9),
+		RequiredIntPtr:    new(9),
+		NegativeInt:       0,
+	}
+
+	// Valid updates
+	st.Value(&structOrig).OldValue(&structOrig).ExpectValid()
+	st.Value(&structIncrease).OldValue(&structOrig).ExpectValid()
+
+	// Invalid updates (decreases)
+	st.Value(&structDecrease).OldValue(&structOrig).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("intField"), nil, "").WithOrigin("monotonic"),
+		field.Invalid(field.NewPath("int64Field"), nil, "").WithOrigin("monotonic"),
+		field.Invalid(field.NewPath("uint64Field"), nil, "").WithOrigin("monotonic"),
+		field.Invalid(field.NewPath("intPtrField"), nil, "").WithOrigin("monotonic"),
+		field.Invalid(field.NewPath("monotonicField"), nil, "").WithOrigin("monotonic"),
+		field.Invalid(field.NewPath("monotonicPtrField"), nil, "").WithOrigin("monotonic"),
+		field.Invalid(field.NewPath("optionalInt"), nil, "").WithOrigin("monotonic"),
+		field.Invalid(field.NewPath("requiredInt"), nil, "").WithOrigin("monotonic"),
+		field.Invalid(field.NewPath("optionalIntPtr"), nil, "").WithOrigin("monotonic"),
+		field.Invalid(field.NewPath("requiredIntPtr"), nil, "").WithOrigin("monotonic"),
+	})
+
+	// Test special cases: zero and nil
+	structZero := structOrig
+	structZero.OptionalInt = 0
+	structZero.RequiredInt = 0
+	structZero.OptionalIntPtr = new(0)
+	structZero.RequiredIntPtr = new(0)
+
+	// OptionalInt (non-pointer) -> 0 is INVALID (Fails because +k8s:update=NoUnset is present).
+	// RequiredInt -> 0 is INVALID (Fails because of +k8s:required).
+	// OptionalIntPtr -> 0 is INVALID (Monotonic check detects decreased value).
+	// RequiredIntPtr -> 0 is INVALID (Monotonic check detects decreased value).
+	st.Value(&structZero).OldValue(&structOrig).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("optionalInt"), 0, "").WithOrigin("update"),
+		field.Required(field.NewPath("requiredInt"), ""),
+		field.Invalid(field.NewPath("optionalIntPtr"), 0, "").WithOrigin("monotonic"),
+		field.Invalid(field.NewPath("requiredIntPtr"), 0, "").WithOrigin("monotonic"),
+	})
+
+	// OptionalIntPtr -> nil is INVALID because of +k8s:update=NoUnset
+	structNil := structOrig
+	structNil.OptionalIntPtr = nil
+	st.Value(&structNil).OldValue(&structOrig).ExpectMatches(field.ErrorMatcher{}.ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("optionalIntPtr"), nil, "").WithOrigin("update"),
+	})
+
+	// Create should be valid (monotonic validation is update-only)
+	st.Value(&structDecrease).ExpectValid()
+
+	// OptionalIntPtr unset -> set should be valid (transition from nil to value)
+	structSet := structOrig
+	structSet.OptionalIntPtr = new(10)
+	oldObjectSet := structSet
+	oldObjectSet.OptionalIntPtr = nil
+	st.Value(&structSet).OldValue(&oldObjectSet).ExpectValid()
+
+	// OptionalIntPtr set -> unset is now INVALID due to +k8s:update=NoUnset
+	structUnset := structOrig
+	structUnset.OptionalIntPtr = nil
+	st.Value(&structUnset).OldValue(&structOrig).ExpectMatches(field.ErrorMatcher{}.ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("optionalIntPtr"), nil, "").WithOrigin("update"),
+	})
+
+	// Invalid because it violates the minimum constraint (origin = "minimum")
+	structBad := Struct{RequiredInt: 1, RequiredIntPtr: new(int)}
+	structBad.NegativeInt = -11 // below the declared -10
+
+	st.Value(&structBad).ExpectMatches(
+		field.ErrorMatcher{}.ByOrigin(),
+		field.ErrorList{
+			field.Invalid(field.NewPath("negativeInt"), -11, "").
+				WithOrigin("minimum"),
+		})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/zz_generated.validations.go
new file mode 100644
index 0000000000..120b2c9072
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/zz_generated.validations.go
@@ -0,0 +1,420 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package monotonic
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_MonotonicType validates an instance of MonotonicType according
+// to declarative validation rules in the API schema.
+func Validate_MonotonicType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *MonotonicType) (errs field.ErrorList) {
+
+	if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.Monotonic(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.IntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.Monotonic(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return &oldObj.IntField
+			})
+		errs = append(errs, fn(fldPath.Child("intField"), &obj.IntField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Int64Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.Monotonic(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int64 {
+				return &oldObj.Int64Field
+			})
+		errs = append(errs, fn(fldPath.Child("int64Field"), &obj.Int64Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.Uint64Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *uint64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.Monotonic(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *uint64 {
+				return &oldObj.Uint64Field
+			})
+		errs = append(errs, fn(fldPath.Child("uint64Field"), &obj.Uint64Field, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.UpdatePointer(ctx, op, fldPath, obj, oldObj, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.Monotonic(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return oldObj.IntPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("intPtrField"), obj.IntPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MonotonicField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *MonotonicType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_MonotonicType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *MonotonicType {
+				return &oldObj.MonotonicField
+			})
+		errs = append(errs, fn(fldPath.Child("monotonicField"), &obj.MonotonicField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MonotonicPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *MonotonicType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_MonotonicType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *MonotonicType {
+				return oldObj.MonotonicPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("monotonicPtrField"), obj.MonotonicPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.OptionalInt
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a int, b int) bool { return a == b }, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.Monotonic(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return &oldObj.OptionalInt
+			})
+		errs = append(errs, fn(fldPath.Child("optionalInt"), &obj.OptionalInt, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.RequiredInt
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.Monotonic(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return &oldObj.RequiredInt
+			})
+		errs = append(errs, fn(fldPath.Child("requiredInt"), &obj.RequiredInt, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.OptionalIntPtr
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.UpdatePointer(ctx, op, fldPath, obj, oldObj, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.Monotonic(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return oldObj.OptionalIntPtr
+			})
+		errs = append(errs, fn(fldPath.Child("optionalIntPtr"), obj.OptionalIntPtr, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.RequiredIntPtr
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.Monotonic(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return oldObj.RequiredIntPtr
+			})
+		errs = append(errs, fn(fldPath.Child("requiredIntPtr"), obj.RequiredIntPtr, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.NegativeInt
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, -10); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.Monotonic(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return &oldObj.NegativeInt
+			})
+		errs = append(errs, fn(fldPath.Child("negativeInt"), &obj.NegativeInt, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neq/neqchained/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neq/neqchained/doc.go
new file mode 100644
index 0000000000..9b2063ebd1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neq/neqchained/doc.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package for complex neq compositions.
+// +k8s:validation-gen-nolint
+package neqchained
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:subfield(stringField)=+k8s:neq="disallowed-subfield"
+	StructField InnerStruct `json:"structField"`
+
+	// +k8s:optional
+	// +k8s:subfield(stringField)=+k8s:neq="disallowed-subfield-ptr"
+	StructPtrField *InnerStruct `json:"structPtrField"`
+
+	// +k8s:eachVal=+k8s:neq="disallowed-slice"
+	StringSliceField []string `json:"stringSliceField"`
+
+	// +k8s:eachVal=+k8s:neq="disallowed-map-val"
+	StringMapField map[string]string `json:"stringMapField"`
+
+	// +k8s:eachKey=+k8s:neq="disallowed-key"
+	StringMapKeyField map[string]string `json:"stringMapKeyField"`
+
+	ValidatedSliceField ValidatedStringSlice `json:"validatedSliceField"`
+
+	ValidatedStructField ValidatedInnerStruct `json:"validatedStructField"`
+}
+
+type InnerStruct struct {
+	StringField string `json:"stringField"`
+}
+
+// +k8s:eachVal=+k8s:neq="disallowed-typedef"
+type ValidatedStringSlice []string
+
+// +k8s:subfield(stringField)=+k8s:neq="disallowed-typedef-struct"
+type ValidatedInnerStruct InnerStruct
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neq/neqchained/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neq/neqchained/doc_test.go
new file mode 100644
index 0000000000..5b7454b93f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neq/neqchained/doc_test.go
@@ -0,0 +1,75 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package neqchained
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		StructField:          InnerStruct{StringField: "allowed"},
+		StructPtrField:       &InnerStruct{StringField: "valid"},
+		StringSliceField:     []string{"allowed", "valid"},
+		StringMapField:       map[string]string{"k1": "allowed", "k2": "valid"},
+		StringMapKeyField:    map[string]string{"allowed-key": "v1", "valid-key": "v2"},
+		ValidatedSliceField:  []string{"allowed", "valid"},
+		ValidatedStructField: ValidatedInnerStruct{StringField: "allowed"},
+	}).ExpectValid()
+
+	// Test empty collections and unset.
+	st.Value(&Struct{
+		StructField:          InnerStruct{},
+		StructPtrField:       &InnerStruct{StringField: "valid"},
+		StringSliceField:     []string{},
+		StringMapField:       map[string]string{},
+		StringMapKeyField:    map[string]string{},
+		ValidatedSliceField:  []string{},
+		ValidatedStructField: ValidatedInnerStruct{StringField: "allowed"},
+	}).ExpectValid()
+
+	// Test invalid values trigger all expected validation errors
+	invalidStruct := &Struct{
+		StructField:          InnerStruct{StringField: "disallowed-subfield"},
+		StructPtrField:       &InnerStruct{StringField: "disallowed-subfield-ptr"},
+		StringSliceField:     []string{"valid", "disallowed-slice", "disallowed-slice"},
+		StringMapField:       map[string]string{"a": "disallowed-map-val", "b": "valid", "c": "disallowed-map-val"},
+		StringMapKeyField:    map[string]string{"disallowed-key": "value", "allowed": "ok"},
+		ValidatedSliceField:  []string{"valid", "disallowed-typedef", "disallowed-typedef"},
+		ValidatedStructField: ValidatedInnerStruct{StringField: "disallowed-typedef-struct"},
+	}
+
+	st.Value(invalidStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("structField", "stringField"), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("structPtrField", "stringField"), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("stringSliceField").Index(1), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("stringSliceField").Index(2), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("stringMapField").Key("a"), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("stringMapField").Key("c"), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("stringMapKeyField"), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("validatedSliceField").Index(1), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("validatedSliceField").Index(2), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("validatedStructField", "stringField"), nil, "").WithOrigin("neq"),
+	})
+
+	// Test validation ratcheting allows existing invalid values
+	st.Value(invalidStruct).OldValue(invalidStruct).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neq/neqchained/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neq/neqchained/zz_generated.validations.go
new file mode 100644
index 0000000000..10f2ef008b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neq/neqchained/zz_generated.validations.go
@@ -0,0 +1,296 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package neqchained
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.StructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *InnerStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "stringField"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "stringField",
+					func(o *InnerStruct) *string { return &o.StringField }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.NEQ(ctx, op, fldPath, obj, oldObj, "disallowed-subfield")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *InnerStruct {
+				return &oldObj.StructField
+			})
+		errs = append(errs, fn(fldPath.Child("structField"), &obj.StructField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StructPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *InnerStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			func() { // cohort = "stringField"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "stringField",
+					func(o *InnerStruct) *string { return &o.StringField }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.NEQ(ctx, op, fldPath, obj, oldObj, "disallowed-subfield-ptr")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *InnerStruct {
+				return oldObj.StructPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("structPtrField"), obj.StructPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringSliceField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.NEQ(ctx, op, fldPath, obj, oldObj, "disallowed-slice")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.StringSliceField
+			})
+		errs = append(errs, fn(fldPath.Child("stringSliceField"), obj.StringSliceField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringMapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.NEQ(ctx, op, fldPath, obj, oldObj, "disallowed-map-val")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.StringMapField
+			})
+		errs = append(errs, fn(fldPath.Child("stringMapField"), obj.StringMapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringMapKeyField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.NEQ(ctx, op, fldPath, obj, oldObj, "disallowed-key")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.StringMapKeyField
+			})
+		errs = append(errs, fn(fldPath.Child("stringMapKeyField"), obj.StringMapKeyField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ValidatedSliceField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj ValidatedStringSlice,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ValidatedStringSlice(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) ValidatedStringSlice {
+				return oldObj.ValidatedSliceField
+			})
+		errs = append(errs, fn(fldPath.Child("validatedSliceField"), obj.ValidatedSliceField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ValidatedStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ValidatedInnerStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ValidatedInnerStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *ValidatedInnerStruct {
+				return &oldObj.ValidatedStructField
+			})
+		errs = append(errs, fn(fldPath.Child("validatedStructField"), &obj.ValidatedStructField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ValidatedInnerStruct validates an instance of ValidatedInnerStruct according
+// to declarative validation rules in the API schema.
+func Validate_ValidatedInnerStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ValidatedInnerStruct) (errs field.ErrorList) {
+
+	func() { // cohort = "stringField"
+		if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "stringField",
+			func(o *ValidatedInnerStruct) *string { return &o.StringField }, validate.DirectEqual,
+			func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+				return validate.NEQ(ctx, op, fldPath, obj, oldObj, "disallowed-typedef-struct")
+			}); len(e) != 0 {
+			errs = append(errs, e...)
+		}
+	}()
+
+	// field ValidatedInnerStruct.StringField has no validation
+	return errs
+}
+
+// Validate_ValidatedStringSlice validates an instance of ValidatedStringSlice according
+// to declarative validation rules in the API schema.
+func Validate_ValidatedStringSlice(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj ValidatedStringSlice) (errs field.ErrorList) {
+
+	if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+			return validate.NEQ(ctx, op, fldPath, obj, oldObj, "disallowed-typedef")
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqbool/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqbool/doc.go
new file mode 100644
index 0000000000..88bd3d1637
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqbool/doc.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package neqbool
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:neq=true
+	NeqTrueField bool `json:"neqTrueField"`
+
+	// +k8s:neq=false
+	NeqFalsePtrField *bool `json:"neqFalsePtrField"`
+
+	ValidatedTypedefField ValidatedBoolType `json:"validatedTypedefField"`
+}
+
+// +k8s:neq=true
+type ValidatedBoolType bool
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqbool/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqbool/doc_test.go
new file mode 100644
index 0000000000..3cf62820bd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqbool/doc_test.go
@@ -0,0 +1,55 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package neqbool
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		NeqTrueField:          false,
+		NeqFalsePtrField:      ptr.To(true),
+		ValidatedTypedefField: false,
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		NeqTrueField:          false,
+		NeqFalsePtrField:      nil,
+		ValidatedTypedefField: false,
+	}).ExpectValid()
+
+	invalid := &Struct{
+		NeqTrueField:          true,
+		NeqFalsePtrField:      ptr.To(false),
+		ValidatedTypedefField: true,
+	}
+
+	st.Value(invalid).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("neqTrueField"), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("neqFalsePtrField"), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("validatedTypedefField"), nil, "").WithOrigin("neq"),
+	})
+
+	// Test validation ratcheting.
+	st.Value(invalid).OldValue(invalid).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqbool/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqbool/zz_generated.validations.go
new file mode 100644
index 0000000000..2d1994054e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqbool/zz_generated.validations.go
@@ -0,0 +1,150 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package neqbool
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.NeqTrueField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.NEQ(ctx, op, fldPath, obj, oldObj, true); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *bool {
+				return &oldObj.NeqTrueField
+			})
+		errs = append(errs, fn(fldPath.Child("neqTrueField"), &obj.NeqTrueField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.NeqFalsePtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.NEQ(ctx, op, fldPath, obj, oldObj, false); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *bool {
+				return oldObj.NeqFalsePtrField
+			})
+		errs = append(errs, fn(fldPath.Child("neqFalsePtrField"), obj.NeqFalsePtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ValidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ValidatedBoolType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ValidatedBoolType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *ValidatedBoolType {
+				return &oldObj.ValidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("validatedTypedefField"), &obj.ValidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ValidatedBoolType validates an instance of ValidatedBoolType according
+// to declarative validation rules in the API schema.
+func Validate_ValidatedBoolType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ValidatedBoolType) (errs field.ErrorList) {
+
+	if e := validate.NEQ(ctx, op, fldPath, obj, oldObj, true); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqint/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqint/doc.go
new file mode 100644
index 0000000000..019e5f9f8e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqint/doc.go
@@ -0,0 +1,46 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package neqint
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:neq=0
+	IntField int `json:"intField"`
+
+	// +k8s:neq=-1
+	IntPtrField *int `json:"intPtrField"`
+
+	// +k8s:neq=42
+	IntTypedefField IntType `json:"intTypedefField"`
+
+	ValidatedTypedefField ValidatedIntType `json:"validatedTypedefField"`
+}
+
+type IntType int
+
+// +k8s:neq=100
+type ValidatedIntType int
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqint/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqint/doc_test.go
new file mode 100644
index 0000000000..ab0ee8696d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqint/doc_test.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package neqint
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		IntField:              1,
+		IntPtrField:           ptr.To(0),
+		IntTypedefField:       41,
+		ValidatedTypedefField: 99,
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		IntField:              1,
+		IntPtrField:           nil,
+		IntTypedefField:       41,
+		ValidatedTypedefField: 99,
+	}).ExpectValid()
+
+	invalid := &Struct{
+		IntField:              0,
+		IntPtrField:           ptr.To(-1),
+		IntTypedefField:       42,
+		ValidatedTypedefField: 100,
+	}
+
+	st.Value(invalid).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("intField"), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("intPtrField"), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("intTypedefField"), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("validatedTypedefField"), nil, "").WithOrigin("neq"),
+	})
+
+	// Test validation ratcheting.
+	st.Value(invalid).OldValue(invalid).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqint/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqint/zz_generated.validations.go
new file mode 100644
index 0000000000..acc9bf0039
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqint/zz_generated.validations.go
@@ -0,0 +1,174 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package neqint
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.IntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.NEQ(ctx, op, fldPath, obj, oldObj, 0); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return &oldObj.IntField
+			})
+		errs = append(errs, fn(fldPath.Child("intField"), &obj.IntField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.NEQ(ctx, op, fldPath, obj, oldObj, -1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return oldObj.IntPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("intPtrField"), obj.IntPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.NEQ(ctx, op, fldPath, obj, oldObj, 42); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *IntType {
+				return &oldObj.IntTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("intTypedefField"), &obj.IntTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ValidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ValidatedIntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ValidatedIntType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *ValidatedIntType {
+				return &oldObj.ValidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("validatedTypedefField"), &obj.ValidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ValidatedIntType validates an instance of ValidatedIntType according
+// to declarative validation rules in the API schema.
+func Validate_ValidatedIntType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ValidatedIntType) (errs field.ErrorList) {
+
+	if e := validate.NEQ(ctx, op, fldPath, obj, oldObj, 100); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqstring/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqstring/doc.go
new file mode 100644
index 0000000000..e31d05a9e1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqstring/doc.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package neqstring
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:neq="disallowed-string"
+	StringField string `json:"stringField"`
+
+	// +k8s:neq="disallowed-pointer"
+	StringPtrField *string `json:"stringPtrField"`
+
+	// +k8s:neq="disallowed-typedef"
+	StringTypedefField StringType `json:"stringTypedefField"`
+
+	// +k8s:neq="disallowed-typedef-pointer"
+	StringTypedefPtrField *StringType `json:"stringTypedefPtrField"`
+
+	ValidatedTypedefField    ValidatedStringType  `json:"validatedTypedefField"`
+	ValidatedTypedefPtrField *ValidatedStringType `json:"validatedTypedefPtrField"`
+}
+
+type StringType string
+
+// +k8s:neq="disallowed-on-type"
+type ValidatedStringType string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqstring/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqstring/doc_test.go
new file mode 100644
index 0000000000..5c2578384d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqstring/doc_test.go
@@ -0,0 +1,67 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package neqstring
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		StringField:              "allowed-string",
+		StringPtrField:           ptr.To("allowed-pointer"),
+		StringTypedefField:       "allowed-typedef",
+		StringTypedefPtrField:    ptr.To(StringType("allowed-typedef-pointer")),
+		ValidatedTypedefField:    "allowed-on-type",
+		ValidatedTypedefPtrField: ptr.To(ValidatedStringType("allowed-on-type-ptr")),
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		StringField:              "allowed-string",
+		StringPtrField:           nil,
+		StringTypedefField:       "allowed-typedef",
+		StringTypedefPtrField:    nil,
+		ValidatedTypedefField:    "allowed-on-type",
+		ValidatedTypedefPtrField: nil,
+	}).ExpectValid()
+
+	invalid := &Struct{
+		StringField:              "disallowed-string",
+		StringPtrField:           ptr.To("disallowed-pointer"),
+		StringTypedefField:       "disallowed-typedef",
+		StringTypedefPtrField:    ptr.To(StringType("disallowed-typedef-pointer")),
+		ValidatedTypedefField:    "disallowed-on-type",
+		ValidatedTypedefPtrField: ptr.To(ValidatedStringType("disallowed-on-type")),
+	}
+
+	st.Value(invalid).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("stringField"), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("stringPtrField"), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("stringTypedefField"), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("stringTypedefPtrField"), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("validatedTypedefField"), nil, "").WithOrigin("neq"),
+		field.Invalid(field.NewPath("validatedTypedefPtrField"), nil, "").WithOrigin("neq"),
+	})
+
+	// Test validation ratcheting.
+	st.Value(invalid).OldValue(invalid).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqstring/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqstring/zz_generated.validations.go
new file mode 100644
index 0000000000..01f451a9c3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/neq/neqstring/zz_generated.validations.go
@@ -0,0 +1,220 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package neqstring
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.NEQ(ctx, op, fldPath, obj, oldObj, "disallowed-string"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.NEQ(ctx, op, fldPath, obj, oldObj, "disallowed-pointer"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.StringPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("stringPtrField"), obj.StringPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.NEQ(ctx, op, fldPath, obj, oldObj, "disallowed-typedef"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *StringType {
+				return &oldObj.StringTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("stringTypedefField"), &obj.StringTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.NEQ(ctx, op, fldPath, obj, oldObj, "disallowed-typedef-pointer"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *StringType {
+				return oldObj.StringTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("stringTypedefPtrField"), obj.StringTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ValidatedTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ValidatedStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ValidatedStringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *ValidatedStringType {
+				return &oldObj.ValidatedTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("validatedTypedefField"), &obj.ValidatedTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ValidatedTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ValidatedStringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ValidatedStringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *ValidatedStringType {
+				return oldObj.ValidatedTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("validatedTypedefPtrField"), obj.ValidatedTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ValidatedStringType validates an instance of ValidatedStringType according
+// to declarative validation rules in the API schema.
+func Validate_ValidatedStringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ValidatedStringType) (errs field.ErrorList) {
+
+	if e := validate.NEQ(ctx, op, fldPath, obj, oldObj, "disallowed-on-type"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque/doc.go
new file mode 100644
index 0000000000..33985040b5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque/doc.go
@@ -0,0 +1,188 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-targets
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package opaque
+
+import (
+	"k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field Struct.StructField"
+	StructField OtherStruct `json:"structField"`
+
+	// +k8s:validateFalse="field Struct.StructPtrField"
+	// +k8s:required
+	StructPtrField *OtherStruct `json:"structPtrField"`
+
+	// +k8s:validateFalse="field Struct.OpaqueStructField"
+	// +k8s:opaqueType
+	OpaqueStructField OtherStruct `json:"opaqueStructField"`
+
+	// +k8s:validateFalse="field Struct.OpaqueStructPtrField"
+	// +k8s:required
+	// +k8s:opaqueType
+	OpaqueStructPtrField *OtherStruct `json:"opaqueStructPtrField"`
+
+	// +k8s:validateFalse="field Struct.SliceOfStructField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.SliceOfStructField vals"
+	SliceOfStructField []OtherStruct `json:"sliceOfStructField"`
+
+	// +k8s:validateFalse="field Struct.SliceOfOpaqueStructField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.SliceOfOpaqueStructField vals"
+	// +k8s:eachVal=+k8s:opaqueType
+	SliceOfOpaqueStructField []OtherStruct `json:"sliceOfOpaqueStructField"`
+
+	// +k8s:validateFalse="field Struct.ListMapOfStructField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListMapOfStructField vals"
+	// +k8s:listType=map
+	// +k8s:listMapKey=stringField
+	ListMapOfStructField []OtherStruct `json:"listMapOfStructField"`
+
+	// +k8s:validateFalse="field Struct.ListMapOfOpaqueStructField"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.ListMapOfOpaqueStructField vals"
+	// +k8s:listType=map
+	// +k8s:listMapKey=stringField
+	// +k8s:eachVal=+k8s:opaqueType
+	ListMapOfOpaqueStructField []OtherStruct `json:"listMapOfOpaqueStructField"`
+
+	// +k8s:validateFalse="field Struct.MapOfStringToStructField"
+	// +k8s:eachKey=+k8s:validateFalse="field Struct.MapOfStringToStructField keys"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapOfStringToStructField vals"
+	MapOfStringToStructField map[OtherString]OtherStruct `json:"mapOfStringToStructField"`
+
+	// +k8s:validateFalse="field Struct.MapOfStringToOpaqueStructField"
+	// +k8s:eachKey=+k8s:validateFalse="field Struct.MapOfStringToOpaqueStructField keys"
+	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapOfStringToOpaqueStructField vals"
+	// +k8s:eachKey=+k8s:opaqueType
+	// +k8s:eachVal=+k8s:opaqueType
+	MapOfStringToOpaqueStructField map[OtherString]OtherStruct `json:"mapOfStringToOpaqueStructField"`
+}
+
+// +k8s:validateFalse="type OtherStruct"
+type OtherStruct struct {
+	// +k8s:validateFalse="field OtherStruct.StringField"
+	StringField string `json:"stringField"`
+}
+
+// OpaqueFieldsStruct contains fields with the opaque markers, contains no field validations.
+// Validations should not be generated for these fields.
+// +k8s:validateTrue="type OpaqueFieldsStruct"
+type OpaqueFieldsStruct struct {
+	// +k8s:opaqueType
+	OtherStruct
+
+	// +k8s:eachVal=+k8s:opaqueType
+	OpaqueSliceField []OtherStruct `json:"opaqueSliceField"`
+
+	// +k8s:eachKey=+k8s:opaqueType
+	// +k8s:eachVal=+k8s:opaqueType
+	OpaqueMapField map[OtherString]OtherStruct `json:"opaqueMapField"`
+
+	TypedefOpaqueStructField TypedefOpaqueStruct `json:"typedefOpaqueStructField"`
+
+	TypedefOpaqueSliceField TypedefOpaqueSlice `json:"typedefOpaqueSliceField"`
+
+	TypedefOpaqueMapField TypedefOpaqueMap `json:"typedefOpaqueMapField"`
+
+	// +k8s:opaqueType
+	IsolatedOpaqueStructField OtherStruct `json:"isolatedOpaqueStructField"`
+}
+
+// +k8s:validateFalse="type OtherString"
+type OtherString string
+
+// TODO: the validateFalse test fixture doesn't handle map and slice types, and
+// fixing it requires fixing randfill.  That is a tomorrow problem.  For now, the
+// following types have been tested to generate correct code with
+// +k8s:opaqueType.
+
+// +k8s:opaqueType
+type TypedefOpaqueStruct struct {
+	// +k8s:required
+	StringField string `json:"stringField"`
+}
+
+// +k8s:eachVal=+k8s:opaqueType
+type TypedefOpaqueSlice []OtherStruct
+
+// +k8s:eachKey=+k8s:opaqueType
+// +k8s:eachVal=+k8s:opaqueType
+type TypedefOpaqueMap map[OtherString]OtherStruct
+
+// +k8s:validateTrue="type TypedefSliceOther"
+// +k8s:eachVal=+k8s:opaqueType
+type TypedefSliceOther []OtherStruct
+
+// +k8s:validateTrue="type TypedefMapOther"
+// +k8s:eachKey=+k8s:opaqueType
+// +k8s:eachVal=+k8s:opaqueType
+type TypedefMapOther map[OtherString]OtherStruct
+
+type NoValidationStruct struct {
+	StringField string `json:"stringField"`
+}
+
+type NoValidationString string
+
+// OpaqueNoValidationFieldsStruct tests that when a type/key/val is opaque but the opaque type
+// does not have any validation, we correctly do not emit any validation calls.
+// +k8s:validateTrue="type OpaqueNoValidationFieldsStruct"
+type OpaqueNoValidationFieldsStruct struct {
+	// +k8s:opaqueType
+	NoValidationStruct
+
+	// +k8s:eachVal=+k8s:opaqueType
+	OpaqueSliceField []NoValidationStruct `json:"opaqueSliceField"`
+
+	// +k8s:eachKey=+k8s:opaqueType
+	// +k8s:eachVal=+k8s:opaqueType
+	OpaqueMapField map[NoValidationString]NoValidationStruct `json:"opaqueMapField"`
+
+	// +k8s:opaqueType
+	IsolatedOpaqueStructField NoValidationStruct `json:"isolatedOpaqueStructField"`
+}
+
+// +k8s:opaqueType
+// +k8s:validateFalse="type OpaqueStructWithValidation"
+type OpaqueStructWithValidation struct {
+	// +k8s:validateFalse="field OpaqueStructWithValidation.StringField"
+	StringField string `json:"stringField"`
+}
+
+type BaseStruct struct {
+	// +k8s:validateFalse="field BaseStruct.Field"
+	Field string `json:"field"`
+}
+
+// +k8s:opaqueType
+// +k8s:validateFalse="type OpaqueAliasWithValidation"
+type OpaqueAliasWithValidation BaseStruct
+
+type ParentWithOpaqueAliasWithValidation struct {
+	TypeMeta int                       `json:"typeMeta"`
+	Field    OpaqueAliasWithValidation `json:"field"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque/doc_test.go
new file mode 100644
index 0000000000..d41b5c926e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque/doc_test.go
@@ -0,0 +1,153 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package opaque
+
+import (
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		StructField:                    OtherStruct{},
+		StructPtrField:                 &OtherStruct{},
+		OpaqueStructField:              OtherStruct{},
+		OpaqueStructPtrField:           &OtherStruct{},
+		SliceOfStructField:             []OtherStruct{{}, {}},
+		SliceOfOpaqueStructField:       []OtherStruct{{}, {}},
+		ListMapOfStructField:           []OtherStruct{{"foo"}, {"bar"}},
+		ListMapOfOpaqueStructField:     []OtherStruct{{"foo"}, {"bar"}},
+		MapOfStringToStructField:       map[OtherString]OtherStruct{"a": {"foo"}, "b": {"bar"}},
+		MapOfStringToOpaqueStructField: map[OtherString]OtherStruct{"a": {"foo"}, "b": {"bar"}},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"structField":                         {"field Struct.StructField", "type OtherStruct"},
+		"structPtrField":                      {"field Struct.StructPtrField", "type OtherStruct"},
+		"structField.stringField":             {"field OtherStruct.StringField"},
+		"structPtrField.stringField":          {"field OtherStruct.StringField"},
+		"opaqueStructField":                   {"field Struct.OpaqueStructField"},
+		"opaqueStructPtrField":                {"field Struct.OpaqueStructPtrField"},
+		"sliceOfStructField":                  {"field Struct.SliceOfStructField"},
+		"sliceOfStructField[0]":               {"field Struct.SliceOfStructField vals", "type OtherStruct"},
+		"sliceOfStructField[0].stringField":   {"field OtherStruct.StringField"},
+		"sliceOfStructField[1]":               {"field Struct.SliceOfStructField vals", "type OtherStruct"},
+		"sliceOfStructField[1].stringField":   {"field OtherStruct.StringField"},
+		"sliceOfOpaqueStructField":            {"field Struct.SliceOfOpaqueStructField"},
+		"sliceOfOpaqueStructField[0]":         {"field Struct.SliceOfOpaqueStructField vals"},
+		"sliceOfOpaqueStructField[1]":         {"field Struct.SliceOfOpaqueStructField vals"},
+		"listMapOfStructField":                {"field Struct.ListMapOfStructField"},
+		"listMapOfStructField[0]":             {"field Struct.ListMapOfStructField vals", "type OtherStruct"},
+		"listMapOfStructField[0].stringField": {"field OtherStruct.StringField"},
+		"listMapOfStructField[1]":             {"field Struct.ListMapOfStructField vals", "type OtherStruct"},
+		"listMapOfStructField[1].stringField": {"field OtherStruct.StringField"},
+		"listMapOfOpaqueStructField":          {"field Struct.ListMapOfOpaqueStructField"},
+		"listMapOfOpaqueStructField[0]":       {"field Struct.ListMapOfOpaqueStructField vals"},
+		"listMapOfOpaqueStructField[1]":       {"field Struct.ListMapOfOpaqueStructField vals"},
+		"mapOfStringToStructField": {
+			"field Struct.MapOfStringToStructField",
+			"field Struct.MapOfStringToStructField keys",
+			"field Struct.MapOfStringToStructField keys",
+			"type OtherString",
+			"type OtherString",
+		},
+		"mapOfStringToStructField[a]":             {"field Struct.MapOfStringToStructField vals", "type OtherStruct"},
+		"mapOfStringToStructField[a].stringField": {"field OtherStruct.StringField"},
+		"mapOfStringToStructField[b]":             {"field Struct.MapOfStringToStructField vals", "type OtherStruct"},
+		"mapOfStringToStructField[b].stringField": {"field OtherStruct.StringField"},
+		"mapOfStringToOpaqueStructField": {
+			"field Struct.MapOfStringToOpaqueStructField",
+			"field Struct.MapOfStringToOpaqueStructField keys",
+			"field Struct.MapOfStringToOpaqueStructField keys",
+		},
+		"mapOfStringToOpaqueStructField[a]": {"field Struct.MapOfStringToOpaqueStructField vals"},
+		"mapOfStringToOpaqueStructField[b]": {"field Struct.MapOfStringToOpaqueStructField vals"},
+	})
+
+	st.Value(&Struct{
+		ListMapOfStructField:       []OtherStruct{{"foo"}, {"foo"}},
+		ListMapOfOpaqueStructField: []OtherStruct{{"foo"}, {"foo"}},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"structField":                         {"field Struct.StructField", "type OtherStruct"},
+		"structField.stringField":             {"field OtherStruct.StringField"},
+		"opaqueStructField":                   {"field Struct.OpaqueStructField"},
+		"listMapOfStructField":                {"field Struct.ListMapOfStructField"},
+		"listMapOfStructField[0]":             {"field Struct.ListMapOfStructField vals", "type OtherStruct"},
+		"listMapOfStructField[0].stringField": {"field OtherStruct.StringField"},
+		"listMapOfStructField[1]":             {"field Struct.ListMapOfStructField vals", "type OtherStruct"},
+		"listMapOfStructField[1].stringField": {"field OtherStruct.StringField"},
+		"listMapOfOpaqueStructField":          {"field Struct.ListMapOfOpaqueStructField"},
+		"listMapOfOpaqueStructField[0]":       {"field Struct.ListMapOfOpaqueStructField vals"},
+		"listMapOfOpaqueStructField[1]":       {"field Struct.ListMapOfOpaqueStructField vals"},
+		"mapOfStringToOpaqueStructField":      {"field Struct.MapOfStringToOpaqueStructField"},
+		"mapOfStringToStructField":            {"field Struct.MapOfStringToStructField"},
+		"sliceOfOpaqueStructField":            {"field Struct.SliceOfOpaqueStructField"},
+		"sliceOfStructField":                  {"field Struct.SliceOfStructField"},
+	})
+
+	str := OtherString("foo")
+	st.Value(&str).ExpectValidateFalseByPath(map[string][]string{
+		"": {"type OtherString"},
+	})
+
+	st.Value(&OtherStruct{}).ExpectValidateFalseByPath(map[string][]string{
+		"":            {"type OtherStruct"},
+		"stringField": {"field OtherStruct.StringField"},
+	})
+
+	st.Value(&OpaqueFieldsStruct{
+		OtherStruct:               OtherStruct{"foo"},
+		OpaqueSliceField:          []OtherStruct{{"foo"}},
+		OpaqueMapField:            map[OtherString]OtherStruct{"a": {"foo"}},
+		TypedefOpaqueStructField:  TypedefOpaqueStruct{"foo"},
+		TypedefOpaqueSliceField:   []OtherStruct{{"foo"}},
+		TypedefOpaqueMapField:     map[OtherString]OtherStruct{"a": {"foo"}},
+		IsolatedOpaqueStructField: OtherStruct{"foo"},
+	}).ExpectValid()
+
+	st.Value(&OpaqueNoValidationFieldsStruct{
+		NoValidationStruct:        NoValidationStruct{"foo"},
+		OpaqueSliceField:          []NoValidationStruct{{"foo"}},
+		OpaqueMapField:            map[NoValidationString]NoValidationStruct{"a": {"foo"}},
+		IsolatedOpaqueStructField: NoValidationStruct{"foo"},
+	}).ExpectValid()
+
+	st.Value(&OpaqueStructWithValidation{
+		StringField: "foo",
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"": {"type OpaqueStructWithValidation"},
+	})
+
+	st.Value(&ParentWithOpaqueAliasWithValidation{
+		Field: OpaqueAliasWithValidation{
+			Field: "foo",
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"field": {"type OpaqueAliasWithValidation"},
+	})
+
+	st.Value(&OpaqueAliasWithValidation{
+		Field: "foo",
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"": {"type OpaqueAliasWithValidation"},
+	})
+
+	st.Value(&BaseStruct{
+		Field: "foo",
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"field": {"field BaseStruct.Field"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque/zz_generated.validations.go
new file mode 100644
index 0000000000..162e3adeb8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque/zz_generated.validations.go
@@ -0,0 +1,760 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package opaque
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type BaseStruct
+	scheme.AddValidationFunc(
+		(*BaseStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_BaseStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*BaseStruct),
+					safe.Cast[*BaseStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type OpaqueAliasWithValidation
+	scheme.AddValidationFunc(
+		(*OpaqueAliasWithValidation)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_OpaqueAliasWithValidation(
+					ctx, op, nil, /* fldPath */
+					obj.(*OpaqueAliasWithValidation),
+					safe.Cast[*OpaqueAliasWithValidation](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type OpaqueFieldsStruct
+	scheme.AddValidationFunc(
+		(*OpaqueFieldsStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_OpaqueFieldsStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*OpaqueFieldsStruct),
+					safe.Cast[*OpaqueFieldsStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type OpaqueNoValidationFieldsStruct
+	scheme.AddValidationFunc(
+		(*OpaqueNoValidationFieldsStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_OpaqueNoValidationFieldsStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*OpaqueNoValidationFieldsStruct),
+					safe.Cast[*OpaqueNoValidationFieldsStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type OpaqueStructWithValidation
+	scheme.AddValidationFunc(
+		(*OpaqueStructWithValidation)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_OpaqueStructWithValidation(
+					ctx, op, nil, /* fldPath */
+					obj.(*OpaqueStructWithValidation),
+					safe.Cast[*OpaqueStructWithValidation](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type OtherString
+	scheme.AddValidationFunc(
+		(*OtherString)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_OtherString(
+					ctx, op, nil, /* fldPath */
+					obj.(*OtherString),
+					safe.Cast[*OtherString](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type OtherStruct
+	scheme.AddValidationFunc(
+		(*OtherStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_OtherStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*OtherStruct),
+					safe.Cast[*OtherStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithOpaqueAliasWithValidation
+	scheme.AddValidationFunc(
+		(*ParentWithOpaqueAliasWithValidation)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithOpaqueAliasWithValidation(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithOpaqueAliasWithValidation),
+					safe.Cast[*ParentWithOpaqueAliasWithValidation](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type TypedefMapOther
+	scheme.AddValidationFunc(
+		(TypedefMapOther)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_TypedefMapOther(
+					ctx, op, nil, /* fldPath */
+					obj.(TypedefMapOther),
+					safe.Cast[TypedefMapOther](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type TypedefSliceOther
+	scheme.AddValidationFunc(
+		(TypedefSliceOther)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_TypedefSliceOther(
+					ctx, op, nil, /* fldPath */
+					obj.(TypedefSliceOther),
+					safe.Cast[TypedefSliceOther](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_BaseStruct validates an instance of BaseStruct according
+// to declarative validation rules in the API schema.
+func Validate_BaseStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *BaseStruct) (errs field.ErrorList) {
+
+	{ // field BaseStruct.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field BaseStruct.Field"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *BaseStruct) *string {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_OpaqueAliasWithValidation validates an instance of OpaqueAliasWithValidation according
+// to declarative validation rules in the API schema.
+func Validate_OpaqueAliasWithValidation(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OpaqueAliasWithValidation) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type OpaqueAliasWithValidation"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_OpaqueFieldsStruct validates an instance of OpaqueFieldsStruct according
+// to declarative validation rules in the API schema.
+func Validate_OpaqueFieldsStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OpaqueFieldsStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "type OpaqueFieldsStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field OpaqueFieldsStruct.OtherStruct has no validation
+	// field OpaqueFieldsStruct.OpaqueSliceField has no validation
+	// field OpaqueFieldsStruct.OpaqueMapField has no validation
+	// field OpaqueFieldsStruct.TypedefOpaqueStructField has no validation
+	// field OpaqueFieldsStruct.TypedefOpaqueSliceField has no validation
+	// field OpaqueFieldsStruct.TypedefOpaqueMapField has no validation
+	// field OpaqueFieldsStruct.IsolatedOpaqueStructField has no validation
+	return errs
+}
+
+// Validate_OpaqueNoValidationFieldsStruct validates an instance of OpaqueNoValidationFieldsStruct according
+// to declarative validation rules in the API schema.
+func Validate_OpaqueNoValidationFieldsStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OpaqueNoValidationFieldsStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "type OpaqueNoValidationFieldsStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field OpaqueNoValidationFieldsStruct.NoValidationStruct has no validation
+	// field OpaqueNoValidationFieldsStruct.OpaqueSliceField has no validation
+	// field OpaqueNoValidationFieldsStruct.OpaqueMapField has no validation
+	// field OpaqueNoValidationFieldsStruct.IsolatedOpaqueStructField has no validation
+	return errs
+}
+
+// Validate_OpaqueStructWithValidation validates an instance of OpaqueStructWithValidation according
+// to declarative validation rules in the API schema.
+func Validate_OpaqueStructWithValidation(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OpaqueStructWithValidation) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type OpaqueStructWithValidation"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_OtherString validates an instance of OtherString according
+// to declarative validation rules in the API schema.
+func Validate_OtherString(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OtherString) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type OtherString"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_OtherStruct validates an instance of OtherStruct according
+// to declarative validation rules in the API schema.
+func Validate_OtherStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OtherStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type OtherStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field OtherStruct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field OtherStruct.StringField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *OtherStruct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithOpaqueAliasWithValidation validates an instance of ParentWithOpaqueAliasWithValidation according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithOpaqueAliasWithValidation(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithOpaqueAliasWithValidation) (errs field.ErrorList) {
+
+	// field ParentWithOpaqueAliasWithValidation.TypeMeta has no validation
+
+	{ // field ParentWithOpaqueAliasWithValidation.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *OpaqueAliasWithValidation,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_OpaqueAliasWithValidation(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithOpaqueAliasWithValidation) *OpaqueAliasWithValidation {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.StructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.StructField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_OtherStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *OtherStruct {
+				return &oldObj.StructField
+			})
+		errs = append(errs, fn(fldPath.Child("structField"), &obj.StructField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StructPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.StructPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_OtherStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *OtherStruct {
+				return oldObj.StructPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("structPtrField"), obj.StructPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.OpaqueStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.OpaqueStructField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *OtherStruct {
+				return &oldObj.OpaqueStructField
+			})
+		errs = append(errs, fn(fldPath.Child("opaqueStructField"), &obj.OpaqueStructField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.OpaqueStructPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.OpaqueStructPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *OtherStruct {
+				return oldObj.OpaqueStructPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("opaqueStructPtrField"), obj.OpaqueStructPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceOfStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.SliceOfStructField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.SliceOfStructField vals")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_OtherStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherStruct {
+				return oldObj.SliceOfStructField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceOfStructField"), obj.SliceOfStructField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceOfOpaqueStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.SliceOfOpaqueStructField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.SliceOfOpaqueStructField vals")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherStruct {
+				return oldObj.SliceOfOpaqueStructField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceOfOpaqueStructField"), obj.SliceOfOpaqueStructField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListMapOfStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListMapOfStructField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherStruct, b *OtherStruct) bool { return a.StringField == b.StringField }, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListMapOfStructField vals")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherStruct, b *OtherStruct) bool { return a.StringField == b.StringField }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherStruct, b *OtherStruct) bool { return a.StringField == b.StringField }, validate.DirectEqual, Validate_OtherStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherStruct {
+				return oldObj.ListMapOfStructField
+			})
+		errs = append(errs, fn(fldPath.Child("listMapOfStructField"), obj.ListMapOfStructField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListMapOfOpaqueStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListMapOfOpaqueStructField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherStruct, b *OtherStruct) bool { return a.StringField == b.StringField }, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListMapOfOpaqueStructField vals")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *OtherStruct, b *OtherStruct) bool { return a.StringField == b.StringField }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []OtherStruct {
+				return oldObj.ListMapOfOpaqueStructField
+			})
+		errs = append(errs, fn(fldPath.Child("listMapOfOpaqueStructField"), obj.ListMapOfOpaqueStructField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapOfStringToStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[OtherString]OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherString) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapOfStringToStructField keys")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapOfStringToStructField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapOfStringToStructField vals")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the key type's validation function
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj, Validate_OtherString); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_OtherStruct); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[OtherString]OtherStruct {
+				return oldObj.MapOfStringToStructField
+			})
+		errs = append(errs, fn(fldPath.Child("mapOfStringToStructField"), obj.MapOfStringToStructField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapOfStringToOpaqueStructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[OtherString]OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherString) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapOfStringToOpaqueStructField keys")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapOfStringToOpaqueStructField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapOfStringToOpaqueStructField vals")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[OtherString]OtherStruct {
+				return oldObj.MapOfStringToOpaqueStructField
+			})
+		errs = append(errs, fn(fldPath.Child("mapOfStringToOpaqueStructField"), obj.MapOfStringToOpaqueStructField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_TypedefMapOther validates an instance of TypedefMapOther according
+// to declarative validation rules in the API schema.
+func Validate_TypedefMapOther(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj TypedefMapOther) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "type TypedefMapOther"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_TypedefSliceOther validates an instance of TypedefSliceOther according
+// to declarative validation rules in the API schema.
+func Validate_TypedefSliceOther(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj TypedefSliceOther) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "type TypedefSliceOther"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque/zz_generated.validations_coverage_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque/zz_generated.validations_coverage_test.go
new file mode 100644
index 0000000000..a4ec923029
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque/zz_generated.validations_coverage_test.go
@@ -0,0 +1,194 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package opaque
+
+import (
+	fmt "fmt"
+	os "os"
+	testing "testing"
+
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	coverage "k8s.io/apimachinery/pkg/test/coverage"
+)
+
+func init() {
+	coverage.RegisterDeclaredRules(
+		schema.GroupVersionKind{Group: "k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque", Version: "opaque", Kind: "BaseStruct"},
+		coverage.FieldRules{
+			"field": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+		},
+	)
+}
+
+func init() {
+	coverage.RegisterDeclaredRules(
+		schema.GroupVersionKind{Group: "k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque", Version: "opaque", Kind: "OpaqueAliasWithValidation"},
+		coverage.FieldRules{
+			"": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+		},
+	)
+}
+
+func init() {
+	coverage.RegisterDeclaredRules(
+		schema.GroupVersionKind{Group: "k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque", Version: "opaque", Kind: "OpaqueStructWithValidation"},
+		coverage.FieldRules{
+			"": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+		},
+	)
+}
+
+func init() {
+	coverage.RegisterDeclaredRules(
+		schema.GroupVersionKind{Group: "k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque", Version: "opaque", Kind: "OtherString"},
+		coverage.FieldRules{
+			"": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+		},
+	)
+}
+
+func init() {
+	coverage.RegisterDeclaredRules(
+		schema.GroupVersionKind{Group: "k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque", Version: "opaque", Kind: "OtherStruct"},
+		coverage.FieldRules{
+			"": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"stringField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+		},
+	)
+}
+
+func init() {
+	coverage.RegisterDeclaredRules(
+		schema.GroupVersionKind{Group: "k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque", Version: "opaque", Kind: "ParentWithOpaqueAliasWithValidation"},
+		coverage.FieldRules{
+			"field": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+		},
+	)
+}
+
+func init() {
+	coverage.RegisterDeclaredRules(
+		schema.GroupVersionKind{Group: "k8s.io/code-generator/cmd/validation-gen/output_tests/tags/opaque", Version: "opaque", Kind: "Struct"},
+		coverage.FieldRules{
+			"listMapOfOpaqueStructField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"listMapOfOpaqueStructField[*]": {
+				{ErrorType: "FieldValueDuplicate"},
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"listMapOfStructField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"listMapOfStructField[*]": {
+				{ErrorType: "FieldValueDuplicate"},
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"listMapOfStructField[*].stringField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"mapOfStringToOpaqueStructField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"mapOfStringToOpaqueStructField[*]": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"mapOfStringToStructField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"mapOfStringToStructField[*]": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"mapOfStringToStructField[*].stringField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"opaqueStructField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"opaqueStructPtrField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+				{ErrorType: "FieldValueRequired"},
+			},
+			"sliceOfOpaqueStructField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"sliceOfOpaqueStructField[*]": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"sliceOfStructField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"sliceOfStructField[*]": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"sliceOfStructField[*].stringField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"structField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"structField.stringField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+			"structPtrField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+				{ErrorType: "FieldValueRequired"},
+			},
+			"structPtrField.stringField": {
+				{ErrorType: "FieldValueInvalid", Origin: "validateFalse"},
+			},
+		},
+	)
+}
+
+func TestMain(m *testing.M) {
+	code := m.Run()
+	if err := coverage.AssertDeclarativeCoverage(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		if code == 0 {
+			code = 1
+		}
+	}
+	os.Exit(code)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/doc.go
new file mode 100644
index 0000000000..e39eb11102
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/doc.go
@@ -0,0 +1,99 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package optional
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:optional
+	// +k8s:validateFalse="field Struct.StringField"
+	StringField string `json:"stringField"`
+
+	// +k8s:optional
+	// +k8s:validateFalse="field Struct.StringPtrField"
+	StringPtrField *string `json:"stringPtrField"`
+
+	// +k8s:optional
+	// +k8s:validateFalse="field Struct.StringTypedefField"
+	StringTypedefField StringType `json:"stringTypedefField"`
+
+	// +k8s:optional
+	// +k8s:validateFalse="field Struct.StringTypedefPtrField"
+	StringTypedefPtrField *StringType `json:"stringTypedefPtrField"`
+
+	// +k8s:optional
+	// +k8s:validateFalse="field Struct.IntField"
+	IntField int `json:"intField"`
+
+	// +k8s:optional
+	// +k8s:validateFalse="field Struct.IntPtrField"
+	IntPtrField *int `json:"intPtrField"`
+
+	// +k8s:optional
+	// +k8s:validateFalse="field Struct.IntTypedefField"
+	IntTypedefField IntType `json:"intTypedefField"`
+
+	// +k8s:optional
+	// +k8s:validateFalse="field Struct.IntTypedefPtrField"
+	IntTypedefPtrField *IntType `json:"intTypedefPtrField"`
+
+	// non-pointer struct fields cannot be optional
+
+	// +k8s:optional
+	// +k8s:validateFalse="field Struct.OtherStructPtrField"
+	OtherStructPtrField *OtherStruct `json:"otherStructPtrField"`
+
+	// +k8s:optional
+	// +k8s:validateFalse="field Struct.SliceField"
+	SliceField []string `json:"sliceField"`
+
+	// +k8s:optional
+	// +k8s:validateFalse="field Struct.SliceTypedefField"
+	SliceTypedefField SliceType `json:"sliceTypedefField"`
+
+	// +k8s:optional
+	// +k8s:validateFalse="field Struct.MapField"
+	MapField map[string]string `json:"mapField"`
+
+	// +k8s:optional
+	// +k8s:validateFalse="field Struct.MapTypedefField"
+	MapTypedefField MapType `json:"mapTypedefField"`
+}
+
+// +k8s:validateFalse="type StringType"
+type StringType string
+
+// +k8s:validateFalse="type IntType"
+type IntType int
+
+// +k8s:validateFalse="type OtherStruct"
+type OtherStruct struct{}
+
+// +k8s:validateFalse="type SliceType"
+type SliceType []string
+
+// +k8s:validateFalse="type MapType"
+type MapType map[string]string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/doc_test.go
new file mode 100644
index 0000000000..a3dc93ae5a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/doc_test.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package optional
+
+import (
+	"testing"
+
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero-values.
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		StringField:           "abc",
+		StringPtrField:        ptr.To("xyz"),
+		StringTypedefField:    StringType("abc"),
+		StringTypedefPtrField: ptr.To(StringType("xyz")),
+		IntField:              123,
+		IntPtrField:           ptr.To(456),
+		IntTypedefField:       IntType(123),
+		IntTypedefPtrField:    ptr.To(IntType(456)),
+		OtherStructPtrField:   &OtherStruct{},
+		SliceField:            []string{"a", "b"},
+		SliceTypedefField:     SliceType([]string{"a", "b"}),
+		MapField:              map[string]string{"a": "b", "c": "d"},
+		MapTypedefField:       MapType(map[string]string{"a": "b", "c": "d"}),
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"stringField":           {"field Struct.StringField"},
+		"stringPtrField":        {"field Struct.StringPtrField"},
+		"stringTypedefField":    {"field Struct.StringTypedefField", "type StringType"},
+		"stringTypedefPtrField": {"field Struct.StringTypedefPtrField", "type StringType"},
+		"intField":              {"field Struct.IntField"},
+		"intPtrField":           {"field Struct.IntPtrField"},
+		"intTypedefField":       {"field Struct.IntTypedefField", "type IntType"},
+		"intTypedefPtrField":    {"field Struct.IntTypedefPtrField", "type IntType"},
+		"otherStructPtrField":   {"type OtherStruct", "field Struct.OtherStructPtrField"},
+		"sliceField":            {"field Struct.SliceField"},
+		"sliceTypedefField":     {"field Struct.SliceTypedefField", "type SliceType"},
+		"mapField":              {"field Struct.MapField"},
+		"mapTypedefField":       {"field Struct.MapTypedefField", "type MapType"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/nonzero_defaults/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/nonzero_defaults/doc.go
new file mode 100644
index 0000000000..9539eddbf8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/nonzero_defaults/doc.go
@@ -0,0 +1,70 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package nonzerodefaults
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:optional
+	// +default="foobar"
+	StringField string `json:"stringField"`
+
+	// +k8s:optional
+	// +default="foobar"
+	StringPtrField *string `json:"stringPtrField"`
+
+	// +k8s:optional
+	// +default=123
+	IntField int `json:"intField"`
+
+	// +k8s:optional
+	// +default=123
+	IntPtrField *int `json:"intPtrField"`
+
+	// +k8s:optional
+	// +default=true
+	BoolField bool `json:"boolField"`
+
+	// +k8s:optional
+	// +default=true
+	BoolPtrField *bool `json:"boolPtrField"`
+
+	// +k8s:optional
+	// +default={"name": "x"}
+	StructPtrField *Submarker `json:"structPtrField"`
+
+	// +k8s:optional
+	// +default=["foo"]
+	SliceField []string `json:"sliceField"`
+
+	// +k8s:optional
+	// +default={"k": "v"}
+	MapField map[string]string `json:"mapField"`
+}
+
+type Submarker struct {
+	Name string `json:"name"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/nonzero_defaults/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/nonzero_defaults/doc_test.go
new file mode 100644
index 0000000000..7de239fa3a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/nonzero_defaults/doc_test.go
@@ -0,0 +1,54 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package nonzerodefaults
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero-values.
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Required(field.NewPath("stringField"), ""),
+		field.Required(field.NewPath("stringPtrField"), ""),
+		field.Required(field.NewPath("intField"), ""),
+		field.Required(field.NewPath("intPtrField"), ""),
+		field.Required(field.NewPath("boolField"), ""),
+		field.Required(field.NewPath("boolPtrField"), ""),
+		field.Required(field.NewPath("structPtrField"), ""),
+		field.Required(field.NewPath("sliceField"), ""),
+		field.Required(field.NewPath("mapField"), ""),
+	})
+
+	st.Value(&Struct{
+		StringField:    "abc",
+		StringPtrField: ptr.To(""),
+		IntField:       123,
+		IntPtrField:    ptr.To(0),
+		BoolField:      true,
+		BoolPtrField:   ptr.To(false),
+		StructPtrField: &Submarker{Name: "x"},
+		SliceField:     []string{"foo"},
+		MapField:       map[string]string{"k": "v"},
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/nonzero_defaults/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/nonzero_defaults/zz_generated.validations.go
new file mode 100644
index 0000000000..6527dd65cf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/nonzero_defaults/zz_generated.validations.go
@@ -0,0 +1,338 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package nonzerodefaults
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			// optional fields with default values are effectively required
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			// optional fields with default values are effectively required
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.StringPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("stringPtrField"), obj.StringPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			// optional fields with default values are effectively required
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return &oldObj.IntField
+			})
+		errs = append(errs, fn(fldPath.Child("intField"), &obj.IntField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			// optional fields with default values are effectively required
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return oldObj.IntPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("intPtrField"), obj.IntPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.BoolField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			// optional fields with default values are effectively required
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *bool {
+				return &oldObj.BoolField
+			})
+		errs = append(errs, fn(fldPath.Child("boolField"), &obj.BoolField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.BoolPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			// optional fields with default values are effectively required
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *bool {
+				return oldObj.BoolPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("boolPtrField"), obj.BoolPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StructPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Submarker,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			// optional fields with default values are effectively required
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Submarker {
+				return oldObj.StructPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("structPtrField"), obj.StructPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			// optional fields with default values are effectively required
+			if e := validate.RequiredSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.SliceField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceField"), obj.SliceField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			// optional fields with default values are effectively required
+			if e := validate.RequiredMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/zero_defaults/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/zero_defaults/doc.go
new file mode 100644
index 0000000000..abe128c914
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/zero_defaults/doc.go
@@ -0,0 +1,54 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package zerodefaults
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:optional
+	// +default=""
+	StringField string `json:"stringField"`
+
+	// +k8s:optional
+	// +default=""
+	StringPtrField *string `json:"stringPtrField"`
+
+	// +k8s:optional
+	// +default=0
+	IntField int `json:"intField"`
+
+	// +k8s:optional
+	// +default=0
+	IntPtrField *int `json:"intPtrField"`
+
+	// +k8s:optional
+	// +default=false
+	BoolField bool `json:"boolField"`
+
+	// +k8s:optional
+	// +default=false
+	BoolPtrField *bool `json:"boolPtrField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/zero_defaults/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/zero_defaults/doc_test.go
new file mode 100644
index 0000000000..886b0829e5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/zero_defaults/doc_test.go
@@ -0,0 +1,48 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package zerodefaults
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero-values.
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		// "stringField": optional value fields with zero defaults are just docs
+		// "intField": optional value fields with zero defaults are just docs
+		// "boolField": optional value fields with zero defaults are just docs
+		field.Required(field.NewPath("stringPtrField"), ""),
+		field.Required(field.NewPath("intPtrField"), ""),
+		field.Required(field.NewPath("boolPtrField"), ""),
+	})
+
+	st.Value(&Struct{
+		StringField:    "abc",
+		StringPtrField: ptr.To(""),
+		IntField:       123,
+		IntPtrField:    ptr.To(0),
+		BoolField:      true,
+		BoolPtrField:   ptr.To(false),
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/zero_defaults/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/zero_defaults/zz_generated.validations.go
new file mode 100644
index 0000000000..49514344b3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/zero_defaults/zz_generated.validations.go
@@ -0,0 +1,202 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package zerodefaults
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// optional value-type fields with zero-value defaults are purely documentation
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			// optional fields with default values are effectively required
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.StringPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("stringPtrField"), obj.StringPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// optional value-type fields with zero-value defaults are purely documentation
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return &oldObj.IntField
+			})
+		errs = append(errs, fn(fldPath.Child("intField"), &obj.IntField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			// optional fields with default values are effectively required
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return oldObj.IntPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("intPtrField"), obj.IntPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.BoolField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// optional value-type fields with zero-value defaults are purely documentation
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *bool {
+				return &oldObj.BoolField
+			})
+		errs = append(errs, fn(fldPath.Child("boolField"), &obj.BoolField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.BoolPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			// optional fields with default values are effectively required
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *bool {
+				return oldObj.BoolPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("boolPtrField"), obj.BoolPtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/zz_generated.validations.go
new file mode 100644
index 0000000000..6fad6d85d9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/optional/zz_generated.validations.go
@@ -0,0 +1,550 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package optional
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_IntType validates an instance of IntType according
+// to declarative validation rules in the API schema.
+func Validate_IntType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *IntType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type IntType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_MapType validates an instance of MapType according
+// to declarative validation rules in the API schema.
+func Validate_MapType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj MapType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_OtherStruct validates an instance of OtherStruct according
+// to declarative validation rules in the API schema.
+func Validate_OtherStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OtherStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type OtherStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_SliceType validates an instance of SliceType according
+// to declarative validation rules in the API schema.
+func Validate_SliceType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj SliceType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type SliceType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_StringType validates an instance of StringType according
+// to declarative validation rules in the API schema.
+func Validate_StringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StringType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type StringType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.StringField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.StringPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.StringPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("stringPtrField"), obj.StringPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.StringTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_StringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *StringType {
+				return &oldObj.StringTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("stringTypedefField"), &obj.StringTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.StringTypedefPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_StringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *StringType {
+				return oldObj.StringTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("stringTypedefPtrField"), obj.StringTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.IntField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return &oldObj.IntField
+			})
+		errs = append(errs, fn(fldPath.Child("intField"), &obj.IntField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.IntPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return oldObj.IntPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("intPtrField"), obj.IntPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.IntTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_IntType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *IntType {
+				return &oldObj.IntTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("intTypedefField"), &obj.IntTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.IntTypedefPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_IntType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *IntType {
+				return oldObj.IntTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("intTypedefPtrField"), obj.IntTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.OtherStructPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.OtherStructPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_OtherStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *OtherStruct {
+				return oldObj.OtherStructPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("otherStructPtrField"), obj.OtherStructPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.SliceField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.SliceField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceField"), obj.SliceField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj SliceType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.SliceTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_SliceType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) SliceType {
+				return oldObj.SliceTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceTypedefField"), obj.SliceTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj MapType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_MapType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) MapType {
+				return oldObj.MapTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapTypedefField"), obj.MapTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/discriminators/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/discriminators/doc.go
new file mode 100644
index 0000000000..e7a5fba6f8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/discriminators/doc.go
@@ -0,0 +1,55 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package discriminators
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	DiscriminatorField         Discriminator         `json:"discriminatorField"`
+	DiscriminatorFieldDisabled DiscriminatorDisabled `json:"discriminatorFieldDisabled"`
+}
+
+type Discriminator struct {
+	// +k8s:ifEnabled(FeatureZ)=+k8s:modeDiscriminator
+	Discriminator string `json:"discriminator"`
+
+	// +k8s:ifEnabled(FeatureZ)=+k8s:ifMode("A")=+k8s:optional
+	FieldA *string `json:"fieldA"`
+
+	// +k8s:ifEnabled(FeatureZ)=+k8s:ifMode("B")=+k8s:optional
+	FieldB *string `json:"fieldB"`
+}
+
+type DiscriminatorDisabled struct {
+	// +k8s:ifDisabled(FeatureZ)=+k8s:modeDiscriminator
+	Discriminator string `json:"discriminator"`
+
+	// +k8s:ifDisabled(FeatureZ)=+k8s:ifMode("A")=+k8s:optional
+	FieldA *string `json:"fieldA"`
+
+	// +k8s:ifDisabled(FeatureZ)=+k8s:ifMode("B")=+k8s:optional
+	FieldB *string `json:"fieldB"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/discriminators/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/discriminators/doc_test.go
new file mode 100644
index 0000000000..d8aa582f5a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/discriminators/doc_test.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package discriminators
+
+import (
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values
+	}).Opts(map[string]bool{"FeatureZ": false}).ExpectValid()
+
+	st.Value(&Struct{
+		DiscriminatorField: Discriminator{
+			Discriminator: "A",
+			FieldB:        ptr.To("invalid"), // invalid because discriminator is A
+		},
+		DiscriminatorFieldDisabled: DiscriminatorDisabled{
+			Discriminator: "A",
+			FieldB:        ptr.To("invalid"), // invalid because discriminator is A
+		},
+	}).Opts(map[string]bool{"FeatureZ": false}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{field.Forbidden(field.NewPath("discriminatorFieldDisabled", "fieldB"), "").WithOrigin("")},
+	)
+
+	st.Value(&Struct{
+		DiscriminatorField: Discriminator{
+			Discriminator: "A",
+			FieldB:        ptr.To("invalid"), // invalid because discriminator is A
+		},
+		DiscriminatorFieldDisabled: DiscriminatorDisabled{
+			Discriminator: "A",
+			FieldB:        ptr.To("invalid"), // invalid because discriminator is A
+		},
+	}).Opts(map[string]bool{"FeatureZ": true}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{field.Forbidden(field.NewPath("discriminatorField", "fieldB"), "").WithOrigin("")},
+	)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/discriminators/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/discriminators/zz_generated.validations.go
new file mode 100644
index 0000000000..cf5f92e7ba
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/discriminators/zz_generated.validations.go
@@ -0,0 +1,258 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package discriminators
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Discriminator validates an instance of Discriminator according
+// to declarative validation rules in the API schema.
+func Validate_Discriminator(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Discriminator) (errs field.ErrorList) {
+
+	if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureZ", true,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *Discriminator) field.ErrorList {
+			return validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldA",
+				func(obj *Discriminator) *string { return obj.FieldA },
+				func(obj *Discriminator) string { return obj.Discriminator }, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj)...)
+					return errs
+				},
+				[]validate.DiscriminatedRule[*string, string]{
+
+					{
+						Value: "A",
+						Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+							errs := field.ErrorList{}
+							earlyReturn := false
+							if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+								earlyReturn = true
+							}
+							if earlyReturn {
+								return errs
+							}
+							return errs
+						},
+					},
+				})
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureZ", true,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *Discriminator) field.ErrorList {
+			return validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldB",
+				func(obj *Discriminator) *string { return obj.FieldB },
+				func(obj *Discriminator) string { return obj.Discriminator }, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj)...)
+					return errs
+				},
+				[]validate.DiscriminatedRule[*string, string]{
+
+					{
+						Value: "B",
+						Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+							errs := field.ErrorList{}
+							earlyReturn := false
+							if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+								earlyReturn = true
+							}
+							if earlyReturn {
+								return errs
+							}
+							return errs
+						},
+					},
+				})
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Discriminator.Discriminator has no validation
+	// field Discriminator.FieldA has no validation
+	// field Discriminator.FieldB has no validation
+	return errs
+}
+
+// Validate_DiscriminatorDisabled validates an instance of DiscriminatorDisabled according
+// to declarative validation rules in the API schema.
+func Validate_DiscriminatorDisabled(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DiscriminatorDisabled) (errs field.ErrorList) {
+
+	if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureZ", false,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *DiscriminatorDisabled) field.ErrorList {
+			return validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldA",
+				func(obj *DiscriminatorDisabled) *string { return obj.FieldA },
+				func(obj *DiscriminatorDisabled) string { return obj.Discriminator }, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj)...)
+					return errs
+				},
+				[]validate.DiscriminatedRule[*string, string]{
+
+					{
+						Value: "A",
+						Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+							errs := field.ErrorList{}
+							earlyReturn := false
+							if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+								earlyReturn = true
+							}
+							if earlyReturn {
+								return errs
+							}
+							return errs
+						},
+					},
+				})
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureZ", false,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *DiscriminatorDisabled) field.ErrorList {
+			return validate.Discriminated(ctx, op, fldPath, obj, oldObj, "fieldB",
+				func(obj *DiscriminatorDisabled) *string { return obj.FieldB },
+				func(obj *DiscriminatorDisabled) string { return obj.Discriminator }, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					errs := field.ErrorList{}
+					errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj)...)
+					return errs
+				},
+				[]validate.DiscriminatedRule[*string, string]{
+
+					{
+						Value: "B",
+						Validation: func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+							errs := field.ErrorList{}
+							earlyReturn := false
+							if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+								earlyReturn = true
+							}
+							if earlyReturn {
+								return errs
+							}
+							return errs
+						},
+					},
+				})
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field DiscriminatorDisabled.Discriminator has no validation
+	// field DiscriminatorDisabled.FieldA has no validation
+	// field DiscriminatorDisabled.FieldB has no validation
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.DiscriminatorField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Discriminator,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Discriminator(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Discriminator {
+				return &oldObj.DiscriminatorField
+			})
+		errs = append(errs, fn(fldPath.Child("discriminatorField"), &obj.DiscriminatorField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.DiscriminatorFieldDisabled
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DiscriminatorDisabled,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DiscriminatorDisabled(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *DiscriminatorDisabled {
+				return &oldObj.DiscriminatorFieldDisabled
+			})
+		errs = append(errs, fn(fldPath.Child("discriminatorFieldDisabled"), &obj.DiscriminatorFieldDisabled, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/lists/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/lists/doc.go
new file mode 100644
index 0000000000..b1939dd843
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/lists/doc.go
@@ -0,0 +1,49 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package lists
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:ifEnabled(FeatureX)=+k8s:listType=map
+	// +k8s:ifEnabled(FeatureX)=+k8s:listMapKey=name
+	ListMap []ListItem `json:"listMap"`
+
+	// +k8s:ifDisabled(FeatureX)=+k8s:listType=map
+	// +k8s:ifDisabled(FeatureX)=+k8s:listMapKey=name
+	ListMapDisabled []ListItem `json:"listMapDisabled"`
+
+	// +k8s:ifEnabled(FeatureX)=+k8s:eachVal=+k8s:validateFalse="field Struct.ListEachVal/val"
+	ListEachVal []ListItem `json:"listEachVal"`
+
+	// +k8s:ifDisabled(FeatureX)=+k8s:eachVal=+k8s:validateFalse="field Struct.ListEachValDisabled/val"
+	ListEachValDisabled []ListItem `json:"listEachValDisabled"`
+}
+
+type ListItem struct {
+	Name  string `json:"name"`
+	Value string `json:"value"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/lists/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/lists/doc_test.go
new file mode 100644
index 0000000000..1da98453e8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/lists/doc_test.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package lists
+
+import (
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		ListMap: []ListItem{
+			{Name: "a", Value: "1"},
+			{Name: "a", Value: "2"},
+		},
+		ListMapDisabled: []ListItem{
+			{Name: "b", Value: "1"},
+			{Name: "b", Value: "2"},
+		},
+	}).Opts(map[string]bool{"FeatureX": false}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{field.Duplicate(field.NewPath("listMapDisabled").Index(1), ListItem{Name: "b", Value: "2"}).WithOrigin("")},
+	)
+
+	st.Value(&Struct{
+		ListMap: []ListItem{
+			{Name: "a", Value: "1"},
+			{Name: "a", Value: "2"},
+		},
+		ListMapDisabled: []ListItem{
+			{Name: "b", Value: "1"},
+			{Name: "b", Value: "2"},
+		},
+	}).Opts(map[string]bool{"FeatureX": true}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{field.Duplicate(field.NewPath("listMap").Index(1), ListItem{Name: "a", Value: "2"}).WithOrigin("")},
+	)
+
+	st.Value(&Struct{
+		ListEachVal: []ListItem{
+			{Name: "c", Value: "3"},
+		},
+		ListEachValDisabled: []ListItem{
+			{Name: "d", Value: "4"},
+		},
+	}).Opts(map[string]bool{"FeatureX": false}).ExpectValidateFalseByPath(map[string][]string{
+		"listEachValDisabled[0]": {"field Struct.ListEachValDisabled/val"},
+	})
+
+	st.Value(&Struct{
+		ListEachVal: []ListItem{
+			{Name: "c", Value: "3"},
+		},
+		ListEachValDisabled: []ListItem{
+			{Name: "d", Value: "4"},
+		},
+	}).Opts(map[string]bool{"FeatureX": true}).ExpectValidateFalseByPath(map[string][]string{
+		"listEachVal[0]": {"field Struct.ListEachVal/val"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/lists/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/lists/zz_generated.validations.go
new file mode 100644
index 0000000000..c0055b7a7e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/lists/zz_generated.validations.go
@@ -0,0 +1,184 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package lists
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ListMap
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ListItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []ListItem) field.ErrorList {
+					return validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+						func(a *ListItem, b *ListItem) bool { return a.Name == b.Name })
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []ListItem {
+				return oldObj.ListMap
+			})
+		errs = append(errs, fn(fldPath.Child("listMap"), obj.ListMap, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListMapDisabled
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ListItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", false,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []ListItem) field.ErrorList {
+					return validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+						func(a *ListItem, b *ListItem) bool { return a.Name == b.Name })
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []ListItem {
+				return oldObj.ListMapDisabled
+			})
+		errs = append(errs, fn(fldPath.Child("listMapDisabled"), obj.ListMapDisabled, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListEachVal
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ListItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []ListItem) field.ErrorList {
+					return validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+						func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ListItem) field.ErrorList {
+							return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListEachVal/val")
+						})
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []ListItem {
+				return oldObj.ListEachVal
+			})
+		errs = append(errs, fn(fldPath.Child("listEachVal"), obj.ListEachVal, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ListEachValDisabled
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ListItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", false,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []ListItem) field.ErrorList {
+					return validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+						func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ListItem) field.ErrorList {
+							return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListEachValDisabled/val")
+						})
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []ListItem {
+				return oldObj.ListEachValDisabled
+			})
+		errs = append(errs, fn(fldPath.Child("listEachValDisabled"), obj.ListEachValDisabled, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/maps/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/maps/doc.go
new file mode 100644
index 0000000000..f2d3fd1092
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/maps/doc.go
@@ -0,0 +1,48 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package maps
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:ifEnabled(FeatureX)=+k8s:validateFalse="field Struct.MapField"
+	MapField map[string]string `json:"mapField"`
+
+	// +k8s:ifDisabled(FeatureX)=+k8s:validateFalse="field Struct.MapFieldDisabled"
+	MapFieldDisabled map[string]string `json:"mapFieldDisabled"`
+
+	// +k8s:ifEnabled(FeatureX)=+k8s:eachKey=+k8s:validateFalse="field Struct.MapFieldEachKey/key"
+	MapFieldEachKey map[string]string `json:"mapFieldEachKey"`
+
+	// +k8s:ifDisabled(FeatureX)=+k8s:eachKey=+k8s:validateFalse="field Struct.MapFieldEachKeyDisabled/key"
+	MapFieldEachKeyDisabled map[string]string `json:"mapFieldEachKeyDisabled"`
+
+	// +k8s:ifEnabled(FeatureX)=+k8s:eachVal=+k8s:validateFalse="field Struct.MapFieldEachVal/val"
+	MapFieldEachVal map[string]string `json:"mapFieldEachVal"`
+
+	// +k8s:ifDisabled(FeatureX)=+k8s:eachVal=+k8s:validateFalse="field Struct.MapFieldEachValDisabled/val"
+	MapFieldEachValDisabled map[string]string `json:"mapFieldEachValDisabled"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/maps/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/maps/doc_test.go
new file mode 100644
index 0000000000..ea0aff8dbf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/maps/doc_test.go
@@ -0,0 +1,75 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package maps
+
+import (
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		MapField: map[string]string{
+			"a": "1",
+		},
+		MapFieldDisabled: map[string]string{
+			"b": "2",
+		},
+		MapFieldEachKey: map[string]string{
+			"a": "1",
+		},
+		MapFieldEachKeyDisabled: map[string]string{
+			"b": "2",
+		},
+		MapFieldEachVal: map[string]string{
+			"a": "1",
+		},
+		MapFieldEachValDisabled: map[string]string{
+			"b": "2",
+		},
+	}).Opts(map[string]bool{"FeatureX": false}).ExpectValidateFalseByPath(map[string][]string{
+		"mapFieldDisabled":           {"field Struct.MapFieldDisabled"},
+		"mapFieldEachKeyDisabled":    {"field Struct.MapFieldEachKeyDisabled/key"},
+		"mapFieldEachValDisabled[b]": {"field Struct.MapFieldEachValDisabled/val"},
+	})
+
+	st.Value(&Struct{
+		MapField: map[string]string{
+			"a": "1",
+		},
+		MapFieldDisabled: map[string]string{
+			"b": "2",
+		},
+		MapFieldEachKey: map[string]string{
+			"a": "1",
+		},
+		MapFieldEachKeyDisabled: map[string]string{
+			"b": "2",
+		},
+		MapFieldEachVal: map[string]string{
+			"a": "1",
+		},
+		MapFieldEachValDisabled: map[string]string{
+			"b": "2",
+		},
+	}).Opts(map[string]bool{"FeatureX": true}).ExpectValidateFalseByPath(map[string][]string{
+		"mapField":           {"field Struct.MapField"},
+		"mapFieldEachKey":    {"field Struct.MapFieldEachKey/key"},
+		"mapFieldEachVal[a]": {"field Struct.MapFieldEachVal/val"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/maps/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/maps/zz_generated.validations.go
new file mode 100644
index 0000000000..eb6ba12e35
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/maps/zz_generated.validations.go
@@ -0,0 +1,242 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package maps
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapFieldDisabled
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", false,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapFieldDisabled")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapFieldDisabled
+			})
+		errs = append(errs, fn(fldPath.Child("mapFieldDisabled"), obj.MapFieldDisabled, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapFieldEachKey
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+					return validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+						func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+							return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapFieldEachKey/key")
+						})
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapFieldEachKey
+			})
+		errs = append(errs, fn(fldPath.Child("mapFieldEachKey"), obj.MapFieldEachKey, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapFieldEachKeyDisabled
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", false,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+					return validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+						func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+							return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapFieldEachKeyDisabled/key")
+						})
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapFieldEachKeyDisabled
+			})
+		errs = append(errs, fn(fldPath.Child("mapFieldEachKeyDisabled"), obj.MapFieldEachKeyDisabled, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapFieldEachVal
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+					return validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+						func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+							return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapFieldEachVal/val")
+						})
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapFieldEachVal
+			})
+		errs = append(errs, fn(fldPath.Child("mapFieldEachVal"), obj.MapFieldEachVal, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapFieldEachValDisabled
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", false,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+					return validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+						func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+							return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapFieldEachValDisabled/val")
+						})
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapFieldEachValDisabled
+			})
+		errs = append(errs, fn(fldPath.Child("mapFieldEachValDisabled"), obj.MapFieldEachValDisabled, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/simple/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/simple/doc.go
new file mode 100644
index 0000000000..15602823ed
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/simple/doc.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package simple
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+type MySlice []string
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:ifEnabled(FeatureX)=+k8s:validateFalse="field Struct.XEnabledField"
+	XEnabledField string `json:"xEnabledField"`
+
+	// +k8s:ifDisabled(FeatureX)=+k8s:validateFalse="field Struct.XDisabledField"
+	XDisabledField string `json:"xDisabledField"`
+
+	// +k8s:ifEnabled(FeatureY)=+k8s:validateFalse="field Struct.YEnabledField"
+	YEnabledField string `json:"yEnabledField"`
+
+	// +k8s:ifDisabled(FeatureY)=+k8s:validateFalse="field Struct.YDisabledField"
+	YDisabledField string `json:"yDisabledField"`
+
+	// +k8s:ifEnabled(FeatureX)=+k8s:validateFalse="field Struct.XYMixedField/X"
+	// +k8s:ifDisabled(FeatureY)=+k8s:validateFalse="field Struct.XYMixedField/Y"
+	XYMixedField string `json:"xyMixedField"`
+	// +k8s:ifEnabled(FeatureX)=+k8s:validateFalse="field Struct.NilableAliasField"
+	NilableAliasField MySlice `json:"nilableAliasField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/simple/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/simple/doc_test.go
new file mode 100644
index 0000000000..1e852ea1e9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/simple/doc_test.go
@@ -0,0 +1,81 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package simple
+
+import (
+	"errors"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values
+	}).Opts(map[string]bool{"FeatureX": false, "FeatureY": false}).ExpectValidateFalseByPath(map[string][]string{
+		// All ifDisabled validations should trigger
+		"xDisabledField": {"field Struct.XDisabledField"},
+		"yDisabledField": {"field Struct.YDisabledField"},
+		"xyMixedField":   {"field Struct.XYMixedField/Y"},
+	})
+
+	st.Value(&Struct{
+		// All zero values
+	}).Opts(map[string]bool{"FeatureX": true, "FeatureY": true}).ExpectValidateFalseByPath(map[string][]string{
+		// All ifEnabled validations should trigger
+		"xEnabledField":     {"field Struct.XEnabledField"},
+		"yEnabledField":     {"field Struct.YEnabledField"},
+		"xyMixedField":      {"field Struct.XYMixedField/X"},
+		"nilableAliasField": {"field Struct.NilableAliasField"},
+	})
+
+	st.Value(&Struct{
+		// All zero values
+	}).Opts(map[string]bool{"FeatureX": true, "FeatureY": false}).ExpectValidateFalseByPath(map[string][]string{
+		// All ifEnabled validations should trigger
+		"xEnabledField":  {"field Struct.XEnabledField"},
+		"yDisabledField": {"field Struct.YDisabledField"},
+		"xyMixedField": {
+			"field Struct.XYMixedField/X",
+			"field Struct.XYMixedField/Y"},
+		"nilableAliasField": {"field Struct.NilableAliasField"},
+	})
+
+	st.Value(&Struct{
+		// All zero values
+	}).Opts(map[string]bool{"FeatureX": false, "FeatureY": true}).ExpectValidateFalseByPath(map[string][]string{
+		// All ifEnabled validations should trigger
+		"xDisabledField": {"field Struct.XDisabledField"},
+		"yEnabledField":  {"field Struct.YEnabledField"},
+	})
+
+	// No options declared: every referenced option is undeclared.
+	internal := func(p string) *field.Error {
+		return field.InternalError(field.NewPath(p), errors.New(""))
+	}
+	st.Value(&Struct{}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		internal("xEnabledField"),
+		internal("xDisabledField"),
+		internal("yEnabledField"),
+		internal("yDisabledField"),
+		internal("xyMixedField"), // ifEnabled(FeatureX)
+		internal("xyMixedField"), // ifDisabled(FeatureY)
+		internal("nilableAliasField"),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/simple/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/simple/zz_generated.validations.go
new file mode 100644
index 0000000000..bf6b6cd428
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/simple/zz_generated.validations.go
@@ -0,0 +1,236 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package simple
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.XEnabledField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.XEnabledField")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.XEnabledField
+			})
+		errs = append(errs, fn(fldPath.Child("xEnabledField"), &obj.XEnabledField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.XDisabledField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", false,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.XDisabledField")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.XDisabledField
+			})
+		errs = append(errs, fn(fldPath.Child("xDisabledField"), &obj.XDisabledField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.YEnabledField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureY", true,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.YEnabledField")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.YEnabledField
+			})
+		errs = append(errs, fn(fldPath.Child("yEnabledField"), &obj.YEnabledField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.YDisabledField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureY", false,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.YDisabledField")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.YDisabledField
+			})
+		errs = append(errs, fn(fldPath.Child("yDisabledField"), &obj.YDisabledField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.XYMixedField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureY", false,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.XYMixedField/Y")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.XYMixedField/X")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.XYMixedField
+			})
+		errs = append(errs, fn(fldPath.Child("xyMixedField"), &obj.XYMixedField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.NilableAliasField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj MySlice,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj MySlice) field.ErrorList {
+					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.NilableAliasField")
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) MySlice {
+				return oldObj.NilableAliasField
+			})
+		errs = append(errs, fn(fldPath.Child("nilableAliasField"), obj.NilableAliasField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/subfields/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/subfields/doc.go
new file mode 100644
index 0000000000..e70fddf223
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/subfields/doc.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package subfields
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:ifEnabled(FeatureX)=+k8s:subfield(xEnabledField)=+k8s:validateFalse="field Struct.ObjectMeta.XEnabledField"
+	ObjectMeta `json:"metadata,omitempty"`
+
+	// +k8s:ifDisabled(FeatureX)=+k8s:subfield(xDisabledField)=+k8s:validateFalse="field Struct.ObjectMetaDisabled.XDisabledField"
+	ObjectMetaDisabled ObjectMeta `json:"metadataDisabled,omitempty"`
+}
+
+type ObjectMeta struct {
+	XEnabledField  string `json:"xEnabledField"`
+	XDisabledField string `json:"xDisabledField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/subfields/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/subfields/doc_test.go
new file mode 100644
index 0000000000..5666d2de0e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/subfields/doc_test.go
@@ -0,0 +1,37 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package subfields
+
+import (
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values
+	}).Opts(map[string]bool{"FeatureX": false}).ExpectValidateFalseByPath(map[string][]string{
+		"metadataDisabled.xDisabledField": {"field Struct.ObjectMetaDisabled.XDisabledField"},
+	})
+
+	st.Value(&Struct{
+		// All zero values
+	}).Opts(map[string]bool{"FeatureX": true}).ExpectValidateFalseByPath(map[string][]string{
+		"metadata.xEnabledField": {"field Struct.ObjectMeta.XEnabledField"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/subfields/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/subfields/zz_generated.validations.go
new file mode 100644
index 0000000000..f942b769b9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/subfields/zz_generated.validations.go
@@ -0,0 +1,129 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package subfields
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ObjectMeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ObjectMeta,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ObjectMeta) field.ErrorList {
+					return validate.Subfield(ctx, op, fldPath, obj, oldObj, "xEnabledField",
+						func(o *ObjectMeta) *string { return &o.XEnabledField }, validate.DirectEqual,
+						func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+							return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ObjectMeta.XEnabledField")
+						})
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *ObjectMeta {
+				return &oldObj.ObjectMeta
+			})
+		errs = append(errs, fn(fldPath.Child("metadata"), &obj.ObjectMeta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ObjectMetaDisabled
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ObjectMeta,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", false,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ObjectMeta) field.ErrorList {
+					return validate.Subfield(ctx, op, fldPath, obj, oldObj, "xDisabledField",
+						func(o *ObjectMeta) *string { return &o.XDisabledField }, validate.DirectEqual,
+						func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+							return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ObjectMetaDisabled.XDisabledField")
+						})
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *ObjectMeta {
+				return &oldObj.ObjectMetaDisabled
+			})
+		errs = append(errs, fn(fldPath.Child("metadataDisabled"), &obj.ObjectMetaDisabled, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/unions/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/unions/doc.go
new file mode 100644
index 0000000000..03db34f1f7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/unions/doc.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package unions
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	UnionField         Union         `json:"unionField"`
+	UnionFieldDisabled UnionDisabled `json:"unionFieldDisabled"`
+
+	ZeroOrOneOfField         ZeroOrOneOf         `json:"zeroOrOneOfField"`
+	ZeroOrOneOfFieldDisabled ZeroOrOneOfDisabled `json:"zeroOrOneOfFieldDisabled"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:ifEnabled(FeatureX)=+k8s:item(name: "succeeded")=+k8s:zeroOrOneOfMember
+	// +k8s:ifEnabled(FeatureX)=+k8s:item(name: "failed")=+k8s:zeroOrOneOfMember
+	ZeroOrOneOfItem []Task `json:"zeroOrOneOfItem"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:ifDisabled(FeatureX)=+k8s:item(name: "succeeded")=+k8s:zeroOrOneOfMember
+	// +k8s:ifDisabled(FeatureX)=+k8s:item(name: "failed")=+k8s:zeroOrOneOfMember
+	ZeroOrOneOfItemDisabled []Task `json:"zeroOrOneOfItemDisabled"`
+}
+
+type Task struct {
+	Name  string `json:"name"`
+	State string `json:"state"`
+}
+
+type Union struct {
+	// +k8s:ifEnabled(FeatureX)=+k8s:unionDiscriminator
+	Discriminator string `json:"discriminator"`
+
+	// +k8s:ifEnabled(FeatureX)=+k8s:unionMember
+	XEnabledField string `json:"xEnabledField"`
+
+	// +k8s:ifEnabled(FeatureX)=+k8s:unionMember
+	XDisabledField string `json:"xDisabledField"`
+}
+
+type UnionDisabled struct {
+	// +k8s:ifDisabled(FeatureX)=+k8s:unionDiscriminator
+	Discriminator string `json:"discriminator"`
+
+	// +k8s:ifDisabled(FeatureX)=+k8s:unionMember
+	XEnabledField string `json:"xEnabledField"`
+
+	// +k8s:ifDisabled(FeatureX)=+k8s:unionMember
+	XDisabledField string `json:"xDisabledField"`
+}
+
+type ZeroOrOneOf struct {
+	// +k8s:ifEnabled(FeatureX)=+k8s:zeroOrOneOfMember
+	XEnabledField string `json:"xEnabledField"`
+
+	// +k8s:ifEnabled(FeatureX)=+k8s:zeroOrOneOfMember
+	XDisabledField string `json:"xDisabledField"`
+}
+
+type ZeroOrOneOfDisabled struct {
+	// +k8s:ifDisabled(FeatureX)=+k8s:zeroOrOneOfMember
+	XEnabledField string `json:"xEnabledField"`
+
+	// +k8s:ifDisabled(FeatureX)=+k8s:zeroOrOneOfMember
+	XDisabledField string `json:"xDisabledField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/unions/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/unions/doc_test.go
new file mode 100644
index 0000000000..513ba6dd89
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/unions/doc_test.go
@@ -0,0 +1,110 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unions
+
+import (
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero values
+	}).Opts(map[string]bool{"FeatureX": false}).ExpectValid()
+
+	st.Value(&Struct{
+		UnionField: Union{
+			Discriminator:  "xEnabledField",
+			XEnabledField:  "foo",
+			XDisabledField: "bar", // Invalid since XEnabledField is the discriminator
+		},
+		ZeroOrOneOfField: ZeroOrOneOf{
+			XEnabledField:  "foo",
+			XDisabledField: "bar",
+		},
+		ZeroOrOneOfItem: []Task{
+			{Name: "succeeded"},
+			{Name: "failed"},
+		},
+	}).Opts(map[string]bool{"FeatureX": true}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{
+			field.Invalid(field.NewPath("unionField", "xDisabledField"), "", "").WithOrigin("union"),
+			field.Invalid(field.NewPath("unionField", "xEnabledField"), "", "").WithOrigin("union"),
+			field.Invalid(field.NewPath("zeroOrOneOfField"), "{XEnabledField:\"foo\", XDisabledField:\"bar\"}", "").WithOrigin("zeroOrOneOf"),
+			field.Invalid(field.NewPath("zeroOrOneOfItem"), "[{Name:\"succeeded\", State:\"\"} {Name:\"failed\", State:\"\"}]", "").WithOrigin("zeroOrOneOf"),
+		},
+	)
+
+	st.Value(&Struct{
+		UnionField: Union{
+			Discriminator:  "xEnabledField",
+			XEnabledField:  "foo",
+			XDisabledField: "bar",
+		},
+		ZeroOrOneOfField: ZeroOrOneOf{
+			XEnabledField:  "foo",
+			XDisabledField: "bar",
+		},
+		ZeroOrOneOfItem: []Task{
+			{Name: "succeeded"},
+			{Name: "failed"},
+		},
+	}).Opts(map[string]bool{"FeatureX": false}).ExpectValid()
+
+	st.Value(&Struct{
+		UnionFieldDisabled: UnionDisabled{
+			Discriminator:  "xEnabledField",
+			XEnabledField:  "foo",
+			XDisabledField: "bar", // Invalid since XEnabledField is the discriminator
+		},
+		ZeroOrOneOfFieldDisabled: ZeroOrOneOfDisabled{
+			XEnabledField:  "foo",
+			XDisabledField: "bar",
+		},
+		ZeroOrOneOfItemDisabled: []Task{
+			{Name: "succeeded"},
+			{Name: "failed"},
+		},
+	}).Opts(map[string]bool{"FeatureX": false}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin(),
+		field.ErrorList{
+			field.Invalid(field.NewPath("unionFieldDisabled", "xDisabledField"), "", "").WithOrigin("union"),
+			field.Invalid(field.NewPath("unionFieldDisabled", "xEnabledField"), "", "").WithOrigin("union"),
+			field.Invalid(field.NewPath("zeroOrOneOfFieldDisabled"), "{XEnabledField:\"foo\", XDisabledField:\"bar\"}", "").WithOrigin("zeroOrOneOf"),
+			field.Invalid(field.NewPath("zeroOrOneOfItemDisabled"), "[{Name:\"succeeded\", State:\"\"} {Name:\"failed\", State:\"\"}]", "").WithOrigin("zeroOrOneOf"),
+		},
+	)
+
+	st.Value(&Struct{
+		UnionFieldDisabled: UnionDisabled{
+			Discriminator:  "xEnabledField",
+			XEnabledField:  "foo",
+			XDisabledField: "bar",
+		},
+		ZeroOrOneOfFieldDisabled: ZeroOrOneOfDisabled{
+			XEnabledField:  "foo",
+			XDisabledField: "bar",
+		},
+		ZeroOrOneOfItemDisabled: []Task{
+			{Name: "succeeded"},
+			{Name: "failed"},
+		},
+	}).Opts(map[string]bool{"FeatureX": true}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/unions/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/unions/zz_generated.validations.go
new file mode 100644
index 0000000000..ed92643c1b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/unions/zz_generated.validations.go
@@ -0,0 +1,405 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package unions
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_options_unions_Struct_zeroOrOneOfItem_ = validate.NewUnionMembership(validate.NewUnionMember("zeroOrOneOfItem[{\"name\": \"succeeded\"}]"), validate.NewUnionMember("zeroOrOneOfItem[{\"name\": \"failed\"}]"))
+var zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_options_unions_Struct_zeroOrOneOfItemDisabled_ = validate.NewUnionMembership(validate.NewUnionMember("zeroOrOneOfItemDisabled[{\"name\": \"succeeded\"}]"), validate.NewUnionMember("zeroOrOneOfItemDisabled[{\"name\": \"failed\"}]"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.UnionField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *Union,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_Union(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *Union {
+				return &oldObj.UnionField
+			})
+		errs = append(errs, fn(fldPath.Child("unionField"), &obj.UnionField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.UnionFieldDisabled
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *UnionDisabled,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_UnionDisabled(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *UnionDisabled {
+				return &oldObj.UnionFieldDisabled
+			})
+		errs = append(errs, fn(fldPath.Child("unionFieldDisabled"), &obj.UnionFieldDisabled, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ZeroOrOneOfField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ZeroOrOneOf,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ZeroOrOneOf(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *ZeroOrOneOf {
+				return &oldObj.ZeroOrOneOfField
+			})
+		errs = append(errs, fn(fldPath.Child("zeroOrOneOfField"), &obj.ZeroOrOneOfField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ZeroOrOneOfFieldDisabled
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ZeroOrOneOfDisabled,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ZeroOrOneOfDisabled(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *ZeroOrOneOfDisabled {
+				return &oldObj.ZeroOrOneOfFieldDisabled
+			})
+		errs = append(errs, fn(fldPath.Child("zeroOrOneOfFieldDisabled"), &obj.ZeroOrOneOfFieldDisabled, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ZeroOrOneOfItem
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Task,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []Task) field.ErrorList {
+					return validate.ZeroOrOneOfUnion(ctx, op, fldPath, obj, oldObj, zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_options_unions_Struct_zeroOrOneOfItem_,
+						func(list []Task) bool {
+							for i := range list {
+								if list[i].Name == "failed" {
+									return true
+								}
+							}
+							return false
+						},
+						func(list []Task) bool {
+							for i := range list {
+								if list[i].Name == "succeeded" {
+									return true
+								}
+							}
+							return false
+						})
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Task, b *Task) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []Task {
+				return oldObj.ZeroOrOneOfItem
+			})
+		errs = append(errs, fn(fldPath.Child("zeroOrOneOfItem"), obj.ZeroOrOneOfItem, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ZeroOrOneOfItemDisabled
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Task,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", false,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []Task) field.ErrorList {
+					return validate.ZeroOrOneOfUnion(ctx, op, fldPath, obj, oldObj, zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_options_unions_Struct_zeroOrOneOfItemDisabled_,
+						func(list []Task) bool {
+							for i := range list {
+								if list[i].Name == "failed" {
+									return true
+								}
+							}
+							return false
+						},
+						func(list []Task) bool {
+							for i := range list {
+								if list[i].Name == "succeeded" {
+									return true
+								}
+							}
+							return false
+						})
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Task, b *Task) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []Task {
+				return oldObj.ZeroOrOneOfItemDisabled
+			})
+		errs = append(errs, fn(fldPath.Child("zeroOrOneOfItemDisabled"), obj.ZeroOrOneOfItemDisabled, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_options_unions_Union_ = validate.NewDiscriminatedUnionMembership("discriminator", validate.NewDiscriminatedUnionMember("xEnabledField", "XEnabledField"), validate.NewDiscriminatedUnionMember("xDisabledField", "XDisabledField"))
+
+// Validate_Union validates an instance of Union according
+// to declarative validation rules in the API schema.
+func Validate_Union(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Union) (errs field.ErrorList) {
+
+	if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *Union) field.ErrorList {
+			return validate.DiscriminatedUnion(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_options_unions_Union_,
+				func(obj *Union) string {
+					if obj == nil {
+						return ""
+					}
+					return string(obj.Discriminator)
+				},
+				func(obj *Union) bool {
+					if obj == nil {
+						return false
+					}
+					var z string
+					return obj.XEnabledField != z
+				},
+				func(obj *Union) bool {
+					if obj == nil {
+						return false
+					}
+					var z string
+					return obj.XDisabledField != z
+				})
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Union.Discriminator has no validation
+	// field Union.XEnabledField has no validation
+	// field Union.XDisabledField has no validation
+	return errs
+}
+
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_options_unions_UnionDisabled_ = validate.NewDiscriminatedUnionMembership("discriminator", validate.NewDiscriminatedUnionMember("xEnabledField", "XEnabledField"), validate.NewDiscriminatedUnionMember("xDisabledField", "XDisabledField"))
+
+// Validate_UnionDisabled validates an instance of UnionDisabled according
+// to declarative validation rules in the API schema.
+func Validate_UnionDisabled(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *UnionDisabled) (errs field.ErrorList) {
+
+	if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", false,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *UnionDisabled) field.ErrorList {
+			return validate.DiscriminatedUnion(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_options_unions_UnionDisabled_,
+				func(obj *UnionDisabled) string {
+					if obj == nil {
+						return ""
+					}
+					return string(obj.Discriminator)
+				},
+				func(obj *UnionDisabled) bool {
+					if obj == nil {
+						return false
+					}
+					var z string
+					return obj.XEnabledField != z
+				},
+				func(obj *UnionDisabled) bool {
+					if obj == nil {
+						return false
+					}
+					var z string
+					return obj.XDisabledField != z
+				})
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field UnionDisabled.Discriminator has no validation
+	// field UnionDisabled.XEnabledField has no validation
+	// field UnionDisabled.XDisabledField has no validation
+	return errs
+}
+
+var zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_options_unions_ZeroOrOneOf_ = validate.NewUnionMembership(validate.NewUnionMember("xEnabledField"), validate.NewUnionMember("xDisabledField"))
+
+// Validate_ZeroOrOneOf validates an instance of ZeroOrOneOf according
+// to declarative validation rules in the API schema.
+func Validate_ZeroOrOneOf(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ZeroOrOneOf) (errs field.ErrorList) {
+
+	if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ZeroOrOneOf) field.ErrorList {
+			return validate.ZeroOrOneOfUnion(ctx, op, fldPath, obj, oldObj, zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_options_unions_ZeroOrOneOf_,
+				func(obj *ZeroOrOneOf) bool {
+					if obj == nil {
+						return false
+					}
+					var z string
+					return obj.XEnabledField != z
+				},
+				func(obj *ZeroOrOneOf) bool {
+					if obj == nil {
+						return false
+					}
+					var z string
+					return obj.XDisabledField != z
+				})
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field ZeroOrOneOf.XEnabledField has no validation
+	// field ZeroOrOneOf.XDisabledField has no validation
+	return errs
+}
+
+var zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_options_unions_ZeroOrOneOfDisabled_ = validate.NewUnionMembership(validate.NewUnionMember("xEnabledField"), validate.NewUnionMember("xDisabledField"))
+
+// Validate_ZeroOrOneOfDisabled validates an instance of ZeroOrOneOfDisabled according
+// to declarative validation rules in the API schema.
+func Validate_ZeroOrOneOfDisabled(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ZeroOrOneOfDisabled) (errs field.ErrorList) {
+
+	if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", false,
+		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ZeroOrOneOfDisabled) field.ErrorList {
+			return validate.ZeroOrOneOfUnion(ctx, op, fldPath, obj, oldObj, zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_options_unions_ZeroOrOneOfDisabled_,
+				func(obj *ZeroOrOneOfDisabled) bool {
+					if obj == nil {
+						return false
+					}
+					var z string
+					return obj.XEnabledField != z
+				},
+				func(obj *ZeroOrOneOfDisabled) bool {
+					if obj == nil {
+						return false
+					}
+					var z string
+					return obj.XDisabledField != z
+				})
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field ZeroOrOneOfDisabled.XEnabledField has no validation
+	// field ZeroOrOneOfDisabled.XDisabledField has no validation
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/doc.go
new file mode 100644
index 0000000000..2393c14ec8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/doc.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package update
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:ifEnabled(FeatureX)=+k8s:immutable
+	ImmutableEnabled string `json:"immutableEnabled"`
+
+	// +k8s:ifDisabled(FeatureX)=+k8s:immutable
+	ImmutableDisabled string `json:"immutableDisabled"`
+
+	// +k8s:ifEnabled(FeatureX)=+k8s:update=NoModify
+	UpdateNoModifyEnabled string `json:"updateNoModifyEnabled"`
+
+	// +k8s:ifDisabled(FeatureX)=+k8s:update=NoModify
+	UpdateNoModifyDisabled string `json:"updateNoModifyDisabled"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/doc_test.go
new file mode 100644
index 0000000000..4bb234b9ce
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/doc_test.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package update
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	structA := Struct{
+		ImmutableEnabled:       "aaa",
+		ImmutableDisabled:      "bbb",
+		UpdateNoModifyEnabled:  "ccc",
+		UpdateNoModifyDisabled: "ddd",
+	}
+
+	structB := Struct{
+		ImmutableEnabled:       "eee",
+		ImmutableDisabled:      "fff",
+		UpdateNoModifyEnabled:  "ggg",
+		UpdateNoModifyDisabled: "hhh",
+	}
+
+	st.Value(&structA).OldValue(&structA).Opts(map[string]bool{"FeatureX": false}).ExpectValid()
+
+	st.Value(&structB).OldValue(&structA).Opts(map[string]bool{"FeatureX": false}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailSubstring(),
+		field.ErrorList{
+			field.Invalid(field.NewPath("immutableDisabled"), nil, "").WithOrigin("immutable"),
+			field.Invalid(field.NewPath("updateNoModifyDisabled"), nil, "field cannot be modified once set").WithOrigin("update"),
+		},
+	)
+
+	st.Value(&structB).OldValue(&structA).Opts(map[string]bool{"FeatureX": true}).ExpectMatches(
+		field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailSubstring(),
+		field.ErrorList{
+			field.Invalid(field.NewPath("immutableEnabled"), nil, "").WithOrigin("immutable"),
+			field.Invalid(field.NewPath("updateNoModifyEnabled"), nil, "field cannot be modified once set").WithOrigin("update"),
+		},
+	)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/zz_generated.validations.go
new file mode 100644
index 0000000000..b96320a866
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/zz_generated.validations.go
@@ -0,0 +1,191 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package update
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ImmutableEnabled
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.ImmutableEnabled
+			})
+		errs = append(errs, fn(fldPath.Child("immutableEnabled"), &obj.ImmutableEnabled, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ImmutableDisabled
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", false, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.ImmutableDisabled
+			})
+		errs = append(errs, fn(fldPath.Child("immutableDisabled"), &obj.ImmutableDisabled, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.UpdateNoModifyEnabled
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+						func(a string, b string) bool { return a == b }, validate.NoModify)
+				}).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.UpdateNoModifyEnabled
+			})
+		errs = append(errs, fn(fldPath.Child("updateNoModifyEnabled"), &obj.UpdateNoModifyEnabled, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.UpdateNoModifyDisabled
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", false,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+						func(a string, b string) bool { return a == b }, validate.NoModify)
+				}).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.UpdateNoModifyDisabled
+			})
+		errs = append(errs, fn(fldPath.Child("updateNoModifyDisabled"), &obj.UpdateNoModifyDisabled, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/required/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/required/doc.go
new file mode 100644
index 0000000000..8a57606570
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/required/doc.go
@@ -0,0 +1,115 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package required
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.StringField"
+	StringField string `json:"stringField"`
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.StringPtrField"
+	StringPtrField *string `json:"stringPtrField"`
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.StringTypedefField"
+	StringTypedefField StringType `json:"stringTypedefField"`
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.StringTypedefPtrField"
+	StringTypedefPtrField *StringType `json:"stringTypedefPtrField"`
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.IntField"
+	IntField int `json:"intField"`
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.IntPtrField"
+	IntPtrField *int `json:"intPtrField"`
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.IntTypedefField"
+	IntTypedefField IntType `json:"intTypedefField"`
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.IntTypedefPtrField"
+	IntTypedefPtrField *IntType `json:"intTypedefPtrField"`
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.BoolField"
+	BoolField bool `json:"boolField"`
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.FloatField"
+	FloatField float64 `json:"floatField"`
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.ByteField"
+	ByteField byte `json:"byteField"`
+
+	// non-pointer struct fields cannot be required or optional
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.OtherStructPtrField"
+	OtherStructPtrField *OtherStruct `json:"otherStructPtrField"`
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.SliceField"
+	SliceField []string `json:"sliceField"`
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.SliceTypedefField"
+	SliceTypedefField SliceType `json:"sliceTypedefField"`
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.ByteArrayField"
+	ByteArrayField []byte `json:"byteArrayField"`
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.MapField"
+	MapField map[string]string `json:"mapField"`
+
+	// +k8s:required
+	// +k8s:validateFalse="field Struct.MapTypedefField"
+	MapTypedefField MapType `json:"mapTypedefField"`
+}
+
+// +k8s:validateFalse="type StringType"
+type StringType string
+
+// +k8s:validateFalse="type IntType"
+type IntType int
+
+// +k8s:validateFalse="type OtherStruct"
+type OtherStruct struct{}
+
+// +k8s:validateFalse="type SliceType"
+type SliceType []string
+
+// +k8s:validateFalse="type MapType"
+type MapType map[string]string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/required/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/required/doc_test.go
new file mode 100644
index 0000000000..175a8c3fd3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/required/doc_test.go
@@ -0,0 +1,127 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package required
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero-values (nil slices/maps).
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Required(field.NewPath("stringField"), ""),
+		field.Required(field.NewPath("stringPtrField"), ""),
+		field.Required(field.NewPath("stringTypedefField"), ""),
+		field.Required(field.NewPath("stringTypedefPtrField"), ""),
+		field.Required(field.NewPath("intField"), ""),
+		field.Required(field.NewPath("intPtrField"), ""),
+		field.Required(field.NewPath("intTypedefField"), ""),
+		field.Required(field.NewPath("intTypedefPtrField"), ""),
+		field.Required(field.NewPath("boolField"), ""),
+		field.Required(field.NewPath("floatField"), ""),
+		field.Required(field.NewPath("byteField"), ""),
+		field.Required(field.NewPath("otherStructPtrField"), ""),
+		field.Required(field.NewPath("sliceField"), ""),
+		field.Required(field.NewPath("sliceTypedefField"), ""),
+		field.Required(field.NewPath("byteArrayField"), ""),
+		field.Required(field.NewPath("mapField"), ""),
+		field.Required(field.NewPath("mapTypedefField"), ""),
+	})
+
+	st.Value(&Struct{
+		// Explicit zero-values and empty slices/maps.
+		StringField:           "",
+		StringPtrField:        nil,
+		StringTypedefField:    "",
+		StringTypedefPtrField: nil,
+		IntField:              0,
+		IntPtrField:           nil,
+		IntTypedefField:       0,
+		IntTypedefPtrField:    nil,
+		BoolField:             false,
+		FloatField:            0.0,
+		ByteField:             0,
+		OtherStructPtrField:   nil,
+		SliceField:            []string{},
+		SliceTypedefField:     SliceType{},
+		ByteArrayField:        []byte{},
+		MapField:              map[string]string{},
+		MapTypedefField:       MapType{},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Required(field.NewPath("stringField"), ""),
+		field.Required(field.NewPath("stringPtrField"), ""),
+		field.Required(field.NewPath("stringTypedefField"), ""),
+		field.Required(field.NewPath("stringTypedefPtrField"), ""),
+		field.Required(field.NewPath("intField"), ""),
+		field.Required(field.NewPath("intPtrField"), ""),
+		field.Required(field.NewPath("intTypedefField"), ""),
+		field.Required(field.NewPath("intTypedefPtrField"), ""),
+		field.Required(field.NewPath("boolField"), ""),
+		field.Required(field.NewPath("floatField"), ""),
+		field.Required(field.NewPath("byteField"), ""),
+		field.Required(field.NewPath("otherStructPtrField"), ""),
+		field.Required(field.NewPath("sliceField"), ""),
+		field.Required(field.NewPath("sliceTypedefField"), ""),
+		field.Required(field.NewPath("byteArrayField"), ""),
+		field.Required(field.NewPath("mapField"), ""),
+		field.Required(field.NewPath("mapTypedefField"), ""),
+	})
+
+	st.Value(&Struct{
+		StringField:           "abc",
+		StringPtrField:        ptr.To("xyz"),
+		StringTypedefField:    StringType("abc"),
+		StringTypedefPtrField: ptr.To(StringType("xyz")),
+		IntField:              123,
+		IntPtrField:           ptr.To(456),
+		IntTypedefField:       IntType(123),
+		IntTypedefPtrField:    ptr.To(IntType(456)),
+		BoolField:             true,
+		FloatField:            1.23,
+		ByteField:             'a',
+		OtherStructPtrField:   &OtherStruct{},
+		SliceField:            []string{"a", "b"},
+		SliceTypedefField:     SliceType([]string{"a", "b"}),
+		ByteArrayField:        []byte("abc"),
+		MapField:              map[string]string{"a": "b", "c": "d"},
+		MapTypedefField:       MapType(map[string]string{"a": "b", "c": "d"}),
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"stringField":           {"field Struct.StringField"},
+		"stringPtrField":        {"field Struct.StringPtrField"},
+		"stringTypedefField":    {"field Struct.StringTypedefField", "type StringType"},
+		"stringTypedefPtrField": {"field Struct.StringTypedefPtrField", "type StringType"},
+		"intField":              {"field Struct.IntField"},
+		"intPtrField":           {"field Struct.IntPtrField"},
+		"intTypedefField":       {"field Struct.IntTypedefField", "type IntType"},
+		"intTypedefPtrField":    {"field Struct.IntTypedefPtrField", "type IntType"},
+		"boolField":             {"field Struct.BoolField"},
+		"floatField":            {"field Struct.FloatField"},
+		"byteField":             {"field Struct.ByteField"},
+		"otherStructPtrField":   {"type OtherStruct", "field Struct.OtherStructPtrField"},
+		"sliceField":            {"field Struct.SliceField"},
+		"sliceTypedefField":     {"field Struct.SliceTypedefField", "type SliceType"},
+		"byteArrayField":        {"field Struct.ByteArrayField"},
+		"mapField":              {"field Struct.MapField"},
+		"mapTypedefField":       {"field Struct.MapTypedefField", "type MapType"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/required/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/required/zz_generated.validations.go
new file mode 100644
index 0000000000..67dc796f1e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/required/zz_generated.validations.go
@@ -0,0 +1,691 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package required
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_IntType validates an instance of IntType according
+// to declarative validation rules in the API schema.
+func Validate_IntType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *IntType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type IntType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_MapType validates an instance of MapType according
+// to declarative validation rules in the API schema.
+func Validate_MapType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj MapType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_OtherStruct validates an instance of OtherStruct according
+// to declarative validation rules in the API schema.
+func Validate_OtherStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OtherStruct) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type OtherStruct"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_SliceType validates an instance of SliceType according
+// to declarative validation rules in the API schema.
+func Validate_SliceType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj SliceType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type SliceType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_StringType validates an instance of StringType according
+// to declarative validation rules in the API schema.
+func Validate_StringType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StringType) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type StringType"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.StringField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.StringPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.StringPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("stringPtrField"), obj.StringPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.StringTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_StringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *StringType {
+				return &oldObj.StringTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("stringTypedefField"), &obj.StringTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StringTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *StringType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.StringTypedefPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_StringType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *StringType {
+				return oldObj.StringTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("stringTypedefPtrField"), obj.StringTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.IntField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return &oldObj.IntField
+			})
+		errs = append(errs, fn(fldPath.Child("intField"), &obj.IntField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.IntPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return oldObj.IntPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("intPtrField"), obj.IntPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.IntTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_IntType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *IntType {
+				return &oldObj.IntTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("intTypedefField"), &obj.IntTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IntTypedefPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *IntType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.IntTypedefPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_IntType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *IntType {
+				return oldObj.IntTypedefPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("intTypedefPtrField"), obj.IntTypedefPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.BoolField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.BoolField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *bool {
+				return &oldObj.BoolField
+			})
+		errs = append(errs, fn(fldPath.Child("boolField"), &obj.BoolField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.FloatField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *float64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.FloatField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *float64 {
+				return &oldObj.FloatField
+			})
+		errs = append(errs, fn(fldPath.Child("floatField"), &obj.FloatField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ByteField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *byte,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ByteField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *byte {
+				return &oldObj.ByteField
+			})
+		errs = append(errs, fn(fldPath.Child("byteField"), &obj.ByteField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.OtherStructPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.OtherStructPtrField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_OtherStruct(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *OtherStruct {
+				return oldObj.OtherStructPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("otherStructPtrField"), obj.OtherStructPtrField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.SliceField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.SliceField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceField"), obj.SliceField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj SliceType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.SliceTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_SliceType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) SliceType {
+				return oldObj.SliceTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("sliceTypedefField"), obj.SliceTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.ByteArrayField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []byte,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ByteArrayField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []byte {
+				return oldObj.ByteArrayField
+			})
+		errs = append(errs, fn(fldPath.Child("byteArrayField"), obj.ByteArrayField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.MapField
+			})
+		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.MapTypedefField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj MapType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapTypedefField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_MapType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) MapType {
+				return oldObj.MapTypedefField
+			})
+		errs = append(errs, fn(fldPath.Child("mapTypedefField"), obj.MapTypedefField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/deep/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/deep/doc.go
new file mode 100644
index 0000000000..f901f06897
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/deep/doc.go
@@ -0,0 +1,89 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// Package subfield contains test types for testing subfield field validation tags.
+// +k8s:validation-gen-nolint
+package deep
+
+// TODO: Uncomment the following code once the generated validation code can handle NPE by
+// configuring optionality or requiredness for the intermediate fields.
+
+/**
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Struct demonstrates validations for subfield fields of structs.
+type Struct struct {
+	TypeMeta int `json:"typeMeta"`
+
+	// +k8s:subfield(structField)=+k8s:subfield(stringField)=+k8s:validateFalse="Struct.StructField.StructField 1"
+	// +k8s:subfield(structField)=+k8s:subfield(stringField)=+k8s:validateFalse="Struct.StructField.StructField 2"
+	// +k8s:subfield(sliceField)=+k8s:eachVal=+k8s:subfield(stringField)=+k8s:validateFalse="Struct.StructField.SliceField"
+	// +k8s:subfield(mapField)=+k8s:eachVal=+k8s:subfield(stringField)=+k8s:validateFalse="Struct.StructField.MapField"
+	StructField OtherStruct `json:"structField"`
+
+	// +k8s:subfield(structField)=+k8s:subfield(stringField)=+k8s:validateFalse="Struct.StructPtrField.StructField 1"
+	// +k8s:subfield(structField)=+k8s:subfield(stringField)=+k8s:validateFalse="Struct.StructPtrField.StructField 2"
+	// +k8s:subfield(sliceField)=+k8s:eachVal=+k8s:subfield(stringField)=+k8s:validateFalse="Struct.StructPtrField.SliceField"
+	// +k8s:subfield(mapField)=+k8s:eachVal=+k8s:subfield(stringField)=+k8s:validateFalse="Struct.StructPtrField.MapField"
+	StructPtrField *OtherStruct `json:"structPtrField"`
+}
+
+type OtherStruct struct {
+	StructField SmallStruct            `json:"structField"`
+	SliceField  []SmallStruct          `json:"sliceField"`
+	MapField    map[string]SmallStruct `json:"mapField"`
+}
+
+type SmallStruct struct {
+	StringField string `json:"stringField"`
+}
+
+type StructWithOptionalField struct {
+	// +k8s:optional
+	OptionalField string `json:"optionalField"`
+}
+
+type SetByServerStruct struct {
+	TypeMeta int `json:"typeMeta"`
+
+	// +k8s:subfield(optionalField)=+k8s:setByServer
+	SubfieldSetByServer StructWithOptionalField `json:"subfieldSetByServer"`
+
+	// +k8s:subfield(stringField)=+k8s:setByServer
+	// +k8s:subfield(stringField)=+k8s:optional
+	EmbeddedSetByServer UnvalidatedStruct `json:"embeddedSetByServer"`
+
+	// +k8s:subfield(optionalField)=+k8s:required
+	// +k8s:opaqueType
+	OpaqueSubfieldRequired StructWithOptionalField `json:"opaqueSubfieldRequired"`
+
+	// +k8s:subfield(optionalField)=+k8s:required
+	SubfieldRequired StructWithOptionalField `json:"subfieldRequired"`
+
+	// +k8s:optional
+	// +k8s:subfield(optionalField)=+k8s:setByServer
+	SubfieldPtrSetByServer *StructWithOptionalField `json:"subfieldPtrSetByServer"`
+
+	// +k8s:optional
+	// +k8s:subfield(optionalField)=+k8s:required
+	SubfieldPtrRequired *StructWithOptionalField `json:"subfieldPtrRequired"`
+}
+**/
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/deep/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/deep/zz_generated.validations.go
new file mode 100644
index 0000000000..921f279859
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/deep/zz_generated.validations.go
@@ -0,0 +1,22 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package deep
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/doc.go
new file mode 100644
index 0000000000..a510c303e1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/doc.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// Package  contains test types for testing subfield field validation tags.
+// +k8s:validation-gen-nolint
+package list
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int `json:"typeMeta"`
+
+	// +k8s:subfield(ownerReferences)=+k8s:listType=map
+	// +k8s:subfield(ownerReferences)=+k8s:listMapKey=uid
+	// +k8s:subfield(finalizers)=+k8s:listType=set
+	// +k8s:subfield(labels)=+k8s:eachKey=+k8s:validateFalse="labels key error"
+	// +k8s:opaqueType
+	metav1.ObjectMeta `json:"objectMeta"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/doc_test.go
new file mode 100644
index 0000000000..9044c3221e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/doc_test.go
@@ -0,0 +1,65 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package list
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestStructValidation(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Valid case: empty ownerReferences, distinct finalizers, empty labels
+	st.Value(&Struct{
+		ObjectMeta: metav1.ObjectMeta{
+			Finalizers: []string{"finalizer1", "finalizer2"},
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{})
+
+	// Invalid case: duplicate UIDs
+	st.Value(&Struct{
+		ObjectMeta: metav1.ObjectMeta{
+			OwnerReferences: []metav1.OwnerReference{
+				{UID: "1", Name: "ref1"},
+				{UID: "1", Name: "ref2"},
+			},
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Duplicate(field.NewPath("objectMeta", "ownerReferences").Index(1), metav1.OwnerReference{UID: "1", Name: "ref2"}),
+	})
+
+	// Invalid case: duplicate finalizers
+	st.Value(&Struct{
+		ObjectMeta: metav1.ObjectMeta{
+			Finalizers: []string{"finalizer1", "finalizer1"},
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Duplicate(field.NewPath("objectMeta", "finalizers").Index(1), "finalizer1"),
+	})
+
+	// Invalid case: non-empty labels trigger fixed failure
+	st.Value(&Struct{
+		ObjectMeta: metav1.ObjectMeta{
+			Labels: map[string]string{"key1": "val1"},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"objectMeta.labels": {"labels key error"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/zz_generated.validations.go
new file mode 100644
index 0000000000..de5a185c66
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/zz_generated.validations.go
@@ -0,0 +1,126 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package list
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.ObjectMeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.ObjectMeta,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "labels"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "labels",
+					func(o *v1.ObjectMeta) map[string]string { return o.Labels }, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+						return validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+							func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+								return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "labels key error")
+							})
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			func() { // cohort = "ownerReferences"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "ownerReferences",
+					func(o *v1.ObjectMeta) []v1.OwnerReference { return o.OwnerReferences }, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []v1.OwnerReference) field.ErrorList {
+						return validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+							func(a *v1.OwnerReference, b *v1.OwnerReference) bool { return a.UID == b.UID })
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			func() { // cohort = "finalizers"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "finalizers",
+					func(o *v1.ObjectMeta) []string { return o.Finalizers }, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+						return validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual)
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *v1.ObjectMeta {
+				return &oldObj.ObjectMeta
+			})
+		errs = append(errs, fn(fldPath.Child("objectMeta"), &obj.ObjectMeta, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
+func deepEqualImpl_[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/nonincluded/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/nonincluded/doc.go
new file mode 100644
index 0000000000..d1814e8b60
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/nonincluded/doc.go
@@ -0,0 +1,35 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// Package nonincluded contains test types for testing subfield field validation tags.
+// +k8s:validation-gen-nolint
+package nonincluded
+
+import (
+	"k8s.io/code-generator/cmd/validation-gen/output_tests/_codegenignore/other"
+	"k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	// +k8s:subfield(stringField)=+k8s:validateFalse="subfield Struct.(other.StructType).StringField"
+	// +k8s:opaqueType
+	other.StructType
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/nonincluded/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/nonincluded/doc_test.go
new file mode 100644
index 0000000000..557452e8ef
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/nonincluded/doc_test.go
@@ -0,0 +1,29 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package nonincluded
+
+import (
+	"testing"
+)
+
+func TestSubfieldObjectMetaValidationWithValidateFalse(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{}).ExpectValidateFalseByPath(map[string][]string{
+		"other.StructType.stringField": {"subfield Struct.(other.StructType).StringField"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/nonincluded/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/nonincluded/zz_generated.validations.go
new file mode 100644
index 0000000000..e515fa99e4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/nonincluded/zz_generated.validations.go
@@ -0,0 +1,96 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package nonincluded
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	other "k8s.io/code-generator/cmd/validation-gen/output_tests/_codegenignore/other"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	{ // field Struct.StructType
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *other.StructType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "stringField"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "stringField",
+					func(o *other.StructType) *string { return &o.StringField }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.(other.StructType).StringField")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *other.StructType {
+				return &oldObj.StructType
+			})
+		errs = append(errs, fn(safe.Value(fldPath, func() *field.Path { return fldPath.Child("other.StructType") }), &obj.StructType, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/doc.go
new file mode 100644
index 0000000000..107c92fd0f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/doc.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// Package subfield contains test types for testing subfield field validation tags.
+// +k8s:validation-gen-nolint
+package shallow
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Struct demonstrates validations for subfield fields of structs.
+type Struct struct {
+	TypeMeta int `json:"typeMeta"`
+
+	// +k8s:subfield(stringField)=+k8s:validateFalse="subfield Struct.StructField.StringField 1"
+	// +k8s:subfield(stringField)=+k8s:validateFalse="subfield Struct.StructField.StringField 2"
+	// +k8s:subfield(pointerField)=+k8s:validateFalse="subfield Struct.StructField.PointerField"
+	// +k8s:subfield(structField)=+k8s:validateFalse="subfield Struct.StructField.StructField"
+	// +k8s:subfield(sliceField)=+k8s:validateFalse="subfield Struct.StructField.SliceField"
+	// +k8s:subfield(mapField)=+k8s:validateFalse="subfield Struct.StructField.MapField"
+	StructField OtherStruct `json:"structField"`
+
+	// +k8s:subfield(stringField)=+k8s:validateFalse="subfield Struct.StructPtrField.StringField 1"
+	// +k8s:subfield(stringField)=+k8s:validateFalse="subfield Struct.StructPtrField.StringField 2"
+	// +k8s:subfield(pointerField)=+k8s:validateFalse="subfield Struct.StructPtrField.PointerField"
+	// +k8s:subfield(structField)=+k8s:validateFalse="subfield Struct.StructPtrField.StructField"
+	// +k8s:subfield(sliceField)=+k8s:validateFalse="subfield Struct.StructPtrField.SliceField"
+	// +k8s:subfield(mapField)=+k8s:validateFalse="subfield Struct.StructPtrField.MapField"
+	StructPtrField *OtherStruct `json:"structPtrField"`
+}
+
+type OtherStruct struct {
+	StringField  string            `json:"stringField"`
+	PointerField *string           `json:"pointerField"`
+	StructField  SmallStruct       `json:"structField"`
+	SliceField   []string          `json:"sliceField"`
+	MapField     map[string]string `json:"mapField"`
+}
+
+type SmallStruct struct {
+	StringField string `json:"stringField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/doc_test.go
new file mode 100644
index 0000000000..6bd1d93ea9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/doc_test.go
@@ -0,0 +1,55 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package shallow
+
+import (
+	"testing"
+
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		StructField: OtherStruct{
+			StringField:  "",
+			PointerField: ptr.To(""),
+			StructField:  SmallStruct{},
+			SliceField:   []string{},
+			MapField:     map[string]string{},
+		},
+		StructPtrField: &OtherStruct{
+			StringField:  "",
+			PointerField: ptr.To(""),
+			StructField:  SmallStruct{},
+			SliceField:   []string{},
+			MapField:     map[string]string{},
+		},
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"structField.stringField":     {"subfield Struct.StructField.StringField 1", "subfield Struct.StructField.StringField 2"},
+		"structField.pointerField":    {"subfield Struct.StructField.PointerField"},
+		"structField.structField":     {"subfield Struct.StructField.StructField"},
+		"structField.sliceField":      {"subfield Struct.StructField.SliceField"},
+		"structField.mapField":        {"subfield Struct.StructField.MapField"},
+		"structPtrField.stringField":  {"subfield Struct.StructPtrField.StringField 1", "subfield Struct.StructPtrField.StringField 2"},
+		"structPtrField.pointerField": {"subfield Struct.StructPtrField.PointerField"},
+		"structPtrField.structField":  {"subfield Struct.StructPtrField.StructField"},
+		"structPtrField.sliceField":   {"subfield Struct.StructPtrField.SliceField"},
+		"structPtrField.mapField":     {"subfield Struct.StructPtrField.MapField"},
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/zz_generated.validations.go
new file mode 100644
index 0000000000..d9cf158b01
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/zz_generated.validations.go
@@ -0,0 +1,219 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package shallow
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.StructField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "stringField"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "stringField",
+					func(o *OtherStruct) *string { return &o.StringField }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructField.StringField 1")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "stringField",
+					func(o *OtherStruct) *string { return &o.StringField }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructField.StringField 2")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			func() { // cohort = "pointerField"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "pointerField",
+					func(o *OtherStruct) *string { return o.PointerField }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructField.PointerField")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			func() { // cohort = "structField"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "structField",
+					func(o *OtherStruct) *SmallStruct { return &o.StructField }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *SmallStruct) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructField.StructField")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			func() { // cohort = "sliceField"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "sliceField",
+					func(o *OtherStruct) []string { return o.SliceField }, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructField.SliceField")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			func() { // cohort = "mapField"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "mapField",
+					func(o *OtherStruct) map[string]string { return o.MapField }, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructField.MapField")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *OtherStruct {
+				return &oldObj.StructField
+			})
+		errs = append(errs, fn(fldPath.Child("structField"), &obj.StructField, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.StructPtrField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *OtherStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "stringField"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "stringField",
+					func(o *OtherStruct) *string { return &o.StringField }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructPtrField.StringField 1")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "stringField",
+					func(o *OtherStruct) *string { return &o.StringField }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructPtrField.StringField 2")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			func() { // cohort = "pointerField"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "pointerField",
+					func(o *OtherStruct) *string { return o.PointerField }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructPtrField.PointerField")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			func() { // cohort = "structField"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "structField",
+					func(o *OtherStruct) *SmallStruct { return &o.StructField }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *SmallStruct) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructPtrField.StructField")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			func() { // cohort = "sliceField"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "sliceField",
+					func(o *OtherStruct) []string { return o.SliceField }, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructPtrField.SliceField")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			func() { // cohort = "mapField"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "mapField",
+					func(o *OtherStruct) map[string]string { return o.MapField }, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructPtrField.MapField")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *OtherStruct {
+				return oldObj.StructPtrField
+			})
+		errs = append(errs, fn(fldPath.Child("structPtrField"), obj.StructPtrField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
+func deepEqualImpl_[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/doc.go
new file mode 100644
index 0000000000..c5f2002b6a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/doc.go
@@ -0,0 +1,171 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// Package shortcircuit contains test types for testing subfield short-circuit behavior.
+// +k8s:validation-gen-nolint
+package shortcircuit
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type TargetWithRequired struct {
+	// +k8s:required
+	Value *string `json:"value"`
+}
+
+type TargetWithImmutable struct {
+	// +k8s:immutable
+	Value string `json:"value"`
+	Other string `json:"other"`
+}
+
+type ParentWithRequired struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithRequired.Field.Value"
+	Field TargetWithRequired `json:"field"`
+}
+
+type ParentWithImmutable struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithImmutable.Field.Value"
+	Field TargetWithImmutable `json:"field"`
+}
+
+type ParentWithOpaqueField struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithOpaqueField.Field.Value"
+	// +k8s:opaqueType
+	Field TargetWithRequired `json:"field"`
+}
+
+type ParentWithOpaqueImmutableField struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithOpaqueImmutableField.Field.Value"
+	// +k8s:opaqueType
+	Field TargetWithImmutable `json:"field"`
+}
+
+type ParentWithAlphaOpaqueField struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithAlphaOpaqueField.Field.Value"
+	// +k8s:alpha=+k8s:opaqueType
+	Field TargetWithRequired `json:"field"`
+}
+
+type ParentWithAlphaOpaqueImmutableField struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithAlphaOpaqueImmutableField.Field.Value"
+	// +k8s:alpha=+k8s:opaqueType
+	Field TargetWithImmutable `json:"field"`
+}
+
+// +k8s:opaqueType
+type AliasOpaqueTargetWithRequired TargetWithRequired
+
+type ParentWithOpaqueAlias struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithOpaqueAlias.Field.Value"
+	Field AliasOpaqueTargetWithRequired `json:"field"`
+}
+
+type ParentWithPointerOpaqueAlias struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithPointerOpaqueAlias.Field.Value"
+	Field *AliasOpaqueTargetWithRequired `json:"field"`
+}
+
+// +k8s:opaqueType
+type AliasOpaqueTargetWithImmutable TargetWithImmutable
+
+type ParentWithOpaqueImmutableAlias struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithOpaqueImmutableAlias.Field.Value"
+	Field AliasOpaqueTargetWithImmutable `json:"field"`
+}
+
+type ParentWithMultipleShortCircuit struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:required
+	// +k8s:subfield(value)=+k8s:immutable
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithMultipleShortCircuit.Field.Value"
+	Field *TargetWithRequired `json:"field"`
+}
+
+type TargetWithOptional struct {
+	// +k8s:optional
+	Value *string `json:"value"`
+}
+
+type ParentWithOptional struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithOptional.Field.Value"
+	Field TargetWithOptional `json:"field"`
+}
+
+type ParentWithSubfieldRequiredAndChildOptional struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:subfield(value)=+k8s:required
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithSubfieldRequiredAndChildOptional.Field.Value"
+	Field TargetWithOptional `json:"field"`
+}
+
+type TargetWithForbidden struct {
+	// +k8s:forbidden
+	Value *string `json:"value"`
+}
+
+type ParentWithForbidden struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithForbidden.Field.Value"
+	Field TargetWithForbidden `json:"field"`
+}
+
+type TargetWithUpdate struct {
+	// +k8s:update=NoModify
+	Value string `json:"value"`
+}
+
+type ParentWithUpdate struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithUpdate.Field.Value"
+	Field TargetWithUpdate `json:"field"`
+}
+
+type TargetWithMaxItems struct {
+	// +k8s:maxItems=2
+	Value []string `json:"value"`
+}
+
+type ParentWithMaxItems struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithMaxItems.Field.Value"
+	Field TargetWithMaxItems `json:"field"`
+}
+
+type TargetWithMaxProperties struct {
+	// +k8s:maxProperties=2
+	Value map[string]string `json:"value"`
+}
+
+type ParentWithMaxProperties struct {
+	TypeMeta int `json:"typeMeta"`
+	// +k8s:subfield(value)=+k8s:validateFalse="subfield ParentWithMaxProperties.Field.Value"
+	Field TargetWithMaxProperties `json:"field"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/doc_test.go
new file mode 100644
index 0000000000..06a60dee7a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/doc_test.go
@@ -0,0 +1,448 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package shortcircuit
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestRequiredShortCircuit(t *testing.T) {
+	tests := []struct {
+		name         string
+		value        any
+		expectErrors field.ErrorList
+	}{
+		{
+			name: "required field is nil, short circuits",
+			value: &ParentWithRequired{
+				Field: TargetWithRequired{
+					Value: nil,
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Required(field.NewPath("field", "value"), ""),
+			}.MarkShortCircuit(),
+		},
+		{
+			name: "required field is provided, subfield validation runs",
+			value: &ParentWithRequired{
+				Field: TargetWithRequired{
+					Value: new(""),
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "forced failure: subfield ParentWithRequired.Field.Value").WithOrigin("validateFalse"),
+			},
+		},
+		{
+			name: "opaqueType on field, required check is not inherited, subfield validation runs",
+			value: &ParentWithOpaqueField{
+				Field: TargetWithRequired{
+					Value: nil,
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "forced failure: subfield ParentWithOpaqueField.Field.Value").WithOrigin("validateFalse"),
+			},
+		},
+		{
+			name: "alpha opaqueType on field, required check is not inherited, subfield validation runs",
+			value: &ParentWithAlphaOpaqueField{
+				Field: TargetWithRequired{
+					Value: nil,
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "forced failure: subfield ParentWithAlphaOpaqueField.Field.Value").WithOrigin("validateFalse"),
+			},
+		},
+		{
+			name: "opaqueType on alias, required check is not inherited, subfield validation runs",
+			value: &ParentWithOpaqueAlias{
+				Field: AliasOpaqueTargetWithRequired{
+					Value: nil,
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "forced failure: subfield ParentWithOpaqueAlias.Field.Value").WithOrigin("validateFalse"),
+			},
+		},
+		{
+			name: "opaqueType on pointer alias, required check is not inherited, subfield validation runs",
+			value: &ParentWithPointerOpaqueAlias{
+				Field: &AliasOpaqueTargetWithRequired{
+					Value: nil,
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "forced failure: subfield ParentWithPointerOpaqueAlias.Field.Value").WithOrigin("validateFalse"),
+			},
+		},
+	}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailExact().MatchShortCircuit()
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			st := localSchemeBuilder.Test(t)
+			st.Value(tc.value).ExpectMatches(matcher, tc.expectErrors)
+		})
+	}
+}
+
+func TestImmutableShortCircuit(t *testing.T) {
+	tests := []struct {
+		name         string
+		value        any
+		oldValue     any
+		expectErrors field.ErrorList
+	}{
+		{
+			name: "immutable field changed on update, short circuits",
+			value: &ParentWithImmutable{
+				Field: TargetWithImmutable{
+					Value: "new",
+				},
+			},
+			oldValue: &ParentWithImmutable{
+				Field: TargetWithImmutable{
+					Value: "old",
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), "new", "field is immutable").WithOrigin("immutable"),
+			}.MarkShortCircuit(),
+		},
+		{
+			name: "immutable field not validated on create, subfield validation runs",
+			value: &ParentWithImmutable{
+				Field: TargetWithImmutable{
+					Value: "new",
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "forced failure: subfield ParentWithImmutable.Field.Value").WithOrigin("validateFalse"),
+			},
+		},
+		{
+			name: "opaqueType on field, immutable check is not inherited, subfield validation runs on update",
+			value: &ParentWithOpaqueImmutableField{
+				Field: TargetWithImmutable{
+					Value: "new",
+				},
+			},
+			oldValue: &ParentWithOpaqueImmutableField{
+				Field: TargetWithImmutable{
+					Value: "old",
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "forced failure: subfield ParentWithOpaqueImmutableField.Field.Value").WithOrigin("validateFalse"),
+			},
+		},
+		{
+			name: "alpha opaqueType on field, immutable check is not inherited, subfield validation runs on update",
+			value: &ParentWithAlphaOpaqueImmutableField{
+				Field: TargetWithImmutable{
+					Value: "new",
+				},
+			},
+			oldValue: &ParentWithAlphaOpaqueImmutableField{
+				Field: TargetWithImmutable{
+					Value: "old",
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "forced failure: subfield ParentWithAlphaOpaqueImmutableField.Field.Value").WithOrigin("validateFalse"),
+			},
+		},
+		{
+			name: "opaqueType on alias, immutable check is not inherited, subfield validation runs on update",
+			value: &ParentWithOpaqueImmutableAlias{
+				Field: AliasOpaqueTargetWithImmutable{
+					Value: "new",
+				},
+			},
+			oldValue: &ParentWithOpaqueImmutableAlias{
+				Field: AliasOpaqueTargetWithImmutable{
+					Value: "old",
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "forced failure: subfield ParentWithOpaqueImmutableAlias.Field.Value").WithOrigin("validateFalse"),
+			},
+		},
+	}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailExact().MatchShortCircuit()
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			st := localSchemeBuilder.Test(t)
+			tester := st.Value(tc.value)
+			if tc.oldValue != nil {
+				tester.OldValue(tc.oldValue)
+			}
+			tester.ExpectMatches(matcher, tc.expectErrors)
+		})
+	}
+}
+
+func TestMultipleShortCircuit(t *testing.T) {
+	tests := []struct {
+		name         string
+		value        any
+		oldValue     any
+		expectErrors field.ErrorList
+	}{
+		{
+			name: "required field is nil, short circuits at field level",
+			value: &ParentWithMultipleShortCircuit{
+				Field: nil,
+			},
+			expectErrors: field.ErrorList{
+				field.Required(field.NewPath("field"), ""),
+			}.MarkShortCircuit(),
+		},
+		{
+			name: "immutable subfield changed, short circuits at subfield level on update",
+			value: &ParentWithMultipleShortCircuit{
+				Field: &TargetWithRequired{
+					Value: new("new"),
+				},
+			},
+			oldValue: &ParentWithMultipleShortCircuit{
+				Field: &TargetWithRequired{
+					Value: new("old"),
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), "new", "field is immutable").WithOrigin("immutable"),
+			}.MarkShortCircuit(),
+		},
+		{
+			name: "immutable subfield changed to nil on update, subfield immutable runs before inherited required",
+			value: &ParentWithMultipleShortCircuit{
+				Field: &TargetWithRequired{
+					Value: nil,
+				},
+			},
+			oldValue: &ParentWithMultipleShortCircuit{
+				Field: &TargetWithRequired{
+					Value: new("old"),
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "field is immutable").WithOrigin("immutable"),
+				field.Required(field.NewPath("field", "value"), ""),
+			}.MarkShortCircuit(),
+		},
+		{
+			name: "field is not nil, subfield validation runs on create",
+			value: &ParentWithMultipleShortCircuit{
+				Field: &TargetWithRequired{
+					Value: new("val"),
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "forced failure: subfield ParentWithMultipleShortCircuit.Field.Value").WithOrigin("validateFalse"),
+			},
+		},
+	}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailExact().MatchShortCircuit()
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			st := localSchemeBuilder.Test(t)
+			tester := st.Value(tc.value)
+			if tc.oldValue != nil {
+				tester.OldValue(tc.oldValue)
+			}
+			tester.ExpectMatches(matcher, tc.expectErrors)
+		})
+	}
+}
+
+func TestOtherShortCircuits(t *testing.T) {
+	tests := []struct {
+		name         string
+		value        any
+		oldValue     any
+		expectErrors field.ErrorList
+	}{
+		// +k8s:optional
+		{
+			name: "optional field is nil, short circuits",
+			value: &ParentWithOptional{
+				Field: TargetWithOptional{
+					Value: nil,
+				},
+			},
+			expectErrors: nil,
+		},
+		{
+			name: "optional field is provided, subfield validation runs",
+			value: &ParentWithOptional{
+				Field: TargetWithOptional{
+					Value: new(""),
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "forced failure: subfield ParentWithOptional.Field.Value").WithOrigin("validateFalse"),
+			},
+		},
+
+		// +k8s:required on subfield, +k8s:optional on child
+		{
+			name: "subfield required but value is nil, fails required validation and short circuits (optional child does not prevent it)",
+			value: &ParentWithSubfieldRequiredAndChildOptional{
+				Field: TargetWithOptional{
+					Value: nil,
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Required(field.NewPath("field", "value"), ""),
+			}.MarkShortCircuit(),
+		},
+		{
+			name: "subfield required and value is provided, runs non-short-circuit validation",
+			value: &ParentWithSubfieldRequiredAndChildOptional{
+				Field: TargetWithOptional{
+					Value: new("val"),
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "forced failure: subfield ParentWithSubfieldRequiredAndChildOptional.Field.Value").WithOrigin("validateFalse"),
+			},
+		},
+
+		// +k8s:forbidden
+		{
+			name: "forbidden field is nil, short circuits",
+			value: &ParentWithForbidden{
+				Field: TargetWithForbidden{
+					Value: nil,
+				},
+			},
+			expectErrors: nil,
+		},
+		{
+			name: "forbidden field is provided, fails forbidden validation and short circuits",
+			value: &ParentWithForbidden{
+				Field: TargetWithForbidden{
+					Value: new(""),
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Forbidden(field.NewPath("field", "value"), ""),
+			}.MarkShortCircuit(),
+		},
+
+		// +k8s:update
+		{
+			name: "update field on create, subfield validation runs",
+			value: &ParentWithUpdate{
+				Field: TargetWithUpdate{
+					Value: "any",
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "forced failure: subfield ParentWithUpdate.Field.Value").WithOrigin("validateFalse"),
+			},
+		},
+		{
+			name: "update field modified on update, fails update validation and short circuits",
+			value: &ParentWithUpdate{
+				Field: TargetWithUpdate{
+					Value: "new",
+				},
+			},
+			oldValue: &ParentWithUpdate{
+				Field: TargetWithUpdate{
+					Value: "old",
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), "new", "field cannot be modified once set").WithOrigin("update"),
+			}.MarkShortCircuit(),
+		},
+
+		// +k8s:maxItems
+		{
+			name: "maxItems field within limit, subfield validation runs",
+			value: &ParentWithMaxItems{
+				Field: TargetWithMaxItems{
+					Value: []string{"a", "b"},
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "forced failure: subfield ParentWithMaxItems.Field.Value").WithOrigin("validateFalse"),
+			},
+		},
+		{
+			name: "maxItems field exceeds limit, fails maxItems validation and short circuits",
+			value: &ParentWithMaxItems{
+				Field: TargetWithMaxItems{
+					Value: []string{"a", "b", "c"},
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.TooMany(field.NewPath("field", "value"), 3, 2).WithOrigin("maxItems"),
+			}.MarkShortCircuit(),
+		},
+
+		// +k8s:maxProperties
+		{
+			name: "maxProperties field within limit, subfield validation runs",
+			value: &ParentWithMaxProperties{
+				Field: TargetWithMaxProperties{
+					Value: map[string]string{"a": "1", "b": "2"},
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.Invalid(field.NewPath("field", "value"), nil, "forced failure: subfield ParentWithMaxProperties.Field.Value").WithOrigin("validateFalse"),
+			},
+		},
+		{
+			name: "maxProperties field exceeds limit, fails maxProperties validation and short circuits",
+			value: &ParentWithMaxProperties{
+				Field: TargetWithMaxProperties{
+					Value: map[string]string{"a": "1", "b": "2", "c": "3"},
+				},
+			},
+			expectErrors: field.ErrorList{
+				field.TooMany(field.NewPath("field", "value"), 3, 2).WithOrigin("maxProperties"),
+			}.MarkShortCircuit(),
+		},
+	}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailExact().MatchShortCircuit()
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			st := localSchemeBuilder.Test(t)
+			tester := st.Value(tc.value)
+			if tc.oldValue != nil {
+				tester.OldValue(tc.oldValue)
+			}
+			tester.ExpectMatches(matcher, tc.expectErrors)
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/zz_generated.validations.go
new file mode 100644
index 0000000000..2c0282191a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/zz_generated.validations.go
@@ -0,0 +1,1335 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package shortcircuit
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type ParentWithAlphaOpaqueField
+	scheme.AddValidationFunc(
+		(*ParentWithAlphaOpaqueField)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithAlphaOpaqueField(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithAlphaOpaqueField),
+					safe.Cast[*ParentWithAlphaOpaqueField](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithAlphaOpaqueImmutableField
+	scheme.AddValidationFunc(
+		(*ParentWithAlphaOpaqueImmutableField)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithAlphaOpaqueImmutableField(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithAlphaOpaqueImmutableField),
+					safe.Cast[*ParentWithAlphaOpaqueImmutableField](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithForbidden
+	scheme.AddValidationFunc(
+		(*ParentWithForbidden)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithForbidden(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithForbidden),
+					safe.Cast[*ParentWithForbidden](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithImmutable
+	scheme.AddValidationFunc(
+		(*ParentWithImmutable)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithImmutable(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithImmutable),
+					safe.Cast[*ParentWithImmutable](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithMaxItems
+	scheme.AddValidationFunc(
+		(*ParentWithMaxItems)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithMaxItems(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithMaxItems),
+					safe.Cast[*ParentWithMaxItems](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithMaxProperties
+	scheme.AddValidationFunc(
+		(*ParentWithMaxProperties)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithMaxProperties(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithMaxProperties),
+					safe.Cast[*ParentWithMaxProperties](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithMultipleShortCircuit
+	scheme.AddValidationFunc(
+		(*ParentWithMultipleShortCircuit)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithMultipleShortCircuit(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithMultipleShortCircuit),
+					safe.Cast[*ParentWithMultipleShortCircuit](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithOpaqueAlias
+	scheme.AddValidationFunc(
+		(*ParentWithOpaqueAlias)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithOpaqueAlias(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithOpaqueAlias),
+					safe.Cast[*ParentWithOpaqueAlias](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithOpaqueField
+	scheme.AddValidationFunc(
+		(*ParentWithOpaqueField)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithOpaqueField(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithOpaqueField),
+					safe.Cast[*ParentWithOpaqueField](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithOpaqueImmutableAlias
+	scheme.AddValidationFunc(
+		(*ParentWithOpaqueImmutableAlias)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithOpaqueImmutableAlias(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithOpaqueImmutableAlias),
+					safe.Cast[*ParentWithOpaqueImmutableAlias](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithOpaqueImmutableField
+	scheme.AddValidationFunc(
+		(*ParentWithOpaqueImmutableField)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithOpaqueImmutableField(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithOpaqueImmutableField),
+					safe.Cast[*ParentWithOpaqueImmutableField](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithOptional
+	scheme.AddValidationFunc(
+		(*ParentWithOptional)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithOptional(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithOptional),
+					safe.Cast[*ParentWithOptional](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithPointerOpaqueAlias
+	scheme.AddValidationFunc(
+		(*ParentWithPointerOpaqueAlias)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithPointerOpaqueAlias(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithPointerOpaqueAlias),
+					safe.Cast[*ParentWithPointerOpaqueAlias](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithRequired
+	scheme.AddValidationFunc(
+		(*ParentWithRequired)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithRequired(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithRequired),
+					safe.Cast[*ParentWithRequired](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithSubfieldRequiredAndChildOptional
+	scheme.AddValidationFunc(
+		(*ParentWithSubfieldRequiredAndChildOptional)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithSubfieldRequiredAndChildOptional(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithSubfieldRequiredAndChildOptional),
+					safe.Cast[*ParentWithSubfieldRequiredAndChildOptional](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type ParentWithUpdate
+	scheme.AddValidationFunc(
+		(*ParentWithUpdate)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_ParentWithUpdate(
+					ctx, op, nil, /* fldPath */
+					obj.(*ParentWithUpdate),
+					safe.Cast[*ParentWithUpdate](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_ParentWithAlphaOpaqueField validates an instance of ParentWithAlphaOpaqueField according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithAlphaOpaqueField(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithAlphaOpaqueField) (errs field.ErrorList) {
+
+	// field ParentWithAlphaOpaqueField.TypeMeta has no validation
+
+	{ // field ParentWithAlphaOpaqueField.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TargetWithRequired,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "value"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithRequired) *string { return o.Value }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithAlphaOpaqueField.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithAlphaOpaqueField) *TargetWithRequired {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithAlphaOpaqueImmutableField validates an instance of ParentWithAlphaOpaqueImmutableField according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithAlphaOpaqueImmutableField(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithAlphaOpaqueImmutableField) (errs field.ErrorList) {
+
+	// field ParentWithAlphaOpaqueImmutableField.TypeMeta has no validation
+
+	{ // field ParentWithAlphaOpaqueImmutableField.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TargetWithImmutable,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "value"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithImmutable) *string { return &o.Value }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithAlphaOpaqueImmutableField.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithAlphaOpaqueImmutableField) *TargetWithImmutable {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithForbidden validates an instance of ParentWithForbidden according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithForbidden(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithForbidden) (errs field.ErrorList) {
+
+	// field ParentWithForbidden.TypeMeta has no validation
+
+	{ // field ParentWithForbidden.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TargetWithForbidden,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "value"
+				earlyReturn := false
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithForbidden) *string { return o.Value }, validate.DirectEqual, validate.ForbiddenPointer).MarkShortCircuit(); len(e) != 0 {
+					earlyReturn = true
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithForbidden) *string { return o.Value }, validate.DirectEqual, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+					earlyReturn = true
+				}
+				if earlyReturn {
+					return // do not proceed
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithForbidden) *string { return o.Value }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithForbidden.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			// call the type's validation function
+			errs = append(errs, Validate_TargetWithForbidden(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithForbidden) *TargetWithForbidden {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithImmutable validates an instance of ParentWithImmutable according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithImmutable(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithImmutable) (errs field.ErrorList) {
+
+	// field ParentWithImmutable.TypeMeta has no validation
+
+	{ // field ParentWithImmutable.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TargetWithImmutable,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "value"
+				earlyReturn := false
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithImmutable) *string { return &o.Value }, validate.DirectEqual, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+					earlyReturn = true
+				}
+				if earlyReturn {
+					return // do not proceed
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithImmutable) *string { return &o.Value }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithImmutable.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			// call the type's validation function
+			errs = append(errs, Validate_TargetWithImmutable(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithImmutable) *TargetWithImmutable {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithMaxItems validates an instance of ParentWithMaxItems according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithMaxItems(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithMaxItems) (errs field.ErrorList) {
+
+	// field ParentWithMaxItems.TypeMeta has no validation
+
+	{ // field ParentWithMaxItems.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TargetWithMaxItems,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "value"
+				earlyReturn := false
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithMaxItems) []string { return o.Value }, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+						return validate.MaxItems(ctx, op, fldPath, obj, oldObj, 2)
+					}).MarkShortCircuit(); len(e) != 0 {
+					earlyReturn = true
+				}
+				if earlyReturn {
+					return // do not proceed
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithMaxItems) []string { return o.Value }, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithMaxItems.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			// call the type's validation function
+			errs = append(errs, Validate_TargetWithMaxItems(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithMaxItems) *TargetWithMaxItems {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithMaxProperties validates an instance of ParentWithMaxProperties according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithMaxProperties(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithMaxProperties) (errs field.ErrorList) {
+
+	// field ParentWithMaxProperties.TypeMeta has no validation
+
+	{ // field ParentWithMaxProperties.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TargetWithMaxProperties,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "value"
+				earlyReturn := false
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithMaxProperties) map[string]string { return o.Value }, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+						return validate.MaxProperties(ctx, op, fldPath, obj, oldObj, 2)
+					}).MarkShortCircuit(); len(e) != 0 {
+					earlyReturn = true
+				}
+				if earlyReturn {
+					return // do not proceed
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithMaxProperties) map[string]string { return o.Value }, deepEqualImpl_,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithMaxProperties.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			// call the type's validation function
+			errs = append(errs, Validate_TargetWithMaxProperties(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithMaxProperties) *TargetWithMaxProperties {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithMultipleShortCircuit validates an instance of ParentWithMultipleShortCircuit according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithMultipleShortCircuit(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithMultipleShortCircuit) (errs field.ErrorList) {
+
+	// field ParentWithMultipleShortCircuit.TypeMeta has no validation
+
+	{ // field ParentWithMultipleShortCircuit.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TargetWithRequired,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			func() { // cohort = "value"
+				earlyReturn := false
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithRequired) *string { return o.Value }, validate.DirectEqual, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+					errs = append(errs, e...)
+					earlyReturn = true
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithRequired) *string { return o.Value }, validate.DirectEqual, validate.RequiredPointer).MarkShortCircuit(); len(e) != 0 {
+					earlyReturn = true
+				}
+				if earlyReturn {
+					return // do not proceed
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithRequired) *string { return o.Value }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithMultipleShortCircuit.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			// call the type's validation function
+			errs = append(errs, Validate_TargetWithRequired(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithMultipleShortCircuit) *TargetWithRequired {
+				return oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithOpaqueAlias validates an instance of ParentWithOpaqueAlias according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithOpaqueAlias(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithOpaqueAlias) (errs field.ErrorList) {
+
+	// field ParentWithOpaqueAlias.TypeMeta has no validation
+
+	{ // field ParentWithOpaqueAlias.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *AliasOpaqueTargetWithRequired,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "value"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *AliasOpaqueTargetWithRequired) *string { return o.Value }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithOpaqueAlias.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithOpaqueAlias) *AliasOpaqueTargetWithRequired {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithOpaqueField validates an instance of ParentWithOpaqueField according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithOpaqueField(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithOpaqueField) (errs field.ErrorList) {
+
+	// field ParentWithOpaqueField.TypeMeta has no validation
+
+	{ // field ParentWithOpaqueField.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TargetWithRequired,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "value"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithRequired) *string { return o.Value }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithOpaqueField.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithOpaqueField) *TargetWithRequired {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithOpaqueImmutableAlias validates an instance of ParentWithOpaqueImmutableAlias according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithOpaqueImmutableAlias(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithOpaqueImmutableAlias) (errs field.ErrorList) {
+
+	// field ParentWithOpaqueImmutableAlias.TypeMeta has no validation
+
+	{ // field ParentWithOpaqueImmutableAlias.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *AliasOpaqueTargetWithImmutable,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "value"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *AliasOpaqueTargetWithImmutable) *string { return &o.Value }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithOpaqueImmutableAlias.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithOpaqueImmutableAlias) *AliasOpaqueTargetWithImmutable {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithOpaqueImmutableField validates an instance of ParentWithOpaqueImmutableField according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithOpaqueImmutableField(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithOpaqueImmutableField) (errs field.ErrorList) {
+
+	// field ParentWithOpaqueImmutableField.TypeMeta has no validation
+
+	{ // field ParentWithOpaqueImmutableField.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TargetWithImmutable,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "value"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithImmutable) *string { return &o.Value }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithOpaqueImmutableField.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithOpaqueImmutableField) *TargetWithImmutable {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithOptional validates an instance of ParentWithOptional according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithOptional(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithOptional) (errs field.ErrorList) {
+
+	// field ParentWithOptional.TypeMeta has no validation
+
+	{ // field ParentWithOptional.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TargetWithOptional,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "value"
+				earlyReturn := false
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithOptional) *string { return o.Value }, validate.DirectEqual, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+					earlyReturn = true
+				}
+				if earlyReturn {
+					return // do not proceed
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithOptional) *string { return o.Value }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithOptional.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			// call the type's validation function
+			errs = append(errs, Validate_TargetWithOptional(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithOptional) *TargetWithOptional {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithPointerOpaqueAlias validates an instance of ParentWithPointerOpaqueAlias according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithPointerOpaqueAlias(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithPointerOpaqueAlias) (errs field.ErrorList) {
+
+	// field ParentWithPointerOpaqueAlias.TypeMeta has no validation
+
+	{ // field ParentWithPointerOpaqueAlias.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *AliasOpaqueTargetWithRequired,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "value"
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *AliasOpaqueTargetWithRequired) *string { return o.Value }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithPointerOpaqueAlias.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithPointerOpaqueAlias) *AliasOpaqueTargetWithRequired {
+				return oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithRequired validates an instance of ParentWithRequired according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithRequired(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithRequired) (errs field.ErrorList) {
+
+	// field ParentWithRequired.TypeMeta has no validation
+
+	{ // field ParentWithRequired.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TargetWithRequired,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "value"
+				earlyReturn := false
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithRequired) *string { return o.Value }, validate.DirectEqual, validate.RequiredPointer).MarkShortCircuit(); len(e) != 0 {
+					earlyReturn = true
+				}
+				if earlyReturn {
+					return // do not proceed
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithRequired) *string { return o.Value }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithRequired.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			// call the type's validation function
+			errs = append(errs, Validate_TargetWithRequired(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithRequired) *TargetWithRequired {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithSubfieldRequiredAndChildOptional validates an instance of ParentWithSubfieldRequiredAndChildOptional according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithSubfieldRequiredAndChildOptional(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithSubfieldRequiredAndChildOptional) (errs field.ErrorList) {
+
+	// field ParentWithSubfieldRequiredAndChildOptional.TypeMeta has no validation
+
+	{ // field ParentWithSubfieldRequiredAndChildOptional.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TargetWithOptional,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "value"
+				earlyReturn := false
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithOptional) *string { return o.Value }, validate.DirectEqual, validate.RequiredPointer).MarkShortCircuit(); len(e) != 0 {
+					errs = append(errs, e...)
+					earlyReturn = true
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithOptional) *string { return o.Value }, validate.DirectEqual, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+					earlyReturn = true
+				}
+				if earlyReturn {
+					return // do not proceed
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithOptional) *string { return o.Value }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithSubfieldRequiredAndChildOptional.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			// call the type's validation function
+			errs = append(errs, Validate_TargetWithOptional(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithSubfieldRequiredAndChildOptional) *TargetWithOptional {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ParentWithUpdate validates an instance of ParentWithUpdate according
+// to declarative validation rules in the API schema.
+func Validate_ParentWithUpdate(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ParentWithUpdate) (errs field.ErrorList) {
+
+	// field ParentWithUpdate.TypeMeta has no validation
+
+	{ // field ParentWithUpdate.Field
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TargetWithUpdate,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			func() { // cohort = "value"
+				earlyReturn := false
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithUpdate) *string { return &o.Value }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+							func(a string, b string) bool { return a == b }, validate.NoModify)
+					}).MarkShortCircuit(); len(e) != 0 {
+					earlyReturn = true
+				}
+				if earlyReturn {
+					return // do not proceed
+				}
+				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+					func(o *TargetWithUpdate) *string { return &o.Value }, validate.DirectEqual,
+					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithUpdate.Field.Value")
+					}); len(e) != 0 {
+					errs = append(errs, e...)
+				}
+			}()
+			// call the type's validation function
+			errs = append(errs, Validate_TargetWithUpdate(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ParentWithUpdate) *TargetWithUpdate {
+				return &oldObj.Field
+			})
+		errs = append(errs, fn(fldPath.Child("field"), &obj.Field, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_TargetWithForbidden validates an instance of TargetWithForbidden according
+// to declarative validation rules in the API schema.
+func Validate_TargetWithForbidden(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *TargetWithForbidden) (errs field.ErrorList) {
+
+	{ // field TargetWithForbidden.Value
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *TargetWithForbidden) *string {
+				return oldObj.Value
+			})
+		errs = append(errs, fn(fldPath.Child("value"), obj.Value, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_TargetWithImmutable validates an instance of TargetWithImmutable according
+// to declarative validation rules in the API schema.
+func Validate_TargetWithImmutable(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *TargetWithImmutable) (errs field.ErrorList) {
+
+	{ // field TargetWithImmutable.Value
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *TargetWithImmutable) *string {
+				return &oldObj.Value
+			})
+		errs = append(errs, fn(fldPath.Child("value"), &obj.Value, oldVal, oldObj != nil)...)
+	}
+
+	// field TargetWithImmutable.Other has no validation
+	return errs
+}
+
+// Validate_TargetWithMaxItems validates an instance of TargetWithMaxItems according
+// to declarative validation rules in the API schema.
+func Validate_TargetWithMaxItems(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *TargetWithMaxItems) (errs field.ErrorList) {
+
+	{ // field TargetWithMaxItems.Value
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 2).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *TargetWithMaxItems) []string {
+				return oldObj.Value
+			})
+		errs = append(errs, fn(fldPath.Child("value"), obj.Value, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_TargetWithMaxProperties validates an instance of TargetWithMaxProperties according
+// to declarative validation rules in the API schema.
+func Validate_TargetWithMaxProperties(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *TargetWithMaxProperties) (errs field.ErrorList) {
+
+	{ // field TargetWithMaxProperties.Value
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxProperties(ctx, op, fldPath, obj, oldObj, 2).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *TargetWithMaxProperties) map[string]string {
+				return oldObj.Value
+			})
+		errs = append(errs, fn(fldPath.Child("value"), obj.Value, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_TargetWithOptional validates an instance of TargetWithOptional according
+// to declarative validation rules in the API schema.
+func Validate_TargetWithOptional(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *TargetWithOptional) (errs field.ErrorList) {
+
+	{ // field TargetWithOptional.Value
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *TargetWithOptional) *string {
+				return oldObj.Value
+			})
+		errs = append(errs, fn(fldPath.Child("value"), obj.Value, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_TargetWithRequired validates an instance of TargetWithRequired according
+// to declarative validation rules in the API schema.
+func Validate_TargetWithRequired(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *TargetWithRequired) (errs field.ErrorList) {
+
+	{ // field TargetWithRequired.Value
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *TargetWithRequired) *string {
+				return oldObj.Value
+			})
+		errs = append(errs, fn(fldPath.Child("value"), obj.Value, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_TargetWithUpdate validates an instance of TargetWithUpdate according
+// to declarative validation rules in the API schema.
+func Validate_TargetWithUpdate(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *TargetWithUpdate) (errs field.ErrorList) {
+
+	{ // field TargetWithUpdate.Value
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a string, b string) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *TargetWithUpdate) *string {
+				return &oldObj.Value
+			})
+		errs = append(errs, fn(fldPath.Child("value"), &obj.Value, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
+func deepEqualImpl_[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/unions/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/unions/doc.go
new file mode 100644
index 0000000000..82a21b8b90
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/unions/doc.go
@@ -0,0 +1,43 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// Package unions contains test types for testing subfield union validation tags.
+// +k8s:validation-gen-nolint
+package unions
+
+import (
+	"k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int `json:"typeMeta"`
+
+	// +k8s:subfield(d)=+k8s:unionDiscriminator
+	// +k8s:subfield(m1)=+k8s:unionMember
+	// +k8s:subfield(m2)=+k8s:unionMember
+	Subfield SubStruct `json:"subfield"`
+}
+
+type SubStruct struct {
+	D  string `json:"d"`
+	M1 *int   `json:"m1,omitempty"`
+	M2 *int   `json:"m2,omitempty"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/unions/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/unions/doc_test.go
new file mode 100644
index 0000000000..6a2a9eb3b6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/unions/doc_test.go
@@ -0,0 +1,66 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unions
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestStructValidation(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Valid case: D is M1, M1 is set
+	st.Value(&Struct{
+		Subfield: SubStruct{
+			D:  "M1",
+			M1: ptr.To(1),
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{})
+
+	// Valid case: D is M2, M2 is set
+	st.Value(&Struct{
+		Subfield: SubStruct{
+			D:  "M2",
+			M2: ptr.To(1),
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{})
+
+	// Invalid case: D is M1, but M2 is set
+	st.Value(&Struct{
+		Subfield: SubStruct{
+			D:  "M1",
+			M2: ptr.To(1),
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("subfield", "m1"), "", "must be specified when `d` is \"M1\"").WithOrigin("union"),
+		field.Invalid(field.NewPath("subfield", "m2"), "", "may only be specified when `d` is \"M2\"").WithOrigin("union"),
+	})
+
+	// Invalid case: D is M1, and BOTH are set
+	st.Value(&Struct{
+		Subfield: SubStruct{
+			D:  "M1",
+			M1: ptr.To(1),
+			M2: ptr.To(1),
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("subfield", "m2"), "", "may only be specified when `d` is \"M2\"").WithOrigin("union"),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/unions/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/unions/zz_generated.validations.go
new file mode 100644
index 0000000000..9362b007c9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/unions/zz_generated.validations.go
@@ -0,0 +1,112 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package unions
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_subfield_unions_Struct_subfield_ = validate.NewDiscriminatedUnionMembership("d", validate.NewDiscriminatedUnionMember("m1", "M1"), validate.NewDiscriminatedUnionMember("m2", "M2"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.Subfield
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *SubStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.DiscriminatedUnion(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_subfield_unions_Struct_subfield_,
+				func(obj *SubStruct) string {
+					if obj == nil {
+						return ""
+					}
+					return string(obj.D)
+				},
+				func(obj *SubStruct) bool {
+					if obj == nil {
+						return false
+					}
+					return obj.M1 != nil
+				},
+				func(obj *SubStruct) bool {
+					if obj == nil {
+						return false
+					}
+					return obj.M2 != nil
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *SubStruct {
+				return &oldObj.Subfield
+			})
+		errs = append(errs, fn(fldPath.Child("subfield"), &obj.Subfield, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/issubresource/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/issubresource/doc.go
new file mode 100644
index 0000000000..df6c6a5519
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/issubresource/doc.go
@@ -0,0 +1,37 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Note: this selects all types in the package.
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package issubresource
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Root resource is supported by default
+
+// +k8s:isSubresource="/scale"
+
+// T1 is a test type
+type T1 struct {
+	// +k8s:validateTrue="field T1.S"
+	S string `json:"s"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/issubresource/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/issubresource/doc_test.go
new file mode 100644
index 0000000000..0dbe831864
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/issubresource/doc_test.go
@@ -0,0 +1,39 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package issubresource
+
+import (
+	"fmt"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestRegisterValidations(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	t1 := &T1{}
+	st.Value(t1).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.InternalError(nil, fmt.Errorf("")),
+	})
+
+	st.Value(t1).Subresources([]string{"scale"}).ExpectValid()
+
+	st.Value(t1).Subresources([]string{"unknown"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.InternalError(nil, fmt.Errorf("")),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/issubresource/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/issubresource/zz_generated.validations.go
new file mode 100644
index 0000000000..ef2be6dc5f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/issubresource/zz_generated.validations.go
@@ -0,0 +1,89 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package issubresource
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/scale":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	{ // field T1.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/root/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/root/doc.go
new file mode 100644
index 0000000000..ee0d2c610a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/root/doc.go
@@ -0,0 +1,37 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Note: this selects all types in the package.
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package root
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// This tests that without any +k8s:supportsSubresource or +k8s:isSubresource tags,
+// that the validation of both the root resource is allowed and validation of all
+// subresources fails with an error.
+
+// T1 is a test type
+type T1 struct {
+	// +k8s:validateTrue="field T1.S"
+	S string `json:"s"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/root/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/root/doc_test.go
new file mode 100644
index 0000000000..cceeda6dca
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/root/doc_test.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package root
+
+import (
+	"fmt"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestRegisterValidations(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	t1 := &T1{}
+
+	st.Value(t1).ExpectValid()
+
+	st.Value(t1).Subresources([]string{"scale"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.InternalError(nil, fmt.Errorf("")),
+	})
+
+	st.Value(t1).Subresources([]string{"x", "y"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.InternalError(nil, fmt.Errorf("")),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/root/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/root/zz_generated.validations.go
new file mode 100644
index 0000000000..b7755f0702
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/root/zz_generated.validations.go
@@ -0,0 +1,89 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package root
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	{ // field T1.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/subresource/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/subresource/doc.go
new file mode 100644
index 0000000000..5b4289316d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/subresource/doc.go
@@ -0,0 +1,39 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Note: this selects all types in the package.
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package subresource
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Root resource is supported by default
+
+// +k8s:supportsSubresource="/status"
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/x/y"
+
+// T1 is a test type
+type T1 struct {
+	// +k8s:validateTrue="field T1.S"
+	S string `json:"s"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/subresource/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/subresource/doc_test.go
new file mode 100644
index 0000000000..8bf631a70e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/subresource/doc_test.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package subresource
+
+import (
+	"fmt"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestRegisterValidations(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	t1 := &T1{}
+
+	st.Value(t1).ExpectValid()
+
+	st.Value(t1).Subresources([]string{"status"}).ExpectValid()
+	st.Value(t1).Subresources([]string{"scale"}).ExpectValid()
+	st.Value(t1).Subresources([]string{"x", "y"}).ExpectValid()
+
+	st.Value(t1).Subresources([]string{"status", "unknown"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.InternalError(nil, fmt.Errorf("")),
+	})
+
+	st.Value(t1).Subresources([]string{"unknown"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.InternalError(nil, fmt.Errorf("")),
+	})
+	st.Value(t1).Subresources([]string{"x", "unknown"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.InternalError(nil, fmt.Errorf("")),
+	})
+	st.Value(t1).Subresources([]string{"x", "y", "unknown"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.InternalError(nil, fmt.Errorf("")),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/subresource/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/subresource/zz_generated.validations.go
new file mode 100644
index 0000000000..8b847e8abc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/supported_resources/subresource/zz_generated.validations.go
@@ -0,0 +1,89 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package subresource
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/", "/scale", "/status", "/x/y":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	{ // field T1.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field T1.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/custom_members/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/custom_members/doc.go
new file mode 100644
index 0000000000..3de417aef6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/custom_members/doc.go
@@ -0,0 +1,53 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package custommembers
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Discriminated union with custom member names
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:unionDiscriminator
+	D D `json:"d"`
+
+	// +k8s:unionMember(memberName: "CustomM1")
+	// +k8s:optional
+	M1 *M1 `json:"m1"`
+
+	// +k8s:unionMember(memberName: "CustomM2")
+	// +k8s:optional
+	M2 *M2 `json:"m2"`
+}
+
+type D string
+
+const (
+	DM1 D = "CustomM1"
+	DM2 D = "CustomM2"
+)
+
+type M1 struct{}
+
+type M2 struct{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/custom_members/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/custom_members/doc_test.go
new file mode 100644
index 0000000000..ce7fe0425c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/custom_members/doc_test.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package custommembers
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{D: DM1, M1: &M1{}}).ExpectValid()
+	st.Value(&Struct{D: DM2, M2: &M2{}}).ExpectValid()
+
+	st.Value(&Struct{D: DM2, M1: &M1{}, M2: &M2{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("m1"), nil, "may only be specified when"),
+	}.WithOrigin("union"))
+
+	st.Value(&Struct{D: DM1}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("m1"), nil, "must be specified when"),
+	}.WithOrigin("union"))
+
+	// Test validation ratcheting
+	st.Value(&Struct{D: DM2, M1: &M1{}, M2: &M2{}}).OldValue(&Struct{D: DM2, M1: &M1{}, M2: &M2{}}).ExpectValid()
+	st.Value(&Struct{D: DM1}).OldValue(&Struct{D: DM1}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/custom_members/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/custom_members/zz_generated.validations.go
new file mode 100644
index 0000000000..761bcaf83d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/custom_members/zz_generated.validations.go
@@ -0,0 +1,148 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package custommembers
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_discriminated_custom_members_Struct_ = validate.NewDiscriminatedUnionMembership("d", validate.NewDiscriminatedUnionMember("m1", "CustomM1"), validate.NewDiscriminatedUnionMember("m2", "CustomM2"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.DiscriminatedUnion(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_discriminated_custom_members_Struct_,
+		func(obj *Struct) string {
+			if obj == nil {
+				return ""
+			}
+			return string(obj.D)
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M1 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M2 != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+	// field Struct.D has no validation
+
+	{ // field Struct.M1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M1 {
+				return oldObj.M1
+			})
+		errs = append(errs, fn(fldPath.Child("m1"), obj.M1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.M2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M2 {
+				return oldObj.M2
+			})
+		errs = append(errs, fn(fldPath.Child("m2"), obj.M2, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/empty/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/empty/doc.go
new file mode 100644
index 0000000000..7fdcdd06c1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/empty/doc.go
@@ -0,0 +1,36 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package empty
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Empty discriminated union
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:unionDiscriminator
+	D D `json:"d"`
+}
+
+type D string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/empty/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/empty/doc_test.go
new file mode 100644
index 0000000000..55d5877675
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/empty/doc_test.go
@@ -0,0 +1,31 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package empty
+
+import (
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Unions discriminators may be optional.
+	st.Value(&Struct{D: D("")}).ExpectValid()
+
+	// Unions discriminators Should be validated for valid values.
+	st.Value(&Struct{D: D("Unknown")}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/empty/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/empty/zz_generated.validations.go
new file mode 100644
index 0000000000..bb569cc741
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/empty/zz_generated.validations.go
@@ -0,0 +1,22 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package empty
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/multiple/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/multiple/doc.go
new file mode 100644
index 0000000000..0aedae327d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/multiple/doc.go
@@ -0,0 +1,66 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package multiple
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Two discriminated unions in the same struct
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:unionDiscriminator(union: "union1")
+	D1 D `json:"d1"`
+
+	// +k8s:unionMember(union: "union1")
+	// +k8s:optional
+	U1M1 *M1 `json:"u1m1"`
+
+	// +k8s:unionMember(union: "union1")
+	// +k8s:optional
+	U1M2 *M2 `json:"u1m2"`
+
+	// +k8s:unionDiscriminator(union: "union2")
+	D2 D `json:"d2"`
+
+	// +k8s:unionMember(union: "union2")
+	// +k8s:optional
+	U2M1 *M1 `json:"u2m1"`
+
+	// +k8s:unionMember(union: "union2")
+	// +k8s:optional
+	U2M2 *M2 `json:"u2m2"`
+}
+
+type D string
+
+const (
+	U1M1 D = "U1M1"
+	U1M2 D = "U1M2"
+	U2M1 D = "U2M1"
+	U2M2 D = "U2M2"
+)
+
+type M1 struct{}
+
+type M2 struct{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/multiple/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/multiple/doc_test.go
new file mode 100644
index 0000000000..3cb1e0c404
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/multiple/doc_test.go
@@ -0,0 +1,88 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package multiple
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{}).ExpectValid()
+
+	st.Value(&Struct{
+		D1: U1M1, U1M1: &M1{},
+		D2: U2M1, U2M1: &M1{},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		D1: U1M2, U1M2: &M2{},
+		D2: U2M2, U2M2: &M2{},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		D1: U1M2, U1M1: &M1{}, U1M2: &M2{},
+		D2: U2M2, // no value
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("u1m1"), nil, "may only be specified when"),
+		field.Invalid(field.NewPath("u2m2"), nil, "must be specified when"),
+	}.WithOrigin("union"))
+
+	st.Value(&Struct{
+		D1: U1M2, // no value
+		D2: U2M2, U2M1: &M1{}, U2M2: &M2{},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("u1m2"), nil, "must be specified when"),
+		field.Invalid(field.NewPath("u2m1"), nil, "may only be specified when"),
+	}.WithOrigin("union"))
+
+	st.Value(&Struct{
+		D1: U1M2, // no value
+		D2: U2M2, // no value
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("u1m2"), nil, "must be specified when"),
+		field.Invalid(field.NewPath("u2m2"), nil, "must be specified when"),
+	}.WithOrigin("union"))
+
+	// Test validation ratcheting
+	st.Value(&Struct{
+		D1: U1M2, U1M1: &M1{}, U1M2: &M2{},
+		D2: U2M2, // no value
+	}).OldValue(&Struct{
+		D1: U1M2, U1M1: &M1{}, U1M2: &M2{},
+		D2: U2M2, // no value
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		D1: U1M2, // no value
+		D2: U2M2, U2M1: &M1{}, U2M2: &M2{},
+	}).OldValue(&Struct{
+		D1: U1M2, // no value
+		D2: U2M2, U2M1: &M1{}, U2M2: &M2{},
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		D1: U1M2, // no value
+		D2: U2M2, // no value
+	}).OldValue(&Struct{
+		D1: U1M2, // no value
+		D2: U2M2, // no value
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/multiple/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/multiple/zz_generated.validations.go
new file mode 100644
index 0000000000..6833e3b387
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/multiple/zz_generated.validations.go
@@ -0,0 +1,228 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package multiple
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_discriminated_multiple_Struct_union1 = validate.NewDiscriminatedUnionMembership("d1", validate.NewDiscriminatedUnionMember("u1m1", "U1M1"), validate.NewDiscriminatedUnionMember("u1m2", "U1M2"))
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_discriminated_multiple_Struct_union2 = validate.NewDiscriminatedUnionMembership("d2", validate.NewDiscriminatedUnionMember("u2m1", "U2M1"), validate.NewDiscriminatedUnionMember("u2m2", "U2M2"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.DiscriminatedUnion(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_discriminated_multiple_Struct_union1,
+		func(obj *Struct) string {
+			if obj == nil {
+				return ""
+			}
+			return string(obj.D1)
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.U1M1 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.U1M2 != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.DiscriminatedUnion(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_discriminated_multiple_Struct_union2,
+		func(obj *Struct) string {
+			if obj == nil {
+				return ""
+			}
+			return string(obj.D2)
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.U2M1 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.U2M2 != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+	// field Struct.D1 has no validation
+
+	{ // field Struct.U1M1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M1 {
+				return oldObj.U1M1
+			})
+		errs = append(errs, fn(fldPath.Child("u1m1"), obj.U1M1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.U1M2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M2 {
+				return oldObj.U1M2
+			})
+		errs = append(errs, fn(fldPath.Child("u1m2"), obj.U1M2, oldVal, oldObj != nil)...)
+	}
+
+	// field Struct.D2 has no validation
+
+	{ // field Struct.U2M1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M1 {
+				return oldObj.U2M1
+			})
+		errs = append(errs, fn(fldPath.Child("u2m1"), obj.U2M1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.U2M2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M2 {
+				return oldObj.U2M2
+			})
+		errs = append(errs, fn(fldPath.Child("u2m2"), obj.U2M2, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/simple/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/simple/doc.go
new file mode 100644
index 0000000000..2df20ea245
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/simple/doc.go
@@ -0,0 +1,63 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package simple
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Discriminated union
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:unionDiscriminator
+	D D `json:"d"`
+
+	// +k8s:unionMember
+	// +k8s:optional
+	M1 *M1 `json:"m1"`
+
+	// +k8s:unionMember
+	// +k8s:optional
+	M2 *M2 `json:"m2"`
+
+	// +k8s:unionMember
+	// +k8s:optional
+	M3 []string `json:"m3"`
+
+	// +k8s:unionMember
+	// +k8s:optional
+	M4 map[string]string `json:"m4"`
+}
+
+type D string
+
+const (
+	DM1 D = "M1"
+	DM2 D = "M2"
+	DM3 D = "M3"
+	DM4 D = "M4"
+)
+
+type M1 struct{}
+
+type M2 struct{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/simple/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/simple/doc_test.go
new file mode 100644
index 0000000000..5adfa7f0c8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/simple/doc_test.go
@@ -0,0 +1,94 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package simple
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{ /* zero values */ }).ExpectValid()
+
+	st.Value(&Struct{D: DM1, M1: &M1{}}).ExpectValid()
+	st.Value(&Struct{D: DM2, M2: &M2{}}).ExpectValid()
+	st.Value(&Struct{D: DM3, M3: []string{"a"}}).ExpectValid()
+	st.Value(&Struct{D: DM4, M4: map[string]string{"k": "v"}}).ExpectValid()
+
+	st.Value(&Struct{D: DM2, M1: &M1{}, M2: &M2{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("m1"), nil, "may only be specified when"),
+	}.WithOrigin("union"))
+
+	st.Value(&Struct{D: DM1}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("m1"), nil, "must be specified when"),
+	}.WithOrigin("union"))
+
+	// Slice member: discriminator matches but slice is nil
+	st.Value(&Struct{D: DM3}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("m3"), nil, "must be specified when"),
+	}.WithOrigin("union"))
+	// Slice member: discriminator matches but slice is empty (len==0, not nil)
+	st.Value(&Struct{D: DM3, M3: []string{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("m3"), nil, "must be specified when"),
+	}.WithOrigin("union"))
+
+	// Slice member: discriminator doesn't match but slice is set
+	st.Value(&Struct{D: DM1, M1: &M1{}, M3: []string{"a"}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("m3"), nil, "may only be specified when"),
+	}.WithOrigin("union"))
+
+	// Map member: discriminator matches but map is nil
+	st.Value(&Struct{D: DM4}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("m4"), nil, "must be specified when"),
+	}.WithOrigin("union"))
+	// Map member: discriminator matches but map is empty (len==0, not nil)
+	st.Value(&Struct{D: DM4, M4: map[string]string{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("m4"), nil, "must be specified when"),
+	}.WithOrigin("union"))
+
+	// Map member: discriminator doesn't match but map is set
+	st.Value(&Struct{D: DM1, M1: &M1{}, M4: map[string]string{"k": "v"}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("m4"), nil, "may only be specified when"),
+	}.WithOrigin("union"))
+
+	// Test validation ratcheting
+	st.Value(&Struct{D: DM2, M1: &M1{}, M2: &M2{}}).OldValue(&Struct{D: DM2, M1: &M1{}, M2: &M2{}}).ExpectValid()
+	st.Value(&Struct{D: DM1}).OldValue(&Struct{D: DM1}).ExpectValid()
+
+	// Slice member ratcheting: unchanged membership
+	st.Value(&Struct{D: DM3, M3: []string{"a"}}).OldValue(&Struct{D: DM3, M3: []string{"b"}}).ExpectValid()
+	// Slice member ratcheting: changed from set to unset
+	st.Value(&Struct{D: DM3}).OldValue(&Struct{D: DM3, M3: []string{"a"}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("m3"), nil, "must be specified when"),
+	}.WithOrigin("union"))
+
+	// Map member ratcheting: unchanged membership
+	st.Value(&Struct{D: DM4, M4: map[string]string{"k": "v1"}}).OldValue(&Struct{D: DM4, M4: map[string]string{"k": "v2"}}).ExpectValid()
+	// Map member ratcheting: changed from set to unset
+	st.Value(&Struct{D: DM4}).OldValue(&Struct{D: DM4, M4: map[string]string{"k": "v"}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("m4"), nil, "must be specified when"),
+	}.WithOrigin("union"))
+
+	// Test update with nil old value (simulates newly-set pointer field during update).
+	// Discriminated union validation should still detect mismatches even though oldObj is nil.
+	st.Value(&Struct{D: DM1}).OldValue(nil).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("m1"), nil, "must be specified when"),
+	}.WithOrigin("union"))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/simple/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/simple/zz_generated.validations.go
new file mode 100644
index 0000000000..d2028d6301
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/simple/zz_generated.validations.go
@@ -0,0 +1,217 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package simple
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_discriminated_simple_Struct_ = validate.NewDiscriminatedUnionMembership("d", validate.NewDiscriminatedUnionMember("m1", "M1"), validate.NewDiscriminatedUnionMember("m2", "M2"), validate.NewDiscriminatedUnionMember("m3", "M3"), validate.NewDiscriminatedUnionMember("m4", "M4"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.DiscriminatedUnion(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_discriminated_simple_Struct_,
+		func(obj *Struct) string {
+			if obj == nil {
+				return ""
+			}
+			return string(obj.D)
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M1 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M2 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.M3) != 0
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.M4) != 0
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+	// field Struct.D has no validation
+
+	{ // field Struct.M1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M1 {
+				return oldObj.M1
+			})
+		errs = append(errs, fn(fldPath.Child("m1"), obj.M1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.M2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M2 {
+				return oldObj.M2
+			})
+		errs = append(errs, fn(fldPath.Child("m2"), obj.M2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.M3
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.M3
+			})
+		errs = append(errs, fn(fldPath.Child("m3"), obj.M3, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.M4
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.M4
+			})
+		errs = append(errs, fn(fldPath.Child("m4"), obj.M4, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/sparse/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/sparse/doc.go
new file mode 100644
index 0000000000..1f60346be8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/sparse/doc.go
@@ -0,0 +1,49 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package sparse
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Discriminated union
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:unionDiscriminator
+	D D `json:"d"`
+
+	// +k8s:unionMember
+	// +k8s:optional
+	M1 *M1 `json:"m1"`
+
+	//Note: no M2 field to match the M2 discriminator.
+}
+
+type D string
+
+const (
+	DM1 D = "M1"
+	DM2 D = "M2"
+)
+
+type M1 struct{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/sparse/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/sparse/doc_test.go
new file mode 100644
index 0000000000..1976ade978
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/sparse/doc_test.go
@@ -0,0 +1,44 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sparse
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{ /* zero values */ }).ExpectValid()
+
+	st.Value(&Struct{D: DM1, M1: &M1{}}).ExpectValid()
+	st.Value(&Struct{D: DM2}).ExpectValid()
+
+	st.Value(&Struct{D: DM2, M1: &M1{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("m1"), nil, "may only be specified when"),
+	}.WithOrigin("union"))
+
+	st.Value(&Struct{D: DM1}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("m1"), nil, "must be specified when"),
+	}.WithOrigin("union"))
+
+	// Test validation ratcheting
+	st.Value(&Struct{D: DM2, M1: &M1{}}).OldValue(&Struct{D: DM2, M1: &M1{}}).ExpectValid()
+	st.Value(&Struct{D: DM1}).OldValue(&Struct{D: DM1}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/sparse/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/sparse/zz_generated.validations.go
new file mode 100644
index 0000000000..72660eb7ae
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/discriminated/sparse/zz_generated.validations.go
@@ -0,0 +1,114 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package sparse
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_discriminated_sparse_Struct_ = validate.NewDiscriminatedUnionMembership("d", validate.NewDiscriminatedUnionMember("m1", "M1"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.DiscriminatedUnion(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_discriminated_sparse_Struct_,
+		func(obj *Struct) string {
+			if obj == nil {
+				return ""
+			}
+			return string(obj.D)
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M1 != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+	// field Struct.D has no validation
+
+	{ // field Struct.M1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M1 {
+				return oldObj.M1
+			})
+		errs = append(errs, fn(fldPath.Child("m1"), obj.M1, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/custom_members/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/custom_members/doc.go
new file mode 100644
index 0000000000..2cd7d65099
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/custom_members/doc.go
@@ -0,0 +1,45 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package custommembers
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Non-discriminated union with custom member names
+type Struct struct {
+	TypeMeta int
+
+	NonUnionField string `json:"nonUnionField"`
+
+	// +k8s:unionMember(memberName: "CustomM1")
+	// +k8s:optional
+	M1 *M1 `json:"m1"`
+
+	// +k8s:unionMember(memberName: "CustomM2")
+	// +k8s:optional
+	M2 *M2 `json:"m2"`
+}
+
+type M1 struct{}
+
+type M2 struct{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/custom_members/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/custom_members/doc_test.go
new file mode 100644
index 0000000000..2e91d904b5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/custom_members/doc_test.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package custommembers
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{M1: &M1{}}).ExpectValid()
+	st.Value(&Struct{M2: &M2{}}).ExpectValid()
+
+	st.Value(&Struct{M1: &M1{}, M2: &M2{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify exactly one of"),
+	}.WithOrigin("union"))
+	st.Value(&Struct{}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify one of"),
+	}.WithOrigin("union"))
+
+	// Test validation ratcheting
+	st.Value(&Struct{M1: &M1{}, M2: &M2{}}).OldValue(&Struct{M1: &M1{}, M2: &M2{}}).ExpectValid()
+	st.Value(&Struct{}).OldValue(&Struct{}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/custom_members/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/custom_members/zz_generated.validations.go
new file mode 100644
index 0000000000..452b627c98
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/custom_members/zz_generated.validations.go
@@ -0,0 +1,142 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package custommembers
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_undiscriminated_custom_members_Struct_ = validate.NewUnionMembership(validate.NewUnionMember("m1"), validate.NewUnionMember("m2"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_undiscriminated_custom_members_Struct_,
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M1 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M2 != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+	// field Struct.NonUnionField has no validation
+
+	{ // field Struct.M1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M1 {
+				return oldObj.M1
+			})
+		errs = append(errs, fn(fldPath.Child("m1"), obj.M1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.M2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M2 {
+				return oldObj.M2
+			})
+		errs = append(errs, fn(fldPath.Child("m2"), obj.M2, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/multiple/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/multiple/doc.go
new file mode 100644
index 0000000000..94069ef3c0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/multiple/doc.go
@@ -0,0 +1,53 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package multiple
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Two non-discriminated unions in the same struct
+type Struct struct {
+	TypeMeta int
+
+	NonUnionField string `json:"nonUnionField"`
+
+	// +k8s:unionMember(union: "union1")
+	// +k8s:optional
+	U1M1 *M1 `json:"u1m1"`
+
+	// +k8s:unionMember(union: "union1")
+	// +k8s:optional
+	U1M2 *M2 `json:"u1m2"`
+
+	// +k8s:unionMember(union: "union2")
+	// +k8s:optional
+	U2M1 *M1 `json:"u2m1"`
+
+	// +k8s:unionMember(union: "union2")
+	// +k8s:optional
+	U2M2 *M2 `json:"u2m2"`
+}
+
+type M1 struct{}
+
+type M2 struct{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/multiple/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/multiple/doc_test.go
new file mode 100644
index 0000000000..777a5be858
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/multiple/doc_test.go
@@ -0,0 +1,65 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package multiple
+
+import (
+	"testing"
+
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify one of: `u1m1`, `u1m2`").WithOrigin("union"),
+		field.Invalid(nil, nil, "must specify one of: `u2m1`, `u2m2`").WithOrigin("union"),
+	})
+
+	st.Value(&Struct{U1M1: &M1{}, U2M1: &M1{}}).ExpectValid()
+	st.Value(&Struct{U1M2: &M2{}, U2M2: &M2{}}).ExpectValid()
+
+	st.Value(&Struct{U1M1: &M1{}, U1M2: &M2{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify exactly one of: `u1m1`, `u1m2`").WithOrigin("union"),
+		field.Invalid(nil, nil, "must specify one of: `u2m1`, `u2m2`").WithOrigin("union"),
+	})
+
+	st.Value(&Struct{U2M1: &M1{}, U2M2: &M2{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify one of: `u1m1`, `u1m2`").WithOrigin("union"),
+		field.Invalid(nil, nil, "must specify exactly one of: `u2m1`, `u2m2`").WithOrigin("union"),
+	})
+
+	st.Value(&Struct{
+		U1M1: &M1{}, U1M2: &M2{},
+		U2M1: &M1{}, U2M2: &M2{},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify exactly one of: `u1m1`, `u1m2`").WithOrigin("union"),
+		field.Invalid(nil, nil, "must specify exactly one of: `u2m1`, `u2m2`").WithOrigin("union"),
+	})
+
+	// Test validation ratcheting
+	st.Value(&Struct{}).OldValue(&Struct{}).ExpectValid()
+	st.Value(&Struct{U1M1: &M1{}, U1M2: &M2{}}).OldValue(&Struct{U1M1: &M1{}, U1M2: &M2{}}).ExpectValid()
+	st.Value(&Struct{U2M1: &M1{}, U2M2: &M2{}}).OldValue(&Struct{U2M1: &M1{}, U2M2: &M2{}}).ExpectValid()
+	st.Value(&Struct{
+		U1M1: &M1{}, U1M2: &M2{},
+		U2M1: &M1{}, U2M2: &M2{},
+	}).OldValue(&Struct{
+		U1M1: &M1{}, U1M2: &M2{},
+		U2M1: &M1{}, U2M2: &M2{},
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/multiple/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/multiple/zz_generated.validations.go
new file mode 100644
index 0000000000..34490fedc4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/multiple/zz_generated.validations.go
@@ -0,0 +1,214 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package multiple
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_undiscriminated_multiple_Struct_union1 = validate.NewUnionMembership(validate.NewUnionMember("u1m1"), validate.NewUnionMember("u1m2"))
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_undiscriminated_multiple_Struct_union2 = validate.NewUnionMembership(validate.NewUnionMember("u2m1"), validate.NewUnionMember("u2m2"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_undiscriminated_multiple_Struct_union1,
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.U1M1 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.U1M2 != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_undiscriminated_multiple_Struct_union2,
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.U2M1 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.U2M2 != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+	// field Struct.NonUnionField has no validation
+
+	{ // field Struct.U1M1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M1 {
+				return oldObj.U1M1
+			})
+		errs = append(errs, fn(fldPath.Child("u1m1"), obj.U1M1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.U1M2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M2 {
+				return oldObj.U1M2
+			})
+		errs = append(errs, fn(fldPath.Child("u1m2"), obj.U1M2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.U2M1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M1 {
+				return oldObj.U2M1
+			})
+		errs = append(errs, fn(fldPath.Child("u2m1"), obj.U2M1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.U2M2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M2 {
+				return oldObj.U2M2
+			})
+		errs = append(errs, fn(fldPath.Child("u2m2"), obj.U2M2, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/simple/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/simple/doc.go
new file mode 100644
index 0000000000..5cc49142e2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/simple/doc.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package simple
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Non-discriminated union
+type Struct struct {
+	TypeMeta int
+
+	NonUnionField string `json:"nonUnionField"`
+
+	// +k8s:unionMember
+	// +k8s:optional
+	M1 *M1 `json:"m1"`
+
+	// +k8s:unionMember
+	// +k8s:optional
+	M2 *M2 `json:"m2"`
+
+	// +k8s:unionMember
+	// +k8s:optional
+	M3 string `json:"m3"`
+
+	// +k8s:unionMember
+	// +k8s:optional
+	M4 *string `json:"m4"`
+
+	// +k8s:unionMember
+	// +k8s:optional
+	M5 []string `json:"m5"`
+
+	// +k8s:unionMember
+	// +k8s:optional
+	M6 map[string]string `json:"m6"`
+}
+
+type M1 struct{}
+
+type M2 struct{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/simple/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/simple/doc_test.go
new file mode 100644
index 0000000000..a6f5c582ed
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/simple/doc_test.go
@@ -0,0 +1,75 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package simple
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify one of"),
+	}.WithOrigin("union"))
+
+	st.Value(&Struct{M1: &M1{}}).ExpectValid()
+	st.Value(&Struct{M2: &M2{}}).ExpectValid()
+	st.Value(&Struct{M3: "a string"}).ExpectValid()
+	st.Value(&Struct{M4: ptr.To("a string")}).ExpectValid()
+	st.Value(&Struct{M5: []string{"a string"}}).ExpectValid()
+	st.Value(&Struct{M6: map[string]string{"k": "v"}}).ExpectValid()
+
+	// Empty slice/map are "not set" (same as nil for union membership)
+	st.Value(&Struct{M5: []string{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify one of"),
+	}.WithOrigin("union"))
+	st.Value(&Struct{M6: map[string]string{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify one of"),
+	}.WithOrigin("union"))
+
+	st.Value(&Struct{M1: &M1{}, M2: &M2{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify exactly one of"),
+	}.WithOrigin("union"))
+	st.Value(&Struct{M1: &M1{}, M3: "a string"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify exactly one of"),
+	}.WithOrigin("union"))
+	st.Value(&Struct{M1: &M1{}, M4: ptr.To("a string")}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify exactly one of"),
+	}.WithOrigin("union"))
+
+	// Update only considers whether a field was set, not the value.
+	st.Value(&Struct{M3: "a string"}).OldValue(&Struct{M3: "different string"}).ExpectValid()
+
+	// Test validation ratcheting
+	st.Value(&Struct{}).OldValue(&Struct{}).ExpectValid()
+	st.Value(&Struct{M1: &M1{}, M2: &M2{}}).OldValue(&Struct{M1: &M1{}, M2: &M2{}}).ExpectValid()
+	st.Value(&Struct{M3: "a string", M2: &M2{}}).OldValue(&Struct{M3: "different string", M2: &M2{}}).ExpectValid()
+
+	// Slice/map member ratcheting: unchanged membership, different values
+	st.Value(&Struct{M5: []string{"a"}}).OldValue(&Struct{M5: []string{"b"}}).ExpectValid()
+	st.Value(&Struct{M6: map[string]string{"k": "v1"}}).OldValue(&Struct{M6: map[string]string{"k": "v2"}}).ExpectValid()
+
+	// Test update with nil old value (simulates new map entry or newly-set pointer field during update).
+	// Union validation should still detect the empty union even though oldObj is nil.
+	st.Value(&Struct{}).OldValue(nil).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify one of").WithOrigin("union"),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/simple/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/simple/zz_generated.validations.go
new file mode 100644
index 0000000000..012ee08ee8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/union/union/undiscriminated/simple/zz_generated.validations.go
@@ -0,0 +1,280 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package simple
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_undiscriminated_simple_Struct_ = validate.NewUnionMembership(validate.NewUnionMember("m1"), validate.NewUnionMember("m2"), validate.NewUnionMember("m3"), validate.NewUnionMember("m4"), validate.NewUnionMember("m5"), validate.NewUnionMember("m6"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_union_union_undiscriminated_simple_Struct_,
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M1 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M2 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			var z string
+			return obj.M3 != z
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M4 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.M5) != 0
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.M6) != 0
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+	// field Struct.NonUnionField has no validation
+
+	{ // field Struct.M1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M1 {
+				return oldObj.M1
+			})
+		errs = append(errs, fn(fldPath.Child("m1"), obj.M1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.M2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M2 {
+				return oldObj.M2
+			})
+		errs = append(errs, fn(fldPath.Child("m2"), obj.M2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.M3
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.M3
+			})
+		errs = append(errs, fn(fldPath.Child("m3"), &obj.M3, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.M4
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.M4
+			})
+		errs = append(errs, fn(fldPath.Child("m4"), obj.M4, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.M5
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.M5
+			})
+		errs = append(errs, fn(fldPath.Child("m5"), obj.M5, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.M6
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) map[string]string {
+				return oldObj.M6
+			})
+		errs = append(errs, fn(fldPath.Child("m6"), obj.M6, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/unique/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/unique/doc.go
new file mode 100644
index 0000000000..d8ad99f057
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/unique/doc.go
@@ -0,0 +1,123 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package unique
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// Basic unique=set on primitive slice
+	// +k8s:listType=atomic
+	// +k8s:unique=set
+	PrimitiveListUniqueSet []string `json:"primitiveListUniqueSet"`
+
+	// unique=map with multiple keys
+	// +k8s:listType=atomic
+	// +k8s:unique=map
+	// +k8s:listMapKey=key1
+	// +k8s:listMapKey=key2
+	SliceMapFieldWithMultipleKeys []ItemWithMultipleKeys `json:"sliceMapFieldWithMultipleKeys"`
+
+	// atomic + unique=set combination
+	// +k8s:listType=atomic
+	// +k8s:unique=set
+	AtomicListUniqueSet []Item `json:"atomicListUniqueSet"`
+
+	// atomic + unique=map combination
+	// +k8s:listType=atomic
+	// +k8s:unique=map
+	// +k8s:listMapKey=key
+	AtomicListUniqueMap []Item `json:"atomicListUniqueMap"`
+
+	// customUnique with listType=set
+	// +k8s:listType=set
+	// +k8s:customUnique
+	CustomUniqueListWithTypeSet []string `json:"customUniqueListWithTypeSet"`
+
+	// customUnique with listType=map
+	// +k8s:listType=map
+	// +k8s:listMapKey=key
+	// +k8s:customUnique
+	CustomUniqueListWithTypeMap []Item `json:"customUniqueListWithTypeMap"`
+
+	// unique=map with pointer key
+	// +k8s:listType=atomic
+	// +k8s:unique=map
+	// +k8s:listMapKey=key
+	SliceMapFieldWithPtrKey []PtrKeyStruct `json:"sliceMapFieldWithPtrKey"`
+
+	// unique=map with mixed (pointer and primitive) keys
+	// +k8s:listType=atomic
+	// +k8s:unique=map
+	// +k8s:listMapKey=key1
+	// +k8s:listMapKey=key2
+	SliceMapFieldWithMixedKeys []ItemWithMixedKeys `json:"sliceMapFieldWithMixedKeys"`
+
+	// unique=map with multiple pointer keys
+	// +k8s:listType=atomic
+	// +k8s:unique=map
+	// +k8s:listMapKey=key1
+	// +k8s:listMapKey=key2
+	SliceMapFieldWithMultiplePtrKeys []ItemWithMultiplePtrKeys `json:"sliceMapFieldWithMultiplePtrKeys"`
+
+	// unique=set on slice of pointers to primitive
+	// +k8s:listType=atomic
+	// +k8s:unique=set
+	PrimitivePointerListUniqueSet []*string `json:"primitivePointerListUniqueSet"`
+
+	// unique=map on slice of pointers to struct
+	// +k8s:listType=atomic
+	// +k8s:unique=map
+	// +k8s:listMapKey=key
+	PointerListUniqueMap []*Item `json:"pointerListUniqueMap"`
+}
+
+type Item struct {
+	Key  string `json:"key"`
+	Data string `json:"data"`
+}
+
+type ItemWithMultipleKeys struct {
+	Key1 string `json:"key1"`
+	Key2 string `json:"key2"`
+	Data string `json:"data"`
+}
+
+type PtrKeyStruct struct {
+	Key  *string `json:"key"`
+	Data string  `json:"data"`
+}
+
+type ItemWithMixedKeys struct {
+	Key1 *string `json:"key1"`
+	Key2 string  `json:"key2"`
+	Data string  `json:"data"`
+}
+
+type ItemWithMultiplePtrKeys struct {
+	Key1 *string `json:"key1"`
+	Key2 *string `json:"key2"`
+	Data string  `json:"data"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/unique/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/unique/doc_test.go
new file mode 100644
index 0000000000..999a7301d5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/unique/doc_test.go
@@ -0,0 +1,256 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unique
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestUnique(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Test empty struct (should be valid)
+	st.Value(&Struct{}).ExpectValid()
+
+	// Test valid cases with no duplicates
+	st.Value(&Struct{
+		PrimitiveListUniqueSet: []string{"aaa", "bbb"},
+		SliceMapFieldWithMultipleKeys: []ItemWithMultipleKeys{
+			{Key1: "a", Key2: "x", Data: "first"},
+			{Key1: "a", Key2: "y", Data: "second"},
+		},
+		AtomicListUniqueSet: []Item{
+			{Key: "key1", Data: "one"},
+			{Key: "key2", Data: "two"},
+		},
+		AtomicListUniqueMap: []Item{
+			{Key: "key1", Data: "one"},
+			{Key: "key2", Data: "two"},
+		},
+		CustomUniqueListWithTypeSet: []string{"a", "b", "a"},
+		CustomUniqueListWithTypeMap: []Item{{Key: "a"}, {Key: "b"}, {Key: "a"}},
+		SliceMapFieldWithPtrKey: []PtrKeyStruct{
+			{Key: new("a"), Data: "first"},
+			{Key: new("b"), Data: "second"},
+		},
+		SliceMapFieldWithMixedKeys: []ItemWithMixedKeys{
+			{Key1: new("a"), Key2: "x", Data: "first"},
+			{Key1: new("a"), Key2: "y", Data: "second"},
+		},
+		SliceMapFieldWithMultiplePtrKeys: []ItemWithMultiplePtrKeys{
+			{Key1: new("a"), Key2: new("x"), Data: "first"},
+			{Key1: new("a"), Key2: new("y"), Data: "second"},
+		},
+		PrimitivePointerListUniqueSet: []*string{new("aaa"), new("bbb")},
+		PointerListUniqueMap: []*Item{
+			{Key: "key1", Data: "one"},
+			{Key: "key2", Data: "two"},
+		},
+	}).ExpectValid()
+
+	// Test empty lists
+	st.Value(&Struct{
+		PrimitiveListUniqueSet:           []string{},
+		SliceMapFieldWithMultipleKeys:    []ItemWithMultipleKeys{},
+		AtomicListUniqueSet:              []Item{},
+		AtomicListUniqueMap:              []Item{},
+		CustomUniqueListWithTypeSet:      []string{},
+		CustomUniqueListWithTypeMap:      []Item{},
+		SliceMapFieldWithMixedKeys:       []ItemWithMixedKeys{},
+		SliceMapFieldWithMultiplePtrKeys: []ItemWithMultiplePtrKeys{},
+		PrimitivePointerListUniqueSet:    []*string{},
+		PointerListUniqueMap:             []*Item{},
+	}).ExpectValid()
+
+	// Test single element lists
+	st.Value(&Struct{
+		PrimitiveListUniqueSet:           []string{"single"},
+		SliceMapFieldWithMultipleKeys:    []ItemWithMultipleKeys{{Key1: "a", Key2: "b", Data: "one"}},
+		AtomicListUniqueSet:              []Item{{Key: "single", Data: "one"}},
+		AtomicListUniqueMap:              []Item{{Key: "single", Data: "one"}},
+		CustomUniqueListWithTypeSet:      []string{"single"},
+		CustomUniqueListWithTypeMap:      []Item{{Key: "single"}},
+		SliceMapFieldWithMixedKeys:       []ItemWithMixedKeys{{Key1: new("a"), Key2: "b", Data: "one"}},
+		SliceMapFieldWithMultiplePtrKeys: []ItemWithMultiplePtrKeys{{Key1: new("a"), Key2: new("b"), Data: "one"}},
+		PrimitivePointerListUniqueSet:    []*string{new("single")},
+		PointerListUniqueMap:             []*Item{{Key: "single", Data: "one"}},
+	}).ExpectValid()
+
+	// Test duplicate values (should fail validation)
+	st.Value(&Struct{
+		PrimitiveListUniqueSet: []string{"aaa", "bbb", "ccc", "ccc", "bbb", "aaa"},
+		SliceMapFieldWithMultipleKeys: []ItemWithMultipleKeys{
+			{Key1: "a", Key2: "x", Data: "first"},
+			{Key1: "a", Key2: "y", Data: "second"},
+			{Key1: "a", Key2: "x", Data: "third"},
+		},
+		AtomicListUniqueSet: []Item{
+			{Key: "key1", Data: "one"},
+			{Key: "key2", Data: "two"},
+			{Key: "key1", Data: "one"},
+		},
+		AtomicListUniqueMap: []Item{
+			{Key: "key1", Data: "one"},
+			{Key: "key2", Data: "two"},
+			{Key: "key1", Data: "three"},
+		},
+		CustomUniqueListWithTypeSet: []string{"a", "b", "a"},
+		CustomUniqueListWithTypeMap: []Item{{Key: "a"}, {Key: "b"}, {Key: "a"}},
+		SliceMapFieldWithPtrKey: []PtrKeyStruct{
+			{Key: new("a"), Data: "first"},
+			{Key: new("b"), Data: "second"},
+			{Key: new("a"), Data: "third"},
+		},
+		SliceMapFieldWithMixedKeys: []ItemWithMixedKeys{
+			{Key1: new("a"), Key2: "x", Data: "first"},
+			{Key1: new("a"), Key2: "y", Data: "second"},
+			{Key1: new("a"), Key2: "x", Data: "third"},
+		},
+		SliceMapFieldWithMultiplePtrKeys: []ItemWithMultiplePtrKeys{
+			{Key1: new("a"), Key2: new("x"), Data: "first"},
+			{Key1: new("a"), Key2: new("y"), Data: "second"},
+			{Key1: new("a"), Key2: new("x"), Data: "third"},
+		},
+		PrimitivePointerListUniqueSet: []*string{new("aaa"), new("bbb"), new("aaa")},
+		PointerListUniqueMap: []*Item{
+			{Key: "key1", Data: "one"},
+			{Key: "key2", Data: "two"},
+			{Key: "key1", Data: "three"},
+		},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Duplicate(field.NewPath("primitiveListUniqueSet").Index(3), nil),
+		field.Duplicate(field.NewPath("primitiveListUniqueSet").Index(4), nil),
+		field.Duplicate(field.NewPath("primitiveListUniqueSet").Index(5), nil),
+		field.Duplicate(field.NewPath("sliceMapFieldWithMultipleKeys").Index(2), nil),
+		field.Duplicate(field.NewPath("atomicListUniqueSet").Index(2), nil),
+		field.Duplicate(field.NewPath("atomicListUniqueMap").Index(2), nil),
+		field.Duplicate(field.NewPath("sliceMapFieldWithPtrKey").Index(2), nil),
+		field.Duplicate(field.NewPath("sliceMapFieldWithMixedKeys").Index(2), nil),
+		field.Duplicate(field.NewPath("sliceMapFieldWithMultiplePtrKeys").Index(2), nil),
+		field.Duplicate(field.NewPath("primitivePointerListUniqueSet").Index(2), nil),
+		field.Duplicate(field.NewPath("pointerListUniqueMap").Index(2), nil),
+	})
+
+	// Test with zero values and empty strings
+	st.Value(&Struct{
+		PrimitiveListUniqueSet: []string{"", "a", ""},
+		AtomicListUniqueMap: []Item{
+			{Key: "", Data: "one"},
+			{Key: "a", Data: "two"},
+			{Key: "", Data: "three"},
+		},
+		CustomUniqueListWithTypeSet: []string{"", "a", ""},
+		CustomUniqueListWithTypeMap: []Item{{Key: ""}, {Key: "a"}, {Key: ""}},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Duplicate(field.NewPath("primitiveListUniqueSet").Index(2), nil),
+		field.Duplicate(field.NewPath("atomicListUniqueMap").Index(2), nil),
+	})
+
+	// Test nil elements in pointer lists (should trigger Required errors)
+	st.Value(&Struct{
+		PrimitivePointerListUniqueSet: []*string{new("a"), nil, new("b")},
+		PointerListUniqueMap:          []*Item{{Key: "key1"}, nil},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
+		field.Required(field.NewPath("primitivePointerListUniqueSet").Index(1), ""),
+		field.Required(field.NewPath("pointerListUniqueMap").Index(1), ""),
+	})
+}
+
+func TestRatcheting(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	struct1 := Struct{
+		PrimitiveListUniqueSet: []string{"aaa", "bbb"},
+		SliceMapFieldWithMultipleKeys: []ItemWithMultipleKeys{
+			{Key1: "a", Key2: "x", Data: "first"},
+			{Key1: "a", Key2: "y", Data: "second"},
+		},
+		AtomicListUniqueSet: []Item{
+			{Key: "key1", Data: "one"},
+			{Key: "key2", Data: "two"},
+		},
+		AtomicListUniqueMap: []Item{
+			{Key: "key1", Data: "one"},
+			{Key: "key2", Data: "two"},
+		},
+		CustomUniqueListWithTypeSet: []string{"a", "b", "a"},
+		CustomUniqueListWithTypeMap: []Item{{Key: "a"}, {Key: "b"}, {Key: "a"}},
+		SliceMapFieldWithPtrKey: []PtrKeyStruct{
+			{Key: new("a"), Data: "first"},
+			{Key: new("b"), Data: "second"},
+		},
+		SliceMapFieldWithMixedKeys: []ItemWithMixedKeys{
+			{Key1: new("a"), Key2: "x", Data: "first"},
+			{Key1: new("a"), Key2: "y", Data: "second"},
+		},
+		SliceMapFieldWithMultiplePtrKeys: []ItemWithMultiplePtrKeys{
+			{Key1: new("a"), Key2: new("x"), Data: "first"},
+			{Key1: new("a"), Key2: new("y"), Data: "second"},
+		},
+		PrimitivePointerListUniqueSet: []*string{new("aaa"), new("bbb")},
+		PointerListUniqueMap: []*Item{
+			{Key: "key1", Data: "one"},
+			{Key: "key2", Data: "two"},
+		},
+	}
+
+	// Same data, different order.
+	struct2 := Struct{
+		PrimitiveListUniqueSet: []string{"bbb", "aaa"},
+		SliceMapFieldWithMultipleKeys: []ItemWithMultipleKeys{
+			{Key1: "a", Key2: "y", Data: "second"},
+			{Key1: "a", Key2: "x", Data: "first"},
+		},
+		AtomicListUniqueSet: []Item{
+			{Key: "key2", Data: "two"},
+			{Key: "key1", Data: "one"},
+		},
+		AtomicListUniqueMap: []Item{
+			{Key: "key2", Data: "two"},
+			{Key: "key1", Data: "one"},
+		},
+		CustomUniqueListWithTypeSet: []string{"a", "a", "b"},
+		CustomUniqueListWithTypeMap: []Item{{Key: "a"}, {Key: "a"}, {Key: "b"}},
+		SliceMapFieldWithPtrKey: []PtrKeyStruct{
+			{Key: new("b"), Data: "second"},
+			{Key: new("a"), Data: "first"},
+		},
+		SliceMapFieldWithMixedKeys: []ItemWithMixedKeys{
+			{Key1: new("a"), Key2: "y", Data: "second"},
+			{Key1: new("a"), Key2: "x", Data: "first"},
+		},
+		SliceMapFieldWithMultiplePtrKeys: []ItemWithMultiplePtrKeys{
+			{Key1: new("a"), Key2: new("y"), Data: "second"},
+			{Key1: new("a"), Key2: new("x"), Data: "first"},
+		},
+		PrimitivePointerListUniqueSet: []*string{new("bbb"), new("aaa")},
+		PointerListUniqueMap: []*Item{
+			{Key: "key2", Data: "two"},
+			{Key: "key1", Data: "one"},
+		},
+	}
+
+	// Test that reordering doesn't trigger validation errors
+	st.Value(&struct1).OldValue(&struct2).ExpectValid()
+	st.Value(&struct2).OldValue(&struct1).ExpectValid()
+
+	// Test that the same data is considered valid regardless of order
+	st.Value(&struct1).ExpectValid()
+	st.Value(&struct2).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/unique/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/unique/zz_generated.validations.go
new file mode 100644
index 0000000000..792ebe13bb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/unique/zz_generated.validations.go
@@ -0,0 +1,353 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package unique
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.PrimitiveListUniqueSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.PrimitiveListUniqueSet
+			})
+		errs = append(errs, fn(fldPath.Child("primitiveListUniqueSet"), obj.PrimitiveListUniqueSet, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceMapFieldWithMultipleKeys
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ItemWithMultipleKeys,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *ItemWithMultipleKeys, b *ItemWithMultipleKeys) bool {
+					return a.Key1 == b.Key1 && a.Key2 == b.Key2
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []ItemWithMultipleKeys {
+				return oldObj.SliceMapFieldWithMultipleKeys
+			})
+		errs = append(errs, fn(fldPath.Child("sliceMapFieldWithMultipleKeys"), obj.SliceMapFieldWithMultipleKeys, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.AtomicListUniqueSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Item,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []Item {
+				return oldObj.AtomicListUniqueSet
+			})
+		errs = append(errs, fn(fldPath.Child("atomicListUniqueSet"), obj.AtomicListUniqueSet, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.AtomicListUniqueMap
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Item,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Item, b *Item) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []Item {
+				return oldObj.AtomicListUniqueMap
+			})
+		errs = append(errs, fn(fldPath.Child("atomicListUniqueMap"), obj.AtomicListUniqueMap, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.CustomUniqueListWithTypeSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// Uniqueness validation is implemented via custom, handwritten validation
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []string {
+				return oldObj.CustomUniqueListWithTypeSet
+			})
+		errs = append(errs, fn(fldPath.Child("customUniqueListWithTypeSet"), obj.CustomUniqueListWithTypeSet, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.CustomUniqueListWithTypeMap
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Item,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// Uniqueness validation is implemented via custom, handwritten validation
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []Item {
+				return oldObj.CustomUniqueListWithTypeMap
+			})
+		errs = append(errs, fn(fldPath.Child("customUniqueListWithTypeMap"), obj.CustomUniqueListWithTypeMap, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceMapFieldWithPtrKey
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []PtrKeyStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *PtrKeyStruct, b *PtrKeyStruct) bool {
+					return ((a.Key == nil && b.Key == nil) || (a.Key != nil && b.Key != nil && *a.Key == *b.Key))
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []PtrKeyStruct {
+				return oldObj.SliceMapFieldWithPtrKey
+			})
+		errs = append(errs, fn(fldPath.Child("sliceMapFieldWithPtrKey"), obj.SliceMapFieldWithPtrKey, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceMapFieldWithMixedKeys
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ItemWithMixedKeys,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *ItemWithMixedKeys, b *ItemWithMixedKeys) bool {
+					return ((a.Key1 == nil && b.Key1 == nil) || (a.Key1 != nil && b.Key1 != nil && *a.Key1 == *b.Key1)) && a.Key2 == b.Key2
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []ItemWithMixedKeys {
+				return oldObj.SliceMapFieldWithMixedKeys
+			})
+		errs = append(errs, fn(fldPath.Child("sliceMapFieldWithMixedKeys"), obj.SliceMapFieldWithMixedKeys, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.SliceMapFieldWithMultiplePtrKeys
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ItemWithMultiplePtrKeys,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *ItemWithMultiplePtrKeys, b *ItemWithMultiplePtrKeys) bool {
+					return ((a.Key1 == nil && b.Key1 == nil) || (a.Key1 != nil && b.Key1 != nil && *a.Key1 == *b.Key1)) && ((a.Key2 == nil && b.Key2 == nil) || (a.Key2 != nil && b.Key2 != nil && *a.Key2 == *b.Key2))
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []ItemWithMultiplePtrKeys {
+				return oldObj.SliceMapFieldWithMultiplePtrKeys
+			})
+		errs = append(errs, fn(fldPath.Child("sliceMapFieldWithMultiplePtrKeys"), obj.SliceMapFieldWithMultiplePtrKeys, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.PrimitivePointerListUniqueSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []*string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrSliceNoNils[string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.PtrSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []*string {
+				return oldObj.PrimitivePointerListUniqueSet
+			})
+		errs = append(errs, fn(fldPath.Child("primitivePointerListUniqueSet"), obj.PrimitivePointerListUniqueSet, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.PointerListUniqueMap
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []*Item,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrSliceNoNils[Item](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.PtrSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *Item, b *Item) bool { return a.Key == b.Key }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) []*Item {
+				return oldObj.PointerListUniqueMap
+			})
+		errs = append(errs, fn(fldPath.Child("pointerListUniqueMap"), obj.PointerListUniqueMap, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/doc.go
new file mode 100644
index 0000000000..b74680779a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/doc.go
@@ -0,0 +1,147 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package lists
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type UpdateListStruct struct {
+	TypeMeta int
+
+	// Slice NoSet/NoUnset (len == 0 semantics, no match function needed).
+
+	// +k8s:listType=atomic
+	// +k8s:update=NoSet
+	StringSliceNoSet []string `json:"stringSliceNoSet"`
+
+	// +k8s:listType=atomic
+	// +k8s:update=NoUnset
+	StringSliceNoUnset []string `json:"stringSliceNoUnset"`
+
+	// listType=set -> DirectEqual match for directly-comparable elements.
+
+	// +k8s:listType=set
+	// +k8s:update=NoAddItem
+	StringSetNoAdd []string `json:"stringSetNoAdd"`
+
+	// +k8s:listType=set
+	// +k8s:update=NoRemoveItem
+	StringSetNoRemove []string `json:"stringSetNoRemove"`
+
+	// +k8s:listType=set
+	// +k8s:update=NoAddItem
+	// +k8s:update=NoRemoveItem
+	StringSetFrozenShape []string `json:"stringSetFrozenShape"`
+
+	// listType=map -> inline listMapKey comparison closure.
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:update=NoAddItem
+	MapListNoAdd []UpdateItem `json:"mapListNoAdd"`
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:update=NoAddItem
+	// +k8s:update=NoRemoveItem
+	MapListFrozenShape []UpdateItem `json:"mapListFrozenShape"`
+
+	// listType=map with a composite key (every key field is ANDed).
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:listMapKey=priority
+	// +k8s:update=NoRemoveItem
+	CompositeKeyList []CompositeKeyItem `json:"compositeKeyList"`
+
+	// listType=atomic + unique={set,map} -> same as the non-atomic variant.
+
+	// +k8s:listType=atomic
+	// +k8s:unique=set
+	// +k8s:update=NoAddItem
+	AtomicUniqueSetNoAdd []string `json:"atomicUniqueSetNoAdd"`
+
+	// +k8s:listType=atomic
+	// +k8s:unique=map
+	// +k8s:listMapKey=name
+	// +k8s:update=NoAddItem
+	// +k8s:update=NoRemoveItem
+	AtomicUniqueMapFrozenShape []UpdateItem `json:"atomicUniqueMapFrozenShape"`
+
+	// listType=set over a non-directly-comparable element -> SemanticDeepEqual.
+
+	// +k8s:listType=set
+	// +k8s:update=NoAddItem
+	// +k8s:update=NoRemoveItem
+	NonComparableSetFrozenShape []NonComparableItem `json:"nonComparableSetFrozenShape"`
+
+	// Typedef list: list metadata lives on the type, the field inherits it.
+
+	// +k8s:update=NoAddItem
+	// +k8s:update=NoRemoveItem
+	TypedefFrozenList FrozenUserList `json:"typedefFrozenList"`
+
+	// eachVal composition: per-item NoModify, list shape can still change.
+
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:eachVal=+k8s:update=NoModify
+	EachValNoModifyList []UpdateItem `json:"eachValNoModifyList"`
+
+	// Pointer Slice NoSet
+	// +k8s:listType=atomic
+	// +k8s:update=NoSet
+	PointerSliceNoSet []*string `json:"pointerSliceNoSet"`
+
+	// Pointer listType=set + NoAddItem
+	// +k8s:listType=set
+	// +k8s:update=NoAddItem
+	PointerSetNoAdd []*string `json:"pointerSetNoAdd"`
+
+	// Pointer listType=map + NoRemoveItem
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:update=NoRemoveItem
+	PointerMapListNoRemove []*UpdateItem `json:"pointerMapListNoRemove"`
+}
+
+type UpdateItem struct {
+	Name  string `json:"name"`
+	Value string `json:"value"`
+}
+
+type CompositeKeyItem struct {
+	Name     string `json:"name"`
+	Priority int    `json:"priority"`
+	Value    string `json:"value"`
+}
+
+// NonComparableItem holds a slice, so Go's == is unavailable.
+type NonComparableItem struct {
+	Name string   `json:"name"`
+	Tags []string `json:"tags"`
+}
+
+// +k8s:listType=map
+// +k8s:listMapKey=name
+type FrozenUserList []UpdateItem
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/doc_test.go
new file mode 100644
index 0000000000..df5d5b3998
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/doc_test.go
@@ -0,0 +1,356 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package lists
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestUpdateListTags(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin()
+	base := UpdateListStruct{}
+
+	// Slice NoSet (len == 0 semantics)
+	{
+		old := base
+		old.StringSliceNoSet = nil
+		cur := base
+		cur.StringSliceNoSet = []string{"a"}
+
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Invalid(field.NewPath("stringSliceNoSet"), nil, "field cannot be set once created").WithOrigin("update"),
+		})
+
+		// nil -> nil is allowed
+		st.Value(&old).OldValue(&old).ExpectValid()
+	}
+
+	// Slice NoUnset
+	{
+		old := base
+		old.StringSliceNoUnset = []string{"a"}
+		cur := base
+		cur.StringSliceNoUnset = nil
+
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Invalid(field.NewPath("stringSliceNoUnset"), nil, "field cannot be cleared once set").WithOrigin("update"),
+		})
+	}
+
+	// listType=set + NoAddItem
+	{
+		old := base
+		old.StringSetNoAdd = []string{"a", "b"}
+		cur := base
+		cur.StringSetNoAdd = []string{"a", "b", "c"}
+
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("stringSetNoAdd").Index(2), "item may not be added").WithOrigin("update"),
+		})
+
+		// Reorder of existing items is allowed.
+		reordered := base
+		reordered.StringSetNoAdd = []string{"b", "a"}
+		st.Value(&reordered).OldValue(&old).ExpectValid()
+	}
+
+	// listType=set + NoRemoveItem
+	{
+		old := base
+		old.StringSetNoRemove = []string{"a", "b", "c"}
+		cur := base
+		cur.StringSetNoRemove = []string{"a", "c"}
+
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("stringSetNoRemove"), "may not be removed").WithOrigin("update"),
+		})
+	}
+
+	// Frozen-shape set: NoAddItem + NoRemoveItem
+	{
+		old := base
+		old.StringSetFrozenShape = []string{"a", "b"}
+
+		// Permutation is valid.
+		perm := base
+		perm.StringSetFrozenShape = []string{"b", "a"}
+		st.Value(&perm).OldValue(&old).ExpectValid()
+
+		// Swap one item: one add + one remove, both reported.
+		swap := base
+		swap.StringSetFrozenShape = []string{"a", "c"}
+		st.Value(&swap).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("stringSetFrozenShape").Index(1), "item may not be added").WithOrigin("update"),
+			field.Forbidden(field.NewPath("stringSetFrozenShape"), "may not be removed").WithOrigin("update"),
+		})
+	}
+
+	// listType=map + single key + NoAddItem
+	{
+		old := base
+		old.MapListNoAdd = []UpdateItem{{Name: "alpha", Value: "1"}}
+		cur := base
+		cur.MapListNoAdd = []UpdateItem{
+			{Name: "alpha", Value: "1"},
+			{Name: "beta", Value: "2"},
+		}
+
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("mapListNoAdd").Index(1), "item may not be added").WithOrigin("update"),
+		})
+
+		// Modifying the value of an existing keyed item is not an "add".
+		modified := base
+		modified.MapListNoAdd = []UpdateItem{{Name: "alpha", Value: "999"}}
+		st.Value(&modified).OldValue(&old).ExpectValid()
+	}
+
+	// listType=map + single key + frozen shape
+	{
+		old := base
+		old.MapListFrozenShape = []UpdateItem{
+			{Name: "alpha", Value: "1"},
+			{Name: "beta", Value: "2"},
+		}
+
+		// Value-only change to an existing keyed item is allowed.
+		modify := base
+		modify.MapListFrozenShape = []UpdateItem{
+			{Name: "alpha", Value: "99"},
+			{Name: "beta", Value: "2"},
+		}
+		st.Value(&modify).OldValue(&old).ExpectValid()
+
+		// Removing a key produces a NoRemoveItem error.
+		removed := base
+		removed.MapListFrozenShape = []UpdateItem{{Name: "alpha", Value: "1"}}
+		st.Value(&removed).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("mapListFrozenShape"), "may not be removed").WithOrigin("update"),
+		})
+	}
+
+	// listType=map + composite key + NoRemoveItem
+	{
+		old := base
+		old.CompositeKeyList = []CompositeKeyItem{
+			{Name: "alpha", Priority: 1, Value: "x"},
+			{Name: "alpha", Priority: 2, Value: "y"},
+		}
+
+		// Same key pair, different value: allowed.
+		modify := base
+		modify.CompositeKeyList = []CompositeKeyItem{
+			{Name: "alpha", Priority: 1, Value: "x"},
+			{Name: "alpha", Priority: 2, Value: "y2"},
+		}
+		st.Value(&modify).OldValue(&old).ExpectValid()
+
+		// Remove one pair entirely: rejected.
+		removed := base
+		removed.CompositeKeyList = []CompositeKeyItem{
+			{Name: "alpha", Priority: 1, Value: "x"},
+		}
+		st.Value(&removed).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("compositeKeyList"), "may not be removed").WithOrigin("update"),
+		})
+	}
+
+	// listType=atomic + unique=set + NoAddItem
+	{
+		old := base
+		old.AtomicUniqueSetNoAdd = []string{"a"}
+		cur := base
+		cur.AtomicUniqueSetNoAdd = []string{"a", "b"}
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("atomicUniqueSetNoAdd").Index(1), "item may not be added").WithOrigin("update"),
+		})
+	}
+
+	// listType=atomic + unique=map: semanticMap path via unique=
+	{
+		old := base
+		old.AtomicUniqueMapFrozenShape = []UpdateItem{
+			{Name: "alpha", Value: "1"},
+			{Name: "beta", Value: "2"},
+		}
+
+		// Value-only change on an existing keyed item is allowed. This
+		// matches listType=map behavior.
+		modify := base
+		modify.AtomicUniqueMapFrozenShape = []UpdateItem{
+			{Name: "alpha", Value: "99"},
+			{Name: "beta", Value: "2"},
+		}
+		st.Value(&modify).OldValue(&old).ExpectValid()
+
+		// Adding a new key is rejected.
+		add := base
+		add.AtomicUniqueMapFrozenShape = []UpdateItem{
+			{Name: "alpha", Value: "1"},
+			{Name: "beta", Value: "2"},
+			{Name: "gamma", Value: "3"},
+		}
+		st.Value(&add).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("atomicUniqueMapFrozenShape").Index(2), "item may not be added").WithOrigin("update"),
+		})
+	}
+
+	// listType=set over non-directly-comparable elements
+	{
+		old := base
+		old.NonComparableSetFrozenShape = []NonComparableItem{
+			{Name: "alpha", Tags: []string{"x", "y"}},
+			{Name: "beta", Tags: []string{"z"}},
+		}
+
+		// Reordering full-value items is allowed (SemanticDeepEqual matches
+		// each one in the old list).
+		reordered := base
+		reordered.NonComparableSetFrozenShape = []NonComparableItem{
+			{Name: "beta", Tags: []string{"z"}},
+			{Name: "alpha", Tags: []string{"x", "y"}},
+		}
+		st.Value(&reordered).OldValue(&old).ExpectValid()
+
+		// Mutating a tag inside one element changes its identity under
+		// set semantics (the whole element is the key), so this is
+		// reported as both an add and a remove.
+		mutated := base
+		mutated.NonComparableSetFrozenShape = []NonComparableItem{
+			{Name: "alpha", Tags: []string{"x", "y", "NEW"}},
+			{Name: "beta", Tags: []string{"z"}},
+		}
+		st.Value(&mutated).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("nonComparableSetFrozenShape").Index(0), "item may not be added").WithOrigin("update"),
+			field.Forbidden(field.NewPath("nonComparableSetFrozenShape"), "may not be removed").WithOrigin("update"),
+		})
+	}
+
+	// Typedef list: metadata inherited from type
+	{
+		old := base
+		old.TypedefFrozenList = FrozenUserList{{Name: "alpha", Value: "1"}}
+
+		// Value-only mutation of the existing keyed item: allowed.
+		modify := base
+		modify.TypedefFrozenList = FrozenUserList{{Name: "alpha", Value: "2"}}
+		st.Value(&modify).OldValue(&old).ExpectValid()
+
+		// Add a new keyed item: rejected.
+		add := base
+		add.TypedefFrozenList = FrozenUserList{
+			{Name: "alpha", Value: "1"},
+			{Name: "beta", Value: "9"},
+		}
+		st.Value(&add).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("typedefFrozenList").Index(1), "item may not be added").WithOrigin("update"),
+		})
+	}
+
+	// eachVal composition on a list: per-item NoModify
+	{
+		old := base
+		old.EachValNoModifyList = []UpdateItem{
+			{Name: "alpha", Value: "1"},
+			{Name: "beta", Value: "2"},
+		}
+
+		// Adding a new keyed item is allowed. NoModify is per-item.
+		add := base
+		add.EachValNoModifyList = []UpdateItem{
+			{Name: "alpha", Value: "1"},
+			{Name: "beta", Value: "2"},
+			{Name: "gamma", Value: "3"},
+		}
+		st.Value(&add).OldValue(&old).ExpectValid()
+
+		// Removing a keyed item is allowed. NoModify is per-item.
+		remove := base
+		remove.EachValNoModifyList = []UpdateItem{{Name: "alpha", Value: "1"}}
+		st.Value(&remove).OldValue(&old).ExpectValid()
+
+		// Mutating the non-key Value field of an existing keyed item fires.
+		mutate := base
+		mutate.EachValNoModifyList = []UpdateItem{
+			{Name: "alpha", Value: "99"},
+			{Name: "beta", Value: "2"},
+		}
+		st.Value(&mutate).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Invalid(field.NewPath("eachValNoModifyList").Index(0), nil, "cannot be modified").WithOrigin("update"),
+		})
+	}
+
+	// Pointer Slice NoSet
+	{
+		old := base
+		old.PointerSliceNoSet = nil
+		cur := base
+		cur.PointerSliceNoSet = []*string{new("a")}
+
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Invalid(field.NewPath("pointerSliceNoSet"), nil, "field cannot be set once created").WithOrigin("update"),
+		})
+
+		// nil -> nil is allowed
+		st.Value(&old).OldValue(&old).ExpectValid()
+	}
+
+	// Pointer listType=set + NoAddItem
+	{
+		old := base
+		old.PointerSetNoAdd = []*string{new("a"), new("b")}
+		cur := base
+		cur.PointerSetNoAdd = []*string{new("a"), new("b"), new("c")}
+
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("pointerSetNoAdd").Index(2), "item may not be added").WithOrigin("update"),
+		})
+	}
+
+	// Pointer listType=map + NoRemoveItem
+	{
+		old := base
+		old.PointerMapListNoRemove = []*UpdateItem{
+			{Name: "alpha", Value: "1"},
+			{Name: "beta", Value: "2"},
+		}
+		cur := base
+		cur.PointerMapListNoRemove = []*UpdateItem{
+			{Name: "alpha", Value: "1"},
+		}
+
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("pointerMapListNoRemove"), "item may not be removed").WithOrigin("update"),
+		})
+	}
+
+	// Nil element in pointer slice on update should trigger Required error from PtrSliceUpdate
+	{
+		old := base
+		old.PointerSetNoAdd = []*string{new("a")}
+		cur := base
+		cur.PointerSetNoAdd = []*string{nil}
+
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Required(field.NewPath("pointerSetNoAdd").Index(0), ""),
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/zz_generated.validations.go
new file mode 100644
index 0000000000..b0e1a4e3fb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/zz_generated.validations.go
@@ -0,0 +1,634 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package lists
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type UpdateListStruct
+	scheme.AddValidationFunc(
+		(*UpdateListStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_UpdateListStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*UpdateListStruct),
+					safe.Cast[*UpdateListStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_FrozenUserList validates an instance of FrozenUserList according
+// to declarative validation rules in the API schema.
+func Validate_FrozenUserList(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj FrozenUserList) (errs field.ErrorList) {
+
+	// lists with map semantics require unique keys
+	if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+		func(a *UpdateItem, b *UpdateItem) bool { return a.Name == b.Name }); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_UpdateListStruct validates an instance of UpdateListStruct according
+// to declarative validation rules in the API schema.
+func Validate_UpdateListStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *UpdateListStruct) (errs field.ErrorList) {
+
+	// field UpdateListStruct.TypeMeta has no validation
+
+	{ // field UpdateListStruct.StringSliceNoSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj, nil, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) []string {
+				return oldObj.StringSliceNoSet
+			})
+		errs = append(errs, fn(fldPath.Child("stringSliceNoSet"), obj.StringSliceNoSet, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateListStruct.StringSliceNoUnset
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj, nil, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) []string {
+				return oldObj.StringSliceNoUnset
+			})
+		errs = append(errs, fn(fldPath.Child("stringSliceNoUnset"), obj.StringSliceNoUnset, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateListStruct.StringSetNoAdd
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, validate.NoAddItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) []string {
+				return oldObj.StringSetNoAdd
+			})
+		errs = append(errs, fn(fldPath.Child("stringSetNoAdd"), obj.StringSetNoAdd, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateListStruct.StringSetNoRemove
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) []string {
+				return oldObj.StringSetNoRemove
+			})
+		errs = append(errs, fn(fldPath.Child("stringSetNoRemove"), obj.StringSetNoRemove, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateListStruct.StringSetFrozenShape
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, validate.NoAddItem, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) []string {
+				return oldObj.StringSetFrozenShape
+			})
+		errs = append(errs, fn(fldPath.Child("stringSetFrozenShape"), obj.StringSetFrozenShape, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateListStruct.MapListNoAdd
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []UpdateItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj,
+				func(a *UpdateItem, b *UpdateItem) bool { return a.Name == b.Name }, validate.NoAddItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *UpdateItem, b *UpdateItem) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) []UpdateItem {
+				return oldObj.MapListNoAdd
+			})
+		errs = append(errs, fn(fldPath.Child("mapListNoAdd"), obj.MapListNoAdd, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateListStruct.MapListFrozenShape
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []UpdateItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj,
+				func(a *UpdateItem, b *UpdateItem) bool { return a.Name == b.Name }, validate.NoAddItem, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *UpdateItem, b *UpdateItem) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) []UpdateItem {
+				return oldObj.MapListFrozenShape
+			})
+		errs = append(errs, fn(fldPath.Child("mapListFrozenShape"), obj.MapListFrozenShape, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateListStruct.CompositeKeyList
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []CompositeKeyItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj,
+				func(a *CompositeKeyItem, b *CompositeKeyItem) bool {
+					return a.Name == b.Name && a.Priority == b.Priority
+				}, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *CompositeKeyItem, b *CompositeKeyItem) bool {
+					return a.Name == b.Name && a.Priority == b.Priority
+				}); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) []CompositeKeyItem {
+				return oldObj.CompositeKeyList
+			})
+		errs = append(errs, fn(fldPath.Child("compositeKeyList"), obj.CompositeKeyList, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateListStruct.AtomicUniqueSetNoAdd
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, validate.NoAddItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) []string {
+				return oldObj.AtomicUniqueSetNoAdd
+			})
+		errs = append(errs, fn(fldPath.Child("atomicUniqueSetNoAdd"), obj.AtomicUniqueSetNoAdd, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateListStruct.AtomicUniqueMapFrozenShape
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []UpdateItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj,
+				func(a *UpdateItem, b *UpdateItem) bool { return a.Name == b.Name }, validate.NoAddItem, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *UpdateItem, b *UpdateItem) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) []UpdateItem {
+				return oldObj.AtomicUniqueMapFrozenShape
+			})
+		errs = append(errs, fn(fldPath.Child("atomicUniqueMapFrozenShape"), obj.AtomicUniqueMapFrozenShape, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateListStruct.NonComparableSetFrozenShape
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []NonComparableItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, validate.NoAddItem, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) []NonComparableItem {
+				return oldObj.NonComparableSetFrozenShape
+			})
+		errs = append(errs, fn(fldPath.Child("nonComparableSetFrozenShape"), obj.NonComparableSetFrozenShape, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateListStruct.TypedefFrozenList
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj FrozenUserList,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj,
+				func(a *UpdateItem, b *UpdateItem) bool { return a.Name == b.Name }, validate.NoAddItem, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_FrozenUserList(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) FrozenUserList {
+				return oldObj.TypedefFrozenList
+			})
+		errs = append(errs, fn(fldPath.Child("typedefFrozenList"), obj.TypedefFrozenList, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateListStruct.EachValNoModifyList
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []UpdateItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *UpdateItem, b *UpdateItem) bool { return a.Name == b.Name }, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *UpdateItem) field.ErrorList {
+					return validate.UpdateStruct(ctx, op, fldPath, obj, oldObj, validate.NoModify)
+				}).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *UpdateItem, b *UpdateItem) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) []UpdateItem {
+				return oldObj.EachValNoModifyList
+			})
+		errs = append(errs, fn(fldPath.Child("eachValNoModifyList"), obj.EachValNoModifyList, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateListStruct.PointerSliceNoSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []*string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrSliceNoNils[string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.PtrSliceUpdate(ctx, op, fldPath, obj, oldObj, nil, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) []*string {
+				return oldObj.PointerSliceNoSet
+			})
+		errs = append(errs, fn(fldPath.Child("pointerSliceNoSet"), obj.PointerSliceNoSet, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateListStruct.PointerSetNoAdd
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []*string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrSliceNoNils[string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.PtrSliceUpdate(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, validate.NoAddItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.PtrSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) []*string {
+				return oldObj.PointerSetNoAdd
+			})
+		errs = append(errs, fn(fldPath.Child("pointerSetNoAdd"), obj.PointerSetNoAdd, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateListStruct.PointerMapListNoRemove
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []*UpdateItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrSliceNoNils[UpdateItem](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.PtrSliceUpdate(ctx, op, fldPath, obj, oldObj,
+				func(a *UpdateItem, b *UpdateItem) bool { return a.Name == b.Name }, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.PtrSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *UpdateItem, b *UpdateItem) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateListStruct) []*UpdateItem {
+				return oldObj.PointerMapListNoRemove
+			})
+		errs = append(errs, fn(fldPath.Child("pointerMapListNoRemove"), obj.PointerMapListNoRemove, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
+func deepEqualImpl_[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc.go
new file mode 100644
index 0000000000..465888aea1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc.go
@@ -0,0 +1,72 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package maps
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type UpdateMapStruct struct {
+	TypeMeta int
+
+	// +k8s:update=NoSet
+	MapNoSet map[string]string `json:"mapNoSet"`
+
+	// +k8s:update=NoUnset
+	MapNoUnset map[string]string `json:"mapNoUnset"`
+
+	// +k8s:update=NoAddItem
+	MapNoAdd map[string]string `json:"mapNoAdd"`
+
+	// +k8s:update=NoRemoveItem
+	MapNoRemove map[string]string `json:"mapNoRemove"`
+
+	// +k8s:update=NoAddItem
+	// +k8s:update=NoRemoveItem
+	MapFrozenShape map[string]string `json:"mapFrozenShape"`
+
+	// +k8s:update=NoSet
+	// +k8s:update=NoAddItem
+	MapSetThenFreeze map[string]MapItem `json:"mapSetThenFreeze"`
+
+	// eachVal composition: per-value NoModify, key set can still change.
+
+	// +k8s:eachVal=+k8s:update=NoModify
+	EachValNoModifyMap map[string]MapItem `json:"eachValNoModifyMap"`
+
+	// Pointer Map NoSet
+	// +k8s:update=NoSet
+	PointerMapNoSet map[string]*string `json:"pointerMapNoSet"`
+
+	// Pointer Map NoAdd
+	// +k8s:update=NoAddItem
+	PointerMapNoAdd map[string]*string `json:"pointerMapNoAdd"`
+
+	// Pointer Map NoRemove
+	// +k8s:update=NoRemoveItem
+	PointerMapNoRemove map[string]*MapItem `json:"pointerMapNoRemove"`
+}
+
+type MapItem struct {
+	Name  string `json:"name"`
+	Value string `json:"value"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc_test.go
new file mode 100644
index 0000000000..3917898a1c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc_test.go
@@ -0,0 +1,188 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package maps
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestUpdateMapTags(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin()
+	base := UpdateMapStruct{}
+
+	// Map NoSet/NoUnset
+	{
+		old := base
+		cur := base
+		cur.MapNoSet = map[string]string{"a": "1"}
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Invalid(field.NewPath("mapNoSet"), nil, "field cannot be set once created").WithOrigin("update"),
+		})
+	}
+	{
+		old := base
+		old.MapNoUnset = map[string]string{"a": "1"}
+		cur := base
+		cur.MapNoUnset = nil
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Invalid(field.NewPath("mapNoUnset"), nil, "field cannot be cleared once set").WithOrigin("update"),
+		})
+	}
+
+	// Map NoAddItem/NoRemoveItem
+	{
+		old := base
+		old.MapNoAdd = map[string]string{"a": "1"}
+		cur := base
+		cur.MapNoAdd = map[string]string{"a": "1", "b": "2"}
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("mapNoAdd").Key("b"), "item may not be added").WithOrigin("update"),
+		})
+
+		// Value-only change to an existing key is allowed.
+		modify := base
+		modify.MapNoAdd = map[string]string{"a": "99"}
+		st.Value(&modify).OldValue(&old).ExpectValid()
+	}
+	{
+		old := base
+		old.MapNoRemove = map[string]string{"a": "1", "b": "2"}
+		cur := base
+		cur.MapNoRemove = map[string]string{"a": "1"}
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("mapNoRemove").Key("b"), "item may not be removed").WithOrigin("update"),
+		})
+	}
+
+	// Map frozen shape
+	{
+		old := base
+		old.MapFrozenShape = map[string]string{"a": "1", "b": "2"}
+
+		// Value-only change: allowed.
+		modify := base
+		modify.MapFrozenShape = map[string]string{"a": "11", "b": "22"}
+		st.Value(&modify).OldValue(&old).ExpectValid()
+
+		// Swap one key: one add + one remove.
+		swap := base
+		swap.MapFrozenShape = map[string]string{"a": "1", "c": "3"}
+		st.Value(&swap).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("mapFrozenShape").Key("c"), "item may not be added").WithOrigin("update"),
+			field.Forbidden(field.NewPath("mapFrozenShape").Key("b"), "item may not be removed").WithOrigin("update"),
+		})
+	}
+
+	// Map combined NoSet + NoAddItem
+	{
+		old := base
+		cur := base
+		cur.MapSetThenFreeze = map[string]MapItem{"k": {Name: "k", Value: "v"}}
+
+		// Both constraints fire: NoSet on the empty->non-empty transition
+		// and NoAddItem on the new key.
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Invalid(field.NewPath("mapSetThenFreeze"), nil, "field cannot be set once created").WithOrigin("update"),
+			field.Forbidden(field.NewPath("mapSetThenFreeze").Key("k"), "item may not be added").WithOrigin("update"),
+		})
+	}
+
+	// eachVal composition on a map: per-value NoModify
+	{
+		old := base
+		old.EachValNoModifyMap = map[string]MapItem{
+			"a": {Name: "a", Value: "1"},
+		}
+
+		// Adding/removing keys is fine.
+		add := base
+		add.EachValNoModifyMap = map[string]MapItem{
+			"a": {Name: "a", Value: "1"},
+			"b": {Name: "b", Value: "2"},
+		}
+		st.Value(&add).OldValue(&old).ExpectValid()
+
+		// Mutating an existing value fires.
+		mutate := base
+		mutate.EachValNoModifyMap = map[string]MapItem{
+			"a": {Name: "a", Value: "99"},
+		}
+		st.Value(&mutate).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Invalid(field.NewPath("eachValNoModifyMap").Key("a"), nil, "cannot be modified").WithOrigin("update"),
+		})
+	}
+
+	// Pointer Map NoSet
+	{
+		old := base
+		old.PointerMapNoSet = nil
+		cur := base
+		cur.PointerMapNoSet = map[string]*string{"a": new("1")}
+
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Invalid(field.NewPath("pointerMapNoSet"), nil, "field cannot be set once created").WithOrigin("update"),
+		})
+
+		// nil -> nil is allowed
+		st.Value(&old).OldValue(&old).ExpectValid()
+	}
+
+	// Pointer Map NoAddItem
+	{
+		old := base
+		old.PointerMapNoAdd = map[string]*string{"a": new("1")}
+		cur := base
+		cur.PointerMapNoAdd = map[string]*string{"a": new("1"), "b": new("2")}
+
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("pointerMapNoAdd").Key("b"), "item may not be added").WithOrigin("update"),
+		})
+	}
+
+	// Pointer Map NoRemoveItem
+	{
+		old := base
+		old.PointerMapNoRemove = map[string]*MapItem{
+			"a": {Name: "a", Value: "1"},
+			"b": {Name: "b", Value: "2"},
+		}
+		cur := base
+		cur.PointerMapNoRemove = map[string]*MapItem{
+			"a": {Name: "a", Value: "1"},
+		}
+
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Forbidden(field.NewPath("pointerMapNoRemove").Key("b"), "item may not be removed").WithOrigin("update"),
+		})
+	}
+
+	// Nil element in pointer map on update should trigger Required error from PtrMapNoNils
+	{
+		old := base
+		old.PointerMapNoAdd = map[string]*string{"a": new("1")}
+		cur := base
+		cur.PointerMapNoAdd = map[string]*string{"a": nil}
+
+		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
+			field.Required(field.NewPath("pointerMapNoAdd").Key("a"), ""),
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/zz_generated.validations.go
new file mode 100644
index 0000000000..e471ab1470
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/zz_generated.validations.go
@@ -0,0 +1,373 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package maps
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type UpdateMapStruct
+	scheme.AddValidationFunc(
+		(*UpdateMapStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_UpdateMapStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*UpdateMapStruct),
+					safe.Cast[*UpdateMapStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_UpdateMapStruct validates an instance of UpdateMapStruct according
+// to declarative validation rules in the API schema.
+func Validate_UpdateMapStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *UpdateMapStruct) (errs field.ErrorList) {
+
+	// field UpdateMapStruct.TypeMeta has no validation
+
+	{ // field UpdateMapStruct.MapNoSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateMap(ctx, op, fldPath, obj, oldObj, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateMapStruct) map[string]string {
+				return oldObj.MapNoSet
+			})
+		errs = append(errs, fn(fldPath.Child("mapNoSet"), obj.MapNoSet, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateMapStruct.MapNoUnset
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateMap(ctx, op, fldPath, obj, oldObj, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateMapStruct) map[string]string {
+				return oldObj.MapNoUnset
+			})
+		errs = append(errs, fn(fldPath.Child("mapNoUnset"), obj.MapNoUnset, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateMapStruct.MapNoAdd
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateMap(ctx, op, fldPath, obj, oldObj, validate.NoAddItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateMapStruct) map[string]string {
+				return oldObj.MapNoAdd
+			})
+		errs = append(errs, fn(fldPath.Child("mapNoAdd"), obj.MapNoAdd, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateMapStruct.MapNoRemove
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateMap(ctx, op, fldPath, obj, oldObj, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateMapStruct) map[string]string {
+				return oldObj.MapNoRemove
+			})
+		errs = append(errs, fn(fldPath.Child("mapNoRemove"), obj.MapNoRemove, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateMapStruct.MapFrozenShape
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateMap(ctx, op, fldPath, obj, oldObj, validate.NoAddItem, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateMapStruct) map[string]string {
+				return oldObj.MapFrozenShape
+			})
+		errs = append(errs, fn(fldPath.Child("mapFrozenShape"), obj.MapFrozenShape, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateMapStruct.MapSetThenFreeze
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateMap(ctx, op, fldPath, obj, oldObj, validate.NoSet, validate.NoAddItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateMapStruct) map[string]MapItem {
+				return oldObj.MapSetThenFreeze
+			})
+		errs = append(errs, fn(fldPath.Child("mapSetThenFreeze"), obj.MapSetThenFreeze, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateMapStruct.EachValNoModifyMap
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MapItem) field.ErrorList {
+					return validate.UpdateStruct(ctx, op, fldPath, obj, oldObj, validate.NoModify)
+				}).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateMapStruct) map[string]MapItem {
+				return oldObj.EachValNoModifyMap
+			})
+		errs = append(errs, fn(fldPath.Child("eachValNoModifyMap"), obj.EachValNoModifyMap, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateMapStruct.PointerMapNoSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]*string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrMapNoNils[string, string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.UpdateMap(ctx, op, fldPath, obj, oldObj, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateMapStruct) map[string]*string {
+				return oldObj.PointerMapNoSet
+			})
+		errs = append(errs, fn(fldPath.Child("pointerMapNoSet"), obj.PointerMapNoSet, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateMapStruct.PointerMapNoAdd
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]*string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrMapNoNils[string, string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.UpdateMap(ctx, op, fldPath, obj, oldObj, validate.NoAddItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateMapStruct) map[string]*string {
+				return oldObj.PointerMapNoAdd
+			})
+		errs = append(errs, fn(fldPath.Child("pointerMapNoAdd"), obj.PointerMapNoAdd, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateMapStruct.PointerMapNoRemove
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]*MapItem,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.PtrMapNoNils[string, MapItem](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.UpdateMap(ctx, op, fldPath, obj, oldObj, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateMapStruct) map[string]*MapItem {
+				return oldObj.PointerMapNoRemove
+			})
+		errs = append(errs, fn(fldPath.Child("pointerMapNoRemove"), obj.PointerMapNoRemove, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/doc.go
new file mode 100644
index 0000000000..46af4eadcb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/doc.go
@@ -0,0 +1,126 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package for the +k8s:update tag.
+// +k8s:validation-gen-nolint
+package primitives
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type UpdateTestStruct struct {
+	TypeMeta int
+
+	// +k8s:update=NoSet
+	StringNoSet string `json:"stringNoSet"`
+
+	// +k8s:update=NoUnset
+	StringNoUnset string `json:"stringNoUnset"`
+
+	// +k8s:update=NoModify
+	StringNoModify string `json:"stringNoModify"`
+
+	// +k8s:update=NoSet
+	// +k8s:update=NoModify
+	// +k8s:update=NoUnset
+	StringFullyRestricted string `json:"stringFullyRestricted"`
+
+	// +k8s:update=NoModify
+	// +k8s:update=NoUnset
+	StringSetOnce string `json:"stringSetOnce"`
+
+	// +k8s:update=NoModify
+	IntNoModify int `json:"intNoModify"`
+
+	// +k8s:update=NoModify
+	Int32NoModify int32 `json:"int32NoModify"`
+
+	// +k8s:update=NoModify
+	Int64NoModify int64 `json:"int64NoModify"`
+
+	// +k8s:update=NoModify
+	UintNoModify uint `json:"uintNoModify"`
+
+	// +k8s:update=NoModify
+	BoolNoModify bool `json:"boolNoModify"`
+
+	// +k8s:update=NoModify
+	Float32NoModify float32 `json:"float32NoModify"`
+
+	// +k8s:update=NoModify
+	Float64NoModify float64 `json:"float64NoModify"`
+
+	// +k8s:update=NoModify
+	ByteNoModify byte `json:"byteNoModify"`
+
+	// +k8s:update=NoModify
+	StructNoModify TestStruct `json:"structNoModify"`
+
+	// +k8s:update=NoModify
+	NonComparableStructNoModify NonComparableStruct `json:"nonComparableStructNoModify"`
+
+	// Pointer field tests
+
+	// +k8s:update=NoSet
+	PointerNoSet *string `json:"pointerNoSet"`
+
+	// +k8s:update=NoUnset
+	PointerNoUnset *string `json:"pointerNoUnset"`
+
+	// +k8s:update=NoModify
+	PointerNoModify *string `json:"pointerNoModify"`
+
+	// +k8s:update=NoSet
+	// +k8s:update=NoModify
+	// +k8s:update=NoUnset
+	PointerFullyRestricted *string `json:"pointerFullyRestricted"`
+
+	// +k8s:update=NoModify
+	IntPointerNoModify *int `json:"intPointerNoModify"`
+
+	// +k8s:update=NoModify
+	BoolPointerNoModify *bool `json:"boolPointerNoModify"`
+
+	// +k8s:update=NoModify
+	StructPointerNoModify *TestStruct `json:"structPointerNoModify"`
+
+	// Type alias tests
+
+	// +k8s:update=NoModify
+	CustomTypeNoModify CustomString `json:"customTypeNoModify"`
+
+	// +k8s:update=NoSet
+	CustomTypeNoSet CustomInt `json:"customTypeNoSet"`
+}
+
+type TestStruct struct {
+	StringField string `json:"stringField"`
+	IntField    int    `json:"intField"`
+}
+
+// NonComparableStruct contains a slice which makes it non-comparable
+type NonComparableStruct struct {
+	SliceField []string `json:"sliceField"`
+	IntField   int      `json:"intField"`
+}
+
+// Custom types to test type aliases
+type CustomString string
+type CustomInt int
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/doc_test.go
new file mode 100644
index 0000000000..bbefa4c5c5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/doc_test.go
@@ -0,0 +1,401 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package primitives
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestUpdateTags(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	baseStruct := UpdateTestStruct{}
+
+	// String NoSet
+	old := baseStruct
+	old.StringNoSet = "" // unset
+
+	new := baseStruct
+	new.StringNoSet = "value"
+
+	st.Value(&new).OldValue(&old).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("stringNoSet"), nil, "field cannot be set once created").WithOrigin("update"),
+	})
+
+	st.Value(&old).OldValue(&old).ExpectValid()
+
+	// String NoUnset
+	oldWithValue := baseStruct
+	oldWithValue.StringNoUnset = "value"
+
+	newUnset := baseStruct
+	newUnset.StringNoUnset = ""
+
+	// Can set initially (empty to non-empty)
+	st.Value(&oldWithValue).OldValue(&baseStruct).ExpectValid()
+
+	// Cannot unset (non-empty to empty)
+	st.Value(&newUnset).OldValue(&oldWithValue).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("stringNoUnset"), nil, "field cannot be cleared once set").WithOrigin("update"),
+	})
+
+	// String NoModify
+	oldEmpty := baseStruct
+	withValue := baseStruct
+	withValue.StringNoModify = "value"
+	modified := baseStruct
+	modified.StringNoModify = "different"
+
+	// Can set initially (empty to non-empty)
+	st.Value(&withValue).OldValue(&oldEmpty).ExpectValid()
+
+	// Can unset (non-empty to empty)
+	st.Value(&oldEmpty).OldValue(&withValue).ExpectValid()
+
+	// Cannot modify (non-empty to different non-empty)
+	st.Value(&modified).OldValue(&withValue).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("stringNoModify"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// String Fully Restricted
+	oldEmpty = baseStruct
+	withValue = baseStruct
+	withValue.StringFullyRestricted = "value"
+	modified = baseStruct
+	modified.StringFullyRestricted = "different"
+
+	// Cannot set (NoSet)
+	st.Value(&withValue).OldValue(&oldEmpty).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("stringFullyRestricted"), nil, "field cannot be set once created").WithOrigin("update"),
+	})
+
+	// Cannot unset (NoUnset)
+	st.Value(&oldEmpty).OldValue(&withValue).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("stringFullyRestricted"), nil, "field cannot be cleared once set").WithOrigin("update"),
+	})
+
+	// Cannot modify (NoModify)
+	st.Value(&modified).OldValue(&withValue).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("stringFullyRestricted"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// String Set-Once Pattern
+	oldEmpty = baseStruct
+	withValue = baseStruct
+	withValue.StringSetOnce = "value"
+	modified = baseStruct
+	modified.StringSetOnce = "different"
+
+	// Can set once (empty to non-empty)
+	st.Value(&withValue).OldValue(&oldEmpty).ExpectValid()
+
+	// Cannot unset (NoUnset)
+	st.Value(&oldEmpty).OldValue(&withValue).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("stringSetOnce"), nil, "field cannot be cleared once set").WithOrigin("update"),
+	})
+
+	// Cannot modify (NoModify)
+	st.Value(&modified).OldValue(&withValue).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("stringSetOnce"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// Int NoModify
+	oldZero := baseStruct
+	withValue = baseStruct
+	withValue.IntNoModify = 10
+
+	// Can transition from 0 to 10 (unset to set is allowed)
+	st.Value(&withValue).OldValue(&oldZero).ExpectValid()
+
+	// Cannot modify from one non-zero to another
+	modified = baseStruct
+	modified.IntNoModify = 20
+	st.Value(&modified).OldValue(&withValue).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("intNoModify"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// Int32 NoModify
+	old = baseStruct
+	withValue = baseStruct
+	withValue.Int32NoModify = 42
+
+	// Can set initially
+	st.Value(&withValue).OldValue(&old).ExpectValid()
+
+	// Cannot modify
+	modified = baseStruct
+	modified.Int32NoModify = 100
+	st.Value(&modified).OldValue(&withValue).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("int32NoModify"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// Uint NoModify
+	old = baseStruct
+	withValue = baseStruct
+	withValue.UintNoModify = 42
+
+	// Can set initially
+	st.Value(&withValue).OldValue(&old).ExpectValid()
+
+	// Cannot modify
+	modified = baseStruct
+	modified.UintNoModify = 100
+	st.Value(&modified).OldValue(&withValue).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("uintNoModify"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// Bool NoModify
+	oldFalse := baseStruct
+	withTrue := baseStruct
+	withTrue.BoolNoModify = true
+
+	// Can transition from false to true (unset to set)
+	st.Value(&withTrue).OldValue(&oldFalse).ExpectValid()
+
+	// Cannot modify back to false
+	st.Value(&oldFalse).OldValue(&withTrue).ExpectValid() // This is allowed as it's set->unset
+
+	// Float32 NoModify
+	old = baseStruct
+	withValue = baseStruct
+	withValue.Float32NoModify = 3.14
+
+	// Can set initially
+	st.Value(&withValue).OldValue(&old).ExpectValid()
+
+	// Cannot modify
+	modified = baseStruct
+	modified.Float32NoModify = 2.71
+	st.Value(&modified).OldValue(&withValue).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("float32NoModify"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// Float64 NoModify
+	oldZero = baseStruct
+	withValue = baseStruct
+	withValue.Float64NoModify = 3.14
+
+	// Can transition from 0.0 to 3.14
+	st.Value(&withValue).OldValue(&oldZero).ExpectValid()
+
+	// Cannot modify to different value
+	modified = baseStruct
+	modified.Float64NoModify = 2.71
+	st.Value(&modified).OldValue(&withValue).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("float64NoModify"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// Byte NoModify
+	old = baseStruct
+	withValue = baseStruct
+	withValue.ByteNoModify = 255
+
+	// Can set initially
+	st.Value(&withValue).OldValue(&old).ExpectValid()
+
+	// Cannot modify
+	modified = baseStruct
+	modified.ByteNoModify = 128
+	st.Value(&modified).OldValue(&withValue).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("byteNoModify"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// Struct NoModify
+	withStruct := baseStruct
+	withStruct.StructNoModify = TestStruct{StringField: "value", IntField: 42}
+
+	modifiedStruct := baseStruct
+	modifiedStruct.StructNoModify = TestStruct{StringField: "different", IntField: 100}
+
+	// Cannot modify (struct fields are always set, never unset)
+	st.Value(&modifiedStruct).OldValue(&withStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("structNoModify"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// NonComparable Struct NoModify - uses reflection
+	// For non-pointer structs, even zero value is considered "set"
+	// So any change is a modification
+	old = baseStruct
+	old.NonComparableStructNoModify = NonComparableStruct{} // zero value
+
+	withValue = baseStruct
+	withValue.NonComparableStructNoModify = NonComparableStruct{
+		SliceField: []string{"a", "b"},
+		IntField:   42,
+	}
+
+	// Cannot change from zero value to non-zero (both are "set")
+	st.Value(&withValue).OldValue(&old).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("nonComparableStructNoModify"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// Also cannot modify between two non-zero values
+	modified = baseStruct
+	modified.NonComparableStructNoModify = NonComparableStruct{
+		SliceField: []string{"c", "d"},
+		IntField:   100,
+	}
+	st.Value(&modified).OldValue(&withValue).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("nonComparableStructNoModify"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// Can keep the same value
+	st.Value(&withValue).OldValue(&withValue).ExpectValid()
+
+	// Pointer NoSet
+	withSet := baseStruct
+	withSet.PointerNoSet = ptr.To("value")
+
+	// Cannot set after creation (nil to non-nil)
+	st.Value(&withSet).OldValue(&baseStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("pointerNoSet"), nil, "field cannot be set once created").WithOrigin("update"),
+	})
+
+	// Pointer NoUnset
+	withPointer := baseStruct
+	withPointer.PointerNoUnset = ptr.To("value")
+
+	// Can set initially
+	st.Value(&withPointer).OldValue(&baseStruct).ExpectValid()
+
+	// Cannot unset (non-nil to nil)
+	st.Value(&baseStruct).OldValue(&withPointer).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("pointerNoUnset"), nil, "field cannot be cleared once set").WithOrigin("update"),
+	})
+
+	// Pointer NoModify
+	withPointer = baseStruct
+	withPointer.PointerNoModify = ptr.To("value")
+
+	modifiedPointer := baseStruct
+	modifiedPointer.PointerNoModify = ptr.To("different")
+
+	// Can set initially
+	st.Value(&withPointer).OldValue(&baseStruct).ExpectValid()
+
+	// Can unset (NoModify allows set/unset transitions)
+	st.Value(&baseStruct).OldValue(&withPointer).ExpectValid()
+
+	// Cannot modify content
+	st.Value(&modifiedPointer).OldValue(&withPointer).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("pointerNoModify"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// Pointer Fully Restricted
+	withPointer = baseStruct
+	withPointer.PointerFullyRestricted = ptr.To("value")
+
+	modifiedPointer = baseStruct
+	modifiedPointer.PointerFullyRestricted = ptr.To("different")
+
+	// Cannot set (NoSet)
+	st.Value(&withPointer).OldValue(&baseStruct).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("pointerFullyRestricted"), nil, "field cannot be set once created").WithOrigin("update"),
+	})
+
+	// Cannot unset (NoUnset)
+	st.Value(&baseStruct).OldValue(&withPointer).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("pointerFullyRestricted"), nil, "field cannot be cleared once set").WithOrigin("update"),
+	})
+
+	// Cannot modify (NoModify)
+	st.Value(&modifiedPointer).OldValue(&withPointer).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("pointerFullyRestricted"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// Int Pointer NoModify
+	withPointer = baseStruct
+	withPointer.IntPointerNoModify = ptr.To(42)
+
+	modifiedPointer = baseStruct
+	modifiedPointer.IntPointerNoModify = ptr.To(100)
+
+	// Can set initially
+	st.Value(&withPointer).OldValue(&baseStruct).ExpectValid()
+
+	// Can unset
+	st.Value(&baseStruct).OldValue(&withPointer).ExpectValid()
+
+	// Cannot modify content
+	st.Value(&modifiedPointer).OldValue(&withPointer).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("intPointerNoModify"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// Bool Pointer NoModify
+	falseVal := false
+	trueVal := true
+
+	withFalse := baseStruct
+	withFalse.BoolPointerNoModify = &falseVal
+
+	withTrue = baseStruct
+	withTrue.BoolPointerNoModify = &trueVal
+
+	// Can set initially
+	st.Value(&withFalse).OldValue(&baseStruct).ExpectValid()
+
+	// Cannot modify content
+	st.Value(&withTrue).OldValue(&withFalse).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("boolPointerNoModify"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// Struct Pointer NoModify
+	withPointer = baseStruct
+	withPointer.StructPointerNoModify = &TestStruct{StringField: "value", IntField: 42}
+
+	modifiedPointer = baseStruct
+	modifiedPointer.StructPointerNoModify = &TestStruct{StringField: "different", IntField: 100}
+
+	// Can set initially
+	st.Value(&withPointer).OldValue(&baseStruct).ExpectValid()
+
+	// Can unset
+	st.Value(&baseStruct).OldValue(&withPointer).ExpectValid()
+
+	// Cannot modify content
+	st.Value(&modifiedPointer).OldValue(&withPointer).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("structPointerNoModify"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// Custom Type NoModify
+	old = baseStruct
+	withValue = baseStruct
+	withValue.CustomTypeNoModify = "custom-value"
+
+	// Can set initially
+	st.Value(&withValue).OldValue(&old).ExpectValid()
+
+	// Cannot modify
+	modified = baseStruct
+	modified.CustomTypeNoModify = "different-value"
+	st.Value(&modified).OldValue(&withValue).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("customTypeNoModify"), nil, "field cannot be modified once set").WithOrigin("update"),
+	})
+
+	// Custom Type NoSet
+	old = baseStruct
+	withValue = baseStruct
+	withValue.CustomTypeNoSet = 42
+
+	// Cannot set
+	st.Value(&withValue).OldValue(&old).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("customTypeNoSet"), nil, "field cannot be set once created").WithOrigin("update"),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/zz_generated.validations.go
new file mode 100644
index 0000000000..61e82e9fde
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/zz_generated.validations.go
@@ -0,0 +1,779 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package primitives
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type UpdateTestStruct
+	scheme.AddValidationFunc(
+		(*UpdateTestStruct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_UpdateTestStruct(
+					ctx, op, nil, /* fldPath */
+					obj.(*UpdateTestStruct),
+					safe.Cast[*UpdateTestStruct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_UpdateTestStruct validates an instance of UpdateTestStruct according
+// to declarative validation rules in the API schema.
+func Validate_UpdateTestStruct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *UpdateTestStruct) (errs field.ErrorList) {
+
+	// field UpdateTestStruct.TypeMeta has no validation
+
+	{ // field UpdateTestStruct.StringNoSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a string, b string) bool { return a == b }, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *string {
+				return &oldObj.StringNoSet
+			})
+		errs = append(errs, fn(fldPath.Child("stringNoSet"), &obj.StringNoSet, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.StringNoUnset
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a string, b string) bool { return a == b }, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *string {
+				return &oldObj.StringNoUnset
+			})
+		errs = append(errs, fn(fldPath.Child("stringNoUnset"), &obj.StringNoUnset, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.StringNoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a string, b string) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *string {
+				return &oldObj.StringNoModify
+			})
+		errs = append(errs, fn(fldPath.Child("stringNoModify"), &obj.StringNoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.StringFullyRestricted
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a string, b string) bool { return a == b }, validate.NoSet, validate.NoUnset, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *string {
+				return &oldObj.StringFullyRestricted
+			})
+		errs = append(errs, fn(fldPath.Child("stringFullyRestricted"), &obj.StringFullyRestricted, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.StringSetOnce
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a string, b string) bool { return a == b }, validate.NoUnset, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *string {
+				return &oldObj.StringSetOnce
+			})
+		errs = append(errs, fn(fldPath.Child("stringSetOnce"), &obj.StringSetOnce, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.IntNoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a int, b int) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *int {
+				return &oldObj.IntNoModify
+			})
+		errs = append(errs, fn(fldPath.Child("intNoModify"), &obj.IntNoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.Int32NoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int32,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a int32, b int32) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *int32 {
+				return &oldObj.Int32NoModify
+			})
+		errs = append(errs, fn(fldPath.Child("int32NoModify"), &obj.Int32NoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.Int64NoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a int64, b int64) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *int64 {
+				return &oldObj.Int64NoModify
+			})
+		errs = append(errs, fn(fldPath.Child("int64NoModify"), &obj.Int64NoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.UintNoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *uint,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a uint, b uint) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *uint {
+				return &oldObj.UintNoModify
+			})
+		errs = append(errs, fn(fldPath.Child("uintNoModify"), &obj.UintNoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.BoolNoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a bool, b bool) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *bool {
+				return &oldObj.BoolNoModify
+			})
+		errs = append(errs, fn(fldPath.Child("boolNoModify"), &obj.BoolNoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.Float32NoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *float32,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a float32, b float32) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *float32 {
+				return &oldObj.Float32NoModify
+			})
+		errs = append(errs, fn(fldPath.Child("float32NoModify"), &obj.Float32NoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.Float64NoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *float64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a float64, b float64) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *float64 {
+				return &oldObj.Float64NoModify
+			})
+		errs = append(errs, fn(fldPath.Child("float64NoModify"), &obj.Float64NoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.ByteNoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *byte,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a byte, b byte) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *byte {
+				return &oldObj.ByteNoModify
+			})
+		errs = append(errs, fn(fldPath.Child("byteNoModify"), &obj.ByteNoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.StructNoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TestStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateStruct(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *TestStruct {
+				return &oldObj.StructNoModify
+			})
+		errs = append(errs, fn(fldPath.Child("structNoModify"), &obj.StructNoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.NonComparableStructNoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *NonComparableStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateStruct(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *NonComparableStruct {
+				return &oldObj.NonComparableStructNoModify
+			})
+		errs = append(errs, fn(fldPath.Child("nonComparableStructNoModify"), &obj.NonComparableStructNoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.PointerNoSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdatePointer(ctx, op, fldPath, obj, oldObj, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *string {
+				return oldObj.PointerNoSet
+			})
+		errs = append(errs, fn(fldPath.Child("pointerNoSet"), obj.PointerNoSet, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.PointerNoUnset
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdatePointer(ctx, op, fldPath, obj, oldObj, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *string {
+				return oldObj.PointerNoUnset
+			})
+		errs = append(errs, fn(fldPath.Child("pointerNoUnset"), obj.PointerNoUnset, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.PointerNoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdatePointer(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *string {
+				return oldObj.PointerNoModify
+			})
+		errs = append(errs, fn(fldPath.Child("pointerNoModify"), obj.PointerNoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.PointerFullyRestricted
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdatePointer(ctx, op, fldPath, obj, oldObj, validate.NoSet, validate.NoUnset, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *string {
+				return oldObj.PointerFullyRestricted
+			})
+		errs = append(errs, fn(fldPath.Child("pointerFullyRestricted"), obj.PointerFullyRestricted, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.IntPointerNoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdatePointer(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *int {
+				return oldObj.IntPointerNoModify
+			})
+		errs = append(errs, fn(fldPath.Child("intPointerNoModify"), obj.IntPointerNoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.BoolPointerNoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdatePointer(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *bool {
+				return oldObj.BoolPointerNoModify
+			})
+		errs = append(errs, fn(fldPath.Child("boolPointerNoModify"), obj.BoolPointerNoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.StructPointerNoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TestStruct,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdatePointer(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *TestStruct {
+				return oldObj.StructPointerNoModify
+			})
+		errs = append(errs, fn(fldPath.Child("structPointerNoModify"), obj.StructPointerNoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.CustomTypeNoModify
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *CustomString,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a CustomString, b CustomString) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *CustomString {
+				return &oldObj.CustomTypeNoModify
+			})
+		errs = append(errs, fn(fldPath.Child("customTypeNoModify"), &obj.CustomTypeNoModify, oldVal, oldObj != nil)...)
+	}
+
+	{ // field UpdateTestStruct.CustomTypeNoSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *CustomInt,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
+				func(a CustomInt, b CustomInt) bool { return a == b }, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *UpdateTestStruct) *CustomInt {
+				return &oldObj.CustomTypeNoSet
+			})
+		errs = append(errs, fn(fldPath.Child("customTypeNoSet"), &obj.CustomTypeNoSet, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_false/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_false/doc.go
new file mode 100644
index 0000000000..9ad0c06a03
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_false/doc.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package validatefalse
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field Struct.StringField"
+	StringField string `json:"stringField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_false/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_false/doc_test.go
new file mode 100644
index 0000000000..3bbc4edecc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_false/doc_test.go
@@ -0,0 +1,45 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validatefalse
+
+import (
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero-values.
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"stringField": {"field Struct.StringField"},
+	})
+	// Test validation ratcheting
+	st.Value(&Struct{}).OldValue(&Struct{}).ExpectValid()
+
+	st.Value(&Struct{
+		StringField: "abc",
+	}).ExpectValidateFalseByPath(map[string][]string{
+		"stringField": {"field Struct.StringField"},
+	})
+	// Test validation ratcheting
+	st.Value(&Struct{
+		StringField: "abc",
+	}).OldValue(&Struct{
+		StringField: "abc",
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_false/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_false/zz_generated.validations.go
new file mode 100644
index 0000000000..551b70fa22
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_false/zz_generated.validations.go
@@ -0,0 +1,91 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package validatefalse
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.StringField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_true/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_true/doc.go
new file mode 100644
index 0000000000..c58589c772
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_true/doc.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package validatetrue
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:validateTrue="field Struct.StringField"
+	StringField string `json:"stringField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_true/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_true/doc_test.go
new file mode 100644
index 0000000000..7123c9588d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_true/doc_test.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validatetrue
+
+import (
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero-values.
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		StringField: "abc",
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_true/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_true/zz_generated.validations.go
new file mode 100644
index 0000000000..eea30b7e58
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validate_true/zz_generated.validations.go
@@ -0,0 +1,91 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package validatetrue
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field Struct.StringField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruealpha/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruealpha/doc.go
new file mode 100644
index 0000000000..1019067ece
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruealpha/doc.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package validatetruealpha
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:validateTrueAlpha="field Struct.StringField"
+	StringField string `json:"stringField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruealpha/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruealpha/doc_test.go
new file mode 100644
index 0000000000..e741b3ab25
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruealpha/doc_test.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validatetruealpha
+
+import (
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero-values.
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		StringField: "abc",
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruealpha/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruealpha/zz_generated.validations.go
new file mode 100644
index 0000000000..670aa29bdb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruealpha/zz_generated.validations.go
@@ -0,0 +1,91 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package validatetruealpha
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field Struct.StringField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruebeta/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruebeta/doc.go
new file mode 100644
index 0000000000..37e863bfd3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruebeta/doc.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package validatetruebeta
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	TypeMeta int
+
+	// +k8s:validateTrueBeta="field Struct.StringField"
+	StringField string `json:"stringField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruebeta/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruebeta/doc_test.go
new file mode 100644
index 0000000000..534712bd5c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruebeta/doc_test.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validatetruebeta
+
+import (
+	"testing"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	st.Value(&Struct{
+		// All zero-values.
+	}).ExpectValid()
+
+	st.Value(&Struct{
+		StringField: "abc",
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruebeta/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruebeta/zz_generated.validations.go
new file mode 100644
index 0000000000..73d5b60fa8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/validatetruebeta/zz_generated.validations.go
@@ -0,0 +1,91 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package validatetruebeta
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	// field Struct.TypeMeta has no validation
+
+	{ // field Struct.StringField
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, true, "field Struct.StringField"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.StringField
+			})
+		errs = append(errs, fn(fldPath.Child("stringField"), &obj.StringField, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/custom_members/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/custom_members/doc.go
new file mode 100644
index 0000000000..98cd500812
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/custom_members/doc.go
@@ -0,0 +1,45 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package custommembers
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Non-discriminated zero-or-one-of union with custom member names
+type Struct struct {
+	TypeMeta int
+
+	NonUnionField string `json:"nonUnionField"`
+
+	// +k8s:zeroOrOneOfMember(memberName: "CustomM1")
+	// +k8s:optional
+	M1 *M1 `json:"m1"`
+
+	// +k8s:zeroOrOneOfMember(memberName: "CustomM2")
+	// +k8s:optional
+	M2 *M2 `json:"m2"`
+}
+
+type M1 struct{}
+
+type M2 struct{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/custom_members/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/custom_members/doc_test.go
new file mode 100644
index 0000000000..a8d559372e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/custom_members/doc_test.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package custommembers
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Empty union is valid
+	st.Value(&Struct{}).ExpectValid()
+
+	st.Value(&Struct{M1: &M1{}}).ExpectValid()
+	st.Value(&Struct{M2: &M2{}}).ExpectValid()
+
+	st.Value(&Struct{M1: &M1{}, M2: &M2{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify at most one of"),
+	})
+
+	// Test validation ratcheting
+	st.Value(&Struct{M1: &M1{}, M2: &M2{}}).OldValue(&Struct{M1: &M1{}, M2: &M2{}}).ExpectValid()
+	st.Value(&Struct{}).OldValue(&Struct{}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/custom_members/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/custom_members/zz_generated.validations.go
new file mode 100644
index 0000000000..557da66d7d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/custom_members/zz_generated.validations.go
@@ -0,0 +1,142 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package custommembers
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_zerooroneof_zerooroneof_custom_members_Struct_ = validate.NewUnionMembership(validate.NewUnionMember("m1"), validate.NewUnionMember("m2"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.ZeroOrOneOfUnion(ctx, op, fldPath, obj, oldObj, zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_zerooroneof_zerooroneof_custom_members_Struct_,
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M1 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M2 != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+	// field Struct.NonUnionField has no validation
+
+	{ // field Struct.M1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M1 {
+				return oldObj.M1
+			})
+		errs = append(errs, fn(fldPath.Child("m1"), obj.M1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.M2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M2 {
+				return oldObj.M2
+			})
+		errs = append(errs, fn(fldPath.Child("m2"), obj.M2, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/multiple/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/multiple/doc.go
new file mode 100644
index 0000000000..e04ccc0071
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/multiple/doc.go
@@ -0,0 +1,53 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package multiple
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Two non-discriminated zero-or-one-of unions in the same struct
+type Struct struct {
+	TypeMeta int
+
+	NonUnionField string `json:"nonUnionField"`
+
+	// +k8s:zeroOrOneOfMember(union: "union1")
+	// +k8s:optional
+	U1M1 *M1 `json:"u1m1"`
+
+	// +k8s:zeroOrOneOfMember(union: "union1")
+	// +k8s:optional
+	U1M2 *M2 `json:"u1m2"`
+
+	// +k8s:zeroOrOneOfMember(union: "union2")
+	// +k8s:optional
+	U2M1 *M1 `json:"u2m1"`
+
+	// +k8s:zeroOrOneOfMember(union: "union2")
+	// +k8s:optional
+	U2M2 *M2 `json:"u2m2"`
+}
+
+type M1 struct{}
+
+type M2 struct{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/multiple/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/multiple/doc_test.go
new file mode 100644
index 0000000000..2be31c9563
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/multiple/doc_test.go
@@ -0,0 +1,66 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package multiple
+
+import (
+	"testing"
+
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Both unions can be empty
+	st.Value(&Struct{}).ExpectValid()
+
+	// One member from each union
+	st.Value(&Struct{U1M1: &M1{}, U2M1: &M1{}}).ExpectValid()
+	st.Value(&Struct{U1M2: &M2{}, U2M2: &M2{}}).ExpectValid()
+
+	// One union with member, other empty
+	st.Value(&Struct{U1M1: &M1{}}).ExpectValid()
+	st.Value(&Struct{U2M2: &M2{}}).ExpectValid()
+
+	// Multiple members in one union
+	st.Value(&Struct{U1M1: &M1{}, U1M2: &M2{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify at most one of").WithOrigin("zeroOrOneOf"),
+	})
+
+	st.Value(&Struct{U2M1: &M1{}, U2M2: &M2{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify at most one of").WithOrigin("zeroOrOneOf"),
+	})
+
+	st.Value(&Struct{
+		U1M1: &M1{}, U1M2: &M2{},
+		U2M1: &M1{}, U2M2: &M2{},
+	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify at most one of").WithOrigin("zeroOrOneOf"),
+	})
+
+	// Test validation ratcheting
+	st.Value(&Struct{}).OldValue(&Struct{}).ExpectValid()
+	st.Value(&Struct{U1M1: &M1{}, U1M2: &M2{}}).OldValue(&Struct{U1M1: &M1{}, U1M2: &M2{}}).ExpectValid()
+	st.Value(&Struct{U2M1: &M1{}, U2M2: &M2{}}).OldValue(&Struct{U2M1: &M1{}, U2M2: &M2{}}).ExpectValid()
+	st.Value(&Struct{
+		U1M1: &M1{}, U1M2: &M2{},
+		U2M1: &M1{}, U2M2: &M2{},
+	}).OldValue(&Struct{
+		U1M1: &M1{}, U1M2: &M2{},
+		U2M1: &M1{}, U2M2: &M2{},
+	}).ExpectValid()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/multiple/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/multiple/zz_generated.validations.go
new file mode 100644
index 0000000000..5eb2bfbf20
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/multiple/zz_generated.validations.go
@@ -0,0 +1,214 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package multiple
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_zerooroneof_zerooroneof_multiple_Struct_union1 = validate.NewUnionMembership(validate.NewUnionMember("u1m1"), validate.NewUnionMember("u1m2"))
+var zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_zerooroneof_zerooroneof_multiple_Struct_union2 = validate.NewUnionMembership(validate.NewUnionMember("u2m1"), validate.NewUnionMember("u2m2"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.ZeroOrOneOfUnion(ctx, op, fldPath, obj, oldObj, zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_zerooroneof_zerooroneof_multiple_Struct_union1,
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.U1M1 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.U1M2 != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.ZeroOrOneOfUnion(ctx, op, fldPath, obj, oldObj, zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_zerooroneof_zerooroneof_multiple_Struct_union2,
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.U2M1 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.U2M2 != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+	// field Struct.NonUnionField has no validation
+
+	{ // field Struct.U1M1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M1 {
+				return oldObj.U1M1
+			})
+		errs = append(errs, fn(fldPath.Child("u1m1"), obj.U1M1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.U1M2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M2 {
+				return oldObj.U1M2
+			})
+		errs = append(errs, fn(fldPath.Child("u1m2"), obj.U1M2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.U2M1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M1 {
+				return oldObj.U2M1
+			})
+		errs = append(errs, fn(fldPath.Child("u2m1"), obj.U2M1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.U2M2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M2 {
+				return oldObj.U2M2
+			})
+		errs = append(errs, fn(fldPath.Child("u2m2"), obj.U2M2, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/simple/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/simple/doc.go
new file mode 100644
index 0000000000..d0cb62252c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/simple/doc.go
@@ -0,0 +1,53 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package simple
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// Non-discriminated zero-or-one-of union
+type Struct struct {
+	TypeMeta int
+
+	NonUnionField string `json:"nonUnionField"`
+
+	// +k8s:zeroOrOneOfMember
+	// +k8s:optional
+	M1 *M1 `json:"m1"`
+
+	// +k8s:zeroOrOneOfMember
+	// +k8s:optional
+	M2 *M2 `json:"m2"`
+
+	// +k8s:zeroOrOneOfMember
+	// +k8s:optional
+	M3 string `json:"m3"`
+
+	// +k8s:zeroOrOneOfMember
+	// +k8s:optional
+	M4 *string `json:"m4"`
+}
+
+type M1 struct{}
+
+type M2 struct{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/simple/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/simple/doc_test.go
new file mode 100644
index 0000000000..6764fa0654
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/simple/doc_test.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package simple
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	// Empty union is valid for zeroOrOneOf
+	st.Value(&Struct{}).ExpectValid()
+
+	st.Value(&Struct{M1: &M1{}}).ExpectValid()
+	st.Value(&Struct{M2: &M2{}}).ExpectValid()
+	st.Value(&Struct{M3: "a string"}).ExpectValid()
+	st.Value(&Struct{M4: ptr.To("a string")}).ExpectValid()
+
+	st.Value(&Struct{M1: &M1{}, M2: &M2{}}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify at most one of").WithOrigin("zeroOrOneOf"),
+	})
+	st.Value(&Struct{M1: &M1{}, M3: "a string"}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify at most one of").WithOrigin("zeroOrOneOf"),
+	})
+	st.Value(&Struct{M1: &M1{}, M4: ptr.To("a string")}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify at most one of").WithOrigin("zeroOrOneOf"),
+	})
+
+	// Update only considers whether a field was set, not the value.
+	st.Value(&Struct{M3: "a string"}).OldValue(&Struct{M3: "different string"}).ExpectValid()
+
+	// Test validation ratcheting
+	st.Value(&Struct{}).OldValue(&Struct{}).ExpectValid()
+	st.Value(&Struct{M1: &M1{}, M2: &M2{}}).OldValue(&Struct{M1: &M1{}, M2: &M2{}}).ExpectValid()
+	st.Value(&Struct{M3: "a string", M2: &M2{}}).OldValue(&Struct{M3: "different string", M2: &M2{}}).ExpectValid()
+
+	// Test update with nil old value (simulates new map entry added during update).
+	// Empty union is still valid for zeroOrOneOf, even with nil old value.
+	st.Value(&Struct{}).OldValue((*Struct)(nil)).ExpectValid()
+	// Multiple members set should still be caught even with nil old value.
+	st.Value(&Struct{M1: &M1{}, M2: &M2{}}).OldValue((*Struct)(nil)).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(nil, nil, "must specify at most one of").WithOrigin("zeroOrOneOf"),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/simple/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/simple/zz_generated.validations.go
new file mode 100644
index 0000000000..87be5caeef
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/zerooroneof/zerooroneof/simple/zz_generated.validations.go
@@ -0,0 +1,211 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package simple
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+var zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_zerooroneof_zerooroneof_simple_Struct_ = validate.NewUnionMembership(validate.NewUnionMember("m1"), validate.NewUnionMember("m2"), validate.NewUnionMember("m3"), validate.NewUnionMember("m4"))
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	if e := validate.ZeroOrOneOfUnion(ctx, op, fldPath, obj, oldObj, zeroOrOneOfMembershipFor_k8s_io_code_generator_cmd_validation_gen_output_tests_tags_zerooroneof_zerooroneof_simple_Struct_,
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M1 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M2 != nil
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			var z string
+			return obj.M3 != z
+		},
+		func(obj *Struct) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.M4 != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field Struct.TypeMeta has no validation
+	// field Struct.NonUnionField has no validation
+
+	{ // field Struct.M1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M1 {
+				return oldObj.M1
+			})
+		errs = append(errs, fn(fldPath.Child("m1"), obj.M1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.M2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *M2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *M2 {
+				return oldObj.M2
+			})
+		errs = append(errs, fn(fldPath.Child("m2"), obj.M2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.M3
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.M3
+			})
+		errs = append(errs, fn(fldPath.Child("m3"), &obj.M3, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.M4
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.M4
+			})
+		errs = append(errs, fn(fldPath.Child("m4"), obj.M4, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/type_args/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/type_args/doc.go
new file mode 100644
index 0000000000..69102603fa
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/type_args/doc.go
@@ -0,0 +1,55 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package typeargs
+
+import (
+	"k8s.io/code-generator/cmd/validation-gen/output_tests/primitives"
+	"k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+var localSchemeBuilder = testscheme.New()
+
+// Explicitly set the type-arg to prove it renders properly.
+// NOTE: because of how validation code is generated, these must always be
+// pointers, because that is what gets passed around.
+type T1 struct {
+	TypeMeta int
+
+	// +k8s:validateFalse(typeArg: "k8s.io/code-generator/cmd/validation-gen/output_tests/primitives.T1")="T1.S1"
+	S1 *primitives.T1 `json:"s1"`
+	// +k8s:validateFalse(typeArg: "k8s.io/code-generator/cmd/validation-gen/output_tests/primitives.T1")="PT1.PS1"
+	PS1 *primitives.T1 `json:"ps1"`
+
+	// +k8s:validateFalse(typeArg: "k8s.io/code-generator/cmd/validation-gen/output_tests/type_args.E1")="T1.E1"
+	E1 E1 `json:"e1"`
+	// +k8s:validateTrue(typeArg: "k8s.io/code-generator/cmd/validation-gen/output_tests/type_args.E1")="T1.PE1"
+	PE1 *E1 `json:"pe1"`
+
+	// +k8s:validateFalse(typeArg: "int")="T1.I1"
+	I1 int `json:"i1"`
+	// +k8s:validateTrue(typeArg: "int")="T1.PI1"
+	PI1 *int `json:"pi1"`
+}
+
+// +k8s:validateFalse="type E1"
+type E1 string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/type_args/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/type_args/testdata/validate-false.json
new file mode 100644
index 0000000000..53d0f98df2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/type_args/testdata/validate-false.json
@@ -0,0 +1,98 @@
+{
+  "*typeargs.T1": {
+    "e1": [
+      "T1.E1",
+      "type E1"
+    ],
+    "i1": [
+      "T1.I1"
+    ],
+    "pe1": [
+      "type E1"
+    ],
+    "ps1": [
+      "PT1.PS1"
+    ],
+    "ps1.anothert2.b": [
+      "field T2.B"
+    ],
+    "ps1.anothert2.f": [
+      "field T2.F"
+    ],
+    "ps1.anothert2.i": [
+      "field T2.I"
+    ],
+    "ps1.anothert2.s": [
+      "field T2.S"
+    ],
+    "ps1.b": [
+      "field T1.B"
+    ],
+    "ps1.f": [
+      "field T1.F"
+    ],
+    "ps1.i": [
+      "field T1.I"
+    ],
+    "ps1.s": [
+      "field T1.S"
+    ],
+    "ps1.t2": [
+      "field T1.T2"
+    ],
+    "ps1.t2.b": [
+      "field T2.B"
+    ],
+    "ps1.t2.f": [
+      "field T2.F"
+    ],
+    "ps1.t2.i": [
+      "field T2.I"
+    ],
+    "ps1.t2.s": [
+      "field T2.S"
+    ],
+    "s1": [
+      "T1.S1"
+    ],
+    "s1.anothert2.b": [
+      "field T2.B"
+    ],
+    "s1.anothert2.f": [
+      "field T2.F"
+    ],
+    "s1.anothert2.i": [
+      "field T2.I"
+    ],
+    "s1.anothert2.s": [
+      "field T2.S"
+    ],
+    "s1.b": [
+      "field T1.B"
+    ],
+    "s1.f": [
+      "field T1.F"
+    ],
+    "s1.i": [
+      "field T1.I"
+    ],
+    "s1.s": [
+      "field T1.S"
+    ],
+    "s1.t2": [
+      "field T1.T2"
+    ],
+    "s1.t2.b": [
+      "field T2.B"
+    ],
+    "s1.t2.f": [
+      "field T2.F"
+    ],
+    "s1.t2.i": [
+      "field T2.I"
+    ],
+    "s1.t2.s": [
+      "field T2.S"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/type_args/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/type_args/zz_generated.validations.go
new file mode 100644
index 0000000000..ddad383707
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/type_args/zz_generated.validations.go
@@ -0,0 +1,233 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package typeargs
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	primitives "k8s.io/code-generator/cmd/validation-gen/output_tests/primitives"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_E1 validates an instance of E1 according
+// to declarative validation rules in the API schema.
+func Validate_E1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *E1) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type E1"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	// field T1.TypeMeta has no validation
+
+	{ // field T1.S1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *primitives.T1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult[*primitives.T1](ctx, op, fldPath, obj, oldObj, false, "T1.S1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, primitives.Validate_T1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *primitives.T1 {
+				return oldObj.S1
+			})
+		errs = append(errs, fn(fldPath.Child("s1"), obj.S1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PS1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *primitives.T1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult[*primitives.T1](ctx, op, fldPath, obj, oldObj, false, "PT1.PS1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, primitives.Validate_T1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *primitives.T1 {
+				return oldObj.PS1
+			})
+		errs = append(errs, fn(fldPath.Child("ps1"), obj.PS1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.E1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *E1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult[*E1](ctx, op, fldPath, obj, oldObj, false, "T1.E1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_E1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *E1 {
+				return &oldObj.E1
+			})
+		errs = append(errs, fn(fldPath.Child("e1"), &obj.E1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PE1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *E1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult[*E1](ctx, op, fldPath, obj, oldObj, true, "T1.PE1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_E1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *E1 {
+				return oldObj.PE1
+			})
+		errs = append(errs, fn(fldPath.Child("pe1"), obj.PE1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.I1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult[*int](ctx, op, fldPath, obj, oldObj, false, "T1.I1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *int {
+				return &oldObj.I1
+			})
+		errs = append(errs, fn(fldPath.Child("i1"), &obj.I1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PI1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult[*int](ctx, op, fldPath, obj, oldObj, true, "T1.PI1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *int {
+				return oldObj.PI1
+			})
+		errs = append(errs, fn(fldPath.Child("pi1"), obj.PI1, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/type_args/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/type_args/zz_generated.validations_test.go
new file mode 100644
index 0000000000..15940447e7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/type_args/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package typeargs
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/typedefs/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/typedefs/doc.go
new file mode 100644
index 0000000000..f97a544f27
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/typedefs/doc.go
@@ -0,0 +1,75 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package typedefs
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+// +k8s:validateFalse="type E1"
+type E1 string
+
+// +k8s:validateFalse="type E2"
+type E2 int
+
+// +k8s:validateFalse="type E3"
+type E3 E1
+
+// +k8s:validateFalse="type E4"
+type E4 T2
+
+// +k8s:validateFalse="type T1"
+type T1 struct {
+	TypeMeta int
+
+	// +k8s:validateFalse="field T1.E1"
+	E1 E1 `json:"e1"`
+	// +k8s:validateFalse="field T1.PE1"
+	PE1 *E1 `json:"pe1"`
+
+	// +k8s:validateFalse="field T1.E2"
+	E2 E2 `json:"e2"`
+	// +k8s:validateFalse="field T1.PE2"
+	PE2 *E2 `json:"pe2"`
+
+	// +k8s:validateFalse="field T1.E3"
+	E3 E3 `json:"e3"`
+	// +k8s:validateFalse="field T1.PE3"
+	PE3 *E3 `json:"pe3"`
+
+	// +k8s:validateFalse="field T1.E4"
+	E4 E4 `json:"e4"`
+	// +k8s:validateFalse="field T1.PE4"
+	PE4 *E4 `json:"pe4"`
+
+	// +k8s:validateFalse="field T1.T2"
+	T2 T2 `json:"t2"`
+	// +k8s:validateFalse="field T1.PT2"
+	PT2 *T2 `json:"pt2"`
+}
+
+// +k8s:validateFalse="type T2"
+type T2 struct {
+	// +k8s:validateFalse="field T2.S"
+	S string `json:"s"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/typedefs/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/typedefs/testdata/validate-false.json
new file mode 100644
index 0000000000..45d5766bdd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/typedefs/testdata/validate-false.json
@@ -0,0 +1,59 @@
+{
+  "*typedefs.T1": {
+    "": [
+      "type T1"
+    ],
+    "e1": [
+      "field T1.E1",
+      "type E1"
+    ],
+    "e2": [
+      "field T1.E2",
+      "type E2"
+    ],
+    "e3": [
+      "field T1.E3",
+      "type E3"
+    ],
+    "e4": [
+      "field T1.E4",
+      "type E4"
+    ],
+    "e4.s": [
+      "field T2.S"
+    ],
+    "pe1": [
+      "field T1.PE1",
+      "type E1"
+    ],
+    "pe2": [
+      "field T1.PE2",
+      "type E2"
+    ],
+    "pe3": [
+      "field T1.PE3",
+      "type E3"
+    ],
+    "pe4": [
+      "field T1.PE4",
+      "type E4"
+    ],
+    "pe4.s": [
+      "field T2.S"
+    ],
+    "pt2": [
+      "field T1.PT2",
+      "type T2"
+    ],
+    "pt2.s": [
+      "field T2.S"
+    ],
+    "t2": [
+      "field T1.T2",
+      "type T2"
+    ],
+    "t2.s": [
+      "field T2.S"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/typedefs/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/typedefs/zz_generated.validations.go
new file mode 100644
index 0000000000..ca5c5b891a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/typedefs/zz_generated.validations.go
@@ -0,0 +1,444 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package typedefs
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_E1 validates an instance of E1 according
+// to declarative validation rules in the API schema.
+func Validate_E1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *E1) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type E1"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_E2 validates an instance of E2 according
+// to declarative validation rules in the API schema.
+func Validate_E2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *E2) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type E2"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_E3 validates an instance of E3 according
+// to declarative validation rules in the API schema.
+func Validate_E3(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *E3) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type E3"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_E4 validates an instance of E4 according
+// to declarative validation rules in the API schema.
+func Validate_E4(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *E4) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type E4"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field E4.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *E4) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T1"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	// field T1.TypeMeta has no validation
+
+	{ // field T1.E1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *E1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.E1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_E1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *E1 {
+				return &oldObj.E1
+			})
+		errs = append(errs, fn(fldPath.Child("e1"), &obj.E1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PE1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *E1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.PE1"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_E1(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *E1 {
+				return oldObj.PE1
+			})
+		errs = append(errs, fn(fldPath.Child("pe1"), obj.PE1, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.E2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *E2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.E2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_E2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *E2 {
+				return &oldObj.E2
+			})
+		errs = append(errs, fn(fldPath.Child("e2"), &obj.E2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PE2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *E2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.PE2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_E2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *E2 {
+				return oldObj.PE2
+			})
+		errs = append(errs, fn(fldPath.Child("pe2"), obj.PE2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.E3
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *E3,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.E3"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_E3(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *E3 {
+				return &oldObj.E3
+			})
+		errs = append(errs, fn(fldPath.Child("e3"), &obj.E3, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PE3
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *E3,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.PE3"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_E3(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *E3 {
+				return oldObj.PE3
+			})
+		errs = append(errs, fn(fldPath.Child("pe3"), obj.PE3, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.E4
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *E4,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.E4"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_E4(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *E4 {
+				return &oldObj.E4
+			})
+		errs = append(errs, fn(fldPath.Child("e4"), &obj.E4, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PE4
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *E4,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.PE4"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_E4(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *E4 {
+				return oldObj.PE4
+			})
+		errs = append(errs, fn(fldPath.Child("pe4"), obj.PE4, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.T2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.T2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T2 {
+				return &oldObj.T2
+			})
+		errs = append(errs, fn(fldPath.Child("t2"), &obj.T2, oldVal, oldObj != nil)...)
+	}
+
+	{ // field T1.PT2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T1.PT2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) *T2 {
+				return oldObj.PT2
+			})
+		errs = append(errs, fn(fldPath.Child("pt2"), obj.PT2, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T2 validates an instance of T2 according
+// to declarative validation rules in the API schema.
+func Validate_T2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T2) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type T2"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field T2.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/typedefs/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/typedefs/zz_generated.validations_test.go
new file mode 100644
index 0000000000..13aa49d8a1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/typedefs/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package typedefs
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/types_with_suffix/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/types_with_suffix/doc.go
new file mode 100644
index 0000000000..4b2ddba4ee
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/types_with_suffix/doc.go
@@ -0,0 +1,66 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithSuffix=Request
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package primitives
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type StructRequest struct {
+	// +k8s:validateFalse="field StructRequest.S"
+	S string `json:"s"`
+
+	// +k8s:validateFalse="field StructRequest.T2"
+	T2 T2 `json:"t2"`
+
+	// No internal validations.
+	T3 T3 `json:"t3"`
+}
+
+// Note: This has validations and is linked into the type-graph of StructRequest.
+type T2 struct {
+	// +k8s:validateFalse="field T2.I"
+	I int `json:"i"`
+}
+
+// Note: This has no validations and is linked into the type-graph of StructRequest.
+type T3 struct {
+	B bool    `json:"b"`
+	F float64 `json:"f"`
+}
+
+// Note: This has validations and is not linked into the type-graph of
+// StructRequest.
+type T4 struct {
+	// +k8s:validateFalse="field T4.S"
+	S string `json:"s"`
+	// +k8s:validateFalse="field T4.I"
+	I int `json:"i"`
+	// +k8s:validateFalse="field T4.B"
+	B bool `json:"b"`
+	// +k8s:validateFalse="field T4.F"
+	F float64 `json:"f"`
+}
+
+// +k8s:validateFalse="type EnumRequest"
+type EnumRequest string
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/types_with_suffix/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/types_with_suffix/testdata/validate-false.json
new file mode 100644
index 0000000000..a692993ae4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/types_with_suffix/testdata/validate-false.json
@@ -0,0 +1,18 @@
+{
+  "*primitives.EnumRequest": {
+    "": [
+      "type EnumRequest"
+    ]
+  },
+  "*primitives.StructRequest": {
+    "s": [
+      "field StructRequest.S"
+    ],
+    "t2": [
+      "field StructRequest.T2"
+    ],
+    "t2.i": [
+      "field T2.I"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/types_with_suffix/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/types_with_suffix/zz_generated.validations.go
new file mode 100644
index 0000000000..e5ea729e15
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/types_with_suffix/zz_generated.validations.go
@@ -0,0 +1,177 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package primitives
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type EnumRequest
+	scheme.AddValidationFunc(
+		(*EnumRequest)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_EnumRequest(
+					ctx, op, nil, /* fldPath */
+					obj.(*EnumRequest),
+					safe.Cast[*EnumRequest](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type StructRequest
+	scheme.AddValidationFunc(
+		(*StructRequest)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_StructRequest(
+					ctx, op, nil, /* fldPath */
+					obj.(*StructRequest),
+					safe.Cast[*StructRequest](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_EnumRequest validates an instance of EnumRequest according
+// to declarative validation rules in the API schema.
+func Validate_EnumRequest(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *EnumRequest) (errs field.ErrorList) {
+
+	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type EnumRequest"); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_StructRequest validates an instance of StructRequest according
+// to declarative validation rules in the API schema.
+func Validate_StructRequest(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *StructRequest) (errs field.ErrorList) {
+
+	{ // field StructRequest.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field StructRequest.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructRequest) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	{ // field StructRequest.T2
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *T2,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field StructRequest.T2"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_T2(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *StructRequest) *T2 {
+				return &oldObj.T2
+			})
+		errs = append(errs, fn(fldPath.Child("t2"), &obj.T2, oldVal, oldObj != nil)...)
+	}
+
+	// field StructRequest.T3 has no validation
+	return errs
+}
+
+// Validate_T2 validates an instance of T2 according
+// to declarative validation rules in the API schema.
+func Validate_T2(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T2) (errs field.ErrorList) {
+
+	{ // field T2.I
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field T2.I"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T2) *int {
+				return &oldObj.I
+			})
+		errs = append(errs, fn(fldPath.Child("i"), &obj.I, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/types_with_suffix/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/types_with_suffix/zz_generated.validations_test.go
new file mode 100644
index 0000000000..550334b185
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/types_with_suffix/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package primitives
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/lists/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/lists/doc.go
new file mode 100644
index 0000000000..2ea277d170
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/lists/doc.go
@@ -0,0 +1,36 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package lists
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type T1 struct {
+	LM1 []M1 `json:"lm1"`
+}
+
+type M1 struct {
+	// +k8s:validateFalse="M1.S"
+	S string `json:"s"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/lists/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/lists/testdata/validate-false.json
new file mode 100644
index 0000000000..1657294497
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/lists/testdata/validate-false.json
@@ -0,0 +1,15 @@
+{
+  "*lists.M1": {
+    "s": [
+      "M1.S"
+    ]
+  },
+  "*lists.T1": {
+    "lm1[0].s": [
+      "M1.S"
+    ],
+    "lm1[1].s": [
+      "M1.S"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/lists/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/lists/zz_generated.validations.go
new file mode 100644
index 0000000000..7374822e41
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/lists/zz_generated.validations.go
@@ -0,0 +1,138 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package lists
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type M1
+	scheme.AddValidationFunc(
+		(*M1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_M1(
+					ctx, op, nil, /* fldPath */
+					obj.(*M1),
+					safe.Cast[*M1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_M1 validates an instance of M1 according
+// to declarative validation rules in the API schema.
+func Validate_M1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *M1) (errs field.ErrorList) {
+
+	{ // field M1.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "M1.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *M1) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	{ // field T1.LM1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_M1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) []M1 {
+				return oldObj.LM1
+			})
+		errs = append(errs, fn(fldPath.Child("lm1"), obj.LM1, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/lists/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/lists/zz_generated.validations_test.go
new file mode 100644
index 0000000000..a9e21dc747
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/lists/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package lists
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/maps/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/maps/doc.go
new file mode 100644
index 0000000000..ff88bd638d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/maps/doc.go
@@ -0,0 +1,36 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+// +k8s:validation-gen-test-fixture=validateFalse
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package maps
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type T1 struct {
+	MSM1 map[string]M1 `json:"msm1"`
+}
+
+type M1 struct {
+	// +k8s:validateFalse="M1.S"
+	S string `json:"s"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/maps/testdata/validate-false.json b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/maps/testdata/validate-false.json
new file mode 100644
index 0000000000..1b140e6f39
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/maps/testdata/validate-false.json
@@ -0,0 +1,15 @@
+{
+  "*maps.M1": {
+    "s": [
+      "M1.S"
+    ]
+  },
+  "*maps.T1": {
+    "msm1[ƒ岯Ȉ\u0026\u003c沲3镟Ō仲牚輠ɟɛ].s": [
+      "M1.S"
+    ],
+    "msm1[Ȱ轷N].s": [
+      "M1.S"
+    ]
+  }
+}
\ No newline at end of file
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/maps/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/maps/zz_generated.validations.go
new file mode 100644
index 0000000000..02a6379422
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/maps/zz_generated.validations.go
@@ -0,0 +1,138 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package maps
+
+import (
+	context "context"
+	fmt "fmt"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type M1
+	scheme.AddValidationFunc(
+		(*M1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_M1(
+					ctx, op, nil, /* fldPath */
+					obj.(*M1),
+					safe.Cast[*M1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	// type T1
+	scheme.AddValidationFunc(
+		(*T1)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_T1(
+					ctx, op, nil, /* fldPath */
+					obj.(*T1),
+					safe.Cast[*T1](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_M1 validates an instance of M1 according
+// to declarative validation rules in the API schema.
+func Validate_M1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *M1) (errs field.ErrorList) {
+
+	{ // field M1.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "M1.S"); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *M1) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_T1 validates an instance of T1 according
+// to declarative validation rules in the API schema.
+func Validate_T1(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *T1) (errs field.ErrorList) {
+
+	{ // field T1.MSM1
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]M1,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_M1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *T1) map[string]M1 {
+				return oldObj.MSM1
+			})
+		errs = append(errs, fn(fldPath.Child("msm1"), obj.MSM1, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/maps/zz_generated.validations_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/maps/zz_generated.validations_test.go
new file mode 100644
index 0000000000..12393a0ccd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/maps/zz_generated.validations_test.go
@@ -0,0 +1,30 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package maps
+
+import (
+	"testing"
+)
+
+func TestValidation(t *testing.T) {
+	localSchemeBuilder.Test(t).ValidateFixtures()
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitive_pointers/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitive_pointers/doc.go
new file mode 100644
index 0000000000..56bb38bd29
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitive_pointers/doc.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// Package primitivepointers is a test package.
+//
+// +k8s:validation-gen-nolint
+//
+//nolint:unused
+package primitivepointers
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	// +k8s:immutable
+	SP *string `json:"sp"`
+	// +k8s:immutable
+	IP *int `json:"ip"`
+	// +k8s:immutable
+	BP *bool `json:"bp"`
+	// +k8s:immutable
+	FP *float64 `json:"fp"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitive_pointers/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitive_pointers/doc_test.go
new file mode 100644
index 0000000000..fb0e735218
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitive_pointers/doc_test.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package primitivepointers
+
+import (
+	"testing"
+
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	structA1 := Struct{
+		SP: ptr.To("zero"),
+		IP: ptr.To(0),
+		BP: ptr.To(false),
+		FP: ptr.To(0.0),
+	}
+
+	// Same data, different pointers
+	structA2 := Struct{
+		SP: ptr.To("zero"),
+		IP: ptr.To(0),
+		BP: ptr.To(false),
+		FP: ptr.To(0.0),
+	}
+	// Different data.
+	structB := Struct{
+		SP: ptr.To("one"),
+		IP: ptr.To(1),
+		BP: ptr.To(true),
+		FP: ptr.To(1.1),
+	}
+
+	st.Value(&structA1).OldValue(&structA1).ExpectValid()
+
+	st.Value(&structA1).OldValue(&structA2).ExpectValid()
+
+	st.Value(&structA1).OldValue(&structB).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("sp"), nil, "").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("ip"), nil, "").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("bp"), nil, "").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("fp"), nil, "").WithOrigin("immutable"),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitive_pointers/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitive_pointers/zz_generated.validations.go
new file mode 100644
index 0000000000..6d5021e475
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitive_pointers/zz_generated.validations.go
@@ -0,0 +1,181 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package primitivepointers
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	{ // field Struct.SP
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return oldObj.SP
+			})
+		errs = append(errs, fn(fldPath.Child("sp"), obj.SP, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.IP
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return oldObj.IP
+			})
+		errs = append(errs, fn(fldPath.Child("ip"), obj.IP, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.BP
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *bool {
+				return oldObj.BP
+			})
+		errs = append(errs, fn(fldPath.Child("bp"), obj.BP, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.FP
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *float64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *float64 {
+				return oldObj.FP
+			})
+		errs = append(errs, fn(fldPath.Child("fp"), obj.FP, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitives/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitives/doc.go
new file mode 100644
index 0000000000..a0d9ec2fae
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitives/doc.go
@@ -0,0 +1,37 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=*
+// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+
+// This is a test package.
+// +k8s:validation-gen-nolint
+package primitives
+
+import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+
+var localSchemeBuilder = testscheme.New()
+
+type Struct struct {
+	// +k8s:immutable
+	S string `json:"s"`
+	// +k8s:immutable
+	I int `json:"i"`
+	// +k8s:immutable
+	B bool `json:"b"`
+	// +k8s:immutable
+	F float64 `json:"f"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitives/doc_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitives/doc_test.go
new file mode 100644
index 0000000000..1a2ac506d3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitives/doc_test.go
@@ -0,0 +1,51 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package primitives
+
+import (
+	"testing"
+
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func Test(t *testing.T) {
+	st := localSchemeBuilder.Test(t)
+
+	structA := Struct{
+		S: "zero",
+		I: 0,
+		B: false,
+		F: 0.0,
+	}
+
+	// Different data.
+	structB := Struct{
+		S: "one",
+		I: 1,
+		B: true,
+		F: 1.1,
+	}
+
+	st.Value(&structA).OldValue(&structA).ExpectValid()
+
+	st.Value(&structA).OldValue(&structB).ExpectMatches(field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin(), field.ErrorList{
+		field.Invalid(field.NewPath("s"), nil, "").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("i"), nil, "").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("b"), nil, "").WithOrigin("immutable"),
+		field.Invalid(field.NewPath("f"), nil, "").WithOrigin("immutable"),
+	})
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitives/zz_generated.validations.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitives/zz_generated.validations.go
new file mode 100644
index 0000000000..c4f213b209
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/output_tests/update_validations/primitives/zz_generated.validations.go
@@ -0,0 +1,181 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package primitives
+
+import (
+	context "context"
+	fmt "fmt"
+
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
+)
+
+func init() { localSchemeBuilder.Register(RegisterValidations) }
+
+// RegisterValidations adds validation functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterValidations(scheme *testscheme.Scheme) error {
+	// type Struct
+	scheme.AddValidationFunc(
+		(*Struct)(nil),
+		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
+			switch op.Request.SubresourcePath() {
+			case "/":
+				return Validate_Struct(
+					ctx, op, nil, /* fldPath */
+					obj.(*Struct),
+					safe.Cast[*Struct](oldObj))
+			}
+			return field.ErrorList{
+				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
+			}
+		})
+	return nil
+}
+
+// Validate_Struct validates an instance of Struct according
+// to declarative validation rules in the API schema.
+func Validate_Struct(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Struct) (errs field.ErrorList) {
+
+	{ // field Struct.S
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *string {
+				return &oldObj.S
+			})
+		errs = append(errs, fn(fldPath.Child("s"), &obj.S, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.I
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *int {
+				return &oldObj.I
+			})
+		errs = append(errs, fn(fldPath.Child("i"), &obj.I, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.B
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *bool {
+				return &oldObj.B
+			})
+		errs = append(errs, fn(fldPath.Child("b"), &obj.B, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Struct.F
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *float64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Struct) *float64 {
+				return &oldObj.F
+			})
+		errs = append(errs, fn(fldPath.Child("f"), &obj.F, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/targets.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/targets.go
new file mode 100644
index 0000000000..90692c7f40
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/targets.go
@@ -0,0 +1,616 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"cmp"
+	"fmt"
+	"reflect"
+	"slices"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/code-generator/cmd/validation-gen/validators"
+	"k8s.io/code-generator/pkg/apidefinitions"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/klog/v2"
+)
+
+// These are the comment tags that carry parameters for validation generation.
+const (
+	// Defines which types to generate validation for.  There are two places
+	// this can be used:
+	//   Per-package:
+	//     * "*": generate validation for all types in this package
+	//	   * "TypesWithField=FooBar": generate validation for all types with a
+	//	     field named "FooBar"
+	//     * "TypesWithSuffix=FooBar": generate validation for all types whose
+	//       name ends with "FooBar"
+	//   Per-type:
+	//	   * "true": generate validation for this type
+	//	   * "false": do not generate validation for this type
+	mainTagName = "k8s:validation-gen"
+	// Defines the type of the scheme used to register validations. Defaults to
+	// "k8s.io/apimachinery/pkg.runtime.Scheme", but can be set to another type
+	// (e.g. in tests), or set to "nil" to disable scheme registration for this
+	// package.
+	schemeRegistryTagName = "k8s:validation-gen-scheme-registry"
+	// Defines the deep-equal function used for equivalence and ratcheting checks.
+	// Defaults to "k8s.io/apimachinery/pkg/api/equality.Semantic.DeepEqual".
+	deepEqualFuncTagName = "k8s:validation-gen-deep-equal-func"
+	// If set, generate go test files for test fixtures.  Supported values: "validateFalse".
+	testFixtureTagName = "k8s:validation-gen-test-fixture"
+
+	// name of the subresource that this type represents and can validate declaratively.
+	isSubresourceTagName = "k8s:isSubresource"
+
+	// name of a subresource that this type can validate declaratively, tag may be
+	// repeated to support multiple subresources.
+	supportsSubresourceTagName = "k8s:supportsSubresource"
+
+	// if set on a package, generates declarative coverage test targets even if it's not a versioned API package.
+	generateTestTargetsTagName = "k8s:validation-gen-test-targets"
+)
+
+var (
+	runtimePkg           = "k8s.io/apimachinery/pkg/runtime"
+	schemeType           = types.Name{Package: runtimePkg, Name: "Scheme"}
+	defaultDeepEqualFunc = types.Name{Package: "k8s.io/apimachinery/pkg/api/equality", Name: "Semantic.DeepEqual"}
+	metav1Pkg            = "k8s.io/apimachinery/pkg/apis/meta/v1"
+	listMetaType         = types.Name{Package: metav1Pkg, Name: "ListMeta"}
+)
+
+// extractAndParseTag extracts all the values for a given tag, according to the
+// tag grammar.
+func extractAndParseTag(tagName string, comments []string) ([]codetags.Tag, error) {
+	extracted := codetags.Extract("+", comments)
+	var tags []codetags.Tag
+	for key, lines := range extracted {
+		if key != tagName {
+			continue
+		}
+		t, err := codetags.ParseAll(lines)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse tags: %w: %s", err, lines)
+		}
+		tags = append(tags, t...)
+	}
+	return tags, nil
+}
+
+// validationTypeMatch returns the +k8s:validation-gen tag values for pkg,
+// or false if validation-gen should not run.
+func validationTypeMatch(pkg *types.Package, idOpts []apidefinitions.Option) ([]string, bool) {
+	info, err := apidefinitions.Identify(pkg, apidefinitions.Validation, idOpts...)
+	if err != nil {
+		klog.Fatal(err)
+	}
+	if !info.ShouldGenerate() {
+		return nil, false
+	}
+	return info.TypeFilters(), true
+}
+
+// TODO: this can just accept a single bool
+func checkMainTag(comments []string, require ...string) bool {
+	// TODO: convert to extractAndParseTag() and update all callers to use quoted values
+	tags, err := gengo.ExtractFunctionStyleCommentTags("+", []string{mainTagName}, comments)
+	if err != nil {
+		klog.Fatalf("Failed to extract tags: %v", err)
+	}
+	values, found := tags[mainTagName]
+	if !found {
+		return false
+	}
+
+	if len(require) == 0 {
+		return len(values) == 1 && values[0].Value == ""
+	}
+
+	valueStrings := make([]string, len(values))
+	for i, tag := range values {
+		valueStrings[i] = tag.Value
+	}
+
+	return reflect.DeepEqual(valueStrings, require)
+}
+
+func schemeRegistryTag(pkg *types.Package) (types.Name, bool) {
+	// TODO: convert to extractAndParseTag() and update all callers to use quoted values
+	tags, err := gengo.ExtractFunctionStyleCommentTags("+", []string{schemeRegistryTagName}, pkg.Comments)
+	if err != nil {
+		klog.Fatalf("Failed to extract scheme registry tags: %v", err)
+	}
+	values, found := tags[schemeRegistryTagName]
+	if !found || len(values) == 0 {
+		return schemeType, true // default
+	}
+	if len(values) > 1 {
+		panic(fmt.Sprintf("Package %q contains more than one usage of %q", pkg.Path, schemeRegistryTagName))
+	}
+	val := values[0].Value
+	if val == "nil" {
+		// no registration wanted for this package
+		return types.Name{}, false
+	}
+	return types.ParseFullyQualifiedName(val), true
+}
+
+// registerScheme reports whether pkg registers its validations with a scheme.
+func registerScheme(pkg *types.Package) bool {
+	_, ok := schemeRegistryTag(pkg)
+	return ok
+}
+
+func deepEqualFuncTag(pkg *types.Package) types.Name {
+	// TODO: convert to extractAndParseTag() and update all callers to use quoted values
+	tags, err := gengo.ExtractFunctionStyleCommentTags("+", []string{deepEqualFuncTagName}, pkg.Comments)
+	if err != nil {
+		klog.Fatalf("Failed to extract deep equal func tags: %v", err)
+	}
+	values, found := tags[deepEqualFuncTagName]
+	if !found || len(values) == 0 {
+		return defaultDeepEqualFunc
+	}
+	if len(values) > 1 {
+		panic(fmt.Sprintf("Package %q contains more than one usage of %q", pkg.Path, deepEqualFuncTagName))
+	}
+	val := values[0].Value
+	if val == "" {
+		return defaultDeepEqualFunc
+	}
+	return parseDeepEqualFunc(val)
+}
+
+func parseDeepEqualFunc(val string) types.Name {
+	lastSlash := strings.LastIndex(val, "/")
+	if lastSlash == -1 {
+		dot := strings.Index(val, ".")
+		if dot == -1 {
+			return types.Name{Name: val}
+		}
+		return types.Name{
+			Package: val[:dot],
+			Name:    val[dot+1:],
+		}
+	}
+	dot := lastSlash + strings.Index(val[lastSlash:], ".")
+	if dot == lastSlash {
+		return types.Name{Package: val}
+	}
+	return types.Name{
+		Package: val[:dot],
+		Name:    val[dot+1:],
+	}
+}
+
+func isSubresourceTag(t *types.Type) (string, bool) {
+	var comments []string
+	comments = append(comments, t.SecondClosestCommentLines...)
+	comments = append(comments, t.CommentLines...)
+	tags, err := extractAndParseTag(isSubresourceTagName, comments)
+	if err != nil {
+		klog.Fatalf("Failed to extract isSubresource tags: %v", err)
+	}
+	if len(tags) == 0 {
+		return "", false
+	}
+	if len(tags) > 1 {
+		panic(fmt.Sprintf("Type %q contains more than one usage of %q", t.Name.String(), isSubresourceTagName))
+	}
+	return tags[0].Value, true
+}
+
+func supportedSubresourceTags(t *types.Type) sets.Set[string] {
+	var comments []string
+	comments = append(comments, t.SecondClosestCommentLines...)
+	comments = append(comments, t.CommentLines...)
+	tags, err := extractAndParseTag(supportsSubresourceTagName, comments)
+	if err != nil {
+		klog.Fatalf("Failed to extract supportedSubresource tags: %v", err)
+	}
+	if len(tags) == 0 {
+		return sets.New[string]()
+	}
+	subresources := sets.New[string]()
+	for _, tag := range tags {
+		subresources.Insert(tag.Value)
+	}
+	return subresources
+}
+
+var testFixtureTagValues = sets.New("validateFalse")
+
+func testFixtureTag(pkg *types.Package) sets.Set[string] {
+	result := sets.New[string]()
+	// TODO: convert to extractAndParseTag() and update all callers to use quoted values
+	tags, err := gengo.ExtractFunctionStyleCommentTags("+", []string{testFixtureTagName}, pkg.Comments)
+	if err != nil {
+		klog.Fatalf("Failed to extract test fixture tags: %v", err)
+	}
+	values, found := tags[testFixtureTagName]
+	if !found {
+		return result
+	}
+
+	for _, tag := range values {
+		if !testFixtureTagValues.Has(tag.Value) {
+			panic(fmt.Sprintf("Package %q: %s must be one of '%s', but got: %s", pkg.Path, testFixtureTagName, testFixtureTagValues.UnsortedList(), tag.Value))
+		}
+		result.Insert(tag.Value)
+	}
+	return result
+}
+
+func generateTestTargetsTag(pkg *types.Package) bool {
+	tags, err := gengo.ExtractFunctionStyleCommentTags("+", []string{generateTestTargetsTagName}, pkg.Comments)
+	if err != nil {
+		klog.Fatalf("Failed to extract %s tags: %v", generateTestTargetsTagName, err)
+	}
+	_, found := tags[generateTestTargetsTagName]
+	return found
+}
+
+// NameSystems returns the name system used by the generators in this package.
+func NameSystems() namer.NameSystems {
+	return namer.NameSystems{
+		"public":             namer.NewPublicNamer(1),
+		"raw":                namer.NewRawNamer("", nil),
+		"objectvalidationfn": validationFnNamer(),
+		"private":            namer.NewPrivateNamer(0),
+		"name":               namer.NewPublicNamer(0),
+	}
+}
+
+func validationFnNamer() *namer.NameStrategy {
+	return &namer.NameStrategy{
+		Prefix: "Validate_",
+		Join: func(pre string, in []string, post string) string {
+			return pre + strings.Join(in, "_") + post
+		},
+	}
+}
+
+// DefaultNameSystem returns the default name system for ordering the types to be
+// processed by the generators in this package.
+func DefaultNameSystem() string {
+	return "public"
+}
+
+func GetTargets(context *generator.Context, args *Args) []generator.Target {
+	boilerplate, err := gengo.GoBoilerplate(args.GoHeaderFile, gengo.StdBuildTag, gengo.StdGeneratedBy)
+	if err != nil {
+		klog.Fatalf("Failed loading boilerplate: %v", err)
+	}
+
+	var idOpts []apidefinitions.Option
+	if len(args.LintRules) > 0 {
+		idOpts = append(idOpts, apidefinitions.WithLintRules(args.LintRules...))
+	}
+
+	var targetList []generator.Target
+
+	// First load other "input" packages.  We do this as a single call because
+	// it is MUCH faster.
+	inputPkgs := make([]string, 0, len(context.Inputs))
+	pkgToInput := map[string]string{}
+	inputToCanonicalPkg := map[string]string{} // types package -> the output package cross-package references resolve to
+	for _, input := range context.Inputs {
+		klog.V(4).Infof("considering pkg %q", input)
+		pkg := context.Universe[input]
+
+		info, err := apidefinitions.Identify(pkg, apidefinitions.Validation, idOpts...)
+		if err != nil {
+			klog.Fatal(err)
+		}
+		if !info.ShouldGenerate() {
+			continue
+		}
+
+		// +k8s:validation-gen-input may direct the generator at types in
+		// a different package than the one where validators will be emitted.
+		inputPath := info.ExternalTypes()
+		pkgToInput[input] = inputPath
+		if inputPath != pkg.Path {
+			klog.V(4).Infof("  input pkg %v", inputPath)
+			inputPkgs = append(inputPkgs, inputPath)
+		}
+		// An input's validation may be generated into more than one package. One
+		// is canonical -- the package cross-package references resolve to. The
+		// registering package is canonical; if none registers, the first one seen
+		// wins. At most one package may register.
+		if prev, ok := inputToCanonicalPkg[inputPath]; !ok {
+			inputToCanonicalPkg[inputPath] = input
+		} else if registerScheme(pkg) {
+			if registerScheme(context.Universe[prev]) {
+				klog.Fatalf("input %q is generated into two registering packages (%q, %q); mark one +k8s:validation-gen-scheme-registry=nil", inputPath, prev, input)
+			}
+			inputToCanonicalPkg[inputPath] = input // a registering package displaces a non-registering one
+		}
+	}
+
+	// Make sure explicit extra-packages are added.
+	var readOnlyPkgs []string
+	for _, pkg := range args.ReadOnlyPkgs {
+		// In case someone specifies an extra as a path into vendor, convert
+		// it to its "real" package path.
+		if i := strings.Index(pkg, "/vendor/"); i != -1 {
+			pkg = pkg[i+len("/vendor/"):]
+		}
+		readOnlyPkgs = append(readOnlyPkgs, pkg)
+	}
+	if expanded, err := context.FindPackages(readOnlyPkgs...); err != nil {
+		klog.Fatalf("cannot find extra packages: %v", err)
+	} else {
+		readOnlyPkgs = expanded // now in fully canonical form
+	}
+	for _, extra := range readOnlyPkgs {
+		inputPkgs = append(inputPkgs, extra)
+		pkgToInput[extra] = extra
+		// Don't let a read-only package override a generation mapping.
+		if _, ok := inputToCanonicalPkg[extra]; !ok {
+			inputToCanonicalPkg[extra] = extra
+		}
+	}
+
+	if len(inputPkgs) > 0 {
+		if _, err := context.LoadPackages(inputPkgs...); err != nil {
+			klog.Fatalf("cannot load packages: %v", err)
+		}
+	}
+	// update context.Order to the latest context.Universe
+	orderer := namer.Orderer{Namer: namer.NewPublicNamer(1)}
+	context.Order = orderer.OrderUniverse(context.Universe)
+
+	// Initialize all validator plugins exactly once.
+	validator := validators.InitGlobalValidator(context, inputToCanonicalPkg)
+
+	// Create a type discoverer for all types of all inputs.
+	td := NewTypeDiscoverer(validator, inputToCanonicalPkg)
+	if err := td.Init(context); err != nil {
+		klog.Fatalf("Error discovering constants: %v", err)
+	}
+
+	// Create a linter to collect errors as we go.
+	linter := newLinter(lintRules(validator)...)
+
+	// groupKindReports accumulates Reports across every input, keyed by
+	// GroupKind so testTargets emits exactly one SimpleTarget per Kind.
+	groupKindReports := map[schema.GroupKind][]*report{}
+
+	// Build a cache of type->callNode for every type we need.
+	for _, input := range context.Inputs {
+		klog.V(2).InfoS("processing", "pkg", input)
+
+		pkg := context.Universe[input]
+
+		schemeRegistry, registerThisPkg := schemeRegistryTag(pkg)
+		deepEqualFunc := deepEqualFuncTag(pkg)
+
+		criteria, found := validationTypeMatch(pkg, idOpts)
+		if !found {
+			klog.V(2).InfoS("  did not find required tag", "tag", mainTagName)
+			continue
+		}
+		if len(criteria) == 1 && criteria[0] == "" {
+			klog.Fatalf("%s: found package tag %q with no value", input, mainTagName)
+		}
+		for _, crit := range criteria {
+			if crit == "*" {
+				continue
+			}
+			if val, found := strings.CutPrefix(crit, "TypesWithField="); found {
+				if val == "" {
+					klog.Fatalf("%s: found package tag \"%s=%s\" with empty value", input, mainTagName, crit)
+				}
+				continue
+			}
+			if val, found := strings.CutPrefix(crit, "TypesWithSuffix="); found {
+				if val == "" {
+					klog.Fatalf("%s: found package tag \"%s=%s\" with empty value", input, mainTagName, crit)
+				}
+				continue
+			}
+			klog.Fatalf("%s: unknown value for package tag %q: %q", input, mainTagName, crit)
+		}
+		shouldCreateObjectValidationFn := func(t *types.Type) bool {
+			// Never generate validation for unexported types.
+			if namer.IsPrivateGoName(t.Name.Name) {
+				return false
+			}
+			// opt-out
+			if checkMainTag(t.CommentLines, "false") {
+				return false
+			}
+			if checkMainTag(t.SecondClosestCommentLines, "false") {
+				return false
+			}
+			// opt-in
+			if checkMainTag(t.CommentLines, "true") {
+				return true
+			}
+			if checkMainTag(t.SecondClosestCommentLines, "true") {
+				return true
+			}
+
+			// skip types that embed metav1.ListMeta
+			if t.Kind == types.Struct {
+				for _, member := range t.Members {
+					if member.Embedded && member.Type.Name == listMetaType {
+						return false
+					}
+				}
+			}
+
+			// all types
+			for _, v := range criteria {
+				if v == "*" {
+					return true
+				}
+				if field, found := strings.CutPrefix(v, "TypesWithField="); found {
+					if isTypeWithField(t, field) {
+						return true
+					}
+				}
+				if field, found := strings.CutPrefix(v, "TypesWithSuffix="); found {
+					if isTypeWithSuffix(t, field) {
+						return true
+					}
+				}
+			}
+			return false
+		}
+
+		// Find the right input pkg, which might not be this one.
+		inputPath := pkgToInput[input]
+		// typesPkg is where the types that need validation are defined.
+		// Sometimes it is different from pkg. For example, kubernetes core/v1
+		// types are defined in k8s.io/api/core/v1, while the pkg which holds
+		// defaulter code is at k/k/pkg/api/v1.
+		typesPkg := context.Universe[inputPath]
+
+		// Figure out which types we should be considering further.
+		var rootTypes []*types.Type
+		for _, t := range typesPkg.Types {
+			if shouldCreateObjectValidationFn(t) {
+				rootTypes = append(rootTypes, t)
+			} else {
+				klog.V(6).InfoS("skipping type", "type", t)
+			}
+		}
+		// Deterministic ordering helps in logs and debugging.
+		slices.SortFunc(rootTypes, func(a, b *types.Type) int {
+			return cmp.Compare(a.Name.String(), b.Name.String())
+		})
+
+		for _, t := range rootTypes {
+			klog.V(3).InfoS("pre-processing", "type", t)
+			if err := td.DiscoverType(t); err != nil {
+				klog.Fatalf("failed to generate validations: %v", err)
+			}
+		}
+
+		extracted := codetags.Extract("+", pkg.Comments)
+		if _, ok := extracted["k8s:validation-gen-nolint"]; !ok {
+			for _, t := range rootTypes {
+				klog.V(3).InfoS("linting root-type", "type", t)
+				if err := linter.lintType(t); err != nil {
+					klog.Fatalf("failed to lint type %q: %v", t.Name, err)
+				}
+			}
+		}
+
+		targetList = append(targetList,
+			&generator.SimpleTarget{
+				PkgName:       pkg.Name,
+				PkgPath:       pkg.Path,
+				PkgDir:        pkg.Dir, // output pkg is the same as the input
+				HeaderComment: boilerplate,
+
+				FilterFunc: func(c *generator.Context, t *types.Type) bool {
+					return t.Name.Package == typesPkg.Path
+				},
+
+				GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+					generators = []generator.Generator{
+						NewGenValidations(args.OutputFile, pkg.Path, typesPkg.Path, rootTypes, td, inputToCanonicalPkg, schemeRegistry, registerThisPkg, deepEqualFunc),
+					}
+					testFixtureTags := testFixtureTag(pkg)
+					if testFixtureTags.Len() > 0 {
+						if !strings.HasSuffix(args.OutputFile, ".go") {
+							panic(fmt.Sprintf("%s requires that output file have .go suffix", testFixtureTagName))
+						}
+						filename := args.OutputFile[0:len(args.OutputFile)-3] + "_test.go"
+						generators = append(generators, FixtureTests(filename, testFixtureTags))
+					}
+					if generateTestTargetsTag(pkg) {
+						var reports []*report
+						for _, t := range rootTypes {
+							rules := collectRules(td.typeNodes[t])
+							if len(rules) == 0 {
+								continue
+							}
+							reports = append(reports, &report{
+								Group:   pkg.Path,
+								Version: pkg.Name,
+								Kind:    t.Name.Name,
+								Rules:   rules,
+							})
+						}
+						if len(reports) > 0 {
+							filename := args.OutputFile[0:len(args.OutputFile)-3] + "_coverage_test.go"
+							generators = append(generators, newCoverageTestGen(pkg.Path, filename, reports, true, nil))
+						}
+					}
+					return generators
+				},
+			})
+
+		// Accumulate per-Kind rules; testTargets emits after the loop.
+		// Only the registering package contributes coverage; a non-registering
+		// package generated from the same input has identical rules, so counting
+		// it too would double-list the version for the Kind.
+		if args.TestOutputRoot != "" && registerThisPkg {
+			collectReports(typesPkg, rootTypes, td, groupKindReports)
+		}
+	}
+
+	// All inputs processed: fail if a ValidateCustom_* function lacks a tag.
+	if err := validators.VerifyCustomValidationsHaveTags(); err != nil {
+		klog.Fatalf("%v", err)
+	}
+
+	// Emit per-Kind coverage test targets. No-op when --test-output-root is empty.
+	allowlist, err := loadAllowlist(args.TestAllowlist)
+	if err != nil {
+		klog.Fatalf("loading allowlist: %v", err)
+	}
+	targetList = append(targetList, testTargets(args.TestOutputRoot, args.TestOutputFilePrefix, groupKindReports, allowlist, boilerplate)...)
+
+	if len(linter.lintErrors) > 0 {
+		buf := strings.Builder{}
+
+		for t, errs := range linter.lintErrors {
+			buf.WriteString(fmt.Sprintf("  type %v:\n", t))
+			for _, err := range errs {
+				buf.WriteString(fmt.Sprintf("    %s\n", err.Error()))
+			}
+		}
+		klog.Fatalf("lint failed:\n%s", buf.String())
+	}
+	return targetList
+}
+
+func isTypeWithField(t *types.Type, fieldName string) bool {
+	if t.Kind == types.Struct {
+		for _, field := range t.Members {
+			if field.Name == fieldName {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func isTypeWithSuffix(t *types.Type, suffix string) bool {
+	return strings.HasSuffix(t.Name.Name, suffix)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/targets_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/targets_test.go
new file mode 100644
index 0000000000..ff67234ed3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/targets_test.go
@@ -0,0 +1,64 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"testing"
+
+	"k8s.io/gengo/v2/types"
+)
+
+func TestParseDeepEqualFunc(t *testing.T) {
+	testCases := []struct {
+		name     string
+		input    string
+		expected types.Name
+	}{{
+		name:     "fully qualified with struct field",
+		input:    "k8s.io/apimachinery/pkg/api/equality.Semantic.DeepEqual",
+		expected: types.Name{Package: "k8s.io/apimachinery/pkg/api/equality", Name: "Semantic.DeepEqual"},
+	}, {
+		name:     "fully qualified package function",
+		input:    "k8s.io/code-generator/cmd/validation-gen/testscheme.CustomEqual",
+		expected: types.Name{Package: "k8s.io/code-generator/cmd/validation-gen/testscheme", Name: "CustomEqual"},
+	}, {
+		name:     "single level package function",
+		input:    "testscheme.CustomEqual",
+		expected: types.Name{Package: "testscheme", Name: "CustomEqual"},
+	}, {
+		name:     "single level package struct field",
+		input:    "testscheme.Semantic.DeepEqual",
+		expected: types.Name{Package: "testscheme", Name: "Semantic.DeepEqual"},
+	}, {
+		name:     "package-local function",
+		input:    "CustomDeepEqual",
+		expected: types.Name{Package: "", Name: "CustomDeepEqual"},
+	}, {
+		name:     "empty input",
+		input:    "",
+		expected: types.Name{Package: "", Name: ""},
+	}}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := parseDeepEqualFunc(tc.input)
+			if want, got := tc.expected, result; got != want {
+				t.Errorf("expected %v, got %v", want, got)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/test_targets.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/test_targets.go
new file mode 100644
index 0000000000..8d9c1d34bc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/test_targets.go
@@ -0,0 +1,480 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"cmp"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"regexp"
+	"slices"
+	"strconv"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/code-generator/cmd/validation-gen/validators"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+	"sigs.k8s.io/yaml"
+)
+
+// Package symbols referenced in emitted test fixtures. fmtPkgSymbols (shared
+// with validation.go) covers Fprintln.
+var (
+	schemaPkg               = "k8s.io/apimachinery/pkg/runtime/schema"
+	schemaPkgSymbols        = mkPkgNames(schemaPkg, "GroupVersionKind")
+	osPkgSymbols            = mkPkgNames("os", "Stderr", "Exit")
+	testingSymbols          = mkPkgNames("testing", "M")
+	runtimeTestPkg          = "k8s.io/apimachinery/pkg/test/coverage"
+	runtimeRegisterSymbols  = mkPkgNames(runtimeTestPkg, "RegisterDeclaredRules", "FieldRules")
+	runtimeAssertCovSymbols = mkPkgNames(runtimeTestPkg, "AssertDeclarativeCoverage")
+)
+
+// apiVersionRe matches Kubernetes-style API versions: v1, v1alpha1, v2beta3.
+// Used to detect whether an input package is a versioned API package (vs. a
+// helper or main package, which we skip).
+var apiVersionRe = regexp.MustCompile(`^v\d+(alpha\d+|beta\d+)?$`)
+
+// rule is one declared field-validation error.
+type rule struct {
+	ErrorType string
+	Origin    string
+}
+
+// fieldRules maps field path → declared rules for a single Kind.
+type fieldRules map[string][]rule
+
+// report is one GVK's declared rules. Used as in-memory scaffolding while
+// emitting per-Kind test fixtures; not serialized.
+type report struct {
+	Group   string
+	Version string
+	Kind    string
+	Rules   fieldRules
+}
+
+// allowlistEntry filters a declared rule out of coverage fixture generation.
+// Every field is required: apiVersion matches by literal equality (in the
+// "<group>/<version>" form, or just "<version>" for core); kind/path/
+// errorType/origin match literally or wildcard with "*". Empty is rejected
+// at load time so an entry can never silently overexclude.
+type allowlistEntry struct {
+	APIVersion string `json:"apiVersion"`
+	Kind       string `json:"kind"`
+	Path       string `json:"path"`
+	ErrorType  string `json:"errorType"`
+	Origin     string `json:"origin"`
+	Reason     string `json:"reason"`
+}
+
+// groupVersion splits e.APIVersion into (group, version). "v1" → ("", "v1");
+// "apps/v1" → ("apps", "v1").
+func (e *allowlistEntry) groupVersion() (string, string) {
+	if i := strings.IndexByte(e.APIVersion, '/'); i >= 0 {
+		return e.APIVersion[:i], e.APIVersion[i+1:]
+	}
+	return "", e.APIVersion
+}
+
+// matches reports whether the entry filters out the given rule. apiVersion
+// must match exactly; the remaining fields match by literal equality or
+// wildcard with "*".
+func (e *allowlistEntry) matches(group, version, kind, path string, rule rule) bool {
+	g, v := e.groupVersion()
+	return g == group &&
+		v == version &&
+		(e.Kind == "*" || e.Kind == kind) &&
+		(e.Path == "*" || e.Path == path) &&
+		(e.ErrorType == "*" || e.ErrorType == rule.ErrorType) &&
+		(e.Origin == "*" || e.Origin == rule.Origin)
+}
+
+// filterReports returns reports with allowlisted rules removed. Reports
+// left with no rules are dropped. Returns reports unchanged if allowlist is empty.
+func filterReports(reports []*report, allowlist []allowlistEntry) []*report {
+	if len(allowlist) == 0 {
+		return reports
+	}
+	out := make([]*report, 0, len(reports))
+	for _, r := range reports {
+		filtered := fieldRules{}
+		for path, rs := range r.Rules {
+			for _, rule := range rs {
+				if slices.ContainsFunc(allowlist, func(e allowlistEntry) bool {
+					return e.matches(r.Group, r.Version, r.Kind, path, rule)
+				}) {
+					continue
+				}
+				filtered[path] = append(filtered[path], rule)
+			}
+		}
+		if len(filtered) == 0 {
+			continue
+		}
+		out = append(out, &report{
+			Group: r.Group, Version: r.Version, Kind: r.Kind, Rules: filtered,
+		})
+	}
+	return out
+}
+
+// loadAllowlist reads the YAML file at path. Returns nil when path is empty.
+// Errors on read/parse failure or any entry missing the required reason.
+func loadAllowlist(path string) ([]allowlistEntry, error) {
+	if path == "" {
+		return nil, nil
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("reading allowlist %q: %w", path, err)
+	}
+	var entries []allowlistEntry
+	if err := yaml.Unmarshal(data, &entries); err != nil {
+		return nil, fmt.Errorf("parsing allowlist %q: %w", path, err)
+	}
+	for i, e := range entries {
+		for _, f := range []struct{ name, val string }{
+			{"apiVersion", e.APIVersion},
+			{"kind", e.Kind},
+			{"path", e.Path},
+			{"errorType", e.ErrorType},
+			{"origin", e.Origin},
+			{"reason", e.Reason},
+		} {
+			if strings.TrimSpace(f.val) == "" {
+				return nil, fmt.Errorf("allowlist %q entry %d: %s is required (use %q to wildcard)", path, i, f.name, "*")
+			}
+		}
+	}
+	return entries, nil
+}
+
+// coverageTestGen emits test files for validation-gen coverage.
+// It can emit rule registrations (init func), apiVersions variable, and TestMain.
+type coverageTestGen struct {
+	generator.GoGenerator
+	outputPackage string
+	imports       namer.ImportTracker
+	reports       []*report
+	emitMain      bool
+	versions      []string
+}
+
+func newCoverageTestGen(outputPackage, filename string, reports []*report, emitMain bool, versions []string) generator.Generator {
+	return &coverageTestGen{
+		GoGenerator: generator.GoGenerator{
+			OutputFilename: filename,
+		},
+		outputPackage: outputPackage,
+		imports:       generator.NewImportTrackerForPackage(outputPackage),
+		reports:       reports,
+		emitMain:      emitMain,
+		versions:      versions,
+	}
+}
+
+func (g *coverageTestGen) Namers(*generator.Context) namer.NameSystems {
+	return namer.NameSystems{"raw": namer.NewRawNamer(g.outputPackage, g.imports)}
+}
+
+func (g *coverageTestGen) Imports(*generator.Context) []string { return g.imports.ImportLines() }
+
+func (g *coverageTestGen) Filter(*generator.Context, *types.Type) bool { return false }
+
+func emitRegisterDeclaredRules(sw *generator.SnippetWriter, c *generator.Context, reports []*report) {
+	for _, r := range reports {
+		args := generator.Args{
+			"schema":  mkSymbolArgs(c, schemaPkgSymbols),
+			"runtime": mkSymbolArgs(c, runtimeRegisterSymbols),
+			"group":   strconv.Quote(r.Group),
+			"version": strconv.Quote(r.Version),
+			"kind":    strconv.Quote(r.Kind),
+		}
+		sw.Do("func init() {\n", nil)
+		sw.Do("    $.runtime.RegisterDeclaredRules|raw$(\n", args)
+		sw.Do("        $.schema.GroupVersionKind|raw${Group: $.group$, Version: $.version$, Kind: $.kind$},\n", args)
+		sw.Do("        $.runtime.FieldRules|raw${\n", args)
+
+		paths := make([]string, 0, len(r.Rules))
+		for p := range r.Rules {
+			paths = append(paths, p)
+		}
+		slices.Sort(paths)
+		for _, path := range paths {
+			rules := slices.Clone(r.Rules[path])
+			slices.SortFunc(rules, func(a, b rule) int {
+				if c := cmp.Compare(a.ErrorType, b.ErrorType); c != 0 {
+					return c
+				}
+				return cmp.Compare(a.Origin, b.Origin)
+			})
+			sw.Do("            $.path$: {\n", generator.Args{"path": strconv.Quote(path)})
+			for _, r := range rules {
+				ruleArgs := generator.Args{"errorType": strconv.Quote(r.ErrorType)}
+				if r.Origin != "" {
+					ruleArgs["origin"] = strconv.Quote(r.Origin)
+					sw.Do("                {ErrorType: $.errorType$, Origin: $.origin$},\n", ruleArgs)
+				} else {
+					sw.Do("                {ErrorType: $.errorType$},\n", ruleArgs)
+				}
+			}
+			sw.Do("            },\n", nil)
+		}
+		sw.Do("        },\n    )\n}\n\n", nil)
+	}
+}
+
+func emitTestMain(sw *generator.SnippetWriter, c *generator.Context) {
+	args := generator.Args{
+		"testing": mkSymbolArgs(c, testingSymbols),
+		"fmt":     mkSymbolArgs(c, fmtPkgSymbols),
+		"os":      mkSymbolArgs(c, osPkgSymbols),
+		"runtime": mkSymbolArgs(c, runtimeAssertCovSymbols),
+	}
+	sw.Do("func TestMain(m *$.testing.M|raw$) {\n", args)
+	sw.Do("    code := m.Run()\n", nil)
+	sw.Do("    if err := $.runtime.AssertDeclarativeCoverage|raw$(); err != nil {\n", args)
+	sw.Do("        $.fmt.Fprintln|raw$($.os.Stderr|raw$, err)\n", args)
+	sw.Do("        if code == 0 {\n            code = 1\n        }\n    }\n", nil)
+	sw.Do("    $.os.Exit|raw$(code)\n}\n", args)
+}
+
+func (g *coverageTestGen) Init(c *generator.Context, w io.Writer) error {
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+	if len(g.reports) > 0 {
+		emitRegisterDeclaredRules(sw, c, g.reports)
+	}
+
+	if g.emitMain {
+		if len(g.versions) > 0 {
+			versions := slices.Clone(g.versions)
+			slices.Sort(versions)
+			sw.Do("var apiVersions = []string{", nil)
+			for i, v := range versions {
+				if i > 0 {
+					sw.Do(", ", nil)
+				}
+				sw.Do("$.v$", generator.Args{"v": strconv.Quote(v)})
+			}
+			sw.Do("}\n\n", nil)
+		}
+		emitTestMain(sw, c)
+	}
+	return sw.Error()
+}
+
+// collectReports appends a *report into groupKindReports for each
+// Kind in pkg with at least one declared rule. Records all packages; testTargets
+// filters out non-API packages (empty Version) at emit time.
+func collectReports(pkg *types.Package, rootTypes []*types.Type, td *typeDiscoverer, groupKindReports map[schema.GroupKind][]*report) {
+	// Derive (group, version) from the input package:
+	//   group:   the GroupName const if defined (the established API
+	//            convention); otherwise the package path as a fallback.
+	//   version: the package name when it looks like an API version
+	//            (vN[alphaM|betaM]); empty otherwise — testTargets uses the
+	//            empty version to skip non-API packages.
+	var group, version string
+	if c, ok := pkg.Constants["GroupName"]; ok && c.ConstValue != nil {
+		group = *c.ConstValue
+	} else {
+		group = pkg.Path
+	}
+	if apiVersionRe.MatchString(pkg.Name) {
+		version = pkg.Name
+	}
+
+	for _, t := range rootTypes {
+		rules := collectRules(td.typeNodes[t])
+		if len(rules) == 0 {
+			continue
+		}
+		kind := t.Name.Name
+		gk := schema.GroupKind{Group: group, Kind: kind}
+		groupKindReports[gk] = append(groupKindReports[gk], &report{
+			Group:   group,
+			Version: version,
+			Kind:    kind,
+			Rules:   rules,
+		})
+	}
+}
+
+// testTargets returns one SimpleTarget per Kind in groupKindReports. Each
+// target's directory is <testOutputRoot>/<short-group>/<lowercase(kind)>/
+// and contains one <prefix><version>_test.go per version plus a
+// shared <prefix>main_test.go. Skips Kinds with empty Version
+// (non-API packages) and Kinds whose every rule is allowlisted.
+func testTargets(testOutputRoot, filePrefix string, groupKindReports map[schema.GroupKind][]*report, allowlist []allowlistEntry, boilerplate []byte) []generator.Target {
+	if testOutputRoot == "" || len(groupKindReports) == 0 {
+		return nil
+	}
+	out := make([]generator.Target, 0, len(groupKindReports))
+	for _, reports := range groupKindReports {
+		// reports is non-empty by construction in collectReports.
+		first := reports[0]
+		if first.Version == "" {
+			continue // not a real API package
+		}
+		reports = filterReports(reports, allowlist)
+		if len(reports) == 0 {
+			continue // every rule was allowlisted away
+		}
+		lowerKind := strings.ToLower(first.Kind)
+		// Short group name (first DNS label) as the directory; "core" for the
+		// empty legacy group — matches client-gen / informer-gen convention.
+		group := first.Group
+		if group == "" {
+			group = "core"
+		}
+		pkgDir := filepath.Join(testOutputRoot, strings.Split(group, ".")[0], lowerKind)
+
+		out = append(out, &generator.SimpleTarget{
+			PkgName:       lowerKind,
+			PkgPath:       pkgDir, // informational; gengo writes to PkgDir
+			PkgDir:        pkgDir,
+			HeaderComment: boilerplate,
+			GeneratorsFunc: func(*generator.Context) []generator.Generator {
+				gens := make([]generator.Generator, 0, len(reports)+1) // +1 for main_test.go
+				versions := make([]string, 0, len(reports))
+				for _, r := range reports {
+					gens = append(gens, newCoverageTestGen(pkgDir, filePrefix+r.Version+"_test.go", []*report{r}, false, nil))
+					versions = append(versions, r.Version)
+				}
+				gens = append(gens, newCoverageTestGen(pkgDir, filePrefix+"main_test.go", nil, true, versions))
+				return gens
+			}})
+	}
+	return out
+}
+
+// collectRules walks node's type tree and returns its declared FieldRules.
+func collectRules(node *typeNode) fieldRules {
+	if node == nil {
+		return nil
+	}
+	rules := fieldRules{}
+	seen := map[*typeNode]bool{}
+
+	record := func(path string, fns []validators.FunctionGen) {
+		for _, fn := range fns {
+			recordRules(rules, path, fn, "")
+		}
+	}
+
+	var walkNode func(*typeNode, string, bool, bool)
+	var walkChild func(*childNode, string, bool, bool)
+	walkNode = func(n *typeNode, path string, skipElem, skipKey bool) {
+		if n == nil || seen[n] {
+			return
+		}
+		seen[n] = true
+		defer delete(seen, n)
+
+		record(path, n.typeValidations.Functions)
+		if n.valueType == nil {
+			return
+		}
+
+		if n.typeValidations.OpaqueType {
+			return
+		}
+
+		skipElem = skipElem || n.typeValidations.OpaqueValType
+		skipKey = skipKey || n.typeValidations.OpaqueKeyType
+
+		record(joinPath(path, "[*]"), n.typeValIterations.Functions)
+		record(path, n.typeKeyIterations.Functions) // keys validate at parent path
+
+		for _, fld := range n.fields {
+			walkChild(fld, joinPath(path, fld.jsonName), false, false)
+		}
+		if n.elem != nil && !skipElem {
+			walkChild(n.elem, joinPath(path, "[*]"), false, false)
+		}
+		if n.key != nil && !skipKey {
+			walkChild(n.key, path, false, false)
+		}
+		if n.underlying != nil {
+			walkChild(n.underlying, path, skipElem, skipKey)
+		}
+	}
+	walkChild = func(c *childNode, path string, skipElem, skipKey bool) {
+		if c == nil {
+			return
+		}
+		record(path, c.fieldValidations.Functions)
+		record(joinPath(path, "[*]"), c.fieldValIterations.Functions)
+		record(path, c.fieldKeyIterations.Functions)
+
+		if c.fieldValidations.OpaqueType {
+			return
+		}
+
+		skipElem = skipElem || c.fieldValidations.OpaqueValType
+		skipKey = skipKey || c.fieldValidations.OpaqueKeyType
+
+		walkNode(c.node, path, skipElem, skipKey)
+	}
+	walkNode(node, "", false, false)
+	return rules
+}
+
+// recordRules descends fg, accumulating Wrapper/MultiWrapperFunction
+// PathFragments into suffix, and records (basePath+suffix, Rule) at each
+// emitting leaf. A FunctionGen may declare multiple Emissions when the
+// runtime emits errors of different types or at different path fragments
+// from the same call (e.g. ValSliceUpdate with NoAddItem and NoRemoveItem).
+func recordRules(rules fieldRules, basePath string, fg validators.FunctionGen, suffix string) {
+	if len(fg.Emits) > 0 {
+		for _, e := range fg.Emits {
+			path := basePath + suffix + e.PathFragment
+			rules[path] = append(rules[path], rule{
+				ErrorType: string(e.Type),
+				Origin:    e.Origin,
+			})
+		}
+		return
+	}
+	for _, arg := range fg.Args {
+		switch a := arg.(type) {
+		case validators.WrapperFunction:
+			recordRules(rules, basePath, a.Function, suffix+a.PathFragment)
+		case validators.MultiWrapperFunction:
+			for _, child := range a.Functions {
+				recordRules(rules, basePath, child, suffix+a.PathFragment)
+			}
+		}
+	}
+}
+
+// joinPath joins seg onto base; empty seg is a no-op so inline-embedded
+// struct fields (jsonName "") stay transparent.
+func joinPath(base, seg string) string {
+	if seg == "" {
+		return base
+	}
+	if base == "" {
+		return seg
+	}
+	if strings.HasPrefix(seg, "[") {
+		return base + seg
+	}
+	return base + "." + seg
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/testscheme/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/testscheme/doc.go
new file mode 100644
index 0000000000..618fb7f72c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/testscheme/doc.go
@@ -0,0 +1,107 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package testscheme provides a scheme implementation and test utilities
+// useful for writing output_tests for validation-gen.
+//
+// For an output test to use this scheme, it should be located in a dedicated go package.
+// The go package should have validation-gen and this test scheme enabled and must declare a
+// 'localSchemeBuilder' using the 'testscheme.New()' function. For example:
+//
+//	// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
+//	// +k8s:validation-gen
+//	package example
+//	import "k8s.io/code-generator/cmd/validation-gen/testscheme"
+//	var localSchemeBuilder = testscheme.New()
+//
+// This is sufficient for validation-gen to generate a `zz_generated.validations.go` for the types
+// in the package that compile.
+//
+// With the scheme enabled. An output test may be tested either by handwritten test code or
+// by generated test fixtures.
+//
+// For example, to test by hand. The testschema provides utilities to create a value and assert
+// that the expected errors are returned when the value is validated.
+// Note that if `OldValue()` or `OldValueFuzzed()` is called on the `ValidationTester`, subsequent
+// validation calls will implicitly use update validation.
+//
+//	 func Test(t *testing.T) {
+//		  st := localSchemeBuilder.Test(t)
+//		  st.Value(&T1{
+//			E0:  "x",
+//			PE0: pointer.To(E0("y")),
+//		  }).ExpectInvalid(
+//			field.NotSupported(field.NewPath("e0"), "x", []string{EnumValue1, EnumValue2}),
+//			field.NotSupported(field.NewPath("pe0"), "y", []string{EnumValue1, EnumValue2}))}
+//	 }
+//
+// Tests fixtures can also be enabled. For example:
+//
+//	// ...
+//	// +k8s:validation-gen-test-fixture=validateFalse
+//	// package example
+//
+// When a test fixture is enabled, a `zz_generated.validations_test.go` file will be generated
+// test for all the registered types in the package according to the behavior of the named test
+// fixture(s).
+//
+// Test Fixtures:
+//
+// `validateFalse` - This test fixture executes validation of each registered type and accumulates
+// all `validateFalse` validation errors. For example:
+//
+//	type T1 struct {
+//		// +k8s:validateFalse="field T1.S"
+//		S string `json:"s"`
+//		// +k8s:validateFalse="field T1.T"
+//		T T2 `json:"t"`
+//	}
+//
+// The above `example.T1` test type has two validated fields: `s` and 't'. The fields are named
+// according to the Go "json" field tag, and each has a validation error identifier
+// provided by `+k8s:validateFalse=<identifier>`.
+//
+// The `validateFalse` test fixture will validate an instance of `example.T1`, generated using fuzzed
+// data, and then group the validation errors by field name. Represented in JSON like:
+//
+//	{
+//	  "*example.T1": {
+//	    "s": [
+//	      "field T1.S"
+//	    ],
+//	    "t": [
+//	      "field T1.T"
+//	    ]
+//	  }
+//	}
+//
+// This validation error data contains an object for each registered type, keyed by type name.
+// For each registered type, the validation errors from `+k8s:validateFalse` tags are grouped
+// by field path with all validation error identifiers collected into a list.
+//
+// This data is compared with the expected validation results that are defined in
+// a `testdata/validate-false.json` file in the same package, and any differences are
+// reported as test errors.
+//
+// `testdata/validate-false.json` can be generated automatically by setting the
+// `UPDATE_VALIDATION_GEN_FIXTURE_DATA=true` environment variable to true when running the tests.
+//
+// Test authors that generated `testdata/validate-false.json` are expected to ensure that file
+// is correct before checking it in to source control.
+//
+// The fuzzed data is generated pseudo-randomly with a consistent seed, with all nilable fields se
+// to a value, and with a single entry for each map  and a single element for each slice.
+package testscheme
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/testscheme/testscheme.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/testscheme/testscheme.go
new file mode 100644
index 0000000000..add7a3daaa
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/testscheme/testscheme.go
@@ -0,0 +1,394 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testscheme
+
+import (
+	"bytes"
+	stdcmp "cmp"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"math/rand"
+	"os"
+	"path"
+	"reflect"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"         // nolint:depguard // this package provides test utilities
+	"github.com/google/go-cmp/cmp/cmpopts" // nolint:depguard // this package provides test utilities
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/test/coverage"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"sigs.k8s.io/randfill"
+)
+
+// Scheme is similar to runtime.Scheme, but for validation testing purposes. Scheme only supports validation,
+// supports registration of any type (not just runtime.Object) and implements Register directly, allowing it
+// to also be used as a scheme builder.
+// Must only be used with tests that perform all registration before calls to validate.
+type Scheme struct {
+	validationFuncs    map[reflect.Type]func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList
+	registrationErrors field.ErrorList
+}
+
+// New creates a new Scheme.
+func New() *Scheme {
+	return &Scheme{validationFuncs: map[reflect.Type]func(ctx context.Context, op operation.Operation, object interface{}, oldObject interface{}) field.ErrorList{}}
+}
+
+// AddValidationFunc registers a validation function.
+// Last writer wins.
+func (s *Scheme) AddValidationFunc(srcType any, fn func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList) {
+	s.validationFuncs[reflect.TypeOf(srcType)] = fn
+}
+
+// Validate validates an object using the registered validation function.
+func (s *Scheme) Validate(ctx context.Context, options map[string]bool, object any, subresources ...string) field.ErrorList {
+	if len(s.registrationErrors) > 0 {
+		return s.registrationErrors // short circuit with registration errors if any are present
+	}
+	if fn, ok := s.validationFuncs[reflect.TypeOf(object)]; ok {
+		return fn(ctx, operation.Operation{Type: operation.Create, Request: operation.Request{Subresources: subresources}, Options: options}, object, nil)
+	}
+	return nil
+}
+
+// ValidateUpdate validates an update to an object using the registered validation function.
+func (s *Scheme) ValidateUpdate(ctx context.Context, options map[string]bool, object, oldObject any, subresources ...string) field.ErrorList {
+	if len(s.registrationErrors) > 0 {
+		return s.registrationErrors // short circuit with registration errors if any are present
+	}
+	if fn, ok := s.validationFuncs[reflect.TypeOf(object)]; ok {
+		return fn(ctx, operation.Operation{Type: operation.Update, Request: operation.Request{Subresources: subresources}, Options: options}, object, oldObject)
+	}
+	return nil
+}
+
+// Register adds a scheme setup function to the list.
+func (s *Scheme) Register(funcs ...func(*Scheme) error) {
+	for _, f := range funcs {
+		err := f(s)
+		if err != nil {
+			s.registrationErrors = append(s.registrationErrors, toRegistrationError(err))
+		}
+	}
+}
+
+func toRegistrationError(err error) *field.Error {
+	return field.InternalError(nil, fmt.Errorf("registration error: %w", err))
+}
+
+// Test returns a ValidationTestBuilder for this scheme.
+func (s *Scheme) Test(t *testing.T) *ValidationTestBuilder {
+	return &ValidationTestBuilder{t, s}
+}
+
+// ValidationTestBuilder provides convenience functions to build
+// validation tests.
+type ValidationTestBuilder struct {
+	*testing.T
+	s *Scheme
+}
+
+const fixtureEnvVar = "UPDATE_VALIDATION_GEN_FIXTURE_DATA"
+
+// ValidateFixtures ensures that the validation errors of all registered types match what is expected by the test fixture files.
+// For each registered type, a value is created for the type, and populated by fuzzing the value, before validating the type.
+// See ValueFuzzed for details.
+//
+// If the UPDATE_VALIDATION_GEN_FIXTURE_DATA=true environment variable is set, test fixture files are created or overridden.
+//
+// Fixtures:
+//   - validate-false.json: defines a map of registered type to a map of field path to  +validateFalse validations args
+//     that are expected to be returned as errors when the type is validated.
+func (s *ValidationTestBuilder) ValidateFixtures() {
+	s.T.Helper()
+
+	flag := os.Getenv(fixtureEnvVar)
+	// Run validation
+	got := map[string]map[string][]string{}
+	for t := range s.s.validationFuncs {
+		var v any
+		// TODO: this should handle maps and slices
+		if t.Kind() == reflect.Ptr {
+			v = reflect.New(t.Elem()).Interface()
+		} else {
+			v = reflect.Indirect(reflect.New(t)).Interface()
+		}
+		if reflect.TypeOf(v).Kind() != reflect.Ptr {
+			v = &v
+		}
+		s.ValueFuzzed(v)
+		vt := &ValidationTester{ValidationTestBuilder: s, value: v}
+		byPath := vt.validateFalseArgsByPath()
+		got[t.String()] = byPath
+	}
+
+	testdataFilename := "testdata/validate-false.json"
+	if flag == "true" {
+		// Generate fixture file
+		if err := os.MkdirAll(path.Dir(testdataFilename), os.FileMode(0755)); err != nil {
+			s.Fatal("error making directory", err)
+		}
+		data, err := json.MarshalIndent(got, "", "  ")
+		if err != nil {
+			s.Fatal(err)
+		}
+		err = os.WriteFile(testdataFilename, data, os.FileMode(0644))
+		if err != nil {
+			s.Fatal(err)
+		}
+	} else {
+		// Load fixture file
+		testdataFile, err := os.Open(testdataFilename)
+		if errors.Is(err, os.ErrNotExist) {
+			s.Fatalf("%s test fixture data not found. Run go test with the environment variable %s=true to create test fixture data.",
+				testdataFilename, fixtureEnvVar)
+		} else if err != nil {
+			s.Fatal(err)
+		}
+		defer func() {
+			err := testdataFile.Close()
+			if err != nil {
+				s.Fatal(err)
+			}
+		}()
+
+		byteValue, err := io.ReadAll(testdataFile)
+		if err != nil {
+			s.Fatal(err)
+		}
+		testdata := map[string]map[string][]string{}
+		err = json.Unmarshal(byteValue, &testdata)
+		if err != nil {
+			s.Fatal(err)
+		}
+		// Compare fixture with validation results
+		expectedKeys := sets.New[string]()
+		gotKeys := sets.New[string]()
+		for k := range got {
+			gotKeys.Insert(k)
+		}
+		hasErrors := false
+		for k, expectedForType := range testdata {
+			expectedKeys.Insert(k)
+			gotForType, ok := got[k]
+			s.T.Run(k, func(t *testing.T) {
+				t.Helper()
+
+				if !ok {
+					t.Errorf("%q has expected validateFalse args in %s but got no validation errors.", k, testdataFilename)
+					hasErrors = true
+				} else if !cmp.Equal(gotForType, expectedForType) {
+					t.Errorf("validateFalse args, grouped by field path, differed from %s:\n%s\n",
+						testdataFilename, cmp.Diff(gotForType, expectedForType, cmpopts.SortMaps(stdcmp.Less[string])))
+					hasErrors = true
+				}
+			})
+		}
+		for unexpectedType := range gotKeys.Difference(expectedKeys) {
+			s.T.Run(unexpectedType, func(t *testing.T) {
+				t.Helper()
+
+				t.Errorf("%q got unexpected validateFalse args, grouped by field path:\n%s\n",
+					unexpectedType, cmp.Diff(nil, got[unexpectedType], cmpopts.SortMaps(stdcmp.Less[string])))
+				hasErrors = true
+			})
+		}
+		if hasErrors {
+			s.T.Logf("If the test expectations have changed, run go test with the environment variable %s=true", fixtureEnvVar)
+		}
+	}
+}
+
+func randfiller() *randfill.Filler {
+	// Ensure that lists and maps are not empty and use a deterministic seed.
+	// But also, don't recurse infinitely.
+	return randfill.New().NilChance(0.0).NumElements(2, 2).MaxDepth(8).RandSource(rand.NewSource(0))
+}
+
+// ValueFuzzed automatically populates the given value using a deterministic filler.
+// The filler sets pointers to values and always includes a two map keys and slice elements.
+func (s *ValidationTestBuilder) ValueFuzzed(value any) *ValidationTester {
+	randfiller().Fill(value)
+	return &ValidationTester{ValidationTestBuilder: s, value: value}
+}
+
+// Value returns a ValidationTester for the given value. The value
+// must be a registered with the scheme for validation.
+func (s *ValidationTestBuilder) Value(value any) *ValidationTester {
+	return &ValidationTester{ValidationTestBuilder: s, value: value}
+}
+
+// ValidationTester provides convenience functions to define validation
+// tests for a validatable value.
+type ValidationTester struct {
+	*ValidationTestBuilder
+	value        any
+	oldValue     any
+	isUpdate     bool
+	options      map[string]bool
+	subresources []string
+}
+
+// OldValue sets the oldValue for this ValidationTester. When oldValue is set,
+// update validation will be used to test validation.
+// oldValue must be the same type as value.
+// Returns ValidationTester to support call chaining.
+func (v *ValidationTester) OldValue(oldValue any) *ValidationTester {
+	v.oldValue = oldValue
+	v.isUpdate = true
+	return v
+}
+
+// OldValueFuzzed automatically populates the given value using a deterministic filler.
+// The filler sets pointers to values and always includes a two map keys and slice elements.
+func (v *ValidationTester) OldValueFuzzed(oldValue any) *ValidationTester {
+	randfiller().Fill(oldValue)
+	v.oldValue = oldValue
+	v.isUpdate = true
+	return v
+}
+
+// Opts sets the ValidationOpts to use.
+func (v *ValidationTester) Opts(options map[string]bool) *ValidationTester {
+	v.options = options
+	return v
+}
+
+// Subresource sets the ValidationOpts to use.
+func (v *ValidationTester) Subresources(subresources []string) *ValidationTester {
+	v.subresources = subresources
+	return v
+}
+
+func multiline(errs field.ErrorList) string {
+	if len(errs) == 0 {
+		return "<no errors>"
+	}
+	if len(errs) == 1 {
+		return errs[0].Error()
+	}
+
+	var buf bytes.Buffer
+	for _, err := range errs {
+		buf.WriteString("\n")
+		buf.WriteString(err.Error())
+	}
+	return buf.String()
+}
+
+// ExpectValid validates the value and calls t.Errorf if any validation errors are returned.
+// Returns ValidationTester to support call chaining.
+func (v *ValidationTester) ExpectValid() *ValidationTester {
+	v.T.Helper()
+
+	v.T.Run(fmt.Sprintf("%T", v.value), func(t *testing.T) {
+		t.Helper()
+
+		errs := v.validate()
+		if len(errs) > 0 {
+			t.Errorf("want no errors, got: %v", multiline(errs))
+		}
+	})
+	return v
+}
+
+// ExpectValidateFalseByPath validates the value and looks for the errors
+// specifically produced by `+k8s:validateFalse` tags. Each field (the map key)
+// can have multiple error strings (the map value). Test which are trying
+// to prove that the validation logic itself (e.g. validation-gen) produces the
+// expected errors should use this method.
+func (v *ValidationTester) ExpectValidateFalseByPath(expectedByPath map[string][]string) *ValidationTester {
+	v.T.Helper()
+
+	v.T.Run(fmt.Sprintf("%T", v.value), func(t *testing.T) {
+		t.Helper()
+
+		actualByPath := v.validateFalseArgsByPath()
+		// ensure args are sorted
+		for _, args := range expectedByPath {
+			sort.Strings(args)
+		}
+		if !cmp.Equal(expectedByPath, actualByPath) {
+			t.Errorf("validateFalse args, grouped by field path, differed from expected:\n%s\n", cmp.Diff(expectedByPath, actualByPath, cmpopts.SortMaps(stdcmp.Less[string])))
+		}
+
+	})
+	return v
+}
+
+func (v *ValidationTester) validateFalseArgsByPath() map[string][]string {
+	byPath := map[string][]string{}
+	errs := v.validate()
+	for _, e := range errs {
+		if strings.HasPrefix(e.Detail, "forced failure: ") {
+			arg := strings.TrimPrefix(e.Detail, "forced failure: ")
+			f := e.Field
+			if f == "<nil>" {
+				f = ""
+			}
+			byPath[f] = append(byPath[f], arg)
+		}
+	}
+	// ensure args are sorted
+	for _, args := range byPath {
+		sort.Strings(args)
+	}
+	return byPath
+}
+
+// ExpectMatches compares the expected errors with the actual errors returned
+// by the validation, using the provided ErrorMatcher. Tests which are trying
+// to prove that a use-case of validation (e.g. testing pod validation)
+// produces the expected errors should use this method.
+func (v *ValidationTester) ExpectMatches(matcher field.ErrorMatcher, expected field.ErrorList) *ValidationTester {
+	v.Helper()
+
+	v.Run(fmt.Sprintf("%T", v.value), func(t *testing.T) {
+		t.Helper()
+		actual := v.validate()
+		matcher.Test(t, expected, actual)
+	})
+	return v
+}
+
+func (v *ValidationTester) validate() field.ErrorList {
+	var errs field.ErrorList
+	if v.isUpdate {
+		errs = v.s.ValidateUpdate(context.Background(), v.options, v.value, v.oldValue, v.subresources...)
+	} else {
+		errs = v.s.Validate(context.Background(), v.options, v.value, v.subresources...)
+	}
+
+	rt := reflect.TypeOf(v.value)
+	for rt.Kind() == reflect.Ptr {
+		rt = rt.Elem()
+	}
+	pkgName := strings.Split(rt.String(), ".")[0]
+	gvk := schema.GroupVersionKind{Group: rt.PkgPath(), Version: pkgName, Kind: rt.Name()}
+	coverage.RecordObservedRules(gvk, errs)
+
+	return errs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/util/util.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/util/util.go
new file mode 100644
index 0000000000..6b11730682
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/util/util.go
@@ -0,0 +1,228 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"fmt"
+	"math"
+	"strconv"
+
+	"k8s.io/gengo/v2/parser/tags"
+	"k8s.io/gengo/v2/types"
+)
+
+// GetMemberByJSON returns the child member of the type that has the given JSON
+// name. It returns nil if no such member exists.
+func GetMemberByJSON(t *types.Type, jsonName string) *types.Member {
+	for i := range t.Members {
+		if jsonTag, ok := tags.LookupJSON(t.Members[i]); ok {
+			if jsonTag.Name == jsonName {
+				return &t.Members[i]
+			}
+		}
+	}
+	return nil
+}
+
+// IsNilableType returns true if the argument type can be compared to nil.
+func IsNilableType(t *types.Type) bool {
+	t = NativeType(t)
+
+	switch t.Kind {
+	case types.Pointer, types.Map, types.Slice, types.Interface: // Note: Arrays are not nilable
+		return true
+	}
+	return false
+}
+
+// NativeType returns the Go native type of the argument type, with any
+// intermediate typedefs removed. Go itself already flattens typedefs, but this
+// handles it in the unlikely event that we ever fix that.
+//
+// Examples:
+// * Trivial:
+//   - given `int`, returns `int`
+//   - given `*int`, returns `*int`
+//   - given `[]int`, returns `[]int`
+//
+// * Typedefs
+//   - given `type X int; X`, returns `int`
+//   - given `type X int; []X`, returns `[]X`
+//
+// * Typedefs and pointers:
+//   - given `type X int; *X`, returns `*int`
+//   - given `type X *int; *X`, returns `**int`
+//   - given `type X []int; X`, returns `[]int`
+//   - given `type X []int; *X`, returns `*[]int`
+func NativeType(t *types.Type) *types.Type {
+	ptrs := 0
+	conditionMet := false
+	for !conditionMet {
+		switch t.Kind {
+		case types.Alias:
+			t = t.Underlying
+		case types.Pointer:
+			ptrs++
+			t = t.Elem
+		default:
+			conditionMet = true
+		}
+	}
+	for range ptrs {
+		t = types.PointerTo(t)
+	}
+	return t
+}
+
+// NonPointer returns the value-type of a possibly pointer type. If type is not
+// a pointer, it returns the input type.
+func NonPointer(t *types.Type) *types.Type {
+	for t.Kind == types.Pointer {
+		t = t.Elem
+	}
+	return t
+}
+
+// IsDirectComparable returns true if the type is safe to compare using "==".
+// It is similar to gengo.IsComparable, but it doesn't consider Pointers to be
+// comparable (we don't want shallow compare).
+func IsDirectComparable(t *types.Type) bool {
+	switch t.Kind {
+	case types.Builtin:
+		return true
+	case types.Struct:
+		for _, f := range t.Members {
+			if !IsDirectComparable(f.Type) {
+				return false
+			}
+		}
+		return true
+	case types.Array:
+		return IsDirectComparable(t.Elem)
+	case types.Alias:
+		return IsDirectComparable(t.Underlying)
+	}
+	return false
+}
+
+// ParseInt strictly parses an int from a string input,
+// ensuring that when converted back to a string, the resulting
+// int and the input string have the exact same representation.
+// This prevents scenarios where an input like "0100" parses
+// as 100 and would be re-stringed as "100".
+func ParseInt(val string) (int, error) {
+	intVal, err := strconv.Atoi(val)
+	if err != nil {
+		return 0, fmt.Errorf("parsing %q as int: %w", val, err)
+	}
+
+	strVal := strconv.Itoa(intVal)
+	if strVal != val {
+		return 0, fmt.Errorf("%q is not a valid int value", val)
+	}
+
+	return intVal, nil
+}
+
+// ParseSignedInt strictly parses a signed integer from a string input and
+// validates that the result fits within the specified bit size. The bitSize
+// parameter should be 8, 16, 32, or 64, corresponding to the target Go type.
+// Values outside the representable range for the target type are rejected at
+// parse time with a descriptive error.
+func ParseSignedInt(val string, bitSize int) (int64, error) {
+	intVal, err := strconv.ParseInt(val, 10, 64)
+	if err != nil {
+		return 0, fmt.Errorf("parsing %q as int: %w", val, err)
+	}
+
+	// Verify canonical form: reject leading zeros, unary plus, etc.
+	strVal := strconv.FormatInt(intVal, 10)
+	if strVal != val {
+		return 0, fmt.Errorf("%q is not a valid int value", val)
+	}
+
+	// Validate the parsed value fits in the target type's range.
+	var minVal, maxVal int64
+	switch bitSize {
+	case 8:
+		minVal, maxVal = math.MinInt8, math.MaxInt8
+	case 16:
+		minVal, maxVal = math.MinInt16, math.MaxInt16
+	case 32:
+		minVal, maxVal = math.MinInt32, math.MaxInt32
+	case 64:
+		minVal, maxVal = math.MinInt64, math.MaxInt64
+	default:
+		return 0, fmt.Errorf("unsupported bitSize %d; must be 8, 16, 32, or 64", bitSize)
+	}
+	if intVal < minVal || intVal > maxVal {
+		return 0, fmt.Errorf("value %d does not fit in int%d (range [%d, %d])", intVal, bitSize, minVal, maxVal)
+	}
+
+	return intVal, nil
+}
+
+// ParseUnsignedInt strictly parses an unsigned integer from a string input and
+// validates that the result fits within the specified bit size. The bitSize
+// parameter should be 8, 16, 32, or 64, corresponding to the target Go type.
+func ParseUnsignedInt(val string, bitSize int) (uint64, error) {
+	uintVal, err := strconv.ParseUint(val, 10, 64)
+	if err != nil {
+		return 0, fmt.Errorf("parsing %q as uint: %w", val, err)
+	}
+
+	// Verify canonical form: reject leading zeros, unary plus, etc.
+	strVal := strconv.FormatUint(uintVal, 10)
+	if strVal != val {
+		return 0, fmt.Errorf("%q is not a valid uint value", val)
+	}
+
+	// Validate the parsed value fits in the target type's range.
+	var maxVal uint64
+	switch bitSize {
+	case 8:
+		maxVal = math.MaxUint8
+	case 16:
+		maxVal = math.MaxUint16
+	case 32:
+		maxVal = math.MaxUint32
+	case 64:
+		maxVal = math.MaxUint64
+	default:
+		return 0, fmt.Errorf("unsupported bitSize %d; must be 8, 16, 32, or 64", bitSize)
+	}
+	if uintVal > maxVal {
+		return 0, fmt.Errorf("value %d does not fit in uint%d (range [0, %d])", uintVal, bitSize, maxVal)
+	}
+
+	return uintVal, nil
+}
+
+// ParseBool strictly parses a bool from a string input,
+// ensuring that when converted back to a string, the resulting
+// bool and the input string have the exact same representation.
+// This prevents scenarios where an input like "TRUE" parses
+// as true and would be re-stringed as "true".
+func ParseBool(val string) (bool, error) {
+	switch val {
+	case "true":
+		return true, nil
+	case "false":
+		return false, nil
+	}
+	return false, fmt.Errorf("%q is not a valid bool value", val)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/util/util_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/util/util_test.go
new file mode 100644
index 0000000000..dd008cc1cb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/util/util_test.go
@@ -0,0 +1,940 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/gengo/v2/types"
+)
+
+func TestGetMemberByJSON(t *testing.T) {
+	tests := []struct {
+		name     string
+		t        *types.Type
+		jsonTag  string
+		want     *types.Member
+		wantBool bool
+	}{{
+		name: "exact match",
+		t: &types.Type{
+			Members: []types.Member{
+				{Name: "Field0", Tags: `json:"field0"`},
+				{Name: "Field1", Tags: `json:"field1"`},
+				{Name: "Field2", Tags: `json:"field2"`},
+			},
+		},
+		jsonTag:  "field1",
+		want:     &types.Member{Name: "Field1", Tags: `json:"field1"`},
+		wantBool: true,
+	}, {
+		name: "no match",
+		t: &types.Type{
+			Members: []types.Member{
+				{Name: "Field0", Tags: `json:"field0"`},
+				{Name: "Field1", Tags: `json:"field1"`},
+			},
+		},
+		jsonTag:  "field2",
+		want:     nil,
+		wantBool: false,
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := GetMemberByJSON(tt.t, tt.jsonTag)
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("GetMemberByJSON() got %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestIsNilableType(t *testing.T) {
+	tStruct := &types.Type{
+		Name: types.Name{Name: "MyStruct"},
+		Kind: types.Struct,
+	}
+
+	tests := []struct {
+		name string
+		t    *types.Type
+		want bool
+	}{{
+		name: "pointer",
+		t: &types.Type{
+			Kind: types.Pointer,
+			Elem: tStruct,
+		},
+		want: true,
+	}, {
+		name: "alias to pointer",
+		t: &types.Type{
+			Kind: types.Alias,
+			Underlying: &types.Type{
+				Kind: types.Pointer,
+				Elem: tStruct,
+			},
+		},
+		want: true,
+	}, {
+		name: "map",
+		t: &types.Type{
+			Kind: types.Map,
+		},
+		want: true,
+	}, {
+		name: "alias to map",
+		t: &types.Type{
+			Kind: types.Alias,
+			Underlying: &types.Type{
+				Kind: types.Map,
+			},
+		},
+		want: true,
+	}, {
+		name: "slice",
+		t: &types.Type{
+			Kind: types.Slice,
+		},
+		want: true,
+	}, {
+		name: "alias to slice",
+		t: &types.Type{
+			Kind: types.Alias,
+			Underlying: &types.Type{
+				Kind: types.Slice,
+			},
+		},
+		want: true,
+	}, {
+		name: "interface",
+		t: &types.Type{
+			Kind: types.Interface,
+		},
+		want: true,
+	}, {
+		name: "alias to interface",
+		t: &types.Type{
+			Kind: types.Alias,
+			Underlying: &types.Type{
+				Kind: types.Interface,
+			},
+		},
+		want: true,
+	}, {
+		name: "struct",
+		t: &types.Type{
+			Kind: types.Struct,
+		},
+		want: false,
+	}, {
+		name: "alias to struct",
+		t: &types.Type{
+			Kind: types.Alias,
+			Underlying: &types.Type{
+				Kind: types.Struct,
+			},
+		},
+		want: false,
+	}, {
+		name: "builtin",
+		t: &types.Type{
+			Kind: types.Builtin,
+		},
+		want: false,
+	}, {
+		name: "alias to builtin",
+		t: &types.Type{
+			Kind: types.Alias,
+			Underlying: &types.Type{
+				Kind: types.Builtin,
+			},
+		},
+		want: false,
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := IsNilableType(tt.t); got != tt.want {
+				t.Errorf("IsNilableType() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestNativeType(t *testing.T) {
+	tStruct := &types.Type{
+		Name: types.Name{Name: "MyStruct"},
+		Kind: types.Struct,
+	}
+	pStruct := &types.Type{
+		Name: types.Name{Name: "*MyStruct"},
+		Kind: types.Pointer,
+		Elem: tStruct,
+	}
+
+	tests := []struct {
+		name string
+		t    *types.Type
+		want *types.Type
+	}{{
+		name: "struct",
+		t:    tStruct,
+		want: tStruct,
+	}, {
+		name: "pointer to struct",
+		t:    pStruct,
+		want: pStruct,
+	}, {
+		name: "alias to struct",
+		t: &types.Type{
+			Name:       types.Name{Name: "Alias"},
+			Kind:       types.Alias,
+			Underlying: tStruct,
+		},
+		want: tStruct,
+	}, {
+		name: "pointer to alias to struct",
+		t: &types.Type{
+			Name: types.Name{Name: "*Alias"},
+			Kind: types.Pointer,
+			Elem: &types.Type{
+				Kind:       types.Alias,
+				Underlying: tStruct,
+			},
+		},
+		want: pStruct,
+	}, {
+		name: "alias of pointer to struct",
+		t: &types.Type{
+			Name:       types.Name{Name: "AliasP"},
+			Kind:       types.Alias,
+			Underlying: pStruct,
+		},
+		want: pStruct,
+	}, {
+		name: "pointer to alias of pointer to struct",
+		t: &types.Type{
+			Name: types.Name{Name: "*AliasP"},
+			Kind: types.Pointer,
+			Elem: &types.Type{
+				Name:       types.Name{Name: "AliasP"},
+				Kind:       types.Alias,
+				Underlying: pStruct,
+			},
+		},
+		want: &types.Type{
+			Name: types.Name{Name: "**MyStruct"},
+			Kind: types.Pointer,
+			Elem: pStruct,
+		},
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if want, got := tt.want.String(), NativeType(tt.t).String(); want != got {
+				t.Errorf("NativeType() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestNonPointer(t *testing.T) {
+	tStruct := &types.Type{
+		Name: types.Name{Name: "MyStruct"},
+		Kind: types.Struct,
+	}
+
+	tests := []struct {
+		name string
+		t    *types.Type
+		want *types.Type
+	}{{
+		name: "value",
+		t:    tStruct,
+		want: tStruct,
+	}, {
+		name: "pointer",
+		t: &types.Type{
+			Name: types.Name{Name: "*MyStruct"},
+			Kind: types.Pointer,
+			Elem: tStruct,
+		},
+		want: tStruct,
+	}, {
+		name: "pointer pointer",
+		t: &types.Type{
+			Name: types.Name{Name: "**MyStruct"},
+			Kind: types.Pointer,
+			Elem: &types.Type{
+				Kind: types.Pointer,
+				Elem: tStruct,
+			},
+		},
+		want: tStruct,
+	}, {
+		name: "pointer alias pointer",
+		t: &types.Type{
+			Name: types.Name{Name: "*AliasP"},
+			Kind: types.Pointer,
+			Elem: &types.Type{
+				Name: types.Name{Name: "AliasP"},
+				Kind: types.Alias,
+				Underlying: &types.Type{
+					Name: types.Name{Name: "*MyStruct"},
+					Kind: types.Pointer,
+					Elem: tStruct,
+				},
+			},
+		},
+		want: &types.Type{
+			Name: types.Name{Name: "AliasP"},
+			Kind: types.Alias,
+			Underlying: &types.Type{
+				Name: types.Name{Name: "*MyStruct"},
+				Kind: types.Pointer,
+				Elem: tStruct,
+			},
+		},
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := NonPointer(tt.t); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("NonPointer() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+// gengo has `PointerTo()` but not the rest, so keep this here for consistency.
+func ptrTo(t *types.Type) *types.Type {
+	return &types.Type{
+		Name: types.Name{
+			Package: "",
+			Name:    "*" + t.Name.String(),
+		},
+		Kind: types.Pointer,
+		Elem: t,
+	}
+}
+
+func sliceOf(t *types.Type) *types.Type {
+	return &types.Type{
+		Name: types.Name{
+			Package: "",
+			Name:    "[]" + t.Name.String(),
+		},
+		Kind: types.Slice,
+		Elem: t,
+	}
+}
+
+func mapOf(t *types.Type) *types.Type {
+	return &types.Type{
+		Name: types.Name{
+			Package: "",
+			Name:    "map[string]" + t.Name.String(),
+		},
+		Kind: types.Map,
+		Key:  types.String,
+		Elem: t,
+	}
+}
+
+func arrayOf(t *types.Type) *types.Type {
+	return &types.Type{
+		Name: types.Name{
+			Package: "",
+			Name:    "[2]" + t.Name.String(),
+		},
+		Kind: types.Array,
+		Len:  2,
+		Elem: t,
+	}
+}
+
+func aliasOf(name string, t *types.Type) *types.Type {
+	return &types.Type{
+		Name: types.Name{
+			Package: "",
+			Name:    "Alias_" + name,
+		},
+		Kind:       types.Alias,
+		Underlying: t,
+	}
+}
+
+func TestIsDirectComparable(t *testing.T) {
+	cases := []struct {
+		in     *types.Type
+		expect bool
+	}{
+		{
+			in:     types.String,
+			expect: true,
+		}, {
+			in:     ptrTo(types.String),
+			expect: false,
+		}, {
+			in:     sliceOf(types.String),
+			expect: false,
+		}, {
+			in:     mapOf(types.String),
+			expect: false,
+		}, {
+			in:     aliasOf("s", types.String),
+			expect: true,
+		}, {
+			in: &types.Type{
+				Name: types.Name{
+					Package: "",
+					Name:    "struct_comparable_member",
+				},
+				Kind: types.Struct,
+				Members: []types.Member{
+					{
+						Name: "s",
+						Type: types.String,
+					},
+				},
+			},
+			expect: true,
+		}, {
+			in: &types.Type{
+				Name: types.Name{
+					Package: "",
+					Name:    "struct_uncomparable_member",
+				},
+				Kind: types.Struct,
+				Members: []types.Member{
+					{
+						Name: "s",
+						Type: ptrTo(types.String),
+					},
+				},
+			},
+			expect: false,
+		}, {
+			in:     arrayOf(types.String),
+			expect: true,
+		}, {
+			in:     arrayOf(aliasOf("s", types.String)),
+			expect: true,
+		}, {
+			in:     arrayOf(ptrTo(types.String)),
+			expect: false,
+		}, {
+			in:     arrayOf(mapOf(types.String)),
+			expect: false,
+		},
+	}
+
+	for _, tc := range cases {
+		if got, want := IsDirectComparable(tc.in), tc.expect; got != want {
+			t.Errorf("%q: expected %v, got %v", tc.in, want, got)
+		}
+	}
+}
+
+func TestParseInt(t *testing.T) {
+	type testcase struct {
+		name          string
+		in            string
+		expectedOut   int
+		expectedError bool
+	}
+
+	testcases := []testcase{
+		{
+			name:        "valid canonical positive integer string",
+			in:          "100",
+			expectedOut: 100,
+		},
+		{
+			name:        "valid canonical negative integer string",
+			in:          "-100",
+			expectedOut: -100,
+		},
+		{
+			name:          "empty string",
+			in:            "",
+			expectedError: true,
+		},
+		{
+			name:          "invalid unary positive integer string",
+			in:            "+100",
+			expectedError: true,
+		},
+		{
+			name:          "invalid canonical integer string, not an integer at all",
+			in:            "notanint",
+			expectedError: true,
+		},
+		{
+			name:          "invalid canonical integer string, spurious leading zeros",
+			in:            "00100",
+			expectedError: true,
+		},
+		{
+			name:          "invalid canonical integer string, octal value",
+			in:            "0o123",
+			expectedError: true,
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			out, err := ParseInt(tc.in)
+			switch {
+			case tc.expectedError && err == nil:
+				t.Error("expected an error but did not receive one")
+			case !tc.expectedError && err != nil:
+				t.Errorf("received an unexpected error: %v", err)
+			}
+
+			if out != tc.expectedOut {
+				t.Errorf("expected an output value of %d but got %d", tc.expectedOut, out)
+			}
+		})
+	}
+}
+
+func TestParseSignedInt(t *testing.T) {
+	type testcase struct {
+		name          string
+		in            string
+		bitSize       int
+		expectedOut   int64
+		expectedError bool
+	}
+
+	testcases := []testcase{
+		// --- int32 valid boundaries ---
+		{
+			name:        "int32 exact minimum boundary",
+			in:          "-2147483648",
+			bitSize:     32,
+			expectedOut: -2147483648,
+		},
+		{
+			name:        "int32 exact maximum boundary",
+			in:          "2147483647",
+			bitSize:     32,
+			expectedOut: 2147483647,
+		},
+		{
+			name:        "int32 zero",
+			in:          "0",
+			bitSize:     32,
+			expectedOut: 0,
+		},
+		{
+			name:        "int32 positive value",
+			in:          "100",
+			bitSize:     32,
+			expectedOut: 100,
+		},
+		{
+			name:        "int32 negative value",
+			in:          "-1",
+			bitSize:     32,
+			expectedOut: -1,
+		},
+		// --- int32 overflow ---
+		{
+			name:          "int32 one below minimum overflows",
+			in:            "-2147483649",
+			bitSize:       32,
+			expectedError: true,
+		},
+		{
+			name:          "int32 one above maximum overflows",
+			in:            "2147483648",
+			bitSize:       32,
+			expectedError: true,
+		},
+		{
+			name:        "int64 accepts value that overflows int32",
+			in:          "2147483648",
+			bitSize:     64,
+			expectedOut: 2147483648,
+		},
+		// --- int64 valid boundaries ---
+		{
+			name:        "int64 exact minimum boundary",
+			in:          "-9223372036854775808",
+			bitSize:     64,
+			expectedOut: -9223372036854775808,
+		},
+		{
+			name:        "int64 exact maximum boundary",
+			in:          "9223372036854775807",
+			bitSize:     64,
+			expectedOut: 9223372036854775807,
+		},
+		// --- int64 overflow ---
+		{
+			name:          "int64 one above maximum overflows",
+			in:            "9223372036854775808",
+			bitSize:       64,
+			expectedError: true,
+		},
+		{
+			name:          "int64 one below minimum overflows",
+			in:            "-9223372036854775809",
+			bitSize:       64,
+			expectedError: true,
+		},
+		// --- int16 boundaries ---
+		{
+			name:        "int16 exact minimum boundary",
+			in:          "-32768",
+			bitSize:     16,
+			expectedOut: -32768,
+		},
+		{
+			name:        "int16 exact maximum boundary",
+			in:          "32767",
+			bitSize:     16,
+			expectedOut: 32767,
+		},
+		{
+			name:          "int16 one above maximum overflows",
+			in:            "32768",
+			bitSize:       16,
+			expectedError: true,
+		},
+		{
+			name:          "int16 one below minimum overflows",
+			in:            "-32769",
+			bitSize:       16,
+			expectedError: true,
+		},
+		// --- int8 boundaries ---
+		{
+			name:        "int8 exact minimum boundary",
+			in:          "-128",
+			bitSize:     8,
+			expectedOut: -128,
+		},
+		{
+			name:        "int8 exact maximum boundary",
+			in:          "127",
+			bitSize:     8,
+			expectedOut: 127,
+		},
+		{
+			name:          "int8 one above maximum overflows",
+			in:            "128",
+			bitSize:       8,
+			expectedError: true,
+		},
+		{
+			name:          "int8 one below minimum overflows",
+			in:            "-129",
+			bitSize:       8,
+			expectedError: true,
+		},
+		// --- canonical form rejection ---
+		{
+			name:          "leading zeros rejected",
+			in:            "0100",
+			bitSize:       32,
+			expectedError: true,
+		},
+		{
+			name:          "unary plus rejected",
+			in:            "+1",
+			bitSize:       32,
+			expectedError: true,
+		},
+		{
+			name:          "octal notation rejected",
+			in:            "0o77",
+			bitSize:       32,
+			expectedError: true,
+		},
+		{
+			name:          "hex notation rejected",
+			in:            "0xFF",
+			bitSize:       32,
+			expectedError: true,
+		},
+		{
+			name:          "empty string rejected",
+			in:            "",
+			bitSize:       32,
+			expectedError: true,
+		},
+		{
+			name:          "non-numeric string rejected",
+			in:            "abc",
+			bitSize:       32,
+			expectedError: true,
+		},
+		{
+			name:          "floating point rejected",
+			in:            "1.5",
+			bitSize:       32,
+			expectedError: true,
+		},
+		{
+			name:          "whitespace rejected",
+			in:            " 1",
+			bitSize:       32,
+			expectedError: true,
+		},
+		{
+			name:          "negative zero canonical form rejected",
+			in:            "-0",
+			bitSize:       32,
+			expectedError: true,
+		},
+		{
+			name:          "unknown bit size returns error",
+			in:            "1",
+			bitSize:       7,
+			expectedError: true,
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			out, err := ParseSignedInt(tc.in, tc.bitSize)
+			switch {
+			case tc.expectedError && err == nil:
+				t.Errorf("expected an error for input %q with bitSize %d but did not receive one (got %d)", tc.in, tc.bitSize, out)
+			case !tc.expectedError && err != nil:
+				t.Errorf("received an unexpected error for input %q with bitSize %d: %v", tc.in, tc.bitSize, err)
+			}
+
+			if out != tc.expectedOut {
+				t.Errorf("expected output %d but got %d", tc.expectedOut, out)
+			}
+		})
+	}
+}
+
+func TestParseUnsignedInt(t *testing.T) {
+	type testcase struct {
+		name          string
+		in            string
+		bitSize       int
+		expectedOut   uint64
+		expectedError bool
+	}
+
+	testcases := []testcase{
+		// --- uint64 valid boundaries ---
+		{
+			name:        "uint64 maximum boundary",
+			in:          "18446744073709551615",
+			bitSize:     64,
+			expectedOut: 18446744073709551615,
+		},
+		{
+			name:        "uint64 zero",
+			in:          "0",
+			bitSize:     64,
+			expectedOut: 0,
+		},
+		// --- uint64 overflow ---
+		{
+			name:          "uint64 one above maximum overflows",
+			in:            "18446744073709551616",
+			bitSize:       64,
+			expectedError: true,
+		},
+		// --- uint32 valid boundaries ---
+		{
+			name:        "uint32 maximum boundary",
+			in:          "4294967295",
+			bitSize:     32,
+			expectedOut: 4294967295,
+		},
+		{
+			name:        "uint32 zero",
+			in:          "0",
+			bitSize:     32,
+			expectedOut: 0,
+		},
+		{
+			name:          "uint32 one above maximum overflows",
+			in:            "4294967296",
+			bitSize:       32,
+			expectedError: true,
+		},
+		// --- uint16 valid boundaries ---
+		{
+			name:        "uint16 maximum boundary",
+			in:          "65535",
+			bitSize:     16,
+			expectedOut: 65535,
+		},
+		{
+			name:          "uint16 one above maximum overflows",
+			in:            "65536",
+			bitSize:       16,
+			expectedError: true,
+		},
+		// --- uint8 valid boundaries ---
+		{
+			name:        "uint8 maximum boundary",
+			in:          "255",
+			bitSize:     8,
+			expectedOut: 255,
+		},
+		{
+			name:          "uint8 one above maximum overflows",
+			in:            "256",
+			bitSize:       8,
+			expectedError: true,
+		},
+		// --- negative values rejected for unsigned ---
+		{
+			name:          "negative value rejected",
+			in:            "-1",
+			bitSize:       64,
+			expectedError: true,
+		},
+		{
+			name:        "uint64 accepts value that overflows uint32",
+			in:          "4294967296",
+			bitSize:     64,
+			expectedOut: 4294967296,
+		},
+		// --- canonical form rejection ---
+		{
+			name:          "leading zeros rejected",
+			in:            "0100",
+			bitSize:       32,
+			expectedError: true,
+		},
+		{
+			name:          "unary plus rejected",
+			in:            "+1",
+			bitSize:       32,
+			expectedError: true,
+		},
+		{
+			name:          "empty string rejected",
+			in:            "",
+			bitSize:       64,
+			expectedError: true,
+		},
+		{
+			name:          "hex notation rejected",
+			in:            "0xFF",
+			bitSize:       32,
+			expectedError: true,
+		},
+		{
+			name:          "floating point rejected",
+			in:            "1.0",
+			bitSize:       32,
+			expectedError: true,
+		},
+		{
+			name:          "unknown bit size returns error",
+			in:            "1",
+			bitSize:       7,
+			expectedError: true,
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			out, err := ParseUnsignedInt(tc.in, tc.bitSize)
+			switch {
+			case tc.expectedError && err == nil:
+				t.Errorf("expected an error for input %q with bitSize %d but did not receive one (got %d)", tc.in, tc.bitSize, out)
+			case !tc.expectedError && err != nil:
+				t.Errorf("received an unexpected error for input %q with bitSize %d: %v", tc.in, tc.bitSize, err)
+			}
+
+			if out != tc.expectedOut {
+				t.Errorf("expected output %d but got %d", tc.expectedOut, out)
+			}
+		})
+	}
+}
+
+func TestParseBool(t *testing.T) {
+	type testcase struct {
+		name          string
+		in            string
+		expectedOut   bool
+		expectedError bool
+	}
+
+	testcases := []testcase{
+		{
+			name:        "valid canonical true string",
+			in:          "true",
+			expectedOut: true,
+		},
+		{
+			name:        "valid canonical false string",
+			in:          "false",
+			expectedOut: false,
+		},
+		{
+			name:          "empty string",
+			in:            "",
+			expectedError: true,
+		},
+		{
+			name:          "invalid canonical boolean string, not a bool at all",
+			in:            "notabool",
+			expectedError: true,
+		},
+		{
+			name:          "invalid canonical boolean string, capitalized",
+			in:            "True",
+			expectedError: true,
+		},
+		{
+			name:          "invalid canonical boolean string, numeric",
+			in:            "1",
+			expectedError: true,
+		},
+		{
+			name:          "invalid canonical boolean string, YAML",
+			in:            "yes",
+			expectedError: true,
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			out, err := ParseBool(tc.in)
+			switch {
+			case tc.expectedError && err == nil:
+				t.Error("expected an error but did not receive one")
+			case !tc.expectedError && err != nil:
+				t.Errorf("received an unexpected error: %v", err)
+			}
+
+			if out != tc.expectedOut {
+				t.Errorf("expected an output value of %v but got %v", tc.expectedOut, out)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validation.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validation.go
new file mode 100644
index 0000000000..a4368afa96
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validation.go
@@ -0,0 +1,2166 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"bytes"
+	"cmp"
+	"fmt"
+	"io"
+	"reflect"
+	"slices"
+	"strconv"
+	"strings"
+	"unicode"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/code-generator/cmd/validation-gen/validators"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/parser/tags"
+	"k8s.io/gengo/v2/types"
+	"k8s.io/klog/v2"
+)
+
+func mkPkgNames(pkg string, names ...string) []types.Name {
+	result := make([]types.Name, 0, len(names))
+	for _, name := range names {
+		result = append(result, types.Name{Package: pkg, Name: name})
+	}
+	return result
+}
+
+var (
+	fieldPkg            = "k8s.io/apimachinery/pkg/util/validation/field"
+	fieldPkgSymbols     = mkPkgNames(fieldPkg, "ErrorList", "InternalError", "Path")
+	fmtPkgSymbols       = mkPkgNames("fmt", "Errorf", "Fprintln")
+	safePkg             = "k8s.io/apimachinery/pkg/api/safe"
+	safePkgSymbols      = mkPkgNames(safePkg, "Field", "Cast", "Value")
+	operationPkg        = "k8s.io/apimachinery/pkg/api/operation"
+	operationPkgSymbols = mkPkgNames(operationPkg, "Operation", "MatchesSubresource", "Update")
+	contextPkg          = "context"
+	contextPkgSymbols   = mkPkgNames(contextPkg, "Context")
+)
+
+// genValidations produces a file with autogenerated validations.
+type genValidations struct {
+	generator.GoGenerator
+	outputPackage       string
+	inputPackage        string
+	inputToCanonicalPkg map[string]string // input package -> the generated package cross-package references resolve to
+	rootTypes           []*types.Type
+	discovered          *typeDiscoverer
+	imports             namer.ImportTracker
+	schemeRegistry      types.Name
+	emitRegisterFunc    bool
+	deepEqualFunc       types.Name
+	usedDeepEqualImpl   bool
+}
+
+// NewGenValidations creates a new generator for the specified package.
+func NewGenValidations(outputFilename, outputPackage, inputPackage string, rootTypes []*types.Type, discovered *typeDiscoverer, inputToCanonicalPkg map[string]string, schemeRegistry types.Name, emitRegisterFunc bool, deepEqualFunc types.Name) generator.Generator {
+	return &genValidations{
+		GoGenerator: generator.GoGenerator{
+			OutputFilename: outputFilename,
+		},
+		outputPackage:       outputPackage,
+		inputPackage:        inputPackage,
+		inputToCanonicalPkg: inputToCanonicalPkg,
+		rootTypes:           rootTypes,
+		discovered:          discovered,
+		imports:             generator.NewImportTrackerForPackage(outputPackage),
+		schemeRegistry:      schemeRegistry,
+		emitRegisterFunc:    emitRegisterFunc,
+		deepEqualFunc:       deepEqualFunc,
+	}
+}
+
+// resolveFunc maps a validator reference to the package it should be called
+// from, applying the first rule that matches (local wins over canonical):
+//  1. if this generator validates the reference's input package, the
+//     generator's own output package (the local copy);
+//  2. else the input's canonical package, if one exists;
+//  3. otherwise the reference is returned unchanged.
+func (g *genValidations) resolveFunc(name types.Name) types.Name {
+	if name.Package == g.inputPackage {
+		name.Package = g.outputPackage
+	} else if pkg, ok := g.inputToCanonicalPkg[name.Package]; ok {
+		name.Package = pkg
+	}
+	return name
+}
+
+func (g *genValidations) Namers(_ *generator.Context) namer.NameSystems {
+	// Have the raw namer for this file track what it imports.
+	return namer.NameSystems{
+		"raw": namer.NewRawNamer(g.outputPackage, g.imports),
+	}
+}
+
+func (g *genValidations) Filter(_ *generator.Context, t *types.Type) bool {
+	// We want to emit code for all root types.
+	if slices.Contains(g.rootTypes, t) {
+		return true
+	}
+	// We want to emit for any other type that is referenced by a root type's
+	// graph and has validations. Types that were only discovered as another
+	// package's root (selected there, referenced by nothing) are skipped so a
+	// generator does not emit validators it never calls.
+	n := g.discovered.typeNodes[t]
+	return n != nil && n.referenced && g.hasValidations(n)
+}
+
+func (g *genValidations) Imports(_ *generator.Context) (imports []string) {
+	var importLines []string
+	for _, singleImport := range g.imports.ImportLines() {
+		if g.isOtherPackage(singleImport) {
+			importLines = append(importLines, singleImport)
+		}
+	}
+	return importLines
+}
+
+func (g *genValidations) isOtherPackage(pkg string) bool {
+	if pkg == g.outputPackage {
+		return false
+	}
+	if strings.HasSuffix(pkg, `"`+g.outputPackage+`"`) {
+		return false
+	}
+	return true
+}
+
+func (g *genValidations) Init(c *generator.Context, w io.Writer) error {
+	klog.V(5).Infof("emitting registration code")
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+	if g.emitRegisterFunc {
+		g.emitRegisterFunction(c, g.schemeRegistry, sw)
+	}
+	if err := sw.Error(); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (g *genValidations) GenerateType(c *generator.Context, t *types.Type, w io.Writer) error {
+	klog.V(5).Infof("emitting validation code for type %v", t)
+
+	sw := generator.NewSnippetWriter(w, c, "$", "$")
+	g.emitValidationVariables(c, t, sw)
+	g.emitValidationFunction(c, t, sw)
+	if err := sw.Error(); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (g *genValidations) Finalize(c *generator.Context, w io.Writer) error {
+	if g.usedDeepEqualImpl {
+		sw := generator.NewSnippetWriter(w, c, "$", "$")
+		sw.Do("\n", nil)
+		sw.Do("// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.\n", nil)
+		sw.Do("func deepEqualImpl_[T any](a, b T) bool {\n", nil)
+		if g.deepEqualFunc.Package == "" {
+			sw.Do("	return $.$(a, b)\n", g.deepEqualFunc.Name)
+		} else {
+			targs := generator.Args{
+				"deepEqualFunc": c.Universe.Type(g.deepEqualFunc),
+			}
+			sw.Do("	return $.deepEqualFunc|raw$(a, b)\n", targs)
+		}
+		sw.Do("}\n", nil)
+		return sw.Error()
+	}
+	return nil
+}
+
+// typeDiscoverer contains fields necessary to build graphs of types.
+type typeDiscoverer struct {
+	initialized         bool
+	validator           validators.ValidationExtractor
+	inputToCanonicalPkg map[string]string
+
+	// constantsByType holds a map of type to constants of that type.
+	constantsByType map[*types.Type][]*validators.Constant
+
+	// typeNodes holds a map of gengo Type to typeNode for all of the types
+	// encountered during discovery.
+	typeNodes map[*types.Type]*typeNode
+}
+
+// NewTypeDiscoverer creates a NewTypeDiscoverer.
+// Init must be called before calling DiscoverType.
+func NewTypeDiscoverer(validator validators.ValidationExtractor, inputToCanonicalPkg map[string]string) *typeDiscoverer {
+	return &typeDiscoverer{
+		validator:           validator,
+		inputToCanonicalPkg: inputToCanonicalPkg,
+		constantsByType:     map[*types.Type][]*validators.Constant{},
+		typeNodes:           map[*types.Type]*typeNode{},
+	}
+}
+
+// Init uses the generator context to prepare for type discovery.
+func (td *typeDiscoverer) Init(c *generator.Context) error {
+	packages := c.Universe
+	for _, pkg := range packages {
+		// We only care about packages we are generating for or are readonly.
+		if _, ok := td.inputToCanonicalPkg[pkg.Path]; !ok {
+			continue
+		}
+		for _, cnst := range pkg.Constants {
+			context := validators.Context{
+				Scope:          validators.ScopeConst,
+				Type:           cnst.Underlying,
+				Path:           nil, // NA when discovering a constant
+				Member:         nil, // NA when discovering a constant
+				ParentPath:     nil, // NA when discovering a constant
+				ListSelector:   nil, // NA for constants
+				ParentType:     nil, // NA for constants
+				Constants:      nil, // NA for constants
+				StabilityLevel: "",  // Default to stable unless overridden
+			}
+			tgs, err := td.validator.ExtractTags(context, cnst.CommentLines)
+			if err != nil {
+				return fmt.Errorf("constant %s: %w", cnst.Name, err)
+			}
+			if len(tgs) > 0 {
+				// Also check that the tgs are valid.
+				if _, err := td.validator.ExtractValidations(context, tgs...); err != nil {
+					return fmt.Errorf("constant %s: %w", cnst.Name, err)
+				}
+			}
+			td.constantsByType[cnst.Underlying] = append(td.constantsByType[cnst.Underlying], &validators.Constant{Constant: cnst, Tags: tgs})
+		}
+	}
+	td.initialized = true
+	return nil
+}
+
+// childNode represents a type which is used in another type (e.g. a struct
+// field).
+type childNode struct {
+	name      string      // the field name in the parent, populated when this node is a struct field
+	jsonName  string      // always populated when name is populated
+	childType *types.Type // the real type of the child (may be a pointer)
+	node      *typeNode   // the node of the child's value type, or nil if it is in a foreign package
+
+	fieldValidations validators.Validations // validations on the field
+
+	// These are not the same as fieldValidations, and are not considered in
+	// hasValidations. These let us emit the iteration code for list and
+	// map types, but we might not have enough information to know if we can
+	// skip them at discovery time.
+	fieldValIterations validators.Validations // validations on each val
+	fieldKeyIterations validators.Validations // validations on each key
+}
+
+// typeNode represents a node in the type-graph, annotated with information
+// about validations.  Everything in this type, transitively, is assoctiated
+// with the type, and not any specific instance of that type (e.g. when used as
+// a field in a struct.
+type typeNode struct {
+	valueType  *types.Type // never a pointer, but may be a map, slice, struct, etc.
+	funcName   types.Name  // populated when this type is has a validation function
+	referenced bool        // true if used as a field/element/key/underlying of another type (set by discoverChild)
+
+	fields     []*childNode // populated when this type is a struct
+	key        *childNode   // populated when this type is a map
+	elem       *childNode   // populated when this type is a map or slice
+	underlying *childNode   // populated when this type is an alias
+
+	typeValidations validators.Validations // validations on the type
+
+	// These are not the same as typeValidations, and are not considered in
+	// hasValidations. These let us emit the iteration code for list and
+	// map types, but we might not have enough information to know if we can
+	// skip them at discovery time.
+	typeValIterations validators.Validations // validations on each val
+	typeKeyIterations validators.Validations // validations on each key
+}
+
+// resolveElemNode traverses underlying alias nodes to find the concrete element node (for slices/maps).
+func (n *typeNode) resolveElemNode() *typeNode {
+	if n.elem != nil {
+		return n.elem.node
+	}
+	if n.underlying != nil && n.underlying.node != nil && n.underlying.node.elem != nil {
+		return n.underlying.node.elem.node
+	}
+	return nil
+}
+
+// resolveKeyNode traverses underlying alias nodes to find the concrete key node (for maps).
+func (n *typeNode) resolveKeyNode() *typeNode {
+	if n.key != nil {
+		return n.key.node
+	}
+	if n.underlying != nil && n.underlying.node != nil && n.underlying.node.key != nil {
+		return n.underlying.node.key.node
+	}
+	return nil
+}
+
+// DiscoverType walks the given type recursively, building a type-graph in this
+// typeDiscoverer.  If this is called multiple times for different types, the
+// graphs will be will be merged.
+func (td *typeDiscoverer) DiscoverType(t *types.Type) error {
+	if !td.initialized {
+		return fmt.Errorf("typeDiscoverer not initialized")
+	}
+	if t.Kind == types.Pointer {
+		return fmt.Errorf("type %v: pointer root-types are not supported", t)
+	}
+	fldPath := field.NewPath(t.Name.String())
+	if node, err := td.discoverType(t, fldPath); err != nil {
+		return err
+	} else if node == nil {
+		panic(fmt.Sprintf("discovered a nil node for type %v", t))
+	}
+	return nil
+}
+
+// discoverType walks the given type recursively and returns a typeNode
+// representing it. This does not distinguish between discovering a type
+// definition and discovering a field of a struct.  The first time it
+// encounters a type it has not seen before, it will explore that type. If it
+// finds a type it has already processed, it will return the existing node.
+func (td *typeDiscoverer) discoverType(t *types.Type, fldPath *field.Path) (*typeNode, error) {
+	// With the exception of builtins (which gengo puts in package ""), we
+	// can't traverse into packages which are not being processed by this tool.
+	if t.Name.Package != "" {
+		_, ok := td.inputToCanonicalPkg[t.Name.Package]
+		if !ok {
+			return nil, nil
+		}
+	}
+
+	// Catch some cases that we don't want to handle (yet?).  This happens
+	// as early as possible to make all the other code simpler.
+	if err := td.verifySupportedType(t); err != nil {
+		return nil, fmt.Errorf("field %s (%s): %w", fldPath.String(), t, err)
+	}
+
+	// Discovery applies to values, not pointers.
+	if t.Kind == types.Pointer {
+		return td.discoverType(t.Elem, fldPath)
+	}
+
+	// If we have done this type already, we can stop here and break any
+	// recursion.
+	if node, found := td.typeNodes[t]; found {
+		return node, nil
+	}
+	klog.V(4).InfoS("discoverType", "type", t, "kind", t.Kind, "path", fldPath.String())
+
+	// This is the type-node being assembled in the rest of this function.
+	thisNode := &typeNode{
+		valueType: t,
+	}
+	td.typeNodes[t] = thisNode
+
+	// If we are descending into a named type...
+	switch t.Kind {
+	case types.Alias, types.Struct:
+		// Reboot the field path for better logging.  Otherwise the field path
+		// might come in as something like <type1>.<field1>.<field2> which is
+		// true, but not super useful.
+		fldPath = field.NewPath(t.Name.String())
+
+		// Find its validation function for later use.
+		if fn, ok := td.getValidationFunctionName(t); ok {
+			thisNode.funcName = fn
+		}
+	}
+
+	// Discover into this type before extracting type validations.
+	switch t.Kind {
+	case types.Builtin, types.Interface:
+		// Nothing more to do.
+	case types.Alias:
+		// Discover the underlying type.
+		//
+		// Note: By the language definition, what gengo calls "Aliases" (really
+		// just "type definitions") have underlying types of the type literal.
+		// In other words, if we define `type T1 string` and `type T2 T1`, the
+		// underlying type of T2 is string, not T1.  This means that:
+		//    1) We will emit code for both underlying types. If the underlying
+		//       type is a struct with many fields, we will emit two identical
+		//       functions.
+		//    2) Validating a field of type T2 will NOT call any validation
+		//       defined on the type T1.
+		//    3) In the case of a type definition whose RHS is a struct which
+		//       has fields with validation tags, the validation for those fields
+		//       WILL be called from the generated for for the new type.
+		if node, err := td.discoverChild(t.Underlying, fldPath); err != nil {
+			return nil, err
+		} else {
+			thisNode.underlying = &childNode{
+				childType: t.Underlying,
+				node:      node,
+			}
+		}
+	case types.Struct:
+		// Discover into this struct, recursively.
+		if err := td.discoverStruct(thisNode, fldPath); err != nil {
+			return nil, err
+		}
+	case types.Slice:
+		// Discover the element type.
+		if node, err := td.discoverChild(t.Elem, fldPath.Key("vals")); err != nil {
+			return nil, err
+		} else {
+			thisNode.elem = &childNode{
+				childType: t.Elem,
+				node:      node,
+			}
+		}
+	case types.Map:
+		// Discover the key type.
+		if node, err := td.discoverChild(t.Key, fldPath.Key("keys")); err != nil {
+			return nil, err
+		} else {
+			thisNode.key = &childNode{
+				childType: t.Key,
+				node:      node,
+			}
+		}
+
+		// Discover the element type.
+		if node, err := td.discoverChild(t.Elem, fldPath.Key("vals")); err != nil {
+			return nil, err
+		} else {
+			thisNode.elem = &childNode{
+				childType: t.Elem,
+				node:      node,
+			}
+		}
+	}
+
+	// Extract any type-attached validation rules.  We do this AFTER descending
+	// into the type, so that these validators have access to the full type.
+	// For example, all struct field validators get called before the type
+	// validators.  This does not influence the order in which the validations
+	// are called in emitted code, just how we evaluate what to emit.
+	switch t.Kind {
+	case types.Alias, types.Struct:
+		if fldPath.String() != t.String() {
+			panic(fmt.Sprintf("path for type != the type name: %s, %s", t.String(), fldPath.String()))
+		}
+		consts := td.constantsByType[t]
+		context := validators.Context{
+			Scope:          validators.ScopeType,
+			Type:           t,
+			Path:           fldPath,
+			Member:         nil, // NA when discovering a type
+			ParentPath:     nil, // NA when discovering a type
+			Constants:      consts,
+			ListSelector:   nil, // NA for type scope
+			ParentType:     nil, // NA for type scope
+			StabilityLevel: "",  // Default to stable unless overridden
+		}
+		extractedTags, err := td.validator.ExtractTags(context, t.CommentLines)
+		if err != nil {
+			return nil, fmt.Errorf("%v: %w", fldPath, err)
+		}
+		if validations, err := td.validator.ExtractValidations(context, extractedTags...); err != nil {
+			return nil, fmt.Errorf("%v: %w", fldPath, err)
+		} else if validations.Empty() {
+			klog.V(6).InfoS("no type-attached validations", "type", t)
+		} else {
+			if util.NonPointer(util.NativeType(t)).Kind == types.Map && util.NonPointer(util.NativeType(t)).Elem.Kind == types.Slice {
+				return nil, fmt.Errorf("field %s: validation for map of slices is not supported", fldPath)
+			}
+			klog.V(5).InfoS("found type-attached validations", "n", len(validations.Functions), "type", t)
+			thisNode.typeValidations.Add(validations)
+		}
+
+		// Handle type definitions whose output depends on the rest of type
+		// discovery being complete. In particular, aliases to lists and maps need
+		// iteration, but we don't want to iterate them if the key or value types
+		// don't actually have validations. We also want to handle non-included
+		// types and make users tell us what they intended. Lastly, we want to
+		// handle recursive types, but we need to finish discovering the type
+		// before we know if there are other validations, again so we don't emit
+		// empty functions.
+		if t.Kind == types.Alias {
+			switch util.NonPointer(util.NativeType(t)).Kind {
+			case types.Slice:
+				// Validate each value.
+				elemNode := thisNode.resolveElemNode()
+				if elemNode == nil {
+					if !thisNode.typeValidations.OpaqueValType {
+						return nil, fmt.Errorf("%v: value type %v is in a non-included package; "+
+							"either add this package to validation-gen's --readonly-pkg flag, "+
+							"or add +k8s:eachVal=+k8s:opaqueType to the field to skip validation",
+							fldPath, util.NativeType(t).Elem)
+					}
+				} else if thisNode.typeValidations.OpaqueValType {
+					// If the type is marked as opaque, we can treat it as it is
+					// were in a non-included package.
+				} else {
+					// If the value type is a named type, call the validation
+					// function for each element.
+					if funcName := elemNode.funcName; funcName.Name != "" {
+						// Save the iteration validation while we have all the
+						// information we need. Later we can check if we
+						// actually need it.
+						//
+						// Note: the first argument to Function() is really
+						// only for debugging.
+						v, err := validators.ForEachVal(fldPath, thisNode.valueType,
+							validators.Function("iterateListValues", validators.DefaultFlags, funcName).
+								WithComment("iterate the list and call the type's validation function"))
+						if err != nil {
+							return nil, fmt.Errorf("generating list iteration: %w", err)
+						} else {
+							thisNode.typeValIterations.Add(v)
+						}
+					}
+				}
+			case types.Map:
+				// Validate each key.
+				keyNode := thisNode.resolveKeyNode()
+				if keyNode == nil {
+					if !thisNode.typeValidations.OpaqueKeyType {
+						return nil, fmt.Errorf("%v: key type %v is in a non-included package; "+
+							"either add this package to validation-gen's --readonly-pkg flag, "+
+							"or add +k8s:eachKey=+k8s:opaqueType to the field to skip validation",
+							fldPath, util.NativeType(t).Key)
+					}
+				} else if thisNode.typeValidations.OpaqueKeyType {
+					// If the type is marked as opaque, we can treat it as it is
+					// were in a non-included package.
+				} else {
+					// If the key type is a named type, call the validation
+					// function for each key.
+					if funcName := keyNode.funcName; funcName.Name != "" {
+						// Save the iteration validation while we have all the
+						// information we need. Later we can check if we
+						// actually need it.
+						//
+						// Note: the first argument to Function() is really
+						// only for debugging.
+						v, err := validators.ForEachKey(fldPath, thisNode.valueType,
+							validators.Function("iterateMapKeys", validators.DefaultFlags, funcName).
+								WithComment("iterate the map and call the key type's validation function"))
+						if err != nil {
+							return nil, fmt.Errorf("generating map key iteration: %w", err)
+						} else {
+							thisNode.typeKeyIterations.Add(v)
+						}
+					}
+				}
+				// Validate each value.
+				elemNode := thisNode.resolveElemNode()
+				if elemNode == nil {
+					if !thisNode.typeValidations.OpaqueValType {
+						return nil, fmt.Errorf("%v: value type %v is in a non-included package; "+
+							"either add this package to validation-gen's --readonly-pkg flag, "+
+							"or add +k8s:eachVal=+k8s:opaqueType to the field to skip validation",
+							fldPath, util.NativeType(t).Elem)
+					}
+				} else if thisNode.typeValidations.OpaqueValType {
+					// If the type is marked as opaque, we can treat it as it is
+					// were in a non-included package.
+				} else {
+					// If the value type is a named type, call the validation
+					// function for each element.
+					if funcName := elemNode.funcName; funcName.Name != "" {
+						// Save the iteration validation while we have all the
+						// information we need. Later we can check if we
+						// actually need it.
+						//
+						// Note: the first argument to Function() is really
+						// only for debugging.
+						v, err := validators.ForEachVal(fldPath, thisNode.valueType,
+							validators.Function("iterateMapValues", validators.DefaultFlags, funcName).
+								WithComment("iterate the map and call the value type's validation function"))
+						if err != nil {
+							return nil, fmt.Errorf("generating map value iteration: %w", err)
+						} else {
+							thisNode.typeValIterations.Add(v)
+						}
+					}
+				}
+			}
+		}
+	}
+
+	// These are validations that could not be fully resolved during tag extraction
+	// (e.g., because they need to wrap inner validations or depend on the full
+	// type graph being discovered). We resolve them iteratively because a
+	// deferred validation may yield further deferred validations.
+	deferred := thisNode.typeValidations.Deferred
+	thisNode.typeValidations.Deferred = nil
+	depth := 0
+	for len(deferred) > 0 {
+		depth++
+		if depth > 10 {
+			return nil, fmt.Errorf("deferred validation recursion depth exceeded "+
+				"10 for type %s at path %s", thisNode.valueType.String(), fldPath.String())
+		}
+		var nextDeferred []validators.DeferredGen
+		for _, def := range deferred {
+			res, err := def.Callback()
+			if err != nil {
+				return nil, err
+			}
+			if len(res.Deferred) > 0 {
+				nextDeferred = append(nextDeferred, res.Deferred...)
+				res.Deferred = nil
+			}
+			// Deferred validations can originate from fields with ParentContext scope (e.g., UnionValidations)
+			// or from validations on type definitions with ThisContext scope (e.g., eachVal on a slice type).
+			if def.Scope == validators.ThisContext || def.Scope == validators.ParentContext {
+				thisNode.typeValidations.Add(res)
+			} else {
+				return nil, fmt.Errorf("unexpected scope %v", def.Scope)
+			}
+		}
+		deferred = nextDeferred
+	}
+
+	return thisNode, nil
+}
+
+// discoverChild is discoverType for a type reached as a child (a field,
+// element, key, or underlying type) of another type. It additionally marks the
+// discovered node as referenced. See typeNode.referenced.
+func (td *typeDiscoverer) discoverChild(t *types.Type, fldPath *field.Path) (*typeNode, error) {
+	node, err := td.discoverType(t, fldPath)
+	if node != nil {
+		node.referenced = true
+	}
+	return node, err
+}
+
+// verifySupportedType checks whether the given type is supported.
+func (td *typeDiscoverer) verifySupportedType(t *types.Type) error {
+	switch t.Kind {
+	case types.Builtin, types.Struct:
+		// Allowed
+	case types.Interface:
+		// We can't do much with interfaces, but they pop up in some places
+		// like RawExtension.
+	case types.Alias:
+		if t.Underlying.Kind == types.Pointer {
+			return fmt.Errorf("typedefs to pointers are not supported")
+		}
+	case types.Pointer:
+		pointee := util.NativeType(t.Elem)
+		switch pointee.Kind {
+		case types.Pointer:
+			return fmt.Errorf("pointers to pointers are not supported")
+		case types.Slice, types.Array:
+			return fmt.Errorf("pointers to lists are not supported")
+		case types.Map:
+			return fmt.Errorf("pointers to maps are not supported")
+		}
+	case types.Array:
+		return fmt.Errorf("fixed-size arrays are not supported")
+	case types.Slice:
+		elem := util.NativeType(t.Elem)
+		switch elem.Kind {
+		case types.Slice:
+			if util.NativeType(elem.Elem) != types.Byte {
+				return fmt.Errorf("lists of lists are not supported")
+			}
+		case types.Map:
+			return fmt.Errorf("lists of maps are not supported")
+		}
+	case types.Map:
+		key := util.NativeType(t.Key)
+		if key != types.String {
+			return fmt.Errorf("maps with non-string keys are not supported")
+		}
+		elem := util.NativeType(t.Elem)
+		switch elem.Kind {
+		case types.Map:
+			return fmt.Errorf("maps of maps are not supported")
+		}
+	default:
+		return fmt.Errorf("kind %v is not supported", t.Kind)
+	}
+
+	return nil
+}
+
+// resolveFieldElemNode returns the element node for a slice/map field, falling
+// back to the type cache when the field type's elem child is not yet wired up
+// (a recursive type still under construction).
+func (td *typeDiscoverer) resolveFieldElemNode(child *childNode, elemType *types.Type) *typeNode {
+	if child.node != nil && child.node.elem != nil {
+		return child.node.elem.node
+	}
+	return td.typeNodes[elemType]
+}
+
+// resolveFieldKeyNode is resolveFieldElemNode for a map's key.
+func (td *typeDiscoverer) resolveFieldKeyNode(child *childNode, keyType *types.Type) *typeNode {
+	if child.node != nil && child.node.key != nil {
+		return child.node.key.node
+	}
+	return td.typeNodes[keyType]
+}
+
+// discoverStruct walks a struct type recursively.
+func (td *typeDiscoverer) discoverStruct(thisNode *typeNode, fldPath *field.Path) error {
+	var fields []*childNode
+
+	klog.V(5).InfoS("discoverStruct", "type", thisNode.valueType)
+
+	// Discover into each field of this struct.
+	for _, memb := range thisNode.valueType.Members {
+		name := memb.Name
+
+		// Only do exported fields.
+		if unicode.IsLower([]rune(name)[0]) {
+			continue
+		}
+
+		// If we try to emit code for this field and find no JSON name, we
+		// will abort.
+		jsonName := ""
+		if commentTags, ok := tags.LookupJSON(memb); ok {
+			jsonName = commentTags.Name
+		}
+
+		var childPath *field.Path
+		if jsonName != "" {
+			childPath = fldPath.Child(jsonName)
+		} else {
+			childPath = fldPath.Child(name)
+		}
+
+		// Discover the field type.
+		klog.V(5).InfoS("field", "name", name, "jsonName", jsonName, "type", memb.Type, "path", childPath)
+		childType := memb.Type
+		var child *childNode
+		if node, err := td.discoverChild(childType, childPath); err != nil {
+			return err
+		} else {
+			child = &childNode{
+				name:      name,
+				jsonName:  jsonName,
+				childType: childType,
+				node:      node,
+			}
+		}
+
+		// Extract any field-attached validation rules.
+		context := validators.Context{
+			Scope:          validators.ScopeField,
+			Type:           childType,
+			Path:           childPath,
+			Member:         &memb,
+			ParentPath:     fldPath,
+			ParentType:     thisNode.valueType,
+			ListSelector:   nil, // NA for fields
+			Constants:      nil, // NA for fields
+			StabilityLevel: "",  // Inherited or default
+		}
+
+		tags, err := td.validator.ExtractTags(context, memb.CommentLines)
+		if err != nil {
+			return fmt.Errorf("field %s: %w", childPath.String(), err)
+		}
+		if validations, err := td.validator.ExtractValidations(context, tags...); err != nil {
+			return fmt.Errorf("field %s: %w", childPath.String(), err)
+		} else if validations.Empty() {
+			klog.V(6).InfoS("no field-attached validations", "field", childPath)
+		} else {
+			klog.V(5).InfoS("found field-attached validations", "n", len(validations.Functions), "field", childPath)
+			if util.NonPointer(util.NativeType(childType)).Kind == types.Map && util.NonPointer(util.NativeType(childType)).Elem.Kind == types.Slice {
+				return fmt.Errorf("field %s: validation for map of slices is not supported", childPath)
+			}
+			child.fieldValidations.Add(validations)
+			// TODO: re-visit erroring on specific cases where variable generation is not supported for field validations
+			// currently there are some cases where we want variable generation for field validations
+		}
+
+		// Handle non-included types.
+		switch util.NonPointer(childType).Kind {
+		case types.Struct, types.Alias:
+			if child.node == nil { // a non-included type
+				if !child.fieldValidations.OpaqueType {
+					return fmt.Errorf("%v: type %v is in a non-included package; "+
+						"either add this package to validation-gen's --readonly-pkg flag, "+
+						"or add +k8s:opaqueType to the field to skip validation",
+						childPath, childType.String())
+				}
+			} else if child.fieldValidations.OpaqueType {
+				// If the field is marked as opaque, we can treat it as it is
+				// were in a non-included package.
+				child.node = nil
+			}
+		}
+
+		// Add any other field-attached "special" validators. We need to do
+		// this after all the other field validation has been processed,
+		// because some of this is conditional on whether other validations
+		// were emitted (to avoid emitting empty functions).
+		//
+		// We do this here, rather than in discoverType() because we need to
+		// know information about the field, not just the type.
+		switch childType.Kind {
+		case types.Slice:
+			// Validate each value of a list field.
+			if elemNode := td.resolveFieldElemNode(child, childType.Elem); elemNode == nil {
+				if !child.fieldValidations.OpaqueValType {
+					return fmt.Errorf("%v: value type %v is in a non-included package; "+
+						"either add this package to validation-gen's --readonly-pkg flag, "+
+						"or add +k8s:eachVal=+k8s:opaqueType to the field to skip validation",
+						childPath, childType.Elem.String())
+				}
+			} else if child.fieldValidations.OpaqueValType {
+				// If the field is marked as opaque, we can treat it as it is
+				// were in a non-included package.
+			} else {
+				// If the list's value type is a named type, call the validation
+				// function for each element.
+				if funcName := elemNode.funcName; funcName.Name != "" {
+					// Save the iteration validation while we have all the
+					// information we need. Later we can check if we
+					// actually need it.
+					//
+					// Note: the first argument to Function() is really
+					// only for debugging.
+					v, err := validators.ForEachVal(childPath, childType,
+						validators.Function("iterateListValues", validators.DefaultFlags, funcName).
+							WithComment("iterate the list and call the type's validation function"))
+					if err != nil {
+						return fmt.Errorf("generating list iteration: %w", err)
+					} else {
+						child.fieldValIterations.Add(v)
+					}
+				}
+			}
+		case types.Map:
+			// Validate each key of a map field.
+			if keyNode := td.resolveFieldKeyNode(child, childType.Key); keyNode == nil {
+				if !child.fieldValidations.OpaqueKeyType {
+					return fmt.Errorf("%v: key type %v is in a non-included package; "+
+						"either add this package to validation-gen's --readonly-pkg flag, "+
+						"or add +k8s:eachKey=+k8s:opaqueType to the field to skip validation",
+						childPath, childType.Key.String())
+				}
+			} else if child.fieldValidations.OpaqueKeyType {
+				// If the field is marked as opaque, we can treat it as it is
+				// were in a non-included package.
+			} else {
+				// If the map's key type is a named type, call the validation
+				// function for each key.
+				if funcName := keyNode.funcName; funcName.Name != "" {
+					// Save the iteration validation while we have all the
+					// information we need. Later we can check if we
+					// actually need it.
+					//
+					// Note: the first argument to Function() is really
+					// only for debugging.
+					v, err := validators.ForEachKey(childPath, childType,
+						validators.Function("iterateMapKeys", validators.DefaultFlags, funcName).
+							WithComment("iterate the map and call the key type's validation function"))
+					if err != nil {
+						return fmt.Errorf("generating map key iteration: %w", err)
+					} else {
+						child.fieldKeyIterations.Add(v)
+					}
+				}
+			}
+			// Validate each value of a map field.
+			if elemNode := td.resolveFieldElemNode(child, childType.Elem); elemNode == nil {
+				if !child.fieldValidations.OpaqueValType {
+					return fmt.Errorf("%v: value type %v is in a non-included package; "+
+						"either add this package to validation-gen's --readonly-pkg flag, "+
+						"or add +k8s:eachVal=+k8s:opaqueType to the field to skip validation",
+						childPath, childType.Elem.String())
+				}
+			} else if child.fieldValidations.OpaqueValType {
+				// If the field is marked as opaque, we can treat it as it is
+				// were in a non-included package.
+			} else {
+				// If the map's value type is a named type, call the validation
+				// function for each element.
+				if funcName := elemNode.funcName; funcName.Name != "" {
+					// Save the iteration validation while we have all the
+					// information we need. Later we can check if we
+					// actually need it.
+					//
+					// Note: the first argument to Function() is really
+					// only for debugging.
+					v, err := validators.ForEachVal(childPath, childType,
+						validators.Function("iterateMapValues", validators.DefaultFlags, funcName).
+							WithComment("iterate the map and call the value type's validation function"))
+					if err != nil {
+						return fmt.Errorf("generating map value iteration: %w", err)
+					} else {
+						child.fieldValIterations.Add(v)
+					}
+				}
+			}
+		}
+
+		fields = append(fields, child)
+	}
+
+	for _, child := range fields {
+		// Process deferred validations for the field. Similar to type-level
+		// deferred validations, these are resolved iteratively until no more
+		// deferred validations are produced.
+		deferred := child.fieldValidations.Deferred
+		child.fieldValidations.Deferred = nil
+		depth := 0
+		for len(deferred) > 0 {
+			depth++
+			if depth > 10 {
+				return fmt.Errorf("deferred validation recursion depth exceeded "+
+					"10 for field %s of type %s", child.name, thisNode.valueType.String())
+			}
+			var nextDeferred []validators.DeferredGen
+			for _, def := range deferred {
+				res, err := def.Callback()
+				if err != nil {
+					return fmt.Errorf("deferred validation callback failed for field %s of type %s: %w",
+						child.name, thisNode.valueType.String(), err)
+				}
+				if len(res.Deferred) > 0 {
+					nextDeferred = append(nextDeferred, res.Deferred...)
+					res.Deferred = nil
+				}
+				// Map the resolved validations to the appropriate context:
+				// - ThisContext maps to the field's validations.
+				// - ParentContext maps to the containing type's validations.
+				//   This occurs when a validation specified on a field actually applies to the
+				//   entire struct (e.g., union validations that enforce rules across multiple fields).
+				switch def.Scope {
+				case validators.ThisContext:
+					child.fieldValidations.Add(res)
+				case validators.ParentContext:
+					thisNode.typeValidations.Add(res)
+				default:
+					return fmt.Errorf("unexpected scope %v", def.Scope)
+				}
+			}
+			deferred = nextDeferred
+		}
+	}
+
+	thisNode.fields = fields
+	return nil
+}
+
+// getValidationFunctionName returns a type's validator identity: (input
+// package, Validate_T). Which package a call actually targets is output-
+// dependent, so it's resolved at emit time (resolveFunc), not baked in here.
+//
+// TODO: Currently this is a "blind" call - we hope that the expected function
+// exists, but we don't verify that, and we only emit calls into packages which
+// are being processed by this generator. For cross-package calls we will need
+// to verify the target, either by naming convention + fingerprint or by
+// explicit comment-tags or something.
+func (td *typeDiscoverer) getValidationFunctionName(t *types.Type) (types.Name, bool) {
+	if _, ok := td.inputToCanonicalPkg[t.Name.Package]; !ok {
+		return types.Name{}, false
+	}
+	return types.Name{Package: t.Name.Package, Name: "Validate_" + t.Name.Name}, true
+}
+
+func mkSymbolArgs(c *generator.Context, names []types.Name) generator.Args {
+	args := generator.Args{}
+	for _, name := range names {
+		args[name.Name] = c.Universe.Type(name)
+	}
+	return args
+}
+
+// hasValidations checks whether the given typeNode has any
+// validations, transitively.
+func (g *genValidations) hasValidations(n *typeNode) bool {
+	seen := map[*typeNode]bool{}
+	return g.hasValidationsImpl(n, seen)
+}
+
+// hasValidationsImpl implements hasValidations without risk of infinite
+// recursion.
+func (g *genValidations) hasValidationsImpl(n *typeNode, seen map[*typeNode]bool) bool {
+	if n == nil {
+		return false
+	}
+
+	if seen[n] {
+		return false
+	}
+	seen[n] = true
+
+	if n.typeValidations.HasEmitable() {
+		return true
+	}
+
+	if n.typeValidations.OpaqueType {
+		return false
+	}
+
+	if n.underlying != nil {
+		if n.typeKeyIterations.HasEmitable() {
+			if keyNode := n.resolveKeyNode(); keyNode != nil && g.hasValidationsImpl(keyNode, seen) {
+				return true
+			}
+		}
+		if n.typeValIterations.HasEmitable() {
+			if elemNode := n.resolveElemNode(); elemNode != nil && g.hasValidationsImpl(elemNode, seen) {
+				return true
+			}
+		}
+		if g.hasValidationsImpl(n.underlying.node, seen) {
+			return true
+		}
+	}
+
+	for _, c := range n.fields {
+		if c.fieldValidations.HasEmitable() {
+			return true
+		}
+		if c.fieldKeyIterations.HasEmitable() {
+			if keyNode := c.node.resolveKeyNode(); keyNode != nil && g.hasValidationsImpl(keyNode, seen) {
+				return true
+			}
+		}
+		if c.fieldValIterations.HasEmitable() {
+			if elemNode := c.node.resolveElemNode(); elemNode != nil && g.hasValidationsImpl(elemNode, seen) {
+				return true
+			}
+		}
+		if g.hasValidationsImpl(c.node, seen) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// emitRegisterFunction emits the type-registration logic for validation
+// functions.
+func (g *genValidations) emitRegisterFunction(c *generator.Context, schemeRegistry types.Name, sw *generator.SnippetWriter) {
+	var targetTypes []*types.Type
+	for _, rootType := range g.rootTypes {
+		if g.hasValidations(g.discovered.typeNodes[rootType]) {
+			targetTypes = append(targetTypes, rootType)
+		}
+	}
+	if len(targetTypes) == 0 {
+		return
+	}
+
+	scheme := c.Universe.Type(schemeRegistry)
+	schemePtr := &types.Type{
+		Kind: types.Pointer,
+		Elem: scheme,
+	}
+
+	sw.Do("func init() { localSchemeBuilder.Register(RegisterValidations)}\n\n", nil)
+
+	sw.Do("// RegisterValidations adds validation functions to the given scheme.\n", nil)
+	sw.Do("// Public to allow building arbitrary schemes.\n", nil)
+	sw.Do("func RegisterValidations(scheme $.|raw$) error {\n", schemePtr)
+	for _, rootType := range targetTypes {
+		node := g.discovered.typeNodes[rootType]
+		if node == nil {
+			panic(fmt.Sprintf("found nil node for root-type %v", rootType))
+		}
+
+		targs := generator.Args{
+			"rootType":  rootType,
+			"typePfx":   "",
+			"field":     mkSymbolArgs(c, fieldPkgSymbols),
+			"fmt":       mkSymbolArgs(c, fmtPkgSymbols),
+			"operation": mkSymbolArgs(c, operationPkgSymbols),
+			"safe":      mkSymbolArgs(c, safePkgSymbols),
+			"context":   mkSymbolArgs(c, contextPkgSymbols),
+		}
+		if !util.IsNilableType(rootType) {
+			targs["typePfx"] = "*"
+		}
+
+		// This uses a typed nil pointer, rather than a real instance because
+		// we need the type information, but not an instance of the type.
+		sw.Do("// type $.rootType|name$\n", targs)
+		sw.Do("scheme.AddValidationFunc(\n", targs)
+		sw.Do("    ($.typePfx$$.rootType|raw$)(nil),\n", targs)
+		sw.Do("    func(ctx $.context.Context$, op $.operation.Operation|raw$, obj, oldObj interface{}) $.field.ErrorList|raw$ {\n", targs)
+
+		sw.Do("switch op.Request.SubresourcePath() {\n", nil)
+		sw.Do("case ", nil)
+		for i, s := range g.toResourceList(rootType) {
+			if i > 0 {
+				sw.Do(", ", nil)
+			}
+			sw.Do("$.$", s)
+		}
+		sw.Do(":\n", nil)
+		sw.Do("    return $.rootType|objectvalidationfn$(\n", targs)
+		sw.Do("               ctx, ", targs)
+		sw.Do("               op, ", targs)
+		sw.Do("               nil /* fldPath */,\n", targs)
+		sw.Do("               obj.($.typePfx$$.rootType|raw$),\n", targs)
+		sw.Do("               $.safe.Cast|raw$[$.typePfx$$.rootType|raw$](oldObj))\n", targs)
+		sw.Do("  }\n", targs)
+		sw.Do("  return $.field.ErrorList|raw${\n", targs)
+		sw.Do("      $.field.InternalError|raw$(", targs)
+		sw.Do("          nil, ", targs)
+		sw.Do("          $.fmt.Errorf|raw$(\"no validation found for %T, subresource: %v\", obj, op.Request.SubresourcePath())),\n", targs)
+		sw.Do("  }\n", targs)
+		sw.Do("})\n", targs)
+	}
+	sw.Do("return nil\n", nil)
+	sw.Do("}\n\n", nil)
+}
+
+// toResourceList returns a list of resources that are supported by a kind.
+func (g *genValidations) toResourceList(rootType *types.Type) []string {
+	supportedSubresources := supportedSubresourceTags(rootType)
+
+	if subresource, isSubresource := isSubresourceTag(rootType); isSubresource {
+		supportedSubresources.Insert(subresource)
+	} else {
+		supportedSubresources.Insert("/")
+	}
+	supported := supportedSubresources.UnsortedList()
+	slices.Sort(supported)
+	for i, subresource := range supported {
+		supported[i] = strconv.Quote(subresource)
+	}
+	return supported
+}
+
+// emitValidationFunction emits a validation function for the specified type.
+func (g *genValidations) emitValidationFunction(c *generator.Context, t *types.Type, sw *generator.SnippetWriter) {
+	if !g.hasValidations(g.discovered.typeNodes[t]) {
+		return
+	}
+
+	targs := generator.Args{
+		"inType":     t,
+		"field":      mkSymbolArgs(c, fieldPkgSymbols),
+		"operation":  mkSymbolArgs(c, operationPkgSymbols),
+		"context":    mkSymbolArgs(c, contextPkgSymbols),
+		"objTypePfx": "*",
+	}
+	if util.IsNilableType(t) {
+		targs["objTypePfx"] = ""
+	}
+
+	node := g.discovered.typeNodes[t]
+	if node == nil {
+		panic(fmt.Sprintf("found nil node for root-type %v", t))
+	}
+	sw.Do("// $.inType|objectvalidationfn$ validates an instance of $.inType|name$ according\n", targs)
+	sw.Do("// to declarative validation rules in the API schema.\n", targs)
+	sw.Do("func $.inType|objectvalidationfn$(\n", targs)
+	sw.Do("    ctx $.context.Context|raw$, ", targs)
+	sw.Do("    op $.operation.Operation|raw$, ", targs)
+	sw.Do("    fldPath *$.field.Path|raw$,\n", targs)
+	sw.Do("    obj, oldObj $.objTypePfx$$.inType|raw$) ", targs)
+	sw.Do("(errs $.field.ErrorList|raw$) {\n\n", targs)
+	fakeChild := &childNode{
+		node:      node,
+		childType: t,
+	}
+	g.emitValidationForChild(c, fakeChild, sw)
+	sw.Do("return errs\n", nil)
+	sw.Do("}\n\n", nil)
+}
+
+// emitValidationForChild emits code for the specified childNode, calling
+// type-attached validations and then descending into the type (e.g. struct
+// fields).
+//
+// Emitted code assumes that the value in question is always a pair of nilable
+// variables named "obj" and "oldObj", and the field path to this value is
+// named "fldPath".
+//
+// This function assumes that thisChild.node is not nil.
+func (g *genValidations) emitValidationForChild(c *generator.Context, thisChild *childNode, sw *generator.SnippetWriter) {
+	thisNode := thisChild.node
+	inType := thisNode.valueType
+
+	targs := generator.Args{
+		"inType": inType,
+		"field":  mkSymbolArgs(c, fieldPkgSymbols),
+		"safe":   mkSymbolArgs(c, safePkgSymbols),
+	}
+
+	didSome := false // for prettier output later
+
+	// Emit code for type-attached validations.
+	if validations := thisNode.typeValidations; !validations.Empty() {
+		switch thisNode.valueType.Kind {
+		case types.Struct, types.Alias: // OK
+		default:
+			panic(fmt.Sprintf("unexpected type-validations on type %v, kind %s", thisNode.valueType, thisNode.valueType.Kind))
+		}
+		emitComments(validations.Comments, sw)
+		g.emitCallsToValidators(c, validations.Functions, sw)
+		sw.Do("\n", nil)
+		didSome = true
+	}
+
+	if validations := thisNode.typeKeyIterations; !validations.Empty() {
+		keyNode := thisNode.resolveKeyNode()
+		if keyNode != nil && g.hasValidations(keyNode) {
+			emitComments(validations.Comments, sw)
+			g.emitCallsToValidators(c, validations.Functions, sw)
+			sw.Do("\n", nil)
+			didSome = true
+		}
+	}
+
+	if validations := thisNode.typeValIterations; !validations.Empty() {
+		elemNode := thisNode.resolveElemNode()
+		if elemNode != nil && g.hasValidations(elemNode) {
+			emitComments(validations.Comments, sw)
+			g.emitCallsToValidators(c, validations.Functions, sw)
+			sw.Do("\n", nil)
+			didSome = true
+		}
+	}
+
+	if thisNode.typeValidations.OpaqueType {
+		return
+	}
+
+	// Descend into the type.
+	switch inType.Kind {
+	case types.Builtin:
+		// Nothing further.
+	case types.Slice:
+		// Nothing further
+	case types.Map:
+		// Nothing further
+	case types.Alias:
+		g.emitValidationForChild(c, thisNode.underlying, sw)
+	case types.Struct:
+		for _, fld := range thisNode.fields {
+			if len(fld.name) == 0 {
+				panic(fmt.Sprintf("missing field name in type %s (field-type %s)", thisNode.valueType, fld.childType))
+			}
+			// Missing JSON name is checked iff we have code to emit.
+
+			// Accumulate into a buffer so we don't emit empty functions.
+			buf := bytes.NewBuffer(nil)
+			bufsw := sw.Dup(buf)
+
+			// On ratcheting checks:
+			//
+			// We emit ratcheting checks ONLY for struct fields and ONLY when
+			// that field has some validations to call.
+			//
+			// We DO NOT emit ratchet checks inside type-specific validation
+			// functions, because that leads to repeated ratchet checking which
+			// is almost never useful work (keep reading).
+			//
+			// The consequence of this is that a caller of a type's validation
+			// function is assumed to have already done a ratchet check (which
+			// is true for all generated code (except root types, keep
+			// reading)). For struct types (our most common case), the type's
+			// function will do ratchet checks on each sub-field anyway.
+			//
+			// This leaves one case where validation is executed unilaterally:
+			// non-pre-checked calls of validation functions for types which have
+			// type-attached validations.  This can happen in two cases:
+			//   1. an external caller of a type's validation function
+			//   2. the generated register function for a package which calls a
+			//      root-type's validation function
+			//
+			// TODO: We are leaving this as a problem for the future. If we
+			// find that we have a root type which has type-attached validation
+			// AND that validation is being ratcheted, then we will need to
+			// address this. Some options:
+			//   1. emit a ratchet check in the package's register function
+			//   2. emit a ratchet check in the type's validation function
+			//      (IFF it has type-attached validation, perhaps only for root
+			//      types)
+			//   3. emit both "safe" (ratchet check the whole object) and
+			//      "fast" (assume the object was already ratchet checked)
+			//      forms of each type's validation function, so that the
+			//      generated code can call the "fast" form while external code
+			//      calls the "safe" form.
+			//   4. implement depth-first traversal of validation, where each
+			//      function returns an additional bool indicating "something
+			//      changed", which gets propagated up the caller to decide if
+			//      it needs to do higher-level validations (e.g. if any field
+			//      in a struct changes, the struct's type-attached validations
+			//      need to be executed, but if no fields changed they can be
+			//      skipped).
+			//
+			// For the same reasons, in the specific case of lists and maps of pointers,
+			// we do not emit nil-checks inside type-specific validation
+			// functions.  If we solve for the duplicative ratcheting, then we
+			// should also solve for nil-checks.
+
+			if nt := util.NativeType(fld.childType); nt.Kind == types.Slice && nt.Elem.Kind == types.Pointer {
+				hasFieldValidations := len(fld.fieldValidations.Functions) > 0
+				hasPropagation := fld.node != nil && g.hasValidations(fld.node)
+				hasKeyIterations := len(fld.fieldKeyIterations.Functions) > 0 && hasPropagation
+				hasValIterations := len(fld.fieldValIterations.Functions) > 0 && hasPropagation
+
+				if hasFieldValidations || hasPropagation || hasKeyIterations || hasValIterations {
+					// Prepend the nil-check so it runs before any other
+					// validations. This is important because the other
+					// validations may assume that the slice has no nil values.
+					nilCheck := validators.PtrSliceNoNils(nt.Elem.Elem.Name)
+					fld.fieldValidations.Functions = append([]validators.FunctionGen{nilCheck}, fld.fieldValidations.Functions...)
+				}
+			} else if nt := util.NativeType(fld.childType); nt.Kind == types.Map && nt.Elem.Kind == types.Pointer {
+				hasFieldValidations := len(fld.fieldValidations.Functions) > 0
+				hasPropagation := fld.node != nil && g.hasValidations(fld.node)
+				hasKeyIterations := len(fld.fieldKeyIterations.Functions) > 0 && hasPropagation
+				hasValIterations := len(fld.fieldValIterations.Functions) > 0 && hasPropagation
+
+				if hasFieldValidations || hasPropagation || hasKeyIterations || hasValIterations {
+					// Prepend the nil-check so it runs before any other
+					// validations. This is important because the other
+					// validations may assume that the map has no nil values.
+					nilCheck := validators.PtrMapNoNils(nt.Key.Name, nt.Elem.Elem.Name)
+					fld.fieldValidations.Functions = append([]validators.FunctionGen{nilCheck}, fld.fieldValidations.Functions...)
+				}
+			}
+
+			validations := fld.fieldValidations
+			fldRatchetingChecked := false
+			if !validations.Empty() {
+				emitComments(validations.Comments, bufsw)
+				if len(validations.Functions) > 0 {
+					g.emitRatchetingCheck(c, fld.childType, bufsw)
+					fldRatchetingChecked = true
+					bufsw.Do("// call field-attached validations\n", nil)
+					g.emitCallsToValidators(c, validations.Functions, bufsw)
+				}
+			}
+
+			// If the node is nil, this must be a type in a package we are not
+			// handling - it's effectively opaque to us.
+			if fld.node != nil {
+				// Get to the real type.
+				switch fld.node.valueType.Kind {
+				case types.Alias, types.Struct:
+					// If this field is another type, we may need to call its
+					// validation function. If it has no validations
+					// (transitively) then we don't need to do anything.
+					if g.hasValidations(fld.node) {
+						if !fldRatchetingChecked {
+							g.emitRatchetingCheck(c, fld.childType, bufsw)
+							fldRatchetingChecked = true
+						}
+						g.emitCallToOtherTypeFunc(c, fld.node, bufsw)
+					}
+				}
+
+				emitIterations := func(iterations validators.Validations, node *typeNode) {
+					if iterations.Empty() {
+						return
+					}
+					if node != nil && g.hasValidations(node) {
+						emitComments(iterations.Comments, bufsw)
+						if len(iterations.Functions) > 0 {
+							if !fldRatchetingChecked {
+								g.emitRatchetingCheck(c, fld.childType, bufsw)
+								fldRatchetingChecked = true
+							}
+							g.emitCallsToValidators(c, iterations.Functions, bufsw)
+						}
+					}
+				}
+
+				emitIterations(fld.fieldKeyIterations, fld.node.resolveKeyNode())
+				emitIterations(fld.fieldValIterations, fld.node.resolveElemNode())
+
+				if fld.node.valueType.Kind == types.Slice || fld.node.valueType.Kind == types.Map {
+					// Descend into this field.
+					g.emitValidationForChild(c, fld, bufsw)
+				}
+			}
+
+			if buf.Len() > 0 {
+				leafType, typePfx, exprPfx := getLeafTypeAndPrefixes(fld.childType)
+				targs := targs.WithArgs(generator.Args{
+					"fieldName":    fld.name,
+					"fieldJSON":    fld.jsonName,
+					"fieldType":    leafType,
+					"fieldTypePfx": typePfx,
+					"fieldExprPfx": exprPfx,
+				})
+
+				if didSome {
+					sw.Do("\n", nil)
+				}
+				sw.Do("{ // field $.inType|raw$.$.fieldName$\n", targs)
+				sw.Do("    fn := func(\n", targs)
+				sw.Do("        fldPath *$.field.Path|raw$,\n", targs)
+				sw.Do("        obj, oldObj $.fieldTypePfx$$.fieldType|raw$,\n", targs)
+				sw.Do("        oldValueCorrelated bool) (errs $.field.ErrorList|raw$) {\n", targs)
+				if err := sw.Merge(buf, bufsw); err != nil {
+					panic(fmt.Sprintf("failed to merge buffer: %v", err))
+				}
+				sw.Do("            return\n", targs)
+				sw.Do("    }\n", targs)
+				// safe.Field returns a nil if the old object does not have a correlatable
+				// value, such as a map.
+				// This is ambiguous with the case where the field exists and is nil.
+				// This ambiguity is a problem for ratcheting, which needs to distinguish
+				// these cases. For example, if a required field is removed from a map,
+				// safe.Field will return nil for the old value, and the new value is also
+				// nil (because it doesn't exist). Ratcheting would normally allow this,
+				// but it's a validation failure because a required field is missing.
+				//
+				// To solve this, we pass an extra boolean parameter to the validation
+				// function, indicating whether the old value was correlated. If the old
+				// value was uncorrelated, it means the field was not present in the old
+				// object, and we should not apply ratcheting logic. `oldObj != nil`
+				// provides this bit of information.
+				//
+				// This bit is not currently propagated down to deeper levels of
+				// validation, but since the code generator only ever looks one level
+				// down, this is sufficient for now.
+				sw.Do("    oldVal := $.safe.Field|raw$(oldObj,\n", targs)
+				sw.Do("        func(oldObj *$.inType|raw$) $.fieldTypePfx$$.fieldType|raw$ {\n", targs)
+				sw.Do("            return $.fieldExprPfx$oldObj.$.fieldName$\n", targs)
+				sw.Do("        })\n", targs)
+				sw.Do("    errs = append(errs, fn(", targs)
+				if len(fld.jsonName) > 0 {
+					sw.Do("fldPath.Child(\"$.fieldJSON$\"), ", targs)
+				} else {
+					// If there is an embedded field in a root-type, fldPath
+					// will be nil, and we need SOMETHING for the field path.
+					sw.Do("$.safe.Value|raw$(fldPath, func() *$.field.Path|raw$ { return fldPath.Child(\"$.fieldType|raw$\") }), ", targs)
+				}
+				sw.Do("    $.fieldExprPfx$obj.$.fieldName$, oldVal, oldObj != nil)...)\n", targs)
+				sw.Do("}\n", targs)
+				sw.Do("\n", nil)
+			} else {
+				targs := targs.WithArgs(generator.Args{
+					"fieldName": fld.name,
+				})
+				sw.Do("// field $.inType|raw$.$.fieldName$ has no validation\n", targs)
+			}
+			didSome = true
+		}
+	default:
+		panic(fmt.Sprintf("unhandled type: %v (kind %s)", inType, inType.Kind))
+	}
+}
+
+// emitCallToOtherTypeFunc generates a call to the specified node's generated
+// validation function for a field in some parent context.
+//
+// Emitted code assumes that the value in question is always a pair of nilable
+// variables named "obj" and "oldObj", and the field path to this value is
+// named "fldPath".
+func (g *genValidations) emitCallToOtherTypeFunc(c *generator.Context, node *typeNode, sw *generator.SnippetWriter) {
+	targs := generator.Args{
+		"funcName": c.Universe.Type(g.resolveFunc(node.funcName)),
+	}
+	sw.Do("// call the type's validation function\n", nil)
+	sw.Do("errs = append(errs, $.funcName|raw$(ctx, op, fldPath, obj, oldObj)...)\n", targs)
+}
+
+// emitRatchetingCheck emits an equivalence check for default ratcheting.
+func (g *genValidations) emitRatchetingCheck(c *generator.Context, t *types.Type, sw *generator.SnippetWriter) {
+	// Emit equivalence check for default ratcheting.
+	targs := generator.Args{
+		"operation": mkSymbolArgs(c, operationPkgSymbols),
+	}
+	sw.Do("// don't revalidate unchanged data\n", nil)
+	sw.Do("if oldValueCorrelated && op.Type == $.operation.Update|raw$ {\n", targs)
+	// If the type is a builtin, we can use a simpler equality check when they are not nil.
+	if util.IsDirectComparable(util.NonPointer(util.NativeType(t))) {
+		// We should never get anything but pointers here, since every other
+		// nilable type is not Comparable.
+		//
+		// This condition looks overly complex, but each case is needed:
+		// - obj == oldObj : handle pointers which are nil in old and new
+		// - obj != nil : handle optional fields which are updated to nil
+		// - oldObj != nil : handle optional fields which are updated from nil
+		// - *obj == *oldObj : compare values
+		sw.Do("  if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {\n", targs)
+	} else {
+		if g.deepEqualFunc.Package == "" {
+			sw.Do("  if $.$(obj, oldObj) {\n", g.deepEqualFunc.Name)
+		} else {
+			targs["deepEqualFunc"] = c.Universe.Type(g.deepEqualFunc)
+			sw.Do("  if $.deepEqualFunc|raw$(obj, oldObj) {\n", targs)
+		}
+	}
+	sw.Do("    return nil\n", nil)
+	sw.Do("  }\n", nil)
+	sw.Do("}\n", nil)
+}
+
+// emitCallsToValidators emits calls to a list of validation functions for
+// a single field or type. validations is a list of functions to call, with
+// arguments.
+//
+// When calling registered validators, we always pass a nilable type.  E.g. if
+// the field's type is string, we pass *string, and if the field's type is
+// *string, we also pass *string.  This means that validators need to do
+// nil-checks themselves, if they intend to dereference the pointer.  This
+// makes updates more consistent.
+//
+// Emitted code assumes that the value in question is always a pair of nilable
+// variables named "obj" and "oldObj", and the field path to this value is
+// named "fldPath".
+func (g *genValidations) emitCallsToValidators(c *generator.Context, validations []validators.FunctionGen, sw *generator.SnippetWriter) {
+	// Group and sort the inputs.
+	cohorts := sortIntoCohorts(validations)
+
+	for _, validations := range cohorts {
+		cohortName := validations[0].Cohort
+		if cohortName != "" {
+			sw.Do("func() { // cohort = \"$.$\"\n", cohortName)
+		}
+
+		hasShortCircuits := false
+		lastShortCircuitIdx := -1
+		for i, v := range validations {
+			if v.Flags.IsSet(validators.ShortCircuit) {
+				hasShortCircuits = true
+				lastShortCircuitIdx = i
+			}
+		}
+
+		if hasShortCircuits {
+			sw.Do("earlyReturn := false\n", nil)
+		}
+
+		for i, v := range validations {
+			isShortCircuit := v.Flags.IsSet(validators.ShortCircuit)
+			isNonError := v.Flags.IsSet(validators.NonError)
+
+			targs := generator.Args{
+				"funcName": c.Universe.Type(g.resolveFunc(v.Function)),
+				"field":    mkSymbolArgs(c, fieldPkgSymbols),
+				"fmt":      mkSymbolArgs(c, fmtPkgSymbols),
+			}
+
+			emitCall := func() {
+				sw.Do("$.funcName|raw$", targs)
+				if typeArgs := v.TypeArgs; len(typeArgs) > 0 {
+					sw.Do("[", nil)
+					for i, typeArg := range typeArgs {
+						sw.Do("$.|raw$", c.Universe.Type(typeArg))
+						if i < len(typeArgs)-1 {
+							sw.Do(",", nil)
+						}
+					}
+					sw.Do("]", nil)
+				}
+				sw.Do("(ctx, op, fldPath, obj, oldObj", targs)
+				for _, arg := range v.Args {
+					sw.Do(", ", nil)
+					g.toGolangSourceDataLiteral(sw, c, arg, flNewlineOK)
+				}
+				sw.Do(")", targs)
+				switch v.StabilityLevel {
+				case validators.ValidationStabilityLevelAlpha:
+					sw.Do(".MarkAlpha()", nil)
+				case validators.ValidationStabilityLevelBeta:
+					sw.Do(".MarkBeta()", nil)
+				}
+				if isShortCircuit {
+					sw.Do(".MarkShortCircuit()", nil)
+				}
+			}
+
+			// If validation is conditional, wrap the validation function with a conditions check.
+			if !v.Conditions.Empty() {
+				emitBaseFunction := emitCall
+				emitCall = func() {
+					// emitOptionLookup emits "<var>, defined := op.HasOption(<option>)" and
+					// surfaces an undefined option as an internal error.
+					emitOptionLookup := func(varName, option string) {
+						la := generator.Args{"field": targs["field"], "fmt": targs["fmt"], "opt": strconv.Quote(option)}
+						sw.Do("  "+varName+", defined := op.HasOption($.opt$)\n", la)
+						sw.Do("  if !defined {\n", nil)
+						sw.Do("    return $.field.ErrorList|raw${$.field.InternalError|raw$(fldPath, $.fmt.Errorf|raw$(\"undefined validation option %q\", $.opt$))}\n", la)
+						sw.Do("  }\n", nil)
+					}
+					sw.Do("func() $.field.ErrorList|raw$ {\n", targs)
+					if len(v.Conditions.OptionEnabled) > 0 {
+						emitOptionLookup("optionEnabled", v.Conditions.OptionEnabled)
+					}
+					if len(v.Conditions.OptionDisabled) > 0 {
+						emitOptionLookup("optionDisabled", v.Conditions.OptionDisabled)
+					}
+					sw.Do("  if ", nil)
+					firstCondition := true
+					if len(v.Conditions.OptionEnabled) > 0 {
+						sw.Do("optionEnabled", nil)
+						firstCondition = false
+					}
+					if len(v.Conditions.OptionDisabled) > 0 {
+						if !firstCondition {
+							sw.Do(" && ", nil)
+						}
+						sw.Do("!optionDisabled", nil)
+					}
+					sw.Do(" {\n", nil)
+					sw.Do("    return ", nil)
+					emitBaseFunction()
+					sw.Do("\n", nil)
+					sw.Do("  }\n", nil)
+					sw.Do("  return nil // skip validation\n", nil)
+					sw.Do("}()", nil)
+				}
+			}
+
+			for _, comment := range v.Comments {
+				sw.Do("// $.$\n", comment)
+			}
+			if isShortCircuit {
+				sw.Do("if e := ", nil)
+				emitCall()
+				sw.Do("; len(e) != 0 {\n", nil)
+				if !isNonError {
+					sw.Do("  errs = append(errs, e...)\n", nil)
+				}
+				sw.Do("  earlyReturn = true\n", nil)
+				sw.Do("}\n", nil)
+
+				// Check for early return ONLY after the LAST short-circuit
+				if hasShortCircuits && i == lastShortCircuitIdx {
+					sw.Do("if earlyReturn {\n", nil)
+					sw.Do("  return // do not proceed\n", nil)
+					sw.Do("}\n", nil)
+				}
+			} else {
+				if isNonError {
+					emitCall()
+				} else {
+					sw.Do("if e := ", nil)
+					emitCall()
+					sw.Do("; len(e) != 0 {\n", nil)
+					sw.Do("  errs = append(errs, e...)\n", nil)
+					sw.Do("}\n", nil)
+				}
+			}
+		}
+		if cohortName != "" {
+			sw.Do("}()\n", nil)
+		}
+	}
+}
+
+// sortIntoCohorts groups the inputs into a list of cohorts. Within each
+// cohort, function calls are sorted such that short-circuiting function
+// calls are handled before others. The first cohort is always the
+// default cohort (named "") if it exists. Other cohorts are returned in
+// the order they were defined in the input.
+func sortIntoCohorts(in []validators.FunctionGen) [][]validators.FunctionGen {
+	defaultCohort := make([]validators.FunctionGen, 0, len(in))
+	namedCohorts := map[string][]validators.FunctionGen{}
+	idx := make([]string, 0, len(in))
+	for _, fg := range in {
+		key := fg.Cohort
+		if key == "" {
+			defaultCohort = append(defaultCohort, fg)
+		} else {
+			if !slices.Contains(idx, key) {
+				idx = append(idx, key)
+			}
+			namedCohorts[key] = append(namedCohorts[key], fg)
+		}
+	}
+	if len(defaultCohort) > 0 {
+		idx = append([]string{""}, idx...)
+	}
+	// NOTE: we do not sort cohorts by name, because we want to preserve
+	// their definition order.
+
+	result := make([][]validators.FunctionGen, 0, len(in))
+	for _, key := range idx {
+		var cohort []validators.FunctionGen
+		if key == "" {
+			cohort = defaultCohort
+		} else {
+			cohort = namedCohorts[key]
+		}
+
+		sooner := make([]validators.FunctionGen, 0, len(cohort))
+		later := make([]validators.FunctionGen, 0, len(cohort))
+
+		for _, fg := range cohort {
+			isShortCircuit := (fg.Flags.IsSet(validators.ShortCircuit))
+
+			if isShortCircuit {
+				sooner = append(sooner, fg)
+			} else {
+				later = append(later, fg)
+			}
+		}
+		sorted := sooner
+		sorted = append(sorted, later...)
+		result = append(result, sorted)
+	}
+	return result
+}
+
+func emitComments(comments []string, sw *generator.SnippetWriter) {
+	for _, comment := range comments {
+		sw.Do("// ", nil)
+		sw.Do(comment, nil)
+		sw.Do("\n", nil)
+	}
+}
+
+// emitValidationVariables emits a list of variable declarations. Each variable declaration has a
+// private (unexported) variable name, and a function invocation declaration that is expected
+// to initialize the value of the variable.
+func (g *genValidations) emitValidationVariables(c *generator.Context, t *types.Type, sw *generator.SnippetWriter) {
+	tn := g.discovered.typeNodes[t]
+
+	emit := func(variables []validators.VariableGen) {
+		slices.SortFunc(variables, func(a, b validators.VariableGen) int {
+			return cmp.Compare(a.Variable.Name, b.Variable.Name)
+		})
+		for _, variable := range variables {
+			targs := generator.Args{
+				"varName": c.Universe.Type(types.Name(variable.Variable)),
+			}
+
+			sw.Do("var $.varName|private$ = ", targs)
+			g.toGolangSourceDataLiteral(sw, c, variable.Initializer, flNewlineOK)
+			sw.Do("\n", nil)
+		}
+	}
+	// TODO: Handle potential variable name collisions when multiple validators
+	// generate variables with the same name.
+	emit(tn.typeValidations.Variables)
+	for _, field := range tn.fields {
+		if len(field.fieldValidations.Variables) != 0 {
+			emit(field.fieldValidations.Variables)
+		}
+	}
+}
+
+const (
+	// flNewlineOK is a flag indicating that it's acceptable to emit newlines
+	// when rendering a value. This is used for complex literals which may be
+	// more readable with newlines, but should not be used for simple literals
+	// where newlines would be undesirable.
+	flNewlineOK uint64 = 1 << iota
+)
+
+// toGolangSourceDataLiteral renders the given value as a Go literal in the
+// generated source code. The value is expected to be one of a limited set of
+// types (e.g. basic types, types.Type, validators.Identifier, etc.) which are
+// commonly used as arguments to validation functions. The flags parameter can
+// be used to control certain aspects of the rendering.
+func (g *genValidations) toGolangSourceDataLiteral(sw *generator.SnippetWriter, c *generator.Context, value any, flags uint64) {
+	// For safety, be strict in what values we output to visited source, and ensure strings
+	// are quoted.
+
+	switch v := value.(type) {
+	case uint, uint8, uint16, uint32, uint64, int, int8, int16, int32, int64, float32, float64, bool:
+		sw.Do(fmt.Sprintf("%v", value), nil)
+	case string:
+		// If the incoming string was quoted, we still do it ourselves, JIC.
+		str := value.(string)
+		if s, err := strconv.Unquote(str); err == nil {
+			str = s
+		}
+		sw.Do(fmt.Sprintf("%q", str), nil)
+	case *types.Type:
+		sw.Do("$.|raw$", v)
+	case types.Member:
+		sw.Do("obj."+v.Name, nil)
+	case *types.Member:
+		sw.Do("obj."+v.Name, nil)
+	case validators.Identifier:
+		if types.Name(v) == validators.DeepEqualImpl {
+			g.usedDeepEqualImpl = true
+		}
+		if v.Package == "" {
+			sw.Do(v.Name, nil)
+		} else {
+			sw.Do("$.|raw$", c.Universe.Type(types.Name(v)))
+		}
+	case *validators.Identifier:
+		if types.Name(*v) == validators.DeepEqualImpl {
+			g.usedDeepEqualImpl = true
+		}
+		if v.Package == "" {
+			sw.Do(v.Name, nil)
+		} else {
+			sw.Do("$.|raw$", c.Universe.Type(types.Name(*v)))
+		}
+	case validators.PrivateVar:
+		sw.Do("$.|private$", c.Universe.Type(types.Name(v)))
+	case *validators.PrivateVar:
+		sw.Do("$.|private$", c.Universe.Type(types.Name(*v)))
+	case validators.WrapperFunction:
+		if extraArgs := v.Function.Args; len(extraArgs) == 0 {
+			// If the function to be wrapped has no additional arguments, we can
+			// just use it directly.
+			targs := generator.Args{
+				"funcName": c.Universe.Type(g.resolveFunc(v.Function.Function)),
+			}
+			for _, comment := range v.Function.Comments {
+				sw.Do("// $.$\n", comment)
+			}
+			sw.Do("$.funcName|raw$", targs)
+		} else {
+			// If the function to be wrapped has additional arguments, we need
+			// a "standard signature" validation function to wrap it.
+			targs := generator.Args{
+				"field":      mkSymbolArgs(c, fieldPkgSymbols),
+				"operation":  mkSymbolArgs(c, operationPkgSymbols),
+				"context":    mkSymbolArgs(c, contextPkgSymbols),
+				"objType":    v.ObjType,
+				"objTypePfx": "*",
+			}
+			if util.IsNilableType(v.ObjType) {
+				targs["objTypePfx"] = ""
+			}
+
+			if flags&flNewlineOK != 0 {
+				sw.Do("\n", nil)
+			}
+			sw.Do("func(", targs)
+			sw.Do("    ctx $.context.Context|raw$, ", targs)
+			sw.Do("    op $.operation.Operation|raw$, ", targs)
+			sw.Do("    fldPath *$.field.Path|raw$, ", targs)
+			sw.Do("    obj, oldObj $.objTypePfx$$.objType|raw$ ", targs)
+			sw.Do(")    $.field.ErrorList|raw$ {\n", targs)
+			sw.Do("return ", nil)
+			g.emitFunctionCall(sw, c, v.Function, "ctx", "op", "fldPath", "obj", "oldObj")
+			sw.Do("\n}", targs)
+		}
+	case validators.MultiWrapperFunction:
+		// MultiWrapperFunction generates a closure to execute multiple validation functions.
+		targs := generator.Args{
+			"field":      mkSymbolArgs(c, fieldPkgSymbols),
+			"operation":  mkSymbolArgs(c, operationPkgSymbols),
+			"context":    mkSymbolArgs(c, contextPkgSymbols),
+			"objType":    v.ObjType,
+			"objTypePfx": "*",
+		}
+		// Use the nilable form to pass pointers to standard validation functions.
+		if util.IsNilableType(v.ObjType) {
+			targs["objTypePfx"] = ""
+		}
+
+		if flags&flNewlineOK != 0 {
+			sw.Do("\n", nil)
+		}
+		sw.Do("func(", targs)
+		sw.Do("    ctx $.context.Context|raw$, ", targs)
+		sw.Do("    op $.operation.Operation|raw$, ", targs)
+		sw.Do("    fldPath *$.field.Path|raw$, ", targs)
+		sw.Do("    obj, oldObj $.objTypePfx$$.objType|raw$ ", targs)
+		sw.Do(")    $.field.ErrorList|raw$ {\n", targs)
+		sw.Do("errs := $.field.ErrorList|raw${}\n", targs)
+
+		// Determine if any wrapped functions short-circuit.
+		hasShortCircuits := false
+		lastShortCircuitIdx := -1
+		for i, fg := range v.Functions {
+			if fg.Flags.IsSet(validators.ShortCircuit) {
+				hasShortCircuits = true
+				lastShortCircuitIdx = i
+			}
+		}
+		if hasShortCircuits {
+			sw.Do("earlyReturn := false\n", nil)
+		}
+
+		for i, fg := range v.Functions {
+			isNonError := fg.Flags.IsSet(validators.NonError)
+
+			if fg.Flags.IsSet(validators.ShortCircuit) {
+				// Short-circuiting functions stop execution if they return an error.
+				sw.Do("if e := ", nil)
+				g.emitFunctionCall(sw, c, fg, "ctx", "op", "fldPath", "obj", "oldObj")
+				sw.Do("; len(e) != 0 {\n", nil)
+				if !isNonError {
+					sw.Do("  errs = append(errs, e...)\n", nil)
+				}
+				sw.Do("  earlyReturn = true\n", nil)
+				sw.Do("}\n", nil)
+
+				// If a failure occurred during short-circuiting, return early.
+				if i == lastShortCircuitIdx {
+					sw.Do("if earlyReturn {\n", nil)
+					sw.Do("  return errs\n", nil)
+					sw.Do("}\n", nil)
+				}
+			} else {
+				// Standard functions append errors to the list.
+				if isNonError {
+					g.emitFunctionCall(sw, c, fg, "ctx", "op", "fldPath", "obj", "oldObj")
+				} else {
+					sw.Do("errs = append(errs, ", nil)
+					g.emitFunctionCall(sw, c, fg, "ctx", "op", "fldPath", "obj", "oldObj")
+					sw.Do("...)\n", nil)
+				}
+			}
+		}
+		sw.Do("return errs\n}", nil)
+	case validators.Literal:
+		sw.Do("$.$", v)
+	case validators.FunctionGen:
+		for _, comment := range v.Comments {
+			sw.Do("// $.$\\n", comment)
+		}
+		g.emitFunctionCall(sw, c, v)
+	case validators.FunctionLiteral:
+		if flags&flNewlineOK != 0 {
+			sw.Do("\n", nil)
+		}
+		sw.Do("func(", nil)
+		for i, param := range v.Parameters {
+			if i > 0 {
+				sw.Do(", ", nil)
+			}
+			targs := generator.Args{
+				"name": param.Name,
+				"type": param.Type,
+			}
+			sw.Do("$.name$ $.type|raw$", targs)
+		}
+		sw.Do(")", nil)
+		if len(v.Results) > 1 {
+			sw.Do(" (", nil)
+		}
+		for i, ret := range v.Results {
+			if i > 0 {
+				sw.Do(", ", nil)
+			}
+			targs := generator.Args{
+				"name": ret.Name,
+				"type": ret.Type,
+			}
+			sw.Do("$.name$ $.type|raw$", targs)
+		}
+		if len(v.Results) > 1 {
+			sw.Do(")", nil)
+		}
+		sw.Do(" { $.$ }", v.Body)
+	case validators.StructLiteral:
+		targs := generator.Args{
+			"type": c.Universe.Type(v.Type),
+		}
+		if flags&flNewlineOK != 0 {
+			sw.Do("\n", nil)
+		}
+		sw.Do("$.type|raw$", targs)
+		if len(v.TypeArgs) > 0 {
+			sw.Do("[", nil)
+			for i, typeArg := range v.TypeArgs {
+				if i > 0 {
+					sw.Do(", ", nil)
+				}
+				sw.Do("$.|raw$", typeArg)
+			}
+			sw.Do("]", nil)
+		}
+		sw.Do("{", nil)
+		if flags&flNewlineOK != 0 {
+			sw.Do("\n", nil)
+		}
+		for _, f := range v.Fields {
+			sw.Do(f.Name, nil)
+			sw.Do(": ", nil)
+			g.toGolangSourceDataLiteral(sw, c, f.Value, flags)
+			sw.Do(",", nil)
+			if flags&flNewlineOK != 0 {
+				sw.Do("\n", nil)
+			}
+		}
+		sw.Do("}", targs)
+	case validators.SliceLiteral:
+		if flags&flNewlineOK != 0 {
+			sw.Do("\n", nil)
+		}
+		sw.Do("[]", nil)
+		targs := generator.Args{
+			"type": c.Universe.Type(v.ElementType),
+		}
+		sw.Do("$.type|raw$", targs)
+		if len(v.ElementTypeArgs) > 0 {
+			sw.Do("[", nil)
+			for i, typeArg := range v.ElementTypeArgs {
+				if i > 0 {
+					sw.Do(", ", nil)
+				}
+				sw.Do("$.|raw$", typeArg)
+			}
+			sw.Do("]", nil)
+		}
+		sw.Do("{", nil)
+		if flags&flNewlineOK != 0 {
+			sw.Do("\n", nil)
+		}
+		for _, e := range v.Elements {
+			// TODO: slice-of-struct ends up with extra newlines because we
+			// emit one after `{` and `,` plus one before a struct. We
+			// should track "isNewLine" in sw, and instead of unconditionally
+			// adding a newline after each element, call sw.NewLine() which
+			// only adds a newline if the previous write did not end with one.
+			g.toGolangSourceDataLiteral(sw, c, e, flags)
+			sw.Do(",", nil)
+			if flags&flNewlineOK != 0 {
+				sw.Do("\n", nil)
+			}
+		}
+		sw.Do("}", nil)
+	default:
+		rv := reflect.ValueOf(value)
+		switch rv.Kind() {
+		case reflect.Array:
+			arraySize := ""
+			if rv.Kind() == reflect.Array {
+				arraySize = strconv.Itoa(rv.Len())
+			}
+			var itemType string
+			switch rv.Type().Elem().Kind() {
+			case reflect.String: // For now, only support lists of strings.
+				itemType = rv.Type().Elem().Name()
+			default:
+				panic(fmt.Sprintf("Unsupported extraArg type: %T", value))
+			}
+			rv.Type().Elem()
+			sw.Do("[$.arraySize$]$.itemType${", map[string]string{"arraySize": arraySize, "itemType": itemType})
+			for i := range rv.Len() {
+				val := rv.Index(i)
+				g.toGolangSourceDataLiteral(sw, c, val.Interface(), flags)
+				if i < rv.Len()-1 {
+					sw.Do(", ", nil)
+				}
+			}
+			sw.Do("}", nil)
+		default:
+			// TODO: check this during discovery and emit an error with more useful information
+			panic(fmt.Sprintf("Unsupported extraArg type: %T", value))
+		}
+	}
+}
+
+func (g *genValidations) emitFunctionCall(sw *generator.SnippetWriter, c *generator.Context, v validators.FunctionGen, leadingArgs ...string) {
+	targs := generator.Args{
+		"funcName": c.Universe.Type(g.resolveFunc(v.Function)),
+	}
+	sw.Do("$.funcName|raw$", targs)
+	if typeArgs := v.TypeArgs; len(typeArgs) > 0 {
+		sw.Do("[", nil)
+		for i, typeArg := range typeArgs {
+			sw.Do("$.|raw$", c.Universe.Type(typeArg))
+			if i < len(typeArgs)-1 {
+				sw.Do(",", nil)
+			}
+		}
+		sw.Do("]", nil)
+	}
+	sw.Do("(", nil)
+	if len(leadingArgs) > 0 {
+		sw.Do(strings.Join(leadingArgs, ", "), nil)
+	}
+	if len(leadingArgs) > 0 && len(v.Args) > 0 {
+		sw.Do(", ", nil)
+	}
+	for i, arg := range v.Args {
+		if i != 0 {
+			sw.Do(", ", nil)
+		}
+		g.toGolangSourceDataLiteral(sw, c, arg, flNewlineOK)
+	}
+	sw.Do(")", nil)
+	switch v.StabilityLevel {
+	case validators.ValidationStabilityLevelAlpha:
+		sw.Do(".MarkAlpha()", nil)
+	case validators.ValidationStabilityLevelBeta:
+		sw.Do(".MarkBeta()", nil)
+	}
+}
+
+// getLeafTypeAndPrefixes returns the "leaf value type" for a given type, as
+// well as type and expression prefix strings for the input type.  The type
+// prefix can be prepended to the given type's name to produce the nilable form
+// of that type.  The expression prefix can be prepended to a variable of the
+// given type to produce the nilable form of that value.
+//
+// Example: Given an input type "string" this should produce (string, "*", "&").
+// That is to say: the value-type is "string", which yields "*string" when the
+// type prefix is applied, and a variable "x" becomes "&x" when the expression
+// prefix is applied.
+//
+// Example: Given an input type "*string" this should produce (string, "*", "").
+// That is to say: the value-type is "string", which yields "*string" when the
+// type prefix is applied, and a variable "x" remains "x" when the expression
+// prefix is applied.
+func getLeafTypeAndPrefixes(inType *types.Type) (*types.Type, string, string) {
+	leafType := inType
+	typePfx := ""
+	exprPfx := ""
+
+	nPtrs := 0
+	for leafType.Kind == types.Pointer {
+		nPtrs++
+		leafType = leafType.Elem
+	}
+	if !util.IsNilableType(leafType) {
+		typePfx = "*"
+		if nPtrs == 0 {
+			exprPfx = "&"
+		} else {
+			exprPfx = strings.Repeat("*", nPtrs-1)
+		}
+	} else {
+		exprPfx = strings.Repeat("*", nPtrs)
+	}
+
+	return leafType, typePfx, exprPfx
+}
+
+// FixtureTests generates a test file that checks all validateFalse validations.
+func FixtureTests(outputFilename string, testFixtureTags sets.Set[string]) generator.Generator {
+	return &fixtureTestGen{
+		GoGenerator: generator.GoGenerator{
+			OutputFilename: outputFilename,
+		},
+		testFixtureTags: testFixtureTags,
+	}
+}
+
+type fixtureTestGen struct {
+	generator.GoGenerator
+	testFixtureTags sets.Set[string]
+}
+
+func (g *fixtureTestGen) Imports(_ *generator.Context) (imports []string) {
+	return []string{`"testing"`}
+}
+
+func (g *fixtureTestGen) Init(c *generator.Context, w io.Writer) error {
+	if g.testFixtureTags.Has("validateFalse") {
+		sw := generator.NewSnippetWriter(w, c, "$", "$")
+		sw.Do("func TestValidation(t *testing.T) {\n", nil)
+		sw.Do("  localSchemeBuilder.Test(t).ValidateFixtures()\n", nil)
+		sw.Do("}\n", nil)
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validation_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validation_test.go
new file mode 100644
index 0000000000..5d53a9309a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validation_test.go
@@ -0,0 +1,478 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/code-generator/cmd/validation-gen/validators"
+	"k8s.io/gengo/v2/types"
+)
+
+// gengo has `PointerTo()` but not the rest, so keep this here for consistency.
+func ptrTo(t *types.Type) *types.Type {
+	return &types.Type{
+		Name: types.Name{
+			Package: "",
+			Name:    "*" + t.Name.String(),
+		},
+		Kind: types.Pointer,
+		Elem: t,
+	}
+}
+
+func sliceOf(t *types.Type) *types.Type {
+	return &types.Type{
+		Name: types.Name{
+			Package: "",
+			Name:    "[]" + t.Name.String(),
+		},
+		Kind: types.Slice,
+		Elem: t,
+	}
+}
+
+func mapOf(t *types.Type) *types.Type {
+	return &types.Type{
+		Name: types.Name{
+			Package: "",
+			Name:    "map[string]" + t.Name.String(),
+		},
+		Kind: types.Map,
+		Key:  types.String,
+		Elem: t,
+	}
+}
+
+func aliasOf(name string, t *types.Type) *types.Type {
+	return &types.Type{
+		Name: types.Name{
+			Package: "",
+			Name:    "Alias_" + name,
+		},
+		Kind:       types.Alias,
+		Underlying: t,
+	}
+}
+
+func TestGetLeafTypeAndPrefixes(t *testing.T) {
+
+	cases := []struct {
+		in              *types.Type
+		expectedType    *types.Type
+		expectedTypePfx string
+		expectedExprPfx string
+	}{{
+		// string
+		in:              types.String,
+		expectedType:    types.String,
+		expectedTypePfx: "*",
+		expectedExprPfx: "&",
+	}, {
+		// *string
+		in:              ptrTo(types.String),
+		expectedType:    types.String,
+		expectedTypePfx: "*",
+		expectedExprPfx: "",
+	}, {
+		// **string
+		in:              ptrTo(ptrTo(types.String)),
+		expectedType:    types.String,
+		expectedTypePfx: "*",
+		expectedExprPfx: "*",
+	}, {
+		// ***string
+		in:              ptrTo(ptrTo(ptrTo(types.String))),
+		expectedType:    types.String,
+		expectedTypePfx: "*",
+		expectedExprPfx: "**",
+	}, {
+		// []string
+		in:              sliceOf(types.String),
+		expectedType:    sliceOf(types.String),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// *[]string
+		in:              ptrTo(sliceOf(types.String)),
+		expectedType:    sliceOf(types.String),
+		expectedTypePfx: "",
+		expectedExprPfx: "*",
+	}, {
+		// **[]string
+		in:              ptrTo(ptrTo(sliceOf(types.String))),
+		expectedType:    sliceOf(types.String),
+		expectedTypePfx: "",
+		expectedExprPfx: "**",
+	}, {
+		// ***[]string
+		in:              ptrTo(ptrTo(ptrTo(sliceOf(types.String)))),
+		expectedType:    sliceOf(types.String),
+		expectedTypePfx: "",
+		expectedExprPfx: "***",
+	}, {
+		// map[string]string
+		in:              mapOf(types.String),
+		expectedType:    mapOf(types.String),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// *map[string]string
+		in:              ptrTo(mapOf(types.String)),
+		expectedType:    mapOf(types.String),
+		expectedTypePfx: "",
+		expectedExprPfx: "*",
+	}, {
+		// **map[string]string
+		in:              ptrTo(ptrTo(mapOf(types.String))),
+		expectedType:    mapOf(types.String),
+		expectedTypePfx: "",
+		expectedExprPfx: "**",
+	}, {
+		// ***map[string]string
+		in:              ptrTo(ptrTo(ptrTo(mapOf(types.String)))),
+		expectedType:    mapOf(types.String),
+		expectedTypePfx: "",
+		expectedExprPfx: "***",
+	}, {
+		// alias of string
+		in:              aliasOf("s", types.String),
+		expectedType:    aliasOf("s", types.String),
+		expectedTypePfx: "*",
+		expectedExprPfx: "&",
+	}, {
+		// alias of *string
+		in:              aliasOf("ps", ptrTo(types.String)),
+		expectedType:    aliasOf("ps", types.String),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// alias of **string
+		in:              aliasOf("pps", ptrTo(ptrTo(types.String))),
+		expectedType:    aliasOf("pps", types.String),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// alias of ***string
+		in:              aliasOf("ppps", ptrTo(ptrTo(ptrTo(types.String)))),
+		expectedType:    aliasOf("ppps", types.String),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// alias of []string
+		in:              aliasOf("ls", sliceOf(types.String)),
+		expectedType:    aliasOf("ls", sliceOf(types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// alias of *[]string
+		in:              aliasOf("pls", ptrTo(sliceOf(types.String))),
+		expectedType:    aliasOf("pls", sliceOf(types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// alias of **[]string
+		in:              aliasOf("ppls", ptrTo(ptrTo(sliceOf(types.String)))),
+		expectedType:    aliasOf("ppls", sliceOf(types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// alias of ***[]string
+		in:              aliasOf("pppls", ptrTo(ptrTo(ptrTo(sliceOf(types.String))))),
+		expectedType:    aliasOf("pppls", sliceOf(types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// alias of map[string]string
+		in:              aliasOf("ms", mapOf(types.String)),
+		expectedType:    aliasOf("ms", mapOf(types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// alias of *map[string]string
+		in:              aliasOf("pms", ptrTo(mapOf(types.String))),
+		expectedType:    aliasOf("pms", mapOf(types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// alias of **map[string]string
+		in:              aliasOf("ppms", ptrTo(ptrTo(mapOf(types.String)))),
+		expectedType:    aliasOf("ppms", mapOf(types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// alias of ***map[string]string
+		in:              aliasOf("pppms", ptrTo(ptrTo(ptrTo(mapOf(types.String))))),
+		expectedType:    aliasOf("pppms", mapOf(types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// *alias-of-string
+		in:              ptrTo(aliasOf("s", types.String)),
+		expectedType:    aliasOf("s", types.String),
+		expectedTypePfx: "*",
+		expectedExprPfx: "",
+	}, {
+		// **alias-of-string
+		in:              ptrTo(ptrTo(aliasOf("s", types.String))),
+		expectedType:    aliasOf("s", types.String),
+		expectedTypePfx: "*",
+		expectedExprPfx: "*",
+	}, {
+		// ***alias-of-string
+		in:              ptrTo(ptrTo(ptrTo(aliasOf("s", types.String)))),
+		expectedType:    aliasOf("s", types.String),
+		expectedTypePfx: "*",
+		expectedExprPfx: "**",
+	}, {
+		// []alias-of-string
+		in:              sliceOf(aliasOf("s", types.String)),
+		expectedType:    sliceOf(aliasOf("s", types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// *[]alias-of-string
+		in:              ptrTo(sliceOf(aliasOf("s", types.String))),
+		expectedType:    sliceOf(aliasOf("s", types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "*",
+	}, {
+		// **[]alias-of-string
+		in:              ptrTo(ptrTo(sliceOf(aliasOf("s", types.String)))),
+		expectedType:    sliceOf(aliasOf("s", types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "**",
+	}, {
+		// ***[]alias-of-string
+		in:              ptrTo(ptrTo(ptrTo(sliceOf(aliasOf("s", types.String))))),
+		expectedType:    sliceOf(aliasOf("s", types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "***",
+	}, {
+		// map[string]alias-of-string
+		in:              mapOf(aliasOf("s", types.String)),
+		expectedType:    mapOf(aliasOf("s", types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// *map[string]alias-of-string
+		in:              ptrTo(mapOf(aliasOf("s", types.String))),
+		expectedType:    mapOf(aliasOf("s", types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "*",
+	}, {
+		// **map[string]alias-of-string
+		in:              ptrTo(ptrTo(mapOf(aliasOf("s", types.String)))),
+		expectedType:    mapOf(aliasOf("s", types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "**",
+	}, {
+		// ***map[string]alias-of-string
+		in:              ptrTo(ptrTo(ptrTo(mapOf(aliasOf("s", types.String))))),
+		expectedType:    mapOf(aliasOf("s", types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "***",
+	}, {
+		// *alias-of-*string
+		in:              ptrTo(aliasOf("ps", ptrTo(types.String))),
+		expectedType:    aliasOf("ps", ptrTo(types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "*",
+	}, {
+		// **alias-of-*string
+		in:              ptrTo(ptrTo(aliasOf("ps", ptrTo(types.String)))),
+		expectedType:    aliasOf("ps", ptrTo(types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "**",
+	}, {
+		// ***alias-of-*string
+		in:              ptrTo(ptrTo(ptrTo(aliasOf("ps", ptrTo(types.String))))),
+		expectedType:    aliasOf("ps", ptrTo(types.String)),
+		expectedTypePfx: "",
+		expectedExprPfx: "***",
+	}, {
+		// []alias-of-*string
+		in:              sliceOf(aliasOf("ps", ptrTo(types.String))),
+		expectedType:    sliceOf(aliasOf("ps", ptrTo(types.String))),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// *[]alias-of-*string
+		in:              ptrTo(sliceOf(aliasOf("ps", ptrTo(types.String)))),
+		expectedType:    sliceOf(aliasOf("ps", ptrTo(types.String))),
+		expectedTypePfx: "",
+		expectedExprPfx: "*",
+	}, {
+		// **[]alias-of-*string
+		in:              ptrTo(ptrTo(sliceOf(aliasOf("ps", ptrTo(types.String))))),
+		expectedType:    sliceOf(aliasOf("ps", ptrTo(types.String))),
+		expectedTypePfx: "",
+		expectedExprPfx: "**",
+	}, {
+		// ***[]alias-of-*string
+		in:              ptrTo(ptrTo(ptrTo(sliceOf(aliasOf("ps", ptrTo(types.String)))))),
+		expectedType:    sliceOf(aliasOf("ps", ptrTo(types.String))),
+		expectedTypePfx: "",
+		expectedExprPfx: "***",
+	}, {
+		// map[string]alias-of-*string
+		in:              mapOf(aliasOf("ps", ptrTo(types.String))),
+		expectedType:    mapOf(aliasOf("ps", ptrTo(types.String))),
+		expectedTypePfx: "",
+		expectedExprPfx: "",
+	}, {
+		// *map[string]alias-of-*string
+		in:              ptrTo(mapOf(aliasOf("ps", ptrTo(types.String)))),
+		expectedType:    mapOf(aliasOf("ps", ptrTo(types.String))),
+		expectedTypePfx: "",
+		expectedExprPfx: "*",
+	}, {
+		// **map[string]alias-of-*string
+		in:              ptrTo(ptrTo(mapOf(aliasOf("ps", ptrTo(types.String))))),
+		expectedType:    mapOf(aliasOf("ps", ptrTo(types.String))),
+		expectedTypePfx: "",
+		expectedExprPfx: "**",
+	}, {
+		// ***map[string]alias-of-*string
+		in:              ptrTo(ptrTo(ptrTo(mapOf(aliasOf("ps", ptrTo(types.String)))))),
+		expectedType:    mapOf(aliasOf("ps", ptrTo(types.String))),
+		expectedTypePfx: "",
+		expectedExprPfx: "***",
+	}}
+
+	for _, tc := range cases {
+		leafType, typePfx, exprPfx := getLeafTypeAndPrefixes(tc.in)
+		if got, want := leafType.Name.String(), tc.expectedType.Name.String(); got != want {
+			t.Errorf("%q: wrong leaf type: expected %q, got %q", tc.in, want, got)
+		}
+		if got, want := typePfx, tc.expectedTypePfx; got != want {
+			t.Errorf("%q: wrong type prefix: expected %q, got %q", tc.in, want, got)
+		}
+		if got, want := exprPfx, tc.expectedExprPfx; got != want {
+			t.Errorf("%q: wrong expr prefix: expected %q, got %q", tc.in, want, got)
+		}
+	}
+}
+
+func TestSortIntoCohorts(t *testing.T) {
+	cases := []struct {
+		in       []validators.FunctionGen
+		expected [][]validators.FunctionGen
+	}{{
+		// empty
+		in:       []validators.FunctionGen{},
+		expected: [][]validators.FunctionGen{},
+	}, {
+		// default cohort
+		in: []validators.FunctionGen{
+			{TagName: "a", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "b", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "c", Cohort: "", Flags: validators.DefaultFlags},
+		},
+		expected: [][]validators.FunctionGen{{
+			{TagName: "a", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "b", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "c", Cohort: "", Flags: validators.DefaultFlags},
+		}},
+	}, {
+		// default cohort, not already sorted by name
+		in: []validators.FunctionGen{
+			{TagName: "c", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "b", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "a", Cohort: "", Flags: validators.DefaultFlags},
+		},
+		expected: [][]validators.FunctionGen{{
+			{TagName: "c", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "b", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "a", Cohort: "", Flags: validators.DefaultFlags},
+		}},
+	}, {
+		// default cohort, with a short-circuit
+		in: []validators.FunctionGen{
+			{TagName: "a", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "b", Cohort: "", Flags: validators.ShortCircuit},
+			{TagName: "c", Cohort: "", Flags: validators.DefaultFlags},
+		},
+		expected: [][]validators.FunctionGen{{
+			{TagName: "b", Cohort: "", Flags: validators.ShortCircuit},
+			{TagName: "a", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "c", Cohort: "", Flags: validators.DefaultFlags},
+		}},
+	}, {
+		// default cohort, with 2 short-circuits
+		in: []validators.FunctionGen{
+			{TagName: "a", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "b", Cohort: "", Flags: validators.ShortCircuit},
+			{TagName: "c", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "d", Cohort: "", Flags: validators.ShortCircuit},
+		},
+		expected: [][]validators.FunctionGen{{
+			{TagName: "b", Cohort: "", Flags: validators.ShortCircuit},
+			{TagName: "d", Cohort: "", Flags: validators.ShortCircuit},
+			{TagName: "a", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "c", Cohort: "", Flags: validators.DefaultFlags},
+		}},
+	}, {
+		// default and non-default cohorts
+		in: []validators.FunctionGen{
+			{TagName: "a", Cohort: "foo", Flags: validators.DefaultFlags},
+			{TagName: "b", Cohort: "bar", Flags: validators.DefaultFlags},
+			{TagName: "c", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "d", Cohort: "foo", Flags: validators.DefaultFlags},
+			{TagName: "e", Cohort: "bar", Flags: validators.DefaultFlags},
+			{TagName: "f", Cohort: "", Flags: validators.DefaultFlags},
+		},
+		expected: [][]validators.FunctionGen{{
+			{TagName: "c", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "f", Cohort: "", Flags: validators.DefaultFlags},
+		}, {
+			{TagName: "a", Cohort: "foo", Flags: validators.DefaultFlags},
+			{TagName: "d", Cohort: "foo", Flags: validators.DefaultFlags},
+		}, {
+			{TagName: "b", Cohort: "bar", Flags: validators.DefaultFlags},
+			{TagName: "e", Cohort: "bar", Flags: validators.DefaultFlags},
+		}},
+	}, {
+		// default and non-default cohorts with short-circuit
+		in: []validators.FunctionGen{
+			{TagName: "a", Cohort: "foo", Flags: validators.DefaultFlags},
+			{TagName: "b", Cohort: "bar", Flags: validators.DefaultFlags},
+			{TagName: "c", Cohort: "", Flags: validators.DefaultFlags},
+			{TagName: "d", Cohort: "foo", Flags: validators.ShortCircuit},
+			{TagName: "e", Cohort: "bar", Flags: validators.ShortCircuit},
+			{TagName: "f", Cohort: "", Flags: validators.ShortCircuit},
+		},
+		expected: [][]validators.FunctionGen{{
+			{TagName: "f", Cohort: "", Flags: validators.ShortCircuit},
+			{TagName: "c", Cohort: "", Flags: validators.DefaultFlags},
+		}, {
+			{TagName: "d", Cohort: "foo", Flags: validators.ShortCircuit},
+			{TagName: "a", Cohort: "foo", Flags: validators.DefaultFlags},
+		}, {
+			{TagName: "e", Cohort: "bar", Flags: validators.ShortCircuit},
+			{TagName: "b", Cohort: "bar", Flags: validators.DefaultFlags},
+		}},
+	}}
+
+	for _, tc := range cases {
+		out := sortIntoCohorts(tc.in)
+		if !reflect.DeepEqual(out, tc.expected) {
+			t.Errorf("expected %v, got %v", tc.expected, out)
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/common.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/common.go
new file mode 100644
index 0000000000..d19317e564
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/common.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+	"strconv"
+
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	// libValidationPkg is the pkgpath to our "standard library" of validation
+	// functions.
+	libValidationPkg = "k8s.io/apimachinery/pkg/api/validate"
+)
+
+// rootTypeString returns a string representation of the relationship between
+// src and dst types, for use in error messages.
+func rootTypeString(src, dst *types.Type) string {
+	if src == dst {
+		return src.String()
+	}
+	return src.String() + " -> " + dst.String()
+}
+
+// isUnsignedInt returns true if t is an unsigned integer type.
+func isUnsignedInt(t *types.Type) bool {
+	switch t {
+	case types.Uint, types.Uint64, types.Uint32, types.Uint16, types.Byte:
+		return true
+	}
+	return false
+}
+
+// intBitSize returns the bit width of a gengo integer type. For platform-sized
+// types (int, uint), strconv.IntSize is used. Byte maps to 8. Returns an error
+// for any type not in the supported integer set so unrecognized types are
+// caught at codegen time rather than silently falling back.
+func intBitSize(t *types.Type) (int, error) {
+	switch t {
+	case types.Byte: // int8 becomes byte in gengo
+		return 8, nil
+	case types.Int16, types.Uint16:
+		return 16, nil
+	case types.Int32, types.Uint32:
+		return 32, nil
+	case types.Int64, types.Uint64:
+		return 64, nil
+	case types.Int, types.Uint:
+		return strconv.IntSize, nil
+	default:
+		return 0, fmt.Errorf("unsupported integer type: %v", t)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/customvalidation.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/customvalidation.go
new file mode 100644
index 0000000000..f403196820
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/customvalidation.go
@@ -0,0 +1,263 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	customValidationTagName = "k8s:customValidation"
+
+	customValidationFuncPrefix = "ValidateCustom_"
+)
+
+// Fixed types in the custom-validation signature; value/oldValue types vary.
+var (
+	contextType   = types.Name{Package: "context", Name: "Context"}
+	operationType = types.Name{Package: "k8s.io/apimachinery/pkg/api/operation", Name: "Operation"}
+	fieldPathType = types.Name{Package: "k8s.io/apimachinery/pkg/util/validation/field", Name: "Path"}
+	errorListType = types.Name{Package: "k8s.io/apimachinery/pkg/util/validation/field", Name: "ErrorList"}
+)
+
+var customValidationValidator = &customValidationTagValidator{}
+
+func init() {
+	RegisterTagValidator(customValidationValidator)
+}
+
+// customValidationTagValidator wires a hand-written ValidateCustom_* function
+// (in the generated package, found by naming convention) into the generated
+// traversal, so it inherits traversal, ratcheting and short-circuiting.
+type customValidationTagValidator struct {
+	gengoContext        *generator.Context
+	inputToCanonicalPkg map[string]string
+	// claimed records every function a tag wired (directly or via a composing
+	// tag such as ifEnabled), so verifyCustomFunctions can spot ValidateCustom_*
+	// functions defined without a tag.
+	claimed map[types.Name]bool
+}
+
+func (v *customValidationTagValidator) Init(cfg Config) {
+	v.gengoContext = cfg.GengoContext
+	v.inputToCanonicalPkg = cfg.InputToCanonicalPkg
+	v.claimed = map[types.Name]bool{}
+}
+
+func (customValidationTagValidator) TagName() string {
+	return customValidationTagName
+}
+
+var customValidationTagValidScopes = sets.New(ScopeType, ScopeField)
+
+func (customValidationTagValidator) ValidScopes() sets.Set[Scope] {
+	return customValidationTagValidScopes
+}
+
+func (v *customValidationTagValidator) GetValidations(context Context, _ codetags.Tag) (Validations, error) {
+	// Resolve the output package for the type that owns the call site (the type
+	// itself, or the containing struct for a field), as done for Validate_<Type>.
+	definingType := context.Type
+	if context.Scope == ScopeField {
+		definingType = context.ParentType
+	}
+	outPkg, ok := v.inputToCanonicalPkg[definingType.Name.Package]
+	if !ok {
+		return Validations{}, fmt.Errorf("cannot resolve generated package for %s (is it being processed by validation-gen?)", definingType.Name.Package)
+	}
+
+	// Resolve the function name from the naming convention.
+	funcName := customValidationFuncPrefix + definingType.Name.Name
+	if context.Scope == ScopeField {
+		funcName += "_" + context.Member.Name
+	}
+	fn := types.Name{Package: outPkg, Name: funcName}
+
+	// value and oldValue are the nilable form of the validated value, matching
+	// what the generated traversal passes to the function.
+	valueType := context.Type
+	if !util.IsNilableType(valueType) {
+		valueType = types.PointerTo(valueType)
+	}
+
+	// Fail with a clear error if the function is missing or mis-typed, rather
+	// than silently skipping validation or emitting code that won't compile.
+	if err := v.checkFunction(fn, valueType); err != nil {
+		return Validations{}, err
+	}
+	v.claimed[fn] = true
+
+	// Declare no Emission: the generator can't know a hand-written function's
+	// error type or path, so the declarative-validation test generator must not
+	// synthesize a coverage case for it. The runtime call is unaffected.
+	var result Validations
+	result.AddFunction(Function(customValidationTagName, DefaultFlags, fn).WithComment("custom validation"))
+	return result, nil
+}
+
+// VerifyCustomValidationsHaveTags errors for any ValidateCustom_* function that
+// is untagged, or defined in an input package instead of the generated one.
+// Call it after all inputs have been processed.
+func VerifyCustomValidationsHaveTags() error {
+	return customValidationValidator.verifyCustomFunctions()
+}
+
+func (v *customValidationTagValidator) verifyCustomFunctions() error {
+	if v.gengoContext == nil {
+		return nil
+	}
+	var issues []string
+	scanned := map[string]bool{}
+	for inPkg, outPkg := range v.inputToCanonicalPkg {
+		// A ValidateCustom_* function in the input package is misplaced; it must
+		// live in the generated package. (inPkg == outPkg for self-contained
+		// packages, e.g. test fixtures.)
+		if inPkg != outPkg {
+			if pkg := v.gengoContext.Universe[inPkg]; pkg != nil {
+				for name := range pkg.Functions {
+					if strings.HasPrefix(name, customValidationFuncPrefix) {
+						issues = append(issues, fmt.Sprintf("%s.%s: move to the generated package %s", inPkg, name, outPkg))
+					}
+				}
+			}
+		}
+		// A ValidateCustom_* function in the generated package with no tag.
+		if scanned[outPkg] {
+			continue
+		}
+		scanned[outPkg] = true
+		if pkg := v.gengoContext.Universe[outPkg]; pkg != nil {
+			for name := range pkg.Functions {
+				if strings.HasPrefix(name, customValidationFuncPrefix) && !v.claimed[types.Name{Package: outPkg, Name: name}] {
+					issues = append(issues, fmt.Sprintf("%s.%s: no matching tag (add +%s, or rename if not a custom validation)", outPkg, name, customValidationTagName))
+				}
+			}
+		}
+	}
+	if len(issues) > 0 {
+		sort.Strings(issues)
+		return fmt.Errorf("+%s: %s", customValidationTagName, strings.Join(issues, "; "))
+	}
+	return nil
+}
+
+// checkFunction verifies that the referenced hand-written function exists in the
+// universe and has the canonical validator signature for the given value type.
+func (v customValidationTagValidator) checkFunction(fn types.Name, valueType *types.Type) error {
+	if v.gengoContext == nil {
+		return nil // docs/lint path: nothing to verify against.
+	}
+	pkg := v.gengoContext.Universe[fn.Package]
+	if pkg == nil {
+		return fmt.Errorf("+%s: cannot find package %q to verify function %q", customValidationTagName, fn.Package, fn.Name)
+	}
+	f := pkg.Functions[fn.Name]
+	if f == nil {
+		return fmt.Errorf("+%s: expected hand-written function %s.%s was not found", customValidationTagName, fn.Package, fn.Name)
+	}
+	if sig := f.Underlying.Signature; sig == nil || !signatureMatches(sig, valueType) {
+		return fmt.Errorf("+%s: %s.%s must have signature "+
+			"func(ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue %s) field.ErrorList",
+			customValidationTagName, fn.Package, fn.Name, renderType(valueType))
+	}
+	return nil
+}
+
+// signatureMatches reports whether sig is the canonical custom-validation
+// signature for a value of the given type.
+func signatureMatches(sig *types.Signature, valueType *types.Type) bool {
+	if sig.Variadic || len(sig.Parameters) != 5 || len(sig.Results) != 1 {
+		return false
+	}
+	return isType(sig.Parameters[0].Type, contextType) &&
+		isType(sig.Parameters[1].Type, operationType) &&
+		isPointerTo(sig.Parameters[2].Type, fieldPathType) &&
+		sameType(sig.Parameters[3].Type, valueType) &&
+		sameType(sig.Parameters[4].Type, valueType) &&
+		isType(sig.Results[0].Type, errorListType)
+}
+
+func isType(t *types.Type, name types.Name) bool {
+	return t != nil && t.Name == name
+}
+
+func isPointerTo(t *types.Type, name types.Name) bool {
+	return t != nil && t.Kind == types.Pointer && t.Elem != nil && t.Elem.Name == name
+}
+
+// sameType structurally compares two types by kind and (for leaves) name.
+func sameType(a, b *types.Type) bool {
+	if a == nil || b == nil {
+		return a == b
+	}
+	if a.Kind != b.Kind {
+		return false
+	}
+	switch a.Kind {
+	case types.Pointer, types.Slice, types.Array:
+		return sameType(a.Elem, b.Elem)
+	case types.Map:
+		return sameType(a.Key, b.Key) && sameType(a.Elem, b.Elem)
+	default:
+		return a.Name == b.Name
+	}
+}
+
+// renderType formats a type for an error message (e.g. "*Struct", "[]StringType").
+func renderType(t *types.Type) string {
+	if t == nil {
+		return "?"
+	}
+	switch t.Kind {
+	case types.Pointer:
+		return "*" + renderType(t.Elem)
+	case types.Slice, types.Array:
+		return "[]" + renderType(t.Elem)
+	case types.Map:
+		return "map[" + renderType(t.Key) + "]" + renderType(t.Elem)
+	default:
+		return t.Name.Name
+	}
+}
+
+func (v customValidationTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            customValidationTagName,
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(customValidationTagValidScopes),
+		Description:    "Calls a hand-written validation function from the generated traversal code.",
+		Docs: "The function lives in the generated package, with signature " +
+			"func(context.Context, operation.Operation, *field.Path, value, oldValue <ValueType>) field.ErrorList, " +
+			"where <ValueType> is the validated value's type made nilable: a pointer (e.g. *string), or the " +
+			"type itself if already nilable (slice, map, pointer). In the function name, <Type> and <Field> " +
+			"are Go identifiers (e.g. Replicas, not the JSON name replicas). " +
+			"Field scope (ValidateCustom_<Type>_<Field>) validates one field; on update the framework skips " +
+			"the call when that field is unchanged. Type scope (ValidateCustom_<Type>) is for checks across " +
+			"multiple fields; the framework does not skip it on update, so an expensive check should return " +
+			"early when value and oldValue are equal. " +
+			"For per-element checks, put the tag on the element type, or use field scope and loop inside the " +
+			"function.",
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/dependentrequired.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/dependentrequired.go
new file mode 100644
index 0000000000..89c01237c1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/dependentrequired.go
@@ -0,0 +1,177 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/parser/tags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	dependentRequiredTagName  = "k8s:dependentRequired"
+	dependentForbiddenTagName = "k8s:dependentForbidden"
+)
+
+var (
+	dependentRequiredValidator  = types.Name{Package: libValidationPkg, Name: "DependentRequired"}
+	dependentForbiddenValidator = types.Name{Package: libValidationPkg, Name: "DependentForbidden"}
+)
+
+func init() {
+	RegisterTagValidator(dependencyTagValidator{dependencyRequired})
+	RegisterTagValidator(dependencyTagValidator{dependencyForbidden})
+}
+
+// dependencyTagValidator implements conditional set-ness dependencies between
+// sibling fields: when the tagged (trigger) field is set, a named sibling must
+// also be set (required mode) or must not be set (forbidden mode).
+type dependencyTagValidator struct {
+	mode dependencyMode
+}
+
+type dependencyMode string
+
+const (
+	dependencyRequired  dependencyMode = dependentRequiredTagName
+	dependencyForbidden dependencyMode = dependentForbiddenTagName
+)
+
+func (dependencyTagValidator) Init(_ Config) {}
+
+func (dtv dependencyTagValidator) TagName() string {
+	return string(dtv.mode)
+}
+
+var dependencyTagValidScopes = sets.New(ScopeField)
+
+func (dependencyTagValidator) ValidScopes() sets.Set[Scope] {
+	return dependencyTagValidScopes
+}
+
+func (dtv dependencyTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	if context.Member == nil {
+		return Validations{}, fmt.Errorf("must be used on a struct field")
+	}
+
+	parentType := util.NonPointer(util.NativeType(context.ParentType))
+	if parentType.Kind != types.Struct {
+		return Validations{}, fmt.Errorf("parent type must be a struct (got %s)", parentType.Kind)
+	}
+
+	if len(tag.Args) != 1 {
+		return Validations{}, fmt.Errorf("expected exactly one argument naming the dependent field, got %d", len(tag.Args))
+	}
+	dependentJSONName := tag.Args[0].Value
+
+	dependentMember := util.GetMemberByJSON(parentType, dependentJSONName)
+	if dependentMember == nil {
+		return Validations{}, fmt.Errorf("no sibling field with JSON name %q", dependentJSONName)
+	}
+	if dependentMember.Name == context.Member.Name {
+		return Validations{}, fmt.Errorf("trigger and dependent field must be different (both are %q)", dependentJSONName)
+	}
+
+	triggerJSONTag, ok := tags.LookupJSON(*context.Member)
+	if !ok || triggerJSONTag.Name == "" {
+		return Validations{}, fmt.Errorf("trigger field %q has no JSON name", context.Member.Name)
+	}
+	triggerJSONName := triggerJSONTag.Name
+
+	// "Is set" has an obvious meaning for these kinds: pointer non-nil,
+	// slice/map non-empty, builtin non-zero. We don't restrict what a
+	// pointer points to — in practice it's a builtin or a struct.
+	for _, m := range []struct {
+		role   string
+		member *types.Member
+	}{{"trigger", context.Member}, {"dependent", dependentMember}} {
+		nt := util.NativeType(m.member.Type)
+		switch nt.Kind {
+		case types.Pointer, types.Map, types.Slice, types.Builtin:
+		default:
+			return Validations{}, fmt.Errorf("%s field %q has unsupported type kind %s",
+				m.role, m.member.Name, nt.Kind)
+		}
+	}
+
+	tagName := string(dtv.mode)
+	var validator types.Name
+	var emitType field.ErrorType
+	var origin string
+	switch dtv.mode {
+	case dependencyRequired:
+		validator, emitType, origin = dependentRequiredValidator, field.ErrorTypeRequired, "dependentRequired"
+	case dependencyForbidden:
+		validator, emitType, origin = dependentForbiddenValidator, field.ErrorTypeForbidden, "dependentForbidden"
+	default:
+		panic(fmt.Sprintf("unknown dependency mode: %q", dtv.mode))
+	}
+
+	ptrType := types.PointerTo(context.ParentType)
+	triggerExtractor := createMemberExtractor(ptrType, context.Member)
+	dependentExtractor := createMemberExtractor(ptrType, dependentMember)
+
+	// Emit at the parent — the check needs both sibling fields.
+	return Validations{
+		Deferred: []DeferredGen{
+			Deferred(ParentContext, func() (Validations, error) {
+				fn := Function(tagName, DefaultFlags, validator,
+					triggerJSONName, triggerExtractor,
+					dependentJSONName, dependentExtractor,
+				).WithEmits(Emission{
+					Type:         emitType,
+					Origin:       origin,
+					PathFragment: "." + dependentJSONName,
+				})
+				return Validations{Functions: []FunctionGen{fn}}, nil
+			}),
+		},
+	}, nil
+}
+
+func (dtv dependencyTagValidator) Docs() TagDoc {
+	doc := TagDoc{
+		Tag:            dtv.TagName(),
+		StabilityLevel: TagStabilityLevelAlpha,
+		Scopes:         sets.List(dtv.ValidScopes()),
+		Args: []TagArgDoc{{
+			Description: "<sibling-field-json-name>",
+			Type:        codetags.ArgTypeString,
+			Required:    true,
+		}},
+	}
+	switch dtv.mode {
+	case dependencyRequired:
+		doc.Description = "Indicates that when this field is set, the named sibling field must also be set."
+		doc.Docs = "When the tagged field is set (non-nil pointer, non-empty slice/map, or non-zero " +
+			"builtin), the named sibling must also be set. Dependencies are one-directional. " +
+			"Repeat the tag to require multiple siblings."
+	case dependencyForbidden:
+		doc.Description = "Indicates that when this field is set, the named sibling field must not be set."
+		doc.Docs = "When the tagged field is set (non-nil pointer, non-empty slice/map, or non-zero " +
+			"builtin), the named sibling must not be set. Dependencies are one-directional. " +
+			"Repeat the tag to forbid multiple siblings."
+	default:
+		panic(fmt.Sprintf("unknown dependency mode: %q", dtv.mode))
+	}
+	return doc
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/each.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/each.go
new file mode 100644
index 0000000000..75709c87d3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/each.go
@@ -0,0 +1,410 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	eachValTagName = "k8s:eachVal"
+	eachKeyTagName = "k8s:eachKey"
+)
+
+// We keep the eachVal and eachKey validators around because the main
+// code-generation logic calls them directly.  We could move them into the main
+// pkg, but it's easier and cleaner to leave them here.
+var globalEachVal *eachValTagValidator
+var globalEachKey *eachKeyTagValidator
+
+func init() {
+	// Iterating values of lists and maps is a special tag, which can be called
+	// directly by the code-generator logic.
+	globalEachVal = &eachValTagValidator{byPath: globalListMeta, validator: nil}
+	RegisterTagValidator(globalEachVal)
+
+	// Iterating keys of maps is a special tag, which can be called directly by
+	// the code-generator logic.
+	globalEachKey = &eachKeyTagValidator{validator: nil}
+	RegisterTagValidator(globalEachKey)
+}
+
+type eachValTagValidator struct {
+	byPath    map[string]*listMetadata
+	validator TagValidationExtractor
+}
+
+func (evtv *eachValTagValidator) Init(cfg Config) {
+	evtv.validator = cfg.TagValidator
+}
+
+func (eachValTagValidator) TagName() string {
+	return eachValTagName
+}
+
+func (eachValTagValidator) ValidScopes() sets.Set[Scope] {
+	return listTagsValidScopes
+}
+
+var (
+	validateEachValSliceVal = types.Name{Package: libValidationPkg, Name: "EachValSliceVal"}
+	validateEachPtrSliceVal = types.Name{Package: libValidationPkg, Name: "EachPtrSliceVal"}
+	validateEachMapVal      = types.Name{Package: libValidationPkg, Name: "EachMapVal"}
+	validateEachPtrMapVal   = types.Name{Package: libValidationPkg, Name: "EachPtrMapVal"}
+)
+
+func (evtv eachValTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	// NOTE: pointers to lists and maps are not supported, so we should never see a pointer here.
+	t := context.Type
+	nt := util.NativeType(t)
+	switch nt.Kind {
+	case types.Slice, types.Array, types.Map:
+	default:
+		return Validations{}, fmt.Errorf("can only be used on list or map types (%s)", nt.Kind)
+	}
+
+	elemContext := Context{
+		// Scope is initialized below.
+		Type:           nt.Elem,
+		Path:           context.Path.Key("(vals)"),
+		Member:         nil, // NA for list/map values
+		ParentPath:     context.Path,
+		ParentType:     context.Type,
+		StabilityLevel: context.StabilityLevel,
+	}
+	switch nt.Kind {
+	case types.Slice, types.Array:
+		elemContext.Scope = ScopeListVal
+		elemContext.ListSelector = []ListSelectorTerm{} // empty == "all"
+	case types.Map:
+		elemContext.Scope = ScopeMapVal
+		// TODO: We may need map selectors at some point.
+	}
+	if tag.ValueTag == nil {
+		return Validations{}, fmt.Errorf("missing validation tag")
+	}
+
+	validations, err := evtv.validator.ExtractTagValidations(elemContext, *tag.ValueTag)
+	if err != nil {
+		return Validations{}, err
+	}
+
+	if len(validations.Variables) > 0 {
+		return Validations{}, fmt.Errorf("variable generation is not supported")
+	}
+
+	result := Validations{
+		OpaqueValType: validations.OpaqueType, // Map element opacity to collection value opacity
+	}
+	result.Comments = append(result.Comments, validations.Comments...)
+
+	if len(validations.Functions) > 0 {
+		// We defer this because we want listType and listMapKey to compute list keys first.
+		result.AddDeferred(Deferred(ThisContext, func() (Validations, error) {
+			return evtv.getValidations(context.Path, t, Validations{Functions: validations.Functions})
+		}))
+	}
+
+	if len(validations.Deferred) > 0 {
+		result.AddDeferred(Deferred(ThisContext, func() (Validations, error) {
+			resolved := Validations{}
+			for _, d := range validations.Deferred {
+				inner, err := d.Callback()
+				if err != nil {
+					return Validations{}, err
+				}
+				resolved.Add(inner)
+			}
+			return evtv.getValidations(context.Path, t, resolved)
+		}))
+	}
+
+	if result.Empty() {
+		return Validations{}, fmt.Errorf("no validation functions found")
+	}
+
+	return result, nil
+}
+
+// t is expected to be the top-most type of the list or map. For example, if
+// this is a typedef to a list, this is the alias type, not the underlying
+// type.
+func (evtv eachValTagValidator) getValidations(fldPath *field.Path, t *types.Type, validations Validations) (Validations, error) {
+	switch util.NativeType(t).Kind {
+	case types.Slice, types.Array:
+		return evtv.getListValidations(fldPath, t, validations)
+	case types.Map:
+		return evtv.getMapValidations(t, validations)
+	}
+	return Validations{}, fmt.Errorf("non-iterable type: %v", t)
+}
+
+// ForEachVal returns a validation that applies a function to each element of
+// a list or map. The type argument is expected to be the top-most type of the
+// list or map. For example, if this is a typedef to a list, this is the alias
+// type, not the underlying type.
+func ForEachVal(fldPath *field.Path, t *types.Type, fn FunctionGen) (Validations, error) {
+	return globalEachVal.getValidations(fldPath, t, Validations{Functions: []FunctionGen{fn}})
+}
+
+// t is expected to be the top-most type of the list. For example, if this is a
+// typedef to a list, this is the alias type, not the underlying type.
+func (evtv eachValTagValidator) getListValidations(fldPath *field.Path, t *types.Type, validations Validations) (Validations, error) {
+	listMetadata := evtv.byPath[fldPath.String()]
+	if listMetadata == nil {
+		// If we don't have metadata for this field, we might have it for the
+		// field's type.
+		listMetadata = evtv.byPath[t.String()]
+	}
+
+	nt := util.NativeType(t)
+
+	// matchArg is the function that is used to lookup the correlated element in the old list.
+	var matchArg any = Literal("nil")
+
+	// equivArg is the function that is used to compare the correlated elements in the old and new lists.
+	// It would be "nil" if the matchArg is a full comparison function.
+	var equivArg any = Literal("nil")
+
+	// directComparable is used to determine whether we can use the direct
+	// comparison operator "==" or need to use the semantic DeepEqual when
+	// looking up and comparing correlated list elements for validation ratcheting.
+	directComparable := util.IsDirectComparable(util.NonPointer(util.NativeType(nt.Elem)))
+
+	if listMetadata != nil {
+		switch listMetadata.semantic {
+		case semanticMap:
+			// For listType=map, we use key to lookup the correlated element in the old list.
+			// And use equivFunc to compare the correlated elements in the old and new lists.
+			matchArg = listMetadata.makeListMapMatchFunc(nt.Elem)
+			if directComparable {
+				equivArg = Identifier(validateDirectEqual)
+			} else {
+				equivArg = Identifier(validateSemanticDeepEqual)
+			}
+		case semanticSet:
+			// For listType=set, matchArg is the equivalence check, so equivArg is nil.
+			if directComparable {
+				matchArg = Identifier(validateDirectEqual)
+			} else {
+				matchArg = Identifier(validateSemanticDeepEqual)
+			}
+		default:
+			// For non-map and non-set list, we don't lookup the correlated element in the old list.
+			// The matchArg and equivArg are both nil.
+		}
+	}
+
+	validateFunc := validateEachValSliceVal
+	if nt.Elem.Kind == types.Pointer {
+		validateFunc = validateEachPtrSliceVal
+	}
+
+	wrapped := WrapFunctions(validations, func(vfn FunctionGen, _ DeferredScope) FunctionGen {
+		comm := vfn.Comments
+		vfn.Comments = nil
+		return Function(eachValTagName, vfn.Flags, validateFunc, matchArg, equivArg, WrapperFunction{Function: vfn, ObjType: nt.Elem, PathFragment: "[*]"}).WithComments(comm...)
+	})
+	// Only Functions/Deferred carry forward; element opacity becomes value opacity.
+	return Validations{
+		Functions:     wrapped.Functions,
+		Deferred:      wrapped.Deferred,
+		OpaqueValType: validations.OpaqueType,
+	}, nil
+}
+
+// t is expected to be the top-most type of the map. For example, if this is a
+// typedef to a map, this is the alias type, not the underlying type.
+func (evtv eachValTagValidator) getMapValidations(t *types.Type, validations Validations) (Validations, error) {
+	nt := util.NativeType(t)
+	equivArg := Identifier(validateSemanticDeepEqual)
+	if util.IsDirectComparable(util.NonPointer(util.NativeType(nt.Elem))) {
+		equivArg = Identifier(validateDirectEqual)
+	}
+
+	validateFunc := validateEachMapVal
+	if nt.Elem.Kind == types.Pointer {
+		validateFunc = validateEachPtrMapVal
+	}
+
+	wrapped := WrapFunctions(validations, func(vfn FunctionGen, _ DeferredScope) FunctionGen {
+		comm := vfn.Comments
+		vfn.Comments = nil
+		return Function(eachValTagName, vfn.Flags, validateFunc, equivArg, WrapperFunction{Function: vfn, ObjType: nt.Elem, PathFragment: "[*]"}).WithComments(comm...)
+	})
+	return Validations{
+		Functions:     wrapped.Functions,
+		Deferred:      wrapped.Deferred,
+		OpaqueValType: validations.OpaqueType,
+	}, nil
+}
+
+func (evtv eachValTagValidator) Docs() TagDoc {
+	doc := TagDoc{
+		Tag:            evtv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(evtv.ValidScopes()),
+		Description:    "Declares a validation for each value in a map or list.",
+		Payloads: []TagPayloadDoc{{
+			Description: "<validation-tag>",
+			Docs:        "The tag to evaluate for each value.",
+		}},
+		PayloadsType:     codetags.ValueTypeTag,
+		PayloadsRequired: true,
+	}
+	return doc
+}
+
+type eachKeyTagValidator struct {
+	validator TagValidationExtractor
+}
+
+func (ektv *eachKeyTagValidator) Init(cfg Config) {
+	ektv.validator = cfg.TagValidator
+}
+
+func (eachKeyTagValidator) TagName() string {
+	return eachKeyTagName
+}
+
+func (eachKeyTagValidator) ValidScopes() sets.Set[Scope] {
+	return listTagsValidScopes
+}
+
+var (
+	validateEachMapKey = types.Name{Package: libValidationPkg, Name: "EachMapKey"}
+)
+
+func (ektv eachKeyTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	// NOTE: pointers to lists are not supported, so we should never see a pointer here.
+	t := context.Type
+	nt := util.NativeType(t)
+	if nt.Kind != types.Map {
+		return Validations{}, fmt.Errorf("can only be used on map types (%s)", nt.Kind)
+	}
+
+	elemContext := Context{
+		Scope:          ScopeMapKey,
+		Type:           nt.Key,
+		Path:           context.Path.Key("(keys)"),
+		Member:         nil, // NA for map keys
+		ParentPath:     context.Path,
+		ParentType:     context.Type,
+		StabilityLevel: context.StabilityLevel,
+	}
+
+	validations, err := ektv.validator.ExtractTagValidations(elemContext, *tag.ValueTag)
+	if err != nil {
+		return Validations{}, err
+	}
+
+	if len(validations.Variables) > 0 {
+		return Validations{}, fmt.Errorf("variable generation is not supported")
+	}
+
+	result := Validations{
+		OpaqueKeyType: validations.OpaqueType,
+	}
+	result.Comments = append(result.Comments, validations.Comments...)
+
+	if len(validations.Functions) > 0 {
+		innerVals, err := ektv.getValidations(t, Validations{Functions: validations.Functions})
+		if err != nil {
+			return Validations{}, err
+		}
+		result.Add(innerVals)
+	}
+
+	if len(validations.Deferred) > 0 {
+		result.AddDeferred(Deferred(ThisContext, func() (Validations, error) {
+			resolved := Validations{}
+			for _, d := range validations.Deferred {
+				inner, err := d.Callback()
+				if err != nil {
+					return Validations{}, err
+				}
+				resolved.Add(inner)
+			}
+			return ektv.getValidations(t, resolved)
+		}))
+	}
+
+	if result.Empty() {
+		return Validations{}, fmt.Errorf("no validation functions found")
+	}
+
+	return result, nil
+}
+
+func (ektv eachKeyTagValidator) getValidations(t *types.Type, validations Validations) (Validations, error) {
+	nt := util.NativeType(t)
+	wrapped := WrapFunctions(validations, func(vfn FunctionGen, _ DeferredScope) FunctionGen {
+		comm := vfn.Comments
+		vfn.Comments = nil
+		return Function(eachKeyTagName, vfn.Flags, validateEachMapKey, WrapperFunction{Function: vfn, ObjType: nt.Key}).WithComments(comm...)
+	})
+	return Validations{
+		Functions:     wrapped.Functions,
+		Deferred:      wrapped.Deferred,
+		OpaqueKeyType: validations.OpaqueType,
+	}, nil
+}
+
+// ForEachKey returns a validation that applies a function to each key of
+// a map.
+func ForEachKey(_ *field.Path, t *types.Type, fn FunctionGen) (Validations, error) {
+	return globalEachKey.getValidations(t, Validations{Functions: []FunctionGen{fn}})
+}
+
+func (ektv eachKeyTagValidator) Docs() TagDoc {
+	doc := TagDoc{
+		Tag:            ektv.TagName(),
+		Scopes:         sets.List(ektv.ValidScopes()),
+		StabilityLevel: TagStabilityLevelStable,
+		Description:    "Declares a validation for each key in a map.",
+		Payloads: []TagPayloadDoc{{
+			Description: "<validation-tag>",
+			Docs:        "The tag to evaluate for each key.",
+		}},
+		PayloadsType:     codetags.ValueTypeTag,
+		PayloadsRequired: true,
+	}
+	return doc
+}
+
+var (
+	validatePtrSliceNoNils = types.Name{Package: libValidationPkg, Name: "PtrSliceNoNils"}
+	validatePtrMapNoNils   = types.Name{Package: libValidationPkg, Name: "PtrMapNoNils"}
+)
+
+// PtrSliceNoNils returns a synthetic validation that rejects nil elements of a
+// pointer slice. It is not tag-driven; the generator injects it for []*T fields.
+func PtrSliceNoNils(elemType types.Name) FunctionGen {
+	return Function("PtrSliceNoNils", ShortCircuit, validatePtrSliceNoNils).WithTypeArgs(elemType)
+}
+
+// PtrMapNoNils returns a synthetic validation that rejects nil elements of a
+// pointer map. It is not tag-driven; the generator injects it for map[K]*V fields.
+func PtrMapNoNils(keyType, elemType types.Name) FunctionGen {
+	return Function("PtrMapNoNils", ShortCircuit, validatePtrMapNoNils).WithTypeArgs(keyType, elemType)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/enum.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/enum.go
new file mode 100644
index 0000000000..618b92fbb7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/enum.go
@@ -0,0 +1,275 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"cmp"
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	enumTagName        = "k8s:enum"
+	enumExcludeTagName = "k8s:enumExclude"
+)
+
+func init() {
+	RegisterTagValidator(&enumTagValidator{})
+	RegisterTagValidator(&enumExcludeTagValidator{})
+}
+
+type enumExcludeTagValidator struct {
+}
+
+func (*enumExcludeTagValidator) Init(_ Config) {
+}
+
+func (*enumExcludeTagValidator) TagName() string {
+	return enumExcludeTagName
+}
+
+var enumExcludeValidScope = sets.New(ScopeConst)
+
+func (*enumExcludeTagValidator) ValidScopes() sets.Set[Scope] {
+	return enumExcludeValidScope
+}
+
+func (*enumExcludeTagValidator) GetValidations(_ Context, _ codetags.Tag) (Validations, error) {
+	return Validations{}, nil
+}
+
+func (eetv *enumExcludeTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            eetv.TagName(),
+		StabilityLevel: TagStabilityLevelAlpha,
+		Scopes:         sets.List(eetv.ValidScopes()),
+		Description: `Indicates that an constant value is not part of an enum, even if the constant's type is tagged with k8s:enum.
+May be conditionally excluded via +k8s:ifEnabled(Option)=+k8s:enumExclude or +k8s:ifDisabled(Option)=+k8s:enumExclude.
+If multiple +k8s:ifEnabled/+k8s:ifDisabled tags are used, the value is excluded if any of the exclude conditions are met.`,
+	}
+}
+
+type enumTagValidator struct {
+	validator TagValidationExtractor
+}
+
+func (etv *enumTagValidator) Init(cfg Config) {
+	etv.validator = cfg.TagValidator
+}
+
+func (enumTagValidator) TagName() string {
+	return enumTagName
+}
+
+var enumTagValidScopes = sets.New(ScopeType)
+
+func (enumTagValidator) ValidScopes() sets.Set[Scope] {
+	return enumTagValidScopes
+}
+
+var (
+	enumValidator     = types.Name{Package: libValidationPkg, Name: "Enum"}
+	enumExclusionType = types.Name{Package: libValidationPkg, Name: "EnumExclusion"}
+	setsNew           = types.Name{Package: "k8s.io/apimachinery/pkg/util/sets", Name: "New"}
+)
+
+func (etv *enumTagValidator) GetValidations(context Context, _ codetags.Tag) (Validations, error) {
+	// NOTE: typedefs to pointers are not supported, so we should never see a pointer here.
+	if t := util.NativeType(context.Type); t != types.String {
+		return Validations{}, fmt.Errorf("can only be used on string types (%s)", rootTypeString(context.Type, t))
+	}
+
+	enum := &enumType{Name: context.Type.Name}
+	for _, c := range context.Constants {
+		var exclusions []enumExclude
+		isExcluded := false
+		for _, tag := range c.Tags {
+			switch tag.Name {
+			case enumExcludeTagName:
+				isExcluded = true
+			case ifEnabledTag, ifDisabledTag:
+				if tag.ValueTag != nil && tag.ValueTag.Name == enumExcludeTagName {
+					if option, ok := tag.PositionalArg(); ok {
+						exclusions = append(exclusions, enumExclude{
+							excludeWhen: tag.Name == ifEnabledTag,
+							option:      option.Value,
+						})
+					}
+				}
+			}
+		}
+		if isExcluded {
+			continue
+		}
+
+		value := &enumValue{
+			Name:       c.Constant.Name,
+			Value:      *c.Constant.ConstValue,
+			Comment:    strings.Join(c.Constant.CommentLines, " "),
+			Exclusions: exclusions,
+		}
+		enum.addIfNotPresent(value)
+	}
+
+	// Sort the values for the codegen that happens later.
+	slices.SortFunc(enum.Values, func(a, b *enumValue) int {
+		return cmp.Compare(a.Name.Name, b.Name.Name)
+	})
+	for _, v := range enum.Values {
+		slices.SortFunc(v.Exclusions, func(a, b enumExclude) int {
+			if a.excludeWhen == b.excludeWhen {
+				return cmp.Compare(a.option, b.option)
+			}
+			if a.excludeWhen {
+				return 1
+			}
+			return -1
+		})
+	}
+
+	var result Validations
+
+	// TODO: Avoid the "local" here. This was added to avoid errors caused when the package is an empty string.
+	//       The correct package would be the output package but is not known here. This does not show up in generated code.
+	// TODO: Append a consistent hash suffix to avoid generated name conflicts?
+	symbolsVarName := PrivateVar{Name: "SymbolsFor" + context.Type.Name.Name, Package: "local"}
+	var allValues []any
+	var exclusionRules []any
+	for _, v := range enum.Values {
+		allValues = append(allValues, Identifier(v.Name))
+		for _, exclusion := range v.Exclusions {
+			exclusionRules = append(exclusionRules, StructLiteral{
+				Type:     enumExclusionType,
+				TypeArgs: []*types.Type{context.Type},
+				Fields: []StructLiteralField{
+					{"Value", Identifier(v.Name)},
+					{"Option", exclusion.option},
+					{"ExcludeWhen", exclusion.excludeWhen},
+				},
+			})
+		}
+	}
+	initFn := Function("setsNew", DefaultFlags, setsNew, allValues...)
+	if len(allValues) == 0 {
+		initFn = initFn.WithTypeArgs(enum.Name)
+	}
+	result.AddVariable(Variable(symbolsVarName, initFn))
+	var exclusions any = Literal("nil")
+	if len(exclusionRules) > 0 {
+		exclusionsVar := PrivateVar{Name: "ExclusionsFor" + context.Type.Name.Name, Package: "local"}
+		result.AddVariable(Variable(exclusionsVar, SliceLiteral{
+			ElementType:     enumExclusionType,
+			ElementTypeArgs: []*types.Type{context.Type},
+			Elements:        exclusionRules,
+		}))
+		exclusions = exclusionsVar
+	}
+	fn := Function(enumTagName, DefaultFlags, enumValidator, symbolsVarName, exclusions).
+		WithEmits(Emission{field.ErrorTypeNotSupported, "", ""})
+	result.AddFunction(fn)
+
+	return result, nil
+}
+
+func (etv *enumTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            etv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(etv.ValidScopes()),
+		Description:    "Indicates that a string type is an enum. All constant values of this type are considered values in the enum unless excluded using +k8s:enumExclude.",
+	}
+}
+
+func (et *enumType) ValueArgs() []any {
+	var values []any
+	for _, value := range et.SymbolConstants() {
+		values = append(values, value)
+	}
+	return values
+}
+
+func (et *enumType) SymbolConstants() []Identifier {
+	var values []Identifier
+	for _, value := range et.Values {
+		values = append(values, Identifier(value.Name))
+	}
+	slices.SortFunc(values, func(a, b Identifier) int {
+		return cmp.Compare(a.Name, b.Name)
+	})
+	return values
+}
+
+// TODO: Everything below this comment is copied from kube-openapi's enum.go.
+
+type enumType struct {
+	Name   types.Name
+	Values []*enumValue
+}
+
+type enumValue struct {
+	Name       types.Name
+	Value      string
+	Comment    string
+	Exclusions []enumExclude
+}
+
+type enumExclude struct {
+	// excludeWhen determines the condition for exclusion.
+	// If true, the value is excluded if the option is present.
+	// If false, the value is excluded if the option is NOT present.
+	excludeWhen bool
+	// option is the name of the feature option that controls the exclusion.
+	option string
+}
+
+// ValueStrings returns all possible values of the enum type as strings
+// the results are sorted and quoted as Go literals.
+func (et *enumType) ValueStrings() []string {
+	var values []string
+	for _, value := range et.Values {
+		// use "%q" format to generate a Go literal of the string const value
+		values = append(values, fmt.Sprintf("%q", value.Value))
+	}
+	sort.Strings(values)
+	return values
+}
+
+func (et *enumType) addIfNotPresent(value *enumValue) {
+	// If we already have an enum case with the same value, then ignore this new
+	// one. This can happen if an enum aliases one from another package and
+	// re-exports the cases.
+	for i, existing := range et.Values {
+		if existing.Value == value.Value {
+
+			// Take the value of the longer comment (or some other deterministic tie breaker)
+			if len(existing.Comment) < len(value.Comment) || (len(existing.Comment) == len(value.Comment) && existing.Comment > value.Comment) {
+				et.Values[i] = value
+			}
+
+			return
+		}
+	}
+	et.Values = append(et.Values, value)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/equality.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/equality.go
new file mode 100644
index 0000000000..1376a50952
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/equality.go
@@ -0,0 +1,112 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	neqTagName = "k8s:neq"
+)
+
+func init() {
+	RegisterTagValidator(neqTagValidator{})
+}
+
+type neqTagValidator struct{}
+
+func (neqTagValidator) Init(_ Config) {}
+
+func (neqTagValidator) TagName() string {
+	return neqTagName
+}
+
+var neqTagValidScopes = sets.New(ScopeType, ScopeField, ScopeListVal, ScopeMapKey, ScopeMapVal)
+
+func (neqTagValidator) ValidScopes() sets.Set[Scope] {
+	return neqTagValidScopes
+}
+
+var (
+	neqValidator = types.Name{Package: libValidationPkg, Name: "NEQ"}
+)
+
+func (v neqTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	t := util.NonPointer(util.NativeType(context.Type))
+	if !util.IsDirectComparable(t) {
+		return Validations{}, fmt.Errorf("can only be used on comparable types (e.g. string, int, bool), but got %s", rootTypeString(context.Type, t))
+	}
+
+	if tag.ValueType == codetags.ValueTypeNone {
+		return Validations{}, fmt.Errorf("missing required payload")
+	}
+
+	var disallowedValue any
+	var err error
+
+	switch {
+	case t == types.String:
+		if tag.ValueType != codetags.ValueTypeString {
+			return Validations{}, fmt.Errorf("type mismatch: field is a string, but payload is of type %s", tag.ValueType)
+		}
+		disallowedValue = tag.Value
+	case t == types.Bool:
+		if tag.ValueType != codetags.ValueTypeBool {
+			return Validations{}, fmt.Errorf("type mismatch: field is a bool, but payload is of type %s", tag.ValueType)
+		}
+		disallowedValue, err = util.ParseBool(tag.Value)
+		if err != nil {
+			return Validations{}, fmt.Errorf("invalid bool value for payload: %w", err)
+		}
+	case types.IsInteger(t):
+		if tag.ValueType != codetags.ValueTypeInt {
+			return Validations{}, fmt.Errorf("type mismatch: field is an integer, but payload is of type %s", tag.ValueType)
+		}
+		disallowedValue, err = util.ParseInt(tag.Value)
+		if err != nil {
+			return Validations{}, fmt.Errorf("invalid integer value for payload: %w", err)
+		}
+	default:
+		return Validations{}, fmt.Errorf("unsupported type for 'neq' tag: %s", t.Name)
+	}
+
+	fn := Function(v.TagName(), DefaultFlags, neqValidator, disallowedValue).
+		WithEmits(Emission{field.ErrorTypeInvalid, "neq", ""})
+	return Validations{Functions: []FunctionGen{fn}}, nil
+}
+
+func (v neqTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:              v.TagName(),
+		StabilityLevel:   TagStabilityLevelAlpha,
+		Scopes:           sets.List(v.ValidScopes()),
+		Description:      "Verifies the field's value is not equal to a specific disallowed value. Supports string, integer, and boolean types.",
+		PayloadsRequired: true,
+		PayloadsType:     codetags.ValueTypeRaw,
+		Payloads: []TagPayloadDoc{{
+			Description: "<value>",
+			Docs:        "The disallowed value. The parser will infer the type (string, int, bool).",
+		}},
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/format.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/format.go
new file mode 100644
index 0000000000..79528b3138
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/format.go
@@ -0,0 +1,184 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	formatTagName = "k8s:format"
+)
+
+func init() {
+	RegisterTagValidator(formatTagValidator{})
+}
+
+type formatTagValidator struct{}
+
+func (formatTagValidator) Init(_ Config) {}
+
+func (formatTagValidator) TagName() string {
+	return formatTagName
+}
+
+var formatTagValidScopes = sets.New(ScopeType, ScopeField, ScopeListVal, ScopeMapKey, ScopeMapVal)
+
+func (formatTagValidator) ValidScopes() sets.Set[Scope] {
+	return formatTagValidScopes
+}
+
+var (
+	// Keep this list alphabetized.
+	// TODO: uncomment the following when we've done the homework
+	// to be sure it works the current state of IP manual-ratcheting
+	// ipSloppyValidator         = types.Name{Package: libValidationPkg, Name: "IPSloppy"}
+	extendedResourceNameValidator       = types.Name{Package: libValidationPkg, Name: "ExtendedResourceName"}
+	labelKeyValidator                   = types.Name{Package: libValidationPkg, Name: "LabelKey"}
+	labelValueValidator                 = types.Name{Package: libValidationPkg, Name: "LabelValue"}
+	longNameCaselessValidator           = types.Name{Package: libValidationPkg, Name: "LongNameCaseless"}
+	longNameValidator                   = types.Name{Package: libValidationPkg, Name: "LongName"}
+	pathSegmentValidator                = types.Name{Package: libValidationPkg, Name: "PathSegmentName"}
+	prefixedLabelKeyValidator           = types.Name{Package: libValidationPkg, Name: "PrefixedLabelKey"}
+	resourceFullyQualifiedNameValidator = types.Name{Package: libValidationPkg, Name: "ResourceFullyQualifiedName"}
+	resourcePoolNameValidator           = types.Name{Package: libValidationPkg, Name: "ResourcePoolName"}
+	shortNameValidator                  = types.Name{Package: libValidationPkg, Name: "ShortName"}
+	uuidValidator                       = types.Name{Package: libValidationPkg, Name: "UUID"}
+)
+
+func (formatTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	// This tag can apply to value and pointer fields, as well as typedefs
+	// (which should never be pointers). We need to check the concrete type.
+	if t := util.NonPointer(util.NativeType(context.Type)); t != types.String {
+		return Validations{}, fmt.Errorf("can only be used on string types (%s)", rootTypeString(context.Type, t))
+	}
+
+	var result Validations
+	if formatFunction, err := getFormatValidationFunction(tag.Value); err != nil {
+		return result, err
+	} else {
+		result.AddFunction(formatFunction)
+	}
+	return result, nil
+}
+
+func getFormatValidationFunction(format string) (FunctionGen, error) {
+	// The naming convention for these formats follows the JSON schema style:
+	// all lower-case, dashes between words. See
+	// https://json-schema.org/draft/2020-12/json-schema-validation#name-defined-formats
+	// for more examples.
+
+	switch format {
+	// Keep this sequence alphabetized.
+	case "k8s-extended-resource-name":
+		return Function(formatTagName, DefaultFlags, extendedResourceNameValidator).
+			WithEmits(Emission{field.ErrorTypeInvalid, "format=k8s-extended-resource-name", ""}), nil
+	// TODO: uncomment the following when we've done the homework
+	// to be sure it works the current state of IP manual-ratcheting
+	/*
+		case "k8s-ip":
+			return Function(formatTagName, DefaultFlags, ipSloppyValidator), nil
+	*/
+	case "k8s-label-key":
+		return Function(formatTagName, DefaultFlags, labelKeyValidator).
+			WithEmits(Emission{field.ErrorTypeInvalid, "format=k8s-label-key", ""}), nil
+	case "k8s-label-value":
+		return Function(formatTagName, DefaultFlags, labelValueValidator).
+			WithEmits(Emission{field.ErrorTypeInvalid, "format=k8s-label-value", ""}), nil
+	case "k8s-long-name":
+		return Function(formatTagName, DefaultFlags, longNameValidator).
+			WithEmits(Emission{field.ErrorTypeInvalid, "format=k8s-long-name", ""}), nil
+	case "k8s-long-name-caseless":
+		return Function(formatTagName, DefaultFlags, longNameCaselessValidator).
+			WithEmits(Emission{field.ErrorTypeInvalid, "format=k8s-long-name-caseless", ""}), nil
+	case "k8s-path-segment-name":
+		return Function(formatTagName, DefaultFlags, pathSegmentValidator).
+			WithEmits(Emission{field.ErrorTypeInvalid, "format=k8s-path-segment-name", ""}), nil
+	case "k8s-prefixed-label-key":
+		return Function(formatTagName, DefaultFlags, prefixedLabelKeyValidator).
+			WithEmits(Emission{field.ErrorTypeInvalid, "format=k8s-prefixed-label-key", ""}), nil
+	case "k8s-resource-fully-qualified-name":
+		return Function(formatTagName, DefaultFlags, resourceFullyQualifiedNameValidator).
+			WithEmits(Emission{field.ErrorTypeInvalid, "format=k8s-resource-fully-qualified-name", ""}), nil
+	case "k8s-resource-pool-name":
+		return Function(formatTagName, DefaultFlags, resourcePoolNameValidator).
+			WithEmits(Emission{field.ErrorTypeInvalid, "format=k8s-resource-pool-name", ""}), nil
+	case "k8s-short-name":
+		return Function(formatTagName, DefaultFlags, shortNameValidator).
+			WithEmits(Emission{field.ErrorTypeInvalid, "format=k8s-short-name", ""}), nil
+	case "k8s-uuid":
+		return Function(formatTagName, DefaultFlags, uuidValidator).
+			WithEmits(Emission{field.ErrorTypeInvalid, "format=k8s-uuid", ""}), nil
+	}
+	// TODO: Flesh out the list of validation functions
+
+	return FunctionGen{}, fmt.Errorf("unsupported validation format %q", format)
+}
+
+func (ftv formatTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            ftv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(ftv.ValidScopes()),
+		Description:    "Indicates that a string field has a particular format.",
+		Payloads: []TagPayloadDoc{{ // Keep this list alphabetized.
+			Description: "k8s-extended-resource-name",
+			Docs:        "This field holds a Kubernetes extended resource name. This is a domain-prefixed name that must not have a `kubernetes.io` or `requests.` prefix. When `requests.` is prepended, the result must be a valid label key, as used by quota.",
+		}, {
+			Description: "k8s-ip",
+			Docs:        "This field holds an IPv4 or IPv6 address value. IPv4 octets may have leading zeros.",
+		}, {
+			Description: "k8s-label-key",
+			Docs:        "This field holds a Kubernetes label key.",
+		}, {
+			Description: "k8s-label-value",
+			Docs:        "This field holds a Kubernetes label value.",
+		}, {
+			Description: "k8s-long-name",
+			Docs:        "This field holds a Kubernetes \"long name\", aka a \"DNS subdomain\" value.",
+		}, {
+			Description: "k8s-long-name-caseless",
+			Docs:        "Deprecated: This field holds a case-insensitive Kubernetes \"long name\", aka a \"DNS subdomain\" value.",
+		}, {
+			Description: "k8s-path-segment-name",
+			Docs:        "This field holds a Kubernetes \"path segment name\" value.",
+		}, {
+			Description: "k8s-prefixed-label-key",
+			Docs:        "This field holds a Kubernetes label key, with the prefix required.",
+		}, {
+			Description: "k8s-resource-fully-qualified-name",
+			Docs:        "This field holds a Kubernetes resource \"fully qualified name\" value. A fully qualified name must not be empty and must be composed of a prefix and a name, separated by a slash (e.g., \"prefix/name\"). The prefix must be a DNS subdomain, and the name part must be a C identifier with no more than 32 characters.",
+		}, {
+			Description: "k8s-resource-pool-name",
+			Docs:        "This field holds value with one or more Kubernetes \"long name\" parts separated by `/` and no longer than 253 characters.",
+		}, {
+			Description: "k8s-short-name",
+			Docs:        "This field holds a Kubernetes \"short name\", aka a \"DNS label\" value.",
+		}, {
+			Description: "k8s-uuid",
+			Docs:        "This field holds a Kubernetes UUID, which conforms to RFC 4122.",
+		}},
+		PayloadsType:     codetags.ValueTypeString,
+		PayloadsRequired: true,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/immutable.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/immutable.go
new file mode 100644
index 0000000000..e98669f9fe
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/immutable.go
@@ -0,0 +1,68 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	immutableTagName = "k8s:immutable"
+)
+
+func init() {
+	RegisterTagValidator(immutableTagValidator{})
+}
+
+type immutableTagValidator struct{}
+
+func (immutableTagValidator) Init(_ Config) {}
+
+func (immutableTagValidator) TagName() string {
+	return immutableTagName
+}
+
+var immutableTagValidScopes = sets.New(ScopeField, ScopeType, ScopeMapVal, ScopeListVal)
+
+func (immutableTagValidator) ValidScopes() sets.Set[Scope] {
+	return immutableTagValidScopes
+}
+
+var (
+	immutableValidator = types.Name{Package: libValidationPkg, Name: "Immutable"}
+)
+
+func (immutableTagValidator) GetValidations(context Context, _ codetags.Tag) (Validations, error) {
+	var result Validations
+
+	// Use ShortCircuit flag so immutable runs in the same group as +k8s:optional.
+	result.AddFunction(Function(immutableTagName, ShortCircuit, immutableValidator).
+		WithEmits(Emission{field.ErrorTypeInvalid, "immutable", ""}))
+	return result, nil
+}
+
+func (itv immutableTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            itv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(itv.ValidScopes()),
+		Description:    "Indicates that a field may not be updated.",
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/item.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/item.go
new file mode 100644
index 0000000000..6be7a61a7f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/item.go
@@ -0,0 +1,407 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	itemTagName = "k8s:item"
+)
+
+func init() {
+	// Processing item tags requires the list metadata.
+	RegisterTagValidator(&itemTagValidator{listByPath: globalListMeta})
+}
+
+type keyValuePair struct {
+	key       string
+	value     any
+	valueType codetags.ValueType
+}
+
+type itemTagValidator struct {
+	validator  TagValidationExtractor
+	listByPath map[string]*listMetadata
+}
+
+func (itv *itemTagValidator) Init(cfg Config) {
+	itv.validator = cfg.TagValidator
+}
+
+func (itemTagValidator) TagName() string {
+	return itemTagName
+}
+
+var itemTagValidScopes = sets.New(ScopeType, ScopeField, ScopeListVal, ScopeMapKey, ScopeMapVal)
+
+func (itemTagValidator) ValidScopes() sets.Set[Scope] {
+	return itemTagValidScopes
+}
+
+var (
+	validateValSliceItem = types.Name{Package: libValidationPkg, Name: "ValSliceItem"}
+	validatePtrSliceItem = types.Name{Package: libValidationPkg, Name: "PtrSliceItem"}
+)
+
+func (itv *itemTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	// TODO: Support regular maps with syntax like:
+	// +k8s:item("map-key")=+k8s:immutable
+
+	// This tag can apply to value and pointer fields, as well as typedefs
+	// (which should never be pointers). We need to check the concrete type.
+	nt := util.NonPointer(util.NativeType(context.Type))
+	if nt.Kind != types.Slice {
+		return Validations{}, fmt.Errorf("can only be used on list types")
+	}
+	elemT := util.NonPointer(util.NativeType(nt.Elem))
+
+	validateFunc := validateValSliceItem
+	if nt.Elem.Kind == types.Pointer {
+		validateFunc = validatePtrSliceItem
+	}
+	if elemT.Kind != types.Struct {
+		return Validations{}, fmt.Errorf("can only be used on lists of structs")
+	}
+	if tag.ValueType != codetags.ValueTypeTag || tag.ValueTag == nil {
+		return Validations{}, fmt.Errorf("requires a validation tag as its value payload")
+	}
+
+	// Parse key-value pairs from named args.
+	criteria, err := criteriaFromArgs(tag.Args)
+	if err != nil {
+		return Validations{}, err
+	}
+	if len(criteria) == 0 {
+		return Validations{}, fmt.Errorf("no selection criteria was specified")
+	}
+
+	// Extract validations from the stored tag
+	itemKey := selectorString(criteria)
+	itemPath := context.Path.Key(itemKey)
+	itemSelector := generateSelector(criteria)
+	subContext := Context{
+		Scope:          ScopeListVal,
+		Type:           elemT,
+		Path:           itemPath,
+		ListSelector:   itemSelector,
+		ParentPath:     context.Path,
+		ParentType:     context.Type,
+		StabilityLevel: context.StabilityLevel,
+	}
+
+	validations, err := itv.validator.ExtractTagValidations(subContext, *tag.ValueTag)
+	if err != nil {
+		return Validations{}, err
+	}
+
+	result := validations.Clone()
+	result.Functions = nil
+	result.Deferred = nil
+
+	// 1. Handle immediate functions. We need to defer them because listMetadata is not ready yet.
+	if len(validations.Functions) > 0 {
+		result.AddDeferred(Deferred(ThisContext, func() (Validations, error) {
+			matchArg, equivArg, err := itv.prepareArgs(context, criteria, elemT)
+			if err != nil {
+				return Validations{}, err
+			}
+			deferredResult := Validations{}
+			for _, vfn := range validations.Functions {
+				f := Function(itemTagName, vfn.Flags, validateFunc, matchArg, equivArg, WrapperFunction{Function: vfn, ObjType: elemT})
+				f.Cohort = itemKey
+				vfn = f
+				deferredResult.AddFunction(vfn)
+			}
+			return deferredResult, nil
+		}))
+	}
+
+	// 2. Handle deferred validations from child tag.
+	for _, d := range validations.Deferred {
+		scope := d.Scope
+		if scope == ParentContext {
+			// A child tag (e.g. +k8s:union) returning a ParentContext validation intends
+			// to evaluate the entire collection (the list) after its items are processed.
+			// Because item tags are evaluated in the context of the list field, the "parent"
+			// of a list element is conceptually the list itself, which maps to ThisContext
+			// (the field phase).
+			// If we left this as ParentContext, the framework would mistakenly defer it to
+			// the struct containing the list. By mapping to ThisContext, we ensure the
+			// deferred validation correctly runs at the end of the list field's phase, naturally
+			// accumulating and running after all immediate item validations for this criteria.
+			scope = ThisContext
+		}
+		result.AddDeferred(Deferred(scope, func() (Validations, error) {
+			inner, err := d.Callback()
+			if err != nil {
+				return Validations{}, err
+			}
+
+			matchArg, equivArg, err := itv.prepareArgs(context, criteria, elemT)
+			if err != nil {
+				return Validations{}, err
+			}
+
+			return wrapFunctionsWithScope(inner, func(fn FunctionGen, s DeferredScope) FunctionGen {
+				if s == ParentContext {
+					// We reach here if the original deferred scope was ParentContext.
+					// Because the parent of a list element is the list itself, the generated
+					// function `fn` (e.g. a union validation) already expects the full list
+					// as its argument. If we didn't skip wrapping, validateValSliceItem would
+					// mistakenly attempt to pass individual list elements to it.
+					return fn
+				}
+				f := Function(itemTagName, fn.Flags, validateFunc, matchArg, equivArg, WrapperFunction{Function: fn, ObjType: elemT})
+				f.Cohort = itemKey
+				return f
+			}, d.Scope), nil
+		}))
+	}
+
+	return result, nil
+}
+
+func (itv *itemTagValidator) prepareArgs(context Context, criteria []keyValuePair, elemT *types.Type) (matchArg any, equivArg any, err error) {
+	listMeta, ok := itv.listByPath[context.Path.String()]
+	if !ok && context.Scope == ScopeField {
+		listMeta, ok = itv.listByPath[context.Type.String()]
+	}
+	if !ok || listMeta.semantic != semanticMap || len(listMeta.keyMembers) == 0 {
+		return nil, nil, fmt.Errorf("found items with no list metadata - item tags require listType=map or unique=map with listMapKey")
+	}
+
+	if len(criteria) != len(listMeta.keyNames) {
+		return nil, nil, fmt.Errorf("number of arguments (%d) does not match number of listMapKey fields (%d)", len(criteria), len(listMeta.keyNames))
+	}
+
+	foundKeys := make(map[string]bool)
+	sortedCriteria := make([]keyValuePair, 0, len(listMeta.keyNames))
+	for _, keyName := range listMeta.keyNames {
+		for _, pair := range criteria {
+			if pair.key == keyName {
+				member := util.GetMemberByJSON(elemT, pair.key)
+				if member == nil {
+					return nil, nil, fmt.Errorf("no field with JSON name %q", pair.key)
+				}
+				// We don't need to validate type match here, as it's done during generateComparisonRHS
+				foundKeys[keyName] = true
+				sortedCriteria = append(sortedCriteria, pair)
+				break
+			}
+		}
+	}
+	if len(foundKeys) != len(listMeta.keyNames) {
+		missing := []string{}
+		for _, k := range listMeta.keyNames {
+			if !foundKeys[k] {
+				missing = append(missing, k)
+			}
+		}
+		return nil, nil, fmt.Errorf("missing required listMapKey fields: %v", missing)
+	}
+	matchArg, err = createMatchFn(elemT, sortedCriteria)
+	if err != nil {
+		return nil, nil, err
+	}
+	directComparable := util.IsDirectComparable(util.NonPointer(util.NativeType(elemT)))
+	if directComparable {
+		equivArg = Identifier(validateDirectEqual)
+	} else {
+		equivArg = Identifier(validateSemanticDeepEqual)
+	}
+	return matchArg, equivArg, nil
+}
+
+func criteriaFromArgs(args []codetags.Arg) ([]keyValuePair, error) {
+	criteria := []keyValuePair{}
+	keysSeen := sets.Set[string]{}
+
+	for _, arg := range args {
+		if arg.Name == "" {
+			return nil, fmt.Errorf("all arguments must be named")
+		}
+		if keysSeen.Has(arg.Name) {
+			return nil, fmt.Errorf("duplicate argument: %q", arg.Name)
+		}
+		keysSeen.Insert(arg.Name)
+
+		parsedValue, valueType, err := parseTypedValue(arg.Value, arg.Type)
+		if err != nil {
+			return nil, fmt.Errorf("invalid value for argument %q: %w", arg.Name, err)
+		}
+
+		criteria = append(criteria, keyValuePair{
+			key:       arg.Name,
+			value:     parsedValue,
+			valueType: valueType,
+		})
+	}
+	return criteria, nil
+}
+
+// parseTypedValue parses a value based on its detected type
+func parseTypedValue(value string, argType codetags.ArgType) (any, codetags.ValueType, error) {
+	switch argType {
+	case codetags.ArgTypeString:
+		return value, codetags.ValueTypeString, nil
+	case codetags.ArgTypeInt:
+		intVal, err := util.ParseInt(value)
+		if err != nil {
+			return nil, "", fmt.Errorf("invalid integer: %w", err)
+		}
+		return intVal, codetags.ValueTypeInt, nil
+	case codetags.ArgTypeBool:
+		boolVal, err := util.ParseBool(value)
+		if err != nil {
+			return nil, "", fmt.Errorf("invalid boolean: %w", err)
+		}
+		return boolVal, codetags.ValueTypeBool, nil
+	default:
+		return nil, "", fmt.Errorf("unsupported argument type: %q", argType)
+	}
+}
+
+func (itv itemTagValidator) Docs() TagDoc {
+	doc := TagDoc{
+		Tag:            itv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(itv.ValidScopes()),
+		Description: "Declares a validation for an item of a slice declared as a +k8s:listType=map. " +
+			"The item to match is declared by providing field-value pair arguments. All key fields must be specified.",
+		Usage: "+k8s:item(stringKey: \"value\", intKey: 42, boolKey: true)=<validation-tag>",
+		Docs: "Arguments must be named with the JSON names of the list-map key fields. " +
+			"Values can be strings, integers, or booleans. " +
+			"For example: +k8s:item(name: \"myname\", priority: 10, enabled: true)=<chained-validation-tag>",
+		AcceptsUnknownArgs: true,
+		Payloads: []TagPayloadDoc{{
+			Description: "<validation-tag>",
+			Docs:        "The tag to evaluate for the matching list item.",
+		}},
+		PayloadsType:     codetags.ValueTypeTag,
+		PayloadsRequired: true,
+	}
+	return doc
+}
+
+func buildMatchConditions(elemT *types.Type, criteria []keyValuePair, itemRef string) (string, error) {
+	var conditions []string
+
+	for _, fld := range criteria {
+		member := util.GetMemberByJSON(elemT, fld.key)
+		if member == nil {
+			return "", fmt.Errorf("no field with JSON name %q", fld.key)
+		}
+		// Generate the comparison based on the field's actual type
+		rhs, err := generateComparisonRHS(member, fld.value)
+		if err != nil {
+			return "", err
+		}
+		if member.Type.Kind == types.Pointer {
+			conditions = append(conditions, fmt.Sprintf("%s.%s != nil && *%s.%s == %s", itemRef, member.Name, itemRef, member.Name, rhs))
+		} else {
+			conditions = append(conditions, fmt.Sprintf("%s.%s == %s", itemRef, member.Name, rhs))
+		}
+	}
+
+	return strings.Join(conditions, " && "), nil
+}
+
+func createMatchFn(elemT *types.Type, criteria []keyValuePair) (FunctionLiteral, error) {
+	condition, err := buildMatchConditions(elemT, criteria, "item")
+	if err != nil {
+		return FunctionLiteral{}, err
+	}
+
+	return FunctionLiteral{
+		Parameters: []ParamResult{{"item", types.PointerTo(elemT)}},
+		Results:    []ParamResult{{"", types.Bool}},
+		Body:       fmt.Sprintf("return %s", condition),
+	}, nil
+}
+
+func generateComparisonRHS(member *types.Member, value any) (string, error) {
+	memberType := util.NonPointer(util.NativeType(member.Type))
+	switch {
+	case memberType == types.String:
+		strVal, ok := value.(string)
+		if !ok {
+			return "", fmt.Errorf("type mismatch, field is string but value is not: %v", value)
+		}
+		return fmt.Sprintf("%q", strVal), nil
+
+	case memberType == types.Bool:
+		boolVal, ok := value.(bool)
+		if !ok {
+			return "", fmt.Errorf("type mismatch, field is bool but value is not: %v", value)
+		}
+		return fmt.Sprintf("%t", boolVal), nil
+
+	case types.IsInteger(memberType):
+		intVal, ok := value.(int)
+		if !ok {
+			return "", fmt.Errorf("type mismatch, field is int but value is not: %v", value)
+		}
+		return fmt.Sprintf("%d", intVal), nil
+
+	default:
+		return "", fmt.Errorf("unsupported type %s for field %s", memberType.String(), member.Name)
+	}
+}
+
+// selectorString creates a field path for list map items using a JSON-like
+// syntax. The format is {"key": "value", "key2": 42, "key3": true} with quoted
+// keys and appropriately formatted values.
+func selectorString(criteria []keyValuePair) string {
+	var pairs []string
+	for _, fld := range criteria {
+		valueStr := formatValueForPath(fld.value)
+		pairs = append(pairs, fmt.Sprintf("%q: %s", fld.key, valueStr))
+	}
+	return fmt.Sprintf("{%s}", strings.Join(pairs, ", "))
+}
+
+func formatValueForPath(value any) string {
+	switch v := value.(type) {
+	case string:
+		return fmt.Sprintf("%q", v)
+	case int:
+		return fmt.Sprintf("%d", v)
+	case bool:
+		return fmt.Sprintf("%t", v)
+	default:
+		return fmt.Sprintf("%v", v)
+	}
+}
+
+func generateSelector(criteria []keyValuePair) []ListSelectorTerm {
+	terms := make([]ListSelectorTerm, len(criteria))
+	for i, pair := range criteria {
+		terms[i] = ListSelectorTerm{
+			Field: pair.key,
+			Value: pair.value,
+		}
+	}
+	return terms
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/levels.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/levels.go
new file mode 100644
index 0000000000..e1e7c2467a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/levels.go
@@ -0,0 +1,112 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+	"regexp"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/gengo/v2/codetags"
+)
+
+var kubeVersionRegex = regexp.MustCompile(`^\d+\.\d+$`)
+
+const (
+	alphaTagName = "k8s:alpha"
+	betaTagName  = "k8s:beta"
+)
+
+func init() {
+	RegisterTagValidator(&levelTagValidator{tagName: alphaTagName, level: ValidationStabilityLevelAlpha})
+	RegisterTagValidator(&levelTagValidator{tagName: betaTagName, level: ValidationStabilityLevelBeta})
+}
+
+type levelTagValidator struct {
+	validator TagValidationExtractor
+	tagName   string
+	level     ValidationStabilityLevel
+}
+
+func (ltv *levelTagValidator) Init(cfg Config) {
+	ltv.validator = cfg.TagValidator
+}
+
+func (ltv *levelTagValidator) TagName() string {
+	return ltv.tagName
+}
+
+var levelTagsValidScopes = sets.New(ScopeType, ScopeField, ScopeListVal, ScopeMapKey, ScopeMapVal)
+
+func (levelTagValidator) ValidScopes() sets.Set[Scope] {
+	return levelTagsValidScopes
+}
+
+func (ltv *levelTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	if tag.ValueType != codetags.ValueTypeTag || tag.ValueTag == nil {
+		return Validations{}, fmt.Errorf("requires a validation tag as its value payload")
+	}
+
+	if len(tag.Args) > 1 {
+		return Validations{}, fmt.Errorf("at most one optional kubernetes version argument is supported")
+	}
+
+	var version string
+	if len(tag.Args) == 1 {
+		arg := tag.Args[0]
+		version = arg.Value
+		if !kubeVersionRegex.MatchString(version) {
+			return Validations{}, fmt.Errorf("invalid kubernetes version format, expected <major>.<minor>, got %s", version)
+		}
+	}
+
+	context.StabilityLevel = ltv.level
+	validations, err := ltv.validator.ExtractTagValidations(context, *tag.ValueTag)
+	if err != nil {
+		return Validations{}, err
+	}
+
+	validations = WrapFunctions(validations, func(fn FunctionGen, scope DeferredScope) FunctionGen {
+		if fn.StabilityLevelSelfManaged {
+			return fn
+		}
+		fn.StabilityLevel = ltv.level
+		return fn
+	})
+	return validations, nil
+}
+
+func (ltv *levelTagValidator) Docs() TagDoc {
+	doc := TagDoc{
+		Tag:            ltv.TagName(),
+		StabilityLevel: TagStabilityLevelBeta,
+		Scopes:         sets.List(ltv.ValidScopes()),
+		Description:    fmt.Sprintf("Marks the given payload validation as a %s validation of the handwritten validation code. An optional Kubernetes version can be specified.", ltv.level),
+		Args: []TagArgDoc{{
+			Description: "The Kubernetes version (e.g. `1.34`) at which this validation was added.",
+			Type:        codetags.ArgTypeString,
+			Name:        "since",
+		}},
+		Payloads: []TagPayloadDoc{{
+			Description: "<validation-tag>",
+			Docs:        fmt.Sprintf("The validation tag to evaluate as a %s validation.", ltv.level),
+		}},
+		PayloadsType:     codetags.ValueTypeTag,
+		PayloadsRequired: true,
+	}
+	return doc
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/limits.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/limits.go
new file mode 100644
index 0000000000..999c19e781
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/limits.go
@@ -0,0 +1,583 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	minItemsTagName      = "k8s:minItems"
+	maxItemsTagName      = "k8s:maxItems"
+	minimumTagName       = "k8s:minimum"
+	maximumTagName       = "k8s:maximum"
+	minLengthTagName     = "k8s:minLength"
+	maxLengthTagName     = "k8s:maxLength"
+	maxBytesTagName      = "k8s:maxBytes"
+	maxPropertiesTagName = "k8s:maxProperties"
+	minPropertiesTagName = "k8s:minProperties"
+)
+
+func init() {
+	RegisterTagValidator(minItemsTagValidator{})
+	RegisterTagValidator(maxItemsTagValidator{})
+	RegisterTagValidator(minPropertiesTagValidator{})
+	RegisterTagValidator(maxPropertiesTagValidator{})
+	RegisterTagValidator(minimumTagValidator{})
+	RegisterTagValidator(maximumTagValidator{})
+	RegisterTagValidator(minLengthTagValidator{})
+	RegisterTagValidator(maxLengthTagValidator{})
+	RegisterTagValidator(maxBytesTagValidator{})
+}
+
+type maxLengthTagValidator struct{}
+
+func (maxLengthTagValidator) Init(_ Config) {}
+
+func (maxLengthTagValidator) TagName() string {
+	return maxLengthTagName
+}
+
+var maxLengthTagValidScopes = sets.New(ScopeType, ScopeField, ScopeListVal, ScopeMapKey, ScopeMapVal)
+
+func (maxLengthTagValidator) ValidScopes() sets.Set[Scope] {
+	return maxLengthTagValidScopes
+}
+
+var maxLengthValidator = types.Name{Package: libValidationPkg, Name: "MaxLength"}
+
+func (maxLengthTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	var result Validations
+
+	// This tag can apply to value and pointer fields, as well as typedefs
+	// (which should never be pointers). We need to check the concrete type.
+	if t := util.NonPointer(util.NativeType(context.Type)); t != types.String {
+		return Validations{}, fmt.Errorf("can only be used on string types (%s)", rootTypeString(context.Type, t))
+	}
+
+	intVal, err := util.ParseInt(tag.Value)
+	if err != nil {
+		return result, fmt.Errorf("failed to parse tag payload as int: %w", err)
+	}
+	if intVal < 0 {
+		return result, fmt.Errorf("must be greater than or equal to zero")
+	}
+	result.AddFunction(Function(maxLengthTagName, DefaultFlags, maxLengthValidator, intVal).
+		WithEmits(Emission{field.ErrorTypeTooLong, "maxLength", ""}))
+	return result, nil
+}
+
+func (mltv maxLengthTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            mltv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(mltv.ValidScopes()),
+		Description: `Indicates that a string field has a limit on its length in characters.
+		This could allow up to 4*N bytes if multi-byte characters are used.
+		If you want to limit length of bytes specifically, use maxBytes.`,
+		Payloads: []TagPayloadDoc{{
+			Description: "<non-negative integer>",
+			Docs:        "This field must be no more than X characters long.",
+		}},
+		PayloadsType:     codetags.ValueTypeInt,
+		PayloadsRequired: true,
+	}
+}
+
+type maxBytesTagValidator struct{}
+
+func (maxBytesTagValidator) Init(_ Config) {}
+
+func (maxBytesTagValidator) TagName() string {
+	return maxBytesTagName
+}
+
+var maxBytesTagValidScopes = sets.New(ScopeType, ScopeField, ScopeListVal, ScopeMapKey, ScopeMapVal)
+
+func (maxBytesTagValidator) ValidScopes() sets.Set[Scope] {
+	return maxBytesTagValidScopes
+}
+
+var maxBytesValidator = types.Name{Package: libValidationPkg, Name: "MaxBytes"}
+
+func (maxBytesTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	var result Validations
+
+	// This tag can apply to value and pointer fields, as well as typedefs
+	// (which should never be pointers). We need to check the concrete type.
+	if t := util.NonPointer(util.NativeType(context.Type)); t != types.String {
+		return Validations{}, fmt.Errorf("can only be used on string types (%s)", rootTypeString(context.Type, t))
+	}
+
+	intVal, err := util.ParseInt(tag.Value)
+	if err != nil {
+		return result, fmt.Errorf("failed to parse tag payload as int: %w", err)
+	}
+	if intVal < 0 {
+		return result, fmt.Errorf("must be greater than or equal to zero")
+	}
+	result.AddFunction(Function(maxBytesTagName, DefaultFlags, maxBytesValidator, intVal).
+		WithEmits(Emission{field.ErrorTypeTooLong, "maxBytes", ""}))
+	return result, nil
+}
+
+func (mbtv maxBytesTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            mbtv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(mbtv.ValidScopes()),
+		Description: `Indicates that a string field has a limit on its length in bytes.
+		This could only allow as few as N/4 multi-byte characters.
+		If you want to limit length of characters specifically, use maxLength.`,
+		Payloads: []TagPayloadDoc{{
+			Description: "<non-negative integer>",
+			Docs:        "This field must be no more than X bytes long.",
+		}},
+		PayloadsType:     codetags.ValueTypeInt,
+		PayloadsRequired: true,
+	}
+}
+
+type minItemsTagValidator struct{}
+
+func (minItemsTagValidator) Init(_ Config) {}
+
+func (minItemsTagValidator) TagName() string {
+	return minItemsTagName
+}
+
+var minItemsTagValidScopes = sets.New(
+	ScopeType,
+	ScopeField,
+	ScopeListVal,
+	ScopeMapVal,
+)
+
+func (minItemsTagValidator) ValidScopes() sets.Set[Scope] {
+	return minItemsTagValidScopes
+}
+
+var minItemsValidator = types.Name{Package: libValidationPkg, Name: "MinItems"}
+
+func (minItemsTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	var result Validations
+
+	// NOTE: pointers to lists are not supported, so we should never see a pointer here.
+	if t := util.NativeType(context.Type); t.Kind != types.Slice && t.Kind != types.Array {
+		return Validations{}, fmt.Errorf("can only be used on list types (%s)", rootTypeString(context.Type, t))
+	}
+
+	intVal, err := util.ParseInt(tag.Value)
+	if err != nil {
+		return result, fmt.Errorf("failed to parse tag payload as int: %w", err)
+	}
+	if intVal < 0 {
+		return result, fmt.Errorf("must be greater than or equal to zero")
+	}
+	result.AddFunction(Function(minItemsTagName, DefaultFlags, minItemsValidator, intVal).
+		WithEmits(Emission{field.ErrorTypeTooFew, "minItems", ""}))
+	return result, nil
+}
+
+func (mitv minItemsTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            mitv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(mitv.ValidScopes()),
+		Description:    "Indicates that a list has a minimum size.",
+		Payloads: []TagPayloadDoc{{
+			Description: "<non-negative integer>",
+			Docs:        "This list must be at least X items long.",
+		}},
+		PayloadsType:     codetags.ValueTypeInt,
+		PayloadsRequired: true,
+	}
+}
+
+type minPropertiesTagValidator struct{}
+
+func (minPropertiesTagValidator) Init(_ Config) {}
+
+func (minPropertiesTagValidator) TagName() string {
+	return minPropertiesTagName
+}
+
+var minPropertiesTagValidScopes = sets.New(
+	ScopeType,
+	ScopeField,
+)
+
+func (minPropertiesTagValidator) ValidScopes() sets.Set[Scope] {
+	return minPropertiesTagValidScopes
+}
+
+var minPropertiesValidator = types.Name{Package: libValidationPkg, Name: "MinProperties"}
+
+func (minPropertiesTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	var result Validations
+
+	// NOTE: pointers to maps are not supported, so we should never see a pointer here.
+	t := util.NativeType(context.Type)
+	if t.Kind != types.Map {
+		return Validations{}, fmt.Errorf("can only be used on map types (%s)", rootTypeString(context.Type, t))
+	}
+	keyType := util.NativeType(t.Key)
+	if keyType.Kind != types.Builtin || keyType.Name.Name != "string" {
+		return Validations{}, fmt.Errorf("can only be used on map types with string-based keys (%s)", rootTypeString(context.Type, t))
+	}
+
+	intVal, err := util.ParseInt(tag.Value)
+	if err != nil {
+		return result, fmt.Errorf("failed to parse tag payload as int: %w", err)
+	}
+	if intVal < 0 {
+		return result, fmt.Errorf("must be greater than or equal to zero")
+	}
+	if intVal > 100000 {
+		return result, fmt.Errorf("must be less than or equal to 100000")
+	}
+	result.AddFunction(Function(minPropertiesTagName, DefaultFlags, minPropertiesValidator, intVal).
+		WithEmits(Emission{field.ErrorTypeTooFew, "minProperties", ""}))
+	return result, nil
+}
+
+func (mptv minPropertiesTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            mptv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(mptv.ValidScopes()),
+		Description:    "minProperties provides a limit on properties of an object as defined by JSON schema. In Kubernetes it may only be used to constrain the number of elements on a field defined as a golang map.",
+		Payloads: []TagPayloadDoc{{
+			Description: "<non-negative integer>",
+			Docs:        "This map must have at least X properties (where X <= 100000).",
+		}},
+		PayloadsType:     codetags.ValueTypeInt,
+		PayloadsRequired: true,
+	}
+}
+
+type maxItemsTagValidator struct{}
+
+func (maxItemsTagValidator) Init(_ Config) {}
+
+func (maxItemsTagValidator) TagName() string {
+	return maxItemsTagName
+}
+
+var maxItemsTagValidScopes = sets.New(
+	ScopeType,
+	ScopeField,
+	ScopeListVal,
+	ScopeMapVal,
+)
+
+func (maxItemsTagValidator) ValidScopes() sets.Set[Scope] {
+	return maxItemsTagValidScopes
+}
+
+var maxItemsValidator = types.Name{Package: libValidationPkg, Name: "MaxItems"}
+
+func (maxItemsTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	var result Validations
+
+	// NOTE: pointers to lists are not supported, so we should never see a pointer here.
+	if t := util.NativeType(context.Type); t.Kind != types.Slice && t.Kind != types.Array {
+		return Validations{}, fmt.Errorf("can only be used on list types (%s)", rootTypeString(context.Type, t))
+	}
+
+	intVal, err := util.ParseInt(tag.Value)
+	if err != nil {
+		return result, fmt.Errorf("failed to parse tag payload as int: %w", err)
+	}
+	if intVal < 0 {
+		return result, fmt.Errorf("must be greater than or equal to zero")
+	}
+	// Note: maxItems short-circuits other validations for safety.
+	result.AddFunction(Function(maxItemsTagName, ShortCircuit, maxItemsValidator, intVal).
+		WithEmits(Emission{field.ErrorTypeTooMany, "maxItems", ""}))
+	return result, nil
+}
+
+func (mitv maxItemsTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            mitv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(mitv.ValidScopes()),
+		Description:    "Indicates that a list has a limit on its size.",
+		Payloads: []TagPayloadDoc{{
+			Description: "<non-negative integer>",
+			Docs:        "This list must be no more than X items long.",
+		}},
+		PayloadsType:     codetags.ValueTypeInt,
+		PayloadsRequired: true,
+	}
+}
+
+type maxPropertiesTagValidator struct{}
+
+func (maxPropertiesTagValidator) Init(_ Config) {}
+
+func (maxPropertiesTagValidator) TagName() string {
+	return maxPropertiesTagName
+}
+
+var maxPropertiesTagValidScopes = sets.New(
+	ScopeType,
+	ScopeField,
+)
+
+func (maxPropertiesTagValidator) ValidScopes() sets.Set[Scope] {
+	return maxPropertiesTagValidScopes
+}
+
+var maxPropertiesValidator = types.Name{Package: libValidationPkg, Name: "MaxProperties"}
+
+func (maxPropertiesTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	var result Validations
+
+	// NOTE: pointers to maps are not supported, so we should never see a pointer here.
+	t := util.NativeType(context.Type)
+	if t.Kind != types.Map {
+		return Validations{}, fmt.Errorf("can only be used on map types (%s)", rootTypeString(context.Type, t))
+	}
+	keyType := util.NativeType(t.Key)
+	if keyType.Kind != types.Builtin || keyType.Name.Name != "string" {
+		return Validations{}, fmt.Errorf("can only be used on map types with string-based keys (%s)", rootTypeString(context.Type, t))
+	}
+
+	intVal, err := util.ParseInt(tag.Value)
+	if err != nil {
+		return result, fmt.Errorf("failed to parse tag payload as int: %w", err)
+	}
+	if intVal < 0 {
+		return result, fmt.Errorf("must be greater than or equal to zero")
+	}
+	if intVal > 100000 {
+		return result, fmt.Errorf("must be less than or equal to 100000")
+	}
+	// Note: maxProperties short-circuits other validations.
+	result.AddFunction(Function(maxPropertiesTagName, ShortCircuit, maxPropertiesValidator, intVal).
+		WithEmits(Emission{field.ErrorTypeTooMany, "maxProperties", ""}))
+	return result, nil
+}
+
+func (mptv maxPropertiesTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            mptv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(mptv.ValidScopes()),
+		Description:    "maxProperties provides a limit on properties of an object as defined by JSON schema. In Kubernetes it may only be used to constrain the number of elements on a field defined as a golang map.",
+		Payloads: []TagPayloadDoc{{
+			Description: "<non-negative integer>",
+			Docs:        "This map must have no more than X properties (where X <= 100000).",
+		}},
+		PayloadsType:     codetags.ValueTypeInt,
+		PayloadsRequired: true,
+	}
+}
+
+type minimumTagValidator struct{}
+
+func (minimumTagValidator) Init(_ Config) {}
+
+func (minimumTagValidator) TagName() string {
+	return minimumTagName
+}
+
+var minimumTagValidScopes = sets.New(ScopeType, ScopeField, ScopeListVal, ScopeMapKey, ScopeMapVal)
+
+func (minimumTagValidator) ValidScopes() sets.Set[Scope] {
+	return minimumTagValidScopes
+}
+
+var minimumValidator = types.Name{Package: libValidationPkg, Name: "Minimum"}
+
+func (minimumTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	var result Validations
+
+	// This tag can apply to value and pointer fields, as well as typedefs
+	// (which should never be pointers). We need to check the concrete type.
+	t := util.NonPointer(util.NativeType(context.Type))
+	if !types.IsInteger(t) {
+		return result, fmt.Errorf("can only be used on integer types (%s)", rootTypeString(context.Type, t))
+	}
+
+	bitSize, err := intBitSize(t)
+	if err != nil {
+		return result, err
+	}
+	if isUnsignedInt(t) {
+		uintVal, err := util.ParseUnsignedInt(tag.Value, bitSize)
+		if err != nil {
+			return result, fmt.Errorf("failed to parse tag payload: %w", err)
+		}
+		result.AddFunction(Function(minimumTagName, DefaultFlags, minimumValidator, uintVal).
+			WithEmits(Emission{field.ErrorTypeInvalid, "minimum", ""}))
+	} else {
+		intVal, err := util.ParseSignedInt(tag.Value, bitSize)
+		if err != nil {
+			return result, fmt.Errorf("failed to parse tag payload: %w", err)
+		}
+		result.AddFunction(Function(minimumTagName, DefaultFlags, minimumValidator, intVal).
+			WithEmits(Emission{field.ErrorTypeInvalid, "minimum", ""}))
+	}
+	return result, nil
+}
+
+func (mtv minimumTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            mtv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(mtv.ValidScopes()),
+		Description:    "Indicates that a numeric field has a minimum value.",
+		Payloads: []TagPayloadDoc{{
+			Description: "<integer>",
+			Docs:        "This field must be greater than or equal to X.",
+		}},
+		PayloadsType:     codetags.ValueTypeInt,
+		PayloadsRequired: true,
+	}
+}
+
+type maximumTagValidator struct{}
+
+func (maximumTagValidator) Init(_ Config) {}
+
+func (maximumTagValidator) TagName() string {
+	return maximumTagName
+}
+
+var maximumTagValidScopes = sets.New(ScopeType, ScopeField, ScopeListVal, ScopeMapKey, ScopeMapVal)
+
+func (maximumTagValidator) ValidScopes() sets.Set[Scope] {
+	return maximumTagValidScopes
+}
+
+var maximumValidator = types.Name{Package: libValidationPkg, Name: "Maximum"}
+
+func (maximumTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	var result Validations
+
+	// This tag can apply to value and pointer fields, as well as typedefs
+	// (which should never be pointers). We need to check the concrete type.
+	t := util.NonPointer(util.NativeType(context.Type))
+	if !types.IsInteger(t) {
+		return result, fmt.Errorf("can only be used on integer types (%s)", rootTypeString(context.Type, t))
+	}
+
+	bitSize, err := intBitSize(t)
+	if err != nil {
+		return result, err
+	}
+	if isUnsignedInt(t) {
+		uintVal, err := util.ParseUnsignedInt(tag.Value, bitSize)
+		if err != nil {
+			return result, fmt.Errorf("failed to parse tag payload: %w", err)
+		}
+		result.AddFunction(Function(maximumTagName, DefaultFlags, maximumValidator, uintVal).
+			WithEmits(Emission{field.ErrorTypeInvalid, "maximum", ""}))
+	} else {
+		intVal, err := util.ParseSignedInt(tag.Value, bitSize)
+		if err != nil {
+			return result, fmt.Errorf("failed to parse tag payload: %w", err)
+		}
+		result.AddFunction(Function(maximumTagName, DefaultFlags, maximumValidator, intVal).
+			WithEmits(Emission{field.ErrorTypeInvalid, "maximum", ""}))
+	}
+	return result, nil
+}
+
+func (mtv maximumTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            mtv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(mtv.ValidScopes()),
+		Description:    "Indicates that a numeric field has a maximum value.",
+		Payloads: []TagPayloadDoc{{
+			Description: "<integer>",
+			Docs:        "This field must be less than or equal to X.",
+		}},
+		PayloadsType:     codetags.ValueTypeInt,
+		PayloadsRequired: true,
+	}
+}
+
+type minLengthTagValidator struct{}
+
+func (minLengthTagValidator) Init(_ Config) {}
+
+func (minLengthTagValidator) TagName() string {
+	return minLengthTagName
+}
+
+var minLengthTagValidScopes = sets.New(ScopeType, ScopeField, ScopeListVal, ScopeMapKey, ScopeMapVal)
+
+func (minLengthTagValidator) ValidScopes() sets.Set[Scope] {
+	return minLengthTagValidScopes
+}
+
+var minLengthValidator = types.Name{Package: libValidationPkg, Name: "MinLength"}
+
+func (minLengthTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	var result Validations
+
+	// This tag can apply to value and pointer fields, as well as typedefs
+	// (which should never be pointers). We need to check the concrete type.
+	if t := util.NonPointer(util.NativeType(context.Type)); t != types.String {
+		return result, fmt.Errorf("can only be used on string types (%s)", rootTypeString(context.Type, t))
+	}
+
+	intVal, err := util.ParseInt(tag.Value)
+	if err != nil {
+		return result, fmt.Errorf("failed to parse tag payload as int: %w", err)
+	}
+
+	// Usage of `+k8s:minLength=0` is useful as a semantic representation of the fact that
+	// the minimum valid length of the field was considered and that it intentionally doesn't
+	// have a minimum length constraint.
+	// Because a minimum length of `0` is semantically equivalent to not performing
+	// any validation, we only add a validation function to the result if the
+	// minimum length constraint is > 0.
+	if intVal > 0 {
+		result.AddFunction(Function(minLengthTagName, DefaultFlags, minLengthValidator, intVal).
+			WithEmits(Emission{field.ErrorTypeTooShort, "minLength", ""}))
+	}
+	return result, nil
+}
+
+func (mltv minLengthTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            mltv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(mltv.ValidScopes()),
+		Description: `Indicates that a string field has a minimum length for its value in characters.
+		This means that the minimum size in bytes is a range from X to 4X if multi-byte characters are allowed.
+		`,
+		Payloads: []TagPayloadDoc{{
+			Description: "<integer>",
+			Docs:        "This field must be at least X characters long.",
+		}},
+		PayloadsType:     codetags.ValueTypeInt,
+		PayloadsRequired: true,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/list.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/list.go
new file mode 100644
index 0000000000..16103556a3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/list.go
@@ -0,0 +1,527 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	listTypeTagName     = "k8s:listType"
+	ListMapKeyTagName   = "k8s:listMapKey"
+	uniqueTagName       = "k8s:unique"
+	customUniqueTagName = "k8s:customUnique"
+)
+
+// globalListMeta is shared between list-related validators.
+var globalListMeta = map[string]*listMetadata{} // keyed by the field or type path
+
+func init() {
+	// Accumulate list metadata via tags.
+	RegisterTagValidator(listTypeTagValidator{byPath: globalListMeta})
+	RegisterTagValidator(listMapKeyTagValidator{byPath: globalListMeta})
+	RegisterTagValidator(uniqueTagValidator{byPath: globalListMeta})
+	RegisterTagValidator(customUniqueTagValidator{byPath: globalListMeta})
+}
+
+// This applies to all tags in this file.
+var listTagsValidScopes = sets.New(ScopeType, ScopeField, ScopeListVal, ScopeMapKey, ScopeMapVal)
+
+type listOwnership string
+
+const (
+	ownershipSingle listOwnership = "single" // from listType=atomic
+	ownershipShared listOwnership = "shared" // from listType=set/map
+)
+
+type listSemantic string
+
+const (
+	semanticAtomic listSemantic = "atomic" // No uniqueness check
+	semanticSet    listSemantic = "set"    // uniqueness check
+	semanticMap    listSemantic = "map"    // uniqueness check based on key(s)
+)
+
+// listMetadata collects information about a single list with map or set semantics.
+type listMetadata struct {
+	ownership  listOwnership // For now we don't use it for generation.
+	semantic   listSemantic
+	keyMembers []*types.Member // For semantic == map.
+	keyNames   []string        // For semantic == map.
+
+	// customUnique indicates that k8s:customUnique is set on this list.
+	// It disables generation of uniqueness validation for this list.
+	customUnique   bool
+	stabilityLevel ValidationStabilityLevel
+}
+
+func (lm *listMetadata) check() error {
+	// Check some fundamental constraints on list tags.
+
+	// If we have listMapKey but no map semantics, that's an error
+	if len(lm.keyMembers) > 0 && lm.semantic != semanticMap {
+		return fmt.Errorf("found listMapKey without listType=map or unique=map")
+	}
+
+	// If we have map semantics but no keys, that's an error
+	if lm.semantic == semanticMap && len(lm.keyMembers) == 0 {
+		return fmt.Errorf("found listType=map or unique=map without listMapKey")
+	}
+
+	// listType is mandatory.
+	if lm.ownership == "" {
+		return fmt.Errorf("listType must be specified - use listType=atomic, listType=set, or listType=map")
+	}
+
+	return nil
+}
+
+// makeListMapMatchFunc generates a function that compares two list-map
+// elements by their list-map key fields.
+func (lm *listMetadata) makeListMapMatchFunc(t *types.Type) FunctionLiteral {
+	if lm.semantic != semanticMap {
+		panic("makeListMapMatchFunc called on a non-map list")
+	}
+	// If no keys are defined, we will throw a good error later.
+
+	matchFn := FunctionLiteral{
+		Parameters: []ParamResult{{"a", types.PointerTo(util.NonPointer(t))}, {"b", types.PointerTo(util.NonPointer(t))}},
+		Results:    []ParamResult{{"", types.Bool}},
+	}
+	buf := strings.Builder{}
+	buf.WriteString("return ")
+
+	for i, memb := range lm.keyMembers {
+		if i > 0 {
+			buf.WriteString(" && ")
+		}
+		fldName := memb.Name
+
+		if memb.Type.Kind == types.Pointer {
+			// Dereference pointers for comparison.
+			// This is tricky because they could be nil.
+			// Two keys are equal if all their fields are equal.
+			// For pointer fields, that means either both are nil,
+			// or neither is nil and the pointed-to values are equal.
+			buf.WriteString(fmt.Sprintf("((a.%s == nil && b.%s == nil) || (a.%s != nil && b.%s != nil && *a.%s == *b.%s))", fldName, fldName, fldName, fldName, fldName, fldName))
+		} else {
+			buf.WriteString(fmt.Sprintf("a.%s == b.%s", fldName, fldName))
+		}
+	}
+	matchFn.Body = buf.String()
+	return matchFn
+}
+
+type listTypeTagValidator struct {
+	byPath map[string]*listMetadata
+}
+
+func (listTypeTagValidator) Init(Config) {}
+
+func (listTypeTagValidator) TagName() string {
+	return listTypeTagName
+}
+
+func (listTypeTagValidator) ValidScopes() sets.Set[Scope] {
+	return listTagsValidScopes
+}
+
+func (lttv listTypeTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	// NOTE: pointers to lists are not supported, so we should never see a pointer here.
+	t := util.NativeType(context.Type)
+	if t.Kind != types.Slice && t.Kind != types.Array {
+		return Validations{}, fmt.Errorf("can only be used on list types (%s)", t.Kind)
+	}
+
+	lm := lttv.byPath[context.Path.String()]
+	if lm == nil {
+		lm = &listMetadata{}
+		lttv.byPath[context.Path.String()] = lm
+	}
+	lm.stabilityLevel = context.StabilityLevel
+	if lm.ownership != "" {
+		return Validations{}, fmt.Errorf("listType cannot be specified more than once")
+	}
+
+	switch tag.Value {
+	case "atomic":
+		lm.ownership = ownershipSingle
+		// Do not overwrite a more specific semantic from uniqueTagValidator
+		if lm.semantic == "" {
+			lm.semantic = semanticAtomic
+		}
+	case "set":
+		lm.ownership = ownershipShared
+		// If uniqueTagValidator has run for `unique=set` or `unique=map`,
+		// lm.semantic will be non-empty and non-atomic.
+		if lm.semantic != "" && lm.semantic != semanticAtomic {
+			return Validations{}, fmt.Errorf("unique tag is redundant for listType=%q", tag.Value)
+		}
+		lm.semantic = semanticSet
+	case "map":
+		lm.ownership = ownershipShared
+		// If uniqueTagValidator has run for `unique=set` or `unique=map`,
+		// lm.semantic will be non-empty and non-atomic.
+		if lm.semantic != "" && lm.semantic != semanticAtomic {
+			return Validations{}, fmt.Errorf("unique tag is redundant for listType=%q", tag.Value)
+		}
+		if util.NonPointer(util.NativeType(t.Elem)).Kind != types.Struct {
+			return Validations{}, fmt.Errorf("only lists of structs can be list-maps")
+		}
+		lm.semantic = semanticMap
+	default:
+		return Validations{}, fmt.Errorf("unknown list type %q", tag.Value)
+	}
+
+	return Validations{
+		Deferred: []DeferredGen{
+			Deferred(ThisContext, func() (Validations, error) {
+				return getListValidations(lttv.byPath, context)
+			}),
+		},
+	}, nil
+}
+
+func (lttv listTypeTagValidator) Docs() TagDoc {
+	doc := TagDoc{
+		Tag:            lttv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(lttv.ValidScopes()),
+		Description:    "Declares a list field's semantic type and ownership behavior. atomic: single ownership, set: shared ownership with uniqueness, map: shared ownership with key-based uniqueness.",
+		Payloads: []TagPayloadDoc{{
+			Description: "<type>",
+			Docs:        "atomic | map | set",
+		}},
+		PayloadsType:     codetags.ValueTypeString,
+		PayloadsRequired: true,
+	}
+	return doc
+}
+
+type listMapKeyTagValidator struct {
+	byPath map[string]*listMetadata
+}
+
+func (listMapKeyTagValidator) Init(Config) {}
+
+func (listMapKeyTagValidator) TagName() string {
+	return ListMapKeyTagName
+}
+
+func (listMapKeyTagValidator) ValidScopes() sets.Set[Scope] {
+	return listTagsValidScopes
+}
+
+func (lmktv listMapKeyTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	// NOTE: pointers to lists are not supported, so we should never see a pointer here.
+	t := util.NativeType(context.Type)
+	if t.Kind != types.Slice && t.Kind != types.Array {
+		return Validations{}, fmt.Errorf("can only be used on list types (%s)", t.Kind)
+	}
+	structT := util.NonPointer(util.NativeType(t.Elem))
+	if structT.Kind != types.Struct {
+		return Validations{}, fmt.Errorf("only lists of structs can be list-maps")
+	}
+
+	var memb *types.Member
+	if m := util.GetMemberByJSON(structT, tag.Value); m == nil {
+		return Validations{}, fmt.Errorf("no field for JSON name %q", tag.Value)
+	} else {
+		keyType := m.Type
+		if keyType.Kind == types.Pointer {
+			keyType = keyType.Elem
+		}
+		if util.NativeType(keyType).Kind != types.Builtin {
+			return Validations{}, fmt.Errorf("only primitive types and pointers to primitive types can be list-map keys, not %s", m.Type.String())
+		}
+		memb = m
+	}
+
+	lm := lmktv.byPath[context.Path.String()]
+	if lm == nil {
+		lm = &listMetadata{}
+		lmktv.byPath[context.Path.String()] = lm
+	}
+	lm.keyMembers = append(lm.keyMembers, memb)
+	lm.keyNames = append(lm.keyNames, tag.Value)
+
+	// Validations will be generated by listTypeTagValidator. This validator just computes the keys required for list-map.
+	return Validations{}, nil
+}
+
+func (lmktv listMapKeyTagValidator) Docs() TagDoc {
+	doc := TagDoc{
+		Tag:            lmktv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(lmktv.ValidScopes()),
+		Description:    "Declares a named sub-field of a list's value-type to be part of the list-map key.",
+		Payloads: []TagPayloadDoc{{
+			Description: "<field-json-name>",
+			Docs:        "The name of the field.",
+		}},
+		PayloadsType:     codetags.ValueTypeString,
+		PayloadsRequired: true,
+	}
+	return doc
+}
+
+type uniqueTagValidator struct {
+	byPath map[string]*listMetadata
+}
+
+func (uniqueTagValidator) Init(Config) {}
+
+func (uniqueTagValidator) TagName() string {
+	return uniqueTagName
+}
+
+func (uniqueTagValidator) ValidScopes() sets.Set[Scope] {
+	return listTagsValidScopes
+}
+
+func (utv uniqueTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	// NOTE: pointers to lists are not supported, so we should never see a pointer here.
+	t := util.NativeType(context.Type)
+	if t.Kind != types.Slice && t.Kind != types.Array {
+		return Validations{}, fmt.Errorf("can only be used on list types (%s)", t.Kind)
+	}
+
+	lm := utv.byPath[context.Path.String()]
+	if lm == nil {
+		lm = &listMetadata{}
+		utv.byPath[context.Path.String()] = lm
+	}
+
+	lm.stabilityLevel = context.StabilityLevel
+
+	// If listType has already run and set a non-atomic ownership, this is an error.
+	if lm.ownership != "" && lm.ownership != ownershipSingle {
+		return Validations{}, fmt.Errorf("unique tag may not be used with listType=set or listType=map")
+	}
+
+	if lm.semantic != "" && lm.semantic != semanticAtomic {
+		return Validations{}, fmt.Errorf("unique tag cannot be specified more than once")
+	}
+
+	switch tag.Value {
+	case "set":
+		lm.semantic = semanticSet
+	case "map":
+		if util.NonPointer(util.NativeType(t.Elem)).Kind != types.Struct {
+			return Validations{}, fmt.Errorf("only lists of structs can be list-maps")
+		}
+		lm.semantic = semanticMap
+	default:
+		return Validations{}, fmt.Errorf("unknown unique type %q", tag.Value)
+	}
+
+	return Validations{
+		Deferred: []DeferredGen{
+			Deferred(ThisContext, func() (Validations, error) {
+				return getListValidations(utv.byPath, context)
+			}),
+		},
+	}, nil
+}
+
+func (utv uniqueTagValidator) Docs() TagDoc {
+	doc := TagDoc{
+		Tag:            utv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(utv.ValidScopes()),
+		Description:    "Declares that a list field's elements are unique. This tag can be used with listType=atomic to add uniqueness constraints, or independently to specify uniqueness semantics.",
+		Payloads: []TagPayloadDoc{{
+			Description: "<type>",
+			Docs:        "map | set",
+		}},
+		PayloadsType:     codetags.ValueTypeString,
+		PayloadsRequired: true,
+	}
+	return doc
+}
+
+type customUniqueTagValidator struct {
+	byPath map[string]*listMetadata
+}
+
+func (customUniqueTagValidator) Init(Config) {}
+
+func (customUniqueTagValidator) TagName() string {
+	return customUniqueTagName
+}
+
+func (customUniqueTagValidator) ValidScopes() sets.Set[Scope] {
+	return listTagsValidScopes
+}
+
+func (cutv customUniqueTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	// NOTE: pointers to lists are not supported, so we should never see a pointer here.
+	t := util.NativeType(context.Type)
+	if t.Kind != types.Slice && t.Kind != types.Array {
+		return Validations{}, fmt.Errorf("can only be used on list types (%s)", t.Kind)
+	}
+
+	lm := cutv.byPath[context.Path.String()]
+	if lm == nil {
+		lm = &listMetadata{}
+		cutv.byPath[context.Path.String()] = lm
+	}
+
+	lm.customUnique = true
+
+	// Configures metadata, Validations are emitted by the ListValidator.
+	return Validations{}, nil
+}
+
+func (cutv customUniqueTagValidator) Docs() TagDoc {
+	doc := TagDoc{
+		Tag:            cutv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(cutv.ValidScopes()),
+		Description:    "Indicates that uniqueness validation for this list is implemented via custom, handwritten validation. This disables generation of uniqueness validation for this list.",
+		Payloads:       nil,
+	}
+	return doc
+}
+
+var (
+	validateValSliceUnique    = types.Name{Package: libValidationPkg, Name: "ValSliceUnique"}
+	validatePtrSliceUnique    = types.Name{Package: libValidationPkg, Name: "PtrSliceUnique"}
+	validateSemanticDeepEqual = DeepEqualImpl
+	validateDirectEqual       = types.Name{Package: libValidationPkg, Name: "DirectEqual"}
+)
+
+// getListMeta is a helper to find list metadata for a given context.
+func getListMeta(byPath map[string]*listMetadata, context Context) (*listMetadata, error) {
+	// Look up the list metadata which is defined on this field.
+	lm := byPath[context.Path.String()]
+
+	// NOTE: We don't really support list-of-list or map-of-list, so this does
+	// not consider the case of ScopeListVal or ScopeMapVal. If we want to
+	// support those, we need to look at this and make sure the paths work the
+	// way we need.
+	if context.Scope == ScopeField {
+		// If this is a field, look up the list metadata for the type.
+		tm := byPath[context.Type.String()]
+		if lm != nil && tm != nil {
+			return nil, fmt.Errorf("found list metadata for both a field and its type: %s", context.Path)
+		}
+		if tm != nil {
+			return tm, nil
+		}
+		// TODO(thockin): enable this once the whole codebase is converted or
+		// if we only run against fields which are opted-in.
+		// if lm == nil && tm == nil {
+		//       return Validations{}, fmt.Errorf("found a list field without list metadata")
+		// }
+	}
+	return lm, nil
+}
+
+// keep track of things we have already done
+var listsGenerated = map[string]bool{}
+
+// Finish work on the accumulated list metadata.
+func getListValidations(byPath map[string]*listMetadata, context Context) (Validations, error) {
+	nt := util.NativeType(context.Type)
+	if nt.Kind != types.Slice && nt.Kind != types.Array {
+		return Validations{}, nil
+	}
+
+	lm, err := getListMeta(byPath, context)
+	if err != nil {
+		return Validations{}, err
+	}
+
+	if lm == nil {
+		// If we don't have metadata for this field, we might have it for the
+		// field's type.
+		return Validations{}, nil
+	}
+
+	// If we have processed this path before, we don't want to do it again.
+	// This could be because there are multiple keys or even just a
+	// listType=map and listMapKey=field.
+	if p := context.Path.String(); listsGenerated[p] {
+		return Validations{}, nil
+	}
+	listsGenerated[context.Path.String()] = true
+
+	// Do this after the above - if we only get one error, the one(s) above
+	// this are more important.
+	if err := lm.check(); err != nil {
+		return Validations{}, err
+	}
+	result := Validations{}
+	if lm.customUnique {
+		// Uniqueness validation is disabled in generated validation for this list.
+		// It would defer to handwritten validation to check the uniqueness.
+		result.AddComment("Uniqueness validation is implemented via custom, handwritten validation")
+		return result, nil
+	}
+
+	// Generate uniqueness checks for lists with higher-order semantics.
+	if lm.semantic == semanticSet {
+		// Only compare primitive values when possible. Slices and maps are not
+		// comparable, and structs might hold pointer fields, which are directly
+		// comparable but not what we need.
+		//
+		matchArg := validateSemanticDeepEqual
+		if util.IsDirectComparable(util.NonPointer(util.NativeType(nt.Elem))) {
+			matchArg = validateDirectEqual
+		}
+		validateFunc := validateValSliceUnique
+		if nt.Elem.Kind == types.Pointer {
+			validateFunc = validatePtrSliceUnique
+		}
+		comment := "lists with set semantics require unique values"
+		f := Function("listValidator", DefaultFlags, validateFunc, Identifier(matchArg)).
+			WithComment(comment).
+			WithEmits(Emission{field.ErrorTypeDuplicate, "", "[*]"})
+		if lm.stabilityLevel != "" {
+			f = f.WithStabilityLevel(lm.stabilityLevel)
+		}
+		result.AddFunction(f)
+	}
+	if lm.semantic == semanticMap {
+		// TODO: There are some fields which are declared as maps which do not
+		// enforce uniqueness in manual validation. Those either need to not be
+		// maps or we need to allow types to opt-out from this validation.  SSA
+		// is also not able to handle these well.
+		matchArg := lm.makeListMapMatchFunc(nt.Elem)
+		validateFunc := validateValSliceUnique
+		if nt.Elem.Kind == types.Pointer {
+			validateFunc = validatePtrSliceUnique
+		}
+		comment := "lists with map semantics require unique keys"
+
+		f := Function("listValidator", DefaultFlags, validateFunc, matchArg).
+			WithComment(comment).
+			WithStabilityLevel(lm.stabilityLevel).
+			WithEmits(Emission{field.ErrorTypeDuplicate, "", "[*]"})
+		result.AddFunction(f)
+	}
+
+	return result, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/mode.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/mode.go
new file mode 100644
index 0000000000..2b7d8127ad
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/mode.go
@@ -0,0 +1,510 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+	"regexp"
+	"slices"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/parser/tags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	modeDiscriminatorTagName = "k8s:modeDiscriminator"
+	ifModeTagName            = "k8s:ifMode"
+)
+
+// validGroupNameRegex restricts discriminator group names to identifiers that
+// start with a letter and contain only alphanumeric characters and underscores.
+var validGroupNameRegex = regexp.MustCompile(`^[a-zA-Z][a-zA-Z0-9_]*$`)
+
+func init() {
+	RegisterTagValidator(&modeDiscriminatorTagValidator{discriminatorDefinitions})
+	RegisterTagValidator(&ifModeTagValidator{discriminatorDefinitions, nil})
+}
+
+// discriminatorDefinitions stores all discriminator definitions found by tag validators.
+// Key is the struct path.
+var discriminatorDefinitions = map[string]discriminatorGroups{}
+
+type discriminatorGroups map[string]*discriminatorGroup
+
+type discriminatorGroup struct {
+	name                string
+	discriminatorMember *types.Member
+	// members maps field names to their rules in this discriminator group.
+	members map[string]*fieldMemberRules
+}
+
+type fieldMemberRules struct {
+	member *types.Member
+	rules  []memberRule
+}
+
+type memberRule struct {
+	value          string
+	validations    Validations
+	stabilityLevel ValidationStabilityLevel
+}
+
+func (mg discriminatorGroups) getOrCreate(name string) *discriminatorGroup {
+	if name == "" {
+		name = "default"
+	}
+	g, ok := mg[name]
+	if !ok {
+		g = &discriminatorGroup{
+			name:    name,
+			members: make(map[string]*fieldMemberRules),
+		}
+		mg[name] = g
+	}
+	return g
+}
+
+type modeDiscriminatorTagValidator struct {
+	shared map[string]discriminatorGroups
+}
+
+func (mdtv *modeDiscriminatorTagValidator) Init(_ Config) {}
+
+func (mdtv *modeDiscriminatorTagValidator) TagName() string {
+	return modeDiscriminatorTagName
+}
+
+func (mdtv *modeDiscriminatorTagValidator) ValidScopes() sets.Set[Scope] {
+	return sets.New(ScopeField)
+}
+
+func (mdtv *modeDiscriminatorTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	if util.NativeType(context.Type).Kind == types.Pointer {
+		return Validations{}, fmt.Errorf("can only be used on non-pointer types")
+	}
+
+	if t := util.NonPointer(util.NativeType(context.Type)); t.Kind != types.Builtin || (t.Name.Name != "string" && t.Name.Name != "bool") {
+		return Validations{}, fmt.Errorf("can only be used on string or bool types (%s)", rootTypeString(context.Type, t))
+	}
+
+	if mdtv.shared[context.ParentPath.String()] == nil {
+		mdtv.shared[context.ParentPath.String()] = make(discriminatorGroups)
+	}
+	groupName := ""
+	if nameArg, ok := tag.NamedArg("modality"); ok {
+		groupName = nameArg.Value
+	}
+	if groupName != "" && !validGroupNameRegex.MatchString(groupName) {
+		return Validations{}, fmt.Errorf("discriminator group name must match %s, got %q", validGroupNameRegex.String(), groupName)
+	}
+	if groupName == "default" {
+		return Validations{}, fmt.Errorf("discriminator group name %q is reserved", groupName)
+	}
+	group := mdtv.shared[context.ParentPath.String()].getOrCreate(groupName)
+	if group.discriminatorMember != nil && group.discriminatorMember != context.Member {
+		return Validations{}, fmt.Errorf("duplicate discriminator: %q", groupName)
+	}
+	group.discriminatorMember = context.Member
+
+	// configures descriminator metadata, Validations are emitted by  modeDiscriminatorTagValidator.
+	return Validations{}, nil
+}
+
+func (mdtv *modeDiscriminatorTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            mdtv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(mdtv.ValidScopes()),
+		Description:    "Indicates that this field is a discriminator for state-based validation.",
+		Args: []TagArgDoc{{
+			Name:        "modality",
+			Description: "<string>",
+			Docs:        "the name of the discriminator group, if more than one exists",
+			Type:        codetags.ArgTypeString,
+		}},
+	}
+}
+
+type ifModeTagValidator struct {
+	shared    map[string]discriminatorGroups
+	validator TagValidationExtractor
+}
+
+func (imtv *ifModeTagValidator) Init(cfg Config) {
+	imtv.validator = cfg.TagValidator
+}
+
+func (imtv *ifModeTagValidator) TagName() string {
+	return ifModeTagName
+}
+
+func (imtv *ifModeTagValidator) ValidScopes() sets.Set[Scope] {
+	return sets.New(ScopeField)
+}
+
+func (imtv *ifModeTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	if tag.ValueTag == nil {
+		return Validations{}, fmt.Errorf("missing required payload")
+	}
+
+	groupName := ""
+	if modeArg, ok := tag.NamedArg("modality"); ok {
+		groupName = modeArg.Value
+	}
+	if groupName == "default" {
+		return Validations{}, fmt.Errorf("discriminator group name %q is reserved", groupName)
+	}
+
+	value := ""
+	if valArg, ok := tag.NamedArg("mode"); ok {
+		value = valArg.Value
+	} else if len(tag.Args) > 0 && tag.Args[0].Name == "" {
+		// Positional argument
+		value = tag.Args[0].Value
+	} else {
+		return Validations{}, fmt.Errorf("missing required mode")
+	}
+
+	if imtv.shared[context.ParentPath.String()] == nil {
+		imtv.shared[context.ParentPath.String()] = make(discriminatorGroups)
+	}
+	group := imtv.shared[context.ParentPath.String()].getOrCreate(groupName)
+
+	fieldName := context.Member.Name
+	if rules, ok := group.members[fieldName]; ok {
+		if rules.member != context.Member {
+			return Validations{}, fmt.Errorf("internal error: member mismatch for field %q", fieldName)
+		}
+	} else {
+		group.members[fieldName] = &fieldMemberRules{
+			member: context.Member,
+		}
+	}
+
+	payloadValidations, err := imtv.validator.ExtractTagValidations(context, *tag.ValueTag)
+	if err != nil {
+		return Validations{}, err
+	}
+
+	group.members[fieldName].rules = append(group.members[fieldName].rules, memberRule{
+		value:          value,
+		validations:    payloadValidations,
+		stabilityLevel: context.StabilityLevel,
+	})
+
+	return Validations{
+		Deferred: []DeferredGen{
+			Deferred(ParentContext, func() (Validations, error) {
+				return getDiscriminatorValidations(imtv.shared, context)
+			}),
+		},
+	}, nil
+}
+
+func (imtv *ifModeTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            imtv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(imtv.ValidScopes()),
+		Description:    "Indicates that this field's validation depends on a mode discriminator.",
+		Args: []TagArgDoc{{
+			Name:        "", // positional
+			Description: "<string>",
+			Docs:        "the value of the mode discriminator for which this validation applies",
+			Type:        codetags.ArgTypeString,
+		}, {
+			Name:        "modality",
+			Description: "<string>",
+			Docs:        "the name of the discriminator group",
+			Type:        codetags.ArgTypeString,
+		}, {
+			Name:        "mode",
+			Description: "<string>",
+			Docs:        "the mode value for which this validation applies",
+			Type:        codetags.ArgTypeString,
+		}},
+		PayloadsType:     codetags.ValueTypeTag,
+		PayloadsRequired: true,
+	}
+}
+
+func getDiscriminatorValidations(shared map[string]discriminatorGroups, context Context) (Validations, error) {
+	structPath := context.ParentPath.String()
+
+	// Extract the most concrete type possible.
+	if k := util.NonPointer(util.NativeType(context.ParentType)).Kind; k != types.Struct {
+		return Validations{}, nil
+	}
+
+	groups, ok := shared[structPath]
+	if !ok || len(groups) == 0 {
+		return Validations{}, nil
+	}
+	// deleting to ensure we don't process the same struct twice.
+	delete(shared, structPath)
+
+	var result Validations
+
+	// Sort group names for deterministic output
+	groupNames := make([]string, 0, len(groups))
+	for name := range groups {
+		groupNames = append(groupNames, name)
+	}
+	slices.Sort(groupNames)
+
+	for _, gn := range groupNames {
+		group := groups[gn]
+		if group.discriminatorMember == nil {
+			if len(group.members) > 0 {
+				if gn == "default" {
+					return Validations{}, fmt.Errorf("missing discriminator")
+				}
+				return Validations{}, fmt.Errorf("missing discriminator for group %q", gn)
+			}
+			continue
+		}
+		fieldNames := make([]string, 0, len(group.members))
+		for name := range group.members {
+			fieldNames = append(fieldNames, name)
+		}
+		slices.Sort(fieldNames)
+
+		for _, fn := range fieldNames {
+			rules := group.members[fn]
+			v, err := generateMemberFieldValidation(context.ParentType, group, rules)
+			if err != nil {
+				return Validations{}, err
+			}
+			result.Add(v)
+		}
+	}
+
+	return result, nil
+}
+
+func generateMemberFieldValidation(structType *types.Type, group *discriminatorGroup, rules *fieldMemberRules) (Validations, error) {
+	fieldType := rules.member.Type
+
+	// Use the nilable form to handle missing values.
+	nilableFieldType := fieldType
+	fieldExprPrefix := ""
+	if !util.IsNilableType(nilableFieldType) {
+		nilableFieldType = types.PointerTo(nilableFieldType)
+		fieldExprPrefix = "&"
+	}
+
+	// Get the JSON name of the field
+	jsonName := rules.member.Name
+	if jt, ok := tags.LookupJSON(*rules.member); ok {
+		jsonName = jt.Name
+	}
+
+	// Default-Forbidden runs at structPath.Child(jsonName) inside the
+	// Discriminated runtime; attribute it to "." + jsonName.
+	defaultForbidden, err := getForbiddenValidation(fieldType, "."+jsonName)
+	if err != nil {
+		return Validations{}, err
+	}
+
+	// Prepare DiscriminatedRules
+	// Mark each rule's validation functions with their stability level before
+	// aggregating by value, so that different rules for the same value can
+	// carry different stability levels.
+	rulesByValue := make(map[string]*Validations)
+	var values []string
+	for _, rule := range rules.rules {
+		// Track unique discriminator values in order of first appearance.
+		if _, ok := rulesByValue[rule.value]; !ok {
+			rulesByValue[rule.value] = &Validations{}
+			values = append(values, rule.value)
+		}
+		// Mark each validation function with its stability level before merging.
+		v := rule.validations
+		if rule.stabilityLevel != "" {
+			marked := make([]FunctionGen, len(v.Functions))
+			for i, f := range v.Functions {
+				marked[i] = f.WithStabilityLevel(rule.stabilityLevel)
+			}
+			v.Functions = marked
+		}
+		// Accumulate this rule's validations with others that share the same discriminator value.
+		rulesByValue[rule.value].Add(v)
+	}
+	slices.Sort(values)
+
+	// When all rules share the same stability level, the default-forbidden
+	// (which fires for unrecognized discriminator values) should also be marked
+	// with that level so its errors carry the same stability annotation.
+	if uniformLevel := uniformStabilityLevel(rules.rules); uniformLevel != "" {
+		mwf, ok := defaultForbidden.(MultiWrapperFunction)
+		if !ok {
+			return Validations{}, fmt.Errorf("internal error: defaultForbidden is not a MultiWrapperFunction")
+		}
+		marked := make([]FunctionGen, len(mwf.Functions))
+		for i, f := range mwf.Functions {
+			marked[i] = f.WithStabilityLevel(uniformLevel)
+		}
+		mwf.Functions = marked
+		defaultForbidden = mwf
+	}
+
+	discriminatorType := group.discriminatorMember.Type
+	var discriminatedRules []any
+	for _, val := range values {
+		wrapper := MultiWrapperFunction{
+			Functions: rulesByValue[val].Functions,
+			ObjType:   nilableFieldType,
+			// Per-mode rules also run at structPath.Child(jsonName).
+			PathFragment: "." + jsonName,
+		}
+
+		// Convert the string tag value to the appropriate typed Go literal
+		// for the discriminator type.
+		typedValue, err := convertDiscriminatorValue(val, discriminatorType)
+		if err != nil {
+			return Validations{}, fmt.Errorf("invalid discriminator value %q: %w", val, err)
+		}
+
+		discriminatedRules = append(discriminatedRules, StructLiteral{
+			Type:     types.Name{Package: libValidationPkg, Name: "DiscriminatedRule"},
+			TypeArgs: []*types.Type{nilableFieldType, discriminatorType},
+			Fields: []StructLiteralField{
+				{Name: "Value", Value: typedValue},
+				{Name: "Validation", Value: wrapper},
+			},
+		})
+	}
+
+	discriminatedValidator := types.Name{Package: libValidationPkg, Name: "Discriminated"}
+
+	rulesSlice := SliceLiteral{
+		ElementType:     types.Name{Package: libValidationPkg, Name: "DiscriminatedRule"},
+		ElementTypeArgs: []*types.Type{nilableFieldType, discriminatorType},
+		Elements:        discriminatedRules,
+	}
+
+	// getValue extractor
+	getValue := FunctionLiteral{
+		Parameters: []ParamResult{{Name: "obj", Type: types.PointerTo(structType)}},
+		Results:    []ParamResult{{Type: nilableFieldType}},
+		Body:       fmt.Sprintf("return %sobj.%s", fieldExprPrefix, rules.member.Name),
+	}
+
+	// getDiscriminator extractor
+	getDiscriminator := FunctionLiteral{
+		Parameters: []ParamResult{{Name: "obj", Type: types.PointerTo(structType)}},
+		Results:    []ParamResult{{Type: discriminatorType}},
+		Body:       fmt.Sprintf("return obj.%s", group.discriminatorMember.Name),
+	}
+
+	// directComparable is used to determine whether we can use the direct
+	// comparison operator "==" or need to use the semantic DeepEqual when
+	// looking up and comparing correlated list elements for validation ratcheting.
+	var equivArg any
+	if util.IsDirectComparable(util.NonPointer(util.NativeType(fieldType))) {
+		equivArg = Identifier(validateDirectEqual)
+	} else {
+		equivArg = Identifier(validateSemanticDeepEqual)
+	}
+
+	fn := Function(modeDiscriminatorTagName, DefaultFlags, discriminatedValidator,
+		Literal(fmt.Sprintf("%q", jsonName)),
+		getValue,
+		getDiscriminator,
+		equivArg,
+		defaultForbidden,
+		rulesSlice,
+	)
+	// Stability levels are already set on the wrapped validation functions, so
+	// skip the level wrapping in the upstream. Processing the stability level
+	// in the upstream will override the stability levels of the wrapped validators.
+	fn.StabilityLevelSelfManaged = true
+	return Validations{Functions: []FunctionGen{fn}}, nil
+}
+
+// uniformStabilityLevel returns the common stability level if all rules share
+// the same one, or "" if they differ.
+func uniformStabilityLevel(rules []memberRule) ValidationStabilityLevel {
+	level := rules[0].stabilityLevel
+	for i := 1; i < len(rules); i++ {
+		if rules[i].stabilityLevel != level {
+			return ""
+		}
+	}
+	return level
+}
+
+// getForbiddenValidation returns a MultiWrapperFunction wrapping the runtime
+// validate.Forbidden* call appropriate for t's kind. pathFragment is the
+// wrapper's PathFragment (see MultiWrapperFunction).
+func getForbiddenValidation(t *types.Type, pathFragment string) (any, error) {
+	var forbidden types.Name
+	nt := util.NativeType(t)
+	switch nt.Kind {
+	case types.Slice:
+		forbidden = types.Name{Package: libValidationPkg, Name: "ForbiddenSlice"}
+	case types.Map:
+		forbidden = types.Name{Package: libValidationPkg, Name: "ForbiddenMap"}
+	case types.Pointer:
+		forbidden = types.Name{Package: libValidationPkg, Name: "ForbiddenPointer"}
+	case types.Struct:
+		return nil, fmt.Errorf("discriminated member fields of struct type must be pointers")
+	default:
+		forbidden = types.Name{Package: libValidationPkg, Name: "ForbiddenValue"}
+	}
+
+	fg := Function(forbiddenTagName, DefaultFlags, forbidden).
+		WithEmits(Emission{field.ErrorTypeForbidden, "", ""})
+
+	// Use the nilable form to match standard validation function signatures.
+	wrapperObjType := t
+	if !util.IsNilableType(t) {
+		wrapperObjType = types.PointerTo(t)
+	}
+
+	return MultiWrapperFunction{
+		Functions:    []FunctionGen{fg},
+		ObjType:      wrapperObjType,
+		PathFragment: pathFragment,
+	}, nil
+}
+
+// convertDiscriminatorValue converts a string tag value to the appropriate
+// typed Go literal for the given discriminator type.
+func convertDiscriminatorValue(val string, discType *types.Type) (any, error) {
+	nt := util.NonPointer(util.NativeType(discType))
+	if nt.Kind != types.Builtin {
+		return nil, fmt.Errorf("unsupported discriminator type: %s", nt.Name.Name)
+	}
+
+	switch nt.Name.Name {
+	case "string":
+		return val, nil
+	case "bool":
+		b, err := util.ParseBool(val)
+		if err != nil {
+			return nil, fmt.Errorf("cannot parse %q as bool: %w", val, err)
+		}
+		return b, nil
+	default:
+		return nil, fmt.Errorf("unsupported discriminator type: %s", nt.Name.Name)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/monotonic.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/monotonic.go
new file mode 100644
index 0000000000..1db92c15b9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/monotonic.go
@@ -0,0 +1,70 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+func init() {
+	RegisterTagValidator(&monotonicTagValidator{})
+}
+
+const (
+	monotonicTagName = "k8s:monotonic"
+)
+
+var (
+	monotonicValidator = types.Name{Package: libValidationPkg, Name: "Monotonic"}
+)
+
+type monotonicTagValidator struct{}
+
+func (v *monotonicTagValidator) Init(_ Config) {}
+
+func (v *monotonicTagValidator) TagName() string {
+	return monotonicTagName
+}
+
+func (v *monotonicTagValidator) ValidScopes() sets.Set[Scope] {
+	return sets.New(ScopeType, ScopeField)
+}
+
+func (v *monotonicTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	t := util.NonPointer(util.NativeType(context.Type))
+	if !types.IsInteger(t) {
+		return Validations{}, fmt.Errorf("must be an integer type (got %s)", rootTypeString(context.Type, t))
+	}
+
+	result := Validations{}
+	result.AddFunction(Function(monotonicTagName, DefaultFlags, monotonicValidator))
+	return result, nil
+}
+
+func (v *monotonicTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            monotonicTagName,
+		StabilityLevel: TagStabilityLevelAlpha,
+		Scopes:         sets.List(v.ValidScopes()),
+		Description:    "ensures that a field's value never decreases on update",
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/opaque.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/opaque.go
new file mode 100644
index 0000000000..67ca904cc8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/opaque.go
@@ -0,0 +1,97 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	opaqueTypeTagName = "k8s:opaqueType"
+)
+
+// globalOpaqueTypes and globalOpaqueMembers record the set of types and struct
+// members tagged with +k8s:opaqueType, populated as opaqueTypeTagValidator
+// processes those tags. Other validators (currently subfield) consult these to
+// decide whether to inherit short-circuit validations from the field. Lookups
+// must therefore happen in a deferred callback so that all opaque tags have
+// been registered first.
+var (
+	globalOpaqueTypes   = map[*types.Type]bool{}
+	globalOpaqueMembers = map[*types.Member]bool{}
+)
+
+type opaqueTypeTagValidator struct{}
+
+func init() {
+	RegisterTagValidator(opaqueTypeTagValidator{})
+}
+
+func (opaqueTypeTagValidator) Init(Config) {}
+
+func (opaqueTypeTagValidator) TagName() string {
+	return opaqueTypeTagName
+}
+
+func (opaqueTypeTagValidator) ValidScopes() sets.Set[Scope] {
+	return sets.New(ScopeType, ScopeField, ScopeListVal, ScopeMapKey, ScopeMapVal)
+}
+
+func (opaqueTypeTagValidator) GetValidations(context Context, _ codetags.Tag) (Validations, error) {
+	// Store information about opaque types and fields, so that other validators
+	// don't have to extract it again.
+	switch context.Scope {
+	case ScopeType:
+		globalOpaqueTypes[util.NonPointer(util.NativeType(context.Type))] = true
+	case ScopeField:
+		if context.Member != nil {
+			globalOpaqueMembers[context.Member] = true
+		}
+	}
+	return Validations{OpaqueType: true}, nil
+}
+
+// isFieldOpaque reports whether the field or its type was tagged
+// +k8s:opaqueType. It reads from the package-level registries above, so
+// callers must invoke it from a deferred callback (or any other context
+// where opaque-tag processing has finished).
+func isFieldOpaque(context Context) bool {
+	if context.Member != nil && globalOpaqueMembers[context.Member] {
+		return true
+	}
+	if context.Type != nil && globalOpaqueTypes[util.NonPointer(util.NativeType(context.Type))] {
+		return true
+	}
+	return false
+}
+
+func (v opaqueTypeTagValidator) Docs() TagDoc {
+	doc := TagDoc{
+		Tag:            opaqueTypeTagName,
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(v.ValidScopes()),
+		Description: "Indicates that any validations declared on the referenced type will be ignored. " +
+			"If a referenced type's package is not included in the generator's current " +
+			"flags, this tag must be set, or code generation will fail (preventing silent " +
+			"mistakes). If the validations should not be ignored, add the type's package " +
+			"to the generator using the --readonly-pkg flag.",
+	}
+	return doc
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/options.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/options.go
new file mode 100644
index 0000000000..5e872f2277
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/options.go
@@ -0,0 +1,112 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	ifEnabledTag  = "k8s:ifEnabled"
+	ifDisabledTag = "k8s:ifDisabled"
+)
+
+func init() {
+	RegisterTagValidator(&ifTagValidator{true, nil})
+	RegisterTagValidator(&ifTagValidator{false, nil})
+}
+
+type ifTagValidator struct {
+	enabled   bool
+	validator TagValidationExtractor
+}
+
+func (itv *ifTagValidator) Init(cfg Config) {
+	itv.validator = cfg.TagValidator
+}
+
+func (itv ifTagValidator) TagName() string {
+	if itv.enabled {
+		return ifEnabledTag
+	}
+	return ifDisabledTag
+}
+
+var ifEnabledDisabledTagValidScopes = sets.New(ScopeType, ScopeField, ScopeListVal, ScopeMapKey, ScopeMapVal, ScopeConst)
+
+func (ifTagValidator) ValidScopes() sets.Set[Scope] {
+	return ifEnabledDisabledTagValidScopes
+}
+
+var (
+	ifOption = types.Name{Package: libValidationPkg, Name: "IfOption"}
+)
+
+func (itv ifTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	optionArg, ok := tag.PositionalArg()
+	if !ok {
+		return Validations{}, fmt.Errorf("missing required option name positional argument")
+	}
+
+	validations, err := itv.validator.ExtractTagValidations(context, *tag.ValueTag)
+	if err != nil {
+		return Validations{}, err
+	}
+
+	return WrapFunctions(validations, func(fn FunctionGen, scope DeferredScope) FunctionGen {
+		objType := context.Type
+		if scope == ParentContext {
+			objType = context.ParentType
+		}
+
+		return Function(itv.TagName(), fn.Flags, ifOption, optionArg.Value, itv.enabled, WrapperFunction{Function: fn, ObjType: objType})
+	}), nil
+}
+
+func (itv ifTagValidator) Docs() TagDoc {
+	doc := TagDoc{
+		Tag:            itv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Args: []TagArgDoc{{
+			Description: "<option>",
+			Type:        codetags.ArgTypeString,
+			Required:    true,
+		}},
+		Scopes: sets.List(itv.ValidScopes()),
+	}
+
+	doc.PayloadsType = codetags.ValueTypeTag
+	doc.PayloadsRequired = true
+	if itv.enabled {
+		doc.Description = "Declares a validation that only applies when an option is enabled."
+		doc.Payloads = []TagPayloadDoc{{
+			Description: "<validation-tag>",
+			Docs:        "This validation tag will be evaluated only if the validation option is enabled.",
+		}}
+	} else {
+		doc.Description = "Declares a validation that only applies when an option is disabled."
+		doc.Payloads = []TagPayloadDoc{{
+			Description: "<validation-tag>",
+			Docs:        "This validation tag will be evaluated only if the validation option is disabled.",
+		}}
+	}
+	return doc
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/registry.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/registry.go
new file mode 100644
index 0000000000..90806d388c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/registry.go
@@ -0,0 +1,269 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"cmp"
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+	"sync"
+	"sync/atomic"
+
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/generator"
+)
+
+// This is the global registry of tag validators. For simplicity this is in
+// the same package as the implementations, but it should not be used directly.
+var globalRegistry = &registry{
+	tagValidators: map[string]TagValidator{},
+}
+
+// registry holds a list of registered tags.
+type registry struct {
+	lock        sync.Mutex
+	initialized atomic.Bool // init() was called
+
+	tagValidators map[string]TagValidator // keyed by tagname
+	tagIndex      []string                // all tag names
+}
+
+func (reg *registry) addTagValidator(tv TagValidator) {
+	if reg.initialized.Load() {
+		panic("registry was modified after init")
+	}
+
+	reg.lock.Lock()
+	defer reg.lock.Unlock()
+
+	name := tv.TagName()
+	if _, exists := globalRegistry.tagValidators[name]; exists {
+		panic(fmt.Sprintf("tag %q was registered twice", name))
+	}
+	switch level := tv.Docs().StabilityLevel; level {
+	case TagStabilityLevelAlpha, TagStabilityLevelBeta, TagStabilityLevelStable:
+		// valid
+	case "":
+		panic(fmt.Sprintf("tag %q is missing stability level", name))
+	default:
+		panic(fmt.Sprintf("tag %q has invalid stability level %q", name, level))
+	}
+	globalRegistry.tagValidators[name] = tv
+}
+
+func (reg *registry) init(c *generator.Context, inputToCanonicalPkg map[string]string) {
+	if reg.initialized.Load() {
+		panic("registry.init() was called twice")
+	}
+
+	reg.lock.Lock()
+	defer reg.lock.Unlock()
+
+	cfg := Config{
+		GengoContext:        c,
+		TagValidator:        reg,
+		InputToCanonicalPkg: inputToCanonicalPkg,
+	}
+
+	for _, tv := range globalRegistry.tagValidators {
+		reg.tagIndex = append(reg.tagIndex, tv.TagName())
+		tv.Init(cfg)
+	}
+	sort.Strings(reg.tagIndex)
+
+	reg.initialized.Store(true)
+}
+
+func (reg *registry) ExtractTags(_ Context, comments []string) ([]codetags.Tag, error) {
+	extracted := codetags.Extract("+", comments)
+	var tags []codetags.Tag
+	for tagName, lines := range extracted {
+		if !slices.Contains(reg.tagIndex, tagName) {
+			continue
+		}
+		t, err := codetags.ParseAll(lines)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse tags: %w: %s", err, lines)
+		}
+		tags = append(tags, t...)
+	}
+	return tags, nil
+}
+
+// ExtractValidations considers the given context (e.g. a type definition) and
+// evaluates registered validators.  This includes type validators (which run
+// against all types) and tag validators which run only if a specific tag is
+// found in the associated comment block.  Any matching validators produce zero
+// or more validations, which will later be rendered by the code-generation
+// logic.
+func (reg *registry) ExtractValidations(context Context, tags ...codetags.Tag) (Validations, error) {
+	if !reg.initialized.Load() {
+		panic("registry.init() was not called")
+	}
+
+	validations, err := reg.ExtractTagValidations(context, tags...)
+	if err != nil {
+		return Validations{}, err
+	}
+
+	return validations, nil
+}
+
+func (reg *registry) ExtractTagValidations(context Context, tags ...codetags.Tag) (Validations, error) {
+	if !reg.initialized.Load() {
+		panic("registry.init() was not called")
+	}
+	accumulatedValidations := Validations{}
+	tags = reg.sortTags(tags)
+	for _, tag := range tags {
+		tv := reg.tagValidators[tag.Name]
+		// At this point we know tv exists and is not nil due to the upfront check
+		if scopes := tv.ValidScopes(); !scopes.Has(context.Scope) {
+			return Validations{}, fmt.Errorf("tag %q cannot be specified on %s", tv.TagName(), context.Scope)
+		}
+		if err := typeCheck(tag, tv.Docs()); err != nil {
+			return Validations{}, fmt.Errorf("tag %q: %w", tv.TagName(), err)
+		}
+		if theseValidations, err := tv.GetValidations(context, tag); err != nil {
+			return Validations{}, fmt.Errorf("tag %q: %w", tv.TagName(), err)
+		} else {
+			accumulatedValidations.Add(theseValidations)
+		}
+	}
+	return accumulatedValidations, nil
+}
+
+func (reg *registry) sortTags(tags []codetags.Tag) []codetags.Tag {
+	// First sort all tags by their name, so the final output is deterministic.
+	// It is important to do this before validations are generated.
+	//
+	// Some tags are "meta" tags which wrap other tags. For example:
+	//
+	//   // +k8s:validateFalse="111"
+	//   // +k8s:validateFalse="222"
+	//   // +k8s:ifEnabled(Foo)=+k8s:validateFalse="333"
+	//
+	// Tag extraction will group these by tag name. The first two are
+	// instances of "k8s:validateFalse", while the third is an instance of
+	// "k8s:ifEnabled".
+	//
+	// Without sorting, the order in which tag validators are called is not defined
+	// (map iteration). This can lead to non-deterministic order of the generated
+	// validations. By sorting the tags by name first, we ensure that "k8s:ifEnabled"
+	// is processed before or after "k8s:validateFalse" consistently, allowing the
+	// "k8s:validateFalse" tags to remain grouped together. The tags for each name
+	// are processed in order of appearance, so relative ordering is preserved.
+	sortedTags := make([]codetags.Tag, len(tags))
+	copy(sortedTags, tags)
+
+	slices.SortFunc(sortedTags, func(a, b codetags.Tag) int {
+		return cmp.Compare(a.Name, b.Name)
+	})
+
+	return sortedTags
+}
+
+// Docs returns documentation for each tag in this registry.
+func (reg *registry) Docs() []TagDoc {
+	var result []TagDoc
+	for _, k := range reg.tagIndex {
+		v := reg.tagValidators[k]
+		result = append(result, v.Docs())
+	}
+	return result
+}
+
+// RegisterTagValidator must be called for TagValidator to be used by
+// validation-gen. See TagValidator for more information.
+func RegisterTagValidator(tv TagValidator) {
+	globalRegistry.addTagValidator(tv)
+}
+
+// TagValidationExtractor represents an aggregation of validator plugins.
+type TagValidationExtractor interface {
+	// ExtractTagValidations extracts all validations associated with the given tags.
+	// Some tag validators may update internal state and then return deferred
+	// validations.
+	ExtractTagValidations(context Context, Tags ...codetags.Tag) (Validations, error)
+}
+
+// ValidationExtractor represents an aggregation of validator plugins.
+type ValidationExtractor interface {
+
+	// ExtractTags extracts Tags from comment lines.
+	ExtractTags(context Context, comments []string) ([]codetags.Tag, error)
+
+	// ExtractValidations considers the given context (e.g. a type definition) and
+	// evaluates registered validators.  This includes type validators (which run
+	// against all types) and tag validators which run only if a specific tag is
+	// found in the associated comment block.  Any matching validators produce zero
+	// or more validations, which will later be rendered by the code-generation
+	// logic.
+	ExtractValidations(context Context, Tags ...codetags.Tag) (Validations, error)
+
+	// A ValidationExtractor is also a TagValidationExtractor.
+	TagValidationExtractor
+
+	// Docs returns documentation for each known tag.
+	Docs() []TagDoc
+
+	// Stability returns the stability level for a given tag.
+	Stability(tag string) (TagStabilityLevel, error)
+
+	// IsKnownTag returns true if the tag is a registered validation tag.
+	IsKnownTag(tag string) bool
+}
+
+// Stability returns the stability level for a given tag.
+func (reg *registry) Stability(tag string) (TagStabilityLevel, error) {
+	tagName := strings.TrimPrefix(tag, "+")
+	tv, ok := reg.tagValidators[tagName]
+	if !ok {
+		return "", fmt.Errorf("tag %q doesn't have stability level", tag)
+	}
+
+	if tv.Docs().StabilityLevel == "" {
+		return "", fmt.Errorf("tag %q doesn't have stability level", tag)
+	}
+	return tv.Docs().StabilityLevel, nil
+}
+
+// GetStability returns the stability level for a given tag from the global registry.
+func GetStability(tag string) (TagStabilityLevel, error) {
+	return globalRegistry.Stability(tag)
+}
+
+// IsKnownTag returns true if the tag has been registered as a validation tag.
+func (reg *registry) IsKnownTag(tag string) bool {
+	_, err := reg.Stability(tag)
+	return err == nil
+}
+
+// IsKnownTag returns true if the given tag is a registered validation tag.
+func IsKnownTag(tag string) bool {
+	return globalRegistry.IsKnownTag(tag)
+}
+
+// InitGlobalValidator must be called exactly once by the main application to
+// initialize and safely access the global tag registry.  Once this is called,
+// no more validators may be registered.
+func InitGlobalValidator(c *generator.Context, inputToCanonicalPkg map[string]string) ValidationExtractor {
+	globalRegistry.init(c, inputToCanonicalPkg)
+	return globalRegistry
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/registry_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/registry_test.go
new file mode 100644
index 0000000000..937c451b64
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/registry_test.go
@@ -0,0 +1,92 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"testing"
+)
+
+func TestGetStability(t *testing.T) {
+	tests := []struct {
+		tagName     string
+		expected    TagStabilityLevel
+		expectError bool
+	}{
+		{
+			tagName:  "k8s:validateTrueAlpha",
+			expected: TagStabilityLevelAlpha,
+		},
+		{
+			tagName:  "k8s:validateTrueBeta",
+			expected: TagStabilityLevelBeta,
+		},
+		{
+			tagName:  "k8s:required",
+			expected: TagStabilityLevelStable,
+		},
+		{
+			tagName:     "k8s:unknownTag",
+			expected:    "",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.tagName, func(t *testing.T) {
+			got, err := GetStability(tt.tagName)
+			if err != nil && !tt.expectError {
+				t.Errorf("Unexpected error: %v", err)
+			}
+			if got != tt.expected {
+				t.Errorf("GetStability(%q) = %v, want %v", tt.tagName, got, tt.expected)
+			}
+		})
+	}
+}
+
+func TestIsKnownTag(t *testing.T) {
+	tests := []struct {
+		tagName  string
+		expected bool
+	}{
+		{
+			tagName:  "k8s:validateTrueAlpha",
+			expected: true,
+		},
+		{
+			tagName:  "k8s:validateTrueBeta",
+			expected: true,
+		},
+		{
+			tagName:  "k8s:required",
+			expected: true,
+		},
+		{
+			tagName:  "k8s:unknownTag",
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.tagName, func(t *testing.T) {
+			got := IsKnownTag(tt.tagName)
+			if got != tt.expected {
+				t.Errorf("IsKnownTag(%q) = %v, want %v", tt.tagName, got, tt.expected)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/required.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/required.go
new file mode 100644
index 0000000000..f4d73ad668
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/required.go
@@ -0,0 +1,337 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	requiredTagName  = "k8s:required"
+	optionalTagName  = "k8s:optional"
+	forbiddenTagName = "k8s:forbidden"
+	defaultTagName   = "default" // TODO: this should eventually be +k8s:default
+)
+
+func init() {
+	RegisterTagValidator(requirednessTagValidator{requirednessRequired})
+	RegisterTagValidator(requirednessTagValidator{requirednessOptional})
+	RegisterTagValidator(requirednessTagValidator{requirednessForbidden})
+}
+
+// requirednessTagValidator implements multiple modes of requiredness.
+type requirednessTagValidator struct {
+	mode requirednessMode
+}
+
+type requirednessMode string
+
+const (
+	requirednessRequired  requirednessMode = requiredTagName
+	requirednessOptional  requirednessMode = optionalTagName
+	requirednessForbidden requirednessMode = forbiddenTagName
+)
+
+func (requirednessTagValidator) Init(_ Config) {}
+
+func (rtv requirednessTagValidator) TagName() string {
+	return string(rtv.mode)
+}
+
+var requirednessTagValidScopes = sets.New(ScopeField)
+
+func (requirednessTagValidator) ValidScopes() sets.Set[Scope] {
+	return requirednessTagValidScopes
+}
+
+func (rtv requirednessTagValidator) GetValidations(context Context, _ codetags.Tag) (Validations, error) {
+	switch rtv.mode {
+	case requirednessRequired:
+		return rtv.doRequired(context)
+	case requirednessOptional:
+		return rtv.doOptional(context)
+	case requirednessForbidden:
+		return rtv.doForbidden(context)
+	}
+	panic(fmt.Sprintf("unknown requiredness mode: %q", rtv.mode))
+}
+
+var (
+	requiredValueValidator   = types.Name{Package: libValidationPkg, Name: "RequiredValue"}
+	requiredPointerValidator = types.Name{Package: libValidationPkg, Name: "RequiredPointer"}
+	requiredSliceValidator   = types.Name{Package: libValidationPkg, Name: "RequiredSlice"}
+	requiredMapValidator     = types.Name{Package: libValidationPkg, Name: "RequiredMap"}
+)
+
+// TODO: It might be valuable to have a string payload for when requiredness is
+// conditional (e.g. required when <otherfield> is specified).
+func (rtv requirednessTagValidator) doRequired(context Context) (Validations, error) {
+	// Most validators don't care whether the value they are validating was
+	// originally defined as a value-type or a pointer-type in the API.  This
+	// one does.  Since Go doesn't do partial specialization of templates, we
+	// do manual dispatch here.
+	emits := Emission{field.ErrorTypeRequired, "", ""}
+	switch util.NativeType(context.Type).Kind {
+	case types.Slice:
+		return Validations{Functions: []FunctionGen{Function(requiredTagName, ShortCircuit, requiredSliceValidator).WithEmits(emits)}}, nil
+	case types.Map:
+		return Validations{Functions: []FunctionGen{Function(requiredTagName, ShortCircuit, requiredMapValidator).WithEmits(emits)}}, nil
+	case types.Pointer:
+		return Validations{Functions: []FunctionGen{Function(requiredTagName, ShortCircuit, requiredPointerValidator).WithEmits(emits)}}, nil
+	case types.Struct:
+		// The +k8s:required tag on a non-pointer struct is not supported.
+		// If you encounter this error and believe you have a valid use case
+		// for forbiddening a non-pointer struct, please let us know! We need
+		// to understand your scenario to determine if we need to adjust
+		// this behavior or provide alternative validation mechanisms.
+		return Validations{}, fmt.Errorf("non-pointer structs cannot use the %q tag", requiredTagName)
+	}
+	return Validations{Functions: []FunctionGen{Function(requiredTagName, ShortCircuit, requiredValueValidator).WithEmits(emits)}}, nil
+}
+
+var (
+	optionalValueValidator   = types.Name{Package: libValidationPkg, Name: "OptionalValue"}
+	optionalPointerValidator = types.Name{Package: libValidationPkg, Name: "OptionalPointer"}
+	optionalSliceValidator   = types.Name{Package: libValidationPkg, Name: "OptionalSlice"}
+	optionalMapValidator     = types.Name{Package: libValidationPkg, Name: "OptionalMap"}
+)
+
+func (rtv requirednessTagValidator) doOptional(context Context) (Validations, error) {
+	// All of our tags are expressed from the perspective of a client of the
+	// API, but the code we generate is for the server. Optional is tricky.
+	//
+	// A field which is marked as optional and does not have a default is
+	// strictly optional. A client is allowed to not set it and the server will
+	// not give it a default value. Code which consumes it must handle that it
+	// might not have any value at all.
+	//
+	// A field which is marked as optional but has a default is optional to
+	// clients, but required to the server. A client is allowed to not set it
+	// but the server will give it a default value. Code which consumes it can
+	// assume that it always has a value.
+	//
+	// One special case must be handled: optional non-pointer fields with
+	// default values. If the default is not the zero value for the type, then
+	// the zero value is used to decide whether to assign the default value,
+	// and so must be out of bounds; we can proceed as above.
+	//
+	// But if the default is the zero value, then the zero value is obviously
+	// valid, and the fact that the field is optional is meaningless - there is
+	// no way to tell the difference between a client not setting it (yielding
+	// the zero value) and a client setting it to the zero value.
+	//
+	// TODO: handle default=ref(...)
+	// TODO: handle manual defaulting
+	if hasDefault, zeroDefault, err := rtv.hasZeroDefault(context); err != nil {
+		return Validations{}, err
+	} else if hasDefault {
+		if !util.IsNilableType(context.Type) && zeroDefault {
+			return Validations{Comments: []string{"optional value-type fields with zero-value defaults are purely documentation"}}, nil
+		}
+		validations, err := rtv.doRequired(context)
+		if err != nil {
+			return Validations{}, err
+		}
+		for i, fn := range validations.Functions {
+			validations.Functions[i] = fn.WithComment("optional fields with default values are effectively required")
+		}
+		return validations, nil
+	}
+
+	// Most validators don't care whether the value they are validating was
+	// originally defined as a value-type or a pointer-type in the API.  This
+	// one does.  Since Go doesn't do partial specialization of templates, we
+	// do manual dispatch here.
+	switch util.NativeType(context.Type).Kind {
+	case types.Slice:
+		return Validations{Functions: []FunctionGen{Function(optionalTagName, ShortCircuit|NonError, optionalSliceValidator)}}, nil
+	case types.Map:
+		return Validations{Functions: []FunctionGen{Function(optionalTagName, ShortCircuit|NonError, optionalMapValidator)}}, nil
+	case types.Pointer:
+		return Validations{Functions: []FunctionGen{Function(optionalTagName, ShortCircuit|NonError, optionalPointerValidator)}}, nil
+	case types.Struct:
+		// The +k8s:optional tag on a non-pointer struct is not supported.
+		// If you encounter this error and believe you have a valid use case
+		// for forbiddening a non-pointer struct, please let us know! We need
+		// to understand your scenario to determine if we need to adjust
+		// this behavior or provide alternative validation mechanisms.
+		return Validations{}, fmt.Errorf("non-pointer structs cannot use the %q tag", optionalTagName)
+	}
+	return Validations{Functions: []FunctionGen{Function(optionalTagName, ShortCircuit|NonError, optionalValueValidator)}}, nil
+}
+
+// hasZeroDefault returns whether the field has a default value and whether
+// that default value is the zero value for the field's type.
+func (rtv requirednessTagValidator) hasZeroDefault(context Context) (bool, bool, error) {
+	// This validator only applies to fields, so Member must be valid.
+	tagsByName, err := gengo.ExtractFunctionStyleCommentTags("+", []string{defaultTagName}, context.Member.CommentLines)
+	if err != nil {
+		return false, false, fmt.Errorf("failed to read tags: %w", err)
+	}
+
+	tags, hasDefault := tagsByName[defaultTagName]
+	if !hasDefault {
+		return false, false, nil
+	}
+	if len(tags) == 0 {
+		return false, false, fmt.Errorf("+default tag with no value")
+	}
+	if len(tags) > 1 {
+		return false, false, fmt.Errorf("+default tag with multiple values: %q", tags)
+	}
+
+	payload := tags[0].Value
+	var defaultValue any
+	if err := json.Unmarshal([]byte(payload), &defaultValue); err != nil {
+		return false, false, fmt.Errorf("failed to parse default value %q: %w", payload, err)
+	}
+	if defaultValue == nil {
+		return false, false, fmt.Errorf("failed to parse default value %q: unmarshalled to nil", payload)
+	}
+
+	// For nilable types (pointer, slice, map, interface), the caller
+	// ignores zeroDefault and always treats a field-with-default as
+	// effectively required. Skip the zero-value comparison.
+	if util.IsNilableType(context.Type) {
+		return true, false, nil
+	}
+
+	t := util.NonPointer(util.NativeType(context.Type))
+	zero, found := typeZeroValue[t.String()]
+	if !found {
+		return false, false, fmt.Errorf("unknown zero-value for type %s", t.String())
+	}
+
+	return true, reflect.DeepEqual(defaultValue, zero), nil
+}
+
+// This is copied from defaulter-gen.
+// TODO: move this back to gengo as Type.ZeroValue()?
+var typeZeroValue = map[string]any{
+	"uint":        0.,
+	"uint8":       0.,
+	"uint16":      0.,
+	"uint32":      0.,
+	"uint64":      0.,
+	"int":         0.,
+	"int8":        0.,
+	"int16":       0.,
+	"int32":       0.,
+	"int64":       0.,
+	"byte":        0.,
+	"float64":     0.,
+	"float32":     0.,
+	"bool":        false,
+	"time.Time":   "",
+	"string":      "",
+	"integer":     0.,
+	"number":      0.,
+	"boolean":     false,
+	"[]byte":      "", // base64 encoded characters
+	"interface{}": interface{}(nil),
+	"any":         interface{}(nil),
+}
+
+var (
+	forbiddenValueValidator   = types.Name{Package: libValidationPkg, Name: "ForbiddenValue"}
+	forbiddenPointerValidator = types.Name{Package: libValidationPkg, Name: "ForbiddenPointer"}
+	forbiddenSliceValidator   = types.Name{Package: libValidationPkg, Name: "ForbiddenSlice"}
+	forbiddenMapValidator     = types.Name{Package: libValidationPkg, Name: "ForbiddenMap"}
+)
+
+// TODO: It might be valuable to have a string payload for when forbidden is
+// conditional (e.g. forbidden when <option> is disabled).
+func (requirednessTagValidator) doForbidden(context Context) (Validations, error) {
+	// Forbidden is weird.  Each of these emits two checks, which are polar
+	// opposites.  If the field fails the forbidden check, it will
+	// short-circuit and not run the optional check.  If it passes the
+	// forbidden check, it must not be specified, so it will "fail" the
+	// optional check and short-circuit (but without error).  Why?  For
+	// example, this prevents any further validation from trying to run on a
+	// nil pointer.
+	// The optional* siblings carry the NonError flag (they don't produce
+	// errors, just short-circuit), so they get no Emission.
+	forbids := Emission{field.ErrorTypeForbidden, "", ""}
+	switch util.NativeType(context.Type).Kind {
+	case types.Slice:
+		return Validations{
+			Functions: []FunctionGen{
+				Function(forbiddenTagName, ShortCircuit, forbiddenSliceValidator).WithEmits(forbids),
+				Function(forbiddenTagName, ShortCircuit|NonError, optionalSliceValidator),
+			},
+		}, nil
+	case types.Map:
+		return Validations{
+			Functions: []FunctionGen{
+				Function(forbiddenTagName, ShortCircuit, forbiddenMapValidator).WithEmits(forbids),
+				Function(forbiddenTagName, ShortCircuit|NonError, optionalMapValidator),
+			},
+		}, nil
+	case types.Pointer:
+		return Validations{
+			Functions: []FunctionGen{
+				Function(forbiddenTagName, ShortCircuit, forbiddenPointerValidator).WithEmits(forbids),
+				Function(forbiddenTagName, ShortCircuit|NonError, optionalPointerValidator),
+			},
+		}, nil
+	case types.Struct:
+		// The +k8s:forbidden tag on a non-pointer struct is not supported.
+		// If you encounter this error and believe you have a valid use case
+		// for forbiddening a non-pointer struct, please let us know! We need
+		// to understand your scenario to determine if we need to adjust
+		// this behavior or provide alternative validation mechanisms.
+		return Validations{}, fmt.Errorf("non-pointer structs cannot use the %q tag", forbiddenTagName)
+	}
+	return Validations{
+		Functions: []FunctionGen{
+			Function(forbiddenTagName, ShortCircuit, forbiddenValueValidator).WithEmits(forbids),
+			Function(forbiddenTagName, ShortCircuit|NonError, optionalValueValidator),
+		},
+	}, nil
+}
+
+func (rtv requirednessTagValidator) Docs() TagDoc {
+	doc := TagDoc{
+		Tag:    rtv.TagName(),
+		Scopes: sets.List(rtv.ValidScopes()),
+	}
+
+	switch rtv.mode {
+	case requirednessRequired:
+		doc.StabilityLevel = TagStabilityLevelStable
+		doc.Description = "Indicates that a field must be specified by clients."
+	case requirednessOptional:
+		doc.StabilityLevel = TagStabilityLevelStable
+		doc.Description = "Indicates that a field is optional to clients."
+	case requirednessForbidden:
+		doc.StabilityLevel = TagStabilityLevelBeta
+		doc.Description = "Indicates that a field may not be specified."
+	default:
+		panic(fmt.Sprintf("unknown requiredness mode: %q", rtv.mode))
+	}
+
+	return doc
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/subfield.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/subfield.go
new file mode 100644
index 0000000000..0bff2c21a5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/subfield.go
@@ -0,0 +1,242 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	subfieldTagName = "k8s:subfield"
+)
+
+func init() {
+	RegisterTagValidator(&subfieldTagValidator{})
+}
+
+type subfieldTagValidator struct {
+	validator              TagValidationExtractor
+	processedShortCircuits map[string]bool
+}
+
+func (stv *subfieldTagValidator) Init(cfg Config) {
+	stv.validator = cfg.TagValidator
+	stv.processedShortCircuits = make(map[string]bool)
+}
+
+func (*subfieldTagValidator) TagName() string {
+	return subfieldTagName
+}
+
+var subfieldTagValidScopes = sets.New(ScopeType, ScopeField, ScopeListVal, ScopeMapKey, ScopeMapVal)
+
+func (*subfieldTagValidator) ValidScopes() sets.Set[Scope] {
+	return subfieldTagValidScopes
+}
+
+var (
+	validateSubfield = types.Name{Package: libValidationPkg, Name: "Subfield"}
+)
+
+func (stv *subfieldTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	// TODO: Support nested subfields once the generated validation code can
+	// prevent nil pointer dereferences by checking optionality or requiredness
+	// for intermediate fields.
+	for t := tag.ValueTag; t != nil; t = t.ValueTag {
+		if t.Name == subfieldTagName {
+			return Validations{}, fmt.Errorf("nested +%s tags are unsupported; apply validations directly to the nested type instead", subfieldTagName)
+		}
+	}
+
+	args := tag.Args
+	// This tag can apply to value and pointer fields, as well as typedefs
+	// (which should never be pointers). We need to check the concrete type.
+	t := context.Type
+	nt := util.NonPointer(util.NativeType(t))
+	if nt.Kind != types.Struct {
+		return Validations{}, fmt.Errorf("can only be used on struct types: %v", nt.Kind)
+	}
+	subname := args[0].Value
+	submemb := util.GetMemberByJSON(nt, subname)
+	if submemb == nil {
+		return Validations{}, fmt.Errorf("no field for json name %q", subname)
+	}
+
+	subContext := Context{
+		Scope:          ScopeField,
+		Type:           submemb.Type,
+		Path:           context.Path.Child(subname),
+		Member:         submemb,
+		ParentPath:     context.Path,
+		ParentType:     context.Type,
+		StabilityLevel: context.StabilityLevel,
+	}
+
+	nilableStructType := context.Type
+	if !util.IsNilableType(nilableStructType) {
+		nilableStructType = types.PointerTo(nilableStructType)
+	}
+
+	nilableFieldType := submemb.Type
+	fieldExprPrefix := ""
+	if !util.IsNilableType(nilableFieldType) {
+		nilableFieldType = types.PointerTo(nilableFieldType)
+		fieldExprPrefix = "&"
+	}
+
+	// getFn is the function that retrieves the subfield value from the
+	// struct.
+	getFn := FunctionLiteral{
+		Parameters: []ParamResult{{"o", nilableStructType}},
+		Results:    []ParamResult{{"", nilableFieldType}},
+	}
+	getFn.Body = fmt.Sprintf("return %so.%s", fieldExprPrefix, submemb.Name)
+
+	// equivArg compares the correlated elements in the old and new lists, for
+	// ratcheting. directComparable selects "==" vs semantic DeepEqual.
+	var equivArg any = Identifier(validateSemanticDeepEqual)
+	if util.IsDirectComparable(util.NonPointer(util.NativeType(submemb.Type))) {
+		// It must be a pointer, since other nilable types are not directly
+		// comparable.
+		equivArg = Identifier(validateDirectEqual)
+	}
+
+	tagValidations, err := stv.validator.ExtractTagValidations(subContext, *tag.ValueTag)
+	if err != nil {
+		return Validations{}, err
+	}
+
+	// Only the parent-member short-circuit inheritance depends on opaque-tag
+	// globals (see globalOpaqueTypes / globalOpaqueMembers in opaque.go), so
+	// defer just that decision until all opaque tags have been registered. The
+	// rest of the wrapping is independent and runs eagerly.
+	result := Validations{}
+	result.AddDeferred(Deferred(ThisContext, func() (Validations, error) {
+		// Subfield's own validations (which contain its short-circuits) are added first,
+		// and inherited parent member short-circuits are added second. The cohort-based
+		// partitioner (sortIntoCohorts) will then sort them so that all short-circuits
+		// run first, preserving the relative addition order (subfield short-circuits
+		// first, then inherited short-circuits). Finally, non-short-circuits will run.
+		var combined Validations
+		combined.Add(tagValidations)
+		if !isFieldOpaque(context) {
+			fieldValidations, err := stv.extractMemberShortCircuits(subContext)
+			if err != nil {
+				return Validations{}, err
+			}
+			combined.Add(fieldValidations)
+		}
+
+		mapped := WrapFunctions(combined, func(fn FunctionGen, scope DeferredScope) FunctionGen {
+			// ParentContext functions (e.g. Union) emit without a cohort.
+			if scope == ParentContext {
+				return fn
+			}
+			f := Function(subfieldTagName, fn.Flags, validateSubfield, subname, getFn, equivArg,
+				WrapperFunction{Function: fn, ObjType: submemb.Type, PathFragment: "." + subname})
+			f.Cohort = subname
+			return f
+		})
+
+		for i := range mapped.Deferred {
+			// The validations belong to the subfield, so re-scope ParentContext
+			// (which would target the enclosing struct) to ThisContext.
+			if mapped.Deferred[i].Scope == ParentContext {
+				mapped.Deferred[i].Scope = ThisContext
+			}
+		}
+
+		return mapped, nil
+	}))
+	return result, nil
+}
+
+// extractMemberShortCircuits extracts short-circuit validations (e.g. required,
+// immutable) from the child member's own comment lines so that the subfield
+// validator can inherit them. Each subfield path is processed at most once;
+// without this dedup, multiple subfield tags for the same child field would emit
+// duplicate short-circuit validations.
+func (stv *subfieldTagValidator) extractMemberShortCircuits(subContext Context) (Validations, error) {
+	key := subContext.Path.String()
+	if stv.processedShortCircuits[key] {
+		return Validations{}, nil
+	}
+	stv.processedShortCircuits[key] = true
+
+	ve, ok := stv.validator.(ValidationExtractor)
+	if !ok {
+		return Validations{}, fmt.Errorf("validator does not implement ValidationExtractor")
+	}
+	tags, err := ve.ExtractTags(subContext, subContext.Member.CommentLines)
+	if err != nil {
+		return Validations{}, err
+	}
+	memberValidations, err := ve.ExtractValidations(subContext, tags...)
+	if err != nil {
+		return Validations{}, err
+	}
+	return copyShortCircuitsAsNonError(memberValidations), nil
+}
+
+func (stv *subfieldTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            stv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(stv.ValidScopes()),
+		Description:    "Declares a validation for a subfield of a struct.",
+		Args: []TagArgDoc{{
+			Description: "<field-json-name>",
+			Type:        codetags.ArgTypeString,
+			Required:    true,
+		}},
+		Docs: "The named subfield must be a direct field of the struct, or of an embedded struct.",
+		Payloads: []TagPayloadDoc{{
+			Description: "<validation-tag>",
+			Docs:        "The tag to evaluate for the subfield.",
+		}},
+		PayloadsType:     codetags.ValueTypeTag,
+		PayloadsRequired: true,
+	}
+}
+
+// copyShortCircuitsAsNonError recursively traverses the validations (and deferred ones)
+// and returns a new Validations object containing only the functions that have
+// ShortCircuit flag set. The returned functions are also marked as NonError.
+func copyShortCircuitsAsNonError(v Validations) Validations {
+	res := Validations{}
+	for _, fn := range v.Functions {
+		if fn.Flags.IsSet(ShortCircuit) {
+			fn.Flags |= NonError
+			res.AddFunction(fn)
+		}
+	}
+	for _, d := range v.Deferred {
+		res.AddDeferred(Deferred(d.Scope, func() (Validations, error) {
+			inner, err := d.Callback()
+			if err != nil {
+				return Validations{}, err
+			}
+			return copyShortCircuitsAsNonError(inner), nil
+		}))
+	}
+	return res
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/testing.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/testing.go
new file mode 100644
index 0000000000..7d426febb2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/testing.go
@@ -0,0 +1,194 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	// These tags return a fixed pass/fail state.
+	validateTrueTagName  = "k8s:validateTrue"
+	validateFalseTagName = "k8s:validateFalse"
+
+	// This tag always returns an error from ExtractValidations.
+	validateErrorTagName = "k8s:validateError"
+
+	// validate true alpha/beta  test tags.
+	validateAlphaTagName = "k8s:validateTrueAlpha"
+	validateBetaTagName  = "k8s:validateTrueBeta"
+)
+
+func init() {
+	RegisterTagValidator(fixedResultTagValidator{result: true})
+	RegisterTagValidator(fixedResultTagValidator{result: false})
+	RegisterTagValidator(fixedResultTagValidator{error: true})
+	RegisterTagValidator(fixedResultTagValidator{result: true, stability: TagStabilityLevelAlpha})
+	RegisterTagValidator(fixedResultTagValidator{result: true, stability: TagStabilityLevelBeta})
+}
+
+type fixedResultTagValidator struct {
+	result    bool
+	error     bool
+	stability TagStabilityLevel
+}
+
+func (fixedResultTagValidator) Init(_ Config) {}
+
+func (frtv fixedResultTagValidator) TagName() string {
+	if frtv.error {
+		return validateErrorTagName
+	} else if frtv.result {
+		switch frtv.stability {
+		case TagStabilityLevelAlpha:
+			return validateAlphaTagName
+		case TagStabilityLevelBeta:
+			return validateBetaTagName
+		default:
+			return validateTrueTagName
+		}
+	}
+	return validateFalseTagName
+}
+
+var fixedResultTagValidScopes = sets.New(ScopeType, ScopeField, ScopeListVal, ScopeMapKey, ScopeMapVal)
+
+func (fixedResultTagValidator) ValidScopes() sets.Set[Scope] {
+	return fixedResultTagValidScopes
+}
+
+func (frtv fixedResultTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	var result Validations
+
+	if frtv.error {
+		return result, fmt.Errorf("forced error: %q", tag.Value)
+	}
+
+	args, err := frtv.toFixedResultArgs(tag)
+	if err != nil {
+		return result, fmt.Errorf("can't decode tag payload: %w", err)
+	}
+	fn := Function(frtv.TagName(), args.flags, fixedResultValidator, frtv.result, args.msg).
+		WithTypeArgs(args.typeArgs...)
+	if !frtv.result {
+		fn = fn.WithEmits(Emission{field.ErrorTypeInvalid, "validateFalse", ""})
+	}
+	fn.Cohort = args.cohort
+	result.AddFunction(fn)
+
+	return result, nil
+}
+
+var (
+	fixedResultValidator = types.Name{Package: libValidationPkg, Name: "FixedResult"}
+)
+
+type fixedResultArgs struct {
+	flags    FunctionFlags
+	msg      string
+	typeArgs []types.Name
+	cohort   string
+}
+
+func (fixedResultTagValidator) toFixedResultArgs(in codetags.Tag) (fixedResultArgs, error) {
+	result := fixedResultArgs{}
+	for _, a := range in.Args {
+		switch a.Name {
+		case "flags":
+			for _, fl := range strings.Split(a.Value, ",") {
+				fl = strings.TrimSpace(fl)
+				switch fl {
+				case "ShortCircuit":
+					result.flags |= ShortCircuit
+				case "NonError":
+					result.flags |= NonError
+				default:
+					return fixedResultArgs{}, fmt.Errorf("unknown flag: %q", fl)
+				}
+			}
+		case "typeArg":
+			if tn := a.Value; len(tn) > 0 {
+				if !strings.HasPrefix(tn, "*") {
+					tn = "*" + tn // We always need the pointer type.
+				}
+				result.typeArgs = []types.Name{{Package: "", Name: tn}}
+			}
+		case "cohort":
+			result.cohort = a.Value
+		}
+	}
+	if in.ValueType == codetags.ValueTypeString {
+		result.msg = in.Value
+	}
+	return result, nil
+}
+
+func (frtv fixedResultTagValidator) Docs() TagDoc {
+	tagStabilityLevel := TagStabilityLevelAlpha
+	if frtv.stability != "" {
+		tagStabilityLevel = frtv.stability
+	}
+	doc := TagDoc{
+		Tag:            frtv.TagName(),
+		StabilityLevel: tagStabilityLevel,
+		Scopes:         sets.List(frtv.ValidScopes()),
+	}
+	doc.PayloadsType = codetags.ValueTypeString
+	if frtv.error {
+		doc.Description = "Always fails code generation (useful for testing)."
+		doc.Payloads = []TagPayloadDoc{{
+			Description: "<string>",
+			Docs:        "This string will be included in the error message.",
+		}}
+	} else {
+		// True and false have the same args and payload.
+		doc.Payloads = []TagPayloadDoc{{
+			Description: "<none>",
+		}, {
+			Description: "<string>",
+			Docs:        "The generated code will include this string.",
+		}}
+		doc.Args = []TagArgDoc{{
+			Name:        "flags",
+			Description: "<comma-separated-list-of-flag-string>",
+			Docs:        `values: ShortCircuit, NonError`,
+			Type:        codetags.ArgTypeString,
+		}, {
+			Name:        "typeArg",
+			Description: "<string>",
+			Docs:        "The type arg in generated code (must be the value-type, not pointer).",
+			Type:        codetags.ArgTypeString,
+		}, {
+			Name:        "cohort",
+			Description: "<string>",
+			Docs:        "An optional cohort name to group multiple validations.",
+			Type:        codetags.ArgTypeString,
+		}}
+		if frtv.result {
+			doc.Description = "Always passes validation (useful for testing)."
+		} else {
+			doc.Description = "Always fails validation (useful for testing)."
+		}
+	}
+	return doc
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/union.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/union.go
new file mode 100644
index 0000000000..529267b60f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/union.go
@@ -0,0 +1,523 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+	"regexp"
+	"slices"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/parser/tags"
+	"k8s.io/gengo/v2/types"
+)
+
+var discriminatedUnionValidator = types.Name{Package: libValidationPkg, Name: "DiscriminatedUnion"}
+var unionValidator = types.Name{Package: libValidationPkg, Name: "Union"}
+
+var newDiscriminatedUnionMember = types.Name{Package: libValidationPkg, Name: "NewDiscriminatedUnionMember"}
+var newDiscriminatedUnionMembership = types.Name{Package: libValidationPkg, Name: "NewDiscriminatedUnionMembership"}
+var newUnionMember = types.Name{Package: libValidationPkg, Name: "NewUnionMember"}
+var newUnionMembership = types.Name{Package: libValidationPkg, Name: "NewUnionMembership"}
+var unionVariablePrefix = "unionMembershipFor"
+
+func init() {
+	// Unions are comprised of multiple tags that need to share information.
+	// For field-based unions: tags are on struct fields, validation is on the struct
+	// For item-based unions: tags are on list items (via +k8s:item), validation is on the list
+
+	// "shared" maps from field path strings (key) to union definitions (value)
+	// key examples:
+	//   - struct union: "MyStruct" (validation on the struct type)
+	//   - list union: "Pipeline.Tasks" (validation on the list field)
+	shared := map[string]unions{}
+	RegisterTagValidator(unionDiscriminatorTagValidator{shared})
+	RegisterTagValidator(unionMemberTagValidator{shared})
+}
+
+func getUnionValidations(shared map[string]unions, context Context) (Validations, error) {
+	// unions are keyed by ParentPath for struct fields (ScopeField), or Path for others.
+	structPath := context.ParentPath
+	parentType := context.ParentType
+
+	// TODO: Add support for map items once map item validation is implemented
+
+	// Extract the most concrete type possible.
+	if k := util.NonPointer(util.NativeType(parentType)).Kind; k != types.Struct && k != types.Slice {
+		return Validations{}, nil
+	}
+
+	unions := shared[structPath.String()]
+	if len(unions) == 0 {
+		return Validations{}, nil
+	}
+	delete(shared, structPath.String())
+
+	result, err := processUnionValidations(structPath, parentType, unions, unionVariablePrefix,
+		unionMemberTagName, unionValidator, discriminatedUnionValidator,
+		Emission{field.ErrorTypeInvalid, "union", ""})
+	return result, err
+}
+
+const (
+	unionDiscriminatorTagName = "k8s:unionDiscriminator"
+	unionMemberTagName        = "k8s:unionMember"
+)
+
+type unionDiscriminatorTagValidator struct {
+	shared map[string]unions
+}
+
+func (unionDiscriminatorTagValidator) Init(_ Config) {}
+
+func (unionDiscriminatorTagValidator) TagName() string {
+	return unionDiscriminatorTagName
+}
+
+// Shared between unionDiscriminatorTagValidator and unionMemberTagValidator.
+var unionTagValidScopes = sets.New(ScopeField, ScopeListVal)
+
+func (unionDiscriminatorTagValidator) ValidScopes() sets.Set[Scope] {
+	return unionTagValidScopes
+}
+
+func (udtv unionDiscriminatorTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	err := processDiscriminatorValidations(udtv.shared, context, tag)
+	if err != nil {
+		return Validations{}, err
+	}
+	// Configure descriminator for the union. Validations are emitted by the union member validator.
+	return Validations{}, nil
+}
+
+func (udtv unionDiscriminatorTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            udtv.TagName(),
+		StabilityLevel: TagStabilityLevelBeta,
+		Scopes:         sets.List(udtv.ValidScopes()),
+		Description:    "Indicates that this field is the discriminator for a union.",
+		Args: []TagArgDoc{{
+			Name:        "union",
+			Description: "<string>",
+			Docs:        "the name of the union, if more than one exists",
+			Type:        codetags.ArgTypeString,
+		}},
+	}
+}
+
+type unionMemberTagValidator struct {
+	shared map[string]unions
+}
+
+func (unionMemberTagValidator) Init(_ Config) {}
+
+func (unionMemberTagValidator) TagName() string {
+	return unionMemberTagName
+}
+
+func (unionMemberTagValidator) ValidScopes() sets.Set[Scope] {
+	return unionTagValidScopes
+}
+
+func (umtv unionMemberTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	err := processMemberValidations(umtv.shared, context, tag)
+	if err != nil {
+		return Validations{}, err
+	}
+	return Validations{
+		Deferred: []DeferredGen{
+			Deferred(ParentContext, func() (Validations, error) {
+				return getUnionValidations(umtv.shared, context)
+			}),
+		},
+	}, nil
+}
+
+func (umtv unionMemberTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            umtv.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(umtv.ValidScopes()),
+		Description:    "Indicates that this field is a member of a union.",
+		Args: []TagArgDoc{{
+			Name:        "union",
+			Description: "<string>",
+			Docs:        "the name of the union, if more than one exists",
+			Type:        codetags.ArgTypeString,
+		}, {
+			Name:        "memberName",
+			Description: "<string>",
+			Docs:        "the discriminator value for this member",
+			Default:     "the field's name",
+			Type:        codetags.ArgTypeString,
+		}},
+	}
+}
+
+// union defines how a union validation will be generated. Unions can be
+// composed of either a set of struct fields (with an optional disctriminator),
+// or a set of list items (stored as selection criteria).
+type union struct {
+	// members provides field information about all the members of the union.
+	// Each item provides a fieldName and discriminatorValue pair, where the
+	// name identifies the field or selector (for use in errors) and the
+	// discriminatorValue indicates the value which should be used in a
+	// discriminated union to name this member.
+	members []unionMember
+
+	// fieldMembers describes all the members of a struct-field union.  This is
+	// mutually exclusive with itemMembers.
+	fieldMembers []*types.Member
+
+	// discriminator is the name of the discriminator field.
+	discriminator *string
+	// discriminatorMember describes the discriminator field.
+	discriminatorMember *types.Member
+
+	// itemMembers stores selection criteria for all the members of a list-item
+	// union. This is mutually exclusive with fieldMembers. The map key is the
+	// "field name" (eg: `field[{"name": "succeeded"}]`), and the value is a
+	// list of selection criteria.
+	itemMembers map[string][]ListSelectorTerm
+}
+
+type unionMember struct {
+	fieldName          string
+	discriminatorValue string
+}
+
+// unions represents all the unions for a go struct.
+type unions map[string]*union
+
+// newUnion initializes a new union instance
+func newUnion() *union {
+	return &union{
+		// slice fields can be nil
+		itemMembers: make(map[string][]ListSelectorTerm),
+	}
+}
+
+// getOrCreate gets a union by name, or initializes a new union by the given name.
+func (us unions) getOrCreate(name string) *union {
+	var u *union
+	var ok bool
+	if u, ok = us[name]; !ok {
+		u = newUnion()
+		us[name] = u
+	}
+	return u
+}
+
+func processUnionValidations(structPath *field.Path, parentType *types.Type, unions unions, varPrefix string,
+	tagName string, undiscriminatedValidator types.Name, discriminatedValidator types.Name, emits Emission,
+) (Validations, error) {
+	result := Validations{}
+
+	// Sort the keys for stable output.
+	keys := make([]string, 0, len(unions))
+	for k := range unions {
+		keys = append(keys, k)
+	}
+	slices.Sort(keys)
+	for _, unionName := range keys {
+		u := unions[unionName]
+		if len(u.fieldMembers) > 0 || u.discriminator != nil || len(u.itemMembers) > 0 {
+			if len(u.fieldMembers) > 0 && len(u.itemMembers) > 0 {
+				return Validations{}, fmt.Errorf("cannot have both field members and item members")
+			}
+			nativeType := util.NonPointer(util.NativeType(parentType))
+			if nativeType.Kind == types.Struct && len(u.itemMembers) > 0 {
+				return Validations{}, fmt.Errorf("struct type cannot have item members")
+			}
+			if nativeType.Kind == types.Slice && len(u.fieldMembers) > 0 {
+				return Validations{}, fmt.Errorf("slice type cannot have field members")
+			}
+
+			// TODO: Avoid the "local" here. This was added to avoid errors caused when the package is an empty string.
+			//       The correct package would be the output package but is not known here. This does not show up in generated code.
+			// TODO: Append a consistent hash suffix to avoid generated name conflicts?
+			varBaseName := sanitizeName(structPath.String() + "_" + unionName) // unionName can be ""
+			supportVarName := PrivateVar{Name: varPrefix + "_" + varBaseName, Package: "local"}
+
+			var extractorArgs []any
+			ptrType := types.PointerTo(parentType)
+
+			// Handle field unions
+			for _, member := range u.fieldMembers {
+				extractor := createMemberExtractor(ptrType, member)
+				extractorArgs = append(extractorArgs, extractor)
+			}
+
+			// Handle list item unions for lists
+			if nativeType.Kind == types.Slice && len(u.itemMembers) > 0 {
+				elemType := util.NonPointer(nativeType.Elem)
+
+				// Sort keys for stable output
+				keys := make([]string, 0, len(u.itemMembers))
+				for key := range u.itemMembers {
+					keys = append(keys, key)
+				}
+				slices.Sort(keys)
+
+				for _, fullPath := range keys {
+					selector := u.itemMembers[fullPath]
+					extractor, err := createItemExtractor(parentType, elemType, selector)
+					if err != nil {
+						return Validations{}, err
+					}
+					extractorArgs = append(extractorArgs, extractor)
+				}
+			}
+
+			if u.discriminator != nil {
+				supportVar := Variable(supportVarName,
+					Function(tagName, DefaultFlags, newDiscriminatedUnionMembership,
+						append([]any{*u.discriminator}, getMemberArgs(u, parentType, true)...)...))
+				result.Variables = append(result.Variables, supportVar)
+
+				discriminatorExtractor := FunctionLiteral{
+					Parameters: []ParamResult{{Name: "obj", Type: ptrType}},
+					Results:    []ParamResult{{Type: types.String}},
+					Body:       fmt.Sprintf("if obj == nil {return \"\"}; return string(obj.%s)", u.discriminatorMember.Name), // Cast to string
+				}
+
+				extraArgs := append([]any{supportVarName, discriminatorExtractor}, extractorArgs...)
+				fn := Function(tagName, DefaultFlags, discriminatedValidator, extraArgs...).
+					WithEmits(emits)
+				result.Functions = append(result.Functions, fn)
+			} else {
+				supportVar := Variable(supportVarName, Function(tagName, DefaultFlags, newUnionMembership, getMemberArgs(u, parentType, false)...))
+				result.Variables = append(result.Variables, supportVar)
+
+				extraArgs := append([]any{supportVarName}, extractorArgs...)
+				fn := Function(tagName, DefaultFlags, undiscriminatedValidator, extraArgs...).
+					WithEmits(emits)
+				result.Functions = append(result.Functions, fn)
+			}
+		}
+	}
+
+	return result, nil
+}
+
+func createMemberExtractor(ptrType *types.Type, member *types.Member) FunctionLiteral {
+	extractor := FunctionLiteral{
+		Parameters: []ParamResult{{Name: "obj", Type: ptrType}},
+		Results:    []ParamResult{{Type: types.Bool}},
+	}
+	nt := util.NativeType(member.Type)
+	switch nt.Kind {
+	case types.Pointer:
+		extractor.Body = fmt.Sprintf("if obj == nil {return false}; return obj.%s != nil", member.Name)
+	case types.Map, types.Slice:
+		extractor.Body = fmt.Sprintf("if obj == nil {return false}; return len(obj.%s) != 0", member.Name)
+	case types.Builtin:
+		extractor.Body = fmt.Sprintf("if obj == nil {return false}; var z %s; return obj.%s != z", member.Type, member.Name)
+	default:
+		// This should be caught before we get here, but JIC.
+		extractor.Body = fmt.Sprintf("if obj == nil {return false}; return false /* unsupported union member kind: %s */", nt.Kind)
+	}
+	return extractor
+}
+
+// createItemExtractor creates an extractor function for list item union
+// members. It generates code that loops through the list to check if an item
+// matching the criteria exists.
+func createItemExtractor(listType *types.Type, elemType *types.Type, selector []ListSelectorTerm) (FunctionLiteral, error) {
+	var criteria []keyValuePair
+	for _, term := range selector {
+		criteria = append(criteria, keyValuePair{
+			key:   term.Field,
+			value: fmt.Sprint(term.Value),
+		})
+	}
+
+	// Sort for stable output.
+	slices.SortFunc(criteria, func(a, b keyValuePair) int {
+		return strings.Compare(a.key, b.key)
+	})
+
+	condition, err := buildMatchConditions(elemType, criteria, "list[i]")
+	if err != nil {
+		return FunctionLiteral{}, err
+	}
+
+	extractor := FunctionLiteral{
+		Parameters: []ParamResult{{Name: "list", Type: listType}},
+		Results:    []ParamResult{{Type: types.Bool}},
+		Body: fmt.Sprintf(
+			`for i := range list {
+				if %s {
+					return true
+				}
+			 }
+			 return false`, condition),
+	}
+
+	return extractor, nil
+}
+
+// processDiscriminatorValidations processes union discriminator tags. It is a
+// free function, rather than a method so that it can be called from other
+// union-like tags.
+func processDiscriminatorValidations(shared map[string]unions, context Context, tag codetags.Tag) error {
+	// This tag can apply to value and pointer fields, as well as typedefs
+	// (which should never be pointers). We need to check the concrete type.
+	if t := util.NonPointer(util.NativeType(context.Type)); t != types.String {
+		return fmt.Errorf("can only be used on string types (%s)", rootTypeString(context.Type, t))
+	}
+	if shared[context.ParentPath.String()] == nil {
+		shared[context.ParentPath.String()] = unions{}
+	}
+	unionArg, _ := tag.NamedArg("union") // optional
+	u := shared[context.ParentPath.String()].getOrCreate(unionArg.Value)
+
+	var discriminatorFieldName string
+	if jsonAnnotation, ok := tags.LookupJSON(*context.Member); ok {
+		discriminatorFieldName = jsonAnnotation.Name
+		u.discriminator = &discriminatorFieldName
+		u.discriminatorMember = context.Member
+	}
+
+	return nil
+}
+
+// processMemberValidations processes union member tags for fields and list
+// items.  It is a free function, rather than a method so that it can be called
+// from other union-like tags.
+func processMemberValidations(shared map[string]unions, context Context, tag codetags.Tag) error {
+	switch context.Scope {
+	case ScopeField:
+		return processFieldMemberValidations(shared, context, tag)
+	case ScopeListVal:
+		return processListMemberValidations(shared, context, tag)
+	}
+	return fmt.Errorf("can only be used on fields and list items: %v", context.Scope)
+}
+
+// processFieldMemberValidations processes union member tags for struct fields.
+// It is a free function, rather than a method so that it can be called from
+// other union-like tags.
+func processFieldMemberValidations(shared map[string]unions, context Context, tag codetags.Tag) error {
+	nt := util.NativeType(context.Member.Type)
+	switch nt.Kind {
+	case types.Pointer, types.Map, types.Slice, types.Builtin:
+		// OK
+	default:
+		// In particular non-pointer structs are not supported.
+		return fmt.Errorf("can only be used on nilable and primitive types (%s)", nt.Kind)
+	}
+	if context.Member == nil {
+		return fmt.Errorf("struct-field union member has no member info in context")
+	}
+
+	jsonTag, ok := tags.LookupJSON(*context.Member)
+	if !ok {
+		return fmt.Errorf("field %q is a union member but has no JSON struct field tag", context.Member)
+	}
+	fieldName := jsonTag.Name
+	if len(fieldName) == 0 {
+		return fmt.Errorf("field %q is a union member but has no JSON name", context.Member)
+	}
+
+	if shared[context.ParentPath.String()] == nil {
+		shared[context.ParentPath.String()] = unions{}
+	}
+
+	// See if the tag specified a member name.
+	memberName := context.Member.Name                        // default
+	if memberNameArg, ok := tag.NamedArg("memberName"); ok { // optional
+		memberName = memberNameArg.Value
+	}
+
+	unionArg, _ := tag.NamedArg("union") // optional
+	u := shared[context.ParentPath.String()].getOrCreate(unionArg.Value)
+	u.members = append(u.members, unionMember{fieldName, memberName})
+
+	u.fieldMembers = append(u.fieldMembers, context.Member)
+
+	return nil
+}
+
+// processListMemberValidations processes union member tags for list items.  It
+// is a free function, rather than a method so that it can be called from other
+// union-like tags.
+func processListMemberValidations(shared map[string]unions, context Context, tag codetags.Tag) error {
+	if context.ListSelector == nil {
+		return fmt.Errorf("list-item union member has no list selector in context")
+	}
+
+	// It's not really a "field", but close enough. We don't really NEED the
+	// field name, since it is present in the error message, but it is more
+	// human-friendly. eg: `field[{"name": "succeeded"}]`
+	fieldName := lastPathElement(context.Path)
+
+	if shared[context.ParentPath.String()] == nil {
+		shared[context.ParentPath.String()] = unions{}
+	}
+
+	// See if the tag specified a member name.
+	memberName := ""
+	if memberNameArg, ok := tag.NamedArg("memberName"); ok { // optional
+		memberName = memberNameArg.Value
+	}
+
+	unionArg, _ := tag.NamedArg("union") // optional
+	u := shared[context.ParentPath.String()].getOrCreate(unionArg.Value)
+	u.members = append(u.members, unionMember{fieldName, memberName})
+
+	if _, found := u.itemMembers[fieldName]; found {
+		return fmt.Errorf("list-item union member %q already exists", fieldName)
+	}
+	u.itemMembers[fieldName] = context.ListSelector
+
+	return nil
+}
+
+func lastPathElement(path *field.Path) string {
+	parts := strings.Split(path.String(), ".")
+	if len(parts) > 0 {
+		return parts[len(parts)-1]
+	}
+	return ""
+}
+
+// getMemberArgs gets a list of arguments which construct union members.
+func getMemberArgs(u *union, _ *types.Type, discrim bool) []any {
+	members := make([]any, 0, len(u.members))
+	for _, f := range u.members {
+		fieldName := f.fieldName
+		memberName := f.discriminatorValue
+		if discrim {
+			members = append(members, Function("unused", 0, newDiscriminatedUnionMember, fieldName, memberName))
+		} else {
+			members = append(members, Function("unused", 0, newUnionMember, fieldName))
+		}
+	}
+	return members
+}
+
+// sanitizeName converts a string into a valid Go identifier
+func sanitizeName(name string) string {
+	name = strings.ReplaceAll(name, ".", "_")
+	re := regexp.MustCompile(`[^a-zA-Z0-9_]`)
+	return re.ReplaceAllString(name, "_")
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/update.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/update.go
new file mode 100644
index 0000000000..f0cfd3264d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/update.go
@@ -0,0 +1,420 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+	"slices"
+
+	"k8s.io/apimachinery/pkg/api/validate"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	updateTagName = "k8s:update"
+)
+
+func init() {
+	shared := map[string]*updateMetadata{}
+	RegisterTagValidator(updateTagCollector{byFieldPath: shared, listByPath: globalListMeta})
+}
+
+// updateMetadata collects constraints for a field, supporting both normal and shadow validation.
+type updateMetadata struct {
+	constraints    sets.Set[validate.UpdateConstraint]
+	stabilityLevel ValidationStabilityLevel
+}
+
+// updateTagCollector collects +k8s:update tags
+type updateTagCollector struct {
+	byFieldPath map[string]*updateMetadata
+	listByPath  map[string]*listMetadata
+}
+
+func (updateTagCollector) Init(_ Config) {}
+
+func (updateTagCollector) TagName() string {
+	return updateTagName
+}
+
+var updateTagValidScopes = sets.New(ScopeField, ScopeListVal, ScopeMapVal)
+
+func (updateTagCollector) ValidScopes() sets.Set[Scope] {
+	return updateTagValidScopes
+}
+
+func (utc updateTagCollector) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	// Parse constraint from this tag
+	var constraint validate.UpdateConstraint
+	switch tag.Value {
+	case "NoSet":
+		constraint = validate.NoSet
+	case "NoUnset":
+		constraint = validate.NoUnset
+	case "NoModify":
+		constraint = validate.NoModify
+	case "NoAddItem":
+		constraint = validate.NoAddItem
+	case "NoRemoveItem":
+		constraint = validate.NoRemoveItem
+	default:
+		return Validations{}, fmt.Errorf("unknown +k8s:update constraint: %s", tag.Value)
+	}
+
+	// Element scope (reached via +k8s:eachVal): only NoModify is valid,
+	// and there is at most one constraint per tag invocation, so emit the
+	// validation directly.
+	// Field scope: fall through and accumulate, so that multiple +k8s:update
+	// tags on the same field can be merged into one call later by
+	// updateFieldValidator.
+	if context.Scope == ScopeListVal || context.Scope == ScopeMapVal {
+		if constraint != validate.NoModify {
+			return Validations{}, fmt.Errorf("+k8s:update=%s does not apply to %s, attach it to the enclosing field", constraintName(constraint), context.Scope)
+		}
+		nt := util.NonPointer(util.NativeType(context.Type))
+		if nt.Kind == types.Slice || nt.Kind == types.Map {
+			return Validations{}, fmt.Errorf("+k8s:update=NoModify cannot be applied to list/map elements that are themselves lists or maps")
+		}
+		// For ScopeListVal, NoModify is only meaningful when the enclosing
+		// list matches items by key (listType=map or unique=map). For
+		// listType=set or listType=atomic, a content change becomes a new
+		// unmatched item that ratchets through as a no-op. Reject upfront.
+		if context.Scope == ScopeListVal && context.ParentPath != nil {
+			if lm := utc.listByPath[context.ParentPath.String()]; lm != nil && lm.semantic != semanticMap {
+				return Validations{}, fmt.Errorf("+k8s:eachVal=+k8s:update=NoModify requires the enclosing list to use listType=map or unique=map (got %s)", lm.semantic)
+			}
+		}
+		v := emitScalarUpdate(context, []validate.UpdateConstraint{constraint})
+		applyStabilityLevel(&v, context.StabilityLevel)
+		return v, nil
+	}
+
+	// Initialize metadata if doesn't exist
+	fieldPath := context.Path.String()
+	if utc.byFieldPath[fieldPath] == nil {
+		utc.byFieldPath[fieldPath] = &updateMetadata{constraints: sets.New[validate.UpdateConstraint]()}
+	}
+	um := utc.byFieldPath[fieldPath]
+
+	um.stabilityLevel = context.StabilityLevel
+
+	// Add this constraint to the set for this field
+	um.constraints.Insert(constraint)
+
+	if err := utc.validateConstraintsForType(context, um.constraints.UnsortedList()); err != nil {
+		return Validations{}, err
+	}
+
+	return Validations{
+		Deferred: []DeferredGen{
+			Deferred(ThisContext, func() (Validations, error) {
+				return getUpdateValidations(utc.byFieldPath, utc.listByPath, context)
+			}),
+		},
+	}, nil
+}
+
+func (utc updateTagCollector) validateConstraintsForType(context Context, constraints []validate.UpdateConstraint) error {
+	t := util.NonPointer(util.NativeType(context.Type))
+	isCompound := t.Kind == types.Slice || t.Kind == types.Map
+	isPointer := context.Type.Kind == types.Pointer
+	isStruct := t.Kind == types.Struct
+
+	for _, constraint := range constraints {
+		switch constraint {
+		case validate.NoAddItem, validate.NoRemoveItem:
+			if !isCompound {
+				return fmt.Errorf("+k8s:update=%s can only be used on list or map fields", constraintName(constraint))
+			}
+		case validate.NoModify:
+			if isCompound {
+				return fmt.Errorf("+k8s:update=NoModify is not supported on list or map fields, use +k8s:eachVal=+k8s:update=NoModify for per-item immutability")
+			}
+		case validate.NoSet, validate.NoUnset:
+			// For non-pointer struct fields, only NoModify is applicable
+			if isStruct && !isPointer {
+				return fmt.Errorf("+k8s:update=%s cannot be used on non-pointer struct fields (they cannot be unset)", constraintName(constraint))
+			}
+		}
+	}
+
+	return nil
+}
+
+func constraintName(c validate.UpdateConstraint) string {
+	switch c {
+	case validate.NoSet:
+		return "NoSet"
+	case validate.NoUnset:
+		return "NoUnset"
+	case validate.NoModify:
+		return "NoModify"
+	case validate.NoAddItem:
+		return "NoAddItem"
+	case validate.NoRemoveItem:
+		return "NoRemoveItem"
+	default:
+		return fmt.Sprintf("Unknown(%d)", c)
+	}
+}
+
+func (utc updateTagCollector) Docs() TagDoc {
+	return TagDoc{
+		Tag:            utc.TagName(),
+		StabilityLevel: TagStabilityLevelStable,
+		Scopes:         sets.List(utc.ValidScopes()),
+		PayloadsType:   codetags.ValueTypeString,
+		Description: "Provides constraints on the allowed update operations of a field. " +
+			"Constraints: NoSet (prevents unset->set transitions), NoUnset (prevents set->unset transitions), " +
+			"NoModify (prevents value changes but allows set/unset transitions), " +
+			"NoAddItem (prevents adding items to a slice or map), NoRemoveItem (prevents removing items from a slice or map). " +
+			"Multiple constraints can be specified using multiple tags. " +
+			"For non-pointer structs, NoSet and NoUnset have no effect as these fields cannot be unset. " +
+			"For slice and map fields, 'unset' means len == 0. Slice item identity for NoAddItem/NoRemoveItem comes from " +
+			"+k8s:listType/+k8s:listMapKey/+k8s:unique, for maps the key is the item identity. " +
+			"NoModify is not supported on slices or maps, use +k8s:eachVal=+k8s:update=NoModify for per-item immutability. " +
+			"On lists, +k8s:eachVal=+k8s:update=NoModify requires listType=map or unique=map, otherwise content changes are not detectable. " +
+			"Examples: +k8s:update=NoModify +k8s:update=NoUnset for set-once fields, " +
+			"+k8s:update=NoSet for fields that must be set at creation or never, " +
+			"+k8s:update=NoAddItem +k8s:update=NoRemoveItem on a listType=map field to freeze the structural shape of the list.",
+	}
+}
+
+var (
+	updateValueValidator    = types.Name{Package: libValidationPkg, Name: "UpdateValue"}
+	updatePointerValidator  = types.Name{Package: libValidationPkg, Name: "UpdatePointer"}
+	updateStructValidator   = types.Name{Package: libValidationPkg, Name: "UpdateStruct"}
+	valSliceUpdateValidator = types.Name{Package: libValidationPkg, Name: "ValSliceUpdate"}
+	ptrSliceUpdateValidator = types.Name{Package: libValidationPkg, Name: "PtrSliceUpdate"}
+	updateMapValidator      = types.Name{Package: libValidationPkg, Name: "UpdateMap"}
+
+	// Constraint constants that will be used as arguments
+	noSetConstraint        = types.Name{Package: libValidationPkg, Name: "NoSet"}
+	noUnsetConstraint      = types.Name{Package: libValidationPkg, Name: "NoUnset"}
+	noModifyConstraint     = types.Name{Package: libValidationPkg, Name: "NoModify"}
+	noAddItemConstraint    = types.Name{Package: libValidationPkg, Name: "NoAddItem"}
+	noRemoveItemConstraint = types.Name{Package: libValidationPkg, Name: "NoRemoveItem"}
+)
+
+func getUpdateValidations(byFieldPath map[string]*updateMetadata, listByPath map[string]*listMetadata, context Context) (Validations, error) {
+	um := byFieldPath[context.Path.String()]
+
+	if um == nil || um.constraints.Len() == 0 {
+		return Validations{}, nil
+	}
+	// Delete the entry from the map after processing to avoid reprocessing.
+	delete(byFieldPath, context.Path.String())
+
+	constraints := um.constraints.UnsortedList()
+
+	v, err := generateUpdateValidation(listByPath, context, constraints)
+	if err != nil {
+		return Validations{}, err
+	}
+
+	level := um.stabilityLevel
+	if context.StabilityLevel != "" {
+		level = context.StabilityLevel
+	}
+
+	applyStabilityLevel(&v, level)
+	return v, nil
+}
+
+func generateUpdateValidation(listByPath map[string]*listMetadata, context Context, constraints []validate.UpdateConstraint) (Validations, error) {
+	// Sort constraints to ensure deterministic order
+	slices.Sort(constraints)
+
+	t := util.NonPointer(util.NativeType(context.Type))
+	switch t.Kind {
+	case types.Slice:
+		return generateSliceValidation(listByPath, context, constraints)
+	case types.Map:
+		return generateMapValidation(constraints), nil
+	}
+	return emitScalarUpdate(context, constraints), nil
+}
+
+// generateSliceValidation emits validate.ValSliceUpdate. NoAddItem/NoRemoveItem
+// need a match function to pair old and new items, which function we emit is
+// determined by the list's semantic (set/map) as set by
+// +k8s:listType/+k8s:listMapKey/+k8s:unique. For NoSet/NoUnset alone, a nil match is fine.
+//
+// Metadata lookup falls back from the field path to the type path so that
+// typedef-level list annotations apply, mirroring the pattern used by
+// listValidator.
+func generateSliceValidation(listByPath map[string]*listMetadata, context Context, constraints []validate.UpdateConstraint) (Validations, error) {
+	var matchArg any = Literal("nil")
+	// NoAddItem/NoRemoveItem need a match function to pair items between old and new, NoSet/NoUnset only check len == 0.
+	if slices.Contains(constraints, validate.NoAddItem) || slices.Contains(constraints, validate.NoRemoveItem) {
+		lm := listByPath[context.Path.String()]
+		if lm == nil {
+			lm = listByPath[context.Type.String()]
+		}
+		if lm == nil {
+			return Validations{}, fmt.Errorf("+k8s:update=NoAddItem/+k8s:update=NoRemoveItem require list metadata (+k8s:listType with listMapKey, or +k8s:unique) to determine item identity")
+		}
+		elem := util.NativeType(context.Type).Elem
+		switch lm.semantic {
+		case semanticMap:
+			if len(lm.keyMembers) == 0 {
+				return Validations{}, fmt.Errorf("+k8s:update=NoAddItem/+k8s:update=NoRemoveItem require listMapKey to be set for listType=map")
+			}
+			matchArg = lm.makeListMapMatchFunc(elem)
+		case semanticSet:
+			if util.IsDirectComparable(util.NonPointer(util.NativeType(elem))) {
+				matchArg = Identifier(validateDirectEqual)
+			} else {
+				matchArg = Identifier(validateSemanticDeepEqual)
+			}
+		default:
+			return Validations{}, fmt.Errorf("+k8s:update=NoAddItem/+k8s:update=NoRemoveItem require listType=set, listType=map, unique=set, or unique=map to define item identity")
+		}
+	}
+
+	args := append([]any{matchArg}, constraintIdentifierArgs(constraints)...)
+
+	validator := valSliceUpdateValidator
+	nt := util.NativeType(context.Type)
+	if nt.Elem.Kind == types.Pointer {
+		validator = ptrSliceUpdateValidator
+	}
+
+	// Use ShortCircuit flag so these run in the same group as +k8s:optional
+	fn := Function(updateTagName, ShortCircuit, validator, args...).
+		WithEmits(compoundUpdateEmissions(constraints, false)...)
+	return Validations{Functions: []FunctionGen{fn}}, nil
+}
+
+// generateMapValidation emits validate.UpdateMap. The map key is the item
+// identity, so no list metadata or match function is needed.
+func generateMapValidation(constraints []validate.UpdateConstraint) Validations {
+	// Use ShortCircuit flag so these run in the same group as +k8s:optional
+	fn := Function(updateTagName, ShortCircuit, updateMapValidator, constraintIdentifierArgs(constraints)...).
+		WithEmits(compoundUpdateEmissions(constraints, true)...)
+	return Validations{Functions: []FunctionGen{fn}}
+}
+
+// emitScalarUpdate emits a call to UpdateValue/UpdatePointer/UpdateStruct
+// based on the Go kind of context.Type.
+// Used for both field scope (scalar/pointer/struct) and list/map element
+// scope via +k8s:eachVal.
+func emitScalarUpdate(context Context, constraints []validate.UpdateConstraint) Validations {
+	// Determine the appropriate validator function based on field type
+	t := util.NonPointer(util.NativeType(context.Type))
+	isPointer := context.Type.Kind == types.Pointer
+	isStruct := t.Kind == types.Struct
+	isComparable := util.IsDirectComparable(t)
+
+	var validatorFunc types.Name
+	var args []any
+	if isPointer {
+		validatorFunc = updatePointerValidator
+		args = constraintIdentifierArgs(constraints)
+	} else if isStruct {
+		validatorFunc = updateStructValidator
+		args = constraintIdentifierArgs(constraints)
+	} else {
+		validatorFunc = updateValueValidator
+		var matchArg any
+		if isComparable {
+			matchArg = FunctionLiteral{
+				Parameters: []ParamResult{{"a", context.Type}, {"b", context.Type}},
+				Results:    []ParamResult{{"", types.Bool}},
+				Body:       "return a == b",
+			}
+		} else {
+			matchArg = Identifier(validateSemanticDeepEqual)
+		}
+		args = append([]any{matchArg}, constraintIdentifierArgs(constraints)...)
+	}
+
+	// Use ShortCircuit flag so these run in the same group as +k8s:optional.
+	// Scalar/pointer/struct fields only accept NoSet/NoUnset/NoModify
+	// (validateConstraintsForType rejects the rest), all of which emit
+	// field.Invalid at the field path.
+	fn := Function(updateTagName, ShortCircuit, validatorFunc, args...).
+		WithEmits(Emission{field.ErrorTypeInvalid, "update", ""})
+	return Validations{Functions: []FunctionGen{fn}}
+}
+
+// compoundUpdateEmissions returns the (deduplicated) Emissions ValSliceUpdate or
+// UpdateMap produces for the given constraints. Order is stable for
+// reproducible codegen. NoModify is rejected for compound types upstream, so
+// only NoSet/NoUnset/NoAddItem/NoRemoveItem are handled here.
+//
+//   - NoSet/NoUnset       -> Invalid at the field path
+//   - NoAddItem           -> Forbidden at fldPath.Index(i)/fldPath.Key(k) ("[*]")
+//   - NoRemoveItem, slice -> Forbidden at fldPath ("")
+//   - NoRemoveItem, map   -> Forbidden at fldPath.Key(k) ("[*]"), shared with NoAddItem
+func compoundUpdateEmissions(constraints []validate.UpdateConstraint, isMap bool) []Emission {
+	var hasInvalid, hasAdd, hasRemove bool
+	for _, c := range constraints {
+		switch c {
+		case validate.NoSet, validate.NoUnset:
+			hasInvalid = true
+		case validate.NoAddItem:
+			hasAdd = true
+		case validate.NoRemoveItem:
+			hasRemove = true
+		}
+	}
+	var out []Emission
+	if hasInvalid {
+		out = append(out, Emission{field.ErrorTypeInvalid, "update", ""})
+	}
+	if hasAdd || (hasRemove && isMap) {
+		out = append(out, Emission{field.ErrorTypeForbidden, "update", "[*]"})
+	}
+	if hasRemove && !isMap {
+		out = append(out, Emission{field.ErrorTypeForbidden, "update", ""})
+	}
+	return out
+}
+
+// constraintIdentifierArgs builds the constraint arguments in deterministic order.
+func constraintIdentifierArgs(constraints []validate.UpdateConstraint) []any {
+	var args []any
+	for _, constraint := range constraints {
+		switch constraint {
+		case validate.NoSet:
+			args = append(args, Identifier(noSetConstraint))
+		case validate.NoUnset:
+			args = append(args, Identifier(noUnsetConstraint))
+		case validate.NoModify:
+			args = append(args, Identifier(noModifyConstraint))
+		case validate.NoAddItem:
+			args = append(args, Identifier(noAddItemConstraint))
+		case validate.NoRemoveItem:
+			args = append(args, Identifier(noRemoveItemConstraint))
+		}
+	}
+	return args
+}
+
+func applyStabilityLevel(v *Validations, level ValidationStabilityLevel) {
+	if level == "" {
+		return
+	}
+	for i := range v.Functions {
+		v.Functions[i] = v.Functions[i].WithStabilityLevel(level)
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/validators.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/validators.go
new file mode 100644
index 0000000000..235897dddc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/validators.go
@@ -0,0 +1,763 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/generator"
+	"k8s.io/gengo/v2/types"
+)
+
+var (
+	DeepEqualImpl = types.Name{Name: "deepEqualImpl_"}
+)
+
+// TagValidator describes a single validation tag and how to use it. To be
+// findable by validation-gen, a TagValidator must be registered - see
+// RegisterTagValidator.
+//
+// TagValidators should not depend on other TagValidators having been run
+// already because users might specify tags in the any order.
+//
+// No other guarantees are made about the order of execution of TagValidators.
+// Instead of relying on tag ordering, TagValidators can
+// accumulate information internally and use a DeferredGen to finish the work.
+type TagValidator interface {
+	// Init initializes the implementation.  This will be called exactly once.
+	Init(cfg Config)
+
+	// TagName returns the full tag name (without the "marker" prefix) for this
+	// tag.
+	TagName() string
+
+	// ValidScopes returns the set of scopes where this tag may be used.
+	ValidScopes() sets.Set[Scope]
+
+	// GetValidations returns any validations described by this tag.
+	GetValidations(context Context, tag codetags.Tag) (Validations, error)
+
+	// Docs returns user-facing documentation for this tag.
+	Docs() TagDoc
+}
+
+// Config carries optional configuration information for use by validators.
+type Config struct {
+	// GengoContext provides gengo's generator Context.  This allows validators
+	// to look up all sorts of other information.
+	GengoContext *generator.Context
+
+	// TagValidator provides a way to compose validations.
+	//
+	// For example, it is possible to define a validation such as
+	// "+myValidator=+format=IP" by using the registry to extract the
+	// validation for the embedded "+format=IP" and use those to
+	// create the final Validations returned by the "+myValidator" tag.
+	//
+	// This field MUST NOT be used during init, since other validators may not
+	// be initialized yet.
+	TagValidator TagValidationExtractor
+
+	// InputToCanonicalPkg maps each input (API types) package to its canonical
+	// generated validation package (the one cross-package references resolve to).
+	// This is the same mapping the generator uses to locate generated
+	// Validate_<Type> functions, and lets validators reference hand-written
+	// functions that live alongside the generated code (e.g. +k8s:customValidation).
+	InputToCanonicalPkg map[string]string
+}
+
+// Scope describes where a validation (or potential validation) is located.
+type Scope string
+
+// Note: All of these values should be strings which can be used in an error
+// message such as "may not be used in %s".
+const (
+	// ScopeType indicates a validation on a type definition, which applies to
+	// all instances of that type.
+	ScopeType Scope = "type definitions"
+
+	// ScopeField indicates a validation on a particular struct field, which
+	// applies only to that field of that struct.
+	ScopeField Scope = "struct fields"
+
+	// ScopeListVal indicates a validation which applies to all elements of a
+	// list field or type.
+	ScopeListVal Scope = "list values"
+
+	// ScopeMapKey indicates a validation which applies to all keys of a map
+	// field or type.
+	ScopeMapKey Scope = "map keys"
+
+	// ScopeMapVal indicates a validation which applies to all values of a map
+	// field or type.
+	ScopeMapVal Scope = "map values"
+
+	// ScopeConst indicates a validation which applies to constant values only.
+	ScopeConst Scope = "constant values"
+
+	// TODO: It's not clear if we need to distinguish (e.g.) list values of
+	// fields from list values of typedefs.  We could make {type,field} be
+	// orthogonal to {scalar, list, list-value, map, map-key, map-value} (and
+	// maybe even pointers?), but that seems like extra work that is not needed
+	// for now.
+)
+
+// Context describes where a tag was used, so that the scope can be checked
+// and so validators can handle different cases if they need.
+type Context struct {
+	// Scope is where the validation is being considered.
+	Scope Scope
+
+	// Type provides details about the type being validated.  When Scope is
+	// ScopeType, this is the newly defined type.  When Scope is ScopeField,
+	// this is the field's type (which may be a pointer, an alias, or both).
+	// When Scope indicates a list-value, map-key, or map-value, this is the
+	// type of that key or value (which, again, may be a pointer, and alias, or
+	// both). When Scope is ScopeConst this is the constant's type.
+	Type *types.Type
+
+	// Path provides a path to the type or field being validated. This is
+	// useful for identifying an exact context, e.g. to track information
+	// between related tags. When Scope is ScopeType, this is the Go package
+	// path and type name (e.g. "k8s.io/api/core/v1.Pod"). When Scope is
+	// ScopeField, this is the field path (e.g. "spec.containers[*].image").
+	// When Scope indicates a list-value, map-key, or map-value, this is the
+	// type or field path, as described above, with a suffix indicating
+	// that it refers to the keys or values. For ScopeConst, this will be nil.
+	Path *field.Path
+
+	// Member provides details about a field within a struct when Scope is
+	// ScopeField.  For all other values of Scope, this will be nil.
+	Member *types.Member
+
+	// ListSelector provides a list of key-value pairs that represent criteria
+	// for selecting one or more items from a list.  When Scope is
+	// ScopeListVal, this will be non-nil.  An empty selector means that
+	// all items in the list should be selected.  For all other values of
+	// Scope, this will be nil.
+	ListSelector []ListSelectorTerm
+
+	// ParentPath provides a path to the parent type or field of the object
+	// being validated, when applicable. enabling unique identification of
+	// validation contexts for the same type in different locations.  When
+	// Scope is ScopeField, this is the path to the containing struct type or
+	// field (depending on where the validation tag was sepcified).  When Scope
+	// indicates a list-value, map-key, or map-value, this is the path to the
+	// list or map type or field (depending on where the validation tag was
+	// specified). When Scope is ScopeType, this is nil.
+	ParentPath *field.Path
+
+	// ParentType provides the type of the parent of the object being validated.
+	// When Scope is ScopeField, this is the containing struct type. When Scope
+	// indicates a list-value, map-key, or map-value, this is the list or map type.
+	// When the scope is ScopeType, this is nil.
+	ParentType *types.Type
+
+	// Constants provides access to all constants of the type being
+	// validated.  Only set when Scope is ScopeType.
+	Constants []*Constant
+
+	// StabilityLevel indicates the stability on the corresponding validation.
+	StabilityLevel ValidationStabilityLevel
+}
+
+// Constant represents a constant value.
+type Constant struct {
+	Constant *types.Type
+	Tags     []codetags.Tag
+}
+
+// ListSelectorTerm represents a field name and value pair.
+type ListSelectorTerm struct {
+	// Field is the JSON name of the field to match.
+	Field string
+	// Value is the value to match.  This must be a primitive type which can
+	// be used as list-map keys: string, int, or bool.
+	Value any
+}
+
+// TagStabilityLevel indicates the stability of a validation tag.
+type TagStabilityLevel string
+
+const (
+	// TagStabilityLevelAlpha indicates that a tag's semantics may change in the future.
+	TagStabilityLevelAlpha TagStabilityLevel = "Alpha"
+	// TagStabilityLevelBeta indicates that a tag's semantics will remain unchanged for the
+	// foreseeable future. This is used for soaking tags before qualifying to stable.
+	TagStabilityLevelBeta TagStabilityLevel = "Beta"
+	// TagStabilityLevelStable indicates that a tag's semantics will remain unchanged for the
+	// foreseeable future.
+	TagStabilityLevelStable TagStabilityLevel = "Stable"
+)
+
+var stabilityOrder = map[TagStabilityLevel]int{
+	TagStabilityLevelAlpha:  0,
+	TagStabilityLevelBeta:   1,
+	TagStabilityLevelStable: 2,
+}
+
+// Validation stability level denotes the stability of a validation.
+type ValidationStabilityLevel string
+
+const (
+	// Alpha denotes the declarative validations should be run with the handwritten validation. But the handwritten validations are the authoritative.
+	ValidationStabilityLevelAlpha ValidationStabilityLevel = "Alpha"
+	// Beta denotes the declarative validations should be run with the handwritten validation. Declarative validations are authoritative.
+	ValidationStabilityLevelBeta ValidationStabilityLevel = "Beta"
+)
+
+// Compare returns an integer comparing two stability levels, or an error if either
+// stability level is unknown.
+func (s TagStabilityLevel) Compare(other TagStabilityLevel) (int, error) {
+	sOrder, okS := stabilityOrder[s]
+	if !okS {
+		return 0, fmt.Errorf("unknown stability level %q", s)
+	}
+	otherOrder, okOther := stabilityOrder[other]
+	if !okOther {
+		return 0, fmt.Errorf("unknown stability level %q", other)
+	}
+	return sOrder - otherOrder, nil
+}
+
+// TagDoc describes a comment-tag and its usage.
+type TagDoc struct {
+	// Tag is the tag name, without the leading '+'.
+	Tag string
+	// StabilityLevel is the stability level of the tag.
+	StabilityLevel TagStabilityLevel
+	// Args lists any arguments this tag might take.
+	Args []TagArgDoc `json:",omitempty"`
+	// Usage is how the tag is used, including arguments.
+	Usage string
+	// Description is a short description of this tag's purpose.
+	Description string
+	// Docs is a human-oriented string explaining this tag.
+	Docs string
+	// Warning is an optional warning about this tag.
+	Warning string `json:",omitempty"`
+	// Scopes lists the place or places this tag may be used.
+	Scopes []Scope
+	// Payloads lists zero or more varieties of value for this tag. If this tag
+	// never has a payload, this list should be empty, but if the payload is
+	// optional, this list should include an entry for "<none>".
+	Payloads []TagPayloadDoc `json:",omitempty"`
+	// PayloadsType is the type of the payloads.
+	PayloadsType codetags.ValueType `json:",omitempty"`
+	// PayloadsRequired is true if a payload is required.
+	PayloadsRequired bool `json:",omitempty"`
+	// AcceptsUnknownArgs is true if unknown args are accepted
+	AcceptsUnknownArgs bool `json:",omitempty"`
+}
+
+func (td TagDoc) Arg(name string) (TagArgDoc, bool) {
+	for _, arg := range td.Args {
+		if arg.Name == name {
+			return arg, true
+		}
+	}
+	return TagArgDoc{}, false
+}
+
+// TagArgDoc describes an argument for a tag.
+//
+// For example,
+//
+//	`+tagName(arg)`
+//	`+tagName(name1: arg1, name2: arg2)`
+type TagArgDoc struct {
+	// Name of this arg. Not provided for positional args.
+	Name string
+	// Description is a short description of this arg (e.g. `<name>`).
+	Description string
+	// Type is the type of the arg.
+	Type codetags.ArgType
+	// Required is true if the argument is required.
+	Required bool
+	// Default is the effective value if no value is provided.
+	Default string
+	// Docs is a human-oriented string explaining this arg.
+	Docs string
+}
+
+// TagPayloadDoc describes a value for a tag (e.g. `+tagName=tagValue`).  Some
+// tags support multiple payloads, including <none> (e.g. `+tagName`).
+type TagPayloadDoc struct {
+	// Description is a short description of this payload (e.g. `<number>`).
+	Description string
+	// Docs is a human-oriented string explaining this payload.
+	Docs string
+}
+
+// Validations define the function calls and variables to generate to perform
+// validation.
+type Validations struct {
+	// Functions hold the function calls that should be generated to perform
+	// validation.  These functions may not be called in order - they may be
+	// sorted based on their flags and other criteria.
+	//
+	// Each function's signature must be of the form:
+	//   func(
+	//        // standard arguments
+	//        ctx context.Context
+	//        op operation.Operation,
+	//        fldPath field.Path,
+	//        value, oldValue <ValueType>, // always nilable
+	//        // additional arguments (optional)
+	//        Args[0] <Args[0]Type>,
+	//        Args[1] <Args[1]Type>,
+	//        ...
+	//        Args[N] <Args[N]Type>)
+	//
+	// The standard arguments are not included in the FunctionGen.Args list.
+	Functions []FunctionGen
+
+	// Variables hold any variables which must be generated to perform
+	// validation.  Variables are not permitted in every context.
+	Variables []VariableGen
+
+	// Comments holds comments to emit (without the leading "//").
+	Comments []string
+
+	// OpaqueType indicates that the type being validated is opaque, and that
+	// any validations defined on it should not be emitted.
+	OpaqueType bool
+
+	// OpaqueKeyType indicates that the key type of a map being validated is
+	// opaque, and that any validations defined on it should not be emitted.
+	OpaqueKeyType bool
+
+	// OpaqueValType indicates that the key type of a map or slice being
+	// validated is opaque, and that any validations defined on it should not
+	// be emitted.
+	OpaqueValType bool
+
+	// Deferred holds a list of callbacks which will be executed after all other
+	// validation generation is complete. This allows validators to defer
+	// decision making until they have more information (e.g. about other
+	// validators). Deferred callbacks may return further deferred validations,
+	// which will be processed iteratively until exhaustion.
+	Deferred []DeferredGen
+}
+
+func (v *Validations) Empty() bool {
+	return !v.HasEmitable() &&
+		!v.OpaqueType &&
+		!v.OpaqueKeyType &&
+		!v.OpaqueValType
+}
+
+func (v *Validations) HasEmitable() bool {
+	return len(v.Functions) > 0 || len(v.Variables) > 0 || len(v.Comments) > 0 || len(v.Deferred) > 0
+}
+
+func (v *Validations) AddFunction(fn FunctionGen) {
+	v.Functions = append(v.Functions, fn)
+}
+
+func (v *Validations) AddVariable(vr VariableGen) {
+	v.Variables = append(v.Variables, vr)
+}
+
+func (v *Validations) AddDeferred(d DeferredGen) {
+	v.Deferred = append(v.Deferred, d)
+}
+
+func (v *Validations) AddComment(comment string) {
+	v.Comments = append(v.Comments, comment)
+}
+
+func (v *Validations) Add(o Validations) {
+	v.Functions = append(v.Functions, o.Functions...)
+	v.Variables = append(v.Variables, o.Variables...)
+	v.Comments = append(v.Comments, o.Comments...)
+	v.Deferred = append(v.Deferred, o.Deferred...)
+	v.OpaqueType = v.OpaqueType || o.OpaqueType
+	v.OpaqueKeyType = v.OpaqueKeyType || o.OpaqueKeyType
+	v.OpaqueValType = v.OpaqueValType || o.OpaqueValType
+}
+
+// Clone returns a copy of v with new slices for its slice fields.
+func (v Validations) Clone() Validations {
+	res := v
+	if v.Functions != nil {
+		res.Functions = make([]FunctionGen, len(v.Functions))
+		copy(res.Functions, v.Functions)
+	}
+	if v.Variables != nil {
+		res.Variables = make([]VariableGen, len(v.Variables))
+		copy(res.Variables, v.Variables)
+	}
+	if v.Comments != nil {
+		res.Comments = make([]string, len(v.Comments))
+		copy(res.Comments, v.Comments)
+	}
+	if v.Deferred != nil {
+		res.Deferred = make([]DeferredGen, len(v.Deferred))
+		copy(res.Deferred, v.Deferred)
+	}
+	return res
+}
+
+// WrapFunctions applies the given wrap function to all functions in this Validations object
+// and recursively to all Deferred validations, passing the appropriate scope.
+// Useful for applying common transformations (e.g., conditionals, stability levels)
+// to all validations, including deferred ones.
+func WrapFunctions(v Validations, wrapFn func(FunctionGen, DeferredScope) FunctionGen) Validations {
+	return wrapFunctionsWithScope(v, wrapFn, ThisContext)
+}
+
+func wrapFunctionsWithScope(v Validations, wrapFn func(FunctionGen, DeferredScope) FunctionGen, scope DeferredScope) Validations {
+	result := v.Clone()
+	result.Functions = nil
+	result.Deferred = nil
+
+	for _, fn := range v.Functions {
+		result.AddFunction(wrapFn(fn, scope))
+	}
+
+	for _, d := range v.Deferred {
+		result.AddDeferred(Deferred(d.Scope, func() (Validations, error) {
+			inner, err := d.Callback()
+			if err != nil {
+				return Validations{}, err
+			}
+			return wrapFunctionsWithScope(inner, wrapFn, d.Scope), nil
+		}))
+	}
+
+	return result
+}
+
+// FunctionFlags define optional properties of a validator.  Most validators
+// can just use DefaultFlags.
+type FunctionFlags uint32
+
+// IsSet returns true if all of the wanted flags are set.
+func (ff FunctionFlags) IsSet(wanted FunctionFlags) bool {
+	return (ff & wanted) == wanted
+}
+
+const (
+	// DefaultFlags is defined for clarity.
+	DefaultFlags FunctionFlags = 0
+
+	// ShortCircuit indicates that further validations should be skipped if
+	// this validator fails. If there are multiple validators with this flag
+	// set, they will ALL run, and if any of them fail, any non-short-circuit
+	// validators will be skipped.  Most validators are not fatal.
+	ShortCircuit FunctionFlags = 1 << iota
+
+	// NonError indicates that a failure of this validator should not be
+	// accumulated as an error, but should trigger other aspects of the failure
+	// path (e.g. early return when combined with ShortCircuit).
+	NonError
+)
+
+// Conditions defines what conditions must be true for a resource to be validated.
+// If any of the conditions are not true, the resource is not validated.
+type Conditions struct {
+	// OptionEnabled specifies an option name that must be set to true for the condition to be true.
+	OptionEnabled string
+
+	// OptionDisabled specifies an option name that must be set to false for the condition to be true.
+	OptionDisabled string
+}
+
+func (c Conditions) Empty() bool {
+	return len(c.OptionEnabled) == 0 && len(c.OptionDisabled) == 0
+}
+
+// Identifier is a name that the generator will output as an identifier.
+// Identifiers are generated using the RawNamer strategy.
+type Identifier types.Name
+
+// PrivateVar is a variable name that the generator will output as a private identifier.
+// PrivateVars are generated using the PrivateNamer strategy.
+type PrivateVar types.Name
+
+// Function creates a FunctionGen for a given function name and extraArgs.
+func Function(tagName string, flags FunctionFlags, function types.Name, extraArgs ...any) FunctionGen {
+	return FunctionGen{
+		TagName:  tagName,
+		Flags:    flags,
+		Function: function,
+		Args:     extraArgs,
+	}
+}
+
+// DeferredScope indicates how long a validation should be deferred.
+type DeferredScope string
+
+const (
+	// ThisContext defers validation until the end of the current context (e.g. field or type).
+	ThisContext DeferredScope = "ThisContext"
+	// ParentContext defers validation until the end of the parent context (e.g. to accumulate data across fields in a struct).
+	ParentContext DeferredScope = "ParentContext"
+)
+
+// Deferred creates a DeferredGen for a given callback.
+func Deferred(scope DeferredScope, callback func() (Validations, error)) DeferredGen {
+	return DeferredGen{
+		Scope:    scope,
+		Callback: callback,
+	}
+}
+
+// DeferredGen describes a validation generation task that is deferred until
+// later.
+type DeferredGen struct {
+	Scope    DeferredScope
+	Callback func() (Validations, error)
+}
+
+// Emission describes the field.Error a runtime validator produces on failure.
+// Must match what the runtime function emits via .WithOrigin(...).
+type Emission struct {
+	Type   field.ErrorType
+	Origin string
+	// PathFragment, when non-empty, is the static field-path component the
+	// runtime validator appends to fldPath before emitting the error (e.g.
+	// "[*]" for Unique, which reports field.Duplicate(fldPath.Index(i), ...)
+	// at the offending element). Used by tools that walk the FunctionGen
+	// tree to reconstruct the path the runtime will emit at.
+	PathFragment string
+}
+
+// FunctionGen describes a function call that should be generated.
+type FunctionGen struct {
+	// TagName is the tag which triggered this function.
+	TagName string
+
+	// Cohort indicates a set of related functions which are processed
+	// together.
+	Cohort string
+
+	// Flags holds the options for this validator function.
+	Flags FunctionFlags
+
+	// Function is the name of the function to call.
+	Function types.Name
+
+	// Args holds arguments to pass to the function, and may conatin:
+	// - data literals comprised of maps, slices, strings, ints, floats, and bools
+	// - types.Type (to reference any type in the universe)
+	// - types.Member (to reference members of the current value)
+	// - types.Identifier (to reference any identifier in the universe)
+	// - validators.WrapperFunction (to call another validation function)
+	// - validators.Literal (to pass a literal value)
+	// - validators.FunctionLiteral (to pass a function literal)
+	// - validators.PrivateVar (to reference a variable)
+	//
+	// See toGolangSourceDataLiteral for details.
+	Args []any
+
+	// TypeArgs assigns types to the type parameters of the function, for
+	// generic function calls which require explicit type arguments.
+	TypeArgs []types.Name
+
+	// Conditions holds any conditions that must true for a field to be
+	// validated by this function.
+	Conditions Conditions
+
+	// Comments holds optional comments that should be added to the generated
+	// code (without the leading "//").
+	Comments []string
+
+	// StabilityLevel indicates the stability level of the corresponding validation.
+	StabilityLevel ValidationStabilityLevel
+
+	// StabilityLevelSelfManaged indicates that the function already has stability levels
+	// embedded or handled, and should not be wrapped by levelTagValidator.
+	StabilityLevelSelfManaged bool
+
+	// Emits, when non-empty, declares the field.Errors the runtime validator
+	// produces on failure. Set via WithEmits; empty for wrappers and
+	// non-emitting validators. A single function call may emit errors of
+	// different types and/or at different path fragments (e.g. ValSliceUpdate
+	// with NoAddItem and NoRemoveItem), so this is a slice.
+	Emits []Emission
+}
+
+// WithTypeArgs returns a derived FunctionGen with type arguments.
+func (fg FunctionGen) WithTypeArgs(typeArgs ...types.Name) FunctionGen {
+	fg.TypeArgs = typeArgs
+	return fg
+}
+
+// WithConditions returns a derived FunctionGen with conditions.
+func (fg FunctionGen) WithConditions(conditions Conditions) FunctionGen {
+	fg.Conditions = conditions
+	return fg
+}
+
+// WithComments returns a new FunctionGen with a comment.
+func (fg FunctionGen) WithComments(comments ...string) FunctionGen {
+	fg.Comments = append(fg.Comments, comments...)
+	return fg
+}
+
+// WithComment returns a new FunctionGen with a comment.
+func (fg FunctionGen) WithComment(comment string) FunctionGen {
+	return fg.WithComments(comment)
+}
+
+// WithStabilityLevel returns a new FunctionGen with the given stability level.
+func (fg FunctionGen) WithStabilityLevel(level ValidationStabilityLevel) FunctionGen {
+	fg.StabilityLevel = level
+	return fg
+}
+
+// WithEmits returns a new FunctionGen that declares the field.Errors the
+// runtime validator produces on failure. A function may emit more than one
+// distinct (type, path) tuple — pass each as a separate Emission.
+func (fg FunctionGen) WithEmits(emits ...Emission) FunctionGen {
+	fg.Emits = emits
+	return fg
+}
+
+// Variable creates a VariableGen for a given variable name and init value.
+func Variable(variable PrivateVar, initializer any) VariableGen {
+	return VariableGen{
+		Variable:    variable,
+		Initializer: initializer,
+	}
+}
+
+type VariableGen struct {
+	// Variable holds the variable identifier.
+	Variable PrivateVar
+
+	// Initializer is the value to initialize the variable with.
+	// Initializer may be any function call or literal type supported by toGolangSourceDataLiteral.
+	Initializer any
+}
+
+// WrapperFunction describes a function literal which has the fingerprint of a
+// regular validation function (op, fldPath, obj, oldObj) and calls another
+// validation function with the same signature, plus extra args if needed.
+type WrapperFunction struct {
+	Function FunctionGen
+	ObjType  *types.Type
+	// PathFragment, when non-empty, is the static field-path component the
+	// wrapping FunctionGen adds to fldPath before invoking Function (e.g.
+	// "[*]" for slice/map value iteration, ".<name>" for subfield). Used
+	// by tools that walk the FunctionGen tree to reconstruct field paths.
+	PathFragment string
+}
+
+// MultiWrapperFunction describes a function literal which has the fingerprint
+// of a regular validation function (op, fldPath, obj, oldObj) and calls
+// multiple other validation functions with the same signature.
+type MultiWrapperFunction struct {
+	Functions []FunctionGen
+	ObjType   *types.Type
+	// PathFragment, when non-empty, is the static field-path component the
+	// wrapping FunctionGen adds to fldPath before invoking the inner Functions
+	// (e.g. ".<jsonName>" for the discriminated-mode validator). Used by tools
+	// that walk the FunctionGen tree to reconstruct field paths.
+	PathFragment string
+}
+
+// Literal is a literal value that, when used as an argument to a validator,
+// will be emitted without any further interpretation.  Use this with caution,
+// it will not be subject to Namers.
+type Literal string
+
+// FunctionLiteral describes a function-literal expression that can be used as
+// an argument to a validator.  Unlike WrapperFunction, this does not
+// necessarily have the same signature as a regular validation function.
+type FunctionLiteral struct {
+	Parameters []ParamResult
+	Results    []ParamResult
+	Body       string
+}
+
+// StructLiteral represents a struct literal expression that can be used as
+// an argument to a validator.
+type StructLiteral struct {
+	// Type is the type of the struct literal to be generated.
+	Type types.Name
+	// TypeArgs are the generic type arguments for the struct type.
+	TypeArgs []*types.Type
+	Fields   []StructLiteralField
+}
+
+// SliceLiteral represents a slice literal expression that can be used as
+// an argument to a validator.
+type SliceLiteral struct {
+	// ElementType is the type of the elements in the slice.
+	ElementType types.Name
+	// ElementTypeArgs are the generic type arguments for the element type.
+	ElementTypeArgs []*types.Type
+	Elements        []any
+}
+
+type StructLiteralField struct {
+	Name  string
+	Value any
+}
+
+// ParamResult represents a parameter or a result of a function.
+type ParamResult struct {
+	Name string
+	Type *types.Type
+}
+
+// typeCheck checks that the argument and value types of the tag match the types
+// declared in the doc.
+func typeCheck(tag codetags.Tag, doc TagDoc) error {
+	for _, docArg := range doc.Args {
+		hasArg := false
+		for _, tagArg := range tag.Args {
+			if tagArg.Name == docArg.Name {
+				hasArg = true
+				if docArg.Type != tagArg.Type {
+					return fmt.Errorf("argument %q has wrong type: got %s, want %s",
+						tagArg, tagArg.Type, docArg.Type)
+				}
+				break
+			}
+		}
+		if !hasArg && docArg.Required {
+			if docArg.Name == "" {
+				return fmt.Errorf("missing required positional argument of type %s", docArg.Type)
+			} else {
+				return fmt.Errorf("missing named argument %q of type %s", docArg.Name, docArg.Type)
+			}
+		}
+	}
+
+	for _, tagArg := range tag.Args {
+		if _, ok := doc.Arg(tagArg.Name); !ok {
+			if !doc.AcceptsUnknownArgs {
+				return fmt.Errorf("unrecognized named argument %q", tagArg)
+			}
+		}
+	}
+	if tag.ValueType == codetags.ValueTypeNone {
+		if doc.PayloadsRequired {
+			return fmt.Errorf("missing required tag value of type %s", doc.PayloadsType)
+		}
+	} else if doc.PayloadsType != codetags.ValueTypeRaw && tag.ValueType != doc.PayloadsType {
+		return fmt.Errorf("tag value has wrong type: got %s, want %s", tag.ValueType, doc.PayloadsType)
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/validators_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/validators_test.go
new file mode 100644
index 0000000000..5586168b46
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/validators_test.go
@@ -0,0 +1,219 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"strings"
+	"testing"
+
+	"k8s.io/gengo/v2/codetags"
+)
+
+func TestTypeCheck(t *testing.T) {
+
+	mkt := func(args []codetags.Arg, valueType codetags.ValueType) codetags.Tag {
+		return codetags.Tag{
+			Args:      args,
+			ValueType: valueType,
+		}
+	}
+
+	mkta := func(name string, value string, argType codetags.ArgType) codetags.Arg {
+		return codetags.Arg{
+			Name:  name,
+			Value: value,
+			Type:  argType,
+		}
+	}
+
+	mkd := func(args []TagArgDoc, payloadsRequired bool, payloadsType codetags.ValueType) TagDoc {
+		return TagDoc{
+			Args:             args,
+			PayloadsRequired: payloadsRequired,
+			PayloadsType:     payloadsType,
+		}
+	}
+
+	mkda := func(name string, argType codetags.ArgType, required bool) TagArgDoc {
+		return TagArgDoc{
+			Name:     name,
+			Type:     argType,
+			Required: required,
+		}
+	}
+	tests := []struct {
+		name    string
+		tag     codetags.Tag
+		doc     TagDoc
+		wantErr string
+	}{
+		{
+			name: "valid tag with no args",
+			tag:  mkt(nil, codetags.ValueTypeNone),
+			doc:  mkd(nil, false, codetags.ValueTypeNone),
+		},
+
+		// named args
+		{
+			name: "valid tag with required named args",
+			tag: mkt([]codetags.Arg{
+				mkta("arg1", "value1", codetags.ArgTypeString),
+				mkta("arg2", "value2", codetags.ArgTypeString),
+			}, codetags.ValueTypeNone),
+			doc: mkd([]TagArgDoc{
+				mkda("arg1", codetags.ArgTypeString, true),
+				mkda("arg2", codetags.ArgTypeString, true),
+			}, false, codetags.ValueTypeNone),
+		},
+		{
+			name: "valid tag with optional named args",
+			tag: mkt([]codetags.Arg{
+				mkta("arg1", "value1", codetags.ArgTypeString),
+				mkta("arg2", "value2", codetags.ArgTypeString),
+			}, codetags.ValueTypeNone),
+			doc: mkd([]TagArgDoc{
+				mkda("arg1", codetags.ArgTypeString, false),
+				mkda("arg2", codetags.ArgTypeString, false),
+			}, false, codetags.ValueTypeNone),
+		},
+		{
+			name: "valid tag without optional named args",
+			tag:  mkt([]codetags.Arg{}, codetags.ValueTypeNone),
+			doc: mkd([]TagArgDoc{
+				mkda("arg1", codetags.ArgTypeString, false),
+				mkda("arg2", codetags.ArgTypeString, false),
+			}, false, codetags.ValueTypeNone),
+		},
+		{
+			name: "missing required named argument",
+			tag:  mkt(nil, codetags.ValueTypeNone),
+			doc: mkd([]TagArgDoc{
+				mkda("arg1", codetags.ArgTypeString, true),
+			}, false, codetags.ValueTypeNone),
+			wantErr: "missing named argument",
+		},
+		{
+			name: "named argument with wrong type",
+			tag: mkt([]codetags.Arg{
+				mkta("arg1", "value1", codetags.ArgTypeString),
+			}, codetags.ValueTypeNone),
+			doc: mkd([]TagArgDoc{
+				mkda("arg1", codetags.ArgTypeInt, true),
+			}, false, codetags.ValueTypeNone),
+			wantErr: "has wrong type: got string, want int",
+		},
+		{
+			name: "unrecognized named argument",
+			tag: mkt([]codetags.Arg{
+				mkta("arg1", "value1", codetags.ArgTypeString),
+				mkta("arg2", "value2", codetags.ArgTypeString),
+			}, codetags.ValueTypeNone),
+			doc: mkd([]TagArgDoc{
+				mkda("arg1", codetags.ArgTypeString, true),
+			}, false, codetags.ValueTypeNone),
+			wantErr: "unrecognized named argument",
+		},
+
+		// positional arg
+		{
+			name: "valid tag with required positional arg",
+			tag: mkt([]codetags.Arg{
+				mkta("", "value1", codetags.ArgTypeString),
+			}, codetags.ValueTypeNone),
+			doc: mkd([]TagArgDoc{
+				mkda("", codetags.ArgTypeString, true),
+			}, false, codetags.ValueTypeNone),
+		},
+		{
+			name: "valid tag with optional positional arg",
+			tag: mkt([]codetags.Arg{
+				mkta("", "value1", codetags.ArgTypeString),
+			}, codetags.ValueTypeNone),
+			doc: mkd([]TagArgDoc{
+				mkda("", codetags.ArgTypeString, false),
+			}, false, codetags.ValueTypeNone),
+		},
+		{
+			name: "valid tag without optional positional arg",
+			tag:  mkt([]codetags.Arg{}, codetags.ValueTypeNone),
+			doc: mkd([]TagArgDoc{
+				mkda("", codetags.ArgTypeString, false),
+			}, false, codetags.ValueTypeNone),
+		},
+		{
+			name: "missing required positional argument",
+			tag:  mkt(nil, codetags.ValueTypeNone),
+			doc: mkd([]TagArgDoc{
+				mkda("", codetags.ArgTypeString, true),
+			}, false, codetags.ValueTypeNone),
+			wantErr: "missing required positional argument",
+		},
+		{
+			name: "positional argument with wrong type",
+			tag: mkt([]codetags.Arg{
+				mkta("", "value1", codetags.ArgTypeString),
+			}, codetags.ValueTypeNone),
+			doc: mkd([]TagArgDoc{
+				mkda("", codetags.ArgTypeInt, true),
+			}, false, codetags.ValueTypeNone),
+			wantErr: "has wrong type: got string, want int",
+		},
+
+		// values
+		{
+			name: "valid required tag value",
+			tag:  mkt(nil, codetags.ValueTypeString),
+			doc:  mkd(nil, true, codetags.ValueTypeString),
+		},
+		{
+			name: "valid with optional tag value",
+			tag:  mkt(nil, codetags.ValueTypeString),
+			doc:  mkd(nil, false, codetags.ValueTypeString),
+		},
+		{
+			name: "valid without optional tag value",
+			tag:  mkt(nil, codetags.ValueTypeNone),
+			doc:  mkd(nil, false, codetags.ValueTypeString),
+		},
+		{
+			name:    "missing required tag value",
+			tag:     mkt(nil, codetags.ValueTypeNone),
+			doc:     mkd(nil, true, codetags.ValueTypeString),
+			wantErr: "missing required tag value",
+		},
+		{
+			name:    "tag value with wrong type",
+			tag:     mkt(nil, codetags.ValueTypeString),
+			doc:     mkd(nil, false, codetags.ValueTypeInt),
+			wantErr: "tag value has wrong type",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := typeCheck(tt.tag, tt.doc)
+			if (len(tt.wantErr) == 0) != (err == nil) {
+				t.Errorf("typeCheck() error = %v, wantErr = %v", err, tt.wantErr)
+			}
+			if err != nil && tt.wantErr != "" {
+				if !strings.Contains(err.Error(), tt.wantErr) {
+					t.Errorf("typeCheck() error = %v, wantErr = %v", err, tt.wantErr)
+				}
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/zeroorone.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/zeroorone.go
new file mode 100644
index 0000000000..45fa8022e4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/cmd/validation-gen/validators/zeroorone.go
@@ -0,0 +1,120 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validators
+
+import (
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/code-generator/cmd/validation-gen/util"
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+var zeroOrOneOfUnionValidator = types.Name{Package: libValidationPkg, Name: "ZeroOrOneOfUnion"}
+var zeroOrOneOfVariablePrefix = "zeroOrOneOfMembershipFor"
+
+func init() {
+	// ZeroOrOneOf unions are comprised of multiple tags, which need to share information
+	// between them.  The tags are on struct fields, but the validation
+	// actually pertains to the struct itself.
+	shared := map[string]unions{}
+	RegisterTagValidator(zeroOrOneOfMemberTagValidator{shared})
+}
+
+func getZeroOrOneOfValidations(shared map[string]unions, context Context) (Validations, error) {
+	// unions are keyed by ParentPath for struct fields (ScopeField), or Path for others.
+	structPath := context.ParentPath.String()
+
+	// Gengo does not treat struct definitions as aliases, which is
+	// inconsistent but unlikely to change. That means we don't REALLY need to
+	// handle it here, but let's be extra careful and extract the most concrete
+	// type possible.
+	if k := util.NonPointer(util.NativeType(context.ParentType)).Kind; k != types.Struct && k != types.Slice {
+		return Validations{}, nil
+	}
+
+	unions := shared[structPath]
+	if len(unions) == 0 {
+		return Validations{}, nil
+	}
+	delete(shared, structPath)
+
+	result, err := processUnionValidations(context.ParentPath, context.ParentType, unions, zeroOrOneOfVariablePrefix,
+		zeroOrOneOfMemberTagName, zeroOrOneOfUnionValidator, types.Name{},
+		Emission{field.ErrorTypeInvalid, "zeroOrOneOf", ""})
+	return result, err
+}
+
+const (
+	// This tag should only ever be used on list item types, never on struct
+	// fields directly.  If applied to struct fields, the "orR one of" behavior
+	// is frozen at this moment in time, and can never be expanded. Why?
+	// Back-rev clients can't tell the difference between "zero were specified"
+	// and "a field I don't know about was specified".
+	zeroOrOneOfMemberTagName = "k8s:zeroOrOneOfMember"
+)
+
+type zeroOrOneOfMemberTagValidator struct {
+	shared map[string]unions
+}
+
+func (zeroOrOneOfMemberTagValidator) Init(_ Config) {}
+
+func (zeroOrOneOfMemberTagValidator) TagName() string {
+	return zeroOrOneOfMemberTagName
+}
+
+func (zeroOrOneOfMemberTagValidator) ValidScopes() sets.Set[Scope] {
+	return sets.New(ScopeField, ScopeListVal)
+}
+
+func (zmtv zeroOrOneOfMemberTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+	err := processMemberValidations(zmtv.shared, context, tag)
+	if err != nil {
+		return Validations{}, err
+	}
+	return Validations{
+		Deferred: []DeferredGen{
+			Deferred(ParentContext, func() (Validations, error) {
+				return getZeroOrOneOfValidations(zmtv.shared, context)
+			}),
+		},
+	}, nil
+}
+
+func (zmtv zeroOrOneOfMemberTagValidator) Docs() TagDoc {
+	return TagDoc{
+		Tag:            zmtv.TagName(),
+		Scopes:         sets.List(zmtv.ValidScopes()),
+		StabilityLevel: TagStabilityLevelStable,
+		Description:    "Indicates that this field is a member of a zero-or-one-of union.",
+		Docs:           "A zero-or-one-of union allows at most one member to be set. Unlike regular unions, having no members set is valid.",
+		Warning:        "This tag should only be used on sets of list items, and never on struct fields directly.",
+		Args: []TagArgDoc{{
+			Name:        "union",
+			Description: "<string>",
+			Docs:        "the name of the union, if more than one exists",
+			Type:        codetags.ArgTypeString,
+		}, {
+			Name:        "memberName",
+			Description: "<string>",
+			Docs:        "the custom member name for this member",
+			Default:     "the field's name",
+			Type:        codetags.ArgTypeString,
+		}},
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/code-of-conduct.md b/hack/tools/code-generator/third_party/k8s.io/code-generator/code-of-conduct.md
new file mode 100644
index 0000000000..0d15c00cf3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/code-of-conduct.md
@@ -0,0 +1,3 @@
+# Kubernetes Community Code of Conduct
+
+Please refer to our [Kubernetes Community Code of Conduct](https://git.k8s.io/community/code-of-conduct.md)
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/doc.go
new file mode 100644
index 0000000000..3ef48f7521
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/doc.go
@@ -0,0 +1,17 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package codegenerator
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/docs/DEVELOPMENT.md b/hack/tools/code-generator/third_party/k8s.io/code-generator/docs/DEVELOPMENT.md
new file mode 100644
index 0000000000..4f8ec48f4a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/docs/DEVELOPMENT.md
@@ -0,0 +1,122 @@
+# Developing Kubernetes Code Generators
+
+## Context
+
+The `k8s.io/code-generator` repository contains a collection of code generators for Kubernetes-style API types. These generators are essential for building Kubernetes controllers, custom resource definitions (CRDs), and aggregated API servers. They automate the creation of boilerplate code required to interact with the Kubernetes API machinery, ensuring consistency and reducing manual toil.
+
+## Background & History
+
+This repository is synced from the main Kubernetes repository (`kubernetes/kubernetes`). Changes are typically made in the upstream `staging/src/k8s.io/code-generator` directory within `kubernetes/kubernetes` and then published here.
+
+Historically, writing Kubernetes controllers involved writing significant amounts of boilerplate code for watching resources, maintaining local caches, and implementing client logic. The code generators were developed to mechanize this process, relying on Go struct tags (comment annotations) to drive the generation logic.
+
+## Technical Architecture
+
+The generators are built on top of `k8s.io/gengo`, a framework for generating code parsing Go files. The general flow is:
+
+1.  **Parsing:** The tools parse Go source files containing API type definitions (structs).
+2.  **Tag Extraction:** They look for specific comment tags (e.g., `// +genclient`, `// +k8s:deepcopy-gen=true`) to identify which types require code generation and how they should be processed.
+3.  **Generation:** Based on the tags and types, the tools generate Go code (and sometimes other formats like Protobuf IDL) using templates.
+
+### Key Concepts
+
+*   **Input:** Go packages containing API type definitions (typically in `pkg/apis/<group>/<version>`).
+*   **Tags:** Magic comments that control generation.
+*   **Output:** Generated Go files, often named `zz_generated.<generator>.go` or placed in specific subdirectories like `clientset`, `informers`, and `listers`.
+
+## Internal Mechanics & Development
+
+Based on maintainer insights (including notes from 2025/03/27), here are common patterns and strategies used when working with or developing these generators.
+
+### Debugging Strategy
+Debugging generators against a full codebase can be noisy. A common practice is to create a small, isolated test case:
+*   **Isolation:** Use a package name like `_hack` (prefixed with an underscore so it's ignored by default Go processes).
+*   **Targeted Execution:** Invoke the generator specifically against this package to step through logic in a debugger without processing every API group.
+
+### Two-Phase Execution
+Most generators follow a two-phase architecture:
+1.  **Discovery:** Recursively traversing the type tree to build a graph of types and fields.
+    *   **Root Types:** The tool scans packages for "root types" (entry points) based on specific tags (e.g., in `doc.go`) or the presence of `TypeMeta`.
+    *   **Graph Building:** It builds a graph of "Type Nodes" (the type itself) and "Child Nodes" (fields/instances).
+    *   **Early Filtering:** Unsupported cases are filtered out early during discovery. Examples include:
+        *   Pointers to pointers (`**T`)
+        *   Slices of pointers (`[]*T`)
+        *   Non-exported fields
+2.  **Generation (Emit):** Iterating over the discovered graph to produce Go code.
+
+### The "Call Frame" Pattern
+You will often see generated code wrapped in anonymous functions. This pattern is used to:
+*   **Simplify Scoping:** It allows the variable for the object at each recursive level to always be called `obj`, rather than tracking long chains like `obj.Spec.Template.Spec`.
+*   **Easy Short-Circuiting:** It enables early returns (e.g., if an optional field is nil) without complex nested `if/else` logic in the main function body.
+
+## The Generators
+
+The repository contains several specific generators, each located in `cmd/`:
+
+### 1. `client-gen`
+Generates typed clientsets for API groups.
+*   **Input:** API types tagged with `// +genclient`.
+*   **Output:** A `clientset` Go package providing easy-to-use methods for CRUD operations on resources.
+
+### 2. `lister-gen`
+Generates "Listers" for API resources.
+*   **Purpose:** Listers provide a read-only interface to access data from a local cache (Informer), avoiding expensive API server calls.
+
+### 3. `informer-gen`
+Generates "Informers" for API resources.
+*   **Purpose:** Informers watch the API server for changes and update a local cache (Store). They connect the Client to the Lister and allow registering event handlers.
+
+### 4. `deepcopy-gen`
+Generates `DeepCopy` methods for API types.
+*   **Purpose:** Kubernetes API objects are often passed by pointer. `DeepCopy` ensures that modifying an object in one part of the code (e.g., a cache) doesn't affect others.
+
+### 5. `defaulter-gen`
+Generates defaulting functions based on `// +default` tags.
+
+### 6. `conversion-gen`
+Generates conversion functions between different API versions (e.g., `v1` to `v1beta1`). Essential for the API server's internal hub model.
+
+### 7. `applyconfiguration-gen`
+Generates types for Server-Side Apply patches, allowing fields to be explicitly omitted.
+
+### 8. `register-gen`
+Generates registration code to make types known to the Kubernetes runtime Scheme.
+
+### 9. `go-to-protobuf`
+Generates Protobuf IDL and marshaling code for efficient communication.
+
+### 10. `prerelease-lifecycle-gen`
+Generates code that tracks API introduction, deprecation, and removal versions.
+
+### 11. `validation-gen`
+Generates validation logic based on struct tags.
+*   **Context:** Detailed walk-throughs have highlighted this tool to assist with upcoming "Ratcheting" features (checking if a field changed between versions).
+*   **Root Types:** Processes types identified as roots (often having `TypeMeta`).
+*   **Plugin Architecture:** Uses a plugin system for tag validators. Some tags are "late tags" that depend on shared state from previous tags (e.g., `listMap` validation).
+*   **Strict Rules:** Enforces patterns like requiring pointers for `optional` fields.
+
+## Usage
+
+The recommended way to invoke these generators is using the wrapper script `kube_codegen.sh` located in the root of this repository. This script orchestrates the execution of the individual generators with standard conventions.
+
+Example:
+
+```bash
+source "${CODEGEN_PKG}/kube_codegen.sh"
+
+kube::codegen::gen_helpers \
+    --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
+    "${SCRIPT_ROOT}/apis"
+
+kube::codegen::gen_client \
+    --with-watch \
+    --with-applyconfig \
+    --output-dir "${SCRIPT_ROOT}/pkg/client" \
+    --output-pkg "github.com/example/project/pkg/client" \
+    --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
+    "${SCRIPT_ROOT}/apis"
+```
+
+## Contributing
+
+Please refer to [CONTRIBUTING.md](../CONTRIBUTING.md) for guidelines on how to contribute. Remember that changes should generally be made in the `kubernetes/kubernetes` repository and not directly here.
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/.gitignore b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/.gitignore
new file mode 100644
index 0000000000..8ae0c29ad7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/.gitignore
@@ -0,0 +1,2 @@
+# avoid constant churn as this file is not kept in sync with the root
+go.work.sum
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/apis/example/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/apis/example/v1/doc.go
new file mode 100644
index 0000000000..aab826f935
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/apis/example/v1/doc.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=example-group.hyphens.code-generator.k8s.io
+// +groupGoName=ExampleGroup
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/apis/example/v1/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/apis/example/v1/types.go
new file mode 100644
index 0000000000..0f9c78bdee
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/apis/example/v1/types.go
@@ -0,0 +1,74 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestType is a top-level type. A client is created for it.
+type TestType struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +optional
+	Status TestTypeStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestTypeList is a top-level list type. The client methods for lists are automatically created.
+// You are not supposed to create a separated client for this one.
+type TestTypeList struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []TestType `json:"items"`
+}
+
+type TestTypeStatus struct {
+	Blah string `json:"blah"`
+}
+
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+type ClusterTestTypeList struct {
+	metav1.TypeMeta `json:""`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ClusterTestType `json:"items"`
+}
+
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +genclient:method=GetScale,verb=get,subresource=scale,result=k8s.io/api/autoscaling/v1.Scale
+// +genclient:method=UpdateScale,verb=update,subresource=scale,input=k8s.io/api/autoscaling/v1.Scale,result=k8s.io/api/autoscaling/v1.Scale
+
+type ClusterTestType struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +optional
+	Status ClusterTestTypeStatus `json:"status,omitempty"`
+}
+
+type ClusterTestTypeStatus struct {
+	Blah string `json:"blah"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/apis/example/v1/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/apis/example/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..5eee47016b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/apis/example/v1/zz_generated.deepcopy.go
@@ -0,0 +1,178 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterTestType) DeepCopyInto(out *ClusterTestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTestType.
+func (in *ClusterTestType) DeepCopy() *ClusterTestType {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterTestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterTestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterTestTypeList) DeepCopyInto(out *ClusterTestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ClusterTestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTestTypeList.
+func (in *ClusterTestTypeList) DeepCopy() *ClusterTestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterTestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterTestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterTestTypeStatus) DeepCopyInto(out *ClusterTestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTestTypeStatus.
+func (in *ClusterTestTypeStatus) DeepCopy() *ClusterTestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterTestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType) DeepCopyInto(out *TestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType.
+func (in *TestType) DeepCopy() *TestType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeList) DeepCopyInto(out *TestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeList.
+func (in *TestTypeList) DeepCopy() *TestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeStatus) DeepCopyInto(out *TestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeStatus.
+func (in *TestTypeStatus) DeepCopy() *TestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/apis/example/v1/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/apis/example/v1/zz_generated.defaults.go
new file mode 100644
index 0000000000..dac177e93b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/apis/example/v1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/apis/example/v1/zz_generated.register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/apis/example/v1/zz_generated.register.go
new file mode 100644
index 0000000000..e628aec057
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/apis/example/v1/zz_generated.register.go
@@ -0,0 +1,73 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by register-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName specifies the group name used to register the objects.
+const GroupName = "example-group.hyphens.code-generator.k8s.io"
+
+// GroupVersion specifies the group and the version used to register the objects.
+var GroupVersion = metav1.GroupVersion{Group: GroupName, Version: "v1"}
+
+// SchemeGroupVersion is group version used to register these objects
+//
+// Deprecated: use GroupVersion instead.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	// Deprecated: use Install instead
+	AddToScheme = localSchemeBuilder.AddToScheme
+	Install     = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&ClusterTestType{},
+		&ClusterTestTypeList{},
+		&TestType{},
+		&TestTypeList{},
+	)
+	// AddToGroupVersion allows the serialization of client types like ListOptions.
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1/clustertesttype.go
new file mode 100644
index 0000000000..6672f5a45a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1/clustertesttype.go
@@ -0,0 +1,233 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// ClusterTestTypeApplyConfiguration represents a declarative configuration of the ClusterTestType type for use
+// with apply.
+type ClusterTestTypeApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration    `json:""`
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Status                               *ClusterTestTypeStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// ClusterTestType constructs a declarative configuration of the ClusterTestType type for use with
+// apply.
+func ClusterTestType(name string) *ClusterTestTypeApplyConfiguration {
+	b := &ClusterTestTypeApplyConfiguration{}
+	b.WithName(name)
+	b.WithKind("ClusterTestType")
+	b.WithAPIVersion("example-group.hyphens.code-generator.k8s.io/v1")
+	return b
+}
+
+func (b ClusterTestTypeApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithKind(value string) *ClusterTestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithAPIVersion(value string) *ClusterTestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithName(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithGenerateName(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithNamespace(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithUID(value types.UID) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithResourceVersion(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithGeneration(value int64) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *ClusterTestTypeApplyConfiguration) WithLabels(entries map[string]string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *ClusterTestTypeApplyConfiguration) WithAnnotations(entries map[string]string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *ClusterTestTypeApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *ClusterTestTypeApplyConfiguration) WithFinalizers(values ...string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *ClusterTestTypeApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithStatus(value *ClusterTestTypeStatusApplyConfiguration) *ClusterTestTypeApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1/clustertesttypestatus.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1/clustertesttypestatus.go
new file mode 100644
index 0000000000..c2ccfa5811
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1/clustertesttypestatus.go
@@ -0,0 +1,39 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// ClusterTestTypeStatusApplyConfiguration represents a declarative configuration of the ClusterTestTypeStatus type for use
+// with apply.
+type ClusterTestTypeStatusApplyConfiguration struct {
+	Blah *string `json:"blah,omitempty"`
+}
+
+// ClusterTestTypeStatusApplyConfiguration constructs a declarative configuration of the ClusterTestTypeStatus type for use with
+// apply.
+func ClusterTestTypeStatus() *ClusterTestTypeStatusApplyConfiguration {
+	return &ClusterTestTypeStatusApplyConfiguration{}
+}
+
+// WithBlah sets the Blah field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Blah field is set to the value of the last call.
+func (b *ClusterTestTypeStatusApplyConfiguration) WithBlah(value string) *ClusterTestTypeStatusApplyConfiguration {
+	b.Blah = &value
+	return b
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1/testtype.go
new file mode 100644
index 0000000000..1afbe85802
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1/testtype.go
@@ -0,0 +1,236 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// TestTypeApplyConfiguration represents a declarative configuration of the TestType type for use
+// with apply.
+//
+// TestType is a top-level type. A client is created for it.
+type TestTypeApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration    `json:""`
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Status                               *TestTypeStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// TestType constructs a declarative configuration of the TestType type for use with
+// apply.
+func TestType(name, namespace string) *TestTypeApplyConfiguration {
+	b := &TestTypeApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("TestType")
+	b.WithAPIVersion("example-group.hyphens.code-generator.k8s.io/v1")
+	return b
+}
+
+func (b TestTypeApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithKind(value string) *TestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithAPIVersion(value string) *TestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithName(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithGenerateName(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithNamespace(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithUID(value types.UID) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithResourceVersion(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithGeneration(value int64) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *TestTypeApplyConfiguration) WithLabels(entries map[string]string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *TestTypeApplyConfiguration) WithAnnotations(entries map[string]string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *TestTypeApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *TestTypeApplyConfiguration) WithFinalizers(values ...string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *TestTypeApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithStatus(value *TestTypeStatusApplyConfiguration) *TestTypeApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1/testtypestatus.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1/testtypestatus.go
new file mode 100644
index 0000000000..246b2ee188
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1/testtypestatus.go
@@ -0,0 +1,39 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// TestTypeStatusApplyConfiguration represents a declarative configuration of the TestTypeStatus type for use
+// with apply.
+type TestTypeStatusApplyConfiguration struct {
+	Blah *string `json:"blah,omitempty"`
+}
+
+// TestTypeStatusApplyConfiguration constructs a declarative configuration of the TestTypeStatus type for use with
+// apply.
+func TestTypeStatus() *TestTypeStatusApplyConfiguration {
+	return &TestTypeStatusApplyConfiguration{}
+}
+
+// WithBlah sets the Blah field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Blah field is set to the value of the last call.
+func (b *TestTypeStatusApplyConfiguration) WithBlah(value string) *TestTypeStatusApplyConfiguration {
+	b.Blah = &value
+	return b
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/internal/internal.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/internal/internal.go
new file mode 100644
index 0000000000..c482faa5c2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/internal/internal.go
@@ -0,0 +1,62 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package internal
+
+import (
+	fmt "fmt"
+	sync "sync"
+
+	typed "sigs.k8s.io/structured-merge-diff/v6/typed"
+)
+
+func Parser() *typed.Parser {
+	parserOnce.Do(func() {
+		var err error
+		parser, err = typed.NewParser(schemaYAML)
+		if err != nil {
+			panic(fmt.Sprintf("Failed to parse schema: %v", err))
+		}
+	})
+	return parser
+}
+
+var parserOnce sync.Once
+var parser *typed.Parser
+var schemaYAML = typed.YAMLObject(`types:
+- name: __untyped_atomic_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+- name: __untyped_deduced_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_deduced_
+    elementRelationship: separable
+`)
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/utils.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/utils.go
new file mode 100644
index 0000000000..b2834e4ab5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/utils.go
@@ -0,0 +1,50 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package applyconfiguration
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	v1 "k8s.io/code-generator/examples/HyphenGroup/apis/example/v1"
+	examplev1 "k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1"
+	internal "k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/internal"
+)
+
+// ForKind returns an apply configuration type for the given GroupVersionKind, or nil if no
+// apply configuration type exists for the given GroupVersionKind.
+func ForKind(kind schema.GroupVersionKind) interface{} {
+	switch kind {
+	// Group=example-group.hyphens.code-generator.k8s.io, Version=v1
+	case v1.SchemeGroupVersion.WithKind("ClusterTestType"):
+		return &examplev1.ClusterTestTypeApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("ClusterTestTypeStatus"):
+		return &examplev1.ClusterTestTypeStatusApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("TestType"):
+		return &examplev1.TestTypeApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("TestTypeStatus"):
+		return &examplev1.TestTypeStatusApplyConfiguration{}
+
+	}
+	return nil
+}
+
+func NewTypeConverter(scheme *runtime.Scheme) managedfields.TypeConverter {
+	return managedfields.NewSchemeTypeConverter(scheme, internal.Parser())
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/clientset.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/clientset.go
new file mode 100644
index 0000000000..21fef60a51
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/clientset.go
@@ -0,0 +1,120 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package versioned
+
+import (
+	fmt "fmt"
+	http "net/http"
+
+	discovery "k8s.io/client-go/discovery"
+	rest "k8s.io/client-go/rest"
+	flowcontrol "k8s.io/client-go/util/flowcontrol"
+	examplegroupv1 "k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1"
+)
+
+type Interface interface {
+	Discovery() discovery.DiscoveryInterfaces
+	ExampleGroupV1() examplegroupv1.ExampleGroupV1Interface
+}
+
+// Clientset contains the clients for groups.
+type Clientset struct {
+	*discovery.DiscoveryClient
+	exampleGroupV1 *examplegroupv1.ExampleGroupV1Client
+}
+
+// ExampleGroupV1 retrieves the ExampleGroupV1Client
+func (c *Clientset) ExampleGroupV1() examplegroupv1.ExampleGroupV1Interface {
+	return c.exampleGroupV1
+}
+
+// Discovery retrieves the DiscoveryClient
+func (c *Clientset) Discovery() discovery.DiscoveryInterfaces {
+	if c == nil {
+		return nil
+	}
+	return c.DiscoveryClient
+}
+
+// NewForConfig creates a new Clientset for the given config.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfig will generate a rate-limiter in configShallowCopy.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*Clientset, error) {
+	configShallowCopy := *c
+
+	if configShallowCopy.UserAgent == "" {
+		configShallowCopy.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	// share the transport between all clients
+	httpClient, err := rest.HTTPClientFor(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewForConfigAndClient(&configShallowCopy, httpClient)
+}
+
+// NewForConfigAndClient creates a new Clientset for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfigAndClient will generate a rate-limiter in configShallowCopy.
+func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset, error) {
+	configShallowCopy := *c
+	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
+		if configShallowCopy.Burst <= 0 {
+			return nil, fmt.Errorf("burst is required to be greater than 0 when RateLimiter is not set and QPS is set to greater than 0")
+		}
+		configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
+	}
+
+	var cs Clientset
+	var err error
+	cs.exampleGroupV1, err = examplegroupv1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+
+	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	return &cs, nil
+}
+
+// NewForConfigOrDie creates a new Clientset for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *Clientset {
+	cs, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return cs
+}
+
+// New creates a new Clientset for the given RESTClient.
+func New(c rest.Interface) *Clientset {
+	var cs Clientset
+	cs.exampleGroupV1 = examplegroupv1.New(c)
+
+	cs.DiscoveryClient = discovery.NewDiscoveryClient(c)
+	return &cs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/fake/clientset_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/fake/clientset_generated.go
new file mode 100644
index 0000000000..4a5402f184
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/fake/clientset_generated.go
@@ -0,0 +1,142 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/discovery"
+	fakediscovery "k8s.io/client-go/discovery/fake"
+	"k8s.io/client-go/testing"
+	applyconfiguration "k8s.io/code-generator/examples/HyphenGroup/applyconfiguration"
+	clientset "k8s.io/code-generator/examples/HyphenGroup/clientset/versioned"
+	examplegroupv1 "k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1"
+	fakeexamplegroupv1 "k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/fake"
+)
+
+// NewSimpleClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any field management, validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+func NewSimpleClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewObjectTracker(scheme, codecs.UniversalDecoder())
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{tracker: o}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		var opts metav1.ListOptions
+		if watchAction, ok := action.(testing.WatchActionImpl); ok {
+			opts = watchAction.ListOptions
+		}
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns, opts)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
+// Clientset implements clientset.Interface. Meant to be embedded into a
+// struct to get a default implementation. This makes faking out just the method
+// you want to test easier.
+type Clientset struct {
+	testing.Fake
+	discovery *fakediscovery.FakeDiscovery
+	tracker   testing.ObjectTracker
+}
+
+func (c *Clientset) Discovery() discovery.DiscoveryInterfaces {
+	return c.discovery
+}
+
+func (c *Clientset) Tracker() testing.ObjectTracker {
+	return c.tracker
+}
+
+// IsWatchListSemanticsUnSupported informs the reflector that this client
+// doesn't support WatchList semantics.
+//
+// This is a synthetic method whose sole purpose is to satisfy the optional
+// interface check performed by the reflector.
+// Returning true signals that WatchList can NOT be used.
+// No additional logic is implemented here.
+func (c *Clientset) IsWatchListSemanticsUnSupported() bool {
+	return true
+}
+
+// NewClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+//
+// Compared to NewSimpleClientset, the Clientset returned here supports field tracking and thus
+// server-side apply. Beware though that support in that for CRDs is missing
+// (https://github.com/kubernetes/kubernetes/issues/126850).
+func NewClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewFieldManagedObjectTracker(
+		scheme,
+		codecs.UniversalDecoder(),
+		applyconfiguration.NewTypeConverter(scheme),
+	)
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{tracker: o}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		var opts metav1.ListOptions
+		if watchAction, ok := action.(testing.WatchActionImpl); ok {
+			opts = watchAction.ListOptions
+		}
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns, opts)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
+var (
+	_ clientset.Interface = &Clientset{}
+	_ testing.FakeClient  = &Clientset{}
+)
+
+// ExampleGroupV1 retrieves the ExampleGroupV1Client
+func (c *Clientset) ExampleGroupV1() examplegroupv1.ExampleGroupV1Interface {
+	return &fakeexamplegroupv1.FakeExampleGroupV1{Fake: &c.Fake}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/fake/doc.go
new file mode 100644
index 0000000000..9b99e71670
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated fake clientset.
+package fake
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/fake/register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/fake/register.go
new file mode 100644
index 0000000000..3350b2ded9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/fake/register.go
@@ -0,0 +1,56 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	examplegroupv1 "k8s.io/code-generator/examples/HyphenGroup/apis/example/v1"
+)
+
+var scheme = runtime.NewScheme()
+var codecs = serializer.NewCodecFactory(scheme)
+
+var localSchemeBuilder = runtime.SchemeBuilder{
+	examplegroupv1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
+//
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(scheme))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/scheme/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/scheme/doc.go
new file mode 100644
index 0000000000..7dc3756168
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/scheme/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package contains the scheme of the automatically generated clientset.
+package scheme
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/scheme/register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/scheme/register.go
new file mode 100644
index 0000000000..066b540ced
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/scheme/register.go
@@ -0,0 +1,56 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package scheme
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	examplegroupv1 "k8s.io/code-generator/examples/HyphenGroup/apis/example/v1"
+)
+
+var Scheme = runtime.NewScheme()
+var Codecs = serializer.NewCodecFactory(Scheme)
+var ParameterCodec = runtime.NewParameterCodec(Scheme)
+var localSchemeBuilder = runtime.SchemeBuilder{
+	examplegroupv1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
+//
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(Scheme))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/clustertesttype.go
new file mode 100644
index 0000000000..9824e061c6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/clustertesttype.go
@@ -0,0 +1,105 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	autoscalingv1 "k8s.io/api/autoscaling/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	examplev1 "k8s.io/code-generator/examples/HyphenGroup/apis/example/v1"
+	applyconfigurationexamplev1 "k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1"
+	scheme "k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/scheme"
+)
+
+// ClusterTestTypesGetter has a method to return a ClusterTestTypeInterface.
+// A group's client should implement this interface.
+type ClusterTestTypesGetter interface {
+	ClusterTestTypes() ClusterTestTypeInterface
+}
+
+// ClusterTestTypeInterface has methods to work with ClusterTestType resources.
+type ClusterTestTypeInterface interface {
+	Create(ctx context.Context, clusterTestType *examplev1.ClusterTestType, opts metav1.CreateOptions) (*examplev1.ClusterTestType, error)
+	Update(ctx context.Context, clusterTestType *examplev1.ClusterTestType, opts metav1.UpdateOptions) (*examplev1.ClusterTestType, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, clusterTestType *examplev1.ClusterTestType, opts metav1.UpdateOptions) (*examplev1.ClusterTestType, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*examplev1.ClusterTestType, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*examplev1.ClusterTestTypeList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *examplev1.ClusterTestType, err error)
+	Apply(ctx context.Context, clusterTestType *applyconfigurationexamplev1.ClusterTestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *examplev1.ClusterTestType, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, clusterTestType *applyconfigurationexamplev1.ClusterTestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *examplev1.ClusterTestType, err error)
+	GetScale(ctx context.Context, clusterTestTypeName string, options metav1.GetOptions) (*autoscalingv1.Scale, error)
+	UpdateScale(ctx context.Context, clusterTestTypeName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (*autoscalingv1.Scale, error)
+
+	ClusterTestTypeExpansion
+}
+
+// clusterTestTypes implements ClusterTestTypeInterface
+type clusterTestTypes struct {
+	*gentype.ClientWithListAndApply[*examplev1.ClusterTestType, *examplev1.ClusterTestTypeList, *applyconfigurationexamplev1.ClusterTestTypeApplyConfiguration]
+}
+
+// newClusterTestTypes returns a ClusterTestTypes
+func newClusterTestTypes(c *ExampleGroupV1Client) *clusterTestTypes {
+	return &clusterTestTypes{
+		gentype.NewClientWithListAndApply[*examplev1.ClusterTestType, *examplev1.ClusterTestTypeList, *applyconfigurationexamplev1.ClusterTestTypeApplyConfiguration](
+			"clustertesttypes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			"",
+			func() *examplev1.ClusterTestType { return &examplev1.ClusterTestType{} },
+			func() *examplev1.ClusterTestTypeList { return &examplev1.ClusterTestTypeList{} },
+		),
+	}
+}
+
+// GetScale takes name of the clusterTestType, and returns the corresponding autoscalingv1.Scale object, and an error if there is any.
+func (c *clusterTestTypes) GetScale(ctx context.Context, clusterTestTypeName string, options metav1.GetOptions) (result *autoscalingv1.Scale, err error) {
+	result = &autoscalingv1.Scale{}
+	err = c.GetClient().Get().
+		Resource("clustertesttypes").
+		Name(clusterTestTypeName).
+		SubResource("scale").
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// UpdateScale takes the top resource name and the representation of a scale and updates it. Returns the server's representation of the scale, and an error, if there is any.
+func (c *clusterTestTypes) UpdateScale(ctx context.Context, clusterTestTypeName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (result *autoscalingv1.Scale, err error) {
+	result = &autoscalingv1.Scale{}
+	err = c.GetClient().Put().
+		Resource("clustertesttypes").
+		Name(clusterTestTypeName).
+		SubResource("scale").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(scale).
+		Do(ctx).
+		Into(result)
+	return
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/doc.go
similarity index 97%
rename from vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/doc.go
rename to hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/doc.go
index baaf2d9853..3af5d054f1 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/doc.go
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/doc.go
@@ -17,4 +17,4 @@ limitations under the License.
 // Code generated by client-gen. DO NOT EDIT.
 
 // This package has the automatically generated typed clients.
-package v1alpha2
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/example_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/example_client.go
new file mode 100644
index 0000000000..53549375e4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/example_client.go
@@ -0,0 +1,106 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	http "net/http"
+
+	rest "k8s.io/client-go/rest"
+	examplev1 "k8s.io/code-generator/examples/HyphenGroup/apis/example/v1"
+	scheme "k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/scheme"
+)
+
+type ExampleGroupV1Interface interface {
+	RESTClient() rest.Interface
+	ClusterTestTypesGetter
+	TestTypesGetter
+}
+
+// ExampleGroupV1Client is used to interact with features provided by the example-group.hyphens.code-generator.k8s.io group.
+type ExampleGroupV1Client struct {
+	restClient rest.Interface
+}
+
+func (c *ExampleGroupV1Client) ClusterTestTypes() ClusterTestTypeInterface {
+	return newClusterTestTypes(c)
+}
+
+func (c *ExampleGroupV1Client) TestTypes(namespace string) TestTypeInterface {
+	return newTestTypes(c, namespace)
+}
+
+// NewForConfig creates a new ExampleGroupV1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ExampleGroupV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ExampleGroupV1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ExampleGroupV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &ExampleGroupV1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new ExampleGroupV1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ExampleGroupV1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new ExampleGroupV1Client for the given RESTClient.
+func New(c rest.Interface) *ExampleGroupV1Client {
+	return &ExampleGroupV1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := examplev1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ExampleGroupV1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/fake/doc.go
similarity index 100%
rename from vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/fake/doc.go
rename to hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/fake/doc.go
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/fake/fake_clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/fake/fake_clustertesttype.go
new file mode 100644
index 0000000000..7d875dba3c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/fake/fake_clustertesttype.go
@@ -0,0 +1,78 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	context "context"
+
+	autoscalingv1 "k8s.io/api/autoscaling/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gentype "k8s.io/client-go/gentype"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/HyphenGroup/apis/example/v1"
+	examplev1 "k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1"
+	typedexamplev1 "k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1"
+)
+
+// fakeClusterTestTypes implements ClusterTestTypeInterface
+type fakeClusterTestTypes struct {
+	*gentype.FakeClientWithListAndApply[*v1.ClusterTestType, *v1.ClusterTestTypeList, *examplev1.ClusterTestTypeApplyConfiguration]
+	Fake *FakeExampleGroupV1
+}
+
+func newFakeClusterTestTypes(fake *FakeExampleGroupV1) typedexamplev1.ClusterTestTypeInterface {
+	return &fakeClusterTestTypes{
+		gentype.NewFakeClientWithListAndApply[*v1.ClusterTestType, *v1.ClusterTestTypeList, *examplev1.ClusterTestTypeApplyConfiguration](
+			fake.Fake,
+			"",
+			v1.SchemeGroupVersion.WithResource("clustertesttypes"),
+			v1.SchemeGroupVersion.WithKind("ClusterTestType"),
+			func() *v1.ClusterTestType { return &v1.ClusterTestType{} },
+			func() *v1.ClusterTestTypeList { return &v1.ClusterTestTypeList{} },
+			func(dst, src *v1.ClusterTestTypeList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.ClusterTestTypeList) []*v1.ClusterTestType { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.ClusterTestTypeList, items []*v1.ClusterTestType) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
+
+// GetScale takes name of the clusterTestType, and returns the corresponding scale object, and an error if there is any.
+func (c *fakeClusterTestTypes) GetScale(ctx context.Context, clusterTestTypeName string, options metav1.GetOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.
+		Invokes(testing.NewRootGetSubresourceActionWithOptions(c.Resource(), "scale", clusterTestTypeName, options), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*autoscalingv1.Scale), err
+}
+
+// UpdateScale takes the representation of a scale and updates it. Returns the server's representation of the scale, and an error, if there is any.
+func (c *fakeClusterTestTypes) UpdateScale(ctx context.Context, clusterTestTypeName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.
+		Invokes(testing.NewRootUpdateSubresourceActionWithOptions(c.Resource(), "scale", scale, opts), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*autoscalingv1.Scale), err
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/fake/fake_scheduling_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/fake/fake_example_client.go
similarity index 67%
rename from vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/fake/fake_scheduling_client.go
rename to hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/fake/fake_example_client.go
index 1d21b2d914..6afac7c209 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/fake/fake_scheduling_client.go
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/fake/fake_example_client.go
@@ -19,26 +19,26 @@ limitations under the License.
 package fake
 
 import (
-	v1alpha2 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2"
 	rest "k8s.io/client-go/rest"
 	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1"
 )
 
-type FakeSchedulingV1alpha2 struct {
+type FakeExampleGroupV1 struct {
 	*testing.Fake
 }
 
-func (c *FakeSchedulingV1alpha2) PodGroups(namespace string) v1alpha2.PodGroupInterface {
-	return newFakePodGroups(c, namespace)
+func (c *FakeExampleGroupV1) ClusterTestTypes() v1.ClusterTestTypeInterface {
+	return newFakeClusterTestTypes(c)
 }
 
-func (c *FakeSchedulingV1alpha2) Workloads(namespace string) v1alpha2.WorkloadInterface {
-	return newFakeWorkloads(c, namespace)
+func (c *FakeExampleGroupV1) TestTypes(namespace string) v1.TestTypeInterface {
+	return newFakeTestTypes(c, namespace)
 }
 
 // RESTClient returns a RESTClient that is used to communicate
 // with API server by this client implementation.
-func (c *FakeSchedulingV1alpha2) RESTClient() rest.Interface {
+func (c *FakeExampleGroupV1) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/fake/fake_testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/fake/fake_testtype.go
new file mode 100644
index 0000000000..9188f2f0b6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/fake/fake_testtype.go
@@ -0,0 +1,49 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	gentype "k8s.io/client-go/gentype"
+	v1 "k8s.io/code-generator/examples/HyphenGroup/apis/example/v1"
+	examplev1 "k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1"
+	typedexamplev1 "k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1"
+)
+
+// fakeTestTypes implements TestTypeInterface
+type fakeTestTypes struct {
+	*gentype.FakeClientWithListAndApply[*v1.TestType, *v1.TestTypeList, *examplev1.TestTypeApplyConfiguration]
+	Fake *FakeExampleGroupV1
+}
+
+func newFakeTestTypes(fake *FakeExampleGroupV1, namespace string) typedexamplev1.TestTypeInterface {
+	return &fakeTestTypes{
+		gentype.NewFakeClientWithListAndApply[*v1.TestType, *v1.TestTypeList, *examplev1.TestTypeApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1.SchemeGroupVersion.WithResource("testtypes"),
+			v1.SchemeGroupVersion.WithKind("TestType"),
+			func() *v1.TestType { return &v1.TestType{} },
+			func() *v1.TestTypeList { return &v1.TestTypeList{} },
+			func(dst, src *v1.TestTypeList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.TestTypeList) []*v1.TestType { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.TestTypeList, items []*v1.TestType) { list.Items = gentype.FromPointerSlice(items) },
+		),
+		fake,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/generated_expansion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/generated_expansion.go
new file mode 100644
index 0000000000..3059734a9e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+type ClusterTestTypeExpansion interface{}
+
+type TestTypeExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/testtype.go
new file mode 100644
index 0000000000..8fcecd1409
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/typed/example/v1/testtype.go
@@ -0,0 +1,74 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	examplev1 "k8s.io/code-generator/examples/HyphenGroup/apis/example/v1"
+	applyconfigurationexamplev1 "k8s.io/code-generator/examples/HyphenGroup/applyconfiguration/example/v1"
+	scheme "k8s.io/code-generator/examples/HyphenGroup/clientset/versioned/scheme"
+)
+
+// TestTypesGetter has a method to return a TestTypeInterface.
+// A group's client should implement this interface.
+type TestTypesGetter interface {
+	TestTypes(namespace string) TestTypeInterface
+}
+
+// TestTypeInterface has methods to work with TestType resources.
+type TestTypeInterface interface {
+	Create(ctx context.Context, testType *examplev1.TestType, opts metav1.CreateOptions) (*examplev1.TestType, error)
+	Update(ctx context.Context, testType *examplev1.TestType, opts metav1.UpdateOptions) (*examplev1.TestType, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, testType *examplev1.TestType, opts metav1.UpdateOptions) (*examplev1.TestType, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*examplev1.TestType, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*examplev1.TestTypeList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *examplev1.TestType, err error)
+	Apply(ctx context.Context, testType *applyconfigurationexamplev1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *examplev1.TestType, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, testType *applyconfigurationexamplev1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *examplev1.TestType, err error)
+	TestTypeExpansion
+}
+
+// testTypes implements TestTypeInterface
+type testTypes struct {
+	*gentype.ClientWithListAndApply[*examplev1.TestType, *examplev1.TestTypeList, *applyconfigurationexamplev1.TestTypeApplyConfiguration]
+}
+
+// newTestTypes returns a TestTypes
+func newTestTypes(c *ExampleGroupV1Client, namespace string) *testTypes {
+	return &testTypes{
+		gentype.NewClientWithListAndApply[*examplev1.TestType, *examplev1.TestTypeList, *applyconfigurationexamplev1.TestTypeApplyConfiguration](
+			"testtypes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *examplev1.TestType { return &examplev1.TestType{} },
+			func() *examplev1.TestTypeList { return &examplev1.TestTypeList{} },
+		),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/example/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/example/interface.go
new file mode 100644
index 0000000000..a3a8658f37
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/example/interface.go
@@ -0,0 +1,46 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package example
+
+import (
+	v1 "k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/example/v1"
+	internalinterfaces "k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1 provides access to shared informers for resources in V1.
+	V1() v1.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1 returns a new v1.Interface.
+func (g *group) V1() v1.Interface {
+	return v1.New(g.factory, g.namespace, g.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/example/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/example/v1/clustertesttype.go
new file mode 100644
index 0000000000..baafebc319
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/example/v1/clustertesttype.go
@@ -0,0 +1,207 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	apisexamplev1 "k8s.io/code-generator/examples/HyphenGroup/apis/example/v1"
+	versioned "k8s.io/code-generator/examples/HyphenGroup/clientset/versioned"
+	internalinterfaces "k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/internalinterfaces"
+	examplev1 "k8s.io/code-generator/examples/HyphenGroup/listers/example/v1"
+)
+
+// ClusterTestTypeInformer provides access to a shared informer and lister for
+// ClusterTestTypes. Prefer using the type-safe variant (see [TypedClusterTestTypeInformer]).
+type ClusterTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() examplev1.ClusterTestTypeLister
+}
+
+// TypedClusterTestTypeInformer provides access to a shared informer and lister for
+// ClusterTestTypes, including the type-safe TypedInformer variant.
+// It is a superset of ClusterTestTypeInformer.
+type TypedClusterTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ClusterTestTypeIndexInformer
+	Lister() examplev1.ClusterTestTypeLister
+}
+
+// ClusterTestTypeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ClusterTestTypeIndexInformer cache.TypedSharedIndexInformer[*apisexamplev1.ClusterTestType]
+
+// ClusterTestTypeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ClusterTestType.
+type ClusterTestTypeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apisexamplev1.ClusterTestType]
+
+// ClusterTestTypeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ClusterTestType.
+type ClusterTestTypeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apisexamplev1.ClusterTestType]
+
+// ClusterTestTypeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ClusterTestType.
+type ClusterTestTypeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apisexamplev1.ClusterTestType]
+
+// ClusterTestTypeIndexers is a specialization of [cache.TypedIndexers] for ClusterTestType.
+type ClusterTestTypeIndexers = cache.TypedIndexers[*apisexamplev1.ClusterTestType]
+
+// DeletedClusterTestType is a specialization of [cache.DeletedObject] for ClusterTestType.
+type DeletedClusterTestType = cache.DeletedObject[*apisexamplev1.ClusterTestType]
+
+type clusterTestTypeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// NewClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterTestTypeInformer]).
+func NewClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers ClusterTestTypeIndexers) ClusterTestTypeIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredClusterTestTypeInformer]).
+func NewFilteredClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers ClusterTestTypeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterTestTypeIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewClusterTestTypeInformerWithOptions constructs a new informer for ClusterTestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterTestTypeInformerWithOptions]).
+func NewClusterTestTypeInformerWithOptions(client versioned.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, options)
+}
+
+// NewTypedClusterTestTypeInformerWithOptions constructs a new informer for ClusterTestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterTestTypeInformerWithOptions(client versioned.Interface, options internalinterfaces.InformerOptions) ClusterTestTypeIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "example-group.hyphens.code-generator.k8s.io", Version: "v1", Resource: "clustertesttypes"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.ClusterTestType](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleGroupV1().ClusterTestTypes().List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleGroupV1().ClusterTestTypes().Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleGroupV1().ClusterTestTypes().List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleGroupV1().ClusterTestTypes().Watch(ctx, opts)
+			},
+		}, client),
+		&apisexamplev1.ClusterTestType{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *clusterTestTypeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *clusterTestTypeInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *clusterTestTypeInformer) TypedInformer() ClusterTestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.ClusterTestType](f.factory.InformerFor(&apisexamplev1.ClusterTestType{}, f.defaultInformer))
+}
+
+func (f *clusterTestTypeInformer) Lister() examplev1.ClusterTestTypeLister {
+	return examplev1.NewClusterTestTypeLister(f.Informer().GetIndexer())
+}
+
+// ToTypedClusterTestTypeInformer converts an untyped informer into a TypedClusterTestTypeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterTestType. If that is not the case, calling type-safe methods of the returned
+// TypedClusterTestTypeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedClusterTestTypeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedClusterTestTypeInformer(informer ClusterTestTypeInformer) TypedClusterTestTypeInformer {
+	if informer, ok := informer.(TypedClusterTestTypeInformer); ok {
+		return informer
+	}
+	return &clusterTestTypeTypedInformerAdapter{informer}
+}
+
+type clusterTestTypeTypedInformerAdapter struct {
+	ClusterTestTypeInformer
+}
+
+func (a *clusterTestTypeTypedInformerAdapter) TypedInformer() ClusterTestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.ClusterTestType](a.Informer())
+}
+
+// ToClusterTestTypeIndexInformer converts an untyped informer into a ClusterTestTypeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterTestType. If that is not the case, calling type-safe methods of the returned
+// ClusterTestTypeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ClusterTestTypeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToClusterTestTypeIndexInformer(informer cache.SharedIndexInformer) ClusterTestTypeIndexInformer {
+	if informer, ok := informer.(ClusterTestTypeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.ClusterTestType](informer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/example/v1/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/example/v1/interface.go
new file mode 100644
index 0000000000..8059288a2a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/example/v1/interface.go
@@ -0,0 +1,52 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	internalinterfaces "k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// ClusterTestTypes returns a ClusterTestTypeInformer.
+	ClusterTestTypes() TypedClusterTestTypeInformer
+	// TestTypes returns a TestTypeInformer.
+	TestTypes() TypedTestTypeInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// ClusterTestTypes returns a TypedClusterTestTypeInformer.
+func (v *version) ClusterTestTypes() TypedClusterTestTypeInformer {
+	return &clusterTestTypeInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// TestTypes returns a TypedTestTypeInformer.
+func (v *version) TestTypes() TypedTestTypeInformer {
+	return &testTypeInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/example/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/example/v1/testtype.go
new file mode 100644
index 0000000000..e403209adc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/example/v1/testtype.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	apisexamplev1 "k8s.io/code-generator/examples/HyphenGroup/apis/example/v1"
+	versioned "k8s.io/code-generator/examples/HyphenGroup/clientset/versioned"
+	internalinterfaces "k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/internalinterfaces"
+	examplev1 "k8s.io/code-generator/examples/HyphenGroup/listers/example/v1"
+)
+
+// TestTypeInformer provides access to a shared informer and lister for
+// TestTypes. Prefer using the type-safe variant (see [TypedTestTypeInformer]).
+type TestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() examplev1.TestTypeLister
+}
+
+// TypedTestTypeInformer provides access to a shared informer and lister for
+// TestTypes, including the type-safe TypedInformer variant.
+// It is a superset of TestTypeInformer.
+type TypedTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() TestTypeIndexInformer
+	Lister() examplev1.TestTypeLister
+}
+
+// TestTypeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type TestTypeIndexInformer cache.TypedSharedIndexInformer[*apisexamplev1.TestType]
+
+// TestTypeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for TestType.
+type TestTypeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apisexamplev1.TestType]
+
+// TestTypeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for TestType.
+type TestTypeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apisexamplev1.TestType]
+
+// TestTypeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for TestType.
+type TestTypeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apisexamplev1.TestType]
+
+// TestTypeIndexers is a specialization of [cache.TypedIndexers] for TestType.
+type TestTypeIndexers = cache.TypedIndexers[*apisexamplev1.TestType]
+
+// DeletedTestType is a specialization of [cache.DeletedObject] for TestType.
+type DeletedTestType = cache.DeletedObject[*apisexamplev1.TestType]
+
+type testTypeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformer]).
+func NewTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredTestTypeInformer]).
+func NewFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformerWithOptions]).
+func NewTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) TestTypeIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "example-group.hyphens.code-generator.k8s.io", Version: "v1", Resource: "testtypes"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleGroupV1().TestTypes(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleGroupV1().TestTypes(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleGroupV1().TestTypes(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleGroupV1().TestTypes(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apisexamplev1.TestType{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *testTypeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *testTypeInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *testTypeInformer) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](f.factory.InformerFor(&apisexamplev1.TestType{}, f.defaultInformer))
+}
+
+func (f *testTypeInformer) Lister() examplev1.TestTypeLister {
+	return examplev1.NewTestTypeLister(f.Informer().GetIndexer())
+}
+
+// ToTypedTestTypeInformer converts an untyped informer into a TypedTestTypeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TypedTestTypeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedTestTypeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedTestTypeInformer(informer TestTypeInformer) TypedTestTypeInformer {
+	if informer, ok := informer.(TypedTestTypeInformer); ok {
+		return informer
+	}
+	return &testTypeTypedInformerAdapter{informer}
+}
+
+type testTypeTypedInformerAdapter struct {
+	TestTypeInformer
+}
+
+func (a *testTypeTypedInformerAdapter) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](a.Informer())
+}
+
+// ToTestTypeIndexInformer converts an untyped informer into a TestTypeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TestTypeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a TestTypeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTestTypeIndexInformer(informer cache.SharedIndexInformer) TestTypeIndexInformer {
+	if informer, ok := informer.(TestTypeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](informer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/factory.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/factory.go
new file mode 100644
index 0000000000..5f12102a98
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/factory.go
@@ -0,0 +1,333 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	context "context"
+	reflect "reflect"
+	sync "sync"
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	wait "k8s.io/apimachinery/pkg/util/wait"
+	cache "k8s.io/client-go/tools/cache"
+	versioned "k8s.io/code-generator/examples/HyphenGroup/clientset/versioned"
+	example "k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/example"
+	internalinterfaces "k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/internalinterfaces"
+)
+
+// SharedInformerOption defines the functional option type for SharedInformerFactory.
+type SharedInformerOption func(*sharedInformerFactory) *sharedInformerFactory
+
+type sharedInformerFactory struct {
+	client           versioned.Interface
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	lock             sync.Mutex
+	defaultResync    time.Duration
+	customResync     map[reflect.Type]time.Duration
+	transform        cache.TransformFunc
+	informerName     *cache.InformerName
+
+	informers map[reflect.Type]cache.SharedIndexInformer
+	// startedInformers is used for tracking which informers have been started.
+	// This allows Start() to be called multiple times safely.
+	startedInformers map[reflect.Type]bool
+	// wg tracks how many goroutines were started.
+	wg sync.WaitGroup
+	// shuttingDown is true when Shutdown has been called. It may still be running
+	// because it needs to wait for goroutines.
+	shuttingDown bool
+}
+
+// WithCustomResyncConfig sets a custom resync period for the specified informer types.
+func WithCustomResyncConfig(resyncConfig map[v1.Object]time.Duration) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		for k, v := range resyncConfig {
+			factory.customResync[reflect.TypeOf(k)] = v
+		}
+		return factory
+	}
+}
+
+// WithTweakListOptions sets a custom filter on all listers of the configured SharedInformerFactory.
+func WithTweakListOptions(tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.tweakListOptions = tweakListOptions
+		return factory
+	}
+}
+
+// WithNamespace limits the SharedInformerFactory to the specified namespace.
+func WithNamespace(namespace string) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.namespace = namespace
+		return factory
+	}
+}
+
+// WithTransform sets a transform on all informers.
+func WithTransform(transform cache.TransformFunc) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.transform = transform
+		return factory
+	}
+}
+
+// WithInformerName sets the InformerName for informer identity used in metrics.
+// The InformerName must be created via cache.NewInformerName() at startup,
+// which validates global uniqueness. Each informer type will register its
+// GVR under this name.
+func WithInformerName(informerName *cache.InformerName) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.informerName = informerName
+		return factory
+	}
+}
+
+func (f *sharedInformerFactory) InformerName() *cache.InformerName {
+	return f.informerName
+}
+
+// NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces.
+func NewSharedInformerFactory(client versioned.Interface, defaultResync time.Duration) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync)
+}
+
+// NewFilteredSharedInformerFactory constructs a new instance of sharedInformerFactory.
+// Listers obtained via this SharedInformerFactory will be subject to the same filters
+// as specified here.
+//
+// Deprecated: Please use NewSharedInformerFactoryWithOptions instead
+func NewFilteredSharedInformerFactory(client versioned.Interface, defaultResync time.Duration, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync, WithNamespace(namespace), WithTweakListOptions(tweakListOptions))
+}
+
+// NewSharedInformerFactoryWithOptions constructs a new instance of a SharedInformerFactory with additional options.
+func NewSharedInformerFactoryWithOptions(client versioned.Interface, defaultResync time.Duration, options ...SharedInformerOption) SharedInformerFactory {
+	factory := &sharedInformerFactory{
+		client:           client,
+		namespace:        v1.NamespaceAll,
+		defaultResync:    defaultResync,
+		informers:        make(map[reflect.Type]cache.SharedIndexInformer),
+		startedInformers: make(map[reflect.Type]bool),
+		customResync:     make(map[reflect.Type]time.Duration),
+	}
+
+	// Apply all options
+	for _, opt := range options {
+		factory = opt(factory)
+	}
+
+	return factory
+}
+
+func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
+	f.StartWithContext(wait.ContextForChannel(stopCh))
+}
+
+func (f *sharedInformerFactory) StartWithContext(ctx context.Context) {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	if f.shuttingDown {
+		return
+	}
+
+	for informerType, informer := range f.informers {
+		if !f.startedInformers[informerType] {
+			f.wg.Go(func() {
+				informer.RunWithContext(ctx)
+			})
+			f.startedInformers[informerType] = true
+		}
+	}
+}
+
+func (f *sharedInformerFactory) Shutdown() {
+	f.lock.Lock()
+	f.shuttingDown = true
+	f.lock.Unlock()
+
+	// Will return immediately if there is nothing to wait for.
+	f.wg.Wait()
+	f.informerName.Release()
+}
+
+func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
+	result := f.WaitForCacheSyncWithContext(wait.ContextForChannel(stopCh))
+	return result.Synced
+}
+
+func (f *sharedInformerFactory) WaitForCacheSyncWithContext(ctx context.Context) cache.SyncResult {
+	informers := func() map[reflect.Type]cache.SharedIndexInformer {
+		f.lock.Lock()
+		defer f.lock.Unlock()
+
+		informers := map[reflect.Type]cache.SharedIndexInformer{}
+		for informerType, informer := range f.informers {
+			if f.startedInformers[informerType] {
+				informers[informerType] = informer
+			}
+		}
+		return informers
+	}()
+
+	// Wait for informers to sync, without polling.
+	cacheSyncs := make([]cache.DoneChecker, 0, len(informers))
+	for _, informer := range informers {
+		cacheSyncs = append(cacheSyncs, informer.HasSyncedChecker())
+	}
+	cache.WaitFor(ctx, "" /* no logging */, cacheSyncs...)
+
+	res := cache.SyncResult{
+		Synced: make(map[reflect.Type]bool, len(informers)),
+	}
+	failed := false
+	for informType, informer := range informers {
+		hasSynced := informer.HasSynced()
+		if !hasSynced {
+			failed = true
+		}
+		res.Synced[informType] = hasSynced
+	}
+	if failed {
+		// context.Cause is more informative than ctx.Err().
+		// This must be non-nil, otherwise WaitFor wouldn't have stopped
+		// prematurely.
+		res.Err = context.Cause(ctx)
+	}
+
+	return res
+}
+
+// InformerFor returns the SharedIndexInformer for obj using an internal
+// client.
+func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(obj)
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+
+	resyncPeriod, exists := f.customResync[informerType]
+	if !exists {
+		resyncPeriod = f.defaultResync
+	}
+
+	informer = newFunc(f.client, resyncPeriod)
+	if f.transform != nil {
+		informer.SetTransform(f.transform)
+	}
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// SharedInformerFactory provides shared informers for resources in all known
+// API group versions.
+//
+// It is typically used like this:
+//
+//	ctx, cancel := context.WithCancel(context.Background())
+//	defer cancel()
+//	factory := NewSharedInformerFactory(client, resyncPeriod)
+//	defer factory.Shutdown()    // Returns immediately if nothing was started.
+//	genericInformer := factory.ForResource(resource)
+//	typedInformer := factory.SomeAPIGroup().V1().SomeType()
+//	handle, err := typeInformer.Informer().AddEventHandler(...)
+//	if err != nil {
+//	    return fmt.Errorf("register event handler: %v", err)
+//	}
+//	defer typeInformer.Informer().RemoveEventHandler(handle) // Avoids leaking goroutines.
+//	factory.StartWithContext(ctx)                            // Start processing these informers.
+//	synced := factory.WaitForCacheSyncWithContext(ctx)
+//	if err := synced.AsError(); err != nil {
+//	    return err
+//	}
+//	for v := range synced {
+//	    // Only if desired log some information similar to this.
+//	    fmt.Fprintf(os.Stdout, "cache synced: %s", v)
+//	}
+//
+//	// Also make sure that all of the initial cache events have been delivered.
+//	if !WaitFor(ctx, "event handler sync", handle.HasSyncedChecker()) {
+//	    // Must have failed because of context.
+//	    return fmt.Errorf("sync event handler: %w", context.Cause(ctx))
+//	}
+//
+//	// Creating informers can also be created after Start, but then
+//	// Start must be called again:
+//	anotherGenericInformer := factory.ForResource(resource)
+//	factory.StartWithContext(ctx)
+type SharedInformerFactory interface {
+	internalinterfaces.SharedInformerFactory
+
+	// Start initializes all requested informers. They are handled in goroutines
+	// which run until the stop channel gets closed.
+	// Warning: Start does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	//
+	// Contextual logging: StartWithContext should be used instead of Start in code which supports contextual logging.
+	Start(stopCh <-chan struct{})
+
+	// StartWithContext initializes all requested informers. They are handled in goroutines
+	// which run until the context gets canceled.
+	// Warning: StartWithContext does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	StartWithContext(ctx context.Context)
+
+	// Shutdown marks a factory as shutting down. At that point no new
+	// informers can be started anymore and Start will return without
+	// doing anything.
+	//
+	// In addition, Shutdown blocks until all goroutines have terminated. For that
+	// to happen, the close channel(s) that they were started with must be closed,
+	// either before Shutdown gets called or while it is waiting.
+	//
+	// Shutdown may be called multiple times, even concurrently. All such calls will
+	// block until all goroutines have terminated.
+	Shutdown()
+
+	// WaitForCacheSync blocks until all started informers' caches were synced
+	// or the stop channel gets closed.
+	//
+	// Contextual logging: WaitForCacheSyncWithContext should be used instead of WaitForCacheSync in code which supports contextual logging. It also returns a more useful result.
+	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
+
+	// WaitForCacheSyncWithContext blocks until all started informers' caches were synced
+	// or the context gets canceled.
+	WaitForCacheSyncWithContext(ctx context.Context) cache.SyncResult
+
+	// ForResource gives generic access to a shared informer of the matching type.
+	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
+
+	// InformerFor returns the SharedIndexInformer for obj using an internal
+	// client.
+	InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer
+
+	ExampleGroup() example.Interface
+}
+
+func (f *sharedInformerFactory) ExampleGroup() example.Interface {
+	return example.New(f, f.namespace, f.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/generic.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/generic.go
new file mode 100644
index 0000000000..65cfad0691
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/generic.go
@@ -0,0 +1,64 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	fmt "fmt"
+
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	cache "k8s.io/client-go/tools/cache"
+	v1 "k8s.io/code-generator/examples/HyphenGroup/apis/example/v1"
+)
+
+// GenericInformer is type of SharedIndexInformer which will locate and delegate to other
+// sharedInformers based on type
+type GenericInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() cache.GenericLister
+}
+
+type genericInformer struct {
+	informer cache.SharedIndexInformer
+	resource schema.GroupResource
+}
+
+// Informer returns the SharedIndexInformer.
+func (f *genericInformer) Informer() cache.SharedIndexInformer {
+	return f.informer
+}
+
+// Lister returns the GenericLister.
+func (f *genericInformer) Lister() cache.GenericLister {
+	return cache.NewGenericLister(f.Informer().GetIndexer(), f.resource)
+}
+
+// ForResource gives generic access to a shared informer of the matching type
+// TODO extend this to unknown resources with a client pool
+func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource) (GenericInformer, error) {
+	switch resource {
+	// Group=example-group.hyphens.code-generator.k8s.io, Version=v1
+	case v1.SchemeGroupVersion.WithResource("clustertesttypes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.ExampleGroup().V1().ClusterTestTypes().Informer()}, nil
+	case v1.SchemeGroupVersion.WithResource("testtypes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.ExampleGroup().V1().TestTypes().Informer()}, nil
+
+	}
+
+	return nil, fmt.Errorf("no informer found for %v", resource)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/internalinterfaces/factory_interfaces.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/internalinterfaces/factory_interfaces.go
new file mode 100644
index 0000000000..4d0c063b5b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/informers/externalversions/internalinterfaces/factory_interfaces.go
@@ -0,0 +1,59 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package internalinterfaces
+
+import (
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	cache "k8s.io/client-go/tools/cache"
+	versioned "k8s.io/code-generator/examples/HyphenGroup/clientset/versioned"
+)
+
+// NewInformerFunc takes versioned.Interface and time.Duration to return a SharedIndexInformer.
+type NewInformerFunc func(versioned.Interface, time.Duration) cache.SharedIndexInformer
+
+// SharedInformerFactory a small interface to allow for adding an informer without an import cycle
+type SharedInformerFactory interface {
+	Start(stopCh <-chan struct{})
+	InformerFor(obj runtime.Object, newFunc NewInformerFunc) cache.SharedIndexInformer
+	InformerName() *cache.InformerName
+}
+
+// TweakListOptionsFunc is a function that transforms a v1.ListOptions.
+type TweakListOptionsFunc func(*v1.ListOptions)
+
+// InformerOptions holds the options for creating an informer.
+type InformerOptions struct {
+	// ResyncPeriod is the resync period for this informer.
+	// If not set, defaults to 0 (no resync).
+	ResyncPeriod time.Duration
+
+	// Indexers are the indexers for this informer.
+	Indexers cache.Indexers
+
+	// InformerName is used to uniquely identify this informer for metrics.
+	// If not set, metrics will not be published for this informer.
+	// Use cache.NewInformerName() to create an InformerName at startup.
+	InformerName *cache.InformerName
+
+	// TweakListOptions is an optional function to modify the list options.
+	TweakListOptions TweakListOptionsFunc
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/listers/example/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/listers/example/v1/clustertesttype.go
new file mode 100644
index 0000000000..d4aa80fb94
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/listers/example/v1/clustertesttype.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	examplev1 "k8s.io/code-generator/examples/HyphenGroup/apis/example/v1"
+)
+
+// ClusterTestTypeLister helps list ClusterTestTypes.
+// All objects returned here must be treated as read-only.
+type ClusterTestTypeLister interface {
+	// List lists all ClusterTestTypes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*examplev1.ClusterTestType, err error)
+	// Get retrieves the ClusterTestType from the index for a given name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*examplev1.ClusterTestType, error)
+	ClusterTestTypeListerExpansion
+}
+
+// clusterTestTypeLister implements the ClusterTestTypeLister interface.
+type clusterTestTypeLister struct {
+	listers.ResourceIndexer[*examplev1.ClusterTestType]
+}
+
+// NewClusterTestTypeLister returns a new ClusterTestTypeLister.
+func NewClusterTestTypeLister(indexer cache.Indexer) ClusterTestTypeLister {
+	return &clusterTestTypeLister{listers.New[*examplev1.ClusterTestType](indexer, examplev1.Resource("clustertesttype"))}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/listers/example/v1/expansion_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/listers/example/v1/expansion_generated.go
new file mode 100644
index 0000000000..2681a29f47
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/listers/example/v1/expansion_generated.go
@@ -0,0 +1,31 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+// ClusterTestTypeListerExpansion allows custom methods to be added to
+// ClusterTestTypeLister.
+type ClusterTestTypeListerExpansion interface{}
+
+// TestTypeListerExpansion allows custom methods to be added to
+// TestTypeLister.
+type TestTypeListerExpansion interface{}
+
+// TestTypeNamespaceListerExpansion allows custom methods to be added to
+// TestTypeNamespaceLister.
+type TestTypeNamespaceListerExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/listers/example/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/listers/example/v1/testtype.go
new file mode 100644
index 0000000000..47364c0cd1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/HyphenGroup/listers/example/v1/testtype.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	examplev1 "k8s.io/code-generator/examples/HyphenGroup/apis/example/v1"
+)
+
+// TestTypeLister helps list TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeLister interface {
+	// List lists all TestTypes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*examplev1.TestType, err error)
+	// TestTypes returns an object that can list and get TestTypes.
+	TestTypes(namespace string) TestTypeNamespaceLister
+	TestTypeListerExpansion
+}
+
+// testTypeLister implements the TestTypeLister interface.
+type testTypeLister struct {
+	listers.ResourceIndexer[*examplev1.TestType]
+}
+
+// NewTestTypeLister returns a new TestTypeLister.
+func NewTestTypeLister(indexer cache.Indexer) TestTypeLister {
+	return &testTypeLister{listers.New[*examplev1.TestType](indexer, examplev1.Resource("testtype"))}
+}
+
+// TestTypes returns an object that can list and get TestTypes.
+func (s *testTypeLister) TestTypes(namespace string) TestTypeNamespaceLister {
+	return testTypeNamespaceLister{listers.NewNamespaced[*examplev1.TestType](s.ResourceIndexer, namespace)}
+}
+
+// TestTypeNamespaceLister helps list and get TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeNamespaceLister interface {
+	// List lists all TestTypes in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*examplev1.TestType, err error)
+	// Get retrieves the TestType from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*examplev1.TestType, error)
+	TestTypeNamespaceListerExpansion
+}
+
+// testTypeNamespaceLister implements the TestTypeNamespaceLister
+// interface.
+type testTypeNamespaceLister struct {
+	listers.ResourceIndexer[*examplev1.TestType]
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/apis/example/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/apis/example/v1/doc.go
new file mode 100644
index 0000000000..e6614c0da6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/apis/example/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=example.crd.code-generator.k8s.io
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/apis/example/v1/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/apis/example/v1/types.go
new file mode 100644
index 0000000000..d8a2ae666d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/apis/example/v1/types.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestType is a top-level type. A client is created for it.
+type TestType struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +optional
+	Status TestTypeStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestTypeList is a top-level list type. The client methods for lists are automatically created.
+// You are not supposed to create a separated client for this one.
+type TestTypeList struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []TestType `json:"items"`
+}
+
+type TestTypeStatus struct {
+	Blah string `json:"blah"`
+}
+
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+type ClusterTestTypeList struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ClusterTestType `json:"items"`
+}
+
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +genclient:method=GetScale,verb=get,subresource=scale,result=k8s.io/api/autoscaling/v1.Scale
+// +genclient:method=UpdateScale,verb=update,subresource=scale,input=k8s.io/api/autoscaling/v1.Scale,result=k8s.io/api/autoscaling/v1.Scale
+// +genclient:method=CreateScale,verb=create,subresource=scale,input=k8s.io/api/autoscaling/v1.Scale,result=k8s.io/api/autoscaling/v1.Scale
+
+type ClusterTestType struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +optional
+	Status ClusterTestTypeStatus `json:"status,omitempty"`
+}
+
+type ClusterTestTypeStatus struct {
+	Blah string `json:"blah"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/apis/example/v1/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/apis/example/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..5eee47016b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/apis/example/v1/zz_generated.deepcopy.go
@@ -0,0 +1,178 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterTestType) DeepCopyInto(out *ClusterTestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTestType.
+func (in *ClusterTestType) DeepCopy() *ClusterTestType {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterTestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterTestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterTestTypeList) DeepCopyInto(out *ClusterTestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ClusterTestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTestTypeList.
+func (in *ClusterTestTypeList) DeepCopy() *ClusterTestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterTestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterTestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterTestTypeStatus) DeepCopyInto(out *ClusterTestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTestTypeStatus.
+func (in *ClusterTestTypeStatus) DeepCopy() *ClusterTestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterTestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType) DeepCopyInto(out *TestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType.
+func (in *TestType) DeepCopy() *TestType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeList) DeepCopyInto(out *TestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeList.
+func (in *TestTypeList) DeepCopy() *TestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeStatus) DeepCopyInto(out *TestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeStatus.
+func (in *TestTypeStatus) DeepCopy() *TestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/apis/example/v1/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/apis/example/v1/zz_generated.defaults.go
new file mode 100644
index 0000000000..dac177e93b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/apis/example/v1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/apis/example/v1/zz_generated.register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/apis/example/v1/zz_generated.register.go
new file mode 100644
index 0000000000..a587c37bc9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/apis/example/v1/zz_generated.register.go
@@ -0,0 +1,73 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by register-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName specifies the group name used to register the objects.
+const GroupName = "example.crd.code-generator.k8s.io"
+
+// GroupVersion specifies the group and the version used to register the objects.
+var GroupVersion = metav1.GroupVersion{Group: GroupName, Version: "v1"}
+
+// SchemeGroupVersion is group version used to register these objects
+//
+// Deprecated: use GroupVersion instead.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	// Deprecated: use Install instead
+	AddToScheme = localSchemeBuilder.AddToScheme
+	Install     = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&ClusterTestType{},
+		&ClusterTestTypeList{},
+		&TestType{},
+		&TestTypeList{},
+	)
+	// AddToGroupVersion allows the serialization of client types like ListOptions.
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1/clustertesttype.go
new file mode 100644
index 0000000000..da165b1fb7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1/clustertesttype.go
@@ -0,0 +1,233 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// ClusterTestTypeApplyConfiguration represents a declarative configuration of the ClusterTestType type for use
+// with apply.
+type ClusterTestTypeApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration    `json:""`
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Status                               *ClusterTestTypeStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// ClusterTestType constructs a declarative configuration of the ClusterTestType type for use with
+// apply.
+func ClusterTestType(name string) *ClusterTestTypeApplyConfiguration {
+	b := &ClusterTestTypeApplyConfiguration{}
+	b.WithName(name)
+	b.WithKind("ClusterTestType")
+	b.WithAPIVersion("example.crd.code-generator.k8s.io/v1")
+	return b
+}
+
+func (b ClusterTestTypeApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithKind(value string) *ClusterTestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithAPIVersion(value string) *ClusterTestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithName(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithGenerateName(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithNamespace(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithUID(value types.UID) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithResourceVersion(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithGeneration(value int64) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *ClusterTestTypeApplyConfiguration) WithLabels(entries map[string]string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *ClusterTestTypeApplyConfiguration) WithAnnotations(entries map[string]string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *ClusterTestTypeApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *ClusterTestTypeApplyConfiguration) WithFinalizers(values ...string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *ClusterTestTypeApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithStatus(value *ClusterTestTypeStatusApplyConfiguration) *ClusterTestTypeApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1/clustertesttypestatus.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1/clustertesttypestatus.go
new file mode 100644
index 0000000000..c2ccfa5811
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1/clustertesttypestatus.go
@@ -0,0 +1,39 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// ClusterTestTypeStatusApplyConfiguration represents a declarative configuration of the ClusterTestTypeStatus type for use
+// with apply.
+type ClusterTestTypeStatusApplyConfiguration struct {
+	Blah *string `json:"blah,omitempty"`
+}
+
+// ClusterTestTypeStatusApplyConfiguration constructs a declarative configuration of the ClusterTestTypeStatus type for use with
+// apply.
+func ClusterTestTypeStatus() *ClusterTestTypeStatusApplyConfiguration {
+	return &ClusterTestTypeStatusApplyConfiguration{}
+}
+
+// WithBlah sets the Blah field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Blah field is set to the value of the last call.
+func (b *ClusterTestTypeStatusApplyConfiguration) WithBlah(value string) *ClusterTestTypeStatusApplyConfiguration {
+	b.Blah = &value
+	return b
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1/testtype.go
new file mode 100644
index 0000000000..154a69209a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1/testtype.go
@@ -0,0 +1,236 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// TestTypeApplyConfiguration represents a declarative configuration of the TestType type for use
+// with apply.
+//
+// TestType is a top-level type. A client is created for it.
+type TestTypeApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration    `json:""`
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Status                               *TestTypeStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// TestType constructs a declarative configuration of the TestType type for use with
+// apply.
+func TestType(name, namespace string) *TestTypeApplyConfiguration {
+	b := &TestTypeApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("TestType")
+	b.WithAPIVersion("example.crd.code-generator.k8s.io/v1")
+	return b
+}
+
+func (b TestTypeApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithKind(value string) *TestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithAPIVersion(value string) *TestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithName(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithGenerateName(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithNamespace(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithUID(value types.UID) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithResourceVersion(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithGeneration(value int64) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *TestTypeApplyConfiguration) WithLabels(entries map[string]string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *TestTypeApplyConfiguration) WithAnnotations(entries map[string]string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *TestTypeApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *TestTypeApplyConfiguration) WithFinalizers(values ...string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *TestTypeApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithStatus(value *TestTypeStatusApplyConfiguration) *TestTypeApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1/testtypestatus.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1/testtypestatus.go
new file mode 100644
index 0000000000..246b2ee188
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1/testtypestatus.go
@@ -0,0 +1,39 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// TestTypeStatusApplyConfiguration represents a declarative configuration of the TestTypeStatus type for use
+// with apply.
+type TestTypeStatusApplyConfiguration struct {
+	Blah *string `json:"blah,omitempty"`
+}
+
+// TestTypeStatusApplyConfiguration constructs a declarative configuration of the TestTypeStatus type for use with
+// apply.
+func TestTypeStatus() *TestTypeStatusApplyConfiguration {
+	return &TestTypeStatusApplyConfiguration{}
+}
+
+// WithBlah sets the Blah field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Blah field is set to the value of the last call.
+func (b *TestTypeStatusApplyConfiguration) WithBlah(value string) *TestTypeStatusApplyConfiguration {
+	b.Blah = &value
+	return b
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/internal/internal.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/internal/internal.go
new file mode 100644
index 0000000000..c482faa5c2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/internal/internal.go
@@ -0,0 +1,62 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package internal
+
+import (
+	fmt "fmt"
+	sync "sync"
+
+	typed "sigs.k8s.io/structured-merge-diff/v6/typed"
+)
+
+func Parser() *typed.Parser {
+	parserOnce.Do(func() {
+		var err error
+		parser, err = typed.NewParser(schemaYAML)
+		if err != nil {
+			panic(fmt.Sprintf("Failed to parse schema: %v", err))
+		}
+	})
+	return parser
+}
+
+var parserOnce sync.Once
+var parser *typed.Parser
+var schemaYAML = typed.YAMLObject(`types:
+- name: __untyped_atomic_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+- name: __untyped_deduced_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_deduced_
+    elementRelationship: separable
+`)
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/utils.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/utils.go
new file mode 100644
index 0000000000..0175e0692c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/applyconfiguration/utils.go
@@ -0,0 +1,50 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package applyconfiguration
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	v1 "k8s.io/code-generator/examples/MixedCase/apis/example/v1"
+	examplev1 "k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1"
+	internal "k8s.io/code-generator/examples/MixedCase/applyconfiguration/internal"
+)
+
+// ForKind returns an apply configuration type for the given GroupVersionKind, or nil if no
+// apply configuration type exists for the given GroupVersionKind.
+func ForKind(kind schema.GroupVersionKind) interface{} {
+	switch kind {
+	// Group=example.crd.code-generator.k8s.io, Version=v1
+	case v1.SchemeGroupVersion.WithKind("ClusterTestType"):
+		return &examplev1.ClusterTestTypeApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("ClusterTestTypeStatus"):
+		return &examplev1.ClusterTestTypeStatusApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("TestType"):
+		return &examplev1.TestTypeApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("TestTypeStatus"):
+		return &examplev1.TestTypeStatusApplyConfiguration{}
+
+	}
+	return nil
+}
+
+func NewTypeConverter(scheme *runtime.Scheme) managedfields.TypeConverter {
+	return managedfields.NewSchemeTypeConverter(scheme, internal.Parser())
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/clientset.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/clientset.go
new file mode 100644
index 0000000000..2bdbaa5c30
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/clientset.go
@@ -0,0 +1,120 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package versioned
+
+import (
+	fmt "fmt"
+	http "net/http"
+
+	discovery "k8s.io/client-go/discovery"
+	rest "k8s.io/client-go/rest"
+	flowcontrol "k8s.io/client-go/util/flowcontrol"
+	examplev1 "k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1"
+)
+
+type Interface interface {
+	Discovery() discovery.DiscoveryInterfaces
+	ExampleV1() examplev1.ExampleV1Interface
+}
+
+// Clientset contains the clients for groups.
+type Clientset struct {
+	*discovery.DiscoveryClient
+	exampleV1 *examplev1.ExampleV1Client
+}
+
+// ExampleV1 retrieves the ExampleV1Client
+func (c *Clientset) ExampleV1() examplev1.ExampleV1Interface {
+	return c.exampleV1
+}
+
+// Discovery retrieves the DiscoveryClient
+func (c *Clientset) Discovery() discovery.DiscoveryInterfaces {
+	if c == nil {
+		return nil
+	}
+	return c.DiscoveryClient
+}
+
+// NewForConfig creates a new Clientset for the given config.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfig will generate a rate-limiter in configShallowCopy.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*Clientset, error) {
+	configShallowCopy := *c
+
+	if configShallowCopy.UserAgent == "" {
+		configShallowCopy.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	// share the transport between all clients
+	httpClient, err := rest.HTTPClientFor(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewForConfigAndClient(&configShallowCopy, httpClient)
+}
+
+// NewForConfigAndClient creates a new Clientset for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfigAndClient will generate a rate-limiter in configShallowCopy.
+func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset, error) {
+	configShallowCopy := *c
+	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
+		if configShallowCopy.Burst <= 0 {
+			return nil, fmt.Errorf("burst is required to be greater than 0 when RateLimiter is not set and QPS is set to greater than 0")
+		}
+		configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
+	}
+
+	var cs Clientset
+	var err error
+	cs.exampleV1, err = examplev1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+
+	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	return &cs, nil
+}
+
+// NewForConfigOrDie creates a new Clientset for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *Clientset {
+	cs, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return cs
+}
+
+// New creates a new Clientset for the given RESTClient.
+func New(c rest.Interface) *Clientset {
+	var cs Clientset
+	cs.exampleV1 = examplev1.New(c)
+
+	cs.DiscoveryClient = discovery.NewDiscoveryClient(c)
+	return &cs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/fake/clientset_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/fake/clientset_generated.go
new file mode 100644
index 0000000000..9f4ad64e76
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/fake/clientset_generated.go
@@ -0,0 +1,142 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/discovery"
+	fakediscovery "k8s.io/client-go/discovery/fake"
+	"k8s.io/client-go/testing"
+	applyconfiguration "k8s.io/code-generator/examples/MixedCase/applyconfiguration"
+	clientset "k8s.io/code-generator/examples/MixedCase/clientset/versioned"
+	examplev1 "k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1"
+	fakeexamplev1 "k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/fake"
+)
+
+// NewSimpleClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any field management, validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+func NewSimpleClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewObjectTracker(scheme, codecs.UniversalDecoder())
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{tracker: o}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		var opts metav1.ListOptions
+		if watchAction, ok := action.(testing.WatchActionImpl); ok {
+			opts = watchAction.ListOptions
+		}
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns, opts)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
+// Clientset implements clientset.Interface. Meant to be embedded into a
+// struct to get a default implementation. This makes faking out just the method
+// you want to test easier.
+type Clientset struct {
+	testing.Fake
+	discovery *fakediscovery.FakeDiscovery
+	tracker   testing.ObjectTracker
+}
+
+func (c *Clientset) Discovery() discovery.DiscoveryInterfaces {
+	return c.discovery
+}
+
+func (c *Clientset) Tracker() testing.ObjectTracker {
+	return c.tracker
+}
+
+// IsWatchListSemanticsUnSupported informs the reflector that this client
+// doesn't support WatchList semantics.
+//
+// This is a synthetic method whose sole purpose is to satisfy the optional
+// interface check performed by the reflector.
+// Returning true signals that WatchList can NOT be used.
+// No additional logic is implemented here.
+func (c *Clientset) IsWatchListSemanticsUnSupported() bool {
+	return true
+}
+
+// NewClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+//
+// Compared to NewSimpleClientset, the Clientset returned here supports field tracking and thus
+// server-side apply. Beware though that support in that for CRDs is missing
+// (https://github.com/kubernetes/kubernetes/issues/126850).
+func NewClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewFieldManagedObjectTracker(
+		scheme,
+		codecs.UniversalDecoder(),
+		applyconfiguration.NewTypeConverter(scheme),
+	)
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{tracker: o}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		var opts metav1.ListOptions
+		if watchAction, ok := action.(testing.WatchActionImpl); ok {
+			opts = watchAction.ListOptions
+		}
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns, opts)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
+var (
+	_ clientset.Interface = &Clientset{}
+	_ testing.FakeClient  = &Clientset{}
+)
+
+// ExampleV1 retrieves the ExampleV1Client
+func (c *Clientset) ExampleV1() examplev1.ExampleV1Interface {
+	return &fakeexamplev1.FakeExampleV1{Fake: &c.Fake}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/fake/doc.go
new file mode 100644
index 0000000000..9b99e71670
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated fake clientset.
+package fake
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/fake/register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/fake/register.go
new file mode 100644
index 0000000000..4711b6ae16
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/fake/register.go
@@ -0,0 +1,56 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	examplev1 "k8s.io/code-generator/examples/MixedCase/apis/example/v1"
+)
+
+var scheme = runtime.NewScheme()
+var codecs = serializer.NewCodecFactory(scheme)
+
+var localSchemeBuilder = runtime.SchemeBuilder{
+	examplev1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
+//
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(scheme))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/scheme/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/scheme/doc.go
new file mode 100644
index 0000000000..7dc3756168
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/scheme/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package contains the scheme of the automatically generated clientset.
+package scheme
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/scheme/register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/scheme/register.go
new file mode 100644
index 0000000000..472da566e9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/scheme/register.go
@@ -0,0 +1,56 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package scheme
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	examplev1 "k8s.io/code-generator/examples/MixedCase/apis/example/v1"
+)
+
+var Scheme = runtime.NewScheme()
+var Codecs = serializer.NewCodecFactory(Scheme)
+var ParameterCodec = runtime.NewParameterCodec(Scheme)
+var localSchemeBuilder = runtime.SchemeBuilder{
+	examplev1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
+//
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(Scheme))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/clustertesttype.go
new file mode 100644
index 0000000000..b9a4fc8e20
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/clustertesttype.go
@@ -0,0 +1,120 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	autoscalingv1 "k8s.io/api/autoscaling/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	examplev1 "k8s.io/code-generator/examples/MixedCase/apis/example/v1"
+	applyconfigurationexamplev1 "k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1"
+	scheme "k8s.io/code-generator/examples/MixedCase/clientset/versioned/scheme"
+)
+
+// ClusterTestTypesGetter has a method to return a ClusterTestTypeInterface.
+// A group's client should implement this interface.
+type ClusterTestTypesGetter interface {
+	ClusterTestTypes() ClusterTestTypeInterface
+}
+
+// ClusterTestTypeInterface has methods to work with ClusterTestType resources.
+type ClusterTestTypeInterface interface {
+	Create(ctx context.Context, clusterTestType *examplev1.ClusterTestType, opts metav1.CreateOptions) (*examplev1.ClusterTestType, error)
+	Update(ctx context.Context, clusterTestType *examplev1.ClusterTestType, opts metav1.UpdateOptions) (*examplev1.ClusterTestType, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, clusterTestType *examplev1.ClusterTestType, opts metav1.UpdateOptions) (*examplev1.ClusterTestType, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*examplev1.ClusterTestType, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*examplev1.ClusterTestTypeList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *examplev1.ClusterTestType, err error)
+	Apply(ctx context.Context, clusterTestType *applyconfigurationexamplev1.ClusterTestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *examplev1.ClusterTestType, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, clusterTestType *applyconfigurationexamplev1.ClusterTestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *examplev1.ClusterTestType, err error)
+	GetScale(ctx context.Context, clusterTestTypeName string, options metav1.GetOptions) (*autoscalingv1.Scale, error)
+	UpdateScale(ctx context.Context, clusterTestTypeName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (*autoscalingv1.Scale, error)
+	CreateScale(ctx context.Context, clusterTestTypeName string, scale *autoscalingv1.Scale, opts metav1.CreateOptions) (*autoscalingv1.Scale, error)
+
+	ClusterTestTypeExpansion
+}
+
+// clusterTestTypes implements ClusterTestTypeInterface
+type clusterTestTypes struct {
+	*gentype.ClientWithListAndApply[*examplev1.ClusterTestType, *examplev1.ClusterTestTypeList, *applyconfigurationexamplev1.ClusterTestTypeApplyConfiguration]
+}
+
+// newClusterTestTypes returns a ClusterTestTypes
+func newClusterTestTypes(c *ExampleV1Client) *clusterTestTypes {
+	return &clusterTestTypes{
+		gentype.NewClientWithListAndApply[*examplev1.ClusterTestType, *examplev1.ClusterTestTypeList, *applyconfigurationexamplev1.ClusterTestTypeApplyConfiguration](
+			"clustertesttypes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			"",
+			func() *examplev1.ClusterTestType { return &examplev1.ClusterTestType{} },
+			func() *examplev1.ClusterTestTypeList { return &examplev1.ClusterTestTypeList{} },
+		),
+	}
+}
+
+// GetScale takes name of the clusterTestType, and returns the corresponding autoscalingv1.Scale object, and an error if there is any.
+func (c *clusterTestTypes) GetScale(ctx context.Context, clusterTestTypeName string, options metav1.GetOptions) (result *autoscalingv1.Scale, err error) {
+	result = &autoscalingv1.Scale{}
+	err = c.GetClient().Get().
+		Resource("clustertesttypes").
+		Name(clusterTestTypeName).
+		SubResource("scale").
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// UpdateScale takes the top resource name and the representation of a scale and updates it. Returns the server's representation of the scale, and an error, if there is any.
+func (c *clusterTestTypes) UpdateScale(ctx context.Context, clusterTestTypeName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (result *autoscalingv1.Scale, err error) {
+	result = &autoscalingv1.Scale{}
+	err = c.GetClient().Put().
+		Resource("clustertesttypes").
+		Name(clusterTestTypeName).
+		SubResource("scale").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(scale).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// CreateScale takes the representation of a scale and creates it.  Returns the server's representation of the scale, and an error, if there is any.
+func (c *clusterTestTypes) CreateScale(ctx context.Context, clusterTestTypeName string, scale *autoscalingv1.Scale, opts metav1.CreateOptions) (result *autoscalingv1.Scale, err error) {
+	result = &autoscalingv1.Scale{}
+	err = c.GetClient().Post().
+		Resource("clustertesttypes").
+		Name(clusterTestTypeName).
+		SubResource("scale").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(scale).
+		Do(ctx).
+		Into(result)
+	return
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/doc.go
new file mode 100644
index 0000000000..3af5d054f1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/example_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/example_client.go
new file mode 100644
index 0000000000..69e6efaa48
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/example_client.go
@@ -0,0 +1,106 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	http "net/http"
+
+	rest "k8s.io/client-go/rest"
+	examplev1 "k8s.io/code-generator/examples/MixedCase/apis/example/v1"
+	scheme "k8s.io/code-generator/examples/MixedCase/clientset/versioned/scheme"
+)
+
+type ExampleV1Interface interface {
+	RESTClient() rest.Interface
+	ClusterTestTypesGetter
+	TestTypesGetter
+}
+
+// ExampleV1Client is used to interact with features provided by the example.crd.code-generator.k8s.io group.
+type ExampleV1Client struct {
+	restClient rest.Interface
+}
+
+func (c *ExampleV1Client) ClusterTestTypes() ClusterTestTypeInterface {
+	return newClusterTestTypes(c)
+}
+
+func (c *ExampleV1Client) TestTypes(namespace string) TestTypeInterface {
+	return newTestTypes(c, namespace)
+}
+
+// NewForConfig creates a new ExampleV1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ExampleV1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &ExampleV1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new ExampleV1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ExampleV1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new ExampleV1Client for the given RESTClient.
+func New(c rest.Interface) *ExampleV1Client {
+	return &ExampleV1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := examplev1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ExampleV1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/fake/doc.go
new file mode 100644
index 0000000000..16f4439906
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/fake/fake_clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/fake/fake_clustertesttype.go
new file mode 100644
index 0000000000..eec15f0bb3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/fake/fake_clustertesttype.go
@@ -0,0 +1,89 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	context "context"
+
+	autoscalingv1 "k8s.io/api/autoscaling/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gentype "k8s.io/client-go/gentype"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/MixedCase/apis/example/v1"
+	examplev1 "k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1"
+	typedexamplev1 "k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1"
+)
+
+// fakeClusterTestTypes implements ClusterTestTypeInterface
+type fakeClusterTestTypes struct {
+	*gentype.FakeClientWithListAndApply[*v1.ClusterTestType, *v1.ClusterTestTypeList, *examplev1.ClusterTestTypeApplyConfiguration]
+	Fake *FakeExampleV1
+}
+
+func newFakeClusterTestTypes(fake *FakeExampleV1) typedexamplev1.ClusterTestTypeInterface {
+	return &fakeClusterTestTypes{
+		gentype.NewFakeClientWithListAndApply[*v1.ClusterTestType, *v1.ClusterTestTypeList, *examplev1.ClusterTestTypeApplyConfiguration](
+			fake.Fake,
+			"",
+			v1.SchemeGroupVersion.WithResource("clustertesttypes"),
+			v1.SchemeGroupVersion.WithKind("ClusterTestType"),
+			func() *v1.ClusterTestType { return &v1.ClusterTestType{} },
+			func() *v1.ClusterTestTypeList { return &v1.ClusterTestTypeList{} },
+			func(dst, src *v1.ClusterTestTypeList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.ClusterTestTypeList) []*v1.ClusterTestType { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.ClusterTestTypeList, items []*v1.ClusterTestType) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
+
+// GetScale takes name of the clusterTestType, and returns the corresponding scale object, and an error if there is any.
+func (c *fakeClusterTestTypes) GetScale(ctx context.Context, clusterTestTypeName string, options metav1.GetOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.
+		Invokes(testing.NewRootGetSubresourceActionWithOptions(c.Resource(), "scale", clusterTestTypeName, options), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*autoscalingv1.Scale), err
+}
+
+// UpdateScale takes the representation of a scale and updates it. Returns the server's representation of the scale, and an error, if there is any.
+func (c *fakeClusterTestTypes) UpdateScale(ctx context.Context, clusterTestTypeName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.
+		Invokes(testing.NewRootUpdateSubresourceActionWithOptions(c.Resource(), "scale", scale, opts), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*autoscalingv1.Scale), err
+}
+
+// CreateScale takes the representation of a scale and creates it.  Returns the server's representation of the scale, and an error, if there is any.
+func (c *fakeClusterTestTypes) CreateScale(ctx context.Context, clusterTestTypeName string, scale *autoscalingv1.Scale, opts metav1.CreateOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.
+		Invokes(testing.NewRootCreateSubresourceActionWithOptions(c.Resource(), clusterTestTypeName, "scale", scale, opts), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*autoscalingv1.Scale), err
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/fake/fake_example_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/fake/fake_example_client.go
new file mode 100644
index 0000000000..e2009382d1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/fake/fake_example_client.go
@@ -0,0 +1,44 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1"
+)
+
+type FakeExampleV1 struct {
+	*testing.Fake
+}
+
+func (c *FakeExampleV1) ClusterTestTypes() v1.ClusterTestTypeInterface {
+	return newFakeClusterTestTypes(c)
+}
+
+func (c *FakeExampleV1) TestTypes(namespace string) v1.TestTypeInterface {
+	return newFakeTestTypes(c, namespace)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeExampleV1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/fake/fake_testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/fake/fake_testtype.go
new file mode 100644
index 0000000000..b57866e25e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/fake/fake_testtype.go
@@ -0,0 +1,49 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	gentype "k8s.io/client-go/gentype"
+	v1 "k8s.io/code-generator/examples/MixedCase/apis/example/v1"
+	examplev1 "k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1"
+	typedexamplev1 "k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1"
+)
+
+// fakeTestTypes implements TestTypeInterface
+type fakeTestTypes struct {
+	*gentype.FakeClientWithListAndApply[*v1.TestType, *v1.TestTypeList, *examplev1.TestTypeApplyConfiguration]
+	Fake *FakeExampleV1
+}
+
+func newFakeTestTypes(fake *FakeExampleV1, namespace string) typedexamplev1.TestTypeInterface {
+	return &fakeTestTypes{
+		gentype.NewFakeClientWithListAndApply[*v1.TestType, *v1.TestTypeList, *examplev1.TestTypeApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1.SchemeGroupVersion.WithResource("testtypes"),
+			v1.SchemeGroupVersion.WithKind("TestType"),
+			func() *v1.TestType { return &v1.TestType{} },
+			func() *v1.TestTypeList { return &v1.TestTypeList{} },
+			func(dst, src *v1.TestTypeList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.TestTypeList) []*v1.TestType { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.TestTypeList, items []*v1.TestType) { list.Items = gentype.FromPointerSlice(items) },
+		),
+		fake,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/generated_expansion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/generated_expansion.go
new file mode 100644
index 0000000000..3059734a9e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+type ClusterTestTypeExpansion interface{}
+
+type TestTypeExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/testtype.go
new file mode 100644
index 0000000000..78336bfda5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/clientset/versioned/typed/example/v1/testtype.go
@@ -0,0 +1,74 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	examplev1 "k8s.io/code-generator/examples/MixedCase/apis/example/v1"
+	applyconfigurationexamplev1 "k8s.io/code-generator/examples/MixedCase/applyconfiguration/example/v1"
+	scheme "k8s.io/code-generator/examples/MixedCase/clientset/versioned/scheme"
+)
+
+// TestTypesGetter has a method to return a TestTypeInterface.
+// A group's client should implement this interface.
+type TestTypesGetter interface {
+	TestTypes(namespace string) TestTypeInterface
+}
+
+// TestTypeInterface has methods to work with TestType resources.
+type TestTypeInterface interface {
+	Create(ctx context.Context, testType *examplev1.TestType, opts metav1.CreateOptions) (*examplev1.TestType, error)
+	Update(ctx context.Context, testType *examplev1.TestType, opts metav1.UpdateOptions) (*examplev1.TestType, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, testType *examplev1.TestType, opts metav1.UpdateOptions) (*examplev1.TestType, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*examplev1.TestType, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*examplev1.TestTypeList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *examplev1.TestType, err error)
+	Apply(ctx context.Context, testType *applyconfigurationexamplev1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *examplev1.TestType, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, testType *applyconfigurationexamplev1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *examplev1.TestType, err error)
+	TestTypeExpansion
+}
+
+// testTypes implements TestTypeInterface
+type testTypes struct {
+	*gentype.ClientWithListAndApply[*examplev1.TestType, *examplev1.TestTypeList, *applyconfigurationexamplev1.TestTypeApplyConfiguration]
+}
+
+// newTestTypes returns a TestTypes
+func newTestTypes(c *ExampleV1Client, namespace string) *testTypes {
+	return &testTypes{
+		gentype.NewClientWithListAndApply[*examplev1.TestType, *examplev1.TestTypeList, *applyconfigurationexamplev1.TestTypeApplyConfiguration](
+			"testtypes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *examplev1.TestType { return &examplev1.TestType{} },
+			func() *examplev1.TestTypeList { return &examplev1.TestTypeList{} },
+		),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/example/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/example/interface.go
new file mode 100644
index 0000000000..1766c025b9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/example/interface.go
@@ -0,0 +1,46 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package example
+
+import (
+	v1 "k8s.io/code-generator/examples/MixedCase/informers/externalversions/example/v1"
+	internalinterfaces "k8s.io/code-generator/examples/MixedCase/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1 provides access to shared informers for resources in V1.
+	V1() v1.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1 returns a new v1.Interface.
+func (g *group) V1() v1.Interface {
+	return v1.New(g.factory, g.namespace, g.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/example/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/example/v1/clustertesttype.go
new file mode 100644
index 0000000000..67b539e193
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/example/v1/clustertesttype.go
@@ -0,0 +1,207 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	apisexamplev1 "k8s.io/code-generator/examples/MixedCase/apis/example/v1"
+	versioned "k8s.io/code-generator/examples/MixedCase/clientset/versioned"
+	internalinterfaces "k8s.io/code-generator/examples/MixedCase/informers/externalversions/internalinterfaces"
+	examplev1 "k8s.io/code-generator/examples/MixedCase/listers/example/v1"
+)
+
+// ClusterTestTypeInformer provides access to a shared informer and lister for
+// ClusterTestTypes. Prefer using the type-safe variant (see [TypedClusterTestTypeInformer]).
+type ClusterTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() examplev1.ClusterTestTypeLister
+}
+
+// TypedClusterTestTypeInformer provides access to a shared informer and lister for
+// ClusterTestTypes, including the type-safe TypedInformer variant.
+// It is a superset of ClusterTestTypeInformer.
+type TypedClusterTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ClusterTestTypeIndexInformer
+	Lister() examplev1.ClusterTestTypeLister
+}
+
+// ClusterTestTypeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ClusterTestTypeIndexInformer cache.TypedSharedIndexInformer[*apisexamplev1.ClusterTestType]
+
+// ClusterTestTypeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ClusterTestType.
+type ClusterTestTypeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apisexamplev1.ClusterTestType]
+
+// ClusterTestTypeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ClusterTestType.
+type ClusterTestTypeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apisexamplev1.ClusterTestType]
+
+// ClusterTestTypeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ClusterTestType.
+type ClusterTestTypeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apisexamplev1.ClusterTestType]
+
+// ClusterTestTypeIndexers is a specialization of [cache.TypedIndexers] for ClusterTestType.
+type ClusterTestTypeIndexers = cache.TypedIndexers[*apisexamplev1.ClusterTestType]
+
+// DeletedClusterTestType is a specialization of [cache.DeletedObject] for ClusterTestType.
+type DeletedClusterTestType = cache.DeletedObject[*apisexamplev1.ClusterTestType]
+
+type clusterTestTypeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// NewClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterTestTypeInformer]).
+func NewClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers ClusterTestTypeIndexers) ClusterTestTypeIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredClusterTestTypeInformer]).
+func NewFilteredClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers ClusterTestTypeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterTestTypeIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewClusterTestTypeInformerWithOptions constructs a new informer for ClusterTestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterTestTypeInformerWithOptions]).
+func NewClusterTestTypeInformerWithOptions(client versioned.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, options)
+}
+
+// NewTypedClusterTestTypeInformerWithOptions constructs a new informer for ClusterTestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterTestTypeInformerWithOptions(client versioned.Interface, options internalinterfaces.InformerOptions) ClusterTestTypeIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "example.crd.code-generator.k8s.io", Version: "v1", Resource: "clustertesttypes"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.ClusterTestType](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().ClusterTestTypes().List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().ClusterTestTypes().Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().ClusterTestTypes().List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().ClusterTestTypes().Watch(ctx, opts)
+			},
+		}, client),
+		&apisexamplev1.ClusterTestType{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *clusterTestTypeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *clusterTestTypeInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *clusterTestTypeInformer) TypedInformer() ClusterTestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.ClusterTestType](f.factory.InformerFor(&apisexamplev1.ClusterTestType{}, f.defaultInformer))
+}
+
+func (f *clusterTestTypeInformer) Lister() examplev1.ClusterTestTypeLister {
+	return examplev1.NewClusterTestTypeLister(f.Informer().GetIndexer())
+}
+
+// ToTypedClusterTestTypeInformer converts an untyped informer into a TypedClusterTestTypeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterTestType. If that is not the case, calling type-safe methods of the returned
+// TypedClusterTestTypeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedClusterTestTypeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedClusterTestTypeInformer(informer ClusterTestTypeInformer) TypedClusterTestTypeInformer {
+	if informer, ok := informer.(TypedClusterTestTypeInformer); ok {
+		return informer
+	}
+	return &clusterTestTypeTypedInformerAdapter{informer}
+}
+
+type clusterTestTypeTypedInformerAdapter struct {
+	ClusterTestTypeInformer
+}
+
+func (a *clusterTestTypeTypedInformerAdapter) TypedInformer() ClusterTestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.ClusterTestType](a.Informer())
+}
+
+// ToClusterTestTypeIndexInformer converts an untyped informer into a ClusterTestTypeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterTestType. If that is not the case, calling type-safe methods of the returned
+// ClusterTestTypeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ClusterTestTypeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToClusterTestTypeIndexInformer(informer cache.SharedIndexInformer) ClusterTestTypeIndexInformer {
+	if informer, ok := informer.(ClusterTestTypeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.ClusterTestType](informer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/example/v1/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/example/v1/interface.go
new file mode 100644
index 0000000000..e5edb04b1e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/example/v1/interface.go
@@ -0,0 +1,52 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	internalinterfaces "k8s.io/code-generator/examples/MixedCase/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// ClusterTestTypes returns a ClusterTestTypeInformer.
+	ClusterTestTypes() TypedClusterTestTypeInformer
+	// TestTypes returns a TestTypeInformer.
+	TestTypes() TypedTestTypeInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// ClusterTestTypes returns a TypedClusterTestTypeInformer.
+func (v *version) ClusterTestTypes() TypedClusterTestTypeInformer {
+	return &clusterTestTypeInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// TestTypes returns a TypedTestTypeInformer.
+func (v *version) TestTypes() TypedTestTypeInformer {
+	return &testTypeInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/example/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/example/v1/testtype.go
new file mode 100644
index 0000000000..2b971d09e9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/example/v1/testtype.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	apisexamplev1 "k8s.io/code-generator/examples/MixedCase/apis/example/v1"
+	versioned "k8s.io/code-generator/examples/MixedCase/clientset/versioned"
+	internalinterfaces "k8s.io/code-generator/examples/MixedCase/informers/externalversions/internalinterfaces"
+	examplev1 "k8s.io/code-generator/examples/MixedCase/listers/example/v1"
+)
+
+// TestTypeInformer provides access to a shared informer and lister for
+// TestTypes. Prefer using the type-safe variant (see [TypedTestTypeInformer]).
+type TestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() examplev1.TestTypeLister
+}
+
+// TypedTestTypeInformer provides access to a shared informer and lister for
+// TestTypes, including the type-safe TypedInformer variant.
+// It is a superset of TestTypeInformer.
+type TypedTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() TestTypeIndexInformer
+	Lister() examplev1.TestTypeLister
+}
+
+// TestTypeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type TestTypeIndexInformer cache.TypedSharedIndexInformer[*apisexamplev1.TestType]
+
+// TestTypeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for TestType.
+type TestTypeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apisexamplev1.TestType]
+
+// TestTypeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for TestType.
+type TestTypeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apisexamplev1.TestType]
+
+// TestTypeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for TestType.
+type TestTypeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apisexamplev1.TestType]
+
+// TestTypeIndexers is a specialization of [cache.TypedIndexers] for TestType.
+type TestTypeIndexers = cache.TypedIndexers[*apisexamplev1.TestType]
+
+// DeletedTestType is a specialization of [cache.DeletedObject] for TestType.
+type DeletedTestType = cache.DeletedObject[*apisexamplev1.TestType]
+
+type testTypeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformer]).
+func NewTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredTestTypeInformer]).
+func NewFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformerWithOptions]).
+func NewTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) TestTypeIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "example.crd.code-generator.k8s.io", Version: "v1", Resource: "testtypes"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apisexamplev1.TestType{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *testTypeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *testTypeInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *testTypeInformer) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](f.factory.InformerFor(&apisexamplev1.TestType{}, f.defaultInformer))
+}
+
+func (f *testTypeInformer) Lister() examplev1.TestTypeLister {
+	return examplev1.NewTestTypeLister(f.Informer().GetIndexer())
+}
+
+// ToTypedTestTypeInformer converts an untyped informer into a TypedTestTypeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TypedTestTypeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedTestTypeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedTestTypeInformer(informer TestTypeInformer) TypedTestTypeInformer {
+	if informer, ok := informer.(TypedTestTypeInformer); ok {
+		return informer
+	}
+	return &testTypeTypedInformerAdapter{informer}
+}
+
+type testTypeTypedInformerAdapter struct {
+	TestTypeInformer
+}
+
+func (a *testTypeTypedInformerAdapter) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](a.Informer())
+}
+
+// ToTestTypeIndexInformer converts an untyped informer into a TestTypeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TestTypeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a TestTypeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTestTypeIndexInformer(informer cache.SharedIndexInformer) TestTypeIndexInformer {
+	if informer, ok := informer.(TestTypeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](informer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/factory.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/factory.go
new file mode 100644
index 0000000000..c0dbe4d9df
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/factory.go
@@ -0,0 +1,333 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	context "context"
+	reflect "reflect"
+	sync "sync"
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	wait "k8s.io/apimachinery/pkg/util/wait"
+	cache "k8s.io/client-go/tools/cache"
+	versioned "k8s.io/code-generator/examples/MixedCase/clientset/versioned"
+	example "k8s.io/code-generator/examples/MixedCase/informers/externalversions/example"
+	internalinterfaces "k8s.io/code-generator/examples/MixedCase/informers/externalversions/internalinterfaces"
+)
+
+// SharedInformerOption defines the functional option type for SharedInformerFactory.
+type SharedInformerOption func(*sharedInformerFactory) *sharedInformerFactory
+
+type sharedInformerFactory struct {
+	client           versioned.Interface
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	lock             sync.Mutex
+	defaultResync    time.Duration
+	customResync     map[reflect.Type]time.Duration
+	transform        cache.TransformFunc
+	informerName     *cache.InformerName
+
+	informers map[reflect.Type]cache.SharedIndexInformer
+	// startedInformers is used for tracking which informers have been started.
+	// This allows Start() to be called multiple times safely.
+	startedInformers map[reflect.Type]bool
+	// wg tracks how many goroutines were started.
+	wg sync.WaitGroup
+	// shuttingDown is true when Shutdown has been called. It may still be running
+	// because it needs to wait for goroutines.
+	shuttingDown bool
+}
+
+// WithCustomResyncConfig sets a custom resync period for the specified informer types.
+func WithCustomResyncConfig(resyncConfig map[v1.Object]time.Duration) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		for k, v := range resyncConfig {
+			factory.customResync[reflect.TypeOf(k)] = v
+		}
+		return factory
+	}
+}
+
+// WithTweakListOptions sets a custom filter on all listers of the configured SharedInformerFactory.
+func WithTweakListOptions(tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.tweakListOptions = tweakListOptions
+		return factory
+	}
+}
+
+// WithNamespace limits the SharedInformerFactory to the specified namespace.
+func WithNamespace(namespace string) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.namespace = namespace
+		return factory
+	}
+}
+
+// WithTransform sets a transform on all informers.
+func WithTransform(transform cache.TransformFunc) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.transform = transform
+		return factory
+	}
+}
+
+// WithInformerName sets the InformerName for informer identity used in metrics.
+// The InformerName must be created via cache.NewInformerName() at startup,
+// which validates global uniqueness. Each informer type will register its
+// GVR under this name.
+func WithInformerName(informerName *cache.InformerName) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.informerName = informerName
+		return factory
+	}
+}
+
+func (f *sharedInformerFactory) InformerName() *cache.InformerName {
+	return f.informerName
+}
+
+// NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces.
+func NewSharedInformerFactory(client versioned.Interface, defaultResync time.Duration) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync)
+}
+
+// NewFilteredSharedInformerFactory constructs a new instance of sharedInformerFactory.
+// Listers obtained via this SharedInformerFactory will be subject to the same filters
+// as specified here.
+//
+// Deprecated: Please use NewSharedInformerFactoryWithOptions instead
+func NewFilteredSharedInformerFactory(client versioned.Interface, defaultResync time.Duration, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync, WithNamespace(namespace), WithTweakListOptions(tweakListOptions))
+}
+
+// NewSharedInformerFactoryWithOptions constructs a new instance of a SharedInformerFactory with additional options.
+func NewSharedInformerFactoryWithOptions(client versioned.Interface, defaultResync time.Duration, options ...SharedInformerOption) SharedInformerFactory {
+	factory := &sharedInformerFactory{
+		client:           client,
+		namespace:        v1.NamespaceAll,
+		defaultResync:    defaultResync,
+		informers:        make(map[reflect.Type]cache.SharedIndexInformer),
+		startedInformers: make(map[reflect.Type]bool),
+		customResync:     make(map[reflect.Type]time.Duration),
+	}
+
+	// Apply all options
+	for _, opt := range options {
+		factory = opt(factory)
+	}
+
+	return factory
+}
+
+func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
+	f.StartWithContext(wait.ContextForChannel(stopCh))
+}
+
+func (f *sharedInformerFactory) StartWithContext(ctx context.Context) {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	if f.shuttingDown {
+		return
+	}
+
+	for informerType, informer := range f.informers {
+		if !f.startedInformers[informerType] {
+			f.wg.Go(func() {
+				informer.RunWithContext(ctx)
+			})
+			f.startedInformers[informerType] = true
+		}
+	}
+}
+
+func (f *sharedInformerFactory) Shutdown() {
+	f.lock.Lock()
+	f.shuttingDown = true
+	f.lock.Unlock()
+
+	// Will return immediately if there is nothing to wait for.
+	f.wg.Wait()
+	f.informerName.Release()
+}
+
+func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
+	result := f.WaitForCacheSyncWithContext(wait.ContextForChannel(stopCh))
+	return result.Synced
+}
+
+func (f *sharedInformerFactory) WaitForCacheSyncWithContext(ctx context.Context) cache.SyncResult {
+	informers := func() map[reflect.Type]cache.SharedIndexInformer {
+		f.lock.Lock()
+		defer f.lock.Unlock()
+
+		informers := map[reflect.Type]cache.SharedIndexInformer{}
+		for informerType, informer := range f.informers {
+			if f.startedInformers[informerType] {
+				informers[informerType] = informer
+			}
+		}
+		return informers
+	}()
+
+	// Wait for informers to sync, without polling.
+	cacheSyncs := make([]cache.DoneChecker, 0, len(informers))
+	for _, informer := range informers {
+		cacheSyncs = append(cacheSyncs, informer.HasSyncedChecker())
+	}
+	cache.WaitFor(ctx, "" /* no logging */, cacheSyncs...)
+
+	res := cache.SyncResult{
+		Synced: make(map[reflect.Type]bool, len(informers)),
+	}
+	failed := false
+	for informType, informer := range informers {
+		hasSynced := informer.HasSynced()
+		if !hasSynced {
+			failed = true
+		}
+		res.Synced[informType] = hasSynced
+	}
+	if failed {
+		// context.Cause is more informative than ctx.Err().
+		// This must be non-nil, otherwise WaitFor wouldn't have stopped
+		// prematurely.
+		res.Err = context.Cause(ctx)
+	}
+
+	return res
+}
+
+// InformerFor returns the SharedIndexInformer for obj using an internal
+// client.
+func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(obj)
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+
+	resyncPeriod, exists := f.customResync[informerType]
+	if !exists {
+		resyncPeriod = f.defaultResync
+	}
+
+	informer = newFunc(f.client, resyncPeriod)
+	if f.transform != nil {
+		informer.SetTransform(f.transform)
+	}
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// SharedInformerFactory provides shared informers for resources in all known
+// API group versions.
+//
+// It is typically used like this:
+//
+//	ctx, cancel := context.WithCancel(context.Background())
+//	defer cancel()
+//	factory := NewSharedInformerFactory(client, resyncPeriod)
+//	defer factory.Shutdown()    // Returns immediately if nothing was started.
+//	genericInformer := factory.ForResource(resource)
+//	typedInformer := factory.SomeAPIGroup().V1().SomeType()
+//	handle, err := typeInformer.Informer().AddEventHandler(...)
+//	if err != nil {
+//	    return fmt.Errorf("register event handler: %v", err)
+//	}
+//	defer typeInformer.Informer().RemoveEventHandler(handle) // Avoids leaking goroutines.
+//	factory.StartWithContext(ctx)                            // Start processing these informers.
+//	synced := factory.WaitForCacheSyncWithContext(ctx)
+//	if err := synced.AsError(); err != nil {
+//	    return err
+//	}
+//	for v := range synced {
+//	    // Only if desired log some information similar to this.
+//	    fmt.Fprintf(os.Stdout, "cache synced: %s", v)
+//	}
+//
+//	// Also make sure that all of the initial cache events have been delivered.
+//	if !WaitFor(ctx, "event handler sync", handle.HasSyncedChecker()) {
+//	    // Must have failed because of context.
+//	    return fmt.Errorf("sync event handler: %w", context.Cause(ctx))
+//	}
+//
+//	// Creating informers can also be created after Start, but then
+//	// Start must be called again:
+//	anotherGenericInformer := factory.ForResource(resource)
+//	factory.StartWithContext(ctx)
+type SharedInformerFactory interface {
+	internalinterfaces.SharedInformerFactory
+
+	// Start initializes all requested informers. They are handled in goroutines
+	// which run until the stop channel gets closed.
+	// Warning: Start does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	//
+	// Contextual logging: StartWithContext should be used instead of Start in code which supports contextual logging.
+	Start(stopCh <-chan struct{})
+
+	// StartWithContext initializes all requested informers. They are handled in goroutines
+	// which run until the context gets canceled.
+	// Warning: StartWithContext does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	StartWithContext(ctx context.Context)
+
+	// Shutdown marks a factory as shutting down. At that point no new
+	// informers can be started anymore and Start will return without
+	// doing anything.
+	//
+	// In addition, Shutdown blocks until all goroutines have terminated. For that
+	// to happen, the close channel(s) that they were started with must be closed,
+	// either before Shutdown gets called or while it is waiting.
+	//
+	// Shutdown may be called multiple times, even concurrently. All such calls will
+	// block until all goroutines have terminated.
+	Shutdown()
+
+	// WaitForCacheSync blocks until all started informers' caches were synced
+	// or the stop channel gets closed.
+	//
+	// Contextual logging: WaitForCacheSyncWithContext should be used instead of WaitForCacheSync in code which supports contextual logging. It also returns a more useful result.
+	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
+
+	// WaitForCacheSyncWithContext blocks until all started informers' caches were synced
+	// or the context gets canceled.
+	WaitForCacheSyncWithContext(ctx context.Context) cache.SyncResult
+
+	// ForResource gives generic access to a shared informer of the matching type.
+	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
+
+	// InformerFor returns the SharedIndexInformer for obj using an internal
+	// client.
+	InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer
+
+	Example() example.Interface
+}
+
+func (f *sharedInformerFactory) Example() example.Interface {
+	return example.New(f, f.namespace, f.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/generic.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/generic.go
new file mode 100644
index 0000000000..ff86f38e46
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/generic.go
@@ -0,0 +1,64 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	fmt "fmt"
+
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	cache "k8s.io/client-go/tools/cache"
+	v1 "k8s.io/code-generator/examples/MixedCase/apis/example/v1"
+)
+
+// GenericInformer is type of SharedIndexInformer which will locate and delegate to other
+// sharedInformers based on type
+type GenericInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() cache.GenericLister
+}
+
+type genericInformer struct {
+	informer cache.SharedIndexInformer
+	resource schema.GroupResource
+}
+
+// Informer returns the SharedIndexInformer.
+func (f *genericInformer) Informer() cache.SharedIndexInformer {
+	return f.informer
+}
+
+// Lister returns the GenericLister.
+func (f *genericInformer) Lister() cache.GenericLister {
+	return cache.NewGenericLister(f.Informer().GetIndexer(), f.resource)
+}
+
+// ForResource gives generic access to a shared informer of the matching type
+// TODO extend this to unknown resources with a client pool
+func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource) (GenericInformer, error) {
+	switch resource {
+	// Group=example.crd.code-generator.k8s.io, Version=v1
+	case v1.SchemeGroupVersion.WithResource("clustertesttypes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Example().V1().ClusterTestTypes().Informer()}, nil
+	case v1.SchemeGroupVersion.WithResource("testtypes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Example().V1().TestTypes().Informer()}, nil
+
+	}
+
+	return nil, fmt.Errorf("no informer found for %v", resource)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/internalinterfaces/factory_interfaces.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/internalinterfaces/factory_interfaces.go
new file mode 100644
index 0000000000..8157380448
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/informers/externalversions/internalinterfaces/factory_interfaces.go
@@ -0,0 +1,59 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package internalinterfaces
+
+import (
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	cache "k8s.io/client-go/tools/cache"
+	versioned "k8s.io/code-generator/examples/MixedCase/clientset/versioned"
+)
+
+// NewInformerFunc takes versioned.Interface and time.Duration to return a SharedIndexInformer.
+type NewInformerFunc func(versioned.Interface, time.Duration) cache.SharedIndexInformer
+
+// SharedInformerFactory a small interface to allow for adding an informer without an import cycle
+type SharedInformerFactory interface {
+	Start(stopCh <-chan struct{})
+	InformerFor(obj runtime.Object, newFunc NewInformerFunc) cache.SharedIndexInformer
+	InformerName() *cache.InformerName
+}
+
+// TweakListOptionsFunc is a function that transforms a v1.ListOptions.
+type TweakListOptionsFunc func(*v1.ListOptions)
+
+// InformerOptions holds the options for creating an informer.
+type InformerOptions struct {
+	// ResyncPeriod is the resync period for this informer.
+	// If not set, defaults to 0 (no resync).
+	ResyncPeriod time.Duration
+
+	// Indexers are the indexers for this informer.
+	Indexers cache.Indexers
+
+	// InformerName is used to uniquely identify this informer for metrics.
+	// If not set, metrics will not be published for this informer.
+	// Use cache.NewInformerName() to create an InformerName at startup.
+	InformerName *cache.InformerName
+
+	// TweakListOptions is an optional function to modify the list options.
+	TweakListOptions TweakListOptionsFunc
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/listers/example/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/listers/example/v1/clustertesttype.go
new file mode 100644
index 0000000000..a345523c3c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/listers/example/v1/clustertesttype.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	examplev1 "k8s.io/code-generator/examples/MixedCase/apis/example/v1"
+)
+
+// ClusterTestTypeLister helps list ClusterTestTypes.
+// All objects returned here must be treated as read-only.
+type ClusterTestTypeLister interface {
+	// List lists all ClusterTestTypes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*examplev1.ClusterTestType, err error)
+	// Get retrieves the ClusterTestType from the index for a given name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*examplev1.ClusterTestType, error)
+	ClusterTestTypeListerExpansion
+}
+
+// clusterTestTypeLister implements the ClusterTestTypeLister interface.
+type clusterTestTypeLister struct {
+	listers.ResourceIndexer[*examplev1.ClusterTestType]
+}
+
+// NewClusterTestTypeLister returns a new ClusterTestTypeLister.
+func NewClusterTestTypeLister(indexer cache.Indexer) ClusterTestTypeLister {
+	return &clusterTestTypeLister{listers.New[*examplev1.ClusterTestType](indexer, examplev1.Resource("clustertesttype"))}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/listers/example/v1/expansion_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/listers/example/v1/expansion_generated.go
new file mode 100644
index 0000000000..2681a29f47
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/listers/example/v1/expansion_generated.go
@@ -0,0 +1,31 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+// ClusterTestTypeListerExpansion allows custom methods to be added to
+// ClusterTestTypeLister.
+type ClusterTestTypeListerExpansion interface{}
+
+// TestTypeListerExpansion allows custom methods to be added to
+// TestTypeLister.
+type TestTypeListerExpansion interface{}
+
+// TestTypeNamespaceListerExpansion allows custom methods to be added to
+// TestTypeNamespaceLister.
+type TestTypeNamespaceListerExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/listers/example/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/listers/example/v1/testtype.go
new file mode 100644
index 0000000000..d9ded55320
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/MixedCase/listers/example/v1/testtype.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	examplev1 "k8s.io/code-generator/examples/MixedCase/apis/example/v1"
+)
+
+// TestTypeLister helps list TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeLister interface {
+	// List lists all TestTypes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*examplev1.TestType, err error)
+	// TestTypes returns an object that can list and get TestTypes.
+	TestTypes(namespace string) TestTypeNamespaceLister
+	TestTypeListerExpansion
+}
+
+// testTypeLister implements the TestTypeLister interface.
+type testTypeLister struct {
+	listers.ResourceIndexer[*examplev1.TestType]
+}
+
+// NewTestTypeLister returns a new TestTypeLister.
+func NewTestTypeLister(indexer cache.Indexer) TestTypeLister {
+	return &testTypeLister{listers.New[*examplev1.TestType](indexer, examplev1.Resource("testtype"))}
+}
+
+// TestTypes returns an object that can list and get TestTypes.
+func (s *testTypeLister) TestTypes(namespace string) TestTypeNamespaceLister {
+	return testTypeNamespaceLister{listers.NewNamespaced[*examplev1.TestType](s.ResourceIndexer, namespace)}
+}
+
+// TestTypeNamespaceLister helps list and get TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeNamespaceLister interface {
+	// List lists all TestTypes in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*examplev1.TestType, err error)
+	// Get retrieves the TestType from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*examplev1.TestType, error)
+	TestTypeNamespaceListerExpansion
+}
+
+// testTypeNamespaceLister implements the TestTypeNamespaceLister
+// interface.
+type testTypeNamespaceLister struct {
+	listers.ResourceIndexer[*examplev1.TestType]
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/doc.go
new file mode 100644
index 0000000000..8300440759
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +groupName=
+
+package core
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/install/install.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/install/install.go
new file mode 100644
index 0000000000..c1b6d2d5c4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/install/install.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package install installs the experimental API group, making it available as
+// an option to all of the API encoding/decoding machinery.
+package install
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/code-generator/examples/apiserver/apis/core"
+	"k8s.io/code-generator/examples/apiserver/apis/core/v1"
+)
+
+// Install registers the API group and adds types to a scheme
+func Install(scheme *runtime.Scheme) {
+	utilruntime.Must(core.AddToScheme(scheme))
+	utilruntime.Must(v1.AddToScheme(scheme))
+	utilruntime.Must(scheme.SetVersionPriority(v1.SchemeGroupVersion))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/register.go
new file mode 100644
index 0000000000..9e2cd292a9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/register.go
@@ -0,0 +1,45 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var SchemeGroupVersion = schema.GroupVersion{Version: runtime.APIVersionInternal}
+
+var (
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+	AddToScheme   = SchemeBuilder.AddToScheme
+)
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&TestType{},
+		&TestTypeList{},
+	)
+
+	scheme.AddKnownTypes(SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/types.go
new file mode 100644
index 0000000000..9ad4579cd3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/types.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package core
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestType is a top-level type. A client is created for it.
+type TestType struct {
+	metav1.TypeMeta
+	// +optional
+	metav1.ObjectMeta
+	// +optional
+	Status TestTypeStatus
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestTypeList is a top-level list type. The client methods for lists are automatically created.
+// You are not supposed to create a separated client for this one.
+type TestTypeList struct {
+	metav1.TypeMeta
+	// +optional
+	metav1.ListMeta
+
+	Items []TestType
+}
+
+type TestTypeStatus struct {
+	Blah string
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/doc.go
new file mode 100644
index 0000000000..985e8d019a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/doc.go
@@ -0,0 +1,24 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen=package
+// +k8s:defaulter-gen=TypeMeta
+// +k8s:conversion-gen=k8s.io/code-generator/examples/apiserver/apis/core
+// +groupName=
+// +k8s:openapi-model-package=io.k8s.code-generator.examples.apiserver.apis.core.v1
+
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/types.go
new file mode 100644
index 0000000000..196c7168a2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/types.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestType is a top-level type. A client is created for it.
+type TestType struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +optional
+	Status TestTypeStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestTypeList is a top-level list type. The client methods for lists are automatically created.
+// You are not supposed to create a separated client for this one.
+type TestTypeList struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []TestType `json:"items"`
+}
+
+type TestTypeStatus struct {
+	Blah string `json:"blah"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/zz_generated.conversion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/zz_generated.conversion.go
new file mode 100644
index 0000000000..5cfb08c09c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/zz_generated.conversion.go
@@ -0,0 +1,138 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by conversion-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	unsafe "unsafe"
+
+	conversion "k8s.io/apimachinery/pkg/conversion"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	core "k8s.io/code-generator/examples/apiserver/apis/core"
+)
+
+func init() {
+	localSchemeBuilder.Register(RegisterConversions)
+}
+
+// RegisterConversions adds conversion functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*TestType)(nil), (*core.TestType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_TestType_To_core_TestType(a.(*TestType), b.(*core.TestType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*core.TestType)(nil), (*TestType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_core_TestType_To_v1_TestType(a.(*core.TestType), b.(*TestType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*TestTypeList)(nil), (*core.TestTypeList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_TestTypeList_To_core_TestTypeList(a.(*TestTypeList), b.(*core.TestTypeList), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*core.TestTypeList)(nil), (*TestTypeList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_core_TestTypeList_To_v1_TestTypeList(a.(*core.TestTypeList), b.(*TestTypeList), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*TestTypeStatus)(nil), (*core.TestTypeStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_TestTypeStatus_To_core_TestTypeStatus(a.(*TestTypeStatus), b.(*core.TestTypeStatus), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*core.TestTypeStatus)(nil), (*TestTypeStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_core_TestTypeStatus_To_v1_TestTypeStatus(a.(*core.TestTypeStatus), b.(*TestTypeStatus), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+func autoConvert_v1_TestType_To_core_TestType(in *TestType, out *core.TestType, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_v1_TestTypeStatus_To_core_TestTypeStatus(&in.Status, &out.Status, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_v1_TestType_To_core_TestType is an autogenerated conversion function.
+func Convert_v1_TestType_To_core_TestType(in *TestType, out *core.TestType, s conversion.Scope) error {
+	return autoConvert_v1_TestType_To_core_TestType(in, out, s)
+}
+
+func autoConvert_core_TestType_To_v1_TestType(in *core.TestType, out *TestType, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_core_TestTypeStatus_To_v1_TestTypeStatus(&in.Status, &out.Status, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_core_TestType_To_v1_TestType is an autogenerated conversion function.
+func Convert_core_TestType_To_v1_TestType(in *core.TestType, out *TestType, s conversion.Scope) error {
+	return autoConvert_core_TestType_To_v1_TestType(in, out, s)
+}
+
+func autoConvert_v1_TestTypeList_To_core_TestTypeList(in *TestTypeList, out *core.TestTypeList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	out.Items = *(*[]core.TestType)(unsafe.Pointer(&in.Items))
+	return nil
+}
+
+// Convert_v1_TestTypeList_To_core_TestTypeList is an autogenerated conversion function.
+func Convert_v1_TestTypeList_To_core_TestTypeList(in *TestTypeList, out *core.TestTypeList, s conversion.Scope) error {
+	return autoConvert_v1_TestTypeList_To_core_TestTypeList(in, out, s)
+}
+
+func autoConvert_core_TestTypeList_To_v1_TestTypeList(in *core.TestTypeList, out *TestTypeList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	out.Items = *(*[]TestType)(unsafe.Pointer(&in.Items))
+	return nil
+}
+
+// Convert_core_TestTypeList_To_v1_TestTypeList is an autogenerated conversion function.
+func Convert_core_TestTypeList_To_v1_TestTypeList(in *core.TestTypeList, out *TestTypeList, s conversion.Scope) error {
+	return autoConvert_core_TestTypeList_To_v1_TestTypeList(in, out, s)
+}
+
+func autoConvert_v1_TestTypeStatus_To_core_TestTypeStatus(in *TestTypeStatus, out *core.TestTypeStatus, s conversion.Scope) error {
+	*out = *(*core.TestTypeStatus)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_v1_TestTypeStatus_To_core_TestTypeStatus is an autogenerated conversion function.
+func Convert_v1_TestTypeStatus_To_core_TestTypeStatus(in *TestTypeStatus, out *core.TestTypeStatus, s conversion.Scope) error {
+	return autoConvert_v1_TestTypeStatus_To_core_TestTypeStatus(in, out, s)
+}
+
+func autoConvert_core_TestTypeStatus_To_v1_TestTypeStatus(in *core.TestTypeStatus, out *TestTypeStatus, s conversion.Scope) error {
+	*out = *(*TestTypeStatus)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_core_TestTypeStatus_To_v1_TestTypeStatus is an autogenerated conversion function.
+func Convert_core_TestTypeStatus_To_v1_TestTypeStatus(in *core.TestTypeStatus, out *TestTypeStatus, s conversion.Scope) error {
+	return autoConvert_core_TestTypeStatus_To_v1_TestTypeStatus(in, out, s)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..d87f706f77
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/zz_generated.deepcopy.go
@@ -0,0 +1,102 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType) DeepCopyInto(out *TestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType.
+func (in *TestType) DeepCopy() *TestType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeList) DeepCopyInto(out *TestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeList.
+func (in *TestTypeList) DeepCopy() *TestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeStatus) DeepCopyInto(out *TestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeStatus.
+func (in *TestTypeStatus) DeepCopy() *TestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/zz_generated.defaults.go
new file mode 100644
index 0000000000..dac177e93b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/zz_generated.model_name.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/zz_generated.model_name.go
new file mode 100644
index 0000000000..dc5df91042
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/zz_generated.model_name.go
@@ -0,0 +1,37 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package v1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TestType) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.core.v1.TestType"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TestTypeList) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.core.v1.TestTypeList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TestTypeStatus) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.core.v1.TestTypeStatus"
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/zz_generated.register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/zz_generated.register.go
new file mode 100644
index 0000000000..4580878e63
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/v1/zz_generated.register.go
@@ -0,0 +1,71 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by register-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName specifies the group name used to register the objects.
+const GroupName = ""
+
+// GroupVersion specifies the group and the version used to register the objects.
+var GroupVersion = metav1.GroupVersion{Group: GroupName, Version: "v1"}
+
+// SchemeGroupVersion is group version used to register these objects
+//
+// Deprecated: use GroupVersion instead.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	// Deprecated: use Install instead
+	AddToScheme = localSchemeBuilder.AddToScheme
+	Install     = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&TestType{},
+		&TestTypeList{},
+	)
+	// AddToGroupVersion allows the serialization of client types like ListOptions.
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..4e59542113
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/core/zz_generated.deepcopy.go
@@ -0,0 +1,102 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package core
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType) DeepCopyInto(out *TestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType.
+func (in *TestType) DeepCopy() *TestType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeList) DeepCopyInto(out *TestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeList.
+func (in *TestTypeList) DeepCopy() *TestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeStatus) DeepCopyInto(out *TestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeStatus.
+func (in *TestTypeStatus) DeepCopy() *TestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/doc.go
new file mode 100644
index 0000000000..c46cee4a03
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +groupName=example.apiserver.code-generator.k8s.io
+
+package example
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/install/install.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/install/install.go
new file mode 100644
index 0000000000..80b583b89d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/install/install.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package install installs the experimental API group, making it available as
+// an option to all of the API encoding/decoding machinery.
+package install
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/code-generator/examples/apiserver/apis/example"
+	"k8s.io/code-generator/examples/apiserver/apis/example/v1"
+)
+
+// Install registers the API group and adds types to a scheme
+func Install(scheme *runtime.Scheme) {
+	utilruntime.Must(example.AddToScheme(scheme))
+	utilruntime.Must(v1.AddToScheme(scheme))
+	utilruntime.Must(scheme.SetVersionPriority(v1.SchemeGroupVersion))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/register.go
new file mode 100644
index 0000000000..da397b524a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/register.go
@@ -0,0 +1,45 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package example
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var SchemeGroupVersion = schema.GroupVersion{Group: "example.api.code-generator.k8s.io", Version: runtime.APIVersionInternal}
+
+var (
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+	AddToScheme   = SchemeBuilder.AddToScheme
+)
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&TestType{},
+		&TestTypeList{},
+	)
+
+	scheme.AddKnownTypes(SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/types.go
new file mode 100644
index 0000000000..72ef357022
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/types.go
@@ -0,0 +1,82 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package example
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestType is a top-level type. A client is created for it.
+type TestType struct {
+	metav1.TypeMeta
+	// +optional
+	metav1.ObjectMeta
+	// +optional
+	Status TestTypeStatus
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestTypeList is a top-level list type. The client methods for lists are automatically created.
+// You are not supposed to create a separated client for this one.
+type TestTypeList struct {
+	metav1.TypeMeta
+	// +optional
+	metav1.ListMeta
+
+	Items []TestType
+}
+
+type TestTypeStatus struct {
+	Blah string
+}
+
+type Conversion struct {
+	Identical MemoryIdentical
+	Different MemoryDifferent
+}
+type MemoryIdentical struct {
+	Items      *MemoryIdentical
+	Properties map[string]MemoryIdentical
+	AllOf      []MemoryIdentical
+	Bool       bool
+}
+type MemoryDifferent struct {
+	Items      *MemoryDifferent
+	Properties map[string]MemoryDifferent
+	AllOf      []MemoryDifferent
+	Bool       bool // differs from external representation
+}
+
+type ConversionPrivate struct {
+	PublicField  string
+	privateField string
+}
+
+type ConversionCustomContainer struct {
+	Slice   []ConversionCustom
+	SliceP  []*ConversionCustom
+	Map     map[string]ConversionCustom
+	MapP    map[string]*ConversionCustom
+	Struct  ConversionCustom
+	StructP *ConversionCustom
+}
+type ConversionCustom struct {
+	PublicField  string
+	privateField string
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/conversion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/conversion.go
new file mode 100644
index 0000000000..3bd40eba26
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/conversion.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	conversion "k8s.io/apimachinery/pkg/conversion"
+	example "k8s.io/code-generator/examples/apiserver/apis/example"
+)
+
+// manually created final conversion function required because the object contains private fields that cannot be auto-converted
+func Convert_v1_ConversionPrivate_To_example_ConversionPrivate(in *ConversionPrivate, out *example.ConversionPrivate, scope conversion.Scope) error {
+	return autoConvert_v1_ConversionPrivate_To_example_ConversionPrivate(in, out, scope)
+}
+
+// manually created final conversion function required because the object contains private fields that cannot be auto-converted
+func Convert_example_ConversionPrivate_To_v1_ConversionPrivate(in *example.ConversionPrivate, out *ConversionPrivate, scope conversion.Scope) error {
+	return autoConvert_example_ConversionPrivate_To_v1_ConversionPrivate(in, out, scope)
+}
+
+// custom conversion function to exercise use of custom functions in slice/map/pointer fields
+func Convert_v1_ConversionCustom_To_example_ConversionCustom(in *ConversionCustom, out *example.ConversionCustom, scope conversion.Scope) error {
+	return autoConvert_v1_ConversionCustom_To_example_ConversionCustom(in, out, scope)
+}
+
+// custom conversion function to exercise use of custom functions in slice/map/pointer fields
+func Convert_example_ConversionCustom_To_v1_ConversionCustom(in *example.ConversionCustom, out *ConversionCustom, scope conversion.Scope) error {
+	return autoConvert_example_ConversionCustom_To_v1_ConversionCustom(in, out, scope)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/conversion_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/conversion_test.go
new file mode 100644
index 0000000000..27a5e9429f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/conversion_test.go
@@ -0,0 +1,87 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/code-generator/examples/apiserver/apis/example"
+)
+
+func TestConversion(t *testing.T) {
+	testcases := []struct {
+		name string
+		in   *ConversionCustomContainer
+	}{
+		{
+			name: "nil",
+			in:   &ConversionCustomContainer{},
+		},
+		{
+			name: "empty",
+			in: &ConversionCustomContainer{
+				Slice:   []ConversionCustom{},
+				SliceP:  []*ConversionCustom{},
+				Map:     map[string]ConversionCustom{},
+				MapP:    map[string]*ConversionCustom{},
+				Struct:  ConversionCustom{},
+				StructP: &ConversionCustom{},
+			},
+		},
+		{
+			name: "nil_entries",
+			in: &ConversionCustomContainer{
+				Slice:  []ConversionCustom{{}},
+				SliceP: []*ConversionCustom{nil},
+				Map:    map[string]ConversionCustom{"key": {}},
+				MapP:   map[string]*ConversionCustom{"key": nil},
+			},
+		},
+		{
+			name: "set_entries",
+			in: &ConversionCustomContainer{
+				Slice:   []ConversionCustom{{PublicField: "test1"}},
+				SliceP:  []*ConversionCustom{{PublicField: "test2"}},
+				Map:     map[string]ConversionCustom{"key": {PublicField: "test3"}},
+				MapP:    map[string]*ConversionCustom{"key": {PublicField: "test4"}},
+				Struct:  ConversionCustom{PublicField: "test5"},
+				StructP: &ConversionCustom{PublicField: "test6"},
+			},
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			original := tc.in.DeepCopy()
+
+			out := &example.ConversionCustomContainer{}
+			if err := Convert_v1_ConversionCustomContainer_To_example_ConversionCustomContainer(tc.in, out, nil); err != nil {
+				t.Fatal(err)
+			}
+
+			roundtrip := &ConversionCustomContainer{}
+			if err := Convert_example_ConversionCustomContainer_To_v1_ConversionCustomContainer(out, roundtrip, nil); err != nil {
+				t.Fatal(err)
+			}
+
+			if !reflect.DeepEqual(original, roundtrip) {
+				t.Fatalf("expected:\n%#v\ngot:\n%#v", original, roundtrip)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/doc.go
new file mode 100644
index 0000000000..0d1407e0b6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/doc.go
@@ -0,0 +1,24 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen=package
+// +k8s:defaulter-gen=TypeMeta
+// +k8s:conversion-gen=k8s.io/code-generator/examples/apiserver/apis/example
+// +groupName=example.apiserver.code-generator.k8s.io
+// +k8s:openapi-model-package=io.k8s.code-generator.examples.apiserver.apis.example.v1
+
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/types.go
new file mode 100644
index 0000000000..8a44dc7bdf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/types.go
@@ -0,0 +1,92 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestType is a top-level type. A client is created for it.
+type TestType struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +optional
+	Status TestTypeStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestTypeList is a top-level list type. The client methods for lists are automatically created.
+// You are not supposed to create a separated client for this one.
+type TestTypeList struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []TestType `json:"items"`
+}
+
+type TestTypeStatus struct {
+	Blah string `json:"blah"`
+}
+
+type Conversion struct {
+	Identical MemoryIdentical `json:"identical"`
+	Different MemoryDifferent `json:"different"`
+}
+type MemoryIdentical struct {
+	Items *MemoryIdentical `json:"items,omitempty"`
+
+	Properties map[string]MemoryIdentical `json:"properties,omitempty"`
+
+	// +listType=atomic
+	AllOf []MemoryIdentical `json:"allOf,omitempty"`
+
+	Bool bool `json:"bool"`
+}
+type MemoryDifferent struct {
+	Items *MemoryDifferent `json:"items,omitempty"`
+
+	Properties map[string]MemoryDifferent `json:"properties,omitempty"`
+
+	// +listType=atomic
+	AllOf []MemoryDifferent `json:"allOf,omitempty"`
+
+	Bool *bool `json:"bool"` // differs from internal representation
+}
+
+type ConversionPrivate struct {
+	PublicField  string `json:"publicField"`
+	privateField string `json:"privateField"`
+}
+
+type ConversionCustomContainer struct {
+	// +listType=atomic
+	Slice []ConversionCustom `json:"slice"`
+	// +listType=atomic
+	SliceP  []*ConversionCustom          `json:"sliceP"`
+	Map     map[string]ConversionCustom  `json:"map"`
+	MapP    map[string]*ConversionCustom `json:"mapP"`
+	Struct  ConversionCustom             `json:"struct"`
+	StructP *ConversionCustom            `json:"structP"`
+}
+type ConversionCustom struct {
+	PublicField  string `json:"publicField"`
+	privateField string `json:"privateField"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/zz_generated.conversion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/zz_generated.conversion.go
new file mode 100644
index 0000000000..f4a74459bb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/zz_generated.conversion.go
@@ -0,0 +1,513 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by conversion-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	unsafe "unsafe"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	conversion "k8s.io/apimachinery/pkg/conversion"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	example "k8s.io/code-generator/examples/apiserver/apis/example"
+)
+
+func init() {
+	localSchemeBuilder.Register(RegisterConversions)
+}
+
+// RegisterConversions adds conversion functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*Conversion)(nil), (*example.Conversion)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_Conversion_To_example_Conversion(a.(*Conversion), b.(*example.Conversion), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*example.Conversion)(nil), (*Conversion)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_example_Conversion_To_v1_Conversion(a.(*example.Conversion), b.(*Conversion), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*ConversionCustomContainer)(nil), (*example.ConversionCustomContainer)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_ConversionCustomContainer_To_example_ConversionCustomContainer(a.(*ConversionCustomContainer), b.(*example.ConversionCustomContainer), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*example.ConversionCustomContainer)(nil), (*ConversionCustomContainer)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_example_ConversionCustomContainer_To_v1_ConversionCustomContainer(a.(*example.ConversionCustomContainer), b.(*ConversionCustomContainer), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*MemoryDifferent)(nil), (*example.MemoryDifferent)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_MemoryDifferent_To_example_MemoryDifferent(a.(*MemoryDifferent), b.(*example.MemoryDifferent), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*example.MemoryDifferent)(nil), (*MemoryDifferent)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_example_MemoryDifferent_To_v1_MemoryDifferent(a.(*example.MemoryDifferent), b.(*MemoryDifferent), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*MemoryIdentical)(nil), (*example.MemoryIdentical)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_MemoryIdentical_To_example_MemoryIdentical(a.(*MemoryIdentical), b.(*example.MemoryIdentical), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*example.MemoryIdentical)(nil), (*MemoryIdentical)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_example_MemoryIdentical_To_v1_MemoryIdentical(a.(*example.MemoryIdentical), b.(*MemoryIdentical), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*TestType)(nil), (*example.TestType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_TestType_To_example_TestType(a.(*TestType), b.(*example.TestType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*example.TestType)(nil), (*TestType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_example_TestType_To_v1_TestType(a.(*example.TestType), b.(*TestType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*TestTypeList)(nil), (*example.TestTypeList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_TestTypeList_To_example_TestTypeList(a.(*TestTypeList), b.(*example.TestTypeList), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*example.TestTypeList)(nil), (*TestTypeList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_example_TestTypeList_To_v1_TestTypeList(a.(*example.TestTypeList), b.(*TestTypeList), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*TestTypeStatus)(nil), (*example.TestTypeStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_TestTypeStatus_To_example_TestTypeStatus(a.(*TestTypeStatus), b.(*example.TestTypeStatus), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*example.TestTypeStatus)(nil), (*TestTypeStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_example_TestTypeStatus_To_v1_TestTypeStatus(a.(*example.TestTypeStatus), b.(*TestTypeStatus), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*example.ConversionCustom)(nil), (*ConversionCustom)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_example_ConversionCustom_To_v1_ConversionCustom(a.(*example.ConversionCustom), b.(*ConversionCustom), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*example.ConversionPrivate)(nil), (*ConversionPrivate)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_example_ConversionPrivate_To_v1_ConversionPrivate(a.(*example.ConversionPrivate), b.(*ConversionPrivate), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ConversionCustom)(nil), (*example.ConversionCustom)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_ConversionCustom_To_example_ConversionCustom(a.(*ConversionCustom), b.(*example.ConversionCustom), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ConversionPrivate)(nil), (*example.ConversionPrivate)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_ConversionPrivate_To_example_ConversionPrivate(a.(*ConversionPrivate), b.(*example.ConversionPrivate), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+func autoConvert_v1_Conversion_To_example_Conversion(in *Conversion, out *example.Conversion, s conversion.Scope) error {
+	if err := Convert_v1_MemoryIdentical_To_example_MemoryIdentical(&in.Identical, &out.Identical, s); err != nil {
+		return err
+	}
+	if err := Convert_v1_MemoryDifferent_To_example_MemoryDifferent(&in.Different, &out.Different, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_v1_Conversion_To_example_Conversion is an autogenerated conversion function.
+func Convert_v1_Conversion_To_example_Conversion(in *Conversion, out *example.Conversion, s conversion.Scope) error {
+	return autoConvert_v1_Conversion_To_example_Conversion(in, out, s)
+}
+
+func autoConvert_example_Conversion_To_v1_Conversion(in *example.Conversion, out *Conversion, s conversion.Scope) error {
+	if err := Convert_example_MemoryIdentical_To_v1_MemoryIdentical(&in.Identical, &out.Identical, s); err != nil {
+		return err
+	}
+	if err := Convert_example_MemoryDifferent_To_v1_MemoryDifferent(&in.Different, &out.Different, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_example_Conversion_To_v1_Conversion is an autogenerated conversion function.
+func Convert_example_Conversion_To_v1_Conversion(in *example.Conversion, out *Conversion, s conversion.Scope) error {
+	return autoConvert_example_Conversion_To_v1_Conversion(in, out, s)
+}
+
+func autoConvert_v1_ConversionCustom_To_example_ConversionCustom(in *ConversionCustom, out *example.ConversionCustom, s conversion.Scope) error {
+	out.PublicField = in.PublicField
+	// WARNING: out.privateField is not exported and cannot be set
+	return nil
+}
+
+func autoConvert_example_ConversionCustom_To_v1_ConversionCustom(in *example.ConversionCustom, out *ConversionCustom, s conversion.Scope) error {
+	out.PublicField = in.PublicField
+	// WARNING: in.privateField is not exported and cannot be read
+	return nil
+}
+
+func autoConvert_v1_ConversionCustomContainer_To_example_ConversionCustomContainer(in *ConversionCustomContainer, out *example.ConversionCustomContainer, s conversion.Scope) error {
+	if in.Slice != nil {
+		in, out := &in.Slice, &out.Slice
+		*out = make([]example.ConversionCustom, len(*in))
+		for i := range *in {
+			if err := Convert_v1_ConversionCustom_To_example_ConversionCustom(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Slice = nil
+	}
+	if in.SliceP != nil {
+		in, out := &in.SliceP, &out.SliceP
+		*out = make([]*example.ConversionCustom, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				(*out)[i] = new(example.ConversionCustom)
+				if err := Convert_v1_ConversionCustom_To_example_ConversionCustom((*in)[i], (*out)[i], s); err != nil {
+					return err
+				}
+			}
+		}
+	} else {
+		out.SliceP = nil
+	}
+	if in.Map != nil {
+		in, out := &in.Map, &out.Map
+		*out = make(map[string]example.ConversionCustom, len(*in))
+		for key, val := range *in {
+			newVal := new(example.ConversionCustom)
+			if err := Convert_v1_ConversionCustom_To_example_ConversionCustom(&val, newVal, s); err != nil {
+				return err
+			}
+			(*out)[key] = *newVal
+		}
+	} else {
+		out.Map = nil
+	}
+	if in.MapP != nil {
+		in, out := &in.MapP, &out.MapP
+		*out = make(map[string]*example.ConversionCustom, len(*in))
+		for key, val := range *in {
+			newVal := new(*example.ConversionCustom)
+			if val != nil {
+				*newVal = new(example.ConversionCustom)
+				if err := Convert_v1_ConversionCustom_To_example_ConversionCustom(val, *newVal, s); err != nil {
+					return err
+				}
+			}
+			(*out)[key] = *newVal
+		}
+	} else {
+		out.MapP = nil
+	}
+	if err := Convert_v1_ConversionCustom_To_example_ConversionCustom(&in.Struct, &out.Struct, s); err != nil {
+		return err
+	}
+	if in.StructP != nil {
+		in, out := &in.StructP, &out.StructP
+		*out = new(example.ConversionCustom)
+		if err := Convert_v1_ConversionCustom_To_example_ConversionCustom(*in, *out, s); err != nil {
+			return err
+		}
+	} else {
+		out.StructP = nil
+	}
+	return nil
+}
+
+// Convert_v1_ConversionCustomContainer_To_example_ConversionCustomContainer is an autogenerated conversion function.
+func Convert_v1_ConversionCustomContainer_To_example_ConversionCustomContainer(in *ConversionCustomContainer, out *example.ConversionCustomContainer, s conversion.Scope) error {
+	return autoConvert_v1_ConversionCustomContainer_To_example_ConversionCustomContainer(in, out, s)
+}
+
+func autoConvert_example_ConversionCustomContainer_To_v1_ConversionCustomContainer(in *example.ConversionCustomContainer, out *ConversionCustomContainer, s conversion.Scope) error {
+	if in.Slice != nil {
+		in, out := &in.Slice, &out.Slice
+		*out = make([]ConversionCustom, len(*in))
+		for i := range *in {
+			if err := Convert_example_ConversionCustom_To_v1_ConversionCustom(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Slice = nil
+	}
+	if in.SliceP != nil {
+		in, out := &in.SliceP, &out.SliceP
+		*out = make([]*ConversionCustom, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				(*out)[i] = new(ConversionCustom)
+				if err := Convert_example_ConversionCustom_To_v1_ConversionCustom((*in)[i], (*out)[i], s); err != nil {
+					return err
+				}
+			}
+		}
+	} else {
+		out.SliceP = nil
+	}
+	if in.Map != nil {
+		in, out := &in.Map, &out.Map
+		*out = make(map[string]ConversionCustom, len(*in))
+		for key, val := range *in {
+			newVal := new(ConversionCustom)
+			if err := Convert_example_ConversionCustom_To_v1_ConversionCustom(&val, newVal, s); err != nil {
+				return err
+			}
+			(*out)[key] = *newVal
+		}
+	} else {
+		out.Map = nil
+	}
+	if in.MapP != nil {
+		in, out := &in.MapP, &out.MapP
+		*out = make(map[string]*ConversionCustom, len(*in))
+		for key, val := range *in {
+			newVal := new(*ConversionCustom)
+			if val != nil {
+				*newVal = new(ConversionCustom)
+				if err := Convert_example_ConversionCustom_To_v1_ConversionCustom(val, *newVal, s); err != nil {
+					return err
+				}
+			}
+			(*out)[key] = *newVal
+		}
+	} else {
+		out.MapP = nil
+	}
+	if err := Convert_example_ConversionCustom_To_v1_ConversionCustom(&in.Struct, &out.Struct, s); err != nil {
+		return err
+	}
+	if in.StructP != nil {
+		in, out := &in.StructP, &out.StructP
+		*out = new(ConversionCustom)
+		if err := Convert_example_ConversionCustom_To_v1_ConversionCustom(*in, *out, s); err != nil {
+			return err
+		}
+	} else {
+		out.StructP = nil
+	}
+	return nil
+}
+
+// Convert_example_ConversionCustomContainer_To_v1_ConversionCustomContainer is an autogenerated conversion function.
+func Convert_example_ConversionCustomContainer_To_v1_ConversionCustomContainer(in *example.ConversionCustomContainer, out *ConversionCustomContainer, s conversion.Scope) error {
+	return autoConvert_example_ConversionCustomContainer_To_v1_ConversionCustomContainer(in, out, s)
+}
+
+func autoConvert_v1_ConversionPrivate_To_example_ConversionPrivate(in *ConversionPrivate, out *example.ConversionPrivate, s conversion.Scope) error {
+	out.PublicField = in.PublicField
+	// WARNING: out.privateField is not exported and cannot be set
+	return nil
+}
+
+func autoConvert_example_ConversionPrivate_To_v1_ConversionPrivate(in *example.ConversionPrivate, out *ConversionPrivate, s conversion.Scope) error {
+	out.PublicField = in.PublicField
+	// WARNING: in.privateField is not exported and cannot be read
+	return nil
+}
+
+func autoConvert_v1_MemoryDifferent_To_example_MemoryDifferent(in *MemoryDifferent, out *example.MemoryDifferent, s conversion.Scope) error {
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = new(example.MemoryDifferent)
+		if err := Convert_v1_MemoryDifferent_To_example_MemoryDifferent(*in, *out, s); err != nil {
+			return err
+		}
+	} else {
+		out.Items = nil
+	}
+	if in.Properties != nil {
+		in, out := &in.Properties, &out.Properties
+		*out = make(map[string]example.MemoryDifferent, len(*in))
+		for key, val := range *in {
+			newVal := new(example.MemoryDifferent)
+			if err := Convert_v1_MemoryDifferent_To_example_MemoryDifferent(&val, newVal, s); err != nil {
+				return err
+			}
+			(*out)[key] = *newVal
+		}
+	} else {
+		out.Properties = nil
+	}
+	if in.AllOf != nil {
+		in, out := &in.AllOf, &out.AllOf
+		*out = make([]example.MemoryDifferent, len(*in))
+		for i := range *in {
+			if err := Convert_v1_MemoryDifferent_To_example_MemoryDifferent(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.AllOf = nil
+	}
+	if err := metav1.Convert_Pointer_bool_To_bool(&in.Bool, &out.Bool, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_v1_MemoryDifferent_To_example_MemoryDifferent is an autogenerated conversion function.
+func Convert_v1_MemoryDifferent_To_example_MemoryDifferent(in *MemoryDifferent, out *example.MemoryDifferent, s conversion.Scope) error {
+	return autoConvert_v1_MemoryDifferent_To_example_MemoryDifferent(in, out, s)
+}
+
+func autoConvert_example_MemoryDifferent_To_v1_MemoryDifferent(in *example.MemoryDifferent, out *MemoryDifferent, s conversion.Scope) error {
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = new(MemoryDifferent)
+		if err := Convert_example_MemoryDifferent_To_v1_MemoryDifferent(*in, *out, s); err != nil {
+			return err
+		}
+	} else {
+		out.Items = nil
+	}
+	if in.Properties != nil {
+		in, out := &in.Properties, &out.Properties
+		*out = make(map[string]MemoryDifferent, len(*in))
+		for key, val := range *in {
+			newVal := new(MemoryDifferent)
+			if err := Convert_example_MemoryDifferent_To_v1_MemoryDifferent(&val, newVal, s); err != nil {
+				return err
+			}
+			(*out)[key] = *newVal
+		}
+	} else {
+		out.Properties = nil
+	}
+	if in.AllOf != nil {
+		in, out := &in.AllOf, &out.AllOf
+		*out = make([]MemoryDifferent, len(*in))
+		for i := range *in {
+			if err := Convert_example_MemoryDifferent_To_v1_MemoryDifferent(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.AllOf = nil
+	}
+	if err := metav1.Convert_bool_To_Pointer_bool(&in.Bool, &out.Bool, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_example_MemoryDifferent_To_v1_MemoryDifferent is an autogenerated conversion function.
+func Convert_example_MemoryDifferent_To_v1_MemoryDifferent(in *example.MemoryDifferent, out *MemoryDifferent, s conversion.Scope) error {
+	return autoConvert_example_MemoryDifferent_To_v1_MemoryDifferent(in, out, s)
+}
+
+func autoConvert_v1_MemoryIdentical_To_example_MemoryIdentical(in *MemoryIdentical, out *example.MemoryIdentical, s conversion.Scope) error {
+	*out = *(*example.MemoryIdentical)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_v1_MemoryIdentical_To_example_MemoryIdentical is an autogenerated conversion function.
+func Convert_v1_MemoryIdentical_To_example_MemoryIdentical(in *MemoryIdentical, out *example.MemoryIdentical, s conversion.Scope) error {
+	return autoConvert_v1_MemoryIdentical_To_example_MemoryIdentical(in, out, s)
+}
+
+func autoConvert_example_MemoryIdentical_To_v1_MemoryIdentical(in *example.MemoryIdentical, out *MemoryIdentical, s conversion.Scope) error {
+	*out = *(*MemoryIdentical)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_example_MemoryIdentical_To_v1_MemoryIdentical is an autogenerated conversion function.
+func Convert_example_MemoryIdentical_To_v1_MemoryIdentical(in *example.MemoryIdentical, out *MemoryIdentical, s conversion.Scope) error {
+	return autoConvert_example_MemoryIdentical_To_v1_MemoryIdentical(in, out, s)
+}
+
+func autoConvert_v1_TestType_To_example_TestType(in *TestType, out *example.TestType, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_v1_TestTypeStatus_To_example_TestTypeStatus(&in.Status, &out.Status, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_v1_TestType_To_example_TestType is an autogenerated conversion function.
+func Convert_v1_TestType_To_example_TestType(in *TestType, out *example.TestType, s conversion.Scope) error {
+	return autoConvert_v1_TestType_To_example_TestType(in, out, s)
+}
+
+func autoConvert_example_TestType_To_v1_TestType(in *example.TestType, out *TestType, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_example_TestTypeStatus_To_v1_TestTypeStatus(&in.Status, &out.Status, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_example_TestType_To_v1_TestType is an autogenerated conversion function.
+func Convert_example_TestType_To_v1_TestType(in *example.TestType, out *TestType, s conversion.Scope) error {
+	return autoConvert_example_TestType_To_v1_TestType(in, out, s)
+}
+
+func autoConvert_v1_TestTypeList_To_example_TestTypeList(in *TestTypeList, out *example.TestTypeList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	out.Items = *(*[]example.TestType)(unsafe.Pointer(&in.Items))
+	return nil
+}
+
+// Convert_v1_TestTypeList_To_example_TestTypeList is an autogenerated conversion function.
+func Convert_v1_TestTypeList_To_example_TestTypeList(in *TestTypeList, out *example.TestTypeList, s conversion.Scope) error {
+	return autoConvert_v1_TestTypeList_To_example_TestTypeList(in, out, s)
+}
+
+func autoConvert_example_TestTypeList_To_v1_TestTypeList(in *example.TestTypeList, out *TestTypeList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	out.Items = *(*[]TestType)(unsafe.Pointer(&in.Items))
+	return nil
+}
+
+// Convert_example_TestTypeList_To_v1_TestTypeList is an autogenerated conversion function.
+func Convert_example_TestTypeList_To_v1_TestTypeList(in *example.TestTypeList, out *TestTypeList, s conversion.Scope) error {
+	return autoConvert_example_TestTypeList_To_v1_TestTypeList(in, out, s)
+}
+
+func autoConvert_v1_TestTypeStatus_To_example_TestTypeStatus(in *TestTypeStatus, out *example.TestTypeStatus, s conversion.Scope) error {
+	*out = *(*example.TestTypeStatus)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_v1_TestTypeStatus_To_example_TestTypeStatus is an autogenerated conversion function.
+func Convert_v1_TestTypeStatus_To_example_TestTypeStatus(in *TestTypeStatus, out *example.TestTypeStatus, s conversion.Scope) error {
+	return autoConvert_v1_TestTypeStatus_To_example_TestTypeStatus(in, out, s)
+}
+
+func autoConvert_example_TestTypeStatus_To_v1_TestTypeStatus(in *example.TestTypeStatus, out *TestTypeStatus, s conversion.Scope) error {
+	*out = *(*TestTypeStatus)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_example_TestTypeStatus_To_v1_TestTypeStatus is an autogenerated conversion function.
+func Convert_example_TestTypeStatus_To_v1_TestTypeStatus(in *example.TestTypeStatus, out *TestTypeStatus, s conversion.Scope) error {
+	return autoConvert_example_TestTypeStatus_To_v1_TestTypeStatus(in, out, s)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..4d0ad6cec8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/zz_generated.deepcopy.go
@@ -0,0 +1,287 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Conversion) DeepCopyInto(out *Conversion) {
+	*out = *in
+	in.Identical.DeepCopyInto(&out.Identical)
+	in.Different.DeepCopyInto(&out.Different)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Conversion.
+func (in *Conversion) DeepCopy() *Conversion {
+	if in == nil {
+		return nil
+	}
+	out := new(Conversion)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConversionCustom) DeepCopyInto(out *ConversionCustom) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConversionCustom.
+func (in *ConversionCustom) DeepCopy() *ConversionCustom {
+	if in == nil {
+		return nil
+	}
+	out := new(ConversionCustom)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConversionCustomContainer) DeepCopyInto(out *ConversionCustomContainer) {
+	*out = *in
+	if in.Slice != nil {
+		in, out := &in.Slice, &out.Slice
+		*out = make([]ConversionCustom, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceP != nil {
+		in, out := &in.SliceP, &out.SliceP
+		*out = make([]*ConversionCustom, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(ConversionCustom)
+				**out = **in
+			}
+		}
+	}
+	if in.Map != nil {
+		in, out := &in.Map, &out.Map
+		*out = make(map[string]ConversionCustom, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.MapP != nil {
+		in, out := &in.MapP, &out.MapP
+		*out = make(map[string]*ConversionCustom, len(*in))
+		for key, val := range *in {
+			var outVal *ConversionCustom
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = new(ConversionCustom)
+				**out = **in
+			}
+			(*out)[key] = outVal
+		}
+	}
+	out.Struct = in.Struct
+	if in.StructP != nil {
+		in, out := &in.StructP, &out.StructP
+		*out = new(ConversionCustom)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConversionCustomContainer.
+func (in *ConversionCustomContainer) DeepCopy() *ConversionCustomContainer {
+	if in == nil {
+		return nil
+	}
+	out := new(ConversionCustomContainer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConversionPrivate) DeepCopyInto(out *ConversionPrivate) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConversionPrivate.
+func (in *ConversionPrivate) DeepCopy() *ConversionPrivate {
+	if in == nil {
+		return nil
+	}
+	out := new(ConversionPrivate)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *MemoryDifferent) DeepCopyInto(out *MemoryDifferent) {
+	*out = *in
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = new(MemoryDifferent)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Properties != nil {
+		in, out := &in.Properties, &out.Properties
+		*out = make(map[string]MemoryDifferent, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	if in.AllOf != nil {
+		in, out := &in.AllOf, &out.AllOf
+		*out = make([]MemoryDifferent, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Bool != nil {
+		in, out := &in.Bool, &out.Bool
+		*out = new(bool)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MemoryDifferent.
+func (in *MemoryDifferent) DeepCopy() *MemoryDifferent {
+	if in == nil {
+		return nil
+	}
+	out := new(MemoryDifferent)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *MemoryIdentical) DeepCopyInto(out *MemoryIdentical) {
+	*out = *in
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = new(MemoryIdentical)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Properties != nil {
+		in, out := &in.Properties, &out.Properties
+		*out = make(map[string]MemoryIdentical, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	if in.AllOf != nil {
+		in, out := &in.AllOf, &out.AllOf
+		*out = make([]MemoryIdentical, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MemoryIdentical.
+func (in *MemoryIdentical) DeepCopy() *MemoryIdentical {
+	if in == nil {
+		return nil
+	}
+	out := new(MemoryIdentical)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType) DeepCopyInto(out *TestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType.
+func (in *TestType) DeepCopy() *TestType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeList) DeepCopyInto(out *TestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeList.
+func (in *TestTypeList) DeepCopy() *TestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeStatus) DeepCopyInto(out *TestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeStatus.
+func (in *TestTypeStatus) DeepCopy() *TestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/zz_generated.defaults.go
new file mode 100644
index 0000000000..dac177e93b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/zz_generated.model_name.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/zz_generated.model_name.go
new file mode 100644
index 0000000000..ce0d1aa552
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/zz_generated.model_name.go
@@ -0,0 +1,67 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package v1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Conversion) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.example.v1.Conversion"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ConversionCustom) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.example.v1.ConversionCustom"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ConversionCustomContainer) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.example.v1.ConversionCustomContainer"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ConversionPrivate) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.example.v1.ConversionPrivate"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in MemoryDifferent) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.example.v1.MemoryDifferent"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in MemoryIdentical) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.example.v1.MemoryIdentical"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TestType) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.example.v1.TestType"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TestTypeList) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.example.v1.TestTypeList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TestTypeStatus) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.example.v1.TestTypeStatus"
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/zz_generated.register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/zz_generated.register.go
new file mode 100644
index 0000000000..fa02e7b1f1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/v1/zz_generated.register.go
@@ -0,0 +1,71 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by register-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName specifies the group name used to register the objects.
+const GroupName = "example.apiserver.code-generator.k8s.io"
+
+// GroupVersion specifies the group and the version used to register the objects.
+var GroupVersion = metav1.GroupVersion{Group: GroupName, Version: "v1"}
+
+// SchemeGroupVersion is group version used to register these objects
+//
+// Deprecated: use GroupVersion instead.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	// Deprecated: use Install instead
+	AddToScheme = localSchemeBuilder.AddToScheme
+	Install     = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&TestType{},
+		&TestTypeList{},
+	)
+	// AddToGroupVersion allows the serialization of client types like ListOptions.
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..a27cd80336
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example/zz_generated.deepcopy.go
@@ -0,0 +1,282 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package example
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Conversion) DeepCopyInto(out *Conversion) {
+	*out = *in
+	in.Identical.DeepCopyInto(&out.Identical)
+	in.Different.DeepCopyInto(&out.Different)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Conversion.
+func (in *Conversion) DeepCopy() *Conversion {
+	if in == nil {
+		return nil
+	}
+	out := new(Conversion)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConversionCustom) DeepCopyInto(out *ConversionCustom) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConversionCustom.
+func (in *ConversionCustom) DeepCopy() *ConversionCustom {
+	if in == nil {
+		return nil
+	}
+	out := new(ConversionCustom)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConversionCustomContainer) DeepCopyInto(out *ConversionCustomContainer) {
+	*out = *in
+	if in.Slice != nil {
+		in, out := &in.Slice, &out.Slice
+		*out = make([]ConversionCustom, len(*in))
+		copy(*out, *in)
+	}
+	if in.SliceP != nil {
+		in, out := &in.SliceP, &out.SliceP
+		*out = make([]*ConversionCustom, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(ConversionCustom)
+				**out = **in
+			}
+		}
+	}
+	if in.Map != nil {
+		in, out := &in.Map, &out.Map
+		*out = make(map[string]ConversionCustom, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.MapP != nil {
+		in, out := &in.MapP, &out.MapP
+		*out = make(map[string]*ConversionCustom, len(*in))
+		for key, val := range *in {
+			var outVal *ConversionCustom
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = new(ConversionCustom)
+				**out = **in
+			}
+			(*out)[key] = outVal
+		}
+	}
+	out.Struct = in.Struct
+	if in.StructP != nil {
+		in, out := &in.StructP, &out.StructP
+		*out = new(ConversionCustom)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConversionCustomContainer.
+func (in *ConversionCustomContainer) DeepCopy() *ConversionCustomContainer {
+	if in == nil {
+		return nil
+	}
+	out := new(ConversionCustomContainer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConversionPrivate) DeepCopyInto(out *ConversionPrivate) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConversionPrivate.
+func (in *ConversionPrivate) DeepCopy() *ConversionPrivate {
+	if in == nil {
+		return nil
+	}
+	out := new(ConversionPrivate)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *MemoryDifferent) DeepCopyInto(out *MemoryDifferent) {
+	*out = *in
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = new(MemoryDifferent)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Properties != nil {
+		in, out := &in.Properties, &out.Properties
+		*out = make(map[string]MemoryDifferent, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	if in.AllOf != nil {
+		in, out := &in.AllOf, &out.AllOf
+		*out = make([]MemoryDifferent, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MemoryDifferent.
+func (in *MemoryDifferent) DeepCopy() *MemoryDifferent {
+	if in == nil {
+		return nil
+	}
+	out := new(MemoryDifferent)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *MemoryIdentical) DeepCopyInto(out *MemoryIdentical) {
+	*out = *in
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = new(MemoryIdentical)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Properties != nil {
+		in, out := &in.Properties, &out.Properties
+		*out = make(map[string]MemoryIdentical, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	if in.AllOf != nil {
+		in, out := &in.AllOf, &out.AllOf
+		*out = make([]MemoryIdentical, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MemoryIdentical.
+func (in *MemoryIdentical) DeepCopy() *MemoryIdentical {
+	if in == nil {
+		return nil
+	}
+	out := new(MemoryIdentical)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType) DeepCopyInto(out *TestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType.
+func (in *TestType) DeepCopy() *TestType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeList) DeepCopyInto(out *TestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeList.
+func (in *TestTypeList) DeepCopy() *TestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeStatus) DeepCopyInto(out *TestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeStatus.
+func (in *TestTypeStatus) DeepCopy() *TestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/doc.go
new file mode 100644
index 0000000000..09be515b57
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/doc.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +groupName=example.test.apiserver.code-generator.k8s.io
+// +groupGoName=SecondExample
+
+package example2
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/install/install.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/install/install.go
new file mode 100644
index 0000000000..97e6d1081f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/install/install.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package install installs the experimental API group, making it available as
+// an option to all of the API encoding/decoding machinery.
+package install
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/code-generator/examples/apiserver/apis/example2"
+	"k8s.io/code-generator/examples/apiserver/apis/example2/v1"
+)
+
+// Install registers the API group and adds types to a scheme
+func Install(scheme *runtime.Scheme) {
+	utilruntime.Must(example2.AddToScheme(scheme))
+	utilruntime.Must(v1.AddToScheme(scheme))
+	utilruntime.Must(scheme.SetVersionPriority(v1.SchemeGroupVersion))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/register.go
new file mode 100644
index 0000000000..508565af7a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/register.go
@@ -0,0 +1,45 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package example2
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var SchemeGroupVersion = schema.GroupVersion{Group: "example.test.apiserver.code-generator.k8s.io", Version: runtime.APIVersionInternal}
+
+var (
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+	AddToScheme   = SchemeBuilder.AddToScheme
+)
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&TestType{},
+		&TestTypeList{},
+	)
+
+	scheme.AddKnownTypes(SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/types.go
new file mode 100644
index 0000000000..3bdcf2a9a4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/types.go
@@ -0,0 +1,45 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package example2
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +genclient:nonNamespaced
+//
+// TestType is a top-level type. A client is created for it.
+type TestType struct {
+	metav1.TypeMeta
+	metav1.ObjectMeta
+	Status TestTypeStatus
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestTypeList is a top-level list type. The client methods for lists are automatically created.
+// You are not supposed to create a separated client for this one.
+type TestTypeList struct {
+	metav1.TypeMeta
+	metav1.ListMeta
+
+	Items []TestType
+}
+
+type TestTypeStatus struct {
+	Blah string
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/doc.go
new file mode 100644
index 0000000000..e1d68f6cb4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/doc.go
@@ -0,0 +1,25 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen=package
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=example.test.apiserver.code-generator.k8s.io
+// +k8s:conversion-gen=k8s.io/code-generator/examples/apiserver/apis/example2
+// +groupGoName=SecondExample
+// +k8s:openapi-model-package=io.k8s.code-generator.examples.apiserver.apis.example2.v1
+
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/types.go
new file mode 100644
index 0000000000..3ae1f96721
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/types.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestType is a top-level type. A client is created for it.
+type TestType struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +optional
+	Status TestTypeStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestTypeList is a top-level list type. The client methods for lists are automatically created.
+// You are not supposed to create a separated client for this one.
+type TestTypeList struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []TestType `json:"items"`
+}
+
+type TestTypeStatus struct {
+	Blah string `json:"blah"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/zz_generated.conversion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/zz_generated.conversion.go
new file mode 100644
index 0000000000..865afe19d2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/zz_generated.conversion.go
@@ -0,0 +1,138 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by conversion-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	unsafe "unsafe"
+
+	conversion "k8s.io/apimachinery/pkg/conversion"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	example2 "k8s.io/code-generator/examples/apiserver/apis/example2"
+)
+
+func init() {
+	localSchemeBuilder.Register(RegisterConversions)
+}
+
+// RegisterConversions adds conversion functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*TestType)(nil), (*example2.TestType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_TestType_To_example2_TestType(a.(*TestType), b.(*example2.TestType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*example2.TestType)(nil), (*TestType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_example2_TestType_To_v1_TestType(a.(*example2.TestType), b.(*TestType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*TestTypeList)(nil), (*example2.TestTypeList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_TestTypeList_To_example2_TestTypeList(a.(*TestTypeList), b.(*example2.TestTypeList), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*example2.TestTypeList)(nil), (*TestTypeList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_example2_TestTypeList_To_v1_TestTypeList(a.(*example2.TestTypeList), b.(*TestTypeList), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*TestTypeStatus)(nil), (*example2.TestTypeStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_TestTypeStatus_To_example2_TestTypeStatus(a.(*TestTypeStatus), b.(*example2.TestTypeStatus), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*example2.TestTypeStatus)(nil), (*TestTypeStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_example2_TestTypeStatus_To_v1_TestTypeStatus(a.(*example2.TestTypeStatus), b.(*TestTypeStatus), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+func autoConvert_v1_TestType_To_example2_TestType(in *TestType, out *example2.TestType, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_v1_TestTypeStatus_To_example2_TestTypeStatus(&in.Status, &out.Status, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_v1_TestType_To_example2_TestType is an autogenerated conversion function.
+func Convert_v1_TestType_To_example2_TestType(in *TestType, out *example2.TestType, s conversion.Scope) error {
+	return autoConvert_v1_TestType_To_example2_TestType(in, out, s)
+}
+
+func autoConvert_example2_TestType_To_v1_TestType(in *example2.TestType, out *TestType, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_example2_TestTypeStatus_To_v1_TestTypeStatus(&in.Status, &out.Status, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_example2_TestType_To_v1_TestType is an autogenerated conversion function.
+func Convert_example2_TestType_To_v1_TestType(in *example2.TestType, out *TestType, s conversion.Scope) error {
+	return autoConvert_example2_TestType_To_v1_TestType(in, out, s)
+}
+
+func autoConvert_v1_TestTypeList_To_example2_TestTypeList(in *TestTypeList, out *example2.TestTypeList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	out.Items = *(*[]example2.TestType)(unsafe.Pointer(&in.Items))
+	return nil
+}
+
+// Convert_v1_TestTypeList_To_example2_TestTypeList is an autogenerated conversion function.
+func Convert_v1_TestTypeList_To_example2_TestTypeList(in *TestTypeList, out *example2.TestTypeList, s conversion.Scope) error {
+	return autoConvert_v1_TestTypeList_To_example2_TestTypeList(in, out, s)
+}
+
+func autoConvert_example2_TestTypeList_To_v1_TestTypeList(in *example2.TestTypeList, out *TestTypeList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	out.Items = *(*[]TestType)(unsafe.Pointer(&in.Items))
+	return nil
+}
+
+// Convert_example2_TestTypeList_To_v1_TestTypeList is an autogenerated conversion function.
+func Convert_example2_TestTypeList_To_v1_TestTypeList(in *example2.TestTypeList, out *TestTypeList, s conversion.Scope) error {
+	return autoConvert_example2_TestTypeList_To_v1_TestTypeList(in, out, s)
+}
+
+func autoConvert_v1_TestTypeStatus_To_example2_TestTypeStatus(in *TestTypeStatus, out *example2.TestTypeStatus, s conversion.Scope) error {
+	*out = *(*example2.TestTypeStatus)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_v1_TestTypeStatus_To_example2_TestTypeStatus is an autogenerated conversion function.
+func Convert_v1_TestTypeStatus_To_example2_TestTypeStatus(in *TestTypeStatus, out *example2.TestTypeStatus, s conversion.Scope) error {
+	return autoConvert_v1_TestTypeStatus_To_example2_TestTypeStatus(in, out, s)
+}
+
+func autoConvert_example2_TestTypeStatus_To_v1_TestTypeStatus(in *example2.TestTypeStatus, out *TestTypeStatus, s conversion.Scope) error {
+	*out = *(*TestTypeStatus)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_example2_TestTypeStatus_To_v1_TestTypeStatus is an autogenerated conversion function.
+func Convert_example2_TestTypeStatus_To_v1_TestTypeStatus(in *example2.TestTypeStatus, out *TestTypeStatus, s conversion.Scope) error {
+	return autoConvert_example2_TestTypeStatus_To_v1_TestTypeStatus(in, out, s)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..d87f706f77
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/zz_generated.deepcopy.go
@@ -0,0 +1,102 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType) DeepCopyInto(out *TestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType.
+func (in *TestType) DeepCopy() *TestType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeList) DeepCopyInto(out *TestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeList.
+func (in *TestTypeList) DeepCopy() *TestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeStatus) DeepCopyInto(out *TestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeStatus.
+func (in *TestTypeStatus) DeepCopy() *TestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/zz_generated.defaults.go
new file mode 100644
index 0000000000..dac177e93b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/zz_generated.model_name.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/zz_generated.model_name.go
new file mode 100644
index 0000000000..51b9bb8966
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/zz_generated.model_name.go
@@ -0,0 +1,37 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package v1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TestType) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.example2.v1.TestType"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TestTypeList) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.example2.v1.TestTypeList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TestTypeStatus) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.example2.v1.TestTypeStatus"
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/zz_generated.register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/zz_generated.register.go
new file mode 100644
index 0000000000..a1c3dcd081
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/v1/zz_generated.register.go
@@ -0,0 +1,71 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by register-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName specifies the group name used to register the objects.
+const GroupName = "example.test.apiserver.code-generator.k8s.io"
+
+// GroupVersion specifies the group and the version used to register the objects.
+var GroupVersion = metav1.GroupVersion{Group: GroupName, Version: "v1"}
+
+// SchemeGroupVersion is group version used to register these objects
+//
+// Deprecated: use GroupVersion instead.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	// Deprecated: use Install instead
+	AddToScheme = localSchemeBuilder.AddToScheme
+	Install     = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&TestType{},
+		&TestTypeList{},
+	)
+	// AddToGroupVersion allows the serialization of client types like ListOptions.
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..1fa43c462e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example2/zz_generated.deepcopy.go
@@ -0,0 +1,102 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package example2
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType) DeepCopyInto(out *TestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType.
+func (in *TestType) DeepCopy() *TestType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeList) DeepCopyInto(out *TestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeList.
+func (in *TestTypeList) DeepCopy() *TestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeStatus) DeepCopyInto(out *TestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeStatus.
+func (in *TestTypeStatus) DeepCopy() *TestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/doc.go
new file mode 100644
index 0000000000..89ee87604e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/doc.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +groupName=example.dots.apiserver.code-generator.k8s.io
+// +groupGoName=ThirdExample
+
+package example3
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/install/install.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/install/install.go
new file mode 100644
index 0000000000..7305d2bbef
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/install/install.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package install installs the experimental API group, making it available as
+// an option to all of the API encoding/decoding machinery.
+package install
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	example3 "k8s.io/code-generator/examples/apiserver/apis/example3.io"
+	"k8s.io/code-generator/examples/apiserver/apis/example3.io/v1"
+)
+
+// Install registers the API group and adds types to a scheme
+func Install(scheme *runtime.Scheme) {
+	utilruntime.Must(example3.AddToScheme(scheme))
+	utilruntime.Must(v1.AddToScheme(scheme))
+	utilruntime.Must(scheme.SetVersionPriority(v1.SchemeGroupVersion))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/register.go
new file mode 100644
index 0000000000..b77b2b1807
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/register.go
@@ -0,0 +1,45 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package example3
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var SchemeGroupVersion = schema.GroupVersion{Group: "example.dots.apiserver.code-generator.k8s.io", Version: runtime.APIVersionInternal}
+
+var (
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+	AddToScheme   = SchemeBuilder.AddToScheme
+)
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&TestType{},
+		&TestTypeList{},
+	)
+
+	scheme.AddKnownTypes(SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/types.go
new file mode 100644
index 0000000000..a020b0af53
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/types.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package example3
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestType is a top-level type. A client is created for it.
+type TestType struct {
+	metav1.TypeMeta
+	// +optional
+	metav1.ObjectMeta
+	// +optional
+	Status TestTypeStatus
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestTypeList is a top-level list type. The client methods for lists are automatically created.
+// You are not supposed to create a separated client for this one.
+type TestTypeList struct {
+	metav1.TypeMeta
+	// +optional
+	metav1.ListMeta
+
+	Items []TestType
+}
+
+type TestTypeStatus struct {
+	Blah string
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/doc.go
new file mode 100644
index 0000000000..5756ae11ce
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/doc.go
@@ -0,0 +1,25 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen=package
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=example.dots.apiserver.code-generator.k8s.io
+// +k8s:conversion-gen=k8s.io/code-generator/examples/apiserver/apis/example3.io
+// +groupGoName=ThirdExample
+// +k8s:openapi-model-package=io.k8s.code-generator.examples.apiserver.apis.example3.io.v1
+
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/types.go
new file mode 100644
index 0000000000..3ae1f96721
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/types.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestType is a top-level type. A client is created for it.
+type TestType struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +optional
+	Status TestTypeStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestTypeList is a top-level list type. The client methods for lists are automatically created.
+// You are not supposed to create a separated client for this one.
+type TestTypeList struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []TestType `json:"items"`
+}
+
+type TestTypeStatus struct {
+	Blah string `json:"blah"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/zz_generated.conversion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/zz_generated.conversion.go
new file mode 100644
index 0000000000..d3540f83fb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/zz_generated.conversion.go
@@ -0,0 +1,138 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by conversion-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	unsafe "unsafe"
+
+	conversion "k8s.io/apimachinery/pkg/conversion"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	example3io "k8s.io/code-generator/examples/apiserver/apis/example3.io"
+)
+
+func init() {
+	localSchemeBuilder.Register(RegisterConversions)
+}
+
+// RegisterConversions adds conversion functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*TestType)(nil), (*example3io.TestType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_TestType_To_example3io_TestType(a.(*TestType), b.(*example3io.TestType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*example3io.TestType)(nil), (*TestType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_example3io_TestType_To_v1_TestType(a.(*example3io.TestType), b.(*TestType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*TestTypeList)(nil), (*example3io.TestTypeList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_TestTypeList_To_example3io_TestTypeList(a.(*TestTypeList), b.(*example3io.TestTypeList), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*example3io.TestTypeList)(nil), (*TestTypeList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_example3io_TestTypeList_To_v1_TestTypeList(a.(*example3io.TestTypeList), b.(*TestTypeList), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*TestTypeStatus)(nil), (*example3io.TestTypeStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_TestTypeStatus_To_example3io_TestTypeStatus(a.(*TestTypeStatus), b.(*example3io.TestTypeStatus), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*example3io.TestTypeStatus)(nil), (*TestTypeStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_example3io_TestTypeStatus_To_v1_TestTypeStatus(a.(*example3io.TestTypeStatus), b.(*TestTypeStatus), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+func autoConvert_v1_TestType_To_example3io_TestType(in *TestType, out *example3io.TestType, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_v1_TestTypeStatus_To_example3io_TestTypeStatus(&in.Status, &out.Status, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_v1_TestType_To_example3io_TestType is an autogenerated conversion function.
+func Convert_v1_TestType_To_example3io_TestType(in *TestType, out *example3io.TestType, s conversion.Scope) error {
+	return autoConvert_v1_TestType_To_example3io_TestType(in, out, s)
+}
+
+func autoConvert_example3io_TestType_To_v1_TestType(in *example3io.TestType, out *TestType, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_example3io_TestTypeStatus_To_v1_TestTypeStatus(&in.Status, &out.Status, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_example3io_TestType_To_v1_TestType is an autogenerated conversion function.
+func Convert_example3io_TestType_To_v1_TestType(in *example3io.TestType, out *TestType, s conversion.Scope) error {
+	return autoConvert_example3io_TestType_To_v1_TestType(in, out, s)
+}
+
+func autoConvert_v1_TestTypeList_To_example3io_TestTypeList(in *TestTypeList, out *example3io.TestTypeList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	out.Items = *(*[]example3io.TestType)(unsafe.Pointer(&in.Items))
+	return nil
+}
+
+// Convert_v1_TestTypeList_To_example3io_TestTypeList is an autogenerated conversion function.
+func Convert_v1_TestTypeList_To_example3io_TestTypeList(in *TestTypeList, out *example3io.TestTypeList, s conversion.Scope) error {
+	return autoConvert_v1_TestTypeList_To_example3io_TestTypeList(in, out, s)
+}
+
+func autoConvert_example3io_TestTypeList_To_v1_TestTypeList(in *example3io.TestTypeList, out *TestTypeList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	out.Items = *(*[]TestType)(unsafe.Pointer(&in.Items))
+	return nil
+}
+
+// Convert_example3io_TestTypeList_To_v1_TestTypeList is an autogenerated conversion function.
+func Convert_example3io_TestTypeList_To_v1_TestTypeList(in *example3io.TestTypeList, out *TestTypeList, s conversion.Scope) error {
+	return autoConvert_example3io_TestTypeList_To_v1_TestTypeList(in, out, s)
+}
+
+func autoConvert_v1_TestTypeStatus_To_example3io_TestTypeStatus(in *TestTypeStatus, out *example3io.TestTypeStatus, s conversion.Scope) error {
+	*out = *(*example3io.TestTypeStatus)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_v1_TestTypeStatus_To_example3io_TestTypeStatus is an autogenerated conversion function.
+func Convert_v1_TestTypeStatus_To_example3io_TestTypeStatus(in *TestTypeStatus, out *example3io.TestTypeStatus, s conversion.Scope) error {
+	return autoConvert_v1_TestTypeStatus_To_example3io_TestTypeStatus(in, out, s)
+}
+
+func autoConvert_example3io_TestTypeStatus_To_v1_TestTypeStatus(in *example3io.TestTypeStatus, out *TestTypeStatus, s conversion.Scope) error {
+	*out = *(*TestTypeStatus)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_example3io_TestTypeStatus_To_v1_TestTypeStatus is an autogenerated conversion function.
+func Convert_example3io_TestTypeStatus_To_v1_TestTypeStatus(in *example3io.TestTypeStatus, out *TestTypeStatus, s conversion.Scope) error {
+	return autoConvert_example3io_TestTypeStatus_To_v1_TestTypeStatus(in, out, s)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..d87f706f77
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/zz_generated.deepcopy.go
@@ -0,0 +1,102 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType) DeepCopyInto(out *TestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType.
+func (in *TestType) DeepCopy() *TestType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeList) DeepCopyInto(out *TestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeList.
+func (in *TestTypeList) DeepCopy() *TestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeStatus) DeepCopyInto(out *TestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeStatus.
+func (in *TestTypeStatus) DeepCopy() *TestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/zz_generated.defaults.go
new file mode 100644
index 0000000000..dac177e93b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/zz_generated.model_name.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/zz_generated.model_name.go
new file mode 100644
index 0000000000..e9fddb1c5a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/zz_generated.model_name.go
@@ -0,0 +1,37 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package v1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TestType) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.example3.io.v1.TestType"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TestTypeList) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.example3.io.v1.TestTypeList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TestTypeStatus) OpenAPIModelName() string {
+	return "io.k8s.code-generator.examples.apiserver.apis.example3.io.v1.TestTypeStatus"
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/zz_generated.register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/zz_generated.register.go
new file mode 100644
index 0000000000..b4b5585dc3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/v1/zz_generated.register.go
@@ -0,0 +1,71 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by register-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName specifies the group name used to register the objects.
+const GroupName = "example.dots.apiserver.code-generator.k8s.io"
+
+// GroupVersion specifies the group and the version used to register the objects.
+var GroupVersion = metav1.GroupVersion{Group: GroupName, Version: "v1"}
+
+// SchemeGroupVersion is group version used to register these objects
+//
+// Deprecated: use GroupVersion instead.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	// Deprecated: use Install instead
+	AddToScheme = localSchemeBuilder.AddToScheme
+	Install     = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&TestType{},
+		&TestTypeList{},
+	)
+	// AddToGroupVersion allows the serialization of client types like ListOptions.
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..2a976a9eed
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/apis/example3.io/zz_generated.deepcopy.go
@@ -0,0 +1,102 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package example3
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType) DeepCopyInto(out *TestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType.
+func (in *TestType) DeepCopy() *TestType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeList) DeepCopyInto(out *TestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeList.
+func (in *TestTypeList) DeepCopy() *TestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeStatus) DeepCopyInto(out *TestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeStatus.
+func (in *TestTypeStatus) DeepCopy() *TestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/clientset.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/clientset.go
new file mode 100644
index 0000000000..d835fd8b8d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/clientset.go
@@ -0,0 +1,159 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package versioned
+
+import (
+	fmt "fmt"
+	http "net/http"
+
+	discovery "k8s.io/client-go/discovery"
+	rest "k8s.io/client-go/rest"
+	flowcontrol "k8s.io/client-go/util/flowcontrol"
+	corev1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1"
+	examplev1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1"
+	secondexamplev1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1"
+	thirdexamplev1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1"
+)
+
+type Interface interface {
+	Discovery() discovery.DiscoveryInterfaces
+	CoreV1() corev1.CoreV1Interface
+	ExampleV1() examplev1.ExampleV1Interface
+	SecondExampleV1() secondexamplev1.SecondExampleV1Interface
+	ThirdExampleV1() thirdexamplev1.ThirdExampleV1Interface
+}
+
+// Clientset contains the clients for groups.
+type Clientset struct {
+	*discovery.DiscoveryClient
+	coreV1          *corev1.CoreV1Client
+	exampleV1       *examplev1.ExampleV1Client
+	secondExampleV1 *secondexamplev1.SecondExampleV1Client
+	thirdExampleV1  *thirdexamplev1.ThirdExampleV1Client
+}
+
+// CoreV1 retrieves the CoreV1Client
+func (c *Clientset) CoreV1() corev1.CoreV1Interface {
+	return c.coreV1
+}
+
+// ExampleV1 retrieves the ExampleV1Client
+func (c *Clientset) ExampleV1() examplev1.ExampleV1Interface {
+	return c.exampleV1
+}
+
+// SecondExampleV1 retrieves the SecondExampleV1Client
+func (c *Clientset) SecondExampleV1() secondexamplev1.SecondExampleV1Interface {
+	return c.secondExampleV1
+}
+
+// ThirdExampleV1 retrieves the ThirdExampleV1Client
+func (c *Clientset) ThirdExampleV1() thirdexamplev1.ThirdExampleV1Interface {
+	return c.thirdExampleV1
+}
+
+// Discovery retrieves the DiscoveryClient
+func (c *Clientset) Discovery() discovery.DiscoveryInterfaces {
+	if c == nil {
+		return nil
+	}
+	return c.DiscoveryClient
+}
+
+// NewForConfig creates a new Clientset for the given config.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfig will generate a rate-limiter in configShallowCopy.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*Clientset, error) {
+	configShallowCopy := *c
+
+	if configShallowCopy.UserAgent == "" {
+		configShallowCopy.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	// share the transport between all clients
+	httpClient, err := rest.HTTPClientFor(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewForConfigAndClient(&configShallowCopy, httpClient)
+}
+
+// NewForConfigAndClient creates a new Clientset for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfigAndClient will generate a rate-limiter in configShallowCopy.
+func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset, error) {
+	configShallowCopy := *c
+	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
+		if configShallowCopy.Burst <= 0 {
+			return nil, fmt.Errorf("burst is required to be greater than 0 when RateLimiter is not set and QPS is set to greater than 0")
+		}
+		configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
+	}
+
+	var cs Clientset
+	var err error
+	cs.coreV1, err = corev1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	cs.exampleV1, err = examplev1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	cs.secondExampleV1, err = secondexamplev1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	cs.thirdExampleV1, err = thirdexamplev1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+
+	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	return &cs, nil
+}
+
+// NewForConfigOrDie creates a new Clientset for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *Clientset {
+	cs, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return cs
+}
+
+// New creates a new Clientset for the given RESTClient.
+func New(c rest.Interface) *Clientset {
+	var cs Clientset
+	cs.coreV1 = corev1.New(c)
+	cs.exampleV1 = examplev1.New(c)
+	cs.secondExampleV1 = secondexamplev1.New(c)
+	cs.thirdExampleV1 = thirdexamplev1.New(c)
+
+	cs.DiscoveryClient = discovery.NewDiscoveryClient(c)
+	return &cs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/fake/clientset_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/fake/clientset_generated.go
new file mode 100644
index 0000000000..e40a151eb8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/fake/clientset_generated.go
@@ -0,0 +1,122 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/discovery"
+	fakediscovery "k8s.io/client-go/discovery/fake"
+	"k8s.io/client-go/testing"
+	clientset "k8s.io/code-generator/examples/apiserver/clientset/versioned"
+	corev1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1"
+	fakecorev1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/fake"
+	examplev1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1"
+	fakeexamplev1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/fake"
+	secondexamplev1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1"
+	fakesecondexamplev1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/fake"
+	thirdexamplev1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1"
+	fakethirdexamplev1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/fake"
+)
+
+// NewSimpleClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any field management, validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+func NewSimpleClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewObjectTracker(scheme, codecs.UniversalDecoder())
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{tracker: o}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		var opts metav1.ListOptions
+		if watchAction, ok := action.(testing.WatchActionImpl); ok {
+			opts = watchAction.ListOptions
+		}
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns, opts)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
+// Clientset implements clientset.Interface. Meant to be embedded into a
+// struct to get a default implementation. This makes faking out just the method
+// you want to test easier.
+type Clientset struct {
+	testing.Fake
+	discovery *fakediscovery.FakeDiscovery
+	tracker   testing.ObjectTracker
+}
+
+func (c *Clientset) Discovery() discovery.DiscoveryInterfaces {
+	return c.discovery
+}
+
+func (c *Clientset) Tracker() testing.ObjectTracker {
+	return c.tracker
+}
+
+// IsWatchListSemanticsUnSupported informs the reflector that this client
+// doesn't support WatchList semantics.
+//
+// This is a synthetic method whose sole purpose is to satisfy the optional
+// interface check performed by the reflector.
+// Returning true signals that WatchList can NOT be used.
+// No additional logic is implemented here.
+func (c *Clientset) IsWatchListSemanticsUnSupported() bool {
+	return true
+}
+
+var (
+	_ clientset.Interface = &Clientset{}
+	_ testing.FakeClient  = &Clientset{}
+)
+
+// CoreV1 retrieves the CoreV1Client
+func (c *Clientset) CoreV1() corev1.CoreV1Interface {
+	return &fakecorev1.FakeCoreV1{Fake: &c.Fake}
+}
+
+// ExampleV1 retrieves the ExampleV1Client
+func (c *Clientset) ExampleV1() examplev1.ExampleV1Interface {
+	return &fakeexamplev1.FakeExampleV1{Fake: &c.Fake}
+}
+
+// SecondExampleV1 retrieves the SecondExampleV1Client
+func (c *Clientset) SecondExampleV1() secondexamplev1.SecondExampleV1Interface {
+	return &fakesecondexamplev1.FakeSecondExampleV1{Fake: &c.Fake}
+}
+
+// ThirdExampleV1 retrieves the ThirdExampleV1Client
+func (c *Clientset) ThirdExampleV1() thirdexamplev1.ThirdExampleV1Interface {
+	return &fakethirdexamplev1.FakeThirdExampleV1{Fake: &c.Fake}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/fake/doc.go
new file mode 100644
index 0000000000..9b99e71670
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated fake clientset.
+package fake
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/fake/register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/fake/register.go
new file mode 100644
index 0000000000..c2a38a9fc8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/fake/register.go
@@ -0,0 +1,62 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	corev1 "k8s.io/code-generator/examples/apiserver/apis/core/v1"
+	examplev1 "k8s.io/code-generator/examples/apiserver/apis/example/v1"
+	secondexamplev1 "k8s.io/code-generator/examples/apiserver/apis/example2/v1"
+	thirdexamplev1 "k8s.io/code-generator/examples/apiserver/apis/example3.io/v1"
+)
+
+var scheme = runtime.NewScheme()
+var codecs = serializer.NewCodecFactory(scheme)
+
+var localSchemeBuilder = runtime.SchemeBuilder{
+	corev1.AddToScheme,
+	examplev1.AddToScheme,
+	secondexamplev1.AddToScheme,
+	thirdexamplev1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
+//
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(scheme))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/scheme/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/scheme/doc.go
new file mode 100644
index 0000000000..7dc3756168
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/scheme/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package contains the scheme of the automatically generated clientset.
+package scheme
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/scheme/register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/scheme/register.go
new file mode 100644
index 0000000000..1ea712906c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/scheme/register.go
@@ -0,0 +1,62 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package scheme
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	corev1 "k8s.io/code-generator/examples/apiserver/apis/core/v1"
+	examplev1 "k8s.io/code-generator/examples/apiserver/apis/example/v1"
+	secondexamplev1 "k8s.io/code-generator/examples/apiserver/apis/example2/v1"
+	thirdexamplev1 "k8s.io/code-generator/examples/apiserver/apis/example3.io/v1"
+)
+
+var Scheme = runtime.NewScheme()
+var Codecs = serializer.NewCodecFactory(Scheme)
+var ParameterCodec = runtime.NewParameterCodec(Scheme)
+var localSchemeBuilder = runtime.SchemeBuilder{
+	corev1.AddToScheme,
+	examplev1.AddToScheme,
+	secondexamplev1.AddToScheme,
+	thirdexamplev1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
+//
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(Scheme))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/core_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/core_client.go
new file mode 100644
index 0000000000..3fa7460aa4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/core_client.go
@@ -0,0 +1,101 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	http "net/http"
+
+	rest "k8s.io/client-go/rest"
+	corev1 "k8s.io/code-generator/examples/apiserver/apis/core/v1"
+	scheme "k8s.io/code-generator/examples/apiserver/clientset/versioned/scheme"
+)
+
+type CoreV1Interface interface {
+	RESTClient() rest.Interface
+	TestTypesGetter
+}
+
+// CoreV1Client is used to interact with features provided by the  group.
+type CoreV1Client struct {
+	restClient rest.Interface
+}
+
+func (c *CoreV1Client) TestTypes(namespace string) TestTypeInterface {
+	return newTestTypes(c, namespace)
+}
+
+// NewForConfig creates a new CoreV1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*CoreV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new CoreV1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*CoreV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &CoreV1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new CoreV1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *CoreV1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new CoreV1Client for the given RESTClient.
+func New(c rest.Interface) *CoreV1Client {
+	return &CoreV1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := corev1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/api"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *CoreV1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/doc.go
new file mode 100644
index 0000000000..3af5d054f1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/fake/doc.go
new file mode 100644
index 0000000000..16f4439906
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/fake/fake_core_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/fake/fake_core_client.go
new file mode 100644
index 0000000000..d7e352089c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/fake/fake_core_client.go
@@ -0,0 +1,40 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1"
+)
+
+type FakeCoreV1 struct {
+	*testing.Fake
+}
+
+func (c *FakeCoreV1) TestTypes(namespace string) v1.TestTypeInterface {
+	return newFakeTestTypes(c, namespace)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeCoreV1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/fake/fake_testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/fake/fake_testtype.go
new file mode 100644
index 0000000000..88d3c42e7d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/fake/fake_testtype.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	gentype "k8s.io/client-go/gentype"
+	v1 "k8s.io/code-generator/examples/apiserver/apis/core/v1"
+	corev1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1"
+)
+
+// fakeTestTypes implements TestTypeInterface
+type fakeTestTypes struct {
+	*gentype.FakeClientWithList[*v1.TestType, *v1.TestTypeList]
+	Fake *FakeCoreV1
+}
+
+func newFakeTestTypes(fake *FakeCoreV1, namespace string) corev1.TestTypeInterface {
+	return &fakeTestTypes{
+		gentype.NewFakeClientWithList[*v1.TestType, *v1.TestTypeList](
+			fake.Fake,
+			namespace,
+			v1.SchemeGroupVersion.WithResource("testtypes"),
+			v1.SchemeGroupVersion.WithKind("TestType"),
+			func() *v1.TestType { return &v1.TestType{} },
+			func() *v1.TestTypeList { return &v1.TestTypeList{} },
+			func(dst, src *v1.TestTypeList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.TestTypeList) []*v1.TestType { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.TestTypeList, items []*v1.TestType) { list.Items = gentype.FromPointerSlice(items) },
+		),
+		fake,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/generated_expansion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/generated_expansion.go
new file mode 100644
index 0000000000..d513810d0d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+type TestTypeExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/testtype.go
new file mode 100644
index 0000000000..85a6d1e54a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/core/v1/testtype.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	corev1 "k8s.io/code-generator/examples/apiserver/apis/core/v1"
+	scheme "k8s.io/code-generator/examples/apiserver/clientset/versioned/scheme"
+)
+
+// TestTypesGetter has a method to return a TestTypeInterface.
+// A group's client should implement this interface.
+type TestTypesGetter interface {
+	TestTypes(namespace string) TestTypeInterface
+}
+
+// TestTypeInterface has methods to work with TestType resources.
+type TestTypeInterface interface {
+	Create(ctx context.Context, testType *corev1.TestType, opts metav1.CreateOptions) (*corev1.TestType, error)
+	Update(ctx context.Context, testType *corev1.TestType, opts metav1.UpdateOptions) (*corev1.TestType, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, testType *corev1.TestType, opts metav1.UpdateOptions) (*corev1.TestType, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*corev1.TestType, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*corev1.TestTypeList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *corev1.TestType, err error)
+	TestTypeExpansion
+}
+
+// testTypes implements TestTypeInterface
+type testTypes struct {
+	*gentype.ClientWithList[*corev1.TestType, *corev1.TestTypeList]
+}
+
+// newTestTypes returns a TestTypes
+func newTestTypes(c *CoreV1Client, namespace string) *testTypes {
+	return &testTypes{
+		gentype.NewClientWithList[*corev1.TestType, *corev1.TestTypeList](
+			"testtypes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *corev1.TestType { return &corev1.TestType{} },
+			func() *corev1.TestTypeList { return &corev1.TestTypeList{} },
+		),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/doc.go
new file mode 100644
index 0000000000..3af5d054f1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/example_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/example_client.go
new file mode 100644
index 0000000000..14bf5802f7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/example_client.go
@@ -0,0 +1,101 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	http "net/http"
+
+	rest "k8s.io/client-go/rest"
+	examplev1 "k8s.io/code-generator/examples/apiserver/apis/example/v1"
+	scheme "k8s.io/code-generator/examples/apiserver/clientset/versioned/scheme"
+)
+
+type ExampleV1Interface interface {
+	RESTClient() rest.Interface
+	TestTypesGetter
+}
+
+// ExampleV1Client is used to interact with features provided by the example.apiserver.code-generator.k8s.io group.
+type ExampleV1Client struct {
+	restClient rest.Interface
+}
+
+func (c *ExampleV1Client) TestTypes(namespace string) TestTypeInterface {
+	return newTestTypes(c, namespace)
+}
+
+// NewForConfig creates a new ExampleV1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ExampleV1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &ExampleV1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new ExampleV1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ExampleV1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new ExampleV1Client for the given RESTClient.
+func New(c rest.Interface) *ExampleV1Client {
+	return &ExampleV1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := examplev1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ExampleV1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/fake/doc.go
new file mode 100644
index 0000000000..16f4439906
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/fake/fake_example_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/fake/fake_example_client.go
new file mode 100644
index 0000000000..003ff79171
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/fake/fake_example_client.go
@@ -0,0 +1,40 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1"
+)
+
+type FakeExampleV1 struct {
+	*testing.Fake
+}
+
+func (c *FakeExampleV1) TestTypes(namespace string) v1.TestTypeInterface {
+	return newFakeTestTypes(c, namespace)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeExampleV1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/fake/fake_testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/fake/fake_testtype.go
new file mode 100644
index 0000000000..643182934d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/fake/fake_testtype.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	gentype "k8s.io/client-go/gentype"
+	v1 "k8s.io/code-generator/examples/apiserver/apis/example/v1"
+	examplev1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1"
+)
+
+// fakeTestTypes implements TestTypeInterface
+type fakeTestTypes struct {
+	*gentype.FakeClientWithList[*v1.TestType, *v1.TestTypeList]
+	Fake *FakeExampleV1
+}
+
+func newFakeTestTypes(fake *FakeExampleV1, namespace string) examplev1.TestTypeInterface {
+	return &fakeTestTypes{
+		gentype.NewFakeClientWithList[*v1.TestType, *v1.TestTypeList](
+			fake.Fake,
+			namespace,
+			v1.SchemeGroupVersion.WithResource("testtypes"),
+			v1.SchemeGroupVersion.WithKind("TestType"),
+			func() *v1.TestType { return &v1.TestType{} },
+			func() *v1.TestTypeList { return &v1.TestTypeList{} },
+			func(dst, src *v1.TestTypeList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.TestTypeList) []*v1.TestType { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.TestTypeList, items []*v1.TestType) { list.Items = gentype.FromPointerSlice(items) },
+		),
+		fake,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/generated_expansion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/generated_expansion.go
new file mode 100644
index 0000000000..d513810d0d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+type TestTypeExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/testtype.go
new file mode 100644
index 0000000000..2aa8d3bb2b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example/v1/testtype.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	examplev1 "k8s.io/code-generator/examples/apiserver/apis/example/v1"
+	scheme "k8s.io/code-generator/examples/apiserver/clientset/versioned/scheme"
+)
+
+// TestTypesGetter has a method to return a TestTypeInterface.
+// A group's client should implement this interface.
+type TestTypesGetter interface {
+	TestTypes(namespace string) TestTypeInterface
+}
+
+// TestTypeInterface has methods to work with TestType resources.
+type TestTypeInterface interface {
+	Create(ctx context.Context, testType *examplev1.TestType, opts metav1.CreateOptions) (*examplev1.TestType, error)
+	Update(ctx context.Context, testType *examplev1.TestType, opts metav1.UpdateOptions) (*examplev1.TestType, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, testType *examplev1.TestType, opts metav1.UpdateOptions) (*examplev1.TestType, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*examplev1.TestType, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*examplev1.TestTypeList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *examplev1.TestType, err error)
+	TestTypeExpansion
+}
+
+// testTypes implements TestTypeInterface
+type testTypes struct {
+	*gentype.ClientWithList[*examplev1.TestType, *examplev1.TestTypeList]
+}
+
+// newTestTypes returns a TestTypes
+func newTestTypes(c *ExampleV1Client, namespace string) *testTypes {
+	return &testTypes{
+		gentype.NewClientWithList[*examplev1.TestType, *examplev1.TestTypeList](
+			"testtypes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *examplev1.TestType { return &examplev1.TestType{} },
+			func() *examplev1.TestTypeList { return &examplev1.TestTypeList{} },
+		),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/doc.go
new file mode 100644
index 0000000000..3af5d054f1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/example2_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/example2_client.go
new file mode 100644
index 0000000000..eed5feff9e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/example2_client.go
@@ -0,0 +1,101 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	http "net/http"
+
+	rest "k8s.io/client-go/rest"
+	example2v1 "k8s.io/code-generator/examples/apiserver/apis/example2/v1"
+	scheme "k8s.io/code-generator/examples/apiserver/clientset/versioned/scheme"
+)
+
+type SecondExampleV1Interface interface {
+	RESTClient() rest.Interface
+	TestTypesGetter
+}
+
+// SecondExampleV1Client is used to interact with features provided by the example.test.apiserver.code-generator.k8s.io group.
+type SecondExampleV1Client struct {
+	restClient rest.Interface
+}
+
+func (c *SecondExampleV1Client) TestTypes(namespace string) TestTypeInterface {
+	return newTestTypes(c, namespace)
+}
+
+// NewForConfig creates a new SecondExampleV1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*SecondExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new SecondExampleV1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*SecondExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &SecondExampleV1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new SecondExampleV1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *SecondExampleV1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new SecondExampleV1Client for the given RESTClient.
+func New(c rest.Interface) *SecondExampleV1Client {
+	return &SecondExampleV1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := example2v1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *SecondExampleV1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/fake/doc.go
new file mode 100644
index 0000000000..16f4439906
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/fake/fake_example2_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/fake/fake_example2_client.go
new file mode 100644
index 0000000000..44a41cd602
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/fake/fake_example2_client.go
@@ -0,0 +1,40 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1"
+)
+
+type FakeSecondExampleV1 struct {
+	*testing.Fake
+}
+
+func (c *FakeSecondExampleV1) TestTypes(namespace string) v1.TestTypeInterface {
+	return newFakeTestTypes(c, namespace)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeSecondExampleV1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/fake/fake_testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/fake/fake_testtype.go
new file mode 100644
index 0000000000..e02f80702a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/fake/fake_testtype.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	gentype "k8s.io/client-go/gentype"
+	v1 "k8s.io/code-generator/examples/apiserver/apis/example2/v1"
+	example2v1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1"
+)
+
+// fakeTestTypes implements TestTypeInterface
+type fakeTestTypes struct {
+	*gentype.FakeClientWithList[*v1.TestType, *v1.TestTypeList]
+	Fake *FakeSecondExampleV1
+}
+
+func newFakeTestTypes(fake *FakeSecondExampleV1, namespace string) example2v1.TestTypeInterface {
+	return &fakeTestTypes{
+		gentype.NewFakeClientWithList[*v1.TestType, *v1.TestTypeList](
+			fake.Fake,
+			namespace,
+			v1.SchemeGroupVersion.WithResource("testtypes"),
+			v1.SchemeGroupVersion.WithKind("TestType"),
+			func() *v1.TestType { return &v1.TestType{} },
+			func() *v1.TestTypeList { return &v1.TestTypeList{} },
+			func(dst, src *v1.TestTypeList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.TestTypeList) []*v1.TestType { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.TestTypeList, items []*v1.TestType) { list.Items = gentype.FromPointerSlice(items) },
+		),
+		fake,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/generated_expansion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/generated_expansion.go
new file mode 100644
index 0000000000..d513810d0d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+type TestTypeExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/testtype.go
new file mode 100644
index 0000000000..ce7a9bd13c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example2/v1/testtype.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	example2v1 "k8s.io/code-generator/examples/apiserver/apis/example2/v1"
+	scheme "k8s.io/code-generator/examples/apiserver/clientset/versioned/scheme"
+)
+
+// TestTypesGetter has a method to return a TestTypeInterface.
+// A group's client should implement this interface.
+type TestTypesGetter interface {
+	TestTypes(namespace string) TestTypeInterface
+}
+
+// TestTypeInterface has methods to work with TestType resources.
+type TestTypeInterface interface {
+	Create(ctx context.Context, testType *example2v1.TestType, opts metav1.CreateOptions) (*example2v1.TestType, error)
+	Update(ctx context.Context, testType *example2v1.TestType, opts metav1.UpdateOptions) (*example2v1.TestType, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, testType *example2v1.TestType, opts metav1.UpdateOptions) (*example2v1.TestType, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*example2v1.TestType, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*example2v1.TestTypeList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *example2v1.TestType, err error)
+	TestTypeExpansion
+}
+
+// testTypes implements TestTypeInterface
+type testTypes struct {
+	*gentype.ClientWithList[*example2v1.TestType, *example2v1.TestTypeList]
+}
+
+// newTestTypes returns a TestTypes
+func newTestTypes(c *SecondExampleV1Client, namespace string) *testTypes {
+	return &testTypes{
+		gentype.NewClientWithList[*example2v1.TestType, *example2v1.TestTypeList](
+			"testtypes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *example2v1.TestType { return &example2v1.TestType{} },
+			func() *example2v1.TestTypeList { return &example2v1.TestTypeList{} },
+		),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/doc.go
new file mode 100644
index 0000000000..3af5d054f1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/example3.io_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/example3.io_client.go
new file mode 100644
index 0000000000..a11e72add8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/example3.io_client.go
@@ -0,0 +1,101 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	http "net/http"
+
+	rest "k8s.io/client-go/rest"
+	example3iov1 "k8s.io/code-generator/examples/apiserver/apis/example3.io/v1"
+	scheme "k8s.io/code-generator/examples/apiserver/clientset/versioned/scheme"
+)
+
+type ThirdExampleV1Interface interface {
+	RESTClient() rest.Interface
+	TestTypesGetter
+}
+
+// ThirdExampleV1Client is used to interact with features provided by the example.dots.apiserver.code-generator.k8s.io group.
+type ThirdExampleV1Client struct {
+	restClient rest.Interface
+}
+
+func (c *ThirdExampleV1Client) TestTypes(namespace string) TestTypeInterface {
+	return newTestTypes(c, namespace)
+}
+
+// NewForConfig creates a new ThirdExampleV1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ThirdExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ThirdExampleV1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ThirdExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &ThirdExampleV1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new ThirdExampleV1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ThirdExampleV1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new ThirdExampleV1Client for the given RESTClient.
+func New(c rest.Interface) *ThirdExampleV1Client {
+	return &ThirdExampleV1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := example3iov1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ThirdExampleV1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/fake/doc.go
new file mode 100644
index 0000000000..16f4439906
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/fake/fake_example3.io_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/fake/fake_example3.io_client.go
new file mode 100644
index 0000000000..221f4acaaa
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/fake/fake_example3.io_client.go
@@ -0,0 +1,40 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1"
+)
+
+type FakeThirdExampleV1 struct {
+	*testing.Fake
+}
+
+func (c *FakeThirdExampleV1) TestTypes(namespace string) v1.TestTypeInterface {
+	return newFakeTestTypes(c, namespace)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeThirdExampleV1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/fake/fake_testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/fake/fake_testtype.go
new file mode 100644
index 0000000000..275315966a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/fake/fake_testtype.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	gentype "k8s.io/client-go/gentype"
+	v1 "k8s.io/code-generator/examples/apiserver/apis/example3.io/v1"
+	example3iov1 "k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1"
+)
+
+// fakeTestTypes implements TestTypeInterface
+type fakeTestTypes struct {
+	*gentype.FakeClientWithList[*v1.TestType, *v1.TestTypeList]
+	Fake *FakeThirdExampleV1
+}
+
+func newFakeTestTypes(fake *FakeThirdExampleV1, namespace string) example3iov1.TestTypeInterface {
+	return &fakeTestTypes{
+		gentype.NewFakeClientWithList[*v1.TestType, *v1.TestTypeList](
+			fake.Fake,
+			namespace,
+			v1.SchemeGroupVersion.WithResource("testtypes"),
+			v1.SchemeGroupVersion.WithKind("TestType"),
+			func() *v1.TestType { return &v1.TestType{} },
+			func() *v1.TestTypeList { return &v1.TestTypeList{} },
+			func(dst, src *v1.TestTypeList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.TestTypeList) []*v1.TestType { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.TestTypeList, items []*v1.TestType) { list.Items = gentype.FromPointerSlice(items) },
+		),
+		fake,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/generated_expansion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/generated_expansion.go
new file mode 100644
index 0000000000..d513810d0d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+type TestTypeExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/testtype.go
new file mode 100644
index 0000000000..408e9f1dba
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/clientset/versioned/typed/example3.io/v1/testtype.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	example3iov1 "k8s.io/code-generator/examples/apiserver/apis/example3.io/v1"
+	scheme "k8s.io/code-generator/examples/apiserver/clientset/versioned/scheme"
+)
+
+// TestTypesGetter has a method to return a TestTypeInterface.
+// A group's client should implement this interface.
+type TestTypesGetter interface {
+	TestTypes(namespace string) TestTypeInterface
+}
+
+// TestTypeInterface has methods to work with TestType resources.
+type TestTypeInterface interface {
+	Create(ctx context.Context, testType *example3iov1.TestType, opts metav1.CreateOptions) (*example3iov1.TestType, error)
+	Update(ctx context.Context, testType *example3iov1.TestType, opts metav1.UpdateOptions) (*example3iov1.TestType, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, testType *example3iov1.TestType, opts metav1.UpdateOptions) (*example3iov1.TestType, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*example3iov1.TestType, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*example3iov1.TestTypeList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *example3iov1.TestType, err error)
+	TestTypeExpansion
+}
+
+// testTypes implements TestTypeInterface
+type testTypes struct {
+	*gentype.ClientWithList[*example3iov1.TestType, *example3iov1.TestTypeList]
+}
+
+// newTestTypes returns a TestTypes
+func newTestTypes(c *ThirdExampleV1Client, namespace string) *testTypes {
+	return &testTypes{
+		gentype.NewClientWithList[*example3iov1.TestType, *example3iov1.TestTypeList](
+			"testtypes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *example3iov1.TestType { return &example3iov1.TestType{} },
+			func() *example3iov1.TestTypeList { return &example3iov1.TestTypeList{} },
+		),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/core/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/core/interface.go
new file mode 100644
index 0000000000..56a1bc41a6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/core/interface.go
@@ -0,0 +1,46 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package core
+
+import (
+	v1 "k8s.io/code-generator/examples/apiserver/informers/externalversions/core/v1"
+	internalinterfaces "k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1 provides access to shared informers for resources in V1.
+	V1() v1.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1 returns a new v1.Interface.
+func (g *group) V1() v1.Interface {
+	return v1.New(g.factory, g.namespace, g.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/core/v1/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/core/v1/interface.go
new file mode 100644
index 0000000000..3d3c24444f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/core/v1/interface.go
@@ -0,0 +1,45 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	internalinterfaces "k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// TestTypes returns a TestTypeInformer.
+	TestTypes() TypedTestTypeInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// TestTypes returns a TypedTestTypeInformer.
+func (v *version) TestTypes() TypedTestTypeInformer {
+	return &testTypeInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/core/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/core/v1/testtype.go
new file mode 100644
index 0000000000..038a32dab1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/core/v1/testtype.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	apiscorev1 "k8s.io/code-generator/examples/apiserver/apis/core/v1"
+	versioned "k8s.io/code-generator/examples/apiserver/clientset/versioned"
+	internalinterfaces "k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces"
+	corev1 "k8s.io/code-generator/examples/apiserver/listers/core/v1"
+)
+
+// TestTypeInformer provides access to a shared informer and lister for
+// TestTypes. Prefer using the type-safe variant (see [TypedTestTypeInformer]).
+type TestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() corev1.TestTypeLister
+}
+
+// TypedTestTypeInformer provides access to a shared informer and lister for
+// TestTypes, including the type-safe TypedInformer variant.
+// It is a superset of TestTypeInformer.
+type TypedTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() TestTypeIndexInformer
+	Lister() corev1.TestTypeLister
+}
+
+// TestTypeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type TestTypeIndexInformer cache.TypedSharedIndexInformer[*apiscorev1.TestType]
+
+// TestTypeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for TestType.
+type TestTypeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiscorev1.TestType]
+
+// TestTypeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for TestType.
+type TestTypeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiscorev1.TestType]
+
+// TestTypeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for TestType.
+type TestTypeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiscorev1.TestType]
+
+// TestTypeIndexers is a specialization of [cache.TypedIndexers] for TestType.
+type TestTypeIndexers = cache.TypedIndexers[*apiscorev1.TestType]
+
+// DeletedTestType is a specialization of [cache.DeletedObject] for TestType.
+type DeletedTestType = cache.DeletedObject[*apiscorev1.TestType]
+
+type testTypeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformer]).
+func NewTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredTestTypeInformer]).
+func NewFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformerWithOptions]).
+func NewTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) TestTypeIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "testtypes"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apiscorev1.TestType](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.CoreV1().TestTypes(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.CoreV1().TestTypes(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.CoreV1().TestTypes(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.CoreV1().TestTypes(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apiscorev1.TestType{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *testTypeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *testTypeInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *testTypeInformer) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiscorev1.TestType](f.factory.InformerFor(&apiscorev1.TestType{}, f.defaultInformer))
+}
+
+func (f *testTypeInformer) Lister() corev1.TestTypeLister {
+	return corev1.NewTestTypeLister(f.Informer().GetIndexer())
+}
+
+// ToTypedTestTypeInformer converts an untyped informer into a TypedTestTypeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TypedTestTypeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedTestTypeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedTestTypeInformer(informer TestTypeInformer) TypedTestTypeInformer {
+	if informer, ok := informer.(TypedTestTypeInformer); ok {
+		return informer
+	}
+	return &testTypeTypedInformerAdapter{informer}
+}
+
+type testTypeTypedInformerAdapter struct {
+	TestTypeInformer
+}
+
+func (a *testTypeTypedInformerAdapter) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiscorev1.TestType](a.Informer())
+}
+
+// ToTestTypeIndexInformer converts an untyped informer into a TestTypeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TestTypeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a TestTypeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTestTypeIndexInformer(informer cache.SharedIndexInformer) TestTypeIndexInformer {
+	if informer, ok := informer.(TestTypeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiscorev1.TestType](informer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example/interface.go
new file mode 100644
index 0000000000..33dc89d5f8
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example/interface.go
@@ -0,0 +1,46 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package example
+
+import (
+	v1 "k8s.io/code-generator/examples/apiserver/informers/externalversions/example/v1"
+	internalinterfaces "k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1 provides access to shared informers for resources in V1.
+	V1() v1.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1 returns a new v1.Interface.
+func (g *group) V1() v1.Interface {
+	return v1.New(g.factory, g.namespace, g.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example/v1/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example/v1/interface.go
new file mode 100644
index 0000000000..3d3c24444f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example/v1/interface.go
@@ -0,0 +1,45 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	internalinterfaces "k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// TestTypes returns a TestTypeInformer.
+	TestTypes() TypedTestTypeInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// TestTypes returns a TypedTestTypeInformer.
+func (v *version) TestTypes() TypedTestTypeInformer {
+	return &testTypeInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example/v1/testtype.go
new file mode 100644
index 0000000000..101c71b221
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example/v1/testtype.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	apisexamplev1 "k8s.io/code-generator/examples/apiserver/apis/example/v1"
+	versioned "k8s.io/code-generator/examples/apiserver/clientset/versioned"
+	internalinterfaces "k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces"
+	examplev1 "k8s.io/code-generator/examples/apiserver/listers/example/v1"
+)
+
+// TestTypeInformer provides access to a shared informer and lister for
+// TestTypes. Prefer using the type-safe variant (see [TypedTestTypeInformer]).
+type TestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() examplev1.TestTypeLister
+}
+
+// TypedTestTypeInformer provides access to a shared informer and lister for
+// TestTypes, including the type-safe TypedInformer variant.
+// It is a superset of TestTypeInformer.
+type TypedTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() TestTypeIndexInformer
+	Lister() examplev1.TestTypeLister
+}
+
+// TestTypeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type TestTypeIndexInformer cache.TypedSharedIndexInformer[*apisexamplev1.TestType]
+
+// TestTypeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for TestType.
+type TestTypeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apisexamplev1.TestType]
+
+// TestTypeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for TestType.
+type TestTypeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apisexamplev1.TestType]
+
+// TestTypeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for TestType.
+type TestTypeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apisexamplev1.TestType]
+
+// TestTypeIndexers is a specialization of [cache.TypedIndexers] for TestType.
+type TestTypeIndexers = cache.TypedIndexers[*apisexamplev1.TestType]
+
+// DeletedTestType is a specialization of [cache.DeletedObject] for TestType.
+type DeletedTestType = cache.DeletedObject[*apisexamplev1.TestType]
+
+type testTypeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformer]).
+func NewTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredTestTypeInformer]).
+func NewFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformerWithOptions]).
+func NewTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) TestTypeIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "example.apiserver.code-generator.k8s.io", Version: "v1", Resource: "testtypes"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apisexamplev1.TestType{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *testTypeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *testTypeInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *testTypeInformer) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](f.factory.InformerFor(&apisexamplev1.TestType{}, f.defaultInformer))
+}
+
+func (f *testTypeInformer) Lister() examplev1.TestTypeLister {
+	return examplev1.NewTestTypeLister(f.Informer().GetIndexer())
+}
+
+// ToTypedTestTypeInformer converts an untyped informer into a TypedTestTypeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TypedTestTypeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedTestTypeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedTestTypeInformer(informer TestTypeInformer) TypedTestTypeInformer {
+	if informer, ok := informer.(TypedTestTypeInformer); ok {
+		return informer
+	}
+	return &testTypeTypedInformerAdapter{informer}
+}
+
+type testTypeTypedInformerAdapter struct {
+	TestTypeInformer
+}
+
+func (a *testTypeTypedInformerAdapter) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](a.Informer())
+}
+
+// ToTestTypeIndexInformer converts an untyped informer into a TestTypeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TestTypeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a TestTypeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTestTypeIndexInformer(informer cache.SharedIndexInformer) TestTypeIndexInformer {
+	if informer, ok := informer.(TestTypeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](informer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example2/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example2/interface.go
new file mode 100644
index 0000000000..4e68f06231
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example2/interface.go
@@ -0,0 +1,46 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package example2
+
+import (
+	v1 "k8s.io/code-generator/examples/apiserver/informers/externalversions/example2/v1"
+	internalinterfaces "k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1 provides access to shared informers for resources in V1.
+	V1() v1.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1 returns a new v1.Interface.
+func (g *group) V1() v1.Interface {
+	return v1.New(g.factory, g.namespace, g.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example2/v1/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example2/v1/interface.go
new file mode 100644
index 0000000000..3d3c24444f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example2/v1/interface.go
@@ -0,0 +1,45 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	internalinterfaces "k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// TestTypes returns a TestTypeInformer.
+	TestTypes() TypedTestTypeInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// TestTypes returns a TypedTestTypeInformer.
+func (v *version) TestTypes() TypedTestTypeInformer {
+	return &testTypeInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example2/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example2/v1/testtype.go
new file mode 100644
index 0000000000..a50fdc3aa2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example2/v1/testtype.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	apisexample2v1 "k8s.io/code-generator/examples/apiserver/apis/example2/v1"
+	versioned "k8s.io/code-generator/examples/apiserver/clientset/versioned"
+	internalinterfaces "k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces"
+	example2v1 "k8s.io/code-generator/examples/apiserver/listers/example2/v1"
+)
+
+// TestTypeInformer provides access to a shared informer and lister for
+// TestTypes. Prefer using the type-safe variant (see [TypedTestTypeInformer]).
+type TestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() example2v1.TestTypeLister
+}
+
+// TypedTestTypeInformer provides access to a shared informer and lister for
+// TestTypes, including the type-safe TypedInformer variant.
+// It is a superset of TestTypeInformer.
+type TypedTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() TestTypeIndexInformer
+	Lister() example2v1.TestTypeLister
+}
+
+// TestTypeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type TestTypeIndexInformer cache.TypedSharedIndexInformer[*apisexample2v1.TestType]
+
+// TestTypeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for TestType.
+type TestTypeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apisexample2v1.TestType]
+
+// TestTypeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for TestType.
+type TestTypeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apisexample2v1.TestType]
+
+// TestTypeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for TestType.
+type TestTypeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apisexample2v1.TestType]
+
+// TestTypeIndexers is a specialization of [cache.TypedIndexers] for TestType.
+type TestTypeIndexers = cache.TypedIndexers[*apisexample2v1.TestType]
+
+// DeletedTestType is a specialization of [cache.DeletedObject] for TestType.
+type DeletedTestType = cache.DeletedObject[*apisexample2v1.TestType]
+
+type testTypeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformer]).
+func NewTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredTestTypeInformer]).
+func NewFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformerWithOptions]).
+func NewTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) TestTypeIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "example.test.apiserver.code-generator.k8s.io", Version: "v1", Resource: "testtypes"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apisexample2v1.TestType](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SecondExampleV1().TestTypes(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SecondExampleV1().TestTypes(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SecondExampleV1().TestTypes(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SecondExampleV1().TestTypes(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apisexample2v1.TestType{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *testTypeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *testTypeInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *testTypeInformer) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexample2v1.TestType](f.factory.InformerFor(&apisexample2v1.TestType{}, f.defaultInformer))
+}
+
+func (f *testTypeInformer) Lister() example2v1.TestTypeLister {
+	return example2v1.NewTestTypeLister(f.Informer().GetIndexer())
+}
+
+// ToTypedTestTypeInformer converts an untyped informer into a TypedTestTypeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TypedTestTypeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedTestTypeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedTestTypeInformer(informer TestTypeInformer) TypedTestTypeInformer {
+	if informer, ok := informer.(TypedTestTypeInformer); ok {
+		return informer
+	}
+	return &testTypeTypedInformerAdapter{informer}
+}
+
+type testTypeTypedInformerAdapter struct {
+	TestTypeInformer
+}
+
+func (a *testTypeTypedInformerAdapter) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexample2v1.TestType](a.Informer())
+}
+
+// ToTestTypeIndexInformer converts an untyped informer into a TestTypeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TestTypeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a TestTypeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTestTypeIndexInformer(informer cache.SharedIndexInformer) TestTypeIndexInformer {
+	if informer, ok := informer.(TestTypeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apisexample2v1.TestType](informer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example3.io/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example3.io/interface.go
new file mode 100644
index 0000000000..b00a58a806
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example3.io/interface.go
@@ -0,0 +1,46 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package example3
+
+import (
+	v1 "k8s.io/code-generator/examples/apiserver/informers/externalversions/example3.io/v1"
+	internalinterfaces "k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1 provides access to shared informers for resources in V1.
+	V1() v1.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1 returns a new v1.Interface.
+func (g *group) V1() v1.Interface {
+	return v1.New(g.factory, g.namespace, g.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example3.io/v1/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example3.io/v1/interface.go
new file mode 100644
index 0000000000..3d3c24444f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example3.io/v1/interface.go
@@ -0,0 +1,45 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	internalinterfaces "k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// TestTypes returns a TestTypeInformer.
+	TestTypes() TypedTestTypeInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// TestTypes returns a TypedTestTypeInformer.
+func (v *version) TestTypes() TypedTestTypeInformer {
+	return &testTypeInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example3.io/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example3.io/v1/testtype.go
new file mode 100644
index 0000000000..680cc84c61
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/example3.io/v1/testtype.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	apisexample3iov1 "k8s.io/code-generator/examples/apiserver/apis/example3.io/v1"
+	versioned "k8s.io/code-generator/examples/apiserver/clientset/versioned"
+	internalinterfaces "k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces"
+	example3iov1 "k8s.io/code-generator/examples/apiserver/listers/example3.io/v1"
+)
+
+// TestTypeInformer provides access to a shared informer and lister for
+// TestTypes. Prefer using the type-safe variant (see [TypedTestTypeInformer]).
+type TestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() example3iov1.TestTypeLister
+}
+
+// TypedTestTypeInformer provides access to a shared informer and lister for
+// TestTypes, including the type-safe TypedInformer variant.
+// It is a superset of TestTypeInformer.
+type TypedTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() TestTypeIndexInformer
+	Lister() example3iov1.TestTypeLister
+}
+
+// TestTypeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type TestTypeIndexInformer cache.TypedSharedIndexInformer[*apisexample3iov1.TestType]
+
+// TestTypeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for TestType.
+type TestTypeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apisexample3iov1.TestType]
+
+// TestTypeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for TestType.
+type TestTypeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apisexample3iov1.TestType]
+
+// TestTypeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for TestType.
+type TestTypeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apisexample3iov1.TestType]
+
+// TestTypeIndexers is a specialization of [cache.TypedIndexers] for TestType.
+type TestTypeIndexers = cache.TypedIndexers[*apisexample3iov1.TestType]
+
+// DeletedTestType is a specialization of [cache.DeletedObject] for TestType.
+type DeletedTestType = cache.DeletedObject[*apisexample3iov1.TestType]
+
+type testTypeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformer]).
+func NewTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredTestTypeInformer]).
+func NewFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformerWithOptions]).
+func NewTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) TestTypeIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "example.dots.apiserver.code-generator.k8s.io", Version: "v1", Resource: "testtypes"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apisexample3iov1.TestType](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ThirdExampleV1().TestTypes(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ThirdExampleV1().TestTypes(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ThirdExampleV1().TestTypes(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ThirdExampleV1().TestTypes(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apisexample3iov1.TestType{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *testTypeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *testTypeInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *testTypeInformer) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexample3iov1.TestType](f.factory.InformerFor(&apisexample3iov1.TestType{}, f.defaultInformer))
+}
+
+func (f *testTypeInformer) Lister() example3iov1.TestTypeLister {
+	return example3iov1.NewTestTypeLister(f.Informer().GetIndexer())
+}
+
+// ToTypedTestTypeInformer converts an untyped informer into a TypedTestTypeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TypedTestTypeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedTestTypeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedTestTypeInformer(informer TestTypeInformer) TypedTestTypeInformer {
+	if informer, ok := informer.(TypedTestTypeInformer); ok {
+		return informer
+	}
+	return &testTypeTypedInformerAdapter{informer}
+}
+
+type testTypeTypedInformerAdapter struct {
+	TestTypeInformer
+}
+
+func (a *testTypeTypedInformerAdapter) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexample3iov1.TestType](a.Informer())
+}
+
+// ToTestTypeIndexInformer converts an untyped informer into a TestTypeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TestTypeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a TestTypeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTestTypeIndexInformer(informer cache.SharedIndexInformer) TestTypeIndexInformer {
+	if informer, ok := informer.(TestTypeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apisexample3iov1.TestType](informer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/factory.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/factory.go
new file mode 100644
index 0000000000..e3acbb525b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/factory.go
@@ -0,0 +1,351 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	context "context"
+	reflect "reflect"
+	sync "sync"
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	wait "k8s.io/apimachinery/pkg/util/wait"
+	cache "k8s.io/client-go/tools/cache"
+	versioned "k8s.io/code-generator/examples/apiserver/clientset/versioned"
+	core "k8s.io/code-generator/examples/apiserver/informers/externalversions/core"
+	example "k8s.io/code-generator/examples/apiserver/informers/externalversions/example"
+	example2 "k8s.io/code-generator/examples/apiserver/informers/externalversions/example2"
+	example3io "k8s.io/code-generator/examples/apiserver/informers/externalversions/example3.io"
+	internalinterfaces "k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces"
+)
+
+// SharedInformerOption defines the functional option type for SharedInformerFactory.
+type SharedInformerOption func(*sharedInformerFactory) *sharedInformerFactory
+
+type sharedInformerFactory struct {
+	client           versioned.Interface
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	lock             sync.Mutex
+	defaultResync    time.Duration
+	customResync     map[reflect.Type]time.Duration
+	transform        cache.TransformFunc
+	informerName     *cache.InformerName
+
+	informers map[reflect.Type]cache.SharedIndexInformer
+	// startedInformers is used for tracking which informers have been started.
+	// This allows Start() to be called multiple times safely.
+	startedInformers map[reflect.Type]bool
+	// wg tracks how many goroutines were started.
+	wg sync.WaitGroup
+	// shuttingDown is true when Shutdown has been called. It may still be running
+	// because it needs to wait for goroutines.
+	shuttingDown bool
+}
+
+// WithCustomResyncConfig sets a custom resync period for the specified informer types.
+func WithCustomResyncConfig(resyncConfig map[v1.Object]time.Duration) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		for k, v := range resyncConfig {
+			factory.customResync[reflect.TypeOf(k)] = v
+		}
+		return factory
+	}
+}
+
+// WithTweakListOptions sets a custom filter on all listers of the configured SharedInformerFactory.
+func WithTweakListOptions(tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.tweakListOptions = tweakListOptions
+		return factory
+	}
+}
+
+// WithNamespace limits the SharedInformerFactory to the specified namespace.
+func WithNamespace(namespace string) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.namespace = namespace
+		return factory
+	}
+}
+
+// WithTransform sets a transform on all informers.
+func WithTransform(transform cache.TransformFunc) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.transform = transform
+		return factory
+	}
+}
+
+// WithInformerName sets the InformerName for informer identity used in metrics.
+// The InformerName must be created via cache.NewInformerName() at startup,
+// which validates global uniqueness. Each informer type will register its
+// GVR under this name.
+func WithInformerName(informerName *cache.InformerName) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.informerName = informerName
+		return factory
+	}
+}
+
+func (f *sharedInformerFactory) InformerName() *cache.InformerName {
+	return f.informerName
+}
+
+// NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces.
+func NewSharedInformerFactory(client versioned.Interface, defaultResync time.Duration) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync)
+}
+
+// NewFilteredSharedInformerFactory constructs a new instance of sharedInformerFactory.
+// Listers obtained via this SharedInformerFactory will be subject to the same filters
+// as specified here.
+//
+// Deprecated: Please use NewSharedInformerFactoryWithOptions instead
+func NewFilteredSharedInformerFactory(client versioned.Interface, defaultResync time.Duration, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync, WithNamespace(namespace), WithTweakListOptions(tweakListOptions))
+}
+
+// NewSharedInformerFactoryWithOptions constructs a new instance of a SharedInformerFactory with additional options.
+func NewSharedInformerFactoryWithOptions(client versioned.Interface, defaultResync time.Duration, options ...SharedInformerOption) SharedInformerFactory {
+	factory := &sharedInformerFactory{
+		client:           client,
+		namespace:        v1.NamespaceAll,
+		defaultResync:    defaultResync,
+		informers:        make(map[reflect.Type]cache.SharedIndexInformer),
+		startedInformers: make(map[reflect.Type]bool),
+		customResync:     make(map[reflect.Type]time.Duration),
+	}
+
+	// Apply all options
+	for _, opt := range options {
+		factory = opt(factory)
+	}
+
+	return factory
+}
+
+func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
+	f.StartWithContext(wait.ContextForChannel(stopCh))
+}
+
+func (f *sharedInformerFactory) StartWithContext(ctx context.Context) {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	if f.shuttingDown {
+		return
+	}
+
+	for informerType, informer := range f.informers {
+		if !f.startedInformers[informerType] {
+			f.wg.Go(func() {
+				informer.RunWithContext(ctx)
+			})
+			f.startedInformers[informerType] = true
+		}
+	}
+}
+
+func (f *sharedInformerFactory) Shutdown() {
+	f.lock.Lock()
+	f.shuttingDown = true
+	f.lock.Unlock()
+
+	// Will return immediately if there is nothing to wait for.
+	f.wg.Wait()
+	f.informerName.Release()
+}
+
+func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
+	result := f.WaitForCacheSyncWithContext(wait.ContextForChannel(stopCh))
+	return result.Synced
+}
+
+func (f *sharedInformerFactory) WaitForCacheSyncWithContext(ctx context.Context) cache.SyncResult {
+	informers := func() map[reflect.Type]cache.SharedIndexInformer {
+		f.lock.Lock()
+		defer f.lock.Unlock()
+
+		informers := map[reflect.Type]cache.SharedIndexInformer{}
+		for informerType, informer := range f.informers {
+			if f.startedInformers[informerType] {
+				informers[informerType] = informer
+			}
+		}
+		return informers
+	}()
+
+	// Wait for informers to sync, without polling.
+	cacheSyncs := make([]cache.DoneChecker, 0, len(informers))
+	for _, informer := range informers {
+		cacheSyncs = append(cacheSyncs, informer.HasSyncedChecker())
+	}
+	cache.WaitFor(ctx, "" /* no logging */, cacheSyncs...)
+
+	res := cache.SyncResult{
+		Synced: make(map[reflect.Type]bool, len(informers)),
+	}
+	failed := false
+	for informType, informer := range informers {
+		hasSynced := informer.HasSynced()
+		if !hasSynced {
+			failed = true
+		}
+		res.Synced[informType] = hasSynced
+	}
+	if failed {
+		// context.Cause is more informative than ctx.Err().
+		// This must be non-nil, otherwise WaitFor wouldn't have stopped
+		// prematurely.
+		res.Err = context.Cause(ctx)
+	}
+
+	return res
+}
+
+// InformerFor returns the SharedIndexInformer for obj using an internal
+// client.
+func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(obj)
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+
+	resyncPeriod, exists := f.customResync[informerType]
+	if !exists {
+		resyncPeriod = f.defaultResync
+	}
+
+	informer = newFunc(f.client, resyncPeriod)
+	if f.transform != nil {
+		informer.SetTransform(f.transform)
+	}
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// SharedInformerFactory provides shared informers for resources in all known
+// API group versions.
+//
+// It is typically used like this:
+//
+//	ctx, cancel := context.WithCancel(context.Background())
+//	defer cancel()
+//	factory := NewSharedInformerFactory(client, resyncPeriod)
+//	defer factory.Shutdown()    // Returns immediately if nothing was started.
+//	genericInformer := factory.ForResource(resource)
+//	typedInformer := factory.SomeAPIGroup().V1().SomeType()
+//	handle, err := typeInformer.Informer().AddEventHandler(...)
+//	if err != nil {
+//	    return fmt.Errorf("register event handler: %v", err)
+//	}
+//	defer typeInformer.Informer().RemoveEventHandler(handle) // Avoids leaking goroutines.
+//	factory.StartWithContext(ctx)                            // Start processing these informers.
+//	synced := factory.WaitForCacheSyncWithContext(ctx)
+//	if err := synced.AsError(); err != nil {
+//	    return err
+//	}
+//	for v := range synced {
+//	    // Only if desired log some information similar to this.
+//	    fmt.Fprintf(os.Stdout, "cache synced: %s", v)
+//	}
+//
+//	// Also make sure that all of the initial cache events have been delivered.
+//	if !WaitFor(ctx, "event handler sync", handle.HasSyncedChecker()) {
+//	    // Must have failed because of context.
+//	    return fmt.Errorf("sync event handler: %w", context.Cause(ctx))
+//	}
+//
+//	// Creating informers can also be created after Start, but then
+//	// Start must be called again:
+//	anotherGenericInformer := factory.ForResource(resource)
+//	factory.StartWithContext(ctx)
+type SharedInformerFactory interface {
+	internalinterfaces.SharedInformerFactory
+
+	// Start initializes all requested informers. They are handled in goroutines
+	// which run until the stop channel gets closed.
+	// Warning: Start does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	//
+	// Contextual logging: StartWithContext should be used instead of Start in code which supports contextual logging.
+	Start(stopCh <-chan struct{})
+
+	// StartWithContext initializes all requested informers. They are handled in goroutines
+	// which run until the context gets canceled.
+	// Warning: StartWithContext does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	StartWithContext(ctx context.Context)
+
+	// Shutdown marks a factory as shutting down. At that point no new
+	// informers can be started anymore and Start will return without
+	// doing anything.
+	//
+	// In addition, Shutdown blocks until all goroutines have terminated. For that
+	// to happen, the close channel(s) that they were started with must be closed,
+	// either before Shutdown gets called or while it is waiting.
+	//
+	// Shutdown may be called multiple times, even concurrently. All such calls will
+	// block until all goroutines have terminated.
+	Shutdown()
+
+	// WaitForCacheSync blocks until all started informers' caches were synced
+	// or the stop channel gets closed.
+	//
+	// Contextual logging: WaitForCacheSyncWithContext should be used instead of WaitForCacheSync in code which supports contextual logging. It also returns a more useful result.
+	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
+
+	// WaitForCacheSyncWithContext blocks until all started informers' caches were synced
+	// or the context gets canceled.
+	WaitForCacheSyncWithContext(ctx context.Context) cache.SyncResult
+
+	// ForResource gives generic access to a shared informer of the matching type.
+	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
+
+	// InformerFor returns the SharedIndexInformer for obj using an internal
+	// client.
+	InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer
+
+	Core() core.Interface
+	Example() example.Interface
+	SecondExample() example2.Interface
+	ThirdExample() example3io.Interface
+}
+
+func (f *sharedInformerFactory) Core() core.Interface {
+	return core.New(f, f.namespace, f.tweakListOptions)
+}
+
+func (f *sharedInformerFactory) Example() example.Interface {
+	return example.New(f, f.namespace, f.tweakListOptions)
+}
+
+func (f *sharedInformerFactory) SecondExample() example2.Interface {
+	return example2.New(f, f.namespace, f.tweakListOptions)
+}
+
+func (f *sharedInformerFactory) ThirdExample() example3io.Interface {
+	return example3io.New(f, f.namespace, f.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/generic.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/generic.go
new file mode 100644
index 0000000000..f1b7667973
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/generic.go
@@ -0,0 +1,77 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	fmt "fmt"
+
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	cache "k8s.io/client-go/tools/cache"
+	v1 "k8s.io/code-generator/examples/apiserver/apis/core/v1"
+	examplev1 "k8s.io/code-generator/examples/apiserver/apis/example/v1"
+	example2v1 "k8s.io/code-generator/examples/apiserver/apis/example2/v1"
+	example3iov1 "k8s.io/code-generator/examples/apiserver/apis/example3.io/v1"
+)
+
+// GenericInformer is type of SharedIndexInformer which will locate and delegate to other
+// sharedInformers based on type
+type GenericInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() cache.GenericLister
+}
+
+type genericInformer struct {
+	informer cache.SharedIndexInformer
+	resource schema.GroupResource
+}
+
+// Informer returns the SharedIndexInformer.
+func (f *genericInformer) Informer() cache.SharedIndexInformer {
+	return f.informer
+}
+
+// Lister returns the GenericLister.
+func (f *genericInformer) Lister() cache.GenericLister {
+	return cache.NewGenericLister(f.Informer().GetIndexer(), f.resource)
+}
+
+// ForResource gives generic access to a shared informer of the matching type
+// TODO extend this to unknown resources with a client pool
+func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource) (GenericInformer, error) {
+	switch resource {
+	// Group=core, Version=v1
+	case v1.SchemeGroupVersion.WithResource("testtypes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Core().V1().TestTypes().Informer()}, nil
+
+		// Group=example.apiserver.code-generator.k8s.io, Version=v1
+	case examplev1.SchemeGroupVersion.WithResource("testtypes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Example().V1().TestTypes().Informer()}, nil
+
+		// Group=example.dots.apiserver.code-generator.k8s.io, Version=v1
+	case example3iov1.SchemeGroupVersion.WithResource("testtypes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.ThirdExample().V1().TestTypes().Informer()}, nil
+
+		// Group=example.test.apiserver.code-generator.k8s.io, Version=v1
+	case example2v1.SchemeGroupVersion.WithResource("testtypes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.SecondExample().V1().TestTypes().Informer()}, nil
+
+	}
+
+	return nil, fmt.Errorf("no informer found for %v", resource)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces/factory_interfaces.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces/factory_interfaces.go
new file mode 100644
index 0000000000..d1eb3072dd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/informers/externalversions/internalinterfaces/factory_interfaces.go
@@ -0,0 +1,59 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package internalinterfaces
+
+import (
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	cache "k8s.io/client-go/tools/cache"
+	versioned "k8s.io/code-generator/examples/apiserver/clientset/versioned"
+)
+
+// NewInformerFunc takes versioned.Interface and time.Duration to return a SharedIndexInformer.
+type NewInformerFunc func(versioned.Interface, time.Duration) cache.SharedIndexInformer
+
+// SharedInformerFactory a small interface to allow for adding an informer without an import cycle
+type SharedInformerFactory interface {
+	Start(stopCh <-chan struct{})
+	InformerFor(obj runtime.Object, newFunc NewInformerFunc) cache.SharedIndexInformer
+	InformerName() *cache.InformerName
+}
+
+// TweakListOptionsFunc is a function that transforms a v1.ListOptions.
+type TweakListOptionsFunc func(*v1.ListOptions)
+
+// InformerOptions holds the options for creating an informer.
+type InformerOptions struct {
+	// ResyncPeriod is the resync period for this informer.
+	// If not set, defaults to 0 (no resync).
+	ResyncPeriod time.Duration
+
+	// Indexers are the indexers for this informer.
+	Indexers cache.Indexers
+
+	// InformerName is used to uniquely identify this informer for metrics.
+	// If not set, metrics will not be published for this informer.
+	// Use cache.NewInformerName() to create an InformerName at startup.
+	InformerName *cache.InformerName
+
+	// TweakListOptions is an optional function to modify the list options.
+	TweakListOptions TweakListOptionsFunc
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/core/v1/expansion_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/core/v1/expansion_generated.go
new file mode 100644
index 0000000000..0192e05f0d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/core/v1/expansion_generated.go
@@ -0,0 +1,27 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+// TestTypeListerExpansion allows custom methods to be added to
+// TestTypeLister.
+type TestTypeListerExpansion interface{}
+
+// TestTypeNamespaceListerExpansion allows custom methods to be added to
+// TestTypeNamespaceLister.
+type TestTypeNamespaceListerExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/core/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/core/v1/testtype.go
new file mode 100644
index 0000000000..b620aecee9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/core/v1/testtype.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	corev1 "k8s.io/code-generator/examples/apiserver/apis/core/v1"
+)
+
+// TestTypeLister helps list TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeLister interface {
+	// List lists all TestTypes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*corev1.TestType, err error)
+	// TestTypes returns an object that can list and get TestTypes.
+	TestTypes(namespace string) TestTypeNamespaceLister
+	TestTypeListerExpansion
+}
+
+// testTypeLister implements the TestTypeLister interface.
+type testTypeLister struct {
+	listers.ResourceIndexer[*corev1.TestType]
+}
+
+// NewTestTypeLister returns a new TestTypeLister.
+func NewTestTypeLister(indexer cache.Indexer) TestTypeLister {
+	return &testTypeLister{listers.New[*corev1.TestType](indexer, corev1.Resource("testtype"))}
+}
+
+// TestTypes returns an object that can list and get TestTypes.
+func (s *testTypeLister) TestTypes(namespace string) TestTypeNamespaceLister {
+	return testTypeNamespaceLister{listers.NewNamespaced[*corev1.TestType](s.ResourceIndexer, namespace)}
+}
+
+// TestTypeNamespaceLister helps list and get TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeNamespaceLister interface {
+	// List lists all TestTypes in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*corev1.TestType, err error)
+	// Get retrieves the TestType from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*corev1.TestType, error)
+	TestTypeNamespaceListerExpansion
+}
+
+// testTypeNamespaceLister implements the TestTypeNamespaceLister
+// interface.
+type testTypeNamespaceLister struct {
+	listers.ResourceIndexer[*corev1.TestType]
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example/v1/expansion_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example/v1/expansion_generated.go
new file mode 100644
index 0000000000..0192e05f0d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example/v1/expansion_generated.go
@@ -0,0 +1,27 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+// TestTypeListerExpansion allows custom methods to be added to
+// TestTypeLister.
+type TestTypeListerExpansion interface{}
+
+// TestTypeNamespaceListerExpansion allows custom methods to be added to
+// TestTypeNamespaceLister.
+type TestTypeNamespaceListerExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example/v1/testtype.go
new file mode 100644
index 0000000000..caf84018cd
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example/v1/testtype.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	examplev1 "k8s.io/code-generator/examples/apiserver/apis/example/v1"
+)
+
+// TestTypeLister helps list TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeLister interface {
+	// List lists all TestTypes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*examplev1.TestType, err error)
+	// TestTypes returns an object that can list and get TestTypes.
+	TestTypes(namespace string) TestTypeNamespaceLister
+	TestTypeListerExpansion
+}
+
+// testTypeLister implements the TestTypeLister interface.
+type testTypeLister struct {
+	listers.ResourceIndexer[*examplev1.TestType]
+}
+
+// NewTestTypeLister returns a new TestTypeLister.
+func NewTestTypeLister(indexer cache.Indexer) TestTypeLister {
+	return &testTypeLister{listers.New[*examplev1.TestType](indexer, examplev1.Resource("testtype"))}
+}
+
+// TestTypes returns an object that can list and get TestTypes.
+func (s *testTypeLister) TestTypes(namespace string) TestTypeNamespaceLister {
+	return testTypeNamespaceLister{listers.NewNamespaced[*examplev1.TestType](s.ResourceIndexer, namespace)}
+}
+
+// TestTypeNamespaceLister helps list and get TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeNamespaceLister interface {
+	// List lists all TestTypes in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*examplev1.TestType, err error)
+	// Get retrieves the TestType from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*examplev1.TestType, error)
+	TestTypeNamespaceListerExpansion
+}
+
+// testTypeNamespaceLister implements the TestTypeNamespaceLister
+// interface.
+type testTypeNamespaceLister struct {
+	listers.ResourceIndexer[*examplev1.TestType]
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example2/v1/expansion_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example2/v1/expansion_generated.go
new file mode 100644
index 0000000000..c43caf2403
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example2/v1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example2/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example2/v1/testtype.go
new file mode 100644
index 0000000000..43ed3f695e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example2/v1/testtype.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	example2v1 "k8s.io/code-generator/examples/apiserver/apis/example2/v1"
+)
+
+// TestTypeLister helps list TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeLister interface {
+	// List lists all TestTypes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*example2v1.TestType, err error)
+	// TestTypes returns an object that can list and get TestTypes.
+	TestTypes(namespace string) TestTypeNamespaceLister
+	TestTypeListerExpansion
+}
+
+// testTypeLister implements the TestTypeLister interface.
+type testTypeLister struct {
+	listers.ResourceIndexer[*example2v1.TestType]
+}
+
+// NewTestTypeLister returns a new TestTypeLister.
+func NewTestTypeLister(indexer cache.Indexer) TestTypeLister {
+	return &testTypeLister{listers.New[*example2v1.TestType](indexer, example2v1.Resource("testtype"))}
+}
+
+// TestTypes returns an object that can list and get TestTypes.
+func (s *testTypeLister) TestTypes(namespace string) TestTypeNamespaceLister {
+	return testTypeNamespaceLister{listers.NewNamespaced[*example2v1.TestType](s.ResourceIndexer, namespace)}
+}
+
+// TestTypeNamespaceLister helps list and get TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeNamespaceLister interface {
+	// List lists all TestTypes in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*example2v1.TestType, err error)
+	// Get retrieves the TestType from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*example2v1.TestType, error)
+	TestTypeNamespaceListerExpansion
+}
+
+// testTypeNamespaceLister implements the TestTypeNamespaceLister
+// interface.
+type testTypeNamespaceLister struct {
+	listers.ResourceIndexer[*example2v1.TestType]
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example2/v1/testtype_expansion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example2/v1/testtype_expansion.go
new file mode 100644
index 0000000000..c135d28447
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example2/v1/testtype_expansion.go
@@ -0,0 +1,31 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+// TestTypeListerExpansion allows custom methods to be added to
+// TestTypeLister.
+type TestTypeListerExpansion interface {
+	CheckExpansionSupport()
+}
+
+// TestTypeNamespaceListerExpansion allows custom methods to be added to
+// TestTypeNamespaceLister.
+type TestTypeNamespaceListerExpansion interface{}
+
+func (*testTypeLister) CheckExpansionSupport() {
+	// This checks that lister-gen correctly supports expansions
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example3.io/v1/expansion_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example3.io/v1/expansion_generated.go
new file mode 100644
index 0000000000..0192e05f0d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example3.io/v1/expansion_generated.go
@@ -0,0 +1,27 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+// TestTypeListerExpansion allows custom methods to be added to
+// TestTypeLister.
+type TestTypeListerExpansion interface{}
+
+// TestTypeNamespaceListerExpansion allows custom methods to be added to
+// TestTypeNamespaceLister.
+type TestTypeNamespaceListerExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example3.io/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example3.io/v1/testtype.go
new file mode 100644
index 0000000000..96b2088baa
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/listers/example3.io/v1/testtype.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	example3iov1 "k8s.io/code-generator/examples/apiserver/apis/example3.io/v1"
+)
+
+// TestTypeLister helps list TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeLister interface {
+	// List lists all TestTypes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*example3iov1.TestType, err error)
+	// TestTypes returns an object that can list and get TestTypes.
+	TestTypes(namespace string) TestTypeNamespaceLister
+	TestTypeListerExpansion
+}
+
+// testTypeLister implements the TestTypeLister interface.
+type testTypeLister struct {
+	listers.ResourceIndexer[*example3iov1.TestType]
+}
+
+// NewTestTypeLister returns a new TestTypeLister.
+func NewTestTypeLister(indexer cache.Indexer) TestTypeLister {
+	return &testTypeLister{listers.New[*example3iov1.TestType](indexer, example3iov1.Resource("testtype"))}
+}
+
+// TestTypes returns an object that can list and get TestTypes.
+func (s *testTypeLister) TestTypes(namespace string) TestTypeNamespaceLister {
+	return testTypeNamespaceLister{listers.NewNamespaced[*example3iov1.TestType](s.ResourceIndexer, namespace)}
+}
+
+// TestTypeNamespaceLister helps list and get TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeNamespaceLister interface {
+	// List lists all TestTypes in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*example3iov1.TestType, err error)
+	// Get retrieves the TestType from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*example3iov1.TestType, error)
+	TestTypeNamespaceListerExpansion
+}
+
+// testTypeNamespaceLister implements the TestTypeNamespaceLister
+// interface.
+type testTypeNamespaceLister struct {
+	listers.ResourceIndexer[*example3iov1.TestType]
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/openapi/zz_generated.openapi.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/openapi/zz_generated.openapi.go
new file mode 100644
index 0000000000..412fa58693
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/apiserver/openapi/zz_generated.openapi.go
@@ -0,0 +1,3503 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package openapi
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	version "k8s.io/apimachinery/pkg/version"
+	corev1 "k8s.io/code-generator/examples/apiserver/apis/core/v1"
+	examplev1 "k8s.io/code-generator/examples/apiserver/apis/example/v1"
+	example2v1 "k8s.io/code-generator/examples/apiserver/apis/example2/v1"
+	example3iov1 "k8s.io/code-generator/examples/apiserver/apis/example3.io/v1"
+	common "k8s.io/kube-openapi/pkg/common"
+	spec "k8s.io/kube-openapi/pkg/validation/spec"
+)
+
+func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenAPIDefinition {
+	return map[string]common.OpenAPIDefinition{
+		resource.Quantity{}.OpenAPIModelName():                   schema_apimachinery_pkg_api_resource_Quantity(ref),
+		v1.APIGroup{}.OpenAPIModelName():                         schema_pkg_apis_meta_v1_APIGroup(ref),
+		v1.APIGroupList{}.OpenAPIModelName():                     schema_pkg_apis_meta_v1_APIGroupList(ref),
+		v1.APIResource{}.OpenAPIModelName():                      schema_pkg_apis_meta_v1_APIResource(ref),
+		v1.APIResourceList{}.OpenAPIModelName():                  schema_pkg_apis_meta_v1_APIResourceList(ref),
+		v1.APIVersions{}.OpenAPIModelName():                      schema_pkg_apis_meta_v1_APIVersions(ref),
+		v1.ApplyOptions{}.OpenAPIModelName():                     schema_pkg_apis_meta_v1_ApplyOptions(ref),
+		v1.Condition{}.OpenAPIModelName():                        schema_pkg_apis_meta_v1_Condition(ref),
+		v1.CreateOptions{}.OpenAPIModelName():                    schema_pkg_apis_meta_v1_CreateOptions(ref),
+		v1.DeleteOptions{}.OpenAPIModelName():                    schema_pkg_apis_meta_v1_DeleteOptions(ref),
+		v1.Duration{}.OpenAPIModelName():                         schema_pkg_apis_meta_v1_Duration(ref),
+		v1.FieldSelectorRequirement{}.OpenAPIModelName():         schema_pkg_apis_meta_v1_FieldSelectorRequirement(ref),
+		v1.FieldsV1{}.OpenAPIModelName():                         schema_pkg_apis_meta_v1_FieldsV1(ref),
+		v1.GetOptions{}.OpenAPIModelName():                       schema_pkg_apis_meta_v1_GetOptions(ref),
+		v1.GroupKind{}.OpenAPIModelName():                        schema_pkg_apis_meta_v1_GroupKind(ref),
+		v1.GroupResource{}.OpenAPIModelName():                    schema_pkg_apis_meta_v1_GroupResource(ref),
+		v1.GroupVersion{}.OpenAPIModelName():                     schema_pkg_apis_meta_v1_GroupVersion(ref),
+		v1.GroupVersionForDiscovery{}.OpenAPIModelName():         schema_pkg_apis_meta_v1_GroupVersionForDiscovery(ref),
+		v1.GroupVersionKind{}.OpenAPIModelName():                 schema_pkg_apis_meta_v1_GroupVersionKind(ref),
+		v1.GroupVersionResource{}.OpenAPIModelName():             schema_pkg_apis_meta_v1_GroupVersionResource(ref),
+		v1.InternalEvent{}.OpenAPIModelName():                    schema_pkg_apis_meta_v1_InternalEvent(ref),
+		v1.LabelSelector{}.OpenAPIModelName():                    schema_pkg_apis_meta_v1_LabelSelector(ref),
+		v1.LabelSelectorRequirement{}.OpenAPIModelName():         schema_pkg_apis_meta_v1_LabelSelectorRequirement(ref),
+		v1.List{}.OpenAPIModelName():                             schema_pkg_apis_meta_v1_List(ref),
+		v1.ListMeta{}.OpenAPIModelName():                         schema_pkg_apis_meta_v1_ListMeta(ref),
+		v1.ListOptions{}.OpenAPIModelName():                      schema_pkg_apis_meta_v1_ListOptions(ref),
+		v1.ManagedFieldsEntry{}.OpenAPIModelName():               schema_pkg_apis_meta_v1_ManagedFieldsEntry(ref),
+		v1.MicroTime{}.OpenAPIModelName():                        schema_pkg_apis_meta_v1_MicroTime(ref),
+		v1.ObjectMeta{}.OpenAPIModelName():                       schema_pkg_apis_meta_v1_ObjectMeta(ref),
+		v1.OwnerReference{}.OpenAPIModelName():                   schema_pkg_apis_meta_v1_OwnerReference(ref),
+		v1.PartialObjectMetadata{}.OpenAPIModelName():            schema_pkg_apis_meta_v1_PartialObjectMetadata(ref),
+		v1.PartialObjectMetadataList{}.OpenAPIModelName():        schema_pkg_apis_meta_v1_PartialObjectMetadataList(ref),
+		v1.Patch{}.OpenAPIModelName():                            schema_pkg_apis_meta_v1_Patch(ref),
+		v1.PatchOptions{}.OpenAPIModelName():                     schema_pkg_apis_meta_v1_PatchOptions(ref),
+		v1.Preconditions{}.OpenAPIModelName():                    schema_pkg_apis_meta_v1_Preconditions(ref),
+		v1.RootPaths{}.OpenAPIModelName():                        schema_pkg_apis_meta_v1_RootPaths(ref),
+		v1.ServerAddressByClientCIDR{}.OpenAPIModelName():        schema_pkg_apis_meta_v1_ServerAddressByClientCIDR(ref),
+		v1.ShardInfo{}.OpenAPIModelName():                        schema_pkg_apis_meta_v1_ShardInfo(ref),
+		v1.Status{}.OpenAPIModelName():                           schema_pkg_apis_meta_v1_Status(ref),
+		v1.StatusCause{}.OpenAPIModelName():                      schema_pkg_apis_meta_v1_StatusCause(ref),
+		v1.StatusDetails{}.OpenAPIModelName():                    schema_pkg_apis_meta_v1_StatusDetails(ref),
+		v1.Table{}.OpenAPIModelName():                            schema_pkg_apis_meta_v1_Table(ref),
+		v1.TableColumnDefinition{}.OpenAPIModelName():            schema_pkg_apis_meta_v1_TableColumnDefinition(ref),
+		v1.TableOptions{}.OpenAPIModelName():                     schema_pkg_apis_meta_v1_TableOptions(ref),
+		v1.TableRow{}.OpenAPIModelName():                         schema_pkg_apis_meta_v1_TableRow(ref),
+		v1.TableRowCondition{}.OpenAPIModelName():                schema_pkg_apis_meta_v1_TableRowCondition(ref),
+		v1.Time{}.OpenAPIModelName():                             schema_pkg_apis_meta_v1_Time(ref),
+		v1.Timestamp{}.OpenAPIModelName():                        schema_pkg_apis_meta_v1_Timestamp(ref),
+		v1.TypeMeta{}.OpenAPIModelName():                         schema_pkg_apis_meta_v1_TypeMeta(ref),
+		v1.UpdateOptions{}.OpenAPIModelName():                    schema_pkg_apis_meta_v1_UpdateOptions(ref),
+		v1.WatchEvent{}.OpenAPIModelName():                       schema_pkg_apis_meta_v1_WatchEvent(ref),
+		runtime.RawExtension{}.OpenAPIModelName():                schema_k8sio_apimachinery_pkg_runtime_RawExtension(ref),
+		runtime.TypeMeta{}.OpenAPIModelName():                    schema_k8sio_apimachinery_pkg_runtime_TypeMeta(ref),
+		runtime.Unknown{}.OpenAPIModelName():                     schema_k8sio_apimachinery_pkg_runtime_Unknown(ref),
+		version.Info{}.OpenAPIModelName():                        schema_k8sio_apimachinery_pkg_version_Info(ref),
+		corev1.TestType{}.OpenAPIModelName():                     schema_apiserver_apis_core_v1_TestType(ref),
+		corev1.TestTypeList{}.OpenAPIModelName():                 schema_apiserver_apis_core_v1_TestTypeList(ref),
+		corev1.TestTypeStatus{}.OpenAPIModelName():               schema_apiserver_apis_core_v1_TestTypeStatus(ref),
+		examplev1.Conversion{}.OpenAPIModelName():                schema_apiserver_apis_example_v1_Conversion(ref),
+		examplev1.ConversionCustom{}.OpenAPIModelName():          schema_apiserver_apis_example_v1_ConversionCustom(ref),
+		examplev1.ConversionCustomContainer{}.OpenAPIModelName(): schema_apiserver_apis_example_v1_ConversionCustomContainer(ref),
+		examplev1.ConversionPrivate{}.OpenAPIModelName():         schema_apiserver_apis_example_v1_ConversionPrivate(ref),
+		examplev1.MemoryDifferent{}.OpenAPIModelName():           schema_apiserver_apis_example_v1_MemoryDifferent(ref),
+		examplev1.MemoryIdentical{}.OpenAPIModelName():           schema_apiserver_apis_example_v1_MemoryIdentical(ref),
+		examplev1.TestType{}.OpenAPIModelName():                  schema_apiserver_apis_example_v1_TestType(ref),
+		examplev1.TestTypeList{}.OpenAPIModelName():              schema_apiserver_apis_example_v1_TestTypeList(ref),
+		examplev1.TestTypeStatus{}.OpenAPIModelName():            schema_apiserver_apis_example_v1_TestTypeStatus(ref),
+		example2v1.TestType{}.OpenAPIModelName():                 schema_apiserver_apis_example2_v1_TestType(ref),
+		example2v1.TestTypeList{}.OpenAPIModelName():             schema_apiserver_apis_example2_v1_TestTypeList(ref),
+		example2v1.TestTypeStatus{}.OpenAPIModelName():           schema_apiserver_apis_example2_v1_TestTypeStatus(ref),
+		example3iov1.TestType{}.OpenAPIModelName():               schema_apiserver_apis_example3io_v1_TestType(ref),
+		example3iov1.TestTypeList{}.OpenAPIModelName():           schema_apiserver_apis_example3io_v1_TestTypeList(ref),
+		example3iov1.TestTypeStatus{}.OpenAPIModelName():         schema_apiserver_apis_example3io_v1_TestTypeStatus(ref),
+	}
+}
+
+func schema_apimachinery_pkg_api_resource_Quantity(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.EmbedOpenAPIDefinitionIntoV2Extension(common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.\n\nThe serialization format is:\n\n``` <quantity>        ::= <signedNumber><suffix>\n\n\t(Note that <suffix> may be empty, from the \"\" case in <decimalSI>.)\n\n<digit>           ::= 0 | 1 | ... | 9 <digits>          ::= <digit> | <digit><digits> <number>          ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign>            ::= \"+\" | \"-\" <signedNumber>    ::= <number> | <sign><number> <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei\n\n\t(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)\n\n<decimalSI>       ::= m | \"\" | k | M | G | T | P | E\n\n\t(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)\n\n<decimalExponent> ::= \"e\" <signedNumber> | \"E\" <signedNumber> ```\n\nNo matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.\n\nWhen a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.\n\nBefore serializing, Quantity will be put in \"canonical form\". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:\n\n- No precision is lost - No fractional digits will be emitted - The exponent (or suffix) is as large as possible.\n\nThe sign will be omitted unless the number is negative.\n\nExamples:\n\n- 1.5 will be serialized as \"1500m\" - 1.5Gi will be serialized as \"1536Mi\"\n\nNote that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.\n\nNon-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)\n\nThis format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.",
+				OneOf:       common.GenerateOpenAPIV3OneOfSchema(resource.Quantity{}.OpenAPIV3OneOfTypes()),
+				Format:      resource.Quantity{}.OpenAPISchemaFormat(),
+			},
+		},
+	}, common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.\n\nThe serialization format is:\n\n``` <quantity>        ::= <signedNumber><suffix>\n\n\t(Note that <suffix> may be empty, from the \"\" case in <decimalSI>.)\n\n<digit>           ::= 0 | 1 | ... | 9 <digits>          ::= <digit> | <digit><digits> <number>          ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign>            ::= \"+\" | \"-\" <signedNumber>    ::= <number> | <sign><number> <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei\n\n\t(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)\n\n<decimalSI>       ::= m | \"\" | k | M | G | T | P | E\n\n\t(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)\n\n<decimalExponent> ::= \"e\" <signedNumber> | \"E\" <signedNumber> ```\n\nNo matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.\n\nWhen a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.\n\nBefore serializing, Quantity will be put in \"canonical form\". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:\n\n- No precision is lost - No fractional digits will be emitted - The exponent (or suffix) is as large as possible.\n\nThe sign will be omitted unless the number is negative.\n\nExamples:\n\n- 1.5 will be serialized as \"1500m\" - 1.5Gi will be serialized as \"1536Mi\"\n\nNote that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.\n\nNon-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)\n\nThis format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.",
+				Type:        resource.Quantity{}.OpenAPISchemaType(),
+				Format:      resource.Quantity{}.OpenAPISchemaFormat(),
+			},
+		},
+	})
+}
+
+func schema_apimachinery_pkg_api_resource_int64Amount(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "int64Amount represents a fixed precision numerator and arbitrary scale exponent. It is faster than operations on inf.Dec for values that can be represented as int64.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"value": {
+						SchemaProps: spec.SchemaProps{
+							Default: 0,
+							Type:    []string{"integer"},
+							Format:  "int64",
+						},
+					},
+					"scale": {
+						SchemaProps: spec.SchemaProps{
+							Default: 0,
+							Type:    []string{"integer"},
+							Format:  "int32",
+						},
+					},
+				},
+				Required: []string{"value", "scale"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_APIGroup(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "APIGroup contains the name, the supported versions, and the preferred version of a group.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "name is the name of the group.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"versions": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "versions are the versions supported in this group.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(v1.GroupVersionForDiscovery{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+					"preferredVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "preferredVersion is the version preferred by the API server, which probably is the storage version.",
+							Default:     map[string]interface{}{},
+							Ref:         ref(v1.GroupVersionForDiscovery{}.OpenAPIModelName()),
+						},
+					},
+					"serverAddressByClientCIDRs": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "a map of client CIDR to server address that is serving this group. This is to help clients reach servers in the most network-efficient way possible. Clients can use the appropriate server address as per the CIDR that they match. In case of multiple matches, clients should use the longest matching CIDR. The server returns only those CIDRs that it thinks that the client can match. For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP. Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(v1.ServerAddressByClientCIDR{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"name", "versions"},
+			},
+		},
+		Dependencies: []string{
+			v1.GroupVersionForDiscovery{}.OpenAPIModelName(), v1.ServerAddressByClientCIDR{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_APIGroupList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "APIGroupList is a list of APIGroup, to allow clients to discover the API at /apis.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"groups": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "groups is a list of APIGroup.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(v1.APIGroup{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"groups"},
+			},
+		},
+		Dependencies: []string{
+			v1.APIGroup{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_APIResource(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "APIResource specifies the name of a resource and whether it is namespaced.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "name is the plural name of the resource.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"singularName": {
+						SchemaProps: spec.SchemaProps{
+							Description: "singularName is the singular name of the resource.  This allows clients to handle plural and singular opaquely. The singularName is more correct for reporting status on a single item and both singular and plural are allowed from the kubectl CLI interface.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"namespaced": {
+						SchemaProps: spec.SchemaProps{
+							Description: "namespaced indicates if a resource is namespaced or not.",
+							Default:     false,
+							Type:        []string{"boolean"},
+							Format:      "",
+						},
+					},
+					"group": {
+						SchemaProps: spec.SchemaProps{
+							Description: "group is the preferred group of the resource.  Empty implies the group of the containing resource list. For subresources, this may have a different value, for example: Scale\".",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"version": {
+						SchemaProps: spec.SchemaProps{
+							Description: "version is the preferred version of the resource.  Empty implies the version of the containing resource list For subresources, this may have a different value, for example: v1 (while inside a v1beta1 version of the core resource's group)\".",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "kind is the kind for the resource (e.g. 'Foo' is the kind for a resource 'foo')",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"verbs": {
+						SchemaProps: spec.SchemaProps{
+							Description: "verbs is a list of supported kube verbs (this includes get, list, watch, create, update, patch, delete, deletecollection, and proxy)",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"shortNames": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "shortNames is a list of suggested short names of the resource.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"categories": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "categories is a list of the grouped resources this resource belongs to (e.g. 'all')",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"storageVersionHash": {
+						SchemaProps: spec.SchemaProps{
+							Description: "The hash value of the storage version, the version this resource is converted to when written to the data store. Value must be treated as opaque by clients. Only equality comparison on the value is valid. This is an alpha feature and may change or be removed in the future. The field is populated by the apiserver only if the StorageVersionHash feature gate is enabled. This field will remain optional even if it graduates.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"name", "singularName", "namespaced", "kind", "verbs"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_APIResourceList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "APIResourceList is a list of APIResource, it is used to expose the name of the resources supported in a specific group and version, and if the resource is namespaced.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"groupVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "groupVersion is the group and version this APIResourceList is for.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"resources": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "resources contains the name of the resources and if they are namespaced.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(v1.APIResource{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"groupVersion", "resources"},
+			},
+		},
+		Dependencies: []string{
+			v1.APIResource{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_APIVersions(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "APIVersions lists the versions that are available, to allow clients to discover the API at /api, which is the root path of the legacy v1 API.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"versions": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "versions are the api versions that are available.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"serverAddressByClientCIDRs": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "a map of client CIDR to server address that is serving this group. This is to help clients reach servers in the most network-efficient way possible. Clients can use the appropriate server address as per the CIDR that they match. In case of multiple matches, clients should use the longest matching CIDR. The server returns only those CIDRs that it thinks that the client can match. For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP. Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(v1.ServerAddressByClientCIDR{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"versions", "serverAddressByClientCIDRs"},
+			},
+		},
+		Dependencies: []string{
+			v1.ServerAddressByClientCIDR{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_ApplyOptions(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "ApplyOptions may be provided when applying an API object. FieldManager is required for apply requests. ApplyOptions is equivalent to PatchOptions. It is provided as a convenience with documentation that speaks specifically to how the options fields relate to apply.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"dryRun": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"force": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people.",
+							Default:     false,
+							Type:        []string{"boolean"},
+							Format:      "",
+						},
+					},
+					"fieldManager": {
+						SchemaProps: spec.SchemaProps{
+							Description: "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"force", "fieldManager"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_Condition(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Condition contains details for one aspect of the current state of this API Resource.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"type": {
+						SchemaProps: spec.SchemaProps{
+							Description: "type of condition in CamelCase or in foo.example.com/CamelCase.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Description: "status of the condition, one of True, False, Unknown.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"observedGeneration": {
+						SchemaProps: spec.SchemaProps{
+							Description: "observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.",
+							Type:        []string{"integer"},
+							Format:      "int64",
+						},
+					},
+					"lastTransitionTime": {
+						SchemaProps: spec.SchemaProps{
+							Description: "lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+							Ref:         ref(v1.Time{}.OpenAPIModelName()),
+						},
+					},
+					"reason": {
+						SchemaProps: spec.SchemaProps{
+							Description: "reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"message": {
+						SchemaProps: spec.SchemaProps{
+							Description: "message is a human readable message indicating details about the transition. This may be an empty string.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"type", "status", "lastTransitionTime", "reason", "message"},
+			},
+		},
+		Dependencies: []string{
+			v1.Time{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_CreateOptions(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "CreateOptions may be provided when creating an API object.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"dryRun": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"fieldManager": {
+						SchemaProps: spec.SchemaProps{
+							Description: "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"fieldValidation": {
+						SchemaProps: spec.SchemaProps{
+							Description: "fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_DeleteOptions(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "DeleteOptions may be provided when deleting an API object.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"gracePeriodSeconds": {
+						SchemaProps: spec.SchemaProps{
+							Description: "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.",
+							Type:        []string{"integer"},
+							Format:      "int64",
+						},
+					},
+					"preconditions": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Must be fulfilled before a deletion is carried out. If not possible, a 409 Conflict status will be returned.",
+							Ref:         ref(v1.Preconditions{}.OpenAPIModelName()),
+						},
+					},
+					"orphanDependents": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.",
+							Type:        []string{"boolean"},
+							Format:      "",
+						},
+					},
+					"propagationPolicy": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"dryRun": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"ignoreStoreReadErrorWithClusterBreakingPotential": {
+						SchemaProps: spec.SchemaProps{
+							Description: "if set to true, it will trigger an unsafe deletion of the resource in case the normal deletion flow fails with a corrupt object error. A resource is considered corrupt if it can not be retrieved from the underlying storage successfully because of a) its data can not be transformed e.g. decryption failure, or b) it fails to decode into an object. NOTE: unsafe deletion ignores finalizer constraints, skips precondition checks, and removes the object from the storage. WARNING: This may potentially break the cluster if the workload associated with the resource being unsafe-deleted relies on normal deletion flow. Use only if you REALLY know what you are doing. The default value is false, and the user must opt in to enable it",
+							Type:        []string{"boolean"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			v1.Preconditions{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_Duration(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Duration is a wrapper around time.Duration which supports correct marshaling to YAML and JSON. In particular, it marshals into strings, which can be used as map keys in json.",
+				Type:        v1.Duration{}.OpenAPISchemaType(),
+				Format:      v1.Duration{}.OpenAPISchemaFormat(),
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_FieldSelectorRequirement(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "FieldSelectorRequirement is a selector that contains values, a key, and an operator that relates the key and values.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"key": {
+						SchemaProps: spec.SchemaProps{
+							Description: "key is the field selector key that the requirement applies to.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"operator": {
+						SchemaProps: spec.SchemaProps{
+							Description: "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. The list of operators may grow in the future.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"values": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"key", "operator"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_FieldsV1(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:<name>', where <name> is the name of a field in a struct, or key in a map 'v:<value>', where <value> is the exact json formatted value of a list item 'i:<index>', where <index> is position of a item in a list 'k:<keys>', where <keys> is a map of  a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff",
+				Type:        []string{"object"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_GetOptions(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "GetOptions is the standard query options to the standard REST get call.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"resourceVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_GroupKind(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "GroupKind specifies a Group and a Kind, but does not force a version.  This is useful for identifying concepts during lookup stages without having partially valid types",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"group": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"group", "kind"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_GroupResource(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "GroupResource specifies a Group and a Resource, but does not force a version.  This is useful for identifying concepts during lookup stages without having partially valid types",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"group": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"resource": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"group", "resource"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_GroupVersion(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "GroupVersion contains the \"group\" and the \"version\", which uniquely identifies the API.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"group": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"version": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"group", "version"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_GroupVersionForDiscovery(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "GroupVersion contains the \"group/version\" and \"version\" string of a version. It is made a struct to keep extensibility.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"groupVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "groupVersion specifies the API group and version in the form \"group/version\"",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"version": {
+						SchemaProps: spec.SchemaProps{
+							Description: "version specifies the version in the form of \"version\". This is to save the clients the trouble of splitting the GroupVersion.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"groupVersion", "version"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_GroupVersionKind(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "GroupVersionKind unambiguously identifies a kind.  It doesn't anonymously include GroupVersion to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"group": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"version": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"group", "version", "kind"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_GroupVersionResource(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "GroupVersionResource unambiguously identifies a resource.  It doesn't anonymously include GroupVersion to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"group": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"version": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"resource": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"group", "version", "resource"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_InternalEvent(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "InternalEvent makes watch.Event versioned",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"Type": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"Object": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Object is:\n * If Type is Added or Modified: the new state of the object.\n * If Type is Deleted: the state of the object immediately before deletion.\n * If Type is Bookmark: the object (instance of a type being watched) where\n   only ResourceVersion field is set. On successful restart of watch from a\n   bookmark resourceVersion, client is guaranteed to not get repeat event\n   nor miss any events.\n * If Type is Error: *api.Status is recommended; other types may make sense\n   depending on context.",
+						},
+					},
+				},
+				Required: []string{"Type", "Object"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_LabelSelector(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"matchLabels": {
+						SchemaProps: spec.SchemaProps{
+							Description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"matchExpressions": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(v1.LabelSelectorRequirement{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			VendorExtensible: spec.VendorExtensible{
+				Extensions: spec.Extensions{
+					"x-kubernetes-map-type": "atomic",
+				},
+			},
+		},
+		Dependencies: []string{
+			v1.LabelSelectorRequirement{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_LabelSelectorRequirement(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"key": {
+						SchemaProps: spec.SchemaProps{
+							Description: "key is the label key that the selector applies to.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"operator": {
+						SchemaProps: spec.SchemaProps{
+							Description: "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"values": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"key", "operator"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_List(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "List holds a list of objects, which may not be known by the server.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Default:     map[string]interface{}{},
+							Ref:         ref(v1.ListMeta{}.OpenAPIModelName()),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Description: "List of objects",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(runtime.RawExtension{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"items"},
+			},
+		},
+		Dependencies: []string{
+			v1.ListMeta{}.OpenAPIModelName(), runtime.RawExtension{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_ListMeta(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "ListMeta describes metadata that synthetic resources must have, including lists and various status objects. A resource may have only one of {ObjectMeta, ListMeta}.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"selfLink": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"resourceVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "String that identifies the server's internal version of this object that can be used by clients to determine when objects have changed. Value must be treated as opaque by clients and passed unmodified back to the server. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"continue": {
+						SchemaProps: spec.SchemaProps{
+							Description: "continue may be set if the user set a limit on the number of items returned, and indicates that the server has more data available. The value is opaque and may be used to issue another request to the endpoint that served this list to retrieve the next set of available objects. Continuing a consistent list may not be possible if the server configuration has changed or more than a few minutes have passed. The resourceVersion field returned when using this continue value will be identical to the value in the first response, unless you have received this token from an error message.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"remainingItemCount": {
+						SchemaProps: spec.SchemaProps{
+							Description: "remainingItemCount is the number of subsequent items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the field will be left unset and omitted during serialization. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and this field will be left unset and omitted during serialization. Servers older than v1.15 do not set this field. The intended use of the remainingItemCount is *estimating* the size of a collection. Clients should not rely on the remainingItemCount to be set or to be exact.",
+							Type:        []string{"integer"},
+							Format:      "int64",
+						},
+					},
+					"shardInfo": {
+						SchemaProps: spec.SchemaProps{
+							Description: "shardInfo is set when the list is a filtered subset of the full collection, as selected by a shard selector on the request. It echoes back the selector so clients can verify which shard they received and merge sharded responses. Clients should not cache sharded list responses as a full representation of the collection.\n\nThis is an alpha field and requires enabling the ShardedListAndWatch feature gate.",
+							Ref:         ref(v1.ShardInfo{}.OpenAPIModelName()),
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			v1.ShardInfo{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_ListOptions(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "ListOptions is the query options to a standard REST list call.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"labelSelector": {
+						SchemaProps: spec.SchemaProps{
+							Description: "A selector to restrict the list of returned objects by their labels. Defaults to everything.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"fieldSelector": {
+						SchemaProps: spec.SchemaProps{
+							Description: "A selector to restrict the list of returned objects by their fields. Defaults to everything.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"watch": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.",
+							Type:        []string{"boolean"},
+							Format:      "",
+						},
+					},
+					"allowWatchBookmarks": {
+						SchemaProps: spec.SchemaProps{
+							Description: "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.",
+							Type:        []string{"boolean"},
+							Format:      "",
+						},
+					},
+					"resourceVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"resourceVersionMatch": {
+						SchemaProps: spec.SchemaProps{
+							Description: "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"timeoutSeconds": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.",
+							Type:        []string{"integer"},
+							Format:      "int64",
+						},
+					},
+					"limit": {
+						SchemaProps: spec.SchemaProps{
+							Description: "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.",
+							Type:        []string{"integer"},
+							Format:      "int64",
+						},
+					},
+					"continue": {
+						SchemaProps: spec.SchemaProps{
+							Description: "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"sendInitialEvents": {
+						SchemaProps: spec.SchemaProps{
+							Description: "`sendInitialEvents=true` may be set together with `watch=true`. In that case, the watch stream will begin with synthetic events to produce the current state of objects in the collection. Once all such events have been sent, a synthetic \"Bookmark\" event  will be sent. The bookmark will report the ResourceVersion (RV) corresponding to the set of objects, and be marked with `\"k8s.io/initial-events-end\": \"true\"` annotation. Afterwards, the watch stream will proceed as usual, sending watch events corresponding to changes (subsequent to the RV) to objects watched.\n\nWhen `sendInitialEvents` option is set, we require `resourceVersionMatch` option to also be set. The semantic of the watch request is as following: - `resourceVersionMatch` = NotOlderThan\n  is interpreted as \"data at least as new as the provided `resourceVersion`\"\n  and the bookmark event is send when the state is synced\n  to a `resourceVersion` at least as fresh as the one provided by the ListOptions.\n  If `resourceVersion` is unset, this is interpreted as \"consistent read\" and the\n  bookmark event is send when the state is synced at least to the moment\n  when request started being processed.\n- `resourceVersionMatch` set to any other value or unset\n  Invalid error is returned.\n\nDefaults to true if `resourceVersion=\"\"` or `resourceVersion=\"0\"` (for backward compatibility reasons) and to false otherwise.",
+							Type:        []string{"boolean"},
+							Format:      "",
+						},
+					},
+					"shardSelector": {
+						SchemaProps: spec.SchemaProps{
+							Description: "shardSelector restricts the list of returned objects using a CEL-based shard selector expression. The format uses the shardRange() function combined with || (logical OR) to specify one or more hash ranges:\n\n  shardRange(object.metadata.uid, '0x0', '0x8000000000000000')\n  shardRange(object.metadata.uid, '0x0', '0x8000000000000000') || shardRange(object.metadata.uid, '0x8000000000000000', '0x10000000000000000')\n\nField paths use CEL-style object-rooted syntax (e.g. \"object.metadata.uid\"), NOT the fieldSelector format (\"metadata.uid\"). Currently supported paths:\n  - object.metadata.uid\n  - object.metadata.namespace\n\nhexStart and hexEnd are single-quoted CEL string literals with a '0x' prefix, defining the inclusive lower and exclusive upper bounds over the 64-bit FNV-1a hash space. The full range is [0x0, 0x10000000000000000), where the exclusive upper bound equals 2^64.\n\nExamples:\n  2-shard split:\n    shard 0: shardRange(object.metadata.uid, '0x0000000000000000', '0x8000000000000000')\n    shard 1: shardRange(object.metadata.uid, '0x8000000000000000', '0x10000000000000000')\n  4-shard split:\n    shard 0: shardRange(object.metadata.uid, '0x0000000000000000', '0x4000000000000000')\n    shard 1: shardRange(object.metadata.uid, '0x4000000000000000', '0x8000000000000000')\n    shard 2: shardRange(object.metadata.uid, '0x8000000000000000', '0xc000000000000000')\n    shard 3: shardRange(object.metadata.uid, '0xc000000000000000', '0x10000000000000000')\n\nThis is an alpha field and requires enabling the ShardedListAndWatch feature gate.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_ManagedFieldsEntry(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"manager": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Manager is an identifier of the workflow managing these fields.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"operation": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"time": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over.",
+							Ref:         ref(v1.Time{}.OpenAPIModelName()),
+						},
+					},
+					"fieldsType": {
+						SchemaProps: spec.SchemaProps{
+							Description: "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"fieldsV1": {
+						SchemaProps: spec.SchemaProps{
+							Description: "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type.",
+							Ref:         ref(v1.FieldsV1{}.OpenAPIModelName()),
+						},
+					},
+					"subresource": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			v1.FieldsV1{}.OpenAPIModelName(), v1.Time{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_MicroTime(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "MicroTime is version of Time with microsecond level precision.",
+				Type:        v1.MicroTime{}.OpenAPISchemaType(),
+				Format:      v1.MicroTime{}.OpenAPISchemaFormat(),
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_ObjectMeta(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"generateName": {
+						SchemaProps: spec.SchemaProps{
+							Description: "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"namespace": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"selfLink": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"uid": {
+						SchemaProps: spec.SchemaProps{
+							Description: "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"resourceVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"generation": {
+						SchemaProps: spec.SchemaProps{
+							Description: "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.",
+							Type:        []string{"integer"},
+							Format:      "int64",
+						},
+					},
+					"creationTimestamp": {
+						SchemaProps: spec.SchemaProps{
+							Description: "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+							Ref:         ref(v1.Time{}.OpenAPIModelName()),
+						},
+					},
+					"deletionTimestamp": {
+						SchemaProps: spec.SchemaProps{
+							Description: "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+							Ref:         ref(v1.Time{}.OpenAPIModelName()),
+						},
+					},
+					"deletionGracePeriodSeconds": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.",
+							Type:        []string{"integer"},
+							Format:      "int64",
+						},
+					},
+					"labels": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"annotations": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"ownerReferences": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-map-keys": []interface{}{
+									"uid",
+								},
+								"x-kubernetes-list-type":       "map",
+								"x-kubernetes-patch-merge-key": "uid",
+								"x-kubernetes-patch-strategy":  "merge",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(v1.OwnerReference{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+					"finalizers": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type":      "set",
+								"x-kubernetes-patch-strategy": "merge",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order.  Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"managedFields": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(v1.ManagedFieldsEntry{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			v1.ManagedFieldsEntry{}.OpenAPIModelName(), v1.OwnerReference{}.OpenAPIModelName(), v1.Time{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_OwnerReference(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "API version of the referent.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"uid": {
+						SchemaProps: spec.SchemaProps{
+							Description: "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"controller": {
+						SchemaProps: spec.SchemaProps{
+							Description: "If true, this reference points to the managing controller.",
+							Type:        []string{"boolean"},
+							Format:      "",
+						},
+					},
+					"blockOwnerDeletion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.",
+							Type:        []string{"boolean"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"apiVersion", "kind", "name", "uid"},
+			},
+			VendorExtensible: spec.VendorExtensible{
+				Extensions: spec.Extensions{
+					"x-kubernetes-map-type": "atomic",
+				},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_PartialObjectMetadata(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "PartialObjectMetadata is a generic representation of any object with ObjectMeta. It allows clients to get access to a particular ObjectMeta schema without knowing the details of the version.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+							Default:     map[string]interface{}{},
+							Ref:         ref(v1.ObjectMeta{}.OpenAPIModelName()),
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			v1.ObjectMeta{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_PartialObjectMetadataList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "PartialObjectMetadataList contains a list of objects containing only their metadata",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Default:     map[string]interface{}{},
+							Ref:         ref(v1.ListMeta{}.OpenAPIModelName()),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Description: "items contains each of the included items.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(v1.PartialObjectMetadata{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"items"},
+			},
+		},
+		Dependencies: []string{
+			v1.ListMeta{}.OpenAPIModelName(), v1.PartialObjectMetadata{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_Patch(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Patch is provided to give a concrete name and type to the Kubernetes PATCH request body.",
+				Type:        []string{"object"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_PatchOptions(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "PatchOptions may be provided when patching an API object. PatchOptions is meant to be a superset of UpdateOptions.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"dryRun": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"force": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.",
+							Type:        []string{"boolean"},
+							Format:      "",
+						},
+					},
+					"fieldManager": {
+						SchemaProps: spec.SchemaProps{
+							Description: "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"fieldValidation": {
+						SchemaProps: spec.SchemaProps{
+							Description: "fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_Preconditions(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"uid": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Specifies the target UID.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"resourceVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Specifies the target ResourceVersion",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_RootPaths(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "RootPaths lists the paths available at root. For example: \"/healthz\", \"/apis\".",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"paths": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "paths are the paths available at root.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"paths"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_ServerAddressByClientCIDR(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "ServerAddressByClientCIDR helps the client to determine the server address that they should use, depending on the clientCIDR that they match.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"clientCIDR": {
+						SchemaProps: spec.SchemaProps{
+							Description: "The CIDR with which clients can match their IP to figure out the server address that they should use.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"serverAddress": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Address of this server, suitable for a client that matches the above CIDR. This can be a hostname, hostname:port, IP or IP:port.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"clientCIDR", "serverAddress"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_ShardInfo(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "ShardInfo describes the shard selector that was applied to produce a list response. Its presence on a list response indicates the list is a filtered subset.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"selector": {
+						SchemaProps: spec.SchemaProps{
+							Description: "selector is the shard selector string from the request, echoed back so clients can verify which shard they received and merge responses from multiple shards.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"selector"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_Status(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Status is a return value for calls that don't return other objects.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Default:     map[string]interface{}{},
+							Ref:         ref(v1.ListMeta{}.OpenAPIModelName()),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Status of the operation. One of: \"Success\" or \"Failure\". More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"message": {
+						SchemaProps: spec.SchemaProps{
+							Description: "A human-readable description of the status of this operation.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"reason": {
+						SchemaProps: spec.SchemaProps{
+							Description: "A machine-readable description of why this operation is in the \"Failure\" status. If this value is empty there is no information available. A Reason clarifies an HTTP status code but does not override it.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"details": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Extended data associated with the reason.  Each reason may define its own extended details. This field is optional and the data returned is not guaranteed to conform to any schema except that defined by the reason type.",
+							Ref:         ref(v1.StatusDetails{}.OpenAPIModelName()),
+						},
+					},
+					"code": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Suggested HTTP return code for this status, 0 if not set.",
+							Type:        []string{"integer"},
+							Format:      "int32",
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			v1.ListMeta{}.OpenAPIModelName(), v1.StatusDetails{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_StatusCause(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "StatusCause provides more information about an api.Status failure, including cases when multiple errors are encountered.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"reason": {
+						SchemaProps: spec.SchemaProps{
+							Description: "A machine-readable description of the cause of the error. If this value is empty there is no information available.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"message": {
+						SchemaProps: spec.SchemaProps{
+							Description: "A human-readable description of the cause of the error.  This field may be presented as-is to a reader.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"field": {
+						SchemaProps: spec.SchemaProps{
+							Description: "The field of the resource that has caused this error, as named by its JSON serialization. May include dot and postfix notation for nested attributes. Arrays are zero-indexed.  Fields may appear more than once in an array of causes due to fields having multiple errors. Optional.\n\nExamples:\n  \"name\" - the field \"name\" on the current resource\n  \"items[0].name\" - the field \"name\" on the first array entry in \"items\"",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_StatusDetails(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "StatusDetails is a set of additional properties that MAY be set by the server to provide additional information about a response. The Reason field of a Status object defines what attributes will be set. Clients must ignore fields that do not match the defined type of each attribute, and should assume that any attribute may be empty, invalid, or under defined.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "The name attribute of the resource associated with the status StatusReason (when there is a single name which can be described).",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"group": {
+						SchemaProps: spec.SchemaProps{
+							Description: "The group attribute of the resource associated with the status StatusReason.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "The kind attribute of the resource associated with the status StatusReason. On some operations may differ from the requested resource Kind. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"uid": {
+						SchemaProps: spec.SchemaProps{
+							Description: "UID of the resource. (when there is a single resource which can be described). More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"causes": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "The Causes array includes more details associated with the StatusReason failure. Not all StatusReasons may provide detailed causes.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(v1.StatusCause{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+					"retryAfterSeconds": {
+						SchemaProps: spec.SchemaProps{
+							Description: "If specified, the time in seconds before the operation should be retried. Some errors may indicate the client must take an alternate action - for those errors this field may indicate how long to wait before taking the alternate action.",
+							Type:        []string{"integer"},
+							Format:      "int32",
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			v1.StatusCause{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_Table(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Table is a tabular representation of a set of API resources. The server transforms the object into a set of preferred columns for quickly reviewing the objects.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Default:     map[string]interface{}{},
+							Ref:         ref(v1.ListMeta{}.OpenAPIModelName()),
+						},
+					},
+					"columnDefinitions": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "columnDefinitions describes each column in the returned items array. The number of cells per row will always match the number of column definitions.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(v1.TableColumnDefinition{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+					"rows": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "rows is the list of items in the table.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(v1.TableRow{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"columnDefinitions", "rows"},
+			},
+		},
+		Dependencies: []string{
+			v1.ListMeta{}.OpenAPIModelName(), v1.TableColumnDefinition{}.OpenAPIModelName(), v1.TableRow{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_TableColumnDefinition(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "TableColumnDefinition contains information about a column returned in the Table.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "name is a human readable name for the column.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"type": {
+						SchemaProps: spec.SchemaProps{
+							Description: "type is an OpenAPI type definition for this column, such as number, integer, string, or array. See https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#data-types for more.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"format": {
+						SchemaProps: spec.SchemaProps{
+							Description: "format is an optional OpenAPI type modifier for this column. A format modifies the type and imposes additional rules, like date or time formatting for a string. The 'name' format is applied to the primary identifier column which has type 'string' to assist in clients identifying column is the resource name. See https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#data-types for more.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"description": {
+						SchemaProps: spec.SchemaProps{
+							Description: "description is a human readable description of this column.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"priority": {
+						SchemaProps: spec.SchemaProps{
+							Description: "priority is an integer defining the relative importance of this column compared to others. Lower numbers are considered higher priority. Columns that may be omitted in limited space scenarios should be given a higher priority.",
+							Default:     0,
+							Type:        []string{"integer"},
+							Format:      "int32",
+						},
+					},
+				},
+				Required: []string{"name", "type", "format", "description", "priority"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_TableOptions(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "TableOptions are used when a Table is requested by the caller.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"includeObject": {
+						SchemaProps: spec.SchemaProps{
+							Description: "includeObject decides whether to include each object along with its columnar information. Specifying \"None\" will return no object, specifying \"Object\" will return the full object contents, and specifying \"Metadata\" (the default) will return the object's metadata in the PartialObjectMetadata kind in version v1beta1 of the meta.k8s.io API group.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_TableRow(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "TableRow is an individual row in a table.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"cells": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "cells will be as wide as the column definitions array and may contain strings, numbers (float64 or int64), booleans, simple maps, lists, or null. See the type field of the column definition for a more detailed description.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"object"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"conditions": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "conditions describe additional status of a row that are relevant for a human user. These conditions apply to the row, not to the object, and will be specific to table output. The only defined condition type is 'Completed', for a row that indicates a resource that has run to completion and can be given less visual priority.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(v1.TableRowCondition{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+					"object": {
+						SchemaProps: spec.SchemaProps{
+							Description: "This field contains the requested additional information about each object based on the includeObject policy when requesting the Table. If \"None\", this field is empty, if \"Object\" this will be the default serialization of the object for the current API version, and if \"Metadata\" (the default) will contain the object metadata. Check the returned kind and apiVersion of the object before parsing. The media type of the object will always match the enclosing list - if this as a JSON table, these will be JSON encoded objects.",
+							Ref:         ref(runtime.RawExtension{}.OpenAPIModelName()),
+						},
+					},
+				},
+				Required: []string{"cells"},
+			},
+		},
+		Dependencies: []string{
+			v1.TableRowCondition{}.OpenAPIModelName(), runtime.RawExtension{}.OpenAPIModelName()},
+	}
+}
+
+func schema_pkg_apis_meta_v1_TableRowCondition(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "TableRowCondition allows a row to be marked with additional information.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"type": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Type of row condition. The only defined value is 'Completed' indicating that the object this row represents has reached a completed state and may be given less visual priority than other rows. Clients are not required to honor any conditions but should be consistent where possible about handling the conditions.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Status of the condition, one of True, False, Unknown.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"reason": {
+						SchemaProps: spec.SchemaProps{
+							Description: "(brief) machine readable reason for the condition's last transition.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"message": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Human readable message indicating details about last transition.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"type", "status"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_Time(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON.  Wrappers are provided for many of the factory methods that the time package offers.",
+				Type:        v1.Time{}.OpenAPISchemaType(),
+				Format:      v1.Time{}.OpenAPISchemaFormat(),
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_Timestamp(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Timestamp is a struct that is equivalent to Time, but intended for protobuf marshalling/unmarshalling. It is generated into a serialization that matches Time. Do not use in Go structs.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"seconds": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z inclusive.",
+							Default:     0,
+							Type:        []string{"integer"},
+							Format:      "int64",
+						},
+					},
+					"nanos": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Non-negative fractions of a second at nanosecond resolution. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be from 0 to 999,999,999 inclusive. This field may be limited in precision depending on context.",
+							Default:     0,
+							Type:        []string{"integer"},
+							Format:      "int32",
+						},
+					},
+				},
+				Required: []string{"seconds", "nanos"},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_TypeMeta(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "TypeMeta describes an individual object in an API response or request with strings representing the type of the object and its API schema version. Structures that are versioned or persisted should inline TypeMeta.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_UpdateOptions(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "UpdateOptions may be provided when updating an API object. All fields in UpdateOptions should also be present in PatchOptions.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"dryRun": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Type:   []string{"string"},
+										Format: "",
+									},
+								},
+							},
+						},
+					},
+					"fieldManager": {
+						SchemaProps: spec.SchemaProps{
+							Description: "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"fieldValidation": {
+						SchemaProps: spec.SchemaProps{
+							Description: "fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_pkg_apis_meta_v1_WatchEvent(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Event represents a single event to a watched resource.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"type": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"object": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Object is:\n * If Type is Added or Modified: the new state of the object.\n * If Type is Deleted: the state of the object immediately before deletion.\n * If Type is Error: *Status is recommended; other types may make sense\n   depending on context.",
+							Ref:         ref(runtime.RawExtension{}.OpenAPIModelName()),
+						},
+					},
+				},
+				Required: []string{"type", "object"},
+			},
+		},
+		Dependencies: []string{
+			runtime.RawExtension{}.OpenAPIModelName()},
+	}
+}
+
+func schema_k8sio_apimachinery_pkg_runtime_RawExtension(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "RawExtension is used to hold extensions in external versions.\n\nTo use this, make a field which has RawExtension as its type in your external, versioned struct, and Object in your internal struct. You also need to register your various plugin types.\n\n// Internal package:\n\n\ttype MyAPIObject struct {\n\t\truntime.TypeMeta `json:\"\"`\n\t\tMyPlugin runtime.Object `json:\"myPlugin\"`\n\t}\n\n\ttype PluginA struct {\n\t\tAOption string `json:\"aOption\"`\n\t}\n\n// External package:\n\n\ttype MyAPIObject struct {\n\t\truntime.TypeMeta `json:\"\"`\n\t\tMyPlugin runtime.RawExtension `json:\"myPlugin\"`\n\t}\n\n\ttype PluginA struct {\n\t\tAOption string `json:\"aOption\"`\n\t}\n\n// On the wire, the JSON will look something like this:\n\n\t{\n\t\t\"kind\":\"MyAPIObject\",\n\t\t\"apiVersion\":\"v1\",\n\t\t\"myPlugin\": {\n\t\t\t\"kind\":\"PluginA\",\n\t\t\t\"aOption\":\"foo\",\n\t\t},\n\t}\n\nSo what happens? Decode first uses json or yaml to unmarshal the serialized data into your external MyAPIObject. That causes the raw JSON to be stored, but not unpacked. The next step is to copy (using pkg/conversion) into the internal struct. The runtime package's DefaultScheme has conversion functions installed which will unpack the JSON stored in RawExtension, turning it into the correct object type, and storing it in the Object. (TODO: In the case where the object is of an unknown type, a runtime.Unknown object will be created and stored.)",
+				Type:        []string{"object"},
+			},
+		},
+	}
+}
+
+func schema_k8sio_apimachinery_pkg_runtime_TypeMeta(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "TypeMeta is shared by all top level objects. The proper way to use it is to inline it in your type, like this:\n\n\ttype MyAwesomeAPIObject struct {\n\t     runtime.TypeMeta    `json:\"\"`\n\t     ... // other fields\n\t}\n\nfunc (obj *MyAwesomeAPIObject) SetGroupVersionKind(gvk *metav1.GroupVersionKind) { metav1.UpdateTypeMeta(obj,gvk) }; GroupVersionKind() *GroupVersionKind\n\nTypeMeta is provided here for convenience. You may use it directly from this package or define your own with the same fields.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Type:   []string{"string"},
+							Format: "",
+						},
+					},
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Type:   []string{"string"},
+							Format: "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_k8sio_apimachinery_pkg_runtime_Unknown(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Unknown allows api objects with unknown types to be passed-through. This can be used to deal with the API objects from a plug-in. Unknown objects still have functioning TypeMeta features-- kind, version, etc. metadata and field mutatation.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Type:   []string{"string"},
+							Format: "",
+						},
+					},
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Type:   []string{"string"},
+							Format: "",
+						},
+					},
+					"ContentEncoding": {
+						SchemaProps: spec.SchemaProps{
+							Description: "ContentEncoding is encoding used to encode 'Raw' data. Unspecified means no encoding.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"ContentType": {
+						SchemaProps: spec.SchemaProps{
+							Description: "ContentType  is serialization method used to serialize 'Raw'. Unspecified means ContentTypeJSON.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"ContentEncoding", "ContentType"},
+			},
+		},
+	}
+}
+
+func schema_k8sio_apimachinery_pkg_version_Info(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Info contains versioning information. how we'll want to distribute that information.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"major": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Major is the major version of the binary version",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"minor": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Minor is the minor version of the binary version",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"emulationMajor": {
+						SchemaProps: spec.SchemaProps{
+							Description: "EmulationMajor is the major version of the emulation version",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"emulationMinor": {
+						SchemaProps: spec.SchemaProps{
+							Description: "EmulationMinor is the minor version of the emulation version",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"minCompatibilityMajor": {
+						SchemaProps: spec.SchemaProps{
+							Description: "MinCompatibilityMajor is the major version of the minimum compatibility version",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"minCompatibilityMinor": {
+						SchemaProps: spec.SchemaProps{
+							Description: "MinCompatibilityMinor is the minor version of the minimum compatibility version",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"gitVersion": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"gitCommit": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"gitTreeState": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"buildDate": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"goVersion": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"compiler": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"platform": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"major", "minor", "gitVersion", "gitCommit", "gitTreeState", "buildDate", "goVersion", "compiler", "platform"},
+			},
+		},
+	}
+}
+
+func schema_apiserver_apis_core_v1_TestType(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "TestType is a top-level type. A client is created for it.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref(v1.ObjectMeta{}.OpenAPIModelName()),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref(corev1.TestTypeStatus{}.OpenAPIModelName()),
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			v1.ObjectMeta{}.OpenAPIModelName(), corev1.TestTypeStatus{}.OpenAPIModelName()},
+	}
+}
+
+func schema_apiserver_apis_core_v1_TestTypeList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "TestTypeList is a top-level list type. The client methods for lists are automatically created. You are not supposed to create a separated client for this one.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref(v1.ListMeta{}.OpenAPIModelName()),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(corev1.TestType{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"items"},
+			},
+		},
+		Dependencies: []string{
+			v1.ListMeta{}.OpenAPIModelName(), corev1.TestType{}.OpenAPIModelName()},
+	}
+}
+
+func schema_apiserver_apis_core_v1_TestTypeStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"blah": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"blah"},
+			},
+		},
+	}
+}
+
+func schema_apiserver_apis_example_v1_Conversion(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"identical": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref(examplev1.MemoryIdentical{}.OpenAPIModelName()),
+						},
+					},
+					"different": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref(examplev1.MemoryDifferent{}.OpenAPIModelName()),
+						},
+					},
+				},
+				Required: []string{"identical", "different"},
+			},
+		},
+		Dependencies: []string{
+			examplev1.MemoryDifferent{}.OpenAPIModelName(), examplev1.MemoryIdentical{}.OpenAPIModelName()},
+	}
+}
+
+func schema_apiserver_apis_example_v1_ConversionCustom(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"publicField": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"privateField": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"publicField", "privateField"},
+			},
+		},
+	}
+}
+
+func schema_apiserver_apis_example_v1_ConversionCustomContainer(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"slice": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(examplev1.ConversionCustom{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+					"sliceP": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(examplev1.ConversionCustom{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+					"map": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(examplev1.ConversionCustom{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+					"mapP": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(examplev1.ConversionCustom{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+					"struct": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref(examplev1.ConversionCustom{}.OpenAPIModelName()),
+						},
+					},
+					"structP": {
+						SchemaProps: spec.SchemaProps{
+							Ref: ref(examplev1.ConversionCustom{}.OpenAPIModelName()),
+						},
+					},
+				},
+				Required: []string{"slice", "sliceP", "map", "mapP", "struct", "structP"},
+			},
+		},
+		Dependencies: []string{
+			examplev1.ConversionCustom{}.OpenAPIModelName()},
+	}
+}
+
+func schema_apiserver_apis_example_v1_ConversionPrivate(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"publicField": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"privateField": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"publicField", "privateField"},
+			},
+		},
+	}
+}
+
+func schema_apiserver_apis_example_v1_MemoryDifferent(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Ref: ref(examplev1.MemoryDifferent{}.OpenAPIModelName()),
+						},
+					},
+					"properties": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(examplev1.MemoryDifferent{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+					"allOf": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(examplev1.MemoryDifferent{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+					"bool": {
+						SchemaProps: spec.SchemaProps{
+							Type:   []string{"boolean"},
+							Format: "",
+						},
+					},
+				},
+				Required: []string{"bool"},
+			},
+		},
+		Dependencies: []string{
+			examplev1.MemoryDifferent{}.OpenAPIModelName()},
+	}
+}
+
+func schema_apiserver_apis_example_v1_MemoryIdentical(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Ref: ref(examplev1.MemoryIdentical{}.OpenAPIModelName()),
+						},
+					},
+					"properties": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(examplev1.MemoryIdentical{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+					"allOf": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(examplev1.MemoryIdentical{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+					"bool": {
+						SchemaProps: spec.SchemaProps{
+							Default: false,
+							Type:    []string{"boolean"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"bool"},
+			},
+		},
+		Dependencies: []string{
+			examplev1.MemoryIdentical{}.OpenAPIModelName()},
+	}
+}
+
+func schema_apiserver_apis_example_v1_TestType(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "TestType is a top-level type. A client is created for it.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref(v1.ObjectMeta{}.OpenAPIModelName()),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref(examplev1.TestTypeStatus{}.OpenAPIModelName()),
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			v1.ObjectMeta{}.OpenAPIModelName(), examplev1.TestTypeStatus{}.OpenAPIModelName()},
+	}
+}
+
+func schema_apiserver_apis_example_v1_TestTypeList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "TestTypeList is a top-level list type. The client methods for lists are automatically created. You are not supposed to create a separated client for this one.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref(v1.ListMeta{}.OpenAPIModelName()),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(examplev1.TestType{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"items"},
+			},
+		},
+		Dependencies: []string{
+			v1.ListMeta{}.OpenAPIModelName(), examplev1.TestType{}.OpenAPIModelName()},
+	}
+}
+
+func schema_apiserver_apis_example_v1_TestTypeStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"blah": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"blah"},
+			},
+		},
+	}
+}
+
+func schema_apiserver_apis_example2_v1_TestType(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "TestType is a top-level type. A client is created for it.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref(v1.ObjectMeta{}.OpenAPIModelName()),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref(example2v1.TestTypeStatus{}.OpenAPIModelName()),
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			v1.ObjectMeta{}.OpenAPIModelName(), example2v1.TestTypeStatus{}.OpenAPIModelName()},
+	}
+}
+
+func schema_apiserver_apis_example2_v1_TestTypeList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "TestTypeList is a top-level list type. The client methods for lists are automatically created. You are not supposed to create a separated client for this one.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref(v1.ListMeta{}.OpenAPIModelName()),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(example2v1.TestType{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"items"},
+			},
+		},
+		Dependencies: []string{
+			v1.ListMeta{}.OpenAPIModelName(), example2v1.TestType{}.OpenAPIModelName()},
+	}
+}
+
+func schema_apiserver_apis_example2_v1_TestTypeStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"blah": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"blah"},
+			},
+		},
+	}
+}
+
+func schema_apiserver_apis_example3io_v1_TestType(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "TestType is a top-level type. A client is created for it.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref(v1.ObjectMeta{}.OpenAPIModelName()),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref(example3iov1.TestTypeStatus{}.OpenAPIModelName()),
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			v1.ObjectMeta{}.OpenAPIModelName(), example3iov1.TestTypeStatus{}.OpenAPIModelName()},
+	}
+}
+
+func schema_apiserver_apis_example3io_v1_TestTypeList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "TestTypeList is a top-level list type. The client methods for lists are automatically created. You are not supposed to create a separated client for this one.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref(v1.ListMeta{}.OpenAPIModelName()),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref(example3iov1.TestType{}.OpenAPIModelName()),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"items"},
+			},
+		},
+		Dependencies: []string{
+			v1.ListMeta{}.OpenAPIModelName(), example3iov1.TestType{}.OpenAPIModelName()},
+	}
+}
+
+func schema_apiserver_apis_example3io_v1_TestTypeStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"blah": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"blah"},
+			},
+		},
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/conflicting/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/conflicting/v1/doc.go
new file mode 100644
index 0000000000..76620d2ef5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/conflicting/v1/doc.go
@@ -0,0 +1,22 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=conflicting.test.crd.code-generator.k8s.io
+// +groupGoName=ConflictingExample
+
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/conflicting/v1/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/conflicting/v1/types.go
new file mode 100644
index 0000000000..b3015f669e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/conflicting/v1/types.go
@@ -0,0 +1,64 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gwv1alpha2 "k8s.io/code-generator/examples/crd/apis/gateway-api/v1alpha2"
+)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestType is a top-level type. A client is created for it.
+type TestType struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +optional
+	Status TestTypeStatus `json:"status,omitempty"`
+
+	TestEmbeddedType `json:"embedded"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestTypeList is a top-level list type. The client methods for lists are automatically created.
+// You are not supposed to create a separate client for this one.
+type TestTypeList struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []TestType `json:"items"`
+}
+
+type TestTypeStatus struct {
+	Blah                    string `json:"blah"`
+	gwv1alpha2.PolicyStatus `json:""`
+}
+
+type TestTypeEmbeddedStatus struct {
+	Statuses []TestTypeEmbeddedStatus `json:"statuses"`
+}
+
+// TestEmbeddedType is a type intended to create conflicts with other embedded structs:
+// Kind conflicts with TypeMeta (inlined), and Namespace conflicts with ObjectMeta (embedded).
+type TestEmbeddedType struct {
+	Kind      string `json:"kind"`
+	Namespace string `json:"namespace"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/conflicting/v1/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/conflicting/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..36d2e1d3b2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/conflicting/v1/zz_generated.deepcopy.go
@@ -0,0 +1,143 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestEmbeddedType) DeepCopyInto(out *TestEmbeddedType) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestEmbeddedType.
+func (in *TestEmbeddedType) DeepCopy() *TestEmbeddedType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestEmbeddedType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType) DeepCopyInto(out *TestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Status.DeepCopyInto(&out.Status)
+	out.TestEmbeddedType = in.TestEmbeddedType
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType.
+func (in *TestType) DeepCopy() *TestType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeEmbeddedStatus) DeepCopyInto(out *TestTypeEmbeddedStatus) {
+	*out = *in
+	if in.Statuses != nil {
+		in, out := &in.Statuses, &out.Statuses
+		*out = make([]TestTypeEmbeddedStatus, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeEmbeddedStatus.
+func (in *TestTypeEmbeddedStatus) DeepCopy() *TestTypeEmbeddedStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeEmbeddedStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeList) DeepCopyInto(out *TestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeList.
+func (in *TestTypeList) DeepCopy() *TestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeStatus) DeepCopyInto(out *TestTypeStatus) {
+	*out = *in
+	in.PolicyStatus.DeepCopyInto(&out.PolicyStatus)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeStatus.
+func (in *TestTypeStatus) DeepCopy() *TestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/conflicting/v1/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/conflicting/v1/zz_generated.defaults.go
new file mode 100644
index 0000000000..dac177e93b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/conflicting/v1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/conflicting/v1/zz_generated.register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/conflicting/v1/zz_generated.register.go
new file mode 100644
index 0000000000..778075a072
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/conflicting/v1/zz_generated.register.go
@@ -0,0 +1,71 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by register-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName specifies the group name used to register the objects.
+const GroupName = "conflicting.test.crd.code-generator.k8s.io"
+
+// GroupVersion specifies the group and the version used to register the objects.
+var GroupVersion = metav1.GroupVersion{Group: GroupName, Version: "v1"}
+
+// SchemeGroupVersion is group version used to register these objects
+//
+// Deprecated: use GroupVersion instead.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	// Deprecated: use Install instead
+	AddToScheme = localSchemeBuilder.AddToScheme
+	Install     = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&TestType{},
+		&TestTypeList{},
+	)
+	// AddToGroupVersion allows the serialization of client types like ListOptions.
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example/v1/doc.go
new file mode 100644
index 0000000000..673ac55d7b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example/v1/doc.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=example.crd.code-generator.k8s.io
+
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example/v1/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example/v1/types.go
new file mode 100644
index 0000000000..2f7f605d2c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example/v1/types.go
@@ -0,0 +1,79 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +genclient:method=GetClusterTestType,verb=get
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestType is a top-level type. A client is created for it.
+type TestType struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +optional
+	Status TestTypeStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestTypeList is a top-level list type. The client methods for lists are automatically created.
+// You are not supposed to create a separated client for this one.
+type TestTypeList struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []TestType `json:"items"`
+}
+
+type TestTypeStatus struct {
+	Blah string `json:"blah"`
+}
+
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+type ClusterTestTypeList struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []ClusterTestType `json:"items"`
+}
+
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +genclient:method=GetScale,verb=get,subresource=scale,result=k8s.io/api/autoscaling/v1.Scale
+// +genclient:method=UpdateScale,verb=update,subresource=scale,input=k8s.io/api/autoscaling/v1.Scale,result=k8s.io/api/autoscaling/v1.Scale
+
+type ClusterTestType struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +optional
+	Status ClusterTestTypeStatus `json:"status,omitempty"`
+}
+
+// Struct level comment
+type ClusterTestTypeStatus struct {
+	// Field level comment
+	Blah string `json:"blah"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example/v1/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..5eee47016b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example/v1/zz_generated.deepcopy.go
@@ -0,0 +1,178 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterTestType) DeepCopyInto(out *ClusterTestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTestType.
+func (in *ClusterTestType) DeepCopy() *ClusterTestType {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterTestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterTestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterTestTypeList) DeepCopyInto(out *ClusterTestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ClusterTestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTestTypeList.
+func (in *ClusterTestTypeList) DeepCopy() *ClusterTestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterTestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterTestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterTestTypeStatus) DeepCopyInto(out *ClusterTestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTestTypeStatus.
+func (in *ClusterTestTypeStatus) DeepCopy() *ClusterTestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterTestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType) DeepCopyInto(out *TestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType.
+func (in *TestType) DeepCopy() *TestType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeList) DeepCopyInto(out *TestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeList.
+func (in *TestTypeList) DeepCopy() *TestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeStatus) DeepCopyInto(out *TestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeStatus.
+func (in *TestTypeStatus) DeepCopy() *TestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example/v1/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example/v1/zz_generated.defaults.go
new file mode 100644
index 0000000000..dac177e93b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example/v1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example/v1/zz_generated.register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example/v1/zz_generated.register.go
new file mode 100644
index 0000000000..a587c37bc9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example/v1/zz_generated.register.go
@@ -0,0 +1,73 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by register-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName specifies the group name used to register the objects.
+const GroupName = "example.crd.code-generator.k8s.io"
+
+// GroupVersion specifies the group and the version used to register the objects.
+var GroupVersion = metav1.GroupVersion{Group: GroupName, Version: "v1"}
+
+// SchemeGroupVersion is group version used to register these objects
+//
+// Deprecated: use GroupVersion instead.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	// Deprecated: use Install instead
+	AddToScheme = localSchemeBuilder.AddToScheme
+	Install     = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&ClusterTestType{},
+		&ClusterTestTypeList{},
+		&TestType{},
+		&TestTypeList{},
+	)
+	// AddToGroupVersion allows the serialization of client types like ListOptions.
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example2/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example2/v1/doc.go
new file mode 100644
index 0000000000..5d1cbec5ef
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example2/v1/doc.go
@@ -0,0 +1,22 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=example.test.crd.code-generator.k8s.io
+// +groupGoName=SecondExample
+
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example2/v1/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example2/v1/types.go
new file mode 100644
index 0000000000..3ae1f96721
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example2/v1/types.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestType is a top-level type. A client is created for it.
+type TestType struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +optional
+	Status TestTypeStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestTypeList is a top-level list type. The client methods for lists are automatically created.
+// You are not supposed to create a separated client for this one.
+type TestTypeList struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []TestType `json:"items"`
+}
+
+type TestTypeStatus struct {
+	Blah string `json:"blah"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example2/v1/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example2/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..d87f706f77
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example2/v1/zz_generated.deepcopy.go
@@ -0,0 +1,102 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType) DeepCopyInto(out *TestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType.
+func (in *TestType) DeepCopy() *TestType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeList) DeepCopyInto(out *TestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeList.
+func (in *TestTypeList) DeepCopy() *TestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeStatus) DeepCopyInto(out *TestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeStatus.
+func (in *TestTypeStatus) DeepCopy() *TestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example2/v1/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example2/v1/zz_generated.defaults.go
new file mode 100644
index 0000000000..dac177e93b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example2/v1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example2/v1/zz_generated.register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example2/v1/zz_generated.register.go
new file mode 100644
index 0000000000..89a9645666
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/example2/v1/zz_generated.register.go
@@ -0,0 +1,71 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by register-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName specifies the group name used to register the objects.
+const GroupName = "example.test.crd.code-generator.k8s.io"
+
+// GroupVersion specifies the group and the version used to register the objects.
+var GroupVersion = metav1.GroupVersion{Group: GroupName, Version: "v1"}
+
+// SchemeGroupVersion is group version used to register these objects
+//
+// Deprecated: use GroupVersion instead.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	// Deprecated: use Install instead
+	AddToScheme = localSchemeBuilder.AddToScheme
+	Install     = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&TestType{},
+		&TestTypeList{},
+	)
+	// AddToGroupVersion allows the serialization of client types like ListOptions.
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/extensions/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/extensions/v1/doc.go
new file mode 100644
index 0000000000..a90928266b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/extensions/v1/doc.go
@@ -0,0 +1,22 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=extensions.test.crd.code-generator.k8s.io
+// +groupGoName=ExtensionsExample
+
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/extensions/v1/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/extensions/v1/types.go
new file mode 100644
index 0000000000..3e922e9047
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/extensions/v1/types.go
@@ -0,0 +1,65 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +genclient:method=GetExtended,verb=get
+// +genclient:method=ListExtended,verb=list
+// +genclient:method=CreateExtended,verb=create
+// +genclient:method=UpdateExtended,verb=update
+// +genclient:method=PatchExtended,verb=patch
+// +genclient:method=ApplyExtended,verb=apply
+// +genclient:method=GetSubresource,verb=get,subresource=testsubresource,result=k8s.io/code-generator/examples/crd/apis/extensions/v1.TestSubresource
+// +genclient:method=CreateSubresource,verb=create,subresource=testsubresource,input=k8s.io/code-generator/examples/crd/apis/extensions/v1.TestSubresource,result=k8s.io/code-generator/examples/crd/apis/extensions/v1.TestSubresource
+// +genclient:method=UpdateSubresource,verb=update,subresource=subresource,input=k8s.io/code-generator/examples/crd/apis/extensions/v1.TestSubresource,result=k8s.io/code-generator/examples/crd/apis/extensions/v1.TestSubresource
+// +genclient:method=ApplySubresource,verb=apply,subresource=subresource,input=k8s.io/code-generator/examples/crd/apis/extensions/v1.TestSubresource,result=k8s.io/code-generator/examples/crd/apis/extensions/v1.TestSubresource
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestType is a top-level type. A client is created for it.
+type TestType struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +optional
+	Status TestTypeStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+type TestSubresource struct {
+	metav1.TypeMeta `json:""`
+
+	Name string `json:"name"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestTypeList is a top-level list type. The client methods for lists are automatically created.
+// You are not supposed to create a separate client for this one.
+type TestTypeList struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []TestType `json:"items"`
+}
+
+type TestTypeStatus struct {
+	Blah string `json:"blah"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/extensions/v1/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/extensions/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..906252fab9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/extensions/v1/zz_generated.deepcopy.go
@@ -0,0 +1,127 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestSubresource) DeepCopyInto(out *TestSubresource) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestSubresource.
+func (in *TestSubresource) DeepCopy() *TestSubresource {
+	if in == nil {
+		return nil
+	}
+	out := new(TestSubresource)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestSubresource) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType) DeepCopyInto(out *TestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType.
+func (in *TestType) DeepCopy() *TestType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeList) DeepCopyInto(out *TestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeList.
+func (in *TestTypeList) DeepCopy() *TestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeStatus) DeepCopyInto(out *TestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeStatus.
+func (in *TestTypeStatus) DeepCopy() *TestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/extensions/v1/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/extensions/v1/zz_generated.defaults.go
new file mode 100644
index 0000000000..dac177e93b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/extensions/v1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/extensions/v1/zz_generated.register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/extensions/v1/zz_generated.register.go
new file mode 100644
index 0000000000..1fd0f578b1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/extensions/v1/zz_generated.register.go
@@ -0,0 +1,72 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by register-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName specifies the group name used to register the objects.
+const GroupName = "extensions.test.crd.code-generator.k8s.io"
+
+// GroupVersion specifies the group and the version used to register the objects.
+var GroupVersion = metav1.GroupVersion{Group: GroupName, Version: "v1"}
+
+// SchemeGroupVersion is group version used to register these objects
+//
+// Deprecated: use GroupVersion instead.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	// Deprecated: use Install instead
+	AddToScheme = localSchemeBuilder.AddToScheme
+	Install     = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&TestSubresource{},
+		&TestType{},
+		&TestTypeList{},
+	)
+	// AddToGroupVersion allows the serialization of client types like ListOptions.
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/gateway-api/v1/shared_types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/gateway-api/v1/shared_types.go
new file mode 100644
index 0000000000..41453a69e7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/gateway-api/v1/shared_types.go
@@ -0,0 +1,26 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+// Copied from Gateway API as a minimal reproducer for #131533
+
+type ParentReference struct {
+}
+
+func (in *ParentReference) DeepCopyInto(out *ParentReference) {
+	*out = *in
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/gateway-api/v1alpha2/policy_types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/gateway-api/v1alpha2/policy_types.go
new file mode 100644
index 0000000000..e5e1fe9e70
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/apis/gateway-api/v1alpha2/policy_types.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	v1 "k8s.io/code-generator/examples/crd/apis/gateway-api/v1"
+)
+
+// Copied from Gateway API as a minimal reproducer for #131533
+
+type PolicyAncestorStatus struct {
+	AncestorRef v1.ParentReference `json:"ancestorRef"`
+}
+
+type PolicyStatus struct {
+	Ancestors []PolicyAncestorStatus `json:"ancestors"`
+}
+
+func (in *PolicyAncestorStatus) DeepCopyInto(out *PolicyAncestorStatus) {
+	*out = *in
+	in.AncestorRef.DeepCopyInto(&out.AncestorRef)
+}
+
+func (in *PolicyStatus) DeepCopyInto(out *PolicyStatus) {
+	*out = *in
+	if in.Ancestors != nil {
+		in, out := &in.Ancestors, &out.Ancestors
+		*out = make([]PolicyAncestorStatus, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/conflicting/v1/testembeddedtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/conflicting/v1/testembeddedtype.go
new file mode 100644
index 0000000000..f5c25b17ed
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/conflicting/v1/testembeddedtype.go
@@ -0,0 +1,51 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// TestEmbeddedTypeApplyConfiguration represents a declarative configuration of the TestEmbeddedType type for use
+// with apply.
+//
+// TestEmbeddedType is a type intended to create conflicts with other embedded structs:
+// Kind conflicts with TypeMeta (inlined), and Namespace conflicts with ObjectMeta (embedded).
+type TestEmbeddedTypeApplyConfiguration struct {
+	Kind      *string `json:"kind,omitempty"`
+	Namespace *string `json:"namespace,omitempty"`
+}
+
+// TestEmbeddedTypeApplyConfiguration constructs a declarative configuration of the TestEmbeddedType type for use with
+// apply.
+func TestEmbeddedType() *TestEmbeddedTypeApplyConfiguration {
+	return &TestEmbeddedTypeApplyConfiguration{}
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *TestEmbeddedTypeApplyConfiguration) WithKind(value string) *TestEmbeddedTypeApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *TestEmbeddedTypeApplyConfiguration) WithNamespace(value string) *TestEmbeddedTypeApplyConfiguration {
+	b.Namespace = &value
+	return b
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/conflicting/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/conflicting/v1/testtype.go
new file mode 100644
index 0000000000..b08e6c8735
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/conflicting/v1/testtype.go
@@ -0,0 +1,243 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// TestTypeApplyConfiguration represents a declarative configuration of the TestType type for use
+// with apply.
+//
+// TestType is a top-level type. A client is created for it.
+type TestTypeApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration    `json:""`
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Status                               *TestTypeStatusApplyConfiguration `json:"status,omitempty"`
+	*TestEmbeddedTypeApplyConfiguration  `json:"embedded,omitempty"`
+}
+
+// TestType constructs a declarative configuration of the TestType type for use with
+// apply.
+func TestType(name, namespace string) *TestTypeApplyConfiguration {
+	b := &TestTypeApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("TestType")
+	b.WithAPIVersion("conflicting.test.crd.code-generator.k8s.io/v1")
+	return b
+}
+
+func (b TestTypeApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithKind(value string) *TestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithAPIVersion(value string) *TestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithName(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithGenerateName(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithNamespace(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithUID(value types.UID) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithResourceVersion(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithGeneration(value int64) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *TestTypeApplyConfiguration) WithLabels(entries map[string]string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *TestTypeApplyConfiguration) WithAnnotations(entries map[string]string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *TestTypeApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *TestTypeApplyConfiguration) WithFinalizers(values ...string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *TestTypeApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithStatus(value *TestTypeStatusApplyConfiguration) *TestTypeApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+func (b *TestTypeApplyConfiguration) ensureTestEmbeddedTypeApplyConfigurationExists() {
+	if b.TestEmbeddedTypeApplyConfiguration == nil {
+		b.TestEmbeddedTypeApplyConfiguration = &TestEmbeddedTypeApplyConfiguration{}
+	}
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/conflicting/v1/testtypestatus.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/conflicting/v1/testtypestatus.go
new file mode 100644
index 0000000000..49a29bf11f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/conflicting/v1/testtypestatus.go
@@ -0,0 +1,54 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	v1alpha2 "k8s.io/code-generator/examples/crd/apis/gateway-api/v1alpha2"
+)
+
+// TestTypeStatusApplyConfiguration represents a declarative configuration of the TestTypeStatus type for use
+// with apply.
+type TestTypeStatusApplyConfiguration struct {
+	Blah                  *string `json:"blah,omitempty"`
+	v1alpha2.PolicyStatus `json:""`
+}
+
+// TestTypeStatusApplyConfiguration constructs a declarative configuration of the TestTypeStatus type for use with
+// apply.
+func TestTypeStatus() *TestTypeStatusApplyConfiguration {
+	return &TestTypeStatusApplyConfiguration{}
+}
+
+// WithBlah sets the Blah field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Blah field is set to the value of the last call.
+func (b *TestTypeStatusApplyConfiguration) WithBlah(value string) *TestTypeStatusApplyConfiguration {
+	b.Blah = &value
+	return b
+}
+
+// WithAncestors adds the given value to the Ancestors field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Ancestors field.
+func (b *TestTypeStatusApplyConfiguration) WithAncestors(values ...v1alpha2.PolicyAncestorStatus) *TestTypeStatusApplyConfiguration {
+	for i := range values {
+		b.PolicyStatus.Ancestors = append(b.PolicyStatus.Ancestors, values[i])
+	}
+	return b
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example/v1/clustertesttype.go
new file mode 100644
index 0000000000..da165b1fb7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example/v1/clustertesttype.go
@@ -0,0 +1,233 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// ClusterTestTypeApplyConfiguration represents a declarative configuration of the ClusterTestType type for use
+// with apply.
+type ClusterTestTypeApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration    `json:""`
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Status                               *ClusterTestTypeStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// ClusterTestType constructs a declarative configuration of the ClusterTestType type for use with
+// apply.
+func ClusterTestType(name string) *ClusterTestTypeApplyConfiguration {
+	b := &ClusterTestTypeApplyConfiguration{}
+	b.WithName(name)
+	b.WithKind("ClusterTestType")
+	b.WithAPIVersion("example.crd.code-generator.k8s.io/v1")
+	return b
+}
+
+func (b ClusterTestTypeApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithKind(value string) *ClusterTestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithAPIVersion(value string) *ClusterTestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithName(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithGenerateName(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithNamespace(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithUID(value types.UID) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithResourceVersion(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithGeneration(value int64) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *ClusterTestTypeApplyConfiguration) WithLabels(entries map[string]string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *ClusterTestTypeApplyConfiguration) WithAnnotations(entries map[string]string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *ClusterTestTypeApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *ClusterTestTypeApplyConfiguration) WithFinalizers(values ...string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *ClusterTestTypeApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithStatus(value *ClusterTestTypeStatusApplyConfiguration) *ClusterTestTypeApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example/v1/clustertesttypestatus.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example/v1/clustertesttypestatus.go
new file mode 100644
index 0000000000..be3302c930
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example/v1/clustertesttypestatus.go
@@ -0,0 +1,42 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// ClusterTestTypeStatusApplyConfiguration represents a declarative configuration of the ClusterTestTypeStatus type for use
+// with apply.
+//
+// Struct level comment
+type ClusterTestTypeStatusApplyConfiguration struct {
+	// Field level comment
+	Blah *string `json:"blah,omitempty"`
+}
+
+// ClusterTestTypeStatusApplyConfiguration constructs a declarative configuration of the ClusterTestTypeStatus type for use with
+// apply.
+func ClusterTestTypeStatus() *ClusterTestTypeStatusApplyConfiguration {
+	return &ClusterTestTypeStatusApplyConfiguration{}
+}
+
+// WithBlah sets the Blah field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Blah field is set to the value of the last call.
+func (b *ClusterTestTypeStatusApplyConfiguration) WithBlah(value string) *ClusterTestTypeStatusApplyConfiguration {
+	b.Blah = &value
+	return b
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example/v1/testtype.go
new file mode 100644
index 0000000000..154a69209a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example/v1/testtype.go
@@ -0,0 +1,236 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// TestTypeApplyConfiguration represents a declarative configuration of the TestType type for use
+// with apply.
+//
+// TestType is a top-level type. A client is created for it.
+type TestTypeApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration    `json:""`
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Status                               *TestTypeStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// TestType constructs a declarative configuration of the TestType type for use with
+// apply.
+func TestType(name, namespace string) *TestTypeApplyConfiguration {
+	b := &TestTypeApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("TestType")
+	b.WithAPIVersion("example.crd.code-generator.k8s.io/v1")
+	return b
+}
+
+func (b TestTypeApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithKind(value string) *TestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithAPIVersion(value string) *TestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithName(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithGenerateName(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithNamespace(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithUID(value types.UID) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithResourceVersion(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithGeneration(value int64) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *TestTypeApplyConfiguration) WithLabels(entries map[string]string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *TestTypeApplyConfiguration) WithAnnotations(entries map[string]string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *TestTypeApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *TestTypeApplyConfiguration) WithFinalizers(values ...string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *TestTypeApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithStatus(value *TestTypeStatusApplyConfiguration) *TestTypeApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example/v1/testtypestatus.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example/v1/testtypestatus.go
new file mode 100644
index 0000000000..246b2ee188
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example/v1/testtypestatus.go
@@ -0,0 +1,39 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// TestTypeStatusApplyConfiguration represents a declarative configuration of the TestTypeStatus type for use
+// with apply.
+type TestTypeStatusApplyConfiguration struct {
+	Blah *string `json:"blah,omitempty"`
+}
+
+// TestTypeStatusApplyConfiguration constructs a declarative configuration of the TestTypeStatus type for use with
+// apply.
+func TestTypeStatus() *TestTypeStatusApplyConfiguration {
+	return &TestTypeStatusApplyConfiguration{}
+}
+
+// WithBlah sets the Blah field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Blah field is set to the value of the last call.
+func (b *TestTypeStatusApplyConfiguration) WithBlah(value string) *TestTypeStatusApplyConfiguration {
+	b.Blah = &value
+	return b
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example2/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example2/v1/testtype.go
new file mode 100644
index 0000000000..6223ecb34a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example2/v1/testtype.go
@@ -0,0 +1,236 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// TestTypeApplyConfiguration represents a declarative configuration of the TestType type for use
+// with apply.
+//
+// TestType is a top-level type. A client is created for it.
+type TestTypeApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration    `json:""`
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Status                               *TestTypeStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// TestType constructs a declarative configuration of the TestType type for use with
+// apply.
+func TestType(name, namespace string) *TestTypeApplyConfiguration {
+	b := &TestTypeApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("TestType")
+	b.WithAPIVersion("example.test.crd.code-generator.k8s.io/v1")
+	return b
+}
+
+func (b TestTypeApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithKind(value string) *TestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithAPIVersion(value string) *TestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithName(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithGenerateName(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithNamespace(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithUID(value types.UID) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithResourceVersion(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithGeneration(value int64) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *TestTypeApplyConfiguration) WithLabels(entries map[string]string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *TestTypeApplyConfiguration) WithAnnotations(entries map[string]string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *TestTypeApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *TestTypeApplyConfiguration) WithFinalizers(values ...string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *TestTypeApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithStatus(value *TestTypeStatusApplyConfiguration) *TestTypeApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example2/v1/testtypestatus.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example2/v1/testtypestatus.go
new file mode 100644
index 0000000000..246b2ee188
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/example2/v1/testtypestatus.go
@@ -0,0 +1,39 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// TestTypeStatusApplyConfiguration represents a declarative configuration of the TestTypeStatus type for use
+// with apply.
+type TestTypeStatusApplyConfiguration struct {
+	Blah *string `json:"blah,omitempty"`
+}
+
+// TestTypeStatusApplyConfiguration constructs a declarative configuration of the TestTypeStatus type for use with
+// apply.
+func TestTypeStatus() *TestTypeStatusApplyConfiguration {
+	return &TestTypeStatusApplyConfiguration{}
+}
+
+// WithBlah sets the Blah field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Blah field is set to the value of the last call.
+func (b *TestTypeStatusApplyConfiguration) WithBlah(value string) *TestTypeStatusApplyConfiguration {
+	b.Blah = &value
+	return b
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/extensions/v1/testsubresource.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/extensions/v1/testsubresource.go
new file mode 100644
index 0000000000..464745bcf6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/extensions/v1/testsubresource.go
@@ -0,0 +1,75 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// TestSubresourceApplyConfiguration represents a declarative configuration of the TestSubresource type for use
+// with apply.
+type TestSubresourceApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration `json:""`
+	Name                              *string `json:"name,omitempty"`
+}
+
+// TestSubresourceApplyConfiguration constructs a declarative configuration of the TestSubresource type for use with
+// apply.
+func TestSubresource() *TestSubresourceApplyConfiguration {
+	b := &TestSubresourceApplyConfiguration{}
+	b.WithKind("TestSubresource")
+	b.WithAPIVersion("extensions.test.crd.code-generator.k8s.io/v1")
+	return b
+}
+
+func (b TestSubresourceApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *TestSubresourceApplyConfiguration) WithKind(value string) *TestSubresourceApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *TestSubresourceApplyConfiguration) WithAPIVersion(value string) *TestSubresourceApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *TestSubresourceApplyConfiguration) WithName(value string) *TestSubresourceApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TestSubresourceApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TestSubresourceApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/extensions/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/extensions/v1/testtype.go
new file mode 100644
index 0000000000..f030e5af51
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/extensions/v1/testtype.go
@@ -0,0 +1,236 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// TestTypeApplyConfiguration represents a declarative configuration of the TestType type for use
+// with apply.
+//
+// TestType is a top-level type. A client is created for it.
+type TestTypeApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration    `json:""`
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Status                               *TestTypeStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// TestType constructs a declarative configuration of the TestType type for use with
+// apply.
+func TestType(name, namespace string) *TestTypeApplyConfiguration {
+	b := &TestTypeApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("TestType")
+	b.WithAPIVersion("extensions.test.crd.code-generator.k8s.io/v1")
+	return b
+}
+
+func (b TestTypeApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithKind(value string) *TestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithAPIVersion(value string) *TestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithName(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithGenerateName(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithNamespace(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithUID(value types.UID) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithResourceVersion(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithGeneration(value int64) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *TestTypeApplyConfiguration) WithLabels(entries map[string]string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *TestTypeApplyConfiguration) WithAnnotations(entries map[string]string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *TestTypeApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *TestTypeApplyConfiguration) WithFinalizers(values ...string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *TestTypeApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithStatus(value *TestTypeStatusApplyConfiguration) *TestTypeApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/extensions/v1/testtypestatus.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/extensions/v1/testtypestatus.go
new file mode 100644
index 0000000000..246b2ee188
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/extensions/v1/testtypestatus.go
@@ -0,0 +1,39 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// TestTypeStatusApplyConfiguration represents a declarative configuration of the TestTypeStatus type for use
+// with apply.
+type TestTypeStatusApplyConfiguration struct {
+	Blah *string `json:"blah,omitempty"`
+}
+
+// TestTypeStatusApplyConfiguration constructs a declarative configuration of the TestTypeStatus type for use with
+// apply.
+func TestTypeStatus() *TestTypeStatusApplyConfiguration {
+	return &TestTypeStatusApplyConfiguration{}
+}
+
+// WithBlah sets the Blah field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Blah field is set to the value of the last call.
+func (b *TestTypeStatusApplyConfiguration) WithBlah(value string) *TestTypeStatusApplyConfiguration {
+	b.Blah = &value
+	return b
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/internal/internal.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/internal/internal.go
new file mode 100644
index 0000000000..c482faa5c2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/internal/internal.go
@@ -0,0 +1,62 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package internal
+
+import (
+	fmt "fmt"
+	sync "sync"
+
+	typed "sigs.k8s.io/structured-merge-diff/v6/typed"
+)
+
+func Parser() *typed.Parser {
+	parserOnce.Do(func() {
+		var err error
+		parser, err = typed.NewParser(schemaYAML)
+		if err != nil {
+			panic(fmt.Sprintf("Failed to parse schema: %v", err))
+		}
+	})
+	return parser
+}
+
+var parserOnce sync.Once
+var parser *typed.Parser
+var schemaYAML = typed.YAMLObject(`types:
+- name: __untyped_atomic_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+- name: __untyped_deduced_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_deduced_
+    elementRelationship: separable
+`)
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/utils.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/utils.go
new file mode 100644
index 0000000000..3baabff8a1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/applyconfiguration/utils.go
@@ -0,0 +1,78 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package applyconfiguration
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	v1 "k8s.io/code-generator/examples/crd/apis/conflicting/v1"
+	examplev1 "k8s.io/code-generator/examples/crd/apis/example/v1"
+	example2v1 "k8s.io/code-generator/examples/crd/apis/example2/v1"
+	extensionsv1 "k8s.io/code-generator/examples/crd/apis/extensions/v1"
+	conflictingv1 "k8s.io/code-generator/examples/crd/applyconfiguration/conflicting/v1"
+	applyconfigurationexamplev1 "k8s.io/code-generator/examples/crd/applyconfiguration/example/v1"
+	applyconfigurationexample2v1 "k8s.io/code-generator/examples/crd/applyconfiguration/example2/v1"
+	applyconfigurationextensionsv1 "k8s.io/code-generator/examples/crd/applyconfiguration/extensions/v1"
+	internal "k8s.io/code-generator/examples/crd/applyconfiguration/internal"
+)
+
+// ForKind returns an apply configuration type for the given GroupVersionKind, or nil if no
+// apply configuration type exists for the given GroupVersionKind.
+func ForKind(kind schema.GroupVersionKind) interface{} {
+	switch kind {
+	// Group=conflicting.test.crd.code-generator.k8s.io, Version=v1
+	case v1.SchemeGroupVersion.WithKind("TestEmbeddedType"):
+		return &conflictingv1.TestEmbeddedTypeApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("TestType"):
+		return &conflictingv1.TestTypeApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("TestTypeStatus"):
+		return &conflictingv1.TestTypeStatusApplyConfiguration{}
+
+		// Group=example.crd.code-generator.k8s.io, Version=v1
+	case examplev1.SchemeGroupVersion.WithKind("ClusterTestType"):
+		return &applyconfigurationexamplev1.ClusterTestTypeApplyConfiguration{}
+	case examplev1.SchemeGroupVersion.WithKind("ClusterTestTypeStatus"):
+		return &applyconfigurationexamplev1.ClusterTestTypeStatusApplyConfiguration{}
+	case examplev1.SchemeGroupVersion.WithKind("TestType"):
+		return &applyconfigurationexamplev1.TestTypeApplyConfiguration{}
+	case examplev1.SchemeGroupVersion.WithKind("TestTypeStatus"):
+		return &applyconfigurationexamplev1.TestTypeStatusApplyConfiguration{}
+
+		// Group=example.test.crd.code-generator.k8s.io, Version=v1
+	case example2v1.SchemeGroupVersion.WithKind("TestType"):
+		return &applyconfigurationexample2v1.TestTypeApplyConfiguration{}
+	case example2v1.SchemeGroupVersion.WithKind("TestTypeStatus"):
+		return &applyconfigurationexample2v1.TestTypeStatusApplyConfiguration{}
+
+		// Group=extensions.test.crd.code-generator.k8s.io, Version=v1
+	case extensionsv1.SchemeGroupVersion.WithKind("TestSubresource"):
+		return &applyconfigurationextensionsv1.TestSubresourceApplyConfiguration{}
+	case extensionsv1.SchemeGroupVersion.WithKind("TestType"):
+		return &applyconfigurationextensionsv1.TestTypeApplyConfiguration{}
+	case extensionsv1.SchemeGroupVersion.WithKind("TestTypeStatus"):
+		return &applyconfigurationextensionsv1.TestTypeStatusApplyConfiguration{}
+
+	}
+	return nil
+}
+
+func NewTypeConverter(scheme *runtime.Scheme) managedfields.TypeConverter {
+	return managedfields.NewSchemeTypeConverter(scheme, internal.Parser())
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/clientset.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/clientset.go
new file mode 100644
index 0000000000..515baa99c4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/clientset.go
@@ -0,0 +1,159 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package versioned
+
+import (
+	fmt "fmt"
+	http "net/http"
+
+	discovery "k8s.io/client-go/discovery"
+	rest "k8s.io/client-go/rest"
+	flowcontrol "k8s.io/client-go/util/flowcontrol"
+	conflictingexamplev1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1"
+	examplev1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1"
+	secondexamplev1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1"
+	extensionsexamplev1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1"
+)
+
+type Interface interface {
+	Discovery() discovery.DiscoveryInterfaces
+	ConflictingExampleV1() conflictingexamplev1.ConflictingExampleV1Interface
+	ExampleV1() examplev1.ExampleV1Interface
+	SecondExampleV1() secondexamplev1.SecondExampleV1Interface
+	ExtensionsExampleV1() extensionsexamplev1.ExtensionsExampleV1Interface
+}
+
+// Clientset contains the clients for groups.
+type Clientset struct {
+	*discovery.DiscoveryClient
+	conflictingExampleV1 *conflictingexamplev1.ConflictingExampleV1Client
+	exampleV1            *examplev1.ExampleV1Client
+	secondExampleV1      *secondexamplev1.SecondExampleV1Client
+	extensionsExampleV1  *extensionsexamplev1.ExtensionsExampleV1Client
+}
+
+// ConflictingExampleV1 retrieves the ConflictingExampleV1Client
+func (c *Clientset) ConflictingExampleV1() conflictingexamplev1.ConflictingExampleV1Interface {
+	return c.conflictingExampleV1
+}
+
+// ExampleV1 retrieves the ExampleV1Client
+func (c *Clientset) ExampleV1() examplev1.ExampleV1Interface {
+	return c.exampleV1
+}
+
+// SecondExampleV1 retrieves the SecondExampleV1Client
+func (c *Clientset) SecondExampleV1() secondexamplev1.SecondExampleV1Interface {
+	return c.secondExampleV1
+}
+
+// ExtensionsExampleV1 retrieves the ExtensionsExampleV1Client
+func (c *Clientset) ExtensionsExampleV1() extensionsexamplev1.ExtensionsExampleV1Interface {
+	return c.extensionsExampleV1
+}
+
+// Discovery retrieves the DiscoveryClient
+func (c *Clientset) Discovery() discovery.DiscoveryInterfaces {
+	if c == nil {
+		return nil
+	}
+	return c.DiscoveryClient
+}
+
+// NewForConfig creates a new Clientset for the given config.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfig will generate a rate-limiter in configShallowCopy.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*Clientset, error) {
+	configShallowCopy := *c
+
+	if configShallowCopy.UserAgent == "" {
+		configShallowCopy.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	// share the transport between all clients
+	httpClient, err := rest.HTTPClientFor(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewForConfigAndClient(&configShallowCopy, httpClient)
+}
+
+// NewForConfigAndClient creates a new Clientset for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfigAndClient will generate a rate-limiter in configShallowCopy.
+func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset, error) {
+	configShallowCopy := *c
+	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
+		if configShallowCopy.Burst <= 0 {
+			return nil, fmt.Errorf("burst is required to be greater than 0 when RateLimiter is not set and QPS is set to greater than 0")
+		}
+		configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
+	}
+
+	var cs Clientset
+	var err error
+	cs.conflictingExampleV1, err = conflictingexamplev1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	cs.exampleV1, err = examplev1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	cs.secondExampleV1, err = secondexamplev1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	cs.extensionsExampleV1, err = extensionsexamplev1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+
+	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	return &cs, nil
+}
+
+// NewForConfigOrDie creates a new Clientset for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *Clientset {
+	cs, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return cs
+}
+
+// New creates a new Clientset for the given RESTClient.
+func New(c rest.Interface) *Clientset {
+	var cs Clientset
+	cs.conflictingExampleV1 = conflictingexamplev1.New(c)
+	cs.exampleV1 = examplev1.New(c)
+	cs.secondExampleV1 = secondexamplev1.New(c)
+	cs.extensionsExampleV1 = extensionsexamplev1.New(c)
+
+	cs.DiscoveryClient = discovery.NewDiscoveryClient(c)
+	return &cs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/fake/clientset_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/fake/clientset_generated.go
new file mode 100644
index 0000000000..31296fe0b1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/fake/clientset_generated.go
@@ -0,0 +1,163 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/discovery"
+	fakediscovery "k8s.io/client-go/discovery/fake"
+	"k8s.io/client-go/testing"
+	applyconfiguration "k8s.io/code-generator/examples/crd/applyconfiguration"
+	clientset "k8s.io/code-generator/examples/crd/clientset/versioned"
+	conflictingexamplev1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1"
+	fakeconflictingexamplev1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/fake"
+	examplev1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1"
+	fakeexamplev1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/fake"
+	secondexamplev1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1"
+	fakesecondexamplev1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/fake"
+	extensionsexamplev1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1"
+	fakeextensionsexamplev1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/fake"
+)
+
+// NewSimpleClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any field management, validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+func NewSimpleClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewObjectTracker(scheme, codecs.UniversalDecoder())
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{tracker: o}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		var opts metav1.ListOptions
+		if watchAction, ok := action.(testing.WatchActionImpl); ok {
+			opts = watchAction.ListOptions
+		}
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns, opts)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
+// Clientset implements clientset.Interface. Meant to be embedded into a
+// struct to get a default implementation. This makes faking out just the method
+// you want to test easier.
+type Clientset struct {
+	testing.Fake
+	discovery *fakediscovery.FakeDiscovery
+	tracker   testing.ObjectTracker
+}
+
+func (c *Clientset) Discovery() discovery.DiscoveryInterfaces {
+	return c.discovery
+}
+
+func (c *Clientset) Tracker() testing.ObjectTracker {
+	return c.tracker
+}
+
+// IsWatchListSemanticsUnSupported informs the reflector that this client
+// doesn't support WatchList semantics.
+//
+// This is a synthetic method whose sole purpose is to satisfy the optional
+// interface check performed by the reflector.
+// Returning true signals that WatchList can NOT be used.
+// No additional logic is implemented here.
+func (c *Clientset) IsWatchListSemanticsUnSupported() bool {
+	return true
+}
+
+// NewClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+//
+// Compared to NewSimpleClientset, the Clientset returned here supports field tracking and thus
+// server-side apply. Beware though that support in that for CRDs is missing
+// (https://github.com/kubernetes/kubernetes/issues/126850).
+func NewClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewFieldManagedObjectTracker(
+		scheme,
+		codecs.UniversalDecoder(),
+		applyconfiguration.NewTypeConverter(scheme),
+	)
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{tracker: o}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		var opts metav1.ListOptions
+		if watchAction, ok := action.(testing.WatchActionImpl); ok {
+			opts = watchAction.ListOptions
+		}
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns, opts)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
+var (
+	_ clientset.Interface = &Clientset{}
+	_ testing.FakeClient  = &Clientset{}
+)
+
+// ConflictingExampleV1 retrieves the ConflictingExampleV1Client
+func (c *Clientset) ConflictingExampleV1() conflictingexamplev1.ConflictingExampleV1Interface {
+	return &fakeconflictingexamplev1.FakeConflictingExampleV1{Fake: &c.Fake}
+}
+
+// ExampleV1 retrieves the ExampleV1Client
+func (c *Clientset) ExampleV1() examplev1.ExampleV1Interface {
+	return &fakeexamplev1.FakeExampleV1{Fake: &c.Fake}
+}
+
+// SecondExampleV1 retrieves the SecondExampleV1Client
+func (c *Clientset) SecondExampleV1() secondexamplev1.SecondExampleV1Interface {
+	return &fakesecondexamplev1.FakeSecondExampleV1{Fake: &c.Fake}
+}
+
+// ExtensionsExampleV1 retrieves the ExtensionsExampleV1Client
+func (c *Clientset) ExtensionsExampleV1() extensionsexamplev1.ExtensionsExampleV1Interface {
+	return &fakeextensionsexamplev1.FakeExtensionsExampleV1{Fake: &c.Fake}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/fake/doc.go
new file mode 100644
index 0000000000..9b99e71670
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated fake clientset.
+package fake
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/fake/register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/fake/register.go
new file mode 100644
index 0000000000..9b1944efe3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/fake/register.go
@@ -0,0 +1,62 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	conflictingexamplev1 "k8s.io/code-generator/examples/crd/apis/conflicting/v1"
+	examplev1 "k8s.io/code-generator/examples/crd/apis/example/v1"
+	secondexamplev1 "k8s.io/code-generator/examples/crd/apis/example2/v1"
+	extensionsexamplev1 "k8s.io/code-generator/examples/crd/apis/extensions/v1"
+)
+
+var scheme = runtime.NewScheme()
+var codecs = serializer.NewCodecFactory(scheme)
+
+var localSchemeBuilder = runtime.SchemeBuilder{
+	conflictingexamplev1.AddToScheme,
+	examplev1.AddToScheme,
+	secondexamplev1.AddToScheme,
+	extensionsexamplev1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
+//
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(scheme))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/scheme/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/scheme/doc.go
new file mode 100644
index 0000000000..7dc3756168
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/scheme/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package contains the scheme of the automatically generated clientset.
+package scheme
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/scheme/register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/scheme/register.go
new file mode 100644
index 0000000000..619f2828f1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/scheme/register.go
@@ -0,0 +1,62 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package scheme
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	conflictingexamplev1 "k8s.io/code-generator/examples/crd/apis/conflicting/v1"
+	examplev1 "k8s.io/code-generator/examples/crd/apis/example/v1"
+	secondexamplev1 "k8s.io/code-generator/examples/crd/apis/example2/v1"
+	extensionsexamplev1 "k8s.io/code-generator/examples/crd/apis/extensions/v1"
+)
+
+var Scheme = runtime.NewScheme()
+var Codecs = serializer.NewCodecFactory(Scheme)
+var ParameterCodec = runtime.NewParameterCodec(Scheme)
+var localSchemeBuilder = runtime.SchemeBuilder{
+	conflictingexamplev1.AddToScheme,
+	examplev1.AddToScheme,
+	secondexamplev1.AddToScheme,
+	extensionsexamplev1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
+//
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(Scheme))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/conflicting_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/conflicting_client.go
new file mode 100644
index 0000000000..d2a6f441d0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/conflicting_client.go
@@ -0,0 +1,101 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	http "net/http"
+
+	rest "k8s.io/client-go/rest"
+	conflictingv1 "k8s.io/code-generator/examples/crd/apis/conflicting/v1"
+	scheme "k8s.io/code-generator/examples/crd/clientset/versioned/scheme"
+)
+
+type ConflictingExampleV1Interface interface {
+	RESTClient() rest.Interface
+	TestTypesGetter
+}
+
+// ConflictingExampleV1Client is used to interact with features provided by the conflicting.test.crd.code-generator.k8s.io group.
+type ConflictingExampleV1Client struct {
+	restClient rest.Interface
+}
+
+func (c *ConflictingExampleV1Client) TestTypes(namespace string) TestTypeInterface {
+	return newTestTypes(c, namespace)
+}
+
+// NewForConfig creates a new ConflictingExampleV1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ConflictingExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ConflictingExampleV1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ConflictingExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &ConflictingExampleV1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new ConflictingExampleV1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ConflictingExampleV1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new ConflictingExampleV1Client for the given RESTClient.
+func New(c rest.Interface) *ConflictingExampleV1Client {
+	return &ConflictingExampleV1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := conflictingv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ConflictingExampleV1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/doc.go
new file mode 100644
index 0000000000..3af5d054f1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/fake/doc.go
new file mode 100644
index 0000000000..16f4439906
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/fake/fake_conflicting_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/fake/fake_conflicting_client.go
new file mode 100644
index 0000000000..fc99cc7b86
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/fake/fake_conflicting_client.go
@@ -0,0 +1,40 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1"
+)
+
+type FakeConflictingExampleV1 struct {
+	*testing.Fake
+}
+
+func (c *FakeConflictingExampleV1) TestTypes(namespace string) v1.TestTypeInterface {
+	return newFakeTestTypes(c, namespace)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeConflictingExampleV1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/fake/fake_testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/fake/fake_testtype.go
new file mode 100644
index 0000000000..1230aeaacf
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/fake/fake_testtype.go
@@ -0,0 +1,49 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	gentype "k8s.io/client-go/gentype"
+	v1 "k8s.io/code-generator/examples/crd/apis/conflicting/v1"
+	conflictingv1 "k8s.io/code-generator/examples/crd/applyconfiguration/conflicting/v1"
+	typedconflictingv1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1"
+)
+
+// fakeTestTypes implements TestTypeInterface
+type fakeTestTypes struct {
+	*gentype.FakeClientWithListAndApply[*v1.TestType, *v1.TestTypeList, *conflictingv1.TestTypeApplyConfiguration]
+	Fake *FakeConflictingExampleV1
+}
+
+func newFakeTestTypes(fake *FakeConflictingExampleV1, namespace string) typedconflictingv1.TestTypeInterface {
+	return &fakeTestTypes{
+		gentype.NewFakeClientWithListAndApply[*v1.TestType, *v1.TestTypeList, *conflictingv1.TestTypeApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1.SchemeGroupVersion.WithResource("testtypes"),
+			v1.SchemeGroupVersion.WithKind("TestType"),
+			func() *v1.TestType { return &v1.TestType{} },
+			func() *v1.TestTypeList { return &v1.TestTypeList{} },
+			func(dst, src *v1.TestTypeList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.TestTypeList) []*v1.TestType { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.TestTypeList, items []*v1.TestType) { list.Items = gentype.FromPointerSlice(items) },
+		),
+		fake,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/generated_expansion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/generated_expansion.go
new file mode 100644
index 0000000000..d513810d0d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+type TestTypeExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/testtype.go
new file mode 100644
index 0000000000..a685e01e41
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/conflicting/v1/testtype.go
@@ -0,0 +1,74 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	conflictingv1 "k8s.io/code-generator/examples/crd/apis/conflicting/v1"
+	applyconfigurationconflictingv1 "k8s.io/code-generator/examples/crd/applyconfiguration/conflicting/v1"
+	scheme "k8s.io/code-generator/examples/crd/clientset/versioned/scheme"
+)
+
+// TestTypesGetter has a method to return a TestTypeInterface.
+// A group's client should implement this interface.
+type TestTypesGetter interface {
+	TestTypes(namespace string) TestTypeInterface
+}
+
+// TestTypeInterface has methods to work with TestType resources.
+type TestTypeInterface interface {
+	Create(ctx context.Context, testType *conflictingv1.TestType, opts metav1.CreateOptions) (*conflictingv1.TestType, error)
+	Update(ctx context.Context, testType *conflictingv1.TestType, opts metav1.UpdateOptions) (*conflictingv1.TestType, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, testType *conflictingv1.TestType, opts metav1.UpdateOptions) (*conflictingv1.TestType, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*conflictingv1.TestType, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*conflictingv1.TestTypeList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *conflictingv1.TestType, err error)
+	Apply(ctx context.Context, testType *applyconfigurationconflictingv1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *conflictingv1.TestType, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, testType *applyconfigurationconflictingv1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *conflictingv1.TestType, err error)
+	TestTypeExpansion
+}
+
+// testTypes implements TestTypeInterface
+type testTypes struct {
+	*gentype.ClientWithListAndApply[*conflictingv1.TestType, *conflictingv1.TestTypeList, *applyconfigurationconflictingv1.TestTypeApplyConfiguration]
+}
+
+// newTestTypes returns a TestTypes
+func newTestTypes(c *ConflictingExampleV1Client, namespace string) *testTypes {
+	return &testTypes{
+		gentype.NewClientWithListAndApply[*conflictingv1.TestType, *conflictingv1.TestTypeList, *applyconfigurationconflictingv1.TestTypeApplyConfiguration](
+			"testtypes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *conflictingv1.TestType { return &conflictingv1.TestType{} },
+			func() *conflictingv1.TestTypeList { return &conflictingv1.TestTypeList{} },
+		),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/clustertesttype.go
new file mode 100644
index 0000000000..b577b840c4
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/clustertesttype.go
@@ -0,0 +1,105 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	autoscalingv1 "k8s.io/api/autoscaling/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	examplev1 "k8s.io/code-generator/examples/crd/apis/example/v1"
+	applyconfigurationexamplev1 "k8s.io/code-generator/examples/crd/applyconfiguration/example/v1"
+	scheme "k8s.io/code-generator/examples/crd/clientset/versioned/scheme"
+)
+
+// ClusterTestTypesGetter has a method to return a ClusterTestTypeInterface.
+// A group's client should implement this interface.
+type ClusterTestTypesGetter interface {
+	ClusterTestTypes() ClusterTestTypeInterface
+}
+
+// ClusterTestTypeInterface has methods to work with ClusterTestType resources.
+type ClusterTestTypeInterface interface {
+	Create(ctx context.Context, clusterTestType *examplev1.ClusterTestType, opts metav1.CreateOptions) (*examplev1.ClusterTestType, error)
+	Update(ctx context.Context, clusterTestType *examplev1.ClusterTestType, opts metav1.UpdateOptions) (*examplev1.ClusterTestType, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, clusterTestType *examplev1.ClusterTestType, opts metav1.UpdateOptions) (*examplev1.ClusterTestType, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*examplev1.ClusterTestType, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*examplev1.ClusterTestTypeList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *examplev1.ClusterTestType, err error)
+	Apply(ctx context.Context, clusterTestType *applyconfigurationexamplev1.ClusterTestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *examplev1.ClusterTestType, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, clusterTestType *applyconfigurationexamplev1.ClusterTestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *examplev1.ClusterTestType, err error)
+	GetScale(ctx context.Context, clusterTestTypeName string, options metav1.GetOptions) (*autoscalingv1.Scale, error)
+	UpdateScale(ctx context.Context, clusterTestTypeName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (*autoscalingv1.Scale, error)
+
+	ClusterTestTypeExpansion
+}
+
+// clusterTestTypes implements ClusterTestTypeInterface
+type clusterTestTypes struct {
+	*gentype.ClientWithListAndApply[*examplev1.ClusterTestType, *examplev1.ClusterTestTypeList, *applyconfigurationexamplev1.ClusterTestTypeApplyConfiguration]
+}
+
+// newClusterTestTypes returns a ClusterTestTypes
+func newClusterTestTypes(c *ExampleV1Client) *clusterTestTypes {
+	return &clusterTestTypes{
+		gentype.NewClientWithListAndApply[*examplev1.ClusterTestType, *examplev1.ClusterTestTypeList, *applyconfigurationexamplev1.ClusterTestTypeApplyConfiguration](
+			"clustertesttypes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			"",
+			func() *examplev1.ClusterTestType { return &examplev1.ClusterTestType{} },
+			func() *examplev1.ClusterTestTypeList { return &examplev1.ClusterTestTypeList{} },
+		),
+	}
+}
+
+// GetScale takes name of the clusterTestType, and returns the corresponding autoscalingv1.Scale object, and an error if there is any.
+func (c *clusterTestTypes) GetScale(ctx context.Context, clusterTestTypeName string, options metav1.GetOptions) (result *autoscalingv1.Scale, err error) {
+	result = &autoscalingv1.Scale{}
+	err = c.GetClient().Get().
+		Resource("clustertesttypes").
+		Name(clusterTestTypeName).
+		SubResource("scale").
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// UpdateScale takes the top resource name and the representation of a scale and updates it. Returns the server's representation of the scale, and an error, if there is any.
+func (c *clusterTestTypes) UpdateScale(ctx context.Context, clusterTestTypeName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (result *autoscalingv1.Scale, err error) {
+	result = &autoscalingv1.Scale{}
+	err = c.GetClient().Put().
+		Resource("clustertesttypes").
+		Name(clusterTestTypeName).
+		SubResource("scale").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(scale).
+		Do(ctx).
+		Into(result)
+	return
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/doc.go
new file mode 100644
index 0000000000..3af5d054f1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/example_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/example_client.go
new file mode 100644
index 0000000000..4b8594bc3e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/example_client.go
@@ -0,0 +1,106 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	http "net/http"
+
+	rest "k8s.io/client-go/rest"
+	examplev1 "k8s.io/code-generator/examples/crd/apis/example/v1"
+	scheme "k8s.io/code-generator/examples/crd/clientset/versioned/scheme"
+)
+
+type ExampleV1Interface interface {
+	RESTClient() rest.Interface
+	ClusterTestTypesGetter
+	TestTypesGetter
+}
+
+// ExampleV1Client is used to interact with features provided by the example.crd.code-generator.k8s.io group.
+type ExampleV1Client struct {
+	restClient rest.Interface
+}
+
+func (c *ExampleV1Client) ClusterTestTypes() ClusterTestTypeInterface {
+	return newClusterTestTypes(c)
+}
+
+func (c *ExampleV1Client) TestTypes(namespace string) TestTypeInterface {
+	return newTestTypes(c, namespace)
+}
+
+// NewForConfig creates a new ExampleV1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ExampleV1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &ExampleV1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new ExampleV1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ExampleV1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new ExampleV1Client for the given RESTClient.
+func New(c rest.Interface) *ExampleV1Client {
+	return &ExampleV1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := examplev1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ExampleV1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/fake/doc.go
new file mode 100644
index 0000000000..16f4439906
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/fake/fake_clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/fake/fake_clustertesttype.go
new file mode 100644
index 0000000000..7618547f94
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/fake/fake_clustertesttype.go
@@ -0,0 +1,78 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	context "context"
+
+	autoscalingv1 "k8s.io/api/autoscaling/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gentype "k8s.io/client-go/gentype"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/crd/apis/example/v1"
+	examplev1 "k8s.io/code-generator/examples/crd/applyconfiguration/example/v1"
+	typedexamplev1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1"
+)
+
+// fakeClusterTestTypes implements ClusterTestTypeInterface
+type fakeClusterTestTypes struct {
+	*gentype.FakeClientWithListAndApply[*v1.ClusterTestType, *v1.ClusterTestTypeList, *examplev1.ClusterTestTypeApplyConfiguration]
+	Fake *FakeExampleV1
+}
+
+func newFakeClusterTestTypes(fake *FakeExampleV1) typedexamplev1.ClusterTestTypeInterface {
+	return &fakeClusterTestTypes{
+		gentype.NewFakeClientWithListAndApply[*v1.ClusterTestType, *v1.ClusterTestTypeList, *examplev1.ClusterTestTypeApplyConfiguration](
+			fake.Fake,
+			"",
+			v1.SchemeGroupVersion.WithResource("clustertesttypes"),
+			v1.SchemeGroupVersion.WithKind("ClusterTestType"),
+			func() *v1.ClusterTestType { return &v1.ClusterTestType{} },
+			func() *v1.ClusterTestTypeList { return &v1.ClusterTestTypeList{} },
+			func(dst, src *v1.ClusterTestTypeList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.ClusterTestTypeList) []*v1.ClusterTestType { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.ClusterTestTypeList, items []*v1.ClusterTestType) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
+
+// GetScale takes name of the clusterTestType, and returns the corresponding scale object, and an error if there is any.
+func (c *fakeClusterTestTypes) GetScale(ctx context.Context, clusterTestTypeName string, options metav1.GetOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.
+		Invokes(testing.NewRootGetSubresourceActionWithOptions(c.Resource(), "scale", clusterTestTypeName, options), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*autoscalingv1.Scale), err
+}
+
+// UpdateScale takes the representation of a scale and updates it. Returns the server's representation of the scale, and an error, if there is any.
+func (c *fakeClusterTestTypes) UpdateScale(ctx context.Context, clusterTestTypeName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.
+		Invokes(testing.NewRootUpdateSubresourceActionWithOptions(c.Resource(), "scale", scale, opts), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*autoscalingv1.Scale), err
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/fake/fake_example_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/fake/fake_example_client.go
new file mode 100644
index 0000000000..c0ffa31fce
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/fake/fake_example_client.go
@@ -0,0 +1,44 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1"
+)
+
+type FakeExampleV1 struct {
+	*testing.Fake
+}
+
+func (c *FakeExampleV1) ClusterTestTypes() v1.ClusterTestTypeInterface {
+	return newFakeClusterTestTypes(c)
+}
+
+func (c *FakeExampleV1) TestTypes(namespace string) v1.TestTypeInterface {
+	return newFakeTestTypes(c, namespace)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeExampleV1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/fake/fake_testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/fake/fake_testtype.go
new file mode 100644
index 0000000000..a07ffdf5a9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/fake/fake_testtype.go
@@ -0,0 +1,65 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	context "context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gentype "k8s.io/client-go/gentype"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/crd/apis/example/v1"
+	examplev1 "k8s.io/code-generator/examples/crd/applyconfiguration/example/v1"
+	typedexamplev1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1"
+)
+
+// fakeTestTypes implements TestTypeInterface
+type fakeTestTypes struct {
+	*gentype.FakeClientWithListAndApply[*v1.TestType, *v1.TestTypeList, *examplev1.TestTypeApplyConfiguration]
+	Fake *FakeExampleV1
+}
+
+func newFakeTestTypes(fake *FakeExampleV1, namespace string) typedexamplev1.TestTypeInterface {
+	return &fakeTestTypes{
+		gentype.NewFakeClientWithListAndApply[*v1.TestType, *v1.TestTypeList, *examplev1.TestTypeApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1.SchemeGroupVersion.WithResource("testtypes"),
+			v1.SchemeGroupVersion.WithKind("TestType"),
+			func() *v1.TestType { return &v1.TestType{} },
+			func() *v1.TestTypeList { return &v1.TestTypeList{} },
+			func(dst, src *v1.TestTypeList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.TestTypeList) []*v1.TestType { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.TestTypeList, items []*v1.TestType) { list.Items = gentype.FromPointerSlice(items) },
+		),
+		fake,
+	}
+}
+
+// GetClusterTestType takes name of the testType, and returns the corresponding testType object, and an error if there is any.
+func (c *fakeTestTypes) GetClusterTestType(ctx context.Context, name string, options metav1.GetOptions) (result *v1.TestType, err error) {
+	emptyResult := &v1.TestType{}
+	obj, err := c.Fake.
+		Invokes(testing.NewGetActionWithOptions(c.Resource(), c.Namespace(), name, options), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1.TestType), err
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/generated_expansion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/generated_expansion.go
new file mode 100644
index 0000000000..3059734a9e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+type ClusterTestTypeExpansion interface{}
+
+type TestTypeExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/testtype.go
new file mode 100644
index 0000000000..045dd4b936
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example/v1/testtype.go
@@ -0,0 +1,89 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	examplev1 "k8s.io/code-generator/examples/crd/apis/example/v1"
+	applyconfigurationexamplev1 "k8s.io/code-generator/examples/crd/applyconfiguration/example/v1"
+	scheme "k8s.io/code-generator/examples/crd/clientset/versioned/scheme"
+)
+
+// TestTypesGetter has a method to return a TestTypeInterface.
+// A group's client should implement this interface.
+type TestTypesGetter interface {
+	TestTypes(namespace string) TestTypeInterface
+}
+
+// TestTypeInterface has methods to work with TestType resources.
+type TestTypeInterface interface {
+	Create(ctx context.Context, testType *examplev1.TestType, opts metav1.CreateOptions) (*examplev1.TestType, error)
+	Update(ctx context.Context, testType *examplev1.TestType, opts metav1.UpdateOptions) (*examplev1.TestType, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, testType *examplev1.TestType, opts metav1.UpdateOptions) (*examplev1.TestType, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*examplev1.TestType, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*examplev1.TestTypeList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *examplev1.TestType, err error)
+	Apply(ctx context.Context, testType *applyconfigurationexamplev1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *examplev1.TestType, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, testType *applyconfigurationexamplev1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *examplev1.TestType, err error)
+	GetClusterTestType(ctx context.Context, name string, opts metav1.GetOptions) (*examplev1.TestType, error)
+
+	TestTypeExpansion
+}
+
+// testTypes implements TestTypeInterface
+type testTypes struct {
+	*gentype.ClientWithListAndApply[*examplev1.TestType, *examplev1.TestTypeList, *applyconfigurationexamplev1.TestTypeApplyConfiguration]
+}
+
+// newTestTypes returns a TestTypes
+func newTestTypes(c *ExampleV1Client, namespace string) *testTypes {
+	return &testTypes{
+		gentype.NewClientWithListAndApply[*examplev1.TestType, *examplev1.TestTypeList, *applyconfigurationexamplev1.TestTypeApplyConfiguration](
+			"testtypes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *examplev1.TestType { return &examplev1.TestType{} },
+			func() *examplev1.TestTypeList { return &examplev1.TestTypeList{} },
+		),
+	}
+}
+
+// GetClusterTestType takes name of the testType, and returns the corresponding testType object, and an error if there is any.
+func (c *testTypes) GetClusterTestType(ctx context.Context, name string, options metav1.GetOptions) (result *examplev1.TestType, err error) {
+	result = &examplev1.TestType{}
+	err = c.GetClient().Get().
+		Namespace(c.GetNamespace()).
+		Resource("testtypes").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/doc.go
new file mode 100644
index 0000000000..3af5d054f1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/example2_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/example2_client.go
new file mode 100644
index 0000000000..967a9e026c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/example2_client.go
@@ -0,0 +1,101 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	http "net/http"
+
+	rest "k8s.io/client-go/rest"
+	example2v1 "k8s.io/code-generator/examples/crd/apis/example2/v1"
+	scheme "k8s.io/code-generator/examples/crd/clientset/versioned/scheme"
+)
+
+type SecondExampleV1Interface interface {
+	RESTClient() rest.Interface
+	TestTypesGetter
+}
+
+// SecondExampleV1Client is used to interact with features provided by the example.test.crd.code-generator.k8s.io group.
+type SecondExampleV1Client struct {
+	restClient rest.Interface
+}
+
+func (c *SecondExampleV1Client) TestTypes(namespace string) TestTypeInterface {
+	return newTestTypes(c, namespace)
+}
+
+// NewForConfig creates a new SecondExampleV1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*SecondExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new SecondExampleV1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*SecondExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &SecondExampleV1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new SecondExampleV1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *SecondExampleV1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new SecondExampleV1Client for the given RESTClient.
+func New(c rest.Interface) *SecondExampleV1Client {
+	return &SecondExampleV1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := example2v1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *SecondExampleV1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/fake/doc.go
new file mode 100644
index 0000000000..16f4439906
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/fake/fake_example2_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/fake/fake_example2_client.go
new file mode 100644
index 0000000000..afa4d893da
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/fake/fake_example2_client.go
@@ -0,0 +1,40 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1"
+)
+
+type FakeSecondExampleV1 struct {
+	*testing.Fake
+}
+
+func (c *FakeSecondExampleV1) TestTypes(namespace string) v1.TestTypeInterface {
+	return newFakeTestTypes(c, namespace)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeSecondExampleV1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/fake/fake_testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/fake/fake_testtype.go
new file mode 100644
index 0000000000..b6b05c3401
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/fake/fake_testtype.go
@@ -0,0 +1,49 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	gentype "k8s.io/client-go/gentype"
+	v1 "k8s.io/code-generator/examples/crd/apis/example2/v1"
+	example2v1 "k8s.io/code-generator/examples/crd/applyconfiguration/example2/v1"
+	typedexample2v1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1"
+)
+
+// fakeTestTypes implements TestTypeInterface
+type fakeTestTypes struct {
+	*gentype.FakeClientWithListAndApply[*v1.TestType, *v1.TestTypeList, *example2v1.TestTypeApplyConfiguration]
+	Fake *FakeSecondExampleV1
+}
+
+func newFakeTestTypes(fake *FakeSecondExampleV1, namespace string) typedexample2v1.TestTypeInterface {
+	return &fakeTestTypes{
+		gentype.NewFakeClientWithListAndApply[*v1.TestType, *v1.TestTypeList, *example2v1.TestTypeApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1.SchemeGroupVersion.WithResource("testtypes"),
+			v1.SchemeGroupVersion.WithKind("TestType"),
+			func() *v1.TestType { return &v1.TestType{} },
+			func() *v1.TestTypeList { return &v1.TestTypeList{} },
+			func(dst, src *v1.TestTypeList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.TestTypeList) []*v1.TestType { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.TestTypeList, items []*v1.TestType) { list.Items = gentype.FromPointerSlice(items) },
+		),
+		fake,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/generated_expansion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/generated_expansion.go
new file mode 100644
index 0000000000..d513810d0d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+type TestTypeExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/testtype.go
new file mode 100644
index 0000000000..dddaac5eac
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/example2/v1/testtype.go
@@ -0,0 +1,74 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	example2v1 "k8s.io/code-generator/examples/crd/apis/example2/v1"
+	applyconfigurationexample2v1 "k8s.io/code-generator/examples/crd/applyconfiguration/example2/v1"
+	scheme "k8s.io/code-generator/examples/crd/clientset/versioned/scheme"
+)
+
+// TestTypesGetter has a method to return a TestTypeInterface.
+// A group's client should implement this interface.
+type TestTypesGetter interface {
+	TestTypes(namespace string) TestTypeInterface
+}
+
+// TestTypeInterface has methods to work with TestType resources.
+type TestTypeInterface interface {
+	Create(ctx context.Context, testType *example2v1.TestType, opts metav1.CreateOptions) (*example2v1.TestType, error)
+	Update(ctx context.Context, testType *example2v1.TestType, opts metav1.UpdateOptions) (*example2v1.TestType, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, testType *example2v1.TestType, opts metav1.UpdateOptions) (*example2v1.TestType, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*example2v1.TestType, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*example2v1.TestTypeList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *example2v1.TestType, err error)
+	Apply(ctx context.Context, testType *applyconfigurationexample2v1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *example2v1.TestType, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, testType *applyconfigurationexample2v1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *example2v1.TestType, err error)
+	TestTypeExpansion
+}
+
+// testTypes implements TestTypeInterface
+type testTypes struct {
+	*gentype.ClientWithListAndApply[*example2v1.TestType, *example2v1.TestTypeList, *applyconfigurationexample2v1.TestTypeApplyConfiguration]
+}
+
+// newTestTypes returns a TestTypes
+func newTestTypes(c *SecondExampleV1Client, namespace string) *testTypes {
+	return &testTypes{
+		gentype.NewClientWithListAndApply[*example2v1.TestType, *example2v1.TestTypeList, *applyconfigurationexample2v1.TestTypeApplyConfiguration](
+			"testtypes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *example2v1.TestType { return &example2v1.TestType{} },
+			func() *example2v1.TestTypeList { return &example2v1.TestTypeList{} },
+		),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/doc.go
new file mode 100644
index 0000000000..3af5d054f1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/extensions_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/extensions_client.go
new file mode 100644
index 0000000000..4886c8af63
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/extensions_client.go
@@ -0,0 +1,101 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	http "net/http"
+
+	rest "k8s.io/client-go/rest"
+	extensionsv1 "k8s.io/code-generator/examples/crd/apis/extensions/v1"
+	scheme "k8s.io/code-generator/examples/crd/clientset/versioned/scheme"
+)
+
+type ExtensionsExampleV1Interface interface {
+	RESTClient() rest.Interface
+	TestTypesGetter
+}
+
+// ExtensionsExampleV1Client is used to interact with features provided by the extensions.test.crd.code-generator.k8s.io group.
+type ExtensionsExampleV1Client struct {
+	restClient rest.Interface
+}
+
+func (c *ExtensionsExampleV1Client) TestTypes(namespace string) TestTypeInterface {
+	return newTestTypes(c, namespace)
+}
+
+// NewForConfig creates a new ExtensionsExampleV1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ExtensionsExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ExtensionsExampleV1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ExtensionsExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &ExtensionsExampleV1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new ExtensionsExampleV1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ExtensionsExampleV1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new ExtensionsExampleV1Client for the given RESTClient.
+func New(c rest.Interface) *ExtensionsExampleV1Client {
+	return &ExtensionsExampleV1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := extensionsv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ExtensionsExampleV1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/fake/doc.go
new file mode 100644
index 0000000000..16f4439906
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/fake/fake_extensions_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/fake/fake_extensions_client.go
new file mode 100644
index 0000000000..5ed70ee1f2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/fake/fake_extensions_client.go
@@ -0,0 +1,40 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1"
+)
+
+type FakeExtensionsExampleV1 struct {
+	*testing.Fake
+}
+
+func (c *FakeExtensionsExampleV1) TestTypes(namespace string) v1.TestTypeInterface {
+	return newFakeTestTypes(c, namespace)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeExtensionsExampleV1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/fake/fake_testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/fake/fake_testtype.go
new file mode 100644
index 0000000000..0245cbd7b2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/fake/fake_testtype.go
@@ -0,0 +1,195 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	context "context"
+	json "encoding/json"
+	fmt "fmt"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	gentype "k8s.io/client-go/gentype"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/crd/apis/extensions/v1"
+	extensionsv1 "k8s.io/code-generator/examples/crd/applyconfiguration/extensions/v1"
+	typedextensionsv1 "k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1"
+)
+
+// fakeTestTypes implements TestTypeInterface
+type fakeTestTypes struct {
+	*gentype.FakeClientWithListAndApply[*v1.TestType, *v1.TestTypeList, *extensionsv1.TestTypeApplyConfiguration]
+	Fake *FakeExtensionsExampleV1
+}
+
+func newFakeTestTypes(fake *FakeExtensionsExampleV1, namespace string) typedextensionsv1.TestTypeInterface {
+	return &fakeTestTypes{
+		gentype.NewFakeClientWithListAndApply[*v1.TestType, *v1.TestTypeList, *extensionsv1.TestTypeApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1.SchemeGroupVersion.WithResource("testtypes"),
+			v1.SchemeGroupVersion.WithKind("TestType"),
+			func() *v1.TestType { return &v1.TestType{} },
+			func() *v1.TestTypeList { return &v1.TestTypeList{} },
+			func(dst, src *v1.TestTypeList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.TestTypeList) []*v1.TestType { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.TestTypeList, items []*v1.TestType) { list.Items = gentype.FromPointerSlice(items) },
+		),
+		fake,
+	}
+}
+
+// GetExtended takes name of the testType, and returns the corresponding testType object, and an error if there is any.
+func (c *fakeTestTypes) GetExtended(ctx context.Context, name string, options metav1.GetOptions) (result *v1.TestType, err error) {
+	emptyResult := &v1.TestType{}
+	obj, err := c.Fake.
+		Invokes(testing.NewGetActionWithOptions(c.Resource(), c.Namespace(), name, options), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1.TestType), err
+}
+
+// ListExtended takes label and field selectors, and returns the list of TestTypes that match those selectors.
+func (c *fakeTestTypes) ListExtended(ctx context.Context, opts metav1.ListOptions) (result *v1.TestTypeList, err error) {
+	emptyResult := &v1.TestTypeList{}
+	obj, err := c.Fake.
+		Invokes(testing.NewListActionWithOptions(c.Resource(), c.Kind(), c.Namespace(), opts), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1.TestTypeList), err
+}
+
+// CreateExtended takes the representation of a testType and creates it.  Returns the server's representation of the testType, and an error, if there is any.
+func (c *fakeTestTypes) CreateExtended(ctx context.Context, testType *v1.TestType, opts metav1.CreateOptions) (result *v1.TestType, err error) {
+	emptyResult := &v1.TestType{}
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateActionWithOptions(c.Resource(), c.Namespace(), testType, opts), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1.TestType), err
+}
+
+// UpdateExtended takes the representation of a testType and updates it. Returns the server's representation of the testType, and an error, if there is any.
+func (c *fakeTestTypes) UpdateExtended(ctx context.Context, testType *v1.TestType, opts metav1.UpdateOptions) (result *v1.TestType, err error) {
+	emptyResult := &v1.TestType{}
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateActionWithOptions(c.Resource(), c.Namespace(), testType, opts), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1.TestType), err
+}
+
+// PatchExtended applies the patch and returns the patched testType.
+func (c *fakeTestTypes) PatchExtended(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *v1.TestType, err error) {
+	emptyResult := &v1.TestType{}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceActionWithOptions(c.Resource(), c.Namespace(), name, pt, data, opts, subresources...), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1.TestType), err
+}
+
+// ApplyExtended takes the given apply declarative configuration, applies it and returns the applied testType.
+func (c *fakeTestTypes) ApplyExtended(ctx context.Context, testType *extensionsv1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *v1.TestType, err error) {
+	if testType == nil {
+		return nil, fmt.Errorf("testType provided to ApplyExtended must not be nil")
+	}
+	data, err := json.Marshal(testType)
+	if err != nil {
+		return nil, err
+	}
+	name := testType.Name
+	if name == nil {
+		return nil, fmt.Errorf("testType.Name must be provided to ApplyExtended")
+	}
+	emptyResult := &v1.TestType{}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceActionWithOptions(c.Resource(), c.Namespace(), *name, types.ApplyPatchType, data, opts.ToPatchOptions()), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1.TestType), err
+}
+
+// GetSubresource takes name of the testType, and returns the corresponding testSubresource object, and an error if there is any.
+func (c *fakeTestTypes) GetSubresource(ctx context.Context, testTypeName string, options metav1.GetOptions) (result *v1.TestSubresource, err error) {
+	emptyResult := &v1.TestSubresource{}
+	obj, err := c.Fake.
+		Invokes(testing.NewGetSubresourceActionWithOptions(c.Resource(), c.Namespace(), "testsubresource", testTypeName, options), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1.TestSubresource), err
+}
+
+// CreateSubresource takes the representation of a testSubresource and creates it.  Returns the server's representation of the testSubresource, and an error, if there is any.
+func (c *fakeTestTypes) CreateSubresource(ctx context.Context, testTypeName string, testSubresource *v1.TestSubresource, opts metav1.CreateOptions) (result *v1.TestSubresource, err error) {
+	emptyResult := &v1.TestSubresource{}
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateSubresourceActionWithOptions(c.Resource(), testTypeName, "testsubresource", c.Namespace(), testSubresource, opts), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1.TestSubresource), err
+}
+
+// UpdateSubresource takes the representation of a testSubresource and updates it. Returns the server's representation of the testSubresource, and an error, if there is any.
+func (c *fakeTestTypes) UpdateSubresource(ctx context.Context, testTypeName string, testSubresource *v1.TestSubresource, opts metav1.UpdateOptions) (result *v1.TestSubresource, err error) {
+	emptyResult := &v1.TestSubresource{}
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateSubresourceActionWithOptions(c.Resource(), "subresource", c.Namespace(), testSubresource, opts), &v1.TestSubresource{})
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1.TestSubresource), err
+}
+
+// ApplySubresource takes top resource name and the apply declarative configuration for subresource,
+// applies it and returns the applied testSubresource, and an error, if there is any.
+func (c *fakeTestTypes) ApplySubresource(ctx context.Context, testTypeName string, testSubresource *extensionsv1.TestSubresourceApplyConfiguration, opts metav1.ApplyOptions) (result *v1.TestSubresource, err error) {
+	if testSubresource == nil {
+		return nil, fmt.Errorf("testSubresource provided to ApplySubresource must not be nil")
+	}
+	data, err := json.Marshal(testSubresource)
+	if err != nil {
+		return nil, err
+	}
+	emptyResult := &v1.TestSubresource{}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceActionWithOptions(c.Resource(), c.Namespace(), testTypeName, types.ApplyPatchType, data, opts.ToPatchOptions(), "testSubresource"), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*v1.TestSubresource), err
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/generated_expansion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/generated_expansion.go
new file mode 100644
index 0000000000..d513810d0d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+type TestTypeExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/testtype.go
new file mode 100644
index 0000000000..b7fd501ab6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/clientset/versioned/typed/extensions/v1/testtype.go
@@ -0,0 +1,253 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	fmt "fmt"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	apply "k8s.io/client-go/util/apply"
+	extensionsv1 "k8s.io/code-generator/examples/crd/apis/extensions/v1"
+	applyconfigurationextensionsv1 "k8s.io/code-generator/examples/crd/applyconfiguration/extensions/v1"
+	scheme "k8s.io/code-generator/examples/crd/clientset/versioned/scheme"
+)
+
+// TestTypesGetter has a method to return a TestTypeInterface.
+// A group's client should implement this interface.
+type TestTypesGetter interface {
+	TestTypes(namespace string) TestTypeInterface
+}
+
+// TestTypeInterface has methods to work with TestType resources.
+type TestTypeInterface interface {
+	Create(ctx context.Context, testType *extensionsv1.TestType, opts metav1.CreateOptions) (*extensionsv1.TestType, error)
+	Update(ctx context.Context, testType *extensionsv1.TestType, opts metav1.UpdateOptions) (*extensionsv1.TestType, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, testType *extensionsv1.TestType, opts metav1.UpdateOptions) (*extensionsv1.TestType, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*extensionsv1.TestType, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1.TestTypeList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *extensionsv1.TestType, err error)
+	Apply(ctx context.Context, testType *applyconfigurationextensionsv1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *extensionsv1.TestType, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, testType *applyconfigurationextensionsv1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *extensionsv1.TestType, err error)
+	GetExtended(ctx context.Context, name string, opts metav1.GetOptions) (*extensionsv1.TestType, error)
+	ListExtended(ctx context.Context, opts metav1.ListOptions) (*extensionsv1.TestTypeList, error)
+	CreateExtended(ctx context.Context, testType *extensionsv1.TestType, opts metav1.CreateOptions) (*extensionsv1.TestType, error)
+	UpdateExtended(ctx context.Context, testType *extensionsv1.TestType, opts metav1.UpdateOptions) (*extensionsv1.TestType, error)
+	PatchExtended(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *extensionsv1.TestType, err error)
+	ApplyExtended(ctx context.Context, testType *applyconfigurationextensionsv1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *extensionsv1.TestType, err error)
+	GetSubresource(ctx context.Context, testTypeName string, options metav1.GetOptions) (*extensionsv1.TestSubresource, error)
+	CreateSubresource(ctx context.Context, testTypeName string, testSubresource *extensionsv1.TestSubresource, opts metav1.CreateOptions) (*extensionsv1.TestSubresource, error)
+	UpdateSubresource(ctx context.Context, testTypeName string, testSubresource *extensionsv1.TestSubresource, opts metav1.UpdateOptions) (*extensionsv1.TestSubresource, error)
+	ApplySubresource(ctx context.Context, testTypeName string, testSubresource *applyconfigurationextensionsv1.TestSubresourceApplyConfiguration, opts metav1.ApplyOptions) (*extensionsv1.TestSubresource, error)
+
+	TestTypeExpansion
+}
+
+// testTypes implements TestTypeInterface
+type testTypes struct {
+	*gentype.ClientWithListAndApply[*extensionsv1.TestType, *extensionsv1.TestTypeList, *applyconfigurationextensionsv1.TestTypeApplyConfiguration]
+}
+
+// newTestTypes returns a TestTypes
+func newTestTypes(c *ExtensionsExampleV1Client, namespace string) *testTypes {
+	return &testTypes{
+		gentype.NewClientWithListAndApply[*extensionsv1.TestType, *extensionsv1.TestTypeList, *applyconfigurationextensionsv1.TestTypeApplyConfiguration](
+			"testtypes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *extensionsv1.TestType { return &extensionsv1.TestType{} },
+			func() *extensionsv1.TestTypeList { return &extensionsv1.TestTypeList{} },
+		),
+	}
+}
+
+// GetExtended takes name of the testType, and returns the corresponding testType object, and an error if there is any.
+func (c *testTypes) GetExtended(ctx context.Context, name string, options metav1.GetOptions) (result *extensionsv1.TestType, err error) {
+	result = &extensionsv1.TestType{}
+	err = c.GetClient().Get().
+		Namespace(c.GetNamespace()).
+		Resource("testtypes").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// ListExtended takes label and field selectors, and returns the list of TestTypes that match those selectors.
+func (c *testTypes) ListExtended(ctx context.Context, opts metav1.ListOptions) (result *extensionsv1.TestTypeList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &extensionsv1.TestTypeList{}
+	err = c.GetClient().Get().
+		Namespace(c.GetNamespace()).
+		Resource("testtypes").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// CreateExtended takes the representation of a testType and creates it.  Returns the server's representation of the testType, and an error, if there is any.
+func (c *testTypes) CreateExtended(ctx context.Context, testType *extensionsv1.TestType, opts metav1.CreateOptions) (result *extensionsv1.TestType, err error) {
+	result = &extensionsv1.TestType{}
+	err = c.GetClient().Post().
+		Namespace(c.GetNamespace()).
+		Resource("testtypes").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(testType).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// UpdateExtended takes the representation of a testType and updates it. Returns the server's representation of the testType, and an error, if there is any.
+func (c *testTypes) UpdateExtended(ctx context.Context, testType *extensionsv1.TestType, opts metav1.UpdateOptions) (result *extensionsv1.TestType, err error) {
+	result = &extensionsv1.TestType{}
+	err = c.GetClient().Put().
+		Namespace(c.GetNamespace()).
+		Resource("testtypes").
+		Name(testType.Name).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(testType).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// PatchExtended applies the patch and returns the patched testType.
+func (c *testTypes) PatchExtended(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *extensionsv1.TestType, err error) {
+	result = &extensionsv1.TestType{}
+	err = c.GetClient().Patch(pt).
+		Namespace(c.GetNamespace()).
+		Resource("testtypes").
+		Name(name).
+		SubResource(subresources...).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// ApplyExtended takes the given apply declarative configuration, applies it and returns the applied testType.
+func (c *testTypes) ApplyExtended(ctx context.Context, testType *applyconfigurationextensionsv1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *extensionsv1.TestType, err error) {
+	if testType == nil {
+		return nil, fmt.Errorf("testType provided to ApplyExtended must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	name := testType.Name
+	if name == nil {
+		return nil, fmt.Errorf("testType.Name must be provided to ApplyExtended")
+	}
+	request, err := apply.NewRequest(c.GetClient(), testType)
+	if err != nil {
+		return nil, err
+	}
+	result = &extensionsv1.TestType{}
+	err = request.
+		Namespace(c.GetNamespace()).
+		Resource("testtypes").
+		Name(*name).
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// GetSubresource takes name of the testType, and returns the corresponding extensionsv1.TestSubresource object, and an error if there is any.
+func (c *testTypes) GetSubresource(ctx context.Context, testTypeName string, options metav1.GetOptions) (result *extensionsv1.TestSubresource, err error) {
+	result = &extensionsv1.TestSubresource{}
+	err = c.GetClient().Get().
+		Namespace(c.GetNamespace()).
+		Resource("testtypes").
+		Name(testTypeName).
+		SubResource("testsubresource").
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// CreateSubresource takes the representation of a testSubresource and creates it.  Returns the server's representation of the testSubresource, and an error, if there is any.
+func (c *testTypes) CreateSubresource(ctx context.Context, testTypeName string, testSubresource *extensionsv1.TestSubresource, opts metav1.CreateOptions) (result *extensionsv1.TestSubresource, err error) {
+	result = &extensionsv1.TestSubresource{}
+	err = c.GetClient().Post().
+		Namespace(c.GetNamespace()).
+		Resource("testtypes").
+		Name(testTypeName).
+		SubResource("testsubresource").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(testSubresource).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// UpdateSubresource takes the top resource name and the representation of a testSubresource and updates it. Returns the server's representation of the testSubresource, and an error, if there is any.
+func (c *testTypes) UpdateSubresource(ctx context.Context, testTypeName string, testSubresource *extensionsv1.TestSubresource, opts metav1.UpdateOptions) (result *extensionsv1.TestSubresource, err error) {
+	result = &extensionsv1.TestSubresource{}
+	err = c.GetClient().Put().
+		Namespace(c.GetNamespace()).
+		Resource("testtypes").
+		Name(testTypeName).
+		SubResource("subresource").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(testSubresource).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// ApplySubresource takes top resource name and the apply declarative configuration for subresource,
+// applies it and returns the applied testSubresource, and an error, if there is any.
+func (c *testTypes) ApplySubresource(ctx context.Context, testTypeName string, testSubresource *applyconfigurationextensionsv1.TestSubresourceApplyConfiguration, opts metav1.ApplyOptions) (result *extensionsv1.TestSubresource, err error) {
+	if testSubresource == nil {
+		return nil, fmt.Errorf("testSubresource provided to ApplySubresource must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	request, err := apply.NewRequest(c.GetClient(), testSubresource)
+	if err != nil {
+		return nil, err
+	}
+
+	result = &extensionsv1.TestSubresource{}
+	err = request.
+		Namespace(c.GetNamespace()).
+		Resource("testtypes").
+		Name(testTypeName).
+		SubResource("subresource").
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/conflicting/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/conflicting/interface.go
new file mode 100644
index 0000000000..9bd1fc3176
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/conflicting/interface.go
@@ -0,0 +1,46 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package conflicting
+
+import (
+	v1 "k8s.io/code-generator/examples/crd/informers/externalversions/conflicting/v1"
+	internalinterfaces "k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1 provides access to shared informers for resources in V1.
+	V1() v1.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1 returns a new v1.Interface.
+func (g *group) V1() v1.Interface {
+	return v1.New(g.factory, g.namespace, g.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/conflicting/v1/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/conflicting/v1/interface.go
new file mode 100644
index 0000000000..6114c2a01c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/conflicting/v1/interface.go
@@ -0,0 +1,45 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	internalinterfaces "k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// TestTypes returns a TestTypeInformer.
+	TestTypes() TypedTestTypeInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// TestTypes returns a TypedTestTypeInformer.
+func (v *version) TestTypes() TypedTestTypeInformer {
+	return &testTypeInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/conflicting/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/conflicting/v1/testtype.go
new file mode 100644
index 0000000000..75830cd5a3
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/conflicting/v1/testtype.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	apisconflictingv1 "k8s.io/code-generator/examples/crd/apis/conflicting/v1"
+	versioned "k8s.io/code-generator/examples/crd/clientset/versioned"
+	internalinterfaces "k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces"
+	conflictingv1 "k8s.io/code-generator/examples/crd/listers/conflicting/v1"
+)
+
+// TestTypeInformer provides access to a shared informer and lister for
+// TestTypes. Prefer using the type-safe variant (see [TypedTestTypeInformer]).
+type TestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() conflictingv1.TestTypeLister
+}
+
+// TypedTestTypeInformer provides access to a shared informer and lister for
+// TestTypes, including the type-safe TypedInformer variant.
+// It is a superset of TestTypeInformer.
+type TypedTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() TestTypeIndexInformer
+	Lister() conflictingv1.TestTypeLister
+}
+
+// TestTypeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type TestTypeIndexInformer cache.TypedSharedIndexInformer[*apisconflictingv1.TestType]
+
+// TestTypeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for TestType.
+type TestTypeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apisconflictingv1.TestType]
+
+// TestTypeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for TestType.
+type TestTypeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apisconflictingv1.TestType]
+
+// TestTypeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for TestType.
+type TestTypeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apisconflictingv1.TestType]
+
+// TestTypeIndexers is a specialization of [cache.TypedIndexers] for TestType.
+type TestTypeIndexers = cache.TypedIndexers[*apisconflictingv1.TestType]
+
+// DeletedTestType is a specialization of [cache.DeletedObject] for TestType.
+type DeletedTestType = cache.DeletedObject[*apisconflictingv1.TestType]
+
+type testTypeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformer]).
+func NewTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredTestTypeInformer]).
+func NewFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformerWithOptions]).
+func NewTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) TestTypeIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "conflicting.test.crd.code-generator.k8s.io", Version: "v1", Resource: "testtypes"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apisconflictingv1.TestType](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ConflictingExampleV1().TestTypes(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ConflictingExampleV1().TestTypes(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ConflictingExampleV1().TestTypes(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ConflictingExampleV1().TestTypes(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apisconflictingv1.TestType{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *testTypeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *testTypeInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *testTypeInformer) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisconflictingv1.TestType](f.factory.InformerFor(&apisconflictingv1.TestType{}, f.defaultInformer))
+}
+
+func (f *testTypeInformer) Lister() conflictingv1.TestTypeLister {
+	return conflictingv1.NewTestTypeLister(f.Informer().GetIndexer())
+}
+
+// ToTypedTestTypeInformer converts an untyped informer into a TypedTestTypeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TypedTestTypeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedTestTypeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedTestTypeInformer(informer TestTypeInformer) TypedTestTypeInformer {
+	if informer, ok := informer.(TypedTestTypeInformer); ok {
+		return informer
+	}
+	return &testTypeTypedInformerAdapter{informer}
+}
+
+type testTypeTypedInformerAdapter struct {
+	TestTypeInformer
+}
+
+func (a *testTypeTypedInformerAdapter) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisconflictingv1.TestType](a.Informer())
+}
+
+// ToTestTypeIndexInformer converts an untyped informer into a TestTypeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TestTypeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a TestTypeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTestTypeIndexInformer(informer cache.SharedIndexInformer) TestTypeIndexInformer {
+	if informer, ok := informer.(TestTypeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apisconflictingv1.TestType](informer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example/interface.go
new file mode 100644
index 0000000000..6998eef4fc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example/interface.go
@@ -0,0 +1,46 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package example
+
+import (
+	v1 "k8s.io/code-generator/examples/crd/informers/externalversions/example/v1"
+	internalinterfaces "k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1 provides access to shared informers for resources in V1.
+	V1() v1.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1 returns a new v1.Interface.
+func (g *group) V1() v1.Interface {
+	return v1.New(g.factory, g.namespace, g.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example/v1/clustertesttype.go
new file mode 100644
index 0000000000..d5aae54713
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example/v1/clustertesttype.go
@@ -0,0 +1,207 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	apisexamplev1 "k8s.io/code-generator/examples/crd/apis/example/v1"
+	versioned "k8s.io/code-generator/examples/crd/clientset/versioned"
+	internalinterfaces "k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces"
+	examplev1 "k8s.io/code-generator/examples/crd/listers/example/v1"
+)
+
+// ClusterTestTypeInformer provides access to a shared informer and lister for
+// ClusterTestTypes. Prefer using the type-safe variant (see [TypedClusterTestTypeInformer]).
+type ClusterTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() examplev1.ClusterTestTypeLister
+}
+
+// TypedClusterTestTypeInformer provides access to a shared informer and lister for
+// ClusterTestTypes, including the type-safe TypedInformer variant.
+// It is a superset of ClusterTestTypeInformer.
+type TypedClusterTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ClusterTestTypeIndexInformer
+	Lister() examplev1.ClusterTestTypeLister
+}
+
+// ClusterTestTypeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ClusterTestTypeIndexInformer cache.TypedSharedIndexInformer[*apisexamplev1.ClusterTestType]
+
+// ClusterTestTypeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ClusterTestType.
+type ClusterTestTypeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apisexamplev1.ClusterTestType]
+
+// ClusterTestTypeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ClusterTestType.
+type ClusterTestTypeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apisexamplev1.ClusterTestType]
+
+// ClusterTestTypeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ClusterTestType.
+type ClusterTestTypeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apisexamplev1.ClusterTestType]
+
+// ClusterTestTypeIndexers is a specialization of [cache.TypedIndexers] for ClusterTestType.
+type ClusterTestTypeIndexers = cache.TypedIndexers[*apisexamplev1.ClusterTestType]
+
+// DeletedClusterTestType is a specialization of [cache.DeletedObject] for ClusterTestType.
+type DeletedClusterTestType = cache.DeletedObject[*apisexamplev1.ClusterTestType]
+
+type clusterTestTypeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// NewClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterTestTypeInformer]).
+func NewClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers ClusterTestTypeIndexers) ClusterTestTypeIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredClusterTestTypeInformer]).
+func NewFilteredClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers ClusterTestTypeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterTestTypeIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewClusterTestTypeInformerWithOptions constructs a new informer for ClusterTestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterTestTypeInformerWithOptions]).
+func NewClusterTestTypeInformerWithOptions(client versioned.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, options)
+}
+
+// NewTypedClusterTestTypeInformerWithOptions constructs a new informer for ClusterTestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterTestTypeInformerWithOptions(client versioned.Interface, options internalinterfaces.InformerOptions) ClusterTestTypeIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "example.crd.code-generator.k8s.io", Version: "v1", Resource: "clustertesttypes"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.ClusterTestType](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().ClusterTestTypes().List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().ClusterTestTypes().Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().ClusterTestTypes().List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().ClusterTestTypes().Watch(ctx, opts)
+			},
+		}, client),
+		&apisexamplev1.ClusterTestType{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *clusterTestTypeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *clusterTestTypeInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *clusterTestTypeInformer) TypedInformer() ClusterTestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.ClusterTestType](f.factory.InformerFor(&apisexamplev1.ClusterTestType{}, f.defaultInformer))
+}
+
+func (f *clusterTestTypeInformer) Lister() examplev1.ClusterTestTypeLister {
+	return examplev1.NewClusterTestTypeLister(f.Informer().GetIndexer())
+}
+
+// ToTypedClusterTestTypeInformer converts an untyped informer into a TypedClusterTestTypeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterTestType. If that is not the case, calling type-safe methods of the returned
+// TypedClusterTestTypeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedClusterTestTypeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedClusterTestTypeInformer(informer ClusterTestTypeInformer) TypedClusterTestTypeInformer {
+	if informer, ok := informer.(TypedClusterTestTypeInformer); ok {
+		return informer
+	}
+	return &clusterTestTypeTypedInformerAdapter{informer}
+}
+
+type clusterTestTypeTypedInformerAdapter struct {
+	ClusterTestTypeInformer
+}
+
+func (a *clusterTestTypeTypedInformerAdapter) TypedInformer() ClusterTestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.ClusterTestType](a.Informer())
+}
+
+// ToClusterTestTypeIndexInformer converts an untyped informer into a ClusterTestTypeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterTestType. If that is not the case, calling type-safe methods of the returned
+// ClusterTestTypeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ClusterTestTypeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToClusterTestTypeIndexInformer(informer cache.SharedIndexInformer) ClusterTestTypeIndexInformer {
+	if informer, ok := informer.(ClusterTestTypeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.ClusterTestType](informer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example/v1/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example/v1/interface.go
new file mode 100644
index 0000000000..0135195f91
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example/v1/interface.go
@@ -0,0 +1,52 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	internalinterfaces "k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// ClusterTestTypes returns a ClusterTestTypeInformer.
+	ClusterTestTypes() TypedClusterTestTypeInformer
+	// TestTypes returns a TestTypeInformer.
+	TestTypes() TypedTestTypeInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// ClusterTestTypes returns a TypedClusterTestTypeInformer.
+func (v *version) ClusterTestTypes() TypedClusterTestTypeInformer {
+	return &clusterTestTypeInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// TestTypes returns a TypedTestTypeInformer.
+func (v *version) TestTypes() TypedTestTypeInformer {
+	return &testTypeInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example/v1/testtype.go
new file mode 100644
index 0000000000..a06f76b798
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example/v1/testtype.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	apisexamplev1 "k8s.io/code-generator/examples/crd/apis/example/v1"
+	versioned "k8s.io/code-generator/examples/crd/clientset/versioned"
+	internalinterfaces "k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces"
+	examplev1 "k8s.io/code-generator/examples/crd/listers/example/v1"
+)
+
+// TestTypeInformer provides access to a shared informer and lister for
+// TestTypes. Prefer using the type-safe variant (see [TypedTestTypeInformer]).
+type TestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() examplev1.TestTypeLister
+}
+
+// TypedTestTypeInformer provides access to a shared informer and lister for
+// TestTypes, including the type-safe TypedInformer variant.
+// It is a superset of TestTypeInformer.
+type TypedTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() TestTypeIndexInformer
+	Lister() examplev1.TestTypeLister
+}
+
+// TestTypeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type TestTypeIndexInformer cache.TypedSharedIndexInformer[*apisexamplev1.TestType]
+
+// TestTypeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for TestType.
+type TestTypeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apisexamplev1.TestType]
+
+// TestTypeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for TestType.
+type TestTypeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apisexamplev1.TestType]
+
+// TestTypeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for TestType.
+type TestTypeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apisexamplev1.TestType]
+
+// TestTypeIndexers is a specialization of [cache.TypedIndexers] for TestType.
+type TestTypeIndexers = cache.TypedIndexers[*apisexamplev1.TestType]
+
+// DeletedTestType is a specialization of [cache.DeletedObject] for TestType.
+type DeletedTestType = cache.DeletedObject[*apisexamplev1.TestType]
+
+type testTypeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformer]).
+func NewTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredTestTypeInformer]).
+func NewFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformerWithOptions]).
+func NewTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) TestTypeIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "example.crd.code-generator.k8s.io", Version: "v1", Resource: "testtypes"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apisexamplev1.TestType{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *testTypeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *testTypeInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *testTypeInformer) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](f.factory.InformerFor(&apisexamplev1.TestType{}, f.defaultInformer))
+}
+
+func (f *testTypeInformer) Lister() examplev1.TestTypeLister {
+	return examplev1.NewTestTypeLister(f.Informer().GetIndexer())
+}
+
+// ToTypedTestTypeInformer converts an untyped informer into a TypedTestTypeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TypedTestTypeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedTestTypeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedTestTypeInformer(informer TestTypeInformer) TypedTestTypeInformer {
+	if informer, ok := informer.(TypedTestTypeInformer); ok {
+		return informer
+	}
+	return &testTypeTypedInformerAdapter{informer}
+}
+
+type testTypeTypedInformerAdapter struct {
+	TestTypeInformer
+}
+
+func (a *testTypeTypedInformerAdapter) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](a.Informer())
+}
+
+// ToTestTypeIndexInformer converts an untyped informer into a TestTypeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TestTypeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a TestTypeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTestTypeIndexInformer(informer cache.SharedIndexInformer) TestTypeIndexInformer {
+	if informer, ok := informer.(TestTypeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apisexamplev1.TestType](informer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example2/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example2/interface.go
new file mode 100644
index 0000000000..5efd9bdcd2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example2/interface.go
@@ -0,0 +1,46 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package example2
+
+import (
+	v1 "k8s.io/code-generator/examples/crd/informers/externalversions/example2/v1"
+	internalinterfaces "k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1 provides access to shared informers for resources in V1.
+	V1() v1.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1 returns a new v1.Interface.
+func (g *group) V1() v1.Interface {
+	return v1.New(g.factory, g.namespace, g.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example2/v1/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example2/v1/interface.go
new file mode 100644
index 0000000000..6114c2a01c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example2/v1/interface.go
@@ -0,0 +1,45 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	internalinterfaces "k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// TestTypes returns a TestTypeInformer.
+	TestTypes() TypedTestTypeInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// TestTypes returns a TypedTestTypeInformer.
+func (v *version) TestTypes() TypedTestTypeInformer {
+	return &testTypeInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example2/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example2/v1/testtype.go
new file mode 100644
index 0000000000..61ff074231
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/example2/v1/testtype.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	apisexample2v1 "k8s.io/code-generator/examples/crd/apis/example2/v1"
+	versioned "k8s.io/code-generator/examples/crd/clientset/versioned"
+	internalinterfaces "k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces"
+	example2v1 "k8s.io/code-generator/examples/crd/listers/example2/v1"
+)
+
+// TestTypeInformer provides access to a shared informer and lister for
+// TestTypes. Prefer using the type-safe variant (see [TypedTestTypeInformer]).
+type TestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() example2v1.TestTypeLister
+}
+
+// TypedTestTypeInformer provides access to a shared informer and lister for
+// TestTypes, including the type-safe TypedInformer variant.
+// It is a superset of TestTypeInformer.
+type TypedTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() TestTypeIndexInformer
+	Lister() example2v1.TestTypeLister
+}
+
+// TestTypeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type TestTypeIndexInformer cache.TypedSharedIndexInformer[*apisexample2v1.TestType]
+
+// TestTypeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for TestType.
+type TestTypeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apisexample2v1.TestType]
+
+// TestTypeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for TestType.
+type TestTypeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apisexample2v1.TestType]
+
+// TestTypeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for TestType.
+type TestTypeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apisexample2v1.TestType]
+
+// TestTypeIndexers is a specialization of [cache.TypedIndexers] for TestType.
+type TestTypeIndexers = cache.TypedIndexers[*apisexample2v1.TestType]
+
+// DeletedTestType is a specialization of [cache.DeletedObject] for TestType.
+type DeletedTestType = cache.DeletedObject[*apisexample2v1.TestType]
+
+type testTypeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformer]).
+func NewTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredTestTypeInformer]).
+func NewFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformerWithOptions]).
+func NewTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) TestTypeIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "example.test.crd.code-generator.k8s.io", Version: "v1", Resource: "testtypes"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apisexample2v1.TestType](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SecondExampleV1().TestTypes(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SecondExampleV1().TestTypes(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SecondExampleV1().TestTypes(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SecondExampleV1().TestTypes(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apisexample2v1.TestType{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *testTypeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *testTypeInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *testTypeInformer) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexample2v1.TestType](f.factory.InformerFor(&apisexample2v1.TestType{}, f.defaultInformer))
+}
+
+func (f *testTypeInformer) Lister() example2v1.TestTypeLister {
+	return example2v1.NewTestTypeLister(f.Informer().GetIndexer())
+}
+
+// ToTypedTestTypeInformer converts an untyped informer into a TypedTestTypeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TypedTestTypeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedTestTypeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedTestTypeInformer(informer TestTypeInformer) TypedTestTypeInformer {
+	if informer, ok := informer.(TypedTestTypeInformer); ok {
+		return informer
+	}
+	return &testTypeTypedInformerAdapter{informer}
+}
+
+type testTypeTypedInformerAdapter struct {
+	TestTypeInformer
+}
+
+func (a *testTypeTypedInformerAdapter) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisexample2v1.TestType](a.Informer())
+}
+
+// ToTestTypeIndexInformer converts an untyped informer into a TestTypeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TestTypeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a TestTypeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTestTypeIndexInformer(informer cache.SharedIndexInformer) TestTypeIndexInformer {
+	if informer, ok := informer.(TestTypeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apisexample2v1.TestType](informer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/extensions/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/extensions/interface.go
new file mode 100644
index 0000000000..5f271ea464
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/extensions/interface.go
@@ -0,0 +1,46 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package extensions
+
+import (
+	v1 "k8s.io/code-generator/examples/crd/informers/externalversions/extensions/v1"
+	internalinterfaces "k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1 provides access to shared informers for resources in V1.
+	V1() v1.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1 returns a new v1.Interface.
+func (g *group) V1() v1.Interface {
+	return v1.New(g.factory, g.namespace, g.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/extensions/v1/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/extensions/v1/interface.go
new file mode 100644
index 0000000000..6114c2a01c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/extensions/v1/interface.go
@@ -0,0 +1,45 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	internalinterfaces "k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// TestTypes returns a TestTypeInformer.
+	TestTypes() TypedTestTypeInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// TestTypes returns a TypedTestTypeInformer.
+func (v *version) TestTypes() TypedTestTypeInformer {
+	return &testTypeInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/extensions/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/extensions/v1/testtype.go
new file mode 100644
index 0000000000..7135832696
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/extensions/v1/testtype.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	apisextensionsv1 "k8s.io/code-generator/examples/crd/apis/extensions/v1"
+	versioned "k8s.io/code-generator/examples/crd/clientset/versioned"
+	internalinterfaces "k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces"
+	extensionsv1 "k8s.io/code-generator/examples/crd/listers/extensions/v1"
+)
+
+// TestTypeInformer provides access to a shared informer and lister for
+// TestTypes. Prefer using the type-safe variant (see [TypedTestTypeInformer]).
+type TestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() extensionsv1.TestTypeLister
+}
+
+// TypedTestTypeInformer provides access to a shared informer and lister for
+// TestTypes, including the type-safe TypedInformer variant.
+// It is a superset of TestTypeInformer.
+type TypedTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() TestTypeIndexInformer
+	Lister() extensionsv1.TestTypeLister
+}
+
+// TestTypeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type TestTypeIndexInformer cache.TypedSharedIndexInformer[*apisextensionsv1.TestType]
+
+// TestTypeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for TestType.
+type TestTypeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apisextensionsv1.TestType]
+
+// TestTypeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for TestType.
+type TestTypeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apisextensionsv1.TestType]
+
+// TestTypeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for TestType.
+type TestTypeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apisextensionsv1.TestType]
+
+// TestTypeIndexers is a specialization of [cache.TypedIndexers] for TestType.
+type TestTypeIndexers = cache.TypedIndexers[*apisextensionsv1.TestType]
+
+// DeletedTestType is a specialization of [cache.DeletedObject] for TestType.
+type DeletedTestType = cache.DeletedObject[*apisextensionsv1.TestType]
+
+type testTypeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformer]).
+func NewTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredTestTypeInformer]).
+func NewFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformerWithOptions]).
+func NewTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) TestTypeIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "extensions.test.crd.code-generator.k8s.io", Version: "v1", Resource: "testtypes"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apisextensionsv1.TestType](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExtensionsExampleV1().TestTypes(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExtensionsExampleV1().TestTypes(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExtensionsExampleV1().TestTypes(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExtensionsExampleV1().TestTypes(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apisextensionsv1.TestType{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *testTypeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *testTypeInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *testTypeInformer) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisextensionsv1.TestType](f.factory.InformerFor(&apisextensionsv1.TestType{}, f.defaultInformer))
+}
+
+func (f *testTypeInformer) Lister() extensionsv1.TestTypeLister {
+	return extensionsv1.NewTestTypeLister(f.Informer().GetIndexer())
+}
+
+// ToTypedTestTypeInformer converts an untyped informer into a TypedTestTypeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TypedTestTypeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedTestTypeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedTestTypeInformer(informer TestTypeInformer) TypedTestTypeInformer {
+	if informer, ok := informer.(TypedTestTypeInformer); ok {
+		return informer
+	}
+	return &testTypeTypedInformerAdapter{informer}
+}
+
+type testTypeTypedInformerAdapter struct {
+	TestTypeInformer
+}
+
+func (a *testTypeTypedInformerAdapter) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apisextensionsv1.TestType](a.Informer())
+}
+
+// ToTestTypeIndexInformer converts an untyped informer into a TestTypeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TestTypeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a TestTypeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTestTypeIndexInformer(informer cache.SharedIndexInformer) TestTypeIndexInformer {
+	if informer, ok := informer.(TestTypeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apisextensionsv1.TestType](informer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/factory.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/factory.go
new file mode 100644
index 0000000000..6570984922
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/factory.go
@@ -0,0 +1,351 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	context "context"
+	reflect "reflect"
+	sync "sync"
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	wait "k8s.io/apimachinery/pkg/util/wait"
+	cache "k8s.io/client-go/tools/cache"
+	versioned "k8s.io/code-generator/examples/crd/clientset/versioned"
+	conflicting "k8s.io/code-generator/examples/crd/informers/externalversions/conflicting"
+	example "k8s.io/code-generator/examples/crd/informers/externalversions/example"
+	example2 "k8s.io/code-generator/examples/crd/informers/externalversions/example2"
+	extensions "k8s.io/code-generator/examples/crd/informers/externalversions/extensions"
+	internalinterfaces "k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces"
+)
+
+// SharedInformerOption defines the functional option type for SharedInformerFactory.
+type SharedInformerOption func(*sharedInformerFactory) *sharedInformerFactory
+
+type sharedInformerFactory struct {
+	client           versioned.Interface
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	lock             sync.Mutex
+	defaultResync    time.Duration
+	customResync     map[reflect.Type]time.Duration
+	transform        cache.TransformFunc
+	informerName     *cache.InformerName
+
+	informers map[reflect.Type]cache.SharedIndexInformer
+	// startedInformers is used for tracking which informers have been started.
+	// This allows Start() to be called multiple times safely.
+	startedInformers map[reflect.Type]bool
+	// wg tracks how many goroutines were started.
+	wg sync.WaitGroup
+	// shuttingDown is true when Shutdown has been called. It may still be running
+	// because it needs to wait for goroutines.
+	shuttingDown bool
+}
+
+// WithCustomResyncConfig sets a custom resync period for the specified informer types.
+func WithCustomResyncConfig(resyncConfig map[v1.Object]time.Duration) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		for k, v := range resyncConfig {
+			factory.customResync[reflect.TypeOf(k)] = v
+		}
+		return factory
+	}
+}
+
+// WithTweakListOptions sets a custom filter on all listers of the configured SharedInformerFactory.
+func WithTweakListOptions(tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.tweakListOptions = tweakListOptions
+		return factory
+	}
+}
+
+// WithNamespace limits the SharedInformerFactory to the specified namespace.
+func WithNamespace(namespace string) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.namespace = namespace
+		return factory
+	}
+}
+
+// WithTransform sets a transform on all informers.
+func WithTransform(transform cache.TransformFunc) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.transform = transform
+		return factory
+	}
+}
+
+// WithInformerName sets the InformerName for informer identity used in metrics.
+// The InformerName must be created via cache.NewInformerName() at startup,
+// which validates global uniqueness. Each informer type will register its
+// GVR under this name.
+func WithInformerName(informerName *cache.InformerName) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.informerName = informerName
+		return factory
+	}
+}
+
+func (f *sharedInformerFactory) InformerName() *cache.InformerName {
+	return f.informerName
+}
+
+// NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces.
+func NewSharedInformerFactory(client versioned.Interface, defaultResync time.Duration) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync)
+}
+
+// NewFilteredSharedInformerFactory constructs a new instance of sharedInformerFactory.
+// Listers obtained via this SharedInformerFactory will be subject to the same filters
+// as specified here.
+//
+// Deprecated: Please use NewSharedInformerFactoryWithOptions instead
+func NewFilteredSharedInformerFactory(client versioned.Interface, defaultResync time.Duration, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync, WithNamespace(namespace), WithTweakListOptions(tweakListOptions))
+}
+
+// NewSharedInformerFactoryWithOptions constructs a new instance of a SharedInformerFactory with additional options.
+func NewSharedInformerFactoryWithOptions(client versioned.Interface, defaultResync time.Duration, options ...SharedInformerOption) SharedInformerFactory {
+	factory := &sharedInformerFactory{
+		client:           client,
+		namespace:        v1.NamespaceAll,
+		defaultResync:    defaultResync,
+		informers:        make(map[reflect.Type]cache.SharedIndexInformer),
+		startedInformers: make(map[reflect.Type]bool),
+		customResync:     make(map[reflect.Type]time.Duration),
+	}
+
+	// Apply all options
+	for _, opt := range options {
+		factory = opt(factory)
+	}
+
+	return factory
+}
+
+func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
+	f.StartWithContext(wait.ContextForChannel(stopCh))
+}
+
+func (f *sharedInformerFactory) StartWithContext(ctx context.Context) {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	if f.shuttingDown {
+		return
+	}
+
+	for informerType, informer := range f.informers {
+		if !f.startedInformers[informerType] {
+			f.wg.Go(func() {
+				informer.RunWithContext(ctx)
+			})
+			f.startedInformers[informerType] = true
+		}
+	}
+}
+
+func (f *sharedInformerFactory) Shutdown() {
+	f.lock.Lock()
+	f.shuttingDown = true
+	f.lock.Unlock()
+
+	// Will return immediately if there is nothing to wait for.
+	f.wg.Wait()
+	f.informerName.Release()
+}
+
+func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
+	result := f.WaitForCacheSyncWithContext(wait.ContextForChannel(stopCh))
+	return result.Synced
+}
+
+func (f *sharedInformerFactory) WaitForCacheSyncWithContext(ctx context.Context) cache.SyncResult {
+	informers := func() map[reflect.Type]cache.SharedIndexInformer {
+		f.lock.Lock()
+		defer f.lock.Unlock()
+
+		informers := map[reflect.Type]cache.SharedIndexInformer{}
+		for informerType, informer := range f.informers {
+			if f.startedInformers[informerType] {
+				informers[informerType] = informer
+			}
+		}
+		return informers
+	}()
+
+	// Wait for informers to sync, without polling.
+	cacheSyncs := make([]cache.DoneChecker, 0, len(informers))
+	for _, informer := range informers {
+		cacheSyncs = append(cacheSyncs, informer.HasSyncedChecker())
+	}
+	cache.WaitFor(ctx, "" /* no logging */, cacheSyncs...)
+
+	res := cache.SyncResult{
+		Synced: make(map[reflect.Type]bool, len(informers)),
+	}
+	failed := false
+	for informType, informer := range informers {
+		hasSynced := informer.HasSynced()
+		if !hasSynced {
+			failed = true
+		}
+		res.Synced[informType] = hasSynced
+	}
+	if failed {
+		// context.Cause is more informative than ctx.Err().
+		// This must be non-nil, otherwise WaitFor wouldn't have stopped
+		// prematurely.
+		res.Err = context.Cause(ctx)
+	}
+
+	return res
+}
+
+// InformerFor returns the SharedIndexInformer for obj using an internal
+// client.
+func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(obj)
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+
+	resyncPeriod, exists := f.customResync[informerType]
+	if !exists {
+		resyncPeriod = f.defaultResync
+	}
+
+	informer = newFunc(f.client, resyncPeriod)
+	if f.transform != nil {
+		informer.SetTransform(f.transform)
+	}
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// SharedInformerFactory provides shared informers for resources in all known
+// API group versions.
+//
+// It is typically used like this:
+//
+//	ctx, cancel := context.WithCancel(context.Background())
+//	defer cancel()
+//	factory := NewSharedInformerFactory(client, resyncPeriod)
+//	defer factory.Shutdown()    // Returns immediately if nothing was started.
+//	genericInformer := factory.ForResource(resource)
+//	typedInformer := factory.SomeAPIGroup().V1().SomeType()
+//	handle, err := typeInformer.Informer().AddEventHandler(...)
+//	if err != nil {
+//	    return fmt.Errorf("register event handler: %v", err)
+//	}
+//	defer typeInformer.Informer().RemoveEventHandler(handle) // Avoids leaking goroutines.
+//	factory.StartWithContext(ctx)                            // Start processing these informers.
+//	synced := factory.WaitForCacheSyncWithContext(ctx)
+//	if err := synced.AsError(); err != nil {
+//	    return err
+//	}
+//	for v := range synced {
+//	    // Only if desired log some information similar to this.
+//	    fmt.Fprintf(os.Stdout, "cache synced: %s", v)
+//	}
+//
+//	// Also make sure that all of the initial cache events have been delivered.
+//	if !WaitFor(ctx, "event handler sync", handle.HasSyncedChecker()) {
+//	    // Must have failed because of context.
+//	    return fmt.Errorf("sync event handler: %w", context.Cause(ctx))
+//	}
+//
+//	// Creating informers can also be created after Start, but then
+//	// Start must be called again:
+//	anotherGenericInformer := factory.ForResource(resource)
+//	factory.StartWithContext(ctx)
+type SharedInformerFactory interface {
+	internalinterfaces.SharedInformerFactory
+
+	// Start initializes all requested informers. They are handled in goroutines
+	// which run until the stop channel gets closed.
+	// Warning: Start does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	//
+	// Contextual logging: StartWithContext should be used instead of Start in code which supports contextual logging.
+	Start(stopCh <-chan struct{})
+
+	// StartWithContext initializes all requested informers. They are handled in goroutines
+	// which run until the context gets canceled.
+	// Warning: StartWithContext does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	StartWithContext(ctx context.Context)
+
+	// Shutdown marks a factory as shutting down. At that point no new
+	// informers can be started anymore and Start will return without
+	// doing anything.
+	//
+	// In addition, Shutdown blocks until all goroutines have terminated. For that
+	// to happen, the close channel(s) that they were started with must be closed,
+	// either before Shutdown gets called or while it is waiting.
+	//
+	// Shutdown may be called multiple times, even concurrently. All such calls will
+	// block until all goroutines have terminated.
+	Shutdown()
+
+	// WaitForCacheSync blocks until all started informers' caches were synced
+	// or the stop channel gets closed.
+	//
+	// Contextual logging: WaitForCacheSyncWithContext should be used instead of WaitForCacheSync in code which supports contextual logging. It also returns a more useful result.
+	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
+
+	// WaitForCacheSyncWithContext blocks until all started informers' caches were synced
+	// or the context gets canceled.
+	WaitForCacheSyncWithContext(ctx context.Context) cache.SyncResult
+
+	// ForResource gives generic access to a shared informer of the matching type.
+	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
+
+	// InformerFor returns the SharedIndexInformer for obj using an internal
+	// client.
+	InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer
+
+	ConflictingExample() conflicting.Interface
+	Example() example.Interface
+	SecondExample() example2.Interface
+	ExtensionsExample() extensions.Interface
+}
+
+func (f *sharedInformerFactory) ConflictingExample() conflicting.Interface {
+	return conflicting.New(f, f.namespace, f.tweakListOptions)
+}
+
+func (f *sharedInformerFactory) Example() example.Interface {
+	return example.New(f, f.namespace, f.tweakListOptions)
+}
+
+func (f *sharedInformerFactory) SecondExample() example2.Interface {
+	return example2.New(f, f.namespace, f.tweakListOptions)
+}
+
+func (f *sharedInformerFactory) ExtensionsExample() extensions.Interface {
+	return extensions.New(f, f.namespace, f.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/generic.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/generic.go
new file mode 100644
index 0000000000..97c23d6e3d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/generic.go
@@ -0,0 +1,79 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	fmt "fmt"
+
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	cache "k8s.io/client-go/tools/cache"
+	v1 "k8s.io/code-generator/examples/crd/apis/conflicting/v1"
+	examplev1 "k8s.io/code-generator/examples/crd/apis/example/v1"
+	example2v1 "k8s.io/code-generator/examples/crd/apis/example2/v1"
+	extensionsv1 "k8s.io/code-generator/examples/crd/apis/extensions/v1"
+)
+
+// GenericInformer is type of SharedIndexInformer which will locate and delegate to other
+// sharedInformers based on type
+type GenericInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() cache.GenericLister
+}
+
+type genericInformer struct {
+	informer cache.SharedIndexInformer
+	resource schema.GroupResource
+}
+
+// Informer returns the SharedIndexInformer.
+func (f *genericInformer) Informer() cache.SharedIndexInformer {
+	return f.informer
+}
+
+// Lister returns the GenericLister.
+func (f *genericInformer) Lister() cache.GenericLister {
+	return cache.NewGenericLister(f.Informer().GetIndexer(), f.resource)
+}
+
+// ForResource gives generic access to a shared informer of the matching type
+// TODO extend this to unknown resources with a client pool
+func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource) (GenericInformer, error) {
+	switch resource {
+	// Group=conflicting.test.crd.code-generator.k8s.io, Version=v1
+	case v1.SchemeGroupVersion.WithResource("testtypes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.ConflictingExample().V1().TestTypes().Informer()}, nil
+
+		// Group=example.crd.code-generator.k8s.io, Version=v1
+	case examplev1.SchemeGroupVersion.WithResource("clustertesttypes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Example().V1().ClusterTestTypes().Informer()}, nil
+	case examplev1.SchemeGroupVersion.WithResource("testtypes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Example().V1().TestTypes().Informer()}, nil
+
+		// Group=example.test.crd.code-generator.k8s.io, Version=v1
+	case example2v1.SchemeGroupVersion.WithResource("testtypes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.SecondExample().V1().TestTypes().Informer()}, nil
+
+		// Group=extensions.test.crd.code-generator.k8s.io, Version=v1
+	case extensionsv1.SchemeGroupVersion.WithResource("testtypes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.ExtensionsExample().V1().TestTypes().Informer()}, nil
+
+	}
+
+	return nil, fmt.Errorf("no informer found for %v", resource)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces/factory_interfaces.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces/factory_interfaces.go
new file mode 100644
index 0000000000..2248213488
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/informers/externalversions/internalinterfaces/factory_interfaces.go
@@ -0,0 +1,59 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package internalinterfaces
+
+import (
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	cache "k8s.io/client-go/tools/cache"
+	versioned "k8s.io/code-generator/examples/crd/clientset/versioned"
+)
+
+// NewInformerFunc takes versioned.Interface and time.Duration to return a SharedIndexInformer.
+type NewInformerFunc func(versioned.Interface, time.Duration) cache.SharedIndexInformer
+
+// SharedInformerFactory a small interface to allow for adding an informer without an import cycle
+type SharedInformerFactory interface {
+	Start(stopCh <-chan struct{})
+	InformerFor(obj runtime.Object, newFunc NewInformerFunc) cache.SharedIndexInformer
+	InformerName() *cache.InformerName
+}
+
+// TweakListOptionsFunc is a function that transforms a v1.ListOptions.
+type TweakListOptionsFunc func(*v1.ListOptions)
+
+// InformerOptions holds the options for creating an informer.
+type InformerOptions struct {
+	// ResyncPeriod is the resync period for this informer.
+	// If not set, defaults to 0 (no resync).
+	ResyncPeriod time.Duration
+
+	// Indexers are the indexers for this informer.
+	Indexers cache.Indexers
+
+	// InformerName is used to uniquely identify this informer for metrics.
+	// If not set, metrics will not be published for this informer.
+	// Use cache.NewInformerName() to create an InformerName at startup.
+	InformerName *cache.InformerName
+
+	// TweakListOptions is an optional function to modify the list options.
+	TweakListOptions TweakListOptionsFunc
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/conflicting/v1/expansion_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/conflicting/v1/expansion_generated.go
new file mode 100644
index 0000000000..0192e05f0d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/conflicting/v1/expansion_generated.go
@@ -0,0 +1,27 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+// TestTypeListerExpansion allows custom methods to be added to
+// TestTypeLister.
+type TestTypeListerExpansion interface{}
+
+// TestTypeNamespaceListerExpansion allows custom methods to be added to
+// TestTypeNamespaceLister.
+type TestTypeNamespaceListerExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/conflicting/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/conflicting/v1/testtype.go
new file mode 100644
index 0000000000..f1ab5b8b69
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/conflicting/v1/testtype.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	conflictingv1 "k8s.io/code-generator/examples/crd/apis/conflicting/v1"
+)
+
+// TestTypeLister helps list TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeLister interface {
+	// List lists all TestTypes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*conflictingv1.TestType, err error)
+	// TestTypes returns an object that can list and get TestTypes.
+	TestTypes(namespace string) TestTypeNamespaceLister
+	TestTypeListerExpansion
+}
+
+// testTypeLister implements the TestTypeLister interface.
+type testTypeLister struct {
+	listers.ResourceIndexer[*conflictingv1.TestType]
+}
+
+// NewTestTypeLister returns a new TestTypeLister.
+func NewTestTypeLister(indexer cache.Indexer) TestTypeLister {
+	return &testTypeLister{listers.New[*conflictingv1.TestType](indexer, conflictingv1.Resource("testtype"))}
+}
+
+// TestTypes returns an object that can list and get TestTypes.
+func (s *testTypeLister) TestTypes(namespace string) TestTypeNamespaceLister {
+	return testTypeNamespaceLister{listers.NewNamespaced[*conflictingv1.TestType](s.ResourceIndexer, namespace)}
+}
+
+// TestTypeNamespaceLister helps list and get TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeNamespaceLister interface {
+	// List lists all TestTypes in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*conflictingv1.TestType, err error)
+	// Get retrieves the TestType from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*conflictingv1.TestType, error)
+	TestTypeNamespaceListerExpansion
+}
+
+// testTypeNamespaceLister implements the TestTypeNamespaceLister
+// interface.
+type testTypeNamespaceLister struct {
+	listers.ResourceIndexer[*conflictingv1.TestType]
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/example/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/example/v1/clustertesttype.go
new file mode 100644
index 0000000000..612ea8ba59
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/example/v1/clustertesttype.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	examplev1 "k8s.io/code-generator/examples/crd/apis/example/v1"
+)
+
+// ClusterTestTypeLister helps list ClusterTestTypes.
+// All objects returned here must be treated as read-only.
+type ClusterTestTypeLister interface {
+	// List lists all ClusterTestTypes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*examplev1.ClusterTestType, err error)
+	// Get retrieves the ClusterTestType from the index for a given name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*examplev1.ClusterTestType, error)
+	ClusterTestTypeListerExpansion
+}
+
+// clusterTestTypeLister implements the ClusterTestTypeLister interface.
+type clusterTestTypeLister struct {
+	listers.ResourceIndexer[*examplev1.ClusterTestType]
+}
+
+// NewClusterTestTypeLister returns a new ClusterTestTypeLister.
+func NewClusterTestTypeLister(indexer cache.Indexer) ClusterTestTypeLister {
+	return &clusterTestTypeLister{listers.New[*examplev1.ClusterTestType](indexer, examplev1.Resource("clustertesttype"))}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/example/v1/expansion_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/example/v1/expansion_generated.go
new file mode 100644
index 0000000000..2681a29f47
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/example/v1/expansion_generated.go
@@ -0,0 +1,31 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+// ClusterTestTypeListerExpansion allows custom methods to be added to
+// ClusterTestTypeLister.
+type ClusterTestTypeListerExpansion interface{}
+
+// TestTypeListerExpansion allows custom methods to be added to
+// TestTypeLister.
+type TestTypeListerExpansion interface{}
+
+// TestTypeNamespaceListerExpansion allows custom methods to be added to
+// TestTypeNamespaceLister.
+type TestTypeNamespaceListerExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/example/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/example/v1/testtype.go
new file mode 100644
index 0000000000..9ba7d40053
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/example/v1/testtype.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	examplev1 "k8s.io/code-generator/examples/crd/apis/example/v1"
+)
+
+// TestTypeLister helps list TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeLister interface {
+	// List lists all TestTypes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*examplev1.TestType, err error)
+	// TestTypes returns an object that can list and get TestTypes.
+	TestTypes(namespace string) TestTypeNamespaceLister
+	TestTypeListerExpansion
+}
+
+// testTypeLister implements the TestTypeLister interface.
+type testTypeLister struct {
+	listers.ResourceIndexer[*examplev1.TestType]
+}
+
+// NewTestTypeLister returns a new TestTypeLister.
+func NewTestTypeLister(indexer cache.Indexer) TestTypeLister {
+	return &testTypeLister{listers.New[*examplev1.TestType](indexer, examplev1.Resource("testtype"))}
+}
+
+// TestTypes returns an object that can list and get TestTypes.
+func (s *testTypeLister) TestTypes(namespace string) TestTypeNamespaceLister {
+	return testTypeNamespaceLister{listers.NewNamespaced[*examplev1.TestType](s.ResourceIndexer, namespace)}
+}
+
+// TestTypeNamespaceLister helps list and get TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeNamespaceLister interface {
+	// List lists all TestTypes in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*examplev1.TestType, err error)
+	// Get retrieves the TestType from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*examplev1.TestType, error)
+	TestTypeNamespaceListerExpansion
+}
+
+// testTypeNamespaceLister implements the TestTypeNamespaceLister
+// interface.
+type testTypeNamespaceLister struct {
+	listers.ResourceIndexer[*examplev1.TestType]
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/example2/v1/expansion_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/example2/v1/expansion_generated.go
new file mode 100644
index 0000000000..0192e05f0d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/example2/v1/expansion_generated.go
@@ -0,0 +1,27 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+// TestTypeListerExpansion allows custom methods to be added to
+// TestTypeLister.
+type TestTypeListerExpansion interface{}
+
+// TestTypeNamespaceListerExpansion allows custom methods to be added to
+// TestTypeNamespaceLister.
+type TestTypeNamespaceListerExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/example2/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/example2/v1/testtype.go
new file mode 100644
index 0000000000..3763c397b6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/example2/v1/testtype.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	example2v1 "k8s.io/code-generator/examples/crd/apis/example2/v1"
+)
+
+// TestTypeLister helps list TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeLister interface {
+	// List lists all TestTypes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*example2v1.TestType, err error)
+	// TestTypes returns an object that can list and get TestTypes.
+	TestTypes(namespace string) TestTypeNamespaceLister
+	TestTypeListerExpansion
+}
+
+// testTypeLister implements the TestTypeLister interface.
+type testTypeLister struct {
+	listers.ResourceIndexer[*example2v1.TestType]
+}
+
+// NewTestTypeLister returns a new TestTypeLister.
+func NewTestTypeLister(indexer cache.Indexer) TestTypeLister {
+	return &testTypeLister{listers.New[*example2v1.TestType](indexer, example2v1.Resource("testtype"))}
+}
+
+// TestTypes returns an object that can list and get TestTypes.
+func (s *testTypeLister) TestTypes(namespace string) TestTypeNamespaceLister {
+	return testTypeNamespaceLister{listers.NewNamespaced[*example2v1.TestType](s.ResourceIndexer, namespace)}
+}
+
+// TestTypeNamespaceLister helps list and get TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeNamespaceLister interface {
+	// List lists all TestTypes in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*example2v1.TestType, err error)
+	// Get retrieves the TestType from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*example2v1.TestType, error)
+	TestTypeNamespaceListerExpansion
+}
+
+// testTypeNamespaceLister implements the TestTypeNamespaceLister
+// interface.
+type testTypeNamespaceLister struct {
+	listers.ResourceIndexer[*example2v1.TestType]
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/extensions/v1/expansion_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/extensions/v1/expansion_generated.go
new file mode 100644
index 0000000000..0192e05f0d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/extensions/v1/expansion_generated.go
@@ -0,0 +1,27 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+// TestTypeListerExpansion allows custom methods to be added to
+// TestTypeLister.
+type TestTypeListerExpansion interface{}
+
+// TestTypeNamespaceListerExpansion allows custom methods to be added to
+// TestTypeNamespaceLister.
+type TestTypeNamespaceListerExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/extensions/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/extensions/v1/testtype.go
new file mode 100644
index 0000000000..573b9535b9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/crd/listers/extensions/v1/testtype.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	extensionsv1 "k8s.io/code-generator/examples/crd/apis/extensions/v1"
+)
+
+// TestTypeLister helps list TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeLister interface {
+	// List lists all TestTypes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*extensionsv1.TestType, err error)
+	// TestTypes returns an object that can list and get TestTypes.
+	TestTypes(namespace string) TestTypeNamespaceLister
+	TestTypeListerExpansion
+}
+
+// testTypeLister implements the TestTypeLister interface.
+type testTypeLister struct {
+	listers.ResourceIndexer[*extensionsv1.TestType]
+}
+
+// NewTestTypeLister returns a new TestTypeLister.
+func NewTestTypeLister(indexer cache.Indexer) TestTypeLister {
+	return &testTypeLister{listers.New[*extensionsv1.TestType](indexer, extensionsv1.Resource("testtype"))}
+}
+
+// TestTypes returns an object that can list and get TestTypes.
+func (s *testTypeLister) TestTypes(namespace string) TestTypeNamespaceLister {
+	return testTypeNamespaceLister{listers.NewNamespaced[*extensionsv1.TestType](s.ResourceIndexer, namespace)}
+}
+
+// TestTypeNamespaceLister helps list and get TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeNamespaceLister interface {
+	// List lists all TestTypes in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*extensionsv1.TestType, err error)
+	// Get retrieves the TestType from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*extensionsv1.TestType, error)
+	TestTypeNamespaceListerExpansion
+}
+
+// testTypeNamespaceLister implements the TestTypeNamespaceLister
+// interface.
+type testTypeNamespaceLister struct {
+	listers.ResourceIndexer[*extensionsv1.TestType]
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/go.mod b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/go.mod
new file mode 100644
index 0000000000..5f603c72a2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/go.mod
@@ -0,0 +1,68 @@
+// This is a submodule to isolate k8s.io/code-generator from k8s.io/{api,apimachinery,client-go} dependencies in generated code
+
+module k8s.io/code-generator/examples
+
+go 1.26.0
+
+godebug default=go1.26
+
+require (
+	k8s.io/api v0.0.0
+	k8s.io/apimachinery v0.0.0
+	k8s.io/client-go v0.0.0
+	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-openapi/jsonpointer v1.0.0 // indirect
+	github.com/go-openapi/jsonreference v1.0.0 // indirect
+	github.com/go-openapi/swag v0.27.1 // indirect
+	github.com/go-openapi/swag/cmdutils v0.27.1 // indirect
+	github.com/go-openapi/swag/conv v0.27.1 // indirect
+	github.com/go-openapi/swag/fileutils v0.27.1 // indirect
+	github.com/go-openapi/swag/jsonutils v0.27.1 // indirect
+	github.com/go-openapi/swag/loading v0.27.1 // indirect
+	github.com/go-openapi/swag/mangling v0.27.1 // indirect
+	github.com/go-openapi/swag/netutils v0.27.1 // indirect
+	github.com/go-openapi/swag/pools v0.27.1 // indirect
+	github.com/go-openapi/swag/stringutils v0.27.1 // indirect
+	github.com/go-openapi/swag/typeutils v0.27.1 // indirect
+	github.com/go-openapi/swag/yamlutils v0.27.1 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	k8s.io/klog/v2 v2.140.0 // indirect
+	k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
+)
+
+replace (
+	k8s.io/api => ../../api
+	k8s.io/apimachinery => ../../apimachinery
+	k8s.io/client-go => ../../client-go
+)
+
+replace github.com/container-storage-interface/spec => github.com/gnufied/spec v1.7.1-0.20260718120346-8e06851c4133
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/go.sum b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/go.sum
new file mode 100644
index 0000000000..fa5fe1590a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/go.sum
@@ -0,0 +1,123 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
+github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
+github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
+github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
+github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY=
+github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0=
+github.com/go-openapi/swag v0.27.1 h1:VotvOLWW8q/EAxB0YdsBBGC8XYyeL1YwBj2ungAGPNg=
+github.com/go-openapi/swag v0.27.1/go.mod h1:GTkJPwHfhJp6MWr4/rCh64HVI3Ofu+tcsbfjfHmTxpE=
+github.com/go-openapi/swag/cmdutils v0.27.1 h1:I7sYqaWVl5mq0NEmNQkAmFDyNin9ufvMX/p2zwtQaOE=
+github.com/go-openapi/swag/cmdutils v0.27.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
+github.com/go-openapi/swag/conv v0.27.1 h1:8wi9ZG+olmY1wXphl93EWniPtbSPkXM/feH7FgjsvrU=
+github.com/go-openapi/swag/conv v0.27.1/go.mod h1:QbqMivkpKhC3g1B1GGGOJ6ANewI3S62dbzYu3Duowqs=
+github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzrb0QkmLKf9oM=
+github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8=
+github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU=
+github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1 h1:mJu3COL9WEaZVp/Kf2PRMi7tPszPEJfSr/OO75ynCs8=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY=
+github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY=
+github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE=
+github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA=
+github.com/go-openapi/swag/mangling v0.27.1/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w=
+github.com/go-openapi/swag/netutils v0.27.1 h1:mICMFoS82F5TZ4Zy3cqmcQk+BFeCp3Uyq3Np7GI0/qU=
+github.com/go-openapi/swag/netutils v0.27.1/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ=
+github.com/go-openapi/swag/pools v0.27.1 h1:9LeadcMyb2GJCbXX5hVQDbZ2Lq9TL4dCs/nx1j5DO0E=
+github.com/go-openapi/swag/pools v0.27.1/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE=
+github.com/go-openapi/swag/stringutils v0.27.1 h1:ZXePZ0r2p1qSjo8tD3Un4vFj8+FqlCkczxDrJIhYUp8=
+github.com/go-openapi/swag/stringutils v0.27.1/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM=
+github.com/go-openapi/swag/typeutils v0.27.1 h1:KSTdFlfnse4r6dP9IrEnwMldjE+zs71UeEB3//PtVXc=
+github.com/go-openapi/swag/typeutils v0.27.1/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ=
+github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA=
+github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo=
+github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
+github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/go.work b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/go.work
new file mode 100644
index 0000000000..8db90b2824
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/go.work
@@ -0,0 +1,8 @@
+// This is a hack, but it prevents go from climbing further and trying to
+// reconcile the various deps across the "real" modules and this one.
+
+go 1.26.0
+
+godebug default=go1.26
+
+use .
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/hack/boilerplate.go.txt b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/hack/boilerplate.go.txt
new file mode 100644
index 0000000000..b7c650da47
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/hack/boilerplate.go.txt
@@ -0,0 +1,16 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/hack/update-codegen.sh b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/hack/update-codegen.sh
new file mode 100755
index 0000000000..c6d3961644
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/hack/update-codegen.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
+SCRIPT_ROOT="${SCRIPT_DIR}/.."
+CODEGEN_PKG="${CODEGEN_PKG:-"${SCRIPT_ROOT}/.."}"
+
+source "${CODEGEN_PKG}/kube_codegen.sh"
+
+THIS_PKG="k8s.io/code-generator/examples"
+
+kube::codegen::gen_helpers \
+    --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
+    --lint-rules known-tags-only,require-explicit-disablement \
+    "${SCRIPT_ROOT}"
+
+kube::codegen::gen_register \
+    --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
+    --lint-rules known-tags-only,require-explicit-disablement \
+    "${SCRIPT_ROOT}"
+
+if [[ -n "${API_KNOWN_VIOLATIONS_DIR:-}" ]]; then
+    report_filename="${API_KNOWN_VIOLATIONS_DIR}/codegen_violation_exceptions.list"
+    if [[ "${UPDATE_API_KNOWN_VIOLATIONS:-}" == "true" ]]; then
+        update_report="--update-report"
+    fi
+fi
+
+kube::codegen::gen_openapi \
+    --output-dir "${SCRIPT_ROOT}/apiserver/openapi" \
+    --output-pkg "k8s.io/${THIS_PKG}/apiserver/openapi" \
+    --report-filename "${report_filename:-"/dev/null"}" \
+    --output-model-name-file "zz_generated.model_name.go" \
+    ${update_report:+"${update_report}"} \
+    --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
+    "${SCRIPT_ROOT}/apiserver/apis"
+
+kube::codegen::gen_client \
+    --with-watch \
+    --output-dir "${SCRIPT_ROOT}/apiserver" \
+    --output-pkg "${THIS_PKG}/apiserver" \
+    --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
+    --lint-rules known-tags-only,require-explicit-disablement \
+    "${SCRIPT_ROOT}/apiserver/apis"
+
+kube::codegen::gen_client \
+    --with-watch \
+    --with-applyconfig \
+    --output-dir "${SCRIPT_ROOT}/crd" \
+    --output-pkg "${THIS_PKG}/crd" \
+    --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
+    --lint-rules known-tags-only,require-explicit-disablement \
+    "${SCRIPT_ROOT}/crd/apis"
+
+kube::codegen::gen_client \
+    --with-watch \
+    --with-applyconfig \
+    --output-dir "${SCRIPT_ROOT}/single" \
+    --output-pkg "${THIS_PKG}/single" \
+    --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
+    --one-input-api "api" \
+    --lint-rules known-tags-only,require-explicit-disablement \
+    "${SCRIPT_ROOT}/single"
+
+kube::codegen::gen_client \
+    --with-watch \
+    --with-applyconfig \
+    --output-dir "${SCRIPT_ROOT}/MixedCase" \
+    --output-pkg "${THIS_PKG}/MixedCase" \
+    --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
+    --lint-rules known-tags-only,require-explicit-disablement \
+    "${SCRIPT_ROOT}/MixedCase/apis"
+
+kube::codegen::gen_client \
+    --with-watch \
+    --with-applyconfig \
+    --output-dir "${SCRIPT_ROOT}/HyphenGroup" \
+    --output-pkg "${THIS_PKG}/HyphenGroup" \
+    --boilerplate "${SCRIPT_ROOT}/hack/boilerplate.go.txt" \
+    --lint-rules known-tags-only,require-explicit-disablement \
+    "${SCRIPT_ROOT}/HyphenGroup/apis"
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/hack/verify-codegen.sh b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/hack/verify-codegen.sh
new file mode 100755
index 0000000000..21c7eb18c9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/hack/verify-codegen.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+DIFFROOT="${SCRIPT_ROOT}"
+TMP_DIFFROOT="$(mktemp -d -t "$(basename "$0").XXXXXX")"
+
+cleanup() {
+  rm -rf "${TMP_DIFFROOT}"
+}
+trap "cleanup" EXIT SIGINT
+
+cleanup
+
+mkdir -p "${TMP_DIFFROOT}"
+cp -a "${DIFFROOT}"/* "${TMP_DIFFROOT}"
+
+"${SCRIPT_ROOT}/hack/update-codegen.sh"
+echo "diffing ${DIFFROOT} against freshly generated codegen"
+ret=0
+diff -Naupr -x.gitignore "${DIFFROOT}" "${TMP_DIFFROOT}" || ret=$?
+if [[ $ret -eq 0 ]]; then
+  echo "${DIFFROOT} up to date."
+else
+  echo "${DIFFROOT} is out of date. Please run hack/update-codegen.sh"
+  exit $ret
+fi
+
+# smoke test
+echo "Smoke testing examples by compiling..."
+pushd "${SCRIPT_ROOT}"
+  go build "k8s.io/code-generator/examples/crd/..."
+  go build "k8s.io/code-generator/examples/single/..."
+  go build "k8s.io/code-generator/examples/apiserver/..."
+  go build "k8s.io/code-generator/examples/MixedCase/..."
+  go build "k8s.io/code-generator/examples/HyphenGroup/..."
+popd
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/api/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/api/v1/doc.go
new file mode 100644
index 0000000000..673ac55d7b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/api/v1/doc.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=example.crd.code-generator.k8s.io
+
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/api/v1/types.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/api/v1/types.go
new file mode 100644
index 0000000000..ee65540ff2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/api/v1/types.go
@@ -0,0 +1,75 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestType is a top-level type. A client is created for it.
+type TestType struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +optional
+	Status TestTypeStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// TestTypeList is a top-level list type. The client methods for lists are automatically created.
+// You are not supposed to create a separated client for this one.
+type TestTypeList struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	Items []TestType `json:"items"`
+}
+
+type TestTypeStatus struct {
+	Blah string `json:"blah"`
+}
+
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+type ClusterTestTypeList struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ClusterTestType `json:"items"`
+}
+
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +genclient:method=GetScale,verb=get,subresource=scale,result=k8s.io/api/autoscaling/v1.Scale
+// +genclient:method=UpdateScale,verb=update,subresource=scale,input=k8s.io/api/autoscaling/v1.Scale,result=k8s.io/api/autoscaling/v1.Scale
+
+type ClusterTestType struct {
+	metav1.TypeMeta `json:""`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	// +optional
+	Status ClusterTestTypeStatus `json:"status,omitempty"`
+}
+
+type ClusterTestTypeStatus struct {
+	Blah string `json:"blah"`
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/api/v1/zz_generated.deepcopy.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/api/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..5eee47016b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/api/v1/zz_generated.deepcopy.go
@@ -0,0 +1,178 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterTestType) DeepCopyInto(out *ClusterTestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTestType.
+func (in *ClusterTestType) DeepCopy() *ClusterTestType {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterTestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterTestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterTestTypeList) DeepCopyInto(out *ClusterTestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ClusterTestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTestTypeList.
+func (in *ClusterTestTypeList) DeepCopy() *ClusterTestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterTestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterTestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterTestTypeStatus) DeepCopyInto(out *ClusterTestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTestTypeStatus.
+func (in *ClusterTestTypeStatus) DeepCopy() *ClusterTestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterTestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType) DeepCopyInto(out *TestType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Status = in.Status
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType.
+func (in *TestType) DeepCopy() *TestType {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeList) DeepCopyInto(out *TestTypeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]TestType, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeList.
+func (in *TestTypeList) DeepCopy() *TestTypeList {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestTypeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestTypeStatus) DeepCopyInto(out *TestTypeStatus) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestTypeStatus.
+func (in *TestTypeStatus) DeepCopy() *TestTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(TestTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/api/v1/zz_generated.defaults.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/api/v1/zz_generated.defaults.go
new file mode 100644
index 0000000000..dac177e93b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/api/v1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/api/v1/zz_generated.register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/api/v1/zz_generated.register.go
new file mode 100644
index 0000000000..a587c37bc9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/api/v1/zz_generated.register.go
@@ -0,0 +1,73 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by register-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName specifies the group name used to register the objects.
+const GroupName = "example.crd.code-generator.k8s.io"
+
+// GroupVersion specifies the group and the version used to register the objects.
+var GroupVersion = metav1.GroupVersion{Group: GroupName, Version: "v1"}
+
+// SchemeGroupVersion is group version used to register these objects
+//
+// Deprecated: use GroupVersion instead.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	// Deprecated: use Install instead
+	AddToScheme = localSchemeBuilder.AddToScheme
+	Install     = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&ClusterTestType{},
+		&ClusterTestTypeList{},
+		&TestType{},
+		&TestTypeList{},
+	)
+	// AddToGroupVersion allows the serialization of client types like ListOptions.
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/api/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/api/v1/clustertesttype.go
new file mode 100644
index 0000000000..da165b1fb7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/api/v1/clustertesttype.go
@@ -0,0 +1,233 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// ClusterTestTypeApplyConfiguration represents a declarative configuration of the ClusterTestType type for use
+// with apply.
+type ClusterTestTypeApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration    `json:""`
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Status                               *ClusterTestTypeStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// ClusterTestType constructs a declarative configuration of the ClusterTestType type for use with
+// apply.
+func ClusterTestType(name string) *ClusterTestTypeApplyConfiguration {
+	b := &ClusterTestTypeApplyConfiguration{}
+	b.WithName(name)
+	b.WithKind("ClusterTestType")
+	b.WithAPIVersion("example.crd.code-generator.k8s.io/v1")
+	return b
+}
+
+func (b ClusterTestTypeApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithKind(value string) *ClusterTestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithAPIVersion(value string) *ClusterTestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithName(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithGenerateName(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithNamespace(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithUID(value types.UID) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithResourceVersion(value string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithGeneration(value int64) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *ClusterTestTypeApplyConfiguration) WithLabels(entries map[string]string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *ClusterTestTypeApplyConfiguration) WithAnnotations(entries map[string]string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *ClusterTestTypeApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *ClusterTestTypeApplyConfiguration) WithFinalizers(values ...string) *ClusterTestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *ClusterTestTypeApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *ClusterTestTypeApplyConfiguration) WithStatus(value *ClusterTestTypeStatusApplyConfiguration) *ClusterTestTypeApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *ClusterTestTypeApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/api/v1/clustertesttypestatus.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/api/v1/clustertesttypestatus.go
new file mode 100644
index 0000000000..c2ccfa5811
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/api/v1/clustertesttypestatus.go
@@ -0,0 +1,39 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// ClusterTestTypeStatusApplyConfiguration represents a declarative configuration of the ClusterTestTypeStatus type for use
+// with apply.
+type ClusterTestTypeStatusApplyConfiguration struct {
+	Blah *string `json:"blah,omitempty"`
+}
+
+// ClusterTestTypeStatusApplyConfiguration constructs a declarative configuration of the ClusterTestTypeStatus type for use with
+// apply.
+func ClusterTestTypeStatus() *ClusterTestTypeStatusApplyConfiguration {
+	return &ClusterTestTypeStatusApplyConfiguration{}
+}
+
+// WithBlah sets the Blah field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Blah field is set to the value of the last call.
+func (b *ClusterTestTypeStatusApplyConfiguration) WithBlah(value string) *ClusterTestTypeStatusApplyConfiguration {
+	b.Blah = &value
+	return b
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/api/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/api/v1/testtype.go
new file mode 100644
index 0000000000..154a69209a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/api/v1/testtype.go
@@ -0,0 +1,236 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// TestTypeApplyConfiguration represents a declarative configuration of the TestType type for use
+// with apply.
+//
+// TestType is a top-level type. A client is created for it.
+type TestTypeApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration    `json:""`
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Status                               *TestTypeStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// TestType constructs a declarative configuration of the TestType type for use with
+// apply.
+func TestType(name, namespace string) *TestTypeApplyConfiguration {
+	b := &TestTypeApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("TestType")
+	b.WithAPIVersion("example.crd.code-generator.k8s.io/v1")
+	return b
+}
+
+func (b TestTypeApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithKind(value string) *TestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithAPIVersion(value string) *TestTypeApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithName(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithGenerateName(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithNamespace(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithUID(value types.UID) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithResourceVersion(value string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithGeneration(value int64) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *TestTypeApplyConfiguration) WithLabels(entries map[string]string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *TestTypeApplyConfiguration) WithAnnotations(entries map[string]string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *TestTypeApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *TestTypeApplyConfiguration) WithFinalizers(values ...string) *TestTypeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *TestTypeApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *TestTypeApplyConfiguration) WithStatus(value *TestTypeStatusApplyConfiguration) *TestTypeApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TestTypeApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/api/v1/testtypestatus.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/api/v1/testtypestatus.go
new file mode 100644
index 0000000000..246b2ee188
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/api/v1/testtypestatus.go
@@ -0,0 +1,39 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// TestTypeStatusApplyConfiguration represents a declarative configuration of the TestTypeStatus type for use
+// with apply.
+type TestTypeStatusApplyConfiguration struct {
+	Blah *string `json:"blah,omitempty"`
+}
+
+// TestTypeStatusApplyConfiguration constructs a declarative configuration of the TestTypeStatus type for use with
+// apply.
+func TestTypeStatus() *TestTypeStatusApplyConfiguration {
+	return &TestTypeStatusApplyConfiguration{}
+}
+
+// WithBlah sets the Blah field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Blah field is set to the value of the last call.
+func (b *TestTypeStatusApplyConfiguration) WithBlah(value string) *TestTypeStatusApplyConfiguration {
+	b.Blah = &value
+	return b
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/internal/internal.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/internal/internal.go
new file mode 100644
index 0000000000..c482faa5c2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/internal/internal.go
@@ -0,0 +1,62 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package internal
+
+import (
+	fmt "fmt"
+	sync "sync"
+
+	typed "sigs.k8s.io/structured-merge-diff/v6/typed"
+)
+
+func Parser() *typed.Parser {
+	parserOnce.Do(func() {
+		var err error
+		parser, err = typed.NewParser(schemaYAML)
+		if err != nil {
+			panic(fmt.Sprintf("Failed to parse schema: %v", err))
+		}
+	})
+	return parser
+}
+
+var parserOnce sync.Once
+var parser *typed.Parser
+var schemaYAML = typed.YAMLObject(`types:
+- name: __untyped_atomic_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+- name: __untyped_deduced_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_deduced_
+    elementRelationship: separable
+`)
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/utils.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/utils.go
new file mode 100644
index 0000000000..4bc4ef7c1e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/applyconfiguration/utils.go
@@ -0,0 +1,50 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package applyconfiguration
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	v1 "k8s.io/code-generator/examples/single/api/v1"
+	apiv1 "k8s.io/code-generator/examples/single/applyconfiguration/api/v1"
+	internal "k8s.io/code-generator/examples/single/applyconfiguration/internal"
+)
+
+// ForKind returns an apply configuration type for the given GroupVersionKind, or nil if no
+// apply configuration type exists for the given GroupVersionKind.
+func ForKind(kind schema.GroupVersionKind) interface{} {
+	switch kind {
+	// Group=example.crd.code-generator.k8s.io, Version=v1
+	case v1.SchemeGroupVersion.WithKind("ClusterTestType"):
+		return &apiv1.ClusterTestTypeApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("ClusterTestTypeStatus"):
+		return &apiv1.ClusterTestTypeStatusApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("TestType"):
+		return &apiv1.TestTypeApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("TestTypeStatus"):
+		return &apiv1.TestTypeStatusApplyConfiguration{}
+
+	}
+	return nil
+}
+
+func NewTypeConverter(scheme *runtime.Scheme) managedfields.TypeConverter {
+	return managedfields.NewSchemeTypeConverter(scheme, internal.Parser())
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/clientset.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/clientset.go
new file mode 100644
index 0000000000..76ed67420c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/clientset.go
@@ -0,0 +1,120 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package versioned
+
+import (
+	fmt "fmt"
+	http "net/http"
+
+	discovery "k8s.io/client-go/discovery"
+	rest "k8s.io/client-go/rest"
+	flowcontrol "k8s.io/client-go/util/flowcontrol"
+	examplev1 "k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1"
+)
+
+type Interface interface {
+	Discovery() discovery.DiscoveryInterfaces
+	ExampleV1() examplev1.ExampleV1Interface
+}
+
+// Clientset contains the clients for groups.
+type Clientset struct {
+	*discovery.DiscoveryClient
+	exampleV1 *examplev1.ExampleV1Client
+}
+
+// ExampleV1 retrieves the ExampleV1Client
+func (c *Clientset) ExampleV1() examplev1.ExampleV1Interface {
+	return c.exampleV1
+}
+
+// Discovery retrieves the DiscoveryClient
+func (c *Clientset) Discovery() discovery.DiscoveryInterfaces {
+	if c == nil {
+		return nil
+	}
+	return c.DiscoveryClient
+}
+
+// NewForConfig creates a new Clientset for the given config.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfig will generate a rate-limiter in configShallowCopy.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*Clientset, error) {
+	configShallowCopy := *c
+
+	if configShallowCopy.UserAgent == "" {
+		configShallowCopy.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	// share the transport between all clients
+	httpClient, err := rest.HTTPClientFor(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewForConfigAndClient(&configShallowCopy, httpClient)
+}
+
+// NewForConfigAndClient creates a new Clientset for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfigAndClient will generate a rate-limiter in configShallowCopy.
+func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset, error) {
+	configShallowCopy := *c
+	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
+		if configShallowCopy.Burst <= 0 {
+			return nil, fmt.Errorf("burst is required to be greater than 0 when RateLimiter is not set and QPS is set to greater than 0")
+		}
+		configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
+	}
+
+	var cs Clientset
+	var err error
+	cs.exampleV1, err = examplev1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+
+	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	return &cs, nil
+}
+
+// NewForConfigOrDie creates a new Clientset for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *Clientset {
+	cs, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return cs
+}
+
+// New creates a new Clientset for the given RESTClient.
+func New(c rest.Interface) *Clientset {
+	var cs Clientset
+	cs.exampleV1 = examplev1.New(c)
+
+	cs.DiscoveryClient = discovery.NewDiscoveryClient(c)
+	return &cs
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/fake/clientset_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/fake/clientset_generated.go
new file mode 100644
index 0000000000..25fbfb780c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/fake/clientset_generated.go
@@ -0,0 +1,142 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/discovery"
+	fakediscovery "k8s.io/client-go/discovery/fake"
+	"k8s.io/client-go/testing"
+	applyconfiguration "k8s.io/code-generator/examples/single/applyconfiguration"
+	clientset "k8s.io/code-generator/examples/single/clientset/versioned"
+	examplev1 "k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1"
+	fakeexamplev1 "k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/fake"
+)
+
+// NewSimpleClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any field management, validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+func NewSimpleClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewObjectTracker(scheme, codecs.UniversalDecoder())
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{tracker: o}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		var opts metav1.ListOptions
+		if watchAction, ok := action.(testing.WatchActionImpl); ok {
+			opts = watchAction.ListOptions
+		}
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns, opts)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
+// Clientset implements clientset.Interface. Meant to be embedded into a
+// struct to get a default implementation. This makes faking out just the method
+// you want to test easier.
+type Clientset struct {
+	testing.Fake
+	discovery *fakediscovery.FakeDiscovery
+	tracker   testing.ObjectTracker
+}
+
+func (c *Clientset) Discovery() discovery.DiscoveryInterfaces {
+	return c.discovery
+}
+
+func (c *Clientset) Tracker() testing.ObjectTracker {
+	return c.tracker
+}
+
+// IsWatchListSemanticsUnSupported informs the reflector that this client
+// doesn't support WatchList semantics.
+//
+// This is a synthetic method whose sole purpose is to satisfy the optional
+// interface check performed by the reflector.
+// Returning true signals that WatchList can NOT be used.
+// No additional logic is implemented here.
+func (c *Clientset) IsWatchListSemanticsUnSupported() bool {
+	return true
+}
+
+// NewClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+//
+// Compared to NewSimpleClientset, the Clientset returned here supports field tracking and thus
+// server-side apply. Beware though that support in that for CRDs is missing
+// (https://github.com/kubernetes/kubernetes/issues/126850).
+func NewClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewFieldManagedObjectTracker(
+		scheme,
+		codecs.UniversalDecoder(),
+		applyconfiguration.NewTypeConverter(scheme),
+	)
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{tracker: o}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		var opts metav1.ListOptions
+		if watchAction, ok := action.(testing.WatchActionImpl); ok {
+			opts = watchAction.ListOptions
+		}
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns, opts)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
+var (
+	_ clientset.Interface = &Clientset{}
+	_ testing.FakeClient  = &Clientset{}
+)
+
+// ExampleV1 retrieves the ExampleV1Client
+func (c *Clientset) ExampleV1() examplev1.ExampleV1Interface {
+	return &fakeexamplev1.FakeExampleV1{Fake: &c.Fake}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/fake/doc.go
new file mode 100644
index 0000000000..9b99e71670
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated fake clientset.
+package fake
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/fake/register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/fake/register.go
new file mode 100644
index 0000000000..084c6bc8fc
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/fake/register.go
@@ -0,0 +1,56 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	examplev1 "k8s.io/code-generator/examples/single/api/v1"
+)
+
+var scheme = runtime.NewScheme()
+var codecs = serializer.NewCodecFactory(scheme)
+
+var localSchemeBuilder = runtime.SchemeBuilder{
+	examplev1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
+//
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(scheme))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/scheme/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/scheme/doc.go
new file mode 100644
index 0000000000..7dc3756168
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/scheme/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package contains the scheme of the automatically generated clientset.
+package scheme
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/scheme/register.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/scheme/register.go
new file mode 100644
index 0000000000..d54e5a32b0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/scheme/register.go
@@ -0,0 +1,56 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package scheme
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	examplev1 "k8s.io/code-generator/examples/single/api/v1"
+)
+
+var Scheme = runtime.NewScheme()
+var Codecs = serializer.NewCodecFactory(Scheme)
+var ParameterCodec = runtime.NewParameterCodec(Scheme)
+var localSchemeBuilder = runtime.SchemeBuilder{
+	examplev1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
+//
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(Scheme))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/api_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/api_client.go
new file mode 100644
index 0000000000..536e57584e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/api_client.go
@@ -0,0 +1,106 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	http "net/http"
+
+	rest "k8s.io/client-go/rest"
+	apiv1 "k8s.io/code-generator/examples/single/api/v1"
+	scheme "k8s.io/code-generator/examples/single/clientset/versioned/scheme"
+)
+
+type ExampleV1Interface interface {
+	RESTClient() rest.Interface
+	ClusterTestTypesGetter
+	TestTypesGetter
+}
+
+// ExampleV1Client is used to interact with features provided by the example.crd.code-generator.k8s.io group.
+type ExampleV1Client struct {
+	restClient rest.Interface
+}
+
+func (c *ExampleV1Client) ClusterTestTypes() ClusterTestTypeInterface {
+	return newClusterTestTypes(c)
+}
+
+func (c *ExampleV1Client) TestTypes(namespace string) TestTypeInterface {
+	return newTestTypes(c, namespace)
+}
+
+// NewForConfig creates a new ExampleV1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ExampleV1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ExampleV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &ExampleV1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new ExampleV1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ExampleV1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new ExampleV1Client for the given RESTClient.
+func New(c rest.Interface) *ExampleV1Client {
+	return &ExampleV1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ExampleV1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/clustertesttype.go
new file mode 100644
index 0000000000..993ee30942
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/clustertesttype.go
@@ -0,0 +1,105 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	autoscalingv1 "k8s.io/api/autoscaling/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	apiv1 "k8s.io/code-generator/examples/single/api/v1"
+	applyconfigurationapiv1 "k8s.io/code-generator/examples/single/applyconfiguration/api/v1"
+	scheme "k8s.io/code-generator/examples/single/clientset/versioned/scheme"
+)
+
+// ClusterTestTypesGetter has a method to return a ClusterTestTypeInterface.
+// A group's client should implement this interface.
+type ClusterTestTypesGetter interface {
+	ClusterTestTypes() ClusterTestTypeInterface
+}
+
+// ClusterTestTypeInterface has methods to work with ClusterTestType resources.
+type ClusterTestTypeInterface interface {
+	Create(ctx context.Context, clusterTestType *apiv1.ClusterTestType, opts metav1.CreateOptions) (*apiv1.ClusterTestType, error)
+	Update(ctx context.Context, clusterTestType *apiv1.ClusterTestType, opts metav1.UpdateOptions) (*apiv1.ClusterTestType, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, clusterTestType *apiv1.ClusterTestType, opts metav1.UpdateOptions) (*apiv1.ClusterTestType, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*apiv1.ClusterTestType, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*apiv1.ClusterTestTypeList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *apiv1.ClusterTestType, err error)
+	Apply(ctx context.Context, clusterTestType *applyconfigurationapiv1.ClusterTestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *apiv1.ClusterTestType, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, clusterTestType *applyconfigurationapiv1.ClusterTestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *apiv1.ClusterTestType, err error)
+	GetScale(ctx context.Context, clusterTestTypeName string, options metav1.GetOptions) (*autoscalingv1.Scale, error)
+	UpdateScale(ctx context.Context, clusterTestTypeName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (*autoscalingv1.Scale, error)
+
+	ClusterTestTypeExpansion
+}
+
+// clusterTestTypes implements ClusterTestTypeInterface
+type clusterTestTypes struct {
+	*gentype.ClientWithListAndApply[*apiv1.ClusterTestType, *apiv1.ClusterTestTypeList, *applyconfigurationapiv1.ClusterTestTypeApplyConfiguration]
+}
+
+// newClusterTestTypes returns a ClusterTestTypes
+func newClusterTestTypes(c *ExampleV1Client) *clusterTestTypes {
+	return &clusterTestTypes{
+		gentype.NewClientWithListAndApply[*apiv1.ClusterTestType, *apiv1.ClusterTestTypeList, *applyconfigurationapiv1.ClusterTestTypeApplyConfiguration](
+			"clustertesttypes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			"",
+			func() *apiv1.ClusterTestType { return &apiv1.ClusterTestType{} },
+			func() *apiv1.ClusterTestTypeList { return &apiv1.ClusterTestTypeList{} },
+		),
+	}
+}
+
+// GetScale takes name of the clusterTestType, and returns the corresponding autoscalingv1.Scale object, and an error if there is any.
+func (c *clusterTestTypes) GetScale(ctx context.Context, clusterTestTypeName string, options metav1.GetOptions) (result *autoscalingv1.Scale, err error) {
+	result = &autoscalingv1.Scale{}
+	err = c.GetClient().Get().
+		Resource("clustertesttypes").
+		Name(clusterTestTypeName).
+		SubResource("scale").
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// UpdateScale takes the top resource name and the representation of a scale and updates it. Returns the server's representation of the scale, and an error, if there is any.
+func (c *clusterTestTypes) UpdateScale(ctx context.Context, clusterTestTypeName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (result *autoscalingv1.Scale, err error) {
+	result = &autoscalingv1.Scale{}
+	err = c.GetClient().Put().
+		Resource("clustertesttypes").
+		Name(clusterTestTypeName).
+		SubResource("scale").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(scale).
+		Do(ctx).
+		Into(result)
+	return
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/doc.go
new file mode 100644
index 0000000000..3af5d054f1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/fake/doc.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/fake/doc.go
new file mode 100644
index 0000000000..16f4439906
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/fake/fake_api_client.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/fake/fake_api_client.go
new file mode 100644
index 0000000000..e970375a60
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/fake/fake_api_client.go
@@ -0,0 +1,44 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1"
+)
+
+type FakeExampleV1 struct {
+	*testing.Fake
+}
+
+func (c *FakeExampleV1) ClusterTestTypes() v1.ClusterTestTypeInterface {
+	return newFakeClusterTestTypes(c)
+}
+
+func (c *FakeExampleV1) TestTypes(namespace string) v1.TestTypeInterface {
+	return newFakeTestTypes(c, namespace)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeExampleV1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/fake/fake_clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/fake/fake_clustertesttype.go
new file mode 100644
index 0000000000..c046f8dd44
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/fake/fake_clustertesttype.go
@@ -0,0 +1,78 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	context "context"
+
+	autoscalingv1 "k8s.io/api/autoscaling/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gentype "k8s.io/client-go/gentype"
+	testing "k8s.io/client-go/testing"
+	v1 "k8s.io/code-generator/examples/single/api/v1"
+	apiv1 "k8s.io/code-generator/examples/single/applyconfiguration/api/v1"
+	typedapiv1 "k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1"
+)
+
+// fakeClusterTestTypes implements ClusterTestTypeInterface
+type fakeClusterTestTypes struct {
+	*gentype.FakeClientWithListAndApply[*v1.ClusterTestType, *v1.ClusterTestTypeList, *apiv1.ClusterTestTypeApplyConfiguration]
+	Fake *FakeExampleV1
+}
+
+func newFakeClusterTestTypes(fake *FakeExampleV1) typedapiv1.ClusterTestTypeInterface {
+	return &fakeClusterTestTypes{
+		gentype.NewFakeClientWithListAndApply[*v1.ClusterTestType, *v1.ClusterTestTypeList, *apiv1.ClusterTestTypeApplyConfiguration](
+			fake.Fake,
+			"",
+			v1.SchemeGroupVersion.WithResource("clustertesttypes"),
+			v1.SchemeGroupVersion.WithKind("ClusterTestType"),
+			func() *v1.ClusterTestType { return &v1.ClusterTestType{} },
+			func() *v1.ClusterTestTypeList { return &v1.ClusterTestTypeList{} },
+			func(dst, src *v1.ClusterTestTypeList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.ClusterTestTypeList) []*v1.ClusterTestType { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.ClusterTestTypeList, items []*v1.ClusterTestType) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
+
+// GetScale takes name of the clusterTestType, and returns the corresponding scale object, and an error if there is any.
+func (c *fakeClusterTestTypes) GetScale(ctx context.Context, clusterTestTypeName string, options metav1.GetOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.
+		Invokes(testing.NewRootGetSubresourceActionWithOptions(c.Resource(), "scale", clusterTestTypeName, options), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*autoscalingv1.Scale), err
+}
+
+// UpdateScale takes the representation of a scale and updates it. Returns the server's representation of the scale, and an error, if there is any.
+func (c *fakeClusterTestTypes) UpdateScale(ctx context.Context, clusterTestTypeName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.
+		Invokes(testing.NewRootUpdateSubresourceActionWithOptions(c.Resource(), "scale", scale, opts), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(*autoscalingv1.Scale), err
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/fake/fake_testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/fake/fake_testtype.go
new file mode 100644
index 0000000000..60bf09f979
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/fake/fake_testtype.go
@@ -0,0 +1,49 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	gentype "k8s.io/client-go/gentype"
+	v1 "k8s.io/code-generator/examples/single/api/v1"
+	apiv1 "k8s.io/code-generator/examples/single/applyconfiguration/api/v1"
+	typedapiv1 "k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1"
+)
+
+// fakeTestTypes implements TestTypeInterface
+type fakeTestTypes struct {
+	*gentype.FakeClientWithListAndApply[*v1.TestType, *v1.TestTypeList, *apiv1.TestTypeApplyConfiguration]
+	Fake *FakeExampleV1
+}
+
+func newFakeTestTypes(fake *FakeExampleV1, namespace string) typedapiv1.TestTypeInterface {
+	return &fakeTestTypes{
+		gentype.NewFakeClientWithListAndApply[*v1.TestType, *v1.TestTypeList, *apiv1.TestTypeApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1.SchemeGroupVersion.WithResource("testtypes"),
+			v1.SchemeGroupVersion.WithKind("TestType"),
+			func() *v1.TestType { return &v1.TestType{} },
+			func() *v1.TestTypeList { return &v1.TestTypeList{} },
+			func(dst, src *v1.TestTypeList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.TestTypeList) []*v1.TestType { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.TestTypeList, items []*v1.TestType) { list.Items = gentype.FromPointerSlice(items) },
+		),
+		fake,
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/generated_expansion.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/generated_expansion.go
new file mode 100644
index 0000000000..3059734a9e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+type ClusterTestTypeExpansion interface{}
+
+type TestTypeExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/testtype.go
new file mode 100644
index 0000000000..9945284e47
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/clientset/versioned/typed/api/v1/testtype.go
@@ -0,0 +1,74 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	apiv1 "k8s.io/code-generator/examples/single/api/v1"
+	applyconfigurationapiv1 "k8s.io/code-generator/examples/single/applyconfiguration/api/v1"
+	scheme "k8s.io/code-generator/examples/single/clientset/versioned/scheme"
+)
+
+// TestTypesGetter has a method to return a TestTypeInterface.
+// A group's client should implement this interface.
+type TestTypesGetter interface {
+	TestTypes(namespace string) TestTypeInterface
+}
+
+// TestTypeInterface has methods to work with TestType resources.
+type TestTypeInterface interface {
+	Create(ctx context.Context, testType *apiv1.TestType, opts metav1.CreateOptions) (*apiv1.TestType, error)
+	Update(ctx context.Context, testType *apiv1.TestType, opts metav1.UpdateOptions) (*apiv1.TestType, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, testType *apiv1.TestType, opts metav1.UpdateOptions) (*apiv1.TestType, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*apiv1.TestType, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*apiv1.TestTypeList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *apiv1.TestType, err error)
+	Apply(ctx context.Context, testType *applyconfigurationapiv1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *apiv1.TestType, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, testType *applyconfigurationapiv1.TestTypeApplyConfiguration, opts metav1.ApplyOptions) (result *apiv1.TestType, err error)
+	TestTypeExpansion
+}
+
+// testTypes implements TestTypeInterface
+type testTypes struct {
+	*gentype.ClientWithListAndApply[*apiv1.TestType, *apiv1.TestTypeList, *applyconfigurationapiv1.TestTypeApplyConfiguration]
+}
+
+// newTestTypes returns a TestTypes
+func newTestTypes(c *ExampleV1Client, namespace string) *testTypes {
+	return &testTypes{
+		gentype.NewClientWithListAndApply[*apiv1.TestType, *apiv1.TestTypeList, *applyconfigurationapiv1.TestTypeApplyConfiguration](
+			"testtypes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *apiv1.TestType { return &apiv1.TestType{} },
+			func() *apiv1.TestTypeList { return &apiv1.TestTypeList{} },
+		),
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/api/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/api/interface.go
new file mode 100644
index 0000000000..633ba3d0de
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/api/interface.go
@@ -0,0 +1,46 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package api
+
+import (
+	v1 "k8s.io/code-generator/examples/single/informers/externalversions/api/v1"
+	internalinterfaces "k8s.io/code-generator/examples/single/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1 provides access to shared informers for resources in V1.
+	V1() v1.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1 returns a new v1.Interface.
+func (g *group) V1() v1.Interface {
+	return v1.New(g.factory, g.namespace, g.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/api/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/api/v1/clustertesttype.go
new file mode 100644
index 0000000000..709e8c291a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/api/v1/clustertesttype.go
@@ -0,0 +1,207 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	singleapiv1 "k8s.io/code-generator/examples/single/api/v1"
+	versioned "k8s.io/code-generator/examples/single/clientset/versioned"
+	internalinterfaces "k8s.io/code-generator/examples/single/informers/externalversions/internalinterfaces"
+	apiv1 "k8s.io/code-generator/examples/single/listers/api/v1"
+)
+
+// ClusterTestTypeInformer provides access to a shared informer and lister for
+// ClusterTestTypes. Prefer using the type-safe variant (see [TypedClusterTestTypeInformer]).
+type ClusterTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() apiv1.ClusterTestTypeLister
+}
+
+// TypedClusterTestTypeInformer provides access to a shared informer and lister for
+// ClusterTestTypes, including the type-safe TypedInformer variant.
+// It is a superset of ClusterTestTypeInformer.
+type TypedClusterTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ClusterTestTypeIndexInformer
+	Lister() apiv1.ClusterTestTypeLister
+}
+
+// ClusterTestTypeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ClusterTestTypeIndexInformer cache.TypedSharedIndexInformer[*singleapiv1.ClusterTestType]
+
+// ClusterTestTypeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ClusterTestType.
+type ClusterTestTypeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*singleapiv1.ClusterTestType]
+
+// ClusterTestTypeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ClusterTestType.
+type ClusterTestTypeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*singleapiv1.ClusterTestType]
+
+// ClusterTestTypeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ClusterTestType.
+type ClusterTestTypeFilteringHandler = cache.TypedFilteringResourceEventHandler[*singleapiv1.ClusterTestType]
+
+// ClusterTestTypeIndexers is a specialization of [cache.TypedIndexers] for ClusterTestType.
+type ClusterTestTypeIndexers = cache.TypedIndexers[*singleapiv1.ClusterTestType]
+
+// DeletedClusterTestType is a specialization of [cache.DeletedObject] for ClusterTestType.
+type DeletedClusterTestType = cache.DeletedObject[*singleapiv1.ClusterTestType]
+
+type clusterTestTypeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// NewClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterTestTypeInformer]).
+func NewClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers ClusterTestTypeIndexers) ClusterTestTypeIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredClusterTestTypeInformer]).
+func NewFilteredClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredClusterTestTypeInformer constructs a new informer for ClusterTestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredClusterTestTypeInformer(client versioned.Interface, resyncPeriod time.Duration, indexers ClusterTestTypeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterTestTypeIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewClusterTestTypeInformerWithOptions constructs a new informer for ClusterTestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterTestTypeInformerWithOptions]).
+func NewClusterTestTypeInformerWithOptions(client versioned.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, options)
+}
+
+// NewTypedClusterTestTypeInformerWithOptions constructs a new informer for ClusterTestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterTestTypeInformerWithOptions(client versioned.Interface, options internalinterfaces.InformerOptions) ClusterTestTypeIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "example.crd.code-generator.k8s.io", Version: "v1", Resource: "clustertesttypes"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*singleapiv1.ClusterTestType](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().ClusterTestTypes().List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().ClusterTestTypes().Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().ClusterTestTypes().List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().ClusterTestTypes().Watch(ctx, opts)
+			},
+		}, client),
+		&singleapiv1.ClusterTestType{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *clusterTestTypeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedClusterTestTypeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *clusterTestTypeInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *clusterTestTypeInformer) TypedInformer() ClusterTestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*singleapiv1.ClusterTestType](f.factory.InformerFor(&singleapiv1.ClusterTestType{}, f.defaultInformer))
+}
+
+func (f *clusterTestTypeInformer) Lister() apiv1.ClusterTestTypeLister {
+	return apiv1.NewClusterTestTypeLister(f.Informer().GetIndexer())
+}
+
+// ToTypedClusterTestTypeInformer converts an untyped informer into a TypedClusterTestTypeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterTestType. If that is not the case, calling type-safe methods of the returned
+// TypedClusterTestTypeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedClusterTestTypeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedClusterTestTypeInformer(informer ClusterTestTypeInformer) TypedClusterTestTypeInformer {
+	if informer, ok := informer.(TypedClusterTestTypeInformer); ok {
+		return informer
+	}
+	return &clusterTestTypeTypedInformerAdapter{informer}
+}
+
+type clusterTestTypeTypedInformerAdapter struct {
+	ClusterTestTypeInformer
+}
+
+func (a *clusterTestTypeTypedInformerAdapter) TypedInformer() ClusterTestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*singleapiv1.ClusterTestType](a.Informer())
+}
+
+// ToClusterTestTypeIndexInformer converts an untyped informer into a ClusterTestTypeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterTestType. If that is not the case, calling type-safe methods of the returned
+// ClusterTestTypeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ClusterTestTypeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToClusterTestTypeIndexInformer(informer cache.SharedIndexInformer) ClusterTestTypeIndexInformer {
+	if informer, ok := informer.(ClusterTestTypeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*singleapiv1.ClusterTestType](informer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/api/v1/interface.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/api/v1/interface.go
new file mode 100644
index 0000000000..56f6ee6b6b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/api/v1/interface.go
@@ -0,0 +1,52 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	internalinterfaces "k8s.io/code-generator/examples/single/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// ClusterTestTypes returns a ClusterTestTypeInformer.
+	ClusterTestTypes() TypedClusterTestTypeInformer
+	// TestTypes returns a TestTypeInformer.
+	TestTypes() TypedTestTypeInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// ClusterTestTypes returns a TypedClusterTestTypeInformer.
+func (v *version) ClusterTestTypes() TypedClusterTestTypeInformer {
+	return &clusterTestTypeInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// TestTypes returns a TypedTestTypeInformer.
+func (v *version) TestTypes() TypedTestTypeInformer {
+	return &testTypeInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/api/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/api/v1/testtype.go
new file mode 100644
index 0000000000..c21ac86c2b
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/api/v1/testtype.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	singleapiv1 "k8s.io/code-generator/examples/single/api/v1"
+	versioned "k8s.io/code-generator/examples/single/clientset/versioned"
+	internalinterfaces "k8s.io/code-generator/examples/single/informers/externalversions/internalinterfaces"
+	apiv1 "k8s.io/code-generator/examples/single/listers/api/v1"
+)
+
+// TestTypeInformer provides access to a shared informer and lister for
+// TestTypes. Prefer using the type-safe variant (see [TypedTestTypeInformer]).
+type TestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() apiv1.TestTypeLister
+}
+
+// TypedTestTypeInformer provides access to a shared informer and lister for
+// TestTypes, including the type-safe TypedInformer variant.
+// It is a superset of TestTypeInformer.
+type TypedTestTypeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() TestTypeIndexInformer
+	Lister() apiv1.TestTypeLister
+}
+
+// TestTypeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type TestTypeIndexInformer cache.TypedSharedIndexInformer[*singleapiv1.TestType]
+
+// TestTypeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for TestType.
+type TestTypeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*singleapiv1.TestType]
+
+// TestTypeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for TestType.
+type TestTypeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*singleapiv1.TestType]
+
+// TestTypeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for TestType.
+type TestTypeFilteringHandler = cache.TypedFilteringResourceEventHandler[*singleapiv1.TestType]
+
+// TestTypeIndexers is a specialization of [cache.TypedIndexers] for TestType.
+type TestTypeIndexers = cache.TypedIndexers[*singleapiv1.TestType]
+
+// DeletedTestType is a specialization of [cache.DeletedObject] for TestType.
+type DeletedTestType = cache.DeletedObject[*singleapiv1.TestType]
+
+type testTypeInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformer]).
+func NewTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredTestTypeInformer]).
+func NewFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredTestTypeInformer constructs a new informer for TestType type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredTestTypeInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers TestTypeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) TestTypeIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedTestTypeInformerWithOptions]).
+func NewTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedTestTypeInformerWithOptions constructs a new informer for TestType type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedTestTypeInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) TestTypeIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "example.crd.code-generator.k8s.io", Version: "v1", Resource: "testtypes"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*singleapiv1.TestType](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ExampleV1().TestTypes(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&singleapiv1.TestType{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *testTypeInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedTestTypeInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *testTypeInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *testTypeInformer) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*singleapiv1.TestType](f.factory.InformerFor(&singleapiv1.TestType{}, f.defaultInformer))
+}
+
+func (f *testTypeInformer) Lister() apiv1.TestTypeLister {
+	return apiv1.NewTestTypeLister(f.Informer().GetIndexer())
+}
+
+// ToTypedTestTypeInformer converts an untyped informer into a TypedTestTypeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TypedTestTypeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedTestTypeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedTestTypeInformer(informer TestTypeInformer) TypedTestTypeInformer {
+	if informer, ok := informer.(TypedTestTypeInformer); ok {
+		return informer
+	}
+	return &testTypeTypedInformerAdapter{informer}
+}
+
+type testTypeTypedInformerAdapter struct {
+	TestTypeInformer
+}
+
+func (a *testTypeTypedInformerAdapter) TypedInformer() TestTypeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*singleapiv1.TestType](a.Informer())
+}
+
+// ToTestTypeIndexInformer converts an untyped informer into a TestTypeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *TestType. If that is not the case, calling type-safe methods of the returned
+// TestTypeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a TestTypeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTestTypeIndexInformer(informer cache.SharedIndexInformer) TestTypeIndexInformer {
+	if informer, ok := informer.(TestTypeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*singleapiv1.TestType](informer)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/factory.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/factory.go
new file mode 100644
index 0000000000..4939b5e1c1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/factory.go
@@ -0,0 +1,333 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	context "context"
+	reflect "reflect"
+	sync "sync"
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	wait "k8s.io/apimachinery/pkg/util/wait"
+	cache "k8s.io/client-go/tools/cache"
+	versioned "k8s.io/code-generator/examples/single/clientset/versioned"
+	api "k8s.io/code-generator/examples/single/informers/externalversions/api"
+	internalinterfaces "k8s.io/code-generator/examples/single/informers/externalversions/internalinterfaces"
+)
+
+// SharedInformerOption defines the functional option type for SharedInformerFactory.
+type SharedInformerOption func(*sharedInformerFactory) *sharedInformerFactory
+
+type sharedInformerFactory struct {
+	client           versioned.Interface
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	lock             sync.Mutex
+	defaultResync    time.Duration
+	customResync     map[reflect.Type]time.Duration
+	transform        cache.TransformFunc
+	informerName     *cache.InformerName
+
+	informers map[reflect.Type]cache.SharedIndexInformer
+	// startedInformers is used for tracking which informers have been started.
+	// This allows Start() to be called multiple times safely.
+	startedInformers map[reflect.Type]bool
+	// wg tracks how many goroutines were started.
+	wg sync.WaitGroup
+	// shuttingDown is true when Shutdown has been called. It may still be running
+	// because it needs to wait for goroutines.
+	shuttingDown bool
+}
+
+// WithCustomResyncConfig sets a custom resync period for the specified informer types.
+func WithCustomResyncConfig(resyncConfig map[v1.Object]time.Duration) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		for k, v := range resyncConfig {
+			factory.customResync[reflect.TypeOf(k)] = v
+		}
+		return factory
+	}
+}
+
+// WithTweakListOptions sets a custom filter on all listers of the configured SharedInformerFactory.
+func WithTweakListOptions(tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.tweakListOptions = tweakListOptions
+		return factory
+	}
+}
+
+// WithNamespace limits the SharedInformerFactory to the specified namespace.
+func WithNamespace(namespace string) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.namespace = namespace
+		return factory
+	}
+}
+
+// WithTransform sets a transform on all informers.
+func WithTransform(transform cache.TransformFunc) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.transform = transform
+		return factory
+	}
+}
+
+// WithInformerName sets the InformerName for informer identity used in metrics.
+// The InformerName must be created via cache.NewInformerName() at startup,
+// which validates global uniqueness. Each informer type will register its
+// GVR under this name.
+func WithInformerName(informerName *cache.InformerName) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.informerName = informerName
+		return factory
+	}
+}
+
+func (f *sharedInformerFactory) InformerName() *cache.InformerName {
+	return f.informerName
+}
+
+// NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces.
+func NewSharedInformerFactory(client versioned.Interface, defaultResync time.Duration) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync)
+}
+
+// NewFilteredSharedInformerFactory constructs a new instance of sharedInformerFactory.
+// Listers obtained via this SharedInformerFactory will be subject to the same filters
+// as specified here.
+//
+// Deprecated: Please use NewSharedInformerFactoryWithOptions instead
+func NewFilteredSharedInformerFactory(client versioned.Interface, defaultResync time.Duration, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync, WithNamespace(namespace), WithTweakListOptions(tweakListOptions))
+}
+
+// NewSharedInformerFactoryWithOptions constructs a new instance of a SharedInformerFactory with additional options.
+func NewSharedInformerFactoryWithOptions(client versioned.Interface, defaultResync time.Duration, options ...SharedInformerOption) SharedInformerFactory {
+	factory := &sharedInformerFactory{
+		client:           client,
+		namespace:        v1.NamespaceAll,
+		defaultResync:    defaultResync,
+		informers:        make(map[reflect.Type]cache.SharedIndexInformer),
+		startedInformers: make(map[reflect.Type]bool),
+		customResync:     make(map[reflect.Type]time.Duration),
+	}
+
+	// Apply all options
+	for _, opt := range options {
+		factory = opt(factory)
+	}
+
+	return factory
+}
+
+func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
+	f.StartWithContext(wait.ContextForChannel(stopCh))
+}
+
+func (f *sharedInformerFactory) StartWithContext(ctx context.Context) {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	if f.shuttingDown {
+		return
+	}
+
+	for informerType, informer := range f.informers {
+		if !f.startedInformers[informerType] {
+			f.wg.Go(func() {
+				informer.RunWithContext(ctx)
+			})
+			f.startedInformers[informerType] = true
+		}
+	}
+}
+
+func (f *sharedInformerFactory) Shutdown() {
+	f.lock.Lock()
+	f.shuttingDown = true
+	f.lock.Unlock()
+
+	// Will return immediately if there is nothing to wait for.
+	f.wg.Wait()
+	f.informerName.Release()
+}
+
+func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
+	result := f.WaitForCacheSyncWithContext(wait.ContextForChannel(stopCh))
+	return result.Synced
+}
+
+func (f *sharedInformerFactory) WaitForCacheSyncWithContext(ctx context.Context) cache.SyncResult {
+	informers := func() map[reflect.Type]cache.SharedIndexInformer {
+		f.lock.Lock()
+		defer f.lock.Unlock()
+
+		informers := map[reflect.Type]cache.SharedIndexInformer{}
+		for informerType, informer := range f.informers {
+			if f.startedInformers[informerType] {
+				informers[informerType] = informer
+			}
+		}
+		return informers
+	}()
+
+	// Wait for informers to sync, without polling.
+	cacheSyncs := make([]cache.DoneChecker, 0, len(informers))
+	for _, informer := range informers {
+		cacheSyncs = append(cacheSyncs, informer.HasSyncedChecker())
+	}
+	cache.WaitFor(ctx, "" /* no logging */, cacheSyncs...)
+
+	res := cache.SyncResult{
+		Synced: make(map[reflect.Type]bool, len(informers)),
+	}
+	failed := false
+	for informType, informer := range informers {
+		hasSynced := informer.HasSynced()
+		if !hasSynced {
+			failed = true
+		}
+		res.Synced[informType] = hasSynced
+	}
+	if failed {
+		// context.Cause is more informative than ctx.Err().
+		// This must be non-nil, otherwise WaitFor wouldn't have stopped
+		// prematurely.
+		res.Err = context.Cause(ctx)
+	}
+
+	return res
+}
+
+// InformerFor returns the SharedIndexInformer for obj using an internal
+// client.
+func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(obj)
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+
+	resyncPeriod, exists := f.customResync[informerType]
+	if !exists {
+		resyncPeriod = f.defaultResync
+	}
+
+	informer = newFunc(f.client, resyncPeriod)
+	if f.transform != nil {
+		informer.SetTransform(f.transform)
+	}
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+// SharedInformerFactory provides shared informers for resources in all known
+// API group versions.
+//
+// It is typically used like this:
+//
+//	ctx, cancel := context.WithCancel(context.Background())
+//	defer cancel()
+//	factory := NewSharedInformerFactory(client, resyncPeriod)
+//	defer factory.Shutdown()    // Returns immediately if nothing was started.
+//	genericInformer := factory.ForResource(resource)
+//	typedInformer := factory.SomeAPIGroup().V1().SomeType()
+//	handle, err := typeInformer.Informer().AddEventHandler(...)
+//	if err != nil {
+//	    return fmt.Errorf("register event handler: %v", err)
+//	}
+//	defer typeInformer.Informer().RemoveEventHandler(handle) // Avoids leaking goroutines.
+//	factory.StartWithContext(ctx)                            // Start processing these informers.
+//	synced := factory.WaitForCacheSyncWithContext(ctx)
+//	if err := synced.AsError(); err != nil {
+//	    return err
+//	}
+//	for v := range synced {
+//	    // Only if desired log some information similar to this.
+//	    fmt.Fprintf(os.Stdout, "cache synced: %s", v)
+//	}
+//
+//	// Also make sure that all of the initial cache events have been delivered.
+//	if !WaitFor(ctx, "event handler sync", handle.HasSyncedChecker()) {
+//	    // Must have failed because of context.
+//	    return fmt.Errorf("sync event handler: %w", context.Cause(ctx))
+//	}
+//
+//	// Creating informers can also be created after Start, but then
+//	// Start must be called again:
+//	anotherGenericInformer := factory.ForResource(resource)
+//	factory.StartWithContext(ctx)
+type SharedInformerFactory interface {
+	internalinterfaces.SharedInformerFactory
+
+	// Start initializes all requested informers. They are handled in goroutines
+	// which run until the stop channel gets closed.
+	// Warning: Start does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	//
+	// Contextual logging: StartWithContext should be used instead of Start in code which supports contextual logging.
+	Start(stopCh <-chan struct{})
+
+	// StartWithContext initializes all requested informers. They are handled in goroutines
+	// which run until the context gets canceled.
+	// Warning: StartWithContext does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	StartWithContext(ctx context.Context)
+
+	// Shutdown marks a factory as shutting down. At that point no new
+	// informers can be started anymore and Start will return without
+	// doing anything.
+	//
+	// In addition, Shutdown blocks until all goroutines have terminated. For that
+	// to happen, the close channel(s) that they were started with must be closed,
+	// either before Shutdown gets called or while it is waiting.
+	//
+	// Shutdown may be called multiple times, even concurrently. All such calls will
+	// block until all goroutines have terminated.
+	Shutdown()
+
+	// WaitForCacheSync blocks until all started informers' caches were synced
+	// or the stop channel gets closed.
+	//
+	// Contextual logging: WaitForCacheSyncWithContext should be used instead of WaitForCacheSync in code which supports contextual logging. It also returns a more useful result.
+	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
+
+	// WaitForCacheSyncWithContext blocks until all started informers' caches were synced
+	// or the context gets canceled.
+	WaitForCacheSyncWithContext(ctx context.Context) cache.SyncResult
+
+	// ForResource gives generic access to a shared informer of the matching type.
+	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
+
+	// InformerFor returns the SharedIndexInformer for obj using an internal
+	// client.
+	InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer
+
+	Example() api.Interface
+}
+
+func (f *sharedInformerFactory) Example() api.Interface {
+	return api.New(f, f.namespace, f.tweakListOptions)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/factory_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/factory_test.go
new file mode 100644
index 0000000000..bc1911121e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/factory_test.go
@@ -0,0 +1,111 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package externalversions
+
+import (
+	"slices"
+	"testing"
+	"time"
+
+	"k8s.io/client-go/tools/cache"
+	singleapiv1 "k8s.io/code-generator/examples/single/api/v1"
+	"k8s.io/code-generator/examples/single/clientset/versioned"
+)
+
+// TestTransforms verified that transform calls are applied as expected.
+func TestTransforms(t *testing.T) {
+	tests := []struct {
+		name                    string
+		useFactoryTransform     bool
+		usePerInformerTransform bool
+		wantTransformCalls      []string
+	}{
+		{
+			name:               "no transforms",
+			wantTransformCalls: nil,
+		},
+		{
+			name:                    "no factory transform preserves per-informer transform",
+			usePerInformerTransform: true,
+			wantTransformCalls:      []string{"per-informer"},
+		},
+		{
+			name:                "factory transform applied when no per-informer transform",
+			useFactoryTransform: true,
+			wantTransformCalls:  []string{"factory"},
+		},
+		{
+			name:                    "factory transform overrides per-informer transform",
+			useFactoryTransform:     true,
+			usePerInformerTransform: true,
+			wantTransformCalls:      []string{"factory"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var transformCalls []string
+			makeTransform := func(name string) cache.TransformFunc {
+				return func(obj interface{}) (interface{}, error) {
+					transformCalls = append(transformCalls, name)
+					return obj, nil
+				}
+			}
+
+			var opts []SharedInformerOption
+			if tt.useFactoryTransform {
+				opts = append(opts, WithTransform(makeTransform("factory")))
+			}
+			factory := NewSharedInformerFactoryWithOptions(nil, 0, opts...)
+
+			var wrapper *transformTrackingInformer
+			newFunc := func(_ versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+				inner := cache.NewSharedIndexInformer(nil, &singleapiv1.TestType{}, resyncPeriod, cache.Indexers{})
+				wrapper = &transformTrackingInformer{SharedIndexInformer: inner}
+				if tt.usePerInformerTransform {
+					err := wrapper.SetTransform(makeTransform("per-informer"))
+					if err != nil {
+						t.Fatalf("failed to set transform: %v", err)
+					}
+				}
+				return wrapper
+			}
+			factory.InformerFor(&singleapiv1.TestType{}, newFunc)
+
+			if wrapper.lastTransform != nil {
+				_, err := wrapper.lastTransform(nil)
+				if err != nil {
+					t.Fatalf("failed to invoke transform: %v", err)
+				}
+			}
+
+			if !slices.Equal(transformCalls, tt.wantTransformCalls) {
+				t.Errorf("transform calls: got %v, want %v", transformCalls, tt.wantTransformCalls)
+			}
+		})
+	}
+}
+
+type transformTrackingInformer struct {
+	cache.SharedIndexInformer
+	lastTransform cache.TransformFunc
+}
+
+func (s *transformTrackingInformer) SetTransform(handler cache.TransformFunc) error {
+	s.lastTransform = handler
+	return s.SharedIndexInformer.SetTransform(handler)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/generic.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/generic.go
new file mode 100644
index 0000000000..59589221d6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/generic.go
@@ -0,0 +1,64 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package externalversions
+
+import (
+	fmt "fmt"
+
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	cache "k8s.io/client-go/tools/cache"
+	v1 "k8s.io/code-generator/examples/single/api/v1"
+)
+
+// GenericInformer is type of SharedIndexInformer which will locate and delegate to other
+// sharedInformers based on type
+type GenericInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() cache.GenericLister
+}
+
+type genericInformer struct {
+	informer cache.SharedIndexInformer
+	resource schema.GroupResource
+}
+
+// Informer returns the SharedIndexInformer.
+func (f *genericInformer) Informer() cache.SharedIndexInformer {
+	return f.informer
+}
+
+// Lister returns the GenericLister.
+func (f *genericInformer) Lister() cache.GenericLister {
+	return cache.NewGenericLister(f.Informer().GetIndexer(), f.resource)
+}
+
+// ForResource gives generic access to a shared informer of the matching type
+// TODO extend this to unknown resources with a client pool
+func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource) (GenericInformer, error) {
+	switch resource {
+	// Group=example.crd.code-generator.k8s.io, Version=v1
+	case v1.SchemeGroupVersion.WithResource("clustertesttypes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Example().V1().ClusterTestTypes().Informer()}, nil
+	case v1.SchemeGroupVersion.WithResource("testtypes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Example().V1().TestTypes().Informer()}, nil
+
+	}
+
+	return nil, fmt.Errorf("no informer found for %v", resource)
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/internalinterfaces/factory_interfaces.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/internalinterfaces/factory_interfaces.go
new file mode 100644
index 0000000000..a96309121c
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/informers/externalversions/internalinterfaces/factory_interfaces.go
@@ -0,0 +1,59 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package internalinterfaces
+
+import (
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	cache "k8s.io/client-go/tools/cache"
+	versioned "k8s.io/code-generator/examples/single/clientset/versioned"
+)
+
+// NewInformerFunc takes versioned.Interface and time.Duration to return a SharedIndexInformer.
+type NewInformerFunc func(versioned.Interface, time.Duration) cache.SharedIndexInformer
+
+// SharedInformerFactory a small interface to allow for adding an informer without an import cycle
+type SharedInformerFactory interface {
+	Start(stopCh <-chan struct{})
+	InformerFor(obj runtime.Object, newFunc NewInformerFunc) cache.SharedIndexInformer
+	InformerName() *cache.InformerName
+}
+
+// TweakListOptionsFunc is a function that transforms a v1.ListOptions.
+type TweakListOptionsFunc func(*v1.ListOptions)
+
+// InformerOptions holds the options for creating an informer.
+type InformerOptions struct {
+	// ResyncPeriod is the resync period for this informer.
+	// If not set, defaults to 0 (no resync).
+	ResyncPeriod time.Duration
+
+	// Indexers are the indexers for this informer.
+	Indexers cache.Indexers
+
+	// InformerName is used to uniquely identify this informer for metrics.
+	// If not set, metrics will not be published for this informer.
+	// Use cache.NewInformerName() to create an InformerName at startup.
+	InformerName *cache.InformerName
+
+	// TweakListOptions is an optional function to modify the list options.
+	TweakListOptions TweakListOptionsFunc
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/listers/api/v1/clustertesttype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/listers/api/v1/clustertesttype.go
new file mode 100644
index 0000000000..a0ce0d3b71
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/listers/api/v1/clustertesttype.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	apiv1 "k8s.io/code-generator/examples/single/api/v1"
+)
+
+// ClusterTestTypeLister helps list ClusterTestTypes.
+// All objects returned here must be treated as read-only.
+type ClusterTestTypeLister interface {
+	// List lists all ClusterTestTypes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*apiv1.ClusterTestType, err error)
+	// Get retrieves the ClusterTestType from the index for a given name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*apiv1.ClusterTestType, error)
+	ClusterTestTypeListerExpansion
+}
+
+// clusterTestTypeLister implements the ClusterTestTypeLister interface.
+type clusterTestTypeLister struct {
+	listers.ResourceIndexer[*apiv1.ClusterTestType]
+}
+
+// NewClusterTestTypeLister returns a new ClusterTestTypeLister.
+func NewClusterTestTypeLister(indexer cache.Indexer) ClusterTestTypeLister {
+	return &clusterTestTypeLister{listers.New[*apiv1.ClusterTestType](indexer, apiv1.Resource("clustertesttype"))}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/listers/api/v1/expansion_generated.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/listers/api/v1/expansion_generated.go
new file mode 100644
index 0000000000..2681a29f47
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/listers/api/v1/expansion_generated.go
@@ -0,0 +1,31 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+// ClusterTestTypeListerExpansion allows custom methods to be added to
+// ClusterTestTypeLister.
+type ClusterTestTypeListerExpansion interface{}
+
+// TestTypeListerExpansion allows custom methods to be added to
+// TestTypeLister.
+type TestTypeListerExpansion interface{}
+
+// TestTypeNamespaceListerExpansion allows custom methods to be added to
+// TestTypeNamespaceLister.
+type TestTypeNamespaceListerExpansion interface{}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/listers/api/v1/testtype.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/listers/api/v1/testtype.go
new file mode 100644
index 0000000000..37e13bfa9a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/examples/single/listers/api/v1/testtype.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	apiv1 "k8s.io/code-generator/examples/single/api/v1"
+)
+
+// TestTypeLister helps list TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeLister interface {
+	// List lists all TestTypes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*apiv1.TestType, err error)
+	// TestTypes returns an object that can list and get TestTypes.
+	TestTypes(namespace string) TestTypeNamespaceLister
+	TestTypeListerExpansion
+}
+
+// testTypeLister implements the TestTypeLister interface.
+type testTypeLister struct {
+	listers.ResourceIndexer[*apiv1.TestType]
+}
+
+// NewTestTypeLister returns a new TestTypeLister.
+func NewTestTypeLister(indexer cache.Indexer) TestTypeLister {
+	return &testTypeLister{listers.New[*apiv1.TestType](indexer, apiv1.Resource("testtype"))}
+}
+
+// TestTypes returns an object that can list and get TestTypes.
+func (s *testTypeLister) TestTypes(namespace string) TestTypeNamespaceLister {
+	return testTypeNamespaceLister{listers.NewNamespaced[*apiv1.TestType](s.ResourceIndexer, namespace)}
+}
+
+// TestTypeNamespaceLister helps list and get TestTypes.
+// All objects returned here must be treated as read-only.
+type TestTypeNamespaceLister interface {
+	// List lists all TestTypes in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*apiv1.TestType, err error)
+	// Get retrieves the TestType from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*apiv1.TestType, error)
+	TestTypeNamespaceListerExpansion
+}
+
+// testTypeNamespaceLister implements the TestTypeNamespaceLister
+// interface.
+type testTypeNamespaceLister struct {
+	listers.ResourceIndexer[*apiv1.TestType]
+}
diff --git a/hack/verify/go-generate.sh b/hack/tools/code-generator/third_party/k8s.io/code-generator/generate-groups.sh
similarity index 68%
rename from hack/verify/go-generate.sh
rename to hack/tools/code-generator/third_party/k8s.io/code-generator/generate-groups.sh
index f4651fdb47..65b0abda5a 100755
--- a/hack/verify/go-generate.sh
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/generate-groups.sh
@@ -1,12 +1,12 @@
 #!/usr/bin/env bash
 
-# Copyright 2026 Google LLC
+# Copyright 2017 The Kubernetes Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
 #
-#      http://www.apache.org/licenses/LICENSE-2.0
+#     http://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
@@ -14,9 +14,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-set -o errexit -o nounset -o pipefail
-
-ROOT="$(git rev-parse --show-toplevel)"
-cd "${ROOT}"
-
-./hack/third_party/kubernetes/verify-generated.sh go-generate "$@"
+echo "ERROR: $(basename "$0") has been removed."
+echo "ERROR: Please use k8s.io/code-generator/kube_codegen.sh instead."
+echo
+exit 1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/generate-internal-groups.sh b/hack/tools/code-generator/third_party/k8s.io/code-generator/generate-internal-groups.sh
new file mode 100755
index 0000000000..65b0abda5a
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/generate-internal-groups.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+echo "ERROR: $(basename "$0") has been removed."
+echo "ERROR: Please use k8s.io/code-generator/kube_codegen.sh instead."
+echo
+exit 1
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/go.mod b/hack/tools/code-generator/third_party/k8s.io/code-generator/go.mod
new file mode 100644
index 0000000000..d4a54e1501
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/go.mod
@@ -0,0 +1,59 @@
+// This is a generated file. Do not edit directly.
+
+module k8s.io/code-generator
+
+go 1.26.0
+
+godebug default=go1.26
+
+require (
+	github.com/gogo/protobuf v1.3.2
+	github.com/google/gnostic-models v0.7.0
+	github.com/google/go-cmp v0.7.0
+	github.com/spf13/pflag v1.0.10
+	go.yaml.in/yaml/v2 v2.4.4
+	golang.org/x/text v0.40.0
+	k8s.io/apimachinery v0.37.0-rc.0
+	k8s.io/gengo/v2 v2.0.0-20260408192533-25e2208e0dc3
+	k8s.io/klog/v2 v2.140.0
+	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad
+	k8s.io/utils v0.0.0-20260626114624-be93311217bd
+	sigs.k8s.io/randfill v1.0.0
+	sigs.k8s.io/yaml v1.6.0
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-openapi/jsonpointer v1.0.0 // indirect
+	github.com/go-openapi/jsonreference v1.0.0 // indirect
+	github.com/go-openapi/swag v0.27.1 // indirect
+	github.com/go-openapi/swag/cmdutils v0.27.1 // indirect
+	github.com/go-openapi/swag/conv v0.27.1 // indirect
+	github.com/go-openapi/swag/fileutils v0.27.1 // indirect
+	github.com/go-openapi/swag/jsonutils v0.27.1 // indirect
+	github.com/go-openapi/swag/loading v0.27.1 // indirect
+	github.com/go-openapi/swag/mangling v0.27.1 // indirect
+	github.com/go-openapi/swag/netutils v0.27.1 // indirect
+	github.com/go-openapi/swag/pools v0.27.1 // indirect
+	github.com/go-openapi/swag/stringutils v0.27.1 // indirect
+	github.com/go-openapi/swag/typeutils v0.27.1 // indirect
+	github.com/go-openapi/swag/yamlutils v0.27.1 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/tools/go/expect v0.1.1-deprecated // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
+)
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/go.sum b/hack/tools/code-generator/third_party/k8s.io/code-generator/go.sum
new file mode 100644
index 0000000000..0bb7efb9d7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/go.sum
@@ -0,0 +1,151 @@
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
+github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
+github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
+github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
+github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY=
+github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0=
+github.com/go-openapi/swag v0.27.1 h1:VotvOLWW8q/EAxB0YdsBBGC8XYyeL1YwBj2ungAGPNg=
+github.com/go-openapi/swag v0.27.1/go.mod h1:GTkJPwHfhJp6MWr4/rCh64HVI3Ofu+tcsbfjfHmTxpE=
+github.com/go-openapi/swag/cmdutils v0.27.1 h1:I7sYqaWVl5mq0NEmNQkAmFDyNin9ufvMX/p2zwtQaOE=
+github.com/go-openapi/swag/cmdutils v0.27.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
+github.com/go-openapi/swag/conv v0.27.1 h1:8wi9ZG+olmY1wXphl93EWniPtbSPkXM/feH7FgjsvrU=
+github.com/go-openapi/swag/conv v0.27.1/go.mod h1:QbqMivkpKhC3g1B1GGGOJ6ANewI3S62dbzYu3Duowqs=
+github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzrb0QkmLKf9oM=
+github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8=
+github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU=
+github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1 h1:mJu3COL9WEaZVp/Kf2PRMi7tPszPEJfSr/OO75ynCs8=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY=
+github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY=
+github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE=
+github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA=
+github.com/go-openapi/swag/mangling v0.27.1/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w=
+github.com/go-openapi/swag/netutils v0.27.1 h1:mICMFoS82F5TZ4Zy3cqmcQk+BFeCp3Uyq3Np7GI0/qU=
+github.com/go-openapi/swag/netutils v0.27.1/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ=
+github.com/go-openapi/swag/pools v0.27.1 h1:9LeadcMyb2GJCbXX5hVQDbZ2Lq9TL4dCs/nx1j5DO0E=
+github.com/go-openapi/swag/pools v0.27.1/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE=
+github.com/go-openapi/swag/stringutils v0.27.1 h1:ZXePZ0r2p1qSjo8tD3Un4vFj8+FqlCkczxDrJIhYUp8=
+github.com/go-openapi/swag/stringutils v0.27.1/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM=
+github.com/go-openapi/swag/typeutils v0.27.1 h1:KSTdFlfnse4r6dP9IrEnwMldjE+zs71UeEB3//PtVXc=
+github.com/go-openapi/swag/typeutils v0.27.1/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ=
+github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA=
+github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo=
+github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
+github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
+golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/apimachinery v0.37.0-rc.0 h1:z92lapcEJUiMb38pzUIp81kEXT6lIWXhs6auvm8+/s4=
+k8s.io/apimachinery v0.37.0-rc.0/go.mod h1:mhq6CPCzI6XJNHSiek+w7Ws9/rP9qL5s+7aBrh5ODSI=
+k8s.io/gengo/v2 v2.0.0-20260408192533-25e2208e0dc3 h1:3L6PNkMLXkU/pz3jWzaaIUz0Rs2V9h+5O51AeRC7poc=
+k8s.io/gengo/v2 v2.0.0-20260408192533-25e2208e0dc3/go.mod h1:yvyl3l9E+UxlqOMUULdKTAYB0rEhsmjr7+2Vb/1pCSo=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/kube_codegen.sh b/hack/tools/code-generator/third_party/k8s.io/code-generator/kube_codegen.sh
new file mode 100755
index 0000000000..2138c365c7
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/kube_codegen.sh
@@ -0,0 +1,909 @@
+#!/usr/bin/env bash
+
+# Copyright 2023 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This presents several functions for packages which want to use kubernetes
+# code-generation tools.
+
+# These functions insist that your input IDL (commented go) files be located in
+# go packages following the pattern $input_pkg_root/$something_sans_slash/$api_version .
+# Those $something_sans_slash will be propagated into the output directory structure.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUBE_CODEGEN_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+
+# This file is intended for out-of-tree projects running code generators.
+# In that context, all in-tree Kubernetes types (e.g. metav1.TypeMeta,
+# resource.Quantity) live in the read-only Go module cache, so generators
+# must not attempt to write output files for them. These packages are passed
+# as --readonly-pkg to generators that support it (validation-gen, openapi-gen).
+# NOTE: These must be passed as separate arguments using an array loop, not
+# via "$(printf ...)". Double-quoting a printf command substitution collapses
+# the output into a single argument, which silently breaks flag parsing.
+KUBE_CODEGEN_READONLY_PKGS=(
+    k8s.io/apimachinery/pkg/apis/meta/v1
+    k8s.io/apimachinery/pkg/api/resource
+    k8s.io/apimachinery/pkg/runtime
+    k8s.io/apimachinery/pkg/types
+    k8s.io/apimachinery/pkg/util/intstr
+    k8s.io/apimachinery/pkg/version
+    time
+)
+
+# Callers which want a specific tag of the k8s.io/code-generator repo should
+# set the KUBE_CODEGEN_TAG to the tag name, e.g. KUBE_CODEGEN_TAG="release-1.32"
+# before sourcing this file.
+CODEGEN_VERSION_SPEC="${KUBE_CODEGEN_TAG:+"@${KUBE_CODEGEN_TAG}"}"
+
+# Go installs in $GOBIN if defined, and $GOPATH/bin otherwise. We want to know
+# which one it is, so we can use it later.
+function get_gobin() {
+    local from_env
+    from_env="$(go env GOBIN)"
+    if [[ -n "${from_env}" ]]; then
+        echo "${from_env}"
+    else
+        echo "$(go env GOPATH)/bin"
+    fi
+}
+GOBIN="$(get_gobin)"
+export GOBIN
+
+function kube::codegen::internal::findz() {
+    # We use `find` rather than `git ls-files` because sometimes external
+    # projects use this across repos.  This is an imperfect wrapper of find,
+    # but good enough for this script.
+    find "$@" -print0
+}
+
+function kube::codegen::internal::grep() {
+    # We use `grep` rather than `git grep` because sometimes external projects
+    # use this across repos.
+    grep "$@" \
+        --exclude-dir .git \
+        --exclude-dir _output \
+        --exclude-dir vendor
+}
+
+# Generate tagged helper code: conversions, deepcopy, defaults and validations
+#
+# USAGE: kube::codegen::gen_helpers [FLAGS] <input-dir>
+#
+# <input-dir>
+#   The root directory under which to search for Go files which request code to
+#   be generated.  This must be a local path, not a Go package.
+#
+#   See note at the top about package structure below that.
+#
+# FLAGS:
+#
+#   --boilerplate <string = path_to_kube_codegen_boilerplate>
+#     An optional override for the header file to insert into generated files.
+#
+#   --extra-peer-dir <string>
+#     An optional list (this flag may be specified multiple times) of "extra"
+#     directories to consider during conversion generation.
+#
+#   --lint-rules <string>
+#     An optional comma-separated list of lint rules to enable on the
+#     generators. See the --lint-rules flag on the individual generators for
+#     supported values (e.g. "known-tags-only,require-explicit-disablement").
+#
+function kube::codegen::gen_helpers() {
+    local in_dir=""
+    local boilerplate="${KUBE_CODEGEN_ROOT}/hack/boilerplate.go.txt"
+    local v="${KUBE_VERBOSE:-0}"
+    local extra_peers=()
+    local lint_rules=""
+
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            "--boilerplate")
+                boilerplate="$2"
+                shift 2
+                ;;
+            "--extra-peer-dir")
+                extra_peers+=("$2")
+                shift 2
+                ;;
+            "--lint-rules")
+                lint_rules="$2"
+                shift 2
+                ;;
+            *)
+                if [[ "$1" =~ ^-- ]]; then
+                    echo "unknown argument: $1" >&2
+                    return 1
+                fi
+                if [ -n "$in_dir" ]; then
+                    echo "too many arguments: $1 (already have $in_dir)" >&2
+                    return 1
+                fi
+                in_dir="$1"
+                shift
+                ;;
+        esac
+    done
+
+    if [ -z "${in_dir}" ]; then
+        echo "input-dir argument is required" >&2
+        return 1
+    fi
+
+    local lint_args=()
+    if [ -n "${lint_rules}" ]; then
+        lint_args+=("--lint-rules" "${lint_rules}")
+    fi
+
+    (
+        # To support running this from anywhere, first cd into this directory,
+        # and then install with forced module mode on and fully qualified name.
+        cd "${KUBE_CODEGEN_ROOT}"
+        BINS=(
+            conversion-gen"${CODEGEN_VERSION_SPEC}"
+            deepcopy-gen"${CODEGEN_VERSION_SPEC}"
+            defaulter-gen"${CODEGEN_VERSION_SPEC}"
+            validation-gen"${CODEGEN_VERSION_SPEC}"
+        )
+        # shellcheck disable=2046 # printf word-splitting is intentional
+        GO111MODULE=on go install $(printf "k8s.io/code-generator/cmd/%s " "${BINS[@]}")
+    )
+
+    # Deepcopy
+    #
+    local input_pkgs=()
+    while read -r dir; do
+        pkg="$(cd "${dir}" && GO111MODULE=on go list -find .)"
+        input_pkgs+=("${pkg}")
+    done < <(
+        ( kube::codegen::internal::grep -l --null \
+            -e '^\s*//\s*+k8s:deepcopy-gen=' \
+            -r "${in_dir}" \
+            --include '*.go' \
+            || true \
+        ) | while read -r -d $'\0' F; do dirname "${F}"; done \
+          | LC_ALL=C sort -u
+    )
+
+    if [ "${#input_pkgs[@]}" != 0 ]; then
+        echo "Generating deepcopy code for ${#input_pkgs[@]} targets"
+
+        kube::codegen::internal::findz \
+            "${in_dir}" \
+            -type f \
+            -name zz_generated.deepcopy.go \
+            | xargs -0 rm -f
+
+        "${GOBIN}/deepcopy-gen" \
+            -v "${v}" \
+            --output-file zz_generated.deepcopy.go \
+            --go-header-file "${boilerplate}" \
+            "${lint_args[@]:+"${lint_args[@]}"}" \
+            "${input_pkgs[@]}"
+    fi
+
+    # Validations
+    #
+    local input_pkgs=()
+    while read -r dir; do
+        pkg="$(cd "${dir}" && GO111MODULE=on go list -find .)"
+        input_pkgs+=("${pkg}")
+    done < <(
+        ( kube::codegen::internal::grep -l --null \
+            -e '^\s*//\s*+k8s:validation-gen=' \
+            -r "${in_dir}" \
+            --include '*.go' \
+            || true \
+        ) | while read -r -d $'\0' F; do dirname "${F}"; done \
+          | LC_ALL=C sort -u
+    )
+
+
+    if [ "${#input_pkgs[@]}" != 0 ]; then
+        echo "Generating validation code for ${#input_pkgs[@]} targets"
+
+        kube::codegen::internal::findz \
+            "${in_dir}" \
+            -type f \
+            -name zz_generated.validations.go \
+            | xargs -0 rm -f
+
+        local readonly_args=()
+        for pkg in "${KUBE_CODEGEN_READONLY_PKGS[@]}"; do
+            readonly_args+=("--readonly-pkg" "${pkg}")
+        done
+        "${GOBIN}/validation-gen" \
+            -v "${v}" \
+            --output-file zz_generated.validations.go \
+            "${readonly_args[@]}" \
+            --go-header-file "${boilerplate}" \
+            "${lint_args[@]:+"${lint_args[@]}"}" \
+            "${input_pkgs[@]}"
+    fi
+
+    # Defaults
+    #
+    local input_pkgs=()
+    while read -r dir; do
+        pkg="$(cd "${dir}" && GO111MODULE=on go list -find .)"
+        input_pkgs+=("${pkg}")
+    done < <(
+        ( kube::codegen::internal::grep -l --null \
+            -e '^\s*//\s*+k8s:defaulter-gen=' \
+            -r "${in_dir}" \
+            --include '*.go' \
+            || true \
+        ) | while read -r -d $'\0' F; do dirname "${F}"; done \
+          | LC_ALL=C sort -u
+    )
+
+    if [ "${#input_pkgs[@]}" != 0 ]; then
+        echo "Generating defaulter code for ${#input_pkgs[@]} targets"
+
+        kube::codegen::internal::findz \
+            "${in_dir}" \
+            -type f \
+            -name zz_generated.defaults.go \
+            | xargs -0 rm -f
+
+        "${GOBIN}/defaulter-gen" \
+            -v "${v}" \
+            --output-file zz_generated.defaults.go \
+            --go-header-file "${boilerplate}" \
+            "${lint_args[@]:+"${lint_args[@]}"}" \
+            "${input_pkgs[@]}"
+    fi
+
+    # Conversions
+    #
+    local input_pkgs=()
+    while read -r dir; do
+        pkg="$(cd "${dir}" && GO111MODULE=on go list -find .)"
+        input_pkgs+=("${pkg}")
+    done < <(
+        ( kube::codegen::internal::grep -l --null \
+            -e '^\s*//\s*+k8s:conversion-gen=' \
+            -r "${in_dir}" \
+            --include '*.go' \
+            || true \
+        ) | while read -r -d $'\0' F; do dirname "${F}"; done \
+          | LC_ALL=C sort -u
+    )
+
+    if [ "${#input_pkgs[@]}" != 0 ]; then
+        echo "Generating conversion code for ${#input_pkgs[@]} targets"
+
+        kube::codegen::internal::findz \
+            "${in_dir}" \
+            -type f \
+            -name zz_generated.conversion.go \
+            | xargs -0 rm -f
+
+        local extra_peer_args=()
+        for arg in "${extra_peers[@]:+"${extra_peers[@]}"}"; do
+            extra_peer_args+=("--extra-peer-dirs" "$arg")
+        done
+        "${GOBIN}/conversion-gen" \
+            -v "${v}" \
+            --output-file zz_generated.conversion.go \
+            --go-header-file "${boilerplate}" \
+            "${extra_peer_args[@]:+"${extra_peer_args[@]}"}" \
+            "${lint_args[@]:+"${lint_args[@]}"}" \
+            "${input_pkgs[@]}"
+    fi
+}
+
+# Generate openapi code
+#
+# USAGE: kube::codegen::gen_openapi [FLAGS] <input-dir>
+#
+# <input-dir>
+#   The root directory under which to search for Go files which request openapi
+#   to be generated.  This must be a local path, not a Go package.
+#
+#   See note at the top about package structure below that.
+#
+# FLAGS:
+#
+#   --output-dir <string>
+#     The directory into which to emit code.
+#
+#   --output-pkg <string>
+#     The Go package path (import path) of the --output-dir.
+#
+#   --extra-pkgs <string>
+#     An optional list of additional packages to be imported during openapi
+#     generation.  The argument must be Go package syntax, e.g.
+#     "k8s.io/foo/bar".  It may be a single value or a comma-delimited list.
+#     This flag may be repeated.
+#
+#   --report-filename <string = "/dev/null">
+#     An optional path at which to write an API violations report.  "-" means
+#     stdout.
+#
+#   --update-report
+#     If specified, update the report file in place, rather than diffing it.
+#
+#   --boilerplate <string = path_to_kube_codegen_boilerplate>
+#     An optional override for the header file to insert into generated files.
+#
+function kube::codegen::gen_openapi() {
+    local in_dir=""
+    local out_dir=""
+    local out_pkg=""
+    local extra_pkgs=()
+    local report="/dev/null"
+    local output_model_name_file=""
+    local update_report=""
+    local boilerplate="${KUBE_CODEGEN_ROOT}/hack/boilerplate.go.txt"
+    local v="${KUBE_VERBOSE:-0}"
+
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            "--output-dir")
+                out_dir="$2"
+                shift 2
+                ;;
+            "--output-pkg")
+                out_pkg="$2"
+                shift 2
+                ;;
+            "--extra-pkgs")
+                extra_pkgs+=("$2")
+                shift 2
+                ;;
+            "--report-filename")
+                report="$2"
+                shift 2
+                ;;
+            "--output-model-name-file")
+              output_model_name_file="$2"
+              shift 2
+              ;;
+            "--update-report")
+                update_report="true"
+                shift
+                ;;
+            "--boilerplate")
+                boilerplate="$2"
+                shift 2
+                ;;
+            *)
+                if [[ "$1" =~ ^-- ]]; then
+                    echo "unknown argument: $1" >&2
+                    return 1
+                fi
+                if [ -n "$in_dir" ]; then
+                    echo "too many arguments: $1 (already have $in_dir)" >&2
+                    return 1
+                fi
+                in_dir="$1"
+                shift
+                ;;
+        esac
+    done
+
+    if [ -z "${in_dir}" ]; then
+        echo "input-dir argument is required" >&2
+        return 1
+    fi
+    if [ -z "${out_dir}" ]; then
+        echo "--output-dir is required" >&2
+        return 1
+    fi
+    if [ -z "${out_pkg}" ]; then
+        echo "--output-pkg is required" >&2
+        return 1
+    fi
+
+    local new_report
+    new_report="$(mktemp -t "$(basename "$0").api_violations.XXXXXX")"
+    if [ -n "${update_report}" ]; then
+        new_report="${report}"
+    fi
+
+    (
+        # To support running this from anywhere, first cd into this directory,
+        # and then install with forced module mode on and fully qualified name.
+        cd "${KUBE_CODEGEN_ROOT}"
+        BINS=(
+            openapi-gen"${CODEGEN_VERSION_SPEC}"
+        )
+        # shellcheck disable=2046 # printf word-splitting is intentional
+        GO111MODULE=on go install $(printf "k8s.io/kube-openapi/cmd/%s " "${BINS[@]}")
+    )
+
+    local input_pkgs=( "${extra_pkgs[@]:+"${extra_pkgs[@]}"}")
+    while read -r dir; do
+        pkg="$(cd "${dir}" && GO111MODULE=on go list -find .)"
+        input_pkgs+=("${pkg}")
+    done < <(
+        ( kube::codegen::internal::grep -l --null \
+            -e '^\s*//\s*+k8s:openapi' \
+            -r "${in_dir}" \
+            --include '*.go' \
+            || true \
+        ) | while read -r -d $'\0' F; do dirname "${F}"; done \
+          | LC_ALL=C sort -u
+    )
+
+    if [ "${#input_pkgs[@]}" != 0 ]; then
+        echo "Generating openapi code for ${#input_pkgs[@]} targets"
+
+        kube::codegen::internal::findz \
+            "${in_dir}" \
+            -type f \
+            -name zz_generated.openapi.go \
+            | xargs -0 rm -f
+
+        local readonly_args=()
+        for pkg in "${KUBE_CODEGEN_READONLY_PKGS[@]}"; do
+            readonly_args+=("--readonly-pkg" "${pkg}")
+        done
+        # These apimachinery packages are passed as explicit inputs
+        # because they contain types referenced by most API types
+        # (e.g. ObjectMeta, Quantity). openapi-gen needs them for
+        # type resolution even though they are not in the caller's
+        # input directory.
+        "${GOBIN}/openapi-gen" \
+            -v "${v}" \
+            --output-file zz_generated.openapi.go \
+            --go-header-file "${boilerplate}" \
+            --output-dir "${out_dir}" \
+            --output-pkg "${out_pkg}" \
+            --report-filename "${new_report}" \
+            --output-model-name-file="${output_model_name_file}" \
+            "${readonly_args[@]}" \
+            "k8s.io/apimachinery/pkg/apis/meta/v1" \
+            "k8s.io/apimachinery/pkg/runtime" \
+            "k8s.io/apimachinery/pkg/version" \
+            "k8s.io/apimachinery/pkg/api/resource" \
+            "${input_pkgs[@]}"
+    fi
+
+    if [ ! -e "${report}" ]; then
+        touch "${report}" # in case it doesn't exist yet
+    fi
+
+    if ! diff -u "${report}" "${new_report}"; then
+        echo -e "ERROR:"
+        echo -e "\tAPI rule check failed for ${report}: new reported violations"
+        echo -e "\tPlease read api/api-rules/README.md"
+        return 1
+    fi
+}
+
+# Generate client code
+#
+# USAGE: kube::codegen::gen_client [FLAGS] <input-dir>
+#
+# <input-dir>
+#   The root package under which to search for Go files which request clients
+#   to be generated. This must be a local path, not a Go package.
+#
+#   See note at the top about package structure below that.
+#
+# FLAGS:
+#   --one-input-api <string>
+#     A specific API (a directory) under the input-dir for which to generate a
+#     client.  If this is not set, clients for all APIs under the input-dir
+#     will be generated (under the --output-pkg).
+#
+#   --output-dir <string>
+#     The root directory under which to emit code.  Each aspect of client
+#     generation will make one or more subdirectories.
+#
+#   --output-pkg <string>
+#     The Go package path (import path) of the --output-dir.  Each aspect of
+#     client generation will make one or more sub-packages.
+#
+#   --boilerplate <string = path_to_kube_codegen_boilerplate>
+#     An optional override for the header file to insert into generated files.
+#
+#   --clientset-name <string = "clientset">
+#     An optional override for the leaf name of the generated "clientset" directory.
+#
+#   --versioned-name <string = "versioned">
+#     An optional override for the leaf name of the generated
+#     "<clientset>/versioned" directory.
+#
+#   --with-applyconfig
+#     Enables generation of applyconfiguration files.
+#
+#   --applyconfig-name <string = "applyconfiguration">
+#     An optional override for the leaf name of the generated "applyconfiguration" directory.
+#
+#   --applyconfig-externals <string = "">
+#     An optional list of comma separated external apply configurations locations
+#     in <type-package>.<type-name>:<applyconfiguration-package> form.
+#
+#   --with-watch
+#     Enables generation of listers and informers for APIs which support WATCH.
+#
+#   --listers-name <string = "listers">
+#     An optional override for the leaf name of the generated "listers" directory.
+#
+#   --informers-name <string = "informers">
+#     An optional override for the leaf name of the generated "informers" directory.
+#
+#   --plural-exceptions <string = "">
+#     An optional list of comma separated plural exception definitions in Type:PluralizedType form.
+#
+#   --prefers-protobuf
+#     Enables generation of clientsets that use protobuf for API requests.
+#
+#   --lint-rules <string>
+#     An optional comma-separated list of lint rules to enable on the
+#     generators. See the --lint-rules flag on the individual generators for
+#     supported values (e.g. "known-tags-only,require-explicit-disablement").
+#
+function kube::codegen::gen_client() {
+    local in_dir=""
+    local one_input_api=""
+    local out_dir=""
+    local out_pkg=""
+    local clientset_subdir="clientset"
+    local clientset_versioned_name="versioned"
+    local applyconfig="false"
+    local applyconfig_subdir="applyconfiguration"
+    local applyconfig_external=""
+    local applyconfig_openapi_schema=""
+    local watchable="false"
+    local listers_subdir="listers"
+    local informers_subdir="informers"
+    local boilerplate="${KUBE_CODEGEN_ROOT}/hack/boilerplate.go.txt"
+    local plural_exceptions=""
+    local v="${KUBE_VERBOSE:-0}"
+    local prefers_protobuf="false"
+    local lint_rules=""
+
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            "--one-input-api")
+                one_input_api="/$2"
+                shift 2
+                ;;
+            "--output-dir")
+                out_dir="$2"
+                shift 2
+                ;;
+            "--output-pkg")
+                out_pkg="$2"
+                shift 2
+                ;;
+            "--boilerplate")
+                boilerplate="$2"
+                shift 2
+                ;;
+            "--clientset-name")
+                clientset_subdir="$2"
+                shift 2
+                ;;
+            "--versioned-name")
+                clientset_versioned_name="$2"
+                shift 2
+                ;;
+            "--with-applyconfig")
+                applyconfig="true"
+                shift
+                ;;
+            "--applyconfig-name")
+                applyconfig_subdir="$2"
+                shift 2
+                ;;
+            "--applyconfig-externals")
+                applyconfig_external="$2"
+                shift 2
+                ;;
+            "--applyconfig-openapi-schema")
+                applyconfig_openapi_schema="$2"
+                shift 2
+                ;;
+            "--with-watch")
+                watchable="true"
+                shift
+                ;;
+            "--listers-name")
+                listers_subdir="$2"
+                shift 2
+                ;;
+            "--informers-name")
+                informers_subdir="$2"
+                shift 2
+                ;;
+            "--plural-exceptions")
+                plural_exceptions="$2"
+                shift 2
+                ;;
+            "--prefers-protobuf")
+                prefers_protobuf="true"
+                shift
+                ;;
+            "--lint-rules")
+                lint_rules="$2"
+                shift 2
+                ;;
+            *)
+                if [[ "$1" =~ ^-- ]]; then
+                    echo "unknown argument: $1" >&2
+                    return 1
+                fi
+                if [ -n "$in_dir" ]; then
+                    echo "too many arguments: $1 (already have $in_dir)" >&2
+                    return 1
+                fi
+                in_dir="$1"
+                shift
+                ;;
+        esac
+    done
+
+    if [ -z "${in_dir}" ]; then
+        echo "input-dir argument is required" >&2
+        return 1
+    fi
+    if [ -z "${out_dir}" ]; then
+        echo "--output-dir is required" >&2
+        return 1
+    fi
+    if [ -z "${out_pkg}" ]; then
+        echo "--output-pkg is required" >&2
+    fi
+
+    local lint_args=()
+    if [ -n "${lint_rules}" ]; then
+        lint_args+=("--lint-rules" "${lint_rules}")
+    fi
+
+    mkdir -p "${out_dir}"
+
+    (
+        # To support running this from anywhere, first cd into this directory,
+        # and then install with forced module mode on and fully qualified name.
+        cd "${KUBE_CODEGEN_ROOT}"
+        BINS=(
+            applyconfiguration-gen"${CODEGEN_VERSION_SPEC}"
+            client-gen"${CODEGEN_VERSION_SPEC}"
+            informer-gen"${CODEGEN_VERSION_SPEC}"
+            lister-gen"${CODEGEN_VERSION_SPEC}"
+        )
+        # shellcheck disable=2046 # printf word-splitting is intentional
+        GO111MODULE=on go install $(printf "k8s.io/code-generator/cmd/%s " "${BINS[@]}")
+    )
+
+    local group_versions=()
+    local input_pkgs=()
+    while read -r dir; do
+        pkg="$(cd "${dir}" && GO111MODULE=on go list -find .)"
+        leaf="$(basename "${dir}")"
+        if grep -E -q '^v[0-9]+((alpha|beta)[0-9]+)?$' <<< "${leaf}"; then
+            input_pkgs+=("${pkg}")
+
+            dir2="$(dirname "${dir}")"
+            leaf2="$(basename "${dir2}")"
+            group_versions+=("${leaf2}/${leaf}")
+        fi
+    done < <(
+        ( kube::codegen::internal::grep -l --null \
+            -e '^\s*//\s*+genclient' \
+            -r "${in_dir}${one_input_api}" \
+            --include '*.go' \
+            || true \
+        ) | while read -r -d $'\0' F; do dirname "${F}"; done \
+          | LC_ALL=C sort -u
+    )
+
+    if [ "${#group_versions[@]}" == 0 ]; then
+        return 0
+    fi
+
+    applyconfig_pkg="" # set this for later use, iff enabled
+    if [ "${applyconfig}" == "true" ]; then
+        applyconfig_pkg="${out_pkg}/${applyconfig_subdir}"
+
+        echo "Generating applyconfig code for ${#input_pkgs[@]} targets"
+
+        ( kube::codegen::internal::grep -l --null \
+            -e '^// Code generated by applyconfiguration-gen. DO NOT EDIT.$' \
+            -r "${out_dir}/${applyconfig_subdir}" \
+            --include '*.go' \
+            || true \
+        ) | xargs -0 rm -f
+
+        "${GOBIN}/applyconfiguration-gen" \
+            -v "${v}" \
+            --go-header-file "${boilerplate}" \
+            --output-dir "${out_dir}/${applyconfig_subdir}" \
+            --output-pkg "${applyconfig_pkg}" \
+            --external-applyconfigurations "${applyconfig_external}" \
+            --openapi-schema "${applyconfig_openapi_schema}" \
+            "${lint_args[@]:+"${lint_args[@]}"}" \
+            "${input_pkgs[@]}"
+    fi
+
+    echo "Generating client code for ${#group_versions[@]} targets"
+
+    ( kube::codegen::internal::grep -l --null \
+        -e '^// Code generated by client-gen. DO NOT EDIT.$' \
+        -r "${out_dir}/${clientset_subdir}" \
+        --include '*.go' \
+        || true \
+    ) | xargs -0 rm -f
+
+    local inputs=()
+    for arg in "${group_versions[@]}"; do
+        inputs+=("--input" "$arg")
+    done
+     "${GOBIN}/client-gen" \
+        -v "${v}" \
+        --go-header-file "${boilerplate}" \
+        --output-dir "${out_dir}/${clientset_subdir}" \
+        --output-pkg "${out_pkg}/${clientset_subdir}" \
+        --clientset-name "${clientset_versioned_name}" \
+        --apply-configuration-package "${applyconfig_pkg}" \
+        --input-base "$(cd "${in_dir}" && pwd -P)" `# must be absolute path or Go import path"` \
+        --plural-exceptions "${plural_exceptions}" \
+        --prefers-protobuf="${prefers_protobuf}" \
+        "${lint_args[@]:+"${lint_args[@]}"}" \
+        "${inputs[@]}"
+
+    if [ "${watchable}" == "true" ]; then
+        echo "Generating lister code for ${#input_pkgs[@]} targets"
+
+        ( kube::codegen::internal::grep -l --null \
+            -e '^// Code generated by lister-gen. DO NOT EDIT.$' \
+            -r "${out_dir}/${listers_subdir}" \
+            --include '*.go' \
+            || true \
+        ) | xargs -0 rm -f
+
+        "${GOBIN}/lister-gen" \
+            -v "${v}" \
+            --go-header-file "${boilerplate}" \
+            --output-dir "${out_dir}/${listers_subdir}" \
+            --output-pkg "${out_pkg}/${listers_subdir}" \
+            --plural-exceptions "${plural_exceptions}" \
+            "${lint_args[@]:+"${lint_args[@]}"}" \
+            "${input_pkgs[@]}"
+
+        echo "Generating informer code for ${#input_pkgs[@]} targets"
+
+        ( kube::codegen::internal::grep -l --null \
+            -e '^// Code generated by informer-gen. DO NOT EDIT.$' \
+            -r "${out_dir}/${informers_subdir}" \
+            --include '*.go' \
+            || true \
+        ) | xargs -0 rm -f
+
+        "${GOBIN}/informer-gen" \
+            -v "${v}" \
+            --go-header-file "${boilerplate}" \
+            --output-dir "${out_dir}/${informers_subdir}" \
+            --output-pkg "${out_pkg}/${informers_subdir}" \
+            --versioned-clientset-package "${out_pkg}/${clientset_subdir}/${clientset_versioned_name}" \
+            --listers-package "${out_pkg}/${listers_subdir}" \
+            --plural-exceptions "${plural_exceptions}" \
+            "${lint_args[@]:+"${lint_args[@]}"}" \
+            "${input_pkgs[@]}"
+    fi
+}
+
+# Generate register code
+#
+# USAGE: kube::codegen::gen_register [FLAGS] <input-dir>
+#
+# <input-dir>
+#   The root directory under which to search for Go files which request code to
+#   be generated.  This must be a local path, not a Go package.
+#
+#   See note at the top about package structure below that.
+#
+# FLAGS:
+#
+#   --boilerplate <string = path_to_kube_codegen_boilerplate>
+#     An optional override for the header file to insert into generated files.
+#
+#   --lint-rules <string>
+#     An optional comma-separated list of lint rules to enable on the
+#     generator. See register-gen's --lint-rules flag for supported values.
+#
+function kube::codegen::gen_register() {
+    local in_dir=""
+    local boilerplate="${KUBE_CODEGEN_ROOT}/hack/boilerplate.go.txt"
+    local v="${KUBE_VERBOSE:-0}"
+    local lint_rules=""
+
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            "--boilerplate")
+                boilerplate="$2"
+                shift 2
+                ;;
+            "--lint-rules")
+                lint_rules="$2"
+                shift 2
+                ;;
+            *)
+                if [[ "$1" =~ ^-- ]]; then
+                    echo "unknown argument: $1" >&2
+                    return 1
+                fi
+                if [ -n "$in_dir" ]; then
+                    echo "too many arguments: $1 (already have $in_dir)" >&2
+                    return 1
+                fi
+                in_dir="$1"
+                shift
+                ;;
+        esac
+    done
+
+    if [ -z "${in_dir}" ]; then
+        echo "input-dir argument is required" >&2
+        return 1
+    fi
+
+    local lint_args=()
+    if [ -n "${lint_rules}" ]; then
+        lint_args+=("--lint-rules" "${lint_rules}")
+    fi
+
+    (
+        # To support running this from anywhere, first cd into this directory,
+        # and then install with forced module mode on and fully qualified name.
+        cd "${KUBE_CODEGEN_ROOT}"
+        BINS=(
+            register-gen"${CODEGEN_VERSION_SPEC}"
+        )
+        # shellcheck disable=2046 # printf word-splitting is intentional
+        GO111MODULE=on go install $(printf "k8s.io/code-generator/cmd/%s " "${BINS[@]}")
+    )
+
+    # Register
+    #
+    local input_pkgs=()
+    while read -r dir; do
+        pkg="$(cd "${dir}" && GO111MODULE=on go list -find .)"
+        input_pkgs+=("${pkg}")
+    done < <(
+        ( kube::codegen::internal::grep -l --null \
+            -e '^\s*//\s*+groupName' \
+            -r "${in_dir}" \
+            --include '*.go' \
+            || true \
+        ) | while read -r -d $'\0' F; do dirname "${F}"; done \
+          | LC_ALL=C sort -u
+    )
+
+    if [ "${#input_pkgs[@]}" != 0 ]; then
+        echo "Generating register code for ${#input_pkgs[@]} targets"
+
+        kube::codegen::internal::findz \
+            "${in_dir}" \
+            -type f \
+            -name zz_generated.register.go \
+            | xargs -0 rm -f
+
+        "${GOBIN}/register-gen" \
+            -v "${v}" \
+            --output-file zz_generated.register.go \
+            --go-header-file "${boilerplate}" \
+            "${lint_args[@]:+"${lint_args[@]}"}" \
+            "${input_pkgs[@]}"
+    fi
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/activation.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/activation.go
new file mode 100644
index 0000000000..3ae0ce3aee
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/activation.go
@@ -0,0 +1,187 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apidefinitions
+
+import (
+	"fmt"
+	"strings"
+
+	"k8s.io/gengo/v2/types"
+)
+
+// Activation represents the data extracted from an API package's
+// doc.go that control the activation of a generator.
+type Activation struct {
+	// spec is the generator specification this activation applies to.
+	spec Spec
+	// shouldGenerate reports if the spec generator should be run
+	// for the package.
+	shouldGenerate bool
+
+	// typeFilers is only set if the spec's ValueMode is TypeFilterList
+	typeFilters []string
+
+	// externalTypes provides a full import path to the external types.
+	externalTypes string
+
+	// Conversion specific:
+	// explicitOnly indicates that conversion is configured to only
+	// generate conversion for explicitly tagged types.
+	explicitOnly bool
+	// peerPackages provides the conversion peer package list.
+	peerPackages []string
+}
+
+// ShouldGenerate reports whether the generator should run on the
+// package. It unifies all activation paths: explicit ActivationTag
+// value, =false opt-out, +<GroupActivationTag> fallback, and ScanTypes
+// type-level fallback. Generators with ValueMode ConversionPeerList
+// also generate when ActivationTag is "false" (in explicit-only mode);
+// use IsExplicitOnly to disambiguate.
+func (a *Activation) ShouldGenerate() bool { return a.shouldGenerate }
+
+// TypeFilters returns the type name patterns the generator should
+// process.
+func (a *Activation) TypeFilters() []string { return a.typeFilters }
+
+// ExternalTypes returns a full import path to the external types.
+func (a *Activation) ExternalTypes() string { return a.externalTypes }
+
+// PeerPackages returns the conversion peer package list.
+func (a *Activation) PeerPackages() []string { return a.peerPackages }
+
+// IsExplicitOnly reports whether conversion-gen should run in
+// explicit-only mode (emit conversions only for explicitly tagged
+// types). Set when +k8s:conversion-gen=false; ONLY meaningful for
+// generators using ConversionPeerList.
+func (a *Activation) IsExplicitOnly() bool { return a.explicitOnly }
+
+// Identify extracts data from pkg's doc.go for the generator described
+// by spec.
+func Identify(pkg *types.Package, spec Spec, opts ...Option) (*Activation, error) {
+	var st identifyState
+	for _, opt := range opts {
+		opt(&st)
+	}
+	if err := applyLintRules(&st, pkg); err != nil {
+		return nil, err
+	}
+	a := &Activation{spec: spec}
+	if pkg == nil {
+		return a, nil
+	}
+	values, optedOut, err := extractGeneratorTag(pkg.Comments, spec.ActivationTag)
+	if err != nil {
+		return nil, err
+	}
+	enabled := !optedOut && len(values) > 0
+	switch spec.ValueMode {
+	case ConversionPeerList:
+		for _, v := range values {
+			if err := checkRelativeImportPath(spec.ActivationTag, v); err != nil {
+				return nil, err
+			}
+		}
+		a.peerPackages = values
+		a.explicitOnly = optedOut
+	case TypeFilterList:
+		a.typeFilters = values
+	}
+	a.externalTypes, err = resolveExternalTypes(pkg, spec)
+	if err != nil {
+		return nil, err
+	}
+
+	switch {
+	case enabled:
+		a.shouldGenerate = true
+	case optedOut:
+		// Only for ConversionPeerList can is generation still needed.
+		// This is to handle the explicit-only mode of conversion-gen.
+		a.shouldGenerate = spec.ValueMode == ConversionPeerList
+	case spec.DefaultEnabled:
+		a.shouldGenerate = true
+	case isGroupActivated(pkg, spec):
+		a.shouldGenerate = true
+	case spec.ScanTypes:
+		a.shouldGenerate = scanTypesForActivation(pkg, spec.ActivationTag)
+	}
+	return a, nil
+}
+
+func isGroupActivated(pkg *types.Package, spec Spec) bool {
+	if len(spec.GroupActivationTag) > 0 {
+		if vals, _ := tagValues(pkg.Comments, spec.GroupActivationTag); len(vals) > 0 {
+			return true
+		}
+	}
+	return false
+}
+
+// scanTypesForActivation reports whether any type in pkg has a
+// type-level +<tagName>=<non-false> tag. This implements ScanTypes
+// activation check.
+func scanTypesForActivation(pkg *types.Package, tagName string) bool {
+	if tagName == "" {
+		return false
+	}
+	for _, t := range pkg.Types {
+		lines := append(append([]string{}, t.CommentLines...), t.SecondClosestCommentLines...)
+		vals, err := tagValues(lines, tagName)
+		if err != nil {
+			continue
+		}
+		for _, v := range vals {
+			if v != "false" {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// resolveExternalTypes returns the value of pkg's +<spec.InputTag> if
+// present, or pkg.Path otherwise. Multiple values for the input tag is
+// an error.
+func resolveExternalTypes(pkg *types.Package, spec Spec) (string, error) {
+	if spec.InputTag == "" {
+		return pkg.Path, nil
+	}
+	values, err := tagValues(pkg.Comments, spec.InputTag)
+	if err != nil {
+		return "", err
+	}
+	switch len(values) {
+	case 0:
+		return pkg.Path, nil
+	case 1:
+		if err := checkRelativeImportPath(spec.InputTag, values[0]); err != nil {
+			return "", err
+		}
+		return values[0], nil
+	default:
+		return "", fmt.Errorf("+%s: expected at most one value, got %v", spec.InputTag, values)
+	}
+}
+
+// checkRelativeImportPath checks if the path is a relative path and returns an error if so
+func checkRelativeImportPath(tagName, path string) error {
+	if strings.HasPrefix(path, "./") || strings.HasPrefix(path, "../") {
+		return fmt.Errorf("+%s: relative path %q is not supported; use the full package import path", tagName, path)
+	}
+	return nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/activation_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/activation_test.go
new file mode 100644
index 0000000000..c4d35d8d5f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/activation_test.go
@@ -0,0 +1,329 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apidefinitions
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"k8s.io/gengo/v2/types"
+)
+
+// TestIdentify code generator identification of API defining packages.
+func TestIdentify(t *testing.T) {
+	cases := []struct {
+		name               string
+		spec               Spec
+		comments           []string
+		wantShouldGenerate bool
+		wantExplicitOnly   bool
+		wantValues         []string // checked via spec-appropriate accessor when applicable
+		wantErr            string
+	}{
+		{
+			name: "no tag, target inactive",
+			spec: Conversion,
+		},
+		{
+			name:     "different tag present, this tag inactive",
+			spec:     Conversion,
+			comments: []string{"+k8s:defaulter-gen=TypeMeta"},
+		},
+		{
+			name:               "single peer pkg activates conversion-gen",
+			spec:               Conversion,
+			comments:           []string{"+k8s:conversion-gen=k8s.io/api/foo"},
+			wantShouldGenerate: true,
+			wantValues:         []string{"k8s.io/api/foo"},
+		},
+		{
+			name: "extensions/v1beta1 5-peer pattern",
+			spec: Conversion,
+			comments: []string{
+				"+k8s:conversion-gen=k8s.io/kubernetes/pkg/apis/apps",
+				"+k8s:conversion-gen=k8s.io/kubernetes/pkg/apis/policy",
+				"+k8s:conversion-gen=k8s.io/kubernetes/pkg/apis/networking",
+				"+k8s:conversion-gen=k8s.io/kubernetes/pkg/apis/extensions",
+				"+k8s:conversion-gen=k8s.io/kubernetes/pkg/apis/autoscaling",
+			},
+			wantShouldGenerate: true,
+			wantValues: []string{
+				"k8s.io/kubernetes/pkg/apis/apps",
+				"k8s.io/kubernetes/pkg/apis/policy",
+				"k8s.io/kubernetes/pkg/apis/networking",
+				"k8s.io/kubernetes/pkg/apis/extensions",
+				"k8s.io/kubernetes/pkg/apis/autoscaling",
+			},
+		},
+		{
+			name:               "defaulter-gen=TypeMeta activates",
+			spec:               Defaulter,
+			comments:           []string{"+k8s:defaulter-gen=TypeMeta"},
+			wantShouldGenerate: true,
+			wantValues:         []string{"TypeMeta"},
+		},
+		{
+			name:               "validation-gen=TypesWithField=TypeMeta activates",
+			spec:               Validation,
+			comments:           []string{"+k8s:validation-gen=TypesWithField=TypeMeta"},
+			wantShouldGenerate: true,
+			wantValues:         []string{"TypesWithField=TypeMeta"},
+		},
+		{
+			name:               "prerelease-lifecycle-gen=true activates",
+			spec:               PrereleaseLifecycle,
+			comments:           []string{"+k8s:prerelease-lifecycle-gen=true"},
+			wantShouldGenerate: true,
+		},
+		{
+			name:               "conversion-gen=false runs in explicit-only mode",
+			spec:               Conversion,
+			comments:           []string{"+k8s:conversion-gen=false"},
+			wantShouldGenerate: true,
+			wantExplicitOnly:   true,
+		},
+		{
+			name:     "defaulter-gen=false opts out",
+			spec:     Defaulter,
+			comments: []string{"+k8s:defaulter-gen=false"},
+		},
+		{
+			name:     "prerelease-lifecycle-gen=false opts out",
+			spec:     PrereleaseLifecycle,
+			comments: []string{"+k8s:prerelease-lifecycle-gen=false"},
+		},
+		{
+			name: "=false mixed with peer pkg is rejected",
+			spec: Conversion,
+			comments: []string{
+				"+k8s:conversion-gen=k8s.io/api/extensions/v1beta1",
+				"+k8s:conversion-gen=false",
+			},
+			wantErr: `cannot mix "false"`,
+		},
+		{
+			name: "repeated identical peer is allowed and preserved",
+			spec: Conversion,
+			comments: []string{
+				"+k8s:conversion-gen=k8s.io/api/foo",
+				"+k8s:conversion-gen=k8s.io/api/foo",
+			},
+			wantShouldGenerate: true,
+			wantValues:         []string{"k8s.io/api/foo", "k8s.io/api/foo"},
+		},
+		{
+			name: "unknown -gen tag fails validation",
+			spec: Conversion,
+			comments: []string{
+				"+k8s:conversion-gen=k8s.io/api/foo",
+				"+k8s:bogus-gen=value",
+			},
+			wantErr: "+k8s:bogus-gen",
+		},
+		{
+			name:     "relative peer package is rejected",
+			spec:     Conversion,
+			comments: []string{"+k8s:conversion-gen=./peer"},
+			wantErr:  "relative path",
+		},
+		{
+			name: "typo in known generator name fails validation",
+			spec: Conversion,
+			comments: []string{
+				"+k8s:conversion-x-gen=k8s.io/api/foo",
+			},
+			wantErr: "+k8s:conversion-x-gen",
+		},
+		{
+			name: "non-generator +k8s: tag passes validation untouched",
+			spec: Validation,
+			comments: []string{
+				"+k8s:validation-gen=TypesWithField=TypeMeta",
+				"+k8s:validateFalse=field",
+			},
+			wantShouldGenerate: true,
+			wantValues:         []string{"TypesWithField=TypeMeta"},
+		},
+		{
+			name: "subtagged generator tag is recognized by its base",
+			spec: PrereleaseLifecycle,
+			comments: []string{
+				"+k8s:prerelease-lifecycle-gen=true",
+				"+k8s:prerelease-lifecycle-gen:introduced=1.30",
+			},
+			wantShouldGenerate: true,
+		},
+		{
+			name: "all recognized -gen tags coexist",
+			spec: Conversion,
+			comments: []string{
+				"+k8s:conversion-gen=k8s.io/api/foo",
+				"+k8s:conversion-gen-external-types=k8s.io/api/foo/v1",
+				"+k8s:defaulter-gen=TypeMeta",
+				"+k8s:defaulter-gen-input=k8s.io/api/foo/v1",
+				"+k8s:validation-gen=TypesWithField=TypeMeta",
+				"+k8s:validation-gen-input=k8s.io/api/foo/v1",
+				"+k8s:validation-gen-deep-equal-func=foo",
+				"+k8s:validation-gen-nolint",
+				"+k8s:validation-gen-scheme-registry=foo",
+				"+k8s:validation-gen-test-fixture=bar",
+				"+k8s:prerelease-lifecycle-gen=true",
+				"+k8s:deepcopy-gen=package",
+				"+k8s:register-gen=true",
+				"+k8s:openapi-gen=true",
+				"+k8s:protobuf-gen=package",
+			},
+			wantShouldGenerate: true,
+			wantValues:         []string{"k8s.io/api/foo"},
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			pkg := &types.Package{Path: "test/pkg", Dir: "/tmp/test", Comments: tc.comments}
+			info, err := Identify(pkg, tc.spec, WithLintRules(LintRuleKnownTagsOnly))
+			if tc.wantErr != "" {
+				if err == nil {
+					t.Fatalf("err = nil, want substring %q", tc.wantErr)
+				}
+				if !strings.Contains(err.Error(), tc.wantErr) {
+					t.Errorf("err = %q, want substring %q", err, tc.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("err = %v, want nil", err)
+			}
+			if got := info.ShouldGenerate(); got != tc.wantShouldGenerate {
+				t.Errorf("ShouldGenerate = %v, want %v", got, tc.wantShouldGenerate)
+			}
+			if got := info.IsExplicitOnly(); got != tc.wantExplicitOnly {
+				t.Errorf("IsExplicitOnly = %v, want %v", got, tc.wantExplicitOnly)
+			}
+			switch tc.spec.ValueMode {
+			case ConversionPeerList:
+				if got := info.PeerPackages(); !reflect.DeepEqual(got, tc.wantValues) {
+					t.Errorf("PeerPackages = %v, want %v", got, tc.wantValues)
+				}
+			case TypeFilterList:
+				if got := info.TypeFilters(); !reflect.DeepEqual(got, tc.wantValues) {
+					t.Errorf("TypeFilters = %v, want %v", got, tc.wantValues)
+				}
+			}
+		})
+	}
+}
+
+func TestExternalTypes(t *testing.T) {
+	const ownPath = "k8s.io/kubernetes/pkg/apis/apps/v1"
+	cases := []struct {
+		name     string
+		spec     Spec
+		comments []string
+		want     string
+		wantErr  string
+	}{
+		{
+			name: "no input tag: own path",
+			spec: Conversion,
+			want: ownPath,
+		},
+		{
+			name:     "conversion: external-types tag",
+			spec:     Conversion,
+			comments: []string{"+k8s:conversion-gen-external-types=k8s.io/api/apps/v1"},
+			want:     "k8s.io/api/apps/v1",
+		},
+		{
+			name:     "defaulter: input tag",
+			spec:     Defaulter,
+			comments: []string{"+k8s:defaulter-gen-input=k8s.io/api/apps/v1"},
+			want:     "k8s.io/api/apps/v1",
+		},
+		{
+			name:     "validation: input tag",
+			spec:     Validation,
+			comments: []string{"+k8s:validation-gen-input=k8s.io/api/apps/v1"},
+			want:     "k8s.io/api/apps/v1",
+		},
+		{
+			name: "conversion ignores other generators' input tags",
+			spec: Conversion,
+			comments: []string{
+				"+k8s:defaulter-gen-input=k8s.io/api/apps/v2",
+				"+k8s:validation-gen-input=k8s.io/api/apps/v3",
+			},
+			want: ownPath,
+		},
+		{
+			name: "Boolean spec returns own path regardless of input tags",
+			spec: PrereleaseLifecycle,
+			comments: []string{
+				"+k8s:defaulter-gen-input=k8s.io/api/apps/v2",
+			},
+			want: ownPath,
+		},
+		{
+			name: "multiple values for same tag is an error",
+			spec: Conversion,
+			comments: []string{
+				"+k8s:conversion-gen-external-types=k8s.io/api/apps/v1",
+				"+k8s:conversion-gen-external-types=k8s.io/api/apps/v2",
+			},
+			wantErr: "expected at most one value",
+		},
+		{
+			name:     "relative input path is rejected",
+			spec:     Validation,
+			comments: []string{"+k8s:validation-gen-input=./types"},
+			wantErr:  "relative path",
+		},
+		{
+			name:     "parent-relative input path is rejected",
+			spec:     Defaulter,
+			comments: []string{"+k8s:defaulter-gen-input=../foo/v1"},
+			wantErr:  "relative path",
+		},
+		{
+			name:     "relative external-types path is rejected",
+			spec:     Conversion,
+			comments: []string{"+k8s:conversion-gen-external-types=./types"},
+			wantErr:  "relative path",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			pkg := &types.Package{Path: ownPath, Comments: tc.comments}
+			tgt, err := Identify(pkg, tc.spec)
+			if tc.wantErr != "" {
+				if err == nil {
+					t.Fatalf("err = nil, want substring %q", tc.wantErr)
+				}
+				if !strings.Contains(err.Error(), tc.wantErr) {
+					t.Errorf("err = %q, want substring %q", err, tc.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("err = %v, want nil", err)
+			}
+			if got := tgt.ExternalTypes(); got != tc.want {
+				t.Errorf("ExternalTypes = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/lint.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/lint.go
new file mode 100644
index 0000000000..2fb16fddc9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/lint.go
@@ -0,0 +1,330 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apidefinitions
+
+import (
+	"errors"
+	"fmt"
+	"path"
+	"reflect"
+	"regexp"
+	"slices"
+	"sort"
+	"strings"
+
+	"github.com/spf13/pflag"
+
+	"k8s.io/gengo/v2/codetags"
+	"k8s.io/gengo/v2/types"
+)
+
+const (
+	// LintRuleKnownTagsOnly rejects any +k8s: tag in the package
+	// that are not recognized as a known Kubernetes tag.
+	LintRuleKnownTagsOnly = "known-tags-only"
+
+	// LintRuleExplicitDisablement requires that all generators
+	// either be enabled API definition packages where the
+	// generator is typically needed, or that a tag is used
+	// to disable the generator explicitly.
+	// When set, this prevents generators from being accidentally
+	// omitted in API definition packages where they are typically
+	// needed.
+	LintRuleExplicitDisablement = "require-explicit-disablement"
+)
+
+// Option provides configuration options for package identification.
+type Option func(*identifyState)
+
+type identifyState struct {
+	lintRules []string
+}
+
+// WithLintRules enables one or more tag-checking lint rules.
+func WithLintRules(names ...string) Option {
+	return func(s *identifyState) {
+		if s.lintRules == nil {
+			s.lintRules = append(s.lintRules, names...)
+		}
+	}
+}
+
+type LintArgs struct {
+	// LintRules names tag-checking lint rules to enable; see
+	// apipkg.LintRule* constants for the supported names. Off by
+	// default to preserve backward compatibility with third-party generator tags.
+	LintRules []string
+}
+
+var allLintRules = []string{LintRuleKnownTagsOnly, LintRuleExplicitDisablement}
+
+func AddFlags(args *LintArgs, fs *pflag.FlagSet) {
+	supportedLinters := allLintRules
+	fs.StringSliceVar(&args.LintRules, "lint-rules", args.LintRules,
+		fmt.Sprintf("Comma-separated list of tag-checking lint rules to enable. Supports: %s",
+			strings.Join(supportedLinters, ",")))
+}
+
+func ValidateFlags(lintRules []string) error {
+	for _, rule := range lintRules {
+		if !slices.Contains(allLintRules, rule) {
+			return fmt.Errorf("unrecognized rule in --lint-rules: %s", rule)
+		}
+	}
+	return nil
+}
+
+func applyLintRules(st *identifyState, pkg *types.Package) error {
+	for _, rule := range st.lintRules {
+		switch rule {
+		case LintRuleKnownTagsOnly:
+			if err := checkKnownTags(pkg); err != nil {
+				return err
+			}
+		case LintRuleExplicitDisablement:
+			if err := checkExplicitDisablement(pkg); err != nil {
+				return err
+			}
+		default:
+			return fmt.Errorf("unrecognized lint-rule: %s", rule)
+		}
+	}
+	return nil
+}
+
+// checkKnownTags enforces LintRuleKnownTagsOnly. It only checks tags
+// in the +k8s:*-gen[...] family; non-generator +k8s: tags pass
+// through untouched.
+func checkKnownTags(pkg *types.Package) error {
+	if pkg == nil {
+		return nil
+	}
+	var unknown []string
+	for name := range codetags.Extract("+", pkg.Comments) {
+		if !strings.HasPrefix(name, "k8s:") || !strings.Contains(name, "-gen") {
+			continue
+		}
+		base := name
+		if i := strings.Index(name[len("k8s:"):], ":"); i >= 0 {
+			base = name[:len("k8s:")+i]
+		}
+		if !allKnownTags.Has(base) {
+			unknown = append(unknown, "+"+name)
+		}
+	}
+	if len(unknown) == 0 {
+		return nil
+	}
+
+	sort.Strings(unknown)
+	allowed := allKnownTags.UnsortedList()
+	slices.Sort(allowed)
+	return fmt.Errorf("%s/doc.go: unrecognized +k8s: tag(s): %s\nrecognized generator tags: %s",
+		pkg.Dir, strings.Join(unknown, ", "), strings.Join(allowed, ", "))
+}
+
+// checkExplicitDisablement enforces LintRuleExplicitDisablement.
+func checkExplicitDisablement(pkg *types.Package) error {
+	if pkg == nil {
+		return nil
+	}
+	roles := classifyPackage(pkg)
+	expected := expectedGenerators(roles)
+	if len(expected) == 0 {
+		return nil
+	}
+	tagged := codetags.Extract("+", pkg.Comments)
+	var missing []Spec
+	for _, spec := range expected {
+		if _, ok := tagged[spec.ActivationTag]; !ok {
+			missing = append(missing, spec)
+		}
+	}
+	if len(missing) == 0 {
+		return nil
+	}
+	sort.Slice(missing, func(i, j int) bool { return missing[i].ActivationTag < missing[j].ActivationTag })
+
+	var sb strings.Builder
+	fmt.Fprintf(&sb, "%s/doc.go: %s.\n", pkg.Dir, roles.describePackage(pkg.Dir))
+	sb.WriteString("Set explicit configuration or disablement for these generators in doc.go:")
+	for _, spec := range missing {
+		fmt.Fprintf(&sb, "\n  +%s=<%s>", spec.ActivationTag, valueHint(spec))
+	}
+	return errors.New(sb.String())
+}
+
+// valueHint describes the accepted shape of an ActivationTag value, for
+// inclusion in user-facing errors.
+func valueHint(spec Spec) string {
+	switch spec.ValueMode {
+	case ConversionPeerList:
+		return "peer-package or false"
+	case TypeFilterList:
+		return "TypeMeta or false"
+	case Package:
+		return "package or false"
+	case Boolean:
+		return "true or false"
+	default:
+		return "value or false"
+	}
+}
+
+func expectedGenerators(roles packageRoles) []Spec {
+	var expected []Spec
+	if roles.isExternalVersion {
+		expected = append(expected, Deepcopy)
+	}
+	if roles.isInternalVersion {
+		expected = append(expected, Conversion, Defaulter, Validation)
+	}
+	return expected
+}
+
+type packageRoles struct {
+	// isExternalGroup identifies an API group package containing
+	// versioned API types (e.g. staging/src/k8s.io/api/apps).
+	isExternalGroup bool
+
+	// isInternalGroup identifies an API group package containing
+	// API type internals (e.g. pkg/apis/apps). The "internal type" (aka Hub type)
+	// often lives here.
+	isInternalGroup bool
+
+	// isExternalVersion identifies a package containing versioned API types
+	// (e.g. staging/src/k8s.io/api/apps/v1).
+	isExternalVersion bool
+
+	// isInternalVersion identifies a per-version internals package containing
+	// conversion / defaulting / validation for hub types in the parent
+	// directory (e.g. pkg/apis/apps/v1).
+	isInternalVersion bool
+}
+
+func (r packageRoles) describePackage(pkgDir string) string {
+	var parts []string
+	if r.isExternalGroup {
+		parts = append(parts, "API group package with versioned API types in subpackages")
+	}
+	if r.isInternalGroup {
+		parts = append(parts, "API group package containing hub API types")
+	}
+	if r.isExternalVersion {
+		parts = append(parts, "package containing versioned API types")
+	}
+	if r.isInternalVersion {
+		desc := "package containing per-version internals (conversion, defaulting, validation)"
+		if parent := path.Dir(pkgDir); parent != "" && parent != "." && parent != "/" {
+			desc += " for hub types at " + parent
+		}
+		parts = append(parts, desc)
+	}
+	if len(parts) == 0 {
+		return "package has no recognized API role"
+	}
+	return "this package looks like: " + strings.Join(parts, "; ")
+}
+
+// classifyPackage looks for evidence of package roles.
+//
+// This may return false negatives as there is insufficient
+// information to identify the intent of all packages.
+// For example, a package directory with no tags or types might be in
+// a directory that is expected to contain API types, but which
+// will not be detected by this function.
+//
+// This must ONLY be used for linting.
+func classifyPackage(pkg *types.Package) packageRoles {
+	// TODO: We may introduce API declaration files in package in the future.
+	// This would enable package classification that is more precise and
+	// does not require the heuristics used here.
+	if pkg == nil || !looksLikeAPIPackage(pkg) {
+		return packageRoles{}
+	}
+
+	roles := packageRoles{}
+	isVersion := isVersionPath(pkg.Path)
+	external := looksLikeExternalVersionPackage(pkg)
+	if isVersion {
+		if external {
+			roles.isExternalVersion = true
+		} else if looksLikeInternalVersionPackage(pkg) {
+			roles.isInternalVersion = true
+		}
+	} else {
+		if external {
+			roles.isExternalGroup = true
+		} else {
+			roles.isInternalGroup = true
+		}
+	}
+	return roles
+}
+
+func looksLikeAPIPackage(pkg *types.Package) bool {
+	if _, ok, _ := GroupNameForPackage(pkg.Comments); ok {
+		return true
+	}
+	for name := range codetags.Extract("+", pkg.Comments) {
+		if allKnownTags.Has(name) {
+			return true
+		}
+	}
+	return false
+}
+
+func looksLikeInternalVersionPackage(pkg *types.Package) bool {
+	raw := codetags.Extract("+", pkg.Comments)
+	for _, s := range []Spec{Defaulter, Validation} {
+		if _, ok := raw[s.ActivationTag]; ok {
+			return true
+		}
+		if s.InputTag != "" {
+			if _, ok := raw[s.InputTag]; ok {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func looksLikeExternalVersionPackage(pkg *types.Package) bool {
+	for _, t := range pkg.Types {
+		for _, m := range t.Members {
+			if m.Name == "TypeMeta" && m.Embedded {
+				tag, exists := reflect.StructTag(m.Tags).Lookup("json")
+				name := strings.Split(tag, ",")[0]
+				if exists && name == "" {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}
+
+var versionPathRE = regexp.MustCompile(`^v\d+([a-z]+\d+)?$`)
+
+// isVersionPath reports whether the trailing path segment looks like
+// an API version (v1, v1beta2, v2alpha1, ...).
+func isVersionPath(p string) bool {
+	if p == "" {
+		return false
+	}
+	return versionPathRE.MatchString(path.Base(p))
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/lint_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/lint_test.go
new file mode 100644
index 0000000000..5c11d765bb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/lint_test.go
@@ -0,0 +1,413 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apidefinitions
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"k8s.io/gengo/v2/types"
+)
+
+func TestLintRules(t *testing.T) {
+	pkg := func(path string, comments ...string) *types.Package {
+		return &types.Package{Path: path, Dir: "/tmp/" + path, Comments: comments}
+	}
+	pkgWithTypeMeta := func(path, jsonTag string, comments ...string) *types.Package {
+		return &types.Package{
+			Path: path, Dir: "/tmp/" + path, Comments: comments,
+			Types: map[string]*types.Type{
+				"X": {
+					Kind: types.Struct,
+					Members: []types.Member{
+						{Name: "TypeMeta", Embedded: true, Tags: `json:"` + jsonTag + `"`},
+					},
+				},
+			},
+		}
+	}
+
+	allRecognized := []string{
+		"+k8s:conversion-gen=k8s.io/api/foo",
+		"+k8s:conversion-gen-external-types=k8s.io/api/foo/v1",
+		"+k8s:defaulter-gen=TypeMeta",
+		"+k8s:defaulter-gen-input=k8s.io/api/foo/v1",
+		"+k8s:validation-gen=TypesWithField=TypeMeta",
+		"+k8s:validation-gen-input=k8s.io/api/foo/v1",
+		"+k8s:validation-gen-deep-equal-func=foo",
+		"+k8s:validation-gen-nolint",
+		"+k8s:validation-gen-scheme-registry=foo",
+		"+k8s:validation-gen-test-fixture=bar",
+		"+k8s:prerelease-lifecycle-gen=true",
+		"+k8s:deepcopy-gen=package",
+		"+k8s:register-gen=true",
+		"+k8s:openapi-gen=true",
+		"+k8s:openapi-model-package=foo",
+		"+k8s:protobuf-gen=package",
+	}
+
+	cases := []struct {
+		name    string
+		pkg     *types.Package
+		rules   []string
+		wantErr string
+	}{
+		{
+			name: "linting off: typo'd -gen passes",
+			pkg:  pkg("test/pkg", "+k8s:conversion-x-gen=value"),
+		},
+		{
+			name: "linting off: foreign +k8s:*-gen alongside ours passes",
+			pkg:  pkg("test/pkg", "+k8s:my-custom-gen=value", "+k8s:conversion-x-gen=k8s.io/api/foo"),
+		},
+		{
+			name: "linting off: missing universals on InternalVersion passes",
+			pkg: pkg("k8s.io/kubernetes/pkg/apis/apps/v1",
+				"+k8s:conversion-gen=k8s.io/kubernetes/pkg/apis/apps"),
+		},
+		{
+			name: "linting off: missing deepcopy on ExternalVersion passes",
+			pkg:  pkgWithTypeMeta("k8s.io/api/apps/v1", ",inline", "+groupName=apps"),
+		},
+
+		// LintRuleKnownTags
+		{
+			name:  "known-tags: all Recognized tags coexist",
+			pkg:   pkg("test/pkg", allRecognized...),
+			rules: []string{LintRuleKnownTagsOnly},
+		},
+		{
+			name:  "known-tags: subtagged generator recognized by base",
+			pkg:   pkg("test/pkg", "+k8s:prerelease-lifecycle-gen=true", "+k8s:prerelease-lifecycle-gen:introduced=1.30"),
+			rules: []string{LintRuleKnownTagsOnly},
+		},
+		{
+			name:  "known-tags: non-generator +k8s: tag passes",
+			pkg:   pkg("test/pkg", "+k8s:conversion-gen=k8s.io/api/foo", "+k8s:validateFalse=field"),
+			rules: []string{LintRuleKnownTagsOnly},
+		},
+		{
+			name:    "known-tags: unknown -gen fails",
+			pkg:     pkg("test/pkg", "+k8s:bogus-gen=value"),
+			rules:   []string{LintRuleKnownTagsOnly},
+			wantErr: "+k8s:bogus-gen",
+		},
+		{
+			name:    "known-tags: typo'd generator fails",
+			pkg:     pkg("test/pkg", "+k8s:conversion-x-gen=value"),
+			rules:   []string{LintRuleKnownTagsOnly},
+			wantErr: "+k8s:conversion-x-gen",
+		},
+		{
+			name:    "known-tags: foreign +k8s:*-gen fails",
+			pkg:     pkg("test/pkg", "+k8s:my-custom-gen=value", "+k8s:conversion-gen=k8s.io/api/foo"),
+			rules:   []string{LintRuleKnownTagsOnly},
+			wantErr: "+k8s:my-custom-gen",
+		},
+		{
+			name:  "explicit-disablement: NotAPIPackage skips",
+			pkg:   pkg("k8s.io/util/foo"),
+			rules: []string{LintRuleExplicitDisablement},
+		},
+		{
+			name:  "explicit-disablement: ExternalVersion deepcopy=value passes",
+			pkg:   pkgWithTypeMeta("k8s.io/api/apps/v1", ",inline", "+k8s:deepcopy-gen=package"),
+			rules: []string{LintRuleExplicitDisablement},
+		},
+		{
+			name:  "explicit-disablement: ExternalVersion deepcopy=false counts as explicit",
+			pkg:   pkgWithTypeMeta("k8s.io/api/apps/v1", ",inline", "+k8s:deepcopy-gen=false"),
+			rules: []string{LintRuleExplicitDisablement},
+		},
+		{
+			name:    "explicit-disablement: ExternalVersion missing deepcopy fails",
+			pkg:     pkgWithTypeMeta("k8s.io/api/apps/v1", ",inline", "+groupName=apps"),
+			rules:   []string{LintRuleExplicitDisablement},
+			wantErr: "+k8s:deepcopy-gen",
+		},
+		{
+			name: "explicit-disablement: InternalVersion all universals tagged passes",
+			pkg: pkg("k8s.io/kubernetes/pkg/apis/apps/v1",
+				"+k8s:conversion-gen=k8s.io/kubernetes/pkg/apis/apps",
+				"+k8s:defaulter-gen=TypeMeta",
+				"+k8s:validation-gen=TypesWithField=TypeMeta"),
+			rules: []string{LintRuleExplicitDisablement},
+		},
+		{
+			name: "explicit-disablement: InternalVersion missing validation fails",
+			pkg: pkg("k8s.io/kubernetes/pkg/apis/apps/v1",
+				"+k8s:conversion-gen=k8s.io/kubernetes/pkg/apis/apps",
+				"+k8s:defaulter-gen=TypeMeta"),
+			rules:   []string{LintRuleExplicitDisablement},
+			wantErr: "+k8s:validation-gen",
+		},
+		{
+			name: "explicit-disablement: conversion-only shim does not classify, no lint",
+			pkg: pkg("k8s.io/api/foo/v1beta1",
+				"+k8s:conversion-gen=k8s.io/api/foo/v1",
+				"+k8s:conversion-gen-external-types=k8s.io/api/foo/v1"),
+			rules: []string{LintRuleExplicitDisablement},
+		},
+		{
+			name: "explicit-disablement: InternalVersion with conversion+validation but missing defaulter fails",
+			pkg: pkg("k8s.io/kubernetes/pkg/apis/apps/v1",
+				"+k8s:conversion-gen=k8s.io/kubernetes/pkg/apis/apps",
+				"+k8s:validation-gen=TypesWithField=TypeMeta"),
+			rules:   []string{LintRuleExplicitDisablement},
+			wantErr: "+k8s:defaulter-gen",
+		},
+		{
+			name: "explicit-disablement: defaulter alone is enough to classify as InternalVersion",
+			pkg: pkg("k8s.io/kubernetes/pkg/apis/apps/v1",
+				"+k8s:defaulter-gen=TypeMeta"),
+			rules:   []string{LintRuleExplicitDisablement},
+			wantErr: "+k8s:conversion-gen",
+		},
+		{
+			name:  "explicit-disablement: InternalGroup no convention passes",
+			pkg:   pkgWithTypeMeta("k8s.io/kubernetes/pkg/apis/apps", "", "+groupName=apps"),
+			rules: []string{LintRuleExplicitDisablement},
+		},
+		{
+			name:  "explicit-disablement: config-style version (no shim signal) skips",
+			pkg:   pkg("k8s.io/component-base/metrics/api/v1", "+k8s:deepcopy-gen=package"),
+			rules: []string{LintRuleExplicitDisablement},
+		},
+		{
+			name:  "composed: both rules satisfied passes",
+			pkg:   pkgWithTypeMeta("k8s.io/api/apps/v1", ",inline", "+k8s:deepcopy-gen=package"),
+			rules: []string{LintRuleKnownTagsOnly, LintRuleExplicitDisablement},
+		},
+		{
+			name: "composed: known-tags fires on typo even with explicit-disablement on",
+			pkg: pkgWithTypeMeta("k8s.io/api/apps/v1", ",inline",
+				"+k8s:deepcopy-gen=package", "+k8s:conversion-x-gen=value"),
+			rules:   []string{LintRuleKnownTagsOnly, LintRuleExplicitDisablement},
+			wantErr: "+k8s:conversion-x-gen",
+		},
+		{
+			name:    "unknown rule name fails",
+			pkg:     pkg("test/pkg"),
+			rules:   []string{"future-rule"},
+			wantErr: "unrecognized lint-rule: future-rule",
+		},
+		{
+			name:  "empty rule list passes",
+			pkg:   pkg("test/pkg", "+k8s:bogus-gen=value"),
+			rules: []string{},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := Identify(tc.pkg, Conversion, WithLintRules(tc.rules...))
+			if tc.wantErr == "" {
+				if err != nil {
+					t.Errorf("err = %v, want nil", err)
+				}
+				return
+			}
+			if err == nil {
+				t.Fatalf("err = nil, want substring %q", tc.wantErr)
+			}
+			if !strings.Contains(err.Error(), tc.wantErr) {
+				t.Errorf("err = %q, want substring %q", err, tc.wantErr)
+			}
+		})
+	}
+}
+
+func withTypeMeta(jsonTag *string) *types.Type {
+	tags := ""
+	if jsonTag != nil {
+		tags = `json:"` + *jsonTag + `"`
+	}
+	return &types.Type{
+		Kind: types.Struct,
+		Members: []types.Member{
+			{Name: "TypeMeta", Embedded: true, Tags: tags},
+		},
+	}
+}
+
+func TestClassifyPackage(t *testing.T) {
+	cases := []struct {
+		name string
+		pkg  *types.Package
+		want packageRoles
+	}{
+		{
+			name: "nil package",
+			pkg:  nil,
+			want: packageRoles{},
+		},
+		{
+			name: "no codegen signal",
+			pkg: &types.Package{
+				Path:     "k8s.io/util/foo",
+				Comments: []string{"package foo"},
+			},
+			want: packageRoles{},
+		},
+		{
+			name: "external version: staging-style API package with TypeMeta json inline",
+			pkg: &types.Package{
+				Path:     "k8s.io/api/apps/v1",
+				Comments: []string{"+groupName=apps"},
+				Types: map[string]*types.Type{
+					"Deployment": withTypeMeta(new(",inline")),
+				},
+			},
+			want: packageRoles{isExternalVersion: true},
+		},
+		{
+			name: "internal version: server-side conversion shim, no own TypeMeta types",
+			pkg: &types.Package{
+				Path: "k8s.io/kubernetes/pkg/apis/apps/v1",
+				Comments: []string{
+					"+k8s:conversion-gen=k8s.io/kubernetes/pkg/apis/apps",
+					"+k8s:defaulter-gen=TypeMeta",
+				},
+			},
+			want: packageRoles{isInternalVersion: true},
+		},
+		{
+			name: "internal group: pkg/apis/<group>/ with internal types (no json inline)",
+			pkg: &types.Package{
+				Path:     "k8s.io/kubernetes/pkg/apis/apps",
+				Comments: []string{"+groupName=apps", "+k8s:deepcopy-gen=package"},
+				Types: map[string]*types.Type{
+					"Deployment": withTypeMeta(nil),
+				},
+			},
+			want: packageRoles{isInternalGroup: true},
+		},
+		{
+			name: "external group: API group package with no TypeMeta types and version-less path",
+			pkg: &types.Package{
+				Path:     "k8s.io/api/apps",
+				Comments: []string{"+groupName=apps"},
+				Types: map[string]*types.Type{
+					"Deployment": withTypeMeta(new(",inline")),
+				},
+			},
+			want: packageRoles{isExternalGroup: true},
+		},
+		{
+			name: "version path with conversion+defaulter tags classifies as internal-version",
+			pkg: &types.Package{
+				Path: "example.com/internal/foo/v1alpha1",
+				Comments: []string{
+					"+groupName=foo",
+					"+k8s:conversion-gen=example.com/internal/foo",
+					"+k8s:defaulter-gen=TypeMeta",
+				},
+				Types: map[string]*types.Type{
+					"Foo": withTypeMeta(nil),
+				},
+			},
+			want: packageRoles{isInternalVersion: true},
+		},
+		{
+			name: "version path with conversion-only is not classified (conversion-only shim)",
+			pkg: &types.Package{
+				Path: "example.com/api/foo/v1beta1",
+				Comments: []string{
+					"+k8s:conversion-gen=example.com/api/foo/v1",
+					"+k8s:conversion-gen-external-types=example.com/api/foo/v1",
+				},
+			},
+			want: packageRoles{},
+		},
+		{
+			name: "version path with no internal-version tags and no inline TypeMeta is not an API package",
+			pkg: &types.Package{
+				Path:     "example.com/config/foo/v1",
+				Comments: []string{"+k8s:deepcopy-gen=package"},
+			},
+			want: packageRoles{},
+		},
+		{
+			name: "v1beta2 path is recognized as version",
+			pkg: &types.Package{
+				Path:     "k8s.io/api/foo/v1beta2",
+				Comments: []string{"+groupName=foo"},
+				Types: map[string]*types.Type{
+					"Foo": withTypeMeta(new(",inline")),
+				},
+			},
+			want: packageRoles{isExternalVersion: true},
+		},
+		{
+			name: "non-version-looking path with TypeMeta json inline is ExternalGroup",
+			pkg: &types.Package{
+				Path:     "k8s.io/api/special",
+				Comments: []string{"+groupName=special"},
+				Types: map[string]*types.Type{
+					"Special": withTypeMeta(new(",inline")),
+				},
+			},
+			want: packageRoles{isExternalGroup: true},
+		},
+		{
+			name: "package with only +k8s:*-gen tag and no +groupName is internal group",
+			pkg: &types.Package{
+				Path: "example.com/pkg/foo",
+				Comments: []string{
+					"+k8s:deepcopy-gen=package",
+				},
+			},
+			want: packageRoles{isInternalGroup: true},
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := classifyPackage(tc.pkg)
+			if got != tc.want {
+				t.Errorf("classifyPackage = %+v, want %+v", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestExpectedGenerators(t *testing.T) {
+	cases := []struct {
+		name  string
+		roles packageRoles
+		want  []Spec
+	}{
+		{name: "no roles", roles: packageRoles{}, want: nil},
+		{name: "external version", roles: packageRoles{isExternalVersion: true}, want: []Spec{Deepcopy}},
+		{name: "internal version", roles: packageRoles{isInternalVersion: true}, want: []Spec{Conversion, Defaulter, Validation}},
+		{name: "internal group", roles: packageRoles{isInternalGroup: true}, want: nil},
+		{name: "external group", roles: packageRoles{isExternalGroup: true}, want: nil},
+		{
+			name:  "external+internal version: union",
+			roles: packageRoles{isExternalVersion: true, isInternalVersion: true},
+			want:  []Spec{Deepcopy, Conversion, Defaulter, Validation},
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := expectedGenerators(tc.roles)
+			if !reflect.DeepEqual(got, tc.want) {
+				t.Errorf("expectedGenerators(%+v) = %v, want %v", tc.roles, got, tc.want)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/spec.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/spec.go
new file mode 100644
index 0000000000..96289c97bb
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/spec.go
@@ -0,0 +1,172 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apidefinitions
+
+import "k8s.io/apimachinery/pkg/util/sets"
+
+// Spec describes one generator's tag protocol. Required for backward compatibility
+// with existing tag behavior.
+type Spec struct {
+	// ActivationTag declare the primary enablement tag for this generator
+	ActivationTag string
+
+	// ValueMode declares how the ActivationTag's value is interpreted
+	ValueMode ValueMode
+
+	// GroupActivationTag is a package level enablement tag
+	// whose presence activates this generator.
+	// ActivationTag set to "false" always overrides this.
+	GroupActivationTag string
+
+	// ScanTypes indicates that, when ActivationTag is absent, the
+	// generator scans the package's types for type-level
+	// +<ActivationTag>=true tags. ActivationTag set to "false"
+	// suppresses the scan and skips the package.
+	ScanTypes bool
+
+	// DefaultEnabled indicates that the generator runs on every package
+	// it is asked to process unless ActivationTag is set to "false".
+	DefaultEnabled bool
+
+	// InputTag declares the tag that declares a list of input packages for this generator
+	InputTag string
+
+	// AuxTags declares other tags owned by this generator
+	AuxTags []string
+}
+
+// ValueMode describes how an ActivationTag's value is interpreted.
+type ValueMode int
+
+const (
+	// Boolean identifies "true"/"false" values that explicitly turn on or
+	// off a generator.
+	Boolean ValueMode = iota
+
+	// Package identifies "package"/"false" tags that explicitly turn on or
+	// off a generator for an entire package. Such tags typically can
+	// be turned on individually for types within a package unless the value
+	// is "false".
+	Package
+
+	// TypeFilterList: values are type-name patterns (e.g. "TypeMeta" for
+	// defaulter-gen and validation-gen). Read via Activation.TypeFilters.
+	TypeFilterList
+
+	// ConversionPeerList is conversion-gen's bespoke tag protocol.
+	// Values are either peer packages, or "false" which sets
+	// the generator to explicit-only mode.
+	ConversionPeerList
+)
+
+var allKnownSpecs = []Spec{
+	Conversion, Defaulter, Validation, PrereleaseLifecycle,
+	Deepcopy, Register, OpenAPI, Protobuf,
+	Client, ApplyConfiguration, Informer, Lister,
+}
+
+// Codify the behavior of the activation tags for API definition generators.
+var (
+	Conversion = Spec{
+		ActivationTag: "k8s:conversion-gen",
+		InputTag:      "k8s:conversion-gen-external-types",
+		ValueMode:     ConversionPeerList,
+	}
+	Defaulter = Spec{
+		ActivationTag: "k8s:defaulter-gen",
+		InputTag:      "k8s:defaulter-gen-input",
+		ValueMode:     TypeFilterList,
+	}
+	Validation = Spec{
+		ActivationTag: "k8s:validation-gen",
+		InputTag:      "k8s:validation-gen-input",
+		ValueMode:     TypeFilterList,
+		AuxTags: []string{
+			"k8s:validation-gen-deep-equal-func",
+			"k8s:validation-gen-nolint",
+			"k8s:validation-gen-scheme-registry",
+			"k8s:validation-gen-test-fixture",
+			"k8s:validation-gen-test-targets",
+		},
+	}
+	PrereleaseLifecycle = Spec{
+		ActivationTag: "k8s:prerelease-lifecycle-gen",
+		ValueMode:     Boolean,
+	}
+	Deepcopy = Spec{
+		ActivationTag: "k8s:deepcopy-gen",
+		ValueMode:     Package,
+		ScanTypes:     true,
+	}
+	Register = Spec{
+		ActivationTag:      "k8s:register-gen",
+		ValueMode:          Boolean,
+		GroupActivationTag: "groupName",
+	}
+	OpenAPI = Spec{
+		ActivationTag: "k8s:openapi-gen",
+		InputTag:      "k8s:openapi-model-package",
+		ValueMode:     Boolean,
+	}
+	Protobuf = Spec{
+		ActivationTag: "k8s:protobuf-gen",
+		ValueMode:     Package,
+	}
+	Client = Spec{
+		ActivationTag:  "k8s:client-gen",
+		ValueMode:      Boolean,
+		DefaultEnabled: true,
+		AuxTags: []string{
+			"genclient",
+			"genclient:nonNamespaced",
+			"genclient:noVerbs",
+			"genclient:onlyVerbs",
+			"genclient:skipVerbs",
+			"genclient:noStatus",
+			"genclient:readonly",
+			"genclient:method",
+			"groupGoName",
+		},
+	}
+	ApplyConfiguration = Spec{
+		ActivationTag:  "k8s:applyconfiguration-gen",
+		ValueMode:      Boolean,
+		DefaultEnabled: true,
+	}
+	Informer = Spec{
+		ActivationTag:  "k8s:informer-gen",
+		ValueMode:      Boolean,
+		DefaultEnabled: true,
+	}
+	Lister = Spec{
+		ActivationTag:  "k8s:lister-gen",
+		ValueMode:      Boolean,
+		DefaultEnabled: true,
+	}
+)
+
+var allKnownTags = func() sets.Set[string] {
+	out := sets.New[string]()
+	for _, s := range allKnownSpecs {
+		out.Insert(s.ActivationTag)
+		if s.InputTag != "" {
+			out.Insert(s.InputTag)
+		}
+		out.Insert(s.AuxTags...)
+	}
+	return out
+}()
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/tags.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/tags.go
new file mode 100644
index 0000000000..c879a1bff2
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/tags.go
@@ -0,0 +1,97 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apidefinitions
+
+import (
+	"fmt"
+
+	"k8s.io/gengo/v2/codetags"
+)
+
+const tagGroupName = "groupName"
+
+// extractGeneratorTag returns the values of "+<tagName>" in comments.
+// If any value is "false", every value must be "false" (duplicate
+// disablement is allowed but mixing disablement with any other value
+// is an error); optedOut is set when so.
+func extractGeneratorTag(comments []string, tagName string) (values []string, optedOut bool, err error) {
+	if tagName == "" {
+		return nil, false, nil
+	}
+	values, err = tagValues(comments, tagName)
+	if err != nil {
+		return nil, false, err
+	}
+	hasFalse, hasOther := false, false
+	for _, v := range values {
+		if v == "false" {
+			hasFalse = true
+		} else {
+			hasOther = true
+		}
+	}
+	if hasFalse && hasOther {
+		return nil, false, fmt.Errorf("+%s: cannot mix \"false\" with other values; got %v", tagName, values)
+	}
+	if hasFalse {
+		return nil, true, nil
+	}
+	return values, false, nil
+}
+
+func tagValues(lines []string, name string) ([]string, error) {
+	tags, err := extractTags(lines, name)
+	if err != nil {
+		return nil, err
+	}
+	if len(tags[name]) == 0 {
+		return nil, nil
+	}
+	out := make([]string, 0, len(tags[name]))
+	for _, t := range tags[name] {
+		out = append(out, t.Value)
+	}
+	return out, nil
+}
+
+func extractTags(lines []string, names ...string) (map[string][]codetags.Tag, error) {
+	raw := codetags.Extract("+", lines)
+	out := map[string][]codetags.Tag{}
+	for _, name := range names {
+		for _, line := range raw[name] {
+			t, err := codetags.Parse(line, codetags.RawValues(true))
+			if err != nil {
+				return nil, err
+			}
+			out[name] = append(out[name], t)
+		}
+	}
+	return out, nil
+}
+
+// GroupNameForPackage returns the value of the +groupName= tag from
+// comments. ok is false when the tag is absent.
+func GroupNameForPackage(comments []string) (group string, ok bool, err error) {
+	values, err := tagValues(comments, tagGroupName)
+	if err != nil {
+		return "", false, err
+	}
+	if len(values) == 0 {
+		return "", false, nil
+	}
+	return values[0], true, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/tags_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/tags_test.go
new file mode 100644
index 0000000000..495aad01e0
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/apidefinitions/tags_test.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apidefinitions
+
+import (
+	"testing"
+)
+
+func TestGroupNameForPackage(t *testing.T) {
+	cases := []struct {
+		name     string
+		comments []string
+		want     string
+		wantOK   bool
+	}{
+		{name: "groupName tag", comments: []string{"+groupName=apps"}, want: "apps", wantOK: true},
+		{name: "qualified groupName", comments: []string{"+groupName=foo.example.com"}, want: "foo.example.com", wantOK: true},
+		{name: "no tag"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, ok, err := GroupNameForPackage(tc.comments)
+			if err != nil {
+				t.Fatalf("err = %v", err)
+			}
+			if ok != tc.wantOK {
+				t.Errorf("ok = %v, want %v", ok, tc.wantOK)
+			}
+			if got != tc.want {
+				t.Errorf("got %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/namer/tag-override.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/namer/tag-override.go
new file mode 100644
index 0000000000..59ee489f0f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/namer/tag-override.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package namer
+
+import (
+	"k8s.io/gengo/v2"
+	"k8s.io/gengo/v2/namer"
+	"k8s.io/gengo/v2/types"
+)
+
+// TagOverrideNamer is a namer which pulls names from a given tag, if specified,
+// and otherwise falls back to a different namer.
+type TagOverrideNamer struct {
+	tagName  string
+	fallback namer.Namer
+}
+
+// Name returns the tag value if it exists. It no tag was found the fallback namer will be used
+func (n *TagOverrideNamer) Name(t *types.Type) string {
+	if nameOverride := extractTag(n.tagName, append(t.SecondClosestCommentLines, t.CommentLines...)); nameOverride != "" {
+		return nameOverride
+	}
+
+	return n.fallback.Name(t)
+}
+
+// NewTagOverrideNamer creates a namer.Namer which uses the contents of the given tag as
+// the name, or falls back to another Namer if the tag is not present.
+func NewTagOverrideNamer(tagName string, fallback namer.Namer) namer.Namer {
+	return &TagOverrideNamer{
+		tagName:  tagName,
+		fallback: fallback,
+	}
+}
+
+// extractTag gets the comment-tags for the key.  If the tag did not exist, it
+// returns the empty string.
+func extractTag(key string, lines []string) string {
+	val, present := gengo.ExtractCommentTags("+", lines)[key]
+	if !present || len(val) < 1 {
+		return ""
+	}
+
+	return val[0]
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/util/comments.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/util/comments.go
new file mode 100644
index 0000000000..dfc8502cd6
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/util/comments.go
@@ -0,0 +1,92 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"fmt"
+
+	"k8s.io/gengo/v2"
+)
+
+// ExtractCommentTagsWithoutArguments parses comments for special metadata tags. The
+// marker argument should be unique enough to identify the tags needed, and
+// should not be a marker for tags you don't want, or else the caller takes
+// responsibility for making that distinction.
+//
+// The tagNames argument is a list of specific tags being extracted. If this is
+// nil or empty, all lines which match the marker are considered.  If this is
+// specified, only lines with begin with marker + one of the tags will be
+// considered.  This is useful when a common marker is used which may match
+// lines which fail this syntax (e.g. which predate this definition).
+//
+// This function looks for input lines of the following forms:
+//   - 'marker' + "key=value"
+//   - 'marker' + "key()=value"
+//   - 'marker' + "key(arg)=value"
+//
+// The arg is forbidden.  This function only consider tags with no arguments specified
+// (either as "key=value" or as // "key()=value").  Finding tags with an argument will
+// result in an error.
+//
+// The value is optional.  If not specified, the resulting Tag will have "" as
+// the value.
+//
+// Tag comment-lines may have a trailing end-of-line comment.
+//
+// The map returned here is keyed by the Tag's name without args.
+//
+// A tag can be specified more than one time and all values are returned.  If
+// the resulting map has an entry for a key, the value (a slice) is guaranteed
+// to have at least 1 element.
+//
+// Example: if you pass "+" for 'marker', and the following lines are in
+// the comments:
+//
+//	+foo=val1   // foo
+//	+bar
+//	+foo=val2   // also foo
+//	+foo()=val3 // still foo
+//	+baz="qux"
+//
+// Then this function will return:
+//
+//	map[string][]string{"foo":{"val1", "val2", "val3"}, "bar": {""}, "baz": {`"qux"`}}
+func ExtractCommentTagsWithoutArguments(marker string, tagNames []string, lines []string) (map[string][]string, error) {
+	functionStyleTags, err := gengo.ExtractFunctionStyleCommentTags(marker, tagNames, lines)
+	if err != nil {
+		return nil, err
+	}
+
+	out := make(map[string][]string)
+	for tagName, tags := range functionStyleTags {
+		values := make([]string, 0)
+
+		for _, tag := range tags {
+			if tag.Args == nil {
+				values = append(values, tag.Value)
+			} else {
+				return nil, fmt.Errorf(`failed to parse tag %s: expected no arguments, found "%s"`, tag, tag.Args[0])
+			}
+		}
+
+		if len(values) > 0 {
+			out[tagName] = values
+		}
+	}
+
+	return out, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/util/comments_test.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/util/comments_test.go
new file mode 100644
index 0000000000..425d2db74d
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/util/comments_test.go
@@ -0,0 +1,101 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"errors"
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestExtractCommentTagsWithoutArguments(t *testing.T) {
+	cases := []struct {
+		tagNames    []string
+		lines       []string
+		expected    map[string][]string
+		expectedErr error
+	}{{
+		tagNames: nil,
+		lines: []string{
+			"Human comment that is ignored.",
+			"+foo=value1",
+			"+bar",
+			"+foo=value2",
+			"+foo()=value3",
+			"+baz=qux,zrb=true",
+			"+bip=\"value3\"",
+		},
+		expected: map[string][]string{
+			"foo": {"value1", "value2", "value3"},
+			"bar": {""},
+			"baz": {"qux,zrb=true"},
+			"bip": {`"value3"`},
+		},
+		expectedErr: nil,
+	}, {
+		tagNames: nil,
+		lines: []string{
+			"+foo=value1",
+			"+bar",
+			"+foo=value2",
+			"+foo()=value3",
+			"+bip(arg)=",
+			"+baz=qux,zrb=true",
+		},
+		expected:    nil,
+		expectedErr: errors.New(`failed to parse tag bip(arg): expected no arguments, found "arg"`),
+	}, {
+		tagNames: []string{"foo", "bar"},
+		lines: []string{
+			"+foo=value1",
+			"+bar",
+			"+foo=value2",
+			"+foo()=value3",
+			"+bip(arg)=",
+			"+baz=qux,zrb=true",
+		},
+		expected: map[string][]string{
+			"foo": {"value1", "value2", "value3"},
+			"bar": {""},
+		},
+		expectedErr: nil,
+	}, {
+		tagNames: []string{"lorem"},
+		lines: []string{
+			"+foo=value1",
+			"+bar",
+		},
+		expected:    map[string][]string{},
+		expectedErr: nil,
+	}}
+
+	for _, tc := range cases {
+		values, err := ExtractCommentTagsWithoutArguments("+", tc.tagNames, tc.lines)
+
+		if tc.expectedErr == nil && err != nil {
+			t.Errorf("Failed to parse comments: %v", err)
+		}
+		if tc.expectedErr != nil && tc.expectedErr.Error() != err.Error() {
+			t.Errorf("Expectng error %v, got %v", tc.expectedErr.Error(), err.Error())
+		}
+		if !reflect.DeepEqual(tc.expected, values) {
+			t.Errorf("Wrong result:\n%v", cmp.Diff(tc.expected, values))
+		}
+	}
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/util/plural_exceptions.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/util/plural_exceptions.go
new file mode 100644
index 0000000000..73c648d5b5
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/pkg/util/plural_exceptions.go
@@ -0,0 +1,37 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"fmt"
+	"strings"
+)
+
+// PluralExceptionListToMapOrDie converts the list in "Type:PluralType" to map[string]string.
+// This is used for pluralizer.
+// If the format is wrong, this function will panic.
+func PluralExceptionListToMapOrDie(pluralExceptions []string) map[string]string {
+	pluralExceptionMap := make(map[string]string, len(pluralExceptions))
+	for i := range pluralExceptions {
+		parts := strings.Split(pluralExceptions[i], ":")
+		if len(parts) != 2 {
+			panic(fmt.Sprintf("invalid plural exception definition: %s", pluralExceptions[i]))
+		}
+		pluralExceptionMap[parts[0]] = parts[1]
+	}
+	return pluralExceptionMap
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/third_party/forked/golang/LICENSE b/hack/tools/code-generator/third_party/k8s.io/code-generator/third_party/forked/golang/LICENSE
new file mode 100644
index 0000000000..6a66aea5ea
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/third_party/forked/golang/LICENSE
@@ -0,0 +1,27 @@
+Copyright (c) 2009 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/third_party/forked/golang/PATENTS b/hack/tools/code-generator/third_party/k8s.io/code-generator/third_party/forked/golang/PATENTS
new file mode 100644
index 0000000000..733099041f
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/third_party/forked/golang/PATENTS
@@ -0,0 +1,22 @@
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/third_party/forked/golang/reflect/type.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/third_party/forked/golang/reflect/type.go
new file mode 100644
index 0000000000..67957ee33e
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/third_party/forked/golang/reflect/type.go
@@ -0,0 +1,91 @@
+//This package is copied from Go library reflect/type.go.
+//The struct tag library provides no way to extract the list of struct tags, only
+//a specific tag
+package reflect
+
+import (
+	"fmt"
+
+	"strconv"
+	"strings"
+)
+
+type StructTag struct {
+	Name  string
+	Value string
+}
+
+func (t StructTag) String() string {
+	return fmt.Sprintf("%s:%q", t.Name, t.Value)
+}
+
+type StructTags []StructTag
+
+func (tags StructTags) String() string {
+	s := make([]string, 0, len(tags))
+	for _, tag := range tags {
+		s = append(s, tag.String())
+	}
+	return "`" + strings.Join(s, " ") + "`"
+}
+
+func (tags StructTags) Has(name string) bool {
+	for i := range tags {
+		if tags[i].Name == name {
+			return true
+		}
+	}
+	return false
+}
+
+// ParseStructTags returns the full set of fields in a struct tag in the order they appear in
+// the struct tag.
+func ParseStructTags(tag string) (StructTags, error) {
+	tags := StructTags{}
+	for tag != "" {
+		// Skip leading space.
+		i := 0
+		for i < len(tag) && tag[i] == ' ' {
+			i++
+		}
+		tag = tag[i:]
+		if tag == "" {
+			break
+		}
+
+		// Scan to colon. A space, a quote or a control character is a syntax error.
+		// Strictly speaking, control chars include the range [0x7f, 0x9f], not just
+		// [0x00, 0x1f], but in practice, we ignore the multi-byte control characters
+		// as it is simpler to inspect the tag's bytes than the tag's runes.
+		i = 0
+		for i < len(tag) && tag[i] > ' ' && tag[i] != ':' && tag[i] != '"' && tag[i] != 0x7f {
+			i++
+		}
+		if i == 0 || i+1 >= len(tag) || tag[i] != ':' || tag[i+1] != '"' {
+			break
+		}
+		name := string(tag[:i])
+		tag = tag[i+1:]
+
+		// Scan quoted string to find value.
+		i = 1
+		for i < len(tag) && tag[i] != '"' {
+			if tag[i] == '\\' {
+				i++
+			}
+			i++
+		}
+		if i >= len(tag) {
+			break
+		}
+		qvalue := string(tag[:i+1])
+		tag = tag[i+1:]
+
+		value, err := strconv.Unquote(qvalue)
+		if err != nil {
+			return nil, err
+		}
+		tags = append(tags, StructTag{Name: name, Value: value})
+	}
+	return tags, nil
+}
diff --git a/hack/tools/code-generator/third_party/k8s.io/code-generator/tools.go b/hack/tools/code-generator/third_party/k8s.io/code-generator/tools.go
new file mode 100644
index 0000000000..92c9c73ae1
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k8s.io/code-generator/tools.go
@@ -0,0 +1,35 @@
+//go:build tools
+
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// This package contains code generation utilities
+// This package imports things required by build scripts, to force `go mod` to see them as dependencies
+package codegenerator
+
+import (
+	_ "k8s.io/code-generator/cmd/applyconfiguration-gen"
+	_ "k8s.io/code-generator/cmd/client-gen"
+	_ "k8s.io/code-generator/cmd/conversion-gen"
+	_ "k8s.io/code-generator/cmd/deepcopy-gen"
+	_ "k8s.io/code-generator/cmd/defaulter-gen"
+	_ "k8s.io/code-generator/cmd/go-to-protobuf"
+	_ "k8s.io/code-generator/cmd/informer-gen"
+	_ "k8s.io/code-generator/cmd/lister-gen"
+	_ "k8s.io/code-generator/cmd/register-gen"
+	_ "k8s.io/code-generator/cmd/validation-gen"
+	_ "k8s.io/kube-openapi/cmd/openapi-gen"
+)
diff --git a/hack/tools/code-generator/third_party/k_k_141395.diff b/hack/tools/code-generator/third_party/k_k_141395.diff
new file mode 100644
index 0000000000..3a5052cbb9
--- /dev/null
+++ b/hack/tools/code-generator/third_party/k_k_141395.diff
@@ -0,0 +1,4558 @@
+diff --git a/pkg/apis/admissionregistration/v1/zz_generated.validations.go b/pkg/apis/admissionregistration/v1/zz_generated.validations.go
+index c2562dc0936b0..b4b638ed6458a 100644
+--- a/pkg/apis/admissionregistration/v1/zz_generated.validations.go
++++ b/pkg/apis/admissionregistration/v1/zz_generated.validations.go
+@@ -453,7 +453,7 @@ func Validate_ValidatingAdmissionPolicyStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -501,3 +501,8 @@ func Validate_ValidatingWebhookConfiguration(
+ 	// field admissionregistrationv1.ValidatingWebhookConfiguration.Webhooks has no validation
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/admissionregistration/v1alpha1/zz_generated.validations.go b/pkg/apis/admissionregistration/v1alpha1/zz_generated.validations.go
+index 93f66e798e3ab..a08534553e18a 100644
+--- a/pkg/apis/admissionregistration/v1alpha1/zz_generated.validations.go
++++ b/pkg/apis/admissionregistration/v1alpha1/zz_generated.validations.go
+@@ -389,7 +389,7 @@ func Validate_ValidatingAdmissionPolicyStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -403,3 +403,8 @@ func Validate_ValidatingAdmissionPolicyStatus(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/admissionregistration/v1beta1/zz_generated.validations.go b/pkg/apis/admissionregistration/v1beta1/zz_generated.validations.go
+index 3c1b50fa66d94..6d6d394f124b4 100644
+--- a/pkg/apis/admissionregistration/v1beta1/zz_generated.validations.go
++++ b/pkg/apis/admissionregistration/v1beta1/zz_generated.validations.go
+@@ -453,7 +453,7 @@ func Validate_ValidatingAdmissionPolicyStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -501,3 +501,8 @@ func Validate_ValidatingWebhookConfiguration(
+ 	// field admissionregistrationv1beta1.ValidatingWebhookConfiguration.Webhooks has no validation
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/batch/v1/zz_generated.validations.go b/pkg/apis/batch/v1/zz_generated.validations.go
+index 0a830fdeb62b3..8f0b35bb016f5 100644
+--- a/pkg/apis/batch/v1/zz_generated.validations.go
++++ b/pkg/apis/batch/v1/zz_generated.validations.go
+@@ -403,7 +403,7 @@ func Validate_JobSchedulingConfiguration(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.WorkloadPodGroupResourceClaim, b *schedulingv1alpha3.WorkloadPodGroupResourceClaim) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, v1alpha3.Validate_WorkloadPodGroupResourceClaim); len(e) != 0 {
++				}, deepEqualImpl_, v1alpha3.Validate_WorkloadPodGroupResourceClaim); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -583,3 +583,8 @@ func Validate_JobTemplateSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/certificates/v1/zz_generated.validations.go b/pkg/apis/certificates/v1/zz_generated.validations.go
+index 35af1f3579770..bb98173b9a2c2 100644
+--- a/pkg/apis/certificates/v1/zz_generated.validations.go
++++ b/pkg/apis/certificates/v1/zz_generated.validations.go
+@@ -392,7 +392,7 @@ func Validate_PodCertificateRequestStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -410,3 +410,8 @@ func Validate_PodCertificateRequestStatus(
+ 	// field certificatesv1.PodCertificateRequestStatus.NotAfter has no validation
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/certificates/v1beta1/zz_generated.validations.go b/pkg/apis/certificates/v1beta1/zz_generated.validations.go
+index 9af5455cf75c3..d64104e9a2e97 100644
+--- a/pkg/apis/certificates/v1beta1/zz_generated.validations.go
++++ b/pkg/apis/certificates/v1beta1/zz_generated.validations.go
+@@ -392,7 +392,7 @@ func Validate_PodCertificateRequestStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -410,3 +410,8 @@ func Validate_PodCertificateRequestStatus(
+ 	// field certificatesv1beta1.PodCertificateRequestStatus.NotAfter has no validation
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/core/v1/zz_generated.validations.go b/pkg/apis/core/v1/zz_generated.validations.go
+index cd8ad94525e30..8e0d53348368e 100644
+--- a/pkg/apis/core/v1/zz_generated.validations.go
++++ b/pkg/apis/core/v1/zz_generated.validations.go
+@@ -855,7 +855,7 @@ func Validate_NodeAllocatableResourceClaimStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *corev1.NodeAllocatableMappedResources, b *corev1.NodeAllocatableMappedResources) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_NodeAllocatableMappedResources); len(e) != 0 {
++				}, deepEqualImpl_, Validate_NodeAllocatableMappedResources); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -897,7 +897,7 @@ func Validate_NodeAllocatableResourceClaimStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *corev1.NodeAllocatableOverheadResources, b *corev1.NodeAllocatableOverheadResources) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_NodeAllocatableOverheadResources); len(e) != 0 {
++				}, deepEqualImpl_, Validate_NodeAllocatableOverheadResources); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -985,7 +985,8 @@ func Validate_NodeSpec(
+ 			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+ 				earlyReturn = true
+ 			}
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoUnset, validate.NoModify).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoUnset, validate.NoModify).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -1390,7 +1391,7 @@ func Validate_PodSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *corev1.EvictionResponder, b *corev1.EvictionResponder) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_EvictionResponder); len(e) != 0 {
++				func(a *corev1.EvictionResponder, b *corev1.EvictionResponder) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_EvictionResponder); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1462,7 +1463,7 @@ func Validate_PodStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *corev1.NodeAllocatableResourceClaimStatus, b *corev1.NodeAllocatableResourceClaimStatus) bool {
+ 					return a.ResourceClaimName == b.ResourceClaimName
+-				}, validate.SemanticDeepEqual, Validate_NodeAllocatableResourceClaimStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_NodeAllocatableResourceClaimStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1500,7 +1501,7 @@ func Validate_PodStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *corev1.PodVolumeHealth, b *corev1.PodVolumeHealth) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodVolumeHealth); len(e) != 0 {
++				func(a *corev1.PodVolumeHealth, b *corev1.PodVolumeHealth) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_PodVolumeHealth); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2250,3 +2251,8 @@ func Validate_VolumeHealthStatusType(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/flowcontrol/v1/zz_generated.validations.go b/pkg/apis/flowcontrol/v1/zz_generated.validations.go
+index d8484235332a3..8b590e900f5e2 100644
+--- a/pkg/apis/flowcontrol/v1/zz_generated.validations.go
++++ b/pkg/apis/flowcontrol/v1/zz_generated.validations.go
+@@ -307,7 +307,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1.PriorityLevelConfigurationSpec) flowcontrolv1.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1.ExemptPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -338,7 +338,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1.PriorityLevelConfigurationSpec) flowcontrolv1.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1.LimitedPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -454,3 +454,8 @@ func Validate_PriorityLevelConfigurationSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/flowcontrol/v1beta1/zz_generated.validations.go b/pkg/apis/flowcontrol/v1beta1/zz_generated.validations.go
+index b5bf044c847af..1079f7f7b4ae7 100644
+--- a/pkg/apis/flowcontrol/v1beta1/zz_generated.validations.go
++++ b/pkg/apis/flowcontrol/v1beta1/zz_generated.validations.go
+@@ -309,7 +309,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1beta1.PriorityLevelConfigurationSpec) flowcontrolv1beta1.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1beta1.ExemptPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -340,7 +340,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1beta1.PriorityLevelConfigurationSpec) flowcontrolv1beta1.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1beta1.LimitedPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -456,3 +456,8 @@ func Validate_PriorityLevelConfigurationSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/flowcontrol/v1beta2/zz_generated.validations.go b/pkg/apis/flowcontrol/v1beta2/zz_generated.validations.go
+index c598fd02c48cb..56b84e881aa46 100644
+--- a/pkg/apis/flowcontrol/v1beta2/zz_generated.validations.go
++++ b/pkg/apis/flowcontrol/v1beta2/zz_generated.validations.go
+@@ -309,7 +309,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1beta2.PriorityLevelConfigurationSpec) flowcontrolv1beta2.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1beta2.ExemptPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -340,7 +340,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1beta2.PriorityLevelConfigurationSpec) flowcontrolv1beta2.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1beta2.LimitedPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -456,3 +456,8 @@ func Validate_PriorityLevelConfigurationSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/flowcontrol/v1beta3/zz_generated.validations.go b/pkg/apis/flowcontrol/v1beta3/zz_generated.validations.go
+index b7dece4e10418..213f621973b55 100644
+--- a/pkg/apis/flowcontrol/v1beta3/zz_generated.validations.go
++++ b/pkg/apis/flowcontrol/v1beta3/zz_generated.validations.go
+@@ -309,7 +309,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1beta3.PriorityLevelConfigurationSpec) flowcontrolv1beta3.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1beta3.ExemptPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -340,7 +340,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1beta3.PriorityLevelConfigurationSpec) flowcontrolv1beta3.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1beta3.LimitedPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -456,3 +456,8 @@ func Validate_PriorityLevelConfigurationSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/lifecycle/v1alpha1/zz_generated.validations.go b/pkg/apis/lifecycle/v1alpha1/zz_generated.validations.go
+index dbc18b7e8c986..2335b86d38d80 100644
+--- a/pkg/apis/lifecycle/v1alpha1/zz_generated.validations.go
++++ b/pkg/apis/lifecycle/v1alpha1/zz_generated.validations.go
+@@ -552,7 +552,7 @@ func Validate_EvictionRequestStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -732,7 +732,7 @@ func Validate_EvictionStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -858,7 +858,7 @@ func Validate_EvictionStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *lifecyclev1alpha1.TargetResponder, b *lifecyclev1alpha1.TargetResponder) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_TargetResponder); len(e) != 0 {
++				}, deepEqualImpl_, Validate_TargetResponder); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -904,7 +904,7 @@ func Validate_EvictionStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *lifecyclev1alpha1.ResponderStatus, b *lifecyclev1alpha1.ResponderStatus) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_ResponderStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_ResponderStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1374,3 +1374,8 @@ func Validate_TargetResponder(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/lifecycle/validation/validation.go b/pkg/apis/lifecycle/validation/validation.go
+index bf3f2e29df13b..28bb04bfb9709 100644
+--- a/pkg/apis/lifecycle/validation/validation.go
++++ b/pkg/apis/lifecycle/validation/validation.go
+@@ -23,6 +23,7 @@ import (
+ 	"strings"
+ 	"time"
+ 
++	"k8s.io/apimachinery/pkg/api/equality"
+ 	"k8s.io/apimachinery/pkg/api/meta"
+ 	"k8s.io/apimachinery/pkg/api/operation"
+ 	"k8s.io/apimachinery/pkg/api/validate"
+@@ -487,7 +488,7 @@ func ValidateEvictionStatusResponder(status, oldStatus *lifecycle.ResponderStatu
+ 		oldDefaultedStatus = *oldStatus // +k8s:verify-mutation:reason=clone
+ 	}
+ 
+-	if oldStatus != nil && !validate.SemanticDeepEqual(status, oldStatus) && opts.responderState != lifecycle.ResponderStateActive {
++	if oldStatus != nil && !equality.Semantic.DeepEqual(status, oldStatus) && opts.responderState != lifecycle.ResponderStateActive {
+ 		// immutable; changes to the ResponderStatus are only allowed by the active responder or during initialization
+ 		return append(allErrs, field.Invalid(fldPath, status, validation.FieldImmutableErrorMsg).WithOrigin("immutable"))
+ 	}
+diff --git a/pkg/apis/lifecycle/validation/validation_test.go b/pkg/apis/lifecycle/validation/validation_test.go
+index 0c92b20367be6..0f962d44a5a54 100644
+--- a/pkg/apis/lifecycle/validation/validation_test.go
++++ b/pkg/apis/lifecycle/validation/validation_test.go
+@@ -23,7 +23,7 @@ import (
+ 	"time"
+ 
+ 	"github.com/google/go-cmp/cmp"
+-	"k8s.io/apimachinery/pkg/api/validate"
++	"k8s.io/apimachinery/pkg/api/equality"
+ 	"k8s.io/apimachinery/pkg/api/validation"
+ 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+ 	"k8s.io/apimachinery/pkg/util/validation/field"
+@@ -143,7 +143,7 @@ func TestValidateEvictionRequestStatusUpdate(t *testing.T) {
+ 	}
+ 	for name, tc := range successCases {
+ 		t.Run(name, func(t *testing.T) {
+-			if validate.SemanticDeepEqual(tc.oldInput, tc.input) {
++			if equality.Semantic.DeepEqual(tc.oldInput, tc.input) {
+ 				t.Errorf("Expected oldInput and input to differ")
+ 			}
+ 			oldEvictionRequest := mkValidEvictionRequest()
+@@ -812,7 +812,7 @@ func TestValidateEvictionStatusUpdate(t *testing.T) {
+ 	}
+ 	for name, tc := range successCases {
+ 		t.Run(name, func(t *testing.T) {
+-			if !tc.explicitEmptyUpdate && validate.SemanticDeepEqual(tc.oldInput, tc.input) {
++			if !tc.explicitEmptyUpdate && equality.Semantic.DeepEqual(tc.oldInput, tc.input) {
+ 				t.Errorf("Expected oldInput and input to differ")
+ 			}
+ 			// Ensure that the validation doesn't depend on the order of list elements.
+diff --git a/pkg/apis/policy/v1/zz_generated.validations.go b/pkg/apis/policy/v1/zz_generated.validations.go
+index f153234e54e76..df2d2e74fe77f 100644
+--- a/pkg/apis/policy/v1/zz_generated.validations.go
++++ b/pkg/apis/policy/v1/zz_generated.validations.go
+@@ -155,7 +155,7 @@ func Validate_PodDisruptionBudgetStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -169,3 +169,8 @@ func Validate_PodDisruptionBudgetStatus(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/policy/v1beta1/zz_generated.validations.go b/pkg/apis/policy/v1beta1/zz_generated.validations.go
+index def9d2dd2d8a1..369d266ce91c1 100644
+--- a/pkg/apis/policy/v1beta1/zz_generated.validations.go
++++ b/pkg/apis/policy/v1beta1/zz_generated.validations.go
+@@ -155,7 +155,7 @@ func Validate_PodDisruptionBudgetStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -169,3 +169,8 @@ func Validate_PodDisruptionBudgetStatus(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/resource/v1/zz_generated.validations.go b/pkg/apis/resource/v1/zz_generated.validations.go
+index 5353b062bb69e..716aa0f343c96 100644
+--- a/pkg/apis/resource/v1/zz_generated.validations.go
++++ b/pkg/apis/resource/v1/zz_generated.validations.go
+@@ -190,7 +190,7 @@ func Validate_AllocatedDeviceStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -386,7 +386,7 @@ func Validate_Device(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_DeviceAttribute); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_DeviceAttribute); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -434,7 +434,7 @@ func Validate_Device(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1.DeviceCounterConsumption, b *resourcev1.DeviceCounterConsumption) bool {
+ 					return a.CounterSet == b.CounterSet
+-				}, validate.SemanticDeepEqual, Validate_DeviceCounterConsumption); len(e) != 0 {
++				}, deepEqualImpl_, Validate_DeviceCounterConsumption); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -570,7 +570,7 @@ func Validate_Device(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_NodeAllocatableResource); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_NodeAllocatableResource); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1108,7 +1108,7 @@ func Validate_DeviceClaim(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *resourcev1.DeviceRequest, b *resourcev1.DeviceRequest) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_DeviceRequest); len(e) != 0 {
++				func(a *resourcev1.DeviceRequest, b *resourcev1.DeviceRequest) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_DeviceRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1867,7 +1867,7 @@ func Validate_DeviceRequest(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *resourcev1.DeviceSubRequest, b *resourcev1.DeviceSubRequest) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_DeviceSubRequest); len(e) != 0 {
++				func(a *resourcev1.DeviceSubRequest, b *resourcev1.DeviceSubRequest) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_DeviceSubRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2506,7 +2506,7 @@ func Validate_DeviceTaintRuleStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3440,7 +3440,7 @@ func Validate_ResourceClaimStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1.AllocatedDeviceStatus, b *resourcev1.AllocatedDeviceStatus) bool {
+ 					return a.Driver == b.Driver && a.Device == b.Device && a.Pool == b.Pool && ((a.ShareID == nil && b.ShareID == nil) || (a.ShareID != nil && b.ShareID != nil && *a.ShareID == *b.ShareID))
+-				}, validate.SemanticDeepEqual, Validate_AllocatedDeviceStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_AllocatedDeviceStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3674,7 +3674,7 @@ func Validate_ResourceSliceSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *resourcev1.CounterSet, b *resourcev1.CounterSet) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_CounterSet); len(e) != 0 {
++				func(a *resourcev1.CounterSet, b *resourcev1.CounterSet) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_CounterSet); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3777,3 +3777,8 @@ func Validate_SkipNodeOperation(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/resource/v1alpha3/zz_generated.validations.go b/pkg/apis/resource/v1alpha3/zz_generated.validations.go
+index 26768c1f0834f..ec13b717c6ee4 100644
+--- a/pkg/apis/resource/v1alpha3/zz_generated.validations.go
++++ b/pkg/apis/resource/v1alpha3/zz_generated.validations.go
+@@ -277,7 +277,7 @@ func Validate_DeviceTaintRuleStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -776,7 +776,7 @@ func Validate_PoolStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1alpha3.PartitionTypeStatus, b *resourcev1alpha3.PartitionTypeStatus) bool {
+ 					return a.Attribute == b.Attribute && a.Type == b.Type
+-				}, validate.SemanticDeepEqual, Validate_PartitionTypeStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PartitionTypeStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1165,7 +1165,7 @@ func Validate_ResourcePoolStatusRequestStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1413,3 +1413,8 @@ func Validate_ShareableSummaryStatus(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/resource/v1beta1/zz_generated.validations.go b/pkg/apis/resource/v1beta1/zz_generated.validations.go
+index 62ab9a8bfc35c..c78f404aeddd8 100644
+--- a/pkg/apis/resource/v1beta1/zz_generated.validations.go
++++ b/pkg/apis/resource/v1beta1/zz_generated.validations.go
+@@ -175,7 +175,7 @@ func Validate_AllocatedDeviceStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -296,7 +296,7 @@ func Validate_BasicDevice(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_DeviceAttribute); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_DeviceAttribute); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -344,7 +344,7 @@ func Validate_BasicDevice(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1beta1.DeviceCounterConsumption, b *resourcev1beta1.DeviceCounterConsumption) bool {
+ 					return a.CounterSet == b.CounterSet
+-				}, validate.SemanticDeepEqual, Validate_DeviceCounterConsumption); len(e) != 0 {
++				}, deepEqualImpl_, Validate_DeviceCounterConsumption); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -480,7 +480,7 @@ func Validate_BasicDevice(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_NodeAllocatableResource); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_NodeAllocatableResource); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1132,7 +1132,7 @@ func Validate_DeviceClaim(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *resourcev1beta1.DeviceRequest, b *resourcev1beta1.DeviceRequest) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_DeviceRequest); len(e) != 0 {
++				func(a *resourcev1beta1.DeviceRequest, b *resourcev1beta1.DeviceRequest) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_DeviceRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1931,7 +1931,7 @@ func Validate_DeviceRequest(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1beta1.DeviceSubRequest, b *resourcev1beta1.DeviceSubRequest) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_DeviceSubRequest); len(e) != 0 {
++				}, deepEqualImpl_, Validate_DeviceSubRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3271,7 +3271,7 @@ func Validate_ResourceClaimStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1beta1.AllocatedDeviceStatus, b *resourcev1beta1.AllocatedDeviceStatus) bool {
+ 					return a.Driver == b.Driver && a.Device == b.Device && a.Pool == b.Pool && ((a.ShareID == nil && b.ShareID == nil) || (a.ShareID != nil && b.ShareID != nil && *a.ShareID == *b.ShareID))
+-				}, validate.SemanticDeepEqual, Validate_AllocatedDeviceStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_AllocatedDeviceStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3505,7 +3505,7 @@ func Validate_ResourceSliceSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *resourcev1beta1.CounterSet, b *resourcev1beta1.CounterSet) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_CounterSet); len(e) != 0 {
++				func(a *resourcev1beta1.CounterSet, b *resourcev1beta1.CounterSet) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_CounterSet); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3608,3 +3608,8 @@ func Validate_SkipNodeOperation(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/resource/v1beta2/zz_generated.validations.go b/pkg/apis/resource/v1beta2/zz_generated.validations.go
+index 5858ddd09b4f4..c4a76b3e8f07f 100644
+--- a/pkg/apis/resource/v1beta2/zz_generated.validations.go
++++ b/pkg/apis/resource/v1beta2/zz_generated.validations.go
+@@ -190,7 +190,7 @@ func Validate_AllocatedDeviceStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -386,7 +386,7 @@ func Validate_Device(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_DeviceAttribute); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_DeviceAttribute); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -434,7 +434,7 @@ func Validate_Device(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1beta2.DeviceCounterConsumption, b *resourcev1beta2.DeviceCounterConsumption) bool {
+ 					return a.CounterSet == b.CounterSet
+-				}, validate.SemanticDeepEqual, Validate_DeviceCounterConsumption); len(e) != 0 {
++				}, deepEqualImpl_, Validate_DeviceCounterConsumption); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -570,7 +570,7 @@ func Validate_Device(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_NodeAllocatableResource); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_NodeAllocatableResource); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1108,7 +1108,7 @@ func Validate_DeviceClaim(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *resourcev1beta2.DeviceRequest, b *resourcev1beta2.DeviceRequest) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_DeviceRequest); len(e) != 0 {
++				func(a *resourcev1beta2.DeviceRequest, b *resourcev1beta2.DeviceRequest) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_DeviceRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1871,7 +1871,7 @@ func Validate_DeviceRequest(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1beta2.DeviceSubRequest, b *resourcev1beta2.DeviceSubRequest) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_DeviceSubRequest); len(e) != 0 {
++				}, deepEqualImpl_, Validate_DeviceSubRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2510,7 +2510,7 @@ func Validate_DeviceTaintRuleStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3444,7 +3444,7 @@ func Validate_ResourceClaimStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1beta2.AllocatedDeviceStatus, b *resourcev1beta2.AllocatedDeviceStatus) bool {
+ 					return a.Driver == b.Driver && a.Device == b.Device && a.Pool == b.Pool && ((a.ShareID == nil && b.ShareID == nil) || (a.ShareID != nil && b.ShareID != nil && *a.ShareID == *b.ShareID))
+-				}, validate.SemanticDeepEqual, Validate_AllocatedDeviceStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_AllocatedDeviceStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3678,7 +3678,7 @@ func Validate_ResourceSliceSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *resourcev1beta2.CounterSet, b *resourcev1beta2.CounterSet) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_CounterSet); len(e) != 0 {
++				func(a *resourcev1beta2.CounterSet, b *resourcev1beta2.CounterSet) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_CounterSet); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3781,3 +3781,8 @@ func Validate_SkipNodeOperation(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/scheduling/v1alpha3/zz_generated.validations.go b/pkg/apis/scheduling/v1alpha3/zz_generated.validations.go
+index 797660524af64..ae573cfc6b99b 100644
+--- a/pkg/apis/scheduling/v1alpha3/zz_generated.validations.go
++++ b/pkg/apis/scheduling/v1alpha3/zz_generated.validations.go
+@@ -752,7 +752,7 @@ func Validate_CompositePodGroupStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1047,7 +1047,7 @@ func Validate_CompositePodGroupTemplate(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.PodGroupTemplate, b *schedulingv1alpha3.PodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1100,7 +1100,7 @@ func Validate_CompositePodGroupTemplate(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.CompositePodGroupTemplate, b *schedulingv1alpha3.CompositePodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_CompositePodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_CompositePodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1816,7 +1816,7 @@ func Validate_PodGroupSpec(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.PodGroupResourceClaim, b *schedulingv1alpha3.PodGroupResourceClaim) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupResourceClaim); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupResourceClaim); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2010,7 +2010,7 @@ func Validate_PodGroupStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2056,7 +2056,7 @@ func Validate_PodGroupStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.PodGroupResourceClaimStatus, b *schedulingv1alpha3.PodGroupResourceClaimStatus) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupResourceClaimStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupResourceClaimStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2210,7 +2210,7 @@ func Validate_PodGroupTemplate(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.PodGroupResourceClaim, b *schedulingv1alpha3.PodGroupResourceClaim) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupResourceClaim); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupResourceClaim); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3171,7 +3171,7 @@ func Validate_WorkloadSpec(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.PodGroupTemplate, b *schedulingv1alpha3.PodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3231,7 +3231,7 @@ func Validate_WorkloadSpec(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.CompositePodGroupTemplate, b *schedulingv1alpha3.CompositePodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_CompositePodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_CompositePodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3245,3 +3245,8 @@ func Validate_WorkloadSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/scheduling/v1beta1/zz_generated.validations.go b/pkg/apis/scheduling/v1beta1/zz_generated.validations.go
+index 6914741407314..ccc3d7ff6a927 100644
+--- a/pkg/apis/scheduling/v1beta1/zz_generated.validations.go
++++ b/pkg/apis/scheduling/v1beta1/zz_generated.validations.go
+@@ -632,7 +632,7 @@ func Validate_CompositePodGroupTemplate(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1beta1.PodGroupTemplate, b *schedulingv1beta1.PodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -685,7 +685,7 @@ func Validate_CompositePodGroupTemplate(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1beta1.CompositePodGroupTemplate, b *schedulingv1beta1.CompositePodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_CompositePodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_CompositePodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1401,7 +1401,7 @@ func Validate_PodGroupSpec(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1beta1.PodGroupResourceClaim, b *schedulingv1beta1.PodGroupResourceClaim) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupResourceClaim); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupResourceClaim); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1595,7 +1595,7 @@ func Validate_PodGroupStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1641,7 +1641,7 @@ func Validate_PodGroupStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1beta1.PodGroupResourceClaimStatus, b *schedulingv1beta1.PodGroupResourceClaimStatus) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupResourceClaimStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupResourceClaimStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1795,7 +1795,7 @@ func Validate_PodGroupTemplate(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1beta1.PodGroupResourceClaim, b *schedulingv1beta1.PodGroupResourceClaim) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupResourceClaim); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupResourceClaim); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2379,7 +2379,7 @@ func Validate_WorkloadSpec(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1beta1.PodGroupTemplate, b *schedulingv1beta1.PodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2439,7 +2439,7 @@ func Validate_WorkloadSpec(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1beta1.CompositePodGroupTemplate, b *schedulingv1beta1.CompositePodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_CompositePodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_CompositePodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2453,3 +2453,8 @@ func Validate_WorkloadSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/storagemigration/v1/zz_generated.validations.go b/pkg/apis/storagemigration/v1/zz_generated.validations.go
+index 3462185867b85..480bbb54c4f61 100644
+--- a/pkg/apis/storagemigration/v1/zz_generated.validations.go
++++ b/pkg/apis/storagemigration/v1/zz_generated.validations.go
+@@ -148,7 +148,7 @@ func Validate_StorageVersionMigrationStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -163,3 +163,8 @@ func Validate_StorageVersionMigrationStatus(
+ 	// field storagemigrationv1.StorageVersionMigrationStatus.ResourceVersion has no validation
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/storagemigration/v1beta1/zz_generated.validations.go b/pkg/apis/storagemigration/v1beta1/zz_generated.validations.go
+index 0f4a1e3feedd3..b76128cb3ba9f 100644
+--- a/pkg/apis/storagemigration/v1beta1/zz_generated.validations.go
++++ b/pkg/apis/storagemigration/v1beta1/zz_generated.validations.go
+@@ -148,7 +148,7 @@ func Validate_StorageVersionMigrationStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -163,3 +163,8 @@ func Validate_StorageVersionMigrationStatus(
+ 	// field storagemigrationv1beta1.StorageVersionMigrationStatus.ResourceVersion has no validation
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/api/resource/v1/zz_generated.validations.go b/staging/src/k8s.io/api/resource/v1/zz_generated.validations.go
+index b771d5b92a349..2c77f7412ac17 100644
+--- a/staging/src/k8s.io/api/resource/v1/zz_generated.validations.go
++++ b/staging/src/k8s.io/api/resource/v1/zz_generated.validations.go
+@@ -104,7 +104,7 @@ func Validate_AllocatedDeviceStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -300,7 +300,7 @@ func Validate_Device(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_DeviceAttribute); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_DeviceAttribute); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -348,7 +348,7 @@ func Validate_Device(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *DeviceCounterConsumption, b *DeviceCounterConsumption) bool {
+ 					return a.CounterSet == b.CounterSet
+-				}, validate.SemanticDeepEqual, Validate_DeviceCounterConsumption); len(e) != 0 {
++				}, deepEqualImpl_, Validate_DeviceCounterConsumption); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -484,7 +484,7 @@ func Validate_Device(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_NodeAllocatableResource); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_NodeAllocatableResource); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1022,7 +1022,7 @@ func Validate_DeviceClaim(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *DeviceRequest, b *DeviceRequest) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_DeviceRequest); len(e) != 0 {
++				func(a *DeviceRequest, b *DeviceRequest) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_DeviceRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1711,7 +1711,7 @@ func Validate_DeviceRequest(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *DeviceSubRequest, b *DeviceSubRequest) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_DeviceSubRequest); len(e) != 0 {
++				func(a *DeviceSubRequest, b *DeviceSubRequest) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_DeviceSubRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2273,7 +2273,7 @@ func Validate_DeviceTaintRuleStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3119,7 +3119,7 @@ func Validate_ResourceClaimStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *AllocatedDeviceStatus, b *AllocatedDeviceStatus) bool {
+ 					return a.Driver == b.Driver && a.Device == b.Device && a.Pool == b.Pool && ((a.ShareID == nil && b.ShareID == nil) || (a.ShareID != nil && b.ShareID != nil && *a.ShareID == *b.ShareID))
+-				}, validate.SemanticDeepEqual, Validate_AllocatedDeviceStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_AllocatedDeviceStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3243,7 +3243,7 @@ func Validate_ResourceSliceSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *CounterSet, b *CounterSet) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_CounterSet); len(e) != 0 {
++				func(a *CounterSet, b *CounterSet) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_CounterSet); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3346,3 +3346,8 @@ func Validate_SkipNodeOperation(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/api/scheduling/v1alpha3/zz_generated.validations.go b/staging/src/k8s.io/api/scheduling/v1alpha3/zz_generated.validations.go
+index 3202dbe2bea07..b7e1aa6954d65 100644
+--- a/staging/src/k8s.io/api/scheduling/v1alpha3/zz_generated.validations.go
++++ b/staging/src/k8s.io/api/scheduling/v1alpha3/zz_generated.validations.go
+@@ -696,7 +696,7 @@ func Validate_CompositePodGroupStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -985,7 +985,7 @@ func Validate_CompositePodGroupTemplate(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *PodGroupTemplate, b *PodGroupTemplate) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodGroupTemplate); len(e) != 0 {
++				func(a *PodGroupTemplate, b *PodGroupTemplate) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_PodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1032,7 +1032,7 @@ func Validate_CompositePodGroupTemplate(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *CompositePodGroupTemplate, b *CompositePodGroupTemplate) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_CompositePodGroupTemplate); len(e) != 0 {
++				func(a *CompositePodGroupTemplate, b *CompositePodGroupTemplate) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_CompositePodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1744,7 +1744,7 @@ func Validate_PodGroupSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *PodGroupResourceClaim, b *PodGroupResourceClaim) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodGroupResourceClaim); len(e) != 0 {
++				func(a *PodGroupResourceClaim, b *PodGroupResourceClaim) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_PodGroupResourceClaim); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1938,7 +1938,7 @@ func Validate_PodGroupStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1980,7 +1980,7 @@ func Validate_PodGroupStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *PodGroupResourceClaimStatus, b *PodGroupResourceClaimStatus) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodGroupResourceClaimStatus); len(e) != 0 {
++				func(a *PodGroupResourceClaimStatus, b *PodGroupResourceClaimStatus) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_PodGroupResourceClaimStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2130,7 +2130,7 @@ func Validate_PodGroupTemplate(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *PodGroupResourceClaim, b *PodGroupResourceClaim) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodGroupResourceClaim); len(e) != 0 {
++				func(a *PodGroupResourceClaim, b *PodGroupResourceClaim) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_PodGroupResourceClaim); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3298,7 +3298,7 @@ func Validate_WorkloadSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *PodGroupTemplate, b *PodGroupTemplate) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodGroupTemplate); len(e) != 0 {
++				func(a *PodGroupTemplate, b *PodGroupTemplate) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_PodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3352,7 +3352,7 @@ func Validate_WorkloadSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *CompositePodGroupTemplate, b *CompositePodGroupTemplate) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_CompositePodGroupTemplate); len(e) != 0 {
++				func(a *CompositePodGroupTemplate, b *CompositePodGroupTemplate) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_CompositePodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3366,3 +3366,8 @@ func Validate_WorkloadSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/apimachinery/pkg/api/validate/each.go b/staging/src/k8s.io/apimachinery/pkg/api/validate/each.go
+index 2930c21836cc7..affc44576bfee 100644
+--- a/staging/src/k8s.io/apimachinery/pkg/api/validate/each.go
++++ b/staging/src/k8s.io/apimachinery/pkg/api/validate/each.go
+@@ -18,6 +18,7 @@ package validate
+ 
+ import (
+ 	"context"
++	"reflect"
+ 	"slices"
+ 	"sort"
+ 
+@@ -163,6 +164,38 @@ func EachMapVal[K ~string, V any](ctx context.Context, op operation.Operation, f
+ 	return errs
+ }
+ 
++// EachPtrMapVal validates each value in newMap (which is a map of pointers)
++// using the specified validation function, passing the corresponding old value
++// from oldMap if the key exists in oldMap.
++// For update operations, it implements validation ratcheting by skipping validation
++// when the old value exists and the equiv function confirms the values are equivalent.
++//
++// The equiv function will never be called with nil arguments.
++//
++// If equiv is nil, value-based ratcheting is disabled and all values will be validated.
++func EachPtrMapVal[K ~string, V any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]*V,
++	equiv MatchFunc[*V], validator ValidateFunc[*V]) field.ErrorList {
++	var errs field.ErrorList
++	for key, val := range newMap {
++		if val == nil {
++			// Ignore nil items; they are supposed to have been checked by PtrMapNoNils.
++			continue
++		}
++
++		var old *V
++		if o, found := oldMap[key]; found {
++			old = o
++		}
++		// If the operation is an update, for validation ratcheting, skip re-validating if the old
++		// value is found and the equiv function confirms the values are equivalent.
++		if op.Type == operation.Update && old != nil && equiv != nil && equiv(val, old) {
++			continue
++		}
++		errs = append(errs, validator(ctx, op, fldPath.Key(string(key)), val, old)...)
++	}
++	return errs
++}
++
+ // EachMapKey validates each element of newMap with the specified
+ // validation function.
+ func EachMapKey[K ~string, T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]T,
+@@ -261,10 +294,22 @@ func PtrSliceUnique[T any](_ context.Context, _ operation.Operation, fldPath *fi
+ // arguments of type interface{}/any. The wrapper satisfies the type
+ // constraints of MatchFunc while leveraging the underlying semantic equality
+ // logic. It can be used by any other function that needs to call DeepEqual.
++//
++// Deprecated: Callers should use equality.Semantic.DeepEqual directly.
+ func SemanticDeepEqual[T any](a, b T) bool {
+ 	return equality.Semantic.DeepEqual(a, b)
+ }
+ 
++// ReflectDeepEqual is a MatchFunc that uses reflect.DeepEqual to compare two
++// values.
++// This wrapper is needed because MatchFunc requires a function that takes two
++// arguments of specific type T, while reflect.DeepEqual takes arguments of
++// type interface{}/any. It can be used by any other function that needs to
++// call DeepEqual.
++func ReflectDeepEqual[T any](a, b T) bool {
++	return reflect.DeepEqual(a, b)
++}
++
+ // DirectEqual is a MatchFunc that dereferences two pointers and uses the ==
+ // operator to compare the values. If both pointers are nil, it returns true.
+ // If one pointer is nil and the other is not, it returns false.
+@@ -290,3 +335,14 @@ func PtrSliceNoNils[T any](_ context.Context, _ operation.Operation, fldPath *fi
+ 	}
+ 	return
+ }
++
++// PtrMapNoNils returns a Required error for each nil element in a map of
++// pointers.
++func PtrMapNoNils[K ~string, V any](_ context.Context, _ operation.Operation, fldPath *field.Path, newMap, _ map[K]*V) (errs field.ErrorList) {
++	for key, val := range newMap {
++		if val == nil {
++			errs = append(errs, field.Required(fldPath.Key(string(key)), ""))
++		}
++	}
++	return
++}
+diff --git a/staging/src/k8s.io/apimachinery/pkg/api/validate/each_test.go b/staging/src/k8s.io/apimachinery/pkg/api/validate/each_test.go
+index 3b98fcb0460bd..a8b73ae6fccc3 100644
+--- a/staging/src/k8s.io/apimachinery/pkg/api/validate/each_test.go
++++ b/staging/src/k8s.io/apimachinery/pkg/api/validate/each_test.go
+@@ -137,7 +137,7 @@ func TestEachValSliceValRatcheting(t *testing.T) {
+ 		[]TestStruct{
+ 			{11, "a"}, {13, "c"}, {12, "b"},
+ 		},
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 		nil,
+ 	)
+ 	testEachValSliceValRatcheting(t, "ComparableStruct less data in new, exist in old",
+@@ -181,7 +181,7 @@ func TestEachValSliceValRatcheting(t *testing.T) {
+ 		[]NonComparableStruct{
+ 			{I: 11, S: []string{"a"}}, {I: 13, S: []string{"c"}}, {I: 12, S: []string{"b"}},
+ 		},
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 		nil,
+ 	)
+ 	testEachValSliceValRatcheting(t, "NonComparableStructWithKey same data different order",
+@@ -194,7 +194,7 @@ func TestEachValSliceValRatcheting(t *testing.T) {
+ 		MatchFunc[*NonComparableStructWithKey](func(a, b *NonComparableStructWithKey) bool {
+ 			return a.Key == b.Key
+ 		}),
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 	)
+ 
+ }
+@@ -276,7 +276,7 @@ func TestEachMapValRatcheting(t *testing.T) {
+ 			"three": {I: 13, S: []string{"c"}},
+ 			"two":   {I: 12, S: []string{"b"}},
+ 		},
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 		0,
+ 	)
+ 	testEachMapValRatcheting(t, "non comparable value, less data in new, exist in old",
+@@ -289,7 +289,7 @@ func TestEachMapValRatcheting(t *testing.T) {
+ 			"one":   {I: 11, S: []string{"a"}},
+ 			"three": {I: 13, S: []string{"c"}},
+ 		},
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 		0,
+ 	)
+ 	testEachMapValRatcheting(t, "non comparable value, new data, not exist in old",
+@@ -304,7 +304,7 @@ func TestEachMapValRatcheting(t *testing.T) {
+ 			"two":   {I: 12, S: []string{"b"}},
+ 			"four":  {I: 14, S: []string{"d"}},
+ 		},
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 		1,
+ 	)
+ 	testEachMapValRatcheting(t, "struct with pointer field, same value different pointer",
+@@ -316,7 +316,7 @@ func TestEachMapValRatcheting(t *testing.T) {
+ 			"one": {I: 11, P: new(1)},
+ 			"two": {I: 12, P: new(2)},
+ 		},
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 		0,
+ 	)
+ 	testEachMapValRatcheting(t, "nil map to empty map",
+@@ -364,6 +364,173 @@ func testEachMapValRatcheting[K ~string, V any](t *testing.T, name string, old,
+ 	})
+ }
+ 
++func TestEachPtrMapVal(t *testing.T) {
++	testEachPtrMapVal(t, "valid", map[string]*int{"one": new(11), "two": new(12), "three": new(13)})
++	testEachPtrMapVal(t, "valid", map[string]*string{"A": new("a"), "B": new("b"), "C": new("c")})
++	testEachPtrMapVal(t, "valid", map[string]*TestStruct{"one": {11, "a"}, "two": {12, "b"}, "three": {13, "c"}})
++
++	testEachPtrMapVal(t, "empty", map[string]*int{})
++	testEachPtrMapVal(t, "empty", map[string]*string{})
++	testEachPtrMapVal(t, "empty", map[string]*TestStruct{})
++
++	testEachPtrMapVal[int](t, "nil", nil)
++	testEachPtrMapVal[string](t, "nil", nil)
++	testEachPtrMapVal[TestStruct](t, "nil", nil)
++
++	t.Run("nil element ignored", func(t *testing.T) {
++		calls := 0
++		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *int) field.ErrorList {
++			calls++
++			return nil
++		}
++		input := map[string]*int{"a": new(1), "b": nil, "c": new(3)}
++		errs := EachPtrMapVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, vfn)
++		if len(errs) != 0 {
++			t.Errorf("expected 0 errors, got %d: %v", len(errs), errs)
++		}
++		if calls != 2 {
++			t.Errorf("expected 2 calls, got %d", calls)
++		}
++	})
++}
++
++func testEachPtrMapVal[T any](t *testing.T, name string, input map[string]*T) {
++	t.Helper()
++	var zero T
++	t.Run(fmt.Sprintf("%s(*%T)", name, zero), func(t *testing.T) {
++		calls := 0
++		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
++			if oldVal != nil {
++				t.Errorf("expected nil oldVal, got %v", *oldVal)
++			}
++			calls++
++			return nil
++		}
++		errs := EachPtrMapVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, vfn)
++		if len(errs) != 0 {
++			t.Errorf("expected 0 errors, got %d: %v", len(errs), errs)
++		}
++		if calls != len(input) {
++			t.Errorf("expected %d calls, got %d", len(input), calls)
++		}
++	})
++}
++
++func TestEachPtrMapValRatcheting(t *testing.T) {
++	testEachPtrMapValRatcheting(t, "primitive same data",
++		map[string]*int{"one": new(11), "two": new(12), "three": new(13)},
++		map[string]*int{"one": new(11), "three": new(13), "two": new(12)},
++		DirectEqual,
++		0,
++	)
++	testEachPtrMapValRatcheting(t, "primitive less data in new, exist in old",
++		map[string]*int{"one": new(11), "two": new(12), "three": new(13)},
++		map[string]*int{"one": new(11), "three": new(13)},
++		DirectEqual,
++		0,
++	)
++	testEachPtrMapValRatcheting(t, "primitive new data, not exist in old",
++		map[string]*int{"one": new(11), "two": new(12)},
++		map[string]*int{"one": new(11), "two": new(12), "three": new(13)},
++		DirectEqual,
++		1,
++	)
++	testEachPtrMapValRatcheting(t, "non comparable value, same data",
++		map[string]*NonComparableStruct{
++			"one":   {I: 11, S: []string{"a"}},
++			"two":   {I: 12, S: []string{"b"}},
++			"three": {I: 13, S: []string{"c"}},
++		},
++		map[string]*NonComparableStruct{
++			"one":   {I: 11, S: []string{"a"}},
++			"three": {I: 13, S: []string{"c"}},
++			"two":   {I: 12, S: []string{"b"}},
++		},
++		ReflectDeepEqual,
++		0,
++	)
++	testEachPtrMapValRatcheting(t, "non comparable value, less data in new, exist in old",
++		map[string]*NonComparableStruct{
++			"one":   {I: 11, S: []string{"a"}},
++			"two":   {I: 12, S: []string{"b"}},
++			"three": {I: 13, S: []string{"c"}},
++		},
++		map[string]*NonComparableStruct{
++			"one":   {I: 11, S: []string{"a"}},
++			"three": {I: 13, S: []string{"c"}},
++		},
++		ReflectDeepEqual,
++		0,
++	)
++	testEachPtrMapValRatcheting(t, "non comparable value, new data, not exist in old",
++		map[string]*NonComparableStruct{
++			"one":   {I: 11, S: []string{"a"}},
++			"two":   {I: 12, S: []string{"b"}},
++			"three": {I: 13, S: []string{"c"}},
++		},
++		map[string]*NonComparableStruct{
++			"one":   {I: 11, S: []string{"a"}},
++			"three": {I: 13, S: []string{"c"}},
++			"two":   {I: 12, S: []string{"b"}},
++			"four":  {I: 14, S: []string{"d"}},
++		},
++		ReflectDeepEqual,
++		1,
++	)
++	testEachPtrMapValRatcheting(t, "struct with pointer field, same value different pointer",
++		map[string]*NonComparableStructWithPtr{
++			"one": {I: 11, P: new(1)},
++			"two": {I: 12, P: new(2)},
++		},
++		map[string]*NonComparableStructWithPtr{
++			"one": {I: 11, P: new(1)},
++			"two": {I: 12, P: new(2)},
++		},
++		ReflectDeepEqual,
++		0,
++	)
++	testEachPtrMapValRatcheting(t, "nil map to empty map",
++		nil,
++		map[string]*int{},
++		DirectEqual,
++		0,
++	)
++	testEachPtrMapValRatcheting(t, "nil map to non-empty map",
++		nil,
++		map[string]*int{"one": new(1)},
++		DirectEqual,
++		1,
++	)
++	testEachPtrMapValRatcheting(t, "empty map to nil map",
++		map[string]*int{},
++		nil,
++		DirectEqual,
++		0,
++	)
++	testEachPtrMapValRatcheting(t, "non-empty map to nil map",
++		map[string]*int{"one": new(1)},
++		nil,
++		DirectEqual,
++		0,
++	)
++}
++
++func testEachPtrMapValRatcheting[K ~string, V any](t *testing.T, name string, old, new map[K]*V, equiv MatchFunc[*V], wantCalls int) {
++	t.Helper()
++	var zero V
++	t.Run(fmt.Sprintf("%s(*%T)", name, zero), func(t *testing.T) {
++		calls := 0
++		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *V) field.ErrorList {
++			calls++
++			return nil
++		}
++		_ = EachPtrMapVal(context.Background(), operation.Operation{Type: operation.Update}, field.NewPath("test"), new, old, equiv, vfn)
++		if calls != wantCalls {
++			t.Errorf("expected %d calls, got %d", wantCalls, calls)
++		}
++	})
++}
++
+ type StringType string
+ 
+ func TestEachMapKey(t *testing.T) {
+@@ -455,7 +622,7 @@ func testValSliceUnique[T comparable](t *testing.T, name string, input []T, want
+ 		}
+ 	})
+ 	t.Run(fmt.Sprintf("%s(reflect)", name), func(t *testing.T) {
+-		errs := ValSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, SemanticDeepEqual)
++		errs := ValSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, ReflectDeepEqual)
+ 		if len(errs) != wantErrs {
+ 			t.Errorf("expected %d errors, got %d: %s", wantErrs, len(errs), fmtErrs(errs))
+ 		}
+@@ -483,7 +650,7 @@ func testValSliceUniqueByReflect[T any](t *testing.T, name string, input []T, wa
+ 	t.Helper()
+ 	var zero T
+ 	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+-		errs := ValSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, SemanticDeepEqual)
++		errs := ValSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, ReflectDeepEqual)
+ 		if len(errs) != wantErrs {
+ 			t.Errorf("expected %d errors, got %d: %s", wantErrs, len(errs), fmtErrs(errs))
+ 		}
+@@ -573,7 +740,7 @@ func TestEachPtrSliceValRatcheting(t *testing.T) {
+ 	testEachPtrSliceValRatcheting(t, "ComparableStruct same data different order",
+ 		[]*TestStruct{{11, "a"}, {12, "b"}, {13, "c"}},
+ 		[]*TestStruct{{11, "a"}, {13, "c"}, {12, "b"}},
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 		nil,
+ 	)
+ }
+@@ -650,3 +817,30 @@ func TestPtrSliceNoNils(t *testing.T) {
+ 		})
+ 	}
+ }
++
++func TestPtrMapNoNils(t *testing.T) {
++	tests := []struct {
++		name     string
++		input    map[string]*int
++		wantErrs int
++	}{
++		{"nil", nil, 0},
++		{"empty", map[string]*int{}, 0},
++		{"no_nil", map[string]*int{"a": new(1), "b": new(2)}, 0},
++		{"has_nil", map[string]*int{"a": new(1), "b": nil, "c": new(3), "d": nil}, 2},
++	}
++
++	for _, tt := range tests {
++		t.Run(tt.name, func(t *testing.T) {
++			errs := PtrMapNoNils(context.Background(), operation.Operation{}, field.NewPath("test"), tt.input, nil)
++			if len(errs) != tt.wantErrs {
++				t.Errorf("expected %d errors, got %d: %v", tt.wantErrs, len(errs), errs)
++			}
++			for _, err := range errs {
++				if err.Type != field.ErrorTypeRequired {
++					t.Errorf("expected Required error, got %v", err.Type)
++				}
++			}
++		})
++	}
++}
+diff --git a/staging/src/k8s.io/apimachinery/pkg/api/validate/item_test.go b/staging/src/k8s.io/apimachinery/pkg/api/validate/item_test.go
+index 2efd68c0d2b0a..180b8da62c0cd 100644
+--- a/staging/src/k8s.io/apimachinery/pkg/api/validate/item_test.go
++++ b/staging/src/k8s.io/apimachinery/pkg/api/validate/item_test.go
+@@ -157,7 +157,7 @@ func TestValSliceItem(t *testing.T) {
+ 			op := operation.Operation{Type: operation.Update}
+ 			fp := field.NewPath("")
+ 
+-			got := ValSliceItem(ctx, op, fp, tc.new, tc.old, tc.match, SemanticDeepEqual, tc.validator)
++			got := ValSliceItem(ctx, op, fp, tc.new, tc.old, tc.match, ReflectDeepEqual, tc.validator)
+ 
+ 			if !reflect.DeepEqual(got, tc.expected) {
+ 				t.Errorf("got %v want %v", got, tc.expected)
+@@ -227,7 +227,7 @@ func TestPtrSliceItem(t *testing.T) {
+ 			op := operation.Operation{Type: operation.Update}
+ 			fp := field.NewPath("")
+ 
+-			got := PtrSliceItem(ctx, op, fp, tc.new, tc.old, tc.match, SemanticDeepEqual, tc.validator)
++			got := PtrSliceItem(ctx, op, fp, tc.new, tc.old, tc.match, ReflectDeepEqual, tc.validator)
+ 
+ 			if !reflect.DeepEqual(got, tc.expected) {
+ 				t.Errorf("got %v want %v", got, tc.expected)
+diff --git a/staging/src/k8s.io/apimachinery/pkg/api/validate/update.go b/staging/src/k8s.io/apimachinery/pkg/api/validate/update.go
+index c258e6d112c65..cf4db5b5294f1 100644
+--- a/staging/src/k8s.io/apimachinery/pkg/api/validate/update.go
++++ b/staging/src/k8s.io/apimachinery/pkg/api/validate/update.go
+@@ -42,8 +42,8 @@ const (
+ 	NoRemoveItem
+ )
+ 
+-// UpdateValueByCompare verifies update constraints for comparable value types.
+-func UpdateValueByCompare[T comparable](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
++// UpdateValue verifies update constraints for value types.
++func UpdateValue[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, equiv MatchFunc[T], constraints ...UpdateConstraint) field.ErrorList {
+ 	// nil oldValue means no prior value to compare against (eg: a new item at +k8s:eachVal scope) -> no transition to check.
+ 	if op.Type != operation.Update || oldValue == nil {
+ 		return nil
+@@ -51,22 +51,24 @@ func UpdateValueByCompare[T comparable](_ context.Context, op operation.Operatio
+ 
+ 	var errs field.ErrorList
+ 	var zero T
++	valueIsZero := equiv(*value, zero)
++	oldValueIsZero := equiv(*oldValue, zero)
+ 
+ 	for _, constraint := range constraints {
+ 		switch constraint {
+ 		case NoSet:
+-			if *oldValue == zero && *value != zero {
++			if oldValueIsZero && !valueIsZero {
+ 				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+ 			}
+ 		case NoUnset:
+-			if *oldValue != zero && *value == zero {
++			if !oldValueIsZero && valueIsZero {
+ 				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+ 			}
+ 		case NoModify:
+ 			// Rely on validation ratcheting to detect that the value has changed.
+ 			// This check only verifies that the field was set in both the old and
+ 			// new objects, confirming it was a modification, not a set/unset.
+-			if *oldValue != zero && *value != zero {
++			if !oldValueIsZero && !valueIsZero {
+ 				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be modified once set").WithOrigin("update"))
+ 			}
+ 		}
+@@ -75,6 +77,13 @@ func UpdateValueByCompare[T comparable](_ context.Context, op operation.Operatio
+ 	return errs
+ }
+ 
++// UpdateValueByCompare verifies update constraints for comparable value types.
++//
++// Deprecated: Use UpdateValue instead.
++func UpdateValueByCompare[T comparable](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
++	return UpdateValue(ctx, op, fldPath, value, oldValue, func(a, b T) bool { return a == b }, constraints...)
++}
++
+ // UpdatePointer verifies update constraints for pointer types.
+ func UpdatePointer[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+ 	if op.Type != operation.Update {
+@@ -107,38 +116,10 @@ func UpdatePointer[T any](_ context.Context, op operation.Operation, fldPath *fi
+ }
+ 
+ // UpdateValueByReflect verifies update constraints for non-comparable value types using reflection.
+-func UpdateValueByReflect[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+-	// nil oldValue means no prior value to compare against (eg: a new item at +k8s:eachVal scope) -> no transition to check.
+-	if op.Type != operation.Update || oldValue == nil {
+-		return nil
+-	}
+-
+-	var errs field.ErrorList
+-	var zero T
+-	valueIsZero := equality.Semantic.DeepEqual(*value, zero)
+-	oldValueIsZero := equality.Semantic.DeepEqual(*oldValue, zero)
+-
+-	for _, constraint := range constraints {
+-		switch constraint {
+-		case NoSet:
+-			if oldValueIsZero && !valueIsZero {
+-				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+-			}
+-		case NoUnset:
+-			if !oldValueIsZero && valueIsZero {
+-				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+-			}
+-		case NoModify:
+-			// Rely on validation ratcheting to detect that the value has changed.
+-			// This check only verifies that the field was set in both the old and
+-			// new objects, confirming it was a modification, not a set/unset.
+-			if !oldValueIsZero && !valueIsZero {
+-				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be modified once set").WithOrigin("update"))
+-			}
+-		}
+-	}
+-
+-	return errs
++//
++// Deprecated: Use UpdateValue instead.
++func UpdateValueByReflect[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
++	return UpdateValue(ctx, op, fldPath, value, oldValue, func(a, b T) bool { return equality.Semantic.DeepEqual(a, b) }, constraints...)
+ }
+ 
+ // UpdateStruct verifies update constraints for non-pointer struct types.
+diff --git a/staging/src/k8s.io/apimachinery/pkg/api/validate/update_test.go b/staging/src/k8s.io/apimachinery/pkg/api/validate/update_test.go
+index f9e13e0e99dd6..1978ced8d72ab 100644
+--- a/staging/src/k8s.io/apimachinery/pkg/api/validate/update_test.go
++++ b/staging/src/k8s.io/apimachinery/pkg/api/validate/update_test.go
+@@ -138,10 +138,153 @@ func TestUpdateValue(t *testing.T) {
+ 		},
+ 	}
+ 
++	for _, tt := range tests {
++		t.Run(tt.name, func(t *testing.T) {
++			op := operation.Operation{Type: tt.op}
++			errs := UpdateValue(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, func(a, b string) bool { return a == b }, tt.constraints...)
++			if len(errs) != tt.wantErrs {
++				t.Errorf("UpdateValue() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
++			}
++			for i, msg := range tt.wantMsgs {
++				if i >= len(errs) {
++					t.Errorf("Expected error message %q not found", msg)
++					continue
++				}
++				if errs[i].Detail != msg {
++					t.Errorf("UpdateValue() error message = %q, want %q", errs[i].Detail, msg)
++				}
++			}
++		})
++	}
++}
++
++func TestUpdateValueByCompare(t *testing.T) {
++	tests := []struct {
++		name        string
++		op          operation.Type
++		value       string
++		oldValue    string
++		constraints []UpdateConstraint
++		wantErrs    int
++		wantMsgs    []string
++	}{
++		{
++			name:        "NoSet - unset to set transition (forbidden)",
++			op:          operation.Update,
++			value:       "value",
++			oldValue:    "",
++			constraints: []UpdateConstraint{NoSet},
++			wantErrs:    1,
++			wantMsgs:    []string{"field cannot be set once created"},
++		},
++		{
++			name:        "NoUnset - set to unset transition (forbidden)",
++			op:          operation.Update,
++			value:       "",
++			oldValue:    "value",
++			constraints: []UpdateConstraint{NoUnset},
++			wantErrs:    1,
++			wantMsgs:    []string{"field cannot be cleared once set"},
++		},
++		{
++			name:        "NoModify - set to different value (forbidden)",
++			op:          operation.Update,
++			value:       "value2",
++			oldValue:    "value1",
++			constraints: []UpdateConstraint{NoModify},
++			wantErrs:    1,
++			wantMsgs:    []string{"field cannot be modified once set"},
++		},
++	}
++
+ 	for _, tt := range tests {
+ 		t.Run(tt.name, func(t *testing.T) {
+ 			op := operation.Operation{Type: tt.op}
+ 			errs := UpdateValueByCompare(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, tt.constraints...)
++			if len(errs) != tt.wantErrs {
++				t.Errorf("UpdateValueByCompare() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
++			}
++			for i, msg := range tt.wantMsgs {
++				if i >= len(errs) {
++					t.Errorf("Expected error message %q not found", msg)
++					continue
++				}
++				if errs[i].Detail != msg {
++					t.Errorf("UpdateValueByCompare() error message = %q, want %q", errs[i].Detail, msg)
++				}
++			}
++		})
++	}
++}
++
++func TestUpdateValue_CustomMatchFunc(t *testing.T) {
++	type NonComparableStruct struct {
++		Name string
++		Tags []string
++	}
++
++	customEquiv := func(a, b NonComparableStruct) bool {
++		return a.Name == b.Name && (len(a.Tags) == 0 && len(b.Tags) == 0 || (len(a.Tags) == len(b.Tags) && a.Tags[0] == b.Tags[0]))
++	}
++
++	tests := []struct {
++		name        string
++		op          operation.Type
++		value       NonComparableStruct
++		oldValue    NonComparableStruct
++		constraints []UpdateConstraint
++		wantErrs    int
++		wantMsgs    []string
++	}{
++		{
++			name:        "NoSet - unset to set (forbidden)",
++			op:          operation.Update,
++			value:       NonComparableStruct{Name: "foo", Tags: []string{"a"}},
++			oldValue:    NonComparableStruct{},
++			constraints: []UpdateConstraint{NoSet},
++			wantErrs:    1,
++			wantMsgs:    []string{"field cannot be set once created"},
++		},
++		{
++			name:        "NoUnset - set to unset (forbidden)",
++			op:          operation.Update,
++			value:       NonComparableStruct{},
++			oldValue:    NonComparableStruct{Name: "foo", Tags: []string{"a"}},
++			constraints: []UpdateConstraint{NoUnset},
++			wantErrs:    1,
++			wantMsgs:    []string{"field cannot be cleared once set"},
++		},
++		{
++			name:        "NoModify - zero to non-zero transition (allowed)",
++			op:          operation.Update,
++			value:       NonComparableStruct{Name: "foo", Tags: []string{"a"}},
++			oldValue:    NonComparableStruct{},
++			constraints: []UpdateConstraint{NoModify},
++			wantErrs:    0,
++		},
++		{
++			name:        "NoModify - non-zero to zero transition (allowed)",
++			op:          operation.Update,
++			value:       NonComparableStruct{},
++			oldValue:    NonComparableStruct{Name: "foo", Tags: []string{"a"}},
++			constraints: []UpdateConstraint{NoModify},
++			wantErrs:    0,
++		},
++		{
++			name:        "NoModify - non-zero to non-zero transition (forbidden)",
++			op:          operation.Update,
++			value:       NonComparableStruct{Name: "foo", Tags: []string{"b"}},
++			oldValue:    NonComparableStruct{Name: "foo", Tags: []string{"a"}},
++			constraints: []UpdateConstraint{NoModify},
++			wantErrs:    1,
++			wantMsgs:    []string{"field cannot be modified once set"},
++		},
++	}
++
++	for _, tt := range tests {
++		t.Run(tt.name, func(t *testing.T) {
++			op := operation.Operation{Type: tt.op}
++			errs := UpdateValue(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, customEquiv, tt.constraints...)
+ 			if len(errs) != tt.wantErrs {
+ 				t.Errorf("UpdateValue() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
+ 			}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/doc.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/doc.go
+index 25f869adadfb6..a8017edc07723 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/doc.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/doc.go
+@@ -39,6 +39,16 @@ type Struct struct {
+ 	MapTypedefField map[string]StringType `json:"mapTypedefField"`
+ 
+ 	UnvalidatedMapField map[string]string `json:"UnvalidatedMapField"`
++
++	// +k8s:validateFalse="field Struct.MapPtrField"
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrField[*]"
++	MapPtrField map[string]*string `json:"mapPtrField"`
++
++	// +k8s:validateFalse="field Struct.MapPtrTypedefField"
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrTypedefField[*]"
++	MapPtrTypedefField map[string]*StringType `json:"mapPtrTypedefField"`
++
++	UnvalidatedMapPtrField map[string]*string `json:"UnvalidatedMapPtrField"`
+ }
+ 
+ // +k8s:validateFalse="type StringType"
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/testdata/validate-false.json b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/testdata/validate-false.json
+index 5076a6fcff727..b7758a6448905 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/testdata/validate-false.json
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/testdata/validate-false.json
+@@ -12,6 +12,26 @@
+     "mapField[岯Ȉ\u0026\u003c沲3]": [
+       "field Struct.MapField[*]"
+     ],
++    "mapPtrField": [
++      "field Struct.MapPtrField"
++    ],
++    "mapPtrField[`ȝ懿沇]": [
++      "field Struct.MapPtrField[*]"
++    ],
++    "mapPtrField[ǝ祇Fæƭō]": [
++      "field Struct.MapPtrField[*]"
++    ],
++    "mapPtrTypedefField": [
++      "field Struct.MapPtrTypedefField"
++    ],
++    "mapPtrTypedefField[ʈ劉j蕓ư銩6ij憏歅%ɜ¤0Ȼ]": [
++      "field Struct.MapPtrTypedefField[*]",
++      "type StringType"
++    ],
++    "mapPtrTypedefField[剛ň=Z?ǿ\u003c]": [
++      "field Struct.MapPtrTypedefField[*]",
++      "type StringType"
++    ],
+     "mapTypedefField": [
+       "field Struct.MapTypedefField"
+     ],
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/zz_generated.validations.go
+index e2520a6146e80..a4c8f92c3abda 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/zz_generated.validations.go
+@@ -146,5 +146,87 @@ func Validate_Struct(
+ 	}
+ 
+ 	// field Struct.UnvalidatedMapField has no validation
++
++	{ // field Struct.MapPtrField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*string,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField"); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) map[string]*string {
++				return oldObj.MapPtrField
++			})
++		errs = append(errs, fn(fldPath.Child("mapPtrField"), obj.MapPtrField, oldVal, oldObj != nil)...)
++	}
++
++	{ // field Struct.MapPtrTypedefField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*StringType,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, StringType](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField"); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// iterate the map and call the value type's validation function
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_StringType); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) map[string]*StringType {
++				return oldObj.MapPtrTypedefField
++			})
++		errs = append(errs, fn(fldPath.Child("mapPtrTypedefField"), obj.MapPtrTypedefField, oldVal, oldObj != nil)...)
++	}
++
++	// field Struct.UnvalidatedMapPtrField has no validation
+ 	return errs
+ }
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/doc.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/doc.go
+index 4e39a1de8e8ab..2f771fb1deae0 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/doc.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/doc.go
+@@ -38,7 +38,17 @@ type Struct struct {
+ 	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapTypedefField[*]"
+ 	MapTypedefField map[string]OtherTypedefStruct `json:"mapTypedefField"`
+ 
+-	UnvalidatedMapField map[string]string `json:"UnvalidatedMapField"`
++	UnvalidatedMapField map[string]UnvalidatedStruct `json:"UnvalidatedMapField"`
++
++	// +k8s:validateFalse="field Struct.MapPtrField"
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrField[*]"
++	MapPtrField map[string]*OtherStruct `json:"mapPtrField"`
++
++	// +k8s:validateFalse="field Struct.MapPtrTypedefField"
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrTypedefField[*]"
++	MapPtrTypedefField map[string]*OtherTypedefStruct `json:"mapPtrTypedefField"`
++
++	UnvalidatedMapPtrField map[string]*UnvalidatedStruct `json:"UnvalidatedMapPtrField"`
+ }
+ 
+ // +k8s:validateFalse="type OtherStruct"
+@@ -46,3 +56,5 @@ type OtherStruct struct{}
+ 
+ // +k8s:validateFalse="type OtherTypedefStruct"
+ type OtherTypedefStruct OtherStruct
++
++type UnvalidatedStruct struct{}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/testdata/validate-false.json b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/testdata/validate-false.json
+index ec038cbc5e682..2253b92760894 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/testdata/validate-false.json
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/testdata/validate-false.json
+@@ -14,6 +14,28 @@
+       "field Struct.MapField[*]",
+       "type OtherStruct"
+     ],
++    "mapPtrField": [
++      "field Struct.MapPtrField"
++    ],
++    "mapPtrField[\u003eóDz岋笨Gń條]": [
++      "field Struct.MapPtrField[*]",
++      "type OtherStruct"
++    ],
++    "mapPtrField[]": [
++      "field Struct.MapPtrField[*]",
++      "type OtherStruct"
++    ],
++    "mapPtrTypedefField": [
++      "field Struct.MapPtrTypedefField"
++    ],
++    "mapPtrTypedefField[v$蛷)讻IeYF墄[C_睿ȉǫ蹟t´]": [
++      "field Struct.MapPtrTypedefField[*]",
++      "type OtherTypedefStruct"
++    ],
++    "mapPtrTypedefField[ș$0đ\u003eƯ]ɹȽ東]": [
++      "field Struct.MapPtrTypedefField[*]",
++      "type OtherTypedefStruct"
++    ],
+     "mapTypedefField": [
+       "field Struct.MapTypedefField"
+     ],
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/zz_generated.validations.go
+index 0b45bc834b4bd..ebe69b0254344 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/zz_generated.validations.go
+@@ -163,5 +163,91 @@ func Validate_Struct(
+ 	}
+ 
+ 	// field Struct.UnvalidatedMapField has no validation
++
++	{ // field Struct.MapPtrField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*OtherStruct,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, OtherStruct](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField"); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// iterate the map and call the value type's validation function
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_OtherStruct); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) map[string]*OtherStruct {
++				return oldObj.MapPtrField
++			})
++		errs = append(errs, fn(fldPath.Child("mapPtrField"), obj.MapPtrField, oldVal, oldObj != nil)...)
++	}
++
++	{ // field Struct.MapPtrTypedefField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*OtherTypedefStruct,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, OtherTypedefStruct](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField"); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherTypedefStruct) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// iterate the map and call the value type's validation function
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_OtherTypedefStruct); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) map[string]*OtherTypedefStruct {
++				return oldObj.MapPtrTypedefField
++			})
++		errs = append(errs, fn(fldPath.Child("mapPtrTypedefField"), obj.MapPtrTypedefField, oldVal, oldObj != nil)...)
++	}
++
++	// field Struct.UnvalidatedMapPtrField has no validation
+ 	return errs
+ }
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/doc.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/doc.go
+index d21f559c00da1..a4b62cc13e9e0 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/doc.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/doc.go
+@@ -29,20 +29,28 @@ var localSchemeBuilder = testscheme.New()
+ // Note: no validation here
+ type UnvalidatedType map[string]string
+ 
++// Note: no validation here
++type UnvalidatedPtrType map[string]*string
++
+ // +k8s:validateFalse="type MapType"
+ // +k8s:eachVal=+k8s:validateFalse="type MapType[*]"
+ type MapType map[string]string
+ 
+-// Note: no validation here
+-type UnvalidatedPtrType map[string]*string
+-
+-// +k8s:validateFalse="type StringType"
+-type StringType string
++// +k8s:validateFalse="type MapPtrType"
++// +k8s:eachVal=+k8s:validateFalse="type MapPtrType[*]"
++type MapPtrType map[string]*string
+ 
+ // +k8s:validateFalse="type MapTypedefType"
+ // +k8s:eachVal=+k8s:validateFalse="type MapTypedefType[*]"
+ type MapTypedefType map[string]StringType
+ 
++// +k8s:validateFalse="type MapPtrTypedefType"
++// +k8s:eachVal=+k8s:validateFalse="type MapPtrTypedefType[*]"
++type MapPtrTypedefType map[string]*StringType
++
++// +k8s:validateFalse="type StringType"
++type StringType string
++
+ // +k8s:validateFalse="type Struct"
+ type Struct struct {
+ 	TypeMeta int
+@@ -54,4 +62,16 @@ type Struct struct {
+ 	// +k8s:validateFalse="field Struct.MapTypedefField"
+ 	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapTypedefField[*]"
+ 	MapTypedefField MapTypedefType `json:"mapTypedefField"`
++
++	UnvalidatedMapField UnvalidatedType `json:"UnvalidatedMapField"`
++
++	// +k8s:validateFalse="field Struct.MapPtrField"
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrField[*]"
++	MapPtrField MapPtrType `json:"mapPtrField"`
++
++	// +k8s:validateFalse="field Struct.MapPtrTypedefField"
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrTypedefField[*]"
++	MapPtrTypedefField MapPtrTypedefType `json:"mapPtrTypedefField"`
++
++	UnvalidatedMapPtrField UnvalidatedPtrType `json:"UnvalidatedMapPtrField"`
+ }
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/testdata/validate-false.json b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/testdata/validate-false.json
+index c4b147c06f9f2..65a321116f417 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/testdata/validate-false.json
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/testdata/validate-false.json
+@@ -15,6 +15,32 @@
+       "field Struct.MapField[*]",
+       "type MapType[*]"
+     ],
++    "mapPtrField": [
++      "field Struct.MapPtrField",
++      "type MapPtrType"
++    ],
++    "mapPtrField[`ȝ懿沇]": [
++      "field Struct.MapPtrField[*]",
++      "type MapPtrType[*]"
++    ],
++    "mapPtrField[ǝ祇Fæƭō]": [
++      "field Struct.MapPtrField[*]",
++      "type MapPtrType[*]"
++    ],
++    "mapPtrTypedefField": [
++      "field Struct.MapPtrTypedefField",
++      "type MapPtrTypedefType"
++    ],
++    "mapPtrTypedefField[ʈ劉j蕓ư銩6ij憏歅%ɜ¤0Ȼ]": [
++      "field Struct.MapPtrTypedefField[*]",
++      "type MapPtrTypedefType[*]",
++      "type StringType"
++    ],
++    "mapPtrTypedefField[剛ň=Z?ǿ\u003c]": [
++      "field Struct.MapPtrTypedefField[*]",
++      "type MapPtrTypedefType[*]",
++      "type StringType"
++    ],
+     "mapTypedefField": [
+       "field Struct.MapTypedefField",
+       "type MapTypedefType"
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/zz_generated.validations.go
+index a5da56f4c5832..15a29c153d037 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/zz_generated.validations.go
+@@ -56,6 +56,49 @@ func RegisterValidations(scheme *testscheme.Scheme) error {
+ 	return nil
+ }
+ 
++// Validate_MapPtrType validates an instance of MapPtrType according
++// to declarative validation rules in the API schema.
++func Validate_MapPtrType(
++	ctx context.Context, op operation.Operation, fldPath *field.Path,
++	obj, oldObj MapPtrType) (errs field.ErrorList) {
++
++	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapPtrType"); len(e) != 0 {
++		errs = append(errs, e...)
++	}
++	if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
++			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapPtrType[*]")
++		}); len(e) != 0 {
++		errs = append(errs, e...)
++	}
++
++	return errs
++}
++
++// Validate_MapPtrTypedefType validates an instance of MapPtrTypedefType according
++// to declarative validation rules in the API schema.
++func Validate_MapPtrTypedefType(
++	ctx context.Context, op operation.Operation, fldPath *field.Path,
++	obj, oldObj MapPtrTypedefType) (errs field.ErrorList) {
++
++	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapPtrTypedefType"); len(e) != 0 {
++		errs = append(errs, e...)
++	}
++	if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
++			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapPtrTypedefType[*]")
++		}); len(e) != 0 {
++		errs = append(errs, e...)
++	}
++
++	// iterate the map and call the value type's validation function
++	if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_StringType); len(e) != 0 {
++		errs = append(errs, e...)
++	}
++
++	return errs
++}
++
+ // Validate_MapType validates an instance of MapType according
+ // to declarative validation rules in the API schema.
+ func Validate_MapType(
+@@ -188,5 +231,88 @@ func Validate_Struct(
+ 		errs = append(errs, fn(fldPath.Child("mapTypedefField"), obj.MapTypedefField, oldVal, oldObj != nil)...)
+ 	}
+ 
++	// field Struct.UnvalidatedMapField has no validation
++
++	{ // field Struct.MapPtrField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj MapPtrType,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField"); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// call the type's validation function
++			errs = append(errs, Validate_MapPtrType(ctx, op, fldPath, obj, oldObj)...)
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) MapPtrType {
++				return oldObj.MapPtrField
++			})
++		errs = append(errs, fn(fldPath.Child("mapPtrField"), obj.MapPtrField, oldVal, oldObj != nil)...)
++	}
++
++	{ // field Struct.MapPtrTypedefField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj MapPtrTypedefType,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, StringType](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField"); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// call the type's validation function
++			errs = append(errs, Validate_MapPtrTypedefType(ctx, op, fldPath, obj, oldObj)...)
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) MapPtrTypedefType {
++				return oldObj.MapPtrTypedefField
++			})
++		errs = append(errs, fn(fldPath.Child("mapPtrTypedefField"), obj.MapPtrTypedefField, oldVal, oldObj != nil)...)
++	}
++
++	// field Struct.UnvalidatedMapPtrField has no validation
+ 	return errs
+ }
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc.go
+new file mode 100644
+index 0000000000000..74beb7963a20c
+--- /dev/null
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc.go
+@@ -0,0 +1,54 @@
++/*
++Copyright The Kubernetes Authors.
++
++Licensed under the Apache License, Version 2.0 (the "License");
++you may not use this file except in compliance with the License.
++You may obtain a copy of the License at
++
++    http://www.apache.org/licenses/LICENSE-2.0
++
++Unless required by applicable law or agreed to in writing, software
++distributed under the License is distributed on an "AS IS" BASIS,
++WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++See the License for the specific language governing permissions and
++limitations under the License.
++*/
++
++// +k8s:validation-gen=TypesWithField=TypeMeta
++// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
++// +k8s:validation-gen-deep-equal-func=k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func.CustomDeepEqual
++
++// This is a test package.
++// +k8s:validation-gen-nolint
++package deepequalfunc
++
++import (
++	"reflect"
++
++	"k8s.io/code-generator/cmd/validation-gen/testscheme"
++)
++
++var localSchemeBuilder = testscheme.New()
++
++var CustomDeepEqualCalls int
++
++func CustomDeepEqual(a, b any) bool {
++	CustomDeepEqualCalls++
++	return reflect.DeepEqual(a, b)
++}
++
++type Struct struct {
++	TypeMeta int
++
++	// +k8s:validateFalse="field Struct.NonComparableField"
++	NonComparableField NonComparableStruct `json:"nonComparableField"`
++
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapField[*]"
++	MapField map[string]NonComparableStruct `json:"mapField"`
++}
++
++// +k8s:validateFalse="type NonComparableStruct"
++type NonComparableStruct struct {
++	// Ptr makes it not direct-comparable
++	Ptr *int `json:"ptr"`
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc_test.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc_test.go
+new file mode 100644
+index 0000000000000..595e71d26c1bd
+--- /dev/null
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc_test.go
+@@ -0,0 +1,71 @@
++/*
++Copyright The Kubernetes Authors.
++
++Licensed under the Apache License, Version 2.0 (the "License");
++you may not use this file except in compliance with the License.
++You may obtain a copy of the License at
++
++    http://www.apache.org/licenses/LICENSE-2.0
++
++Unless required by applicable law or agreed to in writing, software
++distributed under the License is distributed on an "AS IS" BASIS,
++WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++See the License for the specific language governing permissions and
++limitations under the License.
++*/
++
++package deepequalfunc
++
++import (
++	"testing"
++)
++
++func TestDeepEqualFunc(t *testing.T) {
++	st := localSchemeBuilder.Test(t)
++
++	// Create
++	val1 := 10
++	obj := &Struct{
++		NonComparableField: NonComparableStruct{Ptr: &val1},
++		MapField: map[string]NonComparableStruct{
++			"a": {Ptr: &val1},
++		},
++	}
++	st.Value(obj).ExpectValidateFalseByPath(map[string][]string{
++		"nonComparableField": {"field Struct.NonComparableField", "type NonComparableStruct"},
++		"mapField[a]":        {"field Struct.MapField[*]", "type NonComparableStruct"},
++	})
++
++	// Update with same values should ratchet (skip validation) using CustomDeepEqual
++	CustomDeepEqualCalls = 0
++	oldObj := &Struct{
++		NonComparableField: NonComparableStruct{Ptr: &val1},
++		MapField: map[string]NonComparableStruct{
++			"a": {Ptr: &val1},
++		},
++	}
++	newObj := &Struct{
++		NonComparableField: NonComparableStruct{Ptr: &val1},
++		MapField: map[string]NonComparableStruct{
++			"a": {Ptr: &val1},
++		},
++	}
++	st.Value(newObj).OldValue(oldObj).ExpectValid()
++	if CustomDeepEqualCalls == 0 {
++		t.Errorf("expected CustomDeepEqual to be called during update ratcheting, got %d calls", CustomDeepEqualCalls)
++	}
++
++	// Update with a new map key added: old key "a" ratchets via deepEqualImpl_ -> CustomDeepEqual,
++	// only new key "b" fails.
++	val2 := 20
++	updateObj := &Struct{
++		NonComparableField: NonComparableStruct{Ptr: &val1},
++		MapField: map[string]NonComparableStruct{
++			"a": {Ptr: &val1},
++			"b": {Ptr: &val2},
++		},
++	}
++	st.Value(updateObj).OldValue(oldObj).ExpectValidateFalseByPath(map[string][]string{
++		"mapField[b]": {"field Struct.MapField[*]", "type NonComparableStruct"},
++	})
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/zz_generated.validations.go
+new file mode 100644
+index 0000000000000..2ec646bb0e067
+--- /dev/null
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/zz_generated.validations.go
+@@ -0,0 +1,143 @@
++//go:build !ignore_autogenerated
++// +build !ignore_autogenerated
++
++/*
++Copyright The Kubernetes Authors.
++
++Licensed under the Apache License, Version 2.0 (the "License");
++you may not use this file except in compliance with the License.
++You may obtain a copy of the License at
++
++    http://www.apache.org/licenses/LICENSE-2.0
++
++Unless required by applicable law or agreed to in writing, software
++distributed under the License is distributed on an "AS IS" BASIS,
++WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++See the License for the specific language governing permissions and
++limitations under the License.
++*/
++
++// Code generated by validation-gen. DO NOT EDIT.
++
++package deepequalfunc
++
++import (
++	context "context"
++	fmt "fmt"
++
++	operation "k8s.io/apimachinery/pkg/api/operation"
++	safe "k8s.io/apimachinery/pkg/api/safe"
++	validate "k8s.io/apimachinery/pkg/api/validate"
++	field "k8s.io/apimachinery/pkg/util/validation/field"
++	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
++)
++
++func init() { localSchemeBuilder.Register(RegisterValidations) }
++
++// RegisterValidations adds validation functions to the given scheme.
++// Public to allow building arbitrary schemes.
++func RegisterValidations(scheme *testscheme.Scheme) error {
++	// type Struct
++	scheme.AddValidationFunc(
++		(*Struct)(nil),
++		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
++			switch op.Request.SubresourcePath() {
++			case "/":
++				return Validate_Struct(
++					ctx, op, nil, /* fldPath */
++					obj.(*Struct),
++					safe.Cast[*Struct](oldObj))
++			}
++			return field.ErrorList{
++				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
++			}
++		})
++	return nil
++}
++
++// Validate_NonComparableStruct validates an instance of NonComparableStruct according
++// to declarative validation rules in the API schema.
++func Validate_NonComparableStruct(
++	ctx context.Context, op operation.Operation, fldPath *field.Path,
++	obj, oldObj *NonComparableStruct) (errs field.ErrorList) {
++
++	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type NonComparableStruct"); len(e) != 0 {
++		errs = append(errs, e...)
++	}
++
++	// field NonComparableStruct.Ptr has no validation
++	return errs
++}
++
++// Validate_Struct validates an instance of Struct according
++// to declarative validation rules in the API schema.
++func Validate_Struct(
++	ctx context.Context, op operation.Operation, fldPath *field.Path,
++	obj, oldObj *Struct) (errs field.ErrorList) {
++
++	// field Struct.TypeMeta has no validation
++
++	{ // field Struct.NonComparableField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj *NonComparableStruct,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if CustomDeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.NonComparableField"); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// call the type's validation function
++			errs = append(errs, Validate_NonComparableStruct(ctx, op, fldPath, obj, oldObj)...)
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) *NonComparableStruct {
++				return &oldObj.NonComparableField
++			})
++		errs = append(errs, fn(fldPath.Child("nonComparableField"), &obj.NonComparableField, oldVal, oldObj != nil)...)
++	}
++
++	{ // field Struct.MapField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]NonComparableStruct,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if CustomDeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// iterate the map and call the value type's validation function
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_NonComparableStruct); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) map[string]NonComparableStruct {
++				return oldObj.MapField
++			})
++		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
++	}
++
++	return errs
++}
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return CustomDeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/zz_generated.validations.go
+index eb7d8cd0c62dd..9b6ecf48a5b03 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/zz_generated.validations.go
+@@ -133,7 +133,7 @@ func Validate_ItemList(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *Item, b *Item) bool { return a.Key == b.Key }, validate.SemanticDeepEqual, Validate_Item); len(e) != 0 {
++				func(a *Item, b *Item) bool { return a.Key == b.Key }, deepEqualImpl_, Validate_Item); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -371,18 +371,18 @@ func Validate_StructSlice(
+ 				}
+ 			}
+ 			// call field-attached validations
+-			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, nil,
++			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, nil,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
+ 					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field SetSliceNonComparableField[*]")
+ 				}); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			// lists with set semantics require unique values
+-			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual); len(e) != 0 {
++			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			// iterate the list and call the type's validation function
+-			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, nil, Validate_NonComparableStruct); len(e) != 0 {
++			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, nil, Validate_NonComparableStruct); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -440,7 +440,7 @@ func Validate_StructSlice(
+ 			}
+ 			// call field-attached validations
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *NonComparableStructWithKey, b *NonComparableStructWithKey) bool { return a.Key == b.Key }, validate.SemanticDeepEqual,
++				func(a *NonComparableStructWithKey, b *NonComparableStructWithKey) bool { return a.Key == b.Key }, deepEqualImpl_,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStructWithKey) field.ErrorList {
+ 					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapSliceNonComparableField[*]")
+ 				}); len(e) != 0 {
+@@ -453,7 +453,7 @@ func Validate_StructSlice(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *NonComparableStructWithKey, b *NonComparableStructWithKey) bool { return a.Key == b.Key }, validate.SemanticDeepEqual, Validate_NonComparableStructWithKey); len(e) != 0 {
++				func(a *NonComparableStructWithKey, b *NonComparableStructWithKey) bool { return a.Key == b.Key }, deepEqualImpl_, Validate_NonComparableStructWithKey); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -480,7 +480,7 @@ func Validate_StructSlice(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *PtrKeyStruct, b *PtrKeyStruct) bool {
+ 					return ((a.Key == nil && b.Key == nil) || (a.Key != nil && b.Key != nil && *a.Key == *b.Key))
+-				}, validate.SemanticDeepEqual,
++				}, deepEqualImpl_,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *PtrKeyStruct) field.ErrorList {
+ 					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapSlicePtrKeyField[*]")
+ 				}); len(e) != 0 {
+@@ -497,7 +497,7 @@ func Validate_StructSlice(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *PtrKeyStruct, b *PtrKeyStruct) bool {
+ 					return ((a.Key == nil && b.Key == nil) || (a.Key != nil && b.Key != nil && *a.Key == *b.Key))
+-				}, validate.SemanticDeepEqual, Validate_PtrKeyStruct); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PtrKeyStruct); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -524,7 +524,7 @@ func Validate_StructSlice(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *MixedKeyStruct, b *MixedKeyStruct) bool {
+ 					return ((a.Key1 == nil && b.Key1 == nil) || (a.Key1 != nil && b.Key1 != nil && *a.Key1 == *b.Key1)) && a.Key2 == b.Key2
+-				}, validate.SemanticDeepEqual,
++				}, deepEqualImpl_,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MixedKeyStruct) field.ErrorList {
+ 					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapSliceMixedKeyField[*]")
+ 				}); len(e) != 0 {
+@@ -541,7 +541,7 @@ func Validate_StructSlice(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *MixedKeyStruct, b *MixedKeyStruct) bool {
+ 					return ((a.Key1 == nil && b.Key1 == nil) || (a.Key1 != nil && b.Key1 != nil && *a.Key1 == *b.Key1)) && a.Key2 == b.Key2
+-				}, validate.SemanticDeepEqual, Validate_MixedKeyStruct); len(e) != 0 {
++				}, deepEqualImpl_, Validate_MixedKeyStruct); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -555,3 +555,8 @@ func Validate_StructSlice(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/zz_generated.validations.go
+index e9364e922abcb..183797afbb0c9 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/zz_generated.validations.go
+@@ -157,7 +157,7 @@ func Validate_StructWithMaps(
+ 				}
+ 			}
+ 			// call field-attached validations
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual,
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
+ 					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapTest.MapNonComparableStructField[*]")
+ 				}); len(e) != 0 {
+@@ -174,3 +174,8 @@ func Validate_StructWithMaps(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/zz_generated.validations.go
+index 8dea5b21bba98..0c9ae1e747285 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/zz_generated.validations.go
+@@ -193,7 +193,7 @@ func Validate_T1(
+ 				}
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_T5); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T5); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -217,7 +217,7 @@ func Validate_T1(
+ 				}
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_T6); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T6); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -250,7 +250,7 @@ func Validate_T2(
+ 				}
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_T1); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T1); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -318,7 +318,7 @@ func Validate_T4(
+ 				}
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_T3); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T3); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -355,7 +355,7 @@ func Validate_T5(
+ 				errs = append(errs, e...)
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_T5); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T5); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -412,7 +412,7 @@ func Validate_T6(
+ 				}
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_T6); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T6); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -426,3 +426,8 @@ func Validate_T6(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc.go
+new file mode 100644
+index 0000000000000..dfa903970c25e
+--- /dev/null
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc.go
+@@ -0,0 +1,41 @@
++/*
++Copyright The Kubernetes Authors.
++
++Licensed under the Apache License, Version 2.0 (the "License");
++you may not use this file except in compliance with the License.
++You may obtain a copy of the License at
++
++    http://www.apache.org/licenses/LICENSE-2.0
++
++Unless required by applicable law or agreed to in writing, software
++distributed under the License is distributed on an "AS IS" BASIS,
++WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++See the License for the specific language governing permissions and
++limitations under the License.
++*/
++
++// +k8s:validation-gen=TypesWithField=TypeMeta
++// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
++
++// This is a test package.
++// +k8s:validation-gen-nolint
++package mapofpointers
++
++import "k8s.io/code-generator/cmd/validation-gen/testscheme"
++
++var localSchemeBuilder = testscheme.New()
++
++type Struct struct {
++	TypeMeta int
++
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapField[*]"
++	MapField map[string]*OtherStruct `json:"mapField"`
++
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPrimitiveField[*]"
++	MapPrimitiveField map[string]*string `json:"mapPrimitiveField"`
++}
++
++// +k8s:validateFalse="type OtherStruct"
++type OtherStruct struct {
++	Value string `json:"value"`
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc_test.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc_test.go
+new file mode 100644
+index 0000000000000..b9e93fe5666a8
+--- /dev/null
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc_test.go
+@@ -0,0 +1,52 @@
++/*
++Copyright The Kubernetes Authors.
++
++Licensed under the Apache License, Version 2.0 (the "License");
++you may not use this file except in compliance with the License.
++You may obtain a copy of the License at
++
++    http://www.apache.org/licenses/LICENSE-2.0
++
++Unless required by applicable law or agreed to in writing, software
++distributed under the License is distributed on an "AS IS" BASIS,
++WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++See the License for the specific language governing permissions and
++limitations under the License.
++*/
++
++package mapofpointers
++
++import (
++	"testing"
++
++	"k8s.io/apimachinery/pkg/util/validation/field"
++)
++
++func Test(t *testing.T) {
++	st := localSchemeBuilder.Test(t)
++
++	// 1. Zero values should be valid
++	st.Value(&Struct{
++		// All zero values.
++	}).ExpectValid()
++
++	// 2. Non-nil elements trigger validation errors
++	st.Value(&Struct{
++		MapField:          map[string]*OtherStruct{"k1": {}, "k2": {}},
++		MapPrimitiveField: map[string]*string{"k1": new("a"), "k2": new("b")},
++	}).ExpectValidateFalseByPath(map[string][]string{
++		"mapField[k1]":          {"field Struct.MapField[*]", "type OtherStruct"},
++		"mapField[k2]":          {"field Struct.MapField[*]", "type OtherStruct"},
++		"mapPrimitiveField[k1]": {"field Struct.MapPrimitiveField[*]"},
++		"mapPrimitiveField[k2]": {"field Struct.MapPrimitiveField[*]"},
++	})
++
++	// 3. Nil elements trigger Required errors from PtrMapNoNils
++	st.Value(&Struct{
++		MapField:          map[string]*OtherStruct{"k1": nil},
++		MapPrimitiveField: map[string]*string{"k1": nil},
++	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
++		field.Required(field.NewPath("mapField").Key("k1"), ""),
++		field.Required(field.NewPath("mapPrimitiveField").Key("k1"), ""),
++	})
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/zz_generated.validations.go
+new file mode 100644
+index 0000000000000..641eb0e3fc9b9
+--- /dev/null
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/zz_generated.validations.go
+@@ -0,0 +1,156 @@
++//go:build !ignore_autogenerated
++// +build !ignore_autogenerated
++
++/*
++Copyright The Kubernetes Authors.
++
++Licensed under the Apache License, Version 2.0 (the "License");
++you may not use this file except in compliance with the License.
++You may obtain a copy of the License at
++
++    http://www.apache.org/licenses/LICENSE-2.0
++
++Unless required by applicable law or agreed to in writing, software
++distributed under the License is distributed on an "AS IS" BASIS,
++WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++See the License for the specific language governing permissions and
++limitations under the License.
++*/
++
++// Code generated by validation-gen. DO NOT EDIT.
++
++package mapofpointers
++
++import (
++	context "context"
++	fmt "fmt"
++
++	equality "k8s.io/apimachinery/pkg/api/equality"
++	operation "k8s.io/apimachinery/pkg/api/operation"
++	safe "k8s.io/apimachinery/pkg/api/safe"
++	validate "k8s.io/apimachinery/pkg/api/validate"
++	field "k8s.io/apimachinery/pkg/util/validation/field"
++	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
++)
++
++func init() { localSchemeBuilder.Register(RegisterValidations) }
++
++// RegisterValidations adds validation functions to the given scheme.
++// Public to allow building arbitrary schemes.
++func RegisterValidations(scheme *testscheme.Scheme) error {
++	// type Struct
++	scheme.AddValidationFunc(
++		(*Struct)(nil),
++		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
++			switch op.Request.SubresourcePath() {
++			case "/":
++				return Validate_Struct(
++					ctx, op, nil, /* fldPath */
++					obj.(*Struct),
++					safe.Cast[*Struct](oldObj))
++			}
++			return field.ErrorList{
++				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
++			}
++		})
++	return nil
++}
++
++// Validate_OtherStruct validates an instance of OtherStruct according
++// to declarative validation rules in the API schema.
++func Validate_OtherStruct(
++	ctx context.Context, op operation.Operation, fldPath *field.Path,
++	obj, oldObj *OtherStruct) (errs field.ErrorList) {
++
++	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type OtherStruct"); len(e) != 0 {
++		errs = append(errs, e...)
++	}
++
++	// field OtherStruct.Value has no validation
++	return errs
++}
++
++// Validate_Struct validates an instance of Struct according
++// to declarative validation rules in the API schema.
++func Validate_Struct(
++	ctx context.Context, op operation.Operation, fldPath *field.Path,
++	obj, oldObj *Struct) (errs field.ErrorList) {
++
++	// field Struct.TypeMeta has no validation
++
++	{ // field Struct.MapField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*OtherStruct,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, OtherStruct](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// iterate the map and call the value type's validation function
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_OtherStruct); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) map[string]*OtherStruct {
++				return oldObj.MapField
++			})
++		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
++	}
++
++	{ // field Struct.MapPrimitiveField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*string,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPrimitiveField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) map[string]*string {
++				return oldObj.MapPrimitiveField
++			})
++		errs = append(errs, fn(fldPath.Child("mapPrimitiveField"), obj.MapPrimitiveField, oldVal, oldObj != nil)...)
++	}
++
++	return errs
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/zz_generated.validations.go
+index 85cc57c4600f8..78c8f3462e128 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/zz_generated.validations.go
+@@ -168,7 +168,7 @@ func Validate_Struct(
+ 				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+ 					func(item *PtrItem) bool {
+ 						return item.StringKey != nil && *item.StringKey == "target-ptr" && item.IntKey == 42 && item.BoolKey == true
+-					}, validate.SemanticDeepEqual,
++					}, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *PtrItem) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item PtrItems[stringKey=target-ptr,intKey=42,boolKey=true]")
+ 					}); len(e) != 0 {
+@@ -207,7 +207,7 @@ func Validate_Struct(
+ 				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+ 					func(item *MixedPtrItem) bool {
+ 						return item.StringPtrKey != nil && *item.StringPtrKey == "target-ptr" && item.StringKey == "target"
+-					}, validate.SemanticDeepEqual,
++					}, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MixedPtrItem) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item MixedPtrItems")
+ 					}); len(e) != 0 {
+@@ -225,3 +225,8 @@ func Validate_Struct(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/zz_generated.validations.go
+index 870b19161765c..9556a0689460c 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/zz_generated.validations.go
+@@ -303,7 +303,7 @@ func Validate_Struct(
+ 			}
+ 			func() { // cohort = "{"key": "target-ptr"}"
+ 				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+-					func(item *PtrKeyItem) bool { return item.Key != nil && *item.Key == "target-ptr" }, validate.SemanticDeepEqual,
++					func(item *PtrKeyItem) bool { return item.Key != nil && *item.Key == "target-ptr" }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *PtrKeyItem) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item PtrKeyItems[key=target-ptr]")
+ 					}); len(e) != 0 {
+@@ -410,3 +410,8 @@ func Validate_StructWithNestedTypedef(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/zz_generated.validations.go
+index 40c4c8a1d6ca0..c176df16c859d 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/zz_generated.validations.go
+@@ -219,7 +219,8 @@ func Validate_SpecialValidationStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoModify).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -248,7 +249,8 @@ func Validate_SpecialValidationStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkBeta().MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoModify).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/zz_generated.validations.go
+index 8e9c0e99c504f..bd1654a64c5f1 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/zz_generated.validations.go
+@@ -245,7 +245,7 @@ func Validate_Struct(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *NonComparableStruct, b *NonComparableStruct) bool {
+ 					return a.Key1Field == b.Key1Field && a.Key2Field == b.Key2Field
+-				}, validate.SemanticDeepEqual,
++				}, deepEqualImpl_,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
+ 					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListNonComparableField[*]")
+ 				}); len(e) != 0 {
+@@ -290,7 +290,7 @@ func Validate_Struct(
+ 				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+ 					func(item *PtrKeyStruct) bool {
+ 						return item.Key1Field != nil && *item.Key1Field == "target-ptr" && item.Key2Field == 42
+-					}, validate.SemanticDeepEqual,
++					}, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *PtrKeyStruct) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item ListPtrKeyField[key1Field=target-ptr,key2Field=42]")
+ 					}); len(e) != 0 {
+@@ -329,7 +329,7 @@ func Validate_Struct(
+ 				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+ 					func(item *MixedPtrKeyStruct) bool {
+ 						return item.StringPtrKey != nil && *item.StringPtrKey == "target-ptr" && item.StringKey == "target"
+-					}, validate.SemanticDeepEqual,
++					}, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MixedPtrKeyStruct) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item ListMixedPtrKeyField")
+ 					}); len(e) != 0 {
+@@ -347,3 +347,8 @@ func Validate_Struct(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/zz_generated.validations.go
+index 79c4099dfb3e0..fb48c34721b80 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/zz_generated.validations.go
+@@ -227,7 +227,7 @@ func Validate_Struct(
+ 			}
+ 			// call field-attached validations
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *NonComparableStruct, b *NonComparableStruct) bool { return a.KeyField == b.KeyField }, validate.SemanticDeepEqual,
++				func(a *NonComparableStruct, b *NonComparableStruct) bool { return a.KeyField == b.KeyField }, deepEqualImpl_,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
+ 					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListNonComparableField[*]")
+ 				}); len(e) != 0 {
+@@ -277,3 +277,8 @@ func Validate_Struct(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/zz_generated.validations.go
+index 8a8b743054e9d..77b155ffdda58 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/zz_generated.validations.go
+@@ -183,7 +183,7 @@ func Validate_ImmutableStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, nil, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, nil, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -191,7 +191,7 @@ func Validate_ImmutableStruct(
+ 				return // do not proceed
+ 			}
+ 			// lists with set semantics require unique values
+-			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual); len(e) != 0 {
++			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -278,7 +278,7 @@ func Validate_ImmutableStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, nil, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, nil, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -286,7 +286,7 @@ func Validate_ImmutableStruct(
+ 				return // do not proceed
+ 			}
+ 			// lists with set semantics require unique values
+-			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual); len(e) != 0 {
++			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -397,7 +397,7 @@ func Validate_Struct(
+ 			}
+ 			// call field-attached validations
+ 			// lists with set semantics require unique values
+-			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual); len(e) != 0 {
++			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -422,7 +422,7 @@ func Validate_Struct(
+ 			}
+ 			// call field-attached validations
+ 			// lists with set semantics require unique values
+-			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual); len(e) != 0 {
++			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -436,3 +436,8 @@ func Validate_Struct(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/zz_generated.validations.go
+index 00cd01fb9ceae..d3968299c2140 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/zz_generated.validations.go
+@@ -25,6 +25,7 @@ import (
+ 	context "context"
+ 	fmt "fmt"
+ 
++	equality "k8s.io/apimachinery/pkg/api/equality"
+ 	operation "k8s.io/apimachinery/pkg/api/operation"
+ 	safe "k8s.io/apimachinery/pkg/api/safe"
+ 	validate "k8s.io/apimachinery/pkg/api/validate"
+@@ -195,7 +196,7 @@ func Validate_Collections(
+ 
+ 	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "listField",
+ 		func(obj *Collections) []string { return obj.ListField },
+-		func(obj *Collections) string { return obj.D1 }, validate.SemanticDeepEqual,
++		func(obj *Collections) string { return obj.D1 }, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenSlice(ctx, op, fldPath, obj, oldObj)...)
+@@ -222,7 +223,7 @@ func Validate_Collections(
+ 	}
+ 	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "mapField",
+ 		func(obj *Collections) map[string]string { return obj.MapField },
+-		func(obj *Collections) string { return obj.D1 }, validate.SemanticDeepEqual,
++		func(obj *Collections) string { return obj.D1 }, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenMap(ctx, op, fldPath, obj, oldObj)...)
+@@ -531,3 +532,8 @@ func Validate_StrictUnion(
+ 	// field StrictUnion.FieldB has no validation
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/zz_generated.validations.go
+index ef8c3bc1ef004..120b2c9072d41 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/zz_generated.validations.go
+@@ -258,7 +258,8 @@ func Validate_Struct(
+ 			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+ 				earlyReturn = true
+ 			}
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a int, b int) bool { return a == b }, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/zz_generated.validations.go
+index 2134450e65b06..b96320a866dcd 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/zz_generated.validations.go
+@@ -136,7 +136,8 @@ func Validate_Struct(
+ 			earlyReturn := false
+ 			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+-					return validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify)
++					return validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++						func(a string, b string) bool { return a == b }, validate.NoModify)
+ 				}).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+@@ -168,7 +169,8 @@ func Validate_Struct(
+ 			earlyReturn := false
+ 			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", false,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+-					return validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify)
++					return validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++						func(a string, b string) bool { return a == b }, validate.NoModify)
+ 				}).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/zz_generated.validations.go
+index b9d799f3e64e2..de5a185c66a68 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/zz_generated.validations.go
+@@ -79,7 +79,7 @@ func Validate_Struct(
+ 			// call field-attached validations
+ 			func() { // cohort = "labels"
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "labels",
+-					func(o *v1.ObjectMeta) map[string]string { return o.Labels }, validate.SemanticDeepEqual,
++					func(o *v1.ObjectMeta) map[string]string { return o.Labels }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+ 						return validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+ 							func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+@@ -91,7 +91,7 @@ func Validate_Struct(
+ 			}()
+ 			func() { // cohort = "ownerReferences"
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "ownerReferences",
+-					func(o *v1.ObjectMeta) []v1.OwnerReference { return o.OwnerReferences }, validate.SemanticDeepEqual,
++					func(o *v1.ObjectMeta) []v1.OwnerReference { return o.OwnerReferences }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []v1.OwnerReference) field.ErrorList {
+ 						return validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+ 							func(a *v1.OwnerReference, b *v1.OwnerReference) bool { return a.UID == b.UID })
+@@ -101,7 +101,7 @@ func Validate_Struct(
+ 			}()
+ 			func() { // cohort = "finalizers"
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "finalizers",
+-					func(o *v1.ObjectMeta) []string { return o.Finalizers }, validate.SemanticDeepEqual,
++					func(o *v1.ObjectMeta) []string { return o.Finalizers }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+ 						return validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual)
+ 					}); len(e) != 0 {
+@@ -119,3 +119,8 @@ func Validate_Struct(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/zz_generated.validations.go
+index e9c369fdf7722..d9cf158b01398 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/zz_generated.validations.go
+@@ -112,7 +112,7 @@ func Validate_Struct(
+ 			}()
+ 			func() { // cohort = "sliceField"
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "sliceField",
+-					func(o *OtherStruct) []string { return o.SliceField }, validate.SemanticDeepEqual,
++					func(o *OtherStruct) []string { return o.SliceField }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructField.SliceField")
+ 					}); len(e) != 0 {
+@@ -121,7 +121,7 @@ func Validate_Struct(
+ 			}()
+ 			func() { // cohort = "mapField"
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "mapField",
+-					func(o *OtherStruct) map[string]string { return o.MapField }, validate.SemanticDeepEqual,
++					func(o *OtherStruct) map[string]string { return o.MapField }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructField.MapField")
+ 					}); len(e) != 0 {
+@@ -185,7 +185,7 @@ func Validate_Struct(
+ 			}()
+ 			func() { // cohort = "sliceField"
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "sliceField",
+-					func(o *OtherStruct) []string { return o.SliceField }, validate.SemanticDeepEqual,
++					func(o *OtherStruct) []string { return o.SliceField }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructPtrField.SliceField")
+ 					}); len(e) != 0 {
+@@ -194,7 +194,7 @@ func Validate_Struct(
+ 			}()
+ 			func() { // cohort = "mapField"
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "mapField",
+-					func(o *OtherStruct) map[string]string { return o.MapField }, validate.SemanticDeepEqual,
++					func(o *OtherStruct) map[string]string { return o.MapField }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructPtrField.MapField")
+ 					}); len(e) != 0 {
+@@ -212,3 +212,8 @@ func Validate_Struct(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/zz_generated.validations.go
+index b21f8fbf63bcf..2c0282191a3d1 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/zz_generated.validations.go
+@@ -492,7 +492,7 @@ func Validate_ParentWithMaxItems(
+ 			func() { // cohort = "value"
+ 				earlyReturn := false
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+-					func(o *TargetWithMaxItems) []string { return o.Value }, validate.SemanticDeepEqual,
++					func(o *TargetWithMaxItems) []string { return o.Value }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+ 						return validate.MaxItems(ctx, op, fldPath, obj, oldObj, 2)
+ 					}).MarkShortCircuit(); len(e) != 0 {
+@@ -502,7 +502,7 @@ func Validate_ParentWithMaxItems(
+ 					return // do not proceed
+ 				}
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+-					func(o *TargetWithMaxItems) []string { return o.Value }, validate.SemanticDeepEqual,
++					func(o *TargetWithMaxItems) []string { return o.Value }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithMaxItems.Field.Value")
+ 					}); len(e) != 0 {
+@@ -546,7 +546,7 @@ func Validate_ParentWithMaxProperties(
+ 			func() { // cohort = "value"
+ 				earlyReturn := false
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+-					func(o *TargetWithMaxProperties) map[string]string { return o.Value }, validate.SemanticDeepEqual,
++					func(o *TargetWithMaxProperties) map[string]string { return o.Value }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+ 						return validate.MaxProperties(ctx, op, fldPath, obj, oldObj, 2)
+ 					}).MarkShortCircuit(); len(e) != 0 {
+@@ -556,7 +556,7 @@ func Validate_ParentWithMaxProperties(
+ 					return // do not proceed
+ 				}
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+-					func(o *TargetWithMaxProperties) map[string]string { return o.Value }, validate.SemanticDeepEqual,
++					func(o *TargetWithMaxProperties) map[string]string { return o.Value }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithMaxProperties.Field.Value")
+ 					}); len(e) != 0 {
+@@ -1029,7 +1029,8 @@ func Validate_ParentWithUpdate(
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+ 					func(o *TargetWithUpdate) *string { return &o.Value }, validate.DirectEqual,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+-						return validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify)
++						return validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++							func(a string, b string) bool { return a == b }, validate.NoModify)
+ 					}).MarkShortCircuit(); len(e) != 0 {
+ 					earlyReturn = true
+ 				}
+@@ -1308,7 +1309,8 @@ func Validate_TargetWithUpdate(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -1326,3 +1328,8 @@ func Validate_TargetWithUpdate(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/zz_generated.validations.go
+index 23dfb6e20603c..b0e1a4e3fb7f8 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/zz_generated.validations.go
+@@ -426,7 +426,7 @@ func Validate_UpdateListStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, validate.NoAddItem, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, validate.NoAddItem, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -434,7 +434,7 @@ func Validate_UpdateListStruct(
+ 				return // do not proceed
+ 			}
+ 			// lists with set semantics require unique values
+-			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual); len(e) != 0 {
++			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -627,3 +627,8 @@ func Validate_UpdateListStruct(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc.go
+index 8737cf5e61f67..465888aea1f33 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc.go
+@@ -52,6 +52,18 @@ type UpdateMapStruct struct {
+ 
+ 	// +k8s:eachVal=+k8s:update=NoModify
+ 	EachValNoModifyMap map[string]MapItem `json:"eachValNoModifyMap"`
++
++	// Pointer Map NoSet
++	// +k8s:update=NoSet
++	PointerMapNoSet map[string]*string `json:"pointerMapNoSet"`
++
++	// Pointer Map NoAdd
++	// +k8s:update=NoAddItem
++	PointerMapNoAdd map[string]*string `json:"pointerMapNoAdd"`
++
++	// Pointer Map NoRemove
++	// +k8s:update=NoRemoveItem
++	PointerMapNoRemove map[string]*MapItem `json:"pointerMapNoRemove"`
+ }
+ 
+ type MapItem struct {
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc_test.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc_test.go
+index bb5e84ded9b00..3917898a1c416 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc_test.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc_test.go
+@@ -129,4 +129,60 @@ func TestUpdateMapTags(t *testing.T) {
+ 			field.Invalid(field.NewPath("eachValNoModifyMap").Key("a"), nil, "cannot be modified").WithOrigin("update"),
+ 		})
+ 	}
++
++	// Pointer Map NoSet
++	{
++		old := base
++		old.PointerMapNoSet = nil
++		cur := base
++		cur.PointerMapNoSet = map[string]*string{"a": new("1")}
++
++		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
++			field.Invalid(field.NewPath("pointerMapNoSet"), nil, "field cannot be set once created").WithOrigin("update"),
++		})
++
++		// nil -> nil is allowed
++		st.Value(&old).OldValue(&old).ExpectValid()
++	}
++
++	// Pointer Map NoAddItem
++	{
++		old := base
++		old.PointerMapNoAdd = map[string]*string{"a": new("1")}
++		cur := base
++		cur.PointerMapNoAdd = map[string]*string{"a": new("1"), "b": new("2")}
++
++		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
++			field.Forbidden(field.NewPath("pointerMapNoAdd").Key("b"), "item may not be added").WithOrigin("update"),
++		})
++	}
++
++	// Pointer Map NoRemoveItem
++	{
++		old := base
++		old.PointerMapNoRemove = map[string]*MapItem{
++			"a": {Name: "a", Value: "1"},
++			"b": {Name: "b", Value: "2"},
++		}
++		cur := base
++		cur.PointerMapNoRemove = map[string]*MapItem{
++			"a": {Name: "a", Value: "1"},
++		}
++
++		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
++			field.Forbidden(field.NewPath("pointerMapNoRemove").Key("b"), "item may not be removed").WithOrigin("update"),
++		})
++	}
++
++	// Nil element in pointer map on update should trigger Required error from PtrMapNoNils
++	{
++		old := base
++		old.PointerMapNoAdd = map[string]*string{"a": new("1")}
++		cur := base
++		cur.PointerMapNoAdd = map[string]*string{"a": nil}
++
++		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
++			field.Required(field.NewPath("pointerMapNoAdd").Key("a"), ""),
++		})
++	}
+ }
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/zz_generated.validations.go
+index 38588d3eb9fbc..e471ab147021d 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/zz_generated.validations.go
+@@ -270,5 +270,104 @@ func Validate_UpdateMapStruct(
+ 		errs = append(errs, fn(fldPath.Child("eachValNoModifyMap"), obj.EachValNoModifyMap, oldVal, oldObj != nil)...)
+ 	}
+ 
++	{ // field UpdateMapStruct.PointerMapNoSet
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*string,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if e := validate.UpdateMap(ctx, op, fldPath, obj, oldObj, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *UpdateMapStruct) map[string]*string {
++				return oldObj.PointerMapNoSet
++			})
++		errs = append(errs, fn(fldPath.Child("pointerMapNoSet"), obj.PointerMapNoSet, oldVal, oldObj != nil)...)
++	}
++
++	{ // field UpdateMapStruct.PointerMapNoAdd
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*string,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if e := validate.UpdateMap(ctx, op, fldPath, obj, oldObj, validate.NoAddItem).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *UpdateMapStruct) map[string]*string {
++				return oldObj.PointerMapNoAdd
++			})
++		errs = append(errs, fn(fldPath.Child("pointerMapNoAdd"), obj.PointerMapNoAdd, oldVal, oldObj != nil)...)
++	}
++
++	{ // field UpdateMapStruct.PointerMapNoRemove
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*MapItem,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, MapItem](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if e := validate.UpdateMap(ctx, op, fldPath, obj, oldObj, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *UpdateMapStruct) map[string]*MapItem {
++				return oldObj.PointerMapNoRemove
++			})
++		errs = append(errs, fn(fldPath.Child("pointerMapNoRemove"), obj.PointerMapNoRemove, oldVal, oldObj != nil)...)
++	}
++
+ 	return errs
+ }
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/zz_generated.validations.go
+index 888cb51b17a87..61e82e9fdecb6 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/zz_generated.validations.go
+@@ -77,7 +77,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -106,7 +107,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -135,7 +137,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -164,7 +167,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoSet, validate.NoUnset, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoSet, validate.NoUnset, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -193,7 +197,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoUnset, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoUnset, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -222,7 +227,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a int, b int) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -251,7 +257,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a int32, b int32) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -280,7 +287,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a int64, b int64) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -309,7 +317,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a uint, b uint) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -338,7 +347,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a bool, b bool) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -367,7 +377,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a float32, b float32) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -396,7 +407,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a float64, b float64) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -425,7 +437,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a byte, b byte) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -715,7 +728,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a CustomString, b CustomString) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -744,7 +758,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a CustomInt, b CustomInt) bool { return a == b }, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/targets.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/targets.go
+index 29a676b040ddd..90692c7f40266 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/targets.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/targets.go
+@@ -54,6 +54,9 @@ const (
+ 	// (e.g. in tests), or set to "nil" to disable scheme registration for this
+ 	// package.
+ 	schemeRegistryTagName = "k8s:validation-gen-scheme-registry"
++	// Defines the deep-equal function used for equivalence and ratcheting checks.
++	// Defaults to "k8s.io/apimachinery/pkg/api/equality.Semantic.DeepEqual".
++	deepEqualFuncTagName = "k8s:validation-gen-deep-equal-func"
+ 	// If set, generate go test files for test fixtures.  Supported values: "validateFalse".
+ 	testFixtureTagName = "k8s:validation-gen-test-fixture"
+ 
+@@ -69,10 +72,11 @@ const (
+ )
+ 
+ var (
+-	runtimePkg   = "k8s.io/apimachinery/pkg/runtime"
+-	schemeType   = types.Name{Package: runtimePkg, Name: "Scheme"}
+-	metav1Pkg    = "k8s.io/apimachinery/pkg/apis/meta/v1"
+-	listMetaType = types.Name{Package: metav1Pkg, Name: "ListMeta"}
++	runtimePkg           = "k8s.io/apimachinery/pkg/runtime"
++	schemeType           = types.Name{Package: runtimePkg, Name: "Scheme"}
++	defaultDeepEqualFunc = types.Name{Package: "k8s.io/apimachinery/pkg/api/equality", Name: "Semantic.DeepEqual"}
++	metav1Pkg            = "k8s.io/apimachinery/pkg/apis/meta/v1"
++	listMetaType         = types.Name{Package: metav1Pkg, Name: "ListMeta"}
+ )
+ 
+ // extractAndParseTag extracts all the values for a given tag, according to the
+@@ -157,6 +161,48 @@ func registerScheme(pkg *types.Package) bool {
+ 	return ok
+ }
+ 
++func deepEqualFuncTag(pkg *types.Package) types.Name {
++	// TODO: convert to extractAndParseTag() and update all callers to use quoted values
++	tags, err := gengo.ExtractFunctionStyleCommentTags("+", []string{deepEqualFuncTagName}, pkg.Comments)
++	if err != nil {
++		klog.Fatalf("Failed to extract deep equal func tags: %v", err)
++	}
++	values, found := tags[deepEqualFuncTagName]
++	if !found || len(values) == 0 {
++		return defaultDeepEqualFunc
++	}
++	if len(values) > 1 {
++		panic(fmt.Sprintf("Package %q contains more than one usage of %q", pkg.Path, deepEqualFuncTagName))
++	}
++	val := values[0].Value
++	if val == "" {
++		return defaultDeepEqualFunc
++	}
++	return parseDeepEqualFunc(val)
++}
++
++func parseDeepEqualFunc(val string) types.Name {
++	lastSlash := strings.LastIndex(val, "/")
++	if lastSlash == -1 {
++		dot := strings.Index(val, ".")
++		if dot == -1 {
++			return types.Name{Name: val}
++		}
++		return types.Name{
++			Package: val[:dot],
++			Name:    val[dot+1:],
++		}
++	}
++	dot := lastSlash + strings.Index(val[lastSlash:], ".")
++	if dot == lastSlash {
++		return types.Name{Package: val}
++	}
++	return types.Name{
++		Package: val[:dot],
++		Name:    val[dot+1:],
++	}
++}
++
+ func isSubresourceTag(t *types.Type) (string, bool) {
+ 	var comments []string
+ 	comments = append(comments, t.SecondClosestCommentLines...)
+@@ -358,6 +404,7 @@ func GetTargets(context *generator.Context, args *Args) []generator.Target {
+ 		pkg := context.Universe[input]
+ 
+ 		schemeRegistry, registerThisPkg := schemeRegistryTag(pkg)
++		deepEqualFunc := deepEqualFuncTag(pkg)
+ 
+ 		criteria, found := validationTypeMatch(pkg, idOpts)
+ 		if !found {
+@@ -485,7 +532,7 @@ func GetTargets(context *generator.Context, args *Args) []generator.Target {
+ 
+ 				GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+ 					generators = []generator.Generator{
+-						NewGenValidations(args.OutputFile, pkg.Path, typesPkg.Path, rootTypes, td, inputToCanonicalPkg, schemeRegistry, registerThisPkg),
++						NewGenValidations(args.OutputFile, pkg.Path, typesPkg.Path, rootTypes, td, inputToCanonicalPkg, schemeRegistry, registerThisPkg, deepEqualFunc),
+ 					}
+ 					testFixtureTags := testFixtureTag(pkg)
+ 					if testFixtureTags.Len() > 0 {
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/targets_test.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/targets_test.go
+new file mode 100644
+index 0000000000000..ff67234ed3261
+--- /dev/null
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/targets_test.go
+@@ -0,0 +1,64 @@
++/*
++Copyright The Kubernetes Authors.
++
++Licensed under the Apache License, Version 2.0 (the "License");
++you may not use this file except in compliance with the License.
++You may obtain a copy of the License at
++
++    http://www.apache.org/licenses/LICENSE-2.0
++
++Unless required by applicable law or agreed to in writing, software
++distributed under the License is distributed on an "AS IS" BASIS,
++WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++See the License for the specific language governing permissions and
++limitations under the License.
++*/
++
++package main
++
++import (
++	"testing"
++
++	"k8s.io/gengo/v2/types"
++)
++
++func TestParseDeepEqualFunc(t *testing.T) {
++	testCases := []struct {
++		name     string
++		input    string
++		expected types.Name
++	}{{
++		name:     "fully qualified with struct field",
++		input:    "k8s.io/apimachinery/pkg/api/equality.Semantic.DeepEqual",
++		expected: types.Name{Package: "k8s.io/apimachinery/pkg/api/equality", Name: "Semantic.DeepEqual"},
++	}, {
++		name:     "fully qualified package function",
++		input:    "k8s.io/code-generator/cmd/validation-gen/testscheme.CustomEqual",
++		expected: types.Name{Package: "k8s.io/code-generator/cmd/validation-gen/testscheme", Name: "CustomEqual"},
++	}, {
++		name:     "single level package function",
++		input:    "testscheme.CustomEqual",
++		expected: types.Name{Package: "testscheme", Name: "CustomEqual"},
++	}, {
++		name:     "single level package struct field",
++		input:    "testscheme.Semantic.DeepEqual",
++		expected: types.Name{Package: "testscheme", Name: "Semantic.DeepEqual"},
++	}, {
++		name:     "package-local function",
++		input:    "CustomDeepEqual",
++		expected: types.Name{Package: "", Name: "CustomDeepEqual"},
++	}, {
++		name:     "empty input",
++		input:    "",
++		expected: types.Name{Package: "", Name: ""},
++	}}
++
++	for _, tc := range testCases {
++		t.Run(tc.name, func(t *testing.T) {
++			result := parseDeepEqualFunc(tc.input)
++			if want, got := tc.expected, result; got != want {
++				t.Errorf("expected %v, got %v", want, got)
++			}
++		})
++	}
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/validation.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/validation.go
+index 16725be28ccb7..a4368afa96d8e 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/validation.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/validation.go
+@@ -56,8 +56,6 @@ var (
+ 	operationPkgSymbols = mkPkgNames(operationPkg, "Operation", "MatchesSubresource", "Update")
+ 	contextPkg          = "context"
+ 	contextPkgSymbols   = mkPkgNames(contextPkg, "Context")
+-	equalityPkg         = "k8s.io/apimachinery/pkg/api/equality"
+-	equalityPkgSymbols  = mkPkgNames(equalityPkg, "Semantic")
+ )
+ 
+ // genValidations produces a file with autogenerated validations.
+@@ -71,10 +69,12 @@ type genValidations struct {
+ 	imports             namer.ImportTracker
+ 	schemeRegistry      types.Name
+ 	emitRegisterFunc    bool
++	deepEqualFunc       types.Name
++	usedDeepEqualImpl   bool
+ }
+ 
+ // NewGenValidations creates a new generator for the specified package.
+-func NewGenValidations(outputFilename, outputPackage, inputPackage string, rootTypes []*types.Type, discovered *typeDiscoverer, inputToCanonicalPkg map[string]string, schemeRegistry types.Name, emitRegisterFunc bool) generator.Generator {
++func NewGenValidations(outputFilename, outputPackage, inputPackage string, rootTypes []*types.Type, discovered *typeDiscoverer, inputToCanonicalPkg map[string]string, schemeRegistry types.Name, emitRegisterFunc bool, deepEqualFunc types.Name) generator.Generator {
+ 	return &genValidations{
+ 		GoGenerator: generator.GoGenerator{
+ 			OutputFilename: outputFilename,
+@@ -87,6 +87,7 @@ func NewGenValidations(outputFilename, outputPackage, inputPackage string, rootT
+ 		imports:             generator.NewImportTrackerForPackage(outputPackage),
+ 		schemeRegistry:      schemeRegistry,
+ 		emitRegisterFunc:    emitRegisterFunc,
++		deepEqualFunc:       deepEqualFunc,
+ 	}
+ }
+ 
+@@ -169,6 +170,26 @@ func (g *genValidations) GenerateType(c *generator.Context, t *types.Type, w io.
+ 	return nil
+ }
+ 
++func (g *genValidations) Finalize(c *generator.Context, w io.Writer) error {
++	if g.usedDeepEqualImpl {
++		sw := generator.NewSnippetWriter(w, c, "$", "$")
++		sw.Do("\n", nil)
++		sw.Do("// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.\n", nil)
++		sw.Do("func deepEqualImpl_[T any](a, b T) bool {\n", nil)
++		if g.deepEqualFunc.Package == "" {
++			sw.Do("	return $.$(a, b)\n", g.deepEqualFunc.Name)
++		} else {
++			targs := generator.Args{
++				"deepEqualFunc": c.Universe.Type(g.deepEqualFunc),
++			}
++			sw.Do("	return $.deepEqualFunc|raw$(a, b)\n", targs)
++		}
++		sw.Do("}\n", nil)
++		return sw.Error()
++	}
++	return nil
++}
++
+ // typeDiscoverer contains fields necessary to build graphs of types.
+ type typeDiscoverer struct {
+ 	initialized         bool
+@@ -670,8 +691,6 @@ func (td *typeDiscoverer) verifySupportedType(t *types.Type) error {
+ 		}
+ 		elem := util.NativeType(t.Elem)
+ 		switch elem.Kind {
+-		case types.Pointer:
+-			return fmt.Errorf("maps of pointers are not supported")
+ 		case types.Map:
+ 			return fmt.Errorf("maps of maps are not supported")
+ 		}
+@@ -1289,7 +1308,7 @@ func (g *genValidations) emitValidationForChild(c *generator.Context, thisChild
+ 			//      need to be executed, but if no fields changed they can be
+ 			//      skipped).
+ 			//
+-			// For the same reasons, in the specific case of lists of pointers,
++			// For the same reasons, in the specific case of lists and maps of pointers,
+ 			// we do not emit nil-checks inside type-specific validation
+ 			// functions.  If we solve for the duplicative ratcheting, then we
+ 			// should also solve for nil-checks.
+@@ -1307,6 +1326,19 @@ func (g *genValidations) emitValidationForChild(c *generator.Context, thisChild
+ 					nilCheck := validators.PtrSliceNoNils(nt.Elem.Elem.Name)
+ 					fld.fieldValidations.Functions = append([]validators.FunctionGen{nilCheck}, fld.fieldValidations.Functions...)
+ 				}
++			} else if nt := util.NativeType(fld.childType); nt.Kind == types.Map && nt.Elem.Kind == types.Pointer {
++				hasFieldValidations := len(fld.fieldValidations.Functions) > 0
++				hasPropagation := fld.node != nil && g.hasValidations(fld.node)
++				hasKeyIterations := len(fld.fieldKeyIterations.Functions) > 0 && hasPropagation
++				hasValIterations := len(fld.fieldValIterations.Functions) > 0 && hasPropagation
++
++				if hasFieldValidations || hasPropagation || hasKeyIterations || hasValIterations {
++					// Prepend the nil-check so it runs before any other
++					// validations. This is important because the other
++					// validations may assume that the map has no nil values.
++					nilCheck := validators.PtrMapNoNils(nt.Key.Name, nt.Elem.Elem.Name)
++					fld.fieldValidations.Functions = append([]validators.FunctionGen{nilCheck}, fld.fieldValidations.Functions...)
++				}
+ 			}
+ 
+ 			validations := fld.fieldValidations
+@@ -1314,7 +1346,7 @@ func (g *genValidations) emitValidationForChild(c *generator.Context, thisChild
+ 			if !validations.Empty() {
+ 				emitComments(validations.Comments, bufsw)
+ 				if len(validations.Functions) > 0 {
+-					emitRatchetingCheck(c, fld.childType, bufsw)
++					g.emitRatchetingCheck(c, fld.childType, bufsw)
+ 					fldRatchetingChecked = true
+ 					bufsw.Do("// call field-attached validations\n", nil)
+ 					g.emitCallsToValidators(c, validations.Functions, bufsw)
+@@ -1332,7 +1364,7 @@ func (g *genValidations) emitValidationForChild(c *generator.Context, thisChild
+ 					// (transitively) then we don't need to do anything.
+ 					if g.hasValidations(fld.node) {
+ 						if !fldRatchetingChecked {
+-							emitRatchetingCheck(c, fld.childType, bufsw)
++							g.emitRatchetingCheck(c, fld.childType, bufsw)
+ 							fldRatchetingChecked = true
+ 						}
+ 						g.emitCallToOtherTypeFunc(c, fld.node, bufsw)
+@@ -1347,7 +1379,7 @@ func (g *genValidations) emitValidationForChild(c *generator.Context, thisChild
+ 						emitComments(iterations.Comments, bufsw)
+ 						if len(iterations.Functions) > 0 {
+ 							if !fldRatchetingChecked {
+-								emitRatchetingCheck(c, fld.childType, bufsw)
++								g.emitRatchetingCheck(c, fld.childType, bufsw)
+ 								fldRatchetingChecked = true
+ 							}
+ 							g.emitCallsToValidators(c, iterations.Functions, bufsw)
+@@ -1448,7 +1480,7 @@ func (g *genValidations) emitCallToOtherTypeFunc(c *generator.Context, node *typ
+ }
+ 
+ // emitRatchetingCheck emits an equivalence check for default ratcheting.
+-func emitRatchetingCheck(c *generator.Context, t *types.Type, sw *generator.SnippetWriter) {
++func (g *genValidations) emitRatchetingCheck(c *generator.Context, t *types.Type, sw *generator.SnippetWriter) {
+ 	// Emit equivalence check for default ratcheting.
+ 	targs := generator.Args{
+ 		"operation": mkSymbolArgs(c, operationPkgSymbols),
+@@ -1467,8 +1499,12 @@ func emitRatchetingCheck(c *generator.Context, t *types.Type, sw *generator.Snip
+ 		// - *obj == *oldObj : compare values
+ 		sw.Do("  if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {\n", targs)
+ 	} else {
+-		targs["equality"] = mkSymbolArgs(c, equalityPkgSymbols)
+-		sw.Do("  if $.equality.Semantic|raw$.DeepEqual(obj, oldObj) {\n", targs)
++		if g.deepEqualFunc.Package == "" {
++			sw.Do("  if $.$(obj, oldObj) {\n", g.deepEqualFunc.Name)
++		} else {
++			targs["deepEqualFunc"] = c.Universe.Type(g.deepEqualFunc)
++			sw.Do("  if $.deepEqualFunc|raw$(obj, oldObj) {\n", targs)
++		}
+ 	}
+ 	sw.Do("    return nil\n", nil)
+ 	sw.Do("  }\n", nil)
+@@ -1755,9 +1791,23 @@ func (g *genValidations) toGolangSourceDataLiteral(sw *generator.SnippetWriter,
+ 	case *types.Member:
+ 		sw.Do("obj."+v.Name, nil)
+ 	case validators.Identifier:
+-		sw.Do("$.|raw$", c.Universe.Type(types.Name(v)))
++		if types.Name(v) == validators.DeepEqualImpl {
++			g.usedDeepEqualImpl = true
++		}
++		if v.Package == "" {
++			sw.Do(v.Name, nil)
++		} else {
++			sw.Do("$.|raw$", c.Universe.Type(types.Name(v)))
++		}
+ 	case *validators.Identifier:
+-		sw.Do("$.|raw$", c.Universe.Type(types.Name(*v)))
++		if types.Name(*v) == validators.DeepEqualImpl {
++			g.usedDeepEqualImpl = true
++		}
++		if v.Package == "" {
++			sw.Do(v.Name, nil)
++		} else {
++			sw.Do("$.|raw$", c.Universe.Type(types.Name(*v)))
++		}
+ 	case validators.PrivateVar:
+ 		sw.Do("$.|private$", c.Universe.Type(types.Name(v)))
+ 	case *validators.PrivateVar:
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/each.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/each.go
+index e5e5fc30a54b2..75709c87d33fb 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/each.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/each.go
+@@ -70,6 +70,7 @@ var (
+ 	validateEachValSliceVal = types.Name{Package: libValidationPkg, Name: "EachValSliceVal"}
+ 	validateEachPtrSliceVal = types.Name{Package: libValidationPkg, Name: "EachPtrSliceVal"}
+ 	validateEachMapVal      = types.Name{Package: libValidationPkg, Name: "EachMapVal"}
++	validateEachPtrMapVal   = types.Name{Package: libValidationPkg, Name: "EachPtrMapVal"}
+ )
+ 
+ func (evtv eachValTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+@@ -240,10 +241,16 @@ func (evtv eachValTagValidator) getMapValidations(t *types.Type, validations Val
+ 	if util.IsDirectComparable(util.NonPointer(util.NativeType(nt.Elem))) {
+ 		equivArg = Identifier(validateDirectEqual)
+ 	}
++
++	validateFunc := validateEachMapVal
++	if nt.Elem.Kind == types.Pointer {
++		validateFunc = validateEachPtrMapVal
++	}
++
+ 	wrapped := WrapFunctions(validations, func(vfn FunctionGen, _ DeferredScope) FunctionGen {
+ 		comm := vfn.Comments
+ 		vfn.Comments = nil
+-		return Function(eachValTagName, vfn.Flags, validateEachMapVal, equivArg, WrapperFunction{Function: vfn, ObjType: nt.Elem, PathFragment: "[*]"}).WithComments(comm...)
++		return Function(eachValTagName, vfn.Flags, validateFunc, equivArg, WrapperFunction{Function: vfn, ObjType: nt.Elem, PathFragment: "[*]"}).WithComments(comm...)
+ 	})
+ 	return Validations{
+ 		Functions:     wrapped.Functions,
+@@ -387,6 +394,7 @@ func (ektv eachKeyTagValidator) Docs() TagDoc {
+ 
+ var (
+ 	validatePtrSliceNoNils = types.Name{Package: libValidationPkg, Name: "PtrSliceNoNils"}
++	validatePtrMapNoNils   = types.Name{Package: libValidationPkg, Name: "PtrMapNoNils"}
+ )
+ 
+ // PtrSliceNoNils returns a synthetic validation that rejects nil elements of a
+@@ -394,3 +402,9 @@ var (
+ func PtrSliceNoNils(elemType types.Name) FunctionGen {
+ 	return Function("PtrSliceNoNils", ShortCircuit, validatePtrSliceNoNils).WithTypeArgs(elemType)
+ }
++
++// PtrMapNoNils returns a synthetic validation that rejects nil elements of a
++// pointer map. It is not tag-driven; the generator injects it for map[K]*V fields.
++func PtrMapNoNils(keyType, elemType types.Name) FunctionGen {
++	return Function("PtrMapNoNils", ShortCircuit, validatePtrMapNoNils).WithTypeArgs(keyType, elemType)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/list.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/list.go
+index adb25196f9a84..16103556a3560 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/list.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/list.go
+@@ -408,7 +408,7 @@ func (cutv customUniqueTagValidator) Docs() TagDoc {
+ var (
+ 	validateValSliceUnique    = types.Name{Package: libValidationPkg, Name: "ValSliceUnique"}
+ 	validatePtrSliceUnique    = types.Name{Package: libValidationPkg, Name: "PtrSliceUnique"}
+-	validateSemanticDeepEqual = types.Name{Package: libValidationPkg, Name: "SemanticDeepEqual"}
++	validateSemanticDeepEqual = DeepEqualImpl
+ 	validateDirectEqual       = types.Name{Package: libValidationPkg, Name: "DirectEqual"}
+ )
+ 
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/update.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/update.go
+index d883e20c1caaf..f0cfd3264db4d 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/update.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/update.go
+@@ -199,13 +199,12 @@ func (utc updateTagCollector) Docs() TagDoc {
+ }
+ 
+ var (
+-	updateValueValidator          = types.Name{Package: libValidationPkg, Name: "UpdateValueByCompare"}
+-	updatePointerValidator        = types.Name{Package: libValidationPkg, Name: "UpdatePointer"}
+-	updateValueByReflectValidator = types.Name{Package: libValidationPkg, Name: "UpdateValueByReflect"}
+-	updateStructValidator         = types.Name{Package: libValidationPkg, Name: "UpdateStruct"}
+-	valSliceUpdateValidator       = types.Name{Package: libValidationPkg, Name: "ValSliceUpdate"}
+-	ptrSliceUpdateValidator       = types.Name{Package: libValidationPkg, Name: "PtrSliceUpdate"}
+-	updateMapValidator            = types.Name{Package: libValidationPkg, Name: "UpdateMap"}
++	updateValueValidator    = types.Name{Package: libValidationPkg, Name: "UpdateValue"}
++	updatePointerValidator  = types.Name{Package: libValidationPkg, Name: "UpdatePointer"}
++	updateStructValidator   = types.Name{Package: libValidationPkg, Name: "UpdateStruct"}
++	valSliceUpdateValidator = types.Name{Package: libValidationPkg, Name: "ValSliceUpdate"}
++	ptrSliceUpdateValidator = types.Name{Package: libValidationPkg, Name: "PtrSliceUpdate"}
++	updateMapValidator      = types.Name{Package: libValidationPkg, Name: "UpdateMap"}
+ 
+ 	// Constraint constants that will be used as arguments
+ 	noSetConstraint        = types.Name{Package: libValidationPkg, Name: "NoSet"}
+@@ -314,9 +313,8 @@ func generateMapValidation(constraints []validate.UpdateConstraint) Validations
+ 	return Validations{Functions: []FunctionGen{fn}}
+ }
+ 
+-// emitScalarUpdate emits a call to
+-// UpdateValueByCompare/UpdatePointer/UpdateStruct/UpdateValueByReflect based
+-// on the Go kind of context.Type.
++// emitScalarUpdate emits a call to UpdateValue/UpdatePointer/UpdateStruct
++// based on the Go kind of context.Type.
+ // Used for both field scope (scalar/pointer/struct) and list/map element
+ // scope via +k8s:eachVal.
+ func emitScalarUpdate(context Context, constraints []validate.UpdateConstraint) Validations {
+@@ -327,21 +325,33 @@ func emitScalarUpdate(context Context, constraints []validate.UpdateConstraint)
+ 	isComparable := util.IsDirectComparable(t)
+ 
+ 	var validatorFunc types.Name
++	var args []any
+ 	if isPointer {
+ 		validatorFunc = updatePointerValidator
++		args = constraintIdentifierArgs(constraints)
+ 	} else if isStruct {
+ 		validatorFunc = updateStructValidator
+-	} else if isComparable {
+-		validatorFunc = updateValueValidator
++		args = constraintIdentifierArgs(constraints)
+ 	} else {
+-		validatorFunc = updateValueByReflectValidator
++		validatorFunc = updateValueValidator
++		var matchArg any
++		if isComparable {
++			matchArg = FunctionLiteral{
++				Parameters: []ParamResult{{"a", context.Type}, {"b", context.Type}},
++				Results:    []ParamResult{{"", types.Bool}},
++				Body:       "return a == b",
++			}
++		} else {
++			matchArg = Identifier(validateSemanticDeepEqual)
++		}
++		args = append([]any{matchArg}, constraintIdentifierArgs(constraints)...)
+ 	}
+ 
+ 	// Use ShortCircuit flag so these run in the same group as +k8s:optional.
+ 	// Scalar/pointer/struct fields only accept NoSet/NoUnset/NoModify
+ 	// (validateConstraintsForType rejects the rest), all of which emit
+ 	// field.Invalid at the field path.
+-	fn := Function(updateTagName, ShortCircuit, validatorFunc, constraintIdentifierArgs(constraints)...).
++	fn := Function(updateTagName, ShortCircuit, validatorFunc, args...).
+ 		WithEmits(Emission{field.ErrorTypeInvalid, "update", ""})
+ 	return Validations{Functions: []FunctionGen{fn}}
+ }
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/validators.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/validators.go
+index 196c94bbeb1f1..235897dddc26c 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/validators.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/validators.go
+@@ -26,6 +26,10 @@ import (
+ 	"k8s.io/gengo/v2/types"
+ )
+ 
++var (
++	DeepEqualImpl = types.Name{Name: "deepEqualImpl_"}
++)
++
+ // TagValidator describes a single validation tag and how to use it. To be
+ // findable by validation-gen, a TagValidator must be registered - see
+ // RegisterTagValidator.
+diff --git a/staging/src/k8s.io/code-generator/pkg/apidefinitions/activation_test.go b/staging/src/k8s.io/code-generator/pkg/apidefinitions/activation_test.go
+index fa7c8e29f6408..c4d35d8d5f227 100644
+--- a/staging/src/k8s.io/code-generator/pkg/apidefinitions/activation_test.go
++++ b/staging/src/k8s.io/code-generator/pkg/apidefinitions/activation_test.go
+@@ -178,6 +178,7 @@ func TestIdentify(t *testing.T) {
+ 				"+k8s:defaulter-gen-input=k8s.io/api/foo/v1",
+ 				"+k8s:validation-gen=TypesWithField=TypeMeta",
+ 				"+k8s:validation-gen-input=k8s.io/api/foo/v1",
++				"+k8s:validation-gen-deep-equal-func=foo",
+ 				"+k8s:validation-gen-nolint",
+ 				"+k8s:validation-gen-scheme-registry=foo",
+ 				"+k8s:validation-gen-test-fixture=bar",
+diff --git a/staging/src/k8s.io/code-generator/pkg/apidefinitions/lint_test.go b/staging/src/k8s.io/code-generator/pkg/apidefinitions/lint_test.go
+index a30549a216844..5c11d765bb261 100644
+--- a/staging/src/k8s.io/code-generator/pkg/apidefinitions/lint_test.go
++++ b/staging/src/k8s.io/code-generator/pkg/apidefinitions/lint_test.go
+@@ -49,6 +49,7 @@ func TestLintRules(t *testing.T) {
+ 		"+k8s:defaulter-gen-input=k8s.io/api/foo/v1",
+ 		"+k8s:validation-gen=TypesWithField=TypeMeta",
+ 		"+k8s:validation-gen-input=k8s.io/api/foo/v1",
++		"+k8s:validation-gen-deep-equal-func=foo",
+ 		"+k8s:validation-gen-nolint",
+ 		"+k8s:validation-gen-scheme-registry=foo",
+ 		"+k8s:validation-gen-test-fixture=bar",
+diff --git a/staging/src/k8s.io/code-generator/pkg/apidefinitions/spec.go b/staging/src/k8s.io/code-generator/pkg/apidefinitions/spec.go
+index 58c5da6cb01a1..96289c97bb434 100644
+--- a/staging/src/k8s.io/code-generator/pkg/apidefinitions/spec.go
++++ b/staging/src/k8s.io/code-generator/pkg/apidefinitions/spec.go
+@@ -96,6 +96,7 @@ var (
+ 		InputTag:      "k8s:validation-gen-input",
+ 		ValueMode:     TypeFilterList,
+ 		AuxTags: []string{
++			"k8s:validation-gen-deep-equal-func",
+ 			"k8s:validation-gen-nolint",
+ 			"k8s:validation-gen-scheme-registry",
+ 			"k8s:validation-gen-test-fixture",
+diff --git a/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1alpha1/validation.go b/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1alpha1/validation.go
+index 6c0dbe3bc8ecb..d2aae78012279 100644
+--- a/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1alpha1/validation.go
++++ b/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1alpha1/validation.go
+@@ -20,6 +20,7 @@ import (
+ 	"context"
+ 
+ 	resourceapi "k8s.io/api/resource/v1"
++	"k8s.io/apimachinery/pkg/api/equality"
+ 	"k8s.io/apimachinery/pkg/api/operation"
+ 	"k8s.io/apimachinery/pkg/api/validate"
+ 	"k8s.io/apimachinery/pkg/util/validation/field"
+@@ -29,7 +30,7 @@ func ValidateCustom_Device_Attributes(
+ 	ctx context.Context, op operation.Operation, fldPath *field.Path,
+ 	obj, oldObj map[resourceapi.QualifiedName]resourceapi.DeviceAttribute,
+ ) field.ErrorList {
+-	return validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, resourceapi.Validate_DeviceAttribute)
++	return validate.EachMapVal(ctx, op, fldPath, obj, oldObj, semanticDeepEqual, resourceapi.Validate_DeviceAttribute)
+ }
+ 
+ func ValidateCustom_Device_NetworkData(
+@@ -38,3 +39,12 @@ func ValidateCustom_Device_NetworkData(
+ ) field.ErrorList {
+ 	return resourceapi.Validate_NetworkDeviceData(ctx, op, fldPath, obj, oldObj)
+ }
++
++// semanticDeepEqual is a MatchFunc that uses equality.Semantic.DeepEqual to
++// compare two values.
++// This wrapper is needed because MatchFunc requires a function that takes two
++// arguments of specific type T, while equality.Semantic.DeepEqual takes
++// arguments of type interface{}/any.
++func semanticDeepEqual[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1beta1/validation.go b/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1beta1/validation.go
+index d4df1c48f5e37..00cad29f34893 100644
+--- a/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1beta1/validation.go
++++ b/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1beta1/validation.go
+@@ -20,6 +20,7 @@ import (
+ 	"context"
+ 
+ 	resourceapi "k8s.io/api/resource/v1"
++	"k8s.io/apimachinery/pkg/api/equality"
+ 	"k8s.io/apimachinery/pkg/api/operation"
+ 	"k8s.io/apimachinery/pkg/api/validate"
+ 	"k8s.io/apimachinery/pkg/util/validation/field"
+@@ -29,7 +30,7 @@ func ValidateCustom_Device_Attributes(
+ 	ctx context.Context, op operation.Operation, fldPath *field.Path,
+ 	obj, oldObj map[resourceapi.QualifiedName]resourceapi.DeviceAttribute,
+ ) field.ErrorList {
+-	return validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, resourceapi.Validate_DeviceAttribute)
++	return validate.EachMapVal(ctx, op, fldPath, obj, oldObj, semanticDeepEqual, resourceapi.Validate_DeviceAttribute)
+ }
+ 
+ func ValidateCustom_Device_NetworkData(
+@@ -38,3 +39,12 @@ func ValidateCustom_Device_NetworkData(
+ ) field.ErrorList {
+ 	return resourceapi.Validate_NetworkDeviceData(ctx, op, fldPath, obj, oldObj)
+ }
++
++// semanticDeepEqual is a MatchFunc that uses equality.Semantic.DeepEqual to
++// compare two values.
++// This wrapper is needed because MatchFunc requires a function that takes two
++// arguments of specific type T, while equality.Semantic.DeepEqual takes
++// arguments of type interface{}/any.
++func semanticDeepEqual[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
diff --git a/hack/update/codegen.sh b/hack/update/codegen.sh
new file mode 100755
index 0000000000..31cd26fe89
--- /dev/null
+++ b/hack/update/codegen.sh
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit -o nounset -o pipefail
+
+ROOT="$(git rev-parse --show-toplevel)"
+cd "${ROOT}"
+
+# The boilerpolate header we use for generated Go code.
+GO_BOILERPLATE=hack/boilerplate/go.txt
+
+#
+# The order of these matters - some of the codegen tools depend on the output
+# of others.
+#
+
+# TODO: We should move the rest of these into this file.
+function codegen::go_generate() {
+    echo "Running go generate"
+    go generate ./...
+}
+codegen::go_generate
+
+function codegen::protobuf() {
+    local proto_dirs=()
+    proto_dirs=(
+        pkg/proto/ateapipb
+        internal/proto/ateletpb
+        internal/proto/glutton
+        internal/proto/ateompb
+        internal/fieldmask/fieldmasktestpb
+    )
+
+    echo "Generating protobuf code"
+    for dir in "${proto_dirs[@]}"; do
+        local protoc_gen_go
+        protoc_gen_go="$(./hack/run-tool.sh --print-bin-path protoc-gen-go)"
+        local protoc_gen_go_rpc
+        protoc_gen_go_rpc="$(./hack/run-tool.sh --print-bin-path protoc-gen-go-grpc)"
+        (
+            cd "${dir}" || exit 1
+            "${ROOT}"/hack/protoc.sh \
+                --plugin=protoc-gen-go="${protoc_gen_go}" \
+                --plugin=protoc-gen-go-grpc="${protoc_gen_go_rpc}" \
+                --go_out=paths=source_relative:. \
+                --go-grpc_out=paths=source_relative:. \
+                *.proto
+        )
+    done
+}
+codegen::protobuf
+
+function codegen::validation() {
+    local proto_dirs=()
+    validation_dirs=(
+        cmd/ateapi/internal/controlapi
+    )
+    echo "Generating validation code"
+    for dir in "${validation_dirs[@]}"; do
+        ./hack/run-tool.sh validation-gen \
+            --go-header-file="${GO_BOILERPLATE}" \
+            --output-file=zz_generated.validation.go \
+            --readonly-pkg=google.golang.org/protobuf/types/known/timestamppb \
+            --readonly-pkg=google.golang.org/protobuf/types/known/fieldmaskpb \
+            "./${dir}"
+    done
+}
+codegen::validation
diff --git a/hack/update/gofmt.sh b/hack/update/gofmt.sh
index bb5a845ad1..b2803061ea 100755
--- a/hack/update/gofmt.sh
+++ b/hack/update/gofmt.sh
@@ -37,6 +37,8 @@ dirs=(
         ':(glob)**/*.go' \
         ':!:vendor/*' \
         ':!:**/vendor/*' \
+        ':!:third_party/*' \
+        ':!:**/third_party/*' \
         ':!:LICENSES/*' \
         | while read -r FILE; do dirname "${FILE}"; done \
         | sort \
diff --git a/hack/update/proto-fmt.sh b/hack/update/proto-fmt.sh
index 493c71d978..53236b1b18 100755
--- a/hack/update/proto-fmt.sh
+++ b/hack/update/proto-fmt.sh
@@ -37,6 +37,8 @@ files=(
         ':(glob)**/*.proto' \
         ':!:vendor/*' \
         ':!:**/vendor/*' \
+        ':!:third_party/*' \
+        ':!:**/third_party/*' \
         ':!:LICENSES/*' \
         | sort \
         | uniq)
diff --git a/hack/update/go-generate.sh b/hack/verify/codegen.sh
similarity index 91%
rename from hack/update/go-generate.sh
rename to hack/verify/codegen.sh
index 1b45459e9c..871897869e 100755
--- a/hack/update/go-generate.sh
+++ b/hack/verify/codegen.sh
@@ -19,4 +19,4 @@ set -o errexit -o nounset -o pipefail
 ROOT="$(git rev-parse --show-toplevel)"
 cd "${ROOT}"
 
-go generate ./...
+./hack/third_party/kubernetes/verify-generated.sh codegen "$@"
diff --git a/internal/fieldmask/fieldmasktestpb/gen.go b/internal/fieldmask/fieldmasktestpb/gen.go
deleted file mode 100644
index e0c905b34b..0000000000
--- a/internal/fieldmask/fieldmasktestpb/gen.go
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2026 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package fieldmasktestpb
-
-//go:generate bash -c "../../../hack/protoc.sh --plugin=protoc-gen-go=$(bash ../../../hack/run-tool.sh --print-bin-path protoc-gen-go) --go_out=paths=source_relative:. fieldmasktest.proto"
diff --git a/internal/proto/ateletpb/gen.go b/internal/proto/ateletpb/gen.go
deleted file mode 100644
index b73c10dac6..0000000000
--- a/internal/proto/ateletpb/gen.go
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2026 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ateletpb
-
-//go:generate bash -c "../../../hack/protoc.sh --plugin=protoc-gen-go=$(bash ../../../hack/run-tool.sh --print-bin-path protoc-gen-go) --plugin=protoc-gen-go-grpc=$(bash ../../../hack/run-tool.sh --print-bin-path protoc-gen-go-grpc) --go_out=paths=source_relative:. --go-grpc_out=paths=source_relative:. atelet.proto"
diff --git a/internal/proto/glutton/gen.go b/internal/proto/glutton/gen.go
deleted file mode 100644
index d6795c45af..0000000000
--- a/internal/proto/glutton/gen.go
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2026 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package glutton
-
-//go:generate bash -c "../../../hack/protoc.sh --plugin=protoc-gen-go=$(bash ../../../hack/run-tool.sh --print-bin-path protoc-gen-go) --plugin=protoc-gen-go-grpc=$(bash ../../../hack/run-tool.sh --print-bin-path protoc-gen-go-grpc) --go_out=paths=source_relative:. --go-grpc_out=paths=source_relative:. glutton.proto"
diff --git a/pkg/client/clientset/versioned/clientset.go b/pkg/client/clientset/versioned/clientset.go
index cca9d20a20..fd34793756 100644
--- a/pkg/client/clientset/versioned/clientset.go
+++ b/pkg/client/clientset/versioned/clientset.go
@@ -27,7 +27,7 @@ import (
 )
 
 type Interface interface {
-	Discovery() discovery.DiscoveryInterface
+	Discovery() discovery.DiscoveryInterfaces
 	ApiV1alpha1() apiv1alpha1.ApiV1alpha1Interface
 }
 
@@ -43,7 +43,7 @@ func (c *Clientset) ApiV1alpha1() apiv1alpha1.ApiV1alpha1Interface {
 }
 
 // Discovery retrieves the DiscoveryClient
-func (c *Clientset) Discovery() discovery.DiscoveryInterface {
+func (c *Clientset) Discovery() discovery.DiscoveryInterfaces {
 	if c == nil {
 		return nil
 	}
diff --git a/pkg/client/clientset/versioned/fake/clientset_generated.go b/pkg/client/clientset/versioned/fake/clientset_generated.go
index 168619df71..f2650039d4 100644
--- a/pkg/client/clientset/versioned/fake/clientset_generated.go
+++ b/pkg/client/clientset/versioned/fake/clientset_generated.go
@@ -32,10 +32,6 @@ import (
 // It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
 // without applying any field management, validations and/or defaults. It shouldn't be considered a replacement
 // for a real clientset and is mostly useful in simple unit tests.
-//
-// Deprecated: NewClientset replaces this with support for field management, which significantly improves
-// server side apply testing. NewClientset is only available when apply configurations are generated (e.g.
-// via --with-applyconfig).
 func NewSimpleClientset(objects ...runtime.Object) *Clientset {
 	o := testing.NewObjectTracker(scheme, codecs.UniversalDecoder())
 	for _, obj := range objects {
@@ -73,7 +69,7 @@ type Clientset struct {
 	tracker   testing.ObjectTracker
 }
 
-func (c *Clientset) Discovery() discovery.DiscoveryInterface {
+func (c *Clientset) Discovery() discovery.DiscoveryInterfaces {
 	return c.discovery
 }
 
@@ -81,7 +77,7 @@ func (c *Clientset) Tracker() testing.ObjectTracker {
 	return c.tracker
 }
 
-// IsWatchListSemanticsSupported informs the reflector that this client
+// IsWatchListSemanticsUnSupported informs the reflector that this client
 // doesn't support WatchList semantics.
 //
 // This is a synthetic method whose sole purpose is to satisfy the optional
diff --git a/pkg/client/informers/externalversions/api/v1alpha1/actortemplate.go b/pkg/client/informers/externalversions/api/v1alpha1/actortemplate.go
index 4ab7a9befd..728e70dfa5 100644
--- a/pkg/client/informers/externalversions/api/v1alpha1/actortemplate.go
+++ b/pkg/client/informers/externalversions/api/v1alpha1/actortemplate.go
@@ -26,17 +26,46 @@ import (
 	apiv1alpha1 "github.com/agent-substrate/substrate/pkg/client/listers/api/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	watch "k8s.io/apimachinery/pkg/watch"
 	cache "k8s.io/client-go/tools/cache"
 )
 
 // ActorTemplateInformer provides access to a shared informer and lister for
-// ActorTemplates.
+// ActorTemplates. Prefer using the type-safe variant (see [TypedActorTemplateInformer]).
 type ActorTemplateInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() apiv1alpha1.ActorTemplateLister
 }
 
+// TypedActorTemplateInformer provides access to a shared informer and lister for
+// ActorTemplates, including the type-safe TypedInformer variant.
+// It is a superset of ActorTemplateInformer.
+type TypedActorTemplateInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ActorTemplateIndexInformer
+	Lister() apiv1alpha1.ActorTemplateLister
+}
+
+// ActorTemplateIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ActorTemplateIndexInformer cache.TypedSharedIndexInformer[*pkgapiv1alpha1.ActorTemplate]
+
+// ActorTemplateHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ActorTemplate.
+type ActorTemplateHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*pkgapiv1alpha1.ActorTemplate]
+
+// ActorTemplateDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ActorTemplate.
+type ActorTemplateDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*pkgapiv1alpha1.ActorTemplate]
+
+// ActorTemplateFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ActorTemplate.
+type ActorTemplateFilteringHandler = cache.TypedFilteringResourceEventHandler[*pkgapiv1alpha1.ActorTemplate]
+
+// ActorTemplateIndexers is a specialization of [cache.TypedIndexers] for ActorTemplate.
+type ActorTemplateIndexers = cache.TypedIndexers[*pkgapiv1alpha1.ActorTemplate]
+
+// DeletedActorTemplate is a specialization of [cache.DeletedObject] for ActorTemplate.
+type DeletedActorTemplate = cache.DeletedObject[*pkgapiv1alpha1.ActorTemplate]
+
 type actorTemplateInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -46,55 +75,132 @@ type actorTemplateInformer struct {
 // NewActorTemplateInformer constructs a new informer for ActorTemplate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedActorTemplateInformer]).
 func NewActorTemplateInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
-	return NewFilteredActorTemplateInformer(client, namespace, resyncPeriod, indexers, nil)
+	return NewActorTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedActorTemplateInformer constructs a new informer for ActorTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedActorTemplateInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers ActorTemplateIndexers) ActorTemplateIndexInformer {
+	return NewTypedActorTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
 }
 
 // NewFilteredActorTemplateInformer constructs a new informer for ActorTemplate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredActorTemplateInformer]).
 func NewFilteredActorTemplateInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return cache.NewSharedIndexInformer(
+	return NewTypedActorTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredActorTemplateInformer constructs a new informer for ActorTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredActorTemplateInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers ActorTemplateIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ActorTemplateIndexInformer {
+	return NewTypedActorTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewActorTemplateInformerWithOptions constructs a new informer for ActorTemplate type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedActorTemplateInformerWithOptions]).
+func NewActorTemplateInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedActorTemplateInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedActorTemplateInformerWithOptions constructs a new informer for ActorTemplate type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedActorTemplateInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) ActorTemplateIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "api", Version: "v1alpha1", Resource: "actortemplates"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.ActorTemplate](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
-			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().ActorTemplates(namespace).List(context.Background(), options)
+				return client.ApiV1alpha1().ActorTemplates(namespace).List(context.Background(), opts)
 			},
-			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(opts v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().ActorTemplates(namespace).Watch(context.Background(), options)
+				return client.ApiV1alpha1().ActorTemplates(namespace).Watch(context.Background(), opts)
 			},
-			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+			ListWithContextFunc: func(ctx context.Context, opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().ActorTemplates(namespace).List(ctx, options)
+				return client.ApiV1alpha1().ActorTemplates(namespace).List(ctx, opts)
 			},
-			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+			WatchFuncWithContext: func(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().ActorTemplates(namespace).Watch(ctx, options)
+				return client.ApiV1alpha1().ActorTemplates(namespace).Watch(ctx, opts)
 			},
 		}, client),
 		&pkgapiv1alpha1.ActorTemplate{},
-		resyncPeriod,
-		indexers,
-	)
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
 }
 
 func (f *actorTemplateInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewFilteredActorTemplateInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+	return NewTypedActorTemplateInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *actorTemplateInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&pkgapiv1alpha1.ActorTemplate{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *actorTemplateInformer) TypedInformer() ActorTemplateIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.ActorTemplate](f.factory.InformerFor(&pkgapiv1alpha1.ActorTemplate{}, f.defaultInformer))
 }
 
 func (f *actorTemplateInformer) Lister() apiv1alpha1.ActorTemplateLister {
 	return apiv1alpha1.NewActorTemplateLister(f.Informer().GetIndexer())
 }
+
+// ToTypedActorTemplateInformer converts an untyped informer into a TypedActorTemplateInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ActorTemplate. If that is not the case, calling type-safe methods of the returned
+// TypedActorTemplateInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedActorTemplateInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedActorTemplateInformer(informer ActorTemplateInformer) TypedActorTemplateInformer {
+	if informer, ok := informer.(TypedActorTemplateInformer); ok {
+		return informer
+	}
+	return &actorTemplateTypedInformerAdapter{informer}
+}
+
+type actorTemplateTypedInformerAdapter struct {
+	ActorTemplateInformer
+}
+
+func (a *actorTemplateTypedInformerAdapter) TypedInformer() ActorTemplateIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.ActorTemplate](a.Informer())
+}
+
+// ToActorTemplateIndexInformer converts an untyped informer into a ActorTemplateIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ActorTemplate. If that is not the case, calling type-safe methods of the returned
+// ActorTemplateIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ActorTemplateIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToActorTemplateIndexInformer(informer cache.SharedIndexInformer) ActorTemplateIndexInformer {
+	if informer, ok := informer.(ActorTemplateIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.ActorTemplate](informer)
+}
diff --git a/pkg/client/informers/externalversions/api/v1alpha1/csidriverconfig.go b/pkg/client/informers/externalversions/api/v1alpha1/csidriverconfig.go
index fed08f0d2d..d31546178e 100644
--- a/pkg/client/informers/externalversions/api/v1alpha1/csidriverconfig.go
+++ b/pkg/client/informers/externalversions/api/v1alpha1/csidriverconfig.go
@@ -26,17 +26,46 @@ import (
 	apiv1alpha1 "github.com/agent-substrate/substrate/pkg/client/listers/api/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	watch "k8s.io/apimachinery/pkg/watch"
 	cache "k8s.io/client-go/tools/cache"
 )
 
 // CSIDriverConfigInformer provides access to a shared informer and lister for
-// CSIDriverConfigs.
+// CSIDriverConfigs. Prefer using the type-safe variant (see [TypedCSIDriverConfigInformer]).
 type CSIDriverConfigInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() apiv1alpha1.CSIDriverConfigLister
 }
 
+// TypedCSIDriverConfigInformer provides access to a shared informer and lister for
+// CSIDriverConfigs, including the type-safe TypedInformer variant.
+// It is a superset of CSIDriverConfigInformer.
+type TypedCSIDriverConfigInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() CSIDriverConfigIndexInformer
+	Lister() apiv1alpha1.CSIDriverConfigLister
+}
+
+// CSIDriverConfigIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type CSIDriverConfigIndexInformer cache.TypedSharedIndexInformer[*pkgapiv1alpha1.CSIDriverConfig]
+
+// CSIDriverConfigHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for CSIDriverConfig.
+type CSIDriverConfigHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*pkgapiv1alpha1.CSIDriverConfig]
+
+// CSIDriverConfigDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for CSIDriverConfig.
+type CSIDriverConfigDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*pkgapiv1alpha1.CSIDriverConfig]
+
+// CSIDriverConfigFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for CSIDriverConfig.
+type CSIDriverConfigFilteringHandler = cache.TypedFilteringResourceEventHandler[*pkgapiv1alpha1.CSIDriverConfig]
+
+// CSIDriverConfigIndexers is a specialization of [cache.TypedIndexers] for CSIDriverConfig.
+type CSIDriverConfigIndexers = cache.TypedIndexers[*pkgapiv1alpha1.CSIDriverConfig]
+
+// DeletedCSIDriverConfig is a specialization of [cache.DeletedObject] for CSIDriverConfig.
+type DeletedCSIDriverConfig = cache.DeletedObject[*pkgapiv1alpha1.CSIDriverConfig]
+
 type cSIDriverConfigInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -45,55 +74,132 @@ type cSIDriverConfigInformer struct {
 // NewCSIDriverConfigInformer constructs a new informer for CSIDriverConfig type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSIDriverConfigInformer]).
 func NewCSIDriverConfigInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
-	return NewFilteredCSIDriverConfigInformer(client, resyncPeriod, indexers, nil)
+	return NewCSIDriverConfigInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedCSIDriverConfigInformer constructs a new informer for CSIDriverConfig type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSIDriverConfigInformer(client versioned.Interface, resyncPeriod time.Duration, indexers CSIDriverConfigIndexers) CSIDriverConfigIndexInformer {
+	return NewTypedCSIDriverConfigInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
 }
 
 // NewFilteredCSIDriverConfigInformer constructs a new informer for CSIDriverConfig type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredCSIDriverConfigInformer]).
 func NewFilteredCSIDriverConfigInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return cache.NewSharedIndexInformer(
+	return NewTypedCSIDriverConfigInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredCSIDriverConfigInformer constructs a new informer for CSIDriverConfig type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredCSIDriverConfigInformer(client versioned.Interface, resyncPeriod time.Duration, indexers CSIDriverConfigIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) CSIDriverConfigIndexInformer {
+	return NewTypedCSIDriverConfigInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewCSIDriverConfigInformerWithOptions constructs a new informer for CSIDriverConfig type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSIDriverConfigInformerWithOptions]).
+func NewCSIDriverConfigInformerWithOptions(client versioned.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedCSIDriverConfigInformerWithOptions(client, options)
+}
+
+// NewTypedCSIDriverConfigInformerWithOptions constructs a new informer for CSIDriverConfig type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSIDriverConfigInformerWithOptions(client versioned.Interface, options internalinterfaces.InformerOptions) CSIDriverConfigIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "api", Version: "v1alpha1", Resource: "csidriverconfigs"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.CSIDriverConfig](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
-			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().CSIDriverConfigs().List(context.Background(), options)
+				return client.ApiV1alpha1().CSIDriverConfigs().List(context.Background(), opts)
 			},
-			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(opts v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().CSIDriverConfigs().Watch(context.Background(), options)
+				return client.ApiV1alpha1().CSIDriverConfigs().Watch(context.Background(), opts)
 			},
-			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+			ListWithContextFunc: func(ctx context.Context, opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().CSIDriverConfigs().List(ctx, options)
+				return client.ApiV1alpha1().CSIDriverConfigs().List(ctx, opts)
 			},
-			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+			WatchFuncWithContext: func(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().CSIDriverConfigs().Watch(ctx, options)
+				return client.ApiV1alpha1().CSIDriverConfigs().Watch(ctx, opts)
 			},
 		}, client),
 		&pkgapiv1alpha1.CSIDriverConfig{},
-		resyncPeriod,
-		indexers,
-	)
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
 }
 
 func (f *cSIDriverConfigInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewFilteredCSIDriverConfigInformer(client, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+	return NewTypedCSIDriverConfigInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *cSIDriverConfigInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&pkgapiv1alpha1.CSIDriverConfig{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *cSIDriverConfigInformer) TypedInformer() CSIDriverConfigIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.CSIDriverConfig](f.factory.InformerFor(&pkgapiv1alpha1.CSIDriverConfig{}, f.defaultInformer))
 }
 
 func (f *cSIDriverConfigInformer) Lister() apiv1alpha1.CSIDriverConfigLister {
 	return apiv1alpha1.NewCSIDriverConfigLister(f.Informer().GetIndexer())
 }
+
+// ToTypedCSIDriverConfigInformer converts an untyped informer into a TypedCSIDriverConfigInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSIDriverConfig. If that is not the case, calling type-safe methods of the returned
+// TypedCSIDriverConfigInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedCSIDriverConfigInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedCSIDriverConfigInformer(informer CSIDriverConfigInformer) TypedCSIDriverConfigInformer {
+	if informer, ok := informer.(TypedCSIDriverConfigInformer); ok {
+		return informer
+	}
+	return &cSIDriverConfigTypedInformerAdapter{informer}
+}
+
+type cSIDriverConfigTypedInformerAdapter struct {
+	CSIDriverConfigInformer
+}
+
+func (a *cSIDriverConfigTypedInformerAdapter) TypedInformer() CSIDriverConfigIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.CSIDriverConfig](a.Informer())
+}
+
+// ToCSIDriverConfigIndexInformer converts an untyped informer into a CSIDriverConfigIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSIDriverConfig. If that is not the case, calling type-safe methods of the returned
+// CSIDriverConfigIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a CSIDriverConfigIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToCSIDriverConfigIndexInformer(informer cache.SharedIndexInformer) CSIDriverConfigIndexInformer {
+	if informer, ok := informer.(CSIDriverConfigIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.CSIDriverConfig](informer)
+}
diff --git a/pkg/client/informers/externalversions/api/v1alpha1/interface.go b/pkg/client/informers/externalversions/api/v1alpha1/interface.go
index 5d32739c36..6fdb2bb424 100644
--- a/pkg/client/informers/externalversions/api/v1alpha1/interface.go
+++ b/pkg/client/informers/externalversions/api/v1alpha1/interface.go
@@ -23,13 +23,13 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// ActorTemplates returns a ActorTemplateInformer.
-	ActorTemplates() ActorTemplateInformer
+	ActorTemplates() TypedActorTemplateInformer
 	// CSIDriverConfigs returns a CSIDriverConfigInformer.
-	CSIDriverConfigs() CSIDriverConfigInformer
+	CSIDriverConfigs() TypedCSIDriverConfigInformer
 	// SandboxConfigs returns a SandboxConfigInformer.
-	SandboxConfigs() SandboxConfigInformer
+	SandboxConfigs() TypedSandboxConfigInformer
 	// WorkerPools returns a WorkerPoolInformer.
-	WorkerPools() WorkerPoolInformer
+	WorkerPools() TypedWorkerPoolInformer
 }
 
 type version struct {
@@ -43,22 +43,22 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// ActorTemplates returns a ActorTemplateInformer.
-func (v *version) ActorTemplates() ActorTemplateInformer {
+// ActorTemplates returns a TypedActorTemplateInformer.
+func (v *version) ActorTemplates() TypedActorTemplateInformer {
 	return &actorTemplateInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// CSIDriverConfigs returns a CSIDriverConfigInformer.
-func (v *version) CSIDriverConfigs() CSIDriverConfigInformer {
+// CSIDriverConfigs returns a TypedCSIDriverConfigInformer.
+func (v *version) CSIDriverConfigs() TypedCSIDriverConfigInformer {
 	return &cSIDriverConfigInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// SandboxConfigs returns a SandboxConfigInformer.
-func (v *version) SandboxConfigs() SandboxConfigInformer {
+// SandboxConfigs returns a TypedSandboxConfigInformer.
+func (v *version) SandboxConfigs() TypedSandboxConfigInformer {
 	return &sandboxConfigInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// WorkerPools returns a WorkerPoolInformer.
-func (v *version) WorkerPools() WorkerPoolInformer {
+// WorkerPools returns a TypedWorkerPoolInformer.
+func (v *version) WorkerPools() TypedWorkerPoolInformer {
 	return &workerPoolInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/pkg/client/informers/externalversions/api/v1alpha1/sandboxconfig.go b/pkg/client/informers/externalversions/api/v1alpha1/sandboxconfig.go
index bcfc8eb9b5..f41d4cd632 100644
--- a/pkg/client/informers/externalversions/api/v1alpha1/sandboxconfig.go
+++ b/pkg/client/informers/externalversions/api/v1alpha1/sandboxconfig.go
@@ -26,17 +26,46 @@ import (
 	apiv1alpha1 "github.com/agent-substrate/substrate/pkg/client/listers/api/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	watch "k8s.io/apimachinery/pkg/watch"
 	cache "k8s.io/client-go/tools/cache"
 )
 
 // SandboxConfigInformer provides access to a shared informer and lister for
-// SandboxConfigs.
+// SandboxConfigs. Prefer using the type-safe variant (see [TypedSandboxConfigInformer]).
 type SandboxConfigInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() apiv1alpha1.SandboxConfigLister
 }
 
+// TypedSandboxConfigInformer provides access to a shared informer and lister for
+// SandboxConfigs, including the type-safe TypedInformer variant.
+// It is a superset of SandboxConfigInformer.
+type TypedSandboxConfigInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() SandboxConfigIndexInformer
+	Lister() apiv1alpha1.SandboxConfigLister
+}
+
+// SandboxConfigIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type SandboxConfigIndexInformer cache.TypedSharedIndexInformer[*pkgapiv1alpha1.SandboxConfig]
+
+// SandboxConfigHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for SandboxConfig.
+type SandboxConfigHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*pkgapiv1alpha1.SandboxConfig]
+
+// SandboxConfigDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for SandboxConfig.
+type SandboxConfigDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*pkgapiv1alpha1.SandboxConfig]
+
+// SandboxConfigFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for SandboxConfig.
+type SandboxConfigFilteringHandler = cache.TypedFilteringResourceEventHandler[*pkgapiv1alpha1.SandboxConfig]
+
+// SandboxConfigIndexers is a specialization of [cache.TypedIndexers] for SandboxConfig.
+type SandboxConfigIndexers = cache.TypedIndexers[*pkgapiv1alpha1.SandboxConfig]
+
+// DeletedSandboxConfig is a specialization of [cache.DeletedObject] for SandboxConfig.
+type DeletedSandboxConfig = cache.DeletedObject[*pkgapiv1alpha1.SandboxConfig]
+
 type sandboxConfigInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -45,55 +74,132 @@ type sandboxConfigInformer struct {
 // NewSandboxConfigInformer constructs a new informer for SandboxConfig type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedSandboxConfigInformer]).
 func NewSandboxConfigInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
-	return NewFilteredSandboxConfigInformer(client, resyncPeriod, indexers, nil)
+	return NewSandboxConfigInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedSandboxConfigInformer constructs a new informer for SandboxConfig type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedSandboxConfigInformer(client versioned.Interface, resyncPeriod time.Duration, indexers SandboxConfigIndexers) SandboxConfigIndexInformer {
+	return NewTypedSandboxConfigInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
 }
 
 // NewFilteredSandboxConfigInformer constructs a new informer for SandboxConfig type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredSandboxConfigInformer]).
 func NewFilteredSandboxConfigInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return cache.NewSharedIndexInformer(
+	return NewTypedSandboxConfigInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredSandboxConfigInformer constructs a new informer for SandboxConfig type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredSandboxConfigInformer(client versioned.Interface, resyncPeriod time.Duration, indexers SandboxConfigIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) SandboxConfigIndexInformer {
+	return NewTypedSandboxConfigInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewSandboxConfigInformerWithOptions constructs a new informer for SandboxConfig type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedSandboxConfigInformerWithOptions]).
+func NewSandboxConfigInformerWithOptions(client versioned.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedSandboxConfigInformerWithOptions(client, options)
+}
+
+// NewTypedSandboxConfigInformerWithOptions constructs a new informer for SandboxConfig type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedSandboxConfigInformerWithOptions(client versioned.Interface, options internalinterfaces.InformerOptions) SandboxConfigIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "api", Version: "v1alpha1", Resource: "sandboxconfigs"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.SandboxConfig](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
-			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().SandboxConfigs().List(context.Background(), options)
+				return client.ApiV1alpha1().SandboxConfigs().List(context.Background(), opts)
 			},
-			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(opts v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().SandboxConfigs().Watch(context.Background(), options)
+				return client.ApiV1alpha1().SandboxConfigs().Watch(context.Background(), opts)
 			},
-			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+			ListWithContextFunc: func(ctx context.Context, opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().SandboxConfigs().List(ctx, options)
+				return client.ApiV1alpha1().SandboxConfigs().List(ctx, opts)
 			},
-			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+			WatchFuncWithContext: func(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().SandboxConfigs().Watch(ctx, options)
+				return client.ApiV1alpha1().SandboxConfigs().Watch(ctx, opts)
 			},
 		}, client),
 		&pkgapiv1alpha1.SandboxConfig{},
-		resyncPeriod,
-		indexers,
-	)
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
 }
 
 func (f *sandboxConfigInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewFilteredSandboxConfigInformer(client, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+	return NewTypedSandboxConfigInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *sandboxConfigInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&pkgapiv1alpha1.SandboxConfig{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *sandboxConfigInformer) TypedInformer() SandboxConfigIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.SandboxConfig](f.factory.InformerFor(&pkgapiv1alpha1.SandboxConfig{}, f.defaultInformer))
 }
 
 func (f *sandboxConfigInformer) Lister() apiv1alpha1.SandboxConfigLister {
 	return apiv1alpha1.NewSandboxConfigLister(f.Informer().GetIndexer())
 }
+
+// ToTypedSandboxConfigInformer converts an untyped informer into a TypedSandboxConfigInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *SandboxConfig. If that is not the case, calling type-safe methods of the returned
+// TypedSandboxConfigInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedSandboxConfigInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedSandboxConfigInformer(informer SandboxConfigInformer) TypedSandboxConfigInformer {
+	if informer, ok := informer.(TypedSandboxConfigInformer); ok {
+		return informer
+	}
+	return &sandboxConfigTypedInformerAdapter{informer}
+}
+
+type sandboxConfigTypedInformerAdapter struct {
+	SandboxConfigInformer
+}
+
+func (a *sandboxConfigTypedInformerAdapter) TypedInformer() SandboxConfigIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.SandboxConfig](a.Informer())
+}
+
+// ToSandboxConfigIndexInformer converts an untyped informer into a SandboxConfigIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *SandboxConfig. If that is not the case, calling type-safe methods of the returned
+// SandboxConfigIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a SandboxConfigIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToSandboxConfigIndexInformer(informer cache.SharedIndexInformer) SandboxConfigIndexInformer {
+	if informer, ok := informer.(SandboxConfigIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.SandboxConfig](informer)
+}
diff --git a/pkg/client/informers/externalversions/api/v1alpha1/workerpool.go b/pkg/client/informers/externalversions/api/v1alpha1/workerpool.go
index 0a607819f0..33357e1d18 100644
--- a/pkg/client/informers/externalversions/api/v1alpha1/workerpool.go
+++ b/pkg/client/informers/externalversions/api/v1alpha1/workerpool.go
@@ -26,17 +26,46 @@ import (
 	apiv1alpha1 "github.com/agent-substrate/substrate/pkg/client/listers/api/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	watch "k8s.io/apimachinery/pkg/watch"
 	cache "k8s.io/client-go/tools/cache"
 )
 
 // WorkerPoolInformer provides access to a shared informer and lister for
-// WorkerPools.
+// WorkerPools. Prefer using the type-safe variant (see [TypedWorkerPoolInformer]).
 type WorkerPoolInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() apiv1alpha1.WorkerPoolLister
 }
 
+// TypedWorkerPoolInformer provides access to a shared informer and lister for
+// WorkerPools, including the type-safe TypedInformer variant.
+// It is a superset of WorkerPoolInformer.
+type TypedWorkerPoolInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() WorkerPoolIndexInformer
+	Lister() apiv1alpha1.WorkerPoolLister
+}
+
+// WorkerPoolIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type WorkerPoolIndexInformer cache.TypedSharedIndexInformer[*pkgapiv1alpha1.WorkerPool]
+
+// WorkerPoolHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for WorkerPool.
+type WorkerPoolHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*pkgapiv1alpha1.WorkerPool]
+
+// WorkerPoolDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for WorkerPool.
+type WorkerPoolDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*pkgapiv1alpha1.WorkerPool]
+
+// WorkerPoolFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for WorkerPool.
+type WorkerPoolFilteringHandler = cache.TypedFilteringResourceEventHandler[*pkgapiv1alpha1.WorkerPool]
+
+// WorkerPoolIndexers is a specialization of [cache.TypedIndexers] for WorkerPool.
+type WorkerPoolIndexers = cache.TypedIndexers[*pkgapiv1alpha1.WorkerPool]
+
+// DeletedWorkerPool is a specialization of [cache.DeletedObject] for WorkerPool.
+type DeletedWorkerPool = cache.DeletedObject[*pkgapiv1alpha1.WorkerPool]
+
 type workerPoolInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -46,55 +75,132 @@ type workerPoolInformer struct {
 // NewWorkerPoolInformer constructs a new informer for WorkerPool type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedWorkerPoolInformer]).
 func NewWorkerPoolInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
-	return NewFilteredWorkerPoolInformer(client, namespace, resyncPeriod, indexers, nil)
+	return NewWorkerPoolInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedWorkerPoolInformer constructs a new informer for WorkerPool type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedWorkerPoolInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers WorkerPoolIndexers) WorkerPoolIndexInformer {
+	return NewTypedWorkerPoolInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
 }
 
 // NewFilteredWorkerPoolInformer constructs a new informer for WorkerPool type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredWorkerPoolInformer]).
 func NewFilteredWorkerPoolInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return cache.NewSharedIndexInformer(
+	return NewTypedWorkerPoolInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredWorkerPoolInformer constructs a new informer for WorkerPool type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredWorkerPoolInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers WorkerPoolIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) WorkerPoolIndexInformer {
+	return NewTypedWorkerPoolInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewWorkerPoolInformerWithOptions constructs a new informer for WorkerPool type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedWorkerPoolInformerWithOptions]).
+func NewWorkerPoolInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedWorkerPoolInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedWorkerPoolInformerWithOptions constructs a new informer for WorkerPool type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedWorkerPoolInformerWithOptions(client versioned.Interface, namespace string, options internalinterfaces.InformerOptions) WorkerPoolIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "api", Version: "v1alpha1", Resource: "workerpools"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.WorkerPool](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
-			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().WorkerPools(namespace).List(context.Background(), options)
+				return client.ApiV1alpha1().WorkerPools(namespace).List(context.Background(), opts)
 			},
-			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(opts v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().WorkerPools(namespace).Watch(context.Background(), options)
+				return client.ApiV1alpha1().WorkerPools(namespace).Watch(context.Background(), opts)
 			},
-			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+			ListWithContextFunc: func(ctx context.Context, opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().WorkerPools(namespace).List(ctx, options)
+				return client.ApiV1alpha1().WorkerPools(namespace).List(ctx, opts)
 			},
-			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+			WatchFuncWithContext: func(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
-					tweakListOptions(&options)
+					tweakListOptions(&opts)
 				}
-				return client.ApiV1alpha1().WorkerPools(namespace).Watch(ctx, options)
+				return client.ApiV1alpha1().WorkerPools(namespace).Watch(ctx, opts)
 			},
 		}, client),
 		&pkgapiv1alpha1.WorkerPool{},
-		resyncPeriod,
-		indexers,
-	)
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
 }
 
 func (f *workerPoolInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewFilteredWorkerPoolInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+	return NewTypedWorkerPoolInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *workerPoolInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&pkgapiv1alpha1.WorkerPool{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *workerPoolInformer) TypedInformer() WorkerPoolIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.WorkerPool](f.factory.InformerFor(&pkgapiv1alpha1.WorkerPool{}, f.defaultInformer))
 }
 
 func (f *workerPoolInformer) Lister() apiv1alpha1.WorkerPoolLister {
 	return apiv1alpha1.NewWorkerPoolLister(f.Informer().GetIndexer())
 }
+
+// ToTypedWorkerPoolInformer converts an untyped informer into a TypedWorkerPoolInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *WorkerPool. If that is not the case, calling type-safe methods of the returned
+// TypedWorkerPoolInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedWorkerPoolInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedWorkerPoolInformer(informer WorkerPoolInformer) TypedWorkerPoolInformer {
+	if informer, ok := informer.(TypedWorkerPoolInformer); ok {
+		return informer
+	}
+	return &workerPoolTypedInformerAdapter{informer}
+}
+
+type workerPoolTypedInformerAdapter struct {
+	WorkerPoolInformer
+}
+
+func (a *workerPoolTypedInformerAdapter) TypedInformer() WorkerPoolIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.WorkerPool](a.Informer())
+}
+
+// ToWorkerPoolIndexInformer converts an untyped informer into a WorkerPoolIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *WorkerPool. If that is not the case, calling type-safe methods of the returned
+// WorkerPoolIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a WorkerPoolIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToWorkerPoolIndexInformer(informer cache.SharedIndexInformer) WorkerPoolIndexInformer {
+	if informer, ok := informer.(WorkerPoolIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*pkgapiv1alpha1.WorkerPool](informer)
+}
diff --git a/pkg/client/informers/externalversions/factory.go b/pkg/client/informers/externalversions/factory.go
index 9592554f46..de9c7b410d 100644
--- a/pkg/client/informers/externalversions/factory.go
+++ b/pkg/client/informers/externalversions/factory.go
@@ -17,6 +17,7 @@
 package externalversions
 
 import (
+	context "context"
 	reflect "reflect"
 	sync "sync"
 	time "time"
@@ -27,6 +28,7 @@ import (
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	wait "k8s.io/apimachinery/pkg/util/wait"
 	cache "k8s.io/client-go/tools/cache"
 )
 
@@ -41,6 +43,7 @@ type sharedInformerFactory struct {
 	defaultResync    time.Duration
 	customResync     map[reflect.Type]time.Duration
 	transform        cache.TransformFunc
+	informerName     *cache.InformerName
 
 	informers map[reflect.Type]cache.SharedIndexInformer
 	// startedInformers is used for tracking which informers have been started.
@@ -87,6 +90,21 @@ func WithTransform(transform cache.TransformFunc) SharedInformerOption {
 	}
 }
 
+// WithInformerName sets the InformerName for informer identity used in metrics.
+// The InformerName must be created via cache.NewInformerName() at startup,
+// which validates global uniqueness. Each informer type will register its
+// GVR under this name.
+func WithInformerName(informerName *cache.InformerName) SharedInformerOption {
+	return func(factory *sharedInformerFactory) *sharedInformerFactory {
+		factory.informerName = informerName
+		return factory
+	}
+}
+
+func (f *sharedInformerFactory) InformerName() *cache.InformerName {
+	return f.informerName
+}
+
 // NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces.
 func NewSharedInformerFactory(client versioned.Interface, defaultResync time.Duration) SharedInformerFactory {
 	return NewSharedInformerFactoryWithOptions(client, defaultResync)
@@ -121,6 +139,10 @@ func NewSharedInformerFactoryWithOptions(client versioned.Interface, defaultResy
 }
 
 func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
+	f.StartWithContext(wait.ContextForChannel(stopCh))
+}
+
+func (f *sharedInformerFactory) StartWithContext(ctx context.Context) {
 	f.lock.Lock()
 	defer f.lock.Unlock()
 
@@ -130,15 +152,9 @@ func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
 
 	for informerType, informer := range f.informers {
 		if !f.startedInformers[informerType] {
-			f.wg.Add(1)
-			// We need a new variable in each loop iteration,
-			// otherwise the goroutine would use the loop variable
-			// and that keeps changing.
-			informer := informer
-			go func() {
-				defer f.wg.Done()
-				informer.Run(stopCh)
-			}()
+			f.wg.Go(func() {
+				informer.RunWithContext(ctx)
+			})
 			f.startedInformers[informerType] = true
 		}
 	}
@@ -151,9 +167,15 @@ func (f *sharedInformerFactory) Shutdown() {
 
 	// Will return immediately if there is nothing to wait for.
 	f.wg.Wait()
+	f.informerName.Release()
 }
 
 func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
+	result := f.WaitForCacheSyncWithContext(wait.ContextForChannel(stopCh))
+	return result.Synced
+}
+
+func (f *sharedInformerFactory) WaitForCacheSyncWithContext(ctx context.Context) cache.SyncResult {
 	informers := func() map[reflect.Type]cache.SharedIndexInformer {
 		f.lock.Lock()
 		defer f.lock.Unlock()
@@ -167,10 +189,31 @@ func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[ref
 		return informers
 	}()
 
-	res := map[reflect.Type]bool{}
+	// Wait for informers to sync, without polling.
+	cacheSyncs := make([]cache.DoneChecker, 0, len(informers))
+	for _, informer := range informers {
+		cacheSyncs = append(cacheSyncs, informer.HasSyncedChecker())
+	}
+	cache.WaitFor(ctx, "" /* no logging */, cacheSyncs...)
+
+	res := cache.SyncResult{
+		Synced: make(map[reflect.Type]bool, len(informers)),
+	}
+	failed := false
 	for informType, informer := range informers {
-		res[informType] = cache.WaitForCacheSync(stopCh, informer.HasSynced)
+		hasSynced := informer.HasSynced()
+		if !hasSynced {
+			failed = true
+		}
+		res.Synced[informType] = hasSynced
 	}
+	if failed {
+		// context.Cause is more informative than ctx.Err().
+		// This must be non-nil, otherwise WaitFor wouldn't have stopped
+		// prematurely.
+		res.Err = context.Cause(ctx)
+	}
+
 	return res
 }
 
@@ -192,7 +235,9 @@ func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internal
 	}
 
 	informer = newFunc(f.client, resyncPeriod)
-	informer.SetTransform(f.transform)
+	if f.transform != nil {
+		informer.SetTransform(f.transform)
+	}
 	f.informers[informerType] = informer
 
 	return informer
@@ -206,30 +251,49 @@ func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internal
 //	ctx, cancel := context.WithCancel(context.Background())
 //	defer cancel()
 //	factory := NewSharedInformerFactory(client, resyncPeriod)
-//	defer factory.WaitForStop()    // Returns immediately if nothing was started.
+//	defer factory.Shutdown()    // Returns immediately if nothing was started.
 //	genericInformer := factory.ForResource(resource)
 //	typedInformer := factory.SomeAPIGroup().V1().SomeType()
-//	factory.Start(ctx.Done())          // Start processing these informers.
-//	synced := factory.WaitForCacheSync(ctx.Done())
-//	for v, ok := range synced {
-//	    if !ok {
-//	        fmt.Fprintf(os.Stderr, "caches failed to sync: %v", v)
-//	        return
-//	    }
+//	handle, err := typeInformer.Informer().AddEventHandler(...)
+//	if err != nil {
+//	    return fmt.Errorf("register event handler: %v", err)
+//	}
+//	defer typeInformer.Informer().RemoveEventHandler(handle) // Avoids leaking goroutines.
+//	factory.StartWithContext(ctx)                            // Start processing these informers.
+//	synced := factory.WaitForCacheSyncWithContext(ctx)
+//	if err := synced.AsError(); err != nil {
+//	    return err
+//	}
+//	for v := range synced {
+//	    // Only if desired log some information similar to this.
+//	    fmt.Fprintf(os.Stdout, "cache synced: %s", v)
+//	}
+//
+//	// Also make sure that all of the initial cache events have been delivered.
+//	if !WaitFor(ctx, "event handler sync", handle.HasSyncedChecker()) {
+//	    // Must have failed because of context.
+//	    return fmt.Errorf("sync event handler: %w", context.Cause(ctx))
 //	}
 //
 //	// Creating informers can also be created after Start, but then
 //	// Start must be called again:
 //	anotherGenericInformer := factory.ForResource(resource)
-//	factory.Start(ctx.Done())
+//	factory.StartWithContext(ctx)
 type SharedInformerFactory interface {
 	internalinterfaces.SharedInformerFactory
 
 	// Start initializes all requested informers. They are handled in goroutines
 	// which run until the stop channel gets closed.
 	// Warning: Start does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	//
+	// Contextual logging: StartWithContext should be used instead of Start in code which supports contextual logging.
 	Start(stopCh <-chan struct{})
 
+	// StartWithContext initializes all requested informers. They are handled in goroutines
+	// which run until the context gets canceled.
+	// Warning: StartWithContext does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	StartWithContext(ctx context.Context)
+
 	// Shutdown marks a factory as shutting down. At that point no new
 	// informers can be started anymore and Start will return without
 	// doing anything.
@@ -244,8 +308,14 @@ type SharedInformerFactory interface {
 
 	// WaitForCacheSync blocks until all started informers' caches were synced
 	// or the stop channel gets closed.
+	//
+	// Contextual logging: WaitForCacheSyncWithContext should be used instead of WaitForCacheSync in code which supports contextual logging. It also returns a more useful result.
 	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
 
+	// WaitForCacheSyncWithContext blocks until all started informers' caches were synced
+	// or the context gets canceled.
+	WaitForCacheSyncWithContext(ctx context.Context) cache.SyncResult
+
 	// ForResource gives generic access to a shared informer of the matching type.
 	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
 
diff --git a/pkg/client/informers/externalversions/internalinterfaces/factory_interfaces.go b/pkg/client/informers/externalversions/internalinterfaces/factory_interfaces.go
index df62e3dc54..4a02977dca 100644
--- a/pkg/client/informers/externalversions/internalinterfaces/factory_interfaces.go
+++ b/pkg/client/informers/externalversions/internalinterfaces/factory_interfaces.go
@@ -32,7 +32,26 @@ type NewInformerFunc func(versioned.Interface, time.Duration) cache.SharedIndexI
 type SharedInformerFactory interface {
 	Start(stopCh <-chan struct{})
 	InformerFor(obj runtime.Object, newFunc NewInformerFunc) cache.SharedIndexInformer
+	InformerName() *cache.InformerName
 }
 
 // TweakListOptionsFunc is a function that transforms a v1.ListOptions.
 type TweakListOptionsFunc func(*v1.ListOptions)
+
+// InformerOptions holds the options for creating an informer.
+type InformerOptions struct {
+	// ResyncPeriod is the resync period for this informer.
+	// If not set, defaults to 0 (no resync).
+	ResyncPeriod time.Duration
+
+	// Indexers are the indexers for this informer.
+	Indexers cache.Indexers
+
+	// InformerName is used to uniquely identify this informer for metrics.
+	// If not set, metrics will not be published for this informer.
+	// Use cache.NewInformerName() to create an InformerName at startup.
+	InformerName *cache.InformerName
+
+	// TweakListOptions is an optional function to modify the list options.
+	TweakListOptions TweakListOptionsFunc
+}
diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go
index 5510e03a3a..f33588d863 100644
--- a/pkg/proto/ateapipb/ateapi.pb.go
+++ b/pkg/proto/ateapipb/ateapi.pb.go
@@ -360,7 +360,7 @@ const (
 	Actor_STATUS_PAUSING     Actor_Status = 5
 	Actor_STATUS_PAUSED      Actor_Status = 6
 	Actor_STATUS_CRASHED     Actor_Status = 7
-	Actor_STATUS_DELETING    Actor_Status = 8
+	Actor_STATUS_DELETING    Actor_Status = 8 // Keep this in sync with the Status field's maximum.
 )
 
 // Enum value maps for Actor_Status.
@@ -638,18 +638,59 @@ type ResourceMetadata struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// atespace is the namespace the resource belongs to. Empty for global-scoped
 	// resources. Caller-specified at creation and immutable thereafter.
+	//
+	// Atespaced resources should add +k8s:subfield(atespace)=+k8s:required
+	// Non-atespaced resources should add +k8s:subfield(atespace)=+k8s:forbidden
+	// +k8s:optional
+	// +k8s:format=k8s-short-name
+	// +k8s:immutable
 	Atespace string `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"`
 	// name is the resource's name, unique within its atespace (or globally, for
 	// global-scoped resources). Caller-specified at creation and immutable thereafter.
+	//
+	// +k8s:required
+	// +k8s:format=k8s-short-name
+	// +k8s:immutable
 	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
 	// uid is a server-assigned, globally unique identifier for this resource.
 	// Immutable throughout the lifecycle of the resource.
+	//
+	// This field is ignored during create operations and used as precondition
+	// for update operations.
+	//
+	// +k8s:ifDisabled(validateOutput)=+k8s:optional
+	// +k8s:ifEnabled(validateOutput)=+k8s:required
+	// +k8s:ifEnabled(validateOutput)=+k8s:immutable
+	// +k8s:format=k8s-uuid
 	Uid string `protobuf:"bytes,3,opt,name=uid,proto3" json:"uid,omitempty"`
 	// version is increased on every mutation.
+	//
+	// This field is ignored during create operations and used as precondition
+	// for update operations.
+	//
+	// +k8s:ifDisabled(validateOutput)=+k8s:optional
+	// +k8s:ifEnabled(validateOutput)=+k8s:required
+	// +k8s:alpha(since: "0.0")=+k8s:ifEnabled(validateOutput)=+k8s:monotonic # TODO: get rid of alpha prefix
+	// +k8s:ifEnabled(validateOutput)=+k8s:update=NoUnset
+	// +k8s:minimum=1
 	Version int64 `protobuf:"varint,4,opt,name=version,proto3" json:"version,omitempty"`
 	// create_time is the time the resource was created.
+	//
+	// This field is ignored on input.
+	//
+	// +k8s:ifDisabled(validateOutput)=+k8s:optional
+	// +k8s:ifEnabled(validateOutput)=+k8s:required
+	// +k8s:ifEnabled(validateOutput)=+k8s:immutable
+	// TODO: validate that this is a valid timestamp
 	CreateTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
 	// update_time is the time the resource was last updated.
+	//
+	// This field is ignored on input.
+	//
+	// +k8s:ifDisabled(validateOutput)=+k8s:optional
+	// +k8s:ifEnabled(validateOutput)=+k8s:required
+	// TODO: validate that this is a valid timestamp
+	// TODO: validate that UpdateTime >= CreateTime
 	UpdateTime    *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -812,12 +853,22 @@ func (x *ExternalVolume) GetVolumeContext() map[string]string {
 type Actor struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// Common resource metadata: atespace, name, uid, version, timestamps.
+	//
+	// +k8s:required
+	// +k8s:subfield(atespace)=+k8s:required
 	Metadata *ResourceMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
 	// TODO: delete both fields once we start using actor_template_version below.
-	ActorTemplateNamespace string       `protobuf:"bytes,2,opt,name=actor_template_namespace,json=actorTemplateNamespace,proto3" json:"actor_template_namespace,omitempty"`
-	ActorTemplateName      string       `protobuf:"bytes,3,opt,name=actor_template_name,json=actorTemplateName,proto3" json:"actor_template_name,omitempty"`
-	ActorTemplateVersion   *ObjectRef   `protobuf:"bytes,13,opt,name=actor_template_version,json=actorTemplateVersion,proto3" json:"actor_template_version,omitempty"`
-	Status                 Actor_Status `protobuf:"varint,4,opt,name=status,proto3,enum=ateapi.Actor_Status" json:"status,omitempty"`
+	ActorTemplateNamespace string     `protobuf:"bytes,2,opt,name=actor_template_namespace,json=actorTemplateNamespace,proto3" json:"actor_template_namespace,omitempty"`
+	ActorTemplateName      string     `protobuf:"bytes,3,opt,name=actor_template_name,json=actorTemplateName,proto3" json:"actor_template_name,omitempty"`
+	ActorTemplateVersion   *ObjectRef `protobuf:"bytes,13,opt,name=actor_template_version,json=actorTemplateVersion,proto3" json:"actor_template_version,omitempty"`
+	// status is the actor's current lifecycle state, set by the system.
+	// User-provided values are ignored.
+	//
+	// +k8s:ifDisabled(validateOutput)=+k8s:forbidden
+	// +k8s:ifEnabled(validateOutput)=+k8s:required
+	// +k8s:minimum=1
+	// +k8s:maximum=8 # keep this in sync with the Status enum above
+	Status Actor_Status `protobuf:"varint,4,opt,name=status,proto3,enum=ateapi.Actor_Status" json:"status,omitempty"`
 	// worker_assignment points at the worker currently hosting this Actor.
 	// Unset whenever the Actor has no worker (SUSPENDED, PAUSED, CRASHED).
 	WorkerAssignment       *WorkerAssignment `protobuf:"bytes,5,opt,name=worker_assignment,json=workerAssignment,proto3" json:"worker_assignment,omitempty"`
@@ -1058,16 +1109,17 @@ func (x *WorkerAssignment) GetWorkerPodIp() string {
 // ActorSnapshot is an independently addressable durable Actor snapshot. Its
 // contents are immutable.
 type ActorSnapshot struct {
-	state                  protoimpl.MessageState `protogen:"open.v1"`
-	Metadata               *ResourceMetadata      `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
-	SourceActor            *ObjectRef             `protobuf:"bytes,2,opt,name=source_actor,json=sourceActor,proto3" json:"source_actor,omitempty"`
-	SourceActorUid         string                 `protobuf:"bytes,3,opt,name=source_actor_uid,json=sourceActorUid,proto3" json:"source_actor_uid,omitempty"`
-	SourceActorVersion     int64                  `protobuf:"varint,4,opt,name=source_actor_version,json=sourceActorVersion,proto3" json:"source_actor_version,omitempty"`
-	ActorTemplateNamespace string                 `protobuf:"bytes,5,opt,name=actor_template_namespace,json=actorTemplateNamespace,proto3" json:"actor_template_namespace,omitempty"`
-	ActorTemplateName      string                 `protobuf:"bytes,6,opt,name=actor_template_name,json=actorTemplateName,proto3" json:"actor_template_name,omitempty"`
-	ActorTemplateUid       string                 `protobuf:"bytes,7,opt,name=actor_template_uid,json=actorTemplateUid,proto3" json:"actor_template_uid,omitempty"`
-	ContentScope           SnapshotContentScope   `protobuf:"varint,8,opt,name=content_scope,json=contentScope,proto3,enum=ateapi.SnapshotContentScope" json:"content_scope,omitempty"`
-	SnapshotUri            string                 `protobuf:"bytes,9,opt,name=snapshot_uri,json=snapshotUri,proto3" json:"snapshot_uri,omitempty"`
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// +k8s:opaqueType
+	Metadata               *ResourceMetadata    `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	SourceActor            *ObjectRef           `protobuf:"bytes,2,opt,name=source_actor,json=sourceActor,proto3" json:"source_actor,omitempty"`
+	SourceActorUid         string               `protobuf:"bytes,3,opt,name=source_actor_uid,json=sourceActorUid,proto3" json:"source_actor_uid,omitempty"`
+	SourceActorVersion     int64                `protobuf:"varint,4,opt,name=source_actor_version,json=sourceActorVersion,proto3" json:"source_actor_version,omitempty"`
+	ActorTemplateNamespace string               `protobuf:"bytes,5,opt,name=actor_template_namespace,json=actorTemplateNamespace,proto3" json:"actor_template_namespace,omitempty"`
+	ActorTemplateName      string               `protobuf:"bytes,6,opt,name=actor_template_name,json=actorTemplateName,proto3" json:"actor_template_name,omitempty"`
+	ActorTemplateUid       string               `protobuf:"bytes,7,opt,name=actor_template_uid,json=actorTemplateUid,proto3" json:"actor_template_uid,omitempty"`
+	ContentScope           SnapshotContentScope `protobuf:"varint,8,opt,name=content_scope,json=contentScope,proto3,enum=ateapi.SnapshotContentScope" json:"content_scope,omitempty"`
+	SnapshotUri            string               `protobuf:"bytes,9,opt,name=snapshot_uri,json=snapshotUri,proto3" json:"snapshot_uri,omitempty"`
 	// Immutable reference to the actor_template_version where the snapshot was created from.
 	ActorTemplateVersion *ObjectRef `protobuf:"bytes,10,opt,name=actor_template_version,json=actorTemplateVersion,proto3" json:"actor_template_version,omitempty"`
 	unknownFields        protoimpl.UnknownFields
@@ -1177,10 +1229,11 @@ func (x *ActorSnapshot) GetActorTemplateVersion() *ObjectRef {
 // ActorSnapshotTag is an immutable, Atespace-owned alias and retention pin.
 // Its owning Atespace cannot be deleted until the tag is removed.
 type ActorSnapshotTag struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Metadata      *ResourceMetadata      `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
-	Snapshot      *ObjectRef             `protobuf:"bytes,2,opt,name=snapshot,proto3" json:"snapshot,omitempty"`
-	Scope         ActorSnapshotTagScope  `protobuf:"varint,3,opt,name=scope,proto3,enum=ateapi.ActorSnapshotTagScope" json:"scope,omitempty"`
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// +k8s:opaqueType
+	Metadata      *ResourceMetadata     `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	Snapshot      *ObjectRef            `protobuf:"bytes,2,opt,name=snapshot,proto3" json:"snapshot,omitempty"`
+	Scope         ActorSnapshotTagScope `protobuf:"varint,3,opt,name=scope,proto3,enum=ateapi.ActorSnapshotTagScope" json:"scope,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1241,6 +1294,7 @@ func (x *ActorSnapshotTag) GetScope() ActorSnapshotTagScope {
 type Atespace struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// Common resource metadata: name, uid, version, timestamps.
+	// +k8s:opaqueType
 	Metadata      *ResourceMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -1412,6 +1466,7 @@ func (x *ActorSnapshotSource) GetSnapshotUid() string {
 type ActorTemplate struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// Common resource metadata: atespace, name, uid, version, timestamps.
+	// +k8s:opaqueType
 	Metadata *ResourceMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
 	// default_version_on_create names the ActorTemplateVersion used by
 	// CreateActor calls that do not pin a version. If unset, CreateActor
@@ -1474,6 +1529,7 @@ func (x *ActorTemplate) GetDefaultVersionOnCreate() *ObjectRef {
 type ActorTemplateVersion struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// Common resource metadata: atespace, name, uid, version, timestamps.
+	// +k8s:opaqueType
 	Metadata *ResourceMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
 	// actor_template is the parent ActorTemplate. Required at creation and
 	// immutable.
@@ -3415,6 +3471,8 @@ func (x *GetActorRequest) GetActor() *ObjectRef {
 type CreateActorRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// The actor to create.
+	//
+	// +k8s:required
 	Actor         *Actor `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -3467,6 +3525,8 @@ type UpdateActorRequest struct {
 	// update.
 	// actor.metadata.version and actor.metadata.uid are optional preconditions and
 	// zero values skip the check.
+	//
+	// +k8s:opaqueType
 	Actor *Actor `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"`
 	// The set of fields to update. Required.
 	//
diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto
index cff5ab44d5..008d97abcd 100644
--- a/pkg/proto/ateapipb/ateapi.proto
+++ b/pkg/proto/ateapipb/ateapi.proto
@@ -154,23 +154,64 @@ message Selector {
 message ResourceMetadata {
   // atespace is the namespace the resource belongs to. Empty for global-scoped
   // resources. Caller-specified at creation and immutable thereafter.
+  //
+  // Atespaced resources should add +k8s:subfield(atespace)=+k8s:required
+  // Non-atespaced resources should add +k8s:subfield(atespace)=+k8s:forbidden
+  // +k8s:optional
+  // +k8s:format=k8s-short-name
+  // +k8s:immutable
   string atespace = 1;
 
   // name is the resource's name, unique within its atespace (or globally, for
   // global-scoped resources). Caller-specified at creation and immutable thereafter.
+  //
+  // +k8s:required
+  // +k8s:format=k8s-short-name
+  // +k8s:immutable
   string name = 2;
 
   // uid is a server-assigned, globally unique identifier for this resource.
   // Immutable throughout the lifecycle of the resource.
+  //
+  // This field is ignored during create operations and used as precondition
+  // for update operations.
+  //
+  // +k8s:ifDisabled(validateOutput)=+k8s:optional
+  // +k8s:ifEnabled(validateOutput)=+k8s:required
+  // +k8s:ifEnabled(validateOutput)=+k8s:immutable
+  // +k8s:format=k8s-uuid
   string uid = 3;
 
   // version is increased on every mutation.
+  //
+  // This field is ignored during create operations and used as precondition
+  // for update operations.
+  //
+  // +k8s:ifDisabled(validateOutput)=+k8s:optional
+  // +k8s:ifEnabled(validateOutput)=+k8s:required
+  // +k8s:alpha(since: "0.0")=+k8s:ifEnabled(validateOutput)=+k8s:monotonic # TODO: get rid of alpha prefix
+  // +k8s:ifEnabled(validateOutput)=+k8s:update=NoUnset
+  // +k8s:minimum=1
   int64 version = 4;
 
   // create_time is the time the resource was created.
+  //
+  // This field is ignored on input.
+  //
+  // +k8s:ifDisabled(validateOutput)=+k8s:optional
+  // +k8s:ifEnabled(validateOutput)=+k8s:required
+  // +k8s:ifEnabled(validateOutput)=+k8s:immutable
+  // TODO: validate that this is a valid timestamp
   google.protobuf.Timestamp create_time = 5;
 
   // update_time is the time the resource was last updated.
+  //
+  // This field is ignored on input.
+  //
+  // +k8s:ifDisabled(validateOutput)=+k8s:optional
+  // +k8s:ifEnabled(validateOutput)=+k8s:required
+  // TODO: validate that this is a valid timestamp
+  // TODO: validate that UpdateTime >= CreateTime
   google.protobuf.Timestamp update_time = 6;
 }
 
@@ -202,6 +243,9 @@ message ExternalVolume {
 
 message Actor {
   // Common resource metadata: atespace, name, uid, version, timestamps.
+  //
+  // +k8s:required
+  // +k8s:subfield(atespace)=+k8s:required
   ResourceMetadata metadata = 1;
 
   // TODO: delete both fields once we start using actor_template_version below.
@@ -220,7 +264,15 @@ message Actor {
     STATUS_PAUSED = 6;
     STATUS_CRASHED = 7;
     STATUS_DELETING = 8;
+    // Keep this in sync with the Status field's maximum.
   }
+  // status is the actor's current lifecycle state, set by the system.
+  // User-provided values are ignored.
+  //
+  // +k8s:ifDisabled(validateOutput)=+k8s:forbidden
+  // +k8s:ifEnabled(validateOutput)=+k8s:required
+  // +k8s:minimum=1
+  // +k8s:maximum=8 # keep this in sync with the Status enum above
   Status status = 4;
 
   // worker_assignment points at the worker currently hosting this Actor.
@@ -277,6 +329,7 @@ message WorkerAssignment {
 // ActorSnapshot is an independently addressable durable Actor snapshot. Its
 // contents are immutable.
 message ActorSnapshot {
+  // +k8s:opaqueType
   ResourceMetadata metadata = 1;
   ObjectRef source_actor = 2;
   string source_actor_uid = 3;
@@ -293,6 +346,7 @@ message ActorSnapshot {
 // ActorSnapshotTag is an immutable, Atespace-owned alias and retention pin.
 // Its owning Atespace cannot be deleted until the tag is removed.
 message ActorSnapshotTag {
+  // +k8s:opaqueType
   ResourceMetadata metadata = 1;
   ObjectRef snapshot = 2;
   ActorSnapshotTagScope scope = 3;
@@ -302,6 +356,7 @@ message ActorSnapshotTag {
 // metadata.atespace is always empty; the atespace's identity is metadata.name.
 message Atespace {
   // Common resource metadata: name, uid, version, timestamps.
+  // +k8s:opaqueType
   ResourceMetadata metadata = 1;
 }
 
@@ -342,6 +397,7 @@ enum SandboxClass {
 // ActorTemplateVersion to be used when creating Actors.
 message ActorTemplate {
   // Common resource metadata: atespace, name, uid, version, timestamps.
+  // +k8s:opaqueType
   ResourceMetadata metadata = 1;
 
   // default_version_on_create names the ActorTemplateVersion used by
@@ -360,6 +416,7 @@ message ActorTemplate {
 // ActorTemplateVersion is Atespaced.
 message ActorTemplateVersion {
   // Common resource metadata: atespace, name, uid, version, timestamps.
+  // +k8s:opaqueType
   ResourceMetadata metadata = 1;
 
   // actor_template is the parent ActorTemplate. Required at creation and
@@ -717,6 +774,8 @@ message GetActorRequest {
 // Request to create a new Actor.
 message CreateActorRequest {
   // The actor to create.
+  //
+  // +k8s:required
   Actor actor = 1;
 }
 
@@ -729,6 +788,8 @@ message UpdateActorRequest {
   // update.
   // actor.metadata.version and actor.metadata.uid are optional preconditions and
   // zero values skip the check.
+  //
+  // +k8s:opaqueType
   Actor actor = 1;
 
   // The set of fields to update. Required.
diff --git a/pkg/proto/ateapipb/gen.go b/pkg/proto/ateapipb/gen.go
deleted file mode 100644
index 56d1208af1..0000000000
--- a/pkg/proto/ateapipb/gen.go
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2026 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ateapipb
-
-//go:generate bash -c "../../../hack/protoc.sh --plugin=protoc-gen-go=$(bash ../../../hack/run-tool.sh --print-bin-path protoc-gen-go) --plugin=protoc-gen-go-grpc=$(bash ../../../hack/run-tool.sh --print-bin-path protoc-gen-go-grpc) --go_out=paths=source_relative:. --go-grpc_out=paths=source_relative:. ateapi.proto"
diff --git a/third_party/k8s.io/apimachinery/.github/PULL_REQUEST_TEMPLATE.md b/third_party/k8s.io/apimachinery/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000000..e7e5eb834b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,2 @@
+Sorry, we do not accept changes directly against this repository. Please see
+CONTRIBUTING.md for information on where and how to contribute instead.
diff --git a/third_party/k8s.io/apimachinery/CONTRIBUTING.md b/third_party/k8s.io/apimachinery/CONTRIBUTING.md
new file mode 100644
index 0000000000..4bcf54520d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/CONTRIBUTING.md
@@ -0,0 +1,7 @@
+# Contributing guidelines
+
+Do not open pull requests directly against this repository, they will be ignored. Instead, please open pull requests against [kubernetes/kubernetes](https://git.k8s.io/kubernetes/).  Please follow the same [contributing guide](https://git.k8s.io/kubernetes/CONTRIBUTING.md) you would follow for any other pull request made to kubernetes/kubernetes.
+
+This repository is published from [kubernetes/kubernetes/staging/src/k8s.io/apimachinery](https://git.k8s.io/kubernetes/staging/src/k8s.io/apimachinery) by the [kubernetes publishing-bot](https://git.k8s.io/publishing-bot).
+
+Please see [Staging Directory and Publishing](https://git.k8s.io/community/contributors/devel/sig-architecture/staging.md) for more information
diff --git a/third_party/k8s.io/apimachinery/LICENSE b/third_party/k8s.io/apimachinery/LICENSE
new file mode 100644
index 0000000000..d645695673
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/third_party/k8s.io/apimachinery/OWNERS b/third_party/k8s.io/apimachinery/OWNERS
new file mode 100644
index 0000000000..08b30b3ebc
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/OWNERS
@@ -0,0 +1,28 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+  - smarterclayton
+  - deads2k
+  - sttts
+  - liggitt
+  - caesarxuchao
+  - jpbetz
+reviewers:
+  - apelisse
+  - thockin
+  - smarterclayton
+  - wojtek-t
+  - deads2k
+  - derekwaynecarr
+  - caesarxuchao
+  - cheftako
+  - mikedanese
+  - liggitt
+  - sttts
+  - jpbetz
+labels:
+  - sig/api-machinery
+emeritus_approvers:
+  - lavalamp
+emeritus_reviewers:
+  - ncdc
diff --git a/third_party/k8s.io/apimachinery/README.md b/third_party/k8s.io/apimachinery/README.md
new file mode 100644
index 0000000000..420e9fda12
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/README.md
@@ -0,0 +1,34 @@
+> ⚠️ **This is an automatically published [staged repository](https://git.k8s.io/kubernetes/staging#external-repository-staging-area) for Kubernetes**.   
+> Contributions, including issues and pull requests, should be made to the main Kubernetes repository: [https://github.com/kubernetes/kubernetes](https://github.com/kubernetes/kubernetes).  
+> This repository is read-only for importing, and not used for direct contributions.  
+> See [CONTRIBUTING.md](./CONTRIBUTING.md) for more details.
+# apimachinery
+
+Scheme, typing, encoding, decoding, and conversion packages for Kubernetes and Kubernetes-like API objects.
+
+
+## Purpose
+
+This library is a shared dependency for servers and clients to work with Kubernetes API infrastructure without direct
+type dependencies. Its first consumers are `k8s.io/kubernetes`, `k8s.io/client-go`, and `k8s.io/apiserver`.
+
+
+## Compatibility
+
+There are *NO compatibility guarantees* for this repository. It is in direct support of Kubernetes, so branches
+will track Kubernetes and be compatible with that repo. As we more cleanly separate the layers, we will review the
+compatibility guarantee.
+
+
+## Where does it come from?
+
+`apimachinery` is synced from https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery.
+Code changes are made in that location, merged into `k8s.io/kubernetes` and later synced here.
+
+
+## Things you should *NOT* do
+
+ 1. Add API types to this repo. This is for the machinery, not for the types.
+ 2. Directly modify any files under `pkg` in this repo. Those are driven from `k8s.io/kubernetes/staging/src/k8s.io/apimachinery`.
+ 3. Expect compatibility. This repo is direct support of Kubernetes and the API isn't yet stable enough for API guarantees.
+
diff --git a/third_party/k8s.io/apimachinery/SECURITY_CONTACTS b/third_party/k8s.io/apimachinery/SECURITY_CONTACTS
new file mode 100644
index 0000000000..f6003980fc
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/SECURITY_CONTACTS
@@ -0,0 +1,16 @@
+# Defined below are the security contacts for this repo.
+#
+# They are the contact point for the Product Security Committee to reach out
+# to for triaging and handling of incoming issues.
+#
+# The below names agree to abide by the
+# [Embargo Policy](https://git.k8s.io/security/private-distributors-list.md#embargo-policy)
+# and will be removed and replaced if they violate that agreement.
+#
+# DO NOT REPORT SECURITY VULNERABILITIES DIRECTLY TO THESE NAMES, FOLLOW THE
+# INSTRUCTIONS AT https://kubernetes.io/security/
+
+cheftako
+deads2k
+lavalamp
+sttts
diff --git a/third_party/k8s.io/apimachinery/code-of-conduct.md b/third_party/k8s.io/apimachinery/code-of-conduct.md
new file mode 100644
index 0000000000..0d15c00cf3
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/code-of-conduct.md
@@ -0,0 +1,3 @@
+# Kubernetes Community Code of Conduct
+
+Please refer to our [Kubernetes Community Code of Conduct](https://git.k8s.io/community/code-of-conduct.md)
diff --git a/third_party/k8s.io/apimachinery/doc.go b/third_party/k8s.io/apimachinery/doc.go
new file mode 100644
index 0000000000..1659a0fa6e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/doc.go
@@ -0,0 +1,17 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apimachinery
diff --git a/third_party/k8s.io/apimachinery/go.mod b/third_party/k8s.io/apimachinery/go.mod
new file mode 100644
index 0000000000..c99bb415a7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/go.mod
@@ -0,0 +1,62 @@
+// This is a generated file. Do not edit directly.
+
+module k8s.io/apimachinery
+
+go 1.26.0
+
+godebug default=go1.26
+
+require (
+	github.com/fxamacker/cbor/v2 v2.9.1
+	github.com/google/gnostic-models v0.7.0
+	github.com/google/go-cmp v0.7.0
+	github.com/google/uuid v1.6.0
+	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
+	github.com/spf13/pflag v1.0.10
+	github.com/stretchr/testify v1.11.1
+	golang.org/x/net v0.57.0
+	golang.org/x/time v0.15.0
+	gopkg.in/evanphx/json-patch.v4 v4.13.0
+	gopkg.in/inf.v0 v0.9.1
+	k8s.io/klog/v2 v2.140.0
+	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad
+	k8s.io/streaming v0.37.0-rc.0
+	k8s.io/utils v0.0.0-20260626114624-be93311217bd
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730
+	sigs.k8s.io/randfill v1.0.0
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2
+	sigs.k8s.io/yaml v1.6.0
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-openapi/jsonpointer v1.0.0 // indirect
+	github.com/go-openapi/jsonreference v1.0.0 // indirect
+	github.com/go-openapi/swag v0.27.1 // indirect
+	github.com/go-openapi/swag/cmdutils v0.27.1 // indirect
+	github.com/go-openapi/swag/conv v0.27.1 // indirect
+	github.com/go-openapi/swag/fileutils v0.27.1 // indirect
+	github.com/go-openapi/swag/jsonutils v0.27.1 // indirect
+	github.com/go-openapi/swag/loading v0.27.1 // indirect
+	github.com/go-openapi/swag/mangling v0.27.1 // indirect
+	github.com/go-openapi/swag/netutils v0.27.1 // indirect
+	github.com/go-openapi/swag/pools v0.27.1 // indirect
+	github.com/go-openapi/swag/stringutils v0.27.1 // indirect
+	github.com/go-openapi/swag/typeutils v0.27.1 // indirect
+	github.com/go-openapi/swag/yamlutils v0.27.1 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
+	github.com/moby/spdystream v0.5.1 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
+	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
diff --git a/third_party/k8s.io/apimachinery/go.sum b/third_party/k8s.io/apimachinery/go.sum
new file mode 100644
index 0000000000..99df51e773
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/go.sum
@@ -0,0 +1,123 @@
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
+github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
+github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
+github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY=
+github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0=
+github.com/go-openapi/swag v0.27.1 h1:VotvOLWW8q/EAxB0YdsBBGC8XYyeL1YwBj2ungAGPNg=
+github.com/go-openapi/swag v0.27.1/go.mod h1:GTkJPwHfhJp6MWr4/rCh64HVI3Ofu+tcsbfjfHmTxpE=
+github.com/go-openapi/swag/cmdutils v0.27.1 h1:I7sYqaWVl5mq0NEmNQkAmFDyNin9ufvMX/p2zwtQaOE=
+github.com/go-openapi/swag/cmdutils v0.27.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
+github.com/go-openapi/swag/conv v0.27.1 h1:8wi9ZG+olmY1wXphl93EWniPtbSPkXM/feH7FgjsvrU=
+github.com/go-openapi/swag/conv v0.27.1/go.mod h1:QbqMivkpKhC3g1B1GGGOJ6ANewI3S62dbzYu3Duowqs=
+github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzrb0QkmLKf9oM=
+github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8=
+github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU=
+github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1 h1:mJu3COL9WEaZVp/Kf2PRMi7tPszPEJfSr/OO75ynCs8=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY=
+github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY=
+github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE=
+github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA=
+github.com/go-openapi/swag/mangling v0.27.1/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w=
+github.com/go-openapi/swag/netutils v0.27.1 h1:mICMFoS82F5TZ4Zy3cqmcQk+BFeCp3Uyq3Np7GI0/qU=
+github.com/go-openapi/swag/netutils v0.27.1/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ=
+github.com/go-openapi/swag/pools v0.27.1 h1:9LeadcMyb2GJCbXX5hVQDbZ2Lq9TL4dCs/nx1j5DO0E=
+github.com/go-openapi/swag/pools v0.27.1/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE=
+github.com/go-openapi/swag/stringutils v0.27.1 h1:ZXePZ0r2p1qSjo8tD3Un4vFj8+FqlCkczxDrJIhYUp8=
+github.com/go-openapi/swag/stringutils v0.27.1/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM=
+github.com/go-openapi/swag/typeutils v0.27.1 h1:KSTdFlfnse4r6dP9IrEnwMldjE+zs71UeEB3//PtVXc=
+github.com/go-openapi/swag/typeutils v0.27.1/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ=
+github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA=
+github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo=
+github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
+github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y=
+github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+k8s.io/streaming v0.37.0-rc.0 h1:zDBjrKCnSLQyznohS8DyT1vmiD1s7XEcj5B9kyfN1WQ=
+k8s.io/streaming v0.37.0-rc.0/go.mod h1:APlJR26ZWRcVy5bIEj0QRrKUXROtBHPcxl2NT7EAzPU=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/third_party/k8s.io/apimachinery/pkg/OWNERS b/third_party/k8s.io/apimachinery/pkg/OWNERS
new file mode 100644
index 0000000000..18c387cc97
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/OWNERS
@@ -0,0 +1,9 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+  - caesarxuchao
+  - deads2k
+  - smarterclayton
+  - liggitt
+emeritus_approvers:
+  - lavalamp
diff --git a/third_party/k8s.io/apimachinery/pkg/api/apitesting/close.go b/third_party/k8s.io/apimachinery/pkg/api/apitesting/close.go
new file mode 100644
index 0000000000..dfb5657eb9
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/apitesting/close.go
@@ -0,0 +1,54 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apitesting
+
+import (
+	"io"
+	"testing"
+)
+
+// Close and fail the test if it returns an error.
+func Close(t TestingT, c io.Closer) {
+	t.Helper()
+	assertNoError(t, c.Close())
+}
+
+// CloseNoOp does nothing. Use as a replacement for Close when you
+// need to disable a defer.
+func CloseNoOp(TestingT, io.Closer) {}
+
+// TestingT simulates assert.TestingT and assert.tHelper without adding
+// testify as a non-test dependency.
+type TestingT interface {
+	Errorf(format string, args ...interface{})
+	Helper()
+}
+
+// Ensure that testing T & B satisfy the TestingT interface
+var _ TestingT = &testing.T{}
+var _ TestingT = &testing.B{}
+
+// assertNoError simulates assert.NoError without adding testify as a
+// non-test dependency.
+//
+// In test files, use github.com/stretchr/testify/assert instead.
+func assertNoError(t TestingT, err error) {
+	t.Helper()
+	if err != nil {
+		t.Errorf("Received unexpected error:\n%+v", err)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/apitesting/codec.go b/third_party/k8s.io/apimachinery/pkg/api/apitesting/codec.go
new file mode 100644
index 0000000000..542b0aa275
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/apitesting/codec.go
@@ -0,0 +1,116 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apitesting
+
+import (
+	"fmt"
+	"mime"
+	"os"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apimachinery/pkg/runtime/serializer/recognizer"
+)
+
+var (
+	testCodecMediaType        string
+	testStorageCodecMediaType string
+)
+
+// TestCodec returns the codec for the API version to test against, as set by the
+// KUBE_TEST_API_TYPE env var.
+func TestCodec(codecs runtimeserializer.CodecFactory, gvs ...schema.GroupVersion) runtime.Codec {
+	if len(testCodecMediaType) != 0 {
+		serializerInfo, ok := runtime.SerializerInfoForMediaType(codecs.SupportedMediaTypes(), testCodecMediaType)
+		if !ok {
+			panic(fmt.Sprintf("no serializer for %s", testCodecMediaType))
+		}
+		return codecs.CodecForVersions(serializerInfo.Serializer, codecs.UniversalDeserializer(), schema.GroupVersions(gvs), nil)
+	}
+	return codecs.LegacyCodec(gvs...)
+}
+
+// TestStorageCodec returns the codec for the API version to test against used in storage, as set by the
+// KUBE_TEST_API_STORAGE_TYPE env var.
+func TestStorageCodec(codecs runtimeserializer.CodecFactory, gvs ...schema.GroupVersion) runtime.Codec {
+	if len(testStorageCodecMediaType) != 0 {
+		serializerInfo, ok := runtime.SerializerInfoForMediaType(codecs.SupportedMediaTypes(), testStorageCodecMediaType)
+		if !ok {
+			panic(fmt.Sprintf("no serializer for %s", testStorageCodecMediaType))
+		}
+
+		// etcd2 only supports string data - we must wrap any result before returning
+		// TODO: remove for etcd3 / make parameterizable
+		serializer := serializerInfo.Serializer
+		if !serializerInfo.EncodesAsText {
+			serializer = runtime.NewBase64Serializer(serializer, serializer)
+		}
+
+		decoder := recognizer.NewDecoder(serializer, codecs.UniversalDeserializer())
+		return codecs.CodecForVersions(serializer, decoder, schema.GroupVersions(gvs), nil)
+
+	}
+	return codecs.LegacyCodec(gvs...)
+}
+
+func init() {
+	var err error
+	if apiMediaType := os.Getenv("KUBE_TEST_API_TYPE"); len(apiMediaType) > 0 {
+		testCodecMediaType, _, err = mime.ParseMediaType(apiMediaType)
+		if err != nil {
+			panic(err)
+		}
+	}
+
+	if storageMediaType := os.Getenv("KUBE_TEST_API_STORAGE_TYPE"); len(storageMediaType) > 0 {
+		testStorageCodecMediaType, _, err = mime.ParseMediaType(storageMediaType)
+		if err != nil {
+			panic(err)
+		}
+	}
+}
+
+// InstallOrDieFunc mirrors install functions that require success
+type InstallOrDieFunc func(scheme *runtime.Scheme)
+
+// SchemeForInstallOrDie builds a simple test scheme and codecfactory pair for easy unit testing from higher level install methods
+func SchemeForInstallOrDie(installFns ...InstallOrDieFunc) (*runtime.Scheme, runtimeserializer.CodecFactory) {
+	scheme := runtime.NewScheme()
+	codecFactory := runtimeserializer.NewCodecFactory(scheme)
+	for _, installFn := range installFns {
+		installFn(scheme)
+	}
+
+	return scheme, codecFactory
+}
+
+// InstallFunc mirrors install functions that can return an error
+type InstallFunc func(scheme *runtime.Scheme) error
+
+// SchemeForOrDie builds a simple test scheme and codecfactory pair for easy unit testing from the bare registration methods.
+func SchemeForOrDie(installFns ...InstallFunc) (*runtime.Scheme, runtimeserializer.CodecFactory) {
+	scheme := runtime.NewScheme()
+	codecFactory := runtimeserializer.NewCodecFactory(scheme)
+	for _, installFn := range installFns {
+		if err := installFn(scheme); err != nil {
+			panic(err)
+		}
+	}
+
+	return scheme, codecFactory
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/fuzzer.go b/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/fuzzer.go
new file mode 100644
index 0000000000..a12370886f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/fuzzer.go
@@ -0,0 +1,73 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fuzzer
+
+import (
+	"encoding/json"
+	"fmt"
+	"math/rand"
+
+	"sigs.k8s.io/randfill"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	kjson "k8s.io/apimachinery/pkg/util/json"
+)
+
+// FuzzerFuncs returns a list of func(*SomeType, c randfill.Continue) functions.
+type FuzzerFuncs func(codecs runtimeserializer.CodecFactory) []interface{}
+
+// FuzzerFor can randomly populate api objects that are destined for version.
+func FuzzerFor(funcs FuzzerFuncs, src rand.Source, codecs runtimeserializer.CodecFactory) *randfill.Filler {
+	f := randfill.New().NilChance(.5).NumElements(0, 1)
+	if src != nil {
+		f.RandSource(src)
+	}
+	f.Funcs(funcs(codecs)...)
+	return f
+}
+
+// MergeFuzzerFuncs will merge the given funcLists, overriding early funcs with later ones if there first
+// argument has the same type.
+func MergeFuzzerFuncs(funcs ...FuzzerFuncs) FuzzerFuncs {
+	return FuzzerFuncs(func(codecs runtimeserializer.CodecFactory) []interface{} {
+		result := []interface{}{}
+		for _, f := range funcs {
+			if f != nil {
+				result = append(result, f(codecs)...)
+			}
+		}
+		return result
+	})
+}
+
+func NormalizeJSONRawExtension(ext *runtime.RawExtension) {
+	if json.Valid(ext.Raw) {
+		// RawExtension->JSON encodes struct fields in field index order while map[string]interface{}->JSON encodes
+		// struct fields (i.e. keys in the map) lexicographically. We have to sort the fields here to ensure the
+		// JSON in the (RawExtension->)JSON->map[string]interface{}->JSON round trip results in identical JSON.
+		var u any
+		err := kjson.Unmarshal(ext.Raw, &u)
+		if err != nil {
+			panic(fmt.Sprintf("Failed to encode object: %v", err))
+		}
+		ext.Raw, err = kjson.Marshal(&u)
+		if err != nil {
+			panic(fmt.Sprintf("Failed to encode object: %v", err))
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/valuefuzz.go b/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/valuefuzz.go
new file mode 100644
index 0000000000..facff57bba
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/valuefuzz.go
@@ -0,0 +1,86 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fuzzer
+
+import (
+	"reflect"
+)
+
+// ValueFuzz recursively changes all basic type values in an object. Any kind of references will not
+// be touch, i.e. the addresses of slices, maps, pointers will stay unchanged.
+func ValueFuzz(obj interface{}) {
+	valueFuzz(reflect.ValueOf(obj))
+}
+
+func valueFuzz(obj reflect.Value) {
+	switch obj.Kind() {
+	case reflect.Array:
+		for i := 0; i < obj.Len(); i++ {
+			valueFuzz(obj.Index(i))
+		}
+	case reflect.Slice:
+		if obj.IsNil() {
+			// TODO: set non-nil value
+		} else {
+			for i := 0; i < obj.Len(); i++ {
+				valueFuzz(obj.Index(i))
+			}
+		}
+	case reflect.Interface, reflect.Pointer:
+		if obj.IsNil() {
+			// TODO: set non-nil value
+		} else {
+			valueFuzz(obj.Elem())
+		}
+	case reflect.Struct:
+		for i, n := 0, obj.NumField(); i < n; i++ {
+			valueFuzz(obj.Field(i))
+		}
+	case reflect.Map:
+		if obj.IsNil() {
+			// TODO: set non-nil value
+		} else {
+			for _, k := range obj.MapKeys() {
+				// map values are not addressable. We need a copy.
+				v := obj.MapIndex(k)
+				copy := reflect.New(v.Type())
+				copy.Elem().Set(v)
+				valueFuzz(copy.Elem())
+				obj.SetMapIndex(k, copy.Elem())
+			}
+			// TODO: set some new value
+		}
+	case reflect.Func: // ignore, we don't have function types in our API
+	default:
+		if !obj.CanSet() {
+			return
+		}
+		switch obj.Kind() {
+		case reflect.String:
+			obj.SetString(obj.String() + "x")
+		case reflect.Bool:
+			obj.SetBool(!obj.Bool())
+		case reflect.Float32, reflect.Float64:
+			obj.SetFloat(obj.Float()*2.0 + 1.0)
+		case reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64, reflect.Int:
+			obj.SetInt(obj.Int() + 1)
+		case reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uint:
+			obj.SetUint(obj.Uint() + 1)
+		default:
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/valuefuzz_test.go b/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/valuefuzz_test.go
new file mode 100644
index 0000000000..a935aa40c7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/apitesting/fuzzer/valuefuzz_test.go
@@ -0,0 +1,73 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fuzzer
+
+import "testing"
+
+func TestValueFuzz(t *testing.T) {
+	type (
+		Y struct {
+			I int
+			B bool
+			F float32
+			U uint
+		}
+		X struct {
+			Ptr   *X
+			Y     Y
+			Map   map[string]int
+			Slice []int
+		}
+	)
+
+	x := X{
+		Ptr:   &X{},
+		Map:   map[string]int{"foo": 42},
+		Slice: []int{1, 2, 3},
+	}
+
+	p := x.Ptr
+	m := x.Map
+	s := x.Slice
+
+	ValueFuzz(x)
+
+	if x.Ptr.Y.I == 0 {
+		t.Errorf("x.Ptr.Y.I should have changed")
+	}
+
+	if x.Map["foo"] == 42 {
+		t.Errorf("x.Map[foo] should have changed")
+	}
+
+	if x.Slice[0] == 1 {
+		t.Errorf("x.Slice[0] should have changed")
+	}
+
+	if x.Ptr != p {
+		t.Errorf("x.Ptr changed")
+	}
+
+	m["foo"] = 7
+	if x.Map["foo"] != m["foo"] {
+		t.Errorf("x.Map changed")
+	}
+	s[0] = 7
+	if x.Slice[0] != s[0] {
+		t.Errorf("x.Slice changed")
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/apitesting/naming/naming.go b/third_party/k8s.io/apimachinery/pkg/api/apitesting/naming/naming.go
new file mode 100644
index 0000000000..d089b9f53b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/apitesting/naming/naming.go
@@ -0,0 +1,168 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package naming
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+var (
+	marshalerType   = reflect.TypeOf((*json.Marshaler)(nil)).Elem()
+	unmarshalerType = reflect.TypeOf((*json.Unmarshaler)(nil)).Elem()
+)
+
+// VerifyGroupNames ensures that all groups in the scheme ends with the k8s.io suffix.
+// Exceptions can be tolerated using the legacyUnsuffixedGroups parameter
+func VerifyGroupNames(scheme *runtime.Scheme, legacyUnsuffixedGroups sets.String) error {
+	errs := []error{}
+	for _, gv := range scheme.PrioritizedVersionsAllGroups() {
+		if !strings.HasSuffix(gv.Group, ".k8s.io") && !legacyUnsuffixedGroups.Has(gv.Group) {
+			errs = append(errs, fmt.Errorf("group %s does not have the standard kubernetes API group suffix of .k8s.io", gv.Group))
+		}
+	}
+	return errors.NewAggregate(errs)
+}
+
+// VerifyTagNaming ensures that all types in the scheme have JSON tags set on external types, and JSON tags not set on internal types.
+// Exceptions can be tolerated using the typesAllowedTags and allowedNonstandardJSONNames parameters
+func VerifyTagNaming(scheme *runtime.Scheme, typesAllowedTags map[reflect.Type]bool, allowedNonstandardJSONNames map[reflect.Type]string) error {
+	errs := []error{}
+	for gvk, knownType := range scheme.AllKnownTypes() {
+		var err error
+		if gvk.Version == runtime.APIVersionInternal {
+			err = errors.NewAggregate(ensureNoTags(gvk, knownType, nil, typesAllowedTags))
+		} else {
+			err = errors.NewAggregate(ensureTags(gvk, knownType, nil, allowedNonstandardJSONNames))
+		}
+		if err != nil {
+			errs = append(errs, err)
+		}
+	}
+	return errors.NewAggregate(errs)
+}
+
+func ensureNoTags(gvk schema.GroupVersionKind, tp reflect.Type, parents []reflect.Type, typesAllowedTags map[reflect.Type]bool) []error {
+	errs := []error{}
+	if _, ok := typesAllowedTags[tp]; ok {
+		return errs
+	}
+
+	// Don't look at the same type multiple times
+	if containsType(parents, tp) {
+		return nil
+	}
+	parents = append(parents, tp)
+
+	switch tp.Kind() {
+	case reflect.Map, reflect.Slice, reflect.Pointer:
+		errs = append(errs, ensureNoTags(gvk, tp.Elem(), parents, typesAllowedTags)...)
+
+	case reflect.String, reflect.Bool, reflect.Float32, reflect.Float64, reflect.Int32, reflect.Int64, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr, reflect.Interface:
+		// no-op
+
+	case reflect.Struct:
+		for i := 0; i < tp.NumField(); i++ {
+			f := tp.Field(i)
+			if f.PkgPath != "" {
+				continue // Ignore unexported fields
+			}
+			_, jsonTagExists := f.Tag.Lookup("json")
+			protoTag := f.Tag.Get("protobuf")
+			if jsonTagExists || len(protoTag) > 0 {
+				errs = append(errs, fmt.Errorf("internal types should not have json or protobuf tags. %#v has tag on field %v: %v.\n%s", gvk, f.Name, f.Tag, fmtParentString(parents)))
+			}
+
+			errs = append(errs, ensureNoTags(gvk, f.Type, parents, typesAllowedTags)...)
+		}
+
+	default:
+		errs = append(errs, fmt.Errorf("unexpected type %v in %#v.\n%s", tp.Kind(), gvk, fmtParentString(parents)))
+	}
+	return errs
+}
+
+func ensureTags(gvk schema.GroupVersionKind, tp reflect.Type, parents []reflect.Type, allowedNonstandardJSONNames map[reflect.Type]string) []error {
+	errs := []error{}
+	// This type handles its own encoding/decoding and doesn't need json tags
+	if tp.Implements(marshalerType) && (tp.Implements(unmarshalerType) || reflect.PointerTo(tp).Implements(unmarshalerType)) {
+		return errs
+	}
+
+	// Don't look at the same type multiple times
+	if containsType(parents, tp) {
+		return nil
+	}
+	parents = append(parents, tp)
+
+	switch tp.Kind() {
+	case reflect.Map, reflect.Slice, reflect.Pointer:
+		errs = append(errs, ensureTags(gvk, tp.Elem(), parents, allowedNonstandardJSONNames)...)
+
+	case reflect.String, reflect.Bool, reflect.Float32, reflect.Float64, reflect.Int32, reflect.Int64, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr, reflect.Interface:
+		// no-op
+
+	case reflect.Struct:
+		for i := 0; i < tp.NumField(); i++ {
+			f := tp.Field(i)
+			jsonTag, jsonTagExists := f.Tag.Lookup("json")
+			if len(jsonTag) == 0 {
+				if f.Anonymous && jsonTagExists {
+					// allow json:"" on embedded fields
+				} else {
+					errs = append(errs, fmt.Errorf("external types should have json tags. %#v tags on field %v are: %s.\n%s", gvk, f.Name, f.Tag, fmtParentString(parents)))
+				}
+			}
+
+			jsonTagName := strings.Split(jsonTag, ",")[0]
+			if len(jsonTagName) > 0 && (jsonTagName[0] < 'a' || jsonTagName[0] > 'z') && jsonTagName != "-" && allowedNonstandardJSONNames[tp] != jsonTagName {
+				errs = append(errs, fmt.Errorf("external types should have json names starting with lowercase letter. %#v has json tag on field %v with name %s.\n%s", gvk, f.Name, jsonTagName, fmtParentString(parents)))
+			}
+
+			errs = append(errs, ensureTags(gvk, f.Type, parents, allowedNonstandardJSONNames)...)
+		}
+
+	default:
+		errs = append(errs, fmt.Errorf("unexpected type %v in %#v.\n%s", tp.Kind(), gvk, fmtParentString(parents)))
+	}
+	return errs
+}
+
+func fmtParentString(parents []reflect.Type) string {
+	str := "Type parents:\n"
+	for i, tp := range parents {
+		str += fmt.Sprintf("%s%v\n", strings.Repeat(" ", i), tp)
+	}
+	return str
+}
+
+// containsType returns true if s contains t, false otherwise
+func containsType(s []reflect.Type, t reflect.Type) bool {
+	for _, u := range s {
+		if t == u {
+			return true
+		}
+	}
+	return false
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/compatibility.go b/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/compatibility.go
new file mode 100644
index 0000000000..deba9b456b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/compatibility.go
@@ -0,0 +1,530 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package roundtrip
+
+import (
+	"bytes"
+	gojson "encoding/json"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"reflect"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+	"k8s.io/apimachinery/pkg/runtime/serializer/protobuf"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// CompatibilityTestOptions holds configuration for running a compatibility test using in-memory objects
+// and serialized files on disk representing the current code and serialized data from previous versions.
+//
+// Example use: `NewCompatibilityTestOptions(scheme).Complete(t).Run(t)`
+type CompatibilityTestOptions struct {
+	// Scheme is used to create new objects for filling, decoding, and for constructing serializers.
+	// Required.
+	Scheme *runtime.Scheme
+
+	// TestDataDir points to a directory containing compatibility test data.
+	// Complete() populates this with "testdata" if unset.
+	TestDataDir string
+
+	// TestDataDirCurrentVersion points to a directory containing compatibility test data for the current version.
+	// Complete() populates this with "<TestDataDir>/HEAD" if unset.
+	// Within this directory, `<group>.<version>.<kind>.[json|yaml|pb]` files are required to exist, and are:
+	// * verified to match serialized FilledObjects[GVK]
+	// * verified to decode without error
+	// * verified to round-trip byte-for-byte when re-encoded
+	// * verified to be semantically equal when decoded into memory
+	TestDataDirCurrentVersion string
+
+	// TestDataDirsPreviousVersions is a list of directories containing compatibility test data for previous versions.
+	// Complete() populates this with "<TestDataDir>/v*" directories if nil.
+	// Within these directories, `<group>.<version>.<kind>.[json|yaml|pb]` files are optional. If present, they are:
+	// * verified to decode without error
+	// * verified to round-trip byte-for-byte when re-encoded (or to match a `<group>.<version>.<kind>.[json|yaml|pb].after_roundtrip.[json|yaml|pb]` file if it exists)
+	// * verified to be semantically equal when decoded into memory
+	TestDataDirsPreviousVersions []string
+
+	// Kinds is a list of fully qualified kinds to test.
+	// Complete() populates this with Scheme.AllKnownTypes() if unset.
+	Kinds []schema.GroupVersionKind
+
+	// FilledObjects is an optional set of pre-filled objects to use for verifying HEAD fixtures.
+	// Complete() populates this with the result of CompatibilityTestObject(Kinds[*], Scheme, FillFuncs) for any missing kinds.
+	// Objects must deterministically populate every field and be identical on every invocation.
+	FilledObjects map[schema.GroupVersionKind]runtime.Object
+
+	// FillFuncs is an optional map of custom functions to use to fill instances of particular types.
+	FillFuncs map[reflect.Type]FillFunc
+
+	JSON  runtime.Serializer
+	YAML  runtime.Serializer
+	Proto runtime.Serializer
+}
+
+// FillFunc is a function that populates all serializable fields in obj.
+// s and i are string and integer values relevant to the object being populated
+// (for example, the json key or protobuf tag containing the object)
+// that can be used when filling the object to make the object content identifiable
+type FillFunc func(s string, i int, obj interface{})
+
+func NewCompatibilityTestOptions(scheme *runtime.Scheme) *CompatibilityTestOptions {
+	return &CompatibilityTestOptions{Scheme: scheme}
+}
+
+// coreKinds includes kinds that typically only need to be tested in a single API group
+var coreKinds = sets.NewString(
+	"CreateOptions", "UpdateOptions", "PatchOptions", "DeleteOptions",
+	"GetOptions", "ListOptions", "ExportOptions",
+	"WatchEvent",
+)
+
+func (c *CompatibilityTestOptions) Complete(t *testing.T) *CompatibilityTestOptions {
+	t.Helper()
+
+	// Verify scheme
+	if c.Scheme == nil {
+		t.Fatal("scheme is required")
+	}
+
+	// Populate testdata dirs
+	if c.TestDataDir == "" {
+		c.TestDataDir = "testdata"
+	}
+	if c.TestDataDirCurrentVersion == "" {
+		c.TestDataDirCurrentVersion = filepath.Join(c.TestDataDir, http.MethodHead)
+	}
+	if c.TestDataDirsPreviousVersions == nil {
+		dirs, err := filepath.Glob(filepath.Join(c.TestDataDir, "v*"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		sort.Strings(dirs)
+		c.TestDataDirsPreviousVersions = dirs
+	}
+
+	// Populate kinds
+	if len(c.Kinds) == 0 {
+		gvks := []schema.GroupVersionKind{}
+		for gvk := range c.Scheme.AllKnownTypes() {
+			if gvk.Version == "" || gvk.Version == runtime.APIVersionInternal {
+				// only test external types
+				continue
+			}
+			if strings.HasSuffix(gvk.Kind, "List") {
+				// omit list types
+				continue
+			}
+			if gvk.Group != "" && coreKinds.Has(gvk.Kind) {
+				// only test options types in the core API group
+				continue
+			}
+			gvks = append(gvks, gvk)
+		}
+		c.Kinds = gvks
+	}
+
+	// Sort kinds to get deterministic test order
+	sort.Slice(c.Kinds, func(i, j int) bool {
+		if c.Kinds[i].Group != c.Kinds[j].Group {
+			return c.Kinds[i].Group < c.Kinds[j].Group
+		}
+		if c.Kinds[i].Version != c.Kinds[j].Version {
+			return c.Kinds[i].Version < c.Kinds[j].Version
+		}
+		if c.Kinds[i].Kind != c.Kinds[j].Kind {
+			return c.Kinds[i].Kind < c.Kinds[j].Kind
+		}
+		return false
+	})
+
+	// Fill any missing objects
+	if c.FilledObjects == nil {
+		c.FilledObjects = map[schema.GroupVersionKind]runtime.Object{}
+	}
+	fillFuncs := defaultFillFuncs()
+	for k, v := range c.FillFuncs {
+		fillFuncs[k] = v
+	}
+	for _, gvk := range c.Kinds {
+		if _, ok := c.FilledObjects[gvk]; ok {
+			continue
+		}
+		obj, err := CompatibilityTestObject(c.Scheme, gvk, fillFuncs)
+		if err != nil {
+			t.Fatal(err)
+		}
+		c.FilledObjects[gvk] = obj
+	}
+
+	if c.JSON == nil {
+		c.JSON = json.NewSerializerWithOptions(json.DefaultMetaFactory, c.Scheme, c.Scheme, json.SerializerOptions{Pretty: true})
+	}
+	if c.YAML == nil {
+		c.YAML = json.NewSerializerWithOptions(json.DefaultMetaFactory, c.Scheme, c.Scheme, json.SerializerOptions{Yaml: true})
+	}
+	if c.Proto == nil {
+		c.Proto = protobuf.NewSerializer(c.Scheme, c.Scheme)
+	}
+
+	return c
+}
+
+func (c *CompatibilityTestOptions) Run(t *testing.T) {
+	usedHEADFixtures := sets.NewString()
+
+	for _, gvk := range c.Kinds {
+		t.Run(makeName(gvk), func(t *testing.T) {
+
+			t.Run(http.MethodHead, func(t *testing.T) {
+				c.runCurrentVersionTest(t, gvk, usedHEADFixtures)
+			})
+
+			for _, previousVersionDir := range c.TestDataDirsPreviousVersions {
+				t.Run(filepath.Base(previousVersionDir), func(t *testing.T) {
+					c.runPreviousVersionTest(t, gvk, previousVersionDir, nil)
+				})
+			}
+
+		})
+	}
+
+	// Check for unused HEAD fixtures
+	t.Run("unused_fixtures", func(t *testing.T) {
+		files, err := os.ReadDir(c.TestDataDirCurrentVersion)
+		if err != nil {
+			t.Fatal(err)
+		}
+		allFixtures := sets.NewString()
+		for _, file := range files {
+			allFixtures.Insert(file.Name())
+		}
+
+		if unused := allFixtures.Difference(usedHEADFixtures); len(unused) > 0 {
+			t.Fatalf("remove unused fixtures from %s:\n%s", c.TestDataDirCurrentVersion, strings.Join(unused.List(), "\n"))
+		}
+	})
+}
+
+func (c *CompatibilityTestOptions) runCurrentVersionTest(t *testing.T, gvk schema.GroupVersionKind, usedFiles sets.String) {
+	expectedObject := c.FilledObjects[gvk]
+	expectedJSON, expectedYAML, expectedProto := c.encode(t, expectedObject)
+
+	actualJSON, actualYAML, actualProto, err := read(c.TestDataDirCurrentVersion, gvk, "", usedFiles)
+	if err != nil && !os.IsNotExist(err) {
+		t.Fatal(err)
+	}
+
+	needsUpdate := false
+	if os.IsNotExist(err) {
+		t.Errorf("current version compatibility files did not exist: %v", err)
+		needsUpdate = true
+	} else {
+		if !bytes.Equal(expectedJSON, actualJSON) {
+			t.Errorf("json differs")
+			t.Log(cmp.Diff(string(actualJSON), string(expectedJSON)))
+			needsUpdate = true
+		}
+
+		if !bytes.Equal(expectedYAML, actualYAML) {
+			t.Errorf("yaml differs")
+			t.Log(cmp.Diff(string(actualYAML), string(expectedYAML)))
+			needsUpdate = true
+		}
+
+		if !bytes.Equal(expectedProto, actualProto) {
+			t.Errorf("proto differs")
+			needsUpdate = true
+			t.Log(cmp.Diff(dumpProto(t, actualProto[4:]), dumpProto(t, expectedProto[4:])))
+			// t.Logf("json (for locating the offending field based on surrounding data): %s", string(expectedJSON))
+		}
+	}
+
+	if needsUpdate {
+		const updateEnvVar = "UPDATE_COMPATIBILITY_FIXTURE_DATA"
+		if os.Getenv(updateEnvVar) == "true" {
+			writeFile(t, c.TestDataDirCurrentVersion, gvk, "", "json", expectedJSON)
+			writeFile(t, c.TestDataDirCurrentVersion, gvk, "", "yaml", expectedYAML)
+			writeFile(t, c.TestDataDirCurrentVersion, gvk, "", "pb", expectedProto)
+			t.Logf("wrote expected compatibility data... verify, commit, and rerun tests")
+		} else {
+			t.Logf("if the diff is expected because of a new type or a new field, re-run with %s=true to update the compatibility data", updateEnvVar)
+		}
+		return
+	}
+
+	emptyObj, err := c.Scheme.New(gvk)
+	if err != nil {
+		t.Fatal(err)
+	}
+	{
+		// compact before decoding since embedded RawExtension fields retain indenting
+		compacted := &bytes.Buffer{}
+		if err := gojson.Compact(compacted, actualJSON); err != nil {
+			t.Error(err)
+		}
+
+		jsonDecoded := emptyObj.DeepCopyObject()
+		jsonDecoded, _, err = c.JSON.Decode(compacted.Bytes(), &gvk, jsonDecoded)
+		if err != nil {
+			t.Error(err)
+		} else if !apiequality.Semantic.DeepEqual(expectedObject, jsonDecoded) {
+			t.Errorf("expected and decoded json objects differed:\n%s", cmp.Diff(expectedObject, jsonDecoded))
+		}
+	}
+	{
+		yamlDecoded := emptyObj.DeepCopyObject()
+		yamlDecoded, _, err = c.YAML.Decode(actualYAML, &gvk, yamlDecoded)
+		if err != nil {
+			t.Error(err)
+		} else if !apiequality.Semantic.DeepEqual(expectedObject, yamlDecoded) {
+			t.Errorf("expected and decoded yaml objects differed:\n%s", cmp.Diff(expectedObject, yamlDecoded))
+		}
+	}
+	{
+		protoDecoded := emptyObj.DeepCopyObject()
+		protoDecoded, _, err = c.Proto.Decode(actualProto, &gvk, protoDecoded)
+		if err != nil {
+			t.Error(err)
+		} else if !apiequality.Semantic.DeepEqual(expectedObject, protoDecoded) {
+			t.Errorf("expected and decoded proto objects differed:\n%s", cmp.Diff(expectedObject, protoDecoded))
+		}
+	}
+}
+
+func (c *CompatibilityTestOptions) encode(t *testing.T, obj runtime.Object) (json, yaml, proto []byte) {
+	jsonBytes := bytes.NewBuffer(nil)
+	if err := c.JSON.Encode(obj, jsonBytes); err != nil {
+		t.Fatalf("error encoding json: %v", err)
+	}
+	yamlBytes := bytes.NewBuffer(nil)
+	if err := c.YAML.Encode(obj, yamlBytes); err != nil {
+		t.Fatalf("error encoding yaml: %v", err)
+	}
+	protoBytes := bytes.NewBuffer(nil)
+	if err := c.Proto.Encode(obj, protoBytes); err != nil {
+		t.Fatalf("error encoding proto: %v", err)
+	}
+	return jsonBytes.Bytes(), yamlBytes.Bytes(), protoBytes.Bytes()
+}
+
+func read(dir string, gvk schema.GroupVersionKind, suffix string, usedFiles sets.String) (json, yaml, proto []byte, err error) {
+	jsonFilename := makeName(gvk) + suffix + ".json"
+	actualJSON, jsonErr := ioutil.ReadFile(filepath.Join(dir, jsonFilename))
+	yamlFilename := makeName(gvk) + suffix + ".yaml"
+	actualYAML, yamlErr := ioutil.ReadFile(filepath.Join(dir, yamlFilename))
+	protoFilename := makeName(gvk) + suffix + ".pb"
+	actualProto, protoErr := ioutil.ReadFile(filepath.Join(dir, protoFilename))
+	if usedFiles != nil {
+		usedFiles.Insert(jsonFilename)
+		usedFiles.Insert(yamlFilename)
+		usedFiles.Insert(protoFilename)
+	}
+	if jsonErr != nil {
+		return actualJSON, actualYAML, actualProto, jsonErr
+	}
+	if yamlErr != nil {
+		return actualJSON, actualYAML, actualProto, yamlErr
+	}
+	if protoErr != nil {
+		return actualJSON, actualYAML, actualProto, protoErr
+	}
+	return actualJSON, actualYAML, actualProto, nil
+}
+
+func writeFile(t *testing.T, dir string, gvk schema.GroupVersionKind, suffix, extension string, data []byte) {
+	if err := os.MkdirAll(dir, os.FileMode(0755)); err != nil {
+		t.Fatal("error making directory", err)
+	}
+	if err := ioutil.WriteFile(filepath.Join(dir, makeName(gvk)+suffix+"."+extension), data, os.FileMode(0644)); err != nil {
+		t.Fatalf("error writing %s: %v", extension, err)
+	}
+}
+
+func deleteFile(t *testing.T, dir string, gvk schema.GroupVersionKind, suffix, extension string) {
+	if err := os.Remove(filepath.Join(dir, makeName(gvk)+suffix+"."+extension)); err != nil {
+		t.Fatalf("error removing %s: %v", extension, err)
+	}
+}
+
+func (c *CompatibilityTestOptions) runPreviousVersionTest(t *testing.T, gvk schema.GroupVersionKind, previousVersionDir string, usedFiles sets.String) {
+	jsonBeforeRoundTrip, yamlBeforeRoundTrip, protoBeforeRoundTrip, err := read(previousVersionDir, gvk, "", usedFiles)
+	if os.IsNotExist(err) || (len(jsonBeforeRoundTrip) == 0 && len(yamlBeforeRoundTrip) == 0 && len(protoBeforeRoundTrip) == 0) {
+		t.SkipNow()
+		return
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	emptyObj, err := c.Scheme.New(gvk)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// compact before decoding since embedded RawExtension fields retain indenting
+	compacted := &bytes.Buffer{}
+	if err := gojson.Compact(compacted, jsonBeforeRoundTrip); err != nil {
+		t.Fatal(err)
+	}
+
+	jsonDecoded := emptyObj.DeepCopyObject()
+	jsonDecoded, _, err = c.JSON.Decode(compacted.Bytes(), &gvk, jsonDecoded)
+	if err != nil {
+		t.Fatal(err)
+	}
+	jsonBytes := bytes.NewBuffer(nil)
+	if err := c.JSON.Encode(jsonDecoded, jsonBytes); err != nil {
+		t.Fatalf("error encoding json: %v", err)
+	}
+	jsonAfterRoundTrip := jsonBytes.Bytes()
+
+	yamlDecoded := emptyObj.DeepCopyObject()
+	yamlDecoded, _, err = c.YAML.Decode(yamlBeforeRoundTrip, &gvk, yamlDecoded)
+	if err != nil {
+		t.Fatal(err)
+	} else if !apiequality.Semantic.DeepEqual(jsonDecoded, yamlDecoded) {
+		t.Errorf("decoded json and yaml objects differ:\n%s", cmp.Diff(jsonDecoded, yamlDecoded))
+	}
+	yamlBytes := bytes.NewBuffer(nil)
+	if err := c.YAML.Encode(yamlDecoded, yamlBytes); err != nil {
+		t.Fatalf("error encoding yaml: %v", err)
+	}
+	yamlAfterRoundTrip := yamlBytes.Bytes()
+
+	protoDecoded := emptyObj.DeepCopyObject()
+	protoDecoded, _, err = c.Proto.Decode(protoBeforeRoundTrip, &gvk, protoDecoded)
+	if err != nil {
+		t.Fatal(err)
+	} else if !apiequality.Semantic.DeepEqual(jsonDecoded, protoDecoded) {
+		t.Errorf("decoded json and proto objects differ:\n%s", cmp.Diff(jsonDecoded, protoDecoded))
+	}
+	protoBytes := bytes.NewBuffer(nil)
+	if err := c.Proto.Encode(protoDecoded, protoBytes); err != nil {
+		t.Fatalf("error encoding proto: %v", err)
+	}
+	protoAfterRoundTrip := protoBytes.Bytes()
+
+	jsonNeedsRemove := false
+	yamlNeedsRemove := false
+	protoNeedsRemove := false
+
+	expectedJSONAfterRoundTrip, expectedYAMLAfterRoundTrip, expectedProtoAfterRoundTrip, _ := read(previousVersionDir, gvk, ".after_roundtrip", usedFiles)
+	if len(expectedJSONAfterRoundTrip) == 0 {
+		expectedJSONAfterRoundTrip = jsonBeforeRoundTrip
+	} else if bytes.Equal(jsonBeforeRoundTrip, expectedJSONAfterRoundTrip) {
+		t.Errorf("JSON after_roundtrip file is identical and should be removed")
+		jsonNeedsRemove = true
+	}
+	if len(expectedYAMLAfterRoundTrip) == 0 {
+		expectedYAMLAfterRoundTrip = yamlBeforeRoundTrip
+	} else if bytes.Equal(yamlBeforeRoundTrip, expectedYAMLAfterRoundTrip) {
+		t.Errorf("YAML after_roundtrip file is identical and should be removed")
+		yamlNeedsRemove = true
+	}
+	if len(expectedProtoAfterRoundTrip) == 0 {
+		expectedProtoAfterRoundTrip = protoBeforeRoundTrip
+	} else if bytes.Equal(protoBeforeRoundTrip, expectedProtoAfterRoundTrip) {
+		t.Errorf("Proto after_roundtrip file is identical and should be removed")
+		protoNeedsRemove = true
+	}
+
+	jsonNeedsUpdate := false
+	yamlNeedsUpdate := false
+	protoNeedsUpdate := false
+
+	if !bytes.Equal(expectedJSONAfterRoundTrip, jsonAfterRoundTrip) {
+		t.Errorf("json differs")
+		t.Log(cmp.Diff(string(expectedJSONAfterRoundTrip), string(jsonAfterRoundTrip)))
+		jsonNeedsUpdate = true
+	}
+
+	if !bytes.Equal(expectedYAMLAfterRoundTrip, yamlAfterRoundTrip) {
+		t.Errorf("yaml differs")
+		t.Log(cmp.Diff(string(expectedYAMLAfterRoundTrip), string(yamlAfterRoundTrip)))
+		yamlNeedsUpdate = true
+	}
+
+	if !bytes.Equal(expectedProtoAfterRoundTrip, protoAfterRoundTrip) {
+		t.Errorf("proto differs")
+		protoNeedsUpdate = true
+		t.Log(cmp.Diff(dumpProto(t, expectedProtoAfterRoundTrip[4:]), dumpProto(t, protoAfterRoundTrip[4:])))
+		// t.Logf("json (for locating the offending field based on surrounding data): %s", string(expectedJSON))
+	}
+
+	if jsonNeedsUpdate || yamlNeedsUpdate || protoNeedsUpdate || jsonNeedsRemove || yamlNeedsRemove || protoNeedsRemove {
+		const updateEnvVar = "UPDATE_COMPATIBILITY_FIXTURE_DATA"
+		if os.Getenv(updateEnvVar) == "true" {
+			if jsonNeedsUpdate {
+				writeFile(t, previousVersionDir, gvk, ".after_roundtrip", "json", jsonAfterRoundTrip)
+			} else if jsonNeedsRemove {
+				deleteFile(t, previousVersionDir, gvk, ".after_roundtrip", "json")
+			}
+
+			if yamlNeedsUpdate {
+				writeFile(t, previousVersionDir, gvk, ".after_roundtrip", "yaml", yamlAfterRoundTrip)
+			} else if yamlNeedsRemove {
+				deleteFile(t, previousVersionDir, gvk, ".after_roundtrip", "yaml")
+			}
+
+			if protoNeedsUpdate {
+				writeFile(t, previousVersionDir, gvk, ".after_roundtrip", "pb", protoAfterRoundTrip)
+			} else if protoNeedsRemove {
+				deleteFile(t, previousVersionDir, gvk, ".after_roundtrip", "pb")
+			}
+			t.Logf("wrote expected compatibility data... verify, commit, and rerun tests")
+		} else {
+			t.Logf("if the diff is expected because of a new type or a new field, re-run with %s=true to update the compatibility data", updateEnvVar)
+		}
+		return
+	}
+}
+
+func makeName(gvk schema.GroupVersionKind) string {
+	g := gvk.Group
+	if g == "" {
+		g = "core"
+	}
+	return g + "." + gvk.Version + "." + gvk.Kind
+}
+
+func dumpProto(t *testing.T, data []byte) string {
+	t.Helper()
+	protoc, err := exec.LookPath("protoc")
+	if err != nil {
+		t.Log(err)
+		return ""
+	}
+	cmd := exec.Command(protoc, "--decode_raw")
+	cmd.Stdin = bytes.NewBuffer(data)
+	d, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Log(err)
+		return ""
+	}
+	return string(d)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/construct.go b/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/construct.go
new file mode 100644
index 0000000000..da334a373b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/construct.go
@@ -0,0 +1,192 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package roundtrip
+
+import (
+	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
+	"time"
+
+	apimeta "k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/intstr"
+)
+
+func defaultFillFuncs() map[reflect.Type]FillFunc {
+	funcs := map[reflect.Type]FillFunc{}
+	funcs[reflect.TypeOf(&runtime.RawExtension{})] = func(s string, i int, obj interface{}) {
+		// generate a raw object in normalized form
+		// TODO: test non-normalized round-tripping... YAMLToJSON normalizes and makes exact comparisons fail
+		obj.(*runtime.RawExtension).Raw = []byte(`{"apiVersion":"example.com/v1","kind":"CustomType","spec":{"replicas":1},"status":{"available":1}}`)
+	}
+	funcs[reflect.TypeOf(&metav1.TypeMeta{})] = func(s string, i int, obj interface{}) {
+		// APIVersion and Kind are not serialized in all formats (notably protobuf), so clear by default for cross-format checking.
+		obj.(*metav1.TypeMeta).APIVersion = ""
+		obj.(*metav1.TypeMeta).Kind = ""
+	}
+	funcs[reflect.TypeOf(&metav1.FieldsV1{})] = func(s string, i int, obj interface{}) {
+		obj.(*metav1.FieldsV1).SetRawString(`{}`)
+	}
+	funcs[reflect.TypeOf(&metav1.Time{})] = func(s string, i int, obj interface{}) {
+		// use the integer as an offset from the year
+		obj.(*metav1.Time).Time = time.Date(2000+i, 1, 1, 1, 1, 1, 0, time.UTC)
+	}
+	funcs[reflect.TypeOf(&metav1.MicroTime{})] = func(s string, i int, obj interface{}) {
+		// use the integer as an offset from the year, and as a microsecond
+		obj.(*metav1.MicroTime).Time = time.Date(2000+i, 1, 1, 1, 1, 1, i*int(time.Microsecond), time.UTC)
+	}
+	funcs[reflect.TypeOf(&intstr.IntOrString{})] = func(s string, i int, obj interface{}) {
+		// use the string as a string value
+		obj.(*intstr.IntOrString).Type = intstr.String
+		obj.(*intstr.IntOrString).StrVal = s + "Value"
+	}
+	return funcs
+}
+
+// CompatibilityTestObject returns a deterministically filled object for the specified GVK
+func CompatibilityTestObject(scheme *runtime.Scheme, gvk schema.GroupVersionKind, fillFuncs map[reflect.Type]FillFunc) (runtime.Object, error) {
+	// Construct the object
+	obj, err := scheme.New(gvk)
+	if err != nil {
+		return nil, err
+	}
+
+	fill("", 0, reflect.TypeOf(obj), reflect.ValueOf(obj), fillFuncs, map[reflect.Type]bool{})
+
+	// Set the kind and apiVersion
+	if typeAcc, err := apimeta.TypeAccessor(obj); err != nil {
+		return nil, err
+	} else {
+		typeAcc.SetKind(gvk.Kind)
+		typeAcc.SetAPIVersion(gvk.GroupVersion().String())
+	}
+
+	return obj, nil
+}
+
+func fill(dataString string, dataInt int, t reflect.Type, v reflect.Value, fillFuncs map[reflect.Type]FillFunc, filledTypes map[reflect.Type]bool) {
+	if filledTypes[t] {
+		// we already filled this type, avoid recursing infinitely
+		return
+	}
+	filledTypes[t] = true
+	defer delete(filledTypes, t)
+
+	// if nil, populate pointers with a zero-value instance of the underlying type
+	if t.Kind() == reflect.Pointer && v.IsNil() {
+		if v.CanSet() {
+			v.Set(reflect.New(t.Elem()))
+		} else if v.IsNil() {
+			panic(fmt.Errorf("unsettable nil pointer of type %v in field %s", t, dataString))
+		}
+	}
+
+	if f, ok := fillFuncs[t]; ok {
+		// use the custom fill function for this type
+		f(dataString, dataInt, v.Interface())
+		return
+	}
+
+	switch t.Kind() {
+	case reflect.Slice:
+		// populate with a single-item slice
+		v.Set(reflect.MakeSlice(t, 1, 1))
+		// recurse to populate the item, preserving the data context
+		if t.Elem().Kind() == reflect.Pointer {
+			fill(dataString, dataInt, t.Elem(), v.Index(0), fillFuncs, filledTypes)
+		} else {
+			fill(dataString, dataInt, reflect.PointerTo(t.Elem()), v.Index(0).Addr(), fillFuncs, filledTypes)
+		}
+
+	case reflect.Map:
+		// construct the key, which must be a string type, possibly converted to a type alias of string
+		key := reflect.ValueOf(dataString + "Key").Convert(t.Key())
+		// construct a zero-value item
+		item := reflect.New(t.Elem())
+		// recurse to populate the item, preserving the data context
+		fill(dataString, dataInt, t.Elem(), item.Elem(), fillFuncs, filledTypes)
+		// store in the map
+		v.Set(reflect.MakeMap(t))
+		v.SetMapIndex(key, item.Elem())
+
+	case reflect.Struct:
+		for i := 0; i < t.NumField(); i++ {
+			field := t.Field(i)
+
+			if !field.IsExported() {
+				continue
+			}
+
+			// use the json field name, which must be stable
+			jsonTag, _ := field.Tag.Lookup("json")
+			dataString = strings.Split(jsonTag, ",")[0]
+			if dataString == "-" {
+				// unserialized field, no need to fill it
+				continue
+			}
+			if len(dataString) == 0 {
+				// fall back to the struct field name if there is no json field name
+				dataString = "<no json tag> " + field.Name
+			}
+
+			// use the protobuf tag, which must be stable
+			dataInt := 0
+			if protobufTagParts := strings.Split(field.Tag.Get("protobuf"), ","); len(protobufTagParts) > 1 {
+				if tag, err := strconv.Atoi(protobufTagParts[1]); err != nil {
+					panic(err)
+				} else {
+					dataInt = tag
+				}
+			}
+			if dataInt == 0 {
+				// fall back to the length of dataString as a backup
+				dataInt = -len(dataString)
+			}
+
+			fieldType := field.Type
+			fieldValue := v.Field(i)
+
+			fill(dataString, dataInt, reflect.PointerTo(fieldType), fieldValue.Addr(), fillFuncs, filledTypes)
+		}
+
+	case reflect.Pointer:
+		fill(dataString, dataInt, t.Elem(), v.Elem(), fillFuncs, filledTypes)
+
+	case reflect.String:
+		// use Convert to set into string alias types correctly
+		v.Set(reflect.ValueOf(dataString + "Value").Convert(t))
+
+	case reflect.Bool:
+		// set to true to ensure we serialize omitempty fields
+		v.Set(reflect.ValueOf(true).Convert(t))
+
+	case reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		// use Convert to set into int alias types and different int widths correctly
+		v.Set(reflect.ValueOf(dataInt).Convert(t))
+
+	case reflect.Float32, reflect.Float64:
+		// use Convert to set into float types
+		v.Set(reflect.ValueOf(float32(dataInt) + 0.5).Convert(t))
+
+	default:
+		panic(fmt.Errorf("unhandled type %v in field %s", t, dataString))
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/fuzz_norace.go b/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/fuzz_norace.go
new file mode 100644
index 0000000000..23057619b1
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/fuzz_norace.go
@@ -0,0 +1,22 @@
+//go:build !race
+
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package roundtrip
+
+// in non-race-detection mode, a higher number of iterations is reasonable
+const defaultFuzzIters = 20
diff --git a/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/fuzz_race.go b/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/fuzz_race.go
new file mode 100644
index 0000000000..f7ebb8c170
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/fuzz_race.go
@@ -0,0 +1,22 @@
+//go:build race
+
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package roundtrip
+
+// in race-detection mode, lower the number of iterations to keep reasonable runtimes in CI
+const defaultFuzzIters = 5
diff --git a/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/roundtrip.go b/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/roundtrip.go
new file mode 100644
index 0000000000..7a6cb93f5e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/roundtrip.go
@@ -0,0 +1,434 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package roundtrip
+
+import (
+	"bytes"
+	"encoding/hex"
+	"math/rand"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	flag "github.com/spf13/pflag"
+	"sigs.k8s.io/randfill"
+
+	apitesting "k8s.io/apimachinery/pkg/api/apitesting"
+	"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	apimeta "k8s.io/apimachinery/pkg/api/meta"
+	metafuzzer "k8s.io/apimachinery/pkg/apis/meta/fuzzer"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+	"k8s.io/apimachinery/pkg/runtime/serializer/protobuf"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/utils/dump"
+)
+
+type InstallFunc func(scheme *runtime.Scheme)
+
+// RoundTripTestForAPIGroup is convenient to call from your install package to make sure that a "bare" install of your group provides
+// enough information to round trip
+func RoundTripTestForAPIGroup(t *testing.T, installFn InstallFunc, fuzzingFuncs fuzzer.FuzzerFuncs) {
+	scheme := runtime.NewScheme()
+	installFn(scheme)
+
+	RoundTripTestForScheme(t, scheme, fuzzingFuncs)
+}
+
+// RoundTripTestForScheme is convenient to call if you already have a scheme and want to make sure that its well-formed
+func RoundTripTestForScheme(t *testing.T, scheme *runtime.Scheme, fuzzingFuncs fuzzer.FuzzerFuncs) {
+	codecFactory := runtimeserializer.NewCodecFactory(scheme)
+	f := fuzzer.FuzzerFor(
+		fuzzer.MergeFuzzerFuncs(metafuzzer.Funcs, fuzzingFuncs),
+		rand.NewSource(rand.Int63()),
+		codecFactory,
+	)
+	RoundTripTypesWithoutProtobuf(t, scheme, codecFactory, f, nil)
+}
+
+// RoundTripProtobufTestForAPIGroup is convenient to call from your install package to make sure that a "bare" install of your group provides
+// enough information to round trip
+func RoundTripProtobufTestForAPIGroup(t *testing.T, installFn InstallFunc, fuzzingFuncs fuzzer.FuzzerFuncs) {
+	scheme := runtime.NewScheme()
+	installFn(scheme)
+
+	RoundTripProtobufTestForScheme(t, scheme, fuzzingFuncs)
+}
+
+// RoundTripProtobufTestForScheme is convenient to call if you already have a scheme and want to make sure that its well-formed
+func RoundTripProtobufTestForScheme(t *testing.T, scheme *runtime.Scheme, fuzzingFuncs fuzzer.FuzzerFuncs) {
+	codecFactory := runtimeserializer.NewCodecFactory(scheme)
+	fuzzer := fuzzer.FuzzerFor(
+		fuzzer.MergeFuzzerFuncs(metafuzzer.Funcs, fuzzingFuncs),
+		rand.NewSource(rand.Int63()),
+		codecFactory,
+	)
+	RoundTripTypes(t, scheme, codecFactory, fuzzer, nil)
+}
+
+var FuzzIters = flag.Int("fuzz-iters", defaultFuzzIters, "How many fuzzing iterations to do.")
+
+// globalNonRoundTrippableTypes are kinds that are effectively reserved across all GroupVersions
+// They don't roundtrip
+var globalNonRoundTrippableTypes = sets.NewString(
+	"ExportOptions",
+	"GetOptions",
+	// WatchEvent does not include kind and version and can only be deserialized
+	// implicitly (if the caller expects the specific object). The watch call defines
+	// the schema by content type, rather than via kind/version included in each
+	// object.
+	"WatchEvent",
+	// ListOptions is now part of the meta group
+	"ListOptions",
+	// Delete options is only read in metav1
+	"DeleteOptions",
+)
+
+// GlobalNonRoundTrippableTypes returns the kinds that are effectively reserved across all GroupVersions.
+// They don't roundtrip and thus can be excluded in any custom/downstream roundtrip tests
+//
+//	kinds := scheme.AllKnownTypes()
+//	for gvk := range kinds {
+//	    if roundtrip.GlobalNonRoundTrippableTypes().Has(gvk.Kind) {
+//	        continue
+//	    }
+//	    t.Run(gvk.Group+"."+gvk.Version+"."+gvk.Kind, func(t *testing.T) {
+//	        // roundtrip test
+//	    })
+//	}
+func GlobalNonRoundTrippableTypes() sets.String {
+	return sets.NewString(globalNonRoundTrippableTypes.List()...)
+}
+
+// RoundTripTypesWithoutProtobuf applies the round-trip test to all round-trippable Kinds
+// in the scheme.  It will skip all the GroupVersionKinds in the skip list.
+func RoundTripTypesWithoutProtobuf(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+	roundTripTypes(t, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, true)
+}
+
+func RoundTripTypes(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+	roundTripTypes(t, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, false)
+}
+
+func roundTripTypes(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool, skipProtobuf bool) {
+	for _, group := range groupsFromScheme(scheme) {
+		t.Logf("starting group %q", group)
+		internalVersion := schema.GroupVersion{Group: group, Version: runtime.APIVersionInternal}
+		internalKindToGoType := scheme.KnownTypes(internalVersion)
+
+		for kind := range internalKindToGoType {
+			if globalNonRoundTrippableTypes.Has(kind) {
+				continue
+			}
+
+			internalGVK := internalVersion.WithKind(kind)
+			roundTripSpecificKind(t, internalGVK, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, skipProtobuf)
+		}
+
+		t.Logf("finished group %q", group)
+	}
+}
+
+// RoundTripExternalTypes applies the round-trip test to all external round-trippable Kinds
+// in the scheme.  It will skip all the GroupVersionKinds in the nonRoundTripExternalTypes list .
+func RoundTripExternalTypes(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+	kinds := scheme.AllKnownTypes()
+	for gvk := range kinds {
+		if gvk.Version == runtime.APIVersionInternal || globalNonRoundTrippableTypes.Has(gvk.Kind) {
+			continue
+		}
+		t.Run(gvk.Group+"."+gvk.Version+"."+gvk.Kind, func(t *testing.T) {
+			roundTripSpecificKind(t, gvk, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, false)
+		})
+	}
+}
+
+// RoundTripExternalTypesWithoutProtobuf applies the round-trip test to all external round-trippable Kinds
+// in the scheme.  It will skip all the GroupVersionKinds in the nonRoundTripExternalTypes list.
+func RoundTripExternalTypesWithoutProtobuf(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+	kinds := scheme.AllKnownTypes()
+	for gvk := range kinds {
+		if gvk.Version == runtime.APIVersionInternal || globalNonRoundTrippableTypes.Has(gvk.Kind) {
+			continue
+		}
+		t.Run(gvk.Group+"."+gvk.Version+"."+gvk.Kind, func(t *testing.T) {
+			roundTripSpecificKind(t, gvk, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, true)
+		})
+	}
+}
+
+func RoundTripSpecificKindWithoutProtobuf(t *testing.T, gvk schema.GroupVersionKind, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+	roundTripSpecificKind(t, gvk, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, true)
+}
+
+func RoundTripSpecificKind(t *testing.T, gvk schema.GroupVersionKind, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+	roundTripSpecificKind(t, gvk, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, false)
+}
+
+func roundTripSpecificKind(t *testing.T, gvk schema.GroupVersionKind, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool, skipProtobuf bool) {
+	if nonRoundTrippableTypes[gvk] {
+		t.Logf("skipping %v", gvk)
+		return
+	}
+
+	// Try a few times, since runTest uses random values.
+	for i := 0; i < *FuzzIters; i++ {
+		if gvk.Version == runtime.APIVersionInternal {
+			roundTripToAllExternalVersions(t, scheme, codecFactory, fuzzer, gvk, nonRoundTrippableTypes, skipProtobuf)
+		} else {
+			roundTripOfExternalType(t, scheme, codecFactory, fuzzer, gvk, skipProtobuf)
+		}
+		if t.Failed() {
+			break
+		}
+	}
+}
+
+// fuzzInternalObject fuzzes an arbitrary runtime object using the appropriate
+// fuzzer registered with the apitesting package.
+func fuzzInternalObject(t *testing.T, fuzzer *randfill.Filler, object runtime.Object) runtime.Object {
+	fuzzer.Fill(object)
+
+	j, err := apimeta.TypeAccessor(object)
+	if err != nil {
+		t.Fatalf("Unexpected error %v for %#v", err, object)
+	}
+	j.SetKind("")
+	j.SetAPIVersion("")
+
+	return object
+}
+
+func groupsFromScheme(scheme *runtime.Scheme) []string {
+	ret := sets.String{}
+	for gvk := range scheme.AllKnownTypes() {
+		ret.Insert(gvk.Group)
+	}
+	return ret.List()
+}
+
+func roundTripToAllExternalVersions(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, internalGVK schema.GroupVersionKind, nonRoundTrippableTypes map[schema.GroupVersionKind]bool, skipProtobuf bool) {
+	object, err := scheme.New(internalGVK)
+	if err != nil {
+		t.Fatalf("Couldn't make a %v? %v", internalGVK, err)
+	}
+	if _, err := apimeta.TypeAccessor(object); err != nil {
+		t.Fatalf("%q is not a TypeMeta and cannot be tested - add it to nonRoundTrippableInternalTypes: %v", internalGVK, err)
+	}
+
+	fuzzInternalObject(t, fuzzer, object)
+
+	// find all potential serializations in the scheme.
+	// TODO fix this up to handle kinds that cross registered with different names.
+	for externalGVK, externalGoType := range scheme.AllKnownTypes() {
+		if externalGVK.Version == runtime.APIVersionInternal {
+			continue
+		}
+		if externalGVK.GroupKind() != internalGVK.GroupKind() {
+			continue
+		}
+		if nonRoundTrippableTypes[externalGVK] {
+			t.Logf("\tskipping  %v %v", externalGVK, externalGoType)
+			continue
+		}
+		t.Logf("\tround tripping to %v %v", externalGVK, externalGoType)
+
+		roundTrip(t, scheme, apitesting.TestCodec(codecFactory, externalGVK.GroupVersion()), object)
+
+		// TODO remove this hack after we're past the intermediate steps
+		if !skipProtobuf && externalGVK.Group != "kubeadm.k8s.io" {
+			s := protobuf.NewSerializer(scheme, scheme)
+			protobufCodec := codecFactory.CodecForVersions(s, s, externalGVK.GroupVersion(), nil)
+			roundTrip(t, scheme, protobufCodec, object)
+		}
+	}
+}
+
+func roundTripOfExternalType(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, externalGVK schema.GroupVersionKind, skipProtobuf bool) {
+	object, err := scheme.New(externalGVK)
+	if err != nil {
+		t.Fatalf("Couldn't make a %v? %v", externalGVK, err)
+	}
+	typeAcc, err := apimeta.TypeAccessor(object)
+	if err != nil {
+		t.Fatalf("%q is not a TypeMeta and cannot be tested - add it to nonRoundTrippableInternalTypes: %v", externalGVK, err)
+	}
+
+	fuzzInternalObject(t, fuzzer, object)
+
+	typeAcc.SetKind(externalGVK.Kind)
+	typeAcc.SetAPIVersion(externalGVK.GroupVersion().String())
+
+	roundTrip(t, scheme, json.NewSerializerWithOptions(json.DefaultMetaFactory, scheme, scheme, json.SerializerOptions{}), object)
+
+	// TODO remove this hack after we're past the intermediate steps
+	if !skipProtobuf {
+		roundTrip(t, scheme, protobuf.NewSerializer(scheme, scheme), object)
+	}
+}
+
+// roundTrip applies a single round-trip test to the given runtime object
+// using the given codec.  The round-trip test ensures that an object can be
+// deep-copied, converted, marshaled and back without loss of data.
+//
+// For internal types this means
+//
+//	internal -> external -> json/protobuf -> external -> internal.
+//
+// For external types this means
+//
+//	external -> json/protobuf -> external.
+func roundTrip(t *testing.T, scheme *runtime.Scheme, codec runtime.Codec, object runtime.Object) {
+	original := object
+
+	// deep copy the original object
+	object = object.DeepCopyObject()
+	name := reflect.TypeOf(object).Elem().Name()
+	if !apiequality.Semantic.DeepEqual(original, object) {
+		t.Errorf("%v: DeepCopy altered the object, diff: %v", name, cmp.Diff(original, object))
+		t.Errorf("%s", dump.Pretty(original))
+		t.Errorf("%s", dump.Pretty(object))
+		return
+	}
+
+	// encode (serialize) the deep copy using the provided codec
+	data, err := runtime.Encode(codec, object)
+	if err != nil {
+		if runtime.IsNotRegisteredError(err) {
+			t.Logf("%v: not registered: %v (%s)", name, err, dump.Pretty(object))
+		} else {
+			t.Errorf("%v: %v (%s)", name, err, dump.Pretty(object))
+		}
+		return
+	}
+
+	// ensure that the deep copy is equal to the original; neither the deep
+	// copy or conversion should alter the object
+	// TODO eliminate this global
+	if !apiequality.Semantic.DeepEqual(original, object) {
+		t.Errorf("%v: encode altered the object, diff: %v", name, cmp.Diff(original, object))
+		return
+	}
+
+	// encode (serialize) a second time to verify that it was not varying
+	secondData, err := runtime.Encode(codec, object)
+	if err != nil {
+		if runtime.IsNotRegisteredError(err) {
+			t.Logf("%v: not registered: %v (%s)", name, err, dump.Pretty(object))
+		} else {
+			t.Errorf("%v: %v (%s)", name, err, dump.Pretty(object))
+		}
+		return
+	}
+
+	// serialization to the wire must be stable to ensure that we don't write twice to the DB
+	// when the object hasn't changed.
+	if !bytes.Equal(data, secondData) {
+		t.Errorf("%v: serialization is not stable: %s", name, dump.Pretty(object))
+	}
+
+	// decode (deserialize) the encoded data back into an object
+	obj2, err := runtime.Decode(codec, data)
+	if err != nil {
+		t.Errorf("%v: %v\nCodec: %#v\nData: %s\nSource: %s", name, err, codec, dataAsString(data), dump.Pretty(object))
+		panic("failed")
+	}
+
+	// ensure that the object produced from decoding the encoded data is equal
+	// to the original object
+	if !apiequality.Semantic.DeepEqual(original, obj2) {
+		t.Errorf("%v: diff: %v\nCodec: %#v\nSource:\n\n%s\n\nEncoded:\n\n%s\n\nFinal:\n\n%s", name, cmp.Diff(original, obj2), codec, dump.Pretty(original), dataAsString(data), dump.Pretty(obj2))
+		return
+	}
+
+	// decode the encoded data into a new object (instead of letting the codec
+	// create a new object)
+	obj3 := reflect.New(reflect.TypeOf(object).Elem()).Interface().(runtime.Object)
+	if err := runtime.DecodeInto(codec, data, obj3); err != nil {
+		t.Errorf("%v: %v", name, err)
+		return
+	}
+
+	// special case for kinds which are internal and external at the same time (many in meta.k8s.io are). For those
+	// runtime.DecodeInto above will return the external variant and set the APIVersion and kind, while the input
+	// object might be internal. Hence, we clear those values for obj3 for that case to correctly compare.
+	intAndExt, err := internalAndExternalKind(scheme, object)
+	if err != nil {
+		t.Errorf("%v: %v", name, err)
+		return
+	}
+	if intAndExt {
+		typeAcc, err := apimeta.TypeAccessor(object)
+		if err != nil {
+			t.Fatalf("%v: error accessing TypeMeta: %v", name, err)
+		}
+		if len(typeAcc.GetAPIVersion()) == 0 {
+			typeAcc, err := apimeta.TypeAccessor(obj3)
+			if err != nil {
+				t.Fatalf("%v: error accessing TypeMeta: %v", name, err)
+			}
+			typeAcc.SetAPIVersion("")
+			typeAcc.SetKind("")
+		}
+	}
+
+	// ensure that the new runtime object is equal to the original after being
+	// decoded into
+	if !apiequality.Semantic.DeepEqual(object, obj3) {
+		t.Errorf("%v: diff: %v\nCodec: %#v", name, cmp.Diff(object, obj3), codec)
+		return
+	}
+
+	// do structure-preserving fuzzing of the deep-copied object. If it shares anything with the original,
+	// the deep-copy was actually only a shallow copy. Then original and obj3 will be different after fuzzing.
+	// NOTE: we use the encoding+decoding here as an alternative, guaranteed deep-copy to compare against.
+	fuzzer.ValueFuzz(object)
+	if !apiequality.Semantic.DeepEqual(original, obj3) {
+		t.Errorf("%v: fuzzing a copy altered the original, diff: %v", name, cmp.Diff(original, obj3))
+		return
+	}
+}
+
+func internalAndExternalKind(scheme *runtime.Scheme, object runtime.Object) (bool, error) {
+	kinds, _, err := scheme.ObjectKinds(object)
+	if err != nil {
+		return false, err
+	}
+	internal, external := false, false
+	for _, k := range kinds {
+		if k.Version == runtime.APIVersionInternal {
+			internal = true
+		} else {
+			external = true
+		}
+	}
+	return internal && external, nil
+}
+
+// dataAsString returns the given byte array as a string; handles detecting
+// protocol buffers.
+func dataAsString(data []byte) string {
+	dataString := string(data)
+	if !strings.HasPrefix(dataString, "{") {
+		dataString = "\n" + hex.Dump(data)
+	}
+	return dataString
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/unstructured.go b/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/unstructured.go
new file mode 100644
index 0000000000..f1794943d2
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/apitesting/roundtrip/unstructured.go
@@ -0,0 +1,247 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package roundtrip
+
+import (
+	"bytes"
+	"fmt"
+	"math/rand"
+	"os"
+	"strconv"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	metafuzzer "k8s.io/apimachinery/pkg/apis/meta/fuzzer"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	cborserializer "k8s.io/apimachinery/pkg/runtime/serializer/cbor"
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	jsonserializer "k8s.io/apimachinery/pkg/runtime/serializer/json"
+	"k8s.io/apimachinery/pkg/util/sets"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+// RoundtripToUnstructured verifies the roundtrip faithfulness of all external types in a scheme
+// from native to unstructured and back using both the JSON and CBOR serializers. The intermediate
+// unstructured objects produced by both encodings must be identical and be themselves
+// roundtrippable to JSON and CBOR.
+//
+// Values for all external types in the scheme are generated by fuzzing the a value of the
+// corresponding internal type and converting it, except for types whose registered GVK appears in
+// the "nointernal" set, which are fuzzed directly.
+func RoundtripToUnstructured(t *testing.T, scheme *runtime.Scheme, funcs fuzzer.FuzzerFuncs, skipped sets.Set[schema.GroupVersionKind], nointernal sets.Set[schema.GroupVersionKind]) {
+	codecs := serializer.NewCodecFactory(scheme)
+
+	seed := int64(time.Now().Nanosecond())
+	if override := os.Getenv("TEST_RAND_SEED"); len(override) > 0 {
+		overrideSeed, err := strconv.ParseInt(override, 10, 64)
+		if err != nil {
+			t.Fatal(err)
+		}
+		seed = overrideSeed
+		t.Logf("using overridden seed: %d", seed)
+	} else {
+		t.Logf("seed (override with TEST_RAND_SEED if desired): %d", seed)
+	}
+
+	var buf bytes.Buffer
+	for gvk := range scheme.AllKnownTypes() {
+		if globalNonRoundTrippableTypes.Has(gvk.Kind) {
+			continue
+		}
+
+		if gvk.Version == runtime.APIVersionInternal {
+			continue
+		}
+
+		subtestName := fmt.Sprintf("%s.%s/%s", gvk.Version, gvk.Group, gvk.Kind)
+		if gvk.Group == "" {
+			subtestName = fmt.Sprintf("%s/%s", gvk.Version, gvk.Kind)
+		}
+
+		t.Run(subtestName, func(t *testing.T) {
+			if skipped.Has(gvk) {
+				t.SkipNow()
+			}
+
+			fuzzer := fuzzer.FuzzerFor(fuzzer.MergeFuzzerFuncs(metafuzzer.Funcs, funcs), rand.NewSource(seed), codecs)
+
+			for i := 0; i < *FuzzIters; i++ {
+				item, err := scheme.New(gvk)
+				if err != nil {
+					t.Fatalf("couldn't create external object %v: %v", gvk.Kind, err)
+				}
+
+				if nointernal.Has(gvk) {
+					fuzzer.Fill(item)
+				} else {
+					internalObj, err := scheme.New(gvk.GroupKind().WithVersion(runtime.APIVersionInternal))
+					if err != nil {
+						t.Fatalf("couldn't create internal object %v: %v", gvk.Kind, err)
+					}
+					fuzzer.Fill(internalObj)
+
+					if err := scheme.Convert(internalObj, item, nil); err != nil {
+						t.Fatalf("conversion for %v failed: %v", gvk.Kind, err)
+					}
+				}
+
+				// Decoding into Unstructured requires that apiVersion and kind be
+				// serialized, so populate TypeMeta.
+				item.GetObjectKind().SetGroupVersionKind(gvk)
+
+				jsonSerializer := jsonserializer.NewSerializerWithOptions(jsonserializer.DefaultMetaFactory, scheme, scheme, jsonserializer.SerializerOptions{})
+				cborSerializer := cborserializer.NewSerializer(scheme, scheme)
+
+				// original->JSON->Unstructured
+				buf.Reset()
+				if err := jsonSerializer.Encode(item, &buf); err != nil {
+					t.Fatalf("error encoding native to json: %v", err)
+				}
+				var uJSON runtime.Object = &unstructured.Unstructured{}
+				uJSON, _, err = jsonSerializer.Decode(buf.Bytes(), &gvk, uJSON)
+				if err != nil {
+					t.Fatalf("error decoding json to unstructured: %v", err)
+				}
+
+				// original->CBOR->Unstructured
+				buf.Reset()
+				if err := cborSerializer.Encode(item, &buf); err != nil {
+					t.Fatalf("error encoding native to cbor: %v", err)
+				}
+				var uCBOR runtime.Object = &unstructured.Unstructured{}
+				uCBOR, _, err = cborSerializer.Decode(buf.Bytes(), &gvk, uCBOR)
+				if err != nil {
+					diag, _ := cbor.Diagnose(buf.Bytes())
+					t.Fatalf("error decoding cbor to unstructured: %v, diag: %s", err, diag)
+				}
+
+				// original->JSON->Unstructured == original->CBOR->Unstructured
+				if !apiequality.Semantic.DeepEqual(uJSON, uCBOR) {
+					t.Fatalf("unstructured via json differed from unstructured via cbor: %v", cmp.Diff(uJSON, uCBOR))
+				}
+
+				// original->CBOR(nondeterministic)->Unstructured
+				buf.Reset()
+				if err := cborSerializer.EncodeNondeterministic(item, &buf); err != nil {
+					t.Fatalf("error encoding native to cbor: %v", err)
+				}
+				var uCBORNondeterministic runtime.Object = &unstructured.Unstructured{}
+				uCBORNondeterministic, _, err = cborSerializer.Decode(buf.Bytes(), &gvk, uCBORNondeterministic)
+				if err != nil {
+					diag, _ := cbor.Diagnose(buf.Bytes())
+					t.Fatalf("error decoding cbor to unstructured: %v, diag: %s", err, diag)
+				}
+
+				// original->CBOR->Unstructured == original->CBOR(nondeterministic)->Unstructured
+				if !apiequality.Semantic.DeepEqual(uCBOR, uCBORNondeterministic) {
+					t.Fatalf("unstructured via nondeterministic cbor differed from unstructured via cbor: %v", cmp.Diff(uCBOR, uCBORNondeterministic))
+				}
+
+				// original->JSON/CBOR->Unstructured == original->JSON/CBOR->Unstructured->JSON->Unstructured
+				buf.Reset()
+				if err := jsonSerializer.Encode(uJSON, &buf); err != nil {
+					t.Fatalf("error encoding unstructured to json: %v", err)
+				}
+				var uJSON2 runtime.Object = &unstructured.Unstructured{}
+				uJSON2, _, err = jsonSerializer.Decode(buf.Bytes(), &gvk, uJSON2)
+				if err != nil {
+					t.Fatalf("error decoding json to unstructured: %v", err)
+				}
+				if !apiequality.Semantic.DeepEqual(uJSON, uJSON2) {
+					t.Errorf("object changed during native-json-unstructured-json-unstructured roundtrip, diff: %s", cmp.Diff(uJSON, uJSON2))
+				}
+
+				// original->JSON/CBOR->Unstructured == original->JSON/CBOR->Unstructured->CBOR->Unstructured
+				buf.Reset()
+				if err := cborSerializer.Encode(uCBOR, &buf); err != nil {
+					t.Fatalf("error encoding unstructured to cbor: %v", err)
+				}
+				var uCBOR2 runtime.Object = &unstructured.Unstructured{}
+				uCBOR2, _, err = cborSerializer.Decode(buf.Bytes(), &gvk, uCBOR2)
+				if err != nil {
+					diag, _ := cbor.Diagnose(buf.Bytes())
+					t.Fatalf("error decoding cbor to unstructured: %v, diag: %s", err, diag)
+				}
+				if !apiequality.Semantic.DeepEqual(uCBOR, uCBOR2) {
+					t.Errorf("object changed during native-cbor-unstructured-cbor-unstructured roundtrip, diff: %s", cmp.Diff(uCBOR, uCBOR2))
+				}
+
+				// original->JSON/CBOR->Unstructured->CBOR->Unstructured == original->JSON/CBOR->Unstructured->CBOR(nondeterministic)->Unstructured
+				buf.Reset()
+				if err := cborSerializer.EncodeNondeterministic(uCBOR, &buf); err != nil {
+					t.Fatalf("error encoding unstructured to cbor: %v", err)
+				}
+				var uCBOR2Nondeterministic runtime.Object = &unstructured.Unstructured{}
+				uCBOR2Nondeterministic, _, err = cborSerializer.Decode(buf.Bytes(), &gvk, uCBOR2Nondeterministic)
+				if err != nil {
+					diag, _ := cbor.Diagnose(buf.Bytes())
+					t.Fatalf("error decoding cbor to unstructured: %v, diag: %s", err, diag)
+				}
+				if !apiequality.Semantic.DeepEqual(uCBOR, uCBOR2Nondeterministic) {
+					t.Errorf("object changed during native-cbor-unstructured-cbor(nondeterministic)-unstructured roundtrip, diff: %s", cmp.Diff(uCBOR, uCBOR2Nondeterministic))
+				}
+
+				// original->JSON/CBOR->Unstructured->JSON->final == original
+				buf.Reset()
+				if err := jsonSerializer.Encode(uJSON, &buf); err != nil {
+					t.Fatalf("error encoding unstructured to json: %v", err)
+				}
+				finalJSON, _, err := jsonSerializer.Decode(buf.Bytes(), &gvk, nil)
+				if err != nil {
+					t.Fatalf("error decoding json to native: %v", err)
+				}
+				if !apiequality.Semantic.DeepEqual(item, finalJSON) {
+					t.Errorf("object changed during native-json-unstructured-json-native roundtrip, diff: %s", cmp.Diff(item, finalJSON))
+				}
+
+				// original->JSON/CBOR->Unstructured->CBOR->final == original
+				buf.Reset()
+				if err := cborSerializer.Encode(uCBOR, &buf); err != nil {
+					t.Fatalf("error encoding unstructured to cbor: %v", err)
+				}
+				finalCBOR, _, err := cborSerializer.Decode(buf.Bytes(), &gvk, nil)
+				if err != nil {
+					diag, _ := cbor.Diagnose(buf.Bytes())
+					t.Fatalf("error decoding cbor to native: %v, diag: %s", err, diag)
+				}
+				if !apiequality.Semantic.DeepEqual(item, finalCBOR) {
+					t.Errorf("object changed during native-cbor-unstructured-cbor-native roundtrip, diff: %s", cmp.Diff(item, finalCBOR))
+				}
+
+				// original->JSON/CBOR->Unstructured->CBOR(nondeterministic)->final == original
+				buf.Reset()
+				if err := cborSerializer.EncodeNondeterministic(uCBOR, &buf); err != nil {
+					t.Fatalf("error encoding unstructured to cbor: %v", err)
+				}
+				finalCBORNondeterministic, _, err := cborSerializer.Decode(buf.Bytes(), &gvk, nil)
+				if err != nil {
+					diag, _ := cbor.Diagnose(buf.Bytes())
+					t.Fatalf("error decoding cbor to native: %v, diag: %s", err, diag)
+				}
+				if !apiequality.Semantic.DeepEqual(item, finalCBORNondeterministic) {
+					t.Errorf("object changed during native-cbor-unstructured-cbor-native roundtrip, diff: %s", cmp.Diff(item, finalCBORNondeterministic))
+				}
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/equality/semantic.go b/third_party/k8s.io/apimachinery/pkg/api/equality/semantic.go
new file mode 100644
index 0000000000..cd78c38416
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/equality/semantic.go
@@ -0,0 +1,52 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package equality
+
+import (
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+)
+
+// Semantic can do semantic deep equality checks for api objects.
+// Example: apiequality.Semantic.DeepEqual(aPod, aPodWithNonNilButEmptyMaps) == true
+var Semantic = conversion.EqualitiesOrDie(
+	func(a, b resource.Quantity) bool {
+		// Ignore formatting, only care that numeric value stayed the same.
+		// TODO: if we decide it's important, it should be safe to start comparing the format.
+		//
+		// Uninitialized quantities are equivalent to 0 quantities.
+		return a.Cmp(b) == 0
+	},
+	func(a, b metav1.MicroTime) bool {
+		return a.UTC() == b.UTC()
+	},
+	func(a, b metav1.Time) bool {
+		return a.UTC() == b.UTC()
+	},
+	func(a, b metav1.FieldsV1) bool {
+		return a.Equal(b)
+	},
+	func(a, b labels.Selector) bool {
+		return a.String() == b.String()
+	},
+	func(a, b fields.Selector) bool {
+		return a.String() == b.String()
+	},
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/api/errors/OWNERS b/third_party/k8s.io/apimachinery/pkg/api/errors/OWNERS
new file mode 100644
index 0000000000..1a9f5e7706
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/errors/OWNERS
@@ -0,0 +1,16 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+reviewers:
+  - thockin
+  - smarterclayton
+  - wojtek-t
+  - deads2k
+  - derekwaynecarr
+  - caesarxuchao
+  - mikedanese
+  - liggitt
+  - saad-ali
+  - janetkuo
+  - tallclair
+  - dims
+  - cjcullen
diff --git a/third_party/k8s.io/apimachinery/pkg/api/errors/doc.go b/third_party/k8s.io/apimachinery/pkg/api/errors/doc.go
new file mode 100644
index 0000000000..58751ed0ec
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/errors/doc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package errors provides detailed error types for api field validation.
+package errors
diff --git a/third_party/k8s.io/apimachinery/pkg/api/errors/errors.go b/third_party/k8s.io/apimachinery/pkg/api/errors/errors.go
new file mode 100644
index 0000000000..7b57a9eb6c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/errors/errors.go
@@ -0,0 +1,865 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package errors
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"reflect"
+	"strings"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// StatusError is an error intended for consumption by a REST API server; it can also be
+// reconstructed by clients from a REST response. Public to allow easy type switches.
+type StatusError struct {
+	ErrStatus metav1.Status
+}
+
+// APIStatus is exposed by errors that can be converted to an api.Status object
+// for finer grained details.
+type APIStatus interface {
+	Status() metav1.Status
+}
+
+var _ error = &StatusError{}
+
+var knownReasons = map[metav1.StatusReason]struct{}{
+	// metav1.StatusReasonUnknown : {}
+	metav1.StatusReasonUnauthorized:          {},
+	metav1.StatusReasonForbidden:             {},
+	metav1.StatusReasonNotFound:              {},
+	metav1.StatusReasonAlreadyExists:         {},
+	metav1.StatusReasonConflict:              {},
+	metav1.StatusReasonGone:                  {},
+	metav1.StatusReasonInvalid:               {},
+	metav1.StatusReasonServerTimeout:         {},
+	metav1.StatusReasonStoreReadError:        {},
+	metav1.StatusReasonTimeout:               {},
+	metav1.StatusReasonTooManyRequests:       {},
+	metav1.StatusReasonBadRequest:            {},
+	metav1.StatusReasonMethodNotAllowed:      {},
+	metav1.StatusReasonNotAcceptable:         {},
+	metav1.StatusReasonRequestEntityTooLarge: {},
+	metav1.StatusReasonUnsupportedMediaType:  {},
+	metav1.StatusReasonInternalError:         {},
+	metav1.StatusReasonExpired:               {},
+	metav1.StatusReasonServiceUnavailable:    {},
+}
+
+// Error implements the Error interface.
+func (e *StatusError) Error() string {
+	return e.ErrStatus.Message
+}
+
+// Status allows access to e's status without having to know the detailed workings
+// of StatusError.
+func (e *StatusError) Status() metav1.Status {
+	return e.ErrStatus
+}
+
+// DebugError reports extended info about the error to debug output.
+func (e *StatusError) DebugError() (string, []interface{}) {
+	if out, err := json.MarshalIndent(e.ErrStatus, "", "  "); err == nil {
+		return "server response object: %s", []interface{}{string(out)}
+	}
+	return "server response object: %#v", []interface{}{e.ErrStatus}
+}
+
+// HasStatusCause returns true if the provided error has a details cause
+// with the provided type name.
+// It supports wrapped errors and returns false when the error is nil.
+func HasStatusCause(err error, name metav1.CauseType) bool {
+	_, ok := StatusCause(err, name)
+	return ok
+}
+
+// StatusCause returns the named cause from the provided error if it exists and
+// the error unwraps to the type APIStatus. Otherwise it returns false.
+func StatusCause(err error, name metav1.CauseType) (metav1.StatusCause, bool) {
+	status, ok := err.(APIStatus)
+	if (ok || errors.As(err, &status)) && status.Status().Details != nil {
+		for _, cause := range status.Status().Details.Causes {
+			if cause.Type == name {
+				return cause, true
+			}
+		}
+	}
+	return metav1.StatusCause{}, false
+}
+
+// UnexpectedObjectError can be returned by FromObject if it's passed a non-status object.
+type UnexpectedObjectError struct {
+	Object runtime.Object
+}
+
+// Error returns an error message describing 'u'.
+func (u *UnexpectedObjectError) Error() string {
+	return fmt.Sprintf("unexpected object: %v", u.Object)
+}
+
+// FromObject generates an StatusError from an metav1.Status, if that is the type of obj; otherwise,
+// returns an UnexpecteObjectError.
+func FromObject(obj runtime.Object) error {
+	switch t := obj.(type) {
+	case *metav1.Status:
+		return &StatusError{ErrStatus: *t}
+	case runtime.Unstructured:
+		var status metav1.Status
+		obj := t.UnstructuredContent()
+		if !reflect.DeepEqual(obj["kind"], "Status") {
+			break
+		}
+		if err := runtime.DefaultUnstructuredConverter.FromUnstructured(t.UnstructuredContent(), &status); err != nil {
+			return err
+		}
+		if status.APIVersion != "v1" && status.APIVersion != "meta.k8s.io/v1" {
+			break
+		}
+		return &StatusError{ErrStatus: status}
+	}
+	return &UnexpectedObjectError{obj}
+}
+
+// NewNotFound returns a new error which indicates that the resource of the kind and the name was not found.
+func NewNotFound(qualifiedResource schema.GroupResource, name string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusNotFound,
+		Reason: metav1.StatusReasonNotFound,
+		Details: &metav1.StatusDetails{
+			Group: qualifiedResource.Group,
+			Kind:  qualifiedResource.Resource,
+			Name:  name,
+		},
+		Message: fmt.Sprintf("%s %q not found", qualifiedResource.String(), name),
+	}}
+}
+
+// NewAlreadyExists returns an error indicating the item requested exists by that identifier.
+func NewAlreadyExists(qualifiedResource schema.GroupResource, name string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusConflict,
+		Reason: metav1.StatusReasonAlreadyExists,
+		Details: &metav1.StatusDetails{
+			Group: qualifiedResource.Group,
+			Kind:  qualifiedResource.Resource,
+			Name:  name,
+		},
+		Message: fmt.Sprintf("%s %q already exists", qualifiedResource.String(), name),
+	}}
+}
+
+// NewGenerateNameConflict returns an error indicating the server
+// was not able to generate a valid name for a resource.
+func NewGenerateNameConflict(qualifiedResource schema.GroupResource, name string, retryAfterSeconds int) *StatusError {
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusConflict,
+		Reason: metav1.StatusReasonAlreadyExists,
+		Details: &metav1.StatusDetails{
+			Group:             qualifiedResource.Group,
+			Kind:              qualifiedResource.Resource,
+			Name:              name,
+			RetryAfterSeconds: int32(retryAfterSeconds),
+		},
+		Message: fmt.Sprintf(
+			"%s %q already exists, the server was not able to generate a unique name for the object",
+			qualifiedResource.String(), name),
+	}}
+}
+
+// NewUnauthorized returns an error indicating the client is not authorized to perform the requested
+// action.
+func NewUnauthorized(reason string) *StatusError {
+	message := reason
+	if len(message) == 0 {
+		message = "not authorized"
+	}
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusUnauthorized,
+		Reason:  metav1.StatusReasonUnauthorized,
+		Message: message,
+	}}
+}
+
+// NewForbidden returns an error indicating the requested action was forbidden
+func NewForbidden(qualifiedResource schema.GroupResource, name string, err error) *StatusError {
+	var message string
+	if qualifiedResource.Empty() {
+		message = fmt.Sprintf("forbidden: %v", err)
+	} else if name == "" {
+		message = fmt.Sprintf("%s is forbidden: %v", qualifiedResource.String(), err)
+	} else {
+		message = fmt.Sprintf("%s %q is forbidden: %v", qualifiedResource.String(), name, err)
+	}
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusForbidden,
+		Reason: metav1.StatusReasonForbidden,
+		Details: &metav1.StatusDetails{
+			Group: qualifiedResource.Group,
+			Kind:  qualifiedResource.Resource,
+			Name:  name,
+		},
+		Message: message,
+	}}
+}
+
+// NewConflict returns an error indicating the item can't be updated as provided.
+func NewConflict(qualifiedResource schema.GroupResource, name string, err error) *StatusError {
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusConflict,
+		Reason: metav1.StatusReasonConflict,
+		Details: &metav1.StatusDetails{
+			Group: qualifiedResource.Group,
+			Kind:  qualifiedResource.Resource,
+			Name:  name,
+		},
+		Message: fmt.Sprintf("Operation cannot be fulfilled on %s %q: %v", qualifiedResource.String(), name, err),
+	}}
+}
+
+// NewApplyConflict returns an error including details on the requests apply conflicts
+func NewApplyConflict(causes []metav1.StatusCause, message string) *StatusError {
+	return &StatusError{ErrStatus: metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusConflict,
+		Reason: metav1.StatusReasonConflict,
+		Details: &metav1.StatusDetails{
+			// TODO: Get obj details here?
+			Causes: causes,
+		},
+		Message: message,
+	}}
+}
+
+// NewGone returns an error indicating the item no longer available at the server and no forwarding address is known.
+//
+// Deprecated: Please use NewResourceExpired instead.
+func NewGone(message string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusGone,
+		Reason:  metav1.StatusReasonGone,
+		Message: message,
+	}}
+}
+
+// NewResourceExpired creates an error that indicates that the requested resource content has expired from
+// the server (usually due to a resourceVersion that is too old).
+func NewResourceExpired(message string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusGone,
+		Reason:  metav1.StatusReasonExpired,
+		Message: message,
+	}}
+}
+
+// NewInvalid returns an error indicating the item is invalid and cannot be processed.
+func NewInvalid(qualifiedKind schema.GroupKind, name string, errs field.ErrorList) *StatusError {
+	causes := make([]metav1.StatusCause, 0, len(errs))
+	for i := range errs {
+		err := errs[i]
+		causes = append(causes, metav1.StatusCause{
+			Type:    metav1.CauseType(err.Type),
+			Message: err.ErrorBody(),
+			Field:   err.Field,
+		})
+	}
+	err := &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusUnprocessableEntity,
+		Reason: metav1.StatusReasonInvalid,
+		Details: &metav1.StatusDetails{
+			Group:  qualifiedKind.Group,
+			Kind:   qualifiedKind.Kind,
+			Name:   name,
+			Causes: causes,
+		},
+	}}
+	aggregatedErrs := errs.ToAggregate()
+	if aggregatedErrs == nil {
+		err.ErrStatus.Message = fmt.Sprintf("%s %q is invalid", qualifiedKind.String(), name)
+	} else {
+		err.ErrStatus.Message = fmt.Sprintf("%s %q is invalid: %v", qualifiedKind.String(), name, aggregatedErrs)
+	}
+	return err
+}
+
+// NewBadRequest creates an error that indicates that the request is invalid and can not be processed.
+func NewBadRequest(reason string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusBadRequest,
+		Reason:  metav1.StatusReasonBadRequest,
+		Message: reason,
+	}}
+}
+
+// NewTooManyRequests creates an error that indicates that the client must try again later because
+// the specified endpoint is not accepting requests. More specific details should be provided
+// if client should know why the failure was limited.
+func NewTooManyRequests(message string, retryAfterSeconds int) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusTooManyRequests,
+		Reason:  metav1.StatusReasonTooManyRequests,
+		Message: message,
+		Details: &metav1.StatusDetails{
+			RetryAfterSeconds: int32(retryAfterSeconds),
+		},
+	}}
+}
+
+// NewServiceUnavailable creates an error that indicates that the requested service is unavailable.
+func NewServiceUnavailable(reason string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusServiceUnavailable,
+		Reason:  metav1.StatusReasonServiceUnavailable,
+		Message: reason,
+	}}
+}
+
+// NewMethodNotSupported returns an error indicating the requested action is not supported on this kind.
+func NewMethodNotSupported(qualifiedResource schema.GroupResource, action string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusMethodNotAllowed,
+		Reason: metav1.StatusReasonMethodNotAllowed,
+		Details: &metav1.StatusDetails{
+			Group: qualifiedResource.Group,
+			Kind:  qualifiedResource.Resource,
+		},
+		Message: fmt.Sprintf("%s is not supported on resources of kind %q", action, qualifiedResource.String()),
+	}}
+}
+
+// NewServerTimeout returns an error indicating the requested action could not be completed due to a
+// transient error, and the client should try again.
+func NewServerTimeout(qualifiedResource schema.GroupResource, operation string, retryAfterSeconds int) *StatusError {
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusInternalServerError,
+		Reason: metav1.StatusReasonServerTimeout,
+		Details: &metav1.StatusDetails{
+			Group:             qualifiedResource.Group,
+			Kind:              qualifiedResource.Resource,
+			Name:              operation,
+			RetryAfterSeconds: int32(retryAfterSeconds),
+		},
+		Message: fmt.Sprintf("The %s operation against %s could not be completed at this time, please try again.", operation, qualifiedResource.String()),
+	}}
+}
+
+// NewServerTimeoutForKind should not exist.  Server timeouts happen when accessing resources, the Kind is just what we
+// happened to be looking at when the request failed.  This delegates to keep code sane, but we should work towards removing this.
+func NewServerTimeoutForKind(qualifiedKind schema.GroupKind, operation string, retryAfterSeconds int) *StatusError {
+	return NewServerTimeout(schema.GroupResource{Group: qualifiedKind.Group, Resource: qualifiedKind.Kind}, operation, retryAfterSeconds)
+}
+
+// NewInternalError returns an error indicating the item is invalid and cannot be processed.
+func NewInternalError(err error) *StatusError {
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   http.StatusInternalServerError,
+		Reason: metav1.StatusReasonInternalError,
+		Details: &metav1.StatusDetails{
+			Causes: []metav1.StatusCause{{Message: err.Error()}},
+		},
+		Message: fmt.Sprintf("Internal error occurred: %v", err),
+	}}
+}
+
+// NewTimeoutError returns an error indicating that a timeout occurred before the request
+// could be completed.  Clients may retry, but the operation may still complete.
+func NewTimeoutError(message string, retryAfterSeconds int) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusGatewayTimeout,
+		Reason:  metav1.StatusReasonTimeout,
+		Message: fmt.Sprintf("Timeout: %s", message),
+		Details: &metav1.StatusDetails{
+			RetryAfterSeconds: int32(retryAfterSeconds),
+		},
+	}}
+}
+
+// NewTooManyRequestsError returns an error indicating that the request was rejected because
+// the server has received too many requests. Client should wait and retry. But if the request
+// is perishable, then the client should not retry the request.
+func NewTooManyRequestsError(message string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusTooManyRequests,
+		Reason:  metav1.StatusReasonTooManyRequests,
+		Message: fmt.Sprintf("Too many requests: %s", message),
+	}}
+}
+
+// NewRequestEntityTooLargeError returns an error indicating that the request
+// entity was too large.
+func NewRequestEntityTooLargeError(message string) *StatusError {
+	return &StatusError{metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusRequestEntityTooLarge,
+		Reason:  metav1.StatusReasonRequestEntityTooLarge,
+		Message: fmt.Sprintf("Request entity too large: %s", message),
+	}}
+}
+
+// NewGenericServerResponse returns a new error for server responses that are not in a recognizable form.
+func NewGenericServerResponse(code int, verb string, qualifiedResource schema.GroupResource, name, serverMessage string, retryAfterSeconds int, isUnexpectedResponse bool) *StatusError {
+	reason := metav1.StatusReasonUnknown
+	message := fmt.Sprintf("the server responded with the status code %d but did not return more information", code)
+	switch code {
+	case http.StatusConflict:
+		if verb == http.MethodPost {
+			reason = metav1.StatusReasonAlreadyExists
+		} else {
+			reason = metav1.StatusReasonConflict
+		}
+		message = "the server reported a conflict"
+	case http.StatusNotFound:
+		reason = metav1.StatusReasonNotFound
+		message = "the server could not find the requested resource"
+	case http.StatusBadRequest:
+		reason = metav1.StatusReasonBadRequest
+		message = "the server rejected our request for an unknown reason"
+	case http.StatusUnauthorized:
+		reason = metav1.StatusReasonUnauthorized
+		message = "the server has asked for the client to provide credentials"
+	case http.StatusForbidden:
+		reason = metav1.StatusReasonForbidden
+		// the server message has details about who is trying to perform what action.  Keep its message.
+		message = serverMessage
+	case http.StatusNotAcceptable:
+		reason = metav1.StatusReasonNotAcceptable
+		// the server message has details about what types are acceptable
+		if len(serverMessage) == 0 || serverMessage == "unknown" {
+			message = "the server was unable to respond with a content type that the client supports"
+		} else {
+			message = serverMessage
+		}
+	case http.StatusUnsupportedMediaType:
+		reason = metav1.StatusReasonUnsupportedMediaType
+		// the server message has details about what types are acceptable
+		message = serverMessage
+	case http.StatusMethodNotAllowed:
+		reason = metav1.StatusReasonMethodNotAllowed
+		message = "the server does not allow this method on the requested resource"
+	case http.StatusUnprocessableEntity:
+		reason = metav1.StatusReasonInvalid
+		message = "the server rejected our request due to an error in our request"
+	case http.StatusServiceUnavailable:
+		reason = metav1.StatusReasonServiceUnavailable
+		message = "the server is currently unable to handle the request"
+	case http.StatusGatewayTimeout:
+		reason = metav1.StatusReasonTimeout
+		message = "the server was unable to return a response in the time allotted, but may still be processing the request"
+	case http.StatusTooManyRequests:
+		reason = metav1.StatusReasonTooManyRequests
+		message = "the server has received too many requests and has asked us to try again later"
+	default:
+		if code >= 500 {
+			reason = metav1.StatusReasonInternalError
+			message = fmt.Sprintf("an error on the server (%q) has prevented the request from succeeding", serverMessage)
+		}
+	}
+	switch {
+	case !qualifiedResource.Empty() && len(name) > 0:
+		message = fmt.Sprintf("%s (%s %s %s)", message, strings.ToLower(verb), qualifiedResource.String(), name)
+	case !qualifiedResource.Empty():
+		message = fmt.Sprintf("%s (%s %s)", message, strings.ToLower(verb), qualifiedResource.String())
+	}
+	var causes []metav1.StatusCause
+	if isUnexpectedResponse {
+		causes = []metav1.StatusCause{
+			{
+				Type:    metav1.CauseTypeUnexpectedServerResponse,
+				Message: serverMessage,
+			},
+		}
+	} else {
+		causes = nil
+	}
+	return &StatusError{metav1.Status{
+		Status: metav1.StatusFailure,
+		Code:   int32(code),
+		Reason: reason,
+		Details: &metav1.StatusDetails{
+			Group: qualifiedResource.Group,
+			Kind:  qualifiedResource.Resource,
+			Name:  name,
+
+			Causes:            causes,
+			RetryAfterSeconds: int32(retryAfterSeconds),
+		},
+		Message: message,
+	}}
+}
+
+// IsNotFound returns true if the specified error was created by NewNotFound.
+// It supports wrapped errors and returns false when the error is nil.
+func IsNotFound(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonNotFound {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusNotFound {
+		return true
+	}
+	return false
+}
+
+// IsAlreadyExists determines if the err is an error which indicates that a specified resource already exists.
+// It supports wrapped errors and returns false when the error is nil.
+func IsAlreadyExists(err error) bool {
+	return ReasonForError(err) == metav1.StatusReasonAlreadyExists
+}
+
+// IsConflict determines if the err is an error which indicates the provided update conflicts.
+// It supports wrapped errors and returns false when the error is nil.
+func IsConflict(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonConflict {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusConflict {
+		return true
+	}
+	return false
+}
+
+// IsInvalid determines if the err is an error which indicates the provided resource is not valid.
+// It supports wrapped errors and returns false when the error is nil.
+func IsInvalid(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonInvalid {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusUnprocessableEntity {
+		return true
+	}
+	return false
+}
+
+// IsGone is true if the error indicates the requested resource is no longer available.
+// It supports wrapped errors and returns false when the error is nil.
+func IsGone(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonGone {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusGone {
+		return true
+	}
+	return false
+}
+
+// IsResourceExpired is true if the error indicates the resource has expired and the current action is
+// no longer possible.
+// It supports wrapped errors and returns false when the error is nil.
+func IsResourceExpired(err error) bool {
+	return ReasonForError(err) == metav1.StatusReasonExpired
+}
+
+// IsNotAcceptable determines if err is an error which indicates that the request failed due to an invalid Accept header
+// It supports wrapped errors and returns false when the error is nil.
+func IsNotAcceptable(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonNotAcceptable {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusNotAcceptable {
+		return true
+	}
+	return false
+}
+
+// IsUnsupportedMediaType determines if err is an error which indicates that the request failed due to an invalid Content-Type header
+// It supports wrapped errors and returns false when the error is nil.
+func IsUnsupportedMediaType(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonUnsupportedMediaType {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusUnsupportedMediaType {
+		return true
+	}
+	return false
+}
+
+// IsMethodNotSupported determines if the err is an error which indicates the provided action could not
+// be performed because it is not supported by the server.
+// It supports wrapped errors and returns false when the error is nil.
+func IsMethodNotSupported(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonMethodNotAllowed {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusMethodNotAllowed {
+		return true
+	}
+	return false
+}
+
+// IsServiceUnavailable is true if the error indicates the underlying service is no longer available.
+// It supports wrapped errors and returns false when the error is nil.
+func IsServiceUnavailable(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonServiceUnavailable {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusServiceUnavailable {
+		return true
+	}
+	return false
+}
+
+// IsBadRequest determines if err is an error which indicates that the request is invalid.
+// It supports wrapped errors and returns false when the error is nil.
+func IsBadRequest(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonBadRequest {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusBadRequest {
+		return true
+	}
+	return false
+}
+
+// IsUnauthorized determines if err is an error which indicates that the request is unauthorized and
+// requires authentication by the user.
+// It supports wrapped errors and returns false when the error is nil.
+func IsUnauthorized(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonUnauthorized {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusUnauthorized {
+		return true
+	}
+	return false
+}
+
+// IsForbidden determines if err is an error which indicates that the request is forbidden and cannot
+// be completed as requested.
+// It supports wrapped errors and returns false when the error is nil.
+func IsForbidden(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonForbidden {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusForbidden {
+		return true
+	}
+	return false
+}
+
+// IsTimeout determines if err is an error which indicates that request times out due to long
+// processing.
+// It supports wrapped errors and returns false when the error is nil.
+func IsTimeout(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonTimeout {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusGatewayTimeout {
+		return true
+	}
+	return false
+}
+
+// IsServerTimeout determines if err is an error which indicates that the request needs to be retried
+// by the client.
+// It supports wrapped errors and returns false when the error is nil.
+func IsServerTimeout(err error) bool {
+	// do not check the status code, because no https status code exists that can
+	// be scoped to retryable timeouts.
+	return ReasonForError(err) == metav1.StatusReasonServerTimeout
+}
+
+// IsInternalError determines if err is an error which indicates an internal server error.
+// It supports wrapped errors and returns false when the error is nil.
+func IsInternalError(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonInternalError {
+		return true
+	}
+	if _, ok := knownReasons[reason]; !ok && code == http.StatusInternalServerError {
+		return true
+	}
+	return false
+}
+
+// IsTooManyRequests determines if err is an error which indicates that there are too many requests
+// that the server cannot handle.
+// It supports wrapped errors and returns false when the error is nil.
+func IsTooManyRequests(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonTooManyRequests {
+		return true
+	}
+
+	// IsTooManyRequests' checking of code predates the checking of the code in
+	// the other Is* functions. In order to maintain backward compatibility, this
+	// does not check that the reason is unknown.
+	if code == http.StatusTooManyRequests {
+		return true
+	}
+	return false
+}
+
+// IsRequestEntityTooLargeError determines if err is an error which indicates
+// the request entity is too large.
+// It supports wrapped errors and returns false when the error is nil.
+func IsRequestEntityTooLargeError(err error) bool {
+	reason, code := reasonAndCodeForError(err)
+	if reason == metav1.StatusReasonRequestEntityTooLarge {
+		return true
+	}
+
+	// IsRequestEntityTooLargeError's checking of code predates the checking of
+	// the code in the other Is* functions. In order to maintain backward
+	// compatibility, this does not check that the reason is unknown.
+	if code == http.StatusRequestEntityTooLarge {
+		return true
+	}
+	return false
+}
+
+// IsUnexpectedServerError returns true if the server response was not in the expected API format,
+// and may be the result of another HTTP actor.
+// It supports wrapped errors and returns false when the error is nil.
+func IsUnexpectedServerError(err error) bool {
+	status, ok := err.(APIStatus)
+	if (ok || errors.As(err, &status)) && status.Status().Details != nil {
+		for _, cause := range status.Status().Details.Causes {
+			if cause.Type == metav1.CauseTypeUnexpectedServerResponse {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// IsUnexpectedObjectError determines if err is due to an unexpected object from the master.
+// It supports wrapped errors and returns false when the error is nil.
+func IsUnexpectedObjectError(err error) bool {
+	uoe, ok := err.(*UnexpectedObjectError)
+	return err != nil && (ok || errors.As(err, &uoe))
+}
+
+// IsStoreReadError determines if err is due to either failure to transform the
+// data from the storage, or failure to decode the object appropriately.
+func IsStoreReadError(err error) bool {
+	return ReasonForError(err) == metav1.StatusReasonStoreReadError
+}
+
+// SuggestsClientDelay returns true if this error suggests a client delay as well as the
+// suggested seconds to wait, or false if the error does not imply a wait. It does not
+// address whether the error *should* be retried, since some errors (like a 3xx) may
+// request delay without retry.
+// It supports wrapped errors and returns false when the error is nil.
+func SuggestsClientDelay(err error) (int, bool) {
+	t, ok := err.(APIStatus)
+	if (ok || errors.As(err, &t)) && t.Status().Details != nil {
+		switch t.Status().Reason {
+		// this StatusReason explicitly requests the caller to delay the action
+		case metav1.StatusReasonServerTimeout:
+			return int(t.Status().Details.RetryAfterSeconds), true
+		}
+		// If the client requests that we retry after a certain number of seconds
+		if t.Status().Details.RetryAfterSeconds > 0 {
+			return int(t.Status().Details.RetryAfterSeconds), true
+		}
+	}
+	return 0, false
+}
+
+// ReasonForError returns the HTTP status for a particular error.
+// It supports wrapped errors and returns StatusReasonUnknown when
+// the error is nil or doesn't have a status.
+func ReasonForError(err error) metav1.StatusReason {
+	if status, ok := err.(APIStatus); ok || errors.As(err, &status) {
+		return status.Status().Reason
+	}
+	return metav1.StatusReasonUnknown
+}
+
+func reasonAndCodeForError(err error) (metav1.StatusReason, int32) {
+	if status, ok := err.(APIStatus); ok || errors.As(err, &status) {
+		return status.Status().Reason, status.Status().Code
+	}
+	return metav1.StatusReasonUnknown, 0
+}
+
+// ErrorReporter converts generic errors into runtime.Object errors without
+// requiring the caller to take a dependency on meta/v1 (where Status lives).
+// This prevents circular dependencies in core watch code.
+type ErrorReporter struct {
+	code   int
+	verb   string
+	reason string
+}
+
+// NewClientErrorReporter will respond with valid v1.Status objects that report
+// unexpected server responses. Primarily used by watch to report errors when
+// we attempt to decode a response from the server and it is not in the form
+// we expect. Because watch is a dependency of the core api, we can't return
+// meta/v1.Status in that package and so much inject this interface to convert a
+// generic error as appropriate. The reason is passed as a unique status cause
+// on the returned status, otherwise the generic "ClientError" is returned.
+func NewClientErrorReporter(code int, verb string, reason string) *ErrorReporter {
+	return &ErrorReporter{
+		code:   code,
+		verb:   verb,
+		reason: reason,
+	}
+}
+
+// AsObject returns a valid error runtime.Object (a v1.Status) for the given
+// error, using the code and verb of the reporter type. The error is set to
+// indicate that this was an unexpected server response.
+func (r *ErrorReporter) AsObject(err error) runtime.Object {
+	status := NewGenericServerResponse(r.code, r.verb, schema.GroupResource{}, "", err.Error(), 0, true)
+	if status.ErrStatus.Details == nil {
+		status.ErrStatus.Details = &metav1.StatusDetails{}
+	}
+	reason := r.reason
+	if len(reason) == 0 {
+		reason = "ClientError"
+	}
+	status.ErrStatus.Details.Causes = append(status.ErrStatus.Details.Causes, metav1.StatusCause{
+		Type:    metav1.CauseType(reason),
+		Message: err.Error(),
+	})
+	return &status.ErrStatus
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/errors/errors_test.go b/third_party/k8s.io/apimachinery/pkg/api/errors/errors_test.go
new file mode 100644
index 0000000000..2268d652f6
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/errors/errors_test.go
@@ -0,0 +1,705 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package errors
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"reflect"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func resource(resource string) schema.GroupResource {
+	return schema.GroupResource{Group: "", Resource: resource}
+}
+func kind(kind string) schema.GroupKind {
+	return schema.GroupKind{Group: "", Kind: kind}
+}
+
+func TestErrorNew(t *testing.T) {
+	err := NewAlreadyExists(resource("tests"), "1")
+	if !IsAlreadyExists(err) {
+		t.Errorf("expected to be %s", metav1.StatusReasonAlreadyExists)
+	}
+	if IsConflict(err) {
+		t.Errorf("expected to not be %s", metav1.StatusReasonConflict)
+	}
+	if IsNotFound(err) {
+		t.Errorf("expected to not be %s", metav1.StatusReasonNotFound)
+	}
+	if IsInvalid(err) {
+		t.Errorf("expected to not be %s", metav1.StatusReasonInvalid)
+	}
+	if IsBadRequest(err) {
+		t.Errorf("expected to not be %s", metav1.StatusReasonBadRequest)
+	}
+	if IsForbidden(err) {
+		t.Errorf("expected to not be %s", metav1.StatusReasonForbidden)
+	}
+	if IsServerTimeout(err) {
+		t.Errorf("expected to not be %s", metav1.StatusReasonServerTimeout)
+	}
+	if IsMethodNotSupported(err) {
+		t.Errorf("expected to not be %s", metav1.StatusReasonMethodNotAllowed)
+	}
+
+	if !IsConflict(NewConflict(resource("tests"), "2", errors.New("message"))) {
+		t.Errorf("expected to be %s", metav1.StatusReasonAlreadyExists)
+	}
+	if !IsNotFound(NewNotFound(resource("tests"), "3")) {
+		t.Errorf("expected to be %s", metav1.StatusReasonNotFound)
+	}
+	if !IsInvalid(NewInvalid(kind("Test"), "2", nil)) {
+		t.Errorf("expected to be %s", metav1.StatusReasonInvalid)
+	}
+	if !IsBadRequest(NewBadRequest("reason")) {
+		t.Errorf("expected to be %s", metav1.StatusReasonBadRequest)
+	}
+	if !IsForbidden(NewForbidden(resource("tests"), "2", errors.New("reason"))) {
+		t.Errorf("expected to be %s", metav1.StatusReasonForbidden)
+	}
+	if !IsUnauthorized(NewUnauthorized("reason")) {
+		t.Errorf("expected to be %s", metav1.StatusReasonUnauthorized)
+	}
+	if !IsServerTimeout(NewServerTimeout(resource("tests"), "reason", 0)) {
+		t.Errorf("expected to be %s", metav1.StatusReasonServerTimeout)
+	}
+	if !IsMethodNotSupported(NewMethodNotSupported(resource("foos"), "delete")) {
+		t.Errorf("expected to be %s", metav1.StatusReasonMethodNotAllowed)
+	}
+
+	if !IsAlreadyExists(NewGenerateNameConflict(resource("tests"), "3", 1)) {
+		t.Errorf("expected to be %s", metav1.StatusReasonAlreadyExists)
+	}
+	if time, ok := SuggestsClientDelay(NewGenerateNameConflict(resource("tests"), "3", 1)); time != 1 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+
+	if time, ok := SuggestsClientDelay(NewServerTimeout(resource("tests"), "doing something", 10)); time != 10 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+	if time, ok := SuggestsClientDelay(NewServerTimeout(resource("tests"), "doing something", 0)); time != 0 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+	if time, ok := SuggestsClientDelay(NewTimeoutError("test reason", 10)); time != 10 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+	if time, ok := SuggestsClientDelay(NewTooManyRequests("doing something", 10)); time != 10 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+	if time, ok := SuggestsClientDelay(NewTooManyRequests("doing something", 1)); time != 1 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+	if time, ok := SuggestsClientDelay(NewGenericServerResponse(429, http.MethodGet, resource("tests"), "test", "doing something", 10, true)); time != 10 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+	if time, ok := SuggestsClientDelay(NewGenericServerResponse(500, http.MethodGet, resource("tests"), "test", "doing something", 10, true)); time != 10 || !ok {
+		t.Errorf("unexpected %d", time)
+	}
+	if time, ok := SuggestsClientDelay(NewGenericServerResponse(429, http.MethodGet, resource("tests"), "test", "doing something", 0, true)); time != 0 || ok {
+		t.Errorf("unexpected %d", time)
+	}
+}
+
+func TestNewInvalid(t *testing.T) {
+	testCases := []struct {
+		Err     *field.Error
+		Details *metav1.StatusDetails
+		Msg     string
+	}{
+		{
+			field.Duplicate(field.NewPath("field[0].name"), "bar"),
+			&metav1.StatusDetails{
+				Kind: "Kind",
+				Name: "name",
+				Causes: []metav1.StatusCause{{
+					Type:  metav1.CauseTypeFieldValueDuplicate,
+					Field: "field[0].name",
+				}},
+			},
+			`Kind "name" is invalid: field[0].name: Duplicate value: "bar"`,
+		},
+		{
+			field.Invalid(field.NewPath("field[0].name"), "bar", "detail"),
+			&metav1.StatusDetails{
+				Kind: "Kind",
+				Name: "name",
+				Causes: []metav1.StatusCause{{
+					Type:  metav1.CauseTypeFieldValueInvalid,
+					Field: "field[0].name",
+				}},
+			},
+			`Kind "name" is invalid: field[0].name: Invalid value: "bar": detail`,
+		},
+		{
+			field.NotFound(field.NewPath("field[0].name"), "bar"),
+			&metav1.StatusDetails{
+				Kind: "Kind",
+				Name: "name",
+				Causes: []metav1.StatusCause{{
+					Type:  metav1.CauseTypeFieldValueNotFound,
+					Field: "field[0].name",
+				}},
+			},
+			`Kind "name" is invalid: field[0].name: Not found: "bar"`,
+		},
+		{
+			field.NotSupported[string](field.NewPath("field[0].name"), "bar", nil),
+			&metav1.StatusDetails{
+				Kind: "Kind",
+				Name: "name",
+				Causes: []metav1.StatusCause{{
+					Type:  metav1.CauseTypeFieldValueNotSupported,
+					Field: "field[0].name",
+				}},
+			},
+			`Kind "name" is invalid: field[0].name: Unsupported value: "bar"`,
+		},
+		{
+			field.Required(field.NewPath("field[0].name"), ""),
+			&metav1.StatusDetails{
+				Kind: "Kind",
+				Name: "name",
+				Causes: []metav1.StatusCause{{
+					Type:  metav1.CauseTypeFieldValueRequired,
+					Field: "field[0].name",
+				}},
+			},
+			`Kind "name" is invalid: field[0].name: Required value`,
+		},
+		{
+			nil,
+			&metav1.StatusDetails{
+				Kind:   "Kind",
+				Name:   "name",
+				Causes: []metav1.StatusCause{},
+			},
+			`Kind "name" is invalid`,
+		},
+	}
+	for i, testCase := range testCases {
+		vErr, expected := testCase.Err, testCase.Details
+		if vErr != nil && expected != nil {
+			expected.Causes[0].Message = vErr.ErrorBody()
+		}
+		var errList field.ErrorList
+		if vErr != nil {
+			errList = append(errList, vErr)
+		}
+		err := NewInvalid(kind("Kind"), "name", errList)
+		status := err.ErrStatus
+		if status.Code != 422 || status.Reason != metav1.StatusReasonInvalid {
+			t.Errorf("%d: unexpected status: %#v", i, status)
+		}
+		if !reflect.DeepEqual(expected, status.Details) {
+			t.Errorf("%d: expected %#v, got %#v", i, expected, status.Details)
+		}
+		if testCase.Msg != status.Message {
+			t.Errorf("%d: expected\n%s\ngot\n%s", i, testCase.Msg, status.Message)
+		}
+	}
+}
+
+func TestReasonForError(t *testing.T) {
+	if e, a := metav1.StatusReasonUnknown, ReasonForError(nil); e != a {
+		t.Errorf("unexpected reason type: %#v", a)
+	}
+}
+
+type TestType struct{}
+
+func (obj *TestType) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+func (obj *TestType) DeepCopyObject() runtime.Object {
+	if obj == nil {
+		return nil
+	}
+	clone := *obj
+	return &clone
+}
+
+func TestFromObject(t *testing.T) {
+	table := []struct {
+		obj     runtime.Object
+		message string
+	}{
+		{&metav1.Status{Message: "foobar"}, "foobar"},
+		{&TestType{}, "unexpected object: &{}"},
+	}
+
+	for _, item := range table {
+		if e, a := item.message, FromObject(item.obj).Error(); e != a {
+			t.Errorf("Expected %v, got %v", e, a)
+		}
+	}
+}
+
+func TestReasonForErrorSupportsWrappedErrors(t *testing.T) {
+	testCases := []struct {
+		name           string
+		err            error
+		expectedReason metav1.StatusReason
+	}{
+		{
+			name:           "Direct match",
+			err:            &StatusError{ErrStatus: metav1.Status{Reason: metav1.StatusReasonUnauthorized}},
+			expectedReason: metav1.StatusReasonUnauthorized,
+		},
+		{
+			name:           "No match",
+			err:            errors.New("some other error"),
+			expectedReason: metav1.StatusReasonUnknown,
+		},
+		{
+			name:           "Nested match",
+			err:            fmt.Errorf("wrapping: %w", fmt.Errorf("some more: %w", &StatusError{ErrStatus: metav1.Status{Reason: metav1.StatusReasonAlreadyExists}})),
+			expectedReason: metav1.StatusReasonAlreadyExists,
+		},
+		{
+			name:           "Nested, no match",
+			err:            fmt.Errorf("wrapping: %w", fmt.Errorf("some more: %w", errors.New("hello"))),
+			expectedReason: metav1.StatusReasonUnknown,
+		},
+		{
+			name:           "Nil",
+			expectedReason: metav1.StatusReasonUnknown,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if result := ReasonForError(tc.err); result != tc.expectedReason {
+				t.Errorf("expected reason: %q, but got known reason: %q", tc.expectedReason, result)
+			}
+		})
+	}
+}
+
+func TestIsTooManyRequestsSupportsWrappedErrors(t *testing.T) {
+	testCases := []struct {
+		name        string
+		err         error
+		expectMatch bool
+	}{
+		{
+			name:        "Direct match via status reason",
+			err:         &StatusError{ErrStatus: metav1.Status{Reason: metav1.StatusReasonTooManyRequests}},
+			expectMatch: true,
+		},
+		{
+			name:        "Direct match via status code",
+			err:         &StatusError{ErrStatus: metav1.Status{Code: http.StatusTooManyRequests}},
+			expectMatch: true,
+		},
+		{
+			name:        "No match",
+			err:         &StatusError{},
+			expectMatch: false,
+		},
+		{
+			name:        "Nested match via status reason",
+			err:         fmt.Errorf("Wrapping: %w", &StatusError{ErrStatus: metav1.Status{Reason: metav1.StatusReasonTooManyRequests}}),
+			expectMatch: true,
+		},
+		{
+			name:        "Nested match via status code",
+			err:         fmt.Errorf("Wrapping: %w", &StatusError{ErrStatus: metav1.Status{Code: http.StatusTooManyRequests}}),
+			expectMatch: true,
+		},
+		{
+			name:        "Nested,no match",
+			err:         fmt.Errorf("Wrapping: %w", &StatusError{ErrStatus: metav1.Status{Code: http.StatusNotFound}}),
+			expectMatch: false,
+		},
+		{
+			name:        "Nil",
+			expectMatch: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		if result := IsTooManyRequests(tc.err); result != tc.expectMatch {
+			t.Errorf("Expect match %t, got match %t", tc.expectMatch, result)
+		}
+	}
+}
+func TestIsRequestEntityTooLargeErrorSupportsWrappedErrors(t *testing.T) {
+	testCases := []struct {
+		name        string
+		err         error
+		expectMatch bool
+	}{
+		{
+			name:        "Direct match via status reason",
+			err:         &StatusError{ErrStatus: metav1.Status{Reason: metav1.StatusReasonRequestEntityTooLarge}},
+			expectMatch: true,
+		},
+		{
+			name:        "Direct match via status code",
+			err:         &StatusError{ErrStatus: metav1.Status{Code: http.StatusRequestEntityTooLarge}},
+			expectMatch: true,
+		},
+		{
+			name:        "No match",
+			err:         &StatusError{},
+			expectMatch: false,
+		},
+		{
+			name:        "Nested match via status reason",
+			err:         fmt.Errorf("Wrapping: %w", &StatusError{ErrStatus: metav1.Status{Reason: metav1.StatusReasonRequestEntityTooLarge}}),
+			expectMatch: true,
+		},
+		{
+			name:        "Nested match via status code",
+			err:         fmt.Errorf("Wrapping: %w", &StatusError{ErrStatus: metav1.Status{Code: http.StatusRequestEntityTooLarge}}),
+			expectMatch: true,
+		},
+		{
+			name:        "Nested,no match",
+			err:         fmt.Errorf("Wrapping: %w", &StatusError{ErrStatus: metav1.Status{Code: http.StatusNotFound}}),
+			expectMatch: false,
+		},
+		{
+			name:        "Nil",
+			expectMatch: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		if result := IsRequestEntityTooLargeError(tc.err); result != tc.expectMatch {
+			t.Errorf("Expect match %t, got match %t", tc.expectMatch, result)
+		}
+	}
+}
+
+func TestIsUnexpectedServerError(t *testing.T) {
+	unexpectedServerErr := func() error {
+		return &StatusError{
+			ErrStatus: metav1.Status{
+				Details: &metav1.StatusDetails{
+					Causes: []metav1.StatusCause{{Type: metav1.CauseTypeUnexpectedServerResponse}},
+				},
+			},
+		}
+	}
+	testCases := []struct {
+		name        string
+		err         error
+		expectMatch bool
+	}{
+		{
+			name:        "Direct match",
+			err:         unexpectedServerErr(),
+			expectMatch: true,
+		},
+		{
+			name:        "No match",
+			err:         errors.New("some other error"),
+			expectMatch: false,
+		},
+		{
+			name:        "Nested match",
+			err:         fmt.Errorf("wrapping: %w", unexpectedServerErr()),
+			expectMatch: true,
+		},
+		{
+			name:        "Nested, no match",
+			err:         fmt.Errorf("wrapping: %w", fmt.Errorf("some more: %w", errors.New("hello"))),
+			expectMatch: false,
+		},
+		{
+			name:        "Nil",
+			expectMatch: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if result := IsUnexpectedServerError(tc.err); result != tc.expectMatch {
+				t.Errorf("expected match: %t, but got match: %t", tc.expectMatch, result)
+			}
+		})
+	}
+}
+
+func TestIsUnexpectedObjectError(t *testing.T) {
+	unexpectedObjectErr := func() error {
+		return &UnexpectedObjectError{}
+	}
+	testCases := []struct {
+		name        string
+		err         error
+		expectMatch bool
+	}{
+		{
+			name:        "Direct match",
+			err:         unexpectedObjectErr(),
+			expectMatch: true,
+		},
+		{
+			name:        "No match",
+			err:         errors.New("some other error"),
+			expectMatch: false,
+		},
+		{
+			name:        "Nested match",
+			err:         fmt.Errorf("wrapping: %w", unexpectedObjectErr()),
+			expectMatch: true,
+		},
+		{
+			name:        "Nested, no match",
+			err:         fmt.Errorf("wrapping: %w", fmt.Errorf("some more: %w", errors.New("hello"))),
+			expectMatch: false,
+		},
+		{
+			name:        "Nil",
+			expectMatch: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if result := IsUnexpectedObjectError(tc.err); result != tc.expectMatch {
+				t.Errorf("expected match: %t, but got match: %t", tc.expectMatch, result)
+			}
+		})
+	}
+}
+
+func TestSuggestsClientDelaySupportsWrapping(t *testing.T) {
+	suggestsClientDelayErr := func() error {
+		return &StatusError{
+			ErrStatus: metav1.Status{
+				Reason:  metav1.StatusReasonServerTimeout,
+				Details: &metav1.StatusDetails{},
+			},
+		}
+	}
+	testCases := []struct {
+		name        string
+		err         error
+		expectMatch bool
+	}{
+		{
+			name:        "Direct match",
+			err:         suggestsClientDelayErr(),
+			expectMatch: true,
+		},
+		{
+			name:        "No match",
+			err:         errors.New("some other error"),
+			expectMatch: false,
+		},
+		{
+			name:        "Nested match",
+			err:         fmt.Errorf("wrapping: %w", suggestsClientDelayErr()),
+			expectMatch: true,
+		},
+		{
+			name:        "Nested, no match",
+			err:         fmt.Errorf("wrapping: %w", fmt.Errorf("some more: %w", errors.New("hello"))),
+			expectMatch: false,
+		},
+		{
+			name:        "Nil",
+			expectMatch: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if _, result := SuggestsClientDelay(tc.err); result != tc.expectMatch {
+				t.Errorf("expected match: %t, but got match: %t", tc.expectMatch, result)
+			}
+		})
+	}
+}
+
+func TestIsErrorTypesByReasonAndCode(t *testing.T) {
+	testCases := []struct {
+		name                  string
+		knownReason           metav1.StatusReason
+		otherReason           metav1.StatusReason
+		otherReasonConsidered bool
+		code                  int32
+		fn                    func(error) bool
+	}{
+		{
+			name:                  "IsRequestEntityTooLarge",
+			knownReason:           metav1.StatusReasonRequestEntityTooLarge,
+			otherReason:           metav1.StatusReasonForbidden,
+			otherReasonConsidered: false,
+			code:                  http.StatusRequestEntityTooLarge,
+			fn:                    IsRequestEntityTooLargeError,
+		}, {
+			name:                  "TooManyRequests",
+			knownReason:           metav1.StatusReasonTooManyRequests,
+			otherReason:           metav1.StatusReasonForbidden,
+			otherReasonConsidered: false,
+			code:                  http.StatusTooManyRequests,
+			fn:                    IsTooManyRequests,
+		}, {
+			name:                  "Forbidden",
+			knownReason:           metav1.StatusReasonForbidden,
+			otherReason:           metav1.StatusReasonNotFound,
+			otherReasonConsidered: true,
+			code:                  http.StatusForbidden,
+			fn:                    IsForbidden,
+		}, {
+			name:                  "NotFound",
+			knownReason:           metav1.StatusReasonNotFound,
+			otherReason:           metav1.StatusReasonForbidden,
+			otherReasonConsidered: true,
+			code:                  http.StatusNotFound,
+			fn:                    IsNotFound,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Run("by known reason", func(t *testing.T) {
+				err := &StatusError{
+					metav1.Status{
+						Reason: tc.knownReason,
+					},
+				}
+
+				got := tc.fn(err)
+				if !got {
+					t.Errorf("expected reason %s to match", tc.knownReason)
+				}
+			})
+
+			t.Run("by code and unknown reason", func(t *testing.T) {
+				err := &StatusError{
+					metav1.Status{
+						Reason: metav1.StatusReasonUnknown, // this could be _any_ reason that isn't in knownReasons.
+						Code:   tc.code,
+					},
+				}
+
+				got := tc.fn(err)
+				if !got {
+					t.Errorf("expected code %d with reason %s to match", tc.code, tc.otherReason)
+				}
+			})
+
+			if !tc.otherReasonConsidered {
+				return
+			}
+
+			t.Run("by code and other known reason", func(t *testing.T) {
+				err := &StatusError{
+					metav1.Status{
+						Reason: tc.otherReason,
+						Code:   tc.code,
+					},
+				}
+
+				got := tc.fn(err)
+				if got {
+					t.Errorf("expected code %d with reason %s to not match", tc.code, tc.otherReason)
+				}
+			})
+
+		})
+
+	}
+}
+
+func TestStatusCauseSupportsWrappedErrors(t *testing.T) {
+	err := &StatusError{ErrStatus: metav1.Status{
+		Details: &metav1.StatusDetails{
+			Causes: []metav1.StatusCause{{Type: "SomeCause"}},
+		},
+	}}
+
+	if cause, ok := StatusCause(nil, "SomeCause"); ok {
+		t.Errorf("expected no cause for nil, got %v: %#v", ok, cause)
+	}
+	if cause, ok := StatusCause(errors.New("boom"), "SomeCause"); ok {
+		t.Errorf("expected no cause for wrong type, got %v: %#v", ok, cause)
+	}
+
+	if cause, ok := StatusCause(err, "Other"); ok {
+		t.Errorf("expected no cause for wrong name, got %v: %#v", ok, cause)
+	}
+	if cause, ok := StatusCause(err, "SomeCause"); !ok || cause != err.ErrStatus.Details.Causes[0] {
+		t.Errorf("expected cause, got %v: %#v", ok, cause)
+	}
+
+	wrapped := fmt.Errorf("once: %w", err)
+	if cause, ok := StatusCause(wrapped, "SomeCause"); !ok || cause != err.ErrStatus.Details.Causes[0] {
+		t.Errorf("expected cause when wrapped, got %v: %#v", ok, cause)
+	}
+
+	nested := fmt.Errorf("twice: %w", wrapped)
+	if cause, ok := StatusCause(nested, "SomeCause"); !ok || cause != err.ErrStatus.Details.Causes[0] {
+		t.Errorf("expected cause when nested, got %v: %#v", ok, cause)
+	}
+}
+
+func BenchmarkIsAlreadyExistsWrappedErrors(b *testing.B) {
+	err := NewAlreadyExists(schema.GroupResource{}, "")
+	wrapped := fmt.Errorf("once: %w", err)
+
+	b.Run("Nil", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			IsAlreadyExists(nil)
+		}
+	})
+
+	b.Run("Bare", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			IsAlreadyExists(err)
+		}
+	})
+
+	b.Run("Wrapped", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			IsAlreadyExists(wrapped)
+		}
+	})
+}
+
+func BenchmarkIsNotFoundWrappedErrors(b *testing.B) {
+	err := NewNotFound(schema.GroupResource{}, "")
+	wrapped := fmt.Errorf("once: %w", err)
+
+	b.Run("Nil", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			IsNotFound(nil)
+		}
+	})
+
+	b.Run("Bare", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			IsNotFound(err)
+		}
+	})
+
+	b.Run("Wrapped", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			IsNotFound(wrapped)
+		}
+	})
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/OWNERS b/third_party/k8s.io/apimachinery/pkg/api/meta/OWNERS
new file mode 100644
index 0000000000..3bd8bf535e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/OWNERS
@@ -0,0 +1,15 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+reviewers:
+  - thockin
+  - smarterclayton
+  - wojtek-t
+  - deads2k
+  - derekwaynecarr
+  - caesarxuchao
+  - mikedanese
+  - liggitt
+  - janetkuo
+  - dims
+emeritus_reviewers:
+  - ncdc
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/conditions.go b/third_party/k8s.io/apimachinery/pkg/api/meta/conditions.go
new file mode 100644
index 0000000000..cbdf2eeb83
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/conditions.go
@@ -0,0 +1,119 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// SetStatusCondition sets the corresponding condition in conditions to newCondition and returns true
+// if the conditions are changed by this call.
+// conditions must be non-nil.
+//  1. if the condition of the specified type already exists (all fields of the existing condition are updated to
+//     newCondition, LastTransitionTime is set to now if the new status differs from the old status)
+//  2. if a condition of the specified type does not exist (LastTransitionTime is set to now() if unset, and newCondition is appended)
+func SetStatusCondition(conditions *[]metav1.Condition, newCondition metav1.Condition) (changed bool) {
+	if conditions == nil {
+		return false
+	}
+	existingCondition := FindStatusCondition(*conditions, newCondition.Type)
+	if existingCondition == nil {
+		if newCondition.LastTransitionTime.IsZero() {
+			newCondition.LastTransitionTime = metav1.NewTime(time.Now())
+		}
+		*conditions = append(*conditions, newCondition)
+		return true
+	}
+
+	if existingCondition.Status != newCondition.Status {
+		existingCondition.Status = newCondition.Status
+		if !newCondition.LastTransitionTime.IsZero() {
+			existingCondition.LastTransitionTime = newCondition.LastTransitionTime
+		} else {
+			existingCondition.LastTransitionTime = metav1.NewTime(time.Now())
+		}
+		changed = true
+	}
+
+	if existingCondition.Reason != newCondition.Reason {
+		existingCondition.Reason = newCondition.Reason
+		changed = true
+	}
+	if existingCondition.Message != newCondition.Message {
+		existingCondition.Message = newCondition.Message
+		changed = true
+	}
+	if existingCondition.ObservedGeneration != newCondition.ObservedGeneration {
+		existingCondition.ObservedGeneration = newCondition.ObservedGeneration
+		changed = true
+	}
+
+	return changed
+}
+
+// RemoveStatusCondition removes the corresponding conditionType from conditions if present. Returns
+// true if it was present and got removed.
+// conditions must be non-nil.
+func RemoveStatusCondition(conditions *[]metav1.Condition, conditionType string) (removed bool) {
+	if conditions == nil || len(*conditions) == 0 {
+		return false
+	}
+	newConditions := make([]metav1.Condition, 0, len(*conditions)-1)
+	for _, condition := range *conditions {
+		if condition.Type != conditionType {
+			newConditions = append(newConditions, condition)
+		}
+	}
+
+	removed = len(*conditions) != len(newConditions)
+	*conditions = newConditions
+
+	return removed
+}
+
+// FindStatusCondition finds the conditionType in conditions.
+func FindStatusCondition(conditions []metav1.Condition, conditionType string) *metav1.Condition {
+	for i := range conditions {
+		if conditions[i].Type == conditionType {
+			return &conditions[i]
+		}
+	}
+
+	return nil
+}
+
+// IsStatusConditionTrue returns true when the conditionType is present and set to `metav1.ConditionTrue`
+func IsStatusConditionTrue(conditions []metav1.Condition, conditionType string) bool {
+	return IsStatusConditionPresentAndEqual(conditions, conditionType, metav1.ConditionTrue)
+}
+
+// IsStatusConditionFalse returns true when the conditionType is present and set to `metav1.ConditionFalse`
+func IsStatusConditionFalse(conditions []metav1.Condition, conditionType string) bool {
+	return IsStatusConditionPresentAndEqual(conditions, conditionType, metav1.ConditionFalse)
+}
+
+// IsStatusConditionPresentAndEqual returns true when conditionType is present and equal to status.
+func IsStatusConditionPresentAndEqual(conditions []metav1.Condition, conditionType string, status metav1.ConditionStatus) bool {
+	for _, condition := range conditions {
+		if condition.Type == conditionType {
+			return condition.Status == status
+		}
+	}
+	return false
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/conditions_test.go b/third_party/k8s.io/apimachinery/pkg/api/meta/conditions_test.go
new file mode 100644
index 0000000000..248c885800
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/conditions_test.go
@@ -0,0 +1,250 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"reflect"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestSetStatusCondition(t *testing.T) {
+	oneHourBefore := time.Now().Add(-1 * time.Hour)
+	oneHourAfter := time.Now().Add(1 * time.Hour)
+
+	tests := []struct {
+		name          string
+		conditions    []metav1.Condition
+		toAdd         metav1.Condition
+		expectChanged bool
+		expected      []metav1.Condition
+	}{
+		{
+			name: "should-add",
+			conditions: []metav1.Condition{
+				{Type: "first"},
+				{Type: "third"},
+			},
+			toAdd:         metav1.Condition{Type: "second", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourBefore}, Reason: "reason", Message: "message"},
+			expectChanged: true,
+			expected: []metav1.Condition{
+				{Type: "first"},
+				{Type: "third"},
+				{Type: "second", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourBefore}, Reason: "reason", Message: "message"},
+			},
+		},
+		{
+			name: "use-supplied-time",
+			conditions: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second", Status: metav1.ConditionFalse},
+				{Type: "third"},
+			},
+			toAdd:         metav1.Condition{Type: "second", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourBefore}, Reason: "reason", Message: "message"},
+			expectChanged: true,
+			expected: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourBefore}, Reason: "reason", Message: "message"},
+				{Type: "third"},
+			},
+		},
+		{
+			name: "update-fields",
+			conditions: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourBefore}},
+				{Type: "third"},
+			},
+			toAdd:         metav1.Condition{Type: "second", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourAfter}, Reason: "reason", Message: "message", ObservedGeneration: 3},
+			expectChanged: true,
+			expected: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourBefore}, Reason: "reason", Message: "message", ObservedGeneration: 3},
+				{Type: "third"},
+			},
+		},
+		{
+			name: "nothing changes",
+			conditions: []metav1.Condition{{
+				Type:               "type",
+				Status:             metav1.ConditionTrue,
+				LastTransitionTime: metav1.Time{Time: oneHourBefore},
+			}},
+			toAdd: metav1.Condition{Type: "type", Status: metav1.ConditionTrue, LastTransitionTime: metav1.Time{Time: oneHourBefore}},
+			expected: []metav1.Condition{{
+				Type:               "type",
+				Status:             metav1.ConditionTrue,
+				LastTransitionTime: metav1.Time{Time: oneHourBefore},
+			}},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			changed := SetStatusCondition(&test.conditions, test.toAdd)
+			if test.expectChanged != changed {
+				t.Errorf("expectChanged=%t != changed=%t", test.expectChanged, changed)
+			}
+			if !reflect.DeepEqual(test.conditions, test.expected) {
+				t.Error(test.conditions)
+			}
+		})
+	}
+}
+
+func TestRemoveStatusCondition(t *testing.T) {
+	tests := []struct {
+		name          string
+		conditions    []metav1.Condition
+		conditionType string
+		expectRemoval bool
+		expected      []metav1.Condition
+	}{
+		{
+			name: "present",
+			conditions: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second"},
+				{Type: "third"},
+			},
+			conditionType: "second",
+			expectRemoval: true,
+			expected: []metav1.Condition{
+				{Type: "first"},
+				{Type: "third"},
+			},
+		},
+		{
+			name: "not-present",
+			conditions: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second"},
+				{Type: "third"},
+			},
+			conditionType: "fourth",
+			expected: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second"},
+				{Type: "third"},
+			},
+		},
+		{
+			name:          "empty_conditions",
+			conditions:    []metav1.Condition{},
+			conditionType: "Foo",
+			expected:      []metav1.Condition{},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			removed := RemoveStatusCondition(&test.conditions, test.conditionType)
+			if test.expectRemoval != removed {
+				t.Errorf("expectRemoval=%t != removal=%t", test.expectRemoval, removed)
+			}
+			if !reflect.DeepEqual(test.conditions, test.expected) {
+				t.Error(test.conditions)
+			}
+		})
+	}
+}
+
+func TestFindStatusCondition(t *testing.T) {
+	tests := []struct {
+		name          string
+		conditions    []metav1.Condition
+		conditionType string
+		expected      *metav1.Condition
+	}{
+		{
+			name: "not-present",
+			conditions: []metav1.Condition{
+				{Type: "first"},
+			},
+			conditionType: "second",
+			expected:      nil,
+		},
+		{
+			name: "present",
+			conditions: []metav1.Condition{
+				{Type: "first"},
+				{Type: "second"},
+			},
+			conditionType: "second",
+			expected:      &metav1.Condition{Type: "second"},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := FindStatusCondition(test.conditions, test.conditionType)
+			if !reflect.DeepEqual(actual, test.expected) {
+				t.Error(actual)
+			}
+		})
+	}
+}
+
+func TestIsStatusConditionPresentAndEqual(t *testing.T) {
+	tests := []struct {
+		name            string
+		conditions      []metav1.Condition
+		conditionType   string
+		conditionStatus metav1.ConditionStatus
+		expected        bool
+	}{
+		{
+			name: "doesnt-match-true",
+			conditions: []metav1.Condition{
+				{Type: "first", Status: metav1.ConditionUnknown},
+			},
+			conditionType:   "first",
+			conditionStatus: metav1.ConditionTrue,
+			expected:        false,
+		},
+		{
+			name: "does-match-true",
+			conditions: []metav1.Condition{
+				{Type: "first", Status: metav1.ConditionTrue},
+			},
+			conditionType:   "first",
+			conditionStatus: metav1.ConditionTrue,
+			expected:        true,
+		},
+		{
+			name: "does-match-false",
+			conditions: []metav1.Condition{
+				{Type: "first", Status: metav1.ConditionFalse},
+			},
+			conditionType:   "first",
+			conditionStatus: metav1.ConditionFalse,
+			expected:        true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := IsStatusConditionPresentAndEqual(test.conditions, test.conditionType, test.conditionStatus)
+			if actual != test.expected {
+				t.Error(actual)
+			}
+
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/doc.go b/third_party/k8s.io/apimachinery/pkg/api/meta/doc.go
new file mode 100644
index 0000000000..a3b18a5c9a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package meta provides functions for retrieving API metadata from objects
+// belonging to the Kubernetes API
+package meta
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/errors.go b/third_party/k8s.io/apimachinery/pkg/api/meta/errors.go
new file mode 100644
index 0000000000..f36aa4ec22
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/errors.go
@@ -0,0 +1,132 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"errors"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// AmbiguousResourceError is returned if the RESTMapper finds multiple matches for a resource
+type AmbiguousResourceError struct {
+	PartialResource schema.GroupVersionResource
+
+	MatchingResources []schema.GroupVersionResource
+	MatchingKinds     []schema.GroupVersionKind
+}
+
+func (e *AmbiguousResourceError) Error() string {
+	switch {
+	case len(e.MatchingKinds) > 0 && len(e.MatchingResources) > 0:
+		return fmt.Sprintf("%v matches multiple resources %v and kinds %v", e.PartialResource, e.MatchingResources, e.MatchingKinds)
+	case len(e.MatchingKinds) > 0:
+		return fmt.Sprintf("%v matches multiple kinds %v", e.PartialResource, e.MatchingKinds)
+	case len(e.MatchingResources) > 0:
+		return fmt.Sprintf("%v matches multiple resources %v", e.PartialResource, e.MatchingResources)
+	}
+	return fmt.Sprintf("%v matches multiple resources or kinds", e.PartialResource)
+}
+
+func (*AmbiguousResourceError) Is(target error) bool {
+	_, ok := target.(*AmbiguousResourceError)
+	return ok
+}
+
+// AmbiguousKindError is returned if the RESTMapper finds multiple matches for a kind
+type AmbiguousKindError struct {
+	PartialKind schema.GroupVersionKind
+
+	MatchingResources []schema.GroupVersionResource
+	MatchingKinds     []schema.GroupVersionKind
+}
+
+func (e *AmbiguousKindError) Error() string {
+	switch {
+	case len(e.MatchingKinds) > 0 && len(e.MatchingResources) > 0:
+		return fmt.Sprintf("%v matches multiple resources %v and kinds %v", e.PartialKind, e.MatchingResources, e.MatchingKinds)
+	case len(e.MatchingKinds) > 0:
+		return fmt.Sprintf("%v matches multiple kinds %v", e.PartialKind, e.MatchingKinds)
+	case len(e.MatchingResources) > 0:
+		return fmt.Sprintf("%v matches multiple resources %v", e.PartialKind, e.MatchingResources)
+	}
+	return fmt.Sprintf("%v matches multiple resources or kinds", e.PartialKind)
+}
+
+func (*AmbiguousKindError) Is(target error) bool {
+	_, ok := target.(*AmbiguousKindError)
+	return ok
+}
+
+func IsAmbiguousError(err error) bool {
+	if err == nil {
+		return false
+	}
+	return errors.Is(err, &AmbiguousResourceError{}) || errors.Is(err, &AmbiguousKindError{})
+}
+
+// NoResourceMatchError is returned if the RESTMapper can't find any match for a resource
+type NoResourceMatchError struct {
+	PartialResource schema.GroupVersionResource
+}
+
+func (e *NoResourceMatchError) Error() string {
+	return fmt.Sprintf("no matches for %v", e.PartialResource)
+}
+
+func (*NoResourceMatchError) Is(target error) bool {
+	_, ok := target.(*NoResourceMatchError)
+	return ok
+}
+
+// NoKindMatchError is returned if the RESTMapper can't find any match for a kind
+type NoKindMatchError struct {
+	// GroupKind is the API group and kind that was searched
+	GroupKind schema.GroupKind
+	// SearchedVersions is the optional list of versions the search was restricted to
+	SearchedVersions []string
+}
+
+func (e *NoKindMatchError) Error() string {
+	searchedVersions := sets.NewString()
+	for _, v := range e.SearchedVersions {
+		searchedVersions.Insert(schema.GroupVersion{Group: e.GroupKind.Group, Version: v}.String())
+	}
+
+	switch len(searchedVersions) {
+	case 0:
+		return fmt.Sprintf("no matches for kind %q in group %q", e.GroupKind.Kind, e.GroupKind.Group)
+	case 1:
+		return fmt.Sprintf("no matches for kind %q in version %q", e.GroupKind.Kind, searchedVersions.List()[0])
+	default:
+		return fmt.Sprintf("no matches for kind %q in versions %q", e.GroupKind.Kind, searchedVersions.List())
+	}
+}
+
+func (*NoKindMatchError) Is(target error) bool {
+	_, ok := target.(*NoKindMatchError)
+	return ok
+}
+
+func IsNoMatchError(err error) bool {
+	if err == nil {
+		return false
+	}
+	return errors.Is(err, &NoResourceMatchError{}) || errors.Is(err, &NoKindMatchError{})
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/errors_test.go b/third_party/k8s.io/apimachinery/pkg/api/meta/errors_test.go
new file mode 100644
index 0000000000..56e5d030b4
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/errors_test.go
@@ -0,0 +1,79 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestErrorMatching(t *testing.T) {
+	testCases := []struct {
+		name string
+		// input should contain an error that is _not_ empty, otherwise the naive reflectlite.DeepEqual matching of
+		// the errors lib will always succeed, but for all of these we want to verify that the matching is based on
+		// type.
+		input       error
+		new         func() error
+		matcherFunc func(error) bool
+	}{
+		{
+			name:        "AmbiguousResourceError",
+			input:       &AmbiguousResourceError{MatchingResources: []schema.GroupVersionResource{{}}},
+			new:         func() error { return &AmbiguousResourceError{} },
+			matcherFunc: IsAmbiguousError,
+		},
+		{
+			name:        "AmbiguousKindError",
+			input:       &AmbiguousKindError{MatchingResources: []schema.GroupVersionResource{{}}},
+			new:         func() error { return &AmbiguousKindError{} },
+			matcherFunc: IsAmbiguousError,
+		},
+		{
+			name:        "NoResourceMatchError",
+			input:       &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Group: "foo"}},
+			new:         func() error { return &NoResourceMatchError{} },
+			matcherFunc: IsNoMatchError,
+		},
+		{
+			name:        "NoKindMatchError",
+			input:       &NoKindMatchError{SearchedVersions: []string{"foo"}},
+			new:         func() error { return &NoKindMatchError{} },
+			matcherFunc: IsNoMatchError,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if !errors.Is(tc.input, tc.new()) {
+				t.Error("error doesn't match itself directly")
+			}
+			if !errors.Is(fmt.Errorf("wrapepd: %w", tc.input), tc.new()) {
+				t.Error("error doesn't match itself when wrapped")
+			}
+			if !tc.matcherFunc(tc.input) {
+				t.Errorf("error doesn't get matched by matcherfunc")
+			}
+			if errors.Is(tc.input, errors.New("foo")) {
+				t.Error("error incorrectly matches other error")
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/firsthit_restmapper.go b/third_party/k8s.io/apimachinery/pkg/api/meta/firsthit_restmapper.go
new file mode 100644
index 0000000000..1bc816fe3f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/firsthit_restmapper.go
@@ -0,0 +1,105 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+)
+
+var (
+	_ ResettableRESTMapper = &FirstHitRESTMapper{}
+)
+
+// FirstHitRESTMapper is a wrapper for multiple RESTMappers which returns the
+// first successful result for the singular requests
+type FirstHitRESTMapper struct {
+	MultiRESTMapper
+}
+
+func (m FirstHitRESTMapper) String() string {
+	return fmt.Sprintf("FirstHitRESTMapper{\n\t%v\n}", m.MultiRESTMapper)
+}
+
+func (m FirstHitRESTMapper) ResourceFor(resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	errors := []error{}
+	for _, t := range m.MultiRESTMapper {
+		ret, err := t.ResourceFor(resource)
+		if err == nil {
+			return ret, nil
+		}
+		errors = append(errors, err)
+	}
+
+	return schema.GroupVersionResource{}, collapseAggregateErrors(errors)
+}
+
+func (m FirstHitRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	errors := []error{}
+	for _, t := range m.MultiRESTMapper {
+		ret, err := t.KindFor(resource)
+		if err == nil {
+			return ret, nil
+		}
+		errors = append(errors, err)
+	}
+
+	return schema.GroupVersionKind{}, collapseAggregateErrors(errors)
+}
+
+// RESTMapping provides the REST mapping for the resource based on the
+// kind and version. This implementation supports multiple REST schemas and
+// return the first match.
+func (m FirstHitRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	errors := []error{}
+	for _, t := range m.MultiRESTMapper {
+		ret, err := t.RESTMapping(gk, versions...)
+		if err == nil {
+			return ret, nil
+		}
+		errors = append(errors, err)
+	}
+
+	return nil, collapseAggregateErrors(errors)
+}
+
+func (m FirstHitRESTMapper) Reset() {
+	m.MultiRESTMapper.Reset()
+}
+
+// collapseAggregateErrors returns the minimal errors.  it handles empty as nil, handles one item in a list
+// by returning the item, and collapses all NoMatchErrors to a single one (since they should all be the same)
+func collapseAggregateErrors(errors []error) error {
+	if len(errors) == 0 {
+		return nil
+	}
+	if len(errors) == 1 {
+		return errors[0]
+	}
+
+	allNoMatchErrors := true
+	for _, err := range errors {
+		allNoMatchErrors = allNoMatchErrors && IsNoMatchError(err)
+	}
+	if allNoMatchErrors {
+		return errors[0]
+	}
+
+	return utilerrors.NewAggregate(errors)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/help.go b/third_party/k8s.io/apimachinery/pkg/api/meta/help.go
new file mode 100644
index 0000000000..468afd0e9e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/help.go
@@ -0,0 +1,334 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+	"sync"
+
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+var (
+	// isListCache maintains a cache of types that are checked for lists
+	// which is used by IsListType.
+	// TODO: remove and replace with an interface check
+	isListCache = struct {
+		lock   sync.RWMutex
+		byType map[reflect.Type]bool
+	}{
+		byType: make(map[reflect.Type]bool, 1024),
+	}
+)
+
+// IsListType returns true if the provided Object has a slice called Items.
+// TODO: Replace the code in this check with an interface comparison by
+// creating and enforcing that lists implement a list accessor.
+func IsListType(obj runtime.Object) bool {
+	switch t := obj.(type) {
+	case runtime.Unstructured:
+		return t.IsList()
+	}
+	t := reflect.TypeOf(obj)
+
+	isListCache.lock.RLock()
+	ok, exists := isListCache.byType[t]
+	isListCache.lock.RUnlock()
+
+	if !exists {
+		_, err := getItemsPtr(obj)
+		ok = err == nil
+
+		// cache only the first 1024 types
+		isListCache.lock.Lock()
+		if len(isListCache.byType) < 1024 {
+			isListCache.byType[t] = ok
+		}
+		isListCache.lock.Unlock()
+	}
+
+	return ok
+}
+
+var (
+	errExpectFieldItems = errors.New("no Items field in this object")
+	errExpectSliceItems = errors.New("Items field must be a slice of objects")
+)
+
+// GetItemsPtr returns a pointer to the list object's Items member.
+// If 'list' doesn't have an Items member, it's not really a list type
+// and an error will be returned.
+// This function will either return a pointer to a slice, or an error, but not both.
+// TODO: this will be replaced with an interface in the future
+func GetItemsPtr(list runtime.Object) (interface{}, error) {
+	obj, err := getItemsPtr(list)
+	if err != nil {
+		return nil, fmt.Errorf("%T is not a list: %v", list, err)
+	}
+	return obj, nil
+}
+
+// getItemsPtr returns a pointer to the list object's Items member or an error.
+func getItemsPtr(list runtime.Object) (interface{}, error) {
+	v, err := conversion.EnforcePtr(list)
+	if err != nil {
+		return nil, err
+	}
+
+	items := v.FieldByName("Items")
+	if !items.IsValid() {
+		return nil, errExpectFieldItems
+	}
+	switch items.Kind() {
+	case reflect.Interface, reflect.Pointer:
+		target := reflect.TypeOf(items.Interface()).Elem()
+		if target.Kind() != reflect.Slice {
+			return nil, errExpectSliceItems
+		}
+		return items.Interface(), nil
+	case reflect.Slice:
+		return items.Addr().Interface(), nil
+	default:
+		return nil, errExpectSliceItems
+	}
+}
+
+// EachListItem invokes fn on each runtime.Object in the list. Any error immediately terminates
+// the loop.
+//
+// If items passed to fn are retained for different durations, and you want to avoid
+// retaining all items in obj as long as any item is referenced, use EachListItemWithAlloc instead.
+func EachListItem(obj runtime.Object, fn func(runtime.Object) error) error {
+	return eachListItem(obj, fn, false)
+}
+
+// EachListItemWithAlloc works like EachListItem, but avoids retaining references to the items slice in obj.
+// It does this by making a shallow copy of non-pointer items in obj.
+//
+// If the items passed to fn are not retained, or are retained for the same duration, use EachListItem instead for memory efficiency.
+func EachListItemWithAlloc(obj runtime.Object, fn func(runtime.Object) error) error {
+	return eachListItem(obj, fn, true)
+}
+
+// allocNew: Whether shallow copy is required when the elements in Object.Items are struct
+func eachListItem(obj runtime.Object, fn func(runtime.Object) error, allocNew bool) error {
+	if unstructured, ok := obj.(runtime.Unstructured); ok {
+		if allocNew {
+			return unstructured.EachListItemWithAlloc(fn)
+		}
+		return unstructured.EachListItem(fn)
+	}
+	// TODO: Change to an interface call?
+	itemsPtr, err := GetItemsPtr(obj)
+	if err != nil {
+		return err
+	}
+	items, err := conversion.EnforcePtr(itemsPtr)
+	if err != nil {
+		return err
+	}
+	len := items.Len()
+	if len == 0 {
+		return nil
+	}
+	takeAddr := false
+	if elemType := items.Type().Elem(); elemType.Kind() != reflect.Pointer && elemType.Kind() != reflect.Interface {
+		if !items.Index(0).CanAddr() {
+			return fmt.Errorf("unable to take address of items in %T for EachListItem", obj)
+		}
+		takeAddr = true
+	}
+
+	for i := 0; i < len; i++ {
+		raw := items.Index(i)
+		if takeAddr {
+			if allocNew {
+				// shallow copy to avoid retaining a reference to the original list item
+				itemCopy := reflect.New(raw.Type())
+				// assign to itemCopy and type-assert
+				itemCopy.Elem().Set(raw)
+				// reflect.New will guarantee that itemCopy must be a pointer.
+				raw = itemCopy
+			} else {
+				raw = raw.Addr()
+			}
+		}
+		// raw must be a pointer or an interface
+		// allocate a pointer is cheap
+		switch item := raw.Interface().(type) {
+		case *runtime.RawExtension:
+			if err := fn(item.Object); err != nil {
+				return err
+			}
+		case runtime.Object:
+			if err := fn(item); err != nil {
+				return err
+			}
+		default:
+			obj, ok := item.(runtime.Object)
+			if !ok {
+				return fmt.Errorf("%v: item[%v]: Expected object, got %#v(%s)", obj, i, raw.Interface(), raw.Kind())
+			}
+			if err := fn(obj); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// ExtractList returns obj's Items element as an array of runtime.Objects.
+// Returns an error if obj is not a List type (does not have an Items member).
+//
+// If items in the returned list are retained for different durations, and you want to avoid
+// retaining all items in obj as long as any item is referenced, use ExtractListWithAlloc instead.
+func ExtractList(obj runtime.Object) ([]runtime.Object, error) {
+	return extractList(obj, false)
+}
+
+// ExtractListWithAlloc works like ExtractList, but avoids retaining references to the items slice in obj.
+// It does this by making a shallow copy of non-pointer items in obj.
+//
+// If the items in the returned list are not retained, or are retained for the same duration, use ExtractList instead for memory efficiency.
+func ExtractListWithAlloc(obj runtime.Object) ([]runtime.Object, error) {
+	return extractList(obj, true)
+}
+
+// allocNew: Whether shallow copy is required when the elements in Object.Items are struct
+func extractList(obj runtime.Object, allocNew bool) ([]runtime.Object, error) {
+	itemsPtr, err := GetItemsPtr(obj)
+	if err != nil {
+		return nil, err
+	}
+	items, err := conversion.EnforcePtr(itemsPtr)
+	if err != nil {
+		return nil, err
+	}
+	if items.IsNil() {
+		return nil, nil
+	}
+	list := make([]runtime.Object, items.Len())
+	if len(list) == 0 {
+		return list, nil
+	}
+	elemType := items.Type().Elem()
+	isRawExtension := elemType == rawExtensionObjectType
+	implementsObject := elemType.Implements(objectType)
+	for i := range list {
+		raw := items.Index(i)
+		switch {
+		case isRawExtension:
+			item := raw.Interface().(runtime.RawExtension)
+			switch {
+			case item.Object != nil:
+				list[i] = item.Object
+			case item.Raw != nil:
+				// TODO: Set ContentEncoding and ContentType correctly.
+				list[i] = &runtime.Unknown{Raw: item.Raw}
+			default:
+				list[i] = nil
+			}
+		case implementsObject:
+			list[i] = raw.Interface().(runtime.Object)
+		case allocNew:
+			// shallow copy to avoid retaining a reference to the original list item
+			itemCopy := reflect.New(raw.Type())
+			// assign to itemCopy and type-assert
+			itemCopy.Elem().Set(raw)
+			var ok bool
+			// reflect.New will guarantee that itemCopy must be a pointer.
+			if list[i], ok = itemCopy.Interface().(runtime.Object); !ok {
+				return nil, fmt.Errorf("%v: item[%v]: Expected object, got %#v(%s)", obj, i, raw.Interface(), raw.Kind())
+			}
+		default:
+			var found bool
+			if list[i], found = raw.Addr().Interface().(runtime.Object); !found {
+				return nil, fmt.Errorf("%v: item[%v]: Expected object, got %#v(%s)", obj, i, raw.Interface(), raw.Kind())
+			}
+		}
+	}
+	return list, nil
+}
+
+var (
+	// objectSliceType is the type of a slice of Objects
+	objectSliceType        = reflect.TypeOf([]runtime.Object{})
+	objectType             = reflect.TypeOf((*runtime.Object)(nil)).Elem()
+	rawExtensionObjectType = reflect.TypeOf(runtime.RawExtension{})
+)
+
+// LenList returns the length of this list or 0 if it is not a list.
+func LenList(list runtime.Object) int {
+	itemsPtr, err := GetItemsPtr(list)
+	if err != nil {
+		return 0
+	}
+	items, err := conversion.EnforcePtr(itemsPtr)
+	if err != nil {
+		return 0
+	}
+	return items.Len()
+}
+
+// SetList sets the given list object's Items member have the elements given in
+// objects.
+// Returns an error if list is not a List type (does not have an Items member),
+// or if any of the objects are not of the right type.
+func SetList(list runtime.Object, objects []runtime.Object) error {
+	itemsPtr, err := GetItemsPtr(list)
+	if err != nil {
+		return err
+	}
+	items, err := conversion.EnforcePtr(itemsPtr)
+	if err != nil {
+		return err
+	}
+	if items.Type() == objectSliceType {
+		items.Set(reflect.ValueOf(objects))
+		return nil
+	}
+	slice := reflect.MakeSlice(items.Type(), len(objects), len(objects))
+	for i := range objects {
+		dest := slice.Index(i)
+		if dest.Type() == rawExtensionObjectType {
+			dest = dest.FieldByName("Object")
+		}
+
+		// check to see if you're directly assignable
+		if reflect.TypeOf(objects[i]).AssignableTo(dest.Type()) {
+			dest.Set(reflect.ValueOf(objects[i]))
+			continue
+		}
+
+		src, err := conversion.EnforcePtr(objects[i])
+		if err != nil {
+			return err
+		}
+		if src.Type().AssignableTo(dest.Type()) {
+			dest.Set(src)
+		} else if src.Type().ConvertibleTo(dest.Type()) {
+			dest.Set(src.Convert(dest.Type()))
+		} else {
+			return fmt.Errorf("item[%d]: can't assign or convert %v into %v", i, src.Type(), dest.Type())
+		}
+	}
+	items.Set(slice)
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/help_test.go b/third_party/k8s.io/apimachinery/pkg/api/meta/help_test.go
new file mode 100644
index 0000000000..e3047f50f1
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/help_test.go
@@ -0,0 +1,585 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"reflect"
+	"strconv"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+const (
+	fakeObjectItemsNum = 1000
+	exemptObjectIndex  = fakeObjectItemsNum / 4
+)
+
+type SampleSpec struct {
+	Flied int
+}
+
+type FooSpec struct {
+	Flied int
+}
+
+type FooList struct {
+	metav1.TypeMeta
+	metav1.ListMeta
+	Items []Foo
+}
+
+func (s *FooList) DeepCopyObject() runtime.Object { panic("unimplemented") }
+
+type SampleList struct {
+	metav1.TypeMeta
+	metav1.ListMeta
+	Items []Sample
+}
+
+func (s *SampleList) DeepCopyObject() runtime.Object { panic("unimplemented") }
+
+type RawExtensionList struct {
+	metav1.TypeMeta
+	metav1.ListMeta
+
+	Items []runtime.RawExtension
+}
+
+func (l RawExtensionList) DeepCopyObject() runtime.Object { panic("unimplemented") }
+
+// NOTE: Foo struct itself is the implementer of runtime.Object.
+type Foo struct {
+	metav1.TypeMeta
+	metav1.ObjectMeta
+	Spec FooSpec
+}
+
+func (f Foo) GetObjectKind() schema.ObjectKind {
+	tm := f.TypeMeta
+	return &tm
+}
+
+func (f Foo) DeepCopyObject() runtime.Object { panic("unimplemented") }
+
+// NOTE: the pointer of Sample that is the implementer of runtime.Object.
+// the behavior is similar to our corev1.Pod. corev1.Node
+type Sample struct {
+	metav1.TypeMeta
+	metav1.ObjectMeta
+	Spec SampleSpec
+}
+
+func (s *Sample) GetObjectKind() schema.ObjectKind {
+	tm := s.TypeMeta
+	return &tm
+}
+
+func (s *Sample) DeepCopyObject() runtime.Object { panic("unimplemented") }
+
+func fakeSampleList(numItems int) *SampleList {
+	out := &SampleList{
+		Items: make([]Sample, numItems),
+	}
+
+	for i := range out.Items {
+		out.Items[i] = Sample{
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: "sample.org/v1",
+				Kind:       "Sample",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      strconv.Itoa(i),
+				Namespace: "default",
+				Labels: map[string]string{
+					"label-key-1": "label-value-1",
+				},
+				Annotations: map[string]string{
+					"annotations-key-1": "annotations-value-1",
+				},
+			},
+			Spec: SampleSpec{
+				Flied: i,
+			},
+		}
+	}
+	return out
+}
+
+func fakeExtensionList(numItems int) *RawExtensionList {
+	out := &RawExtensionList{
+		Items: make([]runtime.RawExtension, numItems),
+	}
+
+	for i := range out.Items {
+		out.Items[i] = runtime.RawExtension{
+			Object: &Foo{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "sample.org/v2",
+					Kind:       "Sample",
+				},
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      strconv.Itoa(i),
+					Namespace: "default",
+					Labels: map[string]string{
+						"label-key-1": "label-value-1",
+					},
+					Annotations: map[string]string{
+						"annotations-key-1": "annotations-value-1",
+					},
+				},
+				Spec: FooSpec{
+					Flied: i,
+				},
+			},
+		}
+	}
+	return out
+}
+
+func fakeUnstructuredList(numItems int) runtime.Unstructured {
+	out := &unstructured.UnstructuredList{
+		Items: make([]unstructured.Unstructured, numItems),
+	}
+
+	for i := range out.Items {
+		out.Items[i] = unstructured.Unstructured{
+			Object: map[string]interface{}{
+				"apiVersion": "v1",
+				"kind":       "Pod",
+				"metadata": map[string]interface{}{
+					"creationTimestamp": nil,
+					"name":              strconv.Itoa(i),
+				},
+				"spec": map[string]interface{}{
+					"hostname": "example.com",
+				},
+				"status": map[string]interface{}{},
+			},
+		}
+	}
+	return out
+}
+
+func fakeFooList(numItems int) *FooList {
+	out := &FooList{
+		Items: make([]Foo, numItems),
+	}
+
+	for i := range out.Items {
+		out.Items[i] = Foo{
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: "foo.org/v1",
+				Kind:       "Foo",
+			},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      strconv.Itoa(i),
+				Namespace: "default",
+				Labels: map[string]string{
+					"label-key-1": "label-value-1",
+				},
+				Annotations: map[string]string{
+					"annotations-key-1": "annotations-value-1",
+				},
+			},
+			Spec: FooSpec{
+				Flied: i,
+			},
+		}
+	}
+	return out
+}
+
+func TestEachList(t *testing.T) {
+	tests := []struct {
+		name            string
+		generateFunc    func(num int) (list runtime.Object)
+		expectObjectNum int
+	}{
+		{
+			name: "StructReceiverList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeFooList(num)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+		{
+			name: "PointerReceiverList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeSampleList(num)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+		{
+			name: "RawExtensionList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeExtensionList(num)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+		{
+			name: "UnstructuredList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeUnstructuredList(fakeObjectItemsNum)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Run("EachListItem", func(t *testing.T) {
+				expectObjectNames := map[string]struct{}{}
+				for i := 0; i < tc.expectObjectNum; i++ {
+					expectObjectNames[strconv.Itoa(i)] = struct{}{}
+				}
+				list := tc.generateFunc(tc.expectObjectNum)
+				err := EachListItem(list, func(object runtime.Object) error {
+					o, err := Accessor(object)
+					if err != nil {
+						return err
+					}
+					delete(expectObjectNames, o.GetName())
+					return nil
+				})
+				if err != nil {
+					t.Errorf("each list item %#v: %v", list, err)
+				}
+				if len(expectObjectNames) != 0 {
+					t.Fatal("expectObjectNames should be empty")
+				}
+			})
+			t.Run("EachListItemWithAlloc", func(t *testing.T) {
+				expectObjectNames := map[string]struct{}{}
+				for i := 0; i < tc.expectObjectNum; i++ {
+					expectObjectNames[strconv.Itoa(i)] = struct{}{}
+				}
+				list := tc.generateFunc(tc.expectObjectNum)
+				err := EachListItemWithAlloc(list, func(object runtime.Object) error {
+					o, err := Accessor(object)
+					if err != nil {
+						return err
+					}
+					delete(expectObjectNames, o.GetName())
+					return nil
+				})
+				if err != nil {
+					t.Errorf("each list %#v with alloc: %v", list, err)
+				}
+				if len(expectObjectNames) != 0 {
+					t.Fatal("expectObjectNames should be empty")
+				}
+			})
+		})
+	}
+}
+
+func TestExtractList(t *testing.T) {
+	tests := []struct {
+		name            string
+		generateFunc    func(num int) (list runtime.Object)
+		expectObjectNum int
+	}{
+		{
+			name: "StructReceiverList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeFooList(num)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+		{
+			name: "PointerReceiverList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeSampleList(num)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+		{
+			name: "RawExtensionList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeExtensionList(num)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+		{
+			name: "UnstructuredList",
+			generateFunc: func(num int) (list runtime.Object) {
+				return fakeUnstructuredList(fakeObjectItemsNum)
+			},
+			expectObjectNum: fakeObjectItemsNum,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Run("ExtractList", func(t *testing.T) {
+				expectObjectNames := map[string]struct{}{}
+				for i := 0; i < tc.expectObjectNum; i++ {
+					expectObjectNames[strconv.Itoa(i)] = struct{}{}
+				}
+				list := tc.generateFunc(tc.expectObjectNum)
+				objs, err := ExtractList(list)
+				if err != nil {
+					t.Fatalf("extract list %#v: %v", list, err)
+				}
+				for i := range objs {
+					var (
+						o   metav1.Object
+						err error
+						obj = objs[i]
+					)
+
+					if reflect.TypeOf(obj).Kind() == reflect.Struct {
+						copy := reflect.New(reflect.TypeOf(obj))
+						copy.Elem().Set(reflect.ValueOf(obj))
+						o, err = Accessor(copy.Interface())
+					} else {
+						o, err = Accessor(obj)
+					}
+					if err != nil {
+						t.Fatalf("Accessor object %#v: %v", obj, err)
+					}
+					delete(expectObjectNames, o.GetName())
+				}
+				if len(expectObjectNames) != 0 {
+					t.Fatal("expectObjectNames should be empty")
+				}
+			})
+			t.Run("ExtractListWithAlloc", func(t *testing.T) {
+				expectObjectNames := map[string]struct{}{}
+				for i := 0; i < tc.expectObjectNum; i++ {
+					expectObjectNames[strconv.Itoa(i)] = struct{}{}
+				}
+				list := tc.generateFunc(tc.expectObjectNum)
+				objs, err := ExtractListWithAlloc(list)
+				if err != nil {
+					t.Fatalf("extract list with alloc: %v", err)
+				}
+				for i := range objs {
+					var (
+						o   metav1.Object
+						err error
+						obj = objs[i]
+					)
+					if reflect.TypeOf(obj).Kind() == reflect.Struct {
+						copy := reflect.New(reflect.TypeOf(obj))
+						copy.Elem().Set(reflect.ValueOf(obj))
+						o, err = Accessor(copy.Interface())
+					} else {
+						o, err = Accessor(obj)
+					}
+					if err != nil {
+						t.Fatalf("Accessor object %#v: %v", obj, err)
+					}
+					delete(expectObjectNames, o.GetName())
+				}
+				if len(expectObjectNames) != 0 {
+					t.Fatal("expectObjectNames should be empty")
+				}
+			})
+		})
+	}
+}
+
+func TestLenList(t *testing.T) {
+	tests := []struct {
+		name string
+		list runtime.Object
+		want int
+	}{
+		{
+			name: "nil",
+			list: nil,
+			want: 0,
+		},
+		{
+			name: "empty FooList",
+			list: &FooList{},
+			want: 0,
+		},
+		{
+			name: "FooList",
+			list: fakeFooList(fakeObjectItemsNum),
+			want: fakeObjectItemsNum,
+		},
+		{
+			name: "SampleList",
+			list: fakeSampleList(fakeObjectItemsNum),
+			want: fakeObjectItemsNum,
+		},
+		{
+			name: "RawExtensionList",
+			list: fakeExtensionList(fakeObjectItemsNum),
+			want: fakeObjectItemsNum,
+		},
+		{
+			name: "UnstructuredList",
+			list: fakeUnstructuredList(fakeObjectItemsNum).(*unstructured.UnstructuredList),
+			want: fakeObjectItemsNum,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := LenList(tc.list); got != tc.want {
+				t.Errorf("LenList() = %d, want %d", got, tc.want)
+			}
+		})
+	}
+}
+
+func BenchmarkExtractListItem(b *testing.B) {
+	tests := []struct {
+		name string
+		list runtime.Object
+	}{
+		{
+			name: "StructReceiverList",
+			list: fakeFooList(fakeObjectItemsNum),
+		},
+		{
+			name: "PointerReceiverList",
+			list: fakeSampleList(fakeObjectItemsNum),
+		},
+		{
+			name: "RawExtensionList",
+			list: fakeExtensionList(fakeObjectItemsNum),
+		},
+	}
+	for _, tc := range tests {
+		b.Run(tc.name, func(b *testing.B) {
+			b.ResetTimer()
+			for i := 0; i < b.N; i++ {
+				_, err := ExtractList(tc.list)
+				if err != nil {
+					b.Fatalf("ExtractList: %v", err)
+				}
+			}
+			b.StopTimer()
+		})
+	}
+}
+
+func BenchmarkEachListItem(b *testing.B) {
+	tests := []struct {
+		name string
+		list runtime.Object
+	}{
+		{
+			name: "StructReceiverList",
+			list: fakeFooList(fakeObjectItemsNum),
+		},
+		{
+			name: "PointerReceiverList",
+			list: fakeSampleList(fakeObjectItemsNum),
+		},
+		{
+			name: "RawExtensionList",
+			list: fakeExtensionList(fakeObjectItemsNum),
+		},
+		{
+			name: "UnstructuredList",
+			list: fakeUnstructuredList(fakeObjectItemsNum),
+		},
+	}
+	for _, tc := range tests {
+		b.Run(tc.name, func(b *testing.B) {
+			b.ResetTimer()
+			for i := 0; i < b.N; i++ {
+				err := EachListItem(tc.list, func(object runtime.Object) error {
+					return nil
+				})
+				if err != nil {
+					b.Fatalf("EachListItem: %v", err)
+				}
+			}
+			b.StopTimer()
+		})
+	}
+}
+
+func BenchmarkExtractListItemWithAlloc(b *testing.B) {
+	tests := []struct {
+		name string
+		list runtime.Object
+	}{
+		{
+			name: "StructReceiverList",
+			list: fakeFooList(fakeObjectItemsNum),
+		},
+		{
+			name: "PointerReceiverList",
+			list: fakeSampleList(fakeObjectItemsNum),
+		},
+		{
+			name: "RawExtensionList",
+			list: fakeExtensionList(fakeObjectItemsNum),
+		},
+	}
+	for _, tc := range tests {
+		b.Run(tc.name, func(b *testing.B) {
+			b.ResetTimer()
+			for i := 0; i < b.N; i++ {
+				_, err := ExtractListWithAlloc(tc.list)
+				if err != nil {
+					b.Fatalf("ExtractListWithAlloc: %v", err)
+				}
+			}
+			b.StopTimer()
+		})
+	}
+}
+
+func BenchmarkEachListItemWithAlloc(b *testing.B) {
+	tests := []struct {
+		name string
+		list runtime.Object
+	}{
+		{
+			name: "StructReceiverList",
+			list: fakeFooList(fakeObjectItemsNum),
+		},
+		{
+			name: "PointerReceiverList",
+			list: fakeSampleList(fakeObjectItemsNum),
+		},
+		{
+			name: "RawExtensionList",
+			list: fakeExtensionList(fakeObjectItemsNum),
+		},
+		{
+			name: "UnstructuredList",
+			list: fakeUnstructuredList(fakeObjectItemsNum),
+		},
+	}
+	for _, tc := range tests {
+		b.Run(tc.name, func(b *testing.B) {
+			b.ResetTimer()
+			for i := 0; i < b.N; i++ {
+				err := EachListItemWithAlloc(tc.list, func(object runtime.Object) error {
+					return nil
+				})
+				if err != nil {
+					b.Fatalf("EachListItemWithAlloc: %v", err)
+				}
+			}
+			b.StopTimer()
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/interfaces.go b/third_party/k8s.io/apimachinery/pkg/api/meta/interfaces.go
new file mode 100644
index 0000000000..628187eeeb
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/interfaces.go
@@ -0,0 +1,250 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+type ListMetaAccessor interface {
+	GetListMeta() List
+}
+
+// List lets you work with list metadata from any of the versioned or
+// internal API objects. Attempting to set or retrieve a field on an object that does
+// not support that field will be a no-op and return a default value.
+type List metav1.ListInterface
+
+// Type exposes the type and APIVersion of versioned or internal API objects.
+type Type metav1.Type
+
+// MetadataAccessor lets you work with object and list metadata from any of the versioned or
+// internal API objects. Attempting to set or retrieve a field on an object that does
+// not support that field (Name, UID, Namespace on lists) will be a no-op and return
+// a default value.
+//
+// MetadataAccessor exposes Interface in a way that can be used with multiple objects.
+type MetadataAccessor interface {
+	APIVersion(obj runtime.Object) (string, error)
+	SetAPIVersion(obj runtime.Object, version string) error
+
+	Kind(obj runtime.Object) (string, error)
+	SetKind(obj runtime.Object, kind string) error
+
+	Namespace(obj runtime.Object) (string, error)
+	SetNamespace(obj runtime.Object, namespace string) error
+
+	Name(obj runtime.Object) (string, error)
+	SetName(obj runtime.Object, name string) error
+
+	GenerateName(obj runtime.Object) (string, error)
+	SetGenerateName(obj runtime.Object, name string) error
+
+	UID(obj runtime.Object) (types.UID, error)
+	SetUID(obj runtime.Object, uid types.UID) error
+
+	SelfLink(obj runtime.Object) (string, error)
+	SetSelfLink(obj runtime.Object, selfLink string) error
+
+	Labels(obj runtime.Object) (map[string]string, error)
+	SetLabels(obj runtime.Object, labels map[string]string) error
+
+	Annotations(obj runtime.Object) (map[string]string, error)
+	SetAnnotations(obj runtime.Object, annotations map[string]string) error
+
+	Continue(obj runtime.Object) (string, error)
+	SetContinue(obj runtime.Object, c string) error
+
+	runtime.ResourceVersioner
+}
+
+type RESTScopeName string
+
+const (
+	RESTScopeNameNamespace RESTScopeName = "namespace"
+	RESTScopeNameRoot      RESTScopeName = "root"
+)
+
+// RESTScope contains the information needed to deal with REST resources that are in a resource hierarchy
+type RESTScope interface {
+	// Name of the scope
+	Name() RESTScopeName
+}
+
+// RESTMapping contains the information needed to deal with objects of a specific
+// resource and kind in a RESTful manner.
+type RESTMapping struct {
+	// Resource is the GroupVersionResource (location) for this endpoint
+	Resource schema.GroupVersionResource
+
+	// GroupVersionKind is the GroupVersionKind (data format) to submit to this endpoint
+	GroupVersionKind schema.GroupVersionKind
+
+	// Scope contains the information needed to deal with REST Resources that are in a resource hierarchy
+	Scope RESTScope
+}
+
+// RESTMapper allows clients to map resources to kind, and map kind and version
+// to interfaces for manipulating those objects. It is primarily intended for
+// consumers of Kubernetes compatible REST APIs as defined in docs/devel/api-conventions.md.
+//
+// The Kubernetes API provides versioned resources and object kinds which are scoped
+// to API groups. In other words, kinds and resources should not be assumed to be
+// unique across groups.
+//
+// RESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use RESTMapperWithContext instead.
+type RESTMapper interface {
+	// KindFor takes a partial resource and returns the single match.  Returns an error if there are multiple matches
+	KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error)
+
+	// KindsFor takes a partial resource and returns the list of potential kinds in priority order
+	KindsFor(resource schema.GroupVersionResource) ([]schema.GroupVersionKind, error)
+
+	// ResourceFor takes a partial resource and returns the single match.  Returns an error if there are multiple matches
+	ResourceFor(input schema.GroupVersionResource) (schema.GroupVersionResource, error)
+
+	// ResourcesFor takes a partial resource and returns the list of potential resource in priority order
+	ResourcesFor(input schema.GroupVersionResource) ([]schema.GroupVersionResource, error)
+
+	// RESTMapping identifies a preferred resource mapping for the provided group kind.
+	RESTMapping(gk schema.GroupKind, versions ...string) (*RESTMapping, error)
+	// RESTMappings returns all resource mappings for the provided group kind if no
+	// version search is provided. Otherwise identifies a preferred resource mapping for
+	// the provided version(s).
+	RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error)
+
+	ResourceSingularizer(resource string) (singular string, err error)
+}
+
+// RESTMapperWithContext allows clients to map resources to kind, and map kind and version
+// to interfaces for manipulating those objects. It is primarily intended for
+// consumers of Kubernetes compatible REST APIs as defined in docs/devel/api-conventions.md.
+//
+// The Kubernetes API provides versioned resources and object kinds which are scoped
+// to API groups. In other words, kinds and resources should not be assumed to be
+// unique across groups.
+type RESTMapperWithContext interface {
+	// KindFor takes a partial resource and returns the single match.  Returns an error if there are multiple matches
+	KindForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error)
+
+	// KindsFor takes a partial resource and returns the list of potential kinds in priority order
+	KindsForWithContext(ctx context.Context, resource schema.GroupVersionResource) ([]schema.GroupVersionKind, error)
+
+	// ResourceFor takes a partial resource and returns the single match.  Returns an error if there are multiple matches
+	ResourceForWithContext(ctx context.Context, input schema.GroupVersionResource) (schema.GroupVersionResource, error)
+
+	// ResourcesFor takes a partial resource and returns the list of potential resource in priority order
+	ResourcesForWithContext(ctx context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionResource, error)
+
+	// RESTMapping identifies a preferred resource mapping for the provided group kind.
+	RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error)
+	// RESTMappings returns all resource mappings for the provided group kind if no
+	// version search is provided. Otherwise identifies a preferred resource mapping for
+	// the provided version(s).
+	RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error)
+
+	ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error)
+}
+
+func ToRESTMapperWithContext(m RESTMapper) RESTMapperWithContext {
+	if m == nil {
+		return nil
+	}
+	if m, ok := m.(RESTMapperWithContext); ok {
+		return m
+	}
+	return &restMapperWrapper{
+		delegate: m,
+	}
+}
+
+type restMapperWrapper struct {
+	delegate RESTMapper
+}
+
+func (m *restMapperWrapper) KindForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return m.delegate.KindFor(resource)
+}
+func (m *restMapperWrapper) KindsForWithContext(ctx context.Context, resource schema.GroupVersionResource) ([]schema.GroupVersionKind, error) {
+	return m.delegate.KindsFor(resource)
+}
+func (m *restMapperWrapper) ResourceForWithContext(ctx context.Context, input schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	return m.delegate.ResourceFor(input)
+}
+func (m *restMapperWrapper) ResourcesForWithContext(ctx context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return m.delegate.ResourcesFor(input)
+}
+func (m *restMapperWrapper) RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	return m.delegate.RESTMapping(gk, versions...)
+}
+func (m *restMapperWrapper) RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	return m.delegate.RESTMappings(gk, versions...)
+}
+func (m *restMapperWrapper) ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error) {
+	return m.delegate.ResourceSingularizer(resource)
+}
+
+// ResettableRESTMapper is a RESTMapper which is capable of resetting itself
+// from discovery.
+// All rest mappers that delegate to other rest mappers must implement this interface and dynamically
+// check if the delegate mapper supports the Reset() operation.
+//
+// ResettableRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ResettableRESTMapperWithContext instead.
+type ResettableRESTMapper interface {
+	RESTMapper
+	Reset()
+}
+
+// ResettableRESTMapperWithContext is a RESTMapper which is capable of resetting itself
+// from discovery.
+// All rest mappers that delegate to other rest mappers must implement this interface and dynamically
+// check if the delegate mapper supports the ResetWithContext() operation.
+type ResettableRESTMapperWithContext interface {
+	RESTMapperWithContext
+	ResetWithContext(ctx context.Context)
+}
+
+func ToResettableRESTMapperWithContext(m ResettableRESTMapper) ResettableRESTMapperWithContext {
+	if m == nil {
+		return nil
+	}
+	if m, ok := m.(ResettableRESTMapperWithContext); ok {
+		return m
+	}
+	return &resettableRESTMapperWrapper{
+		RESTMapperWithContext: ToRESTMapperWithContext(m),
+		delegate:              m,
+	}
+}
+
+type resettableRESTMapperWrapper struct {
+	RESTMapperWithContext
+	delegate ResettableRESTMapper
+}
+
+func (m *resettableRESTMapperWrapper) ResetWithContext(ctx context.Context) {
+	m.delegate.Reset()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/lazy.go b/third_party/k8s.io/apimachinery/pkg/api/meta/lazy.go
new file mode 100644
index 0000000000..a4298114b6
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/lazy.go
@@ -0,0 +1,112 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"sync"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// lazyObject defers loading the mapper and typer until necessary.
+type lazyObject struct {
+	loader func() (RESTMapper, error)
+
+	lock   sync.Mutex
+	loaded bool
+	err    error
+	mapper RESTMapper
+}
+
+// NewLazyRESTMapperLoader handles unrecoverable errors when creating a RESTMapper / ObjectTyper by
+// returning those initialization errors when the interface methods are invoked. This defers the
+// initialization and any server calls until a client actually needs to perform the action.
+func NewLazyRESTMapperLoader(fn func() (RESTMapper, error)) RESTMapper {
+	obj := &lazyObject{loader: fn}
+	return obj
+}
+
+// init lazily loads the mapper and typer, returning an error if initialization has failed.
+func (o *lazyObject) init() error {
+	o.lock.Lock()
+	defer o.lock.Unlock()
+	if o.loaded {
+		return o.err
+	}
+	o.mapper, o.err = o.loader()
+	o.loaded = true
+	return o.err
+}
+
+var _ ResettableRESTMapper = &lazyObject{}
+
+func (o *lazyObject) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	if err := o.init(); err != nil {
+		return schema.GroupVersionKind{}, err
+	}
+	return o.mapper.KindFor(resource)
+}
+
+func (o *lazyObject) KindsFor(resource schema.GroupVersionResource) ([]schema.GroupVersionKind, error) {
+	if err := o.init(); err != nil {
+		return []schema.GroupVersionKind{}, err
+	}
+	return o.mapper.KindsFor(resource)
+}
+
+func (o *lazyObject) ResourceFor(input schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	if err := o.init(); err != nil {
+		return schema.GroupVersionResource{}, err
+	}
+	return o.mapper.ResourceFor(input)
+}
+
+func (o *lazyObject) ResourcesFor(input schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	if err := o.init(); err != nil {
+		return []schema.GroupVersionResource{}, err
+	}
+	return o.mapper.ResourcesFor(input)
+}
+
+func (o *lazyObject) RESTMapping(gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	if err := o.init(); err != nil {
+		return nil, err
+	}
+	return o.mapper.RESTMapping(gk, versions...)
+}
+
+func (o *lazyObject) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	if err := o.init(); err != nil {
+		return nil, err
+	}
+	return o.mapper.RESTMappings(gk, versions...)
+}
+
+func (o *lazyObject) ResourceSingularizer(resource string) (singular string, err error) {
+	if err := o.init(); err != nil {
+		return "", err
+	}
+	return o.mapper.ResourceSingularizer(resource)
+}
+
+func (o *lazyObject) Reset() {
+	o.lock.Lock()
+	defer o.lock.Unlock()
+	if o.loaded && o.err == nil {
+		MaybeResetRESTMapper(o.mapper)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/meta.go b/third_party/k8s.io/apimachinery/pkg/api/meta/meta.go
new file mode 100644
index 0000000000..4bf24da522
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/meta.go
@@ -0,0 +1,647 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"fmt"
+	"reflect"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/klog/v2"
+)
+
+// errNotList is returned when an object implements the Object style interfaces but not the List style
+// interfaces.
+var errNotList = fmt.Errorf("object does not implement the List interfaces")
+
+var errNotCommon = fmt.Errorf("object does not implement the common interface for accessing the SelfLink")
+
+// CommonAccessor returns a Common interface for the provided object or an error if the object does
+// not provide List.
+func CommonAccessor(obj interface{}) (metav1.Common, error) {
+	switch t := obj.(type) {
+	case List:
+		return t, nil
+	case ListMetaAccessor:
+		if m := t.GetListMeta(); m != nil {
+			return m, nil
+		}
+		return nil, errNotCommon
+	case metav1.ListMetaAccessor:
+		if m := t.GetListMeta(); m != nil {
+			return m, nil
+		}
+		return nil, errNotCommon
+	case metav1.Object:
+		return t, nil
+	case metav1.ObjectMetaAccessor:
+		if m := t.GetObjectMeta(); m != nil {
+			return m, nil
+		}
+		return nil, errNotCommon
+	default:
+		return nil, errNotCommon
+	}
+}
+
+// ListAccessor returns a List interface for the provided object or an error if the object does
+// not provide List.
+// IMPORTANT: Objects are NOT a superset of lists. Do not use this check to determine whether an
+// object *is* a List.
+func ListAccessor(obj interface{}) (List, error) {
+	switch t := obj.(type) {
+	case List:
+		return t, nil
+	case ListMetaAccessor:
+		if m := t.GetListMeta(); m != nil {
+			return m, nil
+		}
+		return nil, errNotList
+	case metav1.ListMetaAccessor:
+		if m := t.GetListMeta(); m != nil {
+			return m, nil
+		}
+		return nil, errNotList
+	default:
+		return nil, errNotList
+	}
+}
+
+// errNotObject is returned when an object implements the List style interfaces but not the Object style
+// interfaces.
+var errNotObject = fmt.Errorf("object does not implement the Object interfaces")
+
+// Accessor takes an arbitrary object pointer and returns meta.Interface.
+// obj must be a pointer to an API type. An error is returned if the minimum
+// required fields are missing. Fields that are not required return the default
+// value and are a no-op if set.
+func Accessor(obj interface{}) (metav1.Object, error) {
+	switch t := obj.(type) {
+	case metav1.Object:
+		return t, nil
+	case metav1.ObjectMetaAccessor:
+		if m := t.GetObjectMeta(); m != nil {
+			return m, nil
+		}
+		return nil, errNotObject
+	default:
+		return nil, errNotObject
+	}
+}
+
+// AsPartialObjectMetadata takes the metav1 interface and returns a partial object.
+// TODO: consider making this solely a conversion action.
+func AsPartialObjectMetadata(m metav1.Object) *metav1.PartialObjectMetadata {
+	switch t := m.(type) {
+	case *metav1.ObjectMeta:
+		return &metav1.PartialObjectMetadata{ObjectMeta: *t}
+	default:
+		return &metav1.PartialObjectMetadata{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:                       m.GetName(),
+				GenerateName:               m.GetGenerateName(),
+				Namespace:                  m.GetNamespace(),
+				SelfLink:                   m.GetSelfLink(),
+				UID:                        m.GetUID(),
+				ResourceVersion:            m.GetResourceVersion(),
+				Generation:                 m.GetGeneration(),
+				CreationTimestamp:          m.GetCreationTimestamp(),
+				DeletionTimestamp:          m.GetDeletionTimestamp(),
+				DeletionGracePeriodSeconds: m.GetDeletionGracePeriodSeconds(),
+				Labels:                     m.GetLabels(),
+				Annotations:                m.GetAnnotations(),
+				OwnerReferences:            m.GetOwnerReferences(),
+				Finalizers:                 m.GetFinalizers(),
+				ManagedFields:              m.GetManagedFields(),
+			},
+		}
+	}
+}
+
+// TypeAccessor returns an interface that allows retrieving and modifying the APIVersion
+// and Kind of an in-memory internal object.
+// TODO: this interface is used to test code that does not have ObjectMeta or ListMeta
+// in round tripping (objects which can use apiVersion/kind, but do not fit the Kube
+// api conventions).
+func TypeAccessor(obj interface{}) (Type, error) {
+	if typed, ok := obj.(runtime.Object); ok {
+		return objectAccessor{typed}, nil
+	}
+	v, err := conversion.EnforcePtr(obj)
+	if err != nil {
+		return nil, err
+	}
+	t := v.Type()
+	if v.Kind() != reflect.Struct {
+		return nil, fmt.Errorf("expected struct, but got %v: %v (%#v)", v.Kind(), t, v.Interface())
+	}
+
+	typeMeta := v.FieldByName("TypeMeta")
+	if !typeMeta.IsValid() {
+		return nil, fmt.Errorf("struct %v lacks embedded TypeMeta type", t)
+	}
+	a := &genericAccessor{}
+	if err := extractFromTypeMeta(typeMeta, a); err != nil {
+		return nil, fmt.Errorf("unable to find type fields on %#v: %v", typeMeta, err)
+	}
+	return a, nil
+}
+
+type objectAccessor struct {
+	runtime.Object
+}
+
+func (obj objectAccessor) GetKind() string {
+	return obj.GetObjectKind().GroupVersionKind().Kind
+}
+
+func (obj objectAccessor) SetKind(kind string) {
+	gvk := obj.GetObjectKind().GroupVersionKind()
+	gvk.Kind = kind
+	obj.GetObjectKind().SetGroupVersionKind(gvk)
+}
+
+func (obj objectAccessor) GetAPIVersion() string {
+	return obj.GetObjectKind().GroupVersionKind().GroupVersion().String()
+}
+
+func (obj objectAccessor) SetAPIVersion(version string) {
+	gvk := obj.GetObjectKind().GroupVersionKind()
+	gv, err := schema.ParseGroupVersion(version)
+	if err != nil {
+		gv = schema.GroupVersion{Version: version}
+	}
+	gvk.Group, gvk.Version = gv.Group, gv.Version
+	obj.GetObjectKind().SetGroupVersionKind(gvk)
+}
+
+// NewAccessor returns a MetadataAccessor that can retrieve
+// or manipulate resource version on objects derived from core API
+// metadata concepts.
+func NewAccessor() MetadataAccessor {
+	return resourceAccessor{}
+}
+
+// resourceAccessor implements ResourceVersioner and SelfLinker.
+type resourceAccessor struct{}
+
+func (resourceAccessor) Kind(obj runtime.Object) (string, error) {
+	return objectAccessor{obj}.GetKind(), nil
+}
+
+func (resourceAccessor) SetKind(obj runtime.Object, kind string) error {
+	objectAccessor{obj}.SetKind(kind)
+	return nil
+}
+
+func (resourceAccessor) APIVersion(obj runtime.Object) (string, error) {
+	return objectAccessor{obj}.GetAPIVersion(), nil
+}
+
+func (resourceAccessor) SetAPIVersion(obj runtime.Object, version string) error {
+	objectAccessor{obj}.SetAPIVersion(version)
+	return nil
+}
+
+func (resourceAccessor) Namespace(obj runtime.Object) (string, error) {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return "", err
+	}
+	return accessor.GetNamespace(), nil
+}
+
+func (resourceAccessor) SetNamespace(obj runtime.Object, namespace string) error {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetNamespace(namespace)
+	return nil
+}
+
+func (resourceAccessor) Name(obj runtime.Object) (string, error) {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return "", err
+	}
+	return accessor.GetName(), nil
+}
+
+func (resourceAccessor) SetName(obj runtime.Object, name string) error {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetName(name)
+	return nil
+}
+
+func (resourceAccessor) GenerateName(obj runtime.Object) (string, error) {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return "", err
+	}
+	return accessor.GetGenerateName(), nil
+}
+
+func (resourceAccessor) SetGenerateName(obj runtime.Object, name string) error {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetGenerateName(name)
+	return nil
+}
+
+func (resourceAccessor) UID(obj runtime.Object) (types.UID, error) {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return "", err
+	}
+	return accessor.GetUID(), nil
+}
+
+func (resourceAccessor) SetUID(obj runtime.Object, uid types.UID) error {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetUID(uid)
+	return nil
+}
+
+func (resourceAccessor) SelfLink(obj runtime.Object) (string, error) {
+	accessor, err := CommonAccessor(obj)
+	if err != nil {
+		return "", err
+	}
+	return accessor.GetSelfLink(), nil
+}
+
+func (resourceAccessor) SetSelfLink(obj runtime.Object, selfLink string) error {
+	accessor, err := CommonAccessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetSelfLink(selfLink)
+	return nil
+}
+
+func (resourceAccessor) Labels(obj runtime.Object) (map[string]string, error) {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return nil, err
+	}
+	return accessor.GetLabels(), nil
+}
+
+func (resourceAccessor) SetLabels(obj runtime.Object, labels map[string]string) error {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetLabels(labels)
+	return nil
+}
+
+func (resourceAccessor) Annotations(obj runtime.Object) (map[string]string, error) {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return nil, err
+	}
+	return accessor.GetAnnotations(), nil
+}
+
+func (resourceAccessor) SetAnnotations(obj runtime.Object, annotations map[string]string) error {
+	accessor, err := Accessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetAnnotations(annotations)
+	return nil
+}
+
+func (resourceAccessor) ResourceVersion(obj runtime.Object) (string, error) {
+	accessor, err := CommonAccessor(obj)
+	if err != nil {
+		return "", err
+	}
+	return accessor.GetResourceVersion(), nil
+}
+
+func (resourceAccessor) SetResourceVersion(obj runtime.Object, version string) error {
+	accessor, err := CommonAccessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetResourceVersion(version)
+	return nil
+}
+
+func (resourceAccessor) Continue(obj runtime.Object) (string, error) {
+	accessor, err := ListAccessor(obj)
+	if err != nil {
+		return "", err
+	}
+	return accessor.GetContinue(), nil
+}
+
+func (resourceAccessor) SetContinue(obj runtime.Object, version string) error {
+	accessor, err := ListAccessor(obj)
+	if err != nil {
+		return err
+	}
+	accessor.SetContinue(version)
+	return nil
+}
+
+// extractFromOwnerReference extracts v to o. v is the OwnerReferences field of an object.
+func extractFromOwnerReference(v reflect.Value, o *metav1.OwnerReference) error {
+	if err := runtime.Field(v, "APIVersion", &o.APIVersion); err != nil {
+		return err
+	}
+	if err := runtime.Field(v, "Kind", &o.Kind); err != nil {
+		return err
+	}
+	if err := runtime.Field(v, "Name", &o.Name); err != nil {
+		return err
+	}
+	if err := runtime.Field(v, "UID", &o.UID); err != nil {
+		return err
+	}
+	var controllerPtr *bool
+	if err := runtime.Field(v, "Controller", &controllerPtr); err != nil {
+		return err
+	}
+	if controllerPtr != nil {
+		controller := *controllerPtr
+		o.Controller = &controller
+	}
+	var blockOwnerDeletionPtr *bool
+	if err := runtime.Field(v, "BlockOwnerDeletion", &blockOwnerDeletionPtr); err != nil {
+		return err
+	}
+	if blockOwnerDeletionPtr != nil {
+		block := *blockOwnerDeletionPtr
+		o.BlockOwnerDeletion = &block
+	}
+	return nil
+}
+
+// setOwnerReference sets v to o. v is the OwnerReferences field of an object.
+func setOwnerReference(v reflect.Value, o *metav1.OwnerReference) error {
+	if err := runtime.SetField(o.APIVersion, v, "APIVersion"); err != nil {
+		return err
+	}
+	if err := runtime.SetField(o.Kind, v, "Kind"); err != nil {
+		return err
+	}
+	if err := runtime.SetField(o.Name, v, "Name"); err != nil {
+		return err
+	}
+	if err := runtime.SetField(o.UID, v, "UID"); err != nil {
+		return err
+	}
+	if o.Controller != nil {
+		controller := *(o.Controller)
+		if err := runtime.SetField(&controller, v, "Controller"); err != nil {
+			return err
+		}
+	}
+	if o.BlockOwnerDeletion != nil {
+		block := *(o.BlockOwnerDeletion)
+		if err := runtime.SetField(&block, v, "BlockOwnerDeletion"); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// genericAccessor contains pointers to strings that can modify an arbitrary
+// struct and implements the Accessor interface.
+type genericAccessor struct {
+	namespace         *string
+	name              *string
+	generateName      *string
+	uid               *types.UID
+	apiVersion        *string
+	kind              *string
+	resourceVersion   *string
+	selfLink          *string
+	creationTimestamp *metav1.Time
+	deletionTimestamp **metav1.Time
+	labels            *map[string]string
+	annotations       *map[string]string
+	ownerReferences   reflect.Value
+	finalizers        *[]string
+}
+
+func (a genericAccessor) GetNamespace() string {
+	if a.namespace == nil {
+		return ""
+	}
+	return *a.namespace
+}
+
+func (a genericAccessor) SetNamespace(namespace string) {
+	if a.namespace == nil {
+		return
+	}
+	*a.namespace = namespace
+}
+
+func (a genericAccessor) GetName() string {
+	if a.name == nil {
+		return ""
+	}
+	return *a.name
+}
+
+func (a genericAccessor) SetName(name string) {
+	if a.name == nil {
+		return
+	}
+	*a.name = name
+}
+
+func (a genericAccessor) GetGenerateName() string {
+	if a.generateName == nil {
+		return ""
+	}
+	return *a.generateName
+}
+
+func (a genericAccessor) SetGenerateName(generateName string) {
+	if a.generateName == nil {
+		return
+	}
+	*a.generateName = generateName
+}
+
+func (a genericAccessor) GetUID() types.UID {
+	if a.uid == nil {
+		return ""
+	}
+	return *a.uid
+}
+
+func (a genericAccessor) SetUID(uid types.UID) {
+	if a.uid == nil {
+		return
+	}
+	*a.uid = uid
+}
+
+func (a genericAccessor) GetAPIVersion() string {
+	return *a.apiVersion
+}
+
+func (a genericAccessor) SetAPIVersion(version string) {
+	*a.apiVersion = version
+}
+
+func (a genericAccessor) GetKind() string {
+	return *a.kind
+}
+
+func (a genericAccessor) SetKind(kind string) {
+	*a.kind = kind
+}
+
+func (a genericAccessor) GetResourceVersion() string {
+	return *a.resourceVersion
+}
+
+func (a genericAccessor) SetResourceVersion(version string) {
+	*a.resourceVersion = version
+}
+
+func (a genericAccessor) GetSelfLink() string {
+	return *a.selfLink
+}
+
+func (a genericAccessor) SetSelfLink(selfLink string) {
+	*a.selfLink = selfLink
+}
+
+func (a genericAccessor) GetCreationTimestamp() metav1.Time {
+	return *a.creationTimestamp
+}
+
+func (a genericAccessor) SetCreationTimestamp(timestamp metav1.Time) {
+	*a.creationTimestamp = timestamp
+}
+
+func (a genericAccessor) GetDeletionTimestamp() *metav1.Time {
+	return *a.deletionTimestamp
+}
+
+func (a genericAccessor) SetDeletionTimestamp(timestamp *metav1.Time) {
+	*a.deletionTimestamp = timestamp
+}
+
+func (a genericAccessor) GetLabels() map[string]string {
+	if a.labels == nil {
+		return nil
+	}
+	return *a.labels
+}
+
+func (a genericAccessor) SetLabels(labels map[string]string) {
+	*a.labels = labels
+}
+
+func (a genericAccessor) GetAnnotations() map[string]string {
+	if a.annotations == nil {
+		return nil
+	}
+	return *a.annotations
+}
+
+func (a genericAccessor) SetAnnotations(annotations map[string]string) {
+	if a.annotations == nil {
+		emptyAnnotations := make(map[string]string)
+		a.annotations = &emptyAnnotations
+	}
+	*a.annotations = annotations
+}
+
+func (a genericAccessor) GetFinalizers() []string {
+	if a.finalizers == nil {
+		return nil
+	}
+	return *a.finalizers
+}
+
+func (a genericAccessor) SetFinalizers(finalizers []string) {
+	*a.finalizers = finalizers
+}
+
+func (a genericAccessor) GetOwnerReferences() []metav1.OwnerReference {
+	var ret []metav1.OwnerReference
+	s := a.ownerReferences
+	if s.Kind() != reflect.Pointer || s.Elem().Kind() != reflect.Slice {
+		//nolint:logcheck // Should not happen.
+		klog.Errorf("expect %v to be a pointer to slice", s)
+		return ret
+	}
+	s = s.Elem()
+	// Set the capacity to one element greater to avoid copy if the caller later append an element.
+	ret = make([]metav1.OwnerReference, s.Len(), s.Len()+1)
+	for i := 0; i < s.Len(); i++ {
+		if err := extractFromOwnerReference(s.Index(i), &ret[i]); err != nil {
+			//nolint:logcheck // Should not happen.
+			klog.Errorf("extractFromOwnerReference failed: %v", err)
+			return ret
+		}
+	}
+	return ret
+}
+
+func (a genericAccessor) SetOwnerReferences(references []metav1.OwnerReference) {
+	s := a.ownerReferences
+	if s.Kind() != reflect.Pointer || s.Elem().Kind() != reflect.Slice {
+		//nolint:logcheck // Should not happen.
+		klog.Errorf("expect %v to be a pointer to slice", s)
+	}
+	s = s.Elem()
+	newReferences := reflect.MakeSlice(s.Type(), len(references), len(references))
+	for i := 0; i < len(references); i++ {
+		if err := setOwnerReference(newReferences.Index(i), &references[i]); err != nil {
+			//nolint:logcheck // Should not happen.
+			klog.Errorf("setOwnerReference failed: %v", err)
+			return
+		}
+	}
+	s.Set(newReferences)
+}
+
+// extractFromTypeMeta extracts pointers to version and kind fields from an object
+func extractFromTypeMeta(v reflect.Value, a *genericAccessor) error {
+	if err := runtime.FieldPtr(v, "APIVersion", &a.apiVersion); err != nil {
+		return err
+	}
+	if err := runtime.FieldPtr(v, "Kind", &a.kind); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/meta_test.go b/third_party/k8s.io/apimachinery/pkg/api/meta/meta_test.go
new file mode 100644
index 0000000000..31402441a9
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/meta_test.go
@@ -0,0 +1,51 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"math/rand"
+	"reflect"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	metav1beta1 "k8s.io/apimachinery/pkg/apis/meta/v1beta1"
+
+	"github.com/google/go-cmp/cmp"
+	"sigs.k8s.io/randfill"
+)
+
+func TestAsPartialObjectMetadata(t *testing.T) {
+	f := randfill.New().NilChance(.5).NumElements(0, 1).RandSource(rand.NewSource(1))
+
+	for i := 0; i < 100; i++ {
+		m := &metav1.ObjectMeta{}
+		f.Fill(m)
+		partial := AsPartialObjectMetadata(m)
+		if !reflect.DeepEqual(&partial.ObjectMeta, m) {
+			t.Fatalf("incomplete partial object metadata: %s", cmp.Diff(&partial.ObjectMeta, m))
+		}
+	}
+
+	for i := 0; i < 100; i++ {
+		m := &metav1beta1.PartialObjectMetadata{}
+		f.Fill(&m.ObjectMeta)
+		partial := AsPartialObjectMetadata(m)
+		if !reflect.DeepEqual(&partial.ObjectMeta, &m.ObjectMeta) {
+			t.Fatalf("incomplete partial object metadata: %s", cmp.Diff(&partial.ObjectMeta, &m.ObjectMeta))
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/multirestmapper.go b/third_party/k8s.io/apimachinery/pkg/api/meta/multirestmapper.go
new file mode 100644
index 0000000000..2b2c143ce7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/multirestmapper.go
@@ -0,0 +1,318 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+)
+
+var (
+	_ ResettableRESTMapper            = MultiRESTMapper{}
+	_ fmt.Stringer                    = MultiRESTMapper{}
+	_ ResettableRESTMapperWithContext = MultiRESTMapperWithContext{}
+	_ fmt.Stringer                    = MultiRESTMapperWithContext{}
+)
+
+// MultiRESTMapper is a wrapper for multiple RESTMappers.
+//
+// MultiRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext instead.
+type MultiRESTMapper []RESTMapper
+
+// MultiRESTMapperWithContext is a wrapper for multiple RESTMapperWithContext instances.
+type MultiRESTMapperWithContext []RESTMapperWithContext
+
+func (m MultiRESTMapper) String() string {
+	return stringifyMapper("MultiRESTMapper", m)
+}
+
+func (m MultiRESTMapperWithContext) String() string {
+	return stringifyMapper("MultiRESTMapperWithContext", m)
+}
+
+func stringifyMapper[T any](typeName string, m []T) string {
+	nested := make([]string, 0, len(m))
+	for _, t := range m {
+		currString := fmt.Sprintf("%v", t)
+		splitStrings := strings.Split(currString, "\n")
+		nested = append(nested, strings.Join(splitStrings, "\n\t"))
+	}
+
+	return fmt.Sprintf("%s{\n\t%s\n}", typeName, strings.Join(nested, "\n\t"))
+}
+
+func ToMultiRESTMapperWithContext(m MultiRESTMapper) MultiRESTMapperWithContext {
+	if m == nil {
+		return nil
+	}
+	mc := make(MultiRESTMapperWithContext, len(m))
+	for i, m := range m {
+		mc[i] = ToRESTMapperWithContext(m)
+	}
+	return mc
+}
+
+// ResourceSingularizer converts a REST resource name from plural to singular (e.g., from pods to pod)
+// This implementation supports multiple REST schemas and return the first match.
+//
+// MultiRESTMapperWithContext.ResourceSingularizerWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.ResourceSingularizerWithContext instead.
+func (m MultiRESTMapper) ResourceSingularizer(resource string) (singular string, err error) {
+	return ToMultiRESTMapperWithContext(m).ResourceSingularizerWithContext(context.Background(), resource)
+}
+
+// MultiRESTMapperWithContext.ResourcesForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.ResourcesForWithContext instead.
+func (m MultiRESTMapper) ResourcesFor(resource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return ToMultiRESTMapperWithContext(m).ResourcesForWithContext(context.Background(), resource)
+}
+
+// MultiRESTMapperWithContext.KindsForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.KindsForWithContext instead.
+func (m MultiRESTMapper) KindsFor(resource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
+	return ToMultiRESTMapperWithContext(m).KindsForWithContext(context.Background(), resource)
+}
+
+// MultiRESTMapperWithContext.ResourceForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.ResourceForWithContext instead.
+func (m MultiRESTMapper) ResourceFor(resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	return ToMultiRESTMapperWithContext(m).ResourceForWithContext(context.Background(), resource)
+}
+
+// MultiRESTMapperWithContext.KindForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.KindForWithContext instead.
+func (m MultiRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return ToMultiRESTMapperWithContext(m).KindForWithContext(context.Background(), resource)
+}
+
+// RESTMapping provides the REST mapping for the resource based on the
+// kind and version. This implementation supports multiple REST schemas and
+// return the first match.
+//
+// MultiRESTMapperWithContext.RESTMappingWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.RESTMappingWithContext instead.
+func (m MultiRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	return ToMultiRESTMapperWithContext(m).RESTMappingWithContext(context.Background(), gk, versions...)
+}
+
+// RESTMappings returns all possible RESTMappings for the provided group kind, or an error
+// if the type is not recognized.
+//
+// MultiRESTMapperWithContext.RESTMappingsWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.RESTMappingsWithContext instead.
+func (m MultiRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	return ToMultiRESTMapperWithContext(m).RESTMappingsWithContext(context.Background(), gk, versions...)
+}
+
+// MultiRESTMapperWithContext.Reset is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.Reset instead.
+func (m MultiRESTMapper) Reset() {
+	for _, t := range m {
+		MaybeResetRESTMapper(t)
+	}
+}
+
+// ResourceSingularizer converts a REST resource name from plural to singular (e.g., from pods to pod)
+// This implementation supports multiple REST schemas and return the first match.
+func (m MultiRESTMapperWithContext) ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error) {
+	for _, t := range m {
+		singular, err = t.ResourceSingularizerWithContext(ctx, resource)
+		if err == nil {
+			return
+		}
+	}
+	return
+}
+
+func (m MultiRESTMapperWithContext) ResourcesForWithContext(ctx context.Context, resource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	allGVRs := []schema.GroupVersionResource{}
+	for _, t := range m {
+		gvrs, err := t.ResourcesForWithContext(ctx, resource)
+		// ignore "no match" errors, but any other error percolates back up
+		if IsNoMatchError(err) {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+
+		// walk the existing values to de-dup
+		for _, curr := range gvrs {
+			found := false
+			for _, existing := range allGVRs {
+				if curr == existing {
+					found = true
+					break
+				}
+			}
+
+			if !found {
+				allGVRs = append(allGVRs, curr)
+			}
+		}
+	}
+
+	if len(allGVRs) == 0 {
+		return nil, &NoResourceMatchError{PartialResource: resource}
+	}
+
+	return allGVRs, nil
+}
+
+func (m MultiRESTMapperWithContext) KindsForWithContext(ctx context.Context, resource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
+	allGVKs := []schema.GroupVersionKind{}
+	for _, t := range m {
+		gvks, err := t.KindsForWithContext(ctx, resource)
+		// ignore "no match" errors, but any other error percolates back up
+		if IsNoMatchError(err) {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+
+		// walk the existing values to de-dup
+		for _, curr := range gvks {
+			found := false
+			for _, existing := range allGVKs {
+				if curr == existing {
+					found = true
+					break
+				}
+			}
+
+			if !found {
+				allGVKs = append(allGVKs, curr)
+			}
+		}
+	}
+
+	if len(allGVKs) == 0 {
+		return nil, &NoResourceMatchError{PartialResource: resource}
+	}
+
+	return allGVKs, nil
+}
+
+func (m MultiRESTMapperWithContext) ResourceForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	resources, err := m.ResourcesForWithContext(ctx, resource)
+	if err != nil {
+		return schema.GroupVersionResource{}, err
+	}
+	if len(resources) == 1 {
+		return resources[0], nil
+	}
+
+	return schema.GroupVersionResource{}, &AmbiguousResourceError{PartialResource: resource, MatchingResources: resources}
+}
+
+func (m MultiRESTMapperWithContext) KindForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	kinds, err := m.KindsForWithContext(ctx, resource)
+	if err != nil {
+		return schema.GroupVersionKind{}, err
+	}
+	if len(kinds) == 1 {
+		return kinds[0], nil
+	}
+
+	return schema.GroupVersionKind{}, &AmbiguousResourceError{PartialResource: resource, MatchingKinds: kinds}
+}
+
+// RESTMapping provides the REST mapping for the resource based on the
+// kind and version. This implementation supports multiple REST schemas and
+// return the first match.
+func (m MultiRESTMapperWithContext) RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	allMappings := []*RESTMapping{}
+	errors := []error{}
+
+	for _, t := range m {
+		currMapping, err := t.RESTMappingWithContext(ctx, gk, versions...)
+		// ignore "no match" errors, but any other error percolates back up
+		if IsNoMatchError(err) {
+			continue
+		}
+		if err != nil {
+			errors = append(errors, err)
+			continue
+		}
+
+		allMappings = append(allMappings, currMapping)
+	}
+
+	// if we got exactly one mapping, then use it even if other requested failed
+	if len(allMappings) == 1 {
+		return allMappings[0], nil
+	}
+	if len(allMappings) > 1 {
+		var kinds []schema.GroupVersionKind
+		for _, m := range allMappings {
+			kinds = append(kinds, m.GroupVersionKind)
+		}
+		return nil, &AmbiguousKindError{PartialKind: gk.WithVersion(""), MatchingKinds: kinds}
+	}
+	if len(errors) > 0 {
+		return nil, utilerrors.NewAggregate(errors)
+	}
+	return nil, &NoKindMatchError{GroupKind: gk, SearchedVersions: versions}
+}
+
+// RESTMappings returns all possible RESTMappings for the provided group kind, or an error
+// if the type is not recognized.
+func (m MultiRESTMapperWithContext) RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	var allMappings []*RESTMapping
+	var errors []error
+
+	for _, t := range m {
+		currMappings, err := t.RESTMappingsWithContext(ctx, gk, versions...)
+		// ignore "no match" errors, but any other error percolates back up
+		if IsNoMatchError(err) {
+			continue
+		}
+		if err != nil {
+			errors = append(errors, err)
+			continue
+		}
+		allMappings = append(allMappings, currMappings...)
+	}
+	if len(errors) > 0 {
+		return nil, utilerrors.NewAggregate(errors)
+	}
+	if len(allMappings) == 0 {
+		return nil, &NoKindMatchError{GroupKind: gk, SearchedVersions: versions}
+	}
+	return allMappings, nil
+}
+
+func (m MultiRESTMapperWithContext) ResetWithContext(ctx context.Context) {
+	for _, t := range m {
+		MaybeResetRESTMapperWithContext(ctx, t)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/multirestmapper_test.go b/third_party/k8s.io/apimachinery/pkg/api/meta/multirestmapper_test.go
new file mode 100644
index 0000000000..b71ca468d3
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/multirestmapper_test.go
@@ -0,0 +1,391 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"errors"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestMultiRESTMapperResourceFor(t *testing.T) {
+	tcs := []struct {
+		name string
+
+		mapper MultiRESTMapper
+		input  schema.GroupVersionResource
+		result schema.GroupVersionResource
+		err    error
+	}{
+		{
+			name:   "empty",
+			mapper: MultiRESTMapper{},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: schema.GroupVersionResource{},
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "ignore not found",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "IGNORE_THIS"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: schema.GroupVersionResource{},
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "accept first failure",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: errors.New("fail on this")}, fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{{Resource: "unused"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: schema.GroupVersionResource{},
+			err:    errors.New("fail on this"),
+		},
+	}
+
+	for _, tc := range tcs {
+		actualResult, actualErr := tc.mapper.ResourceFor(tc.input)
+		if e, a := tc.result, actualResult; e != a {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		switch {
+		case tc.err == nil && actualErr == nil:
+		case tc.err == nil:
+			t.Errorf("%s: unexpected error: %v", tc.name, actualErr)
+		case actualErr == nil:
+			t.Errorf("%s: expected error: %v got nil", tc.name, tc.err)
+		case tc.err.Error() != actualErr.Error():
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+func TestMultiRESTMapperResourcesFor(t *testing.T) {
+	tcs := []struct {
+		name string
+
+		mapper MultiRESTMapper
+		input  schema.GroupVersionResource
+		result []schema.GroupVersionResource
+		err    error
+	}{
+		{
+			name:   "empty",
+			mapper: MultiRESTMapper{},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: nil,
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "ignore not found",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "IGNORE_THIS"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: nil,
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "accept first failure",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: errors.New("fail on this")}, fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{{Resource: "unused"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: nil,
+			err:    errors.New("fail on this"),
+		},
+		{
+			name: "union and dedup",
+			mapper: MultiRESTMapper{
+				fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{{Resource: "dupe"}, {Resource: "first"}}},
+				fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{{Resource: "dupe"}, {Resource: "second"}}},
+			},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: []schema.GroupVersionResource{{Resource: "dupe"}, {Resource: "first"}, {Resource: "second"}},
+		},
+		{
+			name: "skip not and continue",
+			mapper: MultiRESTMapper{
+				fixedRESTMapper{err: &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "IGNORE_THIS"}}},
+				fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{{Resource: "first"}, {Resource: "second"}}},
+			},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: []schema.GroupVersionResource{{Resource: "first"}, {Resource: "second"}},
+		},
+	}
+
+	for _, tc := range tcs {
+		actualResult, actualErr := tc.mapper.ResourcesFor(tc.input)
+		if e, a := tc.result, actualResult; !reflect.DeepEqual(e, a) {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		switch {
+		case tc.err == nil && actualErr == nil:
+		case tc.err == nil:
+			t.Errorf("%s: unexpected error: %v", tc.name, actualErr)
+		case actualErr == nil:
+			t.Errorf("%s: expected error: %v got nil", tc.name, tc.err)
+		case tc.err.Error() != actualErr.Error():
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+func TestMultiRESTMapperKindsFor(t *testing.T) {
+	tcs := []struct {
+		name string
+
+		mapper MultiRESTMapper
+		input  schema.GroupVersionResource
+		result []schema.GroupVersionKind
+		err    error
+	}{
+		{
+			name:   "empty",
+			mapper: MultiRESTMapper{},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: nil,
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "ignore not found",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "IGNORE_THIS"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: nil,
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "accept first failure",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: errors.New("fail on this")}, fixedRESTMapper{kindsFor: []schema.GroupVersionKind{{Kind: "unused"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: nil,
+			err:    errors.New("fail on this"),
+		},
+		{
+			name: "union and dedup",
+			mapper: MultiRESTMapper{
+				fixedRESTMapper{kindsFor: []schema.GroupVersionKind{{Kind: "dupe"}, {Kind: "first"}}},
+				fixedRESTMapper{kindsFor: []schema.GroupVersionKind{{Kind: "dupe"}, {Kind: "second"}}},
+			},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: []schema.GroupVersionKind{{Kind: "dupe"}, {Kind: "first"}, {Kind: "second"}},
+		},
+		{
+			name: "skip not and continue",
+			mapper: MultiRESTMapper{
+				fixedRESTMapper{err: &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "IGNORE_THIS"}}},
+				fixedRESTMapper{kindsFor: []schema.GroupVersionKind{{Kind: "first"}, {Kind: "second"}}},
+			},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: []schema.GroupVersionKind{{Kind: "first"}, {Kind: "second"}},
+		},
+	}
+
+	for _, tc := range tcs {
+		actualResult, actualErr := tc.mapper.KindsFor(tc.input)
+		if e, a := tc.result, actualResult; !reflect.DeepEqual(e, a) {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		switch {
+		case tc.err == nil && actualErr == nil:
+		case tc.err == nil:
+			t.Errorf("%s: unexpected error: %v", tc.name, actualErr)
+		case actualErr == nil:
+			t.Errorf("%s: expected error: %v got nil", tc.name, tc.err)
+		case tc.err.Error() != actualErr.Error():
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+func TestMultiRESTMapperKindFor(t *testing.T) {
+	tcs := []struct {
+		name string
+
+		mapper MultiRESTMapper
+		input  schema.GroupVersionResource
+		result schema.GroupVersionKind
+		err    error
+	}{
+		{
+			name:   "empty",
+			mapper: MultiRESTMapper{},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: schema.GroupVersionKind{},
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "ignore not found",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "IGNORE_THIS"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: schema.GroupVersionKind{},
+			err:    &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Resource: "foo"}},
+		},
+		{
+			name:   "accept first failure",
+			mapper: MultiRESTMapper{fixedRESTMapper{err: errors.New("fail on this")}, fixedRESTMapper{kindsFor: []schema.GroupVersionKind{{Kind: "unused"}}}},
+			input:  schema.GroupVersionResource{Resource: "foo"},
+			result: schema.GroupVersionKind{},
+			err:    errors.New("fail on this"),
+		},
+	}
+
+	for _, tc := range tcs {
+		actualResult, actualErr := tc.mapper.KindFor(tc.input)
+		if e, a := tc.result, actualResult; e != a {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		switch {
+		case tc.err == nil && actualErr == nil:
+		case tc.err == nil:
+			t.Errorf("%s: unexpected error: %v", tc.name, actualErr)
+		case actualErr == nil:
+			t.Errorf("%s: expected error: %v got nil", tc.name, tc.err)
+		case tc.err.Error() != actualErr.Error():
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+func TestMultiRESTMapperRESTMappings(t *testing.T) {
+	mapping1, mapping2 := &RESTMapping{}, &RESTMapping{}
+	tcs := []struct {
+		name string
+
+		mapper    MultiRESTMapper
+		groupKind schema.GroupKind
+		versions  []string
+		result    []*RESTMapping
+		err       error
+	}{
+		{
+			name:      "empty with no versions",
+			mapper:    MultiRESTMapper{},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			result:    nil,
+			err:       &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}},
+		},
+		{
+			name:      "empty with one version",
+			mapper:    MultiRESTMapper{},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			versions:  []string{"v1beta"},
+			result:    nil,
+			err:       &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}, SearchedVersions: []string{"v1beta"}},
+		},
+		{
+			name:      "empty with multi(two) vesions",
+			mapper:    MultiRESTMapper{},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			versions:  []string{"v1beta", "v2"},
+			result:    nil,
+			err:       &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}, SearchedVersions: []string{"v1beta", "v2"}},
+		},
+		{
+			name:      "ignore not found with kind not exist",
+			mapper:    MultiRESTMapper{fixedRESTMapper{err: &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "IGNORE_THIS"}}}},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			versions:  nil,
+			result:    nil,
+			err:       &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}},
+		},
+		{
+			name:      "ignore not found with version not exist",
+			mapper:    MultiRESTMapper{fixedRESTMapper{err: &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}, SearchedVersions: []string{"v1"}}}},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			versions:  []string{"v1beta"},
+			result:    nil,
+			err:       &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}, SearchedVersions: []string{"v1beta"}},
+		},
+		{
+			name:      "ignore not found with multi versions not exist",
+			mapper:    MultiRESTMapper{fixedRESTMapper{err: &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}, SearchedVersions: []string{"v1"}}}},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			versions:  []string{"v1beta", "v2"},
+			result:    nil,
+			err:       &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}, SearchedVersions: []string{"v1beta", "v2"}},
+		},
+		{
+			name:      "accept first failure",
+			mapper:    MultiRESTMapper{fixedRESTMapper{err: errors.New("fail on this")}, fixedRESTMapper{mappings: []*RESTMapping{mapping1}}},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			versions:  []string{"v1beta"},
+			result:    nil,
+			err:       errors.New("fail on this"),
+		},
+		{
+			name:      "return both",
+			mapper:    MultiRESTMapper{fixedRESTMapper{mappings: []*RESTMapping{mapping1}}, fixedRESTMapper{mappings: []*RESTMapping{mapping2}}},
+			groupKind: schema.GroupKind{Kind: "Foo"},
+			versions:  []string{"v1beta"},
+			result:    []*RESTMapping{mapping1, mapping2},
+		},
+	}
+
+	for _, tc := range tcs {
+		actualResult, actualErr := tc.mapper.RESTMappings(tc.groupKind, tc.versions...)
+		if e, a := tc.result, actualResult; !reflect.DeepEqual(e, a) {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		switch {
+		case tc.err == nil && actualErr == nil:
+		case tc.err == nil:
+			t.Errorf("%s: unexpected error: %v", tc.name, actualErr)
+		case actualErr == nil:
+			t.Errorf("%s: expected error: %v got nil", tc.name, tc.err)
+		case tc.err.Error() != actualErr.Error():
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+type fixedRESTMapper struct {
+	resourcesFor []schema.GroupVersionResource
+	kindsFor     []schema.GroupVersionKind
+	resourceFor  schema.GroupVersionResource
+	kindFor      schema.GroupVersionKind
+	mappings     []*RESTMapping
+
+	err error
+}
+
+func (m fixedRESTMapper) ResourceSingularizer(resource string) (singular string, err error) {
+	return "", m.err
+}
+
+func (m fixedRESTMapper) ResourcesFor(resource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return m.resourcesFor, m.err
+}
+
+func (m fixedRESTMapper) KindsFor(resource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
+	return m.kindsFor, m.err
+}
+
+func (m fixedRESTMapper) ResourceFor(resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	return m.resourceFor, m.err
+}
+
+func (m fixedRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return m.kindFor, m.err
+}
+
+func (m fixedRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (mapping *RESTMapping, err error) {
+	return nil, m.err
+}
+
+func (m fixedRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) (mappings []*RESTMapping, err error) {
+	return m.mappings, m.err
+}
+
+func (m fixedRESTMapper) ResourceIsValid(resource schema.GroupVersionResource) bool {
+	return false
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/priority.go b/third_party/k8s.io/apimachinery/pkg/api/meta/priority.go
new file mode 100644
index 0000000000..d152e7e322
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/priority.go
@@ -0,0 +1,328 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"context"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+const (
+	AnyGroup    = "*"
+	AnyVersion  = "*"
+	AnyResource = "*"
+	AnyKind     = "*"
+)
+
+var (
+	_ ResettableRESTMapper            = PriorityRESTMapper{}
+	_ ResettableRESTMapperWithContext = PriorityRESTMapperWithContext{}
+	_ fmt.Stringer                    = PriorityRESTMapperWithContext{}
+)
+
+// PriorityRESTMapper is a wrapper for automatically choosing a particular Resource or Kind
+// when multiple matches are possible
+//
+// PriorityRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext instead.
+type PriorityRESTMapper struct {
+	// Delegate is the RESTMapper to use to locate all the Kind and Resource matches
+	Delegate RESTMapper
+
+	// ResourcePriority is a list of priority patterns to apply to matching resources.
+	// The list of all matching resources is narrowed based on the patterns until only one remains.
+	// A pattern with no matches is skipped.  A pattern with more than one match uses its
+	// matches as the list to continue matching against.
+	ResourcePriority []schema.GroupVersionResource
+
+	// KindPriority is a list of priority patterns to apply to matching kinds.
+	// The list of all matching kinds is narrowed based on the patterns until only one remains.
+	// A pattern with no matches is skipped.  A pattern with more than one match uses its
+	// matches as the list to continue matching against.
+	KindPriority []schema.GroupVersionKind
+}
+
+func (m PriorityRESTMapper) String() string {
+	return fmt.Sprintf("PriorityRESTMapper{\n\t%v\n\t%v\n\t%v\n}", m.ResourcePriority, m.KindPriority, m.Delegate)
+}
+
+// PriorityRESTMapperWithContext is a wrapper for automatically choosing a particular Resource or Kind
+// when multiple matches are possible
+type PriorityRESTMapperWithContext struct {
+	// Delegate is the RESTMapperWithContext to use to locate all the Kind and Resource matches
+	Delegate RESTMapperWithContext
+
+	// ResourcePriority is a list of priority patterns to apply to matching resources.
+	// The list of all matching resources is narrowed based on the patterns until only one remains.
+	// A pattern with no matches is skipped.  A pattern with more than one match uses its
+	// matches as the list to continue matching against.
+	ResourcePriority []schema.GroupVersionResource
+
+	// KindPriority is a list of priority patterns to apply to matching kinds.
+	// The list of all matching kinds is narrowed based on the patterns until only one remains.
+	// A pattern with no matches is skipped.  A pattern with more than one match uses its
+	// matches as the list to continue matching against.
+	KindPriority []schema.GroupVersionKind
+}
+
+func (m PriorityRESTMapperWithContext) String() string {
+	return fmt.Sprintf("PriorityRESTMapperWithContext{\n\t%v\n\t%v\n\t%v\n}", m.ResourcePriority, m.KindPriority, m.Delegate)
+}
+
+func ToPriorityRESTMapperWithContext(m PriorityRESTMapper) PriorityRESTMapperWithContext {
+	return PriorityRESTMapperWithContext{
+		Delegate:         ToRESTMapperWithContext(m.Delegate),
+		ResourcePriority: m.ResourcePriority,
+		KindPriority:     m.KindPriority,
+	}
+}
+
+// ResourceFor finds all resources, then passes them through the ResourcePriority patterns to find a single matching hit.
+//
+// PriorityRESTMapperWithContext.ResourceForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.ResourceForWithContext instead.
+func (m PriorityRESTMapper) ResourceFor(partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	return ToPriorityRESTMapperWithContext(m).ResourceForWithContext(context.Background(), partiallySpecifiedResource)
+}
+
+// KindFor finds all kinds, then passes them through the KindPriority patterns to find a single matching hit.
+//
+// PriorityRESTMapperWithContext.KindForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.KindForWithContext instead.
+func (m PriorityRESTMapper) KindFor(partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return ToPriorityRESTMapperWithContext(m).KindForWithContext(context.Background(), partiallySpecifiedResource)
+}
+
+// PriorityRESTMapperWithContext.RESTMappingWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.RESTMappingWithContext instead.
+func (m PriorityRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (mapping *RESTMapping, err error) {
+	return ToPriorityRESTMapperWithContext(m).RESTMappingWithContext(context.Background(), gk, versions...)
+}
+
+// PriorityRESTMapperWithContext.RESTMappingsWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.RESTMappingsWithContext instead.
+func (m PriorityRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	return m.Delegate.RESTMappings(gk, versions...)
+}
+
+// PriorityRESTMapperWithContext.ResourceSingularizerWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.ResourceSingularizerWithContext instead.
+func (m PriorityRESTMapper) ResourceSingularizer(resource string) (singular string, err error) {
+	return m.Delegate.ResourceSingularizer(resource)
+}
+
+// PriorityRESTMapperWithContext.ResourcesForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.ResourcesForWithContext instead.
+func (m PriorityRESTMapper) ResourcesFor(partiallySpecifiedResource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return m.Delegate.ResourcesFor(partiallySpecifiedResource)
+}
+
+// PriorityRESTMapperWithContext.KindsForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.KindsForWithContext instead.
+func (m PriorityRESTMapper) KindsFor(partiallySpecifiedResource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
+	return m.Delegate.KindsFor(partiallySpecifiedResource)
+}
+
+// PriorityRESTMapperWithContext.ResetWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.ResetWithContext instead.
+func (m PriorityRESTMapper) Reset() {
+	MaybeResetRESTMapper(m.Delegate)
+}
+
+// ResourceFor finds all resources, then passes them through the ResourcePriority patterns to find a single matching hit.
+func (m PriorityRESTMapperWithContext) ResourceForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	originalGVRs, originalErr := m.Delegate.ResourcesForWithContext(ctx, partiallySpecifiedResource)
+	if originalErr != nil && len(originalGVRs) == 0 {
+		return schema.GroupVersionResource{}, originalErr
+	}
+	if len(originalGVRs) == 1 {
+		return originalGVRs[0], originalErr
+	}
+
+	remainingGVRs := append([]schema.GroupVersionResource{}, originalGVRs...)
+	for _, pattern := range m.ResourcePriority {
+		matchedGVRs := []schema.GroupVersionResource{}
+		for _, gvr := range remainingGVRs {
+			if resourceMatches(pattern, gvr) {
+				matchedGVRs = append(matchedGVRs, gvr)
+			}
+		}
+
+		switch len(matchedGVRs) {
+		case 0:
+			// if you have no matches, then nothing matched this pattern just move to the next
+			continue
+		case 1:
+			// one match, return
+			return matchedGVRs[0], originalErr
+		default:
+			// more than one match, use the matched hits as the list moving to the next pattern.
+			// this way you can have a series of selection criteria
+			remainingGVRs = matchedGVRs
+		}
+	}
+
+	return schema.GroupVersionResource{}, &AmbiguousResourceError{PartialResource: partiallySpecifiedResource, MatchingResources: originalGVRs}
+}
+
+// KindFor finds all kinds, then passes them through the KindPriority patterns to find a single matching hit.
+func (m PriorityRESTMapperWithContext) KindForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	originalGVKs, originalErr := m.Delegate.KindsForWithContext(ctx, partiallySpecifiedResource)
+	if originalErr != nil && len(originalGVKs) == 0 {
+		return schema.GroupVersionKind{}, originalErr
+	}
+	if len(originalGVKs) == 1 {
+		return originalGVKs[0], originalErr
+	}
+
+	remainingGVKs := append([]schema.GroupVersionKind{}, originalGVKs...)
+	for _, pattern := range m.KindPriority {
+		matchedGVKs := []schema.GroupVersionKind{}
+		for _, gvr := range remainingGVKs {
+			if kindMatches(pattern, gvr) {
+				matchedGVKs = append(matchedGVKs, gvr)
+			}
+		}
+
+		switch len(matchedGVKs) {
+		case 0:
+			// if you have no matches, then nothing matched this pattern just move to the next
+			continue
+		case 1:
+			// one match, return
+			return matchedGVKs[0], originalErr
+		default:
+			// more than one match, use the matched hits as the list moving to the next pattern.
+			// this way you can have a series of selection criteria
+			remainingGVKs = matchedGVKs
+		}
+	}
+
+	return schema.GroupVersionKind{}, &AmbiguousResourceError{PartialResource: partiallySpecifiedResource, MatchingKinds: originalGVKs}
+}
+
+func resourceMatches(pattern schema.GroupVersionResource, resource schema.GroupVersionResource) bool {
+	if pattern.Group != AnyGroup && pattern.Group != resource.Group {
+		return false
+	}
+	if pattern.Version != AnyVersion && pattern.Version != resource.Version {
+		return false
+	}
+	if pattern.Resource != AnyResource && pattern.Resource != resource.Resource {
+		return false
+	}
+
+	return true
+}
+
+func kindMatches(pattern schema.GroupVersionKind, kind schema.GroupVersionKind) bool {
+	if pattern.Group != AnyGroup && pattern.Group != kind.Group {
+		return false
+	}
+	if pattern.Version != AnyVersion && pattern.Version != kind.Version {
+		return false
+	}
+	if pattern.Kind != AnyKind && pattern.Kind != kind.Kind {
+		return false
+	}
+
+	return true
+}
+
+func (m PriorityRESTMapperWithContext) RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (mapping *RESTMapping, err error) {
+	mappings, originalErr := m.Delegate.RESTMappingsWithContext(ctx, gk, versions...)
+	if originalErr != nil && len(mappings) == 0 {
+		return nil, originalErr
+	}
+
+	// any versions the user provides take priority
+	priorities := m.KindPriority
+	if len(versions) > 0 {
+		priorities = make([]schema.GroupVersionKind, 0, len(m.KindPriority)+len(versions))
+		for _, version := range versions {
+			gv := schema.GroupVersion{
+				Version: version,
+				Group:   gk.Group,
+			}
+			priorities = append(priorities, gv.WithKind(AnyKind))
+		}
+		priorities = append(priorities, m.KindPriority...)
+	}
+
+	remaining := append([]*RESTMapping{}, mappings...)
+	for _, pattern := range priorities {
+		var matching []*RESTMapping
+		for _, m := range remaining {
+			if kindMatches(pattern, m.GroupVersionKind) {
+				matching = append(matching, m)
+			}
+		}
+
+		switch len(matching) {
+		case 0:
+			// if you have no matches, then nothing matched this pattern just move to the next
+			continue
+		case 1:
+			// one match, return
+			return matching[0], originalErr
+		default:
+			// more than one match, use the matched hits as the list moving to the next pattern.
+			// this way you can have a series of selection criteria
+			remaining = matching
+		}
+	}
+	if len(remaining) == 1 {
+		return remaining[0], originalErr
+	}
+
+	var kinds []schema.GroupVersionKind
+	for _, m := range mappings {
+		kinds = append(kinds, m.GroupVersionKind)
+	}
+	return nil, &AmbiguousKindError{PartialKind: gk.WithVersion(""), MatchingKinds: kinds}
+}
+
+func (m PriorityRESTMapperWithContext) RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	return m.Delegate.RESTMappingsWithContext(ctx, gk, versions...)
+}
+
+func (m PriorityRESTMapperWithContext) ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error) {
+	return m.Delegate.ResourceSingularizerWithContext(ctx, resource)
+}
+
+func (m PriorityRESTMapperWithContext) ResourcesForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return m.Delegate.ResourcesForWithContext(ctx, partiallySpecifiedResource)
+}
+
+func (m PriorityRESTMapperWithContext) KindsForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
+	return m.Delegate.KindsForWithContext(ctx, partiallySpecifiedResource)
+}
+
+func (m PriorityRESTMapperWithContext) ResetWithContext(ctx context.Context) {
+	MaybeResetRESTMapperWithContext(ctx, m.Delegate)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/priority_test.go b/third_party/k8s.io/apimachinery/pkg/api/meta/priority_test.go
new file mode 100644
index 0000000000..fff1afd172
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/priority_test.go
@@ -0,0 +1,409 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"errors"
+	"reflect"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestPriorityRESTMapperResourceForErrorHandling(t *testing.T) {
+	tcs := []struct {
+		name string
+
+		delegate         RESTMapper
+		resourcePatterns []schema.GroupVersionResource
+		result           schema.GroupVersionResource
+		err              string
+	}{
+		{
+			name:     "error",
+			delegate: fixedRESTMapper{err: errors.New("delegateError")},
+			err:      "delegateError",
+		},
+		{
+			name:     "single hit + error",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{{Resource: "single-hit"}}, err: errors.New("delegateError")},
+			result:   schema.GroupVersionResource{Resource: "single-hit"},
+			err:      "delegateError",
+		},
+		{
+			name: "group selection + error",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{
+				{Group: "one", Version: "a", Resource: "first"},
+				{Group: "two", Version: "b", Resource: "second"},
+			}, err: errors.New("delegateError")},
+			resourcePatterns: []schema.GroupVersionResource{
+				{Group: "one", Version: AnyVersion, Resource: AnyResource},
+			},
+			result: schema.GroupVersionResource{Group: "one", Version: "a", Resource: "first"},
+			err:    "delegateError",
+		},
+
+		{
+			name:     "single hit",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{{Resource: "single-hit"}}},
+			result:   schema.GroupVersionResource{Resource: "single-hit"},
+		},
+		{
+			name: "ambiguous match",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{
+				{Group: "one", Version: "a", Resource: "first"},
+				{Group: "two", Version: "b", Resource: "second"},
+			}},
+			err: "matches multiple resources",
+		},
+		{
+			name: "group selection",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{
+				{Group: "one", Version: "a", Resource: "first"},
+				{Group: "two", Version: "b", Resource: "second"},
+			}},
+			resourcePatterns: []schema.GroupVersionResource{
+				{Group: "one", Version: AnyVersion, Resource: AnyResource},
+			},
+			result: schema.GroupVersionResource{Group: "one", Version: "a", Resource: "first"},
+		},
+		{
+			name: "empty match continues",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{
+				{Group: "one", Version: "a", Resource: "first"},
+				{Group: "two", Version: "b", Resource: "second"},
+			}},
+			resourcePatterns: []schema.GroupVersionResource{
+				{Group: "fail", Version: AnyVersion, Resource: AnyResource},
+				{Group: "one", Version: AnyVersion, Resource: AnyResource},
+			},
+			result: schema.GroupVersionResource{Group: "one", Version: "a", Resource: "first"},
+		},
+		{
+			name: "group followed by version selection",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{
+				{Group: "one", Version: "a", Resource: "first"},
+				{Group: "two", Version: "b", Resource: "second"},
+				{Group: "one", Version: "c", Resource: "third"},
+			}},
+			resourcePatterns: []schema.GroupVersionResource{
+				{Group: "one", Version: AnyVersion, Resource: AnyResource},
+				{Group: AnyGroup, Version: "a", Resource: AnyResource},
+			},
+			result: schema.GroupVersionResource{Group: "one", Version: "a", Resource: "first"},
+		},
+		{
+			name: "resource selection",
+			delegate: fixedRESTMapper{resourcesFor: []schema.GroupVersionResource{
+				{Group: "one", Version: "a", Resource: "first"},
+				{Group: "one", Version: "a", Resource: "second"},
+			}},
+			resourcePatterns: []schema.GroupVersionResource{
+				{Group: AnyGroup, Version: AnyVersion, Resource: "second"},
+			},
+			result: schema.GroupVersionResource{Group: "one", Version: "a", Resource: "second"},
+		},
+	}
+
+	for _, tc := range tcs {
+		mapper := PriorityRESTMapper{Delegate: tc.delegate, ResourcePriority: tc.resourcePatterns}
+
+		actualResult, actualErr := mapper.ResourceFor(schema.GroupVersionResource{})
+		if e, a := tc.result, actualResult; e != a {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		if len(tc.err) == 0 && actualErr == nil {
+			continue
+		}
+		if len(tc.err) == 0 && actualErr != nil {
+			t.Errorf("%s: unexpected err: %v", tc.name, actualErr)
+			continue
+		}
+		if len(tc.err) > 0 && actualErr == nil {
+			t.Errorf("%s: missing expected err: %v", tc.name, tc.err)
+			continue
+		}
+		if !strings.Contains(actualErr.Error(), tc.err) {
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+func TestPriorityRESTMapperKindForErrorHandling(t *testing.T) {
+	tcs := []struct {
+		name string
+
+		delegate     RESTMapper
+		kindPatterns []schema.GroupVersionKind
+		result       schema.GroupVersionKind
+		err          string
+	}{
+		{
+			name:     "error",
+			delegate: fixedRESTMapper{err: errors.New("delegateErr")},
+			err:      "delegateErr",
+		},
+		{
+			name:     "single hit + error",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{{Kind: "single-hit"}}, err: errors.New("delegateErr")},
+			result:   schema.GroupVersionKind{Kind: "single-hit"},
+			err:      "delegateErr",
+		},
+		{
+			name: "group selection + error",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{
+				{Group: "one", Version: "a", Kind: "first"},
+				{Group: "two", Version: "b", Kind: "second"},
+			}, err: errors.New("delegateErr")},
+			kindPatterns: []schema.GroupVersionKind{
+				{Group: "one", Version: AnyVersion, Kind: AnyKind},
+			},
+			result: schema.GroupVersionKind{Group: "one", Version: "a", Kind: "first"},
+			err:    "delegateErr",
+		},
+
+		{
+			name:     "single hit",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{{Kind: "single-hit"}}},
+			result:   schema.GroupVersionKind{Kind: "single-hit"},
+		},
+		{
+			name: "ambiguous match",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{
+				{Group: "one", Version: "a", Kind: "first"},
+				{Group: "two", Version: "b", Kind: "second"},
+			}},
+			err: "matches multiple kinds",
+		},
+		{
+			name: "group selection",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{
+				{Group: "one", Version: "a", Kind: "first"},
+				{Group: "two", Version: "b", Kind: "second"},
+			}},
+			kindPatterns: []schema.GroupVersionKind{
+				{Group: "one", Version: AnyVersion, Kind: AnyKind},
+			},
+			result: schema.GroupVersionKind{Group: "one", Version: "a", Kind: "first"},
+		},
+		{
+			name: "empty match continues",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{
+				{Group: "one", Version: "a", Kind: "first"},
+				{Group: "two", Version: "b", Kind: "second"},
+			}},
+			kindPatterns: []schema.GroupVersionKind{
+				{Group: "fail", Version: AnyVersion, Kind: AnyKind},
+				{Group: "one", Version: AnyVersion, Kind: AnyKind},
+			},
+			result: schema.GroupVersionKind{Group: "one", Version: "a", Kind: "first"},
+		},
+		{
+			name: "group followed by version selection",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{
+				{Group: "one", Version: "a", Kind: "first"},
+				{Group: "two", Version: "b", Kind: "second"},
+				{Group: "one", Version: "c", Kind: "third"},
+			}},
+			kindPatterns: []schema.GroupVersionKind{
+				{Group: "one", Version: AnyVersion, Kind: AnyKind},
+				{Group: AnyGroup, Version: "a", Kind: AnyKind},
+			},
+			result: schema.GroupVersionKind{Group: "one", Version: "a", Kind: "first"},
+		},
+		{
+			name: "kind selection",
+			delegate: fixedRESTMapper{kindsFor: []schema.GroupVersionKind{
+				{Group: "one", Version: "a", Kind: "first"},
+				{Group: "one", Version: "a", Kind: "second"},
+			}},
+			kindPatterns: []schema.GroupVersionKind{
+				{Group: AnyGroup, Version: AnyVersion, Kind: "second"},
+			},
+			result: schema.GroupVersionKind{Group: "one", Version: "a", Kind: "second"},
+		},
+	}
+
+	for _, tc := range tcs {
+		mapper := PriorityRESTMapper{Delegate: tc.delegate, KindPriority: tc.kindPatterns}
+
+		actualResult, actualErr := mapper.KindFor(schema.GroupVersionResource{})
+		if e, a := tc.result, actualResult; e != a {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		if len(tc.err) == 0 && actualErr == nil {
+			continue
+		}
+		if len(tc.err) == 0 && actualErr != nil {
+			t.Errorf("%s: unexpected err: %v", tc.name, actualErr)
+			continue
+		}
+		if len(tc.err) > 0 && actualErr == nil {
+			t.Errorf("%s: missing expected err: %v", tc.name, tc.err)
+			continue
+		}
+		if !strings.Contains(actualErr.Error(), tc.err) {
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+func TestPriorityRESTMapperRESTMapping(t *testing.T) {
+	mapping1 := &RESTMapping{
+		GroupVersionKind: schema.GroupVersionKind{Kind: "Foo", Version: "v1alpha1"},
+	}
+	mapping2 := &RESTMapping{
+		GroupVersionKind: schema.GroupVersionKind{Kind: "Foo", Version: "v1"},
+	}
+	mapping3 := &RESTMapping{
+		GroupVersionKind: schema.GroupVersionKind{Group: "other", Kind: "Foo", Version: "v1"},
+	}
+	allMappers := MultiRESTMapper{
+		fixedRESTMapper{mappings: []*RESTMapping{mapping1}},
+		fixedRESTMapper{mappings: []*RESTMapping{mapping2}},
+		fixedRESTMapper{mappings: []*RESTMapping{mapping3}},
+	}
+	tcs := []struct {
+		name string
+
+		mapper PriorityRESTMapper
+		input  schema.GroupKind
+		result *RESTMapping
+		err    error
+	}{
+		{
+			name:   "empty",
+			mapper: PriorityRESTMapper{Delegate: MultiRESTMapper{}},
+			input:  schema.GroupKind{Kind: "Foo"},
+			err:    &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}},
+		},
+		{
+			name:   "ignore not found",
+			mapper: PriorityRESTMapper{Delegate: MultiRESTMapper{fixedRESTMapper{err: &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "IGNORE_THIS"}}}}},
+			input:  schema.GroupKind{Kind: "Foo"},
+			err:    &NoKindMatchError{GroupKind: schema.GroupKind{Kind: "Foo"}},
+		},
+		{
+			name:   "accept first failure",
+			mapper: PriorityRESTMapper{Delegate: MultiRESTMapper{fixedRESTMapper{err: errors.New("fail on this")}, fixedRESTMapper{mappings: []*RESTMapping{mapping1}}}},
+			input:  schema.GroupKind{Kind: "Foo"},
+			err:    errors.New("fail on this"),
+		},
+		{
+			name:   "result + error",
+			mapper: PriorityRESTMapper{Delegate: fixedRESTMapper{mappings: []*RESTMapping{mapping1}, err: errors.New("fail on this")}},
+			input:  schema.GroupKind{Kind: "Foo"},
+			result: mapping1,
+			err:    errors.New("fail on this"),
+		},
+		{
+			name: "return error for ambiguous",
+			mapper: PriorityRESTMapper{
+				Delegate: allMappers,
+			},
+			input: schema.GroupKind{Kind: "Foo"},
+			err: &AmbiguousKindError{
+				PartialKind: schema.GroupVersionKind{Kind: "Foo"},
+				MatchingKinds: []schema.GroupVersionKind{
+					{Kind: "Foo", Version: "v1alpha1"},
+					{Kind: "Foo", Version: "v1"},
+					{Group: "other", Kind: "Foo", Version: "v1"},
+				},
+			},
+		},
+		{
+			name: "accept only item",
+			mapper: PriorityRESTMapper{
+				Delegate: fixedRESTMapper{mappings: []*RESTMapping{mapping1}},
+			},
+			input:  schema.GroupKind{Kind: "Foo"},
+			result: mapping1,
+		},
+		{
+			name: "return single priority",
+			mapper: PriorityRESTMapper{
+				Delegate:     allMappers,
+				KindPriority: []schema.GroupVersionKind{{Version: "v1", Kind: AnyKind}, {Version: "v1alpha1", Kind: AnyKind}},
+			},
+			input:  schema.GroupKind{Kind: "Foo"},
+			result: mapping2,
+		},
+		{
+			name: "return out of group match",
+			mapper: PriorityRESTMapper{
+				Delegate:     allMappers,
+				KindPriority: []schema.GroupVersionKind{{Group: AnyGroup, Version: "v1", Kind: AnyKind}, {Group: "other", Version: AnyVersion, Kind: AnyKind}},
+			},
+			input:  schema.GroupKind{Kind: "Foo"},
+			result: mapping3,
+		},
+	}
+
+	for _, tc := range tcs {
+		actualResult, actualErr := tc.mapper.RESTMapping(tc.input)
+		if e, a := tc.result, actualResult; !reflect.DeepEqual(e, a) {
+			t.Errorf("%s: expected %v, got %v", tc.name, e, a)
+		}
+		switch {
+		case tc.err == nil && actualErr == nil:
+		case tc.err == nil:
+			t.Errorf("%s: unexpected error: %v", tc.name, actualErr)
+		case actualErr == nil:
+			t.Errorf("%s: expected error: %v got nil", tc.name, tc.err)
+		case tc.err.Error() != actualErr.Error():
+			t.Errorf("%s: expected %v, got %v", tc.name, tc.err, actualErr)
+		}
+	}
+}
+
+func TestPriorityRESTMapperRESTMappingHonorsUserVersion(t *testing.T) {
+	mappingV2alpha1 := &RESTMapping{
+		GroupVersionKind: schema.GroupVersionKind{Group: "Bar", Kind: "Foo", Version: "v2alpha1"},
+	}
+	mappingV1 := &RESTMapping{
+		GroupVersionKind: schema.GroupVersionKind{Group: "Bar", Kind: "Foo", Version: "v1"},
+	}
+
+	allMappers := MultiRESTMapper{
+		fixedRESTMapper{mappings: []*RESTMapping{mappingV2alpha1}},
+		fixedRESTMapper{mappings: []*RESTMapping{mappingV1}},
+	}
+
+	mapper := PriorityRESTMapper{
+		Delegate:     allMappers,
+		KindPriority: []schema.GroupVersionKind{{Group: "Bar", Version: "v2alpha1", Kind: AnyKind}, {Group: "Bar", Version: AnyVersion, Kind: AnyKind}},
+	}
+
+	outMapping1, err := mapper.RESTMapping(schema.GroupKind{Group: "Bar", Kind: "Foo"}, "v1")
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	if outMapping1 != mappingV1 {
+		t.Errorf("asked for version %v, expected mapping for %v, got mapping for %v", "v1", mappingV1.GroupVersionKind, outMapping1.GroupVersionKind)
+	}
+
+	outMapping2, err := mapper.RESTMapping(schema.GroupKind{Group: "Bar", Kind: "Foo"}, "v2alpha1")
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	if outMapping2 != mappingV2alpha1 {
+		t.Errorf("asked for version %v, expected mapping for %v, got mapping for %v", "v2alpha1", mappingV2alpha1.GroupVersionKind, outMapping2.GroupVersionKind)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/restmapper.go b/third_party/k8s.io/apimachinery/pkg/api/meta/restmapper.go
new file mode 100644
index 0000000000..d64db33d41
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/restmapper.go
@@ -0,0 +1,579 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// TODO: move everything in this file to pkg/api/rest
+package meta
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// Implements RESTScope interface
+type restScope struct {
+	name RESTScopeName
+}
+
+func (r *restScope) Name() RESTScopeName {
+	return r.name
+}
+
+var RESTScopeNamespace = &restScope{
+	name: RESTScopeNameNamespace,
+}
+
+var RESTScopeRoot = &restScope{
+	name: RESTScopeNameRoot,
+}
+
+// DefaultRESTMapper exposes mappings between the types defined in a
+// runtime.Scheme. It assumes that all types defined the provided scheme
+// can be mapped with the provided MetadataAccessor and Codec interfaces.
+//
+// The resource name of a Kind is defined as the lowercase,
+// English-plural version of the Kind string.
+// When converting from resource to Kind, the singular version of the
+// resource name is also accepted for convenience.
+//
+// TODO: Only accept plural for some operations for increased control?
+// (`get pod bar` vs `get pods bar`)
+type DefaultRESTMapper struct {
+	defaultGroupVersions []schema.GroupVersion
+
+	resourceToKind       map[schema.GroupVersionResource]schema.GroupVersionKind
+	kindToPluralResource map[schema.GroupVersionKind]schema.GroupVersionResource
+	kindToScope          map[schema.GroupVersionKind]RESTScope
+	singularToPlural     map[schema.GroupVersionResource]schema.GroupVersionResource
+	pluralToSingular     map[schema.GroupVersionResource]schema.GroupVersionResource
+}
+
+func (m *DefaultRESTMapper) String() string {
+	if m == nil {
+		return "<nil>"
+	}
+	return fmt.Sprintf("DefaultRESTMapper{kindToPluralResource=%v}", m.kindToPluralResource)
+}
+
+var _ RESTMapper = &DefaultRESTMapper{}
+var _ RESTMapperWithContext = &DefaultRESTMapper{}
+var _ fmt.Stringer = &DefaultRESTMapper{}
+
+// NewDefaultRESTMapper initializes a mapping between Kind and APIVersion
+// to a resource name and back based on the objects in a runtime.Scheme
+// and the Kubernetes API conventions. Takes a group name, a priority list of the versions
+// to search when an object has no default version (set empty to return an error),
+// and a function that retrieves the correct metadata for a given version.
+func NewDefaultRESTMapper(defaultGroupVersions []schema.GroupVersion) *DefaultRESTMapper {
+	resourceToKind := make(map[schema.GroupVersionResource]schema.GroupVersionKind)
+	kindToPluralResource := make(map[schema.GroupVersionKind]schema.GroupVersionResource)
+	kindToScope := make(map[schema.GroupVersionKind]RESTScope)
+	singularToPlural := make(map[schema.GroupVersionResource]schema.GroupVersionResource)
+	pluralToSingular := make(map[schema.GroupVersionResource]schema.GroupVersionResource)
+	// TODO: verify name mappings work correctly when versions differ
+
+	return &DefaultRESTMapper{
+		resourceToKind:       resourceToKind,
+		kindToPluralResource: kindToPluralResource,
+		kindToScope:          kindToScope,
+		defaultGroupVersions: defaultGroupVersions,
+		singularToPlural:     singularToPlural,
+		pluralToSingular:     pluralToSingular,
+	}
+}
+
+func (m *DefaultRESTMapper) Add(kind schema.GroupVersionKind, scope RESTScope) {
+	plural, singular := UnsafeGuessKindToResource(kind)
+	m.AddSpecific(kind, plural, singular, scope)
+}
+
+func (m *DefaultRESTMapper) AddSpecific(kind schema.GroupVersionKind, plural, singular schema.GroupVersionResource, scope RESTScope) {
+	m.singularToPlural[singular] = plural
+	m.pluralToSingular[plural] = singular
+
+	m.resourceToKind[singular] = kind
+	m.resourceToKind[plural] = kind
+
+	m.kindToPluralResource[kind] = plural
+	m.kindToScope[kind] = scope
+}
+
+// unpluralizedSuffixes is a list of resource suffixes that are the same plural and singular
+// This is only is only necessary because some bits of code are lazy and don't actually use the RESTMapper like they should.
+// TODO eliminate this so that different callers can correctly map to resources.  This probably means updating all
+// callers to use the RESTMapper they mean.
+var unpluralizedSuffixes = []string{
+	"endpoints",
+}
+
+// UnsafeGuessKindToResource converts Kind to a resource name.
+// Broken. This method only "sort of" works when used outside of this package.  It assumes that Kinds and Resources match
+// and they aren't guaranteed to do so.
+func UnsafeGuessKindToResource(kind schema.GroupVersionKind) ( /*plural*/ schema.GroupVersionResource /*singular*/, schema.GroupVersionResource) {
+	kindName := kind.Kind
+	if len(kindName) == 0 {
+		return schema.GroupVersionResource{}, schema.GroupVersionResource{}
+	}
+	singularName := strings.ToLower(kindName)
+	singular := kind.GroupVersion().WithResource(singularName)
+
+	for _, skip := range unpluralizedSuffixes {
+		if strings.HasSuffix(singularName, skip) {
+			return singular, singular
+		}
+	}
+
+	switch string(singularName[len(singularName)-1]) {
+	case "s":
+		return kind.GroupVersion().WithResource(singularName + "es"), singular
+	case "y":
+		return kind.GroupVersion().WithResource(strings.TrimSuffix(singularName, "y") + "ies"), singular
+	}
+
+	return kind.GroupVersion().WithResource(singularName + "s"), singular
+}
+
+// ResourceSingularizer implements RESTMapper
+// It converts a resource name from plural to singular (e.g., from pods to pod)
+func (m *DefaultRESTMapper) ResourceSingularizer(resourceType string) (string, error) {
+	partialResource := schema.GroupVersionResource{Resource: resourceType}
+	resources, err := m.ResourcesFor(partialResource)
+	if err != nil {
+		return resourceType, err
+	}
+
+	singular := schema.GroupVersionResource{}
+	for _, curr := range resources {
+		currSingular, ok := m.pluralToSingular[curr]
+		if !ok {
+			continue
+		}
+		if singular.Empty() {
+			singular = currSingular
+			continue
+		}
+
+		if currSingular.Resource != singular.Resource {
+			return resourceType, fmt.Errorf("multiple possible singular resources (%v) found for %v", resources, resourceType)
+		}
+	}
+
+	if singular.Empty() {
+		return resourceType, fmt.Errorf("no singular of resource %v has been defined", resourceType)
+	}
+
+	return singular.Resource, nil
+}
+
+func (m *DefaultRESTMapper) ResourceSingularizerWithContext(_ context.Context, resourceType string) (string, error) {
+	return m.ResourceSingularizer(resourceType)
+}
+
+// coerceResourceForMatching makes the resource lower case and converts internal versions to unspecified (legacy behavior)
+func coerceResourceForMatching(resource schema.GroupVersionResource) schema.GroupVersionResource {
+	resource.Resource = strings.ToLower(resource.Resource)
+	if resource.Version == runtime.APIVersionInternal {
+		resource.Version = ""
+	}
+
+	return resource
+}
+
+func (m *DefaultRESTMapper) ResourcesFor(input schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	resource := coerceResourceForMatching(input)
+
+	hasResource := len(resource.Resource) > 0
+	hasGroup := len(resource.Group) > 0
+	hasVersion := len(resource.Version) > 0
+
+	if !hasResource {
+		return nil, fmt.Errorf("a resource must be present, got: %v", resource)
+	}
+
+	ret := []schema.GroupVersionResource{}
+	switch {
+	case hasGroup && hasVersion:
+		// fully qualified.  Find the exact match
+		for plural, singular := range m.pluralToSingular {
+			if singular == resource {
+				ret = append(ret, plural)
+				break
+			}
+			if plural == resource {
+				ret = append(ret, plural)
+				break
+			}
+		}
+
+	case hasGroup:
+		// given a group, prefer an exact match.  If you don't find one, resort to a prefix match on group
+		foundExactMatch := false
+		requestedGroupResource := resource.GroupResource()
+		for plural, singular := range m.pluralToSingular {
+			if singular.GroupResource() == requestedGroupResource {
+				foundExactMatch = true
+				ret = append(ret, plural)
+			}
+			if plural.GroupResource() == requestedGroupResource {
+				foundExactMatch = true
+				ret = append(ret, plural)
+			}
+		}
+
+		// if you didn't find an exact match, match on group prefixing. This allows storageclass.storage to match
+		// storageclass.storage.k8s.io
+		if !foundExactMatch {
+			for plural, singular := range m.pluralToSingular {
+				if !strings.HasPrefix(plural.Group, requestedGroupResource.Group) {
+					continue
+				}
+				if singular.Resource == requestedGroupResource.Resource {
+					ret = append(ret, plural)
+				}
+				if plural.Resource == requestedGroupResource.Resource {
+					ret = append(ret, plural)
+				}
+			}
+
+		}
+
+	case hasVersion:
+		for plural, singular := range m.pluralToSingular {
+			if singular.Version == resource.Version && singular.Resource == resource.Resource {
+				ret = append(ret, plural)
+			}
+			if plural.Version == resource.Version && plural.Resource == resource.Resource {
+				ret = append(ret, plural)
+			}
+		}
+
+	default:
+		for plural, singular := range m.pluralToSingular {
+			if singular.Resource == resource.Resource {
+				ret = append(ret, plural)
+			}
+			if plural.Resource == resource.Resource {
+				ret = append(ret, plural)
+			}
+		}
+	}
+
+	if len(ret) == 0 {
+		return nil, &NoResourceMatchError{PartialResource: resource}
+	}
+
+	sort.Sort(resourceByPreferredGroupVersion{ret, m.defaultGroupVersions})
+	return ret, nil
+}
+
+func (m *DefaultRESTMapper) ResourcesForWithContext(_ context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return m.ResourcesFor(input)
+}
+
+func (m *DefaultRESTMapper) ResourceFor(resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	resources, err := m.ResourcesFor(resource)
+	if err != nil {
+		return schema.GroupVersionResource{}, err
+	}
+	if len(resources) == 1 {
+		return resources[0], nil
+	}
+
+	return schema.GroupVersionResource{}, &AmbiguousResourceError{PartialResource: resource, MatchingResources: resources}
+}
+
+func (m *DefaultRESTMapper) ResourceForWithContext(_ context.Context, resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	return m.ResourceFor(resource)
+}
+
+func (m *DefaultRESTMapper) KindsFor(input schema.GroupVersionResource) ([]schema.GroupVersionKind, error) {
+	resource := coerceResourceForMatching(input)
+
+	hasResource := len(resource.Resource) > 0
+	hasGroup := len(resource.Group) > 0
+	hasVersion := len(resource.Version) > 0
+
+	if !hasResource {
+		return nil, fmt.Errorf("a resource must be present, got: %v", resource)
+	}
+
+	ret := []schema.GroupVersionKind{}
+	switch {
+	// fully qualified.  Find the exact match
+	case hasGroup && hasVersion:
+		kind, exists := m.resourceToKind[resource]
+		if exists {
+			ret = append(ret, kind)
+		}
+
+	case hasGroup:
+		foundExactMatch := false
+		requestedGroupResource := resource.GroupResource()
+		for currResource, currKind := range m.resourceToKind {
+			if currResource.GroupResource() == requestedGroupResource {
+				foundExactMatch = true
+				ret = append(ret, currKind)
+			}
+		}
+
+		// if you didn't find an exact match, match on group prefixing. This allows storageclass.storage to match
+		// storageclass.storage.k8s.io
+		if !foundExactMatch {
+			for currResource, currKind := range m.resourceToKind {
+				if !strings.HasPrefix(currResource.Group, requestedGroupResource.Group) {
+					continue
+				}
+				if currResource.Resource == requestedGroupResource.Resource {
+					ret = append(ret, currKind)
+				}
+			}
+
+		}
+
+	case hasVersion:
+		for currResource, currKind := range m.resourceToKind {
+			if currResource.Version == resource.Version && currResource.Resource == resource.Resource {
+				ret = append(ret, currKind)
+			}
+		}
+
+	default:
+		for currResource, currKind := range m.resourceToKind {
+			if currResource.Resource == resource.Resource {
+				ret = append(ret, currKind)
+			}
+		}
+	}
+
+	if len(ret) == 0 {
+		return nil, &NoResourceMatchError{PartialResource: input}
+	}
+
+	sort.Sort(kindByPreferredGroupVersion{ret, m.defaultGroupVersions})
+	return ret, nil
+}
+
+func (m *DefaultRESTMapper) KindsForWithContext(_ context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionKind, error) {
+	return m.KindsFor(input)
+}
+
+func (m *DefaultRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	kinds, err := m.KindsFor(resource)
+	if err != nil {
+		return schema.GroupVersionKind{}, err
+	}
+	if len(kinds) == 1 {
+		return kinds[0], nil
+	}
+
+	return schema.GroupVersionKind{}, &AmbiguousResourceError{PartialResource: resource, MatchingKinds: kinds}
+}
+
+func (m *DefaultRESTMapper) KindForWithContext(_ context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return m.KindFor(resource)
+}
+
+type kindByPreferredGroupVersion struct {
+	list      []schema.GroupVersionKind
+	sortOrder []schema.GroupVersion
+}
+
+func (o kindByPreferredGroupVersion) Len() int      { return len(o.list) }
+func (o kindByPreferredGroupVersion) Swap(i, j int) { o.list[i], o.list[j] = o.list[j], o.list[i] }
+func (o kindByPreferredGroupVersion) Less(i, j int) bool {
+	lhs := o.list[i]
+	rhs := o.list[j]
+	if lhs == rhs {
+		return false
+	}
+
+	if lhs.GroupVersion() == rhs.GroupVersion() {
+		return lhs.Kind < rhs.Kind
+	}
+
+	// otherwise, the difference is in the GroupVersion, so we need to sort with respect to the preferred order
+	lhsIndex := -1
+	rhsIndex := -1
+
+	for i := range o.sortOrder {
+		if o.sortOrder[i] == lhs.GroupVersion() {
+			lhsIndex = i
+		}
+		if o.sortOrder[i] == rhs.GroupVersion() {
+			rhsIndex = i
+		}
+	}
+
+	if rhsIndex == -1 {
+		return true
+	}
+
+	return lhsIndex < rhsIndex
+}
+
+type resourceByPreferredGroupVersion struct {
+	list      []schema.GroupVersionResource
+	sortOrder []schema.GroupVersion
+}
+
+func (o resourceByPreferredGroupVersion) Len() int      { return len(o.list) }
+func (o resourceByPreferredGroupVersion) Swap(i, j int) { o.list[i], o.list[j] = o.list[j], o.list[i] }
+func (o resourceByPreferredGroupVersion) Less(i, j int) bool {
+	lhs := o.list[i]
+	rhs := o.list[j]
+	if lhs == rhs {
+		return false
+	}
+
+	if lhs.GroupVersion() == rhs.GroupVersion() {
+		return lhs.Resource < rhs.Resource
+	}
+
+	// otherwise, the difference is in the GroupVersion, so we need to sort with respect to the preferred order
+	lhsIndex := -1
+	rhsIndex := -1
+
+	for i := range o.sortOrder {
+		if o.sortOrder[i] == lhs.GroupVersion() {
+			lhsIndex = i
+		}
+		if o.sortOrder[i] == rhs.GroupVersion() {
+			rhsIndex = i
+		}
+	}
+
+	if rhsIndex == -1 {
+		return true
+	}
+
+	return lhsIndex < rhsIndex
+}
+
+// RESTMapping returns a struct representing the resource path and conversion interfaces a
+// RESTClient should use to operate on the provided group/kind in order of versions. If a version search
+// order is not provided, the search order provided to DefaultRESTMapper will be used to resolve which
+// version should be used to access the named group/kind.
+func (m *DefaultRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	mappings, err := m.RESTMappings(gk, versions...)
+	if err != nil {
+		return nil, err
+	}
+	if len(mappings) == 0 {
+		return nil, &NoKindMatchError{GroupKind: gk, SearchedVersions: versions}
+	}
+	// since we rely on RESTMappings method
+	// take the first match and return to the caller
+	// as this was the existing behavior.
+	return mappings[0], nil
+}
+
+func (m *DefaultRESTMapper) RESTMappingWithContext(_ context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	return m.RESTMapping(gk, versions...)
+}
+
+// RESTMappings returns the RESTMappings for the provided group kind. If a version search order
+// is not provided, the search order provided to DefaultRESTMapper will be used.
+func (m *DefaultRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	mappings := make([]*RESTMapping, 0)
+	potentialGVK := make([]schema.GroupVersionKind, 0)
+	hadVersion := false
+
+	// Pick an appropriate version
+	for _, version := range versions {
+		if len(version) == 0 || version == runtime.APIVersionInternal {
+			continue
+		}
+		currGVK := gk.WithVersion(version)
+		hadVersion = true
+		if _, ok := m.kindToPluralResource[currGVK]; ok {
+			potentialGVK = append(potentialGVK, currGVK)
+			break
+		}
+	}
+	// Use the default preferred versions
+	if !hadVersion && len(potentialGVK) == 0 {
+		for _, gv := range m.defaultGroupVersions {
+			if gv.Group != gk.Group {
+				continue
+			}
+			potentialGVK = append(potentialGVK, gk.WithVersion(gv.Version))
+		}
+	}
+
+	if len(potentialGVK) == 0 {
+		return nil, &NoKindMatchError{GroupKind: gk, SearchedVersions: versions}
+	}
+
+	for _, gvk := range potentialGVK {
+		//Ensure we have a REST mapping
+		res, ok := m.kindToPluralResource[gvk]
+		if !ok {
+			continue
+		}
+
+		// Ensure we have a REST scope
+		scope, ok := m.kindToScope[gvk]
+		if !ok {
+			return nil, fmt.Errorf("the provided version %q and kind %q cannot be mapped to a supported scope", gvk.GroupVersion(), gvk.Kind)
+		}
+
+		mappings = append(mappings, &RESTMapping{
+			Resource:         res,
+			GroupVersionKind: gvk,
+			Scope:            scope,
+		})
+	}
+
+	if len(mappings) == 0 {
+		return nil, &NoResourceMatchError{PartialResource: schema.GroupVersionResource{Group: gk.Group, Resource: gk.Kind}}
+	}
+	return mappings, nil
+}
+
+func (m *DefaultRESTMapper) RESTMappingsWithContext(_ context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	return m.RESTMappings(gk, versions...)
+}
+
+// MaybeResetRESTMapper calls Reset() on the mapper if it is a ResettableRESTMapper or
+// ResetWithContext() if it is a ResettableRESTMapperWithContext.
+//
+// MaybeResetRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MaybeResetRESTMapperWithContext instead.
+func MaybeResetRESTMapper(mapper RESTMapper) {
+	maybeReset(context.Background(), mapper)
+}
+
+// MaybeResetRESTMapperWithContext calls Reset() on the mapper if it is a ResettableRESTMapper or
+// ResetWithContext() if it is a ResettableRESTMapperWithContext.
+func MaybeResetRESTMapperWithContext(ctx context.Context, mapper RESTMapperWithContext) {
+	maybeReset(ctx, mapper)
+}
+
+func maybeReset(ctx context.Context, mapper any) {
+	if m, ok := mapper.(ResettableRESTMapperWithContext); ok {
+		m.ResetWithContext(ctx)
+		return
+	}
+	if m, ok := mapper.(ResettableRESTMapper); ok {
+		m.Reset()
+		return
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/restmapper_test.go b/third_party/k8s.io/apimachinery/pkg/api/meta/restmapper_test.go
new file mode 100644
index 0000000000..f168f033c7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/restmapper_test.go
@@ -0,0 +1,724 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meta
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestRESTMapperVersionAndKindForResource(t *testing.T) {
+	testGroup := "test.group"
+	testVersion := "test"
+	testGroupVersion := schema.GroupVersion{Group: testGroup, Version: testVersion}
+
+	testCases := []struct {
+		Resource               schema.GroupVersionResource
+		GroupVersionToRegister schema.GroupVersion
+		ExpectedGVK            schema.GroupVersionKind
+		Err                    bool
+	}{
+		{Resource: schema.GroupVersionResource{Resource: "internalobjec"}, Err: true},
+		{Resource: schema.GroupVersionResource{Resource: "internalObjec"}, Err: true},
+
+		{Resource: schema.GroupVersionResource{Resource: "internalobject"}, ExpectedGVK: testGroupVersion.WithKind("InternalObject")},
+		{Resource: schema.GroupVersionResource{Resource: "internalobjects"}, ExpectedGVK: testGroupVersion.WithKind("InternalObject")},
+	}
+	for i, testCase := range testCases {
+		mapper := NewDefaultRESTMapper([]schema.GroupVersion{testGroupVersion})
+		if len(testCase.ExpectedGVK.Kind) != 0 {
+			mapper.Add(testCase.ExpectedGVK, RESTScopeNamespace)
+		}
+		actualGVK, err := mapper.KindFor(testCase.Resource)
+
+		hasErr := err != nil
+		if hasErr != testCase.Err {
+			t.Errorf("%d: unexpected error behavior %t: %v", i, testCase.Err, err)
+			continue
+		}
+		if err != nil {
+			continue
+		}
+
+		if actualGVK != testCase.ExpectedGVK {
+			t.Errorf("%d: unexpected version and kind: e=%s a=%s", i, testCase.ExpectedGVK, actualGVK)
+		}
+	}
+}
+
+func TestRESTMapperGroupForResource(t *testing.T) {
+	testCases := []struct {
+		Resource         schema.GroupVersionResource
+		GroupVersionKind schema.GroupVersionKind
+		Err              bool
+	}{
+		{Resource: schema.GroupVersionResource{Resource: "myObject"}, GroupVersionKind: schema.GroupVersionKind{Group: "testapi", Version: "test", Kind: "MyObject"}},
+		{Resource: schema.GroupVersionResource{Resource: "myobject"}, GroupVersionKind: schema.GroupVersionKind{Group: "testapi2", Version: "test", Kind: "MyObject"}},
+		{Resource: schema.GroupVersionResource{Resource: "myObje"}, Err: true, GroupVersionKind: schema.GroupVersionKind{Group: "testapi", Version: "test", Kind: "MyObject"}},
+		{Resource: schema.GroupVersionResource{Resource: "myobje"}, Err: true, GroupVersionKind: schema.GroupVersionKind{Group: "testapi", Version: "test", Kind: "MyObject"}},
+	}
+	for i, testCase := range testCases {
+		mapper := NewDefaultRESTMapper([]schema.GroupVersion{testCase.GroupVersionKind.GroupVersion()})
+		mapper.Add(testCase.GroupVersionKind, RESTScopeNamespace)
+
+		actualGVK, err := mapper.KindFor(testCase.Resource)
+		if testCase.Err {
+			if err == nil {
+				t.Errorf("%d: expected error", i)
+			}
+		} else if err != nil {
+			t.Errorf("%d: unexpected error: %v", i, err)
+		} else if actualGVK != testCase.GroupVersionKind {
+			t.Errorf("%d: expected group %q, got %q", i, testCase.GroupVersionKind, actualGVK)
+		}
+	}
+}
+
+func TestRESTMapperKindsFor(t *testing.T) {
+	testCases := []struct {
+		Name                     string
+		PreferredOrder           []schema.GroupVersion
+		KindsToRegister          []schema.GroupVersionKind
+		PartialResourceToRequest schema.GroupVersionResource
+
+		ExpectedKinds   []schema.GroupVersionKind
+		ExpectedKindErr string
+	}{
+		{
+			// exact matches are preferred
+			Name: "groups, with group exact",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "first-group-1", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group-1", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+			PartialResourceToRequest: schema.GroupVersionResource{Group: "first-group", Resource: "my-kind"},
+
+			ExpectedKinds: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+		},
+
+		{
+			// group prefixes work
+			Name: "groups, with group prefix",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "second-group", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+			},
+			PartialResourceToRequest: schema.GroupVersionResource{Group: "first", Resource: "my-kind"},
+
+			ExpectedKinds: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+		},
+
+		{
+			// group prefixes can be ambiguous
+			Name: "groups, with ambiguous group prefix",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "first-group-1", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group-1", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+			PartialResourceToRequest: schema.GroupVersionResource{Group: "first", Resource: "my-kind"},
+
+			ExpectedKinds: []schema.GroupVersionKind{
+				{Group: "first-group-1", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+			ExpectedKindErr: " matches multiple kinds ",
+		},
+
+		{
+			Name: "ambiguous groups, with preference order",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "second-group", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "your-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "your-kind"},
+			},
+			PartialResourceToRequest: schema.GroupVersionResource{Resource: "my-kinds"},
+
+			ExpectedKinds: []schema.GroupVersionKind{
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+			ExpectedKindErr: " matches multiple kinds ",
+		},
+
+		{
+			Name: "ambiguous groups, with explicit group match",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "second-group", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "your-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "your-kind"},
+			},
+			PartialResourceToRequest: schema.GroupVersionResource{Group: "first-group", Resource: "my-kinds"},
+
+			ExpectedKinds: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+		},
+
+		{
+			Name: "ambiguous groups, with ambiguous version match",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "first-group", Version: "first-version"},
+				{Group: "second-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "your-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "your-kind"},
+			},
+			PartialResourceToRequest: schema.GroupVersionResource{Version: "first-version", Resource: "my-kinds"},
+
+			ExpectedKinds: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+			},
+			ExpectedKindErr: " matches multiple kinds ",
+		},
+	}
+	for _, testCase := range testCases {
+		tcName := testCase.Name
+		mapper := NewDefaultRESTMapper(testCase.PreferredOrder)
+		for _, kind := range testCase.KindsToRegister {
+			mapper.Add(kind, RESTScopeNamespace)
+		}
+
+		actualKinds, err := mapper.KindsFor(testCase.PartialResourceToRequest)
+		if err != nil {
+			t.Errorf("%s: unexpected error: %v", tcName, err)
+			continue
+		}
+		if !reflect.DeepEqual(testCase.ExpectedKinds, actualKinds) {
+			t.Errorf("%s: expected %v, got %v", tcName, testCase.ExpectedKinds, actualKinds)
+		}
+
+		singleKind, err := mapper.KindFor(testCase.PartialResourceToRequest)
+		if err == nil && len(testCase.ExpectedKindErr) != 0 {
+			t.Errorf("%s: expected error: %v", tcName, testCase.ExpectedKindErr)
+			continue
+		}
+		if err != nil {
+			if len(testCase.ExpectedKindErr) == 0 {
+				t.Errorf("%s: unexpected error: %v", tcName, err)
+				continue
+			} else {
+				if !strings.Contains(err.Error(), testCase.ExpectedKindErr) {
+					t.Errorf("%s: expected %v, got %v", tcName, testCase.ExpectedKindErr, err)
+					continue
+				}
+			}
+
+		} else {
+			if testCase.ExpectedKinds[0] != singleKind {
+				t.Errorf("%s: expected %v, got %v", tcName, testCase.ExpectedKinds[0], singleKind)
+			}
+
+		}
+	}
+}
+
+func TestRESTMapperResourcesFor(t *testing.T) {
+	testCases := []struct {
+		Name                             string
+		PreferredOrder                   []schema.GroupVersion
+		KindsToRegister                  []schema.GroupVersionKind
+		PluralPartialResourceToRequest   schema.GroupVersionResource
+		SingularPartialResourceToRequest schema.GroupVersionResource
+
+		ExpectedResources   []schema.GroupVersionResource
+		ExpectedResourceErr string
+	}{
+		{
+			// exact matches are preferred
+			Name: "groups, with group exact",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "first-group-1", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group-1", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+			PluralPartialResourceToRequest:   schema.GroupVersionResource{Group: "first-group", Resource: "my-kinds"},
+			SingularPartialResourceToRequest: schema.GroupVersionResource{Group: "first-group", Resource: "my-kind"},
+
+			ExpectedResources: []schema.GroupVersionResource{
+				{Group: "first-group", Version: "first-version", Resource: "my-kinds"},
+			},
+		},
+
+		{
+			// group prefixes work
+			Name: "groups, with group prefix",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "second-group", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+			},
+			PluralPartialResourceToRequest:   schema.GroupVersionResource{Group: "first", Resource: "my-kinds"},
+			SingularPartialResourceToRequest: schema.GroupVersionResource{Group: "first", Resource: "my-kind"},
+
+			ExpectedResources: []schema.GroupVersionResource{
+				{Group: "first-group", Version: "first-version", Resource: "my-kinds"},
+			},
+		},
+
+		{
+			// group prefixes can be ambiguous
+			Name: "groups, with ambiguous group prefix",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "first-group-1", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group-1", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+			},
+			PluralPartialResourceToRequest:   schema.GroupVersionResource{Group: "first", Resource: "my-kinds"},
+			SingularPartialResourceToRequest: schema.GroupVersionResource{Group: "first", Resource: "my-kind"},
+
+			ExpectedResources: []schema.GroupVersionResource{
+				{Group: "first-group-1", Version: "first-version", Resource: "my-kinds"},
+				{Group: "first-group", Version: "first-version", Resource: "my-kinds"},
+			},
+			ExpectedResourceErr: " matches multiple resources ",
+		},
+
+		{
+			Name: "ambiguous groups, with preference order",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "second-group", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "your-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "your-kind"},
+			},
+			PluralPartialResourceToRequest:   schema.GroupVersionResource{Resource: "my-kinds"},
+			SingularPartialResourceToRequest: schema.GroupVersionResource{Resource: "my-kind"},
+
+			ExpectedResources: []schema.GroupVersionResource{
+				{Group: "second-group", Version: "first-version", Resource: "my-kinds"},
+				{Group: "first-group", Version: "first-version", Resource: "my-kinds"},
+			},
+			ExpectedResourceErr: " matches multiple resources ",
+		},
+
+		{
+			Name: "ambiguous groups, with explicit group match",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "second-group", Version: "first-version"},
+				{Group: "first-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "your-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "your-kind"},
+			},
+			PluralPartialResourceToRequest:   schema.GroupVersionResource{Group: "first-group", Resource: "my-kinds"},
+			SingularPartialResourceToRequest: schema.GroupVersionResource{Group: "first-group", Resource: "my-kind"},
+
+			ExpectedResources: []schema.GroupVersionResource{
+				{Group: "first-group", Version: "first-version", Resource: "my-kinds"},
+			},
+		},
+
+		{
+			Name: "ambiguous groups, with ambiguous version match",
+			PreferredOrder: []schema.GroupVersion{
+				{Group: "first-group", Version: "first-version"},
+				{Group: "second-group", Version: "first-version"},
+			},
+			KindsToRegister: []schema.GroupVersionKind{
+				{Group: "first-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "first-group", Version: "first-version", Kind: "your-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "my-kind"},
+				{Group: "second-group", Version: "first-version", Kind: "your-kind"},
+			},
+			PluralPartialResourceToRequest:   schema.GroupVersionResource{Version: "first-version", Resource: "my-kinds"},
+			SingularPartialResourceToRequest: schema.GroupVersionResource{Version: "first-version", Resource: "my-kind"},
+
+			ExpectedResources: []schema.GroupVersionResource{
+				{Group: "first-group", Version: "first-version", Resource: "my-kinds"},
+				{Group: "second-group", Version: "first-version", Resource: "my-kinds"},
+			},
+			ExpectedResourceErr: " matches multiple resources ",
+		},
+	}
+	for _, testCase := range testCases {
+		tcName := testCase.Name
+
+		for _, partialResource := range []schema.GroupVersionResource{testCase.PluralPartialResourceToRequest, testCase.SingularPartialResourceToRequest} {
+			mapper := NewDefaultRESTMapper(testCase.PreferredOrder)
+			for _, kind := range testCase.KindsToRegister {
+				mapper.Add(kind, RESTScopeNamespace)
+			}
+
+			actualResources, err := mapper.ResourcesFor(partialResource)
+			if err != nil {
+				t.Errorf("%s: unexpected error: %v", tcName, err)
+				continue
+			}
+			if !reflect.DeepEqual(testCase.ExpectedResources, actualResources) {
+				t.Errorf("%s: expected %v, got %v", tcName, testCase.ExpectedResources, actualResources)
+			}
+
+			singleResource, err := mapper.ResourceFor(partialResource)
+			if err == nil && len(testCase.ExpectedResourceErr) != 0 {
+				t.Errorf("%s: expected error: %v", tcName, testCase.ExpectedResourceErr)
+				continue
+			}
+			if err != nil {
+				if len(testCase.ExpectedResourceErr) == 0 {
+					t.Errorf("%s: unexpected error: %v", tcName, err)
+					continue
+				} else {
+					if !strings.Contains(err.Error(), testCase.ExpectedResourceErr) {
+						t.Errorf("%s: expected %v, got %v", tcName, testCase.ExpectedResourceErr, err)
+						continue
+					}
+				}
+
+			} else {
+				if testCase.ExpectedResources[0] != singleResource {
+					t.Errorf("%s: expected %v, got %v", tcName, testCase.ExpectedResources[0], singleResource)
+				}
+
+			}
+		}
+	}
+}
+
+func TestKindToResource(t *testing.T) {
+	testCases := []struct {
+		Kind             string
+		Plural, Singular string
+	}{
+		{Kind: "Pod", Plural: "pods", Singular: "pod"},
+
+		{Kind: "ReplicationController", Plural: "replicationcontrollers", Singular: "replicationcontroller"},
+
+		// Add "ies" when ending with "y"
+		{Kind: "ImageRepository", Plural: "imagerepositories", Singular: "imagerepository"},
+		// Add "es" when ending with "s"
+		{Kind: "miss", Plural: "misses", Singular: "miss"},
+		// Add "s" otherwise
+		{Kind: "lowercase", Plural: "lowercases", Singular: "lowercase"},
+	}
+	for i, testCase := range testCases {
+		version := schema.GroupVersion{}
+
+		plural, singular := UnsafeGuessKindToResource(version.WithKind(testCase.Kind))
+		if singular != version.WithResource(testCase.Singular) || plural != version.WithResource(testCase.Plural) {
+			t.Errorf("%d: unexpected plural and singular: %v %v", i, plural, singular)
+		}
+	}
+}
+
+func TestRESTMapperResourceSingularizer(t *testing.T) {
+	testGroupVersion := schema.GroupVersion{Group: "tgroup", Version: "test"}
+
+	testCases := []struct {
+		Kind     string
+		Plural   string
+		Singular string
+	}{
+		{Kind: "Pod", Plural: "pods", Singular: "pod"},
+		{Kind: "ReplicationController", Plural: "replicationcontrollers", Singular: "replicationcontroller"},
+		{Kind: "ImageRepository", Plural: "imagerepositories", Singular: "imagerepository"},
+		{Kind: "Status", Plural: "statuses", Singular: "status"},
+
+		{Kind: "lowercase", Plural: "lowercases", Singular: "lowercase"},
+		// TODO this test is broken.  This updates to reflect actual behavior.  Kinds are expected to be singular
+		// old (incorrect), comment: Don't add extra s if the original object is already plural
+		{Kind: "lowercases", Plural: "lowercaseses", Singular: "lowercases"},
+	}
+	for i, testCase := range testCases {
+		mapper := NewDefaultRESTMapper([]schema.GroupVersion{testGroupVersion})
+		// create singular/plural mapping
+		mapper.Add(testGroupVersion.WithKind(testCase.Kind), RESTScopeNamespace)
+
+		singular, err := mapper.ResourceSingularizer(testCase.Plural)
+		if err != nil {
+			t.Errorf("%d: unexpected error: %v", i, err)
+		}
+		if singular != testCase.Singular {
+			t.Errorf("%d: mismatched singular: got %v, expected %v", i, singular, testCase.Singular)
+		}
+	}
+}
+
+func TestRESTMapperRESTMapping(t *testing.T) {
+	testGroup := "tgroup"
+	testGroupVersion := schema.GroupVersion{Group: testGroup, Version: "test"}
+	internalGroupVersion := schema.GroupVersion{Group: testGroup, Version: "test"}
+
+	testCases := []struct {
+		Kind             string
+		APIGroupVersions []schema.GroupVersion
+		DefaultVersions  []schema.GroupVersion
+
+		Resource             schema.GroupVersionResource
+		ExpectedGroupVersion *schema.GroupVersion
+		Err                  bool
+	}{
+		{Kind: "Unknown", Err: true},
+		{Kind: "InternalObject", Err: true},
+
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "Unknown", Err: true},
+
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "InternalObject", APIGroupVersions: []schema.GroupVersion{{Group: testGroup, Version: "test"}}, Resource: testGroupVersion.WithResource("internalobjects")},
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "InternalObject", APIGroupVersions: []schema.GroupVersion{{Group: testGroup, Version: "test"}}, Resource: testGroupVersion.WithResource("internalobjects")},
+
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "InternalObject", APIGroupVersions: []schema.GroupVersion{{Group: testGroup, Version: "test"}}, Resource: testGroupVersion.WithResource("internalobjects")},
+
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "InternalObject", APIGroupVersions: []schema.GroupVersion{}, Resource: internalGroupVersion.WithResource("internalobjects"), ExpectedGroupVersion: &schema.GroupVersion{Group: testGroup, Version: "test"}},
+
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "InternalObject", APIGroupVersions: []schema.GroupVersion{{Group: testGroup, Version: "test"}}, Resource: testGroupVersion.WithResource("internalobjects")},
+
+		// TODO: add test for a resource that exists in one version but not another
+	}
+	for i, testCase := range testCases {
+		mapper := NewDefaultRESTMapper(testCase.DefaultVersions)
+		mapper.Add(internalGroupVersion.WithKind("InternalObject"), RESTScopeNamespace)
+
+		preferredVersions := []string{}
+		for _, gv := range testCase.APIGroupVersions {
+			preferredVersions = append(preferredVersions, gv.Version)
+		}
+		gk := schema.GroupKind{Group: testGroup, Kind: testCase.Kind}
+
+		mapping, err := mapper.RESTMapping(gk, preferredVersions...)
+		hasErr := err != nil
+		if hasErr != testCase.Err {
+			t.Errorf("%d: unexpected error behavior %t: %v", i, testCase.Err, err)
+		}
+		if hasErr {
+			continue
+		}
+		if mapping.Resource != testCase.Resource {
+			t.Errorf("%d: unexpected resource: %#v", i, mapping)
+		}
+
+		groupVersion := testCase.ExpectedGroupVersion
+		if groupVersion == nil {
+			groupVersion = &testCase.APIGroupVersions[0]
+		}
+		if mapping.GroupVersionKind.GroupVersion() != *groupVersion {
+			t.Errorf("%d: unexpected version: %#v", i, mapping)
+		}
+
+	}
+}
+
+func TestRESTMapperRESTMappingSelectsVersion(t *testing.T) {
+	expectedGroupVersion1 := schema.GroupVersion{Group: "tgroup", Version: "test1"}
+	expectedGroupVersion2 := schema.GroupVersion{Group: "tgroup", Version: "test2"}
+	expectedGroupVersion3 := schema.GroupVersion{Group: "tgroup", Version: "test3"}
+	internalObjectGK := schema.GroupKind{Group: "tgroup", Kind: "InternalObject"}
+	otherObjectGK := schema.GroupKind{Group: "tgroup", Kind: "OtherObject"}
+
+	mapper := NewDefaultRESTMapper([]schema.GroupVersion{expectedGroupVersion1, expectedGroupVersion2})
+	mapper.Add(expectedGroupVersion1.WithKind("InternalObject"), RESTScopeNamespace)
+	mapper.Add(expectedGroupVersion2.WithKind("OtherObject"), RESTScopeNamespace)
+
+	// pick default matching object kind based on search order
+	mapping, err := mapper.RESTMapping(otherObjectGK)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if mapping.Resource != expectedGroupVersion2.WithResource("otherobjects") || mapping.GroupVersionKind.GroupVersion() != expectedGroupVersion2 {
+		t.Errorf("unexpected mapping: %#v", mapping)
+	}
+
+	mapping, err = mapper.RESTMapping(internalObjectGK)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if mapping.Resource != expectedGroupVersion1.WithResource("internalobjects") || mapping.GroupVersionKind.GroupVersion() != expectedGroupVersion1 {
+		t.Errorf("unexpected mapping: %#v", mapping)
+	}
+
+	// mismatch of version
+	_, err = mapper.RESTMapping(internalObjectGK, expectedGroupVersion2.Version)
+	if err == nil {
+		t.Errorf("unexpected non-error")
+	}
+	_, err = mapper.RESTMapping(otherObjectGK, expectedGroupVersion1.Version)
+	if err == nil {
+		t.Errorf("unexpected non-error")
+	}
+
+	// not in the search versions
+	_, err = mapper.RESTMapping(otherObjectGK, expectedGroupVersion3.Version)
+	if err == nil {
+		t.Errorf("unexpected non-error")
+	}
+
+	// explicit search order
+	_, err = mapper.RESTMapping(otherObjectGK, expectedGroupVersion3.Version, expectedGroupVersion1.Version)
+	if err == nil {
+		t.Errorf("unexpected non-error")
+	}
+
+	mapping, err = mapper.RESTMapping(otherObjectGK, expectedGroupVersion3.Version, expectedGroupVersion2.Version)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if mapping.Resource != expectedGroupVersion2.WithResource("otherobjects") || mapping.GroupVersionKind.GroupVersion() != expectedGroupVersion2 {
+		t.Errorf("unexpected mapping: %#v", mapping)
+	}
+}
+
+func TestRESTMapperRESTMappings(t *testing.T) {
+	testGroup := "tgroup"
+	testGroupVersion := schema.GroupVersion{Group: testGroup, Version: "v1"}
+
+	testCases := []struct {
+		Kind                string
+		APIGroupVersions    []schema.GroupVersion
+		DefaultVersions     []schema.GroupVersion
+		AddGroupVersionKind []schema.GroupVersionKind
+
+		ExpectedRESTMappings []*RESTMapping
+		Err                  bool
+	}{
+		{Kind: "Unknown", Err: true},
+		{Kind: "InternalObject", Err: true},
+
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "Unknown", Err: true},
+
+		// ask for specific version - not available - thus error
+		{DefaultVersions: []schema.GroupVersion{testGroupVersion}, Kind: "InternalObject", APIGroupVersions: []schema.GroupVersion{{Group: testGroup, Version: "v2"}}, Err: true},
+
+		// ask for specific version - available - check ExpectedRESTMappings
+		{
+			DefaultVersions:      []schema.GroupVersion{testGroupVersion},
+			Kind:                 "InternalObject",
+			APIGroupVersions:     []schema.GroupVersion{{Group: testGroup, Version: "v2"}},
+			AddGroupVersionKind:  []schema.GroupVersionKind{schema.GroupVersion{Group: testGroup, Version: "v2"}.WithKind("InternalObject")},
+			ExpectedRESTMappings: []*RESTMapping{{Resource: schema.GroupVersionResource{Group: testGroup, Version: "v2", Resource: "internalobjects"}, GroupVersionKind: schema.GroupVersionKind{Group: testGroup, Version: "v2", Kind: "InternalObject"}}},
+		},
+
+		// ask for specific versions - only one available - check ExpectedRESTMappings
+		{
+			DefaultVersions:      []schema.GroupVersion{testGroupVersion},
+			Kind:                 "InternalObject",
+			APIGroupVersions:     []schema.GroupVersion{{Group: testGroup, Version: "v3"}, {Group: testGroup, Version: "v2"}},
+			AddGroupVersionKind:  []schema.GroupVersionKind{schema.GroupVersion{Group: testGroup, Version: "v2"}.WithKind("InternalObject")},
+			ExpectedRESTMappings: []*RESTMapping{{Resource: schema.GroupVersionResource{Group: testGroup, Version: "v2", Resource: "internalobjects"}, GroupVersionKind: schema.GroupVersionKind{Group: testGroup, Version: "v2", Kind: "InternalObject"}}},
+		},
+
+		// do not ask for specific version - search through default versions - check ExpectedRESTMappings
+		{
+			DefaultVersions:     []schema.GroupVersion{testGroupVersion, {Group: testGroup, Version: "v2"}},
+			Kind:                "InternalObject",
+			AddGroupVersionKind: []schema.GroupVersionKind{schema.GroupVersion{Group: testGroup, Version: "v1"}.WithKind("InternalObject"), schema.GroupVersion{Group: testGroup, Version: "v2"}.WithKind("InternalObject")},
+			ExpectedRESTMappings: []*RESTMapping{
+				{
+					Resource:         schema.GroupVersionResource{Group: testGroup, Version: "v1", Resource: "internalobjects"},
+					GroupVersionKind: schema.GroupVersionKind{Group: testGroup, Version: "v1", Kind: "InternalObject"},
+				},
+				{
+					Resource:         schema.GroupVersionResource{Group: testGroup, Version: "v2", Resource: "internalobjects"},
+					GroupVersionKind: schema.GroupVersionKind{Group: testGroup, Version: "v2", Kind: "InternalObject"},
+				},
+			},
+		},
+	}
+
+	for i, testCase := range testCases {
+		mapper := NewDefaultRESTMapper(testCase.DefaultVersions)
+		for _, gvk := range testCase.AddGroupVersionKind {
+			mapper.Add(gvk, RESTScopeNamespace)
+		}
+
+		preferredVersions := []string{}
+		for _, gv := range testCase.APIGroupVersions {
+			preferredVersions = append(preferredVersions, gv.Version)
+		}
+		gk := schema.GroupKind{Group: testGroup, Kind: testCase.Kind}
+
+		mappings, err := mapper.RESTMappings(gk, preferredVersions...)
+		hasErr := err != nil
+		if hasErr != testCase.Err {
+			t.Errorf("%d: unexpected error behavior %t: %v", i, testCase.Err, err)
+		}
+		if hasErr {
+			continue
+		}
+		if len(mappings) != len(testCase.ExpectedRESTMappings) {
+			t.Errorf("%d: unexpected number = %d of rest mappings was returned, expected = %d", i, len(mappings), len(testCase.ExpectedRESTMappings))
+		}
+		for j, mapping := range mappings {
+			exp := testCase.ExpectedRESTMappings[j]
+			if mapping.Resource != exp.Resource {
+				t.Errorf("%d - %d: unexpected resource: %#v", i, j, mapping)
+			}
+			if mapping.GroupVersionKind != exp.GroupVersionKind {
+				t.Errorf("%d - %d: unexpected GroupVersionKind: %#v", i, j, mapping)
+			}
+		}
+	}
+}
+
+func TestRESTMapperReportsErrorOnBadVersion(t *testing.T) {
+	expectedGroupVersion1 := schema.GroupVersion{Group: "tgroup", Version: "test1"}
+	expectedGroupVersion2 := schema.GroupVersion{Group: "tgroup", Version: "test2"}
+	internalObjectGK := schema.GroupKind{Group: "tgroup", Kind: "InternalObject"}
+
+	mapper := NewDefaultRESTMapper([]schema.GroupVersion{expectedGroupVersion1, expectedGroupVersion2})
+	mapper.Add(expectedGroupVersion1.WithKind("InternalObject"), RESTScopeNamespace)
+	_, err := mapper.RESTMapping(internalObjectGK, "test3")
+	if err == nil {
+		t.Errorf("unexpected non-error")
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/table/table.go b/third_party/k8s.io/apimachinery/pkg/api/meta/table/table.go
new file mode 100644
index 0000000000..1887f32626
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/table/table.go
@@ -0,0 +1,70 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package table
+
+import (
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/duration"
+)
+
+// MetaToTableRow converts a list or object into one or more table rows. The provided rowFn is invoked for
+// each accessed item, with name and age being passed to each.
+func MetaToTableRow(obj runtime.Object, rowFn func(obj runtime.Object, m metav1.Object, name, age string) ([]interface{}, error)) ([]metav1.TableRow, error) {
+	if meta.IsListType(obj) {
+		rows := make([]metav1.TableRow, 0, 16)
+		err := meta.EachListItem(obj, func(obj runtime.Object) error {
+			nestedRows, err := MetaToTableRow(obj, rowFn)
+			if err != nil {
+				return err
+			}
+			rows = append(rows, nestedRows...)
+			return nil
+		})
+		if err != nil {
+			return nil, err
+		}
+		return rows, nil
+	}
+
+	rows := make([]metav1.TableRow, 0, 1)
+	m, err := meta.Accessor(obj)
+	if err != nil {
+		return nil, err
+	}
+	row := metav1.TableRow{
+		Object: runtime.RawExtension{Object: obj},
+	}
+	row.Cells, err = rowFn(obj, m, m.GetName(), ConvertToHumanReadableDateType(m.GetCreationTimestamp()))
+	if err != nil {
+		return nil, err
+	}
+	rows = append(rows, row)
+	return rows, nil
+}
+
+// ConvertToHumanReadableDateType returns the elapsed time since timestamp in
+// human-readable approximation.
+func ConvertToHumanReadableDateType(timestamp metav1.Time) string {
+	if timestamp.IsZero() {
+		return "<unknown>"
+	}
+	return duration.HumanDuration(time.Since(timestamp.Time))
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/meta/testrestmapper/test_restmapper.go b/third_party/k8s.io/apimachinery/pkg/api/meta/testrestmapper/test_restmapper.go
new file mode 100644
index 0000000000..72c6438cb6
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/meta/testrestmapper/test_restmapper.go
@@ -0,0 +1,165 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testrestmapper
+
+import (
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// TestOnlyStaticRESTMapper returns a union RESTMapper of all known types with priorities chosen in the following order:
+//  1. legacy kube group preferred version, extensions preferred version, metrics preferred version, legacy
+//     kube any version, extensions any version, metrics any version, all other groups alphabetical preferred version,
+//     all other groups alphabetical.
+//
+// TODO callers of this method should be updated to build their own specific restmapper based on their scheme for their tests
+// TODO the things being tested are related to whether various cases are handled, not tied to the particular types being checked.
+func TestOnlyStaticRESTMapper(scheme *runtime.Scheme, versionPatterns ...schema.GroupVersion) meta.RESTMapper {
+	unionMapper := meta.MultiRESTMapper{}
+	unionedGroups := sets.NewString()
+	for _, enabledVersion := range scheme.PrioritizedVersionsAllGroups() {
+		if !unionedGroups.Has(enabledVersion.Group) {
+			unionedGroups.Insert(enabledVersion.Group)
+			unionMapper = append(unionMapper, newRESTMapper(enabledVersion.Group, scheme))
+		}
+	}
+
+	if len(versionPatterns) != 0 {
+		resourcePriority := []schema.GroupVersionResource{}
+		kindPriority := []schema.GroupVersionKind{}
+		for _, versionPriority := range versionPatterns {
+			resourcePriority = append(resourcePriority, versionPriority.WithResource(meta.AnyResource))
+			kindPriority = append(kindPriority, versionPriority.WithKind(meta.AnyKind))
+		}
+
+		return meta.PriorityRESTMapper{Delegate: unionMapper, ResourcePriority: resourcePriority, KindPriority: kindPriority}
+	}
+
+	prioritizedGroups := []string{"", "extensions", "metrics"}
+	resourcePriority, kindPriority := prioritiesForGroups(scheme, prioritizedGroups...)
+
+	prioritizedGroupsSet := sets.NewString(prioritizedGroups...)
+	remainingGroups := sets.String{}
+	for _, enabledVersion := range scheme.PrioritizedVersionsAllGroups() {
+		if !prioritizedGroupsSet.Has(enabledVersion.Group) {
+			remainingGroups.Insert(enabledVersion.Group)
+		}
+	}
+
+	remainingResourcePriority, remainingKindPriority := prioritiesForGroups(scheme, remainingGroups.List()...)
+	resourcePriority = append(resourcePriority, remainingResourcePriority...)
+	kindPriority = append(kindPriority, remainingKindPriority...)
+
+	return meta.PriorityRESTMapper{Delegate: unionMapper, ResourcePriority: resourcePriority, KindPriority: kindPriority}
+}
+
+// prioritiesForGroups returns the resource and kind priorities for a PriorityRESTMapper, preferring the preferred version of each group first,
+// then any non-preferred version of the group second.
+func prioritiesForGroups(scheme *runtime.Scheme, groups ...string) ([]schema.GroupVersionResource, []schema.GroupVersionKind) {
+	resourcePriority := []schema.GroupVersionResource{}
+	kindPriority := []schema.GroupVersionKind{}
+
+	for _, group := range groups {
+		availableVersions := scheme.PrioritizedVersionsForGroup(group)
+		if len(availableVersions) > 0 {
+			resourcePriority = append(resourcePriority, availableVersions[0].WithResource(meta.AnyResource))
+			kindPriority = append(kindPriority, availableVersions[0].WithKind(meta.AnyKind))
+		}
+	}
+	for _, group := range groups {
+		resourcePriority = append(resourcePriority, schema.GroupVersionResource{Group: group, Version: meta.AnyVersion, Resource: meta.AnyResource})
+		kindPriority = append(kindPriority, schema.GroupVersionKind{Group: group, Version: meta.AnyVersion, Kind: meta.AnyKind})
+	}
+
+	return resourcePriority, kindPriority
+}
+
+func newRESTMapper(group string, scheme *runtime.Scheme) meta.RESTMapper {
+	mapper := meta.NewDefaultRESTMapper(scheme.PrioritizedVersionsForGroup(group))
+	for _, gv := range scheme.PrioritizedVersionsForGroup(group) {
+		for kind := range scheme.KnownTypes(gv) {
+			if ignoredKinds.Has(kind) {
+				continue
+			}
+			scope := meta.RESTScopeNamespace
+			if rootScopedKinds[gv.WithKind(kind).GroupKind()] {
+				scope = meta.RESTScopeRoot
+			}
+			mapper.Add(gv.WithKind(kind), scope)
+		}
+	}
+
+	return mapper
+}
+
+// hardcoded is good enough for the test we're running
+var rootScopedKinds = map[schema.GroupKind]bool{
+	{Group: "admission.k8s.io", Kind: "AdmissionReview"}: true,
+
+	{Group: "admissionregistration.k8s.io", Kind: "ValidatingWebhookConfiguration"}: true,
+	{Group: "admissionregistration.k8s.io", Kind: "MutatingWebhookConfiguration"}:   true,
+
+	{Group: "authentication.k8s.io", Kind: "TokenReview"}: true,
+
+	{Group: "authorization.k8s.io", Kind: "SubjectAccessReview"}:     true,
+	{Group: "authorization.k8s.io", Kind: "SelfSubjectAccessReview"}: true,
+	{Group: "authorization.k8s.io", Kind: "SelfSubjectRulesReview"}:  true,
+
+	{Group: "certificates.k8s.io", Kind: "CertificateSigningRequest"}: true,
+
+	{Group: "", Kind: "Node"}:             true,
+	{Group: "", Kind: "Namespace"}:        true,
+	{Group: "", Kind: "PersistentVolume"}: true,
+	{Group: "", Kind: "ComponentStatus"}:  true,
+
+	{Group: "rbac.authorization.k8s.io", Kind: "ClusterRole"}:        true,
+	{Group: "rbac.authorization.k8s.io", Kind: "ClusterRoleBinding"}: true,
+
+	{Group: "scheduling.k8s.io", Kind: "PriorityClass"}: true,
+
+	{Group: "storage.k8s.io", Kind: "StorageClass"}:     true,
+	{Group: "storage.k8s.io", Kind: "VolumeAttachment"}: true,
+
+	{Group: "apiextensions.k8s.io", Kind: "CustomResourceDefinition"}: true,
+
+	{Group: "apiserver.k8s.io", Kind: "AdmissionConfiguration"}: true,
+
+	{Group: "audit.k8s.io", Kind: "Event"}:  true,
+	{Group: "audit.k8s.io", Kind: "Policy"}: true,
+
+	{Group: "apiregistration.k8s.io", Kind: "APIService"}: true,
+
+	{Group: "metrics.k8s.io", Kind: "NodeMetrics"}: true,
+
+	{Group: "wardle.example.com", Kind: "Fischer"}: true,
+}
+
+// hardcoded is good enough for the test we're running
+var ignoredKinds = sets.NewString(
+	"ListOptions",
+	"DeleteOptions",
+	"Status",
+	"PodLogOptions",
+	"PodExecOptions",
+	"PodAttachOptions",
+	"PodPortForwardOptions",
+	"PodProxyOptions",
+	"NodeProxyOptions",
+	"ServiceProxyOptions",
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/api/operation/operation.go b/third_party/k8s.io/apimachinery/pkg/api/operation/operation.go
new file mode 100644
index 0000000000..cccc7e60c2
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/operation/operation.go
@@ -0,0 +1,100 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package operation
+
+import (
+	"strings"
+)
+
+// Operation provides contextual information about a validation request and the API
+// operation being validated.
+// This type is intended for use with generate validation code and may be enhanced
+// in the future to include other information needed to validate requests.
+type Operation struct {
+	// Type is the category of operation being validated.  This does not
+	// differentiate between HTTP verbs like PUT and PATCH, but rather merges
+	// those into a single "Update" category.
+	Type Type
+
+	// Options are the validation options in effect for this operation, mapping option
+	// name to whether it is enabled. Option names typically match feature gates, but an
+	// option may be enabled even when its feature gate is off — e.g. when the feature is
+	// already in use by the object being updated. Set by the resource strategy and
+	// read-only during validation.
+	//
+	// Every option a validation tag references must be defined here by the strategy; an
+	// option that is not defined is a programming error (see HasOption).
+	Options map[string]bool
+
+	// Request provides information about the request being validated.
+	Request Request
+}
+
+// HasOption returns whether the named option is enabled and whether it was defined by
+// the strategy. Every option a validation tag references must be defined; callers treat
+// an undefined option as an internal error (see validate.IfOption) rather than silently
+// as disabled.
+func (o Operation) HasOption(option string) (enabled, defined bool) {
+	enabled, defined = o.Options[option]
+	return
+}
+
+// Request provides information about the request being validated.
+type Request struct {
+	// Subresources identifies the subresource path components of the request. For
+	// example, Subresources for a request to `/api/v1/pods/my-pod/status` would be
+	// `["status"]`. For `/api/v1/widget/my-widget/x/y/z`, it would be `["x", "y",
+	// "z"]`. For a root resource (`/api/v1/pods/my-pod`), Subresources will be an
+	// empty slice.
+	//
+	// Validation logic should only consult this field if the validation rules for a
+	// particular field differ depending on whether the main resource or a specific
+	// subresource is being accessed. For example:
+	//
+	// Updates to a Pod resource (`/`) normally cannot change container resource
+	// requests/limits after the Pod is created (they are immutable). However, when
+	// accessing the Pod's "resize" subresource (`/resize`), these specific fields
+	// are allowed to be modified. In this scenario, the validation logic for
+	// `spec.container[*].resources` must check `Subresources` to permit changes only
+	// when the request targets the "resize" subresource.
+	//
+	// Note: This field should not be used to control which fields a subresource
+	// operation is allowed to write. This is the responsibility of "field wiping".
+	// Field wiping logic is expected to be handled in resource strategies by
+	// modifying the incoming object before it is validated.
+	Subresources []string
+}
+
+// SubresourcePath returns the path is a slash-separated list of subresource
+// names. For example, `/status`, `/resize`, or `/x/y/z`.
+func (r Request) SubresourcePath() string {
+	if len(r.Subresources) == 0 {
+		return "/"
+	}
+	return "/" + strings.Join(r.Subresources, "/")
+}
+
+// Code is the request operation to be validated.
+type Type uint32
+
+const (
+	// Create indicates the request being validated is for a resource create operation.
+	Create Type = iota
+
+	// Update indicates the request being validated is for a resource update operation.
+	Update
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/OWNERS b/third_party/k8s.io/apimachinery/pkg/api/resource/OWNERS
new file mode 100644
index 0000000000..063fd285da
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/OWNERS
@@ -0,0 +1,10 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+reviewers:
+  - thockin
+  - smarterclayton
+  - wojtek-t
+  - derekwaynecarr
+  - mikedanese
+  - saad-ali
+  - janetkuo
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/amount.go b/third_party/k8s.io/apimachinery/pkg/api/resource/amount.go
new file mode 100644
index 0000000000..2eebec667d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/amount.go
@@ -0,0 +1,337 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"math/big"
+	"strconv"
+
+	inf "gopkg.in/inf.v0"
+)
+
+// Scale is used for getting and setting the base-10 scaled value.
+// Base-2 scales are omitted for mathematical simplicity.
+// See Quantity.ScaledValue for more details.
+type Scale int32
+
+// infScale adapts a Scale value to an inf.Scale value.
+func (s Scale) infScale() inf.Scale {
+	return inf.Scale(-s) // inf.Scale is upside-down
+}
+
+const (
+	Nano  Scale = -9
+	Micro Scale = -6
+	Milli Scale = -3
+	Kilo  Scale = 3
+	Mega  Scale = 6
+	Giga  Scale = 9
+	Tera  Scale = 12
+	Peta  Scale = 15
+	Exa   Scale = 18
+)
+
+var (
+	Zero = int64Amount{}
+
+	// Used by quantity strings - treat as read only
+	zeroBytes = []byte("0")
+)
+
+// int64Amount represents a fixed precision numerator and arbitrary scale exponent. It is faster
+// than operations on inf.Dec for values that can be represented as int64.
+// +k8s:openapi-gen=true
+type int64Amount struct {
+	value int64
+	scale Scale
+}
+
+// Sign returns 0 if the value is zero, -1 if it is less than 0, or 1 if it is greater than 0.
+func (a int64Amount) Sign() int {
+	switch {
+	case a.value == 0:
+		return 0
+	case a.value > 0:
+		return 1
+	default:
+		return -1
+	}
+}
+
+// AsInt64 returns the current amount as an int64 at scale 0, or false if the value cannot be
+// represented in an int64 OR would result in a loss of precision. This method is intended as
+// an optimization to avoid calling AsDec.
+func (a int64Amount) AsInt64() (int64, bool) {
+	if a.scale == 0 {
+		return a.value, true
+	}
+	if a.scale < 0 {
+		// TODO: attempt to reduce factors, although it is assumed that factors are reduced prior
+		// to the int64Amount being created.
+		return 0, false
+	}
+	return positiveScaleInt64(a.value, a.scale)
+}
+
+// AsScaledInt64 returns an int64 representing the value of this amount at the specified scale,
+// rounding up, or false if that would result in overflow. (1e20).AsScaledInt64(1) would result
+// in overflow because 1e19 is not representable as an int64. Note that setting a scale larger
+// than the current value may result in loss of precision - i.e. (1e-6).AsScaledInt64(0) would
+// return 1, because 0.000001 is rounded up to 1.
+func (a int64Amount) AsScaledInt64(scale Scale) (result int64, ok bool) {
+	if a.scale < scale {
+		result, _ = negativeScaleInt64(a.value, scale-a.scale)
+		return result, true
+	}
+	return positiveScaleInt64(a.value, a.scale-scale)
+}
+
+// AsDec returns an inf.Dec representation of this value.
+func (a int64Amount) AsDec() *inf.Dec {
+	var base inf.Dec
+	base.SetUnscaled(a.value)
+	base.SetScale(inf.Scale(-a.scale))
+	return &base
+}
+
+// Cmp returns 0 if a and b are equal, 1 if a is greater than b, or -1 if a is less than b.
+func (a int64Amount) Cmp(b int64Amount) int {
+	switch {
+	case a.scale == b.scale:
+		// compare only the unscaled portion
+	case a.scale > b.scale:
+		result, remainder, exact := divideByScaleInt64(b.value, a.scale-b.scale)
+		if !exact {
+			return a.AsDec().Cmp(b.AsDec())
+		}
+		if result == a.value {
+			switch {
+			case remainder == 0:
+				return 0
+			case remainder > 0:
+				return -1
+			default:
+				return 1
+			}
+		}
+		b.value = result
+	default:
+		result, remainder, exact := divideByScaleInt64(a.value, b.scale-a.scale)
+		if !exact {
+			return a.AsDec().Cmp(b.AsDec())
+		}
+		if result == b.value {
+			switch {
+			case remainder == 0:
+				return 0
+			case remainder > 0:
+				return 1
+			default:
+				return -1
+			}
+		}
+		a.value = result
+	}
+
+	switch {
+	case a.value == b.value:
+		return 0
+	case a.value < b.value:
+		return -1
+	default:
+		return 1
+	}
+}
+
+// Add adds two int64Amounts together, matching scales. It will return false and not mutate
+// a if overflow or underflow would result.
+func (a *int64Amount) Add(b int64Amount) bool {
+	switch {
+	case b.value == 0:
+		return true
+	case a.value == 0:
+		a.value = b.value
+		a.scale = b.scale
+		return true
+	case a.scale == b.scale:
+		c, ok := int64Add(a.value, b.value)
+		if !ok {
+			return false
+		}
+		a.value = c
+	case a.scale > b.scale:
+		c, ok := positiveScaleInt64(a.value, a.scale-b.scale)
+		if !ok {
+			return false
+		}
+		c, ok = int64Add(c, b.value)
+		if !ok {
+			return false
+		}
+		a.scale = b.scale
+		a.value = c
+	default:
+		c, ok := positiveScaleInt64(b.value, b.scale-a.scale)
+		if !ok {
+			return false
+		}
+		c, ok = int64Add(a.value, c)
+		if !ok {
+			return false
+		}
+		a.value = c
+	}
+	return true
+}
+
+// Sub removes the value of b from the current amount, or returns false if underflow would result.
+func (a *int64Amount) Sub(b int64Amount) bool {
+	return a.Add(int64Amount{value: -b.value, scale: b.scale})
+}
+
+// Mul multiplies the provided b to the current amount, or
+// returns false if overflow or underflow would result.
+func (a *int64Amount) Mul(b int64) bool {
+	switch {
+	case a.value == 0:
+		return true
+	case b == 0:
+		a.value = 0
+		a.scale = 0
+		return true
+	case a.scale == 0:
+		c, ok := int64Multiply(a.value, b)
+		if !ok {
+			return false
+		}
+		a.value = c
+	case a.scale > 0:
+		c, ok := int64Multiply(a.value, b)
+		if !ok {
+			return false
+		}
+		if _, ok = positiveScaleInt64(c, a.scale); !ok {
+			return false
+		}
+		a.value = c
+	default:
+		c, ok := int64Multiply(a.value, b)
+		if !ok {
+			return false
+		}
+		if _, ok = negativeScaleInt64(c, -a.scale); !ok {
+			return false
+		}
+		a.value = c
+	}
+	return true
+}
+
+// AsScale adjusts this amount to set a minimum scale, rounding up, and returns true iff no precision
+// was lost. (1.1e5).AsScale(5) would return 1.1e5, but (1.1e5).AsScale(6) would return 1e6.
+func (a int64Amount) AsScale(scale Scale) (int64Amount, bool) {
+	if a.scale >= scale {
+		return a, true
+	}
+	result, exact := negativeScaleInt64(a.value, scale-a.scale)
+	return int64Amount{value: result, scale: scale}, exact
+}
+
+// AsCanonicalBytes accepts a buffer to write the base-10 string value of this field to, and returns
+// either that buffer or a larger buffer and the current exponent of the value. The value is adjusted
+// until the exponent is a multiple of 3 - i.e. 1.1e5 would return "110", 3.
+func (a int64Amount) AsCanonicalBytes(out []byte) (result []byte, exponent int32) {
+	mantissa := a.value
+	exponent = int32(a.scale)
+
+	amount, times := removeInt64Factors(mantissa, 10)
+	exponent += int32(times)
+
+	// make sure exponent is a multiple of 3
+	var ok bool
+	switch exponent % 3 {
+	case 1, -2:
+		amount, ok = int64MultiplyScale10(amount)
+		if !ok {
+			return infDecAmount{a.AsDec()}.AsCanonicalBytes(out)
+		}
+		exponent = exponent - 1
+	case 2, -1:
+		amount, ok = int64MultiplyScale100(amount)
+		if !ok {
+			return infDecAmount{a.AsDec()}.AsCanonicalBytes(out)
+		}
+		exponent = exponent - 2
+	}
+	return strconv.AppendInt(out, amount, 10), exponent
+}
+
+// AsCanonicalBase1024Bytes accepts a buffer to write the base-1024 string value of this field to, and returns
+// either that buffer or a larger buffer and the current exponent of the value. 2048 is 2 * 1024 ^ 1 and would
+// return []byte("2048"), 1.
+func (a int64Amount) AsCanonicalBase1024Bytes(out []byte) (result []byte, exponent int32) {
+	value, ok := a.AsScaledInt64(0)
+	if !ok {
+		return infDecAmount{a.AsDec()}.AsCanonicalBase1024Bytes(out)
+	}
+	amount, exponent := removeInt64Factors(value, 1024)
+	return strconv.AppendInt(out, amount, 10), exponent
+}
+
+// infDecAmount implements common operations over an inf.Dec that are specific to the quantity
+// representation.
+type infDecAmount struct {
+	*inf.Dec
+}
+
+// AsScale adjusts this amount to set a minimum scale, rounding up, and returns true iff no precision
+// was lost. (1.1e5).AsScale(5) would return 1.1e5, but (1.1e5).AsScale(6) would return 1e6.
+func (a infDecAmount) AsScale(scale Scale) (infDecAmount, bool) {
+	tmp := &inf.Dec{}
+	tmp.Round(a.Dec, scale.infScale(), inf.RoundUp)
+	return infDecAmount{tmp}, tmp.Cmp(a.Dec) == 0
+}
+
+// AsCanonicalBytes accepts a buffer to write the base-10 string value of this field to, and returns
+// either that buffer or a larger buffer and the current exponent of the value. The value is adjusted
+// until the exponent is a multiple of 3 - i.e. 1.1e5 would return "110", 3.
+func (a infDecAmount) AsCanonicalBytes(out []byte) (result []byte, exponent int32) {
+	mantissa := a.Dec.UnscaledBig()
+	exponent = int32(-a.Dec.Scale())
+	amount := big.NewInt(0).Set(mantissa)
+	// move all factors of 10 into the exponent for easy reasoning
+	amount, times := removeBigIntFactors(amount, bigTen)
+	exponent += times
+
+	// make sure exponent is a multiple of 3
+	for exponent%3 != 0 {
+		amount.Mul(amount, bigTen)
+		exponent--
+	}
+
+	return append(out, amount.String()...), exponent
+}
+
+// AsCanonicalBase1024Bytes accepts a buffer to write the base-1024 string value of this field to, and returns
+// either that buffer or a larger buffer and the current exponent of the value. 2048 is 2 * 1024 ^ 1 and would
+// return []byte("2048"), 1.
+func (a infDecAmount) AsCanonicalBase1024Bytes(out []byte) (result []byte, exponent int32) {
+	tmp := &inf.Dec{}
+	tmp.Round(a.Dec, 0, inf.RoundUp)
+	amount, exponent := removeBigIntFactors(tmp.UnscaledBig(), big1024)
+	return append(out, amount.String()...), exponent
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/amount_test.go b/third_party/k8s.io/apimachinery/pkg/api/resource/amount_test.go
new file mode 100644
index 0000000000..a6c4054b98
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/amount_test.go
@@ -0,0 +1,205 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"testing"
+)
+
+func TestInt64AmountAsInt64(t *testing.T) {
+	for _, test := range []struct {
+		value  int64
+		scale  Scale
+		result int64
+		ok     bool
+	}{
+		{100, 0, 100, true},
+		{100, 1, 1000, true},
+		{100, -5, 0, false},
+		{100, 100, 0, false},
+	} {
+		r, ok := int64Amount{value: test.value, scale: test.scale}.AsInt64()
+		if r != test.result {
+			t.Errorf("%v: unexpected result: %d", test, r)
+		}
+		if ok != test.ok {
+			t.Errorf("%v: unexpected ok: %t", test, ok)
+		}
+	}
+}
+
+func TestInt64AmountAdd(t *testing.T) {
+	for _, test := range []struct {
+		a, b, c int64Amount
+		ok      bool
+	}{
+		{int64Amount{value: 100, scale: 1}, int64Amount{value: 10, scale: 2}, int64Amount{value: 200, scale: 1}, true},
+		{int64Amount{value: 100, scale: 1}, int64Amount{value: 1, scale: 2}, int64Amount{value: 110, scale: 1}, true},
+		{int64Amount{value: 100, scale: 1}, int64Amount{value: 1, scale: 100}, int64Amount{value: 1, scale: 100}, false},
+		{int64Amount{value: -5, scale: 2}, int64Amount{value: 50, scale: 1}, int64Amount{value: 0, scale: 1}, true},
+		{int64Amount{value: -5, scale: 2}, int64Amount{value: 5, scale: 2}, int64Amount{value: 0, scale: 2}, true},
+
+		{int64Amount{value: mostPositive, scale: -1}, int64Amount{value: 1, scale: -1}, int64Amount{value: 0, scale: -1}, false},
+		{int64Amount{value: mostPositive, scale: -1}, int64Amount{value: 0, scale: -1}, int64Amount{value: mostPositive, scale: -1}, true},
+		{int64Amount{value: mostPositive / 10, scale: 1}, int64Amount{value: 10, scale: 0}, int64Amount{value: mostPositive, scale: -1}, false},
+	} {
+		c := test.a
+		ok := c.Add(test.b)
+		if ok != test.ok {
+			t.Errorf("%v: unexpected ok: %t", test, ok)
+		}
+		if ok {
+			if c != test.c {
+				t.Errorf("%v: unexpected result: %d", test, c)
+			}
+		} else {
+			if c != test.a {
+				t.Errorf("%v: overflow addition mutated source: %d", test, c)
+			}
+		}
+
+		// addition is commutative
+		c = test.b
+		if ok := c.Add(test.a); ok != test.ok {
+			t.Errorf("%v: unexpected ok: %t", test, ok)
+		}
+		if ok {
+			if c != test.c {
+				t.Errorf("%v: unexpected result: %d", test, c)
+			}
+		} else {
+			if c != test.b {
+				t.Errorf("%v: overflow addition mutated source: %d", test, c)
+			}
+		}
+	}
+}
+
+func TestInt64AmountMul(t *testing.T) {
+	for _, test := range []struct {
+		a  int64Amount
+		b  int64
+		c  int64Amount
+		ok bool
+	}{
+		{int64Amount{value: 100, scale: 1}, 1000, int64Amount{value: 100000, scale: 1}, true},
+		{int64Amount{value: 100, scale: -1}, 1000, int64Amount{value: 100000, scale: -1}, true},
+		{int64Amount{value: 1, scale: 100}, 10, int64Amount{value: 1, scale: 100}, false},
+		{int64Amount{value: 1, scale: -100}, 10, int64Amount{value: 1, scale: -100}, false},
+		{int64Amount{value: -5, scale: 2}, 500, int64Amount{value: -2500, scale: 2}, true},
+		{int64Amount{value: -5, scale: -2}, 500, int64Amount{value: -2500, scale: -2}, true},
+		{int64Amount{value: 0, scale: 1}, 0, int64Amount{value: 0, scale: 1}, true},
+
+		{int64Amount{value: mostPositive, scale: -1}, 10, int64Amount{value: mostPositive, scale: -1}, false},
+		{int64Amount{value: mostPositive, scale: -1}, 0, int64Amount{value: 0, scale: 0}, true},
+		{int64Amount{value: mostPositive, scale: 0}, 1, int64Amount{value: mostPositive, scale: 0}, true},
+		{int64Amount{value: mostPositive / 10, scale: 1}, 10, int64Amount{value: mostPositive / 10, scale: 1}, false},
+		{int64Amount{value: mostPositive, scale: 0}, -1, int64Amount{value: -mostPositive, scale: 0}, true},
+		{int64Amount{value: mostNegative, scale: 0}, 1, int64Amount{value: mostNegative, scale: 0}, true},
+		{int64Amount{value: mostNegative, scale: 1}, 0, int64Amount{value: 0, scale: 0}, true},
+		{int64Amount{value: mostNegative, scale: 1}, 1, int64Amount{value: mostNegative, scale: 1}, false},
+	} {
+		c := test.a
+		ok := c.Mul(test.b)
+		if ok && !test.ok {
+			t.Errorf("unextected success: %v", c)
+		} else if !ok && test.ok {
+			t.Errorf("unexpeted failure: %v", c)
+		} else if ok {
+			if c != test.c {
+				t.Errorf("%v: unexpected result: %d", test, c)
+			}
+		} else {
+			if c != test.a {
+				t.Errorf("%v: overflow multiplication mutated source: %d", test, c)
+			}
+		}
+	}
+}
+
+func TestInt64AsCanonicalString(t *testing.T) {
+	for _, test := range []struct {
+		value    int64
+		scale    Scale
+		result   string
+		exponent int32
+	}{
+		{100, 0, "100", 0},
+		{100, 1, "1", 3},
+		{100, -1, "10", 0},
+		{10800, -10, "1080", -9},
+	} {
+		r, exp := int64Amount{value: test.value, scale: test.scale}.AsCanonicalBytes(nil)
+		if string(r) != test.result {
+			t.Errorf("%v: unexpected result: %s", test, r)
+		}
+		if exp != test.exponent {
+			t.Errorf("%v: unexpected exponent: %d", test, exp)
+		}
+	}
+}
+
+func TestAmountSign(t *testing.T) {
+	table := []struct {
+		i      int64Amount
+		expect int
+	}{
+		{int64Amount{value: -50, scale: 1}, -1},
+		{int64Amount{value: 0, scale: 1}, 0},
+		{int64Amount{value: 300, scale: 1}, 1},
+		{int64Amount{value: -50, scale: -8}, -1},
+		{int64Amount{value: 50, scale: -8}, 1},
+		{int64Amount{value: 0, scale: -8}, 0},
+		{int64Amount{value: -50, scale: 0}, -1},
+		{int64Amount{value: 50, scale: 0}, 1},
+		{int64Amount{value: 0, scale: 0}, 0},
+	}
+	for _, testCase := range table {
+		if result := testCase.i.Sign(); result != testCase.expect {
+			t.Errorf("i: %v, Expected: %v, Actual: %v", testCase.i, testCase.expect, result)
+		}
+	}
+}
+
+func TestInt64AmountAsScaledInt64(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		i      int64Amount
+		scaled Scale
+		result int64
+		ok     bool
+	}{
+		{"test when i.scale < scaled ", int64Amount{value: 100, scale: 0}, 5, 1, true},
+		{"test when i.scale = scaled", int64Amount{value: 100, scale: 1}, 1, 100, true},
+		{"test when i.scale > scaled and result doesn't overflow", int64Amount{value: 100, scale: 5}, 2, 100000, true},
+		{"test when i.scale > scaled and result overflows", int64Amount{value: 876, scale: 30}, 4, 0, false},
+		{"test when i.scale < 0 and fraction exists", int64Amount{value: 93, scale: -1}, 0, 10, true},
+		{"test when i.scale < 0 and fraction doesn't exist", int64Amount{value: 100, scale: -1}, 0, 10, true},
+		{"test when i.value < 0 and fraction exists", int64Amount{value: -1932, scale: 2}, 4, -20, true},
+		{"test when i.value < 0 and fraction doesn't exists", int64Amount{value: -1900, scale: 2}, 4, -19, true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			r, ok := test.i.AsScaledInt64(test.scaled)
+			if r != test.result {
+				t.Errorf("%v: expected result: %d, got result: %d", test.name, test.result, r)
+			}
+			if ok != test.ok {
+				t.Errorf("%v: expected ok: %t, got ok: %t", test.name, test.ok, ok)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/generated.pb.go b/third_party/k8s.io/apimachinery/pkg/api/resource/generated.pb.go
new file mode 100644
index 0000000000..9e1a5c0e1f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/generated.pb.go
@@ -0,0 +1,24 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/apimachinery/pkg/api/resource/generated.proto
+
+package resource
+
+func (m *Quantity) Reset() { *m = Quantity{} }
+
+func (m *QuantityValue) Reset() { *m = QuantityValue{} }
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/generated.proto b/third_party/k8s.io/apimachinery/pkg/api/resource/generated.proto
new file mode 100644
index 0000000000..875ad8577a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/generated.proto
@@ -0,0 +1,113 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.apimachinery.pkg.api.resource;
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/apimachinery/pkg/api/resource";
+
+// Quantity is a fixed-point representation of a number.
+// It provides convenient marshaling/unmarshaling in JSON and YAML,
+// in addition to String() and AsInt64() accessors.
+//
+// The serialization format is:
+//
+// ```
+// <quantity>        ::= <signedNumber><suffix>
+//
+// 	(Note that <suffix> may be empty, from the "" case in <decimalSI>.)
+//
+// <digit>           ::= 0 | 1 | ... | 9
+// <digits>          ::= <digit> | <digit><digits>
+// <number>          ::= <digits> | <digits>.<digits> | <digits>. | .<digits>
+// <sign>            ::= "+" | "-"
+// <signedNumber>    ::= <number> | <sign><number>
+// <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI>
+// <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei
+//
+// 	(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)
+//
+// <decimalSI>       ::= m | "" | k | M | G | T | P | E
+//
+// 	(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)
+//
+// <decimalExponent> ::= "e" <signedNumber> | "E" <signedNumber>
+// ```
+//
+// No matter which of the three exponent forms is used, no quantity may represent
+// a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal
+// places. Numbers larger or more precise will be capped or rounded up.
+// (E.g.: 0.1m will rounded up to 1m.)
+// This may be extended in the future if we require larger or smaller quantities.
+//
+// When a Quantity is parsed from a string, it will remember the type of suffix
+// it had, and will use the same type again when it is serialized.
+//
+// Before serializing, Quantity will be put in "canonical form".
+// This means that Exponent/suffix will be adjusted up or down (with a
+// corresponding increase or decrease in Mantissa) such that:
+//
+// - No precision is lost
+// - No fractional digits will be emitted
+// - The exponent (or suffix) is as large as possible.
+//
+// The sign will be omitted unless the number is negative.
+//
+// Examples:
+//
+// - 1.5 will be serialized as "1500m"
+// - 1.5Gi will be serialized as "1536Mi"
+//
+// Note that the quantity will NEVER be internally represented by a
+// floating point number. That is the whole point of this exercise.
+//
+// Non-canonical values will still parse as long as they are well formed,
+// but will be re-emitted in their canonical form. (So always use canonical
+// form, or don't diff.)
+//
+// This format is intended to make it difficult to use these numbers without
+// writing some sort of special handling code in the hopes that that will
+// cause implementors to also use a fixed point implementation.
+//
+// +protobuf=true
+// +protobuf.embed=string
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:deepcopy-gen=true
+// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.api.resource
+message Quantity {
+  optional string string = 1;
+}
+
+// QuantityValue makes it possible to use a Quantity as value for a command
+// line parameter.
+//
+// +protobuf=true
+// +protobuf.embed=string
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:deepcopy-gen=true
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.api.resource
+message QuantityValue {
+  optional string string = 1;
+}
+
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/math.go b/third_party/k8s.io/apimachinery/pkg/api/resource/math.go
new file mode 100644
index 0000000000..8ffcb9f09a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/math.go
@@ -0,0 +1,310 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"math/big"
+
+	inf "gopkg.in/inf.v0"
+)
+
+const (
+	// maxInt64Factors is the highest value that will be checked when removing factors of 10 from an int64.
+	// It is also the maximum decimal digits that can be represented with an int64.
+	maxInt64Factors = 18
+)
+
+var (
+	// Commonly needed big.Int values-- treat as read only!
+	bigTen      = big.NewInt(10)
+	bigZero     = big.NewInt(0)
+	bigOne      = big.NewInt(1)
+	bigThousand = big.NewInt(1000)
+	big1024     = big.NewInt(1024)
+
+	// Commonly needed inf.Dec values-- treat as read only!
+	decZero = inf.NewDec(0, 0)
+	decOne  = inf.NewDec(1, 0)
+
+	// Largest (in magnitude) number allowed.
+	maxAllowed = infDecAmount{inf.NewDec((1<<63)-1, 0)} // == max int64
+
+	// The maximum value we can represent milli-units for.
+	// Compare with the return value of Quantity.Value() to
+	// see if it's safe to use Quantity.MilliValue().
+	MaxMilliValue = int64(((1 << 63) - 1) / 1000)
+)
+
+const mostNegative = -(mostPositive + 1)
+const mostPositive = 1<<63 - 1
+
+// int64Add returns a+b, or false if that would overflow int64.
+func int64Add(a, b int64) (int64, bool) {
+	c := a + b
+	switch {
+	case a > 0 && b > 0:
+		if c < 0 {
+			return 0, false
+		}
+	case a < 0 && b < 0:
+		if c > 0 {
+			return 0, false
+		}
+		if a == mostNegative && b == mostNegative {
+			return 0, false
+		}
+	}
+	return c, true
+}
+
+// int64Multiply returns a*b, or false if that would overflow or underflow int64.
+func int64Multiply(a, b int64) (int64, bool) {
+	if a == 0 || b == 0 || a == 1 || b == 1 {
+		return a * b, true
+	}
+	if a == mostNegative || b == mostNegative {
+		return 0, false
+	}
+	c := a * b
+	return c, c/b == a
+}
+
+// int64MultiplyScale returns a*b, assuming b is greater than one, or false if that would overflow or underflow int64.
+// Use when b is known to be greater than one.
+func int64MultiplyScale(a int64, b int64) (int64, bool) {
+	if a == 0 || a == 1 {
+		return a * b, true
+	}
+	if a == mostNegative && b != 1 {
+		return 0, false
+	}
+	c := a * b
+	return c, c/b == a
+}
+
+// int64MultiplyScale10 multiplies a by 10, or returns false if that would overflow. This method is faster than
+// int64Multiply(a, 10) because the compiler can optimize constant factor multiplication.
+func int64MultiplyScale10(a int64) (int64, bool) {
+	if a == 0 || a == 1 {
+		return a * 10, true
+	}
+	if a == mostNegative {
+		return 0, false
+	}
+	c := a * 10
+	return c, c/10 == a
+}
+
+// int64MultiplyScale100 multiplies a by 100, or returns false if that would overflow. This method is faster than
+// int64Multiply(a, 100) because the compiler can optimize constant factor multiplication.
+func int64MultiplyScale100(a int64) (int64, bool) {
+	if a == 0 || a == 1 {
+		return a * 100, true
+	}
+	if a == mostNegative {
+		return 0, false
+	}
+	c := a * 100
+	return c, c/100 == a
+}
+
+// int64MultiplyScale1000 multiplies a by 1000, or returns false if that would overflow. This method is faster than
+// int64Multiply(a, 1000) because the compiler can optimize constant factor multiplication.
+func int64MultiplyScale1000(a int64) (int64, bool) {
+	if a == 0 || a == 1 {
+		return a * 1000, true
+	}
+	if a == mostNegative {
+		return 0, false
+	}
+	c := a * 1000
+	return c, c/1000 == a
+}
+
+// positiveScaleInt64 multiplies base by 10^scale, returning false if the
+// value overflows. Passing a negative scale is undefined.
+func positiveScaleInt64(base int64, scale Scale) (int64, bool) {
+	switch scale {
+	case 0:
+		return base, true
+	case 1:
+		return int64MultiplyScale10(base)
+	case 2:
+		return int64MultiplyScale100(base)
+	case 3:
+		return int64MultiplyScale1000(base)
+	case 6:
+		return int64MultiplyScale(base, 1000000)
+	case 9:
+		return int64MultiplyScale(base, 1000000000)
+	default:
+		value := base
+		var ok bool
+		for i := Scale(0); i < scale; i++ {
+			if value, ok = int64MultiplyScale(value, 10); !ok {
+				return 0, false
+			}
+		}
+		return value, true
+	}
+}
+
+// negativeScaleInt64 reduces base by the provided scale, rounding up, until the
+// value is zero or the scale is reached. Passing a negative scale is undefined.
+// The value returned, if not exact, is rounded away from zero.
+func negativeScaleInt64(base int64, scale Scale) (result int64, exact bool) {
+	if scale == 0 {
+		return base, true
+	}
+
+	value := base
+	var fraction bool
+	for i := Scale(0); i < scale; i++ {
+		if !fraction && value%10 != 0 {
+			fraction = true
+		}
+		value = value / 10
+		if value == 0 {
+			if fraction {
+				if base > 0 {
+					return 1, false
+				}
+				return -1, false
+			}
+			return 0, true
+		}
+	}
+	if fraction {
+		if base > 0 {
+			value++
+		} else {
+			value--
+		}
+	}
+	return value, !fraction
+}
+
+func pow10Int64(b int64) int64 {
+	switch b {
+	case 0:
+		return 1
+	case 1:
+		return 10
+	case 2:
+		return 100
+	case 3:
+		return 1000
+	case 4:
+		return 10000
+	case 5:
+		return 100000
+	case 6:
+		return 1000000
+	case 7:
+		return 10000000
+	case 8:
+		return 100000000
+	case 9:
+		return 1000000000
+	case 10:
+		return 10000000000
+	case 11:
+		return 100000000000
+	case 12:
+		return 1000000000000
+	case 13:
+		return 10000000000000
+	case 14:
+		return 100000000000000
+	case 15:
+		return 1000000000000000
+	case 16:
+		return 10000000000000000
+	case 17:
+		return 100000000000000000
+	case 18:
+		return 1000000000000000000
+	default:
+		return 0
+	}
+}
+
+// negativeScaleInt64 returns the result of dividing base by scale * 10 and the remainder, or
+// false if no such division is possible. Dividing by negative scales is undefined.
+func divideByScaleInt64(base int64, scale Scale) (result, remainder int64, exact bool) {
+	if scale == 0 {
+		return base, 0, true
+	}
+	// the max scale representable in base 10 in an int64 is 18 decimal places
+	if scale >= 18 {
+		return 0, base, false
+	}
+	divisor := pow10Int64(int64(scale))
+	return base / divisor, base % divisor, true
+}
+
+// removeInt64Factors divides in a loop; the return values have the property that
+// value == result * base ^ scale
+func removeInt64Factors(value int64, base int64) (result int64, times int32) {
+	times = 0
+	result = value
+	negative := result < 0
+	if negative {
+		result = -result
+	}
+	switch base {
+	// allow the compiler to optimize the common cases
+	case 10:
+		for result >= 10 && result%10 == 0 {
+			times++
+			result = result / 10
+		}
+	// allow the compiler to optimize the common cases
+	case 1024:
+		for result >= 1024 && result%1024 == 0 {
+			times++
+			result = result / 1024
+		}
+	default:
+		for result >= base && result%base == 0 {
+			times++
+			result = result / base
+		}
+	}
+	if negative {
+		result = -result
+	}
+	return result, times
+}
+
+// removeBigIntFactors divides in a loop; the return values have the property that
+// d == result * factor ^ times
+// d may be modified in place.
+// If d == 0, then the return values will be (0, 0)
+func removeBigIntFactors(d, factor *big.Int) (result *big.Int, times int32) {
+	q := big.NewInt(0)
+	m := big.NewInt(0)
+	for d.Cmp(bigZero) != 0 {
+		q.DivMod(d, factor, m)
+		if m.Cmp(bigZero) != 0 {
+			break
+		}
+		times++
+		d, q = q, d
+	}
+	return d, times
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/math_test.go b/third_party/k8s.io/apimachinery/pkg/api/resource/math_test.go
new file mode 100644
index 0000000000..070a0c237e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/math_test.go
@@ -0,0 +1,211 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"testing"
+)
+
+func TestDetectOverflowAdd(t *testing.T) {
+	for _, test := range []struct {
+		a, b int64
+		c    int64
+		ok   bool
+	}{
+		{0, 0, 0, true},
+		{-1, 1, 0, true},
+		{0, 1, 1, true},
+		{2, 2, 4, true},
+		{2, -2, 0, true},
+		{-2, -2, -4, true},
+
+		{mostNegative, -1, 0, false},
+		{mostNegative, 1, mostNegative + 1, true},
+		{mostPositive, -1, mostPositive - 1, true},
+		{mostPositive, 1, 0, false},
+
+		{mostNegative, mostPositive, -1, true},
+		{mostPositive, mostNegative, -1, true},
+		{mostPositive, mostPositive, 0, false},
+		{mostNegative, mostNegative, 0, false},
+
+		{-mostPositive, mostNegative, 0, false},
+		{mostNegative, -mostPositive, 0, false},
+		{-mostPositive, -mostPositive, 0, false},
+	} {
+		c, ok := int64Add(test.a, test.b)
+		if c != test.c {
+			t.Errorf("%v: unexpected result: %d", test, c)
+		}
+		if ok != test.ok {
+			t.Errorf("%v: unexpected overflow: %t", test, ok)
+		}
+		// addition is commutative
+		d, ok2 := int64Add(test.b, test.a)
+		if c != d || ok != ok2 {
+			t.Errorf("%v: not commutative: %d %t", test, d, ok2)
+		}
+	}
+}
+
+func TestDetectOverflowMultiply(t *testing.T) {
+	for _, test := range []struct {
+		a, b int64
+		c    int64
+		ok   bool
+	}{
+		{0, 0, 0, true},
+		{-1, 1, -1, true},
+		{-1, -1, 1, true},
+		{1, 1, 1, true},
+		{0, 1, 0, true},
+		{1, 0, 0, true},
+		{2, 2, 4, true},
+		{2, -2, -4, true},
+		{-2, -2, 4, true},
+
+		{mostNegative, -1, 0, false},
+		{mostNegative, 1, mostNegative, true},
+		{mostPositive, -1, -mostPositive, true},
+		{mostPositive, 1, mostPositive, true},
+
+		{mostNegative, mostPositive, 0, false},
+		{mostPositive, mostNegative, 0, false},
+		{mostPositive, mostPositive, 1, false},
+		{mostNegative, mostNegative, 0, false},
+
+		{-mostPositive, mostNegative, 0, false},
+		{mostNegative, -mostPositive, 0, false},
+		{-mostPositive, -mostPositive, 1, false},
+	} {
+		c, ok := int64Multiply(test.a, test.b)
+		if c != test.c {
+			t.Errorf("%v: unexpected result: %d", test, c)
+		}
+		if ok != test.ok {
+			t.Errorf("%v: unexpected overflow: %t", test, ok)
+		}
+		// multiplication is commutative
+		d, ok2 := int64Multiply(test.b, test.a)
+		if c != d || ok != ok2 {
+			t.Errorf("%v: not commutative: %d %t", test, d, ok2)
+		}
+	}
+}
+
+func TestDetectOverflowScale(t *testing.T) {
+	for _, a := range []int64{0, -1, 1, 10, -10, mostPositive, mostNegative, -mostPositive} {
+		for _, b := range []int64{1, 2, 10, 100, 1000, mostPositive} {
+			expect, expectOk := int64Multiply(a, b)
+
+			c, ok := int64MultiplyScale(a, b)
+			if c != expect {
+				t.Errorf("%d*%d: unexpected result: %d", a, b, c)
+			}
+			if ok != expectOk {
+				t.Errorf("%d*%d: unexpected overflow: %t", a, b, ok)
+			}
+		}
+		for _, test := range []struct {
+			base int64
+			fn   func(a int64) (int64, bool)
+		}{
+			{10, int64MultiplyScale10},
+			{100, int64MultiplyScale100},
+			{1000, int64MultiplyScale1000},
+		} {
+			expect, expectOk := int64Multiply(a, test.base)
+			c, ok := test.fn(a)
+			if c != expect {
+				t.Errorf("%d*%d: unexpected result: %d", a, test.base, c)
+			}
+			if ok != expectOk {
+				t.Errorf("%d*%d: unexpected overflow: %t", a, test.base, ok)
+			}
+		}
+	}
+}
+
+func TestRemoveInt64Factors(t *testing.T) {
+	for _, test := range []struct {
+		value  int64
+		max    int64
+		result int64
+		scale  int32
+	}{
+		{100, 10, 1, 2},
+		{100, 10, 1, 2},
+		{100, 100, 1, 1},
+		{1, 10, 1, 0},
+	} {
+		r, s := removeInt64Factors(test.value, test.max)
+		if r != test.result {
+			t.Errorf("%v: unexpected result: %d", test, r)
+		}
+		if s != test.scale {
+			t.Errorf("%v: unexpected scale: %d", test, s)
+		}
+	}
+}
+
+func TestNegativeScaleInt64(t *testing.T) {
+	for _, test := range []struct {
+		base   int64
+		scale  Scale
+		result int64
+		exact  bool
+	}{
+		{1234567, 0, 1234567, true},
+		{1234567, 1, 123457, false},
+		{1234567, 2, 12346, false},
+		{1234567, 3, 1235, false},
+		{1234567, 4, 124, false},
+
+		{-1234567, 0, -1234567, true},
+		{-1234567, 1, -123457, false},
+		{-1234567, 2, -12346, false},
+		{-1234567, 3, -1235, false},
+		{-1234567, 4, -124, false},
+
+		{1000, 0, 1000, true},
+		{1000, 1, 100, true},
+		{1000, 2, 10, true},
+		{1000, 3, 1, true},
+		{1000, 4, 1, false},
+
+		{-1000, 0, -1000, true},
+		{-1000, 1, -100, true},
+		{-1000, 2, -10, true},
+		{-1000, 3, -1, true},
+		{-1000, 4, -1, false},
+
+		{0, 0, 0, true},
+		{0, 1, 0, true},
+		{0, 2, 0, true},
+
+		// negative scale is undefined behavior
+		{1000, -1, 1000, true},
+	} {
+		result, exact := negativeScaleInt64(test.base, test.scale)
+		if result != test.result {
+			t.Errorf("%v: unexpected result: %d", test, result)
+		}
+		if exact != test.exact {
+			t.Errorf("%v: unexpected exact: %t", test, exact)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/quantity.go b/third_party/k8s.io/apimachinery/pkg/api/resource/quantity.go
new file mode 100644
index 0000000000..e6b1f1b535
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/quantity.go
@@ -0,0 +1,891 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	math "math"
+	"math/big"
+	"strconv"
+	"strings"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+
+	inf "gopkg.in/inf.v0"
+)
+
+// Quantity is a fixed-point representation of a number.
+// It provides convenient marshaling/unmarshaling in JSON and YAML,
+// in addition to String() and AsInt64() accessors.
+//
+// The serialization format is:
+//
+// ```
+// <quantity>        ::= <signedNumber><suffix>
+//
+//	(Note that <suffix> may be empty, from the "" case in <decimalSI>.)
+//
+// <digit>           ::= 0 | 1 | ... | 9
+// <digits>          ::= <digit> | <digit><digits>
+// <number>          ::= <digits> | <digits>.<digits> | <digits>. | .<digits>
+// <sign>            ::= "+" | "-"
+// <signedNumber>    ::= <number> | <sign><number>
+// <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI>
+// <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei
+//
+//	(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)
+//
+// <decimalSI>       ::= m | "" | k | M | G | T | P | E
+//
+//	(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)
+//
+// <decimalExponent> ::= "e" <signedNumber> | "E" <signedNumber>
+// ```
+//
+// No matter which of the three exponent forms is used, no quantity may represent
+// a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal
+// places. Numbers larger or more precise will be capped or rounded up.
+// (E.g.: 0.1m will rounded up to 1m.)
+// This may be extended in the future if we require larger or smaller quantities.
+//
+// When a Quantity is parsed from a string, it will remember the type of suffix
+// it had, and will use the same type again when it is serialized.
+//
+// Before serializing, Quantity will be put in "canonical form".
+// This means that Exponent/suffix will be adjusted up or down (with a
+// corresponding increase or decrease in Mantissa) such that:
+//
+// - No precision is lost
+// - No fractional digits will be emitted
+// - The exponent (or suffix) is as large as possible.
+//
+// The sign will be omitted unless the number is negative.
+//
+// Examples:
+//
+// - 1.5 will be serialized as "1500m"
+// - 1.5Gi will be serialized as "1536Mi"
+//
+// Note that the quantity will NEVER be internally represented by a
+// floating point number. That is the whole point of this exercise.
+//
+// Non-canonical values will still parse as long as they are well formed,
+// but will be re-emitted in their canonical form. (So always use canonical
+// form, or don't diff.)
+//
+// This format is intended to make it difficult to use these numbers without
+// writing some sort of special handling code in the hopes that that will
+// cause implementors to also use a fixed point implementation.
+//
+// +protobuf=true
+// +protobuf.embed=string
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:deepcopy-gen=true
+// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.api.resource
+type Quantity struct {
+	// i is the quantity in int64 scaled form, if d.Dec == nil
+	i int64Amount
+	// d is the quantity in inf.Dec form if d.Dec != nil
+	d infDecAmount
+	// s is the generated value of this quantity to avoid recalculation
+	s string
+
+	// Change Format at will. See the comment for Canonicalize for
+	// more details.
+	Format
+}
+
+// CanonicalValue allows a quantity amount to be converted to a string.
+type CanonicalValue interface {
+	// AsCanonicalBytes returns a byte array representing the string representation
+	// of the value mantissa and an int32 representing its exponent in base-10. Callers may
+	// pass a byte slice to the method to avoid allocations.
+	AsCanonicalBytes(out []byte) ([]byte, int32)
+	// AsCanonicalBase1024Bytes returns a byte array representing the string representation
+	// of the value mantissa and an int32 representing its exponent in base-1024. Callers
+	// may pass a byte slice to the method to avoid allocations.
+	AsCanonicalBase1024Bytes(out []byte) ([]byte, int32)
+}
+
+// Format lists the three possible formattings of a quantity.
+type Format string
+
+const (
+	DecimalExponent = Format("DecimalExponent") // e.g., 12e6
+	BinarySI        = Format("BinarySI")        // e.g., 12Mi (12 * 2^20)
+	DecimalSI       = Format("DecimalSI")       // e.g., 12M  (12 * 10^6)
+)
+
+// MustParse turns the given string into a quantity or panics; for tests
+// or other cases where you know the string is valid.
+func MustParse(str string) Quantity {
+	q, err := ParseQuantity(str)
+	if err != nil {
+		panic(fmt.Errorf("cannot parse '%v': %v", str, err))
+	}
+	return q
+}
+
+const (
+	// splitREString is used to separate a number from its suffix; as such,
+	// this is overly permissive, but that's OK-- it will be checked later.
+	splitREString = "^([+-]?[0-9.]+)([eEinumkKMGTP]*[-+]?[0-9]*)$"
+)
+
+var (
+	// Errors that could happen while parsing a string.
+	ErrFormatWrong = errors.New("quantities must match the regular expression '" + splitREString + "'")
+	ErrNumeric     = errors.New("unable to parse numeric part of quantity")
+	ErrSuffix      = errors.New("unable to parse quantity's suffix")
+)
+
+// parseQuantityString is a fast scanner for quantity values.
+func parseQuantityString(str string) (positive bool, value, num, denom, suffix string, err error) {
+	positive = true
+	pos := 0
+	end := len(str)
+
+	// handle leading sign
+	if pos < end {
+		switch str[0] {
+		case '-':
+			positive = false
+			pos++
+		case '+':
+			pos++
+		}
+	}
+
+	// strip leading zeros
+Zeroes:
+	for i := pos; ; i++ {
+		if i >= end {
+			num = "0"
+			value = num
+			return
+		}
+		switch str[i] {
+		case '0':
+			pos++
+		default:
+			break Zeroes
+		}
+	}
+
+	// extract the numerator
+Num:
+	for i := pos; ; i++ {
+		if i >= end {
+			num = str[pos:end]
+			value = str[0:end]
+			return
+		}
+		switch str[i] {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+		default:
+			num = str[pos:i]
+			pos = i
+			break Num
+		}
+	}
+
+	// if we stripped all numerator positions, always return 0
+	if len(num) == 0 {
+		num = "0"
+	}
+
+	// handle a denominator
+	if pos < end && str[pos] == '.' {
+		pos++
+	Denom:
+		for i := pos; ; i++ {
+			if i >= end {
+				denom = str[pos:end]
+				value = str[0:end]
+				return
+			}
+			switch str[i] {
+			case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			default:
+				denom = str[pos:i]
+				pos = i
+				break Denom
+			}
+		}
+		// TODO: we currently allow 1.G, but we may not want to in the future.
+		// if len(denom) == 0 {
+		// 	err = ErrFormatWrong
+		// 	return
+		// }
+	}
+	value = str[0:pos]
+
+	// grab the elements of the suffix
+	suffixStart := pos
+	for i := pos; ; i++ {
+		if i >= end {
+			suffix = str[suffixStart:end]
+			return
+		}
+		if !strings.ContainsAny(str[i:i+1], "eEinumkKMGTP") {
+			pos = i
+			break
+		}
+	}
+	if pos < end {
+		switch str[pos] {
+		case '-', '+':
+			pos++
+		}
+	}
+Suffix:
+	for i := pos; ; i++ {
+		if i >= end {
+			suffix = str[suffixStart:end]
+			return
+		}
+		switch str[i] {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+		default:
+			break Suffix
+		}
+	}
+	// we encountered a non decimal in the Suffix loop, but the last character
+	// was not a valid exponent
+	err = ErrFormatWrong
+	return
+}
+
+// ParseQuantity turns str into a Quantity, or returns an error.
+func ParseQuantity(str string) (Quantity, error) {
+	if len(str) == 0 {
+		return Quantity{}, ErrFormatWrong
+	}
+	if str == "0" {
+		return Quantity{Format: DecimalSI, s: str}, nil
+	}
+
+	positive, value, num, denom, suf, err := parseQuantityString(str)
+	if err != nil {
+		return Quantity{}, err
+	}
+
+	base, exponent, format, ok := quantitySuffixer.interpret(suffix(suf))
+	if !ok {
+		return Quantity{}, ErrSuffix
+	}
+
+	precision := int32(0)
+	scale := int32(0)
+	mantissa := int64(1)
+	switch format {
+	case DecimalExponent, DecimalSI:
+		scale = exponent
+		precision = maxInt64Factors - int32(len(num)+len(denom))
+	case BinarySI:
+		scale = 0
+		switch {
+		case exponent >= 0 && len(denom) == 0:
+			// only handle positive binary numbers with the fast path
+			mantissa = int64(int64(mantissa) << uint64(exponent))
+			// 1Mi (2^20) has ~6 digits of decimal precision, so exponent*3/10 -1 is roughly the precision
+			precision = 15 - int32(len(num)) - int32(float32(exponent)*3/10) - 1
+		default:
+			precision = -1
+		}
+	}
+
+	if precision >= 0 {
+		// if we have a denominator, shift the entire value to the left by the number of places in the
+		// denominator
+		scale -= int32(len(denom))
+		if scale >= int32(Nano) {
+			shifted := num + denom
+
+			var value int64
+			value, err := strconv.ParseInt(shifted, 10, 64)
+			if err != nil {
+				return Quantity{}, ErrNumeric
+			}
+			if result, ok := int64Multiply(value, int64(mantissa)); ok {
+				if !positive {
+					result = -result
+				}
+				// if the number is in canonical form, reuse the string
+				switch format {
+				case BinarySI:
+					if exponent%10 == 0 && (value&0x07 != 0) {
+						return Quantity{i: int64Amount{value: result, scale: Scale(scale)}, Format: format, s: str}, nil
+					}
+				default:
+					if scale%3 == 0 && !strings.HasSuffix(shifted, "000") && shifted[0] != '0' {
+						return Quantity{i: int64Amount{value: result, scale: Scale(scale)}, Format: format, s: str}, nil
+					}
+				}
+				return Quantity{i: int64Amount{value: result, scale: Scale(scale)}, Format: format}, nil
+			}
+		}
+	}
+
+	amount := new(inf.Dec)
+	if _, ok := amount.SetString(value); !ok {
+		return Quantity{}, ErrNumeric
+	}
+
+	// So that no one but us has to think about suffixes, remove it.
+	if base == 10 {
+		amount.SetScale(amount.Scale() + Scale(exponent).infScale())
+	} else if base == 2 {
+		// numericSuffix = 2 ** exponent
+		numericSuffix := big.NewInt(1).Lsh(bigOne, uint(exponent))
+		ub := amount.UnscaledBig()
+		amount.SetUnscaledBig(ub.Mul(ub, numericSuffix))
+	}
+
+	// Cap at min/max bounds.
+	sign := amount.Sign()
+	if sign == -1 {
+		amount.Neg(amount)
+	}
+
+	// This rounds non-zero values up to the minimum representable value, under the theory that
+	// if you want some resources, you should get some resources, even if you asked for way too small
+	// of an amount.  Arguably, this should be inf.RoundHalfUp (normal rounding), but that would have
+	// the side effect of rounding values < .5n to zero.
+	if v, ok := amount.Unscaled(); v != int64(0) || !ok {
+		amount.Round(amount, Nano.infScale(), inf.RoundUp)
+	}
+
+	// The max is just a simple cap.
+	// TODO: this prevents accumulating quantities greater than int64, for instance quota across a cluster
+	if format == BinarySI && amount.Cmp(maxAllowed.Dec) > 0 {
+		amount.Set(maxAllowed.Dec)
+	}
+
+	if format == BinarySI && amount.Cmp(decOne) < 0 && amount.Cmp(decZero) > 0 {
+		// This avoids rounding and hopefully confusion, too.
+		format = DecimalSI
+	}
+	if sign == -1 {
+		amount.Neg(amount)
+	}
+
+	return Quantity{d: infDecAmount{amount}, Format: format}, nil
+}
+
+// DeepCopy returns a deep-copy of the Quantity value.  Note that the method
+// receiver is a value, so we can mutate it in-place and return it.
+func (q Quantity) DeepCopy() Quantity {
+	if q.d.Dec != nil {
+		tmp := &inf.Dec{}
+		q.d.Dec = tmp.Set(q.d.Dec)
+	}
+	return q
+}
+
+// OpenAPISchemaType is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+//
+// See: https://github.com/kubernetes/kube-openapi/tree/master/pkg/generators
+func (_ Quantity) OpenAPISchemaType() []string { return []string{"string"} }
+
+// OpenAPISchemaFormat is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+func (_ Quantity) OpenAPISchemaFormat() string { return "" }
+
+// OpenAPIV3OneOfTypes is used by the kube-openapi generator when constructing
+// the OpenAPI v3 spec of this type.
+func (Quantity) OpenAPIV3OneOfTypes() []string { return []string{"string", "number"} }
+
+// CanonicalizeBytes returns the canonical form of q and its suffix (see comment on Quantity).
+//
+// Note about BinarySI:
+//   - If q.Format is set to BinarySI and q.Amount represents a non-zero value between
+//     -1 and +1, it will be emitted as if q.Format were DecimalSI.
+//   - Otherwise, if q.Format is set to BinarySI, fractional parts of q.Amount will be
+//     rounded up. (1.1i becomes 2i.)
+func (q *Quantity) CanonicalizeBytes(out []byte) (result, suffix []byte) {
+	if q.IsZero() {
+		return zeroBytes, nil
+	}
+
+	var rounded CanonicalValue
+	format := q.Format
+	switch format {
+	case DecimalExponent, DecimalSI:
+	case BinarySI:
+		if q.CmpInt64(-1024) > 0 && q.CmpInt64(1024) < 0 {
+			// This avoids rounding and hopefully confusion, too.
+			format = DecimalSI
+		} else {
+			var exact bool
+			if rounded, exact = q.AsScale(0); !exact {
+				// Don't lose precision-- show as DecimalSI
+				format = DecimalSI
+			}
+		}
+	default:
+		format = DecimalExponent
+	}
+
+	// TODO: If BinarySI formatting is requested but would cause rounding, upgrade to
+	// one of the other formats.
+	switch format {
+	case DecimalExponent, DecimalSI:
+		number, exponent := q.AsCanonicalBytes(out)
+		suffix, _ := quantitySuffixer.constructBytes(10, exponent, format)
+		return number, suffix
+	default:
+		// format must be BinarySI
+		number, exponent := rounded.AsCanonicalBase1024Bytes(out)
+		suffix, _ := quantitySuffixer.constructBytes(2, exponent*10, format)
+		return number, suffix
+	}
+}
+
+// AsApproximateFloat64 returns a float64 representation of the quantity which
+// may lose precision. If precision matter more than performance, see
+// AsFloat64Slow. If the value of the quantity is outside the range of a
+// float64 +Inf/-Inf will be returned.
+func (q *Quantity) AsApproximateFloat64() float64 {
+	var base float64
+	var exponent int
+	if q.d.Dec != nil {
+		base, _ = big.NewFloat(0).SetInt(q.d.Dec.UnscaledBig()).Float64()
+		exponent = int(-q.d.Dec.Scale())
+	} else {
+		base = float64(q.i.value)
+		exponent = int(q.i.scale)
+	}
+	if exponent == 0 {
+		return base
+	}
+
+	return base * math.Pow10(exponent)
+}
+
+// AsFloat64Slow returns a float64 representation of the quantity.  This is
+// more precise than AsApproximateFloat64 but significantly slower.  If the
+// value of the quantity is outside the range of a float64 +Inf/-Inf will be
+// returned.
+func (q *Quantity) AsFloat64Slow() float64 {
+	infDec := q.AsDec()
+
+	var absScale int64
+	if infDec.Scale() < 0 {
+		absScale = int64(-infDec.Scale())
+	} else {
+		absScale = int64(infDec.Scale())
+	}
+	pow10AbsScale := big.NewInt(10)
+	pow10AbsScale = pow10AbsScale.Exp(pow10AbsScale, big.NewInt(absScale), nil)
+
+	var resultBigFloat *big.Float
+	if infDec.Scale() < 0 {
+		resultBigInt := new(big.Int).Mul(infDec.UnscaledBig(), pow10AbsScale)
+		resultBigFloat = new(big.Float).SetInt(resultBigInt)
+	} else {
+		pow10AbsScaleFloat := new(big.Float).SetInt(pow10AbsScale)
+		resultBigFloat = new(big.Float).SetInt(infDec.UnscaledBig())
+		resultBigFloat = resultBigFloat.Quo(resultBigFloat, pow10AbsScaleFloat)
+	}
+
+	result, _ := resultBigFloat.Float64()
+	return result
+}
+
+// AsInt64 returns a representation of the current value as an int64 if a fast conversion
+// is possible. If false is returned, callers must use the inf.Dec form of this quantity.
+func (q *Quantity) AsInt64() (int64, bool) {
+	if q.d.Dec != nil {
+		return 0, false
+	}
+	return q.i.AsInt64()
+}
+
+// ToDec promotes the quantity in place to use an inf.Dec representation and returns itself.
+func (q *Quantity) ToDec() *Quantity {
+	if q.d.Dec == nil {
+		q.d.Dec = q.i.AsDec()
+		q.i = int64Amount{}
+	}
+	return q
+}
+
+// AsDec returns the quantity as represented by a scaled inf.Dec.
+func (q *Quantity) AsDec() *inf.Dec {
+	if q.d.Dec != nil {
+		return q.d.Dec
+	}
+	q.d.Dec = q.i.AsDec()
+	q.i = int64Amount{}
+	return q.d.Dec
+}
+
+// AsCanonicalBytes returns the canonical byte representation of this quantity as a mantissa
+// and base 10 exponent. The out byte slice may be passed to the method to avoid an extra
+// allocation.
+func (q *Quantity) AsCanonicalBytes(out []byte) (result []byte, exponent int32) {
+	if q.d.Dec != nil {
+		return q.d.AsCanonicalBytes(out)
+	}
+	return q.i.AsCanonicalBytes(out)
+}
+
+// IsZero returns true if the quantity is equal to zero.
+func (q *Quantity) IsZero() bool {
+	if q.d.Dec != nil {
+		return q.d.Dec.Sign() == 0
+	}
+	return q.i.value == 0
+}
+
+// Sign returns 0 if the quantity is zero, -1 if the quantity is less than zero, or 1 if the
+// quantity is greater than zero.
+func (q *Quantity) Sign() int {
+	if q.d.Dec != nil {
+		return q.d.Dec.Sign()
+	}
+	return q.i.Sign()
+}
+
+// AsScale returns the current value, rounded up to the provided scale, and returns
+// false if the scale resulted in a loss of precision.
+func (q *Quantity) AsScale(scale Scale) (CanonicalValue, bool) {
+	if q.d.Dec != nil {
+		return q.d.AsScale(scale)
+	}
+	return q.i.AsScale(scale)
+}
+
+// RoundUp updates the quantity to the provided scale, ensuring that the value is at
+// least 1. False is returned if the rounding operation resulted in a loss of precision.
+// Negative numbers are rounded away from zero (-9 scale 1 rounds to -10).
+func (q *Quantity) RoundUp(scale Scale) bool {
+	if q.d.Dec != nil {
+		q.s = ""
+		d, exact := q.d.AsScale(scale)
+		q.d = d
+		return exact
+	}
+	// avoid clearing the string value if we have already calculated it
+	if q.i.scale >= scale {
+		return true
+	}
+	q.s = ""
+	i, exact := q.i.AsScale(scale)
+	q.i = i
+	return exact
+}
+
+// Add adds the provide y quantity to the current value. If the current value is zero,
+// the format of the quantity will be updated to the format of y.
+func (q *Quantity) Add(y Quantity) {
+	q.s = ""
+	if q.d.Dec == nil && y.d.Dec == nil {
+		if q.i.value == 0 {
+			q.Format = y.Format
+		}
+		if q.i.Add(y.i) {
+			return
+		}
+	} else if q.IsZero() {
+		q.Format = y.Format
+	}
+	q.ToDec().d.Dec.Add(q.d.Dec, y.AsDec())
+}
+
+// Sub subtracts the provided quantity from the current value in place. If the current
+// value is zero, the format of the quantity will be updated to the format of y.
+func (q *Quantity) Sub(y Quantity) {
+	q.s = ""
+	if q.IsZero() {
+		q.Format = y.Format
+	}
+	if q.d.Dec == nil && y.d.Dec == nil && q.i.Sub(y.i) {
+		return
+	}
+	q.ToDec().d.Dec.Sub(q.d.Dec, y.AsDec())
+}
+
+// Mul multiplies the provided y to the current value.
+// It will return false if the result is inexact. Otherwise, it will return true.
+func (q *Quantity) Mul(y int64) bool {
+	q.s = ""
+	if q.d.Dec == nil && q.i.Mul(y) {
+		return true
+	}
+	return q.ToDec().d.Dec.Mul(q.d.Dec, inf.NewDec(y, inf.Scale(0))).UnscaledBig().IsInt64()
+}
+
+// Cmp returns 0 if the quantity is equal to y, -1 if the quantity is less than y, or 1 if the
+// quantity is greater than y.
+func (q *Quantity) Cmp(y Quantity) int {
+	if q.d.Dec == nil && y.d.Dec == nil {
+		return q.i.Cmp(y.i)
+	}
+	return q.AsDec().Cmp(y.AsDec())
+}
+
+// CmpInt64 returns 0 if the quantity is equal to y, -1 if the quantity is less than y, or 1 if the
+// quantity is greater than y.
+func (q *Quantity) CmpInt64(y int64) int {
+	if q.d.Dec != nil {
+		return q.d.Dec.Cmp(inf.NewDec(y, inf.Scale(0)))
+	}
+	return q.i.Cmp(int64Amount{value: y})
+}
+
+// Neg sets quantity to be the negative value of itself.
+func (q *Quantity) Neg() {
+	q.s = ""
+	if q.d.Dec == nil {
+		q.i.value = -q.i.value
+		return
+	}
+	q.d.Dec.Neg(q.d.Dec)
+}
+
+// Equal checks equality of two Quantities. This is useful for testing with
+// cmp.Equal.
+func (q Quantity) Equal(v Quantity) bool {
+	return q.Cmp(v) == 0
+}
+
+// int64QuantityExpectedBytes is the expected width in bytes of the canonical string representation
+// of most Quantity values.
+const int64QuantityExpectedBytes = 18
+
+// String formats the Quantity as a string, caching the result if not calculated.
+// String is an expensive operation and caching this result significantly reduces the cost of
+// normal parse / marshal operations on Quantity.
+func (q *Quantity) String() string {
+	if q == nil {
+		return "<nil>"
+	}
+	if len(q.s) == 0 {
+		result := make([]byte, 0, int64QuantityExpectedBytes)
+		number, suffix := q.CanonicalizeBytes(result)
+		number = append(number, suffix...)
+		q.s = string(number)
+	}
+	return q.s
+}
+
+// MarshalJSON implements the json.Marshaller interface.
+func (q Quantity) MarshalJSON() ([]byte, error) {
+	if len(q.s) > 0 {
+		out := make([]byte, len(q.s)+2)
+		out[0], out[len(out)-1] = '"', '"'
+		copy(out[1:], q.s)
+		return out, nil
+	}
+	result := make([]byte, int64QuantityExpectedBytes)
+	result[0] = '"'
+	number, suffix := q.CanonicalizeBytes(result[1:1])
+	// if the same slice was returned to us that we passed in, avoid another allocation by copying number into
+	// the source slice and returning that
+	if len(number) > 0 && &number[0] == &result[1] && (len(number)+len(suffix)+2) <= int64QuantityExpectedBytes {
+		number = append(number, suffix...)
+		number = append(number, '"')
+		return result[:1+len(number)], nil
+	}
+	// if CanonicalizeBytes needed more space than our slice provided, we may need to allocate again so use
+	// append
+	result = result[:1]
+	result = append(result, number...)
+	result = append(result, suffix...)
+	result = append(result, '"')
+	return result, nil
+}
+
+func (q Quantity) MarshalCBOR() ([]byte, error) {
+	// The call to String() should never return the string "<nil>" because the receiver's
+	// address will never be nil.
+	return cbor.Marshal(q.String())
+}
+
+// ToUnstructured implements the value.UnstructuredConverter interface.
+func (q Quantity) ToUnstructured() interface{} {
+	return q.String()
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+// TODO: Remove support for leading/trailing whitespace
+func (q *Quantity) UnmarshalJSON(value []byte) error {
+	l := len(value)
+	if l == 4 && bytes.Equal(value, []byte("null")) {
+		q.d.Dec = nil
+		q.i = int64Amount{}
+		return nil
+	}
+	if l >= 2 && value[0] == '"' && value[l-1] == '"' {
+		value = value[1 : l-1]
+	}
+
+	parsed, err := ParseQuantity(strings.TrimSpace(string(value)))
+	if err != nil {
+		return err
+	}
+
+	// This copy is safe because parsed will not be referred to again.
+	*q = parsed
+	return nil
+}
+
+func (q *Quantity) UnmarshalCBOR(value []byte) error {
+	var s *string
+	if err := cbor.Unmarshal(value, &s); err != nil {
+		return err
+	}
+
+	if s == nil {
+		q.d.Dec = nil
+		q.i = int64Amount{}
+		return nil
+	}
+
+	parsed, err := ParseQuantity(strings.TrimSpace(*s))
+	if err != nil {
+		return err
+	}
+
+	*q = parsed
+	return nil
+}
+
+// NewDecimalQuantity returns a new Quantity representing the given
+// value in the given format.
+func NewDecimalQuantity(b inf.Dec, format Format) *Quantity {
+	return &Quantity{
+		d:      infDecAmount{&b},
+		Format: format,
+	}
+}
+
+// NewQuantity returns a new Quantity representing the given
+// value in the given format.
+func NewQuantity(value int64, format Format) *Quantity {
+	return &Quantity{
+		i:      int64Amount{value: value},
+		Format: format,
+	}
+}
+
+// NewMilliQuantity returns a new Quantity representing the given
+// value * 1/1000 in the given format. Note that BinarySI formatting
+// will round fractional values, and will be changed to DecimalSI for
+// values x where (-1 < x < 1) && (x != 0).
+func NewMilliQuantity(value int64, format Format) *Quantity {
+	return &Quantity{
+		i:      int64Amount{value: value, scale: -3},
+		Format: format,
+	}
+}
+
+// NewScaledQuantity returns a new Quantity representing the given
+// value * 10^scale in DecimalSI format.
+func NewScaledQuantity(value int64, scale Scale) *Quantity {
+	return &Quantity{
+		i:      int64Amount{value: value, scale: scale},
+		Format: DecimalSI,
+	}
+}
+
+// Value returns the unscaled value of q rounded up to the nearest integer away from 0.
+func (q *Quantity) Value() int64 {
+	return q.ScaledValue(0)
+}
+
+// MilliValue returns the value of ceil(q * 1000); this could overflow an int64;
+// if that's a concern, call Value() first to verify the number is small enough.
+func (q *Quantity) MilliValue() int64 {
+	return q.ScaledValue(Milli)
+}
+
+// ScaledValue returns the value of ceil(q / 10^scale).
+// For example, NewQuantity(1, DecimalSI).ScaledValue(Milli) returns 1000.
+// This could overflow an int64.
+// To detect overflow, call Value() first and verify the expected magnitude.
+func (q *Quantity) ScaledValue(scale Scale) int64 {
+	if q.d.Dec == nil {
+		i, _ := q.i.AsScaledInt64(scale)
+		return i
+	}
+	dec := q.d.Dec
+	return scaledValue(dec.UnscaledBig(), int(dec.Scale()), int(scale.infScale()))
+}
+
+// Set sets q's value to be value.
+func (q *Quantity) Set(value int64) {
+	q.SetScaled(value, 0)
+}
+
+// SetMilli sets q's value to be value * 1/1000.
+func (q *Quantity) SetMilli(value int64) {
+	q.SetScaled(value, Milli)
+}
+
+// SetScaled sets q's value to be value * 10^scale
+func (q *Quantity) SetScaled(value int64, scale Scale) {
+	q.s = ""
+	q.d.Dec = nil
+	q.i = int64Amount{value: value, scale: scale}
+}
+
+// QuantityValue makes it possible to use a Quantity as value for a command
+// line parameter.
+//
+// +protobuf=true
+// +protobuf.embed=string
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:deepcopy-gen=true
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.api.resource
+type QuantityValue struct {
+	Quantity
+}
+
+// Set implements pflag.Value.Set and Go flag.Value.Set.
+func (q *QuantityValue) Set(s string) error {
+	quantity, err := ParseQuantity(s)
+	if err != nil {
+		return err
+	}
+	q.Quantity = quantity
+	return nil
+}
+
+// Type implements pflag.Value.Type.
+func (q QuantityValue) Type() string {
+	return "quantity"
+}
+
+// QuantityPtrEqual compares two Quantity pointers and returns true if they are both nil or point to equal quantities.
+func QuantityPtrEqual(a, b *Quantity) bool {
+	if a == nil && b == nil {
+		return true
+	}
+	if a == nil || b == nil {
+		return false
+	}
+	return a.Equal(*b)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_example_test.go b/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_example_test.go
new file mode 100644
index 0000000000..56a7dbe0e0
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_example_test.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource_test
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/resource"
+)
+
+func ExampleFormat() {
+	memorySize := resource.NewQuantity(5*1024*1024*1024, resource.BinarySI)
+	fmt.Printf("memorySize = %v\n", memorySize)
+
+	diskSize := resource.NewQuantity(5*1000*1000*1000, resource.DecimalSI)
+	fmt.Printf("diskSize = %v\n", diskSize)
+
+	cores := resource.NewMilliQuantity(5300, resource.DecimalSI)
+	fmt.Printf("cores = %v\n", cores)
+
+	// Output:
+	// memorySize = 5Gi
+	// diskSize = 5G
+	// cores = 5300m
+}
+
+func ExampleMustParse() {
+	memorySize := resource.MustParse("5Gi")
+	fmt.Printf("memorySize = %v (%v)\n", memorySize.Value(), memorySize.Format)
+
+	diskSize := resource.MustParse("5G")
+	fmt.Printf("diskSize = %v (%v)\n", diskSize.Value(), diskSize.Format)
+
+	cores := resource.MustParse("5300m")
+	fmt.Printf("milliCores = %v (%v)\n", cores.MilliValue(), cores.Format)
+
+	cores2 := resource.MustParse("5.4")
+	fmt.Printf("milliCores = %v (%v)\n", cores2.MilliValue(), cores2.Format)
+
+	// Output:
+	// memorySize = 5368709120 (BinarySI)
+	// diskSize = 5000000000 (DecimalSI)
+	// milliCores = 5300 (DecimalSI)
+	// milliCores = 5400 (DecimalSI)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_proto.go b/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_proto.go
new file mode 100644
index 0000000000..364ec80da2
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_proto.go
@@ -0,0 +1,284 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"fmt"
+	"io"
+	"math/bits"
+)
+
+func (m *Quantity) Marshal() (data []byte, err error) {
+	size := m.Size()
+	data = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(data[:size])
+	if err != nil {
+		return nil, err
+	}
+	return data[:n], nil
+}
+
+// MarshalTo is a customized version of the generated Protobuf unmarshaler for a struct
+// with a single string field.
+func (m *Quantity) MarshalTo(data []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(data[:size])
+}
+
+// MarshalToSizedBuffer is a customized version of the generated
+// Protobuf unmarshaler for a struct with a single string field.
+func (m *Quantity) MarshalToSizedBuffer(data []byte) (int, error) {
+	i := len(data)
+	_ = i
+	var l int
+	_ = l
+
+	// BEGIN CUSTOM MARSHAL
+	out := m.String()
+	i -= len(out)
+	copy(data[i:], out)
+	i = encodeVarintGenerated(data, i, uint64(len(out)))
+	// END CUSTOM MARSHAL
+	i--
+	data[i] = 0xa
+
+	return len(data) - i, nil
+}
+
+func encodeVarintGenerated(data []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		data[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	data[offset] = uint8(v)
+	return base
+}
+
+func (m *Quantity) Size() (n int) {
+	var l int
+	_ = l
+
+	// BEGIN CUSTOM SIZE
+	l = len(m.String())
+	// END CUSTOM SIZE
+
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (bits.Len64(x|1) + 6) / 7
+}
+
+// Unmarshal is a customized version of the generated Protobuf unmarshaler for a struct
+// with a single string field.
+func (m *Quantity) Unmarshal(data []byte) error {
+	l := len(data)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := data[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Quantity: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Quantity: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field String_", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := data[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(data[iNdEx:postIndex])
+
+			// BEGIN CUSTOM DECODE
+			p, err := ParseQuantity(s)
+			if err != nil {
+				return err
+			}
+			*m = p
+			// END CUSTOM DECODE
+
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(data[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+
+func skipGenerated(data []byte) (n int, err error) {
+	l := len(data)
+	iNdEx := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := data[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if data[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+			return iNdEx, nil
+		case 1:
+			iNdEx += 8
+			return iNdEx, nil
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := data[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			iNdEx += length
+			if length < 0 {
+				return 0, ErrInvalidLengthGenerated
+			}
+			return iNdEx, nil
+		case 3:
+			for {
+				var innerWire uint64
+				var start int = iNdEx
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return 0, ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return 0, io.ErrUnexpectedEOF
+					}
+					b := data[iNdEx]
+					iNdEx++
+					innerWire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				innerWireType := int(innerWire & 0x7)
+				if innerWireType == 4 {
+					break
+				}
+				next, err := skipGenerated(data[start:])
+				if err != nil {
+					return 0, err
+				}
+				iNdEx = start + next
+			}
+			return iNdEx, nil
+		case 4:
+			return iNdEx, nil
+		case 5:
+			iNdEx += 4
+			return iNdEx, nil
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+	}
+	panic("unreachable")
+}
+
+var (
+	ErrInvalidLengthGenerated = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowGenerated   = fmt.Errorf("proto: integer overflow")
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_proto_test.go b/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_proto_test.go
new file mode 100644
index 0000000000..574a3cf5d7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_proto_test.go
@@ -0,0 +1,103 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"testing"
+
+	inf "gopkg.in/inf.v0"
+)
+
+func TestQuantityProtoMarshal(t *testing.T) {
+	// Test when d is nil
+	table := []struct {
+		quantity string
+		expect   Quantity
+	}{
+		{"0", Quantity{i: int64Amount{value: 0, scale: 0}, s: "0", Format: DecimalSI}},
+		{"100m", Quantity{i: int64Amount{value: 100, scale: -3}, s: "100m", Format: DecimalSI}},
+		{"50m", Quantity{i: int64Amount{value: 50, scale: -3}, s: "50m", Format: DecimalSI}},
+		{"10000T", Quantity{i: int64Amount{value: 10000, scale: 12}, s: "10000T", Format: DecimalSI}},
+	}
+	for _, testCase := range table {
+		q := MustParse(testCase.quantity)
+		// Won't currently get an error as MarshalTo can't return one
+		result, _ := q.Marshal()
+		q.MarshalTo(result)
+		if q.Cmp(testCase.expect) != 0 {
+			t.Errorf("Expected: %v, Actual: %v", testCase.expect, q)
+		}
+	}
+	// Test when i is {0,0}
+	table2 := []struct {
+		dec    *inf.Dec
+		expect Quantity
+	}{
+		{dec(0, 0).Dec, Quantity{i: int64Amount{value: 0, scale: 0}, d: infDecAmount{dec(0, 0).Dec}, s: "0", Format: DecimalSI}},
+		{dec(10, 0).Dec, Quantity{i: int64Amount{value: 0, scale: 0}, d: infDecAmount{dec(10, 0).Dec}, s: "10", Format: DecimalSI}},
+		{dec(-10, 0).Dec, Quantity{i: int64Amount{value: 0, scale: 0}, d: infDecAmount{dec(-10, 0).Dec}, s: "-10", Format: DecimalSI}},
+	}
+	for _, testCase := range table2 {
+		q := Quantity{d: infDecAmount{testCase.dec}, Format: DecimalSI}
+		// Won't currently get an error as MarshalTo can't return one
+		result, _ := q.Marshal()
+		q.Unmarshal(result)
+		if q.Cmp(testCase.expect) != 0 {
+			t.Errorf("Expected: %v, Actual: %v", testCase.expect, q)
+		}
+	}
+}
+
+func TestQuantityProtoUnmarshal(t *testing.T) {
+	// Test when d is nil
+	table := []struct {
+		input  Quantity
+		expect string
+	}{
+		{Quantity{i: int64Amount{value: 0, scale: 0}, s: "0", Format: DecimalSI}, "0"},
+		{Quantity{i: int64Amount{value: 100, scale: -3}, s: "100m", Format: DecimalSI}, "100m"},
+		{Quantity{i: int64Amount{value: 50, scale: -3}, s: "50m", Format: DecimalSI}, "50m"},
+		{Quantity{i: int64Amount{value: 10000, scale: 12}, s: "10000T", Format: DecimalSI}, "10000T"},
+	}
+	for _, testCase := range table {
+		var inputQ Quantity
+		expectQ := MustParse(testCase.expect)
+		inputByteArray, _ := testCase.input.Marshal()
+		inputQ.Unmarshal(inputByteArray)
+		if inputQ.Cmp(expectQ) != 0 {
+			t.Errorf("Expected: %v, Actual: %v", inputQ, expectQ)
+		}
+	}
+	// Test when i is {0,0}
+	table2 := []struct {
+		input  Quantity
+		expect *inf.Dec
+	}{
+		{Quantity{i: int64Amount{value: 0, scale: 0}, d: infDecAmount{dec(0, 0).Dec}, s: "0", Format: DecimalSI}, dec(0, 0).Dec},
+		{Quantity{i: int64Amount{value: 0, scale: 0}, d: infDecAmount{dec(10, 0).Dec}, s: "10", Format: DecimalSI}, dec(10, 0).Dec},
+		{Quantity{i: int64Amount{value: 0, scale: 0}, d: infDecAmount{dec(-10, 0).Dec}, s: "-10", Format: DecimalSI}, dec(-10, 0).Dec},
+	}
+	for _, testCase := range table2 {
+		var inputQ Quantity
+		expectQ := Quantity{d: infDecAmount{testCase.expect}, Format: DecimalSI}
+		inputByteArray, _ := testCase.input.Marshal()
+		inputQ.Unmarshal(inputByteArray)
+		if inputQ.Cmp(expectQ) != 0 {
+			t.Errorf("Expected: %v, Actual: %v", inputQ, expectQ)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_test.go b/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_test.go
new file mode 100644
index 0000000000..6553b0047d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/quantity_test.go
@@ -0,0 +1,2035 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"encoding/json"
+	"fmt"
+	"math"
+	"math/big"
+	"math/rand"
+	"os"
+	"strings"
+	"testing"
+	"unicode"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/spf13/pflag"
+	inf "gopkg.in/inf.v0"
+	"sigs.k8s.io/randfill"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	"k8s.io/utils/ptr"
+)
+
+var (
+	bigMostPositive = big.NewInt(mostPositive)
+	bigMostNegative = big.NewInt(mostNegative)
+)
+
+func dec(i int64, exponent int) infDecAmount {
+	// See the below test-- scale is the negative of an exponent.
+	return infDecAmount{inf.NewDec(i, inf.Scale(-exponent))}
+}
+
+func bigDec(i *big.Int, exponent int) infDecAmount {
+	// See the below test-- scale is the negative of an exponent.
+	return infDecAmount{inf.NewDecBig(i, inf.Scale(-exponent))}
+}
+
+func decQuantity(i int64, exponent int, format Format) Quantity {
+	return Quantity{d: dec(i, exponent), Format: format}
+}
+
+func bigDecQuantity(i *big.Int, exponent int, format Format) Quantity {
+	return Quantity{d: bigDec(i, exponent), Format: format}
+}
+
+func intQuantity(i int64, exponent Scale, format Format) Quantity {
+	return Quantity{i: int64Amount{value: i, scale: exponent}, Format: format}
+}
+
+func TestDec(t *testing.T) {
+	table := []struct {
+		got    infDecAmount
+		expect string
+	}{
+		{dec(1, 0), "1"},
+		{dec(1, 1), "10"},
+		{dec(5, 2), "500"},
+		{dec(8, 3), "8000"},
+		{dec(2, 0), "2"},
+		{dec(1, -1), "0.1"},
+		{dec(3, -2), "0.03"},
+		{dec(4, -3), "0.004"},
+	}
+
+	for _, item := range table {
+		if e, a := item.expect, item.got.Dec.String(); e != a {
+			t.Errorf("expected %v, got %v", e, a)
+		}
+	}
+}
+
+func TestBigDec(t *testing.T) {
+	table := []struct {
+		got    infDecAmount
+		expect string
+	}{
+		{bigDec(big.NewInt(1), 0), "1"},
+		{bigDec(big.NewInt(1), 1), "10"},
+		{bigDec(big.NewInt(5), 2), "500"},
+		{bigDec(big.NewInt(8), 3), "8000"},
+		{bigDec(big.NewInt(2), 0), "2"},
+		{bigDec(big.NewInt(1), -1), "0.1"},
+		{bigDec(big.NewInt(3), -2), "0.03"},
+		{bigDec(big.NewInt(4), -3), "0.004"},
+		{bigDec(big.NewInt(0).Add(bigMostPositive, big.NewInt(1)), 0), "9223372036854775808"},
+		{bigDec(big.NewInt(0).Add(bigMostPositive, big.NewInt(1)), 1), "92233720368547758080"},
+		{bigDec(big.NewInt(0).Add(bigMostPositive, big.NewInt(1)), 2), "922337203685477580800"},
+		{bigDec(big.NewInt(0).Add(bigMostPositive, big.NewInt(1)), -1), "922337203685477580.8"},
+		{bigDec(big.NewInt(0).Add(bigMostPositive, big.NewInt(1)), -2), "92233720368547758.08"},
+		{bigDec(big.NewInt(0).Sub(bigMostNegative, big.NewInt(1)), 0), "-9223372036854775809"},
+		{bigDec(big.NewInt(0).Sub(bigMostNegative, big.NewInt(1)), 1), "-92233720368547758090"},
+		{bigDec(big.NewInt(0).Sub(bigMostNegative, big.NewInt(1)), 2), "-922337203685477580900"},
+		{bigDec(big.NewInt(0).Sub(bigMostNegative, big.NewInt(1)), -1), "-922337203685477580.9"},
+		{bigDec(big.NewInt(0).Sub(bigMostNegative, big.NewInt(1)), -2), "-92233720368547758.09"},
+	}
+
+	for _, item := range table {
+		if e, a := item.expect, item.got.Dec.String(); e != a {
+			t.Errorf("expected %v, got %v", e, a)
+		}
+	}
+}
+
+// TestQuantityParseZero ensures that when a 0 quantity is passed, its string value is 0
+func TestQuantityParseZero(t *testing.T) {
+	zero := MustParse("0")
+	if expected, actual := "0", zero.String(); expected != actual {
+		t.Errorf("Expected %v, actual %v", expected, actual)
+	}
+}
+
+// TestQuantityParseNonNumericPanic ensures that when a non-numeric string is parsed
+// it panics
+func TestQuantityParseNonNumericPanic(t *testing.T) {
+	defer func() {
+		if r := recover(); r == nil {
+			t.Errorf("MustParse did not panic")
+		}
+	}()
+	_ = MustParse("Non-Numeric")
+}
+
+// TestQuantityAddZeroPreservesSuffix verifies that a suffix is preserved
+// independent of the order of operations when adding a zero and non-zero val
+func TestQuantityAddZeroPreservesSuffix(t *testing.T) {
+	testValues := []string{"100m", "1Gi"}
+	zero := MustParse("0")
+	for _, testValue := range testValues {
+		value := MustParse(testValue)
+		v1 := value.DeepCopy()
+		// ensure non-zero + zero = non-zero (suffix preserved)
+		v1.Add(zero)
+		// ensure zero + non-zero = non-zero (suffix preserved)
+		v2 := zero.DeepCopy()
+		v2.Add(value)
+
+		if v1.String() != testValue {
+			t.Errorf("Expected %v, actual %v", testValue, v1.String())
+			continue
+		}
+		if v2.String() != testValue {
+			t.Errorf("Expected %v, actual %v", testValue, v2.String())
+		}
+	}
+}
+
+// TestQuantitySubZeroPreservesSuffix verifies that a suffix is preserved
+// independent of the order of operations when subtracting a zero and non-zero val
+func TestQuantitySubZeroPreservesSuffix(t *testing.T) {
+	testValues := []string{"100m", "1Gi"}
+	zero := MustParse("0")
+	for _, testValue := range testValues {
+		value := MustParse(testValue)
+		v1 := value.DeepCopy()
+		// ensure non-zero - zero = non-zero (suffix preserved)
+		v1.Sub(zero)
+		// ensure we preserved the input value
+		if v1.String() != testValue {
+			t.Errorf("Expected %v, actual %v", testValue, v1.String())
+		}
+
+		// ensure zero - non-zero = -non-zero (suffix preserved)
+		v2 := zero.DeepCopy()
+		v2.Sub(value)
+		negVal := value.DeepCopy()
+		negVal.Neg()
+		if v2.String() != negVal.String() {
+			t.Errorf("Expected %v, actual %v", negVal.String(), v2.String())
+		}
+	}
+}
+
+// TestQuantityCanocicalizeZero verifies that you get 0 as canonical value if internal value is 0, and not 0<suffix>
+func TestQuantityCanocicalizeZero(t *testing.T) {
+	val := MustParse("1000m")
+	val.i.Sub(int64Amount{value: 1})
+	zero := Quantity{i: val.i, Format: DecimalSI}
+	if expected, actual := "0", zero.String(); expected != actual {
+		t.Errorf("Expected %v, actual %v", expected, actual)
+	}
+}
+
+func TestQuantityCmp(t *testing.T) {
+	// Test when d is nil
+	table := []struct {
+		x      string
+		y      string
+		expect int
+	}{
+		{"0", "0", 0},
+		{"100m", "50m", 1},
+		{"50m", "100m", -1},
+		{"10000T", "100Gi", 1},
+	}
+	for _, testCase := range table {
+		q1 := MustParse(testCase.x)
+		q2 := MustParse(testCase.y)
+		if result := q1.Cmp(q2); result != testCase.expect {
+			t.Errorf("X: %v, Y: %v, Expected: %v, Actual: %v", testCase.x, testCase.y, testCase.expect, result)
+		}
+	}
+	// Test when i is {0,0}
+	table2 := []struct {
+		x      *inf.Dec
+		y      *inf.Dec
+		expect int
+	}{
+		{dec(0, 0).Dec, dec(0, 0).Dec, 0},
+		{nil, dec(0, 0).Dec, 0},
+		{dec(0, 0).Dec, nil, 0},
+		{nil, nil, 0},
+		{nil, dec(10, 0).Dec, -1},
+		{nil, dec(-10, 0).Dec, 1},
+		{dec(10, 0).Dec, nil, 1},
+		{dec(-10, 0).Dec, nil, -1},
+	}
+	for _, testCase := range table2 {
+		q1 := Quantity{d: infDecAmount{testCase.x}, Format: DecimalSI}
+		q2 := Quantity{d: infDecAmount{testCase.y}, Format: DecimalSI}
+		if result := q1.Cmp(q2); result != testCase.expect {
+			t.Errorf("X: %v, Y: %v, Expected: %v, Actual: %v", testCase.x, testCase.y, testCase.expect, result)
+		}
+	}
+}
+
+func TestParseQuantityString(t *testing.T) {
+	table := []struct {
+		input              string
+		positive           bool
+		value              string
+		num, denom, suffix string
+	}{
+		{"0.025Ti", true, "0.025", "0", "025", "Ti"},
+		{"1.025Ti", true, "1.025", "1", "025", "Ti"},
+		{"-1.025Ti", false, "-1.025", "1", "025", "Ti"},
+		{".", true, ".", "0", "", ""},
+		{"-.", false, "-.", "0", "", ""},
+		{"1E-3", true, "1", "1", "", "E-3"},
+	}
+	for _, test := range table {
+		positive, value, num, denom, suffix, err := parseQuantityString(test.input)
+		if err != nil {
+			t.Errorf("%s: error: %v", test.input, err)
+			continue
+		}
+		if positive != test.positive || value != test.value || num != test.num || denom != test.denom || suffix != test.suffix {
+			t.Errorf("%s: unmatched: %t %q %q %q %q", test.input, positive, value, num, denom, suffix)
+		}
+	}
+}
+
+func TestQuantityParse(t *testing.T) {
+	if _, err := ParseQuantity(""); err == nil {
+		t.Errorf("expected empty string to return error")
+	}
+
+	table := []struct {
+		input  string
+		expect Quantity
+	}{
+		{"0", decQuantity(0, 0, DecimalSI)},
+		{"0n", decQuantity(0, 0, DecimalSI)},
+		{"0u", decQuantity(0, 0, DecimalSI)},
+		{"0m", decQuantity(0, 0, DecimalSI)},
+		{"0Ki", decQuantity(0, 0, BinarySI)},
+		{"0k", decQuantity(0, 0, DecimalSI)},
+		{"0Mi", decQuantity(0, 0, BinarySI)},
+		{"0M", decQuantity(0, 0, DecimalSI)},
+		{"0Gi", decQuantity(0, 0, BinarySI)},
+		{"0G", decQuantity(0, 0, DecimalSI)},
+		{"0Ti", decQuantity(0, 0, BinarySI)},
+		{"0T", decQuantity(0, 0, DecimalSI)},
+
+		// Quantity less numbers are allowed
+		{"1", decQuantity(1, 0, DecimalSI)},
+
+		// Binary suffixes
+		{"1Ki", decQuantity(1024, 0, BinarySI)},
+		{"8Ki", decQuantity(8*1024, 0, BinarySI)},
+		{"7Mi", decQuantity(7*1024*1024, 0, BinarySI)},
+		{"6Gi", decQuantity(6*1024*1024*1024, 0, BinarySI)},
+		{"5Ti", decQuantity(5*1024*1024*1024*1024, 0, BinarySI)},
+		{"4Pi", decQuantity(4*1024*1024*1024*1024*1024, 0, BinarySI)},
+		{"3Ei", decQuantity(3*1024*1024*1024*1024*1024*1024, 0, BinarySI)},
+
+		{"10Ti", decQuantity(10*1024*1024*1024*1024, 0, BinarySI)},
+		{"100Ti", decQuantity(100*1024*1024*1024*1024, 0, BinarySI)},
+
+		// Decimal suffixes
+		{"5n", decQuantity(5, -9, DecimalSI)},
+		{"4u", decQuantity(4, -6, DecimalSI)},
+		{"3m", decQuantity(3, -3, DecimalSI)},
+		{"9", decQuantity(9, 0, DecimalSI)},
+		{"8k", decQuantity(8, 3, DecimalSI)},
+		{"50k", decQuantity(5, 4, DecimalSI)},
+		{"7M", decQuantity(7, 6, DecimalSI)},
+		{"6G", decQuantity(6, 9, DecimalSI)},
+		{"5T", decQuantity(5, 12, DecimalSI)},
+		{"40T", decQuantity(4, 13, DecimalSI)},
+		{"300T", decQuantity(3, 14, DecimalSI)},
+		{"2P", decQuantity(2, 15, DecimalSI)},
+		{"1E", decQuantity(1, 18, DecimalSI)},
+
+		// Decimal exponents
+		{"1E-3", decQuantity(1, -3, DecimalExponent)},
+		{"1e3", decQuantity(1, 3, DecimalExponent)},
+		{"1E6", decQuantity(1, 6, DecimalExponent)},
+		{"1e9", decQuantity(1, 9, DecimalExponent)},
+		{"1E12", decQuantity(1, 12, DecimalExponent)},
+		{"1e15", decQuantity(1, 15, DecimalExponent)},
+		{"1E18", decQuantity(1, 18, DecimalExponent)},
+
+		// Nonstandard but still parsable
+		{"1e14", decQuantity(1, 14, DecimalExponent)},
+		{"1e13", decQuantity(1, 13, DecimalExponent)},
+		{"1e3", decQuantity(1, 3, DecimalExponent)},
+		{"100.035k", decQuantity(100035, 0, DecimalSI)},
+
+		// Things that look like floating point
+		{"0.001", decQuantity(1, -3, DecimalSI)},
+		{"0.0005k", decQuantity(5, -1, DecimalSI)},
+		{"0.005", decQuantity(5, -3, DecimalSI)},
+		{"0.05", decQuantity(5, -2, DecimalSI)},
+		{"0.5", decQuantity(5, -1, DecimalSI)},
+		{"0.00050k", decQuantity(5, -1, DecimalSI)},
+		{"0.00500", decQuantity(5, -3, DecimalSI)},
+		{"0.05000", decQuantity(5, -2, DecimalSI)},
+		{"0.50000", decQuantity(5, -1, DecimalSI)},
+		{"0.5e0", decQuantity(5, -1, DecimalExponent)},
+		{"0.5e-1", decQuantity(5, -2, DecimalExponent)},
+		{"0.5e-2", decQuantity(5, -3, DecimalExponent)},
+		{"0.5e0", decQuantity(5, -1, DecimalExponent)},
+		{"10.035M", decQuantity(10035, 3, DecimalSI)},
+
+		{"1.2e3", decQuantity(12, 2, DecimalExponent)},
+		{"1.3E+6", decQuantity(13, 5, DecimalExponent)},
+		{"1.40e9", decQuantity(14, 8, DecimalExponent)},
+		{"1.53E12", decQuantity(153, 10, DecimalExponent)},
+		{"1.6e15", decQuantity(16, 14, DecimalExponent)},
+		{"1.7E18", decQuantity(17, 17, DecimalExponent)},
+
+		{"9.01", decQuantity(901, -2, DecimalSI)},
+		{"8.1k", decQuantity(81, 2, DecimalSI)},
+		{"7.123456M", decQuantity(7123456, 0, DecimalSI)},
+		{"6.987654321G", decQuantity(6987654321, 0, DecimalSI)},
+		{"5.444T", decQuantity(5444, 9, DecimalSI)},
+		{"40.1T", decQuantity(401, 11, DecimalSI)},
+		{"300.2T", decQuantity(3002, 11, DecimalSI)},
+		{"2.5P", decQuantity(25, 14, DecimalSI)},
+		{"1.01E", decQuantity(101, 16, DecimalSI)},
+
+		// Things that saturate/round
+		{"3.001n", decQuantity(4, -9, DecimalSI)},
+		{"1.1E-9", decQuantity(2, -9, DecimalExponent)},
+		{"0.0000000001", decQuantity(1, -9, DecimalSI)},
+		{"0.0000000005", decQuantity(1, -9, DecimalSI)},
+		{"0.00000000050", decQuantity(1, -9, DecimalSI)},
+		{"0.5e-9", decQuantity(1, -9, DecimalExponent)},
+		{"0.9n", decQuantity(1, -9, DecimalSI)},
+		{"0.00000012345", decQuantity(124, -9, DecimalSI)},
+		{"0.00000012354", decQuantity(124, -9, DecimalSI)},
+		{"9Ei", Quantity{d: maxAllowed, Format: BinarySI}},
+		{"9223372036854775807Ki", Quantity{d: maxAllowed, Format: BinarySI}},
+		{"12E", decQuantity(12, 18, DecimalSI)},
+
+		// We'll accept fractional binary stuff, too.
+		{"100.035Ki", decQuantity(10243584, -2, BinarySI)},
+		{"0.5Mi", decQuantity(.5*1024*1024, 0, BinarySI)},
+		{"0.05Gi", decQuantity(536870912, -1, BinarySI)},
+		{"0.025Ti", decQuantity(274877906944, -1, BinarySI)},
+
+		// Things written by trolls
+		{"0.000000000001Ki", decQuantity(2, -9, DecimalSI)}, // rounds up, changes format
+		{".001", decQuantity(1, -3, DecimalSI)},
+		{".0001k", decQuantity(100, -3, DecimalSI)},
+		{"1.", decQuantity(1, 0, DecimalSI)},
+		{"1.G", decQuantity(1, 9, DecimalSI)},
+	}
+
+	for _, asDec := range []bool{false, true} {
+		for _, item := range table {
+			got, err := ParseQuantity(item.input)
+			if err != nil {
+				t.Errorf("%v: unexpected error: %v", item.input, err)
+				continue
+			}
+			if asDec {
+				got.AsDec()
+			}
+
+			if e, a := item.expect, got; e.Cmp(a) != 0 {
+				t.Errorf("%v: expected %v, got %v", item.input, e.String(), a.String())
+			}
+			if e, a := item.expect.Format, got.Format; e != a {
+				t.Errorf("%v: expected %#v, got %#v", item.input, e, a)
+			}
+
+			if asDec {
+				if i, ok := got.AsInt64(); i != 0 || ok {
+					t.Errorf("%v: expected inf.Dec to return false for AsInt64: %d", item.input, i)
+				}
+				continue
+			}
+			i, ok := item.expect.AsInt64()
+			if !ok {
+				continue
+			}
+			j, ok := got.AsInt64()
+			if !ok {
+				if got.d.Dec == nil && got.i.scale >= 0 {
+					t.Errorf("%v: is an int64Amount, but can't return AsInt64: %v", item.input, got)
+				}
+				continue
+			}
+			if i != j {
+				t.Errorf("%v: expected equivalent representation as int64: %d %d", item.input, i, j)
+			}
+		}
+
+		for _, item := range table {
+			got, err := ParseQuantity(item.input)
+			if err != nil {
+				t.Errorf("%v: unexpected error: %v", item.input, err)
+				continue
+			}
+
+			if asDec {
+				got.AsDec()
+			}
+
+			for _, format := range []Format{DecimalSI, BinarySI, DecimalExponent} {
+				// ensure we are not simply checking pointer equality by creating a new inf.Dec
+				var copied inf.Dec
+				copied.Add(inf.NewDec(0, inf.Scale(0)), got.AsDec())
+				q := NewDecimalQuantity(copied, format)
+				if c := q.Cmp(got); c != 0 {
+					t.Errorf("%v: round trip from decimal back to quantity is not comparable: %d: %#v vs %#v", item.input, c, got, q)
+				}
+			}
+
+			// verify that we can decompose the input and get the same result by building up from the base.
+			positive, _, num, denom, suffix, err := parseQuantityString(item.input)
+			if err != nil {
+				t.Errorf("%v: unexpected error: %v", item.input, err)
+				continue
+			}
+			if got.Sign() >= 0 && !positive || got.Sign() < 0 && positive {
+				t.Errorf("%v: positive was incorrect: %t", item.input, positive)
+				continue
+			}
+			var value string
+			if !positive {
+				value = "-"
+			}
+			value += num
+			if len(denom) > 0 {
+				value += "." + denom
+			}
+			value += suffix
+			if len(value) == 0 {
+				t.Errorf("%v: did not parse correctly, %q %q %q", item.input, num, denom, suffix)
+			}
+			expected, err := ParseQuantity(value)
+			if err != nil {
+				t.Errorf("%v: unexpected error for %s: %v", item.input, value, err)
+				continue
+			}
+			if expected.Cmp(got) != 0 {
+				t.Errorf("%v: not the same as %s", item.input, value)
+				continue
+			}
+		}
+
+		// Try the negative version of everything
+		desired := &inf.Dec{}
+		expect := Quantity{d: infDecAmount{Dec: desired}}
+		for _, item := range table {
+			got, err := ParseQuantity("-" + strings.TrimLeftFunc(item.input, unicode.IsSpace))
+			if err != nil {
+				t.Errorf("-%v: unexpected error: %v", item.input, err)
+				continue
+			}
+			if asDec {
+				got.AsDec()
+			}
+
+			expected := item.expect
+			desired.Neg(expected.AsDec())
+
+			if e, a := expect, got; e.Cmp(a) != 0 {
+				t.Errorf("%v: expected %s, got %s", item.input, e.String(), a.String())
+			}
+			if e, a := expected.Format, got.Format; e != a {
+				t.Errorf("%v: expected %#v, got %#v", item.input, e, a)
+			}
+		}
+
+		// Try everything with an explicit +
+		for _, item := range table {
+			got, err := ParseQuantity("+" + strings.TrimLeftFunc(item.input, unicode.IsSpace))
+			if err != nil {
+				t.Errorf("-%v: unexpected error: %v", item.input, err)
+				continue
+			}
+			if asDec {
+				got.AsDec()
+			}
+
+			if e, a := item.expect, got; e.Cmp(a) != 0 {
+				t.Errorf("%v(%t): expected %s, got %s", item.input, asDec, e.String(), a.String())
+			}
+			if e, a := item.expect.Format, got.Format; e != a {
+				t.Errorf("%v: expected %#v, got %#v", item.input, e, a)
+			}
+		}
+	}
+
+	invalid := []string{
+		"1.1.M",
+		"1+1.0M",
+		"0.1mi",
+		"0.1am",
+		"aoeu",
+		".5i",
+		"1i",
+		"-3.01i",
+		"-3.01e-",
+
+		// trailing whitespace is forbidden
+		" 1",
+		"1 ",
+	}
+	for _, item := range invalid {
+		_, err := ParseQuantity(item)
+		if err == nil {
+			t.Errorf("%v parsed unexpectedly", item)
+		}
+	}
+}
+
+func TestQuantityRoundUp(t *testing.T) {
+	table := []struct {
+		in     string
+		scale  Scale
+		expect Quantity
+		ok     bool
+	}{
+		{"9.01", -3, decQuantity(901, -2, DecimalSI), true},
+		{"9.01", -2, decQuantity(901, -2, DecimalSI), true},
+		{"9.01", -1, decQuantity(91, -1, DecimalSI), false},
+		{"9.01", 0, decQuantity(10, 0, DecimalSI), false},
+		{"9.01", 1, decQuantity(10, 0, DecimalSI), false},
+		{"9.01", 2, decQuantity(100, 0, DecimalSI), false},
+
+		{"-9.01", -3, decQuantity(-901, -2, DecimalSI), true},
+		{"-9.01", -2, decQuantity(-901, -2, DecimalSI), true},
+		{"-9.01", -1, decQuantity(-91, -1, DecimalSI), false},
+		{"-9.01", 0, decQuantity(-10, 0, DecimalSI), false},
+		{"-9.01", 1, decQuantity(-10, 0, DecimalSI), false},
+		{"-9.01", 2, decQuantity(-100, 0, DecimalSI), false},
+	}
+
+	for _, asDec := range []bool{false, true} {
+		for _, item := range table {
+			got, err := ParseQuantity(item.in)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			expect := item.expect.DeepCopy()
+			if asDec {
+				got.AsDec()
+			}
+			if ok := got.RoundUp(item.scale); ok != item.ok {
+				t.Errorf("%s(%d,%t): unexpected ok: %t", item.in, item.scale, asDec, ok)
+			}
+			if got.Cmp(expect) != 0 {
+				t.Errorf("%s(%d,%t): unexpected round: %s vs %s", item.in, item.scale, asDec, got.String(), expect.String())
+			}
+		}
+	}
+}
+
+func TestQuantityCmpInt64AndDec(t *testing.T) {
+	table := []struct {
+		a, b Quantity
+		cmp  int
+	}{
+		{intQuantity(901, -2, DecimalSI), intQuantity(901, -2, DecimalSI), 0},
+		{intQuantity(90, -1, DecimalSI), intQuantity(901, -2, DecimalSI), -1},
+		{intQuantity(901, -2, DecimalSI), intQuantity(900, -2, DecimalSI), 1},
+		{intQuantity(0, 0, DecimalSI), intQuantity(0, 0, DecimalSI), 0},
+		{intQuantity(0, 1, DecimalSI), intQuantity(0, -1, DecimalSI), 0},
+		{intQuantity(0, -1, DecimalSI), intQuantity(0, 1, DecimalSI), 0},
+		{intQuantity(800, -3, DecimalSI), intQuantity(1, 0, DecimalSI), -1},
+		{intQuantity(800, -3, DecimalSI), intQuantity(79, -2, DecimalSI), 1},
+
+		{intQuantity(mostPositive, 0, DecimalSI), intQuantity(1, -1, DecimalSI), 1},
+		{intQuantity(mostPositive, 1, DecimalSI), intQuantity(1, 0, DecimalSI), 1},
+		{intQuantity(mostPositive, 1, DecimalSI), intQuantity(1, 1, DecimalSI), 1},
+		{intQuantity(mostPositive, 1, DecimalSI), intQuantity(0, 1, DecimalSI), 1},
+		{intQuantity(mostPositive, -16, DecimalSI), intQuantity(1, 3, DecimalSI), -1},
+
+		{intQuantity(mostNegative, 0, DecimalSI), intQuantity(0, 0, DecimalSI), -1},
+		{intQuantity(mostNegative, -18, DecimalSI), intQuantity(-1, 0, DecimalSI), -1},
+		{intQuantity(mostNegative, -19, DecimalSI), intQuantity(-1, 0, DecimalSI), 1},
+
+		{intQuantity(1*1000000*1000000*1000000, -17, DecimalSI), intQuantity(1, 1, DecimalSI), 0},
+		{intQuantity(1*1000000*1000000*1000000, -17, DecimalSI), intQuantity(-10, 0, DecimalSI), 1},
+		{intQuantity(-1*1000000*1000000*1000000, -17, DecimalSI), intQuantity(-10, 0, DecimalSI), 0},
+		{intQuantity(1*1000000*1000000*1000000, -17, DecimalSI), intQuantity(1, 0, DecimalSI), 1},
+
+		{intQuantity(1*1000000*1000000*1000000+1, -17, DecimalSI), intQuantity(1, 1, DecimalSI), 1},
+		{intQuantity(1*1000000*1000000*1000000-1, -17, DecimalSI), intQuantity(1, 1, DecimalSI), -1},
+	}
+
+	for _, item := range table {
+		if cmp := item.a.Cmp(item.b); cmp != item.cmp {
+			t.Errorf("%#v: unexpected Cmp: %d", item, cmp)
+		}
+		if cmp := item.b.Cmp(item.a); cmp != -item.cmp {
+			t.Errorf("%#v: unexpected inverted Cmp: %d", item, cmp)
+		}
+	}
+
+	for _, item := range table {
+		a, b := item.a.DeepCopy(), item.b.DeepCopy()
+		a.AsDec()
+		if cmp := a.Cmp(b); cmp != item.cmp {
+			t.Errorf("%#v: unexpected Cmp: %d", item, cmp)
+		}
+		if cmp := b.Cmp(a); cmp != -item.cmp {
+			t.Errorf("%#v: unexpected inverted Cmp: %d", item, cmp)
+		}
+	}
+
+	for _, item := range table {
+		a, b := item.a.DeepCopy(), item.b.DeepCopy()
+		b.AsDec()
+		if cmp := a.Cmp(b); cmp != item.cmp {
+			t.Errorf("%#v: unexpected Cmp: %d", item, cmp)
+		}
+		if cmp := b.Cmp(a); cmp != -item.cmp {
+			t.Errorf("%#v: unexpected inverted Cmp: %d", item, cmp)
+		}
+	}
+
+	for _, item := range table {
+		a, b := item.a.DeepCopy(), item.b.DeepCopy()
+		a.AsDec()
+		b.AsDec()
+		if cmp := a.Cmp(b); cmp != item.cmp {
+			t.Errorf("%#v: unexpected Cmp: %d", item, cmp)
+		}
+		if cmp := b.Cmp(a); cmp != -item.cmp {
+			t.Errorf("%#v: unexpected inverted Cmp: %d", item, cmp)
+		}
+	}
+}
+
+func TestQuantityNeg(t *testing.T) {
+	table := []struct {
+		a   Quantity
+		out string
+	}{
+		{intQuantity(901, -2, DecimalSI), "-9010m"},
+		{decQuantity(901, -2, DecimalSI), "-9010m"},
+	}
+
+	for i, item := range table {
+		out := item.a.DeepCopy()
+		out.Neg()
+		if out.Cmp(item.a) == 0 {
+			t.Errorf("%d: negating an item should not mutate the source: %s", i, out.String())
+		}
+		if out.String() != item.out {
+			t.Errorf("%d: negating did not equal exact value: %s", i, out.String())
+		}
+	}
+}
+
+func TestQuantityString(t *testing.T) {
+	table := []struct {
+		in        Quantity
+		expect    string
+		alternate string
+	}{
+		{decQuantity(1024*1024*1024, 0, BinarySI), "1Gi", "1024Mi"},
+		{decQuantity(300*1024*1024, 0, BinarySI), "300Mi", "307200Ki"},
+		{decQuantity(6*1024, 0, BinarySI), "6Ki", ""},
+		{decQuantity(1001*1024*1024*1024, 0, BinarySI), "1001Gi", "1025024Mi"},
+		{decQuantity(1024*1024*1024*1024, 0, BinarySI), "1Ti", "1024Gi"},
+		{decQuantity(5, 0, BinarySI), "5", "5000m"},
+		{decQuantity(500, -3, BinarySI), "500m", "0.5"},
+		{decQuantity(1, 9, DecimalSI), "1G", "1000M"},
+		{decQuantity(1000, 6, DecimalSI), "1G", "0.001T"},
+		{decQuantity(1000000, 3, DecimalSI), "1G", ""},
+		{decQuantity(1000000000, 0, DecimalSI), "1G", ""},
+		{decQuantity(1, -3, DecimalSI), "1m", "1000u"},
+		{decQuantity(80, -3, DecimalSI), "80m", ""},
+		{decQuantity(1080, -3, DecimalSI), "1080m", "1.08"},
+		{decQuantity(108, -2, DecimalSI), "1080m", "1080000000n"},
+		{decQuantity(10800, -4, DecimalSI), "1080m", ""},
+		{decQuantity(300, 6, DecimalSI), "300M", ""},
+		{decQuantity(1, 12, DecimalSI), "1T", ""},
+		{decQuantity(1234567, 6, DecimalSI), "1234567M", ""},
+		{decQuantity(1234567, -3, BinarySI), "1234567m", ""},
+		{decQuantity(3, 3, DecimalSI), "3k", ""},
+		{decQuantity(1025, 0, BinarySI), "1025", ""},
+		{decQuantity(0, 0, DecimalSI), "0", ""},
+		{decQuantity(0, 0, BinarySI), "0", ""},
+		{decQuantity(1, 9, DecimalExponent), "1e9", ".001e12"},
+		{decQuantity(1, -3, DecimalExponent), "1e-3", "0.001e0"},
+		{decQuantity(1, -9, DecimalExponent), "1e-9", "1000e-12"},
+		{decQuantity(80, -3, DecimalExponent), "80e-3", ""},
+		{decQuantity(300, 6, DecimalExponent), "300e6", ""},
+		{decQuantity(1, 12, DecimalExponent), "1e12", ""},
+		{decQuantity(1, 3, DecimalExponent), "1e3", ""},
+		{decQuantity(3, 3, DecimalExponent), "3e3", ""},
+		{decQuantity(3, 3, DecimalSI), "3k", ""},
+		{decQuantity(0, 0, DecimalExponent), "0", "00"},
+		{decQuantity(1, -9, DecimalSI), "1n", ""},
+		{decQuantity(80, -9, DecimalSI), "80n", ""},
+		{decQuantity(1080, -9, DecimalSI), "1080n", ""},
+		{decQuantity(108, -8, DecimalSI), "1080n", ""},
+		{decQuantity(10800, -10, DecimalSI), "1080n", ""},
+		{decQuantity(1, -6, DecimalSI), "1u", ""},
+		{decQuantity(80, -6, DecimalSI), "80u", ""},
+		{decQuantity(1080, -6, DecimalSI), "1080u", ""},
+	}
+	for _, item := range table {
+		got := item.in.String()
+		if e, a := item.expect, got; e != a {
+			t.Errorf("%#v: expected %v, got %v", item.in, e, a)
+		}
+		q, err := ParseQuantity(item.expect)
+		if err != nil {
+			t.Errorf("%#v: unexpected error: %v", item.expect, err)
+		}
+		if len(q.s) == 0 || q.s != item.expect {
+			t.Errorf("%#v: did not copy canonical string on parse: %s", item.expect, q.s)
+		}
+		if len(item.alternate) == 0 {
+			continue
+		}
+		q, err = ParseQuantity(item.alternate)
+		if err != nil {
+			t.Errorf("%#v: unexpected error: %v", item.expect, err)
+			continue
+		}
+		if len(q.s) != 0 {
+			t.Errorf("%#v: unexpected nested string: %v", item.expect, q.s)
+		}
+		if q.String() != item.expect {
+			t.Errorf("%#v: unexpected alternate canonical: %v", item.expect, q.String())
+		}
+		if len(q.s) == 0 || q.s != item.expect {
+			t.Errorf("%#v: did not set canonical string on ToString: %s", item.expect, q.s)
+		}
+	}
+	desired := &inf.Dec{} // Avoid modifying the values in the table.
+	for _, item := range table {
+		if item.in.Cmp(Quantity{}) == 0 {
+			// Don't expect it to print "-0" ever
+			continue
+		}
+		q := item.in
+		q.d = infDecAmount{desired.Neg(q.AsDec())}
+		if e, a := "-"+item.expect, q.String(); e != a {
+			t.Errorf("%#v: expected %v, got %v", item.in, e, a)
+		}
+	}
+}
+
+func TestQuantityParseEmit(t *testing.T) {
+	table := []struct {
+		in     string
+		expect string
+	}{
+		{"1Ki", "1Ki"},
+		{"1Mi", "1Mi"},
+		{"1Gi", "1Gi"},
+		{"1024Mi", "1Gi"},
+		{"1000M", "1G"},
+		{".001Ki", "1024m"},
+		{".000001Ki", "1024u"},
+		{".000000001Ki", "1024n"},
+		{".000000000001Ki", "2n"},
+	}
+
+	for _, item := range table {
+		q, err := ParseQuantity(item.in)
+		if err != nil {
+			t.Errorf("Couldn't parse %v", item.in)
+			continue
+		}
+		if e, a := item.expect, q.String(); e != a {
+			t.Errorf("%#v: expected %v, got %v", item.in, e, a)
+		}
+	}
+	for _, item := range table {
+		q, err := ParseQuantity("-" + item.in)
+		if err != nil {
+			t.Errorf("Couldn't parse %v", item.in)
+			continue
+		}
+		if q.Cmp(Quantity{}) == 0 {
+			continue
+		}
+		if e, a := "-"+item.expect, q.String(); e != a {
+			t.Errorf("%#v: expected %v, got %v (%#v)", item.in, e, a, q.i)
+		}
+	}
+}
+
+var fuzzer = randfill.New().Funcs(
+	func(q *Quantity, c randfill.Continue) {
+		q.i = Zero
+		if c.Bool() {
+			q.Format = BinarySI
+			if c.Bool() {
+				dec := &inf.Dec{}
+				q.d = infDecAmount{Dec: dec}
+				dec.SetScale(0)
+				dec.SetUnscaled(c.Int63())
+				return
+			}
+			// Be sure to test cases like 1Mi
+			dec := &inf.Dec{}
+			q.d = infDecAmount{Dec: dec}
+			dec.SetScale(0)
+			dec.SetUnscaled(c.Int63n(1024) << uint(10*c.Intn(5)))
+			return
+		}
+		if c.Bool() {
+			q.Format = DecimalSI
+		} else {
+			q.Format = DecimalExponent
+		}
+		if c.Bool() {
+			dec := &inf.Dec{}
+			q.d = infDecAmount{Dec: dec}
+			dec.SetScale(inf.Scale(c.Intn(4)))
+			dec.SetUnscaled(c.Int63())
+			return
+		}
+		// Be sure to test cases like 1M
+		dec := &inf.Dec{}
+		q.d = infDecAmount{Dec: dec}
+		dec.SetScale(inf.Scale(3 - c.Intn(15)))
+		dec.SetUnscaled(c.Int63n(1000))
+	},
+)
+
+func TestQuantityDeepCopy(t *testing.T) {
+	// Test when d is nil
+	slice := []string{"0", "100m", "50m", "10000T"}
+	for _, testCase := range slice {
+		q := MustParse(testCase)
+		if result := q.DeepCopy(); result != q {
+			t.Errorf("Expected: %v, Actual: %v", q, result)
+		}
+	}
+	table := []*inf.Dec{
+		dec(0, 0).Dec,
+		dec(10, 0).Dec,
+		dec(-10, 0).Dec,
+	}
+	// Test when i is {0,0}
+	for _, testCase := range table {
+		q := Quantity{d: infDecAmount{testCase}, Format: DecimalSI}
+		result := q.DeepCopy()
+		if q.d.Cmp(result.AsDec()) != 0 {
+			t.Errorf("Expected: %v, Actual: %v", q.String(), result.String())
+		}
+		result = Quantity{d: infDecAmount{dec(2, 0).Dec}, Format: DecimalSI}
+		if q.d.Cmp(result.AsDec()) == 0 {
+			t.Errorf("Modifying result has affected q")
+		}
+	}
+}
+
+func TestJSON(t *testing.T) {
+	for i := 0; i < 500; i++ {
+		q := &Quantity{}
+		fuzzer.Fill(q)
+		b, err := json.Marshal(q)
+		if err != nil {
+			t.Errorf("error encoding %v: %v", q, err)
+			continue
+		}
+		q2 := &Quantity{}
+		err = json.Unmarshal(b, q2)
+		if err != nil {
+			t.Logf("%d: %s", i, string(b))
+			t.Errorf("%v: error decoding %v: %v", q, string(b), err)
+		}
+		if q2.Cmp(*q) != 0 {
+			t.Errorf("Expected equal: %v, %v (json was '%v')", q, q2, string(b))
+		}
+	}
+}
+
+func TestJSONWhitespace(t *testing.T) {
+	q := Quantity{}
+	testCases := []struct {
+		in     string
+		expect string
+	}{
+		{`" 1"`, "1"},
+		{`"1 "`, "1"},
+		{`1`, "1"},
+		{` 1`, "1"},
+		{`1 `, "1"},
+		{`10`, "10"},
+		{`-1`, "-1"},
+		{` -1`, "-1"},
+	}
+	for _, test := range testCases {
+		if err := json.Unmarshal([]byte(test.in), &q); err != nil {
+			t.Errorf("%q: %v", test.in, err)
+		}
+		if q.String() != test.expect {
+			t.Errorf("unexpected string: %q", q.String())
+		}
+	}
+}
+
+func TestMilliNewSet(t *testing.T) {
+	table := []struct {
+		value  int64
+		format Format
+		expect string
+		exact  bool
+	}{
+		{1, DecimalSI, "1m", true},
+		{1000, DecimalSI, "1", true},
+		{1234000, DecimalSI, "1234", true},
+		{1024, BinarySI, "1024m", false}, // Format changes
+		{1000000, "invalidFormatDefaultsToExponent", "1e3", true},
+		{1024 * 1024, BinarySI, "1048576m", false}, // Format changes
+	}
+
+	for _, item := range table {
+		q := NewMilliQuantity(item.value, item.format)
+		if e, a := item.expect, q.String(); e != a {
+			t.Errorf("Expected %v, got %v; %#v", e, a, q)
+		}
+		if !item.exact {
+			continue
+		}
+		q2, err := ParseQuantity(q.String())
+		if err != nil {
+			t.Errorf("Round trip failed on %v", q)
+		}
+		if e, a := item.value, q2.MilliValue(); e != a {
+			t.Errorf("Expected %v, got %v", e, a)
+		}
+	}
+
+	for _, item := range table {
+		q := NewQuantity(0, item.format)
+		q.SetMilli(item.value)
+		if e, a := item.expect, q.String(); e != a {
+			t.Errorf("Set: Expected %v, got %v; %#v", e, a, q)
+		}
+	}
+}
+
+func TestNewSet(t *testing.T) {
+	table := []struct {
+		value  int64
+		format Format
+		expect string
+	}{
+		{1, DecimalSI, "1"},
+		{1000, DecimalSI, "1k"},
+		{1234000, DecimalSI, "1234k"},
+		{1024, BinarySI, "1Ki"},
+		{1000000, "invalidFormatDefaultsToExponent", "1e6"},
+		{1024 * 1024, BinarySI, "1Mi"},
+	}
+
+	for _, asDec := range []bool{false, true} {
+		for _, item := range table {
+			q := NewQuantity(item.value, item.format)
+			if asDec {
+				q.ToDec()
+			}
+			if e, a := item.expect, q.String(); e != a {
+				t.Errorf("Expected %v, got %v; %#v", e, a, q)
+			}
+			q2, err := ParseQuantity(q.String())
+			if err != nil {
+				t.Errorf("Round trip failed on %v", q)
+			}
+			if e, a := item.value, q2.Value(); e != a {
+				t.Errorf("Expected %v, got %v", e, a)
+			}
+		}
+
+		for _, item := range table {
+			q := NewQuantity(0, item.format)
+			q.Set(item.value)
+			if asDec {
+				q.ToDec()
+			}
+			if e, a := item.expect, q.String(); e != a {
+				t.Errorf("Set: Expected %v, got %v; %#v", e, a, q)
+			}
+		}
+	}
+}
+
+func TestNewScaledSet(t *testing.T) {
+	table := []struct {
+		value  int64
+		scale  Scale
+		expect string
+	}{
+		{1, Nano, "1n"},
+		{1000, Nano, "1u"},
+		{1, Micro, "1u"},
+		{1000, Micro, "1m"},
+		{1, Milli, "1m"},
+		{1000, Milli, "1"},
+		{1, 0, "1"},
+		{0, Nano, "0"},
+		{0, Micro, "0"},
+		{0, Milli, "0"},
+		{0, 0, "0"},
+	}
+
+	for _, item := range table {
+		q := NewScaledQuantity(item.value, item.scale)
+		if e, a := item.expect, q.String(); e != a {
+			t.Errorf("Expected %v, got %v; %#v", e, a, q)
+		}
+		q2, err := ParseQuantity(q.String())
+		if err != nil {
+			t.Errorf("Round trip failed on %v", q)
+		}
+		if e, a := item.value, q2.ScaledValue(item.scale); e != a {
+			t.Errorf("Expected %v, got %v", e, a)
+		}
+		q3 := NewQuantity(0, DecimalSI)
+		q3.SetScaled(item.value, item.scale)
+		if q.Cmp(*q3) != 0 {
+			t.Errorf("Expected %v and %v to be equal", q, q3)
+		}
+	}
+}
+
+func TestScaledValue(t *testing.T) {
+	table := []struct {
+		fromScale Scale
+		toScale   Scale
+		expected  int64
+	}{
+		{Nano, Nano, 1},
+		{Nano, Micro, 1},
+		{Nano, Milli, 1},
+		{Nano, 0, 1},
+		{Micro, Nano, 1000},
+		{Micro, Micro, 1},
+		{Micro, Milli, 1},
+		{Micro, 0, 1},
+		{Milli, Nano, 1000 * 1000},
+		{Milli, Micro, 1000},
+		{Milli, Milli, 1},
+		{Milli, 0, 1},
+		{0, Nano, 1000 * 1000 * 1000},
+		{0, Micro, 1000 * 1000},
+		{0, Milli, 1000},
+		{0, 0, 1},
+		{2, -2, 100 * 100},
+	}
+
+	for _, item := range table {
+		q := NewScaledQuantity(1, item.fromScale)
+		if e, a := item.expected, q.ScaledValue(item.toScale); e != a {
+			t.Errorf("%v to %v: Expected %v, got %v", item.fromScale, item.toScale, e, a)
+		}
+	}
+}
+
+func TestUninitializedNoCrash(t *testing.T) {
+	var q Quantity
+
+	q.Value()
+	q.MilliValue()
+	q.DeepCopy()
+	_ = q.String()
+	q.MarshalJSON()
+}
+
+func TestDeepCopy(t *testing.T) {
+	q := NewQuantity(5, DecimalSI)
+	c := q.DeepCopy()
+	c.Set(6)
+	if q.Value() == 6 {
+		t.Errorf("Copy didn't")
+	}
+}
+
+func TestSub(t *testing.T) {
+	tests := []struct {
+		a        Quantity
+		b        Quantity
+		expected Quantity
+	}{
+		{decQuantity(10, 0, DecimalSI), decQuantity(1, 1, DecimalSI), decQuantity(0, 0, DecimalSI)},
+		{decQuantity(10, 0, DecimalSI), decQuantity(1, 0, BinarySI), decQuantity(9, 0, DecimalSI)},
+		{decQuantity(10, 0, BinarySI), decQuantity(1, 0, DecimalSI), decQuantity(9, 0, BinarySI)},
+		{Quantity{Format: DecimalSI}, decQuantity(50, 0, DecimalSI), decQuantity(-50, 0, DecimalSI)},
+		{decQuantity(50, 0, DecimalSI), Quantity{Format: DecimalSI}, decQuantity(50, 0, DecimalSI)},
+		{Quantity{Format: DecimalSI}, Quantity{Format: DecimalSI}, decQuantity(0, 0, DecimalSI)},
+	}
+
+	for i, test := range tests {
+		test.a.Sub(test.b)
+		if test.a.Cmp(test.expected) != 0 {
+			t.Errorf("[%d] Expected %q, got %q", i, test.expected.String(), test.a.String())
+		}
+	}
+}
+
+func TestNeg(t *testing.T) {
+	tests := []struct {
+		a        Quantity
+		b        Quantity
+		expected Quantity
+	}{
+		{a: intQuantity(0, 0, DecimalSI), expected: intQuantity(0, 0, DecimalSI)},
+		{a: Quantity{}, expected: Quantity{}},
+		{a: intQuantity(10, 0, BinarySI), expected: intQuantity(-10, 0, BinarySI)},
+		{a: intQuantity(-10, 0, BinarySI), expected: intQuantity(10, 0, BinarySI)},
+		{a: decQuantity(0, 0, DecimalSI), expected: intQuantity(0, 0, DecimalSI)},
+		{a: decQuantity(10, 0, BinarySI), expected: intQuantity(-10, 0, BinarySI)},
+		{a: decQuantity(-10, 0, BinarySI), expected: intQuantity(10, 0, BinarySI)},
+	}
+
+	for i, test := range tests {
+		a := test.a.DeepCopy()
+		a.Neg()
+		// ensure value is same
+		if a.Cmp(test.expected) != 0 {
+			t.Errorf("[%d] Expected %q, got %q", i, test.expected.String(), a.String())
+		}
+	}
+}
+
+func TestAdd(t *testing.T) {
+	tests := []struct {
+		a        Quantity
+		b        Quantity
+		expected Quantity
+	}{
+		{decQuantity(10, 0, DecimalSI), decQuantity(1, 1, DecimalSI), decQuantity(20, 0, DecimalSI)},
+		{decQuantity(10, 0, DecimalSI), decQuantity(1, 0, BinarySI), decQuantity(11, 0, DecimalSI)},
+		{decQuantity(10, 0, BinarySI), decQuantity(1, 0, DecimalSI), decQuantity(11, 0, BinarySI)},
+		{Quantity{Format: DecimalSI}, decQuantity(50, 0, DecimalSI), decQuantity(50, 0, DecimalSI)},
+		{decQuantity(50, 0, DecimalSI), Quantity{Format: DecimalSI}, decQuantity(50, 0, DecimalSI)},
+		{Quantity{Format: DecimalSI}, Quantity{Format: DecimalSI}, decQuantity(0, 0, DecimalSI)},
+	}
+
+	for i, test := range tests {
+		test.a.Add(test.b)
+		if test.a.Cmp(test.expected) != 0 {
+			t.Errorf("[%d] Expected %q, got %q", i, test.expected.String(), test.a.String())
+		}
+	}
+}
+
+func TestMul(t *testing.T) {
+	tests := []struct {
+		a        Quantity
+		b        int64
+		expected Quantity
+		ok       bool
+	}{
+		{decQuantity(10, 0, DecimalSI), 10, decQuantity(100, 0, DecimalSI), true},
+		{decQuantity(10, 0, DecimalSI), 1, decQuantity(10, 0, DecimalSI), true},
+		{decQuantity(10, 0, BinarySI), 1, decQuantity(10, 0, BinarySI), true},
+		{Quantity{Format: DecimalSI}, 50, decQuantity(0, 0, DecimalSI), true},
+		{decQuantity(50, 0, DecimalSI), 0, decQuantity(0, 0, DecimalSI), true},
+		{Quantity{Format: DecimalSI}, 0, decQuantity(0, 0, DecimalSI), true},
+
+		{decQuantity(10, 0, DecimalSI), -10, decQuantity(-100, 0, DecimalSI), true},
+		{decQuantity(-10, 0, DecimalSI), 1, decQuantity(-10, 0, DecimalSI), true},
+		{decQuantity(10, 0, BinarySI), -1, decQuantity(-10, 0, BinarySI), true},
+		{decQuantity(-50, 0, DecimalSI), 0, decQuantity(0, 0, DecimalSI), true},
+		{decQuantity(-50, 0, DecimalSI), -50, decQuantity(2500, 0, DecimalSI), true},
+		{Quantity{Format: DecimalSI}, -50, decQuantity(0, 0, DecimalSI), true},
+		{decQuantity(mostPositive, 0, DecimalSI), 0, decQuantity(0, 1, DecimalSI), true},
+		{decQuantity(mostPositive, 0, DecimalSI), 1, decQuantity(mostPositive, 0, DecimalSI), true},
+		{decQuantity(mostPositive, 0, DecimalSI), -1, decQuantity(-mostPositive, 0, DecimalSI), true},
+		{decQuantity(mostPositive/2, 0, DecimalSI), 2, decQuantity((mostPositive/2)*2, 0, DecimalSI), true},
+		{decQuantity(mostPositive/-2, 0, DecimalSI), -2, decQuantity((mostPositive/2)*2, 0, DecimalSI), true},
+		{decQuantity(mostPositive, 0, DecimalSI), 2,
+			bigDecQuantity(big.NewInt(0).Mul(bigMostPositive, big.NewInt(2)), 0, DecimalSI), false},
+		{decQuantity(mostPositive, 0, DecimalSI), 10, decQuantity(mostPositive, 1, DecimalSI), false},
+		{decQuantity(mostPositive, 0, DecimalSI), -10, decQuantity(-mostPositive, 1, DecimalSI), false},
+		{decQuantity(mostNegative, 0, DecimalSI), 0, decQuantity(0, 1, DecimalSI), true},
+		{decQuantity(mostNegative, 0, DecimalSI), 1, decQuantity(mostNegative, 0, DecimalSI), true},
+		{decQuantity(mostNegative, 0, DecimalSI), -1,
+			bigDecQuantity(big.NewInt(0).Add(bigMostPositive, big.NewInt(1)), 0, DecimalSI), false},
+		{decQuantity(mostNegative/2, 0, DecimalSI), 2, decQuantity(mostNegative, 0, DecimalSI), true},
+		{decQuantity(mostNegative/-2, 0, DecimalSI), -2, decQuantity(mostNegative, 0, DecimalSI), true},
+		{decQuantity(mostNegative, 0, DecimalSI), 2,
+			bigDecQuantity(big.NewInt(0).Mul(bigMostNegative, big.NewInt(2)), 0, DecimalSI), false},
+		{decQuantity(mostNegative, 0, DecimalSI), 10, decQuantity(mostNegative, 1, DecimalSI), false},
+		{decQuantity(mostNegative, 0, DecimalSI), -10,
+			bigDecQuantity(big.NewInt(0).Add(bigMostPositive, big.NewInt(1)), 1, DecimalSI), false},
+	}
+
+	for i, test := range tests {
+		if ok := test.a.Mul(test.b); test.ok != ok {
+			t.Errorf("[%d] Expected ok: %t, got ok: %t", i, test.ok, ok)
+		}
+		if test.a.Cmp(test.expected) != 0 {
+			t.Errorf("[%d] Expected %q, got %q", i, test.expected.AsDec().String(), test.a.AsDec().String())
+		}
+	}
+}
+
+func TestAddSubRoundTrip(t *testing.T) {
+	for k := -10; k <= 10; k++ {
+		q := Quantity{Format: DecimalSI}
+		var order []int64
+		for i := 0; i < 100; i++ {
+			j := rand.Int63()
+			order = append(order, j)
+			q.Add(*NewScaledQuantity(j, Scale(k)))
+		}
+		for _, j := range order {
+			q.Sub(*NewScaledQuantity(j, Scale(k)))
+		}
+		if !q.IsZero() {
+			t.Errorf("addition and subtraction did not cancel: %s", &q)
+		}
+	}
+}
+
+func TestAddSubRoundTripAcrossScales(t *testing.T) {
+	q := Quantity{Format: DecimalSI}
+	var order []int64
+	for i := 0; i < 100; i++ {
+		j := rand.Int63()
+		order = append(order, j)
+		q.Add(*NewScaledQuantity(j, Scale(j%20-10)))
+	}
+	for _, j := range order {
+		q.Sub(*NewScaledQuantity(j, Scale(j%20-10)))
+	}
+	if !q.IsZero() {
+		t.Errorf("addition and subtraction did not cancel: %s", &q)
+	}
+}
+
+func TestNegateRoundTrip(t *testing.T) {
+	for _, asDec := range []bool{false, true} {
+		for k := -10; k <= 10; k++ {
+			for i := 0; i < 100; i++ {
+				j := rand.Int63()
+				q := *NewScaledQuantity(j, Scale(k))
+				if asDec {
+					q.AsDec()
+				}
+
+				b := q.DeepCopy()
+				b.Neg()
+				b.Neg()
+				if b.Cmp(q) != 0 {
+					t.Errorf("double negation did not cancel: %s", &q)
+				}
+			}
+		}
+	}
+}
+
+func TestQuantityAsApproximateFloat64(t *testing.T) {
+	// NOTE: this table should be kept in sync with TestQuantityAsFloat64Slow
+	table := []struct {
+		in  Quantity
+		out float64
+	}{
+		{decQuantity(0, 0, DecimalSI), 0.0},
+		{decQuantity(0, 0, DecimalExponent), 0.0},
+		{decQuantity(0, 0, BinarySI), 0.0},
+
+		{decQuantity(1, 0, DecimalSI), 1},
+		{decQuantity(1, 0, DecimalExponent), 1},
+		{decQuantity(1, 0, BinarySI), 1},
+
+		// Binary suffixes
+		{decQuantity(1024, 0, BinarySI), 1024},
+		{decQuantity(8*1024, 0, BinarySI), 8 * 1024},
+		{decQuantity(7*1024*1024, 0, BinarySI), 7 * 1024 * 1024},
+		{decQuantity(7*1024*1024, 1, BinarySI), (7 * 1024 * 1024) * 10},
+		{decQuantity(7*1024*1024, 4, BinarySI), (7 * 1024 * 1024) * 10000},
+		{decQuantity(7*1024*1024, 8, BinarySI), (7 * 1024 * 1024) * 100000000},
+		{decQuantity(7*1024*1024, -1, BinarySI), (7 * 1024 * 1024) * math.Pow10(-1)}, // '* Pow10' and '/ float(10)' do not round the same way
+		{decQuantity(7*1024*1024, -8, BinarySI), (7 * 1024 * 1024) / float64(100000000)},
+
+		{decQuantity(1024, 0, DecimalSI), 1024},
+		{decQuantity(8*1024, 0, DecimalSI), 8 * 1024},
+		{decQuantity(7*1024*1024, 0, DecimalSI), 7 * 1024 * 1024},
+		{decQuantity(7*1024*1024, 1, DecimalSI), (7 * 1024 * 1024) * 10},
+		{decQuantity(7*1024*1024, 4, DecimalSI), (7 * 1024 * 1024) * 10000},
+		{decQuantity(7*1024*1024, 8, DecimalSI), (7 * 1024 * 1024) * 100000000},
+		{decQuantity(7*1024*1024, -1, DecimalSI), (7 * 1024 * 1024) * math.Pow10(-1)}, // '* Pow10' and '/ float(10)' do not round the same way
+		{decQuantity(7*1024*1024, -8, DecimalSI), (7 * 1024 * 1024) / float64(100000000)},
+
+		{decQuantity(1024, 0, DecimalExponent), 1024},
+		{decQuantity(8*1024, 0, DecimalExponent), 8 * 1024},
+		{decQuantity(7*1024*1024, 0, DecimalExponent), 7 * 1024 * 1024},
+		{decQuantity(7*1024*1024, 1, DecimalExponent), (7 * 1024 * 1024) * 10},
+		{decQuantity(7*1024*1024, 4, DecimalExponent), (7 * 1024 * 1024) * 10000},
+		{decQuantity(7*1024*1024, 8, DecimalExponent), (7 * 1024 * 1024) * 100000000},
+		{decQuantity(7*1024*1024, -1, DecimalExponent), (7 * 1024 * 1024) * math.Pow10(-1)}, // '* Pow10' and '/ float(10)' do not round the same way
+		{decQuantity(7*1024*1024, -8, DecimalExponent), (7 * 1024 * 1024) / float64(100000000)},
+
+		// very large numbers
+		{Quantity{d: maxAllowed, Format: DecimalSI}, math.MaxInt64},
+		{Quantity{d: maxAllowed, Format: BinarySI}, math.MaxInt64},
+		{decQuantity(12, 18, DecimalSI), 1.2e19},
+
+		// infinities caused due to float64 overflow
+		{decQuantity(12, 500, DecimalSI), math.Inf(0)},
+		{decQuantity(-12, 500, DecimalSI), math.Inf(-1)},
+	}
+
+	for i, item := range table {
+		t.Run(fmt.Sprintf("%s %s", item.in.Format, item.in.String()), func(t *testing.T) {
+			out := item.in.AsApproximateFloat64()
+			if out != item.out {
+				t.Fatalf("test %d expected %v, got %v", i+1, item.out, out)
+			}
+			if item.in.d.Dec != nil {
+				if i, ok := item.in.AsInt64(); ok {
+					q := intQuantity(i, 0, item.in.Format)
+					out := q.AsApproximateFloat64()
+					if out != item.out {
+						t.Fatalf("as int quantity: expected %v, got %v", item.out, out)
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestQuantityAsFloat64Slow(t *testing.T) {
+	// NOTE: this table should be kept in sync with TestQuantityAsApproximateFloat64
+	table := []struct {
+		in  Quantity
+		out float64
+	}{
+		{decQuantity(0, 0, DecimalSI), 0.0},
+		{decQuantity(0, 0, DecimalExponent), 0.0},
+		{decQuantity(0, 0, BinarySI), 0.0},
+
+		{decQuantity(1, 0, DecimalSI), 1},
+		{decQuantity(1, 0, DecimalExponent), 1},
+		{decQuantity(1, 0, BinarySI), 1},
+
+		// Binary suffixes
+		{decQuantity(1024, 0, BinarySI), 1024},
+		{decQuantity(8*1024, 0, BinarySI), 8 * 1024},
+		{decQuantity(7*1024*1024, 0, BinarySI), 7 * 1024 * 1024},
+		{decQuantity(7*1024*1024, 1, BinarySI), (7 * 1024 * 1024) * 10},
+		{decQuantity(7*1024*1024, 4, BinarySI), (7 * 1024 * 1024) * 10000},
+		{decQuantity(7*1024*1024, 8, BinarySI), (7 * 1024 * 1024) * 100000000},
+		{decQuantity(7*1024*1024, -1, BinarySI), (7 * 1024 * 1024) / float64(10)},
+		{decQuantity(7*1024*1024, -8, BinarySI), (7 * 1024 * 1024) / float64(100000000)},
+
+		{decQuantity(1024, 0, DecimalSI), 1024},
+		{decQuantity(8*1024, 0, DecimalSI), 8 * 1024},
+		{decQuantity(7*1024*1024, 0, DecimalSI), 7 * 1024 * 1024},
+		{decQuantity(7*1024*1024, 1, DecimalSI), (7 * 1024 * 1024) * 10},
+		{decQuantity(7*1024*1024, 4, DecimalSI), (7 * 1024 * 1024) * 10000},
+		{decQuantity(7*1024*1024, 8, DecimalSI), (7 * 1024 * 1024) * 100000000},
+		{decQuantity(7*1024*1024, -1, DecimalSI), (7 * 1024 * 1024) / float64(10)},
+		{decQuantity(7*1024*1024, -8, DecimalSI), (7 * 1024 * 1024) / float64(100000000)},
+
+		{decQuantity(1024, 0, DecimalExponent), 1024},
+		{decQuantity(8*1024, 0, DecimalExponent), 8 * 1024},
+		{decQuantity(7*1024*1024, 0, DecimalExponent), 7 * 1024 * 1024},
+		{decQuantity(7*1024*1024, 1, DecimalExponent), (7 * 1024 * 1024) * 10},
+		{decQuantity(7*1024*1024, 4, DecimalExponent), (7 * 1024 * 1024) * 10000},
+		{decQuantity(7*1024*1024, 8, DecimalExponent), (7 * 1024 * 1024) * 100000000},
+		{decQuantity(7*1024*1024, -1, DecimalExponent), (7 * 1024 * 1024) / float64(10)},
+		{decQuantity(7*1024*1024, -8, DecimalExponent), (7 * 1024 * 1024) / float64(100000000)},
+
+		// very large numbers
+		{Quantity{d: maxAllowed, Format: DecimalSI}, math.MaxInt64},
+		{Quantity{d: maxAllowed, Format: BinarySI}, math.MaxInt64},
+		{decQuantity(12, 18, DecimalSI), 1.2e19},
+
+		// infinities caused due to float64 overflow
+		{decQuantity(12, 500, DecimalSI), math.Inf(0)},
+		{decQuantity(-12, 500, DecimalSI), math.Inf(-1)},
+	}
+
+	for i, item := range table {
+		t.Run(fmt.Sprintf("%s %s", item.in.Format, item.in.String()), func(t *testing.T) {
+			out := item.in.AsFloat64Slow()
+			if out != item.out {
+				t.Fatalf("test %d expected %v, got %v", i+1, item.out, out)
+			}
+			if item.in.d.Dec != nil {
+				if i, ok := item.in.AsInt64(); ok {
+					q := intQuantity(i, 0, item.in.Format)
+					out := q.AsFloat64Slow()
+					if out != item.out {
+						t.Fatalf("as int quantity: expected %v, got %v", item.out, out)
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestStringQuantityAsApproximateFloat64(t *testing.T) {
+	table := []struct {
+		in  string
+		out float64
+	}{
+		{"2Ki", 2048},
+		{"1.1Ki", 1126.4e+0},
+		{"1Mi", 1.048576e+06},
+		{"2Gi", 2.147483648e+09},
+	}
+
+	for _, item := range table {
+		t.Run(item.in, func(t *testing.T) {
+			in, err := ParseQuantity(item.in)
+			if err != nil {
+				t.Fatal(err)
+			}
+			out := in.AsApproximateFloat64()
+			if out != item.out {
+				t.Fatalf("expected %v, got %v", item.out, out)
+			}
+			if in.d.Dec != nil {
+				if i, ok := in.AsInt64(); ok {
+					q := intQuantity(i, 0, in.Format)
+					out := q.AsApproximateFloat64()
+					if out != item.out {
+						t.Fatalf("as int quantity: expected %v, got %v", item.out, out)
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestStringQuantityAsFloat64Slow(t *testing.T) {
+	table := []struct {
+		in  string
+		out float64
+	}{
+		{"2Ki", 2048},
+		{"1.1Ki", 1126.4e+0},
+		{"1Mi", 1.048576e+06},
+		{"2Gi", 2.147483648e+09},
+	}
+
+	for _, item := range table {
+		t.Run(item.in, func(t *testing.T) {
+			in, err := ParseQuantity(item.in)
+			if err != nil {
+				t.Fatal(err)
+			}
+			out := in.AsFloat64Slow()
+			if out != item.out {
+				t.Fatalf("expected %v, got %v", item.out, out)
+			}
+			if in.d.Dec != nil {
+				if i, ok := in.AsInt64(); ok {
+					q := intQuantity(i, 0, in.Format)
+					out := q.AsFloat64Slow()
+					if out != item.out {
+						t.Fatalf("as int quantity: expected %v, got %v", item.out, out)
+					}
+				}
+			}
+		})
+	}
+}
+
+func benchmarkQuantities() []Quantity {
+	return []Quantity{
+		intQuantity(1024*1024*1024, 0, BinarySI),
+		intQuantity(1024*1024*1024*1024, 0, BinarySI),
+		intQuantity(1000000, 3, DecimalSI),
+		intQuantity(1000000000, 0, DecimalSI),
+		intQuantity(1, -3, DecimalSI),
+		intQuantity(80, -3, DecimalSI),
+		intQuantity(1080, -3, DecimalSI),
+		intQuantity(0, 0, BinarySI),
+		intQuantity(1, 9, DecimalExponent),
+		intQuantity(1, -9, DecimalSI),
+		intQuantity(1000000, 10, DecimalSI),
+	}
+}
+
+func BenchmarkQuantityString(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	var s string
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		q.s = ""
+		s = q.String()
+	}
+	b.StopTimer()
+	if len(s) == 0 {
+		b.Fatal(s)
+	}
+}
+
+func BenchmarkQuantityStringPrecalc(b *testing.B) {
+	values := benchmarkQuantities()
+	for i := range values {
+		_ = values[i].String()
+	}
+	b.ResetTimer()
+	var s string
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		s = q.String()
+	}
+	b.StopTimer()
+	if len(s) == 0 {
+		b.Fatal(s)
+	}
+}
+
+func BenchmarkQuantityStringBinarySI(b *testing.B) {
+	values := benchmarkQuantities()
+	for i := range values {
+		values[i].Format = BinarySI
+	}
+	b.ResetTimer()
+	var s string
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		q.s = ""
+		s = q.String()
+	}
+	b.StopTimer()
+	if len(s) == 0 {
+		b.Fatal(s)
+	}
+}
+
+func BenchmarkQuantityMarshalJSON(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		q.s = ""
+		if _, err := q.MarshalJSON(); err != nil {
+			b.Fatal(err)
+		}
+	}
+	b.StopTimer()
+}
+
+func BenchmarkQuantityUnmarshalJSON(b *testing.B) {
+	values := benchmarkQuantities()
+	var json [][]byte
+	for _, v := range values {
+		data, _ := v.MarshalJSON()
+		json = append(json, data)
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		var q Quantity
+		if err := q.UnmarshalJSON(json[i%len(values)]); err != nil {
+			b.Fatal(err)
+		}
+	}
+	b.StopTimer()
+}
+
+func BenchmarkParseQuantity(b *testing.B) {
+	values := benchmarkQuantities()
+	var strings []string
+	for _, v := range values {
+		strings = append(strings, v.String())
+	}
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		if _, err := ParseQuantity(strings[i%len(values)]); err != nil {
+			b.Fatal(err)
+		}
+	}
+	b.StopTimer()
+}
+
+func BenchmarkCanonicalize(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	buffer := make([]byte, 0, 100)
+	for i := 0; i < b.N; i++ {
+		s, _ := values[i%len(values)].CanonicalizeBytes(buffer)
+		if len(s) == 0 {
+			b.Fatal(s)
+		}
+	}
+	b.StopTimer()
+}
+
+func BenchmarkQuantityRoundUp(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		copied := q
+		copied.RoundUp(-3)
+	}
+	b.StopTimer()
+}
+
+func BenchmarkQuantityCopy(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		values[i%len(values)].DeepCopy()
+	}
+	b.StopTimer()
+}
+
+func BenchmarkQuantityAdd(b *testing.B) {
+	values := benchmarkQuantities()
+	base := &Quantity{}
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		base.d.Dec = nil
+		base.i = int64Amount{value: 100}
+		base.Add(q)
+	}
+	b.StopTimer()
+}
+
+func BenchmarkQuantityCmp(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		if q.Cmp(q) != 0 {
+			b.Fatal(q)
+		}
+	}
+	b.StopTimer()
+}
+
+func BenchmarkQuantityAsApproximateFloat64(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		if q.AsApproximateFloat64() == -1 {
+			b.Fatal(q)
+		}
+	}
+	b.StopTimer()
+}
+
+func BenchmarkQuantityAsFloat64Slow(b *testing.B) {
+	values := benchmarkQuantities()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		q := values[i%len(values)]
+		if q.AsFloat64Slow() == -1 {
+			b.Fatal(q)
+		}
+	}
+	b.StopTimer()
+}
+
+var _ pflag.Value = &QuantityValue{}
+
+func TestQuantityValueSet(t *testing.T) {
+	q := QuantityValue{}
+
+	if err := q.Set("invalid"); err == nil {
+
+		t.Error("'invalid' did not trigger a parse error")
+	}
+
+	if err := q.Set("1Mi"); err != nil {
+		t.Errorf("parsing 1Mi should have worked, got: %v", err)
+	}
+	if q.Value() != 1024*1024 {
+		t.Errorf("quantity should have been set to 1Mi, got: %v", q)
+	}
+
+	data, err := json.Marshal(q)
+	if err != nil {
+		t.Errorf("unexpected encoding error: %v", err)
+	}
+	expected := `"1Mi"`
+	if string(data) != expected {
+		t.Errorf("expected 1Mi value to be encoded as %q, got: %q", expected, string(data))
+	}
+}
+
+func ExampleQuantityValue() {
+	q := QuantityValue{
+		Quantity: MustParse("1Mi"),
+	}
+	fs := pflag.FlagSet{}
+	fs.SetOutput(os.Stdout)
+	fs.Var(&q, "mem", "sets amount of memory")
+	fs.PrintDefaults()
+	// Output:
+	// --mem quantity   sets amount of memory (default 1Mi)
+}
+
+func TestQuantityUnmarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		in         []byte
+		want       Quantity
+		errMessage string
+	}{
+		{
+			name: "null",
+			in:   []byte{0xf6}, // null
+			want: Quantity{},
+		},
+		{
+			name: "text string input",
+			in:   []byte("\x621M"), // "1M"
+			want: Quantity{i: int64Amount{value: 1, scale: 6}},
+		},
+		{
+			name: "byte string input",
+			in:   []byte("\x421M"), // '1M'
+			want: Quantity{i: int64Amount{value: 1, scale: 6}},
+		},
+		{
+			name: "whitespace",
+			in:   []byte("\x4a \t\n\r1M \t\n\r"), // h'20090a0d314d20090a0d'
+			want: Quantity{i: int64Amount{value: 1, scale: 6}},
+		},
+		{
+			name:       "empty byte string",
+			in:         []byte{0x40},
+			errMessage: ErrFormatWrong.Error(),
+		},
+		{
+			name:       "empty text string",
+			in:         []byte{0x60},
+			errMessage: ErrFormatWrong.Error(),
+		},
+		{
+			name:       "unsupported input type",
+			in:         []byte{0x07}, // 7
+			errMessage: "cbor: cannot unmarshal positive integer into Go value of type string",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var got Quantity
+			if err := got.UnmarshalCBOR(tc.in); err != nil {
+				if tc.errMessage == "" {
+					t.Fatalf("want nil error, got: %v", err)
+				} else if gotMessage := err.Error(); tc.errMessage != gotMessage {
+					t.Fatalf("want error: %q, got: %q", tc.errMessage, gotMessage)
+				}
+			} else if tc.errMessage != "" {
+				t.Fatalf("got nil error, want: %s", tc.errMessage)
+			}
+
+			if diff := cmp.Diff(tc.want, got); diff != "" {
+				t.Errorf("unexpected diff:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestQuantityRoundtripCBOR(t *testing.T) {
+	for i := 0; i < 500; i++ {
+		var initial, final Quantity
+		fuzzer.Fill(&initial)
+		b, err := cbor.Marshal(initial)
+		if err != nil {
+			t.Errorf("error encoding %v: %v", initial, err)
+			continue
+		}
+		err = cbor.Unmarshal(b, &final)
+		if err != nil {
+			t.Errorf("%v: error decoding %v: %v", initial, string(b), err)
+		}
+		if final.Cmp(initial) != 0 {
+			diag, err := cbor.Diagnose(b)
+			if err != nil {
+				t.Logf("failed to produce diagnostic encoding of 0x%x: %v", b, err)
+			}
+			t.Errorf("Expected equal: %v, %v (cbor was '%s')", initial, final, diag)
+		}
+	}
+}
+
+func TestParseQuantity(t *testing.T) {
+	ptrDec := func(s string) *infDecAmount {
+		d, ok := new(inf.Dec).SetString(s)
+		if !ok {
+			t.Fatalf("invalid dec: %s", s)
+		}
+		return &infDecAmount{d}
+	}
+
+	tests := []struct {
+		input       string
+		wantAsInt64 *int64
+		wantAsDec   *infDecAmount
+		canonical   string
+	}{
+		// min/max 18 digits
+		{input: "-999999999999999999", wantAsInt64: ptr.To[int64](-999999999999999999), wantAsDec: ptrDec("-999999999999999999")},
+		{input: "999999999999999999", wantAsInt64: ptr.To[int64](999999999999999999), wantAsDec: ptrDec("999999999999999999")},
+		// .0
+		{input: "-999999999999999999.0", wantAsInt64: nil, wantAsDec: ptrDec("-999999999999999999"), canonical: "-999999999999999999"},
+		{input: "999999999999999999.0", wantAsInt64: nil, wantAsDec: ptrDec("999999999999999999"), canonical: "999999999999999999"},
+		// .1
+		{input: "-999999999999999999.1", wantAsInt64: nil, wantAsDec: ptrDec("-999999999999999999.1"), canonical: "-999999999999999999100m"},
+		{input: "999999999999999999.1", wantAsInt64: nil, wantAsDec: ptrDec("999999999999999999.1"), canonical: "999999999999999999100m"},
+
+		// min/max 19 digits
+		{input: "-9999999999999999999", wantAsInt64: nil, wantAsDec: ptrDec("-9999999999999999999")},
+		{input: "9999999999999999999", wantAsInt64: nil, wantAsDec: ptrDec("9999999999999999999")},
+		{input: "-1E", wantAsInt64: ptr.To[int64](-1000000000000000000), wantAsDec: ptrDec("-1000000000000000000")},
+		{input: "1E", wantAsInt64: ptr.To[int64](1000000000000000000), wantAsDec: ptrDec("1000000000000000000")},
+		{input: "-1000000000000000000", wantAsInt64: nil, wantAsDec: ptrDec("-1000000000000000000"), canonical: "-1E"}, // should be wantAsInt64: <value>
+		{input: "1000000000000000000", wantAsInt64: nil, wantAsDec: ptrDec("1000000000000000000"), canonical: "1E"},    // should be wantAsInt64: <value>
+		// .0
+		{input: "-9999999999999999999.0", wantAsInt64: nil, wantAsDec: ptrDec("-9999999999999999999"), canonical: "-9999999999999999999"},
+		{input: "9999999999999999999.0", wantAsInt64: nil, wantAsDec: ptrDec("9999999999999999999"), canonical: "9999999999999999999"},
+		{input: "-1.0E", wantAsInt64: ptr.To[int64](-1000000000000000000), wantAsDec: ptrDec("-1000000000000000000"), canonical: "-1E"},
+		{input: "1.0E", wantAsInt64: ptr.To[int64](1000000000000000000), wantAsDec: ptrDec("1000000000000000000"), canonical: "1E"},
+		{input: "-1000000000000000000.0", wantAsInt64: nil, wantAsDec: ptrDec("-1000000000000000000"), canonical: "-1E"}, // should be wantAsInt64: <value>
+		{input: "1000000000000000000.0", wantAsInt64: nil, wantAsDec: ptrDec("1000000000000000000"), canonical: "1E"},    // should be wantAsInt64: <value>
+		// 000m
+		{input: "-9999999999999999999000m", wantAsInt64: nil, wantAsDec: ptrDec("-9999999999999999999"), canonical: "-9999999999999999999"},
+		{input: "9999999999999999999000m", wantAsInt64: nil, wantAsDec: ptrDec("9999999999999999999"), canonical: "9999999999999999999"},
+		// .1
+		{input: "-9999999999999999999.1", wantAsInt64: nil, wantAsDec: ptrDec("-9999999999999999999.1"), canonical: "-9999999999999999999100m"},
+		{input: "9999999999999999999.1", wantAsInt64: nil, wantAsDec: ptrDec("9999999999999999999.1"), canonical: "9999999999999999999100m"},
+		{input: "-1.0000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("-1000000000000000000.1"), canonical: "-1000000000000000000100m"},
+		{input: "1.0000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("1000000000000000000.1"), canonical: "1000000000000000000100m"},
+		{input: "-1000000000000000000.1", wantAsInt64: nil, wantAsDec: ptrDec("-1000000000000000000.1"), canonical: "-1000000000000000000100m"},
+		{input: "1000000000000000000.1", wantAsInt64: nil, wantAsDec: ptrDec("1000000000000000000.1"), canonical: "1000000000000000000100m"},
+		// +1
+		{input: "-1.000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("-1000000000000000001"), canonical: "-1000000000000000001"}, // should be wantAsInt64: <value>
+		{input: "1.000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("1000000000000000001"), canonical: "1000000000000000001"},    // should be wantAsInt64: <value>
+		{input: "-1000000000000000001", wantAsInt64: nil, wantAsDec: ptrDec("-1000000000000000001")},                                      // should be wantAsInt64: <value>
+		{input: "1000000000000000001", wantAsInt64: nil, wantAsDec: ptrDec("1000000000000000001")},                                        // should be wantAsInt64: <value>
+
+		// min/max 20 digits
+		{input: "-10E", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000000")},
+		{input: "10E", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000000")},
+		{input: "-10000000000000000000", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000000"), canonical: "-10E"},
+		{input: "10000000000000000000", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000000"), canonical: "10E"},
+		// .0
+		{input: "-10.0E", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000000"), canonical: "-10E"},
+		{input: "10.0E", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000000"), canonical: "10E"},
+		{input: "-10000000000000000000.0", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000000"), canonical: "-10E"},
+		{input: "10000000000000000000.0", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000000"), canonical: "10E"},
+		// 000m
+		{input: "-10000000000000000000000m", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000000"), canonical: "-10E"},
+		{input: "10000000000000000000000m", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000000"), canonical: "10E"},
+		// .1
+		{input: "-10.0000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000000.1"), canonical: "-10000000000000000000100m"},
+		{input: "10.0000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000000.1"), canonical: "10000000000000000000100m"},
+		{input: "-10000000000000000000.1", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000000.1"), canonical: "-10000000000000000000100m"},
+		{input: "10000000000000000000.1", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000000.1"), canonical: "10000000000000000000100m"},
+		// +1
+		{input: "-10.000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000001"), canonical: "-10000000000000000001"},
+		{input: "10.000000000000000001E", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000001"), canonical: "10000000000000000001"},
+		{input: "-10000000000000000001", wantAsInt64: nil, wantAsDec: ptrDec("-10000000000000000001")},
+		{input: "10000000000000000001", wantAsInt64: nil, wantAsDec: ptrDec("10000000000000000001")},
+
+		// min/max int64 - 1
+		{input: "-9223372036854775809", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775809")},
+		{input: "9223372036854775806", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775806")}, // should be wantAsInt64: <value>
+		// .0
+		{input: "-9223372036854775809.0", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775809"), canonical: "-9223372036854775809"},
+		{input: "9223372036854775806.0", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775806"), canonical: "9223372036854775806"}, // should be wantAsInt64: <value>
+		// 000m
+		{input: "-9223372036854775809000m", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775809"), canonical: "-9223372036854775809"},
+		{input: "9223372036854775806000m", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775806"), canonical: "9223372036854775806"}, // should be wantAsInt64: <value>
+		// .1
+		{input: "-9223372036854775809.1", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775809.1"), canonical: "-9223372036854775809100m"},
+		{input: "9223372036854775806.1", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775806.1"), canonical: "9223372036854775806100m"},
+
+		// min/max int64
+		{input: "-9223372036854775808", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775808")}, // should be wantAsInt64: <value>
+		{input: "9223372036854775807", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775807")},   // should be wantAsInt64: <value>
+		// .0
+		{input: "-9223372036854775808.0", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775808"), canonical: "-9223372036854775808"}, // should be wantAsInt64: <value>
+		{input: "9223372036854775807.0", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775807"), canonical: "9223372036854775807"},    // should be wantAsInt64: <value>
+		// 000m
+		{input: "-9223372036854775808000m", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775808"), canonical: "-9223372036854775808"}, // should be wantAsInt64: <value>
+		{input: "9223372036854775807000m", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775807"), canonical: "9223372036854775807"},    // should be wantAsInt64: <value>
+		// .1
+		{input: "-9223372036854775808.1", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775808.1"), canonical: "-9223372036854775808100m"},
+		{input: "9223372036854775807.1", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775807.1"), canonical: "9223372036854775807100m"},
+
+		// min/max int64 + 1
+		{input: "-9223372036854775807", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775807")}, // should be wantAsInt64: <value>
+		{input: "9223372036854775808", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775808")},
+		// .0
+		{input: "-9223372036854775807.0", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775807"), canonical: "-9223372036854775807"}, // should be wantAsInt64: <value>
+		{input: "9223372036854775808.0", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775808"), canonical: "9223372036854775808"},
+		// 000m
+		{input: "-9223372036854775807000m", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775807"), canonical: "-9223372036854775807"}, // should be wantAsInt64: <value>
+		{input: "9223372036854775808000m", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775808"), canonical: "9223372036854775808"},
+		// .1
+		{input: "-9223372036854775807.1", wantAsInt64: nil, wantAsDec: ptrDec("-9223372036854775807.1"), canonical: "-9223372036854775807100m"},
+		{input: "9223372036854775808.1", wantAsInt64: nil, wantAsDec: ptrDec("9223372036854775808.1"), canonical: "9223372036854775808100m"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.input, func(t *testing.T) {
+			q, err := ParseQuantity(tt.input)
+			if err != nil {
+				t.Fatalf("unexpected error for input %q: %v", tt.input, err)
+			}
+
+			val, ok := q.AsInt64()
+			if tt.wantAsInt64 != nil {
+				if !ok {
+					t.Errorf("AsInt64() returned ok=false for input %q, want ok=true and value %d", tt.input, *tt.wantAsInt64)
+				} else if val != *tt.wantAsInt64 {
+					t.Errorf("AsInt64() returned value %d for input %q, want value %d", val, tt.input, *tt.wantAsInt64)
+				}
+			} else {
+				if ok {
+					t.Errorf("AsInt64() returned ok=true and value %d for input %q, want ok=false", val, tt.input)
+				}
+			}
+
+			if tt.wantAsDec != nil {
+				if q.AsDec().Cmp(tt.wantAsDec.Dec) != 0 {
+					t.Errorf("AsDec() returned %s for input %q, want %s", q.AsDec().String(), tt.input, tt.wantAsDec.Dec.String())
+				}
+			}
+
+			serialized := q.String()
+			expectedString := tt.input
+			if tt.canonical != "" {
+				if tt.canonical == tt.input {
+					t.Errorf("unnecessary identical explicit canonical value in testcase")
+				}
+				expectedString = tt.canonical
+			}
+			if serialized != expectedString {
+				t.Errorf("expected input %q to reserialize to %q but got %q", tt.input, expectedString, serialized)
+			}
+		})
+	}
+}
+
+func TestQuantityPtrEqual(t *testing.T) {
+	q1 := MustParse("100m")
+	q2 := MustParse("100m")
+	q3 := MustParse("200m")
+
+	tests := []struct {
+		name   string
+		a      *Quantity
+		b      *Quantity
+		expect bool
+	}{
+		{
+			name:   "both nil",
+			a:      nil,
+			b:      nil,
+			expect: true,
+		},
+		{
+			name:   "first nil",
+			a:      nil,
+			b:      &q1,
+			expect: false,
+		},
+		{
+			name:   "second nil",
+			a:      &q1,
+			b:      nil,
+			expect: false,
+		},
+		{
+			name:   "equal quantities",
+			a:      &q1,
+			b:      &q2,
+			expect: true,
+		},
+		{
+			name:   "unequal quantities",
+			a:      &q1,
+			b:      &q3,
+			expect: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := QuantityPtrEqual(tt.a, tt.b); got != tt.expect {
+				t.Errorf("QuantityPtrEqual() = %v, want %v", got, tt.expect)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/scale_int.go b/third_party/k8s.io/apimachinery/pkg/api/resource/scale_int.go
new file mode 100644
index 0000000000..55e177b0e9
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/scale_int.go
@@ -0,0 +1,95 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"math"
+	"math/big"
+	"sync"
+)
+
+var (
+	// A sync pool to reduce allocation.
+	intPool  sync.Pool
+	maxInt64 = big.NewInt(math.MaxInt64)
+)
+
+func init() {
+	intPool.New = func() interface{} {
+		return &big.Int{}
+	}
+}
+
+// scaledValue scales given unscaled value from scale to new Scale and returns
+// an int64. It ALWAYS rounds up the result when scale down. The final result might
+// overflow.
+//
+// scale, newScale represents the scale of the unscaled decimal.
+// The mathematical value of the decimal is unscaled * 10**(-scale).
+func scaledValue(unscaled *big.Int, scale, newScale int) int64 {
+	dif := scale - newScale
+	if dif == 0 {
+		return unscaled.Int64()
+	}
+
+	// Handle scale up
+	// This is an easy case, we do not need to care about rounding and overflow.
+	// If any intermediate operation causes overflow, the result will overflow.
+	if dif < 0 {
+		return unscaled.Int64() * int64(math.Pow10(-dif))
+	}
+
+	// Handle scale down
+	// We have to be careful about the intermediate operations.
+
+	// fast path when unscaled < max.Int64 and exp(10,dif) < max.Int64
+	const log10MaxInt64 = 19
+	if unscaled.Cmp(maxInt64) < 0 && dif < log10MaxInt64 {
+		divide := int64(math.Pow10(dif))
+		result := unscaled.Int64() / divide
+		mod := unscaled.Int64() % divide
+		if mod != 0 {
+			return result + 1
+		}
+		return result
+	}
+
+	// We should only convert back to int64 when getting the result.
+	divisor := intPool.Get().(*big.Int)
+	exp := intPool.Get().(*big.Int)
+	result := intPool.Get().(*big.Int)
+	defer func() {
+		intPool.Put(divisor)
+		intPool.Put(exp)
+		intPool.Put(result)
+	}()
+
+	// divisor = 10^(dif)
+	// TODO: create loop up table if exp costs too much.
+	divisor.Exp(bigTen, exp.SetInt64(int64(dif)), nil)
+	// reuse exp
+	remainder := exp
+
+	// result = unscaled / divisor
+	// remainder = unscaled % divisor
+	result.DivMod(unscaled, divisor, remainder)
+	if remainder.Sign() != 0 {
+		return result.Int64() + 1
+	}
+
+	return result.Int64()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/scale_int_test.go b/third_party/k8s.io/apimachinery/pkg/api/resource/scale_int_test.go
new file mode 100644
index 0000000000..b150fa514c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/scale_int_test.go
@@ -0,0 +1,85 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"math"
+	"math/big"
+	"testing"
+)
+
+func TestScaledValueInternal(t *testing.T) {
+	tests := []struct {
+		unscaled *big.Int
+		scale    int
+		newScale int
+
+		want int64
+	}{
+		// remain scale
+		{big.NewInt(1000), 0, 0, 1000},
+
+		// scale down
+		{big.NewInt(1000), 0, -3, 1},
+		{big.NewInt(1000), 3, 0, 1},
+		{big.NewInt(0), 3, 0, 0},
+
+		// always round up
+		{big.NewInt(999), 3, 0, 1},
+		{big.NewInt(500), 3, 0, 1},
+		{big.NewInt(499), 3, 0, 1},
+		{big.NewInt(1), 3, 0, 1},
+		// large scaled value does not lose precision
+		{big.NewInt(0).Sub(maxInt64, bigOne), 1, 0, (math.MaxInt64-1)/10 + 1},
+		// large intermediate result.
+		{big.NewInt(1).Exp(big.NewInt(10), big.NewInt(100), nil), 100, 0, 1},
+
+		// scale up
+		{big.NewInt(0), 0, 3, 0},
+		{big.NewInt(1), 0, 3, 1000},
+		{big.NewInt(1), -3, 0, 1000},
+		{big.NewInt(1000), -3, 2, 100000000},
+		{big.NewInt(0).Div(big.NewInt(math.MaxInt64), bigThousand), 0, 3,
+			(math.MaxInt64 / 1000) * 1000},
+	}
+
+	for i, tt := range tests {
+		old := (&big.Int{}).Set(tt.unscaled)
+		got := scaledValue(tt.unscaled, tt.scale, tt.newScale)
+		if got != tt.want {
+			t.Errorf("#%d: got = %v, want %v", i, got, tt.want)
+		}
+		if tt.unscaled.Cmp(old) != 0 {
+			t.Errorf("#%d: unscaled = %v, want %v", i, tt.unscaled, old)
+		}
+	}
+}
+
+func BenchmarkScaledValueSmall(b *testing.B) {
+	s := big.NewInt(1000)
+	for i := 0; i < b.N; i++ {
+		scaledValue(s, 3, 0)
+	}
+}
+
+func BenchmarkScaledValueLarge(b *testing.B) {
+	s := big.NewInt(math.MaxInt64)
+	s.Mul(s, big.NewInt(1000))
+	for i := 0; i < b.N; i++ {
+		scaledValue(s, 10, 0)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/suffix.go b/third_party/k8s.io/apimachinery/pkg/api/resource/suffix.go
new file mode 100644
index 0000000000..6ec527f9c0
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/suffix.go
@@ -0,0 +1,198 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resource
+
+import (
+	"strconv"
+)
+
+type suffix string
+
+// suffixer can interpret and construct suffixes.
+type suffixer interface {
+	interpret(suffix) (base, exponent int32, fmt Format, ok bool)
+	construct(base, exponent int32, fmt Format) (s suffix, ok bool)
+	constructBytes(base, exponent int32, fmt Format) (s []byte, ok bool)
+}
+
+// quantitySuffixer handles suffixes for all three formats that quantity
+// can handle.
+var quantitySuffixer = newSuffixer()
+
+type bePair struct {
+	base, exponent int32
+}
+
+type listSuffixer struct {
+	suffixToBE      map[suffix]bePair
+	beToSuffix      map[bePair]suffix
+	beToSuffixBytes map[bePair][]byte
+}
+
+func (ls *listSuffixer) addSuffix(s suffix, pair bePair) {
+	if ls.suffixToBE == nil {
+		ls.suffixToBE = map[suffix]bePair{}
+	}
+	if ls.beToSuffix == nil {
+		ls.beToSuffix = map[bePair]suffix{}
+	}
+	if ls.beToSuffixBytes == nil {
+		ls.beToSuffixBytes = map[bePair][]byte{}
+	}
+	ls.suffixToBE[s] = pair
+	ls.beToSuffix[pair] = s
+	ls.beToSuffixBytes[pair] = []byte(s)
+}
+
+func (ls *listSuffixer) lookup(s suffix) (base, exponent int32, ok bool) {
+	pair, ok := ls.suffixToBE[s]
+	if !ok {
+		return 0, 0, false
+	}
+	return pair.base, pair.exponent, true
+}
+
+func (ls *listSuffixer) construct(base, exponent int32) (s suffix, ok bool) {
+	s, ok = ls.beToSuffix[bePair{base, exponent}]
+	return
+}
+
+func (ls *listSuffixer) constructBytes(base, exponent int32) (s []byte, ok bool) {
+	s, ok = ls.beToSuffixBytes[bePair{base, exponent}]
+	return
+}
+
+type suffixHandler struct {
+	decSuffixes listSuffixer
+	binSuffixes listSuffixer
+}
+
+type fastLookup struct {
+	*suffixHandler
+}
+
+func (l fastLookup) interpret(s suffix) (base, exponent int32, format Format, ok bool) {
+	switch s {
+	case "":
+		return 10, 0, DecimalSI, true
+	case "n":
+		return 10, -9, DecimalSI, true
+	case "u":
+		return 10, -6, DecimalSI, true
+	case "m":
+		return 10, -3, DecimalSI, true
+	case "k":
+		return 10, 3, DecimalSI, true
+	case "M":
+		return 10, 6, DecimalSI, true
+	case "G":
+		return 10, 9, DecimalSI, true
+	}
+	return l.suffixHandler.interpret(s)
+}
+
+func newSuffixer() suffixer {
+	sh := &suffixHandler{}
+
+	// IMPORTANT: if you change this section you must change fastLookup
+
+	sh.binSuffixes.addSuffix("Ki", bePair{2, 10})
+	sh.binSuffixes.addSuffix("Mi", bePair{2, 20})
+	sh.binSuffixes.addSuffix("Gi", bePair{2, 30})
+	sh.binSuffixes.addSuffix("Ti", bePair{2, 40})
+	sh.binSuffixes.addSuffix("Pi", bePair{2, 50})
+	sh.binSuffixes.addSuffix("Ei", bePair{2, 60})
+	// Don't emit an error when trying to produce
+	// a suffix for 2^0.
+	sh.decSuffixes.addSuffix("", bePair{2, 0})
+
+	sh.decSuffixes.addSuffix("n", bePair{10, -9})
+	sh.decSuffixes.addSuffix("u", bePair{10, -6})
+	sh.decSuffixes.addSuffix("m", bePair{10, -3})
+	sh.decSuffixes.addSuffix("", bePair{10, 0})
+	sh.decSuffixes.addSuffix("k", bePair{10, 3})
+	sh.decSuffixes.addSuffix("M", bePair{10, 6})
+	sh.decSuffixes.addSuffix("G", bePair{10, 9})
+	sh.decSuffixes.addSuffix("T", bePair{10, 12})
+	sh.decSuffixes.addSuffix("P", bePair{10, 15})
+	sh.decSuffixes.addSuffix("E", bePair{10, 18})
+
+	return fastLookup{sh}
+}
+
+func (sh *suffixHandler) construct(base, exponent int32, fmt Format) (s suffix, ok bool) {
+	switch fmt {
+	case DecimalSI:
+		return sh.decSuffixes.construct(base, exponent)
+	case BinarySI:
+		return sh.binSuffixes.construct(base, exponent)
+	case DecimalExponent:
+		if base != 10 {
+			return "", false
+		}
+		if exponent == 0 {
+			return "", true
+		}
+		return suffix("e" + strconv.FormatInt(int64(exponent), 10)), true
+	}
+	return "", false
+}
+
+func (sh *suffixHandler) constructBytes(base, exponent int32, format Format) (s []byte, ok bool) {
+	switch format {
+	case DecimalSI:
+		return sh.decSuffixes.constructBytes(base, exponent)
+	case BinarySI:
+		return sh.binSuffixes.constructBytes(base, exponent)
+	case DecimalExponent:
+		if base != 10 {
+			return nil, false
+		}
+		if exponent == 0 {
+			return nil, true
+		}
+		result := make([]byte, 8)
+		result[0] = 'e'
+		number := strconv.AppendInt(result[1:1], int64(exponent), 10)
+		if &result[1] == &number[0] {
+			return result[:1+len(number)], true
+		}
+		result = append(result[:1], number...)
+		return result, true
+	}
+	return nil, false
+}
+
+func (sh *suffixHandler) interpret(suffix suffix) (base, exponent int32, fmt Format, ok bool) {
+	// Try lookup tables first
+	if b, e, ok := sh.decSuffixes.lookup(suffix); ok {
+		return b, e, DecimalSI, true
+	}
+	if b, e, ok := sh.binSuffixes.lookup(suffix); ok {
+		return b, e, BinarySI, true
+	}
+
+	if len(suffix) > 1 && (suffix[0] == 'E' || suffix[0] == 'e') {
+		parsed, err := strconv.ParseInt(string(suffix[1:]), 10, 64)
+		if err != nil {
+			return 0, 0, DecimalExponent, false
+		}
+		return 10, int32(parsed), DecimalExponent, true
+	}
+
+	return 0, 0, DecimalExponent, false
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/zz_generated.deepcopy.go b/third_party/k8s.io/apimachinery/pkg/api/resource/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..abb00f38e2
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/zz_generated.deepcopy.go
@@ -0,0 +1,45 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package resource
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Quantity) DeepCopyInto(out *Quantity) {
+	*out = in.DeepCopy()
+	return
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *QuantityValue) DeepCopyInto(out *QuantityValue) {
+	*out = *in
+	out.Quantity = in.Quantity.DeepCopy()
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new QuantityValue.
+func (in *QuantityValue) DeepCopy() *QuantityValue {
+	if in == nil {
+		return nil
+	}
+	out := new(QuantityValue)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/resource/zz_generated.model_name.go b/third_party/k8s.io/apimachinery/pkg/api/resource/zz_generated.model_name.go
new file mode 100644
index 0000000000..2575a2e8c8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/resource/zz_generated.model_name.go
@@ -0,0 +1,32 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package resource
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Quantity) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.api.resource.Quantity"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in QuantityValue) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.api.resource.QuantityValue"
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/safe/safe.go b/third_party/k8s.io/apimachinery/pkg/api/safe/safe.go
new file mode 100644
index 0000000000..6d6d1f88fe
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/safe/safe.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package safe
+
+// Field takes a pointer to any value (which may or may not be nil) and a
+// function that traverses to a target type R (a typical use case is to
+// dereference a field), and returns the result of the traversal, or the zero
+// value of the target type.
+//
+// This is roughly equivalent to:
+//
+//	value != nil ? fn(value) : zero-value
+//
+// ...in languages that support the ternary operator.
+func Field[V any, R any](value *V, fn func(*V) R) R {
+	if value == nil {
+		var zero R
+		return zero
+	}
+	o := fn(value)
+	return o
+}
+
+// Cast takes any value, attempts to cast it to T, and returns the T value if
+// the cast is successful, or else the zero value of T.
+func Cast[T any](value any) T {
+	result, _ := value.(T)
+	return result
+}
+
+// Value takes a pointer to any value (which may or may not be nil) and a
+// function that returns a pointer to the same type.  If the value is not nil,
+// it is returned, otherwise the result of the function is returned.
+//
+// This is roughly equivalent to:
+//
+//	value != nil ? value : fn()
+//
+// ...in languages that support the ternary operator.
+func Value[T any](value *T, fn func() *T) *T {
+	if value != nil {
+		return value
+	}
+	return fn()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/README.md b/third_party/k8s.io/apimachinery/pkg/api/validate/README.md
new file mode 100644
index 0000000000..52ca031d44
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/README.md
@@ -0,0 +1,64 @@
+# API validation
+
+This package holds functions which validate fields and types in the Kubernetes
+API. It may be useful beyond API validation, but this is the primary goal.
+
+Most of the public functions here have signatures which adhere to the following
+pattern, which is assumed by automation and code-generation:
+
+```
+import (
+        "context"
+        "k8s.io/apimachinery/pkg/api/operation"
+        "k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func <Name>(ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue <ValueType>, <OtherArgs...>) field.ErrorList
+```
+
+The name of validator functions should consider that callers will generally be
+spelling out the package name and the function name, and so should aim for
+legibility.  E.g. `validate.Concept()`.
+
+The `ctx` argument is Go's usual Context.
+
+The `opCtx` argument provides information about the API operation in question.
+
+The `fldPath` argument indicates the path to the field in question, to be used
+in errors.
+
+The `value` and `oldValue` arguments are the thing(s) being validated.  For
+CREATE operations (`opCtx.Operation == operation.Create`), the `oldValue`
+argument will be nil.  Many validators functions only look at the current value
+(`value`) and disregard `oldValue`.
+
+The `value` and `oldValue` arguments are always nilable - pointers to primitive
+types, slices of any type, or maps of any type.  Validator functions should
+avoid dereferencing nil. Callers are expected to not pass a nil `value` unless the
+API field itself was nilable. `oldValue` is always nil for CREATE operations and 
+is also nil for UPDATE operations if the `value` is not correlated with an `oldValue`.
+
+Simple content-validators may have no `<OtherArgs>`, but validator functions
+may take additional arguments.  Some validator functions will be built as
+generics, e.g. to allow any integer type or to handle arbitrary slices.
+
+Examples:
+
+```
+// NonEmpty validates that a string is not empty.
+func NonEmpty(ctx context.Context, op operation.Operation, fldPath *field.Path, value, _ *string) field.ErrorList
+
+// Even validates that a slice has an even number of items.
+func Even[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, _ []T) field.ErrorList
+
+// KeysMaxLen validates that all of the string keys in a map are under the
+// specified length.
+func KeysMaxLen[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, _ map[string]T, maxLen int) field.ErrorList
+```
+
+Validator functions always return an `ErrorList` where each item is a distinct
+validation failure and a zero-length return value (not just nil) indicates
+success.
+
+Good validation failure messages follow the Kubernetes API conventions, for
+example using "must" instead of "should".
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/common.go b/third_party/k8s.io/apimachinery/pkg/api/validate/common.go
new file mode 100644
index 0000000000..14a6f0da7f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/common.go
@@ -0,0 +1,28 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// ValidateFunc is a function that validates a value, possibly considering the
+// old value (if any).
+type ValidateFunc[T any] func(ctx context.Context, op operation.Operation, fldPath *field.Path, newValue, oldValue T) field.ErrorList
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/constraints/constraints.go b/third_party/k8s.io/apimachinery/pkg/api/validate/constraints/constraints.go
new file mode 100644
index 0000000000..1689d3c079
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/constraints/constraints.go
@@ -0,0 +1,32 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package constraints
+
+// Signed is a constraint that permits any signed integer type.
+type Signed interface {
+	~int | ~int8 | ~int16 | ~int32 | ~int64
+}
+
+// Unsigned is a constraint that permits any unsigned integer type.
+type Unsigned interface {
+	~uint | ~uint8 | ~uint16 | ~uint32 | ~uint64 | ~uintptr
+}
+
+// Integer is a constraint that permits any integer type.
+type Integer interface {
+	Signed | Unsigned
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/content/decimal_int.go b/third_party/k8s.io/apimachinery/pkg/api/validate/content/decimal_int.go
new file mode 100644
index 0000000000..5622ca15a8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/content/decimal_int.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+const decimalIntegerErrMsg string = "must be a valid decimal integer in canonical form"
+
+// IsDecimalInteger validates that a string represents a decimal integer in strict canonical form.
+// This means the string must be formatted exactly as a human would naturally write an integer,
+// without any programming language conventions like leading zeros, plus signs, or alternate bases.
+//
+// valid values:"0" or Non-zero integers (i.e., "123", "-456") where the first digit is 1-9,
+// followed by any digits 0-9.
+//
+// This validator is stricter than strconv.ParseInt, which accepts leading zeros values (i.e, "0700")
+// and interprets them as decimal 700, potentially causing confusion with octal notation.
+func IsDecimalInteger(value string) []string {
+	n := len(value)
+	if n == 0 {
+		return []string{EmptyError()}
+	}
+
+	i := 0
+	if value[0] == '-' {
+		if n == 1 {
+			return []string{decimalIntegerErrMsg}
+		}
+		i = 1
+	}
+
+	if value[i] == '0' {
+		if n == 1 && i == 0 {
+			return nil
+		}
+		return []string{decimalIntegerErrMsg}
+	}
+
+	if value[i] < '1' || value[i] > '9' {
+		return []string{decimalIntegerErrMsg}
+	}
+
+	for i++; i < n; i++ {
+		if value[i] < '0' || value[i] > '9' {
+			return []string{decimalIntegerErrMsg}
+		}
+	}
+
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/content/decimal_int_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/content/decimal_int_test.go
new file mode 100644
index 0000000000..369417d26a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/content/decimal_int_test.go
@@ -0,0 +1,234 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"strconv"
+	"strings"
+	"testing"
+)
+
+func TestIsDecimalInteger(t *testing.T) {
+	testCases := []struct {
+		name        string
+		input       string
+		shouldPass  bool
+		errContains string
+	}{
+		// valid
+		{name: "zero", input: "0", shouldPass: true},
+		{name: "positive single digit 1", input: "1", shouldPass: true},
+		{name: "positive single digit 2", input: "2", shouldPass: true},
+		{name: "positive single digit 5", input: "5", shouldPass: true},
+		{name: "positive single digit 9", input: "9", shouldPass: true},
+		{name: "negative single digit", input: "-5", shouldPass: true},
+		{name: "negative single digit 1", input: "-1", shouldPass: true},
+		{name: "negative single digit 9", input: "-9", shouldPass: true},
+
+		{name: "number starting with 1", input: "100", shouldPass: true},
+		{name: "number starting with 2", input: "234", shouldPass: true},
+		{name: "number starting with 3", input: "345", shouldPass: true},
+		{name: "number starting with 4", input: "456", shouldPass: true},
+		{name: "number starting with 5", input: "567", shouldPass: true},
+		{name: "number starting with 6", input: "678", shouldPass: true},
+		{name: "number starting with 7", input: "789", shouldPass: true},
+		{name: "number starting with 8", input: "890", shouldPass: true},
+		{name: "number starting with 9", input: "999", shouldPass: true},
+
+		{name: "positive multi-digit", input: "123", shouldPass: true},
+		{name: "negative multi-digit", input: "-456", shouldPass: true},
+		{name: "negative starting with 1", input: "-100", shouldPass: true},
+		{name: "negative starting with 9", input: "-987", shouldPass: true},
+		{name: "large positive number", input: "9223372036854775807", shouldPass: true},  // max int64
+		{name: "large negative number", input: "-9223372036854775808", shouldPass: true}, // min int64
+		{name: "very long valid number", input: "12345678901234567890", shouldPass: true},
+		{name: "all nines", input: "999999999999", shouldPass: true},
+
+		// invalid
+		{name: "negative zero", input: "-0", shouldPass: false},
+		{name: "double zero", input: "00", shouldPass: false},
+		{name: "triple zero", input: "000", shouldPass: false},
+		{name: "many zeros", input: "0000000", shouldPass: false},
+		{name: "leading zero single digit", input: "01", shouldPass: false},
+		{name: "leading zero digit 2", input: "02", shouldPass: false},
+		{name: "leading zero digit 9", input: "09", shouldPass: false},
+		{name: "leading zero multi-digit", input: "0123", shouldPass: false},
+		{name: "octal-like format", input: "0700", shouldPass: false},
+		{name: "octal-like format 2", input: "0950", shouldPass: false},
+		{name: "multiple leading zeros", input: "00123", shouldPass: false},
+		{name: "negative with leading zero", input: "-01", shouldPass: false},
+		{name: "negative with leading zeros", input: "-0123", shouldPass: false},
+		{name: "negative double zero", input: "-00", shouldPass: false},
+		{name: "plus sign", input: "+123", shouldPass: false},
+		{name: "positive plus sign", input: "+5", shouldPass: false},
+		{name: "plus zero", input: "+0", shouldPass: false},
+
+		// Invalid cases - empty and whitespace
+		{name: "empty string", input: "", shouldPass: false, errContains: "non-empty"},
+		{name: "just minus sign", input: "-", shouldPass: false},
+		{name: "just plus sign", input: "+", shouldPass: false},
+		{name: "single space", input: " ", shouldPass: false},
+		{name: "multiple spaces", input: "   ", shouldPass: false},
+		{name: "leading space", input: " 123", shouldPass: false},
+		{name: "trailing space", input: "123 ", shouldPass: false},
+		{name: "space in middle", input: "12 3", shouldPass: false},
+		{name: "spaces around", input: " 123 ", shouldPass: false},
+
+		{name: "decimal number", input: "12.3", shouldPass: false},
+		{name: "decimal zero", input: "0.0", shouldPass: false},
+		{name: "negative decimal", input: "-12.5", shouldPass: false},
+		{name: "trailing dot", input: "123.", shouldPass: false},
+		{name: "leading dot", input: ".123", shouldPass: false},
+
+		{name: "alphabetic", input: "abc", shouldPass: false},
+		{name: "alphanumeric", input: "12a3", shouldPass: false},
+		{name: "letter at start", input: "a123", shouldPass: false},
+		{name: "letter at end", input: "123a", shouldPass: false},
+		{name: "uppercase letters", input: "ABC", shouldPass: false},
+		{name: "mixed case", input: "12A3", shouldPass: false},
+
+		{name: "hexadecimal", input: "0x123", shouldPass: false},
+		{name: "hex uppercase", input: "0X123", shouldPass: false},
+		{name: "octal prefix", input: "0o777", shouldPass: false},
+		{name: "binary prefix", input: "0b101", shouldPass: false},
+		{name: "scientific notation", input: "1e5", shouldPass: false},
+		{name: "scientific negative exp", input: "1e-5", shouldPass: false},
+		{name: "scientific uppercase", input: "1E5", shouldPass: false},
+
+		{name: "underscore separator", input: "1_000", shouldPass: false},
+		{name: "comma separator", input: "1,000", shouldPass: false},
+		{name: "period separator", input: "1.000", shouldPass: false},
+		{name: "apostrophe separator", input: "1'000", shouldPass: false},
+
+		{name: "double minus", input: "--123", shouldPass: false},
+		{name: "double plus", input: "++123", shouldPass: false},
+		{name: "plus minus", input: "+-123", shouldPass: false},
+		{name: "minus plus", input: "-+123", shouldPass: false},
+		{name: "minus at end", input: "123-", shouldPass: false},
+		{name: "minus in middle", input: "12-3", shouldPass: false},
+		{name: "plus at end", input: "123+", shouldPass: false},
+		{name: "plus in middle", input: "12+3", shouldPass: false},
+
+		{name: "tab character at start", input: "\t123", shouldPass: false},
+		{name: "tab character at end", input: "123\t", shouldPass: false},
+		{name: "newline character", input: "123\n", shouldPass: false},
+		{name: "carriage return", input: "123\r", shouldPass: false},
+		{name: "null character", input: "123\x00", shouldPass: false},
+		{name: "vertical tab", input: "123\v", shouldPass: false},
+		{name: "form feed", input: "123\f", shouldPass: false},
+
+		{name: "parentheses", input: "(123)", shouldPass: false},
+		{name: "brackets", input: "[123]", shouldPass: false},
+		{name: "braces", input: "{123}", shouldPass: false},
+		{name: "dollar sign", input: "$123", shouldPass: false},
+		{name: "percent sign", input: "123%", shouldPass: false},
+		{name: "hash", input: "#123", shouldPass: false},
+		{name: "at sign", input: "@123", shouldPass: false},
+		{name: "ampersand", input: "&123", shouldPass: false},
+		{name: "asterisk", input: "*123", shouldPass: false},
+		{name: "slash", input: "12/3", shouldPass: false},
+		{name: "backslash", input: "12\\3", shouldPass: false},
+		{name: "pipe", input: "12|3", shouldPass: false},
+		{name: "semicolon", input: "12;3", shouldPass: false},
+		{name: "colon", input: "12:3", shouldPass: false},
+		{name: "question mark", input: "12?3", shouldPass: false},
+		{name: "exclamation", input: "12!3", shouldPass: false},
+		{name: "tilde", input: "~123", shouldPass: false},
+		{name: "backtick", input: "`123", shouldPass: false},
+		{name: "single quote", input: "'123'", shouldPass: false},
+		{name: "double quote", input: "\"123\"", shouldPass: false},
+
+		{name: "unicode minus", input: "−123", shouldPass: false}, // U+2212 minus sign
+		{name: "unicode digit", input: "１２３", shouldPass: false},  // fullwidth digits
+		{name: "arabic digits", input: "١٢٣", shouldPass: false},  // Arabic-Indic digits
+		{name: "chinese characters", input: "一二三", shouldPass: false},
+		{name: "superscript", input: "123⁴", shouldPass: false},
+		{name: "subscript", input: "123₄", shouldPass: false},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := IsDecimalInteger(tc.input)
+			if tc.shouldPass {
+				if len(errs) != 0 {
+					t.Errorf("IsDecimalInteger(%q) = %v, want no errors", tc.input, errs)
+				}
+			} else {
+				if len(errs) == 0 {
+					t.Errorf("IsDecimalInteger(%q) = no errors, want errors", tc.input)
+				} else if tc.errContains != "" {
+					found := false
+					for _, err := range errs {
+						if strings.Contains(err, tc.errContains) {
+							found = true
+							break
+						}
+					}
+					if !found {
+						t.Errorf("IsDecimalInteger(%q) errors %v should contain %q", tc.input, errs, tc.errContains)
+					}
+				}
+			}
+		})
+	}
+
+	// Additional verification: valid strings should parse with strconv.ParseInt
+	validCases := []string{
+		"0", "1", "2", "5", "9",
+		"-1", "-5", "-9",
+		"123", "-456", "100", "999",
+		"9223372036854775807", "-9223372036854775808",
+		"12345678901234567890",
+	}
+	for _, validCase := range validCases {
+		if errs := IsDecimalInteger(validCase); len(errs) != 0 {
+			t.Errorf("Valid case %q should return no errors, got: %v", validCase, errs)
+		}
+		// Verify it can also be parsed by strconv.ParseInt (within range)
+		if len(validCase) <= 19 { // Only test cases that fit in int64
+			if _, err := strconv.ParseInt(validCase, 10, 64); err != nil {
+				t.Errorf("Valid case %q should be parseable by strconv.ParseInt: %v", validCase, err)
+			}
+		}
+	}
+
+	// Verify that our function rejects what we intend to reject (even if strconv.ParseInt accepts it)
+	rejectedCases := []string{
+		"0700", "0950", "01", "02", "09",
+		"+123", "+5", "+0",
+		"-0", "00", "000",
+		"-01", "-00",
+	}
+	for _, rejectedCase := range rejectedCases {
+		if errs := IsDecimalInteger(rejectedCase); len(errs) == 0 {
+			t.Errorf("Case %q should be rejected by strict validation", rejectedCase)
+		}
+	}
+
+	// Edge case: verify strconv.ParseInt accepts things we reject (proving we're stricter)
+	strconvAcceptsButWeReject := []string{"+123", "0700", "01"}
+	for _, case_ := range strconvAcceptsButWeReject {
+		// strconv.ParseInt should accept it
+		if _, err := strconv.ParseInt(case_, 10, 64); err != nil {
+			t.Errorf("strconv.ParseInt should accept %q but got error: %v", case_, err)
+		}
+		// But our function should reject it
+		if errs := IsDecimalInteger(case_); len(errs) == 0 {
+			t.Errorf("IsDecimalInteger should reject %q (stricter than strconv)", case_)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/content/dns.go b/third_party/k8s.io/apimachinery/pkg/api/validate/content/dns.go
new file mode 100644
index 0000000000..bd20720794
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/content/dns.go
@@ -0,0 +1,101 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"regexp"
+)
+
+const dns1123LabelFmt string = "[a-z0-9]([-a-z0-9]*[a-z0-9])?"
+
+const dns1123LabelErrMsg string = "a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character"
+
+// DNS1123LabelMaxLength is a label's max length in DNS (RFC 1123)
+const DNS1123LabelMaxLength int = 63
+
+var dns1123LabelRegexp = regexp.MustCompile("^" + dns1123LabelFmt + "$")
+
+// IsDNS1123Label tests for a string that conforms to the definition of a label in
+// DNS (RFC 1123).
+func IsDNS1123Label(value string) []string {
+	var errs []string
+	if len(value) > DNS1123LabelMaxLength {
+		errs = append(errs, MaxLenError(DNS1123LabelMaxLength))
+	}
+	if !dns1123LabelRegexp.MatchString(value) {
+		if dns1123SubdomainRegexp.MatchString(value) {
+			// It was a valid subdomain and not a valid label.  Since we
+			// already checked length, it must be dots.
+			errs = append(errs, "must not contain dots")
+		} else {
+			errs = append(errs, RegexError(dns1123LabelErrMsg, dns1123LabelFmt, "my-name", "123-abc"))
+		}
+	}
+	return errs
+}
+
+const dns1123SubdomainFmt string = dns1123LabelFmt + "(\\." + dns1123LabelFmt + ")*"
+const dns1123SubdomainFmtCaseless string = "(?i)" + dns1123SubdomainFmt
+const dns1123SubdomainErrorMsg string = "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character"
+const dns1123SubdomainCaselessErrorMsg string = "an RFC 1123 subdomain must consist of alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character"
+
+// DNS1123SubdomainMaxLength is a subdomain's max length in DNS (RFC 1123)
+const DNS1123SubdomainMaxLength int = 253
+
+var dns1123SubdomainRegexp = regexp.MustCompile("^" + dns1123SubdomainFmt + "$")
+var dns1123SubdomainCaselessRegexp = regexp.MustCompile("^" + dns1123SubdomainFmtCaseless + "$")
+
+// IsDNS1123Subdomain tests for a string that conforms to the definition of a
+// subdomain in DNS (RFC 1123) lowercase.
+func IsDNS1123Subdomain(value string) []string {
+	return isDNS1123Subdomain(value, false)
+}
+
+// IsDNS1123SubdomainCaseless tests for a string that conforms to the definition of a
+// subdomain in DNS (RFC 1123).
+//
+// Deprecated: API validation should never be caseless. Caseless validation is a vector
+// for bugs and failed uniqueness assumptions. For example, names like "foo.com" and
+// "FOO.COM" are both accepted as valid, but they are typically not treated as equal by
+// consumers (e.g. CSI and DRA driver names). This fails the "least surprise" principle and
+// can cause inconsistent behaviors.
+//
+// Note: This allows uppercase names but is not caseless — uppercase and lowercase are
+// treated as different values. Use IsDNS1123Subdomain for strict, lowercase validation
+// instead.
+func IsDNS1123SubdomainCaseless(value string) []string {
+	return isDNS1123Subdomain(value, true)
+}
+
+func isDNS1123Subdomain(value string, caseless bool) []string {
+	var errs []string
+	if len(value) > DNS1123SubdomainMaxLength {
+		errs = append(errs, MaxLenError(DNS1123SubdomainMaxLength))
+	}
+	errorMsg := dns1123SubdomainErrorMsg
+	example := "example.com"
+	regexp := dns1123SubdomainRegexp
+	if caseless {
+		errorMsg = dns1123SubdomainCaselessErrorMsg
+		example = "Example.com"
+		regexp = dns1123SubdomainCaselessRegexp
+	}
+	if !regexp.MatchString(value) {
+		errs = append(errs, RegexError(errorMsg, dns1123SubdomainFmt, example))
+	}
+	return errs
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/content/dns_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/content/dns_test.go
new file mode 100644
index 0000000000..c241d722c1
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/content/dns_test.go
@@ -0,0 +1,126 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestIsDNS1123Label(t *testing.T) {
+	goodValues := []string{
+		"a", "ab", "abc", "a1", "a-1", "a--1--2--b",
+		"0", "01", "012", "1a", "1-a", "1--a--b--2",
+		strings.Repeat("a", 63),
+	}
+	for _, val := range goodValues {
+		if msgs := IsDNS1123Label(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"", "A", "ABC", "aBc", "A1", "A-1", "1-A",
+		"-", "a-", "-a", "1-", "-1",
+		"_", "a_", "_a", "a_b", "1_", "_1", "1_2",
+		".", "a.", ".a", "a.b", "1.", ".1", "1.2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2",
+		strings.Repeat("a", 64),
+	}
+	for _, val := range badValues {
+		if msgs := IsDNS1123Label(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
+
+func TestIsDNS1123Subdomain(t *testing.T) {
+	goodValues := []string{
+		"a", "ab", "abc", "a1", "a-1", "a--1--2--b",
+		"0", "01", "012", "1a", "1-a", "1--a--b--2",
+		"a.a", "ab.a", "abc.a", "a1.a", "a-1.a", "a--1--2--b.a",
+		"a.1", "ab.1", "abc.1", "a1.1", "a-1.1", "a--1--2--b.1",
+		"0.a", "01.a", "012.a", "1a.a", "1-a.a", "1--a--b--2",
+		"0.1", "01.1", "012.1", "1a.1", "1-a.1", "1--a--b--2.1",
+		"a.b.c.d.e", "aa.bb.cc.dd.ee", "1.2.3.4.5", "11.22.33.44.55",
+		strings.Repeat("a", 253),
+	}
+	for _, val := range goodValues {
+		if msgs := IsDNS1123Subdomain(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"", "A", "ABC", "aBc", "A1", "A-1", "1-A",
+		"-", "a-", "-a", "1-", "-1",
+		"_", "a_", "_a", "a_b", "1_", "_1", "1_2",
+		".", "a.", ".a", "a..b", "1.", ".1", "1..2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2",
+		"A.a", "aB.a", "ab.A", "A1.a", "a1.A",
+		"A.1", "aB.1", "A1.1", "1A.1",
+		"0.A", "01.A", "012.A", "1A.a", "1a.A",
+		"A.B.C.D.E", "AA.BB.CC.DD.EE", "a.B.c.d.e", "aa.bB.cc.dd.ee",
+		"a@b", "a,b", "a_b", "a;b",
+		"a:b", "a%b", "a?b", "a$b",
+		strings.Repeat("a", 254),
+	}
+	for _, val := range badValues {
+		if msgs := IsDNS1123Subdomain(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
+
+func TestIsDNS1123SubdomainCaseless(t *testing.T) {
+	goodValues := []string{
+		"a", "ab", "abc", "a1", "a-1", "a--1--2--b",
+		"0", "01", "012", "1a", "1-a", "1--a--b--2",
+		"a.a", "ab.a", "abc.a", "a1.a", "a-1.a", "a--1--2--b.a",
+		"a.1", "ab.1", "abc.1", "a1.1", "a-1.1", "a--1--2--b.1",
+		"0.a", "01.a", "012.a", "1a.a", "1-a.a", "1--a--b--2",
+		"0.1", "01.1", "012.1", "1a.1", "1-a.1", "1--a--b--2.1",
+		"a.b.c.d.e", "aa.bb.cc.dd.ee", "1.2.3.4.5", "11.22.33.44.55",
+		"A", "AB", "ABC", "A1", "A-1",
+		"A.A", "AB.A", "ABC.A", "A1.A", "A-1.A",
+		"A.B.C.D.E", "AA.BB.CC.DD.EE",
+		"a.B.c.d.e", "aa.bB.cc.dd.ee",
+		strings.Repeat("a", 253),
+		strings.Repeat("A", 253),
+	}
+	for _, val := range goodValues {
+		if msgs := IsDNS1123SubdomainCaseless(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"",
+		"-", "a-", "-a", "1-", "-1",
+		"_", "a_", "_a", "a_b", "1_", "_1", "1_2",
+		".", "a.", ".a", "a..b", "1.", ".1", "1..2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2",
+		"a@b", "a,b", "a_b", "a;b",
+		"a:b", "a%b", "a?b", "a$b",
+		strings.Repeat("a", 254),
+	}
+	for _, val := range badValues {
+		if msgs := IsDNS1123SubdomainCaseless(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/content/errors.go b/third_party/k8s.io/apimachinery/pkg/api/validate/content/errors.go
new file mode 100644
index 0000000000..13eeced1a0
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/content/errors.go
@@ -0,0 +1,72 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"fmt"
+	"reflect"
+
+	"k8s.io/apimachinery/pkg/api/validate/constraints"
+)
+
+// MinError returns a string explanation of a "must be greater than or equal"
+// validation failure.
+func MinError[T constraints.Integer](min T) string {
+	return fmt.Sprintf("must be greater than or equal to %d", min)
+}
+
+// MaxError returns a string explanation of a "must be less than or equal"
+// validation failure.
+func MaxError[T constraints.Integer](max T) string {
+	return fmt.Sprintf("must be less than or equal to %d", max)
+}
+
+// MaxLenError returns a string explanation of a "string too long" validation
+// failure.
+func MaxLenError(length int) string {
+	return fmt.Sprintf("must be no more than %d bytes", length)
+}
+
+// EmptyError returns a string explanation of an "empty string" validation.
+func EmptyError() string {
+	return "must be non-empty"
+}
+
+// RegexError returns a string explanation of a regex validation failure.
+func RegexError(msg string, re string, examples ...string) string {
+	if len(examples) == 0 {
+		return msg + " (regex used for validation is '" + re + "')"
+	}
+	msg += " (e.g. "
+	for i := range examples {
+		if i > 0 {
+			msg += " or "
+		}
+		msg += "'" + examples[i] + "', "
+	}
+	msg += "regex used for validation is '" + re + "')"
+	return msg
+}
+
+// NEQError returns a string explanation of a "must not be equal to" validation failure.
+func NEQError[T any](disallowed T) string {
+	format := "%v"
+	if reflect.ValueOf(disallowed).Kind() == reflect.String {
+		format = "%q"
+	}
+	return fmt.Sprintf("must not be equal to "+format, disallowed)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/content/identifier.go b/third_party/k8s.io/apimachinery/pkg/api/validate/content/identifier.go
new file mode 100644
index 0000000000..3913ec9916
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/content/identifier.go
@@ -0,0 +1,35 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"regexp"
+)
+
+const cIdentifierFmt string = "[A-Za-z_][A-Za-z0-9_]*"
+const identifierErrMsg string = "a valid C identifier must start with alphabetic character or '_', followed by a string of alphanumeric characters or '_'"
+
+var cIdentifierRegexp = regexp.MustCompile("^" + cIdentifierFmt + "$")
+
+// IsCIdentifier tests for a string that conforms the definition of an identifier
+// in C. This checks the format, but not the length.
+func IsCIdentifier(value string) []string {
+	if !cIdentifierRegexp.MatchString(value) {
+		return []string{RegexError(identifierErrMsg, cIdentifierFmt, "my_name", "MY_NAME", "MyName")}
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/content/identifier_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/content/identifier_test.go
new file mode 100644
index 0000000000..e5c1bf84ab
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/content/identifier_test.go
@@ -0,0 +1,46 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"testing"
+)
+
+func TestIsCIdentifier(t *testing.T) {
+	goodValues := []string{
+		"a", "ab", "abc", "a1", "_a", "a_", "a_b", "a_1", "a__1__2__b", "__abc_123",
+		"A", "AB", "AbC", "A1", "_A", "A_", "A_B", "A_1", "A__1__2__B", "__123_ABC",
+	}
+	for _, val := range goodValues {
+		if msgs := IsCIdentifier(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"", "1", "123", "1a",
+		"-", "a-", "-a", "1-", "-1", "1_", "1_2",
+		".", "a.", ".a", "a.b", "1.", ".1", "1.2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2",
+		"#a#",
+	}
+	for _, val := range badValues {
+		if msgs := IsCIdentifier(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/content/kube.go b/third_party/k8s.io/apimachinery/pkg/api/validate/content/kube.go
new file mode 100644
index 0000000000..608073f708
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/content/kube.go
@@ -0,0 +1,117 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"regexp"
+	"strings"
+)
+
+const labelKeyCharFmt string = "[A-Za-z0-9]"
+const labelKeyExtCharFmt string = "[-A-Za-z0-9_.]"
+const labelKeyFmt string = "(" + labelKeyCharFmt + labelKeyExtCharFmt + "*)?" + labelKeyCharFmt
+const labelKeyErrMsg string = "must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character"
+const labelKeyMaxLength int = 63
+
+var labelKeyRegexp = regexp.MustCompile("^" + labelKeyFmt + "$")
+
+// IsQualifiedName tests whether the value passed is what Kubernetes calls a
+// "qualified name", which is the same as a label key.
+//
+// Deprecated: use IsLabelKey instead.
+var IsQualifiedName = IsLabelKey
+
+// IsLabelKey tests whether the value passed is a valid label key. This format
+// is used to validate many fields in the Kubernetes API.
+// Label keys consist of an optional prefix and a name, separated by a '/'.
+// If the value is not valid, a list of error strings is returned. Otherwise, an
+// empty list (or nil) is returned.
+func IsLabelKey(value string) []string {
+	var errs []string
+	parts := strings.Split(value, "/")
+	var name string
+	switch len(parts) {
+	case 1:
+		name = parts[0]
+	case 2:
+		var prefix string
+		prefix, name = parts[0], parts[1]
+		if len(prefix) == 0 {
+			errs = append(errs, "prefix part "+EmptyError())
+		} else if msgs := IsDNS1123Subdomain(prefix); len(msgs) != 0 {
+			errs = append(errs, prefixEach(msgs, "prefix part ")...)
+		}
+	default:
+		return append(errs, "a valid label key "+RegexError(labelKeyErrMsg, labelKeyFmt, "MyName", "my.name", "123-abc")+
+			" with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')")
+	}
+
+	if len(name) == 0 {
+		errs = append(errs, "name part "+EmptyError())
+	} else if len(name) > labelKeyMaxLength {
+		errs = append(errs, "name part "+MaxLenError(labelKeyMaxLength))
+	}
+	if !labelKeyRegexp.MatchString(name) {
+		errs = append(errs, "name part "+RegexError(labelKeyErrMsg, labelKeyFmt, "MyName", "my.name", "123-abc"))
+	}
+	return errs
+}
+
+const labelValueFmt string = "(" + labelKeyFmt + ")?"
+const labelValueErrMsg string = "a valid label must be an empty string or consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character"
+
+// LabelValueMaxLength is a label's max length
+const LabelValueMaxLength int = 63
+
+var labelValueRegexp = regexp.MustCompile("^" + labelValueFmt + "$")
+
+// IsLabelValue tests whether the value passed is a valid label value.  If
+// the value is not valid, a list of error strings is returned.  Otherwise an
+// empty list (or nil) is returned.
+func IsLabelValue(value string) []string {
+	var errs []string
+	if len(value) > LabelValueMaxLength {
+		errs = append(errs, MaxLenError(LabelValueMaxLength))
+	}
+	if !labelValueRegexp.MatchString(value) {
+		errs = append(errs, RegexError(labelValueErrMsg, labelValueFmt, "MyValue", "my_value", "12345"))
+	}
+	return errs
+}
+
+func prefixEach(msgs []string, prefix string) []string {
+	for i := range msgs {
+		msgs[i] = prefix + msgs[i]
+	}
+	return msgs
+}
+
+// IsPrefixedLabelKey tests whether the value passed is a valid label key with
+// a domain prefix. This allows "example.com/key" but not "key".
+// If the value is not valid, a list of error strings is returned. Otherwise,
+// an empty list (or nil) is returned.
+func IsPrefixedLabelKey(value string) []string {
+	if errs := IsLabelKey(value); len(errs) > 0 {
+		return errs
+	}
+
+	segments := strings.Split(value, "/")
+	if len(segments) != 2 {
+		return []string{"must include a prefix (e.g. 'example.com/key')"}
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/content/kube_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/content/kube_test.go
new file mode 100644
index 0000000000..59f6f2cd28
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/content/kube_test.go
@@ -0,0 +1,145 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestIsLabelKey(t *testing.T) {
+	successCases := []string{
+		"simple",
+		"now-with-dashes",
+		"1-starts-with-num",
+		"1234",
+		"simple/simple",
+		"now-with-dashes/simple",
+		"now-with-dashes/now-with-dashes",
+		"now.with.dots/simple",
+		"now-with.dashes-and.dots/simple",
+		"1-num.2-num/3-num",
+		"1234/5678",
+		"1.2.3.4/5678",
+		"Uppercase_Is_OK_123",
+		"example.com/Uppercase_Is_OK_123",
+		"requests.storage-foo",
+		strings.Repeat("a", 63),
+		strings.Repeat("a", 253) + "/" + strings.Repeat("b", 63),
+	}
+	for i := range successCases {
+		if errs := IsLabelKey(successCases[i]); len(errs) != 0 {
+			t.Errorf("case[%d]: %q: expected success: %v", i, successCases[i], errs)
+		}
+	}
+
+	errorCases := []string{
+		"nospecialchars%^=@",
+		"cantendwithadash-",
+		"-cantstartwithadash-",
+		"only/one/slash",
+		"Example.com/abc",
+		"example_com/abc",
+		"example.com/",
+		"/simple",
+		strings.Repeat("a", 64),
+		strings.Repeat("a", 254) + "/abc",
+	}
+	for i := range errorCases {
+		if errs := IsLabelKey(errorCases[i]); len(errs) == 0 {
+			t.Errorf("case[%d]: %q: expected failure", i, errorCases[i])
+		}
+	}
+}
+
+func TestIsLabelValue(t *testing.T) {
+	successCases := []string{
+		"simple",
+		"now-with-dashes",
+		"1-starts-with-num",
+		"end-with-num-1",
+		"1234",                  // only num
+		strings.Repeat("a", 63), // to the limit
+		"",                      // empty value
+	}
+	for i := range successCases {
+		if errs := IsLabelValue(successCases[i]); len(errs) != 0 {
+			t.Errorf("case %s expected success: %v", successCases[i], errs)
+		}
+	}
+
+	errorCases := []string{
+		"nospecialchars%^=@",
+		"Tama-nui-te-rā.is.Māori.sun",
+		"\\backslashes\\are\\bad",
+		"-starts-with-dash",
+		"ends-with-dash-",
+		".starts.with.dot",
+		"ends.with.dot.",
+		strings.Repeat("a", 64), // over the limit
+	}
+	for i := range errorCases {
+		if errs := IsLabelValue(errorCases[i]); len(errs) == 0 {
+			t.Errorf("case[%d] expected failure", i)
+		}
+	}
+}
+
+func TestIsPrefixedLabelKey(t *testing.T) {
+	successCases := []string{
+		"simple/simple",
+		"now-with-dashes/simple",
+		"now-with-dashes/now-with-dashes",
+		"now.with.dots/simple",
+		"now-with.dashes-and.dots/simple",
+		"1-num.2-num/3-num",
+		"1234/5678",
+		"1.2.3.4/5678",
+		"example.com/Uppercase_Is_OK_123",
+		strings.Repeat("a", 253) + "/" + strings.Repeat("b", 63),
+	}
+	for i := range successCases {
+		if errs := IsPrefixedLabelKey(successCases[i]); len(errs) != 0 {
+			t.Errorf("case[%d]: %q: expected success: %v", i, successCases[i], errs)
+		}
+	}
+
+	errorCases := []string{
+		"simple",
+		"now-with-dashes",
+		"1-starts-with-num",
+		"1234",
+		"Uppercase_Is_OK_123",
+		"requests.storage-foo",
+		strings.Repeat("a", 63),
+		"nospecialchars%^=@",
+		"cantendwithadash-",
+		"-cantstartwithadash-",
+		"only/one/slash",
+		"Example.com/abc",
+		"example_com/abc",
+		"example.com/",
+		"/simple",
+		strings.Repeat("a", 64),
+		strings.Repeat("a", 254) + "/abc",
+	}
+	for i := range errorCases {
+		if errs := IsPrefixedLabelKey(errorCases[i]); len(errs) == 0 {
+			t.Errorf("case[%d]: %q: expected failure", i, errorCases[i])
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/content/path.go b/third_party/k8s.io/apimachinery/pkg/api/validate/content/path.go
new file mode 100644
index 0000000000..c41b1d4731
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/content/path.go
@@ -0,0 +1,63 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"fmt"
+	"strings"
+)
+
+// Strings that cannot be used as names specified as path segments (like the
+// REST API or etcd store).
+var pathSegmentNameMayNotBe = []string{".", ".."}
+
+// Substrings that cannot be used in names specified as path segments (like the
+// REST API or etcd store).
+var pathSegmentNameMayNotContain = []string{"/", "%"}
+
+// IsPathSegmentName validates the name can be safely encoded as a path
+// segment.
+//
+// Note that, for historical reason, this function does not check for
+// empty strings or impose a limit on the length of the name.
+func IsPathSegmentName(name string) []string {
+	for _, illegalName := range pathSegmentNameMayNotBe {
+		if name == illegalName {
+			return []string{fmt.Sprintf(`may not be '%s'`, illegalName)}
+		}
+	}
+
+	return IsPathSegmentPrefix(name)
+}
+
+// IsPathSegmentPrefix validates the name can be used as a prefix for a
+// name which will be encoded as a path segment It does not check for exact
+// matches with disallowed names, since an arbitrary suffix might make the name
+// valid.
+//
+// Note that, for historical reason, this function does not check for
+// empty strings or impose a limit on the length of the name.
+func IsPathSegmentPrefix(name string) []string {
+	var errors []string
+	for _, illegalContent := range pathSegmentNameMayNotContain {
+		if strings.Contains(name, illegalContent) {
+			errors = append(errors, fmt.Sprintf(`may not contain '%s'`, illegalContent))
+		}
+	}
+
+	return errors
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/content/path_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/content/path_test.go
new file mode 100644
index 0000000000..16a1119e82
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/content/path_test.go
@@ -0,0 +1,158 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestIsPathSegmentPrefix(t *testing.T) {
+	testcases := map[string]struct {
+		Name        string
+		ExpectedMsg string
+	}{
+		"empty": {
+			Name:        "",
+			ExpectedMsg: "", // NOTE: this probably should fail
+		},
+		// NOTE: no validation of max length
+		"valid short": {
+			Name:        "foo",
+			ExpectedMsg: "",
+		},
+		"valid long": {
+			Name:        "foo.bar.baz",
+			ExpectedMsg: "",
+		},
+		// Make sure mixed case, non DNS subdomain characters are tolerated
+		"valid complex": {
+			Name:        "sha256:ABCDEF012345@ABCDEF012345",
+			ExpectedMsg: "",
+		},
+		// Make sure non-ascii characters are tolerated
+		"valid extended charset": {
+			Name:        "Iñtërnâtiônàlizætiøn",
+			ExpectedMsg: "",
+		},
+		"dot": {
+			Name:        ".",
+			ExpectedMsg: "",
+		},
+		"dot leading": {
+			Name:        ".test",
+			ExpectedMsg: "",
+		},
+		"dot dot": {
+			Name:        "..",
+			ExpectedMsg: "",
+		},
+		"dot dot leading": {
+			Name:        "..test",
+			ExpectedMsg: "",
+		},
+		"slash": {
+			Name:        "foo/bar",
+			ExpectedMsg: "/",
+		},
+		"percent": {
+			Name:        "foo%bar",
+			ExpectedMsg: "%",
+		},
+	}
+
+	for k, tc := range testcases {
+		msgs := IsPathSegmentPrefix(tc.Name)
+		if len(tc.ExpectedMsg) == 0 && len(msgs) > 0 {
+			t.Errorf("%s: expected no error, got %v", k, msgs)
+		}
+		if len(tc.ExpectedMsg) > 0 && len(msgs) == 0 {
+			t.Errorf("%s: expected error, got none", k)
+		}
+		if len(tc.ExpectedMsg) > 0 && !strings.Contains(msgs[0], tc.ExpectedMsg) {
+			t.Errorf("%s: expected error containing %q, got %v", k, tc.ExpectedMsg, msgs[0])
+		}
+	}
+}
+
+func TestIsPathSegmentName(t *testing.T) {
+	testcases := map[string]struct {
+		Name        string
+		ExpectedMsg string
+	}{
+		"empty": {
+			Name:        "",
+			ExpectedMsg: "", // NOTE: this probably should fail
+		},
+		// NOTE: no validation of max length
+		"valid short": {
+			Name:        "foo",
+			ExpectedMsg: "",
+		},
+		"valid long": {
+			Name:        "foo.bar.baz",
+			ExpectedMsg: "",
+		},
+		// Make sure mixed case, non DNS subdomain characters are tolerated
+		"valid complex": {
+			Name:        "sha256:ABCDEF012345@ABCDEF012345",
+			ExpectedMsg: "",
+		},
+		// Make sure non-ascii characters are tolerated
+		"valid extended charset": {
+			Name:        "Iñtërnâtiônàlizætiøn",
+			ExpectedMsg: "",
+		},
+		"dot": {
+			Name:        ".",
+			ExpectedMsg: ".",
+		},
+		"dot leading": {
+			Name:        ".test",
+			ExpectedMsg: "",
+		},
+		"dot dot": {
+			Name:        "..",
+			ExpectedMsg: "..",
+		},
+		"dot dot leading": {
+			Name:        "..test",
+			ExpectedMsg: "",
+		},
+		"slash": {
+			Name:        "foo/bar",
+			ExpectedMsg: "/",
+		},
+		"percent": {
+			Name:        "foo%bar",
+			ExpectedMsg: "%",
+		},
+	}
+
+	for k, tc := range testcases {
+		msgs := IsPathSegmentName(tc.Name)
+		if len(tc.ExpectedMsg) == 0 && len(msgs) > 0 {
+			t.Errorf("%s: expected no error, got %v", k, msgs)
+		}
+		if len(tc.ExpectedMsg) > 0 && len(msgs) == 0 {
+			t.Errorf("%s: expected error, got none", k)
+		}
+		if len(tc.ExpectedMsg) > 0 && !strings.Contains(msgs[0], tc.ExpectedMsg) {
+			t.Errorf("%s: expected error containing %q, got %v", k, tc.ExpectedMsg, msgs[0])
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/dependentrequired.go b/third_party/k8s.io/apimachinery/pkg/api/validate/dependentrequired.go
new file mode 100644
index 0000000000..69222c9752
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/dependentrequired.go
@@ -0,0 +1,83 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// DependentRequired verifies that when triggerIsSet(obj) is true, dependentIsSet(obj)
+// is also true; otherwise reports an error at fldPath.Child(dependentName).
+// On Update, the check is skipped if neither side's set-ness changed from oldObj,
+// so unrelated updates can proceed past a pre-existing violation.
+func DependentRequired[T any](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *T,
+	triggerName string, triggerIsSet ExtractorFn[*T, bool],
+	dependentName string, dependentIsSet ExtractorFn[*T, bool],
+) field.ErrorList {
+	if obj == nil {
+		return nil
+	}
+	if op.Type == operation.Update && oldObj != nil {
+		if triggerIsSet(obj) == triggerIsSet(oldObj) && dependentIsSet(obj) == dependentIsSet(oldObj) {
+			return nil
+		}
+	}
+	if !triggerIsSet(obj) {
+		return nil
+	}
+	if dependentIsSet(obj) {
+		return nil
+	}
+	return field.ErrorList{
+		field.Required(fldPath.Child(dependentName),
+			fmt.Sprintf("must be set when %s is set", triggerName)).
+			WithOrigin("dependentRequired"),
+	}
+}
+
+// DependentForbidden verifies that when triggerIsSet(obj) is true, dependentIsSet(obj)
+// is false; otherwise reports an error at fldPath.Child(dependentName).
+// On Update, the check is skipped if neither side's set-ness changed from oldObj,
+// so unrelated updates can proceed past a pre-existing violation.
+func DependentForbidden[T any](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *T,
+	triggerName string, triggerIsSet ExtractorFn[*T, bool],
+	dependentName string, dependentIsSet ExtractorFn[*T, bool],
+) field.ErrorList {
+	if obj == nil {
+		return nil
+	}
+	if op.Type == operation.Update && oldObj != nil {
+		if triggerIsSet(obj) == triggerIsSet(oldObj) && dependentIsSet(obj) == dependentIsSet(oldObj) {
+			return nil
+		}
+	}
+	if !triggerIsSet(obj) {
+		return nil
+	}
+	if !dependentIsSet(obj) {
+		return nil
+	}
+	return field.ErrorList{
+		field.Forbidden(fldPath.Child(dependentName),
+			fmt.Sprintf("may not be set when %s is set", triggerName)).
+			WithOrigin("dependentForbidden"),
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/dependentrequired_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/dependentrequired_test.go
new file mode 100644
index 0000000000..5727b9327a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/dependentrequired_test.go
@@ -0,0 +1,194 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"regexp"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestDependentRequired(t *testing.T) {
+	type obj struct {
+		Trigger    *string
+		Dependent  *string
+		OtherField *string
+	}
+
+	triggerIsSet := func(o *obj) bool { return o != nil && o.Trigger != nil }
+	dependentIsSet := func(o *obj) bool { return o != nil && o.Dependent != nil }
+
+	cases := []struct {
+		name   string
+		op     operation.Operation
+		obj    *obj
+		oldObj *obj
+		err    string // regex; empty means expect no error
+	}{{
+		name: "create: trigger unset, dependent set",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  &obj{Dependent: new("d")},
+	}, {
+		name: "create: trigger set, dependent set",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  &obj{Trigger: new("t"), Dependent: new("d")},
+	}, {
+		name: "create: trigger set, dependent unset",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  &obj{Trigger: new("t")},
+		err:  `fldpath\.dependent: Required value: must be set when trigger is set`,
+	}, {
+		name: "create: nil obj",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  nil,
+	}, {
+		name:   "ratchet: unrelated field changed, trigger and dependent set-ness unchanged",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t"), OtherField: new("new")},
+		oldObj: &obj{Trigger: new("t"), OtherField: new("old")},
+	}, {
+		name:   "ratchet: trigger value changed, set-ness unchanged",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t")},
+		oldObj: &obj{Trigger: new("old")},
+	}, {
+		name:   "update: trigger newly set",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t")},
+		oldObj: &obj{},
+		err:    `fldpath\.dependent: Required value: must be set when trigger is set`,
+	}, {
+		name:   "update: dependent newly cleared",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t")},
+		oldObj: &obj{Trigger: new("t"), Dependent: new("d")},
+		err:    `fldpath\.dependent: Required value: must be set when trigger is set`,
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := DependentRequired(context.Background(), tc.op,
+				field.NewPath("fldpath"), tc.obj, tc.oldObj,
+				"trigger", triggerIsSet,
+				"dependent", dependentIsSet)
+			if len(result) > 0 && tc.err == "" {
+				t.Fatalf("unexpected failure: %v", fmtErrs(result))
+			}
+			if len(result) == 0 && tc.err != "" {
+				t.Fatalf("unexpected success: expected %q", tc.err)
+			}
+			if len(result) > 1 {
+				t.Fatalf("unexpected multi-error: %v", fmtErrs(result))
+			}
+			if len(result) > 0 {
+				if !regexp.MustCompile(tc.err).MatchString(result[0].Error()) {
+					t.Errorf("wrong error\nexpected: %q\n     got: %v", tc.err, fmtErrs(result))
+				}
+				if result[0].Origin != "dependentRequired" {
+					t.Errorf("expected origin %q, got %q", "dependentRequired", result[0].Origin)
+				}
+			}
+		})
+	}
+}
+
+func TestDependentForbidden(t *testing.T) {
+	type obj struct {
+		Trigger    *string
+		Dependent  *string
+		OtherField *string
+	}
+
+	triggerIsSet := func(o *obj) bool { return o != nil && o.Trigger != nil }
+	dependentIsSet := func(o *obj) bool { return o != nil && o.Dependent != nil }
+
+	cases := []struct {
+		name   string
+		op     operation.Operation
+		obj    *obj
+		oldObj *obj
+		err    string // regex; empty means expect no error
+	}{{
+		name: "create: trigger unset, dependent set",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  &obj{Dependent: new("d")},
+	}, {
+		name: "create: trigger set, dependent unset",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  &obj{Trigger: new("t")},
+	}, {
+		name: "create: trigger set, dependent set",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  &obj{Trigger: new("t"), Dependent: new("d")},
+		err:  `fldpath\.dependent: Forbidden: may not be set when trigger is set`,
+	}, {
+		name: "create: nil obj",
+		op:   operation.Operation{Type: operation.Create},
+		obj:  nil,
+	}, {
+		name:   "ratchet: unrelated field changed, trigger and dependent set-ness unchanged",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t"), Dependent: new("d"), OtherField: new("new")},
+		oldObj: &obj{Trigger: new("t"), Dependent: new("d"), OtherField: new("old")},
+	}, {
+		name:   "ratchet: trigger value changed, set-ness unchanged",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t"), Dependent: new("d")},
+		oldObj: &obj{Trigger: new("old"), Dependent: new("d")},
+	}, {
+		name:   "update: trigger newly set",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t"), Dependent: new("d")},
+		oldObj: &obj{Dependent: new("d")},
+		err:    `fldpath\.dependent: Forbidden: may not be set when trigger is set`,
+	}, {
+		name:   "update: dependent newly set",
+		op:     operation.Operation{Type: operation.Update},
+		obj:    &obj{Trigger: new("t"), Dependent: new("d")},
+		oldObj: &obj{Trigger: new("t")},
+		err:    `fldpath\.dependent: Forbidden: may not be set when trigger is set`,
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := DependentForbidden(context.Background(), tc.op,
+				field.NewPath("fldpath"), tc.obj, tc.oldObj,
+				"trigger", triggerIsSet,
+				"dependent", dependentIsSet)
+			if len(result) > 0 && tc.err == "" {
+				t.Fatalf("unexpected failure: %v", fmtErrs(result))
+			}
+			if len(result) == 0 && tc.err != "" {
+				t.Fatalf("unexpected success: expected %q", tc.err)
+			}
+			if len(result) > 1 {
+				t.Fatalf("unexpected multi-error: %v", fmtErrs(result))
+			}
+			if len(result) > 0 {
+				if !regexp.MustCompile(tc.err).MatchString(result[0].Error()) {
+					t.Errorf("wrong error\nexpected: %q\n     got: %v", tc.err, fmtErrs(result))
+				}
+				if result[0].Origin != "dependentForbidden" {
+					t.Errorf("expected origin %q, got %q", "dependentForbidden", result[0].Origin)
+				}
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/discriminator.go b/third_party/k8s.io/apimachinery/pkg/api/validate/discriminator.go
new file mode 100644
index 0000000000..6f4b3cddda
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/discriminator.go
@@ -0,0 +1,74 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// DiscriminatedRule defines a validation to apply for a specific discriminator value.
+type DiscriminatedRule[Tfield any, Tdisc comparable] struct {
+	Value      Tdisc
+	Validation ValidateFunc[Tfield]
+}
+
+// Discriminated validates a member field based on a discriminator value.
+// It iterates through the rules and applies the first one that matches the discriminator.
+// If no rule matches, it applies the defaultValidation if provided.
+//
+// It performs ratcheting: if the operation is an Update, and neither the discriminator
+// nor the value (checked via equiv) have changed, validation is skipped.
+//
+// The equiv function can be called with nil arguments in the case of nilable
+// fields.
+func Discriminated[Tfield any, Tdisc comparable, Tstruct any](ctx context.Context, op operation.Operation, structPath *field.Path,
+	obj, oldObj *Tstruct, fieldName string, getMemberValue func(*Tstruct) Tfield, getDiscriminator func(*Tstruct) Tdisc,
+	equiv MatchFunc[Tfield], defaultValidation ValidateFunc[Tfield], rules []DiscriminatedRule[Tfield, Tdisc],
+) field.ErrorList {
+	value := getMemberValue(obj)
+	discriminator := getDiscriminator(obj)
+	var oldValue Tfield
+	var oldDiscriminator Tdisc
+
+	if oldObj != nil {
+		oldValue = getMemberValue(oldObj)
+		oldDiscriminator = getDiscriminator(oldObj)
+	}
+
+	if op.Type == operation.Update && oldObj != nil && discriminator == oldDiscriminator && equiv(value, oldValue) {
+		return nil
+	}
+
+	fldPath := structPath.Child(fieldName)
+	for _, rule := range rules {
+		if rule.Value == discriminator {
+			if rule.Validation == nil {
+				return nil
+			}
+			return rule.Validation(ctx, op, fldPath, value, oldValue)
+		}
+	}
+
+	if defaultValidation != nil {
+		return defaultValidation(ctx, op, fldPath, value, oldValue)
+	}
+
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/discriminator_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/discriminator_test.go
new file mode 100644
index 0000000000..ae9621b2a9
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/discriminator_test.go
@@ -0,0 +1,265 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestDiscriminated(t *testing.T) {
+	errMatch := field.ErrorList{field.Invalid(field.NewPath("foo"), "bar", "match error")}
+	errDefault := field.ErrorList{field.Invalid(field.NewPath("foo"), "bar", "default error")}
+
+	mockValid := func(_ context.Context, _ operation.Operation, _ *field.Path, _, _ *string) field.ErrorList {
+		return nil
+	}
+	mockErrorMatch := func(_ context.Context, _ operation.Operation, _ *field.Path, _, _ *string) field.ErrorList {
+		return errMatch
+	}
+	mockErrorDefault := func(_ context.Context, _ operation.Operation, _ *field.Path, _, _ *string) field.ErrorList {
+		return errDefault
+	}
+
+	// mockEqual compares pointer values by dereferencing, not by pointer identity.
+	mockEqual := func(a, b *string) bool {
+		if a == nil && b == nil {
+			return true
+		}
+		if a == nil || b == nil {
+			return false
+		}
+		return *a == *b
+	}
+
+	testCases := []struct {
+		name              string
+		opType            operation.Type
+		discriminator     string
+		oldDiscriminator  string
+		value             *string
+		oldValue          *string
+		rules             []DiscriminatedRule[*string, string]
+		defaultValidation ValidateFunc[*string]
+		expected          field.ErrorList
+	}{
+		{
+			name:             "matches rule, returns valid",
+			opType:           operation.Create,
+			discriminator:    "A",
+			oldDiscriminator: "A",
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "A", Validation: mockValid},
+				{Value: "B", Validation: mockErrorMatch},
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          nil,
+		},
+		{
+			name:             "matches rule, returns error",
+			opType:           operation.Create,
+			discriminator:    "B",
+			oldDiscriminator: "B",
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "A", Validation: mockValid},
+				{Value: "B", Validation: mockErrorMatch},
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          errMatch,
+		},
+		{
+			name:             "ratcheting: update, unchanged, skips validation",
+			opType:           operation.Update,
+			discriminator:    "B",
+			oldDiscriminator: "B", // unchanged
+			value:            nil,
+			oldValue:         nil, // unchanged
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "B", Validation: mockErrorMatch}, // would fail if run
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          nil,
+		},
+		{
+			name:             "ratcheting: update, same value different pointers, skips validation",
+			opType:           operation.Update,
+			discriminator:    "B",
+			oldDiscriminator: "B",
+			value:            strPtr("same"),
+			oldValue:         strPtr("same"), // different pointer, same value
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "B", Validation: mockErrorMatch}, // would fail if run
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          nil,
+		},
+		{
+			name:             "ratcheting: update, discriminator changed, runs validation",
+			opType:           operation.Update,
+			discriminator:    "B",
+			oldDiscriminator: "A", // changed
+			value:            nil,
+			oldValue:         nil,
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "B", Validation: mockErrorMatch},
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          errMatch,
+		},
+		{
+			name:             "ratcheting: update, value changed, discriminator unchanged, runs validation",
+			opType:           operation.Update,
+			discriminator:    "B",
+			oldDiscriminator: "B", // unchanged
+			value:            strPtr("new"),
+			oldValue:         strPtr("old"), // changed
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "B", Validation: mockErrorMatch},
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          errMatch,
+		},
+		{
+			name:          "matches rule with nil validation, returns valid",
+			opType:        operation.Create,
+			discriminator: "A",
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "A", Validation: nil},
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          nil,
+		},
+		{
+			name:          "no match, runs default",
+			opType:        operation.Create,
+			discriminator: "C",
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "A", Validation: mockValid},
+				{Value: "B", Validation: mockErrorMatch},
+			},
+			defaultValidation: mockErrorDefault,
+			expected:          errDefault,
+		},
+		{
+			name:          "no match, nil default, returns valid",
+			opType:        operation.Create,
+			discriminator: "C",
+			rules: []DiscriminatedRule[*string, string]{
+				{Value: "A", Validation: mockValid},
+			},
+			defaultValidation: nil,
+			expected:          nil,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			oldDisc := tc.oldDiscriminator
+			if oldDisc == "" {
+				oldDisc = tc.discriminator
+			}
+
+			type StringP struct {
+				Val  *string
+				Disc string
+			}
+			newObj := &StringP{Val: tc.value, Disc: tc.discriminator}
+			var oldObj *StringP
+			if tc.opType == operation.Update {
+				oldObj = &StringP{Val: tc.oldValue, Disc: oldDisc}
+			}
+			getVal := func(p *StringP) *string { return p.Val }
+			getDisc := func(p *StringP) string { return p.Disc }
+			got := Discriminated[*string, string, StringP](context.Background(), operation.Operation{Type: tc.opType}, field.NewPath("root"), newObj, oldObj, "field", getVal, getDisc, mockEqual, tc.defaultValidation, tc.rules)
+
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
+
+func TestDiscriminatedIntDiscriminator(t *testing.T) {
+	errMatch := field.ErrorList{field.Invalid(field.NewPath("foo"), "bar", "match error")}
+	errDefault := field.ErrorList{field.Invalid(field.NewPath("foo"), "bar", "default error")}
+
+	mockErrorMatch := func(_ context.Context, _ operation.Operation, _ *field.Path, _, _ *string) field.ErrorList {
+		return errMatch
+	}
+	mockErrorDefault := func(_ context.Context, _ operation.Operation, _ *field.Path, _, _ *string) field.ErrorList {
+		return errDefault
+	}
+
+	mockEqual := func(a, b *string) bool {
+		return a == b
+	}
+
+	type IntP struct {
+		Val  *string
+		Disc int
+	}
+	newObj := &IntP{Val: nil, Disc: 1}
+	getVal := func(p *IntP) *string { return p.Val }
+	getDisc := func(p *IntP) int { return p.Disc }
+
+	got := Discriminated[*string, int, IntP](context.Background(), operation.Operation{Type: operation.Create}, field.NewPath("root"), newObj, nil, "field", getVal, getDisc, mockEqual, mockErrorDefault, []DiscriminatedRule[*string, int]{
+		{Value: 1, Validation: mockErrorMatch},
+	})
+	if !reflect.DeepEqual(got, errMatch) {
+		t.Errorf("int discriminator: got %v want %v", got, errMatch)
+	}
+}
+
+func TestDiscriminatedBoolDiscriminator(t *testing.T) {
+	errMatch := field.ErrorList{field.Invalid(field.NewPath("foo"), "bar", "match error")}
+	errDefault := field.ErrorList{field.Invalid(field.NewPath("foo"), "bar", "default error")}
+
+	mockErrorMatch := func(_ context.Context, _ operation.Operation, _ *field.Path, _, _ *string) field.ErrorList {
+		return errMatch
+	}
+	mockErrorDefault := func(_ context.Context, _ operation.Operation, _ *field.Path, _, _ *string) field.ErrorList {
+		return errDefault
+	}
+
+	mockEqual := func(a, b *string) bool {
+		return a == b
+	}
+
+	type BoolP struct {
+		Val  *string
+		Disc bool
+	}
+	newObj := &BoolP{Val: nil, Disc: true}
+	getVal := func(p *BoolP) *string { return p.Val }
+	getDisc := func(p *BoolP) bool { return p.Disc }
+
+	got := Discriminated[*string, bool, BoolP](context.Background(), operation.Operation{Type: operation.Create}, field.NewPath("root"), newObj, nil, "field", getVal, getDisc, mockEqual, mockErrorDefault, []DiscriminatedRule[*string, bool]{
+		{Value: true, Validation: mockErrorMatch},
+	})
+	if !reflect.DeepEqual(got, errMatch) {
+		t.Errorf("bool discriminator: got %v want %v", got, errMatch)
+	}
+}
+
+// strPtr returns a new pointer to a copy of s, guaranteeing a distinct allocation.
+func strPtr(s string) *string {
+	return &s
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/doc.go b/third_party/k8s.io/apimachinery/pkg/api/validate/doc.go
new file mode 100644
index 0000000000..eee13e9b38
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/doc.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package validate holds API validation functions which are designed for use
+// with the k8s.io/code-generator/cmd/validation-gen tool.  Each validation
+// function has a similar fingerprint:
+//
+//	func <Name>(ctx context.Context,
+//	            op operation.Operation,
+//	            fldPath *field.Path,
+//	            value, oldValue <nilable type>,
+//	            <other args...>) field.ErrorList
+//
+// The value and oldValue arguments will always be a nilable type.  If the
+// original value was a string, these will be a *string.  If the original value
+// was a slice or map, these will be the same slice or map type.
+//
+// For a CREATE operation, the oldValue will always be nil.  For an UPDATE
+// operation, either value or oldValue may be nil, e.g. when adding or removing
+// a value in a list-map.  Validators which care about UPDATE operations should
+// look at the opCtx argument to know which operation is being executed.
+//
+// Tightened validation (also known as ratcheting validation) is supported by
+// defining a new validation function. For example:
+//
+//	func TightenedMaxLength(ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *string) field.ErrorList {
+//	  if oldValue != nil && len(MaxLength(ctx, op, fldPath, oldValue, nil)) > 0 {
+//	    // old value is not valid, so this value skips the tightened validation
+//	    return nil
+//	  }
+//	  return MaxLength(ctx, op, fldPath, value, nil)
+//	}
+//
+// In general, we cannot distinguish a non-specified slice or map from one that
+// is specified but empty.  Validators should not rely on nil values, but use
+// len() instead.
+package validate
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/each.go b/third_party/k8s.io/apimachinery/pkg/api/validate/each.go
new file mode 100644
index 0000000000..affc44576b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/each.go
@@ -0,0 +1,348 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"reflect"
+	"slices"
+	"sort"
+
+	"k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// MatchFunc is a function that compares two values of the same type,
+// according to some criteria, and returns true if they match.
+type MatchFunc[T any] func(T, T) bool
+
+// EachValSliceVal performs validation on each element of a slice of values
+// using the provided validation function.
+//
+// For update operations, the match function finds corresponding values in
+// oldSlice for each value in newSlice. This comparison can be either full or
+// partial (e.g., matching only specific struct fields that serve as a unique
+// identifier). If match is nil, validation proceeds without considering old
+// values, and the equiv function is not used.
+//
+// For update operations, the equiv function checks if a new value is
+// equivalent to its corresponding old value, enabling validation ratcheting.
+// If equiv is nil but match is provided, the match function is assumed to
+// perform full value comparison.
+//
+// The match and equiv functions will never be called with nil arguments.
+//
+// Note: The slice element type must be non-nilable.
+func EachValSliceVal[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newSlice, oldSlice []T,
+	match, equiv MatchFunc[*T], validator ValidateFunc[*T]) field.ErrorList {
+	var errs field.ErrorList
+	for i := range newSlice {
+		val := &newSlice[i]
+
+		var old *T
+		if match != nil && len(oldSlice) > 0 {
+			old = lookup(oldSlice, val, match)
+		}
+		// If the operation is an update, for validation ratcheting, skip re-validating if the old
+		// value exists and either:
+		// 1. The match function provides full comparison (equiv is nil)
+		// 2. The equiv function confirms the values are equivalent (either directly or semantically)
+		//
+		// The equiv function provides equality comparison when match uses partial comparison.
+		if op.Type == operation.Update && old != nil && (equiv == nil || equiv(val, old)) {
+			continue
+		}
+		errs = append(errs, validator(ctx, op, fldPath.Index(i), val, old)...)
+	}
+	return errs
+}
+
+// EachPtrSliceVal performs validation on each element of a slice of pointers
+// using the provided validation function.
+//
+// For update operations, the match function finds corresponding values in
+// oldSlice for each value in newSlice. This comparison can be either full or
+// partial (e.g., matching only specific struct fields that serve as a unique
+// identifier). If match is nil, validation proceeds without considering old
+// values, and the equiv function is not used.
+//
+// For update operations, the equiv function checks if a new value is
+// equivalent to its corresponding old value, enabling validation ratcheting.
+// If equiv is nil but match is provided, the match function is assumed to
+// perform full value comparison.
+//
+// The match and equiv functions will never be called with nil arguments.
+func EachPtrSliceVal[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newSlice, oldSlice []*T,
+	match, equiv MatchFunc[*T], validator ValidateFunc[*T]) field.ErrorList {
+	var errs field.ErrorList
+	for i := range newSlice {
+		val := newSlice[i]
+		if val == nil {
+			// Ignore nil items; they are supposed to have been checked by PtrSliceNoNils.
+			continue
+		}
+
+		var old *T
+		if match != nil && len(oldSlice) > 0 {
+			old = lookupPointer(oldSlice, val, match)
+		}
+		if op.Type == operation.Update && old != nil && (equiv == nil || equiv(val, old)) {
+			continue
+		}
+		errs = append(errs, validator(ctx, op, fldPath.Index(i), val, old)...)
+	}
+	return errs
+}
+
+// lookup returns a pointer to the first element in the list that matches the
+// target, according to the provided comparison function, or else nil.
+func lookup[T any](list []T, target *T, match MatchFunc[*T]) *T {
+	for i := range list {
+		if match(&list[i], target) {
+			return &list[i]
+		}
+	}
+	return nil
+}
+
+// lookupPointer returns the first non-nil element in the list that matches the
+// target, according to the provided comparison function, or else nil.
+// Nil elements in the list are skipped.
+func lookupPointer[T any](list []*T, target *T, match MatchFunc[*T]) *T {
+	for i := range list {
+		if list[i] == nil {
+			// We can't really do anything about nil entries in the old list,
+			// just skip them.
+			continue
+		}
+		if match(list[i], target) {
+			return list[i]
+		}
+	}
+	return nil
+}
+
+// EachMapVal validates each value in newMap using the specified validation
+// function, passing the corresponding old value from oldMap if the key exists in oldMap.
+// For update operations, it implements validation ratcheting by skipping validation
+// when the old value exists and the equiv function confirms the values are equivalent.
+// The value-type of the map is assumed to not be nilable.
+//
+// The equiv function will never be called with nil arguments.
+//
+// If equiv is nil, value-based ratcheting is disabled and all values will be validated.
+func EachMapVal[K ~string, V any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]V,
+	equiv MatchFunc[*V], validator ValidateFunc[*V]) field.ErrorList {
+	var errs field.ErrorList
+	for key, val := range newMap {
+		var old *V
+		if o, found := oldMap[key]; found {
+			old = &o
+		}
+		// If the operation is an update, for validation ratcheting, skip re-validating if the old
+		// value is found and the equiv function confirms the values are equivalent.
+		if op.Type == operation.Update && old != nil && equiv != nil && equiv(&val, old) {
+			continue
+		}
+		errs = append(errs, validator(ctx, op, fldPath.Key(string(key)), &val, old)...)
+	}
+	return errs
+}
+
+// EachPtrMapVal validates each value in newMap (which is a map of pointers)
+// using the specified validation function, passing the corresponding old value
+// from oldMap if the key exists in oldMap.
+// For update operations, it implements validation ratcheting by skipping validation
+// when the old value exists and the equiv function confirms the values are equivalent.
+//
+// The equiv function will never be called with nil arguments.
+//
+// If equiv is nil, value-based ratcheting is disabled and all values will be validated.
+func EachPtrMapVal[K ~string, V any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]*V,
+	equiv MatchFunc[*V], validator ValidateFunc[*V]) field.ErrorList {
+	var errs field.ErrorList
+	for key, val := range newMap {
+		if val == nil {
+			// Ignore nil items; they are supposed to have been checked by PtrMapNoNils.
+			continue
+		}
+
+		var old *V
+		if o, found := oldMap[key]; found {
+			old = o
+		}
+		// If the operation is an update, for validation ratcheting, skip re-validating if the old
+		// value is found and the equiv function confirms the values are equivalent.
+		if op.Type == operation.Update && old != nil && equiv != nil && equiv(val, old) {
+			continue
+		}
+		errs = append(errs, validator(ctx, op, fldPath.Key(string(key)), val, old)...)
+	}
+	return errs
+}
+
+// EachMapKey validates each element of newMap with the specified
+// validation function.
+func EachMapKey[K ~string, T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]T,
+	validator ValidateFunc[*K]) field.ErrorList {
+	var errs field.ErrorList
+	for key := range newMap {
+		var old *K
+		if _, found := oldMap[key]; found {
+			old = &key
+		}
+		// If the operation is an update, for validation ratcheting, skip re-validating if
+		// the key is found in oldMap.
+		if op.Type == operation.Update && old != nil {
+			continue
+		}
+		// Note: the field path is the field, not the key.
+		errs = append(errs, validator(ctx, op, fldPath, &key, nil)...)
+	}
+	return errs
+}
+
+// ValSliceUnique verifies that each element of a slice of values is unique,
+// according to the match function. It compares every element of the slice with
+// every other element and returns errors for non-unique items.
+//
+// The match function will never be called with nil arguments.
+func ValSliceUnique[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, newSlice, _ []T, match MatchFunc[*T]) field.ErrorList {
+	var dups []int
+	for i := range newSlice {
+		for j := i + 1; j < len(newSlice); j++ {
+			if match(&newSlice[i], &newSlice[j]) {
+				if dups == nil {
+					dups = make([]int, 0, len(newSlice))
+				}
+				if !slices.Contains(dups, j) {
+					dups = append(dups, j)
+				}
+			}
+		}
+	}
+
+	var errs field.ErrorList
+	sort.Ints(dups)
+	for _, i := range dups {
+		var val any = newSlice[i]
+		// TODO: we don't want the whole item to be logged in the error, just
+		// the key(s). Unfortunately, the way errors are rendered, it comes out
+		// as something like "map[string]any{...}" which is not very nice. Once
+		// that is fixed, we can consider adding a way for this function to
+		// specify that just the keys should be rendered in the error.
+		errs = append(errs, field.Duplicate(fldPath.Index(i), val))
+	}
+	return errs
+}
+
+// PtrSliceUnique verifies that each element of a slice of pointers is unique,
+// according to the match function. It compares every element of the slice with
+// every other element and returns errors for non-unique items.
+//
+// The match function will never be called with nil arguments.
+func PtrSliceUnique[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, newSlice, _ []*T, match MatchFunc[*T]) field.ErrorList {
+	var errs field.ErrorList
+	var dups []int
+	for i := range newSlice {
+		if newSlice[i] == nil {
+			// Ignore nil items; they are supposed to have been checked by PtrSliceNoNils.
+			continue
+		}
+		for j := i + 1; j < len(newSlice); j++ {
+			if newSlice[j] == nil {
+				continue
+			}
+			if match(newSlice[i], newSlice[j]) {
+				if dups == nil {
+					dups = make([]int, 0, len(newSlice))
+				}
+				if !slices.Contains(dups, j) {
+					dups = append(dups, j)
+				}
+			}
+		}
+	}
+
+	sort.Ints(dups)
+	for _, i := range dups {
+		var val any = newSlice[i]
+		errs = append(errs, field.Duplicate(fldPath.Index(i), val))
+	}
+	return errs
+}
+
+// SemanticDeepEqual is a MatchFunc that uses equality.Semantic.DeepEqual to
+// compare two values.
+// This wrapper is needed because MatchFunc requires a function that takes two
+// arguments of specific type T, while equality.Semantic.DeepEqual takes
+// arguments of type interface{}/any. The wrapper satisfies the type
+// constraints of MatchFunc while leveraging the underlying semantic equality
+// logic. It can be used by any other function that needs to call DeepEqual.
+//
+// Deprecated: Callers should use equality.Semantic.DeepEqual directly.
+func SemanticDeepEqual[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
+
+// ReflectDeepEqual is a MatchFunc that uses reflect.DeepEqual to compare two
+// values.
+// This wrapper is needed because MatchFunc requires a function that takes two
+// arguments of specific type T, while reflect.DeepEqual takes arguments of
+// type interface{}/any. It can be used by any other function that needs to
+// call DeepEqual.
+func ReflectDeepEqual[T any](a, b T) bool {
+	return reflect.DeepEqual(a, b)
+}
+
+// DirectEqual is a MatchFunc that dereferences two pointers and uses the ==
+// operator to compare the values. If both pointers are nil, it returns true.
+// If one pointer is nil and the other is not, it returns false.
+// It can be used by any other function that needs to compare two pointees
+// directly.
+func DirectEqual[T comparable](a, b *T) bool {
+	if a == b {
+		return true
+	}
+	if a == nil || b == nil {
+		return false
+	}
+	return *a == *b
+}
+
+// PtrSliceNoNils returns a Required error for each nil element in a slice of
+// pointers.
+func PtrSliceNoNils[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, newSlice, _ []*T) (errs field.ErrorList) {
+	for i := range newSlice {
+		if newSlice[i] == nil {
+			errs = append(errs, field.Required(fldPath.Index(i), ""))
+		}
+	}
+	return
+}
+
+// PtrMapNoNils returns a Required error for each nil element in a map of
+// pointers.
+func PtrMapNoNils[K ~string, V any](_ context.Context, _ operation.Operation, fldPath *field.Path, newMap, _ map[K]*V) (errs field.ErrorList) {
+	for key, val := range newMap {
+		if val == nil {
+			errs = append(errs, field.Required(fldPath.Key(string(key)), ""))
+		}
+	}
+	return
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/each_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/each_test.go
new file mode 100644
index 0000000000..a8b73ae6fc
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/each_test.go
@@ -0,0 +1,846 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"slices"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+type TestStruct struct {
+	I int
+	D string
+}
+
+type TestStructWithKey struct {
+	Key string
+	I   int
+	D   string
+}
+
+type NonComparableKey struct {
+	I *int
+}
+
+type NonComparableStruct struct {
+	I int
+	S []string
+}
+
+type NonComparableStructWithKey struct {
+	Key string
+	I   int
+	S   []string
+}
+
+type NonComparableStructWithPtr struct {
+	I int
+	P *int
+}
+
+func TestEachValSliceVal(t *testing.T) {
+	testEachValSliceVal(t, "valid", []int{11, 12, 13})
+	testEachValSliceVal(t, "valid", []string{"a", "b", "c"})
+	testEachValSliceVal(t, "valid", []TestStruct{{11, "a"}, {12, "b"}, {13, "c"}})
+
+	testEachValSliceVal(t, "empty", []int{})
+	testEachValSliceVal(t, "empty", []string{})
+	testEachValSliceVal(t, "empty", []TestStruct{})
+
+	testEachValSliceVal[int](t, "nil", nil)
+	testEachValSliceVal[string](t, "nil", nil)
+	testEachValSliceVal[TestStruct](t, "nil", nil)
+
+	testEachValSliceValUpdate(t, "valid", []int{11, 12, 13})
+	testEachValSliceValUpdate(t, "valid", []string{"a", "b", "c"})
+	testEachValSliceValUpdate(t, "valid", []TestStruct{{11, "a"}, {12, "b"}, {13, "c"}})
+
+	testEachValSliceValUpdate(t, "empty", []int{})
+	testEachValSliceValUpdate(t, "empty", []string{})
+	testEachValSliceValUpdate(t, "empty", []TestStruct{})
+
+	testEachValSliceValUpdate[int](t, "nil", nil)
+	testEachValSliceValUpdate[string](t, "nil", nil)
+	testEachValSliceValUpdate[TestStruct](t, "nil", nil)
+}
+
+func testEachValSliceVal[T any](t *testing.T, name string, input []T) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			if oldVal != nil {
+				t.Errorf("expected nil oldVal, got %v", *oldVal)
+			}
+			calls++
+			return nil
+		}
+		_ = EachValSliceVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, nil, vfn)
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func testEachValSliceValUpdate[T any](t *testing.T, name string, input []T) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			if oldVal == nil {
+				t.Fatalf("expected non-nil oldVal")
+			}
+			if !reflect.DeepEqual(*newVal, *oldVal) {
+				t.Errorf("expected oldVal == newVal, got %v, %v", *oldVal, *newVal)
+			}
+			calls++
+			return nil
+		}
+		old := make([]T, len(input))
+		copy(old, input)
+		slices.Reverse(old)
+		match := func(a, b *T) bool { return reflect.DeepEqual(*a, *b) }
+		_ = EachValSliceVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, old, match, match, vfn)
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func TestEachValSliceValRatcheting(t *testing.T) {
+	testEachValSliceValRatcheting(t, "ComparableStruct same data different order",
+		[]TestStruct{
+			{11, "a"}, {12, "b"}, {13, "c"},
+		},
+		[]TestStruct{
+			{11, "a"}, {13, "c"}, {12, "b"},
+		},
+		ReflectDeepEqual,
+		nil,
+	)
+	testEachValSliceValRatcheting(t, "ComparableStruct less data in new, exist in old",
+		[]TestStruct{
+			{11, "a"}, {12, "b"}, {13, "c"},
+		},
+		[]TestStruct{
+			{11, "a"}, {13, "c"},
+		},
+		DirectEqual,
+		nil,
+	)
+	testEachValSliceValRatcheting(t, "Comparable struct with key same data different order",
+		[]TestStructWithKey{
+			{Key: "a", I: 11, D: "a"}, {Key: "b", I: 12, D: "b"}, {Key: "c", I: 13, D: "c"},
+		},
+		[]TestStructWithKey{
+			{Key: "a", I: 11, D: "a"}, {Key: "c", I: 13, D: "c"}, {Key: "b", I: 12, D: "b"},
+		},
+		MatchFunc[*TestStructWithKey](func(a, b *TestStructWithKey) bool {
+			return a.Key == b.Key
+		}),
+		DirectEqual,
+	)
+	testEachValSliceValRatcheting(t, "Comparable struct with key less data in new, exist in old",
+		[]TestStructWithKey{
+			{Key: "a", I: 11, D: "a"}, {Key: "b", I: 12, D: "b"}, {Key: "c", I: 13, D: "c"},
+		},
+		[]TestStructWithKey{
+			{Key: "a", I: 11, D: "a"}, {Key: "c", I: 13, D: "c"},
+		},
+		MatchFunc[*TestStructWithKey](func(a, b *TestStructWithKey) bool {
+			return a.Key == b.Key
+		}),
+		DirectEqual,
+	)
+	testEachValSliceValRatcheting(t, "NonComparableStruct same data different order",
+		[]NonComparableStruct{
+			{I: 11, S: []string{"a"}}, {I: 12, S: []string{"b"}}, {I: 13, S: []string{"c"}},
+		},
+		[]NonComparableStruct{
+			{I: 11, S: []string{"a"}}, {I: 13, S: []string{"c"}}, {I: 12, S: []string{"b"}},
+		},
+		ReflectDeepEqual,
+		nil,
+	)
+	testEachValSliceValRatcheting(t, "NonComparableStructWithKey same data different order",
+		[]NonComparableStructWithKey{
+			{Key: "a", I: 11, S: []string{"a"}}, {Key: "b", I: 12, S: []string{"b"}}, {Key: "c", I: 13, S: []string{"c"}},
+		},
+		[]NonComparableStructWithKey{
+			{Key: "a", I: 11, S: []string{"a"}}, {Key: "b", I: 12, S: []string{"b"}}, {Key: "c", I: 13, S: []string{"c"}},
+		},
+		MatchFunc[*NonComparableStructWithKey](func(a, b *NonComparableStructWithKey) bool {
+			return a.Key == b.Key
+		}),
+		ReflectDeepEqual,
+	)
+
+}
+
+func testEachValSliceValRatcheting[T any](t *testing.T, name string, old, new []T, match, equiv MatchFunc[*T]) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			return field.ErrorList{field.Invalid(fldPath, *newVal, "expected no calls")}
+		}
+		errs := EachValSliceVal(context.Background(), operation.Operation{Type: operation.Update}, field.NewPath("test"), new, old, match, equiv, vfn)
+		if len(errs) > 0 {
+			t.Errorf("expected no errors, got %d: %s", len(errs), fmtErrs(errs))
+		}
+	})
+}
+
+func TestEachMapVal(t *testing.T) {
+	testEachMapVal(t, "valid", map[string]int{"one": 11, "two": 12, "three": 13})
+	testEachMapVal(t, "valid", map[string]string{"A": "a", "B": "b", "C": "c"})
+	testEachMapVal(t, "valid", map[string]TestStruct{"one": {11, "a"}, "two": {12, "b"}, "three": {13, "c"}})
+
+	testEachMapVal(t, "empty", map[string]int{})
+	testEachMapVal(t, "empty", map[string]string{})
+	testEachMapVal(t, "empty", map[string]TestStruct{})
+
+	testEachMapVal[int](t, "nil", nil)
+	testEachMapVal[string](t, "nil", nil)
+	testEachMapVal[TestStruct](t, "nil", nil)
+}
+
+func testEachMapVal[T any](t *testing.T, name string, input map[string]T) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			if oldVal != nil {
+				t.Errorf("expected nil oldVal, got %v", *oldVal)
+			}
+			calls++
+			return nil
+		}
+		_ = EachMapVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, vfn)
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func TestEachMapValRatcheting(t *testing.T) {
+	testEachMapValRatcheting(t, "primitive same data",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13, "two": 12},
+		DirectEqual,
+		0,
+	)
+	testEachMapValRatcheting(t, "primitive less data in new, exist in old",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13},
+		DirectEqual,
+		0,
+	)
+	testEachMapValRatcheting(t, "primitive new data, not exist in old",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13, "two": 12, "four": 14},
+		DirectEqual,
+		1,
+	)
+	testEachMapValRatcheting(t, "non comparable value, same data",
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"three": {I: 13, S: []string{"c"}},
+			"two":   {I: 12, S: []string{"b"}},
+		},
+		ReflectDeepEqual,
+		0,
+	)
+	testEachMapValRatcheting(t, "non comparable value, less data in new, exist in old",
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		ReflectDeepEqual,
+		0,
+	)
+	testEachMapValRatcheting(t, "non comparable value, new data, not exist in old",
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"three": {I: 13, S: []string{"c"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"four":  {I: 14, S: []string{"d"}},
+		},
+		ReflectDeepEqual,
+		1,
+	)
+	testEachMapValRatcheting(t, "struct with pointer field, same value different pointer",
+		map[string]NonComparableStructWithPtr{
+			"one": {I: 11, P: new(1)},
+			"two": {I: 12, P: new(2)},
+		},
+		map[string]NonComparableStructWithPtr{
+			"one": {I: 11, P: new(1)},
+			"two": {I: 12, P: new(2)},
+		},
+		ReflectDeepEqual,
+		0,
+	)
+	testEachMapValRatcheting(t, "nil map to empty map",
+		nil,
+		map[string]int{},
+		DirectEqual,
+		0,
+	)
+
+	testEachMapValRatcheting(t, "nil map to non-empty map",
+		nil,
+		map[string]int{"one": 1},
+		DirectEqual,
+		1, // Expect validation for new entry
+	)
+
+	testEachMapValRatcheting(t, "empty map to nil map",
+		map[string]int{},
+		nil,
+		DirectEqual,
+		0,
+	)
+
+	testEachMapValRatcheting(t, "non-empty map to nil map",
+		map[string]int{"one": 1},
+		nil,
+		DirectEqual,
+		0,
+	)
+}
+
+func testEachMapValRatcheting[K ~string, V any](t *testing.T, name string, old, new map[K]V, equiv MatchFunc[*V], wantCalls int) {
+	t.Helper()
+	var zero V
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *V) field.ErrorList {
+			calls++
+			return nil
+		}
+		_ = EachMapVal(context.Background(), operation.Operation{Type: operation.Update}, field.NewPath("test"), new, old, equiv, vfn)
+		if calls != wantCalls {
+			t.Errorf("expected %d calls, got %d", wantCalls, calls)
+		}
+	})
+}
+
+func TestEachPtrMapVal(t *testing.T) {
+	testEachPtrMapVal(t, "valid", map[string]*int{"one": new(11), "two": new(12), "three": new(13)})
+	testEachPtrMapVal(t, "valid", map[string]*string{"A": new("a"), "B": new("b"), "C": new("c")})
+	testEachPtrMapVal(t, "valid", map[string]*TestStruct{"one": {11, "a"}, "two": {12, "b"}, "three": {13, "c"}})
+
+	testEachPtrMapVal(t, "empty", map[string]*int{})
+	testEachPtrMapVal(t, "empty", map[string]*string{})
+	testEachPtrMapVal(t, "empty", map[string]*TestStruct{})
+
+	testEachPtrMapVal[int](t, "nil", nil)
+	testEachPtrMapVal[string](t, "nil", nil)
+	testEachPtrMapVal[TestStruct](t, "nil", nil)
+
+	t.Run("nil element ignored", func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *int) field.ErrorList {
+			calls++
+			return nil
+		}
+		input := map[string]*int{"a": new(1), "b": nil, "c": new(3)}
+		errs := EachPtrMapVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, vfn)
+		if len(errs) != 0 {
+			t.Errorf("expected 0 errors, got %d: %v", len(errs), errs)
+		}
+		if calls != 2 {
+			t.Errorf("expected 2 calls, got %d", calls)
+		}
+	})
+}
+
+func testEachPtrMapVal[T any](t *testing.T, name string, input map[string]*T) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(*%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			if oldVal != nil {
+				t.Errorf("expected nil oldVal, got %v", *oldVal)
+			}
+			calls++
+			return nil
+		}
+		errs := EachPtrMapVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, vfn)
+		if len(errs) != 0 {
+			t.Errorf("expected 0 errors, got %d: %v", len(errs), errs)
+		}
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func TestEachPtrMapValRatcheting(t *testing.T) {
+	testEachPtrMapValRatcheting(t, "primitive same data",
+		map[string]*int{"one": new(11), "two": new(12), "three": new(13)},
+		map[string]*int{"one": new(11), "three": new(13), "two": new(12)},
+		DirectEqual,
+		0,
+	)
+	testEachPtrMapValRatcheting(t, "primitive less data in new, exist in old",
+		map[string]*int{"one": new(11), "two": new(12), "three": new(13)},
+		map[string]*int{"one": new(11), "three": new(13)},
+		DirectEqual,
+		0,
+	)
+	testEachPtrMapValRatcheting(t, "primitive new data, not exist in old",
+		map[string]*int{"one": new(11), "two": new(12)},
+		map[string]*int{"one": new(11), "two": new(12), "three": new(13)},
+		DirectEqual,
+		1,
+	)
+	testEachPtrMapValRatcheting(t, "non comparable value, same data",
+		map[string]*NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		map[string]*NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"three": {I: 13, S: []string{"c"}},
+			"two":   {I: 12, S: []string{"b"}},
+		},
+		ReflectDeepEqual,
+		0,
+	)
+	testEachPtrMapValRatcheting(t, "non comparable value, less data in new, exist in old",
+		map[string]*NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		map[string]*NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		ReflectDeepEqual,
+		0,
+	)
+	testEachPtrMapValRatcheting(t, "non comparable value, new data, not exist in old",
+		map[string]*NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		map[string]*NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"three": {I: 13, S: []string{"c"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"four":  {I: 14, S: []string{"d"}},
+		},
+		ReflectDeepEqual,
+		1,
+	)
+	testEachPtrMapValRatcheting(t, "struct with pointer field, same value different pointer",
+		map[string]*NonComparableStructWithPtr{
+			"one": {I: 11, P: new(1)},
+			"two": {I: 12, P: new(2)},
+		},
+		map[string]*NonComparableStructWithPtr{
+			"one": {I: 11, P: new(1)},
+			"two": {I: 12, P: new(2)},
+		},
+		ReflectDeepEqual,
+		0,
+	)
+	testEachPtrMapValRatcheting(t, "nil map to empty map",
+		nil,
+		map[string]*int{},
+		DirectEqual,
+		0,
+	)
+	testEachPtrMapValRatcheting(t, "nil map to non-empty map",
+		nil,
+		map[string]*int{"one": new(1)},
+		DirectEqual,
+		1,
+	)
+	testEachPtrMapValRatcheting(t, "empty map to nil map",
+		map[string]*int{},
+		nil,
+		DirectEqual,
+		0,
+	)
+	testEachPtrMapValRatcheting(t, "non-empty map to nil map",
+		map[string]*int{"one": new(1)},
+		nil,
+		DirectEqual,
+		0,
+	)
+}
+
+func testEachPtrMapValRatcheting[K ~string, V any](t *testing.T, name string, old, new map[K]*V, equiv MatchFunc[*V], wantCalls int) {
+	t.Helper()
+	var zero V
+	t.Run(fmt.Sprintf("%s(*%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *V) field.ErrorList {
+			calls++
+			return nil
+		}
+		_ = EachPtrMapVal(context.Background(), operation.Operation{Type: operation.Update}, field.NewPath("test"), new, old, equiv, vfn)
+		if calls != wantCalls {
+			t.Errorf("expected %d calls, got %d", wantCalls, calls)
+		}
+	})
+}
+
+type StringType string
+
+func TestEachMapKey(t *testing.T) {
+	testEachMapKey(t, "valid", map[string]int{"one": 11, "two": 12, "three": 13})
+	testEachMapKey(t, "valid", map[StringType]string{"A": "a", "B": "b", "C": "c"})
+}
+
+func testEachMapKey[K ~string, V any](t *testing.T, name string, input map[K]V) {
+	t.Helper()
+	var zero K
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *K) field.ErrorList {
+			if oldVal != nil {
+				t.Errorf("expected nil oldVal, got %v", *oldVal)
+			}
+			calls++
+			return nil
+		}
+		_ = EachMapKey(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, vfn)
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func TestEachMapKeyRatcheting(t *testing.T) {
+	testEachMapKeyRatcheting(t, "same data, 0 validation calls",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13, "two": 12},
+		0,
+	)
+	testEachMapKeyRatcheting(t, "less data in new, exist in old, 0 validation calls",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13},
+		0,
+	)
+	testEachMapKeyRatcheting(t, "new data, not exist in old, 1 validation call",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13, "two": 12, "four": 14},
+		1,
+	)
+}
+
+func testEachMapKeyRatcheting[K ~string, V any](t *testing.T, name string, old, new map[K]V, wantCalls int) {
+	t.Helper()
+	var zero V
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *K) field.ErrorList {
+			calls++
+			return nil
+		}
+		_ = EachMapKey(context.Background(), operation.Operation{Type: operation.Update}, field.NewPath("test"), new, old, vfn)
+		if calls != wantCalls {
+			t.Errorf("expected %d calls, got %d", wantCalls, calls)
+		}
+	})
+}
+
+func TestValSliceUniqueComparableValues(t *testing.T) {
+	testValSliceUnique(t, "int_nil", []int(nil), 0)
+	testValSliceUnique(t, "int_empty", []int{}, 0)
+	testValSliceUnique(t, "int_uniq", []int{1, 2, 3}, 0)
+	testValSliceUnique(t, "int_dup", []int{1, 2, 3, 2, 1}, 2)
+
+	testValSliceUnique(t, "string_nil", []string(nil), 0)
+	testValSliceUnique(t, "string_empty", []string{}, 0)
+	testValSliceUnique(t, "string_uniq", []string{"a", "b", "c"}, 0)
+	testValSliceUnique(t, "string_dup", []string{"a", "a", "c", "b", "a"}, 2)
+
+	type isComparable struct {
+		I int
+		S string
+	}
+
+	testValSliceUnique(t, "struct_nil", []isComparable(nil), 0)
+	testValSliceUnique(t, "struct_empty", []isComparable{}, 0)
+	testValSliceUnique(t, "struct_uniq", []isComparable{{1, "a"}, {2, "b"}, {3, "c"}}, 0)
+	testValSliceUnique(t, "struct_dup", []isComparable{{1, "a"}, {2, "b"}, {3, "c"}, {2, "b"}, {1, "a"}}, 2)
+}
+
+func testValSliceUnique[T comparable](t *testing.T, name string, input []T, wantErrs int) {
+	t.Helper()
+	t.Run(fmt.Sprintf("%s(direct)", name), func(t *testing.T) {
+		errs := ValSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, DirectEqual)
+		if len(errs) != wantErrs {
+			t.Errorf("expected %d errors, got %d: %s", wantErrs, len(errs), fmtErrs(errs))
+		}
+	})
+	t.Run(fmt.Sprintf("%s(reflect)", name), func(t *testing.T) {
+		errs := ValSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, ReflectDeepEqual)
+		if len(errs) != wantErrs {
+			t.Errorf("expected %d errors, got %d: %s", wantErrs, len(errs), fmtErrs(errs))
+		}
+	})
+}
+
+func TestValSliceUniqueNonComparableValues(t *testing.T) {
+	type nonComparable struct {
+		I int
+		S []string
+	}
+
+	testValSliceUniqueByReflect(t, "noncomp_nil", []nonComparable(nil), 0)
+	testValSliceUniqueByReflect(t, "noncomp_empty", []nonComparable{}, 0)
+	testValSliceUniqueByReflect(t, "noncomp_uniq", []nonComparable{{1, []string{"a"}}, {2, []string{"b"}}, {3, []string{"c"}}}, 0)
+	testValSliceUniqueByReflect(t, "noncomp_dup", []nonComparable{
+		{1, []string{"a"}},
+		{2, []string{"b"}},
+		{3, []string{"c"}},
+		{2, []string{"b"}},
+		{1, []string{"a"}}}, 2)
+}
+
+func testValSliceUniqueByReflect[T any](t *testing.T, name string, input []T, wantErrs int) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		errs := ValSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, ReflectDeepEqual)
+		if len(errs) != wantErrs {
+			t.Errorf("expected %d errors, got %d: %s", wantErrs, len(errs), fmtErrs(errs))
+		}
+	})
+}
+
+func TestEachPtrSliceVal(t *testing.T) {
+	testEachPtrSliceVal(t, "valid", []*int{new(11), new(12), new(13)})
+	testEachPtrSliceVal(t, "valid", []*string{new("a"), new("b"), new("c")})
+	testEachPtrSliceVal(t, "valid", []*TestStruct{{11, "a"}, {12, "b"}, {13, "c"}})
+
+	testEachPtrSliceVal(t, "empty", []*int{})
+	testEachPtrSliceVal[int](t, "nil", nil)
+
+	// Test nil elements
+	t.Run("nil elements", func(t *testing.T) {
+		input := []*int{new(11), nil, new(13)}
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *int) field.ErrorList {
+			calls++
+			return nil
+		}
+		errs := EachPtrSliceVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, nil, vfn)
+		if len(errs) != 0 {
+			t.Errorf("expected 0 errors, got %d", len(errs))
+		}
+		if calls != 2 {
+			t.Errorf("expected 2 calls, got %d", calls)
+		}
+	})
+
+	testEachPtrSliceValUpdate(t, "valid", []*int{new(11), new(12), new(13)})
+}
+
+func testEachPtrSliceVal[T any](t *testing.T, name string, input []*T) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(*%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			if oldVal != nil {
+				t.Errorf("expected nil oldVal, got %v", *oldVal)
+			}
+			calls++
+			return nil
+		}
+		errs := EachPtrSliceVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, nil, vfn)
+		if len(errs) != 0 {
+			t.Errorf("expected 0 errors, got %d: %v", len(errs), errs)
+		}
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func testEachPtrSliceValUpdate[T any](t *testing.T, name string, input []*T) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(*%T) update", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			if oldVal == nil {
+				t.Fatalf("expected non-nil oldVal")
+			}
+			if !reflect.DeepEqual(*newVal, *oldVal) {
+				t.Errorf("expected oldVal == newVal, got %v, %v", *oldVal, *newVal)
+			}
+			calls++
+			return nil
+		}
+		old := make([]*T, len(input))
+		copy(old, input)
+		slices.Reverse(old)
+		match := func(a, b *T) bool { return reflect.DeepEqual(*a, *b) }
+		errs := EachPtrSliceVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, old, match, match, vfn)
+		if len(errs) != 0 {
+			t.Errorf("expected 0 errors, got %d: %v", len(errs), errs)
+		}
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func TestEachPtrSliceValRatcheting(t *testing.T) {
+	testEachPtrSliceValRatcheting(t, "ComparableStruct same data different order",
+		[]*TestStruct{{11, "a"}, {12, "b"}, {13, "c"}},
+		[]*TestStruct{{11, "a"}, {13, "c"}, {12, "b"}},
+		ReflectDeepEqual,
+		nil,
+	)
+}
+
+func testEachPtrSliceValRatcheting[T any](t *testing.T, name string, old, new []*T, match, equiv MatchFunc[*T]) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(*%T)", name, zero), func(t *testing.T) {
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			return field.ErrorList{field.Invalid(fldPath, *newVal, "expected no calls")}
+		}
+		errs := EachPtrSliceVal(context.Background(), operation.Operation{Type: operation.Update}, field.NewPath("test"), new, old, match, equiv, vfn)
+		if len(errs) != 0 {
+			t.Errorf("expected 0 errors, got %d: %v", len(errs), errs)
+		}
+	})
+}
+
+func TestPtrSliceUnique(t *testing.T) {
+	testPtrSliceUnique(t, "int_nil", []*int(nil), 0, 0)
+	testPtrSliceUnique(t, "int_empty", []*int{}, 0, 0)
+	testPtrSliceUnique(t, "int_uniq", []*int{new(1), new(2), new(3)}, 0, 0)
+	testPtrSliceUnique(t, "int_dup", []*int{new(1), new(2), new(3), new(2), new(1)}, 2, 0)
+	testPtrSliceUnique(t, "int_nil_element", []*int{new(1), nil, new(3), nil}, 0, 0)
+	testPtrSliceUnique(t, "int_dup_and_nil", []*int{new(1), nil, new(1), nil}, 1, 0)
+}
+
+func testPtrSliceUnique[T comparable](t *testing.T, name string, input []*T, wantDupErrs, wantReqErrs int) {
+	t.Helper()
+	t.Run(fmt.Sprintf("%s(direct)", name), func(t *testing.T) {
+		errs := PtrSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, DirectEqual)
+		gotDup, gotReq := countErrors(errs)
+		if gotDup != wantDupErrs || gotReq != wantReqErrs {
+			t.Errorf("expected %d dup, %d req errors; got %d dup, %d req: %s", wantDupErrs, wantReqErrs, gotDup, gotReq, fmtErrs(errs))
+		}
+	})
+}
+
+func countErrors(errs field.ErrorList) (dup, req int) {
+	for _, err := range errs {
+		switch err.Type {
+		case field.ErrorTypeDuplicate:
+			dup++
+		case field.ErrorTypeRequired:
+			req++
+		}
+	}
+	return
+}
+
+func TestPtrSliceNoNils(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    []*int
+		wantErrs int
+	}{
+		{"nil", nil, 0},
+		{"empty", []*int{}, 0},
+		{"no_nil", []*int{new(1), new(2)}, 0},
+		{"has_nil", []*int{new(1), nil, new(3), nil}, 2},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			errs := PtrSliceNoNils(context.Background(), operation.Operation{}, field.NewPath("test"), tt.input, nil)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("expected %d errors, got %d: %v", tt.wantErrs, len(errs), errs)
+			}
+			for _, err := range errs {
+				if err.Type != field.ErrorTypeRequired {
+					t.Errorf("expected Required error, got %v", err.Type)
+				}
+			}
+		})
+	}
+}
+
+func TestPtrMapNoNils(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    map[string]*int
+		wantErrs int
+	}{
+		{"nil", nil, 0},
+		{"empty", map[string]*int{}, 0},
+		{"no_nil", map[string]*int{"a": new(1), "b": new(2)}, 0},
+		{"has_nil", map[string]*int{"a": new(1), "b": nil, "c": new(3), "d": nil}, 2},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			errs := PtrMapNoNils(context.Background(), operation.Operation{}, field.NewPath("test"), tt.input, nil)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("expected %d errors, got %d: %v", tt.wantErrs, len(errs), errs)
+			}
+			for _, err := range errs {
+				if err.Type != field.ErrorTypeRequired {
+					t.Errorf("expected Required error, got %v", err.Type)
+				}
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/enum.go b/third_party/k8s.io/apimachinery/pkg/api/validate/enum.go
new file mode 100644
index 0000000000..4d8e2c0aa8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/enum.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"slices"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Enum verifies that a given value is a member of a set of enum values.
+// Exclude Rules that apply when options are enabled or disabled are also considered.
+// If ANY exclude rule matches for a value, that value is excluded from the enum when validating.
+func Enum[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T, validValues sets.Set[T], exclusions []EnumExclusion[T]) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	excluded, err := isExcluded(op, exclusions, *value)
+	if err != nil {
+		return field.ErrorList{field.InternalError(fldPath, err)}
+	}
+	if !validValues.Has(*value) || excluded {
+		supported, err := supportedValues(op, validValues, exclusions)
+		if err != nil {
+			return field.ErrorList{field.InternalError(fldPath, err)}
+		}
+		return field.ErrorList{field.NotSupported[T](fldPath, *value, supported)}
+	}
+	return nil
+}
+
+// supportedValues returns a sorted list of supported values.
+// Excluded enum values are not included in the list.
+func supportedValues[T ~string](op operation.Operation, values sets.Set[T], exclusions []EnumExclusion[T]) ([]T, error) {
+	res := make([]T, 0, len(values))
+	for key := range values {
+		excluded, err := isExcluded(op, exclusions, key)
+		if err != nil {
+			return nil, err
+		}
+		if excluded {
+			continue
+		}
+		res = append(res, key)
+	}
+	slices.Sort(res)
+	return res, nil
+}
+
+// EnumExclusion represents a single enum exclusion rule.
+type EnumExclusion[T ~string] struct {
+	// Value specifies the enum value to be conditionally excluded.
+	Value T
+	// ExcludeWhen determines the condition for exclusion.
+	// If true, the value is excluded if the option is present.
+	// If false, the value is excluded if the option is NOT present.
+	ExcludeWhen bool
+	// Option is the name of the feature option that controls the exclusion.
+	Option string
+}
+
+func isExcluded[T ~string](op operation.Operation, exclusions []EnumExclusion[T], value T) (bool, error) {
+	for _, rule := range exclusions {
+		on, defined := op.HasOption(rule.Option)
+		if !defined {
+			return false, fmt.Errorf("undefined validation option %q", rule.Option)
+		}
+		if rule.Value == value && rule.ExcludeWhen == on {
+			return true, nil
+		}
+	}
+	return false, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/enum_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/enum_test.go
new file mode 100644
index 0000000000..523cbabba4
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/enum_test.go
@@ -0,0 +1,241 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestEnum(t *testing.T) {
+	cases := []struct {
+		name      string
+		value     string
+		valid     sets.Set[string]
+		expectErr string
+	}{{
+		name:      "valid value",
+		value:     "a",
+		valid:     sets.New("a", "b", "c"),
+		expectErr: "",
+	}, {
+		name:      "invalid value",
+		value:     "x",
+		valid:     sets.New("a", "b", "c"),
+		expectErr: `fldpath: Unsupported value: "x": supported values: "a", "b", "c"`,
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			op := operation.Operation{Type: operation.Create}
+			errs := Enum(context.Background(), op, field.NewPath("fldpath"), &tc.value, nil, tc.valid, nil)
+
+			if tc.expectErr == "" {
+				if len(errs) > 0 {
+					t.Fatalf("expected no error, but got: %v", errs)
+				}
+			} else {
+				if len(errs) == 0 {
+					t.Fatal("expected an error, but got none")
+				}
+				if len(errs) > 1 {
+					t.Fatalf("expected a single error, but got: %v", errs)
+				}
+				if errs[0].Error() != tc.expectErr {
+					t.Errorf("expected error %q, but got %q", tc.expectErr, errs[0].Error())
+				}
+			}
+		})
+	}
+}
+
+func TestEnumTypedef(t *testing.T) {
+	type StringType string
+	const (
+		NotStringFoo StringType = "foo"
+		NotStringBar StringType = "bar"
+		NotStringQux StringType = "qux"
+	)
+
+	cases := []struct {
+		name      string
+		value     StringType
+		valid     sets.Set[StringType]
+		expectErr string
+	}{{
+		name:      "valid value",
+		value:     "foo",
+		valid:     sets.New(NotStringFoo, NotStringBar, NotStringQux),
+		expectErr: "",
+	}, {
+		name:      "invalid value",
+		value:     "x",
+		valid:     sets.New(NotStringFoo, NotStringBar, NotStringQux),
+		expectErr: `fldpath: Unsupported value: "x": supported values: "bar", "foo", "qux"`,
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			op := operation.Operation{Type: operation.Create}
+			errs := Enum(context.Background(), op, field.NewPath("fldpath"), &tc.value, nil, tc.valid, nil)
+
+			if tc.expectErr == "" {
+				if len(errs) > 0 {
+					t.Fatalf("expected no error, but got: %v", errs)
+				}
+			} else {
+				if len(errs) == 0 {
+					t.Fatal("expected an error, but got none")
+				}
+				if len(errs) > 1 {
+					t.Fatalf("expected a single error, but got: %v", errs)
+				}
+				if errs[0].Error() != tc.expectErr {
+					t.Errorf("expected error %q, but got %q", tc.expectErr, errs[0].Error())
+				}
+			}
+		})
+	}
+}
+
+func TestEnumExclude(t *testing.T) {
+	type TestEnum string
+	const (
+		ValueA TestEnum = "A"
+		ValueB TestEnum = "B"
+		ValueC TestEnum = "C"
+		ValueD TestEnum = "D"
+	)
+
+	const (
+		FeatureA = "FeatureA"
+		FeatureB = "FeatureB"
+	)
+
+	testEnumValues := sets.New(ValueA, ValueB, ValueC, ValueD)
+	testEnumExclusions := []EnumExclusion[TestEnum]{
+		{Value: ValueA, Option: FeatureA, ExcludeWhen: true},
+		{Value: ValueB, Option: FeatureB, ExcludeWhen: false},
+		{Value: ValueD, Option: FeatureA, ExcludeWhen: true},
+		{Value: ValueD, Option: FeatureB, ExcludeWhen: false},
+	}
+
+	testCases := []struct {
+		name           string
+		value          TestEnum
+		opts           map[string]bool
+		expectInternal bool
+		expectErr      string
+	}{
+		{
+			name:  "no options, A is valid",
+			value: ValueA,
+			opts:  map[string]bool{FeatureA: false, FeatureB: false},
+		},
+		{
+			name:      "no options, B is invalid",
+			value:     ValueB,
+			opts:      map[string]bool{FeatureA: false, FeatureB: false},
+			expectErr: `fld: Unsupported value: "B": supported values: "A", "C"`,
+		},
+		{
+			name:      "no options, D is invalid",
+			value:     ValueD,
+			opts:      map[string]bool{FeatureA: false, FeatureB: false},
+			expectErr: `fld: Unsupported value: "D": supported values: "A", "C"`,
+		},
+		{
+			name:      "FeatureA enabled, A is invalid",
+			value:     ValueA,
+			opts:      map[string]bool{FeatureA: true, FeatureB: false},
+			expectErr: `fld: Unsupported value: "A": supported values: "C"`,
+		},
+		{
+			name:      "FeatureA enabled, B is invalid",
+			value:     ValueB,
+			opts:      map[string]bool{FeatureA: true, FeatureB: false},
+			expectErr: `fld: Unsupported value: "B": supported values: "C"`,
+		},
+		{
+			name:  "FeatureB enabled, A is valid",
+			value: ValueA,
+			opts:  map[string]bool{FeatureA: false, FeatureB: true},
+		},
+		{
+			name:  "FeatureB enabled, B is valid",
+			value: ValueB,
+			opts:  map[string]bool{FeatureA: false, FeatureB: true},
+		},
+		{
+			name:      "FeatureA and FeatureB enabled, A is invalid",
+			value:     ValueA,
+			opts:      map[string]bool{FeatureA: true, FeatureB: true},
+			expectErr: `fld: Unsupported value: "A": supported values: "B", "C"`,
+		},
+		{
+			name:  "FeatureA and FeatureB enabled, B is valid",
+			value: ValueB,
+			opts:  map[string]bool{FeatureA: true, FeatureB: true},
+		},
+		{
+			name:      "FeatureA and FeatureB enabled, D is invalid",
+			value:     ValueD,
+			opts:      map[string]bool{FeatureA: true, FeatureB: true},
+			expectErr: `fld: Unsupported value: "D": supported values: "B", "C"`,
+		},
+		{
+			name:           "undeclared option is an internal error",
+			value:          ValueB,
+			opts:           map[string]bool{FeatureA: false},
+			expectInternal: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			op := operation.Operation{Type: operation.Create, Options: tc.opts}
+			errs := Enum(context.Background(), op, field.NewPath("fld"), &tc.value, nil, testEnumValues, testEnumExclusions)
+
+			if tc.expectInternal {
+				if len(errs) != 1 || errs[0].Type != field.ErrorTypeInternal {
+					t.Fatalf("expected a single internal error, but got: %v", errs)
+				}
+				return
+			}
+
+			if tc.expectErr == "" {
+				if len(errs) > 0 {
+					t.Fatalf("expected no error, but got: %v", errs)
+				}
+			} else {
+				if len(errs) == 0 {
+					t.Fatal("expected an error, but got none")
+				}
+				if len(errs) > 1 {
+					t.Fatalf("expected a single error, but got: %v", errs)
+				}
+				if errs[0].Error() != tc.expectErr {
+					t.Errorf("expected error %q, but got %q", tc.expectErr, errs[0].Error())
+				}
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/equality.go b/third_party/k8s.io/apimachinery/pkg/api/validate/equality.go
new file mode 100644
index 0000000000..12e99d0ec4
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/equality.go
@@ -0,0 +1,38 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/content"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// NEQ validates that the specified comparable value is not equal to the disallowed value.
+func NEQ[T comparable](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, disallowed T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	if *value == disallowed {
+		return field.ErrorList{
+			field.Invalid(fldPath, *value, content.NEQError(disallowed)).WithOrigin("neq"),
+		}
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/errors.go b/third_party/k8s.io/apimachinery/pkg/api/validate/errors.go
new file mode 100644
index 0000000000..a9dc4b01c0
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/errors.go
@@ -0,0 +1,96 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"errors"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+type allDeclarativeEnforcedKeyType struct{}
+
+var allDeclarativeEnforcedKey = allDeclarativeEnforcedKeyType{}
+
+// WithAllDeclarativeEnforcedForTest returns a copy of parent context with allDeclarativeEnforcedKey set to true.
+// This is used for testing to expose all declarative validation errors and filter all handwritten validation errors
+// that are covered by declarative validation, regardless of the feature gate or maturity level.
+//
+// NOTE: This function is intended for testing purposes only and should not be used in production code.
+func WithAllDeclarativeEnforcedForTest(ctx context.Context) context.Context {
+	return context.WithValue(ctx, allDeclarativeEnforcedKey, true)
+}
+
+// AllDeclarativeEnforced returns true if the context contains allDeclarativeEnforcedKey set to true.
+func AllDeclarativeEnforced(ctx context.Context) bool {
+	if ctx == nil {
+		return false
+	}
+	return ctx.Value(allDeclarativeEnforcedKey) == true
+}
+
+// FilterCoveredHandwrittenErrors removes a CoveredByDeclarative handwritten error when a matching enforced
+// beta declarative error exists (matched by type, field, and origin). In AllDeclarativeEnforced
+// (testing-only) mode every covered handwritten error is removed.
+func FilterCoveredHandwrittenErrors(ctx context.Context, imperativeErrs, enforcedDeclarativeErrs field.ErrorList, betaEnabled bool, rules ...field.NormalizationRule) field.ErrorList {
+	matcher := field.ErrorMatcher{}.ByType().ByOrigin().RequireOriginWhenInvalid().ByFieldNormalized(rules)
+	allDeclarativeEnforced := AllDeclarativeEnforced(ctx)
+	return imperativeErrs.Filter(func(e error) bool {
+		var fe *field.Error
+		if !errors.As(e, &fe) || !fe.CoveredByDeclarative {
+			return false
+		}
+		if allDeclarativeEnforced {
+			return true
+		}
+		for _, dErr := range enforcedDeclarativeErrs {
+			if dErr.IsBeta() && matcher.Matches(fe, dErr) {
+				return true
+			}
+		}
+		return false
+	})
+}
+
+// FilterEnforcedDeclarativeErrors collects the declarative errors that are enforced (i.e. surfaced to the user) in the
+// current mode. A declarative error is enforced when any of the following holds:
+//   - AllDeclarativeEnforced is set (testing): every declarative error is enforced.
+//   - It is an internal error: always enforced, regardless of lifecycle.
+//   - It is a beta error and BetaEnabled is true.
+//   - It is a standard (unprefixed) error: always enforced.
+//
+// Alpha errors are never enforced; they remain shadowed by handwritten validation.
+func FilterEnforcedDeclarativeErrors(ctx context.Context, declarativeErrs field.ErrorList, betaEnabled bool) field.ErrorList {
+	enforcedDeclarativeErrs := make(field.ErrorList, 0, len(declarativeErrs))
+	allDeclarativeEnforced := AllDeclarativeEnforced(ctx)
+	for _, dvErr := range declarativeErrs {
+		switch {
+		case allDeclarativeEnforced:
+			enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr)
+		case dvErr.Type == field.ErrorTypeInternal:
+			enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr)
+		case dvErr.IsBeta():
+			if betaEnabled {
+				enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr)
+			}
+		case !dvErr.IsAlpha():
+			enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr) // Standard
+		}
+	}
+	return enforcedDeclarativeErrs
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/errors_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/errors_test.go
new file mode 100644
index 0000000000..a90f21898b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/errors_test.go
@@ -0,0 +1,139 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestFilterCoveredHandwrittenErrors(t *testing.T) {
+	originRule := "test-origin"
+
+	handwrittenCovered := field.Invalid(field.NewPath("spec", "name"), "invalid-value", "must be valid").WithOrigin(originRule).MarkCoveredByDeclarative()
+
+	handwrittenNotCovered := field.Invalid(field.NewPath("spec", "name"), "invalid-value", "must be valid").WithOrigin(originRule)
+
+	matchingBetaDeclarative := field.Invalid(field.NewPath("spec", "name"), "invalid-value", "must be valid").WithOrigin(originRule).MarkBeta()
+
+	matchingAlphaDeclarative := field.Invalid(field.NewPath("spec", "name"), "invalid-value", "must be valid").WithOrigin(originRule).MarkAlpha()
+
+	tests := []struct {
+		name                   string
+		errs                   field.ErrorList
+		enforcedDeclarative    field.ErrorList
+		allDeclarativeEnforced bool
+		betaEnabled            bool
+		rules                  []field.NormalizationRule
+		expectedLen            int
+	}{
+		{
+			name:                   "uncovered handwritten error is preserved",
+			errs:                   field.ErrorList{handwrittenNotCovered},
+			enforcedDeclarative:    field.ErrorList{matchingBetaDeclarative},
+			allDeclarativeEnforced: false,
+			expectedLen:            1,
+		},
+		{
+			name:                   "covered handwritten error filtered when matching beta declarative error exists",
+			errs:                   field.ErrorList{handwrittenCovered},
+			enforcedDeclarative:    field.ErrorList{matchingBetaDeclarative},
+			allDeclarativeEnforced: false,
+			expectedLen:            0,
+		},
+		{
+			name:                   "covered handwritten error not filtered when matching declarative is alpha",
+			errs:                   field.ErrorList{handwrittenCovered},
+			enforcedDeclarative:    field.ErrorList{matchingAlphaDeclarative},
+			allDeclarativeEnforced: false,
+			expectedLen:            1,
+		},
+		{
+			name:                   "covered handwritten error filtered in allDeclarativeEnforced mode regardless of matching declarative error",
+			errs:                   field.ErrorList{handwrittenCovered},
+			enforcedDeclarative:    nil,
+			allDeclarativeEnforced: true,
+			expectedLen:            0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			if tt.allDeclarativeEnforced {
+				ctx = WithAllDeclarativeEnforcedForTest(ctx)
+			}
+			res := FilterCoveredHandwrittenErrors(ctx, tt.errs, tt.enforcedDeclarative, tt.betaEnabled, tt.rules...)
+			if len(res) != tt.expectedLen {
+				t.Errorf("FilterCoveredHandwrittenErrors() returned %d errors, expected %d", len(res), tt.expectedLen)
+			}
+		})
+	}
+}
+
+func TestFilterEnforcedDeclarativeErrors(t *testing.T) {
+	internalErr := field.InternalError(field.NewPath("spec"), errors.New("internal error"))
+	alphaErr := field.Invalid(field.NewPath("spec"), "val", "alpha").MarkAlpha()
+	betaErr := field.Invalid(field.NewPath("spec"), "val", "beta").MarkBeta()
+	stdErr := field.Invalid(field.NewPath("spec"), "val", "standard")
+
+	tests := []struct {
+		name                   string
+		declarativeErrs        field.ErrorList
+		betaEnabled            bool
+		allDeclarativeEnforced bool
+		expectedLen            int
+	}{
+		{
+			name:                   "all errors enforced in allDeclarativeEnforced mode",
+			declarativeErrs:        field.ErrorList{internalErr, alphaErr, betaErr, stdErr},
+			betaEnabled:            false,
+			allDeclarativeEnforced: true,
+			expectedLen:            4,
+		},
+		{
+			name:                   "beta disabled ignores alpha and beta",
+			declarativeErrs:        field.ErrorList{internalErr, alphaErr, betaErr, stdErr},
+			betaEnabled:            false,
+			allDeclarativeEnforced: false,
+			expectedLen:            2, // internal + std
+		},
+		{
+			name:                   "beta enabled includes beta but excludes alpha",
+			declarativeErrs:        field.ErrorList{internalErr, alphaErr, betaErr, stdErr},
+			betaEnabled:            true,
+			allDeclarativeEnforced: false,
+			expectedLen:            3, // internal + beta + std
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.Background()
+			if tt.allDeclarativeEnforced {
+				ctx = WithAllDeclarativeEnforcedForTest(ctx)
+			}
+			res := FilterEnforcedDeclarativeErrors(ctx, tt.declarativeErrs, tt.betaEnabled)
+			if len(res) != tt.expectedLen {
+				t.Errorf("FilterEnforcedDeclarativeErrors() returned %d errors, expected %d", len(res), tt.expectedLen)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/immutable.go b/third_party/k8s.io/apimachinery/pkg/api/validate/immutable.go
new file mode 100644
index 0000000000..01a879c98f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/immutable.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Immutable verifies that the specified value has not changed in the course of
+// an update operation. It does nothing if the old value is not provided.
+//
+// This function unconditionally returns a validation error as it
+// relies on the default ratcheting mechanism to only be called when a
+// change to the field has already been detected.  This avoids a redundant
+// equivalence check across ratcheting and this function.
+func Immutable[T any](_ context.Context, op operation.Operation, fldPath *field.Path, _, _ T) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+	return field.ErrorList{
+		field.Invalid(fldPath, nil, "field is immutable").WithOrigin("immutable"),
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/immutable_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/immutable_test.go
new file mode 100644
index 0000000000..60396b0cc6
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/immutable_test.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestImmutable(t *testing.T) {
+	// The Immutable function relies on validation ratcheting to avoid being
+	// called when old and new values are equivalent. This unit test only needs
+	// to confirm two behaviors:
+	// 1. The function does nothing for non-update operations (e.g., create).
+	// 2. The function *always* returns an error for update operations, since
+	//    ratcheting should have prevented the call if the values were unchanged.
+
+	type simpleStruct struct {
+		S string
+	}
+
+	for _, tc := range []struct {
+		name string
+		fn   func(op operation.Operation, fldPath *field.Path) field.ErrorList
+	}{{
+		name: "with primitive type",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return Immutable(context.Background(), op, fld, ptr.To(123), ptr.To(456))
+		},
+	}, {
+		name: "with struct type",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return Immutable(context.Background(), op, fld, &simpleStruct{S: "a"}, &simpleStruct{S: "b"})
+		},
+	}, {
+		name: "with nil values",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			// Explicitly type the nil to satisfy the generic function signature.
+			return Immutable[*int](context.Background(), op, fld, nil, nil)
+		},
+	}} {
+		t.Run(tc.name, func(t *testing.T) {
+			// Create operations should never return an error.
+			errs := tc.fn(operation.Operation{Type: operation.Create}, field.NewPath("field"))
+			if len(errs) != 0 {
+				t.Errorf("expected success for create operation, but got errors: %v", errs)
+			}
+
+			// Update operations should always return exactly one error.
+			errs = tc.fn(operation.Operation{Type: operation.Update}, field.NewPath("field"))
+			if len(errs) == 0 {
+				t.Errorf("expected a failure for update operation, but got success")
+			} else if len(errs) > 1 {
+				t.Errorf("expected exactly one error for update operation, but got %d: %v", len(errs), errs)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/item.go b/third_party/k8s.io/apimachinery/pkg/api/validate/item.go
new file mode 100644
index 0000000000..4ddb2860c5
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/item.go
@@ -0,0 +1,140 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// MatchItemFunc takes an item and returns true if it matches the criteria.
+type MatchItemFunc[T any] func(T) bool
+
+// ValSliceItem finds the first item in a list of values which satisfies the
+// match function, and if found, also looks for a matching item in oldList. If
+// the value of the item is the same as the previous value, as per the equiv
+// function, then no validation is performed. Otherwise, it invokes
+// 'itemValidator' on these items.
+//
+// This function processes only the *first* matching item found in newList. It
+// assumes that the match functions targets a unique identifier (primary key)
+// and will match at most one element per list. If this assumption is violated,
+// changes in list order can lead this function to have inconsistent behavior.
+//
+// The match and equiv functions will never be called with nil arguments.
+//
+// The fldPath passed to itemValidator is indexed to the matched item's
+// position in newList.
+//
+// This function does not validate items that were removed (present in oldList
+// but not in newList).
+func ValSliceItem[TList ~[]TItem, TItem any](
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	newList, oldList TList,
+	match MatchItemFunc[*TItem],
+	equiv MatchFunc[*TItem],
+	itemValidator func(ctx context.Context, op operation.Operation, fldPath *field.Path, newObj, oldObj *TItem) field.ErrorList,
+) field.ErrorList {
+	var matchedNew, matchedOld *TItem
+	var newIndex int
+
+	for i := range newList {
+		if match(&newList[i]) {
+			matchedNew = &newList[i]
+			newIndex = i
+			break
+		}
+	}
+	if matchedNew == nil {
+		return nil
+	}
+
+	for i := range oldList {
+		if match(&oldList[i]) {
+			matchedOld = &oldList[i]
+			break
+		}
+	}
+
+	if op.Type == operation.Update && matchedOld != nil && equiv(matchedNew, matchedOld) {
+		return nil
+	}
+
+	return itemValidator(ctx, op, fldPath.Index(newIndex), matchedNew, matchedOld)
+}
+
+// PtrSliceItem finds the first item in a list of pointers which satisfies the
+// match function, and if found, also looks for a matching item in oldList. If
+// the value of the item is the same as the previous value, as per the equiv
+// function, then no validation is performed. Otherwise, it invokes
+// 'itemValidator' on these items.
+//
+// This function processes only the *first* matching item found in newList. It
+// assumes that the match functions targets a unique identifier (primary key)
+// and will match at most one element per list. If this assumption is violated,
+// changes in list order can lead this function to have inconsistent behavior.
+//
+// The match and equiv functions will never be called with nil arguments.
+//
+// The fldPath passed to itemValidator is indexed to the matched item's
+// position in newList.
+//
+// This function does not validate items that were removed (present in oldList
+// but not in newList).
+func PtrSliceItem[TList ~[]*TItem, TItem any](
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	newList, oldList TList,
+	match MatchItemFunc[*TItem],
+	equiv MatchFunc[*TItem],
+	itemValidator func(ctx context.Context, op operation.Operation, fldPath *field.Path, newObj, oldObj *TItem) field.ErrorList,
+) field.ErrorList {
+	var matchedNew, matchedOld *TItem
+	var newIndex int
+
+	for i := range newList {
+		if newList[i] == nil {
+			// Ignore nil items; they are supposed to have been checked by PtrSliceNoNils.
+			continue
+		}
+		if match(newList[i]) {
+			matchedNew = newList[i]
+			newIndex = i
+			break
+		}
+	}
+	if matchedNew == nil {
+		return nil
+	}
+
+	for i := range oldList {
+		if oldList[i] == nil {
+			continue
+		}
+		if match(oldList[i]) {
+			matchedOld = oldList[i]
+			break
+		}
+	}
+
+	if op.Type == operation.Update && matchedOld != nil && equiv(matchedNew, matchedOld) {
+		return nil
+	}
+
+	return itemValidator(ctx, op, fldPath.Index(newIndex), matchedNew, matchedOld)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/item_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/item_test.go
new file mode 100644
index 0000000000..180b8da62c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/item_test.go
@@ -0,0 +1,237 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+type multiKeyItem struct {
+	K1 string `json:"k1"`
+	K2 string `json:"k2"`
+	V  int    `json:"v"`
+}
+
+func TestValSliceItem(t *testing.T) {
+	testCases := []struct {
+		name      string
+		new       []multiKeyItem
+		old       []multiKeyItem
+		match     MatchItemFunc[*multiKeyItem]
+		validator func(context.Context, operation.Operation, *field.Path, *multiKeyItem, *multiKeyItem) field.ErrorList
+		expected  field.ErrorList
+	}{
+		{
+			name: "no match",
+			new: []multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "target"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, _, _ *multiKeyItem) field.ErrorList {
+				return field.ErrorList{field.Invalid(fp, nil, "err")}
+			},
+			expected: nil,
+		},
+		{
+			name: "new item with matching keys",
+			new: []multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+				{K1: "target", K2: "target2", V: 2},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "target" && i.K2 == "target2"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, o *multiKeyItem) field.ErrorList {
+				if n != nil && o == nil {
+					return field.ErrorList{field.Invalid(fp, n.K1, "added")}
+				}
+				return nil
+			},
+			expected: field.ErrorList{field.Invalid(field.NewPath("").Index(1), "target", "added")},
+		},
+		{
+			name: "updated item - same keys different values",
+			new: []multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+				{K1: "update", K2: "target2", V: 20},
+			},
+			old: []multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+				{K1: "update", K2: "target2", V: 2},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "update" && i.K2 == "target2"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, o *multiKeyItem) field.ErrorList {
+				if n != nil && o != nil && n.V != o.V {
+					return field.ErrorList{field.Invalid(fp.Child("v"), n.V, "changed")}
+				}
+				return nil
+			},
+			expected: field.ErrorList{field.Invalid(field.NewPath("").Index(1).Child("v"), 20, "changed")},
+		},
+		{
+			// For completeness as listType=map && listKey=... required tags prevents dupes.
+			name: "first match only - multiple items with same keys",
+			new: []multiKeyItem{
+				{K1: "dup", K2: "target2", V: 1},
+				{K1: "dup", K2: "target2", V: 2},
+			},
+			old: []multiKeyItem{
+				{K1: "dup", K2: "target2", V: 10},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "dup" && i.K2 == "target2"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, o *multiKeyItem) field.ErrorList {
+				if n != nil && o != nil {
+					return field.ErrorList{field.Invalid(fp, n.V, "value")}
+				}
+				return nil
+			},
+			expected: field.ErrorList{field.Invalid(field.NewPath("").Index(0), 1, "value")},
+		},
+		{
+			name: "nil new list",
+			new:  nil,
+			old: []multiKeyItem{
+				{K1: "exists", K2: "target2", V: 1},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "exists" && i.K2 == "target2"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, o *multiKeyItem) field.ErrorList {
+				if n == nil && o != nil {
+					return field.ErrorList{field.Invalid(fp, nil, "deleted")}
+				}
+				return nil
+			},
+			expected: nil,
+		},
+		{
+			name:  "empty lists",
+			new:   []multiKeyItem{},
+			old:   []multiKeyItem{},
+			match: func(i *multiKeyItem) bool { return true },
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, _, _ *multiKeyItem) field.ErrorList {
+				return field.ErrorList{field.Invalid(fp, nil, "err")}
+			},
+			expected: nil,
+		},
+		{
+			name:  "nil lists",
+			new:   nil,
+			old:   nil,
+			match: func(i *multiKeyItem) bool { return true },
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, _, _ *multiKeyItem) field.ErrorList {
+				return field.ErrorList{field.Invalid(fp, nil, "err")}
+			},
+			expected: nil,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := context.Background()
+			op := operation.Operation{Type: operation.Update}
+			fp := field.NewPath("")
+
+			got := ValSliceItem(ctx, op, fp, tc.new, tc.old, tc.match, ReflectDeepEqual, tc.validator)
+
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
+
+func TestPtrSliceItem(t *testing.T) {
+	testCases := []struct {
+		name      string
+		new       []*multiKeyItem
+		old       []*multiKeyItem
+		match     MatchItemFunc[*multiKeyItem]
+		validator func(context.Context, operation.Operation, *field.Path, *multiKeyItem, *multiKeyItem) field.ErrorList
+		expected  field.ErrorList
+	}{
+		{
+			name: "no match",
+			new: []*multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "target"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, _, _ *multiKeyItem) field.ErrorList {
+				return field.ErrorList{field.Invalid(fp, nil, "err")}
+			},
+			expected: nil,
+		},
+		{
+			name: "new item with matching keys",
+			new: []*multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+				{K1: "target", K2: "target2", V: 2},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "target" && i.K2 == "target2"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, o *multiKeyItem) field.ErrorList {
+				if n != nil && o == nil {
+					return field.ErrorList{field.Invalid(fp, n.K1, "added")}
+				}
+				return nil
+			},
+			expected: field.ErrorList{field.Invalid(field.NewPath("").Index(1), "target", "added")},
+		},
+		{
+			name: "nil element in new list (ignored)",
+			new: []*multiKeyItem{
+				nil,
+				{K1: "target", V: 1},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "target"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, _ *multiKeyItem) field.ErrorList {
+				return field.ErrorList{field.Invalid(fp, n.K1, "matched")}
+			},
+			expected: field.ErrorList{field.Invalid(field.NewPath("").Index(1), "target", "matched")},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := context.Background()
+			op := operation.Operation{Type: operation.Update}
+			fp := field.NewPath("")
+
+			got := PtrSliceItem(ctx, op, fp, tc.new, tc.old, tc.match, ReflectDeepEqual, tc.validator)
+
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/limits.go b/third_party/k8s.io/apimachinery/pkg/api/validate/limits.go
new file mode 100644
index 0000000000..768546f6bc
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/limits.go
@@ -0,0 +1,160 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"math"
+	"unicode/utf8"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/constraints"
+	"k8s.io/apimachinery/pkg/api/validate/content"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// MaxLength verifies that the specified value is not longer than max
+// characters.
+func MaxLength[T ~string](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, max int) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+
+	// if the length of the value in bytes is less
+	// than the maximum size then we can confidently
+	// say that this value is within the bounds
+	// enforced by the maximum value regardless
+	// of the actual makeup of characters in the value
+	byteLength := len(*value)
+	if byteLength <= max {
+		return nil
+	}
+
+	// because runes are up to 4 byte characters, if we assume all characters
+	// in the input are runes, the minimum number of characters that
+	// are specified is len(value)/4. If the minimum multi-byte
+	// character count is greater than our enforced maximum, we
+	// can confidently say that the value is invalid without having
+	// to actually perform the more expensive rune counting step
+	minimum := int(math.Ceil(float64(byteLength) / 4.0))
+	if minimum > max || utf8.RuneCountInString(string(*value)) > max {
+		return field.ErrorList{field.TooLongCharacters(fldPath, *value, max).WithOrigin("maxLength")}
+	}
+	return nil
+}
+
+// MaxBytes verifies that the specified value is not longer than max bytes.
+func MaxBytes[T ~string](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, max int) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+
+	if len(*value) > max {
+		return field.ErrorList{field.TooLong(fldPath, *value, max).WithOrigin("maxBytes")}
+	}
+
+	return nil
+}
+
+// MaxItems verifies that the specified slice is not longer than max items.
+func MaxItems[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ []T, max int) field.ErrorList {
+	if len(value) > max {
+		return field.ErrorList{field.TooMany(fldPath, len(value), max).WithOrigin("maxItems")}
+	}
+	return nil
+}
+
+// MaxProperties verifies that the specified map has no more than max keys.
+func MaxProperties[K comparable, V any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]V, max int) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+
+	if len(value) > max {
+		return field.ErrorList{field.TooMany(fldPath, len(value), max).WithOrigin("maxProperties")}
+	}
+	return nil
+}
+
+// MinItems verifies that the specified slice is not shorter than min items.
+func MinItems[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ []T, min int) field.ErrorList {
+	if len(value) < min {
+		return field.ErrorList{field.TooFew(fldPath, len(value), min).WithOrigin("minItems")}
+	}
+	return nil
+}
+
+// MinProperties verifies that the specified map is not shorter than min properties.
+func MinProperties[K comparable, V any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]V, min int) field.ErrorList {
+	if len(value) < min {
+		return field.ErrorList{field.TooFew(fldPath, len(value), min).WithOrigin("minProperties")}
+	}
+	return nil
+}
+
+// Minimum verifies that the specified value is greater than or equal to min.
+func Minimum[T constraints.Integer](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, min T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	if *value < min {
+		return field.ErrorList{field.Invalid(fldPath, *value, content.MinError(min)).WithOrigin("minimum")}
+	}
+	return nil
+}
+
+// Maximum verifies that the specified value is less than or equal to max.
+func Maximum[T constraints.Integer](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, max T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	if *value > max {
+		return field.ErrorList{field.Invalid(fldPath, *value, content.MaxError(max)).WithOrigin("maximum")}
+	}
+	return nil
+}
+
+// MinLength verifies that the specified value is at least min characters, if non-nil.
+func MinLength[T ~string](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, min int) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+
+	byteLength := len(*value)
+
+	// because runes are up to 4 byte characters, if we assume all characters
+	// in the input are 4 byte runes, the minimum number of characters that
+	// are specified is len(value)/4. If the minimum multi-byte
+	// character count is greater than or equal to our enforced minimum, we
+	// can confidently say that the value is valid without having
+	// to actually perform the more expensive rune counting step
+	if int(math.Ceil(float64(byteLength)/4.0)) >= min {
+		return nil
+	}
+
+	// if the length of the value in bytes is less
+	// than the minimum size then we can confidently
+	// say that this value is not within the bounds
+	// enforced by the maximum value regardless
+	// of the actual makeup of characters in the value.
+	// Otherwise, perform a rune count to determine if the
+	// number of characters is less than the minimum.
+	if byteLength < min || utf8.RuneCountInString(string(*value)) < min {
+		return field.ErrorList{field.TooShort(fldPath, *value, min).WithOrigin("minLength")}
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/limits_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/limits_test.go
new file mode 100644
index 0000000000..934b876f8f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/limits_test.go
@@ -0,0 +1,679 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/constraints"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestMaxLength(t *testing.T) {
+	cases := []struct {
+		name     string
+		value    string
+		max      int
+		wantErrs field.ErrorList
+	}{{
+		name:     "empty string",
+		value:    "",
+		max:      0,
+		wantErrs: nil,
+	}, {
+		name:  "zero length",
+		value: "0",
+		max:   0,
+		wantErrs: field.ErrorList{
+			field.TooLongCharacters(field.NewPath("fldpath"), "", 0).WithOrigin("maxLength"),
+		},
+	}, {
+		name:     "one character",
+		value:    "0",
+		max:      1,
+		wantErrs: nil,
+	}, {
+		name:  "two characters",
+		value: "01",
+		max:   1,
+		wantErrs: field.ErrorList{
+			field.TooLongCharacters(field.NewPath("fldpath"), "", 1).WithOrigin("maxLength"),
+		},
+	}, {
+		value: "",
+		max:   -1,
+		wantErrs: field.ErrorList{
+			field.TooLongCharacters(field.NewPath("fldpath"), "", -1).WithOrigin("maxLength"),
+		},
+	}, {
+		name:     "ascii-only characters, less characters than max (n-1)",
+		value:    "abcdefghi",
+		max:      10,
+		wantErrs: nil,
+	}, {
+		name:     "multi-byte characters, less characters than max (n-1)",
+		value:    "©®©®©®©®©",
+		max:      10,
+		wantErrs: nil,
+	}, {
+		name:  "ascii-only characters, more characters than max (n+1)",
+		value: "abcdefghijkl",
+		max:   10,
+		wantErrs: field.ErrorList{
+			field.TooLongCharacters(field.NewPath("fldpath"), "", 10).WithOrigin("maxLength"),
+		},
+	}, {
+		name:  "multi-byte characters, more characters than max (n+1)",
+		value: "©®©®©®©®©®©",
+		max:   10,
+		wantErrs: field.ErrorList{
+			field.TooLongCharacters(field.NewPath("fldpath"), "", 10).WithOrigin("maxLength"),
+		},
+	}, {
+		name:  "mixture of characters, minimum possible size of input is less than max, rune count exceed maximum",
+		value: "©abc®defghi",
+		max:   10,
+		wantErrs: field.ErrorList{
+			field.TooLongCharacters(field.NewPath("fldpath"), "", 10).WithOrigin("maxLength"),
+		},
+	}, {
+		name:     "multi-byte characters, exact characters as max (n)",
+		value:    "©®©®©®©®©®",
+		max:      10,
+		wantErrs: nil,
+	}, {
+		name:     "ascii-only characters, exact characters as max (n)",
+		value:    "abcdefghij",
+		max:      10,
+		wantErrs: nil,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			v := tc.value
+			gotErrs := MaxLength(context.Background(), operation.Operation{}, field.NewPath("fldpath"), &v, nil, tc.max)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMinItems(t *testing.T) {
+	cases := []struct {
+		name     string
+		items    int
+		min      int
+		wantErrs field.ErrorList
+	}{{
+		name:  "0 items, min 0",
+		items: 0,
+		min:   0,
+	}, {
+		name:  "1 item, min 0",
+		items: 1,
+		min:   0,
+	}, {
+		name:  "1 item, min 1",
+		items: 1,
+		min:   1,
+	}, {
+		name:  "0 items, min 1",
+		items: 0,
+		min:   1,
+		wantErrs: field.ErrorList{
+			field.TooFew(field.NewPath("fldpath"), 0, 1).WithOrigin("minItems"),
+		},
+	}, {
+		name:  "1 item, min 2",
+		items: 1,
+		min:   2,
+		wantErrs: field.ErrorList{
+			field.TooFew(field.NewPath("fldpath"), 1, 2).WithOrigin("minItems"),
+		},
+	}, {
+		name:  "0 items, min -1",
+		items: 0,
+		min:   -1,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := make([]bool, tc.items)
+			gotErrs := MinItems(context.Background(), operation.Operation{}, field.NewPath("fldpath"), value, nil, tc.min)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMinProperties(t *testing.T) {
+	cases := []struct {
+		name       string
+		properties int
+		min        int
+		wantErrs   field.ErrorList
+	}{{
+		name:       "0 properties, min 0",
+		properties: 0,
+		min:        0,
+	}, {
+		name:       "1 property, min 0",
+		properties: 1,
+		min:        0,
+	}, {
+		name:       "1 property, min 1",
+		properties: 1,
+		min:        1,
+	}, {
+		name:       "0 properties, min 1",
+		properties: 0,
+		min:        1,
+		wantErrs: field.ErrorList{
+			field.TooFew(field.NewPath("fldpath"), 0, 1).WithOrigin("minProperties"),
+		},
+	}, {
+		name:       "1 property, min 2",
+		properties: 1,
+		min:        2,
+		wantErrs: field.ErrorList{
+			field.TooFew(field.NewPath("fldpath"), 1, 2).WithOrigin("minProperties"),
+		},
+	}, {
+		name:       "0 properties, min 100000",
+		properties: 0,
+		min:        100000,
+		wantErrs: field.ErrorList{
+			field.TooFew(field.NewPath("fldpath"), 0, 100000).WithOrigin("minProperties"),
+		},
+	}, {
+		name:       "99999 properties, min 100000",
+		properties: 99999,
+		min:        100000,
+		wantErrs: field.ErrorList{
+			field.TooFew(field.NewPath("fldpath"), 99999, 100000).WithOrigin("minProperties"),
+		},
+	}, {
+		name:       "100000 properties, min 100000",
+		properties: 100000,
+		min:        100000,
+	}, {
+		// Note: While JSON Schema does not allow negative values for minProperties,
+		// we test that the validator handles it safely if it ever occurs at runtime.
+		name:       "0 properties, min -1",
+		properties: 0,
+		min:        -1,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := make(map[string]bool, tc.properties)
+			for i := 0; i < tc.properties; i++ {
+				value[fmt.Sprintf("k%d", i)] = true
+			}
+			gotErrs := MinProperties(context.Background(), operation.Operation{}, field.NewPath("fldpath"), value, nil, tc.min)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMaxItems(t *testing.T) {
+	cases := []struct {
+		name     string
+		items    int
+		max      int
+		wantErrs field.ErrorList
+	}{{
+		name:  "0 items, max 0",
+		items: 0,
+		max:   0,
+	}, {
+		name:  "1 item, max 0",
+		items: 1,
+		max:   0,
+		wantErrs: field.ErrorList{
+			field.TooMany(field.NewPath("fldpath"), 1, 0).WithOrigin("maxItems"),
+		},
+	}, {
+		name:  "1 item, max 1",
+		items: 1,
+		max:   1,
+	}, {
+		name:  "2 items, max 1",
+		items: 2,
+		max:   1,
+		wantErrs: field.ErrorList{
+			field.TooMany(field.NewPath("fldpath"), 2, 1).WithOrigin("maxItems"),
+		},
+	}, {
+		name:  "0 items, max -1",
+		items: 0,
+		max:   -1,
+		wantErrs: field.ErrorList{
+			field.TooMany(field.NewPath("fldpath"), 0, -1).WithOrigin("maxItems"),
+		},
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := make([]bool, tc.items)
+			gotErrs := MaxItems(context.Background(), operation.Operation{}, field.NewPath("fldpath"), value, nil, tc.max)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMaxProperties(t *testing.T) {
+	cases := []struct {
+		name       string
+		properties int
+		max        int
+		wantErrs   field.ErrorList
+	}{{
+		name:       "0 properties, max 0",
+		properties: 0,
+		max:        0,
+	}, {
+		name:       "1 property, max 0",
+		properties: 1,
+		max:        0,
+		wantErrs: field.ErrorList{
+			field.TooMany(field.NewPath("fldpath"), 1, 0).WithOrigin("maxProperties"),
+		},
+	}, {
+		name:       "1 property, max 1",
+		properties: 1,
+		max:        1,
+	}, {
+		name:       "2 properties, max 1",
+		properties: 2,
+		max:        1,
+		wantErrs: field.ErrorList{
+			field.TooMany(field.NewPath("fldpath"), 2, 1).WithOrigin("maxProperties"),
+		},
+	}, {
+		name:       "100000 properties, max 100000",
+		properties: 100000,
+		max:        100000,
+	}, {
+		name:       "100001 properties, max 100000",
+		properties: 100001,
+		max:        100000,
+		wantErrs: field.ErrorList{
+			field.TooMany(field.NewPath("fldpath"), 100001, 100000).WithOrigin("maxProperties"),
+		},
+	}, {
+		// Note: While JSON Schema does not allow negative values for maxProperties,
+		// we test that the validator handles it safely if it ever occurs at runtime.
+		name:       "0 properties, max -1",
+		properties: 0,
+		max:        -1,
+		wantErrs: field.ErrorList{
+			field.TooMany(field.NewPath("fldpath"), 0, -1).WithOrigin("maxProperties"),
+		},
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := make(map[string]string, tc.properties)
+			for i := 0; i < tc.properties; i++ {
+				value[fmt.Sprintf("%d", i)] = "value"
+			}
+
+			gotErrs := MaxProperties(context.Background(), operation.Operation{}, field.NewPath("fldpath"), value, nil, tc.max)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMinimum(t *testing.T) {
+	testMinimumPositive[int](t)
+	testMinimumNegative[int](t)
+	testMinimumPositive[int8](t)
+	testMinimumNegative[int8](t)
+	testMinimumPositive[int16](t)
+	testMinimumNegative[int16](t)
+	testMinimumPositive[int32](t)
+	testMinimumNegative[int32](t)
+	testMinimumPositive[int64](t)
+	testMinimumNegative[int64](t)
+
+	testMinimumPositive[uint](t)
+	testMinimumPositive[uint8](t)
+	testMinimumPositive[uint16](t)
+	testMinimumPositive[uint32](t)
+	testMinimumPositive[uint64](t)
+}
+
+type minimumTestCase[T constraints.Integer] struct {
+	min      T
+	value    T
+	wantErrs field.ErrorList
+}
+
+func testMinimumPositive[T constraints.Integer](t *testing.T) {
+	t.Helper()
+	cases := []minimumTestCase[T]{{
+		min:   0,
+		value: 0,
+	}, {
+		min:   1,
+		value: 0,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), nil, "must be greater than or equal to").WithOrigin("minimum"),
+		},
+	}, {
+		min:   1,
+		value: 1,
+	}, {
+		min:   2,
+		value: 1,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), nil, "must be greater than or equal to").WithOrigin("minimum"),
+		},
+	}}
+	doTestMinimum[T](t, cases)
+}
+
+func testMinimumNegative[T constraints.Signed](t *testing.T) {
+	t.Helper()
+	cases := []minimumTestCase[T]{{
+		min:   -1,
+		value: -1,
+	}, {
+		min:   -1,
+		value: -2,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), nil, "must be greater than or equal to").WithOrigin("minimum"),
+		},
+	}}
+
+	doTestMinimum[T](t, cases)
+}
+
+func doTestMinimum[T constraints.Integer](t *testing.T, cases []minimumTestCase[T]) {
+	t.Helper()
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		name := fmt.Sprintf("%T (%v >= %v)", tc.value, tc.value, tc.min)
+		t.Run(name, func(t *testing.T) {
+			v := tc.value
+			gotErrs := Minimum(context.Background(), operation.Operation{}, field.NewPath("fldpath"), &v, nil, tc.min)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMaximum(t *testing.T) {
+	testMaximumPositive[int](t)
+	testMaximumNegative[int](t)
+	testMaximumPositive[int8](t)
+	testMaximumNegative[int8](t)
+	testMaximumPositive[int16](t)
+	testMaximumNegative[int16](t)
+	testMaximumPositive[int32](t)
+	testMaximumNegative[int32](t)
+	testMaximumPositive[int64](t)
+	testMaximumNegative[int64](t)
+
+	testMaximumPositive[uint](t)
+	testMaximumPositive[uint8](t)
+	testMaximumPositive[uint16](t)
+	testMaximumPositive[uint32](t)
+	testMaximumPositive[uint64](t)
+}
+
+type maximumTestCase[T constraints.Integer] struct {
+	max      T
+	value    T
+	wantErrs field.ErrorList
+}
+
+func testMaximumPositive[T constraints.Integer](t *testing.T) {
+	t.Helper()
+	cases := []maximumTestCase[T]{{
+		max:   0,
+		value: 0,
+	}, {
+		max:   0,
+		value: 1,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), nil, "must be less than or equal to").WithOrigin("maximum"),
+		},
+	}, {
+		max:   1,
+		value: 1,
+	}, {
+		max:   1,
+		value: 2,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), nil, "must be less than or equal to").WithOrigin("maximum"),
+		},
+	}}
+	doTestMaximum[T](t, cases)
+}
+
+func testMaximumNegative[T constraints.Signed](t *testing.T) {
+	t.Helper()
+	cases := []maximumTestCase[T]{{
+		max:   -1,
+		value: -1,
+	}, {
+		max:   -2,
+		value: -1,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), nil, "must be less than or equal to").WithOrigin("maximum"),
+		},
+	}}
+
+	doTestMaximum[T](t, cases)
+}
+
+func doTestMaximum[T constraints.Integer](t *testing.T, cases []maximumTestCase[T]) {
+	t.Helper()
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		name := fmt.Sprintf("%T (%v <= %v)", tc.value, tc.value, tc.max)
+		t.Run(name, func(t *testing.T) {
+			v := tc.value
+			gotErrs := Maximum(context.Background(), operation.Operation{}, field.NewPath("fldpath"), &v, nil, tc.max)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMaxBytes(t *testing.T) {
+	cases := []struct {
+		name     string
+		value    string
+		max      int
+		wantErrs field.ErrorList
+	}{{
+		name:     "empty string",
+		value:    "",
+		max:      0,
+		wantErrs: nil,
+	}, {
+		name:  "zero length",
+		value: "0",
+		max:   0,
+		wantErrs: field.ErrorList{
+			field.TooLong(field.NewPath("fldpath"), "", 0).WithOrigin("maxBytes"),
+		},
+	}, {
+		name:     "one character",
+		value:    "0",
+		max:      1,
+		wantErrs: nil,
+	}, {
+		name:  "two characters",
+		value: "01",
+		max:   1,
+		wantErrs: field.ErrorList{
+			field.TooLong(field.NewPath("fldpath"), "", 1).WithOrigin("maxBytes"),
+		},
+	}, {
+		value: "",
+		max:   -1,
+		wantErrs: field.ErrorList{
+			field.TooLong(field.NewPath("fldpath"), "", -1).WithOrigin("maxBytes"),
+		},
+	}, {
+		name:     "ascii-only characters, less bytes than max",
+		value:    "abcdefghi",
+		max:      10,
+		wantErrs: nil,
+	}, {
+		name:     "multi-byte characters, less bytes than max",
+		value:    "©®©®",
+		max:      10,
+		wantErrs: nil,
+	}, {
+		name:  "ascii-only characters, more bytes than max",
+		value: "abcdefghijkl",
+		max:   10,
+		wantErrs: field.ErrorList{
+			field.TooLong(field.NewPath("fldpath"), "", 10).WithOrigin("maxBytes"),
+		},
+	}, {
+		name:  "multi-byte characters, more bytes than max",
+		value: "©®©®©©",
+		max:   10,
+		wantErrs: field.ErrorList{
+			field.TooLong(field.NewPath("fldpath"), "", 10).WithOrigin("maxBytes"),
+		},
+	}, {
+		name:     "mixture of characters, less bytes than max",
+		value:    "©abc®®",
+		max:      10,
+		wantErrs: nil,
+	}, {
+		name:  "mixture of characters, more bytes than max",
+		value: "©abc®®abc",
+		max:   10,
+		wantErrs: field.ErrorList{
+			field.TooLong(field.NewPath("fldpath"), "", 10).WithOrigin("maxBytes"),
+		},
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			v := tc.value
+			gotErrs := MaxBytes(context.Background(), operation.Operation{}, field.NewPath("fldpath"), &v, nil, tc.max)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestMinLength(t *testing.T) {
+	cases := []struct {
+		name     string
+		value    string
+		min      int
+		wantErrs field.ErrorList // regex
+	}{{
+		name:     "empty string allowed",
+		value:    "",
+		min:      0,
+		wantErrs: nil,
+	}, {
+		name:  "minimum length of one, empty string",
+		value: "",
+		min:   1,
+		wantErrs: field.ErrorList{
+			field.TooShort(field.NewPath("fldpath"), "", 1).WithOrigin("minLength"),
+		},
+	}, {
+		name:     "minimum length of one, non-empty string",
+		value:    "test",
+		min:      1,
+		wantErrs: nil,
+	}, {
+		name:  "minimum length of 10, 9 character string",
+		value: "012345678",
+		min:   10,
+		wantErrs: field.ErrorList{
+			field.TooShort(field.NewPath("fldpath"), "012345678", 10).WithOrigin("minLength"),
+		},
+	}, {
+		name:     "minimum length of 10, 10 character string",
+		value:    "0123456789",
+		min:      10,
+		wantErrs: nil,
+	}, {
+		name:     "negative minimum value",
+		value:    "",
+		min:      -1,
+		wantErrs: nil,
+	}, {
+		name:  "ascii-only characters, less characters than min (n-1)",
+		value: "abcdefghi",
+		min:   10,
+		wantErrs: field.ErrorList{
+			field.TooShort(field.NewPath("fldpath"), "abcdefghi", 10).WithOrigin("minLength"),
+		},
+	}, {
+		name:  "multi-byte characters, less characters than min (n-1)",
+		value: "©®©®©®©®©",
+		min:   10,
+		wantErrs: field.ErrorList{
+			field.TooShort(field.NewPath("fldpath"), "©®©®©®©®©", 10).WithOrigin("minLength"),
+		},
+	}, {
+		name:     "ascii-only characters, more characters than min (n+1)",
+		value:    "abcdefghijkl",
+		min:      10,
+		wantErrs: nil,
+	}, {
+		name:     "multi-byte characters, more characters than min (n+1)",
+		value:    "©®©®©®©®©®©",
+		min:      10,
+		wantErrs: nil,
+	}, {
+		name:  "mixture of characters, maximum size in bytes of input is greater than min, rune count less than min",
+		value: "©®©®©®", // 12 bytes, but 6 characters
+		min:   10,
+		wantErrs: field.ErrorList{
+			field.TooShort(field.NewPath("fldpath"), "©®©®©®", 10).WithOrigin("minLength"),
+		},
+	}, {
+		name:     "multi-byte characters, exact characters as min (n)",
+		value:    "©®©®©®©®©®",
+		min:      10,
+		wantErrs: nil,
+	}, {
+		name:     "ascii-only characters, exact characters as min (n)",
+		value:    "abcdefghij",
+		min:      10,
+		wantErrs: nil,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			v := tc.value
+			gotErrs := MinLength(context.Background(), operation.Operation{}, field.NewPath("fldpath"), &v, nil, tc.min)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/monotonic.go b/third_party/k8s.io/apimachinery/pkg/api/validate/monotonic.go
new file mode 100644
index 0000000000..f0526c9ffe
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/monotonic.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/constraints"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Monotonic validates that an integer value has not decreased on update.
+func Monotonic[T constraints.Integer](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+
+	if value == nil || oldValue == nil {
+		return nil
+	}
+
+	if *value < *oldValue {
+		return field.ErrorList{field.Invalid(fldPath, *value, fmt.Sprintf("may not be decreased from %v", *oldValue)).WithOrigin("monotonic")}
+	}
+
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/monotonic_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/monotonic_test.go
new file mode 100644
index 0000000000..4f900ef6c9
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/monotonic_test.go
@@ -0,0 +1,121 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/constraints"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestMonotonic(t *testing.T) {
+	testMonotonicPositive[int](t)
+	testMonotonicNegative[int](t)
+	testMonotonicPositive[int64](t)
+	testMonotonicPositive[uint64](t)
+}
+
+type monotonicTestCase[T constraints.Integer] struct {
+	name     string
+	op       operation.Operation
+	value    *T
+	oldValue *T
+	wantErrs field.ErrorList
+}
+
+func testMonotonicPositive[T constraints.Integer](t *testing.T) {
+	t.Helper()
+	v0 := T(0)
+	v1 := T(1)
+	v2 := T(2)
+
+	cases := []monotonicTestCase[T]{{
+		name:     "create (ignored)",
+		op:       operation.Operation{Type: operation.Create},
+		value:    &v0,
+		oldValue: nil,
+	}, {
+		name:     "update same value",
+		op:       operation.Operation{Type: operation.Update},
+		value:    &v1,
+		oldValue: &v1,
+	}, {
+		name:     "update increase",
+		op:       operation.Operation{Type: operation.Update},
+		value:    &v2,
+		oldValue: &v1,
+	}, {
+		name:     "update decrease",
+		op:       operation.Operation{Type: operation.Update},
+		value:    &v1,
+		oldValue: &v2,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), v1, "").WithOrigin("monotonic"),
+		},
+	}, {
+		name:     "update nil value",
+		op:       operation.Operation{Type: operation.Update},
+		value:    nil,
+		oldValue: &v1,
+	}, {
+		name:     "update nil old value",
+		op:       operation.Operation{Type: operation.Update},
+		value:    &v1,
+		oldValue: nil,
+	}}
+
+	doTestMonotonic[T](t, cases)
+}
+
+func testMonotonicNegative[T constraints.Signed](t *testing.T) {
+	t.Helper()
+	vM1 := T(-1)
+	vM2 := T(-2)
+
+	cases := []monotonicTestCase[T]{{
+		name:     "update negative increase",
+		op:       operation.Operation{Type: operation.Update},
+		value:    &vM1,
+		oldValue: &vM2,
+	}, {
+		name:     "update negative decrease",
+		op:       operation.Operation{Type: operation.Update},
+		value:    &vM2,
+		oldValue: &vM1,
+		wantErrs: field.ErrorList{
+			field.Invalid(field.NewPath("fldpath"), vM2, "").WithOrigin("monotonic"),
+		},
+	}}
+
+	doTestMonotonic[T](t, cases)
+}
+
+func doTestMonotonic[T constraints.Integer](t *testing.T, cases []monotonicTestCase[T]) {
+	t.Helper()
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailSubstring().ByField().ByType()
+	for _, tc := range cases {
+		name := fmt.Sprintf("%T %s", *new(T), tc.name)
+		t.Run(name, func(t *testing.T) {
+			gotErrs := Monotonic(context.Background(), tc.op, field.NewPath("fldpath"), tc.value, tc.oldValue)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/options.go b/third_party/k8s.io/apimachinery/pkg/api/validate/options.go
new file mode 100644
index 0000000000..143be3b64a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/options.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// IfOption conditionally evaluates a validation function. If the option and enabled are both true the validator
+// is called. If the option and enabled are both false the validator is called. Otherwise, the validator is not called.
+func IfOption[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue T,
+	optionName string, enabled bool, validator func(context.Context, operation.Operation, *field.Path, T, T) field.ErrorList,
+) field.ErrorList {
+	on, defined := op.HasOption(optionName)
+	if !defined {
+		return field.ErrorList{field.InternalError(fldPath, fmt.Errorf("undefined validation option %q", optionName))}
+	}
+	if on == enabled {
+		return validator(ctx, op, fldPath, value, oldValue)
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/required.go b/third_party/k8s.io/apimachinery/pkg/api/validate/required.go
new file mode 100644
index 0000000000..61a253a9d8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/required.go
@@ -0,0 +1,133 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// RequiredValue verifies that the specified value is not the zero-value for
+// its type.
+func RequiredValue[T comparable](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	var zero T
+	if *value != zero {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "")}
+}
+
+// RequiredPointer verifies that the specified pointer is not nil.
+func RequiredPointer[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value != nil {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "")}
+}
+
+// RequiredSlice verifies that the specified slice is not empty.
+func RequiredSlice[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ []T) field.ErrorList {
+	if len(value) > 0 {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "")}
+}
+
+// RequiredMap verifies that the specified map is not empty.
+func RequiredMap[K comparable, T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]T) field.ErrorList {
+	if len(value) > 0 {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "")}
+}
+
+// ForbiddenValue verifies that the specified value is the zero-value for its
+// type.
+func ForbiddenValue[T comparable](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	var zero T
+	if *value == zero {
+		return nil
+	}
+	return field.ErrorList{field.Forbidden(fldPath, "")}
+}
+
+// ForbiddenPointer verifies that the specified pointer is nil.
+func ForbiddenPointer[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	return field.ErrorList{field.Forbidden(fldPath, "")}
+}
+
+// ForbiddenSlice verifies that the specified slice is empty.
+func ForbiddenSlice[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ []T) field.ErrorList {
+	if len(value) == 0 {
+		return nil
+	}
+	return field.ErrorList{field.Forbidden(fldPath, "")}
+}
+
+// ForbiddenMap verifies that the specified map is empty.
+func ForbiddenMap[K comparable, T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]T) field.ErrorList {
+	if len(value) == 0 {
+		return nil
+	}
+	return field.ErrorList{field.Forbidden(fldPath, "")}
+}
+
+// OptionalValue verifies that the specified value is not the zero-value for
+// its type. This is identical to RequiredValue, but the caller should treat an
+// error here as an indication that the optional value was not specified.
+func OptionalValue[T comparable](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	var zero T
+	if *value != zero {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "optional value was not specified")}
+}
+
+// OptionalPointer verifies that the specified pointer is not nil. This is
+// identical to RequiredPointer, but the caller should treat an error here as an
+// indication that the optional value was not specified.
+func OptionalPointer[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value != nil {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "optional value was not specified")}
+}
+
+// OptionalSlice verifies that the specified slice is not empty. This is
+// identical to RequiredSlice, but the caller should treat an error here as an
+// indication that the optional value was not specified.
+func OptionalSlice[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ []T) field.ErrorList {
+	if len(value) > 0 {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "optional value was not specified")}
+}
+
+// OptionalMap verifies that the specified map is not empty. This is identical
+// to RequiredMap, but the caller should treat an error here as an indication that
+// the optional value was not specified.
+func OptionalMap[K comparable, T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]T) field.ErrorList {
+	if len(value) > 0 {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "optional value was not specified")}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/required_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/required_test.go
new file mode 100644
index 0000000000..6511271cd9
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/required_test.go
@@ -0,0 +1,924 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"regexp"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestRequiredValue(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := "value"
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := "" // zero-value
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 123
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0 // zero-value
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := true
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false // zero-value
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{"value"}
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{} // zero-value
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ptr.To("")
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil) // zero-value
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Required value",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestRequiredPointer(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ""
+			return RequiredPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*string)(nil)
+			return RequiredPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0
+			return RequiredPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*int)(nil)
+			return RequiredPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false
+			return RequiredPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*bool)(nil)
+			return RequiredPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{}
+			return RequiredPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*struct{ S string })(nil)
+			return RequiredPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil)
+			return RequiredPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (**string)(nil)
+			return RequiredPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath: Required value",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestRequiredSlice(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{""}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{0}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{false}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{nil}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestRequiredMap(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{"": ""}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{0: 0}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[bool]bool{false: false}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]bool{}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestOptionalValue(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := "value"
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := "" // zero-value
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 123
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0 // zero-value
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := true
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false // zero-value
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{"value"}
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{} // zero-value
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ptr.To("")
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil) // zero-value
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestOptionalPointer(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ""
+			return OptionalPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*string)(nil)
+			return OptionalPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0
+			return OptionalPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*int)(nil)
+			return OptionalPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false
+			return OptionalPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*bool)(nil)
+			return OptionalPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{}
+			return OptionalPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*struct{ S string })(nil)
+			return OptionalPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil)
+			return OptionalPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (**string)(nil)
+			return OptionalPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestOptionalSlice(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{""}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{0}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{false}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{nil}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestOptionalMap(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{"": ""}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{0: 0}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[bool]bool{false: false}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]bool{}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestForbiddenValue(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ""
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := "value"
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 123
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := true
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{}
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{"value"}
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil)
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ptr.To("")
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestForbiddenPointer(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*string)(nil)
+			return ForbiddenPointer(context.Background(), op, fp, pointer, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ""
+			return ForbiddenPointer(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*int)(nil)
+			return ForbiddenPointer(context.Background(), op, fp, pointer, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0
+			return ForbiddenPointer(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*bool)(nil)
+			return ForbiddenPointer(context.Background(), op, fp, pointer, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false
+			return ForbiddenPointer(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*struct{ S string })(nil)
+			return ForbiddenPointer(context.Background(), op, fp, pointer, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{}
+			return ForbiddenPointer(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (**string)(nil)
+			return ForbiddenPointer(context.Background(), op, fp, pointer, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil)
+			return ForbiddenPointer(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestForbiddenSlice(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{""}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{0}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{false}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{nil}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestForbiddenMap(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{"": ""}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{0: 0}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]bool{}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[bool]bool{false: false}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/strfmt.go b/third_party/k8s.io/apimachinery/pkg/api/validate/strfmt.go
new file mode 100644
index 0000000000..893f55d777
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/strfmt.go
@@ -0,0 +1,329 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/content"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+const (
+	uuidErrorMessage              = "must be a lowercase UUID in 8-4-4-4-12 format"
+	defaultResourceRequestsPrefix = "requests."
+	// Default namespace prefix.
+	resourceDefaultNamespacePrefix = "kubernetes.io/"
+	resourceDeviceMaxLength        = 32
+)
+
+// ShortName verifies that the specified value is a valid "short name"
+// (sometimes known as a "DNS label").
+//   - must not be empty
+//   - must be less than 64 characters long
+//   - must start and end with lower-case alphanumeric characters
+//   - must contain only lower-case alphanumeric characters or dashes
+//
+// All errors returned by this function will be "invalid" type errors. If the
+// caller wants better errors, it must take responsibility for checking things
+// like required/optional and max-length.
+func ShortName[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	for _, msg := range content.IsDNS1123Label((string)(*value)) {
+		allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-short-name"))
+	}
+	return allErrs
+}
+
+// LongName verifies that the specified value is a valid "long name"
+// (sometimes known as a "DNS subdomain").
+//   - must not be empty
+//   - must be less than 254 characters long
+//   - each element must start and end with lower-case alphanumeric characters
+//   - each element must contain only lower-case alphanumeric characters or dashes
+//
+// All errors returned by this function will be "invalid" type errors. If the
+// caller wants better errors, it must take responsibility for checking things
+// like required/optional and max-length.
+func LongName[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	for _, msg := range content.IsDNS1123Subdomain((string)(*value)) {
+		allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-long-name"))
+	}
+	return allErrs
+}
+
+// LabelKey verifies that the specified value is a valid label key.
+// A label key is composed of an optional prefix and a name, separated by a '/'.
+// The name part is required and must:
+//   - be 63 characters or less
+//   - begin and end with an alphanumeric character ([a-z0-9A-Z])
+//   - contain only alphanumeric characters, dashes (-), underscores (_), or dots (.)
+//
+// The prefix is optional and must:
+//   - be a DNS subdomain
+//   - be no more than 253 characters
+func LabelKey[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	for _, msg := range content.IsLabelKey((string)(*value)) {
+		allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-label-key"))
+	}
+	return allErrs
+}
+
+// PrefixedLabelKey verifies that the specified value is a valid label key with
+// a domain prefix.
+// A prefixed label key is composed of a prefix and a name, separated by a '/'.
+// The name part is required and must:
+//   - be 63 characters or less
+//   - begin and end with an alphanumeric character ([a-z0-9A-Z])
+//   - contain only alphanumeric characters, dashes (-), underscores (_), or dots (.)
+//
+// The prefix must:
+//   - be a DNS subdomain
+//   - be no more than 253 characters
+func PrefixedLabelKey[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	for _, msg := range content.IsPrefixedLabelKey((string)(*value)) {
+		allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-prefixed-label-key"))
+	}
+	return allErrs
+}
+
+// LongNameCaseless verifies that the specified value is a valid "long name"
+// (sometimes known as a "DNS subdomain"), but is case-insensitive.
+//   - must not be empty
+//   - must be less than 254 characters long
+//   - each element must start and end with alphanumeric characters
+//   - each element must contain only alphanumeric characters or dashes
+//
+// Deprecated: Case-insensitive names are not recommended as they can lead to ambiguity
+// (e.g., 'Foo', 'FOO', and 'foo' would be allowed names for foo). Use LongName for strict, lowercase validation.
+func LongNameCaseless[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	for _, msg := range content.IsDNS1123SubdomainCaseless((string)(*value)) {
+		allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-long-name-caseless"))
+	}
+	return allErrs
+}
+
+// LabelValue verifies that the specified value is a valid label value.
+//   - can be empty
+//   - must be no more than 63 characters
+//   - must start and end with alphanumeric characters
+//   - must contain only alphanumeric characters, dashes, underscores, or dots
+func LabelValue[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	for _, msg := range content.IsLabelValue((string)(*value)) {
+		allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-label-value"))
+	}
+	return allErrs
+}
+
+// PathSegmentName verifies that the specified value is a valid path segment name.
+// A path segment name can be safely encoded as a path segment in URLs and file paths.
+//   - must not be exactly "." or ".."
+//   - must not contain "/" (forward slash)
+//   - must not contain "%" (percent sign)
+//   - can contain any other characters including mixed case, numbers, dots, hyphens, underscores, and non-ASCII characters
+func PathSegmentName[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	for _, msg := range content.IsPathSegmentName((string)(*value)) {
+		allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-path-segment-name"))
+	}
+	return allErrs
+}
+
+// UUID verifies that the specified value is a valid UUID (RFC 4122).
+//   - must be 36 characters long
+//   - must be in the normalized form `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`
+//   - must use only lowercase hexadecimal characters
+func UUID[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	val := (string)(*value)
+	if len(val) != 36 {
+		return field.ErrorList{field.Invalid(fldPath, val, uuidErrorMessage).WithOrigin("format=k8s-uuid")}
+	}
+	for idx := 0; idx < len(val); idx++ {
+		character := val[idx]
+		switch idx {
+		case 8, 13, 18, 23:
+			if character != '-' {
+				return field.ErrorList{field.Invalid(fldPath, val, uuidErrorMessage).WithOrigin("format=k8s-uuid")}
+			}
+		default:
+			// should be lower case hexadecimal.
+			if (character < '0' || character > '9') && (character < 'a' || character > 'f') {
+				return field.ErrorList{field.Invalid(fldPath, val, uuidErrorMessage).WithOrigin("format=k8s-uuid")}
+			}
+		}
+	}
+	return nil
+}
+
+// ResourcePoolName verifies that the specified value is one or more valid "long name"
+// parts separated by a '/' and no longer than 253 characters.
+func ResourcePoolName[T ~string](ctx context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	val := (string)(*value)
+	var allErrs field.ErrorList
+	if len(val) > 253 {
+		allErrs = append(allErrs, field.TooLong(fldPath, val, 253))
+	}
+	parts := strings.Split(val, "/")
+	for i, part := range parts {
+		if len(part) == 0 {
+			allErrs = append(allErrs, field.Invalid(fldPath, val, fmt.Sprintf("segment %d: must not be empty", i)))
+			continue
+		}
+		// Note that we are overwriting the origin from the underlying LongName validation.
+		allErrs = append(allErrs, LongName(ctx, op, fldPath, &part, nil).PrefixDetail(fmt.Sprintf("segment %d: ", i))...)
+	}
+	return allErrs.WithOrigin("format=k8s-resource-pool-name")
+}
+
+// ExtendedResourceName verifies that the specified value is a valid extended resource name.
+// An extended resource name is a domain-prefixed name that does not use the "kubernetes.io"
+// or "requests." prefixes. Must be a valid label key when appended to "requests.", as in quota.
+//
+//   - must have slash domain and name.
+//   - must not have the "kubernetes.io" domain
+//   - must not have the "requests." prefix
+//   - name must be 63 characters or less
+//   - must be a valid label key when appended to "requests.", as in quota
+//     -- must contain only alphanumeric characters, dashes, underscores, or dots
+//     -- must end with an alphanumeric character
+func ExtendedResourceName[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	val := string(*value)
+	allErrs := field.ErrorList{}
+	if !strings.Contains(val, "/") {
+		allErrs = append(allErrs, field.Invalid(fldPath, val, "a name must be a domain-prefixed path, such as 'example.com/my-prop'"))
+	} else if strings.Contains(val, resourceDefaultNamespacePrefix) {
+		allErrs = append(allErrs, field.Invalid(fldPath, val, fmt.Sprintf("must not have %q domain", resourceDefaultNamespacePrefix)))
+	}
+	// Ensure extended resource is not type of quota.
+	if strings.HasPrefix(val, defaultResourceRequestsPrefix) {
+		allErrs = append(allErrs, field.Invalid(fldPath, val, fmt.Sprintf("must not have %q prefix", defaultResourceRequestsPrefix)))
+	}
+
+	// Ensure it satisfies the rules in IsLabelKey() after converted into quota resource name
+	nameForQuota := fmt.Sprintf("%s%s", defaultResourceRequestsPrefix, val)
+	for _, msg := range content.IsLabelKey(nameForQuota) {
+		allErrs = append(allErrs, field.Invalid(fldPath, val, msg))
+	}
+	return allErrs.WithOrigin("format=k8s-extended-resource-name")
+}
+
+// resourcesQualifiedName verifies that the specified value is a valid Kubernetes resources
+// qualified name.
+//   - must not be empty
+//   - must be composed of an optional prefix and a name, separated by a slash (e.g., "prefix/name")
+//   - the prefix, if specified, must be a DNS subdomain
+//   - the name part must be a C identifier
+//   - the name part must be no more than 32 characters
+func resourcesQualifiedName[T ~string](ctx context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	s := string(*value)
+	parts := strings.Split(s, "/")
+	// TODO: This validation and the corresponding handwritten validation validateQualifiedName in
+	// pkg/apis/resource/validation/validation.go are not validating whether there are more than 1
+	// slash. This should be fixed in both places.
+	switch len(parts) {
+	case 1:
+		allErrs = append(allErrs, validateCIdentifier(parts[0], resourceDeviceMaxLength, fldPath)...)
+	case 2:
+		if len(parts[0]) == 0 {
+			allErrs = append(allErrs, field.Invalid(fldPath, "", "prefix must not be empty"))
+		} else {
+			if len(parts[0]) > 63 {
+				allErrs = append(allErrs, field.TooLong(fldPath, parts[0], 63))
+			}
+			allErrs = append(allErrs, LongName(ctx, op, fldPath, &parts[0], nil).PrefixDetail("prefix: ")...)
+		}
+		if len(parts[1]) == 0 {
+			allErrs = append(allErrs, field.Invalid(fldPath, "", "name must not be empty"))
+		} else {
+			allErrs = append(allErrs, validateCIdentifier(parts[1], resourceDeviceMaxLength, fldPath)...)
+		}
+	}
+	return allErrs
+}
+
+// ResourceFullyQualifiedName verifies that the specified value is a valid Kubernetes
+// fully qualified name.
+//   - must not be empty
+//   - must be composed of a prefix and a name, separated by a slash (e.g., "prefix/name")
+//   - the prefix must be a DNS subdomain
+//   - the name part must be a C identifier
+//   - the name part must be no more than 32 characters
+func ResourceFullyQualifiedName[T ~string](ctx context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	s := string(*value)
+	allErrs = append(allErrs, resourcesQualifiedName(ctx, op, fldPath, &s, nil)...)
+	if !strings.Contains(s, "/") {
+		allErrs = append(allErrs, field.Invalid(fldPath, s, "a fully qualified name must be a domain and a name separated by a slash"))
+	}
+	return allErrs.WithOrigin("format=k8s-resource-fully-qualified-name")
+}
+
+func validateCIdentifier(id string, length int, fldPath *field.Path) field.ErrorList {
+	var allErrs field.ErrorList
+	if len(id) > length {
+		allErrs = append(allErrs, field.TooLong(fldPath, id, length))
+	}
+	for _, msg := range content.IsCIdentifier(id) {
+		allErrs = append(allErrs, field.Invalid(fldPath, id, msg))
+	}
+	return allErrs
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/strfmt_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/strfmt_test.go
new file mode 100644
index 0000000000..1310f414a3
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/strfmt_test.go
@@ -0,0 +1,950 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestShortName(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid",
+		input:    "abc-123",
+		wantErrs: nil,
+	}, {
+		name:  "invalid: empty",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character").WithOrigin("format=k8s-short-name"),
+		},
+	}, {
+		name:  "invalid: too long",
+		input: "01234567890123456789012345678901234567890123456789012345678901234",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "01234567890123456789012345678901234567890123456789012345678901234", "must be no more than 63 bytes").WithOrigin("format=k8s-short-name"),
+		},
+	}, {
+		name:  "invalid: starts with dash",
+		input: "-abc-123",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "-abc-123", "a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character").WithOrigin("format=k8s-short-name"),
+		},
+	}, {
+		name:  "invalid: ends with dash",
+		input: "abc-123-",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "abc-123-", "a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character").WithOrigin("format=k8s-short-name"),
+		},
+	}, {
+		name:  "invalid: upper-case",
+		input: "ABC-123",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "ABC-123", "a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character").WithOrigin("format=k8s-short-name"),
+		},
+	}, {
+		name:  "invalid: other chars",
+		input: "abc_123",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "abc_123", "a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character").WithOrigin("format=k8s-short-name"),
+		},
+	}}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailSubstring()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := tc.input
+			gotErrs := ShortName(ctx, operation.Operation{}, fldPath, &value, nil)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestLongName(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid",
+		input:    "a.b.c",
+		wantErrs: nil,
+	}, {
+		name:  "invalid: empty",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name"),
+		},
+	}, {
+		name:  "invalid: too long",
+		input: strings.Repeat("a", 254),
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, strings.Repeat("a", 254), "must be no more than 253 bytes").WithOrigin("format=k8s-long-name"),
+		},
+	}, {
+		name:  "invalid: starts with dash",
+		input: "-a.b.c",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "-a.b.c", "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name"),
+		},
+	}, {
+		name:  "invalid: ends with dash",
+		input: "a.b.c-",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "a.b.c-", "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name"),
+		},
+	}, {
+		name:  "invalid: upper-case",
+		input: "A.b.c",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "A.b.c", "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name"),
+		},
+	}, {
+		name:  "invalid: other chars",
+		input: "a_b.c",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "a_b.c", "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name"),
+		},
+	}}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailSubstring()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := tc.input
+			gotErrs := LongName(ctx, operation.Operation{}, fldPath, &value, nil)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestLabelKey(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid key",
+		input:    "app",
+		wantErrs: nil,
+	}, {
+		name:     "valid key with dash",
+		input:    "app-name",
+		wantErrs: nil,
+	}, {
+		name:     "valid key with dot",
+		input:    "app.name",
+		wantErrs: nil,
+	}, {
+		name:     "valid key with underscore",
+		input:    "app_name",
+		wantErrs: nil,
+	}, {
+		name:     "valid key with prefix",
+		input:    "example.com/app",
+		wantErrs: nil,
+	}, {
+		name:     "valid key with long prefix",
+		input:    strings.Repeat("a", 63) + "." + strings.Repeat("b", 63) + "." + strings.Repeat("c", 63) + "." + strings.Repeat("d", 55) + "/app",
+		wantErrs: nil,
+	}, {
+		name:  "invalid: empty string",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-key"),
+		},
+	}, {
+		name:  "invalid: starts with dash",
+		input: "-app",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-key"),
+		},
+	}, {
+		name:  "invalid: ends with dash",
+		input: "app-",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-key"),
+		},
+	}, {
+		name:  "invalid: contains invalid characters",
+		input: "app^",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-key"),
+		},
+	}, {
+		name:  "invalid: name too long",
+		input: strings.Repeat("a", 64),
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-key"),
+		},
+	}, {
+		name:  "invalid: prefix too long",
+		input: strings.Repeat("a", 254) + "/app",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-key"),
+		},
+	}, {
+		name:  "invalid: prefix is not a DNS subdomain",
+		input: "example-.com/app",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-key"),
+		},
+	}, {
+		name:     "nil value",
+		input:    "", // This will be handled by setting value to nil in the test runner
+		wantErrs: nil,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			var value *string
+			if tc.name != "nil value" {
+				v := tc.input
+				value = &v
+			}
+			gotErrs := LabelKey(ctx, operation.Operation{}, fldPath, value, nil)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestPrefixedLabelKey(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:  "valid key",
+		input: "app",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "valid key with dash",
+		input: "app-name",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "valid key with dot",
+		input: "app.name",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "valid key with underscore",
+		input: "app_name",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:     "valid key with prefix",
+		input:    "example.com/app",
+		wantErrs: nil,
+	}, {
+		name:     "valid key with long prefix",
+		input:    strings.Repeat("a", 63) + "." + strings.Repeat("b", 63) + "." + strings.Repeat("c", 63) + "." + strings.Repeat("d", 55) + "/app",
+		wantErrs: nil,
+	}, {
+		name:  "invalid: empty string",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "invalid: starts with dash",
+		input: "-app",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "invalid: ends with dash",
+		input: "app-",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "invalid: contains invalid characters",
+		input: "app^",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "invalid: name too long",
+		input: strings.Repeat("a", 64),
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "invalid: prefix too long",
+		input: strings.Repeat("a", 254) + "/app",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:  "invalid: prefix is not a DNS subdomain",
+		input: "example-.com/app",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-prefixed-label-key"),
+		},
+	}, {
+		name:     "nil value",
+		input:    "", // This will be handled by setting value to nil in the test runner
+		wantErrs: nil,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			var value *string
+			if tc.name != "nil value" {
+				v := tc.input
+				value = &v
+			}
+			gotErrs := PrefixedLabelKey(ctx, operation.Operation{}, fldPath, value, nil)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestK8sUUID(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid uuid with hyphens",
+		input:    "123e4567-e89b-12d3-a456-426614174000",
+		wantErrs: nil,
+	}, {
+		name:  "invalid uuid with hyphens uppercase",
+		input: "123E4567-E89B-12D3-A456-426614174000",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "123E4567-E89B-12D3-A456-426614174000", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}, {
+		name:  "invalid uuid with urn prefix",
+		input: "urn:uuid:123e4567-e89b-12d3-a456-426614174000",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "urn:uuid:123e4567-e89b-12d3-a456-426614174000", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}, {
+		name:  "invalid uuid without hyphens",
+		input: "123e4567e89b12d3a456426614174000",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "123e4567e89b12d3a456426614174000", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}, {
+		name:  "invalid: wrong length",
+		input: "123e4567-e89b-12d3-a456-42661417400",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "123e4567-e89b-12d3-a456-42661417400", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}, {
+		name:  "invalid: wrong characters",
+		input: "123e4567-e89b-12d3-a456-42661417400g",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "123e4567-e89b-12d3-a456-42661417400g", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}, {
+		name:  "invalid: misplaced hyphens",
+		input: "123e4567-e89b-12d3-a4564-26614174000",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "123e4567-e89b-12d3-a4564-26614174000", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}, {
+		name:  "empty string",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}, {
+		name:  "not a uuid",
+		input: "not-a-uuid",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "not-a-uuid", "must be a lowercase UUID in 8-4-4-4-12 format").WithOrigin("format=k8s-uuid"),
+		},
+	}}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailExact()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := tc.input
+			gotErrs := UUID(ctx, operation.Operation{}, fldPath, &value, nil)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestLabelValue(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid value",
+		input:    "valid-value",
+		wantErrs: nil,
+	}, {
+		name:     "valid value with dots",
+		input:    "valid.value",
+		wantErrs: nil,
+	}, {
+		name:     "valid value with underscores",
+		input:    "valid_value",
+		wantErrs: nil,
+	}, {
+		name:     "valid single character value",
+		input:    "a",
+		wantErrs: nil,
+	}, {
+		name:     "valid value with numbers",
+		input:    "123-abc",
+		wantErrs: nil,
+	}, {
+		name:     "valid uppercase characters",
+		input:    "Valid-Value",
+		wantErrs: nil,
+	}, {
+		name:  "invalid: starts with dash",
+		input: "-invalid-value",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:  "invalid: ends with dash",
+		input: "invalid-value-",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:  "invalid: starts with dot",
+		input: ".invalid.value",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:  "invalid: ends with dot",
+		input: "invalid.value.",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:  "invalid: starts with underscore",
+		input: "_invalid_value",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:  "invalid: ends with underscore",
+		input: "invalid_value_",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:  "invalid: contains special characters",
+		input: "invalid@value",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:  "invalid: too long",
+		input: "a" + strings.Repeat("b", 62) + "c", // 64 characters
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-label-value"),
+		},
+	}, {
+		name:     "valid: max length",
+		input:    "a" + strings.Repeat("b", 61) + "c", // 63 characters
+		wantErrs: nil,
+	}, {
+		name:     "valid: empty string",
+		input:    "",
+		wantErrs: nil,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := tc.input
+			gotErrs := LabelValue(ctx, operation.Operation{}, fldPath, &value, nil)
+
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestPathSegmentName(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	// This format validator does not check for empty strings or max length,
+	// only checks path-segment-unsafe characters. Those constraints are
+	// handled by separate validators (Required, maxLength) in the schema.
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid simple name",
+		input:    "valid-name",
+		wantErrs: nil,
+	}, {
+		name:     "valid with dots",
+		input:    "foo.bar.baz",
+		wantErrs: nil,
+	}, {
+		name:     "valid with mixed case",
+		input:    "MyResource",
+		wantErrs: nil,
+	}, {
+		name:     "valid with numbers",
+		input:    "resource123",
+		wantErrs: nil,
+	}, {
+		name:     "valid with underscores",
+		input:    "my_resource",
+		wantErrs: nil,
+	}, {
+		name:     "valid complex identifier",
+		input:    "sha256:ABCDEF012345@ABCDEF012345",
+		wantErrs: nil,
+	}, {
+		name:     "valid with non-ASCII characters",
+		input:    "Iñtërnâtiônàlizætiøn",
+		wantErrs: nil,
+	}, {
+		name:     "valid with leading dot",
+		input:    ".test",
+		wantErrs: nil,
+	}, {
+		name:     "valid with leading double dot",
+		input:    "..test",
+		wantErrs: nil,
+	}, {
+		name:     "valid empty string",
+		input:    "",
+		wantErrs: nil,
+	}, {
+		name:  "invalid: exactly dot",
+		input: ".",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, ".", "may not be '.'").WithOrigin("format=k8s-path-segment-name"),
+		},
+	}, {
+		name:  "invalid: exactly double dot",
+		input: "..",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "..", "may not be '..'").WithOrigin("format=k8s-path-segment-name"),
+		},
+	}, {
+		name:  "invalid: contains slash",
+		input: "foo/bar",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "foo/bar", "may not contain '/'").WithOrigin("format=k8s-path-segment-name"),
+		},
+	}, {
+		name:  "invalid: contains percent",
+		input: "foo%bar",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "foo%bar", "may not contain '%'").WithOrigin("format=k8s-path-segment-name"),
+		},
+	}, {
+		name:  "invalid: contains both slash and percent",
+		input: "foo/bar%baz",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "may not contain '/'").WithOrigin("format=k8s-path-segment-name"),
+			field.Invalid(fldPath, nil, "may not contain '%'").WithOrigin("format=k8s-path-segment-name"),
+		},
+	}}
+
+	exactMatcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailSubstring()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := tc.input
+			gotErrs := PathSegmentName(ctx, operation.Operation{}, fldPath, &value, nil)
+
+			exactMatcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestLongNameCaseless(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid",
+		input:    "A.b.C",
+		wantErrs: nil,
+	}, {
+		name:  "invalid: empty",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "an RFC 1123 subdomain must consist of alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name-caseless"),
+		},
+	}, {
+		name:  "invalid: too long",
+		input: strings.Repeat("a", 254),
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, strings.Repeat("a", 254), "must be no more than 253 bytes").WithOrigin("format=k8s-long-name-caseless"),
+		},
+	}, {
+		name:  "invalid: starts with dash",
+		input: "-A.b.C",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "-A.b.C", "an RFC 1123 subdomain must consist of alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name-caseless"),
+		},
+	},
+		{
+			name:  "invalid: ends with dash",
+			input: "A.b.C-",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "A.b.C-", "an RFC 1123 subdomain must consist of alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name-caseless"),
+			},
+		},
+		{
+			name:  "invalid: other chars",
+			input: "A_b.C",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "A_b.C", "an RFC 1123 subdomain must consist of alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character").WithOrigin("format=k8s-long-name-caseless"),
+			},
+		},
+	}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := tc.input
+			gotErrs := LongNameCaseless(ctx, operation.Operation{}, fldPath, &value, nil)
+
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestResourcePoolName(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:  "valid: single segment",
+		input: "a.valid.long-name",
+	}, {
+		name:  "valid: two segments",
+		input: "a.valid.long-name/another.one",
+	}, {
+		name:  "valid: multiple segments",
+		input: "a/b/c.d.e",
+	}, {
+		name:  "valid: segments with numbers",
+		input: "1.2.3/4.5.6",
+	}, {
+		name:  "invalid: empty string",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "segment 0: must not be empty").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: leading slash",
+		input: "/a.b.c",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: trailing slash",
+		input: "a.b.c/",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: double slash",
+		input: "a.b.c//d.e.f",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: one segment has uppercase",
+		input: "a.valid.name/Not.Valid",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "segment 1: a lowercase RFC 1123").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: one segment starts with dash",
+		input: "a.valid.name/-not-valid",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "segment 1: a lowercase RFC 1123").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: one segment has special characters",
+		input: "a.valid.name/not_valid",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "segment 1: a lowercase RFC 1123").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: too long",
+		input: "a.valid.name/" + strings.Repeat("b", 253),
+		wantErrs: field.ErrorList{
+			field.TooLong(fldPath, nil, 253).WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: segment too long",
+		input: strings.Repeat("b", 254),
+		wantErrs: field.ErrorList{
+			field.TooLong(fldPath, nil, 253).WithOrigin("format=k8s-resource-pool-name"),
+			field.Invalid(fldPath, nil, "segment 0: must be no more than 253 bytes").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: multiple invalid segments",
+		input: "Not/Valid/Either",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "segment 0: a lowercase RFC 1123").WithOrigin("format=k8s-resource-pool-name"),
+			field.Invalid(fldPath, nil, "segment 1: a lowercase RFC 1123").WithOrigin("format=k8s-resource-pool-name"),
+			field.Invalid(fldPath, nil, "segment 2: a lowercase RFC 1123").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}, {
+		name:  "invalid: just a slash",
+		input: "/",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, nil, "segment 0: must not be empty").WithOrigin("format=k8s-resource-pool-name"),
+			field.Invalid(fldPath, nil, "segment 1: must not be empty").WithOrigin("format=k8s-resource-pool-name"),
+		},
+	}}
+
+	exactMatcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailSubstring()
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := &tc.input
+			gotErrs := ResourcePoolName(ctx, operation.Operation{}, fldPath, value, nil)
+			exactMatcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestExtendedResourceName(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{
+		{
+			name:     "valid",
+			input:    "example-kub.io/foo",
+			wantErrs: nil,
+		},
+		{
+			name:  "invalid: name too long",
+			input: strings.Repeat("a", 64),
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, strings.Repeat("a", 64), "a name must be a domain-prefixed path, such as 'example.com/my-prop").WithOrigin("format=k8s-extended-resource-name"),
+				field.Invalid(fldPath, strings.Repeat("a", 64), "name part must be no more than 63 bytes").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+		{
+			name:  "invalid: empty",
+			input: "",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "", "a name must be a domain-prefixed path, such as 'example.com/my-prop").WithOrigin("format=k8s-extended-resource-name"),
+				field.Invalid(fldPath, "", "name part must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]')").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+		{
+			name:  "invalid: no domain",
+			input: "foo",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "foo", "a name must be a domain-prefixed path, such as 'example.com/my-prop'").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+		{
+			name:  "invalid: no domain and no name",
+			input: "/",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "/", "name part must be non-empty").WithOrigin("format=k8s-extended-resource-name"),
+				field.Invalid(fldPath, "/", "name part must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]')").WithOrigin("format=k8s-extended-resource-name"),
+				field.Invalid(fldPath, "/", "prefix part a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+		{
+			name:  "invalid: something.kubernetes.io domain",
+			input: "something.kubernetes.io/foo",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "something.kubernetes.io/foo", "must not have \"kubernetes.io/\" domain").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+		{
+			name:  "invalid: kubernetes.io domain",
+			input: "kubernetes.io/foo",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "kubernetes.io/foo", "must not have \"kubernetes.io/\" domain").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+		{
+			name:  "invalid: requests prefix",
+			input: "requests.example.com/foo",
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "requests.example.com/foo", "must not have \"requests.\" prefix").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+		{
+			name:  "invalid: name too long",
+			input: "example.com/" + strings.Repeat("a", 64),
+			wantErrs: field.ErrorList{
+				field.Invalid(fldPath, "example.com/"+strings.Repeat("a", 64), "name part must be no more than 63 bytes").WithOrigin("format=k8s-extended-resource-name"),
+			},
+		},
+	}
+
+	exactMatcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin().ByDetailSubstring()
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := &tc.input
+			gotErrs := ExtendedResourceName(ctx, operation.Operation{}, fldPath, value, nil)
+			exactMatcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
+
+func TestResourceFullyQualifiedName(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("test")
+
+	testCases := []struct {
+		name     string
+		input    string
+		wantErrs field.ErrorList
+	}{{
+		name:     "valid name with prefix",
+		input:    "prefix.com/name",
+		wantErrs: nil,
+	}, {
+		name:     "valid name with complex prefix",
+		input:    "my-subdomain.example.com/name",
+		wantErrs: nil,
+	}, {
+		name:  "invalid name with dots",
+		input: "prefix.com/name.with.dots",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "name.with.dots", "a valid C identifier must start with alphabetic character").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:  "invalid name with dashes",
+		input: "prefix.com/name-with-dashes",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "name-with-dashes", "a valid C identifier must start with alphabetic character").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:  "invalid: no prefix",
+		input: "name",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "name", "a fully qualified name must be a domain and a name separated by a slash").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:  "invalid: empty",
+		input: "",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "a fully qualified name must be a domain and a name separated by a slash").WithOrigin("format=k8s-resource-fully-qualified-name"),
+			field.Invalid(fldPath, "", "a valid C identifier must start with alphabetic character").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:  "invalid: prefix too long",
+		input: strings.Repeat("a", 254) + "/name",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, strings.Repeat("a", 254), "prefix: must be no more than 253 bytes").WithOrigin("format=k8s-resource-fully-qualified-name"),
+			field.TooLong(fldPath, strings.Repeat("a", 254), 63).WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:  "invalid: name too long",
+		input: "prefix.com/" + strings.Repeat("a", 64),
+		wantErrs: field.ErrorList{
+			field.TooLong(fldPath, strings.Repeat("a", 64), 32).WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:  "invalid: prefix is not a valid DNS subdomain",
+		input: "Prefix.com/name",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "Prefix.com", "prefix: a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:     "invalid: name is not a valid RFC 1123 label",
+		input:    "prefix.com/Name",
+		wantErrs: nil, // no errors, C-identifiers can have uppercase letters
+	}, {
+		name:     "invalid: more than one slash",
+		input:    "prefix.com/name/extra",
+		wantErrs: nil, // This is not validated, yet.
+	}, {
+		name:  "invalid: empty name",
+		input: "prefix.com/",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "name must not be empty").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}, {
+		name:  "invalid: empty prefix",
+		input: "/name",
+		wantErrs: field.ErrorList{
+			field.Invalid(fldPath, "", "prefix must not be empty").WithOrigin("format=k8s-resource-fully-qualified-name"),
+		},
+	}}
+
+	matcher := field.ErrorMatcher{}.ByType().ByField().ByDetailSubstring().ByOrigin()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			value := tc.input
+			gotErrs := ResourceFullyQualifiedName(ctx, operation.Operation{}, fldPath, &value, nil)
+			matcher.Test(t, tc.wantErrs, gotErrs)
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/subfield.go b/third_party/k8s.io/apimachinery/pkg/api/validate/subfield.go
new file mode 100644
index 0000000000..7aa48d3304
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/subfield.go
@@ -0,0 +1,56 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// GetFieldFunc is a function that extracts a field from a type and returns a
+// nilable value.
+type GetFieldFunc[Tstruct any, Tfield any] func(*Tstruct) Tfield
+
+// Subfield validates a subfield of a struct against a validator function. If
+// the value of the subfield is the same as the previous value, as per the
+// equiv function, then no validation is performed.
+//
+// The equiv function can be called with nil arguments in the case of nilable
+// fields.
+//
+// The fldPath passed to the validator includes the subfield name.
+func Subfield[Tstruct any, Tfield any](
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	newStruct, oldStruct *Tstruct,
+	fldName string, getField GetFieldFunc[Tstruct, Tfield],
+	equiv MatchFunc[Tfield],
+	validator ValidateFunc[Tfield],
+) field.ErrorList {
+	var errs field.ErrorList
+	newVal := getField(newStruct)
+	var oldVal Tfield
+	if oldStruct != nil {
+		oldVal = getField(oldStruct)
+	}
+	if op.Type == operation.Update && oldStruct != nil && equiv(newVal, oldVal) {
+		return nil
+	}
+	errs = append(errs, validator(ctx, op, fldPath.Child(fldName), newVal, oldVal)...)
+	return errs
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/testing.go b/third_party/k8s.io/apimachinery/pkg/api/validate/testing.go
new file mode 100644
index 0000000000..461bb0cdd0
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/testing.go
@@ -0,0 +1,35 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// FixedResult asserts a fixed boolean result.  This is mostly useful for
+// testing.
+func FixedResult[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ T, result bool, arg string) field.ErrorList {
+	if result {
+		return nil
+	}
+	return field.ErrorList{
+		field.Invalid(fldPath, value, "forced failure: "+arg).WithOrigin("validateFalse"),
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/testing_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/testing_test.go
new file mode 100644
index 0000000000..762e6df621
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/testing_test.go
@@ -0,0 +1,146 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestFixedResult(t *testing.T) {
+	cases := []struct {
+		value any
+		pass  bool
+	}{{
+		value: "",
+		pass:  false,
+	}, {
+		value: "",
+		pass:  true,
+	}, {
+		value: "nonempty",
+		pass:  false,
+	}, {
+		value: "nonempty",
+		pass:  true,
+	}, {
+		value: 0,
+		pass:  false,
+	}, {
+		value: 0,
+		pass:  true,
+	}, {
+		value: 1,
+		pass:  false,
+	}, {
+		value: 1,
+		pass:  true,
+	}, {
+		value: false,
+		pass:  false,
+	}, {
+		value: false,
+		pass:  true,
+	}, {
+		value: true,
+		pass:  false,
+	}, {
+		value: true,
+		pass:  true,
+	}, {
+		value: nil,
+		pass:  false,
+	}, {
+		value: nil,
+		pass:  true,
+	}, {
+		value: ptr.To(""),
+		pass:  false,
+	}, {
+		value: ptr.To(""),
+		pass:  true,
+	}, {
+		value: ptr.To("nonempty"),
+		pass:  false,
+	}, {
+		value: ptr.To("nonempty"),
+		pass:  true,
+	}, {
+		value: []string(nil),
+		pass:  false,
+	}, {
+		value: []string(nil),
+		pass:  true,
+	}, {
+		value: []string{},
+		pass:  false,
+	}, {
+		value: []string{},
+		pass:  true,
+	}, {
+		value: []string{"s"},
+		pass:  false,
+	}, {
+		value: []string{"s"},
+		pass:  true,
+	}, {
+		value: map[string]string(nil),
+		pass:  false,
+	}, {
+		value: map[string]string(nil),
+		pass:  true,
+	}, {
+		value: map[string]string{},
+		pass:  false,
+	}, {
+		value: map[string]string{},
+		pass:  true,
+	}, {
+		value: map[string]string{"k": "v"},
+		pass:  false,
+	}, {
+		value: map[string]string{"k": "v"},
+		pass:  true,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailExact()
+	for i, tc := range cases {
+		result := FixedResult(context.Background(), operation.Operation{}, field.NewPath("fldpath"), tc.value, nil, tc.pass, "detail string")
+		if len(result) != 0 && tc.pass {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && !tc.pass {
+			t.Errorf("case %d: unexpected success", i)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			wantErrorList := field.ErrorList{
+				field.Invalid(field.NewPath("fldpath"), tc.value, "forced failure: detail string").WithOrigin("validateFalse"),
+			}
+			matcher.Test(t, wantErrorList, result)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/union.go b/third_party/k8s.io/apimachinery/pkg/api/validate/union.go
new file mode 100644
index 0000000000..753a4a9ee1
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/union.go
@@ -0,0 +1,238 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// ExtractorFn extracts a value from a parent object. Depending on the context,
+// that could be the value of a field or just whether that field was set or
+// not.
+// Note: obj is not guaranteed to be non-nil, need to handle nil obj in the
+// extractor.
+type ExtractorFn[T, V any] func(obj T) V
+
+// UnionValidationOptions configures how union validation behaves
+type UnionValidationOptions struct {
+	// ErrorForEmpty returns error when no fields are set (nil means no error)
+	ErrorForEmpty func(fldPath *field.Path, allFields []string) *field.Error
+
+	// ErrorForMultiple returns error when multiple fields are set (nil means no error)
+	ErrorForMultiple func(fldPath *field.Path, specifiedFields []string, allFields []string) *field.Error
+}
+
+// Union verifies that exactly one member of a union is specified.
+//
+// UnionMembership must define all the members of the union.
+//
+// For example:
+//
+//	var UnionMembershipForABC := validate.NewUnionMembership(
+//	 	validate.NewUnionMember("a"),
+//	 	validate.NewUnionMember("b"),
+//	 	validate.NewUnionMember("c"),
+//	 )
+//	func ValidateABC(ctx context.Context, op operation.Operation, fldPath *field.Path, in *ABC) (errs field.ErrorList) {
+//		errs = append(errs, Union(ctx, op, fldPath, in, oldIn, UnionMembershipForABC,
+//			func(in *ABC) bool { return in.A != nil },
+//			func(in *ABC) bool { return in.B != "" },
+//			func(in *ABC) bool { return in.C != 0 },
+//		)...)
+//		return errs
+//	}
+//
+// Note that T is "any", rather than "comparable", because union-members can be
+// slices, meaning T might be a struct with a slice, meaning it is not
+// comparable.
+func Union[T any](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj T, union *UnionMembership, isSetFns ...ExtractorFn[T, bool]) field.ErrorList {
+	options := UnionValidationOptions{
+		ErrorForEmpty: func(fldPath *field.Path, allFields []string) *field.Error {
+			return field.Invalid(fldPath, "",
+				fmt.Sprintf("must specify one of: %s", strings.Join(allFields, ", ")))
+		},
+		ErrorForMultiple: func(fldPath *field.Path, specifiedFields []string, allFields []string) *field.Error {
+			return field.Invalid(fldPath, fmt.Sprintf("{%s}", strings.Join(specifiedFields, ", ")),
+				fmt.Sprintf("must specify exactly one of: %s", strings.Join(allFields, ", ")))
+		},
+	}
+
+	return unionValidate(op, fldPath, obj, oldObj, union, options, isSetFns...).WithOrigin("union")
+}
+
+// DiscriminatedUnion verifies specified union member matches the discriminator.
+//
+// UnionMembership must define all the members of the union and the discriminator.
+//
+// For example:
+//
+//	var UnionMembershipForABC = validate.NewDiscriminatedUnionMembership("type",
+//	 	validate.NewDiscriminatedUnionMember("a", "A"),
+//	 	validate.NewDiscriminatedUnionMember("b", "B"),
+//	 	validate.NewDiscriminatedUnionMember("c", "C"),
+//	)
+//	func ValidateABC(ctx context.Context, op operation.Operation, fldPath *field.Path, in *ABC) (errs field.ErrorList) {
+//		errs = append(errs, DiscriminatedUnion(ctx, op, fldPath, in, oldIn, UnionMembershipForABC,
+//			func(in *ABC) string { return string(in.Type) },
+//			func(in *ABC) bool { return in.A != nil },
+//			func(in *ABC) bool { return in.B != "" },
+//			func(in *ABC) bool { return in.C != 0 },
+//		)...)
+//		return errs
+//	}
+//
+// It is not an error for the discriminatorValue to be unknown.  That must be
+// validated on its own.
+//
+// Note that T is "any", rather than "comparable", because union-members can be
+// slices, meaning T might be a struct with a slice, meaning it is not
+// comparable.
+func DiscriminatedUnion[T any, D ~string](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj T, union *UnionMembership, discriminatorExtractor ExtractorFn[T, D], isSetFns ...ExtractorFn[T, bool]) (errs field.ErrorList) {
+	if len(union.members) != len(isSetFns) {
+		return field.ErrorList{
+			field.InternalError(fldPath,
+				fmt.Errorf("number of extractors (%d) does not match number of union members (%d)",
+					len(isSetFns), len(union.members))),
+		}
+	}
+	hasOldValue := !reflect.ValueOf(oldObj).IsZero() // because T is any, rather than comparable
+	var changed bool
+	discriminatorValue := discriminatorExtractor(obj)
+	if op.Type == operation.Update {
+		oldDiscriminatorValue := discriminatorExtractor(oldObj)
+		changed = discriminatorValue != oldDiscriminatorValue
+	}
+
+	for i, fieldIsSet := range isSetFns {
+		member := union.members[i]
+		isDiscriminatedMember := string(discriminatorValue) == member.discriminatorValue
+		newIsSet := fieldIsSet(obj)
+		if op.Type == operation.Update && !changed {
+			oldIsSet := fieldIsSet(oldObj)
+			changed = changed || newIsSet != oldIsSet
+		}
+		if newIsSet && !isDiscriminatedMember {
+			errs = append(errs, field.Invalid(fldPath.Child(member.fieldName), "",
+				fmt.Sprintf("may only be specified when `%s` is %q", union.discriminatorName, member.discriminatorValue)))
+		} else if !newIsSet && isDiscriminatedMember {
+			errs = append(errs, field.Invalid(fldPath.Child(member.fieldName), "",
+				fmt.Sprintf("must be specified when `%s` is %q", union.discriminatorName, discriminatorValue)))
+		}
+	}
+	// If the union discriminator and membership is unchanged, we don't need to
+	// re-validate.
+	if op.Type == operation.Update && hasOldValue && !changed {
+		return nil
+	}
+	return errs.WithOrigin("union")
+}
+
+// UnionMember represents a member of a union.
+type UnionMember struct {
+	fieldName          string
+	discriminatorValue string
+}
+
+// NewUnionMember returns a new UnionMember for the given field name.
+func NewUnionMember(fieldName string) UnionMember {
+	return UnionMember{fieldName: fieldName}
+}
+
+// NewDiscriminatedUnionMember returns a new UnionMember for the given field
+// name and discriminator value.
+func NewDiscriminatedUnionMember(fieldName, discriminatorValue string) UnionMember {
+	return UnionMember{fieldName: fieldName, discriminatorValue: discriminatorValue}
+}
+
+// UnionMembership represents an ordered list of field union memberships.
+type UnionMembership struct {
+	discriminatorName string
+	members           []UnionMember
+}
+
+// NewUnionMembership returns a new UnionMembership for the given list of members.
+// Member names must be unique.
+func NewUnionMembership(member ...UnionMember) *UnionMembership {
+	return NewDiscriminatedUnionMembership("", member...)
+}
+
+// NewDiscriminatedUnionMembership returns a new UnionMembership for the given discriminator field and list of members.
+// members are provided in the same way as for NewUnionMembership.
+func NewDiscriminatedUnionMembership(discriminatorFieldName string, members ...UnionMember) *UnionMembership {
+	return &UnionMembership{
+		discriminatorName: discriminatorFieldName,
+		members:           members,
+	}
+}
+
+// allFields returns a string listing all the field names of the member of a union for use in error reporting.
+func (u UnionMembership) allFields() []string {
+	memberNames := make([]string, 0, len(u.members))
+	for _, f := range u.members {
+		memberNames = append(memberNames, fmt.Sprintf("`%s`", f.fieldName))
+	}
+	return memberNames
+}
+
+func unionValidate[T any](op operation.Operation, fldPath *field.Path,
+	obj, oldObj T, union *UnionMembership, options UnionValidationOptions, isSetFns ...ExtractorFn[T, bool],
+) field.ErrorList {
+	if len(union.members) != len(isSetFns) {
+		return field.ErrorList{
+			field.InternalError(fldPath,
+				fmt.Errorf("number of extractors (%d) does not match number of union members (%d)",
+					len(isSetFns), len(union.members))),
+		}
+	}
+
+	hasOldValue := !reflect.ValueOf(oldObj).IsZero() // because T is any, rather than comparable
+	var specifiedFields []string
+	var changed bool
+	for i, fieldIsSet := range isSetFns {
+		newIsSet := fieldIsSet(obj)
+		if op.Type == operation.Update && !changed {
+			oldIsSet := fieldIsSet(oldObj)
+			changed = changed || newIsSet != oldIsSet
+		}
+		if newIsSet {
+			specifiedFields = append(specifiedFields, union.members[i].fieldName)
+		}
+	}
+
+	// If the union membership is unchanged, we don't need to re-validate.
+	if op.Type == operation.Update && hasOldValue && !changed {
+		return nil
+	}
+
+	var errs field.ErrorList
+
+	if len(specifiedFields) > 1 && options.ErrorForMultiple != nil {
+		errs = append(errs, options.ErrorForMultiple(fldPath, specifiedFields, union.allFields()))
+	}
+
+	if len(specifiedFields) == 0 && options.ErrorForEmpty != nil {
+		errs = append(errs, options.ErrorForEmpty(fldPath, union.allFields()))
+	}
+
+	return errs
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/union_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/union_test.go
new file mode 100644
index 0000000000..4afc3f759d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/union_test.go
@@ -0,0 +1,485 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+type testMember struct{}
+
+func TestUnion(t *testing.T) {
+	testCases := []struct {
+		name        string
+		fields      []string
+		fieldValues []bool
+		expected    field.ErrorList
+	}{
+		{
+			name:        "one member set",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{false, false, false, true},
+			expected:    nil,
+		},
+		{
+			name:        "two members set",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{false, true, false, true},
+			expected:    field.ErrorList{field.Invalid(nil, "{b, d}", "must specify exactly one of: `a`, `b`, `c`, `d`")}.WithOrigin("union"),
+		},
+		{
+			name:        "all members set",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{true, true, true, true},
+			expected:    field.ErrorList{field.Invalid(nil, "{a, b, c, d}", "must specify exactly one of: `a`, `b`, `c`, `d`")}.WithOrigin("union"),
+		},
+		{
+			name:        "no member set",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{false, false, false, false},
+			expected:    field.ErrorList{field.Invalid(nil, "", "must specify one of: `a`, `b`, `c`, `d`")}.WithOrigin("union"),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			members := []UnionMember{}
+			for _, f := range tc.fields {
+				members = append(members, NewUnionMember(f))
+			}
+
+			t.Run("pointer", func(t *testing.T) {
+				// Create mock extractors that return predefined values instead of
+				// actually extracting from the object.
+				extractors := make([]ExtractorFn[*testMember, bool], len(tc.fieldValues))
+				for i, val := range tc.fieldValues {
+					extractors[i] = func(_ *testMember) bool { return val }
+				}
+
+				got := Union(context.Background(), operation.Operation{}, nil, &testMember{}, nil,
+					NewUnionMembership(members...), extractors...)
+				if !reflect.DeepEqual(got, tc.expected) {
+					t.Errorf("got %v want %v", got, tc.expected)
+				}
+			})
+			t.Run("value", func(t *testing.T) {
+				// Create mock extractors that return predefined values instead of
+				// actually extracting from the object.
+				extractors := make([]ExtractorFn[testMember, bool], len(tc.fieldValues))
+				for i, val := range tc.fieldValues {
+					extractors[i] = func(_ testMember) bool { return val }
+				}
+
+				got := Union(context.Background(), operation.Operation{}, nil, testMember{}, testMember{},
+					NewUnionMembership(members...), extractors...)
+				if !reflect.DeepEqual(got, tc.expected) {
+					t.Errorf("got %v want %v", got, tc.expected)
+				}
+			})
+		})
+	}
+}
+
+func TestDiscriminatedUnion(t *testing.T) {
+	testCases := []struct {
+		name               string
+		discriminatorField string
+		fields             [][2]string
+		discriminatorValue string
+		fieldValues        []bool
+		expected           field.ErrorList
+	}{
+		{
+			name:               "valid discriminated union A",
+			discriminatorField: "d",
+			fields:             [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			discriminatorValue: "A",
+			fieldValues:        []bool{true, false, false, false},
+		},
+		{
+			name:               "valid discriminated union C",
+			discriminatorField: "d",
+			fields:             [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			discriminatorValue: "C",
+			fieldValues:        []bool{false, false, true, false},
+		},
+		{
+			name:               "invalid, discriminator not set to member that is specified",
+			discriminatorField: "type",
+			fields:             [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			discriminatorValue: "C",
+			fieldValues:        []bool{false, true, false, false},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("b"), "", "may only be specified when `type` is \"B\""),
+				field.Invalid(field.NewPath("c"), "", "must be specified when `type` is \"C\""),
+			}.WithOrigin("union"),
+		},
+		{
+			name:               "invalid, discriminator correct, multiple members set",
+			discriminatorField: "type",
+			fields:             [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			discriminatorValue: "C",
+			fieldValues:        []bool{false, true, true, true},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("b"), "", "may only be specified when `type` is \"B\""),
+				field.Invalid(field.NewPath("d"), "", "may only be specified when `type` is \"D\""),
+			}.WithOrigin("union"),
+		},
+	}
+
+	for _, tc := range testCases {
+		members := []UnionMember{}
+		for _, f := range tc.fields {
+			members = append(members, NewDiscriminatedUnionMember(f[0], f[1]))
+		}
+
+		t.Run(tc.name, func(t *testing.T) {
+			t.Run("pointer", func(t *testing.T) {
+				discriminatorExtractor := func(_ *testMember) string { return tc.discriminatorValue }
+
+				// Create mock extractors that return predefined values instead of
+				// actually extracting from the object.
+				extractors := make([]ExtractorFn[*testMember, bool], len(tc.fieldValues))
+				for i, val := range tc.fieldValues {
+					extractors[i] = func(_ *testMember) bool { return val }
+				}
+
+				got := DiscriminatedUnion(context.Background(), operation.Operation{}, nil, &testMember{}, nil,
+					NewDiscriminatedUnionMembership(tc.discriminatorField, members...), discriminatorExtractor, extractors...)
+				if !reflect.DeepEqual(got, tc.expected) {
+					t.Errorf("got %v want %v", got.ToAggregate(), tc.expected.ToAggregate())
+				}
+			})
+			t.Run("value", func(t *testing.T) {
+				discriminatorExtractor := func(_ testMember) string { return tc.discriminatorValue }
+
+				// Create mock extractors that return predefined values instead of
+				// actually extracting from the object.
+				extractors := make([]ExtractorFn[testMember, bool], len(tc.fieldValues))
+				for i, val := range tc.fieldValues {
+					extractors[i] = func(_ testMember) bool { return val }
+				}
+
+				got := DiscriminatedUnion(context.Background(), operation.Operation{}, nil, testMember{}, testMember{},
+					NewDiscriminatedUnionMembership(tc.discriminatorField, members...), discriminatorExtractor, extractors...)
+				if !reflect.DeepEqual(got, tc.expected) {
+					t.Errorf("got %v want %v", got.ToAggregate(), tc.expected.ToAggregate())
+				}
+			})
+		})
+	}
+}
+
+type testStruct struct {
+	M1 *m1               `json:"m1"`
+	M2 *m2               `json:"m2"`
+	M3 []string          `json:"m3"`
+	M4 map[string]string `json:"m4"`
+}
+
+type m1 struct{}
+type m2 struct{}
+
+var extractors = []ExtractorFn[*testStruct, bool]{
+	func(s *testStruct) bool {
+		if s == nil {
+			return false
+		}
+		return s.M1 != nil
+	},
+	func(s *testStruct) bool {
+		if s == nil {
+			return false
+		}
+		return s.M2 != nil
+	},
+	func(s *testStruct) bool {
+		if s == nil {
+			return false
+		}
+		return len(s.M3) != 0
+	},
+	func(s *testStruct) bool {
+		if s == nil {
+			return false
+		}
+		return len(s.M4) != 0
+	},
+}
+
+func TestUnionRatcheting(t *testing.T) {
+	testCases := []struct {
+		name      string
+		oldStruct *testStruct
+		newStruct *testStruct
+		expected  field.ErrorList
+	}{
+		{
+			name:      "old nil - no ratcheting",
+			oldStruct: nil,
+			newStruct: &testStruct{},
+			expected: field.ErrorList{
+				field.Invalid(nil, "", "must specify one of: `m1`, `m2`, `m3`, `m4`"),
+			}.WithOrigin("union"),
+		},
+		{
+			name:      "both empty struct",
+			oldStruct: &testStruct{},
+			newStruct: &testStruct{},
+		},
+		{
+			name: "both have more than one member",
+			oldStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+			newStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+		},
+		{
+			name: "change to invalid",
+			oldStruct: &testStruct{
+				M1: &m1{},
+			},
+			newStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(nil, "{m1, m2}", "must specify exactly one of: `m1`, `m2`, `m3`, `m4`"),
+			}.WithOrigin("union"),
+		},
+		{
+			name:      "slice member ratcheting: unchanged membership",
+			oldStruct: &testStruct{M3: []string{"a"}},
+			newStruct: &testStruct{M3: []string{"b"}},
+		},
+		{
+			name:      "map member ratcheting: unchanged membership",
+			oldStruct: &testStruct{M4: map[string]string{"k": "v1"}},
+			newStruct: &testStruct{M4: map[string]string{"k": "v2"}},
+		},
+		{
+			name:      "empty slice is not set",
+			oldStruct: nil,
+			newStruct: &testStruct{M3: []string{}},
+			expected: field.ErrorList{
+				field.Invalid(nil, "", "must specify one of: `m1`, `m2`, `m3`, `m4`"),
+			}.WithOrigin("union"),
+		},
+		{
+			name:      "empty map is not set",
+			oldStruct: nil,
+			newStruct: &testStruct{M4: map[string]string{}},
+			expected: field.ErrorList{
+				field.Invalid(nil, "", "must specify one of: `m1`, `m2`, `m3`, `m4`"),
+			}.WithOrigin("union"),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			members := []UnionMember{NewUnionMember("m1"), NewUnionMember("m2"), NewUnionMember("m3"), NewUnionMember("m4")}
+			got := Union(context.Background(), operation.Operation{Type: operation.Update}, nil, tc.newStruct, tc.oldStruct,
+				NewUnionMembership(members...), extractors...)
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
+
+type testDiscriminatedStruct struct {
+	D  string            `json:"d"`
+	M1 *m1               `json:"m1"`
+	M2 *m2               `json:"m2"`
+	M3 []string          `json:"m3"`
+	M4 map[string]string `json:"m4"`
+}
+
+var testDiscriminatorExtractor = func(s *testDiscriminatedStruct) string {
+	if s != nil {
+		return s.D
+	}
+	return ""
+}
+var testDiscriminatedExtractors = []ExtractorFn[*testDiscriminatedStruct, bool]{
+	func(s *testDiscriminatedStruct) bool {
+		if s == nil {
+			return false
+		}
+		return s.M1 != nil
+	},
+	func(s *testDiscriminatedStruct) bool {
+		if s == nil {
+			return false
+		}
+		return s.M2 != nil
+	},
+	func(s *testDiscriminatedStruct) bool {
+		if s == nil {
+			return false
+		}
+		return len(s.M3) != 0
+	},
+	func(s *testDiscriminatedStruct) bool {
+		if s == nil {
+			return false
+		}
+		return len(s.M4) != 0
+	},
+}
+
+func TestDiscriminatedUnionRatcheting(t *testing.T) {
+	testCases := []struct {
+		name      string
+		oldStruct *testDiscriminatedStruct
+		newStruct *testDiscriminatedStruct
+		expected  field.ErrorList
+	}{
+		{
+			name: "pass with both nil",
+		},
+		{
+			name:      "pass with both empty struct",
+			oldStruct: &testDiscriminatedStruct{},
+			newStruct: &testDiscriminatedStruct{},
+		},
+		{
+			name: "pass with both not set to member that is specified",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M2: &m2{},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M2: &m2{},
+			},
+		},
+		{
+			name: "pass with both set to more than one member",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M1: &m1{},
+				M2: &m2{},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M1: &m1{},
+				M2: &m2{},
+			},
+		},
+		{
+			name: "fail on changing to invalid with both set",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M1: &m1{},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M1: &m1{},
+				M2: &m2{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("m2"), "", "may only be specified when `d` is \"m2\""),
+			}.WithOrigin("union"),
+		},
+		{
+			name: "fail on changing the discriminator",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M1: &m1{},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m2",
+				M1: &m1{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("m1"), "", "may only be specified when `d` is \"m1\""),
+				field.Invalid(field.NewPath("m2"), "", "must be specified when `d` is \"m2\""),
+			}.WithOrigin("union"),
+		},
+		{
+			name: "slice member ratcheting: unchanged membership",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m3",
+				M3: []string{"a"},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m3",
+				M3: []string{"b"},
+			},
+		},
+		{
+			name: "map member ratcheting: unchanged membership",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m4",
+				M4: map[string]string{"k": "v1"},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m4",
+				M4: map[string]string{"k": "v2"},
+			},
+		},
+		{
+			name: "empty slice is not set",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m3",
+				M3: []string{"a"},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m3",
+				M3: []string{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("m3"), "", "must be specified when `d` is \"m3\""),
+			}.WithOrigin("union"),
+		},
+		{
+			name: "empty map is not set",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m4",
+				M4: map[string]string{"k": "v"},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m4",
+				M4: map[string]string{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("m4"), "", "must be specified when `d` is \"m4\""),
+			}.WithOrigin("union"),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			members := []UnionMember{NewDiscriminatedUnionMember("m1", "m1"), NewDiscriminatedUnionMember("m2", "m2"), NewDiscriminatedUnionMember("m3", "m3"), NewDiscriminatedUnionMember("m4", "m4")}
+			got := DiscriminatedUnion(context.Background(), operation.Operation{Type: operation.Update}, nil, tc.newStruct, tc.oldStruct,
+				NewDiscriminatedUnionMembership("d", members...), testDiscriminatorExtractor, testDiscriminatedExtractors...)
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/update.go b/third_party/k8s.io/apimachinery/pkg/api/validate/update.go
new file mode 100644
index 0000000000..cf4db5b529
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/update.go
@@ -0,0 +1,289 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"slices"
+
+	"k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// UpdateConstraint represents a constraint on update operations
+type UpdateConstraint int
+
+const (
+	// NoSet prevents unset->set transitions
+	NoSet UpdateConstraint = iota
+	// NoUnset prevents set->unset transitions
+	NoUnset
+	// NoModify prevents value changes but allows set/unset transitions
+	NoModify
+	// NoAddItem prevents adding items to a slice or map
+	NoAddItem
+	// NoRemoveItem prevents removing items from a slice or map
+	NoRemoveItem
+)
+
+// UpdateValue verifies update constraints for value types.
+func UpdateValue[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, equiv MatchFunc[T], constraints ...UpdateConstraint) field.ErrorList {
+	// nil oldValue means no prior value to compare against (eg: a new item at +k8s:eachVal scope) -> no transition to check.
+	if op.Type != operation.Update || oldValue == nil {
+		return nil
+	}
+
+	var errs field.ErrorList
+	var zero T
+	valueIsZero := equiv(*value, zero)
+	oldValueIsZero := equiv(*oldValue, zero)
+
+	for _, constraint := range constraints {
+		switch constraint {
+		case NoSet:
+			if oldValueIsZero && !valueIsZero {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+			}
+		case NoUnset:
+			if !oldValueIsZero && valueIsZero {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+			}
+		case NoModify:
+			// Rely on validation ratcheting to detect that the value has changed.
+			// This check only verifies that the field was set in both the old and
+			// new objects, confirming it was a modification, not a set/unset.
+			if !oldValueIsZero && !valueIsZero {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be modified once set").WithOrigin("update"))
+			}
+		}
+	}
+
+	return errs
+}
+
+// UpdateValueByCompare verifies update constraints for comparable value types.
+//
+// Deprecated: Use UpdateValue instead.
+func UpdateValueByCompare[T comparable](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+	return UpdateValue(ctx, op, fldPath, value, oldValue, func(a, b T) bool { return a == b }, constraints...)
+}
+
+// UpdatePointer verifies update constraints for pointer types.
+func UpdatePointer[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+
+	var errs field.ErrorList
+
+	for _, constraint := range constraints {
+		switch constraint {
+		case NoSet:
+			if oldValue == nil && value != nil {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+			}
+		case NoUnset:
+			if oldValue != nil && value == nil {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+			}
+		case NoModify:
+			// Rely on validation ratcheting to detect that the value has changed.
+			// This check only verifies that the field was non-nil in both the old
+			// and new objects, confirming it was a modification, not a set/unset.
+			if oldValue != nil && value != nil {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be modified once set").WithOrigin("update"))
+			}
+		}
+	}
+
+	return errs
+}
+
+// UpdateValueByReflect verifies update constraints for non-comparable value types using reflection.
+//
+// Deprecated: Use UpdateValue instead.
+func UpdateValueByReflect[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+	return UpdateValue(ctx, op, fldPath, value, oldValue, func(a, b T) bool { return equality.Semantic.DeepEqual(a, b) }, constraints...)
+}
+
+// UpdateStruct verifies update constraints for non-pointer struct types.
+// Non-pointer structs are always considered "set" and never "unset".
+func UpdateStruct[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+	// nil oldValue means no prior value to compare against (eg: a new item at +k8s:eachVal scope) -> no transition to check.
+	if op.Type != operation.Update || oldValue == nil {
+		return nil
+	}
+
+	var errs field.ErrorList
+
+	for _, constraint := range constraints {
+		switch constraint {
+		case NoSet, NoUnset:
+			// These constraints don't apply to non-pointer structs
+			// as they can't be unset. This should be caught at generation time.
+			continue
+		case NoModify:
+			// Non-pointer structs are always considered "set". Therefore, any
+			// change detected by validation ratcheting is a modification.
+			// The deep equality check is redundant and has been removed.
+			errs = append(errs, field.Invalid(fldPath, nil, "field cannot be modified once set").WithOrigin("update"))
+		}
+	}
+
+	return errs
+}
+
+// ValSliceUpdate verifies update constraints for slices of values.
+// NoAddItem and NoRemoveItem use the match function to find corresponding
+// elements between value and oldValue. NoSet and NoUnset treat len == 0 as
+// "unset".
+//
+// The match function will never be called with nil arguments.
+func ValSliceUpdate[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue []T, match MatchFunc[*T], constraints ...UpdateConstraint) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+
+	if match == nil && (slices.Contains(constraints, NoAddItem) || slices.Contains(constraints, NoRemoveItem)) {
+		return field.ErrorList{field.InternalError(fldPath, fmt.Errorf("ValSliceUpdate: NoAddItem/NoRemoveItem require a non-nil match function"))}
+	}
+
+	var errs field.ErrorList
+
+	for _, constraint := range constraints {
+		switch constraint {
+		case NoSet:
+			if len(oldValue) == 0 && len(value) > 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+			}
+		case NoUnset:
+			if len(oldValue) > 0 && len(value) == 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+			}
+		case NoAddItem:
+			for i := range value {
+				newItem := &value[i]
+				if lookup(oldValue, newItem, match) == nil {
+					errs = append(errs, field.Forbidden(fldPath.Index(i), "item may not be added").WithOrigin("update"))
+				}
+			}
+		case NoRemoveItem:
+			for i := range oldValue {
+				oldItem := &oldValue[i]
+				if lookup(value, oldItem, match) == nil {
+					errs = append(errs, field.Forbidden(fldPath, "item may not be removed").WithOrigin("update"))
+				}
+			}
+		}
+	}
+
+	return errs
+}
+
+// PtrSliceUpdate verifies update constraints for slices of pointers.
+// NoAddItem and NoRemoveItem use the match function to find corresponding
+// elements between value and oldValue. NoSet and NoUnset treat len == 0 as
+// "unset".
+//
+// The match function will never be called with nil arguments.
+func PtrSliceUpdate[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue []*T, match MatchFunc[*T], constraints ...UpdateConstraint) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+
+	if match == nil && (slices.Contains(constraints, NoAddItem) || slices.Contains(constraints, NoRemoveItem)) {
+		return field.ErrorList{field.InternalError(fldPath, fmt.Errorf("PtrSliceUpdate: NoAddItem/NoRemoveItem require a non-nil match function"))}
+	}
+
+	var errs field.ErrorList
+
+	for _, constraint := range constraints {
+		switch constraint {
+		case NoSet:
+			if len(oldValue) == 0 && len(value) > 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+			}
+		case NoUnset:
+			if len(oldValue) > 0 && len(value) == 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+			}
+		case NoAddItem:
+			for i := range value {
+				newItem := value[i]
+				if newItem == nil {
+					// Ignore nil items; they are supposed to have been checked by PtrSliceNoNils.
+					continue
+				}
+				if lookupPointer(oldValue, newItem, match) == nil {
+					errs = append(errs, field.Forbidden(fldPath.Index(i), "item may not be added").WithOrigin("update"))
+				}
+			}
+		case NoRemoveItem:
+			for i := range oldValue {
+				oldItem := oldValue[i]
+				if oldItem == nil {
+					continue
+				}
+				if lookupPointer(value, oldItem, match) == nil {
+					errs = append(errs, field.Forbidden(fldPath, "item may not be removed").WithOrigin("update"))
+				}
+			}
+		}
+	}
+
+	return errs
+}
+
+// UpdateMap verifies update constraints for map types.
+// NoAddItem and NoRemoveItem compare keys between value and oldValue. NoSet
+// and NoUnset treat len == 0 as "unset".
+func UpdateMap[K comparable, V any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue map[K]V, constraints ...UpdateConstraint) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+
+	var errs field.ErrorList
+
+	for _, constraint := range constraints {
+		switch constraint {
+		case NoSet:
+			if len(oldValue) == 0 && len(value) > 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+			}
+		case NoUnset:
+			if len(oldValue) > 0 && len(value) == 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+			}
+		case NoAddItem:
+			for k := range value {
+				if _, ok := oldValue[k]; !ok {
+					errs = append(errs, field.Forbidden(fldPath.Key(fmt.Sprintf("%v", k)), "item may not be added").WithOrigin("update"))
+				}
+			}
+		case NoRemoveItem:
+			for k := range oldValue {
+				if _, ok := value[k]; !ok {
+					errs = append(errs, field.Forbidden(fldPath.Key(fmt.Sprintf("%v", k)), "item may not be removed").WithOrigin("update"))
+				}
+			}
+		}
+	}
+
+	return errs
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/update_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/update_test.go
new file mode 100644
index 0000000000..1978ced8d7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/update_test.go
@@ -0,0 +1,928 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestUpdateValue(t *testing.T) {
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       string
+		oldValue    string
+		constraints []UpdateConstraint
+		wantErrs    int
+		wantMsgs    []string
+	}{
+		{
+			name:        "create operation - no validation",
+			op:          operation.Create,
+			value:       "value",
+			oldValue:    "",
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoSet - unset to set transition (forbidden)",
+			op:          operation.Update,
+			value:       "value",
+			oldValue:    "",
+			constraints: []UpdateConstraint{NoSet},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoSet - set to set transition (allowed)",
+			op:          operation.Update,
+			value:       "value2",
+			oldValue:    "value1",
+			constraints: []UpdateConstraint{NoSet},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoUnset - set to unset transition (forbidden)",
+			op:          operation.Update,
+			value:       "",
+			oldValue:    "value",
+			constraints: []UpdateConstraint{NoUnset},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "NoUnset - unset to set transition (allowed)",
+			op:          operation.Update,
+			value:       "value",
+			oldValue:    "",
+			constraints: []UpdateConstraint{NoUnset},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - set to different value (forbidden)",
+			op:          operation.Update,
+			value:       "value2",
+			oldValue:    "value1",
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+		{
+			name:        "NoModify - unset to set transition (allowed)",
+			op:          operation.Update,
+			value:       "value",
+			oldValue:    "",
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - set to unset transition (allowed)",
+			op:          operation.Update,
+			value:       "",
+			oldValue:    "value",
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "Multiple constraints - NoSet and NoUnset",
+			op:          operation.Update,
+			value:       "value",
+			oldValue:    "",
+			constraints: []UpdateConstraint{NoSet, NoUnset},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be set once created"},
+		},
+		{
+			name:        "Multiple constraints - NoUnset and NoModify",
+			op:          operation.Update,
+			value:       "",
+			oldValue:    "value",
+			constraints: []UpdateConstraint{NoUnset, NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "Multiple constraints - NoSet, NoUnset, NoModify - modify attempt",
+			op:          operation.Update,
+			value:       "value2",
+			oldValue:    "value1",
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+		{
+			name:        "No constraints",
+			op:          operation.Update,
+			value:       "value2",
+			oldValue:    "value1",
+			constraints: []UpdateConstraint{},
+			wantErrs:    0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := UpdateValue(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, func(a, b string) bool { return a == b }, tt.constraints...)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("UpdateValue() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
+			}
+			for i, msg := range tt.wantMsgs {
+				if i >= len(errs) {
+					t.Errorf("Expected error message %q not found", msg)
+					continue
+				}
+				if errs[i].Detail != msg {
+					t.Errorf("UpdateValue() error message = %q, want %q", errs[i].Detail, msg)
+				}
+			}
+		})
+	}
+}
+
+func TestUpdateValueByCompare(t *testing.T) {
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       string
+		oldValue    string
+		constraints []UpdateConstraint
+		wantErrs    int
+		wantMsgs    []string
+	}{
+		{
+			name:        "NoSet - unset to set transition (forbidden)",
+			op:          operation.Update,
+			value:       "value",
+			oldValue:    "",
+			constraints: []UpdateConstraint{NoSet},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoUnset - set to unset transition (forbidden)",
+			op:          operation.Update,
+			value:       "",
+			oldValue:    "value",
+			constraints: []UpdateConstraint{NoUnset},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "NoModify - set to different value (forbidden)",
+			op:          operation.Update,
+			value:       "value2",
+			oldValue:    "value1",
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := UpdateValueByCompare(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, tt.constraints...)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("UpdateValueByCompare() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
+			}
+			for i, msg := range tt.wantMsgs {
+				if i >= len(errs) {
+					t.Errorf("Expected error message %q not found", msg)
+					continue
+				}
+				if errs[i].Detail != msg {
+					t.Errorf("UpdateValueByCompare() error message = %q, want %q", errs[i].Detail, msg)
+				}
+			}
+		})
+	}
+}
+
+func TestUpdateValue_CustomMatchFunc(t *testing.T) {
+	type NonComparableStruct struct {
+		Name string
+		Tags []string
+	}
+
+	customEquiv := func(a, b NonComparableStruct) bool {
+		return a.Name == b.Name && (len(a.Tags) == 0 && len(b.Tags) == 0 || (len(a.Tags) == len(b.Tags) && a.Tags[0] == b.Tags[0]))
+	}
+
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       NonComparableStruct
+		oldValue    NonComparableStruct
+		constraints []UpdateConstraint
+		wantErrs    int
+		wantMsgs    []string
+	}{
+		{
+			name:        "NoSet - unset to set (forbidden)",
+			op:          operation.Update,
+			value:       NonComparableStruct{Name: "foo", Tags: []string{"a"}},
+			oldValue:    NonComparableStruct{},
+			constraints: []UpdateConstraint{NoSet},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoUnset - set to unset (forbidden)",
+			op:          operation.Update,
+			value:       NonComparableStruct{},
+			oldValue:    NonComparableStruct{Name: "foo", Tags: []string{"a"}},
+			constraints: []UpdateConstraint{NoUnset},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "NoModify - zero to non-zero transition (allowed)",
+			op:          operation.Update,
+			value:       NonComparableStruct{Name: "foo", Tags: []string{"a"}},
+			oldValue:    NonComparableStruct{},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - non-zero to zero transition (allowed)",
+			op:          operation.Update,
+			value:       NonComparableStruct{},
+			oldValue:    NonComparableStruct{Name: "foo", Tags: []string{"a"}},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - non-zero to non-zero transition (forbidden)",
+			op:          operation.Update,
+			value:       NonComparableStruct{Name: "foo", Tags: []string{"b"}},
+			oldValue:    NonComparableStruct{Name: "foo", Tags: []string{"a"}},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := UpdateValue(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, customEquiv, tt.constraints...)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("UpdateValue() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
+			}
+			for i, msg := range tt.wantMsgs {
+				if i >= len(errs) {
+					t.Errorf("Expected error message %q not found", msg)
+					continue
+				}
+				if errs[i].Detail != msg {
+					t.Errorf("UpdateValue() error message = %q, want %q", errs[i].Detail, msg)
+				}
+			}
+		})
+	}
+}
+
+func TestUpdatePointer(t *testing.T) {
+	stringPtr := func(s string) *string { return &s }
+
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       *string
+		oldValue    *string
+		constraints []UpdateConstraint
+		wantErrs    int
+		wantMsgs    []string
+	}{
+		{
+			name:        "create operation - no validation",
+			op:          operation.Create,
+			value:       stringPtr("value"),
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoSet - nil to non-nil transition (forbidden)",
+			op:          operation.Update,
+			value:       stringPtr("value"),
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoSet - non-nil to non-nil transition (allowed)",
+			op:          operation.Update,
+			value:       stringPtr("value2"),
+			oldValue:    stringPtr("value1"),
+			constraints: []UpdateConstraint{NoSet},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoUnset - non-nil to nil transition (forbidden)",
+			op:          operation.Update,
+			value:       nil,
+			oldValue:    stringPtr("value"),
+			constraints: []UpdateConstraint{NoUnset},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "NoUnset - nil to non-nil transition (allowed)",
+			op:          operation.Update,
+			value:       stringPtr("value"),
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoUnset},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - different values (forbidden)",
+			op:          operation.Update,
+			value:       stringPtr("value2"),
+			oldValue:    stringPtr("value1"),
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+		{
+			name:        "NoModify - nil to non-nil transition (allowed)",
+			op:          operation.Update,
+			value:       stringPtr("value"),
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - non-nil to nil transition (allowed)",
+			op:          operation.Update,
+			value:       nil,
+			oldValue:    stringPtr("value"),
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "Multiple constraints - all three",
+			op:          operation.Update,
+			value:       stringPtr("value2"),
+			oldValue:    stringPtr("value1"),
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := UpdatePointer(context.TODO(), op, field.NewPath("test"), tt.value, tt.oldValue, tt.constraints...)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("UpdatePointer() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
+			}
+			for i, msg := range tt.wantMsgs {
+				if i >= len(errs) {
+					t.Errorf("Expected error message %q not found", msg)
+					continue
+				}
+				if errs[i].Detail != msg {
+					t.Errorf("UpdatePointer() error message = %q, want %q", errs[i].Detail, msg)
+				}
+			}
+		})
+	}
+}
+
+func TestUpdateValueByReflect(t *testing.T) {
+	type CustomStruct struct {
+		Field1 string
+		Field2 int
+	}
+
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       CustomStruct
+		oldValue    CustomStruct
+		constraints []UpdateConstraint
+		wantErrs    int
+		wantMsgs    []string
+	}{
+		{
+			name:        "NoModify - zero to non-zero transition (allowed)",
+			op:          operation.Update,
+			value:       CustomStruct{Field1: "test", Field2: 42},
+			oldValue:    CustomStruct{},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - non-zero to zero transition (allowed)",
+			op:          operation.Update,
+			value:       CustomStruct{},
+			oldValue:    CustomStruct{Field1: "test", Field2: 42},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - different values (forbidden)",
+			op:          operation.Update,
+			value:       CustomStruct{Field1: "test2", Field2: 100},
+			oldValue:    CustomStruct{Field1: "test1", Field2: 42},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+		{
+			name:        "NoSet - zero to non-zero (forbidden)",
+			op:          operation.Update,
+			value:       CustomStruct{Field1: "test", Field2: 42},
+			oldValue:    CustomStruct{},
+			constraints: []UpdateConstraint{NoSet},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoUnset - non-zero to zero (forbidden)",
+			op:          operation.Update,
+			value:       CustomStruct{},
+			oldValue:    CustomStruct{Field1: "test", Field2: 42},
+			constraints: []UpdateConstraint{NoUnset},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "Multiple constraints",
+			op:          operation.Update,
+			value:       CustomStruct{Field1: "test", Field2: 42},
+			oldValue:    CustomStruct{},
+			constraints: []UpdateConstraint{NoSet, NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be set once created"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := UpdateValueByReflect(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, tt.constraints...)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("UpdateValueByReflect() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
+			}
+			for i, msg := range tt.wantMsgs {
+				if i >= len(errs) {
+					t.Errorf("Expected error message %q not found", msg)
+					continue
+				}
+				if errs[i].Detail != msg {
+					t.Errorf("UpdateValueByReflect() error message = %q, want %q", errs[i].Detail, msg)
+				}
+			}
+		})
+	}
+}
+
+func TestUpdateStruct(t *testing.T) {
+	type TestStruct struct {
+		Field1 string
+		Field2 int
+	}
+
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       TestStruct
+		oldValue    TestStruct
+		constraints []UpdateConstraint
+		wantErrs    int
+		wantMsgs    []string
+	}{
+		{
+			name:        "create operation - no validation",
+			op:          operation.Create,
+			value:       TestStruct{Field1: "test", Field2: 42},
+			oldValue:    TestStruct{},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    0,
+		},
+		{
+			name:        "NoModify - different values (forbidden)",
+			op:          operation.Update,
+			value:       TestStruct{Field1: "test2", Field2: 100},
+			oldValue:    TestStruct{Field1: "test1", Field2: 42},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+		{
+			name:        "NoModify - zero value to non-zero (forbidden)",
+			op:          operation.Update,
+			value:       TestStruct{Field1: "test", Field2: 42},
+			oldValue:    TestStruct{},
+			constraints: []UpdateConstraint{NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+		{
+			name:        "NoSet and NoUnset with modification - only NoModify triggers",
+			op:          operation.Update,
+			value:       TestStruct{Field1: "test2", Field2: 100},
+			oldValue:    TestStruct{Field1: "test1", Field2: 42},
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoModify},
+			wantErrs:    1,
+			wantMsgs:    []string{"field cannot be modified once set"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := UpdateStruct(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, tt.constraints...)
+			if len(errs) != tt.wantErrs {
+				t.Errorf("UpdateStruct() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
+			}
+			for i, msg := range tt.wantMsgs {
+				if i >= len(errs) {
+					t.Errorf("Expected error message %q not found", msg)
+					continue
+				}
+				if errs[i].Detail != msg {
+					t.Errorf("UpdateStruct() error message = %q, want %q", errs[i].Detail, msg)
+				}
+			}
+		})
+	}
+}
+
+func TestValSliceUpdate(t *testing.T) {
+	type keyed struct {
+		Name  string
+		Value string
+	}
+	keyMatch := func(a, b *keyed) bool { return a.Name == b.Name }
+
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       []string
+		oldValue    []string
+		match       MatchFunc[*string]
+		constraints []UpdateConstraint
+		wantDetails []string
+	}{
+		{
+			name:        "create operation - no validation",
+			op:          operation.Create,
+			value:       []string{"a"},
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoAddItem, NoRemoveItem},
+			match:       DirectEqual[string],
+		},
+		{
+			name:        "NoSet nil to non-empty (forbidden)",
+			op:          operation.Update,
+			value:       []string{"a"},
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet},
+			wantDetails: []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoSet empty to non-empty (forbidden)",
+			op:          operation.Update,
+			value:       []string{"a"},
+			oldValue:    []string{},
+			constraints: []UpdateConstraint{NoSet},
+			wantDetails: []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoSet non-empty to non-empty (allowed)",
+			op:          operation.Update,
+			value:       []string{"a", "b"},
+			oldValue:    []string{"a"},
+			constraints: []UpdateConstraint{NoSet},
+		},
+		{
+			name:        "NoUnset non-empty to nil (forbidden)",
+			op:          operation.Update,
+			value:       nil,
+			oldValue:    []string{"a"},
+			constraints: []UpdateConstraint{NoUnset},
+			wantDetails: []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "NoUnset non-empty to empty (forbidden)",
+			op:          operation.Update,
+			value:       []string{},
+			oldValue:    []string{"a"},
+			constraints: []UpdateConstraint{NoUnset},
+			wantDetails: []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "NoAddItem direct-equal item added",
+			op:          operation.Update,
+			value:       []string{"a", "b", "c"},
+			oldValue:    []string{"a", "c"},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoAddItem},
+			wantDetails: []string{"item may not be added"},
+		},
+		{
+			name:        "NoAddItem direct-equal reorder allowed",
+			op:          operation.Update,
+			value:       []string{"c", "a", "b"},
+			oldValue:    []string{"a", "b", "c"},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoAddItem},
+		},
+		{
+			name:        "NoRemoveItem direct-equal item removed",
+			op:          operation.Update,
+			value:       []string{"a"},
+			oldValue:    []string{"a", "b"},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoRemoveItem},
+			wantDetails: []string{"item may not be removed"},
+		},
+		{
+			name:        "NoAddItem + NoRemoveItem frozen shape (allowed)",
+			op:          operation.Update,
+			value:       []string{"a", "b"},
+			oldValue:    []string{"b", "a"},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoAddItem, NoRemoveItem},
+		},
+		{
+			name:        "NoAddItem + NoRemoveItem one added one removed",
+			op:          operation.Update,
+			value:       []string{"a", "c"},
+			oldValue:    []string{"a", "b"},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoAddItem, NoRemoveItem},
+			wantDetails: []string{
+				"item may not be added",
+				"item may not be removed",
+			},
+		},
+		{
+			name:        "NoAddItem + NoRemoveItem combined with NoUnset",
+			op:          operation.Update,
+			value:       nil,
+			oldValue:    []string{"a"},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoUnset, NoAddItem, NoRemoveItem},
+			wantDetails: []string{
+				"field cannot be cleared once set",
+				"item may not be removed",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := ValSliceUpdate(context.TODO(), op, field.NewPath("test"), tt.value, tt.oldValue, tt.match, tt.constraints...)
+			if len(errs) != len(tt.wantDetails) {
+				t.Fatalf("ValSliceUpdate() returned %d errors, want %d: %v", len(errs), len(tt.wantDetails), errs)
+			}
+			for i, want := range tt.wantDetails {
+				if errs[i].Detail != want {
+					t.Errorf("ValSliceUpdate() error[%d] = %q, want %q", i, errs[i].Detail, want)
+				}
+				if errs[i].Origin != "update" {
+					t.Errorf("ValSliceUpdate() error[%d] origin = %q, want %q", i, errs[i].Origin, "update")
+				}
+			}
+		})
+	}
+
+	// Keyed-match case: matching by the Name field only. Modifying the Value
+	// of a keyed item should not trigger either NoAddItem or NoRemoveItem
+	// (that check belongs to eachVal + NoModify).
+	t.Run("NoAddItem+NoRemoveItem keyed match allows item modification", func(t *testing.T) {
+		op := operation.Operation{Type: operation.Update}
+		newList := []keyed{{Name: "alpha", Value: "v2"}, {Name: "beta", Value: "v1"}}
+		oldList := []keyed{{Name: "alpha", Value: "v1"}, {Name: "beta", Value: "v1"}}
+		errs := ValSliceUpdate(context.TODO(), op, field.NewPath("test"), newList, oldList, keyMatch, NoAddItem, NoRemoveItem)
+		if len(errs) != 0 {
+			t.Errorf("expected no errors for keyed-match item modification, got %v", errs)
+		}
+	})
+
+	t.Run("NoAddItem+NoRemoveItem keyed match reports add and remove by key", func(t *testing.T) {
+		op := operation.Operation{Type: operation.Update}
+		newList := []keyed{{Name: "alpha"}, {Name: "gamma"}}
+		oldList := []keyed{{Name: "alpha"}, {Name: "beta"}}
+		errs := ValSliceUpdate(context.TODO(), op, field.NewPath("test"), newList, oldList, keyMatch, NoAddItem, NoRemoveItem)
+		if len(errs) != 2 {
+			t.Fatalf("expected 2 errors, got %d: %v", len(errs), errs)
+		}
+	})
+
+	t.Run("NoAddItem without match returns internal error", func(t *testing.T) {
+		op := operation.Operation{Type: operation.Update}
+		errs := ValSliceUpdate[string](context.TODO(), op, field.NewPath("test"), []string{"a"}, nil, nil, NoAddItem)
+		if len(errs) != 1 || errs[0].Type != field.ErrorTypeInternal {
+			t.Errorf("expected single InternalError, got %v", errs)
+		}
+	})
+}
+
+func TestUpdateMap(t *testing.T) {
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       map[string]string
+		oldValue    map[string]string
+		constraints []UpdateConstraint
+		wantDetails []string
+	}{
+		{
+			name:        "create operation - no validation",
+			op:          operation.Create,
+			value:       map[string]string{"a": "1"},
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoAddItem, NoRemoveItem},
+		},
+		{
+			name:        "NoSet nil to non-empty (forbidden)",
+			op:          operation.Update,
+			value:       map[string]string{"a": "1"},
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet},
+			wantDetails: []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoUnset non-empty to empty (forbidden)",
+			op:          operation.Update,
+			value:       map[string]string{},
+			oldValue:    map[string]string{"a": "1"},
+			constraints: []UpdateConstraint{NoUnset},
+			wantDetails: []string{"field cannot be cleared once set"},
+		},
+		{
+			name:        "NoAddItem key added",
+			op:          operation.Update,
+			value:       map[string]string{"a": "1", "b": "2"},
+			oldValue:    map[string]string{"a": "1"},
+			constraints: []UpdateConstraint{NoAddItem},
+			wantDetails: []string{"item may not be added"},
+		},
+		{
+			name:        "NoAddItem value-only change allowed",
+			op:          operation.Update,
+			value:       map[string]string{"a": "2"},
+			oldValue:    map[string]string{"a": "1"},
+			constraints: []UpdateConstraint{NoAddItem},
+		},
+		{
+			name:        "NoRemoveItem key removed",
+			op:          operation.Update,
+			value:       map[string]string{"a": "1"},
+			oldValue:    map[string]string{"a": "1", "b": "2"},
+			constraints: []UpdateConstraint{NoRemoveItem},
+			wantDetails: []string{"item may not be removed"},
+		},
+		{
+			name:        "NoAddItem + NoRemoveItem stable keys allowed",
+			op:          operation.Update,
+			value:       map[string]string{"a": "1", "b": "22"},
+			oldValue:    map[string]string{"a": "11", "b": "2"},
+			constraints: []UpdateConstraint{NoAddItem, NoRemoveItem},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := UpdateMap(context.TODO(), op, field.NewPath("test"), tt.value, tt.oldValue, tt.constraints...)
+			if len(errs) != len(tt.wantDetails) {
+				t.Fatalf("UpdateMap() returned %d errors, want %d: %v", len(errs), len(tt.wantDetails), errs)
+			}
+			for i, want := range tt.wantDetails {
+				if errs[i].Detail != want {
+					t.Errorf("UpdateMap() error[%d] = %q, want %q", i, errs[i].Detail, want)
+				}
+				if errs[i].Origin != "update" {
+					t.Errorf("UpdateMap() error[%d] origin = %q, want %q", i, errs[i].Origin, "update")
+				}
+			}
+		})
+	}
+}
+
+func TestPtrSliceUpdate(t *testing.T) {
+	type keyed struct {
+		Name  string
+		Value string
+	}
+	keyMatch := func(a, b *keyed) bool { return a.Name == b.Name }
+
+	tests := []struct {
+		name        string
+		op          operation.Type
+		value       []*string
+		oldValue    []*string
+		match       MatchFunc[*string]
+		constraints []UpdateConstraint
+		wantDetails []string
+	}{
+		{
+			name:        "create operation - no validation",
+			op:          operation.Create,
+			value:       []*string{new("a")},
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet, NoUnset, NoAddItem, NoRemoveItem},
+			match:       DirectEqual[string],
+		},
+		{
+			name:        "NoSet nil to non-empty (forbidden)",
+			op:          operation.Update,
+			value:       []*string{new("a")},
+			oldValue:    nil,
+			constraints: []UpdateConstraint{NoSet},
+			wantDetails: []string{"field cannot be set once created"},
+		},
+		{
+			name:        "NoAddItem direct-equal item added",
+			op:          operation.Update,
+			value:       []*string{new("a"), new("b"), new("c")},
+			oldValue:    []*string{new("a"), new("c")},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoAddItem},
+			wantDetails: []string{"item may not be added"},
+		},
+		{
+			name:        "NoRemoveItem direct-equal item removed",
+			op:          operation.Update,
+			value:       []*string{new("a")},
+			oldValue:    []*string{new("a"), new("b")},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoRemoveItem},
+			wantDetails: []string{"item may not be removed"},
+		},
+		{
+			name:        "nil element in value (ignored)",
+			op:          operation.Update,
+			value:       []*string{new("a"), nil, new("c")},
+			oldValue:    []*string{new("a"), new("c")},
+			match:       DirectEqual[string],
+			constraints: []UpdateConstraint{NoAddItem},
+			// Expect 0 errors because nil is ignored and non-nil elements match old values.
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			op := operation.Operation{Type: tt.op}
+			errs := PtrSliceUpdate(context.TODO(), op, field.NewPath("test"), tt.value, tt.oldValue, tt.match, tt.constraints...)
+
+			if len(errs) != len(tt.wantDetails) {
+				t.Fatalf("PtrSliceUpdate() returned %d errors, want %d: %v", len(errs), len(tt.wantDetails), errs)
+			}
+			for i, want := range tt.wantDetails {
+				if errs[i].Detail != want {
+					t.Errorf("PtrSliceUpdate() error[%d] = %q, want %q", i, errs[i].Detail, want)
+				}
+				if errs[i].Origin != "update" {
+					t.Errorf("PtrSliceUpdate() error[%d] origin = %q, want %q", i, errs[i].Origin, "update")
+				}
+			}
+		})
+	}
+
+	t.Run("NoAddItem+NoRemoveItem keyed match allows item modification", func(t *testing.T) {
+		op := operation.Operation{Type: operation.Update}
+		newList := []*keyed{{Name: "alpha", Value: "v2"}, {Name: "beta", Value: "v1"}}
+		oldList := []*keyed{{Name: "alpha", Value: "v1"}, {Name: "beta", Value: "v1"}}
+		errs := PtrSliceUpdate(context.TODO(), op, field.NewPath("test"), newList, oldList, keyMatch, NoAddItem, NoRemoveItem)
+		if len(errs) != 0 {
+			t.Errorf("expected no errors for keyed-match item modification, got %v", errs)
+		}
+	})
+
+	t.Run("NoAddItem without match returns internal error", func(t *testing.T) {
+		op := operation.Operation{Type: operation.Update}
+		errs := PtrSliceUpdate[string](context.TODO(), op, field.NewPath("test"), []*string{new("a")}, nil, nil, NoAddItem)
+		if len(errs) != 1 || errs[0].Type != field.ErrorTypeInternal {
+			t.Errorf("expected single InternalError, got %v", errs)
+		}
+	})
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/util_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/util_test.go
new file mode 100644
index 0000000000..28bd577c8d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/util_test.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"bytes"
+	"strconv"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// fmtErrs is a helper for nicer test output.  It will use multiple lines if
+// errs has more than 1 item.
+func fmtErrs(errs field.ErrorList) string {
+	if len(errs) == 0 {
+		return "<no errors>"
+	}
+	if len(errs) == 1 {
+		return strconv.Quote(errs[0].Error())
+	}
+	buf := bytes.Buffer{}
+	for _, e := range errs {
+		buf.WriteString("\n")
+		buf.WriteString(strconv.Quote(e.Error()))
+	}
+	return buf.String()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/zeroorone.go b/third_party/k8s.io/apimachinery/pkg/api/validate/zeroorone.go
new file mode 100644
index 0000000000..6a5df4ca34
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/zeroorone.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// ZeroOrOneOfUnion verifies that at most one member of a union is specified.
+//
+// ZeroOrOneOfMembership must define all the members of the union.
+//
+// For example:
+//
+//	var ZeroOrOneOfMembershipForABC = validate.NewUnionMembership(
+//		validate.NewUnionMember("a"),
+//		validate.NewUnionMember("b"),
+//		validate.NewUnionMember("c"),
+//	)
+//	func ValidateABC(ctx context.Context, op operation.Operation, fldPath *field.Path, in *ABC) (errs field.ErrorList) {
+//		errs = append(errs, validate.ZeroOrOneOfUnion(ctx, op, fldPath, in, oldIn,
+//			ZeroOrOneOfMembershipForABC,
+//			func(in *ABC) bool { return in.A != nil },
+//			func(in *ABC) bool { return in.B != ""},
+//			func(in *ABC) bool { return in.C != 0 },
+//		)...)
+//		return errs
+//	}
+func ZeroOrOneOfUnion[T any](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj T, union *UnionMembership, isSetFns ...ExtractorFn[T, bool]) field.ErrorList {
+	options := UnionValidationOptions{
+		ErrorForEmpty: nil,
+		ErrorForMultiple: func(fldPath *field.Path, specifiedFields []string, allFields []string) *field.Error {
+			return field.Invalid(fldPath, fmt.Sprintf("{%s}", strings.Join(specifiedFields, ", ")),
+				fmt.Sprintf("must specify at most one of: %s", strings.Join(allFields, ", "))).WithOrigin("zeroOrOneOf")
+		},
+	}
+
+	errs := unionValidate(op, fldPath, obj, oldObj, union, options, isSetFns...)
+	return errs
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validate/zeroorone_test.go b/third_party/k8s.io/apimachinery/pkg/api/validate/zeroorone_test.go
new file mode 100644
index 0000000000..686a1c11a6
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validate/zeroorone_test.go
@@ -0,0 +1,153 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestZeroOrOneOfUnion(t *testing.T) {
+	testCases := []struct {
+		name        string
+		fields      []string
+		fieldValues []bool
+		expected    field.ErrorList
+	}{
+		{
+			name:        "one member set",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{false, false, false, true},
+			expected:    nil,
+		},
+		{
+			name:        "two members set",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{false, true, false, true},
+			expected:    field.ErrorList{field.Invalid(nil, "{b, d}", "must specify at most one of: `a`, `b`, `c`, `d`").WithOrigin("zeroOrOneOf")},
+		},
+		{
+			name:        "all members set",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{true, true, true, true},
+			expected:    field.ErrorList{field.Invalid(nil, "{a, b, c, d}", "must specify at most one of: `a`, `b`, `c`, `d`").WithOrigin("zeroOrOneOf")},
+		},
+		{
+			name:        "no member set - allowed for ZeroOrOneOf",
+			fields:      []string{"a", "b", "c", "d"},
+			fieldValues: []bool{false, false, false, false},
+			expected:    nil, // This is the key difference from Union
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			members := []UnionMember{}
+			for _, f := range tc.fields {
+				members = append(members, NewUnionMember(f))
+			}
+
+			// Create mock extractors that return predefined values instead of
+			// actually extracting from the object.
+			extractors := make([]ExtractorFn[*testMember, bool], len(tc.fieldValues))
+			for i, val := range tc.fieldValues {
+				extractors[i] = func(_ *testMember) bool { return val }
+			}
+
+			got := ZeroOrOneOfUnion(context.Background(), operation.Operation{}, nil, &testMember{}, nil,
+				NewUnionMembership(members...), extractors...)
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
+
+func TestZeroOrOneOfUnionRatcheting(t *testing.T) {
+	testCases := []struct {
+		name      string
+		oldStruct *testStruct
+		newStruct *testStruct
+		expected  field.ErrorList
+	}{
+		{
+			name:      "both nil",
+			oldStruct: nil,
+			newStruct: nil,
+		},
+		{
+			name:      "both empty struct - allowed for ZeroOrOneOf",
+			oldStruct: &testStruct{},
+			newStruct: &testStruct{},
+		},
+		{
+			name: "both have more than one member",
+			oldStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+			newStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+		},
+		{
+			name: "change to invalid",
+			oldStruct: &testStruct{
+				M1: &m1{},
+			},
+			newStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(nil, "{m1, m2}", "must specify at most one of: `m1`, `m2`, `m3`, `m4`").WithOrigin("zeroOrOneOf"),
+			},
+		},
+		{
+			name:      "change from empty to one member - allowed",
+			oldStruct: &testStruct{},
+			newStruct: &testStruct{
+				M1: &m1{},
+			},
+			expected: nil,
+		},
+		{
+			name: "change from one member to empty - allowed",
+			oldStruct: &testStruct{
+				M1: &m1{},
+			},
+			newStruct: &testStruct{},
+			expected:  nil,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			members := []UnionMember{NewUnionMember("m1"), NewUnionMember("m2"), NewUnionMember("m3"), NewUnionMember("m4")}
+			got := ZeroOrOneOfUnion(context.Background(), operation.Operation{Type: operation.Update}, nil, tc.newStruct, tc.oldStruct,
+				NewUnionMembership(members...), extractors...)
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validation/OWNERS b/third_party/k8s.io/apimachinery/pkg/api/validation/OWNERS
new file mode 100644
index 0000000000..4023732476
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validation/OWNERS
@@ -0,0 +1,11 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+# Disable inheritance as this is an api owners file
+options:
+  no_parent_owners: true
+approvers:
+  - api-approvers
+reviewers:
+  - api-reviewers
+labels:
+  - kind/api-change
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validation/doc.go b/third_party/k8s.io/apimachinery/pkg/api/validation/doc.go
new file mode 100644
index 0000000000..9e305b0b18
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validation/doc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package validation contains generic api type validation functions.
+package validation
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validation/generic.go b/third_party/k8s.io/apimachinery/pkg/api/validation/generic.go
new file mode 100644
index 0000000000..35ea723a0f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validation/generic.go
@@ -0,0 +1,94 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// IsNegativeErrorMsg is a error message for value must be greater than or equal to 0.
+const IsNegativeErrorMsg string = `must be greater than or equal to 0`
+
+// ValidateNameFunc validates that the provided name is valid for a given resource type.
+// Not all resources have the same validation rules for names. Prefix is true
+// if the name will have a value appended to it.  If the name is not valid,
+// this returns a list of descriptions of individual characteristics of the
+// value that were not valid.  Otherwise this returns an empty list or nil.
+type ValidateNameFunc func(name string, prefix bool) []string
+
+// ValidateNameFuncWithErrors validates that the provided name is valid for a
+// given resource type.
+//
+// This is similar to ValidateNameFunc, except that it produces an ErrorList.
+type ValidateNameFuncWithErrors func(fldPath *field.Path, name string) field.ErrorList
+
+// NameIsDNSSubdomain is a ValidateNameFunc for names that must be a DNS subdomain.
+func NameIsDNSSubdomain(name string, prefix bool) []string {
+	if prefix {
+		name = maskTrailingDash(name)
+	}
+	return validation.IsDNS1123Subdomain(name)
+}
+
+// NameIsDNSLabel is a ValidateNameFunc for names that must be a DNS 1123 label.
+func NameIsDNSLabel(name string, prefix bool) []string {
+	if prefix {
+		name = maskTrailingDash(name)
+	}
+	return validation.IsDNS1123Label(name)
+}
+
+// NameIsDNS1035Label is a ValidateNameFunc for names that must be a DNS 952 label.
+func NameIsDNS1035Label(name string, prefix bool) []string {
+	if prefix {
+		name = maskTrailingDash(name)
+	}
+	return validation.IsDNS1035Label(name)
+}
+
+// ValidateNamespaceName can be used to check whether the given namespace name is valid.
+// Prefix indicates this name will be used as part of generation, in which case
+// trailing dashes are allowed.
+var ValidateNamespaceName = NameIsDNSLabel
+
+// ValidateServiceAccountName can be used to check whether the given service account name is valid.
+// Prefix indicates this name will be used as part of generation, in which case
+// trailing dashes are allowed.
+var ValidateServiceAccountName = NameIsDNSSubdomain
+
+// maskTrailingDash replaces the final character of a string with a subdomain safe
+// value if it is a dash and if the length of this string is greater than 1. Note that
+// this is used when a value could be appended to the string, see ValidateNameFunc
+// for more info.
+func maskTrailingDash(name string) string {
+	if len(name) > 1 && strings.HasSuffix(name, "-") {
+		return name[:len(name)-2] + "a"
+	}
+	return name
+}
+
+// ValidateNonnegativeField validates that given value is not negative.
+func ValidateNonnegativeField(value int64, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	if value < 0 {
+		allErrs = append(allErrs, field.Invalid(fldPath, value, IsNegativeErrorMsg).WithOrigin("minimum"))
+	}
+	return allErrs
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validation/generic_test.go b/third_party/k8s.io/apimachinery/pkg/api/validation/generic_test.go
new file mode 100644
index 0000000000..a753cc2b22
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validation/generic_test.go
@@ -0,0 +1,65 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import "testing"
+
+func TestMaskTrailingDash(t *testing.T) {
+	testCases := []struct {
+		beforeMasking        string
+		expectedAfterMasking string
+		description          string
+	}{
+		{
+			beforeMasking:        "",
+			expectedAfterMasking: "",
+			description:          "empty string",
+		},
+		{
+			beforeMasking:        "-",
+			expectedAfterMasking: "-",
+			description:          "only a single dash",
+		},
+		{
+			beforeMasking:        "-foo",
+			expectedAfterMasking: "-foo",
+			description:          "has leading dash",
+		},
+		{
+			beforeMasking:        "-foo-",
+			expectedAfterMasking: "-foa",
+			description:          "has both leading and trailing dashes",
+		},
+		{
+			beforeMasking:        "b-",
+			expectedAfterMasking: "a",
+			description:          "has trailing dash",
+		},
+		{
+			beforeMasking:        "ab",
+			expectedAfterMasking: "ab",
+			description:          "has neither leading nor trailing dashes",
+		},
+	}
+
+	for _, tc := range testCases {
+		afterMasking := maskTrailingDash(tc.beforeMasking)
+		if afterMasking != tc.expectedAfterMasking {
+			t.Errorf("error in test case: %s. expected: %s, actual: %s", tc.description, tc.expectedAfterMasking, afterMasking)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validation/objectmeta.go b/third_party/k8s.io/apimachinery/pkg/api/validation/objectmeta.go
new file mode 100644
index 0000000000..ff86973fbd
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validation/objectmeta.go
@@ -0,0 +1,369 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1validation "k8s.io/apimachinery/pkg/apis/meta/v1/validation"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// FieldImmutableErrorMsg is a error message for field is immutable.
+const FieldImmutableErrorMsg string = `field is immutable`
+
+const TotalAnnotationSizeLimitB int = 256 * (1 << 10) // 256 kB
+
+// BannedOwners is a black list of object that are not allowed to be owners.
+var BannedOwners = map[schema.GroupVersionKind]struct{}{
+	{Group: "", Version: "v1", Kind: "Event"}: {},
+}
+
+// ValidateAnnotations validates that a set of annotations are correctly defined.
+func ValidateAnnotations(annotations map[string]string, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	for k := range annotations {
+		// The rule is QualifiedName except that case doesn't matter, so convert to lowercase before checking.
+		for _, msg := range validation.IsQualifiedName(strings.ToLower(k)) {
+			allErrs = append(allErrs, field.Invalid(fldPath, k, msg).WithOrigin("format=k8s-label-key"))
+		}
+	}
+	if err := ValidateAnnotationsSize(annotations); err != nil {
+		allErrs = append(allErrs, field.TooLong(fldPath, "" /*unused*/, TotalAnnotationSizeLimitB))
+	}
+	return allErrs
+}
+
+func ValidateAnnotationsSize(annotations map[string]string) error {
+	var totalSize int64
+	for k, v := range annotations {
+		totalSize += (int64)(len(k)) + (int64)(len(v))
+	}
+	if totalSize > (int64)(TotalAnnotationSizeLimitB) {
+		return fmt.Errorf("annotations size %d is larger than limit %d", totalSize, TotalAnnotationSizeLimitB)
+	}
+	return nil
+}
+
+func validateOwnerReference(ownerReference metav1.OwnerReference, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	gv, err := schema.ParseGroupVersion(ownerReference.APIVersion)
+	// gvk.Group is empty for the legacy group.
+	if len(ownerReference.APIVersion) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("apiVersion"), "must not be empty").MarkCoveredByDeclarative())
+	} else if err != nil || len(gv.Version) == 0 {
+		allErrs = append(allErrs, field.Invalid(fldPath.Child("apiVersion"), ownerReference.APIVersion, "must be <group>/<version> or <version>"))
+	}
+	if len(ownerReference.Kind) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("kind"), "must not be empty").MarkCoveredByDeclarative())
+	}
+	if len(ownerReference.Name) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("name"), "must not be empty").MarkCoveredByDeclarative())
+	}
+	if len(ownerReference.UID) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("uid"), "must not be empty").MarkCoveredByDeclarative())
+	}
+	gvk := gv.WithKind(ownerReference.Kind)
+	if _, ok := BannedOwners[gvk]; ok {
+		allErrs = append(allErrs, field.Invalid(fldPath, ownerReference, fmt.Sprintf("%s is disallowed from being an owner", gvk)))
+	}
+	return allErrs
+}
+
+// ValidateOwnerReferences validates that a set of owner references are correctly defined.
+func ValidateOwnerReferences(ownerReferences []metav1.OwnerReference, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	firstControllerName := ""
+	for idx, ref := range ownerReferences {
+		allErrs = append(allErrs, validateOwnerReference(ref, fldPath.Index(idx))...)
+		if ref.Controller != nil && *ref.Controller {
+			curControllerName := ref.Kind + "/" + ref.Name
+			if firstControllerName != "" {
+				allErrs = append(allErrs, field.Invalid(fldPath, ownerReferences,
+					fmt.Sprintf("Only one reference can have Controller set to true. Found \"true\" in references for %v and %v", firstControllerName, curControllerName)))
+			} else {
+				firstControllerName = curControllerName
+			}
+		}
+	}
+	return allErrs
+}
+
+// ValidateFinalizerName validates finalizer names.
+func ValidateFinalizerName(stringValue string, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	for _, msg := range validation.IsQualifiedName(stringValue) {
+		allErrs = append(allErrs, field.Invalid(fldPath, stringValue, msg))
+	}
+
+	return allErrs
+}
+
+// ValidateNoNewFinalizers validates the new finalizers has no new finalizers compare to old finalizers.
+func ValidateNoNewFinalizers(newFinalizers []string, oldFinalizers []string, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	extra := sets.NewString(newFinalizers...).Difference(sets.NewString(oldFinalizers...))
+	if len(extra) != 0 {
+		allErrs = append(allErrs, field.Forbidden(fldPath, fmt.Sprintf("no new finalizers can be added if the object is being deleted, found new finalizers %#v", extra.List())))
+	}
+	return allErrs
+}
+
+// ValidateImmutableField validates the new value and the old value are deeply equal.
+func ValidateImmutableField(newVal, oldVal interface{}, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	if !apiequality.Semantic.DeepEqual(oldVal, newVal) {
+		allErrs = append(allErrs, field.Invalid(fldPath, newVal, FieldImmutableErrorMsg))
+	}
+	return allErrs
+}
+
+// ValidateObjectMetaDeclaratively validates an ObjectMeta instance declaratively and deduplicates handwritten errors.
+// betaEnabled controls whether declarative validation rules at the Beta stability level are enforced.
+// NOTE: This method should be used in the types for which declarative validation is not enabled yet or cannot be enabled. The types
+// for which declarative validation is enabled and valdiation code is generated must use ValidateObjectMeta and ValidateObjectMetaUpdate.
+func ValidateObjectMetaDeclaratively(ctx context.Context, op operation.Type, obj, oldObj *metav1.ObjectMeta, requiresNamespace bool, nameFn ValidateNameFunc, fldPath *field.Path, betaEnabled bool) field.ErrorList {
+	var errs field.ErrorList
+	switch op {
+	case operation.Create:
+		errs = ValidateObjectMeta(obj, requiresNamespace, nameFn, fldPath)
+	case operation.Update:
+		errs = ValidateObjectMetaUpdate(obj, oldObj, fldPath)
+	}
+	dvErrs := v1validation.Validate_ObjectMeta(ctx, operation.Operation{Type: op}, fldPath, obj, oldObj)
+	enforcedDVErrs := validate.FilterEnforcedDeclarativeErrors(ctx, dvErrs, betaEnabled)
+	errs = errs.MarkFromImperative()
+	errs = validate.FilterCoveredHandwrittenErrors(ctx, errs, enforcedDVErrs, betaEnabled)
+	return append(errs, enforcedDVErrs...)
+}
+
+// ValidateObjectMeta validates an object's metadata on creation. It expects that name generation has already
+// been performed.
+func ValidateObjectMeta(objMeta *metav1.ObjectMeta, requiresNamespace bool, nameFn ValidateNameFunc, fldPath *field.Path) field.ErrorList {
+	metadata, err := meta.Accessor(objMeta)
+	if err != nil {
+		var allErrs field.ErrorList
+		allErrs = append(allErrs, field.Invalid(fldPath, objMeta, err.Error()))
+		return allErrs
+	}
+	return ValidateObjectMetaAccessor(metadata, requiresNamespace, nameFn, fldPath)
+}
+
+// objectMetaValidationOptions defines behavioral modifications for validating
+// an ObjectMeta.
+type objectMetaValidationOptions struct {
+	/* nothing here yet */
+}
+
+// ObjectMetaValidationOption specifies a behavioral modifier for
+// ValidateObjectMetaWithOpts and ValidateObjectMetaAccessorWithOpts.
+type ObjectMetaValidationOption func(opts *objectMetaValidationOptions)
+
+// ValidateObjectMetaWithOpts validates an object's metadata on creation. It
+// expects that name generation has already been performed, so name validation
+// is always executed.
+//
+// This is similar to ValidateObjectMeta, but uses options to buy future-safety
+// and uses different signature for the name validation function.  It also does
+// not directly validate the generateName field, because name generation
+// should have already been performed and it is the result of that generastion
+// that must conform to the nameFn.
+func ValidateObjectMetaWithOpts(objMeta *metav1.ObjectMeta, isNamespaced bool, nameFn ValidateNameFuncWithErrors, fldPath *field.Path, options ...ObjectMetaValidationOption) field.ErrorList {
+	metadata, err := meta.Accessor(objMeta)
+	if err != nil {
+		var allErrs field.ErrorList
+		allErrs = append(allErrs, field.InternalError(fldPath, err))
+		return allErrs
+	}
+	return ValidateObjectMetaAccessorWithOpts(metadata, isNamespaced, nameFn, fldPath, options...)
+}
+
+// ValidateObjectMetaAccessor validates an object's metadata on creation. It expects that name generation has already
+// been performed.
+func ValidateObjectMetaAccessor(meta metav1.Object, requiresNamespace bool, nameFn ValidateNameFunc, fldPath *field.Path) field.ErrorList {
+	var allErrs field.ErrorList
+
+	if len(meta.GetGenerateName()) != 0 {
+		for _, msg := range nameFn(meta.GetGenerateName(), true) {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("generateName"), meta.GetGenerateName(), msg))
+		}
+	}
+	// If the generated name validates, but the calculated value does not, it's a problem with generation, and we
+	// report it here. This may confuse users, but indicates a programming bug and still must be validated.
+	// If there are multiple fields out of which one is required then add an or as a separator
+	if len(meta.GetName()) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("name"), "name or generateName is required"))
+	} else {
+		for _, msg := range nameFn(meta.GetName(), false) {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("name"), meta.GetName(), msg))
+		}
+	}
+
+	return append(allErrs, validateObjectMetaAccessorWithOptsCommon(meta, requiresNamespace, fldPath, nil)...)
+}
+
+// ValidateObjectMetaAccessorWithOpts validates an object's metadata on
+// creation. It expects that name generation has already been performed, so
+// name validation is always executed.
+//
+// This is similar to ValidateObjectMetaAccessor, but uses options to buy
+// future-safety and uses different signature for the name validation function.
+// It also does not directly validate the generateName field, because name
+// generation should have already been performed and it is the result of that
+// generastion that must conform to the nameFn.
+func ValidateObjectMetaAccessorWithOpts(meta metav1.Object, isNamespaced bool, nameFn ValidateNameFuncWithErrors, fldPath *field.Path, options ...ObjectMetaValidationOption) field.ErrorList {
+	opts := objectMetaValidationOptions{}
+	for _, opt := range options {
+		opt(&opts)
+	}
+
+	var allErrs field.ErrorList
+
+	// generateName is not directly validated here. Types can have
+	// different rules for name generation, and the nameFn is for validating
+	// the post-generation data, not the input. In the past we assumed that
+	// name generation was always "append 5 random characters", but that's not
+	// NECESSARILY true. Also, the nameFn should always be considering the max
+	// length of the name, and it doesn't know enough about the name generation
+	// to do that. Also, given a bad generateName, the user will get errors
+	// for both the generateName and name fields. We will focus validation on
+	// the name field, which should give a better UX overall.
+	// TODO(thockin): should we do a max-length check here? e.g. 1K or 4K?
+
+	if len(meta.GetGenerateName()) != 0 && len(meta.GetName()) == 0 {
+		allErrs = append(allErrs,
+			field.InternalError(fldPath.Child("name"), fmt.Errorf("generateName was specified (%q), but no name was generated", meta.GetGenerateName())))
+	}
+	if len(meta.GetName()) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("name"), "name or generateName is required"))
+	} else {
+		allErrs = append(allErrs, nameFn(fldPath.Child("name"), meta.GetName())...)
+	}
+
+	return append(allErrs, validateObjectMetaAccessorWithOptsCommon(meta, isNamespaced, fldPath, &opts)...)
+}
+
+// validateObjectMetaAccessorWithOptsCommon is a shared function for validating
+// the parts of an ObjectMeta with are handled the same in both paths..
+func validateObjectMetaAccessorWithOptsCommon(meta metav1.Object, isNamespaced bool, fldPath *field.Path, _ *objectMetaValidationOptions) field.ErrorList {
+	var allErrs field.ErrorList
+
+	if isNamespaced {
+		if len(meta.GetNamespace()) == 0 {
+			allErrs = append(allErrs, field.Required(fldPath.Child("namespace"), ""))
+		} else {
+			for _, msg := range ValidateNamespaceName(meta.GetNamespace(), false) {
+				allErrs = append(allErrs, field.Invalid(fldPath.Child("namespace"), meta.GetNamespace(), msg))
+			}
+		}
+	} else {
+		if len(meta.GetNamespace()) != 0 {
+			// TODO(thockin): change to "may not be specified on this type" or something
+			allErrs = append(allErrs, field.Forbidden(fldPath.Child("namespace"), "not allowed on this type"))
+		}
+	}
+
+	allErrs = append(allErrs, ValidateNonnegativeField(meta.GetGeneration(), fldPath.Child("generation")).MarkCoveredByDeclarative()...)
+	allErrs = append(allErrs, v1validation.ValidateLabels(meta.GetLabels(), fldPath.Child("labels"))...)
+	allErrs = append(allErrs, ValidateAnnotations(meta.GetAnnotations(), fldPath.Child("annotations"))...)
+	allErrs = append(allErrs, ValidateOwnerReferences(meta.GetOwnerReferences(), fldPath.Child("ownerReferences"))...)
+	allErrs = append(allErrs, ValidateFinalizers(meta.GetFinalizers(), fldPath.Child("finalizers"))...)
+	allErrs = append(allErrs, v1validation.ValidateManagedFields(meta.GetManagedFields(), fldPath.Child("managedFields"), v1validation.CoveredByDeclarative)...)
+	return allErrs
+}
+
+// ValidateFinalizers tests if the finalizers name are valid, and if there are conflicting finalizers.
+func ValidateFinalizers(finalizers []string, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	hasFinalizerOrphanDependents := false
+	hasFinalizerDeleteDependents := false
+	for _, finalizer := range finalizers {
+		allErrs = append(allErrs, ValidateFinalizerName(finalizer, fldPath)...)
+		if finalizer == metav1.FinalizerOrphanDependents {
+			hasFinalizerOrphanDependents = true
+		}
+		if finalizer == metav1.FinalizerDeleteDependents {
+			hasFinalizerDeleteDependents = true
+		}
+	}
+	if hasFinalizerDeleteDependents && hasFinalizerOrphanDependents {
+		allErrs = append(allErrs, field.Invalid(fldPath, finalizers, fmt.Sprintf("finalizer %s and %s cannot be both set", metav1.FinalizerOrphanDependents, metav1.FinalizerDeleteDependents)))
+	}
+	return allErrs
+}
+
+// ValidateObjectMetaUpdate validates an object's metadata when updated.
+func ValidateObjectMetaUpdate(newMeta, oldMeta *metav1.ObjectMeta, fldPath *field.Path) field.ErrorList {
+	newMetadata, err := meta.Accessor(newMeta)
+	if err != nil {
+		allErrs := field.ErrorList{}
+		allErrs = append(allErrs, field.Invalid(fldPath, newMeta, err.Error()))
+		return allErrs
+	}
+	oldMetadata, err := meta.Accessor(oldMeta)
+	if err != nil {
+		allErrs := field.ErrorList{}
+		allErrs = append(allErrs, field.Invalid(fldPath, oldMeta, err.Error()))
+		return allErrs
+	}
+	return ValidateObjectMetaAccessorUpdate(newMetadata, oldMetadata, fldPath)
+}
+
+// ValidateObjectMetaAccessorUpdate validates an object's metadata when updated.
+func ValidateObjectMetaAccessorUpdate(newMeta, oldMeta metav1.Object, fldPath *field.Path) field.ErrorList {
+	var allErrs field.ErrorList
+
+	// Finalizers cannot be added if the object is already being deleted.
+	if oldMeta.GetDeletionTimestamp() != nil {
+		allErrs = append(allErrs, ValidateNoNewFinalizers(newMeta.GetFinalizers(), oldMeta.GetFinalizers(), fldPath.Child("finalizers"))...)
+	}
+
+	// Reject updates that don't specify a resource version
+	if len(newMeta.GetResourceVersion()) == 0 {
+		allErrs = append(allErrs, field.Invalid(fldPath.Child("resourceVersion"), newMeta.GetResourceVersion(), "must be specified for an update"))
+	}
+
+	// Generation shouldn't be decremented
+	allErrs = append(allErrs, ValidateNonnegativeField(newMeta.GetGeneration(), fldPath.Child("generation")).MarkCoveredByDeclarative()...)
+	if newMeta.GetGeneration() < oldMeta.GetGeneration() {
+		allErrs = append(allErrs, field.Invalid(fldPath.Child("generation"), newMeta.GetGeneration(), "must not be decremented"))
+	}
+
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetName(), oldMeta.GetName(), fldPath.Child("name"))...)
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetNamespace(), oldMeta.GetNamespace(), fldPath.Child("namespace"))...)
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetUID(), oldMeta.GetUID(), fldPath.Child("uid")).WithOrigin("immutable").MarkCoveredByDeclarative()...)
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetCreationTimestamp(), oldMeta.GetCreationTimestamp(), fldPath.Child("creationTimestamp")).WithOrigin("immutable").MarkCoveredByDeclarative()...)
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetDeletionTimestamp(), oldMeta.GetDeletionTimestamp(), fldPath.Child("deletionTimestamp")).WithOrigin("immutable").MarkCoveredByDeclarative()...)
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetDeletionGracePeriodSeconds(), oldMeta.GetDeletionGracePeriodSeconds(), fldPath.Child("deletionGracePeriodSeconds")).WithOrigin("immutable").MarkCoveredByDeclarative()...)
+
+	allErrs = append(allErrs, v1validation.ValidateLabels(newMeta.GetLabels(), fldPath.Child("labels"))...)
+	allErrs = append(allErrs, ValidateAnnotations(newMeta.GetAnnotations(), fldPath.Child("annotations"))...)
+	allErrs = append(allErrs, ValidateOwnerReferences(newMeta.GetOwnerReferences(), fldPath.Child("ownerReferences"))...)
+	allErrs = append(allErrs, v1validation.ValidateManagedFields(newMeta.GetManagedFields(), fldPath.Child("managedFields"), v1validation.CoveredByDeclarative)...)
+
+	return allErrs
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validation/objectmeta_test.go b/third_party/k8s.io/apimachinery/pkg/api/validation/objectmeta_test.go
new file mode 100644
index 0000000000..ec329d1984
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validation/objectmeta_test.go
@@ -0,0 +1,999 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"context"
+	"fmt"
+	"math/rand"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+const (
+	maxLengthErrMsg = "must be no more than"
+	namePartErrMsg  = "name part must consist of"
+	nameErrMsg      = "a valid label key must consist of"
+)
+
+// Ensure custom name functions are allowed
+func TestValidateObjectMetaCustomName(t *testing.T) {
+	testCases := []struct {
+		name   string
+		input  metav1.ObjectMeta
+		nErrs  int
+		errStr string
+	}{{
+		name:  "valid name, empty generateName",
+		input: metav1.ObjectMeta{Name: "test", GenerateName: ""},
+	}, {
+		name:  "valid name and generateName",
+		input: metav1.ObjectMeta{Name: "test", GenerateName: "test"},
+	}, {
+		name:   "invalid name, empty generateName",
+		input:  metav1.ObjectMeta{Name: "invalid", GenerateName: ""},
+		nErrs:  1,
+		errStr: "wrong value",
+	}, {
+		name:   "invalid name, valid generateName",
+		input:  metav1.ObjectMeta{Name: "invalid", GenerateName: "test"},
+		nErrs:  1,
+		errStr: "wrong value",
+	}, {
+		name:   "invalid name, invalid generateName",
+		input:  metav1.ObjectMeta{Name: "invalid", GenerateName: "invalid"},
+		nErrs:  2,
+		errStr: "wrong value",
+	}}
+
+	fn := func(s string, prefix bool) []string {
+		// Note: this is called on both name and generateName
+		if s == "test" {
+			return nil
+		}
+		return []string{"wrong value"}
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := ValidateObjectMeta(&tc.input, false, fn, field.NewPath("field"))
+
+			if len(errs) == 0 {
+				if len(tc.errStr) != 0 {
+					t.Fatalf("expected 1 error, got none")
+				}
+			} else {
+				if len(tc.errStr) == 0 {
+					t.Fatalf("expected no errors, got: %v", errs)
+				}
+				if len(errs) != tc.nErrs {
+					t.Fatalf("expected %d errors, got %d: %q", tc.nErrs, len(errs), errs)
+				}
+				if !strings.Contains(errs[0].Error(), "wrong value") {
+					t.Errorf("unexpected error message: %v", errs[0].Error())
+				}
+			}
+		})
+	}
+}
+
+// Ensure custom name functions work
+func TestValidateObjectMetaWithOptsName(t *testing.T) {
+	testCases := []struct {
+		name   string
+		input  metav1.ObjectMeta
+		errStr string
+	}{{
+		name:  "valid name, empty generateName",
+		input: metav1.ObjectMeta{Name: "test", GenerateName: ""},
+	}, {
+		name:  "valid name and generateName",
+		input: metav1.ObjectMeta{Name: "test", GenerateName: "test"},
+	}, {
+		name:   "invalid name, empty generateName",
+		input:  metav1.ObjectMeta{Name: "invalid", GenerateName: ""},
+		errStr: "wrong value",
+	}, {
+		name:   "invalid name, valid generateName",
+		input:  metav1.ObjectMeta{Name: "invalid", GenerateName: "test"},
+		errStr: "wrong value",
+	}, {
+		name:   "invalid name, invalid generateName",
+		input:  metav1.ObjectMeta{Name: "invalid", GenerateName: "invalid"},
+		errStr: "wrong value",
+	}}
+
+	fn := func(fldPath *field.Path, s string) field.ErrorList {
+		if s == "test" {
+			return nil
+		}
+		return field.ErrorList{field.Invalid(fldPath, s, "wrong value")}
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := ValidateObjectMetaWithOpts(&tc.input, false, fn, field.NewPath("field"))
+
+			if len(errs) == 0 {
+				if len(tc.errStr) != 0 {
+					t.Fatalf("expected 1 error, got none")
+				}
+			} else {
+				if len(tc.errStr) == 0 {
+					t.Fatalf("expected no errors, got: %v", errs)
+				}
+				if len(errs) != 1 {
+					t.Fatalf("expected 1 error, got %d: %q", len(errs), errs)
+				}
+				if !strings.Contains(errs[0].Error(), "wrong value") {
+					t.Errorf("unexpected error message: %v", errs[0].Error())
+				}
+			}
+		})
+	}
+}
+
+// Ensure namespace names follow dns label format
+func TestValidateObjectMetaNamespaces(t *testing.T) {
+	errs := validateObjectMetaAccessorWithOptsCommon(
+		&metav1.ObjectMeta{Name: "test", Namespace: "foo.bar"},
+		true, field.NewPath("field"), nil)
+	if len(errs) != 1 {
+		t.Fatalf("unexpected errors: %v", errs)
+	}
+	if !strings.Contains(errs[0].Error(), `Invalid value: "foo.bar"`) {
+		t.Errorf("unexpected error message: %v", errs)
+	}
+	maxLength := 63
+	letters := []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789")
+	b := make([]rune, maxLength+1)
+	for i := range b {
+		b[i] = letters[rand.Intn(len(letters))]
+	}
+	errs = validateObjectMetaAccessorWithOptsCommon(
+		&metav1.ObjectMeta{Name: "test", Namespace: string(b)},
+		true, field.NewPath("field"), nil)
+	if len(errs) != 2 {
+		t.Fatalf("unexpected errors: %v", errs)
+	}
+	if !strings.Contains(errs[0].Error(), "Invalid value") || !strings.Contains(errs[1].Error(), "Invalid value") {
+		t.Errorf("unexpected error message: %v", errs)
+	}
+}
+
+func TestValidateObjectMetaOwnerReferences(t *testing.T) {
+	trueVar := true
+	falseVar := false
+	testCases := []struct {
+		description          string
+		ownerReferences      []metav1.OwnerReference
+		expectError          bool
+		expectedErrorMessage string
+	}{
+		{
+			description: "simple success - third party extension.",
+			ownerReferences: []metav1.OwnerReference{
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind",
+					Name:       "name",
+					UID:        "1",
+				},
+			},
+			expectError:          false,
+			expectedErrorMessage: "",
+		},
+		{
+			description: "simple failures - event shouldn't be set as an owner",
+			ownerReferences: []metav1.OwnerReference{
+				{
+					APIVersion: "v1",
+					Kind:       "Event",
+					Name:       "name",
+					UID:        "1",
+				},
+			},
+			expectError:          true,
+			expectedErrorMessage: "is disallowed from being an owner",
+		},
+		{
+			description: "simple failures - invalid apiVersion with too many slashes",
+			ownerReferences: []metav1.OwnerReference{
+				{
+					APIVersion: "a/b/c",
+					Kind:       "Pod",
+					Name:       "name",
+					UID:        "1",
+				},
+			},
+			expectError:          true,
+			expectedErrorMessage: "must be <group>/<version> or <version>",
+		},
+		{
+			description: "simple failures - invalid apiVersion with empty version",
+			ownerReferences: []metav1.OwnerReference{
+				{
+					APIVersion: "foo/",
+					Kind:       "Pod",
+					Name:       "name",
+					UID:        "1",
+				},
+			},
+			expectError:          true,
+			expectedErrorMessage: "must be <group>/<version> or <version>",
+		},
+		{
+			description: "simple success - apiVersion with no slashes (legacy core group)",
+			ownerReferences: []metav1.OwnerReference{
+				{
+					APIVersion: "v1",
+					Kind:       "Pod",
+					Name:       "name",
+					UID:        "1",
+				},
+			},
+			expectError:          false,
+			expectedErrorMessage: "",
+		},
+		{
+			description: "simple controller ref success - one reference with Controller set",
+			ownerReferences: []metav1.OwnerReference{
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind",
+					Name:       "name",
+					UID:        "1",
+					Controller: &falseVar,
+				},
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind",
+					Name:       "name",
+					UID:        "2",
+					Controller: &trueVar,
+				},
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind",
+					Name:       "name",
+					UID:        "3",
+					Controller: &falseVar,
+				},
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind",
+					Name:       "name",
+					UID:        "4",
+				},
+			},
+			expectError:          false,
+			expectedErrorMessage: "",
+		},
+		{
+			description: "simple controller ref failure - two references with Controller set",
+			ownerReferences: []metav1.OwnerReference{
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind1",
+					Name:       "name",
+					UID:        "1",
+					Controller: &falseVar,
+				},
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind2",
+					Name:       "name",
+					UID:        "2",
+					Controller: &trueVar,
+				},
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind3",
+					Name:       "name",
+					UID:        "3",
+					Controller: &trueVar,
+				},
+				{
+					APIVersion: "customresourceVersion",
+					Kind:       "customresourceKind4",
+					Name:       "name",
+					UID:        "4",
+				},
+			},
+			expectError:          true,
+			expectedErrorMessage: "Only one reference can have Controller set to true. Found \"true\" in references for customresourceKind2/name and customresourceKind3/name",
+		},
+	}
+
+	for _, tc := range testCases {
+		errs := validateObjectMetaAccessorWithOptsCommon(
+			&metav1.ObjectMeta{Name: "test", Namespace: "test", OwnerReferences: tc.ownerReferences},
+			true, field.NewPath("field"), nil)
+		if len(errs) != 0 && !tc.expectError {
+			t.Errorf("unexpected error: %v in test case %v", errs, tc.description)
+		}
+		if len(errs) == 0 && tc.expectError {
+			t.Errorf("expect error in test case %v", tc.description)
+		}
+		if len(errs) != 0 && !strings.Contains(errs[0].Error(), tc.expectedErrorMessage) {
+			t.Errorf("unexpected error message: %v in test case %v", errs, tc.description)
+		}
+	}
+}
+
+func TestValidateObjectMetaUpdateIgnoresCreationTimestamp(t *testing.T) {
+	if errs := ValidateObjectMetaUpdate(
+		&metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+		&metav1.ObjectMeta{Name: "test", ResourceVersion: "1", CreationTimestamp: metav1.NewTime(time.Unix(10, 0))},
+		field.NewPath("field"),
+	); len(errs) != 1 {
+		t.Fatalf("unexpected errors: %v", errs)
+	}
+	if errs := ValidateObjectMetaUpdate(
+		&metav1.ObjectMeta{Name: "test", ResourceVersion: "1", CreationTimestamp: metav1.NewTime(time.Unix(10, 0))},
+		&metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+		field.NewPath("field"),
+	); len(errs) != 1 {
+		t.Fatalf("unexpected errors: %v", errs)
+	}
+	if errs := ValidateObjectMetaUpdate(
+		&metav1.ObjectMeta{Name: "test", ResourceVersion: "1", CreationTimestamp: metav1.NewTime(time.Unix(10, 0))},
+		&metav1.ObjectMeta{Name: "test", ResourceVersion: "1", CreationTimestamp: metav1.NewTime(time.Unix(11, 0))},
+		field.NewPath("field"),
+	); len(errs) != 1 {
+		t.Fatalf("unexpected errors: %v", errs)
+	}
+}
+
+func TestValidateFinalizersUpdate(t *testing.T) {
+	testcases := map[string]struct {
+		Old         metav1.ObjectMeta
+		New         metav1.ObjectMeta
+		ExpectedErr string
+	}{
+		"invalid adding finalizers": {
+			Old:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &metav1.Time{}, Finalizers: []string{"x/a"}},
+			New:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &metav1.Time{}, Finalizers: []string{"x/a", "y/b"}},
+			ExpectedErr: "y/b",
+		},
+		"invalid changing finalizers": {
+			Old:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &metav1.Time{}, Finalizers: []string{"x/a"}},
+			New:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &metav1.Time{}, Finalizers: []string{"x/b"}},
+			ExpectedErr: "x/b",
+		},
+		"valid removing finalizers": {
+			Old:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &metav1.Time{}, Finalizers: []string{"x/a", "y/b"}},
+			New:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &metav1.Time{}, Finalizers: []string{"x/a"}},
+			ExpectedErr: "",
+		},
+		"valid adding finalizers for objects not being deleted": {
+			Old:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Finalizers: []string{"x/a"}},
+			New:         metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Finalizers: []string{"x/a", "y/b"}},
+			ExpectedErr: "",
+		},
+	}
+	for name, tc := range testcases {
+		errs := ValidateObjectMetaUpdate(&tc.New, &tc.Old, field.NewPath("field"))
+		if len(errs) == 0 {
+			if len(tc.ExpectedErr) != 0 {
+				t.Errorf("case: %q, expected error to contain %q", name, tc.ExpectedErr)
+			}
+		} else if e, a := tc.ExpectedErr, errs.ToAggregate().Error(); !strings.Contains(a, e) {
+			t.Errorf("case: %q, expected error to contain %q, got error %q", name, e, a)
+		}
+	}
+}
+
+func TestValidateFinalizersPreventConflictingFinalizers(t *testing.T) {
+	testcases := map[string]struct {
+		ObjectMeta  metav1.ObjectMeta
+		ExpectedErr string
+	}{
+		"conflicting finalizers": {
+			ObjectMeta:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Finalizers: []string{metav1.FinalizerOrphanDependents, metav1.FinalizerDeleteDependents}},
+			ExpectedErr: "cannot be both set",
+		},
+	}
+	for name, tc := range testcases {
+		errs := validateObjectMetaAccessorWithOptsCommon(&tc.ObjectMeta, false, field.NewPath("field"), nil)
+		if len(errs) == 0 {
+			if len(tc.ExpectedErr) != 0 {
+				t.Errorf("case: %q, expected error to contain %q", name, tc.ExpectedErr)
+			}
+		} else if e, a := tc.ExpectedErr, errs.ToAggregate().Error(); !strings.Contains(a, e) {
+			t.Errorf("case: %q, expected error to contain %q, got error %q", name, e, a)
+		}
+	}
+}
+
+func TestValidateObjectMetaUpdatePreventsDeletionFieldMutation(t *testing.T) {
+	now := metav1.NewTime(time.Unix(1000, 0).UTC())
+	later := metav1.NewTime(time.Unix(2000, 0).UTC())
+	gracePeriodShort := int64(30)
+	gracePeriodLong := int64(40)
+
+	testcases := map[string]struct {
+		Old          metav1.ObjectMeta
+		New          metav1.ObjectMeta
+		ExpectedNew  metav1.ObjectMeta
+		ExpectedErrs []string
+	}{
+		"valid without deletion fields": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			ExpectedErrs: []string{},
+		},
+		"valid with deletion fields": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now, DeletionGracePeriodSeconds: &gracePeriodShort},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now, DeletionGracePeriodSeconds: &gracePeriodShort},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now, DeletionGracePeriodSeconds: &gracePeriodShort},
+			ExpectedErrs: []string{},
+		},
+
+		"invalid set deletionTimestamp": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now},
+			ExpectedErrs: []string{"field.deletionTimestamp: Invalid value: \"1970-01-01T00:16:40Z\": field is immutable"},
+		},
+		"invalid clear deletionTimestamp": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			ExpectedErrs: []string{"field.deletionTimestamp: Invalid value: null: field is immutable"},
+		},
+		"invalid change deletionTimestamp": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &later},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &later},
+			ExpectedErrs: []string{"field.deletionTimestamp: Invalid value: \"1970-01-01T00:33:20Z\": field is immutable"},
+		},
+
+		"invalid set deletionGracePeriodSeconds": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionGracePeriodSeconds: &gracePeriodShort},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionGracePeriodSeconds: &gracePeriodShort},
+			ExpectedErrs: []string{"field.deletionGracePeriodSeconds: Invalid value: 30: field is immutable"},
+		},
+		"invalid clear deletionGracePeriodSeconds": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionGracePeriodSeconds: &gracePeriodShort},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
+			ExpectedErrs: []string{"field.deletionGracePeriodSeconds: Invalid value: null: field is immutable"},
+		},
+		"invalid change deletionGracePeriodSeconds": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionGracePeriodSeconds: &gracePeriodShort},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionGracePeriodSeconds: &gracePeriodLong},
+			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionGracePeriodSeconds: &gracePeriodLong},
+			ExpectedErrs: []string{"field.deletionGracePeriodSeconds: Invalid value: 40: field is immutable"},
+		},
+	}
+
+	for k, tc := range testcases {
+		errs := ValidateObjectMetaUpdate(&tc.New, &tc.Old, field.NewPath("field"))
+		if len(errs) != len(tc.ExpectedErrs) {
+			t.Logf("%s: Expected: %#v", k, tc.ExpectedErrs)
+			t.Logf("%s: Got: %#v", k, errs)
+			t.Errorf("%s: expected %d errors, got %d", k, len(tc.ExpectedErrs), len(errs))
+			continue
+		}
+		for i := range errs {
+			if errs[i].Error() != tc.ExpectedErrs[i] {
+				t.Errorf("%s: error #%d:\n  expected: %q\n       got: %q", k, i, tc.ExpectedErrs[i], errs[i].Error())
+			}
+		}
+		if !reflect.DeepEqual(tc.New, tc.ExpectedNew) {
+			t.Errorf("%s: Expected after validation:\n%#v\ngot\n%#v", k, tc.ExpectedNew, tc.New)
+		}
+	}
+}
+
+func TestObjectMetaGenerationUpdate(t *testing.T) {
+	testcases := map[string]struct {
+		Old          metav1.ObjectMeta
+		New          metav1.ObjectMeta
+		ExpectedErrs []string
+	}{
+		"invalid generation change - decremented": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Generation: 5},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Generation: 4},
+			ExpectedErrs: []string{"field.generation: Invalid value: 4: must not be decremented"},
+		},
+		"valid generation change - incremented by one": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Generation: 1},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Generation: 2},
+			ExpectedErrs: []string{},
+		},
+		"valid generation field - not updated": {
+			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Generation: 5},
+			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", Generation: 5},
+			ExpectedErrs: []string{},
+		},
+	}
+
+	for k, tc := range testcases {
+		errList := []string{}
+		errs := ValidateObjectMetaUpdate(&tc.New, &tc.Old, field.NewPath("field"))
+		if len(errs) != len(tc.ExpectedErrs) {
+			t.Logf("%s: Expected: %#v", k, tc.ExpectedErrs)
+			for _, err := range errs {
+				errList = append(errList, err.Error())
+			}
+			t.Logf("%s: Got: %#v", k, errList)
+			t.Errorf("%s: expected %d errors, got %d", k, len(tc.ExpectedErrs), len(errs))
+			continue
+		}
+		for i := range errList {
+			if errList[i] != tc.ExpectedErrs[i] {
+				t.Errorf("%s: error #%d:\n  expected: %q\n       got: %q", k, i, tc.ExpectedErrs[i], errs[i].Error())
+			}
+		}
+	}
+}
+
+// Ensure trailing dash is allowed in generate name
+func TestValidateObjectMetaTrimsTrailingDash(t *testing.T) {
+	errs := ValidateObjectMeta(
+		&metav1.ObjectMeta{Name: "test", GenerateName: "foo-"},
+		false,
+		NameIsDNSSubdomain,
+		field.NewPath("field"))
+	if len(errs) != 0 {
+		t.Fatalf("unexpected errors: %v", errs)
+	}
+}
+
+func TestValidateAnnotations(t *testing.T) {
+	successCases := []map[string]string{
+		{"simple": "bar"},
+		{"now-with-dashes": "bar"},
+		{"1-starts-with-num": "bar"},
+		{"1234": "bar"},
+		{"simple/simple": "bar"},
+		{"now-with-dashes/simple": "bar"},
+		{"now-with-dashes/now-with-dashes": "bar"},
+		{"now.with.dots/simple": "bar"},
+		{"now-with.dashes-and.dots/simple": "bar"},
+		{"1-num.2-num/3-num": "bar"},
+		{"1234/5678": "bar"},
+		{"1.2.3.4/5678": "bar"},
+		{"UpperCase123": "bar"},
+		{"a": strings.Repeat("b", TotalAnnotationSizeLimitB-1)},
+		{
+			"a": strings.Repeat("b", TotalAnnotationSizeLimitB/2-1),
+			"c": strings.Repeat("d", TotalAnnotationSizeLimitB/2-1),
+		},
+	}
+	for i := range successCases {
+		errs := ValidateAnnotations(successCases[i], field.NewPath("field"))
+		if len(errs) != 0 {
+			t.Errorf("case[%d] expected success, got %#v", i, errs)
+		}
+	}
+
+	nameErrorCases := []struct {
+		annotations map[string]string
+		expect      string
+	}{
+		{map[string]string{"nospecialchars^=@": "bar"}, namePartErrMsg},
+		{map[string]string{"cantendwithadash-": "bar"}, namePartErrMsg},
+		{map[string]string{"only/one/slash": "bar"}, nameErrMsg},
+		{map[string]string{strings.Repeat("a", 254): "bar"}, maxLengthErrMsg},
+	}
+	for i := range nameErrorCases {
+		errs := ValidateAnnotations(nameErrorCases[i].annotations, field.NewPath("field"))
+		if len(errs) != 1 {
+			t.Errorf("case[%d]: expected failure", i)
+		} else {
+			if !strings.Contains(errs[0].Detail, nameErrorCases[i].expect) {
+				t.Errorf("case[%d]: error details do not include %q: %q", i, nameErrorCases[i].expect, errs[0].Detail)
+			}
+		}
+	}
+	totalSizeErrorCases := []map[string]string{
+		{"a": strings.Repeat("b", TotalAnnotationSizeLimitB)},
+		{
+			"a": strings.Repeat("b", TotalAnnotationSizeLimitB/2),
+			"c": strings.Repeat("d", TotalAnnotationSizeLimitB/2),
+		},
+	}
+	for i := range totalSizeErrorCases {
+		errs := ValidateAnnotations(totalSizeErrorCases[i], field.NewPath("field"))
+		if len(errs) != 1 {
+			t.Errorf("case[%d] expected failure", i)
+		}
+	}
+}
+
+func TestValidateObjectMetaDeclaratively(t *testing.T) {
+	ctx := context.Background()
+	fldPath := field.NewPath("metadata")
+	now := metav1.NewTime(time.Unix(1000, 0).UTC())
+	later := metav1.NewTime(time.Unix(2000, 0).UTC())
+	gracePeriod30 := int64(30)
+	gracePeriod40 := int64(40)
+
+	createCases := []struct {
+		name              string
+		obj               *metav1.ObjectMeta
+		requiresNamespace bool
+		expectedErrs      field.ErrorList
+	}{
+		{
+			name:              "valid metadata",
+			obj:               mkMeta(),
+			requiresNamespace: true,
+			expectedErrs:      nil,
+		},
+		{
+			name:              "invalid name format",
+			obj:               mkMeta(tweakName("invalid_name")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("name"), "invalid_name", "").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "missing required namespace",
+			obj:               mkMeta(tweakNamespace("")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("namespace"), "").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "negative generation",
+			obj:               mkMeta(tweakGeneration(-1)),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("generation"), int64(-1), "").WithOrigin("minimum").MarkAlpha(),
+			},
+		},
+		{
+			name:              "managedFields empty operation",
+			obj:               mkMeta(tweakManagedFields(metav1.ManagedFieldsEntry{FieldsType: "FieldsV1"})),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("managedFields").Index(0).Child("operation"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences empty apiVersion",
+			obj:               mkMeta(tweakOwnerRefs(mkOwnerRef(tweakRefAPIVersion("")))),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("apiVersion"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences empty kind",
+			obj:               mkMeta(tweakOwnerRefs(mkOwnerRef(tweakRefKind("")))),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("kind"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences empty name",
+			obj:               mkMeta(tweakOwnerRefs(mkOwnerRef(tweakRefName("")))),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("name"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences empty uid",
+			obj:               mkMeta(tweakOwnerRefs(mkOwnerRef(tweakRefUID("")))),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("uid"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences event is disallowed",
+			obj:               mkMeta(tweakOwnerRefs(mkOwnerRef(tweakRefKind("Event")))),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("ownerReferences").Index(0), metav1.OwnerReference{APIVersion: "v1", Kind: "Event", Name: "name", UID: "uid-1"}, "").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "invalid annotation key",
+			obj:               mkMeta(tweakAnnotations(map[string]string{"-invalid": "val"})),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("annotations"), "-invalid", "").WithOrigin("format=k8s-label-key").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "annotations size limit exceeded",
+			obj:               mkMeta(tweakAnnotations(map[string]string{"a": strings.Repeat("b", TotalAnnotationSizeLimitB)})),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.TooLong(fldPath.Child("annotations"), "", TotalAnnotationSizeLimitB).MarkFromImperative(),
+			},
+		},
+	}
+
+	matcher := field.ErrorMatcher{}.ByField().ByType().BySource().ByOrigin()
+
+	toExpectedErrs := func(allDeclarativeEnforced bool, betaEnabled bool, errs field.ErrorList) field.ErrorList {
+		expected := make(field.ErrorList, 0, len(errs))
+		for _, err := range errs {
+			e := *err
+			if !allDeclarativeEnforced && (e.IsAlpha() || (!betaEnabled && e.IsBeta())) {
+				_ = e.MarkFromImperative()
+				e.ValidationStabilityLevel = 0
+			}
+			expected = append(expected, &e)
+		}
+		return expected
+	}
+
+	for _, tc := range createCases {
+		for _, betaEnabled := range []bool{true, false} {
+			for _, allDeclarativeEnforced := range []bool{true, false} {
+				t.Run(fmt.Sprintf("Create: %s (betaEnabled=%v, allDeclarativeEnforced=%v)", tc.name, betaEnabled, allDeclarativeEnforced), func(t *testing.T) {
+					testCtx := ctx
+					if allDeclarativeEnforced {
+						testCtx = validate.WithAllDeclarativeEnforcedForTest(ctx)
+					}
+					errs := ValidateObjectMetaDeclaratively(testCtx, operation.Create, tc.obj, nil, tc.requiresNamespace, NameIsDNSSubdomain, fldPath, betaEnabled)
+					matcher.Test(t, toExpectedErrs(allDeclarativeEnforced, betaEnabled, tc.expectedErrs), errs)
+				})
+			}
+		}
+	}
+
+	updateCases := []struct {
+		name              string
+		obj               *metav1.ObjectMeta
+		oldObj            *metav1.ObjectMeta
+		requiresNamespace bool
+		expectedErrs      field.ErrorList
+	}{
+		{
+			name:              "valid update",
+			obj:               mkMeta(tweakResourceVersion("2")),
+			oldObj:            mkMeta(tweakResourceVersion("1")),
+			requiresNamespace: true,
+			expectedErrs:      nil,
+		},
+		{
+			name:              "valid generation zero on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakGeneration(0)),
+			oldObj:            mkMeta(tweakResourceVersion("1"), tweakGeneration(0)),
+			requiresNamespace: true,
+			expectedErrs:      nil,
+		},
+		{
+			name:              "decremented generation to zero on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakGeneration(0)),
+			oldObj:            mkMeta(tweakResourceVersion("1"), tweakGeneration(1)),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("generation"), int64(0), "must not be decremented").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "negative generation on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakGeneration(-1)),
+			oldObj:            mkMeta(tweakResourceVersion("1"), tweakGeneration(0)),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("generation"), int64(-1), "").WithOrigin("minimum").MarkAlpha(),
+				field.Invalid(fldPath.Child("generation"), int64(-1), "must not be decremented").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "immutable namespace",
+			obj:               mkMeta(tweakNamespace("new-ns"), tweakResourceVersion("2")),
+			oldObj:            mkMeta(tweakNamespace("old-ns"), tweakResourceVersion("1")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("namespace"), "new-ns", "").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "ownerReferences empty apiVersion on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakOwnerRefs(mkOwnerRef(tweakRefAPIVersion("")))),
+			oldObj:            mkMeta(tweakResourceVersion("1")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("apiVersion"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences empty kind on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakOwnerRefs(mkOwnerRef(tweakRefKind("")))),
+			oldObj:            mkMeta(tweakResourceVersion("1")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("kind"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences empty name on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakOwnerRefs(mkOwnerRef(tweakRefName("")))),
+			oldObj:            mkMeta(tweakResourceVersion("1")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("name"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "ownerReferences empty uid on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakOwnerRefs(mkOwnerRef(tweakRefUID("")))),
+			oldObj:            mkMeta(tweakResourceVersion("1")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Required(fldPath.Child("ownerReferences").Index(0).Child("uid"), "").MarkAlpha(),
+			},
+		},
+		{
+			name:              "invalid annotation key on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakAnnotations(map[string]string{"-invalid": "val"})),
+			oldObj:            mkMeta(tweakResourceVersion("1")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("annotations"), "-invalid", "").WithOrigin("format=k8s-label-key").MarkFromImperative(),
+			},
+		},
+		{
+			name:              "immutable uid on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakUID("uid-new")),
+			oldObj:            mkMeta(tweakResourceVersion("1"), tweakUID("uid-old")),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("uid"), types.UID("uid-new"), "").WithOrigin("immutable").MarkAlpha(),
+			},
+		},
+		{
+			name:              "immutable creationTimestamp on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakCreationTimestamp(later)),
+			oldObj:            mkMeta(tweakResourceVersion("1"), tweakCreationTimestamp(now)),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("creationTimestamp"), later, "").WithOrigin("immutable").MarkAlpha(),
+			},
+		},
+		{
+			name:              "immutable deletionTimestamp on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakDeletionTimestamp(&later)),
+			oldObj:            mkMeta(tweakResourceVersion("1"), tweakDeletionTimestamp(&now)),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("deletionTimestamp"), &later, "").WithOrigin("immutable").MarkAlpha(),
+			},
+		},
+		{
+			name:              "immutable deletionGracePeriodSeconds on update",
+			obj:               mkMeta(tweakResourceVersion("2"), tweakDeletionGracePeriodSeconds(&gracePeriod40)),
+			oldObj:            mkMeta(tweakResourceVersion("1"), tweakDeletionGracePeriodSeconds(&gracePeriod30)),
+			requiresNamespace: true,
+			expectedErrs: field.ErrorList{
+				field.Invalid(fldPath.Child("deletionGracePeriodSeconds"), &gracePeriod40, "").WithOrigin("immutable").MarkAlpha(),
+			},
+		},
+	}
+
+	for _, tc := range updateCases {
+		for _, betaEnabled := range []bool{true, false} {
+			for _, allDeclarativeEnforced := range []bool{true, false} {
+				t.Run(fmt.Sprintf("Update: %s (betaEnabled=%v, allDeclarativeEnforced=%v)", tc.name, betaEnabled, allDeclarativeEnforced), func(t *testing.T) {
+					testCtx := ctx
+					if allDeclarativeEnforced {
+						testCtx = validate.WithAllDeclarativeEnforcedForTest(ctx)
+					}
+					errs := ValidateObjectMetaDeclaratively(testCtx, operation.Update, tc.obj, tc.oldObj, tc.requiresNamespace, NameIsDNSSubdomain, fldPath, betaEnabled)
+					matcher.Test(t, toExpectedErrs(allDeclarativeEnforced, betaEnabled, tc.expectedErrs), errs)
+				})
+			}
+		}
+	}
+}
+
+func mkMeta(tweaks ...func(*metav1.ObjectMeta)) *metav1.ObjectMeta {
+	obj := &metav1.ObjectMeta{
+		Name:      "valid-name",
+		Namespace: "valid-ns",
+	}
+	for _, tweak := range tweaks {
+		tweak(obj)
+	}
+	return obj
+}
+
+func tweakName(n string) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.Name = n }
+}
+
+func tweakNamespace(ns string) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.Namespace = ns }
+}
+
+func tweakResourceVersion(rv string) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.ResourceVersion = rv }
+}
+
+func tweakGeneration(g int64) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.Generation = g }
+}
+
+func tweakAnnotations(ann map[string]string) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.Annotations = ann }
+}
+
+func tweakManagedFields(entries ...metav1.ManagedFieldsEntry) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.ManagedFields = entries }
+}
+
+func tweakUID(u string) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.UID = types.UID(u) }
+}
+
+func tweakCreationTimestamp(t metav1.Time) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.CreationTimestamp = t }
+}
+
+func tweakDeletionTimestamp(t *metav1.Time) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.DeletionTimestamp = t }
+}
+
+func tweakDeletionGracePeriodSeconds(gps *int64) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.DeletionGracePeriodSeconds = gps }
+}
+
+func tweakRefAPIVersion(v string) func(*metav1.OwnerReference) {
+	return func(r *metav1.OwnerReference) { r.APIVersion = v }
+}
+
+func tweakRefKind(k string) func(*metav1.OwnerReference) {
+	return func(r *metav1.OwnerReference) { r.Kind = k }
+}
+
+func tweakRefName(n string) func(*metav1.OwnerReference) {
+	return func(r *metav1.OwnerReference) { r.Name = n }
+}
+
+func tweakRefUID(u string) func(*metav1.OwnerReference) {
+	return func(r *metav1.OwnerReference) { r.UID = types.UID(u) }
+}
+
+func tweakOwnerRefs(refs ...metav1.OwnerReference) func(*metav1.ObjectMeta) {
+	return func(o *metav1.ObjectMeta) { o.OwnerReferences = refs }
+}
+
+func mkOwnerRef(tweaks ...func(*metav1.OwnerReference)) metav1.OwnerReference {
+	r := &metav1.OwnerReference{
+		APIVersion: "v1",
+		Kind:       "Pod",
+		Name:       "name",
+		UID:        "uid-1",
+	}
+	for _, tweak := range tweaks {
+		tweak(r)
+	}
+	return *r
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/api/validation/path/name.go b/third_party/k8s.io/apimachinery/pkg/api/validation/path/name.go
new file mode 100644
index 0000000000..c0dee8108a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/api/validation/path/name.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package path
+
+import (
+	"k8s.io/apimachinery/pkg/api/validate/content"
+)
+
+// IsValidPathSegmentName validates the name can be safely encoded as a path segment
+//
+// Deprecated: use content.IsPathSegmentName directly.
+var IsValidPathSegmentName = content.IsPathSegmentName
+
+// IsValidPathSegmentPrefix validates the name can be used as a prefix for a name which will be encoded as a path segment
+// It does not check for exact matches with disallowed names, since an arbitrary suffix might make the name valid
+//
+// Deprecated: use content.IsPathSegmentPrefix directly.
+var IsValidPathSegmentPrefix = content.IsPathSegmentPrefix
+
+// ValidatePathSegmentName validates the name can be safely encoded as a path segment
+//
+// Deprecated: use a locally defined function.
+func ValidatePathSegmentName(name string, prefix bool) []string {
+	if prefix {
+		return IsValidPathSegmentPrefix(name)
+	}
+	return IsValidPathSegmentName(name)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/OWNERS b/third_party/k8s.io/apimachinery/pkg/apis/OWNERS
new file mode 100644
index 0000000000..4023732476
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/OWNERS
@@ -0,0 +1,11 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+# Disable inheritance as this is an api owners file
+options:
+  no_parent_owners: true
+approvers:
+  - api-approvers
+reviewers:
+  - api-reviewers
+labels:
+  - kind/api-change
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/asn1/oid.go b/third_party/k8s.io/apimachinery/pkg/apis/asn1/oid.go
new file mode 100644
index 0000000000..59c363f919
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/asn1/oid.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package asn1
+
+import "encoding/asn1"
+
+// These constants store suffixes for use with the CNCF Private Enterprise Number allocated to Kubernetes:
+// https://www.iana.org/assignments/enterprise-numbers.txt
+//
+// Root: 1.3.6.1.4.1.57683
+//
+// Cloud Native Computing Foundation
+const (
+	// single-value, string value
+	x509UIDSuffix = 2
+)
+
+func makeOID(suffix int) asn1.ObjectIdentifier {
+	return asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57683, suffix}
+}
+
+// X509UID returns an OID (1.3.6.1.4.1.57683.2) for an element of an x509 distinguished name representing a user UID.
+// The UID is a unique value for a particular user that will change if the user is removed from the system
+// and another user is added with the same username.
+//
+// This element must not appear more than once in a distinguished name, and the value must be a string
+func X509UID() asn1.ObjectIdentifier {
+	return makeOID(x509UIDSuffix)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/fuzzer/fuzzer.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/fuzzer/fuzzer.go
new file mode 100644
index 0000000000..c263f1450d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/fuzzer/fuzzer.go
@@ -0,0 +1,339 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fuzzer
+
+import (
+	"fmt"
+	"math/rand"
+	"sort"
+	"strconv"
+	"strings"
+
+	"sigs.k8s.io/randfill"
+
+	apitesting "k8s.io/apimachinery/pkg/api/apitesting"
+	"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	metav1beta1 "k8s.io/apimachinery/pkg/apis/meta/v1beta1"
+	"k8s.io/apimachinery/pkg/runtime"
+	runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+func genericFuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
+	return []interface{}{
+		func(q *resource.Quantity, c randfill.Continue) {
+			*q = *resource.NewQuantity(c.Int63n(1000), resource.DecimalExponent)
+		},
+		func(j *int, c randfill.Continue) {
+			*j = int(c.Int31())
+		},
+		func(j **int, c randfill.Continue) {
+			if c.Bool() {
+				i := int(c.Int31())
+				*j = &i
+			} else {
+				*j = nil
+			}
+		},
+		func(j *runtime.TypeMeta, c randfill.Continue) {
+			// We have to customize the randomization of TypeMetas because their
+			// APIVersion and Kind must remain blank in memory.
+			j.APIVersion = ""
+			j.Kind = ""
+		},
+		func(j *runtime.Object, c randfill.Continue) {
+			// TODO: uncomment when round trip starts from a versioned object
+			if true { // c.Bool() {
+				*j = &runtime.Unknown{
+					// We do not set TypeMeta here because it is not carried through a round trip
+					Raw:         []byte(`{"apiVersion":"unknown.group/unknown","kind":"Something","someKey":"someValue"}`),
+					ContentType: runtime.ContentTypeJSON,
+				}
+			} else {
+				types := []runtime.Object{&metav1.Status{}, &metav1.APIGroup{}}
+				t := types[c.Rand.Intn(len(types))]
+				c.Fill(t)
+				*j = t
+			}
+		},
+		func(r *runtime.RawExtension, c randfill.Continue) {
+			// Pick an arbitrary type and fuzz it
+			types := []runtime.Object{&metav1.Status{}, &metav1.APIGroup{}}
+			obj := types[c.Rand.Intn(len(types))]
+			c.Fill(obj)
+
+			// Find a codec for converting the object to raw bytes.  This is necessary for the
+			// api version and kind to be correctly set be serialization.
+			var codec = apitesting.TestCodec(codecs, metav1.SchemeGroupVersion)
+
+			// Convert the object to raw bytes
+			bytes, err := runtime.Encode(codec, obj)
+			if err != nil {
+				panic(fmt.Sprintf("Failed to encode object: %v", err))
+			}
+
+			// strip trailing newlines which do not survive roundtrips
+			for len(bytes) >= 1 && bytes[len(bytes)-1] == 10 {
+				bytes = bytes[:len(bytes)-1]
+			}
+
+			// Set the bytes field on the RawExtension
+			r.Raw = bytes
+		},
+	}
+}
+
+// taken from randfill (nee gofuzz) internals for RandString
+type charRange struct {
+	first, last rune
+}
+
+func (c *charRange) choose(r *rand.Rand) rune {
+	count := int64(c.last - c.first + 1)
+	ch := c.first + rune(r.Int63n(count))
+
+	return ch
+}
+
+// randomLabelPart produces a valid random label value or name-part
+// of a label key.
+func randomLabelPart(c randfill.Continue, canBeEmpty bool) string {
+	validStartEnd := []charRange{{'0', '9'}, {'a', 'z'}, {'A', 'Z'}}
+	validMiddle := []charRange{{'0', '9'}, {'a', 'z'}, {'A', 'Z'},
+		{'.', '.'}, {'-', '-'}, {'_', '_'}}
+
+	partLen := c.Rand.Intn(64) // len is [0, 63]
+	if !canBeEmpty {
+		partLen = c.Rand.Intn(63) + 1 // len is [1, 63]
+	}
+
+	runes := make([]rune, partLen)
+	if partLen == 0 {
+		return string(runes)
+	}
+
+	runes[0] = validStartEnd[c.Rand.Intn(len(validStartEnd))].choose(c.Rand)
+	for i := range runes[1:] {
+		runes[i+1] = validMiddle[c.Rand.Intn(len(validMiddle))].choose(c.Rand)
+	}
+	runes[len(runes)-1] = validStartEnd[c.Rand.Intn(len(validStartEnd))].choose(c.Rand)
+
+	return string(runes)
+}
+
+func randomDNSLabel(c randfill.Continue) string {
+	validStartEnd := []charRange{{'0', '9'}, {'a', 'z'}}
+	validMiddle := []charRange{{'0', '9'}, {'a', 'z'}, {'-', '-'}}
+
+	partLen := c.Rand.Intn(63) + 1 // len is [1, 63]
+	runes := make([]rune, partLen)
+
+	runes[0] = validStartEnd[c.Rand.Intn(len(validStartEnd))].choose(c.Rand)
+	for i := range runes[1:] {
+		runes[i+1] = validMiddle[c.Rand.Intn(len(validMiddle))].choose(c.Rand)
+	}
+	runes[len(runes)-1] = validStartEnd[c.Rand.Intn(len(validStartEnd))].choose(c.Rand)
+
+	return string(runes)
+}
+
+func randomLabelKey(c randfill.Continue) string {
+	namePart := randomLabelPart(c, false)
+	prefixPart := ""
+
+	usePrefix := c.Bool()
+	if usePrefix {
+		// we can fit, with dots, at most 3 labels in the 253 allotted characters
+		prefixPartsLen := c.Rand.Intn(2) + 1
+		prefixParts := make([]string, prefixPartsLen)
+		for i := range prefixParts {
+			prefixParts[i] = randomDNSLabel(c)
+		}
+		prefixPart = strings.Join(prefixParts, ".") + "/"
+	}
+
+	return prefixPart + namePart
+}
+
+func v1FuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
+
+	return []interface{}{
+		func(j *metav1.TypeMeta, c randfill.Continue) {
+			// We have to customize the randomization of TypeMetas because their
+			// APIVersion and Kind must remain blank in memory.
+			j.APIVersion = ""
+			j.Kind = ""
+		},
+		func(j *metav1.ObjectMeta, c randfill.Continue) {
+			c.FillNoCustom(j)
+
+			j.ResourceVersion = strconv.FormatUint(c.Uint64(), 10)
+			j.UID = types.UID(c.String(0))
+
+			// Fuzzing sec and nsec in a smaller range (uint32 instead of int64),
+			// so that the result Unix time is a valid date and can be parsed into RFC3339 format.
+			var sec, nsec uint32
+			c.Fill(&sec)
+			c.Fill(&nsec)
+			j.CreationTimestamp = metav1.Unix(int64(sec), int64(nsec)).Rfc3339Copy()
+
+			if j.DeletionTimestamp != nil {
+				c.Fill(&sec)
+				c.Fill(&nsec)
+				t := metav1.Unix(int64(sec), int64(nsec)).Rfc3339Copy()
+				j.DeletionTimestamp = &t
+			}
+
+			if len(j.Labels) == 0 {
+				j.Labels = nil
+			} else {
+				delete(j.Labels, "")
+			}
+			if len(j.Annotations) == 0 {
+				j.Annotations = nil
+			} else {
+				delete(j.Annotations, "")
+			}
+			if len(j.OwnerReferences) == 0 {
+				j.OwnerReferences = nil
+			}
+			if len(j.Finalizers) == 0 {
+				j.Finalizers = nil
+			}
+		},
+		func(j *metav1.ResourceVersionMatch, c randfill.Continue) {
+			matches := []metav1.ResourceVersionMatch{"", metav1.ResourceVersionMatchExact, metav1.ResourceVersionMatchNotOlderThan}
+			*j = matches[c.Rand.Intn(len(matches))]
+		},
+		func(j *metav1.ListMeta, c randfill.Continue) {
+			j.ResourceVersion = strconv.FormatUint(c.Uint64(), 10)
+			j.SelfLink = c.String(0) //nolint:staticcheck // SA1019 backwards compatibility
+		},
+		func(j *metav1.LabelSelector, c randfill.Continue) {
+			c.FillNoCustom(j)
+			// we can't have an entirely empty selector, so force
+			// use of MatchExpression if necessary
+			if len(j.MatchLabels) == 0 && len(j.MatchExpressions) == 0 {
+				j.MatchExpressions = make([]metav1.LabelSelectorRequirement, c.Rand.Intn(2)+1)
+			}
+
+			if j.MatchLabels != nil {
+				fuzzedMatchLabels := make(map[string]string, len(j.MatchLabels))
+				for i := 0; i < len(j.MatchLabels); i++ {
+					fuzzedMatchLabels[randomLabelKey(c)] = randomLabelPart(c, true)
+				}
+				j.MatchLabels = fuzzedMatchLabels
+			}
+
+			validOperators := []metav1.LabelSelectorOperator{
+				metav1.LabelSelectorOpIn,
+				metav1.LabelSelectorOpNotIn,
+				metav1.LabelSelectorOpExists,
+				metav1.LabelSelectorOpDoesNotExist,
+			}
+
+			if j.MatchExpressions != nil {
+				// NB: the label selector parser code sorts match expressions by key, and
+				// sorts and deduplicates the values, so we need to make sure ours are
+				// sorted and deduplicated as well here to preserve round-trip comparison.
+				// In practice, not sorting doesn't hurt anything...
+
+				for i := range j.MatchExpressions {
+					req := metav1.LabelSelectorRequirement{}
+					c.Fill(&req)
+					req.Key = randomLabelKey(c)
+					req.Operator = validOperators[c.Rand.Intn(len(validOperators))]
+					if req.Operator == metav1.LabelSelectorOpIn || req.Operator == metav1.LabelSelectorOpNotIn {
+						if len(req.Values) == 0 {
+							// we must have some values here, so randomly choose a short length
+							req.Values = make([]string, c.Rand.Intn(2)+1)
+						}
+						for i := range req.Values {
+							req.Values[i] = randomLabelPart(c, true)
+						}
+						req.Values = sets.List(sets.New(req.Values...))
+					} else {
+						req.Values = nil
+					}
+					j.MatchExpressions[i] = req
+				}
+
+				sort.Slice(j.MatchExpressions, func(a, b int) bool { return j.MatchExpressions[a].Key < j.MatchExpressions[b].Key })
+			}
+		},
+		func(j *metav1.ManagedFieldsEntry, c randfill.Continue) {
+			c.FillNoCustom(j)
+			j.FieldsV1 = nil
+		},
+	}
+}
+
+func v1beta1FuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
+	return []interface{}{
+		func(r *metav1beta1.TableOptions, c randfill.Continue) {
+			c.FillNoCustom(r)
+			// NoHeaders is not serialized to the wire but is allowed within the versioned
+			// type because we don't use meta internal types in the client and API server.
+			r.NoHeaders = false
+		},
+		func(r *metav1beta1.TableRow, c randfill.Continue) {
+			c.Fill(&r.Object)
+			c.Fill(&r.Conditions)
+			if len(r.Conditions) == 0 {
+				r.Conditions = nil
+			}
+			n := c.Intn(10)
+			if n > 0 {
+				r.Cells = make([]interface{}, n)
+			}
+			for i := range r.Cells {
+				t := c.Intn(6)
+				switch t {
+				case 0:
+					r.Cells[i] = c.String(0)
+				case 1:
+					r.Cells[i] = c.Int63()
+				case 2:
+					r.Cells[i] = c.Bool()
+				case 3:
+					x := map[string]interface{}{}
+					for j := c.Intn(10) + 1; j >= 0; j-- {
+						x[c.String(0)] = c.String(0)
+					}
+					r.Cells[i] = x
+				case 4:
+					x := make([]interface{}, c.Intn(10))
+					for i := range x {
+						x[i] = c.Int63()
+					}
+					r.Cells[i] = x
+				default:
+					r.Cells[i] = nil
+				}
+			}
+		},
+	}
+}
+
+var Funcs = fuzzer.MergeFuzzerFuncs(
+	genericFuzzerFuncs,
+	v1FuzzerFuncs,
+	v1beta1FuzzerFuncs,
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/conversion.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/conversion.go
new file mode 100644
index 0000000000..f431157ec4
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/conversion.go
@@ -0,0 +1,30 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internalversion
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+)
+
+func Convert_v1_ListOptions_To_internalversion_ListOptions(in *v1.ListOptions, out *ListOptions, s conversion.Scope) error {
+	return autoConvert_v1_ListOptions_To_internalversion_ListOptions(in, out, s)
+}
+
+func Convert_internalversion_ListOptions_To_v1_ListOptions(in *ListOptions, out *v1.ListOptions, s conversion.Scope) error {
+	return autoConvert_internalversion_ListOptions_To_v1_ListOptions(in, out, s)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/defaults.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/defaults.go
new file mode 100644
index 0000000000..29c6a48b6a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/defaults.go
@@ -0,0 +1,38 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internalversion
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// SetListOptionsDefaults sets defaults on the provided ListOptions if applicable.
+//
+// TODO(#115478): once the watch-list fg is always on we register this function in the scheme (via AddTypeDefaultingFunc).
+// TODO(#115478): when the function is registered in the scheme remove all callers of this method.
+func SetListOptionsDefaults(obj *ListOptions, isWatchListFeatureEnabled bool) {
+	if !isWatchListFeatureEnabled {
+		return
+	}
+	if obj.SendInitialEvents != nil || len(obj.ResourceVersionMatch) != 0 {
+		return
+	}
+	legacy := obj.ResourceVersion == "" || obj.ResourceVersion == "0"
+	if obj.Watch && legacy {
+		turnOnInitialEvents := true
+		obj.SendInitialEvents = &turnOnInitialEvents
+		obj.ResourceVersionMatch = metav1.ResourceVersionMatchNotOlderThan
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/defaults_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/defaults_test.go
new file mode 100644
index 0000000000..f1c5016066
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/defaults_test.go
@@ -0,0 +1,107 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internalversion
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/utils/ptr"
+)
+
+func TestSetListOptionsDefaults(t *testing.T) {
+	scenarios := []struct {
+		name                    string
+		watchListFeatureEnabled bool
+		targetObj               ListOptions
+		expectedObj             ListOptions
+	}{
+		{
+			name:                    "no-op, RV doesn't match",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersion: "1"},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersion: "1"},
+		},
+		{
+			name:                    "no-op, SendInitialEvents set",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(true)},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(true)},
+		},
+		{
+			name:                    "no-op, ResourceVersionMatch set",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersionMatch: "m"},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersionMatch: "m"},
+		},
+		{
+			name:                    "no-op, Watch=false",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything()},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything()},
+		},
+		{
+			name:                    "defaults applied, match on empty RV",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(true), ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan},
+		},
+		{
+			name:                    "defaults applied, match on RV=0",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersion: "0"},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersion: "0", SendInitialEvents: ptr.To(true), ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan},
+		},
+		{
+			name:        "no-op, match on empty RV but watch-list fg is off",
+			targetObj:   ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true},
+			expectedObj: ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true},
+		},
+		{
+			name:                    "no-op, match on empty RV but SendInitialEvents is on",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(true)},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(true)},
+		},
+		{
+			name:                    "no-op, match on empty RV but SendInitialEvents is off",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(false)},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(false)},
+		},
+		{
+			name:                    "no-op, match on empty RV but ResourceVersionMatch set",
+			watchListFeatureEnabled: true,
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersionMatch: "m"},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersionMatch: "m"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		t.Run(scenario.name, func(t *testing.T) {
+			SetListOptionsDefaults(&scenario.targetObj, scenario.watchListFeatureEnabled)
+			if !apiequality.Semantic.DeepEqual(&scenario.expectedObj, &scenario.targetObj) {
+				t.Errorf("expected and defaulted objects are different:\n%s", cmp.Diff(&scenario.expectedObj, &scenario.targetObj))
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/doc.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/doc.go
new file mode 100644
index 0000000000..1e85c5c43d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +k8s:conversion-gen=k8s.io/apimachinery/pkg/apis/meta/v1
+
+package internalversion
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/register.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/register.go
new file mode 100644
index 0000000000..a59ac71268
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/register.go
@@ -0,0 +1,88 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internalversion
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	metav1beta1 "k8s.io/apimachinery/pkg/apis/meta/v1beta1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName is the group name for this API.
+const GroupName = "meta.k8s.io"
+
+var (
+	// TODO: move SchemeBuilder with zz_generated.deepcopy.go to k8s.io/api.
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	AddToScheme        = localSchemeBuilder.AddToScheme
+)
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
+
+// Kind takes an unqualified kind and returns a Group qualified GroupKind
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// addToGroupVersion registers common meta types into schemas.
+func addToGroupVersion(scheme *runtime.Scheme) error {
+	if err := scheme.AddIgnoredConversionType(&metav1.TypeMeta{}, &metav1.TypeMeta{}); err != nil {
+		return err
+	}
+	// ListOptions is the only options struct which needs conversion (it exposes labels and fields
+	// as selectors for convenience). The other types have only a single representation today.
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&ListOptions{},
+		&metav1.GetOptions{},
+		&metav1.DeleteOptions{},
+		&metav1.CreateOptions{},
+		&metav1.UpdateOptions{},
+	)
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&metav1.Table{},
+		&metav1.TableOptions{},
+		&metav1beta1.PartialObjectMetadata{},
+		&metav1beta1.PartialObjectMetadataList{},
+	)
+	if err := metav1beta1.AddMetaToScheme(scheme); err != nil {
+		return err
+	}
+	if err := metav1.AddMetaToScheme(scheme); err != nil {
+		return err
+	}
+	// Allow delete options to be decoded across all version in this scheme (we may want to be more clever than this)
+	scheme.AddUnversionedTypes(SchemeGroupVersion,
+		&metav1.DeleteOptions{},
+		&metav1.CreateOptions{},
+		&metav1.UpdateOptions{})
+
+	metav1.AddToGroupVersion(scheme, metav1.SchemeGroupVersion)
+	if err := metav1beta1.RegisterConversions(scheme); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Unlike other API groups, meta internal knows about all meta external versions, but keeps
+// the logic for conversion private.
+func init() {
+	localSchemeBuilder.Register(addToGroupVersion)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/doc.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/doc.go
new file mode 100644
index 0000000000..b5ce956ee5
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/doc.go
@@ -0,0 +1,17 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scheme
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/register.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/register.go
new file mode 100644
index 0000000000..585d7f44bd
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/register.go
@@ -0,0 +1,39 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scheme
+
+import (
+	"k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// Scheme is the registry for any type that adheres to the meta API spec.
+var Scheme = runtime.NewScheme()
+
+// Codecs provides access to encoding and decoding for the scheme.
+var Codecs = serializer.NewCodecFactory(Scheme)
+
+// ParameterCodec handles versioning of objects that are converted to query parameters.
+var ParameterCodec = runtime.NewParameterCodec(Scheme)
+
+// Unlike other API groups, meta internal knows about all meta external versions, but keeps
+// the logic for conversion private.
+func init() {
+	utilruntime.Must(internalversion.AddToScheme(Scheme))
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/register_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/register_test.go
new file mode 100644
index 0000000000..e17f28a7a0
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/register_test.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scheme
+
+import (
+	"net/url"
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestListOptions(t *testing.T) {
+	// verify round trip conversion
+	ten := int64(10)
+	in := &metav1.ListOptions{
+		LabelSelector:   "a=1",
+		FieldSelector:   "b=1",
+		ResourceVersion: "10",
+		TimeoutSeconds:  &ten,
+		Watch:           true,
+	}
+	out := &metainternalversion.ListOptions{}
+	if err := Scheme.Convert(in, out, nil); err != nil {
+		t.Fatal(err)
+	}
+	actual := &metav1.ListOptions{}
+	if err := Scheme.Convert(out, actual, nil); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(in, actual) {
+		t.Errorf("unexpected: %s", cmp.Diff(in, actual))
+	}
+
+	// verify failing conversion
+	for i, failingObject := range []*metav1.ListOptions{
+		{LabelSelector: "a!!!"},
+		{FieldSelector: "a!!!"},
+	} {
+		out = &metainternalversion.ListOptions{}
+		if err := Scheme.Convert(failingObject, out, nil); err == nil {
+			t.Errorf("%d: unexpected conversion: %#v", i, out)
+		}
+	}
+
+	// verify kind registration
+	if gvks, unversioned, err := Scheme.ObjectKinds(in); err != nil || unversioned || gvks[0] != metav1.SchemeGroupVersion.WithKind("ListOptions") {
+		t.Errorf("unexpected: %v %v %v", gvks[0], unversioned, err)
+	}
+	if gvks, unversioned, err := Scheme.ObjectKinds(out); err != nil || unversioned || gvks[0] != metainternalversion.SchemeGroupVersion.WithKind("ListOptions") {
+		t.Errorf("unexpected: %v %v %v", gvks[0], unversioned, err)
+	}
+
+	actual = &metav1.ListOptions{}
+	if err := ParameterCodec.DecodeParameters(url.Values{"watch": []string{"1"}}, metav1.SchemeGroupVersion, actual); err != nil {
+		t.Fatal(err)
+	}
+	if !actual.Watch {
+		t.Errorf("unexpected watch decode: %#v", actual)
+	}
+
+	// check ParameterCodec
+	query, err := ParameterCodec.EncodeParameters(in, metav1.SchemeGroupVersion)
+	if err != nil {
+		t.Fatal(err)
+	}
+	actual = &metav1.ListOptions{}
+	if err := ParameterCodec.DecodeParameters(query, metav1.SchemeGroupVersion, actual); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(in, actual) {
+		t.Errorf("unexpected: %s", cmp.Diff(in, actual))
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/roundtrip_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/roundtrip_test.go
new file mode 100644
index 0000000000..028942c6a8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/roundtrip_test.go
@@ -0,0 +1,28 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scheme
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/apitesting/roundtrip"
+	"k8s.io/apimachinery/pkg/apis/meta/fuzzer"
+)
+
+func TestRoundTrip(t *testing.T) {
+	roundtrip.RoundTripTestForScheme(t, Scheme, fuzzer.Funcs)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/types.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/types.go
new file mode 100644
index 0000000000..a34a11c3e3
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/types.go
@@ -0,0 +1,108 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internalversion
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// ListOptions is the query options to a standard REST list call.
+type ListOptions struct {
+	metav1.TypeMeta
+
+	// A selector based on labels
+	LabelSelector labels.Selector
+	// A selector based on fields
+	FieldSelector fields.Selector
+	// If true, watch for changes to this list
+	Watch bool
+	// allowWatchBookmarks requests watch events with type "BOOKMARK".
+	// Servers that do not implement bookmarks may ignore this flag and
+	// bookmarks are sent at the server's discretion. Clients should not
+	// assume bookmarks are returned at any specific interval, nor may they
+	// assume the server will send any BOOKMARK event during a session.
+	// If this is not a watch, this field is ignored.
+	AllowWatchBookmarks bool
+	// resourceVersion sets a constraint on what resource versions a request may be served from.
+	// See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+	// details.
+	ResourceVersion string
+	// resourceVersionMatch determines how resourceVersion is applied to list calls.
+	// It is highly recommended that resourceVersionMatch be set for list calls where
+	// resourceVersion is set.
+	// See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+	// details.
+	ResourceVersionMatch metav1.ResourceVersionMatch
+
+	// Timeout for the list/watch call.
+	TimeoutSeconds *int64
+	// Limit specifies the maximum number of results to return from the server. The server may
+	// not support this field on all resource types, but if it does and more results remain it
+	// will set the continue field on the returned list object.
+	Limit int64
+	// Continue is a token returned by the server that lets a client retrieve chunks of results
+	// from the server by specifying limit. The server may reject requests for continuation tokens
+	// it does not recognize and will return a 410 error if the token can no longer be used because
+	// it has expired.
+	Continue string
+
+	// `sendInitialEvents=true` may be set together with `watch=true`.
+	// In that case, the watch stream will begin with synthetic events to
+	// produce the current state of objects in the collection. Once all such
+	// events have been sent, a synthetic "Bookmark" event  will be sent.
+	// The bookmark will report the ResourceVersion (RV) corresponding to the
+	// set of objects, and be marked with `"k8s.io/initial-events-end": "true"` annotation.
+	// Afterwards, the watch stream will proceed as usual, sending watch events
+	// corresponding to changes (subsequent to the RV) to objects watched.
+	//
+	// When `sendInitialEvents` option is set, we require `resourceVersionMatch`
+	// option to also be set. The semantic of the watch request is as following:
+	// - `resourceVersionMatch` = NotOlderThan
+	//   is interpreted as "data at least as new as the provided `resourceVersion`"
+	//   and the bookmark event is send when the state is synced
+	//   to a `resourceVersion` at least as fresh as the one provided by the ListOptions.
+	//   If `resourceVersion` is unset, this is interpreted as "consistent read" and the
+	//   bookmark event is send when the state is synced at least to the moment
+	//   when request started being processed.
+	// - `resourceVersionMatch` set to any other value or unset
+	//   Invalid error is returned.
+	//
+	// Defaults to true if `resourceVersion=""` or `resourceVersion="0"` (for backward
+	// compatibility reasons) and to false otherwise.
+	SendInitialEvents *bool
+
+	// ShardSelector is the raw shard selector string from the request.
+	// Parsing is deferred to the apiserver storage layer where the CEL
+	// parser dependency is available.
+	ShardSelector string
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// List holds a list of objects, which may not be known by the server.
+type List struct {
+	metav1.TypeMeta
+	// +optional
+	metav1.ListMeta
+
+	Items []runtime.Object
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/validation/validation.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/validation/validation.go
new file mode 100644
index 0000000000..2734a8f3ba
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/validation/validation.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// ValidateListOptions returns all validation errors found while validating the ListOptions.
+func ValidateListOptions(options *internalversion.ListOptions, isWatchListFeatureEnabled bool) field.ErrorList {
+	if options.Watch {
+		return validateWatchOptions(options, isWatchListFeatureEnabled)
+	}
+	allErrs := field.ErrorList{}
+	if match := options.ResourceVersionMatch; len(match) > 0 {
+		if len(options.ResourceVersion) == 0 {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("resourceVersionMatch"), "resourceVersionMatch is forbidden unless resourceVersion is provided"))
+		}
+		if len(options.Continue) > 0 {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("resourceVersionMatch"), "resourceVersionMatch is forbidden when continue is provided"))
+		}
+		if match != metav1.ResourceVersionMatchExact && match != metav1.ResourceVersionMatchNotOlderThan {
+			allErrs = append(allErrs, field.NotSupported(field.NewPath("resourceVersionMatch"), match, []string{string(metav1.ResourceVersionMatchExact), string(metav1.ResourceVersionMatchNotOlderThan), ""}))
+		}
+		if match == metav1.ResourceVersionMatchExact && options.ResourceVersion == "0" {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("resourceVersionMatch"), "resourceVersionMatch \"exact\" is forbidden for resourceVersion \"0\""))
+		}
+	}
+	if options.SendInitialEvents != nil {
+		allErrs = append(allErrs, field.Forbidden(field.NewPath("sendInitialEvents"), "sendInitialEvents is forbidden for list"))
+	}
+	return allErrs
+}
+
+func validateWatchOptions(options *internalversion.ListOptions, isWatchListFeatureEnabled bool) field.ErrorList {
+	allErrs := field.ErrorList{}
+	match := options.ResourceVersionMatch
+	if options.SendInitialEvents != nil {
+		if match != metav1.ResourceVersionMatchNotOlderThan {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("resourceVersionMatch"), fmt.Sprintf("sendInitialEvents requires setting resourceVersionMatch to %s", metav1.ResourceVersionMatchNotOlderThan)))
+		}
+		if !isWatchListFeatureEnabled {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("sendInitialEvents"), "sendInitialEvents is forbidden for watch unless the WatchList feature gate is enabled"))
+		}
+	}
+	if len(match) > 0 {
+		if options.SendInitialEvents == nil {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("resourceVersionMatch"), "resourceVersionMatch is forbidden for watch unless sendInitialEvents is provided"))
+		}
+		if match != metav1.ResourceVersionMatchNotOlderThan {
+			allErrs = append(allErrs, field.NotSupported(field.NewPath("resourceVersionMatch"), match, []string{string(metav1.ResourceVersionMatchNotOlderThan)}))
+		}
+		if len(options.Continue) > 0 {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("resourceVersionMatch"), "resourceVersionMatch is forbidden when continue is provided"))
+		}
+	}
+	return allErrs
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/validation/validation_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/validation/validation_test.go
new file mode 100644
index 0000000000..450627d923
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/validation/validation_test.go
@@ -0,0 +1,193 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/apis/meta/internalversion"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/utils/ptr"
+)
+
+func TestValidateListOptions(t *testing.T) {
+	cases := []struct {
+		name                    string
+		opts                    internalversion.ListOptions
+		watchListFeatureEnabled bool
+		expectErrors            []string
+	}{{
+		name: "valid-default",
+		opts: internalversion.ListOptions{},
+	}, {
+		name: "valid-resourceversionmatch-exact",
+		opts: internalversion.ListOptions{
+			ResourceVersion:      "1",
+			ResourceVersionMatch: metav1.ResourceVersionMatchExact,
+		},
+	}, {
+		name: "invalid-resourceversionmatch-exact",
+		opts: internalversion.ListOptions{
+			ResourceVersion:      "0",
+			ResourceVersionMatch: metav1.ResourceVersionMatchExact,
+		},
+		expectErrors: []string{"resourceVersionMatch: Forbidden: resourceVersionMatch \"exact\" is forbidden for resourceVersion \"0\""},
+	}, {
+		name: "valid-resourceversionmatch-notolderthan",
+		opts: internalversion.ListOptions{
+			ResourceVersion:      "0",
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+		},
+	}, {
+		name: "invalid-resourceversionmatch",
+		opts: internalversion.ListOptions{
+			ResourceVersion:      "0",
+			ResourceVersionMatch: "foo",
+		},
+		expectErrors: []string{"resourceVersionMatch: Unsupported value: \"foo\": supported values: \"Exact\", \"NotOlderThan\", \"\""},
+	}, {
+		name: "list-sendInitialEvents-forbidden",
+		opts: internalversion.ListOptions{
+			SendInitialEvents: ptr.To(true),
+		},
+		expectErrors: []string{"sendInitialEvents: Forbidden: sendInitialEvents is forbidden for list"},
+	}, {
+		name: "valid-watch-default",
+		opts: internalversion.ListOptions{
+			Watch: true,
+		},
+	}, {
+		name: "valid-watch-sendInitialEvents-on",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(true),
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+			AllowWatchBookmarks:  true,
+		},
+		watchListFeatureEnabled: true,
+	}, {
+		name: "valid-watch-sendInitialEvents-off",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(false),
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+			AllowWatchBookmarks:  true,
+		},
+		watchListFeatureEnabled: true,
+	}, {
+		name: "watch-resourceversionmatch-without-sendInitialEvents-forbidden",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+		},
+		expectErrors: []string{"resourceVersionMatch: Forbidden: resourceVersionMatch is forbidden for watch unless sendInitialEvents is provided"},
+	}, {
+		name: "watch-sendInitialEvents-without-resourceversionmatch-forbidden",
+		opts: internalversion.ListOptions{
+			Watch:             true,
+			SendInitialEvents: ptr.To(true),
+		},
+		expectErrors: []string{"resourceVersionMatch: Forbidden: sendInitialEvents requires setting resourceVersionMatch to NotOlderThan", "sendInitialEvents: Forbidden: sendInitialEvents is forbidden for watch unless the WatchList feature gate is enabled"},
+	}, {
+		name: "watch-sendInitialEvents-with-exact-resourceversionmatch-forbidden",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(true),
+			ResourceVersionMatch: metav1.ResourceVersionMatchExact,
+			AllowWatchBookmarks:  true,
+		},
+		watchListFeatureEnabled: true,
+		expectErrors:            []string{"resourceVersionMatch: Forbidden: sendInitialEvents requires setting resourceVersionMatch to NotOlderThan", "resourceVersionMatch: Unsupported value: \"Exact\": supported values: \"NotOlderThan\""},
+	}, {
+		name: "watch-sendInitialEvents-on-with-empty-resourceversionmatch-forbidden",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(true),
+			ResourceVersionMatch: "",
+		},
+		expectErrors: []string{"resourceVersionMatch: Forbidden: sendInitialEvents requires setting resourceVersionMatch to NotOlderThan", "sendInitialEvents: Forbidden: sendInitialEvents is forbidden for watch unless the WatchList feature gate is enabled"},
+	}, {
+		name: "watch-sendInitialEvents-off-with-empty-resourceversionmatch-forbidden",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(false),
+			ResourceVersionMatch: "",
+		},
+		expectErrors: []string{"resourceVersionMatch: Forbidden: sendInitialEvents requires setting resourceVersionMatch to NotOlderThan", "sendInitialEvents: Forbidden: sendInitialEvents is forbidden for watch unless the WatchList feature gate is enabled"},
+	}, {
+		name: "watch-sendInitialEvents-with-incorrect-resourceversionmatch-forbidden",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(true),
+			ResourceVersionMatch: "incorrect",
+			AllowWatchBookmarks:  true,
+		},
+		watchListFeatureEnabled: true,
+		expectErrors:            []string{"resourceVersionMatch: Forbidden: sendInitialEvents requires setting resourceVersionMatch to NotOlderThan", "resourceVersionMatch: Unsupported value: \"incorrect\": supported values: \"NotOlderThan\""},
+	}, {
+		// note that validating allowWatchBookmarks would break backward compatibility
+		// because it was possible to request initial events via resourceVersion=0 before this change
+		name: "watch-sendInitialEvents-no-allowWatchBookmark",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(true),
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+		},
+		watchListFeatureEnabled: true,
+	}, {
+		name: "watch-sendInitialEvents-no-watchlist-fg-disabled",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(true),
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+			AllowWatchBookmarks:  true,
+		},
+		expectErrors: []string{"sendInitialEvents: Forbidden: sendInitialEvents is forbidden for watch unless the WatchList feature gate is enabled"},
+	}, {
+		name: "watch-sendInitialEvents-no-watchlist-fg-disabled",
+		opts: internalversion.ListOptions{
+			Watch:                true,
+			SendInitialEvents:    ptr.To(true),
+			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
+			AllowWatchBookmarks:  true,
+			Continue:             "123",
+		},
+		watchListFeatureEnabled: true,
+		expectErrors:            []string{"resourceVersionMatch: Forbidden: resourceVersionMatch is forbidden when continue is provided"},
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := ValidateListOptions(&tc.opts, tc.watchListFeatureEnabled)
+			if len(tc.expectErrors) > 0 {
+				if len(errs) != len(tc.expectErrors) {
+					t.Errorf("expected %d errors but got %d errors", len(tc.expectErrors), len(errs))
+					return
+				}
+				for i, expectedErr := range tc.expectErrors {
+					if expectedErr != errs[i].Error() {
+						t.Errorf("expected error '%s' but got '%s'", expectedErr, errs[i].Error())
+					}
+				}
+				return
+			}
+			if len(errs) != 0 {
+				t.Errorf("expected no errors, but got: %v", errs)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/zz_generated.conversion.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/zz_generated.conversion.go
new file mode 100644
index 0000000000..f321ad2345
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/zz_generated.conversion.go
@@ -0,0 +1,140 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by conversion-gen. DO NOT EDIT.
+
+package internalversion
+
+import (
+	unsafe "unsafe"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	conversion "k8s.io/apimachinery/pkg/conversion"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+func init() {
+	localSchemeBuilder.Register(RegisterConversions)
+}
+
+// RegisterConversions adds conversion functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*List)(nil), (*v1.List)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_internalversion_List_To_v1_List(a.(*List), b.(*v1.List), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*v1.List)(nil), (*List)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_List_To_internalversion_List(a.(*v1.List), b.(*List), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ListOptions)(nil), (*v1.ListOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_internalversion_ListOptions_To_v1_ListOptions(a.(*ListOptions), b.(*v1.ListOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*v1.ListOptions)(nil), (*ListOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_ListOptions_To_internalversion_ListOptions(a.(*v1.ListOptions), b.(*ListOptions), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+func autoConvert_internalversion_List_To_v1_List(in *List, out *v1.List, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.RawExtension, len(*in))
+		for i := range *in {
+			if err := runtime.Convert_runtime_Object_To_runtime_RawExtension(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
+	return nil
+}
+
+// Convert_internalversion_List_To_v1_List is an autogenerated conversion function.
+func Convert_internalversion_List_To_v1_List(in *List, out *v1.List, s conversion.Scope) error {
+	return autoConvert_internalversion_List_To_v1_List(in, out, s)
+}
+
+func autoConvert_v1_List_To_internalversion_List(in *v1.List, out *List, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.Object, len(*in))
+		for i := range *in {
+			if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
+	return nil
+}
+
+// Convert_v1_List_To_internalversion_List is an autogenerated conversion function.
+func Convert_v1_List_To_internalversion_List(in *v1.List, out *List, s conversion.Scope) error {
+	return autoConvert_v1_List_To_internalversion_List(in, out, s)
+}
+
+func autoConvert_internalversion_ListOptions_To_v1_ListOptions(in *ListOptions, out *v1.ListOptions, s conversion.Scope) error {
+	if err := v1.Convert_labels_Selector_To_string(&in.LabelSelector, &out.LabelSelector, s); err != nil {
+		return err
+	}
+	if err := v1.Convert_fields_Selector_To_string(&in.FieldSelector, &out.FieldSelector, s); err != nil {
+		return err
+	}
+	out.Watch = in.Watch
+	out.AllowWatchBookmarks = in.AllowWatchBookmarks
+	out.ResourceVersion = in.ResourceVersion
+	out.ResourceVersionMatch = v1.ResourceVersionMatch(in.ResourceVersionMatch)
+	out.TimeoutSeconds = (*int64)(unsafe.Pointer(in.TimeoutSeconds))
+	out.Limit = in.Limit
+	out.Continue = in.Continue
+	out.SendInitialEvents = (*bool)(unsafe.Pointer(in.SendInitialEvents))
+	out.ShardSelector = in.ShardSelector
+	return nil
+}
+
+func autoConvert_v1_ListOptions_To_internalversion_ListOptions(in *v1.ListOptions, out *ListOptions, s conversion.Scope) error {
+	if err := v1.Convert_string_To_labels_Selector(&in.LabelSelector, &out.LabelSelector, s); err != nil {
+		return err
+	}
+	if err := v1.Convert_string_To_fields_Selector(&in.FieldSelector, &out.FieldSelector, s); err != nil {
+		return err
+	}
+	out.Watch = in.Watch
+	out.AllowWatchBookmarks = in.AllowWatchBookmarks
+	out.ResourceVersion = in.ResourceVersion
+	out.ResourceVersionMatch = v1.ResourceVersionMatch(in.ResourceVersionMatch)
+	out.TimeoutSeconds = (*int64)(unsafe.Pointer(in.TimeoutSeconds))
+	out.Limit = in.Limit
+	out.Continue = in.Continue
+	out.SendInitialEvents = (*bool)(unsafe.Pointer(in.SendInitialEvents))
+	out.ShardSelector = in.ShardSelector
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/zz_generated.deepcopy.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..af66a2ac4c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/internalversion/zz_generated.deepcopy.go
@@ -0,0 +1,102 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package internalversion
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *List) DeepCopyInto(out *List) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.Object, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				(*out)[i] = (*in)[i].DeepCopyObject()
+			}
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new List.
+func (in *List) DeepCopy() *List {
+	if in == nil {
+		return nil
+	}
+	out := new(List)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *List) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListOptions) DeepCopyInto(out *ListOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.LabelSelector != nil {
+		out.LabelSelector = in.LabelSelector.DeepCopySelector()
+	}
+	if in.FieldSelector != nil {
+		out.FieldSelector = in.FieldSelector.DeepCopySelector()
+	}
+	if in.TimeoutSeconds != nil {
+		in, out := &in.TimeoutSeconds, &out.TimeoutSeconds
+		*out = new(int64)
+		**out = **in
+	}
+	if in.SendInitialEvents != nil {
+		in, out := &in.SendInitialEvents, &out.SendInitialEvents
+		*out = new(bool)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListOptions.
+func (in *ListOptions) DeepCopy() *ListOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(ListOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ListOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/OWNERS b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/OWNERS
new file mode 100644
index 0000000000..ec414a84b9
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/OWNERS
@@ -0,0 +1,17 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+reviewers:
+  - thockin
+  - smarterclayton
+  - wojtek-t
+  - deads2k
+  - caesarxuchao
+  - liggitt
+  - sttts
+  - luxas
+  - janetkuo
+  - justinsb
+  - soltysh
+  - dims
+emeritus_reviewers:
+  - ncdc
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/controller_ref.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/controller_ref.go
new file mode 100644
index 0000000000..5005beb12d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/controller_ref.go
@@ -0,0 +1,68 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/utils/ptr"
+)
+
+// IsControlledBy checks if the  object has a controllerRef set to the given owner
+func IsControlledBy(obj Object, owner Object) bool {
+	ref := GetControllerOfNoCopy(obj)
+	if ref == nil {
+		return false
+	}
+	return ref.UID == owner.GetUID()
+}
+
+// GetControllerOf returns a pointer to a copy of the controllerRef if controllee has a controller
+func GetControllerOf(controllee Object) *OwnerReference {
+	ref := GetControllerOfNoCopy(controllee)
+	if ref == nil {
+		return nil
+	}
+	cp := *ref
+	cp.Controller = ptr.To(*ref.Controller)
+	if ref.BlockOwnerDeletion != nil {
+		cp.BlockOwnerDeletion = ptr.To(*ref.BlockOwnerDeletion)
+	}
+	return &cp
+}
+
+// GetControllerOfNoCopy returns a pointer to the controllerRef if controllee has a controller
+func GetControllerOfNoCopy(controllee Object) *OwnerReference {
+	refs := controllee.GetOwnerReferences()
+	for i := range refs {
+		if refs[i].Controller != nil && *refs[i].Controller {
+			return &refs[i]
+		}
+	}
+	return nil
+}
+
+// NewControllerRef creates an OwnerReference pointing to the given owner.
+func NewControllerRef(owner Object, gvk schema.GroupVersionKind) *OwnerReference {
+	return &OwnerReference{
+		APIVersion:         gvk.GroupVersion().String(),
+		Kind:               gvk.Kind,
+		Name:               owner.GetName(),
+		UID:                owner.GetUID(),
+		BlockOwnerDeletion: ptr.To(true),
+		Controller:         ptr.To(true),
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/controller_ref_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/controller_ref_test.go
new file mode 100644
index 0000000000..3abfb9aa91
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/controller_ref_test.go
@@ -0,0 +1,173 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type metaObj struct {
+	ObjectMeta
+	TypeMeta
+}
+
+func TestNewControllerRef(t *testing.T) {
+	gvk := schema.GroupVersionKind{
+		Group:   "group",
+		Version: "v1",
+		Kind:    "Kind",
+	}
+	obj1 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			Name: "name",
+			UID:  "uid1",
+		},
+	}
+	controllerRef := NewControllerRef(obj1, gvk)
+	if controllerRef.UID != obj1.UID {
+		t.Errorf("Incorrect UID: %s", controllerRef.UID)
+	}
+	if controllerRef.Controller == nil || *controllerRef.Controller != true {
+		t.Error("Controller must be set to true")
+	}
+	if controllerRef.BlockOwnerDeletion == nil || *controllerRef.BlockOwnerDeletion != true {
+		t.Error("BlockOwnerDeletion must be set to true")
+	}
+	if controllerRef.APIVersion == "" ||
+		controllerRef.Kind == "" ||
+		controllerRef.Name == "" {
+		t.Errorf("All controllerRef fields must be set: %v", controllerRef)
+	}
+}
+
+func TestGetControllerOf(t *testing.T) {
+	gvk := schema.GroupVersionKind{
+		Group:   "group",
+		Version: "v1",
+		Kind:    "Kind",
+	}
+	obj1 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			UID:  "uid1",
+			Name: "name1",
+		},
+	}
+	controllerRef := NewControllerRef(obj1, gvk)
+	controllerRef.BlockOwnerDeletion = nil
+	var falseRef = false
+	obj2 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			UID:  "uid2",
+			Name: "name1",
+			OwnerReferences: []OwnerReference{
+				{
+					Name:       "owner1",
+					Controller: &falseRef,
+				},
+				*controllerRef,
+				{
+					Name:       "owner2",
+					Controller: &falseRef,
+				},
+			},
+		},
+	}
+
+	if GetControllerOf(obj1) != nil {
+		t.Error("GetControllerOf must return null")
+	}
+	c := GetControllerOf(obj2)
+	if c.Name != controllerRef.Name || c.UID != controllerRef.UID {
+		t.Errorf("Incorrect result of GetControllerOf: %v", c)
+	}
+
+	// test that all pointers are also deep copied
+	if (c.Controller == controllerRef.Controller) ||
+		(c.BlockOwnerDeletion != nil && c.BlockOwnerDeletion == controllerRef.BlockOwnerDeletion) {
+		t.Errorf("GetControllerOf did not return deep copy: %v", c)
+	}
+}
+
+func BenchmarkGetControllerOf(b *testing.B) {
+	gvk := schema.GroupVersionKind{
+		Group:   "group",
+		Version: "v1",
+		Kind:    "Kind",
+	}
+	obj1 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			UID:  "9d0cdf8a-dedc-11e9-bf91-42010a800167",
+			Name: "my-object",
+		},
+	}
+	controllerRef := NewControllerRef(obj1, gvk)
+	controllerRef2 := *controllerRef
+	controllerRef2.Controller = nil
+	obj2 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			UID:             "uid2",
+			Name:            "name1",
+			OwnerReferences: []OwnerReference{controllerRef2, controllerRef2, *controllerRef},
+		},
+	}
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for n := 0; n < b.N; n++ {
+		c := GetControllerOf(obj2)
+		if c.Name != controllerRef.Name || c.UID != controllerRef.UID {
+			b.Errorf("Incorrect result of GetControllerOf: %v", c)
+		}
+	}
+}
+
+func TestIsControlledBy(t *testing.T) {
+	gvk := schema.GroupVersionKind{
+		Group:   "group",
+		Version: "v1",
+		Kind:    "Kind",
+	}
+	obj1 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			UID: "uid1",
+		},
+	}
+	obj2 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			UID: "uid2",
+			OwnerReferences: []OwnerReference{
+				*NewControllerRef(obj1, gvk),
+			},
+		},
+	}
+	obj3 := &metaObj{
+		ObjectMeta: ObjectMeta{
+			UID: "uid3",
+			OwnerReferences: []OwnerReference{
+				*NewControllerRef(obj2, gvk),
+			},
+		},
+	}
+	if !IsControlledBy(obj2, obj1) || !IsControlledBy(obj3, obj2) {
+		t.Error("Incorrect IsControlledBy result: false")
+	}
+	if IsControlledBy(obj3, obj1) {
+		t.Error("Incorrect IsControlledBy result: true")
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/conversion.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/conversion.go
new file mode 100644
index 0000000000..8eaebb80e9
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/conversion.go
@@ -0,0 +1,355 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"fmt"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/intstr"
+)
+
+func Convert_Pointer_float64_To_float64(in **float64, out *float64, s conversion.Scope) error {
+	if *in == nil {
+		*out = 0
+		return nil
+	}
+	*out = float64(**in)
+	return nil
+}
+
+func Convert_float64_To_Pointer_float64(in *float64, out **float64, s conversion.Scope) error {
+	temp := float64(*in)
+	*out = &temp
+	return nil
+}
+
+func Convert_Pointer_int32_To_int32(in **int32, out *int32, s conversion.Scope) error {
+	if *in == nil {
+		*out = 0
+		return nil
+	}
+	*out = int32(**in)
+	return nil
+}
+
+func Convert_int32_To_Pointer_int32(in *int32, out **int32, s conversion.Scope) error {
+	temp := int32(*in)
+	*out = &temp
+	return nil
+}
+
+func Convert_Pointer_int64_To_int64(in **int64, out *int64, s conversion.Scope) error {
+	if *in == nil {
+		*out = 0
+		return nil
+	}
+	*out = int64(**in)
+	return nil
+}
+
+func Convert_int64_To_Pointer_int64(in *int64, out **int64, s conversion.Scope) error {
+	temp := int64(*in)
+	*out = &temp
+	return nil
+}
+
+func Convert_Pointer_int64_To_int(in **int64, out *int, s conversion.Scope) error {
+	if *in == nil {
+		*out = 0
+		return nil
+	}
+	*out = int(**in)
+	return nil
+}
+
+func Convert_int_To_Pointer_int64(in *int, out **int64, s conversion.Scope) error {
+	temp := int64(*in)
+	*out = &temp
+	return nil
+}
+
+func Convert_Pointer_string_To_string(in **string, out *string, s conversion.Scope) error {
+	if *in == nil {
+		*out = ""
+		return nil
+	}
+	*out = **in
+	return nil
+}
+
+func Convert_string_To_Pointer_string(in *string, out **string, s conversion.Scope) error {
+	if in == nil {
+		stringVar := ""
+		*out = &stringVar
+		return nil
+	}
+	*out = in
+	return nil
+}
+
+func Convert_Pointer_bool_To_bool(in **bool, out *bool, s conversion.Scope) error {
+	if *in == nil {
+		*out = false
+		return nil
+	}
+	*out = **in
+	return nil
+}
+
+func Convert_bool_To_Pointer_bool(in *bool, out **bool, s conversion.Scope) error {
+	if in == nil {
+		boolVar := false
+		*out = &boolVar
+		return nil
+	}
+	*out = in
+	return nil
+}
+
+// +k8s:conversion-fn=drop
+func Convert_v1_TypeMeta_To_v1_TypeMeta(in, out *TypeMeta, s conversion.Scope) error {
+	// These values are explicitly not copied
+	//out.APIVersion = in.APIVersion
+	//out.Kind = in.Kind
+	return nil
+}
+
+// +k8s:conversion-fn=copy-only
+func Convert_v1_ListMeta_To_v1_ListMeta(in, out *ListMeta, s conversion.Scope) error {
+	*out = *in
+	return nil
+}
+
+// +k8s:conversion-fn=copy-only
+func Convert_v1_DeleteOptions_To_v1_DeleteOptions(in, out *DeleteOptions, s conversion.Scope) error {
+	*out = *in
+	return nil
+}
+
+// +k8s:conversion-fn=copy-only
+func Convert_intstr_IntOrString_To_intstr_IntOrString(in, out *intstr.IntOrString, s conversion.Scope) error {
+	*out = *in
+	return nil
+}
+
+func Convert_Pointer_intstr_IntOrString_To_intstr_IntOrString(in **intstr.IntOrString, out *intstr.IntOrString, s conversion.Scope) error {
+	if *in == nil {
+		*out = intstr.IntOrString{} // zero value
+		return nil
+	}
+	*out = **in // copy
+	return nil
+}
+
+func Convert_intstr_IntOrString_To_Pointer_intstr_IntOrString(in *intstr.IntOrString, out **intstr.IntOrString, s conversion.Scope) error {
+	temp := *in // copy
+	*out = &temp
+	return nil
+}
+
+// +k8s:conversion-fn=copy-only
+func Convert_v1_Time_To_v1_Time(in *Time, out *Time, s conversion.Scope) error {
+	// Cannot deep copy these, because time.Time has unexported fields.
+	*out = *in
+	return nil
+}
+
+// +k8s:conversion-fn=copy-only
+func Convert_v1_MicroTime_To_v1_MicroTime(in *MicroTime, out *MicroTime, s conversion.Scope) error {
+	// Cannot deep copy these, because time.Time has unexported fields.
+	*out = *in
+	return nil
+}
+
+func Convert_Pointer_v1_Duration_To_v1_Duration(in **Duration, out *Duration, s conversion.Scope) error {
+	if *in == nil {
+		*out = Duration{} // zero duration
+		return nil
+	}
+	*out = **in // copy
+	return nil
+}
+
+func Convert_v1_Duration_To_Pointer_v1_Duration(in *Duration, out **Duration, s conversion.Scope) error {
+	temp := *in //copy
+	*out = &temp
+	return nil
+}
+
+// Convert_Slice_string_To_v1_Time allows converting a URL query parameter value
+func Convert_Slice_string_To_v1_Time(in *[]string, out *Time, s conversion.Scope) error {
+	str := ""
+	if len(*in) > 0 {
+		str = (*in)[0]
+	}
+	return out.UnmarshalQueryParameter(str)
+}
+
+func Convert_Slice_string_To_Pointer_v1_Time(in *[]string, out **Time, s conversion.Scope) error {
+	if in == nil {
+		return nil
+	}
+	str := ""
+	if len(*in) > 0 {
+		str = (*in)[0]
+	}
+	temp := Time{}
+	if err := temp.UnmarshalQueryParameter(str); err != nil {
+		return err
+	}
+	*out = &temp
+	return nil
+}
+
+func Convert_string_To_labels_Selector(in *string, out *labels.Selector, s conversion.Scope) error {
+	selector, err := labels.Parse(*in)
+	if err != nil {
+		return err
+	}
+	*out = selector
+	return nil
+}
+
+func Convert_string_To_fields_Selector(in *string, out *fields.Selector, s conversion.Scope) error {
+	selector, err := fields.ParseSelector(*in)
+	if err != nil {
+		return err
+	}
+	*out = selector
+	return nil
+}
+
+func Convert_labels_Selector_To_string(in *labels.Selector, out *string, s conversion.Scope) error {
+	if *in == nil {
+		return nil
+	}
+	*out = (*in).String()
+	return nil
+}
+
+func Convert_fields_Selector_To_string(in *fields.Selector, out *string, s conversion.Scope) error {
+	if *in == nil {
+		return nil
+	}
+	*out = (*in).String()
+	return nil
+}
+
+// +k8s:conversion-fn=copy-only
+func Convert_resource_Quantity_To_resource_Quantity(in *resource.Quantity, out *resource.Quantity, s conversion.Scope) error {
+	*out = *in
+	return nil
+}
+
+func Convert_Map_string_To_string_To_v1_LabelSelector(in *map[string]string, out *LabelSelector, s conversion.Scope) error {
+	if in == nil {
+		return nil
+	}
+	for labelKey, labelValue := range *in {
+		AddLabelToSelector(out, labelKey, labelValue)
+	}
+	return nil
+}
+
+func Convert_v1_LabelSelector_To_Map_string_To_string(in *LabelSelector, out *map[string]string, s conversion.Scope) error {
+	var err error
+	*out, err = LabelSelectorAsMap(in)
+	return err
+}
+
+// Convert_Slice_string_To_Slice_int32 converts multiple query parameters or
+// a single query parameter with a comma delimited value to multiple int32.
+// This is used for port forwarding which needs the ports as int32.
+func Convert_Slice_string_To_Slice_int32(in *[]string, out *[]int32, s conversion.Scope) error {
+	for _, s := range *in {
+		for _, v := range strings.Split(s, ",") {
+			x, err := strconv.ParseUint(v, 10, 16)
+			if err != nil {
+				return fmt.Errorf("cannot convert to []int32: %v", err)
+			}
+			*out = append(*out, int32(x))
+		}
+	}
+	return nil
+}
+
+// Convert_Slice_string_To_Pointer_v1_DeletionPropagation allows converting a URL query parameter propagationPolicy
+func Convert_Slice_string_To_Pointer_v1_DeletionPropagation(in *[]string, out **DeletionPropagation, s conversion.Scope) error {
+	var str string
+	if len(*in) > 0 {
+		str = (*in)[0]
+	} else {
+		str = ""
+	}
+	temp := DeletionPropagation(str)
+	*out = &temp
+	return nil
+}
+
+// Convert_Slice_string_To_v1_IncludeObjectPolicy allows converting a URL query parameter value
+func Convert_Slice_string_To_v1_IncludeObjectPolicy(in *[]string, out *IncludeObjectPolicy, s conversion.Scope) error {
+	if len(*in) > 0 {
+		*out = IncludeObjectPolicy((*in)[0])
+	}
+	return nil
+}
+
+// Convert_url_Values_To_v1_DeleteOptions allows converting a URL to DeleteOptions.
+func Convert_url_Values_To_v1_DeleteOptions(in *url.Values, out *DeleteOptions, s conversion.Scope) error {
+	if err := autoConvert_url_Values_To_v1_DeleteOptions(in, out, s); err != nil {
+		return err
+	}
+
+	uid := types.UID("")
+	if values, ok := (*in)["uid"]; ok && len(values) > 0 {
+		uid = types.UID(values[0])
+	}
+
+	resourceVersion := ""
+	if values, ok := (*in)["resourceVersion"]; ok && len(values) > 0 {
+		resourceVersion = values[0]
+	}
+
+	if len(uid) > 0 || len(resourceVersion) > 0 {
+		if out.Preconditions == nil {
+			out.Preconditions = &Preconditions{}
+		}
+		if len(uid) > 0 {
+			out.Preconditions.UID = &uid
+		}
+		if len(resourceVersion) > 0 {
+			out.Preconditions.ResourceVersion = &resourceVersion
+		}
+	}
+	return nil
+}
+
+// Convert_Slice_string_To_v1_ResourceVersionMatch allows converting a URL query parameter to ResourceVersionMatch
+func Convert_Slice_string_To_v1_ResourceVersionMatch(in *[]string, out *ResourceVersionMatch, s conversion.Scope) error {
+	if len(*in) > 0 {
+		*out = ResourceVersionMatch((*in)[0])
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/conversion_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/conversion_test.go
new file mode 100644
index 0000000000..1063759972
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/conversion_test.go
@@ -0,0 +1,125 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1_test
+
+import (
+	"testing"
+	"time"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestMapToLabelSelectorRoundTrip(t *testing.T) {
+	// We should be able to round-trip a map-only selector through LabelSelector.
+	inputs := []map[string]string{
+		nil,
+		{},
+		{"one": "foo"},
+		{"one": "foo", "two": "bar"},
+	}
+	for _, in := range inputs {
+		ls := &v1.LabelSelector{}
+		if err := v1.Convert_Map_string_To_string_To_v1_LabelSelector(&in, ls, nil); err != nil {
+			t.Errorf("Convert_Map_string_To_string_To_v1_LabelSelector(%#v): %v", in, err)
+			continue
+		}
+		out := map[string]string{}
+		if err := v1.Convert_v1_LabelSelector_To_Map_string_To_string(ls, &out, nil); err != nil {
+			t.Errorf("Convert_v1_LabelSelector_To_Map_string_To_string(%#v): %v", ls, err)
+			continue
+		}
+		if !apiequality.Semantic.DeepEqual(in, out) {
+			t.Errorf("map-selector conversion round-trip failed: got %v; want %v", out, in)
+		}
+	}
+}
+
+func TestConvertSliceStringToDeletionPropagation(t *testing.T) {
+	tcs := []struct {
+		Input  []string
+		Output v1.DeletionPropagation
+	}{
+		{
+			Input:  nil,
+			Output: "",
+		},
+		{
+			Input:  []string{},
+			Output: "",
+		},
+		{
+			Input:  []string{"foo"},
+			Output: "foo",
+		},
+		{
+			Input:  []string{"bar", "foo"},
+			Output: "bar",
+		},
+	}
+
+	for _, tc := range tcs {
+		var dpPtr *v1.DeletionPropagation
+		if err := v1.Convert_Slice_string_To_Pointer_v1_DeletionPropagation(&tc.Input, &dpPtr, nil); err != nil {
+			t.Errorf("Convert_Slice_string_To_Pointer_v1_DeletionPropagation(%#v): %v", tc.Input, err)
+			continue
+		}
+		if !apiequality.Semantic.DeepEqual(dpPtr, &tc.Output) {
+			t.Errorf("slice string to DeletionPropagation conversion failed: got %v; want %v", *dpPtr, tc.Output)
+		}
+	}
+}
+
+func TestConvertSliceStringToPointerTime(t *testing.T) {
+	t1 := v1.Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC)
+	t1String := t1.Format(time.RFC3339)
+	t2 := v1.Date(2000, time.June, 6, 6, 6, 6, 0, time.UTC)
+	t2String := t2.Format(time.RFC3339)
+
+	tcs := []struct {
+		Input  []string
+		Output *v1.Time
+	}{
+		{
+			Input:  []string{},
+			Output: &v1.Time{},
+		},
+		{
+			Input:  []string{""},
+			Output: &v1.Time{},
+		},
+		{
+			Input:  []string{t1String},
+			Output: &t1,
+		},
+		{
+			Input:  []string{t1String, t2String},
+			Output: &t1,
+		},
+	}
+
+	for _, tc := range tcs {
+		var timePtr *v1.Time
+		if err := v1.Convert_Slice_string_To_Pointer_v1_Time(&tc.Input, &timePtr, nil); err != nil {
+			t.Errorf("Convert_Slice_string_To_Pointer_v1_Time(%#v): %v", tc.Input, err)
+			continue
+		}
+		if !apiequality.Semantic.DeepEqual(timePtr, tc.Output) {
+			t.Errorf("slice string to *v1.Time conversion failed: got %#v; want %#v", timePtr, tc.Output)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/deepcopy.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/deepcopy.go
new file mode 100644
index 0000000000..8751d0524f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/deepcopy.go
@@ -0,0 +1,46 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func (in *TableRow) DeepCopy() *TableRow {
+	if in == nil {
+		return nil
+	}
+
+	out := new(TableRow)
+
+	if in.Cells != nil {
+		out.Cells = make([]interface{}, len(in.Cells))
+		for i := range in.Cells {
+			out.Cells[i] = runtime.DeepCopyJSONValue(in.Cells[i])
+		}
+	}
+
+	if in.Conditions != nil {
+		out.Conditions = make([]TableRowCondition, len(in.Conditions))
+		for i := range in.Conditions {
+			in.Conditions[i].DeepCopyInto(&out.Conditions[i])
+		}
+	}
+
+	in.Object.DeepCopyInto(&out.Object)
+	return out
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/doc.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/doc.go
new file mode 100644
index 0000000000..31c87361f6
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/doc.go
@@ -0,0 +1,25 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:conversion-gen=false
+// +k8s:deepcopy-gen=package
+// +k8s:openapi-gen=true
+// +k8s:defaulter-gen=TypeMeta
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.apis.meta.v1
+
+// +groupName=meta.k8s.io
+
+package v1
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/duration.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/duration.go
new file mode 100644
index 0000000000..a22b07878f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/duration.go
@@ -0,0 +1,65 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"time"
+)
+
+// Duration is a wrapper around time.Duration which supports correct
+// marshaling to YAML and JSON. In particular, it marshals into strings, which
+// can be used as map keys in json.
+type Duration struct {
+	time.Duration `protobuf:"varint,1,opt,name=duration,casttype=time.Duration"`
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+func (d *Duration) UnmarshalJSON(b []byte) error {
+	var str string
+	err := json.Unmarshal(b, &str)
+	if err != nil {
+		return err
+	}
+
+	pd, err := time.ParseDuration(str)
+	if err != nil {
+		return err
+	}
+	d.Duration = pd
+	return nil
+}
+
+// MarshalJSON implements the json.Marshaler interface.
+func (d Duration) MarshalJSON() ([]byte, error) {
+	return json.Marshal(d.Duration.String())
+}
+
+// ToUnstructured implements the value.UnstructuredConverter interface.
+func (d Duration) ToUnstructured() interface{} {
+	return d.Duration.String()
+}
+
+// OpenAPISchemaType is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+//
+// See: https://github.com/kubernetes/kube-openapi/tree/master/pkg/generators
+func (_ Duration) OpenAPISchemaType() []string { return []string{"string"} }
+
+// OpenAPISchemaFormat is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+func (_ Duration) OpenAPISchemaFormat() string { return "" }
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/duration_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/duration_test.go
new file mode 100644
index 0000000000..34ca6b5ded
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/duration_test.go
@@ -0,0 +1,153 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"sigs.k8s.io/yaml"
+)
+
+type DurationHolder struct {
+	D Duration `json:"d"`
+}
+
+func TestDurationMarshalYAML(t *testing.T) {
+	cases := []struct {
+		input  Duration
+		result string
+	}{
+		{Duration{5 * time.Second}, "d: 5s\n"},
+		{Duration{2 * time.Minute}, "d: 2m0s\n"},
+		{Duration{time.Hour + 3*time.Millisecond}, "d: 1h0m0.003s\n"},
+	}
+
+	for _, c := range cases {
+		input := DurationHolder{c.input}
+		result, err := yaml.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input: %q: %v", input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("Failed to marshal input: %q: expected %q, got %q", input, c.result, string(result))
+		}
+	}
+}
+
+func TestDurationUnmarshalYAML(t *testing.T) {
+	cases := []struct {
+		input  string
+		result Duration
+	}{
+		{"d: 0s\n", Duration{}},
+		{"d: 5s\n", Duration{5 * time.Second}},
+		{"d: 2m0s\n", Duration{2 * time.Minute}},
+		{"d: 1h0m0.003s\n", Duration{time.Hour + 3*time.Millisecond}},
+
+		// Units with zero values can optionally be dropped
+		{"d: 2m\n", Duration{2 * time.Minute}},
+		{"d: 1h0.003s\n", Duration{time.Hour + 3*time.Millisecond}},
+	}
+
+	for _, c := range cases {
+		var result DurationHolder
+		if err := yaml.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("Failed to unmarshal input %q: %v", c.input, err)
+		}
+		if result.D != c.result {
+			t.Errorf("Failed to unmarshal input %q: expected %q, got %q", c.input, c.result, result)
+		}
+	}
+}
+
+func TestDurationMarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  Duration
+		result string
+	}{
+		{Duration{5 * time.Second}, `{"d":"5s"}`},
+		{Duration{2 * time.Minute}, `{"d":"2m0s"}`},
+		{Duration{time.Hour + 3*time.Millisecond}, `{"d":"1h0m0.003s"}`},
+	}
+
+	for _, c := range cases {
+		input := DurationHolder{c.input}
+		result, err := json.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input: %q: %v", input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("Failed to marshal input: %q: expected %q, got %q", input, c.result, string(result))
+		}
+	}
+}
+
+func TestDurationUnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  string
+		result Duration
+	}{
+		{`{"d":"0s"}`, Duration{}},
+		{`{"d":"5s"}`, Duration{5 * time.Second}},
+		{`{"d":"2m0s"}`, Duration{2 * time.Minute}},
+		{`{"d":"1h0m0.003s"}`, Duration{time.Hour + 3*time.Millisecond}},
+
+		// Units with zero values can optionally be dropped
+		{`{"d":"2m"}`, Duration{2 * time.Minute}},
+		{`{"d":"1h0.003s"}`, Duration{time.Hour + 3*time.Millisecond}},
+	}
+
+	for _, c := range cases {
+		var result DurationHolder
+		if err := json.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("Failed to unmarshal input %q: %v", c.input, err)
+		}
+		if result.D != c.result {
+			t.Errorf("Failed to unmarshal input %q: expected %q, got %q", c.input, c.result, result)
+		}
+	}
+}
+
+func TestDurationMarshalJSONUnmarshalYAML(t *testing.T) {
+	cases := []struct {
+		input Duration
+	}{
+		{Duration{}},
+		{Duration{5 * time.Second}},
+		{Duration{2 * time.Minute}},
+		{Duration{time.Hour + 3*time.Millisecond}},
+	}
+
+	for i, c := range cases {
+		input := DurationHolder{c.input}
+		jsonMarshalled, err := json.Marshal(&input)
+		if err != nil {
+			t.Errorf("%d-1: Failed to marshal input: '%v': %v", i, input, err)
+		}
+
+		var result DurationHolder
+		if err := yaml.Unmarshal(jsonMarshalled, &result); err != nil {
+			t.Errorf("%d-2: Failed to unmarshal '%+v': %v", i, string(jsonMarshalled), err)
+		}
+
+		if input.D != result.D {
+			t.Errorf("%d-4: Failed to marshal input '%#v': got %#v", i, input, result)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1.go
new file mode 100644
index 0000000000..81aca59fac
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1.go
@@ -0,0 +1,170 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"fmt"
+	"io"
+)
+
+func (FieldsV1) SwaggerDoc() map[string]string {
+	return map[string]string{
+		"": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:<name>', where <name> is the name of a field in a struct, or key in a map 'v:<value>', where <value> is the exact json formatted value of a list item 'i:<index>', where <index> is position of a item in a list 'k:<keys>', where <keys> is a map of  a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff",
+	}
+}
+
+type FieldsV1Reader interface {
+	io.Reader
+	io.ReaderAt
+	// Size returns the original byte length of the underlying data. Size is the number of bytes available for reading via ReadAt.
+	Size() int64
+}
+
+func (f *FieldsV1) DeepCopy() *FieldsV1 {
+	if f == nil {
+		return nil
+	}
+	out := new(FieldsV1)
+	f.DeepCopyInto(out)
+	return out
+}
+
+func (f *FieldsV1) Marshal() (dAtA []byte, err error) {
+	size := f.Size()
+	dAtA = make([]byte, size)
+	n, err := f.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (f *FieldsV1) MarshalTo(dAtA []byte) (int, error) {
+	size := f.Size()
+	return f.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (f *FieldsV1) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	rawBytes := f.GetRawBytes()
+	if len(rawBytes) > 0 {
+		i -= len(rawBytes)
+		copy(dAtA[i:], rawBytes)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(rawBytes)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (f *FieldsV1) Size() (n int) {
+	if f == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if l := int(f.GetRawReader().Size()); l > 0 {
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (f *FieldsV1) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: FieldsV1: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: FieldsV1: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Raw", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+
+			f.SetRawBytes(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_benchmark_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_benchmark_test.go
new file mode 100644
index 0000000000..812c181627
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_benchmark_test.go
@@ -0,0 +1,118 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+var benchmarkPayloads = []string{
+	// Small managed fields payload
+	`{"f:metadata":{"f:labels":{"f:app":{}},"f:annotations":{"f:revision":{}}},"f:spec":{"f:replicas":{},"f:template":{"f:metadata":{"f:labels":{"f:app":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"nginx\"}":{".":{},"f:image":{},"f:name":{}}}}}}}`,
+	// Larger, deeply nested valid JSON payload (representing complex managedFields)
+	`{"f:metadata":{"f:annotations":{".":{},"f:kubectl.kubernetes.io/last-applied-configuration":{}},"f:labels":{".":{},"f:app.kubernetes.io/name":{}}},"f:spec":{"f:replicas":{},"f:selector":{},"f:template":{"f:metadata":{"f:labels":{".":{},"f:app.kubernetes.io/name":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"app\"}":{".":{},"f:image":{},"f:name":{},"f:ports":{".":{},"k:{\"containerPort\":8080,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:protocol":{}}},"f:resources":{".":{},"f:limits":{".":{},"f:cpu":{},"f:memory":{}},"f:requests":{".":{},"f:cpu":{},"f:memory":{}}}}}}}}}`,
+}
+
+// BenchmarkDecodeDuplicate measures the allocation and speed of unmarshaling
+// exactly identical payloads repeatedly, which is the most common case for
+// heavily replicated resources (DaemonSets, ReplicaSets) in the API server.
+func BenchmarkDecodeDuplicate(b *testing.B) {
+	for _, payload := range benchmarkPayloads {
+		b.Run(fmt.Sprintf("Size%d", len(payload)), func(b *testing.B) {
+			rawJSON := []byte(payload)
+			b.ResetTimer()
+			b.ReportAllocs()
+			var retained []metav1.FieldsV1
+			for j := 0; j < b.N; j++ {
+				var f metav1.FieldsV1
+				if err := json.Unmarshal(rawJSON, &f); err != nil {
+					b.Fatal(err)
+				}
+				retained = append(retained, f)
+			}
+			_ = retained
+		})
+	}
+}
+
+// BenchmarkDecodeUnique measures the allocation and speed of unmarshaling
+// completely unique payloads to measure the worst-case interning overhead.
+func BenchmarkDecodeUnique(b *testing.B) {
+	for _, payload := range benchmarkPayloads {
+		b.Run(fmt.Sprintf("Size%d", len(payload)), func(b *testing.B) {
+			b.ResetTimer()
+			b.ReportAllocs()
+			var retained []metav1.FieldsV1
+			for j := 0; j < b.N; j++ {
+				// Inject the iteration counter to guarantee the string is unique
+				novelPayload := fmt.Appendf(nil, `{"f:iter":%d,%s`, j, payload[1:])
+				var f metav1.FieldsV1
+				if err := json.Unmarshal(novelPayload, &f); err != nil {
+					b.Fatal(err)
+				}
+				retained = append(retained, f)
+			}
+			_ = retained
+		})
+	}
+}
+
+// BenchmarkParallelDecode tests parallel deserialization of duplicate strings
+// to verify lock contention behavior in highly concurrent environments.
+func BenchmarkParallelDecode(b *testing.B) {
+	for _, payload := range benchmarkPayloads {
+		b.Run(fmt.Sprintf("Size%d", len(payload)), func(b *testing.B) {
+			rawJSON := []byte(payload)
+			b.ResetTimer()
+			b.ReportAllocs()
+			b.RunParallel(func(pb *testing.PB) {
+				for pb.Next() {
+					var f metav1.FieldsV1
+					if err := json.Unmarshal(rawJSON, &f); err != nil {
+						b.Fatal(err)
+					}
+				}
+			})
+		})
+	}
+}
+
+// BenchmarkEqual_Same measures the fast-path equality check for identical structs.
+func BenchmarkEqual_Same(b *testing.B) {
+	f1 := metav1.NewFieldsV1(benchmarkPayloads[1])
+	f2 := metav1.NewFieldsV1(benchmarkPayloads[1])
+	b.ResetTimer()
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		_ = f1.Equal(*f2)
+	}
+}
+
+// BenchmarkEqual_Different measures the fallback-path equality check for differing structs.
+func BenchmarkEqual_Different(b *testing.B) {
+	f1 := metav1.NewFieldsV1(benchmarkPayloads[1])
+	f2 := metav1.NewFieldsV1(benchmarkPayloads[0])
+	b.ResetTimer()
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		_ = f1.Equal(*f2)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_byte.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_byte.go
new file mode 100644
index 0000000000..66f28e1d9f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_byte.go
@@ -0,0 +1,105 @@
+//go:build !fieldsv1string
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"bytes"
+)
+
+// FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.
+//
+// Each key is either a '.' representing the field itself, and will always map to an empty set,
+// or a string representing a sub-field or item. The string will follow one of these four formats:
+// 'f:<name>', where <name> is the name of a field in a struct, or key in a map
+// 'v:<value>', where <value> is the exact json formatted value of a list item
+// 'i:<index>', where <index> is position of a item in a list
+// 'k:<keys>', where <keys> is a map of  a list item's key fields to their unique values
+// If a key maps to an empty Fields value, the field that key represents is part of the set.
+//
+// The exact format is defined in sigs.k8s.io/structured-merge-diff
+// +k8s:deepcopy-gen=false
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type FieldsV1 struct {
+	// Raw is the underlying serialization of this object.
+	//
+	// Deprecated: Direct access to this field is deprecated. Use GetRawBytes, GetRawString, SetRawBytes, SetRawString, GetRawReader, NewFieldsV1 instead.
+	Raw []byte `json:"-" protobuf:"bytes,1,opt,name=Raw"`
+}
+
+func (f FieldsV1) String() string {
+	return string(f.Raw)
+}
+
+func (f FieldsV1) Equal(f2 FieldsV1) bool {
+	return bytes.Equal(f.Raw, f2.Raw)
+}
+
+func (f *FieldsV1) GetRawReader() FieldsV1Reader {
+	if f == nil || len(f.Raw) == 0 {
+		return bytes.NewReader(nil)
+	}
+	return bytes.NewReader(f.Raw)
+}
+
+// GetRawBytes returns the raw bytes.
+// These may or may not be a copy of the underlying bytes.
+// If mutating the underlying bytes is desired, the returned bytes may be mutated and then passed to SetRawBytes().
+// If mutating the underlying bytes is not desired, make a copy of the returned bytes.
+func (f *FieldsV1) GetRawBytes() []byte {
+	if f == nil {
+		return nil
+	}
+	return f.Raw
+}
+
+// GetRawString returns the raw data as a string.
+func (f *FieldsV1) GetRawString() string {
+	if f == nil {
+		return ""
+	}
+	return string(f.Raw)
+}
+
+// SetRawBytes sets the raw bytes. It does not retain the passed-in byte slice.
+func (f *FieldsV1) SetRawBytes(b []byte) {
+	if f != nil {
+		f.Raw = bytes.Clone(b)
+	}
+}
+
+// SetRawString sets the raw data from a string.
+func (f *FieldsV1) SetRawString(s string) {
+	if f != nil {
+		f.Raw = []byte(s)
+	}
+}
+
+func NewFieldsV1(raw string) *FieldsV1 {
+	return &FieldsV1{Raw: []byte(raw)}
+}
+
+func (f *FieldsV1) DeepCopyInto(out *FieldsV1) {
+	*out = *f
+	if f.Raw != nil {
+		in, out := &f.Raw, &out.Raw
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_string.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_string.go
new file mode 100644
index 0000000000..679452ae17
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_string.go
@@ -0,0 +1,113 @@
+//go:build fieldsv1string
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"strings"
+	"unique"
+)
+
+// FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.
+//
+// Each key is either a '.' representing the field itself, and will always map to an empty set,
+// or a string representing a sub-field or item. The string will follow one of these four formats:
+// 'f:<name>', where <name> is the name of a field in a struct, or key in a map
+// 'v:<value>', where <value> is the exact json formatted value of a list item
+// 'i:<index>', where <index> is position of a item in a list
+// 'k:<keys>', where <keys> is a map of  a list item's key fields to their unique values
+// If a key maps to an empty Fields value, the field that key represents is part of the set.
+//
+// The exact format is defined in sigs.k8s.io/structured-merge-diff
+// +k8s:deepcopy-gen=false
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type FieldsV1 struct {
+	// The zero value of a unique.Handle[string] has an uninitialized underlying pointer.
+	// Calling .Value() on it panics. We must explicitly check for this uninitialized
+	// state (f.handle == unique.Handle[string]{}) across accessors to safely support
+	// uninitialized metav1.FieldsV1{} objects.
+	// See ongoing golang discussion related to this here: https://github.com/golang/go/issues/73344
+	handle unique.Handle[string]
+}
+
+func (f FieldsV1) String() string {
+	if f.handle == (unique.Handle[string]{}) {
+		return ""
+	}
+	return f.handle.Value()
+}
+
+func (f FieldsV1) Equal(f2 FieldsV1) bool {
+	if f.handle == f2.handle {
+		return true
+	}
+	// An uninitialized FieldsV1 compared to an explicitly empty
+	// FieldsV1 (unique.Make("") will fail the handle check above.
+	// Evaluate string contents directly as well to maintain parity with legacy
+	// bytes.Equal(nil, []byte{}) == true behavior.
+	return f.GetRawString() == f2.GetRawString()
+}
+
+func (f *FieldsV1) GetRawReader() FieldsV1Reader {
+	if f == nil || f.handle == (unique.Handle[string]{}) {
+		return strings.NewReader("")
+	}
+	return strings.NewReader(f.handle.Value())
+}
+
+// GetRawBytes returns the raw bytes.
+// These may or may not be a copy of the underlying bytes.
+// If mutating the underlying bytes is desired, the returned bytes may be mutated and then passed to SetRawBytes().
+// If mutating the underlying bytes is not desired, make a copy of the returned bytes.
+func (f *FieldsV1) GetRawBytes() []byte {
+	if f == nil || f.handle == (unique.Handle[string]{}) {
+		return nil
+	}
+	return []byte(f.handle.Value())
+}
+
+// GetRawString returns the raw data as a string.
+func (f *FieldsV1) GetRawString() string {
+	if f == nil || f.handle == (unique.Handle[string]{}) {
+		return ""
+	}
+	return f.handle.Value()
+}
+
+// SetRawBytes sets the raw bytes. It does not retain the passed-in byte slice.
+func (f *FieldsV1) SetRawBytes(b []byte) {
+	if f != nil {
+		f.handle = unique.Make(string(b))
+	}
+}
+
+// SetRawString sets the raw data from a string.
+func (f *FieldsV1) SetRawString(s string) {
+	if f != nil {
+		f.handle = unique.Make(s)
+	}
+}
+
+func NewFieldsV1(raw string) *FieldsV1 {
+	return &FieldsV1{handle: unique.Make(raw)}
+}
+
+func (f *FieldsV1) DeepCopyInto(out *FieldsV1) {
+	*out = *f
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_string_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_string_test.go
new file mode 100644
index 0000000000..384951673a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/fieldsv1_string_test.go
@@ -0,0 +1,362 @@
+//go:build fieldsv1string
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"testing"
+	"unsafe"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// requireInterned fails the test if the two strings do not point to the exact same memory address.
+func requireInterned(t *testing.T, a, b string) {
+	t.Helper()
+	ptrA := unsafe.StringData(a)
+	ptrB := unsafe.StringData(b)
+	if ptrA != ptrB {
+		t.Fatalf("Expected strings to be interned (same memory address) but pointers differ: %p != %p", ptrA, ptrB)
+	}
+}
+
+func TestFieldsV1_String(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		f        metav1.FieldsV1
+		expected string
+	}{
+		{
+			name:     "zero value handle",
+			f:        metav1.FieldsV1{},
+			expected: "",
+		},
+		{
+			name:     "initialized empty handle",
+			f:        *metav1.NewFieldsV1(""),
+			expected: "",
+		},
+		{
+			name:     "valid payload",
+			f:        *metav1.NewFieldsV1(`{"f:app":{}}`),
+			expected: `{"f:app":{}}`,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := tc.f.String(); got != tc.expected {
+				t.Errorf("expected %q, got %q", tc.expected, got)
+			}
+		})
+	}
+}
+
+func TestFieldsV1_Equal(t *testing.T) {
+	valid := *metav1.NewFieldsV1(`{"f:app":{}}`)
+	validClone := *metav1.NewFieldsV1(`{"f:app":{}}`)
+	different := *metav1.NewFieldsV1(`{"f:other":{}}`)
+
+	for _, tc := range []struct {
+		name     string
+		a        metav1.FieldsV1
+		b        metav1.FieldsV1
+		expected bool
+	}{
+		{"both zero value", metav1.FieldsV1{}, metav1.FieldsV1{}, true},
+		{"zero value and initialized empty handle", metav1.FieldsV1{}, *metav1.NewFieldsV1(""), true},
+		{"identical valid payloads", valid, validClone, true},
+		{"different payloads", valid, different, false},
+		{"zero value and valid payload", metav1.FieldsV1{}, valid, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := tc.a.Equal(tc.b); got != tc.expected {
+				t.Errorf("expected Equal() to be %v, got %v", tc.expected, got)
+			}
+			// Commutative property
+			if got := tc.b.Equal(tc.a); got != tc.expected {
+				t.Errorf("expected Equal() commutative to be %v, got %v", tc.expected, got)
+			}
+		})
+	}
+}
+
+func TestFieldsV1_GetRawReader(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		f        *metav1.FieldsV1
+		expected []byte
+	}{
+		{"nil receiver", nil, []byte("")},
+		{"zero value handle", &metav1.FieldsV1{}, []byte("")},
+		{"initialized empty handle", metav1.NewFieldsV1(""), []byte("")},
+		{"valid payload", metav1.NewFieldsV1(`{"f:app":{}}`), []byte(`{"f:app":{}}`)},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			reader := tc.f.GetRawReader()
+			got, err := io.ReadAll(reader)
+			if err != nil {
+				t.Fatalf("unexpected error reading from RawReader: %v", err)
+			}
+			if !bytes.Equal(got, tc.expected) {
+				t.Errorf("expected %q, got %q", tc.expected, got)
+			}
+		})
+	}
+}
+
+func TestFieldsV1_GetRawBytes(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		f        *metav1.FieldsV1
+		expected []byte
+	}{
+		{"nil receiver", nil, nil},
+		{"zero value handle", &metav1.FieldsV1{}, nil},
+		{"initialized empty handle", metav1.NewFieldsV1(""), []byte{}},
+		{"valid payload", metav1.NewFieldsV1(`{"f:app":{}}`), []byte(`{"f:app":{}}`)},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got := tc.f.GetRawBytes()
+			if !bytes.Equal(got, tc.expected) {
+				t.Errorf("expected %v, got %v", tc.expected, got)
+			}
+			// Explicitly check for nil
+			if tc.expected == nil && got != nil {
+				t.Errorf("expected strict nil, got %v", got)
+			}
+		})
+	}
+
+	t.Run("mutation safety", func(t *testing.T) {
+		f := metav1.NewFieldsV1(`{"f:app":{}}`)
+		b := f.GetRawBytes()
+
+		// Mutate the returned bytes
+		b[2] = 'X'
+
+		// The original interned string must remain unchanged
+		if got := f.GetRawString(); got != `{"f:app":{}}` {
+			t.Errorf("GetRawBytes returned an unisolated slice! Mutating it corrupted the handle. Got: %s", got)
+		}
+	})
+}
+
+func TestFieldsV1_GetRawString(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		f        *metav1.FieldsV1
+		expected string
+	}{
+		{"nil receiver", nil, ""},
+		{"zero value handle", &metav1.FieldsV1{}, ""},
+		{"initialized empty handle", metav1.NewFieldsV1(""), ""},
+		{"valid payload", metav1.NewFieldsV1(`{"f:app":{}}`), `{"f:app":{}}`},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := tc.f.GetRawString(); got != tc.expected {
+				t.Errorf("expected %q, got %q", tc.expected, got)
+			}
+		})
+	}
+}
+
+func TestFieldsV1_SetRawBytes(t *testing.T) {
+	t.Run("nil receiver", func(t *testing.T) {
+		var f *metav1.FieldsV1        // nil
+		f.SetRawBytes([]byte("test")) // Should not panic
+	})
+
+	t.Run("empty slice input", func(t *testing.T) {
+		f := &metav1.FieldsV1{}
+		f.SetRawBytes([]byte{})
+		if f.GetRawString() != "" {
+			t.Errorf("Expected empty string, got %q", f.GetRawString())
+		}
+	})
+
+	t.Run("nil slice input", func(t *testing.T) {
+		f := &metav1.FieldsV1{}
+		f.SetRawBytes(nil)
+		if f.GetRawString() != "" {
+			t.Errorf("Expected empty string, got %q", f.GetRawString())
+		}
+	})
+
+	t.Run("interning behavior", func(t *testing.T) {
+		payload := []byte(`{"f:app":{}}`)
+
+		// Two distinct slices with identical content
+		b1 := append([]byte(nil), payload...)
+		b2 := append([]byte(nil), payload...)
+
+		f1 := &metav1.FieldsV1{}
+		f1.SetRawBytes(b1)
+
+		f2 := &metav1.FieldsV1{}
+		f2.SetRawBytes(b2)
+
+		if f1.GetRawString() != string(payload) {
+			t.Errorf("Expected GetRawString to match payload, got %q", f1.GetRawString())
+		}
+
+		requireInterned(t, f1.GetRawString(), f2.GetRawString())
+	})
+}
+
+func TestFieldsV1_SetRawString(t *testing.T) {
+	t.Run("nil receiver", func(t *testing.T) {
+		var f *metav1.FieldsV1 // nil
+		f.SetRawString("test") // Should not panic
+	})
+
+	t.Run("interning behavior", func(t *testing.T) {
+		payload := `{"f:app":{}}`
+
+		// Force string copy to avoid compiler static string optimization if possible
+		s1 := string(append([]byte(nil), payload...))
+		s2 := string(append([]byte(nil), payload...))
+
+		f1 := &metav1.FieldsV1{}
+		f1.SetRawString(s1)
+
+		f2 := &metav1.FieldsV1{}
+		f2.SetRawString(s2)
+
+		requireInterned(t, f1.GetRawString(), f2.GetRawString())
+	})
+}
+
+func TestFieldsV1_NewFieldsV1(t *testing.T) {
+	t.Run("interning behavior", func(t *testing.T) {
+		payload := `{"f:app":{}}`
+		s1 := string(append([]byte(nil), payload...))
+		s2 := string(append([]byte(nil), payload...))
+
+		f1 := metav1.NewFieldsV1(s1)
+		f2 := metav1.NewFieldsV1(s2)
+
+		requireInterned(t, f1.GetRawString(), f2.GetRawString())
+	})
+}
+
+func TestFieldsV1_DeepCopyInto(t *testing.T) {
+	t.Run("preserves interning", func(t *testing.T) {
+		orig := metav1.NewFieldsV1(`{"f:app":{}}`)
+		var clone metav1.FieldsV1
+		orig.DeepCopyInto(&clone)
+
+		if orig.GetRawString() != clone.GetRawString() {
+			t.Fatalf("Expected strings to match after DeepCopyInto, got %q and %q", orig.GetRawString(), clone.GetRawString())
+		}
+
+		requireInterned(t, orig.GetRawString(), clone.GetRawString())
+	})
+
+	t.Run("zero value deep copy", func(t *testing.T) {
+		var orig metav1.FieldsV1
+		var clone metav1.FieldsV1
+		orig.DeepCopyInto(&clone)
+
+		if clone.GetRawString() != "" {
+			t.Errorf("Expected empty string from cloned zero-value, got %q", clone.GetRawString())
+		}
+		if !orig.Equal(clone) {
+			t.Errorf("Expected original zero-value and its clone to be equal")
+		}
+	})
+
+	t.Run("independence after deep copy", func(t *testing.T) {
+		orig := metav1.NewFieldsV1(`{"f:app":{}}`)
+		var clone metav1.FieldsV1
+		orig.DeepCopyInto(&clone)
+
+		// Modify the clone
+		clone.SetRawString(`{"f:new":{}}`)
+
+		// The original should be completely untouched
+		if got := orig.GetRawString(); got != `{"f:app":{}}` {
+			t.Errorf("DeepCopyInto failed to isolate clone! Modifying clone corrupted original. Got: %s", got)
+		}
+	})
+}
+func TestFieldsV1_UnmarshalInterning(t *testing.T) {
+	jsonPayload := []byte(`{"f:metadata":{"f:labels":{"f:app":{}}}}`)
+	orig := metav1.NewFieldsV1(string(jsonPayload))
+
+	protoPayload, err := orig.Marshal()
+	if err != nil {
+		t.Fatalf("Failed to marshal protobuf payload during setup: %v", err)
+	}
+
+	cborPayload, err := orig.MarshalCBOR()
+	if err != nil {
+		t.Fatalf("Failed to marshal CBOR payload during setup: %v", err)
+	}
+
+	tests := []struct {
+		name      string
+		payload   []byte
+		unmarshal func(t *testing.T, f *metav1.FieldsV1, payload []byte)
+	}{
+		{
+			name:    "json unmarshal",
+			payload: jsonPayload,
+			unmarshal: func(t *testing.T, f *metav1.FieldsV1, payload []byte) {
+				if err := json.Unmarshal(payload, f); err != nil {
+					t.Fatalf("JSON Unmarshal failed: %v", err)
+				}
+			},
+		},
+		{
+			name:    "protobuf unmarshal",
+			payload: protoPayload,
+			unmarshal: func(t *testing.T, f *metav1.FieldsV1, payload []byte) {
+				if err := f.Unmarshal(payload); err != nil {
+					t.Fatalf("Protobuf Unmarshal failed: %v", err)
+				}
+			},
+		},
+		{
+			name:    "cbor unmarshal",
+			payload: cborPayload,
+			unmarshal: func(t *testing.T, f *metav1.FieldsV1, payload []byte) {
+				if err := f.UnmarshalCBOR(payload); err != nil {
+					t.Fatalf("CBOR Unmarshal failed: %v", err)
+				}
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			// Ensure independent slice memory
+			b1 := append([]byte(nil), tc.payload...)
+			b2 := append([]byte(nil), tc.payload...)
+
+			var f1 metav1.FieldsV1
+			var f2 metav1.FieldsV1
+
+			tc.unmarshal(t, &f1, b1)
+			tc.unmarshal(t, &f2, b2)
+
+			requireInterned(t, f1.GetRawString(), f2.GetRawString())
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/generated.pb.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/generated.pb.go
new file mode 100644
index 0000000000..293b0223a7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/generated.pb.go
@@ -0,0 +1,10536 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto
+
+package v1
+
+import (
+	fmt "fmt"
+
+	io "io"
+	"sort"
+
+	runtime "k8s.io/apimachinery/pkg/runtime"
+
+	math_bits "math/bits"
+	reflect "reflect"
+	strings "strings"
+	time "time"
+
+	k8s_io_apimachinery_pkg_types "k8s.io/apimachinery/pkg/types"
+)
+
+func (m *APIGroup) Reset() { *m = APIGroup{} }
+
+func (m *APIGroupList) Reset() { *m = APIGroupList{} }
+
+func (m *APIResource) Reset() { *m = APIResource{} }
+
+func (m *APIResourceList) Reset() { *m = APIResourceList{} }
+
+func (m *APIVersions) Reset() { *m = APIVersions{} }
+
+func (m *ApplyOptions) Reset() { *m = ApplyOptions{} }
+
+func (m *Condition) Reset() { *m = Condition{} }
+
+func (m *CreateOptions) Reset() { *m = CreateOptions{} }
+
+func (m *DeleteOptions) Reset() { *m = DeleteOptions{} }
+
+func (m *Duration) Reset() { *m = Duration{} }
+
+func (m *FieldSelectorRequirement) Reset() { *m = FieldSelectorRequirement{} }
+
+func (m *FieldsV1) Reset() { *m = FieldsV1{} }
+
+func (m *GetOptions) Reset() { *m = GetOptions{} }
+
+func (m *GroupKind) Reset() { *m = GroupKind{} }
+
+func (m *GroupResource) Reset() { *m = GroupResource{} }
+
+func (m *GroupVersion) Reset() { *m = GroupVersion{} }
+
+func (m *GroupVersionForDiscovery) Reset() { *m = GroupVersionForDiscovery{} }
+
+func (m *GroupVersionKind) Reset() { *m = GroupVersionKind{} }
+
+func (m *GroupVersionResource) Reset() { *m = GroupVersionResource{} }
+
+func (m *LabelSelector) Reset() { *m = LabelSelector{} }
+
+func (m *LabelSelectorRequirement) Reset() { *m = LabelSelectorRequirement{} }
+
+func (m *List) Reset() { *m = List{} }
+
+func (m *ListMeta) Reset() { *m = ListMeta{} }
+
+func (m *ListOptions) Reset() { *m = ListOptions{} }
+
+func (m *ManagedFieldsEntry) Reset() { *m = ManagedFieldsEntry{} }
+
+func (m *MicroTime) Reset() { *m = MicroTime{} }
+
+func (m *ObjectMeta) Reset() { *m = ObjectMeta{} }
+
+func (m *OwnerReference) Reset() { *m = OwnerReference{} }
+
+func (m *PartialObjectMetadata) Reset() { *m = PartialObjectMetadata{} }
+
+func (m *PartialObjectMetadataList) Reset() { *m = PartialObjectMetadataList{} }
+
+func (m *Patch) Reset() { *m = Patch{} }
+
+func (m *PatchOptions) Reset() { *m = PatchOptions{} }
+
+func (m *Preconditions) Reset() { *m = Preconditions{} }
+
+func (m *RootPaths) Reset() { *m = RootPaths{} }
+
+func (m *ServerAddressByClientCIDR) Reset() { *m = ServerAddressByClientCIDR{} }
+
+func (m *ShardInfo) Reset() { *m = ShardInfo{} }
+
+func (m *Status) Reset() { *m = Status{} }
+
+func (m *StatusCause) Reset() { *m = StatusCause{} }
+
+func (m *StatusDetails) Reset() { *m = StatusDetails{} }
+
+func (m *TableOptions) Reset() { *m = TableOptions{} }
+
+func (m *Time) Reset() { *m = Time{} }
+
+func (m *Timestamp) Reset() { *m = Timestamp{} }
+
+func (m *TypeMeta) Reset() { *m = TypeMeta{} }
+
+func (m *UpdateOptions) Reset() { *m = UpdateOptions{} }
+
+func (m *Verbs) Reset() { *m = Verbs{} }
+
+func (m *WatchEvent) Reset() { *m = WatchEvent{} }
+
+func (m *APIGroup) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *APIGroup) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *APIGroup) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.ServerAddressByClientCIDRs) > 0 {
+		for iNdEx := len(m.ServerAddressByClientCIDRs) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ServerAddressByClientCIDRs[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x22
+		}
+	}
+	{
+		size, err := m.PreferredVersion.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	if len(m.Versions) > 0 {
+		for iNdEx := len(m.Versions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Versions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *APIGroupList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *APIGroupList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *APIGroupList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Groups) > 0 {
+		for iNdEx := len(m.Groups) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Groups[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *APIResource) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *APIResource) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *APIResource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.StorageVersionHash)
+	copy(dAtA[i:], m.StorageVersionHash)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.StorageVersionHash)))
+	i--
+	dAtA[i] = 0x52
+	i -= len(m.Version)
+	copy(dAtA[i:], m.Version)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version)))
+	i--
+	dAtA[i] = 0x4a
+	i -= len(m.Group)
+	copy(dAtA[i:], m.Group)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Group)))
+	i--
+	dAtA[i] = 0x42
+	if len(m.Categories) > 0 {
+		for iNdEx := len(m.Categories) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Categories[iNdEx])
+			copy(dAtA[i:], m.Categories[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.Categories[iNdEx])))
+			i--
+			dAtA[i] = 0x3a
+		}
+	}
+	i -= len(m.SingularName)
+	copy(dAtA[i:], m.SingularName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.SingularName)))
+	i--
+	dAtA[i] = 0x32
+	if len(m.ShortNames) > 0 {
+		for iNdEx := len(m.ShortNames) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.ShortNames[iNdEx])
+			copy(dAtA[i:], m.ShortNames[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.ShortNames[iNdEx])))
+			i--
+			dAtA[i] = 0x2a
+		}
+	}
+	if m.Verbs != nil {
+		{
+			size, err := m.Verbs.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0x1a
+	i--
+	if m.Namespaced {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x10
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *APIResourceList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *APIResourceList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *APIResourceList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.APIResources) > 0 {
+		for iNdEx := len(m.APIResources) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.APIResources[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	i -= len(m.GroupVersion)
+	copy(dAtA[i:], m.GroupVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.GroupVersion)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *APIVersions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *APIVersions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *APIVersions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.ServerAddressByClientCIDRs) > 0 {
+		for iNdEx := len(m.ServerAddressByClientCIDRs) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ServerAddressByClientCIDRs[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Versions) > 0 {
+		for iNdEx := len(m.Versions) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Versions[iNdEx])
+			copy(dAtA[i:], m.Versions[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.Versions[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ApplyOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ApplyOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ApplyOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.FieldManager)
+	copy(dAtA[i:], m.FieldManager)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldManager)))
+	i--
+	dAtA[i] = 0x1a
+	i--
+	if m.Force {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x10
+	if len(m.DryRun) > 0 {
+		for iNdEx := len(m.DryRun) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.DryRun[iNdEx])
+			copy(dAtA[i:], m.DryRun[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.DryRun[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Condition) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Condition) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Condition) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Message)
+	copy(dAtA[i:], m.Message)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message)))
+	i--
+	dAtA[i] = 0x32
+	i -= len(m.Reason)
+	copy(dAtA[i:], m.Reason)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Reason)))
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.LastTransitionTime.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	i = encodeVarintGenerated(dAtA, i, uint64(m.ObservedGeneration))
+	i--
+	dAtA[i] = 0x18
+	i -= len(m.Status)
+	copy(dAtA[i:], m.Status)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Type)
+	copy(dAtA[i:], m.Type)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *CreateOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CreateOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CreateOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.FieldValidation)
+	copy(dAtA[i:], m.FieldValidation)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldValidation)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.FieldManager)
+	copy(dAtA[i:], m.FieldManager)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldManager)))
+	i--
+	dAtA[i] = 0x1a
+	if len(m.DryRun) > 0 {
+		for iNdEx := len(m.DryRun) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.DryRun[iNdEx])
+			copy(dAtA[i:], m.DryRun[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.DryRun[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *DeleteOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DeleteOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *DeleteOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.IgnoreStoreReadErrorWithClusterBreakingPotential != nil {
+		i--
+		if *m.IgnoreStoreReadErrorWithClusterBreakingPotential {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x30
+	}
+	if len(m.DryRun) > 0 {
+		for iNdEx := len(m.DryRun) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.DryRun[iNdEx])
+			copy(dAtA[i:], m.DryRun[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.DryRun[iNdEx])))
+			i--
+			dAtA[i] = 0x2a
+		}
+	}
+	if m.PropagationPolicy != nil {
+		i -= len(*m.PropagationPolicy)
+		copy(dAtA[i:], *m.PropagationPolicy)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.PropagationPolicy)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.OrphanDependents != nil {
+		i--
+		if *m.OrphanDependents {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Preconditions != nil {
+		{
+			size, err := m.Preconditions.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.GracePeriodSeconds != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.GracePeriodSeconds))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Duration) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Duration) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Duration) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Duration))
+	i--
+	dAtA[i] = 0x8
+	return len(dAtA) - i, nil
+}
+
+func (m *FieldSelectorRequirement) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *FieldSelectorRequirement) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *FieldSelectorRequirement) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Values) > 0 {
+		for iNdEx := len(m.Values) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Values[iNdEx])
+			copy(dAtA[i:], m.Values[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.Values[iNdEx])))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	i -= len(m.Operator)
+	copy(dAtA[i:], m.Operator)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Operator)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Key)
+	copy(dAtA[i:], m.Key)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Key)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *GetOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GetOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GetOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.ResourceVersion)
+	copy(dAtA[i:], m.ResourceVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ResourceVersion)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *GroupKind) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GroupKind) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GroupKind) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Group)
+	copy(dAtA[i:], m.Group)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Group)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *GroupResource) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GroupResource) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GroupResource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Resource)
+	copy(dAtA[i:], m.Resource)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Resource)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Group)
+	copy(dAtA[i:], m.Group)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Group)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *GroupVersion) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GroupVersion) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GroupVersion) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Version)
+	copy(dAtA[i:], m.Version)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Group)
+	copy(dAtA[i:], m.Group)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Group)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *GroupVersionForDiscovery) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GroupVersionForDiscovery) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GroupVersionForDiscovery) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Version)
+	copy(dAtA[i:], m.Version)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.GroupVersion)
+	copy(dAtA[i:], m.GroupVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.GroupVersion)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *GroupVersionKind) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GroupVersionKind) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GroupVersionKind) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Version)
+	copy(dAtA[i:], m.Version)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Group)
+	copy(dAtA[i:], m.Group)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Group)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *GroupVersionResource) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GroupVersionResource) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GroupVersionResource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Resource)
+	copy(dAtA[i:], m.Resource)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Resource)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Version)
+	copy(dAtA[i:], m.Version)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Group)
+	copy(dAtA[i:], m.Group)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Group)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *LabelSelector) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LabelSelector) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *LabelSelector) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.MatchExpressions) > 0 {
+		for iNdEx := len(m.MatchExpressions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.MatchExpressions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.MatchLabels) > 0 {
+		keysForMatchLabels := make([]string, 0, len(m.MatchLabels))
+		for k := range m.MatchLabels {
+			keysForMatchLabels = append(keysForMatchLabels, string(k))
+		}
+		sort.Strings(keysForMatchLabels)
+		for iNdEx := len(keysForMatchLabels) - 1; iNdEx >= 0; iNdEx-- {
+			v := m.MatchLabels[string(keysForMatchLabels[iNdEx])]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = encodeVarintGenerated(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(keysForMatchLabels[iNdEx])
+			copy(dAtA[i:], keysForMatchLabels[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForMatchLabels[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintGenerated(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *LabelSelectorRequirement) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LabelSelectorRequirement) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *LabelSelectorRequirement) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Values) > 0 {
+		for iNdEx := len(m.Values) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Values[iNdEx])
+			copy(dAtA[i:], m.Values[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.Values[iNdEx])))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	i -= len(m.Operator)
+	copy(dAtA[i:], m.Operator)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Operator)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Key)
+	copy(dAtA[i:], m.Key)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Key)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *List) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *List) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *List) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *ListMeta) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListMeta) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.ShardInfo != nil {
+		{
+			size, err := m.ShardInfo.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.RemainingItemCount != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.RemainingItemCount))
+		i--
+		dAtA[i] = 0x20
+	}
+	i -= len(m.Continue)
+	copy(dAtA[i:], m.Continue)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Continue)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.ResourceVersion)
+	copy(dAtA[i:], m.ResourceVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ResourceVersion)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.SelfLink)
+	copy(dAtA[i:], m.SelfLink)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.SelfLink)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *ListOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ListOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.ShardSelector)
+	copy(dAtA[i:], m.ShardSelector)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ShardSelector)))
+	i--
+	dAtA[i] = 0x7a
+	if m.SendInitialEvents != nil {
+		i--
+		if *m.SendInitialEvents {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x58
+	}
+	i -= len(m.ResourceVersionMatch)
+	copy(dAtA[i:], m.ResourceVersionMatch)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ResourceVersionMatch)))
+	i--
+	dAtA[i] = 0x52
+	i--
+	if m.AllowWatchBookmarks {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x48
+	i -= len(m.Continue)
+	copy(dAtA[i:], m.Continue)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Continue)))
+	i--
+	dAtA[i] = 0x42
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Limit))
+	i--
+	dAtA[i] = 0x38
+	if m.TimeoutSeconds != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.TimeoutSeconds))
+		i--
+		dAtA[i] = 0x28
+	}
+	i -= len(m.ResourceVersion)
+	copy(dAtA[i:], m.ResourceVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ResourceVersion)))
+	i--
+	dAtA[i] = 0x22
+	i--
+	if m.Watch {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x18
+	i -= len(m.FieldSelector)
+	copy(dAtA[i:], m.FieldSelector)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldSelector)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.LabelSelector)
+	copy(dAtA[i:], m.LabelSelector)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.LabelSelector)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *ManagedFieldsEntry) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ManagedFieldsEntry) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ManagedFieldsEntry) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Subresource)
+	copy(dAtA[i:], m.Subresource)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Subresource)))
+	i--
+	dAtA[i] = 0x42
+	if m.FieldsV1 != nil {
+		{
+			size, err := m.FieldsV1.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x3a
+	}
+	i -= len(m.FieldsType)
+	copy(dAtA[i:], m.FieldsType)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldsType)))
+	i--
+	dAtA[i] = 0x32
+	if m.Time != nil {
+		{
+			size, err := m.Time.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	i -= len(m.APIVersion)
+	copy(dAtA[i:], m.APIVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.APIVersion)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Operation)
+	copy(dAtA[i:], m.Operation)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Operation)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Manager)
+	copy(dAtA[i:], m.Manager)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Manager)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *ObjectMeta) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ObjectMeta) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ObjectMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.ManagedFields) > 0 {
+		for iNdEx := len(m.ManagedFields) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ManagedFields[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0x8a
+		}
+	}
+	if len(m.Finalizers) > 0 {
+		for iNdEx := len(m.Finalizers) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Finalizers[iNdEx])
+			copy(dAtA[i:], m.Finalizers[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.Finalizers[iNdEx])))
+			i--
+			dAtA[i] = 0x72
+		}
+	}
+	if len(m.OwnerReferences) > 0 {
+		for iNdEx := len(m.OwnerReferences) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.OwnerReferences[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x6a
+		}
+	}
+	if len(m.Annotations) > 0 {
+		keysForAnnotations := make([]string, 0, len(m.Annotations))
+		for k := range m.Annotations {
+			keysForAnnotations = append(keysForAnnotations, string(k))
+		}
+		sort.Strings(keysForAnnotations)
+		for iNdEx := len(keysForAnnotations) - 1; iNdEx >= 0; iNdEx-- {
+			v := m.Annotations[string(keysForAnnotations[iNdEx])]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = encodeVarintGenerated(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(keysForAnnotations[iNdEx])
+			copy(dAtA[i:], keysForAnnotations[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForAnnotations[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintGenerated(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x62
+		}
+	}
+	if len(m.Labels) > 0 {
+		keysForLabels := make([]string, 0, len(m.Labels))
+		for k := range m.Labels {
+			keysForLabels = append(keysForLabels, string(k))
+		}
+		sort.Strings(keysForLabels)
+		for iNdEx := len(keysForLabels) - 1; iNdEx >= 0; iNdEx-- {
+			v := m.Labels[string(keysForLabels[iNdEx])]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = encodeVarintGenerated(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(keysForLabels[iNdEx])
+			copy(dAtA[i:], keysForLabels[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForLabels[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintGenerated(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x5a
+		}
+	}
+	if m.DeletionGracePeriodSeconds != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.DeletionGracePeriodSeconds))
+		i--
+		dAtA[i] = 0x50
+	}
+	if m.DeletionTimestamp != nil {
+		{
+			size, err := m.DeletionTimestamp.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x4a
+	}
+	{
+		size, err := m.CreationTimestamp.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x42
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Generation))
+	i--
+	dAtA[i] = 0x38
+	i -= len(m.ResourceVersion)
+	copy(dAtA[i:], m.ResourceVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ResourceVersion)))
+	i--
+	dAtA[i] = 0x32
+	i -= len(m.UID)
+	copy(dAtA[i:], m.UID)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.UID)))
+	i--
+	dAtA[i] = 0x2a
+	i -= len(m.SelfLink)
+	copy(dAtA[i:], m.SelfLink)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.SelfLink)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.Namespace)
+	copy(dAtA[i:], m.Namespace)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Namespace)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.GenerateName)
+	copy(dAtA[i:], m.GenerateName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.GenerateName)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *OwnerReference) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *OwnerReference) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *OwnerReference) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.BlockOwnerDeletion != nil {
+		i--
+		if *m.BlockOwnerDeletion {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x38
+	}
+	if m.Controller != nil {
+		i--
+		if *m.Controller {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x30
+	}
+	i -= len(m.APIVersion)
+	copy(dAtA[i:], m.APIVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.APIVersion)))
+	i--
+	dAtA[i] = 0x2a
+	i -= len(m.UID)
+	copy(dAtA[i:], m.UID)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.UID)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *PartialObjectMetadata) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PartialObjectMetadata) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PartialObjectMetadata) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *PartialObjectMetadataList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PartialObjectMetadataList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PartialObjectMetadataList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *Patch) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Patch) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Patch) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *PatchOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PatchOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PatchOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.FieldValidation)
+	copy(dAtA[i:], m.FieldValidation)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldValidation)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.FieldManager)
+	copy(dAtA[i:], m.FieldManager)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldManager)))
+	i--
+	dAtA[i] = 0x1a
+	if m.Force != nil {
+		i--
+		if *m.Force {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.DryRun) > 0 {
+		for iNdEx := len(m.DryRun) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.DryRun[iNdEx])
+			copy(dAtA[i:], m.DryRun[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.DryRun[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Preconditions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Preconditions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Preconditions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.ResourceVersion != nil {
+		i -= len(*m.ResourceVersion)
+		copy(dAtA[i:], *m.ResourceVersion)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ResourceVersion)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.UID != nil {
+		i -= len(*m.UID)
+		copy(dAtA[i:], *m.UID)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.UID)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *RootPaths) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RootPaths) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RootPaths) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Paths) > 0 {
+		for iNdEx := len(m.Paths) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Paths[iNdEx])
+			copy(dAtA[i:], m.Paths[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.Paths[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ServerAddressByClientCIDR) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ServerAddressByClientCIDR) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ServerAddressByClientCIDR) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.ServerAddress)
+	copy(dAtA[i:], m.ServerAddress)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ServerAddress)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.ClientCIDR)
+	copy(dAtA[i:], m.ClientCIDR)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ClientCIDR)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *ShardInfo) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ShardInfo) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ShardInfo) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Selector)
+	copy(dAtA[i:], m.Selector)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Selector)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *Status) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Status) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Status) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Code))
+	i--
+	dAtA[i] = 0x30
+	if m.Details != nil {
+		{
+			size, err := m.Details.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2a
+	}
+	i -= len(m.Reason)
+	copy(dAtA[i:], m.Reason)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Reason)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.Message)
+	copy(dAtA[i:], m.Message)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Status)
+	copy(dAtA[i:], m.Status)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status)))
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *StatusCause) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *StatusCause) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *StatusCause) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Field)
+	copy(dAtA[i:], m.Field)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Field)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Message)
+	copy(dAtA[i:], m.Message)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Type)
+	copy(dAtA[i:], m.Type)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *StatusDetails) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *StatusDetails) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *StatusDetails) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.UID)
+	copy(dAtA[i:], m.UID)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.UID)))
+	i--
+	dAtA[i] = 0x32
+	i = encodeVarintGenerated(dAtA, i, uint64(m.RetryAfterSeconds))
+	i--
+	dAtA[i] = 0x28
+	if len(m.Causes) > 0 {
+		for iNdEx := len(m.Causes) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Causes[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x22
+		}
+	}
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Group)
+	copy(dAtA[i:], m.Group)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Group)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *TableOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TableOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *TableOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.IncludeObject)
+	copy(dAtA[i:], m.IncludeObject)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.IncludeObject)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *Timestamp) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Timestamp) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Timestamp) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Nanos))
+	i--
+	dAtA[i] = 0x10
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Seconds))
+	i--
+	dAtA[i] = 0x8
+	return len(dAtA) - i, nil
+}
+
+func (m *TypeMeta) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TypeMeta) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *TypeMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.APIVersion)
+	copy(dAtA[i:], m.APIVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.APIVersion)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *UpdateOptions) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UpdateOptions) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *UpdateOptions) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.FieldValidation)
+	copy(dAtA[i:], m.FieldValidation)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldValidation)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.FieldManager)
+	copy(dAtA[i:], m.FieldManager)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.FieldManager)))
+	i--
+	dAtA[i] = 0x12
+	if len(m.DryRun) > 0 {
+		for iNdEx := len(m.DryRun) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.DryRun[iNdEx])
+			copy(dAtA[i:], m.DryRun[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.DryRun[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m Verbs) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m Verbs) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m Verbs) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m) > 0 {
+		for iNdEx := len(m) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m[iNdEx])
+			copy(dAtA[i:], m[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *WatchEvent) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WatchEvent) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WatchEvent) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.Object.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Type)
+	copy(dAtA[i:], m.Type)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *APIGroup) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Versions) > 0 {
+		for _, e := range m.Versions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = m.PreferredVersion.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.ServerAddressByClientCIDRs) > 0 {
+		for _, e := range m.ServerAddressByClientCIDRs {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *APIGroupList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Groups) > 0 {
+		for _, e := range m.Groups {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *APIResource) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	n += 2
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Verbs != nil {
+		l = m.Verbs.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.ShortNames) > 0 {
+		for _, s := range m.ShortNames {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = len(m.SingularName)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Categories) > 0 {
+		for _, s := range m.Categories {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = len(m.Group)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Version)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.StorageVersionHash)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *APIResourceList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.GroupVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.APIResources) > 0 {
+		for _, e := range m.APIResources {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *APIVersions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Versions) > 0 {
+		for _, s := range m.Versions {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.ServerAddressByClientCIDRs) > 0 {
+		for _, e := range m.ServerAddressByClientCIDRs {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *ApplyOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.DryRun) > 0 {
+		for _, s := range m.DryRun {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	n += 2
+	l = len(m.FieldManager)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *Condition) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Type)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Status)
+	n += 1 + l + sovGenerated(uint64(l))
+	n += 1 + sovGenerated(uint64(m.ObservedGeneration))
+	l = m.LastTransitionTime.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Reason)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Message)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *CreateOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.DryRun) > 0 {
+		for _, s := range m.DryRun {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = len(m.FieldManager)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.FieldValidation)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *DeleteOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.GracePeriodSeconds != nil {
+		n += 1 + sovGenerated(uint64(*m.GracePeriodSeconds))
+	}
+	if m.Preconditions != nil {
+		l = m.Preconditions.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.OrphanDependents != nil {
+		n += 2
+	}
+	if m.PropagationPolicy != nil {
+		l = len(*m.PropagationPolicy)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.DryRun) > 0 {
+		for _, s := range m.DryRun {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if m.IgnoreStoreReadErrorWithClusterBreakingPotential != nil {
+		n += 2
+	}
+	return n
+}
+
+func (m *Duration) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 1 + sovGenerated(uint64(m.Duration))
+	return n
+}
+
+func (m *FieldSelectorRequirement) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Key)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Operator)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Values) > 0 {
+		for _, s := range m.Values {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *GetOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.ResourceVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *GroupKind) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Group)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *GroupResource) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Group)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Resource)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *GroupVersion) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Group)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Version)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *GroupVersionForDiscovery) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.GroupVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Version)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *GroupVersionKind) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Group)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Version)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *GroupVersionResource) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Group)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Version)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Resource)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *LabelSelector) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.MatchLabels) > 0 {
+		for k, v := range m.MatchLabels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + len(v) + sovGenerated(uint64(len(v)))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
+	if len(m.MatchExpressions) > 0 {
+		for _, e := range m.MatchExpressions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *LabelSelectorRequirement) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Key)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Operator)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Values) > 0 {
+		for _, s := range m.Values {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *List) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *ListMeta) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.SelfLink)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.ResourceVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Continue)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.RemainingItemCount != nil {
+		n += 1 + sovGenerated(uint64(*m.RemainingItemCount))
+	}
+	if m.ShardInfo != nil {
+		l = m.ShardInfo.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *ListOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.LabelSelector)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.FieldSelector)
+	n += 1 + l + sovGenerated(uint64(l))
+	n += 2
+	l = len(m.ResourceVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.TimeoutSeconds != nil {
+		n += 1 + sovGenerated(uint64(*m.TimeoutSeconds))
+	}
+	n += 1 + sovGenerated(uint64(m.Limit))
+	l = len(m.Continue)
+	n += 1 + l + sovGenerated(uint64(l))
+	n += 2
+	l = len(m.ResourceVersionMatch)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.SendInitialEvents != nil {
+		n += 2
+	}
+	l = len(m.ShardSelector)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *ManagedFieldsEntry) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Manager)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Operation)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.APIVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Time != nil {
+		l = m.Time.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = len(m.FieldsType)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.FieldsV1 != nil {
+		l = m.FieldsV1.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = len(m.Subresource)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *ObjectMeta) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.GenerateName)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Namespace)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.SelfLink)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.UID)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.ResourceVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	n += 1 + sovGenerated(uint64(m.Generation))
+	l = m.CreationTimestamp.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.DeletionTimestamp != nil {
+		l = m.DeletionTimestamp.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.DeletionGracePeriodSeconds != nil {
+		n += 1 + sovGenerated(uint64(*m.DeletionGracePeriodSeconds))
+	}
+	if len(m.Labels) > 0 {
+		for k, v := range m.Labels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + len(v) + sovGenerated(uint64(len(v)))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
+	if len(m.Annotations) > 0 {
+		for k, v := range m.Annotations {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + len(v) + sovGenerated(uint64(len(v)))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
+	if len(m.OwnerReferences) > 0 {
+		for _, e := range m.OwnerReferences {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.Finalizers) > 0 {
+		for _, s := range m.Finalizers {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.ManagedFields) > 0 {
+		for _, e := range m.ManagedFields {
+			l = e.Size()
+			n += 2 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *OwnerReference) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.UID)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.APIVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Controller != nil {
+		n += 2
+	}
+	if m.BlockOwnerDeletion != nil {
+		n += 2
+	}
+	return n
+}
+
+func (m *PartialObjectMetadata) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ObjectMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *PartialObjectMetadataList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *Patch) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *PatchOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.DryRun) > 0 {
+		for _, s := range m.DryRun {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if m.Force != nil {
+		n += 2
+	}
+	l = len(m.FieldManager)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.FieldValidation)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *Preconditions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.UID != nil {
+		l = len(*m.UID)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.ResourceVersion != nil {
+		l = len(*m.ResourceVersion)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *RootPaths) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Paths) > 0 {
+		for _, s := range m.Paths {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *ServerAddressByClientCIDR) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.ClientCIDR)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.ServerAddress)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *ShardInfo) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Selector)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *Status) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Status)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Message)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Reason)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Details != nil {
+		l = m.Details.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	n += 1 + sovGenerated(uint64(m.Code))
+	return n
+}
+
+func (m *StatusCause) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Type)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Message)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Field)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *StatusDetails) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Group)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Causes) > 0 {
+		for _, e := range m.Causes {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	n += 1 + sovGenerated(uint64(m.RetryAfterSeconds))
+	l = len(m.UID)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *TableOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.IncludeObject)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *Timestamp) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 1 + sovGenerated(uint64(m.Seconds))
+	n += 1 + sovGenerated(uint64(m.Nanos))
+	return n
+}
+
+func (m *TypeMeta) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.APIVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *UpdateOptions) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.DryRun) > 0 {
+		for _, s := range m.DryRun {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = len(m.FieldManager)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.FieldValidation)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m Verbs) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m) > 0 {
+		for _, s := range m {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *WatchEvent) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Type)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Object.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozGenerated(x uint64) (n int) {
+	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *APIGroup) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForVersions := "[]GroupVersionForDiscovery{"
+	for _, f := range this.Versions {
+		repeatedStringForVersions += strings.Replace(strings.Replace(f.String(), "GroupVersionForDiscovery", "GroupVersionForDiscovery", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForVersions += "}"
+	repeatedStringForServerAddressByClientCIDRs := "[]ServerAddressByClientCIDR{"
+	for _, f := range this.ServerAddressByClientCIDRs {
+		repeatedStringForServerAddressByClientCIDRs += strings.Replace(strings.Replace(f.String(), "ServerAddressByClientCIDR", "ServerAddressByClientCIDR", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForServerAddressByClientCIDRs += "}"
+	s := strings.Join([]string{`&APIGroup{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`Versions:` + repeatedStringForVersions + `,`,
+		`PreferredVersion:` + strings.Replace(strings.Replace(this.PreferredVersion.String(), "GroupVersionForDiscovery", "GroupVersionForDiscovery", 1), `&`, ``, 1) + `,`,
+		`ServerAddressByClientCIDRs:` + repeatedStringForServerAddressByClientCIDRs + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *APIGroupList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForGroups := "[]APIGroup{"
+	for _, f := range this.Groups {
+		repeatedStringForGroups += strings.Replace(strings.Replace(f.String(), "APIGroup", "APIGroup", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForGroups += "}"
+	s := strings.Join([]string{`&APIGroupList{`,
+		`Groups:` + repeatedStringForGroups + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *APIResource) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&APIResource{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`Namespaced:` + fmt.Sprintf("%v", this.Namespaced) + `,`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`Verbs:` + strings.Replace(fmt.Sprintf("%v", this.Verbs), "Verbs", "Verbs", 1) + `,`,
+		`ShortNames:` + fmt.Sprintf("%v", this.ShortNames) + `,`,
+		`SingularName:` + fmt.Sprintf("%v", this.SingularName) + `,`,
+		`Categories:` + fmt.Sprintf("%v", this.Categories) + `,`,
+		`Group:` + fmt.Sprintf("%v", this.Group) + `,`,
+		`Version:` + fmt.Sprintf("%v", this.Version) + `,`,
+		`StorageVersionHash:` + fmt.Sprintf("%v", this.StorageVersionHash) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *APIResourceList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForAPIResources := "[]APIResource{"
+	for _, f := range this.APIResources {
+		repeatedStringForAPIResources += strings.Replace(strings.Replace(f.String(), "APIResource", "APIResource", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForAPIResources += "}"
+	s := strings.Join([]string{`&APIResourceList{`,
+		`GroupVersion:` + fmt.Sprintf("%v", this.GroupVersion) + `,`,
+		`APIResources:` + repeatedStringForAPIResources + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ApplyOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ApplyOptions{`,
+		`DryRun:` + fmt.Sprintf("%v", this.DryRun) + `,`,
+		`Force:` + fmt.Sprintf("%v", this.Force) + `,`,
+		`FieldManager:` + fmt.Sprintf("%v", this.FieldManager) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Condition) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Condition{`,
+		`Type:` + fmt.Sprintf("%v", this.Type) + `,`,
+		`Status:` + fmt.Sprintf("%v", this.Status) + `,`,
+		`ObservedGeneration:` + fmt.Sprintf("%v", this.ObservedGeneration) + `,`,
+		`LastTransitionTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastTransitionTime), "Time", "Time", 1), `&`, ``, 1) + `,`,
+		`Reason:` + fmt.Sprintf("%v", this.Reason) + `,`,
+		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CreateOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CreateOptions{`,
+		`DryRun:` + fmt.Sprintf("%v", this.DryRun) + `,`,
+		`FieldManager:` + fmt.Sprintf("%v", this.FieldManager) + `,`,
+		`FieldValidation:` + fmt.Sprintf("%v", this.FieldValidation) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *DeleteOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&DeleteOptions{`,
+		`GracePeriodSeconds:` + valueToStringGenerated(this.GracePeriodSeconds) + `,`,
+		`Preconditions:` + strings.Replace(this.Preconditions.String(), "Preconditions", "Preconditions", 1) + `,`,
+		`OrphanDependents:` + valueToStringGenerated(this.OrphanDependents) + `,`,
+		`PropagationPolicy:` + valueToStringGenerated(this.PropagationPolicy) + `,`,
+		`DryRun:` + fmt.Sprintf("%v", this.DryRun) + `,`,
+		`IgnoreStoreReadErrorWithClusterBreakingPotential:` + valueToStringGenerated(this.IgnoreStoreReadErrorWithClusterBreakingPotential) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Duration) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Duration{`,
+		`Duration:` + fmt.Sprintf("%v", this.Duration) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *FieldSelectorRequirement) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&FieldSelectorRequirement{`,
+		`Key:` + fmt.Sprintf("%v", this.Key) + `,`,
+		`Operator:` + fmt.Sprintf("%v", this.Operator) + `,`,
+		`Values:` + fmt.Sprintf("%v", this.Values) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *GetOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&GetOptions{`,
+		`ResourceVersion:` + fmt.Sprintf("%v", this.ResourceVersion) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *GroupVersionForDiscovery) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&GroupVersionForDiscovery{`,
+		`GroupVersion:` + fmt.Sprintf("%v", this.GroupVersion) + `,`,
+		`Version:` + fmt.Sprintf("%v", this.Version) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *LabelSelector) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForMatchExpressions := "[]LabelSelectorRequirement{"
+	for _, f := range this.MatchExpressions {
+		repeatedStringForMatchExpressions += strings.Replace(strings.Replace(f.String(), "LabelSelectorRequirement", "LabelSelectorRequirement", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForMatchExpressions += "}"
+	keysForMatchLabels := make([]string, 0, len(this.MatchLabels))
+	for k := range this.MatchLabels {
+		keysForMatchLabels = append(keysForMatchLabels, k)
+	}
+	sort.Strings(keysForMatchLabels)
+	mapStringForMatchLabels := "map[string]string{"
+	for _, k := range keysForMatchLabels {
+		mapStringForMatchLabels += fmt.Sprintf("%v: %v,", k, this.MatchLabels[k])
+	}
+	mapStringForMatchLabels += "}"
+	s := strings.Join([]string{`&LabelSelector{`,
+		`MatchLabels:` + mapStringForMatchLabels + `,`,
+		`MatchExpressions:` + repeatedStringForMatchExpressions + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *LabelSelectorRequirement) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&LabelSelectorRequirement{`,
+		`Key:` + fmt.Sprintf("%v", this.Key) + `,`,
+		`Operator:` + fmt.Sprintf("%v", this.Operator) + `,`,
+		`Values:` + fmt.Sprintf("%v", this.Values) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *List) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]RawExtension{"
+	for _, f := range this.Items {
+		repeatedStringForItems += fmt.Sprintf("%v", f) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&List{`,
+		`ListMeta:` + strings.Replace(strings.Replace(this.ListMeta.String(), "ListMeta", "ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ListMeta) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ListMeta{`,
+		`SelfLink:` + fmt.Sprintf("%v", this.SelfLink) + `,`,
+		`ResourceVersion:` + fmt.Sprintf("%v", this.ResourceVersion) + `,`,
+		`Continue:` + fmt.Sprintf("%v", this.Continue) + `,`,
+		`RemainingItemCount:` + valueToStringGenerated(this.RemainingItemCount) + `,`,
+		`ShardInfo:` + strings.Replace(this.ShardInfo.String(), "ShardInfo", "ShardInfo", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ListOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ListOptions{`,
+		`LabelSelector:` + fmt.Sprintf("%v", this.LabelSelector) + `,`,
+		`FieldSelector:` + fmt.Sprintf("%v", this.FieldSelector) + `,`,
+		`Watch:` + fmt.Sprintf("%v", this.Watch) + `,`,
+		`ResourceVersion:` + fmt.Sprintf("%v", this.ResourceVersion) + `,`,
+		`TimeoutSeconds:` + valueToStringGenerated(this.TimeoutSeconds) + `,`,
+		`Limit:` + fmt.Sprintf("%v", this.Limit) + `,`,
+		`Continue:` + fmt.Sprintf("%v", this.Continue) + `,`,
+		`AllowWatchBookmarks:` + fmt.Sprintf("%v", this.AllowWatchBookmarks) + `,`,
+		`ResourceVersionMatch:` + fmt.Sprintf("%v", this.ResourceVersionMatch) + `,`,
+		`SendInitialEvents:` + valueToStringGenerated(this.SendInitialEvents) + `,`,
+		`ShardSelector:` + fmt.Sprintf("%v", this.ShardSelector) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ManagedFieldsEntry) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ManagedFieldsEntry{`,
+		`Manager:` + fmt.Sprintf("%v", this.Manager) + `,`,
+		`Operation:` + fmt.Sprintf("%v", this.Operation) + `,`,
+		`APIVersion:` + fmt.Sprintf("%v", this.APIVersion) + `,`,
+		`Time:` + strings.Replace(fmt.Sprintf("%v", this.Time), "Time", "Time", 1) + `,`,
+		`FieldsType:` + fmt.Sprintf("%v", this.FieldsType) + `,`,
+		`FieldsV1:` + strings.Replace(fmt.Sprintf("%v", this.FieldsV1), "FieldsV1", "FieldsV1", 1) + `,`,
+		`Subresource:` + fmt.Sprintf("%v", this.Subresource) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ObjectMeta) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForOwnerReferences := "[]OwnerReference{"
+	for _, f := range this.OwnerReferences {
+		repeatedStringForOwnerReferences += strings.Replace(strings.Replace(f.String(), "OwnerReference", "OwnerReference", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForOwnerReferences += "}"
+	repeatedStringForManagedFields := "[]ManagedFieldsEntry{"
+	for _, f := range this.ManagedFields {
+		repeatedStringForManagedFields += strings.Replace(strings.Replace(f.String(), "ManagedFieldsEntry", "ManagedFieldsEntry", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForManagedFields += "}"
+	keysForLabels := make([]string, 0, len(this.Labels))
+	for k := range this.Labels {
+		keysForLabels = append(keysForLabels, k)
+	}
+	sort.Strings(keysForLabels)
+	mapStringForLabels := "map[string]string{"
+	for _, k := range keysForLabels {
+		mapStringForLabels += fmt.Sprintf("%v: %v,", k, this.Labels[k])
+	}
+	mapStringForLabels += "}"
+	keysForAnnotations := make([]string, 0, len(this.Annotations))
+	for k := range this.Annotations {
+		keysForAnnotations = append(keysForAnnotations, k)
+	}
+	sort.Strings(keysForAnnotations)
+	mapStringForAnnotations := "map[string]string{"
+	for _, k := range keysForAnnotations {
+		mapStringForAnnotations += fmt.Sprintf("%v: %v,", k, this.Annotations[k])
+	}
+	mapStringForAnnotations += "}"
+	s := strings.Join([]string{`&ObjectMeta{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`GenerateName:` + fmt.Sprintf("%v", this.GenerateName) + `,`,
+		`Namespace:` + fmt.Sprintf("%v", this.Namespace) + `,`,
+		`SelfLink:` + fmt.Sprintf("%v", this.SelfLink) + `,`,
+		`UID:` + fmt.Sprintf("%v", this.UID) + `,`,
+		`ResourceVersion:` + fmt.Sprintf("%v", this.ResourceVersion) + `,`,
+		`Generation:` + fmt.Sprintf("%v", this.Generation) + `,`,
+		`CreationTimestamp:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.CreationTimestamp), "Time", "Time", 1), `&`, ``, 1) + `,`,
+		`DeletionTimestamp:` + strings.Replace(fmt.Sprintf("%v", this.DeletionTimestamp), "Time", "Time", 1) + `,`,
+		`DeletionGracePeriodSeconds:` + valueToStringGenerated(this.DeletionGracePeriodSeconds) + `,`,
+		`Labels:` + mapStringForLabels + `,`,
+		`Annotations:` + mapStringForAnnotations + `,`,
+		`OwnerReferences:` + repeatedStringForOwnerReferences + `,`,
+		`Finalizers:` + fmt.Sprintf("%v", this.Finalizers) + `,`,
+		`ManagedFields:` + repeatedStringForManagedFields + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *OwnerReference) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&OwnerReference{`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`UID:` + fmt.Sprintf("%v", this.UID) + `,`,
+		`APIVersion:` + fmt.Sprintf("%v", this.APIVersion) + `,`,
+		`Controller:` + valueToStringGenerated(this.Controller) + `,`,
+		`BlockOwnerDeletion:` + valueToStringGenerated(this.BlockOwnerDeletion) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PartialObjectMetadata) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&PartialObjectMetadata{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(this.ObjectMeta.String(), "ObjectMeta", "ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PartialObjectMetadataList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]PartialObjectMetadata{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "PartialObjectMetadata", "PartialObjectMetadata", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&PartialObjectMetadataList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(this.ListMeta.String(), "ListMeta", "ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Patch) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Patch{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PatchOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&PatchOptions{`,
+		`DryRun:` + fmt.Sprintf("%v", this.DryRun) + `,`,
+		`Force:` + valueToStringGenerated(this.Force) + `,`,
+		`FieldManager:` + fmt.Sprintf("%v", this.FieldManager) + `,`,
+		`FieldValidation:` + fmt.Sprintf("%v", this.FieldValidation) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Preconditions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Preconditions{`,
+		`UID:` + valueToStringGenerated(this.UID) + `,`,
+		`ResourceVersion:` + valueToStringGenerated(this.ResourceVersion) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *RootPaths) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&RootPaths{`,
+		`Paths:` + fmt.Sprintf("%v", this.Paths) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ServerAddressByClientCIDR) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ServerAddressByClientCIDR{`,
+		`ClientCIDR:` + fmt.Sprintf("%v", this.ClientCIDR) + `,`,
+		`ServerAddress:` + fmt.Sprintf("%v", this.ServerAddress) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ShardInfo) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ShardInfo{`,
+		`Selector:` + fmt.Sprintf("%v", this.Selector) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Status) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Status{`,
+		`ListMeta:` + strings.Replace(strings.Replace(this.ListMeta.String(), "ListMeta", "ListMeta", 1), `&`, ``, 1) + `,`,
+		`Status:` + fmt.Sprintf("%v", this.Status) + `,`,
+		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`Reason:` + fmt.Sprintf("%v", this.Reason) + `,`,
+		`Details:` + strings.Replace(this.Details.String(), "StatusDetails", "StatusDetails", 1) + `,`,
+		`Code:` + fmt.Sprintf("%v", this.Code) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *StatusCause) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&StatusCause{`,
+		`Type:` + fmt.Sprintf("%v", this.Type) + `,`,
+		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`Field:` + fmt.Sprintf("%v", this.Field) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *StatusDetails) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForCauses := "[]StatusCause{"
+	for _, f := range this.Causes {
+		repeatedStringForCauses += strings.Replace(strings.Replace(f.String(), "StatusCause", "StatusCause", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForCauses += "}"
+	s := strings.Join([]string{`&StatusDetails{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`Group:` + fmt.Sprintf("%v", this.Group) + `,`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`Causes:` + repeatedStringForCauses + `,`,
+		`RetryAfterSeconds:` + fmt.Sprintf("%v", this.RetryAfterSeconds) + `,`,
+		`UID:` + fmt.Sprintf("%v", this.UID) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *TableOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&TableOptions{`,
+		`IncludeObject:` + fmt.Sprintf("%v", this.IncludeObject) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Timestamp) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Timestamp{`,
+		`Seconds:` + fmt.Sprintf("%v", this.Seconds) + `,`,
+		`Nanos:` + fmt.Sprintf("%v", this.Nanos) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *TypeMeta) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&TypeMeta{`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`APIVersion:` + fmt.Sprintf("%v", this.APIVersion) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *UpdateOptions) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&UpdateOptions{`,
+		`DryRun:` + fmt.Sprintf("%v", this.DryRun) + `,`,
+		`FieldManager:` + fmt.Sprintf("%v", this.FieldManager) + `,`,
+		`FieldValidation:` + fmt.Sprintf("%v", this.FieldValidation) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WatchEvent) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WatchEvent{`,
+		`Type:` + fmt.Sprintf("%v", this.Type) + `,`,
+		`Object:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.Object), "RawExtension", "runtime.RawExtension", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringGenerated(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *APIGroup) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: APIGroup: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: APIGroup: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Versions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Versions = append(m.Versions, GroupVersionForDiscovery{})
+			if err := m.Versions[len(m.Versions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PreferredVersion", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.PreferredVersion.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerAddressByClientCIDRs", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServerAddressByClientCIDRs = append(m.ServerAddressByClientCIDRs, ServerAddressByClientCIDR{})
+			if err := m.ServerAddressByClientCIDRs[len(m.ServerAddressByClientCIDRs)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *APIGroupList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: APIGroupList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: APIGroupList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Groups", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Groups = append(m.Groups, APIGroup{})
+			if err := m.Groups[len(m.Groups)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *APIResource) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: APIResource: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: APIResource: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Namespaced", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Namespaced = bool(v != 0)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Verbs", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Verbs == nil {
+				m.Verbs = Verbs{}
+			}
+			if err := m.Verbs.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ShortNames", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ShortNames = append(m.ShortNames, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SingularName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SingularName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Categories", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Categories = append(m.Categories, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Group", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Group = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StorageVersionHash", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.StorageVersionHash = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *APIResourceList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: APIResourceList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: APIResourceList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GroupVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.GroupVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field APIResources", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.APIResources = append(m.APIResources, APIResource{})
+			if err := m.APIResources[len(m.APIResources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *APIVersions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: APIVersions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: APIVersions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Versions", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Versions = append(m.Versions, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerAddressByClientCIDRs", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServerAddressByClientCIDRs = append(m.ServerAddressByClientCIDRs, ServerAddressByClientCIDR{})
+			if err := m.ServerAddressByClientCIDRs[len(m.ServerAddressByClientCIDRs)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ApplyOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ApplyOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ApplyOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DryRun", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DryRun = append(m.DryRun, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Force", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Force = bool(v != 0)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldManager", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldManager = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Condition) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Condition: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Condition: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Status = ConditionStatus(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObservedGeneration", wireType)
+			}
+			m.ObservedGeneration = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ObservedGeneration |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastTransitionTime", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.LastTransitionTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CreateOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CreateOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CreateOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DryRun", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DryRun = append(m.DryRun, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldManager", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldManager = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldValidation", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldValidation = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeleteOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeleteOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeleteOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GracePeriodSeconds", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.GracePeriodSeconds = &v
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Preconditions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Preconditions == nil {
+				m.Preconditions = &Preconditions{}
+			}
+			if err := m.Preconditions.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OrphanDependents", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.OrphanDependents = &b
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PropagationPolicy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := DeletionPropagation(dAtA[iNdEx:postIndex])
+			m.PropagationPolicy = &s
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DryRun", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DryRun = append(m.DryRun, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IgnoreStoreReadErrorWithClusterBreakingPotential", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.IgnoreStoreReadErrorWithClusterBreakingPotential = &b
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Duration) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Duration: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Duration: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Duration", wireType)
+			}
+			m.Duration = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Duration |= time.Duration(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *FieldSelectorRequirement) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: FieldSelectorRequirement: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: FieldSelectorRequirement: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Key = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Operator", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Operator = FieldSelectorOperator(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Values", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Values = append(m.Values, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GetOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GetOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GetOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GroupKind) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GroupKind: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GroupKind: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Group", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Group = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GroupResource) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GroupResource: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GroupResource: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Group", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Group = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Resource", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Resource = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GroupVersion) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GroupVersion: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GroupVersion: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Group", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Group = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GroupVersionForDiscovery) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GroupVersionForDiscovery: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GroupVersionForDiscovery: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GroupVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.GroupVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GroupVersionKind) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GroupVersionKind: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GroupVersionKind: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Group", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Group = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GroupVersionResource) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GroupVersionResource: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GroupVersionResource: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Group", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Group = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Resource", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Resource = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *LabelSelector) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LabelSelector: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LabelSelector: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MatchLabels", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.MatchLabels == nil {
+				m.MatchLabels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipGenerated(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.MatchLabels[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MatchExpressions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.MatchExpressions = append(m.MatchExpressions, LabelSelectorRequirement{})
+			if err := m.MatchExpressions[len(m.MatchExpressions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *LabelSelectorRequirement) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LabelSelectorRequirement: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LabelSelectorRequirement: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Key = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Operator", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Operator = LabelSelectorOperator(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Values", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Values = append(m.Values, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *List) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: List: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: List: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, runtime.RawExtension{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ListMeta) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ListMeta: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ListMeta: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SelfLink", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SelfLink = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Continue", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Continue = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RemainingItemCount", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.RemainingItemCount = &v
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ShardInfo", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ShardInfo == nil {
+				m.ShardInfo = &ShardInfo{}
+			}
+			if err := m.ShardInfo.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ListOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ListOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ListOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LabelSelector", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LabelSelector = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldSelector", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldSelector = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Watch", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Watch = bool(v != 0)
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TimeoutSeconds", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.TimeoutSeconds = &v
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+			}
+			m.Limit = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Limit |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Continue", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Continue = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AllowWatchBookmarks", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.AllowWatchBookmarks = bool(v != 0)
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceVersionMatch", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceVersionMatch = ResourceVersionMatch(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SendInitialEvents", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.SendInitialEvents = &b
+		case 15:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ShardSelector", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ShardSelector = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ManagedFieldsEntry) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ManagedFieldsEntry: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ManagedFieldsEntry: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Manager", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Manager = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Operation", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Operation = ManagedFieldsOperationType(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field APIVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.APIVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Time", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Time == nil {
+				m.Time = &Time{}
+			}
+			if err := m.Time.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldsType", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldsType = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldsV1", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.FieldsV1 == nil {
+				m.FieldsV1 = &FieldsV1{}
+			}
+			if err := m.FieldsV1.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Subresource", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Subresource = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ObjectMeta) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ObjectMeta: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ObjectMeta: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GenerateName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.GenerateName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Namespace = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SelfLink", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SelfLink = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UID = k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Generation", wireType)
+			}
+			m.Generation = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Generation |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CreationTimestamp", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.CreationTimestamp.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeletionTimestamp", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.DeletionTimestamp == nil {
+				m.DeletionTimestamp = &Time{}
+			}
+			if err := m.DeletionTimestamp.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 10:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeletionGracePeriodSeconds", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.DeletionGracePeriodSeconds = &v
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Labels", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Labels == nil {
+				m.Labels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipGenerated(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.Labels[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 12:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Annotations", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Annotations == nil {
+				m.Annotations = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipGenerated(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.Annotations[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 13:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OwnerReferences", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.OwnerReferences = append(m.OwnerReferences, OwnerReference{})
+			if err := m.OwnerReferences[len(m.OwnerReferences)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 14:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Finalizers", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Finalizers = append(m.Finalizers, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 17:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ManagedFields", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ManagedFields = append(m.ManagedFields, ManagedFieldsEntry{})
+			if err := m.ManagedFields[len(m.ManagedFields)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *OwnerReference) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: OwnerReference: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: OwnerReference: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UID = k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field APIVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.APIVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Controller", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.Controller = &b
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BlockOwnerDeletion", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.BlockOwnerDeletion = &b
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PartialObjectMetadata) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PartialObjectMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PartialObjectMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PartialObjectMetadataList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PartialObjectMetadataList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PartialObjectMetadataList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, PartialObjectMetadata{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Patch) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Patch: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Patch: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PatchOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PatchOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PatchOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DryRun", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DryRun = append(m.DryRun, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Force", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.Force = &b
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldManager", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldManager = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldValidation", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldValidation = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Preconditions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Preconditions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Preconditions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
+			m.UID = &s
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ResourceVersion = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RootPaths) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RootPaths: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RootPaths: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Paths", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Paths = append(m.Paths, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ServerAddressByClientCIDR) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ServerAddressByClientCIDR: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ServerAddressByClientCIDR: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientCIDR", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ClientCIDR = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerAddress", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServerAddress = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ShardInfo) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ShardInfo: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ShardInfo: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Selector", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Selector = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Status) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Status: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Status: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Status = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Reason = StatusReason(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Details", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Details == nil {
+				m.Details = &StatusDetails{}
+			}
+			if err := m.Details.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Code", wireType)
+			}
+			m.Code = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Code |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *StatusCause) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: StatusCause: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: StatusCause: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = CauseType(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Field", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Field = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *StatusDetails) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: StatusDetails: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: StatusDetails: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Group", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Group = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Causes", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Causes = append(m.Causes, StatusCause{})
+			if err := m.Causes[len(m.Causes)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RetryAfterSeconds", wireType)
+			}
+			m.RetryAfterSeconds = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.RetryAfterSeconds |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UID = k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TableOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TableOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TableOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IncludeObject", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.IncludeObject = IncludeObjectPolicy(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Timestamp) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Timestamp: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Timestamp: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Seconds", wireType)
+			}
+			m.Seconds = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Seconds |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Nanos", wireType)
+			}
+			m.Nanos = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Nanos |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TypeMeta) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TypeMeta: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TypeMeta: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field APIVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.APIVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UpdateOptions) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UpdateOptions: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UpdateOptions: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DryRun", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DryRun = append(m.DryRun, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldManager", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldManager = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FieldValidation", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.FieldValidation = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Verbs) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Verbs: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Verbs: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			*m = append(*m, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WatchEvent) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WatchEvent: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WatchEvent: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Object", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Object.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipGenerated(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLengthGenerated
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupGenerated
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthGenerated
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+var (
+	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto
new file mode 100644
index 0000000000..afc9b250fa
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto
@@ -0,0 +1,1331 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.apimachinery.pkg.apis.meta.v1;
+
+import "k8s.io/apimachinery/pkg/runtime/generated.proto";
+import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/apimachinery/pkg/apis/meta/v1";
+
+// APIGroup contains the name, the supported versions, and the preferred version
+// of a group.
+message APIGroup {
+  // name is the name of the group.
+  optional string name = 1;
+
+  // versions are the versions supported in this group.
+  // +listType=atomic
+  repeated GroupVersionForDiscovery versions = 2;
+
+  // preferredVersion is the version preferred by the API server, which
+  // probably is the storage version.
+  // +optional
+  optional GroupVersionForDiscovery preferredVersion = 3;
+
+  // a map of client CIDR to server address that is serving this group.
+  // This is to help clients reach servers in the most network-efficient way possible.
+  // Clients can use the appropriate server address as per the CIDR that they match.
+  // In case of multiple matches, clients should use the longest matching CIDR.
+  // The server returns only those CIDRs that it thinks that the client can match.
+  // For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP.
+  // Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.
+  // +optional
+  // +listType=atomic
+  repeated ServerAddressByClientCIDR serverAddressByClientCIDRs = 4;
+}
+
+// APIGroupList is a list of APIGroup, to allow clients to discover the API at
+// /apis.
+message APIGroupList {
+  // groups is a list of APIGroup.
+  // +listType=atomic
+  repeated APIGroup groups = 1;
+}
+
+// APIResource specifies the name of a resource and whether it is namespaced.
+message APIResource {
+  // name is the plural name of the resource.
+  optional string name = 1;
+
+  // singularName is the singular name of the resource.  This allows clients to handle plural and singular opaquely.
+  // The singularName is more correct for reporting status on a single item and both singular and plural are allowed
+  // from the kubectl CLI interface.
+  optional string singularName = 6;
+
+  // namespaced indicates if a resource is namespaced or not.
+  optional bool namespaced = 2;
+
+  // group is the preferred group of the resource.  Empty implies the group of the containing resource list.
+  // For subresources, this may have a different value, for example: Scale".
+  optional string group = 8;
+
+  // version is the preferred version of the resource.  Empty implies the version of the containing resource list
+  // For subresources, this may have a different value, for example: v1 (while inside a v1beta1 version of the core resource's group)".
+  optional string version = 9;
+
+  // kind is the kind for the resource (e.g. 'Foo' is the kind for a resource 'foo')
+  optional string kind = 3;
+
+  // verbs is a list of supported kube verbs (this includes get, list, watch, create,
+  // update, patch, delete, deletecollection, and proxy)
+  optional Verbs verbs = 4;
+
+  // shortNames is a list of suggested short names of the resource.
+  // +listType=atomic
+  repeated string shortNames = 5;
+
+  // categories is a list of the grouped resources this resource belongs to (e.g. 'all')
+  // +listType=atomic
+  repeated string categories = 7;
+
+  // The hash value of the storage version, the version this resource is
+  // converted to when written to the data store. Value must be treated
+  // as opaque by clients. Only equality comparison on the value is valid.
+  // This is an alpha feature and may change or be removed in the future.
+  // The field is populated by the apiserver only if the
+  // StorageVersionHash feature gate is enabled.
+  // This field will remain optional even if it graduates.
+  // +optional
+  optional string storageVersionHash = 10;
+}
+
+// APIResourceList is a list of APIResource, it is used to expose the name of the
+// resources supported in a specific group and version, and if the resource
+// is namespaced.
+message APIResourceList {
+  // groupVersion is the group and version this APIResourceList is for.
+  optional string groupVersion = 1;
+
+  // resources contains the name of the resources and if they are namespaced.
+  // +listType=atomic
+  repeated APIResource resources = 2;
+}
+
+// APIVersions lists the versions that are available, to allow clients to
+// discover the API at /api, which is the root path of the legacy v1 API.
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+message APIVersions {
+  // versions are the api versions that are available.
+  // +listType=atomic
+  repeated string versions = 1;
+
+  // a map of client CIDR to server address that is serving this group.
+  // This is to help clients reach servers in the most network-efficient way possible.
+  // Clients can use the appropriate server address as per the CIDR that they match.
+  // In case of multiple matches, clients should use the longest matching CIDR.
+  // The server returns only those CIDRs that it thinks that the client can match.
+  // For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP.
+  // Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.
+  // +listType=atomic
+  repeated ServerAddressByClientCIDR serverAddressByClientCIDRs = 2;
+}
+
+// ApplyOptions may be provided when applying an API object.
+// FieldManager is required for apply requests.
+// ApplyOptions is equivalent to PatchOptions. It is provided as a convenience with documentation
+// that speaks specifically to how the options fields relate to apply.
+message ApplyOptions {
+  // When present, indicates that modifications should not be
+  // persisted. An invalid or unrecognized dryRun directive will
+  // result in an error response and no further processing of the
+  // request. Valid values are:
+  // - All: all dry run stages will be processed
+  // +optional
+  // +listType=atomic
+  repeated string dryRun = 1;
+
+  // Force is going to "force" Apply requests. It means user will
+  // re-acquire conflicting fields owned by other people.
+  optional bool force = 2;
+
+  // fieldManager is a name associated with the actor or entity
+  // that is making these changes. The value must be less than or
+  // 128 characters long, and only contain printable characters,
+  // as defined by https://golang.org/pkg/unicode/#IsPrint. This
+  // field is required.
+  optional string fieldManager = 3;
+}
+
+// Condition contains details for one aspect of the current state of this API Resource.
+// ---
+// This struct is intended for direct use as an array at the field path .status.conditions.  For example,
+//
+// 	type FooStatus struct{
+// 	    // Represents the observations of a foo's current state.
+// 	    // Known .status.conditions.type are: "Available", "Progressing", and "Degraded"
+// 	    // +patchMergeKey=type
+// 	    // +patchStrategy=merge
+// 	    // +listType=map
+// 	    // +listMapKey=type
+// 	    // +k8s:alpha(since: "1.37")=+k8s:optional
+// 	    // +k8s:alpha(since: "1.37")=+k8s:listType=map
+// 	    // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+// 	    Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
+//
+// 	    // other fields
+// 	}
+message Condition {
+  // type of condition in CamelCase or in foo.example.com/CamelCase.
+  // ---
+  // Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
+  // useful (see .node.status.conditions), the ability to deconflict is important.
+  // The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+  // +required
+  // +kubebuilder:validation:Required
+  // +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$`
+  // +kubebuilder:validation:MaxLength=316
+  // +k8s:alpha(since: "1.37")=+k8s:required
+  optional string type = 1;
+
+  // status of the condition, one of True, False, Unknown.
+  // +required
+  // +kubebuilder:validation:Required
+  // +kubebuilder:validation:Enum=True;False;Unknown
+  // +k8s:alpha(since: "1.37")=+k8s:required
+  optional string status = 2;
+
+  // observedGeneration represents the .metadata.generation that the condition was set based upon.
+  // For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+  // with respect to the current state of the instance.
+  // +optional
+  // +kubebuilder:validation:Minimum=0
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:minimum=0
+  optional int64 observedGeneration = 3;
+
+  // lastTransitionTime is the last time the condition transitioned from one status to another.
+  // This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+  // +required
+  // +kubebuilder:validation:Required
+  // +kubebuilder:validation:Type=string
+  // +kubebuilder:validation:Format=date-time
+  // +k8s:alpha(since: "1.37")=+k8s:customValidation
+  optional Time lastTransitionTime = 4;
+
+  // reason contains a programmatic identifier indicating the reason for the condition's last transition.
+  // Producers of specific condition types may define expected values and meanings for this field,
+  // and whether the values are considered a guaranteed API.
+  // The value should be a CamelCase string.
+  // This field may not be empty.
+  // +required
+  // +kubebuilder:validation:Required
+  // +kubebuilder:validation:MaxLength=1024
+  // +kubebuilder:validation:MinLength=1
+  // +kubebuilder:validation:Pattern=`^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$`
+  // +k8s:alpha(since: "1.37")=+k8s:required
+  // +k8s:alpha(since: "1.37")=+k8s:maxBytes=1024
+  optional string reason = 5;
+
+  // message is a human readable message indicating details about the transition.
+  // This may be an empty string.
+  // +required
+  // +kubebuilder:validation:Required
+  // +kubebuilder:validation:MaxLength=32768
+  optional string message = 6;
+}
+
+// CreateOptions may be provided when creating an API object.
+message CreateOptions {
+  // When present, indicates that modifications should not be
+  // persisted. An invalid or unrecognized dryRun directive will
+  // result in an error response and no further processing of the
+  // request. Valid values are:
+  // - All: all dry run stages will be processed
+  // +optional
+  // +listType=atomic
+  repeated string dryRun = 1;
+
+  // fieldManager is a name associated with the actor or entity
+  // that is making these changes. The value must be less than or
+  // 128 characters long, and only contain printable characters,
+  // as defined by https://golang.org/pkg/unicode/#IsPrint.
+  // +optional
+  optional string fieldManager = 3;
+
+  // fieldValidation instructs the server on how to handle
+  // objects in the request (POST/PUT/PATCH) containing unknown
+  // or duplicate fields. Valid values are:
+  // - Ignore: This will ignore any unknown fields that are silently
+  // dropped from the object, and will ignore all but the last duplicate
+  // field that the decoder encounters. This is the default behavior
+  // prior to v1.23.
+  // - Warn: This will send a warning via the standard warning response
+  // header for each unknown field that is dropped from the object, and
+  // for each duplicate field that is encountered. The request will
+  // still succeed if there are no other errors, and will only persist
+  // the last of any duplicate fields. This is the default in v1.23+
+  // - Strict: This will fail the request with a BadRequest error if
+  // any unknown fields would be dropped from the object, or if any
+  // duplicate fields are present. The error returned from the server
+  // will contain all unknown and duplicate fields encountered.
+  // +optional
+  optional string fieldValidation = 4;
+}
+
+// DeleteOptions may be provided when deleting an API object.
+message DeleteOptions {
+  // The duration in seconds before the object should be deleted. Value must be non-negative integer.
+  // The value zero indicates delete immediately. If this value is nil, the default grace period for the
+  // specified type will be used.
+  // Defaults to a per object value if not specified. zero means delete immediately.
+  // +optional
+  optional int64 gracePeriodSeconds = 1;
+
+  // Must be fulfilled before a deletion is carried out. If not possible, a 409 Conflict status will be
+  // returned.
+  // +k8s:conversion-gen=false
+  // +optional
+  optional Preconditions preconditions = 2;
+
+  // Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7.
+  // Should the dependent objects be orphaned. If true/false, the "orphan"
+  // finalizer will be added to/removed from the object's finalizers list.
+  // Either this field or PropagationPolicy may be set, but not both.
+  // +optional
+  optional bool orphanDependents = 3;
+
+  // Whether and how garbage collection will be performed.
+  // Either this field or OrphanDependents may be set, but not both.
+  // The default policy is decided by the existing finalizer set in the
+  // metadata.finalizers and the resource-specific default policy.
+  // Acceptable values are: 'Orphan' - orphan the dependents; 'Background' -
+  // allow the garbage collector to delete the dependents in the background;
+  // 'Foreground' - a cascading policy that deletes all dependents in the
+  // foreground.
+  // +optional
+  optional string propagationPolicy = 4;
+
+  // When present, indicates that modifications should not be
+  // persisted. An invalid or unrecognized dryRun directive will
+  // result in an error response and no further processing of the
+  // request. Valid values are:
+  // - All: all dry run stages will be processed
+  // +optional
+  // +listType=atomic
+  repeated string dryRun = 5;
+
+  // if set to true, it will trigger an unsafe deletion of the resource in
+  // case the normal deletion flow fails with a corrupt object error.
+  // A resource is considered corrupt if it can not be retrieved from
+  // the underlying storage successfully because of a) its data can
+  // not be transformed e.g. decryption failure, or b) it fails
+  // to decode into an object.
+  // NOTE: unsafe deletion ignores finalizer constraints, skips
+  // precondition checks, and removes the object from the storage.
+  // WARNING: This may potentially break the cluster if the workload
+  // associated with the resource being unsafe-deleted relies on normal
+  // deletion flow. Use only if you REALLY know what you are doing.
+  // The default value is false, and the user must opt in to enable it
+  // +optional
+  optional bool ignoreStoreReadErrorWithClusterBreakingPotential = 6;
+}
+
+// Duration is a wrapper around time.Duration which supports correct
+// marshaling to YAML and JSON. In particular, it marshals into strings, which
+// can be used as map keys in json.
+message Duration {
+  optional int64 duration = 1;
+}
+
+// FieldSelectorRequirement is a selector that contains values, a key, and an operator that
+// relates the key and values.
+message FieldSelectorRequirement {
+  // key is the field selector key that the requirement applies to.
+  optional string key = 1;
+
+  // operator represents a key's relationship to a set of values.
+  // Valid operators are In, NotIn, Exists, DoesNotExist.
+  // The list of operators may grow in the future.
+  optional string operator = 2;
+
+  // values is an array of string values.
+  // If the operator is In or NotIn, the values array must be non-empty.
+  // If the operator is Exists or DoesNotExist, the values array must be empty.
+  // +optional
+  // +listType=atomic
+  repeated string values = 3;
+}
+
+// FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.
+//
+// Each key is either a '.' representing the field itself, and will always map to an empty set,
+// or a string representing a sub-field or item. The string will follow one of these four formats:
+// 'f:<name>', where <name> is the name of a field in a struct, or key in a map
+// 'v:<value>', where <value> is the exact json formatted value of a list item
+// 'i:<index>', where <index> is position of a item in a list
+// 'k:<keys>', where <keys> is a map of  a list item's key fields to their unique values
+// If a key maps to an empty Fields value, the field that key represents is part of the set.
+//
+// The exact format is defined in sigs.k8s.io/structured-merge-diff
+// +k8s:deepcopy-gen=false
+// +protobuf.options.marshal=false
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message FieldsV1 {
+  // Raw is the underlying serialization of this object.
+  //
+  // Deprecated: Direct access to this field is deprecated. Use GetRawBytes, GetRawString, SetRawBytes, SetRawString, GetRawReader, NewFieldsV1 instead.
+  optional bytes Raw = 1;
+}
+
+// GetOptions is the standard query options to the standard REST get call.
+message GetOptions {
+  // resourceVersion sets a constraint on what resource versions a request may be served from.
+  // See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+  // details.
+  //
+  // Defaults to unset
+  // +optional
+  optional string resourceVersion = 1;
+}
+
+// GroupKind specifies a Group and a Kind, but does not force a version.  This is useful for identifying
+// concepts during lookup stages without having partially valid types
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message GroupKind {
+  optional string group = 1;
+
+  optional string kind = 2;
+}
+
+// GroupResource specifies a Group and a Resource, but does not force a version.  This is useful for identifying
+// concepts during lookup stages without having partially valid types
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message GroupResource {
+  optional string group = 1;
+
+  optional string resource = 2;
+}
+
+// GroupVersion contains the "group" and the "version", which uniquely identifies the API.
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message GroupVersion {
+  optional string group = 1;
+
+  optional string version = 2;
+}
+
+// GroupVersion contains the "group/version" and "version" string of a version.
+// It is made a struct to keep extensibility.
+message GroupVersionForDiscovery {
+  // groupVersion specifies the API group and version in the form "group/version"
+  optional string groupVersion = 1;
+
+  // version specifies the version in the form of "version". This is to save
+  // the clients the trouble of splitting the GroupVersion.
+  optional string version = 2;
+}
+
+// GroupVersionKind unambiguously identifies a kind.  It doesn't anonymously include GroupVersion
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message GroupVersionKind {
+  optional string group = 1;
+
+  optional string version = 2;
+
+  optional string kind = 3;
+}
+
+// GroupVersionResource unambiguously identifies a resource.  It doesn't anonymously include GroupVersion
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message GroupVersionResource {
+  optional string group = 1;
+
+  optional string version = 2;
+
+  optional string resource = 3;
+}
+
+// A label selector is a label query over a set of resources. The result of matchLabels and
+// matchExpressions are ANDed. An empty label selector matches all objects. A null
+// label selector matches no objects.
+// +structType=atomic
+message LabelSelector {
+  // matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+  // map is equivalent to an element of matchExpressions, whose key field is "key", the
+  // operator is "In", and the values array contains only "value". The requirements are ANDed.
+  // +optional
+  map<string, string> matchLabels = 1;
+
+  // matchExpressions is a list of label selector requirements. The requirements are ANDed.
+  // +optional
+  // +listType=atomic
+  repeated LabelSelectorRequirement matchExpressions = 2;
+}
+
+// A label selector requirement is a selector that contains values, a key, and an operator that
+// relates the key and values.
+message LabelSelectorRequirement {
+  // key is the label key that the selector applies to.
+  optional string key = 1;
+
+  // operator represents a key's relationship to a set of values.
+  // Valid operators are In, NotIn, Exists and DoesNotExist.
+  optional string operator = 2;
+
+  // values is an array of string values. If the operator is In or NotIn,
+  // the values array must be non-empty. If the operator is Exists or DoesNotExist,
+  // the values array must be empty. This array is replaced during a strategic
+  // merge patch.
+  // +optional
+  // +listType=atomic
+  repeated string values = 3;
+}
+
+// List holds a list of objects, which may not be known by the server.
+message List {
+  // Standard list metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +optional
+  optional ListMeta metadata = 1;
+
+  // List of objects
+  repeated .k8s.io.apimachinery.pkg.runtime.RawExtension items = 2;
+}
+
+// ListMeta describes metadata that synthetic resources must have, including lists and
+// various status objects. A resource may have only one of {ObjectMeta, ListMeta}.
+message ListMeta {
+  // Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
+  // +optional
+  optional string selfLink = 1;
+
+  // String that identifies the server's internal version of this object that
+  // can be used by clients to determine when objects have changed.
+  // Value must be treated as opaque by clients and passed unmodified back to the server.
+  // Populated by the system.
+  // Read-only.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+  // +optional
+  optional string resourceVersion = 2;
+
+  // continue may be set if the user set a limit on the number of items returned, and indicates that
+  // the server has more data available. The value is opaque and may be used to issue another request
+  // to the endpoint that served this list to retrieve the next set of available objects. Continuing a
+  // consistent list may not be possible if the server configuration has changed or more than a few
+  // minutes have passed. The resourceVersion field returned when using this continue value will be
+  // identical to the value in the first response, unless you have received this token from an error
+  // message.
+  optional string continue = 3;
+
+  // remainingItemCount is the number of subsequent items in the list which are not included in this
+  // list response. If the list request contained label or field selectors, then the number of
+  // remaining items is unknown and the field will be left unset and omitted during serialization.
+  // If the list is complete (either because it is not chunking or because this is the last chunk),
+  // then there are no more remaining items and this field will be left unset and omitted during
+  // serialization.
+  // Servers older than v1.15 do not set this field.
+  // The intended use of the remainingItemCount is *estimating* the size of a collection. Clients
+  // should not rely on the remainingItemCount to be set or to be exact.
+  // +optional
+  optional int64 remainingItemCount = 4;
+
+  // shardInfo is set when the list is a filtered subset of the full collection,
+  // as selected by a shard selector on the request. It echoes back the selector
+  // so clients can verify which shard they received and merge sharded responses.
+  // Clients should not cache sharded list responses as a full representation
+  // of the collection.
+  //
+  // This is an alpha field and requires enabling the ShardedListAndWatch feature gate.
+  // +featureGate=ShardedListAndWatch
+  // +optional
+  optional ShardInfo shardInfo = 5;
+}
+
+// ListOptions is the query options to a standard REST list call.
+message ListOptions {
+  // A selector to restrict the list of returned objects by their labels.
+  // Defaults to everything.
+  // +optional
+  optional string labelSelector = 1;
+
+  // A selector to restrict the list of returned objects by their fields.
+  // Defaults to everything.
+  // +optional
+  optional string fieldSelector = 2;
+
+  // Watch for changes to the described resources and return them as a stream of
+  // add, update, and remove notifications. Specify resourceVersion.
+  // +optional
+  optional bool watch = 3;
+
+  // allowWatchBookmarks requests watch events with type "BOOKMARK".
+  // Servers that do not implement bookmarks may ignore this flag and
+  // bookmarks are sent at the server's discretion. Clients should not
+  // assume bookmarks are returned at any specific interval, nor may they
+  // assume the server will send any BOOKMARK event during a session.
+  // If this is not a watch, this field is ignored.
+  // +optional
+  optional bool allowWatchBookmarks = 9;
+
+  // resourceVersion sets a constraint on what resource versions a request may be served from.
+  // See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+  // details.
+  //
+  // Defaults to unset
+  // +optional
+  optional string resourceVersion = 4;
+
+  // resourceVersionMatch determines how resourceVersion is applied to list calls.
+  // It is highly recommended that resourceVersionMatch be set for list calls where
+  // resourceVersion is set
+  // See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+  // details.
+  //
+  // Defaults to unset
+  // +optional
+  optional string resourceVersionMatch = 10;
+
+  // Timeout for the list/watch call.
+  // This limits the duration of the call, regardless of any activity or inactivity.
+  // +optional
+  optional int64 timeoutSeconds = 5;
+
+  // limit is a maximum number of responses to return for a list call. If more items exist, the
+  // server will set the `continue` field on the list metadata to a value that can be used with the
+  // same initial query to retrieve the next set of results. Setting a limit may return fewer than
+  // the requested amount of items (up to zero items) in the event all requested objects are
+  // filtered out and clients should only use the presence of the continue field to determine whether
+  // more results are available. Servers may choose not to support the limit argument and will return
+  // all of the available results. If limit is specified and the continue field is empty, clients may
+  // assume that no more results are available. This field is not supported if watch is true.
+  //
+  // The server guarantees that the objects returned when using continue will be identical to issuing
+  // a single list call without a limit - that is, no objects created, modified, or deleted after the
+  // first request is issued will be included in any subsequent continued requests. This is sometimes
+  // referred to as a consistent snapshot, and ensures that a client that is using limit to receive
+  // smaller chunks of a very large result can ensure they see all possible objects. If objects are
+  // updated during a chunked list the version of the object that was present at the time the first list
+  // result was calculated is returned.
+  optional int64 limit = 7;
+
+  // The continue option should be set when retrieving more results from the server. Since this value is
+  // server defined, clients may only use the continue value from a previous query result with identical
+  // query parameters (except for the value of continue) and the server may reject a continue value it
+  // does not recognize. If the specified continue value is no longer valid whether due to expiration
+  // (generally five to fifteen minutes) or a configuration change on the server, the server will
+  // respond with a 410 ResourceExpired error together with a continue token. If the client needs a
+  // consistent list, it must restart their list without the continue field. Otherwise, the client may
+  // send another list request with the token received with the 410 error, the server will respond with
+  // a list starting from the next key, but from the latest snapshot, which is inconsistent from the
+  // previous list results - objects that are created, modified, or deleted after the first list request
+  // will be included in the response, as long as their keys are after the "next key".
+  //
+  // This field is not supported when watch is true. Clients may start a watch from the last
+  // resourceVersion value returned by the server and not miss any modifications.
+  optional string continue = 8;
+
+  // `sendInitialEvents=true` may be set together with `watch=true`.
+  // In that case, the watch stream will begin with synthetic events to
+  // produce the current state of objects in the collection. Once all such
+  // events have been sent, a synthetic "Bookmark" event  will be sent.
+  // The bookmark will report the ResourceVersion (RV) corresponding to the
+  // set of objects, and be marked with `"k8s.io/initial-events-end": "true"` annotation.
+  // Afterwards, the watch stream will proceed as usual, sending watch events
+  // corresponding to changes (subsequent to the RV) to objects watched.
+  //
+  // When `sendInitialEvents` option is set, we require `resourceVersionMatch`
+  // option to also be set. The semantic of the watch request is as following:
+  // - `resourceVersionMatch` = NotOlderThan
+  //   is interpreted as "data at least as new as the provided `resourceVersion`"
+  //   and the bookmark event is send when the state is synced
+  //   to a `resourceVersion` at least as fresh as the one provided by the ListOptions.
+  //   If `resourceVersion` is unset, this is interpreted as "consistent read" and the
+  //   bookmark event is send when the state is synced at least to the moment
+  //   when request started being processed.
+  // - `resourceVersionMatch` set to any other value or unset
+  //   Invalid error is returned.
+  //
+  // Defaults to true if `resourceVersion=""` or `resourceVersion="0"` (for backward
+  // compatibility reasons) and to false otherwise.
+  // +optional
+  optional bool sendInitialEvents = 11;
+
+  // shardSelector restricts the list of returned objects using a CEL-based
+  // shard selector expression. The format uses the shardRange() function
+  // combined with || (logical OR) to specify one or more hash ranges:
+  //
+  //   shardRange(object.metadata.uid, '0x0', '0x8000000000000000')
+  //   shardRange(object.metadata.uid, '0x0', '0x8000000000000000') || shardRange(object.metadata.uid, '0x8000000000000000', '0x10000000000000000')
+  //
+  // Field paths use CEL-style object-rooted syntax (e.g. "object.metadata.uid"),
+  // NOT the fieldSelector format ("metadata.uid"). Currently supported paths:
+  //   - object.metadata.uid
+  //   - object.metadata.namespace
+  //
+  // hexStart and hexEnd are single-quoted CEL string literals with a '0x' prefix,
+  // defining the inclusive lower and exclusive upper bounds over the 64-bit FNV-1a
+  // hash space. The full range is [0x0, 0x10000000000000000), where the exclusive
+  // upper bound equals 2^64.
+  //
+  // Examples:
+  //   2-shard split:
+  //     shard 0: shardRange(object.metadata.uid, '0x0000000000000000', '0x8000000000000000')
+  //     shard 1: shardRange(object.metadata.uid, '0x8000000000000000', '0x10000000000000000')
+  //   4-shard split:
+  //     shard 0: shardRange(object.metadata.uid, '0x0000000000000000', '0x4000000000000000')
+  //     shard 1: shardRange(object.metadata.uid, '0x4000000000000000', '0x8000000000000000')
+  //     shard 2: shardRange(object.metadata.uid, '0x8000000000000000', '0xc000000000000000')
+  //     shard 3: shardRange(object.metadata.uid, '0xc000000000000000', '0x10000000000000000')
+  //
+  // This is an alpha field and requires enabling the ShardedListAndWatch feature gate.
+  // +featureGate=ShardedListAndWatch
+  // +optional
+  optional string shardSelector = 15;
+}
+
+// ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource
+// that the fieldset applies to.
+message ManagedFieldsEntry {
+  // Manager is an identifier of the workflow managing these fields.
+  optional string manager = 1;
+
+  // Operation is the type of operation which lead to this ManagedFieldsEntry being created.
+  // The only valid values for this field are 'Apply' and 'Update'.
+  // +k8s:alpha(since: "1.37")=+k8s:required
+  optional string operation = 2;
+
+  // APIVersion defines the version of this resource that this field set
+  // applies to. The format is "group/version" just like the top-level
+  // APIVersion field. It is necessary to track the version of a field
+  // set because it cannot be automatically converted.
+  optional string apiVersion = 3;
+
+  // Time is the timestamp of when the ManagedFields entry was added. The
+  // timestamp will also be updated if a field is added, the manager
+  // changes any of the owned fields value or removes a field. The
+  // timestamp does not update when a field is removed from the entry
+  // because another manager took it over.
+  // +optional
+  optional Time time = 4;
+
+  // FieldsType is the discriminator for the different fields format and version.
+  // There is currently only one possible value: "FieldsV1"
+  optional string fieldsType = 6;
+
+  // FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
+  // +optional
+  optional FieldsV1 fieldsV1 = 7;
+
+  // Subresource is the name of the subresource used to update that object, or
+  // empty string if the object was updated through the main resource. The
+  // value of this field is used to distinguish between managers, even if they
+  // share the same name. For example, a status update will be distinct from a
+  // regular update using the same manager name.
+  // Note that the APIVersion field is not related to the Subresource field and
+  // it always corresponds to the version of the main resource.
+  optional string subresource = 8;
+}
+
+// MicroTime is version of Time with microsecond level precision.
+//
+// +protobuf.options.marshal=false
+// +protobuf.as=Timestamp
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message MicroTime {
+  // Represents seconds of UTC time since Unix epoch
+  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+  // 9999-12-31T23:59:59Z inclusive.
+  optional int64 seconds = 1;
+
+  // Non-negative fractions of a second at nanosecond resolution. Negative
+  // second values with fractions must still have non-negative nanos values
+  // that count forward in time. Must be from 0 to 999,999,999
+  // inclusive. This field may be limited in precision depending on context.
+  optional int32 nanos = 2;
+}
+
+// ObjectMeta is metadata that all persisted resources must have, which includes all objects
+// users must create.
+message ObjectMeta {
+  // Name must be unique within a namespace. Is required when creating resources, although
+  // some resources may allow a client to request the generation of an appropriate name
+  // automatically. Name is primarily intended for creation idempotence and configuration
+  // definition.
+  // Cannot be updated.
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+  // +optional
+  optional string name = 1;
+
+  // GenerateName is an optional prefix, used by the server, to generate a unique
+  // name ONLY IF the Name field has not been provided.
+  // If this field is used, the name returned to the client will be different
+  // than the name passed. This value will also be combined with a unique suffix.
+  // The provided value has the same validation rules as the Name field,
+  // and may be truncated by the length of the suffix required to make the value
+  // unique on the server.
+  //
+  // If this field is specified and the generated name exists, the server will return a 409.
+  //
+  // Applied only if Name is not specified.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
+  // +optional
+  optional string generateName = 2;
+
+  // Namespace defines the space within which each name must be unique. An empty namespace is
+  // equivalent to the "default" namespace, but "default" is the canonical representation.
+  // Not all objects are required to be scoped to a namespace - the value of this field for
+  // those objects will be empty.
+  //
+  // Must be a DNS_LABEL.
+  // Cannot be updated.
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces
+  // +optional
+  optional string namespace = 3;
+
+  // Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
+  // +optional
+  optional string selfLink = 4;
+
+  // UID is the unique in time and space value for this object. It is typically generated by
+  // the server on successful creation of a resource and is not allowed to change on PUT
+  // operations.
+  //
+  // Populated by the system.
+  // Read-only.
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+  // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  optional string uid = 5;
+
+  // An opaque value that represents the internal version of this object that can
+  // be used by clients to determine when objects have changed. May be used for optimistic
+  // concurrency, change detection, and the watch operation on a resource or set of resources.
+  // Clients must treat these values as opaque and passed unmodified back to the server.
+  // They may only be valid for a particular resource or set of resources.
+  //
+  // Populated by the system.
+  // Read-only.
+  // Value must be treated as opaque by clients and .
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+  // +optional
+  optional string resourceVersion = 6;
+
+  // A sequence number representing a specific generation of the desired state.
+  // Populated by the system. Read-only.
+  // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:minimum=0
+  optional int64 generation = 7;
+
+  // CreationTimestamp is a timestamp representing the server time when this object was
+  // created. It is not guaranteed to be set in happens-before order across separate operations.
+  // Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+  //
+  // Populated by the system.
+  // Read-only.
+  // Null for lists.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  optional Time creationTimestamp = 8;
+
+  // DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This
+  // field is set by the server when a graceful deletion is requested by the user, and is not
+  // directly settable by a client. The resource is expected to be deleted (no longer visible
+  // from resource lists, and not reachable by name) after the time in this field, once the
+  // finalizers list is empty. As long as the finalizers list contains items, deletion is blocked.
+  // Once the deletionTimestamp is set, this value may not be unset or be set further into the
+  // future, although it may be shortened or the resource may be deleted prior to this time.
+  // For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react
+  // by sending a graceful termination signal to the containers in the pod. After that 30 seconds,
+  // the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup,
+  // remove the pod from the API. In the presence of network partitions, this object may still
+  // exist after this timestamp, until an administrator or automated process can determine the
+  // resource is fully terminated.
+  // If not set, graceful deletion of the object has not been requested.
+  //
+  // Populated by the system when a graceful deletion is requested.
+  // Read-only.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  optional Time deletionTimestamp = 9;
+
+  // Number of seconds allowed for this object to gracefully terminate before
+  // it will be removed from the system. Only set when deletionTimestamp is also set.
+  // May only be shortened.
+  // Read-only.
+  // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  optional int64 deletionGracePeriodSeconds = 10;
+
+  // Map of string keys and values that can be used to organize and categorize
+  // (scope and select) objects. May match selectors of replication controllers
+  // and services.
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
+  // +optional
+  map<string, string> labels = 11;
+
+  // Annotations is an unstructured key value map stored with a resource that may be
+  // set by external tools to store and retrieve arbitrary metadata. They are not
+  // queryable and should be preserved when modifying objects.
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
+  // +optional
+  map<string, string> annotations = 12;
+
+  // List of objects depended by this object. If ALL objects in the list have
+  // been deleted, this object will be garbage collected. If this object is managed by a controller,
+  // then an entry in this list will point to this controller, with the controller field set to true.
+  // There cannot be more than one managing controller.
+  // +optional
+  // +patchMergeKey=uid
+  // +patchStrategy=merge
+  // +listType=map
+  // +listMapKey=uid
+  // +k8s:alpha(since:"1.37")=+k8s:optional
+  repeated OwnerReference ownerReferences = 13;
+
+  // Must be empty before the object is deleted from the registry. Each entry
+  // is an identifier for the responsible component that will remove the entry
+  // from the list. If the deletionTimestamp of the object is non-nil, entries
+  // in this list can only be removed.
+  // Finalizers may be processed and removed in any order.  Order is NOT enforced
+  // because it introduces significant risk of stuck finalizers.
+  // finalizers is a shared field, any actor with permission can reorder it.
+  // If the finalizer list is processed in order, then this can lead to a situation
+  // in which the component responsible for the first finalizer in the list is
+  // waiting for a signal (field value, external system, or other) produced by a
+  // component responsible for a finalizer later in the list, resulting in a deadlock.
+  // Without enforced ordering finalizers are free to order amongst themselves and
+  // are not vulnerable to ordering changes in the list.
+  // +optional
+  // +patchStrategy=merge
+  // +listType=set
+  repeated string finalizers = 14;
+
+  // ManagedFields maps workflow-id and version to the set of fields
+  // that are managed by that workflow. This is mostly for internal
+  // housekeeping, and users typically shouldn't need to set or
+  // understand this field. A workflow can be the user's name, a
+  // controller's name, or the name of a specific apply path like
+  // "ci-cd". The set of fields is always in the version that the
+  // workflow used when modifying the object.
+  //
+  // +optional
+  // +listType=atomic
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  repeated ManagedFieldsEntry managedFields = 17;
+}
+
+// OwnerReference contains enough information to let you identify an owning
+// object. An owning object must be in the same namespace as the dependent, or
+// be cluster-scoped, so there is no namespace field.
+// +structType=atomic
+message OwnerReference {
+  // API version of the referent.
+  // +k8s:alpha(since:"1.37")=+k8s:required
+  optional string apiVersion = 5;
+
+  // Kind of the referent.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +k8s:alpha(since:"1.37")=+k8s:required
+  optional string kind = 1;
+
+  // Name of the referent.
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+  // +k8s:alpha(since:"1.37")=+k8s:required
+  optional string name = 3;
+
+  // UID of the referent.
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+  // +k8s:alpha(since:"1.37")=+k8s:required
+  optional string uid = 4;
+
+  // If true, this reference points to the managing controller.
+  // +optional
+  optional bool controller = 6;
+
+  // If true, AND if the owner has the "foregroundDeletion" finalizer, then
+  // the owner cannot be deleted from the key-value store until this
+  // reference is removed.
+  // See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
+  // for how the garbage collector interacts with this field and enforces the foreground deletion.
+  // Defaults to false.
+  // To set this field, a user needs "delete" permission of the owner,
+  // otherwise 422 (Unprocessable Entity) will be returned.
+  // +optional
+  optional bool blockOwnerDeletion = 7;
+}
+
+// PartialObjectMetadata is a generic representation of any object with ObjectMeta. It allows clients
+// to get access to a particular ObjectMeta schema without knowing the details of the version.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+message PartialObjectMetadata {
+  // Standard object's metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  // +optional
+  // +k8s:opaqueType
+  optional ObjectMeta metadata = 1;
+}
+
+// PartialObjectMetadataList contains a list of objects containing only their metadata
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+message PartialObjectMetadataList {
+  // Standard list metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +optional
+  optional ListMeta metadata = 1;
+
+  // items contains each of the included items.
+  repeated PartialObjectMetadata items = 2;
+}
+
+// Patch is provided to give a concrete name and type to the Kubernetes PATCH request body.
+message Patch {
+}
+
+// PatchOptions may be provided when patching an API object.
+// PatchOptions is meant to be a superset of UpdateOptions.
+message PatchOptions {
+  // When present, indicates that modifications should not be
+  // persisted. An invalid or unrecognized dryRun directive will
+  // result in an error response and no further processing of the
+  // request. Valid values are:
+  // - All: all dry run stages will be processed
+  // +optional
+  // +listType=atomic
+  repeated string dryRun = 1;
+
+  // Force is going to "force" Apply requests. It means user will
+  // re-acquire conflicting fields owned by other people. Force
+  // flag must be unset for non-apply patch requests.
+  // +optional
+  optional bool force = 2;
+
+  // fieldManager is a name associated with the actor or entity
+  // that is making these changes. The value must be less than or
+  // 128 characters long, and only contain printable characters,
+  // as defined by https://golang.org/pkg/unicode/#IsPrint. This
+  // field is required for apply requests
+  // (application/apply-patch) but optional for non-apply patch
+  // types (JsonPatch, MergePatch, StrategicMergePatch).
+  // +optional
+  optional string fieldManager = 3;
+
+  // fieldValidation instructs the server on how to handle
+  // objects in the request (POST/PUT/PATCH) containing unknown
+  // or duplicate fields. Valid values are:
+  // - Ignore: This will ignore any unknown fields that are silently
+  // dropped from the object, and will ignore all but the last duplicate
+  // field that the decoder encounters. This is the default behavior
+  // prior to v1.23.
+  // - Warn: This will send a warning via the standard warning response
+  // header for each unknown field that is dropped from the object, and
+  // for each duplicate field that is encountered. The request will
+  // still succeed if there are no other errors, and will only persist
+  // the last of any duplicate fields. This is the default in v1.23+
+  // - Strict: This will fail the request with a BadRequest error if
+  // any unknown fields would be dropped from the object, or if any
+  // duplicate fields are present. The error returned from the server
+  // will contain all unknown and duplicate fields encountered.
+  // +optional
+  optional string fieldValidation = 4;
+}
+
+// Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.
+message Preconditions {
+  // Specifies the target UID.
+  // +optional
+  optional string uid = 1;
+
+  // Specifies the target ResourceVersion
+  // +optional
+  optional string resourceVersion = 2;
+}
+
+// RootPaths lists the paths available at root.
+// For example: "/healthz", "/apis".
+message RootPaths {
+  // paths are the paths available at root.
+  // +listType=atomic
+  repeated string paths = 1;
+}
+
+// ServerAddressByClientCIDR helps the client to determine the server address that they should use, depending on the clientCIDR that they match.
+message ServerAddressByClientCIDR {
+  // The CIDR with which clients can match their IP to figure out the server address that they should use.
+  optional string clientCIDR = 1;
+
+  // Address of this server, suitable for a client that matches the above CIDR.
+  // This can be a hostname, hostname:port, IP or IP:port.
+  optional string serverAddress = 2;
+}
+
+// ShardInfo describes the shard selector that was applied to produce a list response.
+// Its presence on a list response indicates the list is a filtered subset.
+message ShardInfo {
+  // selector is the shard selector string from the request, echoed back so clients
+  // can verify which shard they received and merge responses from multiple shards.
+  // +required
+  optional string selector = 1;
+}
+
+// Status is a return value for calls that don't return other objects.
+message Status {
+  // Standard list metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +optional
+  optional ListMeta metadata = 1;
+
+  // Status of the operation.
+  // One of: "Success" or "Failure".
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+  // +optional
+  optional string status = 2;
+
+  // A human-readable description of the status of this operation.
+  // +optional
+  optional string message = 3;
+
+  // A machine-readable description of why this operation is in the
+  // "Failure" status. If this value is empty there
+  // is no information available. A Reason clarifies an HTTP status
+  // code but does not override it.
+  // +optional
+  optional string reason = 4;
+
+  // Extended data associated with the reason.  Each reason may define its
+  // own extended details. This field is optional and the data returned
+  // is not guaranteed to conform to any schema except that defined by
+  // the reason type.
+  // +optional
+  optional StatusDetails details = 5;
+
+  // Suggested HTTP return code for this status, 0 if not set.
+  // +optional
+  optional int32 code = 6;
+}
+
+// StatusCause provides more information about an api.Status failure, including
+// cases when multiple errors are encountered.
+message StatusCause {
+  // A machine-readable description of the cause of the error. If this value is
+  // empty there is no information available.
+  // +optional
+  optional string reason = 1;
+
+  // A human-readable description of the cause of the error.  This field may be
+  // presented as-is to a reader.
+  // +optional
+  optional string message = 2;
+
+  // The field of the resource that has caused this error, as named by its JSON
+  // serialization. May include dot and postfix notation for nested attributes.
+  // Arrays are zero-indexed.  Fields may appear more than once in an array of
+  // causes due to fields having multiple errors.
+  // Optional.
+  //
+  // Examples:
+  //   "name" - the field "name" on the current resource
+  //   "items[0].name" - the field "name" on the first array entry in "items"
+  // +optional
+  optional string field = 3;
+}
+
+// StatusDetails is a set of additional properties that MAY be set by the
+// server to provide additional information about a response. The Reason
+// field of a Status object defines what attributes will be set. Clients
+// must ignore fields that do not match the defined type of each attribute,
+// and should assume that any attribute may be empty, invalid, or under
+// defined.
+message StatusDetails {
+  // The name attribute of the resource associated with the status StatusReason
+  // (when there is a single name which can be described).
+  // +optional
+  optional string name = 1;
+
+  // The group attribute of the resource associated with the status StatusReason.
+  // +optional
+  optional string group = 2;
+
+  // The kind attribute of the resource associated with the status StatusReason.
+  // On some operations may differ from the requested resource Kind.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +optional
+  optional string kind = 3;
+
+  // UID of the resource.
+  // (when there is a single resource which can be described).
+  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+  // +optional
+  optional string uid = 6;
+
+  // The Causes array includes more details associated with the StatusReason
+  // failure. Not all StatusReasons may provide detailed causes.
+  // +optional
+  // +listType=atomic
+  repeated StatusCause causes = 4;
+
+  // If specified, the time in seconds before the operation should be retried. Some errors may indicate
+  // the client must take an alternate action - for those errors this field may indicate how long to wait
+  // before taking the alternate action.
+  // +optional
+  optional int32 retryAfterSeconds = 5;
+}
+
+// TableOptions are used when a Table is requested by the caller.
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+message TableOptions {
+  // includeObject decides whether to include each object along with its columnar information.
+  // Specifying "None" will return no object, specifying "Object" will return the full object contents, and
+  // specifying "Metadata" (the default) will return the object's metadata in the PartialObjectMetadata kind
+  // in version v1beta1 of the meta.k8s.io API group.
+  optional string includeObject = 1;
+}
+
+// Time is a wrapper around time.Time which supports correct
+// marshaling to YAML and JSON.  Wrappers are provided for many
+// of the factory methods that the time package offers.
+//
+// +protobuf.options.marshal=false
+// +protobuf.as=Timestamp
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message Time {
+  // Represents seconds of UTC time since Unix epoch
+  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+  // 9999-12-31T23:59:59Z inclusive.
+  optional int64 seconds = 1;
+
+  // Non-negative fractions of a second at nanosecond resolution. Negative
+  // second values with fractions must still have non-negative nanos values
+  // that count forward in time. Must be from 0 to 999,999,999
+  // inclusive. This field may be limited in precision depending on context.
+  optional int32 nanos = 2;
+}
+
+// Timestamp is a struct that is equivalent to Time, but intended for
+// protobuf marshalling/unmarshalling. It is generated into a serialization
+// that matches Time. Do not use in Go structs.
+message Timestamp {
+  // Represents seconds of UTC time since Unix epoch
+  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+  // 9999-12-31T23:59:59Z inclusive.
+  optional int64 seconds = 1;
+
+  // Non-negative fractions of a second at nanosecond resolution. Negative
+  // second values with fractions must still have non-negative nanos values
+  // that count forward in time. Must be from 0 to 999,999,999
+  // inclusive. This field may be limited in precision depending on context.
+  optional int32 nanos = 2;
+}
+
+// TypeMeta describes an individual object in an API response or request
+// with strings representing the type of the object and its API schema version.
+// Structures that are versioned or persisted should inline TypeMeta.
+//
+// +k8s:deepcopy-gen=false
+message TypeMeta {
+  // Kind is a string value representing the REST resource this object represents.
+  // Servers may infer this from the endpoint the client submits requests to.
+  // Cannot be updated.
+  // In CamelCase.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +optional
+  optional string kind = 1;
+
+  // APIVersion defines the versioned schema of this representation of an object.
+  // Servers should convert recognized schemas to the latest internal value, and
+  // may reject unrecognized values.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+  // +optional
+  optional string apiVersion = 2;
+}
+
+// UpdateOptions may be provided when updating an API object.
+// All fields in UpdateOptions should also be present in PatchOptions.
+message UpdateOptions {
+  // When present, indicates that modifications should not be
+  // persisted. An invalid or unrecognized dryRun directive will
+  // result in an error response and no further processing of the
+  // request. Valid values are:
+  // - All: all dry run stages will be processed
+  // +optional
+  // +listType=atomic
+  repeated string dryRun = 1;
+
+  // fieldManager is a name associated with the actor or entity
+  // that is making these changes. The value must be less than or
+  // 128 characters long, and only contain printable characters,
+  // as defined by https://golang.org/pkg/unicode/#IsPrint.
+  // +optional
+  optional string fieldManager = 2;
+
+  // fieldValidation instructs the server on how to handle
+  // objects in the request (POST/PUT/PATCH) containing unknown
+  // or duplicate fields. Valid values are:
+  // - Ignore: This will ignore any unknown fields that are silently
+  // dropped from the object, and will ignore all but the last duplicate
+  // field that the decoder encounters. This is the default behavior
+  // prior to v1.23.
+  // - Warn: This will send a warning via the standard warning response
+  // header for each unknown field that is dropped from the object, and
+  // for each duplicate field that is encountered. The request will
+  // still succeed if there are no other errors, and will only persist
+  // the last of any duplicate fields. This is the default in v1.23+
+  // - Strict: This will fail the request with a BadRequest error if
+  // any unknown fields would be dropped from the object, or if any
+  // duplicate fields are present. The error returned from the server
+  // will contain all unknown and duplicate fields encountered.
+  // +optional
+  optional string fieldValidation = 3;
+}
+
+// Verbs masks the value so protobuf can generate
+//
+// +protobuf.nullable=true
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message Verbs {
+  // items, if empty, will result in an empty slice
+
+  repeated string items = 1;
+}
+
+// Event represents a single event to a watched resource.
+//
+// +protobuf=true
+// +k8s:deepcopy-gen=true
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+message WatchEvent {
+  optional string type = 1;
+
+  // Object is:
+  //  * If Type is Added or Modified: the new state of the object.
+  //  * If Type is Deleted: the state of the object immediately before deletion.
+  //  * If Type is Error: *Status is recommended; other types may make sense
+  //    depending on context.
+  optional .k8s.io.apimachinery.pkg.runtime.RawExtension object = 2;
+}
+
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/group_version.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/group_version.go
new file mode 100644
index 0000000000..fc9e521e21
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/group_version.go
@@ -0,0 +1,157 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupResource specifies a Group and a Resource, but does not force a version.  This is useful for identifying
+// concepts during lookup stages without having partially valid types
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type GroupResource struct {
+	Group    string `json:"group" protobuf:"bytes,1,opt,name=group"`
+	Resource string `json:"resource" protobuf:"bytes,2,opt,name=resource"`
+}
+
+func (gr *GroupResource) String() string {
+	if gr == nil {
+		return "<nil>"
+	}
+	if len(gr.Group) == 0 {
+		return gr.Resource
+	}
+	return gr.Resource + "." + gr.Group
+}
+
+// GroupVersionResource unambiguously identifies a resource.  It doesn't anonymously include GroupVersion
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type GroupVersionResource struct {
+	Group    string `json:"group" protobuf:"bytes,1,opt,name=group"`
+	Version  string `json:"version" protobuf:"bytes,2,opt,name=version"`
+	Resource string `json:"resource" protobuf:"bytes,3,opt,name=resource"`
+}
+
+func (gvr *GroupVersionResource) String() string {
+	if gvr == nil {
+		return "<nil>"
+	}
+	return strings.Join([]string{gvr.Group, "/", gvr.Version, ", Resource=", gvr.Resource}, "")
+}
+
+// GroupKind specifies a Group and a Kind, but does not force a version.  This is useful for identifying
+// concepts during lookup stages without having partially valid types
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type GroupKind struct {
+	Group string `json:"group" protobuf:"bytes,1,opt,name=group"`
+	Kind  string `json:"kind" protobuf:"bytes,2,opt,name=kind"`
+}
+
+func (gk *GroupKind) String() string {
+	if gk == nil {
+		return "<nil>"
+	}
+	if len(gk.Group) == 0 {
+		return gk.Kind
+	}
+	return gk.Kind + "." + gk.Group
+}
+
+// GroupVersionKind unambiguously identifies a kind.  It doesn't anonymously include GroupVersion
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type GroupVersionKind struct {
+	Group   string `json:"group" protobuf:"bytes,1,opt,name=group"`
+	Version string `json:"version" protobuf:"bytes,2,opt,name=version"`
+	Kind    string `json:"kind" protobuf:"bytes,3,opt,name=kind"`
+}
+
+func (gvk GroupVersionKind) String() string {
+	return gvk.Group + "/" + gvk.Version + ", Kind=" + gvk.Kind
+}
+
+// GroupVersion contains the "group" and the "version", which uniquely identifies the API.
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type GroupVersion struct {
+	Group   string `json:"group" protobuf:"bytes,1,opt,name=group"`
+	Version string `json:"version" protobuf:"bytes,2,opt,name=version"`
+}
+
+// Empty returns true if group and version are empty
+func (gv GroupVersion) Empty() bool {
+	return len(gv.Group) == 0 && len(gv.Version) == 0
+}
+
+// String puts "group" and "version" into a single "group/version" string. For the legacy v1
+// it returns "v1".
+func (gv GroupVersion) String() string {
+	// special case the internal apiVersion for the legacy kube types
+	if gv.Empty() {
+		return ""
+	}
+
+	// special case of "v1" for backward compatibility
+	if len(gv.Group) == 0 && gv.Version == "v1" {
+		return gv.Version
+	}
+	if len(gv.Group) > 0 {
+		return gv.Group + "/" + gv.Version
+	}
+	return gv.Version
+}
+
+// MarshalJSON implements the json.Marshaller interface.
+func (gv GroupVersion) MarshalJSON() ([]byte, error) {
+	s := gv.String()
+	if strings.Count(s, "/") > 1 {
+		return []byte{}, fmt.Errorf("illegal GroupVersion %v: contains more than one /", s)
+	}
+	return json.Marshal(s)
+}
+
+func (gv *GroupVersion) unmarshal(value []byte) error {
+	var s string
+	if err := json.Unmarshal(value, &s); err != nil {
+		return err
+	}
+	parsed, err := schema.ParseGroupVersion(s)
+	if err != nil {
+		return err
+	}
+	gv.Group, gv.Version = parsed.Group, parsed.Version
+	return nil
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+func (gv *GroupVersion) UnmarshalJSON(value []byte) error {
+	return gv.unmarshal(value)
+}
+
+// UnmarshalTEXT implements the Ugorji's encoding.TextUnmarshaler interface.
+func (gv *GroupVersion) UnmarshalText(value []byte) error {
+	return gv.unmarshal(value)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/group_version_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/group_version_test.go
new file mode 100644
index 0000000000..c50a1902ec
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/group_version_test.go
@@ -0,0 +1,78 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	gojson "encoding/json"
+	"reflect"
+	"testing"
+
+	utiljson "k8s.io/apimachinery/pkg/util/json"
+)
+
+type GroupVersionHolder struct {
+	GV GroupVersion `json:"val"`
+}
+
+func TestGroupVersionUnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  []byte
+		expect GroupVersion
+	}{
+		{[]byte(`{"val": "v1"}`), GroupVersion{"", "v1"}},
+		{[]byte(`{"val": "apps/v1"}`), GroupVersion{"apps", "v1"}},
+	}
+
+	for _, c := range cases {
+		var result GroupVersionHolder
+		// test golang lib's JSON codec
+		if err := gojson.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("JSON codec failed to unmarshal input '%v': %v", c.input, err)
+		}
+		if !reflect.DeepEqual(result.GV, c.expect) {
+			t.Errorf("JSON codec failed to unmarshal input '%s': expected %+v, got %+v", c.input, c.expect, result.GV)
+		}
+		// test the utiljson codec
+		if err := utiljson.Unmarshal(c.input, &result); err != nil {
+			t.Errorf("util/json codec failed to unmarshal input '%v': %v", c.input, err)
+		}
+		if !reflect.DeepEqual(result.GV, c.expect) {
+			t.Errorf("util/json codec failed to unmarshal input '%s': expected %+v, got %+v", c.input, c.expect, result.GV)
+		}
+	}
+}
+
+func TestGroupVersionMarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  GroupVersion
+		expect []byte
+	}{
+		{GroupVersion{"", "v1"}, []byte(`{"val":"v1"}`)},
+		{GroupVersion{"apps", "v1"}, []byte(`{"val":"apps/v1"}`)},
+	}
+
+	for _, c := range cases {
+		input := GroupVersionHolder{c.input}
+		result, err := gojson.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input '%v': %v", input, err)
+		}
+		if !reflect.DeepEqual(result, c.expect) {
+			t.Errorf("Failed to marshal input '%+v': expected: %s, got: %s", input, c.expect, result)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/helpers.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/helpers.go
new file mode 100644
index 0000000000..45ed1e9891
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/helpers.go
@@ -0,0 +1,386 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	"k8s.io/apimachinery/pkg/selection"
+	"k8s.io/apimachinery/pkg/types"
+	utiljson "k8s.io/apimachinery/pkg/util/json"
+)
+
+// LabelSelectorAsSelector converts the LabelSelector api type into a struct that implements
+// labels.Selector
+// Note: This function should be kept in sync with the selector methods in pkg/labels/selector.go
+func LabelSelectorAsSelector(ps *LabelSelector) (labels.Selector, error) {
+	if ps == nil {
+		return labels.Nothing(), nil
+	}
+	if len(ps.MatchLabels)+len(ps.MatchExpressions) == 0 {
+		return labels.Everything(), nil
+	}
+	requirements := make([]labels.Requirement, 0, len(ps.MatchLabels)+len(ps.MatchExpressions))
+	for k, v := range ps.MatchLabels {
+		r, err := labels.NewRequirement(k, selection.Equals, []string{v})
+		if err != nil {
+			return nil, err
+		}
+		requirements = append(requirements, *r)
+	}
+	for _, expr := range ps.MatchExpressions {
+		var op selection.Operator
+		switch expr.Operator {
+		case LabelSelectorOpIn:
+			op = selection.In
+		case LabelSelectorOpNotIn:
+			op = selection.NotIn
+		case LabelSelectorOpExists:
+			op = selection.Exists
+		case LabelSelectorOpDoesNotExist:
+			op = selection.DoesNotExist
+		default:
+			return nil, fmt.Errorf("%q is not a valid label selector operator", expr.Operator)
+		}
+		r, err := labels.NewRequirement(expr.Key, op, append([]string(nil), expr.Values...))
+		if err != nil {
+			return nil, err
+		}
+		requirements = append(requirements, *r)
+	}
+	selector := labels.NewSelector()
+	selector = selector.Add(requirements...)
+	return selector, nil
+}
+
+// LabelSelectorAsMap converts the LabelSelector api type into a map of strings, ie. the
+// original structure of a label selector. Operators that cannot be converted into plain
+// labels (Exists, DoesNotExist, NotIn, and In with more than one value) will result in
+// an error.
+func LabelSelectorAsMap(ps *LabelSelector) (map[string]string, error) {
+	if ps == nil {
+		return nil, nil
+	}
+	selector := map[string]string{}
+	for k, v := range ps.MatchLabels {
+		selector[k] = v
+	}
+	for _, expr := range ps.MatchExpressions {
+		switch expr.Operator {
+		case LabelSelectorOpIn:
+			if len(expr.Values) != 1 {
+				return selector, fmt.Errorf("operator %q without a single value cannot be converted into the old label selector format", expr.Operator)
+			}
+			// Should we do anything in case this will override a previous key-value pair?
+			selector[expr.Key] = expr.Values[0]
+		case LabelSelectorOpNotIn, LabelSelectorOpExists, LabelSelectorOpDoesNotExist:
+			return selector, fmt.Errorf("operator %q cannot be converted into the old label selector format", expr.Operator)
+		default:
+			return selector, fmt.Errorf("%q is not a valid selector operator", expr.Operator)
+		}
+	}
+	return selector, nil
+}
+
+// ParseToLabelSelector parses a string representing a selector into a LabelSelector object.
+// Note: This function should be kept in sync with the parser in pkg/labels/selector.go
+func ParseToLabelSelector(selector string) (*LabelSelector, error) {
+	reqs, err := labels.ParseToRequirements(selector)
+	if err != nil {
+		return nil, fmt.Errorf("couldn't parse the selector string \"%s\": %v", selector, err)
+	}
+
+	labelSelector := &LabelSelector{
+		MatchLabels:      map[string]string{},
+		MatchExpressions: []LabelSelectorRequirement{},
+	}
+	for _, req := range reqs {
+		var op LabelSelectorOperator
+		switch req.Operator() {
+		case selection.Equals, selection.DoubleEquals:
+			vals := req.Values()
+			if vals.Len() != 1 {
+				return nil, fmt.Errorf("equals operator must have exactly one value")
+			}
+			val, ok := vals.PopAny()
+			if !ok {
+				return nil, fmt.Errorf("equals operator has exactly one value but it cannot be retrieved")
+			}
+			labelSelector.MatchLabels[req.Key()] = val
+			continue
+		case selection.In:
+			op = LabelSelectorOpIn
+		case selection.NotIn:
+			op = LabelSelectorOpNotIn
+		case selection.Exists:
+			op = LabelSelectorOpExists
+		case selection.DoesNotExist:
+			op = LabelSelectorOpDoesNotExist
+		case selection.GreaterThan, selection.LessThan:
+			// Adding a separate case for these operators to indicate that this is deliberate
+			return nil, fmt.Errorf("%q isn't supported in label selectors", req.Operator())
+		default:
+			return nil, fmt.Errorf("%q is not a valid label selector operator", req.Operator())
+		}
+		labelSelector.MatchExpressions = append(labelSelector.MatchExpressions, LabelSelectorRequirement{
+			Key:      req.Key(),
+			Operator: op,
+			Values:   req.Values().List(),
+		})
+	}
+	return labelSelector, nil
+}
+
+// SetAsLabelSelector converts the labels.Set object into a LabelSelector api object.
+func SetAsLabelSelector(ls labels.Set) *LabelSelector {
+	if ls == nil {
+		return nil
+	}
+
+	selector := &LabelSelector{
+		MatchLabels: make(map[string]string, len(ls)),
+	}
+	for label, value := range ls {
+		selector.MatchLabels[label] = value
+	}
+
+	return selector
+}
+
+// FormatLabelSelector convert labelSelector into plain string
+func FormatLabelSelector(labelSelector *LabelSelector) string {
+	selector, err := LabelSelectorAsSelector(labelSelector)
+	if err != nil {
+		return "<error>"
+	}
+
+	l := selector.String()
+	if len(l) == 0 {
+		l = "<none>"
+	}
+	return l
+}
+
+func ExtractGroupVersions(l *APIGroupList) []string {
+	var groupVersions []string
+	for _, g := range l.Groups {
+		for _, gv := range g.Versions {
+			groupVersions = append(groupVersions, gv.GroupVersion)
+		}
+	}
+	return groupVersions
+}
+
+// HasAnnotation returns a bool if passed in annotation exists
+func HasAnnotation(obj ObjectMeta, ann string) bool {
+	_, found := obj.Annotations[ann]
+	return found
+}
+
+// SetMetaDataAnnotation sets the annotation and value
+func SetMetaDataAnnotation(obj *ObjectMeta, ann string, value string) {
+	if obj.Annotations == nil {
+		obj.Annotations = make(map[string]string)
+	}
+	obj.Annotations[ann] = value
+}
+
+// HasLabel returns a bool if passed in label exists
+func HasLabel(obj ObjectMeta, label string) bool {
+	_, found := obj.Labels[label]
+	return found
+}
+
+// SetMetaDataLabel sets the label and value
+func SetMetaDataLabel(obj *ObjectMeta, label string, value string) {
+	if obj.Labels == nil {
+		obj.Labels = make(map[string]string)
+	}
+	obj.Labels[label] = value
+}
+
+// SingleObject returns a ListOptions for watching a single object.
+func SingleObject(meta ObjectMeta) ListOptions {
+	return ListOptions{
+		FieldSelector:   fields.OneTermEqualSelector("metadata.name", meta.Name).String(),
+		ResourceVersion: meta.ResourceVersion,
+	}
+}
+
+// NewDeleteOptions returns a DeleteOptions indicating the resource should
+// be deleted within the specified grace period. Use zero to indicate
+// immediate deletion. If you would prefer to use the default grace period,
+// use &metav1.DeleteOptions{} directly.
+func NewDeleteOptions(grace int64) *DeleteOptions {
+	return &DeleteOptions{GracePeriodSeconds: &grace}
+}
+
+// NewPreconditionDeleteOptions returns a DeleteOptions with a UID precondition set.
+func NewPreconditionDeleteOptions(uid string) *DeleteOptions {
+	u := types.UID(uid)
+	p := Preconditions{UID: &u}
+	return &DeleteOptions{Preconditions: &p}
+}
+
+// NewUIDPreconditions returns a Preconditions with UID set.
+func NewUIDPreconditions(uid string) *Preconditions {
+	u := types.UID(uid)
+	return &Preconditions{UID: &u}
+}
+
+// NewRVDeletionPrecondition returns a DeleteOptions with a ResourceVersion precondition set.
+func NewRVDeletionPrecondition(rv string) *DeleteOptions {
+	p := Preconditions{ResourceVersion: &rv}
+	return &DeleteOptions{Preconditions: &p}
+}
+
+// HasObjectMetaSystemFieldValues returns true if fields that are managed by the system on ObjectMeta have values.
+func HasObjectMetaSystemFieldValues(meta Object) bool {
+	return !meta.GetCreationTimestamp().Time.IsZero() ||
+		len(meta.GetUID()) != 0
+}
+
+// ResetObjectMetaForStatus forces the meta fields for a status update to match the meta fields
+// for a pre-existing object. This is opt-in for new objects with Status subresource.
+func ResetObjectMetaForStatus(meta, existingMeta Object) {
+	meta.SetDeletionTimestamp(existingMeta.GetDeletionTimestamp())
+	meta.SetGeneration(existingMeta.GetGeneration())
+	meta.SetSelfLink(existingMeta.GetSelfLink())
+	meta.SetLabels(existingMeta.GetLabels())
+	meta.SetAnnotations(existingMeta.GetAnnotations())
+	meta.SetFinalizers(existingMeta.GetFinalizers())
+	meta.SetOwnerReferences(existingMeta.GetOwnerReferences())
+	// managedFields must be preserved since it's been modified to
+	// track changed fields in the status update.
+	//meta.SetManagedFields(existingMeta.GetManagedFields())
+}
+
+// MarshalJSON implements json.Marshaler
+// MarshalJSON may get called on pointers or values, so implement MarshalJSON on value.
+// http://stackoverflow.com/questions/21390979/custom-marshaljson-never-gets-called-in-go
+func (f FieldsV1) MarshalJSON() ([]byte, error) {
+	raw := f.GetRawBytes()
+	if len(raw) == 0 {
+		return []byte("null"), nil
+	}
+	if f.getContentType() == fieldsV1InvalidOrValidCBORObject {
+		var u map[string]interface{}
+		if err := cbor.Unmarshal(raw, &u); err != nil {
+			return nil, fmt.Errorf("metav1.FieldsV1 cbor invalid: %w", err)
+		}
+		return utiljson.Marshal(u)
+	}
+	return raw, nil
+}
+
+// UnmarshalJSON implements json.Unmarshaler
+func (f *FieldsV1) UnmarshalJSON(b []byte) error {
+	if f == nil {
+		return errors.New("metav1.FieldsV1: UnmarshalJSON on nil pointer")
+	}
+	if !bytes.Equal(b, []byte("null")) {
+		f.SetRawBytes(b)
+	}
+	return nil
+}
+
+var _ json.Marshaler = FieldsV1{}
+var _ json.Unmarshaler = &FieldsV1{}
+
+func (f FieldsV1) MarshalCBOR() ([]byte, error) {
+	raw := f.GetRawBytes()
+	if len(raw) == 0 {
+		return cbor.Marshal(nil)
+	}
+	if f.getContentType() == fieldsV1InvalidOrValidJSONObject {
+		var u map[string]interface{}
+		if err := utiljson.Unmarshal(raw, &u); err != nil {
+			return nil, fmt.Errorf("metav1.FieldsV1 json invalid: %w", err)
+		}
+		return cbor.Marshal(u)
+	}
+	return raw, nil
+}
+
+var cborNull = []byte{0xf6}
+
+func (f *FieldsV1) UnmarshalCBOR(b []byte) error {
+	if f == nil {
+		return errors.New("metav1.FieldsV1: UnmarshalCBOR on nil pointer")
+	}
+	if !bytes.Equal(b, cborNull) {
+		f.SetRawBytes(b)
+	}
+	return nil
+}
+
+const (
+	// fieldsV1InvalidOrEmpty indicates that a FieldsV1 either contains no raw bytes or its raw
+	// bytes don't represent an allowable value in any supported encoding.
+	fieldsV1InvalidOrEmpty = iota
+
+	// fieldsV1InvalidOrValidJSONObject indicates that a FieldV1 either contains raw bytes that
+	// are a valid JSON encoding of an allowable value or don't represent an allowable value in
+	// any supported encoding.
+	fieldsV1InvalidOrValidJSONObject
+
+	// fieldsV1InvalidOrValidCBORObject indicates that a FieldV1 either contains raw bytes that
+	// are a valid CBOR encoding of an allowable value or don't represent an allowable value in
+	// any supported encoding.
+	fieldsV1InvalidOrValidCBORObject
+)
+
+// getContentType returns one of fieldsV1InvalidOrEmpty, fieldsV1InvalidOrValidJSONObject,
+// fieldsV1InvalidOrValidCBORObject based on the value of Raw.
+//
+// Raw can be encoded in JSON or CBOR and is only valid if it is empty, null, or an object (map)
+// value. It is invalid if it contains a JSON string, number, boolean, or array. If Raw is nonempty
+// and represents an allowable value, then the initial byte unambiguously distinguishes a
+// JSON-encoded value from a CBOR-encoded value.
+//
+// A valid JSON-encoded value can begin with any of the four JSON whitespace characters, the first
+// character 'n' of null, or '{' (0x09, 0x0a, 0x0d, 0x20, 0x6e, or 0x7b, respectively). A valid
+// CBOR-encoded value can begin with the null simple value, an initial byte with major type "map",
+// or, if a tag-enclosed map, an initial byte with major type "tag" (0xf6, 0xa0...0xbf, or
+// 0xc6...0xdb). The two sets of valid initial bytes don't intersect.
+func (f FieldsV1) getContentType() int {
+	reader := f.GetRawReader()
+	if reader.Size() > 0 {
+		var buf [1]byte
+		if _, err := reader.Read(buf[:]); err != nil {
+			return fieldsV1InvalidOrEmpty
+		}
+		p := buf[0]
+		switch p {
+		case 'n', '{', '\t', '\r', '\n', ' ':
+			return fieldsV1InvalidOrValidJSONObject
+		case 0xf6: // null
+			return fieldsV1InvalidOrValidCBORObject
+		default:
+			if p >= 0xa0 && p <= 0xbf /* map */ || p >= 0xc6 && p <= 0xdb /* tag */ {
+				return fieldsV1InvalidOrValidCBORObject
+			}
+		}
+	}
+	return fieldsV1InvalidOrEmpty
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/helpers_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/helpers_test.go
new file mode 100644
index 0000000000..b529d9b0b1
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/helpers_test.go
@@ -0,0 +1,483 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/randfill"
+)
+
+func TestLabelSelectorAsSelector(t *testing.T) {
+	matchLabels := map[string]string{"foo": "bar"}
+	matchExpressions := []LabelSelectorRequirement{{
+		Key:      "baz",
+		Operator: LabelSelectorOpIn,
+		Values:   []string{"qux", "norf"},
+	}}
+	mustParse := func(s string) labels.Selector {
+		out, e := labels.Parse(s)
+		if e != nil {
+			panic(e)
+		}
+		return out
+	}
+	tc := []struct {
+		in        *LabelSelector
+		out       labels.Selector
+		expectErr bool
+	}{
+		{in: nil, out: labels.Nothing()},
+		{in: &LabelSelector{}, out: labels.Everything()},
+		{
+			in:  &LabelSelector{MatchLabels: matchLabels},
+			out: mustParse("foo=bar"),
+		},
+		{
+			in:  &LabelSelector{MatchExpressions: matchExpressions},
+			out: mustParse("baz in (norf,qux)"),
+		},
+		{
+			in:  &LabelSelector{MatchLabels: matchLabels, MatchExpressions: matchExpressions},
+			out: mustParse("baz in (norf,qux),foo=bar"),
+		},
+		{
+			in: &LabelSelector{
+				MatchExpressions: []LabelSelectorRequirement{{
+					Key:      "baz",
+					Operator: LabelSelectorOpExists,
+					Values:   []string{"qux", "norf"},
+				}},
+			},
+			expectErr: true,
+		},
+	}
+
+	for i, tc := range tc {
+		inCopy := tc.in.DeepCopy()
+		out, err := LabelSelectorAsSelector(tc.in)
+		// after calling LabelSelectorAsSelector, tc.in shouldn't be modified
+		if !reflect.DeepEqual(inCopy, tc.in) {
+			t.Errorf("[%v]expected:\n\t%#v\nbut got:\n\t%#v", i, inCopy, tc.in)
+		}
+		if err == nil && tc.expectErr {
+			t.Errorf("[%v]expected error but got none.", i)
+		}
+		if err != nil && !tc.expectErr {
+			t.Errorf("[%v]did not expect error but got: %v", i, err)
+		}
+		// fmt.Sprint() over String() as nil.String() will panic
+		if fmt.Sprint(out) != fmt.Sprint(tc.out) {
+			t.Errorf("[%v]expected:\n\t%s\nbut got:\n\t%s", i, fmt.Sprint(tc.out), fmt.Sprint(out))
+		}
+	}
+}
+
+func BenchmarkLabelSelectorAsSelector(b *testing.B) {
+	selector := &LabelSelector{
+		MatchLabels: map[string]string{
+			"foo": "foo",
+			"bar": "bar",
+		},
+		MatchExpressions: []LabelSelectorRequirement{{
+			Key:      "baz",
+			Operator: LabelSelectorOpExists,
+		}},
+	}
+	b.StartTimer()
+	for i := 0; i < b.N; i++ {
+		_, err := LabelSelectorAsSelector(selector)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func TestLabelSelectorAsMap(t *testing.T) {
+	matchLabels := map[string]string{"foo": "bar"}
+	matchExpressions := func(operator LabelSelectorOperator, values []string) []LabelSelectorRequirement {
+		return []LabelSelectorRequirement{{
+			Key:      "baz",
+			Operator: operator,
+			Values:   values,
+		}}
+	}
+
+	tests := []struct {
+		in        *LabelSelector
+		out       map[string]string
+		errString string
+	}{
+		{in: nil, out: nil},
+		{
+			in:  &LabelSelector{MatchLabels: matchLabels},
+			out: map[string]string{"foo": "bar"},
+		},
+		{
+			in:  &LabelSelector{MatchLabels: matchLabels, MatchExpressions: matchExpressions(LabelSelectorOpIn, []string{"norf"})},
+			out: map[string]string{"foo": "bar", "baz": "norf"},
+		},
+		{
+			in:  &LabelSelector{MatchExpressions: matchExpressions(LabelSelectorOpIn, []string{"norf"})},
+			out: map[string]string{"baz": "norf"},
+		},
+		{
+			in:        &LabelSelector{MatchLabels: matchLabels, MatchExpressions: matchExpressions(LabelSelectorOpIn, []string{"norf", "qux"})},
+			out:       map[string]string{"foo": "bar"},
+			errString: "without a single value cannot be converted",
+		},
+		{
+			in:        &LabelSelector{MatchExpressions: matchExpressions(LabelSelectorOpNotIn, []string{"norf", "qux"})},
+			out:       map[string]string{},
+			errString: "cannot be converted",
+		},
+		{
+			in:        &LabelSelector{MatchLabels: matchLabels, MatchExpressions: matchExpressions(LabelSelectorOpExists, []string{})},
+			out:       map[string]string{"foo": "bar"},
+			errString: "cannot be converted",
+		},
+		{
+			in:        &LabelSelector{MatchExpressions: matchExpressions(LabelSelectorOpDoesNotExist, []string{})},
+			out:       map[string]string{},
+			errString: "cannot be converted",
+		},
+	}
+
+	for i, tc := range tests {
+		out, err := LabelSelectorAsMap(tc.in)
+		if err == nil && len(tc.errString) > 0 {
+			t.Errorf("[%v]expected error but got none.", i)
+			continue
+		}
+		if err != nil && len(tc.errString) == 0 {
+			t.Errorf("[%v]did not expect error but got: %v", i, err)
+			continue
+		}
+		if err != nil && len(tc.errString) > 0 && !strings.Contains(err.Error(), tc.errString) {
+			t.Errorf("[%v]expected error with %q but got: %v", i, tc.errString, err)
+			continue
+		}
+		if !reflect.DeepEqual(out, tc.out) {
+			t.Errorf("[%v]expected:\n\t%+v\nbut got:\n\t%+v", i, tc.out, out)
+		}
+	}
+}
+
+func TestResetObjectMetaForStatus(t *testing.T) {
+	meta := &ObjectMeta{}
+	existingMeta := &ObjectMeta{}
+
+	// fuzz the existingMeta to set every field, no nils
+	f := randfill.New().NilChance(0).NumElements(1, 1).MaxDepth(10)
+	f.Fill(existingMeta)
+	ResetObjectMetaForStatus(meta, existingMeta)
+
+	// not all fields are stomped during the reset.  These fields should not have been set. False
+	// set them all to their zero values.  Before you add anything to this list, consider whether or not
+	// you're enforcing immutability (those are fine) and whether /status should be able to update
+	// these values (these are usually not fine).
+
+	// generateName doesn't do anything after create
+	existingMeta.SetGenerateName("")
+	// resourceVersion is enforced in validation and used during the storage update
+	existingMeta.SetResourceVersion("")
+	// fields made immutable in validation
+	existingMeta.SetUID(types.UID(""))
+	existingMeta.SetName("")
+	existingMeta.SetNamespace("")
+	existingMeta.SetCreationTimestamp(Time{})
+	existingMeta.SetDeletionTimestamp(nil)
+	existingMeta.SetDeletionGracePeriodSeconds(nil)
+	existingMeta.SetManagedFields(nil)
+
+	if !reflect.DeepEqual(meta, existingMeta) {
+		t.Error(cmp.Diff(meta, existingMeta))
+	}
+}
+
+func TestSetMetaDataLabel(t *testing.T) {
+	tests := []struct {
+		obj   *ObjectMeta
+		label string
+		value string
+		want  map[string]string
+	}{
+		{
+			obj:   &ObjectMeta{},
+			label: "foo",
+			value: "bar",
+			want:  map[string]string{"foo": "bar"},
+		},
+		{
+			obj:   &ObjectMeta{Labels: map[string]string{"foo": "bar"}},
+			label: "foo",
+			value: "baz",
+			want:  map[string]string{"foo": "baz"},
+		},
+		{
+			obj:   &ObjectMeta{Labels: map[string]string{"foo": "bar"}},
+			label: "version",
+			value: "1.0.0",
+			want:  map[string]string{"foo": "bar", "version": "1.0.0"},
+		},
+	}
+
+	for _, tc := range tests {
+		SetMetaDataLabel(tc.obj, tc.label, tc.value)
+		if !reflect.DeepEqual(tc.obj.Labels, tc.want) {
+			t.Errorf("got %v, want %v", tc.obj.Labels, tc.want)
+		}
+	}
+}
+
+func TestFieldsV1MarshalJSON(t *testing.T) {
+	for _, tc := range []struct {
+		Name     string
+		FieldsV1 FieldsV1
+		Want     []byte
+		Error    string
+	}{
+		{
+			Name:     "zero-value encodes as json null",
+			FieldsV1: FieldsV1{},
+			Want:     []byte(`null`),
+		},
+		{
+			Name:     "cbor null is transcoded to json null",
+			FieldsV1: *NewFieldsV1(string([]byte{0xf6})), // null
+			Want:     []byte(`null`),
+		},
+		{
+			Name:     "valid non-map cbor and valid non-object json is returned as-is",
+			FieldsV1: *NewFieldsV1(string([]byte{0x30})),
+			Want:     []byte{0x30}, // Valid CBOR encoding of -17 and JSON encoding of 0!
+		},
+		{
+			Name:     "self-described cbor map is transcoded to json map",
+			FieldsV1: *NewFieldsV1(string([]byte{0xd9, 0xd9, 0xf7, 0xa1, 0x43, 'f', 'o', 'o', 0x43, 'b', 'a', 'r'})), // 55799({"foo":"bar"})
+			Want:     []byte(`{"foo":"bar"}`),
+		},
+		{
+			Name:     "json object is returned as-is",
+			FieldsV1: *NewFieldsV1(" \t\r\n{\"foo\":\"bar\"}"),
+			Want:     []byte(" \t\r\n{\"foo\":\"bar\"}"),
+		},
+		{
+			Name:     "invalid json is returned as-is",
+			FieldsV1: *NewFieldsV1(`{{`),
+			Want:     []byte(`{{`),
+		},
+		{
+			Name:     "invalid cbor fails to transcode to json",
+			FieldsV1: *NewFieldsV1(string([]byte{0xa1})),
+			Error:    "metav1.FieldsV1 cbor invalid: unexpected EOF",
+		},
+	} {
+		t.Run(tc.Name, func(t *testing.T) {
+			got, err := tc.FieldsV1.MarshalJSON()
+			if err != nil {
+				if tc.Error == "" {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				if msg := err.Error(); msg != tc.Error {
+					t.Fatalf("expected error %q, got %q", tc.Error, msg)
+				}
+			} else if tc.Error != "" {
+				t.Fatalf("expected error %q, got nil", tc.Error)
+			}
+			if diff := cmp.Diff(tc.Want, got); diff != "" {
+				t.Errorf("unexpected diff:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestFieldsV1MarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		Name     string
+		FieldsV1 FieldsV1
+		Want     []byte
+		Error    string
+	}{
+		{
+			Name:     "nil encodes as cbor null",
+			FieldsV1: FieldsV1{},
+			Want:     []byte{0xf6}, // null
+		},
+		{
+			Name:     "json null is transcoded to cbor null",
+			FieldsV1: *NewFieldsV1(string(`null`)),
+			Want:     []byte{0xf6}, // null
+		},
+		{
+			Name:     "valid non-map cbor and valid non-object json is returned as-is",
+			FieldsV1: *NewFieldsV1(string([]byte{0x30})),
+			Want:     []byte{0x30}, // Valid CBOR encoding of -17 and JSON encoding of 0!
+		},
+		{
+			Name:     "json object is transcoded to cbor map",
+			FieldsV1: *NewFieldsV1(" \t\r\n{\"foo\":\"bar\"}"),
+			Want:     []byte{0xa1, 0x43, 'f', 'o', 'o', 0x43, 'b', 'a', 'r'},
+		},
+		{
+			Name:     "self-described cbor map is returned as-is",
+			FieldsV1: *NewFieldsV1(string([]byte{0xd9, 0xd9, 0xf7, 0xa1, 0x43, 'f', 'o', 'o', 0x43, 'b', 'a', 'r'})), // 55799({"foo":"bar"})
+			Want:     []byte{0xd9, 0xd9, 0xf7, 0xa1, 0x43, 'f', 'o', 'o', 0x43, 'b', 'a', 'r'},                       // 55799({"foo":"bar"})
+		},
+		{
+			Name:     "invalid json fails to transcode to cbor",
+			FieldsV1: *NewFieldsV1(`{{`),
+			Error:    "metav1.FieldsV1 json invalid: invalid character '{' looking for beginning of object key string",
+		},
+		{
+			Name:     "invalid cbor is returned as-is",
+			FieldsV1: *NewFieldsV1(string([]byte{0xa1})),
+			Want:     []byte{0xa1},
+		},
+	} {
+		t.Run(tc.Name, func(t *testing.T) {
+			got, err := tc.FieldsV1.MarshalCBOR()
+			if err != nil {
+				if tc.Error == "" {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				if msg := err.Error(); msg != tc.Error {
+					t.Fatalf("expected error %q, got %q", tc.Error, msg)
+				}
+			} else if tc.Error != "" {
+				t.Fatalf("expected error %q, got nil", tc.Error)
+			}
+
+			if diff := cmp.Diff(tc.Want, got); diff != "" {
+				t.Errorf("unexpected diff:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestFieldsV1UnmarshalJSON(t *testing.T) {
+	for _, tc := range []struct {
+		Name  string
+		JSON  []byte
+		Into  *FieldsV1
+		Want  *FieldsV1
+		Error string
+	}{
+		{
+			Name:  "nil receiver returns error",
+			Into:  nil,
+			Error: "metav1.FieldsV1: UnmarshalJSON on nil pointer",
+		},
+		{
+			Name: "json null does not modify receiver", // conventional for json.Unmarshaler
+			JSON: []byte(`null`),
+			Into: NewFieldsV1(`unmodified`),
+			Want: NewFieldsV1(`unmodified`),
+		},
+		{
+			Name: "valid input is copied verbatim",
+			JSON: []byte("{\"foo\":\"bar\"} \t\r\n"),
+			Into: &FieldsV1{},
+			Want: NewFieldsV1("{\"foo\":\"bar\"} \t\r\n"),
+		},
+		{
+			Name: "invalid input is copied verbatim",
+			JSON: []byte("{{"),
+			Into: &FieldsV1{},
+			Want: NewFieldsV1("{{"),
+		},
+	} {
+		t.Run(tc.Name, func(t *testing.T) {
+			got := tc.Into.DeepCopy()
+			err := got.UnmarshalJSON(tc.JSON)
+			if err != nil {
+				if tc.Error == "" {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				if msg := err.Error(); msg != tc.Error {
+					t.Fatalf("expected error %q, got %q", tc.Error, msg)
+				}
+			} else if tc.Error != "" {
+				t.Fatalf("expected error %q, got nil", tc.Error)
+			}
+
+			if diff := cmp.Diff(tc.Want, got); diff != "" {
+				t.Errorf("unexpected diff:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestFieldsV1UnmarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		Name  string
+		CBOR  []byte
+		Into  *FieldsV1
+		Want  *FieldsV1
+		Error string
+	}{
+		{
+			Name:  "nil receiver returns error",
+			Into:  nil,
+			Want:  nil,
+			Error: "metav1.FieldsV1: UnmarshalCBOR on nil pointer",
+		},
+		{
+			Name: "cbor null does not modify receiver",
+			CBOR: []byte{0xf6},
+			Into: NewFieldsV1(`unmodified`),
+			Want: NewFieldsV1(`unmodified`),
+		},
+		{
+			Name: "valid input is copied verbatim",
+			CBOR: []byte{0xa1, 0x43, 'f', 'o', 'o', 0x43, 'b', 'a', 'r'},
+			Into: &FieldsV1{},
+			Want: NewFieldsV1(string([]byte{0xa1, 0x43, 'f', 'o', 'o', 0x43, 'b', 'a', 'r'})),
+		},
+		{
+			Name: "invalid input is copied verbatim",
+			CBOR: []byte{0xff}, // UnmarshalCBOR should never be called with malformed input, testing anyway.
+			Into: &FieldsV1{},
+			Want: NewFieldsV1(string([]byte{0xff})),
+		},
+	} {
+		t.Run(tc.Name, func(t *testing.T) {
+			got := tc.Into.DeepCopy()
+			err := got.UnmarshalCBOR(tc.CBOR)
+			if err != nil {
+				if tc.Error == "" {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				if msg := err.Error(); msg != tc.Error {
+					t.Fatalf("expected error %q, got %q", tc.Error, msg)
+				}
+			} else if tc.Error != "" {
+				t.Fatalf("expected error %q, got nil", tc.Error)
+			}
+
+			if diff := cmp.Diff(tc.Want, got); diff != "" {
+				t.Errorf("unexpected diff:\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/labels.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/labels.go
new file mode 100644
index 0000000000..9b45145da6
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/labels.go
@@ -0,0 +1,55 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+// Clones the given selector and returns a new selector with the given key and value added.
+// Returns the given selector, if labelKey is empty.
+func CloneSelectorAndAddLabel(selector *LabelSelector, labelKey, labelValue string) *LabelSelector {
+	if labelKey == "" {
+		// Don't need to add a label.
+		return selector
+	}
+
+	// Clone.
+	newSelector := selector.DeepCopy()
+
+	if newSelector.MatchLabels == nil {
+		newSelector.MatchLabels = make(map[string]string)
+	}
+
+	newSelector.MatchLabels[labelKey] = labelValue
+
+	return newSelector
+}
+
+// AddLabelToSelector returns a selector with the given key and value added to the given selector's MatchLabels.
+func AddLabelToSelector(selector *LabelSelector, labelKey, labelValue string) *LabelSelector {
+	if labelKey == "" {
+		// Don't need to add a label.
+		return selector
+	}
+	if selector.MatchLabels == nil {
+		selector.MatchLabels = make(map[string]string)
+	}
+	selector.MatchLabels[labelKey] = labelValue
+	return selector
+}
+
+// SelectorHasLabel checks if the given selector contains the given label key in its MatchLabels
+func SelectorHasLabel(selector *LabelSelector, labelKey string) bool {
+	return len(selector.MatchLabels[labelKey]) > 0
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/labels_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/labels_test.go
new file mode 100644
index 0000000000..918b1a294c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/labels_test.go
@@ -0,0 +1,123 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestCloneSelectorAndAddLabel(t *testing.T) {
+	labels := map[string]string{
+		"foo1": "bar1",
+		"foo2": "bar2",
+		"foo3": "bar3",
+	}
+	matchExpressions := []LabelSelectorRequirement{
+		{Key: "foo", Operator: LabelSelectorOpIn, Values: []string{"foo"}},
+	}
+
+	cases := []struct {
+		labels     map[string]string
+		labelKey   string
+		labelValue string
+		want       map[string]string
+	}{
+		{
+			labels: labels,
+			want:   labels,
+		},
+		{
+			labels:     labels,
+			labelKey:   "foo4",
+			labelValue: "89",
+			want: map[string]string{
+				"foo1": "bar1",
+				"foo2": "bar2",
+				"foo3": "bar3",
+				"foo4": "89",
+			},
+		},
+		{
+			labels:     nil,
+			labelKey:   "foo4",
+			labelValue: "12",
+			want: map[string]string{
+				"foo4": "12",
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		ls_in := LabelSelector{MatchLabels: tc.labels, MatchExpressions: matchExpressions}
+		ls_out := LabelSelector{MatchLabels: tc.want, MatchExpressions: matchExpressions}
+
+		got := CloneSelectorAndAddLabel(&ls_in, tc.labelKey, tc.labelValue)
+		if !reflect.DeepEqual(got, &ls_out) {
+			t.Errorf("got %v, want %v", got, tc.want)
+		}
+	}
+}
+
+func TestAddLabelToSelector(t *testing.T) {
+	labels := map[string]string{
+		"foo1": "bar1",
+		"foo2": "bar2",
+		"foo3": "bar3",
+	}
+
+	cases := []struct {
+		labels     map[string]string
+		labelKey   string
+		labelValue string
+		want       map[string]string
+	}{
+		{
+			labels: labels,
+			want:   labels,
+		},
+		{
+			labels:     labels,
+			labelKey:   "foo4",
+			labelValue: "89",
+			want: map[string]string{
+				"foo1": "bar1",
+				"foo2": "bar2",
+				"foo3": "bar3",
+				"foo4": "89",
+			},
+		},
+		{
+			labels:     nil,
+			labelKey:   "foo4",
+			labelValue: "12",
+			want: map[string]string{
+				"foo4": "12",
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		ls_in := LabelSelector{MatchLabels: tc.labels}
+		ls_out := LabelSelector{MatchLabels: tc.want}
+
+		got := AddLabelToSelector(&ls_in, tc.labelKey, tc.labelValue)
+		if !reflect.DeepEqual(got, &ls_out) {
+			t.Errorf("got %v, want %v", got, tc.want)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/meta.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/meta.go
new file mode 100644
index 0000000000..6ae1b095fc
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/meta.go
@@ -0,0 +1,185 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// TODO: move this, Object, List, and Type to a different package
+type ObjectMetaAccessor interface {
+	GetObjectMeta() Object
+}
+
+// Object lets you work with object metadata from any of the versioned or
+// internal API objects. Attempting to set or retrieve a field on an object that does
+// not support that field (Name, UID, Namespace on lists) will be a no-op and return
+// a default value.
+type Object interface {
+	GetNamespace() string
+	SetNamespace(namespace string)
+	GetName() string
+	SetName(name string)
+	GetGenerateName() string
+	SetGenerateName(name string)
+	GetUID() types.UID
+	SetUID(uid types.UID)
+	GetResourceVersion() string
+	SetResourceVersion(version string)
+	GetGeneration() int64
+	SetGeneration(generation int64)
+	GetSelfLink() string
+	SetSelfLink(selfLink string)
+	GetCreationTimestamp() Time
+	SetCreationTimestamp(timestamp Time)
+	GetDeletionTimestamp() *Time
+	SetDeletionTimestamp(timestamp *Time)
+	GetDeletionGracePeriodSeconds() *int64
+	SetDeletionGracePeriodSeconds(*int64)
+	GetLabels() map[string]string
+	SetLabels(labels map[string]string)
+	GetAnnotations() map[string]string
+	SetAnnotations(annotations map[string]string)
+	GetFinalizers() []string
+	SetFinalizers(finalizers []string)
+	GetOwnerReferences() []OwnerReference
+	SetOwnerReferences([]OwnerReference)
+	GetManagedFields() []ManagedFieldsEntry
+	SetManagedFields(managedFields []ManagedFieldsEntry)
+}
+
+// ListMetaAccessor retrieves the list interface from an object
+type ListMetaAccessor interface {
+	GetListMeta() ListInterface
+}
+
+// Common lets you work with core metadata from any of the versioned or
+// internal API objects. Attempting to set or retrieve a field on an object that does
+// not support that field will be a no-op and return a default value.
+// TODO: move this, and TypeMeta and ListMeta, to a different package
+type Common interface {
+	GetResourceVersion() string
+	SetResourceVersion(version string)
+	GetSelfLink() string
+	SetSelfLink(selfLink string)
+}
+
+// ListInterface lets you work with list metadata from any of the versioned or
+// internal API objects. Attempting to set or retrieve a field on an object that does
+// not support that field will be a no-op and return a default value.
+// TODO: move this, and TypeMeta and ListMeta, to a different package
+type ListInterface interface {
+	GetResourceVersion() string
+	SetResourceVersion(version string)
+	GetSelfLink() string
+	SetSelfLink(selfLink string)
+	GetContinue() string
+	SetContinue(c string)
+	GetRemainingItemCount() *int64
+	SetRemainingItemCount(c *int64)
+}
+
+// ShardedListInterface can be implemented by list types to indicate that they
+// represent a sharded subset of the full collection rather than the complete list.
+type ShardedListInterface interface {
+	GetShardInfo() *ShardInfo
+	SetShardInfo(*ShardInfo)
+}
+
+// Type exposes the type and APIVersion of versioned or internal API objects.
+// TODO: move this, and TypeMeta and ListMeta, to a different package
+type Type interface {
+	GetAPIVersion() string
+	SetAPIVersion(version string)
+	GetKind() string
+	SetKind(kind string)
+}
+
+var _ ListInterface = &ListMeta{}
+
+func (meta *ListMeta) GetResourceVersion() string        { return meta.ResourceVersion }
+func (meta *ListMeta) SetResourceVersion(version string) { meta.ResourceVersion = version }
+func (meta *ListMeta) GetSelfLink() string               { return meta.SelfLink }
+func (meta *ListMeta) SetSelfLink(selfLink string)       { meta.SelfLink = selfLink }
+func (meta *ListMeta) GetContinue() string               { return meta.Continue }
+func (meta *ListMeta) SetContinue(c string)              { meta.Continue = c }
+func (meta *ListMeta) GetRemainingItemCount() *int64     { return meta.RemainingItemCount }
+func (meta *ListMeta) SetRemainingItemCount(c *int64)    { meta.RemainingItemCount = c }
+func (meta *ListMeta) GetShardInfo() *ShardInfo          { return meta.ShardInfo }
+func (meta *ListMeta) SetShardInfo(s *ShardInfo)         { meta.ShardInfo = s }
+
+func (obj *TypeMeta) GetObjectKind() schema.ObjectKind { return obj }
+
+// SetGroupVersionKind satisfies the ObjectKind interface for all objects that embed TypeMeta
+func (obj *TypeMeta) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	obj.APIVersion, obj.Kind = gvk.ToAPIVersionAndKind()
+}
+
+// GroupVersionKind satisfies the ObjectKind interface for all objects that embed TypeMeta
+func (obj *TypeMeta) GroupVersionKind() schema.GroupVersionKind {
+	return schema.FromAPIVersionAndKind(obj.APIVersion, obj.Kind)
+}
+
+func (obj *ListMeta) GetListMeta() ListInterface { return obj }
+
+func (obj *ObjectMeta) GetObjectMeta() Object { return obj }
+
+// Namespace implements metav1.Object for any object with an ObjectMeta typed field. Allows
+// fast, direct access to metadata fields for API objects.
+func (meta *ObjectMeta) GetNamespace() string                { return meta.Namespace }
+func (meta *ObjectMeta) SetNamespace(namespace string)       { meta.Namespace = namespace }
+func (meta *ObjectMeta) GetName() string                     { return meta.Name }
+func (meta *ObjectMeta) SetName(name string)                 { meta.Name = name }
+func (meta *ObjectMeta) GetGenerateName() string             { return meta.GenerateName }
+func (meta *ObjectMeta) SetGenerateName(generateName string) { meta.GenerateName = generateName }
+func (meta *ObjectMeta) GetUID() types.UID                   { return meta.UID }
+func (meta *ObjectMeta) SetUID(uid types.UID)                { meta.UID = uid }
+func (meta *ObjectMeta) GetResourceVersion() string          { return meta.ResourceVersion }
+func (meta *ObjectMeta) SetResourceVersion(version string)   { meta.ResourceVersion = version }
+func (meta *ObjectMeta) GetGeneration() int64                { return meta.Generation }
+func (meta *ObjectMeta) SetGeneration(generation int64)      { meta.Generation = generation }
+func (meta *ObjectMeta) GetSelfLink() string                 { return meta.SelfLink }
+func (meta *ObjectMeta) SetSelfLink(selfLink string)         { meta.SelfLink = selfLink }
+func (meta *ObjectMeta) GetCreationTimestamp() Time          { return meta.CreationTimestamp }
+func (meta *ObjectMeta) SetCreationTimestamp(creationTimestamp Time) {
+	meta.CreationTimestamp = creationTimestamp
+}
+func (meta *ObjectMeta) GetDeletionTimestamp() *Time { return meta.DeletionTimestamp }
+func (meta *ObjectMeta) SetDeletionTimestamp(deletionTimestamp *Time) {
+	meta.DeletionTimestamp = deletionTimestamp
+}
+func (meta *ObjectMeta) GetDeletionGracePeriodSeconds() *int64 {
+	return meta.DeletionGracePeriodSeconds
+}
+func (meta *ObjectMeta) SetDeletionGracePeriodSeconds(deletionGracePeriodSeconds *int64) {
+	meta.DeletionGracePeriodSeconds = deletionGracePeriodSeconds
+}
+func (meta *ObjectMeta) GetLabels() map[string]string                 { return meta.Labels }
+func (meta *ObjectMeta) SetLabels(labels map[string]string)           { meta.Labels = labels }
+func (meta *ObjectMeta) GetAnnotations() map[string]string            { return meta.Annotations }
+func (meta *ObjectMeta) SetAnnotations(annotations map[string]string) { meta.Annotations = annotations }
+func (meta *ObjectMeta) GetFinalizers() []string                      { return meta.Finalizers }
+func (meta *ObjectMeta) SetFinalizers(finalizers []string)            { meta.Finalizers = finalizers }
+func (meta *ObjectMeta) GetOwnerReferences() []OwnerReference         { return meta.OwnerReferences }
+func (meta *ObjectMeta) SetOwnerReferences(references []OwnerReference) {
+	meta.OwnerReferences = references
+}
+func (meta *ObjectMeta) GetManagedFields() []ManagedFieldsEntry { return meta.ManagedFields }
+func (meta *ObjectMeta) SetManagedFields(managedFields []ManagedFieldsEntry) {
+	meta.ManagedFields = managedFields
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time.go
new file mode 100644
index 0000000000..9f302b3f36
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time.go
@@ -0,0 +1,209 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"time"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+)
+
+const RFC3339Micro = "2006-01-02T15:04:05.000000Z07:00"
+
+// MicroTime is version of Time with microsecond level precision.
+//
+// +protobuf.options.marshal=false
+// +protobuf.as=Timestamp
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type MicroTime struct {
+	time.Time `protobuf:"-"`
+}
+
+// DeepCopy returns a deep-copy of the MicroTime value.  The underlying time.Time
+// type is effectively immutable in the time API, so it is safe to
+// copy-by-assign, despite the presence of (unexported) Pointer fields.
+func (t *MicroTime) DeepCopyInto(out *MicroTime) {
+	*out = *t
+}
+
+// NewMicroTime returns a wrapped instance of the provided time
+func NewMicroTime(time time.Time) MicroTime {
+	return MicroTime{time}
+}
+
+// DateMicro returns the MicroTime corresponding to the supplied parameters
+// by wrapping time.Date.
+func DateMicro(year int, month time.Month, day, hour, min, sec, nsec int, loc *time.Location) MicroTime {
+	return MicroTime{time.Date(year, month, day, hour, min, sec, nsec, loc)}
+}
+
+// NowMicro returns the current local time.
+func NowMicro() MicroTime {
+	return MicroTime{time.Now()}
+}
+
+// IsZero returns true if the value is nil or time is zero.
+func (t *MicroTime) IsZero() bool {
+	if t == nil {
+		return true
+	}
+	return t.Time.IsZero()
+}
+
+// Before reports whether the time instant t is before u.
+func (t *MicroTime) Before(u *MicroTime) bool {
+	if t != nil && u != nil {
+		return t.Time.Before(u.Time)
+	}
+	return false
+}
+
+// Equal reports whether the time instant t is equal to u.
+func (t *MicroTime) Equal(u *MicroTime) bool {
+	if t == nil && u == nil {
+		return true
+	}
+	if t != nil && u != nil {
+		return t.Time.Equal(u.Time)
+	}
+	return false
+}
+
+// BeforeTime reports whether the time instant t is before second-lever precision u.
+func (t *MicroTime) BeforeTime(u *Time) bool {
+	if t != nil && u != nil {
+		return t.Time.Before(u.Time)
+	}
+	return false
+}
+
+// EqualTime reports whether the time instant t is equal to second-lever precision u.
+func (t *MicroTime) EqualTime(u *Time) bool {
+	if t == nil && u == nil {
+		return true
+	}
+	if t != nil && u != nil {
+		return t.Time.Equal(u.Time)
+	}
+	return false
+}
+
+// UnixMicro returns the local time corresponding to the given Unix time
+// by wrapping time.Unix.
+func UnixMicro(sec int64, nsec int64) MicroTime {
+	return MicroTime{time.Unix(sec, nsec)}
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+func (t *MicroTime) UnmarshalJSON(b []byte) error {
+	if len(b) == 4 && string(b) == "null" {
+		t.Time = time.Time{}
+		return nil
+	}
+
+	var str string
+	err := json.Unmarshal(b, &str)
+	if err != nil {
+		return err
+	}
+
+	pt, err := time.Parse(RFC3339Micro, str)
+	if err != nil {
+		return err
+	}
+
+	t.Time = pt.Local()
+	return nil
+}
+
+func (t *MicroTime) UnmarshalCBOR(b []byte) error {
+	var s *string
+	if err := cbor.Unmarshal(b, &s); err != nil {
+		return err
+	}
+	if s == nil {
+		t.Time = time.Time{}
+		return nil
+	}
+
+	parsed, err := time.Parse(RFC3339Micro, *s)
+	if err != nil {
+		return err
+	}
+
+	t.Time = parsed.Local()
+	return nil
+}
+
+// UnmarshalQueryParameter converts from a URL query parameter value to an object
+func (t *MicroTime) UnmarshalQueryParameter(str string) error {
+	if len(str) == 0 {
+		t.Time = time.Time{}
+		return nil
+	}
+	// Tolerate requests from older clients that used JSON serialization to build query params
+	if len(str) == 4 && str == "null" {
+		t.Time = time.Time{}
+		return nil
+	}
+
+	pt, err := time.Parse(RFC3339Micro, str)
+	if err != nil {
+		return err
+	}
+
+	t.Time = pt.Local()
+	return nil
+}
+
+// MarshalJSON implements the json.Marshaler interface.
+func (t MicroTime) MarshalJSON() ([]byte, error) {
+	if t.IsZero() {
+		// Encode unset/nil objects as JSON's "null".
+		return []byte("null"), nil
+	}
+
+	return json.Marshal(t.UTC().Format(RFC3339Micro))
+}
+
+func (t MicroTime) MarshalCBOR() ([]byte, error) {
+	if t.IsZero() {
+		return cbor.Marshal(nil)
+	}
+	return cbor.Marshal(t.UTC().Format(RFC3339Micro))
+}
+
+// OpenAPISchemaType is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+//
+// See: https://github.com/kubernetes/kube-openapi/tree/master/pkg/generators
+func (_ MicroTime) OpenAPISchemaType() []string { return []string{"string"} }
+
+// OpenAPISchemaFormat is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+func (_ MicroTime) OpenAPISchemaFormat() string { return "date-time" }
+
+// MarshalQueryParameter converts to a URL query parameter value
+func (t MicroTime) MarshalQueryParameter() (string, error) {
+	if t.IsZero() {
+		// Encode unset/nil objects as an empty string
+		return "", nil
+	}
+
+	return t.UTC().Format(RFC3339Micro), nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_fuzz.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_fuzz.go
new file mode 100644
index 0000000000..338ea9be72
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_fuzz.go
@@ -0,0 +1,40 @@
+//go:build !notest
+
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"math/rand"
+	"time"
+
+	"sigs.k8s.io/randfill"
+)
+
+// Fuzz satisfies randfill.SimpleSelfFiller.
+func (t *MicroTime) RandFill(r *rand.Rand) {
+	if t == nil {
+		return
+	}
+	// Allow for about 1000 years of randomness. Accurate to a tenth of
+	// micro second. Leave off nanoseconds because JSON doesn't
+	// represent them so they can't round-trip properly.
+	t.Time = time.Unix(r.Int63n(1000*365*24*60*60), 1000*r.Int63n(1000000))
+}
+
+// ensure MicroTime implements randfill.Interface
+var _ randfill.SimpleSelfFiller = &MicroTime{}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_proto.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_proto.go
new file mode 100644
index 0000000000..ab68181e91
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_proto.go
@@ -0,0 +1,86 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"time"
+)
+
+// Timestamp is declared in time_proto.go
+
+// Timestamp returns the Time as a new Timestamp value.
+func (m *MicroTime) ProtoMicroTime() *Timestamp {
+	if m == nil {
+		return &Timestamp{}
+	}
+
+	// truncate precision to microseconds to match JSON marshaling/unmarshaling
+	truncatedNanoseconds := time.Duration(m.Time.Nanosecond()).Truncate(time.Microsecond)
+	return &Timestamp{
+		Seconds: m.Time.Unix(),
+		Nanos:   int32(truncatedNanoseconds),
+	}
+}
+
+// Size implements the protobuf marshalling interface.
+func (m *MicroTime) Size() (n int) {
+	if m == nil || m.Time.IsZero() {
+		return 0
+	}
+	return m.ProtoMicroTime().Size()
+}
+
+// Reset implements the protobuf marshalling interface.
+func (m *MicroTime) Unmarshal(data []byte) error {
+	if len(data) == 0 {
+		m.Time = time.Time{}
+		return nil
+	}
+	p := Timestamp{}
+	if err := p.Unmarshal(data); err != nil {
+		return err
+	}
+
+	// truncate precision to microseconds to match JSON marshaling/unmarshaling
+	truncatedNanoseconds := time.Duration(p.Nanos).Truncate(time.Microsecond)
+	m.Time = time.Unix(p.Seconds, int64(truncatedNanoseconds)).Local()
+	return nil
+}
+
+// Marshal implements the protobuf marshalling interface.
+func (m *MicroTime) Marshal() (data []byte, err error) {
+	if m == nil || m.Time.IsZero() {
+		return nil, nil
+	}
+	return m.ProtoMicroTime().Marshal()
+}
+
+// MarshalTo implements the protobuf marshalling interface.
+func (m *MicroTime) MarshalTo(data []byte) (int, error) {
+	if m == nil || m.Time.IsZero() {
+		return 0, nil
+	}
+	return m.ProtoMicroTime().MarshalTo(data)
+}
+
+// MarshalToSizedBuffer implements the protobuf marshalling interface.
+func (m *MicroTime) MarshalToSizedBuffer(data []byte) (int, error) {
+	if m == nil || m.Time.IsZero() {
+		return 0, nil
+	}
+	return m.ProtoMicroTime().MarshalToSizedBuffer(data)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_test.go
new file mode 100644
index 0000000000..b96baa5b77
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_test.go
@@ -0,0 +1,402 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"testing"
+	"time"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	"sigs.k8s.io/yaml"
+
+	"github.com/google/go-cmp/cmp"
+	"sigs.k8s.io/randfill"
+)
+
+type MicroTimeHolder struct {
+	T MicroTime `json:"t"`
+}
+
+func TestMicroTimeMarshalYAML(t *testing.T) {
+	cases := []struct {
+		input  MicroTime
+		result string
+	}{
+		{MicroTime{}, "t: null\n"},
+		{DateMicro(1998, time.May, 5, 1, 5, 5, 50, time.FixedZone("test", -4*60*60)), "t: \"1998-05-05T05:05:05.000000Z\"\n"},
+		{DateMicro(1998, time.May, 5, 5, 5, 5, 0, time.UTC), "t: \"1998-05-05T05:05:05.000000Z\"\n"},
+	}
+
+	for _, c := range cases {
+		input := MicroTimeHolder{c.input}
+		result, err := yaml.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input: '%v': %v", input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("Failed to marshal input: '%v': expected %+v, got %q", input, c.result, string(result))
+		}
+	}
+}
+
+func TestMicroTimeUnmarshalYAML(t *testing.T) {
+	cases := []struct {
+		input  string
+		result MicroTime
+	}{
+		{"t: null\n", MicroTime{}},
+		{"t: 1998-05-05T05:05:05.000000Z\n", MicroTime{Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC).Local()}},
+	}
+
+	for _, c := range cases {
+		var result MicroTimeHolder
+		if err := yaml.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("Failed to unmarshal input '%v': %v", c.input, err)
+		}
+		if result.T != c.result {
+			t.Errorf("Failed to unmarshal input '%v': expected %+v, got %+v", c.input, c.result, result)
+		}
+	}
+}
+
+func TestMicroTimeMarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  MicroTime
+		result string
+	}{
+		{MicroTime{}, "{\"t\":null}"},
+		{DateMicro(1998, time.May, 5, 5, 5, 5, 50, time.UTC), "{\"t\":\"1998-05-05T05:05:05.000000Z\"}"},
+		{DateMicro(1998, time.May, 5, 5, 5, 5, 0, time.UTC), "{\"t\":\"1998-05-05T05:05:05.000000Z\"}"},
+	}
+
+	for _, c := range cases {
+		input := MicroTimeHolder{c.input}
+		result, err := json.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input: '%v': %v", input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("Failed to marshal input: '%v': expected %+v, got %q", input, c.result, string(result))
+		}
+	}
+}
+
+func TestMicroTimeUnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  string
+		result MicroTime
+	}{
+		{"{\"t\":null}", MicroTime{}},
+		{"{\"t\":\"1998-05-05T05:05:05.000000Z\"}", MicroTime{Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC).Local()}},
+	}
+
+	for _, c := range cases {
+		var result MicroTimeHolder
+		if err := json.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("Failed to unmarshal input '%v': %v", c.input, err)
+		}
+		if result.T != c.result {
+			t.Errorf("Failed to unmarshal input '%v': expected %+v, got %+v", c.input, c.result, result)
+		}
+	}
+}
+
+func TestMicroTimeMarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		in   MicroTime
+		out  []byte
+	}{
+		{name: "zero value", in: MicroTime{}, out: []byte{0xf6}},                                                                                       // null
+		{name: "no fractional seconds", in: DateMicro(1998, time.May, 5, 5, 5, 5, 0, time.UTC), out: []byte("\x58\x1b1998-05-05T05:05:05.000000Z")},    // '1998-05-05T05:05:05.000000Z'
+		{name: "nanoseconds truncated", in: DateMicro(1998, time.May, 5, 5, 5, 5, 5050, time.UTC), out: []byte("\x58\x1b1998-05-05T05:05:05.000005Z")}, // '1998-05-05T05:05:05.000005Z'
+	} {
+		t.Run(fmt.Sprintf("%+v", tc.in), func(t *testing.T) {
+			got, err := tc.in.MarshalCBOR()
+			if err != nil {
+				t.Fatal(err)
+			}
+			if diff := cmp.Diff(tc.out, got); diff != "" {
+				t.Errorf("unexpected output:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestMicroTimeUnmarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		in         []byte
+		out        MicroTime
+		errMessage string
+	}{
+		{name: "null", in: []byte{0xf6}, out: MicroTime{}}, // null
+		{name: "valid", in: []byte("\x58\x1b1998-05-05T05:05:05.000000Z"), out: MicroTime{Time: Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC).Local()}},                                    // '1998-05-05T05:05:05.000000Z'
+		{name: "invalid cbor type", in: []byte{0x07}, out: MicroTime{}, errMessage: "cbor: cannot unmarshal positive integer into Go value of type string"},                                // 7
+		{name: "malformed timestamp", in: []byte("\x45hello"), out: MicroTime{}, errMessage: `parsing time "hello" as "2006-01-02T15:04:05.000000Z07:00": cannot parse "hello" as "2006"`}, // 'hello'
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var got MicroTime
+			err := got.UnmarshalCBOR(tc.in)
+			if err != nil {
+				if tc.errMessage == "" {
+					t.Fatalf("want nil error, got: %v", err)
+				} else if gotMessage := err.Error(); tc.errMessage != gotMessage {
+					t.Fatalf("want error: %q, got: %q", tc.errMessage, gotMessage)
+				}
+			} else if tc.errMessage != "" {
+				t.Fatalf("got nil error, want: %s", tc.errMessage)
+			}
+			if diff := cmp.Diff(tc.out, got); diff != "" {
+				t.Errorf("unexpected output:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestMicroTimeProto(t *testing.T) {
+	cases := []struct {
+		input MicroTime
+	}{
+		{MicroTime{}},
+		{DateMicro(1998, time.May, 5, 1, 5, 5, 1000, time.Local)},
+		{DateMicro(1998, time.May, 5, 5, 5, 5, 0, time.Local)},
+	}
+
+	for _, c := range cases {
+		input := c.input
+		data, err := input.Marshal()
+		if err != nil {
+			t.Fatalf("Failed to marshal input: '%v': %v", input, err)
+		}
+		time := MicroTime{}
+		if err := time.Unmarshal(data); err != nil {
+			t.Fatalf("Failed to unmarshal output: '%v': %v", input, err)
+		}
+		if !reflect.DeepEqual(input, time) {
+			t.Errorf("Marshal->Unmarshal is not idempotent: '%v' vs '%v'", input, time)
+		}
+	}
+}
+
+func TestMicroTimeEqual(t *testing.T) {
+	t1 := NewMicroTime(time.Now())
+	cases := []struct {
+		name   string
+		x      *MicroTime
+		y      *MicroTime
+		result bool
+	}{
+		{"nil =? nil", nil, nil, true},
+		{"!nil =? !nil", &t1, &t1, true},
+		{"nil =? !nil", nil, &t1, false},
+		{"!nil =? nil", &t1, nil, false},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.Equal(c.y)
+			if result != c.result {
+				t.Errorf("Failed equality test for '%v', '%v': expected %+v, got %+v", c.x, c.y, c.result, result)
+			}
+		})
+	}
+}
+
+func TestMicroTimeEqualTime(t *testing.T) {
+	t1 := NewMicroTime(time.Now())
+	t2 := NewTime(t1.Time)
+	cases := []struct {
+		name   string
+		x      *MicroTime
+		y      *Time
+		result bool
+	}{
+		{"nil =? nil", nil, nil, true},
+		{"!nil =? !nil", &t1, &t2, true},
+		{"nil =? !nil", nil, &t2, false},
+		{"!nil =? nil", &t1, nil, false},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.EqualTime(c.y)
+			if result != c.result {
+				t.Errorf("Failed equality test for '%v', '%v': expected %+v, got %+v", c.x, c.y, c.result, result)
+			}
+		})
+	}
+}
+
+func TestMicroTimeBefore(t *testing.T) {
+	t1 := NewMicroTime(time.Now())
+	cases := []struct {
+		name string
+		x    *MicroTime
+		y    *MicroTime
+	}{
+		{"nil <? nil", nil, nil},
+		{"!nil <? !nil", &t1, &t1},
+		{"nil <? !nil", nil, &t1},
+		{"!nil <? nil", &t1, nil},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.Before(c.y)
+			if result {
+				t.Errorf("Failed before test for '%v', '%v': expected false, got %+v", c.x, c.y, result)
+			}
+		})
+	}
+}
+func TestMicroTimeBeforeTime(t *testing.T) {
+	t1 := NewMicroTime(time.Now())
+	t2 := NewTime(t1.Time)
+	cases := []struct {
+		name string
+		x    *MicroTime
+		y    *Time
+	}{
+		{"nil <? nil", nil, nil},
+		{"!nil <? !nil", &t1, &t2},
+		{"nil <? !nil", nil, &t2},
+		{"!nil <? nil", &t1, nil},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.BeforeTime(c.y)
+			if result {
+				t.Errorf("Failed before test for '%v', '%v': expected false, got %+v", c.x, c.y, result)
+			}
+		})
+	}
+}
+
+func TestMicroTimeIsZero(t *testing.T) {
+	t1 := NewMicroTime(time.Now())
+	cases := []struct {
+		name   string
+		x      *MicroTime
+		result bool
+	}{
+		{"nil =? 0", nil, true},
+		{"!nil =? 0", &t1, false},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.IsZero()
+			if result != c.result {
+				t.Errorf("Failed equality test for '%v': expected %+v, got %+v", c.x, c.result, result)
+			}
+		})
+	}
+}
+
+func TestMicroTimeUnmarshalJSONAndProtoEqual(t *testing.T) {
+	cases := []struct {
+		name   string
+		input  MicroTime
+		result bool
+	}{
+		{"nanosecond level precision", UnixMicro(123, 123123123), true},
+		{"microsecond level precision", UnixMicro(123, 123123000), true},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			jsonData, err := c.input.MarshalJSON()
+			if err != nil {
+				t.Fatalf("Failed to marshal input to JSON: '%v': %v", c.input, err)
+			}
+
+			protoData, err := c.input.Marshal()
+			if err != nil {
+				t.Fatalf("Failed to marshal input to proto: '%v': %v", c.input, err)
+			}
+
+			var tJSON, tProto MicroTime
+			if err = tJSON.UnmarshalJSON(jsonData); err != nil {
+				t.Fatalf("Failed to unmarshal JSON: '%v': %v", jsonData, err)
+			}
+			if err = tProto.Unmarshal(protoData); err != nil {
+				t.Fatalf("Failed to unmarshal proto: '%v': %v", protoData, err)
+			}
+
+			result := tJSON.Equal(&tProto)
+			if result != c.result {
+				t.Errorf("Failed equality test for '%v': expected %+v, got %+v", c.input, c.result, result)
+			}
+		})
+	}
+}
+
+func TestMicroTimeProtoUnmarshalRaw(t *testing.T) {
+	cases := []struct {
+		name     string
+		input    []byte
+		expected MicroTime
+	}{
+		// input is generated by Timestamp{123, 123123123}.Marshal()
+		{"nanosecond level precision", []byte{8, 123, 16, 179, 235, 218, 58}, UnixMicro(123, 123123000)},
+		// input is generated by Timestamp{123, 123123000}.Marshal()
+		{"microsecond level precision", []byte{8, 123, 16, 184, 234, 218, 58}, UnixMicro(123, 123123000)},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			var actual MicroTime
+			if err := actual.Unmarshal(c.input); err != nil {
+				t.Fatalf("Failed to unmarshal proto: '%v': %v", c.input, err)
+			}
+
+			if !actual.Equal(&c.expected) {
+				t.Errorf("Failed unmarshal from nanosecond-precise raw for '%v': expected %+v, got %+v", c.input, c.expected, actual)
+			}
+		})
+	}
+
+}
+
+func TestMicroTimeRoundtripCBOR(t *testing.T) {
+	fuzzer := randfill.New()
+	for i := 0; i < 500; i++ {
+		var initial, final MicroTime
+		fuzzer.Fill(&initial)
+		b, err := cbor.Marshal(initial)
+		if err != nil {
+			t.Errorf("error encoding %v: %v", initial, err)
+			continue
+		}
+		err = cbor.Unmarshal(b, &final)
+		if err != nil {
+			t.Errorf("%v: error decoding %v: %v", initial, string(b), err)
+		}
+		if !final.Equal(&initial) {
+			diag, err := cbor.Diagnose(b)
+			if err != nil {
+				t.Logf("failed to produce diagnostic encoding of 0x%x: %v", b, err)
+			}
+			t.Errorf("expected equal: %v, %v (cbor was '%s')", initial, final, diag)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/options_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/options_test.go
new file mode 100644
index 0000000000..5d37987dac
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/options_test.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"testing"
+
+	"sigs.k8s.io/randfill"
+)
+
+func TestPatchOptionsIsSuperSetOfUpdateOptions(t *testing.T) {
+	f := randfill.New()
+	for i := 0; i < 1000; i++ {
+		t.Run(fmt.Sprintf("Run %d/1000", i), func(t *testing.T) {
+			update := UpdateOptions{}
+			f.Fill(&update)
+
+			b, err := json.Marshal(update)
+			if err != nil {
+				t.Fatalf("failed to marshal UpdateOptions (%v): %v", err, update)
+			}
+			patch := PatchOptions{}
+			err = json.Unmarshal(b, &patch)
+			if err != nil {
+				t.Fatalf("failed to unmarshal UpdateOptions into PatchOptions: %v", err)
+			}
+
+			b, err = json.Marshal(patch)
+			if err != nil {
+				t.Fatalf("failed to marshal PatchOptions (%v): %v", err, patch)
+			}
+			got := UpdateOptions{}
+			err = json.Unmarshal(b, &got)
+			if err != nil {
+				t.Fatalf("failed to unmarshal UpdateOptions into UpdateOptions: %v", err)
+			}
+
+			if !reflect.DeepEqual(update, got) {
+				t.Fatalf(`UpdateOptions -> PatchOptions -> UpdateOptions round-trip failed:
+got: %v
+want: %v`, got, update)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/register.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/register.go
new file mode 100644
index 0000000000..1abdd626de
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/register.go
@@ -0,0 +1,107 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// GroupName is the group name for this API.
+const GroupName = "meta.k8s.io"
+
+var (
+	// localSchemeBuilder is used to make compiler happy for autogenerated
+	// conversions. However, it's not used.
+	schemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &schemeBuilder
+)
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Unversioned is group version for unversioned API objects
+// TODO: this should be v1 probably
+var Unversioned = schema.GroupVersion{Group: "", Version: "v1"}
+
+// WatchEventKind is name reserved for serializing watch events.
+const WatchEventKind = "WatchEvent"
+
+// Kind takes an unqualified kind and returns a Group qualified GroupKind
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// scheme is the registry for the common types that adhere to the meta v1 API spec.
+var scheme = runtime.NewScheme()
+
+// ParameterCodec knows about query parameters used with the meta v1 API spec.
+var ParameterCodec = runtime.NewParameterCodec(scheme)
+
+var optionsTypes = []runtime.Object{
+	&ListOptions{},
+	&GetOptions{},
+	&DeleteOptions{},
+	&CreateOptions{},
+	&UpdateOptions{},
+	&PatchOptions{},
+}
+
+// AddToGroupVersion registers common meta types into schemas.
+func AddToGroupVersion(scheme *runtime.Scheme, groupVersion schema.GroupVersion) {
+	scheme.AddKnownTypeWithName(groupVersion.WithKind(WatchEventKind), &WatchEvent{})
+	scheme.AddKnownTypeWithName(
+		schema.GroupVersion{Group: groupVersion.Group, Version: runtime.APIVersionInternal}.WithKind(WatchEventKind),
+		&InternalEvent{},
+	)
+	// Supports legacy code paths, most callers should use metav1.ParameterCodec for now
+	scheme.AddKnownTypes(groupVersion, optionsTypes...)
+	// Register Unversioned types under their own special group
+	scheme.AddUnversionedTypes(Unversioned,
+		&Status{},
+		&APIVersions{},
+		&APIGroupList{},
+		&APIGroup{},
+		&APIResourceList{},
+	)
+
+	// register manually. This usually goes through the SchemeBuilder, which we cannot use here.
+	utilruntime.Must(RegisterConversions(scheme))
+	utilruntime.Must(RegisterDefaults(scheme))
+}
+
+// AddMetaToScheme registers base meta types into schemas.
+func AddMetaToScheme(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&Table{},
+		&TableOptions{},
+		&PartialObjectMetadata{},
+		&PartialObjectMetadataList{},
+	)
+
+	return nil
+}
+
+func init() {
+	scheme.AddUnversionedTypes(SchemeGroupVersion, optionsTypes...)
+
+	utilruntime.Must(AddMetaToScheme(scheme))
+
+	// register manually. This usually goes through the SchemeBuilder, which we cannot use here.
+	utilruntime.Must(RegisterDefaults(scheme))
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time.go
new file mode 100644
index 0000000000..0333cfdb33
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time.go
@@ -0,0 +1,211 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"time"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+)
+
+// Time is a wrapper around time.Time which supports correct
+// marshaling to YAML and JSON.  Wrappers are provided for many
+// of the factory methods that the time package offers.
+//
+// +protobuf.options.marshal=false
+// +protobuf.as=Timestamp
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type Time struct {
+	time.Time `protobuf:"-"`
+}
+
+// DeepCopyInto creates a deep-copy of the Time value.  The underlying time.Time
+// type is effectively immutable in the time API, so it is safe to
+// copy-by-assign, despite the presence of (unexported) Pointer fields.
+func (t *Time) DeepCopyInto(out *Time) {
+	*out = *t
+}
+
+// NewTime returns a wrapped instance of the provided time
+func NewTime(time time.Time) Time {
+	return Time{time}
+}
+
+// Date returns the Time corresponding to the supplied parameters
+// by wrapping time.Date.
+func Date(year int, month time.Month, day, hour, min, sec, nsec int, loc *time.Location) Time {
+	return Time{time.Date(year, month, day, hour, min, sec, nsec, loc)}
+}
+
+// Now returns the current local time.
+func Now() Time {
+	return Time{time.Now()}
+}
+
+// IsZero returns true if the value is nil or time is zero.
+func (t *Time) IsZero() bool {
+	if t == nil {
+		return true
+	}
+	return t.Time.IsZero()
+}
+
+// Before reports whether the time instant t is before u.
+func (t *Time) Before(u *Time) bool {
+	if t != nil && u != nil {
+		return t.Time.Before(u.Time)
+	}
+	return false
+}
+
+// Equal reports whether the time instant t is equal to u.
+func (t *Time) Equal(u *Time) bool {
+	if t == nil && u == nil {
+		return true
+	}
+	if t != nil && u != nil {
+		return t.Time.Equal(u.Time)
+	}
+	return false
+}
+
+// Unix returns the local time corresponding to the given Unix time
+// by wrapping time.Unix.
+func Unix(sec int64, nsec int64) Time {
+	return Time{time.Unix(sec, nsec)}
+}
+
+// Rfc3339Copy returns a copy of the Time at second-level precision.
+func (t Time) Rfc3339Copy() Time {
+	copied, _ := time.Parse(time.RFC3339, t.Format(time.RFC3339))
+	return Time{copied}
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+func (t *Time) UnmarshalJSON(b []byte) error {
+	if len(b) == 4 && string(b) == "null" {
+		t.Time = time.Time{}
+		return nil
+	}
+
+	var str string
+	err := json.Unmarshal(b, &str)
+	if err != nil {
+		return err
+	}
+
+	pt, err := time.Parse(time.RFC3339, str)
+	if err != nil {
+		return err
+	}
+
+	t.Time = pt.Local()
+	return nil
+}
+
+func (t *Time) UnmarshalCBOR(b []byte) error {
+	var s *string
+	if err := cbor.Unmarshal(b, &s); err != nil {
+		return err
+	}
+	if s == nil {
+		t.Time = time.Time{}
+		return nil
+	}
+
+	parsed, err := time.Parse(time.RFC3339, *s)
+	if err != nil {
+		return err
+	}
+
+	t.Time = parsed.Local()
+	return nil
+}
+
+// UnmarshalQueryParameter converts from a URL query parameter value to an object
+func (t *Time) UnmarshalQueryParameter(str string) error {
+	if len(str) == 0 {
+		t.Time = time.Time{}
+		return nil
+	}
+	// Tolerate requests from older clients that used JSON serialization to build query params
+	if len(str) == 4 && str == "null" {
+		t.Time = time.Time{}
+		return nil
+	}
+
+	pt, err := time.Parse(time.RFC3339, str)
+	if err != nil {
+		return err
+	}
+
+	t.Time = pt.Local()
+	return nil
+}
+
+// MarshalJSON implements the json.Marshaler interface.
+func (t Time) MarshalJSON() ([]byte, error) {
+	if t.IsZero() {
+		// Encode unset/nil objects as JSON's "null".
+		return []byte("null"), nil
+	}
+	buf := make([]byte, 0, len(time.RFC3339)+2)
+	buf = append(buf, '"')
+	// time cannot contain non escapable JSON characters
+	buf = t.UTC().AppendFormat(buf, time.RFC3339)
+	buf = append(buf, '"')
+	return buf, nil
+}
+
+func (t Time) MarshalCBOR() ([]byte, error) {
+	if t.IsZero() {
+		return cbor.Marshal(nil)
+	}
+
+	return cbor.Marshal(t.UTC().Format(time.RFC3339))
+}
+
+// ToUnstructured implements the value.UnstructuredConverter interface.
+func (t Time) ToUnstructured() interface{} {
+	if t.IsZero() {
+		return nil
+	}
+	buf := make([]byte, 0, len(time.RFC3339))
+	buf = t.UTC().AppendFormat(buf, time.RFC3339)
+	return string(buf)
+}
+
+// OpenAPISchemaType is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+//
+// See: https://github.com/kubernetes/kube-openapi/tree/master/pkg/generators
+func (_ Time) OpenAPISchemaType() []string { return []string{"string"} }
+
+// OpenAPISchemaFormat is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+func (_ Time) OpenAPISchemaFormat() string { return "date-time" }
+
+// MarshalQueryParameter converts to a URL query parameter value
+func (t Time) MarshalQueryParameter() (string, error) {
+	if t.IsZero() {
+		// Encode unset/nil objects as an empty string
+		return "", nil
+	}
+
+	return t.UTC().Format(time.RFC3339), nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_fuzz.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_fuzz.go
new file mode 100644
index 0000000000..14ec5f0586
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_fuzz.go
@@ -0,0 +1,40 @@
+//go:build !notest
+
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"math/rand"
+	"time"
+
+	"sigs.k8s.io/randfill"
+)
+
+// Fuzz satisfies randfill.SimpleSelfFiller.
+func (t *Time) RandFill(r *rand.Rand) {
+	if t == nil {
+		return
+	}
+	// Allow for about 1000 years of randomness.  Leave off nanoseconds
+	// because JSON doesn't represent them so they can't round-trip
+	// properly.
+	t.Time = time.Unix(r.Int63n(1000*365*24*60*60), 0)
+}
+
+// ensure Time implements randfill.SimpleSelfFiller
+var _ randfill.SimpleSelfFiller = &Time{}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_proto.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_proto.go
new file mode 100644
index 0000000000..eac8d96589
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_proto.go
@@ -0,0 +1,100 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"time"
+)
+
+// Timestamp is a struct that is equivalent to Time, but intended for
+// protobuf marshalling/unmarshalling. It is generated into a serialization
+// that matches Time. Do not use in Go structs.
+type Timestamp struct {
+	// Represents seconds of UTC time since Unix epoch
+	// 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+	// 9999-12-31T23:59:59Z inclusive.
+	Seconds int64 `json:"seconds" protobuf:"varint,1,opt,name=seconds"`
+	// Non-negative fractions of a second at nanosecond resolution. Negative
+	// second values with fractions must still have non-negative nanos values
+	// that count forward in time. Must be from 0 to 999,999,999
+	// inclusive. This field may be limited in precision depending on context.
+	Nanos int32 `json:"nanos" protobuf:"varint,2,opt,name=nanos"`
+}
+
+// Timestamp returns the Time as a new Timestamp value.
+func (m *Time) ProtoTime() *Timestamp {
+	if m == nil {
+		return &Timestamp{}
+	}
+	return &Timestamp{
+		Seconds: m.Time.Unix(),
+		// leaving this here for the record.  our JSON only handled seconds, so this results in writes by
+		// protobuf clients storing values that aren't read by json clients, which results in unexpected
+		// field mutation, which fails various validation and equality code.
+		// Nanos:   int32(m.Time.Nanosecond()),
+	}
+}
+
+// Size implements the protobuf marshalling interface.
+func (m *Time) Size() (n int) {
+	if m == nil || m.Time.IsZero() {
+		return 0
+	}
+	return m.ProtoTime().Size()
+}
+
+// Reset implements the protobuf marshalling interface.
+func (m *Time) Unmarshal(data []byte) error {
+	if len(data) == 0 {
+		m.Time = time.Time{}
+		return nil
+	}
+	p := Timestamp{}
+	if err := p.Unmarshal(data); err != nil {
+		return err
+	}
+	// leaving this here for the record.  our JSON only handled seconds, so this results in writes by
+	// protobuf clients storing values that aren't read by json clients, which results in unexpected
+	// field mutation, which fails various validation and equality code.
+	// m.Time = time.Unix(p.Seconds, int64(p.Nanos)).Local()
+	m.Time = time.Unix(p.Seconds, int64(0)).Local()
+	return nil
+}
+
+// Marshal implements the protobuf marshaling interface.
+func (m *Time) Marshal() (data []byte, err error) {
+	if m == nil || m.Time.IsZero() {
+		return nil, nil
+	}
+	return m.ProtoTime().Marshal()
+}
+
+// MarshalTo implements the protobuf marshaling interface.
+func (m *Time) MarshalTo(data []byte) (int, error) {
+	if m == nil || m.Time.IsZero() {
+		return 0, nil
+	}
+	return m.ProtoTime().MarshalTo(data)
+}
+
+// MarshalToSizedBuffer implements the protobuf reverse marshaling interface.
+func (m *Time) MarshalToSizedBuffer(data []byte) (int, error) {
+	if m == nil || m.Time.IsZero() {
+		return 0, nil
+	}
+	return m.ProtoTime().MarshalToSizedBuffer(data)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_test.go
new file mode 100644
index 0000000000..886425f2fb
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/time_test.go
@@ -0,0 +1,327 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"testing"
+	"time"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	"sigs.k8s.io/yaml"
+
+	"github.com/google/go-cmp/cmp"
+	"sigs.k8s.io/randfill"
+)
+
+type TimeHolder struct {
+	T Time `json:"t"`
+}
+
+func TestTimeMarshalYAML(t *testing.T) {
+	cases := []struct {
+		input  Time
+		result string
+	}{
+		{Time{}, "t: null\n"},
+		{Date(1998, time.May, 5, 1, 5, 5, 50, time.FixedZone("test", -4*60*60)), "t: \"1998-05-05T05:05:05Z\"\n"},
+		{Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC), "t: \"1998-05-05T05:05:05Z\"\n"},
+	}
+
+	for _, c := range cases {
+		input := TimeHolder{c.input}
+		result, err := yaml.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input: '%v': %v", input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("Failed to marshal input: '%v': expected %+v, got %q", input, c.result, string(result))
+		}
+	}
+}
+
+func TestTimeUnmarshalYAML(t *testing.T) {
+	cases := []struct {
+		input  string
+		result Time
+	}{
+		{"t: null\n", Time{}},
+		{"t: 1998-05-05T05:05:05Z\n", Time{Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC).Local()}},
+	}
+
+	for _, c := range cases {
+		var result TimeHolder
+		if err := yaml.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("Failed to unmarshal input '%v': %v", c.input, err)
+		}
+		if result.T != c.result {
+			t.Errorf("Failed to unmarshal input '%v': expected %+v, got %+v", c.input, c.result, result)
+		}
+	}
+}
+
+func TestTimeMarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  Time
+		result string
+	}{
+		{Time{}, "{\"t\":null}"},
+		{Date(1998, time.May, 5, 5, 5, 5, 50, time.UTC), "{\"t\":\"1998-05-05T05:05:05Z\"}"},
+		{Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC), "{\"t\":\"1998-05-05T05:05:05Z\"}"},
+	}
+
+	for _, c := range cases {
+		input := TimeHolder{c.input}
+		result, err := json.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input: '%v': %v", input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("Failed to marshal input: '%v': expected %+v, got %q", input, c.result, string(result))
+		}
+	}
+}
+
+func TestTimeUnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  string
+		result Time
+	}{
+		{"{\"t\":null}", Time{}},
+		{"{\"t\":\"1998-05-05T05:05:05Z\"}", Time{Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC).Local()}},
+		{"{\"t\":\"1998-05-05T05:05:05.123456789Z\"}", Time{Date(1998, time.May, 5, 5, 5, 5, 123456789, time.UTC).Local()}},
+	}
+
+	for _, c := range cases {
+		var result TimeHolder
+		if err := json.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("Failed to unmarshal input '%v': %v", c.input, err)
+		}
+		if result.T != c.result {
+			t.Errorf("Failed to unmarshal input '%v': expected %+v, got %+v", c.input, c.result, result)
+		}
+	}
+}
+
+func TestTimeMarshalJSONUnmarshalYAML(t *testing.T) {
+	cases := []struct {
+		input Time
+	}{
+		{Time{}},
+		{Date(1998, time.May, 5, 5, 5, 5, 50, time.Local).Rfc3339Copy()},
+		{Date(1998, time.May, 5, 5, 5, 5, 0, time.Local).Rfc3339Copy()},
+	}
+
+	for i, c := range cases {
+		input := TimeHolder{c.input}
+		jsonMarshalled, err := json.Marshal(&input)
+		if err != nil {
+			t.Errorf("%d-1: Failed to marshal input: '%v': %v", i, input, err)
+		}
+
+		var result TimeHolder
+		err = yaml.Unmarshal(jsonMarshalled, &result)
+		if err != nil {
+			t.Errorf("%d-2: Failed to unmarshal '%+v': %v", i, string(jsonMarshalled), err)
+		}
+
+		iN, iO := input.T.Zone()
+		oN, oO := result.T.Zone()
+		if iN != oN || iO != oO {
+			t.Errorf("%d-3: Time zones differ before and after serialization %s:%d %s:%d", i, iN, iO, oN, oO)
+		}
+
+		if input.T.UnixNano() != result.T.UnixNano() {
+			t.Errorf("%d-4: Failed to marshal input '%#v': got %#v", i, input, result)
+		}
+	}
+}
+
+func TestTimeMarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		in   Time
+		out  []byte
+	}{
+		{name: "zero value", in: Time{}, out: []byte{0xf6}},                                                                                        // null
+		{name: "no fractional seconds", in: Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC), out: []byte("\x541998-05-05T05:05:05Z")},                // '1998-05-05T05:05:05Z'
+		{name: "fractional seconds truncated", in: Date(1998, time.May, 5, 5, 5, 5, 123456789, time.UTC), out: []byte("\x541998-05-05T05:05:05Z")}, // '1998-05-05T05:05:05Z'
+		{name: "epoch", in: Time{Time: time.Unix(0, 0)}, out: []byte("\x541970-01-01T00:00:00Z")},                                                  // '1970-01-01T00:00:00Z'
+		{name: "pre-epoch", in: Date(1960, time.January, 1, 0, 0, 0, 0, time.UTC), out: []byte("\x541960-01-01T00:00:00Z")},                        // '1960-01-01T00:00:00Z'
+	} {
+		t.Run(fmt.Sprintf("%+v", tc.in), func(t *testing.T) {
+			got, err := tc.in.MarshalCBOR()
+			if err != nil {
+				t.Fatal(err)
+			}
+			if diff := cmp.Diff(tc.out, got); diff != "" {
+				t.Errorf("unexpected output:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestTimeUnmarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		in         []byte
+		out        Time
+		errMessage string
+	}{
+		{name: "null", in: []byte{0xf6}, out: Time{}}, // null
+		{name: "no fractional seconds", in: []byte("\x58\x141998-05-05T05:05:05Z"), out: Time{Time: Date(1998, time.May, 5, 5, 5, 5, 0, time.UTC).Local()}},                    // '1998-05-05T05:05:05Z'
+		{name: "fractional seconds", in: []byte("\x58\x1e1998-05-05T05:05:05.123456789Z"), out: Time{Time: Date(1998, time.May, 5, 5, 5, 5, 123456789, time.UTC).Local()}},     // '1998-05-05T05:05:05.123456789Z'
+		{name: "invalid cbor type", in: []byte{0x07}, out: Time{}, errMessage: "cbor: cannot unmarshal positive integer into Go value of type string"},                         // 7
+		{name: "malformed timestamp", in: []byte("\x45hello"), out: Time{}, errMessage: `parsing time "hello" as "2006-01-02T15:04:05Z07:00": cannot parse "hello" as "2006"`}, // 'hello'
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var got Time
+			err := got.UnmarshalCBOR(tc.in)
+			if err != nil {
+				if tc.errMessage == "" {
+					t.Fatalf("want nil error, got: %v", err)
+				} else if gotMessage := err.Error(); tc.errMessage != gotMessage {
+					t.Fatalf("want error: %q, got: %q", tc.errMessage, gotMessage)
+				}
+			} else if tc.errMessage != "" {
+				t.Fatalf("got nil error, want: %s", tc.errMessage)
+			}
+			if diff := cmp.Diff(tc.out, got); diff != "" {
+				t.Errorf("unexpected output:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestTimeProto(t *testing.T) {
+	cases := []struct {
+		input Time
+	}{
+		{Time{}},
+		{Date(1998, time.May, 5, 1, 5, 5, 0, time.Local)},
+		{Date(1998, time.May, 5, 5, 5, 5, 0, time.Local)},
+	}
+
+	for _, c := range cases {
+		input := c.input
+		data, err := input.Marshal()
+		if err != nil {
+			t.Fatalf("Failed to marshal input: '%v': %v", input, err)
+		}
+		time := Time{}
+		if err := time.Unmarshal(data); err != nil {
+			t.Fatalf("Failed to unmarshal output: '%v': %v", input, err)
+		}
+		if !reflect.DeepEqual(input, time) {
+			t.Errorf("Marshal->Unmarshal is not idempotent: '%v' vs '%v'", input, time)
+		}
+	}
+}
+
+func TestTimeEqual(t *testing.T) {
+	t1 := NewTime(time.Now())
+	cases := []struct {
+		name   string
+		x      *Time
+		y      *Time
+		result bool
+	}{
+		{"nil =? nil", nil, nil, true},
+		{"!nil =? !nil", &t1, &t1, true},
+		{"nil =? !nil", nil, &t1, false},
+		{"!nil =? nil", &t1, nil, false},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.Equal(c.y)
+			if result != c.result {
+				t.Errorf("Failed equality test for '%v', '%v': expected %+v, got %+v", c.x, c.y, c.result, result)
+			}
+		})
+	}
+}
+
+func TestTimeBefore(t *testing.T) {
+	t1 := NewTime(time.Now())
+	cases := []struct {
+		name string
+		x    *Time
+		y    *Time
+	}{
+		{"nil <? nil", nil, nil},
+		{"!nil <? !nil", &t1, &t1},
+		{"nil <? !nil", nil, &t1},
+		{"!nil <? nil", &t1, nil},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.Before(c.y)
+			if result {
+				t.Errorf("Failed equality test for '%v', '%v': expected false, got %+v", c.x, c.y, result)
+			}
+		})
+	}
+}
+
+func TestTimeIsZero(t *testing.T) {
+	t1 := NewTime(time.Now())
+	cases := []struct {
+		name   string
+		x      *Time
+		result bool
+	}{
+		{"nil =? 0", nil, true},
+		{"!nil =? 0", &t1, false},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			result := c.x.IsZero()
+			if result != c.result {
+				t.Errorf("Failed equality test for '%v': expected %+v, got %+v", c.x, c.result, result)
+			}
+		})
+	}
+}
+
+func TestTimeRoundtripCBOR(t *testing.T) {
+	fuzzer := randfill.New()
+	for i := 0; i < 500; i++ {
+		var initial, final Time
+		fuzzer.Fill(&initial)
+		b, err := cbor.Marshal(initial)
+		if err != nil {
+			t.Errorf("error encoding %v: %v", initial, err)
+			continue
+		}
+		err = cbor.Unmarshal(b, &final)
+		if err != nil {
+			t.Errorf("%v: error decoding %v: %v", initial, string(b), err)
+		}
+		if !final.Equal(&initial) {
+			diag, err := cbor.Diagnose(b)
+			if err != nil {
+				t.Logf("failed to produce diagnostic encoding of 0x%x: %v", b, err)
+			}
+			t.Errorf("expected equal: %v, %v (cbor was '%s')", initial, final, diag)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types.go
new file mode 100644
index 0000000000..f88212e15e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types.go
@@ -0,0 +1,1695 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package v1 contains API types that are common to all versions.
+//
+// The package contains two categories of types:
+//   - external (serialized) types that lack their own version (e.g TypeMeta)
+//   - internal (never-serialized) types that are needed by several different
+//     api groups, and so live here, to avoid duplication and/or import loops
+//     (e.g. LabelSelector).
+//
+// In the future, we will probably move these categories of objects into
+// separate packages.
+package v1
+
+import (
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// TypeMeta describes an individual object in an API response or request
+// with strings representing the type of the object and its API schema version.
+// Structures that are versioned or persisted should inline TypeMeta.
+//
+// +k8s:deepcopy-gen=false
+type TypeMeta struct {
+	// Kind is a string value representing the REST resource this object represents.
+	// Servers may infer this from the endpoint the client submits requests to.
+	// Cannot be updated.
+	// In CamelCase.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	Kind string `json:"kind,omitempty" protobuf:"bytes,1,opt,name=kind"`
+
+	// APIVersion defines the versioned schema of this representation of an object.
+	// Servers should convert recognized schemas to the latest internal value, and
+	// may reject unrecognized values.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+	// +optional
+	APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,2,opt,name=apiVersion"`
+}
+
+// ListMeta describes metadata that synthetic resources must have, including lists and
+// various status objects. A resource may have only one of {ObjectMeta, ListMeta}.
+type ListMeta struct {
+	// Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
+	// +optional
+	SelfLink string `json:"selfLink,omitempty" protobuf:"bytes,1,opt,name=selfLink"`
+
+	// String that identifies the server's internal version of this object that
+	// can be used by clients to determine when objects have changed.
+	// Value must be treated as opaque by clients and passed unmodified back to the server.
+	// Populated by the system.
+	// Read-only.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+	// +optional
+	ResourceVersion string `json:"resourceVersion,omitempty" protobuf:"bytes,2,opt,name=resourceVersion"`
+
+	// continue may be set if the user set a limit on the number of items returned, and indicates that
+	// the server has more data available. The value is opaque and may be used to issue another request
+	// to the endpoint that served this list to retrieve the next set of available objects. Continuing a
+	// consistent list may not be possible if the server configuration has changed or more than a few
+	// minutes have passed. The resourceVersion field returned when using this continue value will be
+	// identical to the value in the first response, unless you have received this token from an error
+	// message.
+	Continue string `json:"continue,omitempty" protobuf:"bytes,3,opt,name=continue"`
+
+	// remainingItemCount is the number of subsequent items in the list which are not included in this
+	// list response. If the list request contained label or field selectors, then the number of
+	// remaining items is unknown and the field will be left unset and omitted during serialization.
+	// If the list is complete (either because it is not chunking or because this is the last chunk),
+	// then there are no more remaining items and this field will be left unset and omitted during
+	// serialization.
+	// Servers older than v1.15 do not set this field.
+	// The intended use of the remainingItemCount is *estimating* the size of a collection. Clients
+	// should not rely on the remainingItemCount to be set or to be exact.
+	// +optional
+	RemainingItemCount *int64 `json:"remainingItemCount,omitempty" protobuf:"bytes,4,opt,name=remainingItemCount"`
+
+	// shardInfo is set when the list is a filtered subset of the full collection,
+	// as selected by a shard selector on the request. It echoes back the selector
+	// so clients can verify which shard they received and merge sharded responses.
+	// Clients should not cache sharded list responses as a full representation
+	// of the collection.
+	//
+	// This is an alpha field and requires enabling the ShardedListAndWatch feature gate.
+	// +featureGate=ShardedListAndWatch
+	// +optional
+	ShardInfo *ShardInfo `json:"shardInfo,omitempty" protobuf:"bytes,5,opt,name=shardInfo"`
+}
+
+// ShardInfo describes the shard selector that was applied to produce a list response.
+// Its presence on a list response indicates the list is a filtered subset.
+type ShardInfo struct {
+	// selector is the shard selector string from the request, echoed back so clients
+	// can verify which shard they received and merge responses from multiple shards.
+	// +required
+	Selector string `json:"selector" protobuf:"bytes,1,opt,name=selector"`
+}
+
+// Field path constants that are specific to the internal API
+// representation.
+const (
+	ObjectNameField = "metadata.name"
+)
+
+// These are internal finalizer values for Kubernetes-like APIs, must be qualified name unless defined here
+const (
+	FinalizerOrphanDependents = "orphan"
+	FinalizerDeleteDependents = "foregroundDeletion"
+)
+
+// ObjectMeta is metadata that all persisted resources must have, which includes all objects
+// users must create.
+type ObjectMeta struct {
+	// Name must be unique within a namespace. Is required when creating resources, although
+	// some resources may allow a client to request the generation of an appropriate name
+	// automatically. Name is primarily intended for creation idempotence and configuration
+	// definition.
+	// Cannot be updated.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+	// +optional
+	Name string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name"`
+
+	// GenerateName is an optional prefix, used by the server, to generate a unique
+	// name ONLY IF the Name field has not been provided.
+	// If this field is used, the name returned to the client will be different
+	// than the name passed. This value will also be combined with a unique suffix.
+	// The provided value has the same validation rules as the Name field,
+	// and may be truncated by the length of the suffix required to make the value
+	// unique on the server.
+	//
+	// If this field is specified and the generated name exists, the server will return a 409.
+	//
+	// Applied only if Name is not specified.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
+	// +optional
+	GenerateName string `json:"generateName,omitempty" protobuf:"bytes,2,opt,name=generateName"`
+
+	// Namespace defines the space within which each name must be unique. An empty namespace is
+	// equivalent to the "default" namespace, but "default" is the canonical representation.
+	// Not all objects are required to be scoped to a namespace - the value of this field for
+	// those objects will be empty.
+	//
+	// Must be a DNS_LABEL.
+	// Cannot be updated.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces
+	// +optional
+	Namespace string `json:"namespace,omitempty" protobuf:"bytes,3,opt,name=namespace"`
+
+	// Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
+	// +optional
+	SelfLink string `json:"selfLink,omitempty" protobuf:"bytes,4,opt,name=selfLink"`
+
+	// UID is the unique in time and space value for this object. It is typically generated by
+	// the server on successful creation of a resource and is not allowed to change on PUT
+	// operations.
+	//
+	// Populated by the system.
+	// Read-only.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	UID types.UID `json:"uid,omitempty" protobuf:"bytes,5,opt,name=uid,casttype=k8s.io/kubernetes/pkg/types.UID"`
+
+	// An opaque value that represents the internal version of this object that can
+	// be used by clients to determine when objects have changed. May be used for optimistic
+	// concurrency, change detection, and the watch operation on a resource or set of resources.
+	// Clients must treat these values as opaque and passed unmodified back to the server.
+	// They may only be valid for a particular resource or set of resources.
+	//
+	// Populated by the system.
+	// Read-only.
+	// Value must be treated as opaque by clients and .
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+	// +optional
+	ResourceVersion string `json:"resourceVersion,omitempty" protobuf:"bytes,6,opt,name=resourceVersion"`
+
+	// A sequence number representing a specific generation of the desired state.
+	// Populated by the system. Read-only.
+	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:minimum=0
+	Generation int64 `json:"generation,omitempty" protobuf:"varint,7,opt,name=generation"`
+
+	// CreationTimestamp is a timestamp representing the server time when this object was
+	// created. It is not guaranteed to be set in happens-before order across separate operations.
+	// Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+	//
+	// Populated by the system.
+	// Read-only.
+	// Null for lists.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	CreationTimestamp Time `json:"creationTimestamp,omitempty,omitzero" protobuf:"bytes,8,opt,name=creationTimestamp"`
+
+	// DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This
+	// field is set by the server when a graceful deletion is requested by the user, and is not
+	// directly settable by a client. The resource is expected to be deleted (no longer visible
+	// from resource lists, and not reachable by name) after the time in this field, once the
+	// finalizers list is empty. As long as the finalizers list contains items, deletion is blocked.
+	// Once the deletionTimestamp is set, this value may not be unset or be set further into the
+	// future, although it may be shortened or the resource may be deleted prior to this time.
+	// For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react
+	// by sending a graceful termination signal to the containers in the pod. After that 30 seconds,
+	// the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup,
+	// remove the pod from the API. In the presence of network partitions, this object may still
+	// exist after this timestamp, until an administrator or automated process can determine the
+	// resource is fully terminated.
+	// If not set, graceful deletion of the object has not been requested.
+	//
+	// Populated by the system when a graceful deletion is requested.
+	// Read-only.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	DeletionTimestamp *Time `json:"deletionTimestamp,omitempty" protobuf:"bytes,9,opt,name=deletionTimestamp"`
+
+	// Number of seconds allowed for this object to gracefully terminate before
+	// it will be removed from the system. Only set when deletionTimestamp is also set.
+	// May only be shortened.
+	// Read-only.
+	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	DeletionGracePeriodSeconds *int64 `json:"deletionGracePeriodSeconds,omitempty" protobuf:"varint,10,opt,name=deletionGracePeriodSeconds"`
+
+	// Map of string keys and values that can be used to organize and categorize
+	// (scope and select) objects. May match selectors of replication controllers
+	// and services.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
+	// +optional
+	Labels map[string]string `json:"labels,omitempty" protobuf:"bytes,11,rep,name=labels"`
+
+	// Annotations is an unstructured key value map stored with a resource that may be
+	// set by external tools to store and retrieve arbitrary metadata. They are not
+	// queryable and should be preserved when modifying objects.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
+	// +optional
+	Annotations map[string]string `json:"annotations,omitempty" protobuf:"bytes,12,rep,name=annotations"`
+
+	// List of objects depended by this object. If ALL objects in the list have
+	// been deleted, this object will be garbage collected. If this object is managed by a controller,
+	// then an entry in this list will point to this controller, with the controller field set to true.
+	// There cannot be more than one managing controller.
+	// +optional
+	// +patchMergeKey=uid
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=uid
+	// +k8s:alpha(since:"1.37")=+k8s:optional
+	OwnerReferences []OwnerReference `json:"ownerReferences,omitempty" patchStrategy:"merge" patchMergeKey:"uid" protobuf:"bytes,13,rep,name=ownerReferences"`
+
+	// Must be empty before the object is deleted from the registry. Each entry
+	// is an identifier for the responsible component that will remove the entry
+	// from the list. If the deletionTimestamp of the object is non-nil, entries
+	// in this list can only be removed.
+	// Finalizers may be processed and removed in any order.  Order is NOT enforced
+	// because it introduces significant risk of stuck finalizers.
+	// finalizers is a shared field, any actor with permission can reorder it.
+	// If the finalizer list is processed in order, then this can lead to a situation
+	// in which the component responsible for the first finalizer in the list is
+	// waiting for a signal (field value, external system, or other) produced by a
+	// component responsible for a finalizer later in the list, resulting in a deadlock.
+	// Without enforced ordering finalizers are free to order amongst themselves and
+	// are not vulnerable to ordering changes in the list.
+	// +optional
+	// +patchStrategy=merge
+	// +listType=set
+	Finalizers []string `json:"finalizers,omitempty" patchStrategy:"merge" protobuf:"bytes,14,rep,name=finalizers"`
+
+	// Tombstone: ClusterName was a legacy field that was always cleared by
+	// the system and never used.
+	// ClusterName string `json:"clusterName,omitempty" protobuf:"bytes,15,opt,name=clusterName"`
+
+	// ManagedFields maps workflow-id and version to the set of fields
+	// that are managed by that workflow. This is mostly for internal
+	// housekeeping, and users typically shouldn't need to set or
+	// understand this field. A workflow can be the user's name, a
+	// controller's name, or the name of a specific apply path like
+	// "ci-cd". The set of fields is always in the version that the
+	// workflow used when modifying the object.
+	//
+	// +optional
+	// +listType=atomic
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	ManagedFields []ManagedFieldsEntry `json:"managedFields,omitempty" protobuf:"bytes,17,rep,name=managedFields"`
+}
+
+const (
+	// NamespaceDefault means the object is in the default namespace which is applied when not specified by clients
+	NamespaceDefault = "default"
+	// NamespaceAll is the default argument to specify on a context when you want to list or filter resources across all namespaces
+	NamespaceAll = ""
+	// NamespaceNone is the argument for a context when there is no namespace.
+	NamespaceNone = ""
+	// NamespaceSystem is the system namespace where we place system components.
+	NamespaceSystem = "kube-system"
+	// NamespacePublic is the namespace where we place public info (ConfigMaps)
+	NamespacePublic = "kube-public"
+)
+
+// OwnerReference contains enough information to let you identify an owning
+// object. An owning object must be in the same namespace as the dependent, or
+// be cluster-scoped, so there is no namespace field.
+// +structType=atomic
+type OwnerReference struct {
+	// API version of the referent.
+	// +k8s:alpha(since:"1.37")=+k8s:required
+	APIVersion string `json:"apiVersion" protobuf:"bytes,5,opt,name=apiVersion"`
+	// Kind of the referent.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +k8s:alpha(since:"1.37")=+k8s:required
+	Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"`
+	// Name of the referent.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+	// +k8s:alpha(since:"1.37")=+k8s:required
+	Name string `json:"name" protobuf:"bytes,3,opt,name=name"`
+	// UID of the referent.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+	// +k8s:alpha(since:"1.37")=+k8s:required
+	UID types.UID `json:"uid" protobuf:"bytes,4,opt,name=uid,casttype=k8s.io/apimachinery/pkg/types.UID"`
+	// If true, this reference points to the managing controller.
+	// +optional
+	Controller *bool `json:"controller,omitempty" protobuf:"varint,6,opt,name=controller"`
+	// If true, AND if the owner has the "foregroundDeletion" finalizer, then
+	// the owner cannot be deleted from the key-value store until this
+	// reference is removed.
+	// See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
+	// for how the garbage collector interacts with this field and enforces the foreground deletion.
+	// Defaults to false.
+	// To set this field, a user needs "delete" permission of the owner,
+	// otherwise 422 (Unprocessable Entity) will be returned.
+	// +optional
+	BlockOwnerDeletion *bool `json:"blockOwnerDeletion,omitempty" protobuf:"varint,7,opt,name=blockOwnerDeletion"`
+}
+
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// ListOptions is the query options to a standard REST list call.
+type ListOptions struct {
+	TypeMeta `json:""`
+
+	// A selector to restrict the list of returned objects by their labels.
+	// Defaults to everything.
+	// +optional
+	LabelSelector string `json:"labelSelector,omitempty" protobuf:"bytes,1,opt,name=labelSelector"`
+	// A selector to restrict the list of returned objects by their fields.
+	// Defaults to everything.
+	// +optional
+	FieldSelector string `json:"fieldSelector,omitempty" protobuf:"bytes,2,opt,name=fieldSelector"`
+
+	// +k8s:deprecated=includeUninitialized,protobuf=6
+
+	// Watch for changes to the described resources and return them as a stream of
+	// add, update, and remove notifications. Specify resourceVersion.
+	// +optional
+	Watch bool `json:"watch,omitempty" protobuf:"varint,3,opt,name=watch"`
+	// allowWatchBookmarks requests watch events with type "BOOKMARK".
+	// Servers that do not implement bookmarks may ignore this flag and
+	// bookmarks are sent at the server's discretion. Clients should not
+	// assume bookmarks are returned at any specific interval, nor may they
+	// assume the server will send any BOOKMARK event during a session.
+	// If this is not a watch, this field is ignored.
+	// +optional
+	AllowWatchBookmarks bool `json:"allowWatchBookmarks,omitempty" protobuf:"varint,9,opt,name=allowWatchBookmarks"`
+
+	// resourceVersion sets a constraint on what resource versions a request may be served from.
+	// See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+	// details.
+	//
+	// Defaults to unset
+	// +optional
+	ResourceVersion string `json:"resourceVersion,omitempty" protobuf:"bytes,4,opt,name=resourceVersion"`
+
+	// resourceVersionMatch determines how resourceVersion is applied to list calls.
+	// It is highly recommended that resourceVersionMatch be set for list calls where
+	// resourceVersion is set
+	// See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+	// details.
+	//
+	// Defaults to unset
+	// +optional
+	ResourceVersionMatch ResourceVersionMatch `json:"resourceVersionMatch,omitempty" protobuf:"bytes,10,opt,name=resourceVersionMatch,casttype=ResourceVersionMatch"`
+	// Timeout for the list/watch call.
+	// This limits the duration of the call, regardless of any activity or inactivity.
+	// +optional
+	TimeoutSeconds *int64 `json:"timeoutSeconds,omitempty" protobuf:"varint,5,opt,name=timeoutSeconds"`
+
+	// limit is a maximum number of responses to return for a list call. If more items exist, the
+	// server will set the `continue` field on the list metadata to a value that can be used with the
+	// same initial query to retrieve the next set of results. Setting a limit may return fewer than
+	// the requested amount of items (up to zero items) in the event all requested objects are
+	// filtered out and clients should only use the presence of the continue field to determine whether
+	// more results are available. Servers may choose not to support the limit argument and will return
+	// all of the available results. If limit is specified and the continue field is empty, clients may
+	// assume that no more results are available. This field is not supported if watch is true.
+	//
+	// The server guarantees that the objects returned when using continue will be identical to issuing
+	// a single list call without a limit - that is, no objects created, modified, or deleted after the
+	// first request is issued will be included in any subsequent continued requests. This is sometimes
+	// referred to as a consistent snapshot, and ensures that a client that is using limit to receive
+	// smaller chunks of a very large result can ensure they see all possible objects. If objects are
+	// updated during a chunked list the version of the object that was present at the time the first list
+	// result was calculated is returned.
+	Limit int64 `json:"limit,omitempty" protobuf:"varint,7,opt,name=limit"`
+	// The continue option should be set when retrieving more results from the server. Since this value is
+	// server defined, clients may only use the continue value from a previous query result with identical
+	// query parameters (except for the value of continue) and the server may reject a continue value it
+	// does not recognize. If the specified continue value is no longer valid whether due to expiration
+	// (generally five to fifteen minutes) or a configuration change on the server, the server will
+	// respond with a 410 ResourceExpired error together with a continue token. If the client needs a
+	// consistent list, it must restart their list without the continue field. Otherwise, the client may
+	// send another list request with the token received with the 410 error, the server will respond with
+	// a list starting from the next key, but from the latest snapshot, which is inconsistent from the
+	// previous list results - objects that are created, modified, or deleted after the first list request
+	// will be included in the response, as long as their keys are after the "next key".
+	//
+	// This field is not supported when watch is true. Clients may start a watch from the last
+	// resourceVersion value returned by the server and not miss any modifications.
+	Continue string `json:"continue,omitempty" protobuf:"bytes,8,opt,name=continue"`
+
+	// `sendInitialEvents=true` may be set together with `watch=true`.
+	// In that case, the watch stream will begin with synthetic events to
+	// produce the current state of objects in the collection. Once all such
+	// events have been sent, a synthetic "Bookmark" event  will be sent.
+	// The bookmark will report the ResourceVersion (RV) corresponding to the
+	// set of objects, and be marked with `"k8s.io/initial-events-end": "true"` annotation.
+	// Afterwards, the watch stream will proceed as usual, sending watch events
+	// corresponding to changes (subsequent to the RV) to objects watched.
+	//
+	// When `sendInitialEvents` option is set, we require `resourceVersionMatch`
+	// option to also be set. The semantic of the watch request is as following:
+	// - `resourceVersionMatch` = NotOlderThan
+	//   is interpreted as "data at least as new as the provided `resourceVersion`"
+	//   and the bookmark event is send when the state is synced
+	//   to a `resourceVersion` at least as fresh as the one provided by the ListOptions.
+	//   If `resourceVersion` is unset, this is interpreted as "consistent read" and the
+	//   bookmark event is send when the state is synced at least to the moment
+	//   when request started being processed.
+	// - `resourceVersionMatch` set to any other value or unset
+	//   Invalid error is returned.
+	//
+	// Defaults to true if `resourceVersion=""` or `resourceVersion="0"` (for backward
+	// compatibility reasons) and to false otherwise.
+	// +optional
+	SendInitialEvents *bool `json:"sendInitialEvents,omitempty" protobuf:"varint,11,opt,name=sendInitialEvents"`
+
+	// shardSelector restricts the list of returned objects using a CEL-based
+	// shard selector expression. The format uses the shardRange() function
+	// combined with || (logical OR) to specify one or more hash ranges:
+	//
+	//   shardRange(object.metadata.uid, '0x0', '0x8000000000000000')
+	//   shardRange(object.metadata.uid, '0x0', '0x8000000000000000') || shardRange(object.metadata.uid, '0x8000000000000000', '0x10000000000000000')
+	//
+	// Field paths use CEL-style object-rooted syntax (e.g. "object.metadata.uid"),
+	// NOT the fieldSelector format ("metadata.uid"). Currently supported paths:
+	//   - object.metadata.uid
+	//   - object.metadata.namespace
+	//
+	// hexStart and hexEnd are single-quoted CEL string literals with a '0x' prefix,
+	// defining the inclusive lower and exclusive upper bounds over the 64-bit FNV-1a
+	// hash space. The full range is [0x0, 0x10000000000000000), where the exclusive
+	// upper bound equals 2^64.
+	//
+	// Examples:
+	//   2-shard split:
+	//     shard 0: shardRange(object.metadata.uid, '0x0000000000000000', '0x8000000000000000')
+	//     shard 1: shardRange(object.metadata.uid, '0x8000000000000000', '0x10000000000000000')
+	//   4-shard split:
+	//     shard 0: shardRange(object.metadata.uid, '0x0000000000000000', '0x4000000000000000')
+	//     shard 1: shardRange(object.metadata.uid, '0x4000000000000000', '0x8000000000000000')
+	//     shard 2: shardRange(object.metadata.uid, '0x8000000000000000', '0xc000000000000000')
+	//     shard 3: shardRange(object.metadata.uid, '0xc000000000000000', '0x10000000000000000')
+	//
+	// This is an alpha field and requires enabling the ShardedListAndWatch feature gate.
+	// +featureGate=ShardedListAndWatch
+	// +optional
+	ShardSelector string `json:"shardSelector,omitempty" protobuf:"bytes,15,opt,name=shardSelector"`
+}
+
+const (
+	// InitialEventsAnnotationKey the name of the key
+	// under which an annotation marking the end of
+	// a watchlist stream is stored.
+	//
+	// The annotation is added to a "Bookmark" event.
+	InitialEventsAnnotationKey = "k8s.io/initial-events-end"
+)
+
+// resourceVersionMatch specifies how the resourceVersion parameter is applied. resourceVersionMatch
+// may only be set if resourceVersion is also set.
+//
+// "NotOlderThan" matches data at least as new as the provided resourceVersion.
+// "Exact" matches data at the exact resourceVersion provided.
+//
+// See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+// details.
+type ResourceVersionMatch string
+
+const (
+	// ResourceVersionMatchNotOlderThan matches data at least as new as the provided
+	// resourceVersion.
+	ResourceVersionMatchNotOlderThan ResourceVersionMatch = "NotOlderThan"
+	// ResourceVersionMatchExact matches data at the exact resourceVersion
+	// provided.
+	ResourceVersionMatchExact ResourceVersionMatch = "Exact"
+)
+
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// GetOptions is the standard query options to the standard REST get call.
+type GetOptions struct {
+	TypeMeta `json:""`
+	// resourceVersion sets a constraint on what resource versions a request may be served from.
+	// See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
+	// details.
+	//
+	// Defaults to unset
+	// +optional
+	ResourceVersion string `json:"resourceVersion,omitempty" protobuf:"bytes,1,opt,name=resourceVersion"`
+	// +k8s:deprecated=includeUninitialized,protobuf=2
+}
+
+// DeletionPropagation decides if a deletion will propagate to the dependents of
+// the object, and how the garbage collector will handle the propagation.
+type DeletionPropagation string
+
+const (
+	// Orphans the dependents.
+	DeletePropagationOrphan DeletionPropagation = "Orphan"
+	// Deletes the object from the key-value store, the garbage collector will
+	// delete the dependents in the background.
+	DeletePropagationBackground DeletionPropagation = "Background"
+	// The object exists in the key-value store until the garbage collector
+	// deletes all the dependents whose ownerReference.blockOwnerDeletion=true
+	// from the key-value store.  API sever will put the "foregroundDeletion"
+	// finalizer on the object, and sets its deletionTimestamp.  This policy is
+	// cascading, i.e., the dependents will be deleted with Foreground.
+	DeletePropagationForeground DeletionPropagation = "Foreground"
+)
+
+const (
+	// DryRunAll means to complete all processing stages, but don't
+	// persist changes to storage.
+	DryRunAll = "All"
+)
+
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// DeleteOptions may be provided when deleting an API object.
+type DeleteOptions struct {
+	TypeMeta `json:""`
+
+	// The duration in seconds before the object should be deleted. Value must be non-negative integer.
+	// The value zero indicates delete immediately. If this value is nil, the default grace period for the
+	// specified type will be used.
+	// Defaults to a per object value if not specified. zero means delete immediately.
+	// +optional
+	GracePeriodSeconds *int64 `json:"gracePeriodSeconds,omitempty" protobuf:"varint,1,opt,name=gracePeriodSeconds"`
+
+	// Must be fulfilled before a deletion is carried out. If not possible, a 409 Conflict status will be
+	// returned.
+	// +k8s:conversion-gen=false
+	// +optional
+	Preconditions *Preconditions `json:"preconditions,omitempty" protobuf:"bytes,2,opt,name=preconditions"`
+
+	// Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7.
+	// Should the dependent objects be orphaned. If true/false, the "orphan"
+	// finalizer will be added to/removed from the object's finalizers list.
+	// Either this field or PropagationPolicy may be set, but not both.
+	// +optional
+	OrphanDependents *bool `json:"orphanDependents,omitempty" protobuf:"varint,3,opt,name=orphanDependents"`
+
+	// Whether and how garbage collection will be performed.
+	// Either this field or OrphanDependents may be set, but not both.
+	// The default policy is decided by the existing finalizer set in the
+	// metadata.finalizers and the resource-specific default policy.
+	// Acceptable values are: 'Orphan' - orphan the dependents; 'Background' -
+	// allow the garbage collector to delete the dependents in the background;
+	// 'Foreground' - a cascading policy that deletes all dependents in the
+	// foreground.
+	// +optional
+	PropagationPolicy *DeletionPropagation `json:"propagationPolicy,omitempty" protobuf:"varint,4,opt,name=propagationPolicy"`
+
+	// When present, indicates that modifications should not be
+	// persisted. An invalid or unrecognized dryRun directive will
+	// result in an error response and no further processing of the
+	// request. Valid values are:
+	// - All: all dry run stages will be processed
+	// +optional
+	// +listType=atomic
+	DryRun []string `json:"dryRun,omitempty" protobuf:"bytes,5,rep,name=dryRun"`
+
+	// if set to true, it will trigger an unsafe deletion of the resource in
+	// case the normal deletion flow fails with a corrupt object error.
+	// A resource is considered corrupt if it can not be retrieved from
+	// the underlying storage successfully because of a) its data can
+	// not be transformed e.g. decryption failure, or b) it fails
+	// to decode into an object.
+	// NOTE: unsafe deletion ignores finalizer constraints, skips
+	// precondition checks, and removes the object from the storage.
+	// WARNING: This may potentially break the cluster if the workload
+	// associated with the resource being unsafe-deleted relies on normal
+	// deletion flow. Use only if you REALLY know what you are doing.
+	// The default value is false, and the user must opt in to enable it
+	// +optional
+	IgnoreStoreReadErrorWithClusterBreakingPotential *bool `json:"ignoreStoreReadErrorWithClusterBreakingPotential,omitempty" protobuf:"varint,6,opt,name=ignoreStoreReadErrorWithClusterBreakingPotential"`
+}
+
+const (
+	// FieldValidationIgnore ignores unknown/duplicate fields
+	FieldValidationIgnore = "Ignore"
+	// FieldValidationWarn responds with a warning, but successfully serve the request
+	FieldValidationWarn = "Warn"
+	// FieldValidationStrict fails the request on unknown/duplicate fields
+	FieldValidationStrict = "Strict"
+)
+
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// CreateOptions may be provided when creating an API object.
+type CreateOptions struct {
+	TypeMeta `json:""`
+
+	// When present, indicates that modifications should not be
+	// persisted. An invalid or unrecognized dryRun directive will
+	// result in an error response and no further processing of the
+	// request. Valid values are:
+	// - All: all dry run stages will be processed
+	// +optional
+	// +listType=atomic
+	DryRun []string `json:"dryRun,omitempty" protobuf:"bytes,1,rep,name=dryRun"`
+	// +k8s:deprecated=includeUninitialized,protobuf=2
+
+	// fieldManager is a name associated with the actor or entity
+	// that is making these changes. The value must be less than or
+	// 128 characters long, and only contain printable characters,
+	// as defined by https://golang.org/pkg/unicode/#IsPrint.
+	// +optional
+	FieldManager string `json:"fieldManager,omitempty" protobuf:"bytes,3,name=fieldManager"`
+
+	// fieldValidation instructs the server on how to handle
+	// objects in the request (POST/PUT/PATCH) containing unknown
+	// or duplicate fields. Valid values are:
+	// - Ignore: This will ignore any unknown fields that are silently
+	// dropped from the object, and will ignore all but the last duplicate
+	// field that the decoder encounters. This is the default behavior
+	// prior to v1.23.
+	// - Warn: This will send a warning via the standard warning response
+	// header for each unknown field that is dropped from the object, and
+	// for each duplicate field that is encountered. The request will
+	// still succeed if there are no other errors, and will only persist
+	// the last of any duplicate fields. This is the default in v1.23+
+	// - Strict: This will fail the request with a BadRequest error if
+	// any unknown fields would be dropped from the object, or if any
+	// duplicate fields are present. The error returned from the server
+	// will contain all unknown and duplicate fields encountered.
+	// +optional
+	FieldValidation string `json:"fieldValidation,omitempty" protobuf:"bytes,4,name=fieldValidation"`
+}
+
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// PatchOptions may be provided when patching an API object.
+// PatchOptions is meant to be a superset of UpdateOptions.
+type PatchOptions struct {
+	TypeMeta `json:""`
+
+	// When present, indicates that modifications should not be
+	// persisted. An invalid or unrecognized dryRun directive will
+	// result in an error response and no further processing of the
+	// request. Valid values are:
+	// - All: all dry run stages will be processed
+	// +optional
+	// +listType=atomic
+	DryRun []string `json:"dryRun,omitempty" protobuf:"bytes,1,rep,name=dryRun"`
+
+	// Force is going to "force" Apply requests. It means user will
+	// re-acquire conflicting fields owned by other people. Force
+	// flag must be unset for non-apply patch requests.
+	// +optional
+	Force *bool `json:"force,omitempty" protobuf:"varint,2,opt,name=force"`
+
+	// fieldManager is a name associated with the actor or entity
+	// that is making these changes. The value must be less than or
+	// 128 characters long, and only contain printable characters,
+	// as defined by https://golang.org/pkg/unicode/#IsPrint. This
+	// field is required for apply requests
+	// (application/apply-patch) but optional for non-apply patch
+	// types (JsonPatch, MergePatch, StrategicMergePatch).
+	// +optional
+	FieldManager string `json:"fieldManager,omitempty" protobuf:"bytes,3,name=fieldManager"`
+
+	// fieldValidation instructs the server on how to handle
+	// objects in the request (POST/PUT/PATCH) containing unknown
+	// or duplicate fields. Valid values are:
+	// - Ignore: This will ignore any unknown fields that are silently
+	// dropped from the object, and will ignore all but the last duplicate
+	// field that the decoder encounters. This is the default behavior
+	// prior to v1.23.
+	// - Warn: This will send a warning via the standard warning response
+	// header for each unknown field that is dropped from the object, and
+	// for each duplicate field that is encountered. The request will
+	// still succeed if there are no other errors, and will only persist
+	// the last of any duplicate fields. This is the default in v1.23+
+	// - Strict: This will fail the request with a BadRequest error if
+	// any unknown fields would be dropped from the object, or if any
+	// duplicate fields are present. The error returned from the server
+	// will contain all unknown and duplicate fields encountered.
+	// +optional
+	FieldValidation string `json:"fieldValidation,omitempty" protobuf:"bytes,4,name=fieldValidation"`
+}
+
+// ApplyOptions may be provided when applying an API object.
+// FieldManager is required for apply requests.
+// ApplyOptions is equivalent to PatchOptions. It is provided as a convenience with documentation
+// that speaks specifically to how the options fields relate to apply.
+type ApplyOptions struct {
+	TypeMeta `json:""`
+
+	// When present, indicates that modifications should not be
+	// persisted. An invalid or unrecognized dryRun directive will
+	// result in an error response and no further processing of the
+	// request. Valid values are:
+	// - All: all dry run stages will be processed
+	// +optional
+	// +listType=atomic
+	DryRun []string `json:"dryRun,omitempty" protobuf:"bytes,1,rep,name=dryRun"`
+
+	// Force is going to "force" Apply requests. It means user will
+	// re-acquire conflicting fields owned by other people.
+	Force bool `json:"force" protobuf:"varint,2,opt,name=force"`
+
+	// fieldManager is a name associated with the actor or entity
+	// that is making these changes. The value must be less than or
+	// 128 characters long, and only contain printable characters,
+	// as defined by https://golang.org/pkg/unicode/#IsPrint. This
+	// field is required.
+	FieldManager string `json:"fieldManager" protobuf:"bytes,3,name=fieldManager"`
+}
+
+func (o ApplyOptions) ToPatchOptions() PatchOptions {
+	return PatchOptions{DryRun: o.DryRun, Force: &o.Force, FieldManager: o.FieldManager}
+}
+
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// UpdateOptions may be provided when updating an API object.
+// All fields in UpdateOptions should also be present in PatchOptions.
+type UpdateOptions struct {
+	TypeMeta `json:""`
+
+	// When present, indicates that modifications should not be
+	// persisted. An invalid or unrecognized dryRun directive will
+	// result in an error response and no further processing of the
+	// request. Valid values are:
+	// - All: all dry run stages will be processed
+	// +optional
+	// +listType=atomic
+	DryRun []string `json:"dryRun,omitempty" protobuf:"bytes,1,rep,name=dryRun"`
+
+	// fieldManager is a name associated with the actor or entity
+	// that is making these changes. The value must be less than or
+	// 128 characters long, and only contain printable characters,
+	// as defined by https://golang.org/pkg/unicode/#IsPrint.
+	// +optional
+	FieldManager string `json:"fieldManager,omitempty" protobuf:"bytes,2,name=fieldManager"`
+
+	// fieldValidation instructs the server on how to handle
+	// objects in the request (POST/PUT/PATCH) containing unknown
+	// or duplicate fields. Valid values are:
+	// - Ignore: This will ignore any unknown fields that are silently
+	// dropped from the object, and will ignore all but the last duplicate
+	// field that the decoder encounters. This is the default behavior
+	// prior to v1.23.
+	// - Warn: This will send a warning via the standard warning response
+	// header for each unknown field that is dropped from the object, and
+	// for each duplicate field that is encountered. The request will
+	// still succeed if there are no other errors, and will only persist
+	// the last of any duplicate fields. This is the default in v1.23+
+	// - Strict: This will fail the request with a BadRequest error if
+	// any unknown fields would be dropped from the object, or if any
+	// duplicate fields are present. The error returned from the server
+	// will contain all unknown and duplicate fields encountered.
+	// +optional
+	FieldValidation string `json:"fieldValidation,omitempty" protobuf:"bytes,3,name=fieldValidation"`
+}
+
+// Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.
+type Preconditions struct {
+	// Specifies the target UID.
+	// +optional
+	UID *types.UID `json:"uid,omitempty" protobuf:"bytes,1,opt,name=uid,casttype=k8s.io/apimachinery/pkg/types.UID"`
+	// Specifies the target ResourceVersion
+	// +optional
+	ResourceVersion *string `json:"resourceVersion,omitempty" protobuf:"bytes,2,opt,name=resourceVersion"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// Status is a return value for calls that don't return other objects.
+type Status struct {
+	TypeMeta `json:""`
+	// Standard list metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// Status of the operation.
+	// One of: "Success" or "Failure".
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	// +optional
+	Status string `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
+	// A human-readable description of the status of this operation.
+	// +optional
+	Message string `json:"message,omitempty" protobuf:"bytes,3,opt,name=message"`
+	// A machine-readable description of why this operation is in the
+	// "Failure" status. If this value is empty there
+	// is no information available. A Reason clarifies an HTTP status
+	// code but does not override it.
+	// +optional
+	Reason StatusReason `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason,casttype=StatusReason"`
+	// Extended data associated with the reason.  Each reason may define its
+	// own extended details. This field is optional and the data returned
+	// is not guaranteed to conform to any schema except that defined by
+	// the reason type.
+	// +optional
+	Details *StatusDetails `json:"details,omitempty" protobuf:"bytes,5,opt,name=details"`
+	// Suggested HTTP return code for this status, 0 if not set.
+	// +optional
+	Code int32 `json:"code,omitempty" protobuf:"varint,6,opt,name=code"`
+}
+
+// StatusDetails is a set of additional properties that MAY be set by the
+// server to provide additional information about a response. The Reason
+// field of a Status object defines what attributes will be set. Clients
+// must ignore fields that do not match the defined type of each attribute,
+// and should assume that any attribute may be empty, invalid, or under
+// defined.
+type StatusDetails struct {
+	// The name attribute of the resource associated with the status StatusReason
+	// (when there is a single name which can be described).
+	// +optional
+	Name string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name"`
+	// The group attribute of the resource associated with the status StatusReason.
+	// +optional
+	Group string `json:"group,omitempty" protobuf:"bytes,2,opt,name=group"`
+	// The kind attribute of the resource associated with the status StatusReason.
+	// On some operations may differ from the requested resource Kind.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	Kind string `json:"kind,omitempty" protobuf:"bytes,3,opt,name=kind"`
+	// UID of the resource.
+	// (when there is a single resource which can be described).
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+	// +optional
+	UID types.UID `json:"uid,omitempty" protobuf:"bytes,6,opt,name=uid,casttype=k8s.io/apimachinery/pkg/types.UID"`
+	// The Causes array includes more details associated with the StatusReason
+	// failure. Not all StatusReasons may provide detailed causes.
+	// +optional
+	// +listType=atomic
+	Causes []StatusCause `json:"causes,omitempty" protobuf:"bytes,4,rep,name=causes"`
+	// If specified, the time in seconds before the operation should be retried. Some errors may indicate
+	// the client must take an alternate action - for those errors this field may indicate how long to wait
+	// before taking the alternate action.
+	// +optional
+	RetryAfterSeconds int32 `json:"retryAfterSeconds,omitempty" protobuf:"varint,5,opt,name=retryAfterSeconds"`
+}
+
+// Values of Status.Status
+const (
+	StatusSuccess = "Success"
+	StatusFailure = "Failure"
+)
+
+// StatusReason is an enumeration of possible failure causes.  Each StatusReason
+// must map to a single HTTP status code, but multiple reasons may map
+// to the same HTTP status code.
+// TODO: move to apiserver
+type StatusReason string
+
+const (
+	// StatusReasonUnknown means the server has declined to indicate a specific reason.
+	// The details field may contain other information about this error.
+	// Status code 500.
+	StatusReasonUnknown StatusReason = ""
+
+	// StatusReasonUnauthorized means the server can be reached and understood the request, but requires
+	// the user to present appropriate authorization credentials (identified by the WWW-Authenticate header)
+	// in order for the action to be completed. If the user has specified credentials on the request, the
+	// server considers them insufficient.
+	// Status code 401
+	StatusReasonUnauthorized StatusReason = "Unauthorized"
+
+	// StatusReasonForbidden means the server can be reached and understood the request, but refuses
+	// to take any further action.  It is the result of the server being configured to deny access for some reason
+	// to the requested resource by the client.
+	// Details (optional):
+	//   "kind" string - the kind attribute of the forbidden resource
+	//                   on some operations may differ from the requested
+	//                   resource.
+	//   "id"   string - the identifier of the forbidden resource
+	// Status code 403
+	StatusReasonForbidden StatusReason = "Forbidden"
+
+	// StatusReasonNotFound means one or more resources required for this operation
+	// could not be found.
+	// Details (optional):
+	//   "kind" string - the kind attribute of the missing resource
+	//                   on some operations may differ from the requested
+	//                   resource.
+	//   "id"   string - the identifier of the missing resource
+	// Status code 404
+	StatusReasonNotFound StatusReason = "NotFound"
+
+	// StatusReasonAlreadyExists means the resource you are creating already exists.
+	// Details (optional):
+	//   "kind" string - the kind attribute of the conflicting resource
+	//   "id"   string - the identifier of the conflicting resource
+	// Status code 409
+	StatusReasonAlreadyExists StatusReason = "AlreadyExists"
+
+	// StatusReasonConflict means the requested operation cannot be completed
+	// due to a conflict in the operation. The client may need to alter the
+	// request. Each resource may define custom details that indicate the
+	// nature of the conflict.
+	// Status code 409
+	StatusReasonConflict StatusReason = "Conflict"
+
+	// StatusReasonGone means the item is no longer available at the server and no
+	// forwarding address is known.
+	// Status code 410
+	StatusReasonGone StatusReason = "Gone"
+
+	// StatusReasonInvalid means the requested create or update operation cannot be
+	// completed due to invalid data provided as part of the request. The client may
+	// need to alter the request. When set, the client may use the StatusDetails
+	// message field as a summary of the issues encountered.
+	// Details (optional):
+	//   "kind" string - the kind attribute of the invalid resource
+	//   "id"   string - the identifier of the invalid resource
+	//   "causes"      - one or more StatusCause entries indicating the data in the
+	//                   provided resource that was invalid.  The code, message, and
+	//                   field attributes will be set.
+	// Status code 422
+	StatusReasonInvalid StatusReason = "Invalid"
+
+	// StatusReasonServerTimeout means the server can be reached and understood the request,
+	// but cannot complete the action in a reasonable time. The client should retry the request.
+	// This is may be due to temporary server load or a transient communication issue with
+	// another server. Status code 500 is used because the HTTP spec provides no suitable
+	// server-requested client retry and the 5xx class represents actionable errors.
+	// Details (optional):
+	//   "kind" string - the kind attribute of the resource being acted on.
+	//   "id"   string - the operation that is being attempted.
+	//   "retryAfterSeconds" int32 - the number of seconds before the operation should be retried
+	// Status code 500
+	StatusReasonServerTimeout StatusReason = "ServerTimeout"
+
+	// StatusReasonStoreReadError means that the server encountered an error while
+	// retrieving resources from the backend object store.
+	// This may be due to backend database error, or because processing of the read
+	// resource failed.
+	// Details:
+	//   "kind" string - the kind attribute of the resource being acted on.
+	//   "name" string - the prefix where the reading error(s) occurred
+	//   "causes" []StatusCause
+	//      - (optional):
+	//        - "type" CauseType - CauseTypeUnexpectedServerResponse
+	//        - "message" string - the error message from the store backend
+	//        - "field" string - the full path with the key of the resource that failed reading
+	//
+	// Status code 500
+	StatusReasonStoreReadError StatusReason = "StorageReadError"
+
+	// StatusReasonTimeout means that the request could not be completed within the given time.
+	// Clients can get this response only when they specified a timeout param in the request,
+	// or if the server cannot complete the operation within a reasonable amount of time.
+	// The request might succeed with an increased value of timeout param. The client *should*
+	// wait at least the number of seconds specified by the retryAfterSeconds field.
+	// Details (optional):
+	//   "retryAfterSeconds" int32 - the number of seconds before the operation should be retried
+	// Status code 504
+	StatusReasonTimeout StatusReason = "Timeout"
+
+	// StatusReasonTooManyRequests means the server experienced too many requests within a
+	// given window and that the client must wait to perform the action again. A client may
+	// always retry the request that led to this error, although the client should wait at least
+	// the number of seconds specified by the retryAfterSeconds field.
+	// Details (optional):
+	//   "retryAfterSeconds" int32 - the number of seconds before the operation should be retried
+	// Status code 429
+	StatusReasonTooManyRequests StatusReason = "TooManyRequests"
+
+	// StatusReasonBadRequest means that the request itself was invalid, because the request
+	// doesn't make any sense, for example deleting a read-only object.  This is different than
+	// StatusReasonInvalid above which indicates that the API call could possibly succeed, but the
+	// data was invalid.  API calls that return BadRequest can never succeed.
+	// Status code 400
+	StatusReasonBadRequest StatusReason = "BadRequest"
+
+	// StatusReasonMethodNotAllowed means that the action the client attempted to perform on the
+	// resource was not supported by the code - for instance, attempting to delete a resource that
+	// can only be created. API calls that return MethodNotAllowed can never succeed.
+	// Status code 405
+	StatusReasonMethodNotAllowed StatusReason = "MethodNotAllowed"
+
+	// StatusReasonNotAcceptable means that the accept types indicated by the client were not acceptable
+	// to the server - for instance, attempting to receive protobuf for a resource that supports only json and yaml.
+	// API calls that return NotAcceptable can never succeed.
+	// Status code 406
+	StatusReasonNotAcceptable StatusReason = "NotAcceptable"
+
+	// StatusReasonRequestEntityTooLarge means that the request entity is too large.
+	// Status code 413
+	StatusReasonRequestEntityTooLarge StatusReason = "RequestEntityTooLarge"
+
+	// StatusReasonUnsupportedMediaType means that the content type sent by the client is not acceptable
+	// to the server - for instance, attempting to send protobuf for a resource that supports only json and yaml.
+	// API calls that return UnsupportedMediaType can never succeed.
+	// Status code 415
+	StatusReasonUnsupportedMediaType StatusReason = "UnsupportedMediaType"
+
+	// StatusReasonInternalError indicates that an internal error occurred, it is unexpected
+	// and the outcome of the call is unknown.
+	// Details (optional):
+	//   "causes" - The original error
+	// Status code 500
+	StatusReasonInternalError StatusReason = "InternalError"
+
+	// StatusReasonExpired indicates that the request is invalid because the content you are requesting
+	// has expired and is no longer available. It is typically associated with watches that can't be
+	// serviced.
+	// Status code 410 (gone)
+	StatusReasonExpired StatusReason = "Expired"
+
+	// StatusReasonServiceUnavailable means that the request itself was valid,
+	// but the requested service is unavailable at this time.
+	// Retrying the request after some time might succeed.
+	// Status code 503
+	StatusReasonServiceUnavailable StatusReason = "ServiceUnavailable"
+)
+
+// StatusCause provides more information about an api.Status failure, including
+// cases when multiple errors are encountered.
+type StatusCause struct {
+	// A machine-readable description of the cause of the error. If this value is
+	// empty there is no information available.
+	// +optional
+	Type CauseType `json:"reason,omitempty" protobuf:"bytes,1,opt,name=reason,casttype=CauseType"`
+	// A human-readable description of the cause of the error.  This field may be
+	// presented as-is to a reader.
+	// +optional
+	Message string `json:"message,omitempty" protobuf:"bytes,2,opt,name=message"`
+	// The field of the resource that has caused this error, as named by its JSON
+	// serialization. May include dot and postfix notation for nested attributes.
+	// Arrays are zero-indexed.  Fields may appear more than once in an array of
+	// causes due to fields having multiple errors.
+	// Optional.
+	//
+	// Examples:
+	//   "name" - the field "name" on the current resource
+	//   "items[0].name" - the field "name" on the first array entry in "items"
+	// +optional
+	Field string `json:"field,omitempty" protobuf:"bytes,3,opt,name=field"`
+}
+
+// CauseType is a machine readable value providing more detail about what
+// occurred in a status response. An operation may have multiple causes for a
+// status (whether Failure or Success).
+type CauseType string
+
+const (
+	// CauseTypeFieldValueNotFound is used to report failure to find a requested value
+	// (e.g. looking up an ID).
+	CauseTypeFieldValueNotFound CauseType = "FieldValueNotFound"
+	// CauseTypeFieldValueRequired is used to report required values that are not
+	// provided (e.g. empty strings, null values, or empty arrays).
+	CauseTypeFieldValueRequired CauseType = "FieldValueRequired"
+	// CauseTypeFieldValueDuplicate is used to report collisions of values that must be
+	// unique (e.g. unique IDs).
+	CauseTypeFieldValueDuplicate CauseType = "FieldValueDuplicate"
+	// CauseTypeFieldValueInvalid is used to report malformed values (e.g. failed regex
+	// match).
+	CauseTypeFieldValueInvalid CauseType = "FieldValueInvalid"
+	// CauseTypeFieldValueNotSupported is used to report valid (as per formatting rules)
+	// values that can not be handled (e.g. an enumerated string).
+	CauseTypeFieldValueNotSupported CauseType = "FieldValueNotSupported"
+	// CauseTypeForbidden is used to report valid (as per formatting rules)
+	// values which would be accepted under some conditions, but which are not
+	// permitted by the current conditions (such as security policy).  See
+	// Forbidden().
+	CauseTypeForbidden CauseType = "FieldValueForbidden"
+	// CauseTypeTooLong is used to report that the given value is too long.
+	// This is similar to ErrorTypeInvalid, but the error will not include the
+	// too-long value.  See TooLong().
+	CauseTypeTooLong CauseType = "FieldValueTooLong"
+	// CauseTypeTooMany is used to report "too many". This is used to
+	// report that a given list has too many items. This is similar to FieldValueTooLong,
+	// but the error indicates quantity instead of length.
+	CauseTypeTooMany CauseType = "FieldValueTooMany"
+	// CauseTypeInternal is used to report other errors that are not related
+	// to user input.  See InternalError().
+	CauseTypeInternal CauseType = "InternalError"
+	// CauseTypeTypeInvalid is for the value did not match the schema type for that field
+	CauseTypeTypeInvalid CauseType = "FieldValueTypeInvalid"
+	// CauseTypeUnexpectedServerResponse is used to report when the server responded to the client
+	// without the expected return type. The presence of this cause indicates the error may be
+	// due to an intervening proxy or the server software malfunctioning.
+	CauseTypeUnexpectedServerResponse CauseType = "UnexpectedServerResponse"
+	// FieldManagerConflict is used to report when another client claims to manage this field,
+	// It should only be returned for a request using server-side apply.
+	CauseTypeFieldManagerConflict CauseType = "FieldManagerConflict"
+	// CauseTypeResourceVersionTooLarge is used to report that the requested resource version
+	// is newer than the data observed by the API server, so the request cannot be served.
+	CauseTypeResourceVersionTooLarge CauseType = "ResourceVersionTooLarge"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// List holds a list of objects, which may not be known by the server.
+type List struct {
+	TypeMeta `json:""`
+	// Standard list metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// List of objects
+	Items []runtime.RawExtension `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+// APIVersions lists the versions that are available, to allow clients to
+// discover the API at /api, which is the root path of the legacy v1 API.
+//
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type APIVersions struct {
+	TypeMeta `json:""`
+	// versions are the api versions that are available.
+	// +listType=atomic
+	Versions []string `json:"versions" protobuf:"bytes,1,rep,name=versions"`
+	// a map of client CIDR to server address that is serving this group.
+	// This is to help clients reach servers in the most network-efficient way possible.
+	// Clients can use the appropriate server address as per the CIDR that they match.
+	// In case of multiple matches, clients should use the longest matching CIDR.
+	// The server returns only those CIDRs that it thinks that the client can match.
+	// For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP.
+	// Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.
+	// +listType=atomic
+	ServerAddressByClientCIDRs []ServerAddressByClientCIDR `json:"serverAddressByClientCIDRs" protobuf:"bytes,2,rep,name=serverAddressByClientCIDRs"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// APIGroupList is a list of APIGroup, to allow clients to discover the API at
+// /apis.
+type APIGroupList struct {
+	TypeMeta `json:""`
+	// groups is a list of APIGroup.
+	// +listType=atomic
+	Groups []APIGroup `json:"groups" protobuf:"bytes,1,rep,name=groups"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// APIGroup contains the name, the supported versions, and the preferred version
+// of a group.
+type APIGroup struct {
+	TypeMeta `json:""`
+	// name is the name of the group.
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+	// versions are the versions supported in this group.
+	// +listType=atomic
+	Versions []GroupVersionForDiscovery `json:"versions" protobuf:"bytes,2,rep,name=versions"`
+	// preferredVersion is the version preferred by the API server, which
+	// probably is the storage version.
+	// +optional
+	PreferredVersion GroupVersionForDiscovery `json:"preferredVersion,omitempty" protobuf:"bytes,3,opt,name=preferredVersion"`
+	// a map of client CIDR to server address that is serving this group.
+	// This is to help clients reach servers in the most network-efficient way possible.
+	// Clients can use the appropriate server address as per the CIDR that they match.
+	// In case of multiple matches, clients should use the longest matching CIDR.
+	// The server returns only those CIDRs that it thinks that the client can match.
+	// For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP.
+	// Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.
+	// +optional
+	// +listType=atomic
+	ServerAddressByClientCIDRs []ServerAddressByClientCIDR `json:"serverAddressByClientCIDRs,omitempty" protobuf:"bytes,4,rep,name=serverAddressByClientCIDRs"`
+}
+
+// ServerAddressByClientCIDR helps the client to determine the server address that they should use, depending on the clientCIDR that they match.
+type ServerAddressByClientCIDR struct {
+	// The CIDR with which clients can match their IP to figure out the server address that they should use.
+	ClientCIDR string `json:"clientCIDR" protobuf:"bytes,1,opt,name=clientCIDR"`
+	// Address of this server, suitable for a client that matches the above CIDR.
+	// This can be a hostname, hostname:port, IP or IP:port.
+	ServerAddress string `json:"serverAddress" protobuf:"bytes,2,opt,name=serverAddress"`
+}
+
+// GroupVersion contains the "group/version" and "version" string of a version.
+// It is made a struct to keep extensibility.
+type GroupVersionForDiscovery struct {
+	// groupVersion specifies the API group and version in the form "group/version"
+	GroupVersion string `json:"groupVersion" protobuf:"bytes,1,opt,name=groupVersion"`
+	// version specifies the version in the form of "version". This is to save
+	// the clients the trouble of splitting the GroupVersion.
+	Version string `json:"version" protobuf:"bytes,2,opt,name=version"`
+}
+
+// APIResource specifies the name of a resource and whether it is namespaced.
+type APIResource struct {
+	// name is the plural name of the resource.
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+	// singularName is the singular name of the resource.  This allows clients to handle plural and singular opaquely.
+	// The singularName is more correct for reporting status on a single item and both singular and plural are allowed
+	// from the kubectl CLI interface.
+	SingularName string `json:"singularName" protobuf:"bytes,6,opt,name=singularName"`
+	// namespaced indicates if a resource is namespaced or not.
+	Namespaced bool `json:"namespaced" protobuf:"varint,2,opt,name=namespaced"`
+	// group is the preferred group of the resource.  Empty implies the group of the containing resource list.
+	// For subresources, this may have a different value, for example: Scale".
+	Group string `json:"group,omitempty" protobuf:"bytes,8,opt,name=group"`
+	// version is the preferred version of the resource.  Empty implies the version of the containing resource list
+	// For subresources, this may have a different value, for example: v1 (while inside a v1beta1 version of the core resource's group)".
+	Version string `json:"version,omitempty" protobuf:"bytes,9,opt,name=version"`
+	// kind is the kind for the resource (e.g. 'Foo' is the kind for a resource 'foo')
+	Kind string `json:"kind" protobuf:"bytes,3,opt,name=kind"`
+	// verbs is a list of supported kube verbs (this includes get, list, watch, create,
+	// update, patch, delete, deletecollection, and proxy)
+	Verbs Verbs `json:"verbs" protobuf:"bytes,4,opt,name=verbs"`
+	// shortNames is a list of suggested short names of the resource.
+	// +listType=atomic
+	ShortNames []string `json:"shortNames,omitempty" protobuf:"bytes,5,rep,name=shortNames"`
+	// categories is a list of the grouped resources this resource belongs to (e.g. 'all')
+	// +listType=atomic
+	Categories []string `json:"categories,omitempty" protobuf:"bytes,7,rep,name=categories"`
+	// The hash value of the storage version, the version this resource is
+	// converted to when written to the data store. Value must be treated
+	// as opaque by clients. Only equality comparison on the value is valid.
+	// This is an alpha feature and may change or be removed in the future.
+	// The field is populated by the apiserver only if the
+	// StorageVersionHash feature gate is enabled.
+	// This field will remain optional even if it graduates.
+	// +optional
+	StorageVersionHash string `json:"storageVersionHash,omitempty" protobuf:"bytes,10,opt,name=storageVersionHash"`
+}
+
+// Verbs masks the value so protobuf can generate
+//
+// +protobuf.nullable=true
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type Verbs []string
+
+func (vs Verbs) String() string {
+	return fmt.Sprintf("%v", []string(vs))
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// APIResourceList is a list of APIResource, it is used to expose the name of the
+// resources supported in a specific group and version, and if the resource
+// is namespaced.
+type APIResourceList struct {
+	TypeMeta `json:""`
+	// groupVersion is the group and version this APIResourceList is for.
+	GroupVersion string `json:"groupVersion" protobuf:"bytes,1,opt,name=groupVersion"`
+	// resources contains the name of the resources and if they are namespaced.
+	// +listType=atomic
+	APIResources []APIResource `json:"resources" protobuf:"bytes,2,rep,name=resources"`
+}
+
+// RootPaths lists the paths available at root.
+// For example: "/healthz", "/apis".
+type RootPaths struct {
+	// paths are the paths available at root.
+	// +listType=atomic
+	Paths []string `json:"paths" protobuf:"bytes,1,rep,name=paths"`
+}
+
+// TODO: remove me when watch is refactored
+func LabelSelectorQueryParam(version string) string {
+	return "labelSelector"
+}
+
+// TODO: remove me when watch is refactored
+func FieldSelectorQueryParam(version string) string {
+	return "fieldSelector"
+}
+
+// String returns available api versions as a human-friendly version string.
+func (apiVersions APIVersions) String() string {
+	return strings.Join(apiVersions.Versions, ",")
+}
+
+func (apiVersions APIVersions) GoString() string {
+	return apiVersions.String()
+}
+
+// Patch is provided to give a concrete name and type to the Kubernetes PATCH request body.
+type Patch struct{}
+
+// Note:
+// There are two different styles of label selectors used in versioned types:
+// an older style which is represented as just a string in versioned types, and a
+// newer style that is structured.  LabelSelector is an internal representation for the
+// latter style.
+
+// A label selector is a label query over a set of resources. The result of matchLabels and
+// matchExpressions are ANDed. An empty label selector matches all objects. A null
+// label selector matches no objects.
+// +structType=atomic
+type LabelSelector struct {
+	// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+	// map is equivalent to an element of matchExpressions, whose key field is "key", the
+	// operator is "In", and the values array contains only "value". The requirements are ANDed.
+	// +optional
+	MatchLabels map[string]string `json:"matchLabels,omitempty" protobuf:"bytes,1,rep,name=matchLabels"`
+	// matchExpressions is a list of label selector requirements. The requirements are ANDed.
+	// +optional
+	// +listType=atomic
+	MatchExpressions []LabelSelectorRequirement `json:"matchExpressions,omitempty" protobuf:"bytes,2,rep,name=matchExpressions"`
+}
+
+// A label selector requirement is a selector that contains values, a key, and an operator that
+// relates the key and values.
+type LabelSelectorRequirement struct {
+	// key is the label key that the selector applies to.
+	Key string `json:"key" protobuf:"bytes,1,opt,name=key"`
+	// operator represents a key's relationship to a set of values.
+	// Valid operators are In, NotIn, Exists and DoesNotExist.
+	Operator LabelSelectorOperator `json:"operator" protobuf:"bytes,2,opt,name=operator,casttype=LabelSelectorOperator"`
+	// values is an array of string values. If the operator is In or NotIn,
+	// the values array must be non-empty. If the operator is Exists or DoesNotExist,
+	// the values array must be empty. This array is replaced during a strategic
+	// merge patch.
+	// +optional
+	// +listType=atomic
+	Values []string `json:"values,omitempty" protobuf:"bytes,3,rep,name=values"`
+}
+
+// A label selector operator is the set of operators that can be used in a selector requirement.
+type LabelSelectorOperator string
+
+const (
+	LabelSelectorOpIn           LabelSelectorOperator = "In"
+	LabelSelectorOpNotIn        LabelSelectorOperator = "NotIn"
+	LabelSelectorOpExists       LabelSelectorOperator = "Exists"
+	LabelSelectorOpDoesNotExist LabelSelectorOperator = "DoesNotExist"
+)
+
+// FieldSelectorRequirement is a selector that contains values, a key, and an operator that
+// relates the key and values.
+type FieldSelectorRequirement struct {
+	// key is the field selector key that the requirement applies to.
+	Key string `json:"key" protobuf:"bytes,1,opt,name=key"`
+	// operator represents a key's relationship to a set of values.
+	// Valid operators are In, NotIn, Exists, DoesNotExist.
+	// The list of operators may grow in the future.
+	Operator FieldSelectorOperator `json:"operator" protobuf:"bytes,2,opt,name=operator,casttype=FieldSelectorOperator"`
+	// values is an array of string values.
+	// If the operator is In or NotIn, the values array must be non-empty.
+	// If the operator is Exists or DoesNotExist, the values array must be empty.
+	// +optional
+	// +listType=atomic
+	Values []string `json:"values,omitempty" protobuf:"bytes,3,rep,name=values"`
+}
+
+// A field selector operator is the set of operators that can be used in a selector requirement.
+type FieldSelectorOperator string
+
+const (
+	FieldSelectorOpIn           FieldSelectorOperator = "In"
+	FieldSelectorOpNotIn        FieldSelectorOperator = "NotIn"
+	FieldSelectorOpExists       FieldSelectorOperator = "Exists"
+	FieldSelectorOpDoesNotExist FieldSelectorOperator = "DoesNotExist"
+)
+
+// ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource
+// that the fieldset applies to.
+type ManagedFieldsEntry struct {
+	// Manager is an identifier of the workflow managing these fields.
+	Manager string `json:"manager,omitempty" protobuf:"bytes,1,opt,name=manager"`
+	// Operation is the type of operation which lead to this ManagedFieldsEntry being created.
+	// The only valid values for this field are 'Apply' and 'Update'.
+	// +k8s:alpha(since: "1.37")=+k8s:required
+	Operation ManagedFieldsOperationType `json:"operation,omitempty" protobuf:"bytes,2,opt,name=operation,casttype=ManagedFieldsOperationType"`
+	// APIVersion defines the version of this resource that this field set
+	// applies to. The format is "group/version" just like the top-level
+	// APIVersion field. It is necessary to track the version of a field
+	// set because it cannot be automatically converted.
+	APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,3,opt,name=apiVersion"`
+	// Time is the timestamp of when the ManagedFields entry was added. The
+	// timestamp will also be updated if a field is added, the manager
+	// changes any of the owned fields value or removes a field. The
+	// timestamp does not update when a field is removed from the entry
+	// because another manager took it over.
+	// +optional
+	Time *Time `json:"time,omitempty" protobuf:"bytes,4,opt,name=time"`
+
+	// Fields is tombstoned to show why 5 is a reserved protobuf tag.
+	//Fields *Fields `json:"fields,omitempty" protobuf:"bytes,5,opt,name=fields,casttype=Fields"`
+
+	// FieldsType is the discriminator for the different fields format and version.
+	// There is currently only one possible value: "FieldsV1"
+	FieldsType string `json:"fieldsType,omitempty" protobuf:"bytes,6,opt,name=fieldsType"`
+	// FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
+	// +optional
+	FieldsV1 *FieldsV1 `json:"fieldsV1,omitempty" protobuf:"bytes,7,opt,name=fieldsV1"`
+
+	// Subresource is the name of the subresource used to update that object, or
+	// empty string if the object was updated through the main resource. The
+	// value of this field is used to distinguish between managers, even if they
+	// share the same name. For example, a status update will be distinct from a
+	// regular update using the same manager name.
+	// Note that the APIVersion field is not related to the Subresource field and
+	// it always corresponds to the version of the main resource.
+	Subresource string `json:"subresource,omitempty" protobuf:"bytes,8,opt,name=subresource"`
+}
+
+// ManagedFieldsOperationType is the type of operation which lead to a ManagedFieldsEntry being created.
+// +k8s:alpha(since: "1.37")=+k8s:enum
+type ManagedFieldsOperationType string
+
+const (
+	ManagedFieldsOperationApply  ManagedFieldsOperationType = "Apply"
+	ManagedFieldsOperationUpdate ManagedFieldsOperationType = "Update"
+)
+
+// TODO: Table does not generate to protobuf because of the interface{} - fix protobuf
+//   generation to support a meta type that can accept any valid JSON. This can be introduced
+//   in a v1 because clients a) receive an error if they try to access proto today, and b)
+//   once introduced they would be able to gracefully switch over to using it.
+
+// Table is a tabular representation of a set of API resources. The server transforms the
+// object into a set of preferred columns for quickly reviewing the objects.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +protobuf=false
+type Table struct {
+	TypeMeta `json:""`
+	// Standard list metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	ListMeta `json:"metadata,omitempty"`
+
+	// columnDefinitions describes each column in the returned items array. The number of cells per row
+	// will always match the number of column definitions.
+	// +listType=atomic
+	ColumnDefinitions []TableColumnDefinition `json:"columnDefinitions"`
+	// rows is the list of items in the table.
+	// +listType=atomic
+	Rows []TableRow `json:"rows"`
+}
+
+// TableColumnDefinition contains information about a column returned in the Table.
+// +protobuf=false
+type TableColumnDefinition struct {
+	// name is a human readable name for the column.
+	Name string `json:"name"`
+	// type is an OpenAPI type definition for this column, such as number, integer, string, or
+	// array.
+	// See https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#data-types for more.
+	Type string `json:"type"`
+	// format is an optional OpenAPI type modifier for this column. A format modifies the type and
+	// imposes additional rules, like date or time formatting for a string. The 'name' format is applied
+	// to the primary identifier column which has type 'string' to assist in clients identifying column
+	// is the resource name.
+	// See https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#data-types for more.
+	Format string `json:"format"`
+	// description is a human readable description of this column.
+	Description string `json:"description"`
+	// priority is an integer defining the relative importance of this column compared to others. Lower
+	// numbers are considered higher priority. Columns that may be omitted in limited space scenarios
+	// should be given a higher priority.
+	Priority int32 `json:"priority"`
+}
+
+// TableRow is an individual row in a table.
+// +protobuf=false
+type TableRow struct {
+	// cells will be as wide as the column definitions array and may contain strings, numbers (float64 or
+	// int64), booleans, simple maps, lists, or null. See the type field of the column definition for a
+	// more detailed description.
+	// +listType=atomic
+	Cells []interface{} `json:"cells"`
+	// conditions describe additional status of a row that are relevant for a human user. These conditions
+	// apply to the row, not to the object, and will be specific to table output. The only defined
+	// condition type is 'Completed', for a row that indicates a resource that has run to completion and
+	// can be given less visual priority.
+	// +optional
+	// +listType=atomic
+	Conditions []TableRowCondition `json:"conditions,omitempty"`
+	// This field contains the requested additional information about each object based on the includeObject
+	// policy when requesting the Table. If "None", this field is empty, if "Object" this will be the
+	// default serialization of the object for the current API version, and if "Metadata" (the default) will
+	// contain the object metadata. Check the returned kind and apiVersion of the object before parsing.
+	// The media type of the object will always match the enclosing list - if this as a JSON table, these
+	// will be JSON encoded objects.
+	// +optional
+	Object runtime.RawExtension `json:"object,omitempty"`
+}
+
+// TableRowCondition allows a row to be marked with additional information.
+// +protobuf=false
+type TableRowCondition struct {
+	// Type of row condition. The only defined value is 'Completed' indicating that the
+	// object this row represents has reached a completed state and may be given less visual
+	// priority than other rows. Clients are not required to honor any conditions but should
+	// be consistent where possible about handling the conditions.
+	Type RowConditionType `json:"type"`
+	// Status of the condition, one of True, False, Unknown.
+	Status ConditionStatus `json:"status"`
+	// (brief) machine readable reason for the condition's last transition.
+	// +optional
+	Reason string `json:"reason,omitempty"`
+	// Human readable message indicating details about last transition.
+	// +optional
+	Message string `json:"message,omitempty"`
+}
+
+type RowConditionType string
+
+// These are valid conditions of a row. This list is not exhaustive and new conditions may be
+// included by other resources.
+const (
+	// RowCompleted means the underlying resource has reached completion and may be given less
+	// visual priority than other resources.
+	RowCompleted RowConditionType = "Completed"
+)
+
+// +k8s:alpha(since: "1.37")=+k8s:enum
+type ConditionStatus string
+
+// These are valid condition statuses. "ConditionTrue" means a resource is in the condition.
+// "ConditionFalse" means a resource is not in the condition. "ConditionUnknown" means kubernetes
+// can't decide if a resource is in the condition or not. In the future, we could add other
+// intermediate conditions, e.g. ConditionDegraded.
+const (
+	ConditionTrue    ConditionStatus = "True"
+	ConditionFalse   ConditionStatus = "False"
+	ConditionUnknown ConditionStatus = "Unknown"
+)
+
+// IncludeObjectPolicy controls which portion of the object is returned with a Table.
+type IncludeObjectPolicy string
+
+const (
+	// IncludeNone returns no object.
+	IncludeNone IncludeObjectPolicy = "None"
+	// IncludeMetadata serializes the object containing only its metadata field.
+	IncludeMetadata IncludeObjectPolicy = "Metadata"
+	// IncludeObject contains the full object.
+	IncludeObject IncludeObjectPolicy = "Object"
+)
+
+// TableOptions are used when a Table is requested by the caller.
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type TableOptions struct {
+	TypeMeta `json:""`
+
+	// NoHeaders is only exposed for internal callers. It is not included in our OpenAPI definitions
+	// and may be removed as a field in a future release.
+	NoHeaders bool `json:"-"`
+
+	// includeObject decides whether to include each object along with its columnar information.
+	// Specifying "None" will return no object, specifying "Object" will return the full object contents, and
+	// specifying "Metadata" (the default) will return the object's metadata in the PartialObjectMetadata kind
+	// in version v1beta1 of the meta.k8s.io API group.
+	IncludeObject IncludeObjectPolicy `json:"includeObject,omitempty" protobuf:"bytes,1,opt,name=includeObject,casttype=IncludeObjectPolicy"`
+}
+
+// PartialObjectMetadata is a generic representation of any object with ObjectMeta. It allows clients
+// to get access to a particular ObjectMeta schema without knowing the details of the version.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type PartialObjectMetadata struct {
+	TypeMeta `json:""`
+	// Standard object's metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	// +optional
+	// +k8s:opaqueType
+	ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+}
+
+// PartialObjectMetadataList contains a list of objects containing only their metadata
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type PartialObjectMetadataList struct {
+	TypeMeta `json:""`
+	// Standard list metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// items contains each of the included items.
+	Items []PartialObjectMetadata `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+// Condition contains details for one aspect of the current state of this API Resource.
+// ---
+// This struct is intended for direct use as an array at the field path .status.conditions.  For example,
+//
+//	type FooStatus struct{
+//	    // Represents the observations of a foo's current state.
+//	    // Known .status.conditions.type are: "Available", "Progressing", and "Degraded"
+//	    // +patchMergeKey=type
+//	    // +patchStrategy=merge
+//	    // +listType=map
+//	    // +listMapKey=type
+//	    // +k8s:alpha(since: "1.37")=+k8s:optional
+//	    // +k8s:alpha(since: "1.37")=+k8s:listType=map
+//	    // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+//	    Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
+//
+//	    // other fields
+//	}
+type Condition struct {
+	// type of condition in CamelCase or in foo.example.com/CamelCase.
+	// ---
+	// Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
+	// useful (see .node.status.conditions), the ability to deconflict is important.
+	// The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$`
+	// +kubebuilder:validation:MaxLength=316
+	// +k8s:alpha(since: "1.37")=+k8s:required
+	Type string `json:"type" protobuf:"bytes,1,opt,name=type"`
+	// status of the condition, one of True, False, Unknown.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Enum=True;False;Unknown
+	// +k8s:alpha(since: "1.37")=+k8s:required
+	Status ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status"`
+	// observedGeneration represents the .metadata.generation that the condition was set based upon.
+	// For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+	// with respect to the current state of the instance.
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:minimum=0
+	ObservedGeneration int64 `json:"observedGeneration,omitempty" protobuf:"varint,3,opt,name=observedGeneration"`
+	// lastTransitionTime is the last time the condition transitioned from one status to another.
+	// This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Type=string
+	// +kubebuilder:validation:Format=date-time
+	// +k8s:alpha(since: "1.37")=+k8s:customValidation
+	LastTransitionTime Time `json:"lastTransitionTime" protobuf:"bytes,4,opt,name=lastTransitionTime"`
+	// reason contains a programmatic identifier indicating the reason for the condition's last transition.
+	// Producers of specific condition types may define expected values and meanings for this field,
+	// and whether the values are considered a guaranteed API.
+	// The value should be a CamelCase string.
+	// This field may not be empty.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MaxLength=1024
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:Pattern=`^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$`
+	// +k8s:alpha(since: "1.37")=+k8s:required
+	// +k8s:alpha(since: "1.37")=+k8s:maxBytes=1024
+	Reason string `json:"reason" protobuf:"bytes,5,opt,name=reason"`
+	// message is a human readable message indicating details about the transition.
+	// This may be an empty string.
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MaxLength=32768
+	Message string `json:"message" protobuf:"bytes,6,opt,name=message"`
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types_swagger_doc_generated.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types_swagger_doc_generated.go
new file mode 100644
index 0000000000..c45c00f1aa
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types_swagger_doc_generated.go
@@ -0,0 +1,477 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+// This file contains a collection of methods that can be used from go-restful to
+// generate Swagger API documentation for its models. Please read this PR for more
+// information on the implementation: https://github.com/emicklei/go-restful/pull/215
+//
+// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if
+// they are on one line! For multiple line or blocks that you want to ignore use ---.
+// Any context after a --- is ignored.
+//
+// Those methods can be generated by using hack/update-codegen.sh
+
+// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
+var map_APIGroup = map[string]string{
+	"":                           "APIGroup contains the name, the supported versions, and the preferred version of a group.",
+	"name":                       "name is the name of the group.",
+	"versions":                   "versions are the versions supported in this group.",
+	"preferredVersion":           "preferredVersion is the version preferred by the API server, which probably is the storage version.",
+	"serverAddressByClientCIDRs": "a map of client CIDR to server address that is serving this group. This is to help clients reach servers in the most network-efficient way possible. Clients can use the appropriate server address as per the CIDR that they match. In case of multiple matches, clients should use the longest matching CIDR. The server returns only those CIDRs that it thinks that the client can match. For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP. Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.",
+}
+
+func (APIGroup) SwaggerDoc() map[string]string {
+	return map_APIGroup
+}
+
+var map_APIGroupList = map[string]string{
+	"":       "APIGroupList is a list of APIGroup, to allow clients to discover the API at /apis.",
+	"groups": "groups is a list of APIGroup.",
+}
+
+func (APIGroupList) SwaggerDoc() map[string]string {
+	return map_APIGroupList
+}
+
+var map_APIResource = map[string]string{
+	"":                   "APIResource specifies the name of a resource and whether it is namespaced.",
+	"name":               "name is the plural name of the resource.",
+	"singularName":       "singularName is the singular name of the resource.  This allows clients to handle plural and singular opaquely. The singularName is more correct for reporting status on a single item and both singular and plural are allowed from the kubectl CLI interface.",
+	"namespaced":         "namespaced indicates if a resource is namespaced or not.",
+	"group":              "group is the preferred group of the resource.  Empty implies the group of the containing resource list. For subresources, this may have a different value, for example: Scale\".",
+	"version":            "version is the preferred version of the resource.  Empty implies the version of the containing resource list For subresources, this may have a different value, for example: v1 (while inside a v1beta1 version of the core resource's group)\".",
+	"kind":               "kind is the kind for the resource (e.g. 'Foo' is the kind for a resource 'foo')",
+	"verbs":              "verbs is a list of supported kube verbs (this includes get, list, watch, create, update, patch, delete, deletecollection, and proxy)",
+	"shortNames":         "shortNames is a list of suggested short names of the resource.",
+	"categories":         "categories is a list of the grouped resources this resource belongs to (e.g. 'all')",
+	"storageVersionHash": "The hash value of the storage version, the version this resource is converted to when written to the data store. Value must be treated as opaque by clients. Only equality comparison on the value is valid. This is an alpha feature and may change or be removed in the future. The field is populated by the apiserver only if the StorageVersionHash feature gate is enabled. This field will remain optional even if it graduates.",
+}
+
+func (APIResource) SwaggerDoc() map[string]string {
+	return map_APIResource
+}
+
+var map_APIResourceList = map[string]string{
+	"":             "APIResourceList is a list of APIResource, it is used to expose the name of the resources supported in a specific group and version, and if the resource is namespaced.",
+	"groupVersion": "groupVersion is the group and version this APIResourceList is for.",
+	"resources":    "resources contains the name of the resources and if they are namespaced.",
+}
+
+func (APIResourceList) SwaggerDoc() map[string]string {
+	return map_APIResourceList
+}
+
+var map_APIVersions = map[string]string{
+	"":                           "APIVersions lists the versions that are available, to allow clients to discover the API at /api, which is the root path of the legacy v1 API.",
+	"versions":                   "versions are the api versions that are available.",
+	"serverAddressByClientCIDRs": "a map of client CIDR to server address that is serving this group. This is to help clients reach servers in the most network-efficient way possible. Clients can use the appropriate server address as per the CIDR that they match. In case of multiple matches, clients should use the longest matching CIDR. The server returns only those CIDRs that it thinks that the client can match. For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP. Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.",
+}
+
+func (APIVersions) SwaggerDoc() map[string]string {
+	return map_APIVersions
+}
+
+var map_ApplyOptions = map[string]string{
+	"":             "ApplyOptions may be provided when applying an API object. FieldManager is required for apply requests. ApplyOptions is equivalent to PatchOptions. It is provided as a convenience with documentation that speaks specifically to how the options fields relate to apply.",
+	"dryRun":       "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+	"force":        "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people.",
+	"fieldManager": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required.",
+}
+
+func (ApplyOptions) SwaggerDoc() map[string]string {
+	return map_ApplyOptions
+}
+
+var map_Condition = map[string]string{
+	"":                   "Condition contains details for one aspect of the current state of this API Resource.",
+	"type":               "type of condition in CamelCase or in foo.example.com/CamelCase.",
+	"status":             "status of the condition, one of True, False, Unknown.",
+	"observedGeneration": "observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.",
+	"lastTransitionTime": "lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+	"reason":             "reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.",
+	"message":            "message is a human readable message indicating details about the transition. This may be an empty string.",
+}
+
+func (Condition) SwaggerDoc() map[string]string {
+	return map_Condition
+}
+
+var map_CreateOptions = map[string]string{
+	"":                "CreateOptions may be provided when creating an API object.",
+	"dryRun":          "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+	"fieldManager":    "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.",
+	"fieldValidation": "fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.",
+}
+
+func (CreateOptions) SwaggerDoc() map[string]string {
+	return map_CreateOptions
+}
+
+var map_DeleteOptions = map[string]string{
+	"":                   "DeleteOptions may be provided when deleting an API object.",
+	"gracePeriodSeconds": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.",
+	"preconditions":      "Must be fulfilled before a deletion is carried out. If not possible, a 409 Conflict status will be returned.",
+	"orphanDependents":   "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.",
+	"propagationPolicy":  "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.",
+	"dryRun":             "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+	"ignoreStoreReadErrorWithClusterBreakingPotential": "if set to true, it will trigger an unsafe deletion of the resource in case the normal deletion flow fails with a corrupt object error. A resource is considered corrupt if it can not be retrieved from the underlying storage successfully because of a) its data can not be transformed e.g. decryption failure, or b) it fails to decode into an object. NOTE: unsafe deletion ignores finalizer constraints, skips precondition checks, and removes the object from the storage. WARNING: This may potentially break the cluster if the workload associated with the resource being unsafe-deleted relies on normal deletion flow. Use only if you REALLY know what you are doing. The default value is false, and the user must opt in to enable it",
+}
+
+func (DeleteOptions) SwaggerDoc() map[string]string {
+	return map_DeleteOptions
+}
+
+var map_FieldSelectorRequirement = map[string]string{
+	"":         "FieldSelectorRequirement is a selector that contains values, a key, and an operator that relates the key and values.",
+	"key":      "key is the field selector key that the requirement applies to.",
+	"operator": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. The list of operators may grow in the future.",
+	"values":   "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.",
+}
+
+func (FieldSelectorRequirement) SwaggerDoc() map[string]string {
+	return map_FieldSelectorRequirement
+}
+
+var map_GetOptions = map[string]string{
+	"":                "GetOptions is the standard query options to the standard REST get call.",
+	"resourceVersion": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset",
+}
+
+func (GetOptions) SwaggerDoc() map[string]string {
+	return map_GetOptions
+}
+
+var map_GroupVersionForDiscovery = map[string]string{
+	"":             "GroupVersion contains the \"group/version\" and \"version\" string of a version. It is made a struct to keep extensibility.",
+	"groupVersion": "groupVersion specifies the API group and version in the form \"group/version\"",
+	"version":      "version specifies the version in the form of \"version\". This is to save the clients the trouble of splitting the GroupVersion.",
+}
+
+func (GroupVersionForDiscovery) SwaggerDoc() map[string]string {
+	return map_GroupVersionForDiscovery
+}
+
+var map_LabelSelector = map[string]string{
+	"":                 "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.",
+	"matchLabels":      "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+	"matchExpressions": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
+}
+
+func (LabelSelector) SwaggerDoc() map[string]string {
+	return map_LabelSelector
+}
+
+var map_LabelSelectorRequirement = map[string]string{
+	"":         "A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
+	"key":      "key is the label key that the selector applies to.",
+	"operator": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.",
+	"values":   "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
+}
+
+func (LabelSelectorRequirement) SwaggerDoc() map[string]string {
+	return map_LabelSelectorRequirement
+}
+
+var map_List = map[string]string{
+	"":         "List holds a list of objects, which may not be known by the server.",
+	"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"items":    "List of objects",
+}
+
+func (List) SwaggerDoc() map[string]string {
+	return map_List
+}
+
+var map_ListMeta = map[string]string{
+	"":                   "ListMeta describes metadata that synthetic resources must have, including lists and various status objects. A resource may have only one of {ObjectMeta, ListMeta}.",
+	"selfLink":           "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.",
+	"resourceVersion":    "String that identifies the server's internal version of this object that can be used by clients to determine when objects have changed. Value must be treated as opaque by clients and passed unmodified back to the server. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency",
+	"continue":           "continue may be set if the user set a limit on the number of items returned, and indicates that the server has more data available. The value is opaque and may be used to issue another request to the endpoint that served this list to retrieve the next set of available objects. Continuing a consistent list may not be possible if the server configuration has changed or more than a few minutes have passed. The resourceVersion field returned when using this continue value will be identical to the value in the first response, unless you have received this token from an error message.",
+	"remainingItemCount": "remainingItemCount is the number of subsequent items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the field will be left unset and omitted during serialization. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and this field will be left unset and omitted during serialization. Servers older than v1.15 do not set this field. The intended use of the remainingItemCount is *estimating* the size of a collection. Clients should not rely on the remainingItemCount to be set or to be exact.",
+	"shardInfo":          "shardInfo is set when the list is a filtered subset of the full collection, as selected by a shard selector on the request. It echoes back the selector so clients can verify which shard they received and merge sharded responses. Clients should not cache sharded list responses as a full representation of the collection.\n\nThis is an alpha field and requires enabling the ShardedListAndWatch feature gate.",
+}
+
+func (ListMeta) SwaggerDoc() map[string]string {
+	return map_ListMeta
+}
+
+var map_ListOptions = map[string]string{
+	"":                     "ListOptions is the query options to a standard REST list call.",
+	"labelSelector":        "A selector to restrict the list of returned objects by their labels. Defaults to everything.",
+	"fieldSelector":        "A selector to restrict the list of returned objects by their fields. Defaults to everything.",
+	"watch":                "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.",
+	"allowWatchBookmarks":  "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.",
+	"resourceVersion":      "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset",
+	"resourceVersionMatch": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset",
+	"timeoutSeconds":       "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.",
+	"limit":                "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.",
+	"continue":             "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.",
+	"sendInitialEvents":    "`sendInitialEvents=true` may be set together with `watch=true`. In that case, the watch stream will begin with synthetic events to produce the current state of objects in the collection. Once all such events have been sent, a synthetic \"Bookmark\" event  will be sent. The bookmark will report the ResourceVersion (RV) corresponding to the set of objects, and be marked with `\"k8s.io/initial-events-end\": \"true\"` annotation. Afterwards, the watch stream will proceed as usual, sending watch events corresponding to changes (subsequent to the RV) to objects watched.\n\nWhen `sendInitialEvents` option is set, we require `resourceVersionMatch` option to also be set. The semantic of the watch request is as following: - `resourceVersionMatch` = NotOlderThan\n  is interpreted as \"data at least as new as the provided `resourceVersion`\"\n  and the bookmark event is send when the state is synced\n  to a `resourceVersion` at least as fresh as the one provided by the ListOptions.\n  If `resourceVersion` is unset, this is interpreted as \"consistent read\" and the\n  bookmark event is send when the state is synced at least to the moment\n  when request started being processed.\n- `resourceVersionMatch` set to any other value or unset\n  Invalid error is returned.\n\nDefaults to true if `resourceVersion=\"\"` or `resourceVersion=\"0\"` (for backward compatibility reasons) and to false otherwise.",
+	"shardSelector":        "shardSelector restricts the list of returned objects using a CEL-based shard selector expression. The format uses the shardRange() function combined with || (logical OR) to specify one or more hash ranges:\n\n  shardRange(object.metadata.uid, '0x0', '0x8000000000000000')\n  shardRange(object.metadata.uid, '0x0', '0x8000000000000000') || shardRange(object.metadata.uid, '0x8000000000000000', '0x10000000000000000')\n\nField paths use CEL-style object-rooted syntax (e.g. \"object.metadata.uid\"), NOT the fieldSelector format (\"metadata.uid\"). Currently supported paths:\n  - object.metadata.uid\n  - object.metadata.namespace\n\nhexStart and hexEnd are single-quoted CEL string literals with a '0x' prefix, defining the inclusive lower and exclusive upper bounds over the 64-bit FNV-1a hash space. The full range is [0x0, 0x10000000000000000), where the exclusive upper bound equals 2^64.\n\nExamples:\n  2-shard split:\n    shard 0: shardRange(object.metadata.uid, '0x0000000000000000', '0x8000000000000000')\n    shard 1: shardRange(object.metadata.uid, '0x8000000000000000', '0x10000000000000000')\n  4-shard split:\n    shard 0: shardRange(object.metadata.uid, '0x0000000000000000', '0x4000000000000000')\n    shard 1: shardRange(object.metadata.uid, '0x4000000000000000', '0x8000000000000000')\n    shard 2: shardRange(object.metadata.uid, '0x8000000000000000', '0xc000000000000000')\n    shard 3: shardRange(object.metadata.uid, '0xc000000000000000', '0x10000000000000000')\n\nThis is an alpha field and requires enabling the ShardedListAndWatch feature gate.",
+}
+
+func (ListOptions) SwaggerDoc() map[string]string {
+	return map_ListOptions
+}
+
+var map_ManagedFieldsEntry = map[string]string{
+	"":            "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.",
+	"manager":     "Manager is an identifier of the workflow managing these fields.",
+	"operation":   "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.",
+	"apiVersion":  "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.",
+	"time":        "Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over.",
+	"fieldsType":  "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"",
+	"fieldsV1":    "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type.",
+	"subresource": "Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.",
+}
+
+func (ManagedFieldsEntry) SwaggerDoc() map[string]string {
+	return map_ManagedFieldsEntry
+}
+
+var map_ObjectMeta = map[string]string{
+	"":                           "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.",
+	"name":                       "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names",
+	"generateName":               "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency",
+	"namespace":                  "Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces",
+	"selfLink":                   "Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.",
+	"uid":                        "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids",
+	"resourceVersion":            "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency",
+	"generation":                 "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.",
+	"creationTimestamp":          "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"deletionTimestamp":          "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"deletionGracePeriodSeconds": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.",
+	"labels":                     "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels",
+	"annotations":                "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations",
+	"ownerReferences":            "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.",
+	"finalizers":                 "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order.  Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.",
+	"managedFields":              "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.",
+}
+
+func (ObjectMeta) SwaggerDoc() map[string]string {
+	return map_ObjectMeta
+}
+
+var map_OwnerReference = map[string]string{
+	"":                   "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.",
+	"apiVersion":         "API version of the referent.",
+	"kind":               "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"name":               "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names",
+	"uid":                "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids",
+	"controller":         "If true, this reference points to the managing controller.",
+	"blockOwnerDeletion": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.",
+}
+
+func (OwnerReference) SwaggerDoc() map[string]string {
+	return map_OwnerReference
+}
+
+var map_PartialObjectMetadata = map[string]string{
+	"":         "PartialObjectMetadata is a generic representation of any object with ObjectMeta. It allows clients to get access to a particular ObjectMeta schema without knowing the details of the version.",
+	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+}
+
+func (PartialObjectMetadata) SwaggerDoc() map[string]string {
+	return map_PartialObjectMetadata
+}
+
+var map_PartialObjectMetadataList = map[string]string{
+	"":         "PartialObjectMetadataList contains a list of objects containing only their metadata",
+	"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"items":    "items contains each of the included items.",
+}
+
+func (PartialObjectMetadataList) SwaggerDoc() map[string]string {
+	return map_PartialObjectMetadataList
+}
+
+var map_Patch = map[string]string{
+	"": "Patch is provided to give a concrete name and type to the Kubernetes PATCH request body.",
+}
+
+func (Patch) SwaggerDoc() map[string]string {
+	return map_Patch
+}
+
+var map_PatchOptions = map[string]string{
+	"":                "PatchOptions may be provided when patching an API object. PatchOptions is meant to be a superset of UpdateOptions.",
+	"dryRun":          "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+	"force":           "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.",
+	"fieldManager":    "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).",
+	"fieldValidation": "fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.",
+}
+
+func (PatchOptions) SwaggerDoc() map[string]string {
+	return map_PatchOptions
+}
+
+var map_Preconditions = map[string]string{
+	"":                "Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.",
+	"uid":             "Specifies the target UID.",
+	"resourceVersion": "Specifies the target ResourceVersion",
+}
+
+func (Preconditions) SwaggerDoc() map[string]string {
+	return map_Preconditions
+}
+
+var map_RootPaths = map[string]string{
+	"":      "RootPaths lists the paths available at root. For example: \"/healthz\", \"/apis\".",
+	"paths": "paths are the paths available at root.",
+}
+
+func (RootPaths) SwaggerDoc() map[string]string {
+	return map_RootPaths
+}
+
+var map_ServerAddressByClientCIDR = map[string]string{
+	"":              "ServerAddressByClientCIDR helps the client to determine the server address that they should use, depending on the clientCIDR that they match.",
+	"clientCIDR":    "The CIDR with which clients can match their IP to figure out the server address that they should use.",
+	"serverAddress": "Address of this server, suitable for a client that matches the above CIDR. This can be a hostname, hostname:port, IP or IP:port.",
+}
+
+func (ServerAddressByClientCIDR) SwaggerDoc() map[string]string {
+	return map_ServerAddressByClientCIDR
+}
+
+var map_ShardInfo = map[string]string{
+	"":         "ShardInfo describes the shard selector that was applied to produce a list response. Its presence on a list response indicates the list is a filtered subset.",
+	"selector": "selector is the shard selector string from the request, echoed back so clients can verify which shard they received and merge responses from multiple shards.",
+}
+
+func (ShardInfo) SwaggerDoc() map[string]string {
+	return map_ShardInfo
+}
+
+var map_Status = map[string]string{
+	"":         "Status is a return value for calls that don't return other objects.",
+	"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"status":   "Status of the operation. One of: \"Success\" or \"Failure\". More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
+	"message":  "A human-readable description of the status of this operation.",
+	"reason":   "A machine-readable description of why this operation is in the \"Failure\" status. If this value is empty there is no information available. A Reason clarifies an HTTP status code but does not override it.",
+	"details":  "Extended data associated with the reason.  Each reason may define its own extended details. This field is optional and the data returned is not guaranteed to conform to any schema except that defined by the reason type.",
+	"code":     "Suggested HTTP return code for this status, 0 if not set.",
+}
+
+func (Status) SwaggerDoc() map[string]string {
+	return map_Status
+}
+
+var map_StatusCause = map[string]string{
+	"":        "StatusCause provides more information about an api.Status failure, including cases when multiple errors are encountered.",
+	"reason":  "A machine-readable description of the cause of the error. If this value is empty there is no information available.",
+	"message": "A human-readable description of the cause of the error.  This field may be presented as-is to a reader.",
+	"field":   "The field of the resource that has caused this error, as named by its JSON serialization. May include dot and postfix notation for nested attributes. Arrays are zero-indexed.  Fields may appear more than once in an array of causes due to fields having multiple errors. Optional.\n\nExamples:\n  \"name\" - the field \"name\" on the current resource\n  \"items[0].name\" - the field \"name\" on the first array entry in \"items\"",
+}
+
+func (StatusCause) SwaggerDoc() map[string]string {
+	return map_StatusCause
+}
+
+var map_StatusDetails = map[string]string{
+	"":                  "StatusDetails is a set of additional properties that MAY be set by the server to provide additional information about a response. The Reason field of a Status object defines what attributes will be set. Clients must ignore fields that do not match the defined type of each attribute, and should assume that any attribute may be empty, invalid, or under defined.",
+	"name":              "The name attribute of the resource associated with the status StatusReason (when there is a single name which can be described).",
+	"group":             "The group attribute of the resource associated with the status StatusReason.",
+	"kind":              "The kind attribute of the resource associated with the status StatusReason. On some operations may differ from the requested resource Kind. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"uid":               "UID of the resource. (when there is a single resource which can be described). More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids",
+	"causes":            "The Causes array includes more details associated with the StatusReason failure. Not all StatusReasons may provide detailed causes.",
+	"retryAfterSeconds": "If specified, the time in seconds before the operation should be retried. Some errors may indicate the client must take an alternate action - for those errors this field may indicate how long to wait before taking the alternate action.",
+}
+
+func (StatusDetails) SwaggerDoc() map[string]string {
+	return map_StatusDetails
+}
+
+var map_Table = map[string]string{
+	"":                  "Table is a tabular representation of a set of API resources. The server transforms the object into a set of preferred columns for quickly reviewing the objects.",
+	"metadata":          "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"columnDefinitions": "columnDefinitions describes each column in the returned items array. The number of cells per row will always match the number of column definitions.",
+	"rows":              "rows is the list of items in the table.",
+}
+
+func (Table) SwaggerDoc() map[string]string {
+	return map_Table
+}
+
+var map_TableColumnDefinition = map[string]string{
+	"":            "TableColumnDefinition contains information about a column returned in the Table.",
+	"name":        "name is a human readable name for the column.",
+	"type":        "type is an OpenAPI type definition for this column, such as number, integer, string, or array. See https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#data-types for more.",
+	"format":      "format is an optional OpenAPI type modifier for this column. A format modifies the type and imposes additional rules, like date or time formatting for a string. The 'name' format is applied to the primary identifier column which has type 'string' to assist in clients identifying column is the resource name. See https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#data-types for more.",
+	"description": "description is a human readable description of this column.",
+	"priority":    "priority is an integer defining the relative importance of this column compared to others. Lower numbers are considered higher priority. Columns that may be omitted in limited space scenarios should be given a higher priority.",
+}
+
+func (TableColumnDefinition) SwaggerDoc() map[string]string {
+	return map_TableColumnDefinition
+}
+
+var map_TableOptions = map[string]string{
+	"":              "TableOptions are used when a Table is requested by the caller.",
+	"includeObject": "includeObject decides whether to include each object along with its columnar information. Specifying \"None\" will return no object, specifying \"Object\" will return the full object contents, and specifying \"Metadata\" (the default) will return the object's metadata in the PartialObjectMetadata kind in version v1beta1 of the meta.k8s.io API group.",
+}
+
+func (TableOptions) SwaggerDoc() map[string]string {
+	return map_TableOptions
+}
+
+var map_TableRow = map[string]string{
+	"":           "TableRow is an individual row in a table.",
+	"cells":      "cells will be as wide as the column definitions array and may contain strings, numbers (float64 or int64), booleans, simple maps, lists, or null. See the type field of the column definition for a more detailed description.",
+	"conditions": "conditions describe additional status of a row that are relevant for a human user. These conditions apply to the row, not to the object, and will be specific to table output. The only defined condition type is 'Completed', for a row that indicates a resource that has run to completion and can be given less visual priority.",
+	"object":     "This field contains the requested additional information about each object based on the includeObject policy when requesting the Table. If \"None\", this field is empty, if \"Object\" this will be the default serialization of the object for the current API version, and if \"Metadata\" (the default) will contain the object metadata. Check the returned kind and apiVersion of the object before parsing. The media type of the object will always match the enclosing list - if this as a JSON table, these will be JSON encoded objects.",
+}
+
+func (TableRow) SwaggerDoc() map[string]string {
+	return map_TableRow
+}
+
+var map_TableRowCondition = map[string]string{
+	"":        "TableRowCondition allows a row to be marked with additional information.",
+	"type":    "Type of row condition. The only defined value is 'Completed' indicating that the object this row represents has reached a completed state and may be given less visual priority than other rows. Clients are not required to honor any conditions but should be consistent where possible about handling the conditions.",
+	"status":  "Status of the condition, one of True, False, Unknown.",
+	"reason":  "(brief) machine readable reason for the condition's last transition.",
+	"message": "Human readable message indicating details about last transition.",
+}
+
+func (TableRowCondition) SwaggerDoc() map[string]string {
+	return map_TableRowCondition
+}
+
+var map_TypeMeta = map[string]string{
+	"":           "TypeMeta describes an individual object in an API response or request with strings representing the type of the object and its API schema version. Structures that are versioned or persisted should inline TypeMeta.",
+	"kind":       "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"apiVersion": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+}
+
+func (TypeMeta) SwaggerDoc() map[string]string {
+	return map_TypeMeta
+}
+
+var map_UpdateOptions = map[string]string{
+	"":                "UpdateOptions may be provided when updating an API object. All fields in UpdateOptions should also be present in PatchOptions.",
+	"dryRun":          "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+	"fieldManager":    "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.",
+	"fieldValidation": "fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.",
+}
+
+func (UpdateOptions) SwaggerDoc() map[string]string {
+	return map_UpdateOptions
+}
+
+// AUTO-GENERATED FUNCTIONS END HERE
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types_test.go
new file mode 100644
index 0000000000..f216527ddb
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/types_test.go
@@ -0,0 +1,134 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	gojson "encoding/json"
+	"reflect"
+	"testing"
+
+	utiljson "k8s.io/apimachinery/pkg/util/json"
+)
+
+func TestVerbsMarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  APIResource
+		result string
+	}{
+		{APIResource{}, `{"name":"","singularName":"","namespaced":false,"kind":"","verbs":null}`},
+		{APIResource{Verbs: Verbs([]string{})}, `{"name":"","singularName":"","namespaced":false,"kind":"","verbs":[]}`},
+		{APIResource{Verbs: Verbs([]string{"delete"})}, `{"name":"","singularName":"","namespaced":false,"kind":"","verbs":["delete"]}`},
+	}
+
+	for i, c := range cases {
+		result, err := gojson.Marshal(&c.input)
+		if err != nil {
+			t.Errorf("[%d] Failed to marshal input: '%v': %v", i, c.input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("[%d] Failed to marshal input: '%v': expected '%v', got '%v'", i, c.input, c.result, string(result))
+		}
+	}
+}
+
+func TestVerbsJsonIterUnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  string
+		result APIResource
+	}{
+		{`{}`, APIResource{}},
+		{`{"verbs":null}`, APIResource{}},
+		{`{"verbs":[]}`, APIResource{Verbs: Verbs([]string{})}},
+		{`{"verbs":["delete"]}`, APIResource{Verbs: Verbs([]string{"delete"})}},
+	}
+
+	for i, c := range cases {
+		var result APIResource
+		if err := utiljson.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("[%d] Failed to unmarshal input '%v': %v", i, c.input, err)
+		}
+		if !reflect.DeepEqual(result, c.result) {
+			t.Errorf("[%d] Failed to unmarshal input '%v': expected %+v, got %+v", i, c.input, c.result, result)
+		}
+	}
+}
+
+// TestMarshalJSONWithOmit tests that we don't have regressions regarding nil and empty slices with "omit"
+func TestMarshalJSONWithOmit(t *testing.T) {
+	cases := []struct {
+		input  LabelSelector
+		result string
+	}{
+		{LabelSelector{}, `{}`},
+		{LabelSelector{MatchExpressions: []LabelSelectorRequirement{}}, `{}`},
+		{LabelSelector{MatchExpressions: []LabelSelectorRequirement{{}}}, `{"matchExpressions":[{"key":"","operator":""}]}`},
+	}
+
+	for i, c := range cases {
+		result, err := gojson.Marshal(&c.input)
+		if err != nil {
+			t.Errorf("[%d] Failed to marshal input: '%v': %v", i, c.input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("[%d] Failed to marshal input: '%v': expected '%v', got '%v'", i, c.input, c.result, string(result))
+		}
+	}
+}
+
+func TestVerbsUnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  string
+		result APIResource
+	}{
+		{`{}`, APIResource{}},
+		{`{"verbs":null}`, APIResource{}},
+		{`{"verbs":[]}`, APIResource{Verbs: Verbs([]string{})}},
+		{`{"verbs":["delete"]}`, APIResource{Verbs: Verbs([]string{"delete"})}},
+	}
+
+	for i, c := range cases {
+		var result APIResource
+		if err := gojson.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("[%d] Failed to unmarshal input '%v': %v", i, c.input, err)
+		}
+		if !reflect.DeepEqual(result, c.result) {
+			t.Errorf("[%d] Failed to unmarshal input '%v': expected %+v, got %+v", i, c.input, c.result, result)
+		}
+	}
+}
+
+func TestVerbsProto(t *testing.T) {
+	cases := []APIResource{
+		{},
+		{Verbs: Verbs([]string{})},
+		{Verbs: Verbs([]string{"delete"})},
+	}
+
+	for _, input := range cases {
+		data, err := input.Marshal()
+		if err != nil {
+			t.Fatalf("Failed to marshal input: '%v': %v", input, err)
+		}
+		resource := APIResource{}
+		if err := resource.Unmarshal(data); err != nil {
+			t.Fatalf("Failed to unmarshal output: '%v': %v", input, err)
+		}
+		if !reflect.DeepEqual(input, resource) {
+			t.Errorf("Marshal->Unmarshal is not idempotent: '%v' vs '%v'", input, resource)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers.go
new file mode 100644
index 0000000000..592445d9c8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers.go
@@ -0,0 +1,551 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructured
+
+import (
+	gojson "encoding/json"
+	"fmt"
+	"io"
+	"math/big"
+	"strings"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/json"
+	"k8s.io/klog/v2"
+)
+
+// NestedFieldCopy returns a deep copy of the value of a nested field.
+// Returns false if the value is missing.
+// No error is returned for a nil field.
+//
+// Note: fields passed to this function are treated as keys within the passed
+// object; no array/slice syntax is supported.
+func NestedFieldCopy(obj map[string]interface{}, fields ...string) (interface{}, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return nil, found, err
+	}
+	return runtime.DeepCopyJSONValue(val), true, nil
+}
+
+// NestedFieldNoCopy returns a reference to a nested field.
+// Returns false if value is not found and an error if unable
+// to traverse obj.
+//
+// Note: fields passed to this function are treated as keys within the passed
+// object; no array/slice syntax is supported.
+func NestedFieldNoCopy(obj map[string]interface{}, fields ...string) (interface{}, bool, error) {
+	var val interface{} = obj
+
+	for i, field := range fields {
+		if val == nil {
+			return nil, false, nil
+		}
+		if m, ok := val.(map[string]interface{}); ok {
+			val, ok = m[field]
+			if !ok {
+				return nil, false, nil
+			}
+		} else {
+			return nil, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected map[string]interface{}", jsonPath(fields[:i+1]), val, val)
+		}
+	}
+	return val, true, nil
+}
+
+// NestedString returns the string value of a nested field.
+// Returns false if value is not found and an error if not a string.
+func NestedString(obj map[string]interface{}, fields ...string) (string, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return "", found, err
+	}
+	s, ok := val.(string)
+	if !ok {
+		return "", false, fmt.Errorf("%v accessor error: %v is of the type %T, expected string", jsonPath(fields), val, val)
+	}
+	return s, true, nil
+}
+
+// NestedBool returns the bool value of a nested field.
+// Returns false if value is not found and an error if not a bool.
+func NestedBool(obj map[string]interface{}, fields ...string) (bool, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return false, found, err
+	}
+	b, ok := val.(bool)
+	if !ok {
+		return false, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected bool", jsonPath(fields), val, val)
+	}
+	return b, true, nil
+}
+
+// NestedFloat64 returns the float64 value of a nested field.
+// Returns false if value is not found and an error if not a float64.
+func NestedFloat64(obj map[string]interface{}, fields ...string) (float64, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return 0, found, err
+	}
+	f, ok := val.(float64)
+	if !ok {
+		return 0, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected float64", jsonPath(fields), val, val)
+	}
+	return f, true, nil
+}
+
+// NestedInt64 returns the int64 value of a nested field.
+// Returns false if value is not found and an error if not an int64.
+func NestedInt64(obj map[string]interface{}, fields ...string) (int64, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return 0, found, err
+	}
+	i, ok := val.(int64)
+	if !ok {
+		return 0, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected int64", jsonPath(fields), val, val)
+	}
+	return i, true, nil
+}
+
+// NestedNumberAsFloat64 returns the float64 value of a nested field. If the field's value is a
+// float64, it is returned. If the field's value is an int64 that can be losslessly converted to
+// float64, it will be converted and returned.  Returns false if value is not found and an error if
+// not a float64 or an int64 that can be accurately represented as a float64.
+func NestedNumberAsFloat64(obj map[string]interface{}, fields ...string) (float64, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return 0, found, err
+	}
+	switch x := val.(type) {
+	case int64:
+		f, accuracy := big.NewInt(x).Float64()
+		if accuracy != big.Exact {
+			return 0, false, fmt.Errorf("%v accessor error: int64 value %v cannot be losslessly converted to float64", jsonPath(fields), x)
+		}
+		return f, true, nil
+	case float64:
+		return x, true, nil
+	default:
+		return 0, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected float64 or int64", jsonPath(fields), val, val)
+	}
+}
+
+// NestedStringSlice returns a copy of []string value of a nested field.
+// Returns false if value is not found and an error if not a []interface{} or contains non-string items in the slice.
+func NestedStringSlice(obj map[string]interface{}, fields ...string) ([]string, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return nil, found, err
+	}
+	m, ok := val.([]interface{})
+	if !ok {
+		return nil, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected []interface{}", jsonPath(fields), val, val)
+	}
+	strSlice := make([]string, 0, len(m))
+	for _, v := range m {
+		if str, ok := v.(string); ok {
+			strSlice = append(strSlice, str)
+		} else {
+			return nil, false, fmt.Errorf("%v accessor error: contains non-string key in the slice: %v is of the type %T, expected string", jsonPath(fields), v, v)
+		}
+	}
+	return strSlice, true, nil
+}
+
+// NestedSlice returns a deep copy of []interface{} value of a nested field.
+// Returns false if value is not found and an error if not a []interface{}.
+func NestedSlice(obj map[string]interface{}, fields ...string) ([]interface{}, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return nil, found, err
+	}
+	_, ok := val.([]interface{})
+	if !ok {
+		return nil, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected []interface{}", jsonPath(fields), val, val)
+	}
+	return runtime.DeepCopyJSONValue(val).([]interface{}), true, nil
+}
+
+// NestedStringMap returns a copy of map[string]string value of a nested field.
+// Returns false if value is not found and an error if not a map[string]interface{} or contains non-string values in the map.
+func NestedStringMap(obj map[string]interface{}, fields ...string) (map[string]string, bool, error) {
+	m, found, err := nestedMapNoCopy(obj, false, fields...)
+	if !found || err != nil {
+		return nil, found, err
+	}
+	strMap := make(map[string]string, len(m))
+	for k, v := range m {
+		if str, ok := v.(string); ok {
+			strMap[k] = str
+		} else {
+			return nil, false, fmt.Errorf("%v accessor error: contains non-string value in the map under key %q: %v is of the type %T, expected string", jsonPath(fields), k, v, v)
+		}
+	}
+	return strMap, true, nil
+}
+
+// NestedNullCoercingStringMap returns a copy of map[string]string value of a nested field.
+// Returns `nil, true, nil` if the value exists and is explicitly null.
+// Returns `nil, false, err` if the value is not a map or a null value, or is a map and contains non-string non-null values.
+// Null values in the map are coerced to "" to match json decoding behavior.
+func NestedNullCoercingStringMap(obj map[string]interface{}, fields ...string) (map[string]string, bool, error) {
+	m, found, err := nestedMapNoCopy(obj, true, fields...)
+	if !found || err != nil || m == nil {
+		return nil, found, err
+	}
+	strMap := make(map[string]string, len(m))
+	for k, v := range m {
+		if str, ok := v.(string); ok {
+			strMap[k] = str
+		} else if v == nil {
+			strMap[k] = ""
+		} else {
+			return nil, false, fmt.Errorf("%v accessor error: contains non-string value in the map under key %q: %v is of the type %T, expected string", jsonPath(fields), k, v, v)
+		}
+	}
+	return strMap, true, nil
+}
+
+// NestedMap returns a deep copy of map[string]interface{} value of a nested field.
+// Returns false if value is not found and an error if not a map[string]interface{}.
+func NestedMap(obj map[string]interface{}, fields ...string) (map[string]interface{}, bool, error) {
+	m, found, err := nestedMapNoCopy(obj, false, fields...)
+	if !found || err != nil {
+		return nil, found, err
+	}
+	return runtime.DeepCopyJSON(m), true, nil
+}
+
+// nestedMapNoCopy returns a map[string]interface{} value of a nested field.
+// Returns false if value is not found and an error if not a map[string]interface{}.
+func nestedMapNoCopy(obj map[string]interface{}, tolerateNil bool, fields ...string) (map[string]interface{}, bool, error) {
+	val, found, err := NestedFieldNoCopy(obj, fields...)
+	if !found || err != nil {
+		return nil, found, err
+	}
+	if val == nil && tolerateNil {
+		return nil, true, nil
+	}
+	m, ok := val.(map[string]interface{})
+	if !ok {
+		return nil, false, fmt.Errorf("%v accessor error: %v is of the type %T, expected map[string]interface{}", jsonPath(fields), val, val)
+	}
+	return m, true, nil
+}
+
+// SetNestedField sets the value of a nested field to a deep copy of the value provided.
+// Returns an error if value cannot be set because one of the nesting levels is not a map[string]interface{}.
+func SetNestedField(obj map[string]interface{}, value interface{}, fields ...string) error {
+	return setNestedFieldNoCopy(obj, runtime.DeepCopyJSONValue(value), fields...)
+}
+
+func setNestedFieldNoCopy(obj map[string]interface{}, value interface{}, fields ...string) error {
+	m := obj
+
+	for i, field := range fields[:len(fields)-1] {
+		if val, ok := m[field]; ok {
+			if valMap, ok := val.(map[string]interface{}); ok {
+				m = valMap
+			} else {
+				return fmt.Errorf("value cannot be set because %v is not a map[string]interface{}", jsonPath(fields[:i+1]))
+			}
+		} else {
+			newVal := make(map[string]interface{})
+			m[field] = newVal
+			m = newVal
+		}
+	}
+	m[fields[len(fields)-1]] = value
+	return nil
+}
+
+// SetNestedStringSlice sets the string slice value of a nested field.
+// Returns an error if value cannot be set because one of the nesting levels is not a map[string]interface{}.
+func SetNestedStringSlice(obj map[string]interface{}, value []string, fields ...string) error {
+	m := make([]interface{}, 0, len(value)) // convert []string into []interface{}
+	for _, v := range value {
+		m = append(m, v)
+	}
+	return setNestedFieldNoCopy(obj, m, fields...)
+}
+
+// SetNestedSlice sets the slice value of a nested field.
+// Returns an error if value cannot be set because one of the nesting levels is not a map[string]interface{}.
+func SetNestedSlice(obj map[string]interface{}, value []interface{}, fields ...string) error {
+	return SetNestedField(obj, value, fields...)
+}
+
+// SetNestedStringMap sets the map[string]string value of a nested field.
+// Returns an error if value cannot be set because one of the nesting levels is not a map[string]interface{}.
+func SetNestedStringMap(obj map[string]interface{}, value map[string]string, fields ...string) error {
+	m := make(map[string]interface{}, len(value)) // convert map[string]string into map[string]interface{}
+	for k, v := range value {
+		m[k] = v
+	}
+	return setNestedFieldNoCopy(obj, m, fields...)
+}
+
+// SetNestedMap sets the map[string]interface{} value of a nested field.
+// Returns an error if value cannot be set because one of the nesting levels is not a map[string]interface{}.
+func SetNestedMap(obj map[string]interface{}, value map[string]interface{}, fields ...string) error {
+	return SetNestedField(obj, value, fields...)
+}
+
+// RemoveNestedField removes the nested field from the obj.
+func RemoveNestedField(obj map[string]interface{}, fields ...string) {
+	m := obj
+	for _, field := range fields[:len(fields)-1] {
+		if x, ok := m[field].(map[string]interface{}); ok {
+			m = x
+		} else {
+			return
+		}
+	}
+	delete(m, fields[len(fields)-1])
+}
+
+func getNestedString(obj map[string]interface{}, fields ...string) string {
+	val, found, err := NestedString(obj, fields...)
+	if !found || err != nil {
+		return ""
+	}
+	return val
+}
+
+func getNestedInt64Pointer(obj map[string]interface{}, fields ...string) *int64 {
+	val, found, err := NestedInt64(obj, fields...)
+	if !found || err != nil {
+		return nil
+	}
+	return &val
+}
+
+func jsonPath(fields []string) string {
+	return "." + strings.Join(fields, ".")
+}
+
+func extractOwnerReference(v map[string]interface{}) metav1.OwnerReference {
+	// though this field is a *bool, but when decoded from JSON, it's
+	// unmarshalled as bool.
+	var controllerPtr *bool
+	if controller, found, err := NestedBool(v, "controller"); err == nil && found {
+		controllerPtr = &controller
+	}
+	var blockOwnerDeletionPtr *bool
+	if blockOwnerDeletion, found, err := NestedBool(v, "blockOwnerDeletion"); err == nil && found {
+		blockOwnerDeletionPtr = &blockOwnerDeletion
+	}
+	return metav1.OwnerReference{
+		Kind:               getNestedString(v, "kind"),
+		Name:               getNestedString(v, "name"),
+		APIVersion:         getNestedString(v, "apiVersion"),
+		UID:                types.UID(getNestedString(v, "uid")),
+		Controller:         controllerPtr,
+		BlockOwnerDeletion: blockOwnerDeletionPtr,
+	}
+}
+
+// UnstructuredJSONScheme is capable of converting JSON data into the Unstructured
+// type, which can be used for generic access to objects without a predefined scheme.
+// TODO: move into serializer/json.
+var UnstructuredJSONScheme runtime.Codec = unstructuredJSONScheme{}
+
+type unstructuredJSONScheme struct{}
+
+const unstructuredJSONSchemeIdentifier runtime.Identifier = "unstructuredJSON"
+
+func (s unstructuredJSONScheme) Decode(data []byte, _ *schema.GroupVersionKind, obj runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	var err error
+	if obj != nil {
+		err = s.decodeInto(data, obj)
+	} else {
+		obj, err = s.decode(data)
+	}
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	gvk := obj.GetObjectKind().GroupVersionKind()
+	if len(gvk.Kind) == 0 {
+		return nil, &gvk, runtime.NewMissingKindErr(string(data))
+	}
+	// TODO(109023): require apiVersion here as well
+
+	return obj, &gvk, nil
+}
+
+func (s unstructuredJSONScheme) Encode(obj runtime.Object, w io.Writer) error {
+	if co, ok := obj.(runtime.CacheableObject); ok {
+		return co.CacheEncode(s.Identifier(), s.doEncode, w)
+	}
+	return s.doEncode(obj, w)
+}
+
+func (unstructuredJSONScheme) doEncode(obj runtime.Object, w io.Writer) error {
+	switch t := obj.(type) {
+	case *Unstructured:
+		return json.NewEncoder(w).Encode(t.Object)
+	case *UnstructuredList:
+		items := make([]interface{}, 0, len(t.Items))
+		for _, i := range t.Items {
+			items = append(items, i.Object)
+		}
+		listObj := make(map[string]interface{}, len(t.Object)+1)
+		for k, v := range t.Object { // Make a shallow copy
+			listObj[k] = v
+		}
+		listObj["items"] = items
+		return json.NewEncoder(w).Encode(listObj)
+	case *runtime.Unknown:
+		// TODO: Unstructured needs to deal with ContentType.
+		_, err := w.Write(t.Raw)
+		return err
+	default:
+		return json.NewEncoder(w).Encode(t)
+	}
+}
+
+// Identifier implements runtime.Encoder interface.
+func (unstructuredJSONScheme) Identifier() runtime.Identifier {
+	return unstructuredJSONSchemeIdentifier
+}
+
+func (s unstructuredJSONScheme) decode(data []byte) (runtime.Object, error) {
+	type detector struct {
+		Items gojson.RawMessage `json:"items"`
+	}
+	var det detector
+	if err := json.Unmarshal(data, &det); err != nil {
+		return nil, err
+	}
+
+	if det.Items != nil {
+		list := &UnstructuredList{}
+		err := s.decodeToList(data, list)
+		return list, err
+	}
+
+	// No Items field, so it wasn't a list.
+	unstruct := &Unstructured{}
+	err := s.decodeToUnstructured(data, unstruct)
+	return unstruct, err
+}
+
+func (s unstructuredJSONScheme) decodeInto(data []byte, obj runtime.Object) error {
+	switch x := obj.(type) {
+	case *Unstructured:
+		return s.decodeToUnstructured(data, x)
+	case *UnstructuredList:
+		return s.decodeToList(data, x)
+	default:
+		return json.Unmarshal(data, x)
+	}
+}
+
+func (unstructuredJSONScheme) decodeToUnstructured(data []byte, unstruct *Unstructured) error {
+	m := make(map[string]interface{})
+	if err := json.Unmarshal(data, &m); err != nil {
+		return err
+	}
+
+	unstruct.Object = m
+
+	return nil
+}
+
+func (s unstructuredJSONScheme) decodeToList(data []byte, list *UnstructuredList) error {
+	type decodeList struct {
+		Items []gojson.RawMessage `json:"items"`
+	}
+
+	var dList decodeList
+	if err := json.Unmarshal(data, &dList); err != nil {
+		return err
+	}
+
+	if err := json.Unmarshal(data, &list.Object); err != nil {
+		return err
+	}
+
+	// For typed lists, e.g., a PodList, API server doesn't set each item's
+	// APIVersion and Kind. We need to set it.
+	listAPIVersion := list.GetAPIVersion()
+	listKind := list.GetKind()
+	itemKind := strings.TrimSuffix(listKind, "List")
+
+	delete(list.Object, "items")
+	list.Items = make([]Unstructured, 0, len(dList.Items))
+	for _, i := range dList.Items {
+		unstruct := &Unstructured{}
+		if err := s.decodeToUnstructured([]byte(i), unstruct); err != nil {
+			return err
+		}
+		// This is hacky. Set the item's Kind and APIVersion to those inferred
+		// from the List.
+		if len(unstruct.GetKind()) == 0 && len(unstruct.GetAPIVersion()) == 0 {
+			unstruct.SetKind(itemKind)
+			unstruct.SetAPIVersion(listAPIVersion)
+		}
+		list.Items = append(list.Items, *unstruct)
+	}
+	return nil
+}
+
+type jsonFallbackEncoder struct {
+	encoder    runtime.Encoder
+	identifier runtime.Identifier
+}
+
+func NewJSONFallbackEncoder(encoder runtime.Encoder) runtime.Encoder {
+	result := map[string]string{
+		"name": "fallback",
+		"base": string(encoder.Identifier()),
+	}
+	identifier, err := gojson.Marshal(result)
+	if err != nil {
+		//nolint:logcheck // Should not be reached.
+		klog.Fatalf("Failed marshaling identifier for jsonFallbackEncoder: %v", err)
+	}
+	return &jsonFallbackEncoder{
+		encoder:    encoder,
+		identifier: runtime.Identifier(identifier),
+	}
+}
+
+func (c *jsonFallbackEncoder) Encode(obj runtime.Object, w io.Writer) error {
+	// There is no need to handle runtime.CacheableObject, as we only
+	// fallback to other encoders here.
+	err := c.encoder.Encode(obj, w)
+	if runtime.IsNotRegisteredError(err) {
+		switch obj.(type) {
+		case *Unstructured, *UnstructuredList:
+			return UnstructuredJSONScheme.Encode(obj, w)
+		}
+	}
+	return err
+}
+
+// Identifier implements runtime.Encoder interface.
+func (c *jsonFallbackEncoder) Identifier() runtime.Identifier {
+	return c.identifier
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers_test.go
new file mode 100644
index 0000000000..7bbb9f91f1
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers_test.go
@@ -0,0 +1,388 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructured
+
+import (
+	"io/ioutil"
+	"math"
+	"reflect"
+	"strings"
+	"sync"
+	"testing"
+
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestCodecOfUnstructuredList tests that there are no data races in Encode().
+// i.e. that it does not mutate the object being encoded.
+func TestCodecOfUnstructuredList(t *testing.T) {
+	var wg sync.WaitGroup
+	concurrency := 10
+	list := UnstructuredList{
+		Object: map[string]interface{}{},
+	}
+	wg.Add(concurrency)
+	for i := 0; i < concurrency; i++ {
+		go func() {
+			defer wg.Done()
+			assert.NoError(t, UnstructuredJSONScheme.Encode(&list, ioutil.Discard))
+		}()
+	}
+	wg.Wait()
+}
+
+func TestRemoveNestedField(t *testing.T) {
+	obj := map[string]interface{}{
+		"x": map[string]interface{}{
+			"y": 1,
+			"a": "foo",
+		},
+	}
+	RemoveNestedField(obj, "x", "a")
+	assert.Len(t, obj["x"], 1)
+	RemoveNestedField(obj, "x", "y")
+	assert.Empty(t, obj["x"])
+	RemoveNestedField(obj, "x")
+	assert.Empty(t, obj)
+	RemoveNestedField(obj, "x") // Remove of a non-existent field
+	assert.Empty(t, obj)
+}
+
+func TestNestedFieldNoCopy(t *testing.T) {
+	target := map[string]interface{}{"foo": "bar"}
+
+	obj := map[string]interface{}{
+		"a": map[string]interface{}{
+			"b": target,
+			"c": nil,
+			"d": []interface{}{"foo"},
+			"e": []interface{}{
+				map[string]interface{}{
+					"f": "bar",
+				},
+			},
+		},
+	}
+
+	// case 1: field exists and is non-nil
+	res, exists, err := NestedFieldNoCopy(obj, "a", "b")
+	assert.True(t, exists)
+	assert.NoError(t, err)
+	assert.Equal(t, target, res)
+	target["foo"] = "baz"
+	assert.Equal(t, target["foo"], res.(map[string]interface{})["foo"], "result should be a reference to the expected item")
+
+	// case 2: field exists and is nil
+	res, exists, err = NestedFieldNoCopy(obj, "a", "c")
+	assert.True(t, exists)
+	assert.NoError(t, err)
+	assert.Nil(t, res)
+
+	// case 3: error traversing obj
+	res, exists, err = NestedFieldNoCopy(obj, "a", "d", "foo")
+	assert.False(t, exists)
+	assert.Error(t, err)
+	assert.Nil(t, res)
+
+	// case 4: field does not exist
+	res, exists, err = NestedFieldNoCopy(obj, "a", "g")
+	assert.False(t, exists)
+	assert.NoError(t, err)
+	assert.Nil(t, res)
+
+	// case 5: intermediate field does not exist
+	res, exists, err = NestedFieldNoCopy(obj, "a", "g", "f")
+	assert.False(t, exists)
+	assert.NoError(t, err)
+	assert.Nil(t, res)
+
+	// case 6: intermediate field is null
+	//         (background: happens easily in YAML)
+	res, exists, err = NestedFieldNoCopy(obj, "a", "c", "f")
+	assert.False(t, exists)
+	assert.NoError(t, err)
+	assert.Nil(t, res)
+
+	// case 7: array/slice syntax is not supported
+	//         (background: users may expect this to be supported)
+	res, exists, err = NestedFieldNoCopy(obj, "a", "e[0]")
+	assert.False(t, exists)
+	assert.NoError(t, err)
+	assert.Nil(t, res)
+}
+
+func TestNestedFieldCopy(t *testing.T) {
+	target := map[string]interface{}{"foo": "bar"}
+
+	obj := map[string]interface{}{
+		"a": map[string]interface{}{
+			"b": target,
+			"c": nil,
+			"d": []interface{}{"foo"},
+		},
+	}
+
+	// case 1: field exists and is non-nil
+	res, exists, err := NestedFieldCopy(obj, "a", "b")
+	assert.True(t, exists)
+	assert.NoError(t, err)
+	assert.Equal(t, target, res)
+	target["foo"] = "baz"
+	assert.NotEqual(t, target["foo"], res.(map[string]interface{})["foo"], "result should be a copy of the expected item")
+
+	// case 2: field exists and is nil
+	res, exists, err = NestedFieldCopy(obj, "a", "c")
+	assert.True(t, exists)
+	assert.NoError(t, err)
+	assert.Nil(t, res)
+
+	// case 3: error traversing obj
+	res, exists, err = NestedFieldCopy(obj, "a", "d", "foo")
+	assert.False(t, exists)
+	assert.Error(t, err)
+	assert.Nil(t, res)
+
+	// case 4: field does not exist
+	res, exists, err = NestedFieldCopy(obj, "a", "e")
+	assert.False(t, exists)
+	assert.NoError(t, err)
+	assert.Nil(t, res)
+}
+
+func TestCacheableObject(t *testing.T) {
+	runtimetesting.CacheableObjectTest(t, UnstructuredJSONScheme)
+}
+
+func TestSetNestedStringSlice(t *testing.T) {
+	obj := map[string]interface{}{
+		"x": map[string]interface{}{
+			"y": 1,
+			"a": "foo",
+		},
+	}
+
+	err := SetNestedStringSlice(obj, []string{"bar"}, "x", "z")
+	assert.NoError(t, err)
+	assert.Len(t, obj["x"], 3)
+	assert.Len(t, obj["x"].(map[string]interface{})["z"], 1)
+	assert.Equal(t, "bar", obj["x"].(map[string]interface{})["z"].([]interface{})[0])
+}
+
+func TestSetNestedSlice(t *testing.T) {
+	obj := map[string]interface{}{
+		"x": map[string]interface{}{
+			"y": 1,
+			"a": "foo",
+		},
+	}
+
+	err := SetNestedSlice(obj, []interface{}{"bar"}, "x", "z")
+	assert.NoError(t, err)
+	assert.Len(t, obj["x"], 3)
+	assert.Len(t, obj["x"].(map[string]interface{})["z"], 1)
+	assert.Equal(t, "bar", obj["x"].(map[string]interface{})["z"].([]interface{})[0])
+}
+
+func TestSetNestedStringMap(t *testing.T) {
+	obj := map[string]interface{}{
+		"x": map[string]interface{}{
+			"y": 1,
+			"a": "foo",
+		},
+	}
+
+	err := SetNestedStringMap(obj, map[string]string{"b": "bar"}, "x", "z")
+	assert.NoError(t, err)
+	assert.Len(t, obj["x"], 3)
+	assert.Len(t, obj["x"].(map[string]interface{})["z"], 1)
+	assert.Equal(t, "bar", obj["x"].(map[string]interface{})["z"].(map[string]interface{})["b"])
+}
+
+func TestSetNestedMap(t *testing.T) {
+	obj := map[string]interface{}{
+		"x": map[string]interface{}{
+			"y": 1,
+			"a": "foo",
+		},
+	}
+
+	err := SetNestedMap(obj, map[string]interface{}{"b": "bar"}, "x", "z")
+	assert.NoError(t, err)
+	assert.Len(t, obj["x"], 3)
+	assert.Len(t, obj["x"].(map[string]interface{})["z"], 1)
+	assert.Equal(t, "bar", obj["x"].(map[string]interface{})["z"].(map[string]interface{})["b"])
+}
+
+func TestNestedNumberAsFloat64(t *testing.T) {
+	for _, tc := range []struct {
+		name           string
+		obj            map[string]interface{}
+		path           []string
+		wantFloat64    float64
+		wantBool       bool
+		wantErrMessage string
+	}{
+		{
+			name:           "not found",
+			obj:            nil,
+			path:           []string{"missing"},
+			wantFloat64:    0,
+			wantBool:       false,
+			wantErrMessage: "",
+		},
+		{
+			name:           "found float64",
+			obj:            map[string]interface{}{"value": float64(42)},
+			path:           []string{"value"},
+			wantFloat64:    42,
+			wantBool:       true,
+			wantErrMessage: "",
+		},
+		{
+			name:           "found unexpected type bool",
+			obj:            map[string]interface{}{"value": true},
+			path:           []string{"value"},
+			wantFloat64:    0,
+			wantBool:       false,
+			wantErrMessage: ".value accessor error: true is of the type bool, expected float64 or int64",
+		},
+		{
+			name:           "found int64",
+			obj:            map[string]interface{}{"value": int64(42)},
+			path:           []string{"value"},
+			wantFloat64:    42,
+			wantBool:       true,
+			wantErrMessage: "",
+		},
+		{
+			name:           "found int64 not representable as float64",
+			obj:            map[string]interface{}{"value": int64(math.MaxInt64)},
+			path:           []string{"value"},
+			wantFloat64:    0,
+			wantBool:       false,
+			wantErrMessage: ".value accessor error: int64 value 9223372036854775807 cannot be losslessly converted to float64",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			gotFloat64, gotBool, gotErr := NestedNumberAsFloat64(tc.obj, tc.path...)
+			if gotFloat64 != tc.wantFloat64 {
+				t.Errorf("got %v, wanted %v", gotFloat64, tc.wantFloat64)
+			}
+			if gotBool != tc.wantBool {
+				t.Errorf("got %t, wanted %t", gotBool, tc.wantBool)
+			}
+			if tc.wantErrMessage != "" {
+				if gotErr == nil {
+					t.Errorf("got nil error, wanted %s", tc.wantErrMessage)
+				} else if gotErrMessage := gotErr.Error(); gotErrMessage != tc.wantErrMessage {
+					t.Errorf("wanted error %q, got: %v", gotErrMessage, tc.wantErrMessage)
+				}
+			} else if gotErr != nil {
+				t.Errorf("wanted nil error, got %v", gotErr)
+			}
+		})
+	}
+}
+
+func TestNestedNullCoercingStringMap(t *testing.T) {
+	for _, tc := range []struct {
+		name           string
+		obj            map[string]interface{}
+		path           []string
+		wantObj        map[string]string
+		wantFound      bool
+		wantErrMessage string
+	}{
+		{
+			name:           "missing map",
+			obj:            nil,
+			path:           []string{"path"},
+			wantObj:        nil,
+			wantFound:      false,
+			wantErrMessage: "",
+		},
+		{
+			name:           "null map",
+			obj:            map[string]interface{}{"path": nil},
+			path:           []string{"path"},
+			wantObj:        nil,
+			wantFound:      true,
+			wantErrMessage: "",
+		},
+		{
+			name:           "non map",
+			obj:            map[string]interface{}{"path": 0},
+			path:           []string{"path"},
+			wantObj:        nil,
+			wantFound:      false,
+			wantErrMessage: "type int",
+		},
+		{
+			name:           "empty map",
+			obj:            map[string]interface{}{"path": map[string]interface{}{}},
+			path:           []string{"path"},
+			wantObj:        map[string]string{},
+			wantFound:      true,
+			wantErrMessage: "",
+		},
+		{
+			name:           "string value",
+			obj:            map[string]interface{}{"path": map[string]interface{}{"a": "1", "b": "2"}},
+			path:           []string{"path"},
+			wantObj:        map[string]string{"a": "1", "b": "2"},
+			wantFound:      true,
+			wantErrMessage: "",
+		},
+		{
+			name:           "null value",
+			obj:            map[string]interface{}{"path": map[string]interface{}{"a": "1", "b": nil}},
+			path:           []string{"path"},
+			wantObj:        map[string]string{"a": "1", "b": ""},
+			wantFound:      true,
+			wantErrMessage: "",
+		},
+		{
+			name:           "invalid value",
+			obj:            map[string]interface{}{"path": map[string]interface{}{"a": "1", "b": nil, "c": 0}},
+			path:           []string{"path"},
+			wantObj:        nil,
+			wantFound:      false,
+			wantErrMessage: `key "c": 0`,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			gotObj, gotFound, gotErr := NestedNullCoercingStringMap(tc.obj, tc.path...)
+			if !reflect.DeepEqual(gotObj, tc.wantObj) {
+				t.Errorf("got %#v, wanted %#v", gotObj, tc.wantObj)
+			}
+			if gotFound != tc.wantFound {
+				t.Errorf("got %v, wanted %v", gotFound, tc.wantFound)
+			}
+			if tc.wantErrMessage != "" {
+				if gotErr == nil {
+					t.Errorf("got nil error, wanted %s", tc.wantErrMessage)
+				} else if gotErrMessage := gotErr.Error(); !strings.Contains(gotErrMessage, tc.wantErrMessage) {
+					t.Errorf("wanted error %q, got: %v", gotErrMessage, tc.wantErrMessage)
+				}
+			} else if gotErr != nil {
+				t.Errorf("wanted nil error, got %v", gotErr)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured.go
new file mode 100644
index 0000000000..fdb0c86297
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured.go
@@ -0,0 +1,493 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructured
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// Unstructured allows objects that do not have Golang structs registered to be manipulated
+// generically. This can be used to deal with the API objects from a plug-in. Unstructured
+// objects still have functioning TypeMeta features-- kind, version, etc.
+//
+// WARNING: This object has accessors for the v1 standard metadata. You *MUST NOT* use this
+// type if you are dealing with objects that are not in the server meta v1 schema.
+//
+// TODO: make the serialization part of this type distinct from the field accessors.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:deepcopy-gen=true
+type Unstructured struct {
+	// Object is a JSON compatible map with string, float, int, bool, []interface{}, or
+	// map[string]interface{}
+	// children.
+	Object map[string]interface{}
+}
+
+var _ metav1.Object = &Unstructured{}
+var _ runtime.Unstructured = &Unstructured{}
+var _ metav1.ListInterface = &Unstructured{}
+
+func (obj *Unstructured) GetObjectKind() schema.ObjectKind { return obj }
+
+func (obj *Unstructured) IsList() bool {
+	field, ok := obj.Object["items"]
+	if !ok {
+		return false
+	}
+	_, ok = field.([]interface{})
+	return ok
+}
+func (obj *Unstructured) ToList() (*UnstructuredList, error) {
+	if !obj.IsList() {
+		// return an empty list back
+		return &UnstructuredList{Object: obj.Object}, nil
+	}
+
+	ret := &UnstructuredList{}
+	ret.Object = obj.Object
+
+	err := obj.EachListItem(func(item runtime.Object) error {
+		castItem := item.(*Unstructured)
+		ret.Items = append(ret.Items, *castItem)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return ret, nil
+}
+
+func (obj *Unstructured) EachListItem(fn func(runtime.Object) error) error {
+	field, ok := obj.Object["items"]
+	if !ok {
+		return errors.New("content is not a list")
+	}
+	items, ok := field.([]interface{})
+	if !ok {
+		return fmt.Errorf("content is not a list: %T", field)
+	}
+	for _, item := range items {
+		child, ok := item.(map[string]interface{})
+		if !ok {
+			return fmt.Errorf("items member is not an object: %T", child)
+		}
+		if err := fn(&Unstructured{Object: child}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (obj *Unstructured) EachListItemWithAlloc(fn func(runtime.Object) error) error {
+	// EachListItem has allocated a new Object for the user, we can use it directly.
+	return obj.EachListItem(fn)
+}
+
+func (obj *Unstructured) UnstructuredContent() map[string]interface{} {
+	if obj.Object == nil {
+		return make(map[string]interface{})
+	}
+	return obj.Object
+}
+
+func (obj *Unstructured) SetUnstructuredContent(content map[string]interface{}) {
+	obj.Object = content
+}
+
+// MarshalJSON ensures that the unstructured object produces proper
+// JSON when passed to Go's standard JSON library.
+func (u *Unstructured) MarshalJSON() ([]byte, error) {
+	var buf bytes.Buffer
+	err := UnstructuredJSONScheme.Encode(u, &buf)
+	return buf.Bytes(), err
+}
+
+// UnmarshalJSON ensures that the unstructured object properly decodes
+// JSON when passed to Go's standard JSON library.
+func (u *Unstructured) UnmarshalJSON(b []byte) error {
+	_, _, err := UnstructuredJSONScheme.Decode(b, nil, u)
+	return err
+}
+
+// NewEmptyInstance returns a new instance of the concrete type containing only kind/apiVersion and no other data.
+// This should be called instead of reflect.New() for unstructured types because the go type alone does not preserve kind/apiVersion info.
+func (in *Unstructured) NewEmptyInstance() runtime.Unstructured {
+	out := new(Unstructured)
+	if in != nil {
+		out.GetObjectKind().SetGroupVersionKind(in.GetObjectKind().GroupVersionKind())
+	}
+	return out
+}
+
+func (in *Unstructured) DeepCopy() *Unstructured {
+	if in == nil {
+		return nil
+	}
+	out := new(Unstructured)
+	*out = *in
+	out.Object = runtime.DeepCopyJSON(in.Object)
+	return out
+}
+
+func (u *Unstructured) setNestedField(value interface{}, fields ...string) {
+	if u.Object == nil {
+		u.Object = make(map[string]interface{})
+	}
+	SetNestedField(u.Object, value, fields...)
+}
+
+func (u *Unstructured) setNestedStringSlice(value []string, fields ...string) {
+	if u.Object == nil {
+		u.Object = make(map[string]interface{})
+	}
+	SetNestedStringSlice(u.Object, value, fields...)
+}
+
+func (u *Unstructured) setNestedSlice(value []interface{}, fields ...string) {
+	if u.Object == nil {
+		u.Object = make(map[string]interface{})
+	}
+	SetNestedSlice(u.Object, value, fields...)
+}
+
+func (u *Unstructured) setNestedMap(value map[string]string, fields ...string) {
+	if u.Object == nil {
+		u.Object = make(map[string]interface{})
+	}
+	SetNestedStringMap(u.Object, value, fields...)
+}
+
+func (u *Unstructured) GetOwnerReferences() []metav1.OwnerReference {
+	field, found, err := NestedFieldNoCopy(u.Object, "metadata", "ownerReferences")
+	if !found || err != nil {
+		return nil
+	}
+	original, ok := field.([]interface{})
+	if !ok {
+		return nil
+	}
+	ret := make([]metav1.OwnerReference, 0, len(original))
+	for _, obj := range original {
+		o, ok := obj.(map[string]interface{})
+		if !ok {
+			// expected map[string]interface{}, got something else
+			return nil
+		}
+		ret = append(ret, extractOwnerReference(o))
+	}
+	return ret
+}
+
+func (u *Unstructured) SetOwnerReferences(references []metav1.OwnerReference) {
+	if references == nil {
+		RemoveNestedField(u.Object, "metadata", "ownerReferences")
+		return
+	}
+
+	newReferences := make([]interface{}, 0, len(references))
+	for _, reference := range references {
+		out, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&reference)
+		if err != nil {
+			utilruntime.HandleError(fmt.Errorf("unable to convert Owner Reference: %v", err))
+			continue
+		}
+		newReferences = append(newReferences, out)
+	}
+	u.setNestedField(newReferences, "metadata", "ownerReferences")
+}
+
+func (u *Unstructured) GetAPIVersion() string {
+	return getNestedString(u.Object, "apiVersion")
+}
+
+func (u *Unstructured) SetAPIVersion(version string) {
+	u.setNestedField(version, "apiVersion")
+}
+
+func (u *Unstructured) GetKind() string {
+	return getNestedString(u.Object, "kind")
+}
+
+func (u *Unstructured) SetKind(kind string) {
+	u.setNestedField(kind, "kind")
+}
+
+func (u *Unstructured) GetNamespace() string {
+	return getNestedString(u.Object, "metadata", "namespace")
+}
+
+func (u *Unstructured) SetNamespace(namespace string) {
+	if len(namespace) == 0 {
+		RemoveNestedField(u.Object, "metadata", "namespace")
+		return
+	}
+	u.setNestedField(namespace, "metadata", "namespace")
+}
+
+func (u *Unstructured) GetName() string {
+	return getNestedString(u.Object, "metadata", "name")
+}
+
+func (u *Unstructured) SetName(name string) {
+	if len(name) == 0 {
+		RemoveNestedField(u.Object, "metadata", "name")
+		return
+	}
+	u.setNestedField(name, "metadata", "name")
+}
+
+func (u *Unstructured) GetGenerateName() string {
+	return getNestedString(u.Object, "metadata", "generateName")
+}
+
+func (u *Unstructured) SetGenerateName(generateName string) {
+	if len(generateName) == 0 {
+		RemoveNestedField(u.Object, "metadata", "generateName")
+		return
+	}
+	u.setNestedField(generateName, "metadata", "generateName")
+}
+
+func (u *Unstructured) GetUID() types.UID {
+	return types.UID(getNestedString(u.Object, "metadata", "uid"))
+}
+
+func (u *Unstructured) SetUID(uid types.UID) {
+	if len(string(uid)) == 0 {
+		RemoveNestedField(u.Object, "metadata", "uid")
+		return
+	}
+	u.setNestedField(string(uid), "metadata", "uid")
+}
+
+func (u *Unstructured) GetResourceVersion() string {
+	return getNestedString(u.Object, "metadata", "resourceVersion")
+}
+
+func (u *Unstructured) SetResourceVersion(resourceVersion string) {
+	if len(resourceVersion) == 0 {
+		RemoveNestedField(u.Object, "metadata", "resourceVersion")
+		return
+	}
+	u.setNestedField(resourceVersion, "metadata", "resourceVersion")
+}
+
+func (u *Unstructured) GetGeneration() int64 {
+	val, found, err := NestedInt64(u.Object, "metadata", "generation")
+	if !found || err != nil {
+		return 0
+	}
+	return val
+}
+
+func (u *Unstructured) SetGeneration(generation int64) {
+	if generation == 0 {
+		RemoveNestedField(u.Object, "metadata", "generation")
+		return
+	}
+	u.setNestedField(generation, "metadata", "generation")
+}
+
+func (u *Unstructured) GetSelfLink() string {
+	return getNestedString(u.Object, "metadata", "selfLink")
+}
+
+func (u *Unstructured) SetSelfLink(selfLink string) {
+	if len(selfLink) == 0 {
+		RemoveNestedField(u.Object, "metadata", "selfLink")
+		return
+	}
+	u.setNestedField(selfLink, "metadata", "selfLink")
+}
+
+func (u *Unstructured) GetContinue() string {
+	return getNestedString(u.Object, "metadata", "continue")
+}
+
+func (u *Unstructured) SetContinue(c string) {
+	if len(c) == 0 {
+		RemoveNestedField(u.Object, "metadata", "continue")
+		return
+	}
+	u.setNestedField(c, "metadata", "continue")
+}
+
+func (u *Unstructured) GetRemainingItemCount() *int64 {
+	return getNestedInt64Pointer(u.Object, "metadata", "remainingItemCount")
+}
+
+func (u *Unstructured) SetRemainingItemCount(c *int64) {
+	if c == nil {
+		RemoveNestedField(u.Object, "metadata", "remainingItemCount")
+	} else {
+		u.setNestedField(*c, "metadata", "remainingItemCount")
+	}
+}
+
+func (u *Unstructured) GetCreationTimestamp() metav1.Time {
+	var timestamp metav1.Time
+	timestamp.UnmarshalQueryParameter(getNestedString(u.Object, "metadata", "creationTimestamp"))
+	return timestamp
+}
+
+func (u *Unstructured) SetCreationTimestamp(timestamp metav1.Time) {
+	ts, _ := timestamp.MarshalQueryParameter()
+	if len(ts) == 0 || timestamp.Time.IsZero() {
+		RemoveNestedField(u.Object, "metadata", "creationTimestamp")
+		return
+	}
+	u.setNestedField(ts, "metadata", "creationTimestamp")
+}
+
+func (u *Unstructured) GetDeletionTimestamp() *metav1.Time {
+	var timestamp metav1.Time
+	timestamp.UnmarshalQueryParameter(getNestedString(u.Object, "metadata", "deletionTimestamp"))
+	if timestamp.IsZero() {
+		return nil
+	}
+	return &timestamp
+}
+
+func (u *Unstructured) SetDeletionTimestamp(timestamp *metav1.Time) {
+	if timestamp == nil {
+		RemoveNestedField(u.Object, "metadata", "deletionTimestamp")
+		return
+	}
+	ts, _ := timestamp.MarshalQueryParameter()
+	u.setNestedField(ts, "metadata", "deletionTimestamp")
+}
+
+func (u *Unstructured) GetDeletionGracePeriodSeconds() *int64 {
+	val, found, err := NestedInt64(u.Object, "metadata", "deletionGracePeriodSeconds")
+	if !found || err != nil {
+		return nil
+	}
+	return &val
+}
+
+func (u *Unstructured) SetDeletionGracePeriodSeconds(deletionGracePeriodSeconds *int64) {
+	if deletionGracePeriodSeconds == nil {
+		RemoveNestedField(u.Object, "metadata", "deletionGracePeriodSeconds")
+		return
+	}
+	u.setNestedField(*deletionGracePeriodSeconds, "metadata", "deletionGracePeriodSeconds")
+}
+
+func (u *Unstructured) GetLabels() map[string]string {
+	m, _, _ := NestedNullCoercingStringMap(u.Object, "metadata", "labels")
+	return m
+}
+
+func (u *Unstructured) SetLabels(labels map[string]string) {
+	if labels == nil {
+		RemoveNestedField(u.Object, "metadata", "labels")
+		return
+	}
+	u.setNestedMap(labels, "metadata", "labels")
+}
+
+func (u *Unstructured) GetAnnotations() map[string]string {
+	m, _, _ := NestedNullCoercingStringMap(u.Object, "metadata", "annotations")
+	return m
+}
+
+func (u *Unstructured) SetAnnotations(annotations map[string]string) {
+	if annotations == nil {
+		RemoveNestedField(u.Object, "metadata", "annotations")
+		return
+	}
+	u.setNestedMap(annotations, "metadata", "annotations")
+}
+
+func (u *Unstructured) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	u.SetAPIVersion(gvk.GroupVersion().String())
+	u.SetKind(gvk.Kind)
+}
+
+func (u *Unstructured) GroupVersionKind() schema.GroupVersionKind {
+	gv, err := schema.ParseGroupVersion(u.GetAPIVersion())
+	if err != nil {
+		return schema.GroupVersionKind{}
+	}
+	gvk := gv.WithKind(u.GetKind())
+	return gvk
+}
+
+func (u *Unstructured) GetFinalizers() []string {
+	val, _, _ := NestedStringSlice(u.Object, "metadata", "finalizers")
+	return val
+}
+
+func (u *Unstructured) SetFinalizers(finalizers []string) {
+	if finalizers == nil {
+		RemoveNestedField(u.Object, "metadata", "finalizers")
+		return
+	}
+	u.setNestedStringSlice(finalizers, "metadata", "finalizers")
+}
+
+func (u *Unstructured) GetManagedFields() []metav1.ManagedFieldsEntry {
+	v, found, err := NestedFieldNoCopy(u.Object, "metadata", "managedFields")
+	if !found || err != nil {
+		return nil
+	}
+	items, ok := v.([]interface{})
+	if !ok {
+		return nil
+	}
+	managedFields := []metav1.ManagedFieldsEntry{}
+	for _, item := range items {
+		m, ok := item.(map[string]interface{})
+		if !ok {
+			utilruntime.HandleError(fmt.Errorf("unable to retrieve managedFields for object, item %v is not a map", item))
+			return nil
+		}
+		out := metav1.ManagedFieldsEntry{}
+		if err := runtime.DefaultUnstructuredConverter.FromUnstructured(m, &out); err != nil {
+			utilruntime.HandleError(fmt.Errorf("unable to retrieve managedFields for object: %v", err))
+			return nil
+		}
+		managedFields = append(managedFields, out)
+	}
+	return managedFields
+}
+
+func (u *Unstructured) SetManagedFields(managedFields []metav1.ManagedFieldsEntry) {
+	if managedFields == nil {
+		RemoveNestedField(u.Object, "metadata", "managedFields")
+		return
+	}
+	items := []interface{}{}
+	for _, managedFieldsEntry := range managedFields {
+		out, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&managedFieldsEntry)
+		if err != nil {
+			utilruntime.HandleError(fmt.Errorf("unable to set managedFields for object: %v", err))
+			return
+		}
+		items = append(items, out)
+	}
+	u.setNestedSlice(items, "metadata", "managedFields")
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_conversion_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_conversion_test.go
new file mode 100644
index 0000000000..8b4d092ec7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_conversion_test.go
@@ -0,0 +1,532 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructured_test
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	testapigroupv1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/test"
+)
+
+func TestObjectToUnstructuredConversion(t *testing.T) {
+	scheme, _ := test.TestScheme()
+	testCases := []struct {
+		name                          string
+		objectToConvert               runtime.Object
+		expectedErr                   error
+		expectedConvertedUnstructured *unstructured.Unstructured
+	}{
+		{
+			name:                          "convert nil object to unstructured should fail",
+			objectToConvert:               nil,
+			expectedErr:                   fmt.Errorf("unable to convert object type <nil> to Unstructured, must be a runtime.Object"),
+			expectedConvertedUnstructured: &unstructured.Unstructured{},
+		},
+		{
+			name:            "convert versioned empty object to unstructured should work",
+			objectToConvert: &testapigroupv1.Carp{},
+			expectedConvertedUnstructured: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata":   map[string]interface{}{},
+					"spec":       map[string]interface{}{},
+					"status":     map[string]interface{}{},
+				},
+			},
+		},
+		{
+			name: "convert valid versioned object to unstructured should work",
+			objectToConvert: &testapigroupv1.Carp{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "noxu",
+				},
+				Spec: testapigroupv1.CarpSpec{
+					Hostname: "example.com",
+				},
+			},
+			expectedConvertedUnstructured: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+		},
+		{
+			name:            "convert hub-versioned object to unstructured should fail",
+			objectToConvert: &testapigroup.Carp{},
+			expectedErr:     fmt.Errorf("unable to convert the internal object type *testapigroup.Carp to Unstructured without providing a preferred version to convert to"),
+		},
+	}
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			outUnstructured := &unstructured.Unstructured{}
+			err := scheme.Convert(testCase.objectToConvert, outUnstructured, nil)
+			if err != nil {
+				assert.Equal(t, testCase.expectedErr, err)
+				return
+			}
+			assert.Equal(t, testCase.expectedConvertedUnstructured, outUnstructured)
+		})
+	}
+}
+
+func TestUnstructuredToObjectConversion(t *testing.T) {
+	scheme, _ := test.TestScheme()
+	testCases := []struct {
+		name                    string
+		unstructuredToConvert   *unstructured.Unstructured
+		convertingObject        runtime.Object
+		expectPanic             bool
+		expectedErrFunc         func(err error) bool
+		expectedConvertedObject runtime.Object
+	}{
+		{
+			name: "convert empty unstructured w/o gvk to versioned object should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{},
+			},
+			convertingObject: &testapigroupv1.Carp{},
+			expectedErrFunc: func(err error) bool {
+				return reflect.DeepEqual(err, runtime.NewMissingKindErr("unstructured object has no kind"))
+			},
+		},
+		{
+			name: "convert empty versioned unstructured to versioned object should work",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+				},
+			},
+			convertingObject:        &testapigroupv1.Carp{},
+			expectedConvertedObject: &testapigroupv1.Carp{},
+		},
+		{
+			name: "convert empty unstructured w/o gvk to versioned object should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{},
+			},
+			convertingObject: &testapigroupv1.Carp{},
+			expectedErrFunc: func(err error) bool {
+				return reflect.DeepEqual(err, runtime.NewMissingKindErr("unstructured object has no kind"))
+			},
+		},
+		{
+			name: "convert valid versioned unstructured to versioned object should work",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+			convertingObject: &testapigroupv1.Carp{},
+			expectedConvertedObject: &testapigroupv1.Carp{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "noxu",
+				},
+				Spec: testapigroupv1.CarpSpec{
+					Hostname: "example.com",
+				},
+			},
+		},
+		{
+			name: "convert valid versioned unstructured to hub-versioned object should work",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+			convertingObject: &testapigroup.Carp{},
+			expectedConvertedObject: &testapigroup.Carp{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "noxu",
+				},
+				Spec: testapigroup.CarpSpec{
+					Hostname: "example.com",
+				},
+			},
+		},
+		{
+			name: "convert unexisting-versioned unstructured to hub-versioned object should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v9",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+			convertingObject: &testapigroup.Carp{},
+			expectedErrFunc: func(err error) bool {
+				return reflect.DeepEqual(err, runtime.NewNotRegisteredGVKErrForTarget(
+					scheme.Name(),
+					schema.GroupVersionKind{Group: "", Version: "v9", Kind: "Carp"},
+					nil,
+				))
+			},
+		},
+		{
+			name: "convert valid versioned unstructured to object w/ a mismatching kind should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+			convertingObject: &metav1.CreateOptions{},
+			expectedErrFunc: func(err error) bool {
+				return strings.HasPrefix(err.Error(), "converting (v1.Carp) to (v1.CreateOptions):")
+			},
+		},
+	}
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			defer func() {
+				v := recover()
+				assert.Equal(t, testCase.expectPanic, v != nil, "unexpected panic")
+			}()
+			outObject := testCase.convertingObject.DeepCopyObject()
+			// Convert by specifying destination object
+			err := scheme.Convert(testCase.unstructuredToConvert, outObject, nil)
+			if err != nil {
+				if testCase.expectedErrFunc != nil {
+					if !testCase.expectedErrFunc(err) {
+						t.Errorf("error mismatched: %v", err)
+					}
+				}
+				return
+			}
+			assert.Equal(t, testCase.expectedConvertedObject, outObject)
+		})
+	}
+}
+
+func TestUnstructuredToGVConversion(t *testing.T) {
+	scheme, _ := test.TestScheme()
+	// HACK: registering fake internal/v1beta1 api
+	scheme.AddKnownTypes(schema.GroupVersion{Group: "foo", Version: "v1beta1"}, &testapigroup.Carp{})
+	scheme.AddKnownTypes(schema.GroupVersion{Group: "foo", Version: "__internal"}, &testapigroup.Carp{})
+
+	testCases := []struct {
+		name                    string
+		unstructuredToConvert   *unstructured.Unstructured
+		targetGV                schema.GroupVersion
+		expectPanic             bool
+		expectedErrFunc         func(err error) bool
+		expectedConvertedObject runtime.Object
+	}{
+		{
+			name: "convert versioned unstructured to valid external version should work",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+				},
+			},
+			targetGV: schema.GroupVersion{Group: "", Version: "v1"},
+			expectedConvertedObject: &testapigroupv1.Carp{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "v1",
+					Kind:       "Carp",
+				},
+			},
+		},
+		{
+			name: "convert hub-versioned unstructured to hub version should work",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "__internal",
+					"kind":       "Carp",
+				},
+			},
+			targetGV:                schema.GroupVersion{Group: "", Version: "__internal"},
+			expectedConvertedObject: &testapigroup.Carp{},
+		},
+		{
+			name: "convert empty unstructured w/o gvk to versioned should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{},
+			},
+			targetGV: schema.GroupVersion{Group: "", Version: "v1"},
+			expectedErrFunc: func(err error) bool {
+				return reflect.DeepEqual(err, runtime.NewMissingKindErr("unstructured object has no kind"))
+			},
+			expectedConvertedObject: nil,
+		},
+		{
+			name: "convert versioned unstructured to mismatching external version should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+				},
+			},
+			targetGV: schema.GroupVersion{Group: "foo", Version: "v1beta1"},
+			expectedErrFunc: func(err error) bool {
+				return reflect.DeepEqual(err, runtime.NewNotRegisteredErrForTarget(
+					scheme.Name(), reflect.TypeOf(testapigroupv1.Carp{}), schema.GroupVersion{Group: "foo", Version: "v1beta1"}))
+			},
+			expectedConvertedObject: nil,
+		},
+		{
+			name: "convert versioned unstructured to mismatching internal version should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+				},
+			},
+			targetGV: schema.GroupVersion{Group: "foo", Version: "__internal"},
+			expectedErrFunc: func(err error) bool {
+				return reflect.DeepEqual(err, runtime.NewNotRegisteredErrForTarget(
+					scheme.Name(), reflect.TypeOf(testapigroupv1.Carp{}), schema.GroupVersion{Group: "foo", Version: "__internal"}))
+			},
+			expectedConvertedObject: nil,
+		},
+		{
+			name: "convert valid versioned unstructured to its own version should work",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+			targetGV: schema.GroupVersion{Group: "", Version: "v1"},
+			expectedConvertedObject: &testapigroupv1.Carp{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "v1",
+					Kind:       "Carp",
+				},
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "noxu",
+				},
+				Spec: testapigroupv1.CarpSpec{
+					Hostname: "example.com",
+				},
+			},
+		},
+		{
+			name: "convert valid versioned unstructured to hub-version should work ignoring type meta",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+			targetGV: schema.GroupVersion{Group: "", Version: "__internal"},
+			expectedConvertedObject: &testapigroup.Carp{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "noxu",
+				},
+				Spec: testapigroup.CarpSpec{
+					Hostname: "example.com",
+				},
+			},
+		},
+		{
+			name: "convert valid versioned unstructured to unexisting version should fail",
+			unstructuredToConvert: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Carp",
+					"metadata": map[string]interface{}{
+						"name": "noxu",
+					},
+					"spec": map[string]interface{}{
+						"hostname": "example.com",
+					},
+					"status": map[string]interface{}{},
+				},
+			},
+			targetGV: schema.GroupVersion{Group: "", Version: "v9"},
+			expectedErrFunc: func(err error) bool {
+				return reflect.DeepEqual(err, runtime.NewNotRegisteredGVKErrForTarget(
+					scheme.Name(),
+					schema.GroupVersionKind{Group: "", Version: "v9", Kind: "Carp"},
+					nil,
+				))
+			},
+			expectedConvertedObject: nil,
+		},
+	}
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			defer func() {
+				v := recover()
+				assert.Equal(t, testCase.expectPanic, v != nil, "unexpected panic")
+			}()
+			// Convert by specifying destination object
+			outObject, err := scheme.ConvertToVersion(testCase.unstructuredToConvert, testCase.targetGV)
+			if testCase.expectedErrFunc != nil {
+				if !testCase.expectedErrFunc(err) {
+					t.Errorf("error mismatched: %v", err)
+				}
+			}
+			assert.Equal(t, testCase.expectedConvertedObject, outObject)
+		})
+	}
+}
+
+func TestUnstructuredToUnstructuredConversion(t *testing.T) {
+	// eventually, we don't want any inter-unstructured conversion happen, but for now, the conversion
+	// just copy/pastes
+	scheme, _ := test.TestScheme()
+	inUnstructured := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": "v1",
+			"kind":       "Carp",
+		},
+	}
+	outUnstructured := &unstructured.Unstructured{}
+	err := scheme.Convert(inUnstructured, outUnstructured, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, inUnstructured, outUnstructured)
+}
+
+func benchmarkCarp() *testapigroupv1.Carp {
+	t := metav1.Date(2015, 1, 1, 12, 0, 0, 0, time.UTC)
+	return &testapigroupv1.Carp{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "name",
+			Namespace: "namespace",
+		},
+		Spec: testapigroupv1.CarpSpec{
+			RestartPolicy: "restart",
+			NodeSelector: map[string]string{
+				"label1": "value1",
+				"label2": "value2",
+			},
+			ServiceAccountName: "service-account",
+			HostNetwork:        false,
+			HostPID:            true,
+			Subdomain:          "hostname.subdomain.namespace.svc.domain",
+		},
+		Status: testapigroupv1.CarpStatus{
+			Phase: "phase",
+			Conditions: []testapigroupv1.CarpCondition{
+				{
+					Type:               "condition1",
+					Status:             "true",
+					LastProbeTime:      t,
+					LastTransitionTime: t,
+					Reason:             "reason",
+					Message:            "message",
+				},
+			},
+			Message: "message",
+			Reason:  "reason",
+			HostIP:  "1.2.3.4",
+		},
+	}
+}
+
+func BenchmarkToUnstructured(b *testing.B) {
+	carp := benchmarkCarp()
+	converter := runtime.DefaultUnstructuredConverter
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+		result, err := converter.ToUnstructured(carp)
+		if err != nil {
+			b.Fatalf("Unexpected conversion error: %v", err)
+		}
+		if len(result) != 3 {
+			b.Errorf("Unexpected conversion result: %#v", result)
+		}
+	}
+}
+
+func BenchmarkFromUnstructured(b *testing.B) {
+	carp := benchmarkCarp()
+	converter := runtime.DefaultUnstructuredConverter
+	unstr, err := converter.ToUnstructured(carp)
+	if err != nil {
+		b.Fatalf("Unexpected conversion error: %v", err)
+	}
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+		result := testapigroupv1.Carp{}
+		if err := converter.FromUnstructured(unstr, &result); err != nil {
+			b.Fatalf("Unexpected conversion error: %v", err)
+		}
+		if result.Status.Phase != "phase" {
+			b.Errorf("Unexpected conversion result: %#v", result)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_list.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_list.go
new file mode 100644
index 0000000000..82beda2a29
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_list.go
@@ -0,0 +1,219 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructured
+
+import (
+	"bytes"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var _ runtime.Unstructured = &UnstructuredList{}
+var _ metav1.ListInterface = &UnstructuredList{}
+
+// UnstructuredList allows lists that do not have Golang structs
+// registered to be manipulated generically. This can be used to deal
+// with the API lists from a plug-in.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:deepcopy-gen=true
+type UnstructuredList struct {
+	Object map[string]interface{}
+
+	// Items is a list of unstructured objects.
+	Items []Unstructured `json:"items"`
+}
+
+func (u *UnstructuredList) GetObjectKind() schema.ObjectKind { return u }
+
+func (u *UnstructuredList) IsList() bool { return true }
+
+func (u *UnstructuredList) EachListItem(fn func(runtime.Object) error) error {
+	for i := range u.Items {
+		if err := fn(&u.Items[i]); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (u *UnstructuredList) EachListItemWithAlloc(fn func(runtime.Object) error) error {
+	for i := range u.Items {
+		if err := fn(&Unstructured{Object: u.Items[i].Object}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// NewEmptyInstance returns a new instance of the concrete type containing only kind/apiVersion and no other data.
+// This should be called instead of reflect.New() for unstructured types because the go type alone does not preserve kind/apiVersion info.
+func (u *UnstructuredList) NewEmptyInstance() runtime.Unstructured {
+	out := new(UnstructuredList)
+	if u != nil {
+		out.SetGroupVersionKind(u.GroupVersionKind())
+	}
+	return out
+}
+
+// UnstructuredContent returns a map contain an overlay of the Items field onto
+// the Object field. Items always overwrites overlay.
+func (u *UnstructuredList) UnstructuredContent() map[string]interface{} {
+	out := make(map[string]interface{}, len(u.Object)+1)
+
+	// shallow copy every property
+	for k, v := range u.Object {
+		out[k] = v
+	}
+
+	items := make([]interface{}, len(u.Items))
+	for i, item := range u.Items {
+		items[i] = item.UnstructuredContent()
+	}
+	out["items"] = items
+	return out
+}
+
+// SetUnstructuredContent obeys the conventions of List and keeps Items and the items
+// array in sync. If items is not an array of objects in the incoming map, then any
+// mismatched item will be removed.
+func (obj *UnstructuredList) SetUnstructuredContent(content map[string]interface{}) {
+	obj.Object = content
+	if content == nil {
+		obj.Items = nil
+		return
+	}
+	items, ok := obj.Object["items"].([]interface{})
+	if !ok || items == nil {
+		items = []interface{}{}
+	}
+	unstructuredItems := make([]Unstructured, 0, len(items))
+	newItems := make([]interface{}, 0, len(items))
+	for _, item := range items {
+		o, ok := item.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		unstructuredItems = append(unstructuredItems, Unstructured{Object: o})
+		newItems = append(newItems, o)
+	}
+	obj.Items = unstructuredItems
+	obj.Object["items"] = newItems
+}
+
+func (u *UnstructuredList) DeepCopy() *UnstructuredList {
+	if u == nil {
+		return nil
+	}
+	out := new(UnstructuredList)
+	*out = *u
+	out.Object = runtime.DeepCopyJSON(u.Object)
+	out.Items = make([]Unstructured, len(u.Items))
+	for i := range u.Items {
+		u.Items[i].DeepCopyInto(&out.Items[i])
+	}
+	return out
+}
+
+// MarshalJSON ensures that the unstructured list object produces proper
+// JSON when passed to Go's standard JSON library.
+func (u *UnstructuredList) MarshalJSON() ([]byte, error) {
+	var buf bytes.Buffer
+	err := UnstructuredJSONScheme.Encode(u, &buf)
+	return buf.Bytes(), err
+}
+
+// UnmarshalJSON ensures that the unstructured list object properly
+// decodes JSON when passed to Go's standard JSON library.
+func (u *UnstructuredList) UnmarshalJSON(b []byte) error {
+	_, _, err := UnstructuredJSONScheme.Decode(b, nil, u)
+	return err
+}
+
+func (u *UnstructuredList) GetAPIVersion() string {
+	return getNestedString(u.Object, "apiVersion")
+}
+
+func (u *UnstructuredList) SetAPIVersion(version string) {
+	u.setNestedField(version, "apiVersion")
+}
+
+func (u *UnstructuredList) GetKind() string {
+	return getNestedString(u.Object, "kind")
+}
+
+func (u *UnstructuredList) SetKind(kind string) {
+	u.setNestedField(kind, "kind")
+}
+
+func (u *UnstructuredList) GetResourceVersion() string {
+	return getNestedString(u.Object, "metadata", "resourceVersion")
+}
+
+func (u *UnstructuredList) SetResourceVersion(version string) {
+	u.setNestedField(version, "metadata", "resourceVersion")
+}
+
+func (u *UnstructuredList) GetSelfLink() string {
+	return getNestedString(u.Object, "metadata", "selfLink")
+}
+
+func (u *UnstructuredList) SetSelfLink(selfLink string) {
+	u.setNestedField(selfLink, "metadata", "selfLink")
+}
+
+func (u *UnstructuredList) GetContinue() string {
+	return getNestedString(u.Object, "metadata", "continue")
+}
+
+func (u *UnstructuredList) SetContinue(c string) {
+	u.setNestedField(c, "metadata", "continue")
+}
+
+func (u *UnstructuredList) GetRemainingItemCount() *int64 {
+	return getNestedInt64Pointer(u.Object, "metadata", "remainingItemCount")
+}
+
+func (u *UnstructuredList) SetRemainingItemCount(c *int64) {
+	if c == nil {
+		RemoveNestedField(u.Object, "metadata", "remainingItemCount")
+	} else {
+		u.setNestedField(*c, "metadata", "remainingItemCount")
+	}
+}
+
+func (u *UnstructuredList) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	u.SetAPIVersion(gvk.GroupVersion().String())
+	u.SetKind(gvk.Kind)
+}
+
+func (u *UnstructuredList) GroupVersionKind() schema.GroupVersionKind {
+	gv, err := schema.ParseGroupVersion(u.GetAPIVersion())
+	if err != nil {
+		return schema.GroupVersionKind{}
+	}
+	gvk := gv.WithKind(u.GetKind())
+	return gvk
+}
+
+func (u *UnstructuredList) setNestedField(value interface{}, fields ...string) {
+	if u.Object == nil {
+		u.Object = make(map[string]interface{})
+	}
+	SetNestedField(u.Object, value, fields...)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_list_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_list_test.go
new file mode 100644
index 0000000000..d3c42b519a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_list_test.go
@@ -0,0 +1,86 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructured
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUnstructuredList(t *testing.T) {
+	list := &UnstructuredList{
+		Object: map[string]interface{}{"kind": "List", "apiVersion": "v1"},
+		Items: []Unstructured{
+			{Object: map[string]interface{}{"kind": "Pod", "apiVersion": "v1", "metadata": map[string]interface{}{"name": "test"}}},
+		},
+	}
+	content := list.UnstructuredContent()
+	items := content["items"].([]interface{})
+	require.Len(t, items, 1)
+	val, found, err := NestedFieldCopy(items[0].(map[string]interface{}), "metadata", "name")
+	require.True(t, found)
+	require.NoError(t, err)
+	assert.Equal(t, "test", val)
+}
+
+func TestNilDeletionTimestamp(t *testing.T) {
+	var u Unstructured
+	del := u.GetDeletionTimestamp()
+	if del != nil {
+		t.Errorf("unexpected non-nil deletion timestamp: %v", del)
+	}
+	u.SetDeletionTimestamp(u.GetDeletionTimestamp())
+	del = u.GetDeletionTimestamp()
+	if del != nil {
+		t.Errorf("unexpected non-nil deletion timestamp: %v", del)
+	}
+	_, ok := u.Object["metadata"]
+	assert.False(t, ok)
+
+	now := metav1.Now()
+	u.SetDeletionTimestamp(&now)
+	assert.Equal(t, now.Unix(), u.GetDeletionTimestamp().Unix())
+	u.SetDeletionTimestamp(nil)
+	metadata := u.Object["metadata"].(map[string]interface{})
+	_, ok = metadata["deletionTimestamp"]
+	assert.False(t, ok)
+}
+
+func TestEmptyCreationTimestampIsOmitted(t *testing.T) {
+	var u Unstructured
+	now := metav1.Now()
+
+	// set an initial creationTimestamp and ensure the field exists
+	u.SetCreationTimestamp(now)
+	metadata := u.Object["metadata"].(map[string]interface{})
+	_, exists := metadata["creationTimestamp"]
+	if !exists {
+		t.Fatalf("unexpected missing creationTimestamp")
+	}
+
+	// set an empty timestamp and ensure the field no longer exists
+	u.SetCreationTimestamp(metav1.Time{})
+	metadata = u.Object["metadata"].(map[string]interface{})
+	creationTimestamp, exists := metadata["creationTimestamp"]
+	if exists {
+		t.Errorf("unexpected creation timestamp field: %q", creationTimestamp)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_test.go
new file mode 100644
index 0000000000..889083eccb
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructured_test.go
@@ -0,0 +1,476 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructured_test
+
+import (
+	"bytes"
+	"math/big"
+	"math/rand"
+	"os"
+	"reflect"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/randfill"
+
+	"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
+	"k8s.io/apimachinery/pkg/api/equality"
+	metafuzzer "k8s.io/apimachinery/pkg/apis/meta/fuzzer"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	cborserializer "k8s.io/apimachinery/pkg/runtime/serializer/cbor"
+	jsonserializer "k8s.io/apimachinery/pkg/runtime/serializer/json"
+)
+
+func TestNilUnstructuredContent(t *testing.T) {
+	var u unstructured.Unstructured
+	uCopy := u.DeepCopy()
+	content := u.UnstructuredContent()
+	expContent := make(map[string]interface{})
+	assert.EqualValues(t, expContent, content)
+	assert.Equal(t, uCopy, &u)
+}
+
+// TestUnstructuredMetadataRoundTrip checks that metadata accessors
+// correctly set the metadata for unstructured objects.
+// First, it fuzzes an empty ObjectMeta and sets this value as the metadata for an unstructured object.
+// Next, it uses metadata accessor methods to set these fuzzed values to another unstructured object.
+// Finally, it checks that both the unstructured objects are equal.
+func TestUnstructuredMetadataRoundTrip(t *testing.T) {
+	scheme := runtime.NewScheme()
+	codecs := serializer.NewCodecFactory(scheme)
+	seed := rand.Int63()
+	fuzzer := fuzzer.FuzzerFor(metafuzzer.Funcs, rand.NewSource(seed), codecs)
+
+	N := 1000
+	for i := 0; i < N; i++ {
+		u := &unstructured.Unstructured{Object: map[string]interface{}{}}
+		uCopy := u.DeepCopy()
+		metadata := &metav1.ObjectMeta{}
+		fuzzer.Fill(metadata)
+
+		if err := setObjectMeta(u, metadata); err != nil {
+			t.Fatalf("unexpected error setting fuzzed ObjectMeta: %v", err)
+		}
+		setObjectMetaUsingAccessors(u, uCopy)
+
+		if !equality.Semantic.DeepEqual(u, uCopy) {
+			t.Errorf("diff: %v", cmp.Diff(u, uCopy))
+		}
+	}
+}
+
+// TestUnstructuredMetadataOmitempty checks that ObjectMeta omitempty
+// semantics are enforced for unstructured objects.
+// The fuzzing test above should catch these cases but this is here just to be safe.
+// Example: the metadata.clusterName field has the omitempty json tag
+// so if it is set to it's zero value (""), it should be removed from the metadata map.
+func TestUnstructuredMetadataOmitempty(t *testing.T) {
+	scheme := runtime.NewScheme()
+	codecs := serializer.NewCodecFactory(scheme)
+	seed := rand.Int63()
+	fuzzer := fuzzer.FuzzerFor(metafuzzer.Funcs, rand.NewSource(seed), codecs)
+
+	// fuzz to make sure we don't miss any function calls below
+	u := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	metadata := &metav1.ObjectMeta{}
+	fuzzer.Fill(metadata)
+	if err := setObjectMeta(u, metadata); err != nil {
+		t.Fatalf("unexpected error setting fuzzed ObjectMeta: %v", err)
+	}
+
+	// set zero values for all fields in metadata explicitly
+	// to check that omitempty fields having zero values are never set
+	u.SetName("")
+	u.SetGenerateName("")
+	u.SetNamespace("")
+	u.SetSelfLink("")
+	u.SetUID("")
+	u.SetResourceVersion("")
+	u.SetGeneration(0)
+	u.SetCreationTimestamp(metav1.Time{})
+	u.SetDeletionTimestamp(nil)
+	u.SetDeletionGracePeriodSeconds(nil)
+	u.SetLabels(nil)
+	u.SetAnnotations(nil)
+	u.SetOwnerReferences(nil)
+	u.SetFinalizers(nil)
+	u.SetManagedFields(nil)
+
+	gotMetadata, _, err := unstructured.NestedFieldNoCopy(u.UnstructuredContent(), "metadata")
+	if err != nil {
+		t.Error(err)
+	}
+	emptyMetadata := make(map[string]interface{})
+
+	if !reflect.DeepEqual(gotMetadata, emptyMetadata) {
+		t.Errorf("expected %v, got %v", emptyMetadata, gotMetadata)
+	}
+}
+
+// TestRoundTripJSONCBORUnstructured performs fuzz testing for roundtrip for
+// unstructured object between JSON and CBOR
+func TestRoundTripJSONCBORUnstructured(t *testing.T) {
+	roundtripType[*unstructured.Unstructured](t)
+}
+
+// TestRoundTripJSONCBORUnstructuredList performs fuzz testing for roundtrip for
+// unstructuredList object between JSON and CBOR
+func TestRoundTripJSONCBORUnstructuredList(t *testing.T) {
+	roundtripType[*unstructured.UnstructuredList](t)
+}
+
+func setObjectMeta(u *unstructured.Unstructured, objectMeta *metav1.ObjectMeta) error {
+	if objectMeta == nil {
+		unstructured.RemoveNestedField(u.UnstructuredContent(), "metadata")
+		return nil
+	}
+	metadata, err := runtime.DefaultUnstructuredConverter.ToUnstructured(objectMeta)
+	if err != nil {
+		return err
+	}
+	u.UnstructuredContent()["metadata"] = metadata
+	return nil
+}
+
+func setObjectMetaUsingAccessors(u, uCopy *unstructured.Unstructured) {
+	uCopy.SetName(u.GetName())
+	uCopy.SetGenerateName(u.GetGenerateName())
+	uCopy.SetNamespace(u.GetNamespace())
+	uCopy.SetSelfLink(u.GetSelfLink())
+	uCopy.SetUID(u.GetUID())
+	uCopy.SetResourceVersion(u.GetResourceVersion())
+	uCopy.SetGeneration(u.GetGeneration())
+	uCopy.SetCreationTimestamp(u.GetCreationTimestamp())
+	uCopy.SetDeletionTimestamp(u.GetDeletionTimestamp())
+	uCopy.SetDeletionGracePeriodSeconds(u.GetDeletionGracePeriodSeconds())
+	uCopy.SetLabels(u.GetLabels())
+	uCopy.SetAnnotations(u.GetAnnotations())
+	uCopy.SetOwnerReferences(u.GetOwnerReferences())
+	uCopy.SetFinalizers(u.GetFinalizers())
+	uCopy.SetManagedFields(u.GetManagedFields())
+}
+
+// roundtripType performs fuzz testing for roundtrip conversion for
+// unstructured or unstructuredList object between two formats (A and B) in forward
+// and backward directions
+// Original and final unstructured/list are compared along with all intermediate ones
+func roundtripType[U runtime.Unstructured](t *testing.T) {
+	scheme := runtime.NewScheme()
+	fuzzer := fuzzer.FuzzerFor(fuzzer.MergeFuzzerFuncs(metafuzzer.Funcs, unstructuredFuzzerFuncs), rand.NewSource(getSeed(t)), serializer.NewCodecFactory(scheme))
+
+	jS := jsonserializer.NewSerializerWithOptions(jsonserializer.DefaultMetaFactory, scheme, scheme, jsonserializer.SerializerOptions{})
+	cS := cborserializer.NewSerializer(scheme, scheme)
+
+	for i := 0; i < 50; i++ {
+		original := reflect.New(reflect.TypeFor[U]().Elem()).Interface().(runtime.Unstructured)
+		fuzzer.Fill(original)
+		// unstructured -> JSON > unstructured > CBOR -> unstructured -> JSON -> unstructured
+		roundtrip(t, original, jS, cS)
+		// unstructured -> CBOR > unstructured > JSON -> unstructured -> CBOR -> unstructured
+		roundtrip(t, original, cS, jS)
+	}
+}
+
+// roundtrip tests that an Unstructured object roundtrips faithfully along the
+// sequence Unstructured -> A -> Unstructured -> B -> Unstructured -> A -> Unstructured,
+// given serializers for two encodings A and B. The final object and both intermediate
+// objects must all be equal to the original.
+func roundtrip(t *testing.T, original runtime.Unstructured, a, b runtime.Serializer) {
+	var buf bytes.Buffer
+
+	buf.Reset()
+	// (original) Unstructured -> A
+	if err := a.Encode(original, &buf); err != nil {
+		t.Fatalf("error encoding original unstructured to A: %v", err)
+	}
+	// A -> intermediate unstructured
+	uA := reflect.New(reflect.TypeOf(original).Elem()).Interface().(runtime.Object)
+	uA, _, err := a.Decode(buf.Bytes(), nil, uA)
+	if err != nil {
+		t.Fatalf("error decoding A to unstructured: %v", err)
+	}
+
+	// Compare original unstructured vs intermediate unstructured
+	tmp, ok := uA.(runtime.Unstructured)
+	if !ok {
+		t.Fatalf("unexpected type %T for unstructured", tmp)
+	}
+	if !unstructuredEqual(t, original, uA.(runtime.Unstructured)) {
+		t.Fatalf("original unstructured differed from unstructured via A: %v", cmp.Diff(original, uA))
+	}
+
+	buf.Reset()
+	// intermediate unstructured -> B
+	if err := b.Encode(uA, &buf); err != nil {
+		t.Fatalf("error encoding unstructured to B: %v", err)
+	}
+	// B -> intermediate unstructured
+	uB := reflect.New(reflect.TypeOf(original).Elem()).Interface().(runtime.Object)
+	uB, _, err = b.Decode(buf.Bytes(), nil, uB)
+	if err != nil {
+		t.Fatalf("error decoding B to unstructured: %v", err)
+	}
+
+	// compare original vs intermediate unstructured
+	tmp, ok = uB.(runtime.Unstructured)
+	if !ok {
+		t.Fatalf("unexpected type %T for unstructured", tmp)
+	}
+	if !unstructuredEqual(t, original, uB.(runtime.Unstructured)) {
+		t.Fatalf("unstructured via A differed from unstructured via B: %v", cmp.Diff(original, uB))
+	}
+
+	// intermediate unstructured -> A
+	buf.Reset()
+	if err := a.Encode(uB, &buf); err != nil {
+		t.Fatalf("error encoding unstructured to A: %v", err)
+	}
+	// A -> final unstructured
+	final := reflect.New(reflect.TypeOf(original).Elem()).Interface().(runtime.Object)
+	final, _, err = a.Decode(buf.Bytes(), nil, final)
+	if err != nil {
+		t.Fatalf("error decoding A to unstructured: %v", err)
+	}
+
+	// Compare original unstructured vs final unstructured
+	tmp, ok = final.(runtime.Unstructured)
+	if !ok {
+		t.Fatalf("unexpected type %T for unstructured", tmp)
+	}
+	if !unstructuredEqual(t, original, final.(runtime.Unstructured)) {
+		t.Errorf("object changed during unstructured->A->unstructured->B->unstructured roundtrip, diff: %s", cmp.Diff(original, final))
+	}
+}
+
+func getSeed(t *testing.T) int64 {
+	seed := int64(time.Now().Nanosecond())
+	if override := os.Getenv("TEST_RAND_SEED"); len(override) > 0 {
+		overrideSeed, err := strconv.ParseInt(override, 10, 64)
+		if err != nil {
+			t.Fatal(err)
+		}
+		seed = overrideSeed
+		t.Logf("using overridden seed: %d", seed)
+	} else {
+		t.Logf("seed (override with TEST_RAND_SEED if desired): %d", seed)
+	}
+	return seed
+}
+
+const (
+	maxUnstructuredDepth  = 64
+	maxUnstructuredFanOut = 5
+)
+
+func unstructuredFuzzerFuncs(codecs serializer.CodecFactory) []interface{} {
+	return []interface{}{
+		func(u *unstructured.Unstructured, c randfill.Continue) {
+			obj := make(map[string]interface{})
+			obj["apiVersion"] = generateValidAPIVersionString(c)
+			obj["kind"] = generateNonEmptyString(c)
+			for j := c.Intn(maxUnstructuredFanOut); j >= 0; j-- {
+				obj[c.String(0)] = generateRandomTypeValue(maxUnstructuredDepth, c)
+			}
+			u.Object = obj
+		},
+		func(ul *unstructured.UnstructuredList, c randfill.Continue) {
+			obj := make(map[string]interface{})
+			obj["apiVersion"] = generateValidAPIVersionString(c)
+			obj["kind"] = generateNonEmptyString(c)
+			for j := c.Intn(maxUnstructuredFanOut); j >= 0; j-- {
+				obj[c.String(0)] = generateRandomTypeValue(maxUnstructuredDepth, c)
+			}
+			for j := c.Intn(maxUnstructuredFanOut); j >= 0; j-- {
+				var item = unstructured.Unstructured{}
+				c.Fill(&item)
+				ul.Items = append(ul.Items, item)
+			}
+			ul.Object = obj
+		},
+	}
+}
+
+func generateNonEmptyString(c randfill.Continue) string {
+	temp := c.String(0)
+	for len(temp) == 0 {
+		temp = c.String(0)
+	}
+	return temp
+}
+
+// generateNonEmptyNoSlashString generates a non-empty string without any slashes
+func generateNonEmptyNoSlashString(c randfill.Continue) string {
+	temp := strings.ReplaceAll(generateNonEmptyString(c), "/", "")
+	for len(temp) == 0 {
+		temp = strings.ReplaceAll(generateNonEmptyString(c), "/", "")
+	}
+	return temp
+}
+
+// generateValidAPIVersionString generates valid apiVersion string with formats:
+// <string>/<string> or <string>
+func generateValidAPIVersionString(c randfill.Continue) string {
+	if c.Bool() {
+		return generateNonEmptyNoSlashString(c) + "/" + generateNonEmptyNoSlashString(c)
+	} else {
+		return generateNonEmptyNoSlashString(c)
+	}
+}
+
+// generateRandomTypeValue generates fuzzed valid JSON data types:
+// 1. numbers (float64, int64)
+// 2. string (utf-8 encodings)
+// 3. boolean
+// 4. array ([]interface{})
+// 5. object (map[string]interface{})
+// 6. null
+// Decoding into unstructured can only produce a nil interface{} value or the
+// concrete types map[string]interface{}, []interface{}, int64, float64, string, and bool
+// If a value of other types is put into an unstructured, it will roundtrip
+// to one of the above list of supported types. For example, if Time type is used,
+// it will be encoded into a RFC 3339 format string such as "2001-02-03T12:34:56Z"
+// and when decoding into Unstructured, there is no information to indicate
+// that this string was originally produced by encoding a metav1.Time.
+// All external-versioned builtin types are exercised through RoundtripToUnstructured
+// in apitesting package. Types like metav1.Time are implicitly being exercised
+// because they appear as fields in those types.
+func generateRandomTypeValue(depth int, c randfill.Continue) interface{} {
+	t := c.Rand.Intn(120)
+	// If the max depth for unstructured is reached, only add non-recursive types
+	// which is 20+ in range
+	if depth == 0 {
+		t = 20 + c.Rand.Intn(120-20)
+	}
+
+	switch {
+	case t < 10:
+		item := make([]interface{}, c.Intn(maxUnstructuredFanOut))
+		for k := range item {
+			item[k] = generateRandomTypeValue(depth-1, c)
+		}
+		return item
+	case t < 20:
+		item := map[string]interface{}{}
+		for j := c.Intn(maxUnstructuredFanOut); j >= 0; j-- {
+			item[c.String(0)] = generateRandomTypeValue(depth-1, c)
+		}
+		return item
+	case t < 40:
+		// Only valid UTF-8 encodings
+		var item string
+		c.Fill(&item)
+		return item
+	case t < 60:
+		var item int64
+		c.Fill(&item)
+		return item
+	case t < 80:
+		var item bool
+		c.Fill(&item)
+		return item
+	case t < 100:
+		return c.Rand.NormFloat64()
+	case t < 120:
+		return nil
+	default:
+		panic("invalid case")
+	}
+}
+
+func unstructuredEqual(t *testing.T, a, b runtime.Unstructured) bool {
+	return anyEqual(t, a.UnstructuredContent(), b.UnstructuredContent())
+}
+
+// numberEqual asserts equality of two numbers which one is int64 and one is float64
+// In JSON, a non-decimal float64 is converted to int64 automatically in case the
+// float64 fits into int64 range. Otherwise, the non-decimal float64 remains a float.
+// As a result, this func does an int64 to float64 conversion using math/big package
+// to ensure the conversion is lossless before comparison.
+func numberEqual(a int64, b float64) bool {
+	// Ensure roundtrip int64 to float64 conversion is lossless
+	f, accuracy := big.NewInt(a).Float64()
+	if accuracy == big.Exact {
+		// Distinction between int64 and float64 is not preserved during JSON roundtrip for all numbers.
+		return f == b
+	}
+	return false
+}
+
+func anyEqual(t *testing.T, a, b interface{}) bool {
+	switch b.(type) {
+	case nil, bool, string, int64, float64, []interface{}, map[string]interface{}:
+	default:
+		t.Fatalf("unexpected value %v of type %T", b, b)
+	}
+
+	switch ac := a.(type) {
+	case nil, bool, string:
+		return ac == b
+	case int64:
+		if bc, ok := b.(float64); ok {
+			return numberEqual(ac, bc)
+		}
+		return ac == b
+	case float64:
+		if bc, ok := b.(int64); ok {
+			return numberEqual(bc, ac)
+		}
+		return ac == b
+	case []interface{}:
+		bc, ok := b.([]interface{})
+		if !ok {
+			return false
+		}
+		if len(ac) != len(bc) {
+			return false
+		}
+		for i, aa := range ac {
+			if !anyEqual(t, aa, bc[i]) {
+				return false
+			}
+		}
+		return true
+	case map[string]interface{}:
+		bc, ok := b.(map[string]interface{})
+		if !ok {
+			return false
+		}
+		if len(ac) != len(bc) {
+			return false
+		}
+		for k, aa := range ac {
+			bb, ok := bc[k]
+			if !ok {
+				return false
+			}
+			if !anyEqual(t, aa, bb) {
+				return false
+			}
+		}
+		return true
+	default:
+		t.Fatalf("unexpected value %v of type %T", a, a)
+	}
+	return true
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructuredscheme/scheme.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructuredscheme/scheme.go
new file mode 100644
index 0000000000..f8f5ec8560
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructuredscheme/scheme.go
@@ -0,0 +1,129 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package unstructuredscheme
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+	"k8s.io/apimachinery/pkg/runtime/serializer/versioning"
+)
+
+var scheme = runtime.NewScheme()
+
+// NewUnstructuredNegotiatedSerializer returns a simple, negotiated serializer
+func NewUnstructuredNegotiatedSerializer() runtime.NegotiatedSerializer {
+	return unstructuredNegotiatedSerializer{
+		scheme:  scheme,
+		typer:   NewUnstructuredObjectTyper(),
+		creator: NewUnstructuredCreator(),
+	}
+}
+
+type unstructuredNegotiatedSerializer struct {
+	scheme  *runtime.Scheme
+	typer   runtime.ObjectTyper
+	creator runtime.ObjectCreater
+}
+
+func (s unstructuredNegotiatedSerializer) SupportedMediaTypes() []runtime.SerializerInfo {
+	return []runtime.SerializerInfo{
+		{
+			MediaType:        "application/json",
+			MediaTypeType:    "application",
+			MediaTypeSubType: "json",
+			EncodesAsText:    true,
+			Serializer:       json.NewSerializerWithOptions(json.DefaultMetaFactory, s.creator, s.typer, json.SerializerOptions{}),
+			PrettySerializer: json.NewSerializerWithOptions(json.DefaultMetaFactory, s.creator, s.typer, json.SerializerOptions{Pretty: true}),
+			StreamSerializer: &runtime.StreamSerializerInfo{
+				EncodesAsText: true,
+				Serializer:    json.NewSerializerWithOptions(json.DefaultMetaFactory, s.creator, s.typer, json.SerializerOptions{}),
+				Framer:        json.Framer,
+			},
+		},
+		{
+			MediaType:        "application/yaml",
+			MediaTypeType:    "application",
+			MediaTypeSubType: "yaml",
+			EncodesAsText:    true,
+			Serializer:       json.NewSerializerWithOptions(json.DefaultMetaFactory, s.creator, s.typer, json.SerializerOptions{Yaml: true}),
+		},
+	}
+}
+
+func (s unstructuredNegotiatedSerializer) EncoderForVersion(encoder runtime.Encoder, gv runtime.GroupVersioner) runtime.Encoder {
+	return versioning.NewDefaultingCodecForScheme(s.scheme, encoder, nil, gv, nil)
+}
+
+func (s unstructuredNegotiatedSerializer) DecoderToVersion(decoder runtime.Decoder, gv runtime.GroupVersioner) runtime.Decoder {
+	return versioning.NewDefaultingCodecForScheme(s.scheme, nil, decoder, nil, gv)
+}
+
+type unstructuredObjectTyper struct {
+}
+
+// NewUnstructuredObjectTyper returns an object typer that can deal with unstructured things
+func NewUnstructuredObjectTyper() runtime.ObjectTyper {
+	return unstructuredObjectTyper{}
+}
+
+func (t unstructuredObjectTyper) ObjectKinds(obj runtime.Object) ([]schema.GroupVersionKind, bool, error) {
+	// Delegate for things other than Unstructured.
+	if _, ok := obj.(runtime.Unstructured); !ok {
+		return nil, false, fmt.Errorf("cannot type %T", obj)
+	}
+	gvk := obj.GetObjectKind().GroupVersionKind()
+	if len(gvk.Kind) == 0 {
+		return nil, false, runtime.NewMissingKindErr("object has no kind field ")
+	}
+	if len(gvk.Version) == 0 {
+		return nil, false, runtime.NewMissingVersionErr("object has no apiVersion field")
+	}
+
+	return []schema.GroupVersionKind{obj.GetObjectKind().GroupVersionKind()}, false, nil
+}
+
+func (t unstructuredObjectTyper) Recognizes(gvk schema.GroupVersionKind) bool {
+	return true
+}
+
+type unstructuredCreator struct{}
+
+// NewUnstructuredCreator returns a simple object creator that always returns an unstructured
+func NewUnstructuredCreator() runtime.ObjectCreater {
+	return unstructuredCreator{}
+}
+
+func (c unstructuredCreator) New(kind schema.GroupVersionKind) (runtime.Object, error) {
+	ret := &unstructured.Unstructured{}
+	ret.SetGroupVersionKind(kind)
+	return ret, nil
+}
+
+type unstructuredDefaulter struct {
+}
+
+// NewUnstructuredDefaulter returns defaulter suitable for unstructured types that doesn't default anything
+func NewUnstructuredDefaulter() runtime.ObjectDefaulter {
+	return unstructuredDefaulter{}
+}
+
+func (d unstructuredDefaulter) Default(in runtime.Object) {
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/zz_generated.deepcopy.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..fe8250dd6f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/zz_generated.deepcopy.go
@@ -0,0 +1,56 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package unstructured
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Unstructured) DeepCopyInto(out *Unstructured) {
+	clone := in.DeepCopy()
+	*out = *clone
+	return
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Unstructured) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UnstructuredList) DeepCopyInto(out *UnstructuredList) {
+	clone := in.DeepCopy()
+	*out = *clone
+	return
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *UnstructuredList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/doc.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/doc.go
new file mode 100644
index 0000000000..3b9cb30f2a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/doc.go
@@ -0,0 +1,21 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-input=k8s.io/apimachinery/pkg/apis/meta/v1
+
+// Package validation holds generated validations for meta/v1 types.
+package validation
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation.go
new file mode 100644
index 0000000000..b9ec344270
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation.go
@@ -0,0 +1,433 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+	"unicode"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+
+	"k8s.io/utils/ptr"
+)
+
+// LabelSelectorValidationOptions is a struct that can be passed to ValidateLabelSelector to record the validate options
+type LabelSelectorValidationOptions struct {
+	// Allow invalid label value in selector
+	AllowInvalidLabelValueInSelector bool
+
+	// Allows an operator that is not interpretable to pass validation.  This is useful for cases where a broader check
+	// can be performed, as in a *SubjectAccessReview
+	AllowUnknownOperatorInRequirement bool
+}
+
+// LabelSelectorHasInvalidLabelValue returns true if the given selector contains an invalid label value in a match expression.
+// This is useful for determining whether AllowInvalidLabelValueInSelector should be set to true when validating an update
+// based on existing persisted invalid values.
+func LabelSelectorHasInvalidLabelValue(ps *metav1.LabelSelector) bool {
+	if ps == nil {
+		return false
+	}
+	for _, e := range ps.MatchExpressions {
+		for _, v := range e.Values {
+			if len(validation.IsValidLabelValue(v)) > 0 {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// ValidateLabelSelector validate the LabelSelector according to the opts and returns any validation errors.
+// opts.AllowInvalidLabelValueInSelector is only expected to be set to true when required for backwards compatibility with existing invalid data.
+func ValidateLabelSelector(ps *metav1.LabelSelector, opts LabelSelectorValidationOptions, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	if ps == nil {
+		return allErrs
+	}
+	allErrs = append(allErrs, ValidateLabels(ps.MatchLabels, fldPath.Child("matchLabels"))...)
+	for i, expr := range ps.MatchExpressions {
+		allErrs = append(allErrs, ValidateLabelSelectorRequirement(expr, opts, fldPath.Child("matchExpressions").Index(i))...)
+	}
+	return allErrs
+}
+
+// ValidateLabelSelectorRequirement validate the requirement according to the opts and returns any validation errors.
+// opts.AllowInvalidLabelValueInSelector is only expected to be set to true when required for backwards compatibility with existing invalid data.
+func ValidateLabelSelectorRequirement(sr metav1.LabelSelectorRequirement, opts LabelSelectorValidationOptions, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	switch sr.Operator {
+	case metav1.LabelSelectorOpIn, metav1.LabelSelectorOpNotIn:
+		if len(sr.Values) == 0 {
+			allErrs = append(allErrs, field.Required(fldPath.Child("values"), "must be specified when `operator` is 'In' or 'NotIn'"))
+		}
+	case metav1.LabelSelectorOpExists, metav1.LabelSelectorOpDoesNotExist:
+		if len(sr.Values) > 0 {
+			allErrs = append(allErrs, field.Forbidden(fldPath.Child("values"), "may not be specified when `operator` is 'Exists' or 'DoesNotExist'"))
+		}
+	default:
+		if !opts.AllowUnknownOperatorInRequirement {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("operator"), sr.Operator, "not a valid selector operator"))
+		}
+	}
+	allErrs = append(allErrs, ValidateLabelName(sr.Key, fldPath.Child("key"))...)
+	if !opts.AllowInvalidLabelValueInSelector {
+		for valueIndex, value := range sr.Values {
+			for _, msg := range validation.IsValidLabelValue(value) {
+				allErrs = append(allErrs, field.Invalid(fldPath.Child("values").Index(valueIndex), value, msg))
+			}
+		}
+	}
+	return allErrs
+}
+
+// ValidateLabelName validates that the label name is correctly defined.
+func ValidateLabelName(labelName string, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	for _, msg := range validation.IsQualifiedName(labelName) {
+		allErrs = append(allErrs, field.Invalid(fldPath, labelName, msg).WithOrigin("format=k8s-label-key"))
+	}
+	return allErrs
+}
+
+// ValidateLabels validates that a set of labels are correctly defined.
+func ValidateLabels(labels map[string]string, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	for k, v := range labels {
+		allErrs = append(allErrs, ValidateLabelName(k, fldPath)...)
+		for _, msg := range validation.IsValidLabelValue(v) {
+			allErrs = append(allErrs, field.Invalid(fldPath, v, msg).WithOrigin("format=k8s-label-value"))
+		}
+	}
+	return allErrs
+}
+
+// FieldSelectorValidationOptions is a struct that can be passed to ValidateFieldSelectorRequirement to record the validate options
+type FieldSelectorValidationOptions struct {
+	// Allows an operator that is not interpretable to pass validation.  This is useful for cases where a broader check
+	// can be performed, as in a *SubjectAccessReview
+	AllowUnknownOperatorInRequirement bool
+}
+
+// ValidateLabelSelectorRequirement validates the requirement according to the opts and returns any validation errors.
+func ValidateFieldSelectorRequirement(requirement metav1.FieldSelectorRequirement, opts FieldSelectorValidationOptions, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+
+	if len(requirement.Key) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("key"), "must be specified"))
+	}
+
+	switch requirement.Operator {
+	case metav1.FieldSelectorOpIn, metav1.FieldSelectorOpNotIn:
+		if len(requirement.Values) == 0 {
+			allErrs = append(allErrs, field.Required(fldPath.Child("values"), "must be specified when `operator` is 'In' or 'NotIn'"))
+		}
+	case metav1.FieldSelectorOpExists, metav1.FieldSelectorOpDoesNotExist:
+		if len(requirement.Values) > 0 {
+			allErrs = append(allErrs, field.Forbidden(fldPath.Child("values"), "may not be specified when `operator` is 'Exists' or 'DoesNotExist'"))
+		}
+	default:
+		if !opts.AllowUnknownOperatorInRequirement {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("operator"), requirement.Operator, "not a valid selector operator"))
+		}
+	}
+
+	return allErrs
+}
+
+func ValidateDeleteOptions(options *metav1.DeleteOptions) field.ErrorList {
+	allErrs := field.ErrorList{}
+	//lint:file-ignore SA1019 Keep validation for deprecated OrphanDependents option until it's being removed
+	if options.OrphanDependents != nil && options.PropagationPolicy != nil {
+		allErrs = append(allErrs, field.Invalid(field.NewPath("propagationPolicy"), options.PropagationPolicy, "orphanDependents and deletionPropagation cannot be both set"))
+	}
+	if options.PropagationPolicy != nil &&
+		*options.PropagationPolicy != metav1.DeletePropagationForeground &&
+		*options.PropagationPolicy != metav1.DeletePropagationBackground &&
+		*options.PropagationPolicy != metav1.DeletePropagationOrphan {
+		allErrs = append(allErrs, field.NotSupported(field.NewPath("propagationPolicy"), options.PropagationPolicy, []string{string(metav1.DeletePropagationForeground), string(metav1.DeletePropagationBackground), string(metav1.DeletePropagationOrphan), "nil"}))
+	}
+	allErrs = append(allErrs, ValidateDryRun(field.NewPath("dryRun"), options.DryRun)...)
+	allErrs = append(allErrs, ValidateIgnoreStoreReadError(field.NewPath("ignoreStoreReadErrorWithClusterBreakingPotential"), options)...)
+	return allErrs
+}
+
+func ValidateCreateOptions(options *metav1.CreateOptions) field.ErrorList {
+	allErrs := field.ErrorList{}
+	allErrs = append(allErrs, ValidateFieldManager(options.FieldManager, field.NewPath("fieldManager"))...)
+	allErrs = append(allErrs, ValidateDryRun(field.NewPath("dryRun"), options.DryRun)...)
+	allErrs = append(allErrs, ValidateFieldValidation(field.NewPath("fieldValidation"), options.FieldValidation)...)
+	return allErrs
+}
+
+func ValidateUpdateOptions(options *metav1.UpdateOptions) field.ErrorList {
+	allErrs := field.ErrorList{}
+	allErrs = append(allErrs, ValidateFieldManager(options.FieldManager, field.NewPath("fieldManager"))...)
+	allErrs = append(allErrs, ValidateDryRun(field.NewPath("dryRun"), options.DryRun)...)
+	allErrs = append(allErrs, ValidateFieldValidation(field.NewPath("fieldValidation"), options.FieldValidation)...)
+	return allErrs
+}
+
+func ValidatePatchOptions(options *metav1.PatchOptions, patchType types.PatchType) field.ErrorList {
+	allErrs := field.ErrorList{}
+	switch patchType {
+	case types.ApplyYAMLPatchType, types.ApplyCBORPatchType:
+		if options.FieldManager == "" {
+			// This field is defaulted to "kubectl" by kubectl, but HAS TO be explicitly set by controllers.
+			allErrs = append(allErrs, field.Required(field.NewPath("fieldManager"), "is required for apply patch"))
+		}
+	default:
+		if options.Force != nil {
+			allErrs = append(allErrs, field.Forbidden(field.NewPath("force"), "may not be specified for non-apply patch"))
+		}
+	}
+	allErrs = append(allErrs, ValidateFieldManager(options.FieldManager, field.NewPath("fieldManager"))...)
+	allErrs = append(allErrs, ValidateDryRun(field.NewPath("dryRun"), options.DryRun)...)
+	allErrs = append(allErrs, ValidateFieldValidation(field.NewPath("fieldValidation"), options.FieldValidation)...)
+	return allErrs
+}
+
+var FieldManagerMaxLength = 128
+
+// ValidateFieldManager valides that the fieldManager is the proper length and
+// only has printable characters.
+func ValidateFieldManager(fieldManager string, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	// the field can not be set as a `*string`, so a empty string ("") is
+	// considered as not set and is defaulted by the rest of the process
+	// (unless apply is used, in which case it is required).
+	if len(fieldManager) > FieldManagerMaxLength {
+		allErrs = append(allErrs, field.TooLong(fldPath, "" /*unused*/, FieldManagerMaxLength))
+	}
+	// Verify that all characters are printable.
+	for i, r := range fieldManager {
+		if !unicode.IsPrint(r) {
+			allErrs = append(allErrs, field.Invalid(fldPath, fieldManager, fmt.Sprintf("invalid character %#U (at position %d)", r, i)))
+		}
+	}
+
+	return allErrs
+}
+
+var allowedDryRunValues = sets.NewString(metav1.DryRunAll)
+
+// ValidateDryRun validates that a dryRun query param only contains allowed values.
+func ValidateDryRun(fldPath *field.Path, dryRun []string) field.ErrorList {
+	allErrs := field.ErrorList{}
+	if !allowedDryRunValues.HasAll(dryRun...) {
+		allErrs = append(allErrs, field.NotSupported(fldPath, dryRun, allowedDryRunValues.List()))
+	}
+	return allErrs
+}
+
+var allowedFieldValidationValues = sets.NewString("", metav1.FieldValidationIgnore, metav1.FieldValidationWarn, metav1.FieldValidationStrict)
+
+// ValidateFieldValidation validates that a fieldValidation query param only contains allowed values.
+func ValidateFieldValidation(fldPath *field.Path, fieldValidation string) field.ErrorList {
+	allErrs := field.ErrorList{}
+	if !allowedFieldValidationValues.Has(fieldValidation) {
+		allErrs = append(allErrs, field.NotSupported(fldPath, fieldValidation, allowedFieldValidationValues.List()))
+	}
+	return allErrs
+
+}
+
+const UninitializedStatusUpdateErrorMsg string = `must not update status when the object is uninitialized`
+
+// ValidateTableOptions returns any invalid flags on TableOptions.
+func ValidateTableOptions(opts *metav1.TableOptions) field.ErrorList {
+	var allErrs field.ErrorList
+	switch opts.IncludeObject {
+	case metav1.IncludeMetadata, metav1.IncludeNone, metav1.IncludeObject, "":
+	default:
+		allErrs = append(allErrs, field.Invalid(field.NewPath("includeObject"), opts.IncludeObject, "must be 'Metadata', 'Object', 'None', or empty"))
+	}
+	return allErrs
+}
+
+const MaxSubresourceNameLength = 256
+
+// ManagedFieldsValidationOption specifies options for validating managed fields.
+type ManagedFieldsValidationOption int
+
+const (
+	// CoveredByDeclarative indicates whether errors should be marked as covered by declarative validation.
+	CoveredByDeclarative ManagedFieldsValidationOption = iota + 1
+)
+
+// ValidateManagedFields validates a list of managed fields.
+func ValidateManagedFields(fieldsList []metav1.ManagedFieldsEntry, fldPath *field.Path, opts ...ManagedFieldsValidationOption) field.ErrorList {
+	coveredByDeclarative := false
+	for _, opt := range opts {
+		if opt == CoveredByDeclarative {
+			coveredByDeclarative = true
+		}
+	}
+	var allErrs field.ErrorList
+	for i, fields := range fieldsList {
+		fldPath := fldPath.Index(i)
+		switch fields.Operation {
+		case "":
+			err := field.Required(fldPath.Child("operation"), "must not be empty")
+			if coveredByDeclarative {
+				err = err.MarkCoveredByDeclarative()
+			}
+			allErrs = append(allErrs, err)
+		case metav1.ManagedFieldsOperationApply, metav1.ManagedFieldsOperationUpdate:
+		default:
+			err := field.NotSupported(fldPath.Child("operation"), fields.Operation, []metav1.ManagedFieldsOperationType{metav1.ManagedFieldsOperationApply, metav1.ManagedFieldsOperationUpdate})
+			if coveredByDeclarative {
+				err = err.MarkCoveredByDeclarative()
+			}
+			allErrs = append(allErrs, err)
+		}
+		if len(fields.FieldsType) > 0 && fields.FieldsType != "FieldsV1" {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("fieldsType"), fields.FieldsType, "must be `FieldsV1`"))
+		}
+		allErrs = append(allErrs, ValidateFieldManager(fields.Manager, fldPath.Child("manager"))...)
+
+		if len(fields.Subresource) > MaxSubresourceNameLength {
+			allErrs = append(allErrs, field.TooLong(fldPath.Child("subresource"), "" /*unused*/, MaxSubresourceNameLength))
+		}
+	}
+	return allErrs
+}
+
+func ValidateConditions(conditions []metav1.Condition, fldPath *field.Path) field.ErrorList {
+	var allErrs field.ErrorList
+
+	conditionTypeToFirstIndex := map[string]int{}
+	for i, condition := range conditions {
+		if _, ok := conditionTypeToFirstIndex[condition.Type]; ok {
+			allErrs = append(allErrs, field.Duplicate(fldPath.Index(i), condition.Type).MarkCoveredByDeclarative())
+		} else {
+			conditionTypeToFirstIndex[condition.Type] = i
+		}
+
+		allErrs = append(allErrs, ValidateCondition(condition, fldPath.Index(i))...)
+	}
+
+	return allErrs
+}
+
+// validConditionStatuses is used internally to check validity and provide a good message
+var validConditionStatuses = sets.NewString(string(metav1.ConditionTrue), string(metav1.ConditionFalse), string(metav1.ConditionUnknown))
+
+const (
+	maxReasonLen  = 1 * 1024
+	maxMessageLen = 32 * 1024
+)
+
+func ValidateCondition(condition metav1.Condition, fldPath *field.Path) field.ErrorList {
+	var allErrs field.ErrorList
+
+	// type is set and is a valid format
+	if len(condition.Type) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("type"), "is required").MarkCoveredByDeclarative())
+	} else {
+		allErrs = append(allErrs, ValidateLabelName(condition.Type, fldPath.Child("type"))...)
+	}
+
+	// status is set and is an accepted value
+	if len(condition.Status) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("status"), "").MarkCoveredByDeclarative())
+	} else if !validConditionStatuses.Has(string(condition.Status)) {
+		allErrs = append(allErrs, field.NotSupported(fldPath.Child("status"), condition.Status, validConditionStatuses.List()).MarkCoveredByDeclarative())
+	}
+
+	if condition.ObservedGeneration < 0 {
+		allErrs = append(allErrs, field.Invalid(fldPath.Child("observedGeneration"), condition.ObservedGeneration, "must be greater than or equal to zero").WithOrigin("minimum").MarkCoveredByDeclarative())
+	}
+
+	if condition.LastTransitionTime.IsZero() {
+		allErrs = append(allErrs, field.Required(fldPath.Child("lastTransitionTime"), "").MarkCoveredByDeclarative())
+	}
+
+	if len(condition.Reason) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("reason"), "").MarkCoveredByDeclarative())
+	} else {
+		for _, currErr := range IsValidConditionReason(condition.Reason) {
+			allErrs = append(allErrs, field.Invalid(fldPath.Child("reason"), condition.Reason, currErr))
+		}
+		if len(condition.Reason) > maxReasonLen {
+			allErrs = append(allErrs, field.TooLong(fldPath.Child("reason"), "" /*unused*/, maxReasonLen).WithOrigin("maxBytes").MarkCoveredByDeclarative())
+		}
+	}
+
+	if len(condition.Message) > maxMessageLen {
+		allErrs = append(allErrs, field.TooLong(fldPath.Child("message"), "" /*unused*/, maxMessageLen))
+	}
+
+	return allErrs
+}
+
+const conditionReasonFmt string = "[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?"
+const conditionReasonErrMsg string = "a condition reason must start with alphabetic character, optionally followed by a string of alphanumeric characters or '_,:', and must end with an alphanumeric character or '_'"
+
+var conditionReasonRegexp = regexp.MustCompile("^" + conditionReasonFmt + "$")
+
+// IsValidConditionReason tests for a string that conforms to rules for condition
+// reasons. This checks the format, but not the length.
+func IsValidConditionReason(value string) []string {
+	if !conditionReasonRegexp.MatchString(value) {
+		return []string{validation.RegexError(conditionReasonErrMsg, conditionReasonFmt, "my_name", "MY_NAME", "MyName", "ReasonA,ReasonB", "ReasonA:ReasonB")}
+	}
+	return nil
+}
+
+// ValidateIgnoreStoreReadError validates that delete options are valid when
+// ignoreStoreReadErrorWithClusterBreakingPotential is enabled
+func ValidateIgnoreStoreReadError(fldPath *field.Path, options *metav1.DeleteOptions) field.ErrorList {
+	allErrs := field.ErrorList{}
+	if enabled := ptr.Deref[bool](options.IgnoreStoreReadErrorWithClusterBreakingPotential, false); !enabled {
+		return allErrs
+	}
+
+	if options.PropagationPolicy != nil {
+		allErrs = append(allErrs, field.Invalid(fldPath, true, "cannot be set together with .propagationPolicy"))
+	}
+	//nolint:staticcheck // Keep validation for deprecated OrphanDependents option until it's being removed
+	if options.OrphanDependents != nil {
+		allErrs = append(allErrs, field.Invalid(fldPath, true, "cannot be set together with .orphanDependents"))
+	}
+	if options.GracePeriodSeconds != nil {
+		allErrs = append(allErrs, field.Invalid(fldPath, true, "cannot be set together with .gracePeriodSeconds"))
+	}
+	if options.Preconditions != nil {
+		allErrs = append(allErrs, field.Invalid(fldPath, true, "cannot be set together with .preconditions"))
+	}
+
+	return allErrs
+}
+
+// ValidateCustom_Condition_LastTransitionTime is wired into the generated
+// declarative validation by +k8s:customValidation on Condition.LastTransitionTime.
+// It enforces that the field is set, mirroring the handwritten check in
+// ValidateCondition.
+func ValidateCustom_Condition_LastTransitionTime(ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *metav1.Time) field.ErrorList {
+	if value.IsZero() {
+		return field.ErrorList{field.Required(fldPath, "")}
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation_test.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation_test.go
new file mode 100644
index 0000000000..d7e421037c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation_test.go
@@ -0,0 +1,646 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+
+	"k8s.io/utils/ptr"
+)
+
+func TestValidateLabels(t *testing.T) {
+	successCases := []map[string]string{
+		{"simple": "bar"},
+		{"now-with-dashes": "bar"},
+		{"1-starts-with-num": "bar"},
+		{"1234": "bar"},
+		{"simple/simple": "bar"},
+		{"now-with-dashes/simple": "bar"},
+		{"now-with-dashes/now-with-dashes": "bar"},
+		{"now.with.dots/simple": "bar"},
+		{"now-with.dashes-and.dots/simple": "bar"},
+		{"1-num.2-num/3-num": "bar"},
+		{"1234/5678": "bar"},
+		{"1.2.3.4/5678": "bar"},
+		{"UpperCaseAreOK123": "bar"},
+		{"goodvalue": "123_-.BaR"},
+	}
+	for i := range successCases {
+		errs := ValidateLabels(successCases[i], field.NewPath("field"))
+		if len(errs) != 0 {
+			t.Errorf("case[%d] expected success, got %#v", i, errs)
+		}
+	}
+
+	namePartErrMsg := "name part must consist of"
+	nameErrMsg := "a valid label key must consist of"
+	labelErrMsg := "a valid label must be an empty string or consist of"
+	maxLengthErrMsg := "must be no more than"
+
+	labelNameErrorCases := []struct {
+		labels map[string]string
+		expect string
+	}{
+		{map[string]string{"nospecialchars^=@": "bar"}, namePartErrMsg},
+		{map[string]string{"cantendwithadash-": "bar"}, namePartErrMsg},
+		{map[string]string{"only/one/slash": "bar"}, nameErrMsg},
+		{map[string]string{strings.Repeat("a", 254): "bar"}, maxLengthErrMsg},
+	}
+	for i := range labelNameErrorCases {
+		errs := ValidateLabels(labelNameErrorCases[i].labels, field.NewPath("field"))
+		if len(errs) != 1 {
+			t.Errorf("case[%d]: expected failure", i)
+		} else {
+			if !strings.Contains(errs[0].Detail, labelNameErrorCases[i].expect) {
+				t.Errorf("case[%d]: error details do not include %q: %q", i, labelNameErrorCases[i].expect, errs[0].Detail)
+			}
+		}
+	}
+
+	labelValueErrorCases := []struct {
+		labels map[string]string
+		expect string
+	}{
+		{map[string]string{"toolongvalue": strings.Repeat("a", 64)}, maxLengthErrMsg},
+		{map[string]string{"backslashesinvalue": "some\\bad\\value"}, labelErrMsg},
+		{map[string]string{"nocommasallowed": "bad,value"}, labelErrMsg},
+		{map[string]string{"strangecharsinvalue": "?#$notsogood"}, labelErrMsg},
+	}
+	for i := range labelValueErrorCases {
+		errs := ValidateLabels(labelValueErrorCases[i].labels, field.NewPath("field"))
+		if len(errs) != 1 {
+			t.Errorf("case[%d]: expected failure", i)
+		} else {
+			if !strings.Contains(errs[0].Detail, labelValueErrorCases[i].expect) {
+				t.Errorf("case[%d]: error details do not include %q: %q", i, labelValueErrorCases[i].expect, errs[0].Detail)
+			}
+		}
+	}
+}
+
+func TestValidDryRun(t *testing.T) {
+	tests := [][]string{
+		{},
+		{"All"},
+		{"All", "All"},
+	}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%v", test), func(t *testing.T) {
+			if errs := ValidateDryRun(field.NewPath("dryRun"), test); len(errs) != 0 {
+				t.Errorf("%v should be a valid dry-run value: %v", test, errs)
+			}
+		})
+	}
+}
+
+func TestInvalidDryRun(t *testing.T) {
+	tests := [][]string{
+		{"False"},
+		{"All", "False"},
+	}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%v", test), func(t *testing.T) {
+			if len(ValidateDryRun(field.NewPath("dryRun"), test)) == 0 {
+				t.Errorf("%v shouldn't be a valid dry-run value", test)
+			}
+		})
+	}
+}
+
+func TestValidateDeleteOptionsWithIgnoreStoreReadError(t *testing.T) {
+	fieldPath := field.NewPath("ignoreStoreReadErrorWithClusterBreakingPotential")
+	tests := []struct {
+		name           string
+		opts           metav1.DeleteOptions
+		expectedErrors field.ErrorList
+	}{
+		{
+			name: "option is nil",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: nil,
+				DryRun: []string{"All"},
+			},
+			expectedErrors: field.ErrorList{},
+		},
+		{
+			name: "option is false, PropagationPolicy is set",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: ptr.To[bool](false),
+				DryRun:             []string{"All"},
+				PropagationPolicy:  ptr.To[metav1.DeletionPropagation](metav1.DeletePropagationBackground),
+				GracePeriodSeconds: ptr.To[int64](0),
+				Preconditions:      &metav1.Preconditions{},
+			},
+			expectedErrors: field.ErrorList{},
+		},
+		{
+			name: "option is false, OrphanDependents is set",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: ptr.To[bool](false),
+				DryRun: []string{"All"},
+				//nolint:staticcheck // until it's being removed
+				OrphanDependents:   ptr.To[bool](true),
+				GracePeriodSeconds: ptr.To[int64](0),
+				Preconditions:      &metav1.Preconditions{},
+			},
+			expectedErrors: field.ErrorList{},
+		},
+		{
+			name: "option is true, PropagationPolicy is set",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: ptr.To[bool](true),
+				DryRun:             []string{"All"},
+				PropagationPolicy:  ptr.To[metav1.DeletionPropagation](metav1.DeletePropagationBackground),
+				GracePeriodSeconds: ptr.To[int64](0),
+				Preconditions:      &metav1.Preconditions{},
+			},
+			expectedErrors: field.ErrorList{
+				field.Invalid(fieldPath, true, "cannot be set together with .propagationPolicy"),
+				field.Invalid(fieldPath, true, "cannot be set together with .gracePeriodSeconds"),
+				field.Invalid(fieldPath, true, "cannot be set together with .preconditions"),
+			},
+		},
+		{
+			name: "option is true, OrphanDependents is set",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: ptr.To[bool](true),
+				DryRun: []string{"All"},
+				//nolint:staticcheck // until it's being removed
+				OrphanDependents:   ptr.To[bool](true),
+				GracePeriodSeconds: ptr.To[int64](0),
+				Preconditions:      &metav1.Preconditions{},
+			},
+			expectedErrors: field.ErrorList{
+				field.Invalid(fieldPath, true, "cannot be set together with .orphanDependents"),
+				field.Invalid(fieldPath, true, "cannot be set together with .gracePeriodSeconds"),
+				field.Invalid(fieldPath, true, "cannot be set together with .preconditions"),
+			},
+		},
+		{
+			name: "option is true, no other option is set",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: ptr.To[bool](false),
+			},
+			expectedErrors: field.ErrorList{},
+		},
+		{
+			name: "option is true, dry-run is set (should be allowed)",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: new(true),
+				DryRun: []string{"All"},
+			},
+			expectedErrors: field.ErrorList{},
+		},
+		{
+			name: "option is true, dry-run is set to an invalid value",
+			opts: metav1.DeleteOptions{
+				IgnoreStoreReadErrorWithClusterBreakingPotential: new(true),
+				DryRun: []string{"Invalid"},
+			},
+			expectedErrors: field.ErrorList{
+				field.NotSupported(field.NewPath("dryRun"), []string{"Invalid"}, []string{"All"}),
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			errGot := ValidateDeleteOptions(&test.opts)
+			if !cmp.Equal(test.expectedErrors, errGot) {
+				t.Errorf("expected error(s) to match, diff: %s", cmp.Diff(test.expectedErrors, errGot))
+			}
+		})
+	}
+}
+
+func TestValidPatchOptions(t *testing.T) {
+	tests := []struct {
+		opts      metav1.PatchOptions
+		patchType types.PatchType
+	}{{
+		opts: metav1.PatchOptions{
+			Force:        ptr.To(true),
+			FieldManager: "kubectl",
+		},
+		patchType: types.ApplyYAMLPatchType,
+	}, {
+		opts: metav1.PatchOptions{
+			FieldManager: "kubectl",
+		},
+		patchType: types.ApplyYAMLPatchType,
+	}, {
+		opts: metav1.PatchOptions{
+			Force:        ptr.To(true),
+			FieldManager: "kubectl",
+		},
+		patchType: types.ApplyCBORPatchType,
+	}, {
+		opts: metav1.PatchOptions{
+			FieldManager: "kubectl",
+		},
+		patchType: types.ApplyCBORPatchType,
+	}, {
+		opts:      metav1.PatchOptions{},
+		patchType: types.MergePatchType,
+	}, {
+		opts: metav1.PatchOptions{
+			FieldManager: "patcher",
+		},
+		patchType: types.MergePatchType,
+	}}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%v", test.opts), func(t *testing.T) {
+			errs := ValidatePatchOptions(&test.opts, test.patchType)
+			if len(errs) != 0 {
+				t.Fatalf("Expected no failures, got: %v", errs)
+			}
+		})
+	}
+}
+
+func TestInvalidPatchOptions(t *testing.T) {
+	tests := []struct {
+		opts      metav1.PatchOptions
+		patchType types.PatchType
+	}{
+		// missing manager
+		{
+			opts:      metav1.PatchOptions{},
+			patchType: types.ApplyYAMLPatchType,
+		},
+		// missing manager
+		{
+			opts:      metav1.PatchOptions{},
+			patchType: types.ApplyCBORPatchType,
+		},
+		// force on non-apply
+		{
+			opts: metav1.PatchOptions{
+				Force: ptr.To(true),
+			},
+			patchType: types.MergePatchType,
+		},
+		// manager and force on non-apply
+		{
+			opts: metav1.PatchOptions{
+				FieldManager: "kubectl",
+				Force:        ptr.To(false),
+			},
+			patchType: types.MergePatchType,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%v", test.opts), func(t *testing.T) {
+			errs := ValidatePatchOptions(&test.opts, test.patchType)
+			if len(errs) == 0 {
+				t.Fatal("Expected failures, got none.")
+			}
+		})
+	}
+}
+
+func TestValidateFieldManagerValid(t *testing.T) {
+	tests := []string{
+		"filedManager",
+		"你好", // Hello
+		"🍔",
+	}
+
+	for _, test := range tests {
+		t.Run(test, func(t *testing.T) {
+			errs := ValidateFieldManager(test, field.NewPath("fieldManager"))
+			if len(errs) != 0 {
+				t.Errorf("Validation failed: %v", errs)
+			}
+		})
+	}
+}
+
+func TestValidateFieldManagerInvalid(t *testing.T) {
+	tests := []string{
+		"field\nmanager", // Contains invalid character \n
+		"fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", // Has 129 chars
+	}
+
+	for _, test := range tests {
+		t.Run(test, func(t *testing.T) {
+			errs := ValidateFieldManager(test, field.NewPath("fieldManager"))
+			if len(errs) == 0 {
+				t.Errorf("Validation should have failed")
+			}
+		})
+	}
+}
+
+func TestValidateManagedFieldsInvalid(t *testing.T) {
+	tests := []metav1.ManagedFieldsEntry{{
+		Operation:  metav1.ManagedFieldsOperationUpdate,
+		FieldsType: "RandomVersion",
+		APIVersion: "v1",
+	}, {
+		Operation:  "RandomOperation",
+		FieldsType: "FieldsV1",
+		APIVersion: "v1",
+	}, {
+		// Operation is missing
+		FieldsType: "FieldsV1",
+		APIVersion: "v1",
+	}, {
+		Operation:  metav1.ManagedFieldsOperationUpdate,
+		FieldsType: "FieldsV1",
+		// Invalid fieldManager
+		Manager:    "field\nmanager",
+		APIVersion: "v1",
+	}, {
+		Operation:   metav1.ManagedFieldsOperationApply,
+		FieldsType:  "FieldsV1",
+		APIVersion:  "v1",
+		Subresource: "TooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLongTooLong",
+	}}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%#v", test), func(t *testing.T) {
+			errs := ValidateManagedFields([]metav1.ManagedFieldsEntry{test}, field.NewPath("managedFields"))
+			if len(errs) == 0 {
+				t.Errorf("Validation should have failed")
+			}
+			errs = ValidateManagedFields([]metav1.ManagedFieldsEntry{test}, field.NewPath("managedFields"), CoveredByDeclarative)
+			if len(errs) == 0 {
+				t.Errorf("Validation with CoveredByDeclarative should have failed")
+			}
+		})
+	}
+}
+
+func TestValidateMangedFieldsValid(t *testing.T) {
+	tests := []metav1.ManagedFieldsEntry{{
+		Operation:  metav1.ManagedFieldsOperationUpdate,
+		APIVersion: "v1",
+		// FieldsType is missing
+	}, {
+		Operation:  metav1.ManagedFieldsOperationUpdate,
+		FieldsType: "FieldsV1",
+		APIVersion: "v1",
+	}, {
+		Operation:   metav1.ManagedFieldsOperationApply,
+		FieldsType:  "FieldsV1",
+		APIVersion:  "v1",
+		Subresource: "scale",
+	}, {
+		Operation:  metav1.ManagedFieldsOperationApply,
+		FieldsType: "FieldsV1",
+		APIVersion: "v1",
+		Manager:    "🍔",
+	}}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%#v", test), func(t *testing.T) {
+			err := ValidateManagedFields([]metav1.ManagedFieldsEntry{test}, field.NewPath("managedFields"))
+			if err != nil {
+				t.Errorf("Validation failed: %v", err)
+			}
+			err = ValidateManagedFields([]metav1.ManagedFieldsEntry{test}, field.NewPath("managedFields"), CoveredByDeclarative)
+			if err != nil {
+				t.Errorf("Validation with CoveredByDeclarative failed: %v", err)
+			}
+		})
+	}
+}
+
+func TestValidateConditions(t *testing.T) {
+	tests := []struct {
+		name         string
+		conditions   []metav1.Condition
+		validateErrs func(t *testing.T, errs field.ErrorList)
+	}{{
+		name: "bunch-of-invalid-fields",
+		conditions: []metav1.Condition{{
+			Type:               ":invalid",
+			Status:             "unknown",
+			ObservedGeneration: -1,
+			LastTransitionTime: metav1.Time{},
+			Reason:             "invalid;val",
+			Message:            "",
+		}},
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			needle := `status.conditions[0].type: Invalid value: ":invalid": name part must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]')`
+			if !hasError(errs, needle) {
+				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
+			}
+			needle = `status.conditions[0].status: Unsupported value: "unknown": supported values: "False", "True", "Unknown"`
+			if !hasError(errs, needle) {
+				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
+			}
+			needle = `status.conditions[0].observedGeneration: Invalid value: -1: must be greater than or equal to zero`
+			if !hasError(errs, needle) {
+				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
+			}
+			needle = `status.conditions[0].lastTransitionTime: Required value`
+			if !hasError(errs, needle) {
+				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
+			}
+			needle = `status.conditions[0].reason: Invalid value: "invalid;val": a condition reason must start with alphabetic character, optionally followed by a string of alphanumeric characters or '_,:', and must end with an alphanumeric character or '_' (e.g. 'my_name',  or 'MY_NAME',  or 'MyName',  or 'ReasonA,ReasonB',  or 'ReasonA:ReasonB', regex used for validation is '[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?')`
+			if !hasError(errs, needle) {
+				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
+			}
+		},
+	}, {
+		name: "duplicates",
+		conditions: []metav1.Condition{{
+			Type: "First",
+		}, {
+			Type: "Second",
+		}, {
+			Type: "First",
+		}},
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			needle := `status.conditions[2]: Duplicate value: "First"`
+			if !hasError(errs, needle) {
+				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
+			}
+		},
+	}, {
+		name: "colon-allowed-in-reason",
+		conditions: []metav1.Condition{{
+			Type:   "First",
+			Reason: "valid:val",
+		}},
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			needle := `status.conditions[0].reason`
+			if hasPrefixError(errs, needle) {
+				t.Errorf("has %q in\n%v", needle, errorsAsString(errs))
+			}
+		},
+	}, {
+		name: "comma-allowed-in-reason",
+		conditions: []metav1.Condition{{
+			Type:   "First",
+			Reason: "valid,val",
+		}},
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			needle := `status.conditions[0].reason`
+			if hasPrefixError(errs, needle) {
+				t.Errorf("has %q in\n%v", needle, errorsAsString(errs))
+			}
+		},
+	}, {
+		name: "reason-does-not-end-in-delimiter",
+		conditions: []metav1.Condition{{
+			Type:   "First",
+			Reason: "valid,val:",
+		}},
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			needle := `status.conditions[0].reason: Invalid value: "valid,val:": a condition reason must start with alphabetic character, optionally followed by a string of alphanumeric characters or '_,:', and must end with an alphanumeric character or '_' (e.g. 'my_name',  or 'MY_NAME',  or 'MyName',  or 'ReasonA,ReasonB',  or 'ReasonA:ReasonB', regex used for validation is '[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?')`
+			if !hasError(errs, needle) {
+				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
+			}
+		},
+	}}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			errs := ValidateConditions(test.conditions, field.NewPath("status").Child("conditions"))
+			test.validateErrs(t, errs)
+		})
+	}
+}
+
+func TestLabelSelectorMatchExpression(t *testing.T) {
+	testCases := []struct {
+		name            string
+		labelSelector   *metav1.LabelSelector
+		wantErrorNumber int
+		validateErrs    func(t *testing.T, errs field.ErrorList)
+	}{{
+		name: "Valid LabelSelector",
+		labelSelector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{{
+				Key:      "key",
+				Operator: metav1.LabelSelectorOpIn,
+				Values:   []string{"value"},
+			}},
+		},
+		wantErrorNumber: 0,
+		validateErrs:    nil,
+	}, {
+		name: "MatchExpression's key name isn't valid",
+		labelSelector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{{
+				Key:      "-key",
+				Operator: metav1.LabelSelectorOpIn,
+				Values:   []string{"value"},
+			}},
+		},
+		wantErrorNumber: 1,
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			errMessage := "name part must consist of alphanumeric characters"
+			if !partStringInErrorMessage(errs, errMessage) {
+				t.Errorf("missing %q in\n%v", errMessage, errorsAsString(errs))
+			}
+		},
+	}, {
+		name: "MatchExpression's operator isn't valid",
+		labelSelector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{{
+				Key:      "key",
+				Operator: "abc",
+				Values:   []string{"value"},
+			}},
+		},
+		wantErrorNumber: 1,
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			errMessage := "not a valid selector operator"
+			if !partStringInErrorMessage(errs, errMessage) {
+				t.Errorf("missing %q in\n%v", errMessage, errorsAsString(errs))
+			}
+		},
+	}, {
+		name: "MatchExpression's value name isn't valid",
+		labelSelector: &metav1.LabelSelector{
+			MatchExpressions: []metav1.LabelSelectorRequirement{{
+				Key:      "key",
+				Operator: metav1.LabelSelectorOpIn,
+				Values:   []string{"-value"},
+			}},
+		},
+		wantErrorNumber: 1,
+		validateErrs: func(t *testing.T, errs field.ErrorList) {
+			errMessage := "a valid label must be an empty string or consist of"
+			if !partStringInErrorMessage(errs, errMessage) {
+				t.Errorf("missing %q in\n%v", errMessage, errorsAsString(errs))
+			}
+		},
+	}}
+	for index, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			allErrs := ValidateLabelSelector(testCase.labelSelector, LabelSelectorValidationOptions{AllowInvalidLabelValueInSelector: false}, field.NewPath("labelSelector"))
+			if len(allErrs) != testCase.wantErrorNumber {
+				t.Errorf("case[%d]: expected failure", index)
+			}
+			if len(allErrs) >= 1 && testCase.validateErrs != nil {
+				testCase.validateErrs(t, allErrs)
+			}
+		})
+	}
+}
+
+func hasError(errs field.ErrorList, needle string) bool {
+	for _, curr := range errs {
+		if curr.Error() == needle {
+			return true
+		}
+	}
+	return false
+}
+
+func hasPrefixError(errs field.ErrorList, prefix string) bool {
+	for _, curr := range errs {
+		if strings.HasPrefix(curr.Error(), prefix) {
+			return true
+		}
+	}
+	return false
+}
+
+func partStringInErrorMessage(errs field.ErrorList, prefix string) bool {
+	for _, curr := range errs {
+		if strings.Contains(curr.Error(), prefix) {
+			return true
+		}
+	}
+	return false
+}
+
+func errorsAsString(errs field.ErrorList) string {
+	messages := []string{}
+	for _, curr := range errs {
+		messages = append(messages, curr.Error())
+	}
+	return strings.Join(messages, "\n")
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/zz_generated.validations.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/zz_generated.validations.go
new file mode 100644
index 0000000000..f79373a26d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/validation/zz_generated.validations.go
@@ -0,0 +1,638 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package validation
+
+import (
+	context "context"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	sets "k8s.io/apimachinery/pkg/util/sets"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Validate_Condition validates an instance of Condition according
+// to declarative validation rules in the API schema.
+func Validate_Condition(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.Condition) (errs field.ErrorList) {
+
+	{ // field v1.Condition.Type
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.Condition) *string {
+				return &oldObj.Type
+			})
+		errs = append(errs, fn(fldPath.Child("type"), &obj.Type, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.Condition.Status
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.ConditionStatus,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ConditionStatus(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.Condition) *v1.ConditionStatus {
+				return &oldObj.Status
+			})
+		errs = append(errs, fn(fldPath.Child("status"), &obj.Status, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.Condition.ObservedGeneration
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.Condition) *int64 {
+				return &oldObj.ObservedGeneration
+			})
+		errs = append(errs, fn(fldPath.Child("observedGeneration"), &obj.ObservedGeneration, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.Condition.LastTransitionTime
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.Time,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// custom validation
+			if e := ValidateCustom_Condition_LastTransitionTime(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.Condition) *v1.Time {
+				return &oldObj.LastTransitionTime
+			})
+		errs = append(errs, fn(fldPath.Child("lastTransitionTime"), &obj.LastTransitionTime, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.Condition.Reason
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 1024).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.Condition) *string {
+				return &oldObj.Reason
+			})
+		errs = append(errs, fn(fldPath.Child("reason"), &obj.Reason, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.Condition.Message has no validation
+	return errs
+}
+
+var symbolsForConditionStatus = sets.New(v1.ConditionFalse, v1.ConditionTrue, v1.ConditionUnknown)
+
+// Validate_ConditionStatus validates an instance of ConditionStatus according
+// to declarative validation rules in the API schema.
+func Validate_ConditionStatus(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.ConditionStatus) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForConditionStatus, nil).MarkAlpha(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ManagedFieldsEntry validates an instance of ManagedFieldsEntry according
+// to declarative validation rules in the API schema.
+func Validate_ManagedFieldsEntry(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.ManagedFieldsEntry) (errs field.ErrorList) {
+
+	// field v1.ManagedFieldsEntry.Manager has no validation
+
+	{ // field v1.ManagedFieldsEntry.Operation
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.ManagedFieldsOperationType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ManagedFieldsOperationType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ManagedFieldsEntry) *v1.ManagedFieldsOperationType {
+				return &oldObj.Operation
+			})
+		errs = append(errs, fn(fldPath.Child("operation"), &obj.Operation, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.ManagedFieldsEntry.APIVersion has no validation
+	// field v1.ManagedFieldsEntry.Time has no validation
+	// field v1.ManagedFieldsEntry.FieldsType has no validation
+	// field v1.ManagedFieldsEntry.FieldsV1 has no validation
+	// field v1.ManagedFieldsEntry.Subresource has no validation
+	return errs
+}
+
+var symbolsForManagedFieldsOperationType = sets.New(v1.ManagedFieldsOperationApply, v1.ManagedFieldsOperationUpdate)
+
+// Validate_ManagedFieldsOperationType validates an instance of ManagedFieldsOperationType according
+// to declarative validation rules in the API schema.
+func Validate_ManagedFieldsOperationType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.ManagedFieldsOperationType) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForManagedFieldsOperationType, nil).MarkAlpha(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ObjectMeta validates an instance of ObjectMeta according
+// to declarative validation rules in the API schema.
+func Validate_ObjectMeta(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.ObjectMeta) (errs field.ErrorList) {
+
+	// field v1.ObjectMeta.Name has no validation
+	// field v1.ObjectMeta.GenerateName has no validation
+	// field v1.ObjectMeta.Namespace has no validation
+	// field v1.ObjectMeta.SelfLink has no validation
+
+	{ // field v1.ObjectMeta.UID
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *types.UID,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) *types.UID {
+				return &oldObj.UID
+			})
+		errs = append(errs, fn(fldPath.Child("uid"), &obj.UID, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.ObjectMeta.ResourceVersion has no validation
+
+	{ // field v1.ObjectMeta.Generation
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) *int64 {
+				return &oldObj.Generation
+			})
+		errs = append(errs, fn(fldPath.Child("generation"), &obj.Generation, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.ObjectMeta.CreationTimestamp
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.Time,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) *v1.Time {
+				return &oldObj.CreationTimestamp
+			})
+		errs = append(errs, fn(fldPath.Child("creationTimestamp"), &obj.CreationTimestamp, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.ObjectMeta.DeletionTimestamp
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.Time,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) *v1.Time {
+				return oldObj.DeletionTimestamp
+			})
+		errs = append(errs, fn(fldPath.Child("deletionTimestamp"), obj.DeletionTimestamp, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.ObjectMeta.DeletionGracePeriodSeconds
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) *int64 {
+				return oldObj.DeletionGracePeriodSeconds
+			})
+		errs = append(errs, fn(fldPath.Child("deletionGracePeriodSeconds"), obj.DeletionGracePeriodSeconds, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.ObjectMeta.Labels has no validation
+	// field v1.ObjectMeta.Annotations has no validation
+
+	{ // field v1.ObjectMeta.OwnerReferences
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []v1.OwnerReference,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_OwnerReference); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) []v1.OwnerReference {
+				return oldObj.OwnerReferences
+			})
+		errs = append(errs, fn(fldPath.Child("ownerReferences"), obj.OwnerReferences, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.ObjectMeta.Finalizers has no validation
+
+	{ // field v1.ObjectMeta.ManagedFields
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []v1.ManagedFieldsEntry,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_ManagedFieldsEntry); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) []v1.ManagedFieldsEntry {
+				return oldObj.ManagedFields
+			})
+		errs = append(errs, fn(fldPath.Child("managedFields"), obj.ManagedFields, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_OwnerReference validates an instance of OwnerReference according
+// to declarative validation rules in the API schema.
+func Validate_OwnerReference(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.OwnerReference) (errs field.ErrorList) {
+
+	{ // field v1.OwnerReference.APIVersion
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.OwnerReference) *string {
+				return &oldObj.APIVersion
+			})
+		errs = append(errs, fn(fldPath.Child("apiVersion"), &obj.APIVersion, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.OwnerReference.Kind
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.OwnerReference) *string {
+				return &oldObj.Kind
+			})
+		errs = append(errs, fn(fldPath.Child("kind"), &obj.Kind, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.OwnerReference.Name
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.OwnerReference) *string {
+				return &oldObj.Name
+			})
+		errs = append(errs, fn(fldPath.Child("name"), &obj.Name, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.OwnerReference.UID
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *types.UID,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.OwnerReference) *types.UID {
+				return &oldObj.UID
+			})
+		errs = append(errs, fn(fldPath.Child("uid"), &obj.UID, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.OwnerReference.Controller has no validation
+	// field v1.OwnerReference.BlockOwnerDeletion has no validation
+	return errs
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/watch.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/watch.go
new file mode 100644
index 0000000000..58f0773803
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/watch.go
@@ -0,0 +1,89 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/watch"
+)
+
+// Event represents a single event to a watched resource.
+//
+// +protobuf=true
+// +k8s:deepcopy-gen=true
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type WatchEvent struct {
+	Type string `json:"type" protobuf:"bytes,1,opt,name=type"`
+
+	// Object is:
+	//  * If Type is Added or Modified: the new state of the object.
+	//  * If Type is Deleted: the state of the object immediately before deletion.
+	//  * If Type is Error: *Status is recommended; other types may make sense
+	//    depending on context.
+	Object runtime.RawExtension `json:"object" protobuf:"bytes,2,opt,name=object"`
+}
+
+func Convert_watch_Event_To_v1_WatchEvent(in *watch.Event, out *WatchEvent, s conversion.Scope) error {
+	out.Type = string(in.Type)
+	switch t := in.Object.(type) {
+	case *runtime.Unknown:
+		// TODO: handle other fields on Unknown and detect type
+		out.Object.Raw = t.Raw
+	case nil:
+	default:
+		out.Object.Object = in.Object
+	}
+	return nil
+}
+
+func Convert_v1_InternalEvent_To_v1_WatchEvent(in *InternalEvent, out *WatchEvent, s conversion.Scope) error {
+	return Convert_watch_Event_To_v1_WatchEvent((*watch.Event)(in), out, s)
+}
+
+func Convert_v1_WatchEvent_To_watch_Event(in *WatchEvent, out *watch.Event, s conversion.Scope) error {
+	out.Type = watch.EventType(in.Type)
+	if in.Object.Object != nil {
+		out.Object = in.Object.Object
+	} else if in.Object.Raw != nil {
+		// TODO: handle other fields on Unknown and detect type
+		out.Object = &runtime.Unknown{
+			Raw:         in.Object.Raw,
+			ContentType: runtime.ContentTypeJSON,
+		}
+	}
+	return nil
+}
+
+func Convert_v1_WatchEvent_To_v1_InternalEvent(in *WatchEvent, out *InternalEvent, s conversion.Scope) error {
+	return Convert_v1_WatchEvent_To_watch_Event(in, (*watch.Event)(out), s)
+}
+
+// InternalEvent makes watch.Event versioned
+// +protobuf=false
+type InternalEvent watch.Event
+
+func (e *InternalEvent) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+func (e *WatchEvent) GetObjectKind() schema.ObjectKind    { return schema.EmptyObjectKind }
+func (e *InternalEvent) DeepCopyObject() runtime.Object {
+	if c := e.DeepCopy(); c != nil {
+		return c
+	} else {
+		return nil
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.conversion.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.conversion.go
new file mode 100644
index 0000000000..735cbcb08f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.conversion.go
@@ -0,0 +1,548 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by conversion-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	url "net/url"
+	unsafe "unsafe"
+
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	conversion "k8s.io/apimachinery/pkg/conversion"
+	fields "k8s.io/apimachinery/pkg/fields"
+	labels "k8s.io/apimachinery/pkg/labels"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	intstr "k8s.io/apimachinery/pkg/util/intstr"
+	watch "k8s.io/apimachinery/pkg/watch"
+)
+
+func init() {
+	localSchemeBuilder.Register(RegisterConversions)
+}
+
+// RegisterConversions adds conversion functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*url.Values)(nil), (*CreateOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_CreateOptions(a.(*url.Values), b.(*CreateOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*url.Values)(nil), (*DeleteOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_DeleteOptions(a.(*url.Values), b.(*DeleteOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*url.Values)(nil), (*GetOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_GetOptions(a.(*url.Values), b.(*GetOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*url.Values)(nil), (*ListOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_ListOptions(a.(*url.Values), b.(*ListOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*url.Values)(nil), (*PatchOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_PatchOptions(a.(*url.Values), b.(*PatchOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*url.Values)(nil), (*TableOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_TableOptions(a.(*url.Values), b.(*TableOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*url.Values)(nil), (*UpdateOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_UpdateOptions(a.(*url.Values), b.(*UpdateOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*map[string]string)(nil), (*LabelSelector)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Map_string_To_string_To_v1_LabelSelector(a.(*map[string]string), b.(*LabelSelector), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**bool)(nil), (*bool)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_bool_To_bool(a.(**bool), b.(*bool), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**float64)(nil), (*float64)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_float64_To_float64(a.(**float64), b.(*float64), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**int32)(nil), (*int32)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_int32_To_int32(a.(**int32), b.(*int32), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**int64)(nil), (*int)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_int64_To_int(a.(**int64), b.(*int), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**int64)(nil), (*int64)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_int64_To_int64(a.(**int64), b.(*int64), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**intstr.IntOrString)(nil), (*intstr.IntOrString)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_intstr_IntOrString_To_intstr_IntOrString(a.(**intstr.IntOrString), b.(*intstr.IntOrString), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**string)(nil), (*string)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_string_To_string(a.(**string), b.(*string), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((**Duration)(nil), (*Duration)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Pointer_v1_Duration_To_v1_Duration(a.(**Duration), b.(*Duration), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (**DeletionPropagation)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_Pointer_v1_DeletionPropagation(a.(*[]string), b.(**DeletionPropagation), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (**Time)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_Pointer_v1_Time(a.(*[]string), b.(**Time), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (*[]int32)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_Slice_int32(a.(*[]string), b.(*[]int32), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (*IncludeObjectPolicy)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_v1_IncludeObjectPolicy(a.(*[]string), b.(*IncludeObjectPolicy), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (*ResourceVersionMatch)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_v1_ResourceVersionMatch(a.(*[]string), b.(*ResourceVersionMatch), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (*Time)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_v1_Time(a.(*[]string), b.(*Time), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*bool)(nil), (**bool)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_bool_To_Pointer_bool(a.(*bool), b.(**bool), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*fields.Selector)(nil), (*string)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_fields_Selector_To_string(a.(*fields.Selector), b.(*string), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*float64)(nil), (**float64)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_float64_To_Pointer_float64(a.(*float64), b.(**float64), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*int32)(nil), (**int32)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_int32_To_Pointer_int32(a.(*int32), b.(**int32), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*int64)(nil), (**int64)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_int64_To_Pointer_int64(a.(*int64), b.(**int64), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*int)(nil), (**int64)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_int_To_Pointer_int64(a.(*int), b.(**int64), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*intstr.IntOrString)(nil), (**intstr.IntOrString)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_intstr_IntOrString_To_Pointer_intstr_IntOrString(a.(*intstr.IntOrString), b.(**intstr.IntOrString), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*intstr.IntOrString)(nil), (*intstr.IntOrString)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_intstr_IntOrString_To_intstr_IntOrString(a.(*intstr.IntOrString), b.(*intstr.IntOrString), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*labels.Selector)(nil), (*string)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_labels_Selector_To_string(a.(*labels.Selector), b.(*string), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*resource.Quantity)(nil), (*resource.Quantity)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_resource_Quantity_To_resource_Quantity(a.(*resource.Quantity), b.(*resource.Quantity), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*string)(nil), (**string)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_string_To_Pointer_string(a.(*string), b.(**string), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*string)(nil), (*fields.Selector)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_string_To_fields_Selector(a.(*string), b.(*fields.Selector), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*string)(nil), (*labels.Selector)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_string_To_labels_Selector(a.(*string), b.(*labels.Selector), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*url.Values)(nil), (*DeleteOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_url_Values_To_v1_DeleteOptions(a.(*url.Values), b.(*DeleteOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*DeleteOptions)(nil), (*DeleteOptions)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_DeleteOptions_To_v1_DeleteOptions(a.(*DeleteOptions), b.(*DeleteOptions), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*Duration)(nil), (**Duration)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_Duration_To_Pointer_v1_Duration(a.(*Duration), b.(**Duration), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*InternalEvent)(nil), (*WatchEvent)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_InternalEvent_To_v1_WatchEvent(a.(*InternalEvent), b.(*WatchEvent), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*LabelSelector)(nil), (*map[string]string)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_LabelSelector_To_Map_string_To_string(a.(*LabelSelector), b.(*map[string]string), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ListMeta)(nil), (*ListMeta)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_ListMeta_To_v1_ListMeta(a.(*ListMeta), b.(*ListMeta), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*MicroTime)(nil), (*MicroTime)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_MicroTime_To_v1_MicroTime(a.(*MicroTime), b.(*MicroTime), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*Time)(nil), (*Time)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_Time_To_v1_Time(a.(*Time), b.(*Time), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*TypeMeta)(nil), (*TypeMeta)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_TypeMeta_To_v1_TypeMeta(a.(*TypeMeta), b.(*TypeMeta), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*WatchEvent)(nil), (*InternalEvent)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_WatchEvent_To_v1_InternalEvent(a.(*WatchEvent), b.(*InternalEvent), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*WatchEvent)(nil), (*watch.Event)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_WatchEvent_To_watch_Event(a.(*WatchEvent), b.(*watch.Event), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*watch.Event)(nil), (*WatchEvent)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_watch_Event_To_v1_WatchEvent(a.(*watch.Event), b.(*WatchEvent), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+func autoConvert_url_Values_To_v1_CreateOptions(in *url.Values, out *CreateOptions, s conversion.Scope) error {
+	// WARNING: Field TypeMeta does not have json tag, skipping.
+
+	if values, ok := map[string][]string(*in)["dryRun"]; ok && len(values) > 0 {
+		out.DryRun = *(*[]string)(unsafe.Pointer(&values))
+	} else {
+		out.DryRun = nil
+	}
+	if values, ok := map[string][]string(*in)["fieldManager"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldManager, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldManager = ""
+	}
+	if values, ok := map[string][]string(*in)["fieldValidation"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldValidation, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldValidation = ""
+	}
+	return nil
+}
+
+// Convert_url_Values_To_v1_CreateOptions is an autogenerated conversion function.
+func Convert_url_Values_To_v1_CreateOptions(in *url.Values, out *CreateOptions, s conversion.Scope) error {
+	return autoConvert_url_Values_To_v1_CreateOptions(in, out, s)
+}
+
+func autoConvert_url_Values_To_v1_DeleteOptions(in *url.Values, out *DeleteOptions, s conversion.Scope) error {
+	// WARNING: Field TypeMeta does not have json tag, skipping.
+
+	if values, ok := map[string][]string(*in)["gracePeriodSeconds"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_Pointer_int64(&values, &out.GracePeriodSeconds, s); err != nil {
+			return err
+		}
+	} else {
+		out.GracePeriodSeconds = nil
+	}
+	// INFO: in.Preconditions opted out of conversion generation
+	if values, ok := map[string][]string(*in)["orphanDependents"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_Pointer_bool(&values, &out.OrphanDependents, s); err != nil {
+			return err
+		}
+	} else {
+		out.OrphanDependents = nil
+	}
+	if values, ok := map[string][]string(*in)["propagationPolicy"]; ok && len(values) > 0 {
+		if err := Convert_Slice_string_To_Pointer_v1_DeletionPropagation(&values, &out.PropagationPolicy, s); err != nil {
+			return err
+		}
+	} else {
+		out.PropagationPolicy = nil
+	}
+	if values, ok := map[string][]string(*in)["dryRun"]; ok && len(values) > 0 {
+		out.DryRun = *(*[]string)(unsafe.Pointer(&values))
+	} else {
+		out.DryRun = nil
+	}
+	if values, ok := map[string][]string(*in)["ignoreStoreReadErrorWithClusterBreakingPotential"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_Pointer_bool(&values, &out.IgnoreStoreReadErrorWithClusterBreakingPotential, s); err != nil {
+			return err
+		}
+	} else {
+		out.IgnoreStoreReadErrorWithClusterBreakingPotential = nil
+	}
+	return nil
+}
+
+func autoConvert_url_Values_To_v1_GetOptions(in *url.Values, out *GetOptions, s conversion.Scope) error {
+	// WARNING: Field TypeMeta does not have json tag, skipping.
+
+	if values, ok := map[string][]string(*in)["resourceVersion"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.ResourceVersion, s); err != nil {
+			return err
+		}
+	} else {
+		out.ResourceVersion = ""
+	}
+	return nil
+}
+
+// Convert_url_Values_To_v1_GetOptions is an autogenerated conversion function.
+func Convert_url_Values_To_v1_GetOptions(in *url.Values, out *GetOptions, s conversion.Scope) error {
+	return autoConvert_url_Values_To_v1_GetOptions(in, out, s)
+}
+
+func autoConvert_url_Values_To_v1_ListOptions(in *url.Values, out *ListOptions, s conversion.Scope) error {
+	// WARNING: Field TypeMeta does not have json tag, skipping.
+
+	if values, ok := map[string][]string(*in)["labelSelector"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.LabelSelector, s); err != nil {
+			return err
+		}
+	} else {
+		out.LabelSelector = ""
+	}
+	if values, ok := map[string][]string(*in)["fieldSelector"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldSelector, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldSelector = ""
+	}
+	if values, ok := map[string][]string(*in)["watch"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_bool(&values, &out.Watch, s); err != nil {
+			return err
+		}
+	} else {
+		out.Watch = false
+	}
+	if values, ok := map[string][]string(*in)["allowWatchBookmarks"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_bool(&values, &out.AllowWatchBookmarks, s); err != nil {
+			return err
+		}
+	} else {
+		out.AllowWatchBookmarks = false
+	}
+	if values, ok := map[string][]string(*in)["resourceVersion"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.ResourceVersion, s); err != nil {
+			return err
+		}
+	} else {
+		out.ResourceVersion = ""
+	}
+	if values, ok := map[string][]string(*in)["resourceVersionMatch"]; ok && len(values) > 0 {
+		if err := Convert_Slice_string_To_v1_ResourceVersionMatch(&values, &out.ResourceVersionMatch, s); err != nil {
+			return err
+		}
+	} else {
+		out.ResourceVersionMatch = ""
+	}
+	if values, ok := map[string][]string(*in)["timeoutSeconds"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_Pointer_int64(&values, &out.TimeoutSeconds, s); err != nil {
+			return err
+		}
+	} else {
+		out.TimeoutSeconds = nil
+	}
+	if values, ok := map[string][]string(*in)["limit"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_int64(&values, &out.Limit, s); err != nil {
+			return err
+		}
+	} else {
+		out.Limit = 0
+	}
+	if values, ok := map[string][]string(*in)["continue"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.Continue, s); err != nil {
+			return err
+		}
+	} else {
+		out.Continue = ""
+	}
+	if values, ok := map[string][]string(*in)["sendInitialEvents"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_Pointer_bool(&values, &out.SendInitialEvents, s); err != nil {
+			return err
+		}
+	} else {
+		out.SendInitialEvents = nil
+	}
+	if values, ok := map[string][]string(*in)["shardSelector"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.ShardSelector, s); err != nil {
+			return err
+		}
+	} else {
+		out.ShardSelector = ""
+	}
+	return nil
+}
+
+// Convert_url_Values_To_v1_ListOptions is an autogenerated conversion function.
+func Convert_url_Values_To_v1_ListOptions(in *url.Values, out *ListOptions, s conversion.Scope) error {
+	return autoConvert_url_Values_To_v1_ListOptions(in, out, s)
+}
+
+func autoConvert_url_Values_To_v1_PatchOptions(in *url.Values, out *PatchOptions, s conversion.Scope) error {
+	// WARNING: Field TypeMeta does not have json tag, skipping.
+
+	if values, ok := map[string][]string(*in)["dryRun"]; ok && len(values) > 0 {
+		out.DryRun = *(*[]string)(unsafe.Pointer(&values))
+	} else {
+		out.DryRun = nil
+	}
+	if values, ok := map[string][]string(*in)["force"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_Pointer_bool(&values, &out.Force, s); err != nil {
+			return err
+		}
+	} else {
+		out.Force = nil
+	}
+	if values, ok := map[string][]string(*in)["fieldManager"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldManager, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldManager = ""
+	}
+	if values, ok := map[string][]string(*in)["fieldValidation"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldValidation, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldValidation = ""
+	}
+	return nil
+}
+
+// Convert_url_Values_To_v1_PatchOptions is an autogenerated conversion function.
+func Convert_url_Values_To_v1_PatchOptions(in *url.Values, out *PatchOptions, s conversion.Scope) error {
+	return autoConvert_url_Values_To_v1_PatchOptions(in, out, s)
+}
+
+func autoConvert_url_Values_To_v1_TableOptions(in *url.Values, out *TableOptions, s conversion.Scope) error {
+	// WARNING: Field TypeMeta does not have json tag, skipping.
+
+	if values, ok := map[string][]string(*in)["-"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_bool(&values, &out.NoHeaders, s); err != nil {
+			return err
+		}
+	} else {
+		out.NoHeaders = false
+	}
+	if values, ok := map[string][]string(*in)["includeObject"]; ok && len(values) > 0 {
+		if err := Convert_Slice_string_To_v1_IncludeObjectPolicy(&values, &out.IncludeObject, s); err != nil {
+			return err
+		}
+	} else {
+		out.IncludeObject = ""
+	}
+	return nil
+}
+
+// Convert_url_Values_To_v1_TableOptions is an autogenerated conversion function.
+func Convert_url_Values_To_v1_TableOptions(in *url.Values, out *TableOptions, s conversion.Scope) error {
+	return autoConvert_url_Values_To_v1_TableOptions(in, out, s)
+}
+
+func autoConvert_url_Values_To_v1_UpdateOptions(in *url.Values, out *UpdateOptions, s conversion.Scope) error {
+	// WARNING: Field TypeMeta does not have json tag, skipping.
+
+	if values, ok := map[string][]string(*in)["dryRun"]; ok && len(values) > 0 {
+		out.DryRun = *(*[]string)(unsafe.Pointer(&values))
+	} else {
+		out.DryRun = nil
+	}
+	if values, ok := map[string][]string(*in)["fieldManager"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldManager, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldManager = ""
+	}
+	if values, ok := map[string][]string(*in)["fieldValidation"]; ok && len(values) > 0 {
+		if err := runtime.Convert_Slice_string_To_string(&values, &out.FieldValidation, s); err != nil {
+			return err
+		}
+	} else {
+		out.FieldValidation = ""
+	}
+	return nil
+}
+
+// Convert_url_Values_To_v1_UpdateOptions is an autogenerated conversion function.
+func Convert_url_Values_To_v1_UpdateOptions(in *url.Values, out *UpdateOptions, s conversion.Scope) error {
+	return autoConvert_url_Values_To_v1_UpdateOptions(in, out, s)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.deepcopy.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..eb7eb80d9b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.deepcopy.go
@@ -0,0 +1,1218 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	types "k8s.io/apimachinery/pkg/types"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *APIGroup) DeepCopyInto(out *APIGroup) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Versions != nil {
+		in, out := &in.Versions, &out.Versions
+		*out = make([]GroupVersionForDiscovery, len(*in))
+		copy(*out, *in)
+	}
+	out.PreferredVersion = in.PreferredVersion
+	if in.ServerAddressByClientCIDRs != nil {
+		in, out := &in.ServerAddressByClientCIDRs, &out.ServerAddressByClientCIDRs
+		*out = make([]ServerAddressByClientCIDR, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIGroup.
+func (in *APIGroup) DeepCopy() *APIGroup {
+	if in == nil {
+		return nil
+	}
+	out := new(APIGroup)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *APIGroup) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *APIGroupList) DeepCopyInto(out *APIGroupList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Groups != nil {
+		in, out := &in.Groups, &out.Groups
+		*out = make([]APIGroup, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIGroupList.
+func (in *APIGroupList) DeepCopy() *APIGroupList {
+	if in == nil {
+		return nil
+	}
+	out := new(APIGroupList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *APIGroupList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *APIResource) DeepCopyInto(out *APIResource) {
+	*out = *in
+	if in.Verbs != nil {
+		in, out := &in.Verbs, &out.Verbs
+		*out = make(Verbs, len(*in))
+		copy(*out, *in)
+	}
+	if in.ShortNames != nil {
+		in, out := &in.ShortNames, &out.ShortNames
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Categories != nil {
+		in, out := &in.Categories, &out.Categories
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIResource.
+func (in *APIResource) DeepCopy() *APIResource {
+	if in == nil {
+		return nil
+	}
+	out := new(APIResource)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *APIResourceList) DeepCopyInto(out *APIResourceList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.APIResources != nil {
+		in, out := &in.APIResources, &out.APIResources
+		*out = make([]APIResource, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIResourceList.
+func (in *APIResourceList) DeepCopy() *APIResourceList {
+	if in == nil {
+		return nil
+	}
+	out := new(APIResourceList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *APIResourceList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *APIVersions) DeepCopyInto(out *APIVersions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Versions != nil {
+		in, out := &in.Versions, &out.Versions
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ServerAddressByClientCIDRs != nil {
+		in, out := &in.ServerAddressByClientCIDRs, &out.ServerAddressByClientCIDRs
+		*out = make([]ServerAddressByClientCIDR, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIVersions.
+func (in *APIVersions) DeepCopy() *APIVersions {
+	if in == nil {
+		return nil
+	}
+	out := new(APIVersions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *APIVersions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ApplyOptions) DeepCopyInto(out *ApplyOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.DryRun != nil {
+		in, out := &in.DryRun, &out.DryRun
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplyOptions.
+func (in *ApplyOptions) DeepCopy() *ApplyOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(ApplyOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Condition) DeepCopyInto(out *Condition) {
+	*out = *in
+	in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Condition.
+func (in *Condition) DeepCopy() *Condition {
+	if in == nil {
+		return nil
+	}
+	out := new(Condition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CreateOptions) DeepCopyInto(out *CreateOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.DryRun != nil {
+		in, out := &in.DryRun, &out.DryRun
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CreateOptions.
+func (in *CreateOptions) DeepCopy() *CreateOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(CreateOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CreateOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DeleteOptions) DeepCopyInto(out *DeleteOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.GracePeriodSeconds != nil {
+		in, out := &in.GracePeriodSeconds, &out.GracePeriodSeconds
+		*out = new(int64)
+		**out = **in
+	}
+	if in.Preconditions != nil {
+		in, out := &in.Preconditions, &out.Preconditions
+		*out = new(Preconditions)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.OrphanDependents != nil {
+		in, out := &in.OrphanDependents, &out.OrphanDependents
+		*out = new(bool)
+		**out = **in
+	}
+	if in.PropagationPolicy != nil {
+		in, out := &in.PropagationPolicy, &out.PropagationPolicy
+		*out = new(DeletionPropagation)
+		**out = **in
+	}
+	if in.DryRun != nil {
+		in, out := &in.DryRun, &out.DryRun
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.IgnoreStoreReadErrorWithClusterBreakingPotential != nil {
+		in, out := &in.IgnoreStoreReadErrorWithClusterBreakingPotential, &out.IgnoreStoreReadErrorWithClusterBreakingPotential
+		*out = new(bool)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeleteOptions.
+func (in *DeleteOptions) DeepCopy() *DeleteOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(DeleteOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *DeleteOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Duration) DeepCopyInto(out *Duration) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Duration.
+func (in *Duration) DeepCopy() *Duration {
+	if in == nil {
+		return nil
+	}
+	out := new(Duration)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FieldSelectorRequirement) DeepCopyInto(out *FieldSelectorRequirement) {
+	*out = *in
+	if in.Values != nil {
+		in, out := &in.Values, &out.Values
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FieldSelectorRequirement.
+func (in *FieldSelectorRequirement) DeepCopy() *FieldSelectorRequirement {
+	if in == nil {
+		return nil
+	}
+	out := new(FieldSelectorRequirement)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GetOptions) DeepCopyInto(out *GetOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GetOptions.
+func (in *GetOptions) DeepCopy() *GetOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(GetOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *GetOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupKind) DeepCopyInto(out *GroupKind) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupKind.
+func (in *GroupKind) DeepCopy() *GroupKind {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupKind)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupResource) DeepCopyInto(out *GroupResource) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupResource.
+func (in *GroupResource) DeepCopy() *GroupResource {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupResource)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupVersion) DeepCopyInto(out *GroupVersion) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupVersion.
+func (in *GroupVersion) DeepCopy() *GroupVersion {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupVersion)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupVersionForDiscovery) DeepCopyInto(out *GroupVersionForDiscovery) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupVersionForDiscovery.
+func (in *GroupVersionForDiscovery) DeepCopy() *GroupVersionForDiscovery {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupVersionForDiscovery)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupVersionKind) DeepCopyInto(out *GroupVersionKind) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupVersionKind.
+func (in *GroupVersionKind) DeepCopy() *GroupVersionKind {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupVersionKind)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GroupVersionResource) DeepCopyInto(out *GroupVersionResource) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupVersionResource.
+func (in *GroupVersionResource) DeepCopy() *GroupVersionResource {
+	if in == nil {
+		return nil
+	}
+	out := new(GroupVersionResource)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InternalEvent) DeepCopyInto(out *InternalEvent) {
+	*out = *in
+	if in.Object != nil {
+		out.Object = in.Object.DeepCopyObject()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InternalEvent.
+func (in *InternalEvent) DeepCopy() *InternalEvent {
+	if in == nil {
+		return nil
+	}
+	out := new(InternalEvent)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LabelSelector) DeepCopyInto(out *LabelSelector) {
+	*out = *in
+	if in.MatchLabels != nil {
+		in, out := &in.MatchLabels, &out.MatchLabels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.MatchExpressions != nil {
+		in, out := &in.MatchExpressions, &out.MatchExpressions
+		*out = make([]LabelSelectorRequirement, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LabelSelector.
+func (in *LabelSelector) DeepCopy() *LabelSelector {
+	if in == nil {
+		return nil
+	}
+	out := new(LabelSelector)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LabelSelectorRequirement) DeepCopyInto(out *LabelSelectorRequirement) {
+	*out = *in
+	if in.Values != nil {
+		in, out := &in.Values, &out.Values
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LabelSelectorRequirement.
+func (in *LabelSelectorRequirement) DeepCopy() *LabelSelectorRequirement {
+	if in == nil {
+		return nil
+	}
+	out := new(LabelSelectorRequirement)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *List) DeepCopyInto(out *List) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.RawExtension, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new List.
+func (in *List) DeepCopy() *List {
+	if in == nil {
+		return nil
+	}
+	out := new(List)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *List) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListMeta) DeepCopyInto(out *ListMeta) {
+	*out = *in
+	if in.RemainingItemCount != nil {
+		in, out := &in.RemainingItemCount, &out.RemainingItemCount
+		*out = new(int64)
+		**out = **in
+	}
+	if in.ShardInfo != nil {
+		in, out := &in.ShardInfo, &out.ShardInfo
+		*out = new(ShardInfo)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListMeta.
+func (in *ListMeta) DeepCopy() *ListMeta {
+	if in == nil {
+		return nil
+	}
+	out := new(ListMeta)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListOptions) DeepCopyInto(out *ListOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.TimeoutSeconds != nil {
+		in, out := &in.TimeoutSeconds, &out.TimeoutSeconds
+		*out = new(int64)
+		**out = **in
+	}
+	if in.SendInitialEvents != nil {
+		in, out := &in.SendInitialEvents, &out.SendInitialEvents
+		*out = new(bool)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListOptions.
+func (in *ListOptions) DeepCopy() *ListOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(ListOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ListOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ManagedFieldsEntry) DeepCopyInto(out *ManagedFieldsEntry) {
+	*out = *in
+	if in.Time != nil {
+		in, out := &in.Time, &out.Time
+		*out = (*in).DeepCopy()
+	}
+	if in.FieldsV1 != nil {
+		in, out := &in.FieldsV1, &out.FieldsV1
+		*out = (*in).DeepCopy()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedFieldsEntry.
+func (in *ManagedFieldsEntry) DeepCopy() *ManagedFieldsEntry {
+	if in == nil {
+		return nil
+	}
+	out := new(ManagedFieldsEntry)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MicroTime.
+func (in *MicroTime) DeepCopy() *MicroTime {
+	if in == nil {
+		return nil
+	}
+	out := new(MicroTime)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ObjectMeta) DeepCopyInto(out *ObjectMeta) {
+	*out = *in
+	in.CreationTimestamp.DeepCopyInto(&out.CreationTimestamp)
+	if in.DeletionTimestamp != nil {
+		in, out := &in.DeletionTimestamp, &out.DeletionTimestamp
+		*out = (*in).DeepCopy()
+	}
+	if in.DeletionGracePeriodSeconds != nil {
+		in, out := &in.DeletionGracePeriodSeconds, &out.DeletionGracePeriodSeconds
+		*out = new(int64)
+		**out = **in
+	}
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.OwnerReferences != nil {
+		in, out := &in.OwnerReferences, &out.OwnerReferences
+		*out = make([]OwnerReference, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Finalizers != nil {
+		in, out := &in.Finalizers, &out.Finalizers
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ManagedFields != nil {
+		in, out := &in.ManagedFields, &out.ManagedFields
+		*out = make([]ManagedFieldsEntry, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ObjectMeta.
+func (in *ObjectMeta) DeepCopy() *ObjectMeta {
+	if in == nil {
+		return nil
+	}
+	out := new(ObjectMeta)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *OwnerReference) DeepCopyInto(out *OwnerReference) {
+	*out = *in
+	if in.Controller != nil {
+		in, out := &in.Controller, &out.Controller
+		*out = new(bool)
+		**out = **in
+	}
+	if in.BlockOwnerDeletion != nil {
+		in, out := &in.BlockOwnerDeletion, &out.BlockOwnerDeletion
+		*out = new(bool)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OwnerReference.
+func (in *OwnerReference) DeepCopy() *OwnerReference {
+	if in == nil {
+		return nil
+	}
+	out := new(OwnerReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PartialObjectMetadata) DeepCopyInto(out *PartialObjectMetadata) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PartialObjectMetadata.
+func (in *PartialObjectMetadata) DeepCopy() *PartialObjectMetadata {
+	if in == nil {
+		return nil
+	}
+	out := new(PartialObjectMetadata)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PartialObjectMetadata) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PartialObjectMetadataList) DeepCopyInto(out *PartialObjectMetadataList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]PartialObjectMetadata, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PartialObjectMetadataList.
+func (in *PartialObjectMetadataList) DeepCopy() *PartialObjectMetadataList {
+	if in == nil {
+		return nil
+	}
+	out := new(PartialObjectMetadataList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PartialObjectMetadataList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Patch) DeepCopyInto(out *Patch) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Patch.
+func (in *Patch) DeepCopy() *Patch {
+	if in == nil {
+		return nil
+	}
+	out := new(Patch)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PatchOptions) DeepCopyInto(out *PatchOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.DryRun != nil {
+		in, out := &in.DryRun, &out.DryRun
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Force != nil {
+		in, out := &in.Force, &out.Force
+		*out = new(bool)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PatchOptions.
+func (in *PatchOptions) DeepCopy() *PatchOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(PatchOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PatchOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Preconditions) DeepCopyInto(out *Preconditions) {
+	*out = *in
+	if in.UID != nil {
+		in, out := &in.UID, &out.UID
+		*out = new(types.UID)
+		**out = **in
+	}
+	if in.ResourceVersion != nil {
+		in, out := &in.ResourceVersion, &out.ResourceVersion
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Preconditions.
+func (in *Preconditions) DeepCopy() *Preconditions {
+	if in == nil {
+		return nil
+	}
+	out := new(Preconditions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RootPaths) DeepCopyInto(out *RootPaths) {
+	*out = *in
+	if in.Paths != nil {
+		in, out := &in.Paths, &out.Paths
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RootPaths.
+func (in *RootPaths) DeepCopy() *RootPaths {
+	if in == nil {
+		return nil
+	}
+	out := new(RootPaths)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ServerAddressByClientCIDR) DeepCopyInto(out *ServerAddressByClientCIDR) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServerAddressByClientCIDR.
+func (in *ServerAddressByClientCIDR) DeepCopy() *ServerAddressByClientCIDR {
+	if in == nil {
+		return nil
+	}
+	out := new(ServerAddressByClientCIDR)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ShardInfo) DeepCopyInto(out *ShardInfo) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ShardInfo.
+func (in *ShardInfo) DeepCopy() *ShardInfo {
+	if in == nil {
+		return nil
+	}
+	out := new(ShardInfo)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Status) DeepCopyInto(out *Status) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Details != nil {
+		in, out := &in.Details, &out.Details
+		*out = new(StatusDetails)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Status.
+func (in *Status) DeepCopy() *Status {
+	if in == nil {
+		return nil
+	}
+	out := new(Status)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Status) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StatusCause) DeepCopyInto(out *StatusCause) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StatusCause.
+func (in *StatusCause) DeepCopy() *StatusCause {
+	if in == nil {
+		return nil
+	}
+	out := new(StatusCause)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StatusDetails) DeepCopyInto(out *StatusDetails) {
+	*out = *in
+	if in.Causes != nil {
+		in, out := &in.Causes, &out.Causes
+		*out = make([]StatusCause, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StatusDetails.
+func (in *StatusDetails) DeepCopy() *StatusDetails {
+	if in == nil {
+		return nil
+	}
+	out := new(StatusDetails)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Table) DeepCopyInto(out *Table) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.ColumnDefinitions != nil {
+		in, out := &in.ColumnDefinitions, &out.ColumnDefinitions
+		*out = make([]TableColumnDefinition, len(*in))
+		copy(*out, *in)
+	}
+	if in.Rows != nil {
+		in, out := &in.Rows, &out.Rows
+		*out = make([]TableRow, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Table.
+func (in *Table) DeepCopy() *Table {
+	if in == nil {
+		return nil
+	}
+	out := new(Table)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Table) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TableColumnDefinition) DeepCopyInto(out *TableColumnDefinition) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TableColumnDefinition.
+func (in *TableColumnDefinition) DeepCopy() *TableColumnDefinition {
+	if in == nil {
+		return nil
+	}
+	out := new(TableColumnDefinition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TableOptions) DeepCopyInto(out *TableOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TableOptions.
+func (in *TableOptions) DeepCopy() *TableOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(TableOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TableOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TableRow) DeepCopyInto(out *TableRow) {
+	clone := in.DeepCopy()
+	*out = *clone
+	return
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TableRowCondition) DeepCopyInto(out *TableRowCondition) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TableRowCondition.
+func (in *TableRowCondition) DeepCopy() *TableRowCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(TableRowCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Time.
+func (in *Time) DeepCopy() *Time {
+	if in == nil {
+		return nil
+	}
+	out := new(Time)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Timestamp) DeepCopyInto(out *Timestamp) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Timestamp.
+func (in *Timestamp) DeepCopy() *Timestamp {
+	if in == nil {
+		return nil
+	}
+	out := new(Timestamp)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UpdateOptions) DeepCopyInto(out *UpdateOptions) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.DryRun != nil {
+		in, out := &in.DryRun, &out.DryRun
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UpdateOptions.
+func (in *UpdateOptions) DeepCopy() *UpdateOptions {
+	if in == nil {
+		return nil
+	}
+	out := new(UpdateOptions)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *UpdateOptions) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in Verbs) DeepCopyInto(out *Verbs) {
+	{
+		in := &in
+		*out = make(Verbs, len(*in))
+		copy(*out, *in)
+		return
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Verbs.
+func (in Verbs) DeepCopy() Verbs {
+	if in == nil {
+		return nil
+	}
+	out := new(Verbs)
+	in.DeepCopyInto(out)
+	return *out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WatchEvent) DeepCopyInto(out *WatchEvent) {
+	*out = *in
+	in.Object.DeepCopyInto(&out.Object)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WatchEvent.
+func (in *WatchEvent) DeepCopy() *WatchEvent {
+	if in == nil {
+		return nil
+	}
+	out := new(WatchEvent)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *WatchEvent) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.defaults.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.defaults.go
new file mode 100644
index 0000000000..dac177e93b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.model_name.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.model_name.go
new file mode 100644
index 0000000000..3df687707c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1/zz_generated.model_name.go
@@ -0,0 +1,272 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package v1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIGroup) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.APIGroup"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIGroupList) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.APIGroupList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIResource) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.APIResource"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIResourceList) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.APIResourceList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in APIVersions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.APIVersions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ApplyOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.ApplyOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Condition) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Condition"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CreateOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.CreateOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeleteOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Duration) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Duration"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in FieldSelectorRequirement) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.FieldSelectorRequirement"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in FieldsV1) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GetOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.GetOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GroupKind) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.GroupKind"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GroupResource) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.GroupResource"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GroupVersion) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.GroupVersion"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GroupVersionForDiscovery) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.GroupVersionForDiscovery"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GroupVersionKind) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.GroupVersionKind"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GroupVersionResource) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.GroupVersionResource"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in InternalEvent) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.InternalEvent"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in LabelSelector) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in LabelSelectorRequirement) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in List) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.List"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ListMeta) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.ListMeta"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ListOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.ListOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ManagedFieldsEntry) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in MicroTime) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.MicroTime"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ObjectMeta) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in OwnerReference) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PartialObjectMetadata) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.PartialObjectMetadata"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PartialObjectMetadataList) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.PartialObjectMetadataList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Patch) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Patch"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PatchOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.PatchOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Preconditions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Preconditions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in RootPaths) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.RootPaths"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ServerAddressByClientCIDR) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.ServerAddressByClientCIDR"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ShardInfo) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.ShardInfo"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Status) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Status"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in StatusCause) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.StatusCause"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in StatusDetails) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.StatusDetails"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Table) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Table"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TableColumnDefinition) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.TableColumnDefinition"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TableOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.TableOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TableRow) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.TableRow"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TableRowCondition) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.TableRowCondition"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Time) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Time"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Timestamp) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.Timestamp"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TypeMeta) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.TypeMeta"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in UpdateOptions) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.UpdateOptions"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WatchEvent) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent"
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/conversion.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/conversion.go
new file mode 100644
index 0000000000..5cac6fba5a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/conversion.go
@@ -0,0 +1,46 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	"unsafe"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+)
+
+// Convert_Slice_string_To_v1beta1_IncludeObjectPolicy allows converting a URL query parameter value
+func Convert_Slice_string_To_v1beta1_IncludeObjectPolicy(in *[]string, out *IncludeObjectPolicy, s conversion.Scope) error {
+	if len(*in) > 0 {
+		*out = IncludeObjectPolicy((*in)[0])
+	}
+	return nil
+}
+
+// Convert_v1beta1_PartialObjectMetadataList_To_v1_PartialObjectMetadataList allows converting PartialObjectMetadataList between versions
+func Convert_v1beta1_PartialObjectMetadataList_To_v1_PartialObjectMetadataList(in *PartialObjectMetadataList, out *v1.PartialObjectMetadataList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	out.Items = *(*[]v1.PartialObjectMetadata)(unsafe.Pointer(&in.Items))
+	return nil
+}
+
+// Convert_v1_PartialObjectMetadataList_To_v1beta1_PartialObjectMetadataList allows converting PartialObjectMetadataList between versions
+func Convert_v1_PartialObjectMetadataList_To_v1beta1_PartialObjectMetadataList(in *v1.PartialObjectMetadataList, out *PartialObjectMetadataList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	out.Items = *(*[]v1.PartialObjectMetadata)(unsafe.Pointer(&in.Items))
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/deepcopy.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/deepcopy.go
new file mode 100644
index 0000000000..2b7e8ca0bf
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/deepcopy.go
@@ -0,0 +1,17 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/doc.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/doc.go
new file mode 100644
index 0000000000..159ca0573f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/doc.go
@@ -0,0 +1,24 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +k8s:openapi-gen=true
+// +k8s:defaulter-gen=TypeMeta
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.apis.meta.v1beta1
+
+// +groupName=meta.k8s.io
+
+package v1beta1
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.pb.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.pb.go
new file mode 100644
index 0000000000..3c763898e7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.pb.go
@@ -0,0 +1,341 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.proto
+
+package v1beta1
+
+import (
+	fmt "fmt"
+
+	io "io"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	math_bits "math/bits"
+	reflect "reflect"
+	strings "strings"
+)
+
+func (m *PartialObjectMetadataList) Reset() { *m = PartialObjectMetadataList{} }
+
+func (m *PartialObjectMetadataList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PartialObjectMetadataList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PartialObjectMetadataList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *PartialObjectMetadataList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozGenerated(x uint64) (n int) {
+	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *PartialObjectMetadataList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]PartialObjectMetadata{"
+	for _, f := range this.Items {
+		repeatedStringForItems += fmt.Sprintf("%v", f) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&PartialObjectMetadataList{`,
+		`Items:` + repeatedStringForItems + `,`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringGenerated(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *PartialObjectMetadataList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PartialObjectMetadataList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PartialObjectMetadataList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, v1.PartialObjectMetadata{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipGenerated(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLengthGenerated
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupGenerated
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthGenerated
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+var (
+	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.proto b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.proto
new file mode 100644
index 0000000000..fcec553542
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/generated.proto
@@ -0,0 +1,41 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.apimachinery.pkg.apis.meta.v1beta1;
+
+import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
+import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/apimachinery/pkg/apis/meta/v1beta1";
+
+// PartialObjectMetadataList contains a list of objects containing only their metadata.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+message PartialObjectMetadataList {
+  // Standard list metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 2;
+
+  // items contains each of the included items.
+  repeated .k8s.io.apimachinery.pkg.apis.meta.v1.PartialObjectMetadata items = 1;
+}
+
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/register.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/register.go
new file mode 100644
index 0000000000..a4a412e335
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/register.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName is the group name for this API.
+const GroupName = "meta.k8s.io"
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1beta1"}
+
+// Kind takes an unqualified kind and returns a Group qualified GroupKind
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// AddMetaToScheme registers base meta types into schemas.
+func AddMetaToScheme(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&Table{},
+		&TableOptions{},
+		&PartialObjectMetadata{},
+		&PartialObjectMetadataList{},
+	)
+
+	return nil
+}
+
+// RegisterConversions adds conversion functions to the given scheme.
+func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*PartialObjectMetadataList)(nil), (*v1.PartialObjectMetadataList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1beta1_PartialObjectMetadataList_To_v1_PartialObjectMetadataList(a.(*PartialObjectMetadataList), b.(*v1.PartialObjectMetadataList), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*v1.PartialObjectMetadataList)(nil), (*PartialObjectMetadataList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_PartialObjectMetadataList_To_v1beta1_PartialObjectMetadataList(a.(*v1.PartialObjectMetadataList), b.(*PartialObjectMetadataList), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types.go
new file mode 100644
index 0000000000..1cda0840ac
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types.go
@@ -0,0 +1,85 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// package v1beta1 is alpha objects from meta that will be introduced.
+package v1beta1
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// Table is a tabular representation of a set of API resources. The server transforms the
+// object into a set of preferred columns for quickly reviewing the objects.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +protobuf=false
+type Table = v1.Table
+
+// TableColumnDefinition contains information about a column returned in the Table.
+// +protobuf=false
+type TableColumnDefinition = v1.TableColumnDefinition
+
+// TableRow is an individual row in a table.
+// +protobuf=false
+type TableRow = v1.TableRow
+
+// TableRowCondition allows a row to be marked with additional information.
+// +protobuf=false
+type TableRowCondition = v1.TableRowCondition
+
+type RowConditionType = v1.RowConditionType
+
+type ConditionStatus = v1.ConditionStatus
+
+type IncludeObjectPolicy = v1.IncludeObjectPolicy
+
+// TableOptions are used when a Table is requested by the caller.
+// +k8s:conversion-gen:explicit-from=net/url.Values
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type TableOptions = v1.TableOptions
+
+// PartialObjectMetadata is a generic representation of any object with ObjectMeta. It allows clients
+// to get access to a particular ObjectMeta schema without knowing the details of the version.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type PartialObjectMetadata = v1.PartialObjectMetadata
+
+// IMPORTANT: PartialObjectMetadataList has different protobuf field ids in v1beta1 than
+// v1 because ListMeta was accidentally omitted prior to 1.15. Therefore this type must
+// remain independent of v1.PartialObjectMetadataList to preserve mappings.
+
+// PartialObjectMetadataList contains a list of objects containing only their metadata.
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type PartialObjectMetadataList struct {
+	v1.TypeMeta `json:""`
+	// Standard list metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	v1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,2,opt,name=metadata"`
+
+	// items contains each of the included items.
+	Items []v1.PartialObjectMetadata `json:"items" protobuf:"bytes,1,rep,name=items"`
+}
+
+const (
+	RowCompleted = v1.RowCompleted
+
+	ConditionTrue    = v1.ConditionTrue
+	ConditionFalse   = v1.ConditionFalse
+	ConditionUnknown = v1.ConditionUnknown
+
+	IncludeNone     = v1.IncludeNone
+	IncludeMetadata = v1.IncludeMetadata
+	IncludeObject   = v1.IncludeObject
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types_swagger_doc_generated.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types_swagger_doc_generated.go
new file mode 100644
index 0000000000..dff735dcf3
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types_swagger_doc_generated.go
@@ -0,0 +1,40 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+// This file contains a collection of methods that can be used from go-restful to
+// generate Swagger API documentation for its models. Please read this PR for more
+// information on the implementation: https://github.com/emicklei/go-restful/pull/215
+//
+// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if
+// they are on one line! For multiple line or blocks that you want to ignore use ---.
+// Any context after a --- is ignored.
+//
+// Those methods can be generated by using hack/update-codegen.sh
+
+// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
+var map_PartialObjectMetadataList = map[string]string{
+	"":         "PartialObjectMetadataList contains a list of objects containing only their metadata.",
+	"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+	"items":    "items contains each of the included items.",
+}
+
+func (PartialObjectMetadataList) SwaggerDoc() map[string]string {
+	return map_PartialObjectMetadataList
+}
+
+// AUTO-GENERATED FUNCTIONS END HERE
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/validation/validation.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/validation/validation.go
new file mode 100644
index 0000000000..563b62efa5
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/validation/validation.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// ValidateTableOptions returns any invalid flags on TableOptions.
+func ValidateTableOptions(opts *metav1.TableOptions) field.ErrorList {
+	var allErrs field.ErrorList
+	switch opts.IncludeObject {
+	case metav1.IncludeMetadata, metav1.IncludeNone, metav1.IncludeObject, "":
+	default:
+		allErrs = append(allErrs, field.Invalid(field.NewPath("includeObject"), opts.IncludeObject, "must be 'Metadata', 'Object', 'None', or empty"))
+	}
+	return allErrs
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.deepcopy.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..972b7f03ea
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.deepcopy.go
@@ -0,0 +1,60 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PartialObjectMetadataList) DeepCopyInto(out *PartialObjectMetadataList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]v1.PartialObjectMetadata, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PartialObjectMetadataList.
+func (in *PartialObjectMetadataList) DeepCopy() *PartialObjectMetadataList {
+	if in == nil {
+		return nil
+	}
+	out := new(PartialObjectMetadataList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PartialObjectMetadataList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.defaults.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.defaults.go
new file mode 100644
index 0000000000..198b5be4af
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.model_name.go b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.model_name.go
new file mode 100644
index 0000000000..9c3600119a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/meta/v1beta1/zz_generated.model_name.go
@@ -0,0 +1,27 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package v1beta1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PartialObjectMetadataList) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.meta.v1beta1.PartialObjectMetadataList"
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/doc.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/doc.go
new file mode 100644
index 0000000000..4307afaf35
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/doc.go
@@ -0,0 +1,22 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +groupName=testapigroup.apimachinery.k8s.io
+//
+// package testapigroup contains an testapigroup API used to demonstrate how to create api groups. Moreover, this is
+// used within tests.
+package testapigroup
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/fuzzer/fuzzer.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/fuzzer/fuzzer.go
new file mode 100644
index 0000000000..ff98239713
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/fuzzer/fuzzer.go
@@ -0,0 +1,99 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fuzzer
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/randfill"
+
+	apitesting "k8s.io/apimachinery/pkg/api/apitesting"
+	"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	v1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
+)
+
+// overrideMetaFuncs override some generic fuzzer funcs from k8s.io/apimachinery in order to have more realistic
+// values in a Kubernetes context.
+func overrideMetaFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
+	return []interface{}{
+		func(j *runtime.Object, c randfill.Continue) {
+			// TODO: uncomment when round trip starts from a versioned object
+			if true { // c.Bool() {
+				*j = &runtime.Unknown{
+					// We do not set TypeMeta here because it is not carried through a round trip
+					Raw:         []byte(`{"apiVersion":"unknown.group/unknown","kind":"Something","someKey":"someValue"}`),
+					ContentType: runtime.ContentTypeJSON,
+				}
+			} else {
+				types := []runtime.Object{&testapigroup.Carp{}}
+				t := types[c.Rand.Intn(len(types))]
+				c.Fill(t)
+				*j = t
+			}
+		},
+		func(r *runtime.RawExtension, c randfill.Continue) {
+			// Pick an arbitrary type and fuzz it
+			types := []runtime.Object{&testapigroup.Carp{}}
+			obj := types[c.Rand.Intn(len(types))]
+			c.Fill(obj)
+
+			// Convert the object to raw bytes
+			bytes, err := runtime.Encode(apitesting.TestCodec(codecs, v1.SchemeGroupVersion), obj)
+			if err != nil {
+				panic(fmt.Sprintf("Failed to encode object: %v", err))
+			}
+
+			// Set the bytes field on the RawExtension
+			r.Raw = bytes
+		},
+	}
+}
+
+func testapigroupFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
+	return []interface{}{
+		func(s *testapigroup.CarpSpec, c randfill.Continue) {
+			c.FillNoCustom(s)
+			// has a default value
+			ttl := int64(30)
+			if c.Bool() {
+				ttl = int64(c.Uint32())
+			}
+			s.TerminationGracePeriodSeconds = &ttl
+
+			if s.SchedulerName == "" {
+				s.SchedulerName = "default-scheduler"
+			}
+		},
+		func(j *testapigroup.CarpPhase, c randfill.Continue) {
+			statuses := []testapigroup.CarpPhase{"Pending", "Running", "Succeeded", "Failed", "Unknown"}
+			*j = statuses[c.Rand.Intn(len(statuses))]
+		},
+		func(rp *testapigroup.RestartPolicy, c randfill.Continue) {
+			policies := []testapigroup.RestartPolicy{"Always", "Never", "OnFailure"}
+			*rp = policies[c.Rand.Intn(len(policies))]
+		},
+	}
+}
+
+// Funcs returns the fuzzer functions for the testapigroup.
+var Funcs = fuzzer.MergeFuzzerFuncs(
+	overrideMetaFuncs,
+	testapigroupFuncs,
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/install/install.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/install/install.go
new file mode 100644
index 0000000000..6fc079f51b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/install/install.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package install installs the certificates API group, making it available as
+// an option to all of the API encoding/decoding machinery.
+package install
+
+import (
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	"k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// Install registers the API group and adds types to a scheme
+func Install(scheme *runtime.Scheme) {
+	utilruntime.Must(testapigroup.AddToScheme(scheme))
+	utilruntime.Must(v1.AddToScheme(scheme))
+	utilruntime.Must(scheme.SetVersionPriority(v1.SchemeGroupVersion))
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/install/roundtrip_test.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/install/roundtrip_test.go
new file mode 100644
index 0000000000..7e9b427a87
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/install/roundtrip_test.go
@@ -0,0 +1,29 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package install
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/apitesting/roundtrip"
+	testapigroupfuzzer "k8s.io/apimachinery/pkg/apis/testapigroup/fuzzer"
+)
+
+func TestRoundTrip(t *testing.T) {
+	roundtrip.RoundTripTestForAPIGroup(t, Install, testapigroupfuzzer.Funcs)
+	roundtrip.RoundTripProtobufTestForAPIGroup(t, Install, testapigroupfuzzer.Funcs)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/register.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/register.go
new file mode 100644
index 0000000000..f70c5a83b4
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/register.go
@@ -0,0 +1,52 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testapigroup
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var (
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+	AddToScheme   = SchemeBuilder.AddToScheme
+)
+
+// GroupName is the group name use in this package
+const GroupName = "testapigroup.apimachinery.k8s.io"
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
+
+// Kind takes an unqualified kind and returns a Group qualified GroupKind
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&Carp{},
+		&CarpList{},
+	)
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/types.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/types.go
new file mode 100644
index 0000000000..884963fede
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/types.go
@@ -0,0 +1,161 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testapigroup
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type (
+	ConditionStatus   string
+	CarpConditionType string
+	CarpPhase         string
+	RestartPolicy     string
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// Carp is a collection of containers, used as either input (create, update) or as output (list, get).
+type Carp struct {
+	metav1.TypeMeta
+	// +optional
+	metav1.ObjectMeta
+
+	// Spec defines the behavior of a carp.
+	// +optional
+	Spec CarpSpec
+
+	// Status represents the current information about a carp. This data may not be up
+	// to date.
+	// +optional
+	Status CarpStatus
+}
+
+// CarpStatus represents information about the status of a carp. Status may trail the actual
+// state of a system.
+type CarpStatus struct {
+	// +optional
+	Phase CarpPhase
+	// +optional
+	Conditions []CarpCondition
+	// A human readable message indicating details about why the carp is in this state.
+	// +optional
+	Message string
+	// A brief CamelCase message indicating details about why the carp is in this state. e.g. 'DiskPressure'
+	// +optional
+	Reason string
+
+	// +optional
+	HostIP string
+	// +optional
+	CarpIP string
+
+	// Date and time at which the object was acknowledged by the Kubelet.
+	// This is before the Kubelet pulled the container image(s) for the carp.
+	// +optional
+	StartTime *metav1.Time
+
+	// Carp infos are provided by different clients, hence the map type.
+	//
+	// +listType=map
+	// +listKey=a
+	// +listKey=b
+	// +listKey=c
+	Infos []CarpInfo
+}
+
+type CarpCondition struct {
+	Type   CarpConditionType
+	Status ConditionStatus
+	// +optional
+	LastProbeTime metav1.Time
+	// +optional
+	LastTransitionTime metav1.Time
+	// +optional
+	Reason string
+	// +optional
+	Message string
+}
+
+type CarpInfo struct {
+	// A is the first map key.
+	// +required
+	A int64
+	// B is the second map key.
+	// +required
+	B string
+	// C is the third, optional map key
+	// +optional
+	C *string
+
+	// Some data for each pair of A and B.
+	Data string
+}
+
+// CarpSpec is a description of a carp
+type CarpSpec struct {
+	// +optional
+	RestartPolicy RestartPolicy
+	// Optional duration in seconds the carp needs to terminate gracefully. May be decreased in delete request.
+	// Value must be non-negative integer. The value zero indicates delete immediately.
+	// If this value is nil, the default grace period will be used instead.
+	// The grace period is the duration in seconds after the processes running in the carp are sent
+	// a termination signal and the time when the processes are forcibly halted with a kill signal.
+	// Set this value longer than the expected cleanup time for your process.
+	// +optional
+	TerminationGracePeriodSeconds *int64
+	// Optional duration in seconds relative to the StartTime that the carp may be active on a node
+	// before the system actively tries to terminate the carp; value must be positive integer
+	// +optional
+	ActiveDeadlineSeconds *int64
+	// NodeSelector is a selector which must be true for the carp to fit on a node
+	// +optional
+	NodeSelector map[string]string
+
+	// ServiceAccountName is the name of the ServiceAccount to use to run this carp
+	// The carp will be allowed to use secrets referenced by the ServiceAccount
+	ServiceAccountName string
+
+	// NodeName is a request to schedule this carp onto a specific node.  If it is non-empty,
+	// the scheduler simply schedules this carp onto that node, assuming that it fits resource
+	// requirements.
+	// +optional
+	NodeName string
+	// Specifies the hostname of the Carp.
+	// If not specified, the carp's hostname will be set to a system-defined value.
+	// +optional
+	Hostname string
+	// If specified, the fully qualified Carp hostname will be "<hostname>.<subdomain>.<carp namespace>.svc.<cluster domain>".
+	// If not specified, the carp will not have a domainname at all.
+	// +optional
+	Subdomain string
+	// If specified, the carp will be dispatched by specified scheduler.
+	// If not specified, the carp will be dispatched by default scheduler.
+	// +optional
+	SchedulerName string
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// CarpList is a list of Carps.
+type CarpList struct {
+	metav1.TypeMeta
+	// +optional
+	metav1.ListMeta
+
+	Items []Carp
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/conversion.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/conversion.go
new file mode 100644
index 0000000000..3e8448f4c5
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/conversion.go
@@ -0,0 +1,26 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func addConversionFuncs(scheme *runtime.Scheme) error {
+	// Add non-generated conversion functions here. Currently there are none.
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/defaults.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/defaults.go
new file mode 100644
index 0000000000..436ccde296
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/defaults.go
@@ -0,0 +1,26 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func addDefaultingFuncs(scheme *runtime.Scheme) error {
+	// return RegisterDefaults(scheme)
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/doc.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/doc.go
new file mode 100644
index 0000000000..35bdf7c7cf
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/doc.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen=package
+// +k8s:conversion-gen=k8s.io/apimachinery/pkg/apis/testapigroup
+// +k8s:openapi-gen=false
+// +k8s:defaulter-gen=TypeMeta
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.apis.testapigroup.v1
+
+// +k8s:prerelease-lifecycle-gen=true
+// +groupName=testapigroup.apimachinery.k8s.io
+
+package v1
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/generated.pb.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/generated.pb.go
new file mode 100644
index 0000000000..b1af782b02
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/generated.pb.go
@@ -0,0 +1,2323 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/apimachinery/pkg/apis/testapigroup/v1/generated.proto
+
+package v1
+
+import (
+	fmt "fmt"
+
+	io "io"
+	"sort"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	math_bits "math/bits"
+	reflect "reflect"
+	strings "strings"
+)
+
+func (m *Carp) Reset() { *m = Carp{} }
+
+func (m *CarpCondition) Reset() { *m = CarpCondition{} }
+
+func (m *CarpInfo) Reset() { *m = CarpInfo{} }
+
+func (m *CarpList) Reset() { *m = CarpList{} }
+
+func (m *CarpSpec) Reset() { *m = CarpSpec{} }
+
+func (m *CarpStatus) Reset() { *m = CarpStatus{} }
+
+func (m *Carp) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Carp) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Carp) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *CarpCondition) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CarpCondition) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CarpCondition) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Message)
+	copy(dAtA[i:], m.Message)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message)))
+	i--
+	dAtA[i] = 0x32
+	i -= len(m.Reason)
+	copy(dAtA[i:], m.Reason)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Reason)))
+	i--
+	dAtA[i] = 0x2a
+	{
+		size, err := m.LastTransitionTime.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x22
+	{
+		size, err := m.LastProbeTime.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Status)
+	copy(dAtA[i:], m.Status)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Type)
+	copy(dAtA[i:], m.Type)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *CarpInfo) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CarpInfo) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CarpInfo) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.C != nil {
+		i -= len(*m.C)
+		copy(dAtA[i:], *m.C)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.C)))
+		i--
+		dAtA[i] = 0x22
+	}
+	i -= len(m.Data)
+	copy(dAtA[i:], m.Data)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Data)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.B)
+	copy(dAtA[i:], m.B)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.B)))
+	i--
+	dAtA[i] = 0x12
+	i = encodeVarintGenerated(dAtA, i, uint64(m.A))
+	i--
+	dAtA[i] = 0x8
+	return len(dAtA) - i, nil
+}
+
+func (m *CarpList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CarpList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CarpList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *CarpSpec) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CarpSpec) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CarpSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.SchedulerName)
+	copy(dAtA[i:], m.SchedulerName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.SchedulerName)))
+	i--
+	dAtA[i] = 0x1
+	i--
+	dAtA[i] = 0x9a
+	i -= len(m.Subdomain)
+	copy(dAtA[i:], m.Subdomain)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Subdomain)))
+	i--
+	dAtA[i] = 0x1
+	i--
+	dAtA[i] = 0x8a
+	i -= len(m.Hostname)
+	copy(dAtA[i:], m.Hostname)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Hostname)))
+	i--
+	dAtA[i] = 0x1
+	i--
+	dAtA[i] = 0x82
+	i--
+	if m.HostIPC {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x68
+	i--
+	if m.HostPID {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x60
+	i--
+	if m.HostNetwork {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x58
+	i -= len(m.NodeName)
+	copy(dAtA[i:], m.NodeName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.NodeName)))
+	i--
+	dAtA[i] = 0x52
+	i -= len(m.DeprecatedServiceAccount)
+	copy(dAtA[i:], m.DeprecatedServiceAccount)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.DeprecatedServiceAccount)))
+	i--
+	dAtA[i] = 0x4a
+	i -= len(m.ServiceAccountName)
+	copy(dAtA[i:], m.ServiceAccountName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ServiceAccountName)))
+	i--
+	dAtA[i] = 0x42
+	if len(m.NodeSelector) > 0 {
+		keysForNodeSelector := make([]string, 0, len(m.NodeSelector))
+		for k := range m.NodeSelector {
+			keysForNodeSelector = append(keysForNodeSelector, string(k))
+		}
+		sort.Strings(keysForNodeSelector)
+		for iNdEx := len(keysForNodeSelector) - 1; iNdEx >= 0; iNdEx-- {
+			v := m.NodeSelector[string(keysForNodeSelector[iNdEx])]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = encodeVarintGenerated(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(keysForNodeSelector[iNdEx])
+			copy(dAtA[i:], keysForNodeSelector[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForNodeSelector[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintGenerated(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x3a
+		}
+	}
+	if m.ActiveDeadlineSeconds != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.ActiveDeadlineSeconds))
+		i--
+		dAtA[i] = 0x28
+	}
+	if m.TerminationGracePeriodSeconds != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.TerminationGracePeriodSeconds))
+		i--
+		dAtA[i] = 0x20
+	}
+	i -= len(m.RestartPolicy)
+	copy(dAtA[i:], m.RestartPolicy)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.RestartPolicy)))
+	i--
+	dAtA[i] = 0x1a
+	return len(dAtA) - i, nil
+}
+
+func (m *CarpStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CarpStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CarpStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Infos) > 0 {
+		for iNdEx := len(m.Infos) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Infos[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x42
+		}
+	}
+	if m.StartTime != nil {
+		{
+			size, err := m.StartTime.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x3a
+	}
+	i -= len(m.CarpIP)
+	copy(dAtA[i:], m.CarpIP)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.CarpIP)))
+	i--
+	dAtA[i] = 0x32
+	i -= len(m.HostIP)
+	copy(dAtA[i:], m.HostIP)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.HostIP)))
+	i--
+	dAtA[i] = 0x2a
+	i -= len(m.Reason)
+	copy(dAtA[i:], m.Reason)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Reason)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.Message)
+	copy(dAtA[i:], m.Message)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message)))
+	i--
+	dAtA[i] = 0x1a
+	if len(m.Conditions) > 0 {
+		for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	i -= len(m.Phase)
+	copy(dAtA[i:], m.Phase)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Phase)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *Carp) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ObjectMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Spec.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *CarpCondition) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Type)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Status)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.LastProbeTime.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.LastTransitionTime.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Reason)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Message)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *CarpInfo) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 1 + sovGenerated(uint64(m.A))
+	l = len(m.B)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Data)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.C != nil {
+		l = len(*m.C)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *CarpList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *CarpSpec) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.RestartPolicy)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.TerminationGracePeriodSeconds != nil {
+		n += 1 + sovGenerated(uint64(*m.TerminationGracePeriodSeconds))
+	}
+	if m.ActiveDeadlineSeconds != nil {
+		n += 1 + sovGenerated(uint64(*m.ActiveDeadlineSeconds))
+	}
+	if len(m.NodeSelector) > 0 {
+		for k, v := range m.NodeSelector {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + len(v) + sovGenerated(uint64(len(v)))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
+	l = len(m.ServiceAccountName)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.DeprecatedServiceAccount)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.NodeName)
+	n += 1 + l + sovGenerated(uint64(l))
+	n += 2
+	n += 2
+	n += 2
+	l = len(m.Hostname)
+	n += 2 + l + sovGenerated(uint64(l))
+	l = len(m.Subdomain)
+	n += 2 + l + sovGenerated(uint64(l))
+	l = len(m.SchedulerName)
+	n += 2 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *CarpStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Phase)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Conditions) > 0 {
+		for _, e := range m.Conditions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = len(m.Message)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Reason)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.HostIP)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.CarpIP)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.StartTime != nil {
+		l = m.StartTime.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.Infos) > 0 {
+		for _, e := range m.Infos {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozGenerated(x uint64) (n int) {
+	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *Carp) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Carp{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "CarpSpec", "CarpSpec", 1), `&`, ``, 1) + `,`,
+		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "CarpStatus", "CarpStatus", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CarpCondition) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CarpCondition{`,
+		`Type:` + fmt.Sprintf("%v", this.Type) + `,`,
+		`Status:` + fmt.Sprintf("%v", this.Status) + `,`,
+		`LastProbeTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastProbeTime), "Time", "v1.Time", 1), `&`, ``, 1) + `,`,
+		`LastTransitionTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastTransitionTime), "Time", "v1.Time", 1), `&`, ``, 1) + `,`,
+		`Reason:` + fmt.Sprintf("%v", this.Reason) + `,`,
+		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CarpInfo) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CarpInfo{`,
+		`A:` + fmt.Sprintf("%v", this.A) + `,`,
+		`B:` + fmt.Sprintf("%v", this.B) + `,`,
+		`Data:` + fmt.Sprintf("%v", this.Data) + `,`,
+		`C:` + valueToStringGenerated(this.C) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CarpList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]Carp{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "Carp", "Carp", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&CarpList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CarpSpec) String() string {
+	if this == nil {
+		return "nil"
+	}
+	keysForNodeSelector := make([]string, 0, len(this.NodeSelector))
+	for k := range this.NodeSelector {
+		keysForNodeSelector = append(keysForNodeSelector, k)
+	}
+	sort.Strings(keysForNodeSelector)
+	mapStringForNodeSelector := "map[string]string{"
+	for _, k := range keysForNodeSelector {
+		mapStringForNodeSelector += fmt.Sprintf("%v: %v,", k, this.NodeSelector[k])
+	}
+	mapStringForNodeSelector += "}"
+	s := strings.Join([]string{`&CarpSpec{`,
+		`RestartPolicy:` + fmt.Sprintf("%v", this.RestartPolicy) + `,`,
+		`TerminationGracePeriodSeconds:` + valueToStringGenerated(this.TerminationGracePeriodSeconds) + `,`,
+		`ActiveDeadlineSeconds:` + valueToStringGenerated(this.ActiveDeadlineSeconds) + `,`,
+		`NodeSelector:` + mapStringForNodeSelector + `,`,
+		`ServiceAccountName:` + fmt.Sprintf("%v", this.ServiceAccountName) + `,`,
+		`DeprecatedServiceAccount:` + fmt.Sprintf("%v", this.DeprecatedServiceAccount) + `,`,
+		`NodeName:` + fmt.Sprintf("%v", this.NodeName) + `,`,
+		`HostNetwork:` + fmt.Sprintf("%v", this.HostNetwork) + `,`,
+		`HostPID:` + fmt.Sprintf("%v", this.HostPID) + `,`,
+		`HostIPC:` + fmt.Sprintf("%v", this.HostIPC) + `,`,
+		`Hostname:` + fmt.Sprintf("%v", this.Hostname) + `,`,
+		`Subdomain:` + fmt.Sprintf("%v", this.Subdomain) + `,`,
+		`SchedulerName:` + fmt.Sprintf("%v", this.SchedulerName) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CarpStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForConditions := "[]CarpCondition{"
+	for _, f := range this.Conditions {
+		repeatedStringForConditions += strings.Replace(strings.Replace(f.String(), "CarpCondition", "CarpCondition", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForConditions += "}"
+	repeatedStringForInfos := "[]CarpInfo{"
+	for _, f := range this.Infos {
+		repeatedStringForInfos += strings.Replace(strings.Replace(f.String(), "CarpInfo", "CarpInfo", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForInfos += "}"
+	s := strings.Join([]string{`&CarpStatus{`,
+		`Phase:` + fmt.Sprintf("%v", this.Phase) + `,`,
+		`Conditions:` + repeatedStringForConditions + `,`,
+		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`Reason:` + fmt.Sprintf("%v", this.Reason) + `,`,
+		`HostIP:` + fmt.Sprintf("%v", this.HostIP) + `,`,
+		`CarpIP:` + fmt.Sprintf("%v", this.CarpIP) + `,`,
+		`StartTime:` + strings.Replace(fmt.Sprintf("%v", this.StartTime), "Time", "v1.Time", 1) + `,`,
+		`Infos:` + repeatedStringForInfos + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringGenerated(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *Carp) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Carp: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Carp: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CarpCondition) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CarpCondition: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CarpCondition: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = CarpConditionType(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Status = ConditionStatus(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastProbeTime", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.LastProbeTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastTransitionTime", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.LastTransitionTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CarpInfo) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CarpInfo: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CarpInfo: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field A", wireType)
+			}
+			m.A = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.A |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field B", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.B = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field C", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.C = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CarpList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CarpList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CarpList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, Carp{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CarpSpec) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CarpSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CarpSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RestartPolicy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RestartPolicy = RestartPolicy(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TerminationGracePeriodSeconds", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.TerminationGracePeriodSeconds = &v
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ActiveDeadlineSeconds", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.ActiveDeadlineSeconds = &v
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeSelector", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.NodeSelector == nil {
+				m.NodeSelector = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipGenerated(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.NodeSelector[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceAccountName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServiceAccountName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeprecatedServiceAccount", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DeprecatedServiceAccount = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NodeName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HostNetwork", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.HostNetwork = bool(v != 0)
+		case 12:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HostPID", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.HostPID = bool(v != 0)
+		case 13:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HostIPC", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.HostIPC = bool(v != 0)
+		case 16:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Hostname", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Hostname = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 17:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Subdomain", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Subdomain = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 19:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulerName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SchedulerName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CarpStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CarpStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CarpStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Phase", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Phase = CarpPhase(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Conditions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Conditions = append(m.Conditions, CarpCondition{})
+			if err := m.Conditions[len(m.Conditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HostIP", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.HostIP = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CarpIP", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CarpIP = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StartTime", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.StartTime == nil {
+				m.StartTime = &v1.Time{}
+			}
+			if err := m.StartTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Infos", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Infos = append(m.Infos, CarpInfo{})
+			if err := m.Infos[len(m.Infos)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipGenerated(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLengthGenerated
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupGenerated
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthGenerated
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+var (
+	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/generated.proto b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/generated.proto
new file mode 100644
index 0000000000..c533cae9aa
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/generated.proto
@@ -0,0 +1,239 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.apimachinery.pkg.apis.testapigroup.v1;
+
+import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
+import "k8s.io/apimachinery/pkg/runtime/generated.proto";
+import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/apimachinery/pkg/apis/testapigroup/v1";
+
+// Carp is a collection of containers, used as either input (create, update) or as output (list, get).
+message Carp {
+  // Standard object's metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
+
+  // Specification of the desired behavior of the carp.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+  // +optional
+  optional CarpSpec spec = 2;
+
+  // Most recently observed status of the carp.
+  // This data may not be up to date.
+  // Populated by the system.
+  // Read-only.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+  // +optional
+  optional CarpStatus status = 3;
+}
+
+message CarpCondition {
+  // Type is the type of the condition.
+  // Currently only Ready.
+  // More info: http://kubernetes.io/docs/user-guide/carp-states#carp-conditions
+  optional string type = 1;
+
+  // Status is the status of the condition.
+  // Can be True, False, Unknown.
+  // More info: http://kubernetes.io/docs/user-guide/carp-states#carp-conditions
+  optional string status = 2;
+
+  // Last time we probed the condition.
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastProbeTime = 3;
+
+  // Last time the condition transitioned from one status to another.
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 4;
+
+  // Unique, one-word, CamelCase reason for the condition's last transition.
+  // +optional
+  optional string reason = 5;
+
+  // Human-readable message indicating details about last transition.
+  // +optional
+  optional string message = 6;
+}
+
+message CarpInfo {
+  // A is the first map key.
+  // +required
+  optional int64 a = 1;
+
+  // B is the second map key.
+  // +required
+  optional string b = 2;
+
+  // C is the third, optional map key
+  // +optional
+  optional string c = 4;
+
+  // Some data for each pair of A and B.
+  optional string data = 3;
+}
+
+// CarpList is a list of Carps.
+message CarpList {
+  // Standard list metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
+
+  // List of carps.
+  // More info: http://kubernetes.io/docs/user-guide/carps
+  repeated Carp items = 2;
+}
+
+// CarpSpec is a description of a carp
+message CarpSpec {
+  // Restart policy for all containers within the carp.
+  // One of Always, OnFailure, Never.
+  // Default to Always.
+  // More info: http://kubernetes.io/docs/user-guide/carp-states#restartpolicy
+  // +optional
+  optional string restartPolicy = 3;
+
+  // Optional duration in seconds the carp needs to terminate gracefully. May be decreased in delete request.
+  // Value must be non-negative integer. The value zero indicates delete immediately.
+  // If this value is nil, the default grace period will be used instead.
+  // The grace period is the duration in seconds after the processes running in the carp are sent
+  // a termination signal and the time when the processes are forcibly halted with a kill signal.
+  // Set this value longer than the expected cleanup time for your process.
+  // Defaults to 30 seconds.
+  // +optional
+  optional int64 terminationGracePeriodSeconds = 4;
+
+  // Optional duration in seconds the carp may be active on the node relative to
+  // StartTime before the system will actively try to mark it failed and kill associated containers.
+  // Value must be a positive integer.
+  // +optional
+  optional int64 activeDeadlineSeconds = 5;
+
+  // NodeSelector is a selector which must be true for the carp to fit on a node.
+  // Selector which must match a node's labels for the carp to be scheduled on that node.
+  // More info: http://kubernetes.io/docs/user-guide/node-selection/README
+  // +optional
+  map<string, string> nodeSelector = 7;
+
+  // ServiceAccountName is the name of the ServiceAccount to use to run this carp.
+  // More info: https://kubernetes.io/docs/concepts/security/service-accounts/
+  // +optional
+  optional string serviceAccountName = 8;
+
+  // DeprecatedServiceAccount is a deprecated alias for ServiceAccountName.
+  // Deprecated: Use serviceAccountName instead.
+  // +k8s:conversion-gen=false
+  // +optional
+  optional string deprecatedServiceAccount = 9;
+
+  // NodeName is a request to schedule this carp onto a specific node. If it is non-empty,
+  // the scheduler simply schedules this carp onto that node, assuming that it fits resource
+  // requirements.
+  // +optional
+  optional string nodeName = 10;
+
+  // Host networking requested for this carp. Use the host's network namespace.
+  // Default to false.
+  // +k8s:conversion-gen=false
+  // +optional
+  optional bool hostNetwork = 11;
+
+  // Use the host's pid namespace.
+  // Optional: Default to false.
+  // +k8s:conversion-gen=false
+  // +optional
+  optional bool hostPID = 12;
+
+  // Use the host's ipc namespace.
+  // Optional: Default to false.
+  // +k8s:conversion-gen=false
+  // +optional
+  optional bool hostIPC = 13;
+
+  // Specifies the hostname of the Carp
+  // If not specified, the carp's hostname will be set to a system-defined value.
+  // +optional
+  optional string hostname = 16;
+
+  // If specified, the fully qualified Carp hostname will be "<hostname>.<subdomain>.<carp namespace>.svc.<cluster domain>".
+  // If not specified, the carp will not have a domainname at all.
+  // +optional
+  optional string subdomain = 17;
+
+  // If specified, the carp will be dispatched by specified scheduler.
+  // If not specified, the carp will be dispatched by default scheduler.
+  // +optional
+  optional string schedulerName = 19;
+}
+
+// CarpStatus represents information about the status of a carp. Status may trail the actual
+// state of a system.
+message CarpStatus {
+  // Current condition of the carp.
+  // More info: http://kubernetes.io/docs/user-guide/carp-states#carp-phase
+  // +optional
+  optional string phase = 1;
+
+  // Current service state of carp.
+  // More info: http://kubernetes.io/docs/user-guide/carp-states#carp-conditions
+  // +patchStrategy=merge
+  // +patchMergeKey=type
+  // +listType=map
+  // +listMapKey=type
+  // +optional
+  repeated CarpCondition conditions = 2;
+
+  // A human readable message indicating details about why the carp is in this condition.
+  // +optional
+  optional string message = 3;
+
+  // A brief CamelCase message indicating details about why the carp is in this state.
+  // e.g. 'DiskPressure'
+  // +optional
+  optional string reason = 4;
+
+  // IP address of the host to which the carp is assigned. Empty if not yet scheduled.
+  // +optional
+  optional string hostIP = 5;
+
+  // IP address allocated to the carp. Routable at least within the cluster.
+  // Empty if not yet allocated.
+  // +optional
+  optional string carpIP = 6;
+
+  // RFC 3339 date and time at which the object was acknowledged by the Kubelet.
+  // This is before the Kubelet pulled the container image(s) for the carp.
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time startTime = 7;
+
+  // Carp infos are provided by different clients, hence the map type.
+  //
+  // +listType=map
+  // +listMapKey=a
+  // +listMapKey=b
+  // +listMapKey=c
+  repeated CarpInfo infos = 8;
+}
+
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/register.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/register.go
new file mode 100644
index 0000000000..afd908c7fe
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/register.go
@@ -0,0 +1,64 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName is the group name use in this package
+const GroupName = "testapigroup.apimachinery.k8s.io"
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Kind takes an unqualified kind and returns a Group qualified GroupKind
+func Kind(kind string) schema.GroupKind {
+	return SchemeGroupVersion.WithKind(kind).GroupKind()
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// TODO: move SchemeBuilder with zz_generated.deepcopy.go to k8s.io/api.
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	AddToScheme        = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes, addConversionFuncs, addDefaultingFuncs)
+}
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&Carp{},
+		&CarpList{},
+	)
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/types.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/types.go
new file mode 100644
index 0000000000..8512a514c6
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/types.go
@@ -0,0 +1,224 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type (
+	ConditionStatus   string
+	CarpConditionType string
+	CarpPhase         string
+	RestartPolicy     string
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.1
+
+// Carp is a collection of containers, used as either input (create, update) or as output (list, get).
+type Carp struct {
+	metav1.TypeMeta `json:""`
+	// Standard object's metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// Specification of the desired behavior of the carp.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	// +optional
+	Spec CarpSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
+
+	// Most recently observed status of the carp.
+	// This data may not be up to date.
+	// Populated by the system.
+	// Read-only.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	// +optional
+	Status CarpStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
+}
+
+// CarpStatus represents information about the status of a carp. Status may trail the actual
+// state of a system.
+type CarpStatus struct {
+	// Current condition of the carp.
+	// More info: http://kubernetes.io/docs/user-guide/carp-states#carp-phase
+	// +optional
+	Phase CarpPhase `json:"phase,omitempty" protobuf:"bytes,1,opt,name=phase,casttype=CarpPhase"`
+	// Current service state of carp.
+	// More info: http://kubernetes.io/docs/user-guide/carp-states#carp-conditions
+	// +patchStrategy=merge
+	// +patchMergeKey=type
+	// +listType=map
+	// +listMapKey=type
+	// +optional
+	Conditions []CarpCondition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,2,opt,name=conditions"`
+	// A human readable message indicating details about why the carp is in this condition.
+	// +optional
+	Message string `json:"message,omitempty" protobuf:"bytes,3,opt,name=message"`
+	// A brief CamelCase message indicating details about why the carp is in this state.
+	// e.g. 'DiskPressure'
+	// +optional
+	Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
+
+	// IP address of the host to which the carp is assigned. Empty if not yet scheduled.
+	// +optional
+	HostIP string `json:"hostIP,omitempty" protobuf:"bytes,5,opt,name=hostIP"`
+	// IP address allocated to the carp. Routable at least within the cluster.
+	// Empty if not yet allocated.
+	// +optional
+	CarpIP string `json:"carpIP,omitempty" protobuf:"bytes,6,opt,name=carpIP"`
+
+	// RFC 3339 date and time at which the object was acknowledged by the Kubelet.
+	// This is before the Kubelet pulled the container image(s) for the carp.
+	// +optional
+	StartTime *metav1.Time `json:"startTime,omitempty" protobuf:"bytes,7,opt,name=startTime"`
+
+	// Carp infos are provided by different clients, hence the map type.
+	//
+	// +listType=map
+	// +listMapKey=a
+	// +listMapKey=b
+	// +listMapKey=c
+	Infos []CarpInfo `json:"infos,omitempty" protobuf:"bytes,8,rep,name=infos"`
+}
+
+type CarpCondition struct {
+	// Type is the type of the condition.
+	// Currently only Ready.
+	// More info: http://kubernetes.io/docs/user-guide/carp-states#carp-conditions
+	Type CarpConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=CarpConditionType"`
+	// Status is the status of the condition.
+	// Can be True, False, Unknown.
+	// More info: http://kubernetes.io/docs/user-guide/carp-states#carp-conditions
+	Status ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=ConditionStatus"`
+	// Last time we probed the condition.
+	// +optional
+	LastProbeTime metav1.Time `json:"lastProbeTime,omitempty" protobuf:"bytes,3,opt,name=lastProbeTime"`
+	// Last time the condition transitioned from one status to another.
+	// +optional
+	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,4,opt,name=lastTransitionTime"`
+	// Unique, one-word, CamelCase reason for the condition's last transition.
+	// +optional
+	Reason string `json:"reason,omitempty" protobuf:"bytes,5,opt,name=reason"`
+	// Human-readable message indicating details about last transition.
+	// +optional
+	Message string `json:"message,omitempty" protobuf:"bytes,6,opt,name=message"`
+}
+
+type CarpInfo struct {
+	// A is the first map key.
+	// +required
+	A int64 `json:"a" protobuf:"bytes,1,name=a"`
+	// B is the second map key.
+	// +required
+	B string `json:"b" protobuf:"bytes,2,name=b"`
+	// C is the third, optional map key
+	// +optional
+	C *string `json:"c,omitempty" protobuf:"bytes,4,opt,name=c"`
+
+	// Some data for each pair of A and B.
+	Data string `json:"data" protobuf:"bytes,3,name=data"`
+}
+
+// CarpSpec is a description of a carp
+type CarpSpec struct {
+	// Restart policy for all containers within the carp.
+	// One of Always, OnFailure, Never.
+	// Default to Always.
+	// More info: http://kubernetes.io/docs/user-guide/carp-states#restartpolicy
+	// +optional
+	RestartPolicy RestartPolicy `json:"restartPolicy,omitempty" protobuf:"bytes,3,opt,name=restartPolicy,casttype=RestartPolicy"`
+	// Optional duration in seconds the carp needs to terminate gracefully. May be decreased in delete request.
+	// Value must be non-negative integer. The value zero indicates delete immediately.
+	// If this value is nil, the default grace period will be used instead.
+	// The grace period is the duration in seconds after the processes running in the carp are sent
+	// a termination signal and the time when the processes are forcibly halted with a kill signal.
+	// Set this value longer than the expected cleanup time for your process.
+	// Defaults to 30 seconds.
+	// +optional
+	TerminationGracePeriodSeconds *int64 `json:"terminationGracePeriodSeconds,omitempty" protobuf:"varint,4,opt,name=terminationGracePeriodSeconds"`
+	// Optional duration in seconds the carp may be active on the node relative to
+	// StartTime before the system will actively try to mark it failed and kill associated containers.
+	// Value must be a positive integer.
+	// +optional
+	ActiveDeadlineSeconds *int64 `json:"activeDeadlineSeconds,omitempty" protobuf:"varint,5,opt,name=activeDeadlineSeconds"`
+	// NodeSelector is a selector which must be true for the carp to fit on a node.
+	// Selector which must match a node's labels for the carp to be scheduled on that node.
+	// More info: http://kubernetes.io/docs/user-guide/node-selection/README
+	// +optional
+	NodeSelector map[string]string `json:"nodeSelector,omitempty" protobuf:"bytes,7,rep,name=nodeSelector"`
+
+	// ServiceAccountName is the name of the ServiceAccount to use to run this carp.
+	// More info: https://kubernetes.io/docs/concepts/security/service-accounts/
+	// +optional
+	ServiceAccountName string `json:"serviceAccountName,omitempty" protobuf:"bytes,8,opt,name=serviceAccountName"`
+	// DeprecatedServiceAccount is a deprecated alias for ServiceAccountName.
+	// Deprecated: Use serviceAccountName instead.
+	// +k8s:conversion-gen=false
+	// +optional
+	DeprecatedServiceAccount string `json:"deprecatedServiceAccount,omitempty" protobuf:"bytes,9,opt,name=deprecatedServiceAccount"`
+
+	// NodeName is a request to schedule this carp onto a specific node. If it is non-empty,
+	// the scheduler simply schedules this carp onto that node, assuming that it fits resource
+	// requirements.
+	// +optional
+	NodeName string `json:"nodeName,omitempty" protobuf:"bytes,10,opt,name=nodeName"`
+	// Host networking requested for this carp. Use the host's network namespace.
+	// Default to false.
+	// +k8s:conversion-gen=false
+	// +optional
+	HostNetwork bool `json:"hostNetwork,omitempty" protobuf:"varint,11,opt,name=hostNetwork"`
+	// Use the host's pid namespace.
+	// Optional: Default to false.
+	// +k8s:conversion-gen=false
+	// +optional
+	HostPID bool `json:"hostPID,omitempty" protobuf:"varint,12,opt,name=hostPID"`
+	// Use the host's ipc namespace.
+	// Optional: Default to false.
+	// +k8s:conversion-gen=false
+	// +optional
+	HostIPC bool `json:"hostIPC,omitempty" protobuf:"varint,13,opt,name=hostIPC"`
+	// Specifies the hostname of the Carp
+	// If not specified, the carp's hostname will be set to a system-defined value.
+	// +optional
+	Hostname string `json:"hostname,omitempty" protobuf:"bytes,16,opt,name=hostname"`
+	// If specified, the fully qualified Carp hostname will be "<hostname>.<subdomain>.<carp namespace>.svc.<cluster domain>".
+	// If not specified, the carp will not have a domainname at all.
+	// +optional
+	Subdomain string `json:"subdomain,omitempty" protobuf:"bytes,17,opt,name=subdomain"`
+	// If specified, the carp will be dispatched by specified scheduler.
+	// If not specified, the carp will be dispatched by default scheduler.
+	// +optional
+	SchedulerName string `json:"schedulerName,omitempty" protobuf:"bytes,19,opt,name=schedulerName"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.1
+
+// CarpList is a list of Carps.
+type CarpList struct {
+	metav1.TypeMeta `json:""`
+	// Standard list metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// List of carps.
+	// More info: http://kubernetes.io/docs/user-guide/carps
+	Items []Carp `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.conversion.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.conversion.go
new file mode 100644
index 0000000000..92056d520b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.conversion.go
@@ -0,0 +1,274 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by conversion-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	unsafe "unsafe"
+
+	testapigroup "k8s.io/apimachinery/pkg/apis/testapigroup"
+	conversion "k8s.io/apimachinery/pkg/conversion"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+func init() {
+	localSchemeBuilder.Register(RegisterConversions)
+}
+
+// RegisterConversions adds conversion functions to the given scheme.
+// Public to allow building arbitrary schemes.
+func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddGeneratedConversionFunc((*Carp)(nil), (*testapigroup.Carp)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_Carp_To_testapigroup_Carp(a.(*Carp), b.(*testapigroup.Carp), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*testapigroup.Carp)(nil), (*Carp)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_testapigroup_Carp_To_v1_Carp(a.(*testapigroup.Carp), b.(*Carp), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*CarpCondition)(nil), (*testapigroup.CarpCondition)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_CarpCondition_To_testapigroup_CarpCondition(a.(*CarpCondition), b.(*testapigroup.CarpCondition), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*testapigroup.CarpCondition)(nil), (*CarpCondition)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_testapigroup_CarpCondition_To_v1_CarpCondition(a.(*testapigroup.CarpCondition), b.(*CarpCondition), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*CarpInfo)(nil), (*testapigroup.CarpInfo)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_CarpInfo_To_testapigroup_CarpInfo(a.(*CarpInfo), b.(*testapigroup.CarpInfo), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*testapigroup.CarpInfo)(nil), (*CarpInfo)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_testapigroup_CarpInfo_To_v1_CarpInfo(a.(*testapigroup.CarpInfo), b.(*CarpInfo), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*CarpList)(nil), (*testapigroup.CarpList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_CarpList_To_testapigroup_CarpList(a.(*CarpList), b.(*testapigroup.CarpList), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*testapigroup.CarpList)(nil), (*CarpList)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_testapigroup_CarpList_To_v1_CarpList(a.(*testapigroup.CarpList), b.(*CarpList), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*CarpSpec)(nil), (*testapigroup.CarpSpec)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_CarpSpec_To_testapigroup_CarpSpec(a.(*CarpSpec), b.(*testapigroup.CarpSpec), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*testapigroup.CarpSpec)(nil), (*CarpSpec)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_testapigroup_CarpSpec_To_v1_CarpSpec(a.(*testapigroup.CarpSpec), b.(*CarpSpec), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*CarpStatus)(nil), (*testapigroup.CarpStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_CarpStatus_To_testapigroup_CarpStatus(a.(*CarpStatus), b.(*testapigroup.CarpStatus), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*testapigroup.CarpStatus)(nil), (*CarpStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_testapigroup_CarpStatus_To_v1_CarpStatus(a.(*testapigroup.CarpStatus), b.(*CarpStatus), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+func autoConvert_v1_Carp_To_testapigroup_Carp(in *Carp, out *testapigroup.Carp, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_v1_CarpSpec_To_testapigroup_CarpSpec(&in.Spec, &out.Spec, s); err != nil {
+		return err
+	}
+	if err := Convert_v1_CarpStatus_To_testapigroup_CarpStatus(&in.Status, &out.Status, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_v1_Carp_To_testapigroup_Carp is an autogenerated conversion function.
+func Convert_v1_Carp_To_testapigroup_Carp(in *Carp, out *testapigroup.Carp, s conversion.Scope) error {
+	return autoConvert_v1_Carp_To_testapigroup_Carp(in, out, s)
+}
+
+func autoConvert_testapigroup_Carp_To_v1_Carp(in *testapigroup.Carp, out *Carp, s conversion.Scope) error {
+	out.ObjectMeta = in.ObjectMeta
+	if err := Convert_testapigroup_CarpSpec_To_v1_CarpSpec(&in.Spec, &out.Spec, s); err != nil {
+		return err
+	}
+	if err := Convert_testapigroup_CarpStatus_To_v1_CarpStatus(&in.Status, &out.Status, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Convert_testapigroup_Carp_To_v1_Carp is an autogenerated conversion function.
+func Convert_testapigroup_Carp_To_v1_Carp(in *testapigroup.Carp, out *Carp, s conversion.Scope) error {
+	return autoConvert_testapigroup_Carp_To_v1_Carp(in, out, s)
+}
+
+func autoConvert_v1_CarpCondition_To_testapigroup_CarpCondition(in *CarpCondition, out *testapigroup.CarpCondition, s conversion.Scope) error {
+	*out = *(*testapigroup.CarpCondition)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_v1_CarpCondition_To_testapigroup_CarpCondition is an autogenerated conversion function.
+func Convert_v1_CarpCondition_To_testapigroup_CarpCondition(in *CarpCondition, out *testapigroup.CarpCondition, s conversion.Scope) error {
+	return autoConvert_v1_CarpCondition_To_testapigroup_CarpCondition(in, out, s)
+}
+
+func autoConvert_testapigroup_CarpCondition_To_v1_CarpCondition(in *testapigroup.CarpCondition, out *CarpCondition, s conversion.Scope) error {
+	*out = *(*CarpCondition)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_testapigroup_CarpCondition_To_v1_CarpCondition is an autogenerated conversion function.
+func Convert_testapigroup_CarpCondition_To_v1_CarpCondition(in *testapigroup.CarpCondition, out *CarpCondition, s conversion.Scope) error {
+	return autoConvert_testapigroup_CarpCondition_To_v1_CarpCondition(in, out, s)
+}
+
+func autoConvert_v1_CarpInfo_To_testapigroup_CarpInfo(in *CarpInfo, out *testapigroup.CarpInfo, s conversion.Scope) error {
+	*out = *(*testapigroup.CarpInfo)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_v1_CarpInfo_To_testapigroup_CarpInfo is an autogenerated conversion function.
+func Convert_v1_CarpInfo_To_testapigroup_CarpInfo(in *CarpInfo, out *testapigroup.CarpInfo, s conversion.Scope) error {
+	return autoConvert_v1_CarpInfo_To_testapigroup_CarpInfo(in, out, s)
+}
+
+func autoConvert_testapigroup_CarpInfo_To_v1_CarpInfo(in *testapigroup.CarpInfo, out *CarpInfo, s conversion.Scope) error {
+	*out = *(*CarpInfo)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_testapigroup_CarpInfo_To_v1_CarpInfo is an autogenerated conversion function.
+func Convert_testapigroup_CarpInfo_To_v1_CarpInfo(in *testapigroup.CarpInfo, out *CarpInfo, s conversion.Scope) error {
+	return autoConvert_testapigroup_CarpInfo_To_v1_CarpInfo(in, out, s)
+}
+
+func autoConvert_v1_CarpList_To_testapigroup_CarpList(in *CarpList, out *testapigroup.CarpList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]testapigroup.Carp, len(*in))
+		for i := range *in {
+			if err := Convert_v1_Carp_To_testapigroup_Carp(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
+	return nil
+}
+
+// Convert_v1_CarpList_To_testapigroup_CarpList is an autogenerated conversion function.
+func Convert_v1_CarpList_To_testapigroup_CarpList(in *CarpList, out *testapigroup.CarpList, s conversion.Scope) error {
+	return autoConvert_v1_CarpList_To_testapigroup_CarpList(in, out, s)
+}
+
+func autoConvert_testapigroup_CarpList_To_v1_CarpList(in *testapigroup.CarpList, out *CarpList, s conversion.Scope) error {
+	out.ListMeta = in.ListMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Carp, len(*in))
+		for i := range *in {
+			if err := Convert_testapigroup_Carp_To_v1_Carp(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
+	return nil
+}
+
+// Convert_testapigroup_CarpList_To_v1_CarpList is an autogenerated conversion function.
+func Convert_testapigroup_CarpList_To_v1_CarpList(in *testapigroup.CarpList, out *CarpList, s conversion.Scope) error {
+	return autoConvert_testapigroup_CarpList_To_v1_CarpList(in, out, s)
+}
+
+func autoConvert_v1_CarpSpec_To_testapigroup_CarpSpec(in *CarpSpec, out *testapigroup.CarpSpec, s conversion.Scope) error {
+	out.RestartPolicy = testapigroup.RestartPolicy(in.RestartPolicy)
+	out.TerminationGracePeriodSeconds = (*int64)(unsafe.Pointer(in.TerminationGracePeriodSeconds))
+	out.ActiveDeadlineSeconds = (*int64)(unsafe.Pointer(in.ActiveDeadlineSeconds))
+	out.NodeSelector = *(*map[string]string)(unsafe.Pointer(&in.NodeSelector))
+	out.ServiceAccountName = in.ServiceAccountName
+	// INFO: in.DeprecatedServiceAccount opted out of conversion generation
+	out.NodeName = in.NodeName
+	// INFO: in.HostNetwork opted out of conversion generation
+	// INFO: in.HostPID opted out of conversion generation
+	// INFO: in.HostIPC opted out of conversion generation
+	out.Hostname = in.Hostname
+	out.Subdomain = in.Subdomain
+	out.SchedulerName = in.SchedulerName
+	return nil
+}
+
+// Convert_v1_CarpSpec_To_testapigroup_CarpSpec is an autogenerated conversion function.
+func Convert_v1_CarpSpec_To_testapigroup_CarpSpec(in *CarpSpec, out *testapigroup.CarpSpec, s conversion.Scope) error {
+	return autoConvert_v1_CarpSpec_To_testapigroup_CarpSpec(in, out, s)
+}
+
+func autoConvert_testapigroup_CarpSpec_To_v1_CarpSpec(in *testapigroup.CarpSpec, out *CarpSpec, s conversion.Scope) error {
+	out.RestartPolicy = RestartPolicy(in.RestartPolicy)
+	out.TerminationGracePeriodSeconds = (*int64)(unsafe.Pointer(in.TerminationGracePeriodSeconds))
+	out.ActiveDeadlineSeconds = (*int64)(unsafe.Pointer(in.ActiveDeadlineSeconds))
+	out.NodeSelector = *(*map[string]string)(unsafe.Pointer(&in.NodeSelector))
+	out.ServiceAccountName = in.ServiceAccountName
+	out.NodeName = in.NodeName
+	out.Hostname = in.Hostname
+	out.Subdomain = in.Subdomain
+	out.SchedulerName = in.SchedulerName
+	return nil
+}
+
+// Convert_testapigroup_CarpSpec_To_v1_CarpSpec is an autogenerated conversion function.
+func Convert_testapigroup_CarpSpec_To_v1_CarpSpec(in *testapigroup.CarpSpec, out *CarpSpec, s conversion.Scope) error {
+	return autoConvert_testapigroup_CarpSpec_To_v1_CarpSpec(in, out, s)
+}
+
+func autoConvert_v1_CarpStatus_To_testapigroup_CarpStatus(in *CarpStatus, out *testapigroup.CarpStatus, s conversion.Scope) error {
+	*out = *(*testapigroup.CarpStatus)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_v1_CarpStatus_To_testapigroup_CarpStatus is an autogenerated conversion function.
+func Convert_v1_CarpStatus_To_testapigroup_CarpStatus(in *CarpStatus, out *testapigroup.CarpStatus, s conversion.Scope) error {
+	return autoConvert_v1_CarpStatus_To_testapigroup_CarpStatus(in, out, s)
+}
+
+func autoConvert_testapigroup_CarpStatus_To_v1_CarpStatus(in *testapigroup.CarpStatus, out *CarpStatus, s conversion.Scope) error {
+	*out = *(*CarpStatus)(unsafe.Pointer(in))
+	return nil
+}
+
+// Convert_testapigroup_CarpStatus_To_v1_CarpStatus is an autogenerated conversion function.
+func Convert_testapigroup_CarpStatus_To_v1_CarpStatus(in *testapigroup.CarpStatus, out *CarpStatus, s conversion.Scope) error {
+	return autoConvert_testapigroup_CarpStatus_To_v1_CarpStatus(in, out, s)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.deepcopy.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..d5969b09fc
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.deepcopy.go
@@ -0,0 +1,193 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Carp) DeepCopyInto(out *Carp) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Carp.
+func (in *Carp) DeepCopy() *Carp {
+	if in == nil {
+		return nil
+	}
+	out := new(Carp)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Carp) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpCondition) DeepCopyInto(out *CarpCondition) {
+	*out = *in
+	in.LastProbeTime.DeepCopyInto(&out.LastProbeTime)
+	in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpCondition.
+func (in *CarpCondition) DeepCopy() *CarpCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpInfo) DeepCopyInto(out *CarpInfo) {
+	*out = *in
+	if in.C != nil {
+		in, out := &in.C, &out.C
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpInfo.
+func (in *CarpInfo) DeepCopy() *CarpInfo {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpInfo)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpList) DeepCopyInto(out *CarpList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Carp, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpList.
+func (in *CarpList) DeepCopy() *CarpList {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CarpList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpSpec) DeepCopyInto(out *CarpSpec) {
+	*out = *in
+	if in.TerminationGracePeriodSeconds != nil {
+		in, out := &in.TerminationGracePeriodSeconds, &out.TerminationGracePeriodSeconds
+		*out = new(int64)
+		**out = **in
+	}
+	if in.ActiveDeadlineSeconds != nil {
+		in, out := &in.ActiveDeadlineSeconds, &out.ActiveDeadlineSeconds
+		*out = new(int64)
+		**out = **in
+	}
+	if in.NodeSelector != nil {
+		in, out := &in.NodeSelector, &out.NodeSelector
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpSpec.
+func (in *CarpSpec) DeepCopy() *CarpSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpStatus) DeepCopyInto(out *CarpStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]CarpCondition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.StartTime != nil {
+		in, out := &in.StartTime, &out.StartTime
+		*out = (*in).DeepCopy()
+	}
+	if in.Infos != nil {
+		in, out := &in.Infos, &out.Infos
+		*out = make([]CarpInfo, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpStatus.
+func (in *CarpStatus) DeepCopy() *CarpStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.defaults.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.defaults.go
new file mode 100644
index 0000000000..dac177e93b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.defaults.go
@@ -0,0 +1,33 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by defaulter-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// RegisterDefaults adds defaulters functions to the given scheme.
+// Public to allow building arbitrary schemes.
+// All generated defaulters are covering - they call all nested defaulters.
+func RegisterDefaults(scheme *runtime.Scheme) error {
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.model_name.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.model_name.go
new file mode 100644
index 0000000000..38ee899cb9
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.model_name.go
@@ -0,0 +1,52 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package v1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Carp) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.testapigroup.v1.Carp"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CarpCondition) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.testapigroup.v1.CarpCondition"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CarpInfo) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.testapigroup.v1.CarpInfo"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CarpList) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.testapigroup.v1.CarpList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CarpSpec) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.testapigroup.v1.CarpSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CarpStatus) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.apis.testapigroup.v1.CarpStatus"
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.prerelease-lifecycle.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.prerelease-lifecycle.go
new file mode 100644
index 0000000000..7cd1cf2592
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/v1/zz_generated.prerelease-lifecycle.go
@@ -0,0 +1,34 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by prerelease-lifecycle-gen. DO NOT EDIT.
+
+package v1
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *Carp) APILifecycleIntroduced() (major, minor int) {
+	return 1, 1
+}
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *CarpList) APILifecycleIntroduced() (major, minor int) {
+	return 1, 1
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/zz_generated.deepcopy.go b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..a44dcfe14e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/apis/testapigroup/zz_generated.deepcopy.go
@@ -0,0 +1,193 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package testapigroup
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Carp) DeepCopyInto(out *Carp) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Carp.
+func (in *Carp) DeepCopy() *Carp {
+	if in == nil {
+		return nil
+	}
+	out := new(Carp)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Carp) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpCondition) DeepCopyInto(out *CarpCondition) {
+	*out = *in
+	in.LastProbeTime.DeepCopyInto(&out.LastProbeTime)
+	in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpCondition.
+func (in *CarpCondition) DeepCopy() *CarpCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpInfo) DeepCopyInto(out *CarpInfo) {
+	*out = *in
+	if in.C != nil {
+		in, out := &in.C, &out.C
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpInfo.
+func (in *CarpInfo) DeepCopy() *CarpInfo {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpInfo)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpList) DeepCopyInto(out *CarpList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Carp, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpList.
+func (in *CarpList) DeepCopy() *CarpList {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CarpList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpSpec) DeepCopyInto(out *CarpSpec) {
+	*out = *in
+	if in.TerminationGracePeriodSeconds != nil {
+		in, out := &in.TerminationGracePeriodSeconds, &out.TerminationGracePeriodSeconds
+		*out = new(int64)
+		**out = **in
+	}
+	if in.ActiveDeadlineSeconds != nil {
+		in, out := &in.ActiveDeadlineSeconds, &out.ActiveDeadlineSeconds
+		*out = new(int64)
+		**out = **in
+	}
+	if in.NodeSelector != nil {
+		in, out := &in.NodeSelector, &out.NodeSelector
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpSpec.
+func (in *CarpSpec) DeepCopy() *CarpSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpStatus) DeepCopyInto(out *CarpStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]CarpCondition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.StartTime != nil {
+		in, out := &in.StartTime, &out.StartTime
+		*out = (*in).DeepCopy()
+	}
+	if in.Infos != nil {
+		in, out := &in.Infos, &out.Infos
+		*out = make([]CarpInfo, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpStatus.
+func (in *CarpStatus) DeepCopy() *CarpStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/conversion/converter.go b/third_party/k8s.io/apimachinery/pkg/conversion/converter.go
new file mode 100644
index 0000000000..76b76247c7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/conversion/converter.go
@@ -0,0 +1,225 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package conversion
+
+import (
+	"fmt"
+	"reflect"
+)
+
+type typePair struct {
+	source reflect.Type
+	dest   reflect.Type
+}
+
+type NameFunc func(t reflect.Type) string
+
+var DefaultNameFunc = func(t reflect.Type) string { return t.Name() }
+
+// ConversionFunc converts the object a into the object b, reusing arrays or objects
+// or pointers if necessary. It should return an error if the object cannot be converted
+// or if some data is invalid. If you do not wish a and b to share fields or nested
+// objects, you must copy a before calling this function.
+type ConversionFunc func(a, b interface{}, scope Scope) error
+
+// Converter knows how to convert one type to another.
+type Converter struct {
+	// Map from the conversion pair to a function which can
+	// do the conversion.
+	conversionFuncs          ConversionFuncs
+	generatedConversionFuncs ConversionFuncs
+
+	// Set of conversions that should be treated as a no-op
+	ignoredUntypedConversions map[typePair]struct{}
+}
+
+// NewConverter creates a new Converter object.
+// Arg NameFunc is just for backward compatibility.
+func NewConverter(NameFunc) *Converter {
+	c := &Converter{
+		conversionFuncs:           NewConversionFuncs(),
+		generatedConversionFuncs:  NewConversionFuncs(),
+		ignoredUntypedConversions: make(map[typePair]struct{}),
+	}
+	c.RegisterUntypedConversionFunc(
+		(*[]byte)(nil), (*[]byte)(nil),
+		func(a, b interface{}, s Scope) error {
+			return Convert_Slice_byte_To_Slice_byte(a.(*[]byte), b.(*[]byte), s)
+		},
+	)
+	return c
+}
+
+// WithConversions returns a Converter that is a copy of c but with the additional
+// fns merged on top.
+func (c *Converter) WithConversions(fns ConversionFuncs) *Converter {
+	copied := *c
+	copied.conversionFuncs = c.conversionFuncs.Merge(fns)
+	return &copied
+}
+
+// DefaultMeta returns meta for a given type.
+func (c *Converter) DefaultMeta(t reflect.Type) *Meta {
+	return &Meta{}
+}
+
+// Convert_Slice_byte_To_Slice_byte prevents recursing into every byte
+func Convert_Slice_byte_To_Slice_byte(in *[]byte, out *[]byte, s Scope) error {
+	if *in == nil {
+		*out = nil
+		return nil
+	}
+	*out = make([]byte, len(*in))
+	copy(*out, *in)
+	return nil
+}
+
+// Scope is passed to conversion funcs to allow them to continue an ongoing conversion.
+// If multiple converters exist in the system, Scope will allow you to use the correct one
+// from a conversion function--that is, the one your conversion function was called by.
+type Scope interface {
+	// Call Convert to convert sub-objects. Note that if you call it with your own exact
+	// parameters, you'll run out of stack space before anything useful happens.
+	Convert(src, dest interface{}) error
+
+	// Meta returns any information originally passed to Convert.
+	Meta() *Meta
+}
+
+func NewConversionFuncs() ConversionFuncs {
+	return ConversionFuncs{
+		untyped: make(map[typePair]ConversionFunc),
+	}
+}
+
+type ConversionFuncs struct {
+	untyped map[typePair]ConversionFunc
+}
+
+// AddUntyped adds the provided conversion function to the lookup table for the types that are
+// supplied as a and b. a and b must be pointers or an error is returned. This method overwrites
+// previously defined functions.
+func (c ConversionFuncs) AddUntyped(a, b interface{}, fn ConversionFunc) error {
+	tA, tB := reflect.TypeOf(a), reflect.TypeOf(b)
+	if tA.Kind() != reflect.Pointer {
+		return fmt.Errorf("the type %T must be a pointer to register as an untyped conversion", a)
+	}
+	if tB.Kind() != reflect.Pointer {
+		return fmt.Errorf("the type %T must be a pointer to register as an untyped conversion", b)
+	}
+	c.untyped[typePair{tA, tB}] = fn
+	return nil
+}
+
+// Merge returns a new ConversionFuncs that contains all conversions from
+// both other and c, with other conversions taking precedence.
+func (c ConversionFuncs) Merge(other ConversionFuncs) ConversionFuncs {
+	merged := NewConversionFuncs()
+	for k, v := range c.untyped {
+		merged.untyped[k] = v
+	}
+	for k, v := range other.untyped {
+		merged.untyped[k] = v
+	}
+	return merged
+}
+
+// Meta is supplied by Scheme, when it calls Convert.
+type Meta struct {
+	// Context is an optional field that callers may use to pass info to conversion functions.
+	Context interface{}
+}
+
+// scope contains information about an ongoing conversion.
+type scope struct {
+	converter *Converter
+	meta      *Meta
+}
+
+// Convert continues a conversion.
+func (s *scope) Convert(src, dest interface{}) error {
+	return s.converter.Convert(src, dest, s.meta)
+}
+
+// Meta returns the meta object that was originally passed to Convert.
+func (s *scope) Meta() *Meta {
+	return s.meta
+}
+
+// RegisterUntypedConversionFunc registers a function that converts between a and b by passing objects of those
+// types to the provided function. The function *must* accept objects of a and b - this machinery will not enforce
+// any other guarantee.
+func (c *Converter) RegisterUntypedConversionFunc(a, b interface{}, fn ConversionFunc) error {
+	return c.conversionFuncs.AddUntyped(a, b, fn)
+}
+
+// RegisterGeneratedUntypedConversionFunc registers a function that converts between a and b by passing objects of those
+// types to the provided function. The function *must* accept objects of a and b - this machinery will not enforce
+// any other guarantee.
+func (c *Converter) RegisterGeneratedUntypedConversionFunc(a, b interface{}, fn ConversionFunc) error {
+	return c.generatedConversionFuncs.AddUntyped(a, b, fn)
+}
+
+// RegisterIgnoredConversion registers a "no-op" for conversion, where any requested
+// conversion between from and to is ignored.
+func (c *Converter) RegisterIgnoredConversion(from, to interface{}) error {
+	typeFrom := reflect.TypeOf(from)
+	typeTo := reflect.TypeOf(to)
+	if typeFrom.Kind() != reflect.Pointer {
+		return fmt.Errorf("expected pointer arg for 'from' param 0, got: %v", typeFrom)
+	}
+	if typeTo.Kind() != reflect.Pointer {
+		return fmt.Errorf("expected pointer arg for 'to' param 1, got: %v", typeTo)
+	}
+	c.ignoredUntypedConversions[typePair{typeFrom, typeTo}] = struct{}{}
+	return nil
+}
+
+// Convert will translate src to dest if it knows how. Both must be pointers.
+// If no conversion func is registered and the default copying mechanism
+// doesn't work on this type pair, an error will be returned.
+// 'meta' is given to allow you to pass information to conversion functions,
+// it is not used by Convert() other than storing it in the scope.
+// Not safe for objects with cyclic references!
+func (c *Converter) Convert(src, dest interface{}, meta *Meta) error {
+	pair := typePair{reflect.TypeOf(src), reflect.TypeOf(dest)}
+	scope := &scope{
+		converter: c,
+		meta:      meta,
+	}
+
+	// ignore conversions of this type
+	if _, ok := c.ignoredUntypedConversions[pair]; ok {
+		return nil
+	}
+	if fn, ok := c.conversionFuncs.untyped[pair]; ok {
+		return fn(src, dest, scope)
+	}
+	if fn, ok := c.generatedConversionFuncs.untyped[pair]; ok {
+		return fn(src, dest, scope)
+	}
+
+	dv, err := EnforcePtr(dest)
+	if err != nil {
+		return err
+	}
+	sv, err := EnforcePtr(src)
+	if err != nil {
+		return err
+	}
+	return fmt.Errorf("converting (%s) to (%s): unknown conversion", sv.Type(), dv.Type())
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/conversion/converter_test.go b/third_party/k8s.io/apimachinery/pkg/conversion/converter_test.go
new file mode 100644
index 0000000000..584068772f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/conversion/converter_test.go
@@ -0,0 +1,287 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package conversion
+
+import (
+	"fmt"
+	"reflect"
+	"strconv"
+	"testing"
+)
+
+func TestConverter_byteSlice(t *testing.T) {
+	c := NewConverter(nil)
+	src := []byte{1, 2, 3}
+	dest := []byte{}
+	err := c.Convert(&src, &dest, nil)
+	if err != nil {
+		t.Fatalf("expected no error")
+	}
+	if e, a := src, dest; !reflect.DeepEqual(e, a) {
+		t.Errorf("expected %#v, got %#v", e, a)
+	}
+}
+
+func TestConverter_MismatchedTypes(t *testing.T) {
+	c := NewConverter(nil)
+
+	convertFn := func(in *[]string, out *int, s Scope) error {
+		if str, err := strconv.Atoi((*in)[0]); err != nil {
+			return err
+		} else {
+			*out = str
+			return nil
+		}
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*[]string)(nil), (*int)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn(a.(*[]string), b.(*int), s)
+		},
+	); err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	src := []string{"5"}
+	var dest int
+	if err := c.Convert(&src, &dest, nil); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if e, a := 5, dest; e != a {
+		t.Errorf("expected %#v, got %#v", e, a)
+	}
+}
+
+func TestConverter_CallsRegisteredFunctions(t *testing.T) {
+	type A struct {
+		Foo string
+		Baz int
+	}
+	type B struct {
+		Bar string
+		Baz int
+	}
+	type C struct{}
+	c := NewConverter(nil)
+	convertFn1 := func(in *A, out *B, s Scope) error {
+		out.Bar = in.Foo
+		out.Baz = in.Baz
+		return nil
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*A)(nil), (*B)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn1(a.(*A), b.(*B), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	convertFn2 := func(in *B, out *A, s Scope) error {
+		out.Foo = in.Bar
+		out.Baz = in.Baz
+		return nil
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*B)(nil), (*A)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn2(a.(*B), b.(*A), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	x := A{"hello, intrepid test reader!", 3}
+	y := B{}
+
+	if err := c.Convert(&x, &y, nil); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	if e, a := x.Foo, y.Bar; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := x.Baz, y.Baz; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+
+	z := B{"all your test are belong to us", 42}
+	w := A{}
+
+	if err := c.Convert(&z, &w, nil); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	if e, a := z.Bar, w.Foo; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := z.Baz, w.Baz; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+
+	convertFn3 := func(in *A, out *C, s Scope) error {
+		return fmt.Errorf("C can't store an A, silly")
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*A)(nil), (*C)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn3(a.(*A), b.(*C), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	if err := c.Convert(&A{}, &C{}, nil); err == nil {
+		t.Errorf("unexpected non-error")
+	}
+}
+
+func TestConverter_IgnoredConversion(t *testing.T) {
+	type A struct{}
+	type B struct{}
+
+	count := 0
+	c := NewConverter(nil)
+	convertFn := func(in *A, out *B, s Scope) error {
+		count++
+		return nil
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*A)(nil), (*B)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn(a.(*A), b.(*B), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	if err := c.RegisterIgnoredConversion(&A{}, &B{}); err != nil {
+		t.Fatal(err)
+	}
+	a := A{}
+	b := B{}
+	if err := c.Convert(&a, &b, nil); err != nil {
+		t.Errorf("%v", err)
+	}
+	if count != 0 {
+		t.Errorf("unexpected number of conversion invocations")
+	}
+}
+
+func TestConverter_GeneratedConversionOverridden(t *testing.T) {
+	type A struct{}
+	type B struct{}
+	c := NewConverter(nil)
+	convertFn1 := func(in *A, out *B, s Scope) error {
+		return nil
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*A)(nil), (*B)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn1(a.(*A), b.(*B), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	convertFn2 := func(in *A, out *B, s Scope) error {
+		return fmt.Errorf("generated function should be overridden")
+	}
+	if err := c.RegisterGeneratedUntypedConversionFunc(
+		(*A)(nil), (*B)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn2(a.(*A), b.(*B), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	a := A{}
+	b := B{}
+	if err := c.Convert(&a, &b, nil); err != nil {
+		t.Errorf("%v", err)
+	}
+}
+
+func TestConverter_WithConversionOverridden(t *testing.T) {
+	type A struct{}
+	type B struct{}
+	c := NewConverter(nil)
+	convertFn1 := func(in *A, out *B, s Scope) error {
+		return fmt.Errorf("conversion function should be overridden")
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*A)(nil), (*B)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn1(a.(*A), b.(*B), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	convertFn2 := func(in *A, out *B, s Scope) error {
+		return fmt.Errorf("generated function should be overridden")
+	}
+	if err := c.RegisterGeneratedUntypedConversionFunc(
+		(*A)(nil), (*B)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn2(a.(*A), b.(*B), s)
+		},
+	); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	ext := NewConversionFuncs()
+	ext.AddUntyped(
+		(*A)(nil), (*B)(nil),
+		func(a, b interface{}, s Scope) error {
+			return nil
+		},
+	)
+	newc := c.WithConversions(ext)
+
+	a := A{}
+	b := B{}
+	if err := c.Convert(&a, &b, nil); err == nil || err.Error() != "conversion function should be overridden" {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if err := newc.Convert(&a, &b, nil); err != nil {
+		t.Errorf("%v", err)
+	}
+}
+
+func TestConverter_meta(t *testing.T) {
+	type Foo struct{ A string }
+	type Bar struct{ A string }
+	c := NewConverter(nil)
+	checks := 0
+	convertFn1 := func(in *Foo, out *Bar, s Scope) error {
+		if s.Meta() == nil {
+			t.Errorf("Meta did not get passed!")
+		}
+		checks++
+		out.A = in.A
+		return nil
+	}
+	if err := c.RegisterUntypedConversionFunc(
+		(*Foo)(nil), (*Bar)(nil),
+		func(a, b interface{}, s Scope) error {
+			return convertFn1(a.(*Foo), b.(*Bar), s)
+		},
+	); err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	if err := c.Convert(&Foo{}, &Bar{}, &Meta{}); err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	if checks != 1 {
+		t.Errorf("Registered functions did not get called.")
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/conversion/deep_equal.go b/third_party/k8s.io/apimachinery/pkg/conversion/deep_equal.go
new file mode 100644
index 0000000000..25b2923f22
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/conversion/deep_equal.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package conversion
+
+import (
+	"k8s.io/apimachinery/third_party/forked/golang/reflect"
+)
+
+// The code for this type must be located in third_party, since it forks from
+// go std lib. But for convenience, we expose the type here, too.
+type Equalities struct {
+	reflect.Equalities
+}
+
+// For convenience, panics on errors
+func EqualitiesOrDie(funcs ...interface{}) Equalities {
+	e := Equalities{reflect.Equalities{}}
+	if err := e.AddFuncs(funcs...); err != nil {
+		panic(err)
+	}
+	return e
+}
+
+// Performs a shallow copy of the equalities map
+func (e Equalities) Copy() Equalities {
+	result := Equalities{reflect.Equalities{}}
+
+	for key, value := range e.Equalities {
+		result.Equalities[key] = value
+	}
+
+	return result
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/conversion/doc.go b/third_party/k8s.io/apimachinery/pkg/conversion/doc.go
new file mode 100644
index 0000000000..0c46ef2d16
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/conversion/doc.go
@@ -0,0 +1,24 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package conversion provides go object versioning.
+//
+// Specifically, conversion provides a way for you to define multiple versions
+// of the same object. You may write functions which implement conversion logic,
+// but for the fields which did not change, copying is automated. This makes it
+// easy to modify the structures you use in memory without affecting the format
+// you store on disk or respond to in your external API calls.
+package conversion
diff --git a/third_party/k8s.io/apimachinery/pkg/conversion/helper.go b/third_party/k8s.io/apimachinery/pkg/conversion/helper.go
new file mode 100644
index 0000000000..7fadd27a46
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/conversion/helper.go
@@ -0,0 +1,39 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package conversion
+
+import (
+	"fmt"
+	"reflect"
+)
+
+// EnforcePtr ensures that obj is a pointer of some sort. Returns a reflect.Value
+// of the dereferenced pointer, ensuring that it is settable/addressable.
+// Returns an error if this is not possible.
+func EnforcePtr(obj interface{}) (reflect.Value, error) {
+	v := reflect.ValueOf(obj)
+	if v.Kind() != reflect.Pointer {
+		if v.Kind() == reflect.Invalid {
+			return reflect.Value{}, fmt.Errorf("expected pointer, but got invalid kind")
+		}
+		return reflect.Value{}, fmt.Errorf("expected pointer, but got %v type", v.Type())
+	}
+	if v.IsNil() {
+		return reflect.Value{}, fmt.Errorf("expected pointer, but got nil")
+	}
+	return v.Elem(), nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/conversion/helper_test.go b/third_party/k8s.io/apimachinery/pkg/conversion/helper_test.go
new file mode 100644
index 0000000000..8c61a30a88
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/conversion/helper_test.go
@@ -0,0 +1,38 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package conversion
+
+import "testing"
+
+func TestInvalidPtrValueKind(t *testing.T) {
+	var simple interface{}
+	switch obj := simple.(type) {
+	default:
+		_, err := EnforcePtr(obj)
+		if err == nil {
+			t.Errorf("Expected error on invalid kind")
+		}
+	}
+}
+
+func TestEnforceNilPtr(t *testing.T) {
+	var nilPtr *struct{}
+	_, err := EnforcePtr(nilPtr)
+	if err == nil {
+		t.Errorf("Expected error on nil pointer")
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/convert.go b/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/convert.go
new file mode 100644
index 0000000000..5eb25e2e80
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/convert.go
@@ -0,0 +1,194 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package queryparams
+
+import (
+	"fmt"
+	"net/url"
+	"reflect"
+	"strings"
+)
+
+// Marshaler converts an object to a query parameter string representation
+type Marshaler interface {
+	MarshalQueryParameter() (string, error)
+}
+
+// Unmarshaler converts a string representation to an object
+type Unmarshaler interface {
+	UnmarshalQueryParameter(string) error
+}
+
+func jsonTag(field reflect.StructField) (string, bool) {
+	structTag, exists := field.Tag.Lookup("json")
+	if !exists || len(structTag) == 0 {
+		return "", false
+	}
+	parts := strings.Split(structTag, ",")
+	tag := parts[0]
+	if tag == "-" {
+		tag = ""
+	}
+	omitempty := false
+	parts = parts[1:]
+	for _, part := range parts {
+		if part == "omitempty" {
+			omitempty = true
+			break
+		}
+	}
+	return tag, omitempty
+}
+
+func isPointerKind(kind reflect.Kind) bool {
+	return kind == reflect.Pointer
+}
+
+func isStructKind(kind reflect.Kind) bool {
+	return kind == reflect.Struct
+}
+
+func isValueKind(kind reflect.Kind) bool {
+	switch kind {
+	case reflect.String, reflect.Bool, reflect.Int, reflect.Int8, reflect.Int16,
+		reflect.Int32, reflect.Int64, reflect.Uint, reflect.Uint8,
+		reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Float32,
+		reflect.Float64, reflect.Complex64, reflect.Complex128:
+		return true
+	default:
+		return false
+	}
+}
+
+func zeroValue(value reflect.Value) bool {
+	return reflect.DeepEqual(reflect.Zero(value.Type()).Interface(), value.Interface())
+}
+
+func customMarshalValue(value reflect.Value) (reflect.Value, bool) {
+	// Return unless we implement a custom query marshaler
+	if !value.CanInterface() {
+		return reflect.Value{}, false
+	}
+
+	marshaler, ok := value.Interface().(Marshaler)
+	if !ok {
+		if !isPointerKind(value.Kind()) && value.CanAddr() {
+			marshaler, ok = value.Addr().Interface().(Marshaler)
+			if !ok {
+				return reflect.Value{}, false
+			}
+		} else {
+			return reflect.Value{}, false
+		}
+	}
+
+	// Don't invoke functions on nil pointers
+	// If the type implements MarshalQueryParameter, AND the tag is not omitempty, AND the value is a nil pointer, "" seems like a reasonable response
+	if isPointerKind(value.Kind()) && zeroValue(value) {
+		return reflect.ValueOf(""), true
+	}
+
+	// Get the custom marshalled value
+	v, err := marshaler.MarshalQueryParameter()
+	if err != nil {
+		return reflect.Value{}, false
+	}
+	return reflect.ValueOf(v), true
+}
+
+func addParam(values url.Values, tag string, omitempty bool, value reflect.Value) {
+	if omitempty && zeroValue(value) {
+		return
+	}
+	val := ""
+	iValue := fmt.Sprintf("%v", value.Interface())
+
+	if iValue != "<nil>" {
+		val = iValue
+	}
+	values.Add(tag, val)
+}
+
+func addListOfParams(values url.Values, tag string, omitempty bool, list reflect.Value) {
+	for i := 0; i < list.Len(); i++ {
+		addParam(values, tag, omitempty, list.Index(i))
+	}
+}
+
+// Convert takes an object and converts it to a url.Values object using JSON tags as
+// parameter names. Only top-level simple values, arrays, and slices are serialized.
+// Embedded structs, maps, etc. will not be serialized.
+func Convert(obj interface{}) (url.Values, error) {
+	result := url.Values{}
+	if obj == nil {
+		return result, nil
+	}
+	var sv reflect.Value
+	switch reflect.TypeOf(obj).Kind() {
+	case reflect.Pointer, reflect.Interface:
+		sv = reflect.ValueOf(obj).Elem()
+	default:
+		return nil, fmt.Errorf("expecting a pointer or interface")
+	}
+	st := sv.Type()
+	if !isStructKind(st.Kind()) {
+		return nil, fmt.Errorf("expecting a pointer to a struct")
+	}
+
+	// Check all object fields
+	convertStruct(result, st, sv)
+
+	return result, nil
+}
+
+func convertStruct(result url.Values, st reflect.Type, sv reflect.Value) {
+	for i := 0; i < st.NumField(); i++ {
+		field := sv.Field(i)
+		tag, omitempty := jsonTag(st.Field(i))
+		if len(tag) == 0 {
+			continue
+		}
+		ft := field.Type()
+
+		kind := ft.Kind()
+		if isPointerKind(kind) {
+			ft = ft.Elem()
+			kind = ft.Kind()
+			if !field.IsNil() {
+				field = reflect.Indirect(field)
+				// If the field is non-nil, it should be added to params
+				// and the omitempty should be overwite to false
+				omitempty = false
+			}
+		}
+
+		switch {
+		case isValueKind(kind):
+			addParam(result, tag, omitempty, field)
+		case kind == reflect.Array || kind == reflect.Slice:
+			if isValueKind(ft.Elem().Kind()) {
+				addListOfParams(result, tag, omitempty, field)
+			}
+		case isStructKind(kind) && !(zeroValue(field) && omitempty):
+			if marshalValue, ok := customMarshalValue(field); ok {
+				addParam(result, tag, omitempty, marshalValue)
+			} else {
+				convertStruct(result, ft, field)
+			}
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/convert_test.go b/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/convert_test.go
new file mode 100644
index 0000000000..a9b9385ced
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/convert_test.go
@@ -0,0 +1,216 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package queryparams_test
+
+import (
+	"net/url"
+	"reflect"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion/queryparams"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/utils/ptr"
+)
+
+type namedString string
+type namedBool bool
+
+type bar struct {
+	Float1   float32 `json:"float1"`
+	Float2   float64 `json:"float2"`
+	Int1     int64   `json:"int1,omitempty"`
+	Int2     int32   `json:"int2,omitempty"`
+	Int3     int16   `json:"int3,omitempty"`
+	Str1     string  `json:"str1,omitempty"`
+	Ignored  int
+	Ignored2 string
+}
+
+func (obj *bar) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+type foo struct {
+	Str       string            `json:"str"`
+	Integer   int               `json:"integer,omitempty"`
+	Slice     []string          `json:"slice,omitempty"`
+	Boolean   bool              `json:"boolean,omitempty"`
+	NamedStr  namedString       `json:"namedStr,omitempty"`
+	NamedBool namedBool         `json:"namedBool,omitempty"`
+	Foobar    bar               `json:"foobar,omitempty"`
+	Testmap   map[string]string `json:"testmap,omitempty"`
+}
+
+func (obj *foo) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+type baz struct {
+	Ptr  *int  `json:"ptr"`
+	Bptr *bool `json:"bptr,omitempty"`
+}
+
+func (obj *baz) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+// childStructs tests some of the types we serialize to query params for log API calls
+// notably, the nested time struct
+type childStructs struct {
+	Container      string       `json:"container,omitempty"`
+	Follow         bool         `json:"follow,omitempty"`
+	Previous       bool         `json:"previous,omitempty"`
+	SinceSeconds   *int64       `json:"sinceSeconds,omitempty"`
+	TailLines      *int64       `json:"tailLines,omitempty"`
+	SinceTime      *metav1.Time `json:"sinceTime,omitempty"`
+	EmptyTime      *metav1.Time `json:"emptyTime"`
+	NonPointerTime metav1.Time  `json:"nonPointerTime"`
+}
+
+func (obj *childStructs) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+func validateResult(t *testing.T, input interface{}, actual, expected url.Values) {
+	local := url.Values{}
+	for k, v := range expected {
+		local[k] = v
+	}
+	for k, v := range actual {
+		if ev, ok := local[k]; !ok || !reflect.DeepEqual(ev, v) {
+			if !ok {
+				t.Errorf("%#v: actual value key %s not found in expected map", input, k)
+			} else {
+				t.Errorf("%#v: values don't match: actual: %#v, expected: %#v", input, v, ev)
+			}
+		}
+		delete(local, k)
+	}
+	if len(local) > 0 {
+		t.Errorf("%#v: expected map has keys that were not found in actual map: %#v", input, local)
+	}
+}
+
+func TestConvert(t *testing.T) {
+	sinceSeconds := int64(123)
+	tailLines := int64(0)
+	sinceTime := metav1.Date(2000, 1, 1, 12, 34, 56, 0, time.UTC)
+
+	tests := []struct {
+		input    interface{}
+		expected url.Values
+	}{
+		{
+			input: &foo{
+				Str: "hello",
+			},
+			expected: url.Values{"str": {"hello"}},
+		},
+		{
+			input: &foo{
+				Str:     "test string",
+				Slice:   []string{"one", "two", "three"},
+				Integer: 234,
+				Boolean: true,
+			},
+			expected: url.Values{"str": {"test string"}, "slice": {"one", "two", "three"}, "integer": {"234"}, "boolean": {"true"}},
+		},
+		{
+			input: &foo{
+				Str:       "named types",
+				NamedStr:  "value1",
+				NamedBool: true,
+			},
+			expected: url.Values{"str": {"named types"}, "namedStr": {"value1"}, "namedBool": {"true"}},
+		},
+		{
+			input: &foo{
+				Str: "don't ignore embedded struct",
+				Foobar: bar{
+					Float1: 5.0,
+				},
+			},
+			expected: url.Values{"str": {"don't ignore embedded struct"}, "float1": {"5"}, "float2": {"0"}},
+		},
+		{
+			// Ignore untagged fields
+			input: &bar{
+				Float1:   23.5,
+				Float2:   100.7,
+				Int1:     1,
+				Int2:     2,
+				Int3:     3,
+				Ignored:  1,
+				Ignored2: "ignored",
+			},
+			expected: url.Values{"float1": {"23.5"}, "float2": {"100.7"}, "int1": {"1"}, "int2": {"2"}, "int3": {"3"}},
+		},
+		{
+			// include fields that are not tagged omitempty
+			input: &foo{
+				NamedStr: "named str",
+			},
+			expected: url.Values{"str": {""}, "namedStr": {"named str"}},
+		},
+		{
+			input: &baz{
+				Ptr:  ptr.To(5),
+				Bptr: ptr.To(true),
+			},
+			expected: url.Values{"ptr": {"5"}, "bptr": {"true"}},
+		},
+		{
+			input: &baz{
+				Bptr: ptr.To(true),
+			},
+			expected: url.Values{"ptr": {""}, "bptr": {"true"}},
+		},
+		{
+			input: &baz{
+				Ptr: ptr.To(5),
+			},
+			expected: url.Values{"ptr": {"5"}},
+		},
+		{
+			input: &childStructs{
+				Container:      "mycontainer",
+				Follow:         true,
+				Previous:       true,
+				SinceSeconds:   &sinceSeconds,
+				TailLines:      nil,
+				SinceTime:      &sinceTime, // test a custom marshaller
+				EmptyTime:      nil,        // test a nil custom marshaller without omitempty
+				NonPointerTime: sinceTime,
+			},
+			expected: url.Values{"container": {"mycontainer"}, "follow": {"true"}, "previous": {"true"}, "sinceSeconds": {"123"}, "sinceTime": {"2000-01-01T12:34:56Z"}, "emptyTime": {""}, "nonPointerTime": {"2000-01-01T12:34:56Z"}},
+		},
+		{
+			input: &childStructs{
+				Container:      "mycontainer",
+				Follow:         true,
+				Previous:       true,
+				SinceSeconds:   &sinceSeconds,
+				TailLines:      &tailLines,
+				SinceTime:      nil, // test a nil custom marshaller with omitempty
+				NonPointerTime: sinceTime,
+			},
+			expected: url.Values{"container": {"mycontainer"}, "follow": {"true"}, "previous": {"true"}, "sinceSeconds": {"123"}, "tailLines": {"0"}, "emptyTime": {""}, "nonPointerTime": {"2000-01-01T12:34:56Z"}},
+		},
+	}
+
+	for _, test := range tests {
+		result, err := queryparams.Convert(test.input)
+		if err != nil {
+			t.Errorf("Unexpected error while converting %#v: %v", test.input, err)
+		}
+		validateResult(t, test.input, result, test.expected)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/doc.go b/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/doc.go
new file mode 100644
index 0000000000..4c1002a4c1
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/conversion/queryparams/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package queryparams provides conversion from versioned
+// runtime objects to URL query values
+package queryparams
diff --git a/third_party/k8s.io/apimachinery/pkg/fields/doc.go b/third_party/k8s.io/apimachinery/pkg/fields/doc.go
new file mode 100644
index 0000000000..49059e2635
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/fields/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package fields implements a simple field system, parsing and matching
+// selectors with sets of fields.
+package fields
diff --git a/third_party/k8s.io/apimachinery/pkg/fields/fields.go b/third_party/k8s.io/apimachinery/pkg/fields/fields.go
new file mode 100644
index 0000000000..623b27e957
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/fields/fields.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fields
+
+import (
+	"sort"
+	"strings"
+)
+
+// Fields allows you to present fields independently from their storage.
+type Fields interface {
+	// Has returns whether the provided field exists.
+	Has(field string) (exists bool)
+
+	// Get returns the value for the provided field.
+	Get(field string) (value string)
+}
+
+// Set is a map of field:value. It implements Fields.
+type Set map[string]string
+
+// String returns all fields listed as a human readable string.
+// Conveniently, exactly the format that ParseSelector takes.
+func (ls Set) String() string {
+	selector := make([]string, 0, len(ls))
+	for key, value := range ls {
+		selector = append(selector, key+"="+value)
+	}
+	// Sort for determinism.
+	sort.StringSlice(selector).Sort()
+	return strings.Join(selector, ",")
+}
+
+// Has returns whether the provided field exists in the map.
+func (ls Set) Has(field string) bool {
+	_, exists := ls[field]
+	return exists
+}
+
+// Get returns the value in the map for the provided field.
+func (ls Set) Get(field string) string {
+	return ls[field]
+}
+
+// AsSelector converts fields into a selectors.
+func (ls Set) AsSelector() Selector {
+	return SelectorFromSet(ls)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/fields/fields_test.go b/third_party/k8s.io/apimachinery/pkg/fields/fields_test.go
new file mode 100644
index 0000000000..6965be6870
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/fields/fields_test.go
@@ -0,0 +1,57 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fields
+
+import (
+	"testing"
+)
+
+func matches(t *testing.T, ls Set, want string) {
+	if ls.String() != want {
+		t.Errorf("Expected '%s', but got '%s'", want, ls.String())
+	}
+}
+
+func TestSetString(t *testing.T) {
+	matches(t, Set{"x": "y"}, "x=y")
+	matches(t, Set{"foo": "bar"}, "foo=bar")
+	matches(t, Set{"foo": "bar", "baz": "qup"}, "baz=qup,foo=bar")
+}
+
+func TestFieldHas(t *testing.T) {
+	fieldHasTests := []struct {
+		Ls  Fields
+		Key string
+		Has bool
+	}{
+		{Set{"x": "y"}, "x", true},
+		{Set{"x": ""}, "x", true},
+		{Set{"x": "y"}, "foo", false},
+	}
+	for _, lh := range fieldHasTests {
+		if has := lh.Ls.Has(lh.Key); has != lh.Has {
+			t.Errorf("%#v.Has(%#v) => %v, expected %v", lh.Ls, lh.Key, has, lh.Has)
+		}
+	}
+}
+
+func TestFieldGet(t *testing.T) {
+	ls := Set{"x": "y"}
+	if ls.Get("x") != "y" {
+		t.Errorf("Set.Get is broken")
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/fields/requirements.go b/third_party/k8s.io/apimachinery/pkg/fields/requirements.go
new file mode 100644
index 0000000000..70d94ded88
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/fields/requirements.go
@@ -0,0 +1,30 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fields
+
+import "k8s.io/apimachinery/pkg/selection"
+
+// Requirements is AND of all requirements.
+type Requirements []Requirement
+
+// Requirement contains a field, a value, and an operator that relates the field and value.
+// This is currently for reading internal selection information of field selector.
+type Requirement struct {
+	Operator selection.Operator
+	Field    string
+	Value    string
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/fields/selector.go b/third_party/k8s.io/apimachinery/pkg/fields/selector.go
new file mode 100644
index 0000000000..a9e204976a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/fields/selector.go
@@ -0,0 +1,478 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fields
+
+import (
+	"bytes"
+	"fmt"
+	"sort"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/selection"
+)
+
+// Selector represents a field selector.
+type Selector interface {
+	// Matches returns true if this selector matches the given set of fields.
+	Matches(Fields) bool
+
+	// Empty returns true if this selector does not restrict the selection space.
+	Empty() bool
+
+	// RequiresExactMatch allows a caller to introspect whether a given selector
+	// requires a single specific field to be set, and if so returns the value it
+	// requires.
+	RequiresExactMatch(field string) (value string, found bool)
+
+	// Transform returns a new copy of the selector after TransformFunc has been
+	// applied to the entire selector, or an error if fn returns an error.
+	// If for a given requirement both field and value are transformed to empty
+	// string, the requirement is skipped.
+	Transform(fn TransformFunc) (Selector, error)
+
+	// Requirements converts this interface to Requirements to expose
+	// more detailed selection information.
+	Requirements() Requirements
+
+	// String returns a human readable string that represents this selector.
+	String() string
+
+	// Make a deep copy of the selector.
+	DeepCopySelector() Selector
+}
+
+type nothingSelector struct{}
+
+func (n nothingSelector) Matches(_ Fields) bool      { return false }
+func (n nothingSelector) Empty() bool                { return false }
+func (n nothingSelector) String() string             { return "" }
+func (n nothingSelector) Requirements() Requirements { return nil }
+func (n nothingSelector) DeepCopySelector() Selector { return n }
+func (n nothingSelector) RequiresExactMatch(field string) (value string, found bool) {
+	return "", false
+}
+func (n nothingSelector) Transform(fn TransformFunc) (Selector, error) { return n, nil }
+
+// Nothing returns a selector that matches no fields
+func Nothing() Selector {
+	return nothingSelector{}
+}
+
+// Everything returns a selector that matches all fields.
+func Everything() Selector {
+	return andTerm{}
+}
+
+type hasTerm struct {
+	field, value string
+}
+
+func (t *hasTerm) Matches(ls Fields) bool {
+	return ls.Get(t.field) == t.value
+}
+
+func (t *hasTerm) Empty() bool {
+	return false
+}
+
+func (t *hasTerm) RequiresExactMatch(field string) (value string, found bool) {
+	if t.field == field {
+		return t.value, true
+	}
+	return "", false
+}
+
+func (t *hasTerm) Transform(fn TransformFunc) (Selector, error) {
+	field, value, err := fn(t.field, t.value)
+	if err != nil {
+		return nil, err
+	}
+	if len(field) == 0 && len(value) == 0 {
+		return Everything(), nil
+	}
+	return &hasTerm{field, value}, nil
+}
+
+func (t *hasTerm) Requirements() Requirements {
+	return []Requirement{{
+		Field:    t.field,
+		Operator: selection.Equals,
+		Value:    t.value,
+	}}
+}
+
+func (t *hasTerm) String() string {
+	return fmt.Sprintf("%v=%v", t.field, EscapeValue(t.value))
+}
+
+func (t *hasTerm) DeepCopySelector() Selector {
+	if t == nil {
+		return nil
+	}
+	out := new(hasTerm)
+	*out = *t
+	return out
+}
+
+type notHasTerm struct {
+	field, value string
+}
+
+func (t *notHasTerm) Matches(ls Fields) bool {
+	return ls.Get(t.field) != t.value
+}
+
+func (t *notHasTerm) Empty() bool {
+	return false
+}
+
+func (t *notHasTerm) RequiresExactMatch(field string) (value string, found bool) {
+	return "", false
+}
+
+func (t *notHasTerm) Transform(fn TransformFunc) (Selector, error) {
+	field, value, err := fn(t.field, t.value)
+	if err != nil {
+		return nil, err
+	}
+	if len(field) == 0 && len(value) == 0 {
+		return Everything(), nil
+	}
+	return &notHasTerm{field, value}, nil
+}
+
+func (t *notHasTerm) Requirements() Requirements {
+	return []Requirement{{
+		Field:    t.field,
+		Operator: selection.NotEquals,
+		Value:    t.value,
+	}}
+}
+
+func (t *notHasTerm) String() string {
+	return fmt.Sprintf("%v!=%v", t.field, EscapeValue(t.value))
+}
+
+func (t *notHasTerm) DeepCopySelector() Selector {
+	if t == nil {
+		return nil
+	}
+	out := new(notHasTerm)
+	*out = *t
+	return out
+}
+
+type andTerm []Selector
+
+func (t andTerm) Matches(ls Fields) bool {
+	for _, q := range t {
+		if !q.Matches(ls) {
+			return false
+		}
+	}
+	return true
+}
+
+func (t andTerm) Empty() bool {
+	if t == nil {
+		return true
+	}
+	if len([]Selector(t)) == 0 {
+		return true
+	}
+	for i := range t {
+		if !t[i].Empty() {
+			return false
+		}
+	}
+	return true
+}
+
+func (t andTerm) RequiresExactMatch(field string) (string, bool) {
+	if t == nil || len([]Selector(t)) == 0 {
+		return "", false
+	}
+	for i := range t {
+		if value, found := t[i].RequiresExactMatch(field); found {
+			return value, found
+		}
+	}
+	return "", false
+}
+
+func (t andTerm) Transform(fn TransformFunc) (Selector, error) {
+	next := make([]Selector, 0, len([]Selector(t)))
+	for _, s := range []Selector(t) {
+		n, err := s.Transform(fn)
+		if err != nil {
+			return nil, err
+		}
+		if !n.Empty() {
+			next = append(next, n)
+		}
+	}
+	return andTerm(next), nil
+}
+
+func (t andTerm) Requirements() Requirements {
+	reqs := make([]Requirement, 0, len(t))
+	for _, s := range []Selector(t) {
+		rs := s.Requirements()
+		reqs = append(reqs, rs...)
+	}
+	return reqs
+}
+
+func (t andTerm) String() string {
+	var terms []string
+	for _, q := range t {
+		terms = append(terms, q.String())
+	}
+	return strings.Join(terms, ",")
+}
+
+func (t andTerm) DeepCopySelector() Selector {
+	if t == nil {
+		return nil
+	}
+	out := make([]Selector, len(t))
+	for i := range t {
+		out[i] = t[i].DeepCopySelector()
+	}
+	return andTerm(out)
+}
+
+// SelectorFromSet returns a Selector which will match exactly the given Set. A
+// nil Set is considered equivalent to Everything().
+func SelectorFromSet(ls Set) Selector {
+	if ls == nil {
+		return Everything()
+	}
+	items := make([]Selector, 0, len(ls))
+	for field, value := range ls {
+		items = append(items, &hasTerm{field: field, value: value})
+	}
+	if len(items) == 1 {
+		return items[0]
+	}
+	return andTerm(items)
+}
+
+// valueEscaper prefixes \,= characters with a backslash
+var valueEscaper = strings.NewReplacer(
+	// escape \ characters
+	`\`, `\\`,
+	// then escape , and = characters to allow unambiguous parsing of the value in a fieldSelector
+	`,`, `\,`,
+	`=`, `\=`,
+)
+
+// EscapeValue escapes an arbitrary literal string for use as a fieldSelector value
+func EscapeValue(s string) string {
+	return valueEscaper.Replace(s)
+}
+
+// InvalidEscapeSequence indicates an error occurred unescaping a field selector
+type InvalidEscapeSequence struct {
+	sequence string
+}
+
+func (i InvalidEscapeSequence) Error() string {
+	return fmt.Sprintf("invalid field selector: invalid escape sequence: %s", i.sequence)
+}
+
+// UnescapedRune indicates an error occurred unescaping a field selector
+type UnescapedRune struct {
+	r rune
+}
+
+func (i UnescapedRune) Error() string {
+	return fmt.Sprintf("invalid field selector: unescaped character in value: %v", i.r)
+}
+
+// UnescapeValue unescapes a fieldSelector value and returns the original literal value.
+// May return the original string if it contains no escaped or special characters.
+func UnescapeValue(s string) (string, error) {
+	// if there's no escaping or special characters, just return to avoid allocation
+	if !strings.ContainsAny(s, `\,=`) {
+		return s, nil
+	}
+
+	v := bytes.NewBuffer(make([]byte, 0, len(s)))
+	inSlash := false
+	for _, c := range s {
+		if inSlash {
+			switch c {
+			case '\\', ',', '=':
+				// omit the \ for recognized escape sequences
+				v.WriteRune(c)
+			default:
+				// error on unrecognized escape sequences
+				return "", InvalidEscapeSequence{sequence: string([]rune{'\\', c})}
+			}
+			inSlash = false
+			continue
+		}
+
+		switch c {
+		case '\\':
+			inSlash = true
+		case ',', '=':
+			// unescaped , and = characters are not allowed in field selector values
+			return "", UnescapedRune{r: c}
+		default:
+			v.WriteRune(c)
+		}
+	}
+
+	// Ending with a single backslash is an invalid sequence
+	if inSlash {
+		return "", InvalidEscapeSequence{sequence: "\\"}
+	}
+
+	return v.String(), nil
+}
+
+// ParseSelectorOrDie takes a string representing a selector and returns an
+// object suitable for matching, or panic when an error occur.
+func ParseSelectorOrDie(s string) Selector {
+	selector, err := ParseSelector(s)
+	if err != nil {
+		panic(err)
+	}
+	return selector
+}
+
+// ParseSelector takes a string representing a selector and returns an
+// object suitable for matching, or an error.
+func ParseSelector(selector string) (Selector, error) {
+	return parseSelector(selector,
+		func(lhs, rhs string) (newLhs, newRhs string, err error) {
+			return lhs, rhs, nil
+		})
+}
+
+// ParseAndTransformSelector parses the selector and runs them through the given TransformFunc.
+func ParseAndTransformSelector(selector string, fn TransformFunc) (Selector, error) {
+	return parseSelector(selector, fn)
+}
+
+// TransformFunc transforms selectors.
+type TransformFunc func(field, value string) (newField, newValue string, err error)
+
+// splitTerms returns the comma-separated terms contained in the given fieldSelector.
+// Backslash-escaped commas are treated as data instead of delimiters, and are included in the returned terms, with the leading backslash preserved.
+func splitTerms(fieldSelector string) []string {
+	if len(fieldSelector) == 0 {
+		return nil
+	}
+
+	terms := make([]string, 0, 1)
+	startIndex := 0
+	inSlash := false
+	for i, c := range fieldSelector {
+		switch {
+		case inSlash:
+			inSlash = false
+		case c == '\\':
+			inSlash = true
+		case c == ',':
+			terms = append(terms, fieldSelector[startIndex:i])
+			startIndex = i + 1
+		}
+	}
+
+	terms = append(terms, fieldSelector[startIndex:])
+
+	return terms
+}
+
+const (
+	notEqualOperator    = "!="
+	doubleEqualOperator = "=="
+	equalOperator       = "="
+)
+
+// termOperators holds the recognized operators supported in fieldSelectors.
+// doubleEqualOperator and equal are equivalent, but doubleEqualOperator is checked first
+// to avoid leaving a leading = character on the rhs value.
+var termOperators = []string{notEqualOperator, doubleEqualOperator, equalOperator}
+
+// splitTerm returns the lhs, operator, and rhs parsed from the given term, along with an indicator of whether the parse was successful.
+// no escaping of special characters is supported in the lhs value, so the first occurrence of a recognized operator is used as the split point.
+// the literal rhs is returned, and the caller is responsible for applying any desired unescaping.
+func splitTerm(term string) (lhs, op, rhs string, ok bool) {
+	for i := range term {
+		remaining := term[i:]
+		for _, op := range termOperators {
+			if strings.HasPrefix(remaining, op) {
+				return term[0:i], op, term[i+len(op):], true
+			}
+		}
+	}
+	return "", "", "", false
+}
+
+func parseSelector(selector string, fn TransformFunc) (Selector, error) {
+	parts := splitTerms(selector)
+	sort.StringSlice(parts).Sort()
+	var items []Selector
+	for _, part := range parts {
+		if part == "" {
+			continue
+		}
+		lhs, op, rhs, ok := splitTerm(part)
+		if !ok {
+			return nil, fmt.Errorf("invalid selector: '%s'; can't understand '%s'", selector, part)
+		}
+		unescapedRHS, err := UnescapeValue(rhs)
+		if err != nil {
+			return nil, err
+		}
+		switch op {
+		case notEqualOperator:
+			items = append(items, &notHasTerm{field: lhs, value: unescapedRHS})
+		case doubleEqualOperator:
+			items = append(items, &hasTerm{field: lhs, value: unescapedRHS})
+		case equalOperator:
+			items = append(items, &hasTerm{field: lhs, value: unescapedRHS})
+		default:
+			return nil, fmt.Errorf("invalid selector: '%s'; can't understand '%s'", selector, part)
+		}
+	}
+	if len(items) == 1 {
+		return items[0].Transform(fn)
+	}
+	return andTerm(items).Transform(fn)
+}
+
+// OneTermEqualSelector returns an object that matches objects where one field/field equals one value.
+// Cannot return an error.
+func OneTermEqualSelector(k, v string) Selector {
+	return &hasTerm{field: k, value: v}
+}
+
+// OneTermNotEqualSelector returns an object that matches objects where one field/field does not equal one value.
+// Cannot return an error.
+func OneTermNotEqualSelector(k, v string) Selector {
+	return &notHasTerm{field: k, value: v}
+}
+
+// AndSelectors creates a selector that is the logical AND of all the given selectors
+func AndSelectors(selectors ...Selector) Selector {
+	return andTerm(selectors)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/fields/selector_test.go b/third_party/k8s.io/apimachinery/pkg/fields/selector_test.go
new file mode 100644
index 0000000000..0aa66935cc
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/fields/selector_test.go
@@ -0,0 +1,397 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fields
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestSplitTerms(t *testing.T) {
+	testcases := map[string][]string{
+		// Simple selectors
+		`a`:                            {`a`},
+		`a=avalue`:                     {`a=avalue`},
+		`a=avalue,b=bvalue`:            {`a=avalue`, `b=bvalue`},
+		`a=avalue,b==bvalue,c!=cvalue`: {`a=avalue`, `b==bvalue`, `c!=cvalue`},
+
+		// Empty terms
+		``:     nil,
+		`a=a,`: {`a=a`, ``},
+		`,a=a`: {``, `a=a`},
+
+		// Escaped values
+		`k=\,,k2=v2`:   {`k=\,`, `k2=v2`},   // escaped comma in value
+		`k=\\,k2=v2`:   {`k=\\`, `k2=v2`},   // escaped backslash, unescaped comma
+		`k=\\\,,k2=v2`: {`k=\\\,`, `k2=v2`}, // escaped backslash and comma
+		`k=\a\b\`:      {`k=\a\b\`},         // non-escape sequences
+		`k=\`:          {`k=\`},             // orphan backslash
+
+		// Multi-byte
+		`함=수,목=록`: {`함=수`, `목=록`},
+	}
+
+	for selector, expectedTerms := range testcases {
+		if terms := splitTerms(selector); !reflect.DeepEqual(terms, expectedTerms) {
+			t.Errorf("splitSelectors(`%s`): Expected\n%#v\ngot\n%#v", selector, expectedTerms, terms)
+		}
+	}
+}
+
+func TestSplitTerm(t *testing.T) {
+	testcases := map[string]struct {
+		lhs string
+		op  string
+		rhs string
+		ok  bool
+	}{
+		// Simple terms
+		`a=value`:  {lhs: `a`, op: `=`, rhs: `value`, ok: true},
+		`b==value`: {lhs: `b`, op: `==`, rhs: `value`, ok: true},
+		`c!=value`: {lhs: `c`, op: `!=`, rhs: `value`, ok: true},
+
+		// Empty or invalid terms
+		``:  {lhs: ``, op: ``, rhs: ``, ok: false},
+		`a`: {lhs: ``, op: ``, rhs: ``, ok: false},
+
+		// Escaped values
+		`k=\,`:          {lhs: `k`, op: `=`, rhs: `\,`, ok: true},
+		`k=\=`:          {lhs: `k`, op: `=`, rhs: `\=`, ok: true},
+		`k=\\\a\b\=\,\`: {lhs: `k`, op: `=`, rhs: `\\\a\b\=\,\`, ok: true},
+
+		// Multi-byte
+		`함=수`: {lhs: `함`, op: `=`, rhs: `수`, ok: true},
+	}
+
+	for term, expected := range testcases {
+		lhs, op, rhs, ok := splitTerm(term)
+		if lhs != expected.lhs || op != expected.op || rhs != expected.rhs || ok != expected.ok {
+			t.Errorf(
+				"splitTerm(`%s`): Expected\n%s,%s,%s,%v\nGot\n%s,%s,%s,%v",
+				term,
+				expected.lhs, expected.op, expected.rhs, expected.ok,
+				lhs, op, rhs, ok,
+			)
+		}
+	}
+}
+
+func TestEscapeValue(t *testing.T) {
+	// map values to their normalized escaped values
+	testcases := map[string]string{
+		``:      ``,
+		`a`:     `a`,
+		`=`:     `\=`,
+		`,`:     `\,`,
+		`\`:     `\\`,
+		`\=\,\`: `\\\=\\\,\\`,
+	}
+
+	for unescapedValue, escapedValue := range testcases {
+		actualEscaped := EscapeValue(unescapedValue)
+		if actualEscaped != escapedValue {
+			t.Errorf("EscapeValue(%s): expected %s, got %s", unescapedValue, escapedValue, actualEscaped)
+		}
+
+		actualUnescaped, err := UnescapeValue(escapedValue)
+		if err != nil {
+			t.Errorf("UnescapeValue(%s): unexpected error %v", escapedValue, err)
+		}
+		if actualUnescaped != unescapedValue {
+			t.Errorf("UnescapeValue(%s): expected %s, got %s", escapedValue, unescapedValue, actualUnescaped)
+		}
+	}
+
+	// test invalid escape sequences
+	invalidTestcases := []string{
+		`\`,   // orphan slash is invalid
+		`\\\`, // orphan slash is invalid
+		`\a`,  // unrecognized escape sequence is invalid
+	}
+	for _, invalidValue := range invalidTestcases {
+		_, err := UnescapeValue(invalidValue)
+		if _, ok := err.(InvalidEscapeSequence); !ok || err == nil {
+			t.Errorf("UnescapeValue(%s): expected invalid escape sequence error, got %#v", invalidValue, err)
+		}
+	}
+}
+
+func TestSelectorParse(t *testing.T) {
+	testGoodStrings := []string{
+		"x=a,y=b,z=c",
+		"",
+		"x!=a,y=b",
+		`x=a||y\=b`,
+		`x=a\=\=b`,
+	}
+	testBadStrings := []string{
+		"x=a||y=b",
+		"x==a==b",
+		"x=a,b",
+		"x in (a)",
+		"x in (a,b,c)",
+		"x",
+	}
+	for _, test := range testGoodStrings {
+		lq, err := ParseSelector(test)
+		if err != nil {
+			t.Errorf("%v: error %v (%#v)\n", test, err, err)
+		}
+		if test != lq.String() {
+			t.Errorf("%v restring gave: %v\n", test, lq.String())
+		}
+	}
+	for _, test := range testBadStrings {
+		_, err := ParseSelector(test)
+		if err == nil {
+			t.Errorf("%v: did not get expected error\n", test)
+		}
+	}
+}
+
+func TestDeterministicParse(t *testing.T) {
+	s1, err := ParseSelector("x=a,a=x")
+	s2, err2 := ParseSelector("a=x,x=a")
+	if err != nil || err2 != nil {
+		t.Errorf("Unexpected parse error")
+	}
+	if s1.String() != s2.String() {
+		t.Errorf("Non-deterministic parse")
+	}
+}
+
+func expectMatch(t *testing.T, selector string, ls Set) {
+	lq, err := ParseSelector(selector)
+	if err != nil {
+		t.Errorf("Unable to parse %v as a selector\n", selector)
+		return
+	}
+	if !lq.Matches(ls) {
+		t.Errorf("Wanted %s to match '%s', but it did not.\n", selector, ls)
+	}
+}
+
+func expectNoMatch(t *testing.T, selector string, ls Set) {
+	lq, err := ParseSelector(selector)
+	if err != nil {
+		t.Errorf("Unable to parse %v as a selector\n", selector)
+		return
+	}
+	if lq.Matches(ls) {
+		t.Errorf("Wanted '%s' to not match '%s', but it did.", selector, ls)
+	}
+}
+
+func TestEverything(t *testing.T) {
+	if !Everything().Matches(Set{"x": "y"}) {
+		t.Errorf("Nil selector didn't match")
+	}
+	if !Everything().Empty() {
+		t.Errorf("Everything was not empty")
+	}
+}
+
+func TestSelectorMatches(t *testing.T) {
+	expectMatch(t, "", Set{"x": "y"})
+	expectMatch(t, "x=y", Set{"x": "y"})
+	expectMatch(t, "x=y,z=w", Set{"x": "y", "z": "w"})
+	expectMatch(t, "x!=y,z!=w", Set{"x": "z", "z": "a"})
+	expectMatch(t, "notin=in", Set{"notin": "in"}) // in and notin in exactMatch
+	expectNoMatch(t, "x=y", Set{"x": "z"})
+	expectNoMatch(t, "x=y,z=w", Set{"x": "w", "z": "w"})
+	expectNoMatch(t, "x!=y,z!=w", Set{"x": "z", "z": "w"})
+
+	fieldset := Set{
+		"foo":     "bar",
+		"baz":     "blah",
+		"complex": `=value\,\`,
+	}
+	expectMatch(t, "foo=bar", fieldset)
+	expectMatch(t, "baz=blah", fieldset)
+	expectMatch(t, "foo=bar,baz=blah", fieldset)
+	expectMatch(t, `foo=bar,baz=blah,complex=\=value\\\,\\`, fieldset)
+	expectNoMatch(t, "foo=blah", fieldset)
+	expectNoMatch(t, "baz=bar", fieldset)
+	expectNoMatch(t, "foo=bar,foobar=bar,baz=blah", fieldset)
+}
+
+func TestOneTermEqualSelector(t *testing.T) {
+	if !OneTermEqualSelector("x", "y").Matches(Set{"x": "y"}) {
+		t.Errorf("No match when match expected.")
+	}
+	if OneTermEqualSelector("x", "y").Matches(Set{"x": "z"}) {
+		t.Errorf("Match when none expected.")
+	}
+}
+
+func expectMatchDirect(t *testing.T, selector, ls Set) {
+	if !SelectorFromSet(selector).Matches(ls) {
+		t.Errorf("Wanted %s to match '%s', but it did not.\n", selector, ls)
+	}
+}
+
+func expectNoMatchDirect(t *testing.T, selector, ls Set) {
+	if SelectorFromSet(selector).Matches(ls) {
+		t.Errorf("Wanted '%s' to not match '%s', but it did.", selector, ls)
+	}
+}
+
+func TestSetMatches(t *testing.T) {
+	labelset := Set{
+		"foo": "bar",
+		"baz": "blah",
+	}
+	expectMatchDirect(t, Set{}, labelset)
+	expectMatchDirect(t, Set{"foo": "bar"}, labelset)
+	expectMatchDirect(t, Set{"baz": "blah"}, labelset)
+	expectMatchDirect(t, Set{"foo": "bar", "baz": "blah"}, labelset)
+	expectNoMatchDirect(t, Set{"foo": "=blah"}, labelset)
+	expectNoMatchDirect(t, Set{"baz": "=bar"}, labelset)
+	expectNoMatchDirect(t, Set{"foo": "=bar", "foobar": "bar", "baz": "blah"}, labelset)
+}
+
+func TestNilMapIsValid(t *testing.T) {
+	selector := Set(nil).AsSelector()
+	if selector == nil {
+		t.Errorf("Selector for nil set should be Everything")
+	}
+	if !selector.Empty() {
+		t.Errorf("Selector for nil set should be Empty")
+	}
+}
+
+func TestSetIsEmpty(t *testing.T) {
+	if !(Set{}).AsSelector().Empty() {
+		t.Errorf("Empty set should be empty")
+	}
+	if !(andTerm(nil)).Empty() {
+		t.Errorf("Nil andTerm should be empty")
+	}
+	if (&hasTerm{}).Empty() {
+		t.Errorf("hasTerm should not be empty")
+	}
+	if (&notHasTerm{}).Empty() {
+		t.Errorf("notHasTerm should not be empty")
+	}
+	if !(andTerm{andTerm{}}).Empty() {
+		t.Errorf("Nested andTerm should be empty")
+	}
+	if (andTerm{&hasTerm{"a", "b"}}).Empty() {
+		t.Errorf("Nested andTerm should not be empty")
+	}
+}
+
+func TestRequiresExactMatch(t *testing.T) {
+	testCases := map[string]struct {
+		S     Selector
+		Label string
+		Value string
+		Found bool
+	}{
+		"empty set":                 {Set{}.AsSelector(), "test", "", false},
+		"empty hasTerm":             {&hasTerm{}, "test", "", false},
+		"skipped hasTerm":           {&hasTerm{"a", "b"}, "test", "", false},
+		"valid hasTerm":             {&hasTerm{"test", "b"}, "test", "b", true},
+		"valid hasTerm no value":    {&hasTerm{"test", ""}, "test", "", true},
+		"valid notHasTerm":          {&notHasTerm{"test", "b"}, "test", "", false},
+		"valid notHasTerm no value": {&notHasTerm{"test", ""}, "test", "", false},
+		"nil andTerm":               {andTerm(nil), "test", "", false},
+		"empty andTerm":             {andTerm{}, "test", "", false},
+		"nested andTerm":            {andTerm{andTerm{}}, "test", "", false},
+		"nested andTerm matches":    {andTerm{&hasTerm{"test", "b"}}, "test", "b", true},
+		"andTerm with non-match":    {andTerm{&hasTerm{}, &hasTerm{"test", "b"}}, "test", "b", true},
+	}
+	for k, v := range testCases {
+		value, found := v.S.RequiresExactMatch(v.Label)
+		if value != v.Value {
+			t.Errorf("%s: expected value %s, got %s", k, v.Value, value)
+		}
+		if found != v.Found {
+			t.Errorf("%s: expected found %t, got %t", k, v.Found, found)
+		}
+	}
+}
+
+func TestTransform(t *testing.T) {
+	testCases := []struct {
+		name      string
+		selector  string
+		transform func(field, value string) (string, string, error)
+		result    string
+		isEmpty   bool
+	}{
+		{
+			name:      "empty selector",
+			selector:  "",
+			transform: func(field, value string) (string, string, error) { return field, value, nil },
+			result:    "",
+			isEmpty:   true,
+		},
+		{
+			name:      "no-op transform",
+			selector:  "a=b,c=d",
+			transform: func(field, value string) (string, string, error) { return field, value, nil },
+			result:    "a=b,c=d",
+			isEmpty:   false,
+		},
+		{
+			name:     "transform one field",
+			selector: "a=b,c=d",
+			transform: func(field, value string) (string, string, error) {
+				if field == "a" {
+					return "e", "f", nil
+				}
+				return field, value, nil
+			},
+			result:  "e=f,c=d",
+			isEmpty: false,
+		},
+		{
+			name:      "remove field to make empty",
+			selector:  "a=b",
+			transform: func(field, value string) (string, string, error) { return "", "", nil },
+			result:    "",
+			isEmpty:   true,
+		},
+		{
+			name:     "remove only one field",
+			selector: "a=b,c=d,e=f",
+			transform: func(field, value string) (string, string, error) {
+				if field == "c" {
+					return "", "", nil
+				}
+				return field, value, nil
+			},
+			result:  "a=b,e=f",
+			isEmpty: false,
+		},
+	}
+
+	for i, tc := range testCases {
+		result, err := ParseAndTransformSelector(tc.selector, tc.transform)
+		if err != nil {
+			t.Errorf("[%d] unexpected error during Transform: %v", i, err)
+		}
+		if result.Empty() != tc.isEmpty {
+			t.Errorf("[%d] expected empty: %t, got: %t", i, tc.isEmpty, result.Empty())
+		}
+		if result.String() != tc.result {
+			t.Errorf("[%d] unexpected result: %s", i, result.String())
+		}
+	}
+
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/labels/doc.go b/third_party/k8s.io/apimachinery/pkg/labels/doc.go
new file mode 100644
index 0000000000..35ba788094
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/labels/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package labels implements a simple label system, parsing and matching
+// selectors with sets of labels.
+package labels
diff --git a/third_party/k8s.io/apimachinery/pkg/labels/labels.go b/third_party/k8s.io/apimachinery/pkg/labels/labels.go
new file mode 100644
index 0000000000..670b010ba5
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/labels/labels.go
@@ -0,0 +1,183 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package labels
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Labels allows you to present labels independently from their storage.
+type Labels interface {
+	// Has returns whether the provided label exists.
+	Has(label string) (exists bool)
+
+	// Get returns the value for the provided label.
+	Get(label string) (value string)
+
+	// Lookup returns the value for the provided label if it exists and whether the provided label exist
+	Lookup(label string) (value string, exists bool)
+}
+
+// Set is a map of label:value. It implements Labels.
+type Set map[string]string
+
+// String returns all labels listed as a human readable string.
+// Conveniently, exactly the format that ParseSelector takes.
+func (ls Set) String() string {
+	selector := make([]string, 0, len(ls))
+	for key, value := range ls {
+		selector = append(selector, key+"="+value)
+	}
+	// Sort for determinism.
+	sort.StringSlice(selector).Sort()
+	return strings.Join(selector, ",")
+}
+
+// Has returns whether the provided label exists in the map.
+func (ls Set) Has(label string) bool {
+	_, exists := ls[label]
+	return exists
+}
+
+// Get returns the value in the map for the provided label.
+func (ls Set) Get(label string) string {
+	return ls[label]
+}
+
+// Lookup returns the value for the provided label if it exists and whether the provided label exist
+func (ls Set) Lookup(label string) (string, bool) {
+	val, exists := ls[label]
+	return val, exists
+}
+
+// AsSelector converts labels into a selectors. It does not
+// perform any validation, which means the server will reject
+// the request if the Set contains invalid values.
+func (ls Set) AsSelector() Selector {
+	return SelectorFromSet(ls)
+}
+
+// AsValidatedSelector converts labels into a selectors.
+// The Set is validated client-side, which allows to catch errors early.
+func (ls Set) AsValidatedSelector() (Selector, error) {
+	return ValidatedSelectorFromSet(ls)
+}
+
+// AsSelectorPreValidated converts labels into a selector, but
+// assumes that labels are already validated and thus doesn't
+// perform any validation.
+// According to our measurements this is significantly faster
+// in codepaths that matter at high scale.
+// Note: this method copies the Set; if the Set is immutable, consider wrapping it with ValidatedSetSelector
+// instead, which does not copy.
+func (ls Set) AsSelectorPreValidated() Selector {
+	return SelectorFromValidatedSet(ls)
+}
+
+// FormatLabels converts label map into plain string
+func FormatLabels(labelMap map[string]string) string {
+	l := Set(labelMap).String()
+	if l == "" {
+		l = "<none>"
+	}
+	return l
+}
+
+// Conflicts takes 2 maps and returns true if there a key match between
+// the maps but the value doesn't match, and returns false in other cases
+func Conflicts(labels1, labels2 Set) bool {
+	small := labels1
+	big := labels2
+	if len(labels2) < len(labels1) {
+		small = labels2
+		big = labels1
+	}
+
+	for k, v := range small {
+		if val, match := big[k]; match {
+			if val != v {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+// Merge combines given maps, and does not check for any conflicts
+// between the maps. In case of conflicts, second map (labels2) wins
+func Merge(labels1, labels2 Set) Set {
+	mergedMap := Set{}
+
+	for k, v := range labels1 {
+		mergedMap[k] = v
+	}
+	for k, v := range labels2 {
+		mergedMap[k] = v
+	}
+	return mergedMap
+}
+
+// Equals returns true if the given maps are equal
+func Equals(labels1, labels2 Set) bool {
+	if len(labels1) != len(labels2) {
+		return false
+	}
+
+	for k, v := range labels1 {
+		value, ok := labels2[k]
+		if !ok {
+			return false
+		}
+		if value != v {
+			return false
+		}
+	}
+	return true
+}
+
+// ConvertSelectorToLabelsMap converts selector string to labels map
+// and validates keys and values
+func ConvertSelectorToLabelsMap(selector string, opts ...field.PathOption) (Set, error) {
+	labelsMap := Set{}
+
+	if len(selector) == 0 {
+		return labelsMap, nil
+	}
+
+	labels := strings.Split(selector, ",")
+	for _, label := range labels {
+		l := strings.Split(label, "=")
+		if len(l) != 2 {
+			return labelsMap, fmt.Errorf("invalid selector: %s", l)
+		}
+		key := strings.TrimSpace(l[0])
+		if err := validateLabelKey(key, field.ToPath(opts...)); err != nil {
+			return labelsMap, err
+		}
+		value := strings.TrimSpace(l[1])
+		if err := validateLabelValue(key, value, field.ToPath(opts...)); err != nil {
+			return labelsMap, err
+		}
+		labelsMap[key] = value
+	}
+	return labelsMap, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/labels/labels_test.go b/third_party/k8s.io/apimachinery/pkg/labels/labels_test.go
new file mode 100644
index 0000000000..2d4d761bc2
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/labels/labels_test.go
@@ -0,0 +1,231 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package labels
+
+import (
+	"testing"
+)
+
+func matches(t *testing.T, ls Set, want string) {
+	if ls.String() != want {
+		t.Errorf("Expected '%s', but got '%s'", want, ls.String())
+	}
+}
+
+func TestSetString(t *testing.T) {
+	matches(t, Set{"x": "y"}, "x=y")
+	matches(t, Set{"foo": "bar"}, "foo=bar")
+	matches(t, Set{"foo": "bar", "baz": "qup"}, "baz=qup,foo=bar")
+
+	// TODO: Make our label representation robust enough to handle labels
+	// with ",=!" characters in their names.
+}
+
+func TestLabelHas(t *testing.T) {
+	labelHasTests := []struct {
+		Ls  Labels
+		Key string
+		Has bool
+	}{
+		{Set{"x": "y"}, "x", true},
+		{Set{"x": ""}, "x", true},
+		{Set{"x": "y"}, "foo", false},
+	}
+	for _, lh := range labelHasTests {
+		if has := lh.Ls.Has(lh.Key); has != lh.Has {
+			t.Errorf("%#v.Has(%#v) => %v, expected %v", lh.Ls, lh.Key, has, lh.Has)
+		}
+	}
+}
+
+func TestLabelGet(t *testing.T) {
+	ls := Set{"x": "y"}
+	if ls.Get("x") != "y" {
+		t.Errorf("Set.Get is broken")
+	}
+}
+
+func TestLabelConflict(t *testing.T) {
+	tests := []struct {
+		labels1  map[string]string
+		labels2  map[string]string
+		conflict bool
+	}{
+		{
+			labels1:  map[string]string{},
+			labels2:  map[string]string{},
+			conflict: false,
+		},
+		{
+			labels1:  map[string]string{"env": "test"},
+			labels2:  map[string]string{"infra": "true"},
+			conflict: false,
+		},
+		{
+			labels1:  map[string]string{"env": "test"},
+			labels2:  map[string]string{"infra": "true", "env": "test"},
+			conflict: false,
+		},
+		{
+			labels1:  map[string]string{"env": "test"},
+			labels2:  map[string]string{"env": "dev"},
+			conflict: true,
+		},
+		{
+			labels1:  map[string]string{"env": "test", "infra": "false"},
+			labels2:  map[string]string{"infra": "true", "color": "blue"},
+			conflict: true,
+		},
+	}
+	for _, test := range tests {
+		conflict := Conflicts(Set(test.labels1), Set(test.labels2))
+		if conflict != test.conflict {
+			t.Errorf("expected: %v but got: %v", test.conflict, conflict)
+		}
+	}
+}
+
+func TestLabelMerge(t *testing.T) {
+	tests := []struct {
+		labels1      map[string]string
+		labels2      map[string]string
+		mergedLabels map[string]string
+	}{
+		{
+			labels1:      map[string]string{},
+			labels2:      map[string]string{},
+			mergedLabels: map[string]string{},
+		},
+		{
+			labels1:      map[string]string{"infra": "true"},
+			labels2:      map[string]string{},
+			mergedLabels: map[string]string{"infra": "true"},
+		},
+		{
+			labels1:      map[string]string{"infra": "true"},
+			labels2:      map[string]string{"env": "test", "color": "blue"},
+			mergedLabels: map[string]string{"infra": "true", "env": "test", "color": "blue"},
+		},
+	}
+	for _, test := range tests {
+		mergedLabels := Merge(Set(test.labels1), Set(test.labels2))
+		if !Equals(mergedLabels, test.mergedLabels) {
+			t.Errorf("expected: %v but got: %v", test.mergedLabels, mergedLabels)
+		}
+	}
+}
+
+func TestLabelSelectorParse(t *testing.T) {
+	tests := []struct {
+		selector string
+		labels   map[string]string
+		valid    bool
+	}{
+		{
+			selector: "",
+			labels:   map[string]string{},
+			valid:    true,
+		},
+		{
+			selector: "x=a",
+			labels:   map[string]string{"x": "a"},
+			valid:    true,
+		},
+		{
+			selector: "x=a,y=b,z=c",
+			labels:   map[string]string{"x": "a", "y": "b", "z": "c"},
+			valid:    true,
+		},
+		{
+			selector: " x = a , y = b , z = c ",
+			labels:   map[string]string{"x": "a", "y": "b", "z": "c"},
+			valid:    true,
+		},
+		{
+			selector: "color=green,env=test,service=front",
+			labels:   map[string]string{"color": "green", "env": "test", "service": "front"},
+			valid:    true,
+		},
+		{
+			selector: "color=green, env=test, service=front",
+			labels:   map[string]string{"color": "green", "env": "test", "service": "front"},
+			valid:    true,
+		},
+		{
+			selector: ",",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x,y",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x=$y",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x!=y",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x==y",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x=a||y=b",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x in (y)",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x notin (y)",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+		{
+			selector: "x y",
+			labels:   map[string]string{},
+			valid:    false,
+		},
+	}
+	for _, test := range tests {
+		labels, err := ConvertSelectorToLabelsMap(test.selector)
+		if test.valid && err != nil {
+			t.Errorf("selector: %s, expected no error but got: %s", test.selector, err)
+		} else if !test.valid && err == nil {
+			t.Errorf("selector: %s, expected an error", test.selector)
+		}
+
+		if !Equals(Set(labels), test.labels) {
+			t.Errorf("expected: %s but got: %s", test.labels, labels)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/labels/selector.go b/third_party/k8s.io/apimachinery/pkg/labels/selector.go
new file mode 100644
index 0000000000..f31a890f2b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/labels/selector.go
@@ -0,0 +1,1073 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package labels
+
+import (
+	"fmt"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+
+	"k8s.io/klog/v2"
+
+	"k8s.io/apimachinery/pkg/api/validate/content"
+	"k8s.io/apimachinery/pkg/selection"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+var (
+	unaryOperators = []string{
+		string(selection.Exists), string(selection.DoesNotExist),
+	}
+	binaryOperators = []string{
+		string(selection.In), string(selection.NotIn),
+		string(selection.Equals), string(selection.DoubleEquals), string(selection.NotEquals),
+		string(selection.GreaterThan), string(selection.LessThan),
+	}
+	validRequirementOperators = append(binaryOperators, unaryOperators...)
+)
+
+// Requirements is AND of all requirements.
+type Requirements []Requirement
+
+func (r Requirements) String() string {
+	var sb strings.Builder
+
+	for i, requirement := range r {
+		if i > 0 {
+			sb.WriteString(", ")
+		}
+		sb.WriteString(requirement.String())
+	}
+
+	return sb.String()
+}
+
+// Selector represents a label selector.
+type Selector interface {
+	// Matches returns true if this selector matches the given set of labels.
+	Matches(Labels) bool
+
+	// Empty returns true if this selector does not restrict the selection space.
+	Empty() bool
+
+	// String returns a human readable string that represents this selector.
+	String() string
+
+	// Add adds requirements to the Selector
+	Add(r ...Requirement) Selector
+
+	// Requirements converts this interface into Requirements to expose
+	// more detailed selection information.
+	// If there are querying parameters, it will return converted requirements and selectable=true.
+	// If this selector doesn't want to select anything, it will return selectable=false.
+	Requirements() (requirements Requirements, selectable bool)
+
+	// Make a deep copy of the selector.
+	DeepCopySelector() Selector
+
+	// RequiresExactMatch allows a caller to introspect whether a given selector
+	// requires a single specific label to be set, and if so returns the value it
+	// requires.
+	RequiresExactMatch(label string) (value string, found bool)
+}
+
+// Sharing this saves 1 alloc per use; this is safe because it's immutable.
+var sharedEverythingSelector Selector = internalSelector{}
+
+// Everything returns a selector that matches all labels.
+func Everything() Selector {
+	return sharedEverythingSelector
+}
+
+type nothingSelector struct{}
+
+func (n nothingSelector) Matches(_ Labels) bool              { return false }
+func (n nothingSelector) Empty() bool                        { return false }
+func (n nothingSelector) String() string                     { return "" }
+func (n nothingSelector) Add(_ ...Requirement) Selector      { return n }
+func (n nothingSelector) Requirements() (Requirements, bool) { return nil, false }
+func (n nothingSelector) DeepCopySelector() Selector         { return n }
+func (n nothingSelector) RequiresExactMatch(label string) (value string, found bool) {
+	return "", false
+}
+
+// Sharing this saves 1 alloc per use; this is safe because it's immutable.
+var sharedNothingSelector Selector = nothingSelector{}
+
+// Nothing returns a selector that matches no labels
+func Nothing() Selector {
+	return sharedNothingSelector
+}
+
+// MatchesNothing only returns true for selectors which are definitively determined to match no objects.
+// This currently only detects the `labels.Nothing()` selector, but may change over time to detect more selectors that match no objects.
+//
+// Note: The current implementation does not check for selector conflict scenarios (e.g., a=a,a!=a).
+// Support for detecting such cases can be added in the future.
+func MatchesNothing(selector Selector) bool {
+	return selector == sharedNothingSelector
+}
+
+// NewSelector returns a nil selector
+func NewSelector() Selector {
+	return internalSelector(nil)
+}
+
+type internalSelector []Requirement
+
+func (s internalSelector) DeepCopy() internalSelector {
+	if s == nil {
+		return nil
+	}
+	result := make([]Requirement, len(s))
+	for i := range s {
+		s[i].DeepCopyInto(&result[i])
+	}
+	return result
+}
+
+func (s internalSelector) DeepCopySelector() Selector {
+	return s.DeepCopy()
+}
+
+// ByKey sorts requirements by key to obtain deterministic parser
+type ByKey []Requirement
+
+func (a ByKey) Len() int { return len(a) }
+
+func (a ByKey) Swap(i, j int) { a[i], a[j] = a[j], a[i] }
+
+func (a ByKey) Less(i, j int) bool { return a[i].key < a[j].key }
+
+// Requirement contains values, a key, and an operator that relates the key and values.
+// The zero value of Requirement is invalid.
+// Requirement implements both set based match and exact match
+// Requirement should be initialized via NewRequirement constructor for creating a valid Requirement.
+// +k8s:deepcopy-gen=true
+type Requirement struct {
+	key      string
+	operator selection.Operator
+	// In huge majority of cases we have at most one value here.
+	// It is generally faster to operate on a single-element slice
+	// than on a single-element map, so we have a slice here.
+	strValues []string
+}
+
+// NewRequirement is the constructor for a Requirement.
+// If any of these rules is violated, an error is returned:
+//  1. The operator can only be In, NotIn, Equals, DoubleEquals, Gt, Lt, NotEquals, Exists, or DoesNotExist.
+//  2. If the operator is In or NotIn, the values set must be non-empty.
+//  3. If the operator is Equals, DoubleEquals, or NotEquals, the values set must contain one value.
+//  4. If the operator is Exists or DoesNotExist, the value set must be empty.
+//  5. If the operator is Gt or Lt, the values set must contain only one value, which will be interpreted as an integer.
+//  6. The key is invalid due to its length, or sequence of characters. See validateLabelKey for more details.
+//
+// The empty string is a valid value in the input values set.
+// Returned error, if not nil, is guaranteed to be an aggregated field.ErrorList
+func NewRequirement(key string, op selection.Operator, vals []string, opts ...field.PathOption) (*Requirement, error) {
+	var allErrs field.ErrorList
+	path := field.ToPath(opts...)
+	if err := validateLabelKey(key, path.Child("key")); err != nil {
+		allErrs = append(allErrs, err)
+	}
+
+	valuePath := path.Child("values")
+	switch op {
+	case selection.In, selection.NotIn:
+		if len(vals) == 0 {
+			allErrs = append(allErrs, field.Invalid(valuePath, vals, "for 'in', 'notin' operators, values set can't be empty"))
+		}
+	case selection.Equals, selection.DoubleEquals, selection.NotEquals:
+		if len(vals) != 1 {
+			allErrs = append(allErrs, field.Invalid(valuePath, vals, "exact-match compatibility requires one single value"))
+		}
+	case selection.Exists, selection.DoesNotExist:
+		if len(vals) != 0 {
+			allErrs = append(allErrs, field.Invalid(valuePath, vals, "values set must be empty for exists and does not exist"))
+		}
+	case selection.GreaterThan, selection.LessThan:
+		if len(vals) != 1 {
+			allErrs = append(allErrs, field.Invalid(valuePath, vals, "for 'Gt', 'Lt' operators, exactly one value is required"))
+		}
+		for i := range vals {
+			if _, err := strconv.ParseInt(vals[i], 10, 64); err != nil {
+				allErrs = append(allErrs, field.Invalid(valuePath.Index(i), vals[i], "for 'Gt', 'Lt' operators, the value must be an integer"))
+			}
+		}
+	default:
+		allErrs = append(allErrs, field.NotSupported(path.Child("operator"), op, validRequirementOperators))
+	}
+
+	for i := range vals {
+		if err := validateLabelValue(key, vals[i], valuePath.Index(i)); err != nil {
+			allErrs = append(allErrs, err)
+		}
+	}
+	return &Requirement{key: key, operator: op, strValues: vals}, allErrs.ToAggregate()
+}
+
+func (r *Requirement) hasValue(value string) bool {
+	for i := range r.strValues {
+		if r.strValues[i] == value {
+			return true
+		}
+	}
+	return false
+}
+
+// Matches returns true if the Requirement matches the input Labels.
+// There is a match in the following cases:
+//  1. The operator is Exists and Labels has the Requirement's key.
+//  2. The operator is In, Labels has the Requirement's key and Labels'
+//     value for that key is in Requirement's value set.
+//  3. The operator is NotIn, Labels has the Requirement's key and
+//     Labels' value for that key is not in Requirement's value set.
+//  4. The operator is DoesNotExist or NotIn and Labels does not have the
+//     Requirement's key.
+//  5. The operator is GreaterThanOperator or LessThanOperator, and Labels has
+//     the Requirement's key and the corresponding value satisfies mathematical inequality.
+func (r *Requirement) Matches(ls Labels) bool {
+	switch r.operator {
+	case selection.In, selection.Equals, selection.DoubleEquals:
+		val, exists := ls.Lookup(r.key)
+		if !exists {
+			return false
+		}
+		return r.hasValue(val)
+	case selection.NotIn, selection.NotEquals:
+		val, exists := ls.Lookup(r.key)
+		if !exists {
+			return true
+		}
+		return !r.hasValue(val)
+	case selection.Exists:
+		return ls.Has(r.key)
+	case selection.DoesNotExist:
+		return !ls.Has(r.key)
+	case selection.GreaterThan, selection.LessThan:
+		val, exists := ls.Lookup(r.key)
+		if !exists {
+			return false
+		}
+		lsValue, err := strconv.ParseInt(val, 10, 64)
+		if err != nil {
+			//nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this.
+			klog.V(10).InfoS("ParseInt failed", "value", val, "label", ls, "err", err)
+			return false
+		}
+
+		// There should be only one strValue in r.strValues, and can be converted to an integer.
+		if len(r.strValues) != 1 {
+			//nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this.
+			klog.V(10).InfoS("Invalid values count: for 'Gt', 'Lt' operators, exactly one value is required", "count", len(r.strValues), "requirement", r)
+			return false
+		}
+
+		var rValue int64
+		for i := range r.strValues {
+			rValue, err = strconv.ParseInt(r.strValues[i], 10, 64)
+			if err != nil {
+				//nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this.
+				klog.V(10).InfoS("ParseInt failed: for 'Gt', 'Lt' operators, the value must be an integer", "value", r.strValues[i], "requirement", r, "err", err)
+				return false
+			}
+		}
+		return (r.operator == selection.GreaterThan && lsValue > rValue) || (r.operator == selection.LessThan && lsValue < rValue)
+	default:
+		return false
+	}
+}
+
+// Key returns requirement key
+func (r *Requirement) Key() string {
+	return r.key
+}
+
+// Operator returns requirement operator
+func (r *Requirement) Operator() selection.Operator {
+	return r.operator
+}
+
+// Values returns requirement values
+func (r *Requirement) Values() sets.String {
+	ret := sets.String{}
+	for i := range r.strValues {
+		ret.Insert(r.strValues[i])
+	}
+	return ret
+}
+
+// ValuesUnsorted returns a copy of requirement values as passed to NewRequirement without sorting.
+func (r *Requirement) ValuesUnsorted() []string {
+	ret := make([]string, 0, len(r.strValues))
+	ret = append(ret, r.strValues...)
+	return ret
+}
+
+// Equal checks the equality of requirement.
+func (r Requirement) Equal(x Requirement) bool {
+	if r.key != x.key {
+		return false
+	}
+	if r.operator != x.operator {
+		return false
+	}
+	return slices.Equal(r.strValues, x.strValues)
+}
+
+// Empty returns true if the internalSelector doesn't restrict selection space
+func (s internalSelector) Empty() bool {
+	if s == nil {
+		return true
+	}
+	return len(s) == 0
+}
+
+// String returns a human-readable string that represents this
+// Requirement. If called on an invalid Requirement, an error is
+// returned. See NewRequirement for creating a valid Requirement.
+func (r *Requirement) String() string {
+	var sb strings.Builder
+	sb.Grow(
+		// length of r.key
+		len(r.key) +
+			// length of 'r.operator' + 2 spaces for the worst case ('in' and 'notin')
+			len(r.operator) + 2 +
+			// length of 'r.strValues' slice times. Heuristically 5 chars per word
+			+5*len(r.strValues))
+	if r.operator == selection.DoesNotExist {
+		sb.WriteString("!")
+	}
+	sb.WriteString(r.key)
+
+	switch r.operator {
+	case selection.Equals:
+		sb.WriteString("=")
+	case selection.DoubleEquals:
+		sb.WriteString("==")
+	case selection.NotEquals:
+		sb.WriteString("!=")
+	case selection.In:
+		sb.WriteString(" in ")
+	case selection.NotIn:
+		sb.WriteString(" notin ")
+	case selection.GreaterThan:
+		sb.WriteString(">")
+	case selection.LessThan:
+		sb.WriteString("<")
+	case selection.Exists, selection.DoesNotExist:
+		return sb.String()
+	}
+
+	switch r.operator {
+	case selection.In, selection.NotIn:
+		sb.WriteString("(")
+	}
+	if len(r.strValues) == 1 {
+		sb.WriteString(r.strValues[0])
+	} else { // only > 1 since == 0 prohibited by NewRequirement
+		// normalizes value order on output, without mutating the in-memory selector representation
+		// also avoids normalization when it is not required, and ensures we do not mutate shared data
+		sb.WriteString(strings.Join(safeSort(r.strValues), ","))
+	}
+
+	switch r.operator {
+	case selection.In, selection.NotIn:
+		sb.WriteString(")")
+	}
+	return sb.String()
+}
+
+// safeSort sorts input strings without modification
+func safeSort(in []string) []string {
+	if sort.StringsAreSorted(in) {
+		return in
+	}
+	out := make([]string, len(in))
+	copy(out, in)
+	sort.Strings(out)
+	return out
+}
+
+// Add adds requirements to the selector. It copies the current selector returning a new one
+func (s internalSelector) Add(reqs ...Requirement) Selector {
+	ret := make(internalSelector, 0, len(s)+len(reqs))
+	ret = append(ret, s...)
+	ret = append(ret, reqs...)
+	sort.Sort(ByKey(ret))
+	return ret
+}
+
+// Matches for a internalSelector returns true if all
+// its Requirements match the input Labels. If any
+// Requirement does not match, false is returned.
+func (s internalSelector) Matches(l Labels) bool {
+	for ix := range s {
+		if matches := s[ix].Matches(l); !matches {
+			return false
+		}
+	}
+	return true
+}
+
+func (s internalSelector) Requirements() (Requirements, bool) { return Requirements(s), true }
+
+// String returns a comma-separated string of all
+// the internalSelector Requirements' human-readable strings.
+func (s internalSelector) String() string {
+	var reqs []string
+	for ix := range s {
+		reqs = append(reqs, s[ix].String())
+	}
+	return strings.Join(reqs, ",")
+}
+
+// RequiresExactMatch introspects whether a given selector requires a single specific field
+// to be set, and if so returns the value it requires.
+func (s internalSelector) RequiresExactMatch(label string) (value string, found bool) {
+	for ix := range s {
+		if s[ix].key == label {
+			switch s[ix].operator {
+			case selection.Equals, selection.DoubleEquals, selection.In:
+				if len(s[ix].strValues) == 1 {
+					return s[ix].strValues[0], true
+				}
+			}
+			return "", false
+		}
+	}
+	return "", false
+}
+
+// Token represents constant definition for lexer token
+type Token int
+
+const (
+	// ErrorToken represents scan error
+	ErrorToken Token = iota
+	// EndOfStringToken represents end of string
+	EndOfStringToken
+	// ClosedParToken represents close parenthesis
+	ClosedParToken
+	// CommaToken represents the comma
+	CommaToken
+	// DoesNotExistToken represents logic not
+	DoesNotExistToken
+	// DoubleEqualsToken represents double equals
+	DoubleEqualsToken
+	// EqualsToken represents equal
+	EqualsToken
+	// GreaterThanToken represents greater than
+	GreaterThanToken
+	// IdentifierToken represents identifier, e.g. keys and values
+	IdentifierToken
+	// InToken represents in
+	InToken
+	// LessThanToken represents less than
+	LessThanToken
+	// NotEqualsToken represents not equal
+	NotEqualsToken
+	// NotInToken represents not in
+	NotInToken
+	// OpenParToken represents open parenthesis
+	OpenParToken
+)
+
+// string2token contains the mapping between lexer Token and token literal
+// (except IdentifierToken, EndOfStringToken and ErrorToken since it makes no sense)
+var string2token = map[string]Token{
+	")":     ClosedParToken,
+	",":     CommaToken,
+	"!":     DoesNotExistToken,
+	"==":    DoubleEqualsToken,
+	"=":     EqualsToken,
+	">":     GreaterThanToken,
+	"in":    InToken,
+	"<":     LessThanToken,
+	"!=":    NotEqualsToken,
+	"notin": NotInToken,
+	"(":     OpenParToken,
+}
+
+// ScannedItem contains the Token and the literal produced by the lexer.
+type ScannedItem struct {
+	tok     Token
+	literal string
+}
+
+// isWhitespace returns true if the rune is a space, tab, or newline.
+func isWhitespace(ch byte) bool {
+	return ch == ' ' || ch == '\t' || ch == '\r' || ch == '\n'
+}
+
+// isSpecialSymbol detects if the character ch can be an operator
+func isSpecialSymbol(ch byte) bool {
+	switch ch {
+	case '=', '!', '(', ')', ',', '>', '<':
+		return true
+	}
+	return false
+}
+
+// Lexer represents the Lexer struct for label selector.
+// It contains necessary informationt to tokenize the input string
+type Lexer struct {
+	// s stores the string to be tokenized
+	s string
+	// pos is the position currently tokenized
+	pos int
+}
+
+// read returns the character currently lexed
+// increment the position and check the buffer overflow
+func (l *Lexer) read() (b byte) {
+	b = 0
+	if l.pos < len(l.s) {
+		b = l.s[l.pos]
+		l.pos++
+	}
+	return b
+}
+
+// unread 'undoes' the last read character
+func (l *Lexer) unread() {
+	l.pos--
+}
+
+// scanIDOrKeyword scans string to recognize literal token (for example 'in') or an identifier.
+func (l *Lexer) scanIDOrKeyword() (tok Token, lit string) {
+	var buffer []byte
+IdentifierLoop:
+	for {
+		switch ch := l.read(); {
+		case ch == 0:
+			break IdentifierLoop
+		case isSpecialSymbol(ch) || isWhitespace(ch):
+			l.unread()
+			break IdentifierLoop
+		default:
+			buffer = append(buffer, ch)
+		}
+	}
+	s := string(buffer)
+	if val, ok := string2token[s]; ok { // is a literal token?
+		return val, s
+	}
+	return IdentifierToken, s // otherwise is an identifier
+}
+
+// scanSpecialSymbol scans string starting with special symbol.
+// special symbol identify non literal operators. "!=", "==", "="
+func (l *Lexer) scanSpecialSymbol() (Token, string) {
+	lastScannedItem := ScannedItem{}
+	var buffer []byte
+SpecialSymbolLoop:
+	for {
+		switch ch := l.read(); {
+		case ch == 0:
+			break SpecialSymbolLoop
+		case isSpecialSymbol(ch):
+			buffer = append(buffer, ch)
+			if token, ok := string2token[string(buffer)]; ok {
+				lastScannedItem = ScannedItem{tok: token, literal: string(buffer)}
+			} else if lastScannedItem.tok != 0 {
+				l.unread()
+				break SpecialSymbolLoop
+			}
+		default:
+			l.unread()
+			break SpecialSymbolLoop
+		}
+	}
+	if lastScannedItem.tok == 0 {
+		return ErrorToken, fmt.Sprintf("error expected: keyword found '%s'", buffer)
+	}
+	return lastScannedItem.tok, lastScannedItem.literal
+}
+
+// skipWhiteSpaces consumes all blank characters
+// returning the first non blank character
+func (l *Lexer) skipWhiteSpaces(ch byte) byte {
+	for {
+		if !isWhitespace(ch) {
+			return ch
+		}
+		ch = l.read()
+	}
+}
+
+// Lex returns a pair of Token and the literal
+// literal is meaningfull only for IdentifierToken token
+func (l *Lexer) Lex() (tok Token, lit string) {
+	switch ch := l.skipWhiteSpaces(l.read()); {
+	case ch == 0:
+		return EndOfStringToken, ""
+	case isSpecialSymbol(ch):
+		l.unread()
+		return l.scanSpecialSymbol()
+	default:
+		l.unread()
+		return l.scanIDOrKeyword()
+	}
+}
+
+// Parser data structure contains the label selector parser data structure
+type Parser struct {
+	l            *Lexer
+	scannedItems []ScannedItem
+	position     int
+	path         *field.Path
+}
+
+// ParserContext represents context during parsing:
+// some literal for example 'in' and 'notin' can be
+// recognized as operator for example 'x in (a)' but
+// it can be recognized as value for example 'value in (in)'
+type ParserContext int
+
+const (
+	// KeyAndOperator represents key and operator
+	KeyAndOperator ParserContext = iota
+	// Values represents values
+	Values
+)
+
+// lookahead func returns the current token and string. No increment of current position
+func (p *Parser) lookahead(context ParserContext) (Token, string) {
+	tok, lit := p.scannedItems[p.position].tok, p.scannedItems[p.position].literal
+	if context == Values {
+		switch tok {
+		case InToken, NotInToken:
+			tok = IdentifierToken
+		}
+	}
+	return tok, lit
+}
+
+// consume returns current token and string. Increments the position
+func (p *Parser) consume(context ParserContext) (Token, string) {
+	p.position++
+	tok, lit := p.scannedItems[p.position-1].tok, p.scannedItems[p.position-1].literal
+	if context == Values {
+		switch tok {
+		case InToken, NotInToken:
+			tok = IdentifierToken
+		}
+	}
+	return tok, lit
+}
+
+// scan runs through the input string and stores the ScannedItem in an array
+// Parser can now lookahead and consume the tokens
+func (p *Parser) scan() {
+	for {
+		token, literal := p.l.Lex()
+		p.scannedItems = append(p.scannedItems, ScannedItem{token, literal})
+		if token == EndOfStringToken {
+			break
+		}
+	}
+}
+
+// parse runs the left recursive descending algorithm
+// on input string. It returns a list of Requirement objects.
+func (p *Parser) parse() (internalSelector, error) {
+	p.scan() // init scannedItems
+
+	var requirements internalSelector
+	for {
+		tok, lit := p.lookahead(Values)
+		switch tok {
+		case IdentifierToken, DoesNotExistToken:
+			r, err := p.parseRequirement()
+			if err != nil {
+				return nil, fmt.Errorf("unable to parse requirement: %v", err)
+			}
+			requirements = append(requirements, *r)
+			t, l := p.consume(Values)
+			switch t {
+			case EndOfStringToken:
+				return requirements, nil
+			case CommaToken:
+				t2, l2 := p.lookahead(Values)
+				if t2 != IdentifierToken && t2 != DoesNotExistToken {
+					return nil, fmt.Errorf("found '%s', expected: identifier after ','", l2)
+				}
+			default:
+				return nil, fmt.Errorf("found '%s', expected: ',' or 'end of string'", l)
+			}
+		case EndOfStringToken:
+			return requirements, nil
+		default:
+			return nil, fmt.Errorf("found '%s', expected: !, identifier, or 'end of string'", lit)
+		}
+	}
+}
+
+func (p *Parser) parseRequirement() (*Requirement, error) {
+	key, operator, err := p.parseKeyAndInferOperator()
+	if err != nil {
+		return nil, err
+	}
+	if operator == selection.Exists || operator == selection.DoesNotExist { // operator found lookahead set checked
+		return NewRequirement(key, operator, []string{}, field.WithPath(p.path))
+	}
+	operator, err = p.parseOperator()
+	if err != nil {
+		return nil, err
+	}
+	var values sets.String
+	switch operator {
+	case selection.In, selection.NotIn:
+		values, err = p.parseValues()
+	case selection.Equals, selection.DoubleEquals, selection.NotEquals, selection.GreaterThan, selection.LessThan:
+		values, err = p.parseExactValue()
+	}
+	if err != nil {
+		return nil, err
+	}
+	return NewRequirement(key, operator, values.List(), field.WithPath(p.path))
+
+}
+
+// parseKeyAndInferOperator parses literals.
+// in case of no operator '!, in, notin, ==, =, !=' are found
+// the 'exists' operator is inferred
+func (p *Parser) parseKeyAndInferOperator() (string, selection.Operator, error) {
+	var operator selection.Operator
+	tok, literal := p.consume(Values)
+	if tok == DoesNotExistToken {
+		operator = selection.DoesNotExist
+		tok, literal = p.consume(Values)
+	}
+	if tok != IdentifierToken {
+		err := fmt.Errorf("found '%s', expected: identifier", literal)
+		return "", "", err
+	}
+	if err := validateLabelKey(literal, p.path); err != nil {
+		return "", "", err
+	}
+	if t, _ := p.lookahead(Values); t == EndOfStringToken || t == CommaToken {
+		if operator != selection.DoesNotExist {
+			operator = selection.Exists
+		}
+	}
+	return literal, operator, nil
+}
+
+// parseOperator returns operator and eventually matchType
+// matchType can be exact
+func (p *Parser) parseOperator() (op selection.Operator, err error) {
+	tok, lit := p.consume(KeyAndOperator)
+	switch tok {
+	// DoesNotExistToken shouldn't be here because it's a unary operator, not a binary operator
+	case InToken:
+		op = selection.In
+	case EqualsToken:
+		op = selection.Equals
+	case DoubleEqualsToken:
+		op = selection.DoubleEquals
+	case GreaterThanToken:
+		op = selection.GreaterThan
+	case LessThanToken:
+		op = selection.LessThan
+	case NotInToken:
+		op = selection.NotIn
+	case NotEqualsToken:
+		op = selection.NotEquals
+	default:
+		return "", fmt.Errorf("found '%s', expected: %v", lit, strings.Join(binaryOperators, ", "))
+	}
+	return op, nil
+}
+
+// parseValues parses the values for set based matching (x,y,z)
+func (p *Parser) parseValues() (sets.String, error) {
+	tok, lit := p.consume(Values)
+	if tok != OpenParToken {
+		return nil, fmt.Errorf("found '%s' expected: '('", lit)
+	}
+	tok, lit = p.lookahead(Values)
+	switch tok {
+	case IdentifierToken, CommaToken:
+		s, err := p.parseIdentifiersList() // handles general cases
+		if err != nil {
+			return s, err
+		}
+		if tok, _ = p.consume(Values); tok != ClosedParToken {
+			return nil, fmt.Errorf("found '%s', expected: ')'", lit)
+		}
+		return s, nil
+	case ClosedParToken: // handles "()"
+		p.consume(Values)
+		return sets.NewString(""), nil
+	default:
+		return nil, fmt.Errorf("found '%s', expected: ',', ')' or identifier", lit)
+	}
+}
+
+// parseIdentifiersList parses a (possibly empty) list of
+// of comma separated (possibly empty) identifiers
+func (p *Parser) parseIdentifiersList() (sets.String, error) {
+	s := sets.NewString()
+	for {
+		tok, lit := p.consume(Values)
+		switch tok {
+		case IdentifierToken:
+			s.Insert(lit)
+			tok2, lit2 := p.lookahead(Values)
+			switch tok2 {
+			case CommaToken:
+				continue
+			case ClosedParToken:
+				return s, nil
+			default:
+				return nil, fmt.Errorf("found '%s', expected: ',' or ')'", lit2)
+			}
+		case CommaToken: // handled here since we can have "(,"
+			if s.Len() == 0 {
+				s.Insert("") // to handle (,
+			}
+			tok2, _ := p.lookahead(Values)
+			if tok2 == ClosedParToken {
+				s.Insert("") // to handle ,)  Double "" removed by StringSet
+				return s, nil
+			}
+			if tok2 == CommaToken {
+				s.Insert("") // to handle ,, Double "" removed by StringSet
+			}
+		default: // it can be operator
+			return s, fmt.Errorf("found '%s', expected: ',', or identifier", lit)
+		}
+	}
+}
+
+// parseExactValue parses the only value for exact match style
+func (p *Parser) parseExactValue() (sets.String, error) {
+	s := sets.NewString()
+	tok, _ := p.lookahead(Values)
+	if tok == EndOfStringToken || tok == CommaToken {
+		s.Insert("")
+		return s, nil
+	}
+	tok, lit := p.consume(Values)
+	if tok == IdentifierToken {
+		s.Insert(lit)
+		return s, nil
+	}
+	return nil, fmt.Errorf("found '%s', expected: identifier", lit)
+}
+
+// Parse takes a string representing a selector and returns a selector
+// object, or an error. This parsing function differs from ParseSelector
+// as they parse different selectors with different syntaxes.
+// The input will cause an error if it does not follow this form:
+//
+//	<selector-syntax>         ::= <requirement> | <requirement> "," <selector-syntax>
+//	<requirement>             ::= [!] KEY [ <set-based-restriction> | <exact-match-restriction> ]
+//	<set-based-restriction>   ::= "" | <inclusion-exclusion> <value-set>
+//	<inclusion-exclusion>     ::= <inclusion> | <exclusion>
+//	<exclusion>               ::= "notin"
+//	<inclusion>               ::= "in"
+//	<value-set>               ::= "(" <values> ")"
+//	<values>                  ::= VALUE | VALUE "," <values>
+//	<exact-match-restriction> ::= ["="|"=="|"!="] VALUE
+//
+// KEY is a sequence of one or more characters following [ DNS_SUBDOMAIN "/" ] DNS_LABEL. Max length is 63 characters.
+// VALUE is a sequence of zero or more characters "([A-Za-z0-9_-\.])". Max length is 63 characters.
+// Delimiter is white space: (' ', '\t')
+// Example of valid syntax:
+//
+//	"x in (foo,,baz),y,z notin ()"
+//
+// Note:
+//  1. Inclusion - " in " - denotes that the KEY exists and is equal to any of the
+//     VALUEs in its requirement
+//  2. Exclusion - " notin " - denotes that the KEY is not equal to any
+//     of the VALUEs in its requirement or does not exist
+//  3. The empty string is a valid VALUE
+//  4. A requirement with just a KEY - as in "y" above - denotes that
+//     the KEY exists and can be any VALUE.
+//  5. A requirement with just !KEY requires that the KEY not exist.
+func Parse(selector string, opts ...field.PathOption) (Selector, error) {
+	parsedSelector, err := parse(selector, field.ToPath(opts...))
+	if err == nil {
+		return parsedSelector, nil
+	}
+	return nil, err
+}
+
+// parse parses the string representation of the selector and returns the internalSelector struct.
+// The callers of this method can then decide how to return the internalSelector struct to their
+// callers. This function has two callers now, one returns a Selector interface and the other
+// returns a list of requirements.
+func parse(selector string, path *field.Path) (internalSelector, error) {
+	p := &Parser{l: &Lexer{s: selector, pos: 0}, path: path}
+	items, err := p.parse()
+	if err != nil {
+		return nil, err
+	}
+	sort.Sort(ByKey(items)) // sort to grant determistic parsing
+	return internalSelector(items), err
+}
+
+func validateLabelKey(k string, path *field.Path) *field.Error {
+	if errs := content.IsLabelKey(k); len(errs) != 0 {
+		return field.Invalid(path, k, strings.Join(errs, "; "))
+	}
+	return nil
+}
+
+func validateLabelValue(k, v string, path *field.Path) *field.Error {
+	if errs := validation.IsValidLabelValue(v); len(errs) != 0 {
+		return field.Invalid(path.Key(k), v, strings.Join(errs, "; "))
+	}
+	return nil
+}
+
+// SelectorFromSet returns a Selector which will match exactly the given Set. A
+// nil and empty Sets are considered equivalent to Everything().
+// It does not perform any validation, which means the server will reject
+// the request if the Set contains invalid values.
+func SelectorFromSet(ls Set) Selector {
+	return SelectorFromValidatedSet(ls)
+}
+
+// ValidatedSelectorFromSet returns a Selector which will match exactly the given Set. A
+// nil and empty Sets are considered equivalent to Everything().
+// The Set is validated client-side, which allows to catch errors early.
+func ValidatedSelectorFromSet(ls Set) (Selector, error) {
+	if ls == nil || len(ls) == 0 {
+		return internalSelector{}, nil
+	}
+	requirements := make([]Requirement, 0, len(ls))
+	for label, value := range ls {
+		r, err := NewRequirement(label, selection.Equals, []string{value})
+		if err != nil {
+			return nil, err
+		}
+		requirements = append(requirements, *r)
+	}
+	// sort to have deterministic string representation
+	sort.Sort(ByKey(requirements))
+	return internalSelector(requirements), nil
+}
+
+// SelectorFromValidatedSet returns a Selector which will match exactly the given Set.
+// A nil and empty Sets are considered equivalent to Everything().
+// It assumes that Set is already validated and doesn't do any validation.
+// Note: this method copies the Set; if the Set is immutable, consider wrapping it with ValidatedSetSelector
+// instead, which does not copy.
+func SelectorFromValidatedSet(ls Set) Selector {
+	if ls == nil || len(ls) == 0 {
+		return internalSelector{}
+	}
+	requirements := make([]Requirement, 0, len(ls))
+	for label, value := range ls {
+		requirements = append(requirements, Requirement{key: label, operator: selection.Equals, strValues: []string{value}})
+	}
+	// sort to have deterministic string representation
+	sort.Sort(ByKey(requirements))
+	return internalSelector(requirements)
+}
+
+// ParseToRequirements takes a string representing a selector and returns a list of
+// requirements. This function is suitable for those callers that perform additional
+// processing on selector requirements.
+// See the documentation for Parse() function for more details.
+// TODO: Consider exporting the internalSelector type instead.
+func ParseToRequirements(selector string, opts ...field.PathOption) ([]Requirement, error) {
+	return parse(selector, field.ToPath(opts...))
+}
+
+// ValidatedSetSelector wraps a Set, allowing it to implement the Selector interface. Unlike
+// Set.AsSelectorPreValidated (which copies the input Set), this type simply wraps the underlying
+// Set. As a result, it is substantially more efficient. A nil and empty Sets are considered
+// equivalent to Everything().
+//
+// Callers MUST ensure the underlying Set is not mutated, and that it is already validated. If these
+// constraints are not met, Set.AsValidatedSelector should be preferred
+//
+// None of the Selector methods mutate the underlying Set, but Add() and Requirements() convert to
+// the less optimized version.
+type ValidatedSetSelector Set
+
+func (s ValidatedSetSelector) Matches(labels Labels) bool {
+	for k, v := range s {
+		val, exists := labels.Lookup(k)
+		if !exists || v != val {
+			return false
+		}
+	}
+	return true
+}
+
+func (s ValidatedSetSelector) Empty() bool {
+	return len(s) == 0
+}
+
+func (s ValidatedSetSelector) String() string {
+	keys := make([]string, 0, len(s))
+	for k := range s {
+		keys = append(keys, k)
+	}
+	// Ensure deterministic output
+	sort.Strings(keys)
+	b := strings.Builder{}
+	for i, key := range keys {
+		v := s[key]
+		b.Grow(len(key) + 2 + len(v))
+		if i != 0 {
+			b.WriteString(",")
+		}
+		b.WriteString(key)
+		b.WriteString("=")
+		b.WriteString(v)
+	}
+	return b.String()
+}
+
+func (s ValidatedSetSelector) Add(r ...Requirement) Selector {
+	return s.toFullSelector().Add(r...)
+}
+
+func (s ValidatedSetSelector) Requirements() (requirements Requirements, selectable bool) {
+	return s.toFullSelector().Requirements()
+}
+
+func (s ValidatedSetSelector) DeepCopySelector() Selector {
+	res := make(ValidatedSetSelector, len(s))
+	for k, v := range s {
+		res[k] = v
+	}
+	return res
+}
+
+func (s ValidatedSetSelector) RequiresExactMatch(label string) (value string, found bool) {
+	v, f := s[label]
+	return v, f
+}
+
+func (s ValidatedSetSelector) toFullSelector() Selector {
+	return SelectorFromValidatedSet(Set(s))
+}
+
+var _ Selector = ValidatedSetSelector{}
diff --git a/third_party/k8s.io/apimachinery/pkg/labels/selector_test.go b/third_party/k8s.io/apimachinery/pkg/labels/selector_test.go
new file mode 100644
index 0000000000..abe066154d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/labels/selector_test.go
@@ -0,0 +1,1227 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package labels
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"k8s.io/apimachinery/pkg/selection"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+var (
+	ignoreDetail = cmpopts.IgnoreFields(field.Error{}, "Detail")
+)
+
+func TestSelectorParse(t *testing.T) {
+	testGoodStrings := []string{
+		"x=a,y=b,z=c",
+		"",
+		"x!=a,y=b",
+		"x=",
+		"x= ",
+		"x=,z= ",
+		"x= ,z= ",
+		"!x",
+		"x>1",
+		"x>1,z<5",
+	}
+	testBadStrings := []string{
+		"x=a||y=b",
+		"x==a==b",
+		"!x=a",
+		"x<a",
+	}
+	for _, test := range testGoodStrings {
+		lq, err := Parse(test)
+		if err != nil {
+			t.Errorf("%v: error %v (%#v)\n", test, err, err)
+		}
+		if strings.Replace(test, " ", "", -1) != lq.String() {
+			t.Errorf("%v restring gave: %v\n", test, lq.String())
+		}
+	}
+	for _, test := range testBadStrings {
+		_, err := Parse(test)
+		if err == nil {
+			t.Errorf("%v: did not get expected error\n", test)
+		}
+	}
+}
+
+func TestDeterministicParse(t *testing.T) {
+	s1, err := Parse("x=a,a=x")
+	s2, err2 := Parse("a=x,x=a")
+	if err != nil || err2 != nil {
+		t.Errorf("Unexpected parse error")
+	}
+	if s1.String() != s2.String() {
+		t.Errorf("Non-deterministic parse")
+	}
+}
+
+func expectMatch(t *testing.T, selector string, ls Set) {
+	lq, err := Parse(selector)
+	if err != nil {
+		t.Errorf("Unable to parse %v as a selector\n", selector)
+		return
+	}
+	if !lq.Matches(ls) {
+		t.Errorf("Wanted %s to match '%s', but it did not.\n", selector, ls)
+	}
+}
+
+func expectNoMatch(t *testing.T, selector string, ls Set) {
+	lq, err := Parse(selector)
+	if err != nil {
+		t.Errorf("Unable to parse %v as a selector\n", selector)
+		return
+	}
+	if lq.Matches(ls) {
+		t.Errorf("Wanted '%s' to not match '%s', but it did.", selector, ls)
+	}
+}
+
+func TestEverything(t *testing.T) {
+	if !Everything().Matches(Set{"x": "y"}) {
+		t.Errorf("Nil selector didn't match")
+	}
+	if !Everything().Empty() {
+		t.Errorf("Everything was not empty")
+	}
+}
+
+func TestSelectorMatches(t *testing.T) {
+	expectMatch(t, "", Set{"x": "y"})
+	expectMatch(t, "x=y", Set{"x": "y"})
+	expectMatch(t, "x=y,z=w", Set{"x": "y", "z": "w"})
+	expectMatch(t, "x!=y,z!=w", Set{"x": "z", "z": "a"})
+	expectMatch(t, "notin=in", Set{"notin": "in"}) // in and notin in exactMatch
+	expectMatch(t, "x", Set{"x": "z"})
+	expectMatch(t, "!x", Set{"y": "z"})
+	expectMatch(t, "x>1", Set{"x": "2"})
+	expectMatch(t, "x<1", Set{"x": "0"})
+	expectNoMatch(t, "x=z", Set{})
+	expectNoMatch(t, "x=y", Set{"x": "z"})
+	expectNoMatch(t, "x=y,z=w", Set{"x": "w", "z": "w"})
+	expectNoMatch(t, "x!=y,z!=w", Set{"x": "z", "z": "w"})
+	expectNoMatch(t, "x", Set{"y": "z"})
+	expectNoMatch(t, "!x", Set{"x": "z"})
+	expectNoMatch(t, "x>1", Set{"x": "0"})
+	expectNoMatch(t, "x<1", Set{"x": "2"})
+
+	labelset := Set{
+		"foo": "bar",
+		"baz": "blah",
+	}
+	expectMatch(t, "foo=bar", labelset)
+	expectMatch(t, "baz=blah", labelset)
+	expectMatch(t, "foo=bar,baz=blah", labelset)
+	expectNoMatch(t, "foo=blah", labelset)
+	expectNoMatch(t, "baz=bar", labelset)
+	expectNoMatch(t, "foo=bar,foobar=bar,baz=blah", labelset)
+}
+
+func expectMatchDirect(t *testing.T, selector, ls Set) {
+	if !SelectorFromSet(selector).Matches(ls) {
+		t.Errorf("Wanted %s to match '%s', but it did not.\n", selector, ls)
+	}
+}
+
+//nolint:staticcheck,unused //iccheck // U1000 currently commented out in TODO of TestSetMatches
+func expectNoMatchDirect(t *testing.T, selector, ls Set) {
+	if SelectorFromSet(selector).Matches(ls) {
+		t.Errorf("Wanted '%s' to not match '%s', but it did.", selector, ls)
+	}
+}
+
+func TestSetMatches(t *testing.T) {
+	labelset := Set{
+		"foo": "bar",
+		"baz": "blah",
+	}
+	expectMatchDirect(t, Set{}, labelset)
+	expectMatchDirect(t, Set{"foo": "bar"}, labelset)
+	expectMatchDirect(t, Set{"baz": "blah"}, labelset)
+	expectMatchDirect(t, Set{"foo": "bar", "baz": "blah"}, labelset)
+
+	//TODO: bad values not handled for the moment in SelectorFromSet
+	//expectNoMatchDirect(t, Set{"foo": "=blah"}, labelset)
+	//expectNoMatchDirect(t, Set{"baz": "=bar"}, labelset)
+	//expectNoMatchDirect(t, Set{"foo": "=bar", "foobar": "bar", "baz": "blah"}, labelset)
+}
+
+func TestNilMapIsValid(t *testing.T) {
+	selector := Set(nil).AsSelector()
+	if selector == nil {
+		t.Errorf("Selector for nil set should be Everything")
+	}
+	if !selector.Empty() {
+		t.Errorf("Selector for nil set should be Empty")
+	}
+}
+
+func TestSetIsEmpty(t *testing.T) {
+	if !(Set{}).AsSelector().Empty() {
+		t.Errorf("Empty set should be empty")
+	}
+	if !(NewSelector()).Empty() {
+		t.Errorf("Nil Selector should be empty")
+	}
+}
+
+func TestLexer(t *testing.T) {
+	testcases := []struct {
+		s string
+		t Token
+	}{
+		{"", EndOfStringToken},
+		{",", CommaToken},
+		{"notin", NotInToken},
+		{"in", InToken},
+		{"=", EqualsToken},
+		{"==", DoubleEqualsToken},
+		{">", GreaterThanToken},
+		{"<", LessThanToken},
+		//Note that Lex returns the longest valid token found
+		{"!", DoesNotExistToken},
+		{"!=", NotEqualsToken},
+		{"(", OpenParToken},
+		{")", ClosedParToken},
+		//Non-"special" characters are considered part of an identifier
+		{"~", IdentifierToken},
+		{"||", IdentifierToken},
+	}
+	for _, v := range testcases {
+		l := &Lexer{s: v.s, pos: 0}
+		token, lit := l.Lex()
+		if token != v.t {
+			t.Errorf("Got %d it should be %d for '%s'", token, v.t, v.s)
+		}
+		if v.t != ErrorToken && lit != v.s {
+			t.Errorf("Got '%s' it should be '%s'", lit, v.s)
+		}
+	}
+}
+
+func TestLexerSequence(t *testing.T) {
+	testcases := []struct {
+		s string
+		t []Token
+	}{
+		{"key in ( value )", []Token{IdentifierToken, InToken, OpenParToken, IdentifierToken, ClosedParToken}},
+		{"key notin ( value )", []Token{IdentifierToken, NotInToken, OpenParToken, IdentifierToken, ClosedParToken}},
+		{"key in ( value1, value2 )", []Token{IdentifierToken, InToken, OpenParToken, IdentifierToken, CommaToken, IdentifierToken, ClosedParToken}},
+		{"key", []Token{IdentifierToken}},
+		{"!key", []Token{DoesNotExistToken, IdentifierToken}},
+		{"()", []Token{OpenParToken, ClosedParToken}},
+		{"x in (),y", []Token{IdentifierToken, InToken, OpenParToken, ClosedParToken, CommaToken, IdentifierToken}},
+		{"== != (), = notin", []Token{DoubleEqualsToken, NotEqualsToken, OpenParToken, ClosedParToken, CommaToken, EqualsToken, NotInToken}},
+		{"key>2", []Token{IdentifierToken, GreaterThanToken, IdentifierToken}},
+		{"key<1", []Token{IdentifierToken, LessThanToken, IdentifierToken}},
+	}
+	for _, v := range testcases {
+		var tokens []Token
+		l := &Lexer{s: v.s, pos: 0}
+		for {
+			token, _ := l.Lex()
+			if token == EndOfStringToken {
+				break
+			}
+			tokens = append(tokens, token)
+		}
+		if len(tokens) != len(v.t) {
+			t.Errorf("Bad number of tokens for '%s %d, %d", v.s, len(tokens), len(v.t))
+		}
+		for i := 0; i < min(len(tokens), len(v.t)); i++ {
+			if tokens[i] != v.t[i] {
+				t.Errorf("Test '%s': Mismatching in token type found '%v' it should be '%v'", v.s, tokens[i], v.t[i])
+			}
+		}
+	}
+}
+func TestParserLookahead(t *testing.T) {
+	testcases := []struct {
+		s string
+		t []Token
+	}{
+		{"key in ( value )", []Token{IdentifierToken, InToken, OpenParToken, IdentifierToken, ClosedParToken, EndOfStringToken}},
+		{"key notin ( value )", []Token{IdentifierToken, NotInToken, OpenParToken, IdentifierToken, ClosedParToken, EndOfStringToken}},
+		{"key in ( value1, value2 )", []Token{IdentifierToken, InToken, OpenParToken, IdentifierToken, CommaToken, IdentifierToken, ClosedParToken, EndOfStringToken}},
+		{"key", []Token{IdentifierToken, EndOfStringToken}},
+		{"!key", []Token{DoesNotExistToken, IdentifierToken, EndOfStringToken}},
+		{"()", []Token{OpenParToken, ClosedParToken, EndOfStringToken}},
+		{"", []Token{EndOfStringToken}},
+		{"x in (),y", []Token{IdentifierToken, InToken, OpenParToken, ClosedParToken, CommaToken, IdentifierToken, EndOfStringToken}},
+		{"== != (), = notin", []Token{DoubleEqualsToken, NotEqualsToken, OpenParToken, ClosedParToken, CommaToken, EqualsToken, NotInToken, EndOfStringToken}},
+		{"key>2", []Token{IdentifierToken, GreaterThanToken, IdentifierToken, EndOfStringToken}},
+		{"key<1", []Token{IdentifierToken, LessThanToken, IdentifierToken, EndOfStringToken}},
+	}
+	for _, v := range testcases {
+		p := &Parser{l: &Lexer{s: v.s, pos: 0}, position: 0}
+		p.scan()
+		if len(p.scannedItems) != len(v.t) {
+			t.Errorf("Expected %d items found %d", len(v.t), len(p.scannedItems))
+		}
+		for {
+			token, lit := p.lookahead(KeyAndOperator)
+
+			token2, lit2 := p.consume(KeyAndOperator)
+			if token == EndOfStringToken {
+				break
+			}
+			if token != token2 || lit != lit2 {
+				t.Errorf("Bad values")
+			}
+		}
+	}
+}
+
+func TestParseOperator(t *testing.T) {
+	testcases := []struct {
+		token         string
+		expectedError error
+	}{
+		{"in", nil},
+		{"=", nil},
+		{"==", nil},
+		{">", nil},
+		{"<", nil},
+		{"notin", nil},
+		{"!=", nil},
+		{"!", fmt.Errorf("found '%s', expected: %v", selection.DoesNotExist, strings.Join(binaryOperators, ", "))},
+		{"exists", fmt.Errorf("found '%s', expected: %v", selection.Exists, strings.Join(binaryOperators, ", "))},
+		{"(", fmt.Errorf("found '%s', expected: %v", "(", strings.Join(binaryOperators, ", "))},
+	}
+	for _, testcase := range testcases {
+		p := &Parser{l: &Lexer{s: testcase.token, pos: 0}, position: 0}
+		p.scan()
+
+		_, err := p.parseOperator()
+		if ok := reflect.DeepEqual(testcase.expectedError, err); !ok {
+			t.Errorf("\nexpect err [%v], \nactual err [%v]", testcase.expectedError, err)
+		}
+	}
+}
+
+func TestRequirementConstructor(t *testing.T) {
+	requirementConstructorTests := []struct {
+		Key     string
+		Op      selection.Operator
+		Vals    sets.String
+		WantErr field.ErrorList
+	}{
+		{
+			Key: "x1",
+			Op:  selection.In,
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values",
+					BadValue: []string{},
+				},
+			},
+		},
+		{
+			Key:  "x2",
+			Op:   selection.NotIn,
+			Vals: sets.NewString(),
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values",
+					BadValue: []string{},
+				},
+			},
+		},
+		{
+			Key:  "x3",
+			Op:   selection.In,
+			Vals: sets.NewString("foo"),
+		},
+		{
+			Key:  "x4",
+			Op:   selection.NotIn,
+			Vals: sets.NewString("foo"),
+		},
+		{
+			Key:  "x5",
+			Op:   selection.Equals,
+			Vals: sets.NewString("foo", "bar"),
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values",
+					BadValue: []string{"bar", "foo"},
+				},
+			},
+		},
+		{
+			Key: "x6",
+			Op:  selection.Exists,
+		},
+		{
+			Key: "x7",
+			Op:  selection.DoesNotExist,
+		},
+		{
+			Key:  "x8",
+			Op:   selection.Exists,
+			Vals: sets.NewString("foo"),
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values",
+					BadValue: []string{"foo"},
+				},
+			},
+		},
+		{
+			Key:  "x9",
+			Op:   selection.In,
+			Vals: sets.NewString("bar"),
+		},
+		{
+			Key:  "x10",
+			Op:   selection.In,
+			Vals: sets.NewString("bar"),
+		},
+		{
+			Key:  "x11",
+			Op:   selection.GreaterThan,
+			Vals: sets.NewString("1"),
+		},
+		{
+			Key:  "x12",
+			Op:   selection.LessThan,
+			Vals: sets.NewString("6"),
+		},
+		{
+			Key: "x13",
+			Op:  selection.GreaterThan,
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values",
+					BadValue: []string{},
+				},
+			},
+		},
+		{
+			Key:  "x14",
+			Op:   selection.GreaterThan,
+			Vals: sets.NewString("bar"),
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values[0]",
+					BadValue: "bar",
+				},
+			},
+		},
+		{
+			Key:  "x15",
+			Op:   selection.LessThan,
+			Vals: sets.NewString("bar"),
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values[0]",
+					BadValue: "bar",
+				},
+			},
+		},
+		{
+			Key: strings.Repeat("a", 254), //breaks DNS rule that len(key) <= 253
+			Op:  selection.Exists,
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "key",
+					BadValue: strings.Repeat("a", 254),
+				},
+			},
+		},
+		{
+			Key:  "x16",
+			Op:   selection.Equals,
+			Vals: sets.NewString(strings.Repeat("a", 254)),
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values[0][x16]",
+					BadValue: strings.Repeat("a", 254),
+				},
+			},
+		},
+		{
+			Key:  "x17",
+			Op:   selection.Equals,
+			Vals: sets.NewString("a b"),
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values[0][x17]",
+					BadValue: "a b",
+				},
+			},
+		},
+		{
+			Key: "x18",
+			Op:  "unsupportedOp",
+			WantErr: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeNotSupported,
+					Field:    "operator",
+					BadValue: selection.Operator("unsupportedOp"),
+				},
+			},
+		},
+	}
+	for _, rc := range requirementConstructorTests {
+		_, err := NewRequirement(rc.Key, rc.Op, rc.Vals.List())
+		if diff := cmp.Diff(rc.WantErr.ToAggregate(), err, ignoreDetail); diff != "" {
+			t.Errorf("NewRequirement test %v returned unexpected error (-want,+got):\n%s", rc.Key, diff)
+		}
+	}
+}
+
+func TestToString(t *testing.T) {
+	var req Requirement
+	toStringTests := []struct {
+		In    *internalSelector
+		Out   string
+		Valid bool
+	}{
+
+		{&internalSelector{
+			getRequirement("x", selection.In, sets.NewString("abc", "def"), t),
+			getRequirement("y", selection.NotIn, sets.NewString("jkl"), t),
+			getRequirement("z", selection.Exists, nil, t)},
+			"x in (abc,def),y notin (jkl),z", true},
+		{&internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString("abc", "def"), t),
+			getRequirement("y", selection.NotEquals, sets.NewString("jkl"), t),
+			getRequirement("z", selection.DoesNotExist, nil, t)},
+			"x notin (abc,def),y!=jkl,!z", true},
+		{&internalSelector{
+			getRequirement("x", selection.In, sets.NewString("abc", "def"), t),
+			req}, // adding empty req for the trailing ','
+			"x in (abc,def),", false},
+		{&internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString("abc"), t),
+			getRequirement("y", selection.In, sets.NewString("jkl", "mno"), t),
+			getRequirement("z", selection.NotIn, sets.NewString(""), t)},
+			"x notin (abc),y in (jkl,mno),z notin ()", true},
+		{&internalSelector{
+			getRequirement("x", selection.Equals, sets.NewString("abc"), t),
+			getRequirement("y", selection.DoubleEquals, sets.NewString("jkl"), t),
+			getRequirement("z", selection.NotEquals, sets.NewString("a"), t),
+			getRequirement("z", selection.Exists, nil, t)},
+			"x=abc,y==jkl,z!=a,z", true},
+		{&internalSelector{
+			getRequirement("x", selection.GreaterThan, sets.NewString("2"), t),
+			getRequirement("y", selection.LessThan, sets.NewString("8"), t),
+			getRequirement("z", selection.Exists, nil, t)},
+			"x>2,y<8,z", true},
+	}
+	for _, ts := range toStringTests {
+		if out := ts.In.String(); out == "" && ts.Valid {
+			t.Errorf("%#v.String() => '%v' expected no error", ts.In, out)
+		} else if out != ts.Out {
+			t.Errorf("%#v.String() => '%v' want '%v'", ts.In, out, ts.Out)
+		}
+	}
+}
+
+func TestRequirementSelectorMatching(t *testing.T) {
+	var req Requirement
+	labelSelectorMatchingTests := []struct {
+		Set   Set
+		Sel   Selector
+		Match bool
+	}{
+		{Set{"x": "foo", "y": "baz"}, &internalSelector{
+			req,
+		}, false},
+		{Set{"x": "foo", "y": "baz"}, &internalSelector{
+			getRequirement("x", selection.In, sets.NewString("foo"), t),
+			getRequirement("y", selection.NotIn, sets.NewString("alpha"), t),
+		}, true},
+		{Set{"x": "foo", "y": "baz"}, &internalSelector{
+			getRequirement("x", selection.In, sets.NewString("foo"), t),
+			getRequirement("y", selection.In, sets.NewString("alpha"), t),
+		}, false},
+		{Set{"y": ""}, &internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString(""), t),
+			getRequirement("y", selection.Exists, nil, t),
+		}, true},
+		{Set{"y": ""}, &internalSelector{
+			getRequirement("x", selection.DoesNotExist, nil, t),
+			getRequirement("y", selection.Exists, nil, t),
+		}, true},
+		{Set{"y": ""}, &internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString(""), t),
+			getRequirement("y", selection.DoesNotExist, nil, t),
+		}, false},
+		{Set{"y": "baz"}, &internalSelector{
+			getRequirement("x", selection.In, sets.NewString(""), t),
+		}, false},
+		{Set{"z": "2"}, &internalSelector{
+			getRequirement("z", selection.GreaterThan, sets.NewString("1"), t),
+		}, true},
+		{Set{"z": "v2"}, &internalSelector{
+			getRequirement("z", selection.GreaterThan, sets.NewString("1"), t),
+		}, false},
+	}
+	for _, lsm := range labelSelectorMatchingTests {
+		if match := lsm.Sel.Matches(lsm.Set); match != lsm.Match {
+			t.Errorf("%+v.Matches(%#v) => %v, want %v", lsm.Sel, lsm.Set, match, lsm.Match)
+		}
+	}
+}
+
+func TestSetSelectorParser(t *testing.T) {
+	setSelectorParserTests := []struct {
+		In    string
+		Out   Selector
+		Match bool
+		Valid bool
+	}{
+		{"", NewSelector(), true, true},
+		{"\rx", internalSelector{
+			getRequirement("x", selection.Exists, nil, t),
+		}, true, true},
+		{"this-is-a-dns.domain.com/key-with-dash", internalSelector{
+			getRequirement("this-is-a-dns.domain.com/key-with-dash", selection.Exists, nil, t),
+		}, true, true},
+		{"this-is-another-dns.domain.com/key-with-dash in (so,what)", internalSelector{
+			getRequirement("this-is-another-dns.domain.com/key-with-dash", selection.In, sets.NewString("so", "what"), t),
+		}, true, true},
+		{"0.1.2.domain/99 notin (10.10.100.1, tick.tack.clock)", internalSelector{
+			getRequirement("0.1.2.domain/99", selection.NotIn, sets.NewString("10.10.100.1", "tick.tack.clock"), t),
+		}, true, true},
+		{"foo  in	 (abc)", internalSelector{
+			getRequirement("foo", selection.In, sets.NewString("abc"), t),
+		}, true, true},
+		{"x notin\n (abc)", internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString("abc"), t),
+		}, true, true},
+		{"x  notin	\t	(abc,def)", internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString("abc", "def"), t),
+		}, true, true},
+		{"x in (abc,def)", internalSelector{
+			getRequirement("x", selection.In, sets.NewString("abc", "def"), t),
+		}, true, true},
+		{"x in (abc,)", internalSelector{
+			getRequirement("x", selection.In, sets.NewString("abc", ""), t),
+		}, true, true},
+		{"x in (abc,abc)", internalSelector{
+			getRequirement("x", selection.In, sets.NewString("abc"), t),
+		}, true, true},
+		{"x in ()", internalSelector{
+			getRequirement("x", selection.In, sets.NewString(""), t),
+		}, true, true},
+		{"x in (a,,)", internalSelector{
+			getRequirement("x", selection.In, sets.NewString("a", ""), t),
+		}, true, true},
+		{"x in (a,,,)", internalSelector{
+			getRequirement("x", selection.In, sets.NewString("a", ""), t),
+		}, true, true},
+		{"x in (a,,,,,,)", internalSelector{
+			getRequirement("x", selection.In, sets.NewString("a", ""), t),
+		}, true, true},
+		{"x in (a,,a,,a,,a,,)", internalSelector{
+			getRequirement("x", selection.In, sets.NewString("a", ""), t),
+		}, true, true},
+		{"x notin (abc,,def),bar,z in (),w", internalSelector{
+			getRequirement("bar", selection.Exists, nil, t),
+			getRequirement("w", selection.Exists, nil, t),
+			getRequirement("x", selection.NotIn, sets.NewString("abc", "", "def"), t),
+			getRequirement("z", selection.In, sets.NewString(""), t),
+		}, true, true},
+		{"x,y in (a)", internalSelector{
+			getRequirement("y", selection.In, sets.NewString("a"), t),
+			getRequirement("x", selection.Exists, nil, t),
+		}, false, true},
+		{"x=a", internalSelector{
+			getRequirement("x", selection.Equals, sets.NewString("a"), t),
+		}, true, true},
+		{"x>1", internalSelector{
+			getRequirement("x", selection.GreaterThan, sets.NewString("1"), t),
+		}, true, true},
+		{"x<7", internalSelector{
+			getRequirement("x", selection.LessThan, sets.NewString("7"), t),
+		}, true, true},
+		{"x=a,y!=b", internalSelector{
+			getRequirement("x", selection.Equals, sets.NewString("a"), t),
+			getRequirement("y", selection.NotEquals, sets.NewString("b"), t),
+		}, true, true},
+		{"x=a,y!=b,z in (h,i,j)", internalSelector{
+			getRequirement("x", selection.Equals, sets.NewString("a"), t),
+			getRequirement("y", selection.NotEquals, sets.NewString("b"), t),
+			getRequirement("z", selection.In, sets.NewString("h", "i", "j"), t),
+		}, true, true},
+		{"x=a||y=b", internalSelector{}, false, false},
+		{"x,,y", nil, true, false},
+		{",x,y", nil, true, false},
+		{"x nott in (y)", nil, true, false},
+		{"x notin ( )", internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString(""), t),
+		}, true, true},
+		{"x notin (, a)", internalSelector{
+			getRequirement("x", selection.NotIn, sets.NewString("", "a"), t),
+		}, true, true},
+		{"a in (xyz),", nil, true, false},
+		{"a in (xyz)b notin ()", nil, true, false},
+		{"a ", internalSelector{
+			getRequirement("a", selection.Exists, nil, t),
+		}, true, true},
+		{"a in (x,y,notin, z,in)", internalSelector{
+			getRequirement("a", selection.In, sets.NewString("in", "notin", "x", "y", "z"), t),
+		}, true, true}, // operator 'in' inside list of identifiers
+		{"a in (xyz abc)", nil, false, false}, // no comma
+		{"a notin(", nil, true, false},        // bad formed
+		{"a (", nil, false, false},            // cpar
+		{"(", nil, false, false},              // opar
+	}
+
+	for _, ssp := range setSelectorParserTests {
+		if sel, err := Parse(ssp.In); err != nil && ssp.Valid {
+			t.Errorf("Parse(%s) => %v expected no error", ssp.In, err)
+		} else if err == nil && !ssp.Valid {
+			t.Errorf("Parse(%s) => %+v expected error", ssp.In, sel)
+		} else if ssp.Match && !reflect.DeepEqual(sel, ssp.Out) {
+			t.Errorf("Parse(%s) => parse output '%#v' doesn't match '%#v' expected match", ssp.In, sel, ssp.Out)
+		}
+	}
+}
+
+func getRequirement(key string, op selection.Operator, vals sets.String, t *testing.T) Requirement {
+	req, err := NewRequirement(key, op, vals.List())
+	if err != nil {
+		t.Errorf("NewRequirement(%v, %v, %v) resulted in error:%v", key, op, vals, err)
+		return Requirement{}
+	}
+	return *req
+}
+
+func TestAdd(t *testing.T) {
+	testCases := []struct {
+		name        string
+		sel         Selector
+		key         string
+		operator    selection.Operator
+		values      []string
+		refSelector Selector
+	}{
+		{
+			"keyInOperator",
+			internalSelector{},
+			"key",
+			selection.In,
+			[]string{"value"},
+			internalSelector{Requirement{"key", selection.In, []string{"value"}}},
+		},
+		{
+			"keyEqualsOperator",
+			internalSelector{Requirement{"key", selection.In, []string{"value"}}},
+			"key2",
+			selection.Equals,
+			[]string{"value2"},
+			internalSelector{
+				Requirement{"key", selection.In, []string{"value"}},
+				Requirement{"key2", selection.Equals, []string{"value2"}},
+			},
+		},
+	}
+	for _, ts := range testCases {
+		req, err := NewRequirement(ts.key, ts.operator, ts.values)
+		if err != nil {
+			t.Errorf("%s - Unable to create labels.Requirement", ts.name)
+		}
+		ts.sel = ts.sel.Add(*req)
+		if !reflect.DeepEqual(ts.sel, ts.refSelector) {
+			t.Errorf("%s - Expected %v found %v", ts.name, ts.refSelector, ts.sel)
+		}
+	}
+}
+
+func TestSafeSort(t *testing.T) {
+	tests := []struct {
+		name   string
+		in     []string
+		inCopy []string
+		want   []string
+	}{
+		{
+			name:   "nil strings",
+			in:     nil,
+			inCopy: nil,
+			want:   nil,
+		},
+		{
+			name:   "ordered strings",
+			in:     []string{"bar", "foo"},
+			inCopy: []string{"bar", "foo"},
+			want:   []string{"bar", "foo"},
+		},
+		{
+			name:   "unordered strings",
+			in:     []string{"foo", "bar"},
+			inCopy: []string{"foo", "bar"},
+			want:   []string{"bar", "foo"},
+		},
+		{
+			name:   "duplicated strings",
+			in:     []string{"foo", "bar", "foo", "bar"},
+			inCopy: []string{"foo", "bar", "foo", "bar"},
+			want:   []string{"bar", "bar", "foo", "foo"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := safeSort(tt.in); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("safeSort() = %v, want %v", got, tt.want)
+			}
+			if !reflect.DeepEqual(tt.in, tt.inCopy) {
+				t.Errorf("after safeSort(), input = %v, want %v", tt.in, tt.inCopy)
+			}
+		})
+	}
+}
+
+func BenchmarkSelectorFromValidatedSet(b *testing.B) {
+	set := map[string]string{
+		"foo": "foo",
+		"bar": "bar",
+	}
+	matchee := Set(map[string]string{
+		"foo":   "foo",
+		"bar":   "bar",
+		"extra": "label",
+	})
+
+	for i := 0; i < b.N; i++ {
+		s := SelectorFromValidatedSet(set)
+		if s.Empty() {
+			b.Errorf("Unexpected selector")
+		}
+		if !s.Matches(matchee) {
+			b.Errorf("Unexpected match")
+		}
+	}
+}
+
+func BenchmarkSetSelector(b *testing.B) {
+	set := map[string]string{
+		"foo": "foo",
+		"bar": "bar",
+	}
+	matchee := Set(map[string]string{
+		"foo":   "foo",
+		"bar":   "bar",
+		"extra": "label",
+	})
+
+	for i := 0; i < b.N; i++ {
+		s := ValidatedSetSelector(set)
+		if s.Empty() {
+			b.Errorf("Unexpected selector")
+		}
+		if !s.Matches(matchee) {
+			b.Errorf("Unexpected match")
+		}
+	}
+}
+
+func TestSetSelectorString(t *testing.T) {
+	cases := []struct {
+		set Set
+		out string
+	}{
+		{
+			Set{},
+			"",
+		},
+		{
+			Set{"app": "foo"},
+			"app=foo",
+		},
+		{
+			Set{"app": "foo", "a": "b"},
+			"a=b,app=foo",
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.out, func(t *testing.T) {
+			if got := ValidatedSetSelector(tt.set).String(); tt.out != got {
+				t.Fatalf("expected %v, got %v", tt.out, got)
+			}
+		})
+	}
+}
+
+func TestRequiresExactMatch(t *testing.T) {
+	testCases := []struct {
+		name          string
+		sel           Selector
+		label         string
+		expectedFound bool
+		expectedValue string
+	}{
+		{
+			name:          "keyInOperatorExactMatch",
+			sel:           internalSelector{Requirement{"key", selection.In, []string{"value"}}},
+			label:         "key",
+			expectedFound: true,
+			expectedValue: "value",
+		},
+		{
+			name:          "keyInOperatorNotExactMatch",
+			sel:           internalSelector{Requirement{"key", selection.In, []string{"value", "value2"}}},
+			label:         "key",
+			expectedFound: false,
+			expectedValue: "",
+		},
+		{
+			name: "keyInOperatorNotExactMatch",
+			sel: internalSelector{
+				Requirement{"key", selection.In, []string{"value", "value1"}},
+				Requirement{"key2", selection.In, []string{"value2"}},
+			},
+			label:         "key2",
+			expectedFound: true,
+			expectedValue: "value2",
+		},
+		{
+			name:          "keyEqualOperatorExactMatch",
+			sel:           internalSelector{Requirement{"key", selection.Equals, []string{"value"}}},
+			label:         "key",
+			expectedFound: true,
+			expectedValue: "value",
+		},
+		{
+			name:          "keyDoubleEqualOperatorExactMatch",
+			sel:           internalSelector{Requirement{"key", selection.DoubleEquals, []string{"value"}}},
+			label:         "key",
+			expectedFound: true,
+			expectedValue: "value",
+		},
+		{
+			name:          "keyNotEqualOperatorExactMatch",
+			sel:           internalSelector{Requirement{"key", selection.NotEquals, []string{"value"}}},
+			label:         "key",
+			expectedFound: false,
+			expectedValue: "",
+		},
+		{
+			name: "keyEqualOperatorExactMatchFirst",
+			sel: internalSelector{
+				Requirement{"key", selection.In, []string{"value"}},
+				Requirement{"key2", selection.In, []string{"value2"}},
+			},
+			label:         "key",
+			expectedFound: true,
+			expectedValue: "value",
+		},
+	}
+	for _, ts := range testCases {
+		t.Run(ts.name, func(t *testing.T) {
+			value, found := ts.sel.RequiresExactMatch(ts.label)
+			if found != ts.expectedFound {
+				t.Errorf("Expected match %v, found %v", ts.expectedFound, found)
+			}
+			if found && value != ts.expectedValue {
+				t.Errorf("Expected value %v, found %v", ts.expectedValue, value)
+			}
+
+		})
+	}
+}
+
+func TestValidatedSelectorFromSet(t *testing.T) {
+	tests := []struct {
+		name             string
+		input            Set
+		expectedSelector internalSelector
+		expectedError    field.ErrorList
+	}{
+		{
+			name:  "Simple Set, no error",
+			input: Set{"key": "val"},
+			expectedSelector: internalSelector{
+				Requirement{
+					key:       "key",
+					operator:  selection.Equals,
+					strValues: []string{"val"},
+				},
+			},
+		},
+		{
+			name:  "Invalid Set, value too long",
+			input: Set{"Key": "axahm2EJ8Phiephe2eixohbee9eGeiyees1thuozi1xoh0GiuH3diewi8iem7Nui"},
+			expectedError: field.ErrorList{
+				&field.Error{
+					Type:     field.ErrorTypeInvalid,
+					Field:    "values[0][Key]",
+					BadValue: "axahm2EJ8Phiephe2eixohbee9eGeiyees1thuozi1xoh0GiuH3diewi8iem7Nui",
+				},
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		selector, err := ValidatedSelectorFromSet(tc.input)
+		if diff := cmp.Diff(tc.expectedError.ToAggregate(), err, ignoreDetail); diff != "" {
+			t.Errorf("ValidatedSelectorFromSet %#v returned unexpected error (-want,+got):\n%s", tc.name, diff)
+		}
+		if err == nil {
+			if diff := cmp.Diff(tc.expectedSelector, selector); diff != "" {
+				t.Errorf("ValidatedSelectorFromSet %#v returned unexpected selector (-want,+got):\n%s", tc.name, diff)
+			}
+		}
+	}
+}
+
+func BenchmarkRequirementString(b *testing.B) {
+	r := Requirement{
+		key:      "environment",
+		operator: selection.NotIn,
+		strValues: []string{
+			"dev",
+		},
+	}
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		if r.String() != "environment notin (dev)" {
+			b.Errorf("Unexpected Requirement string")
+		}
+	}
+}
+
+func BenchmarkRequirementMatches(b *testing.B) {
+	r := Requirement{
+		key:      "environment",
+		operator: selection.NotIn,
+		strValues: []string{
+			"dev",
+		},
+	}
+	labels := Set(map[string]string{
+		"key":         "value",
+		"environment": "dev",
+	})
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		r.Matches(labels)
+	}
+}
+
+func TestRequirementEqual(t *testing.T) {
+	tests := []struct {
+		name string
+		x, y *Requirement
+		want bool
+	}{
+		{
+			name: "same requirements should be equal",
+			x: &Requirement{
+				key:       "key",
+				operator:  selection.Equals,
+				strValues: []string{"foo", "bar"},
+			},
+			y: &Requirement{
+				key:       "key",
+				operator:  selection.Equals,
+				strValues: []string{"foo", "bar"},
+			},
+			want: true,
+		},
+		{
+			name: "requirements with different keys should not be equal",
+			x: &Requirement{
+				key:       "key1",
+				operator:  selection.Equals,
+				strValues: []string{"foo", "bar"},
+			},
+			y: &Requirement{
+				key:       "key2",
+				operator:  selection.Equals,
+				strValues: []string{"foo", "bar"},
+			},
+			want: false,
+		},
+		{
+			name: "requirements with different operators should not be equal",
+			x: &Requirement{
+				key:       "key",
+				operator:  selection.Equals,
+				strValues: []string{"foo", "bar"},
+			},
+			y: &Requirement{
+				key:       "key",
+				operator:  selection.In,
+				strValues: []string{"foo", "bar"},
+			},
+			want: false,
+		},
+		{
+			name: "requirements with different values should not be equal",
+			x: &Requirement{
+				key:       "key",
+				operator:  selection.Equals,
+				strValues: []string{"foo", "bar"},
+			},
+			y: &Requirement{
+				key:       "key",
+				operator:  selection.Equals,
+				strValues: []string{"foobar"},
+			},
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := cmp.Equal(tt.x, tt.y); got != tt.want {
+				t.Errorf("cmp.Equal() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestMatchesNothing(t *testing.T) {
+	tests := []struct {
+		name          string
+		selector      string
+		set           map[string]string
+		labelSelector Selector
+		want          bool
+	}{
+		{
+			name:          "MatchNothing should match Nothing()",
+			labelSelector: Nothing(),
+			want:          true,
+		},
+		{
+			name:          "MatchNothing should match sharedNothingSelector",
+			labelSelector: sharedNothingSelector,
+			want:          true,
+		},
+		{
+			name:          "MatchNothing should not match Everything()",
+			labelSelector: Everything(),
+			want:          false,
+		},
+		{
+			name:          "MatchNothing should not match sharedEverythingSelector",
+			labelSelector: sharedEverythingSelector,
+			want:          false,
+		},
+		{
+			name: "MatchNothing should not match empty set",
+			set:  map[string]string{},
+			want: false,
+		},
+		{
+			name: "MatchNothing should not match non-empty set",
+			set:  map[string]string{"key": "value"},
+			want: false,
+		},
+		{
+			name:     "MatchNothing should not match empty selector",
+			selector: "",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - exists",
+			selector: "a",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - not exists",
+			selector: "!a",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - equals",
+			selector: "a=b",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - not equals",
+			selector: "a!=b",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - in",
+			selector: "a in (b)",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - notin",
+			selector: "a notin (b)",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - conflict exists and not exists",
+			selector: "a,!a",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - conflict equals and not equals",
+			selector: "a=b,a!=b",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - conflict in and notin",
+			selector: "a in (b),a notin (b)",
+			want:     false,
+		},
+	}
+
+	for i := 0; i < len(tests); i++ {
+		if tests[i].labelSelector != nil {
+			expectMatchNothing(t, tests[i].labelSelector, tests[i].want)
+		} else if tests[i].set != nil {
+			expectMatchNothing(t, SelectorFromSet(tests[i].set), tests[i].want)
+		} else {
+			selector, err := Parse(tests[i].selector)
+			if err != nil {
+				t.Errorf("Unable to parse %v as a selector.\n", selector)
+			}
+			expectMatchNothing(t, selector, tests[i].want)
+		}
+	}
+}
+
+func expectMatchNothing(t *testing.T, selector Selector, want bool) {
+	if MatchesNothing(selector) != want {
+		t.Errorf("Wanted %s to MatchNothing '%t', but it did not.\n", selector, want)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/labels/zz_generated.deepcopy.go b/third_party/k8s.io/apimachinery/pkg/labels/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..fdf4c31e1e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/labels/zz_generated.deepcopy.go
@@ -0,0 +1,43 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package labels
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Requirement) DeepCopyInto(out *Requirement) {
+	*out = *in
+	if in.strValues != nil {
+		in, out := &in.strValues, &out.strValues
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Requirement.
+func (in *Requirement) DeepCopy() *Requirement {
+	if in == nil {
+		return nil
+	}
+	out := new(Requirement)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/allocator.go b/third_party/k8s.io/apimachinery/pkg/runtime/allocator.go
new file mode 100644
index 0000000000..8bf22ae8ac
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/allocator.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"sync"
+)
+
+// AllocatorPool simply stores Allocator objects to avoid additional memory allocations
+// by caching created but unused items for later reuse, relieving pressure on the garbage collector.
+//
+// Usage:
+//
+//	memoryAllocator := runtime.AllocatorPool.Get().(*runtime.Allocator)
+//	defer runtime.AllocatorPool.Put(memoryAllocator)
+//
+// A note for future:
+//
+//	consider introducing multiple pools for storing buffers of different sizes
+//	perhaps this could allow us to be more efficient.
+var AllocatorPool = sync.Pool{
+	New: func() interface{} {
+		return &Allocator{}
+	},
+}
+
+// Allocator knows how to allocate memory
+// It exists to make the cost of object serialization cheaper.
+// In some cases, it allows for allocating memory only once and then reusing it.
+// This approach puts less load on GC and leads to less fragmented memory in general.
+type Allocator struct {
+	buf []byte
+}
+
+var _ MemoryAllocator = &Allocator{}
+
+// Allocate reserves memory for n bytes only if the underlying array doesn't have enough capacity
+// otherwise it returns previously allocated block of memory.
+//
+// Note that the returned array is not zeroed, it is the caller's
+// responsibility to clean the memory if needed.
+func (a *Allocator) Allocate(n uint64) []byte {
+	if uint64(cap(a.buf)) >= n {
+		a.buf = a.buf[:n]
+		return a.buf
+	}
+	// grow the buffer
+	size := uint64(2*cap(a.buf)) + n
+	a.buf = make([]byte, size)
+	a.buf = a.buf[:n]
+	return a.buf
+}
+
+// SimpleAllocator a wrapper around make([]byte)
+// conforms to the MemoryAllocator interface
+type SimpleAllocator struct{}
+
+var _ MemoryAllocator = &SimpleAllocator{}
+
+func (sa *SimpleAllocator) Allocate(n uint64) []byte {
+	return make([]byte, n)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/allocator_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/allocator_test.go
new file mode 100644
index 0000000000..067a5dda5e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/allocator_test.go
@@ -0,0 +1,78 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"math/rand"
+	"testing"
+)
+
+func TestAllocatorRandomInputs(t *testing.T) {
+	maxBytes := 5 * 1000000 // 5 MB
+	iterations := rand.Intn(10000) + 10
+	target := &Allocator{}
+
+	for i := 0; i < iterations; i++ {
+		bytesToAllocate := rand.Intn(maxBytes)
+		buff := target.Allocate(uint64(bytesToAllocate))
+		if cap(buff) < bytesToAllocate {
+			t.Fatalf("expected the buffer to allocate: %v bytes whereas it allocated: %v bytes", bytesToAllocate, cap(buff))
+		}
+		if len(buff) != bytesToAllocate {
+			t.Fatalf("unexpected length of the buffer, expected: %v, got: %v", bytesToAllocate, len(buff))
+		}
+	}
+}
+
+func TestAllocatorNeverShrinks(t *testing.T) {
+	target := &Allocator{}
+	initialSize := 1000000 // 1MB
+	initialBuff := target.Allocate(uint64(initialSize))
+	if cap(initialBuff) < initialSize {
+		t.Fatalf("unexpected size of the buffer, expected at least 1MB, got: %v", cap(initialBuff))
+	}
+
+	for i := initialSize; i > 0; i = i / 10 {
+		newBuff := target.Allocate(uint64(i))
+		if cap(newBuff) < initialSize {
+			t.Fatalf("allocator is now allowed to shrink memory")
+		}
+		if len(newBuff) != i {
+			t.Fatalf("unexpected length of the buffer, expected: %v, got: %v", i, len(newBuff))
+		}
+	}
+}
+
+func TestAllocatorZero(t *testing.T) {
+	target := &Allocator{}
+	initialSize := 1000000 // 1MB
+	buff := target.Allocate(uint64(initialSize))
+	if cap(buff) < initialSize {
+		t.Fatalf("unexpected size of the buffer, expected at least 1MB, got: %v", cap(buff))
+	}
+	if len(buff) != initialSize {
+		t.Fatalf("unexpected length of the buffer, expected: %v, got: %v", initialSize, len(buff))
+	}
+
+	buff = target.Allocate(0)
+	if cap(buff) < initialSize {
+		t.Fatalf("unexpected size of the buffer, expected at least 1MB, got: %v", cap(buff))
+	}
+	if len(buff) != 0 {
+		t.Fatalf("unexpected length of the buffer, expected: 0, got: %v", len(buff))
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/codec.go b/third_party/k8s.io/apimachinery/pkg/runtime/codec.go
new file mode 100644
index 0000000000..654835b3ed
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/codec.go
@@ -0,0 +1,398 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/url"
+	"reflect"
+	"strconv"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/conversion/queryparams"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/klog/v2"
+)
+
+// codec binds an encoder and decoder.
+type codec struct {
+	Encoder
+	Decoder
+}
+
+// NewCodec creates a Codec from an Encoder and Decoder.
+func NewCodec(e Encoder, d Decoder) Codec {
+	return codec{e, d}
+}
+
+// Encode is a convenience wrapper for encoding to a []byte from an Encoder
+func Encode(e Encoder, obj Object) ([]byte, error) {
+	buf := &bytes.Buffer{}
+	if err := e.Encode(obj, buf); err != nil {
+		return nil, err
+	}
+	return buf.Bytes(), nil
+}
+
+// Decode is a convenience wrapper for decoding data into an Object.
+func Decode(d Decoder, data []byte) (Object, error) {
+	obj, _, err := d.Decode(data, nil, nil)
+	return obj, err
+}
+
+// DecodeInto performs a Decode into the provided object.
+func DecodeInto(d Decoder, data []byte, into Object) error {
+	out, gvk, err := d.Decode(data, nil, into)
+	if err != nil {
+		return err
+	}
+	if out != into {
+		return fmt.Errorf("unable to decode %s into %v", gvk, reflect.TypeOf(into))
+	}
+	return nil
+}
+
+// EncodeOrDie is a version of Encode which will panic instead of returning an error. For tests.
+func EncodeOrDie(e Encoder, obj Object) string {
+	bytes, err := Encode(e, obj)
+	if err != nil {
+		panic(err)
+	}
+	return string(bytes)
+}
+
+// UseOrCreateObject returns obj if the canonical ObjectKind returned by the provided typer matches gvk, or
+// invokes the ObjectCreator to instantiate a new gvk. Returns an error if the typer cannot find the object.
+func UseOrCreateObject(t ObjectTyper, c ObjectCreater, gvk schema.GroupVersionKind, obj Object) (Object, error) {
+	if obj != nil {
+		kinds, _, err := t.ObjectKinds(obj)
+		if err != nil {
+			return nil, err
+		}
+		for _, kind := range kinds {
+			if gvk == kind {
+				return obj, nil
+			}
+		}
+	}
+	return c.New(gvk)
+}
+
+// NoopEncoder converts an Decoder to a Serializer or Codec for code that expects them but only uses decoding.
+type NoopEncoder struct {
+	Decoder
+}
+
+var _ Serializer = NoopEncoder{}
+
+const noopEncoderIdentifier Identifier = "noop"
+
+func (n NoopEncoder) Encode(obj Object, w io.Writer) error {
+	// There is no need to handle runtime.CacheableObject, as we don't
+	// process the obj at all.
+	return fmt.Errorf("encoding is not allowed for this codec: %v", reflect.TypeOf(n.Decoder))
+}
+
+// Identifier implements runtime.Encoder interface.
+func (n NoopEncoder) Identifier() Identifier {
+	return noopEncoderIdentifier
+}
+
+// NoopDecoder converts an Encoder to a Serializer or Codec for code that expects them but only uses encoding.
+type NoopDecoder struct {
+	Encoder
+}
+
+var _ Serializer = NoopDecoder{}
+
+func (n NoopDecoder) Decode(data []byte, gvk *schema.GroupVersionKind, into Object) (Object, *schema.GroupVersionKind, error) {
+	return nil, nil, fmt.Errorf("decoding is not allowed for this codec: %v", reflect.TypeOf(n.Encoder))
+}
+
+// NewParameterCodec creates a ParameterCodec capable of transforming url values into versioned objects and back.
+func NewParameterCodec(scheme *Scheme) ParameterCodec {
+	return &parameterCodec{
+		typer:     scheme,
+		convertor: scheme,
+		creator:   scheme,
+		defaulter: scheme,
+	}
+}
+
+// parameterCodec implements conversion to and from query parameters and objects.
+type parameterCodec struct {
+	typer     ObjectTyper
+	convertor ObjectConvertor
+	creator   ObjectCreater
+	defaulter ObjectDefaulter
+}
+
+var _ ParameterCodec = &parameterCodec{}
+
+// DecodeParameters converts the provided url.Values into an object of type From with the kind of into, and then
+// converts that object to into (if necessary). Returns an error if the operation cannot be completed.
+func (c *parameterCodec) DecodeParameters(parameters url.Values, from schema.GroupVersion, into Object) error {
+	if len(parameters) == 0 {
+		return nil
+	}
+	targetGVKs, _, err := c.typer.ObjectKinds(into)
+	if err != nil {
+		return err
+	}
+	for i := range targetGVKs {
+		if targetGVKs[i].GroupVersion() == from {
+			if err := c.convertor.Convert(&parameters, into, nil); err != nil {
+				return err
+			}
+			// in the case where we going into the same object we're receiving, default on the outbound object
+			if c.defaulter != nil {
+				c.defaulter.Default(into)
+			}
+			return nil
+		}
+	}
+
+	input, err := c.creator.New(from.WithKind(targetGVKs[0].Kind))
+	if err != nil {
+		return err
+	}
+	if err := c.convertor.Convert(&parameters, input, nil); err != nil {
+		return err
+	}
+	// if we have defaulter, default the input before converting to output
+	if c.defaulter != nil {
+		c.defaulter.Default(input)
+	}
+	return c.convertor.Convert(input, into, nil)
+}
+
+// EncodeParameters converts the provided object into the to version, then converts that object to url.Values.
+// Returns an error if conversion is not possible.
+func (c *parameterCodec) EncodeParameters(obj Object, to schema.GroupVersion) (url.Values, error) {
+	gvks, _, err := c.typer.ObjectKinds(obj)
+	if err != nil {
+		return nil, err
+	}
+	gvk := gvks[0]
+	if to != gvk.GroupVersion() {
+		out, err := c.convertor.ConvertToVersion(obj, to)
+		if err != nil {
+			return nil, err
+		}
+		obj = out
+	}
+	return queryparams.Convert(obj)
+}
+
+type base64Serializer struct {
+	Encoder
+	Decoder
+
+	identifier Identifier
+}
+
+func NewBase64Serializer(e Encoder, d Decoder) Serializer {
+	return &base64Serializer{
+		Encoder:    e,
+		Decoder:    d,
+		identifier: identifier(e),
+	}
+}
+
+func identifier(e Encoder) Identifier {
+	result := map[string]string{
+		"name": "base64",
+	}
+	if e != nil {
+		result["encoder"] = string(e.Identifier())
+	}
+	identifier, err := json.Marshal(result)
+	if err != nil {
+		//nolint:logcheck // Should not be reached.
+		klog.Fatalf("Failed marshaling identifier for base64Serializer: %v", err)
+	}
+	return Identifier(identifier)
+}
+
+func (s base64Serializer) Encode(obj Object, stream io.Writer) error {
+	if co, ok := obj.(CacheableObject); ok {
+		return co.CacheEncode(s.Identifier(), s.doEncode, stream)
+	}
+	return s.doEncode(obj, stream)
+}
+
+func (s base64Serializer) doEncode(obj Object, stream io.Writer) error {
+	e := base64.NewEncoder(base64.StdEncoding, stream)
+	err := s.Encoder.Encode(obj, e)
+	e.Close()
+	return err
+}
+
+// Identifier implements runtime.Encoder interface.
+func (s base64Serializer) Identifier() Identifier {
+	return s.identifier
+}
+
+func (s base64Serializer) Decode(data []byte, defaults *schema.GroupVersionKind, into Object) (Object, *schema.GroupVersionKind, error) {
+	out := make([]byte, base64.StdEncoding.DecodedLen(len(data)))
+	n, err := base64.StdEncoding.Decode(out, data)
+	if err != nil {
+		return nil, nil, err
+	}
+	return s.Decoder.Decode(out[:n], defaults, into)
+}
+
+// SerializerInfoForMediaType returns the first info in types that has a matching media type (which cannot
+// include media-type parameters), or the first info with an empty media type, or false if no type matches.
+func SerializerInfoForMediaType(types []SerializerInfo, mediaType string) (SerializerInfo, bool) {
+	for _, info := range types {
+		if info.MediaType == mediaType {
+			return info, true
+		}
+	}
+	for _, info := range types {
+		if len(info.MediaType) == 0 {
+			return info, true
+		}
+	}
+	return SerializerInfo{}, false
+}
+
+var (
+	// InternalGroupVersioner will always prefer the internal version for a given group version kind.
+	InternalGroupVersioner GroupVersioner = internalGroupVersioner{}
+	// DisabledGroupVersioner will reject all kinds passed to it.
+	DisabledGroupVersioner GroupVersioner = disabledGroupVersioner{}
+)
+
+const (
+	internalGroupVersionerIdentifier = "internal"
+	disabledGroupVersionerIdentifier = "disabled"
+)
+
+type internalGroupVersioner struct{}
+
+// KindForGroupVersionKinds returns an internal Kind if one is found, or converts the first provided kind to the internal version.
+func (internalGroupVersioner) KindForGroupVersionKinds(kinds []schema.GroupVersionKind) (schema.GroupVersionKind, bool) {
+	for _, kind := range kinds {
+		if kind.Version == APIVersionInternal {
+			return kind, true
+		}
+	}
+	for _, kind := range kinds {
+		return schema.GroupVersionKind{Group: kind.Group, Version: APIVersionInternal, Kind: kind.Kind}, true
+	}
+	return schema.GroupVersionKind{}, false
+}
+
+// Identifier implements GroupVersioner interface.
+func (internalGroupVersioner) Identifier() string {
+	return internalGroupVersionerIdentifier
+}
+
+type disabledGroupVersioner struct{}
+
+// KindForGroupVersionKinds returns false for any input.
+func (disabledGroupVersioner) KindForGroupVersionKinds(kinds []schema.GroupVersionKind) (schema.GroupVersionKind, bool) {
+	return schema.GroupVersionKind{}, false
+}
+
+// Identifier implements GroupVersioner interface.
+func (disabledGroupVersioner) Identifier() string {
+	return disabledGroupVersionerIdentifier
+}
+
+// Assert that schema.GroupVersion and GroupVersions implement GroupVersioner
+var _ GroupVersioner = schema.GroupVersion{}
+var _ GroupVersioner = schema.GroupVersions{}
+var _ GroupVersioner = multiGroupVersioner{}
+
+type multiGroupVersioner struct {
+	target             schema.GroupVersion
+	acceptedGroupKinds []schema.GroupKind
+	coerce             bool
+}
+
+// NewMultiGroupVersioner returns the provided group version for any kind that matches one of the provided group kinds.
+// Kind may be empty in the provided group kind, in which case any kind will match.
+func NewMultiGroupVersioner(gv schema.GroupVersion, groupKinds ...schema.GroupKind) GroupVersioner {
+	if len(groupKinds) == 0 || (len(groupKinds) == 1 && groupKinds[0].Group == gv.Group) {
+		return gv
+	}
+	return multiGroupVersioner{target: gv, acceptedGroupKinds: groupKinds}
+}
+
+// NewCoercingMultiGroupVersioner returns the provided group version for any incoming kind.
+// Incoming kinds that match the provided groupKinds are preferred.
+// Kind may be empty in the provided group kind, in which case any kind will match.
+// Examples:
+//
+//	gv=mygroup/__internal, groupKinds=mygroup/Foo, anothergroup/Bar
+//	KindForGroupVersionKinds(yetanother/v1/Baz, anothergroup/v1/Bar) -> mygroup/__internal/Bar (matched preferred group/kind)
+//
+//	gv=mygroup/__internal, groupKinds=mygroup, anothergroup
+//	KindForGroupVersionKinds(yetanother/v1/Baz, anothergroup/v1/Bar) -> mygroup/__internal/Bar (matched preferred group)
+//
+//	gv=mygroup/__internal, groupKinds=mygroup, anothergroup
+//	KindForGroupVersionKinds(yetanother/v1/Baz, yetanother/v1/Bar) -> mygroup/__internal/Baz (no preferred group/kind match, uses first kind in list)
+func NewCoercingMultiGroupVersioner(gv schema.GroupVersion, groupKinds ...schema.GroupKind) GroupVersioner {
+	return multiGroupVersioner{target: gv, acceptedGroupKinds: groupKinds, coerce: true}
+}
+
+// KindForGroupVersionKinds returns the target group version if any kind matches any of the original group kinds. It will
+// use the originating kind where possible.
+func (v multiGroupVersioner) KindForGroupVersionKinds(kinds []schema.GroupVersionKind) (schema.GroupVersionKind, bool) {
+	for _, src := range kinds {
+		for _, kind := range v.acceptedGroupKinds {
+			if kind.Group != src.Group {
+				continue
+			}
+			if len(kind.Kind) > 0 && kind.Kind != src.Kind {
+				continue
+			}
+			return v.target.WithKind(src.Kind), true
+		}
+	}
+	if v.coerce && len(kinds) > 0 {
+		return v.target.WithKind(kinds[0].Kind), true
+	}
+	return schema.GroupVersionKind{}, false
+}
+
+// Identifier implements GroupVersioner interface.
+func (v multiGroupVersioner) Identifier() string {
+	groupKinds := make([]string, 0, len(v.acceptedGroupKinds))
+	for _, gk := range v.acceptedGroupKinds {
+		groupKinds = append(groupKinds, gk.String())
+	}
+	result := map[string]string{
+		"name":     "multi",
+		"target":   v.target.String(),
+		"accepted": strings.Join(groupKinds, ","),
+		"coerce":   strconv.FormatBool(v.coerce),
+	}
+	identifier, err := json.Marshal(result)
+	if err != nil {
+		//nolint:logcheck // Should not be reached.
+		klog.Fatalf("Failed marshaling Identifier for %#v: %v", v, err)
+	}
+	return string(identifier)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/codec_check.go b/third_party/k8s.io/apimachinery/pkg/runtime/codec_check.go
new file mode 100644
index 0000000000..e884007766
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/codec_check.go
@@ -0,0 +1,56 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"fmt"
+	"reflect"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/json"
+)
+
+// CheckCodec makes sure that the codec can encode objects like internalType,
+// decode all of the external types listed, and also decode them into the given
+// object. (Will modify internalObject.) (Assumes JSON serialization.)
+// TODO: verify that the correct external version is chosen on encode...
+func CheckCodec(c Codec, internalType Object, externalTypes ...schema.GroupVersionKind) error {
+	if _, err := Encode(c, internalType); err != nil {
+		return fmt.Errorf("internal type not encodable: %v", err)
+	}
+	for _, et := range externalTypes {
+		typeMeta := TypeMeta{
+			Kind:       et.Kind,
+			APIVersion: et.GroupVersion().String(),
+		}
+		exBytes, err := json.Marshal(&typeMeta)
+		if err != nil {
+			return err
+		}
+		obj, err := Decode(c, exBytes)
+		if err != nil {
+			return fmt.Errorf("external type %s not interpretable: %v", et, err)
+		}
+		if reflect.TypeOf(obj) != reflect.TypeOf(internalType) {
+			return fmt.Errorf("decode of external type %s produced: %#v", et, obj)
+		}
+		if err = DecodeInto(c, exBytes, internalType); err != nil {
+			return fmt.Errorf("external type %s not convertible to internal type: %v", et, err)
+		}
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/codec_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/codec_test.go
new file mode 100644
index 0000000000..9425db212a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/codec_test.go
@@ -0,0 +1,104 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime_test
+
+import (
+	"io"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+)
+
+func gv(group, version string) schema.GroupVersion {
+	return schema.GroupVersion{Group: group, Version: version}
+}
+func gvk(group, version, kind string) schema.GroupVersionKind {
+	return schema.GroupVersionKind{Group: group, Version: version, Kind: kind}
+}
+func gk(group, kind string) schema.GroupKind {
+	return schema.GroupKind{Group: group, Kind: kind}
+}
+
+func TestCoercingMultiGroupVersioner(t *testing.T) {
+	testcases := []struct {
+		name           string
+		target         schema.GroupVersion
+		preferredKinds []schema.GroupKind
+		kinds          []schema.GroupVersionKind
+		expectKind     schema.GroupVersionKind
+		expectedId     string
+	}{
+		{
+			name:           "matched preferred group/kind",
+			target:         gv("mygroup", "__internal"),
+			preferredKinds: []schema.GroupKind{gk("mygroup", "Foo"), gk("anothergroup", "Bar")},
+			kinds:          []schema.GroupVersionKind{gvk("yetanother", "v1", "Baz"), gvk("anothergroup", "v1", "Bar")},
+			expectKind:     gvk("mygroup", "__internal", "Bar"),
+			expectedId:     "{\"accepted\":\"Foo.mygroup,Bar.anothergroup\",\"coerce\":\"true\",\"name\":\"multi\",\"target\":\"mygroup/__internal\"}",
+		},
+		{
+			name:           "matched preferred group",
+			target:         gv("mygroup", "__internal"),
+			preferredKinds: []schema.GroupKind{gk("mygroup", ""), gk("anothergroup", "")},
+			kinds:          []schema.GroupVersionKind{gvk("yetanother", "v1", "Baz"), gvk("anothergroup", "v1", "Bar")},
+			expectKind:     gvk("mygroup", "__internal", "Bar"),
+			expectedId:     "{\"accepted\":\".mygroup,.anothergroup\",\"coerce\":\"true\",\"name\":\"multi\",\"target\":\"mygroup/__internal\"}",
+		},
+		{
+			name:           "no preferred group/kind match, uses first kind in list",
+			target:         gv("mygroup", "__internal"),
+			preferredKinds: []schema.GroupKind{gk("mygroup", ""), gk("anothergroup", "")},
+			kinds:          []schema.GroupVersionKind{gvk("yetanother", "v1", "Baz"), gvk("yetanother", "v1", "Bar")},
+			expectKind:     gvk("mygroup", "__internal", "Baz"),
+			expectedId:     "{\"accepted\":\".mygroup,.anothergroup\",\"coerce\":\"true\",\"name\":\"multi\",\"target\":\"mygroup/__internal\"}",
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			v := runtime.NewCoercingMultiGroupVersioner(tc.target, tc.preferredKinds...)
+			kind, ok := v.KindForGroupVersionKinds(tc.kinds)
+			if !ok {
+				t.Error("got no kind")
+			}
+			if kind != tc.expectKind {
+				t.Errorf("expected %#v, got %#v", tc.expectKind, kind)
+			}
+			if e, a := tc.expectedId, v.Identifier(); e != a {
+				t.Errorf("unexpected identifier: %s, expected: %s", a, e)
+			}
+		})
+	}
+}
+
+type mockEncoder struct{}
+
+func (m *mockEncoder) Encode(obj runtime.Object, w io.Writer) error {
+	_, err := w.Write([]byte("mock-result"))
+	return err
+}
+
+func (m *mockEncoder) Identifier() runtime.Identifier {
+	return runtime.Identifier("mock-identifier")
+}
+
+func TestCacheableObject(t *testing.T) {
+	serializer := runtime.NewBase64Serializer(&mockEncoder{}, nil)
+	runtimetesting.CacheableObjectTest(t, serializer)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/conversion.go b/third_party/k8s.io/apimachinery/pkg/runtime/conversion.go
new file mode 100644
index 0000000000..7cef382de2
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/conversion.go
@@ -0,0 +1,183 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package runtime defines conversions between generic types and structs to map query strings
+// to struct objects.
+package runtime
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/conversion"
+)
+
+// DefaultMetaV1FieldSelectorConversion auto-accepts metav1 values for name and namespace.
+// A cluster scoped resource specifying namespace empty works fine and specifying a particular
+// namespace will return no results, as expected.
+func DefaultMetaV1FieldSelectorConversion(label, value string) (string, string, error) {
+	switch label {
+	case "metadata.name":
+		return label, value, nil
+	case "metadata.namespace":
+		return label, value, nil
+	default:
+		return "", "", fmt.Errorf("%q is not a known field selector: only %q, %q", label, "metadata.name", "metadata.namespace")
+	}
+}
+
+func Convert_Slice_string_To_string(in *[]string, out *string, s conversion.Scope) error {
+	if len(*in) == 0 {
+		*out = ""
+		return nil
+	}
+	*out = (*in)[0]
+	return nil
+}
+
+func Convert_Slice_string_To_int(in *[]string, out *int, s conversion.Scope) error {
+	if len(*in) == 0 {
+		*out = 0
+		return nil
+	}
+	str := (*in)[0]
+	i, err := strconv.Atoi(str)
+	if err != nil {
+		return err
+	}
+	*out = i
+	return nil
+}
+
+// Convert_Slice_string_To_bool will convert a string parameter to boolean.
+// Only the absence of a value (i.e. zero-length slice), a value of "false", or a
+// value of "0" resolve to false.
+// Any other value (including empty string) resolves to true.
+func Convert_Slice_string_To_bool(in *[]string, out *bool, s conversion.Scope) error {
+	if len(*in) == 0 {
+		*out = false
+		return nil
+	}
+	switch {
+	case (*in)[0] == "0", strings.EqualFold((*in)[0], "false"):
+		*out = false
+	default:
+		*out = true
+	}
+	return nil
+}
+
+// Convert_Slice_string_To_bool will convert a string parameter to boolean.
+// Only the absence of a value (i.e. zero-length slice), a value of "false", or a
+// value of "0" resolve to false.
+// Any other value (including empty string) resolves to true.
+func Convert_Slice_string_To_Pointer_bool(in *[]string, out **bool, s conversion.Scope) error {
+	if len(*in) == 0 {
+		boolVar := false
+		*out = &boolVar
+		return nil
+	}
+	switch {
+	case (*in)[0] == "0", strings.EqualFold((*in)[0], "false"):
+		boolVar := false
+		*out = &boolVar
+	default:
+		boolVar := true
+		*out = &boolVar
+	}
+	return nil
+}
+
+func string_to_int64(in string) (int64, error) {
+	return strconv.ParseInt(in, 10, 64)
+}
+
+func Convert_string_To_int64(in *string, out *int64, s conversion.Scope) error {
+	if in == nil {
+		*out = 0
+		return nil
+	}
+	i, err := string_to_int64(*in)
+	if err != nil {
+		return err
+	}
+	*out = i
+	return nil
+}
+
+func Convert_Slice_string_To_int64(in *[]string, out *int64, s conversion.Scope) error {
+	if len(*in) == 0 {
+		*out = 0
+		return nil
+	}
+	i, err := string_to_int64((*in)[0])
+	if err != nil {
+		return err
+	}
+	*out = i
+	return nil
+}
+
+func Convert_string_To_Pointer_int64(in *string, out **int64, s conversion.Scope) error {
+	if in == nil {
+		*out = nil
+		return nil
+	}
+	i, err := string_to_int64(*in)
+	if err != nil {
+		return err
+	}
+	*out = &i
+	return nil
+}
+
+func Convert_Slice_string_To_Pointer_int64(in *[]string, out **int64, s conversion.Scope) error {
+	if len(*in) == 0 {
+		*out = nil
+		return nil
+	}
+	i, err := string_to_int64((*in)[0])
+	if err != nil {
+		return err
+	}
+	*out = &i
+	return nil
+}
+
+func RegisterStringConversions(s *Scheme) error {
+	if err := s.AddConversionFunc((*[]string)(nil), (*string)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_string(a.(*[]string), b.(*string), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (*int)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_int(a.(*[]string), b.(*int), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (*bool)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_bool(a.(*[]string), b.(*bool), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*[]string)(nil), (*int64)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_Slice_string_To_int64(a.(*[]string), b.(*int64), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/converter.go b/third_party/k8s.io/apimachinery/pkg/runtime/converter.go
new file mode 100644
index 0000000000..5aa118f58f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/converter.go
@@ -0,0 +1,887 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	encodingjson "encoding/json"
+	"fmt"
+	"math"
+	"os"
+	"reflect"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"sigs.k8s.io/structured-merge-diff/v6/value"
+
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/util/json"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+
+	"k8s.io/klog/v2"
+)
+
+// UnstructuredConverter is an interface for converting between interface{}
+// and map[string]interface representation.
+type UnstructuredConverter interface {
+	ToUnstructured(obj interface{}) (map[string]interface{}, error)
+	FromUnstructured(u map[string]interface{}, obj interface{}) error
+}
+
+type structField struct {
+	structType reflect.Type
+	field      int
+}
+
+type fieldInfo struct {
+	name      string
+	nameValue reflect.Value
+	omitempty bool
+	omitzero  func(dv reflect.Value) bool
+}
+
+type fieldsCacheMap map[structField]*fieldInfo
+
+type fieldsCache struct {
+	sync.Mutex
+	value atomic.Value
+}
+
+func newFieldsCache() *fieldsCache {
+	cache := &fieldsCache{}
+	cache.value.Store(make(fieldsCacheMap))
+	return cache
+}
+
+var (
+	mapStringInterfaceType = reflect.TypeOf(map[string]interface{}{})
+	stringType             = reflect.TypeOf(string(""))
+	fieldCache             = newFieldsCache()
+
+	// DefaultUnstructuredConverter performs unstructured to Go typed object conversions.
+	DefaultUnstructuredConverter = &unstructuredConverter{
+		mismatchDetection: parseBool(os.Getenv("KUBE_PATCH_CONVERSION_DETECTOR")),
+		comparison: conversion.EqualitiesOrDie(
+			func(a, b time.Time) bool {
+				return a.UTC() == b.UTC()
+			},
+		),
+	}
+)
+
+func parseBool(key string) bool {
+	if len(key) == 0 {
+		return false
+	}
+	value, err := strconv.ParseBool(key)
+	if err != nil {
+		utilruntime.HandleError(fmt.Errorf("couldn't parse '%s' as bool for unstructured mismatch detection", key))
+	}
+	return value
+}
+
+// unstructuredConverter knows how to convert between interface{} and
+// Unstructured in both ways.
+type unstructuredConverter struct {
+	// If true, we will be additionally running conversion via json
+	// to ensure that the result is true.
+	// This is supposed to be set only in tests.
+	mismatchDetection bool
+	// comparison is the default test logic used to compare
+	comparison conversion.Equalities
+}
+
+// NewTestUnstructuredConverter creates an UnstructuredConverter that accepts JSON typed maps and translates them
+// to Go types via reflection. It performs mismatch detection automatically and is intended for use by external
+// test tools. Use DefaultUnstructuredConverter if you do not explicitly need mismatch detection.
+func NewTestUnstructuredConverter(comparison conversion.Equalities) UnstructuredConverter {
+	return NewTestUnstructuredConverterWithValidation(comparison)
+}
+
+// NewTestUnstrucutredConverterWithValidation allows for access to
+// FromUnstructuredWithValidation from within tests.
+func NewTestUnstructuredConverterWithValidation(comparison conversion.Equalities) *unstructuredConverter {
+	return &unstructuredConverter{
+		mismatchDetection: true,
+		comparison:        comparison,
+	}
+}
+
+// fromUnstructuredContext provides options for informing the converter
+// the state of its recursive walk through the conversion process.
+type fromUnstructuredContext struct {
+	// isInlined indicates whether the converter is currently in
+	// an inlined field or not to determine whether it should
+	// validate the matchedKeys yet or only collect them.
+	// This should only be set from `structFromUnstructured`
+	isInlined bool
+	// matchedKeys is a stack of the set of all fields that exist in the
+	// concrete go type of the object being converted into.
+	// This should only be manipulated via `pushMatchedKeyTracker`,
+	// `recordMatchedKey`, or `popAndVerifyMatchedKeys`
+	matchedKeys []map[string]struct{}
+	// parentPath collects the path that the conversion
+	// takes as it traverses the unstructured json map.
+	// It is used to report the full path to any unknown
+	// fields that the converter encounters.
+	parentPath []string
+	// returnUnknownFields indicates whether or not
+	// unknown field errors should be collected and
+	// returned to the caller
+	returnUnknownFields bool
+	// unknownFieldErrors are the collection of
+	// the full path to each unknown field in the
+	// object.
+	unknownFieldErrors []error
+}
+
+// pushMatchedKeyTracker adds a placeholder set for tracking
+// matched keys for the given level. This should only be
+// called from `structFromUnstructured`.
+func (c *fromUnstructuredContext) pushMatchedKeyTracker() {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	c.matchedKeys = append(c.matchedKeys, nil)
+}
+
+// recordMatchedKey initializes the last element of matchedKeys
+// (if needed) and sets 'key'. This should only be called from
+// `structFromUnstructured`.
+func (c *fromUnstructuredContext) recordMatchedKey(key string) {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	last := len(c.matchedKeys) - 1
+	if c.matchedKeys[last] == nil {
+		c.matchedKeys[last] = map[string]struct{}{}
+	}
+	c.matchedKeys[last][key] = struct{}{}
+}
+
+// popAndVerifyMatchedKeys pops the last element of matchedKeys,
+// checks the matched keys against the data, and adds unknown
+// field errors for any matched keys.
+// `mapValue` is the value of sv containing all of the keys that exist at this level
+// (ie. sv.MapKeys) in the source data.
+// `matchedKeys` are all the keys found for that level in the destination object.
+// This should only be called from `structFromUnstructured`.
+func (c *fromUnstructuredContext) popAndVerifyMatchedKeys(mapValue reflect.Value) {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	last := len(c.matchedKeys) - 1
+	curMatchedKeys := c.matchedKeys[last]
+	c.matchedKeys[last] = nil
+	c.matchedKeys = c.matchedKeys[:last]
+	for _, key := range mapValue.MapKeys() {
+		if _, ok := curMatchedKeys[key.String()]; !ok {
+			c.recordUnknownField(key.String())
+		}
+	}
+}
+
+func (c *fromUnstructuredContext) recordUnknownField(field string) {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	pathLen := len(c.parentPath)
+	c.pushKey(field)
+	errPath := strings.Join(c.parentPath, "")
+	c.parentPath = c.parentPath[:pathLen]
+	c.unknownFieldErrors = append(c.unknownFieldErrors, fmt.Errorf(`unknown field "%s"`, errPath))
+}
+
+func (c *fromUnstructuredContext) pushIndex(index int) {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	c.parentPath = append(c.parentPath, "[", strconv.Itoa(index), "]")
+}
+
+func (c *fromUnstructuredContext) pushKey(key string) {
+	if !c.returnUnknownFields {
+		return
+	}
+
+	if len(c.parentPath) > 0 {
+		c.parentPath = append(c.parentPath, ".")
+	}
+	c.parentPath = append(c.parentPath, key)
+
+}
+
+// FromUnstructuredWithValidation converts an object from map[string]interface{} representation into a concrete type.
+// It uses encoding/json/Unmarshaler if object implements it or reflection if not.
+// It takes a validationDirective that indicates how to behave when it encounters unknown fields.
+func (c *unstructuredConverter) FromUnstructuredWithValidation(u map[string]interface{}, obj interface{}, returnUnknownFields bool) error {
+	t := reflect.TypeOf(obj)
+	value := reflect.ValueOf(obj)
+	if t.Kind() != reflect.Pointer || value.IsNil() {
+		return fmt.Errorf("FromUnstructured requires a non-nil pointer to an object, got %v", t)
+	}
+
+	fromUnstructuredContext := &fromUnstructuredContext{
+		returnUnknownFields: returnUnknownFields,
+	}
+	err := fromUnstructured(reflect.ValueOf(u), value.Elem(), fromUnstructuredContext)
+	if c.mismatchDetection {
+		newObj := reflect.New(t.Elem()).Interface()
+		newErr := fromUnstructuredViaJSON(u, newObj)
+		if (err != nil) != (newErr != nil) {
+			//nolint:logcheck // Should not be reached.
+			klog.Fatalf("FromUnstructured unexpected error for %v: error: %v", u, err)
+		}
+		if err == nil && !c.comparison.DeepEqual(obj, newObj) {
+			//nolint:logcheck // Should not be reached.
+			klog.Fatalf("FromUnstructured mismatch\nobj1: %#v\nobj2: %#v", obj, newObj)
+		}
+	}
+	if err != nil {
+		return err
+	}
+	if returnUnknownFields && len(fromUnstructuredContext.unknownFieldErrors) > 0 {
+		sort.Slice(fromUnstructuredContext.unknownFieldErrors, func(i, j int) bool {
+			return fromUnstructuredContext.unknownFieldErrors[i].Error() <
+				fromUnstructuredContext.unknownFieldErrors[j].Error()
+		})
+		return NewStrictDecodingError(fromUnstructuredContext.unknownFieldErrors)
+	}
+	return nil
+}
+
+// FromUnstructured converts an object from map[string]interface{} representation into a concrete type.
+// It uses encoding/json/Unmarshaler if object implements it or reflection if not.
+func (c *unstructuredConverter) FromUnstructured(u map[string]interface{}, obj interface{}) error {
+	return c.FromUnstructuredWithValidation(u, obj, false)
+}
+
+func fromUnstructuredViaJSON(u map[string]interface{}, obj interface{}) error {
+	data, err := json.Marshal(u)
+	if err != nil {
+		return err
+	}
+	return json.Unmarshal(data, obj)
+}
+
+func fromUnstructured(sv, dv reflect.Value, ctx *fromUnstructuredContext) error {
+	sv = unwrapInterface(sv)
+	if !sv.IsValid() {
+		dv.Set(reflect.Zero(dv.Type()))
+		return nil
+	}
+	st, dt := sv.Type(), dv.Type()
+
+	switch dt.Kind() {
+	case reflect.Map, reflect.Slice, reflect.Pointer, reflect.Struct, reflect.Interface:
+		// Those require non-trivial conversion.
+	default:
+		// This should handle all simple types.
+		if st.AssignableTo(dt) {
+			dv.Set(sv)
+			return nil
+		}
+		// We cannot simply use "ConvertibleTo", as JSON doesn't support conversions
+		// between those four groups: bools, integers, floats and string. We need to
+		// do the same.
+		if st.ConvertibleTo(dt) {
+			switch st.Kind() {
+			case reflect.String:
+				switch dt.Kind() {
+				case reflect.String:
+					dv.Set(sv.Convert(dt))
+					return nil
+				}
+			case reflect.Bool:
+				switch dt.Kind() {
+				case reflect.Bool:
+					dv.Set(sv.Convert(dt))
+					return nil
+				}
+			case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+				reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+				switch dt.Kind() {
+				case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+					reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+					dv.Set(sv.Convert(dt))
+					return nil
+				case reflect.Float32, reflect.Float64:
+					dv.Set(sv.Convert(dt))
+					return nil
+				}
+			case reflect.Float32, reflect.Float64:
+				switch dt.Kind() {
+				case reflect.Float32, reflect.Float64:
+					dv.Set(sv.Convert(dt))
+					return nil
+				}
+				if sv.Float() == math.Trunc(sv.Float()) {
+					dv.Set(sv.Convert(dt))
+					return nil
+				}
+			}
+			return fmt.Errorf("cannot convert %s to %s", st.String(), dt.String())
+		}
+	}
+
+	// Check if the object has a custom JSON marshaller/unmarshaller.
+	entry := value.TypeReflectEntryOf(dv.Type())
+	if entry.CanConvertFromUnstructured() {
+		return entry.FromUnstructured(sv, dv)
+	}
+
+	switch dt.Kind() {
+	case reflect.Map:
+		return mapFromUnstructured(sv, dv, ctx)
+	case reflect.Slice:
+		return sliceFromUnstructured(sv, dv, ctx)
+	case reflect.Pointer:
+		return pointerFromUnstructured(sv, dv, ctx)
+	case reflect.Struct:
+		return structFromUnstructured(sv, dv, ctx)
+	case reflect.Interface:
+		return interfaceFromUnstructured(sv, dv)
+	default:
+		return fmt.Errorf("unrecognized type: %v", dt.Kind())
+	}
+
+}
+
+func fieldInfoFromField(structType reflect.Type, field int) *fieldInfo {
+	fieldCacheMap := fieldCache.value.Load().(fieldsCacheMap)
+	if info, ok := fieldCacheMap[structField{structType, field}]; ok {
+		return info
+	}
+
+	// Cache miss - we need to compute the field name.
+	info := &fieldInfo{}
+	typeField := structType.Field(field)
+	jsonTag, exists := typeField.Tag.Lookup("json")
+	if !exists || len(jsonTag) == 0 {
+		if !typeField.Anonymous {
+			// match stdlib behavior for naming fields that don't specify a json tag name
+			info.name = typeField.Name
+		}
+	} else {
+		items := strings.Split(jsonTag, ",")
+		info.name = items[0]
+		if isInlinedFromTag(typeField, items[0], items[1:]) {
+			// match stdlib behavior when controlled by tag
+			info.name = ""
+		} else if len(info.name) == 0 && !typeField.Anonymous {
+			// match stdlib behavior for naming fields that don't specify a json tag name
+			info.name = typeField.Name
+		}
+
+		for i := range items {
+			if i > 0 && items[i] == "omitempty" {
+				info.omitempty = true
+			}
+			if i > 0 && items[i] == "omitzero" {
+				info.omitzero = value.OmitZeroFunc(typeField.Type)
+			}
+		}
+	}
+	info.nameValue = reflect.ValueOf(info.name)
+
+	fieldCache.Lock()
+	defer fieldCache.Unlock()
+	fieldCacheMap = fieldCache.value.Load().(fieldsCacheMap)
+	newFieldCacheMap := make(fieldsCacheMap)
+	for k, v := range fieldCacheMap {
+		newFieldCacheMap[k] = v
+	}
+	newFieldCacheMap[structField{structType, field}] = info
+	fieldCache.value.Store(newFieldCacheMap)
+	return info
+}
+
+func unwrapInterface(v reflect.Value) reflect.Value {
+	for v.Kind() == reflect.Interface {
+		v = v.Elem()
+	}
+	return v
+}
+
+func mapFromUnstructured(sv, dv reflect.Value, ctx *fromUnstructuredContext) error {
+	st, dt := sv.Type(), dv.Type()
+	if st.Kind() != reflect.Map {
+		return fmt.Errorf("cannot restore map from %v", st.Kind())
+	}
+
+	if !st.Key().AssignableTo(dt.Key()) && !st.Key().ConvertibleTo(dt.Key()) {
+		return fmt.Errorf("cannot copy map with non-assignable keys: %v %v", st.Key(), dt.Key())
+	}
+
+	if sv.IsNil() {
+		dv.Set(reflect.Zero(dt))
+		return nil
+	}
+	dv.Set(reflect.MakeMap(dt))
+	for _, key := range sv.MapKeys() {
+		value := reflect.New(dt.Elem()).Elem()
+		if val := unwrapInterface(sv.MapIndex(key)); val.IsValid() {
+			if err := fromUnstructured(val, value, ctx); err != nil {
+				return err
+			}
+		} else {
+			value.Set(reflect.Zero(dt.Elem()))
+		}
+		if st.Key().AssignableTo(dt.Key()) {
+			dv.SetMapIndex(key, value)
+		} else {
+			dv.SetMapIndex(key.Convert(dt.Key()), value)
+		}
+	}
+	return nil
+}
+
+func sliceFromUnstructured(sv, dv reflect.Value, ctx *fromUnstructuredContext) error {
+	st, dt := sv.Type(), dv.Type()
+	if st.Kind() == reflect.String && dt.Elem().Kind() == reflect.Uint8 {
+		// We store original []byte representation as string.
+		// This conversion is allowed, but we need to be careful about
+		// marshaling data appropriately.
+		if len(sv.Interface().(string)) > 0 {
+			marshalled, err := json.Marshal(sv.Interface())
+			if err != nil {
+				return fmt.Errorf("error encoding %s to json: %v", st, err)
+			}
+			// TODO: Is this Unmarshal needed?
+			var data []byte
+			err = json.Unmarshal(marshalled, &data)
+			if err != nil {
+				return fmt.Errorf("error decoding from json: %v", err)
+			}
+			dv.SetBytes(data)
+		} else {
+			dv.Set(reflect.MakeSlice(dt, 0, 0))
+		}
+		return nil
+	}
+	if st.Kind() != reflect.Slice {
+		return fmt.Errorf("cannot restore slice from %v", st.Kind())
+	}
+
+	if sv.IsNil() {
+		dv.Set(reflect.Zero(dt))
+		return nil
+	}
+	dv.Set(reflect.MakeSlice(dt, sv.Len(), sv.Cap()))
+
+	pathLen := len(ctx.parentPath)
+	defer func() {
+		ctx.parentPath = ctx.parentPath[:pathLen]
+	}()
+	for i := 0; i < sv.Len(); i++ {
+		ctx.pushIndex(i)
+		if err := fromUnstructured(sv.Index(i), dv.Index(i), ctx); err != nil {
+			return err
+		}
+		ctx.parentPath = ctx.parentPath[:pathLen]
+	}
+	return nil
+}
+
+func pointerFromUnstructured(sv, dv reflect.Value, ctx *fromUnstructuredContext) error {
+	st, dt := sv.Type(), dv.Type()
+
+	if st.Kind() == reflect.Pointer && sv.IsNil() {
+		dv.Set(reflect.Zero(dt))
+		return nil
+	}
+	dv.Set(reflect.New(dt.Elem()))
+	switch st.Kind() {
+	case reflect.Pointer, reflect.Interface:
+		return fromUnstructured(sv.Elem(), dv.Elem(), ctx)
+	default:
+		return fromUnstructured(sv, dv.Elem(), ctx)
+	}
+}
+
+func structFromUnstructured(sv, dv reflect.Value, ctx *fromUnstructuredContext) error {
+	st, dt := sv.Type(), dv.Type()
+	if st.Kind() != reflect.Map {
+		return fmt.Errorf("cannot restore struct from: %v", st.Kind())
+	}
+
+	pathLen := len(ctx.parentPath)
+	svInlined := ctx.isInlined
+	defer func() {
+		ctx.parentPath = ctx.parentPath[:pathLen]
+		ctx.isInlined = svInlined
+	}()
+	if !svInlined {
+		ctx.pushMatchedKeyTracker()
+	}
+	for i := 0; i < dt.NumField(); i++ {
+		fieldInfo := fieldInfoFromField(dt, i)
+		fv := dv.Field(i)
+
+		if len(fieldInfo.name) == 0 {
+			// This field is inlined, recurse into fromUnstructured again
+			// with the same set of matched keys.
+			ctx.isInlined = true
+			if err := fromUnstructured(sv, fv, ctx); err != nil {
+				return err
+			}
+			ctx.isInlined = svInlined
+		} else {
+			// This field is not inlined so we recurse into
+			// child field of sv corresponding to field i of
+			// dv, with a new set of matchedKeys and updating
+			// the parentPath to indicate that we are one level
+			// deeper.
+			ctx.recordMatchedKey(fieldInfo.name)
+			value := unwrapInterface(sv.MapIndex(fieldInfo.nameValue))
+			if value.IsValid() {
+				ctx.isInlined = false
+				ctx.pushKey(fieldInfo.name)
+				if err := fromUnstructured(value, fv, ctx); err != nil {
+					return err
+				}
+				ctx.parentPath = ctx.parentPath[:pathLen]
+				ctx.isInlined = svInlined
+			} else {
+				fv.Set(reflect.Zero(fv.Type()))
+			}
+		}
+	}
+	if !svInlined {
+		ctx.popAndVerifyMatchedKeys(sv)
+	}
+	return nil
+}
+
+func interfaceFromUnstructured(sv, dv reflect.Value) error {
+	// TODO: Is this conversion safe?
+	dv.Set(sv)
+	return nil
+}
+
+// ToUnstructured converts an object into map[string]interface{} representation.
+// It uses encoding/json/Marshaler if object implements it or reflection if not.
+func (c *unstructuredConverter) ToUnstructured(obj interface{}) (map[string]interface{}, error) {
+	var u map[string]interface{}
+	var err error
+	if unstr, ok := obj.(Unstructured); ok {
+		u = unstr.UnstructuredContent()
+	} else {
+		t := reflect.TypeOf(obj)
+		value := reflect.ValueOf(obj)
+		if t.Kind() != reflect.Pointer || value.IsNil() {
+			return nil, fmt.Errorf("ToUnstructured requires a non-nil pointer to an object, got %v", t)
+		}
+		u = map[string]interface{}{}
+		err = toUnstructured(value.Elem(), reflect.ValueOf(&u).Elem())
+	}
+	if c.mismatchDetection {
+		newUnstr := map[string]interface{}{}
+		newErr := toUnstructuredViaJSON(obj, &newUnstr)
+		if (err != nil) != (newErr != nil) {
+			//nolint:logcheck // Should not be reached.
+			klog.Fatalf("ToUnstructured unexpected error for %v: error: %v; newErr: %v", obj, err, newErr)
+		}
+		if err == nil && !c.comparison.DeepEqual(u, newUnstr) {
+			//nolint:logcheck // Should not be reached.
+			klog.Fatalf("ToUnstructured mismatch\nobj1: %#v\nobj2: %#v", u, newUnstr)
+		}
+	}
+	if err != nil {
+		return nil, err
+	}
+	return u, nil
+}
+
+// DeepCopyJSON deep copies the passed value, assuming it is a valid JSON representation i.e. only contains
+// types produced by json.Unmarshal() and also int64.
+// bool, int64, float64, string, []interface{}, map[string]interface{}, json.Number and nil
+func DeepCopyJSON(x map[string]interface{}) map[string]interface{} {
+	return DeepCopyJSONValue(x).(map[string]interface{})
+}
+
+// DeepCopyJSONValue deep copies the passed value, assuming it is a valid JSON representation i.e. only contains
+// types produced by json.Unmarshal() and also int64.
+// bool, int64, float64, string, []interface{}, map[string]interface{}, json.Number and nil
+func DeepCopyJSONValue(x interface{}) interface{} {
+	switch x := x.(type) {
+	case map[string]interface{}:
+		if x == nil {
+			// Typed nil - an interface{} that contains a type map[string]interface{} with a value of nil
+			return x
+		}
+		clone := make(map[string]interface{}, len(x))
+		for k, v := range x {
+			clone[k] = DeepCopyJSONValue(v)
+		}
+		return clone
+	case []interface{}:
+		if x == nil {
+			// Typed nil - an interface{} that contains a type []interface{} with a value of nil
+			return x
+		}
+		clone := make([]interface{}, len(x))
+		for i, v := range x {
+			clone[i] = DeepCopyJSONValue(v)
+		}
+		return clone
+	case string, int64, bool, float64, nil, encodingjson.Number:
+		return x
+	default:
+		panic(fmt.Errorf("cannot deep copy %T", x))
+	}
+}
+
+func toUnstructuredViaJSON(obj interface{}, u *map[string]interface{}) error {
+	data, err := json.Marshal(obj)
+	if err != nil {
+		return err
+	}
+	return json.Unmarshal(data, u)
+}
+
+func toUnstructured(sv, dv reflect.Value) error {
+	// Check if the object has a custom string converter.
+	entry := value.TypeReflectEntryOf(sv.Type())
+	if entry.CanConvertToUnstructured() {
+		v, err := entry.ToUnstructured(sv)
+		if err != nil {
+			return err
+		}
+		if v != nil {
+			dv.Set(reflect.ValueOf(v))
+		}
+		return nil
+	}
+	st := sv.Type()
+	switch st.Kind() {
+	case reflect.String:
+		dv.Set(reflect.ValueOf(sv.String()))
+		return nil
+	case reflect.Bool:
+		dv.Set(reflect.ValueOf(sv.Bool()))
+		return nil
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		dv.Set(reflect.ValueOf(sv.Int()))
+		return nil
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		val, err := uintToUnstructuredHelper(sv.Uint())
+		if err != nil {
+			return err
+		}
+		dv.Set(reflect.ValueOf(val))
+		return nil
+	case reflect.Float32, reflect.Float64:
+		dv.Set(reflect.ValueOf(sv.Float()))
+		return nil
+	case reflect.Map:
+		return mapToUnstructured(sv, dv)
+	case reflect.Slice:
+		return sliceToUnstructured(sv, dv)
+	case reflect.Pointer:
+		return pointerToUnstructured(sv, dv)
+	case reflect.Struct:
+		return structToUnstructured(sv, dv)
+	case reflect.Interface:
+		return interfaceToUnstructured(sv, dv)
+	default:
+		return fmt.Errorf("unrecognized type: %v", st.Kind())
+	}
+}
+
+func mapToUnstructured(sv, dv reflect.Value) error {
+	st, dt := sv.Type(), dv.Type()
+	if sv.IsNil() {
+		dv.Set(reflect.Zero(dt))
+		return nil
+	}
+	if dt.Kind() == reflect.Interface && dv.NumMethod() == 0 {
+		if st.Key().Kind() == reflect.String {
+			dv.Set(reflect.MakeMap(mapStringInterfaceType))
+			dv = dv.Elem()
+			dt = dv.Type()
+		}
+	}
+	if dt.Kind() != reflect.Map {
+		return fmt.Errorf("cannot convert map to: %v", dt.Kind())
+	}
+
+	if !st.Key().AssignableTo(dt.Key()) && !st.Key().ConvertibleTo(dt.Key()) {
+		return fmt.Errorf("cannot copy map with non-assignable keys: %v %v", st.Key(), dt.Key())
+	}
+
+	for _, key := range sv.MapKeys() {
+		value := reflect.New(dt.Elem()).Elem()
+		if err := toUnstructured(sv.MapIndex(key), value); err != nil {
+			return err
+		}
+		if st.Key().AssignableTo(dt.Key()) {
+			dv.SetMapIndex(key, value)
+		} else {
+			dv.SetMapIndex(key.Convert(dt.Key()), value)
+		}
+	}
+	return nil
+}
+
+func sliceToUnstructured(sv, dv reflect.Value) error {
+	st, dt := sv.Type(), dv.Type()
+	if sv.IsNil() {
+		dv.Set(reflect.Zero(dt))
+		return nil
+	}
+	if st.Elem().Kind() == reflect.Uint8 {
+		dv.Set(reflect.New(stringType))
+		data, err := json.Marshal(sv.Bytes())
+		if err != nil {
+			return err
+		}
+		var result string
+		if err = json.Unmarshal(data, &result); err != nil {
+			return err
+		}
+		dv.Set(reflect.ValueOf(result))
+		return nil
+	}
+	if dt.Kind() == reflect.Interface && dv.NumMethod() == 0 {
+		dv.Set(reflect.MakeSlice(reflect.SliceOf(dt), sv.Len(), sv.Cap()))
+		dv = dv.Elem()
+		dt = dv.Type()
+	}
+	if dt.Kind() != reflect.Slice {
+		return fmt.Errorf("cannot convert slice to: %v", dt.Kind())
+	}
+	for i := 0; i < sv.Len(); i++ {
+		if err := toUnstructured(sv.Index(i), dv.Index(i)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func pointerToUnstructured(sv, dv reflect.Value) error {
+	if sv.IsNil() {
+		// We're done - we don't need to store anything.
+		return nil
+	}
+	return toUnstructured(sv.Elem(), dv)
+}
+
+func isEmpty(v reflect.Value) bool {
+	switch v.Kind() {
+	case reflect.Array, reflect.String:
+		return v.Len() == 0
+	case reflect.Bool:
+		return !v.Bool()
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return v.Int() == 0
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return v.Uint() == 0
+	case reflect.Float32, reflect.Float64:
+		return v.Float() == 0
+	case reflect.Map, reflect.Slice:
+		// TODO: It seems that 0-len maps are ignored in it.
+		return v.IsNil() || v.Len() == 0
+	case reflect.Pointer, reflect.Interface:
+		return v.IsNil()
+	}
+	return false
+}
+
+func structToUnstructured(sv, dv reflect.Value) error {
+	st, dt := sv.Type(), dv.Type()
+	if dt.Kind() == reflect.Interface && dv.NumMethod() == 0 {
+		dv.Set(reflect.MakeMapWithSize(mapStringInterfaceType, st.NumField()))
+		dv = dv.Elem()
+		dt = dv.Type()
+	}
+	if dt.Kind() != reflect.Map {
+		return fmt.Errorf("cannot convert struct to: %v", dt.Kind())
+	}
+	realMap := dv.Interface().(map[string]interface{})
+
+	for i := 0; i < st.NumField(); i++ {
+		fieldInfo := fieldInfoFromField(st, i)
+		fv := sv.Field(i)
+
+		if fieldInfo.name == "-" {
+			// This field should be skipped.
+			continue
+		}
+		if fieldInfo.omitempty && isEmpty(fv) {
+			// omitempty fields should be ignored.
+			continue
+		}
+		if fieldInfo.omitzero != nil && fieldInfo.omitzero(fv) {
+			// omitzero fields should be ignored
+			continue
+		}
+		if len(fieldInfo.name) == 0 {
+			// This field is inlined.
+			if err := toUnstructured(fv, dv); err != nil {
+				return err
+			}
+			continue
+		}
+		switch fv.Type().Kind() {
+		case reflect.String:
+			realMap[fieldInfo.name] = fv.String()
+		case reflect.Bool:
+			realMap[fieldInfo.name] = fv.Bool()
+		case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+			realMap[fieldInfo.name] = fv.Int()
+		case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+			val, err := uintToUnstructuredHelper(fv.Uint())
+			if err != nil {
+				return err
+			}
+			realMap[fieldInfo.name] = val
+		case reflect.Float32, reflect.Float64:
+			realMap[fieldInfo.name] = fv.Float()
+		default:
+			subv := reflect.New(dt.Elem()).Elem()
+			if err := toUnstructured(fv, subv); err != nil {
+				return err
+			}
+			dv.SetMapIndex(fieldInfo.nameValue, subv)
+		}
+	}
+	return nil
+}
+
+func interfaceToUnstructured(sv, dv reflect.Value) error {
+	if !sv.IsValid() || sv.IsNil() {
+		dv.Set(reflect.Zero(dv.Type()))
+		return nil
+	}
+	return toUnstructured(sv.Elem(), dv)
+}
+
+func uintToUnstructuredHelper(uVal uint64) (int64, error) {
+	if uVal > math.MaxInt64 {
+		return 0, fmt.Errorf("unsigned value %d does not fit into int64 (overflow)", uVal)
+	}
+	return int64(uVal), nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/converter_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/converter_test.go
new file mode 100644
index 0000000000..0b6aa5b780
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/converter_test.go
@@ -0,0 +1,1213 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// These tests are in a separate package to break cyclic dependency in tests.
+// Unstructured type depends on unstructured converter package but we want to test how the converter handles
+// the Unstructured type so we need to import both.
+
+package runtime_test
+
+import (
+	encodingjson "encoding/json"
+	"fmt"
+	"reflect"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/json"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sigs.k8s.io/randfill"
+)
+
+var simpleEquality = conversion.EqualitiesOrDie(
+	func(a, b time.Time) bool {
+		return a.UTC() == b.UTC()
+	},
+)
+
+// Define a number of test types.
+type A struct {
+	A int    `json:"aa,omitempty"`
+	B string `json:"ab,omitempty"`
+	C bool   `json:"ac,omitempty"`
+	D uint   `json:"ad,omitempty"`
+}
+
+type B struct {
+	A A                 `json:"ba"`
+	B string            `json:"bb"`
+	C map[string]string `json:"bc"`
+	D []string          `json:"bd"`
+}
+
+type C struct {
+	A []A `json:"ca"`
+	B `json:""`
+	C string         `json:"cc"`
+	D *int64         `json:"cd"`
+	E map[string]int `json:"ce"`
+	F []bool         `json:"cf"`
+	G []int          `json:"cg"`
+	H float32        `json:"ch"`
+	I []interface{}  `json:"ci"`
+}
+
+type D struct {
+	A []interface{} `json:"da"`
+}
+
+type E struct {
+	A interface{} `json:"ea"`
+}
+
+type F struct {
+	A string            `json:"fa"`
+	B map[string]string `json:"fb"`
+	C []A               `json:"fc"`
+	D int               `json:"fd"`
+	E float32           `json:"fe"`
+	F []string          `json:"ff"`
+	G []int             `json:"fg"`
+	H []bool            `json:"fh"`
+	I []float32         `json:"fi"`
+	J []byte            `json:"fj"`
+}
+
+type G struct {
+	CustomValue1   CustomValue    `json:"customValue1"`
+	CustomValue2   *CustomValue   `json:"customValue2"`
+	CustomPointer1 CustomPointer  `json:"customPointer1"`
+	CustomPointer2 *CustomPointer `json:"customPointer2"`
+}
+
+type H struct {
+	A A `json:"ha"`
+	C `json:""`
+}
+
+type I struct {
+	A A `json:"ia"`
+	H `json:""`
+
+	UL1 UnknownLevel1 `json:"ul1"`
+}
+
+type UnknownLevel1 struct {
+	A          int64 `json:"a"`
+	InlinedAA  `json:""`
+	InlinedAAA `json:""`
+}
+type InlinedAA struct {
+	AA int64 `json:"aa"`
+}
+type InlinedAAA struct {
+	AAA   int64         `json:"aaa"`
+	Child UnknownLevel2 `json:"child"`
+}
+
+type UnknownLevel2 struct {
+	B          int64 `json:"b"`
+	InlinedBB  `json:""`
+	InlinedBBB `json:""`
+}
+type InlinedBB struct {
+	BB int64 `json:"bb"`
+}
+type InlinedBBB struct {
+	BBB   int64         `json:"bbb"`
+	Child UnknownLevel3 `json:"child"`
+}
+
+type UnknownLevel3 struct {
+	C          int64 `json:"c"`
+	InlinedCC  `json:""`
+	InlinedCCC `json:""`
+}
+type InlinedCC struct {
+	CC int64 `json:"cc"`
+}
+type InlinedCCC struct {
+	CCC int64 `json:"ccc"`
+}
+
+type CustomValue struct {
+	data []byte
+}
+
+// MarshalJSON has a value receiver on this type.
+func (c CustomValue) MarshalJSON() ([]byte, error) {
+	return c.data, nil
+}
+
+type CustomPointer struct {
+	data []byte
+}
+
+// MarshalJSON has a pointer receiver on this type.
+func (c *CustomPointer) MarshalJSON() ([]byte, error) {
+	return c.data, nil
+}
+
+func doRoundTrip(t *testing.T, item interface{}) {
+	data, err := json.Marshal(item)
+	if err != nil {
+		t.Errorf("Error when marshaling object: %v", err)
+		return
+	}
+
+	unstr := make(map[string]interface{})
+	err = json.Unmarshal(data, &unstr)
+	if err != nil {
+		t.Errorf("Error when unmarshaling to unstructured: %v", err)
+		return
+	}
+
+	data, err = json.Marshal(unstr)
+	if err != nil {
+		t.Errorf("Error when marshaling unstructured: %v", err)
+		return
+	}
+	unmarshalledObj := reflect.New(reflect.TypeOf(item).Elem()).Interface()
+	err = json.Unmarshal(data, unmarshalledObj)
+	if err != nil {
+		t.Errorf("Error when unmarshaling to object: %v", err)
+		return
+	}
+	if !reflect.DeepEqual(item, unmarshalledObj) {
+		t.Errorf("Object changed during JSON operations, diff: %v", cmp.Diff(item, unmarshalledObj))
+		return
+	}
+
+	// TODO: should be using mismatch detection but fails due to another error
+	newUnstr, err := runtime.DefaultUnstructuredConverter.ToUnstructured(item)
+	if err != nil {
+		t.Errorf("ToUnstructured failed: %v", err)
+		return
+	}
+
+	copiedNewUnstr := runtime.DeepCopyJSONValue(newUnstr)
+	if value, ok := copiedNewUnstr.(map[string]interface{}); ok {
+		newUnstr = value
+	} else {
+		t.Errorf("DeepCopyJSONValue return unexpected type %T", copiedNewUnstr)
+		return
+	}
+
+	newObj := reflect.New(reflect.TypeOf(item).Elem()).Interface()
+	err = runtime.NewTestUnstructuredConverter(simpleEquality).FromUnstructured(newUnstr, newObj)
+	if err != nil {
+		t.Errorf("FromUnstructured failed: %v", err)
+		return
+	}
+
+	if !reflect.DeepEqual(item, newObj) {
+		t.Errorf("Object changed, diff: %v", cmp.Diff(item, newObj))
+	}
+}
+
+func TestRoundTrip(t *testing.T) {
+	intVal := int64(42)
+	testCases := []struct {
+		obj interface{}
+	}{
+		{
+			obj: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"kind": "List",
+				},
+				// Not testing a list with nil Items because items is a non-optional field and hence
+				// is always marshaled into an empty array which is not equal to nil when unmarshalled and will fail.
+				// That is expected.
+				Items: []unstructured.Unstructured{},
+			},
+		},
+		{
+			obj: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"kind": "List",
+				},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"kind": "Pod",
+						},
+					},
+				},
+			},
+		},
+		{
+			obj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"kind": "Pod",
+				},
+			},
+		},
+		{
+			obj: &unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"apiVersion": "v1",
+					"kind":       "Foo",
+					"metadata": map[string]interface{}{
+						"name": "foo1",
+					},
+				},
+			},
+		},
+		{
+			// This (among others) tests nil map, slice and pointer.
+			obj: &C{
+				C: "ccc",
+			},
+		},
+		{
+			// This (among others) tests empty map and slice.
+			obj: &C{
+				A: []A{},
+				C: "ccc",
+				E: map[string]int{},
+				I: []interface{}{},
+			},
+		},
+		{
+			obj: &C{
+				A: []A{
+					{
+						A: 1,
+						B: "11",
+						C: true,
+					},
+					{
+						A: 2,
+						B: "22",
+						C: false,
+					},
+				},
+				B: B{
+					A: A{
+						A: 3,
+						B: "33",
+					},
+					B: "bbb",
+					C: map[string]string{
+						"k1": "v1",
+						"k2": "v2",
+					},
+					D: []string{"s1", "s2"},
+				},
+				C: "ccc",
+				D: &intVal,
+				E: map[string]int{
+					"k1": 1,
+					"k2": 2,
+				},
+				F: []bool{true, false, false},
+				G: []int{1, 2, 5},
+				H: 3.3,
+				I: []interface{}{nil, nil, nil},
+			},
+		},
+		{
+			// Test slice of interface{} with empty slices.
+			obj: &D{
+				A: []interface{}{[]interface{}{}, []interface{}{}},
+			},
+		},
+		{
+			// Test slice of interface{} with different values.
+			obj: &D{
+				A: []interface{}{float64(3.5), int64(4), "3.0", nil},
+			},
+		},
+		{
+			// Test uint values.
+			obj: &A{
+				D: 1,
+			},
+		},
+	}
+
+	for i := range testCases {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			doRoundTrip(t, testCases[i].obj)
+		})
+	}
+}
+
+// TestUnknownFields checks for the collection of unknown
+// field errors from the various possible locations of
+// unknown fields (e.g. fields on struct, inlined struct, slice, etc)
+func TestUnknownFields(t *testing.T) {
+	// simples checks that basic unknown fields are found
+	// in fields, subfields and slices.
+	var simplesData = `{
+"ca": [
+	{
+		"aa": 1,
+		"ab": "ab",
+		"ac": true,
+		"unknown1": 24
+	}
+],
+"cc": "ccstring",
+"unknown2": "foo"
+}`
+
+	var simplesErrs = []string{
+		`unknown field "ca[0].unknown1"`,
+		`unknown field "unknown2"`,
+	}
+
+	// same-name, different-levels checks that
+	// fields at a higher level in the json
+	// are not persisted to unrecognized fields
+	// at lower levels and vice-versa.
+	//
+	// In this case, the field "cc" exists at the root level
+	// but not in the nested field ul1. If we are
+	// improperly retaining matched keys, this not
+	// see an issue with "cc" existing inside "ul1"
+	//
+	// The opposite for "aaa", which exists at the
+	// nested level but not at the root.
+	var sameNameDiffLevelData = `
+	{
+		"cc": "foo",
+		"aaa": 1,
+		"ul1": {
+			"aa": 1,
+			"aaa": 1,
+			"cc": 1
+
+		}
+}`
+	var sameNameDiffLevelErrs = []string{
+		`unknown field "aaa"`,
+		`unknown field "ul1.cc"`,
+	}
+
+	// inlined-inlined confirms that we see
+	// fields that are doubly nested and don't recognize
+	// those that aren't
+	var inlinedInlinedData = `{
+		"bb": "foo",
+		"bc": {
+			"foo": "bar"
+		},
+		"bd": ["d1", "d2"],
+		"aa": 1
+}`
+
+	var inlinedInlinedErrs = []string{
+		`unknown field "aa"`,
+	}
+
+	// combined tests everything together
+	var combinedData = `
+	{
+		"ia": {
+			"aa": 1,
+			"ab": "ab",
+			"unknownI": "foo"
+		},
+		"ha": {
+			"aa": 2,
+			"ab": "ab2",
+			"unknownH": "foo"
+		},
+		"ca":[
+			{
+				"aa":1,
+				"ab":"11",
+				"ac":true
+			},
+			{
+				"aa":2,
+				"ab":"22",
+				"unknown1": "foo"
+			},
+			{
+				"aa":3,
+				"ab":"33",
+				"unknown2": "foo"
+			}
+		],
+		"ba":{
+			"aa":3,
+			"ab":"33",
+			"ac": true,
+			"unknown3": 26,
+			"unknown4": "foo"
+		},
+		"unknown5": "foo",
+		"bb":"bbb",
+		"bc":{
+			"k1":"v1",
+			"k2":"v2"
+		},
+		"bd":[
+			"s1",
+			"s2"
+		],
+		"cc":"ccc",
+		"cd":42,
+		"ce":{
+			"k1":1,
+			"k2":2
+		},
+		"cf":[
+			true,
+			false,
+			false
+		],
+		"cg":
+		[
+			1,
+			2,
+			5
+		],
+		"ch":3.3,
+		"ci":[
+			null,
+			null,
+			null
+		],
+		"ul1": {
+			"a": 1,
+			"aa": 1,
+			"aaa": 1,
+			"b": 1,
+			"bb": 1,
+			"bbb": 1,
+			"c": 1,
+			"cc": 1,
+			"ccc": 1,
+			"child": {
+				"a": 1,
+				"aa": 1,
+				"aaa": 1,
+				"b": 1,
+				"bb": 1,
+				"bbb": 1,
+				"c": 1,
+				"cc": 1,
+				"ccc": 1,
+				"child": {
+					"a": 1,
+					"aa": 1,
+					"aaa": 1,
+					"b": 1,
+					"bb": 1,
+					"bbb": 1,
+					"c": 1,
+					"cc": 1,
+					"ccc": 1
+				}
+			}
+		}
+}`
+
+	var combinedErrs = []string{
+		`unknown field "ca[1].unknown1"`,
+		`unknown field "ca[2].unknown2"`,
+		`unknown field "ba.unknown3"`,
+		`unknown field "ba.unknown4"`,
+		`unknown field "unknown5"`,
+		`unknown field "ha.unknownH"`,
+		`unknown field "ia.unknownI"`,
+
+		`unknown field "ul1.b"`,
+		`unknown field "ul1.bb"`,
+		`unknown field "ul1.bbb"`,
+		`unknown field "ul1.c"`,
+		`unknown field "ul1.cc"`,
+		`unknown field "ul1.ccc"`,
+
+		`unknown field "ul1.child.a"`,
+		`unknown field "ul1.child.aa"`,
+		`unknown field "ul1.child.aaa"`,
+		`unknown field "ul1.child.c"`,
+		`unknown field "ul1.child.cc"`,
+		`unknown field "ul1.child.ccc"`,
+
+		`unknown field "ul1.child.child.a"`,
+		`unknown field "ul1.child.child.aa"`,
+		`unknown field "ul1.child.child.aaa"`,
+		`unknown field "ul1.child.child.b"`,
+		`unknown field "ul1.child.child.bb"`,
+		`unknown field "ul1.child.child.bbb"`,
+	}
+
+	testCases := []struct {
+		jsonData            string
+		obj                 interface{}
+		returnUnknownFields bool
+		expectedErrs        []string
+	}{
+		{
+			jsonData:            simplesData,
+			obj:                 &C{},
+			returnUnknownFields: true,
+			expectedErrs:        simplesErrs,
+		},
+		{
+			jsonData:            simplesData,
+			obj:                 &C{},
+			returnUnknownFields: false,
+		},
+		{
+			jsonData:            sameNameDiffLevelData,
+			obj:                 &I{},
+			returnUnknownFields: true,
+			expectedErrs:        sameNameDiffLevelErrs,
+		},
+		{
+			jsonData:            sameNameDiffLevelData,
+			obj:                 &I{},
+			returnUnknownFields: false,
+		},
+		{
+			jsonData:            inlinedInlinedData,
+			obj:                 &I{},
+			returnUnknownFields: true,
+			expectedErrs:        inlinedInlinedErrs,
+		},
+		{
+			jsonData:            inlinedInlinedData,
+			obj:                 &I{},
+			returnUnknownFields: false,
+		},
+		{
+			jsonData:            combinedData,
+			obj:                 &I{},
+			returnUnknownFields: true,
+			expectedErrs:        combinedErrs,
+		},
+		{
+			jsonData:            combinedData,
+			obj:                 &I{},
+			returnUnknownFields: false,
+		},
+	}
+
+	for i, tc := range testCases {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			unstr := make(map[string]interface{})
+			err := json.Unmarshal([]byte(tc.jsonData), &unstr)
+			if err != nil {
+				t.Errorf("Error when unmarshaling to unstructured: %v", err)
+				return
+			}
+			err = runtime.NewTestUnstructuredConverterWithValidation(simpleEquality).FromUnstructuredWithValidation(unstr, tc.obj, tc.returnUnknownFields)
+			if len(tc.expectedErrs) == 0 && err != nil {
+				t.Errorf("unexpected err: %v", err)
+			}
+			var errString string
+			if err != nil {
+				errString = err.Error()
+			}
+			missedErrs := []string{}
+			failed := false
+			for _, expected := range tc.expectedErrs {
+				if !strings.Contains(errString, expected) {
+					failed = true
+					missedErrs = append(missedErrs, expected)
+				} else {
+					errString = strings.Replace(errString, expected, "", 1)
+				}
+			}
+			if failed {
+				for _, e := range missedErrs {
+					t.Errorf("missing err: %v\n", e)
+				}
+			}
+			leftoverErrors := strings.TrimSpace(strings.TrimPrefix(strings.ReplaceAll(errString, ",", ""), "strict decoding error:"))
+			if leftoverErrors != "" {
+				t.Errorf("found unexpected errors: %s", leftoverErrors)
+			}
+		})
+	}
+}
+
+// BenchmarkFromUnstructuredWithValidation benchmarks
+// the time and memory required to perform FromUnstructured
+// with the various validation directives (Ignore, Warn, Strict)
+func BenchmarkFromUnstructuredWithValidation(b *testing.B) {
+	re := regexp.MustCompile("^I$")
+	f := randfill.NewWithSeed(1).NilChance(0.1).SkipFieldsWithPattern(re)
+	iObj := &I{}
+	f.Fill(&iObj)
+
+	unstr, err := runtime.DefaultUnstructuredConverter.ToUnstructured(iObj)
+	if err != nil {
+		b.Fatalf("ToUnstructured failed: %v", err)
+		return
+	}
+	for _, shouldReturn := range []bool{false, true} {
+		b.Run(fmt.Sprintf("shouldReturn=%t", shouldReturn), func(b *testing.B) {
+			newObj := reflect.New(reflect.TypeOf(iObj).Elem()).Interface()
+			b.ReportAllocs()
+			for i := 0; i < b.N; i++ {
+				if err = runtime.NewTestUnstructuredConverterWithValidation(simpleEquality).FromUnstructuredWithValidation(unstr, newObj, shouldReturn); err != nil {
+					b.Fatalf("FromUnstructured failed: %v", err)
+					return
+				}
+			}
+		})
+	}
+}
+
+// Verifies that:
+// 1) serialized json -> object
+// 2) serialized json -> map[string]interface{} -> object
+// produces the same object.
+func doUnrecognized(t *testing.T, jsonData string, item interface{}, expectedErr error) {
+	unmarshalledObj := reflect.New(reflect.TypeOf(item).Elem()).Interface()
+	err := json.Unmarshal([]byte(jsonData), unmarshalledObj)
+	if (err != nil) != (expectedErr != nil) {
+		t.Errorf("Unexpected error when unmarshaling to object: %v, expected: %v", err, expectedErr)
+		return
+	}
+
+	unstr := make(map[string]interface{})
+	err = json.Unmarshal([]byte(jsonData), &unstr)
+	if err != nil {
+		t.Errorf("Error when unmarshaling to unstructured: %v", err)
+		return
+	}
+	newObj := reflect.New(reflect.TypeOf(item).Elem()).Interface()
+	err = runtime.NewTestUnstructuredConverter(simpleEquality).FromUnstructured(unstr, newObj)
+	if (err != nil) != (expectedErr != nil) {
+		t.Errorf("Unexpected error in FromUnstructured: %v, expected: %v", err, expectedErr)
+	}
+
+	if expectedErr == nil && !reflect.DeepEqual(unmarshalledObj, newObj) {
+		t.Errorf("Object changed, diff: %v", cmp.Diff(unmarshalledObj, newObj))
+	}
+}
+
+func TestUnrecognized(t *testing.T) {
+	testCases := []struct {
+		data string
+		obj  interface{}
+		err  error
+	}{
+		{
+			data: "{\"da\":[3.5,4,\"3.0\",null]}",
+			obj:  &D{},
+		},
+		{
+			data: "{\"ea\":[3.5,4,\"3.0\",null]}",
+			obj:  &E{},
+		},
+		{
+			data: "{\"ea\":[null,null,null]}",
+			obj:  &E{},
+		},
+		{
+			data: "{\"ea\":[[],[null]]}",
+			obj:  &E{},
+		},
+		{
+			data: "{\"ea\":{\"a\":[],\"b\":null}}",
+			obj:  &E{},
+		},
+		{
+			data: "{\"fa\":\"fa\",\"fb\":{\"a\":\"a\"}}",
+			obj:  &F{},
+		},
+		{
+			data: "{\"fa\":\"fa\",\"fb\":{\"a\":null}}",
+			obj:  &F{},
+		},
+		{
+			data: "{\"fc\":[null]}",
+			obj:  &F{},
+		},
+		{
+			data: "{\"fc\":[{\"aa\":123,\"ab\":\"bbb\"}]}",
+			obj:  &F{},
+		},
+		{
+			// Only unknown fields
+			data: "{\"fx\":[{\"aa\":123,\"ab\":\"bbb\"}],\"fz\":123}",
+			obj:  &F{},
+		},
+		{
+			data: "{\"fc\":[{\"aa\":\"aaa\",\"ab\":\"bbb\"}]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal string into Go value of type int"),
+		},
+		{
+			data: "{\"fd\":123,\"fe\":3.5}",
+			obj:  &F{},
+		},
+		{
+			data: "{\"ff\":[\"abc\"],\"fg\":[123],\"fh\":[true,false]}",
+			obj:  &F{},
+		},
+		{
+			data: "{\"fj\":\"\"}",
+			obj:  &F{},
+		},
+		{
+			// Invalid string data
+			data: "{\"fa\":123}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type string"),
+		},
+		{
+			// Invalid string data
+			data: "{\"fa\":13.5}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type string"),
+		},
+		{
+			// Invalid string data
+			data: "{\"fa\":true}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal bool into Go value of type string"),
+		},
+		{
+			// Invalid []string data
+			data: "{\"ff\":123}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type []string"),
+		},
+		{
+			// Invalid []string data
+			data: "{\"ff\":3.5}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type []string"),
+		},
+		{
+			// Invalid []string data
+			data: "{\"ff\":[123,345]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type string"),
+		},
+		{
+			// Invalid []int data
+			data: "{\"fg\":123}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type []int"),
+		},
+		{
+			// Invalid []int data
+			data: "{\"fg\":\"abc\"}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal string into Go value of type []int"),
+		},
+		{
+			// Invalid []int data
+			data: "{\"fg\":[\"abc\"]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal string into Go value of type int"),
+		},
+		{
+			// Invalid []int data
+			data: "{\"fg\":[3.5]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number 3.5 into Go value of type int"),
+		},
+		{
+			// Invalid []int data
+			data: "{\"fg\":[true,false]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number 3.5 into Go value of type int"),
+		},
+		{
+			// Invalid []bool data
+			data: "{\"fh\":123}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type []bool"),
+		},
+		{
+			// Invalid []bool data
+			data: "{\"fh\":\"abc\"}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal string into Go value of type []bool"),
+		},
+		{
+			// Invalid []bool data
+			data: "{\"fh\":[\"abc\"]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal string into Go value of type bool"),
+		},
+		{
+			// Invalid []bool data
+			data: "{\"fh\":[3.5]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type bool"),
+		},
+		{
+			// Invalid []bool data
+			data: "{\"fh\":[123]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type bool"),
+		},
+		{
+			// Invalid []float data
+			data: "{\"fi\":123}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal number into Go value of type []float32"),
+		},
+		{
+			// Invalid []float data
+			data: "{\"fi\":\"abc\"}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal string into Go value of type []float32"),
+		},
+		{
+			// Invalid []float data
+			data: "{\"fi\":[\"abc\"]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal string into Go value of type float32"),
+		},
+		{
+			// Invalid []float data
+			data: "{\"fi\":[true]}",
+			obj:  &F{},
+			err:  fmt.Errorf("json: cannot unmarshal bool into Go value of type float32"),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.data, func(t *testing.T) {
+			doUnrecognized(t, tc.data, tc.obj, tc.err)
+		})
+	}
+}
+
+func TestDeepCopyJSON(t *testing.T) {
+	src := map[string]interface{}{
+		"a": nil,
+		"b": int64(123),
+		"c": map[string]interface{}{
+			"a": "b",
+		},
+		"d": []interface{}{
+			int64(1), int64(2),
+		},
+		"e": "estr",
+		"f": true,
+		"g": encodingjson.Number("123"),
+	}
+	deepCopy := runtime.DeepCopyJSON(src)
+	assert.Equal(t, src, deepCopy)
+}
+
+func TestFloatIntConversion(t *testing.T) {
+	unstr := map[string]interface{}{"fd": float64(3)}
+
+	var obj F
+	if err := runtime.NewTestUnstructuredConverter(simpleEquality).FromUnstructured(unstr, &obj); err != nil {
+		t.Errorf("Unexpected error in FromUnstructured: %v", err)
+	}
+
+	data, err := json.Marshal(unstr)
+	if err != nil {
+		t.Fatalf("Error when marshaling unstructured: %v", err)
+	}
+	var unmarshalled F
+	if err := json.Unmarshal(data, &unmarshalled); err != nil {
+		t.Fatalf("Error when unmarshaling to object: %v", err)
+	}
+
+	if !reflect.DeepEqual(obj, unmarshalled) {
+		t.Errorf("Incorrect conversion, diff: %v", cmp.Diff(obj, unmarshalled))
+	}
+}
+
+func TestIntFloatConversion(t *testing.T) {
+	unstr := map[string]interface{}{"ch": int64(3)}
+
+	var obj C
+	if err := runtime.NewTestUnstructuredConverter(simpleEquality).FromUnstructured(unstr, &obj); err != nil {
+		t.Errorf("Unexpected error in FromUnstructured: %v", err)
+	}
+
+	data, err := json.Marshal(unstr)
+	if err != nil {
+		t.Fatalf("Error when marshaling unstructured: %v", err)
+	}
+	var unmarshalled C
+	if err := json.Unmarshal(data, &unmarshalled); err != nil {
+		t.Fatalf("Error when unmarshaling to object: %v", err)
+	}
+
+	if !reflect.DeepEqual(obj, unmarshalled) {
+		t.Errorf("Incorrect conversion, diff: %v", cmp.Diff(obj, unmarshalled))
+	}
+}
+
+func TestCustomToUnstructured(t *testing.T) {
+	testcases := []struct {
+		Data     string
+		Expected interface{}
+	}{
+		{Data: `null`, Expected: nil},
+		{Data: `true`, Expected: true},
+		{Data: `false`, Expected: false},
+		{Data: `[]`, Expected: []interface{}{}},
+		{Data: `[1]`, Expected: []interface{}{int64(1)}},
+		{Data: `{}`, Expected: map[string]interface{}{}},
+		{Data: `{"a":1}`, Expected: map[string]interface{}{"a": int64(1)}},
+		{Data: `0`, Expected: int64(0)},
+		{Data: `0.0`, Expected: float64(0)},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.Data, func(t *testing.T) {
+			t.Parallel()
+			result, err := runtime.NewTestUnstructuredConverter(simpleEquality).ToUnstructured(&G{
+				CustomValue1:   CustomValue{data: []byte(tc.Data)},
+				CustomValue2:   &CustomValue{data: []byte(tc.Data)},
+				CustomPointer1: CustomPointer{data: []byte(tc.Data)},
+				CustomPointer2: &CustomPointer{data: []byte(tc.Data)},
+			})
+			require.NoError(t, err)
+			for field, fieldResult := range result {
+				assert.Equal(t, tc.Expected, fieldResult, field)
+			}
+		})
+	}
+}
+
+func TestCustomToUnstructuredTopLevel(t *testing.T) {
+	// Only objects are supported at the top level
+	topLevelCases := []interface{}{
+		&CustomValue{data: []byte(`{"a":1}`)},
+		&CustomPointer{data: []byte(`{"a":1}`)},
+	}
+	expected := map[string]interface{}{"a": int64(1)}
+	for i, obj := range topLevelCases {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			t.Parallel()
+			result, err := runtime.NewTestUnstructuredConverter(simpleEquality).ToUnstructured(obj)
+			require.NoError(t, err)
+			assert.Equal(t, expected, result)
+		})
+	}
+}
+
+type OmitemptyNameField struct {
+	I int `json:"omitempty"`
+}
+
+func TestOmitempty(t *testing.T) {
+	expected := `{"omitempty":0}`
+
+	o := &OmitemptyNameField{}
+	jsonData, err := json.Marshal(o)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if e, a := expected, string(jsonData); e != a {
+		t.Fatalf("expected\n%s\ngot\n%s", e, a)
+	}
+
+	unstr, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&o)
+	if err != nil {
+		t.Fatal(err)
+	}
+	jsonUnstrData, err := json.Marshal(unstr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if e, a := expected, string(jsonUnstrData); e != a {
+		t.Fatalf("expected\n%s\ngot\n%s", e, a)
+	}
+}
+
+type InlineTestPrimitive struct {
+	NoNameTagPrimitive          int64 `json:""`
+	NoNameTagInlinePrimitive    int64 `json:",inline"`
+	NoNameTagOmitemptyPrimitive int64 `json:",omitempty"`
+}
+type InlineTestAnonymous struct {
+	NoTag
+	NoNameTag          `json:""`
+	NameTag            `json:"nameTagEmbedded"`
+	NoNameTagInline    `json:",inline"`
+	NoNameTagEmbed     `json:",embed"` //nolint:staticcheck // SA5008 intentionally exercising a tag not present until Go 1.27
+	NoNameTagOmitempty `json:",omitempty"`
+}
+type InlineTestNamed struct {
+	NoTag              NoTag
+	NoNameTag          NoNameTag          `json:""`
+	NameTag            NameTag            `json:"nameTagEmbedded"`
+	NoNameTagInline    NoNameTagInline    `json:",inline"`
+	NoNameTagEmbed     NoNameTagEmbed     `json:",embed"` //nolint:staticcheck // intentionally exercising a tag not present until Go 1.27
+	NoNameTagOmitempty NoNameTagOmitempty `json:",omitempty"`
+}
+type NoTag struct {
+	Data0 int `json:"data0"`
+}
+type NameTag struct {
+	Data1 int `json:"data1"`
+}
+type NoNameTag struct {
+	Data2 int `json:"data2"`
+}
+type NoNameTagInline struct {
+	Data3 int `json:"data3"`
+}
+type NoNameTagOmitempty struct {
+	Data4 int `json:"data4"`
+}
+type NoNameTagEmbed struct {
+	Data5 int `json:"data5"`
+}
+
+func TestInline(t *testing.T) {
+	testcases := []struct {
+		name   string
+		obj    any
+		expect map[string]any
+	}{
+		{
+			name: "primitive-zero",
+			obj:  &InlineTestPrimitive{},
+			expect: map[string]any{
+				"NoNameTagPrimitive":       int64(0),
+				"NoNameTagInlinePrimitive": int64(0),
+			},
+		},
+		{
+			name: "primitive-set",
+			obj: &InlineTestPrimitive{
+				NoNameTagPrimitive:          1,
+				NoNameTagInlinePrimitive:    2,
+				NoNameTagOmitemptyPrimitive: 3,
+			},
+			expect: map[string]any{
+				"NoNameTagPrimitive":          int64(1),
+				"NoNameTagInlinePrimitive":    int64(2),
+				"NoNameTagOmitemptyPrimitive": int64(3),
+			},
+		},
+		{
+			name: "anonymous-zero",
+			obj:  &InlineTestAnonymous{},
+			expect: map[string]any{
+				"data0":           int64(0),
+				"data2":           int64(0),
+				"data3":           int64(0),
+				"data4":           int64(0),
+				"data5":           int64(0),
+				"nameTagEmbedded": map[string]any{"data1": int64(0)},
+			},
+		},
+		{
+			name: "anonymous-set",
+			obj:  &InlineTestAnonymous{},
+			expect: map[string]any{
+				"data0":           int64(0),
+				"data2":           int64(0),
+				"data3":           int64(0),
+				"data4":           int64(0),
+				"data5":           int64(0),
+				"nameTagEmbedded": map[string]any{"data1": int64(0)},
+			},
+		},
+		{
+			name: "named-zero",
+			obj:  &InlineTestNamed{},
+			expect: func() map[string]any {
+				m := map[string]any{
+					"NoTag":              map[string]any{"data0": int64(0)},
+					"nameTagEmbedded":    map[string]any{"data1": int64(0)},
+					"NoNameTag":          map[string]any{"data2": int64(0)},
+					"NoNameTagInline":    map[string]any{"data3": int64(0)},
+					"NoNameTagOmitempty": map[string]any{"data4": int64(0)},
+				}
+				if stdlibSupportsEmbedTag {
+					m["data5"] = int64(0)
+				} else {
+					m["NoNameTagEmbed"] = map[string]any{"data5": int64(0)}
+				}
+				return m
+			}(),
+		},
+		{
+			name: "named-set",
+			obj: &InlineTestNamed{
+				NoTag:              NoTag{Data0: 10},
+				NameTag:            NameTag{Data1: 11},
+				NoNameTag:          NoNameTag{Data2: 12},
+				NoNameTagInline:    NoNameTagInline{Data3: 13},
+				NoNameTagOmitempty: NoNameTagOmitempty{Data4: 14},
+				NoNameTagEmbed:     NoNameTagEmbed{Data5: 15},
+			},
+			expect: func() map[string]any {
+				m := map[string]any{
+					"NoTag":              map[string]any{"data0": int64(10)},
+					"nameTagEmbedded":    map[string]any{"data1": int64(11)},
+					"NoNameTag":          map[string]any{"data2": int64(12)},
+					"NoNameTagInline":    map[string]any{"data3": int64(13)},
+					"NoNameTagOmitempty": map[string]any{"data4": int64(14)},
+				}
+				if stdlibSupportsEmbedTag {
+					m["data5"] = int64(15)
+				} else {
+					m["NoNameTagEmbed"] = map[string]any{"data5": int64(15)}
+				}
+				return m
+			}(),
+		},
+	}
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				// handle panics
+				if err := recover(); err != nil {
+					t.Fatal(err)
+				}
+			}()
+
+			// Check the expectation against stdlib
+			jsonData, err := json.Marshal(tc.obj)
+			if err != nil {
+				t.Fatal(err)
+			}
+			jsonUnstr := map[string]any{}
+			if err := json.Unmarshal(jsonData, &jsonUnstr); err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(tc.expect, jsonUnstr) {
+				t.Fatal(cmp.Diff(tc.expect, jsonUnstr))
+			}
+
+			// Check the expectation against DefaultUnstructuredConverter.ToUnstructured
+			unstr, err := runtime.DefaultUnstructuredConverter.ToUnstructured(tc.obj)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(tc.expect, unstr) {
+				t.Fatal(cmp.Diff(tc.expect, unstr))
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/converter_zero_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/converter_zero_test.go
new file mode 100644
index 0000000000..e807115a0e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/converter_zero_test.go
@@ -0,0 +1,359 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// These tests are in a separate package to break cyclic dependency in tests.
+// Unstructured type depends on unstructured converter package but we want to test how the converter handles
+// the Unstructured type so we need to import both.
+
+package runtime
+
+import (
+	encodingjson "encoding/json"
+	"fmt"
+	"reflect"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/json"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+type ZeroParent struct {
+	Int               int                    `json:"int,omitzero"`
+	IntP              *int                   `json:"intP,omitzero"`
+	String            string                 `json:"string,omitzero"`
+	StringP           *string                `json:"stringP,omitzero"`
+	Bool              bool                   `json:"bool,omitzero"`
+	BoolP             bool                   `json:"boolP,omitzero"`
+	Slice             []int                  `json:"slice,omitzero"`
+	SliceP            *[]int                 `json:"sliceP,omitzero"`
+	Map               map[string]int         `json:"map,omitzero"`
+	MapP              *map[string]int        `json:"mapP,omitzero"`
+	Struct            ZeroChild              `json:"struct,omitzero"`
+	StructP           *ZeroChild             `json:"structP,omitzero"`
+	CustomPrimitive   ZeroCustomPrimitive    `json:"customPrimitive,omitzero"`
+	CustomPrimitiveP  *ZeroCustomPrimitiveP  `json:"customPrimitiveP,omitzero"`
+	CustomStruct      ZeroCustomStruct       `json:"customStruct,omitzero"`
+	CustomStructP     *ZeroCustomStructP     `json:"customStructP,omitzero"`
+	CustomPPrimitive  ZeroCustomPPrimitive   `json:"customPPrimitive,omitzero"`
+	CustomPPrimitiveP *ZeroCustomPPrimitiveP `json:"customPPrimitiveP,omitzero"`
+	CustomPStruct     ZeroCustomPStruct      `json:"customPStruct,omitzero"`
+	CustomPStructP    *ZeroCustomPStructP    `json:"customPStructP,omitzero"`
+}
+type ZeroChild struct {
+	Data int `json:"data"`
+}
+
+type ZeroCustomPrimitive int
+
+func (z ZeroCustomPrimitive) IsZero() bool {
+	return z == 42
+}
+
+type ZeroCustomPrimitiveP int
+
+func (z ZeroCustomPrimitiveP) IsZero() bool {
+	return z == 42
+}
+
+type ZeroCustomStruct struct {
+	Data int `json:"data"`
+}
+
+func (z ZeroCustomStruct) IsZero() bool {
+	return z.Data == 42
+}
+
+type ZeroCustomStructP struct {
+	Data int `json:"data"`
+}
+
+func (z ZeroCustomStructP) IsZero() bool {
+	return z.Data == 42
+}
+
+type ZeroCustomPPrimitive int
+
+func (z *ZeroCustomPPrimitive) IsZero() bool {
+	return *z == 42
+}
+
+type ZeroCustomPPrimitiveP int
+
+func (z *ZeroCustomPPrimitiveP) IsZero() bool {
+	return *z == 42
+}
+
+type ZeroCustomPStruct struct {
+	Data int `json:"data"`
+}
+
+func (z *ZeroCustomPStruct) IsZero() bool {
+	return z.Data == 42
+}
+
+type ZeroCustomPStructP struct {
+	Data int `json:"data"`
+}
+
+func (z *ZeroCustomPStructP) IsZero() bool {
+	return z.Data == 42
+}
+
+func TestOmitZero2(t *testing.T) {
+	testcases := []struct {
+		name   string
+		obj    any
+		expect map[string]any
+	}{
+		{
+			name: "emptyzero",
+			obj:  &ZeroParent{},
+			expect: map[string]any{
+				"customPPrimitive": int64(0),
+				"customPStruct":    map[string]any{"data": int64(0)},
+				"customPrimitive":  int64(0),
+				"customStruct":     map[string]any{"data": int64(0)},
+			},
+		},
+	}
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			jsonData, err := json.Marshal(tc.obj)
+			if err != nil {
+				t.Fatal(err)
+			}
+			jsonUnstructured := map[string]any{}
+			if err := json.Unmarshal(jsonData, &jsonUnstructured); err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(jsonUnstructured, tc.expect) {
+				t.Fatal(cmp.Diff(tc.expect, jsonUnstructured))
+			}
+
+			unstr, err := DefaultUnstructuredConverter.ToUnstructured(tc.obj)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(unstr, tc.expect) {
+				t.Fatal(cmp.Diff(tc.expect, unstr))
+			}
+		})
+	}
+}
+
+type NonZeroStruct struct{}
+
+func (nzs NonZeroStruct) IsZero() bool {
+	return false
+}
+
+type NoPanicStruct struct {
+	Int int `json:"int,omitzero"`
+}
+
+func (nps *NoPanicStruct) IsZero() bool {
+	return nps.Int != 0
+}
+
+type isZeroer interface {
+	IsZero() bool
+}
+
+type OptionalsZero struct {
+	Sr string `json:"sr"`
+	So string `json:"so,omitzero"`
+	Sw string `json:"-"`
+
+	Ir int `json:"omitzero"` // actually named omitzero, not an option
+	Io int `json:"io,omitzero"`
+
+	Slr       []string `json:"slr,random"` //nolint:staticcheck // SA5008
+	Slo       []string `json:"slo,omitzero"`
+	SloNonNil []string `json:"slononnil,omitzero"`
+
+	Mr  map[string]any `json:"mr"`
+	Mo  map[string]any `json:",omitzero"`
+	Moo map[string]any `json:"moo,omitzero"`
+
+	Fr   float64    `json:"fr"`
+	Fo   float64    `json:"fo,omitzero"`
+	Foo  float64    `json:"foo,omitzero"`
+	Foo2 [2]float64 `json:"foo2,omitzero"`
+
+	Br bool `json:"br"`
+	Bo bool `json:"bo,omitzero"`
+
+	Ur uint `json:"ur"`
+	Uo uint `json:"uo,omitzero"`
+
+	Str struct{} `json:"str"`
+	Sto struct{} `json:"sto,omitzero"`
+
+	Time      time.Time     `json:"time,omitzero"`
+	TimeLocal time.Time     `json:"timelocal,omitzero"`
+	Nzs       NonZeroStruct `json:"nzs,omitzero"`
+
+	NilIsZeroer    isZeroer       `json:"niliszeroer,omitzero"`    // nil interface
+	NonNilIsZeroer isZeroer       `json:"nonniliszeroer,omitzero"` // non-nil interface
+	NoPanicStruct0 isZeroer       `json:"nps0,omitzero"`           // non-nil interface with nil pointer
+	NoPanicStruct1 isZeroer       `json:"nps1,omitzero"`           // non-nil interface with non-nil pointer
+	NoPanicStruct2 *NoPanicStruct `json:"nps2,omitzero"`           // nil pointer
+	NoPanicStruct3 *NoPanicStruct `json:"nps3,omitzero"`           // non-nil pointer
+	NoPanicStruct4 NoPanicStruct  `json:"nps4,omitzero"`           // concrete type
+}
+
+func TestOmitZero(t *testing.T) {
+	const want = `{
+ "Mo": {},
+ "br": false,
+ "fr": 0,
+ "mr": {},
+ "nps1": {},
+ "nps3": {},
+ "nps4": {},
+ "nzs": {},
+ "omitzero": 0,
+ "slononnil": [],
+ "slr": null,
+ "sr": "",
+ "str": {},
+ "ur": 0
+}`
+	var o OptionalsZero
+	o.Sw = "something"
+	o.SloNonNil = make([]string, 0)
+	o.Mr = map[string]any{}
+	o.Mo = map[string]any{}
+
+	o.Foo = -0
+	o.Foo2 = [2]float64{+0, -0}
+
+	o.TimeLocal = time.Time{}.Local()
+
+	o.NonNilIsZeroer = time.Time{}
+	o.NoPanicStruct0 = (*NoPanicStruct)(nil)
+	o.NoPanicStruct1 = &NoPanicStruct{}
+	o.NoPanicStruct3 = &NoPanicStruct{}
+
+	unstr, err := DefaultUnstructuredConverter.ToUnstructured(&o)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := encodingjson.MarshalIndent(unstr, "", " ")
+	if err != nil {
+		t.Fatalf("MarshalIndent error: %v", err)
+	}
+	if got := string(got); got != want {
+		t.Errorf("MarshalIndent:\n\tgot:  %s\n\twant: %s\n", got, want)
+	}
+}
+
+func TestOmitZeroMap(t *testing.T) {
+	const want = `{
+ "foo": {
+  "br": false,
+  "fr": 0,
+  "mr": null,
+  "nps4": {},
+  "nzs": {},
+  "omitzero": 0,
+  "slr": null,
+  "sr": "",
+  "str": {},
+  "ur": 0
+ }
+}`
+
+	m := map[string]OptionalsZero{"foo": {}}
+
+	unstr, err := DefaultUnstructuredConverter.ToUnstructured(&m)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := encodingjson.MarshalIndent(unstr, "", " ")
+	if err != nil {
+		t.Fatalf("MarshalIndent error: %v", err)
+	}
+	if got := string(got); got != want {
+		fmt.Println(got)
+		t.Errorf("MarshalIndent:\n\tgot:  %s\n\twant: %s\n", got, want)
+	}
+}
+
+type OptionalsEmptyZero struct {
+	Sr string `json:"sr"`
+	So string `json:"so,omitempty,omitzero"`
+	Sw string `json:"-"`
+
+	Io int `json:"io,omitempty,omitzero"`
+
+	Slr       []string `json:"slr,random"` //nolint:staticcheck // SA5008
+	Slo       []string `json:"slo,omitempty,omitzero"`
+	SloNonNil []string `json:"slononnil,omitempty,omitzero"`
+
+	Mr map[string]any `json:"mr"`
+	Mo map[string]any `json:",omitempty,omitzero"`
+
+	Fr float64 `json:"fr"`
+	Fo float64 `json:"fo,omitempty,omitzero"`
+
+	Br bool `json:"br"`
+	Bo bool `json:"bo,omitempty,omitzero"`
+
+	Ur uint `json:"ur"`
+	Uo uint `json:"uo,omitempty,omitzero"`
+
+	Str struct{} `json:"str"`
+	Sto struct{} `json:"sto,omitempty,omitzero"`
+
+	Time time.Time     `json:"time,omitempty,omitzero"`
+	Nzs  NonZeroStruct `json:"nzs,omitempty,omitzero"`
+}
+
+func TestOmitEmptyZero(t *testing.T) {
+	const want = `{
+ "br": false,
+ "fr": 0,
+ "mr": {},
+ "nzs": {},
+ "slr": null,
+ "sr": "",
+ "str": {},
+ "ur": 0
+}`
+	var o OptionalsEmptyZero
+	o.Sw = "something"
+	o.SloNonNil = make([]string, 0)
+	o.Mr = map[string]any{}
+	o.Mo = map[string]any{}
+
+	unstr, err := DefaultUnstructuredConverter.ToUnstructured(&o)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := encodingjson.MarshalIndent(unstr, "", " ")
+	if err != nil {
+		t.Fatalf("MarshalIndent error: %v", err)
+	}
+	if got := string(got); got != want {
+		t.Errorf("MarshalIndent:\n\tgot:  %s\n\twant: %s\n", got, want)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/doc.go b/third_party/k8s.io/apimachinery/pkg/runtime/doc.go
new file mode 100644
index 0000000000..fd012dbc79
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/doc.go
@@ -0,0 +1,53 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.runtime
+
+// Package runtime includes helper functions for working with API objects
+// that follow the kubernetes API object conventions, which are:
+//
+// 0. Your API objects have a common metadata struct member, TypeMeta.
+//
+// 1. Your code refers to an internal set of API objects.
+//
+// 2. In a separate package, you have an external set of API objects.
+//
+// 3. The external set is considered to be versioned, and no breaking
+// changes are ever made to it (fields may be added but not changed
+// or removed).
+//
+// 4. As your api evolves, you'll make an additional versioned package
+// with every major change.
+//
+// 5. Versioned packages have conversion functions which convert to
+// and from the internal version.
+//
+// 6. You'll continue to support older versions according to your
+// deprecation policy, and you can easily provide a program/library
+// to update old versions into new versions because of 5.
+//
+// 7. All of your serializations and deserializations are handled in a
+// centralized place.
+//
+// Package runtime provides a conversion helper to make 5 easy, and the
+// Encode/Decode/DecodeInto trio to accomplish 7. You can also register
+// additional "codecs" which use a version of your choice. It's
+// recommended that you register your types with runtime in your
+// package's init function.
+//
+// As a bonus, a few common types useful from all api objects and versions
+// are provided in types.go.
+package runtime
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/embedded.go b/third_party/k8s.io/apimachinery/pkg/runtime/embedded.go
new file mode 100644
index 0000000000..7251e65f6e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/embedded.go
@@ -0,0 +1,149 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"errors"
+
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type encodable struct {
+	E        Encoder `json:"-"`
+	obj      Object
+	versions []schema.GroupVersion
+}
+
+func (e encodable) GetObjectKind() schema.ObjectKind { return e.obj.GetObjectKind() }
+func (e encodable) DeepCopyObject() Object {
+	out := e
+	out.obj = e.obj.DeepCopyObject()
+	copy(out.versions, e.versions)
+	return out
+}
+
+// NewEncodable creates an object that will be encoded with the provided codec on demand.
+// Provided as a convenience for test cases dealing with internal objects.
+func NewEncodable(e Encoder, obj Object, versions ...schema.GroupVersion) Object {
+	if _, ok := obj.(*Unknown); ok {
+		return obj
+	}
+	return encodable{e, obj, versions}
+}
+
+func (e encodable) UnmarshalJSON(in []byte) error {
+	return errors.New("runtime.encodable cannot be unmarshalled from JSON")
+}
+
+// Marshal may get called on pointers or values, so implement MarshalJSON on value.
+// http://stackoverflow.com/questions/21390979/custom-marshaljson-never-gets-called-in-go
+func (e encodable) MarshalJSON() ([]byte, error) {
+	return Encode(e.E, e.obj)
+}
+
+// NewEncodableList creates an object that will be encoded with the provided codec on demand.
+// Provided as a convenience for test cases dealing with internal objects.
+func NewEncodableList(e Encoder, objects []Object, versions ...schema.GroupVersion) []Object {
+	out := make([]Object, len(objects))
+	for i := range objects {
+		if _, ok := objects[i].(*Unknown); ok {
+			out[i] = objects[i]
+			continue
+		}
+		out[i] = NewEncodable(e, objects[i], versions...)
+	}
+	return out
+}
+
+func (e *Unknown) UnmarshalJSON(in []byte) error {
+	if e == nil {
+		return errors.New("runtime.Unknown: UnmarshalJSON on nil pointer")
+	}
+	e.TypeMeta = TypeMeta{}
+	e.Raw = append(e.Raw[0:0], in...)
+	e.ContentEncoding = ""
+	e.ContentType = ContentTypeJSON
+	return nil
+}
+
+// Marshal may get called on pointers or values, so implement MarshalJSON on value.
+// http://stackoverflow.com/questions/21390979/custom-marshaljson-never-gets-called-in-go
+func (e Unknown) MarshalJSON() ([]byte, error) {
+	// If ContentType is unset, we assume this is JSON.
+	if e.ContentType != "" && e.ContentType != ContentTypeJSON {
+		return nil, errors.New("runtime.Unknown: MarshalJSON on non-json data")
+	}
+	if e.Raw == nil {
+		return []byte("null"), nil
+	}
+	return e.Raw, nil
+}
+
+func Convert_runtime_Object_To_runtime_RawExtension(in *Object, out *RawExtension, s conversion.Scope) error {
+	if in == nil {
+		out.Raw = []byte("null")
+		return nil
+	}
+	obj := *in
+	if unk, ok := obj.(*Unknown); ok {
+		if unk.Raw != nil {
+			out.Raw = unk.Raw
+			return nil
+		}
+		obj = out.Object
+	}
+	if obj == nil {
+		out.Raw = nil
+		return nil
+	}
+	out.Object = obj
+	return nil
+}
+
+func Convert_runtime_RawExtension_To_runtime_Object(in *RawExtension, out *Object, s conversion.Scope) error {
+	if in.Object != nil {
+		*out = in.Object
+		return nil
+	}
+	data := in.Raw
+	if len(data) == 0 || (len(data) == 4 && string(data) == "null") {
+		*out = nil
+		return nil
+	}
+	*out = &Unknown{
+		Raw: data,
+		// TODO: Set ContentEncoding and ContentType appropriately.
+		// Currently we set ContentTypeJSON to make tests passing.
+		ContentType: ContentTypeJSON,
+	}
+	return nil
+}
+
+func RegisterEmbeddedConversions(s *Scheme) error {
+	if err := s.AddConversionFunc((*Object)(nil), (*RawExtension)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_runtime_Object_To_runtime_RawExtension(a.(*Object), b.(*RawExtension), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*RawExtension)(nil), (*Object)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_runtime_RawExtension_To_runtime_Object(a.(*RawExtension), b.(*Object), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/embedded_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/embedded_test.go
new file mode 100644
index 0000000000..ded6584730
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/embedded_test.go
@@ -0,0 +1,261 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime_test
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+	"k8s.io/apimachinery/pkg/util/diff"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+func TestDecodeEmptyRawExtensionAsObject(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "v1test"}
+	externalGVK := externalGV.WithKind("ObjectTest")
+
+	s := runtime.NewScheme()
+	s.AddKnownTypes(internalGV, &runtimetesting.ObjectTest{})
+	s.AddKnownTypeWithName(externalGVK, &runtimetesting.ObjectTestExternal{})
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+
+	codec := serializer.NewCodecFactory(s).LegacyCodec(externalGV)
+
+	obj, gvk, err := codec.Decode([]byte(`{"kind":"`+externalGVK.Kind+`","apiVersion":"`+externalGV.String()+`","items":[{}]}`), nil, nil)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	test := obj.(*runtimetesting.ObjectTest)
+	if unk, ok := test.Items[0].(*runtime.Unknown); !ok || unk.Kind != "" || unk.APIVersion != "" || string(unk.Raw) != "{}" || unk.ContentType != runtime.ContentTypeJSON {
+		t.Fatalf("unexpected object: %#v", test.Items[0])
+	}
+	if *gvk != externalGVK {
+		t.Fatalf("unexpected kind: %#v", gvk)
+	}
+
+	obj, gvk, err = codec.Decode([]byte(`{"kind":"`+externalGVK.Kind+`","apiVersion":"`+externalGV.String()+`","items":[{"kind":"Other","apiVersion":"v1"}]}`), nil, nil)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	test = obj.(*runtimetesting.ObjectTest)
+	if unk, ok := test.Items[0].(*runtime.Unknown); !ok || unk.Kind != "" || unk.APIVersion != "" || string(unk.Raw) != `{"kind":"Other","apiVersion":"v1"}` || unk.ContentType != runtime.ContentTypeJSON {
+		t.Fatalf("unexpected object: %#v", test.Items[0])
+	}
+	if *gvk != externalGVK {
+		t.Fatalf("unexpected kind: %#v", gvk)
+	}
+}
+
+func TestArrayOfRuntimeObject(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "v1test"}
+
+	s := runtime.NewScheme()
+	s.AddKnownTypes(internalGV, &runtimetesting.EmbeddedTest{})
+	s.AddKnownTypeWithName(externalGV.WithKind("EmbeddedTest"), &runtimetesting.EmbeddedTestExternal{})
+	s.AddKnownTypes(internalGV, &runtimetesting.ObjectTest{})
+	s.AddKnownTypeWithName(externalGV.WithKind("ObjectTest"), &runtimetesting.ObjectTestExternal{})
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+
+	codec := serializer.NewCodecFactory(s).LegacyCodec(externalGV)
+
+	innerItems := []runtime.Object{
+		&runtimetesting.EmbeddedTest{ID: "baz"},
+	}
+	items := []runtime.Object{
+		&runtimetesting.EmbeddedTest{ID: "foo"},
+		&runtimetesting.EmbeddedTest{ID: "bar"},
+		// TODO: until YAML is removed, this JSON must be in ascending key order to ensure consistent roundtrip serialization
+		&runtime.Unknown{
+			Raw:         []byte(`{"apiVersion":"unknown.group/unknown","foo":"bar","kind":"OtherTest"}`),
+			ContentType: runtime.ContentTypeJSON,
+		},
+		&runtimetesting.ObjectTest{
+			Items: runtime.NewEncodableList(codec, innerItems),
+		},
+	}
+	internal := &runtimetesting.ObjectTest{
+		Items: runtime.NewEncodableList(codec, items),
+	}
+	wire, err := runtime.Encode(codec, internal)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	t.Logf("Wire format is:\n%s\n", string(wire))
+
+	obj := &runtimetesting.ObjectTestExternal{}
+	if err := json.Unmarshal(wire, obj); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	t.Logf("exact wire is: %s", string(obj.Items[0].Raw))
+
+	items[3] = &runtimetesting.ObjectTest{Items: innerItems}
+	internal.Items = items
+
+	decoded, err := runtime.Decode(codec, wire)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	list, err := meta.ExtractList(decoded)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if errs := runtime.DecodeList(list, codec); len(errs) > 0 {
+		t.Fatalf("unexpected error: %v", errs)
+	}
+
+	list2, err := meta.ExtractList(list[3])
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if errs := runtime.DecodeList(list2, codec); len(errs) > 0 {
+		t.Fatalf("unexpected error: %v", errs)
+	}
+	if err := meta.SetList(list[3], list2); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// we want DecodeList to set type meta if possible, even on runtime.Unknown objects
+	internal.Items[2].(*runtime.Unknown).TypeMeta = runtime.TypeMeta{Kind: "OtherTest", APIVersion: "unknown.group/unknown"}
+	if e, a := internal.Items, list; !reflect.DeepEqual(e, a) {
+		t.Errorf("mismatched decoded: %s", diff.ObjectGoPrintSideBySide(e, a))
+	}
+}
+
+func TestNestedObject(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "v1test"}
+	embeddedTestExternalGVK := externalGV.WithKind("EmbeddedTest")
+
+	s := runtime.NewScheme()
+	s.AddKnownTypes(internalGV, &runtimetesting.EmbeddedTest{})
+	s.AddKnownTypeWithName(embeddedTestExternalGVK, &runtimetesting.EmbeddedTestExternal{})
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+
+	codec := serializer.NewCodecFactory(s).LegacyCodec(externalGV)
+
+	inner := &runtimetesting.EmbeddedTest{
+		ID: "inner",
+	}
+	outer := &runtimetesting.EmbeddedTest{
+		ID:     "outer",
+		Object: runtime.NewEncodable(codec, inner),
+	}
+
+	wire, err := runtime.Encode(codec, outer)
+	if err != nil {
+		t.Fatalf("Unexpected encode error '%v'", err)
+	}
+
+	t.Logf("Wire format is:\n%v\n", string(wire))
+
+	decoded, err := runtime.Decode(codec, wire)
+	if err != nil {
+		t.Fatalf("Unexpected decode error %v", err)
+	}
+
+	// for later tests
+	outer.Object = inner
+
+	if e, a := outer, decoded; reflect.DeepEqual(e, a) {
+		t.Errorf("Expected unequal %#v %#v", e, a)
+	}
+
+	obj, err := runtime.Decode(codec, decoded.(*runtimetesting.EmbeddedTest).Object.(*runtime.Unknown).Raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	decoded.(*runtimetesting.EmbeddedTest).Object = obj
+	if e, a := outer, decoded; !reflect.DeepEqual(e, a) {
+		t.Errorf("Expected equal %#v %#v", e, a)
+	}
+
+	// test JSON decoding of the external object, which should preserve
+	// raw bytes
+	var externalViaJSON runtimetesting.EmbeddedTestExternal
+	err = json.Unmarshal(wire, &externalViaJSON)
+	if err != nil {
+		t.Fatalf("Unexpected decode error %v", err)
+	}
+	if externalViaJSON.Kind == "" || externalViaJSON.APIVersion == "" || externalViaJSON.ID != "outer" {
+		t.Errorf("Expected objects to have type info set, got %#v", externalViaJSON)
+	}
+	if len(externalViaJSON.EmptyObject.Raw) > 0 {
+		t.Errorf("Expected deserialization of empty nested objects into empty bytes, got %#v", externalViaJSON)
+	}
+
+	// test JSON decoding, too, since Decode uses yaml unmarshalling.
+	// Generic Unmarshalling of JSON cannot load the nested objects because there is
+	// no default schema set.  Consumers wishing to get direct JSON decoding must use
+	// the external representation
+	var decodedViaJSON runtimetesting.EmbeddedTest
+	err = json.Unmarshal(wire, &decodedViaJSON)
+	if err == nil {
+		t.Fatal("Expeceted decode error")
+	}
+	if _, ok := err.(*json.UnmarshalTypeError); !ok {
+		t.Fatalf("Unexpected decode error: %v", err)
+	}
+	if a := decodedViaJSON; a.Object != nil || a.EmptyObject != nil {
+		t.Errorf("Expected embedded objects to be nil: %#v", a)
+	}
+}
+
+// TestDeepCopyOfRuntimeObject checks to make sure that runtime.Objects's can be passed through DeepCopy with fidelity
+func TestDeepCopyOfRuntimeObject(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "v1test"}
+	embeddedTestExternalGVK := externalGV.WithKind("EmbeddedTest")
+
+	s := runtime.NewScheme()
+	s.AddKnownTypes(internalGV, &runtimetesting.EmbeddedTest{})
+	s.AddKnownTypeWithName(embeddedTestExternalGVK, &runtimetesting.EmbeddedTestExternal{})
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+
+	original := &runtimetesting.EmbeddedTest{
+		ID: "outer",
+		Object: &runtimetesting.EmbeddedTest{
+			ID: "inner",
+		},
+	}
+
+	codec := serializer.NewCodecFactory(s).LegacyCodec(externalGV)
+
+	originalData, err := runtime.Encode(codec, original)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	t.Logf("originalRole = %v\n", string(originalData))
+
+	copyOfOriginal := original.DeepCopy()
+	copiedData, err := runtime.Encode(codec, copyOfOriginal)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	t.Logf("copyOfRole   = %v\n", string(copiedData))
+
+	if !reflect.DeepEqual(original, copyOfOriginal) {
+		t.Errorf("expected \n%v\n, got \n%v", string(originalData), string(copiedData))
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/error.go b/third_party/k8s.io/apimachinery/pkg/runtime/error.go
new file mode 100644
index 0000000000..7dfa45762f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/error.go
@@ -0,0 +1,172 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type notRegisteredErr struct {
+	schemeName string
+	gvk        schema.GroupVersionKind
+	target     GroupVersioner
+	t          reflect.Type
+}
+
+func NewNotRegisteredErrForKind(schemeName string, gvk schema.GroupVersionKind) error {
+	return &notRegisteredErr{schemeName: schemeName, gvk: gvk}
+}
+
+func NewNotRegisteredErrForType(schemeName string, t reflect.Type) error {
+	return &notRegisteredErr{schemeName: schemeName, t: t}
+}
+
+func NewNotRegisteredErrForTarget(schemeName string, t reflect.Type, target GroupVersioner) error {
+	return &notRegisteredErr{schemeName: schemeName, t: t, target: target}
+}
+
+func NewNotRegisteredGVKErrForTarget(schemeName string, gvk schema.GroupVersionKind, target GroupVersioner) error {
+	return &notRegisteredErr{schemeName: schemeName, gvk: gvk, target: target}
+}
+
+func (k *notRegisteredErr) Error() string {
+	if k.t != nil && k.target != nil {
+		return fmt.Sprintf("%v is not suitable for converting to %q in scheme %q", k.t, k.target, k.schemeName)
+	}
+	nullGVK := schema.GroupVersionKind{}
+	if k.gvk != nullGVK && k.target != nil {
+		return fmt.Sprintf("%q is not suitable for converting to %q in scheme %q", k.gvk.GroupVersion(), k.target, k.schemeName)
+	}
+	if k.t != nil {
+		return fmt.Sprintf("no kind is registered for the type %v in scheme %q", k.t, k.schemeName)
+	}
+	if len(k.gvk.Kind) == 0 {
+		return fmt.Sprintf("no version %q has been registered in scheme %q", k.gvk.GroupVersion(), k.schemeName)
+	}
+	if k.gvk.Version == APIVersionInternal {
+		return fmt.Sprintf("no kind %q is registered for the internal version of group %q in scheme %q", k.gvk.Kind, k.gvk.Group, k.schemeName)
+	}
+
+	return fmt.Sprintf("no kind %q is registered for version %q in scheme %q", k.gvk.Kind, k.gvk.GroupVersion(), k.schemeName)
+}
+
+// IsNotRegisteredError returns true if the error indicates the provided
+// object or input data is not registered.
+func IsNotRegisteredError(err error) bool {
+	if err == nil {
+		return false
+	}
+	_, ok := err.(*notRegisteredErr)
+	return ok
+}
+
+type missingKindErr struct {
+	data string
+}
+
+func NewMissingKindErr(data string) error {
+	return &missingKindErr{data}
+}
+
+func (k *missingKindErr) Error() string {
+	return fmt.Sprintf("Object 'Kind' is missing in '%s'", k.data)
+}
+
+// IsMissingKind returns true if the error indicates that the provided object
+// is missing a 'Kind' field.
+func IsMissingKind(err error) bool {
+	if err == nil {
+		return false
+	}
+	_, ok := err.(*missingKindErr)
+	return ok
+}
+
+type missingVersionErr struct {
+	data string
+}
+
+func NewMissingVersionErr(data string) error {
+	return &missingVersionErr{data}
+}
+
+func (k *missingVersionErr) Error() string {
+	return fmt.Sprintf("Object 'apiVersion' is missing in '%s'", k.data)
+}
+
+// IsMissingVersion returns true if the error indicates that the provided object
+// is missing a 'Version' field.
+func IsMissingVersion(err error) bool {
+	if err == nil {
+		return false
+	}
+	_, ok := err.(*missingVersionErr)
+	return ok
+}
+
+// strictDecodingError is a base error type that is returned by a strict Decoder such
+// as UniversalStrictDecoder.
+type strictDecodingError struct {
+	errors []error
+}
+
+// NewStrictDecodingError creates a new strictDecodingError object.
+func NewStrictDecodingError(errors []error) error {
+	return &strictDecodingError{
+		errors: errors,
+	}
+}
+
+func (e *strictDecodingError) Error() string {
+	var s strings.Builder
+	s.WriteString("strict decoding error: ")
+	for i, err := range e.errors {
+		if i != 0 {
+			s.WriteString(", ")
+		}
+		s.WriteString(err.Error())
+	}
+	return s.String()
+}
+
+func (e *strictDecodingError) Errors() []error {
+	return e.errors
+}
+
+// IsStrictDecodingError returns true if the error indicates that the provided object
+// strictness violations.
+func IsStrictDecodingError(err error) bool {
+	if err == nil {
+		return false
+	}
+	_, ok := err.(*strictDecodingError)
+	return ok
+}
+
+// AsStrictDecodingError returns a strict decoding error
+// containing all the strictness violations.
+func AsStrictDecodingError(err error) (*strictDecodingError, bool) {
+	if err == nil {
+		return nil, false
+	}
+	strictErr, ok := err.(*strictDecodingError)
+	return strictErr, ok
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/extension.go b/third_party/k8s.io/apimachinery/pkg/runtime/extension.go
new file mode 100644
index 0000000000..60c000bcb7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/extension.go
@@ -0,0 +1,141 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	"k8s.io/apimachinery/pkg/util/json"
+)
+
+// RawExtension intentionally avoids implementing value.UnstructuredConverter for now because the
+// signature of ToUnstructured does not allow returning an error value in cases where the conversion
+// is not possible (content type is unrecognized or bytes don't match content type).
+func rawToUnstructured(raw []byte, contentType string) (interface{}, error) {
+	switch contentType {
+	case ContentTypeJSON:
+		var u interface{}
+		if err := json.Unmarshal(raw, &u); err != nil {
+			return nil, fmt.Errorf("failed to parse RawExtension bytes as JSON: %w", err)
+		}
+		return u, nil
+	case ContentTypeCBOR:
+		var u interface{}
+		if err := cbor.Unmarshal(raw, &u); err != nil {
+			return nil, fmt.Errorf("failed to parse RawExtension bytes as CBOR: %w", err)
+		}
+		return u, nil
+	default:
+		return nil, fmt.Errorf("cannot convert RawExtension with unrecognized content type to unstructured")
+	}
+}
+
+func (re RawExtension) guessContentType() string {
+	switch {
+	case bytes.HasPrefix(re.Raw, cborSelfDescribed):
+		return ContentTypeCBOR
+	case len(re.Raw) > 0:
+		switch re.Raw[0] {
+		case '\t', '\r', '\n', ' ', '{', '[', 'n', 't', 'f', '"', '-', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			// Prefixes for the four whitespace characters, objects, arrays, strings, numbers, true, false, and null.
+			return ContentTypeJSON
+		}
+	}
+	return ""
+}
+
+func (re *RawExtension) UnmarshalJSON(in []byte) error {
+	if re == nil {
+		return errors.New("runtime.RawExtension: UnmarshalJSON on nil pointer")
+	}
+	if bytes.Equal(in, []byte("null")) {
+		return nil
+	}
+	re.Raw = append(re.Raw[0:0], in...)
+	return nil
+}
+
+var (
+	cborNull          = []byte{0xf6}
+	cborSelfDescribed = []byte{0xd9, 0xd9, 0xf7}
+)
+
+func (re *RawExtension) UnmarshalCBOR(in []byte) error {
+	if re == nil {
+		return errors.New("runtime.RawExtension: UnmarshalCBOR on nil pointer")
+	}
+	if !bytes.Equal(in, cborNull) {
+		if !bytes.HasPrefix(in, cborSelfDescribed) {
+			// The self-described CBOR tag doesn't change the interpretation of the data
+			// item it encloses, but it is useful as a magic number. Its encoding is
+			// also what is used to implement the CBOR RecognizingDecoder.
+			re.Raw = append(re.Raw[:0], cborSelfDescribed...)
+		}
+		re.Raw = append(re.Raw, in...)
+	}
+	return nil
+}
+
+// MarshalJSON may get called on pointers or values, so implement MarshalJSON on value.
+// http://stackoverflow.com/questions/21390979/custom-marshaljson-never-gets-called-in-go
+func (re RawExtension) MarshalJSON() ([]byte, error) {
+	if re.Raw == nil {
+		// TODO: this is to support legacy behavior of JSONPrinter and YAMLPrinter, which
+		// expect to call json.Marshal on arbitrary versioned objects (even those not in
+		// the scheme). pkg/kubectl/resource#AsVersionedObjects and its interaction with
+		// kubectl get on objects not in the scheme needs to be updated to ensure that the
+		// objects that are not part of the scheme are correctly put into the right form.
+		if re.Object != nil {
+			return json.Marshal(re.Object)
+		}
+		return []byte("null"), nil
+	}
+
+	contentType := re.guessContentType()
+	if contentType == ContentTypeJSON {
+		return re.Raw, nil
+	}
+
+	u, err := rawToUnstructured(re.Raw, contentType)
+	if err != nil {
+		return nil, err
+	}
+	return json.Marshal(u)
+}
+
+func (re RawExtension) MarshalCBOR() ([]byte, error) {
+	if re.Raw == nil {
+		if re.Object != nil {
+			return cbor.Marshal(re.Object)
+		}
+		return cbor.Marshal(nil)
+	}
+
+	contentType := re.guessContentType()
+	if contentType == ContentTypeCBOR {
+		return re.Raw, nil
+	}
+
+	u, err := rawToUnstructured(re.Raw, contentType)
+	if err != nil {
+		return nil, err
+	}
+	return cbor.Marshal(u)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/extension_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/extension_test.go
new file mode 100644
index 0000000000..3a296987b7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/extension_test.go
@@ -0,0 +1,264 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestEmbeddedRawExtensionMarshal(t *testing.T) {
+	type test struct {
+		Ext runtime.RawExtension
+	}
+
+	extension := test{Ext: runtime.RawExtension{Raw: []byte(`{"foo":"bar"}`)}}
+	data, err := json.Marshal(extension)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if string(data) != `{"Ext":{"foo":"bar"}}` {
+		t.Errorf("unexpected data: %s", string(data))
+	}
+}
+func TestEmbeddedRawExtensionUnmarshal(t *testing.T) {
+	type test struct {
+		Ext runtime.RawExtension
+	}
+
+	testCases := map[string]struct {
+		orig test
+	}{
+		"non-empty object": {
+			orig: test{Ext: runtime.RawExtension{Raw: []byte(`{"foo":"bar"}`)}},
+		},
+		"empty object": {
+			orig: test{Ext: runtime.RawExtension{}},
+		},
+	}
+
+	for k, tc := range testCases {
+		new := test{}
+		data, _ := json.Marshal(tc.orig)
+		if err := json.Unmarshal(data, &new); err != nil {
+			t.Errorf("%s: umarshal error: %v", k, err)
+		}
+		if !reflect.DeepEqual(tc.orig, new) {
+			t.Errorf("%s: unmarshaled struct differs from original: %v %v", k, tc.orig, new)
+		}
+	}
+}
+
+func TestEmbeddedRawExtensionRoundTrip(t *testing.T) {
+	type test struct {
+		Ext runtime.RawExtension
+	}
+
+	testCases := map[string]struct {
+		orig test
+	}{
+		"non-empty object": {
+			orig: test{Ext: runtime.RawExtension{Raw: []byte(`{"foo":"bar"}`)}},
+		},
+		"empty object": {
+			orig: test{Ext: runtime.RawExtension{}},
+		},
+	}
+
+	for k, tc := range testCases {
+		new1 := test{}
+		new2 := test{}
+		data, err := json.Marshal(tc.orig)
+		if err != nil {
+			t.Errorf("1st marshal error: %v", err)
+		}
+		if err = json.Unmarshal(data, &new1); err != nil {
+			t.Errorf("1st unmarshal error: %v", err)
+		}
+		newData, err := json.Marshal(new1)
+		if err != nil {
+			t.Errorf("2st marshal error: %v", err)
+		}
+		if err = json.Unmarshal(newData, &new2); err != nil {
+			t.Errorf("2nd unmarshal error: %v", err)
+		}
+		if !bytes.Equal(data, newData) {
+			t.Errorf("%s: re-marshaled data differs from original: %v %v", k, data, newData)
+		}
+		if !reflect.DeepEqual(tc.orig, new1) {
+			t.Errorf("%s: unmarshaled struct differs from original: %v %v", k, tc.orig, new1)
+		}
+		if !reflect.DeepEqual(new1, new2) {
+			t.Errorf("%s: re-unmarshaled struct differs from original: %v %v", k, new1, new2)
+		}
+	}
+}
+
+func TestRawExtensionMarshalUnstructured(t *testing.T) {
+	for _, tc := range []struct {
+		Name              string
+		In                runtime.RawExtension
+		WantCBOR          []byte
+		ExpectedErrorCBOR string
+		WantJSON          string
+		ExpectedErrorJSON string
+	}{
+		{
+			Name:     "nil bytes and nil object",
+			In:       runtime.RawExtension{},
+			WantCBOR: []byte{0xf6},
+			WantJSON: "null",
+		},
+		{
+			Name:     "nil bytes and non-nil object",
+			In:       runtime.RawExtension{Object: &runtimetesting.ExternalSimple{TestString: "foo"}},
+			WantCBOR: []byte("\xa1\x4atestString\x43foo"),
+			WantJSON: `{"testString":"foo"}`,
+		},
+		{
+			Name:              "cbor bytes not enclosed in self-described tag",
+			In:                runtime.RawExtension{Raw: []byte{0x43, 'f', 'o', 'o'}}, // 'foo'
+			ExpectedErrorCBOR: "cannot convert RawExtension with unrecognized content type to unstructured",
+			ExpectedErrorJSON: "cannot convert RawExtension with unrecognized content type to unstructured",
+		},
+		{
+			Name:     "cbor bytes enclosed in self-described tag",
+			In:       runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0x43, 'f', 'o', 'o'}}, // 55799('foo')
+			WantCBOR: []byte{0xd9, 0xd9, 0xf7, 0x43, 'f', 'o', 'o'},                            // 55799('foo')
+			WantJSON: `"foo"`,
+		},
+		{
+			Name:     "json bytes",
+			In:       runtime.RawExtension{Raw: []byte(`"foo"`)},
+			WantCBOR: []byte{0x43, 'f', 'o', 'o'},
+			WantJSON: `"foo"`,
+		},
+		{
+			Name:     "ambiguous bytes not enclosed in self-described cbor tag",
+			In:       runtime.RawExtension{Raw: []byte{'0'}}, // CBOR -17 / JSON 0
+			WantCBOR: []byte{0x00},
+			WantJSON: `0`,
+		},
+		{
+			Name:     "ambiguous bytes enclosed in self-described cbor tag",
+			In:       runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, '0'}}, // 55799(-17)
+			WantCBOR: []byte{0xd9, 0xd9, 0xf7, '0'},
+			WantJSON: `-17`,
+		},
+		{
+			Name:              "unrecognized bytes",
+			In:                runtime.RawExtension{Raw: []byte{0xff}},
+			ExpectedErrorCBOR: "cannot convert RawExtension with unrecognized content type to unstructured",
+			ExpectedErrorJSON: "cannot convert RawExtension with unrecognized content type to unstructured",
+		},
+		{
+			Name:              "invalid cbor with self-described cbor prefix",
+			In:                runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0xff}},
+			WantCBOR:          []byte{0xd9, 0xd9, 0xf7, 0xff}, // verbatim
+			ExpectedErrorJSON: `failed to parse RawExtension bytes as CBOR: cbor: unexpected "break" code`,
+		},
+		{
+			Name:              "invalid json with json prefix",
+			In:                runtime.RawExtension{Raw: []byte(`{{`)},
+			ExpectedErrorCBOR: `failed to parse RawExtension bytes as JSON: invalid character '{' looking for beginning of object key string`,
+			WantJSON:          `{{`, // verbatim
+		},
+	} {
+		t.Run(tc.Name, func(t *testing.T) {
+			t.Run("CBOR", func(t *testing.T) {
+				got, err := tc.In.MarshalCBOR()
+				if err != nil {
+					if tc.ExpectedErrorCBOR == "" {
+						t.Fatalf("unexpected error: %v", err)
+					}
+					if msg := err.Error(); msg != tc.ExpectedErrorCBOR {
+						t.Fatalf("expected error %q but got %q", tc.ExpectedErrorCBOR, msg)
+					}
+				}
+
+				if diff := cmp.Diff(tc.WantCBOR, got); diff != "" {
+					t.Errorf("unexpected diff:\n%s", diff)
+				}
+			})
+
+			t.Run("JSON", func(t *testing.T) {
+				got, err := tc.In.MarshalJSON()
+				if err != nil {
+					if tc.ExpectedErrorJSON == "" {
+						t.Fatalf("unexpected error: %v", err)
+					}
+					if msg := err.Error(); msg != tc.ExpectedErrorJSON {
+						t.Fatalf("expected error %q but got %q", tc.ExpectedErrorJSON, msg)
+					}
+				}
+
+				if diff := cmp.Diff(tc.WantJSON, string(got)); diff != "" {
+					t.Errorf("unexpected diff:\n%s", diff)
+				}
+			})
+		})
+	}
+}
+
+func TestRawExtensionUnmarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		Name string
+		In   []byte
+		Want runtime.RawExtension
+	}{
+		{
+			// From json.Unmarshaler: By convention, to approximate the behavior of
+			// Unmarshal itself, Unmarshalers implement UnmarshalJSON([]byte("null")) as
+			// a no-op.
+			Name: "no-op on null",
+			In:   []byte{0xf6},
+			Want: runtime.RawExtension{},
+		},
+		{
+			Name: "input copied verbatim",
+			In:   []byte{0xd9, 0xd9, 0xf7, 0x5f, 0x41, 'f', 0x42, 'o', 'o', 0xff}, // 55799(_ 'f' 'oo')
+			Want: runtime.RawExtension{
+				Raw: []byte{0xd9, 0xd9, 0xf7, 0x5f, 0x41, 'f', 0x42, 'o', 'o', 0xff}, // 55799(_ 'f' 'oo')
+			},
+		},
+		{
+			Name: "input enclosed in self-described tag if absent",
+			In:   []byte{0x5f, 0x41, 'f', 0x42, 'o', 'o', 0xff}, // (_ 'f' 'oo')
+			Want: runtime.RawExtension{
+				Raw: []byte{0xd9, 0xd9, 0xf7, 0x5f, 0x41, 'f', 0x42, 'o', 'o', 0xff}, // 55799(_ 'f' 'oo')
+			},
+		},
+	} {
+		t.Run(tc.Name, func(t *testing.T) {
+			var got runtime.RawExtension
+			if err := got.UnmarshalCBOR(tc.In); err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			if diff := cmp.Diff(tc.Want, got); diff != "" {
+				t.Errorf("unexpected diff:\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_126.go b/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_126.go
new file mode 100644
index 0000000000..686ff6abb3
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_126.go
@@ -0,0 +1,26 @@
+//go:build !go1.27
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import "reflect"
+
+func isInlinedFromTag(fieldType reflect.StructField, tagName string, tagDirectives []string) bool {
+	// go <1.27 doesn't honor ",inline"
+	return false
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_126_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_126_test.go
new file mode 100644
index 0000000000..b1da16b9a1
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_126_test.go
@@ -0,0 +1,21 @@
+//go:build !go1.27
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime_test
+
+const stdlibSupportsEmbedTag = false
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_127.go b/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_127.go
new file mode 100644
index 0000000000..abaa79a2db
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_127.go
@@ -0,0 +1,33 @@
+//go:build go1.27
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"reflect"
+)
+
+func isInlinedFromTag(field reflect.StructField, tagName string, tagDirectives []string) bool {
+	fieldType := field.Type
+	if fieldType.Kind() == reflect.Pointer && fieldType.Name() == "" {
+		// optionally unwrap a single level
+		fieldType = fieldType.Elem()
+	}
+	// TODO: when switching to direct use of json/v2, error on non-struct embedding and use of embed with other directives
+	return fieldType.Kind() == reflect.Struct && tagName == "" && len(tagDirectives) == 1 && tagDirectives[0] == "embed"
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_127_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_127_test.go
new file mode 100644
index 0000000000..8cb7fc1e51
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/fieldinfo_127_test.go
@@ -0,0 +1,21 @@
+//go:build go1.27
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime_test
+
+const stdlibSupportsEmbedTag = true
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/generated.pb.go b/third_party/k8s.io/apimachinery/pkg/runtime/generated.pb.go
new file mode 100644
index 0000000000..f5e78d4b36
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/generated.pb.go
@@ -0,0 +1,716 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/apimachinery/pkg/runtime/generated.proto
+
+package runtime
+
+import (
+	fmt "fmt"
+
+	io "io"
+	math_bits "math/bits"
+	reflect "reflect"
+	strings "strings"
+)
+
+func (m *RawExtension) Reset() { *m = RawExtension{} }
+
+func (m *TypeMeta) Reset() { *m = TypeMeta{} }
+
+func (m *Unknown) Reset() { *m = Unknown{} }
+
+func (m *RawExtension) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RawExtension) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RawExtension) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.Raw != nil {
+		i -= len(m.Raw)
+		copy(dAtA[i:], m.Raw)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(m.Raw)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *TypeMeta) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TypeMeta) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *TypeMeta) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.APIVersion)
+	copy(dAtA[i:], m.APIVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.APIVersion)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *Unknown) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Unknown) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Unknown) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.ContentType)
+	copy(dAtA[i:], m.ContentType)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ContentType)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.ContentEncoding)
+	copy(dAtA[i:], m.ContentEncoding)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ContentEncoding)))
+	i--
+	dAtA[i] = 0x1a
+	if m.Raw != nil {
+		i -= len(m.Raw)
+		copy(dAtA[i:], m.Raw)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(m.Raw)))
+		i--
+		dAtA[i] = 0x12
+	}
+	{
+		size, err := m.TypeMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *RawExtension) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Raw != nil {
+		l = len(m.Raw)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *TypeMeta) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.APIVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *Unknown) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.TypeMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Raw != nil {
+		l = len(m.Raw)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = len(m.ContentEncoding)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.ContentType)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozGenerated(x uint64) (n int) {
+	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *RawExtension) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&RawExtension{`,
+		`Raw:` + valueToStringGenerated(this.Raw) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *TypeMeta) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&TypeMeta{`,
+		`APIVersion:` + fmt.Sprintf("%v", this.APIVersion) + `,`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Unknown) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Unknown{`,
+		`TypeMeta:` + strings.Replace(strings.Replace(this.TypeMeta.String(), "TypeMeta", "TypeMeta", 1), `&`, ``, 1) + `,`,
+		`Raw:` + valueToStringGenerated(this.Raw) + `,`,
+		`ContentEncoding:` + fmt.Sprintf("%v", this.ContentEncoding) + `,`,
+		`ContentType:` + fmt.Sprintf("%v", this.ContentType) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringGenerated(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *RawExtension) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RawExtension: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RawExtension: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Raw", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Raw = append(m.Raw[:0], dAtA[iNdEx:postIndex]...)
+			if m.Raw == nil {
+				m.Raw = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TypeMeta) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TypeMeta: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TypeMeta: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field APIVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.APIVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Unknown) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Unknown: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Unknown: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TypeMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.TypeMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Raw", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Raw = append(m.Raw[:0], dAtA[iNdEx:postIndex]...)
+			if m.Raw == nil {
+				m.Raw = []byte{}
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ContentEncoding", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ContentEncoding = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ContentType", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ContentType = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipGenerated(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLengthGenerated
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupGenerated
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthGenerated
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+var (
+	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/generated.proto b/third_party/k8s.io/apimachinery/pkg/runtime/generated.proto
new file mode 100644
index 0000000000..93d187d94a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/generated.proto
@@ -0,0 +1,134 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.apimachinery.pkg.runtime;
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/apimachinery/pkg/runtime";
+
+// RawExtension is used to hold extensions in external versions.
+//
+// To use this, make a field which has RawExtension as its type in your external, versioned
+// struct, and Object in your internal struct. You also need to register your
+// various plugin types.
+//
+// // Internal package:
+//
+// 	type MyAPIObject struct {
+// 		runtime.TypeMeta `json:""`
+// 		MyPlugin runtime.Object `json:"myPlugin"`
+// 	}
+//
+// 	type PluginA struct {
+// 		AOption string `json:"aOption"`
+// 	}
+//
+// // External package:
+//
+// 	type MyAPIObject struct {
+// 		runtime.TypeMeta `json:""`
+// 		MyPlugin runtime.RawExtension `json:"myPlugin"`
+// 	}
+//
+// 	type PluginA struct {
+// 		AOption string `json:"aOption"`
+// 	}
+//
+// // On the wire, the JSON will look something like this:
+//
+// 	{
+// 		"kind":"MyAPIObject",
+// 		"apiVersion":"v1",
+// 		"myPlugin": {
+// 			"kind":"PluginA",
+// 			"aOption":"foo",
+// 		},
+// 	}
+//
+// So what happens? Decode first uses json or yaml to unmarshal the serialized data into
+// your external MyAPIObject. That causes the raw JSON to be stored, but not unpacked.
+// The next step is to copy (using pkg/conversion) into the internal struct. The runtime
+// package's DefaultScheme has conversion functions installed which will unpack the
+// JSON stored in RawExtension, turning it into the correct object type, and storing it
+// in the Object. (TODO: In the case where the object is of an unknown type, a
+// runtime.Unknown object will be created and stored.)
+//
+// +k8s:deepcopy-gen=true
+// +protobuf=true
+// +k8s:openapi-gen=true
+message RawExtension {
+  // Raw is the underlying serialization of this object.
+  //
+  // TODO: Determine how to detect ContentType and ContentEncoding of 'Raw' data.
+  optional bytes raw = 1;
+}
+
+// TypeMeta is shared by all top level objects. The proper way to use it is to inline it in your type,
+// like this:
+//
+// 	type MyAwesomeAPIObject struct {
+// 	     runtime.TypeMeta    `json:""`
+// 	     ... // other fields
+// 	}
+//
+// func (obj *MyAwesomeAPIObject) SetGroupVersionKind(gvk *metav1.GroupVersionKind) { metav1.UpdateTypeMeta(obj,gvk) }; GroupVersionKind() *GroupVersionKind
+//
+// TypeMeta is provided here for convenience. You may use it directly from this package or define
+// your own with the same fields.
+//
+// +k8s:deepcopy-gen=false
+// +protobuf=true
+// +k8s:openapi-gen=true
+message TypeMeta {
+  // +optional
+  optional string apiVersion = 1;
+
+  // +optional
+  optional string kind = 2;
+}
+
+// Unknown allows api objects with unknown types to be passed-through. This can be used
+// to deal with the API objects from a plug-in. Unknown objects still have functioning
+// TypeMeta features-- kind, version, etc.
+// TODO: Make this object have easy access to field based accessors and settors for
+// metadata and field mutatation.
+//
+// +k8s:deepcopy-gen=true
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +protobuf=true
+// +k8s:openapi-gen=true
+message Unknown {
+  optional TypeMeta typeMeta = 1;
+
+  // Raw will hold the complete serialized object which couldn't be matched
+  // with a registered type. Most likely, nothing should be done with this
+  // except for passing it through the system.
+  optional bytes raw = 2;
+
+  // ContentEncoding is encoding used to encode 'Raw' data.
+  // Unspecified means no encoding.
+  optional string contentEncoding = 3;
+
+  // ContentType  is serialization method used to serialize 'Raw'.
+  // Unspecified means ContentTypeJSON.
+  optional string contentType = 4;
+}
+
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/helper.go b/third_party/k8s.io/apimachinery/pkg/runtime/helper.go
new file mode 100644
index 0000000000..242a349865
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/helper.go
@@ -0,0 +1,310 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"fmt"
+	"io"
+	"reflect"
+
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/errors"
+)
+
+// unsafeObjectConvertor implements ObjectConvertor using the unsafe conversion path.
+type unsafeObjectConvertor struct {
+	*Scheme
+}
+
+var _ ObjectConvertor = unsafeObjectConvertor{}
+
+// ConvertToVersion converts in to the provided outVersion without copying the input first, which
+// is only safe if the output object is not mutated or reused.
+func (c unsafeObjectConvertor) ConvertToVersion(in Object, outVersion GroupVersioner) (Object, error) {
+	return c.Scheme.UnsafeConvertToVersion(in, outVersion)
+}
+
+// UnsafeObjectConvertor performs object conversion without copying the object structure,
+// for use when the converted object will not be reused or mutated. Primarily for use within
+// versioned codecs, which use the external object for serialization but do not return it.
+func UnsafeObjectConvertor(scheme *Scheme) ObjectConvertor {
+	return unsafeObjectConvertor{scheme}
+}
+
+// SetField puts the value of src, into fieldName, which must be a member of v.
+// The value of src must be assignable to the field.
+func SetField(src interface{}, v reflect.Value, fieldName string) error {
+	field := v.FieldByName(fieldName)
+	if !field.IsValid() {
+		return fmt.Errorf("couldn't find %v field in %T", fieldName, v.Interface())
+	}
+	srcValue := reflect.ValueOf(src)
+	if srcValue.Type().AssignableTo(field.Type()) {
+		field.Set(srcValue)
+		return nil
+	}
+	if srcValue.Type().ConvertibleTo(field.Type()) {
+		field.Set(srcValue.Convert(field.Type()))
+		return nil
+	}
+	return fmt.Errorf("couldn't assign/convert %v to %v", srcValue.Type(), field.Type())
+}
+
+// Field puts the value of fieldName, which must be a member of v, into dest,
+// which must be a variable to which this field's value can be assigned.
+func Field(v reflect.Value, fieldName string, dest interface{}) error {
+	field := v.FieldByName(fieldName)
+	if !field.IsValid() {
+		return fmt.Errorf("couldn't find %v field in %T", fieldName, v.Interface())
+	}
+	destValue, err := conversion.EnforcePtr(dest)
+	if err != nil {
+		return err
+	}
+	if field.Type().AssignableTo(destValue.Type()) {
+		destValue.Set(field)
+		return nil
+	}
+	if field.Type().ConvertibleTo(destValue.Type()) {
+		destValue.Set(field.Convert(destValue.Type()))
+		return nil
+	}
+	return fmt.Errorf("couldn't assign/convert %v to %v", field.Type(), destValue.Type())
+}
+
+// FieldPtr puts the address of fieldName, which must be a member of v,
+// into dest, which must be an address of a variable to which this field's
+// address can be assigned.
+func FieldPtr(v reflect.Value, fieldName string, dest interface{}) error {
+	field := v.FieldByName(fieldName)
+	if !field.IsValid() {
+		return fmt.Errorf("couldn't find %v field in %T", fieldName, v.Interface())
+	}
+	v, err := conversion.EnforcePtr(dest)
+	if err != nil {
+		return err
+	}
+	field = field.Addr()
+	if field.Type().AssignableTo(v.Type()) {
+		v.Set(field)
+		return nil
+	}
+	if field.Type().ConvertibleTo(v.Type()) {
+		v.Set(field.Convert(v.Type()))
+		return nil
+	}
+	return fmt.Errorf("couldn't assign/convert %v to %v", field.Type(), v.Type())
+}
+
+// EncodeList ensures that each object in an array is converted to a Unknown{} in serialized form.
+// TODO: accept a content type.
+func EncodeList(e Encoder, objects []Object) error {
+	var errs []error
+	for i := range objects {
+		data, err := Encode(e, objects[i])
+		if err != nil {
+			errs = append(errs, err)
+			continue
+		}
+		// TODO: Set ContentEncoding and ContentType.
+		objects[i] = &Unknown{Raw: data}
+	}
+	return errors.NewAggregate(errs)
+}
+
+func decodeListItem(obj *Unknown, decoders []Decoder) (Object, error) {
+	for _, decoder := range decoders {
+		// TODO: Decode based on ContentType.
+		obj, err := Decode(decoder, obj.Raw)
+		if err != nil {
+			if IsNotRegisteredError(err) {
+				continue
+			}
+			return nil, err
+		}
+		return obj, nil
+	}
+	// could not decode, so leave the object as Unknown, but give the decoders the
+	// chance to set Unknown.TypeMeta if it is available.
+	for _, decoder := range decoders {
+		if err := DecodeInto(decoder, obj.Raw, obj); err == nil {
+			return obj, nil
+		}
+	}
+	return obj, nil
+}
+
+// DecodeList alters the list in place, attempting to decode any objects found in
+// the list that have the Unknown type. Any errors that occur are returned
+// after the entire list is processed. Decoders are tried in order.
+func DecodeList(objects []Object, decoders ...Decoder) []error {
+	errs := []error(nil)
+	for i, obj := range objects {
+		switch t := obj.(type) {
+		case *Unknown:
+			decoded, err := decodeListItem(t, decoders)
+			if err != nil {
+				errs = append(errs, err)
+				break
+			}
+			objects[i] = decoded
+		}
+	}
+	return errs
+}
+
+// MultiObjectTyper returns the types of objects across multiple schemes in order.
+type MultiObjectTyper []ObjectTyper
+
+var _ ObjectTyper = MultiObjectTyper{}
+
+func (m MultiObjectTyper) ObjectKinds(obj Object) (gvks []schema.GroupVersionKind, unversionedType bool, err error) {
+	for _, t := range m {
+		gvks, unversionedType, err = t.ObjectKinds(obj)
+		if err == nil {
+			return
+		}
+	}
+	return
+}
+
+func (m MultiObjectTyper) Recognizes(gvk schema.GroupVersionKind) bool {
+	for _, t := range m {
+		if t.Recognizes(gvk) {
+			return true
+		}
+	}
+	return false
+}
+
+// SetZeroValue would set the object of objPtr to zero value of its type.
+func SetZeroValue(objPtr Object) error {
+	v, err := conversion.EnforcePtr(objPtr)
+	if err != nil {
+		return err
+	}
+	v.Set(reflect.Zero(v.Type()))
+	return nil
+}
+
+// DefaultFramer is valid for any stream that can read objects serially without
+// any separation in the stream.
+var DefaultFramer = defaultFramer{}
+
+type defaultFramer struct{}
+
+func (defaultFramer) NewFrameReader(r io.ReadCloser) io.ReadCloser { return r }
+func (defaultFramer) NewFrameWriter(w io.Writer) io.Writer         { return w }
+
+// WithVersionEncoder serializes an object and ensures the GVK is set.
+type WithVersionEncoder struct {
+	Version GroupVersioner
+	Encoder
+	ObjectTyper
+}
+
+// Encode does not do conversion. It sets the gvk during serialization.
+func (e WithVersionEncoder) Encode(obj Object, stream io.Writer) error {
+	gvks, _, err := e.ObjectTyper.ObjectKinds(obj)
+	if err != nil {
+		if IsNotRegisteredError(err) {
+			return e.Encoder.Encode(obj, stream)
+		}
+		return err
+	}
+	kind := obj.GetObjectKind()
+	oldGVK := kind.GroupVersionKind()
+	gvk := gvks[0]
+	if e.Version != nil {
+		preferredGVK, ok := e.Version.KindForGroupVersionKinds(gvks)
+		if ok {
+			gvk = preferredGVK
+		}
+	}
+
+	// The gvk only needs to be set if not already as desired.
+	if gvk != oldGVK {
+		kind.SetGroupVersionKind(gvk)
+		defer kind.SetGroupVersionKind(oldGVK)
+	}
+
+	return e.Encoder.Encode(obj, stream)
+}
+
+// WithoutVersionDecoder clears the group version kind of a deserialized object.
+type WithoutVersionDecoder struct {
+	Decoder
+}
+
+// Decode does not do conversion. It removes the gvk during deserialization.
+func (d WithoutVersionDecoder) Decode(data []byte, defaults *schema.GroupVersionKind, into Object) (Object, *schema.GroupVersionKind, error) {
+	obj, gvk, err := d.Decoder.Decode(data, defaults, into)
+	if obj != nil {
+		kind := obj.GetObjectKind()
+		// clearing the gvk is just a convention of a codec
+		kind.SetGroupVersionKind(schema.GroupVersionKind{})
+	}
+	return obj, gvk, err
+}
+
+type encoderWithAllocator struct {
+	encoder      EncoderWithAllocator
+	memAllocator MemoryAllocator
+}
+
+// NewEncoderWithAllocator returns a new encoder
+func NewEncoderWithAllocator(e EncoderWithAllocator, a MemoryAllocator) Encoder {
+	return &encoderWithAllocator{
+		encoder:      e,
+		memAllocator: a,
+	}
+}
+
+// Encode writes the provided object to the nested writer
+func (e *encoderWithAllocator) Encode(obj Object, w io.Writer) error {
+	return e.encoder.EncodeWithAllocator(obj, w, e.memAllocator)
+}
+
+// Identifier returns identifier of this encoder.
+func (e *encoderWithAllocator) Identifier() Identifier {
+	return e.encoder.Identifier()
+}
+
+// The legacy discovery endpoint requires that its response Encoder implement Serializer.
+// https://github.com/kubernetes/kubernetes/blob/4a1340bfd58fdb3846d4342c101e0bcb574fbfb1/staging/src/k8s.io/apiserver/pkg/endpoints/discovery/util.go#L101-L107
+var _ Serializer = nondeterministicEncoderToEncoderAdapter{}
+
+type nondeterministicEncoderToEncoderAdapter struct {
+	NondeterministicEncoder
+
+	Decoder
+}
+
+func (e nondeterministicEncoderToEncoderAdapter) Encode(obj Object, w io.Writer) error {
+	return e.EncodeNondeterministic(obj, w)
+}
+
+// UseNondeterministicEncoding returns an Encoder that encodes objects using the provided
+// Serializer's EncodeNondeterministic method if it implements NondeterministicEncoder, otherwise it
+// returns the provided Serializer as-is.
+func UseNondeterministicEncoding(serializer Serializer) Encoder {
+	if nondeterministic, ok := serializer.(NondeterministicEncoder); ok {
+		return nondeterministicEncoderToEncoderAdapter{NondeterministicEncoder: nondeterministic, Decoder: serializer}
+	}
+	return serializer
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/interfaces.go b/third_party/k8s.io/apimachinery/pkg/runtime/interfaces.go
new file mode 100644
index 0000000000..8456c21d31
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/interfaces.go
@@ -0,0 +1,393 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"io"
+	"net/url"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+const (
+	// APIVersionInternal may be used if you are registering a type that should not
+	// be considered stable or serialized - it is a convention only and has no
+	// special behavior in this package.
+	APIVersionInternal = "__internal"
+)
+
+// GroupVersioner refines a set of possible conversion targets into a single option.
+type GroupVersioner interface {
+	// KindForGroupVersionKinds returns a desired target group version kind for the given input, or returns ok false if no
+	// target is known. In general, if the return target is not in the input list, the caller is expected to invoke
+	// Scheme.New(target) and then perform a conversion between the current Go type and the destination Go type.
+	// Sophisticated implementations may use additional information about the input kinds to pick a destination kind.
+	KindForGroupVersionKinds(kinds []schema.GroupVersionKind) (target schema.GroupVersionKind, ok bool)
+	// Identifier returns string representation of the object.
+	// Identifiers of two different encoders should be equal only if for every input
+	// kinds they return the same result.
+	Identifier() string
+}
+
+// Identifier represents an identifier.
+// Identitier of two different objects should be equal if and only if for every
+// input the output they produce is exactly the same.
+type Identifier string
+
+// Encoder writes objects to a serialized form
+type Encoder interface {
+	// Encode writes an object to a stream. Implementations may return errors if the versions are
+	// incompatible, or if no conversion is defined.
+	Encode(obj Object, w io.Writer) error
+	// Identifier returns an identifier of the encoder.
+	// Identifiers of two different encoders should be equal if and only if for every input
+	// object it will be encoded to the same representation by both of them.
+	//
+	// Identifier is intended for use with CacheableObject#CacheEncode method. In order to
+	// correctly handle CacheableObject, Encode() method should look similar to below, where
+	// doEncode() is the encoding logic of implemented encoder:
+	//   func (e *MyEncoder) Encode(obj Object, w io.Writer) error {
+	//     if co, ok := obj.(CacheableObject); ok {
+	//       return co.CacheEncode(e.Identifier(), e.doEncode, w)
+	//     }
+	//     return e.doEncode(obj, w)
+	//   }
+	Identifier() Identifier
+}
+
+// NondeterministicEncoder is implemented by Encoders that can serialize objects more efficiently in
+// cases where the output does not need to be deterministic.
+type NondeterministicEncoder interface {
+	Encoder
+
+	// EncodeNondeterministic writes an object to the stream. Unlike the Encode method of
+	// Encoder, EncodeNondeterministic does not guarantee that any two invocations will write
+	// the same sequence of bytes to the io.Writer. Any differences will not be significant to a
+	// generic decoder. For example, map entries and struct fields might be encoded in any
+	// order.
+	EncodeNondeterministic(Object, io.Writer) error
+}
+
+// MemoryAllocator is responsible for allocating memory.
+// By encapsulating memory allocation into its own interface, we can reuse the memory
+// across many operations in places we know it can significantly improve the performance.
+type MemoryAllocator interface {
+	// Allocate reserves memory for n bytes.
+	// Note that implementations of this method are not required to zero the returned array.
+	// It is the caller's responsibility to clean the memory if needed.
+	Allocate(n uint64) []byte
+}
+
+// EncoderWithAllocator  serializes objects in a way that allows callers to manage any additional memory allocations.
+type EncoderWithAllocator interface {
+	Encoder
+	// EncodeWithAllocator writes an object to a stream as Encode does.
+	// In addition, it allows for providing a memory allocator for efficient memory usage during object serialization
+	EncodeWithAllocator(obj Object, w io.Writer, memAlloc MemoryAllocator) error
+}
+
+// Decoder attempts to load an object from data.
+type Decoder interface {
+	// Decode attempts to deserialize the provided data using either the innate typing of the scheme or the
+	// default kind, group, and version provided. It returns a decoded object as well as the kind, group, and
+	// version from the serialized data, or an error. If into is non-nil, it will be used as the target type
+	// and implementations may choose to use it rather than reallocating an object. However, the object is not
+	// guaranteed to be populated. The returned object is not guaranteed to match into. If defaults are
+	// provided, they are applied to the data by default. If no defaults or partial defaults are provided, the
+	// type of the into may be used to guide conversion decisions.
+	Decode(data []byte, defaults *schema.GroupVersionKind, into Object) (Object, *schema.GroupVersionKind, error)
+}
+
+// Serializer is the core interface for transforming objects into a serialized format and back.
+// Implementations may choose to perform conversion of the object, but no assumptions should be made.
+type Serializer interface {
+	Encoder
+	Decoder
+}
+
+// Codec is a Serializer that deals with the details of versioning objects. It offers the same
+// interface as Serializer, so this is a marker to consumers that care about the version of the objects
+// they receive.
+type Codec Serializer
+
+// ParameterCodec defines methods for serializing and deserializing API objects to url.Values and
+// performing any necessary conversion. Unlike the normal Codec, query parameters are not self describing
+// and the desired version must be specified.
+type ParameterCodec interface {
+	// DecodeParameters takes the given url.Values in the specified group version and decodes them
+	// into the provided object, or returns an error.
+	DecodeParameters(parameters url.Values, from schema.GroupVersion, into Object) error
+	// EncodeParameters encodes the provided object as query parameters or returns an error.
+	EncodeParameters(obj Object, to schema.GroupVersion) (url.Values, error)
+}
+
+// Framer is a factory for creating readers and writers that obey a particular framing pattern.
+type Framer interface {
+	NewFrameReader(r io.ReadCloser) io.ReadCloser
+	NewFrameWriter(w io.Writer) io.Writer
+}
+
+// SerializerInfo contains information about a specific serialization format
+type SerializerInfo struct {
+	// MediaType is the value that represents this serializer over the wire.
+	MediaType string
+	// MediaTypeType is the first part of the MediaType ("application" in "application/json").
+	MediaTypeType string
+	// MediaTypeSubType is the second part of the MediaType ("json" in "application/json").
+	MediaTypeSubType string
+	// EncodesAsText indicates this serializer can be encoded to UTF-8 safely.
+	EncodesAsText bool
+	// Serializer is the individual object serializer for this media type.
+	Serializer Serializer
+	// PrettySerializer, if set, can serialize this object in a form biased towards
+	// readability.
+	PrettySerializer Serializer
+	// StrictSerializer, if set, deserializes this object strictly,
+	// erring on unknown fields.
+	StrictSerializer Serializer
+	// StreamSerializer, if set, describes the streaming serialization format
+	// for this media type.
+	StreamSerializer *StreamSerializerInfo
+}
+
+// StreamSerializerInfo contains information about a specific stream serialization format
+type StreamSerializerInfo struct {
+	// EncodesAsText indicates this serializer can be encoded to UTF-8 safely.
+	EncodesAsText bool
+	// Serializer is the top level object serializer for this type when streaming
+	Serializer
+	// Framer is the factory for retrieving streams that separate objects on the wire
+	Framer
+}
+
+// NegotiatedSerializer is an interface used for obtaining encoders, decoders, and serializers
+// for multiple supported media types. This would commonly be accepted by a server component
+// that performs HTTP content negotiation to accept multiple formats.
+type NegotiatedSerializer interface {
+	// SupportedMediaTypes is the media types supported for reading and writing single objects.
+	SupportedMediaTypes() []SerializerInfo
+
+	// EncoderForVersion returns an encoder that ensures objects being written to the provided
+	// serializer are in the provided group version.
+	EncoderForVersion(serializer Encoder, gv GroupVersioner) Encoder
+	// DecoderToVersion returns a decoder that ensures objects being read by the provided
+	// serializer are in the provided group version by default.
+	DecoderToVersion(serializer Decoder, gv GroupVersioner) Decoder
+}
+
+// ClientNegotiator handles turning an HTTP content type into the appropriate encoder.
+// Use NewClientNegotiator or NewVersionedClientNegotiator to create this interface from
+// a NegotiatedSerializer.
+type ClientNegotiator interface {
+	// Encoder returns the appropriate encoder for the provided contentType (e.g. application/json)
+	// and any optional mediaType parameters (e.g. pretty=1), or an error. If no serializer is found
+	// a NegotiateError will be returned. The current client implementations consider params to be
+	// optional modifiers to the contentType and will ignore unrecognized parameters.
+	Encoder(contentType string, params map[string]string) (Encoder, error)
+	// Decoder returns the appropriate decoder for the provided contentType (e.g. application/json)
+	// and any optional mediaType parameters (e.g. pretty=1), or an error. If no serializer is found
+	// a NegotiateError will be returned. The current client implementations consider params to be
+	// optional modifiers to the contentType and will ignore unrecognized parameters.
+	Decoder(contentType string, params map[string]string) (Decoder, error)
+	// StreamDecoder returns the appropriate stream decoder for the provided contentType (e.g.
+	// application/json) and any optional mediaType parameters (e.g. pretty=1), or an error. If no
+	// serializer is found a NegotiateError will be returned. The Serializer and Framer will always
+	// be returned if a Decoder is returned. The current client implementations consider params to be
+	// optional modifiers to the contentType and will ignore unrecognized parameters.
+	StreamDecoder(contentType string, params map[string]string) (Decoder, Serializer, Framer, error)
+}
+
+// StorageSerializer is an interface used for obtaining encoders, decoders, and serializers
+// that can read and write data at rest. This would commonly be used by client tools that must
+// read files, or server side storage interfaces that persist restful objects.
+type StorageSerializer interface {
+	// SupportedMediaTypes are the media types supported for reading and writing objects.
+	SupportedMediaTypes() []SerializerInfo
+
+	// UniversalDeserializer returns a Serializer that can read objects in multiple supported formats
+	// by introspecting the data at rest.
+	UniversalDeserializer() Decoder
+
+	// EncoderForVersion returns an encoder that ensures objects being written to the provided
+	// serializer are in the provided group version.
+	EncoderForVersion(serializer Encoder, gv GroupVersioner) Encoder
+	// DecoderForVersion returns a decoder that ensures objects being read by the provided
+	// serializer are in the provided group version by default.
+	DecoderToVersion(serializer Decoder, gv GroupVersioner) Decoder
+}
+
+// NestedObjectEncoder is an optional interface that objects may implement to be given
+// an opportunity to encode any nested Objects / RawExtensions during serialization.
+type NestedObjectEncoder interface {
+	EncodeNestedObjects(e Encoder) error
+}
+
+// NestedObjectDecoder is an optional interface that objects may implement to be given
+// an opportunity to decode any nested Objects / RawExtensions during serialization.
+// It is possible for DecodeNestedObjects to return a non-nil error but for the decoding
+// to have succeeded in the case of strict decoding errors (e.g. unknown/duplicate fields).
+// As such it is important for callers of DecodeNestedObjects to check to confirm whether
+// an error is a runtime.StrictDecodingError before short circuiting.
+// Similarly, implementations of DecodeNestedObjects should ensure that a runtime.StrictDecodingError
+// is only returned when the rest of decoding has succeeded.
+type NestedObjectDecoder interface {
+	DecodeNestedObjects(d Decoder) error
+}
+
+///////////////////////////////////////////////////////////////////////////////
+// Non-codec interfaces
+
+type ObjectDefaulter interface {
+	// Default takes an object (must be a pointer) and applies any default values.
+	// Defaulters may not error.
+	Default(in Object)
+}
+
+type ObjectVersioner interface {
+	ConvertToVersion(in Object, gv GroupVersioner) (out Object, err error)
+	PrioritizedVersionsForGroup(group string) []schema.GroupVersion
+}
+
+// ObjectConvertor converts an object to a different version.
+type ObjectConvertor interface {
+	// Convert attempts to convert one object into another, or returns an error. This
+	// method does not mutate the in object, but the in and out object might share data structures,
+	// i.e. the out object cannot be mutated without mutating the in object as well.
+	// The context argument will be passed to all nested conversions.
+	Convert(in, out, context interface{}) error
+	// ConvertToVersion takes the provided object and converts it the provided version. This
+	// method does not mutate the in object, but the in and out object might share data structures,
+	// i.e. the out object cannot be mutated without mutating the in object as well.
+	// This method is similar to Convert() but handles specific details of choosing the correct
+	// output version.
+	ConvertToVersion(in Object, gv GroupVersioner) (out Object, err error)
+	ConvertFieldLabel(gvk schema.GroupVersionKind, label, value string) (string, string, error)
+}
+
+// ObjectTyper contains methods for extracting the APIVersion and Kind
+// of objects.
+type ObjectTyper interface {
+	// ObjectKinds returns the all possible group,version,kind of the provided object, true if
+	// the object is unversioned, or an error if the object is not recognized
+	// (IsNotRegisteredError will return true).
+	ObjectKinds(Object) ([]schema.GroupVersionKind, bool, error)
+	// Recognizes returns true if the scheme is able to handle the provided version and kind,
+	// or more precisely that the provided version is a possible conversion or decoding
+	// target.
+	Recognizes(gvk schema.GroupVersionKind) bool
+}
+
+// ObjectCreater contains methods for instantiating an object by kind and version.
+type ObjectCreater interface {
+	New(kind schema.GroupVersionKind) (out Object, err error)
+}
+
+// EquivalentResourceMapper provides information about resources that address the same underlying data as a specified resource
+type EquivalentResourceMapper interface {
+	// EquivalentResourcesFor returns a list of resources that address the same underlying data as resource.
+	// If subresource is specified, only equivalent resources which also have the same subresource are included.
+	// The specified resource can be included in the returned list.
+	EquivalentResourcesFor(resource schema.GroupVersionResource, subresource string) []schema.GroupVersionResource
+	// KindFor returns the kind expected by the specified resource[/subresource].
+	// A zero value is returned if the kind is unknown.
+	KindFor(resource schema.GroupVersionResource, subresource string) schema.GroupVersionKind
+}
+
+// EquivalentResourceRegistry provides an EquivalentResourceMapper interface,
+// and allows registering known resource[/subresource] -> kind
+type EquivalentResourceRegistry interface {
+	EquivalentResourceMapper
+	// RegisterKindFor registers the existence of the specified resource[/subresource] along with its expected kind.
+	RegisterKindFor(resource schema.GroupVersionResource, subresource string, kind schema.GroupVersionKind)
+}
+
+// ResourceVersioner provides methods for setting and retrieving
+// the resource version from an API object.
+type ResourceVersioner interface {
+	SetResourceVersion(obj Object, version string) error
+	ResourceVersion(obj Object) (string, error)
+}
+
+// Namer provides methods for retrieving name and namespace of an API object.
+type Namer interface {
+	// Name returns the name of a given object.
+	Name(obj Object) (string, error)
+	// Namespace returns the name of a given object.
+	Namespace(obj Object) (string, error)
+}
+
+// Object interface must be supported by all API types registered with Scheme. Since objects in a scheme are
+// expected to be serialized to the wire, the interface an Object must provide to the Scheme allows
+// serializers to set the kind, version, and group the object is represented as. An Object may choose
+// to return a no-op ObjectKindAccessor in cases where it is not expected to be serialized.
+type Object interface {
+	GetObjectKind() schema.ObjectKind
+	DeepCopyObject() Object
+}
+
+// CacheableObject allows an object to cache its different serializations
+// to avoid performing the same serialization multiple times.
+type CacheableObject interface {
+	// CacheEncode writes an object to a stream. The <encode> function will
+	// be used in case of cache miss. The <encode> function takes ownership
+	// of the object.
+	// If CacheableObject is a wrapper, then deep-copy of the wrapped object
+	// should be passed to <encode> function.
+	// CacheEncode assumes that for two different calls with the same <id>,
+	// <encode> function will also be the same.
+	CacheEncode(id Identifier, encode func(Object, io.Writer) error, w io.Writer) error
+	// GetObject returns a deep-copy of an object to be encoded - the caller of
+	// GetObject() is the owner of returned object. The reason for making a copy
+	// is to avoid bugs, where caller modifies the object and forgets to copy it,
+	// thus modifying the object for everyone.
+	// The object returned by GetObject should be the same as the one that is supposed
+	// to be passed to <encode> function in CacheEncode method.
+	// If CacheableObject is a wrapper, the copy of wrapped object should be returned.
+	GetObject() Object
+}
+
+// Unstructured objects store values as map[string]interface{}, with only values that can be serialized
+// to JSON allowed.
+type Unstructured interface {
+	Object
+	// NewEmptyInstance returns a new instance of the concrete type containing only kind/apiVersion and no other data.
+	// This should be called instead of reflect.New() for unstructured types because the go type alone does not preserve kind/apiVersion info.
+	NewEmptyInstance() Unstructured
+	// UnstructuredContent returns a non-nil map with this object's contents. Values may be
+	// []interface{}, map[string]interface{}, or any primitive type. Contents are typically serialized to
+	// and from JSON. SetUnstructuredContent should be used to mutate the contents.
+	UnstructuredContent() map[string]interface{}
+	// SetUnstructuredContent updates the object content to match the provided map.
+	SetUnstructuredContent(map[string]interface{})
+	// IsList returns true if this type is a list or matches the list convention - has an array called "items".
+	IsList() bool
+	// EachListItem should pass a single item out of the list as an Object to the provided function. Any
+	// error should terminate the iteration. If IsList() returns false, this method should return an error
+	// instead of calling the provided function.
+	EachListItem(func(Object) error) error
+	// EachListItemWithAlloc works like EachListItem, but avoids retaining references to a slice of items.
+	// It does this by making a shallow copy of non-pointer items before passing them to fn.
+	//
+	// If the items passed to fn are not retained, or are retained for the same duration, use EachListItem instead for memory efficiency.
+	EachListItemWithAlloc(func(Object) error) error
+}
+
+// ApplyConfiguration is an interface that root apply configuration types implement.
+type ApplyConfiguration interface {
+	// IsApplyConfiguration is implemented if the object is the root of an apply configuration.
+	IsApplyConfiguration()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/local_scheme_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/local_scheme_test.go
new file mode 100644
index 0000000000..9b90a71800
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/local_scheme_test.go
@@ -0,0 +1,150 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"testing"
+
+	"reflect"
+
+	"github.com/google/go-cmp/cmp"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestPreferredVersionsAllGroups(t *testing.T) {
+	tests := []struct {
+		name                string
+		versionPriority     map[string][]string
+		observedVersions    []schema.GroupVersion
+		expectedPrioritized map[string][]schema.GroupVersion
+		expectedPreferred   map[schema.GroupVersion]bool
+	}{
+		{
+			name: "observedOnly",
+			observedVersions: []schema.GroupVersion{
+				{Group: "", Version: "v3"},
+				{Group: "foo", Version: "v1"},
+				{Group: "foo", Version: "v2"},
+				{Group: "", Version: "v1"},
+			},
+			expectedPrioritized: map[string][]schema.GroupVersion{
+				"": {
+					{Group: "", Version: "v3"},
+					{Group: "", Version: "v1"},
+				},
+				"foo": {
+					{Group: "foo", Version: "v1"},
+					{Group: "foo", Version: "v2"},
+				},
+			},
+			expectedPreferred: map[schema.GroupVersion]bool{
+				{Group: "", Version: "v3"}:    true,
+				{Group: "foo", Version: "v1"}: true,
+			},
+		},
+		{
+			name: "specifiedOnly",
+			versionPriority: map[string][]string{
+				"":    {"v3", "v1"},
+				"foo": {"v1", "v2"},
+			},
+			expectedPrioritized: map[string][]schema.GroupVersion{
+				"": {
+					{Group: "", Version: "v3"},
+					{Group: "", Version: "v1"},
+				},
+				"foo": {
+					{Group: "foo", Version: "v1"},
+					{Group: "foo", Version: "v2"},
+				},
+			},
+			expectedPreferred: map[schema.GroupVersion]bool{
+				{Group: "", Version: "v3"}:    true,
+				{Group: "foo", Version: "v1"}: true,
+			},
+		},
+		{
+			name: "both",
+			versionPriority: map[string][]string{
+				"":    {"v3", "v1"},
+				"foo": {"v1", "v2"},
+			},
+			observedVersions: []schema.GroupVersion{
+				{Group: "", Version: "v1"},
+				{Group: "", Version: "v3"},
+				{Group: "", Version: "v4"},
+				{Group: "", Version: "v5"},
+				{Group: "bar", Version: "v1"},
+				{Group: "bar", Version: "v2"},
+			},
+			expectedPrioritized: map[string][]schema.GroupVersion{
+				"": {
+					{Group: "", Version: "v3"},
+					{Group: "", Version: "v1"},
+					{Group: "", Version: "v4"},
+					{Group: "", Version: "v5"},
+				},
+				"foo": {
+					{Group: "foo", Version: "v1"},
+					{Group: "foo", Version: "v2"},
+				},
+				"bar": {
+					{Group: "bar", Version: "v1"},
+					{Group: "bar", Version: "v2"},
+				},
+			},
+			expectedPreferred: map[schema.GroupVersion]bool{
+				{Group: "", Version: "v3"}:    true,
+				{Group: "foo", Version: "v1"}: true,
+				{Group: "bar", Version: "v1"}: true,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			scheme := NewScheme()
+			scheme.versionPriority = test.versionPriority
+			scheme.observedVersions = test.observedVersions
+
+			for group, expected := range test.expectedPrioritized {
+				actual := scheme.PrioritizedVersionsForGroup(group)
+				if !reflect.DeepEqual(expected, actual) {
+					t.Error(cmp.Diff(expected, actual))
+				}
+			}
+
+			prioritizedAll := scheme.PrioritizedVersionsAllGroups()
+			actualPrioritizedAll := map[string][]schema.GroupVersion{}
+			for _, actual := range prioritizedAll {
+				actualPrioritizedAll[actual.Group] = append(actualPrioritizedAll[actual.Group], actual)
+			}
+			if !reflect.DeepEqual(test.expectedPrioritized, actualPrioritizedAll) {
+				t.Error(cmp.Diff(test.expectedPrioritized, actualPrioritizedAll))
+			}
+
+			preferredAll := scheme.PreferredVersionAllGroups()
+			actualPreferredAll := map[schema.GroupVersion]bool{}
+			for _, actual := range preferredAll {
+				actualPreferredAll[actual] = true
+			}
+			if !reflect.DeepEqual(test.expectedPreferred, actualPreferredAll) {
+				t.Error(cmp.Diff(test.expectedPreferred, actualPreferredAll))
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/mapper.go b/third_party/k8s.io/apimachinery/pkg/runtime/mapper.go
new file mode 100644
index 0000000000..3ff84611ab
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/mapper.go
@@ -0,0 +1,98 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"sync"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type equivalentResourceRegistry struct {
+	// keyFunc computes a key for the specified resource (this allows honoring colocated resources across API groups).
+	// if null, or if "" is returned, resource.String() is used as the key
+	keyFunc func(resource schema.GroupResource) string
+	// resources maps key -> subresource -> equivalent resources (subresource is not included in the returned resources).
+	// main resources are stored with subresource="".
+	resources map[string]map[string][]schema.GroupVersionResource
+	// kinds maps resource -> subresource -> kind
+	kinds map[schema.GroupVersionResource]map[string]schema.GroupVersionKind
+	// keys caches the computed key for each GroupResource
+	keys map[schema.GroupResource]string
+
+	mutex sync.RWMutex
+}
+
+var _ EquivalentResourceMapper = (*equivalentResourceRegistry)(nil)
+var _ EquivalentResourceRegistry = (*equivalentResourceRegistry)(nil)
+
+// NewEquivalentResourceRegistry creates a resource registry that considers all versions of a GroupResource to be equivalent.
+func NewEquivalentResourceRegistry() EquivalentResourceRegistry {
+	return &equivalentResourceRegistry{}
+}
+
+// NewEquivalentResourceRegistryWithIdentity creates a resource mapper with a custom identity function.
+// If "" is returned by the function, GroupResource#String is used as the identity.
+// GroupResources with the same identity string are considered equivalent.
+func NewEquivalentResourceRegistryWithIdentity(keyFunc func(schema.GroupResource) string) EquivalentResourceRegistry {
+	return &equivalentResourceRegistry{keyFunc: keyFunc}
+}
+
+func (r *equivalentResourceRegistry) EquivalentResourcesFor(resource schema.GroupVersionResource, subresource string) []schema.GroupVersionResource {
+	r.mutex.RLock()
+	defer r.mutex.RUnlock()
+	return r.resources[r.keys[resource.GroupResource()]][subresource]
+}
+func (r *equivalentResourceRegistry) KindFor(resource schema.GroupVersionResource, subresource string) schema.GroupVersionKind {
+	r.mutex.RLock()
+	defer r.mutex.RUnlock()
+	return r.kinds[resource][subresource]
+}
+func (r *equivalentResourceRegistry) RegisterKindFor(resource schema.GroupVersionResource, subresource string, kind schema.GroupVersionKind) {
+	r.mutex.Lock()
+	defer r.mutex.Unlock()
+	if r.kinds == nil {
+		r.kinds = map[schema.GroupVersionResource]map[string]schema.GroupVersionKind{}
+	}
+	if r.kinds[resource] == nil {
+		r.kinds[resource] = map[string]schema.GroupVersionKind{}
+	}
+	r.kinds[resource][subresource] = kind
+
+	// get the shared key of the parent resource
+	key := ""
+	gr := resource.GroupResource()
+	if r.keyFunc != nil {
+		key = r.keyFunc(gr)
+	}
+	if key == "" {
+		key = gr.String()
+	}
+
+	if r.keys == nil {
+		r.keys = map[schema.GroupResource]string{}
+	}
+	r.keys[gr] = key
+
+	if r.resources == nil {
+		r.resources = map[string]map[string][]schema.GroupVersionResource{}
+	}
+	if r.resources[key] == nil {
+		r.resources[key] = map[string][]schema.GroupVersionResource{}
+	}
+	r.resources[key][subresource] = append(r.resources[key][subresource], resource)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/mapper_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/mapper_test.go
new file mode 100644
index 0000000000..d8423e0e31
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/mapper_test.go
@@ -0,0 +1,136 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestResourceMapper(t *testing.T) {
+	gvr := func(g, v, r string) schema.GroupVersionResource {
+		return schema.GroupVersionResource{Group: g, Version: v, Resource: r}
+	}
+
+	gvk := func(g, v, k string) schema.GroupVersionKind {
+		return schema.GroupVersionKind{Group: g, Version: v, Kind: k}
+	}
+
+	kindsToRegister := []struct {
+		gvr         schema.GroupVersionResource
+		subresource string
+		gvk         schema.GroupVersionKind
+	}{
+		// pods
+		{gvr("", "v1", "pods"), "", gvk("", "v1", "Pod")},
+		// pods/status
+		{gvr("", "v1", "pods"), "status", gvk("", "v1", "Pod")},
+		// deployments
+		{gvr("apps", "v1", "deployments"), "", gvk("apps", "v1", "Deployment")},
+		{gvr("apps", "v1beta1", "deployments"), "", gvk("apps", "v1beta1", "Deployment")},
+		{gvr("apps", "v1alpha1", "deployments"), "", gvk("apps", "v1alpha1", "Deployment")},
+		{gvr("extensions", "v1beta1", "deployments"), "", gvk("extensions", "v1beta1", "Deployment")},
+		// deployments/scale (omitted for apps/v1alpha1)
+		{gvr("apps", "v1", "deployments"), "scale", gvk("", "", "Scale")},
+		{gvr("apps", "v1beta1", "deployments"), "scale", gvk("", "", "Scale")},
+		{gvr("extensions", "v1beta1", "deployments"), "scale", gvk("", "", "Scale")},
+		// deployments/status (omitted for apps/v1alpha1)
+		{gvr("apps", "v1", "deployments"), "status", gvk("apps", "v1", "Deployment")},
+		{gvr("apps", "v1beta1", "deployments"), "status", gvk("apps", "v1beta1", "Deployment")},
+		{gvr("extensions", "v1beta1", "deployments"), "status", gvk("extensions", "v1beta1", "Deployment")},
+	}
+
+	testcases := []struct {
+		Name                           string
+		IdentityFunc                   func(schema.GroupResource) string
+		ResourcesForV1Deployment       []schema.GroupVersionResource
+		ResourcesForV1DeploymentScale  []schema.GroupVersionResource
+		ResourcesForV1DeploymentStatus []schema.GroupVersionResource
+	}{
+		{
+			Name:                           "no identityfunc",
+			ResourcesForV1Deployment:       []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("apps", "v1alpha1", "deployments")},
+			ResourcesForV1DeploymentScale:  []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments")},
+			ResourcesForV1DeploymentStatus: []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments")},
+		},
+		{
+			Name:         "empty identityfunc",
+			IdentityFunc: func(schema.GroupResource) string { return "" },
+			// same group
+			ResourcesForV1Deployment:       []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("apps", "v1alpha1", "deployments")},
+			ResourcesForV1DeploymentScale:  []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments")},
+			ResourcesForV1DeploymentStatus: []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments")},
+		},
+		{
+			Name:         "common identityfunc",
+			IdentityFunc: func(schema.GroupResource) string { return "x" },
+			// all resources are seen as equivalent
+			ResourcesForV1Deployment: []schema.GroupVersionResource{gvr("", "v1", "pods"), gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("apps", "v1alpha1", "deployments"), gvr("extensions", "v1beta1", "deployments")},
+			// all resources with scale are seen as equivalent
+			ResourcesForV1DeploymentScale: []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("extensions", "v1beta1", "deployments")},
+			// all resources with status are seen as equivalent
+			ResourcesForV1DeploymentStatus: []schema.GroupVersionResource{gvr("", "v1", "pods"), gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("extensions", "v1beta1", "deployments")},
+		},
+		{
+			Name: "colocated deployments",
+			IdentityFunc: func(resource schema.GroupResource) string {
+				if resource.Resource == "deployments" {
+					return "deployments"
+				}
+				return ""
+			},
+			// all deployments are seen as equivalent
+			ResourcesForV1Deployment: []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("apps", "v1alpha1", "deployments"), gvr("extensions", "v1beta1", "deployments")},
+			// all deployments with scale are seen as equivalent
+			ResourcesForV1DeploymentScale: []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("extensions", "v1beta1", "deployments")},
+			// all deployments with status are seen as equivalent
+			ResourcesForV1DeploymentStatus: []schema.GroupVersionResource{gvr("apps", "v1", "deployments"), gvr("apps", "v1beta1", "deployments"), gvr("extensions", "v1beta1", "deployments")},
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.Name, func(t *testing.T) {
+			mapper := NewEquivalentResourceRegistryWithIdentity(tc.IdentityFunc)
+
+			// register
+			for _, data := range kindsToRegister {
+				mapper.RegisterKindFor(data.gvr, data.subresource, data.gvk)
+			}
+			// verify
+			for _, data := range kindsToRegister {
+				if kind := mapper.KindFor(data.gvr, data.subresource); kind != data.gvk {
+					t.Errorf("KindFor(%#v, %v) returned %#v, expected %#v", data.gvr, data.subresource, kind, data.gvk)
+				}
+			}
+
+			// Verify equivalents to primary resource
+			if resources := mapper.EquivalentResourcesFor(gvr("apps", "v1", "deployments"), ""); !reflect.DeepEqual(resources, tc.ResourcesForV1Deployment) {
+				t.Errorf("diff:\n%s", cmp.Diff(tc.ResourcesForV1Deployment, resources))
+			}
+			// Verify equivalents to subresources
+			if resources := mapper.EquivalentResourcesFor(gvr("apps", "v1", "deployments"), "scale"); !reflect.DeepEqual(resources, tc.ResourcesForV1DeploymentScale) {
+				t.Errorf("diff:\n%s", cmp.Diff(tc.ResourcesForV1DeploymentScale, resources))
+			}
+			if resources := mapper.EquivalentResourcesFor(gvr("apps", "v1", "deployments"), "status"); !reflect.DeepEqual(resources, tc.ResourcesForV1DeploymentStatus) {
+				t.Errorf("diff:\n%s", cmp.Diff(tc.ResourcesForV1DeploymentStatus, resources))
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/negotiate.go b/third_party/k8s.io/apimachinery/pkg/runtime/negotiate.go
new file mode 100644
index 0000000000..3ab119b0a8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/negotiate.go
@@ -0,0 +1,113 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// NegotiateError is returned when a ClientNegotiator is unable to locate
+// a serializer for the requested operation.
+type NegotiateError struct {
+	ContentType string
+	Stream      bool
+}
+
+func (e NegotiateError) Error() string {
+	if e.Stream {
+		return fmt.Sprintf("no stream serializers registered for %s", e.ContentType)
+	}
+	return fmt.Sprintf("no serializers registered for %s", e.ContentType)
+}
+
+type clientNegotiator struct {
+	serializer     NegotiatedSerializer
+	encode, decode GroupVersioner
+}
+
+func (n *clientNegotiator) Encoder(contentType string, params map[string]string) (Encoder, error) {
+	// TODO: `pretty=1` is handled in NegotiateOutputMediaType, consider moving it to this method
+	// if client negotiators truly need to use it
+	mediaTypes := n.serializer.SupportedMediaTypes()
+	info, ok := SerializerInfoForMediaType(mediaTypes, contentType)
+	if !ok {
+		if len(contentType) != 0 || len(mediaTypes) == 0 {
+			return nil, NegotiateError{ContentType: contentType}
+		}
+		info = mediaTypes[0]
+	}
+	return n.serializer.EncoderForVersion(info.Serializer, n.encode), nil
+}
+
+func (n *clientNegotiator) Decoder(contentType string, params map[string]string) (Decoder, error) {
+	mediaTypes := n.serializer.SupportedMediaTypes()
+	info, ok := SerializerInfoForMediaType(mediaTypes, contentType)
+	if !ok {
+		if len(contentType) != 0 || len(mediaTypes) == 0 {
+			return nil, NegotiateError{ContentType: contentType}
+		}
+		info = mediaTypes[0]
+	}
+	return n.serializer.DecoderToVersion(info.Serializer, n.decode), nil
+}
+
+func (n *clientNegotiator) StreamDecoder(contentType string, params map[string]string) (Decoder, Serializer, Framer, error) {
+	mediaTypes := n.serializer.SupportedMediaTypes()
+	info, ok := SerializerInfoForMediaType(mediaTypes, contentType)
+	if !ok {
+		if len(contentType) != 0 || len(mediaTypes) == 0 {
+			return nil, nil, nil, NegotiateError{ContentType: contentType, Stream: true}
+		}
+		info = mediaTypes[0]
+	}
+	if info.StreamSerializer == nil {
+		return nil, nil, nil, NegotiateError{ContentType: info.MediaType, Stream: true}
+	}
+	return n.serializer.DecoderToVersion(info.Serializer, n.decode), info.StreamSerializer.Serializer, info.StreamSerializer.Framer, nil
+}
+
+// NewClientNegotiator will attempt to retrieve the appropriate encoder, decoder, or
+// stream decoder for a given content type. Does not perform any conversion, but will
+// encode the object to the desired group, version, and kind. Use when creating a client.
+func NewClientNegotiator(serializer NegotiatedSerializer, gv schema.GroupVersion) ClientNegotiator {
+	return &clientNegotiator{
+		serializer: serializer,
+		encode:     gv,
+	}
+}
+
+type simpleNegotiatedSerializer struct {
+	info SerializerInfo
+}
+
+func NewSimpleNegotiatedSerializer(info SerializerInfo) NegotiatedSerializer {
+	return &simpleNegotiatedSerializer{info: info}
+}
+
+func (n *simpleNegotiatedSerializer) SupportedMediaTypes() []SerializerInfo {
+	return []SerializerInfo{n.info}
+}
+
+func (n *simpleNegotiatedSerializer) EncoderForVersion(e Encoder, _ GroupVersioner) Encoder {
+	return e
+}
+
+func (n *simpleNegotiatedSerializer) DecoderToVersion(d Decoder, _gv GroupVersioner) Decoder {
+	return d
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/register.go b/third_party/k8s.io/apimachinery/pkg/runtime/register.go
new file mode 100644
index 0000000000..1cd2e4c387
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/register.go
@@ -0,0 +1,31 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import "k8s.io/apimachinery/pkg/runtime/schema"
+
+// SetGroupVersionKind satisfies the ObjectKind interface for all objects that embed TypeMeta
+func (obj *TypeMeta) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	obj.APIVersion, obj.Kind = gvk.ToAPIVersionAndKind()
+}
+
+// GroupVersionKind satisfies the ObjectKind interface for all objects that embed TypeMeta
+func (obj *TypeMeta) GroupVersionKind() schema.GroupVersionKind {
+	return schema.FromAPIVersionAndKind(obj.APIVersion, obj.Kind)
+}
+
+func (obj *TypeMeta) GetObjectKind() schema.ObjectKind { return obj }
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/schema/generated.pb.go b/third_party/k8s.io/apimachinery/pkg/runtime/schema/generated.pb.go
new file mode 100644
index 0000000000..ed57e08afe
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/schema/generated.pb.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/apimachinery/pkg/runtime/schema/generated.proto
+
+package schema
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/schema/generated.proto b/third_party/k8s.io/apimachinery/pkg/runtime/schema/generated.proto
new file mode 100644
index 0000000000..01a9c01e5c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/schema/generated.proto
@@ -0,0 +1,26 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.apimachinery.pkg.runtime.schema;
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/apimachinery/pkg/runtime/schema";
+
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/schema/group_version.go b/third_party/k8s.io/apimachinery/pkg/runtime/schema/group_version.go
new file mode 100644
index 0000000000..d1c37c9429
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/schema/group_version.go
@@ -0,0 +1,305 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package schema
+
+import (
+	"fmt"
+	"strings"
+)
+
+// ParseResourceArg takes the common style of string which may be either `resource.group.com` or `resource.version.group.com`
+// and parses it out into both possibilities.  This code takes no responsibility for knowing which representation was intended
+// but with a knowledge of all GroupVersions, calling code can take a very good guess.  If there are only two segments, then
+// `*GroupVersionResource` is nil.
+// `resource.group.com` -> `group=com, version=group, resource=resource` and `group=group.com, resource=resource`
+func ParseResourceArg(arg string) (*GroupVersionResource, GroupResource) {
+	var gvr *GroupVersionResource
+	if strings.Count(arg, ".") >= 2 {
+		s := strings.SplitN(arg, ".", 3)
+		gvr = &GroupVersionResource{Group: s[2], Version: s[1], Resource: s[0]}
+	}
+
+	return gvr, ParseGroupResource(arg)
+}
+
+// ParseKindArg takes the common style of string which may be either `Kind.group.com` or `Kind.version.group.com`
+// and parses it out into both possibilities. This code takes no responsibility for knowing which representation was intended
+// but with a knowledge of all GroupKinds, calling code can take a very good guess. If there are only two segments, then
+// `*GroupVersionKind` is nil.
+// `Kind.group.com` -> `group=com, version=group, kind=Kind` and `group=group.com, kind=Kind`
+func ParseKindArg(arg string) (*GroupVersionKind, GroupKind) {
+	var gvk *GroupVersionKind
+	if strings.Count(arg, ".") >= 2 {
+		s := strings.SplitN(arg, ".", 3)
+		gvk = &GroupVersionKind{Group: s[2], Version: s[1], Kind: s[0]}
+	}
+
+	return gvk, ParseGroupKind(arg)
+}
+
+// GroupResource specifies a Group and a Resource, but does not force a version.  This is useful for identifying
+// concepts during lookup stages without having partially valid types
+type GroupResource struct {
+	Group    string
+	Resource string
+}
+
+func (gr GroupResource) WithVersion(version string) GroupVersionResource {
+	return GroupVersionResource{Group: gr.Group, Version: version, Resource: gr.Resource}
+}
+
+func (gr GroupResource) Empty() bool {
+	return len(gr.Group) == 0 && len(gr.Resource) == 0
+}
+
+func (gr GroupResource) String() string {
+	if len(gr.Group) == 0 {
+		return gr.Resource
+	}
+	return gr.Resource + "." + gr.Group
+}
+
+func ParseGroupKind(gk string) GroupKind {
+	i := strings.Index(gk, ".")
+	if i == -1 {
+		return GroupKind{Kind: gk}
+	}
+
+	return GroupKind{Group: gk[i+1:], Kind: gk[:i]}
+}
+
+// ParseGroupResource turns "resource.group" string into a GroupResource struct.  Empty strings are allowed
+// for each field.
+func ParseGroupResource(gr string) GroupResource {
+	if i := strings.Index(gr, "."); i >= 0 {
+		return GroupResource{Group: gr[i+1:], Resource: gr[:i]}
+	}
+	return GroupResource{Resource: gr}
+}
+
+// GroupVersionResource unambiguously identifies a resource.  It doesn't anonymously include GroupVersion
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
+type GroupVersionResource struct {
+	Group    string
+	Version  string
+	Resource string
+}
+
+func (gvr GroupVersionResource) Empty() bool {
+	return len(gvr.Group) == 0 && len(gvr.Version) == 0 && len(gvr.Resource) == 0
+}
+
+func (gvr GroupVersionResource) GroupResource() GroupResource {
+	return GroupResource{Group: gvr.Group, Resource: gvr.Resource}
+}
+
+func (gvr GroupVersionResource) GroupVersion() GroupVersion {
+	return GroupVersion{Group: gvr.Group, Version: gvr.Version}
+}
+
+func (gvr GroupVersionResource) String() string {
+	return strings.Join([]string{gvr.Group, "/", gvr.Version, ", Resource=", gvr.Resource}, "")
+}
+
+// GroupKind specifies a Group and a Kind, but does not force a version.  This is useful for identifying
+// concepts during lookup stages without having partially valid types
+type GroupKind struct {
+	Group string
+	Kind  string
+}
+
+func (gk GroupKind) Empty() bool {
+	return len(gk.Group) == 0 && len(gk.Kind) == 0
+}
+
+func (gk GroupKind) WithVersion(version string) GroupVersionKind {
+	return GroupVersionKind{Group: gk.Group, Version: version, Kind: gk.Kind}
+}
+
+func (gk GroupKind) String() string {
+	if len(gk.Group) == 0 {
+		return gk.Kind
+	}
+	return gk.Kind + "." + gk.Group
+}
+
+// GroupVersionKind unambiguously identifies a kind.  It doesn't anonymously include GroupVersion
+// to avoid automatic coercion.  It doesn't use a GroupVersion to avoid custom marshalling
+type GroupVersionKind struct {
+	Group   string
+	Version string
+	Kind    string
+}
+
+// Empty returns true if group, version, and kind are empty
+func (gvk GroupVersionKind) Empty() bool {
+	return len(gvk.Group) == 0 && len(gvk.Version) == 0 && len(gvk.Kind) == 0
+}
+
+func (gvk GroupVersionKind) GroupKind() GroupKind {
+	return GroupKind{Group: gvk.Group, Kind: gvk.Kind}
+}
+
+func (gvk GroupVersionKind) GroupVersion() GroupVersion {
+	return GroupVersion{Group: gvk.Group, Version: gvk.Version}
+}
+
+func (gvk GroupVersionKind) String() string {
+	return gvk.Group + "/" + gvk.Version + ", Kind=" + gvk.Kind
+}
+
+// GroupVersion contains the "group" and the "version", which uniquely identifies the API.
+type GroupVersion struct {
+	Group   string
+	Version string
+}
+
+// Empty returns true if group and version are empty
+func (gv GroupVersion) Empty() bool {
+	return len(gv.Group) == 0 && len(gv.Version) == 0
+}
+
+// String puts "group" and "version" into a single "group/version" string. For the legacy v1
+// it returns "v1".
+func (gv GroupVersion) String() string {
+	if len(gv.Group) > 0 {
+		return gv.Group + "/" + gv.Version
+	}
+	return gv.Version
+}
+
+// Identifier implements runtime.GroupVersioner interface.
+func (gv GroupVersion) Identifier() string {
+	return gv.String()
+}
+
+// KindForGroupVersionKinds identifies the preferred GroupVersionKind out of a list. It returns ok false
+// if none of the options match the group. It prefers a match to group and version over just group.
+// TODO: Move GroupVersion to a package under pkg/runtime, since it's used by scheme.
+// TODO: Introduce an adapter type between GroupVersion and runtime.GroupVersioner, and use LegacyCodec(GroupVersion)
+// in fewer places.
+func (gv GroupVersion) KindForGroupVersionKinds(kinds []GroupVersionKind) (target GroupVersionKind, ok bool) {
+	for _, gvk := range kinds {
+		if gvk.Group == gv.Group && gvk.Version == gv.Version {
+			return gvk, true
+		}
+	}
+	for _, gvk := range kinds {
+		if gvk.Group == gv.Group {
+			return gv.WithKind(gvk.Kind), true
+		}
+	}
+	return GroupVersionKind{}, false
+}
+
+// ParseGroupVersion turns "group/version" string into a GroupVersion struct. It reports error
+// if it cannot parse the string.
+func ParseGroupVersion(gv string) (GroupVersion, error) {
+	// this can be the internal version for the legacy kube types
+	// TODO once we've cleared the last uses as strings, this special case should be removed.
+	if (len(gv) == 0) || (gv == "/") {
+		return GroupVersion{}, nil
+	}
+
+	switch strings.Count(gv, "/") {
+	case 0:
+		return GroupVersion{"", gv}, nil
+	case 1:
+		i := strings.Index(gv, "/")
+		return GroupVersion{gv[:i], gv[i+1:]}, nil
+	default:
+		return GroupVersion{}, fmt.Errorf("unexpected GroupVersion string: %v", gv)
+	}
+}
+
+// WithKind creates a GroupVersionKind based on the method receiver's GroupVersion and the passed Kind.
+func (gv GroupVersion) WithKind(kind string) GroupVersionKind {
+	return GroupVersionKind{Group: gv.Group, Version: gv.Version, Kind: kind}
+}
+
+// WithResource creates a GroupVersionResource based on the method receiver's GroupVersion and the passed Resource.
+func (gv GroupVersion) WithResource(resource string) GroupVersionResource {
+	return GroupVersionResource{Group: gv.Group, Version: gv.Version, Resource: resource}
+}
+
+// GroupVersions can be used to represent a set of desired group versions.
+// TODO: Move GroupVersions to a package under pkg/runtime, since it's used by scheme.
+// TODO: Introduce an adapter type between GroupVersions and runtime.GroupVersioner, and use LegacyCodec(GroupVersion)
+// in fewer places.
+type GroupVersions []GroupVersion
+
+// Identifier implements runtime.GroupVersioner interface.
+func (gvs GroupVersions) Identifier() string {
+	groupVersions := make([]string, 0, len(gvs))
+	for i := range gvs {
+		groupVersions = append(groupVersions, gvs[i].String())
+	}
+	return fmt.Sprintf("[%s]", strings.Join(groupVersions, ","))
+}
+
+// KindForGroupVersionKinds identifies the preferred GroupVersionKind out of a list. It returns ok false
+// if none of the options match the group.
+func (gvs GroupVersions) KindForGroupVersionKinds(kinds []GroupVersionKind) (GroupVersionKind, bool) {
+	var targets []GroupVersionKind
+	for _, gv := range gvs {
+		target, ok := gv.KindForGroupVersionKinds(kinds)
+		if !ok {
+			continue
+		}
+		targets = append(targets, target)
+	}
+	if len(targets) == 1 {
+		return targets[0], true
+	}
+	if len(targets) > 1 {
+		return bestMatch(kinds, targets), true
+	}
+	return GroupVersionKind{}, false
+}
+
+// bestMatch tries to pick best matching GroupVersionKind and falls back to the first
+// found if no exact match exists.
+func bestMatch(kinds []GroupVersionKind, targets []GroupVersionKind) GroupVersionKind {
+	for _, gvk := range targets {
+		for _, k := range kinds {
+			if k == gvk {
+				return k
+			}
+		}
+	}
+	return targets[0]
+}
+
+// ToAPIVersionAndKind is a convenience method for satisfying runtime.Object on types that
+// do not use TypeMeta.
+func (gvk GroupVersionKind) ToAPIVersionAndKind() (string, string) {
+	if gvk.Empty() {
+		return "", ""
+	}
+	return gvk.GroupVersion().String(), gvk.Kind
+}
+
+// FromAPIVersionAndKind returns a GVK representing the provided fields for types that
+// do not use TypeMeta. This method exists to support test types and legacy serializations
+// that have a distinct group and kind.
+// TODO: further reduce usage of this method.
+func FromAPIVersionAndKind(apiVersion, kind string) GroupVersionKind {
+	if gv, err := ParseGroupVersion(apiVersion); err == nil {
+		return GroupVersionKind{Group: gv.Group, Version: gv.Version, Kind: kind}
+	}
+	return GroupVersionKind{Kind: kind}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/schema/group_version_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/schema/group_version_test.go
new file mode 100644
index 0000000000..ff28593c5c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/schema/group_version_test.go
@@ -0,0 +1,240 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package schema
+
+import (
+	"testing"
+)
+
+func TestGroupVersionParse(t *testing.T) {
+	tests := []struct {
+		input string
+		out   GroupVersion
+		err   func(error) bool
+	}{
+		{input: "v1", out: GroupVersion{Version: "v1"}},
+		{input: "v2", out: GroupVersion{Version: "v2"}},
+		{input: "/v1", out: GroupVersion{Version: "v1"}},
+		{input: "v1/", out: GroupVersion{Group: "v1"}},
+		{input: "/v1/", err: func(err error) bool { return err.Error() == "unexpected GroupVersion string: /v1/" }},
+		{input: "v1/a", out: GroupVersion{Group: "v1", Version: "a"}},
+	}
+	for i, test := range tests {
+		out, err := ParseGroupVersion(test.input)
+		if test.err == nil && err != nil || err == nil && test.err != nil {
+			t.Errorf("%d: unexpected error: %v", i, err)
+			continue
+		}
+		if test.err != nil && !test.err(err) {
+			t.Errorf("%d: unexpected error: %v", i, err)
+			continue
+		}
+		if out != test.out {
+			t.Errorf("%d: unexpected output: %#v", i, out)
+		}
+	}
+}
+
+func TestGroupResourceParse(t *testing.T) {
+	tests := []struct {
+		input string
+		out   GroupResource
+	}{
+		{input: "v1", out: GroupResource{Resource: "v1"}},
+		{input: ".v1", out: GroupResource{Group: "v1"}},
+		{input: "v1.", out: GroupResource{Resource: "v1"}},
+		{input: "v1.a", out: GroupResource{Group: "a", Resource: "v1"}},
+		{input: "b.v1.a", out: GroupResource{Group: "v1.a", Resource: "b"}},
+	}
+	for i, test := range tests {
+		out := ParseGroupResource(test.input)
+		if out != test.out {
+			t.Errorf("%d: unexpected output: %#v", i, out)
+		}
+	}
+}
+
+func TestParseResourceArg(t *testing.T) {
+	tests := []struct {
+		input string
+		gvr   *GroupVersionResource
+		gr    GroupResource
+	}{
+		{input: "v1", gr: GroupResource{Resource: "v1"}},
+		{input: ".v1", gr: GroupResource{Group: "v1"}},
+		{input: "v1.", gr: GroupResource{Resource: "v1"}},
+		{input: "v1.a", gr: GroupResource{Group: "a", Resource: "v1"}},
+		{input: "b.v1.a", gvr: &GroupVersionResource{Group: "a", Version: "v1", Resource: "b"}, gr: GroupResource{Group: "v1.a", Resource: "b"}},
+	}
+	for i, test := range tests {
+		gvr, gr := ParseResourceArg(test.input)
+		if (gvr != nil && test.gvr == nil) || (gvr == nil && test.gvr != nil) || (test.gvr != nil && *gvr != *test.gvr) {
+			t.Errorf("%d: unexpected output: %#v", i, gvr)
+		}
+		if gr != test.gr {
+			t.Errorf("%d: unexpected output: %#v", i, gr)
+		}
+	}
+}
+
+func TestKindForGroupVersionKinds(t *testing.T) {
+	gvks := GroupVersions{
+		GroupVersion{Group: "batch", Version: "v1"},
+		GroupVersion{Group: "batch", Version: "v2alpha1"},
+		GroupVersion{Group: "policy", Version: "v1beta1"},
+	}
+	cases := []struct {
+		input  []GroupVersionKind
+		target GroupVersionKind
+		ok     bool
+	}{
+		{
+			input:  []GroupVersionKind{{Group: "batch", Version: "v2alpha1", Kind: "ScheduledJob"}},
+			target: GroupVersionKind{Group: "batch", Version: "v2alpha1", Kind: "ScheduledJob"},
+			ok:     true,
+		},
+		{
+			input:  []GroupVersionKind{{Group: "batch", Version: "v3alpha1", Kind: "CronJob"}},
+			target: GroupVersionKind{Group: "batch", Version: "v1", Kind: "CronJob"},
+			ok:     true,
+		},
+		{
+			input:  []GroupVersionKind{{Group: "policy", Version: "v1beta1", Kind: "PodDisruptionBudget"}},
+			target: GroupVersionKind{Group: "policy", Version: "v1beta1", Kind: "PodDisruptionBudget"},
+			ok:     true,
+		},
+		{
+			input:  []GroupVersionKind{{Group: "apps", Version: "v1alpha1", Kind: "StatefulSet"}},
+			target: GroupVersionKind{},
+			ok:     false,
+		},
+	}
+
+	for i, c := range cases {
+		target, ok := gvks.KindForGroupVersionKinds(c.input)
+		if c.target != target {
+			t.Errorf("%d: unexpected target: %v, expected %v", i, target, c.target)
+		}
+		if c.ok != ok {
+			t.Errorf("%d: unexpected ok: %v, expected %v", i, ok, c.ok)
+		}
+	}
+}
+
+func TestParseKindArg(t *testing.T) {
+	tests := []struct {
+		input string
+		gvk   *GroupVersionKind
+		gk    GroupKind
+	}{
+		{input: "Pod", gk: GroupKind{Kind: "Pod"}},
+		{input: ".apps", gk: GroupKind{Group: "apps"}},
+		{input: "Pod.", gk: GroupKind{Kind: "Pod"}},
+		{input: "StatefulSet.apps", gk: GroupKind{Group: "apps", Kind: "StatefulSet"}},
+		{input: "StatefulSet.v1.apps", gvk: &GroupVersionKind{Group: "apps", Version: "v1", Kind: "StatefulSet"}, gk: GroupKind{Group: "v1.apps", Kind: "StatefulSet"}},
+	}
+	for i, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			gvk, gk := ParseKindArg(test.input)
+			if (gvk != nil && test.gvk == nil) || (gvk == nil && test.gvk != nil) || (test.gvk != nil && *gvk != *test.gvk) {
+				t.Errorf("%d: expected output: %#v, got: %#v", i, test.gvk, gvk)
+			}
+			if gk != test.gk {
+				t.Errorf("%d: expected output: %#v, got: %#v", i, test.gk, gk)
+			}
+		})
+	}
+}
+
+func TestParseGroupKind(t *testing.T) {
+	tests := []struct {
+		input string
+		out   GroupKind
+	}{
+		{input: "Pod", out: GroupKind{Kind: "Pod"}},
+		{input: ".StatefulSet", out: GroupKind{Group: "StatefulSet"}},
+		{input: "StatefulSet.apps", out: GroupKind{Group: "apps", Kind: "StatefulSet"}},
+	}
+	for i, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			out := ParseGroupKind(test.input)
+			if out != test.out {
+				t.Errorf("%d: expected output: %#v, got: %#v", i, test.out, out)
+			}
+		})
+	}
+}
+
+func TestToAPIVersionAndKind(t *testing.T) {
+	tests := []struct {
+		desc         string
+		input        GroupVersionKind
+		GroupVersion string
+		Kind         string
+	}{
+		{
+			desc:         "gvk object is not empty",
+			input:        GroupVersionKind{Version: "V1", Kind: "pod"},
+			GroupVersion: "V1",
+			Kind:         "pod",
+		},
+		{
+			desc:         "gvk object is empty",
+			input:        GroupVersionKind{},
+			GroupVersion: "",
+			Kind:         "",
+		},
+	}
+	for i, test := range tests {
+		version, kind := test.input.ToAPIVersionAndKind()
+		if version != test.GroupVersion {
+			t.Errorf("%d: expected version: %#v, got: %#v", i, test.GroupVersion, version)
+		}
+		if kind != test.Kind {
+			t.Errorf("%d: expected kind: %#v, got: %#v", i, test.Kind, kind)
+		}
+	}
+}
+
+func TestBestMatch(t *testing.T) {
+	tests := []struct {
+		desc    string
+		kinds   []GroupVersionKind
+		targets []GroupVersionKind
+		output  GroupVersionKind
+	}{
+		{
+			desc:    "targets and kinds have match items",
+			kinds:   []GroupVersionKind{{Version: "V1", Kind: "pod"}, {Version: "V2", Kind: "pod"}},
+			targets: []GroupVersionKind{{Version: "V1", Kind: "pod"}},
+			output:  GroupVersionKind{Version: "V1", Kind: "pod"},
+		},
+		{
+			desc:    "targets and kinds do not have match items",
+			kinds:   []GroupVersionKind{{Version: "V1", Kind: "pod"}, {Version: "V2", Kind: "pod"}},
+			targets: []GroupVersionKind{{Version: "V3", Kind: "pod"}, {Version: "V4", Kind: "pod"}},
+			output:  GroupVersionKind{Version: "V3", Kind: "pod"},
+		},
+	}
+
+	for i, test := range tests {
+		out := bestMatch(test.kinds, test.targets)
+		if out != test.output {
+			t.Errorf("%d: expected out: %#v, got: %#v", i, test.output, out)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/schema/interfaces.go b/third_party/k8s.io/apimachinery/pkg/runtime/schema/interfaces.go
new file mode 100644
index 0000000000..f04453fb01
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/schema/interfaces.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package schema
+
+// All objects that are serialized from a Scheme encode their type information. This interface is used
+// by serialization to set type information from the Scheme onto the serialized version of an object.
+// For objects that cannot be serialized or have unique requirements, this interface may be a no-op.
+type ObjectKind interface {
+	// SetGroupVersionKind sets or clears the intended serialized kind of an object. Passing kind nil
+	// should clear the current setting.
+	SetGroupVersionKind(kind GroupVersionKind)
+	// GroupVersionKind returns the stored group, version, and kind of an object, or an empty struct
+	// if the object does not expose or provide these fields.
+	GroupVersionKind() GroupVersionKind
+}
+
+// EmptyObjectKind implements the ObjectKind interface as a noop
+var EmptyObjectKind = emptyObjectKind{}
+
+type emptyObjectKind struct{}
+
+// SetGroupVersionKind implements the ObjectKind interface
+func (emptyObjectKind) SetGroupVersionKind(gvk GroupVersionKind) {}
+
+// GroupVersionKind implements the ObjectKind interface
+func (emptyObjectKind) GroupVersionKind() GroupVersionKind { return GroupVersionKind{} }
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/scheme.go b/third_party/k8s.io/apimachinery/pkg/runtime/scheme.go
new file mode 100644
index 0000000000..80662e55c4
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/scheme.go
@@ -0,0 +1,827 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/naming"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/kube-openapi/pkg/util"
+)
+
+// Scheme defines methods for serializing and deserializing API objects, a type
+// registry for converting group, version, and kind information to and from Go
+// schemas, and mappings between Go schemas of different versions. A scheme is the
+// foundation for a versioned API and versioned configuration over time.
+//
+// In a Scheme, a Type is a particular Go struct, a Version is a point-in-time
+// identifier for a particular representation of that Type (typically backwards
+// compatible), a Kind is the unique name for that Type within the Version, and a
+// Group identifies a set of Versions, Kinds, and Types that evolve over time. An
+// Unversioned Type is one that is not yet formally bound to a type and is promised
+// to be backwards compatible (effectively a "v1" of a Type that does not expect
+// to break in the future).
+//
+// Schemes are not expected to change at runtime and are only threadsafe after
+// registration is complete.
+type Scheme struct {
+	// gvkToType allows one to figure out the go type of an object with
+	// the given version and name.
+	gvkToType map[schema.GroupVersionKind]reflect.Type
+
+	// typeToGVK allows one to find metadata for a given go object.
+	// The reflect.Type we index by should *not* be a pointer.
+	typeToGVK map[reflect.Type][]schema.GroupVersionKind
+
+	// unversionedTypes are transformed without conversion in ConvertToVersion.
+	unversionedTypes map[reflect.Type]schema.GroupVersionKind
+
+	// unversionedKinds are the names of kinds that can be created in the context of any group
+	// or version
+	// TODO: resolve the status of unversioned types.
+	unversionedKinds map[string]reflect.Type
+
+	// Map from version and resource to the corresponding func to convert
+	// resource field labels in that version to internal version.
+	fieldLabelConversionFuncs map[schema.GroupVersionKind]FieldLabelConversionFunc
+
+	// defaulterFuncs is a map to funcs to be called with an object to provide defaulting
+	// the provided object must be a pointer.
+	defaulterFuncs map[reflect.Type]func(interface{})
+
+	// validationFuncs is a map to funcs to be called with an object to perform validation.
+	// The provided object must be a pointer.
+	// If oldObject is non-nil, update validation is performed and may perform additional
+	// validation such as transition rules and immutability checks.
+	validationFuncs map[reflect.Type]func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList
+
+	// converter stores all registered conversion functions. It also has
+	// default converting behavior.
+	converter *conversion.Converter
+
+	// versionPriority is a map of groups to ordered lists of versions for those groups indicating the
+	// default priorities of these versions as registered in the scheme
+	versionPriority map[string][]string
+
+	// observedVersions keeps track of the order we've seen versions during type registration
+	observedVersions []schema.GroupVersion
+
+	// schemeName is the name of this scheme.  If you don't specify a name, the stack of the NewScheme caller will be used.
+	// This is useful for error reporting to indicate the origin of the scheme.
+	schemeName string
+}
+
+// FieldLabelConversionFunc converts a field selector to internal representation.
+type FieldLabelConversionFunc func(label, value string) (internalLabel, internalValue string, err error)
+
+// NewScheme creates a new Scheme. This scheme is pluggable by default.
+func NewScheme() *Scheme {
+	s := &Scheme{
+		gvkToType:                 map[schema.GroupVersionKind]reflect.Type{},
+		typeToGVK:                 map[reflect.Type][]schema.GroupVersionKind{},
+		unversionedTypes:          map[reflect.Type]schema.GroupVersionKind{},
+		unversionedKinds:          map[string]reflect.Type{},
+		fieldLabelConversionFuncs: map[schema.GroupVersionKind]FieldLabelConversionFunc{},
+		defaulterFuncs:            map[reflect.Type]func(interface{}){},
+		validationFuncs:           map[reflect.Type]func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList{},
+		versionPriority:           map[string][]string{},
+		schemeName:                naming.GetNameFromCallsite(internalPackages...),
+	}
+	s.converter = conversion.NewConverter(nil)
+
+	// Enable couple default conversions by default.
+	utilruntime.Must(RegisterEmbeddedConversions(s))
+	utilruntime.Must(RegisterStringConversions(s))
+	return s
+}
+
+// Converter allows access to the converter for the scheme
+func (s *Scheme) Converter() *conversion.Converter {
+	return s.converter
+}
+
+// AddUnversionedTypes registers the provided types as "unversioned", which means that they follow special rules.
+// Whenever an object of this type is serialized, it is serialized with the provided group version and is not
+// converted. Thus unversioned objects are expected to remain backwards compatible forever, as if they were in an
+// API group and version that would never be updated.
+//
+// TODO: there is discussion about removing unversioned and replacing it with objects that are manifest into
+// every version with particular schemas. Resolve this method at that point.
+func (s *Scheme) AddUnversionedTypes(version schema.GroupVersion, types ...Object) {
+	s.addObservedVersion(version)
+	s.AddKnownTypes(version, types...)
+	for _, obj := range types {
+		t := reflect.TypeOf(obj).Elem()
+		gvk := version.WithKind(t.Name())
+		s.unversionedTypes[t] = gvk
+		if old, ok := s.unversionedKinds[gvk.Kind]; ok && t != old {
+			panic(fmt.Sprintf("%v.%v has already been registered as unversioned kind %q - kind name must be unique in scheme %q", old.PkgPath(), old.Name(), gvk, s.schemeName))
+		}
+		s.unversionedKinds[gvk.Kind] = t
+	}
+}
+
+// AddKnownTypes registers all types passed in 'types' as being members of version 'version'.
+// All objects passed to types should be pointers to structs. The name that go reports for
+// the struct becomes the "kind" field when encoding. Version may not be empty - use the
+// APIVersionInternal constant if you have a type that does not have a formal version.
+func (s *Scheme) AddKnownTypes(gv schema.GroupVersion, types ...Object) {
+	s.addObservedVersion(gv)
+	for _, obj := range types {
+		t := reflect.TypeOf(obj)
+		if t.Kind() != reflect.Pointer {
+			panic("All types must be pointers to structs.")
+		}
+		t = t.Elem()
+		s.AddKnownTypeWithName(gv.WithKind(t.Name()), obj)
+	}
+}
+
+// AddKnownTypeWithName is like AddKnownTypes, but it lets you specify what this type should
+// be encoded as. Useful for testing when you don't want to make multiple packages to define
+// your structs. Version may not be empty - use the APIVersionInternal constant if you have a
+// type that does not have a formal version.
+func (s *Scheme) AddKnownTypeWithName(gvk schema.GroupVersionKind, obj Object) {
+	s.addObservedVersion(gvk.GroupVersion())
+	t := reflect.TypeOf(obj)
+	if len(gvk.Version) == 0 {
+		panic(fmt.Sprintf("version is required on all types: %s %v", gvk, t))
+	}
+	if t.Kind() != reflect.Pointer {
+		panic("All types must be pointers to structs.")
+	}
+	t = t.Elem()
+	if t.Kind() != reflect.Struct {
+		panic("All types must be pointers to structs.")
+	}
+
+	if oldT, found := s.gvkToType[gvk]; found && oldT != t {
+		panic(fmt.Sprintf("Double registration of different types for %v: old=%v.%v, new=%v.%v in scheme %q", gvk, oldT.PkgPath(), oldT.Name(), t.PkgPath(), t.Name(), s.schemeName))
+	}
+
+	s.gvkToType[gvk] = t
+
+	for _, existingGvk := range s.typeToGVK[t] {
+		if existingGvk == gvk {
+			return
+		}
+	}
+	s.typeToGVK[t] = append(s.typeToGVK[t], gvk)
+
+	// if the type implements DeepCopyInto(<obj>), register a self-conversion
+	if m := reflect.ValueOf(obj).MethodByName("DeepCopyInto"); m.IsValid() && m.Type().NumIn() == 1 && m.Type().NumOut() == 0 && m.Type().In(0) == reflect.TypeOf(obj) {
+		if err := s.AddGeneratedConversionFunc(obj, obj, func(a, b interface{}, scope conversion.Scope) error {
+			// copy a to b
+			reflect.ValueOf(a).MethodByName("DeepCopyInto").Call([]reflect.Value{reflect.ValueOf(b)})
+			// clear TypeMeta to match legacy reflective conversion
+			b.(Object).GetObjectKind().SetGroupVersionKind(schema.GroupVersionKind{})
+			return nil
+		}); err != nil {
+			panic(err)
+		}
+	}
+}
+
+// KnownTypes returns the types known for the given version.
+func (s *Scheme) KnownTypes(gv schema.GroupVersion) map[string]reflect.Type {
+	types := make(map[string]reflect.Type)
+	for gvk, t := range s.gvkToType {
+		if gv != gvk.GroupVersion() {
+			continue
+		}
+
+		types[gvk.Kind] = t
+	}
+	return types
+}
+
+// VersionsForGroupKind returns the versions that a particular GroupKind can be converted to within the given group.
+// A GroupKind might be converted to a different group. That information is available in EquivalentResourceMapper.
+func (s *Scheme) VersionsForGroupKind(gk schema.GroupKind) []schema.GroupVersion {
+	availableVersions := []schema.GroupVersion{}
+	for gvk := range s.gvkToType {
+		if gk != gvk.GroupKind() {
+			continue
+		}
+
+		availableVersions = append(availableVersions, gvk.GroupVersion())
+	}
+
+	// order the return for stability
+	ret := []schema.GroupVersion{}
+	for _, version := range s.PrioritizedVersionsForGroup(gk.Group) {
+		for _, availableVersion := range availableVersions {
+			if version != availableVersion {
+				continue
+			}
+			ret = append(ret, availableVersion)
+		}
+	}
+
+	return ret
+}
+
+// AllKnownTypes returns the all known types.
+func (s *Scheme) AllKnownTypes() map[schema.GroupVersionKind]reflect.Type {
+	return s.gvkToType
+}
+
+// ObjectKinds returns all possible group,version,kind of the go object, true if the
+// object is considered unversioned, or an error if it's not a pointer or is unregistered.
+func (s *Scheme) ObjectKinds(obj Object) ([]schema.GroupVersionKind, bool, error) {
+	// Unstructured objects are always considered to have their declared GVK
+	if _, ok := obj.(Unstructured); ok {
+		// we require that the GVK be populated in order to recognize the object
+		gvk := obj.GetObjectKind().GroupVersionKind()
+		if len(gvk.Kind) == 0 {
+			return nil, false, NewMissingKindErr("unstructured object has no kind")
+		}
+		if len(gvk.Version) == 0 {
+			return nil, false, NewMissingVersionErr("unstructured object has no version")
+		}
+		return []schema.GroupVersionKind{gvk}, false, nil
+	}
+
+	v, err := conversion.EnforcePtr(obj)
+	if err != nil {
+		return nil, false, err
+	}
+	t := v.Type()
+
+	gvks, ok := s.typeToGVK[t]
+	if !ok {
+		return nil, false, NewNotRegisteredErrForType(s.schemeName, t)
+	}
+	_, unversionedType := s.unversionedTypes[t]
+
+	return gvks, unversionedType, nil
+}
+
+// Recognizes returns true if the scheme is able to handle the provided group,version,kind
+// of an object.
+func (s *Scheme) Recognizes(gvk schema.GroupVersionKind) bool {
+	_, exists := s.gvkToType[gvk]
+	return exists
+}
+
+func (s *Scheme) IsUnversioned(obj Object) (bool, bool) {
+	v, err := conversion.EnforcePtr(obj)
+	if err != nil {
+		return false, false
+	}
+	t := v.Type()
+
+	if _, ok := s.typeToGVK[t]; !ok {
+		return false, false
+	}
+	_, ok := s.unversionedTypes[t]
+	return ok, true
+}
+
+// New returns a new API object of the given version and name, or an error if it hasn't
+// been registered. The version and kind fields must be specified.
+func (s *Scheme) New(kind schema.GroupVersionKind) (Object, error) {
+	if t, exists := s.gvkToType[kind]; exists {
+		return reflect.New(t).Interface().(Object), nil
+	}
+
+	if t, exists := s.unversionedKinds[kind.Kind]; exists {
+		return reflect.New(t).Interface().(Object), nil
+	}
+	return nil, NewNotRegisteredErrForKind(s.schemeName, kind)
+}
+
+// AddIgnoredConversionType identifies a pair of types that should be skipped by
+// conversion (because the data inside them is explicitly dropped during
+// conversion).
+func (s *Scheme) AddIgnoredConversionType(from, to interface{}) error {
+	return s.converter.RegisterIgnoredConversion(from, to)
+}
+
+// AddConversionFunc registers a function that converts between a and b by passing objects of those
+// types to the provided function. The function *must* accept objects of a and b - this machinery will not enforce
+// any other guarantee.
+func (s *Scheme) AddConversionFunc(a, b interface{}, fn conversion.ConversionFunc) error {
+	return s.converter.RegisterUntypedConversionFunc(a, b, fn)
+}
+
+// AddGeneratedConversionFunc registers a function that converts between a and b by passing objects of those
+// types to the provided function. The function *must* accept objects of a and b - this machinery will not enforce
+// any other guarantee.
+func (s *Scheme) AddGeneratedConversionFunc(a, b interface{}, fn conversion.ConversionFunc) error {
+	return s.converter.RegisterGeneratedUntypedConversionFunc(a, b, fn)
+}
+
+// AddFieldLabelConversionFunc adds a conversion function to convert field selectors
+// of the given kind from the given version to internal version representation.
+func (s *Scheme) AddFieldLabelConversionFunc(gvk schema.GroupVersionKind, conversionFunc FieldLabelConversionFunc) error {
+	s.fieldLabelConversionFuncs[gvk] = conversionFunc
+	return nil
+}
+
+// AddTypeDefaultingFunc registers a function that is passed a pointer to an
+// object and can default fields on the object. These functions will be invoked
+// when Default() is called. The function will never be called unless the
+// defaulted object matches srcType. If this function is invoked twice with the
+// same srcType, the fn passed to the later call will be used instead.
+func (s *Scheme) AddTypeDefaultingFunc(srcType Object, fn func(interface{})) {
+	s.defaulterFuncs[reflect.TypeOf(srcType)] = fn
+}
+
+// Default sets defaults on the provided Object.
+func (s *Scheme) Default(src Object) {
+	if fn, ok := s.defaulterFuncs[reflect.TypeOf(src)]; ok {
+		fn(src)
+	}
+}
+
+// AddValidationFunc registered a function that can validate the object, and
+// oldObject. These functions will be invoked when Validate() or ValidateUpdate()
+// is called. The function will never be called unless the validated object
+// matches srcType. If this function is invoked twice with the same srcType, the
+// fn passed to the later call will be used instead.
+func (s *Scheme) AddValidationFunc(srcType Object, fn func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList) {
+	s.validationFuncs[reflect.TypeOf(srcType)] = fn
+}
+
+// Validate validates the provided Object according to the generated declarative validation code.
+// WARNING: This does not validate all objects!  The handwritten validation code in validation.go
+// is not run when this is called.  Only the generated zz_generated.validations.go validation code is run.
+func (s *Scheme) Validate(ctx context.Context, options map[string]bool, object Object, subresources ...string) field.ErrorList {
+	if fn, ok := s.validationFuncs[reflect.TypeOf(object)]; ok {
+		return fn(ctx, operation.Operation{Type: operation.Create, Request: operation.Request{Subresources: subresources}, Options: options}, object, nil)
+	}
+	return nil
+}
+
+// ValidateUpdate validates the provided object and oldObject according to the generated declarative validation code.
+// WARNING: This does not validate all objects!  The handwritten validation code in validation.go
+// is not run when this is called.  Only the generated zz_generated.validations.go validation code is run.
+func (s *Scheme) ValidateUpdate(ctx context.Context, options map[string]bool, object, oldObject Object, subresources ...string) field.ErrorList {
+	if fn, ok := s.validationFuncs[reflect.TypeOf(object)]; ok {
+		return fn(ctx, operation.Operation{Type: operation.Update, Request: operation.Request{Subresources: subresources}, Options: options}, object, oldObject)
+	}
+	return nil
+}
+
+// HasValidationFunc reports whether a validation function is registered for the
+// object's type. Unlike Validate, it distinguishes "no function registered" from
+// "function ran and found no errors", which both yield a nil error list.
+func (s *Scheme) HasValidationFunc(obj Object) bool {
+	_, ok := s.validationFuncs[reflect.TypeOf(obj)]
+	return ok
+}
+
+// Convert will attempt to convert in into out. Both must be pointers. For easy
+// testing of conversion functions. Returns an error if the conversion isn't
+// possible. You can call this with types that haven't been registered (for example,
+// a to test conversion of types that are nested within registered types). The
+// context interface is passed to the convertor. Convert also supports Unstructured
+// types and will convert them intelligently.
+func (s *Scheme) Convert(in, out interface{}, context interface{}) error {
+	unstructuredIn, okIn := in.(Unstructured)
+	unstructuredOut, okOut := out.(Unstructured)
+	switch {
+	case okIn && okOut:
+		// converting unstructured input to an unstructured output is a straight copy - unstructured
+		// is a "smart holder" and the contents are passed by reference between the two objects
+		unstructuredOut.SetUnstructuredContent(unstructuredIn.UnstructuredContent())
+		return nil
+
+	case okOut:
+		// if the output is an unstructured object, use the standard Go type to unstructured
+		// conversion. The object must not be internal.
+		obj, ok := in.(Object)
+		if !ok {
+			return fmt.Errorf("unable to convert object type %T to Unstructured, must be a runtime.Object", in)
+		}
+		gvks, unversioned, err := s.ObjectKinds(obj)
+		if err != nil {
+			return err
+		}
+		gvk := gvks[0]
+
+		// if no conversion is necessary, convert immediately
+		if unversioned || gvk.Version != APIVersionInternal {
+			content, err := DefaultUnstructuredConverter.ToUnstructured(in)
+			if err != nil {
+				return err
+			}
+			unstructuredOut.SetUnstructuredContent(content)
+			unstructuredOut.GetObjectKind().SetGroupVersionKind(gvk)
+			return nil
+		}
+
+		// attempt to convert the object to an external version first.
+		target, ok := context.(GroupVersioner)
+		if !ok {
+			return fmt.Errorf("unable to convert the internal object type %T to Unstructured without providing a preferred version to convert to", in)
+		}
+		// Convert is implicitly unsafe, so we don't need to perform a safe conversion
+		versioned, err := s.UnsafeConvertToVersion(obj, target)
+		if err != nil {
+			return err
+		}
+		content, err := DefaultUnstructuredConverter.ToUnstructured(versioned)
+		if err != nil {
+			return err
+		}
+		unstructuredOut.SetUnstructuredContent(content)
+		return nil
+
+	case okIn:
+		// converting an unstructured object to any type is modeled by first converting
+		// the input to a versioned type, then running standard conversions
+		typed, err := s.unstructuredToTyped(unstructuredIn)
+		if err != nil {
+			return err
+		}
+		in = typed
+	}
+
+	meta := s.generateConvertMeta(in)
+	meta.Context = context
+	return s.converter.Convert(in, out, meta)
+}
+
+// ConvertFieldLabel alters the given field label and value for an kind field selector from
+// versioned representation to an unversioned one or returns an error.
+func (s *Scheme) ConvertFieldLabel(gvk schema.GroupVersionKind, label, value string) (string, string, error) {
+	conversionFunc, ok := s.fieldLabelConversionFuncs[gvk]
+	if !ok {
+		return DefaultMetaV1FieldSelectorConversion(label, value)
+	}
+	return conversionFunc(label, value)
+}
+
+// ConvertToVersion attempts to convert an input object to its matching Kind in another
+// version within this scheme. Will return an error if the provided version does not
+// contain the inKind (or a mapping by name defined with AddKnownTypeWithName). Will also
+// return an error if the conversion does not result in a valid Object being
+// returned. Passes target down to the conversion methods as the Context on the scope.
+func (s *Scheme) ConvertToVersion(in Object, target GroupVersioner) (Object, error) {
+	return s.convertToVersion(true, in, target)
+}
+
+// UnsafeConvertToVersion will convert in to the provided target if such a conversion is possible,
+// but does not guarantee the output object does not share fields with the input object. It attempts to be as
+// efficient as possible when doing conversion.
+func (s *Scheme) UnsafeConvertToVersion(in Object, target GroupVersioner) (Object, error) {
+	return s.convertToVersion(false, in, target)
+}
+
+// convertToVersion handles conversion with an optional copy.
+func (s *Scheme) convertToVersion(copy bool, in Object, target GroupVersioner) (Object, error) {
+	var t reflect.Type
+
+	if u, ok := in.(Unstructured); ok {
+		typed, err := s.unstructuredToTyped(u)
+		if err != nil {
+			return nil, err
+		}
+
+		in = typed
+		// unstructuredToTyped returns an Object, which must be a pointer to a struct.
+		t = reflect.TypeOf(in).Elem()
+
+	} else {
+		// determine the incoming kinds with as few allocations as possible.
+		t = reflect.TypeOf(in)
+		if t.Kind() != reflect.Pointer {
+			return nil, fmt.Errorf("only pointer types may be converted: %v", t)
+		}
+		t = t.Elem()
+		if t.Kind() != reflect.Struct {
+			return nil, fmt.Errorf("only pointers to struct types may be converted: %v", t)
+		}
+	}
+
+	kinds, ok := s.typeToGVK[t]
+	if !ok || len(kinds) == 0 {
+		return nil, NewNotRegisteredErrForType(s.schemeName, t)
+	}
+
+	gvk, ok := target.KindForGroupVersionKinds(kinds)
+	if !ok {
+		// try to see if this type is listed as unversioned (for legacy support)
+		// TODO: when we move to server API versions, we should completely remove the unversioned concept
+		if unversionedKind, ok := s.unversionedTypes[t]; ok {
+			if gvk, ok := target.KindForGroupVersionKinds([]schema.GroupVersionKind{unversionedKind}); ok {
+				return copyAndSetTargetKind(copy, in, gvk)
+			}
+			return copyAndSetTargetKind(copy, in, unversionedKind)
+		}
+		return nil, NewNotRegisteredErrForTarget(s.schemeName, t, target)
+	}
+
+	// target wants to use the existing type, set kind and return (no conversion necessary)
+	for _, kind := range kinds {
+		if gvk == kind {
+			return copyAndSetTargetKind(copy, in, gvk)
+		}
+	}
+
+	// type is unversioned, no conversion necessary
+	if unversionedKind, ok := s.unversionedTypes[t]; ok {
+		if gvk, ok := target.KindForGroupVersionKinds([]schema.GroupVersionKind{unversionedKind}); ok {
+			return copyAndSetTargetKind(copy, in, gvk)
+		}
+		return copyAndSetTargetKind(copy, in, unversionedKind)
+	}
+
+	out, err := s.New(gvk)
+	if err != nil {
+		return nil, err
+	}
+
+	if copy {
+		in = in.DeepCopyObject()
+	}
+
+	meta := s.generateConvertMeta(in)
+	meta.Context = target
+	if err := s.converter.Convert(in, out, meta); err != nil {
+		return nil, err
+	}
+
+	setTargetKind(out, gvk)
+	return out, nil
+}
+
+// unstructuredToTyped attempts to transform an unstructured object to a typed
+// object if possible. It will return an error if conversion is not possible, or the versioned
+// Go form of the object. Note that this conversion will lose fields.
+func (s *Scheme) unstructuredToTyped(in Unstructured) (Object, error) {
+	// the type must be something we recognize
+	gvks, _, err := s.ObjectKinds(in)
+	if err != nil {
+		return nil, err
+	}
+	typed, err := s.New(gvks[0])
+	if err != nil {
+		return nil, err
+	}
+	if err := DefaultUnstructuredConverter.FromUnstructured(in.UnstructuredContent(), typed); err != nil {
+		return nil, fmt.Errorf("unable to convert unstructured object to %v: %v", gvks[0], err)
+	}
+	return typed, nil
+}
+
+// generateConvertMeta constructs the meta value we pass to Convert.
+func (s *Scheme) generateConvertMeta(in interface{}) *conversion.Meta {
+	return s.converter.DefaultMeta(reflect.TypeOf(in))
+}
+
+// copyAndSetTargetKind performs a conditional copy before returning the object, or an error if copy was not successful.
+func copyAndSetTargetKind(copy bool, obj Object, kind schema.GroupVersionKind) (Object, error) {
+	if copy {
+		obj = obj.DeepCopyObject()
+	}
+	setTargetKind(obj, kind)
+	return obj, nil
+}
+
+// setTargetKind sets the kind on an object, taking into account whether the target kind is the internal version.
+func setTargetKind(obj Object, kind schema.GroupVersionKind) {
+	if kind.Version == APIVersionInternal {
+		// internal is a special case
+		// TODO: look at removing the need to special case this
+		obj.GetObjectKind().SetGroupVersionKind(schema.GroupVersionKind{})
+		return
+	}
+	obj.GetObjectKind().SetGroupVersionKind(kind)
+}
+
+// SetVersionPriority allows specifying a precise order of priority. All specified versions must be in the same group,
+// and the specified order overwrites any previously specified order for this group
+func (s *Scheme) SetVersionPriority(versions ...schema.GroupVersion) error {
+	groups := sets.String{}
+	order := []string{}
+	for _, version := range versions {
+		if len(version.Version) == 0 || version.Version == APIVersionInternal {
+			return fmt.Errorf("internal versions cannot be prioritized: %v", version)
+		}
+
+		groups.Insert(version.Group)
+		order = append(order, version.Version)
+	}
+	if len(groups) != 1 {
+		return fmt.Errorf("must register versions for exactly one group: %v", strings.Join(groups.List(), ", "))
+	}
+
+	s.versionPriority[groups.List()[0]] = order
+	return nil
+}
+
+// PrioritizedVersionsForGroup returns versions for a single group in priority order
+func (s *Scheme) PrioritizedVersionsForGroup(group string) []schema.GroupVersion {
+	ret := []schema.GroupVersion{}
+	for _, version := range s.versionPriority[group] {
+		ret = append(ret, schema.GroupVersion{Group: group, Version: version})
+	}
+	for _, observedVersion := range s.observedVersions {
+		if observedVersion.Group != group {
+			continue
+		}
+		found := false
+		for _, existing := range ret {
+			if existing == observedVersion {
+				found = true
+				break
+			}
+		}
+		if !found {
+			ret = append(ret, observedVersion)
+		}
+	}
+
+	return ret
+}
+
+// PrioritizedVersionsAllGroups returns all known versions in their priority order.  Groups are random, but
+// versions for a single group are prioritized
+func (s *Scheme) PrioritizedVersionsAllGroups() []schema.GroupVersion {
+	ret := []schema.GroupVersion{}
+	for group, versions := range s.versionPriority {
+		for _, version := range versions {
+			ret = append(ret, schema.GroupVersion{Group: group, Version: version})
+		}
+	}
+	for _, observedVersion := range s.observedVersions {
+		found := false
+		for _, existing := range ret {
+			if existing == observedVersion {
+				found = true
+				break
+			}
+		}
+		if !found {
+			ret = append(ret, observedVersion)
+		}
+	}
+	return ret
+}
+
+// PreferredVersionAllGroups returns the most preferred version for every group.
+// group ordering is random.
+func (s *Scheme) PreferredVersionAllGroups() []schema.GroupVersion {
+	ret := []schema.GroupVersion{}
+	for group, versions := range s.versionPriority {
+		for _, version := range versions {
+			ret = append(ret, schema.GroupVersion{Group: group, Version: version})
+			break
+		}
+	}
+	for _, observedVersion := range s.observedVersions {
+		found := false
+		for _, existing := range ret {
+			if existing.Group == observedVersion.Group {
+				found = true
+				break
+			}
+		}
+		if !found {
+			ret = append(ret, observedVersion)
+		}
+	}
+
+	return ret
+}
+
+// IsGroupRegistered returns true if types for the group have been registered with the scheme
+func (s *Scheme) IsGroupRegistered(group string) bool {
+	for _, observedVersion := range s.observedVersions {
+		if observedVersion.Group == group {
+			return true
+		}
+	}
+	return false
+}
+
+// IsVersionRegistered returns true if types for the version have been registered with the scheme
+func (s *Scheme) IsVersionRegistered(version schema.GroupVersion) bool {
+	for _, observedVersion := range s.observedVersions {
+		if observedVersion == version {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (s *Scheme) addObservedVersion(version schema.GroupVersion) {
+	if len(version.Version) == 0 || version.Version == APIVersionInternal {
+		return
+	}
+	for _, observedVersion := range s.observedVersions {
+		if observedVersion == version {
+			return
+		}
+	}
+
+	s.observedVersions = append(s.observedVersions, version)
+}
+
+func (s *Scheme) Name() string {
+	return s.schemeName
+}
+
+// internalPackages are packages that ignored when creating a default reflector name. These packages are in the common
+// call chains to NewReflector, so they'd be low entropy names for reflectors
+var internalPackages = []string{"k8s.io/apimachinery/pkg/runtime/scheme.go"}
+
+// ToOpenAPIDefinitionName returns the REST-friendly OpenAPI definition name known type identified by groupVersionKind.
+// If the groupVersionKind does not identify a known type, an error is returned.
+// The Version field of groupVersionKind is required, and the Group and Kind fields are required for unstructured.Unstructured
+// types. If a required field is empty, an error is returned.
+//
+// The OpenAPI definition name is the canonical name of the type, with the group and version removed.
+// For example, the OpenAPI definition name of Pod is `io.k8s.api.core.v1.Pod`.
+//
+// This respects the util.OpenAPIModelNamer interface and will return the name returned by
+// OpenAPIModelName() if it is defined on the type.
+//
+// A known type that is registered as an unstructured.Unstructured type is treated as a custom resource and
+// which has an OpenAPI definition name of the form `<reversed-group>.<version.<kind>`.
+// For example, the OpenAPI definition name of `group: stable.example.com, version: v1, kind: Pod` is
+// `com.example.stable.v1.Pod`.
+func (s *Scheme) ToOpenAPIDefinitionName(groupVersionKind schema.GroupVersionKind) (string, error) {
+	if groupVersionKind.Version == "" { // Empty version is not allowed by New() so check it first to avoid a panic.
+		return "", fmt.Errorf("version is required on all types: %v", groupVersionKind)
+	}
+	example, err := s.New(groupVersionKind)
+	if err != nil {
+		return "", err
+	}
+
+	// Use a namer if provided
+	if namer, ok := example.(util.OpenAPIModelNamer); ok {
+		return namer.OpenAPIModelName(), nil
+	}
+
+	if _, ok := example.(Unstructured); ok {
+		if groupVersionKind.Group == "" || groupVersionKind.Kind == "" {
+			return "", fmt.Errorf("unable to convert GroupVersionKind with empty fields to unstructured type to an OpenAPI definition name: %v", groupVersionKind)
+		}
+		return reverseParts(groupVersionKind.Group) + "." + groupVersionKind.Version + "." + groupVersionKind.Kind, nil
+	}
+	rtype := reflect.TypeOf(example).Elem()
+	name := toOpenAPIDefinitionName(rtype.PkgPath() + "." + rtype.Name())
+	return name, nil
+}
+
+// toOpenAPIDefinitionName converts Golang package/type canonical name into REST friendly OpenAPI name.
+// Input is expected to be `PkgPath + "." TypeName.
+//
+// Examples of REST friendly OpenAPI name:
+//
+//	Input:  k8s.io/api/core/v1.Pod
+//	Output: io.k8s.api.core.v1.Pod
+//
+//	Input:  k8s.io/api/core/v1
+//	Output: io.k8s.api.core.v1
+//
+//	Input:  csi.storage.k8s.io/v1alpha1.CSINodeInfo
+//	Output: io.k8s.storage.csi.v1alpha1.CSINodeInfo
+//
+// Note that this is a copy of ToRESTFriendlyName from k8s.io/kube-openapi/pkg/util. It is duplicated here to avoid
+// a dependency on kube-openapi.
+func toOpenAPIDefinitionName(name string) string {
+	nameParts := strings.Split(name, "/")
+	// Reverse first part. e.g., io.k8s... instead of k8s.io...
+	if len(nameParts) > 0 && strings.Contains(nameParts[0], ".") {
+		nameParts[0] = reverseParts(nameParts[0])
+	}
+	return strings.Join(nameParts, ".")
+}
+
+func reverseParts(dotSeparatedName string) string {
+	parts := strings.Split(dotSeparatedName, ".")
+	for i, j := 0, len(parts)-1; i < j; i, j = i+1, j-1 {
+		parts[i], parts[j] = parts[j], parts[i]
+	}
+	return strings.Join(parts, ".")
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/scheme_builder.go b/third_party/k8s.io/apimachinery/pkg/runtime/scheme_builder.go
new file mode 100644
index 0000000000..944db48182
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/scheme_builder.go
@@ -0,0 +1,48 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+// SchemeBuilder collects functions that add things to a scheme. It's to allow
+// code to compile without explicitly referencing generated types. You should
+// declare one in each package that will have generated deep copy or conversion
+// functions.
+type SchemeBuilder []func(*Scheme) error
+
+// AddToScheme applies all the stored functions to the scheme. A non-nil error
+// indicates that one function failed and the attempt was abandoned.
+func (sb *SchemeBuilder) AddToScheme(s *Scheme) error {
+	for _, f := range *sb {
+		if err := f(s); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Register adds a scheme setup function to the list.
+func (sb *SchemeBuilder) Register(funcs ...func(*Scheme) error) {
+	for _, f := range funcs {
+		*sb = append(*sb, f)
+	}
+}
+
+// NewSchemeBuilder calls Register for you.
+func NewSchemeBuilder(funcs ...func(*Scheme) error) SchemeBuilder {
+	var sb SchemeBuilder
+	sb.Register(funcs...)
+	return sb
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/scheme_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/scheme_test.go
new file mode 100644
index 0000000000..5e4fe1e2c9
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/scheme_test.go
@@ -0,0 +1,1181 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime_test
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+	"k8s.io/apimachinery/pkg/util/diff"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+type testConversions struct {
+	internalToExternalCalls int
+	externalToInternalCalls int
+}
+
+func (c *testConversions) internalToExternalSimple(in *runtimetesting.InternalSimple, out *runtimetesting.ExternalSimple, scope conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.TestString = in.TestString
+	c.internalToExternalCalls++
+	return nil
+}
+
+func (c *testConversions) externalToInternalSimple(in *runtimetesting.ExternalSimple, out *runtimetesting.InternalSimple, scope conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.TestString = in.TestString
+	c.externalToInternalCalls++
+	return nil
+}
+
+func (c *testConversions) registerConversions(s *runtime.Scheme) error {
+	if err := s.AddConversionFunc((*runtimetesting.InternalSimple)(nil), (*runtimetesting.ExternalSimple)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return c.internalToExternalSimple(a.(*runtimetesting.InternalSimple), b.(*runtimetesting.ExternalSimple), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*runtimetesting.ExternalSimple)(nil), (*runtimetesting.InternalSimple)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return c.externalToInternalSimple(a.(*runtimetesting.ExternalSimple), b.(*runtimetesting.InternalSimple), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
+
+func TestScheme(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	internalGVK := internalGV.WithKind("Simple")
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "testExternal"}
+	externalGVK := externalGV.WithKind("Simple")
+
+	scheme := runtime.NewScheme()
+	scheme.AddKnownTypeWithName(internalGVK, &runtimetesting.InternalSimple{})
+	scheme.AddKnownTypeWithName(externalGVK, &runtimetesting.ExternalSimple{})
+	utilruntime.Must(runtimetesting.RegisterConversions(scheme))
+
+	// If set, would clear TypeMeta during conversion.
+	//scheme.AddIgnoredConversionType(&TypeMeta{}, &TypeMeta{})
+
+	// test that scheme is an ObjectTyper
+	var _ runtime.ObjectTyper = scheme
+
+	conversions := &testConversions{
+		internalToExternalCalls: 0,
+		externalToInternalCalls: 0,
+	}
+
+	// Register functions to verify that scope.Meta() gets set correctly.
+	utilruntime.Must(conversions.registerConversions(scheme))
+
+	t.Run("Encode, Decode, DecodeInto, and DecodeToVersion", func(t *testing.T) {
+		simple := &runtimetesting.InternalSimple{
+			TestString: "foo",
+		}
+
+		codecs := serializer.NewCodecFactory(scheme)
+		codec := codecs.LegacyCodec(externalGV)
+		info, _ := runtime.SerializerInfoForMediaType(codecs.SupportedMediaTypes(), runtime.ContentTypeJSON)
+		jsonserializer := info.Serializer
+
+		obj := runtime.Object(simple)
+		data, err := runtime.Encode(codec, obj)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		obj2, err := runtime.Decode(codec, data)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, ok := obj2.(*runtimetesting.InternalSimple); !ok {
+			t.Fatalf("Got wrong type")
+		}
+		if e, a := simple, obj2; !reflect.DeepEqual(e, a) {
+			t.Errorf("Expected:\n %#v,\n Got:\n %#v", e, a)
+		}
+
+		obj3 := &runtimetesting.InternalSimple{}
+		if err := runtime.DecodeInto(codec, data, obj3); err != nil {
+			t.Fatal(err)
+		}
+		// clearing TypeMeta is a function of the scheme, which we do not test here (ConvertToVersion
+		// does not automatically clear TypeMeta anymore).
+		simple.TypeMeta = runtime.TypeMeta{Kind: "Simple", APIVersion: externalGV.String()}
+		if e, a := simple, obj3; !reflect.DeepEqual(e, a) {
+			t.Errorf("Expected:\n %#v,\n Got:\n %#v", e, a)
+		}
+
+		obj4, err := runtime.Decode(jsonserializer, data)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, ok := obj4.(*runtimetesting.ExternalSimple); !ok {
+			t.Fatalf("Got wrong type")
+		}
+	})
+	t.Run("Convert", func(t *testing.T) {
+		simple := &runtimetesting.InternalSimple{
+			TestString: "foo",
+		}
+
+		external := &runtimetesting.ExternalSimple{}
+		if err := scheme.Convert(simple, external, nil); err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+		if e, a := simple.TestString, external.TestString; e != a {
+			t.Errorf("Expected %q, got %q", e, a)
+		}
+	})
+	t.Run("Convert internal to unstructured", func(t *testing.T) {
+		simple := &runtimetesting.InternalSimple{
+			TestString: "foo",
+		}
+
+		unstructuredObj := &runtimetesting.Unstructured{}
+		err := scheme.Convert(simple, unstructuredObj, nil)
+		if err == nil || !strings.Contains(err.Error(), "to Unstructured without providing a preferred version to convert to") {
+			t.Fatalf("Unexpected non-error: %v", err)
+		}
+		if err := scheme.Convert(simple, unstructuredObj, externalGV); err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+		if e, a := simple.TestString, unstructuredObj.Object["testString"].(string); e != a {
+			t.Errorf("Expected %q, got %q", e, a)
+		}
+		if e := unstructuredObj.GetObjectKind().GroupVersionKind(); e != externalGVK {
+			t.Errorf("Unexpected object kind: %#v", e)
+		}
+		if gvks, unversioned, err := scheme.ObjectKinds(unstructuredObj); err != nil || gvks[0] != externalGVK || unversioned {
+			t.Errorf("Scheme did not recognize unversioned: %v, %#v %t", err, gvks, unversioned)
+		}
+	})
+	t.Run("Convert external to unstructured", func(t *testing.T) {
+		unstructuredObj := &runtimetesting.Unstructured{}
+		external := &runtimetesting.ExternalSimple{
+			TestString: "foo",
+		}
+
+		if err := scheme.Convert(external, unstructuredObj, nil); err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+		if e, a := external.TestString, unstructuredObj.Object["testString"].(string); e != a {
+			t.Errorf("Expected %q, got %q", e, a)
+		}
+		if e := unstructuredObj.GetObjectKind().GroupVersionKind(); e != externalGVK {
+			t.Errorf("Unexpected object kind: %#v", e)
+		}
+	})
+	t.Run("Convert unstructured to unstructured", func(t *testing.T) {
+		uIn := &runtimetesting.Unstructured{Object: map[string]interface{}{
+			"test": []interface{}{"other", "test"},
+		}}
+		uOut := &runtimetesting.Unstructured{}
+		if err := scheme.Convert(uIn, uOut, nil); err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+		if !reflect.DeepEqual(uIn.Object, uOut.Object) {
+			t.Errorf("Unexpected object contents: %#v", uOut.Object)
+		}
+	})
+	t.Run("Convert unstructured to structured", func(t *testing.T) {
+		unstructuredObj := &runtimetesting.Unstructured{
+			Object: map[string]interface{}{
+				"testString": "bla",
+			},
+		}
+		unstructuredObj.SetGroupVersionKind(externalGV.WithKind("Simple"))
+		externalOut := &runtimetesting.ExternalSimple{}
+		if err := scheme.Convert(unstructuredObj, externalOut, nil); err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+		if externalOut.TestString != "bla" {
+			t.Errorf("Unexpected object contents: %#v", externalOut)
+		}
+	})
+	t.Run("Encode and Convert should each have caused an increment", func(t *testing.T) {
+		if e, a := 3, conversions.internalToExternalCalls; e != a {
+			t.Errorf("Expected %v, got %v", e, a)
+		}
+	})
+	t.Run("DecodeInto and Decode should each have caused an increment because of a conversion", func(t *testing.T) {
+		if e, a := 2, conversions.externalToInternalCalls; e != a {
+			t.Errorf("Expected %v, got %v", e, a)
+		}
+	})
+	t.Run("Verify that unstructured types must have V and K set", func(t *testing.T) {
+		emptyObj := &runtimetesting.Unstructured{Object: make(map[string]interface{})}
+		if _, _, err := scheme.ObjectKinds(emptyObj); !runtime.IsMissingKind(err) {
+			t.Errorf("unexpected error: %v", err)
+		}
+		emptyObj.SetGroupVersionKind(schema.GroupVersionKind{Kind: "Test"})
+		if _, _, err := scheme.ObjectKinds(emptyObj); !runtime.IsMissingVersion(err) {
+			t.Errorf("unexpected error: %v", err)
+		}
+		emptyObj.SetGroupVersionKind(schema.GroupVersionKind{Kind: "Test", Version: "v1"})
+		if _, _, err := scheme.ObjectKinds(emptyObj); err != nil {
+			t.Errorf("unexpected error: %v", err)
+		}
+	})
+}
+
+func TestBadJSONRejection(t *testing.T) {
+	scheme := runtime.NewScheme()
+	codecs := serializer.NewCodecFactory(scheme)
+	info, _ := runtime.SerializerInfoForMediaType(codecs.SupportedMediaTypes(), runtime.ContentTypeJSON)
+	jsonserializer := info.Serializer
+
+	badJSONMissingKind := []byte(`{ }`)
+	if _, err := runtime.Decode(jsonserializer, badJSONMissingKind); err == nil {
+		t.Errorf("Did not reject despite lack of kind field: %s", badJSONMissingKind)
+	}
+	badJSONUnknownType := []byte(`{"kind": "bar"}`)
+	if _, err1 := runtime.Decode(jsonserializer, badJSONUnknownType); err1 == nil {
+		t.Errorf("Did not reject despite use of unknown type: %s", badJSONUnknownType)
+	}
+}
+
+func TestExternalToInternalMapping(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "testExternal"}
+
+	scheme := runtime.NewScheme()
+	scheme.AddKnownTypeWithName(internalGV.WithKind("OptionalExtensionType"), &runtimetesting.InternalOptionalExtensionType{})
+	scheme.AddKnownTypeWithName(externalGV.WithKind("OptionalExtensionType"), &runtimetesting.ExternalOptionalExtensionType{})
+	utilruntime.Must(runtimetesting.RegisterConversions(scheme))
+
+	codec := serializer.NewCodecFactory(scheme).LegacyCodec(externalGV)
+
+	table := []struct {
+		obj     runtime.Object
+		encoded string
+	}{
+		{
+			&runtimetesting.InternalOptionalExtensionType{Extension: nil},
+			`{"kind":"OptionalExtensionType","apiVersion":"` + externalGV.String() + `"}`,
+		},
+	}
+
+	for i, item := range table {
+		gotDecoded, err := runtime.Decode(codec, []byte(item.encoded))
+		if err != nil {
+			t.Errorf("unexpected error '%v' (%v)", err, item.encoded)
+		} else if e, a := item.obj, gotDecoded; !reflect.DeepEqual(e, a) {
+			t.Errorf("%d: unexpected objects:\n%s", i, diff.ObjectGoPrintSideBySide(e, a))
+		}
+	}
+}
+
+func TestExtensionMapping(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "testExternal"}
+
+	scheme := runtime.NewScheme()
+	scheme.AddKnownTypeWithName(internalGV.WithKind("ExtensionType"), &runtimetesting.InternalExtensionType{})
+	scheme.AddKnownTypeWithName(internalGV.WithKind("OptionalExtensionType"), &runtimetesting.InternalOptionalExtensionType{})
+	scheme.AddKnownTypeWithName(externalGV.WithKind("ExtensionType"), &runtimetesting.ExternalExtensionType{})
+	scheme.AddKnownTypeWithName(externalGV.WithKind("OptionalExtensionType"), &runtimetesting.ExternalOptionalExtensionType{})
+
+	// register external first when the object is the same in both schemes, so ObjectVersionAndKind reports the
+	// external version.
+	scheme.AddKnownTypeWithName(externalGV.WithKind("A"), &runtimetesting.ExtensionA{})
+	scheme.AddKnownTypeWithName(externalGV.WithKind("B"), &runtimetesting.ExtensionB{})
+	scheme.AddKnownTypeWithName(internalGV.WithKind("A"), &runtimetesting.ExtensionA{})
+	scheme.AddKnownTypeWithName(internalGV.WithKind("B"), &runtimetesting.ExtensionB{})
+	utilruntime.Must(runtimetesting.RegisterConversions(scheme))
+
+	codec := serializer.NewCodecFactory(scheme).LegacyCodec(externalGV)
+
+	table := []struct {
+		obj      runtime.Object
+		expected runtime.Object
+		encoded  string
+	}{
+		{
+			&runtimetesting.InternalExtensionType{
+				Extension: runtime.NewEncodable(codec, &runtimetesting.ExtensionA{TestString: "foo"}),
+			},
+			&runtimetesting.InternalExtensionType{
+				Extension: &runtime.Unknown{
+					Raw:         []byte(`{"apiVersion":"test.group/testExternal","kind":"A","testString":"foo"}`),
+					ContentType: runtime.ContentTypeJSON,
+				},
+			},
+			// apiVersion is set in the serialized object for easier consumption by clients
+			`{"apiVersion":"` + externalGV.String() + `","kind":"ExtensionType","extension":{"apiVersion":"test.group/testExternal","kind":"A","testString":"foo"}}
+`,
+		}, {
+			&runtimetesting.InternalExtensionType{Extension: runtime.NewEncodable(codec, &runtimetesting.ExtensionB{TestString: "bar"})},
+			&runtimetesting.InternalExtensionType{
+				Extension: &runtime.Unknown{
+					Raw:         []byte(`{"apiVersion":"test.group/testExternal","kind":"B","testString":"bar"}`),
+					ContentType: runtime.ContentTypeJSON,
+				},
+			},
+			// apiVersion is set in the serialized object for easier consumption by clients
+			`{"apiVersion":"` + externalGV.String() + `","kind":"ExtensionType","extension":{"apiVersion":"test.group/testExternal","kind":"B","testString":"bar"}}
+`,
+		}, {
+			&runtimetesting.InternalExtensionType{Extension: nil},
+			&runtimetesting.InternalExtensionType{
+				Extension: nil,
+			},
+			`{"apiVersion":"` + externalGV.String() + `","kind":"ExtensionType","extension":null}
+`,
+		},
+	}
+
+	for i, item := range table {
+		gotEncoded, err := runtime.Encode(codec, item.obj)
+		if err != nil {
+			t.Errorf("unexpected error '%v' (%#v)", err, item.obj)
+		} else if e, a := item.encoded, string(gotEncoded); e != a {
+			t.Errorf("expected\n%#v\ngot\n%#v\n", e, a)
+		}
+
+		gotDecoded, err := runtime.Decode(codec, []byte(item.encoded))
+		if err != nil {
+			t.Errorf("unexpected error '%v' (%v)", err, item.encoded)
+		} else if e, a := item.expected, gotDecoded; !reflect.DeepEqual(e, a) {
+			t.Errorf("%d: unexpected objects:\n%s", i, diff.ObjectGoPrintSideBySide(e, a))
+		}
+	}
+}
+
+func TestEncode(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	internalGVK := internalGV.WithKind("Simple")
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "testExternal"}
+	externalGVK := externalGV.WithKind("Simple")
+
+	scheme := runtime.NewScheme()
+	scheme.AddKnownTypeWithName(internalGVK, &runtimetesting.InternalSimple{})
+	scheme.AddKnownTypeWithName(externalGVK, &runtimetesting.ExternalSimple{})
+	utilruntime.Must(runtimetesting.RegisterConversions(scheme))
+
+	codec := serializer.NewCodecFactory(scheme).LegacyCodec(externalGV)
+
+	test := &runtimetesting.InternalSimple{
+		TestString: "I'm the same",
+	}
+	obj := runtime.Object(test)
+	data, err := runtime.Encode(codec, obj)
+	obj2, gvk, err2 := codec.Decode(data, nil, nil)
+	if err != nil || err2 != nil {
+		t.Fatalf("Failure: '%v' '%v'", err, err2)
+	}
+	if _, ok := obj2.(*runtimetesting.InternalSimple); !ok {
+		t.Fatalf("Got wrong type")
+	}
+	if !reflect.DeepEqual(obj2, test) {
+		t.Errorf("Expected:\n %#v,\n Got:\n %#v", test, obj2)
+	}
+	if *gvk != externalGVK {
+		t.Errorf("unexpected gvk returned by decode: %#v", *gvk)
+	}
+}
+
+func TestUnversionedTypes(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	internalGVK := internalGV.WithKind("Simple")
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "testExternal"}
+	externalGVK := externalGV.WithKind("Simple")
+	otherGV := schema.GroupVersion{Group: "group", Version: "other"}
+
+	scheme := runtime.NewScheme()
+	scheme.AddUnversionedTypes(externalGV, &runtimetesting.InternalSimple{})
+	scheme.AddKnownTypeWithName(internalGVK, &runtimetesting.InternalSimple{})
+	scheme.AddKnownTypeWithName(externalGVK, &runtimetesting.ExternalSimple{})
+	scheme.AddKnownTypeWithName(otherGV.WithKind("Simple"), &runtimetesting.ExternalSimple{})
+	utilruntime.Must(runtimetesting.RegisterConversions(scheme))
+
+	codec := serializer.NewCodecFactory(scheme).LegacyCodec(externalGV)
+
+	if unv, ok := scheme.IsUnversioned(&runtimetesting.InternalSimple{}); !unv || !ok {
+		t.Fatalf("type not unversioned and in scheme: %t %t", unv, ok)
+	}
+
+	kinds, _, err := scheme.ObjectKinds(&runtimetesting.InternalSimple{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	kind := kinds[0]
+	if kind != externalGV.WithKind("InternalSimple") {
+		t.Fatalf("unexpected: %#v", kind)
+	}
+
+	test := &runtimetesting.InternalSimple{
+		TestString: "I'm the same",
+	}
+	obj := runtime.Object(test)
+	data, err := runtime.Encode(codec, obj)
+	if err != nil {
+		t.Fatal(err)
+	}
+	obj2, gvk, err := codec.Decode(data, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := obj2.(*runtimetesting.InternalSimple); !ok {
+		t.Fatalf("Got wrong type")
+	}
+	if !reflect.DeepEqual(obj2, test) {
+		t.Errorf("Expected:\n %#v,\n Got:\n %#v", test, obj2)
+	}
+	// object is serialized as an unversioned object (in the group and version it was defined in)
+	if *gvk != externalGV.WithKind("InternalSimple") {
+		t.Errorf("unexpected gvk returned by decode: %#v", *gvk)
+	}
+
+	// when serialized to a different group, the object is kept in its preferred name
+	codec = serializer.NewCodecFactory(scheme).LegacyCodec(otherGV)
+	data, err = runtime.Encode(codec, obj)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(data) != `{"apiVersion":"test.group/testExternal","kind":"InternalSimple","testString":"I'm the same"}`+"\n" {
+		t.Errorf("unexpected data: %s", data)
+	}
+}
+
+// Returns a new Scheme set up with the test objects.
+func GetTestScheme() *runtime.Scheme {
+	internalGV := schema.GroupVersion{Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Version: "v1"}
+	alternateExternalGV := schema.GroupVersion{Group: "custom", Version: "v1"}
+	alternateInternalGV := schema.GroupVersion{Group: "custom", Version: runtime.APIVersionInternal}
+	differentExternalGV := schema.GroupVersion{Group: "other", Version: "v2"}
+
+	s := runtime.NewScheme()
+	// Ordinarily, we wouldn't add TestType2, but because this is a test and
+	// both types are from the same package, we need to get it into the system
+	// so that converter will match it with ExternalType2.
+	s.AddKnownTypes(internalGV, &runtimetesting.TestType1{}, &runtimetesting.TestType2{}, &runtimetesting.ExternalInternalSame{})
+	s.AddKnownTypes(externalGV, &runtimetesting.ExternalInternalSame{})
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType1"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType2"), &runtimetesting.ExternalTestType2{})
+	s.AddKnownTypeWithName(internalGV.WithKind("TestType3"), &runtimetesting.TestType1{})
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType3"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType4"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(alternateInternalGV.WithKind("TestType3"), &runtimetesting.TestType1{})
+	s.AddKnownTypeWithName(alternateExternalGV.WithKind("TestType3"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(alternateExternalGV.WithKind("TestType5"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(differentExternalGV.WithKind("TestType1"), &runtimetesting.ExternalTestType1{})
+	s.AddUnversionedTypes(externalGV, &runtimetesting.UnversionedType{})
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+
+	return s
+}
+
+func TestKnownTypes(t *testing.T) {
+	s := GetTestScheme()
+	if len(s.KnownTypes(schema.GroupVersion{Group: "group", Version: "v2"})) != 0 {
+		t.Errorf("should have no known types for v2")
+	}
+
+	types := s.KnownTypes(schema.GroupVersion{Version: "v1"})
+	for _, s := range []string{"TestType1", "TestType2", "TestType3", "ExternalInternalSame"} {
+		if _, ok := types[s]; !ok {
+			t.Errorf("missing type %q", s)
+		}
+	}
+}
+
+func TestAddKnownTypesIdemPotent(t *testing.T) {
+	s := runtime.NewScheme()
+
+	gv := schema.GroupVersion{Group: "foo", Version: "v1"}
+	s.AddKnownTypes(gv, &runtimetesting.InternalSimple{})
+	s.AddKnownTypes(gv, &runtimetesting.InternalSimple{})
+	if len(s.KnownTypes(gv)) != 1 {
+		t.Errorf("expected only one %v type after double registration", gv)
+	}
+	if len(s.AllKnownTypes()) != 1 {
+		t.Errorf("expected only one type after double registration")
+	}
+
+	s.AddKnownTypeWithName(gv.WithKind("InternalSimple"), &runtimetesting.InternalSimple{})
+	s.AddKnownTypeWithName(gv.WithKind("InternalSimple"), &runtimetesting.InternalSimple{})
+	if len(s.KnownTypes(gv)) != 1 {
+		t.Errorf("expected only one %v type after double registration with custom name", gv)
+	}
+	if len(s.AllKnownTypes()) != 1 {
+		t.Errorf("expected only one type after double registration with custom name")
+	}
+
+	s.AddUnversionedTypes(gv, &runtimetesting.InternalSimple{})
+	s.AddUnversionedTypes(gv, &runtimetesting.InternalSimple{})
+	if len(s.KnownTypes(gv)) != 1 {
+		t.Errorf("expected only one %v type after double registration with custom name", gv)
+	}
+	if len(s.AllKnownTypes()) != 1 {
+		t.Errorf("expected only one type after double registration with custom name")
+	}
+
+	kinds, _, err := s.ObjectKinds(&runtimetesting.InternalSimple{})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(kinds) != 1 {
+		t.Errorf("expected only one kind for InternalSimple after double registration")
+	}
+}
+
+// redefine InternalSimple with the same name, but obviously as a different type than in runtimetesting
+type InternalSimple struct {
+	runtime.TypeMeta `json:""`
+	TestString       string `json:"testString"`
+}
+
+func (s *InternalSimple) DeepCopyObject() runtime.Object { return nil }
+
+func TestConflictingAddKnownTypes(t *testing.T) {
+	s := runtime.NewScheme()
+	gv := schema.GroupVersion{Group: "foo", Version: "v1"}
+
+	panicked := make(chan bool)
+	go func() {
+		defer func() {
+			if recover() != nil {
+				panicked <- true
+			}
+		}()
+		s.AddKnownTypeWithName(gv.WithKind("InternalSimple"), &runtimetesting.InternalSimple{})
+		s.AddKnownTypeWithName(gv.WithKind("InternalSimple"), &runtimetesting.ExternalSimple{})
+		panicked <- false
+	}()
+	if !<-panicked {
+		t.Errorf("Expected AddKnownTypesWithName to panic with conflicting type registrations")
+	}
+
+	go func() {
+		defer func() {
+			if recover() != nil {
+				panicked <- true
+			}
+		}()
+
+		s.AddUnversionedTypes(gv, &runtimetesting.InternalSimple{})
+		s.AddUnversionedTypes(gv, &InternalSimple{})
+		panicked <- false
+	}()
+	if !<-panicked {
+		t.Errorf("Expected AddUnversionedTypes to panic with conflicting type registrations")
+	}
+}
+
+func TestConvertToVersionBasic(t *testing.T) {
+	s := GetTestScheme()
+	tt := &runtimetesting.TestType1{A: "I'm not a pointer object"}
+	other, err := s.ConvertToVersion(tt, schema.GroupVersion{Version: "v1"})
+	if err != nil {
+		t.Fatalf("Failure: %v", err)
+	}
+	converted, ok := other.(*runtimetesting.ExternalTestType1)
+	if !ok {
+		t.Fatalf("Got wrong type: %T", other)
+	}
+	if tt.A != converted.A {
+		t.Fatalf("Failed to convert object correctly: %#v", converted)
+	}
+}
+
+type testGroupVersioner struct {
+	target schema.GroupVersionKind
+	ok     bool
+}
+
+func (m testGroupVersioner) KindForGroupVersionKinds(kinds []schema.GroupVersionKind) (schema.GroupVersionKind, bool) {
+	return m.target, m.ok
+}
+
+func (m testGroupVersioner) Identifier() string {
+	return "testGroupVersioner"
+}
+
+func TestConvertToVersion(t *testing.T) {
+	testCases := []struct {
+		scheme *runtime.Scheme
+		in     runtime.Object
+		gv     runtime.GroupVersioner
+		same   bool
+		out    runtime.Object
+		errFn  func(error) bool
+	}{
+		// errors if the type is not registered in the scheme
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.UnknownType{},
+			errFn:  func(err error) bool { return err != nil && runtime.IsNotRegisteredError(err) },
+		},
+		// errors if the group versioner returns no target
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     testGroupVersioner{},
+			errFn: func(err error) bool {
+				return err != nil && strings.Contains(err.Error(), "is not suitable for converting")
+			},
+		},
+		// converts to internal
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     schema.GroupVersion{Version: runtime.APIVersionInternal},
+			out:    &runtimetesting.TestType1{A: "test"},
+		},
+		// converts from unstructured to internal
+		{
+			scheme: GetTestScheme(),
+			in: &runtimetesting.Unstructured{Object: map[string]interface{}{
+				"apiVersion": "custom/v1",
+				"kind":       "TestType3",
+				"A":          "test",
+			}},
+			gv:  schema.GroupVersion{Version: runtime.APIVersionInternal},
+			out: &runtimetesting.TestType1{A: "test"},
+		},
+		// converts from unstructured to external
+		{
+			scheme: GetTestScheme(),
+			in: &runtimetesting.Unstructured{Object: map[string]interface{}{
+				"apiVersion": "custom/v1",
+				"kind":       "TestType3",
+				"A":          "test",
+			}},
+			gv:  schema.GroupVersion{Group: "custom", Version: "v1"},
+			out: &runtimetesting.ExternalTestType1{MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "custom/v1", ObjectKind: "TestType3"}, A: "test"},
+		},
+		// prefers the best match
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     schema.GroupVersions{{Version: runtime.APIVersionInternal}, {Version: "v1"}},
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// unversioned type returned as-is
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.UnversionedType{A: "test"},
+			gv:     schema.GroupVersions{{Version: "v1"}},
+			same:   true,
+			out: &runtimetesting.UnversionedType{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "UnversionedType"},
+				A:                                     "test",
+			},
+		},
+		// unversioned type returned when not included in the target types
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.UnversionedType{A: "test"},
+			gv:     schema.GroupVersions{{Group: "other", Version: "v2"}},
+			same:   true,
+			out: &runtimetesting.UnversionedType{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "UnversionedType"},
+				A:                                     "test",
+			},
+		},
+		// detected as already being in the target version
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     schema.GroupVersions{{Version: "v1"}},
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// detected as already being in the first target version
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     schema.GroupVersions{{Version: "v1"}, {Version: runtime.APIVersionInternal}},
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// detected as already being in the first target version
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     schema.GroupVersions{{Version: "v1"}, {Version: runtime.APIVersionInternal}},
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// the external type is registered in multiple groups, versions, and kinds, and can be targeted to all of them (1/3): different kind
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     testGroupVersioner{ok: true, target: schema.GroupVersionKind{Kind: "TestType3", Version: "v1"}},
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType3"},
+				A:                                     "test",
+			},
+		},
+		// the external type is registered in multiple groups, versions, and kinds, and can be targeted to all of them (2/3): different gv
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     testGroupVersioner{ok: true, target: schema.GroupVersionKind{Kind: "TestType3", Group: "custom", Version: "v1"}},
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "custom/v1", ObjectKind: "TestType3"},
+				A:                                     "test",
+			},
+		},
+		// the external type is registered in multiple groups, versions, and kinds, and can be targeted to all of them (3/3): different gvk
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     testGroupVersioner{ok: true, target: schema.GroupVersionKind{Group: "custom", Version: "v1", Kind: "TestType5"}},
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "custom/v1", ObjectKind: "TestType5"},
+				A:                                     "test",
+			},
+		},
+		// multi group versioner recognizes multiple groups and forces the output to a particular version, copies because version differs
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     runtime.NewMultiGroupVersioner(schema.GroupVersion{Group: "other", Version: "v2"}, schema.GroupKind{Group: "custom", Kind: "TestType3"}, schema.GroupKind{Kind: "TestType1"}),
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "other/v2", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// multi group versioner recognizes multiple groups and forces the output to a particular version, copies because version differs
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     runtime.NewMultiGroupVersioner(schema.GroupVersion{Group: "other", Version: "v2"}, schema.GroupKind{Kind: "TestType1"}, schema.GroupKind{Group: "custom", Kind: "TestType3"}),
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "other/v2", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// multi group versioner is unable to find a match when kind AND group don't match (there is no TestType1 kind in group "other", and no kind "TestType5" in the default group)
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.TestType1{A: "test"},
+			gv:     runtime.NewMultiGroupVersioner(schema.GroupVersion{Group: "custom", Version: "v1"}, schema.GroupKind{Group: "other"}, schema.GroupKind{Kind: "TestType5"}),
+			errFn: func(err error) bool {
+				return err != nil && strings.Contains(err.Error(), "is not suitable for converting")
+			},
+		},
+		// multi group versioner recognizes multiple groups and forces the output to a particular version, performs no copy
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     runtime.NewMultiGroupVersioner(schema.GroupVersion{Group: "", Version: "v1"}, schema.GroupKind{Group: "custom", Kind: "TestType3"}, schema.GroupKind{Kind: "TestType1"}),
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// multi group versioner recognizes multiple groups and forces the output to a particular version, performs no copy
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.ExternalTestType1{A: "test"},
+			gv:     runtime.NewMultiGroupVersioner(schema.GroupVersion{Group: "", Version: "v1"}, schema.GroupKind{Kind: "TestType1"}, schema.GroupKind{Group: "custom", Kind: "TestType3"}),
+			same:   true,
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType1"},
+				A:                                     "test",
+			},
+		},
+		// group versioner can choose a particular target kind for a given input when kind is the same across group versions
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.TestType1{A: "test"},
+			gv:     testGroupVersioner{ok: true, target: schema.GroupVersionKind{Version: "v1", Kind: "TestType3"}},
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "v1", ObjectKind: "TestType3"},
+				A:                                     "test",
+			},
+		},
+		// group versioner can choose a different kind
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.TestType1{A: "test"},
+			gv:     testGroupVersioner{ok: true, target: schema.GroupVersionKind{Kind: "TestType5", Group: "custom", Version: "v1"}},
+			out: &runtimetesting.ExternalTestType1{
+				MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{APIVersion: "custom/v1", ObjectKind: "TestType5"},
+				A:                                     "test",
+			},
+		},
+	}
+	for i, test := range testCases {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			original := test.in.DeepCopyObject()
+			out, err := test.scheme.ConvertToVersion(test.in, test.gv)
+			switch {
+			case test.errFn != nil:
+				if !test.errFn(err) {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				return
+			case err != nil:
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if out == test.in {
+				t.Fatalf("ConvertToVersion should always copy out: %#v", out)
+			}
+
+			if test.same {
+				if !reflect.DeepEqual(original, test.in) {
+					t.Fatalf("unexpected mutation of input: %s", cmp.Diff(original, test.in))
+				}
+				if !reflect.DeepEqual(out, test.out) {
+					t.Fatalf("unexpected out: %s", cmp.Diff(out, test.out))
+				}
+				unsafe, err := test.scheme.UnsafeConvertToVersion(test.in, test.gv)
+				if err != nil {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				if !reflect.DeepEqual(unsafe, test.out) {
+					t.Fatalf("unexpected unsafe: %s", cmp.Diff(unsafe, test.out))
+				}
+				if unsafe != test.in {
+					t.Fatalf("UnsafeConvertToVersion should return same object: %#v", unsafe)
+				}
+				return
+			}
+			if !reflect.DeepEqual(out, test.out) {
+				t.Fatalf("unexpected out: %s", cmp.Diff(out, test.out))
+			}
+		})
+	}
+}
+
+func TestConvert(t *testing.T) {
+	testCases := []struct {
+		scheme *runtime.Scheme
+		in     runtime.Object
+		into   runtime.Object
+		gv     runtime.GroupVersioner
+		out    runtime.Object
+		errFn  func(error) bool
+	}{
+		// converts from internal to unstructured, given a target version
+		{
+			scheme: GetTestScheme(),
+			in:     &runtimetesting.TestType1{A: "test"},
+			into:   &runtimetesting.Unstructured{},
+			out: &runtimetesting.Unstructured{Object: map[string]interface{}{
+				"myVersionKey": "custom/v1",
+				"myKindKey":    "TestType3",
+				"A":            "test",
+			}},
+			gv: schema.GroupVersion{Group: "custom", Version: "v1"},
+		},
+	}
+	for i, test := range testCases {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			err := test.scheme.Convert(test.in, test.into, test.gv)
+			switch {
+			case test.errFn != nil:
+				if !test.errFn(err) {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				return
+			case err != nil:
+				t.Fatalf("unexpected error: %v", err)
+				return
+			}
+
+			if !reflect.DeepEqual(test.into, test.out) {
+				t.Fatalf("unexpected out: %s", cmp.Diff(test.into, test.out))
+			}
+		})
+	}
+}
+
+func TestMetaValues(t *testing.T) {
+	internalGV := schema.GroupVersion{Group: "test.group", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "test.group", Version: "externalVersion"}
+
+	s := runtime.NewScheme()
+	s.AddKnownTypeWithName(internalGV.WithKind("Simple"), &runtimetesting.InternalSimple{})
+	s.AddKnownTypeWithName(externalGV.WithKind("Simple"), &runtimetesting.ExternalSimple{})
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+
+	conversions := &testConversions{
+		internalToExternalCalls: 0,
+		externalToInternalCalls: 0,
+	}
+
+	// Register functions to verify that scope.Meta() gets set correctly.
+	utilruntime.Must(conversions.registerConversions(s))
+
+	simple := &runtimetesting.InternalSimple{
+		TestString: "foo",
+	}
+
+	out, err := s.ConvertToVersion(simple, externalGV)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	internal, err := s.ConvertToVersion(out, internalGV)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if e, a := simple, internal; !reflect.DeepEqual(e, a) {
+		t.Errorf("Expected:\n %#v,\n Got:\n %#v", e, a)
+	}
+
+	if e, a := 1, conversions.internalToExternalCalls; e != a {
+		t.Errorf("Expected %v, got %v", e, a)
+	}
+	if e, a := 1, conversions.externalToInternalCalls; e != a {
+		t.Errorf("Expected %v, got %v", e, a)
+	}
+}
+
+func TestMetaValuesUnregisteredConvert(t *testing.T) {
+	type InternalSimple struct {
+		Version    string `json:"apiVersion,omitempty"`
+		Kind       string `json:"kind,omitempty"`
+		TestString string `json:"testString"`
+	}
+	type ExternalSimple struct {
+		Version    string `json:"apiVersion,omitempty"`
+		Kind       string `json:"kind,omitempty"`
+		TestString string `json:"testString"`
+	}
+	s := runtime.NewScheme()
+	// We deliberately don't register the types.
+
+	internalToExternalCalls := 0
+
+	// Register functions to verify that scope.Meta() gets set correctly.
+	convertSimple := func(in *InternalSimple, out *ExternalSimple, scope conversion.Scope) error {
+		out.TestString = in.TestString
+		internalToExternalCalls++
+		return nil
+	}
+	if err := s.AddConversionFunc((*InternalSimple)(nil), (*ExternalSimple)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertSimple(a.(*InternalSimple), b.(*ExternalSimple), scope)
+	}); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	simple := &InternalSimple{TestString: "foo"}
+	external := &ExternalSimple{}
+	if err := s.Convert(simple, external, nil); err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	if e, a := simple.TestString, external.TestString; e != a {
+		t.Errorf("Expected %v, got %v", e, a)
+	}
+
+	// Verify that our conversion handler got called.
+	if e, a := 1, internalToExternalCalls; e != a {
+		t.Errorf("Expected %v, got %v", e, a)
+	}
+}
+
+func TestRegisterValidate(t *testing.T) {
+	invalidValue := field.Invalid(field.NewPath("testString"), "", "Invalid value").WithOrigin("invalid-value")
+	invalidLength := field.Invalid(field.NewPath("testString"), "", "Invalid length").WithOrigin("invalid-length")
+	invalidStatusErr := field.Invalid(field.NewPath("testString"), "", "Invalid condition").WithOrigin("invalid-condition")
+	invalidIfOptionErr := field.Invalid(field.NewPath("testString"), "", "Invalid when option is set").WithOrigin("invalid-when-option-set")
+
+	testCases := []struct {
+		name        string
+		object      runtime.Object
+		oldObject   runtime.Object
+		subresource []string
+		options     map[string]bool
+		expected    field.ErrorList
+	}{
+		{
+			name:     "single error",
+			object:   &TestType1{},
+			options:  map[string]bool{"option1": false},
+			expected: field.ErrorList{invalidValue},
+		},
+		{
+			name:     "multiple errors",
+			object:   &TestType2{},
+			expected: field.ErrorList{invalidValue, invalidLength},
+		},
+		{
+			name:      "update error",
+			object:    &TestType2{},
+			oldObject: &TestType2{},
+			expected:  field.ErrorList{invalidLength},
+		},
+		{
+			name:     "options error",
+			object:   &TestType1{},
+			options:  map[string]bool{"option1": true},
+			expected: field.ErrorList{invalidIfOptionErr},
+		},
+		{
+			name:        "subresource error",
+			object:      &TestType1{},
+			subresource: []string{"status"},
+			options:     map[string]bool{"option1": false},
+			expected:    field.ErrorList{invalidStatusErr},
+		},
+	}
+
+	s := runtime.NewScheme()
+	ctx := context.Background()
+
+	// register multiple types for testing to ensure registration is working as expected
+	s.AddValidationFunc(&TestType1{}, func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList {
+		if enabled, exists := op.HasOption("option1"); enabled || !exists {
+			return field.ErrorList{invalidIfOptionErr}
+		}
+		if slices.Equal(op.Request.Subresources, []string{"status"}) {
+			return field.ErrorList{invalidStatusErr}
+		}
+		return field.ErrorList{invalidValue}
+	})
+
+	s.AddValidationFunc(&TestType2{}, func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList {
+		if oldObject != nil {
+			return field.ErrorList{invalidLength}
+		}
+		return field.ErrorList{invalidValue, invalidLength}
+	})
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			var results field.ErrorList
+			if tc.oldObject == nil {
+				results = s.Validate(ctx, tc.options, tc.object, tc.subresource...)
+			} else {
+				results = s.ValidateUpdate(ctx, tc.options, tc.object, tc.oldObject, tc.subresource...)
+			}
+			matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+			matcher.Test(t, tc.expected, results)
+		})
+	}
+}
+
+type TestType1 struct {
+	Version    string `json:"apiVersion,omitempty"`
+	Kind       string `json:"kind,omitempty"`
+	TestString string `json:"testString"`
+}
+
+func (TestType1) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+func (TestType1) DeepCopyObject() runtime.Object { return nil }
+
+type TestType2 struct {
+	Version    string `json:"apiVersion,omitempty"`
+	Kind       string `json:"kind,omitempty"`
+	TestString string `json:"testString"`
+}
+
+func (TestType2) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+func (TestType2) DeepCopyObject() runtime.Object { return nil }
+
+func TestToOpenAPIDefinitionName(t *testing.T) {
+	testCases := []struct {
+		name        string
+		registerGvk *schema.GroupVersionKind // defaults to gvk unless set
+		registerObj runtime.Object
+		gvk         schema.GroupVersionKind
+		out         string
+		wantErr     error
+	}{
+		{
+			name:        "unstructured type",
+			registerObj: &unstructured.Unstructured{},
+			gvk:         schema.GroupVersionKind{Group: "stable.example.com", Version: "v1", Kind: "CronTab"},
+			out:         "com.example.stable.v1.CronTab",
+		},
+		{
+			name:        "unregistered type: empty group",
+			registerObj: &unstructured.Unstructured{},
+			gvk:         schema.GroupVersionKind{Version: "v1", Kind: "CronTab"},
+			wantErr:     fmt.Errorf("unable to convert GroupVersionKind with empty fields to unstructured type to an OpenAPI definition name: %v", schema.GroupVersionKind{Version: "v1", Kind: "CronTab"}),
+		},
+		{
+			name:        "unregistered type: empty version",
+			registerObj: &unstructured.Unstructured{},
+			registerGvk: &schema.GroupVersionKind{Group: "stable.example.com", Version: "v1", Kind: "CronTab"},
+			gvk:         schema.GroupVersionKind{Group: "stable.example.com", Kind: "CronTab"},
+			wantErr:     fmt.Errorf("version is required on all types: %v", schema.GroupVersionKind{Group: "stable.example.com", Kind: "CronTab"}),
+		},
+		{
+			name:        "unregistered type: empty kind",
+			registerObj: &unstructured.Unstructured{},
+			gvk:         schema.GroupVersionKind{Group: "stable.example.com", Version: "v1"},
+			wantErr:     fmt.Errorf("unable to convert GroupVersionKind with empty fields to unstructured type to an OpenAPI definition name: %v", schema.GroupVersionKind{Group: "stable.example.com", Version: "v1"}),
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.name, func(t *testing.T) {
+			if test.registerGvk == nil {
+				test.registerGvk = &test.gvk
+			}
+
+			scheme := runtime.NewScheme()
+			scheme.AddKnownTypeWithName(*test.registerGvk, test.registerObj)
+			utilruntime.Must(runtimetesting.RegisterConversions(scheme))
+
+			out, err := scheme.ToOpenAPIDefinitionName(test.gvk)
+			if test.wantErr != nil {
+				if err == nil || err.Error() != test.wantErr.Error() {
+					t.Errorf("expected error: %v but got %v", test.wantErr, err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if out != test.out {
+				t.Errorf("expected %s, got %s", test.out, out)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor.go
new file mode 100644
index 0000000000..e5730e3c50
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor.go
@@ -0,0 +1,402 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cbor
+
+import (
+	"bytes"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+	"k8s.io/apimachinery/pkg/runtime/serializer/recognizer"
+	util "k8s.io/apimachinery/pkg/util/runtime"
+
+	"github.com/fxamacker/cbor/v2"
+)
+
+type metaFactory interface {
+	// Interpret should return the version and kind of the wire-format of the object.
+	Interpret(data []byte) (*schema.GroupVersionKind, error)
+}
+
+type defaultMetaFactory struct{}
+
+func (mf *defaultMetaFactory) Interpret(data []byte) (*schema.GroupVersionKind, error) {
+	var tm metav1.TypeMeta
+	// The input is expected to include additional map keys besides apiVersion and kind, so use
+	// lax mode for decoding into TypeMeta.
+	if err := modes.DecodeLax.Unmarshal(data, &tm); err != nil {
+		return nil, fmt.Errorf("unable to determine group/version/kind: %w", err)
+	}
+	actual := tm.GetObjectKind().GroupVersionKind()
+	return &actual, nil
+}
+
+type Serializer interface {
+	runtime.Serializer
+	runtime.NondeterministicEncoder
+	recognizer.RecognizingDecoder
+
+	// NewSerializer returns a value of this interface type rather than exporting the serializer
+	// type and returning one of those because the zero value of serializer isn't ready to
+	// use. Users aren't intended to implement cbor.Serializer themselves, and this unexported
+	// interface method is here to prevent that (https://go.dev/blog/module-compatibility).
+	private()
+}
+
+var _ Serializer = &serializer{}
+
+type options struct {
+	strict                       bool
+	transcode                    bool
+	streamingCollectionsEncoding bool
+}
+
+type Option func(*options)
+
+// Strict configures a serializer to return a strict decoding error when it encounters map keys that
+// do not correspond to a field in the target object of a decode operation. This option is disabled
+// by default.
+func Strict(s bool) Option {
+	return func(opts *options) {
+		opts.strict = s
+	}
+}
+
+// Transcode configures a serializer to transcode the "raw" bytes of a decoded runtime.RawExtension
+// or metav1.FieldsV1 object to JSON. This is enabled by default to support existing programs that
+// depend on the assumption that objects of either type contain valid JSON.
+func Transcode(s bool) Option {
+	return func(opts *options) {
+		opts.transcode = s
+	}
+}
+
+// StreamingCollectionsEncoding is used for testing purposes only.
+func StreamingCollectionsEncoding(s bool) Option {
+	return func(opts *options) {
+		opts.streamingCollectionsEncoding = s
+	}
+}
+
+type serializer struct {
+	metaFactory metaFactory
+	creater     runtime.ObjectCreater
+	typer       runtime.ObjectTyper
+	options     options
+}
+
+func (serializer) private() {}
+
+// NewSerializer creates and returns a serializer configured with the provided options. The default
+// options are equivalent to explicitly passing Strict(false) and Transcode(true).
+func NewSerializer(creater runtime.ObjectCreater, typer runtime.ObjectTyper, options ...Option) Serializer {
+	return newSerializer(&defaultMetaFactory{}, creater, typer, options...)
+}
+
+func newSerializer(metaFactory metaFactory, creater runtime.ObjectCreater, typer runtime.ObjectTyper, options ...Option) *serializer {
+	s := &serializer{
+		metaFactory: metaFactory,
+		creater:     creater,
+		typer:       typer,
+	}
+	s.options.transcode = true
+	s.options.streamingCollectionsEncoding = true
+	for _, o := range options {
+		o(&s.options)
+	}
+	return s
+}
+
+func (s *serializer) Identifier() runtime.Identifier {
+	return "cbor"
+}
+
+// Encode writes a CBOR representation of the given object.
+//
+// Because the CBOR data item written by a call to Encode is always enclosed in the "self-described
+// CBOR" tag, its encoded form always has the prefix 0xd9d9f7. This prefix is suitable for use as a
+// "magic number" for distinguishing encoded CBOR from other protocols.
+//
+// The default serialization behavior for any given object replicates the behavior of the JSON
+// serializer as far as it is necessary to allow the CBOR serializer to be used as a drop-in
+// replacement for the JSON serializer, with limited exceptions. For example, the distinction
+// between integers and floating-point numbers is preserved in CBOR due to its distinct
+// representations for each type.
+//
+// Objects implementing runtime.Unstructured will have their unstructured content encoded rather
+// than following the default behavior for their dynamic type.
+func (s *serializer) Encode(obj runtime.Object, w io.Writer) error {
+	return s.encode(modes.Encode, obj, w)
+}
+
+func (s *serializer) EncodeNondeterministic(obj runtime.Object, w io.Writer) error {
+	return s.encode(modes.EncodeNondeterministic, obj, w)
+}
+
+func (s *serializer) encode(mode modes.EncMode, obj runtime.Object, w io.Writer) error {
+	if _, err := w.Write(selfDescribedCBOR); err != nil {
+		return err
+	}
+
+	if s.options.streamingCollectionsEncoding {
+		ok, err := streamEncodeCollections(obj, w, mode)
+		if err != nil {
+			return err
+		}
+		if ok {
+			return nil
+		}
+	}
+
+	var v interface{} = obj
+	if u, ok := obj.(runtime.Unstructured); ok {
+		v = u.UnstructuredContent()
+	}
+
+	return mode.MarshalTo(v, w)
+}
+
+// gvkWithDefaults returns group kind and version defaulting from provided default
+func gvkWithDefaults(actual, defaultGVK schema.GroupVersionKind) schema.GroupVersionKind {
+	if len(actual.Kind) == 0 {
+		actual.Kind = defaultGVK.Kind
+	}
+	if len(actual.Version) == 0 && len(actual.Group) == 0 {
+		actual.Group = defaultGVK.Group
+		actual.Version = defaultGVK.Version
+	}
+	if len(actual.Version) == 0 && actual.Group == defaultGVK.Group {
+		actual.Version = defaultGVK.Version
+	}
+	return actual
+}
+
+// diagnose returns the diagnostic encoding of a well-formed CBOR data item.
+func diagnose(data []byte) string {
+	diag, err := modes.Diagnostic.Diagnose(data)
+	if err != nil {
+		// Since the input must already be well-formed CBOR, converting it to diagnostic
+		// notation should not fail.
+		util.HandleError(err)
+
+		return hex.EncodeToString(data)
+	}
+	return diag
+}
+
+// unmarshal unmarshals CBOR data from the provided byte slice into a Go object. If the decoder is
+// configured to report strict errors, the first error return value may be a non-nil strict decoding
+// error. If the last error return value is non-nil, then the unmarshal failed entirely and the
+// state of the destination object should not be relied on.
+func (s *serializer) unmarshal(data []byte, into interface{}) (strict, lax error) {
+	if u, ok := into.(runtime.Unstructured); ok {
+		var content map[string]interface{}
+		defer func() {
+			switch u := u.(type) {
+			case *unstructured.UnstructuredList:
+				// UnstructuredList's implementation of SetUnstructuredContent
+				// produces different objects than those produced by a decode using
+				// UnstructuredJSONScheme:
+				//
+				//   1. SetUnstructuredContent retains the "items" key in the list's
+				//      Object field. It is omitted from Object when decoding with
+				//      UnstructuredJSONScheme.
+				//   2. SetUnstructuredContent does not populate "apiVersion" and
+				//      "kind" on each entry of its Items
+				//      field. UnstructuredJSONScheme does, inferring the singular
+				//      Kind from the list Kind.
+				//   3. SetUnstructuredContent ignores entries of "items" that are
+				//      not JSON objects or are objects without
+				//      "kind". UnstructuredJSONScheme returns an error in either
+				//      case.
+				//
+				// UnstructuredJSONScheme's behavior is replicated here.
+				var items []interface{}
+				if uncast, present := content["items"]; present {
+					var cast bool
+					items, cast = uncast.([]interface{})
+					if !cast {
+						strict, lax = nil, fmt.Errorf("items field of UnstructuredList must be encoded as an array or null if present")
+						return
+					}
+				}
+				apiVersion, _ := content["apiVersion"].(string)
+				kind, _ := content["kind"].(string)
+				kind = strings.TrimSuffix(kind, "List")
+				var unstructureds []unstructured.Unstructured
+				if len(items) > 0 {
+					unstructureds = make([]unstructured.Unstructured, len(items))
+				}
+				for i := range items {
+					object, cast := items[i].(map[string]interface{})
+					if !cast {
+						strict, lax = nil, fmt.Errorf("elements of the items field of UnstructuredList must be encoded as a map")
+						return
+					}
+
+					// As in UnstructuredJSONScheme, only set the heuristic
+					// singular GVK when both "apiVersion" and "kind" are either
+					// missing, non-string, or empty.
+					object["apiVersion"], _ = object["apiVersion"].(string)
+					object["kind"], _ = object["kind"].(string)
+					if object["apiVersion"] == "" && object["kind"] == "" {
+						object["apiVersion"] = apiVersion
+						object["kind"] = kind
+					}
+
+					if object["kind"] == "" {
+						strict, lax = nil, runtime.NewMissingKindErr(diagnose(data))
+						return
+					}
+					if object["apiVersion"] == "" {
+						strict, lax = nil, runtime.NewMissingVersionErr(diagnose(data))
+						return
+					}
+
+					unstructureds[i].Object = object
+				}
+				delete(content, "items")
+				u.Object = content
+				u.Items = unstructureds
+			default:
+				u.SetUnstructuredContent(content)
+			}
+		}()
+		into = &content
+	}
+
+	if !s.options.strict {
+		return nil, modes.DecodeLax.Unmarshal(data, into)
+	}
+
+	err := modes.Decode.Unmarshal(data, into)
+	// TODO: UnknownFieldError is ambiguous. It only provides the index of the first problematic
+	// map entry encountered and does not indicate which map the index refers to.
+	var unknownField *cbor.UnknownFieldError
+	if errors.As(err, &unknownField) {
+		// Unlike JSON, there are no strict errors in CBOR for duplicate map keys. CBOR maps
+		// with duplicate keys are considered invalid according to the spec and are rejected
+		// entirely.
+		return runtime.NewStrictDecodingError([]error{unknownField}), modes.DecodeLax.Unmarshal(data, into)
+	}
+	return nil, err
+}
+
+func (s *serializer) Decode(data []byte, gvk *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	// A preliminary pass over the input to obtain the actual GVK is redundant on a successful
+	// decode into Unstructured.
+	if _, ok := into.(runtime.Unstructured); ok {
+		if _, unmarshalErr := s.unmarshal(data, into); unmarshalErr != nil {
+			actual, interpretErr := s.metaFactory.Interpret(data)
+			if interpretErr != nil {
+				return nil, nil, interpretErr
+			}
+
+			if gvk != nil {
+				*actual = gvkWithDefaults(*actual, *gvk)
+			}
+
+			return nil, actual, unmarshalErr
+		}
+
+		actual := into.GetObjectKind().GroupVersionKind()
+		if len(actual.Kind) == 0 {
+			return nil, &actual, runtime.NewMissingKindErr(diagnose(data))
+		}
+		if len(actual.Version) == 0 {
+			return nil, &actual, runtime.NewMissingVersionErr(diagnose(data))
+		}
+
+		return into, &actual, nil
+	}
+
+	actual, err := s.metaFactory.Interpret(data)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if gvk != nil {
+		*actual = gvkWithDefaults(*actual, *gvk)
+	}
+
+	if into != nil {
+		types, _, err := s.typer.ObjectKinds(into)
+		if err != nil {
+			return nil, actual, err
+		}
+		*actual = gvkWithDefaults(*actual, types[0])
+	}
+
+	if len(actual.Kind) == 0 {
+		return nil, actual, runtime.NewMissingKindErr(diagnose(data))
+	}
+	if len(actual.Version) == 0 {
+		return nil, actual, runtime.NewMissingVersionErr(diagnose(data))
+	}
+
+	obj, err := runtime.UseOrCreateObject(s.typer, s.creater, *actual, into)
+	if err != nil {
+		return nil, actual, err
+	}
+
+	strict, err := s.unmarshal(data, obj)
+	if err != nil {
+		return nil, actual, err
+	}
+
+	if s.options.transcode {
+		if err := transcodeRawTypes(obj); err != nil {
+			return nil, actual, err
+		}
+	}
+
+	return obj, actual, strict
+}
+
+// selfDescribedCBOR is the CBOR encoding of the head of tag number 55799. This tag, specified in
+// RFC 8949 Section 3.4.6 "Self-Described CBOR", encloses all output from the encoder, has no
+// special semantics, and is used as a magic number to recognize CBOR-encoded data items.
+//
+// See https://www.rfc-editor.org/rfc/rfc8949.html#name-self-described-cbor.
+var selfDescribedCBOR = []byte{0xd9, 0xd9, 0xf7}
+
+func (s *serializer) RecognizesData(data []byte) (ok, unknown bool, err error) {
+	return bytes.HasPrefix(data, selfDescribedCBOR), false, nil
+}
+
+// NewSerializerInfo returns a default SerializerInfo for CBOR using the given creater and typer.
+func NewSerializerInfo(creater runtime.ObjectCreater, typer runtime.ObjectTyper) runtime.SerializerInfo {
+	return runtime.SerializerInfo{
+		MediaType:        "application/cbor",
+		MediaTypeType:    "application",
+		MediaTypeSubType: "cbor",
+		Serializer:       NewSerializer(creater, typer),
+		StrictSerializer: NewSerializer(creater, typer, Strict(true)),
+		StreamSerializer: &runtime.StreamSerializerInfo{
+			Framer:     NewFramer(),
+			Serializer: NewSerializer(creater, typer, Transcode(false)),
+		},
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor_test.go
new file mode 100644
index 0000000000..dcb59130c0
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor_test.go
@@ -0,0 +1,874 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// The tests in this package focus on the correctness of its implementation of
+// runtime.Serializer. The specific behavior of marshaling Go values to CBOR bytes and back is
+// tested in the ./internal/modes package, which is used both by the Serializer implementation and
+// the package-scoped Marshal/Unmarshal functions in the ./direct package.
+package cbor
+
+import (
+	"bytes"
+	"encoding/hex"
+	"errors"
+	"io"
+	"reflect"
+	"strconv"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestRecognizesData(t *testing.T) {
+	for _, tc := range []struct {
+		in         []byte
+		recognizes bool
+	}{
+		{
+			in:         nil,
+			recognizes: false,
+		},
+		{
+			in:         []byte{},
+			recognizes: false,
+		},
+		{
+			in:         []byte{0xd9},
+			recognizes: false,
+		},
+		{
+			in:         []byte{0xd9, 0xd9},
+			recognizes: false,
+		},
+		{
+			in:         []byte{0xd9, 0xd9, 0xf7},
+			recognizes: true,
+		},
+		{
+			in:         []byte{0xff, 0xff, 0xff},
+			recognizes: false,
+		},
+		{
+			in:         []byte{0xd9, 0xd9, 0xf7, 0x01, 0x02, 0x03},
+			recognizes: true,
+		},
+		{
+			in:         []byte{0xff, 0xff, 0xff, 0x01, 0x02, 0x03},
+			recognizes: false,
+		},
+	} {
+		t.Run(hex.EncodeToString(tc.in), func(t *testing.T) {
+			s := NewSerializer(nil, nil)
+			recognizes, unknown, err := s.RecognizesData(tc.in)
+			if recognizes != tc.recognizes {
+				t.Errorf("expected recognized to be %t, got %t", tc.recognizes, recognizes)
+			}
+			if unknown {
+				t.Error("expected unknown to be false, got true")
+			}
+			if err != nil {
+				t.Errorf("expected nil error, got: %v", err)
+			}
+		})
+	}
+}
+
+type stubWriter struct {
+	n   int
+	err error
+}
+
+func (w stubWriter) Write([]byte) (int, error) {
+	return w.n, w.err
+}
+
+// anyObject wraps arbitrary concrete values to be encoded or decoded.
+type anyObject struct {
+	Value interface{}
+}
+
+func (p anyObject) GetObjectKind() schema.ObjectKind {
+	return schema.EmptyObjectKind
+}
+
+func (anyObject) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+func (p anyObject) MarshalCBOR() ([]byte, error) {
+	return modes.Encode.Marshal(p.Value)
+}
+
+func (p *anyObject) UnmarshalCBOR(in []byte) error {
+	return modes.Decode.Unmarshal(in, &p.Value)
+}
+
+type structWithRawFields struct {
+	FieldsV1            metav1.FieldsV1       `json:"f"`
+	FieldsV1Pointer     *metav1.FieldsV1      `json:"fp"`
+	RawExtension        runtime.RawExtension  `json:"r"`
+	RawExtensionPointer *runtime.RawExtension `json:"rp"`
+}
+
+func (structWithRawFields) GetObjectKind() schema.ObjectKind {
+	return schema.EmptyObjectKind
+}
+
+func (structWithRawFields) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+type structWithEmbeddedMetas struct {
+	metav1.TypeMeta   `json:""`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+}
+
+func (structWithEmbeddedMetas) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+func TestEncode(t *testing.T) {
+	for _, tc := range []struct {
+		name           string
+		in             runtime.Object
+		assertOnWriter func() (io.Writer, func(*testing.T))
+		assertOnError  func(*testing.T, error)
+	}{
+		{
+			name: "io error writing self described cbor tag",
+			assertOnWriter: func() (io.Writer, func(*testing.T)) {
+				return stubWriter{err: io.ErrShortWrite}, func(*testing.T) {}
+			},
+			assertOnError: func(t *testing.T, err error) {
+				if !errors.Is(err, io.ErrShortWrite) {
+					t.Errorf("expected io.ErrShortWrite, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "output enclosed by self-described CBOR tag",
+			in:   anyObject{},
+			assertOnWriter: func() (io.Writer, func(*testing.T)) {
+				var b bytes.Buffer
+				return &b, func(t *testing.T) {
+					if !bytes.HasPrefix(b.Bytes(), []byte{0xd9, 0xd9, 0xf7}) {
+						t.Errorf("expected output to have prefix 0xd9d9f7: 0x%x", b.Bytes())
+					}
+				}
+			},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "unstructuredlist",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"apiVersion": "v",
+					"kind":       "kList",
+				},
+				Items: []unstructured.Unstructured{
+					{Object: map[string]interface{}{"foo": int64(1)}},
+					{Object: map[string]interface{}{"foo": int64(2)}},
+				},
+			},
+			assertOnWriter: func() (io.Writer, func(t *testing.T)) {
+				var b bytes.Buffer
+				return &b, func(t *testing.T) {
+					// {'kind': 'kList', 'items': [{'foo': 1}, {'foo': 2}], 'apiVersion': 'v'}
+					if diff := cmp.Diff(b.Bytes(), []byte("\xd9\xd9\xf7\xa3\x44kind\x45kList\x45items\x82\xa1\x43foo\x01\xa1\x43foo\x02\x4aapiVersion\x41v")); diff != "" {
+						t.Errorf("unexpected diff:\n%s", diff)
+					}
+				}
+			},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "text marshaler",
+			in:   &textMarshalerObject{},
+			assertOnWriter: func() (io.Writer, func(*testing.T)) {
+				var b bytes.Buffer
+				return &b, func(t *testing.T) {
+					if diff := cmp.Diff(b.Bytes(), []byte{0xd9, 0xd9, 0xf7, 0x64, 't', 'e', 's', 't'}); diff != "" {
+						t.Errorf("unexpected diff:\n%s", diff)
+					}
+				}
+			},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "text marshaler within unstructured content",
+			in: &unstructured.Unstructured{
+				Object: map[string]interface{}{"": textMarshalerObject{}},
+			},
+			assertOnWriter: func() (io.Writer, func(*testing.T)) {
+				var b bytes.Buffer
+				return &b, func(t *testing.T) {
+					if diff := cmp.Diff(b.Bytes(), []byte{0xd9, 0xd9, 0xf7, 0xa1, 0x40, 0x64, 't', 'e', 's', 't'}); diff != "" {
+						t.Errorf("unexpected diff:\n%s", diff)
+					}
+				}
+			},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			s := NewSerializer(nil, nil)
+			w, assertOnWriter := tc.assertOnWriter()
+			err := s.Encode(tc.in, w)
+			tc.assertOnError(t, err)
+			assertOnWriter(t)
+		})
+	}
+}
+
+func TestDecode(t *testing.T) {
+	for _, tc := range []struct {
+		name          string
+		options       []Option
+		data          []byte
+		gvk           *schema.GroupVersionKind
+		metaFactory   metaFactory
+		typer         runtime.ObjectTyper
+		creater       runtime.ObjectCreater
+		into          runtime.Object
+		expectedObj   runtime.Object
+		expectedGVK   *schema.GroupVersionKind
+		assertOnError func(*testing.T, error)
+	}{
+		{
+			name:        "self-described cbor tag accepted",
+			data:        []byte("\xd9\xd9\xf7\xa3\x4aapiVersion\x41v\x44kind\x41k\x48metadata\xa1\x44name\x43foo"), // 55799({'apiVersion': 'v', 'kind': 'k', 'metadata': {'name': 'foo'}})
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: &defaultMetaFactory{},
+			typer:       stubTyper{gvks: []schema.GroupVersionKind{{Version: "v", Kind: "k"}}},
+			into:        &metav1.PartialObjectMetadata{},
+			expectedObj: &metav1.PartialObjectMetadata{
+				TypeMeta:   metav1.TypeMeta{APIVersion: "v", Kind: "k"},
+				ObjectMeta: metav1.ObjectMeta{Name: "foo"},
+			},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "k"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "error determining gvk",
+			metaFactory: stubMetaFactory{err: errors.New("test")},
+			assertOnError: func(t *testing.T, err error) {
+				if err == nil || err.Error() != "test" {
+					t.Errorf("expected error \"test\", got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "typer does not recognize into",
+			gvk:         &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       notRegisteredTyper{},
+			into:        &anyObject{},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsNotRegisteredError(err) {
+					t.Errorf("expected NotRegisteredError, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "gvk from type of into",
+			data:        []byte{0xf6},
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       stubTyper{gvks: []schema.GroupVersionKind{{Group: "x", Version: "y", Kind: "z"}}},
+			into:        &anyObject{},
+			expectedObj: &anyObject{},
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "raw types transcoded",
+			data:        []byte{0xa4, 0x41, 'f', 0xa1, 0x41, 'a', 0x01, 0x42, 'f', 'p', 0xa1, 0x41, 'z', 0x02, 0x41, 'r', 0xa1, 0x41, 'b', 0x03, 0x42, 'r', 'p', 0xa1, 0x41, 'y', 0x04},
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       stubTyper{gvks: []schema.GroupVersionKind{{Group: "x", Version: "y", Kind: "z"}}},
+			into:        &structWithRawFields{},
+			expectedObj: &structWithRawFields{
+				FieldsV1:            *metav1.NewFieldsV1(`{"a":1}`),
+				FieldsV1Pointer:     metav1.NewFieldsV1(`{"z":2}`),
+				RawExtension:        runtime.RawExtension{Raw: []byte(`{"b":3}`)},
+				RawExtensionPointer: &runtime.RawExtension{Raw: []byte(`{"y":4}`)},
+			},
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "raw types not transcoded",
+			options:     []Option{Transcode(false)},
+			data:        []byte{0xa4, 0x41, 'f', 0xa1, 0x41, 'a', 0x01, 0x42, 'f', 'p', 0xa1, 0x41, 'z', 0x02, 0x41, 'r', 0xa1, 0x41, 'b', 0x03, 0x42, 'r', 'p', 0xa1, 0x41, 'y', 0x04},
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       stubTyper{gvks: []schema.GroupVersionKind{{Group: "x", Version: "y", Kind: "z"}}},
+			into:        &structWithRawFields{},
+			expectedObj: &structWithRawFields{
+				FieldsV1:        *metav1.NewFieldsV1(string([]byte{0xa1, 0x41, 'a', 0x01})),
+				FieldsV1Pointer: metav1.NewFieldsV1(string([]byte{0xa1, 0x41, 'z', 0x02})),
+				// RawExtension's UnmarshalCBOR ensures the self-described CBOR tag
+				// is present in the result so that there is never any ambiguity in
+				// distinguishing CBOR from JSON or Protobuf. It is unnecessary for
+				// FieldsV1 to do the same because the initial byte is always
+				// sufficient to distinguish a valid JSON-encoded FieldsV1 from a
+				// valid CBOR-encoded FieldsV1.
+				RawExtension:        runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0xa1, 0x41, 'b', 0x03}},
+				RawExtensionPointer: &runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0xa1, 0x41, 'y', 0x04}},
+			},
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "object with embedded typemeta and objectmeta",
+			data:        []byte("\xa2\x48metadata\xa1\x44name\x43foo\x44spec\xa0"), // {"metadata": {"name": "foo"}}
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       stubTyper{gvks: []schema.GroupVersionKind{{Group: "x", Version: "y", Kind: "z"}}},
+			into:        &structWithEmbeddedMetas{},
+			expectedObj: &structWithEmbeddedMetas{
+				ObjectMeta: metav1.ObjectMeta{Name: "foo"},
+			},
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "strict mode strict error",
+			options:     []Option{Strict(true)},
+			data:        []byte{0xa1, 0x61, 'z', 0x01}, // {'z': 1}
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       stubTyper{gvks: []schema.GroupVersionKind{{Group: "x", Version: "y", Kind: "z"}}},
+			into:        &metav1.PartialObjectMetadata{},
+			expectedObj: &metav1.PartialObjectMetadata{},
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsStrictDecodingError(err) {
+					t.Errorf("expected StrictDecodingError, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "no strict mode no strict error",
+			data:        []byte{0xa1, 0x61, 'z', 0x01}, // {'z': 1}
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       stubTyper{gvks: []schema.GroupVersionKind{{Group: "x", Version: "y", Kind: "z"}}},
+			into:        &metav1.PartialObjectMetadata{},
+			expectedObj: &metav1.PartialObjectMetadata{},
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "unknown error from typer on into",
+			gvk:         &schema.GroupVersionKind{},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			typer:       stubTyper{err: errors.New("test")},
+			into:        &anyObject{},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{},
+			assertOnError: func(t *testing.T, err error) {
+				if err == nil || err.Error() != "test" {
+					t.Errorf("expected error \"test\", got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "missing kind",
+			gvk:         &schema.GroupVersionKind{Version: "v"},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Version: "v"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingKind(err) {
+					t.Errorf("expected MissingKind, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "missing version",
+			gvk:         &schema.GroupVersionKind{Kind: "k"},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Kind: "k"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingVersion(err) {
+					t.Errorf("expected MissingVersion, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "creater error",
+			gvk:         &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			creater:     stubCreater{err: errors.New("test")},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if err == nil || err.Error() != "test" {
+					t.Errorf("expected error \"test\", got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "unmarshal error",
+			data:        nil, // EOF
+			gvk:         &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			creater:     stubCreater{obj: &anyObject{}},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if !errors.Is(err, io.EOF) {
+					t.Errorf("expected EOF, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "strict mode unmarshal error",
+			options:     []Option{Strict(true)},
+			data:        nil, // EOF
+			gvk:         &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			creater:     stubCreater{obj: &anyObject{}},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if !errors.Is(err, io.EOF) {
+					t.Errorf("expected EOF, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "into unstructured unmarshal error",
+			data:        nil, // EOF
+			gvk:         &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
+			into:        &unstructured.Unstructured{},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Group: "x", Version: "y", Kind: "z"},
+			assertOnError: func(t *testing.T, err error) {
+				if !errors.Is(err, io.EOF) {
+					t.Errorf("expected EOF, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "into unstructured missing kind",
+			data:        []byte("\xa1\x6aapiVersion\x61v"),
+			into:        &unstructured.Unstructured{},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Version: "v"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingKind(err) {
+					t.Errorf("expected MissingKind, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "into unstructured missing version",
+			data:        []byte("\xa1\x64kind\x61k"),
+			into:        &unstructured.Unstructured{},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Kind: "k"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingVersion(err) {
+					t.Errorf("expected MissingVersion, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "into unstructured",
+			data: []byte("\xa2\x6aapiVersion\x61v\x64kind\x61k"),
+			into: &unstructured.Unstructured{},
+			expectedObj: &unstructured.Unstructured{Object: map[string]interface{}{
+				"apiVersion": "v",
+				"kind":       "k",
+			}},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "k"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "using unstructured creater",
+			data:        []byte("\xa2\x6aapiVersion\x61v\x64kind\x61k"),
+			metaFactory: &defaultMetaFactory{},
+			creater:     stubCreater{obj: &unstructured.Unstructured{}},
+			expectedObj: &unstructured.Unstructured{Object: map[string]interface{}{
+				"apiVersion": "v",
+				"kind":       "k",
+			}},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "k"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "into unstructuredlist missing kind",
+			data:        []byte("\xa1\x6aapiVersion\x61v"),
+			into:        &unstructured.UnstructuredList{},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Version: "v"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingKind(err) {
+					t.Errorf("expected MissingKind, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "into unstructuredlist missing version",
+			data:        []byte("\xa1\x64kind\x65kList"),
+			into:        &unstructured.UnstructuredList{},
+			expectedObj: nil,
+			expectedGVK: &schema.GroupVersionKind{Kind: "kList"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingVersion(err) {
+					t.Errorf("expected MissingVersion, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "into unstructuredlist empty",
+			data: []byte("\xa2\x6aapiVersion\x61v\x64kind\x65kList"),
+			into: &unstructured.UnstructuredList{},
+			expectedObj: &unstructured.UnstructuredList{Object: map[string]interface{}{
+				"apiVersion": "v",
+				"kind":       "kList",
+			}},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "kList"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "into unstructuredlist nonempty",
+			data: []byte("\xa3\x6aapiVersion\x61v\x64kind\x65kList\x65items\x82\xa1\x63foo\x01\xa1\x63foo\x02"), // {"apiVersion": "v", "kind": "kList", "items": [{"foo": 1}, {"foo": 2}]}
+			into: &unstructured.UnstructuredList{},
+			expectedObj: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"apiVersion": "v",
+					"kind":       "kList",
+				},
+				Items: []unstructured.Unstructured{
+					{Object: map[string]interface{}{"apiVersion": "v", "kind": "k", "foo": int64(1)}},
+					{Object: map[string]interface{}{"apiVersion": "v", "kind": "k", "foo": int64(2)}},
+				},
+			},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "kList"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name: "into unstructuredlist item gvk present",
+			data: []byte("\xa3\x6aapiVersion\x61v\x64kind\x65kList\x65items\x81\xa2\x6aapiVersion\x62vv\x64kind\x62kk"), // {"apiVersion": "v", "kind": "kList", "items": [{"apiVersion": "vv", "kind": "kk"}]}
+			into: &unstructured.UnstructuredList{},
+			expectedObj: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"apiVersion": "v",
+					"kind":       "kList",
+				},
+				Items: []unstructured.Unstructured{
+					{Object: map[string]interface{}{"apiVersion": "vv", "kind": "kk"}},
+				},
+			},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "kList"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "into unstructuredlist item missing kind",
+			data:        []byte("\xa3\x6aapiVersion\x61v\x64kind\x65kList\x65items\x81\xa1\x6aapiVersion\x62vv"), // {"apiVersion": "v", "kind": "kList", "items": [{"apiVersion": "vv"}]}
+			metaFactory: &defaultMetaFactory{},
+			into:        &unstructured.UnstructuredList{},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "kList"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingKind(err) {
+					t.Errorf("expected MissingVersion, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "into unstructuredlist item missing version",
+			data:        []byte("\xa3\x6aapiVersion\x61v\x64kind\x65kList\x65items\x81\xa1\x64kind\x62kk"), // {"apiVersion": "v", "kind": "kList", "items": [{"kind": "kk"}]}
+			metaFactory: &defaultMetaFactory{},
+			into:        &unstructured.UnstructuredList{},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "kList"},
+			assertOnError: func(t *testing.T, err error) {
+				if !runtime.IsMissingVersion(err) {
+					t.Errorf("expected MissingVersion, got: %v", err)
+				}
+			},
+		},
+		{
+			name:        "using unstructuredlist creater",
+			data:        []byte("\xa2\x6aapiVersion\x61v\x64kind\x65kList"),
+			metaFactory: &defaultMetaFactory{},
+			creater:     stubCreater{obj: &unstructured.UnstructuredList{}},
+			expectedObj: &unstructured.UnstructuredList{Object: map[string]interface{}{
+				"apiVersion": "v",
+				"kind":       "kList",
+			}},
+			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "kList"},
+			assertOnError: func(t *testing.T, err error) {
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
+				}
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			s := newSerializer(tc.metaFactory, tc.creater, tc.typer, tc.options...)
+
+			actualObj, actualGVK, err := s.Decode(tc.data, tc.gvk, tc.into)
+			tc.assertOnError(t, err)
+
+			if !reflect.DeepEqual(tc.expectedObj, actualObj) {
+				t.Error(cmp.Diff(tc.expectedObj, actualObj))
+			}
+
+			if diff := cmp.Diff(tc.expectedGVK, actualGVK); diff != "" {
+				t.Error(diff)
+			}
+		})
+	}
+}
+
+type textMarshalerObject struct{}
+
+func (p textMarshalerObject) GetObjectKind() schema.ObjectKind {
+	return schema.EmptyObjectKind
+}
+
+func (textMarshalerObject) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+func (textMarshalerObject) MarshalText() ([]byte, error) {
+	return []byte("test"), nil
+}
+
+func TestMetaFactoryInterpret(t *testing.T) {
+	mf := &defaultMetaFactory{}
+	_, err := mf.Interpret(nil)
+	if err == nil {
+		t.Error("expected non-nil error")
+	}
+	gvk, err := mf.Interpret([]byte("\xa2\x6aapiVersion\x63a/b\x64kind\x61c"))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if diff := cmp.Diff(&schema.GroupVersionKind{Group: "a", Version: "b", Kind: "c"}, gvk); diff != "" {
+		t.Error(diff)
+	}
+}
+
+type stubTyper struct {
+	gvks        []schema.GroupVersionKind
+	unversioned bool
+	err         error
+}
+
+func (t stubTyper) ObjectKinds(obj runtime.Object) ([]schema.GroupVersionKind, bool, error) {
+	return t.gvks, t.unversioned, t.err
+}
+
+func (stubTyper) Recognizes(schema.GroupVersionKind) bool {
+	return false
+}
+
+type stubCreater struct {
+	obj runtime.Object
+	err error
+}
+
+func (c stubCreater) New(gvk schema.GroupVersionKind) (runtime.Object, error) {
+	return c.obj, c.err
+}
+
+type notRegisteredTyper struct{}
+
+func (notRegisteredTyper) ObjectKinds(obj runtime.Object) ([]schema.GroupVersionKind, bool, error) {
+	return nil, false, runtime.NewNotRegisteredErrForType("test", reflect.TypeOf(obj))
+}
+
+func (notRegisteredTyper) Recognizes(schema.GroupVersionKind) bool {
+	return false
+}
+
+type stubMetaFactory struct {
+	gvk *schema.GroupVersionKind
+	err error
+}
+
+func (mf stubMetaFactory) Interpret([]byte) (*schema.GroupVersionKind, error) {
+	return mf.gvk, mf.err
+}
+
+type oneMapField struct {
+	metav1.TypeMeta `json:""`
+	Map             map[string]interface{} `json:"map"`
+}
+
+func (o oneMapField) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+func (o oneMapField) GetObjectKind() schema.ObjectKind {
+	panic("unimplemented")
+}
+
+type eightStringFields struct {
+	metav1.TypeMeta `json:""`
+	A               string `json:"1"`
+	B               string `json:"2"`
+	C               string `json:"3"`
+	D               string `json:"4"`
+	E               string `json:"5"`
+	F               string `json:"6"`
+	G               string `json:"7"`
+	H               string `json:"8"`
+}
+
+func (o eightStringFields) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+func (o eightStringFields) GetObjectKind() schema.ObjectKind {
+	panic("unimplemented")
+}
+
+// TestEncodeNondeterministic tests that repeated encodings of multi-field structs and maps do not
+// encode to precisely the same bytes when repeatedly encoded with EncodeNondeterministic. When
+// using EncodeNondeterministic, the order of items in CBOR maps should be intentionally shuffled to
+// prevent applications from inadvertently depending on encoding determinism. All permutations do
+// not necessarily have equal probability.
+func TestEncodeNondeterministic(t *testing.T) {
+	for _, tc := range []struct {
+		name  string
+		input runtime.Object
+	}{
+		{
+			name: "map",
+			input: func() runtime.Object {
+				m := map[string]interface{}{}
+				for i := 1; i <= 8; i++ {
+					m[strconv.Itoa(i)] = strconv.Itoa(i)
+
+				}
+				return oneMapField{Map: m}
+			}(),
+		},
+		{
+			name: "struct",
+			input: eightStringFields{
+				TypeMeta: metav1.TypeMeta{},
+				A:        "1",
+				B:        "2",
+				C:        "3",
+				D:        "4",
+				E:        "5",
+				F:        "6",
+				G:        "7",
+				H:        "8",
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var b bytes.Buffer
+			e := NewSerializer(nil, nil)
+
+			if err := e.EncodeNondeterministic(tc.input, &b); err != nil {
+				t.Fatal(err)
+			}
+			first := b.String()
+
+			const Trials = 128
+			for trial := 0; trial < Trials; trial++ {
+				b.Reset()
+				if err := e.EncodeNondeterministic(tc.input, &b); err != nil {
+					t.Fatal(err)
+				}
+
+				if !bytes.Equal([]byte(first), b.Bytes()) {
+					return
+				}
+			}
+			t.Fatalf("nondeterministic encode produced the same bytes on %d consecutive calls: %s", Trials, first)
+		})
+	}
+
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections.go
new file mode 100644
index 0000000000..5aa0fb7ca4
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections.go
@@ -0,0 +1,328 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cbor
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"maps"
+	"math/rand"
+	"reflect"
+	"slices"
+	"sort"
+
+	"k8s.io/apimachinery/pkg/conversion"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+
+	"github.com/fxamacker/cbor/v2"
+)
+
+func streamEncodeCollections(obj runtime.Object, w io.Writer, mode modes.EncMode) (bool, error) {
+	list, ok := obj.(*unstructured.UnstructuredList)
+	if ok {
+		return true, streamingEncodeUnstructuredList(w, list, mode)
+	}
+	if _, ok := obj.(cbor.Marshaler); ok {
+		return false, nil
+	}
+	if _, ok := obj.(json.Marshaler); ok {
+		return false, nil
+	}
+	typeMeta, listMeta, items, err := getListMeta(obj)
+	if err == nil {
+		return true, streamingEncodeList(w, typeMeta, listMeta, items, mode)
+	}
+	return false, nil
+}
+
+// getListMeta implements list extraction logic for cbor stream serialization.
+func getListMeta(list runtime.Object) (metav1.TypeMeta, metav1.ListMeta, []interface{}, error) {
+	listValue, err := conversion.EnforcePtr(list)
+	if err != nil {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, err
+	}
+	listType := listValue.Type()
+	if listType.NumField() != 3 {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected ListType to have 3 fields")
+	}
+	// The streaming encoder reproduces the field names and layout implied by the
+	// json struct tags (kind, apiVersion, metadata, items). The CBOR encoder,
+	// however, gives a "cbor" struct tag precedence over "json", so a cbor tag on
+	// any of these fields could rename a key, change its options (e.g. keyasint),
+	// or un-inline the embedded TypeMeta -- diverging from the streamed output.
+	// Refuse to stream such a type and fall back to the general encoder, which
+	// honors the cbor tag correctly.
+	for i := 0; i < listType.NumField(); i++ {
+		if _, ok := listType.Field(i).Tag.Lookup("cbor"); ok {
+			return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected list field %d to have no cbor tag", i)
+		}
+	}
+	// TypeMeta
+	typeMeta, ok := listValue.Field(0).Interface().(metav1.TypeMeta)
+	if !ok {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected TypeMeta field to have TypeMeta type")
+	}
+	if !listType.Field(0).Anonymous {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be embedded`)
+	}
+	if jsonTag, jsonTagExists := listType.Field(0).Tag.Lookup("json"); !jsonTagExists {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag`)
+	} else if jsonTag != "" && jsonTag != ",inline" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be "" or ",inline"`)
+	}
+	// ListMeta
+	listMeta, ok := listValue.Field(1).Interface().(metav1.ListMeta)
+	if !ok {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected ListMeta field to have ListMeta type")
+	}
+	if listType.Field(1).Tag.Get("json") != "metadata,omitempty" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected ListMeta json field tag to be "metadata,omitempty"`)
+	}
+	// Items
+	if listType.Field(2).Tag.Get("json") != "items" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected Items json field tag to be "items"`)
+	}
+	items, err := getListItems(listValue.Field(2))
+	if err != nil {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, err
+	}
+	return typeMeta, listMeta, items, nil
+}
+
+// getListItems returns the elements of a list's Items field as addressable
+// values. Marshaling each element directly (rather than routing through
+// meta.ExtractList) preserves the element's own type and custom marshaler, so
+// that e.g. a metav1.List whose Items are runtime.RawExtension holding CBOR
+// bytes are encoded verbatim by runtime.RawExtension.MarshalCBOR instead of
+// being flattened into a runtime.Unknown (which has no MarshalCBOR and would be
+// misencoded as a struct or fail JSON transcoding).
+//
+// A nil Items slice returns a nil result, distinct from an empty non-nil slice,
+// so the encoder can emit CBOR null rather than an empty array.
+func getListItems(itemsValue reflect.Value) ([]interface{}, error) {
+	if itemsValue.Kind() != reflect.Slice {
+		return nil, fmt.Errorf("expected Items field to be a slice, got %s", itemsValue.Kind())
+	}
+	if itemsValue.IsNil() {
+		return nil, nil
+	}
+	items := make([]interface{}, itemsValue.Len())
+	for i := range items {
+		items[i] = itemsValue.Index(i).Addr().Interface()
+	}
+	return items, nil
+}
+
+type cborMapEntry struct {
+	key   string
+	write func() error
+}
+
+func streamingEncodeList(w io.Writer, typeMeta metav1.TypeMeta, listMeta metav1.ListMeta, items []interface{}, mode modes.EncMode) error {
+	var entries []cborMapEntry
+
+	if typeMeta.Kind != "" {
+		entries = append(entries, cborMapEntry{
+			key: "kind",
+			write: func() error {
+				return encodeKeyValuePair(w, "kind", typeMeta.Kind, mode)
+			},
+		})
+	}
+	entries = append(entries, cborMapEntry{
+		key: "items",
+		write: func() error {
+			if err := mode.MarshalTo("items", w); err != nil {
+				return err
+			}
+			if items == nil {
+				_, err := w.Write([]byte{0xf6}) // CBOR null
+				return err
+			}
+			if err := writeArrayHead(w, len(items)); err != nil {
+				return err
+			}
+			for _, item := range items {
+				if err := mode.MarshalTo(item, w); err != nil {
+					return err
+				}
+			}
+			return nil
+		},
+	})
+	entries = append(entries, cborMapEntry{
+		key: "metadata",
+		write: func() error {
+			return encodeKeyValuePair(w, "metadata", listMeta, mode)
+		},
+	})
+	if typeMeta.APIVersion != "" {
+		entries = append(entries, cborMapEntry{
+			key: "apiVersion",
+			write: func() error {
+				return encodeKeyValuePair(w, "apiVersion", typeMeta.APIVersion, mode)
+			},
+		})
+	}
+
+	// entries is built in a fixed order (kind, items, metadata, apiVersion).
+	// Unlike streamingEncodeUnstructuredList, whose keys come in Go's randomized
+	// map-iteration order, there is no inherent randomness here, so for
+	// nondeterministic modes (SortFastShuffle) we rotate the encoding for-loop
+	// by a random initial offset.
+	start := 0
+	if !mode.IsDeterministic() && len(entries) > 0 {
+		start = rand.Intn(len(entries))
+	}
+
+	if err := writeMapHead(w, len(entries)); err != nil {
+		return err
+	}
+
+	for i := 0; i < len(entries); i++ {
+		entry := entries[(start+i)%len(entries)]
+		if err := entry.write(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func streamingEncodeUnstructuredList(w io.Writer, list *unstructured.UnstructuredList, mode modes.EncMode) error {
+	keys := slices.Collect(maps.Keys(list.Object))
+	if _, exists := list.Object["items"]; !exists {
+		keys = append(keys, "items")
+	}
+	// keys starts in Go's randomized map-iteration order. For deterministic
+	// modes (SortBytewiseLexical) we sort it: shorter lengths come first, then
+	// lexicographic by content. For nondeterministic modes (SortFastShuffle) we
+	// leave the map-iteration order as-is, which already varies from call to
+	// call (analogous to what SortFastShuffle does for structs), so no explicit
+	// shuffling is needed.
+	if mode.IsDeterministic() {
+		sort.Slice(keys, func(i, j int) bool {
+			if len(keys[i]) != len(keys[j]) {
+				return len(keys[i]) < len(keys[j])
+			}
+			return keys[i] < keys[j]
+		})
+	}
+
+	if err := writeMapHead(w, len(keys)); err != nil {
+		return err
+	}
+
+	for _, key := range keys {
+		if err := mode.MarshalTo(key, w); err != nil {
+			return err
+		}
+		if key == "items" {
+			if err := writeArrayHead(w, len(list.Items)); err != nil {
+				return err
+			}
+			for _, item := range list.Items {
+				if err := mode.MarshalTo(item.Object, w); err != nil {
+					return err
+				}
+			}
+		} else {
+			if err := mode.MarshalTo(list.Object[key], w); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func encodeKeyValuePair(w io.Writer, key string, value interface{}, mode modes.EncMode) error {
+	if err := mode.MarshalTo(key, w); err != nil {
+		return err
+	}
+	if err := mode.MarshalTo(value, w); err != nil {
+		return err
+	}
+	return nil
+}
+
+// CBOR major type prefix bytes (the type in the high 3 bits, additional info
+// zeroed), following RFC 8949 Section 3.1.
+const (
+	cborTypeArray byte = 0x80 // major type 4
+	cborTypeMap   byte = 0xa0 // major type 5
+)
+
+// writeMapHead writes a CBOR map header for a map with n entries.
+func writeMapHead(w io.Writer, n int) error {
+	return writeCollectionHead(w, cborTypeMap, int64(n))
+}
+
+// writeArrayHead writes a CBOR array header for an array with n elements.
+func writeArrayHead(w io.Writer, n int) error {
+	return writeCollectionHead(w, cborTypeArray, int64(n))
+}
+
+// writeCollectionHead writes a CBOR collection (array or map) header encoding
+// the number of elements n, following RFC 8949 Section 3 additional info rules:
+//
+//   - base: the prefix byte for the collection type.
+//     For maps: cborTypeMap (0xa0), for arrays: cborTypeArray (0x80).
+//
+// The extended form prefixes are derived from base using bitwise OR:
+//   - base|24: 1-byte length follows (additional info 24)
+//   - base|25: 2-byte length follows (additional info 25)
+//   - base|26: 4-byte length follows (additional info 26)
+//   - base|27: 8-byte length follows (additional info 27)
+//
+// Encoding table (map example, base=0xa0):
+//
+//	n <= 23:         1 byte  — 0xa0|n
+//	n <= 0xFF:        2 bytes — 0xb8 (0xa0|24), n
+//	n <= 0xFFFF:      3 bytes — 0xb9 (0xa0|25), n>>8, n
+//	n <= 0xFFFFFFFF:  5 bytes — 0xba (0xa0|26), n>>24..n
+//	n > 0xFFFFFFFF:   9 bytes — 0xbb (0xa0|27), n>>56..n
+func writeCollectionHead(w io.Writer, base byte, n int64) error {
+	switch {
+	case n <= 23:
+		// Additional info 0–23: length is encoded directly in the low 5 bits.
+		_, err := w.Write([]byte{base + byte(n)})
+		return err
+	case n <= 0xFF:
+		// Additional info 24: one additional byte carries the length.
+		_, err := w.Write([]byte{base | 24, byte(n)})
+		return err
+	case n <= 0xFFFF:
+		// Additional info 25: two additional bytes carry the length (big-endian).
+		_, err := w.Write([]byte{base | 25, byte(n >> 8), byte(n)})
+		return err
+	case n <= 0xFFFFFFFF:
+		// Additional info 26: four additional bytes carry the length (big-endian).
+		_, err := w.Write([]byte{base | 26, byte(n >> 24), byte(n >> 16), byte(n >> 8), byte(n)})
+		return err
+	default:
+		// Additional info 27: eight additional bytes carry the length (big-endian).
+		_, err := w.Write([]byte{
+			base | 27, byte(n >> 56), byte(n >> 48), byte(n >> 40), byte(n >> 32), byte(n >> 24), byte(n >> 16),
+			byte(n >> 8), byte(n),
+		})
+		return err
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections_test.go
new file mode 100644
index 0000000000..9b205f58e8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections_test.go
@@ -0,0 +1,1316 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cbor
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"sigs.k8s.io/randfill"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	testapigroupv1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+)
+
+// TestStreamingCollectionsEncoding verifies that streaming encoding produces
+// output identical to normal non-streaming encoding, and that the streaming
+// encoder actually uses multiple Write calls (not just buffering everything).
+func TestStreamingCollectionsEncoding(t *testing.T) {
+	var buf writeCountingBuffer
+	var remainingItems int64 = 1
+	for _, tc := range []struct {
+		name         string
+		in           runtime.Object
+		cannotStream bool
+	}{
+		// Preserving the distinction between integers and floating-point numbers
+		{
+			name: "Struct with floats",
+			in: &StructWithFloatsList{
+				Items: []StructWithFloats{
+					{
+						Int:     1,
+						Float32: float32(1),
+						Float64: 1.1,
+					},
+				},
+			},
+		},
+		{
+			name: "Unstructured object float",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"int":     1,
+					"float32": float32(1),
+					"float64": 1.1,
+				},
+			},
+		},
+		{
+			name: "Unstructured items float",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"int":     1,
+							"float32": float32(1),
+							"float64": 1.1,
+						},
+					},
+				},
+			},
+		},
+		// Handling structs with duplicate field names (JSON tag names) without producing duplicate keys in the encoded output
+		{
+			name: "StructWithDuplicatedTags",
+			in: &StructWithDuplicatedTagsList{
+				Items: []StructWithDuplicatedTags{
+					{
+						Key1: "key1",
+						Key2: "key2",
+					},
+				},
+			},
+		},
+		// Encoding Go strings containing invalid UTF-8 sequences without error
+		{
+			name: "UnstructuredList object invalid UTF-8",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"key": "\x80", // first byte is a continuation byte
+				},
+			},
+		},
+		{
+			name: "UnstructuredList items invalid UTF-8",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"key": "\x80",
+						},
+					},
+				},
+			},
+		},
+		// Preserving the distinction between absent, present-but-null, and present-and-empty states for slices and maps
+		{
+			name: "CarpList items nil",
+			in: &testapigroupv1.CarpList{
+				Items: nil,
+			},
+		},
+		{
+			name: "CarpList slice nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: nil,
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "CarpList map nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: nil,
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList items nil",
+			in: &unstructured.UnstructuredList{
+				Items: nil,
+			},
+		},
+		{
+			name: "UnstructuredList items slice nil",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"slice": ([]string)(nil),
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList items map nil",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"map": (map[string]string)(nil),
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList object nil",
+			in: &unstructured.UnstructuredList{
+				Object: nil,
+			},
+		},
+		{
+			name: "UnstructuredList object slice nil",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"slice": ([]string)(nil),
+				},
+			},
+		},
+		{
+			name: "UnstructuredList object map nil",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"map": (map[string]string)(nil),
+				},
+			},
+		},
+		{
+			name: "CarpList items empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{},
+			},
+		},
+		{
+			name: "CarpList slice empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: []testapigroupv1.CarpCondition{},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "CarpList map empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: map[string]string{},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList items empty",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{},
+			},
+		},
+		{
+			name: "UnstructuredList items slice empty",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"slice": []string{},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList items map empty",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"map": map[string]string{},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList object empty",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{},
+			},
+		},
+		{
+			name: "UnstructuredList object slice empty",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"slice": []string{},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList object map empty",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"map": map[string]string{},
+				},
+			},
+		},
+		// Handling structs implementing json.Marshaler method
+		{
+			name:         "List with json.Marshaler cannot be streamed",
+			in:           &ListWithMarshalJSONList{},
+			cannotStream: true,
+		},
+		{
+			name: "Struct with json.Marshaler",
+			in: &StructWithMarshalJSONList{
+				Items: []StructWithMarshalJSON{
+					{},
+				},
+			},
+		},
+		// Handling structs implementing cbor.Marshaler but NOT json.Marshaler
+		{
+			name:         "List with cbor.Marshaler cannot be streamed",
+			in:           &ListWithMarshalCBORList{},
+			cannotStream: true,
+		},
+		{
+			name: "Struct with cbor.Marshaler",
+			in: &StructWithMarshalCBORList{
+				Items: []StructWithMarshalCBOR{
+					{},
+				},
+			},
+		},
+		// Handling structs implementing both json.Marshaler and cbor.Marshaler
+		{
+			name:         "List with json.Marshaler and cbor.Marshaler cannot be streamed",
+			in:           &ListWithBothMarshalersList{},
+			cannotStream: true,
+		},
+		{
+			name: "Struct with json.Marshaler and cbor.Marshaler",
+			in: &StructWithBothMarshalersList{
+				Items: []StructWithBothMarshalers{
+					{},
+				},
+			},
+		},
+		// Handling raw bytes.
+		{
+			name: "Struct with raw bytes",
+			in: &StructWithRawBytesList{
+				Items: []StructWithRawBytes{
+					{
+						Slice: []byte{0x01, 0x02, 0x03},
+						Array: [3]byte{0x01, 0x02, 0x03},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList object raw bytes",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"slice": []byte{0x01, 0x02, 0x03},
+					"array": [3]byte{0x01, 0x02, 0x03},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList items raw bytes",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"slice": []byte{0x01, 0x02, 0x03},
+							"array": [3]byte{0x01, 0x02, 0x03},
+						},
+					},
+				},
+			},
+		},
+		// Other scenarios:
+		{
+			name: "List just kind",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind: "List",
+				},
+			},
+		},
+		{
+			name: "List just apiVersion",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "v1",
+				},
+			},
+		},
+		{
+			name: "List no elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{},
+			},
+		},
+		{
+			name: "List one element with continue",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion:    "2345",
+					Continue:           "abc",
+					RemainingItemCount: &remainingItems,
+				},
+				Items: []testapigroupv1.Carp{
+					{
+						TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+							Name:      "pod",
+							Namespace: "default",
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "List two elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{
+					{
+						TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+							Name:      "pod",
+							Namespace: "default",
+						},
+					},
+					{
+						TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+							Name:      "pod2",
+							Namespace: "default2",
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "List with extra field cannot be streamed",
+			in: &ListWithAdditionalFields{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{},
+			},
+			cannotStream: true,
+		},
+		{
+			// A cbor struct tag takes precedence over json in the CBOR encoder, so
+			// the streaming encoder (which follows the json tags) must not claim
+			// this type; it falls back to the general encoder, which renames the
+			// items key to "elements".
+			name: "List with cbor tag cannot be streamed",
+			in: &ListWithCBORTagList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				Items: []testapigroupv1.Carp{
+					{ObjectMeta: metav1.ObjectMeta{Name: "pod"}},
+				},
+			},
+			cannotStream: true,
+		},
+		{
+			name: "Not a collection cannot be streamed",
+			in: &testapigroupv1.Carp{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+			},
+			cannotStream: true,
+		},
+		{
+			name: "UnstructuredList empty",
+			in:   &unstructured.UnstructuredList{},
+		},
+		{
+			name: "UnstructuredList just kind",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"kind": "List"},
+			},
+		},
+		{
+			name: "UnstructuredList just apiVersion",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"apiVersion": "v1"},
+			},
+		},
+		{
+			name: "UnstructuredList no elements",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"kind": "List", "apiVersion": "v1", "metadata": map[string]interface{}{"resourceVersion": "2345"},
+				},
+				Items: []unstructured.Unstructured{},
+			},
+		},
+		{
+			name: "UnstructuredList one element with continue",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"kind": "List", "apiVersion": "v1", "metadata": map[string]interface{}{
+						"resourceVersion":    "2345",
+						"continue":           "abc",
+						"remainingItemCount": "1",
+					},
+				},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "Carp",
+							"metadata": map[string]interface{}{
+								"name":      "pod",
+								"namespace": "default",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList two elements",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"kind": "List", "apiVersion": "v1", "metadata": map[string]interface{}{
+						"resourceVersion": "2345",
+					},
+				},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "Carp",
+							"metadata": map[string]interface{}{
+								"name":      "pod",
+								"namespace": "default",
+							},
+						},
+					},
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "Carp",
+							"metadata": map[string]interface{}{
+								"name":      "pod2",
+								"namespace": "default",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList conflict on items",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"items": []unstructured.Unstructured{
+						{
+							Object: map[string]interface{}{
+								"name": "pod",
+							},
+						},
+					},
+				},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"name": "pod2",
+						},
+					},
+				},
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			buf.Reset()
+			s := NewSerializer(nil, nil, StreamingCollectionsEncoding(true))
+			if err := s.Encode(tc.in, &buf); err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			var normalBuf bytes.Buffer
+			normalS := NewSerializer(nil, nil, StreamingCollectionsEncoding(false))
+			if err := normalS.Encode(tc.in, &normalBuf); err != nil {
+				t.Fatalf("normal encode error: %v", err)
+			}
+
+			if diff := cmp.Diff(buf.Bytes(), normalBuf.Bytes()); diff != "" {
+				t.Errorf("streaming and normal encoding differ:\n%s", diff)
+			}
+
+			expectStreaming := !tc.cannotStream
+			if expectStreaming && buf.writeCount <= 2 {
+				t.Errorf("expected streaming but Write was called only: %d", buf.writeCount)
+			}
+			if !expectStreaming && buf.writeCount > 2 {
+				t.Errorf("expected non-streaming but Write was called more than once: %d", buf.writeCount)
+			}
+		})
+	}
+}
+
+type StructWithFloatsList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithFloats `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *StructWithFloatsList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithFloats struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	Int     int
+	Float32 float32
+	Float64 float64
+}
+
+func (s *StructWithFloats) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithDuplicatedTagsList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithDuplicatedTags `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *StructWithDuplicatedTagsList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithDuplicatedTags struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	Key1 string `json:"key"`
+	Key2 string `json:"key"` //nolint:govet
+}
+
+func (s *StructWithDuplicatedTags) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type ListWithMarshalJSONList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []string `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *ListWithMarshalJSONList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *ListWithMarshalJSONList) MarshalJSON() ([]byte, error) {
+	return []byte(`"marshallJSON"`), nil
+}
+
+type StructWithMarshalJSONList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithMarshalJSON `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *StructWithMarshalJSONList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithMarshalJSON struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+}
+
+func (l *StructWithMarshalJSON) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *StructWithMarshalJSON) MarshalJSON() ([]byte, error) {
+	return []byte(`"marshallJSON"`), nil
+}
+
+type ListWithMarshalCBORList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []string `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *ListWithMarshalCBORList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *ListWithMarshalCBORList) MarshalCBOR() ([]byte, error) {
+	return []byte("\x6bmarshalCBOR"), nil
+}
+
+type StructWithMarshalCBORList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithMarshalCBOR `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *StructWithMarshalCBORList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithMarshalCBOR struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+}
+
+func (l *StructWithMarshalCBOR) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *StructWithMarshalCBOR) MarshalCBOR() ([]byte, error) {
+	return []byte("\x6bmarshalCBOR"), nil
+}
+
+type ListWithBothMarshalersList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []string `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *ListWithBothMarshalersList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *ListWithBothMarshalersList) MarshalJSON() ([]byte, error) {
+	return []byte(`"marshalJSON"`), nil
+}
+
+func (l *ListWithBothMarshalersList) MarshalCBOR() ([]byte, error) {
+	return []byte("\x6bmarshalCBOR"), nil
+}
+
+type StructWithBothMarshalersList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithBothMarshalers `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *StructWithBothMarshalersList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithBothMarshalers struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+}
+
+func (l *StructWithBothMarshalers) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *StructWithBothMarshalers) MarshalJSON() ([]byte, error) {
+	return []byte(`"marshalJSON"`), nil
+}
+
+func (l *StructWithBothMarshalers) MarshalCBOR() ([]byte, error) {
+	return []byte("\x6bmarshalCBOR"), nil
+}
+
+type StructWithRawBytesList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithRawBytes `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *StructWithRawBytesList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithRawBytes struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Slice             []byte
+	Array             [3]byte
+}
+
+func (s *StructWithRawBytes) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type ListWithAdditionalFields struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []testapigroupv1.Carp `json:"items" protobuf:"bytes,2,rep,name=items"`
+	AdditionalField int
+}
+
+func (s *ListWithAdditionalFields) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+// ListWithCBORTagList has a valid json-tagged shape but a cbor struct tag on
+// Items that renames its key. Because the CBOR encoder prefers the cbor tag over
+// json, getListMeta must refuse to stream this type.
+type ListWithCBORTagList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []testapigroupv1.Carp `json:"items" cbor:"elements" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *ListWithCBORTagList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type writeCountingBuffer struct {
+	writeCount int
+	bytes.Buffer
+}
+
+func (b *writeCountingBuffer) Write(data []byte) (int, error) {
+	b.writeCount++
+	return b.Buffer.Write(data)
+}
+
+func (b *writeCountingBuffer) Reset() {
+	b.writeCount = 0
+	b.Buffer.Reset()
+}
+
+func TestFuzzCollectionsEncoding(t *testing.T) {
+	disableFuzzFieldsV1 := func(field *metav1.FieldsV1, c randfill.Continue) {}
+	fuzzUnstructuredList := func(list *unstructured.UnstructuredList, c randfill.Continue) {
+		list.Object = map[string]interface{}{
+			"kind":       "List",
+			"apiVersion": "v1",
+			c.String(0):  c.String(0),
+			c.String(0):  int64(c.Intn(1000000)), // Limit to int64 range
+			c.String(0):  c.Bool(),
+			"metadata": map[string]interface{}{
+				"resourceVersion":    fmt.Sprintf("%d", c.Intn(1000000)), // String format
+				"continue":           c.String(0),
+				"remainingItemCount": fmt.Sprintf("%d", c.Intn(1000000)), // String format
+				c.String(0):          c.String(0),
+			},
+		}
+		c.Fill(&list.Items)
+	}
+	fuzzMap := func(kvs map[string]interface{}, c randfill.Continue) {
+		kvs[c.String(0)] = c.Bool()
+		kvs[c.String(0)] = int64(c.Intn(1000000)) // Limit to int64 range
+		kvs[c.String(0)] = c.String(0)
+	}
+	f := randfill.New().Funcs(disableFuzzFieldsV1, fuzzUnstructuredList, fuzzMap)
+	streamingSerializer := NewSerializer(nil, nil)
+	normalSerializer := NewSerializer(nil, nil, StreamingCollectionsEncoding(false))
+
+	for _, tc := range []struct {
+		name   string
+		newObj func() runtime.Object
+	}{
+		{name: "CarpList", newObj: func() runtime.Object { return &testapigroupv1.CarpList{} }},
+		{name: "UnstructuredList", newObj: func() runtime.Object { return &unstructured.UnstructuredList{} }},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var streamingBuf writeCountingBuffer
+			var normalBuf, ndetBuf bytes.Buffer
+			for i := range 1000 {
+				obj := tc.newObj()
+				f.Fill(obj)
+
+				// Non-streaming, deterministic encode as the reference for all comparisons.
+				normalBuf.Reset()
+				if err := normalSerializer.Encode(obj, &normalBuf); err != nil {
+					t.Fatalf("trial %d: normal encode error: %v", i, err)
+				}
+
+				// Streaming deterministic encode must match the reference byte-for-byte.
+				streamingBuf.Reset()
+				if err := streamingSerializer.Encode(obj, &streamingBuf); err != nil {
+					t.Fatalf("trial %d: streaming encode error: %v", i, err)
+				}
+				if diff := cmp.Diff(normalBuf.Bytes(), streamingBuf.Bytes()); diff != "" {
+					t.Logf("normal:    %x", normalBuf.Bytes())
+					t.Logf("streaming: %x", streamingBuf.Bytes())
+					t.Fatalf("trial %d: streaming and non-streaming differ:\n%s", i, diff)
+				}
+				if streamingBuf.writeCount <= 2 {
+					t.Errorf("trial %d: expected streaming encoding to use more than 2 writes, got %d", i, streamingBuf.writeCount)
+				}
+
+				// Streaming nondeterministic encode must decode to the same value.
+				ndetBuf.Reset()
+				if err := streamingSerializer.EncodeNondeterministic(obj, &ndetBuf); err != nil {
+					t.Fatalf("trial %d: nondeterministic encode error: %v", i, err)
+				}
+
+				var detObj, ndetObj interface{}
+				if err := modes.Decode.Unmarshal(normalBuf.Bytes(), &detObj); err != nil {
+					t.Fatalf("trial %d: decode deterministic: %v", i, err)
+				}
+				if err := modes.Decode.Unmarshal(ndetBuf.Bytes(), &ndetObj); err != nil {
+					t.Fatalf("trial %d: decode nondeterministic: %v", i, err)
+				}
+				if diff := cmp.Diff(detObj, ndetObj); diff != "" {
+					t.Errorf("trial %d: semantic mismatch between deterministic and nondeterministic:\n%s", i, diff)
+				}
+
+				detTyped := reflect.New(reflect.TypeOf(obj).Elem()).Interface()
+				ndetTyped := reflect.New(reflect.TypeOf(obj).Elem()).Interface()
+				if err := modes.Decode.Unmarshal(normalBuf.Bytes(), detTyped); err != nil {
+					t.Fatalf("trial %d: decode deterministic into %T: %v", i, obj, err)
+				}
+				if err := modes.Decode.Unmarshal(ndetBuf.Bytes(), ndetTyped); err != nil {
+					t.Fatalf("trial %d: decode nondeterministic into %T: %v", i, obj, err)
+				}
+				if !apiequality.Semantic.DeepEqual(detTyped, ndetTyped) {
+					t.Errorf("trial %d: typed %T mismatch between deterministic and nondeterministic encodings", i, obj)
+				}
+			}
+		})
+	}
+}
+
+// mustCBORSelfDescribed encodes v to CBOR and prepends the self-described CBOR
+// tag (0xd9d9f7), matching how runtime.RawExtension stores CBOR-content bytes.
+func mustCBORSelfDescribed(t *testing.T, v interface{}) []byte {
+	t.Helper()
+	data, err := modes.Encode.Marshal(v)
+	if err != nil {
+		t.Fatalf("failed to marshal %#v to CBOR: %v", v, err)
+	}
+	return append([]byte{0xd9, 0xd9, 0xf7}, data...)
+}
+
+// TestStreamEncodeListRawExtension is a regression test for streaming encoding of
+// a metav1.List whose Items are runtime.RawExtension. Streaming encoding must be
+// byte-identical to non-streaming encoding, and must round-trip.
+//
+// Previously the streaming path routed items through meta.ExtractList, which
+// flattens a RawExtension holding raw bytes into a runtime.Unknown (dropping its
+// content type). runtime.Unknown implements MarshalJSON but not MarshalCBOR, so
+// CBOR-content bytes were either misencoded as a struct or, worse, failed while
+// the encoder attempted to transcode them from JSON. The streaming path now
+// marshals each RawExtension directly, honoring runtime.RawExtension.MarshalCBOR.
+func TestStreamEncodeListRawExtension(t *testing.T) {
+	streamingSerializer := NewSerializer(nil, nil)
+	normalSerializer := NewSerializer(nil, nil, StreamingCollectionsEncoding(false))
+
+	for _, tc := range []struct {
+		name string
+		// nonEmpty indicates Items encodes as a non-empty array (should stream).
+		nonEmpty bool
+		// roundTrips indicates decoding the output reproduces the input exactly.
+		// Only holds for CBOR-content RawExtension: decoding normalizes JSON bytes
+		// and populated Objects into CBOR Raw bytes.
+		roundTrips bool
+		items      []runtime.RawExtension
+	}{
+		{
+			name:       "RawExtension with CBOR bytes",
+			nonEmpty:   true,
+			roundTrips: true,
+			items: []runtime.RawExtension{
+				{Raw: mustCBORSelfDescribed(t, map[string]interface{}{"foo": "bar"})},
+				{Raw: mustCBORSelfDescribed(t, map[string]interface{}{"baz": int64(1)})},
+			},
+		},
+		{
+			name:     "RawExtension with JSON bytes",
+			nonEmpty: true,
+			items: []runtime.RawExtension{
+				{Raw: []byte(`{"foo":"bar"}`)},
+			},
+		},
+		{
+			name:     "RawExtension with Object",
+			nonEmpty: true,
+			items: []runtime.RawExtension{
+				{Object: &testapigroupv1.Carp{ObjectMeta: metav1.ObjectMeta{Name: "carp"}}},
+			},
+		},
+		{
+			name:  "RawExtension items empty",
+			items: []runtime.RawExtension{},
+		},
+		{
+			name:  "RawExtension items nil",
+			items: nil,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			in := &metav1.List{
+				TypeMeta: metav1.TypeMeta{Kind: "List", APIVersion: "v1"},
+				ListMeta: metav1.ListMeta{ResourceVersion: "42"},
+				Items:    tc.items,
+			}
+
+			var streamingBuf writeCountingBuffer
+			if err := streamingSerializer.Encode(in, &streamingBuf); err != nil {
+				t.Fatalf("streaming encode error: %v", err)
+			}
+
+			var normalBuf bytes.Buffer
+			if err := normalSerializer.Encode(in, &normalBuf); err != nil {
+				t.Fatalf("normal encode error: %v", err)
+			}
+
+			if diff := cmp.Diff(normalBuf.Bytes(), streamingBuf.Bytes()); diff != "" {
+				t.Logf("normal:    %x", normalBuf.Bytes())
+				t.Logf("streaming: %x", streamingBuf.Bytes())
+				t.Errorf("streaming output differs from normal encoding:\n%s", diff)
+			}
+
+			// Non-empty lists should exercise the streaming path (more than the
+			// map-head + items-key writes).
+			if tc.nonEmpty && streamingBuf.writeCount <= 2 {
+				t.Errorf("expected streaming encoding to use more than 2 writes, got %d", streamingBuf.writeCount)
+			}
+
+			// Round-trip: decoding the streamed bytes must reproduce the input
+			// for CBOR-content items (see roundTrips doc above).
+			if tc.roundTrips {
+				out := &metav1.List{}
+				if err := modes.Decode.Unmarshal(streamingBuf.Bytes(), out); err != nil {
+					t.Fatalf("decode error: %v", err)
+				}
+				if !apiequality.Semantic.DeepEqual(in, out) {
+					t.Errorf("round-trip mismatch:\n%s", cmp.Diff(in, out))
+				}
+			}
+		})
+	}
+}
+
+// TestStreamEncodeCollectionsDeterministic verifies that the streaming serializer
+// produces output identical to the normal non-streaming serializer.
+func TestStreamEncodeCollectionsDeterministic(t *testing.T) {
+	streamingSerializer := NewSerializer(nil, nil)
+	normalSerializer := NewSerializer(nil, nil, StreamingCollectionsEncoding(false))
+
+	for _, tc := range []struct {
+		name string
+		in   runtime.Object
+	}{
+		{
+			name: "CarpList with all top-level fields",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "CarpList",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "42",
+				},
+				Items: []testapigroupv1.Carp{
+					{ObjectMeta: metav1.ObjectMeta{Name: "a"}},
+					{ObjectMeta: metav1.ObjectMeta{Name: "b"}},
+					{ObjectMeta: metav1.ObjectMeta{Name: "c"}},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList with all top-level fields",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"kind":       "List",
+					"apiVersion": "v1",
+					"metadata":   map[string]interface{}{"resourceVersion": "42"},
+				},
+				Items: []unstructured.Unstructured{
+					{Object: map[string]interface{}{"name": "a"}},
+					{Object: map[string]interface{}{"name": "b"}},
+					{Object: map[string]interface{}{"name": "b"}},
+				},
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			// Encode with streaming enabled.
+			var streamingBuf writeCountingBuffer
+			if err := streamingSerializer.Encode(tc.in, &streamingBuf); err != nil {
+				t.Fatalf("streaming encode error: %v", err)
+			}
+
+			// Encode with normal non-streaming encoder.
+			var normalBuf bytes.Buffer
+			if err := normalSerializer.Encode(tc.in, &normalBuf); err != nil {
+				t.Fatalf("normal encode error: %v", err)
+			}
+
+			// Output must be identical.
+			if diff := cmp.Diff(normalBuf.Bytes(), streamingBuf.Bytes()); diff != "" {
+				t.Logf("normal: %x", normalBuf.Bytes())
+				t.Logf("streaming: %x", streamingBuf.Bytes())
+				t.Errorf("streaming output differs from normal encoding:\n%s", diff)
+			}
+
+			if streamingBuf.writeCount <= 2 {
+				t.Errorf("expected streaming encoding to use more than 2 writes, got %d", streamingBuf.writeCount)
+			}
+		})
+	}
+}
+
+// TestStreamEncodeCollectionsNondeterministic verifies that the streaming serializer's
+// EncodeNondeterministic method:
+//  1. Semantic correctness: the output decodes to the same object as deterministic encoding.
+//  2. Non-idempotence: across multiple trials the key order is observed to vary
+//     (probabilistic; uses a multi-key object to make the probability of flake negligible).
+func TestStreamEncodeCollectionsNondeterministic(t *testing.T) {
+	streamingSerializer := NewSerializer(nil, nil)
+	normalSerializer := NewSerializer(nil, nil, StreamingCollectionsEncoding(false))
+
+	// A list with kind+apiVersion+metadata+items = 4 keys.
+	// With SortFastShuffle the number of possible orderings is 4! = 24.
+	// Over 200 trials the probability of seeing only 1 unique ordering is (1/24)^199 ≈ 0.
+	const nTrials = 200
+
+	for _, tc := range []struct {
+		name string
+		in   runtime.Object
+	}{
+		{
+			name: "CarpList",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "CarpList",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "42",
+				},
+				Items: []testapigroupv1.Carp{
+					{ObjectMeta: metav1.ObjectMeta{Name: "a"}},
+					{ObjectMeta: metav1.ObjectMeta{Name: "b"}},
+					{ObjectMeta: metav1.ObjectMeta{Name: "c"}},
+				},
+			},
+		},
+		{
+			name: "UnstructuredList",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"kind":       "List",
+					"apiVersion": "v1",
+					"metadata":   map[string]interface{}{"resourceVersion": "42"},
+				},
+				Items: []unstructured.Unstructured{
+					{Object: map[string]interface{}{"name": "a"}},
+					{Object: map[string]interface{}{"name": "b"}},
+					{Object: map[string]interface{}{"name": "c"}},
+				},
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			// Encode once with non-streaming, deterministic mode as reference for semantic equality.
+			var detBuf bytes.Buffer
+			if err := normalSerializer.Encode(tc.in, &detBuf); err != nil {
+				t.Fatalf("deterministic encode error: %v", err)
+			}
+			var detObj map[string]interface{}
+			if err := modes.Decode.Unmarshal(detBuf.Bytes(), &detObj); err != nil {
+				t.Fatalf("decode deterministic output: %v", err)
+			}
+			detTyped := reflect.New(reflect.TypeOf(tc.in).Elem()).Interface()
+			if err := modes.Decode.Unmarshal(detBuf.Bytes(), detTyped); err != nil {
+				t.Fatalf("decode deterministic output into %T: %v", tc.in, err)
+			}
+
+			// Run nTrials of nondeterministic encoding, stopping early once we
+			// observe a second distinct byte sequence.
+			var firstEncoding string
+			for i := range nTrials {
+				var buf writeCountingBuffer
+				if err := streamingSerializer.EncodeNondeterministic(tc.in, &buf); err != nil {
+					t.Fatalf("trial %d: nondeterministic encode error: %v", i, err)
+				}
+				payload := buf.Bytes()
+
+				// Semantic correctness: decoded value must equal the deterministic reference.
+				var ndetObj map[string]interface{}
+				if err := modes.Decode.Unmarshal(payload, &ndetObj); err != nil {
+					t.Fatalf("trial %d: decode nondeterministic output: %v", i, err)
+				}
+				if diff := cmp.Diff(detObj, ndetObj); diff != "" {
+					t.Errorf("trial %d: semantic mismatch between deterministic and nondeterministic:\n%s", i, diff)
+				}
+
+				ndetTyped := reflect.New(reflect.TypeOf(tc.in).Elem()).Interface()
+				if err := modes.Decode.Unmarshal(payload, ndetTyped); err != nil {
+					t.Fatalf("trial %d: decode nondeterministic output into %T: %v", i, tc.in, err)
+				}
+				if !apiequality.Semantic.DeepEqual(detTyped, ndetTyped) {
+					t.Errorf("trial %d: typed %T mismatch between deterministic and nondeterministic encodings", i, tc.in)
+				}
+
+				if buf.writeCount <= 2 {
+					t.Errorf("trial %d: expected streaming encoding to use more than 2 writes, got %d", i, buf.writeCount)
+				}
+
+				enc := string(payload)
+				if i == 0 {
+					firstEncoding = enc
+				} else if enc != firstEncoding {
+					return
+				}
+			}
+
+			t.Errorf("nondeterministic encoding produced only 1 unique byte sequence over %d trials; expected varied output", nTrials)
+		})
+	}
+}
+
+// TestCollectionHeadMatchesLibrary verifies that writeArrayHead and writeMapHead
+// produce byte-identical output to the fxamacker/cbor library's own head encoding
+// at every length-encoding width boundary (and its neighbors) reachable by
+// allocating a real collection. The library encodes an n-element array/map with a
+// leading definite-length head, so our streamed head must equal that prefix.
+//
+// The reachable sizes exercise the 1-, 2-, 3-, and 5-byte argument forms (the last
+// at n=65536). The 8-byte form (n > 2^32) cannot be produced by allocation and is
+// covered against explicit RFC 8949 bytes by TestWriteCollectionHeadBoundaries.
+func TestCollectionHeadMatchesLibrary(t *testing.T) {
+	// Width-class boundaries and neighbors:
+	//   n <= 23           -> 1-byte head
+	//   24    <= n <= 255 -> 2-byte head
+	//   256   <= n <= 65535 -> 3-byte head
+	//   65536 <= n        -> 5-byte head
+	sizes := []int{0, 1, 23, 24, 25, 255, 256, 257, 65535, 65536, 65537}
+
+	assertPrefix := func(t *testing.T, kind string, n int, head, lib []byte) {
+		t.Helper()
+		end := min(len(head), len(lib))
+		if !bytes.Equal(head, lib[:end]) {
+			t.Errorf("%s head mismatch for n=%d:\n  ours:    % x\n  library: % x", kind, n, head, lib[:min(len(lib), len(head)+4)])
+		}
+	}
+
+	for _, n := range sizes {
+		t.Run(fmt.Sprintf("array/%d", n), func(t *testing.T) {
+			var head bytes.Buffer
+			if err := writeArrayHead(&head, n); err != nil {
+				t.Fatalf("writeArrayHead(%d): %v", n, err)
+			}
+			lib, err := modes.Encode.Marshal(make([]bool, n))
+			if err != nil {
+				t.Fatalf("library marshal []bool len %d: %v", n, err)
+			}
+			assertPrefix(t, "array", n, head.Bytes(), lib)
+		})
+		t.Run(fmt.Sprintf("map/%d", n), func(t *testing.T) {
+			var head bytes.Buffer
+			if err := writeMapHead(&head, n); err != nil {
+				t.Fatalf("writeMapHead(%d): %v", n, err)
+			}
+			m := make(map[int64]bool, n)
+			for i := range n {
+				m[int64(i)] = false
+			}
+			lib, err := modes.Encode.Marshal(m)
+			if err != nil {
+				t.Fatalf("library marshal map len %d: %v", n, err)
+			}
+			assertPrefix(t, "map", n, head.Bytes(), lib)
+		})
+	}
+}
+
+// TestWriteCollectionHeadBoundaries checks writeCollectionHead against explicit
+// RFC 8949 Section 3 expected bytes at every additional-information width boundary
+// and its neighbors, for both the array (0x80) and map (0xa0) major types. Unlike
+// TestCollectionHeadMatchesLibrary, this calls writeCollectionHead directly, so it
+// can cover the 8-byte argument form (n > 2^32) that no allocatable collection can
+// reach.
+func TestWriteCollectionHeadBoundaries(t *testing.T) {
+	for _, tc := range []struct {
+		n     int64
+		array []byte
+		mp    []byte
+	}{
+		{n: 0, array: []byte{0x80}, mp: []byte{0xa0}},
+		{n: 1, array: []byte{0x81}, mp: []byte{0xa1}},
+		{n: 23, array: []byte{0x97}, mp: []byte{0xb7}},                                                                                                            // max 1-byte
+		{n: 24, array: []byte{0x98, 0x18}, mp: []byte{0xb8, 0x18}},                                                                                                // min 2-byte
+		{n: 255, array: []byte{0x98, 0xff}, mp: []byte{0xb8, 0xff}},                                                                                               // max 2-byte
+		{n: 256, array: []byte{0x99, 0x01, 0x00}, mp: []byte{0xb9, 0x01, 0x00}},                                                                                   // min 3-byte
+		{n: 65535, array: []byte{0x99, 0xff, 0xff}, mp: []byte{0xb9, 0xff, 0xff}},                                                                                 // max 3-byte
+		{n: 65536, array: []byte{0x9a, 0x00, 0x01, 0x00, 0x00}, mp: []byte{0xba, 0x00, 0x01, 0x00, 0x00}},                                                         // min 5-byte
+		{n: 4294967295, array: []byte{0x9a, 0xff, 0xff, 0xff, 0xff}, mp: []byte{0xba, 0xff, 0xff, 0xff, 0xff}},                                                    // max 5-byte (2^32-1)
+		{n: 4294967296, array: []byte{0x9b, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00}, mp: []byte{0xbb, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00}},    // min 9-byte (2^32)
+		{n: 1099511627775, array: []byte{0x9b, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff}, mp: []byte{0xbb, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff}}, // 0xFFFFFFFFFF
+	} {
+		t.Run(fmt.Sprintf("array/%d", tc.n), func(t *testing.T) {
+			var buf bytes.Buffer
+			if err := writeCollectionHead(&buf, cborTypeArray, tc.n); err != nil {
+				t.Fatalf("writeCollectionHead: %v", err)
+			}
+			if !bytes.Equal(buf.Bytes(), tc.array) {
+				t.Errorf("n=%d: got % x, want % x", tc.n, buf.Bytes(), tc.array)
+			}
+		})
+		t.Run(fmt.Sprintf("map/%d", tc.n), func(t *testing.T) {
+			var buf bytes.Buffer
+			if err := writeCollectionHead(&buf, cborTypeMap, tc.n); err != nil {
+				t.Fatalf("writeCollectionHead: %v", err)
+			}
+			if !bytes.Equal(buf.Bytes(), tc.mp) {
+				t.Errorf("n=%d: got % x, want % x", tc.n, buf.Bytes(), tc.mp)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct/direct.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct/direct.go
new file mode 100644
index 0000000000..945dc47c14
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct/direct.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package direct provides functions for marshaling and unmarshaling between arbitrary Go values and
+// CBOR data, with behavior that is compatible with that of the CBOR serializer. In particular,
+// types that implement cbor.Marshaler and cbor.Unmarshaler should use these functions.
+package direct
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+)
+
+// Marshal serializes a value to CBOR. If there is more than one way to encode the value, it will
+// make the same choice as the CBOR implementation of runtime.Serializer.
+func Marshal(src any) ([]byte, error) {
+	return modes.Encode.Marshal(src)
+}
+
+// Unmarshal deserializes from CBOR into an addressable value. If there is more than one way to
+// unmarshal a value, it will make the same choice as the CBOR implementation of runtime.Serializer.
+func Unmarshal(src []byte, dst any) error {
+	return modes.Decode.Unmarshal(src, dst)
+}
+
+// Diagnose accepts well-formed CBOR bytes and returns a string representing the same data item in
+// human-readable diagnostic notation (RFC 8949 Section 8). The diagnostic notation is not meant to
+// be parsed.
+func Diagnose(src []byte) (string, error) {
+	return modes.Diagnostic.Diagnose(src)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/framer.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/framer.go
new file mode 100644
index 0000000000..28a733c673
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/framer.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cbor
+
+import (
+	"io"
+
+	"k8s.io/apimachinery/pkg/runtime"
+
+	"github.com/fxamacker/cbor/v2"
+)
+
+// NewFramer returns a runtime.Framer based on RFC 8742 CBOR Sequences. Each frame contains exactly
+// one encoded CBOR data item.
+func NewFramer() runtime.Framer {
+	return framer{}
+}
+
+var _ runtime.Framer = framer{}
+
+type framer struct{}
+
+func (framer) NewFrameReader(rc io.ReadCloser) io.ReadCloser {
+	return &frameReader{
+		decoder: cbor.NewDecoder(rc),
+		closer:  rc,
+	}
+}
+
+func (framer) NewFrameWriter(w io.Writer) io.Writer {
+	// Each data item in a CBOR sequence is self-delimiting (like JSON objects).
+	return w
+}
+
+type frameReader struct {
+	decoder *cbor.Decoder
+	closer  io.Closer
+
+	overflow []byte
+}
+
+func (fr *frameReader) Read(dst []byte) (int, error) {
+	if len(fr.overflow) > 0 {
+		// We read a frame that was too large for the destination slice in a previous call
+		// to Read and have bytes left over.
+		n := copy(dst, fr.overflow)
+		if n < len(fr.overflow) {
+			fr.overflow = fr.overflow[n:]
+			return n, io.ErrShortBuffer
+		}
+		fr.overflow = nil
+		return n, nil
+	}
+
+	// The Reader contract allows implementations to use all of dst[0:len(dst)] as scratch
+	// space, even if n < len(dst), but it does not allow implementations to use
+	// dst[len(dst):cap(dst)]. Slicing it up-front allows us to append to it without worrying
+	// about overwriting dst[len(dst):cap(dst)].
+	m := cbor.RawMessage(dst[0:0:len(dst)])
+	if err := fr.decoder.Decode(&m); err != nil {
+		return 0, err
+	}
+
+	if len(m) > len(dst) {
+		// The frame was too big, m has a newly-allocated underlying array to accommodate
+		// it.
+		fr.overflow = m[len(dst):]
+		return copy(dst, m), io.ErrShortBuffer
+	}
+
+	return len(m), nil
+}
+
+func (fr *frameReader) Close() error {
+	return fr.closer.Close()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/framer_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/framer_test.go
new file mode 100644
index 0000000000..05676a1a8d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/framer_test.go
@@ -0,0 +1,147 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cbor_test
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+// TestFrameReaderReadError tests that the frame reader does not resume after encountering a
+// well-formedness error in the input stream. According to RFC 8742 Section 2.8: "[...] if any data
+// item in the sequence is not well formed, it is not possible to reliably decode the rest of the
+// sequence."
+func TestFrameReaderReadError(t *testing.T) {
+	input := []byte{
+		0xff, // ill-formed initial break
+		0xa0, // followed by well-formed empty map
+	}
+	fr := cbor.NewFramer().NewFrameReader(io.NopCloser(bytes.NewReader(input)))
+	for i := 0; i < 3; i++ {
+		n, err := fr.Read(nil)
+		if err == nil || errors.Is(err, io.ErrShortBuffer) {
+			t.Fatalf("expected a non-nil error other than io.ErrShortBuffer, got: %v", err)
+		}
+		if n != 0 {
+			t.Fatalf("expected 0 bytes read on error, got %d", n)
+		}
+	}
+}
+
+func TestFrameReaderRead(t *testing.T) {
+	type ChunkedFrame [][]byte
+
+	for _, tc := range []struct {
+		Name   string
+		Frames []ChunkedFrame
+	}{
+		{
+			Name: "consecutive frames",
+			Frames: []ChunkedFrame{
+				[][]byte{{0xa0}},
+				[][]byte{{0xa0}},
+			},
+		},
+		{
+			Name: "zero-length destination buffer",
+			Frames: []ChunkedFrame{
+				[][]byte{{}, {0xa0}},
+			},
+		},
+		{
+			Name: "overflow",
+			Frames: []ChunkedFrame{
+				[][]byte{
+					{0x43},
+					{'x'},
+					{'y', 'z'},
+				},
+				[][]byte{
+					{0xa1, 0x43, 'f', 'o', 'o'},
+					{'b'},
+					{'a', 'r'},
+				},
+			},
+		},
+	} {
+		t.Run(tc.Name, func(t *testing.T) {
+			var concatenation []byte
+			for _, f := range tc.Frames {
+				for _, c := range f {
+					concatenation = append(concatenation, c...)
+				}
+			}
+
+			fr := cbor.NewFramer().NewFrameReader(io.NopCloser(bytes.NewReader(concatenation)))
+
+			for _, frame := range tc.Frames {
+				var want, got []byte
+				for i, chunk := range frame {
+					dst := make([]byte, len(chunk), 2*len(chunk))
+					for i := len(dst); i < cap(dst); i++ {
+						dst[:cap(dst)][i] = 0xff
+					}
+					n, err := fr.Read(dst)
+					if n != len(chunk) {
+						t.Errorf("expected %d bytes read, got %d", len(chunk), n)
+					}
+					if i == len(frame)-1 && err != nil {
+						t.Errorf("unexpected non-nil error on last read of frame: %v", err)
+					} else if i < len(frame)-1 && !errors.Is(err, io.ErrShortBuffer) {
+						t.Errorf("expected io.ErrShortBuffer on all but the last read of a frame, got: %v", err)
+					}
+					for i := len(dst); i < cap(dst); i++ {
+						if dst[:cap(dst)][i] != 0xff {
+							t.Errorf("read mutated underlying array beyond slice length: %#v", dst[len(dst):cap(dst)])
+							break
+						}
+					}
+					want = append(want, chunk...)
+					got = append(got, dst...)
+				}
+				if diff := cmp.Diff(want, got); diff != "" {
+					t.Errorf("reassembled frame differs:\n%s", diff)
+				}
+			}
+		})
+	}
+}
+
+type fakeReadCloser struct {
+	err error
+}
+
+func (rc fakeReadCloser) Read(_ []byte) (int, error) {
+	return 0, nil
+}
+
+func (rc fakeReadCloser) Close() error {
+	return rc.err
+}
+
+func TestFrameReaderClose(t *testing.T) {
+	want := errors.New("test")
+	if got := cbor.NewFramer().NewFrameReader(fakeReadCloser{err: want}).Close(); !errors.Is(got, want) {
+		t.Errorf("got error %v, want %v", got, want)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/appendixa_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/appendixa_test.go
new file mode 100644
index 0000000000..e434b666c8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/appendixa_test.go
@@ -0,0 +1,601 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes_test
+
+import (
+	"encoding/hex"
+	"fmt"
+	"math"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+// TestAppendixA roundtrips the examples of encoded CBOR data items in RFC 8949 Appendix A. For
+// completeness, all examples from the appendix are included, even those those that are rejected by
+// this decoder or are re-encoded to a different sequence of CBOR bytes (with explanation).
+func TestAppendixA(t *testing.T) {
+	hex := func(h string) []byte {
+		b, err := hex.DecodeString(h)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return b
+	}
+
+	eq := conversion.EqualitiesOrDie(
+		// NaN float64 values are always inequal and have multiple representations. RFC 8949
+		// Section 4.2.2 recommends protocols not supporting NaN payloads or signaling NaNs
+		// choose a single representation for all NaN values. For the purposes of this test,
+		// all NaN representations are equivalent.
+		func(a float64, b float64) bool {
+			if math.IsNaN(a) && math.IsNaN(b) {
+				return true
+			}
+			return math.Float64bits(a) == math.Float64bits(b)
+		},
+	)
+
+	const (
+		reasonArrayFixedLength  = "indefinite-length arrays are re-encoded with fixed length"
+		reasonByteString        = "strings are encoded as the byte string major type"
+		reasonMapFixedLength    = "indefinite-length maps are re-encoded with fixed length"
+		reasonMapSorted         = "map entries are sorted"
+		reasonStringFixedLength = "indefinite-length strings are re-encoded with fixed length"
+		reasonTagIgnored        = "unrecognized tag numbers are ignored"
+		reasonTimeToInterface   = "times decode to interface{} as RFC3339 timestamps for JSON interoperability"
+	)
+
+	for _, tc := range []struct {
+		example []byte // example data item
+		decoded interface{}
+		reject  string   // reason the decoder rejects the example
+		encoded []byte   // re-encoded object (only if different from example encoding)
+		reasons []string // reasons for re-encode difference
+	}{
+		{
+			example: hex("00"),
+			decoded: int64(0),
+		},
+		{
+			example: hex("01"),
+			decoded: int64(1),
+		},
+		{
+			example: hex("0a"),
+			decoded: int64(10),
+		},
+		{
+			example: hex("17"),
+			decoded: int64(23),
+		},
+		{
+			example: hex("1818"),
+			decoded: int64(24),
+		},
+		{
+			example: hex("1819"),
+			decoded: int64(25),
+		},
+		{
+			example: hex("1864"),
+			decoded: int64(100),
+		},
+		{
+			example: hex("1903e8"),
+			decoded: int64(1000),
+		},
+		{
+			example: hex("1a000f4240"),
+			decoded: int64(1000000),
+		},
+		{
+			example: hex("1b000000e8d4a51000"),
+			decoded: int64(1000000000000),
+		},
+		{
+			example: hex("1bffffffffffffffff"),
+			reject:  "2^64-1 overflows int64 and falling back to float64 (as with JSON) loses distinction between float and integer",
+		},
+		{
+			example: hex("c249010000000000000000"),
+			reject:  "decoding tagged positive bigint value to interface{} can't reproduce this value without losing distinction between float and integer",
+		},
+		{
+			example: hex("3bffffffffffffffff"),
+			reject:  "-2^64-1 overflows int64 and falling back to float64 (as with JSON) loses distinction between float and integer",
+		},
+		{
+			example: hex("c349010000000000000000"),
+			reject:  "-18446744073709551617 overflows int64 and falling back to float64 (as with JSON) loses distinction between float and integer",
+		},
+		{
+			example: hex("20"),
+			decoded: int64(-1),
+		},
+		{
+			example: hex("29"),
+			decoded: int64(-10),
+		},
+		{
+			example: hex("3863"),
+			decoded: int64(-100),
+		},
+		{
+			example: hex("3903e7"),
+			decoded: int64(-1000),
+		},
+		{
+			example: hex("f90000"),
+			decoded: 0.0,
+		},
+		{
+			example: hex("f98000"),
+			decoded: math.Copysign(0, -1),
+		},
+		{
+			example: hex("f93c00"),
+			decoded: 1.0,
+		},
+		{
+			example: hex("fb3ff199999999999a"),
+			decoded: 1.1,
+		},
+		{
+			example: hex("f93e00"),
+			decoded: 1.5,
+		},
+		{
+			example: hex("f97bff"),
+			decoded: 65504.0,
+		},
+		{
+			example: hex("fa47c35000"),
+			decoded: 100000.0,
+		},
+		{
+			example: hex("fa7f7fffff"),
+			decoded: 3.4028234663852886e+38,
+		},
+		{
+			example: hex("fb7e37e43c8800759c"),
+			decoded: 1.0e+300,
+		},
+		{
+			example: hex("f90001"),
+			decoded: 5.960464477539063e-8,
+		},
+		{
+			example: hex("f90400"),
+			decoded: 0.00006103515625,
+		},
+		{
+			example: hex("f9c400"),
+			decoded: -4.0,
+		},
+		{
+			example: hex("fbc010666666666666"),
+			decoded: -4.1,
+		},
+		{
+			example: hex("f97c00"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("f97e00"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("f9fc00"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("fa7f800000"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("fa7fc00000"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("faff800000"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("fb7ff0000000000000"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("fb7ff8000000000000"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("fbfff0000000000000"),
+			reject:  "floating-point NaN and infinities are not accepted",
+		},
+		{
+			example: hex("f4"),
+			decoded: false,
+		},
+		{
+			example: hex("f5"),
+			decoded: true,
+		},
+		{
+			example: hex("f6"),
+			decoded: nil,
+		},
+		{
+			example: hex("f7"),
+			reject:  "only simple values false, true, and null have a clear analog",
+		},
+		{
+			example: hex("f0"),
+			reject:  "only simple values false, true, and null have a clear analog",
+		},
+		{
+			example: hex("f8ff"),
+			reject:  "only simple values false, true, and null have a clear analog",
+		},
+		{
+			example: hex("c074323031332d30332d32315432303a30343a30305a"),
+			decoded: "2013-03-21T20:04:00Z",
+			encoded: hex("54323031332d30332d32315432303a30343a30305a"),
+			reasons: []string{
+				reasonByteString,
+				reasonTimeToInterface,
+			},
+		},
+		{
+			example: hex("c11a514b67b0"),
+			decoded: "2013-03-21T20:04:00Z",
+			encoded: hex("54323031332d30332d32315432303a30343a30305a"),
+			reasons: []string{
+				reasonByteString,
+				reasonTimeToInterface,
+			},
+		},
+		{
+			example: hex("c1fb41d452d9ec200000"),
+			decoded: "2013-03-21T20:04:00.5Z",
+			encoded: hex("56323031332d30332d32315432303a30343a30302e355a"),
+			reasons: []string{
+				reasonByteString,
+				reasonTimeToInterface,
+			},
+		},
+		{
+			example: hex("d74401020304"), // 23(h'01020304')
+			decoded: "01020304",
+			encoded: hex("483031303230333034"), // '01020304'
+			reasons: []string{
+				"decoding a byte string enclosed in an expected later encoding tag into an interface{} value automatically converts to the specified encoding for JSON interoperability",
+			},
+		},
+		{
+			example: hex("d818456449455446"),
+			decoded: "dIETF",
+			encoded: hex("456449455446"),
+			reasons: []string{
+				reasonTagIgnored,
+			},
+		},
+		{
+			example: hex("d82076687474703a2f2f7777772e6578616d706c652e636f6d"),
+			decoded: "http://www.example.com",
+			encoded: hex("56687474703a2f2f7777772e6578616d706c652e636f6d"),
+			reasons: []string{
+				reasonByteString,
+				reasonTagIgnored,
+			},
+		},
+		{
+			example: hex("40"),
+			decoded: "",
+		},
+		{
+			example: hex("4401020304"),
+			decoded: "\x01\x02\x03\x04",
+		},
+		{
+			example: hex("60"),
+			decoded: "",
+			encoded: hex("40"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("6161"),
+			decoded: "a",
+			encoded: hex("4161"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("6449455446"),
+			decoded: "IETF",
+			encoded: hex("4449455446"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("62225c"),
+			decoded: "\"\\",
+			encoded: hex("42225c"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("62c3bc"),
+			decoded: "ü",
+			encoded: hex("42c3bc"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("63e6b0b4"),
+			decoded: "水",
+			encoded: hex("43e6b0b4"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("64f0908591"),
+			decoded: "𐅑",
+			encoded: hex("44f0908591"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("80"),
+			decoded: []interface{}{},
+		},
+		{
+			example: hex("83010203"),
+			decoded: []interface{}{int64(1), int64(2), int64(3)},
+		},
+		{
+			example: hex("8301820203820405"),
+			decoded: []interface{}{int64(1), []interface{}{int64(2), int64(3)}, []interface{}{int64(4), int64(5)}},
+		},
+		{
+			example: hex("98190102030405060708090a0b0c0d0e0f101112131415161718181819"),
+			decoded: []interface{}{int64(1), int64(2), int64(3), int64(4), int64(5), int64(6), int64(7), int64(8), int64(9), int64(10), int64(11), int64(12), int64(13), int64(14), int64(15), int64(16), int64(17), int64(18), int64(19), int64(20), int64(21), int64(22), int64(23), int64(24), int64(25)},
+		},
+		{
+			example: hex("a0"),
+			decoded: map[string]interface{}{},
+		},
+		{
+			example: hex("a201020304"),
+			reject:  "integer map keys don't correspond with field names or unstructured keys",
+		},
+		{
+			example: hex("a26161016162820203"),
+			decoded: map[string]interface{}{
+				"a": int64(1),
+				"b": []interface{}{int64(2), int64(3)},
+			},
+			encoded: hex("a24161014162820203"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("826161a161626163"),
+			decoded: []interface{}{
+				"a",
+				map[string]interface{}{"b": "c"},
+			},
+			encoded: hex("824161a141624163"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("a56161614161626142616361436164614461656145"),
+			decoded: map[string]interface{}{
+				"a": "A",
+				"b": "B",
+				"c": "C",
+				"d": "D",
+				"e": "E",
+			},
+			encoded: hex("a54161414141624142416341434164414441654145"),
+			reasons: []string{
+				reasonByteString,
+			},
+		},
+		{
+			example: hex("5f42010243030405ff"),
+			decoded: "\x01\x02\x03\x04\x05",
+			encoded: hex("450102030405"),
+			reasons: []string{
+				reasonStringFixedLength,
+			},
+		},
+		{
+			example: hex("7f657374726561646d696e67ff"),
+			decoded: "streaming",
+			encoded: hex("4973747265616d696e67"),
+			reasons: []string{
+				reasonByteString,
+				reasonStringFixedLength,
+			},
+		},
+		{
+			example: hex("9fff"),
+			decoded: []interface{}{},
+			encoded: hex("80"),
+			reasons: []string{
+				reasonArrayFixedLength,
+			},
+		},
+		{
+			example: hex("9f018202039f0405ffff"),
+			decoded: []interface{}{
+				int64(1),
+				[]interface{}{int64(2), int64(3)},
+				[]interface{}{int64(4), int64(5)},
+			},
+			encoded: hex("8301820203820405"),
+			reasons: []string{
+				reasonArrayFixedLength,
+			},
+		},
+		{
+			example: hex("9f01820203820405ff"),
+			decoded: []interface{}{
+				int64(1),
+				[]interface{}{int64(2), int64(3)},
+				[]interface{}{int64(4), int64(5)},
+			},
+			encoded: hex("8301820203820405"),
+			reasons: []string{
+				reasonArrayFixedLength,
+			},
+		},
+		{
+			example: hex("83018202039f0405ff"),
+			decoded: []interface{}{
+				int64(1),
+				[]interface{}{int64(2), int64(3)},
+				[]interface{}{int64(4), int64(5)},
+			},
+			encoded: hex("8301820203820405"),
+			reasons: []string{
+				reasonArrayFixedLength,
+			},
+		},
+		{
+			example: hex("83019f0203ff820405"),
+			decoded: []interface{}{
+				int64(1),
+				[]interface{}{int64(2), int64(3)},
+				[]interface{}{int64(4), int64(5)},
+			},
+			encoded: hex("8301820203820405"),
+			reasons: []string{
+				reasonArrayFixedLength,
+			},
+		},
+		{
+			example: hex("9f0102030405060708090a0b0c0d0e0f101112131415161718181819ff"),
+			decoded: []interface{}{
+				int64(1), int64(2), int64(3), int64(4), int64(5),
+				int64(6), int64(7), int64(8), int64(9), int64(10),
+				int64(11), int64(12), int64(13), int64(14), int64(15),
+				int64(16), int64(17), int64(18), int64(19), int64(20),
+				int64(21), int64(22), int64(23), int64(24), int64(25),
+			},
+			encoded: hex("98190102030405060708090a0b0c0d0e0f101112131415161718181819"),
+			reasons: []string{
+				reasonArrayFixedLength,
+			},
+		},
+		{
+			example: hex("bf61610161629f0203ffff"),
+			decoded: map[string]interface{}{
+				"a": int64(1),
+				"b": []interface{}{int64(2), int64(3)},
+			},
+			encoded: hex("a24161014162820203"),
+			reasons: []string{
+				reasonArrayFixedLength,
+				reasonByteString,
+				reasonMapFixedLength,
+			},
+		},
+		{
+			example: hex("826161bf61626163ff"),
+			decoded: []interface{}{"a", map[string]interface{}{"b": "c"}},
+			encoded: hex("824161a141624163"),
+			reasons: []string{
+				reasonByteString,
+				reasonMapFixedLength,
+			},
+		},
+		{
+			example: hex("bf6346756ef563416d7421ff"),
+			decoded: map[string]interface{}{
+				"Amt": int64(-2),
+				"Fun": true,
+			},
+			encoded: hex("a243416d74214346756ef5"),
+			reasons: []string{
+				reasonByteString,
+				reasonMapFixedLength,
+				reasonMapSorted,
+			},
+		},
+	} {
+		t.Run(fmt.Sprintf("%x", tc.example), func(t *testing.T) {
+			var decoded interface{}
+			err := modes.Decode.Unmarshal(tc.example, &decoded)
+			if err != nil {
+				if tc.reject != "" {
+					t.Logf("expected decode error (%s) occurred: %v", tc.reject, err)
+					return
+				}
+				t.Fatalf("unexpected decode error: %v", err)
+			} else if tc.reject != "" {
+				t.Fatalf("expected decode error (%v) did not occur", tc.reject)
+			}
+
+			if !eq.DeepEqual(tc.decoded, decoded) {
+				t.Fatal(cmp.Diff(tc.decoded, decoded))
+			}
+
+			actual, err := modes.Encode.Marshal(decoded)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			expected := tc.example
+			if tc.encoded != nil {
+				expected = tc.encoded
+				if len(tc.reasons) == 0 {
+					t.Fatal("invalid test case: missing reasons for difference between the example encoding and the actual encoding")
+				}
+				diff := cmp.Diff(tc.example, tc.encoded)
+				if diff == "" {
+					t.Fatal("invalid test case: no difference between the example encoding and the expected re-encoding")
+				}
+				t.Logf("expecting the following differences from the example encoding on re-encode:\n%s", diff)
+				t.Logf("reasons for encoding differences:")
+				for _, reason := range tc.reasons {
+					t.Logf("- %s", reason)
+				}
+
+			}
+
+			if diff := cmp.Diff(expected, actual); diff != "" {
+				t.Errorf("re-encoded object differs from expected:\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/buffers.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/buffers.go
new file mode 100644
index 0000000000..f14cbd6b58
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/buffers.go
@@ -0,0 +1,65 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"bytes"
+	"sync"
+)
+
+var buffers = BufferProvider{p: new(sync.Pool)}
+
+type buffer struct {
+	bytes.Buffer
+}
+
+type pool interface {
+	Get() interface{}
+	Put(interface{})
+}
+
+type BufferProvider struct {
+	p pool
+}
+
+func (b *BufferProvider) Get() *buffer {
+	if buf, ok := b.p.Get().(*buffer); ok {
+		return buf
+	}
+	return &buffer{}
+}
+
+func (b *BufferProvider) Put(buf *buffer) {
+	if buf.Cap() > 3*1024*1024 /* Default MaxRequestBodyBytes */ {
+		// Objects in a sync.Pool are assumed to be fungible. This is not a good assumption
+		// for pools of *bytes.Buffer because a *bytes.Buffer's underlying array grows as
+		// needed to accommodate writes. In Kubernetes, apiservers tend to encode "small"
+		// objects very frequently and much larger objects (especially large lists) only
+		// occasionally. Under steady load, pooled buffers tend to be borrowed frequently
+		// enough to prevent them from being released. Over time, each buffer is used to
+		// encode a large object and its capacity increases accordingly. The result is that
+		// practically all buffers in the pool retain much more capacity than needed to
+		// encode most objects.
+
+		// As a basic mitigation for the worst case, buffers with more capacity than the
+		// default max request body size are never returned to the pool.
+		// TODO: Optimize for higher buffer utilization.
+		return
+	}
+	buf.Reset()
+	b.p.Put(buf)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/buffers_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/buffers_test.go
new file mode 100644
index 0000000000..dcc619b199
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/buffers_test.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"testing"
+)
+
+type mockPool struct {
+	v interface{}
+}
+
+func (*mockPool) Get() interface{} {
+	return nil
+}
+
+func (p *mockPool) Put(v interface{}) {
+	p.v = v
+}
+
+func TestBufferProviderPut(t *testing.T) {
+	{
+		p := new(mockPool)
+		bp := &BufferProvider{p: p}
+		small := new(buffer)
+		small.Grow(3 * 1024 * 1024)
+		small.WriteString("hello world")
+		bp.Put(small)
+		if p.v != small {
+			t.Errorf("expected buf with capacity %d to be returned to pool", small.Cap())
+		}
+		if small.Len() != 0 {
+			t.Errorf("expected buf to be reset before returning to pool")
+		}
+	}
+
+	{
+		p := new(mockPool)
+		bp := &BufferProvider{p: p}
+		big := new(buffer)
+		big.Grow(3*1024*1024 + 1)
+		bp.Put(big)
+		if p.v != nil {
+			t.Errorf("expected buf with capacity %d not to be returned to pool", big.Cap())
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode.go
new file mode 100644
index 0000000000..4a7055c10f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode.go
@@ -0,0 +1,184 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"reflect"
+
+	"github.com/fxamacker/cbor/v2"
+)
+
+var simpleValues *cbor.SimpleValueRegistry = func() *cbor.SimpleValueRegistry {
+	var opts []func(*cbor.SimpleValueRegistry) error
+	for sv := 0; sv <= 255; sv++ {
+		// Reject simple values 0-19, 23, and 32-255. The simple values 24-31 are reserved
+		// and considered ill-formed by the CBOR specification. We only accept false (20),
+		// true (21), and null (22).
+		switch sv {
+		case 20: // false
+		case 21: // true
+		case 22: // null
+		case 24, 25, 26, 27, 28, 29, 30, 31: // reserved
+		default:
+			opts = append(opts, cbor.WithRejectedSimpleValue(cbor.SimpleValue(sv)))
+		}
+	}
+	simpleValues, err := cbor.NewSimpleValueRegistryFromDefaults(opts...)
+	if err != nil {
+		panic(err)
+	}
+	return simpleValues
+}()
+
+// decode is the basis for the Decode mode, with no JSONUnmarshalerTranscoder
+// configured. TranscodeToJSON uses this directly rather than Decode to avoid an initialization
+// cycle between the two. Everything else should use one of the exported DecModes.
+var decode cbor.DecMode = func() cbor.DecMode {
+	decode, err := cbor.DecOptions{
+		// Maps with duplicate keys are well-formed but invalid according to the CBOR spec
+		// and never acceptable. Unlike the JSON serializer, inputs containing duplicate map
+		// keys are rejected outright and not surfaced as a strict decoding error.
+		DupMapKey: cbor.DupMapKeyEnforcedAPF,
+
+		// For JSON parity, decoding an RFC3339 string into time.Time needs to be accepted
+		// with or without tagging. If a tag number is present, it must be valid.
+		TimeTag: cbor.DecTagOptional,
+
+		// MaxNestedLevels is set to the same value used in the JSON implementation.
+		MaxNestedLevels: 10000,
+
+		// MaxArrayElements is set to the maximum allowed by the cbor library. We rely on
+		// the library initial wellformedness scan and on the api max request limit to
+		// prevent preallocating very large slices during decoding.
+		MaxArrayElements: 2147483647,
+
+		// MaxMapPairs specifies the maximum number of key-value pairs allowed in a map.
+		// We selected this value as it is large enough so that in practice the API server
+		// decoder will always hit the request body limit before the limit here is reached.
+		MaxMapPairs: 2097152,
+
+		// Indefinite-length sequences aren't produced by this serializer, but other
+		// implementations can.
+		IndefLength: cbor.IndefLengthAllowed,
+
+		// Accept inputs that contain CBOR tags.
+		TagsMd: cbor.TagsAllowed,
+
+		// Decode type 0 (unsigned integer) as int64.
+		// TODO: IntDecConvertSignedOrFail errors on overflow, JSON will try to fall back to float64.
+		IntDec: cbor.IntDecConvertSignedOrFail,
+
+		// Disable producing map[cbor.ByteString]interface{}, which is not acceptable for
+		// decodes into interface{}.
+		MapKeyByteString: cbor.MapKeyByteStringForbidden,
+
+		// Error on map keys that don't map to a field in the destination struct.
+		ExtraReturnErrors: cbor.ExtraDecErrorUnknownField,
+
+		// Decode maps into concrete type map[string]interface{} when the destination is an
+		// interface{}.
+		DefaultMapType: reflect.TypeOf(map[string]interface{}(nil)),
+
+		// A CBOR text string whose content is not a valid UTF-8 sequence is well-formed but
+		// invalid according to the CBOR spec. Reject invalid inputs. Encoders are
+		// responsible for ensuring that all text strings they produce contain valid UTF-8
+		// sequences and may use the byte string major type to encode strings that have not
+		// been validated.
+		UTF8: cbor.UTF8RejectInvalid,
+
+		// Never make a case-insensitive match between a map key and a struct field.
+		FieldNameMatching: cbor.FieldNameMatchingCaseSensitive,
+
+		// Produce string concrete values when decoding a CBOR byte string into interface{}.
+		DefaultByteStringType: reflect.TypeOf(""),
+
+		// Allow CBOR byte strings to be decoded into string destination values. If a byte
+		// string is enclosed in an "expected later encoding" tag
+		// (https://www.rfc-editor.org/rfc/rfc8949.html#section-3.4.5.2), then the text
+		// encoding indicated by that tag (e.g. base64) will be applied to the contents of
+		// the byte string.
+		ByteStringToString: cbor.ByteStringToStringAllowedWithExpectedLaterEncoding,
+
+		// Allow CBOR byte strings to match struct fields when appearing as a map key.
+		FieldNameByteString: cbor.FieldNameByteStringAllowed,
+
+		// When decoding an unrecognized tag to interface{}, return the decoded tag content
+		// instead of the default, a cbor.Tag representing a (number, content) pair.
+		UnrecognizedTagToAny: cbor.UnrecognizedTagContentToAny,
+
+		// Decode time tags to interface{} as strings containing RFC 3339 timestamps.
+		TimeTagToAny: cbor.TimeTagToRFC3339Nano,
+
+		// For parity with JSON, strings can be decoded into time.Time if they are RFC 3339
+		// timestamps.
+		ByteStringToTime: cbor.ByteStringToTimeAllowed,
+
+		// Reject NaN and infinite floating-point values since they don't have a JSON
+		// representation (RFC 8259 Section 6).
+		NaN: cbor.NaNDecodeForbidden,
+		Inf: cbor.InfDecodeForbidden,
+
+		// When unmarshaling a byte string into a []byte, assume that the byte string
+		// contains base64-encoded bytes, unless explicitly counterindicated by an "expected
+		// later encoding" tag. This is consistent with the because of unmarshaling a JSON
+		// text into a []byte.
+		ByteStringExpectedFormat: cbor.ByteStringExpectedBase64,
+
+		// Reject the arbitrary-precision integer tags because they can't be faithfully
+		// roundtripped through the allowable Unstructured types.
+		BignumTag: cbor.BignumTagForbidden,
+
+		// Reject anything other than the simple values true, false, and null.
+		SimpleValues: simpleValues,
+
+		// Disable default recognition of types implementing encoding.BinaryUnmarshaler,
+		// which is not recognized for JSON decoding.
+		BinaryUnmarshaler: cbor.BinaryUnmarshalerNone,
+
+		// Marshal types that implement encoding.TextMarshaler by calling their MarshalText
+		// method and encoding the result to a CBOR text string.
+		TextUnmarshaler: cbor.TextUnmarshalerTextString,
+	}.DecMode()
+	if err != nil {
+		panic(err)
+	}
+	return decode
+}()
+
+var Decode cbor.DecMode = func() cbor.DecMode {
+	opts := decode.DecOptions()
+	// When decoding into a value of a type that implements json.Unmarshaler (and does not
+	// implement cbor.Unmarshaler), transcode the input to JSON and pass it to the value's
+	// UnmarshalJSON method.
+	opts.JSONUnmarshalerTranscoder = TranscodeFunc(TranscodeToJSON)
+	dm, err := opts.DecMode()
+	if err != nil {
+		panic(err)
+	}
+	return dm
+}()
+
+// DecodeLax is derived from Decode, but does not complain about unknown fields in the input.
+var DecodeLax cbor.DecMode = func() cbor.DecMode {
+	opts := Decode.DecOptions()
+	opts.ExtraReturnErrors &^= cbor.ExtraDecErrorUnknownField // clear bit
+	dm, err := opts.DecMode()
+	if err != nil {
+		panic(err)
+	}
+	return dm
+}()
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode_test.go
new file mode 100644
index 0000000000..e605981800
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode_test.go
@@ -0,0 +1,851 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes_test
+
+import (
+	"encoding/hex"
+	"fmt"
+	"math"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/google/go-cmp/cmp"
+)
+
+type int64BinaryUnmarshaler int64
+
+func (i *int64BinaryUnmarshaler) UnmarshalBinary(_ []byte) error {
+	return nil
+}
+
+func TestDecode(t *testing.T) {
+	hex := func(h string) []byte {
+		b, err := hex.DecodeString(h)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return b
+	}
+
+	type test struct {
+		name          string
+		modes         []cbor.DecMode // most tests should run for all modes
+		in            []byte
+		into          interface{} // prototype for concrete destination type. if nil, decode into empty interface value.
+		want          interface{}
+		assertOnError func(t *testing.T, e error)
+	}
+
+	// Test cases are grouped by the kind of the CBOR data item being decoded, as enumerated in
+	// https://www.rfc-editor.org/rfc/rfc8949.html#section-2.
+	group := func(t *testing.T, name string, tests []test) {
+		t.Run(name, func(t *testing.T) {
+			for _, test := range tests {
+				t.Run(test.name, func(t *testing.T) {
+					decModes := test.modes
+					if len(decModes) == 0 {
+						decModes = allDecModes
+					}
+
+					for _, decMode := range decModes {
+						modeName, ok := decModeNames[decMode]
+						if !ok {
+							t.Fatal("test case configured to run against unrecognized mode")
+						}
+
+						t.Run(fmt.Sprintf("%s/mode=%s", test.name, modeName), func(t *testing.T) {
+							var dst reflect.Value
+							if test.into == nil {
+								var i interface{}
+								dst = reflect.ValueOf(&i)
+							} else {
+								dst = reflect.New(reflect.TypeOf(test.into))
+							}
+							err := decMode.Unmarshal(test.in, dst.Interface())
+							test.assertOnError(t, err)
+							if err == nil {
+								if diff := cmp.Diff(test.want, dst.Elem().Interface()); diff != "" {
+									t.Errorf("unexpected output:\n%s", diff)
+								}
+							}
+						})
+					}
+				})
+			}
+		})
+	}
+
+	group(t, "unsigned integer", []test{
+		{
+			name:          "unsigned integer decodes to interface{} as int64",
+			in:            hex("0a"), // 10
+			want:          int64(10),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "int64 minimum positive value",
+			in:            hex("00"), // 0
+			want:          int64(0),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "int64 max positive value",
+			in:            hex("1b7fffffffffffffff"), // 9223372036854775807
+			want:          int64(9223372036854775807),
+			assertOnError: assertNilError,
+		},
+		{
+			name: "max positive integer value supported by cbor: 2^64 - 1",
+			in:   hex("1bffffffffffffffff"), // 18446744073709551615
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnmarshalTypeError) {
+				if e == nil {
+					t.Error("expected non-nil error")
+				} else if want := "cbor: cannot unmarshal positive integer into Go value of type int64 (18446744073709551615 overflows Go's int64)"; want != e.Error() {
+					t.Errorf("want error %q, got %q", want, e.Error())
+				}
+			}),
+		},
+	})
+
+	group(t, "negative integer", []test{
+		{
+			name:          "int64 max negative value",
+			in:            hex("20"), // -1
+			want:          int64(-1),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "int64 min negative value",
+			in:            hex("3b7fffffffffffffff"), // -9223372036854775808
+			want:          int64(-9223372036854775808),
+			assertOnError: assertNilError,
+		},
+		{
+			name: "min negative integer value supported by cbor: -2^64",
+			in:   hex("3bffffffffffffffff"), // -18446744073709551616
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnmarshalTypeError) {
+				if e == nil {
+					t.Error("expected non-nil error")
+				} else if want := "cbor: cannot unmarshal negative integer into Go value of type int64 (-18446744073709551616 overflows Go's int64)"; want != e.Error() {
+					t.Errorf("want error %q, got %q", want, e.Error())
+				}
+			}),
+		},
+	})
+
+	group(t, "byte string", []test{
+		{
+			name:          "empty byte string",
+			in:            hex("40"), // ''
+			want:          "",
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "byte string into []byte assumes base64",
+			in:            []byte("\x48AQIDBA=="), // 'AQIDBA=='
+			into:          []byte{},
+			want:          []byte{0x01, 0x02, 0x03, 0x04},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "byte string into []byte errors on invalid base64",
+			in:            hex("41ff"), // h'ff'
+			into:          []byte{},
+			assertOnError: assertErrorMessage("cbor: failed to decode base64 from byte string: illegal base64 data at input byte 0"),
+		},
+		{
+			name:          "empty byte string into []byte assumes base64",
+			in:            hex("40"), // ''
+			into:          []byte{},
+			want:          []byte{},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "byte string with expected encoding tag into []byte does not convert",
+			in:            hex("d64401020304"), // 22(h'01020304')
+			into:          []byte{},
+			want:          []byte{0x01, 0x02, 0x03, 0x04},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "byte string with expected encoding tag into string converts",
+			in:            hex("d64401020304"), // 22(h'01020304')
+			into:          "",
+			want:          "AQIDBA==",
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "byte string with expected encoding tag into interface{} converts",
+			in:            hex("d64401020304"), // 22(h'01020304')
+			want:          "AQIDBA==",
+			assertOnError: assertNilError,
+		},
+		{
+			name: "into non-string type implementing BinaryUnmarshaler",
+			in:   hex("40"), // ''
+			into: int64BinaryUnmarshaler(7),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnmarshalTypeError) {
+				want := &cbor.UnmarshalTypeError{
+					CBORType: "byte string",
+					GoType:   reflect.TypeFor[int64BinaryUnmarshaler]().String(),
+				}
+				if e.CBORType != want.CBORType || e.GoType != want.GoType {
+					t.Errorf("expected %q, got %q", want, e)
+				}
+			}),
+		},
+		{
+			name:          "text unmarshaler",
+			in:            hex("4161"),
+			into:          &RoundtrippableText{},
+			want:          &RoundtrippableText{Text: "a"},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "json unmarshaler",
+			in:            hex("4161"),
+			into:          &RoundtrippableJSON{},
+			want:          &RoundtrippableJSON{Raw: `"a"`},
+			assertOnError: assertNilError,
+		},
+	})
+
+	group(t, "text string", []test{
+		{
+			name: "reject text string containing invalid utf-8 sequence",
+			in:   hex("6180"), // text string beginning with continuation byte 0x80
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.SemanticError) {
+				const expected = "cbor: invalid UTF-8 string"
+				if msg := e.Error(); msg != expected {
+					t.Errorf("expected %v, got %v", expected, msg)
+				}
+			}),
+		},
+		{
+			name:          "indefinite-length text string",
+			in:            hex("7f616161626163ff"), // (_ "a", "b", "c")
+			want:          "abc",
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "empty text string",
+			in:            hex("60"), // ""
+			want:          "",
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "text unmarshaler",
+			in:            hex("6161"),
+			into:          &RoundtrippableText{},
+			want:          &RoundtrippableText{Text: "a"},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "json unmarshaler",
+			in:            hex("6161"),
+			into:          &RoundtrippableJSON{},
+			want:          &RoundtrippableJSON{Raw: `"a"`},
+			assertOnError: assertNilError,
+		},
+	})
+
+	group(t, "array", []test{
+		{
+			name: "nested indefinite-length array",
+			in:   hex("9f9f8080ff9f8080ffff"), // [_ [_ [] []] [_ [][]]]
+			want: []interface{}{
+				[]interface{}{[]interface{}{}, []interface{}{}},
+				[]interface{}{[]interface{}{}, []interface{}{}},
+			},
+			assertOnError: assertNilError,
+		},
+	})
+
+	group(t, "map", []test{
+		{
+			name:          "reject duplicate negative int keys into struct",
+			modes:         []cbor.DecMode{modes.DecodeLax},
+			in:            hex("a220012002"), // {-1: 1, -1: 2}
+			into:          struct{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: int64(-1), Index: 1}),
+		},
+		{
+			name:          "reject duplicate negative int keys into map",
+			in:            hex("a220012002"), // {-1: 1, -1: 2}
+			into:          map[int64]interface{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: int64(-1), Index: 1}),
+		},
+		{
+			name:          "reject duplicate positive int keys into struct",
+			modes:         []cbor.DecMode{modes.DecodeLax},
+			in:            hex("a201010102"), // {1: 1, 1: 2}
+			into:          struct{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: int64(1), Index: 1}),
+		},
+		{
+			name:          "reject duplicate positive int keys into map",
+			in:            hex("a201010102"), // {1: 1, 1: 2}
+			into:          map[int64]interface{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: int64(1), Index: 1}),
+		},
+		{
+			name: "reject duplicate text string keys into struct",
+			in:   hex("a2614101614102"), // {"A": 1, "A": 2}
+			into: struct {
+				A int `json:"A"`
+			}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("A"), Index: 1}),
+		},
+		{
+			name:          "reject duplicate text string keys into map",
+			in:            hex("a2614101614102"), // {"A": 1, "A": 2}
+			into:          map[string]interface{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("A"), Index: 1}),
+		},
+		{
+			name:          "reject duplicate byte string keys into map",
+			in:            hex("a2414101414102"), // {'A': 1, 'A': 2}
+			into:          map[string]interface{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("A"), Index: 1}),
+		},
+		{
+			name: "reject duplicate byte string keys into struct",
+			in:   hex("a2414101414102"), // {'A': 1, 'A': 2}
+			into: struct {
+				A int `json:"A"`
+			}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("A"), Index: 1}),
+		},
+		{
+			name:          "reject duplicate byte string and text string keys into map",
+			in:            hex("a2414101614102"), // {'A': 1, "A": 2}
+			into:          map[string]interface{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("A"), Index: 1}),
+		},
+		{
+			name: "reject duplicate byte string and text string keys into struct",
+			in:   hex("a2414101614102"), // {'A': 1, "A": 2}
+			into: struct {
+				A int `json:"A"`
+			}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("A"), Index: 1}),
+		},
+		{
+			name: "reject two identical indefinite-length byte string keys split into chunks differently into struct",
+			in:   hex("a25f426865436c6c6fff015f416844656c6c6fff02"), // {(_ 'he', 'llo'): 1, (_ 'h', 'ello'): 2}
+			into: struct {
+				Hello int `json:"hello"`
+			}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("hello"), Index: 1}),
+		},
+		{
+			name:          "reject two identical indefinite-length byte string keys split into chunks differently into map",
+			in:            hex("a25f426865436c6c6fff015f416844656c6c6fff02"), // {(_ 'he', 'llo'): 1, (_ 'h', 'ello'): 2}
+			into:          map[string]interface{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("hello"), Index: 1}),
+		},
+		{
+			name: "reject two identical indefinite-length text string keys split into chunks differently into struct",
+			in:   hex("a27f626865636c6c6fff017f616864656c6c6fff02"), // {(_ "he", "llo"): 1, (_ "h", "ello"): 2}
+			into: struct {
+				Hello int `json:"hello"`
+			}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("hello"), Index: 1}),
+		},
+		{
+			name:          "reject two identical indefinite-length text string keys split into chunks differently into map",
+			modes:         []cbor.DecMode{modes.DecodeLax},
+			in:            hex("a27f626865636c6c6fff017f616864656c6c6fff02"), // {(_ "he", "llo"): 1, (_ "h", "ello"): 2}
+			into:          map[string]interface{}{},
+			assertOnError: assertIdenticalError(&cbor.DupMapKeyError{Key: string("hello"), Index: 1}),
+		},
+		{
+			name:  "case-insensitive match treated as unknown field",
+			modes: []cbor.DecMode{modes.Decode},
+			in:    hex("a1614101"), // {"A": 1}
+			into: struct {
+				A int `json:"a"`
+			}{},
+			assertOnError: assertIdenticalError(&cbor.UnknownFieldError{Index: 0}),
+		},
+		{
+			name:  "case-insensitive match ignored in lax mode",
+			modes: []cbor.DecMode{modes.DecodeLax},
+			in:    hex("a1614101"), // {"A": 1}
+			into: struct {
+				A int `json:"a"`
+			}{},
+			want: struct {
+				A int `json:"a"`
+			}{
+				A: 0,
+			},
+			assertOnError: assertNilError,
+		},
+		{
+			name:  "case-insensitive match after exact match treated as unknown field",
+			modes: []cbor.DecMode{modes.Decode},
+			in:    hex("a2616101614102"), // {"a": 1, "A": 2}
+			into: struct {
+				A int `json:"a"`
+			}{},
+			want: struct {
+				A int `json:"a"`
+			}{
+				A: 1,
+			},
+			assertOnError: assertIdenticalError(&cbor.UnknownFieldError{Index: 1}),
+		},
+		{
+			name:  "case-insensitive match after exact match ignored in lax mode",
+			modes: []cbor.DecMode{modes.DecodeLax},
+			in:    hex("a2616101614102"), // {"a": 1, "A": 2}
+			into: struct {
+				A int `json:"a"`
+			}{},
+			want: struct {
+				A int `json:"a"`
+			}{
+				A: 1,
+			},
+			assertOnError: assertNilError,
+		},
+		{
+			name:  "case-insensitive match before exact match treated as unknown field",
+			modes: []cbor.DecMode{modes.Decode},
+			in:    hex("a2614101616102"), // {"A": 1, "a": 2}
+			into: struct {
+				A int `json:"a"`
+			}{},
+			assertOnError: assertIdenticalError(&cbor.UnknownFieldError{Index: 0}),
+		},
+		{
+			name:  "case-insensitive match before exact match ignored in lax mode",
+			modes: []cbor.DecMode{modes.DecodeLax},
+			in:    hex("a2614101616102"), // {"A": 1, "a": 2}
+			into: struct {
+				A int `json:"a"`
+			}{},
+			want: struct {
+				A int `json:"a"`
+			}{
+				A: 2,
+			},
+			assertOnError: assertNilError,
+		},
+		{
+			name:  "unknown field error",
+			modes: []cbor.DecMode{modes.Decode},
+			in:    hex("a1616101"), // {"a": 1}
+			into:  struct{}{},
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnknownFieldError) {
+				if e.Index != 0 {
+					t.Errorf("expected %#v, got %#v", &cbor.UnknownFieldError{Index: 0}, e)
+				}
+			}),
+		},
+		{
+			name:          "no unknown field error in lax mode",
+			modes:         []cbor.DecMode{modes.DecodeLax},
+			in:            hex("a1616101"), // {"a": 1}
+			into:          struct{}{},
+			want:          struct{}{},
+			assertOnError: assertNilError,
+		},
+		{
+			name: "nested indefinite-length map",
+			in:   hex("bf6141bf616101616202ff6142bf616901616a02ffff"), // {_ "A": {_ "a": 1, "b": 2}, "B": {_ "i": 1, "j": 2}}
+			want: map[string]interface{}{
+				"A": map[string]interface{}{"a": int64(1), "b": int64(2)},
+				"B": map[string]interface{}{"i": int64(1), "j": int64(2)},
+			},
+			assertOnError: assertNilError,
+		},
+		{
+			name: "map with non-string key types",
+			in:   hex("a1fb40091eb851eb851f63706965"), // {3.14: "pie"}
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnmarshalTypeError) {
+				if e.CBORType != "primitives" || e.GoType != "string" {
+					t.Errorf("expected %q, got %q", &cbor.UnmarshalTypeError{CBORType: "primitives", GoType: "string"}, e)
+				}
+			}),
+		},
+		{
+			name:          "map with byte string key",
+			in:            hex("a143abcdef187b"), // {h'abcdef': 123}
+			want:          map[string]interface{}{"\xab\xcd\xef": int64(123)},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "map with text string key",
+			in:            hex("a143414243187b"), // {"ABC": 123}
+			want:          map[string]interface{}{"ABC": int64(123)},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "map with mixed string key types",
+			in:            hex("a243abcdef187b43414243187c"), // {h'abcdef': 123, "ABC": 124}
+			want:          map[string]interface{}{"\xab\xcd\xef": int64(123), "ABC": int64(124)},
+			assertOnError: assertNilError,
+		},
+	})
+
+	group(t, "floating-point number", []test{
+		{
+			name: "half precision infinity",
+			in:   hex("f97c00"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "single precision infinity",
+			in:   hex("fa7f800000"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "double precision infinity",
+			in:   hex("fb7ff0000000000000"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "half precision negative infinity",
+			in:   hex("f9fc00"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "single precision negative infinity",
+			in:   hex("faff800000"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "double precision negative infinity",
+			in:   hex("fbfff0000000000000"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "half precision NaN",
+			in:   hex("f97e00"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point NaN"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "single precision NaN",
+			in:   hex("fa7fc00000"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point NaN"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name: "double precision NaN",
+			in:   hex("fb7ff8000000000000"),
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point NaN"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+		{
+			name:          "smallest nonzero float64",
+			in:            hex("fb0000000000000001"),
+			want:          float64(math.SmallestNonzeroFloat64),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "max float64 value",
+			in:            hex("fb7fefffffffffffff"),
+			want:          float64(math.MaxFloat64),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "max float32 value as double precision",
+			in:            hex("fb47efffffe0000000"),
+			want:          float64(math.MaxFloat32),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "max float32 value as single precision",
+			in:            hex("fa7f7fffff"),
+			want:          float64(math.MaxFloat32),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "half precision",
+			in:            hex("f94200"),
+			want:          float64(3),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "double precision without fractional component",
+			in:            hex("fb4000000000000000"),
+			want:          float64(2),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "single precision without fractional component",
+			in:            hex("fa40000000"),
+			want:          float64(2),
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "half precision without fractional component",
+			in:            hex("f94000"),
+			want:          float64(2),
+			assertOnError: assertNilError,
+		},
+	})
+
+	group(t, "simple value", append([]test{
+		{
+			name:          "simple value 20",
+			in:            hex("f4"), // false
+			want:          false,
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "simple value 21",
+			in:            hex("f5"), // true
+			want:          true,
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "simple value 22",
+			in:            hex("f6"), // nil
+			want:          nil,
+			assertOnError: assertNilError,
+		},
+		{
+			name: "simple value 23",
+			in:   hex("f7"), // undefined
+			assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+				if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "simple value 23 is not recognized"}, e); diff != "" {
+					t.Errorf("unexpected error diff:\n%s", diff)
+				}
+			}),
+		},
+	}, func() (generated []test) {
+		// Generate test cases for all simple values (0 to 255) because the number of possible simple values is fixed and small.
+		for i := 0; i <= 255; i++ {
+			each := test{
+				name: fmt.Sprintf("simple value %d", i),
+			}
+			if i <= 23 {
+				each.in = []byte{byte(0xe0) | byte(i)}
+			} else {
+				// larger simple values encode to two bytes
+				each.in = []byte{byte(0xe0) | byte(24), byte(i)}
+			}
+			switch i {
+			case 20, 21, 22, 23: // recognized values with explicit cases
+				continue
+			case 24, 25, 26, 27, 28, 29, 30, 31: // reserved
+				// these are considered not well-formed
+				each.assertOnError = assertOnConcreteError(func(t *testing.T, e *cbor.SyntaxError) {
+					if e == nil {
+						t.Error("expected non-nil error")
+					} else if want := fmt.Sprintf("cbor: invalid simple value %d for type primitives", i); want != e.Error() {
+						t.Errorf("want error %q, got %q", want, e.Error())
+					}
+				})
+			default:
+				// reject all unrecognized simple values
+				each.assertOnError = assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+					if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: fmt.Sprintf("simple value %d is not recognized", i)}, e); diff != "" {
+						t.Errorf("unexpected error diff:\n%s", diff)
+					}
+				})
+			}
+			generated = append(generated, each)
+		}
+		return
+	}()...))
+
+	t.Run("tag", func(t *testing.T) {
+		group(t, "rfc3339 time", []test{
+			{
+				name:          "tag 0 RFC3339 text string",
+				in:            hex("c074323030362d30312d30325431353a30343a30355a"), // 0("2006-01-02T15:04:05Z")
+				want:          "2006-01-02T15:04:05Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 0 byte string",
+				in:            hex("c054323030362d30312d30325431353a30343a30355a"), // 0('2006-01-02T15:04:05Z')
+				want:          "2006-01-02T15:04:05Z",
+				assertOnError: assertErrorMessage("cbor: tag number 0 must be followed by text string, got byte string"),
+			},
+			{
+				name:          "tag 0 non-RFC3339 text string",
+				in:            hex("c06474657874"), // 0("text")
+				assertOnError: assertErrorMessage(`cbor: cannot set text for time.Time: parsing time "text" as "2006-01-02T15:04:05Z07:00": cannot parse "text" as "2006"`),
+			},
+		})
+
+		group(t, "epoch time", []test{
+			{
+				name:          "tag 1 timestamp unsigned integer",
+				in:            hex("c11a43b940e5"), // 1(1136214245)
+				want:          "2006-01-02T15:04:05Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 1 with float16 value",
+				in:            hex("c1f93c00"), // 1(1.0_1)
+				want:          "1970-01-01T00:00:01Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 1 with float32 value",
+				in:            hex("c1fa3f800000"), // 1(1.0_2)
+				want:          "1970-01-01T00:00:01Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 1 with float64 value",
+				in:            hex("c1fb3ff0000000000000"), // 1(1.0_3)
+				want:          "1970-01-01T00:00:01Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 1 with a five digit year",
+				in:            hex("c11b0000003afff44181"), // 1(253402300801)
+				want:          "10000-01-01T00:00:01Z",
+				assertOnError: assertErrorMessage("cbor: decoded time cannot be represented in RFC3339 format with sub-second precision: Time.MarshalText: year outside of range [0,9999]"),
+			},
+			{
+				name:          "tag 1 with a negative integer value",
+				in:            hex("c120"), // 1(-1)
+				want:          "1969-12-31T23:59:59Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 1 with a negative float16 value",
+				in:            hex("c1f9bc00"), // 1(-1.0_1)
+				want:          "1969-12-31T23:59:59Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 1 with a negative float32 value",
+				in:            hex("c1fabf800000"), // 1(-1.0_2)
+				want:          "1969-12-31T23:59:59Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "tag 1 with a negative float64 value",
+				in:            hex("c1fbbff0000000000000"), // 1(-1.0_3)
+				want:          "1969-12-31T23:59:59Z",
+				assertOnError: assertNilError,
+			},
+			{
+				name: "tag 1 with a positive infinity",
+				in:   hex("c1f97c00"), // 1(Infinity)
+				assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+					if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+						t.Errorf("unexpected error diff:\n%s", diff)
+					}
+				}),
+			},
+			{
+				name: "tag 1 with a negative infinity",
+				in:   hex("c1f9fc00"), // 1(-Infinity)
+				assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+					if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point infinity"}, e); diff != "" {
+						t.Errorf("unexpected error diff:\n%s", diff)
+					}
+				}),
+			},
+			{
+				name: "tag 1 with NaN",
+				in:   hex("c1f97e00"), // 1(NaN)
+				assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+					if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "primitives", Message: "floating-point NaN"}, e); diff != "" {
+						t.Errorf("unexpected error diff:\n%s", diff)
+					}
+				}),
+			},
+		})
+
+		group(t, "unsigned bignum", []test{
+			{
+				name: "rejected",
+				in:   hex("c249010000000000000000"), // 2(18446744073709551616)
+				assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+					if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "tag", Message: "bignum"}, e); diff != "" {
+						t.Errorf("unexpected error diff:\n%s", diff)
+					}
+				}),
+			},
+		})
+
+		group(t, "negative bignum", []test{
+			{
+				name: "rejected",
+				in:   hex("c349010000000000000000"), // 3(-18446744073709551617)
+				assertOnError: assertOnConcreteError(func(t *testing.T, e *cbor.UnacceptableDataItemError) {
+					if diff := cmp.Diff(&cbor.UnacceptableDataItemError{CBORType: "tag", Message: "bignum"}, e); diff != "" {
+						t.Errorf("unexpected error diff:\n%s", diff)
+					}
+				}),
+			},
+		})
+
+		group(t, "unrecognized", []test{
+			{
+				name:          "decimal fraction",
+				in:            hex("c48221196ab3"), // 4([-2, 27315])
+				want:          []interface{}{int64(-2), int64(27315)},
+				assertOnError: assertNilError,
+			},
+			{
+				name:          "bigfloat",
+				in:            hex("c5822003"), // 5([-1, 3])
+				want:          []interface{}{int64(-1), int64(3)},
+				assertOnError: assertNilError,
+			},
+		})
+	})
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/diagnostic.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/diagnostic.go
new file mode 100644
index 0000000000..61f3f145f5
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/diagnostic.go
@@ -0,0 +1,36 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"github.com/fxamacker/cbor/v2"
+)
+
+var Diagnostic cbor.DiagMode = func() cbor.DiagMode {
+	opts := Decode.DecOptions()
+	diagnostic, err := cbor.DiagOptions{
+		ByteStringText: true,
+
+		MaxNestedLevels:  opts.MaxNestedLevels,
+		MaxArrayElements: opts.MaxArrayElements,
+		MaxMapPairs:      opts.MaxMapPairs,
+	}.DiagMode()
+	if err != nil {
+		panic(err)
+	}
+	return diagnostic
+}()
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode.go
new file mode 100644
index 0000000000..3287dfd31c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode.go
@@ -0,0 +1,185 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"io"
+
+	"github.com/fxamacker/cbor/v2"
+)
+
+// encode is the basis for the Encode mode, with no JSONMarshalerTranscoder
+// configured. TranscodeFromJSON uses this directly rather than Encode to avoid an initialization
+// cycle between the two. Everything else should use one of the exported EncModes.
+var encode = EncMode{
+	delegate: func() cbor.UserBufferEncMode {
+		encode, err := cbor.EncOptions{
+			// Map keys need to be sorted to have deterministic output, and this is the order
+			// defined in RFC 8949 4.2.1 "Core Deterministic Encoding Requirements".
+			Sort: cbor.SortBytewiseLexical,
+
+			// CBOR supports distinct types for IEEE-754 float16, float32, and float64. Store
+			// floats in the smallest width that preserves value so that equivalent float32 and
+			// float64 values encode to identical bytes, as they do in a JSON
+			// encoding. Satisfies one of the "Core Deterministic Encoding Requirements".
+			ShortestFloat: cbor.ShortestFloat16,
+
+			// Error on attempt to encode NaN and infinite values. This is what the JSON
+			// serializer does.
+			NaNConvert: cbor.NaNConvertReject,
+			InfConvert: cbor.InfConvertReject,
+
+			// Error on attempt to encode math/big.Int values, which can't be faithfully
+			// roundtripped through Unstructured in general (the dynamic numeric types allowed
+			// in Unstructured are limited to float64 and int64).
+			BigIntConvert: cbor.BigIntConvertReject,
+
+			// MarshalJSON for time.Time writes RFC3339 with nanos.
+			Time: cbor.TimeRFC3339Nano,
+
+			// The decoder must be able to accept RFC3339 strings with or without tag 0 (e.g. by
+			// the end of time.Time -> JSON -> Unstructured -> CBOR, the CBOR encoder has no
+			// reliable way of knowing that a particular string originated from serializing a
+			// time.Time), so producing tag 0 has little use.
+			TimeTag: cbor.EncTagNone,
+
+			// Indefinite-length items have multiple encodings and aren't being used anyway, so
+			// disable to avoid an opportunity for nondeterminism.
+			IndefLength: cbor.IndefLengthForbidden,
+
+			// Preserve distinction between nil and empty for slices and maps.
+			NilContainers: cbor.NilContainerAsNull,
+
+			// OK to produce tags.
+			TagsMd: cbor.TagsAllowed,
+
+			// Use the same definition of "empty" as encoding/json.
+			OmitEmpty: cbor.OmitEmptyGoValue,
+
+			// The CBOR types text string and byte string are structurally equivalent, with the
+			// semantic difference that a text string whose content is an invalid UTF-8 sequence
+			// is itself invalid. We reject all invalid text strings at decode time and do not
+			// validate or sanitize all Go strings at encode time. Encoding Go strings to the
+			// byte string type is comparable to the existing Protobuf behavior and cheaply
+			// ensures that the output is valid CBOR.
+			String: cbor.StringToByteString,
+
+			// Encode struct field names to the byte string type rather than the text string
+			// type.
+			FieldName: cbor.FieldNameToByteString,
+
+			// Marshal Go byte arrays to CBOR arrays of integers (as in JSON) instead of byte
+			// strings.
+			ByteArray: cbor.ByteArrayToArray,
+
+			// Marshal []byte to CBOR byte string enclosed in tag 22 (expected later base64
+			// encoding, https://www.rfc-editor.org/rfc/rfc8949.html#section-3.4.5.2), to
+			// interoperate with the existing JSON behavior. This indicates to the decoder that,
+			// when decoding into a string (or unstructured), the resulting value should be the
+			// base64 encoding of the original bytes. No base64 encoding or decoding needs to be
+			// performed for []byte-to-CBOR-to-[]byte roundtrips.
+			ByteSliceLaterFormat: cbor.ByteSliceLaterFormatBase64,
+
+			// Disable default recognition of types implementing encoding.BinaryMarshaler, which
+			// is not recognized for JSON encoding.
+			BinaryMarshaler: cbor.BinaryMarshalerNone,
+
+			// Unmarshal into types that implement encoding.TextUnmarshaler by passing
+			// the contents of a CBOR string to their UnmarshalText method.
+			TextMarshaler: cbor.TextMarshalerTextString,
+		}.UserBufferEncMode()
+		if err != nil {
+			panic(err)
+		}
+		return encode
+	}(),
+	deterministic: true,
+}
+
+var Encode = EncMode{
+	delegate: func() cbor.UserBufferEncMode {
+		opts := encode.options()
+		// To encode a value of a type that implements json.Marshaler (and does not
+		// implement cbor.Marshaler), transcode the result of calling its MarshalJSON method
+		// directly to CBOR.
+		opts.JSONMarshalerTranscoder = TranscodeFunc(TranscodeFromJSON)
+		em, err := opts.UserBufferEncMode()
+		if err != nil {
+			panic(err)
+		}
+		return em
+	}(),
+	deterministic: true,
+}
+
+var EncodeNondeterministic = EncMode{
+	delegate: func() cbor.UserBufferEncMode {
+		opts := Encode.options()
+		opts.Sort = cbor.SortFastShuffle
+		em, err := opts.UserBufferEncMode()
+		if err != nil {
+			panic(err)
+		}
+		return em
+	}(),
+	deterministic: false,
+}
+
+type EncMode struct {
+	delegate      cbor.UserBufferEncMode
+	deterministic bool
+}
+
+func (em EncMode) options() cbor.EncOptions {
+	return em.delegate.EncOptions()
+}
+
+func (em EncMode) IsDeterministic() bool {
+	return em.deterministic
+}
+
+func (em EncMode) MarshalTo(v interface{}, w io.Writer) error {
+	if buf, ok := w.(*buffer); ok {
+		return em.delegate.MarshalToBuffer(v, &buf.Buffer)
+	}
+
+	buf := buffers.Get()
+	defer buffers.Put(buf)
+	if err := em.delegate.MarshalToBuffer(v, &buf.Buffer); err != nil {
+		return err
+	}
+
+	if _, err := io.Copy(w, buf); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (em EncMode) Marshal(v interface{}) ([]byte, error) {
+	buf := buffers.Get()
+	defer buffers.Put(buf)
+
+	if err := em.MarshalTo(v, &buf.Buffer); err != nil {
+		return nil, err
+	}
+
+	clone := make([]byte, buf.Len())
+	copy(clone, buf.Bytes())
+
+	return clone, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode_test.go
new file mode 100644
index 0000000000..5c557b7365
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode_test.go
@@ -0,0 +1,132 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes_test
+
+import (
+	"fmt"
+	"math/big"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/google/go-cmp/cmp"
+)
+
+type int64BinaryMarshaler int64
+
+func (i int64BinaryMarshaler) MarshalBinary() ([]byte, error) {
+	return []byte{}, nil
+}
+
+func TestEncode(t *testing.T) {
+	for _, tc := range []struct {
+		name          string
+		modes         []modes.EncMode
+		in            interface{}
+		want          []byte
+		assertOnError func(t *testing.T, e error)
+	}{
+		{
+			name:          "implementations of BinaryMarshaler are ignored",
+			in:            int64BinaryMarshaler(7),
+			want:          []byte{0x07},
+			assertOnError: assertNilError,
+		},
+		{
+			name: "all duplicate fields are ignored", // Matches behavior of JSON serializer.
+			in: struct {
+				A1 int `json:"a"`
+				A2 int `json:"a"` //nolint:govet // This is intentional to test that the encoder will not encode two map entries with the same key.
+			}{},
+			want:          []byte{0xa0}, // {}
+			assertOnError: assertNilError,
+		},
+		{
+			name: "only tagged field is considered if any are tagged", // Matches behavior of JSON serializer.
+			in: struct {
+				A       int
+				TaggedA int `json:"A"`
+			}{
+				A:       1,
+				TaggedA: 2,
+			},
+			want:          []byte{0xa1, 0x41, 0x41, 0x02}, // {"A": 2}
+			assertOnError: assertNilError,
+		},
+		{
+			name: "math/big.Int values are rejected",
+			in:   big.NewInt(1),
+			assertOnError: assertOnConcreteError(func(t *testing.T, got *cbor.UnsupportedTypeError) {
+				if want := (&cbor.UnsupportedTypeError{Type: reflect.TypeFor[big.Int]()}); *want != *got {
+					t.Errorf("unexpected error, got %#v (%q), want %#v (%q)", got, got.Error(), want, want.Error())
+				}
+			}),
+		},
+		{
+			name:          "byte array encodes to array of integers",
+			in:            [3]byte{0x01, 0x02, 0x03},
+			want:          []byte{0x83, 0x01, 0x02, 0x03}, // [1, 2, 3]
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "string marshalled to byte string",
+			in:            "hello",
+			want:          []byte{0x45, 'h', 'e', 'l', 'l', 'o'},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "[]byte marshalled to byte string in expected base64 encoding tag",
+			in:            []byte("hello"),
+			want:          []byte{0xd6, 0x45, 'h', 'e', 'l', 'l', 'o'},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "text marshaler",
+			in:            &RoundtrippableText{Text: "a"},
+			want:          []byte{0x61, 0x61},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "json marshaler",
+			in:            &RoundtrippableJSON{Raw: `"a"`},
+			want:          []byte{0x41, 0x61},
+			assertOnError: assertNilError,
+		},
+	} {
+		encModes := tc.modes
+		if len(encModes) == 0 {
+			encModes = allEncModes
+		}
+
+		for _, encMode := range encModes {
+			modeName, ok := encModeNames[encMode]
+			if !ok {
+				t.Fatal("test case configured to run against unrecognized mode")
+			}
+
+			t.Run(fmt.Sprintf("mode=%s/%s", modeName, tc.name), func(t *testing.T) {
+				out, err := encMode.Marshal(tc.in)
+				tc.assertOnError(t, err)
+				if diff := cmp.Diff(tc.want, out, cmp.Comparer(func(a, b reflect.Type) bool { return a == b })); diff != "" {
+					t.Errorf("unexpected output:\n%s", diff)
+				}
+			})
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/modes_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/modes_test.go
new file mode 100644
index 0000000000..c303cf5d88
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/modes_test.go
@@ -0,0 +1,83 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes_test
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/google/go-cmp/cmp"
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+)
+
+var encModeNames = map[modes.EncMode]string{
+	modes.Encode:                 "Encode",
+	modes.EncodeNondeterministic: "EncodeNondeterministic",
+}
+
+var allEncModes = []modes.EncMode{
+	modes.Encode,
+	modes.EncodeNondeterministic,
+}
+
+var decModeNames = map[cbor.DecMode]string{
+	modes.Decode:    "Decode",
+	modes.DecodeLax: "DecodeLax",
+}
+
+var allDecModes = []cbor.DecMode{
+	modes.Decode,
+	modes.DecodeLax,
+}
+
+func assertNilError(t *testing.T, e error) {
+	if e != nil {
+		t.Errorf("expected nil error, got: %v", e)
+	}
+}
+
+func assertOnConcreteError[E error](fn func(*testing.T, E)) func(t *testing.T, e error) {
+	return func(t *testing.T, ei error) {
+		var ec E
+		if !errors.As(ei, &ec) {
+			t.Errorf("expected concrete error type %T, got %T: %v", ec, ei, ei)
+			return
+		}
+		fn(t, ec)
+	}
+}
+
+func assertErrorMessage(want string) func(*testing.T, error) {
+	return func(t *testing.T, got error) {
+		if got == nil {
+			t.Error("expected non-nil error")
+			return
+		}
+		if got.Error() != want {
+			t.Errorf("got error %q, want %q", got.Error(), want)
+		}
+	}
+}
+
+func assertIdenticalError[E error](expected E) func(*testing.T, error) {
+	return assertOnConcreteError(func(t *testing.T, actual E) {
+		if diff := cmp.Diff(expected, actual); diff != "" {
+			t.Errorf("diff between actual error and expected error:\n%s", diff)
+		}
+	})
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/roundtrip_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/roundtrip_test.go
new file mode 100644
index 0000000000..e99f427127
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/roundtrip_test.go
@@ -0,0 +1,449 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes_test
+
+import (
+	"encoding/base64"
+	"fmt"
+	"math"
+	"reflect"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/google/go-cmp/cmp"
+)
+
+func nilPointerFor[T interface{}]() *T {
+	return nil
+}
+
+type RoundtrippableText struct{ Text string }
+
+func (rt RoundtrippableText) MarshalText() ([]byte, error) {
+	return []byte(rt.Text), nil
+}
+
+func (rt *RoundtrippableText) UnmarshalText(text []byte) error {
+	rt.Text = string(text)
+	return nil
+}
+
+type RoundtrippableJSON struct{ Raw string }
+
+func (rj RoundtrippableJSON) MarshalJSON() ([]byte, error) {
+	return []byte(rj.Raw), nil
+}
+
+func (rj *RoundtrippableJSON) UnmarshalJSON(raw []byte) error {
+	rj.Raw = string(raw)
+	return nil
+}
+
+// TestRoundtrip roundtrips object serialization to interface{} and back via CBOR.
+func TestRoundtrip(t *testing.T) {
+	type modePair struct {
+		enc modes.EncMode
+		dec cbor.DecMode
+	}
+
+	for _, tc := range []struct {
+		name      string
+		modePairs []modePair
+		obj       interface{}
+	}{
+		{
+			name: "nil slice",
+			obj:  []interface{}(nil),
+		},
+		{
+			name: "byte array",
+			obj:  [3]byte{0x01, 0x02, 0x03},
+		},
+		{
+			name: "nil map",
+			obj:  map[string]interface{}(nil),
+		},
+		{
+			name: "empty slice",
+			obj:  []interface{}{},
+		},
+		{
+			name: "empty map",
+			obj:  map[string]interface{}{},
+		},
+		{
+			name: "nil pointer to slice",
+			obj:  nilPointerFor[[]interface{}](),
+		},
+		{
+			name: "nil pointer to map",
+			obj:  nilPointerFor[map[string]interface{}](),
+		},
+		{
+			name: "nonempty string",
+			obj:  "hello world",
+		},
+		{
+			name: "empty string",
+			obj:  "",
+		},
+		{
+			name: "string containing invalid UTF-8 sequence",
+			obj:  "\x80", // first byte is a continuation byte
+		},
+		{
+			name: "true",
+			obj:  true,
+		},
+		{
+			name: "false",
+			obj:  false,
+		},
+		{
+			name: "int64",
+			obj:  int64(5),
+		},
+		{
+			name: "int64 max",
+			obj:  int64(math.MaxInt64),
+		},
+		{
+			name: "int64 min",
+			obj:  int64(math.MinInt64),
+		},
+		{
+			name: "int64 zero",
+			obj:  int64(math.MinInt64),
+		},
+		{
+			name: "uint64 zero",
+			obj:  uint64(0),
+		},
+		{
+			name: "int32 max",
+			obj:  int32(math.MaxInt32),
+		},
+		{
+			name: "int32 min",
+			obj:  int32(math.MinInt32),
+		},
+		{
+			name: "int32 zero",
+			obj:  int32(math.MinInt32),
+		},
+		{
+			name: "uint32 max",
+			obj:  uint32(math.MaxUint32),
+		},
+		{
+			name: "uint32 zero",
+			obj:  uint32(0),
+		},
+		{
+			name: "int16 max",
+			obj:  int16(math.MaxInt16),
+		},
+		{
+			name: "int16 min",
+			obj:  int16(math.MinInt16),
+		},
+		{
+			name: "int16 zero",
+			obj:  int16(math.MinInt16),
+		},
+		{
+			name: "uint16 max",
+			obj:  uint16(math.MaxUint16),
+		},
+		{
+			name: "uint16 zero",
+			obj:  uint16(0),
+		},
+		{
+			name: "int8 max",
+			obj:  int8(math.MaxInt8),
+		},
+		{
+			name: "int8 min",
+			obj:  int8(math.MinInt8),
+		},
+		{
+			name: "int8 zero",
+			obj:  int8(math.MinInt8),
+		},
+		{
+			name: "uint8 max",
+			obj:  uint8(math.MaxUint8),
+		},
+		{
+			name: "uint8 zero",
+			obj:  uint8(0),
+		},
+		{
+			name: "float64",
+			obj:  float64(2.71),
+		},
+		{
+			name: "float64 max",
+			obj:  float64(math.MaxFloat64),
+		},
+		{
+			name: "float64 smallest nonzero",
+			obj:  float64(math.SmallestNonzeroFloat64),
+		},
+		{
+			name: "float64 no fractional component",
+			obj:  float64(5),
+		},
+		{
+			name: "float32",
+			obj:  float32(2.71),
+		},
+		{
+			name: "float32 max",
+			obj:  float32(math.MaxFloat32),
+		},
+		{
+			name: "float32 smallest nonzero",
+			obj:  float32(math.SmallestNonzeroFloat32),
+		},
+		{
+			name: "float32 no fractional component",
+			obj:  float32(5),
+		},
+		{
+			name: "time.Time",
+			obj:  time.Date(2222, time.May, 4, 12, 13, 14, 123, time.UTC),
+		},
+		{
+			name: "int64 omitempty",
+			obj: struct {
+				V int64 `json:"v,omitempty"`
+			}{},
+		},
+		{
+			name: "float64 omitempty",
+			obj: struct {
+				V float64 `json:"v,omitempty"`
+			}{},
+		},
+		{
+			name: "string omitempty",
+			obj: struct {
+				V string `json:"v,omitempty"`
+			}{},
+		},
+		{
+			name: "bool omitempty",
+			obj: struct {
+				V bool `json:"v,omitempty"`
+			}{},
+		},
+		{
+			name: "nil pointer omitempty",
+			obj: struct {
+				V *struct{} `json:"v,omitempty"`
+			}{},
+		},
+		{
+			name: "nil pointer to slice as struct field",
+			obj: struct {
+				V *[]interface{} `json:"v"`
+			}{},
+		},
+		{
+			name: "nil pointer to slice as struct field with omitempty",
+			obj: struct {
+				V *[]interface{} `json:"v,omitempty"`
+			}{},
+		},
+		{
+			name: "nil pointer to map as struct field",
+			obj: struct {
+				V *map[string]interface{} `json:"v"`
+			}{},
+		},
+		{
+			name: "nil pointer to map as struct field with omitempty",
+			obj: struct {
+				V *map[string]interface{} `json:"v,omitempty"`
+			}{},
+		},
+		{
+			name: "textmarshaler and textunmarshaler",
+			obj:  RoundtrippableText{Text: "foo"},
+		},
+		{
+			name: "json marshaler and unmarshaler",
+			obj:  RoundtrippableJSON{Raw: `{"foo":[42,3.1,true,false,null]}`},
+		},
+	} {
+		modePairs := tc.modePairs
+		if len(modePairs) == 0 {
+			// Default is all modes to all modes.
+			modePairs = []modePair{}
+			for _, encMode := range allEncModes {
+				for _, decMode := range allDecModes {
+					modePairs = append(modePairs, modePair{enc: encMode, dec: decMode})
+				}
+			}
+		}
+
+		for _, modePair := range modePairs {
+			encModeName, ok := encModeNames[modePair.enc]
+			if !ok {
+				t.Fatal("test case configured to run against unrecognized encode mode")
+			}
+
+			decModeName, ok := decModeNames[modePair.dec]
+			if !ok {
+				t.Fatal("test case configured to run against unrecognized decode mode")
+			}
+
+			t.Run(fmt.Sprintf("enc=%s/dec=%s/%s", encModeName, decModeName, tc.name), func(t *testing.T) {
+				original := tc.obj
+
+				cborFromOriginal, err := modePair.enc.Marshal(original)
+				if err != nil {
+					t.Fatalf("unexpected error from Marshal of original: %v", err)
+				}
+
+				var iface interface{}
+				if err := modePair.dec.Unmarshal(cborFromOriginal, &iface); err != nil {
+					t.Fatalf("unexpected error from Unmarshal into %T: %v", &iface, err)
+				}
+
+				cborFromIface, err := modePair.enc.Marshal(iface)
+				if err != nil {
+					t.Fatalf("unexpected error from Marshal of iface: %v", err)
+				}
+
+				{
+					// interface{} to interface{}
+					var iface2 interface{}
+					if err := modePair.dec.Unmarshal(cborFromIface, &iface2); err != nil {
+						t.Fatalf("unexpected error from Unmarshal into %T: %v", &iface2, err)
+					}
+					if diff := cmp.Diff(iface, iface2); diff != "" {
+						t.Errorf("unexpected difference on roundtrip from interface{} to interface{}:\n%s", diff)
+					}
+				}
+
+				{
+					// original to original
+					final := reflect.New(reflect.TypeOf(original))
+					err = modePair.dec.Unmarshal(cborFromOriginal, final.Interface())
+					if err != nil {
+						t.Fatalf("unexpected error from Unmarshal into %T: %v", final.Interface(), err)
+					}
+					if diff := cmp.Diff(original, final.Elem().Interface()); diff != "" {
+						t.Errorf("unexpected difference on roundtrip from original to original:\n%s", diff)
+					}
+				}
+
+				{
+					// original to interface{} to original
+					finalViaIface := reflect.New(reflect.TypeOf(original))
+					err = modePair.dec.Unmarshal(cborFromIface, finalViaIface.Interface())
+					if err != nil {
+						t.Fatalf("unexpected error from Unmarshal into %T: %v", finalViaIface.Interface(), err)
+					}
+					if diff := cmp.Diff(original, finalViaIface.Elem().Interface()); diff != "" {
+						t.Errorf("unexpected difference on roundtrip from original to interface{} to original:\n%s", diff)
+					}
+				}
+			})
+		}
+	}
+}
+
+// TestRoundtripTextEncoding exercises roundtrips between []byte and string.
+func TestRoundtripTextEncoding(t *testing.T) {
+	for _, encMode := range allEncModes {
+		for _, decMode := range allDecModes {
+			t.Run(fmt.Sprintf("enc=%s/dec=%s/byte slice", encModeNames[encMode], decModeNames[decMode]), func(t *testing.T) {
+				original := []byte("foo")
+
+				c, err := encMode.Marshal(original)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				var unstructured interface{}
+				if err := decMode.Unmarshal(c, &unstructured); err != nil {
+					t.Fatal(err)
+				}
+				if diff := cmp.Diff(base64.StdEncoding.EncodeToString(original), unstructured); diff != "" {
+					t.Errorf("[]byte to interface{}: unexpected diff:\n%s", diff)
+				}
+
+				var s string
+				if err := decMode.Unmarshal(c, &s); err != nil {
+					t.Fatal(err)
+				}
+				if diff := cmp.Diff(base64.StdEncoding.EncodeToString(original), s); diff != "" {
+					t.Errorf("[]byte to string: unexpected diff:\n%s", diff)
+				}
+
+				var final []byte
+				if err := decMode.Unmarshal(c, &final); err != nil {
+					t.Fatal(err)
+				}
+				if diff := cmp.Diff(original, final); diff != "" {
+					t.Errorf("[]byte to []byte: unexpected diff:\n%s", diff)
+				}
+			})
+
+			t.Run(fmt.Sprintf("enc=%s/dec=%s/string", encModeNames[encMode], decModeNames[decMode]), func(t *testing.T) {
+				decoded := "foo"
+				original := base64.StdEncoding.EncodeToString([]byte(decoded)) // "Zm9v"
+
+				c, err := encMode.Marshal(original)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				var unstructured interface{}
+				if err := decMode.Unmarshal(c, &unstructured); err != nil {
+					t.Fatal(err)
+				}
+				if diff := cmp.Diff(original, unstructured); diff != "" {
+					t.Errorf("string to interface{}: unexpected diff:\n%s", diff)
+				}
+
+				var b []byte
+				if err := decMode.Unmarshal(c, &b); err != nil {
+					t.Fatal(err)
+				}
+				if diff := cmp.Diff([]byte(decoded), b); diff != "" {
+					t.Errorf("string to []byte: unexpected diff:\n%s", diff)
+				}
+
+				var final string
+				if err := decMode.Unmarshal(c, &final); err != nil {
+					t.Fatal(err)
+				}
+				if diff := cmp.Diff(original, final); diff != "" {
+					t.Errorf("string to string: unexpected diff:\n%s", diff)
+				}
+			})
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/transcoding.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/transcoding.go
new file mode 100644
index 0000000000..5620e9ccc9
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/transcoding.go
@@ -0,0 +1,108 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+
+	kjson "sigs.k8s.io/json"
+)
+
+type TranscodeFunc func(dst io.Writer, src io.Reader) error
+
+func (f TranscodeFunc) Transcode(dst io.Writer, src io.Reader) error {
+	return f(dst, src)
+}
+
+func TranscodeFromJSON(dst io.Writer, src io.Reader) error {
+	var tmp any
+	dec := kjson.NewDecoderCaseSensitivePreserveInts(src)
+	if err := dec.Decode(&tmp); err != nil {
+		return err
+	}
+	if err := dec.Decode(&struct{}{}); !errors.Is(err, io.EOF) {
+		return errors.New("extraneous data")
+	}
+
+	return encode.MarshalTo(tmp, dst)
+}
+
+func TranscodeToJSON(dst io.Writer, src io.Reader) error {
+	var tmp any
+	dec := decode.NewDecoder(src)
+	if err := dec.Decode(&tmp); err != nil {
+		return err
+	}
+	if err := dec.Decode(&struct{}{}); !errors.Is(err, io.EOF) {
+		return errors.New("extraneous data")
+	}
+
+	// Use an Encoder to avoid the extra []byte allocated by Marshal. Encode, unlike Marshal,
+	// appends a trailing newline to separate consecutive encodings of JSON values that aren't
+	// self-delimiting, like numbers. Strip the newline to avoid the assumption that every
+	// json.Unmarshaler implementation will accept trailing whitespace.
+	enc := json.NewEncoder(&trailingLinefeedSuppressor{delegate: dst})
+	enc.SetIndent("", "")
+	return enc.Encode(tmp)
+}
+
+// trailingLinefeedSuppressor is an io.Writer that wraps another io.Writer, suppressing a single
+// trailing linefeed if it is the last byte written by the latest call to Write.
+type trailingLinefeedSuppressor struct {
+	lf       bool
+	delegate io.Writer
+}
+
+func (w *trailingLinefeedSuppressor) Write(p []byte) (int, error) {
+	if len(p) == 0 {
+		// Avoid flushing a buffered linefeeds on an empty write.
+		return 0, nil
+	}
+
+	if w.lf {
+		// The previous write had a trailing linefeed that was buffered. That wasn't the
+		// last Write call, so flush the buffered linefeed before continuing.
+		n, err := w.delegate.Write([]byte{'\n'})
+		if n > 0 {
+			w.lf = false
+		}
+		if err != nil {
+			return 0, err
+		}
+	}
+
+	if p[len(p)-1] != '\n' {
+		return w.delegate.Write(p)
+	}
+
+	p = p[:len(p)-1]
+
+	if len(p) == 0 { // []byte{'\n'}
+		w.lf = true
+		return 1, nil
+	}
+
+	n, err := w.delegate.Write(p)
+	if n == len(p) {
+		// Everything up to the trailing linefeed has been flushed. Eat the linefeed.
+		w.lf = true
+		n++
+	}
+	return n, err
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/transcoding_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/transcoding_test.go
new file mode 100644
index 0000000000..3033b054e8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/transcoding_test.go
@@ -0,0 +1,291 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"errors"
+	"strings"
+	"testing"
+)
+
+func TestTranscodeFromJSON(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		json string
+		cbor string
+		err  error
+	}{
+		{
+			name: "whole number",
+			json: "42",
+			cbor: "\x18\x2a",
+		},
+		{
+			name: "decimal number",
+			json: "1.5",
+			cbor: "\xf9\x3e\x00",
+		},
+		{
+			name: "false",
+			json: "false",
+			cbor: "\xf4",
+		},
+		{
+			name: "true",
+			json: "true",
+			cbor: "\xf5",
+		},
+		{
+			name: "null",
+			json: "null",
+			cbor: "\xf6",
+		},
+		{
+			name: "string",
+			json: `"foo"`,
+			cbor: "\x43foo",
+		},
+		{
+			name: "array",
+			json: `[]`,
+			cbor: "\x80",
+		},
+		{
+			name: "object",
+			json: `{"foo":"bar"}`,
+			cbor: "\xa1\x43foo\x43bar",
+		},
+		{
+			name: "extraneous data",
+			json: "{}{}",
+			err:  errors.New("extraneous data"),
+		},
+		{
+			name: "eof",
+			json: "",
+			err:  errors.New("EOF"),
+		},
+		{
+			name: "unexpected eof",
+			json: "{",
+			err:  errors.New("unexpected EOF"),
+		},
+		{
+			name: "malformed json",
+			json: "}",
+			err:  errors.New("invalid character '}' looking for beginning of value"),
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var out strings.Builder
+			err := TranscodeFromJSON(&out, strings.NewReader(tc.json))
+			if (err == nil) != (tc.err == nil) || tc.err != nil && tc.err.Error() != err.Error() {
+				t.Fatalf("unexpected error: want %v got %v", tc.err, err)
+			}
+			if got, want := out.String(), tc.cbor; got != want {
+				t.Errorf("unexpected transcoding: want 0x%x got 0x%x", want, got)
+			}
+		})
+	}
+}
+
+func TestTranscodeToJSON(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		cbor string
+		json string
+		err  error
+	}{
+		{
+			name: "whole number",
+			cbor: "\x18\x2a",
+			json: "42",
+		},
+		{
+			name: "decimal number",
+			cbor: "\xf9\x3e\x00",
+			json: "1.5",
+		},
+		{
+			name: "false",
+			cbor: "\xf4",
+			json: "false",
+		},
+		{
+			name: "true",
+			cbor: "\xf5",
+			json: "true",
+		},
+		{
+			name: "null",
+			cbor: "\xf6",
+			json: "null",
+		},
+		{
+			name: "string",
+			cbor: "\x43foo",
+			json: `"foo"`,
+		},
+		{
+			name: "array",
+			cbor: "\x80",
+			json: `[]`,
+		},
+		{
+			name: "object",
+			cbor: "\xa1\x43foo\x43bar",
+			json: `{"foo":"bar"}`,
+		},
+		{
+			name: "extraneous data",
+			cbor: "\xa0\xa0",
+			err:  errors.New("extraneous data"),
+		},
+		{
+			name: "unexpected eof",
+			cbor: "\xa1",
+			err:  errors.New("unexpected EOF"),
+		},
+		{
+			name: "malformed cbor",
+			cbor: "\xff",
+			err:  errors.New(`cbor: unexpected "break" code`),
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var out strings.Builder
+			err := TranscodeToJSON(&out, strings.NewReader(tc.cbor))
+			if (err == nil) != (tc.err == nil) || tc.err != nil && tc.err.Error() != err.Error() {
+				t.Fatalf("unexpected error: want %v got %v", tc.err, err)
+			}
+			if got, want := out.String(), tc.json; got != want {
+				t.Errorf("unexpected transcoding: want %q got %q", want, got)
+			}
+		})
+	}
+}
+
+type write struct {
+	p   string
+	n   int
+	err error
+}
+
+type mockWriter struct {
+	t     testing.TB
+	calls []write
+}
+
+func (m *mockWriter) Write(p []byte) (int, error) {
+	if len(m.calls) == 0 {
+		m.t.Fatalf("unexpected call (p=%q)", string(p))
+	}
+	if got, want := string(p), m.calls[0].p; got != want {
+		m.t.Errorf("unexpected argument: want %q, got %q", want, got)
+	}
+	n, err := m.calls[0].n, m.calls[0].err
+	m.calls = m.calls[1:]
+	return n, err
+}
+
+func TestTrailingLinefeedSuppressor(t *testing.T) {
+	for _, tc := range []struct {
+		name      string
+		calls     []write
+		delegated []write
+	}{
+		{
+			name:      "one write without newline",
+			calls:     []write{{"foo", 3, nil}},
+			delegated: []write{{"foo", 3, nil}},
+		},
+		{
+			name:      "one write with newline",
+			calls:     []write{{"foo\n", 4, nil}},
+			delegated: []write{{"foo", 3, nil}},
+		},
+		{
+			name:      "one write with only newline",
+			calls:     []write{{"\n", 1, nil}},
+			delegated: nil,
+		},
+		{
+			name:      "one empty write",
+			calls:     []write{{"", 0, nil}},
+			delegated: nil,
+		},
+		{
+			name:      "three writes, all with only newline",
+			calls:     []write{{"\n", 1, nil}, {"\n", 1, nil}, {"\n", 1, nil}},
+			delegated: []write{{"\n", 1, nil}, {"\n", 1, nil}},
+		},
+		{
+			name:      "buffered linefeed not flushed on empty write",
+			calls:     []write{{"\n", 1, nil}, {"", 0, nil}},
+			delegated: nil,
+		},
+
+		{
+			name:      "two writes, last with trailing newline",
+			calls:     []write{{"foo", 3, nil}, {"bar\n", 4, nil}},
+			delegated: []write{{"foo", 3, nil}, {"bar", 3, nil}},
+		},
+		{
+			name:      "two writes, first with trailing newline",
+			calls:     []write{{"foo\n", 4, nil}, {"bar", 3, nil}},
+			delegated: []write{{"foo", 3, nil}, {"\n", 1, nil}, {"bar", 3, nil}},
+		},
+		{
+			name:      "two writes, both with trailing newlines",
+			calls:     []write{{"foo\n", 4, nil}, {"bar\n", 4, nil}},
+			delegated: []write{{"foo", 3, nil}, {"\n", 1, nil}, {"bar", 3, nil}},
+		},
+		{
+			name:      "two writes, neither with newlines",
+			calls:     []write{{"foo", 3, nil}, {"bar", 3, nil}},
+			delegated: []write{{"foo", 3, nil}, {"bar", 3, nil}},
+		},
+		{
+			name:      "delegate error before reaching newline",
+			calls:     []write{{"foo\n", 1, errors.New("test")}, {"oo\n", 3, nil}},
+			delegated: []write{{"foo", 1, errors.New("test")}, {"oo", 2, nil}},
+		},
+		{
+			name:      "delegate error after reaching newline",
+			calls:     []write{{"foo\n", 4, errors.New("test")}},
+			delegated: []write{{"foo", 3, errors.New("test")}},
+		},
+		{
+			name:      "delegate error flushing newline",
+			calls:     []write{{"foo\n", 4, nil}, {"\n", 0, errors.New("test")}, {"\n", 1, nil}},
+			delegated: []write{{"foo", 3, nil}, {"\n", 0, errors.New("test")}, {"\n", 1, nil}},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			w := &trailingLinefeedSuppressor{delegate: &mockWriter{t: t, calls: tc.delegated}}
+			for _, call := range tc.calls {
+				n, err := w.Write([]byte(call.p))
+				if n != call.n {
+					t.Errorf("unexpected n: want %d got %d", call.n, n)
+				}
+				if (err == nil) != (call.err == nil) || call.err != nil && call.err.Error() != err.Error() {
+					t.Errorf("unexpected error: want %v got %v", call.err, err)
+				}
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/raw.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/raw.go
new file mode 100644
index 0000000000..6d4f283cae
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/raw.go
@@ -0,0 +1,236 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cbor
+
+import (
+	"fmt"
+	"reflect"
+	"sync"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+var sharedTranscoders transcoders
+
+var rawTypeTranscodeFuncs = map[reflect.Type]func(reflect.Value) error{
+	reflect.TypeFor[runtime.RawExtension](): func(rv reflect.Value) error {
+		if !rv.CanAddr() {
+			return nil
+		}
+		re := rv.Addr().Interface().(*runtime.RawExtension)
+		if re.Raw == nil {
+			// When Raw is nil it encodes to null. Don't change nil Raw values during
+			// transcoding, they would have unmarshalled from JSON as nil too.
+			return nil
+		}
+		j, err := re.MarshalJSON()
+		if err != nil {
+			return fmt.Errorf("failed to transcode RawExtension to JSON: %w", err)
+		}
+		re.Raw = j
+		return nil
+	},
+	reflect.TypeFor[metav1.FieldsV1](): func(rv reflect.Value) error {
+		if !rv.CanAddr() {
+			return nil
+		}
+		fields := rv.Addr().Interface().(*metav1.FieldsV1)
+		if fields.GetRawReader().Size() == 0 {
+			// When Raw is nil it encodes to null. Don't change nil Raw values during
+			// transcoding, they would have unmarshalled from JSON as nil too.
+			return nil
+		}
+		j, err := fields.MarshalJSON()
+		if err != nil {
+			return fmt.Errorf("failed to transcode FieldsV1 to JSON: %w", err)
+		}
+		fields.SetRawBytes(j)
+		return nil
+	},
+}
+
+func transcodeRawTypes(v interface{}) error {
+	if v == nil {
+		return nil
+	}
+
+	rv := reflect.ValueOf(v)
+	return sharedTranscoders.getTranscoder(rv.Type()).fn(rv)
+}
+
+type transcoder struct {
+	fn func(rv reflect.Value) error
+}
+
+var noop = transcoder{
+	fn: func(reflect.Value) error {
+		return nil
+	},
+}
+
+type transcoders struct {
+	lock sync.RWMutex
+	m    map[reflect.Type]**transcoder
+}
+
+func (ts *transcoders) getTranscoder(rt reflect.Type) transcoder {
+	ts.lock.RLock()
+	tpp, ok := ts.m[rt]
+	ts.lock.RUnlock()
+	if ok {
+		return **tpp
+	}
+
+	ts.lock.Lock()
+	defer ts.lock.Unlock()
+	tp := ts.getTranscoderLocked(rt)
+	return *tp
+}
+
+func (ts *transcoders) getTranscoderLocked(rt reflect.Type) *transcoder {
+	if tpp, ok := ts.m[rt]; ok {
+		// A transcoder for this type was cached while waiting to acquire the lock.
+		return *tpp
+	}
+
+	// Cache the transcoder now, before populating fn, so that circular references between types
+	// don't overflow the call stack.
+	t := new(transcoder)
+	if ts.m == nil {
+		ts.m = make(map[reflect.Type]**transcoder)
+	}
+	ts.m[rt] = &t
+
+	for rawType, fn := range rawTypeTranscodeFuncs {
+		if rt == rawType {
+			t = &transcoder{fn: fn}
+			return t
+		}
+	}
+
+	switch rt.Kind() {
+	case reflect.Array:
+		te := ts.getTranscoderLocked(rt.Elem())
+		rtlen := rt.Len()
+		if rtlen == 0 || te == &noop {
+			t = &noop
+			break
+		}
+		t.fn = func(rv reflect.Value) error {
+			for i := 0; i < rtlen; i++ {
+				if err := te.fn(rv.Index(i)); err != nil {
+					return err
+				}
+			}
+			return nil
+		}
+	case reflect.Interface:
+		// Any interface value might have a dynamic type involving RawExtension. It needs to
+		// be checked.
+		t.fn = func(rv reflect.Value) error {
+			if rv.IsNil() {
+				return nil
+			}
+			rv = rv.Elem()
+			// The interface element's type is dynamic so its transcoder can't be
+			// determined statically.
+			return ts.getTranscoder(rv.Type()).fn(rv)
+		}
+	case reflect.Map:
+		rtk := rt.Key()
+		tk := ts.getTranscoderLocked(rtk)
+		rte := rt.Elem()
+		te := ts.getTranscoderLocked(rte)
+		if tk == &noop && te == &noop {
+			t = &noop
+			break
+		}
+		t.fn = func(rv reflect.Value) error {
+			iter := rv.MapRange()
+			rvk := reflect.New(rtk).Elem()
+			rve := reflect.New(rte).Elem()
+			for iter.Next() {
+				rvk.SetIterKey(iter)
+				if err := tk.fn(rvk); err != nil {
+					return err
+				}
+				rve.SetIterValue(iter)
+				if err := te.fn(rve); err != nil {
+					return err
+				}
+			}
+			return nil
+		}
+	case reflect.Pointer:
+		te := ts.getTranscoderLocked(rt.Elem())
+		if te == &noop {
+			t = &noop
+			break
+		}
+		t.fn = func(rv reflect.Value) error {
+			if rv.IsNil() {
+				return nil
+			}
+			return te.fn(rv.Elem())
+		}
+	case reflect.Slice:
+		te := ts.getTranscoderLocked(rt.Elem())
+		if te == &noop {
+			t = &noop
+			break
+		}
+		t.fn = func(rv reflect.Value) error {
+			for i := 0; i < rv.Len(); i++ {
+				if err := te.fn(rv.Index(i)); err != nil {
+					return err
+				}
+			}
+			return nil
+		}
+	case reflect.Struct:
+		type fieldTranscoder struct {
+			Index      int
+			Transcoder *transcoder
+		}
+		var fieldTranscoders []fieldTranscoder
+		for i := 0; i < rt.NumField(); i++ {
+			f := rt.Field(i)
+			tf := ts.getTranscoderLocked(f.Type)
+			if tf == &noop {
+				continue
+			}
+			fieldTranscoders = append(fieldTranscoders, fieldTranscoder{Index: i, Transcoder: tf})
+		}
+		if len(fieldTranscoders) == 0 {
+			t = &noop
+			break
+		}
+		t.fn = func(rv reflect.Value) error {
+			for _, ft := range fieldTranscoders {
+				if err := ft.Transcoder.fn(rv.Field(ft.Index)); err != nil {
+					return err
+				}
+			}
+			return nil
+		}
+	default:
+		t = &noop
+	}
+
+	return t
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/raw_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/raw_test.go
new file mode 100644
index 0000000000..5f6b140e41
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/cbor/raw_test.go
@@ -0,0 +1,189 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cbor
+
+import (
+	"fmt"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestTranscodeRawTypes(t *testing.T) {
+	for _, tc := range []struct {
+		In  interface{}
+		Out interface{}
+	}{
+		{
+			In:  nil,
+			Out: nil,
+		},
+		{
+			In:  &runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}},
+			Out: &runtime.RawExtension{Raw: []byte(`7`)},
+		},
+		{
+			In:  &runtime.RawExtension{},
+			Out: &runtime.RawExtension{},
+		},
+		{
+			In:  runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}},
+			Out: runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}, // not addressable
+		},
+		{
+			In:  &[...]runtime.RawExtension{{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}, {Raw: []byte{0xd9, 0xd9, 0xf7, 0x08}}, {Raw: []byte{0xd9, 0xd9, 0xf7, 0x09}}},
+			Out: &[...]runtime.RawExtension{{Raw: []byte(`7`)}, {Raw: []byte(`8`)}, {Raw: []byte(`9`)}},
+		},
+		{
+			In:  &[0]runtime.RawExtension{},
+			Out: &[0]runtime.RawExtension{},
+		},
+		{
+			In:  &[]runtime.RawExtension{{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}, {Raw: []byte{0xd9, 0xd9, 0xf7, 0x08}}, {Raw: []byte{0xd9, 0xd9, 0xf7, 0x09}}},
+			Out: &[]runtime.RawExtension{{Raw: []byte(`7`)}, {Raw: []byte(`8`)}, {Raw: []byte(`9`)}},
+		},
+		{
+			In:  &[]runtime.RawExtension{},
+			Out: &[]runtime.RawExtension{},
+		},
+		{
+			In:  &[]string{"foo"},
+			Out: &[]string{"foo"},
+		},
+		{
+			In:  (*runtime.RawExtension)(nil),
+			Out: (*runtime.RawExtension)(nil),
+		},
+		{
+			In:  &struct{ I fmt.Stringer }{I: &runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}},
+			Out: &struct{ I fmt.Stringer }{I: &runtime.RawExtension{Raw: []byte(`7`)}},
+		},
+		{
+			In:  &struct{ I fmt.Stringer }{I: nil},
+			Out: &struct{ I fmt.Stringer }{I: nil},
+		},
+		{
+			In:  &struct{ I int64 }{I: 7},
+			Out: &struct{ I int64 }{I: 7},
+		},
+		{
+			In: &struct {
+				E runtime.RawExtension
+				I int64
+			}{E: runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}, I: 7},
+			Out: &struct {
+				E runtime.RawExtension
+				I int64
+			}{E: runtime.RawExtension{Raw: []byte(`7`)}, I: 7},
+		},
+		{
+			In: &struct {
+				runtime.RawExtension
+			}{RawExtension: runtime.RawExtension{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}},
+			Out: &struct {
+				runtime.RawExtension
+			}{RawExtension: runtime.RawExtension{Raw: []byte(`7`)}},
+		},
+		{
+			In:  &map[string]string{"hello": "world"},
+			Out: &map[string]string{"hello": "world"},
+		},
+		{
+			In:  &map[string]runtime.RawExtension{"hello": {Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}},
+			Out: &map[string]runtime.RawExtension{"hello": {Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}}, // not addressable
+		},
+		{
+			In:  &map[string][]runtime.RawExtension{"hello": {{Raw: []byte{0xd9, 0xd9, 0xf7, 0x07}}}},
+			Out: &map[string][]runtime.RawExtension{"hello": {{Raw: []byte(`7`)}}},
+		},
+		{
+			In:  metav1.NewFieldsV1(string([]byte{0xa0})),
+			Out: metav1.NewFieldsV1(`{}`),
+		},
+		{
+			In:  &metav1.FieldsV1{},
+			Out: &metav1.FieldsV1{},
+		},
+		{
+			In:  *metav1.NewFieldsV1(string([]byte{0xa0})),
+			Out: *metav1.NewFieldsV1(string([]byte{0xa0})), // not addressable
+		},
+		{
+			In:  &[...]metav1.FieldsV1{*metav1.NewFieldsV1(string([]byte{0xa0})), *metav1.NewFieldsV1(string([]byte{0xf6}))},
+			Out: &[...]metav1.FieldsV1{*metav1.NewFieldsV1(`{}`), *metav1.NewFieldsV1(`null`)},
+		},
+		{
+			In:  &[0]metav1.FieldsV1{},
+			Out: &[0]metav1.FieldsV1{},
+		},
+		{
+			In:  &[]metav1.FieldsV1{*metav1.NewFieldsV1(string([]byte{0xa0})), *metav1.NewFieldsV1(string([]byte{0xf6}))},
+			Out: &[]metav1.FieldsV1{*metav1.NewFieldsV1(`{}`), *metav1.NewFieldsV1(`null`)},
+		},
+		{
+			In:  &[]metav1.FieldsV1{},
+			Out: &[]metav1.FieldsV1{},
+		},
+		{
+			In:  (*metav1.FieldsV1)(nil),
+			Out: (*metav1.FieldsV1)(nil),
+		},
+		{
+			In:  &struct{ I fmt.Stringer }{I: metav1.NewFieldsV1(string([]byte{0xa0}))},
+			Out: &struct{ I fmt.Stringer }{I: metav1.NewFieldsV1(`{}`)},
+		},
+		{
+			In: &struct {
+				E metav1.FieldsV1
+				I int64
+			}{E: *metav1.NewFieldsV1(string([]byte{0xa0})), I: 7},
+			Out: &struct {
+				E metav1.FieldsV1
+				I int64
+			}{E: *metav1.NewFieldsV1(`{}`), I: 7},
+		},
+		{
+			In: &struct {
+				metav1.FieldsV1
+			}{FieldsV1: *metav1.NewFieldsV1(string([]byte{0xa0}))},
+			Out: &struct {
+				metav1.FieldsV1
+			}{FieldsV1: *metav1.NewFieldsV1(`{}`)},
+		},
+		{
+			In:  &map[string]metav1.FieldsV1{"hello": *metav1.NewFieldsV1(string([]byte{0xa0}))},
+			Out: &map[string]metav1.FieldsV1{"hello": *metav1.NewFieldsV1(string([]byte{0xa0}))}, // not addressable
+		},
+		{
+			In:  &map[string][]metav1.FieldsV1{"hello": {*metav1.NewFieldsV1(string([]byte{0xa0}))}},
+			Out: &map[string][]metav1.FieldsV1{"hello": {*metav1.NewFieldsV1(`{}`)}},
+		},
+	} {
+		t.Run(fmt.Sprintf("%#v", tc.In), func(t *testing.T) {
+			if err := transcodeRawTypes(tc.In); err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			if diff := cmp.Diff(tc.Out, tc.In); diff != "" {
+				t.Errorf("unexpected diff:\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/codec_factory.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/codec_factory.go
new file mode 100644
index 0000000000..81286fccb4
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/codec_factory.go
@@ -0,0 +1,322 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serializer
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+	"k8s.io/apimachinery/pkg/runtime/serializer/protobuf"
+	"k8s.io/apimachinery/pkg/runtime/serializer/recognizer"
+	"k8s.io/apimachinery/pkg/runtime/serializer/versioning"
+)
+
+func newSerializersForScheme(scheme *runtime.Scheme, mf json.MetaFactory, options CodecFactoryOptions) []runtime.SerializerInfo {
+	jsonSerializer := json.NewSerializerWithOptions(
+		mf, scheme, scheme,
+		json.SerializerOptions{Yaml: false, Pretty: false, Strict: options.Strict, StreamingCollectionsEncoding: options.StreamingCollectionsEncodingToJSON},
+	)
+	jsonSerializerType := runtime.SerializerInfo{
+		MediaType:        runtime.ContentTypeJSON,
+		MediaTypeType:    "application",
+		MediaTypeSubType: "json",
+		EncodesAsText:    true,
+		Serializer:       jsonSerializer,
+		StrictSerializer: json.NewSerializerWithOptions(
+			mf, scheme, scheme,
+			json.SerializerOptions{Yaml: false, Pretty: false, Strict: true, StreamingCollectionsEncoding: options.StreamingCollectionsEncodingToJSON},
+		),
+		StreamSerializer: &runtime.StreamSerializerInfo{
+			EncodesAsText: true,
+			Serializer:    jsonSerializer,
+			Framer:        json.Framer,
+		},
+	}
+	if options.Pretty {
+		jsonSerializerType.PrettySerializer = json.NewSerializerWithOptions(
+			mf, scheme, scheme,
+			json.SerializerOptions{Yaml: false, Pretty: true, Strict: options.Strict},
+		)
+	}
+
+	yamlSerializer := json.NewSerializerWithOptions(
+		mf, scheme, scheme,
+		json.SerializerOptions{Yaml: true, Pretty: false, Strict: options.Strict},
+	)
+	strictYAMLSerializer := json.NewSerializerWithOptions(
+		mf, scheme, scheme,
+		json.SerializerOptions{Yaml: true, Pretty: false, Strict: true},
+	)
+	protoSerializer := protobuf.NewSerializerWithOptions(scheme, scheme, protobuf.SerializerOptions{
+		StreamingCollectionsEncoding: options.StreamingCollectionsEncodingToProtobuf,
+	})
+	protoRawSerializer := protobuf.NewRawSerializer(scheme, scheme)
+
+	serializers := []runtime.SerializerInfo{
+		jsonSerializerType,
+		{
+			MediaType:        runtime.ContentTypeYAML,
+			MediaTypeType:    "application",
+			MediaTypeSubType: "yaml",
+			EncodesAsText:    true,
+			Serializer:       yamlSerializer,
+			StrictSerializer: strictYAMLSerializer,
+		},
+		{
+			MediaType:        runtime.ContentTypeProtobuf,
+			MediaTypeType:    "application",
+			MediaTypeSubType: "vnd.kubernetes.protobuf",
+			Serializer:       protoSerializer,
+			// note, strict decoding is unsupported for protobuf,
+			// fall back to regular serializing
+			StrictSerializer: protoSerializer,
+			StreamSerializer: &runtime.StreamSerializerInfo{
+				Serializer: protoRawSerializer,
+				Framer:     protobuf.LengthDelimitedFramer,
+			},
+		},
+	}
+
+	for _, f := range options.serializers {
+		serializers = append(serializers, f(scheme, scheme))
+	}
+
+	return serializers
+}
+
+// CodecFactory provides methods for retrieving codecs and serializers for specific
+// versions and content types.
+type CodecFactory struct {
+	scheme    *runtime.Scheme
+	universal runtime.Decoder
+	accepts   []runtime.SerializerInfo
+
+	legacySerializer runtime.Serializer
+}
+
+// CodecFactoryOptions holds the options for configuring CodecFactory behavior
+type CodecFactoryOptions struct {
+	// Strict configures all serializers in strict mode
+	Strict bool
+	// Pretty includes a pretty serializer along with the non-pretty one
+	Pretty bool
+
+	StreamingCollectionsEncodingToJSON     bool
+	StreamingCollectionsEncodingToProtobuf bool
+
+	serializers []func(runtime.ObjectCreater, runtime.ObjectTyper) runtime.SerializerInfo
+}
+
+// CodecFactoryOptionsMutator takes a pointer to an options struct and then modifies it.
+// Functions implementing this type can be passed to the NewCodecFactory() constructor.
+type CodecFactoryOptionsMutator func(*CodecFactoryOptions)
+
+// EnablePretty enables including a pretty serializer along with the non-pretty one
+func EnablePretty(options *CodecFactoryOptions) {
+	options.Pretty = true
+}
+
+// DisablePretty disables including a pretty serializer along with the non-pretty one
+func DisablePretty(options *CodecFactoryOptions) {
+	options.Pretty = false
+}
+
+// EnableStrict enables configuring all serializers in strict mode
+func EnableStrict(options *CodecFactoryOptions) {
+	options.Strict = true
+}
+
+// DisableStrict disables configuring all serializers in strict mode
+func DisableStrict(options *CodecFactoryOptions) {
+	options.Strict = false
+}
+
+// WithSerializer configures a serializer to be supported in addition to the default serializers.
+func WithSerializer(f func(runtime.ObjectCreater, runtime.ObjectTyper) runtime.SerializerInfo) CodecFactoryOptionsMutator {
+	return func(options *CodecFactoryOptions) {
+		options.serializers = append(options.serializers, f)
+	}
+}
+
+func WithStreamingCollectionEncodingToJSON() CodecFactoryOptionsMutator {
+	return func(options *CodecFactoryOptions) {
+		options.StreamingCollectionsEncodingToJSON = true
+	}
+}
+
+func WithStreamingCollectionEncodingToProtobuf() CodecFactoryOptionsMutator {
+	return func(options *CodecFactoryOptions) {
+		options.StreamingCollectionsEncodingToProtobuf = true
+	}
+}
+
+// NewCodecFactory provides methods for retrieving serializers for the supported wire formats
+// and conversion wrappers to define preferred internal and external versions. In the future,
+// as the internal version is used less, callers may instead use a defaulting serializer and
+// only convert objects which are shared internally (Status, common API machinery).
+//
+// Mutators can be passed to change the CodecFactoryOptions before construction of the factory.
+// It is recommended to explicitly pass mutators instead of relying on defaults.
+// By default, Pretty is enabled -- this is conformant with previously supported behavior.
+//
+// TODO: allow other codecs to be compiled in?
+// TODO: accept a scheme interface
+func NewCodecFactory(scheme *runtime.Scheme, mutators ...CodecFactoryOptionsMutator) CodecFactory {
+	options := CodecFactoryOptions{Pretty: true}
+	for _, fn := range mutators {
+		fn(&options)
+	}
+
+	serializers := newSerializersForScheme(scheme, json.DefaultMetaFactory, options)
+	return newCodecFactory(scheme, serializers)
+}
+
+// newCodecFactory is a helper for testing that allows a different metafactory to be specified.
+func newCodecFactory(scheme *runtime.Scheme, serializers []runtime.SerializerInfo) CodecFactory {
+	decoders := make([]runtime.Decoder, 0, len(serializers))
+	var accepts []runtime.SerializerInfo
+	alreadyAccepted := make(map[string]struct{})
+
+	var legacySerializer runtime.Serializer
+	for _, d := range serializers {
+		decoders = append(decoders, d.Serializer)
+		if _, ok := alreadyAccepted[d.MediaType]; ok {
+			continue
+		}
+		alreadyAccepted[d.MediaType] = struct{}{}
+
+		acceptedSerializerShallowCopy := d
+		if d.StreamSerializer != nil {
+			cloned := *d.StreamSerializer
+			acceptedSerializerShallowCopy.StreamSerializer = &cloned
+		}
+		accepts = append(accepts, acceptedSerializerShallowCopy)
+
+		if d.MediaType == runtime.ContentTypeJSON {
+			legacySerializer = d.Serializer
+		}
+	}
+	if legacySerializer == nil {
+		legacySerializer = serializers[0].Serializer
+	}
+
+	return CodecFactory{
+		scheme:    scheme,
+		universal: recognizer.NewDecoder(decoders...),
+
+		accepts: accepts,
+
+		legacySerializer: legacySerializer,
+	}
+}
+
+// WithoutConversion returns a NegotiatedSerializer that performs no conversion, even if the
+// caller requests it.
+func (f CodecFactory) WithoutConversion() runtime.NegotiatedSerializer {
+	return WithoutConversionCodecFactory{f}
+}
+
+// SupportedMediaTypes returns the RFC2046 media types that this factory has serializers for.
+func (f CodecFactory) SupportedMediaTypes() []runtime.SerializerInfo {
+	return f.accepts
+}
+
+// LegacyCodec encodes output to a given API versions, and decodes output into the internal form from
+// any recognized source. The returned codec will always encode output to JSON. If a type is not
+// found in the list of versions an error will be returned.
+//
+// This method is deprecated - clients and servers should negotiate a serializer by mime-type and
+// invoke CodecForVersions. Callers that need only to read data should use UniversalDecoder().
+//
+// TODO: make this call exist only in pkg/api, and initialize it with the set of default versions.
+// All other callers will be forced to request a Codec directly.
+func (f CodecFactory) LegacyCodec(version ...schema.GroupVersion) runtime.Codec {
+	return versioning.NewDefaultingCodecForScheme(f.scheme, f.legacySerializer, f.universal, schema.GroupVersions(version), runtime.InternalGroupVersioner)
+}
+
+// UniversalDeserializer can convert any stored data recognized by this factory into a Go object that satisfies
+// runtime.Object. It does not perform conversion. It does not perform defaulting.
+func (f CodecFactory) UniversalDeserializer() runtime.Decoder {
+	return f.universal
+}
+
+// UniversalDecoder returns a runtime.Decoder capable of decoding all known API objects in all known formats. Used
+// by clients that do not need to encode objects but want to deserialize API objects stored on disk. Only decodes
+// objects in groups registered with the scheme. The GroupVersions passed may be used to select alternate
+// versions of objects to return - by default, runtime.APIVersionInternal is used. If any versions are specified,
+// unrecognized groups will be returned in the version they are encoded as (no conversion). This decoder performs
+// defaulting.
+//
+// TODO: the decoder will eventually be removed in favor of dealing with objects in their versioned form
+// TODO: only accept a group versioner
+func (f CodecFactory) UniversalDecoder(versions ...schema.GroupVersion) runtime.Decoder {
+	var versioner runtime.GroupVersioner
+	if len(versions) == 0 {
+		versioner = runtime.InternalGroupVersioner
+	} else {
+		versioner = schema.GroupVersions(versions)
+	}
+	return f.CodecForVersions(nil, f.universal, nil, versioner)
+}
+
+// CodecForVersions creates a codec with the provided serializer. If an object is decoded and its group is not in the list,
+// it will default to runtime.APIVersionInternal. If encode is not specified for an object's group, the object is not
+// converted. If encode or decode are nil, no conversion is performed.
+func (f CodecFactory) CodecForVersions(encoder runtime.Encoder, decoder runtime.Decoder, encode runtime.GroupVersioner, decode runtime.GroupVersioner) runtime.Codec {
+	// TODO: these are for backcompat, remove them in the future
+	if encode == nil {
+		encode = runtime.DisabledGroupVersioner
+	}
+	if decode == nil {
+		decode = runtime.InternalGroupVersioner
+	}
+	return versioning.NewDefaultingCodecForScheme(f.scheme, encoder, decoder, encode, decode)
+}
+
+// DecoderToVersion returns a decoder that targets the provided group version.
+func (f CodecFactory) DecoderToVersion(decoder runtime.Decoder, gv runtime.GroupVersioner) runtime.Decoder {
+	return f.CodecForVersions(nil, decoder, nil, gv)
+}
+
+// EncoderForVersion returns an encoder that targets the provided group version.
+func (f CodecFactory) EncoderForVersion(encoder runtime.Encoder, gv runtime.GroupVersioner) runtime.Encoder {
+	return f.CodecForVersions(encoder, nil, gv, nil)
+}
+
+// WithoutConversionCodecFactory is a CodecFactory that will explicitly ignore requests to perform conversion.
+// This wrapper is used while code migrates away from using conversion (such as external clients) and in the future
+// will be unnecessary when we change the signature of NegotiatedSerializer.
+type WithoutConversionCodecFactory struct {
+	CodecFactory
+}
+
+// EncoderForVersion returns an encoder that does not do conversion, but does set the group version kind of the object
+// when serialized.
+func (f WithoutConversionCodecFactory) EncoderForVersion(serializer runtime.Encoder, version runtime.GroupVersioner) runtime.Encoder {
+	return runtime.WithVersionEncoder{
+		Version:     version,
+		Encoder:     serializer,
+		ObjectTyper: f.CodecFactory.scheme,
+	}
+}
+
+// DecoderToVersion returns an decoder that does not do conversion.
+func (f WithoutConversionCodecFactory) DecoderToVersion(serializer runtime.Decoder, _ runtime.GroupVersioner) runtime.Decoder {
+	return runtime.WithoutVersionDecoder{
+		Decoder: serializer,
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/codec_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/codec_test.go
new file mode 100644
index 0000000000..ceb6f93da8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/codec_test.go
@@ -0,0 +1,370 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serializer
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"os"
+	"reflect"
+	"strings"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+	"k8s.io/apimachinery/pkg/util/diff"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+
+	"github.com/google/go-cmp/cmp"
+	flag "github.com/spf13/pflag"
+	"sigs.k8s.io/randfill"
+	"sigs.k8s.io/yaml"
+)
+
+var fuzzIters = flag.Int("fuzz-iters", 50, "How many fuzzing iterations to do.")
+
+type testMetaFactory struct{}
+
+func (testMetaFactory) Interpret(data []byte) (*schema.GroupVersionKind, error) {
+	findKind := struct {
+		APIVersion string `json:"myVersionKey,omitempty"`
+		ObjectKind string `json:"myKindKey,omitempty"`
+	}{}
+	// yaml is a superset of json, so we use it to decode here. That way,
+	// we understand both.
+	if err := yaml.Unmarshal(data, &findKind); err != nil {
+		return nil, fmt.Errorf("couldn't get version/kind: %v", err)
+	}
+	gv, err := schema.ParseGroupVersion(findKind.APIVersion)
+	if err != nil {
+		return nil, err
+	}
+	return &schema.GroupVersionKind{Group: gv.Group, Version: gv.Version, Kind: findKind.ObjectKind}, nil
+}
+
+// TestObjectFuzzer can randomly populate all the above objects.
+var TestObjectFuzzer = randfill.New().NilChance(.5).NumElements(1, 100).Funcs(
+	func(j *runtimetesting.MyWeirdCustomEmbeddedVersionKindField, c randfill.Continue) {
+		c.FillNoCustom(j)
+		j.APIVersion = ""
+		j.ObjectKind = ""
+	},
+)
+
+// Returns a new Scheme set up with the test objects.
+func GetTestScheme() (*runtime.Scheme, runtime.Codec) {
+	internalGV := schema.GroupVersion{Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Version: "v1"}
+	externalGV2 := schema.GroupVersion{Version: "v2"}
+
+	s := runtime.NewScheme()
+	// Ordinarily, we wouldn't add TestType2, but because this is a test and
+	// both types are from the same package, we need to get it into the system
+	// so that converter will match it with ExternalType2.
+	s.AddKnownTypes(internalGV, &runtimetesting.TestType1{}, &runtimetesting.TestType2{}, &runtimetesting.ExternalInternalSame{})
+	s.AddKnownTypes(externalGV, &runtimetesting.ExternalInternalSame{})
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType1"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType2"), &runtimetesting.ExternalTestType2{})
+	s.AddKnownTypeWithName(internalGV.WithKind("TestType3"), &runtimetesting.TestType1{})
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType3"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(externalGV2.WithKind("TestType1"), &runtimetesting.ExternalTestType1{})
+
+	s.AddUnversionedTypes(externalGV, &metav1.Status{})
+
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+
+	cf := newCodecFactory(s, newSerializersForScheme(s, testMetaFactory{}, CodecFactoryOptions{Pretty: true, Strict: true}))
+	codec := cf.LegacyCodec(schema.GroupVersion{Version: "v1"})
+	return s, codec
+}
+
+var semantic = conversion.EqualitiesOrDie(
+	func(a, b runtimetesting.MyWeirdCustomEmbeddedVersionKindField) bool {
+		a.APIVersion, a.ObjectKind = "", ""
+		b.APIVersion, b.ObjectKind = "", ""
+		return a == b
+	},
+)
+
+func runTest(t *testing.T, source interface{}) {
+	name := reflect.TypeOf(source).Elem().Name()
+	TestObjectFuzzer.Fill(source)
+
+	_, codec := GetTestScheme()
+	data, err := runtime.Encode(codec, source.(runtime.Object))
+	if err != nil {
+		t.Errorf("%v: %v (%#v)", name, err, source)
+		return
+	}
+	obj2, err := runtime.Decode(codec, data)
+	if err != nil {
+		t.Errorf("%v: %v (%v)", name, err, string(data))
+		return
+	}
+	if !semantic.DeepEqual(source, obj2) {
+		t.Errorf("1: %v: diff: %v", name, diff.ObjectGoPrintSideBySide(source, obj2))
+		return
+	}
+	obj3 := reflect.New(reflect.TypeOf(source).Elem()).Interface()
+	if err := runtime.DecodeInto(codec, data, obj3.(runtime.Object)); err != nil {
+		t.Errorf("2: %v: %v", name, err)
+		return
+	}
+	if !semantic.DeepEqual(source, obj3) {
+		t.Errorf("3: %v: diff: %v", name, cmp.Diff(source, obj3))
+		return
+	}
+}
+
+func TestTypes(t *testing.T) {
+	table := []interface{}{
+		&runtimetesting.TestType1{},
+		&runtimetesting.ExternalInternalSame{},
+	}
+	for _, item := range table {
+		// Try a few times, since runTest uses random values.
+		for i := 0; i < *fuzzIters; i++ {
+			runTest(t, item)
+		}
+	}
+}
+
+func TestVersionedEncoding(t *testing.T) {
+	s, _ := GetTestScheme()
+	cf := newCodecFactory(s, newSerializersForScheme(s, testMetaFactory{}, CodecFactoryOptions{Pretty: true, Strict: true}))
+	info, _ := runtime.SerializerInfoForMediaType(cf.SupportedMediaTypes(), runtime.ContentTypeJSON)
+	encoder := info.Serializer
+
+	codec := cf.EncoderForVersion(encoder, schema.GroupVersion{Version: "v2"})
+	out, err := runtime.Encode(codec, &runtimetesting.TestType1{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(out) != `{"myVersionKey":"v2","myKindKey":"TestType1"}`+"\n" {
+		t.Fatal(string(out))
+	}
+
+	codec = cf.EncoderForVersion(encoder, schema.GroupVersion{Version: "v3"})
+	_, err = runtime.Encode(codec, &runtimetesting.TestType1{})
+	if err == nil {
+		t.Fatal(err)
+	}
+
+	// unversioned encode with no versions is written directly to wire
+	codec = cf.EncoderForVersion(encoder, runtime.InternalGroupVersioner)
+	out, err = runtime.Encode(codec, &runtimetesting.TestType1{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(out) != `{}`+"\n" {
+		t.Fatal(string(out))
+	}
+}
+
+func TestMultipleNames(t *testing.T) {
+	_, codec := GetTestScheme()
+
+	obj, _, err := codec.Decode([]byte(`{"myKindKey":"TestType3","myVersionKey":"v1","A":"value"}`), nil, nil)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	internal := obj.(*runtimetesting.TestType1)
+	if internal.A != "value" {
+		t.Fatalf("unexpected decoded object: %#v", internal)
+	}
+
+	out, err := runtime.Encode(codec, internal)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(string(out), `"myKindKey":"TestType1"`) {
+		t.Errorf("unexpected encoded output: %s", string(out))
+	}
+}
+
+func TestStrictOption(t *testing.T) {
+	s, _ := GetTestScheme()
+	duplicateKeys := `{"myKindKey":"TestType3","myVersionKey":"v1","myVersionKey":"v1","A":"value"}`
+
+	strictCodec := newCodecFactory(s, newSerializersForScheme(s, testMetaFactory{}, CodecFactoryOptions{Pretty: true, Strict: true})).LegacyCodec()
+	_, _, err := strictCodec.Decode([]byte(duplicateKeys), nil, nil)
+	if !runtime.IsStrictDecodingError(err) {
+		t.Fatalf("StrictDecodingError not returned on object with duplicate keys: %v, type: %v", err, reflect.TypeOf(err))
+	}
+
+	nonStrictCodec := newCodecFactory(s, newSerializersForScheme(s, testMetaFactory{}, CodecFactoryOptions{Pretty: true, Strict: false})).LegacyCodec()
+	_, _, err = nonStrictCodec.Decode([]byte(duplicateKeys), nil, nil)
+	if runtime.IsStrictDecodingError(err) {
+		t.Fatalf("Non-Strict decoder returned a StrictDecodingError: %v", err)
+	}
+}
+
+func TestConvertTypesWhenDefaultNamesMatch(t *testing.T) {
+	internalGV := schema.GroupVersion{Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Version: "v1"}
+
+	s := runtime.NewScheme()
+	// create two names internally, with TestType1 being preferred
+	s.AddKnownTypeWithName(internalGV.WithKind("TestType1"), &runtimetesting.TestType1{})
+	s.AddKnownTypeWithName(internalGV.WithKind("OtherType1"), &runtimetesting.TestType1{})
+	// create two names externally, with TestType1 being preferred
+	s.AddKnownTypeWithName(externalGV.WithKind("TestType1"), &runtimetesting.ExternalTestType1{})
+	s.AddKnownTypeWithName(externalGV.WithKind("OtherType1"), &runtimetesting.ExternalTestType1{})
+	if err := runtimetesting.RegisterConversions(s); err != nil {
+		t.Fatalf("unexpected error; %v", err)
+	}
+
+	ext := &runtimetesting.ExternalTestType1{}
+	ext.APIVersion = "v1"
+	ext.ObjectKind = "OtherType1"
+	ext.A = "test"
+	data, err := json.Marshal(ext)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	expect := &runtimetesting.TestType1{A: "test"}
+
+	codec := newCodecFactory(
+		s, newSerializersForScheme(s, testMetaFactory{}, CodecFactoryOptions{Pretty: true, Strict: true}),
+	).LegacyCodec(schema.GroupVersion{Version: "v1"})
+
+	obj, err := runtime.Decode(codec, data)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !semantic.DeepEqual(expect, obj) {
+		t.Errorf("unexpected object: %#v", obj)
+	}
+
+	into := &runtimetesting.TestType1{}
+	if err := runtime.DecodeInto(codec, data, into); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !semantic.DeepEqual(expect, into) {
+		t.Errorf("unexpected object: %#v", obj)
+	}
+}
+
+func TestEncode_Ptr(t *testing.T) {
+	_, codec := GetTestScheme()
+	tt := &runtimetesting.TestType1{A: "I am a pointer object"}
+	data, err := runtime.Encode(codec, tt)
+	obj2, err2 := runtime.Decode(codec, data)
+	if err != nil || err2 != nil {
+		t.Fatalf("Failure: '%v' '%v'\n%s", err, err2, data)
+	}
+	if _, ok := obj2.(*runtimetesting.TestType1); !ok {
+		t.Fatalf("Got wrong type")
+	}
+	if !semantic.DeepEqual(obj2, tt) {
+		t.Errorf("Expected:\n %#v,\n Got:\n %#v", tt, obj2)
+	}
+}
+
+func TestBadJSONRejection(t *testing.T) {
+	log.SetOutput(os.Stderr)
+	_, codec := GetTestScheme()
+	badJSONs := [][]byte{
+		[]byte(`{"myVersionKey":"v1"}`),                          // Missing kind
+		[]byte(`{"myVersionKey":"v1","myKindKey":"bar"}`),        // Unknown kind
+		[]byte(`{"myVersionKey":"bar","myKindKey":"TestType1"}`), // Unknown version
+		[]byte(`{"myKindKey":"TestType1"}`),                      // Missing version
+	}
+	for _, b := range badJSONs {
+		if _, err := runtime.Decode(codec, b); err == nil {
+			t.Errorf("Did not reject bad json: %s", string(b))
+		}
+	}
+	badJSONKindMismatch := []byte(`{"myVersionKey":"v1","myKindKey":"ExternalInternalSame"}`)
+	if err := runtime.DecodeInto(codec, badJSONKindMismatch, &runtimetesting.TestType1{}); err == nil {
+		t.Errorf("Kind is set but doesn't match the object type: %s", badJSONKindMismatch)
+	}
+	if err := runtime.DecodeInto(codec, []byte(``), &runtimetesting.TestType1{}); err != nil {
+		t.Errorf("Should allow empty decode: %v", err)
+	}
+	if _, _, err := codec.Decode([]byte(``), &schema.GroupVersionKind{Kind: "ExternalInternalSame"}, nil); err == nil {
+		t.Errorf("Did not give error for empty data with only kind default")
+	}
+	if _, _, err := codec.Decode([]byte(`{"myVersionKey":"v1"}`), &schema.GroupVersionKind{Kind: "ExternalInternalSame"}, nil); err != nil {
+		t.Errorf("Gave error for version and kind default")
+	}
+	if _, _, err := codec.Decode([]byte(`{"myKindKey":"ExternalInternalSame"}`), &schema.GroupVersionKind{Version: "v1"}, nil); err != nil {
+		t.Errorf("Gave error for version and kind default")
+	}
+	if _, _, err := codec.Decode([]byte(``), &schema.GroupVersionKind{Kind: "ExternalInternalSame", Version: "v1"}, nil); err != nil {
+		t.Errorf("Gave error for version and kind defaulted: %v", err)
+	}
+	if _, err := runtime.Decode(codec, []byte(``)); err == nil {
+		t.Errorf("Did not give error for empty data")
+	}
+}
+
+// Returns a new Scheme set up with the test objects needed by TestDirectCodec.
+func GetDirectCodecTestScheme() *runtime.Scheme {
+	internalGV := schema.GroupVersion{Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Version: "v1"}
+
+	s := runtime.NewScheme()
+	// Ordinarily, we wouldn't add TestType2, but because this is a test and
+	// both types are from the same package, we need to get it into the system
+	// so that converter will match it with ExternalType2.
+	s.AddKnownTypes(internalGV, &runtimetesting.TestType1{})
+	s.AddKnownTypes(externalGV, &runtimetesting.ExternalTestType1{})
+
+	s.AddUnversionedTypes(externalGV, &metav1.Status{})
+
+	utilruntime.Must(runtimetesting.RegisterConversions(s))
+	return s
+}
+
+func TestDirectCodec(t *testing.T) {
+	s := GetDirectCodecTestScheme()
+	cf := newCodecFactory(s, newSerializersForScheme(s, testMetaFactory{}, CodecFactoryOptions{Pretty: true, Strict: true}))
+	info, _ := runtime.SerializerInfoForMediaType(cf.SupportedMediaTypes(), runtime.ContentTypeJSON)
+	serializer := info.Serializer
+	df := cf.WithoutConversion()
+	ignoredGV, err := schema.ParseGroupVersion("ignored group/ignored version")
+	if err != nil {
+		t.Fatal(err)
+	}
+	directEncoder := df.EncoderForVersion(serializer, ignoredGV)
+	directDecoder := df.DecoderToVersion(serializer, ignoredGV)
+	out, err := runtime.Encode(directEncoder, &runtimetesting.ExternalTestType1{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(out) != `{"myVersionKey":"v1","myKindKey":"ExternalTestType1"}`+"\n" {
+		t.Fatal(string(out))
+	}
+	a, _, err := directDecoder.Decode(out, nil, nil)
+	if err != nil {
+		t.Fatalf("error on Decode: %v", err)
+	}
+	e := &runtimetesting.ExternalTestType1{
+		MyWeirdCustomEmbeddedVersionKindField: runtimetesting.MyWeirdCustomEmbeddedVersionKindField{
+			APIVersion: "v1",
+			ObjectKind: "ExternalTestType1",
+		},
+	}
+	if !semantic.DeepEqual(e, a) {
+		t.Fatalf("expect %v, got %v", e, a)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/encoder_with_allocator_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/encoder_with_allocator_test.go
new file mode 100644
index 0000000000..73406d0731
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/encoder_with_allocator_test.go
@@ -0,0 +1,139 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serializer
+
+import (
+	"crypto/rand"
+	"io/ioutil"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	testapigroupv1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/protobuf"
+)
+
+func BenchmarkProtobufEncoder(b *testing.B) {
+	benchmarkEncodeFor(b, protobuf.NewSerializer(nil, nil))
+}
+
+func BenchmarkProtobufEncodeWithAllocator(b *testing.B) {
+	benchmarkEncodeWithAllocatorFor(b, protobuf.NewSerializer(nil, nil))
+}
+
+func BenchmarkRawProtobufEncoder(b *testing.B) {
+	benchmarkEncodeFor(b, protobuf.NewRawSerializer(nil, nil))
+}
+
+func BenchmarkRawProtobufEncodeWithAllocator(b *testing.B) {
+	benchmarkEncodeWithAllocatorFor(b, protobuf.NewRawSerializer(nil, nil))
+}
+
+func benchmarkEncodeFor(b *testing.B, target runtime.Encoder) {
+	for _, tc := range benchTestCases() {
+		b.Run(tc.name, func(b *testing.B) {
+			b.ReportAllocs()
+			for n := 0; n < b.N; n++ {
+				err := target.Encode(tc.obj, ioutil.Discard)
+				if err != nil {
+					b.Fatal(err)
+				}
+			}
+		})
+	}
+}
+
+func benchmarkEncodeWithAllocatorFor(b *testing.B, target runtime.EncoderWithAllocator) {
+	for _, tc := range benchTestCases() {
+		b.Run(tc.name, func(b *testing.B) {
+			b.ReportAllocs()
+			allocator := &runtime.Allocator{}
+			for n := 0; n < b.N; n++ {
+				err := target.EncodeWithAllocator(tc.obj, ioutil.Discard, allocator)
+				if err != nil {
+					b.Fatal(err)
+				}
+			}
+		})
+	}
+}
+
+type benchTestCase struct {
+	name string
+	obj  runtime.Object
+}
+
+func benchTestCases() []benchTestCase {
+	return []benchTestCase{
+		{
+			name: "an obj with 1kB payload",
+			obj: func() runtime.Object {
+				carpPayload := make([]byte, 1000) // 1 kB
+				if _, err := rand.Read(carpPayload); err != nil {
+					panic(err)
+				}
+				return carpWithPayload(carpPayload)
+			}(),
+		},
+		{
+			name: "an obj with 10kB payload",
+			obj: func() runtime.Object {
+				carpPayload := make([]byte, 10000) // 10 kB
+				if _, err := rand.Read(carpPayload); err != nil {
+					panic(err)
+				}
+				return carpWithPayload(carpPayload)
+			}(),
+		},
+		{
+			name: "an obj with 100kB payload",
+			obj: func() runtime.Object {
+				carpPayload := make([]byte, 100000) // 100 kB
+				if _, err := rand.Read(carpPayload); err != nil {
+					panic(err)
+				}
+				return carpWithPayload(carpPayload)
+			}(),
+		},
+		{
+			name: "an obj with 1MB payload",
+			obj: func() runtime.Object {
+				carpPayload := make([]byte, 1000000) // 1 MB
+				if _, err := rand.Read(carpPayload); err != nil {
+					panic(err)
+				}
+				return carpWithPayload(carpPayload)
+			}(),
+		},
+	}
+}
+
+func carpWithPayload(carpPayload []byte) *testapigroupv1.Carp {
+	gvk := &schema.GroupVersionKind{Group: "group", Version: "version", Kind: "Carp"}
+	return &testapigroupv1.Carp{
+		TypeMeta: metav1.TypeMeta{APIVersion: gvk.GroupVersion().String(), Kind: gvk.Kind},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "name",
+			Namespace: "namespace",
+		},
+		Spec: testapigroupv1.CarpSpec{
+			Subdomain:    "carp.k8s.io",
+			NodeSelector: map[string]string{"payload": string(carpPayload)},
+		},
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/collections.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/collections.go
new file mode 100644
index 0000000000..3fa6012dde
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/collections.go
@@ -0,0 +1,249 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"sort"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/conversion"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func streamEncodeCollections(obj runtime.Object, w io.Writer) (bool, error) {
+	list, ok := obj.(*unstructured.UnstructuredList)
+	if ok {
+		return true, newStreamEncoder(w).encodeUnstructuredList(list)
+	}
+	if _, ok := obj.(json.Marshaler); ok {
+		return false, nil
+	}
+	typeMeta, listMeta, items, err := getListMeta(obj)
+	if err == nil {
+		return true, newStreamEncoder(w).encodeList(typeMeta, listMeta, items)
+	}
+	return false, nil
+}
+
+// getListMeta implements list extraction logic for json stream serialization.
+//
+// Reason for a custom logic instead of reusing accessors from meta package:
+// * Validate json tags to prevent incompatibility with json standard package.
+// * ListMetaAccessor doesn't distinguish empty from nil value.
+// * TypeAccessort reparsing "apiVersion" and serializing it with "{group}/{version}"
+func getListMeta(list runtime.Object) (metav1.TypeMeta, metav1.ListMeta, []runtime.Object, error) {
+	listValue, err := conversion.EnforcePtr(list)
+	if err != nil {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, err
+	}
+	listType := listValue.Type()
+	if listType.NumField() != 3 {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected ListType to have 3 fields")
+	}
+	// TypeMeta
+	typeMeta, ok := listValue.Field(0).Interface().(metav1.TypeMeta)
+	if !ok {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected TypeMeta field to have TypeMeta type")
+	}
+	if !listType.Field(0).Anonymous {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be embedded`)
+	}
+	if jsonTag, jsonTagExists := listType.Field(0).Tag.Lookup("json"); !jsonTagExists {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag`)
+	} else if jsonTag != "" && jsonTag != ",inline" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be "" or ",inline"`)
+	}
+	// ListMeta
+	listMeta, ok := listValue.Field(1).Interface().(metav1.ListMeta)
+	if !ok {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected ListMeta field to have ListMeta type")
+	}
+	if listType.Field(1).Tag.Get("json") != "metadata,omitempty" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected ListMeta json field tag to be "metadata,omitempty"`)
+	}
+	// Items
+	items, err := meta.ExtractList(list)
+	if err != nil {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, err
+	}
+	if listType.Field(2).Tag.Get("json") != "items" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected Items json field tag to be "items"`)
+	}
+	return typeMeta, listMeta, items, nil
+}
+
+// streamEncoder encodes JSON values to w, reusing an internal buffer across
+// values to avoid the fresh output allocation json.Marshal makes per call.
+type streamEncoder struct {
+	w    io.Writer
+	buf  bytes.Buffer
+	json *json.Encoder
+}
+
+func newStreamEncoder(w io.Writer) *streamEncoder {
+	e := &streamEncoder{w: w}
+	e.json = json.NewEncoder(&e.buf)
+	return e
+}
+
+func (e *streamEncoder) encodeList(typeMeta metav1.TypeMeta, listMeta metav1.ListMeta, items []runtime.Object) error {
+	// Start
+	if _, err := e.w.Write([]byte(`{`)); err != nil {
+		return err
+	}
+
+	// TypeMeta
+	if typeMeta.Kind != "" {
+		if err := e.encodeKeyValuePair("kind", typeMeta.Kind, []byte(",")); err != nil {
+			return err
+		}
+	}
+	if typeMeta.APIVersion != "" {
+		if err := e.encodeKeyValuePair("apiVersion", typeMeta.APIVersion, []byte(",")); err != nil {
+			return err
+		}
+	}
+
+	// ListMeta
+	if err := e.encodeKeyValuePair("metadata", listMeta, []byte(",")); err != nil {
+		return err
+	}
+
+	// Items
+	if err := e.encodeItemsObjectSlice(items); err != nil {
+		return err
+	}
+
+	// End
+	_, err := e.w.Write([]byte("}\n"))
+	return err
+}
+
+func (e *streamEncoder) encodeItemsObjectSlice(items []runtime.Object) (err error) {
+	if items == nil {
+		err := e.encodeKeyValuePair("items", nil, nil)
+		return err
+	}
+	_, err = e.w.Write([]byte(`"items":[`))
+	if err != nil {
+		return err
+	}
+	suffix := []byte(",")
+	for i, item := range items {
+		if i == len(items)-1 {
+			suffix = nil
+		}
+		err := e.encodeValue(item, suffix)
+		if err != nil {
+			return err
+		}
+	}
+	_, err = e.w.Write([]byte("]"))
+	if err != nil {
+		return err
+	}
+	return err
+}
+
+func (e *streamEncoder) encodeUnstructuredList(list *unstructured.UnstructuredList) error {
+	_, err := e.w.Write([]byte(`{`))
+	if err != nil {
+		return err
+	}
+	keys := make([]string, 0, len(list.Object)+1)
+	for key := range list.Object {
+		keys = append(keys, key)
+	}
+	if _, exists := list.Object["items"]; !exists {
+		keys = append(keys, "items")
+	}
+	sort.Strings(keys)
+
+	suffix := []byte(",")
+	for i, key := range keys {
+		if i == len(keys)-1 {
+			suffix = nil
+		}
+		if key == "items" {
+			err = e.encodeItemsUnstructuredSlice(list.Items, suffix)
+		} else {
+			err = e.encodeKeyValuePair(key, list.Object[key], suffix)
+		}
+		if err != nil {
+			return err
+		}
+	}
+	_, err = e.w.Write([]byte("}\n"))
+	return err
+}
+
+func (e *streamEncoder) encodeItemsUnstructuredSlice(items []unstructured.Unstructured, suffix []byte) (err error) {
+	_, err = e.w.Write([]byte(`"items":[`))
+	if err != nil {
+		return err
+	}
+	comma := []byte(",")
+	for i, item := range items {
+		if i == len(items)-1 {
+			comma = nil
+		}
+		err := e.encodeValue(item.Object, comma)
+		if err != nil {
+			return err
+		}
+	}
+	_, err = e.w.Write([]byte("]"))
+	if err != nil {
+		return err
+	}
+	if len(suffix) > 0 {
+		_, err = e.w.Write(suffix)
+	}
+	return err
+}
+
+func (e *streamEncoder) encodeKeyValuePair(key string, value any, suffix []byte) (err error) {
+	err = e.encodeValue(key, []byte(":"))
+	if err != nil {
+		return err
+	}
+	err = e.encodeValue(value, suffix)
+	if err != nil {
+		return err
+	}
+	return err
+}
+
+func (e *streamEncoder) encodeValue(value any, suffix []byte) error {
+	e.buf.Reset()
+	if err := e.json.Encode(value); err != nil {
+		return err
+	}
+	// Encode appends a newline after the value; replace it with the suffix to
+	// keep the output identical to json.Marshal's.
+	e.buf.Truncate(e.buf.Len() - 1)
+	e.buf.Write(suffix)
+	_, err := e.w.Write(e.buf.Bytes())
+	return err
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/collections_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/collections_test.go
new file mode 100644
index 0000000000..3fc398961b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/collections_test.go
@@ -0,0 +1,869 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	"bytes"
+	"fmt"
+	"math/rand"
+	"slices"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"sigs.k8s.io/randfill"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	testapigroupv1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func TestCollectionsEncoding(t *testing.T) {
+	t.Run("Normal", func(t *testing.T) {
+		testCollectionsEncoding(t, NewSerializerWithOptions(DefaultMetaFactory, nil, nil, SerializerOptions{}), false)
+	})
+	t.Run("Streaming", func(t *testing.T) {
+		testCollectionsEncoding(t, NewSerializerWithOptions(DefaultMetaFactory, nil, nil, SerializerOptions{StreamingCollectionsEncoding: true}), true)
+	})
+}
+
+// testCollectionsEncoding should provide comprehensive tests to validate streaming implementation of encoder.
+func testCollectionsEncoding(t *testing.T, s *Serializer, streamingEnabled bool) {
+	var buf writeCountingBuffer
+	var remainingItems int64 = 1
+	// As defined in KEP-5116 we it should include the following scenarios:
+	// Context: https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/5116-streaming-response-encoding#unit-tests
+	for _, tc := range []struct {
+		name         string
+		in           runtime.Object
+		cannotStream bool
+		expect       string
+		// allow provides allowed alternate representations.
+		// For the json v1->v2 transition, this is used to tolerate changes
+		// in how malformed input in munged.
+		allow []string
+	}{
+		// Preserving the distinction between integers and floating-point numbers
+		{
+			name: "Struct with floats",
+			in: &StructWithFloatsList{
+				Items: []StructWithFloats{
+					{
+						Int:     1,
+						Float32: float32(1),
+						Float64: 1.1,
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"Int\":1,\"Float32\":1,\"Float64\":1.1}]}\n",
+		},
+		{
+			name: "Unstructured object float",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"int":     1,
+					"float32": float32(1),
+					"float64": 1.1,
+				},
+			},
+			expect: "{\"float32\":1,\"float64\":1.1,\"int\":1,\"items\":[]}\n",
+		},
+		{
+			name: "Unstructured items float",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"int":     1,
+							"float32": float32(1),
+							"float64": 1.1,
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"float32\":1,\"float64\":1.1,\"int\":1}]}\n",
+		},
+		// Handling structs with duplicate field names (JSON tag names) without producing duplicate keys in the encoded output
+		{
+			name: "StructWithDuplicatedTags",
+			in: &StructWithDuplicatedTagsList{
+				Items: []StructWithDuplicatedTags{
+					{
+						Key1: "key1",
+						Key2: "key2",
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{}}]}\n",
+		},
+		// Encoding Go strings containing invalid UTF-8 sequences without error
+		{
+			name: "UnstructuredList object invalid UTF-8 ",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"key": "\x80", // first byte is a continuation byte
+				},
+			},
+			expect: "{\"items\":[],\"key\":\"\\ufffd\"}\n",
+			// Go json/v2 emits U+FFFD as raw UTF-8 bytes rather than the \ufffd escape.
+			allow: []string{"{\"items\":[],\"key\":\"\ufffd\"}\n"},
+		},
+		{
+			name: "UnstructuredList items invalid UTF-8 ",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"key": "\x80", // first byte is a continuation byte
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"key\":\"\\ufffd\"}]}\n",
+			// Go json/v2 emits U+FFFD as raw UTF-8 bytes rather than the \ufffd escape.
+			allow: []string{"{\"items\":[{\"key\":\"\ufffd\"}]}\n"},
+		},
+		// Preserving the distinction between absent, present-but-null, and present-and-empty states for slices and maps
+		{
+			name: "CarpList items nil",
+			in: &testapigroupv1.CarpList{
+				Items: nil,
+			},
+			expect: "{\"metadata\":{},\"items\":null}\n",
+		},
+		{
+			name: "CarpList slice nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: nil,
+						},
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"spec\":{},\"status\":{}}]}\n",
+		},
+		{
+			name: "CarpList map nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: nil,
+						},
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"spec\":{},\"status\":{}}]}\n",
+		},
+		{
+			name: "UnstructuredList items nil",
+			in: &unstructured.UnstructuredList{
+				Items: nil,
+			},
+			expect: "{\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList items slice nil",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"slice": ([]string)(nil),
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"slice\":null}]}\n",
+		},
+		{
+			name: "UnstructuredList items map nil",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"map": (map[string]string)(nil),
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"map\":null}]}\n",
+		},
+		{
+			name: "UnstructuredList object nil",
+			in: &unstructured.UnstructuredList{
+				Object: nil,
+			},
+			expect: "{\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList object slice nil",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"slice": ([]string)(nil),
+				},
+			},
+			expect: "{\"items\":[],\"slice\":null}\n",
+		},
+		{
+			name: "UnstructuredList object map nil",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"map": (map[string]string)(nil),
+				},
+			},
+			expect: "{\"items\":[],\"map\":null}\n",
+		},
+		{
+			name: "CarpList items empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{},
+			},
+			expect: "{\"metadata\":{},\"items\":[]}\n",
+		},
+		{
+			name: "CarpList slice empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: []testapigroupv1.CarpCondition{},
+						},
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"spec\":{},\"status\":{}}]}\n",
+		},
+		{
+			name: "CarpList map empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: map[string]string{},
+						},
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"spec\":{},\"status\":{}}]}\n",
+		},
+		{
+			name: "UnstructuredList items empty",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{},
+			},
+			expect: "{\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList items slice empty",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"slice": []string{},
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"slice\":[]}]}\n",
+		},
+		{
+			name: "UnstructuredList items map empty",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"map": map[string]string{},
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"map\":{}}]}\n",
+		},
+		{
+			name: "UnstructuredList object empty",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{},
+			},
+			expect: "{\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList object slice empty",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"slice": []string{},
+				},
+			},
+			expect: "{\"items\":[],\"slice\":[]}\n",
+		},
+		{
+			name: "UnstructuredList object map empty",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"map": map[string]string{},
+				},
+			},
+			expect: "{\"items\":[],\"map\":{}}\n",
+		},
+		// Handling structs implementing MarshallJSON method, especially built-in collection types.
+		{
+			name:         "List with MarshallJSON cannot be streamed",
+			in:           &ListWithMarshalJSONList{},
+			expect:       "\"marshallJSON\"\n",
+			cannotStream: true,
+		},
+		{
+			name: "Struct with MarshallJSON",
+			in: &StructWithMarshalJSONList{
+				Items: []StructWithMarshalJSON{
+					{},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[\"marshallJSON\"]}\n",
+		},
+		// Handling raw bytes.
+		{
+			name: "Struct with raw bytes",
+			in: &StructWithRawBytesList{
+				Items: []StructWithRawBytes{
+					{
+						Slice: []byte{0x01, 0x02, 0x03},
+						Array: [3]byte{0x01, 0x02, 0x03},
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"Slice\":\"AQID\",\"Array\":[1,2,3]}]}\n",
+		},
+		{
+			name: "UnstructuredList object raw bytes",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"slice": []byte{0x01, 0x02, 0x03},
+					"array": [3]byte{0x01, 0x02, 0x03},
+				},
+			},
+			expect: "{\"array\":[1,2,3],\"items\":[],\"slice\":\"AQID\"}\n",
+		},
+		{
+			name: "UnstructuredList items raw bytes",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"slice": []byte{0x01, 0x02, 0x03},
+							"array": [3]byte{0x01, 0x02, 0x03},
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"array\":[1,2,3],\"slice\":\"AQID\"}]}\n",
+		},
+		// Other scenarios:
+		{
+			name: "List just kind",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind: "List",
+				},
+			},
+			expect: "{\"kind\":\"List\",\"metadata\":{},\"items\":null}\n",
+		},
+		{
+			name: "List just apiVersion",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "v1",
+				},
+			},
+			expect: "{\"apiVersion\":\"v1\",\"metadata\":{},\"items\":null}\n",
+		},
+		{
+			name: "List no elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{},
+			},
+			expect: "{\"kind\":\"List\",\"apiVersion\":\"v1\",\"metadata\":{\"resourceVersion\":\"2345\"},\"items\":[]}\n",
+		},
+		{
+			name: "List one element with continue",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion:    "2345",
+					Continue:           "abc",
+					RemainingItemCount: &remainingItems,
+				},
+				Items: []testapigroupv1.Carp{
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod",
+						Namespace: "default",
+					}},
+				},
+			},
+			expect: "{\"kind\":\"List\",\"apiVersion\":\"v1\",\"metadata\":{\"resourceVersion\":\"2345\",\"continue\":\"abc\",\"remainingItemCount\":1},\"items\":[{\"kind\":\"Carp\",\"apiVersion\":\"v1\",\"metadata\":{\"name\":\"pod\",\"namespace\":\"default\"},\"spec\":{},\"status\":{}}]}\n",
+		},
+		{
+			name: "List two elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod",
+						Namespace: "default",
+					}},
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod2",
+						Namespace: "default2",
+					}},
+				},
+			},
+			expect: `{"kind":"List","apiVersion":"v1","metadata":{"resourceVersion":"2345"},"items":[{"kind":"Carp","apiVersion":"v1","metadata":{"name":"pod","namespace":"default"},"spec":{},"status":{}},{"kind":"Carp","apiVersion":"v1","metadata":{"name":"pod2","namespace":"default2"},"spec":{},"status":{}}]}
+`,
+		},
+		{
+			name: "List with extra field cannot be streamed",
+			in: &ListWithAdditionalFields{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{},
+			},
+			cannotStream: true,
+			expect:       "{\"kind\":\"List\",\"apiVersion\":\"v1\",\"metadata\":{\"resourceVersion\":\"2345\"},\"items\":[],\"AdditionalField\":0}\n",
+		},
+		{
+			name: "Not a collection cannot be streamed",
+			in: &testapigroupv1.Carp{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+			},
+			cannotStream: true,
+			expect:       "{\"kind\":\"List\",\"apiVersion\":\"v1\",\"metadata\":{},\"spec\":{},\"status\":{}}\n",
+		},
+		{
+			name:   "UnstructuredList empty",
+			in:     &unstructured.UnstructuredList{},
+			expect: "{\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList just kind",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"kind": "List"},
+			},
+			expect: "{\"items\":[],\"kind\":\"List\"}\n",
+		},
+		{
+			name: "UnstructuredList just apiVersion",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"apiVersion": "v1"},
+			},
+			expect: "{\"apiVersion\":\"v1\",\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList no elements",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"kind": "List", "apiVersion": "v1", "metadata": map[string]interface{}{"resourceVersion": "2345"}},
+				Items:  []unstructured.Unstructured{},
+			},
+			expect: "{\"apiVersion\":\"v1\",\"items\":[],\"kind\":\"List\",\"metadata\":{\"resourceVersion\":\"2345\"}}\n",
+		},
+		{
+			name: "UnstructuredList one element with continue",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"kind": "List", "apiVersion": "v1", "metadata": map[string]interface{}{
+					"resourceVersion":    "2345",
+					"continue":           "abc",
+					"remainingItemCount": "1",
+				}},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "Carp",
+							"metadata": map[string]interface{}{
+								"name":      "pod",
+								"namespace": "default",
+							},
+						},
+					},
+				},
+			},
+			expect: "{\"apiVersion\":\"v1\",\"items\":[{\"apiVersion\":\"v1\",\"kind\":\"Carp\",\"metadata\":{\"name\":\"pod\",\"namespace\":\"default\"}}],\"kind\":\"List\",\"metadata\":{\"continue\":\"abc\",\"remainingItemCount\":\"1\",\"resourceVersion\":\"2345\"}}\n",
+		},
+		{
+			name: "UnstructuredList two elements",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"kind": "List", "apiVersion": "v1", "metadata": map[string]interface{}{
+					"resourceVersion": "2345",
+				}},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "Carp",
+							"metadata": map[string]interface{}{
+								"name":      "pod",
+								"namespace": "default",
+							},
+						},
+					},
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "Carp",
+							"metadata": map[string]interface{}{
+								"name":      "pod2",
+								"namespace": "default",
+							},
+						},
+					},
+				},
+			},
+			expect: "{\"apiVersion\":\"v1\",\"items\":[{\"apiVersion\":\"v1\",\"kind\":\"Carp\",\"metadata\":{\"name\":\"pod\",\"namespace\":\"default\"}},{\"apiVersion\":\"v1\",\"kind\":\"Carp\",\"metadata\":{\"name\":\"pod2\",\"namespace\":\"default\"}}],\"kind\":\"List\",\"metadata\":{\"resourceVersion\":\"2345\"}}\n",
+		},
+		{
+			name: "UnstructuredList conflict on items",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"items": []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"name": "pod",
+						},
+					},
+				},
+				},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"name": "pod2",
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"name\":\"pod2\"}]}\n",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			buf.Reset()
+			if err := s.Encode(tc.in, &buf); err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			t.Logf("encoded: %s", buf.String())
+			if got := buf.String(); got != tc.expect && !slices.Contains(tc.allow, got) {
+				t.Errorf("not matching:\n%s", cmp.Diff(got, tc.expect))
+			}
+			expectStreaming := !tc.cannotStream && streamingEnabled
+			if expectStreaming && buf.writeCount <= 1 {
+				t.Errorf("expected streaming but Write was called only: %d", buf.writeCount)
+			}
+			if !expectStreaming && buf.writeCount > 1 {
+				t.Errorf("expected non-streaming but Write was called more than once: %d", buf.writeCount)
+			}
+		})
+	}
+}
+
+type StructWithFloatsList struct {
+	metav1.TypeMeta `json:""`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithFloats `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *StructWithFloatsList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithFloats struct {
+	metav1.TypeMeta   `json:""`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	Int     int
+	Float32 float32
+	Float64 float64
+}
+
+func (s *StructWithFloats) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithDuplicatedTagsList struct {
+	metav1.TypeMeta `json:""`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithDuplicatedTags `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *StructWithDuplicatedTagsList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithDuplicatedTags struct {
+	metav1.TypeMeta   `json:""`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	Key1 string `json:"key"`
+	Key2 string `json:"key"` //nolint:govet
+}
+
+func (s *StructWithDuplicatedTags) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type ListWithMarshalJSONList struct {
+	metav1.TypeMeta `json:""`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []string `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *ListWithMarshalJSONList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *ListWithMarshalJSONList) MarshalJSON() ([]byte, error) {
+	return []byte(`"marshallJSON"`), nil
+}
+
+type StructWithMarshalJSONList struct {
+	metav1.TypeMeta `json:""`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithMarshalJSON `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *StructWithMarshalJSONList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithMarshalJSON struct {
+	metav1.TypeMeta   `json:""`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+}
+
+func (l *StructWithMarshalJSON) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *StructWithMarshalJSON) MarshalJSON() ([]byte, error) {
+	return []byte(`"marshallJSON"`), nil
+}
+
+type StructWithRawBytesList struct {
+	metav1.TypeMeta `json:""`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithRawBytes `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *StructWithRawBytesList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithRawBytes struct {
+	metav1.TypeMeta   `json:""`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Slice             []byte
+	Array             [3]byte
+}
+
+func (s *StructWithRawBytes) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type ListWithAdditionalFields struct {
+	metav1.TypeMeta `json:""`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []testapigroupv1.Carp `json:"items" protobuf:"bytes,2,rep,name=items"`
+	AdditionalField int
+}
+
+func (s *ListWithAdditionalFields) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type writeCountingBuffer struct {
+	writeCount int
+	bytes.Buffer
+}
+
+func (b *writeCountingBuffer) Write(data []byte) (int, error) {
+	b.writeCount++
+	return b.Buffer.Write(data)
+}
+
+func (b *writeCountingBuffer) Reset() {
+	b.writeCount = 0
+	b.Buffer.Reset()
+}
+
+func TestFuzzCollectionsEncoding(t *testing.T) {
+	disableFuzzFieldsV1 := func(field *metav1.FieldsV1, c randfill.Continue) {}
+	fuzzUnstructuredList := func(list *unstructured.UnstructuredList, c randfill.Continue) {
+		list.Object = map[string]interface{}{
+			"kind":       "List",
+			"apiVersion": "v1",
+			c.String(0):  c.String(0),
+			c.String(0):  c.Uint64(),
+			c.String(0):  c.Bool(),
+			"metadata": map[string]interface{}{
+				"resourceVersion":    fmt.Sprintf("%d", c.Uint64()),
+				"continue":           c.String(0),
+				"remainingItemCount": fmt.Sprintf("%d", c.Uint64()),
+				c.String(0):          c.String(0),
+			}}
+		c.Fill(&list.Items)
+	}
+	fuzzMap := func(kvs map[string]interface{}, c randfill.Continue) {
+		kvs[c.String(0)] = c.Bool()
+		kvs[c.String(0)] = c.Uint64()
+		kvs[c.String(0)] = c.String(0)
+	}
+	f := randfill.New().Funcs(disableFuzzFieldsV1, fuzzUnstructuredList, fuzzMap)
+	streamingBuffer := &bytes.Buffer{}
+	normalSerializer := NewSerializerWithOptions(DefaultMetaFactory, nil, nil, SerializerOptions{StreamingCollectionsEncoding: false})
+	normalBuffer := &bytes.Buffer{}
+	t.Run("CarpList", func(t *testing.T) {
+		for range 1000 {
+			list := &testapigroupv1.CarpList{}
+			f.Fill(list)
+			streamingBuffer.Reset()
+			normalBuffer.Reset()
+			ok, err := streamEncodeCollections(list, streamingBuffer)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if !ok {
+				t.Fatalf("expected streaming encoder to encode %T", list)
+			}
+			if err := normalSerializer.Encode(list, normalBuffer); err != nil {
+				t.Fatal(err)
+			}
+			if diff := cmp.Diff(normalBuffer.String(), streamingBuffer.String()); diff != "" {
+				t.Logf("normal: %s", normalBuffer.String())
+				t.Logf("streaming: %s", streamingBuffer.String())
+				t.Errorf("not matching:\n%s", diff)
+			}
+		}
+	})
+	t.Run("UnstructuredList", func(t *testing.T) {
+		for range 1000 {
+			list := &unstructured.UnstructuredList{}
+			f.Fill(list)
+			streamingBuffer.Reset()
+			normalBuffer.Reset()
+			ok, err := streamEncodeCollections(list, streamingBuffer)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if !ok {
+				t.Fatalf("expected streaming encoder to encode %T", list)
+			}
+			if err := normalSerializer.Encode(list, normalBuffer); err != nil {
+				t.Fatal(err)
+			}
+			if diff := cmp.Diff(normalBuffer.String(), streamingBuffer.String()); diff != "" {
+				t.Logf("normal: %s", normalBuffer.String())
+				t.Logf("streaming: %s", streamingBuffer.String())
+				t.Errorf("not matching:\n%s", diff)
+			}
+		}
+	})
+}
+
+func BenchmarkStreamEncodeCollections(b *testing.B) {
+	disableFuzzFieldsV1 := func(field *metav1.FieldsV1, c randfill.Continue) {}
+	fuzzMap := func(kvs map[string]interface{}, c randfill.Continue) {
+		kvs[c.String(0)] = c.Bool()
+		kvs[c.String(0)] = c.Uint64()
+		kvs[c.String(0)] = c.String(0)
+	}
+	f := randfill.New().RandSource(rand.NewSource(12345)).Funcs(disableFuzzFieldsV1, fuzzMap)
+	carpList := &testapigroupv1.CarpList{}
+	carpList.Items = make([]testapigroupv1.Carp, 1000)
+	for i := range 1000 {
+		f.Fill(&carpList.Items[i])
+	}
+	carpList.Kind = "CarpList"
+	carpList.APIVersion = "testapigroup.k8s.io/v1"
+	carpList.ResourceVersion = "12345"
+	unstructuredList := &unstructured.UnstructuredList{}
+	unstructuredList.Object = map[string]interface{}{
+		"kind":       "List",
+		"apiVersion": "v1",
+		"metadata": map[string]interface{}{
+			"resourceVersion": "12345",
+		},
+	}
+	unstructuredList.Items = make([]unstructured.Unstructured, 1000)
+	for i := range 1000 {
+		unstrMap, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&carpList.Items[i])
+		if err != nil {
+			b.Fatalf("failed to convert carp to unstructured: %v", err)
+		}
+		unstructuredList.Items[i] = unstructured.Unstructured{Object: unstrMap}
+	}
+	b.Run("CarpList", func(b *testing.B) {
+		var buf bytes.Buffer
+		b.ReportAllocs()
+		b.ResetTimer()
+		for i := 0; i < b.N; i++ {
+			buf.Reset()
+			ok, err := streamEncodeCollections(carpList, &buf)
+			if err != nil {
+				b.Fatal(err)
+			}
+			if !ok {
+				b.Fatal("not ok")
+			}
+		}
+	})
+	b.Run("UnstructuredList", func(b *testing.B) {
+		var buf bytes.Buffer
+		b.ReportAllocs()
+		b.ResetTimer()
+		for i := 0; i < b.N; i++ {
+			buf.Reset()
+			ok, err := streamEncodeCollections(unstructuredList, &buf)
+			if err != nil {
+				b.Fatal(err)
+			}
+			if !ok {
+				b.Fatal("not ok")
+			}
+		}
+	})
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go
new file mode 100644
index 0000000000..52c814172f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go
@@ -0,0 +1,364 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	"encoding/json"
+	"io"
+	"strconv"
+
+	kjson "sigs.k8s.io/json"
+	"sigs.k8s.io/yaml"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/recognizer"
+	"k8s.io/apimachinery/pkg/util/framer"
+	utilyaml "k8s.io/apimachinery/pkg/util/yaml"
+	"k8s.io/klog/v2"
+)
+
+// NewSerializer creates a JSON serializer that handles encoding versioned objects into the proper JSON form. If typer
+// is not nil, the object has the group, version, and kind fields set.
+// Deprecated: use NewSerializerWithOptions instead.
+func NewSerializer(meta MetaFactory, creater runtime.ObjectCreater, typer runtime.ObjectTyper, pretty bool) *Serializer {
+	return NewSerializerWithOptions(meta, creater, typer, SerializerOptions{false, pretty, false, false})
+}
+
+// NewYAMLSerializer creates a YAML serializer that handles encoding versioned objects into the proper YAML form. If typer
+// is not nil, the object has the group, version, and kind fields set. This serializer supports only the subset of YAML that
+// matches JSON, and will error if constructs are used that do not serialize to JSON.
+// Deprecated: use NewSerializerWithOptions instead.
+func NewYAMLSerializer(meta MetaFactory, creater runtime.ObjectCreater, typer runtime.ObjectTyper) *Serializer {
+	return NewSerializerWithOptions(meta, creater, typer, SerializerOptions{true, false, false, false})
+}
+
+// NewSerializerWithOptions creates a JSON/YAML serializer that handles encoding versioned objects into the proper JSON/YAML
+// form. If typer is not nil, the object has the group, version, and kind fields set. Options are copied into the Serializer
+// and are immutable.
+func NewSerializerWithOptions(meta MetaFactory, creater runtime.ObjectCreater, typer runtime.ObjectTyper, options SerializerOptions) *Serializer {
+	return &Serializer{
+		meta:       meta,
+		creater:    creater,
+		typer:      typer,
+		options:    options,
+		identifier: identifier(options),
+	}
+}
+
+// identifier computes Identifier of Encoder based on the given options.
+func identifier(options SerializerOptions) runtime.Identifier {
+	result := map[string]string{
+		"name":   "json",
+		"yaml":   strconv.FormatBool(options.Yaml),
+		"pretty": strconv.FormatBool(options.Pretty),
+		"strict": strconv.FormatBool(options.Strict),
+	}
+	identifier, err := json.Marshal(result)
+	if err != nil {
+		//nolint:logcheck // Should not be reached.
+		klog.Fatalf("Failed marshaling identifier for json Serializer: %v", err)
+	}
+	return runtime.Identifier(identifier)
+}
+
+// SerializerOptions holds the options which are used to configure a JSON/YAML serializer.
+// example:
+// (1) To configure a JSON serializer, set `Yaml` to `false`.
+// (2) To configure a YAML serializer, set `Yaml` to `true`.
+// (3) To configure a strict serializer that can return strictDecodingError, set `Strict` to `true`.
+type SerializerOptions struct {
+	// Yaml: configures the Serializer to work with JSON(false) or YAML(true).
+	// When `Yaml` is enabled, this serializer only supports the subset of YAML that
+	// matches JSON, and will error if constructs are used that do not serialize to JSON.
+	Yaml bool
+
+	// Pretty: configures a JSON enabled Serializer(`Yaml: false`) to produce human-readable output.
+	// This option is silently ignored when `Yaml` is `true`.
+	Pretty bool
+
+	// Strict: configures the Serializer to return strictDecodingError's when duplicate fields are present decoding JSON or YAML.
+	// Note that enabling this option is not as performant as the non-strict variant, and should not be used in fast paths.
+	Strict bool
+
+	// StreamingCollectionsEncoding enables encoding collection, one item at the time, drastically reducing memory needed.
+	StreamingCollectionsEncoding bool
+}
+
+// Serializer handles encoding versioned objects into the proper JSON form
+type Serializer struct {
+	meta    MetaFactory
+	options SerializerOptions
+	creater runtime.ObjectCreater
+	typer   runtime.ObjectTyper
+
+	identifier runtime.Identifier
+}
+
+// Serializer implements Serializer
+var _ runtime.Serializer = &Serializer{}
+var _ recognizer.RecognizingDecoder = &Serializer{}
+
+// gvkWithDefaults returns group kind and version defaulting from provided default
+func gvkWithDefaults(actual, defaultGVK schema.GroupVersionKind) schema.GroupVersionKind {
+	if len(actual.Kind) == 0 {
+		actual.Kind = defaultGVK.Kind
+	}
+	if len(actual.Version) == 0 && len(actual.Group) == 0 {
+		actual.Group = defaultGVK.Group
+		actual.Version = defaultGVK.Version
+	}
+	if len(actual.Version) == 0 && actual.Group == defaultGVK.Group {
+		actual.Version = defaultGVK.Version
+	}
+	return actual
+}
+
+// Decode attempts to convert the provided data into YAML or JSON, extract the stored schema kind, apply the provided default gvk, and then
+// load that data into an object matching the desired schema kind or the provided into.
+// If into is *runtime.Unknown, the raw data will be extracted and no decoding will be performed.
+// If into is not registered with the typer, then the object will be straight decoded using normal JSON/YAML unmarshalling.
+// If into is provided and the original data is not fully qualified with kind/version/group, the type of the into will be used to alter the returned gvk.
+// If into is nil or data's gvk different from into's gvk, it will generate a new Object with ObjectCreater.New(gvk)
+// On success or most errors, the method will return the calculated schema kind.
+// The gvk calculate priority will be originalData > default gvk > into
+func (s *Serializer) Decode(originalData []byte, gvk *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	data := originalData
+	if s.options.Yaml {
+		altered, err := yaml.YAMLToJSON(data)
+		if err != nil {
+			return nil, nil, err
+		}
+		data = altered
+	}
+
+	actual, err := s.meta.Interpret(data)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if gvk != nil {
+		*actual = gvkWithDefaults(*actual, *gvk)
+	}
+
+	if unk, ok := into.(*runtime.Unknown); ok && unk != nil {
+		unk.Raw = originalData
+		unk.ContentType = runtime.ContentTypeJSON
+		unk.GetObjectKind().SetGroupVersionKind(*actual)
+		return unk, actual, nil
+	}
+
+	if into != nil {
+		_, isUnstructured := into.(runtime.Unstructured)
+		types, _, err := s.typer.ObjectKinds(into)
+		switch {
+		case runtime.IsNotRegisteredError(err), isUnstructured:
+			strictErrs, err := s.unmarshal(into, data, originalData)
+			if err != nil {
+				return nil, actual, err
+			}
+
+			// when decoding directly into a provided unstructured object,
+			// extract the actual gvk decoded from the provided data,
+			// and ensure it is non-empty.
+			if isUnstructured {
+				*actual = into.GetObjectKind().GroupVersionKind()
+				if len(actual.Kind) == 0 {
+					return nil, actual, runtime.NewMissingKindErr(string(originalData))
+				}
+				// TODO(109023): require apiVersion here as well once unstructuredJSONScheme#Decode does
+			}
+
+			if len(strictErrs) > 0 {
+				return into, actual, runtime.NewStrictDecodingError(strictErrs)
+			}
+			return into, actual, nil
+		case err != nil:
+			return nil, actual, err
+		default:
+			*actual = gvkWithDefaults(*actual, types[0])
+		}
+	}
+
+	if len(actual.Kind) == 0 {
+		return nil, actual, runtime.NewMissingKindErr(string(originalData))
+	}
+	if len(actual.Version) == 0 {
+		return nil, actual, runtime.NewMissingVersionErr(string(originalData))
+	}
+
+	// use the target if necessary
+	obj, err := runtime.UseOrCreateObject(s.typer, s.creater, *actual, into)
+	if err != nil {
+		return nil, actual, err
+	}
+
+	strictErrs, err := s.unmarshal(obj, data, originalData)
+	if err != nil {
+		return nil, actual, err
+	} else if len(strictErrs) > 0 {
+		return obj, actual, runtime.NewStrictDecodingError(strictErrs)
+	}
+	return obj, actual, nil
+}
+
+// Encode serializes the provided object to the given writer.
+func (s *Serializer) Encode(obj runtime.Object, w io.Writer) error {
+	if co, ok := obj.(runtime.CacheableObject); ok {
+		return co.CacheEncode(s.Identifier(), s.doEncode, w)
+	}
+	return s.doEncode(obj, w)
+}
+
+func (s *Serializer) doEncode(obj runtime.Object, w io.Writer) error {
+	if s.options.Yaml {
+		json, err := json.Marshal(obj)
+		if err != nil {
+			return err
+		}
+		data, err := yaml.JSONToYAML(json)
+		if err != nil {
+			return err
+		}
+		_, err = w.Write(data)
+		return err
+	}
+
+	if s.options.Pretty {
+		data, err := json.MarshalIndent(obj, "", "  ")
+		if err != nil {
+			return err
+		}
+		_, err = w.Write(data)
+		return err
+	}
+	if s.options.StreamingCollectionsEncoding {
+		ok, err := streamEncodeCollections(obj, w)
+		if err != nil {
+			return err
+		}
+		if ok {
+			return nil
+		}
+	}
+	encoder := json.NewEncoder(w)
+	return encoder.Encode(obj)
+}
+
+// IsStrict indicates whether the serializer
+// uses strict decoding or not
+func (s *Serializer) IsStrict() bool {
+	return s.options.Strict
+}
+
+func (s *Serializer) unmarshal(into runtime.Object, data, originalData []byte) (strictErrs []error, err error) {
+	// If the deserializer is non-strict, return here.
+	if !s.options.Strict {
+		if err := kjson.UnmarshalCaseSensitivePreserveInts(data, into); err != nil {
+			return nil, err
+		}
+		return nil, nil
+	}
+
+	if s.options.Yaml {
+		// In strict mode pass the original data through the YAMLToJSONStrict converter.
+		// This is done to catch duplicate fields in YAML that would have been dropped in the original YAMLToJSON conversion.
+		// TODO: rework YAMLToJSONStrict to return warnings about duplicate fields without terminating so we don't have to do this twice.
+		_, err := yaml.YAMLToJSONStrict(originalData)
+		if err != nil {
+			strictErrs = append(strictErrs, err)
+		}
+	}
+
+	var strictJSONErrs []error
+	if u, isUnstructured := into.(runtime.Unstructured); isUnstructured {
+		// Unstructured is a custom unmarshaler that gets delegated
+		// to, so in order to detect strict JSON errors we need
+		// to unmarshal directly into the object.
+		m := map[string]interface{}{}
+		strictJSONErrs, err = kjson.UnmarshalStrict(data, &m)
+		u.SetUnstructuredContent(m)
+	} else {
+		strictJSONErrs, err = kjson.UnmarshalStrict(data, into)
+	}
+	if err != nil {
+		// fatal decoding error, not due to strictness
+		return nil, err
+	}
+	strictErrs = append(strictErrs, strictJSONErrs...)
+	return strictErrs, nil
+}
+
+// Identifier implements runtime.Encoder interface.
+func (s *Serializer) Identifier() runtime.Identifier {
+	return s.identifier
+}
+
+// RecognizesData implements the RecognizingDecoder interface.
+func (s *Serializer) RecognizesData(data []byte) (ok, unknown bool, err error) {
+	if s.options.Yaml {
+		// we could potentially look for '---'
+		return false, true, nil
+	}
+	return utilyaml.IsJSONBuffer(data), false, nil
+}
+
+// Framer is the default JSON framing behavior, with newlines delimiting individual objects.
+var Framer = jsonFramer{}
+
+type jsonFramer struct{}
+
+// NewFrameWriter implements stream framing for this serializer
+func (jsonFramer) NewFrameWriter(w io.Writer) io.Writer {
+	// we can write JSON objects directly to the writer, because they are self-framing
+	return w
+}
+
+// NewFrameReader implements stream framing for this serializer
+func (jsonFramer) NewFrameReader(r io.ReadCloser) io.ReadCloser {
+	// we need to extract the JSON chunks of data to pass to Decode()
+	return framer.NewJSONFramedReader(r)
+}
+
+// YAMLFramer is the default JSON framing behavior, with newlines delimiting individual objects.
+var YAMLFramer = yamlFramer{}
+
+type yamlFramer struct{}
+
+// NewFrameWriter implements stream framing for this serializer
+func (yamlFramer) NewFrameWriter(w io.Writer) io.Writer {
+	return yamlFrameWriter{w}
+}
+
+// NewFrameReader implements stream framing for this serializer
+func (yamlFramer) NewFrameReader(r io.ReadCloser) io.ReadCloser {
+	// extract the YAML document chunks directly
+	return utilyaml.NewDocumentDecoder(r)
+}
+
+type yamlFrameWriter struct {
+	w io.Writer
+}
+
+// Write separates each document with the YAML document separator (`---` followed by line
+// break). Writers must write well formed YAML documents (include a final line break).
+func (w yamlFrameWriter) Write(data []byte) (n int, err error) {
+	if _, err := w.w.Write([]byte("---\n")); err != nil {
+		return 0, err
+	}
+	return w.w.Write(data)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json_limit_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json_limit_test.go
new file mode 100644
index 0000000000..8214d293c6
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json_limit_test.go
@@ -0,0 +1,169 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	gojson "encoding/json"
+	"strings"
+	"testing"
+
+	utiljson "k8s.io/apimachinery/pkg/util/json"
+)
+
+type testcase struct {
+	name     string
+	data     []byte
+	checkErr func(t testing.TB, err error)
+
+	benchmark bool
+}
+
+func testcases() []testcase {
+	// verify we got an error of some kind
+	nonNilError := func(t testing.TB, err error) {
+		if err == nil {
+			t.Errorf("expected error, got none")
+		}
+	}
+	// verify the parse completed, either with success or a max depth error
+	successOrMaxDepthError := func(t testing.TB, err error) {
+		if err != nil && !strings.Contains(err.Error(), "max depth") {
+			t.Errorf("expected success or error containing 'max depth', got: %v", err)
+		}
+	}
+
+	return []testcase{
+		{
+			name:     "3MB of deeply nested slices",
+			checkErr: successOrMaxDepthError,
+			data:     []byte(`{"a":` + strings.Repeat(`[`, 3*1024*1024/2) + strings.Repeat(`]`, 3*1024*1024/2) + "}"),
+		},
+		{
+			name:     "3MB of unbalanced nested slices",
+			checkErr: nonNilError,
+			data:     []byte(`{"a":` + strings.Repeat(`[`, 3*1024*1024)),
+		},
+		{
+			name:     "3MB of deeply nested maps",
+			checkErr: successOrMaxDepthError,
+			data:     []byte(strings.Repeat(`{"":`, 3*1024*1024/5/2) + "{}" + strings.Repeat(`}`, 3*1024*1024/5/2)),
+		},
+		{
+			name:     "3MB of unbalanced nested maps",
+			checkErr: nonNilError,
+			data:     []byte(strings.Repeat(`{"":`, 3*1024*1024/5)),
+		},
+		{
+			name:      "3MB of empty slices",
+			data:      []byte(`{"a":[` + strings.Repeat(`[],`, 3*1024*1024/3-2) + `[]]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of slices",
+			data:      []byte(`{"a":[` + strings.Repeat(`[0],`, 3*1024*1024/4-2) + `[0]]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of empty maps",
+			data:      []byte(`{"a":[` + strings.Repeat(`{},`, 3*1024*1024/3-2) + `{}]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of maps",
+			data:      []byte(`{"a":[` + strings.Repeat(`{"a":0},`, 3*1024*1024/8-2) + `{"a":0}]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of ints",
+			data:      []byte(`{"a":[` + strings.Repeat(`0,`, 3*1024*1024/2-2) + `0]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of floats",
+			data:      []byte(`{"a":[` + strings.Repeat(`0.0,`, 3*1024*1024/4-2) + `0.0]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of bools",
+			data:      []byte(`{"a":[` + strings.Repeat(`true,`, 3*1024*1024/5-2) + `true]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of empty strings",
+			data:      []byte(`{"a":[` + strings.Repeat(`"",`, 3*1024*1024/3-2) + `""]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of strings",
+			data:      []byte(`{"a":[` + strings.Repeat(`"abcdefghijklmnopqrstuvwxyz012",`, 3*1024*1024/30-2) + `"abcdefghijklmnopqrstuvwxyz012"]}`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of nulls",
+			data:      []byte(`{"a":[` + strings.Repeat(`null,`, 3*1024*1024/5-2) + `null]}`),
+			benchmark: true,
+		},
+	}
+}
+
+var decoders = map[string]func([]byte, interface{}) error{
+	"gojson":   gojson.Unmarshal,
+	"utiljson": utiljson.Unmarshal,
+}
+
+func TestJSONLimits(t *testing.T) {
+	for _, tc := range testcases() {
+		if tc.benchmark {
+			continue
+		}
+		t.Run(tc.name, func(t *testing.T) {
+			for decoderName, decoder := range decoders {
+				t.Run(decoderName, func(t *testing.T) {
+					v := map[string]interface{}{}
+					err := decoder(tc.data, &v)
+
+					if tc.checkErr != nil {
+						tc.checkErr(t, err)
+					} else if err != nil {
+						t.Errorf("unexpected error: %v", err)
+					}
+				})
+			}
+		})
+	}
+}
+
+func BenchmarkJSONLimits(b *testing.B) {
+	for _, tc := range testcases() {
+		b.Run(tc.name, func(b *testing.B) {
+			for decoderName, decoder := range decoders {
+				b.Run(decoderName, func(b *testing.B) {
+					for i := 0; i < b.N; i++ {
+						v := map[string]interface{}{}
+						err := decoder(tc.data, &v)
+
+						if tc.checkErr != nil {
+							tc.checkErr(b, err)
+						} else if err != nil {
+							b.Errorf("unexpected error: %v", err)
+						}
+					}
+				})
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json_test.go
new file mode 100644
index 0000000000..b21479a53f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/json_test.go
@@ -0,0 +1,1091 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json_test
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+	"k8s.io/apimachinery/pkg/util/diff"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+type testDecodable struct {
+	metav1.TypeMeta `json:""`
+
+	Other     string
+	Value     int           `json:"value"`
+	Spec      DecodableSpec `json:"spec"`
+	Interface interface{}   `json:"interface"`
+}
+
+// DecodableSpec has 15 fields.
+type DecodableSpec struct {
+	A int `json:"A"`
+	B int `json:"B"`
+	C int `json:"C"`
+	D int `json:"D"`
+	E int `json:"E"`
+	F int `json:"F"`
+	G int `json:"G"`
+	H int `json:"h"`
+	I int `json:"i"`
+	J int `json:"j"`
+	K int `json:"k"`
+	L int `json:"l"`
+	M int `json:"m"`
+	N int `json:"n"`
+	O int `json:"o"`
+}
+
+func (d *testDecodable) DeepCopyObject() runtime.Object {
+	if d == nil {
+		return nil
+	}
+	out := new(testDecodable)
+	d.DeepCopyInto(out)
+	return out
+}
+func (d *testDecodable) DeepCopyInto(out *testDecodable) {
+	*out = *d
+	out.Other = d.Other
+	out.Value = d.Value
+	out.Spec = d.Spec
+	out.Interface = d.Interface
+	return
+}
+
+type testDecodeCoercion struct {
+	metav1.TypeMeta `json:""`
+
+	Bool bool `json:"bool"`
+
+	Int   int `json:"int"`
+	Int32 int `json:"int32"`
+	Int64 int `json:"int64"`
+
+	Float32 float32 `json:"float32"`
+	Float64 float64 `json:"float64"`
+
+	String string `json:"string"`
+
+	Struct testDecodable `json:"struct"`
+
+	Array []string          `json:"array"`
+	Map   map[string]string `json:"map"`
+}
+
+func (d *testDecodeCoercion) DeepCopyObject() runtime.Object {
+	if d == nil {
+		return nil
+	}
+	out := new(testDecodeCoercion)
+	d.DeepCopyInto(out)
+	return out
+}
+func (d *testDecodeCoercion) DeepCopyInto(out *testDecodeCoercion) {
+	*out = *d
+	return
+}
+
+func TestDecode(t *testing.T) {
+	type testCase struct {
+		creater runtime.ObjectCreater
+		typer   runtime.ObjectTyper
+		yaml    bool
+		pretty  bool
+		strict  bool
+
+		data       []byte
+		defaultGVK *schema.GroupVersionKind
+		into       runtime.Object
+
+		errFn          func(error) bool
+		expectedObject runtime.Object
+		expectedGVK    *schema.GroupVersionKind
+	}
+
+	testCases := []testCase{
+		// missing metadata without into, typed creater
+		{
+			data: []byte("{}"),
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data: []byte("{}"),
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data: []byte(`{"kind":"Foo"}`),
+
+			expectedGVK: &schema.GroupVersionKind{Kind: "Foo"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'apiVersion' is missing in") },
+		},
+		{
+			data: []byte(`{"kind":"Foo"}`),
+
+			expectedGVK: &schema.GroupVersionKind{Kind: "Foo"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'apiVersion' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data: []byte(`{"apiVersion":"foo/v1"}`),
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data: []byte(`{"apiVersion":"foo/v1"}`),
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:    []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &testDecodable{}},
+
+			expectedObject: &testDecodable{TypeMeta: metav1.TypeMeta{APIVersion: "/v1", Kind: "Foo"}},
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+		},
+		{
+			data:    []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &testDecodable{}},
+
+			expectedObject: &testDecodable{TypeMeta: metav1.TypeMeta{APIVersion: "/v1", Kind: "Foo"}},
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+			strict:         true,
+		},
+
+		// missing metadata with unstructured into
+		{
+			data:  []byte("{}"),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data:  []byte("{}"),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:  []byte(`{"kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"kind": "Foo"}},
+			// TODO(109023): expect this to error; unstructured decoding currently only requires kind to be set, not apiVersion
+		},
+		{
+			data:  []byte(`{"kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"kind": "Foo"}},
+			strict:         true,
+			// TODO(109023): expect this to error; unstructured decoding currently only requires kind to be set, not apiVersion
+		},
+
+		{
+			data:  []byte(`{"apiVersion":"foo/v1"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data:  []byte(`{"apiVersion":"foo/v1"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:  []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "/v1", "kind": "Foo"}},
+		},
+		{
+			data:  []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{},
+
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "/v1", "kind": "Foo"}},
+			strict:         true,
+		},
+
+		// missing metadata with unstructured into providing metadata
+		{
+			data:  []byte("{}"),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data:  []byte("{}"),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:  []byte(`{"kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"kind": "Foo"}},
+			// TODO(109023): expect this to error; unstructured decoding currently only requires kind to be set, not apiVersion
+		},
+		{
+			data:  []byte(`{"kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"kind": "Foo"}},
+			strict:         true,
+			// TODO(109023): expect this to error; unstructured decoding currently only requires kind to be set, not apiVersion
+		},
+
+		{
+			data:  []byte(`{"apiVersion":"foo/v1"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data:  []byte(`{"apiVersion":"foo/v1"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:  []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "/v1", "kind": "Foo"}},
+		},
+		{
+			data:  []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			into:  &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "into/v1", "kind": "Into"}},
+
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "/v1", "kind": "Foo"}},
+			strict:         true,
+		},
+
+		// missing metadata without into, unstructured creater
+		{
+			data:    []byte("{}"),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data:    []byte("{}"),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:    []byte(`{"kind":"Foo"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK: &schema.GroupVersionKind{Kind: "Foo"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'apiVersion' is missing in") },
+		},
+		{
+			data:    []byte(`{"kind":"Foo"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK: &schema.GroupVersionKind{Kind: "Foo"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'apiVersion' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:    []byte(`{"apiVersion":"foo/v1"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+		},
+		{
+			data:    []byte(`{"apiVersion":"foo/v1"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK: &schema.GroupVersionKind{Group: "foo", Version: "v1"},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'Kind' is missing in") },
+			strict:      true,
+		},
+
+		{
+			data:    []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "/v1", "kind": "Foo"}},
+		},
+		{
+			data:    []byte(`{"apiVersion":"/v1","kind":"Foo"}`),
+			typer:   &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			creater: &mockCreater{obj: &unstructured.Unstructured{}},
+
+			expectedGVK:    &schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Foo"},
+			expectedObject: &unstructured.Unstructured{Object: map[string]interface{}{"apiVersion": "/v1", "kind": "Foo"}},
+			strict:         true,
+		},
+
+		// creator errors
+		{
+			data:       []byte("{}"),
+			defaultGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			creater:    &mockCreater{err: fmt.Errorf("fake error")},
+
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			errFn:       func(err error) bool { return err.Error() == "fake error" },
+		},
+		{
+			data:       []byte("{}"),
+			defaultGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			creater:    &mockCreater{err: fmt.Errorf("fake error")},
+
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			errFn:       func(err error) bool { return err.Error() == "fake error" },
+		},
+		// creator typed
+		{
+			data:           []byte("{}"),
+			defaultGVK:     &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			creater:        &mockCreater{obj: &testDecodable{}},
+			expectedObject: &testDecodable{},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+		},
+		{
+			data:           []byte("{}"),
+			defaultGVK:     &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			creater:        &mockCreater{obj: &testDecodable{}},
+			expectedObject: &testDecodable{},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			strict:         true,
+		},
+
+		// version without group is not defaulted
+		{
+			data:           []byte(`{"apiVersion":"blah"}`),
+			defaultGVK:     &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			creater:        &mockCreater{obj: &testDecodable{}},
+			expectedObject: &testDecodable{TypeMeta: metav1.TypeMeta{APIVersion: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "", Version: "blah"},
+		},
+		// group without version is defaulted
+		{
+			data:           []byte(`{"apiVersion":"other/"}`),
+			defaultGVK:     &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			creater:        &mockCreater{obj: &testDecodable{}},
+			expectedObject: &testDecodable{TypeMeta: metav1.TypeMeta{APIVersion: "other/"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+		},
+		// group version, kind is defaulted
+		{
+			data:           []byte(`{"apiVersion":"other1/blah1"}`),
+			defaultGVK:     &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			creater:        &mockCreater{obj: &testDecodable{}},
+			expectedObject: &testDecodable{TypeMeta: metav1.TypeMeta{APIVersion: "other1/blah1"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other1", Version: "blah1"},
+		},
+		// gvk all provided then not defaulted at all
+		{
+			data:           []byte(`{"kind":"Test","apiVersion":"other/blah"}`),
+			defaultGVK:     &schema.GroupVersionKind{Kind: "Test1", Group: "other1", Version: "blah1"},
+			creater:        &mockCreater{obj: &testDecodable{}},
+			expectedObject: &testDecodable{TypeMeta: metav1.TypeMeta{APIVersion: "other/blah", Kind: "Test"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+		},
+		//gvk defaulting if kind not provided in data and defaultGVK use into's kind
+		{
+			data:           []byte(`{"apiVersion":"b1/c1"}`),
+			into:           &testDecodable{TypeMeta: metav1.TypeMeta{Kind: "a3", APIVersion: "b1/c1"}},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "a3", Group: "b1", Version: "c1"}},
+			defaultGVK:     nil,
+			creater:        &mockCreater{obj: &testDecodable{}},
+			expectedObject: &testDecodable{TypeMeta: metav1.TypeMeta{Kind: "a3", APIVersion: "b1/c1"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "a3", Group: "b1", Version: "c1"},
+		},
+
+		// accept runtime.Unknown as into and bypass creator
+		{
+			data: []byte(`{}`),
+			into: &runtime.Unknown{},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			expectedObject: &runtime.Unknown{
+				Raw:         []byte(`{}`),
+				ContentType: runtime.ContentTypeJSON,
+			},
+		},
+		{
+			data: []byte(`{"test":"object"}`),
+			into: &runtime.Unknown{},
+
+			expectedGVK: &schema.GroupVersionKind{},
+			expectedObject: &runtime.Unknown{
+				Raw:         []byte(`{"test":"object"}`),
+				ContentType: runtime.ContentTypeJSON,
+			},
+		},
+		{
+			data:        []byte(`{"test":"object"}`),
+			into:        &runtime.Unknown{},
+			defaultGVK:  &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &runtime.Unknown{
+				TypeMeta:    runtime.TypeMeta{APIVersion: "other/blah", Kind: "Test"},
+				Raw:         []byte(`{"test":"object"}`),
+				ContentType: runtime.ContentTypeJSON,
+			},
+		},
+
+		// unregistered objects can be decoded into directly
+		{
+			data:        []byte(`{"kind":"Test","apiVersion":"other/blah","value":1,"Other":"test"}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{err: runtime.NewNotRegisteredErrForKind("mock", schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"})},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				TypeMeta: metav1.TypeMeta{APIVersion: "other/blah", Kind: "Test"},
+				Other:    "test",
+				Value:    1,
+			},
+		},
+		// registered types get defaulted by the into object kind
+		{
+			data:        []byte(`{"value":1,"Other":"test"}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				Other: "test",
+				Value: 1,
+			},
+		},
+		// registered types get defaulted by the into object kind even without version, but return an error
+		{
+			data:        []byte(`{"value":1,"Other":"test"}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: ""}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: ""},
+			errFn:       func(err error) bool { return strings.Contains(err.Error(), "Object 'apiVersion' is missing in") },
+			expectedObject: &testDecodable{
+				Other: "test",
+				Value: 1,
+			},
+		},
+		// Error on invalid number
+		{
+			data:        []byte(`{"kind":"Test","apiVersion":"other/blah","interface":1e1000}`),
+			creater:     &mockCreater{obj: &testDecodable{}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `json: cannot unmarshal number 1e1000 into Go struct field testDecodable.interface of type float64`)
+			},
+		},
+		// Unmarshalling is case-sensitive
+		{
+			// "VaLue" should have been "value"
+			data:        []byte(`{"kind":"Test","apiVersion":"other/blah","VaLue":1,"Other":"test"}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{err: runtime.NewNotRegisteredErrForKind("mock", schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"})},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				TypeMeta: metav1.TypeMeta{APIVersion: "other/blah", Kind: "Test"},
+				Other:    "test",
+			},
+		},
+		// Unmarshalling is case-sensitive for big struct.
+		{
+			// "b" should have been "B", "I" should have been "i"
+			data:        []byte(`{"kind":"Test","apiVersion":"other/blah","spec": {"A": 1, "b": 2, "h": 3, "I": 4}}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{err: runtime.NewNotRegisteredErrForKind("mock", schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"})},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				TypeMeta: metav1.TypeMeta{APIVersion: "other/blah", Kind: "Test"},
+				Spec:     DecodableSpec{A: 1, H: 3},
+			},
+		},
+		// Unknown fields should return an error from the strict JSON deserializer.
+		{
+			data:        []byte(`{"unknown": 1}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `unknown field "unknown"`)
+			},
+			strict: true,
+		},
+		// Unknown fields should return an error from the strict YAML deserializer.
+		{
+			data:        []byte("unknown: 1\n"),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `unknown field "unknown"`)
+			},
+			yaml:   true,
+			strict: true,
+		},
+		// Duplicate fields should return an error from the strict JSON deserializer.
+		{
+			data:        []byte(`{"value":1,"value":1}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `duplicate field "value"`)
+			},
+			strict: true,
+		},
+		// Duplicate fields should return an error from the strict YAML deserializer.
+		{
+			data: []byte("value: 1\n" +
+				"value: 1\n"),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `"value" already set in map`)
+			},
+			yaml:   true,
+			strict: true,
+		},
+		// Duplicate fields should return an error from the strict JSON deserializer for unstructured.
+		{
+			data:        []byte(`{"kind":"Custom","value":1,"value":1}`),
+			into:        &unstructured.Unstructured{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Custom"},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `duplicate field "value"`)
+			},
+			strict: true,
+		},
+		// Duplicate fields should return an error from the strict YAML deserializer for unstructured.
+		{
+			data: []byte("kind: Custom\n" +
+				"value: 1\n" +
+				"value: 1\n"),
+			into:        &unstructured.Unstructured{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Custom"},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `"value" already set in map`)
+			},
+			yaml:   true,
+			strict: true,
+		},
+		// Strict JSON decode into unregistered objects directly.
+		{
+			data:        []byte(`{"kind":"Test","apiVersion":"other/blah","value":1,"Other":"test"}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{err: runtime.NewNotRegisteredErrForKind("mock", schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"})},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				TypeMeta: metav1.TypeMeta{APIVersion: "other/blah", Kind: "Test"},
+				Other:    "test",
+				Value:    1,
+			},
+			strict: true,
+		},
+		// Strict YAML decode into unregistered objects directly.
+		{
+			data: []byte("kind: Test\n" +
+				"apiVersion: other/blah\n" +
+				"value: 1\n" +
+				"Other: test\n"),
+			into:        &testDecodable{},
+			typer:       &mockTyper{err: runtime.NewNotRegisteredErrForKind("mock", schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"})},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				TypeMeta: metav1.TypeMeta{APIVersion: "other/blah", Kind: "Test"},
+				Other:    "test",
+				Value:    1,
+			},
+			yaml:   true,
+			strict: true,
+		},
+		// Valid strict JSON decode without GVK.
+		{
+			data:        []byte(`{"value":1234}`),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				Value: 1234,
+			},
+			strict: true,
+		},
+		// Valid strict YAML decode without GVK.
+		{
+			data:        []byte("value: 1234\n"),
+			into:        &testDecodable{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodable{
+				Value: 1234,
+			},
+			yaml:   true,
+			strict: true,
+		},
+		// Invalid strict JSON, results in json parse error:
+		{
+			data:  []byte("foo"),
+			into:  &unstructured.Unstructured{},
+			typer: &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `json parse error: invalid character 'o'`)
+			},
+			strict: true,
+		},
+		// empty JSON strict, results in missing kind error
+		{
+			data:        []byte("{}"),
+			into:        &unstructured.Unstructured{},
+			typer:       &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK: &schema.GroupVersionKind{},
+			errFn: func(err error) bool {
+				return strings.Contains(err.Error(), `Object 'Kind' is missing`)
+			},
+			strict: true,
+		},
+		// coerce from null
+		{
+			data:           []byte(`{"bool":null,"int":null,"int32":null,"int64":null,"float32":null,"float64":null,"string":null,"array":null,"map":null,"struct":null}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{},
+			strict:         true,
+		},
+		{
+			data:           []byte(`{"bool":null,"int":null,"int32":null,"int64":null,"float32":null,"float64":null,"string":null,"array":null,"map":null,"struct":null}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{},
+			yaml:           true,
+			strict:         true,
+		},
+		// coerce from string
+		{
+			data:           []byte(`{"string":""}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{},
+			strict:         true,
+		},
+		{
+			data:           []byte(`{"string":""}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{},
+			yaml:           true,
+			strict:         true,
+		},
+		// coerce from array
+		{
+			data:           []byte(`{"array":[]}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Array: []string{}},
+			strict:         true,
+		},
+		{
+			data:           []byte(`{"array":[]}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Array: []string{}},
+			yaml:           true,
+			strict:         true,
+		},
+		// coerce from map
+		{
+			data:           []byte(`{"map":{},"struct":{}}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Map: map[string]string{}},
+			strict:         true,
+		},
+		{
+			data:           []byte(`{"map":{},"struct":{}}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Map: map[string]string{}},
+			yaml:           true,
+			strict:         true,
+		},
+		// coerce from int
+		{
+			data:           []byte(`{"int":1,"int32":1,"int64":1,"float32":1,"float64":1}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Int: 1, Int32: 1, Int64: 1, Float32: 1, Float64: 1},
+			strict:         true,
+		},
+		{
+			data:           []byte(`{"int":1,"int32":1,"int64":1,"float32":1,"float64":1}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Int: 1, Int32: 1, Int64: 1, Float32: 1, Float64: 1},
+			yaml:           true,
+			strict:         true,
+		},
+		// coerce from float
+		{
+			data:           []byte(`{"float32":1.0,"float64":1.0}`),
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Float32: 1, Float64: 1},
+			strict:         true,
+		},
+		{
+			data:           []byte(`{"int":1.0,"int32":1.0,"int64":1.0,"float32":1.0,"float64":1.0}`), // floating point gets dropped in yaml -> json step
+			into:           &testDecodeCoercion{},
+			typer:          &mockTyper{gvk: &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}},
+			expectedGVK:    &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"},
+			expectedObject: &testDecodeCoercion{Int: 1, Int32: 1, Int64: 1, Float32: 1, Float64: 1},
+			yaml:           true,
+			strict:         true,
+		},
+	}
+
+	logTestCase := func(t *testing.T, tc testCase) {
+		t.Logf("data=%s\n\tinto=%T, yaml=%v, strict=%v", string(tc.data), tc.into, tc.yaml, tc.strict)
+	}
+
+	for i, test := range testCases {
+		var s runtime.Serializer
+		if test.yaml {
+			s = json.NewSerializerWithOptions(json.DefaultMetaFactory, test.creater, test.typer, json.SerializerOptions{Yaml: test.yaml, Pretty: false, Strict: test.strict})
+		} else {
+			s = json.NewSerializerWithOptions(json.DefaultMetaFactory, test.creater, test.typer, json.SerializerOptions{Yaml: test.yaml, Pretty: test.pretty, Strict: test.strict})
+		}
+		obj, gvk, err := s.Decode([]byte(test.data), test.defaultGVK, test.into)
+
+		if !reflect.DeepEqual(test.expectedGVK, gvk) {
+			logTestCase(t, test)
+			t.Errorf("%d: unexpected GVK: %v", i, gvk)
+		}
+
+		switch {
+		case err == nil && test.errFn != nil:
+			logTestCase(t, test)
+			t.Errorf("%d: failed: not getting the expected error", i)
+			continue
+		case err != nil && test.errFn == nil:
+			logTestCase(t, test)
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil:
+			if !test.errFn(err) {
+				logTestCase(t, test)
+				t.Errorf("%d: failed: %v", i, err)
+			}
+			if !runtime.IsStrictDecodingError(err) && obj != nil {
+				logTestCase(t, test)
+				t.Errorf("%d: should have returned nil object", i)
+			}
+			continue
+		}
+
+		if test.into != nil && test.into != obj {
+			logTestCase(t, test)
+			t.Errorf("%d: expected into to be returned: %v", i, obj)
+			continue
+		}
+
+		if !reflect.DeepEqual(test.expectedObject, obj) {
+			logTestCase(t, test)
+			t.Errorf("%d: unexpected object:\n%s", i, diff.ObjectGoPrintSideBySide(test.expectedObject, obj))
+		}
+	}
+}
+
+func TestCacheableObject(t *testing.T) {
+	gvk := schema.GroupVersionKind{Group: "group", Version: "version", Kind: "MockCacheableObject"}
+	creater := &mockCreater{obj: &runtimetesting.MockCacheableObject{}}
+	typer := &mockTyper{gvk: &gvk}
+	serializer := json.NewSerializerWithOptions(json.DefaultMetaFactory, creater, typer, json.SerializerOptions{})
+
+	runtimetesting.CacheableObjectTest(t, serializer)
+}
+
+type mockCreater struct {
+	apiVersion string
+	kind       string
+	err        error
+	obj        runtime.Object
+}
+
+func (c *mockCreater) New(kind schema.GroupVersionKind) (runtime.Object, error) {
+	c.apiVersion, c.kind = kind.GroupVersion().String(), kind.Kind
+	return c.obj, c.err
+}
+
+type mockTyper struct {
+	gvk *schema.GroupVersionKind
+	err error
+}
+
+func (t *mockTyper) ObjectKinds(obj runtime.Object) ([]schema.GroupVersionKind, bool, error) {
+	if t.gvk == nil {
+		return nil, false, t.err
+	}
+	return []schema.GroupVersionKind{*t.gvk}, false, t.err
+}
+
+func (t *mockTyper) Recognizes(_ schema.GroupVersionKind) bool {
+	return false
+}
+
+type testEncodableDuplicateTag struct {
+	metav1.TypeMeta `json:""`
+
+	A1 int `json:"a"`
+	A2 int `json:"a"` //nolint:govet // This is intentional to test that the encoder will not encode two map entries with the same key.
+}
+
+func (testEncodableDuplicateTag) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+type testEncodableTagMatchesUntaggedName struct {
+	metav1.TypeMeta `json:""`
+
+	A       int
+	TaggedA int `json:"A"`
+}
+
+func (testEncodableTagMatchesUntaggedName) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+type staticTextMarshaler int
+
+func (staticTextMarshaler) MarshalText() ([]byte, error) {
+	return []byte("static"), nil
+}
+
+type testEncodableMap[K comparable] map[K]interface{}
+
+func (testEncodableMap[K]) GetObjectKind() schema.ObjectKind {
+	panic("unimplemented")
+}
+
+func (testEncodableMap[K]) DeepCopyObject() runtime.Object {
+	panic("unimplemented")
+}
+
+func TestEncode(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		in   runtime.Object
+		want []byte
+	}{
+		// The Go visibility rules for struct fields are amended for JSON when deciding
+		// which field to marshal or unmarshal. If there are multiple fields at the same
+		// level, and that level is the least nested (and would therefore be the nesting
+		// level selected by the usual Go rules), the following extra rules apply:
+
+		// 1) Of those fields, if any are JSON-tagged, only tagged fields are considered,
+		//    even if there are multiple untagged fields that would otherwise conflict.
+		{
+			name: "only tagged field is considered if any are tagged",
+			in: &testEncodableTagMatchesUntaggedName{
+				A:       1,
+				TaggedA: 2,
+			},
+			want: []byte("{\"A\":2}\n"),
+		},
+		// 2) If there is exactly one field (tagged or not according to the first rule),
+		//    that is selected.
+		// 3) Otherwise there are multiple fields, and all are ignored; no error occurs.
+		{
+			name: "all duplicate fields are ignored",
+			in:   &testEncodableDuplicateTag{},
+			want: []byte("{}\n"),
+		},
+		{
+			name: "text marshaler keys can compare inequal but serialize to duplicates",
+			in: testEncodableMap[staticTextMarshaler]{
+				staticTextMarshaler(1): nil,
+				staticTextMarshaler(2): nil,
+			},
+			want: []byte("{\"static\":null,\"static\":null}\n"),
+		},
+		{
+			name: "time.Time keys can compare inequal but serialize to duplicates because time.Time implements TextMarshaler",
+			in: testEncodableMap[time.Time]{
+				time.Date(2222, 11, 30, 23, 59, 58, 57, time.UTC):              nil,
+				time.Date(2222, 11, 30, 23, 59, 58, 57, time.FixedZone("", 0)): nil,
+			},
+			want: []byte("{\"2222-11-30T23:59:58.000000057Z\":null,\"2222-11-30T23:59:58.000000057Z\":null}\n"),
+		},
+		{
+			name: "metav1.Time keys can compare inequal but serialize to duplicates because metav1.Time embeds time.Time which implements TextMarshaler",
+			in: testEncodableMap[metav1.Time]{
+				metav1.Date(2222, 11, 30, 23, 59, 58, 57, time.UTC):              nil,
+				metav1.Date(2222, 11, 30, 23, 59, 58, 57, time.FixedZone("", 0)): nil,
+			},
+			want: []byte("{\"2222-11-30T23:59:58.000000057Z\":null,\"2222-11-30T23:59:58.000000057Z\":null}\n"),
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var dst bytes.Buffer
+			s := json.NewSerializerWithOptions(json.DefaultMetaFactory, nil, nil, json.SerializerOptions{})
+			if err := s.Encode(tc.in, &dst); err != nil {
+				t.Errorf("unexpected error: %v", err)
+			}
+			if diff := cmp.Diff(tc.want, dst.Bytes()); diff != "" {
+				t.Errorf("unexpected output:\n%s", diff)
+			}
+		})
+	}
+}
+
+// TestRoundtripUnstructuredFloat64 demonstrates that encoding a fractionless float64 value to JSON
+// then decoding into interface{} can produce a value with concrete type int64. This is a
+// consequence of two specific behaviors. First, there is nothing in the JSON encoding of a
+// fractionless float64 value to distinguish it from the JSON encoding of an integer value. Second,
+// if, when unmarshaling into interface{}, the decoder encounters a JSON number with no decimal
+// point in the input, it produces a value with concrete type int64 as long as the number can be
+// precisely represented by an int64.
+func TestRoundtripUnstructuredFractionlessFloat64(t *testing.T) {
+	s := json.NewSerializerWithOptions(json.DefaultMetaFactory, runtime.NewScheme(), runtime.NewScheme(), json.SerializerOptions{})
+
+	initial := &unstructured.Unstructured{Object: map[string]interface{}{
+		"apiVersion":                    "v1",
+		"kind":                          "Test",
+		"with-fraction":                 float64(1.5),
+		"without-fraction":              float64(1),
+		"without-fraction-big-positive": float64(9223372036854776000),
+		"without-fraction-big-negative": float64(-9223372036854776000),
+	}}
+
+	var buf bytes.Buffer
+	if err := s.Encode(initial, &buf); err != nil {
+		t.Fatal(err)
+	}
+
+	final := &unstructured.Unstructured{}
+	got, _, err := s.Decode(buf.Bytes(), nil, final)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != final {
+		t.Fatalf("expected Decode to return target Unstructured object but got: %v", got)
+	}
+
+	expected := &unstructured.Unstructured{Object: map[string]interface{}{
+		"apiVersion":                    "v1",
+		"kind":                          "Test",
+		"with-fraction":                 float64(1.5),
+		"without-fraction":              int64(1), // note the change in concrete type
+		"without-fraction-big-positive": float64(9223372036854776000),
+		"without-fraction-big-negative": float64(-9223372036854776000),
+	}}
+
+	if diff := cmp.Diff(expected, final); diff != "" {
+		t.Fatalf("unexpected diff:\n%s", diff)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/meta.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/meta.go
new file mode 100644
index 0000000000..df3f5f989a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/meta.go
@@ -0,0 +1,63 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// MetaFactory is used to store and retrieve the version and kind
+// information for JSON objects in a serializer.
+type MetaFactory interface {
+	// Interpret should return the version and kind of the wire-format of
+	// the object.
+	Interpret(data []byte) (*schema.GroupVersionKind, error)
+}
+
+// DefaultMetaFactory is a default factory for versioning objects in JSON. The object
+// in memory and in the default JSON serialization will use the "kind" and "apiVersion"
+// fields.
+var DefaultMetaFactory = SimpleMetaFactory{}
+
+// SimpleMetaFactory provides default methods for retrieving the type and version of objects
+// that are identified with an "apiVersion" and "kind" fields in their JSON
+// serialization. It may be parameterized with the names of the fields in memory, or an
+// optional list of base structs to search for those fields in memory.
+type SimpleMetaFactory struct {
+}
+
+// Interpret will return the APIVersion and Kind of the JSON wire-format
+// encoding of an object, or an error.
+func (SimpleMetaFactory) Interpret(data []byte) (*schema.GroupVersionKind, error) {
+	findKind := struct {
+		// +optional
+		APIVersion string `json:"apiVersion,omitempty"`
+		// +optional
+		Kind string `json:"kind,omitempty"`
+	}{}
+	if err := json.Unmarshal(data, &findKind); err != nil {
+		return nil, fmt.Errorf("couldn't get version/kind; json parse error: %v", err)
+	}
+	gv, err := schema.ParseGroupVersion(findKind.APIVersion)
+	if err != nil {
+		return nil, err
+	}
+	return &schema.GroupVersionKind{Group: gv.Group, Version: gv.Version, Kind: findKind.Kind}, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/meta_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/meta_test.go
new file mode 100644
index 0000000000..5c5dda89e6
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/json/meta_test.go
@@ -0,0 +1,45 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import "testing"
+
+func TestSimpleMetaFactoryInterpret(t *testing.T) {
+	factory := SimpleMetaFactory{}
+	gvk, err := factory.Interpret([]byte(`{"apiVersion":"1","kind":"object"}`))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if gvk.Version != "1" || gvk.Kind != "object" {
+		t.Errorf("unexpected interpret: %#v", gvk)
+	}
+
+	// no kind or version
+	gvk, err = factory.Interpret([]byte(`{}`))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if gvk.Version != "" || gvk.Kind != "" {
+		t.Errorf("unexpected interpret: %#v", gvk)
+	}
+
+	// unparsable
+	_, err = factory.Interpret([]byte(`{`))
+	if err == nil {
+		t.Errorf("unexpected non-error")
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/negotiated_codec.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/negotiated_codec.go
new file mode 100644
index 0000000000..a42b4a41a8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/negotiated_codec.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serializer
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// TODO: We should split negotiated serializers that we can change versions on from those we can change
+// serialization formats on
+type negotiatedSerializerWrapper struct {
+	info runtime.SerializerInfo
+}
+
+func NegotiatedSerializerWrapper(info runtime.SerializerInfo) runtime.NegotiatedSerializer {
+	return &negotiatedSerializerWrapper{info}
+}
+
+func (n *negotiatedSerializerWrapper) SupportedMediaTypes() []runtime.SerializerInfo {
+	return []runtime.SerializerInfo{n.info}
+}
+
+func (n *negotiatedSerializerWrapper) EncoderForVersion(e runtime.Encoder, _ runtime.GroupVersioner) runtime.Encoder {
+	return e
+}
+
+func (n *negotiatedSerializerWrapper) DecoderToVersion(d runtime.Decoder, _gv runtime.GroupVersioner) runtime.Decoder {
+	return d
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections.go
new file mode 100644
index 0000000000..8db8932fbb
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections.go
@@ -0,0 +1,173 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"encoding/binary"
+	"errors"
+	"io"
+	"math/bits"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+var (
+	errFieldCount          = errors.New("expected ListType to have 3 fields")
+	errTypeMetaField       = errors.New("expected TypeMeta field to have TypeMeta type")
+	errTypeMetaProtobufTag = errors.New(`expected TypeMeta protobuf field tag to be ""`)
+	errListMetaField       = errors.New("expected ListMeta field to have ListMeta type")
+	errListMetaProtobufTag = errors.New(`expected ListMeta protobuf field tag to be "bytes,1,opt,name=metadata"`)
+	errItemsProtobufTag    = errors.New(`expected Items protobuf field tag to be "bytes,2,rep,name=items"`)
+	errItemsSizer          = errors.New(`expected Items elements to implement proto.Sizer`)
+)
+
+// getStreamingListData implements list extraction logic for protobuf stream serialization.
+//
+// Reason for a custom logic instead of reusing accessors from meta package:
+// * Validate proto tags to prevent incompatibility with proto standard package.
+// * ListMetaAccessor doesn't distinguish empty from nil value.
+// * TypeAccessor reparsing "apiVersion" and serializing it with "{group}/{version}"
+func getStreamingListData(list runtime.Object) (data streamingListData, err error) {
+	listValue, err := conversion.EnforcePtr(list)
+	if err != nil {
+		return data, err
+	}
+	listType := listValue.Type()
+	if listType.NumField() != 3 {
+		return data, errFieldCount
+	}
+	// TypeMeta: validated, but not returned as is not serialized.
+	_, ok := listValue.Field(0).Interface().(metav1.TypeMeta)
+	if !ok {
+		return data, errTypeMetaField
+	}
+	if listType.Field(0).Tag.Get("protobuf") != "" {
+		return data, errTypeMetaProtobufTag
+	}
+	// ListMeta
+	listMeta, ok := listValue.Field(1).Interface().(metav1.ListMeta)
+	if !ok {
+		return data, errListMetaField
+	}
+	// if we were ever to relax the protobuf tag check we should update the hardcoded `0xa` below when writing ListMeta.
+	if listType.Field(1).Tag.Get("protobuf") != "bytes,1,opt,name=metadata" {
+		return data, errListMetaProtobufTag
+	}
+	data.listMeta = listMeta
+	// Items; if we were ever to relax the protobuf tag check we should update the hardcoded `0x12` below when writing Items.
+	if listType.Field(2).Tag.Get("protobuf") != "bytes,2,rep,name=items" {
+		return data, errItemsProtobufTag
+	}
+	items, err := meta.ExtractList(list)
+	if err != nil {
+		return data, err
+	}
+	data.items = items
+	data.totalSize, data.listMetaSize, data.itemsSizes, err = listSize(listMeta, items)
+	return data, err
+}
+
+type streamingListData struct {
+	// totalSize is the total size of the serialized List object, including their proto headers/size bytes
+	totalSize int
+
+	// listMetaSize caches results from .Size() call to listMeta, doesn't include header bytes (field identifier, size)
+	listMetaSize int
+	listMeta     metav1.ListMeta
+
+	// itemsSizes caches results from .Size() call to items, doesn't include header bytes (field identifier, size)
+	itemsSizes []int
+	items      []runtime.Object
+}
+
+type sizer interface {
+	Size() int
+}
+
+// listSize return size of ListMeta and items to be later used for preallocations.
+// listMetaSize and itemSizes do not include header bytes (field identifier, size).
+func listSize(listMeta metav1.ListMeta, items []runtime.Object) (totalSize, listMetaSize int, itemSizes []int, err error) {
+	// ListMeta
+	listMetaSize = listMeta.Size()
+	totalSize += 1 + sovGenerated(uint64(listMetaSize)) + listMetaSize
+	// Items
+	itemSizes = make([]int, len(items))
+	for i, item := range items {
+		sizer, ok := item.(sizer)
+		if !ok {
+			return totalSize, listMetaSize, nil, errItemsSizer
+		}
+		n := sizer.Size()
+		itemSizes[i] = n
+		totalSize += 1 + sovGenerated(uint64(n)) + n
+	}
+	return totalSize, listMetaSize, itemSizes, nil
+}
+
+func streamingEncodeUnknownList(w io.Writer, unk runtime.Unknown, listData streamingListData, memAlloc runtime.MemoryAllocator) error {
+	_, err := w.Write(protoEncodingPrefix)
+	if err != nil {
+		return err
+	}
+	// encodeList is responsible for encoding the List into the unknown Raw.
+	encodeList := func(writer io.Writer) (int, error) {
+		return streamingEncodeList(writer, listData, memAlloc)
+	}
+	_, err = unk.MarshalToWriter(w, listData.totalSize, encodeList)
+	return err
+}
+
+func streamingEncodeList(w io.Writer, listData streamingListData, memAlloc runtime.MemoryAllocator) (size int, err error) {
+	// headerScratch escapes via w.Write, so allocate it once per call instead of once per item.
+	headerScratch := make([]byte, 1+binary.MaxVarintLen64)
+	// ListMeta; 0xa = (1 << 3) | 2; field number: 1, type: 2 (LEN). https://protobuf.dev/programming-guides/encoding/#structure
+	n, err := doEncodeWithHeader(&listData.listMeta, w, 0xa, listData.listMetaSize, headerScratch, memAlloc)
+	size += n
+	if err != nil {
+		return size, err
+	}
+	// Items; 0x12 = (2 << 3) | 2; field number: 2, type: 2 (LEN). https://protobuf.dev/programming-guides/encoding/#structure
+	for i, item := range listData.items {
+		n, err := doEncodeWithHeader(item, w, 0x12, listData.itemsSizes[i], headerScratch, memAlloc)
+		size += n
+		if err != nil {
+			return size, err
+		}
+	}
+	return size, nil
+}
+
+// sovGenerated is copied from `generated.pb.go` returns size of varint.
+func sovGenerated(v uint64) int {
+	return (bits.Len64(v|1) + 6) / 7
+}
+
+// encodeVarintGenerated is copied from `generated.pb.go` encodes varint.
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections_test.go
new file mode 100644
index 0000000000..826fdc1681
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections_test.go
@@ -0,0 +1,363 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"bytes"
+	"encoding/base64"
+	"io"
+	"math/rand"
+	"os/exec"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"sigs.k8s.io/randfill"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	testapigroupv1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestCollectionsEncoding(t *testing.T) {
+	t.Run("Normal", func(t *testing.T) {
+		testCollectionsEncoding(t, NewSerializer(nil, nil), false)
+	})
+	t.Run("Streaming", func(t *testing.T) {
+		testCollectionsEncoding(t, NewSerializerWithOptions(nil, nil, SerializerOptions{StreamingCollectionsEncoding: true}), true)
+	})
+}
+
+func testCollectionsEncoding(t *testing.T, s *Serializer, streamingEnabled bool) {
+	var remainingItems int64 = 1
+	testCases := []struct {
+		name string
+		in   runtime.Object
+		// expect is base64 encoded protobuf bytes
+		expect string
+	}{
+		{
+			name: "CarpList items nil",
+			in: &testapigroupv1.CarpList{
+				Items: nil,
+			},
+			expect: "azhzAAoECgASABIICgYKABIAGgAaACIA",
+		},
+		{
+			name: "CarpList slice nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: nil,
+						},
+					},
+				},
+			},
+			expect: "azhzAAoECgASABJBCgYKABIAGgASNwoQCgASABoAIgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgAaACIA",
+		},
+		{
+			name: "CarpList map nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: nil,
+						},
+					},
+				},
+			},
+			expect: "azhzAAoECgASABJBCgYKABIAGgASNwoQCgASABoAIgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgAaACIA",
+		},
+		{
+			name: "CarpList items empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{},
+			},
+			expect: "azhzAAoECgASABIICgYKABIAGgAaACIA",
+		},
+		{
+			name: "CarpList slice empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: []testapigroupv1.CarpCondition{},
+						},
+					},
+				},
+			},
+			expect: "azhzAAoECgASABJBCgYKABIAGgASNwoQCgASABoAIgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgAaACIA",
+		},
+		{
+			name: "CarpList map empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: map[string]string{},
+						},
+					},
+				},
+			},
+			expect: "azhzAAoECgASABJBCgYKABIAGgASNwoQCgASABoAIgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgAaACIA",
+		},
+		{
+			name: "List just kind",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind: "List",
+				},
+			},
+			expect: "azhzAAoICgASBExpc3QSCAoGCgASABoAGgAiAA==",
+		},
+		{
+			name: "List just apiVersion",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "v1",
+				},
+			},
+			expect: "azhzAAoGCgJ2MRIAEggKBgoAEgAaABoAIgA=",
+		},
+		{
+			name: "List no elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{},
+			},
+			expect: "azhzAAoKCgJ2MRIETGlzdBIMCgoKABIEMjM0NRoAGgAiAA==",
+		},
+		{
+			name: "List one element with continue",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion:    "2345",
+					Continue:           "abc",
+					RemainingItemCount: &remainingItems,
+				},
+				Items: []testapigroupv1.Carp{
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod",
+						Namespace: "default",
+					}},
+				},
+			},
+			expect: "azhzAAoKCgJ2MRIETGlzdBJUCg8KABIEMjM0NRoDYWJjIAESQQoaCgNwb2QSABoHZGVmYXVsdCIAKgAyADgAQgASFxoAQgBKAFIAWABgAGgAggEAigEAmgEAGgoKABoAIgAqADIAGgAiAA==",
+		},
+		{
+			name: "List two elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod",
+						Namespace: "default",
+					}},
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod2",
+						Namespace: "default2",
+					}},
+				},
+			},
+			expect: "azhzAAoKCgJ2MRIETGlzdBKUAQoKCgASBDIzNDUaABJBChoKA3BvZBIAGgdkZWZhdWx0IgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgASQwocCgRwb2QyEgAaCGRlZmF1bHQyIgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgAaACIA",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			var buf writeCountingBuffer
+			if err := s.Encode(tc.in, &buf); err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			actualBytes := buf.Bytes()
+			expectBytes, err := io.ReadAll(base64.NewDecoder(base64.StdEncoding, bytes.NewBufferString(tc.expect)))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !bytes.Equal(expectBytes, actualBytes) {
+				expectedBytes, err := base64.StdEncoding.DecodeString(tc.expect)
+				if err == nil {
+					t.Errorf("expected:\n%v\ngot:\n%v", expectedBytes, actualBytes)
+				} else {
+					t.Errorf("expected:\n%v\ngot:\n%v", tc.expect, base64.StdEncoding.EncodeToString(actualBytes))
+				}
+				actualProto := dumpProto(t, actualBytes[4:])
+				expectedProto := dumpProto(t, expectBytes[4:])
+				if actualProto != "" && expectedProto != "" {
+					t.Log(cmp.Diff(actualProto, expectedProto))
+				} else {
+					t.Log(cmp.Diff(actualBytes, expectBytes))
+				}
+			}
+			if streamingEnabled && buf.writeCount <= 1 {
+				t.Errorf("expected streaming but Write was called only: %d", buf.writeCount)
+			}
+			if !streamingEnabled && buf.writeCount > 1 {
+				t.Errorf("expected non-streaming but Write was called more than once: %d", buf.writeCount)
+			}
+		})
+	}
+}
+
+// dumpProto does a best-effort dump of the given proto bytes using protoc if it can be found in the path.
+// This is only used when the test has already failed, to try to give more visibility into the diff of the failure.
+func dumpProto(t *testing.T, data []byte) string {
+	t.Helper()
+	protoc, err := exec.LookPath("protoc")
+	if err != nil {
+		t.Logf("cannot find protoc in path to dump proto contents: %v", err)
+		return ""
+	}
+	cmd := exec.Command(protoc, "--decode_raw")
+	cmd.Stdin = bytes.NewBuffer(data)
+	d, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Logf("protoc invocation failed: %v", err)
+		return ""
+	}
+	return string(d)
+}
+
+type writeCountingBuffer struct {
+	writeCount int
+	bytes.Buffer
+}
+
+func (b *writeCountingBuffer) Write(data []byte) (int, error) {
+	b.writeCount++
+	return b.Buffer.Write(data)
+}
+
+func (b *writeCountingBuffer) Reset() {
+	b.writeCount = 0
+	b.Buffer.Reset()
+}
+
+func TestFuzzCollection(t *testing.T) {
+	f := randfill.New()
+	streamingEncoder := NewSerializerWithOptions(nil, nil, SerializerOptions{StreamingCollectionsEncoding: true})
+	streamingBuffer := &bytes.Buffer{}
+	normalEncoder := NewSerializerWithOptions(nil, nil, SerializerOptions{StreamingCollectionsEncoding: false})
+	normalBuffer := &bytes.Buffer{}
+	for i := 0; i < 1000; i++ {
+		list := &testapigroupv1.CarpList{}
+		f.FillNoCustom(list)
+		streamingBuffer.Reset()
+		normalBuffer.Reset()
+		if err := streamingEncoder.Encode(list, streamingBuffer); err != nil {
+			t.Fatal(err)
+		}
+		if err := normalEncoder.Encode(list, normalBuffer); err != nil {
+			t.Fatal(err)
+		}
+		if diff := cmp.Diff(streamingBuffer.String(), normalBuffer.String()); diff != "" {
+			t.Logf("normal: %s", normalBuffer.String())
+			t.Logf("streaming: %s", streamingBuffer.String())
+			t.Fatalf("unexpected output:\n%s", diff)
+		}
+	}
+}
+
+func TestCallsToSize(t *testing.T) {
+	counter := &countingSizer{data: []byte("abba")}
+	listMeta := metav1.ListMeta{}
+	listData := streamingListData{
+		totalSize:    14,
+		listMeta:     listMeta,
+		listMetaSize: listMeta.Size(),
+		itemsSizes:   []int{counter.Size()},
+		items:        []runtime.Object{counter},
+	}
+	err := streamingEncodeUnknownList(io.Discard, runtime.Unknown{}, listData, &runtime.Allocator{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if counter.count != 1 {
+		t.Errorf("Expected only 1 call to sizer, got %d", counter.count)
+	}
+}
+
+type countingSizer struct {
+	data  []byte
+	count int
+}
+
+var _ runtime.ProtobufMarshaller = (*countingSizer)(nil)
+
+func (s *countingSizer) MarshalTo(data []byte) (int, error) {
+	return copy(data, s.data), nil
+}
+func (s *countingSizer) Size() int {
+	s.count++
+	return len(s.data)
+}
+
+func (s *countingSizer) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (s *countingSizer) GetObjectKind() schema.ObjectKind {
+	return nil
+}
+
+func BenchmarkStreamEncodeProtobufCollections(b *testing.B) {
+	disableFuzzFieldsV1 := func(field *metav1.FieldsV1, c randfill.Continue) {}
+	fuzzMap := func(kvs map[string]interface{}, c randfill.Continue) {
+		kvs[c.String(0)] = c.Bool()
+		kvs[c.String(0)] = c.Uint64()
+		kvs[c.String(0)] = c.String(0)
+	}
+	f := randfill.New().RandSource(rand.NewSource(12345)).Funcs(disableFuzzFieldsV1, fuzzMap)
+	carpList := &testapigroupv1.CarpList{}
+	carpList.Items = make([]testapigroupv1.Carp, 1000)
+	for i := range 1000 {
+		f.Fill(&carpList.Items[i])
+	}
+	carpList.Kind = "CarpList"
+	carpList.APIVersion = "testapigroup.k8s.io/v1"
+	carpList.ResourceVersion = "12345"
+
+	encoder := NewSerializerWithOptions(nil, nil, SerializerOptions{StreamingCollectionsEncoding: true})
+	b.Run("CarpList", func(b *testing.B) {
+		var buf bytes.Buffer
+		b.ReportAllocs()
+		b.ResetTimer()
+		for i := 0; i < b.N; i++ {
+			buf.Reset()
+			if err := encoder.Encode(carpList, &buf); err != nil {
+				b.Fatal(err)
+			}
+		}
+	})
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/doc.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/doc.go
new file mode 100644
index 0000000000..381748d69f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/doc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package protobuf provides a Kubernetes serializer for the protobuf format.
+package protobuf
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf.go
new file mode 100644
index 0000000000..93ad95cef3
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf.go
@@ -0,0 +1,568 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"net/http"
+	"reflect"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/recognizer"
+	"k8s.io/apimachinery/pkg/util/framer"
+	"k8s.io/klog/v2"
+)
+
+var (
+	// protoEncodingPrefix serves as a magic number for an encoded protobuf message on this serializer. All
+	// proto messages serialized by this schema will be preceded by the bytes 0x6b 0x38 0x73, with the fourth
+	// byte being reserved for the encoding style. The only encoding style defined is 0x00, which means that
+	// the rest of the byte stream is a message of type k8s.io.kubernetes.pkg.runtime.Unknown (proto2).
+	//
+	// See k8s.io/apimachinery/pkg/runtime/generated.proto for details of the runtime.Unknown message.
+	//
+	// This encoding scheme is experimental, and is subject to change at any time.
+	protoEncodingPrefix = []byte{0x6b, 0x38, 0x73, 0x00}
+)
+
+type errNotMarshalable struct {
+	t reflect.Type
+}
+
+func (e errNotMarshalable) Error() string {
+	return fmt.Sprintf("object %v does not implement the protobuf marshalling interface and cannot be encoded to a protobuf message", e.t)
+}
+
+func (e errNotMarshalable) Status() metav1.Status {
+	return metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    http.StatusNotAcceptable,
+		Reason:  metav1.StatusReason("NotAcceptable"),
+		Message: e.Error(),
+	}
+}
+
+// IsNotMarshalable checks the type of error, returns a boolean true if error is not nil and not marshalable false otherwise
+func IsNotMarshalable(err error) bool {
+	_, ok := err.(errNotMarshalable)
+	return err != nil && ok
+}
+
+// NewSerializer creates a Protobuf serializer that handles encoding versioned objects into the proper wire form. If a typer
+// is passed, the encoded object will have group, version, and kind fields set. If typer is nil, the objects will be written
+// as-is (any type info passed with the object will be used).
+func NewSerializer(creater runtime.ObjectCreater, typer runtime.ObjectTyper) *Serializer {
+	return NewSerializerWithOptions(creater, typer, SerializerOptions{})
+}
+
+// NewSerializerWithOptions creates a Protobuf serializer that handles encoding versioned objects into the proper wire form. If a typer
+// is passed, the encoded object will have group, version, and kind fields set. If typer is nil, the objects will be written
+// as-is (any type info passed with the object will be used).
+func NewSerializerWithOptions(creater runtime.ObjectCreater, typer runtime.ObjectTyper, opts SerializerOptions) *Serializer {
+	return &Serializer{
+		prefix:  protoEncodingPrefix,
+		creater: creater,
+		typer:   typer,
+		options: opts,
+	}
+}
+
+// Serializer handles encoding versioned objects into the proper wire form
+type Serializer struct {
+	prefix  []byte
+	creater runtime.ObjectCreater
+	typer   runtime.ObjectTyper
+
+	options SerializerOptions
+}
+
+// SerializerOptions holds the options which are used to configure a Proto serializer.
+type SerializerOptions struct {
+	// StreamingCollectionsEncoding enables encoding collection, one item at the time, drastically reducing memory needed.
+	StreamingCollectionsEncoding bool
+}
+
+var _ runtime.Serializer = &Serializer{}
+var _ runtime.EncoderWithAllocator = &Serializer{}
+var _ recognizer.RecognizingDecoder = &Serializer{}
+
+const serializerIdentifier runtime.Identifier = "protobuf"
+
+// Decode attempts to convert the provided data into a protobuf message, extract the stored schema kind, apply the provided default
+// gvk, and then load that data into an object matching the desired schema kind or the provided into. If into is *runtime.Unknown,
+// the raw data will be extracted and no decoding will be performed. If into is not registered with the typer, then the object will
+// be straight decoded using normal protobuf unmarshalling (the MarshalTo interface). If into is provided and the original data is
+// not fully qualified with kind/version/group, the type of the into will be used to alter the returned gvk. On success or most
+// errors, the method will return the calculated schema kind.
+func (s *Serializer) Decode(originalData []byte, gvk *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	prefixLen := len(s.prefix)
+	switch {
+	case len(originalData) == 0:
+		// TODO: treat like decoding {} from JSON with defaulting
+		return nil, nil, fmt.Errorf("empty data")
+	case len(originalData) < prefixLen || !bytes.Equal(s.prefix, originalData[:prefixLen]):
+		return nil, nil, fmt.Errorf("provided data does not appear to be a protobuf message, expected prefix %v", s.prefix)
+	case len(originalData) == prefixLen:
+		// TODO: treat like decoding {} from JSON with defaulting
+		return nil, nil, fmt.Errorf("empty body")
+	}
+
+	data := originalData[prefixLen:]
+	unk := runtime.Unknown{}
+	if err := unk.Unmarshal(data); err != nil {
+		return nil, nil, err
+	}
+
+	actual := unk.GroupVersionKind()
+	copyKindDefaults(&actual, gvk)
+
+	if intoUnknown, ok := into.(*runtime.Unknown); ok && intoUnknown != nil {
+		*intoUnknown = unk
+		if ok, _, _ := s.RecognizesData(unk.Raw); ok {
+			intoUnknown.ContentType = runtime.ContentTypeProtobuf
+		}
+		return intoUnknown, &actual, nil
+	}
+
+	if into != nil {
+		types, _, err := s.typer.ObjectKinds(into)
+		switch {
+		case runtime.IsNotRegisteredError(err):
+			unmarshaler, ok := into.(unmarshaler)
+			if !ok {
+				return nil, &actual, errNotMarshalable{reflect.TypeOf(into)}
+			}
+			// top-level unmarshal resets before delegating unmarshaling to the object
+			unmarshaler.Reset()
+			if err := unmarshaler.Unmarshal(unk.Raw); err != nil {
+				return nil, &actual, err
+			}
+			return into, &actual, nil
+		case err != nil:
+			return nil, &actual, err
+		default:
+			copyKindDefaults(&actual, &types[0])
+			// if the result of defaulting did not set a version or group, ensure that at least group is set
+			// (copyKindDefaults will not assign Group if version is already set). This guarantees that the group
+			// of into is set if there is no better information from the caller or object.
+			if len(actual.Version) == 0 && len(actual.Group) == 0 {
+				actual.Group = types[0].Group
+			}
+		}
+	}
+
+	if len(actual.Kind) == 0 {
+		return nil, &actual, runtime.NewMissingKindErr(fmt.Sprintf("%#v", unk.TypeMeta))
+	}
+	if len(actual.Version) == 0 {
+		return nil, &actual, runtime.NewMissingVersionErr(fmt.Sprintf("%#v", unk.TypeMeta))
+	}
+
+	return unmarshalToObject(s.typer, s.creater, &actual, into, unk.Raw)
+}
+
+// EncodeWithAllocator writes an object to the provided writer.
+// In addition, it allows for providing a memory allocator for efficient memory usage during object serialization.
+func (s *Serializer) EncodeWithAllocator(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	return s.encode(obj, w, memAlloc)
+}
+
+// Encode serializes the provided object to the given writer.
+func (s *Serializer) Encode(obj runtime.Object, w io.Writer) error {
+	return s.encode(obj, w, &runtime.SimpleAllocator{})
+}
+
+func (s *Serializer) encode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	if co, ok := obj.(runtime.CacheableObject); ok {
+		return co.CacheEncode(s.Identifier(), func(obj runtime.Object, w io.Writer) error { return s.doEncode(obj, w, memAlloc) }, w)
+	}
+	return s.doEncode(obj, w, memAlloc)
+}
+
+func (s *Serializer) doEncode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	if memAlloc == nil {
+		//nolint:logcheck // Should not be reached in normal operations.
+		klog.Error("a mandatory memory allocator wasn't provided, this might have a negative impact on performance, check invocations of EncodeWithAllocator method, falling back on runtime.SimpleAllocator")
+		memAlloc = &runtime.SimpleAllocator{}
+	}
+	prefixSize := uint64(len(s.prefix))
+
+	var unk runtime.Unknown
+	switch t := obj.(type) {
+	case *runtime.Unknown:
+		estimatedSize := prefixSize + uint64(t.Size())
+		data := memAlloc.Allocate(estimatedSize)
+		i, err := t.MarshalTo(data[prefixSize:])
+		if err != nil {
+			return err
+		}
+		copy(data, s.prefix)
+		_, err = w.Write(data[:prefixSize+uint64(i)])
+		return err
+	default:
+		kind := obj.GetObjectKind().GroupVersionKind()
+		unk = runtime.Unknown{
+			TypeMeta: runtime.TypeMeta{
+				Kind:       kind.Kind,
+				APIVersion: kind.GroupVersion().String(),
+			},
+		}
+	}
+	if s.options.StreamingCollectionsEncoding {
+		listData, err := getStreamingListData(obj)
+		if err == nil {
+			// Doesn't honor custom proto marshaling methods (like json streaming), because all proto objects implement proto methods.
+			return streamingEncodeUnknownList(w, unk, listData, memAlloc)
+		}
+	}
+
+	switch t := obj.(type) {
+	case bufferedMarshaller:
+		// this path performs a single allocation during write only when the Allocator wasn't provided
+		// it also requires the caller to implement the more efficient Size and MarshalToSizedBuffer methods
+		encodedSize := uint64(t.Size())
+		estimatedSize := prefixSize + estimateUnknownSize(&unk, encodedSize)
+		data := memAlloc.Allocate(estimatedSize)
+
+		i, err := unk.NestedMarshalTo(data[prefixSize:], t, encodedSize)
+		if err != nil {
+			return err
+		}
+
+		copy(data, s.prefix)
+
+		_, err = w.Write(data[:prefixSize+uint64(i)])
+		return err
+
+	case unbufferedMarshaller:
+		// this path performs extra allocations
+		data, err := t.Marshal()
+		if err != nil {
+			return err
+		}
+		unk.Raw = data
+
+		estimatedSize := prefixSize + uint64(unk.Size())
+		data = memAlloc.Allocate(estimatedSize)
+
+		i, err := unk.MarshalTo(data[prefixSize:])
+		if err != nil {
+			return err
+		}
+
+		copy(data, s.prefix)
+
+		_, err = w.Write(data[:prefixSize+uint64(i)])
+		return err
+
+	default:
+		// TODO: marshal with a different content type and serializer (JSON for third party objects)
+		return errNotMarshalable{reflect.TypeOf(obj)}
+	}
+}
+
+// Identifier implements runtime.Encoder interface.
+func (s *Serializer) Identifier() runtime.Identifier {
+	return serializerIdentifier
+}
+
+// RecognizesData implements the RecognizingDecoder interface.
+func (s *Serializer) RecognizesData(data []byte) (bool, bool, error) {
+	return bytes.HasPrefix(data, s.prefix), false, nil
+}
+
+// copyKindDefaults defaults dst to the value in src if dst does not have a value set.
+func copyKindDefaults(dst, src *schema.GroupVersionKind) {
+	if src == nil {
+		return
+	}
+	// apply kind and version defaulting from provided default
+	if len(dst.Kind) == 0 {
+		dst.Kind = src.Kind
+	}
+	if len(dst.Version) == 0 && len(src.Version) > 0 {
+		dst.Group = src.Group
+		dst.Version = src.Version
+	}
+}
+
+// bufferedMarshaller describes a more efficient marshalling interface that can avoid allocating multiple
+// byte buffers by pre-calculating the size of the final buffer needed.
+type bufferedMarshaller interface {
+	runtime.ProtobufMarshaller
+}
+
+// Like bufferedMarshaller, but is able to marshal backwards, which is more efficient since it doesn't call Size() as frequently.
+type bufferedReverseMarshaller interface {
+	runtime.ProtobufReverseMarshaller
+}
+
+type unbufferedMarshaller interface {
+	Marshal() ([]byte, error)
+}
+
+// unmarshaler is the subset of gogo Message and Unmarshaler used by unmarshal
+type unmarshaler interface {
+	// Reset() is called on the top-level message before unmarshaling,
+	// and clears all existing data from the message instance.
+	Reset()
+	// Unmarshal decodes from the start of the data into the message.
+	Unmarshal([]byte) error
+}
+
+// estimateUnknownSize returns the expected bytes consumed by a given runtime.Unknown
+// object with a nil RawJSON struct and the expected size of the provided buffer. The
+// returned size will not be correct if RawJSOn is set on unk.
+func estimateUnknownSize(unk *runtime.Unknown, byteSize uint64) uint64 {
+	size := uint64(unk.Size())
+	// protobuf uses 1 byte for the tag, a varint for the length of the array (at most 8 bytes - uint64 - here),
+	// and the size of the array.
+	size += 1 + 8 + byteSize
+	return size
+}
+
+// NewRawSerializer creates a Protobuf serializer that handles encoding versioned objects into the proper wire form. If typer
+// is not nil, the object has the group, version, and kind fields set. This serializer does not provide type information for the
+// encoded object, and thus is not self describing (callers must know what type is being described in order to decode).
+//
+// This encoding scheme is experimental, and is subject to change at any time.
+func NewRawSerializer(creater runtime.ObjectCreater, typer runtime.ObjectTyper) *RawSerializer {
+	return &RawSerializer{
+		creater: creater,
+		typer:   typer,
+	}
+}
+
+// RawSerializer encodes and decodes objects without adding a runtime.Unknown wrapper (objects are encoded without identifying
+// type).
+type RawSerializer struct {
+	creater runtime.ObjectCreater
+	typer   runtime.ObjectTyper
+}
+
+var _ runtime.Serializer = &RawSerializer{}
+
+const rawSerializerIdentifier runtime.Identifier = "raw-protobuf"
+
+// Decode attempts to convert the provided data into a protobuf message, extract the stored schema kind, apply the provided default
+// gvk, and then load that data into an object matching the desired schema kind or the provided into. If into is *runtime.Unknown,
+// the raw data will be extracted and no decoding will be performed. If into is not registered with the typer, then the object will
+// be straight decoded using normal protobuf unmarshalling (the MarshalTo interface). If into is provided and the original data is
+// not fully qualified with kind/version/group, the type of the into will be used to alter the returned gvk. On success or most
+// errors, the method will return the calculated schema kind.
+func (s *RawSerializer) Decode(originalData []byte, gvk *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	if into == nil {
+		return nil, nil, fmt.Errorf("this serializer requires an object to decode into: %#v", s)
+	}
+
+	if len(originalData) == 0 {
+		// TODO: treat like decoding {} from JSON with defaulting
+		return nil, nil, fmt.Errorf("empty data")
+	}
+	data := originalData
+
+	actual := &schema.GroupVersionKind{}
+	copyKindDefaults(actual, gvk)
+
+	if intoUnknown, ok := into.(*runtime.Unknown); ok && intoUnknown != nil {
+		intoUnknown.Raw = data
+		intoUnknown.ContentEncoding = ""
+		intoUnknown.ContentType = runtime.ContentTypeProtobuf
+		intoUnknown.SetGroupVersionKind(*actual)
+		return intoUnknown, actual, nil
+	}
+
+	types, _, err := s.typer.ObjectKinds(into)
+	switch {
+	case runtime.IsNotRegisteredError(err):
+		unmarshaler, ok := into.(unmarshaler)
+		if !ok {
+			return nil, actual, errNotMarshalable{reflect.TypeOf(into)}
+		}
+		// top-level unmarshal resets before delegating unmarshaling to the object
+		unmarshaler.Reset()
+		if err := unmarshaler.Unmarshal(data); err != nil {
+			return nil, actual, err
+		}
+		return into, actual, nil
+	case err != nil:
+		return nil, actual, err
+	default:
+		copyKindDefaults(actual, &types[0])
+		// if the result of defaulting did not set a version or group, ensure that at least group is set
+		// (copyKindDefaults will not assign Group if version is already set). This guarantees that the group
+		// of into is set if there is no better information from the caller or object.
+		if len(actual.Version) == 0 && len(actual.Group) == 0 {
+			actual.Group = types[0].Group
+		}
+	}
+
+	if len(actual.Kind) == 0 {
+		return nil, actual, runtime.NewMissingKindErr("<protobuf encoded body - must provide default type>")
+	}
+	if len(actual.Version) == 0 {
+		return nil, actual, runtime.NewMissingVersionErr("<protobuf encoded body - must provide default type>")
+	}
+
+	return unmarshalToObject(s.typer, s.creater, actual, into, data)
+}
+
+// unmarshalToObject is the common code between decode in the raw and normal serializer.
+func unmarshalToObject(typer runtime.ObjectTyper, creater runtime.ObjectCreater, actual *schema.GroupVersionKind, into runtime.Object, data []byte) (runtime.Object, *schema.GroupVersionKind, error) {
+	// use the target if necessary
+	obj, err := runtime.UseOrCreateObject(typer, creater, *actual, into)
+	if err != nil {
+		return nil, actual, err
+	}
+
+	unmarshaler, ok := obj.(unmarshaler)
+	if !ok {
+		return nil, actual, errNotMarshalable{reflect.TypeOf(obj)}
+	}
+	// top-level unmarshal resets before delegating unmarshaling to the object
+	unmarshaler.Reset()
+	if err := unmarshaler.Unmarshal(data); err != nil {
+		return nil, actual, err
+	}
+	if actual != nil {
+		obj.GetObjectKind().SetGroupVersionKind(*actual)
+	}
+	return obj, actual, nil
+}
+
+// Encode serializes the provided object to the given writer. Overrides is ignored.
+func (s *RawSerializer) Encode(obj runtime.Object, w io.Writer) error {
+	return s.encode(obj, w, &runtime.SimpleAllocator{})
+}
+
+// EncodeWithAllocator writes an object to the provided writer.
+// In addition, it allows for providing a memory allocator for efficient memory usage during object serialization.
+func (s *RawSerializer) EncodeWithAllocator(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	return s.encode(obj, w, memAlloc)
+}
+
+func (s *RawSerializer) encode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	if co, ok := obj.(runtime.CacheableObject); ok {
+		return co.CacheEncode(s.Identifier(), func(obj runtime.Object, w io.Writer) error { return s.doEncode(obj, w, memAlloc) }, w)
+	}
+	return s.doEncode(obj, w, memAlloc)
+}
+
+func (s *RawSerializer) doEncode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	_, err := doEncode(obj, w, nil, memAlloc)
+	return err
+}
+
+func doEncodeWithHeader(obj any, w io.Writer, field byte, precomputedSize int, headerScratch []byte, memAlloc runtime.MemoryAllocator) (size int, err error) {
+	// Field identifier and size
+	header := headerScratch[:1+sovGenerated(uint64(precomputedSize))]
+	header[0] = field
+	encodeVarintGenerated(header, len(header), uint64(precomputedSize))
+	n, err := w.Write(header)
+	size += n
+	if err != nil {
+		return size, err
+	}
+	// Obj
+	n, err = doEncode(obj, w, &precomputedSize, memAlloc)
+	size += n
+	if err != nil {
+		return size, err
+	}
+	if n != precomputedSize {
+		return size, fmt.Errorf("the size value was %d, but doEncode wrote %d bytes to data", precomputedSize, n)
+	}
+	return size, nil
+}
+
+// doEncode encodes provided object into writer using a allocator if possible.
+// Avoids call by object Size if precomputedObjSize is provided.
+// precomputedObjSize should not include header bytes (field identifier, size).
+func doEncode(obj any, w io.Writer, precomputedObjSize *int, memAlloc runtime.MemoryAllocator) (int, error) {
+	if memAlloc == nil {
+		//nolint:logcheck // Should not be reached in normal operations.
+		klog.Error("a mandatory memory allocator wasn't provided, this might have a negative impact on performance, check invocations of EncodeWithAllocator method, falling back on runtime.SimpleAllocator")
+		memAlloc = &runtime.SimpleAllocator{}
+	}
+	switch t := obj.(type) {
+	case bufferedReverseMarshaller:
+		// this path performs a single allocation during write only when the Allocator wasn't provided
+		// it also requires the caller to implement the more efficient Size and MarshalToSizedBuffer methods
+		if precomputedObjSize == nil {
+			s := t.Size()
+			precomputedObjSize = &s
+		}
+		data := memAlloc.Allocate(uint64(*precomputedObjSize))
+
+		n, err := t.MarshalToSizedBuffer(data)
+		if err != nil {
+			return 0, err
+		}
+		return w.Write(data[:n])
+
+	case bufferedMarshaller:
+		// this path performs a single allocation during write only when the Allocator wasn't provided
+		// it also requires the caller to implement the more efficient Size and MarshalTo methods
+		if precomputedObjSize == nil {
+			s := t.Size()
+			precomputedObjSize = &s
+		}
+		data := memAlloc.Allocate(uint64(*precomputedObjSize))
+
+		n, err := t.MarshalTo(data)
+		if err != nil {
+			return 0, err
+		}
+		return w.Write(data[:n])
+
+	case unbufferedMarshaller:
+		// this path performs extra allocations
+		data, err := t.Marshal()
+		if err != nil {
+			return 0, err
+		}
+		return w.Write(data)
+
+	default:
+		return 0, errNotMarshalable{reflect.TypeOf(obj)}
+	}
+}
+
+// Identifier implements runtime.Encoder interface.
+func (s *RawSerializer) Identifier() runtime.Identifier {
+	return rawSerializerIdentifier
+}
+
+// LengthDelimitedFramer is exported variable of type lengthDelimitedFramer
+var LengthDelimitedFramer = lengthDelimitedFramer{}
+
+// Provides length delimited frame reader and writer methods
+type lengthDelimitedFramer struct{}
+
+// NewFrameWriter implements stream framing for this serializer
+func (lengthDelimitedFramer) NewFrameWriter(w io.Writer) io.Writer {
+	return framer.NewLengthDelimitedFrameWriter(w)
+}
+
+// NewFrameReader implements stream framing for this serializer
+func (lengthDelimitedFramer) NewFrameReader(r io.ReadCloser) io.ReadCloser {
+	return framer.NewLengthDelimitedFrameReader(r)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf_test.go
new file mode 100644
index 0000000000..df9a52d5d8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf_test.go
@@ -0,0 +1,180 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"bytes"
+	"reflect"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	testapigroupv1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+)
+
+func TestCacheableObject(t *testing.T) {
+	gvk := schema.GroupVersionKind{Group: "group", Version: "version", Kind: "MockCacheableObject"}
+	creater := &mockCreater{obj: &runtimetesting.MockCacheableObject{}}
+	typer := &mockTyper{gvk: &gvk}
+
+	encoders := []runtime.Encoder{
+		NewSerializer(creater, typer),
+		NewRawSerializer(creater, typer),
+	}
+
+	for _, encoder := range encoders {
+		runtimetesting.CacheableObjectTest(t, encoder)
+	}
+}
+
+type mockCreater struct {
+	apiVersion string
+	kind       string
+	err        error
+	obj        runtime.Object
+}
+
+func (c *mockCreater) New(kind schema.GroupVersionKind) (runtime.Object, error) {
+	c.apiVersion, c.kind = kind.GroupVersion().String(), kind.Kind
+	return c.obj, c.err
+}
+
+type mockTyper struct {
+	gvk *schema.GroupVersionKind
+	err error
+}
+
+func (t *mockTyper) ObjectKinds(obj runtime.Object) ([]schema.GroupVersionKind, bool, error) {
+	if t.gvk == nil {
+		return nil, false, t.err
+	}
+	return []schema.GroupVersionKind{*t.gvk}, false, t.err
+}
+
+func (t *mockTyper) Recognizes(_ schema.GroupVersionKind) bool {
+	return false
+}
+
+func TestSerializerEncodeWithAllocator(t *testing.T) {
+	testCases := []struct {
+		name string
+		obj  runtime.Object
+	}{
+		{
+			name: "encode a bufferedMarshaller obj",
+			obj: &testapigroupv1.Carp{
+				TypeMeta: metav1.TypeMeta{APIVersion: "group/version", Kind: "Carp"},
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "name",
+					Namespace: "namespace",
+				},
+				Spec: testapigroupv1.CarpSpec{
+					Subdomain: "carp.k8s.io",
+				},
+			},
+		},
+
+		{
+			name: "encode a runtime.Unknown obj",
+			obj:  &runtime.Unknown{TypeMeta: runtime.TypeMeta{APIVersion: "group/version", Kind: "Unknown"}, Raw: []byte("hello world")},
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			target := NewSerializer(nil, nil)
+
+			writer := &bytes.Buffer{}
+			if err := target.Encode(tc.obj, writer); err != nil {
+				t.Fatal(err)
+			}
+
+			writer2 := &bytes.Buffer{}
+			alloc := &testAllocator{}
+			if err := target.EncodeWithAllocator(tc.obj, writer2, alloc); err != nil {
+				t.Fatal(err)
+			}
+			if alloc.allocateCount != 1 {
+				t.Fatalf("expected the Allocate method to be called exactly 1 but it was executed: %v times ", alloc.allocateCount)
+			}
+
+			// to ensure compatibility of the new method with the old one, serialized data must be equal
+			// also we are not testing decoding since "roundtripping" is tested elsewhere for all known types
+			if !reflect.DeepEqual(writer.Bytes(), writer2.Bytes()) {
+				t.Fatal("data mismatch, data serialized with the Encode method is different than serialized with the EncodeWithAllocator method")
+			}
+		})
+	}
+}
+
+func TestRawSerializerEncodeWithAllocator(t *testing.T) {
+	testCases := []struct {
+		name string
+		obj  runtime.Object
+	}{
+		{
+			name: "encode a bufferedReverseMarshaller obj",
+			obj: &testapigroupv1.Carp{
+				TypeMeta: metav1.TypeMeta{APIVersion: "group/version", Kind: "Carp"},
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "name",
+					Namespace: "namespace",
+				},
+				Spec: testapigroupv1.CarpSpec{
+					Subdomain: "carp.k8s.io",
+				},
+			},
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			writer := &bytes.Buffer{}
+			target := NewRawSerializer(nil, nil)
+
+			if err := target.Encode(tc.obj, writer); err != nil {
+				t.Fatal(err)
+			}
+
+			writer2 := &bytes.Buffer{}
+			alloc := &testAllocator{}
+			if err := target.EncodeWithAllocator(tc.obj, writer2, alloc); err != nil {
+				t.Fatal(err)
+			}
+			if alloc.allocateCount != 1 {
+				t.Fatalf("expected the Allocate method to be called exactly 1 but it was executed: %v times ", alloc.allocateCount)
+			}
+
+			// to ensure compatibility of the new method with the old one, serialized data must be equal
+			// also we are not testing decoding since "roundtripping" is tested elsewhere for all known types
+			if !reflect.DeepEqual(writer.Bytes(), writer2.Bytes()) {
+				t.Fatal("data mismatch, data serialized with the Encode method is different than serialized with the EncodeWithAllocator method")
+			}
+		})
+	}
+}
+
+type testAllocator struct {
+	buf           []byte
+	allocateCount int
+}
+
+func (ta *testAllocator) Allocate(n uint64) []byte {
+	ta.buf = make([]byte, n)
+	ta.allocateCount++
+	return ta.buf
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/recognizer/recognizer.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/recognizer/recognizer.go
new file mode 100644
index 0000000000..5a6c200dd1
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/recognizer/recognizer.go
@@ -0,0 +1,128 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package recognizer
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type RecognizingDecoder interface {
+	runtime.Decoder
+	// RecognizesData should return true if the input provided in the provided reader
+	// belongs to this decoder, or an error if the data could not be read or is ambiguous.
+	// Unknown is true if the data could not be determined to match the decoder type.
+	// Decoders should assume that they can read as much of peek as they need (as the caller
+	// provides) and may return unknown if the data provided is not sufficient to make a
+	// a determination. When peek returns EOF that may mean the end of the input or the
+	// end of buffered input - recognizers should return the best guess at that time.
+	RecognizesData(peek []byte) (ok, unknown bool, err error)
+}
+
+// NewDecoder creates a decoder that will attempt multiple decoders in an order defined
+// by:
+//
+// 1. The decoder implements RecognizingDecoder and identifies the data
+// 2. All other decoders, and any decoder that returned true for unknown.
+//
+// The order passed to the constructor is preserved within those priorities.
+func NewDecoder(decoders ...runtime.Decoder) runtime.Decoder {
+	return &decoder{
+		decoders: decoders,
+	}
+}
+
+type decoder struct {
+	decoders []runtime.Decoder
+}
+
+var _ RecognizingDecoder = &decoder{}
+
+func (d *decoder) RecognizesData(data []byte) (bool, bool, error) {
+	var (
+		lastErr    error
+		anyUnknown bool
+	)
+	for _, r := range d.decoders {
+		switch t := r.(type) {
+		case RecognizingDecoder:
+			ok, unknown, err := t.RecognizesData(data)
+			if err != nil {
+				lastErr = err
+				continue
+			}
+			anyUnknown = anyUnknown || unknown
+			if !ok {
+				continue
+			}
+			return true, false, nil
+		}
+	}
+	return false, anyUnknown, lastErr
+}
+
+func (d *decoder) Decode(data []byte, gvk *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	var (
+		lastErr error
+		skipped []runtime.Decoder
+	)
+
+	// try recognizers, record any decoders we need to give a chance later
+	for _, r := range d.decoders {
+		switch t := r.(type) {
+		case RecognizingDecoder:
+			ok, unknown, err := t.RecognizesData(data)
+			if err != nil {
+				lastErr = err
+				continue
+			}
+			if unknown {
+				skipped = append(skipped, t)
+				continue
+			}
+			if !ok {
+				continue
+			}
+			return r.Decode(data, gvk, into)
+		default:
+			skipped = append(skipped, t)
+		}
+	}
+
+	// try recognizers that returned unknown or didn't recognize their data
+	for _, r := range skipped {
+		out, actual, err := r.Decode(data, gvk, into)
+		if err != nil {
+			// if we got an object back from the decoder, and the
+			// error was a strict decoding error (e.g. unknown or
+			// duplicate fields), we still consider the recognizer
+			// to have understood the object
+			if out == nil || !runtime.IsStrictDecodingError(err) {
+				lastErr = err
+				continue
+			}
+		}
+		return out, actual, err
+	}
+
+	if lastErr == nil {
+		lastErr = fmt.Errorf("no serialization format matched the provided data")
+	}
+	return nil, nil, lastErr
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/recognizer/testing/recognizer_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/recognizer/testing/recognizer_test.go
new file mode 100644
index 0000000000..ac882f8388
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/recognizer/testing/recognizer_test.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+	"k8s.io/apimachinery/pkg/runtime/serializer/recognizer"
+)
+
+type A struct{}
+
+func (A) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+func (a A) DeepCopyObject() runtime.Object {
+	return a
+}
+
+func TestRecognizer(t *testing.T) {
+	s := runtime.NewScheme()
+	s.AddKnownTypes(schema.GroupVersion{Version: "v1"}, &A{})
+	d := recognizer.NewDecoder(
+		json.NewSerializerWithOptions(json.DefaultMetaFactory, s, s, json.SerializerOptions{}),
+		json.NewSerializerWithOptions(json.DefaultMetaFactory, s, s, json.SerializerOptions{Yaml: true}),
+	)
+	out, _, err := d.Decode([]byte(`
+kind: A
+apiVersion: v1
+`), nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Logf("%#v", out)
+
+	out, _, err = d.Decode([]byte(`
+{
+  "kind":"A",
+  "apiVersion":"v1"
+}
+`), nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Logf("%#v", out)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/sparse_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/sparse_test.go
new file mode 100644
index 0000000000..406bc3615d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/sparse_test.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serializer
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"k8s.io/apimachinery/pkg/api/equality"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type FakeV1Obj struct {
+	metav1.TypeMeta
+	metav1.ObjectMeta
+}
+
+func (*FakeV1Obj) DeepCopyObject() runtime.Object {
+	panic("not supported")
+}
+
+type FakeV2DifferentObj struct {
+	metav1.TypeMeta
+	metav1.ObjectMeta
+}
+
+func (*FakeV2DifferentObj) DeepCopyObject() runtime.Object {
+	panic("not supported")
+}
+func TestSparse(t *testing.T) {
+	v1 := schema.GroupVersion{Group: "mygroup", Version: "v1"}
+	v2 := schema.GroupVersion{Group: "mygroup", Version: "v2"}
+
+	scheme := runtime.NewScheme()
+	scheme.AddKnownTypes(v1, &FakeV1Obj{})
+	scheme.AddKnownTypes(v2, &FakeV2DifferentObj{})
+	codecs := NewCodecFactory(scheme)
+
+	srcObj1 := &FakeV1Obj{ObjectMeta: metav1.ObjectMeta{Name: "foo"}}
+	srcObj2 := &FakeV2DifferentObj{ObjectMeta: metav1.ObjectMeta{Name: "foo"}}
+
+	encoder := codecs.LegacyCodec(v2, v1)
+	decoder := codecs.UniversalDecoder(v2, v1)
+
+	srcObj1Bytes, err := runtime.Encode(encoder, srcObj1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Log(string(srcObj1Bytes))
+	srcObj2Bytes, err := runtime.Encode(encoder, srcObj2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Log(string(srcObj2Bytes))
+
+	uncastDstObj1, err := runtime.Decode(decoder, srcObj1Bytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	uncastDstObj2, err := runtime.Decode(decoder, srcObj2Bytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// clear typemeta
+	uncastDstObj1.(*FakeV1Obj).TypeMeta = metav1.TypeMeta{}
+	uncastDstObj2.(*FakeV2DifferentObj).TypeMeta = metav1.TypeMeta{}
+
+	if !equality.Semantic.DeepEqual(srcObj1, uncastDstObj1) {
+		t.Fatal(cmp.Diff(srcObj1, uncastDstObj1))
+	}
+	if !equality.Semantic.DeepEqual(srcObj2, uncastDstObj2) {
+		t.Fatal(cmp.Diff(srcObj2, uncastDstObj2))
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/streaming/streaming.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/streaming/streaming.go
new file mode 100644
index 0000000000..971c46d496
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/streaming/streaming.go
@@ -0,0 +1,136 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package streaming implements encoder and decoder for streams
+// of runtime.Objects over io.Writer/Readers.
+package streaming
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// Encoder is a runtime.Encoder on a stream.
+type Encoder interface {
+	// Encode will write the provided object to the stream or return an error. It obeys the same
+	// contract as runtime.VersionedEncoder.
+	Encode(obj runtime.Object) error
+}
+
+// Decoder is a runtime.Decoder from a stream.
+type Decoder interface {
+	// Decode will return io.EOF when no more objects are available.
+	Decode(defaults *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error)
+	// Close closes the underlying stream.
+	Close() error
+}
+
+// Serializer is a factory for creating encoders and decoders that work over streams.
+type Serializer interface {
+	NewEncoder(w io.Writer) Encoder
+	NewDecoder(r io.ReadCloser) Decoder
+}
+
+type decoder struct {
+	reader    io.ReadCloser
+	decoder   runtime.Decoder
+	buf       []byte
+	maxBytes  int
+	resetRead bool
+}
+
+// NewDecoder creates a streaming decoder that reads object chunks from r and decodes them with d.
+// The reader is expected to return ErrShortRead if the provided buffer is not large enough to read
+// an entire object.
+func NewDecoder(r io.ReadCloser, d runtime.Decoder) Decoder {
+	return &decoder{
+		reader:   r,
+		decoder:  d,
+		buf:      make([]byte, 1024),
+		maxBytes: 16 * 1024 * 1024,
+	}
+}
+
+var ErrObjectTooLarge = fmt.Errorf("object to decode was longer than maximum allowed size")
+
+// Decode reads the next object from the stream and decodes it.
+func (d *decoder) Decode(defaults *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	base := 0
+	for {
+		n, err := d.reader.Read(d.buf[base:])
+		if err == io.ErrShortBuffer {
+			if n == 0 {
+				return nil, nil, fmt.Errorf("got short buffer with n=0, base=%d, cap=%d", base, cap(d.buf))
+			}
+			if d.resetRead {
+				continue
+			}
+			// double the buffer size up to maxBytes
+			if len(d.buf) < d.maxBytes {
+				base += n
+				d.buf = append(d.buf, make([]byte, len(d.buf))...)
+				continue
+			}
+			// must read the rest of the frame (until we stop getting ErrShortBuffer)
+			d.resetRead = true
+			return nil, nil, ErrObjectTooLarge
+		}
+		if err != nil {
+			return nil, nil, err
+		}
+		if d.resetRead {
+			// now that we have drained the large read, continue
+			d.resetRead = false
+			continue
+		}
+		base += n
+		break
+	}
+	return d.decoder.Decode(d.buf[:base], defaults, into)
+}
+
+func (d *decoder) Close() error {
+	return d.reader.Close()
+}
+
+type encoder struct {
+	writer  io.Writer
+	encoder runtime.Encoder
+	buf     *bytes.Buffer
+}
+
+// NewEncoder returns a new streaming encoder.
+func NewEncoder(w io.Writer, e runtime.Encoder) Encoder {
+	return &encoder{
+		writer:  w,
+		encoder: e,
+		buf:     &bytes.Buffer{},
+	}
+}
+
+// Encode writes the provided object to the nested writer.
+func (e *encoder) Encode(obj runtime.Object) error {
+	if err := e.encoder.Encode(obj, e.buf); err != nil {
+		return err
+	}
+	_, err := e.writer.Write(e.buf.Bytes())
+	e.buf.Reset()
+	return err
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/streaming/streaming_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/streaming/streaming_test.go
new file mode 100644
index 0000000000..1721423acc
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/streaming/streaming_test.go
@@ -0,0 +1,84 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package streaming
+
+import (
+	"bytes"
+	"io"
+	"io/ioutil"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/framer"
+)
+
+type fakeDecoder struct {
+	got []byte
+	obj runtime.Object
+	err error
+}
+
+func (d *fakeDecoder) Decode(data []byte, gvk *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	d.got = data
+	return d.obj, nil, d.err
+}
+
+func TestEmptyDecoder(t *testing.T) {
+	buf := bytes.NewBuffer([]byte{})
+	d := &fakeDecoder{}
+	_, _, err := NewDecoder(ioutil.NopCloser(buf), d).Decode(nil, nil)
+	if err != io.EOF {
+		t.Fatal(err)
+	}
+}
+
+func TestDecoder(t *testing.T) {
+	frames := [][]byte{
+		make([]byte, 1025),
+		make([]byte, 1024*5),
+		make([]byte, 1024*1024*17),
+		make([]byte, 1025),
+	}
+	pr, pw := io.Pipe()
+	fw := framer.NewLengthDelimitedFrameWriter(pw)
+	go func() {
+		for i := range frames {
+			fw.Write(frames[i])
+		}
+		pw.Close()
+	}()
+
+	r := framer.NewLengthDelimitedFrameReader(pr)
+	d := &fakeDecoder{}
+	dec := NewDecoder(r, d)
+	if _, _, err := dec.Decode(nil, nil); err != nil || !bytes.Equal(d.got, frames[0]) {
+		t.Fatalf("unexpected %v %v", err, len(d.got))
+	}
+	if _, _, err := dec.Decode(nil, nil); err != nil || !bytes.Equal(d.got, frames[1]) {
+		t.Fatalf("unexpected %v %v", err, len(d.got))
+	}
+	if _, _, err := dec.Decode(nil, nil); err != ErrObjectTooLarge || !bytes.Equal(d.got, frames[1]) {
+		t.Fatalf("unexpected %v %v", err, len(d.got))
+	}
+	if _, _, err := dec.Decode(nil, nil); err != nil || !bytes.Equal(d.got, frames[3]) {
+		t.Fatalf("unexpected %v %v", err, len(d.got))
+	}
+	if _, _, err := dec.Decode(nil, nil); err != io.EOF {
+		t.Fatalf("unexpected %v %v", err, len(d.got))
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go
new file mode 100644
index 0000000000..6c86d5e15c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go
@@ -0,0 +1,292 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package versioning
+
+import (
+	"encoding/json"
+	"io"
+	"reflect"
+	"sync"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/klog/v2"
+)
+
+// NewDefaultingCodecForScheme is a convenience method for callers that are using a scheme.
+func NewDefaultingCodecForScheme(
+	// TODO: I should be a scheme interface?
+	scheme *runtime.Scheme,
+	encoder runtime.Encoder,
+	decoder runtime.Decoder,
+	encodeVersion runtime.GroupVersioner,
+	decodeVersion runtime.GroupVersioner,
+) runtime.Codec {
+	return NewCodec(encoder, decoder, runtime.UnsafeObjectConvertor(scheme), scheme, scheme, scheme, encodeVersion, decodeVersion, scheme.Name())
+}
+
+// NewCodec takes objects in their internal versions and converts them to external versions before
+// serializing them. It assumes the serializer provided to it only deals with external versions.
+// This class is also a serializer, but is generally used with a specific version.
+func NewCodec(
+	encoder runtime.Encoder,
+	decoder runtime.Decoder,
+	convertor runtime.ObjectConvertor,
+	creater runtime.ObjectCreater,
+	typer runtime.ObjectTyper,
+	defaulter runtime.ObjectDefaulter,
+	encodeVersion runtime.GroupVersioner,
+	decodeVersion runtime.GroupVersioner,
+	originalSchemeName string,
+) runtime.Codec {
+	internal := &codec{
+		encoder:   encoder,
+		decoder:   decoder,
+		convertor: convertor,
+		creater:   creater,
+		typer:     typer,
+		defaulter: defaulter,
+
+		encodeVersion: encodeVersion,
+		decodeVersion: decodeVersion,
+
+		identifier: identifier(encodeVersion, encoder),
+
+		originalSchemeName: originalSchemeName,
+	}
+	return internal
+}
+
+type codec struct {
+	encoder   runtime.Encoder
+	decoder   runtime.Decoder
+	convertor runtime.ObjectConvertor
+	creater   runtime.ObjectCreater
+	typer     runtime.ObjectTyper
+	defaulter runtime.ObjectDefaulter
+
+	encodeVersion runtime.GroupVersioner
+	decodeVersion runtime.GroupVersioner
+
+	identifier runtime.Identifier
+
+	// originalSchemeName is optional, but when filled in it holds the name of the scheme from which this codec originates
+	originalSchemeName string
+}
+
+var _ runtime.EncoderWithAllocator = &codec{}
+
+var identifiersMap sync.Map
+
+type codecIdentifier struct {
+	EncodeGV string `json:"encodeGV,omitempty"`
+	Encoder  string `json:"encoder,omitempty"`
+	Name     string `json:"name,omitempty"`
+}
+
+// identifier computes Identifier of Encoder based on codec parameters.
+func identifier(encodeGV runtime.GroupVersioner, encoder runtime.Encoder) runtime.Identifier {
+	result := codecIdentifier{
+		Name: "versioning",
+	}
+
+	if encodeGV != nil {
+		result.EncodeGV = encodeGV.Identifier()
+	}
+	if encoder != nil {
+		result.Encoder = string(encoder.Identifier())
+	}
+	if id, ok := identifiersMap.Load(result); ok {
+		return id.(runtime.Identifier)
+	}
+	identifier, err := json.Marshal(result)
+	if err != nil {
+		//nolint:logcheck // Should not be reached.
+		klog.Fatalf("Failed marshaling identifier for codec: %v", err)
+	}
+	identifiersMap.Store(result, runtime.Identifier(identifier))
+	return runtime.Identifier(identifier)
+}
+
+// Decode attempts a decode of the object, then tries to convert it to the internal version. If into is provided and the decoding is
+// successful, the returned runtime.Object will be the value passed as into. Note that this may bypass conversion if you pass an
+// into that matches the serialized version.
+func (c *codec) Decode(data []byte, defaultGVK *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	// If the into object is unstructured and expresses an opinion about its group/version,
+	// create a new instance of the type so we always exercise the conversion path (skips short-circuiting on `into == obj`)
+	decodeInto := into
+	if into != nil {
+		if _, ok := into.(runtime.Unstructured); ok && !into.GetObjectKind().GroupVersionKind().GroupVersion().Empty() {
+			decodeInto = reflect.New(reflect.TypeOf(into).Elem()).Interface().(runtime.Object)
+		}
+	}
+
+	var strictDecodingErrs []error
+	obj, gvk, err := c.decoder.Decode(data, defaultGVK, decodeInto)
+	if err != nil {
+		if strictErr, ok := runtime.AsStrictDecodingError(err); obj != nil && ok {
+			// save the strictDecodingError and let the caller decide what to do with it
+			strictDecodingErrs = append(strictDecodingErrs, strictErr.Errors()...)
+		} else {
+			return nil, gvk, err
+		}
+	}
+
+	if d, ok := obj.(runtime.NestedObjectDecoder); ok {
+		if err := d.DecodeNestedObjects(runtime.WithoutVersionDecoder{Decoder: c.decoder}); err != nil {
+			if strictErr, ok := runtime.AsStrictDecodingError(err); ok {
+				// save the strictDecodingError let and the caller decide what to do with it
+				strictDecodingErrs = append(strictDecodingErrs, strictErr.Errors()...)
+			} else {
+				return nil, gvk, err
+
+			}
+		}
+	}
+
+	// aggregate the strict decoding errors into one
+	var strictDecodingErr error
+	if len(strictDecodingErrs) > 0 {
+		strictDecodingErr = runtime.NewStrictDecodingError(strictDecodingErrs)
+	}
+	// if we specify a target, use generic conversion.
+	if into != nil {
+		// perform defaulting if requested
+		if c.defaulter != nil {
+			c.defaulter.Default(obj)
+		}
+
+		// Short-circuit conversion if the into object is same object
+		if into == obj {
+			return into, gvk, strictDecodingErr
+		}
+
+		if err := c.convertor.Convert(obj, into, c.decodeVersion); err != nil {
+			return nil, gvk, err
+		}
+
+		return into, gvk, strictDecodingErr
+	}
+
+	// perform defaulting if requested
+	if c.defaulter != nil {
+		c.defaulter.Default(obj)
+	}
+
+	out, err := c.convertor.ConvertToVersion(obj, c.decodeVersion)
+	if err != nil {
+		return nil, gvk, err
+	}
+	return out, gvk, strictDecodingErr
+}
+
+// EncodeWithAllocator ensures the provided object is output in the appropriate group and version, invoking
+// conversion if necessary. Unversioned objects (according to the ObjectTyper) are output as is.
+// In addition, it allows for providing a memory allocator for efficient memory usage during object serialization.
+func (c *codec) EncodeWithAllocator(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	return c.encode(obj, w, memAlloc)
+}
+
+// Encode ensures the provided object is output in the appropriate group and version, invoking
+// conversion if necessary. Unversioned objects (according to the ObjectTyper) are output as is.
+func (c *codec) Encode(obj runtime.Object, w io.Writer) error {
+	return c.encode(obj, w, nil)
+}
+
+func (c *codec) encode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	if co, ok := obj.(runtime.CacheableObject); ok {
+		return co.CacheEncode(c.Identifier(), func(obj runtime.Object, w io.Writer) error { return c.doEncode(obj, w, memAlloc) }, w)
+	}
+	return c.doEncode(obj, w, memAlloc)
+}
+
+func (c *codec) doEncode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	encodeFn := c.encoder.Encode
+	if memAlloc != nil {
+		if encoder, supportsAllocator := c.encoder.(runtime.EncoderWithAllocator); supportsAllocator {
+			encodeFn = func(obj runtime.Object, w io.Writer) error {
+				return encoder.EncodeWithAllocator(obj, w, memAlloc)
+			}
+		} else {
+			//nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this.
+			klog.V(6).Infof("a memory allocator was provided but the encoder %s doesn't implement the runtime.EncoderWithAllocator, using regular encoder.Encode method", c.encoder.Identifier())
+		}
+	}
+	switch obj := obj.(type) {
+	case *runtime.Unknown:
+		return encodeFn(obj, w)
+	case runtime.Unstructured:
+		// An unstructured list can contain objects of multiple group version kinds. don't short-circuit just
+		// because the top-level type matches our desired destination type. actually send the object to the converter
+		// to give it a chance to convert the list items if needed.
+		if _, ok := obj.(*unstructured.UnstructuredList); !ok {
+			// avoid conversion roundtrip if GVK is the right one already or is empty (yes, this is a hack, but the old behaviour we rely on in kubectl)
+			objGVK := obj.GetObjectKind().GroupVersionKind()
+			if len(objGVK.Version) == 0 {
+				return encodeFn(obj, w)
+			}
+			targetGVK, ok := c.encodeVersion.KindForGroupVersionKinds([]schema.GroupVersionKind{objGVK})
+			if !ok {
+				return runtime.NewNotRegisteredGVKErrForTarget(c.originalSchemeName, objGVK, c.encodeVersion)
+			}
+			if targetGVK == objGVK {
+				return encodeFn(obj, w)
+			}
+		}
+	}
+
+	gvks, isUnversioned, err := c.typer.ObjectKinds(obj)
+	if err != nil {
+		return err
+	}
+
+	objectKind := obj.GetObjectKind()
+	old := objectKind.GroupVersionKind()
+	// restore the old GVK after encoding
+	defer objectKind.SetGroupVersionKind(old)
+
+	if c.encodeVersion == nil || isUnversioned {
+		if e, ok := obj.(runtime.NestedObjectEncoder); ok {
+			if err := e.EncodeNestedObjects(runtime.WithVersionEncoder{Encoder: c.encoder, ObjectTyper: c.typer}); err != nil {
+				return err
+			}
+		}
+		objectKind.SetGroupVersionKind(gvks[0])
+		return encodeFn(obj, w)
+	}
+
+	// Perform a conversion if necessary
+	out, err := c.convertor.ConvertToVersion(obj, c.encodeVersion)
+	if err != nil {
+		return err
+	}
+
+	if e, ok := out.(runtime.NestedObjectEncoder); ok {
+		if err := e.EncodeNestedObjects(runtime.WithVersionEncoder{Version: c.encodeVersion, Encoder: c.encoder, ObjectTyper: c.typer}); err != nil {
+			return err
+		}
+	}
+
+	// Conversion is responsible for setting the proper group, version, and kind onto the outgoing object
+	return encodeFn(out, w)
+}
+
+// Identifier implements runtime.Encoder interface.
+func (c *codec) Identifier() runtime.Identifier {
+	return c.identifier
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning_test.go
new file mode 100644
index 0000000000..ee12a69adf
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning_test.go
@@ -0,0 +1,405 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package versioning
+
+import (
+	"fmt"
+	"io"
+	"io/ioutil"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
+	"k8s.io/apimachinery/pkg/util/diff"
+)
+
+type testDecodable struct {
+	Other string
+	Value int `json:"value"`
+	gvk   schema.GroupVersionKind
+}
+
+func (d *testDecodable) GetObjectKind() schema.ObjectKind                { return d }
+func (d *testDecodable) SetGroupVersionKind(gvk schema.GroupVersionKind) { d.gvk = gvk }
+func (d *testDecodable) GroupVersionKind() schema.GroupVersionKind       { return d.gvk }
+func (d *testDecodable) DeepCopyObject() runtime.Object {
+	// no real deepcopy because these tests check for pointer equality
+	return d
+}
+
+type testNestedDecodable struct {
+	Other string
+	Value int `json:"value"`
+
+	gvk          schema.GroupVersionKind
+	nestedCalled bool
+	nestedErr    error
+}
+
+func (d *testNestedDecodable) GetObjectKind() schema.ObjectKind                { return d }
+func (d *testNestedDecodable) SetGroupVersionKind(gvk schema.GroupVersionKind) { d.gvk = gvk }
+func (d *testNestedDecodable) GroupVersionKind() schema.GroupVersionKind       { return d.gvk }
+func (d *testNestedDecodable) DeepCopyObject() runtime.Object {
+	// no real deepcopy because these tests check for pointer equality
+	return d
+}
+
+func (d *testNestedDecodable) EncodeNestedObjects(e runtime.Encoder) error {
+	d.nestedCalled = true
+	return d.nestedErr
+}
+
+func (d *testNestedDecodable) DecodeNestedObjects(_ runtime.Decoder) error {
+	d.nestedCalled = true
+	return d.nestedErr
+}
+
+func TestNestedDecode(t *testing.T) {
+	n := &testNestedDecodable{nestedErr: fmt.Errorf("unable to decode")}
+	decoder := &mockSerializer{obj: n}
+	codec := NewCodec(nil, decoder, nil, nil, nil, nil, nil, nil, "TestNestedDecode")
+	if _, _, err := codec.Decode([]byte(`{}`), nil, n); err != n.nestedErr {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if !n.nestedCalled {
+		t.Errorf("did not invoke nested decoder")
+	}
+}
+
+func TestNestedDecodeStrictDecodingError(t *testing.T) {
+	strictErr := runtime.NewStrictDecodingError([]error{fmt.Errorf("duplicate field")})
+	n := &testNestedDecodable{nestedErr: strictErr}
+	decoder := &mockSerializer{obj: n}
+	codec := NewCodec(nil, decoder, nil, nil, nil, nil, nil, nil, "TestNestedDecode")
+	o, _, err := codec.Decode([]byte(`{}`), nil, n)
+	if strictErr, ok := runtime.AsStrictDecodingError(err); !ok || err != strictErr {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if o != n {
+		t.Errorf("did not successfully decode with strict decoding error: %v", o)
+	}
+	if !n.nestedCalled {
+		t.Errorf("did not invoke nested decoder")
+	}
+}
+
+func TestNestedEncode(t *testing.T) {
+	n := &testNestedDecodable{nestedErr: fmt.Errorf("unable to decode")}
+	n2 := &testNestedDecodable{nestedErr: fmt.Errorf("unable to decode 2")}
+	encoder := &mockSerializer{obj: n}
+	codec := NewCodec(
+		encoder, nil,
+		&checkConvertor{obj: n2, groupVersion: schema.GroupVersion{Group: "other"}},
+		nil,
+		&mockTyper{gvks: []schema.GroupVersionKind{{Kind: "test"}}},
+		nil,
+		schema.GroupVersion{Group: "other"}, nil,
+		"TestNestedEncode",
+	)
+	if err := codec.Encode(n, ioutil.Discard); err != n2.nestedErr {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if n.nestedCalled || !n2.nestedCalled {
+		t.Errorf("did not invoke correct nested decoder")
+	}
+}
+
+func TestNestedEncodeError(t *testing.T) {
+	n := &testNestedDecodable{nestedErr: fmt.Errorf("unable to encode")}
+	gvk1 := schema.GroupVersionKind{Kind: "test", Group: "other", Version: "v1"}
+	gvk2 := schema.GroupVersionKind{Kind: "test", Group: "other", Version: "v2"}
+	n.SetGroupVersionKind(gvk1)
+	encoder := &mockSerializer{obj: n}
+	codec := NewCodec(
+		encoder, nil,
+		&mockConvertor{},
+		nil,
+		&mockTyper{gvks: []schema.GroupVersionKind{gvk1, gvk2}},
+		nil,
+		schema.GroupVersion{Group: "other", Version: "v2"}, nil,
+		"TestNestedEncodeError",
+	)
+	if err := codec.Encode(n, ioutil.Discard); err != n.nestedErr {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if n.GroupVersionKind() != gvk1 {
+		t.Errorf("unexpected gvk of input object: %v", n.GroupVersionKind())
+	}
+}
+
+func TestDecode(t *testing.T) {
+	gvk1 := &schema.GroupVersionKind{Kind: "Test", Group: "other", Version: "blah"}
+	decodable1 := &testDecodable{}
+	decodable2 := &testDecodable{}
+	decodable3 := &testDecodable{}
+
+	testCases := []struct {
+		serializer runtime.Serializer
+		convertor  runtime.ObjectConvertor
+		creater    runtime.ObjectCreater
+		typer      runtime.ObjectTyper
+		defaulter  runtime.ObjectDefaulter
+		yaml       bool
+		pretty     bool
+
+		encodes, decodes runtime.GroupVersioner
+
+		defaultGVK *schema.GroupVersionKind
+		into       runtime.Object
+
+		errFn          func(error) bool
+		expectedObject runtime.Object
+		sameObject     runtime.Object
+		expectedGVK    *schema.GroupVersionKind
+	}{
+		{
+			serializer:  &mockSerializer{actual: gvk1},
+			convertor:   &checkConvertor{groupVersion: schema.GroupVersion{Group: "other", Version: runtime.APIVersionInternal}},
+			expectedGVK: gvk1,
+			decodes:     schema.GroupVersion{Group: "other", Version: runtime.APIVersionInternal},
+		},
+		{
+			serializer:  &mockSerializer{actual: gvk1, obj: decodable1},
+			convertor:   &checkConvertor{in: decodable1, obj: decodable2, groupVersion: schema.GroupVersion{Group: "other", Version: runtime.APIVersionInternal}},
+			expectedGVK: gvk1,
+			sameObject:  decodable2,
+			decodes:     schema.GroupVersion{Group: "other", Version: runtime.APIVersionInternal},
+		},
+		// defaultGVK.Group is allowed to force a conversion to the destination group
+		{
+			serializer:  &mockSerializer{actual: gvk1, obj: decodable1},
+			defaultGVK:  &schema.GroupVersionKind{Group: "force"},
+			convertor:   &checkConvertor{in: decodable1, obj: decodable2, groupVersion: schema.GroupVersion{Group: "force", Version: runtime.APIVersionInternal}},
+			expectedGVK: gvk1,
+			sameObject:  decodable2,
+			decodes:     schema.GroupVersion{Group: "force", Version: runtime.APIVersionInternal},
+		},
+		// uses direct conversion for into when objects differ
+		{
+			into:        decodable3,
+			serializer:  &mockSerializer{actual: gvk1, obj: decodable1},
+			convertor:   &checkConvertor{in: decodable1, obj: decodable3, directConvert: true},
+			expectedGVK: gvk1,
+			sameObject:  decodable3,
+		},
+		// decode into the same version as the serialized object
+		{
+			decodes: schema.GroupVersions{gvk1.GroupVersion()},
+
+			serializer:     &mockSerializer{actual: gvk1, obj: decodable1},
+			convertor:      &checkConvertor{in: decodable1, obj: decodable1, groupVersion: schema.GroupVersions{{Group: "other", Version: "blah"}}},
+			expectedGVK:    gvk1,
+			expectedObject: decodable1,
+		},
+	}
+
+	for i, test := range testCases {
+		t.Logf("%d", i)
+		s := NewCodec(test.serializer, test.serializer, test.convertor, test.creater, test.typer, test.defaulter, test.encodes, test.decodes, fmt.Sprintf("mock-%d", i))
+		obj, gvk, err := s.Decode([]byte(`{}`), test.defaultGVK, test.into)
+
+		if !reflect.DeepEqual(test.expectedGVK, gvk) {
+			t.Errorf("%d: unexpected GVK: %v", i, gvk)
+		}
+
+		switch {
+		case err == nil && test.errFn != nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil && test.errFn == nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil:
+			if !test.errFn(err) {
+				t.Errorf("%d: failed: %v", i, err)
+			}
+			if obj != nil {
+				t.Errorf("%d: should have returned nil object", i)
+			}
+			continue
+		}
+
+		if test.into != nil && test.into != obj {
+			t.Errorf("%d: expected into to be returned: %v", i, obj)
+			continue
+		}
+
+		switch {
+		case test.expectedObject != nil:
+			if !reflect.DeepEqual(test.expectedObject, obj) {
+				t.Errorf("%d: unexpected object:\n%s", i, diff.ObjectGoPrintSideBySide(test.expectedObject, obj))
+			}
+		case test.sameObject != nil:
+			if test.sameObject != obj {
+				t.Errorf("%d: unexpected object:\n%s", i, diff.ObjectGoPrintSideBySide(test.sameObject, obj))
+			}
+		case obj != nil:
+			t.Errorf("%d: unexpected object: %#v", i, obj)
+		}
+	}
+}
+
+type checkConvertor struct {
+	err           error
+	in, obj       runtime.Object
+	groupVersion  runtime.GroupVersioner
+	directConvert bool
+}
+
+func (c *checkConvertor) Convert(in, out, context interface{}) error {
+	if !c.directConvert {
+		return fmt.Errorf("unexpected call to Convert")
+	}
+	if c.in != nil && c.in != in {
+		return fmt.Errorf("unexpected in: %s", in)
+	}
+	if c.obj != nil && c.obj != out {
+		return fmt.Errorf("unexpected out: %s", out)
+	}
+	return c.err
+}
+func (c *checkConvertor) ConvertToVersion(in runtime.Object, outVersion runtime.GroupVersioner) (out runtime.Object, err error) {
+	if c.directConvert {
+		return nil, fmt.Errorf("unexpected call to ConvertToVersion")
+	}
+	if c.in != nil && c.in != in {
+		return nil, fmt.Errorf("unexpected in: %s", in)
+	}
+	if !reflect.DeepEqual(c.groupVersion, outVersion) {
+		return nil, fmt.Errorf("unexpected outversion: %s (%s)", outVersion, c.groupVersion)
+	}
+	return c.obj, c.err
+}
+func (c *checkConvertor) ConvertFieldLabel(gvk schema.GroupVersionKind, label, value string) (string, string, error) {
+	return "", "", fmt.Errorf("unexpected call to ConvertFieldLabel")
+}
+
+type mockConvertor struct {
+}
+
+func (c *mockConvertor) Convert(in, out, context interface{}) error {
+	return fmt.Errorf("unexpect call to Convert")
+}
+
+func (c *mockConvertor) ConvertToVersion(in runtime.Object, outVersion runtime.GroupVersioner) (out runtime.Object, err error) {
+	objectKind := in.GetObjectKind()
+	inGVK := objectKind.GroupVersionKind()
+	if out, ok := outVersion.KindForGroupVersionKinds([]schema.GroupVersionKind{inGVK}); ok {
+		objectKind.SetGroupVersionKind(out)
+	} else {
+		return nil, fmt.Errorf("unexpected conversion")
+	}
+	return in, nil
+}
+
+func (c *mockConvertor) ConvertFieldLabel(gvk schema.GroupVersionKind, label, value string) (string, string, error) {
+	return "", "", fmt.Errorf("unexpected call to ConvertFieldLabel")
+}
+
+type mockSerializer struct {
+	err            error
+	obj            runtime.Object
+	encodingObjGVK schema.GroupVersionKind
+
+	defaults, actual *schema.GroupVersionKind
+	into             runtime.Object
+}
+
+func (s *mockSerializer) Decode(data []byte, defaults *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	s.defaults = defaults
+	s.into = into
+	return s.obj, s.actual, s.err
+}
+
+func (s *mockSerializer) Encode(obj runtime.Object, w io.Writer) error {
+	s.obj = obj
+	s.encodingObjGVK = obj.GetObjectKind().GroupVersionKind()
+	return s.err
+}
+
+func (s *mockSerializer) Identifier() runtime.Identifier {
+	return runtime.Identifier("mock")
+}
+
+type mockTyper struct {
+	gvks        []schema.GroupVersionKind
+	unversioned bool
+	err         error
+}
+
+func (t *mockTyper) ObjectKinds(obj runtime.Object) ([]schema.GroupVersionKind, bool, error) {
+	return t.gvks, t.unversioned, t.err
+}
+
+func (t *mockTyper) Recognizes(_ schema.GroupVersionKind) bool {
+	return true
+}
+
+func TestDirectCodecEncode(t *testing.T) {
+	serializer := mockSerializer{}
+	typer := mockTyper{
+		gvks: []schema.GroupVersionKind{
+			{
+				Group: "wrong_group",
+				Kind:  "some_kind",
+			},
+			{
+				Group: "expected_group",
+				Kind:  "some_kind",
+			},
+		},
+	}
+
+	c := runtime.WithVersionEncoder{
+		Version:     schema.GroupVersion{Group: "expected_group"},
+		Encoder:     &serializer,
+		ObjectTyper: &typer,
+	}
+	c.Encode(&testDecodable{}, ioutil.Discard)
+	if e, a := "expected_group", serializer.encodingObjGVK.Group; e != a {
+		t.Errorf("expected group to be %v, got %v", e, a)
+	}
+}
+
+func TestCacheableObject(t *testing.T) {
+	gvk1 := schema.GroupVersionKind{Group: "group", Version: "version1", Kind: "MockCacheableObject"}
+	gvk2 := schema.GroupVersionKind{Group: "group", Version: "version2", Kind: "MockCacheableObject"}
+
+	encoder := NewCodec(
+		&mockSerializer{}, &mockSerializer{},
+		&mockConvertor{}, nil,
+		&mockTyper{gvks: []schema.GroupVersionKind{gvk1, gvk2}}, nil,
+		gvk1.GroupVersion(), gvk2.GroupVersion(),
+		"TestCacheableObject")
+
+	runtimetesting.CacheableObjectTest(t, encoder)
+}
+
+func BenchmarkIdentifier(b *testing.B) {
+	encoder := &mockSerializer{}
+	gv := schema.GroupVersion{Group: "group", Version: "version"}
+
+	for i := 0; i < b.N; i++ {
+		id := identifier(gv, encoder)
+		// Avoid optimizing by compiler.
+		if id[0] != '{' {
+			b.Errorf("unexpected identifier: %s", id)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning_unstructured_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning_unstructured_test.go
new file mode 100644
index 0000000000..e47a259f69
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning_unstructured_test.go
@@ -0,0 +1,338 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package versioning
+
+import (
+	"fmt"
+	"io/ioutil"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func buildUnstructuredDecodable(gvk schema.GroupVersionKind) runtime.Object {
+	obj := &unstructured.Unstructured{}
+	obj.SetGroupVersionKind(gvk)
+	return obj
+}
+
+func buildUnstructuredListDecodable(gvk schema.GroupVersionKind) runtime.Object {
+	obj := &unstructured.UnstructuredList{}
+	obj.SetGroupVersionKind(gvk)
+	return obj
+}
+
+func TestEncodeUnstructured(t *testing.T) {
+	v1GVK := schema.GroupVersionKind{
+		Group:   "crispy",
+		Version: "v1",
+		Kind:    "Noxu",
+	}
+	v2GVK := schema.GroupVersionKind{
+		Group:   "crispy",
+		Version: "v2",
+		Kind:    "Noxu",
+	}
+	elseGVK := schema.GroupVersionKind{
+		Group:   "crispy2",
+		Version: "else",
+		Kind:    "Noxu",
+	}
+	elseUnstructuredDecodable := buildUnstructuredDecodable(elseGVK)
+	elseUnstructuredDecodableList := buildUnstructuredListDecodable(elseGVK)
+	v1UnstructuredDecodable := buildUnstructuredDecodable(v1GVK)
+	v1UnstructuredDecodableList := buildUnstructuredListDecodable(v1GVK)
+	v2UnstructuredDecodable := buildUnstructuredDecodable(v2GVK)
+
+	testCases := []struct {
+		name          string
+		convertor     runtime.ObjectConvertor
+		targetVersion runtime.GroupVersioner
+		outObj        runtime.Object
+		typer         runtime.ObjectTyper
+
+		errFunc     func(error) bool
+		expectedObj runtime.Object
+	}{
+		{
+			name: "encode v1 unstructured with v2 encode version",
+			typer: &mockTyper{
+				gvks: []schema.GroupVersionKind{v1GVK},
+			},
+			outObj:        v1UnstructuredDecodable,
+			targetVersion: v2GVK.GroupVersion(),
+			convertor: &checkConvertor{
+				obj:          v2UnstructuredDecodable,
+				groupVersion: v2GVK.GroupVersion(),
+			},
+			expectedObj: v2UnstructuredDecodable,
+		},
+		{
+			name: "both typer and conversion are bypassed when unstructured gvk matches encode gvk",
+			typer: &mockTyper{
+				err: fmt.Errorf("unexpected typer call"),
+			},
+			outObj:        v1UnstructuredDecodable,
+			targetVersion: v1GVK.GroupVersion(),
+			convertor: &checkConvertor{
+				err: fmt.Errorf("unexpected conversion happened"),
+			},
+			expectedObj: v1UnstructuredDecodable,
+		},
+		{
+			name:          "encode will fail when unstructured object's gvk and encode gvk mismatches",
+			outObj:        elseUnstructuredDecodable,
+			targetVersion: v1GVK.GroupVersion(),
+			errFunc: func(err error) bool {
+				return assert.Equal(t, runtime.NewNotRegisteredGVKErrForTarget("noxu-scheme", elseGVK, v1GVK.GroupVersion()), err)
+			},
+		},
+		{
+			name:          "encode with unstructured list's gvk regardless of its elements' gvk",
+			outObj:        elseUnstructuredDecodableList,
+			targetVersion: elseGVK.GroupVersion(),
+		},
+		{
+			name:          "typer fail to recognize unstructured object gvk will fail the encoding",
+			outObj:        elseUnstructuredDecodable,
+			targetVersion: v1GVK.GroupVersion(),
+			typer: &mockTyper{
+				err: fmt.Errorf("invalid obj gvk"),
+			},
+		},
+		{
+			name:          "encoding unstructured object without encode version will fallback to typer suggested version",
+			targetVersion: v1GVK.GroupVersion(),
+			convertor: &checkConvertor{
+				obj:          v1UnstructuredDecodableList,
+				groupVersion: v1GVK.GroupVersion(),
+			},
+			outObj: elseUnstructuredDecodable,
+			typer: &mockTyper{
+				gvks: []schema.GroupVersionKind{v1GVK},
+			},
+		},
+	}
+	for _, testCase := range testCases {
+		serializer := &mockSerializer{}
+		codec := NewCodec(serializer, serializer, testCase.convertor, nil, testCase.typer, nil, testCase.targetVersion, nil, "noxu-scheme")
+		err := codec.Encode(testCase.outObj, ioutil.Discard)
+		if testCase.errFunc != nil {
+			if !testCase.errFunc(err) {
+				t.Errorf("%v: failed: %v", testCase.name, err)
+			}
+			return
+		}
+		assert.NoError(t, err)
+		assert.Equal(t, testCase.expectedObj, serializer.obj)
+	}
+}
+
+type errNotRecognizedGVK struct {
+	failedGVK    schema.GroupVersionKind
+	claimingGVKs []schema.GroupVersionKind
+}
+
+func (e errNotRecognizedGVK) Error() string {
+	return fmt.Sprintf("unrecognized gvk %v, should be one of %v", e.failedGVK, e.claimingGVKs)
+}
+
+type mockUnstructuredNopConvertor struct {
+	claimingGVKs []schema.GroupVersionKind
+}
+
+func (c *mockUnstructuredNopConvertor) recognizeGVK(gvkToCheck schema.GroupVersionKind) error {
+	matched := false
+	for _, gvk := range c.claimingGVKs {
+		if gvk == gvkToCheck {
+			matched = true
+		}
+	}
+	if !matched {
+		return errNotRecognizedGVK{
+			failedGVK:    gvkToCheck,
+			claimingGVKs: c.claimingGVKs,
+		}
+	}
+	return nil
+}
+
+func (c *mockUnstructuredNopConvertor) Convert(in, out, context interface{}) error {
+	inObj := in.(*unstructured.Unstructured)
+	outObj := out.(*unstructured.Unstructured)
+	if err := c.recognizeGVK(outObj.GroupVersionKind()); err != nil {
+		return err
+	}
+	outGVK := outObj.GetObjectKind().GroupVersionKind()
+	*outObj = *inObj.DeepCopy()
+	outObj.GetObjectKind().SetGroupVersionKind(outGVK)
+	return nil
+}
+
+func (c *mockUnstructuredNopConvertor) ConvertToVersion(in runtime.Object, outVersion runtime.GroupVersioner) (runtime.Object, error) {
+	out := in.DeepCopyObject()
+	targetGVK, matched := outVersion.KindForGroupVersionKinds([]schema.GroupVersionKind{in.GetObjectKind().GroupVersionKind()})
+	if !matched {
+		return nil, fmt.Errorf("attempt to convert to mismatched gv %v", outVersion)
+	}
+	if err := c.recognizeGVK(out.GetObjectKind().GroupVersionKind()); err != nil {
+		return nil, err
+	}
+	out.GetObjectKind().SetGroupVersionKind(targetGVK)
+	return out, nil
+}
+
+func (c *mockUnstructuredNopConvertor) ConvertFieldLabel(gvk schema.GroupVersionKind, label, value string) (string, string, error) {
+	return "", "", fmt.Errorf("unexpected call to ConvertFieldLabel")
+}
+
+func TestDecodeUnstructured(t *testing.T) {
+	internalGVK := schema.GroupVersionKind{
+		Group:   "crispy",
+		Version: runtime.APIVersionInternal,
+		Kind:    "Noxu",
+	}
+	v1GVK := schema.GroupVersionKind{
+		Group:   "crispy",
+		Version: "v1",
+		Kind:    "Noxu",
+	}
+	v2GVK := schema.GroupVersionKind{
+		Group:   "crispy",
+		Version: "v2",
+		Kind:    "Noxu",
+	}
+	internalUnstructuredDecodable := buildUnstructuredDecodable(internalGVK)
+	v1UnstructuredDecodable := buildUnstructuredDecodable(v1GVK)
+	v2UnstructuredDecodable := buildUnstructuredDecodable(v2GVK)
+
+	testCases := []struct {
+		name                    string
+		serializer              runtime.Serializer
+		convertor               runtime.ObjectConvertor
+		suggestedConvertVersion runtime.GroupVersioner
+		defaultGVK              *schema.GroupVersionKind
+		intoObj                 runtime.Object
+
+		errFunc                     func(error) bool
+		expectedGVKOfSerializedData *schema.GroupVersionKind
+		expectedOut                 runtime.Object
+	}{
+		{
+			name:       "decode v1 unstructured into non-nil v2 unstructured",
+			serializer: &mockSerializer{actual: &v1GVK, obj: v1UnstructuredDecodable},
+			convertor: &mockUnstructuredNopConvertor{
+				claimingGVKs: []schema.GroupVersionKind{
+					v1GVK, v2GVK,
+				},
+			},
+			suggestedConvertVersion:     v2GVK.GroupVersion(),
+			intoObj:                     v2UnstructuredDecodable,
+			expectedGVKOfSerializedData: &v1GVK,
+			expectedOut:                 v2UnstructuredDecodable,
+		},
+		{
+			name:       "decode v1 unstructured into nil object with v2 version",
+			serializer: &mockSerializer{actual: &v1GVK, obj: v1UnstructuredDecodable},
+			convertor: &mockUnstructuredNopConvertor{
+				claimingGVKs: []schema.GroupVersionKind{
+					v1GVK, v2GVK,
+				},
+			},
+			suggestedConvertVersion:     v2GVK.GroupVersion(),
+			intoObj:                     nil,
+			expectedGVKOfSerializedData: &v1GVK,
+			expectedOut:                 v2UnstructuredDecodable,
+		},
+		{
+			name:       "decode v1 unstructured into non-nil internal unstructured",
+			serializer: &mockSerializer{actual: &v1GVK, obj: v1UnstructuredDecodable},
+			convertor: &mockUnstructuredNopConvertor{
+				claimingGVKs: []schema.GroupVersionKind{
+					v1GVK, v2GVK,
+				},
+			},
+			suggestedConvertVersion: internalGVK.GroupVersion(),
+			intoObj:                 internalUnstructuredDecodable,
+			errFunc: func(err error) bool {
+				notRecognized, ok := err.(errNotRecognizedGVK)
+				if !ok {
+					return false
+				}
+				return assert.Equal(t, notRecognized.failedGVK, internalGVK)
+			},
+		},
+		{
+			name:       "decode v1 unstructured into nil object with internal version",
+			serializer: &mockSerializer{actual: &v1GVK, obj: v1UnstructuredDecodable},
+			convertor: &mockUnstructuredNopConvertor{
+				claimingGVKs: []schema.GroupVersionKind{
+					v1GVK, v2GVK,
+				},
+			},
+			suggestedConvertVersion: internalGVK.GroupVersion(),
+			intoObj:                 nil,
+			errFunc: func(err error) bool {
+				notRecognized, ok := err.(errNotRecognizedGVK)
+				if !ok {
+					return false
+				}
+				return assert.Equal(t, notRecognized.failedGVK, internalGVK)
+			},
+		},
+		{
+			name:       "skip conversion if serializer returns the same unstructured as into",
+			serializer: &mockSerializer{actual: &v1GVK, obj: v1UnstructuredDecodable},
+			convertor: &checkConvertor{
+				err: fmt.Errorf("unexpected conversion happened"),
+			},
+			suggestedConvertVersion:     internalGVK.GroupVersion(),
+			intoObj:                     v1UnstructuredDecodable,
+			expectedGVKOfSerializedData: &v1GVK,
+			expectedOut:                 v1UnstructuredDecodable,
+		},
+		{
+			name:       "invalid convert version makes decoding unstructured fail",
+			serializer: &mockSerializer{actual: &v1GVK, obj: v1UnstructuredDecodable},
+			convertor: &checkConvertor{
+				in:           v1UnstructuredDecodable,
+				groupVersion: internalGVK.GroupVersion(),
+				err:          fmt.Errorf("no matching decode version"),
+			},
+			suggestedConvertVersion: internalGVK.GroupVersion(),
+			errFunc: func(err error) bool {
+				return assert.Equal(t, err, fmt.Errorf("no matching decode version"))
+			},
+		},
+	}
+	for _, testCase := range testCases {
+		codec := NewCodec(testCase.serializer, testCase.serializer, testCase.convertor, nil, nil, nil, nil, testCase.suggestedConvertVersion, "noxu-scheme")
+		actualObj, actualSerializedGVK, err := codec.Decode([]byte(`{}`), testCase.defaultGVK, testCase.intoObj)
+		if testCase.errFunc != nil {
+			if !testCase.errFunc(err) {
+				t.Errorf("%v: failed: %v", testCase.name, err)
+			}
+			return
+		}
+		assert.NoError(t, err)
+		assert.Equal(t, testCase.expectedOut, actualObj, "%v failed", testCase.name)
+		assert.Equal(t, testCase.expectedGVKOfSerializedData, actualSerializedGVK, "%v failed", testCase.name)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/meta.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/meta.go
new file mode 100644
index 0000000000..407a7419a6
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/meta.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/yaml"
+)
+
+// DefaultMetaFactory is a default factory for versioning objects in JSON or
+// YAML. The object in memory and in the default serialization will use the
+// "kind" and "apiVersion" fields.
+var DefaultMetaFactory = SimpleMetaFactory{}
+
+// SimpleMetaFactory provides default methods for retrieving the type and version of objects
+// that are identified with an "apiVersion" and "kind" fields in their JSON
+// serialization. It may be parameterized with the names of the fields in memory, or an
+// optional list of base structs to search for those fields in memory.
+type SimpleMetaFactory struct{}
+
+// Interpret will return the APIVersion and Kind of the JSON wire-format
+// encoding of an object, or an error.
+func (SimpleMetaFactory) Interpret(data []byte) (*schema.GroupVersionKind, error) {
+	gvk := runtime.TypeMeta{}
+	if err := yaml.Unmarshal(data, &gvk); err != nil {
+		return nil, fmt.Errorf("could not interpret GroupVersionKind; unmarshal error: %v", err)
+	}
+	gv, err := schema.ParseGroupVersion(gvk.APIVersion)
+	if err != nil {
+		return nil, err
+	}
+	return &schema.GroupVersionKind{Group: gv.Group, Version: gv.Version, Kind: gvk.Kind}, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/meta_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/meta_test.go
new file mode 100644
index 0000000000..ba560008ea
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/meta_test.go
@@ -0,0 +1,160 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestInterpret(t *testing.T) {
+	testCases := []struct {
+		name     string
+		input    string
+		expected *schema.GroupVersionKind
+		errFn    func(error) bool
+	}{
+		{
+			name: "YAMLSuccessfullyInterpretVK",
+			input: `apiVersion: v1
+kind: Service`,
+			expected: &schema.GroupVersionKind{Version: "v1", Kind: "Service"},
+		},
+		{
+			name: "YAMLSuccessfullyInterpretGVK",
+			input: `apiVersion: core/v2
+kind: Deployment`,
+			expected: &schema.GroupVersionKind{Group: "core", Version: "v2", Kind: "Deployment"},
+		},
+		{
+			name:     "YAMLSuccessfullyInterpretV",
+			input:    `apiVersion: v1`,
+			expected: &schema.GroupVersionKind{Version: "v1"},
+		},
+		{
+			name:     "YAMLSuccessfullyInterpretK",
+			input:    `kind: Service`,
+			expected: &schema.GroupVersionKind{Kind: "Service"},
+		},
+		{
+			name:     "YAMLSuccessfullyInterpretEmptyString",
+			input:    ``,
+			expected: &schema.GroupVersionKind{},
+		},
+		{
+			name:     "YAMLSuccessfullyInterpretEmptyDoc",
+			input:    `---`,
+			expected: &schema.GroupVersionKind{},
+		},
+		{
+			name: "YAMLSuccessfullyInterpretMultiDoc",
+			input: `---
+apiVersion: v1
+kind: Service
+---
+apiVersion: v2
+kind: Deployment`,
+			expected: &schema.GroupVersionKind{Version: "v1", Kind: "Service"},
+		},
+		{
+			name:     "YAMLSuccessfullyInterpretOnlyG",
+			input:    `apiVersion: core/`,
+			expected: &schema.GroupVersionKind{Group: "core"},
+		},
+		{
+			name:     "YAMLSuccessfullyWrongFormat",
+			input:    `foo: bar`,
+			expected: &schema.GroupVersionKind{},
+		},
+		{
+			name:  "YAMLFailInterpretWrongSyntax",
+			input: `foo`,
+			errFn: func(err error) bool { return err != nil },
+		},
+		{
+			name:     "JSONSuccessfullyInterpretVK",
+			input:    `{"apiVersion": "v3", "kind": "DaemonSet"}`,
+			expected: &schema.GroupVersionKind{Version: "v3", Kind: "DaemonSet"},
+		},
+		{
+			name:     "JSONSuccessfullyInterpretGVK",
+			input:    `{"apiVersion": "core/v2", "kind": "Deployment"}`,
+			expected: &schema.GroupVersionKind{Group: "core", Version: "v2", Kind: "Deployment"},
+		},
+		{
+			name:     "JSONSuccessfullyInterpretV",
+			input:    `{"apiVersion": "v1"}`,
+			expected: &schema.GroupVersionKind{Version: "v1"},
+		},
+		{
+			name:     "JSONSuccessfullyInterpretK",
+			input:    `{"kind": "Service"}`,
+			expected: &schema.GroupVersionKind{Kind: "Service"},
+		},
+		{
+			name:     "JSONSuccessfullyInterpretEmptyString",
+			input:    ``,
+			expected: &schema.GroupVersionKind{},
+		},
+		{
+			name:     "JSONSuccessfullyInterpretEmptyObject",
+			input:    `{}`,
+			expected: &schema.GroupVersionKind{},
+		},
+		{
+			name: "JSONSuccessfullyInterpretMultiDoc",
+			input: `{"apiVersion": "v1", "kind": "Service"}, 
+{"apiVersion": "v2", "kind": "Deployment"}`,
+			expected: &schema.GroupVersionKind{Version: "v1", Kind: "Service"},
+		},
+		{
+			name:     "JSONSuccessfullyWrongFormat",
+			input:    `{"foo": "bar"}`,
+			expected: &schema.GroupVersionKind{},
+		},
+		{
+			name:  "JSONFailInterpretArray",
+			input: `[]`,
+			errFn: func(err error) bool { return err != nil },
+		},
+		{
+			name:  "JSONFailInterpretWrongSyntax",
+			input: `{"foo"`,
+			errFn: func(err error) bool { return err != nil },
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.name, func(t *testing.T) {
+			actual, err := DefaultMetaFactory.Interpret([]byte(test.input))
+			switch {
+			case test.errFn != nil:
+				if !test.errFn(err) {
+					t.Errorf("unexpected error: %v", err)
+				}
+			case err != nil:
+				t.Errorf("unexpected error: %v", err)
+			case !reflect.DeepEqual(test.expected, actual):
+				t.Errorf("outcome mismatch -- expected: %#v, actual: %#v",
+					test.expected, actual,
+				)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/yaml.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/yaml.go
new file mode 100644
index 0000000000..2fdd1d43d5
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/yaml.go
@@ -0,0 +1,46 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/yaml"
+)
+
+// yamlSerializer converts YAML passed to the Decoder methods to JSON.
+type yamlSerializer struct {
+	// the nested serializer
+	runtime.Serializer
+}
+
+// yamlSerializer implements Serializer
+var _ runtime.Serializer = yamlSerializer{}
+
+// NewDecodingSerializer adds YAML decoding support to a serializer that supports JSON.
+func NewDecodingSerializer(jsonSerializer runtime.Serializer) runtime.Serializer {
+	return &yamlSerializer{jsonSerializer}
+}
+
+func (c yamlSerializer) Decode(data []byte, gvk *schema.GroupVersionKind, into runtime.Object) (runtime.Object, *schema.GroupVersionKind, error) {
+	out, err := yaml.ToJSON(data)
+	if err != nil {
+		return nil, nil, err
+	}
+	data = out
+	return c.Serializer.Decode(data, gvk, into)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/yaml_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/yaml_test.go
new file mode 100644
index 0000000000..9a94e4af7a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/serializer/yaml/yaml_test.go
@@ -0,0 +1,414 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import (
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/yaml"
+	sigsyaml "sigs.k8s.io/yaml"
+)
+
+type testcase struct {
+	name  string
+	data  []byte
+	error string
+
+	benchmark bool
+}
+
+func testcases() []testcase {
+	return []testcase{
+		{
+			name:  "arrays of string aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a ["webwebwebwebwebweb","webwebwebwebwebweb","webwebwebwebwebweb","webwebwebwebwebweb","webwebwebwebwebweb","webwebwebwebwebweb","webwebwebwebwebweb","webwebwebwebwebweb","webwebwebwebwebweb"]
+b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+		},
+		{
+			name:  "arrays of empty string aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a ["","","","","","","","",""]
+b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "arrays of null aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a [null,null,null,null,null,null,null,null,null]
+b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "arrays of zero int aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a [0,0,0,0,0,0,0,0,0]
+b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "arrays of zero float aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a [0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0]
+b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "arrays of big float aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a [1234567890.12345678,1234567890.12345678,1234567890.12345678,1234567890.12345678,1234567890.12345678,1234567890.12345678,1234567890.12345678,1234567890.12345678,1234567890.12345678]
+b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "arrays of bool aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a [true,true,true,true,true,true,true,true,true]
+b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a,*a]
+c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b,*b]
+d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c,*c]
+e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d,*d]
+f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e,*e]
+g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f,*f]
+h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g,*g]
+i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h,*h]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "map key aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a {"verylongkey1":"","verylongkey2":"","verylongkey3":"","verylongkey4":"","verylongkey5":"","verylongkey6":"","verylongkey7":"","verylongkey8":"","verylongkey9":""}
+b: &b {"verylongkey1":*a,"verylongkey2":*a,"verylongkey3":*a,"verylongkey4":*a,"verylongkey5":*a,"verylongkey6":*a,"verylongkey7":*a,"verylongkey8":*a,"verylongkey9":*a}
+c: &c {"verylongkey1":*b,"verylongkey2":*b,"verylongkey3":*b,"verylongkey4":*b,"verylongkey5":*b,"verylongkey6":*b,"verylongkey7":*b,"verylongkey8":*b,"verylongkey9":*b}
+d: &d {"verylongkey1":*c,"verylongkey2":*c,"verylongkey3":*c,"verylongkey4":*c,"verylongkey5":*c,"verylongkey6":*c,"verylongkey7":*c,"verylongkey8":*c,"verylongkey9":*c}
+e: &e {"verylongkey1":*d,"verylongkey2":*d,"verylongkey3":*d,"verylongkey4":*d,"verylongkey5":*d,"verylongkey6":*d,"verylongkey7":*d,"verylongkey8":*d,"verylongkey9":*d}
+f: &f {"verylongkey1":*e,"verylongkey2":*e,"verylongkey3":*e,"verylongkey4":*e,"verylongkey5":*e,"verylongkey6":*e,"verylongkey7":*e,"verylongkey8":*e,"verylongkey9":*e}
+g: &g {"verylongkey1":*f,"verylongkey2":*f,"verylongkey3":*f,"verylongkey4":*f,"verylongkey5":*f,"verylongkey6":*f,"verylongkey7":*f,"verylongkey8":*f,"verylongkey9":*f}
+h: &h {"verylongkey1":*g,"verylongkey2":*g,"verylongkey3":*g,"verylongkey4":*g,"verylongkey5":*g,"verylongkey6":*g,"verylongkey7":*g,"verylongkey8":*g,"verylongkey9":*g}
+i: &i {"verylongkey1":*h,"verylongkey2":*h,"verylongkey3":*h,"verylongkey4":*h,"verylongkey5":*h,"verylongkey6":*h,"verylongkey7":*h,"verylongkey8":*h,"verylongkey9":*h}
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "map value aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a {"1":"verylongmapvalue","2":"verylongmapvalue","3":"verylongmapvalue","4":"verylongmapvalue","5":"verylongmapvalue","6":"verylongmapvalue","7":"verylongmapvalue","8":"verylongmapvalue","9":"verylongmapvalue"}
+b: &b {"1":*a,"2":*a,"3":*a,"4":*a,"5":*a,"6":*a,"7":*a,"8":*a,"9":*a}
+c: &c {"1":*b,"2":*b,"3":*b,"4":*b,"5":*b,"6":*b,"7":*b,"8":*b,"9":*b}
+d: &d {"1":*c,"2":*c,"3":*c,"4":*c,"5":*c,"6":*c,"7":*c,"8":*c,"9":*c}
+e: &e {"1":*d,"2":*d,"3":*d,"4":*d,"5":*d,"6":*d,"7":*d,"8":*d,"9":*d}
+f: &f {"1":*e,"2":*e,"3":*e,"4":*e,"5":*e,"6":*e,"7":*e,"8":*e,"9":*e}
+g: &g {"1":*f,"2":*f,"3":*f,"4":*f,"5":*f,"6":*f,"7":*f,"8":*f,"9":*f}
+h: &h {"1":*g,"2":*g,"3":*g,"4":*g,"5":*g,"6":*g,"7":*g,"8":*g,"9":*g}
+i: &i {"1":*h,"2":*h,"3":*h,"4":*h,"5":*h,"6":*h,"7":*h,"8":*h,"9":*h}
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "nested map aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a {"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{"":{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}
+b: &b {"1":*a,"2":*a,"3":*a,"4":*a,"5":*a,"6":*a,"7":*a,"8":*a,"9":*a}
+c: &c {"1":*b,"2":*b,"3":*b,"4":*b,"5":*b,"6":*b,"7":*b,"8":*b,"9":*b}
+d: &d {"1":*c,"2":*c,"3":*c,"4":*c,"5":*c,"6":*c,"7":*c,"8":*c,"9":*c}
+e: &e {"1":*d,"2":*d,"3":*d,"4":*d,"5":*d,"6":*d,"7":*d,"8":*d,"9":*d}
+f: &f {"1":*e,"2":*e,"3":*e,"4":*e,"5":*e,"6":*e,"7":*e,"8":*e,"9":*e}
+g: &g {"1":*f,"2":*f,"3":*f,"4":*f,"5":*f,"6":*f,"7":*f,"8":*f,"9":*f}
+h: &h {"1":*g,"2":*g,"3":*g,"4":*g,"5":*g,"6":*g,"7":*g,"8":*g,"9":*g}
+i: &i {"1":*h,"2":*h,"3":*h,"4":*h,"5":*h,"6":*h,"7":*h,"8":*h,"9":*h}
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:  "nested slice aliases",
+			error: "excessive aliasing",
+			data: []byte(`
+apiVersion: v1
+data:
+a: &a [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[""]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
+b: &b [[[[[[[[[[*a]]]]]]]]],[[[[[[[[[*a]]]]]]]]],[[[[[[[[[*a]]]]]]]]],[[[[[[[[[*a]]]]]]]]],[[[[[[[[[*a]]]]]]]]]]
+c: &c [[[[[[[[[[*b]]]]]]]]],[[[[[[[[[*b]]]]]]]]],[[[[[[[[[*b]]]]]]]]],[[[[[[[[[*b]]]]]]]]],[[[[[[[[[*b]]]]]]]]]]
+d: &d [[[[[[[[[[*c]]]]]]]]],[[[[[[[[[*c]]]]]]]]],[[[[[[[[[*c]]]]]]]]],[[[[[[[[[*c]]]]]]]]],[[[[[[[[[*c]]]]]]]]]]
+e: &e [[[[[[[[[[*d]]]]]]]]],[[[[[[[[[*d]]]]]]]]],[[[[[[[[[*d]]]]]]]]],[[[[[[[[[*d]]]]]]]]],[[[[[[[[[*d]]]]]]]]]]
+f: &f [[[[[[[[[[*e]]]]]]]]],[[[[[[[[[*e]]]]]]]]],[[[[[[[[[*e]]]]]]]]],[[[[[[[[[*e]]]]]]]]],[[[[[[[[[*e]]]]]]]]]]
+g: &g [[[[[[[[[[*f]]]]]]]]],[[[[[[[[[*f]]]]]]]]],[[[[[[[[[*f]]]]]]]]],[[[[[[[[[*f]]]]]]]]],[[[[[[[[[*f]]]]]]]]]]
+h: &h [[[[[[[[[[*g]]]]]]]]],[[[[[[[[[*g]]]]]]]]],[[[[[[[[[*g]]]]]]]]],[[[[[[[[[*g]]]]]]]]],[[[[[[[[[*g]]]]]]]]]]
+i: &i [[[[[[[[[[*h]]]]]]]]],[[[[[[[[[*h]]]]]]]]],[[[[[[[[[*h]]]]]]]]],[[[[[[[[[*h]]]]]]]]],[[[[[[[[[*h]]]]]]]]]]
+kind: ConfigMap
+metadata:
+name: yaml-bomb
+namespace: default
+`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB map without alias",
+			data:      []byte(`a: &a [{a}` + strings.Repeat(`,{a}`, 3*1024*1024/4) + `]`),
+			benchmark: true,
+		},
+		{
+			name:  "3MB map with alias",
+			error: "excessive aliasing",
+			data: []byte(`
+a: &a [{a}` + strings.Repeat(`,{a}`, 3*1024*1024/4) + `]
+b: &b [*a]`),
+			benchmark: true,
+		},
+		{
+			name:  "deeply nested slices",
+			error: "max depth",
+			data:  []byte(strings.Repeat(`[`, 3*1024*1024)),
+		},
+		{
+			name:  "deeply nested maps",
+			error: "max depth",
+			data:  []byte("x: " + strings.Repeat(`{`, 3*1024*1024)),
+		},
+		{
+			name:  "deeply nested indents",
+			error: "max depth",
+			data:  []byte(strings.Repeat(`- `, 3*1024*1024)),
+		},
+		{
+			name:      "3MB of 1000-indent lines",
+			data:      []byte(strings.Repeat(strings.Repeat(`- `, 1000)+"\n", 3*1024/2)),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of empty slices",
+			data:      []byte(`[` + strings.Repeat(`[],`, 3*1024*1024/3-2) + `[]]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of slices",
+			data:      []byte(`[` + strings.Repeat(`[0],`, 3*1024*1024/4-2) + `[0]]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of empty maps",
+			data:      []byte(`[` + strings.Repeat(`{},`, 3*1024*1024/3-2) + `{}]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of maps",
+			data:      []byte(`[` + strings.Repeat(`{a},`, 3*1024*1024/4-2) + `{a}]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of ints",
+			data:      []byte(`[` + strings.Repeat(`0,`, 3*1024*1024/2-2) + `0]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of floats",
+			data:      []byte(`[` + strings.Repeat(`0.0,`, 3*1024*1024/4-2) + `0.0]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of bools",
+			data:      []byte(`[` + strings.Repeat(`true,`, 3*1024*1024/5-2) + `true]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of empty strings",
+			data:      []byte(`[` + strings.Repeat(`"",`, 3*1024*1024/3-2) + `""]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of strings",
+			data:      []byte(`[` + strings.Repeat(`"abcdefghijklmnopqrstuvwxyz012",`, 3*1024*1024/30-2) + `"abcdefghijklmnopqrstuvwxyz012"]`),
+			benchmark: true,
+		},
+		{
+			name:      "3MB of nulls",
+			data:      []byte(`[` + strings.Repeat(`null,`, 3*1024*1024/5-2) + `null]`),
+			benchmark: true,
+		},
+	}
+}
+
+var decoders = map[string]func([]byte) ([]byte, error){
+	"sigsyaml": sigsyaml.YAMLToJSON,
+	"utilyaml": yaml.ToJSON,
+}
+
+func TestYAMLLimits(t *testing.T) {
+	for _, tc := range testcases() {
+		if tc.benchmark {
+			continue
+		}
+		t.Run(tc.name, func(t *testing.T) {
+			for decoderName, decoder := range decoders {
+				t.Run(decoderName, func(t *testing.T) {
+					_, err := decoder(tc.data)
+					if len(tc.error) == 0 {
+						if err != nil {
+							t.Errorf("unexpected error: %v", err)
+						}
+					} else {
+						if err == nil || !strings.Contains(err.Error(), tc.error) {
+							t.Errorf("expected %q error, got %v", tc.error, err)
+						}
+					}
+				})
+			}
+		})
+	}
+}
+
+func BenchmarkYAMLLimits(b *testing.B) {
+	for _, tc := range testcases() {
+		b.Run(tc.name, func(b *testing.B) {
+			for decoderName, decoder := range decoders {
+				b.Run(decoderName, func(b *testing.B) {
+					for i := 0; i < b.N; i++ {
+						_, err := decoder(tc.data)
+						if len(tc.error) == 0 {
+							if err != nil {
+								b.Errorf("unexpected error: %v", err)
+							}
+						} else {
+							if err == nil || !strings.Contains(err.Error(), tc.error) {
+								b.Errorf("expected %q error, got %v", tc.error, err)
+							}
+						}
+					}
+				})
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/splice.go b/third_party/k8s.io/apimachinery/pkg/runtime/splice.go
new file mode 100644
index 0000000000..2badb7b97f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/splice.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"io"
+)
+
+// Splice is the interface that wraps the Splice method.
+//
+// Splice moves data from given slice without copying the underlying data for
+// efficiency purpose. Therefore, the caller should make sure the underlying
+// data is not changed later.
+type Splice interface {
+	Splice([]byte)
+	io.Writer
+	Reset()
+	Bytes() []byte
+}
+
+// A spliceBuffer implements Splice and io.Writer interfaces.
+type spliceBuffer struct {
+	raw []byte
+	buf *bytes.Buffer
+}
+
+func NewSpliceBuffer() Splice {
+	return &spliceBuffer{}
+}
+
+// Splice implements the Splice interface.
+func (sb *spliceBuffer) Splice(raw []byte) {
+	sb.raw = raw
+}
+
+// Write implements the io.Writer interface.
+func (sb *spliceBuffer) Write(p []byte) (n int, err error) {
+	if sb.buf == nil {
+		sb.buf = &bytes.Buffer{}
+	}
+	return sb.buf.Write(p)
+}
+
+// Reset resets the buffer to be empty.
+func (sb *spliceBuffer) Reset() {
+	if sb.buf != nil {
+		sb.buf.Reset()
+	}
+	sb.raw = nil
+}
+
+// Bytes returns the data held by the buffer.
+func (sb *spliceBuffer) Bytes() []byte {
+	if sb.buf != nil && len(sb.buf.Bytes()) > 0 {
+		return sb.buf.Bytes()
+	}
+	if sb.raw != nil {
+		return sb.raw
+	}
+	return []byte{}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/splice_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/splice_test.go
new file mode 100644
index 0000000000..9d8ca5102d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/splice_test.go
@@ -0,0 +1,121 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime_test
+
+import (
+	"bytes"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func TestSpliceBuffer(t *testing.T) {
+	testBytes0 := []byte{0x01, 0x02, 0x03, 0x04}
+	testBytes1 := []byte{0x04, 0x03, 0x02, 0x02}
+
+	testCases := []struct {
+		name string
+		run  func(sb runtime.Splice, buf *bytes.Buffer)
+	}{
+		{
+			name: "Basic Write",
+			run: func(sb runtime.Splice, buf *bytes.Buffer) {
+				sb.Write(testBytes0)
+				buf.Write(testBytes0)
+			},
+		},
+		{
+			name: "Multiple Writes",
+			run: func(sb runtime.Splice, buf *bytes.Buffer) {
+				for _, b := range testBytes0 {
+					sb.Write([]byte{b})
+					buf.Write([]byte{b})
+				}
+			},
+		},
+		{
+			name: "Write and Reset",
+			run: func(sb runtime.Splice, buf *bytes.Buffer) {
+				sb.Write(testBytes0)
+				buf.Write(testBytes0)
+
+				sb.Reset()
+				buf.Reset()
+			},
+		},
+		{
+			name: "Write/Splice",
+			run: func(sb runtime.Splice, buf *bytes.Buffer) {
+				sb.Splice(testBytes0)
+				buf.Write(testBytes0)
+			},
+		},
+		{
+			name: "Write/Splice and Reset",
+			run: func(sb runtime.Splice, buf *bytes.Buffer) {
+				sb.Splice(testBytes0)
+				buf.Write(testBytes0)
+
+				sb.Reset()
+				buf.Reset()
+			},
+		},
+		{
+			name: "Write/Splice, Reset, Write/Splice",
+			run: func(sb runtime.Splice, buf *bytes.Buffer) {
+				sb.Splice(testBytes0)
+				buf.Write(testBytes0)
+
+				sb.Reset()
+				buf.Reset()
+
+				sb.Splice(testBytes1)
+				buf.Write(testBytes1)
+			},
+		},
+		{
+			name: "Write, Reset, Splice",
+			run: func(sb runtime.Splice, buf *bytes.Buffer) {
+				sb.Write(testBytes0)
+				buf.Write(testBytes0)
+
+				sb.Reset()
+				buf.Reset()
+
+				sb.Splice(testBytes1)
+				buf.Write(testBytes1)
+			},
+		},
+	}
+
+	for _, tt := range testCases {
+		t.Run(tt.name, func(t *testing.T) {
+			sb := runtime.NewSpliceBuffer()
+			buf := &bytes.Buffer{}
+			tt.run(sb, buf)
+
+			if sb.Bytes() == nil {
+				t.Errorf("Unexpected nil")
+			}
+			if string(sb.Bytes()) != string(buf.Bytes()) {
+				t.Errorf("Expected sb.Bytes() == %q, buf.Bytes() == %q", sb.Bytes(), buf.Bytes())
+			}
+		})
+
+	}
+
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator.go b/third_party/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator.go
new file mode 100644
index 0000000000..0d5a3e709d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator.go
@@ -0,0 +1,274 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"fmt"
+	"go/ast"
+	"go/doc"
+	"go/parser"
+	"go/token"
+	"io"
+	"reflect"
+	"strconv"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/errors"
+)
+
+// Pair of strings. We keed the name of fields and the doc
+type Pair struct {
+	Name, Doc string
+}
+
+// KubeTypes is an array to represent all available types in a parsed file. [0] is for the type itself
+type KubeTypes []Pair
+
+func astFrom(filePath string) *doc.Package {
+	fset := token.NewFileSet()
+	m := make(map[string]*ast.File)
+
+	f, err := parser.ParseFile(fset, filePath, nil, parser.ParseComments)
+	if err != nil {
+		fmt.Println(err)
+		return nil
+	}
+
+	m[filePath] = f
+	apkg, _ := ast.NewPackage(fset, m, nil, nil)
+
+	return doc.New(apkg, "", 0)
+}
+
+func fmtRawDoc(rawDoc string) string {
+	var buffer bytes.Buffer
+	delPrevChar := func() {
+		if buffer.Len() > 0 {
+			buffer.Truncate(buffer.Len() - 1) // Delete the last " " or "\n"
+		}
+	}
+
+	// Ignore all lines after ---
+	rawDoc = strings.Split(rawDoc, "---")[0]
+
+	for _, line := range strings.Split(rawDoc, "\n") {
+		line = strings.TrimRight(line, " ")
+		leading := strings.TrimLeft(line, " ")
+		switch {
+		case len(line) == 0: // Keep paragraphs
+			delPrevChar()
+			buffer.WriteString("\n\n")
+		case strings.HasPrefix(leading, "TODO"): // Ignore one line TODOs
+		case strings.HasPrefix(leading, "+"): // Ignore instructions to the generators
+		default:
+			if strings.HasPrefix(line, " ") || strings.HasPrefix(line, "\t") {
+				delPrevChar()
+				line = "\n" + line + "\n" // Replace it with newline. This is useful when we have a line with: "Example:\n\tJSON-someting..."
+			} else {
+				line += " "
+			}
+			buffer.WriteString(line)
+		}
+	}
+
+	postDoc := strings.TrimRight(buffer.String(), "\n")
+	postDoc = strings.Replace(postDoc, "\\\"", "\"", -1) // replace user's \" to "
+	postDoc = strings.Replace(postDoc, "\"", "\\\"", -1) // Escape "
+	postDoc = strings.Replace(postDoc, "\n", "\\n", -1)
+	postDoc = strings.Replace(postDoc, "\t", "\\t", -1)
+
+	return postDoc
+}
+
+// fieldName returns the name of the field as it should appear in JSON format
+// "-" indicates that this field is not part of the JSON representation
+func fieldName(field *ast.Field) (string, error) {
+	jsonTag := ""
+	if field.Tag != nil {
+		var jsonTagExists bool
+		tagValue, err := strconv.Unquote(field.Tag.Value)
+		if err != nil {
+			return "", err
+		}
+		jsonTag, jsonTagExists = reflect.StructTag(tagValue).Lookup("json") // Delete first and last quotation
+		// field is embedded, json tag is declared and has an empty name
+		if field.Names == nil && jsonTagExists && (jsonTag == "" || strings.HasPrefix(jsonTag, ",")) {
+			return "-", nil
+		}
+	}
+
+	jsonTag = strings.Split(jsonTag, ",")[0] // This can return "-"
+	if jsonTag == "" {
+		if field.Names != nil {
+			return field.Names[0].Name, nil
+		}
+		return field.Type.(*ast.Ident).Name, nil
+	}
+	return jsonTag, nil
+}
+
+// A buffer of lines that will be written.
+type bufferedLine struct {
+	line        string
+	indentation int
+}
+
+type buffer struct {
+	lines []bufferedLine
+}
+
+func newBuffer() *buffer {
+	return &buffer{
+		lines: make([]bufferedLine, 0),
+	}
+}
+
+func (b *buffer) addLine(line string, indent int) {
+	b.lines = append(b.lines, bufferedLine{line, indent})
+}
+
+func (b *buffer) flushLines(w io.Writer) error {
+	for _, line := range b.lines {
+		indentation := strings.Repeat("\t", line.indentation)
+		fullLine := fmt.Sprintf("%s%s", indentation, line.line)
+		if _, err := io.WriteString(w, fullLine); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func writeFuncHeader(b *buffer, structName string, indent int) {
+	s := fmt.Sprintf("var map_%s = map[string]string {\n", structName)
+	b.addLine(s, indent)
+}
+
+func writeFuncFooter(b *buffer, structName string, indent int) {
+	b.addLine("}\n", indent) // Closes the map definition
+
+	s := fmt.Sprintf("func (%s) SwaggerDoc() map[string]string {\n", structName)
+	b.addLine(s, indent)
+	s = fmt.Sprintf("return map_%s\n", structName)
+	b.addLine(s, indent+1)
+	b.addLine("}\n", indent) // Closes the function definition
+}
+
+func writeMapBody(b *buffer, kubeType []Pair, indent int) {
+	format := "\"%s\": \"%s\",\n"
+	for _, pair := range kubeType {
+		s := fmt.Sprintf(format, pair.Name, pair.Doc)
+		b.addLine(s, indent+2)
+	}
+}
+
+// ParseDocumentationFrom gets all types' documentation and returns them as an
+// array. Each type is again represented as an array (we have to use arrays as we
+// need to be sure for the order of the fields). This function returns fields and
+// struct definitions that have no documentation as {name, ""}.
+func ParseDocumentationFrom(src string) ([]KubeTypes, error) {
+	var docForTypes []KubeTypes
+	var errs []error
+
+	pkg := astFrom(src)
+
+	for _, kubType := range pkg.Types {
+		if structType, ok := kubType.Decl.Specs[0].(*ast.TypeSpec).Type.(*ast.StructType); ok {
+			var ks KubeTypes
+			ks = append(ks, Pair{kubType.Name, fmtRawDoc(kubType.Doc)})
+
+			for _, field := range structType.Fields.List {
+				if n, err := fieldName(field); err != nil {
+					errs = append(errs, err)
+				} else if n != "-" {
+					fieldDoc := fmtRawDoc(field.Doc.Text())
+					ks = append(ks, Pair{n, fieldDoc})
+				}
+			}
+			docForTypes = append(docForTypes, ks)
+		}
+	}
+
+	return docForTypes, errors.NewAggregate(errs)
+}
+
+// WriteSwaggerDocFunc writes a declaration of a function as a string. This function is used in
+// Swagger as a documentation source for structs and theirs fields
+func WriteSwaggerDocFunc(kubeTypes []KubeTypes, w io.Writer) error {
+	for _, kubeType := range kubeTypes {
+		structName := kubeType[0].Name
+		kubeType[0].Name = ""
+
+		// Ignore empty documentation
+		docfulTypes := make(KubeTypes, 0, len(kubeType))
+		for _, pair := range kubeType {
+			if pair.Doc != "" {
+				docfulTypes = append(docfulTypes, pair)
+			}
+		}
+
+		if len(docfulTypes) == 0 {
+			continue // If no fields and the struct have documentation, skip the function definition
+		}
+
+		indent := 0
+		buffer := newBuffer()
+
+		writeFuncHeader(buffer, structName, indent)
+		writeMapBody(buffer, docfulTypes, indent)
+		writeFuncFooter(buffer, structName, indent)
+		buffer.addLine("\n", 0)
+
+		if err := buffer.flushLines(w); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// VerifySwaggerDocsExist writes in a io.Writer a list of structs and fields that
+// are missing of documentation.
+func VerifySwaggerDocsExist(kubeTypes []KubeTypes, w io.Writer) (int, error) {
+	missingDocs := 0
+	buffer := newBuffer()
+
+	for _, kubeType := range kubeTypes {
+		structName := kubeType[0].Name
+		if kubeType[0].Doc == "" {
+			format := "Missing documentation for the struct itself: %s\n"
+			s := fmt.Sprintf(format, structName)
+			buffer.addLine(s, 0)
+			missingDocs++
+		}
+		kubeType = kubeType[1:] // Skip struct definition
+
+		for _, pair := range kubeType { // Iterate only the fields
+			if pair.Doc == "" {
+				format := "In struct: %s, field documentation is missing: %s\n"
+				s := fmt.Sprintf(format, structName, pair.Name)
+				buffer.addLine(s, 0)
+				missingDocs++
+			}
+		}
+	}
+
+	if err := buffer.flushLines(w); err != nil {
+		return -1, err
+	}
+	return missingDocs, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator_test.go
new file mode 100644
index 0000000000..a6f338d311
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator_test.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"testing"
+)
+
+func TestFmtRawDoc(t *testing.T) {
+	tests := []struct {
+		t, expected string
+	}{
+		{"aaa\n  --- asd\n TODO: tooooodo\n toooodoooooo\n", "aaa"},
+		{"aaa\nasd\n TODO: tooooodo\nbbbb\n --- toooodoooooo\n", "aaa asd bbbb"},
+		{" TODO: tooooodo\n", ""},
+		{"Par1\n\nPar2\n\n", "Par1\\n\\nPar2"},
+		{"", ""},
+		{" ", ""},
+		{" \n", ""},
+		{" \n\n ", ""},
+		{"Example:\n\tl1\n\t\tl2\n", "Example:\\n\\tl1\\n\\t\\tl2"},
+	}
+
+	for _, test := range tests {
+		if o := fmtRawDoc(test.t); o != test.expected {
+			t.Fatalf("Expected: %q, got %q", test.expected, o)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/testing/cacheable_object.go b/third_party/k8s.io/apimachinery/pkg/runtime/testing/cacheable_object.go
new file mode 100644
index 0000000000..04c9dc8e08
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/testing/cacheable_object.go
@@ -0,0 +1,220 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// nonCacheableTestObject implements json.Marshaler and proto.Marshaler interfaces
+// for mocking purpose.
+// +k8s:deepcopy-gen=false
+type noncacheableTestObject struct {
+	gvk schema.GroupVersionKind
+}
+
+// MarshalJSON implements json.Marshaler interface.
+func (*noncacheableTestObject) MarshalJSON() ([]byte, error) {
+	return []byte("\"json-result\""), nil
+}
+
+// Marshal implements proto.Marshaler interface.
+func (*noncacheableTestObject) Marshal() ([]byte, error) {
+	return []byte("\"proto-result\""), nil
+}
+
+// DeepCopyObject implements runtime.Object interface.
+func (*noncacheableTestObject) DeepCopyObject() runtime.Object {
+	panic("DeepCopy unimplemented for noncacheableTestObject")
+}
+
+// GetObjectKind implements runtime.Object interface.
+func (o *noncacheableTestObject) GetObjectKind() schema.ObjectKind {
+	return o
+}
+
+// GroupVersionKind implements schema.ObjectKind interface.
+func (o *noncacheableTestObject) GroupVersionKind() schema.GroupVersionKind {
+	return o.gvk
+}
+
+// SetGroupVersionKind implements schema.ObjectKind interface.
+func (o *noncacheableTestObject) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	o.gvk = gvk
+}
+
+var _ runtime.CacheableObject = &MockCacheableObject{}
+
+// MochCacheableObject is used to test CacheableObject interface.
+// +k8s:deepcopy-gen=false
+type MockCacheableObject struct {
+	gvk schema.GroupVersionKind
+
+	t *testing.T
+
+	runEncode      bool
+	returnSelf     bool
+	expectedResult string
+	expectedError  error
+
+	intercepted []runtime.Identifier
+}
+
+// DeepCopyObject implements runtime.Object interface.
+func (m *MockCacheableObject) DeepCopyObject() runtime.Object {
+	panic("DeepCopy unimplemented for MockCacheableObject")
+}
+
+// GetObjectKind implements runtime.Object interface.
+func (m *MockCacheableObject) GetObjectKind() schema.ObjectKind {
+	return m
+}
+
+// GroupVersionKind implements schema.ObjectKind interface.
+func (m *MockCacheableObject) GroupVersionKind() schema.GroupVersionKind {
+	return m.gvk
+}
+
+// SetGroupVersionKind implements schema.ObjectKind interface.
+func (m *MockCacheableObject) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	m.gvk = gvk
+}
+
+// Marshal implements proto.Marshaler interface.
+// This is implemented to avoid errors from protobuf serializer.
+func (*MockCacheableObject) Marshal() ([]byte, error) {
+	return []byte("\"proto-result\""), nil
+}
+
+// CacheEncode implements runtime.CacheableObject interface.
+func (m *MockCacheableObject) CacheEncode(id runtime.Identifier, encode func(runtime.Object, io.Writer) error, w io.Writer) error {
+	m.intercepted = append(m.intercepted, id)
+	if m.runEncode {
+		return encode(m.GetObject(), w)
+	}
+	if _, err := w.Write([]byte(m.expectedResult)); err != nil {
+		m.t.Errorf("couldn't write to io.Writer: %v", err)
+	}
+	return m.expectedError
+}
+
+// GetObject implements runtime.CacheableObject interface.
+func (m *MockCacheableObject) GetObject() runtime.Object {
+	if m.returnSelf {
+		return m
+	}
+	gvk := schema.GroupVersionKind{Group: "group", Version: "version", Kind: "noncacheableTestObject"}
+	return &noncacheableTestObject{gvk: gvk}
+}
+
+func (m *MockCacheableObject) interceptedCalls() []runtime.Identifier {
+	return m.intercepted
+}
+
+type testBuffer struct {
+	writer io.Writer
+	t      *testing.T
+	object *MockCacheableObject
+}
+
+// Write implements io.Writer interface.
+func (b *testBuffer) Write(p []byte) (int, error) {
+	// Before writing any byte, check if <object> has already
+	// intercepted any CacheEncode operation.
+	if len(b.object.interceptedCalls()) == 0 {
+		b.t.Errorf("writing to buffer without handling MockCacheableObject")
+	}
+	return b.writer.Write(p)
+}
+
+// CacheableObjectTest implements a test that should be run for every
+// runtime.Encoder interface implementation.
+// It checks whether CacheableObject is properly supported by it.
+func CacheableObjectTest(t *testing.T, e runtime.Encoder) {
+	gvk1 := schema.GroupVersionKind{Group: "group", Version: "version1", Kind: "MockCacheableObject"}
+
+	testCases := []struct {
+		desc           string
+		runEncode      bool
+		returnSelf     bool
+		expectedResult string
+		expectedError  error
+	}{
+		{
+			desc:      "delegate",
+			runEncode: true,
+		},
+		{
+			desc:       "delegate return self",
+			runEncode:  true,
+			returnSelf: true,
+		},
+		{
+			desc:           "cached success",
+			runEncode:      false,
+			expectedResult: "result",
+			expectedError:  nil,
+		},
+		{
+			desc:           "cached failure",
+			runEncode:      false,
+			expectedResult: "",
+			expectedError:  fmt.Errorf("encoding error"),
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			obj := &MockCacheableObject{
+				gvk:            gvk1,
+				t:              t,
+				runEncode:      test.runEncode,
+				returnSelf:     test.returnSelf,
+				expectedResult: test.expectedResult,
+				expectedError:  test.expectedError,
+			}
+			buffer := bytes.NewBuffer(nil)
+			w := &testBuffer{
+				writer: buffer,
+				t:      t,
+				object: obj,
+			}
+
+			if err := e.Encode(obj, w); err != test.expectedError {
+				t.Errorf("unexpected error: %v, expected: %v", err, test.expectedError)
+			}
+			if !test.runEncode {
+				if result := buffer.String(); result != test.expectedResult {
+					t.Errorf("unexpected result: %s, expected: %s", result, test.expectedResult)
+				}
+			}
+			intercepted := obj.interceptedCalls()
+			if len(intercepted) != 1 {
+				t.Fatalf("unexpected number of intercepted calls: %v", intercepted)
+			}
+			if intercepted[0] != e.Identifier() {
+				t.Errorf("unexpected intercepted call: %v, expected: %v", intercepted, e.Identifier())
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/testing/conversion.go b/third_party/k8s.io/apimachinery/pkg/runtime/testing/conversion.go
new file mode 100644
index 0000000000..384929b17c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/testing/conversion.go
@@ -0,0 +1,300 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func convertEmbeddedTestToEmbeddedTestExternal(in *EmbeddedTest, out *EmbeddedTestExternal, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.ID = in.ID
+	if err := runtime.Convert_runtime_Object_To_runtime_RawExtension(&in.Object, &out.Object, s); err != nil {
+		return err
+	}
+	if err := runtime.Convert_runtime_Object_To_runtime_RawExtension(&in.EmptyObject, &out.EmptyObject, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+func convertEmbeddedTestExternalToEmbeddedTest(in *EmbeddedTestExternal, out *EmbeddedTest, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.ID = in.ID
+	if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&in.Object, &out.Object, s); err != nil {
+		return err
+	}
+	if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&in.EmptyObject, &out.EmptyObject, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+func convertObjectTestToObjectTestExternal(in *ObjectTest, out *ObjectTestExternal, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.ID = in.ID
+	if in.Items != nil {
+		out.Items = make([]runtime.RawExtension, len(in.Items))
+		for i := range in.Items {
+			if err := runtime.Convert_runtime_Object_To_runtime_RawExtension(&in.Items[i], &out.Items[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
+	return nil
+}
+
+func convertObjectTestExternalToObjectTest(in *ObjectTestExternal, out *ObjectTest, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.ID = in.ID
+	if in.Items != nil {
+		out.Items = make([]runtime.Object, len(in.Items))
+		for i := range in.Items {
+			if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&in.Items[i], &out.Items[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
+	return nil
+}
+
+func convertInternalSimpleToExternalSimple(in *InternalSimple, out *ExternalSimple, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.TestString = in.TestString
+	return nil
+}
+
+func convertExternalSimpleToInternalSimple(in *ExternalSimple, out *InternalSimple, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	out.TestString = in.TestString
+	return nil
+}
+
+func convertInternalExtensionTypeToExternalExtensionType(in *InternalExtensionType, out *ExternalExtensionType, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	if err := runtime.Convert_runtime_Object_To_runtime_RawExtension(&in.Extension, &out.Extension, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+func convertExternalExtensionTypeToInternalExtensionType(in *ExternalExtensionType, out *InternalExtensionType, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&in.Extension, &out.Extension, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+func convertInternalOptionalExtensionTypeToExternalOptionalExtensionType(in *InternalOptionalExtensionType, out *ExternalOptionalExtensionType, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	if err := runtime.Convert_runtime_Object_To_runtime_RawExtension(&in.Extension, &out.Extension, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+func convertExternalOptionalExtensionTypeToInternalOptionalExtensionType(in *ExternalOptionalExtensionType, out *InternalOptionalExtensionType, s conversion.Scope) error {
+	out.TypeMeta = in.TypeMeta
+	if err := runtime.Convert_runtime_RawExtension_To_runtime_Object(&in.Extension, &out.Extension, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+func convertTestType1ToExternalTestType1(in *TestType1, out *ExternalTestType1, s conversion.Scope) error {
+	out.MyWeirdCustomEmbeddedVersionKindField = in.MyWeirdCustomEmbeddedVersionKindField
+	out.A = in.A
+	out.B = in.B
+	out.C = in.C
+	out.D = in.D
+	out.E = in.E
+	out.F = in.F
+	out.G = in.G
+	out.H = in.H
+	out.I = in.I
+	out.J = in.J
+	out.K = in.K
+	out.L = in.L
+	out.M = in.M
+	if in.N != nil {
+		out.N = make(map[string]ExternalTestType2)
+		for key := range in.N {
+			in, tmp := in.N[key], ExternalTestType2{}
+			if err := convertTestType2ToExternalTestType2(&in, &tmp, s); err != nil {
+				return err
+			}
+			out.N[key] = tmp
+		}
+	} else {
+		out.N = nil
+	}
+	if in.O != nil {
+		out.O = new(ExternalTestType2)
+		if err := convertTestType2ToExternalTestType2(in.O, out.O, s); err != nil {
+			return err
+		}
+	} else {
+		out.O = nil
+	}
+	if in.P != nil {
+		out.P = make([]ExternalTestType2, len(in.P))
+		for i := range in.P {
+			if err := convertTestType2ToExternalTestType2(&in.P[i], &out.P[i], s); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func convertExternalTestType1ToTestType1(in *ExternalTestType1, out *TestType1, s conversion.Scope) error {
+	out.MyWeirdCustomEmbeddedVersionKindField = in.MyWeirdCustomEmbeddedVersionKindField
+	out.A = in.A
+	out.B = in.B
+	out.C = in.C
+	out.D = in.D
+	out.E = in.E
+	out.F = in.F
+	out.G = in.G
+	out.H = in.H
+	out.I = in.I
+	out.J = in.J
+	out.K = in.K
+	out.L = in.L
+	out.M = in.M
+	if in.N != nil {
+		out.N = make(map[string]TestType2)
+		for key := range in.N {
+			in, tmp := in.N[key], TestType2{}
+			if err := convertExternalTestType2ToTestType2(&in, &tmp, s); err != nil {
+				return err
+			}
+			out.N[key] = tmp
+		}
+	} else {
+		out.N = nil
+	}
+	if in.O != nil {
+		out.O = new(TestType2)
+		if err := convertExternalTestType2ToTestType2(in.O, out.O, s); err != nil {
+			return err
+		}
+	} else {
+		out.O = nil
+	}
+	if in.P != nil {
+		out.P = make([]TestType2, len(in.P))
+		for i := range in.P {
+			if err := convertExternalTestType2ToTestType2(&in.P[i], &out.P[i], s); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func convertTestType2ToExternalTestType2(in *TestType2, out *ExternalTestType2, s conversion.Scope) error {
+	out.A = in.A
+	out.B = in.B
+	return nil
+}
+
+func convertExternalTestType2ToTestType2(in *ExternalTestType2, out *TestType2, s conversion.Scope) error {
+	out.A = in.A
+	out.B = in.B
+	return nil
+}
+
+func RegisterConversions(s *runtime.Scheme) error {
+	if err := s.AddConversionFunc((*EmbeddedTest)(nil), (*EmbeddedTestExternal)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertEmbeddedTestToEmbeddedTestExternal(a.(*EmbeddedTest), b.(*EmbeddedTestExternal), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*EmbeddedTestExternal)(nil), (*EmbeddedTest)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertEmbeddedTestExternalToEmbeddedTest(a.(*EmbeddedTestExternal), b.(*EmbeddedTest), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ObjectTest)(nil), (*ObjectTestExternal)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertObjectTestToObjectTestExternal(a.(*ObjectTest), b.(*ObjectTestExternal), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ObjectTestExternal)(nil), (*ObjectTest)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertObjectTestExternalToObjectTest(a.(*ObjectTestExternal), b.(*ObjectTest), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*InternalSimple)(nil), (*ExternalSimple)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertInternalSimpleToExternalSimple(a.(*InternalSimple), b.(*ExternalSimple), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ExternalSimple)(nil), (*InternalSimple)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertExternalSimpleToInternalSimple(a.(*ExternalSimple), b.(*InternalSimple), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*InternalExtensionType)(nil), (*ExternalExtensionType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertInternalExtensionTypeToExternalExtensionType(a.(*InternalExtensionType), b.(*ExternalExtensionType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ExternalExtensionType)(nil), (*InternalExtensionType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertExternalExtensionTypeToInternalExtensionType(a.(*ExternalExtensionType), b.(*InternalExtensionType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*InternalOptionalExtensionType)(nil), (*ExternalOptionalExtensionType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertInternalOptionalExtensionTypeToExternalOptionalExtensionType(a.(*InternalOptionalExtensionType), b.(*ExternalOptionalExtensionType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ExternalOptionalExtensionType)(nil), (*InternalOptionalExtensionType)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertExternalOptionalExtensionTypeToInternalOptionalExtensionType(a.(*ExternalOptionalExtensionType), b.(*InternalOptionalExtensionType), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*TestType1)(nil), (*ExternalTestType1)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertTestType1ToExternalTestType1(a.(*TestType1), b.(*ExternalTestType1), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ExternalTestType1)(nil), (*TestType1)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertExternalTestType1ToTestType1(a.(*ExternalTestType1), b.(*TestType1), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*TestType2)(nil), (*ExternalTestType2)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertTestType2ToExternalTestType2(a.(*TestType2), b.(*ExternalTestType2), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddConversionFunc((*ExternalTestType2)(nil), (*TestType2)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return convertExternalTestType2ToTestType2(a.(*ExternalTestType2), b.(*TestType2), scope)
+	}); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/testing/doc.go b/third_party/k8s.io/apimachinery/pkg/runtime/testing/doc.go
new file mode 100644
index 0000000000..a490327854
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/testing/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+
+package testing
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/testing/types.go b/third_party/k8s.io/apimachinery/pkg/runtime/testing/types.go
new file mode 100644
index 0000000000..82abf13982
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/testing/types.go
@@ -0,0 +1,336 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/json"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type EmbeddedTest struct {
+	runtime.TypeMeta
+	ID          string
+	Object      runtime.Object
+	EmptyObject runtime.Object
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type EmbeddedTestExternal struct {
+	runtime.TypeMeta `json:""`
+	ID               string               `json:"id,omitempty"`
+	Object           runtime.RawExtension `json:"object,omitempty"`
+	EmptyObject      runtime.RawExtension `json:"emptyObject,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ObjectTest struct {
+	runtime.TypeMeta
+
+	ID    string
+	Items []runtime.Object
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ObjectTestExternal struct {
+	runtime.TypeMeta `yaml:",inline" json:""`
+
+	ID    string                 `json:"id,omitempty"`
+	Items []runtime.RawExtension `json:"items,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type InternalSimple struct {
+	runtime.TypeMeta `json:""`
+	TestString       string `json:"testString"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalSimple struct {
+	runtime.TypeMeta `json:""`
+	TestString       string `json:"testString"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExtensionA struct {
+	runtime.TypeMeta `json:""`
+	TestString       string `json:"testString"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExtensionB struct {
+	runtime.TypeMeta `json:""`
+	TestString       string `json:"testString"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalExtensionType struct {
+	runtime.TypeMeta `json:""`
+	Extension        runtime.RawExtension `json:"extension"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type InternalExtensionType struct {
+	runtime.TypeMeta `json:""`
+	Extension        runtime.Object `json:"extension"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalOptionalExtensionType struct {
+	runtime.TypeMeta `json:""`
+	Extension        runtime.RawExtension `json:"extension,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type InternalOptionalExtensionType struct {
+	runtime.TypeMeta `json:""`
+	Extension        runtime.Object `json:"extension,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type InternalComplex struct {
+	runtime.TypeMeta
+	String    string
+	Integer   int
+	Integer64 int64
+	Int64     int64
+	Bool      bool
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalComplex struct {
+	runtime.TypeMeta `json:""`
+	String           string `json:"string" description:"testing"`
+	Integer          int    `json:"int"`
+	Integer64        int64  `json:",omitempty"`
+	Int64            int64
+	Bool             bool `json:"bool"`
+}
+
+// Test a weird version/kind embedding format.
+// +k8s:deepcopy-gen=false
+type MyWeirdCustomEmbeddedVersionKindField struct {
+	ID         string `json:"ID,omitempty"`
+	APIVersion string `json:"myVersionKey,omitempty"`
+	ObjectKind string `json:"myKindKey,omitempty"`
+	Z          string `json:"Z,omitempty"`
+	Y          uint64 `json:"Y,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type TestType1 struct {
+	MyWeirdCustomEmbeddedVersionKindField `json:""`
+	A                                     string               `json:"A,omitempty"`
+	B                                     int                  `json:"B,omitempty"`
+	C                                     int8                 `json:"C,omitempty"`
+	D                                     int16                `json:"D,omitempty"`
+	E                                     int32                `json:"E,omitempty"`
+	F                                     int64                `json:"F,omitempty"`
+	G                                     uint                 `json:"G,omitempty"`
+	H                                     uint8                `json:"H,omitempty"`
+	I                                     uint16               `json:"I,omitempty"`
+	J                                     uint32               `json:"J,omitempty"`
+	K                                     uint64               `json:"K,omitempty"`
+	L                                     bool                 `json:"L,omitempty"`
+	M                                     map[string]int       `json:"M,omitempty"`
+	N                                     map[string]TestType2 `json:"N,omitempty"`
+	O                                     *TestType2           `json:"O,omitempty"`
+	P                                     []TestType2          `json:"Q,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type TestType2 struct {
+	A string `json:"A,omitempty"`
+	B int    `json:"B,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalTestType2 struct {
+	A string `json:"A,omitempty"`
+	B int    `json:"B,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalTestType1 struct {
+	MyWeirdCustomEmbeddedVersionKindField `json:""`
+	A                                     string                       `json:"A,omitempty"`
+	B                                     int                          `json:"B,omitempty"`
+	C                                     int8                         `json:"C,omitempty"`
+	D                                     int16                        `json:"D,omitempty"`
+	E                                     int32                        `json:"E,omitempty"`
+	F                                     int64                        `json:"F,omitempty"`
+	G                                     uint                         `json:"G,omitempty"`
+	H                                     uint8                        `json:"H,omitempty"`
+	I                                     uint16                       `json:"I,omitempty"`
+	J                                     uint32                       `json:"J,omitempty"`
+	K                                     uint64                       `json:"K,omitempty"`
+	L                                     bool                         `json:"L,omitempty"`
+	M                                     map[string]int               `json:"M,omitempty"`
+	N                                     map[string]ExternalTestType2 `json:"N,omitempty"`
+	O                                     *ExternalTestType2           `json:"O,omitempty"`
+	P                                     []ExternalTestType2          `json:"Q,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalInternalSame struct {
+	MyWeirdCustomEmbeddedVersionKindField `json:""`
+	A                                     TestType2 `json:"A,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type UnversionedType struct {
+	MyWeirdCustomEmbeddedVersionKindField `json:""`
+	A                                     string `json:"A,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type UnknownType struct {
+	MyWeirdCustomEmbeddedVersionKindField `json:""`
+	A                                     string `json:"A,omitempty"`
+}
+
+func (obj *MyWeirdCustomEmbeddedVersionKindField) GetObjectKind() schema.ObjectKind { return obj }
+func (obj *MyWeirdCustomEmbeddedVersionKindField) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	obj.APIVersion, obj.ObjectKind = gvk.ToAPIVersionAndKind()
+}
+func (obj *MyWeirdCustomEmbeddedVersionKindField) GroupVersionKind() schema.GroupVersionKind {
+	return schema.FromAPIVersionAndKind(obj.APIVersion, obj.ObjectKind)
+}
+
+func (obj *TestType2) GetObjectKind() schema.ObjectKind         { return schema.EmptyObjectKind }
+func (obj *ExternalTestType2) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+// +k8s:deepcopy-gen=false
+type Unstructured struct {
+	// Object is a JSON compatible map with string, float, int, bool, []interface{}, or
+	// map[string]interface{}
+	// children.
+	Object map[string]interface{}
+}
+
+var _ runtime.Unstructured = &Unstructured{}
+
+func (obj *Unstructured) GetObjectKind() schema.ObjectKind { return obj }
+
+func (obj *Unstructured) IsList() bool {
+	if obj.Object != nil {
+		_, ok := obj.Object["items"]
+		return ok
+	}
+	return false
+}
+
+func (obj *Unstructured) EachListItem(fn func(runtime.Object) error) error {
+	if obj.Object == nil {
+		return fmt.Errorf("content is not a list")
+	}
+	field, ok := obj.Object["items"]
+	if !ok {
+		return fmt.Errorf("content is not a list")
+	}
+	items, ok := field.([]interface{})
+	if !ok {
+		return nil
+	}
+	for _, item := range items {
+		child, ok := item.(map[string]interface{})
+		if !ok {
+			return fmt.Errorf("items member is not an object")
+		}
+		if err := fn(&Unstructured{Object: child}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (obj *Unstructured) EachListItemWithAlloc(fn func(runtime.Object) error) error {
+	// EachListItem has allocated a new Object for the user, we can use it directly.
+	return obj.EachListItem(fn)
+}
+
+func (obj *Unstructured) NewEmptyInstance() runtime.Unstructured {
+	out := new(Unstructured)
+	if obj != nil {
+		out.SetGroupVersionKind(obj.GroupVersionKind())
+	}
+	return out
+}
+
+func (obj *Unstructured) UnstructuredContent() map[string]interface{} {
+	if obj.Object == nil {
+		return make(map[string]interface{})
+	}
+	return obj.Object
+}
+
+func (obj *Unstructured) SetUnstructuredContent(content map[string]interface{}) {
+	obj.Object = content
+}
+
+// MarshalJSON ensures that the unstructured object produces proper
+// JSON when passed to Go's standard JSON library.
+func (u *Unstructured) MarshalJSON() ([]byte, error) {
+	return json.Marshal(u.Object)
+}
+
+// UnmarshalJSON ensures that the unstructured object properly decodes
+// JSON when passed to Go's standard JSON library.
+func (u *Unstructured) UnmarshalJSON(b []byte) error {
+	return json.Unmarshal(b, &u.Object)
+}
+
+func (in *Unstructured) DeepCopyObject() runtime.Object {
+	return in.DeepCopy()
+}
+
+func (in *Unstructured) DeepCopy() *Unstructured {
+	if in == nil {
+		return nil
+	}
+	out := new(Unstructured)
+	*out = *in
+	out.Object = runtime.DeepCopyJSON(in.Object)
+	return out
+}
+
+func (u *Unstructured) GroupVersionKind() schema.GroupVersionKind {
+	apiVersion, ok := u.Object["apiVersion"].(string)
+	if !ok {
+		return schema.GroupVersionKind{}
+	}
+	gv, err := schema.ParseGroupVersion(apiVersion)
+	if err != nil {
+		return schema.GroupVersionKind{}
+	}
+	kind, ok := u.Object["kind"].(string)
+	if ok {
+		return gv.WithKind(kind)
+	}
+	return schema.GroupVersionKind{}
+}
+
+func (u *Unstructured) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	if u.Object == nil {
+		u.Object = make(map[string]interface{})
+	}
+	u.Object["apiVersion"] = gvk.GroupVersion().String()
+	u.Object["kind"] = gvk.Kind
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/doc.go b/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/doc.go
new file mode 100644
index 0000000000..229ce237de
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+
+package v1
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/types.go b/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/types.go
new file mode 100644
index 0000000000..a6c5fef30f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/types.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ExternalSimple struct {
+	runtime.TypeMeta `json:""`
+	TestString       string `json:"testString"`
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/zz_generated.deepcopy.go b/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..29f1f7a0a8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/zz_generated.deepcopy.go
@@ -0,0 +1,51 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalSimple) DeepCopyInto(out *ExternalSimple) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalSimple.
+func (in *ExternalSimple) DeepCopy() *ExternalSimple {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalSimple)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalSimple) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/zz_generated.model_name.go b/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/zz_generated.model_name.go
new file mode 100644
index 0000000000..c68af71298
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/testing/v1/zz_generated.model_name.go
@@ -0,0 +1,27 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package v1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ExternalSimple) OpenAPIModelName() string {
+	return "io.k8s.api.testing.v1.ExternalSimple"
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/testing/validation.go b/third_party/k8s.io/apimachinery/pkg/runtime/testing/validation.go
new file mode 100644
index 0000000000..bbdfc296cc
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/testing/validation.go
@@ -0,0 +1,126 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"context"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+type VersionValidationRunner func(t *testing.T, gv string, versionValidationErrors field.ErrorList)
+
+// RunValidationForEachVersion runs f as a subtest of t for each version of the given unversioned object.
+// Each subtest is named by GroupVersionKind.  Each call to f is provided the field.ErrorList results
+// of converting the unversioned object to a version and validating it.
+//
+// Only autogenerated validation is run. To test both handwritten and autogenerated validation:
+//
+//		RunValidationForEachVersion(t, testCase.pod, func(t *testing.T, versionValidationErrors field.ErrorList) {
+//		  errs := ValidatePod(testCase.obj) // hand written validation
+//	      errs = append(errs, versionValidationErrors...) // generated declarative validation
+//		  // Validate that the errors are what was expected for this test case.
+//		})
+func RunValidationForEachVersion(t *testing.T, scheme *runtime.Scheme, options map[string]bool, unversioned runtime.Object, fn VersionValidationRunner, ignoreConversionErrors bool, subresources ...string) {
+	runValidation(t, scheme, options, unversioned, fn, ignoreConversionErrors, subresources...)
+}
+
+// RunUpdateValidationForEachVersion is like RunValidationForEachVersion but for update validation.
+func RunUpdateValidationForEachVersion(t *testing.T, scheme *runtime.Scheme, options map[string]bool, unversioned, unversionedOld runtime.Object, fn VersionValidationRunner, ignoreConversionErrors bool, subresources ...string) {
+	runUpdateValidation(t, scheme, options, unversioned, unversionedOld, fn, ignoreConversionErrors, subresources...)
+}
+
+func runValidation(t *testing.T, scheme *runtime.Scheme, options map[string]bool, unversioned runtime.Object, fn VersionValidationRunner, ignoreConversionErrors bool, subresources ...string) {
+	unversionedGVKs, _, err := scheme.ObjectKinds(unversioned)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, unversionedGVK := range unversionedGVKs {
+		// skip if passed in unversioned object is not internal.
+		if unversionedGVK.Version != runtime.APIVersionInternal {
+			continue
+		}
+		gvs := scheme.VersionsForGroupKind(unversionedGVK.GroupKind())
+		for _, gv := range gvs {
+			gvk := gv.WithKind(unversionedGVK.Kind)
+			t.Run(gvk.String(), func(t *testing.T) {
+				if gvk.Version != runtime.APIVersionInternal { // skip internal
+					versioned, err := scheme.New(gvk)
+					if err != nil {
+						t.Fatal(err)
+					}
+					err = scheme.Convert(unversioned, versioned, nil)
+					if ignoreConversionErrors && err != nil {
+						t.Skipf("Failed to convert object from internal type to %s: %v", gvk.Version, err)
+					} else if err != nil {
+						t.Fatal(err)
+					}
+					fn(t, gv.String(), scheme.Validate(context.Background(), options, versioned, subresources...))
+				}
+			})
+		}
+	}
+}
+
+func runUpdateValidation(t *testing.T, scheme *runtime.Scheme, options map[string]bool, unversionedNew, unversionedOld runtime.Object, fn VersionValidationRunner, ignoreConversionErrors bool, subresources ...string) {
+	unversionedGVKs, _, err := scheme.ObjectKinds(unversionedNew)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, unversionedGVK := range unversionedGVKs {
+		// skip if passed in unversioned object is not internal.
+		if unversionedGVK.Version != runtime.APIVersionInternal {
+			continue
+		}
+		gvs := scheme.VersionsForGroupKind(unversionedGVK.GroupKind())
+		for _, gv := range gvs {
+			gvk := gv.WithKind(unversionedGVK.Kind)
+			t.Run(gvk.String(), func(t *testing.T) {
+				if gvk.Version != runtime.APIVersionInternal { // skip internal
+					versionedNew, err := scheme.New(gvk)
+					if err != nil {
+						t.Fatal(err)
+					}
+					err = scheme.Convert(unversionedNew, versionedNew, nil)
+					if ignoreConversionErrors && err != nil {
+						t.Skipf("Failed to convert object from internal type to %s: %v", gvk.Version, err)
+					} else if err != nil {
+						t.Fatal(err)
+					}
+					var versionedOld runtime.Object
+					if unversionedOld != nil {
+						versionedOld, err = scheme.New(gvk)
+						if err != nil {
+							t.Fatal(err)
+						}
+
+						err = scheme.Convert(unversionedOld, versionedOld, nil)
+						if ignoreConversionErrors && err != nil {
+							t.Skipf("Failed to convert object from internal type to %s: %v", gvk.Version, err)
+						} else if err != nil {
+							t.Fatal(err)
+						}
+					}
+
+					fn(t, gv.String(), scheme.ValidateUpdate(context.Background(), options, versionedNew, versionedOld, subresources...))
+				}
+			})
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/testing/zz_generated.deepcopy.go b/third_party/k8s.io/apimachinery/pkg/runtime/testing/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..c0d4419575
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/testing/zz_generated.deepcopy.go
@@ -0,0 +1,630 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package testing
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EmbeddedTest) DeepCopyInto(out *EmbeddedTest) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Object != nil {
+		out.Object = in.Object.DeepCopyObject()
+	}
+	if in.EmptyObject != nil {
+		out.EmptyObject = in.EmptyObject.DeepCopyObject()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EmbeddedTest.
+func (in *EmbeddedTest) DeepCopy() *EmbeddedTest {
+	if in == nil {
+		return nil
+	}
+	out := new(EmbeddedTest)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *EmbeddedTest) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EmbeddedTestExternal) DeepCopyInto(out *EmbeddedTestExternal) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.Object.DeepCopyInto(&out.Object)
+	in.EmptyObject.DeepCopyInto(&out.EmptyObject)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EmbeddedTestExternal.
+func (in *EmbeddedTestExternal) DeepCopy() *EmbeddedTestExternal {
+	if in == nil {
+		return nil
+	}
+	out := new(EmbeddedTestExternal)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *EmbeddedTestExternal) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExtensionA) DeepCopyInto(out *ExtensionA) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtensionA.
+func (in *ExtensionA) DeepCopy() *ExtensionA {
+	if in == nil {
+		return nil
+	}
+	out := new(ExtensionA)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExtensionA) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExtensionB) DeepCopyInto(out *ExtensionB) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtensionB.
+func (in *ExtensionB) DeepCopy() *ExtensionB {
+	if in == nil {
+		return nil
+	}
+	out := new(ExtensionB)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExtensionB) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalComplex) DeepCopyInto(out *ExternalComplex) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalComplex.
+func (in *ExternalComplex) DeepCopy() *ExternalComplex {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalComplex)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalComplex) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalExtensionType) DeepCopyInto(out *ExternalExtensionType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.Extension.DeepCopyInto(&out.Extension)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalExtensionType.
+func (in *ExternalExtensionType) DeepCopy() *ExternalExtensionType {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalExtensionType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalExtensionType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalInternalSame) DeepCopyInto(out *ExternalInternalSame) {
+	*out = *in
+	out.MyWeirdCustomEmbeddedVersionKindField = in.MyWeirdCustomEmbeddedVersionKindField
+	out.A = in.A
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalInternalSame.
+func (in *ExternalInternalSame) DeepCopy() *ExternalInternalSame {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalInternalSame)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalInternalSame) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalOptionalExtensionType) DeepCopyInto(out *ExternalOptionalExtensionType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.Extension.DeepCopyInto(&out.Extension)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalOptionalExtensionType.
+func (in *ExternalOptionalExtensionType) DeepCopy() *ExternalOptionalExtensionType {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalOptionalExtensionType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalOptionalExtensionType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalSimple) DeepCopyInto(out *ExternalSimple) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalSimple.
+func (in *ExternalSimple) DeepCopy() *ExternalSimple {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalSimple)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalSimple) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalTestType1) DeepCopyInto(out *ExternalTestType1) {
+	*out = *in
+	out.MyWeirdCustomEmbeddedVersionKindField = in.MyWeirdCustomEmbeddedVersionKindField
+	if in.M != nil {
+		in, out := &in.M, &out.M
+		*out = make(map[string]int, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.N != nil {
+		in, out := &in.N, &out.N
+		*out = make(map[string]ExternalTestType2, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.O != nil {
+		in, out := &in.O, &out.O
+		*out = new(ExternalTestType2)
+		**out = **in
+	}
+	if in.P != nil {
+		in, out := &in.P, &out.P
+		*out = make([]ExternalTestType2, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalTestType1.
+func (in *ExternalTestType1) DeepCopy() *ExternalTestType1 {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalTestType1)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalTestType1) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExternalTestType2) DeepCopyInto(out *ExternalTestType2) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalTestType2.
+func (in *ExternalTestType2) DeepCopy() *ExternalTestType2 {
+	if in == nil {
+		return nil
+	}
+	out := new(ExternalTestType2)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ExternalTestType2) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InternalComplex) DeepCopyInto(out *InternalComplex) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InternalComplex.
+func (in *InternalComplex) DeepCopy() *InternalComplex {
+	if in == nil {
+		return nil
+	}
+	out := new(InternalComplex)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *InternalComplex) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InternalExtensionType) DeepCopyInto(out *InternalExtensionType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Extension != nil {
+		out.Extension = in.Extension.DeepCopyObject()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InternalExtensionType.
+func (in *InternalExtensionType) DeepCopy() *InternalExtensionType {
+	if in == nil {
+		return nil
+	}
+	out := new(InternalExtensionType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *InternalExtensionType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InternalOptionalExtensionType) DeepCopyInto(out *InternalOptionalExtensionType) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Extension != nil {
+		out.Extension = in.Extension.DeepCopyObject()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InternalOptionalExtensionType.
+func (in *InternalOptionalExtensionType) DeepCopy() *InternalOptionalExtensionType {
+	if in == nil {
+		return nil
+	}
+	out := new(InternalOptionalExtensionType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *InternalOptionalExtensionType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InternalSimple) DeepCopyInto(out *InternalSimple) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InternalSimple.
+func (in *InternalSimple) DeepCopy() *InternalSimple {
+	if in == nil {
+		return nil
+	}
+	out := new(InternalSimple)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *InternalSimple) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ObjectTest) DeepCopyInto(out *ObjectTest) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.Object, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				(*out)[i] = (*in)[i].DeepCopyObject()
+			}
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ObjectTest.
+func (in *ObjectTest) DeepCopy() *ObjectTest {
+	if in == nil {
+		return nil
+	}
+	out := new(ObjectTest)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ObjectTest) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ObjectTestExternal) DeepCopyInto(out *ObjectTestExternal) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.RawExtension, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ObjectTestExternal.
+func (in *ObjectTestExternal) DeepCopy() *ObjectTestExternal {
+	if in == nil {
+		return nil
+	}
+	out := new(ObjectTestExternal)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ObjectTestExternal) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType1) DeepCopyInto(out *TestType1) {
+	*out = *in
+	out.MyWeirdCustomEmbeddedVersionKindField = in.MyWeirdCustomEmbeddedVersionKindField
+	if in.M != nil {
+		in, out := &in.M, &out.M
+		*out = make(map[string]int, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.N != nil {
+		in, out := &in.N, &out.N
+		*out = make(map[string]TestType2, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.O != nil {
+		in, out := &in.O, &out.O
+		*out = new(TestType2)
+		**out = **in
+	}
+	if in.P != nil {
+		in, out := &in.P, &out.P
+		*out = make([]TestType2, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType1.
+func (in *TestType1) DeepCopy() *TestType1 {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType1)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType1) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TestType2) DeepCopyInto(out *TestType2) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TestType2.
+func (in *TestType2) DeepCopy() *TestType2 {
+	if in == nil {
+		return nil
+	}
+	out := new(TestType2)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *TestType2) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UnknownType) DeepCopyInto(out *UnknownType) {
+	*out = *in
+	out.MyWeirdCustomEmbeddedVersionKindField = in.MyWeirdCustomEmbeddedVersionKindField
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UnknownType.
+func (in *UnknownType) DeepCopy() *UnknownType {
+	if in == nil {
+		return nil
+	}
+	out := new(UnknownType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *UnknownType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UnversionedType) DeepCopyInto(out *UnversionedType) {
+	*out = *in
+	out.MyWeirdCustomEmbeddedVersionKindField = in.MyWeirdCustomEmbeddedVersionKindField
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UnversionedType.
+func (in *UnversionedType) DeepCopy() *UnversionedType {
+	if in == nil {
+		return nil
+	}
+	out := new(UnversionedType)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *UnversionedType) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/types.go b/third_party/k8s.io/apimachinery/pkg/runtime/types.go
new file mode 100644
index 0000000000..6cded88997
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/types.go
@@ -0,0 +1,135 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+// Note that the types provided in this file are not versioned and are intended to be
+// safe to use from within all versions of every API object.
+
+// TypeMeta is shared by all top level objects. The proper way to use it is to inline it in your type,
+// like this:
+//
+//	type MyAwesomeAPIObject struct {
+//	     runtime.TypeMeta    `json:""`
+//	     ... // other fields
+//	}
+//
+// func (obj *MyAwesomeAPIObject) SetGroupVersionKind(gvk *metav1.GroupVersionKind) { metav1.UpdateTypeMeta(obj,gvk) }; GroupVersionKind() *GroupVersionKind
+//
+// TypeMeta is provided here for convenience. You may use it directly from this package or define
+// your own with the same fields.
+//
+// +k8s:deepcopy-gen=false
+// +protobuf=true
+// +k8s:openapi-gen=true
+type TypeMeta struct {
+	// +optional
+	APIVersion string `json:"apiVersion,omitempty" yaml:"apiVersion,omitempty" protobuf:"bytes,1,opt,name=apiVersion"`
+	// +optional
+	Kind string `json:"kind,omitempty" yaml:"kind,omitempty" protobuf:"bytes,2,opt,name=kind"`
+}
+
+const (
+	ContentTypeJSON         string = "application/json"
+	ContentTypeYAML         string = "application/yaml"
+	ContentTypeProtobuf     string = "application/vnd.kubernetes.protobuf"
+	ContentTypeCBOR         string = "application/cbor"     // RFC 8949
+	ContentTypeCBORSequence string = "application/cbor-seq" // RFC 8742
+)
+
+// RawExtension is used to hold extensions in external versions.
+//
+// To use this, make a field which has RawExtension as its type in your external, versioned
+// struct, and Object in your internal struct. You also need to register your
+// various plugin types.
+//
+// // Internal package:
+//
+//	type MyAPIObject struct {
+//		runtime.TypeMeta `json:""`
+//		MyPlugin runtime.Object `json:"myPlugin"`
+//	}
+//
+//	type PluginA struct {
+//		AOption string `json:"aOption"`
+//	}
+//
+// // External package:
+//
+//	type MyAPIObject struct {
+//		runtime.TypeMeta `json:""`
+//		MyPlugin runtime.RawExtension `json:"myPlugin"`
+//	}
+//
+//	type PluginA struct {
+//		AOption string `json:"aOption"`
+//	}
+//
+// // On the wire, the JSON will look something like this:
+//
+//	{
+//		"kind":"MyAPIObject",
+//		"apiVersion":"v1",
+//		"myPlugin": {
+//			"kind":"PluginA",
+//			"aOption":"foo",
+//		},
+//	}
+//
+// So what happens? Decode first uses json or yaml to unmarshal the serialized data into
+// your external MyAPIObject. That causes the raw JSON to be stored, but not unpacked.
+// The next step is to copy (using pkg/conversion) into the internal struct. The runtime
+// package's DefaultScheme has conversion functions installed which will unpack the
+// JSON stored in RawExtension, turning it into the correct object type, and storing it
+// in the Object. (TODO: In the case where the object is of an unknown type, a
+// runtime.Unknown object will be created and stored.)
+//
+// +k8s:deepcopy-gen=true
+// +protobuf=true
+// +k8s:openapi-gen=true
+type RawExtension struct {
+	// Raw is the underlying serialization of this object.
+	//
+	// TODO: Determine how to detect ContentType and ContentEncoding of 'Raw' data.
+	Raw []byte `json:"-" protobuf:"bytes,1,opt,name=raw"`
+	// Object can hold a representation of this extension - useful for working with versioned
+	// structs.
+	Object Object `json:"-"`
+}
+
+// Unknown allows api objects with unknown types to be passed-through. This can be used
+// to deal with the API objects from a plug-in. Unknown objects still have functioning
+// TypeMeta features-- kind, version, etc.
+// TODO: Make this object have easy access to field based accessors and settors for
+// metadata and field mutatation.
+//
+// +k8s:deepcopy-gen=true
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +protobuf=true
+// +k8s:openapi-gen=true
+type Unknown struct {
+	TypeMeta `json:"" protobuf:"bytes,1,opt,name=typeMeta"`
+	// Raw will hold the complete serialized object which couldn't be matched
+	// with a registered type. Most likely, nothing should be done with this
+	// except for passing it through the system.
+	Raw []byte `json:"-" protobuf:"bytes,2,opt,name=raw"`
+	// ContentEncoding is encoding used to encode 'Raw' data.
+	// Unspecified means no encoding.
+	ContentEncoding string `protobuf:"bytes,3,opt,name=contentEncoding"`
+	// ContentType  is serialization method used to serialize 'Raw'.
+	// Unspecified means ContentTypeJSON.
+	ContentType string `protobuf:"bytes,4,opt,name=contentType"`
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/types_proto.go b/third_party/k8s.io/apimachinery/pkg/runtime/types_proto.go
new file mode 100644
index 0000000000..70c4ea8c56
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/types_proto.go
@@ -0,0 +1,218 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"fmt"
+	"io"
+)
+
+// ProtobufReverseMarshaller can precompute size, and marshals to the start of the provided data buffer.
+type ProtobufMarshaller interface {
+	// Size returns the number of bytes a call to MarshalTo would consume.
+	Size() int
+	// MarshalTo marshals to the start of the data buffer, which must be at least as big as Size(),
+	// and returns the number of bytes written, which must be identical to the return value of Size().
+	MarshalTo(data []byte) (int, error)
+}
+
+// ProtobufReverseMarshaller can precompute size, and marshals to the end of the provided data buffer.
+type ProtobufReverseMarshaller interface {
+	// Size returns the number of bytes a call to MarshalToSizedBuffer would consume.
+	Size() int
+	// MarshalToSizedBuffer marshals to the end of the data buffer, which must be at least as big as Size(),
+	// and returns the number of bytes written, which must be identical to the return value of Size().
+	MarshalToSizedBuffer(data []byte) (int, error)
+}
+
+const (
+	typeMetaTag        = 0xa
+	rawTag             = 0x12
+	contentEncodingTag = 0x1a
+	contentTypeTag     = 0x22
+
+	// max length of a varint for a uint64
+	maxUint64VarIntLength = 10
+)
+
+// MarshalToWriter allows a caller to provide a streaming writer for raw bytes,
+// instead of populating them inside the Unknown struct.
+// rawSize is the number of bytes rawWriter will write in a success case.
+// writeRaw is called when it is time to write the raw bytes. It must return `rawSize, nil` or an error.
+func (m *Unknown) MarshalToWriter(w io.Writer, rawSize int, writeRaw func(io.Writer) (int, error)) (int, error) {
+	size := 0
+
+	// reuse the buffer for varint marshaling
+	varintBuffer := make([]byte, maxUint64VarIntLength)
+	writeVarint := func(i int) (int, error) {
+		offset := encodeVarintGenerated(varintBuffer, len(varintBuffer), uint64(i))
+		return w.Write(varintBuffer[offset:])
+	}
+
+	// TypeMeta
+	{
+		n, err := w.Write([]byte{typeMetaTag})
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		typeMetaBytes, err := m.TypeMeta.Marshal()
+		if err != nil {
+			return size, err
+		}
+
+		n, err = writeVarint(len(typeMetaBytes))
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		n, err = w.Write(typeMetaBytes)
+		size += n
+		if err != nil {
+			return size, err
+		}
+	}
+
+	// Raw, delegating write to writeRaw()
+	{
+		n, err := w.Write([]byte{rawTag})
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		n, err = writeVarint(rawSize)
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		n, err = writeRaw(w)
+		size += n
+		if err != nil {
+			return size, err
+		}
+		if n != int(rawSize) {
+			return size, fmt.Errorf("the size value was %d, but encoding wrote %d bytes to data", rawSize, n)
+		}
+	}
+
+	// ContentEncoding
+	{
+		n, err := w.Write([]byte{contentEncodingTag})
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		n, err = writeVarint(len(m.ContentEncoding))
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		n, err = w.Write([]byte(m.ContentEncoding))
+		size += n
+		if err != nil {
+			return size, err
+		}
+	}
+
+	// ContentEncoding
+	{
+		n, err := w.Write([]byte{contentTypeTag})
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		n, err = writeVarint(len(m.ContentType))
+		size += n
+		if err != nil {
+			return size, err
+		}
+
+		n, err = w.Write([]byte(m.ContentType))
+		size += n
+		if err != nil {
+			return size, err
+		}
+	}
+	return size, nil
+}
+
+// NestedMarshalTo allows a caller to avoid extra allocations during serialization of an Unknown
+// that will contain an object that implements ProtobufMarshaller or ProtobufReverseMarshaller.
+func (m *Unknown) NestedMarshalTo(data []byte, b ProtobufMarshaller, size uint64) (int, error) {
+	// Calculate the full size of the message.
+	msgSize := m.Size()
+	if b != nil {
+		msgSize += int(size) + sovGenerated(size) + 1
+	}
+
+	// Reverse marshal the fields of m.
+	i := msgSize
+	i -= len(m.ContentType)
+	copy(data[i:], m.ContentType)
+	i = encodeVarintGenerated(data, i, uint64(len(m.ContentType)))
+	i--
+	data[i] = contentTypeTag
+	i -= len(m.ContentEncoding)
+	copy(data[i:], m.ContentEncoding)
+	i = encodeVarintGenerated(data, i, uint64(len(m.ContentEncoding)))
+	i--
+	data[i] = contentEncodingTag
+	if b != nil {
+		if r, ok := b.(ProtobufReverseMarshaller); ok {
+			n1, err := r.MarshalToSizedBuffer(data[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= int(size)
+			if uint64(n1) != size {
+				// programmer error: the Size() method for protobuf does not match the results of LashramOt, which means the proto
+				// struct returned would be wrong.
+				return 0, fmt.Errorf("the Size() value of %T was %d, but NestedMarshalTo wrote %d bytes to data", b, size, n1)
+			}
+		} else {
+			i -= int(size)
+			n1, err := b.MarshalTo(data[i:])
+			if err != nil {
+				return 0, err
+			}
+			if uint64(n1) != size {
+				// programmer error: the Size() method for protobuf does not match the results of MarshalTo, which means the proto
+				// struct returned would be wrong.
+				return 0, fmt.Errorf("the Size() value of %T was %d, but NestedMarshalTo wrote %d bytes to data", b, size, n1)
+			}
+		}
+		i = encodeVarintGenerated(data, i, size)
+		i--
+		data[i] = rawTag
+	}
+	n2, err := m.TypeMeta.MarshalToSizedBuffer(data[:i])
+	if err != nil {
+		return 0, err
+	}
+	i -= n2
+	i = encodeVarintGenerated(data, i, uint64(n2))
+	i--
+	data[i] = typeMetaTag
+	return msgSize - i, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/types_proto_test.go b/third_party/k8s.io/apimachinery/pkg/runtime/types_proto_test.go
new file mode 100644
index 0000000000..50535f0417
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/types_proto_test.go
@@ -0,0 +1,111 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"io"
+	"math"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestVarint(t *testing.T) {
+	varintBuffer := make([]byte, maxUint64VarIntLength)
+	offset := encodeVarintGenerated(varintBuffer, len(varintBuffer), math.MaxUint64)
+	used := len(varintBuffer) - offset
+	if used != maxUint64VarIntLength {
+		t.Fatalf("expected encodeVarintGenerated to use %d bytes to encode MaxUint64, got %d", maxUint64VarIntLength, used)
+	}
+}
+
+func TestNestedMarshalToWriter(t *testing.T) {
+	testcases := []struct {
+		name string
+		raw  []byte
+	}{
+		{
+			name: "zero-length",
+			raw:  []byte{},
+		},
+		{
+			name: "simple",
+			raw:  []byte{0x00, 0x01, 0x02, 0x03},
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			u := &Unknown{
+				ContentType:     "ct",
+				ContentEncoding: "ce",
+				TypeMeta: TypeMeta{
+					APIVersion: "v1",
+					Kind:       "k",
+				},
+			}
+
+			// Marshal normally with Raw inlined
+			u.Raw = tc.raw
+			marshalData, err := u.Marshal()
+			if err != nil {
+				t.Fatal(err)
+			}
+			u.Raw = nil
+
+			// Marshal with NestedMarshalTo
+			nestedMarshalData := make([]byte, len(marshalData))
+			n, err := u.NestedMarshalTo(nestedMarshalData, copyMarshaler(tc.raw), uint64(len(tc.raw)))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if n != len(marshalData) {
+				t.Errorf("NestedMarshalTo returned %d, expected %d", n, len(marshalData))
+			}
+			if e, a := marshalData, nestedMarshalData; !bytes.Equal(e, a) {
+				t.Errorf("NestedMarshalTo and Marshal differ:\n%s", cmp.Diff(e, a))
+			}
+
+			// Streaming marshal with MarshalToWriter
+			buf := bytes.NewBuffer(nil)
+			n, err = u.MarshalToWriter(buf, len(tc.raw), func(w io.Writer) (int, error) {
+				return w.Write(tc.raw)
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if n != len(marshalData) {
+				t.Errorf("MarshalToWriter returned %d, expected %d", n, len(marshalData))
+			}
+			if e, a := marshalData, buf.Bytes(); !bytes.Equal(e, a) {
+				t.Errorf("MarshalToWriter and Marshal differ:\n%s", cmp.Diff(e, a))
+			}
+		})
+	}
+}
+
+type copyMarshaler []byte
+
+func (c copyMarshaler) Size() int {
+	return len(c)
+}
+
+func (c copyMarshaler) MarshalTo(dest []byte) (int, error) {
+	n := copy(dest, []byte(c))
+	return n, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/zz_generated.deepcopy.go b/third_party/k8s.io/apimachinery/pkg/runtime/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..069ea4f92d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/zz_generated.deepcopy.go
@@ -0,0 +1,76 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package runtime
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RawExtension) DeepCopyInto(out *RawExtension) {
+	*out = *in
+	if in.Raw != nil {
+		in, out := &in.Raw, &out.Raw
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.Object != nil {
+		out.Object = in.Object.DeepCopyObject()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RawExtension.
+func (in *RawExtension) DeepCopy() *RawExtension {
+	if in == nil {
+		return nil
+	}
+	out := new(RawExtension)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Unknown) DeepCopyInto(out *Unknown) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	if in.Raw != nil {
+		in, out := &in.Raw, &out.Raw
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Unknown.
+func (in *Unknown) DeepCopy() *Unknown {
+	if in == nil {
+		return nil
+	}
+	out := new(Unknown)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new Object.
+func (in *Unknown) DeepCopyObject() Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/runtime/zz_generated.model_name.go b/third_party/k8s.io/apimachinery/pkg/runtime/zz_generated.model_name.go
new file mode 100644
index 0000000000..cf3ec4dceb
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/runtime/zz_generated.model_name.go
@@ -0,0 +1,92 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package runtime
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Allocator) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.Allocator"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NegotiateError) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.NegotiateError"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NoopDecoder) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.NoopDecoder"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NoopEncoder) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.NoopEncoder"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Pair) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.Pair"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in RawExtension) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.RawExtension"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Scheme) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.Scheme"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SerializerInfo) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.SerializerInfo"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SimpleAllocator) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.SimpleAllocator"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in StreamSerializerInfo) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.StreamSerializerInfo"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TypeMeta) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.TypeMeta"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Unknown) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.Unknown"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WithVersionEncoder) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.WithVersionEncoder"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WithoutVersionDecoder) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.runtime.WithoutVersionDecoder"
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/selection/operator.go b/third_party/k8s.io/apimachinery/pkg/selection/operator.go
new file mode 100644
index 0000000000..298f798c43
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/selection/operator.go
@@ -0,0 +1,33 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package selection
+
+// Operator represents a key/field's relationship to value(s).
+// See labels.Requirement and fields.Requirement for more details.
+type Operator string
+
+const (
+	DoesNotExist Operator = "!"
+	Equals       Operator = "="
+	DoubleEquals Operator = "=="
+	In           Operator = "in"
+	NotEquals    Operator = "!="
+	NotIn        Operator = "notin"
+	Exists       Operator = "exists"
+	GreaterThan  Operator = "gt"
+	LessThan     Operator = "lt"
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/sharding/accessor.go b/third_party/k8s.io/apimachinery/pkg/sharding/accessor.go
new file mode 100644
index 0000000000..fab98ffca4
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/sharding/accessor.go
@@ -0,0 +1,50 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sharding
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// ResolveFieldValue extracts a metadata field value from a runtime.Object
+// based on the given field path.
+//
+// Field paths use CEL-style object-rooted syntax ("object.metadata.<field>"),
+// which differs from the fieldSelector format ("metadata.<field>"). The
+// "object." prefix anchors the path to the resource being filtered.
+//
+// Supported field paths:
+//   - "object.metadata.uid"
+//   - "object.metadata.namespace"
+func ResolveFieldValue(obj runtime.Object, fieldPath string) (string, error) {
+	accessor, err := meta.Accessor(obj)
+	if err != nil {
+		return "", fmt.Errorf("failed to access object metadata: %w", err)
+	}
+
+	switch fieldPath {
+	case "object.metadata.uid":
+		return string(accessor.GetUID()), nil
+	case "object.metadata.namespace":
+		return accessor.GetNamespace(), nil
+	default:
+		return "", fmt.Errorf("unsupported field path: %q", fieldPath)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/sharding/accessor_test.go b/third_party/k8s.io/apimachinery/pkg/sharding/accessor_test.go
new file mode 100644
index 0000000000..bee6d39025
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/sharding/accessor_test.go
@@ -0,0 +1,64 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sharding
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func TestResolveFieldValue(t *testing.T) {
+	obj := &testObject{
+		ObjectMeta: metav1.ObjectMeta{
+			UID:       types.UID("test-uid-123"),
+			Name:      "test-name",
+			Namespace: "test-namespace",
+		},
+	}
+
+	tests := []struct {
+		fieldPath string
+		want      string
+		wantErr   bool
+	}{
+		{"object.metadata.uid", "test-uid-123", false},
+		{"object.metadata.namespace", "test-namespace", false},
+		{"object.metadata.name", "", true},
+		{"object.metadata.labels", "", true},
+		{"invalid.path", "", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.fieldPath, func(t *testing.T) {
+			got, err := ResolveFieldValue(obj, tt.fieldPath)
+			if tt.wantErr {
+				if err == nil {
+					t.Errorf("expected error for fieldPath %q", tt.fieldPath)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if got != tt.want {
+				t.Errorf("ResolveFieldValue(%q) = %q, want %q", tt.fieldPath, got, tt.want)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/sharding/hash.go b/third_party/k8s.io/apimachinery/pkg/sharding/hash.go
new file mode 100644
index 0000000000..ae4dcfe2f6
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/sharding/hash.go
@@ -0,0 +1,30 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sharding
+
+import (
+	"fmt"
+	"hash/fnv"
+)
+
+// HashField computes a hash of value and returns it
+// as a 16-character lowercase hex string (no "0x" prefix).
+func HashField(value string) string {
+	h := fnv.New64a()
+	h.Write([]byte(value))
+	return fmt.Sprintf("%016x", h.Sum64())
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/sharding/hash_test.go b/third_party/k8s.io/apimachinery/pkg/sharding/hash_test.go
new file mode 100644
index 0000000000..750352eef1
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/sharding/hash_test.go
@@ -0,0 +1,58 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sharding
+
+import (
+	"testing"
+)
+
+func TestHashField(t *testing.T) {
+	tests := []struct {
+		input string
+	}{
+		{""},
+		{"abc"},
+		{"test-uid-12345"},
+		{"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"},
+	}
+
+	for _, tt := range tests {
+		result := HashField(tt.input)
+		if len(result) != 16 {
+			t.Errorf("HashField(%q) returned %q (len %d), expected 16 hex chars", tt.input, result, len(result))
+		}
+		// Verify all chars are hex
+		for _, c := range result {
+			if (c < '0' || c > '9') && (c < 'a' || c > 'f') {
+				t.Errorf("HashField(%q) returned %q which contains non-hex char %q", tt.input, result, string(c))
+			}
+		}
+	}
+
+	// Determinism
+	h1 := HashField("test")
+	h2 := HashField("test")
+	if h1 != h2 {
+		t.Errorf("HashField is not deterministic: %q != %q", h1, h2)
+	}
+
+	// Different inputs produce different outputs
+	h3 := HashField("different")
+	if h1 == h3 {
+		t.Errorf("HashField produced same hash for different inputs: %q", h1)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/sharding/selector.go b/third_party/k8s.io/apimachinery/pkg/sharding/selector.go
new file mode 100644
index 0000000000..841388a0d7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/sharding/selector.go
@@ -0,0 +1,137 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sharding
+
+import (
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// Selector represents a shard selector that can match objects based on
+// hash ranges of their metadata fields. It follows the labels.Selector
+// pattern from the Kubernetes API.
+type Selector interface {
+	// Matches returns true if the given object matches the shard selector.
+	Matches(obj runtime.Object) (bool, error)
+
+	// Empty returns true if the selector matches everything (no filtering).
+	Empty() bool
+
+	// String returns the wire-format string representation that can be
+	// round-tripped through Parse.
+	String() string
+
+	// Requirements returns the list of shard range requirements.
+	Requirements() []ShardRangeRequirement
+
+	// DeepCopySelector returns a deep copy of the selector.
+	DeepCopySelector() Selector
+}
+
+// Everything returns a selector that matches all objects.
+func Everything() Selector {
+	return &everythingSelector{}
+}
+
+type everythingSelector struct{}
+
+func (s *everythingSelector) Matches(_ runtime.Object) (bool, error) { return true, nil }
+func (s *everythingSelector) Empty() bool                            { return true }
+func (s *everythingSelector) String() string                         { return "" }
+func (s *everythingSelector) Requirements() []ShardRangeRequirement  { return nil }
+func (s *everythingSelector) DeepCopySelector() Selector             { return &everythingSelector{} }
+
+// shardSelector implements Selector with one or more shard range requirements.
+type shardSelector struct {
+	requirements []ShardRangeRequirement
+}
+
+func (s *shardSelector) Matches(obj runtime.Object) (bool, error) {
+	if len(s.requirements) == 0 {
+		return true, nil
+	}
+	// All requirements must share the same key so we resolve the field value
+	// and compute the hash once. The parser enforces this, but we verify here
+	// to guard against selectors constructed through other means.
+	key := s.requirements[0].Key
+	for _, req := range s.requirements[1:] {
+		if req.Key != key {
+			return false, fmt.Errorf("inconsistent shard keys: %q vs %q", key, req.Key)
+		}
+	}
+
+	value, err := ResolveFieldValue(obj, key)
+	if err != nil {
+		return false, err
+	}
+	hash := "0x" + HashField(value)
+
+	for _, req := range s.requirements {
+		if !HexLess(hash, req.Start) && HexLess(hash, req.End) {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// HexLess compares two 0x-prefixed lowercase hex strings numerically.
+// Both values must be normalized to 16 hex digits (e.g. "0x0000000000000000"),
+// except for the special upper bound "0x10000000000000000" (2^64) which has 17.
+func HexLess(a, b string) bool {
+	if len(a) != len(b) {
+		return len(a) < len(b)
+	}
+	return a < b
+}
+
+func (s *shardSelector) Empty() bool {
+	return len(s.requirements) == 0
+}
+
+func (s *shardSelector) String() string {
+	parts := make([]string, 0, len(s.requirements))
+	for _, req := range s.requirements {
+		parts = append(parts, fmt.Sprintf("shardRange(%s, '%s', '%s')", req.Key, req.Start, req.End))
+	}
+	return strings.Join(parts, " || ")
+}
+
+func (s *shardSelector) Requirements() []ShardRangeRequirement {
+	result := make([]ShardRangeRequirement, len(s.requirements))
+	copy(result, s.requirements)
+	return result
+}
+
+func (s *shardSelector) DeepCopySelector() Selector {
+	reqs := make([]ShardRangeRequirement, len(s.requirements))
+	copy(reqs, s.requirements)
+	return &shardSelector{requirements: reqs}
+}
+
+// NewSelector creates a Selector from the given requirements.
+// All requirements must use the same Key; this is validated at match time.
+// If no requirements are provided, returns Everything().
+func NewSelector(reqs ...ShardRangeRequirement) Selector {
+	if len(reqs) == 0 {
+		return Everything()
+	}
+	return &shardSelector{
+		requirements: reqs,
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/sharding/selector_test.go b/third_party/k8s.io/apimachinery/pkg/sharding/selector_test.go
new file mode 100644
index 0000000000..eb5ea63fe9
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/sharding/selector_test.go
@@ -0,0 +1,141 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sharding
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// testObject is a minimal runtime.Object for testing.
+type testObject struct {
+	metav1.TypeMeta   `json:""`
+	metav1.ObjectMeta `json:"metadata"`
+}
+
+func (t *testObject) DeepCopyObject() runtime.Object {
+	return &testObject{
+		TypeMeta:   t.TypeMeta,
+		ObjectMeta: *t.ObjectMeta.DeepCopy(),
+	}
+}
+
+func TestSelectorMatches(t *testing.T) {
+	obj := &testObject{
+		ObjectMeta: metav1.ObjectMeta{
+			UID:       types.UID("test-uid-123"),
+			Name:      "test-name",
+			Namespace: "test-namespace",
+		},
+	}
+
+	hash := "0x" + HashField("test-uid-123")
+
+	tests := []struct {
+		name      string
+		selector  Selector
+		wantMatch bool
+	}{
+		{
+			name:      "everything matches",
+			selector:  Everything(),
+			wantMatch: true,
+		},
+		{
+			name:      "empty selector matches",
+			selector:  NewSelector(),
+			wantMatch: true,
+		},
+		{
+			name: "full range matches",
+			selector: NewSelector(ShardRangeRequirement{
+				Key:   "object.metadata.uid",
+				Start: "0x0000000000000000",
+				End:   "0x10000000000000000",
+			}),
+			wantMatch: true,
+		},
+		{
+			name: "hash in specific range",
+			selector: NewSelector(ShardRangeRequirement{
+				Key:   "object.metadata.uid",
+				Start: hash,
+				End:   hash + "f", // hash + "f" is always > hash
+			}),
+			wantMatch: true,
+		},
+		{
+			name: "hash below start",
+			selector: NewSelector(ShardRangeRequirement{
+				Key:   "object.metadata.uid",
+				Start: "0xffffffffffffffff",
+				End:   "0x10000000000000000",
+			}),
+			wantMatch: hash >= "0xffffffffffffffff",
+		},
+		{
+			name: "hash at or above end",
+			selector: NewSelector(ShardRangeRequirement{
+				Key:   "object.metadata.uid",
+				Start: "0x0000000000000000",
+				End:   "0x0000000000000001",
+			}),
+			wantMatch: hash < "0x0000000000000001",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			matched, err := tt.selector.Matches(obj)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if matched != tt.wantMatch {
+				t.Errorf("Matches() = %v, want %v (hash=%s)", matched, tt.wantMatch, hash)
+			}
+		})
+	}
+}
+
+func TestSelectorEmpty(t *testing.T) {
+	if !Everything().Empty() {
+		t.Error("Everything() should be empty")
+	}
+	if !NewSelector().Empty() {
+		t.Error("NewSelector() with no args should be empty")
+	}
+
+	sel := NewSelector(ShardRangeRequirement{Key: "object.metadata.uid", Start: "0x0000000000000000", End: "0x8000000000000000"})
+	if sel.Empty() {
+		t.Error("selector with requirement should not be empty")
+	}
+}
+
+func TestSelectorString(t *testing.T) {
+	sel := NewSelector(ShardRangeRequirement{
+		Key:   "object.metadata.uid",
+		Start: "0x00",
+		End:   "0x80",
+	})
+	expected := "shardRange(object.metadata.uid, '0x00', '0x80')"
+	if sel.String() != expected {
+		t.Errorf("String() = %q, want %q", sel.String(), expected)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/sharding/types.go b/third_party/k8s.io/apimachinery/pkg/sharding/types.go
new file mode 100644
index 0000000000..4684fc497f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/sharding/types.go
@@ -0,0 +1,32 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sharding
+
+// ShardRangeRequirement represents a single shard range requirement.
+// It specifies a field path to hash and a hex range [Start, End) for filtering.
+// The hash space is FNV-1a 64-bit: [0x0000000000000000, 0x10000000000000000).
+// Both Start and End must be specified (no empty/unbounded values).
+type ShardRangeRequirement struct {
+	// Key is the field path, e.g. "object.metadata.uid"
+	Key string
+	// Start is the inclusive lower bound as a 0x-prefixed lowercase hex string.
+	// Minimum value is "0x0000000000000000".
+	Start string
+	// End is the exclusive upper bound as a 0x-prefixed lowercase hex string.
+	// Maximum value is "0x10000000000000000" (2^64).
+	End string
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/test/api_meta_help_test.go b/third_party/k8s.io/apimachinery/pkg/test/api_meta_help_test.go
new file mode 100644
index 0000000000..e6be133111
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/test/api_meta_help_test.go
@@ -0,0 +1,335 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"sigs.k8s.io/randfill"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metafuzzer "k8s.io/apimachinery/pkg/apis/meta/fuzzer"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	v1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+)
+
+func TestIsList(t *testing.T) {
+	tests := []struct {
+		obj    runtime.Object
+		isList bool
+	}{
+		{&testapigroup.CarpList{}, true},
+		{&testapigroup.Carp{}, false},
+	}
+	for _, item := range tests {
+		if e, a := item.isList, meta.IsListType(item.obj); e != a {
+			t.Errorf("%v: Expected %v, got %v", reflect.TypeOf(item.obj), e, a)
+		}
+	}
+}
+
+func TestExtractList(t *testing.T) {
+	list1 := []runtime.Object{
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+	}
+	list2 := &ListV1{
+		Items: []runtime.RawExtension{
+			{Raw: []byte("foo")},
+			{Raw: []byte("bar")},
+			{Object: &v1.Carp{ObjectMeta: metav1.ObjectMeta{Name: "other"}}},
+		},
+	}
+	list3 := &fakePtrValueList{
+		Items: []*testapigroup.Carp{
+			{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+			{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+		},
+	}
+	list4 := &testapigroup.CarpList{
+		Items: []testapigroup.Carp{
+			{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+			{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+			{ObjectMeta: metav1.ObjectMeta{Name: "3"}},
+		},
+	}
+
+	testCases := []struct {
+		in    runtime.Object
+		out   []interface{}
+		equal bool
+	}{
+		{
+			in:  &List{},
+			out: []interface{}{},
+		},
+		{
+			in:  &ListV1{},
+			out: []interface{}{},
+		},
+		{
+			in:  &List{Items: list1},
+			out: []interface{}{list1[0], list1[1]},
+		},
+		{
+			in:    list2,
+			out:   []interface{}{&runtime.Unknown{Raw: list2.Items[0].Raw}, &runtime.Unknown{Raw: list2.Items[1].Raw}, list2.Items[2].Object},
+			equal: true,
+		},
+		{
+			in:  list3,
+			out: []interface{}{list3.Items[0], list3.Items[1]},
+		},
+		{
+			in:  list4,
+			out: []interface{}{&list4.Items[0], &list4.Items[1], &list4.Items[2]},
+		},
+	}
+	for i, test := range testCases {
+		list, err := meta.ExtractList(test.in)
+		if err != nil {
+			t.Fatalf("%d: extract: Unexpected error %v", i, err)
+		}
+		if e, a := len(test.out), len(list); e != a {
+			t.Fatalf("%d: extract: Expected %v, got %v", i, e, a)
+		}
+		for j, e := range test.out {
+			if e != list[j] {
+				if !test.equal {
+					t.Fatalf("%d: extract: Expected list[%d] to be %#v, but found %#v", i, j, e, list[j])
+				}
+				if !reflect.DeepEqual(e, list[j]) {
+					t.Fatalf("%d: extract: Expected list[%d] to be %#v, but found %#v", i, j, e, list[j])
+				}
+			}
+		}
+	}
+}
+
+func TestEachListItem(t *testing.T) {
+	list1 := []runtime.Object{
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+	}
+	list2 := &ListV1{
+		Items: []runtime.RawExtension{
+			{Raw: []byte("foo")},
+			{Raw: []byte("bar")},
+			{Object: &v1.Carp{ObjectMeta: metav1.ObjectMeta{Name: "other"}}},
+		},
+	}
+	list3 := &fakePtrValueList{
+		Items: []*testapigroup.Carp{
+			{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+			{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+		},
+	}
+	list4 := &testapigroup.CarpList{
+		Items: []testapigroup.Carp{
+			{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+			{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+			{ObjectMeta: metav1.ObjectMeta{Name: "3"}},
+		},
+	}
+
+	testCases := []struct {
+		in  runtime.Object
+		out []interface{}
+	}{
+		{
+			in:  &List{},
+			out: []interface{}{},
+		},
+		{
+			in:  &ListV1{},
+			out: []interface{}{},
+		},
+		{
+			in:  &List{Items: list1},
+			out: []interface{}{list1[0], list1[1]},
+		},
+		{
+			in:  list2,
+			out: []interface{}{nil, nil, list2.Items[2].Object},
+		},
+		{
+			in:  list3,
+			out: []interface{}{list3.Items[0], list3.Items[1]},
+		},
+		{
+			in:  list4,
+			out: []interface{}{&list4.Items[0], &list4.Items[1], &list4.Items[2]},
+		},
+	}
+	for i, test := range testCases {
+		list := []runtime.Object{}
+		err := meta.EachListItem(test.in, func(obj runtime.Object) error {
+			list = append(list, obj)
+			return nil
+		})
+		if err != nil {
+			t.Fatalf("%d: each: Unexpected error %v", i, err)
+		}
+		if e, a := len(test.out), len(list); e != a {
+			t.Fatalf("%d: each: Expected %v, got %v", i, e, a)
+		}
+		for j, e := range test.out {
+			if e != list[j] {
+				t.Fatalf("%d: each: Expected list[%d] to be %#v, but found %#v", i, j, e, list[j])
+			}
+		}
+	}
+}
+
+type fakePtrInterfaceList struct {
+	Items *[]runtime.Object
+}
+
+func (obj fakePtrInterfaceList) GetObjectKind() schema.ObjectKind {
+	return schema.EmptyObjectKind
+}
+func (obj fakePtrInterfaceList) DeepCopyObject() runtime.Object {
+	panic("fakePtrInterfaceList does not support DeepCopy")
+}
+
+func TestExtractListOfInterfacePtrs(t *testing.T) {
+	pl := &fakePtrInterfaceList{
+		Items: &[]runtime.Object{},
+	}
+	list, err := meta.ExtractList(pl)
+	if err != nil {
+		t.Fatalf("Unexpected error %v", err)
+	}
+	if len(list) > 0 {
+		t.Fatalf("Expected empty list, got %#v", list)
+	}
+}
+
+type fakePtrValueList struct {
+	Items []*testapigroup.Carp
+}
+
+func (obj fakePtrValueList) GetObjectKind() schema.ObjectKind {
+	return schema.EmptyObjectKind
+}
+func (obj *fakePtrValueList) DeepCopyObject() runtime.Object {
+	if obj == nil {
+		return nil
+	}
+	clone := fakePtrValueList{
+		Items: make([]*testapigroup.Carp, len(obj.Items)),
+	}
+	for i, carp := range obj.Items {
+		clone.Items[i] = carp.DeepCopy()
+	}
+	return &clone
+}
+
+func TestSetList(t *testing.T) {
+	pl := &testapigroup.CarpList{}
+	list := []runtime.Object{
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "3"}},
+	}
+	err := meta.SetList(pl, list)
+	if err != nil {
+		t.Fatalf("Unexpected error %v", err)
+	}
+	if e, a := len(list), len(pl.Items); e != a {
+		t.Fatalf("Expected %v, got %v", e, a)
+	}
+	for i := range list {
+		if e, a := list[i].(*testapigroup.Carp).Name, pl.Items[i].Name; e != a {
+			t.Fatalf("Expected %v, got %v", e, a)
+		}
+	}
+}
+
+func TestSetListToRuntimeObjectArray(t *testing.T) {
+	pl := &List{}
+	list := []runtime.Object{
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "2"}},
+		&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "3"}},
+	}
+	err := meta.SetList(pl, list)
+	if err != nil {
+		t.Fatalf("Unexpected error %v", err)
+	}
+	if e, a := len(list), len(pl.Items); e != a {
+		t.Fatalf("Expected %v, got %v", e, a)
+	}
+	for i := range list {
+		if e, a := list[i], pl.Items[i]; e != a {
+			t.Fatalf("%d: unmatched: %s", i, cmp.Diff(e, a))
+		}
+	}
+}
+
+func TestSetListToMatchingType(t *testing.T) {
+	pl := &unstructured.UnstructuredList{}
+	list := []runtime.Object{
+		&unstructured.Unstructured{Object: map[string]interface{}{"foo": 1}},
+		&unstructured.Unstructured{Object: map[string]interface{}{"foo": 2}},
+		&unstructured.Unstructured{Object: map[string]interface{}{"foo": 3}},
+	}
+	err := meta.SetList(pl, list)
+	if err != nil {
+		t.Fatalf("Unexpected error %v", err)
+	}
+	if e, a := len(list), len(pl.Items); e != a {
+		t.Fatalf("Expected %v, got %v", e, a)
+	}
+	for i := range list {
+		if e, a := list[i], &pl.Items[i]; !reflect.DeepEqual(e, a) {
+			t.Fatalf("%d: unmatched: %s", i, cmp.Diff(e, a))
+		}
+	}
+}
+
+func TestSetExtractListRoundTrip(t *testing.T) {
+	scheme := runtime.NewScheme()
+	codecs := serializer.NewCodecFactory(scheme)
+	fuzzer := randfill.New().NilChance(0).NumElements(1, 5).Funcs(metafuzzer.Funcs(codecs)...).MaxDepth(10)
+	for i := 0; i < 5; i++ {
+		start := &testapigroup.CarpList{}
+		fuzzer.Fill(&start.Items)
+
+		list, err := meta.ExtractList(start)
+		if err != nil {
+			t.Errorf("Unexpected error %v", err)
+			continue
+		}
+		got := &testapigroup.CarpList{}
+		err = meta.SetList(got, list)
+		if err != nil {
+			t.Errorf("Unexpected error %v", err)
+			continue
+		}
+		if e, a := start, got; !reflect.DeepEqual(e, a) {
+			t.Fatalf("Expected %#v, got %#v", e, a)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/test/api_meta_meta_test.go b/third_party/k8s.io/apimachinery/pkg/test/api_meta_meta_test.go
new file mode 100644
index 0000000000..e46c7bc97e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/test/api_meta_meta_test.go
@@ -0,0 +1,390 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metafuzzer "k8s.io/apimachinery/pkg/apis/meta/fuzzer"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/randfill"
+)
+
+func TestAPIObjectMeta(t *testing.T) {
+	j := &testapigroup.Carp{
+		TypeMeta: metav1.TypeMeta{APIVersion: "/a", Kind: "b"},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:       "bar",
+			Name:            "foo",
+			GenerateName:    "prefix",
+			UID:             "uid",
+			ResourceVersion: "1",
+			SelfLink:        "some/place/only/we/know",
+			Labels:          map[string]string{"foo": "bar"},
+			Annotations:     map[string]string{"x": "y"},
+			Finalizers: []string{
+				"finalizer.1",
+				"finalizer.2",
+			},
+		},
+	}
+	var _ metav1.Object = &j.ObjectMeta
+	var _ metav1.ObjectMetaAccessor = j
+	accessor, err := meta.Accessor(j)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if accessor != metav1.Object(j) {
+		t.Fatalf("should have returned the same pointer: %#v\n\n%#v", accessor, j)
+	}
+	if e, a := "bar", accessor.GetNamespace(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "foo", accessor.GetName(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "prefix", accessor.GetGenerateName(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "uid", string(accessor.GetUID()); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "1", accessor.GetResourceVersion(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "some/place/only/we/know", accessor.GetSelfLink(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := []string{"finalizer.1", "finalizer.2"}, accessor.GetFinalizers(); !reflect.DeepEqual(e, a) {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+
+	typeAccessor, err := meta.TypeAccessor(j)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if e, a := "a", typeAccessor.GetAPIVersion(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "b", typeAccessor.GetKind(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+
+	accessor.SetNamespace("baz")
+	accessor.SetName("bar")
+	accessor.SetGenerateName("generate")
+	accessor.SetUID("other")
+	typeAccessor.SetAPIVersion("c")
+	typeAccessor.SetKind("d")
+	accessor.SetResourceVersion("2")
+	accessor.SetSelfLink("google.com")
+	accessor.SetFinalizers([]string{"finalizer.3"})
+
+	// Prove that accessor changes the original object.
+	if e, a := "baz", j.Namespace; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "bar", j.Name; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "generate", j.GenerateName; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := types.UID("other"), j.UID; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "c", j.APIVersion; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "d", j.Kind; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "2", j.ResourceVersion; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "google.com", j.SelfLink; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := []string{"finalizer.3"}, j.Finalizers; !reflect.DeepEqual(e, a) {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+
+	typeAccessor.SetAPIVersion("d")
+	typeAccessor.SetKind("e")
+	if e, a := "d", j.APIVersion; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "e", j.Kind; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+}
+
+func TestGenericTypeMeta(t *testing.T) {
+	type TypeMeta struct {
+		Kind              string                  `json:"kind,omitempty"`
+		Namespace         string                  `json:"namespace,omitempty"`
+		Name              string                  `json:"name,omitempty"`
+		GenerateName      string                  `json:"generateName,omitempty"`
+		UID               string                  `json:"uid,omitempty"`
+		CreationTimestamp metav1.Time             `json:"creationTimestamp,omitempty,omitzero"`
+		SelfLink          string                  `json:"selfLink,omitempty"`
+		ResourceVersion   string                  `json:"resourceVersion,omitempty"`
+		APIVersion        string                  `json:"apiVersion,omitempty"`
+		Labels            map[string]string       `json:"labels,omitempty"`
+		Annotations       map[string]string       `json:"annotations,omitempty"`
+		OwnerReferences   []metav1.OwnerReference `json:"ownerReferences,omitempty"`
+		Finalizers        []string                `json:"finalizers,omitempty"`
+	}
+
+	j := struct{ TypeMeta }{TypeMeta{APIVersion: "a", Kind: "b"}}
+
+	typeAccessor, err := meta.TypeAccessor(&j)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if e, a := "a", typeAccessor.GetAPIVersion(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "b", typeAccessor.GetKind(); e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+
+	typeAccessor.SetAPIVersion("c")
+	typeAccessor.SetKind("d")
+
+	if e, a := "c", j.APIVersion; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "d", j.Kind; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+
+	typeAccessor.SetAPIVersion("d")
+	typeAccessor.SetKind("e")
+
+	if e, a := "d", j.APIVersion; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+	if e, a := "e", j.Kind; e != a {
+		t.Errorf("expected %v, got %v", e, a)
+	}
+}
+
+type InternalTypeMeta struct {
+	Kind               string                  `json:"kind,omitempty"`
+	Namespace          string                  `json:"namespace,omitempty"`
+	Name               string                  `json:"name,omitempty"`
+	GenerateName       string                  `json:"generateName,omitempty"`
+	UID                string                  `json:"uid,omitempty"`
+	CreationTimestamp  metav1.Time             `json:"creationTimestamp,omitempty"`
+	SelfLink           string                  `json:"selfLink,omitempty"`
+	ResourceVersion    string                  `json:"resourceVersion,omitempty"`
+	Continue           string                  `json:"next,omitempty"`
+	RemainingItemCount *int64                  `json:"remainingItemCount,omitempty"`
+	APIVersion         string                  `json:"apiVersion,omitempty"`
+	Labels             map[string]string       `json:"labels,omitempty"`
+	Annotations        map[string]string       `json:"annotations,omitempty"`
+	Finalizers         []string                `json:"finalizers,omitempty"`
+	OwnerReferences    []metav1.OwnerReference `json:"ownerReferences,omitempty"`
+}
+
+func (m *InternalTypeMeta) GetResourceVersion() string     { return m.ResourceVersion }
+func (m *InternalTypeMeta) SetResourceVersion(rv string)   { m.ResourceVersion = rv }
+func (m *InternalTypeMeta) GetSelfLink() string            { return m.SelfLink }
+func (m *InternalTypeMeta) SetSelfLink(link string)        { m.SelfLink = link }
+func (m *InternalTypeMeta) GetContinue() string            { return m.Continue }
+func (m *InternalTypeMeta) SetContinue(c string)           { m.Continue = c }
+func (m *InternalTypeMeta) GetRemainingItemCount() *int64  { return m.RemainingItemCount }
+func (m *InternalTypeMeta) SetRemainingItemCount(c *int64) { m.RemainingItemCount = c }
+
+type MyAPIObject struct {
+	TypeMeta InternalTypeMeta `json:""`
+}
+
+func (obj *MyAPIObject) GetListMeta() metav1.ListInterface { return &obj.TypeMeta }
+
+func (obj *MyAPIObject) GetObjectKind() schema.ObjectKind { return obj }
+func (obj *MyAPIObject) SetGroupVersionKind(gvk schema.GroupVersionKind) {
+	obj.TypeMeta.APIVersion, obj.TypeMeta.Kind = gvk.ToAPIVersionAndKind()
+}
+func (obj *MyAPIObject) GroupVersionKind() schema.GroupVersionKind {
+	return schema.FromAPIVersionAndKind(obj.TypeMeta.APIVersion, obj.TypeMeta.Kind)
+}
+func (obj *MyAPIObject) DeepCopyObject() runtime.Object {
+	panic("MyAPIObject does not support DeepCopy")
+}
+
+type MyIncorrectlyMarkedAsAPIObject struct{}
+
+func (obj *MyIncorrectlyMarkedAsAPIObject) GetObjectKind() schema.ObjectKind {
+	return schema.EmptyObjectKind
+}
+func (obj *MyIncorrectlyMarkedAsAPIObject) DeepCopyObject() runtime.Object {
+	panic("MyIncorrectlyMarkedAsAPIObject does not support DeepCopy")
+}
+
+func TestResourceVersionerOfAPI(t *testing.T) {
+	type T struct {
+		runtime.Object
+		Expected string
+	}
+	testCases := map[string]T{
+		"empty api object":                   {&MyAPIObject{}, ""},
+		"api object with version":            {&MyAPIObject{TypeMeta: InternalTypeMeta{ResourceVersion: "1"}}, "1"},
+		"pointer to api object with version": {&MyAPIObject{TypeMeta: InternalTypeMeta{ResourceVersion: "1"}}, "1"},
+	}
+	versioning := meta.NewAccessor()
+	for key, testCase := range testCases {
+		actual, err := versioning.ResourceVersion(testCase.Object)
+		if err != nil {
+			t.Errorf("%s: unexpected error %#v", key, err)
+		}
+		if actual != testCase.Expected {
+			t.Errorf("%s: expected %v, got %v", key, testCase.Expected, actual)
+		}
+	}
+
+	failingCases := map[string]struct {
+		runtime.Object
+		Expected string
+	}{
+		"not a valid object to try": {&MyIncorrectlyMarkedAsAPIObject{}, "1"},
+	}
+	for key, testCase := range failingCases {
+		_, err := versioning.ResourceVersion(testCase.Object)
+		if err == nil {
+			t.Errorf("%s: expected error, got nil", key)
+		}
+	}
+
+	setCases := map[string]struct {
+		runtime.Object
+		Expected string
+	}{
+		"pointer to api object with version": {&MyAPIObject{TypeMeta: InternalTypeMeta{ResourceVersion: "1"}}, "1"},
+	}
+	for key, testCase := range setCases {
+		if err := versioning.SetResourceVersion(testCase.Object, "5"); err != nil {
+			t.Errorf("%s: unexpected error %#v", key, err)
+		}
+		actual, err := versioning.ResourceVersion(testCase.Object)
+		if err != nil {
+			t.Errorf("%s: unexpected error %#v", key, err)
+		}
+		if actual != "5" {
+			t.Errorf("%s: expected %v, got %v", key, "5", actual)
+		}
+	}
+}
+
+type MyAPIObject2 struct {
+	metav1.TypeMeta
+	metav1.ObjectMeta
+}
+
+func getObjectMetaAndOwnerReferences() (myAPIObject2 MyAPIObject2, metaOwnerReferences []metav1.OwnerReference) {
+	scheme := runtime.NewScheme()
+	codecs := serializer.NewCodecFactory(scheme)
+	randfill.New().NilChance(.5).NumElements(1, 5).Funcs(metafuzzer.Funcs(codecs)...).MaxDepth(10).Fill(&myAPIObject2)
+	references := myAPIObject2.ObjectMeta.OwnerReferences
+	// This is necessary for the test to pass because the getter will return a
+	// non-nil slice.
+	metaOwnerReferences = make([]metav1.OwnerReference, 0)
+	for i := 0; i < len(references); i++ {
+		metaOwnerReferences = append(metaOwnerReferences, metav1.OwnerReference{
+			Kind:               references[i].Kind,
+			Name:               references[i].Name,
+			UID:                references[i].UID,
+			APIVersion:         references[i].APIVersion,
+			Controller:         references[i].Controller,
+			BlockOwnerDeletion: references[i].BlockOwnerDeletion,
+		})
+	}
+	if len(references) == 0 {
+		// This is necessary for the test to pass because the setter will make a
+		// non-nil slice.
+		myAPIObject2.ObjectMeta.OwnerReferences = make([]metav1.OwnerReference, 0)
+	}
+	return myAPIObject2, metaOwnerReferences
+}
+
+func testGetOwnerReferences(t *testing.T) {
+	obj, expected := getObjectMetaAndOwnerReferences()
+	accessor, err := meta.Accessor(&obj)
+	if err != nil {
+		t.Error(err)
+	}
+	references := accessor.GetOwnerReferences()
+	if !reflect.DeepEqual(references, expected) {
+		t.Errorf("expect %#v\n got %#v", expected, references)
+	}
+}
+
+func testSetOwnerReferences(t *testing.T) {
+	expected, references := getObjectMetaAndOwnerReferences()
+	obj := MyAPIObject2{}
+	accessor, err := meta.Accessor(&obj)
+	if err != nil {
+		t.Error(err)
+	}
+	accessor.SetOwnerReferences(references)
+	if e, a := expected.ObjectMeta.OwnerReferences, obj.ObjectMeta.OwnerReferences; !reflect.DeepEqual(e, a) {
+		t.Errorf("expect %#v\n got %#v", e, a)
+	}
+}
+
+func TestAccessOwnerReferences(t *testing.T) {
+	fuzzIter := 5
+	for i := 0; i < fuzzIter; i++ {
+		testGetOwnerReferences(t)
+		testSetOwnerReferences(t)
+	}
+}
+
+// BenchmarkAccessorSetFastPath shows the interface fast path
+func BenchmarkAccessorSetFastPath(b *testing.B) {
+	obj := &testapigroup.Carp{
+		TypeMeta: metav1.TypeMeta{APIVersion: "/a", Kind: "b"},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:       "bar",
+			Name:            "foo",
+			GenerateName:    "prefix",
+			UID:             "uid",
+			ResourceVersion: "1",
+			SelfLink:        "some/place/only/we/know",
+			Labels:          map[string]string{"foo": "bar"},
+			Annotations:     map[string]string{"x": "y"},
+		},
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		acc, err := meta.Accessor(obj)
+		if err != nil {
+			b.Fatal(err)
+		}
+		acc.SetNamespace("something")
+	}
+	b.StopTimer()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/test/apis_meta_v1_unstructed_unstructure_test.go b/third_party/k8s.io/apimachinery/pkg/test/apis_meta_v1_unstructed_unstructure_test.go
new file mode 100644
index 0000000000..6b487d3e40
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/test/apis_meta_v1_unstructed_unstructure_test.go
@@ -0,0 +1,560 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	apitesting "k8s.io/apimachinery/pkg/api/apitesting"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func TestDecodeUnstructured(t *testing.T) {
+	groupVersionString := "v1"
+	rawJson := fmt.Sprintf(`{"kind":"Pod","apiVersion":"%s","metadata":{"name":"test"}}`, groupVersionString)
+	pl := &List{
+		Items: []runtime.Object{
+			&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+			&runtime.Unknown{
+				TypeMeta:    runtime.TypeMeta{Kind: "Pod", APIVersion: groupVersionString},
+				Raw:         []byte(rawJson),
+				ContentType: runtime.ContentTypeJSON,
+			},
+			&runtime.Unknown{
+				TypeMeta:    runtime.TypeMeta{Kind: "", APIVersion: groupVersionString},
+				Raw:         []byte(rawJson),
+				ContentType: runtime.ContentTypeJSON,
+			},
+			&unstructured.Unstructured{
+				Object: map[string]interface{}{
+					"kind":       "Foo",
+					"apiVersion": "Bar",
+					"test":       "value",
+				},
+			},
+		},
+	}
+	if errs := runtime.DecodeList(pl.Items, unstructured.UnstructuredJSONScheme); len(errs) == 1 {
+		t.Fatalf("unexpected error %v", errs)
+	}
+	if pod, ok := pl.Items[1].(*unstructured.Unstructured); !ok || pod.Object["kind"] != "Pod" || pod.Object["metadata"].(map[string]interface{})["name"] != "test" {
+		t.Errorf("object not converted: %#v", pl.Items[1])
+	}
+	if pod, ok := pl.Items[2].(*unstructured.Unstructured); !ok || pod.Object["kind"] != "Pod" || pod.Object["metadata"].(map[string]interface{})["name"] != "test" {
+		t.Errorf("object not converted: %#v", pl.Items[2])
+	}
+}
+
+func TestDecode(t *testing.T) {
+	tcs := []struct {
+		json []byte
+		want runtime.Object
+	}{
+		{
+			json: []byte(`{"apiVersion": "test", "kind": "test_kind"}`),
+			want: &unstructured.Unstructured{
+				Object: map[string]interface{}{"apiVersion": "test", "kind": "test_kind"},
+			},
+		},
+		{
+			json: []byte(`{"apiVersion": "test", "kind": "test_list", "items": []}`),
+			want: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"apiVersion": "test", "kind": "test_list"},
+				Items:  []unstructured.Unstructured{},
+			},
+		},
+		{
+			json: []byte(`{"items": [{"metadata": {"name": "object1", "deletionGracePeriodSeconds": 10}, "apiVersion": "test", "kind": "test_kind"}, {"metadata": {"name": "object2"}, "apiVersion": "test", "kind": "test_kind"}], "apiVersion": "test", "kind": "test_list"}`),
+			want: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"apiVersion": "test", "kind": "test_list"},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"metadata":   map[string]interface{}{"name": "object1", "deletionGracePeriodSeconds": int64(10)},
+							"apiVersion": "test",
+							"kind":       "test_kind",
+						},
+					},
+					{
+						Object: map[string]interface{}{
+							"metadata":   map[string]interface{}{"name": "object2"},
+							"apiVersion": "test",
+							"kind":       "test_kind",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	for _, tc := range tcs {
+		got, _, err := unstructured.UnstructuredJSONScheme.Decode(tc.json, nil, nil)
+		if err != nil {
+			t.Errorf("Unexpected error for %q: %v", string(tc.json), err)
+			continue
+		}
+
+		if !reflect.DeepEqual(got, tc.want) {
+			t.Errorf("Decode(%q) want: %v\ngot: %v", string(tc.json), tc.want, got)
+		}
+	}
+}
+
+func TestUnstructuredGetters(t *testing.T) {
+	trueVar := true
+	ten := int64(10)
+	unstruct := unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"kind":       "test_kind",
+			"apiVersion": "test_version",
+			"metadata": map[string]interface{}{
+				"name":                       "test_name",
+				"namespace":                  "test_namespace",
+				"generateName":               "test_generateName",
+				"uid":                        "test_uid",
+				"resourceVersion":            "test_resourceVersion",
+				"generation":                 ten,
+				"deletionGracePeriodSeconds": ten,
+				"selfLink":                   "test_selfLink",
+				"creationTimestamp":          "2009-11-10T23:00:00Z",
+				"deletionTimestamp":          "2010-11-10T23:00:00Z",
+				"labels": map[string]interface{}{
+					"test_label": "test_value",
+				},
+				"annotations": map[string]interface{}{
+					"test_annotation": "test_value",
+				},
+				"ownerReferences": []interface{}{
+					map[string]interface{}{
+						"kind":       "Pod",
+						"name":       "poda",
+						"apiVersion": "v1",
+						"uid":        "1",
+					},
+					map[string]interface{}{
+						"kind":       "Pod",
+						"name":       "podb",
+						"apiVersion": "v1",
+						"uid":        "2",
+						// though these fields are of type *bool, but when
+						// decoded from JSON, they are unmarshalled as bool.
+						"controller":         true,
+						"blockOwnerDeletion": true,
+					},
+				},
+				"finalizers": []interface{}{
+					"finalizer.1",
+					"finalizer.2",
+				},
+			},
+		},
+	}
+
+	if got, want := unstruct.GetAPIVersion(), "test_version"; got != want {
+		t.Errorf("GetAPIVersions() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetKind(), "test_kind"; got != want {
+		t.Errorf("GetKind() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetNamespace(), "test_namespace"; got != want {
+		t.Errorf("GetNamespace() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetName(), "test_name"; got != want {
+		t.Errorf("GetName() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetGenerateName(), "test_generateName"; got != want {
+		t.Errorf("GetGenerateName() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetUID(), types.UID("test_uid"); got != want {
+		t.Errorf("GetUID() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetResourceVersion(), "test_resourceVersion"; got != want {
+		t.Errorf("GetResourceVersion() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetSelfLink(), "test_selfLink"; got != want {
+		t.Errorf("GetSelfLink() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetCreationTimestamp(), metav1.Date(2009, time.November, 10, 23, 0, 0, 0, time.UTC); !got.Equal(&want) {
+		t.Errorf("GetCreationTimestamp() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetDeletionTimestamp(), metav1.Date(2010, time.November, 10, 23, 0, 0, 0, time.UTC); got == nil || !got.Equal(&want) {
+		t.Errorf("GetDeletionTimestamp() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetLabels(), map[string]string{"test_label": "test_value"}; !reflect.DeepEqual(got, want) {
+		t.Errorf("GetLabels() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetAnnotations(), map[string]string{"test_annotation": "test_value"}; !reflect.DeepEqual(got, want) {
+		t.Errorf("GetAnnotations() = %s, want %s", got, want)
+	}
+	refs := unstruct.GetOwnerReferences()
+	expectedOwnerReferences := []metav1.OwnerReference{
+		{
+			Kind:       "Pod",
+			Name:       "poda",
+			APIVersion: "v1",
+			UID:        "1",
+		},
+		{
+			Kind:               "Pod",
+			Name:               "podb",
+			APIVersion:         "v1",
+			UID:                "2",
+			Controller:         &trueVar,
+			BlockOwnerDeletion: &trueVar,
+		},
+	}
+	if got, want := refs, expectedOwnerReferences; !reflect.DeepEqual(got, want) {
+		t.Errorf("GetOwnerReferences()=%v, want %v", got, want)
+	}
+	if got, want := unstruct.GetFinalizers(), []string{"finalizer.1", "finalizer.2"}; !reflect.DeepEqual(got, want) {
+		t.Errorf("GetFinalizers()=%v, want %v", got, want)
+	}
+	if got, want := unstruct.GetDeletionGracePeriodSeconds(), &ten; !reflect.DeepEqual(got, want) {
+		t.Errorf("GetDeletionGracePeriodSeconds()=%v, want %v", got, want)
+	}
+	if got, want := unstruct.GetGeneration(), ten; !reflect.DeepEqual(got, want) {
+		t.Errorf("GetGeneration()=%v, want %v", got, want)
+	}
+}
+
+func TestUnstructuredSetters(t *testing.T) {
+	unstruct := unstructured.Unstructured{}
+	trueVar := true
+	ten := int64(10)
+
+	want := unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"kind":       "test_kind",
+			"apiVersion": "test_version",
+			"metadata": map[string]interface{}{
+				"name":                       "test_name",
+				"namespace":                  "test_namespace",
+				"generateName":               "test_generateName",
+				"uid":                        "test_uid",
+				"resourceVersion":            "test_resourceVersion",
+				"selfLink":                   "test_selfLink",
+				"creationTimestamp":          "2009-11-10T23:00:00Z",
+				"deletionTimestamp":          "2010-11-10T23:00:00Z",
+				"deletionGracePeriodSeconds": ten,
+				"generation":                 ten,
+				"labels": map[string]interface{}{
+					"test_label": "test_value",
+				},
+				"annotations": map[string]interface{}{
+					"test_annotation": "test_value",
+				},
+				"ownerReferences": []interface{}{
+					map[string]interface{}{
+						"kind":       "Pod",
+						"name":       "poda",
+						"apiVersion": "v1",
+						"uid":        "1",
+					},
+					map[string]interface{}{
+						"kind":               "Pod",
+						"name":               "podb",
+						"apiVersion":         "v1",
+						"uid":                "2",
+						"controller":         true,
+						"blockOwnerDeletion": true,
+					},
+				},
+				"finalizers": []interface{}{
+					"finalizer.1",
+					"finalizer.2",
+				},
+			},
+		},
+	}
+
+	unstruct.SetAPIVersion("test_version")
+	unstruct.SetKind("test_kind")
+	unstruct.SetNamespace("test_namespace")
+	unstruct.SetName("test_name")
+	unstruct.SetGenerateName("test_generateName")
+	unstruct.SetUID(types.UID("test_uid"))
+	unstruct.SetResourceVersion("test_resourceVersion")
+	unstruct.SetSelfLink("test_selfLink")
+	unstruct.SetCreationTimestamp(metav1.Date(2009, time.November, 10, 23, 0, 0, 0, time.UTC))
+	date := metav1.Date(2010, time.November, 10, 23, 0, 0, 0, time.UTC)
+	unstruct.SetDeletionTimestamp(&date)
+	unstruct.SetLabels(map[string]string{"test_label": "test_value"})
+	unstruct.SetAnnotations(map[string]string{"test_annotation": "test_value"})
+	newOwnerReferences := []metav1.OwnerReference{
+		{
+			Kind:       "Pod",
+			Name:       "poda",
+			APIVersion: "v1",
+			UID:        "1",
+		},
+		{
+			Kind:               "Pod",
+			Name:               "podb",
+			APIVersion:         "v1",
+			UID:                "2",
+			Controller:         &trueVar,
+			BlockOwnerDeletion: &trueVar,
+		},
+	}
+	unstruct.SetOwnerReferences(newOwnerReferences)
+	unstruct.SetFinalizers([]string{"finalizer.1", "finalizer.2"})
+	unstruct.SetDeletionGracePeriodSeconds(&ten)
+	unstruct.SetGeneration(ten)
+
+	if !reflect.DeepEqual(unstruct, want) {
+		t.Errorf("Wanted: \n%s\n Got:\n%s", want, unstruct)
+	}
+}
+
+func TestOwnerReferences(t *testing.T) {
+	t.Parallel()
+	trueVar := true
+	falseVar := false
+	refs := []metav1.OwnerReference{
+		{
+			APIVersion: "v2",
+			Kind:       "K2",
+			Name:       "n2",
+			UID:        types.UID("abc1"),
+		},
+		{
+			APIVersion:         "v1",
+			Kind:               "K1",
+			Name:               "n1",
+			UID:                types.UID("abc2"),
+			Controller:         &trueVar,
+			BlockOwnerDeletion: &falseVar,
+		},
+		{
+			APIVersion:         "v3",
+			Kind:               "K3",
+			Name:               "n3",
+			UID:                types.UID("abc3"),
+			Controller:         &falseVar,
+			BlockOwnerDeletion: &trueVar,
+		},
+	}
+	for i, ref := range refs {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			t.Parallel()
+			u1 := unstructured.Unstructured{
+				Object: make(map[string]interface{}),
+			}
+			refsX := []metav1.OwnerReference{ref}
+			u1.SetOwnerReferences(refsX)
+
+			have := u1.GetOwnerReferences()
+			if !reflect.DeepEqual(have, refsX) {
+				t.Errorf("Object references are not the same: %#v != %#v", have, refsX)
+			}
+		})
+	}
+}
+
+func TestUnstructuredListGetters(t *testing.T) {
+	unstruct := unstructured.UnstructuredList{
+		Object: map[string]interface{}{
+			"kind":       "test_kind",
+			"apiVersion": "test_version",
+			"metadata": map[string]interface{}{
+				"resourceVersion": "test_resourceVersion",
+				"selfLink":        "test_selfLink",
+			},
+		},
+	}
+
+	if got, want := unstruct.GetAPIVersion(), "test_version"; got != want {
+		t.Errorf("GetAPIVersions() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetKind(), "test_kind"; got != want {
+		t.Errorf("GetKind() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetResourceVersion(), "test_resourceVersion"; got != want {
+		t.Errorf("GetResourceVersion() = %s, want %s", got, want)
+	}
+
+	if got, want := unstruct.GetSelfLink(), "test_selfLink"; got != want {
+		t.Errorf("GetSelfLink() = %s, want %s", got, want)
+	}
+}
+
+func TestUnstructuredListSetters(t *testing.T) {
+	unstruct := unstructured.UnstructuredList{}
+
+	want := unstructured.UnstructuredList{
+		Object: map[string]interface{}{
+			"kind":       "test_kind",
+			"apiVersion": "test_version",
+			"metadata": map[string]interface{}{
+				"resourceVersion": "test_resourceVersion",
+				"selfLink":        "test_selfLink",
+			},
+		},
+	}
+
+	unstruct.SetAPIVersion("test_version")
+	unstruct.SetKind("test_kind")
+	unstruct.SetResourceVersion("test_resourceVersion")
+	unstruct.SetSelfLink("test_selfLink")
+
+	if !reflect.DeepEqual(unstruct, want) {
+		t.Errorf("Wanted: \n%s\n Got:\n%s", unstruct, want)
+	}
+}
+
+func TestDecodeNumbers(t *testing.T) {
+
+	// Start with a valid pod
+	originalJSON := []byte(`{
+		"kind":"Carp",
+		"apiVersion":"v1",
+		"metadata":{"name":"pod","namespace":"foo"},
+		"spec":{
+			"containers":[{"name":"container","image":"container"}],
+			"activeDeadlineSeconds":1000030003
+		}
+	}`)
+
+	pod := &testapigroup.Carp{}
+
+	_, codecs := TestScheme()
+	codec := apitesting.TestCodec(codecs, schema.GroupVersion{Group: "", Version: runtime.APIVersionInternal})
+
+	err := runtime.DecodeInto(codec, originalJSON, pod)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Round-trip with unstructured codec
+	unstructuredObj, err := runtime.Decode(unstructured.UnstructuredJSONScheme, originalJSON)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	roundtripJSON, err := runtime.Encode(unstructured.UnstructuredJSONScheme, unstructuredObj)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Make sure we serialize back out in int form
+	if !strings.Contains(string(roundtripJSON), `"activeDeadlineSeconds":1000030003`) {
+		t.Errorf("Expected %s, got %s", `"activeDeadlineSeconds":1000030003`, string(roundtripJSON))
+	}
+
+	// Decode with structured codec again
+	obj2, err := runtime.Decode(codec, roundtripJSON)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	// ensure pod is still valid
+	pod2, ok := obj2.(*testapigroup.Carp)
+	if !ok {
+		t.Fatalf("expected an *api.Pod, got %#v", obj2)
+	}
+
+	// ensure round-trip preserved large integers
+	if !reflect.DeepEqual(pod, pod2) {
+		t.Fatalf("Expected\n\t%#v, got \n\t%#v", pod, pod2)
+	}
+}
+
+// TestAccessorMethods does opaque roundtrip testing against an Unstructured
+// instance's Object methods to ensure that what is "Set" matches what you
+// subsequently "Get" without any assertions against internal state.
+func TestAccessorMethods(t *testing.T) {
+	int64p := func(i int) *int64 {
+		v := int64(i)
+		return &v
+	}
+	tests := []struct {
+		accessor string
+		val      interface{}
+		nilVal   reflect.Value
+	}{
+		{accessor: "Namespace", val: "foo"},
+		{accessor: "Name", val: "bar"},
+		{accessor: "GenerateName", val: "baz"},
+		{accessor: "UID", val: types.UID("uid")},
+		{accessor: "ResourceVersion", val: "1"},
+		{accessor: "Generation", val: int64(5)},
+		{accessor: "SelfLink", val: "/foo"},
+		// TODO: Handle timestamps, which are being marshalled as UTC and
+		// unmarshalled as Local.
+		// https://github.com/kubernetes/kubernetes/issues/21402
+		// {accessor: "CreationTimestamp", val: someTime},
+		// {accessor: "DeletionTimestamp", val: someTimeP},
+		{accessor: "DeletionTimestamp", nilVal: reflect.ValueOf((*metav1.Time)(nil))},
+		{accessor: "DeletionGracePeriodSeconds", val: int64p(10)},
+		{accessor: "DeletionGracePeriodSeconds", val: int64p(0)},
+		{accessor: "DeletionGracePeriodSeconds", nilVal: reflect.ValueOf((*int64)(nil))},
+		{accessor: "Labels", val: map[string]string{"foo": "bar"}},
+		{accessor: "Annotations", val: map[string]string{"foo": "bar"}},
+		{accessor: "Finalizers", val: []string{"foo"}},
+		{accessor: "OwnerReferences", val: []metav1.OwnerReference{{Name: "foo"}}},
+	}
+	for i, test := range tests {
+		t.Logf("evaluating test %d (%s)", i, test.accessor)
+
+		u := &unstructured.Unstructured{}
+		setter := reflect.ValueOf(u).MethodByName("Set" + test.accessor)
+		getter := reflect.ValueOf(u).MethodByName("Get" + test.accessor)
+
+		args := []reflect.Value{}
+		if test.val != nil {
+			args = append(args, reflect.ValueOf(test.val))
+		} else {
+			args = append(args, test.nilVal)
+		}
+		setter.Call(args)
+
+		ret := getter.Call([]reflect.Value{})
+		actual := ret[0].Interface()
+
+		var expected interface{}
+		if test.val != nil {
+			expected = test.val
+		} else {
+			expected = test.nilVal.Interface()
+		}
+
+		if e, a := expected, actual; !reflect.DeepEqual(e, a) {
+			t.Fatalf("%s: expected %v (%T), got %v (%T)", test.accessor, e, e, a, a)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/test/coverage/coverage.go b/third_party/k8s.io/apimachinery/pkg/test/coverage/coverage.go
new file mode 100644
index 0000000000..8482042a4a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/test/coverage/coverage.go
@@ -0,0 +1,156 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package coverage
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+	"sync"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Rule is one declared field-validation error: error type plus optional origin.
+type Rule struct {
+	ErrorType string
+	Origin    string
+}
+
+// FieldRules maps field path → declared rules for a single Kind.
+type FieldRules map[string][]Rule
+
+// ruleKey is the flat identity of one declared-or-observed rule across the
+// whole test process.
+type ruleKey struct {
+	gvk       schema.GroupVersionKind
+	path      string
+	errorType string
+	origin    string
+}
+
+// indexKeyRe normalizes runtime path subscripts ("[0]", "[my-key]") to "[*]"
+// so observed paths line up with the canonical paths from validation-gen.
+var indexKeyRe = regexp.MustCompile(`\[[^\]]+\]`)
+
+var (
+	rulesMu       sync.Mutex
+	declared      = sets.New[ruleKey]()
+	observed      = sets.New[ruleKey]()
+	nilPathString = (*field.Path)(nil).String()
+)
+
+// RegisterDeclaredRules records the rules declared for one GVK by
+// validation-gen.
+func RegisterDeclaredRules(gvk schema.GroupVersionKind, rules FieldRules) {
+	rulesMu.Lock()
+	defer rulesMu.Unlock()
+	for path, rs := range rules {
+		for _, r := range rs {
+			declared.Insert(ruleKey{gvk: gvk, path: path, errorType: r.ErrorType, origin: r.Origin})
+		}
+	}
+}
+
+// RecordObservedRules marks every error in errs as observed for the given GVK.
+// Idempotent per (GVK, path, errorType, origin). Callers compute the GVK from
+// whatever context they have (e.g., a runtime scheme + request info).
+func RecordObservedRules(gvk schema.GroupVersionKind, errs field.ErrorList) {
+	rulesMu.Lock()
+	defer rulesMu.Unlock()
+	// Runtime errors carry the actual subscript ("spec.items[3]",
+	// "metadata.labels[my-key]"); declared paths use "[*]". Replace every
+	// "[...]" with "[*]" so the lookup in AssertDeclarativeCoverage matches.
+	for _, e := range errs {
+		path := e.Field
+		if path == nilPathString {
+			path = ""
+		}
+		path = indexKeyRe.ReplaceAllString(path, "[*]")
+		observed.Insert(ruleKey{gvk: gvk, path: path, errorType: string(e.Type), origin: e.Origin})
+	}
+}
+
+// AssertDeclarativeCoverage returns nil if every rule registered via
+// RegisterDeclaredRules was observed at least once during this test process;
+// otherwise an error listing the uncovered rules.
+func AssertDeclarativeCoverage() error {
+	rulesMu.Lock()
+	uncovered := declared.Difference(observed).UnsortedList()
+	rulesMu.Unlock()
+	if len(uncovered) == 0 {
+		return nil
+	}
+	return fmt.Errorf("%d uncovered declarative-validation rules:\n%s", len(uncovered), formatUncovered(uncovered))
+}
+
+// formatUncovered renders uncovered rules grouped by GVK, one rule per line.
+// GVKs are sorted by group/version/kind; rules within a GVK by path/errorType/origin.
+//
+// Example:
+//
+//	example.com/v1, Kind=Widget:
+//	  spec.name  FieldValueRequired
+//	  spec.name  FieldValueInvalid origin="format=dns-label"
+func formatUncovered(uncovered []ruleKey) string {
+	gvksToRules := map[schema.GroupVersionKind][]ruleKey{}
+	for _, k := range uncovered {
+		gvksToRules[k.gvk] = append(gvksToRules[k.gvk], k)
+	}
+	gvks := make([]schema.GroupVersionKind, 0, len(gvksToRules))
+	for gvk := range gvksToRules {
+		gvks = append(gvks, gvk)
+	}
+	sort.Slice(gvks, func(i, j int) bool {
+		if gvks[i].Group != gvks[j].Group {
+			return gvks[i].Group < gvks[j].Group
+		}
+		if gvks[i].Version != gvks[j].Version {
+			return gvks[i].Version < gvks[j].Version
+		}
+		return gvks[i].Kind < gvks[j].Kind
+	})
+	var sb strings.Builder
+	for _, gvk := range gvks {
+		gv := gvk.Group + "/" + gvk.Version
+		if gvk.Group == "" {
+			gv = gvk.Version
+		}
+		fmt.Fprintf(&sb, "%s, Kind=%s:\n", gv, gvk.Kind)
+		keys := gvksToRules[gvk]
+		sort.Slice(keys, func(i, j int) bool {
+			if keys[i].path != keys[j].path {
+				return keys[i].path < keys[j].path
+			}
+			if keys[i].errorType != keys[j].errorType {
+				return keys[i].errorType < keys[j].errorType
+			}
+			return keys[i].origin < keys[j].origin
+		})
+		for _, k := range keys {
+			if k.origin != "" {
+				fmt.Fprintf(&sb, "  %s  %s origin=%q\n", k.path, k.errorType, k.origin)
+			} else {
+				fmt.Fprintf(&sb, "  %s  %s\n", k.path, k.errorType)
+			}
+		}
+	}
+	return sb.String()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/test/runtime_helper_test.go b/third_party/k8s.io/apimachinery/pkg/test/runtime_helper_test.go
new file mode 100644
index 0000000000..31e6e7af5c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/test/runtime_helper_test.go
@@ -0,0 +1,49 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	"testing"
+
+	apitesting "k8s.io/apimachinery/pkg/api/apitesting"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func TestDecodeList(t *testing.T) {
+	pl := List{
+		Items: []runtime.Object{
+			&testapigroup.Carp{ObjectMeta: metav1.ObjectMeta{Name: "1"}},
+			&runtime.Unknown{
+				TypeMeta:    runtime.TypeMeta{Kind: "Carp", APIVersion: "v1"},
+				Raw:         []byte(`{"kind":"Carp","apiVersion":"` + "v1" + `","metadata":{"name":"test"}}`),
+				ContentType: runtime.ContentTypeJSON,
+			},
+		},
+	}
+
+	_, codecs := TestScheme()
+	Codec := apitesting.TestCodec(codecs, testapigroup.SchemeGroupVersion)
+
+	if errs := runtime.DecodeList(pl.Items, Codec); len(errs) != 0 {
+		t.Fatalf("unexpected error %v", errs)
+	}
+	if pod, ok := pl.Items[1].(*testapigroup.Carp); !ok || pod.Name != "test" {
+		t.Errorf("object not converted: %#v", pl.Items[1])
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/test/runtime_serializer_protobuf_protobuf_test.go b/third_party/k8s.io/apimachinery/pkg/test/runtime_serializer_protobuf_protobuf_test.go
new file mode 100644
index 0000000000..75c26ca8cb
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/test/runtime_serializer_protobuf_protobuf_test.go
@@ -0,0 +1,362 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	"bytes"
+	"encoding/hex"
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer/protobuf"
+)
+
+type testObject struct {
+	gvk schema.GroupVersionKind
+}
+
+func (d *testObject) GetObjectKind() schema.ObjectKind                { return d }
+func (d *testObject) SetGroupVersionKind(gvk schema.GroupVersionKind) { d.gvk = gvk }
+func (d *testObject) GroupVersionKind() schema.GroupVersionKind       { return d.gvk }
+func (d *testObject) DeepCopyObject() runtime.Object {
+	panic("testObject does not support DeepCopy")
+}
+
+type testMarshalable struct {
+	testObject
+	data []byte
+	err  error
+}
+
+func (d *testMarshalable) Marshal() ([]byte, error) {
+	return d.data, d.err
+}
+
+func (d *testMarshalable) DeepCopyObject() runtime.Object {
+	panic("testMarshalable does not support DeepCopy")
+}
+
+type testBufferedMarshalable struct {
+	testObject
+	data []byte
+	err  error
+}
+
+func (d *testBufferedMarshalable) Marshal() ([]byte, error) {
+	return nil, fmt.Errorf("not invokable")
+}
+
+func (d *testBufferedMarshalable) MarshalTo(data []byte) (int, error) {
+	copy(data, d.data)
+	return len(d.data), d.err
+}
+
+func (d *testBufferedMarshalable) Size() int {
+	return len(d.data)
+}
+
+func (d *testBufferedMarshalable) DeepCopyObject() runtime.Object {
+	panic("testBufferedMarshalable does not support DeepCopy")
+}
+
+func TestRecognize(t *testing.T) {
+	s := protobuf.NewSerializer(nil, nil)
+	ignores := [][]byte{
+		nil,
+		{},
+		[]byte("k8s"),
+		{0x6b, 0x38, 0x73, 0x01},
+	}
+	for i, data := range ignores {
+		if ok, _, err := s.RecognizesData(data); err != nil || ok {
+			t.Errorf("%d: should not recognize data: %v", i, err)
+		}
+	}
+	recognizes := [][]byte{
+		{0x6b, 0x38, 0x73, 0x00},
+		{0x6b, 0x38, 0x73, 0x00, 0x01},
+	}
+	for i, data := range recognizes {
+		if ok, _, err := s.RecognizesData(data); err != nil || !ok {
+			t.Errorf("%d: should recognize data: %v", i, err)
+		}
+	}
+}
+
+func TestEncode(t *testing.T) {
+	obj1 := &testMarshalable{testObject: testObject{}, data: []byte{}}
+	wire1 := []byte{
+		0x6b, 0x38, 0x73, 0x00, // prefix
+		0x0a, 0x04,
+		0x0a, 0x00, // apiversion
+		0x12, 0x00, // kind
+		0x12, 0x00, // data
+		0x1a, 0x00, // content-type
+		0x22, 0x00, // content-encoding
+	}
+	obj2 := &testMarshalable{
+		testObject: testObject{gvk: schema.GroupVersionKind{Kind: "test", Group: "other", Version: "version"}},
+		data:       []byte{0x01, 0x02, 0x03},
+	}
+	wire2 := []byte{
+		0x6b, 0x38, 0x73, 0x00, // prefix
+		0x0a, 0x15,
+		0x0a, 0x0d, 0x6f, 0x74, 0x68, 0x65, 0x72, 0x2f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, // apiversion
+		0x12, 0x04, 0x74, 0x65, 0x73, 0x74, // kind
+		0x12, 0x03, 0x01, 0x02, 0x03, // data
+		0x1a, 0x00, // content-type
+		0x22, 0x00, // content-encoding
+	}
+
+	err1 := fmt.Errorf("a test error")
+
+	testCases := []struct {
+		obj   runtime.Object
+		data  []byte
+		errFn func(error) bool
+	}{
+		{
+			obj:   &testObject{},
+			errFn: protobuf.IsNotMarshalable,
+		},
+		{
+			obj:  obj1,
+			data: wire1,
+		},
+		{
+			obj:   &testMarshalable{testObject: obj1.testObject, err: err1},
+			errFn: func(err error) bool { return err == err1 },
+		},
+		{
+			// if this test fails, writing the "fast path" marshal is not the same as the "slow path"
+			obj:  &testBufferedMarshalable{testObject: obj1.testObject, data: obj1.data},
+			data: wire1,
+		},
+		{
+			obj:  obj2,
+			data: wire2,
+		},
+		{
+			// if this test fails, writing the "fast path" marshal is not the same as the "slow path"
+			obj:  &testBufferedMarshalable{testObject: obj2.testObject, data: obj2.data},
+			data: wire2,
+		},
+		{
+			obj:   &testBufferedMarshalable{testObject: obj1.testObject, err: err1},
+			errFn: func(err error) bool { return err == err1 },
+		},
+	}
+
+	for i, test := range testCases {
+		s := protobuf.NewSerializer(nil, nil)
+		data, err := runtime.Encode(s, test.obj)
+
+		switch {
+		case err == nil && test.errFn != nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil && test.errFn == nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil:
+			if !test.errFn(err) {
+				t.Errorf("%d: failed: %v", i, err)
+			}
+			if data != nil {
+				t.Errorf("%d: should not have returned nil data", i)
+			}
+			continue
+		}
+
+		if test.data != nil && !bytes.Equal(test.data, data) {
+			t.Errorf("%d: unexpected data:\n%s", i, hex.Dump(data))
+			continue
+		}
+
+		if ok, _, err := s.RecognizesData(data); !ok || err != nil {
+			t.Errorf("%d: did not recognize data generated by call: %v", i, err)
+		}
+	}
+}
+
+func TestProtobufDecode(t *testing.T) {
+	wire1 := []byte{
+		0x6b, 0x38, 0x73, 0x00, // prefix
+		0x0a, 0x04,
+		0x0a, 0x00, // apiversion
+		0x12, 0x00, // kind
+		0x12, 0x00, // data
+		0x1a, 0x00, // content-type
+		0x22, 0x00, // content-encoding
+	}
+	wire2 := []byte{
+		0x6b, 0x38, 0x73, 0x00, // prefix
+		0x0a, 0x15,
+		0x0a, 0x0d, 0x6f, 0x74, 0x68, 0x65, 0x72, 0x2f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, // apiversion
+		0x12, 0x04, 0x74, 0x65, 0x73, 0x74, // kind
+		0x12, 0x07, 0x6b, 0x38, 0x73, 0x00, 0x01, 0x02, 0x03, // data
+		0x1a, 0x00, // content-type
+		0x22, 0x00, // content-encoding
+	}
+
+	testCases := []struct {
+		obj   runtime.Object
+		data  []byte
+		errFn func(error) bool
+	}{
+		{
+			obj:   &runtime.Unknown{},
+			errFn: func(err error) bool { return err.Error() == "empty data" },
+		},
+		{
+			data:  []byte{0x6b},
+			errFn: func(err error) bool { return strings.Contains(err.Error(), "does not appear to be a protobuf message") },
+		},
+		{
+			obj: &runtime.Unknown{
+				Raw: []byte{},
+			},
+			data: wire1,
+		},
+		{
+			obj: &runtime.Unknown{
+				TypeMeta: runtime.TypeMeta{
+					APIVersion: "other/version",
+					Kind:       "test",
+				},
+				// content type is set because the prefix matches the content
+				ContentType: runtime.ContentTypeProtobuf,
+				Raw:         []byte{0x6b, 0x38, 0x73, 0x00, 0x01, 0x02, 0x03},
+			},
+			data: wire2,
+		},
+	}
+
+	for i, test := range testCases {
+		s := protobuf.NewSerializer(nil, nil)
+		unk := &runtime.Unknown{}
+		err := runtime.DecodeInto(s, test.data, unk)
+
+		switch {
+		case err == nil && test.errFn != nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil && test.errFn == nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil:
+			if !test.errFn(err) {
+				t.Errorf("%d: failed: %v", i, err)
+			}
+			continue
+		}
+
+		if !reflect.DeepEqual(unk, test.obj) {
+			t.Errorf("%d: unexpected object:\n%#v", i, unk)
+			continue
+		}
+	}
+}
+
+func TestDecodeObjects(t *testing.T) {
+	obj1 := &v1.Carp{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "cool",
+		},
+		Spec: v1.CarpSpec{
+			Hostname: "coolhost",
+		},
+	}
+	obj1wire, err := obj1.Marshal()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	wire1, err := (&runtime.Unknown{
+		TypeMeta: runtime.TypeMeta{Kind: "Carp", APIVersion: "v1"},
+		Raw:      obj1wire,
+	}).Marshal()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	unk2 := &runtime.Unknown{
+		TypeMeta: runtime.TypeMeta{Kind: "Carp", APIVersion: "v1"},
+	}
+	wire2 := make([]byte, len(wire1)*2)
+	n, err := unk2.NestedMarshalTo(wire2, obj1, uint64(obj1.Size()))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n != len(wire1) || !bytes.Equal(wire1, wire2[:n]) {
+		t.Fatalf("unexpected wire:\n%s", hex.Dump(wire2[:n]))
+	}
+
+	wire1 = append([]byte{0x6b, 0x38, 0x73, 0x00}, wire1...)
+
+	obj1WithKind := obj1.DeepCopyObject()
+	obj1WithKind.GetObjectKind().SetGroupVersionKind(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Carp"})
+	testCases := []struct {
+		obj   runtime.Object
+		data  []byte
+		errFn func(error) bool
+	}{
+		{
+			obj:  obj1WithKind,
+			data: wire1,
+		},
+	}
+	scheme := runtime.NewScheme()
+	for i, test := range testCases {
+		scheme.AddKnownTypes(schema.GroupVersion{Version: "v1"}, &v1.Carp{})
+		require.NoError(t, v1.AddToScheme(scheme))
+		s := protobuf.NewSerializer(scheme, scheme)
+		obj, err := runtime.Decode(s, test.data)
+
+		switch {
+		case err == nil && test.errFn != nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil && test.errFn == nil:
+			t.Errorf("%d: failed: %v", i, err)
+			continue
+		case err != nil:
+			if !test.errFn(err) {
+				t.Errorf("%d: failed: %v", i, err)
+			}
+			if obj != nil {
+				t.Errorf("%d: should not have returned an object", i)
+			}
+			continue
+		}
+
+		if !apiequality.Semantic.DeepEqual(obj, test.obj) {
+			t.Errorf("%d: unexpected object:\n%s", i, cmp.Diff(test.obj, obj))
+			continue
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/test/runtime_unversioned_test.go b/third_party/k8s.io/apimachinery/pkg/test/runtime_unversioned_test.go
new file mode 100644
index 0000000000..fc8c176480
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/test/runtime_unversioned_test.go
@@ -0,0 +1,97 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+
+	// TODO: Ideally we should create the necessary package structure in e.g.,
+	// pkg/conversion/test/... instead of importing pkg/api here.
+	apitesting "k8s.io/apimachinery/pkg/api/apitesting"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestV1EncodeDecodeStatus(t *testing.T) {
+	status := &metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    200,
+		Reason:  metav1.StatusReasonUnknown,
+		Message: "",
+	}
+
+	_, codecs := TestScheme()
+	codec := apitesting.TestCodec(codecs, schema.GroupVersion{Group: "", Version: runtime.APIVersionInternal})
+
+	encoded, err := runtime.Encode(codec, status)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	typeMeta := metav1.TypeMeta{}
+	if err := json.Unmarshal(encoded, &typeMeta); err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if typeMeta.Kind != "Status" {
+		t.Errorf("Kind is not set to \"Status\". Got %v", string(encoded))
+	}
+	if typeMeta.APIVersion != "v1" {
+		t.Errorf("APIVersion is not set to \"v1\". Got %v", string(encoded))
+	}
+	decoded, err := runtime.Decode(codec, encoded)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if !reflect.DeepEqual(status, decoded) {
+		t.Errorf("expected: %v, got: %v", status, decoded)
+	}
+}
+
+func TestExperimentalEncodeDecodeStatus(t *testing.T) {
+	status := &metav1.Status{
+		Status:  metav1.StatusFailure,
+		Code:    200,
+		Reason:  metav1.StatusReasonUnknown,
+		Message: "",
+	}
+	_, codecs := TestScheme()
+	expCodec := apitesting.TestCodec(codecs, schema.GroupVersion{Group: "", Version: runtime.APIVersionInternal})
+
+	encoded, err := runtime.Encode(expCodec, status)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	typeMeta := metav1.TypeMeta{}
+	if err := json.Unmarshal(encoded, &typeMeta); err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if typeMeta.Kind != "Status" {
+		t.Errorf("Kind is not set to \"Status\". Got %s", encoded)
+	}
+	if typeMeta.APIVersion != "v1" {
+		t.Errorf("APIVersion is not set to \"\". Got %s", encoded)
+	}
+	decoded, err := runtime.Decode(expCodec, encoded)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if !reflect.DeepEqual(status, decoded) {
+		t.Errorf("expected: %v, got: %v", status, decoded)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/test/util.go b/third_party/k8s.io/apimachinery/pkg/test/util.go
new file mode 100644
index 0000000000..9b6dac094e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/test/util.go
@@ -0,0 +1,70 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/testapigroup"
+	"k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	apiserializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// List and ListV1 should be kept in sync with k8s.io/kubernetes/pkg/api#List
+// and k8s.io/api/core/v1#List.
+//
+// +k8s:deepcopy-gen=true
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type List struct {
+	metav1.TypeMeta
+	metav1.ListMeta
+
+	Items []runtime.Object
+}
+
+// +k8s:deepcopy-gen=true
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type ListV1 struct {
+	metav1.TypeMeta `json:""`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	Items []runtime.RawExtension `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func TestScheme() (*runtime.Scheme, apiserializer.CodecFactory) {
+	internalGV := schema.GroupVersion{Group: "", Version: runtime.APIVersionInternal}
+	externalGV := schema.GroupVersion{Group: "", Version: "v1"}
+	scheme := runtime.NewScheme()
+
+	scheme.AddKnownTypes(internalGV,
+		&testapigroup.Carp{},
+		&testapigroup.CarpList{},
+		&List{},
+	)
+	scheme.AddKnownTypes(externalGV,
+		&v1.Carp{},
+		&v1.CarpList{},
+		&List{},
+	)
+	utilruntime.Must(testapigroup.AddToScheme(scheme))
+	utilruntime.Must(v1.AddToScheme(scheme))
+
+	codecs := apiserializer.NewCodecFactory(scheme)
+	return scheme, codecs
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/test/zz_generated.deepcopy.go b/third_party/k8s.io/apimachinery/pkg/test/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..b86d609211
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/test/zz_generated.deepcopy.go
@@ -0,0 +1,94 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package test
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *List) DeepCopyInto(out *List) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.Object, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				(*out)[i] = (*in)[i].DeepCopyObject()
+			}
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new List.
+func (in *List) DeepCopy() *List {
+	if in == nil {
+		return nil
+	}
+	out := new(List)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *List) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListV1) DeepCopyInto(out *ListV1) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]runtime.RawExtension, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListV1.
+func (in *ListV1) DeepCopy() *ListV1 {
+	if in == nil {
+		return nil
+	}
+	out := new(ListV1)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ListV1) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/types/doc.go b/third_party/k8s.io/apimachinery/pkg/types/doc.go
new file mode 100644
index 0000000000..783cbcdc8d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/types/doc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package types implements various generic types used throughout kubernetes.
+package types
diff --git a/third_party/k8s.io/apimachinery/pkg/types/namespacedname.go b/third_party/k8s.io/apimachinery/pkg/types/namespacedname.go
new file mode 100644
index 0000000000..db18ce1ce2
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/types/namespacedname.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+// NamespacedName comprises a resource name, with a mandatory namespace,
+// rendered as "<namespace>/<name>".  Being a type captures intent and
+// helps make sure that UIDs, namespaced names and non-namespaced names
+// do not get conflated in code.  For most use cases, namespace and name
+// will already have been format validated at the API entry point, so we
+// don't do that here.  Where that's not the case (e.g. in testing),
+// consider using NamespacedNameOrDie() in testing.go in this package.
+
+type NamespacedName struct {
+	Namespace string
+	Name      string
+}
+
+const (
+	Separator = '/'
+)
+
+// String returns the general purpose string representation
+func (n NamespacedName) String() string {
+	return n.Namespace + string(Separator) + n.Name
+}
+
+// MarshalLog emits a struct containing required key/value pair
+func (n NamespacedName) MarshalLog() interface{} {
+	return struct {
+		Name      string `json:"name"`
+		Namespace string `json:"namespace,omitempty"`
+	}{
+		Name:      n.Name,
+		Namespace: n.Namespace,
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/types/nodename.go b/third_party/k8s.io/apimachinery/pkg/types/nodename.go
new file mode 100644
index 0000000000..cff9ca6717
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/types/nodename.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+// NodeName is a type that holds a api.Node's Name identifier.
+// Being a type captures intent and helps make sure that the node name
+// is not confused with similar concepts (the hostname, the cloud provider id,
+// the cloud provider name etc)
+//
+// To clarify the various types:
+//
+//   - Node.Name is the Name field of the Node in the API.  This should be stored in a NodeName.
+//     Unfortunately, because Name is part of ObjectMeta, we can't store it as a NodeName at the API level.
+//
+//   - Hostname is the hostname of the local machine (from uname -n).
+//     However, some components allow the user to pass in a --hostname-override flag,
+//     which will override this in most places. In the absence of anything more meaningful,
+//     kubelet will use Hostname as the Node.Name when it creates the Node.
+//
+// * The cloudproviders have the own names: GCE has InstanceName, AWS has InstanceId.
+//
+//	For GCE, InstanceName is the Name of an Instance object in the GCE API.  On GCE, Instance.Name becomes the
+//	Hostname, and thus it makes sense also to use it as the Node.Name.  But that is GCE specific, and it is up
+//	to the cloudprovider how to do this mapping.
+//
+//	For AWS, the InstanceID is not yet suitable for use as a Node.Name, so we actually use the
+//	PrivateDnsName for the Node.Name.  And this is _not_ always the same as the hostname: if
+//	we are using a custom DHCP domain it won't be.
+type NodeName string
diff --git a/third_party/k8s.io/apimachinery/pkg/types/patch.go b/third_party/k8s.io/apimachinery/pkg/types/patch.go
new file mode 100644
index 0000000000..d338cf213d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/types/patch.go
@@ -0,0 +1,31 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+// Similarly to above, these are constants to support HTTP PATCH utilized by
+// both the client and server that didn't make sense for a whole package to be
+// dedicated to.
+type PatchType string
+
+const (
+	JSONPatchType           PatchType = "application/json-patch+json"
+	MergePatchType          PatchType = "application/merge-patch+json"
+	StrategicMergePatchType PatchType = "application/strategic-merge-patch+json"
+	ApplyPatchType          PatchType = ApplyYAMLPatchType
+	ApplyYAMLPatchType      PatchType = "application/apply-patch+yaml"
+	ApplyCBORPatchType      PatchType = "application/apply-patch+cbor"
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/types/uid.go b/third_party/k8s.io/apimachinery/pkg/types/uid.go
new file mode 100644
index 0000000000..869339222e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/types/uid.go
@@ -0,0 +1,22 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+// UID is a type that holds unique ID values, including UUIDs.  Because we
+// don't ONLY use UUIDs, this is an alias to string.  Being a type captures
+// intent and helps make sure that UIDs and names do not get conflated.
+type UID string
diff --git a/third_party/k8s.io/apimachinery/pkg/util/OWNERS b/third_party/k8s.io/apimachinery/pkg/util/OWNERS
new file mode 100644
index 0000000000..e610094242
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/OWNERS
@@ -0,0 +1,4 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+  - apelisse
diff --git a/third_party/k8s.io/apimachinery/pkg/util/cache/expiring.go b/third_party/k8s.io/apimachinery/pkg/util/cache/expiring.go
new file mode 100644
index 0000000000..1396274c7b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/cache/expiring.go
@@ -0,0 +1,202 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cache
+
+import (
+	"container/heap"
+	"sync"
+	"time"
+
+	"k8s.io/utils/clock"
+)
+
+// NewExpiring returns an initialized expiring cache.
+func NewExpiring() *Expiring {
+	return NewExpiringWithClock(clock.RealClock{})
+}
+
+// NewExpiringWithClock is like NewExpiring but allows passing in a custom
+// clock for testing.
+func NewExpiringWithClock(clock clock.Clock) *Expiring {
+	return &Expiring{
+		clock: clock,
+		cache: make(map[interface{}]entry),
+	}
+}
+
+// Expiring is a map whose entries expire after a per-entry timeout.
+type Expiring struct {
+	// AllowExpiredGet causes the expiration check to be skipped on Get.
+	// It should only be used when a key always corresponds to the exact same value.
+	// Thus when this field is true, expired keys are considered valid
+	// until the next call to Set (which causes the GC to run).
+	// It may not be changed concurrently with calls to Get.
+	AllowExpiredGet bool
+
+	clock clock.Clock
+
+	// mu protects the below fields
+	mu sync.RWMutex
+	// cache is the internal map that backs the cache.
+	cache map[interface{}]entry
+	// generation is used as a cheap resource version for cache entries. Cleanups
+	// are scheduled with a key and generation. When the cleanup runs, it first
+	// compares its generation with the current generation of the entry. It
+	// deletes the entry iff the generation matches. This prevents cleanups
+	// scheduled for earlier versions of an entry from deleting later versions of
+	// an entry when Set() is called multiple times with the same key.
+	//
+	// The integer value of the generation of an entry is meaningless.
+	generation uint64
+
+	heap expiringHeap
+}
+
+type entry struct {
+	val        interface{}
+	expiry     time.Time
+	generation uint64
+}
+
+// Get looks up an entry in the cache.
+func (c *Expiring) Get(key interface{}) (val interface{}, ok bool) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	e, ok := c.cache[key]
+	if !ok {
+		return nil, false
+	}
+	if !c.AllowExpiredGet && !c.clock.Now().Before(e.expiry) {
+		return nil, false
+	}
+	return e.val, true
+}
+
+// Set sets a key/value/expiry entry in the map, overwriting any previous entry
+// with the same key. The entry expires at the given expiry time, but its TTL
+// may be lengthened or shortened by additional calls to Set(). Garbage
+// collection of expired entries occurs during calls to Set(), however calls to
+// Get() will not return expired entries that have not yet been garbage
+// collected.
+func (c *Expiring) Set(key interface{}, val interface{}, ttl time.Duration) {
+	now := c.clock.Now()
+	expiry := now.Add(ttl)
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.generation++
+
+	c.cache[key] = entry{
+		val:        val,
+		expiry:     expiry,
+		generation: c.generation,
+	}
+
+	// Run GC inline before pushing the new entry.
+	c.gc(now)
+
+	heap.Push(&c.heap, &expiringHeapEntry{
+		key:        key,
+		expiry:     expiry,
+		generation: c.generation,
+	})
+}
+
+// Delete deletes an entry in the map.
+func (c *Expiring) Delete(key interface{}) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.del(key, 0)
+}
+
+// del deletes the entry for the given key. The generation argument is the
+// generation of the entry that should be deleted. If the generation has been
+// changed (e.g. if a set has occurred on an existing element but the old
+// cleanup still runs), this is a noop. If the generation argument is 0, the
+// entry's generation is ignored and the entry is deleted.
+//
+// del must be called under the write lock.
+func (c *Expiring) del(key interface{}, generation uint64) {
+	e, ok := c.cache[key]
+	if !ok {
+		return
+	}
+	if generation != 0 && generation != e.generation {
+		return
+	}
+	delete(c.cache, key)
+}
+
+// Len returns the number of items in the cache.
+func (c *Expiring) Len() int {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return len(c.cache)
+}
+
+func (c *Expiring) gc(now time.Time) {
+	for {
+		// Return from gc if the heap is empty or the next element is not yet
+		// expired.
+		//
+		// heap[0] is a peek at the next element in the heap, which is not obvious
+		// from looking at the (*expiringHeap).Pop() implementation below.
+		// heap.Pop() swaps the first entry with the last entry of the heap, then
+		// calls (*expiringHeap).Pop() which returns the last element.
+		if len(c.heap) == 0 || now.Before(c.heap[0].expiry) {
+			return
+		}
+		cleanup := heap.Pop(&c.heap).(*expiringHeapEntry)
+		c.del(cleanup.key, cleanup.generation)
+	}
+}
+
+type expiringHeapEntry struct {
+	key        interface{}
+	expiry     time.Time
+	generation uint64
+}
+
+// expiringHeap is a min-heap ordered by expiration time of its entries. The
+// expiring cache uses this as a priority queue to efficiently organize entries
+// which will be garbage collected once they expire.
+type expiringHeap []*expiringHeapEntry
+
+var _ heap.Interface = &expiringHeap{}
+
+func (cq expiringHeap) Len() int {
+	return len(cq)
+}
+
+func (cq expiringHeap) Less(i, j int) bool {
+	return cq[i].expiry.Before(cq[j].expiry)
+}
+
+func (cq expiringHeap) Swap(i, j int) {
+	cq[i], cq[j] = cq[j], cq[i]
+}
+
+func (cq *expiringHeap) Push(c interface{}) {
+	*cq = append(*cq, c.(*expiringHeapEntry))
+}
+
+func (cq *expiringHeap) Pop() interface{} {
+	c := (*cq)[cq.Len()-1]
+	*cq = (*cq)[:cq.Len()-1]
+	return c
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/cache/expiring_test.go b/third_party/k8s.io/apimachinery/pkg/util/cache/expiring_test.go
new file mode 100644
index 0000000000..95e803308b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/cache/expiring_test.go
@@ -0,0 +1,321 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cache
+
+import (
+	"context"
+	"math/rand"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+
+	testingclock "k8s.io/utils/clock/testing"
+)
+
+func TestExpiringCache(t *testing.T) {
+	cache := NewExpiring()
+
+	if result, ok := cache.Get("foo"); ok || result != nil {
+		t.Errorf("Expected null, false, got %#v, %v", result, ok)
+	}
+
+	record1 := "bob"
+	record2 := "alice"
+
+	// when empty, record is stored
+	cache.Set("foo", record1, time.Hour)
+	if result, ok := cache.Get("foo"); !ok || result != record1 {
+		t.Errorf("Expected %#v, true, got %#v, %v", record1, result, ok)
+	}
+
+	// newer record overrides
+	cache.Set("foo", record2, time.Hour)
+	if result, ok := cache.Get("foo"); !ok || result != record2 {
+		t.Errorf("Expected %#v, true, got %#v, %v", record2, result, ok)
+	}
+
+	// delete the current value
+	cache.Delete("foo")
+	if result, ok := cache.Get("foo"); ok || result != nil {
+		t.Errorf("Expected null, false, got %#v, %v", result, ok)
+	}
+}
+
+func TestExpiration(t *testing.T) {
+	fc := &testingclock.FakeClock{}
+	c := NewExpiringWithClock(fc)
+
+	c.Set("a", "a", time.Second)
+
+	fc.Step(500 * time.Millisecond)
+	if _, ok := c.Get("a"); !ok {
+		t.Fatalf("we should have found a key")
+	}
+
+	fc.Step(time.Second)
+	if _, ok := c.Get("a"); ok {
+		t.Fatalf("we should not have found a key")
+	}
+
+	c.Set("a", "a", time.Second)
+
+	fc.Step(500 * time.Millisecond)
+	if _, ok := c.Get("a"); !ok {
+		t.Fatalf("we should have found a key")
+	}
+
+	// reset should restart the ttl
+	c.Set("a", "a", time.Second)
+
+	fc.Step(750 * time.Millisecond)
+	if _, ok := c.Get("a"); !ok {
+		t.Fatalf("we should have found a key")
+	}
+
+	// Simulate a race between a reset and cleanup. Assert that del doesn't
+	// remove the key.
+	c.Set("a", "a", time.Second)
+
+	e := c.cache["a"]
+	e.generation++
+	e.expiry = e.expiry.Add(1 * time.Second)
+	c.cache["a"] = e
+
+	fc.Step(1 * time.Second)
+	if _, ok := c.Get("a"); !ok {
+		t.Fatalf("we should have found a key")
+	}
+
+	// Check getting an expired key with and without AllowExpiredGet
+	c.Set("b", "b", time.Second)
+	fc.Step(2 * time.Second)
+	if _, ok := c.Get("b"); ok {
+		t.Fatalf("we should not have found b key")
+	}
+	if count := c.Len(); count != 2 { // b is still in the cache
+		t.Errorf("expected two items got: %d", count)
+	}
+	c.AllowExpiredGet = true
+	if _, ok := c.Get("b"); !ok {
+		t.Fatalf("we should have found b key")
+	}
+	if count := c.Len(); count != 2 { // b is still in the cache
+		t.Errorf("expected two items got: %d", count)
+	}
+	c.Set("c", "c", time.Second)      // set some unrelated key to run gc
+	if count := c.Len(); count != 2 { // only a and c in the cache now
+		t.Errorf("expected two items got: %d", count)
+	}
+	if _, ok := c.Get("b"); ok {
+		t.Fatalf("we should not have found b key")
+	}
+	if _, ok := c.Get("a"); !ok {
+		t.Fatalf("we should have found a key")
+	}
+	if _, ok := c.Get("c"); !ok {
+		t.Fatalf("we should have found c key")
+	}
+}
+
+func TestGarbageCollection(t *testing.T) {
+	fc := &testingclock.FakeClock{}
+
+	type entry struct {
+		key, val string
+		ttl      time.Duration
+	}
+
+	tests := []struct {
+		name string
+		now  time.Time
+		set  []entry
+		want map[string]string
+	}{
+		{
+			name: "two entries just set",
+			now:  fc.Now().Add(0 * time.Second),
+			set: []entry{
+				{"a", "aa", 1 * time.Second},
+				{"b", "bb", 2 * time.Second},
+			},
+			want: map[string]string{
+				"a": "aa",
+				"b": "bb",
+			},
+		},
+		{
+			name: "first entry expired now",
+			now:  fc.Now().Add(1 * time.Second),
+			set: []entry{
+				{"a", "aa", 1 * time.Second},
+				{"b", "bb", 2 * time.Second},
+			},
+			want: map[string]string{
+				"b": "bb",
+			},
+		},
+		{
+			name: "first entry expired half a second ago",
+			now:  fc.Now().Add(1500 * time.Millisecond),
+			set: []entry{
+				{"a", "aa", 1 * time.Second},
+				{"b", "bb", 2 * time.Second},
+			},
+			want: map[string]string{
+				"b": "bb",
+			},
+		},
+		{
+			name: "three entries weird order",
+			now:  fc.Now().Add(1 * time.Second),
+			set: []entry{
+				{"c", "cc", 3 * time.Second},
+				{"a", "aa", 1 * time.Second},
+				{"b", "bb", 2 * time.Second},
+			},
+			want: map[string]string{
+				"b": "bb",
+				"c": "cc",
+			},
+		},
+		{
+			name: "expire multiple entries in one cycle",
+			now:  fc.Now().Add(2500 * time.Millisecond),
+			set: []entry{
+				{"a", "aa", 1 * time.Second},
+				{"b", "bb", 2 * time.Second},
+				{"c", "cc", 3 * time.Second},
+			},
+			want: map[string]string{
+				"c": "cc",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			c := NewExpiringWithClock(fc)
+			for _, e := range test.set {
+				c.Set(e.key, e.val, e.ttl)
+			}
+
+			c.gc(test.now)
+
+			for k, want := range test.want {
+				got, ok := c.Get(k)
+				if !ok {
+					t.Errorf("expected cache to have entry for key=%q but found none", k)
+					continue
+				}
+				if got != want {
+					t.Errorf("unexpected value for key=%q: got=%q, want=%q", k, got, want)
+				}
+			}
+			if got, want := c.Len(), len(test.want); got != want {
+				t.Errorf("unexpected cache size: got=%d, want=%d", got, want)
+			}
+		})
+	}
+}
+
+func BenchmarkExpiringCacheContention(b *testing.B) {
+	b.Run("evict_probablility=100%", func(b *testing.B) {
+		benchmarkExpiringCacheContention(b, 1)
+	})
+	b.Run("evict_probablility=10%", func(b *testing.B) {
+		benchmarkExpiringCacheContention(b, 0.1)
+	})
+	b.Run("evict_probablility=1%", func(b *testing.B) {
+		benchmarkExpiringCacheContention(b, 0.01)
+	})
+}
+
+func benchmarkExpiringCacheContention(b *testing.B, prob float64) {
+	const numKeys = 1 << 16
+	cache := NewExpiring()
+
+	keys := []string{}
+	for i := 0; i < numKeys; i++ {
+		key := uuid.New().String()
+		keys = append(keys, key)
+	}
+
+	b.ResetTimer()
+
+	b.SetParallelism(256)
+	b.RunParallel(func(pb *testing.PB) {
+		rand := rand.New(rand.NewSource(rand.Int63()))
+		for pb.Next() {
+			i := rand.Int31()
+			key := keys[i%numKeys]
+			_, ok := cache.Get(key)
+			if ok {
+				// compare lower bits of sampled i to decide whether we should evict.
+				if rand.Float64() < prob {
+					cache.Delete(key)
+				}
+			} else {
+				cache.Set(key, struct{}{}, 50*time.Millisecond)
+			}
+		}
+	})
+}
+
+func TestStressExpiringCache(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	const numKeys = 1 << 16
+	cache := NewExpiring()
+
+	keys := []string{}
+	for i := 0; i < numKeys; i++ {
+		key := uuid.New().String()
+		keys = append(keys, key)
+	}
+
+	var wg sync.WaitGroup
+	for i := 0; i < 256; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			rand := rand.New(rand.NewSource(rand.Int63()))
+			for {
+				select {
+				case <-ctx.Done():
+					return
+				default:
+				}
+				key := keys[rand.Intn(numKeys)]
+				if _, ok := cache.Get(key); !ok {
+					cache.Set(key, struct{}{}, 50*time.Millisecond)
+				}
+			}
+		}()
+	}
+
+	wg.Wait()
+
+	// trigger a GC with a set and check the cache size.
+	time.Sleep(60 * time.Millisecond)
+	cache.Set("trigger", "gc", time.Second)
+	if cache.Len() != 1 {
+		t.Errorf("unexpected cache size: got=%d, want=1", cache.Len())
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/cache/lruexpirecache.go b/third_party/k8s.io/apimachinery/pkg/util/cache/lruexpirecache.go
new file mode 100644
index 0000000000..ad486d580f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/cache/lruexpirecache.go
@@ -0,0 +1,173 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cache
+
+import (
+	"container/list"
+	"sync"
+	"time"
+)
+
+// Clock defines an interface for obtaining the current time
+type Clock interface {
+	Now() time.Time
+}
+
+// realClock implements the Clock interface by calling time.Now()
+type realClock struct{}
+
+func (realClock) Now() time.Time { return time.Now() }
+
+// LRUExpireCache is a cache that ensures the mostly recently accessed keys are returned with
+// a ttl beyond which keys are forcibly expired.
+type LRUExpireCache struct {
+	// clock is used to obtain the current time
+	clock Clock
+
+	lock sync.Mutex
+
+	maxSize      int
+	evictionList list.List
+	entries      map[interface{}]*list.Element
+}
+
+// NewLRUExpireCache creates an expiring cache with the given size
+func NewLRUExpireCache(maxSize int) *LRUExpireCache {
+	return NewLRUExpireCacheWithClock(maxSize, realClock{})
+}
+
+// NewLRUExpireCacheWithClock creates an expiring cache with the given size, using the specified clock to obtain the current time.
+func NewLRUExpireCacheWithClock(maxSize int, clock Clock) *LRUExpireCache {
+	if maxSize <= 0 {
+		panic("maxSize must be > 0")
+	}
+
+	return &LRUExpireCache{
+		clock:   clock,
+		maxSize: maxSize,
+		entries: map[interface{}]*list.Element{},
+	}
+}
+
+type cacheEntry struct {
+	key        interface{}
+	value      interface{}
+	expireTime time.Time
+}
+
+// Add adds the value to the cache at key with the specified maximum duration.
+func (c *LRUExpireCache) Add(key interface{}, value interface{}, ttl time.Duration) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	// Key already exists
+	oldElement, ok := c.entries[key]
+	if ok {
+		c.evictionList.MoveToFront(oldElement)
+		oldElement.Value.(*cacheEntry).value = value
+		oldElement.Value.(*cacheEntry).expireTime = c.clock.Now().Add(ttl)
+		return
+	}
+
+	// Make space if necessary
+	if c.evictionList.Len() >= c.maxSize {
+		toEvict := c.evictionList.Back()
+		c.evictionList.Remove(toEvict)
+		delete(c.entries, toEvict.Value.(*cacheEntry).key)
+	}
+
+	// Add new entry
+	entry := &cacheEntry{
+		key:        key,
+		value:      value,
+		expireTime: c.clock.Now().Add(ttl),
+	}
+	element := c.evictionList.PushFront(entry)
+	c.entries[key] = element
+}
+
+// Get returns the value at the specified key from the cache if it exists and is not
+// expired, or returns false.
+func (c *LRUExpireCache) Get(key interface{}) (interface{}, bool) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	element, ok := c.entries[key]
+	if !ok {
+		return nil, false
+	}
+
+	if c.clock.Now().After(element.Value.(*cacheEntry).expireTime) {
+		c.evictionList.Remove(element)
+		delete(c.entries, key)
+		return nil, false
+	}
+
+	c.evictionList.MoveToFront(element)
+
+	return element.Value.(*cacheEntry).value, true
+}
+
+// Remove removes the specified key from the cache if it exists
+func (c *LRUExpireCache) Remove(key interface{}) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	element, ok := c.entries[key]
+	if !ok {
+		return
+	}
+
+	c.evictionList.Remove(element)
+	delete(c.entries, key)
+}
+
+// RemoveAll removes all keys that match predicate.
+func (c *LRUExpireCache) RemoveAll(predicate func(key any) bool) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	for key, element := range c.entries {
+		if predicate(key) {
+			c.evictionList.Remove(element)
+			delete(c.entries, key)
+		}
+	}
+}
+
+// Keys returns all unexpired keys in the cache.
+//
+// Keep in mind that subsequent calls to Get() for any of the returned keys
+// might return "not found".
+//
+// Keys are returned ordered from least recently used to most recently used.
+func (c *LRUExpireCache) Keys() []interface{} {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	now := c.clock.Now()
+
+	val := make([]interface{}, 0, c.evictionList.Len())
+	for element := c.evictionList.Back(); element != nil; element = element.Prev() {
+		// Only return unexpired keys
+		if !now.After(element.Value.(*cacheEntry).expireTime) {
+			val = append(val, element.Value.(*cacheEntry).key)
+		}
+	}
+
+	return val
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/cache/lruexpirecache_test.go b/third_party/k8s.io/apimachinery/pkg/util/cache/lruexpirecache_test.go
new file mode 100644
index 0000000000..d6bd7464f7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/cache/lruexpirecache_test.go
@@ -0,0 +1,162 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cache
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	testingclock "k8s.io/utils/clock/testing"
+)
+
+func expectEntry(t *testing.T, c *LRUExpireCache, key interface{}, value interface{}) {
+	t.Helper()
+	result, ok := c.Get(key)
+	if !ok || result != value {
+		t.Errorf("Expected cache[%v]: %v, got %v", key, value, result)
+	}
+}
+
+func expectNotEntry(t *testing.T, c *LRUExpireCache, key interface{}) {
+	t.Helper()
+	if result, ok := c.Get(key); ok {
+		t.Errorf("Expected cache[%v] to be empty, got %v", key, result)
+	}
+}
+
+// Note: Check keys before checking individual entries, because Get() changes
+// the eviction list.
+func assertKeys(t *testing.T, gotKeys, wantKeys []interface{}) {
+	t.Helper()
+	if diff := cmp.Diff(gotKeys, wantKeys); diff != "" {
+		t.Errorf("Wrong result for keys: diff (-got +want):\n%s", diff)
+	}
+}
+
+func TestSimpleGet(t *testing.T) {
+	c := NewLRUExpireCache(10)
+	c.Add("long-lived", "12345", 10*time.Hour)
+
+	assertKeys(t, c.Keys(), []interface{}{"long-lived"})
+
+	expectEntry(t, c, "long-lived", "12345")
+}
+
+func TestSimpleRemove(t *testing.T) {
+	c := NewLRUExpireCache(10)
+	c.Add("long-lived", "12345", 10*time.Hour)
+	c.Remove("long-lived")
+
+	assertKeys(t, c.Keys(), []interface{}{})
+
+	expectNotEntry(t, c, "long-lived")
+}
+
+func TestSimpleRemoveAll(t *testing.T) {
+	c := NewLRUExpireCache(10)
+	c.Add("long-lived", "12345", 10*time.Hour)
+	c.Add("other-long-lived", "12345", 10*time.Hour)
+	c.RemoveAll(func(k any) bool {
+		return k.(string) == "long-lived"
+	})
+
+	assertKeys(t, c.Keys(), []any{"other-long-lived"})
+
+	expectNotEntry(t, c, "long-lived")
+	expectEntry(t, c, "other-long-lived", "12345")
+}
+
+func TestExpiredGet(t *testing.T) {
+	fakeClock := testingclock.NewFakeClock(time.Now())
+	c := NewLRUExpireCacheWithClock(10, fakeClock)
+	c.Add("short-lived", "12345", 1*time.Millisecond)
+	// ensure the entry expired
+	fakeClock.Step(2 * time.Millisecond)
+
+	// Keys() should not return expired keys.
+	assertKeys(t, c.Keys(), []interface{}{})
+
+	expectNotEntry(t, c, "short-lived")
+}
+
+func TestLRUOverflow(t *testing.T) {
+	c := NewLRUExpireCache(4)
+	c.Add("elem1", "1", 10*time.Hour)
+	c.Add("elem2", "2", 10*time.Hour)
+	c.Add("elem3", "3", 10*time.Hour)
+	c.Add("elem4", "4", 10*time.Hour)
+	c.Add("elem5", "5", 10*time.Hour)
+
+	assertKeys(t, c.Keys(), []interface{}{"elem2", "elem3", "elem4", "elem5"})
+
+	expectNotEntry(t, c, "elem1")
+	expectEntry(t, c, "elem2", "2")
+	expectEntry(t, c, "elem3", "3")
+	expectEntry(t, c, "elem4", "4")
+	expectEntry(t, c, "elem5", "5")
+}
+
+func TestAddBringsToFront(t *testing.T) {
+	c := NewLRUExpireCache(4)
+	c.Add("elem1", "1", 10*time.Hour)
+	c.Add("elem2", "2", 10*time.Hour)
+	c.Add("elem3", "3", 10*time.Hour)
+	c.Add("elem4", "4", 10*time.Hour)
+
+	c.Add("elem1", "1-new", 10*time.Hour)
+
+	c.Add("elem5", "5", 10*time.Hour)
+
+	assertKeys(t, c.Keys(), []interface{}{"elem3", "elem4", "elem1", "elem5"})
+
+	expectNotEntry(t, c, "elem2")
+	expectEntry(t, c, "elem1", "1-new")
+	expectEntry(t, c, "elem3", "3")
+	expectEntry(t, c, "elem4", "4")
+	expectEntry(t, c, "elem5", "5")
+}
+
+func TestGetBringsToFront(t *testing.T) {
+	c := NewLRUExpireCache(4)
+	c.Add("elem1", "1", 10*time.Hour)
+	c.Add("elem2", "2", 10*time.Hour)
+	c.Add("elem3", "3", 10*time.Hour)
+	c.Add("elem4", "4", 10*time.Hour)
+
+	c.Get("elem1")
+
+	c.Add("elem5", "5", 10*time.Hour)
+
+	assertKeys(t, c.Keys(), []interface{}{"elem3", "elem4", "elem1", "elem5"})
+
+	expectNotEntry(t, c, "elem2")
+	expectEntry(t, c, "elem1", "1")
+	expectEntry(t, c, "elem3", "3")
+	expectEntry(t, c, "elem4", "4")
+	expectEntry(t, c, "elem5", "5")
+}
+
+func TestLRUKeys(t *testing.T) {
+	c := NewLRUExpireCache(4)
+	c.Add("elem1", "1", 10*time.Hour)
+	c.Add("elem2", "2", 10*time.Hour)
+	c.Add("elem3", "3", 10*time.Hour)
+	c.Add("elem4", "4", 10*time.Hour)
+
+	assertKeys(t, c.Keys(), []interface{}{"elem1", "elem2", "elem3", "elem4"})
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/diff/complex_test.go b/third_party/k8s.io/apimachinery/pkg/util/diff/complex_test.go
new file mode 100644
index 0000000000..18ac9336e2
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/diff/complex_test.go
@@ -0,0 +1,353 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package diff
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+)
+
+// TestDiffWithRealGoCmp is a comprehensive test that compares our Diff with the actual go-cmp Diff
+// across a variety of data structures and types to ensure compatibility.
+func TestDiffWithRealGoCmp(t *testing.T) {
+	// Test with simple types
+	t.Run("SimpleTypes", func(t *testing.T) {
+		testCases := []struct {
+			name string
+			a    interface{}
+			b    interface{}
+		}{
+			{name: "Integers", a: 42, b: 43},
+			{name: "Strings", a: "hello", b: "world"},
+			{name: "Booleans", a: true, b: false},
+			{name: "Floats", a: 3.14, b: 2.71},
+		}
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				ourDiff := Diff(tc.a, tc.b)
+				goCmpDiff := cmp.Diff(tc.a, tc.b)
+
+				t.Logf("Our diff:\n%s\n\nGo-cmp diff:\n%s", ourDiff, goCmpDiff)
+
+				// Verify both diffs are non-empty
+				if ourDiff == "" || goCmpDiff == "" {
+					t.Errorf("Expected non-empty diffs, got ourDiff: %v, goCmpDiff: %v",
+						ourDiff == "", goCmpDiff == "")
+				}
+			})
+		}
+	})
+
+	// Test with a simple struct
+	t.Run("SimpleStruct", func(t *testing.T) {
+		type TestStruct struct {
+			Name string
+			Age  int
+			Tags []string
+			Map  map[string]int
+		}
+
+		a := TestStruct{
+			Name: "Alice",
+			Age:  30,
+			Tags: []string{"tag1", "tag2"},
+			Map:  map[string]int{"a": 1, "b": 2},
+		}
+
+		b := TestStruct{
+			Name: "Bob",
+			Age:  25,
+			Tags: []string{"tag1", "tag3"},
+			Map:  map[string]int{"a": 1, "c": 3},
+		}
+
+		ourDiff := Diff(a, b)
+		goCmpDiff := cmp.Diff(a, b)
+
+		t.Logf("Our diff:\n%s\n\nGo-cmp diff:\n%s", ourDiff, goCmpDiff)
+
+		// Check that our diff contains key differences
+		keyDifferences := []string{
+			"Name", "Alice", "Bob",
+			"Age", "30", "25",
+			"Tags", "tag2", "tag3",
+			"Map", "b", "c",
+		}
+
+		for _, key := range keyDifferences {
+			if !strings.Contains(ourDiff, key) {
+				t.Errorf("Our diff doesn't contain expected key difference: %q", key)
+			}
+		}
+	})
+
+	// Test with a complex nested struct
+	t.Run("ComplexNestedStruct", func(t *testing.T) {
+		type Address struct {
+			Street     string
+			City       string
+			State      string
+			PostalCode string
+			Country    string
+		}
+
+		type Contact struct {
+			Type  string
+			Value string
+		}
+
+		type Person struct {
+			ID        int
+			FirstName string
+			LastName  string
+			Age       int
+			Addresses map[string]Address
+			Contacts  []Contact
+			Metadata  map[string]interface{}
+			CreatedAt time.Time
+		}
+
+		now := time.Now()
+		later := now.Add(24 * time.Hour)
+
+		person1 := Person{
+			ID:        1,
+			FirstName: "John",
+			LastName:  "Doe",
+			Age:       30,
+			Addresses: map[string]Address{
+				"home": {
+					Street:     "123 Main St",
+					City:       "Anytown",
+					State:      "CA",
+					PostalCode: "12345",
+					Country:    "USA",
+				},
+				"work": {
+					Street:     "456 Market St",
+					City:       "Worktown",
+					State:      "CA",
+					PostalCode: "54321",
+					Country:    "USA",
+				},
+			},
+			Contacts: []Contact{
+				{Type: "email", Value: "john.doe@example.com"},
+				{Type: "phone", Value: "555-1234"},
+			},
+			Metadata: map[string]interface{}{
+				"created":    "2023-01-01",
+				"loginCount": 42,
+				"settings": map[string]bool{
+					"notifications": true,
+					"darkMode":      false,
+				},
+			},
+			CreatedAt: now,
+		}
+
+		person2 := Person{
+			ID:        1,
+			FirstName: "John",
+			LastName:  "Smith", // Different
+			Age:       31,      // Different
+			Addresses: map[string]Address{
+				"home": {
+					Street:     "123 Main St",
+					City:       "Anytown",
+					State:      "CA",
+					PostalCode: "12345",
+					Country:    "USA",
+				},
+				// "work" address is missing
+			},
+			Contacts: []Contact{
+				{Type: "email", Value: "john.smith@example.com"}, // Different
+				{Type: "phone", Value: "555-1234"},
+				{Type: "fax", Value: "555-5678"}, // Additional
+			},
+			Metadata: map[string]interface{}{
+				"created":    "2023-01-01",
+				"loginCount": 43, // Different
+				"settings": map[string]bool{
+					"notifications": false, // Different
+					"darkMode":      true,  // Different
+				},
+				"newField": "new value", // New field
+			},
+			CreatedAt: later, // Different
+		}
+
+		ourDiff := Diff(person1, person2)
+		goCmpDiff := cmp.Diff(person1, person2)
+
+		t.Logf("Our diff:\n%s\n\nGo-cmp diff:\n%s", ourDiff, goCmpDiff)
+
+		// Check that our diff contains key differences
+		keyDifferences := []string{
+			"LastName", "Smith",
+			"Age",
+			"Addresses", "work",
+			"Contacts", "john.smith@example.com", "fax",
+			"Metadata", "loginCount", "settings", "notifications", "darkMode", "newField",
+		}
+
+		for _, key := range keyDifferences {
+			if !strings.Contains(ourDiff, key) {
+				t.Errorf("Our diff doesn't contain expected key difference: %q", key)
+			}
+		}
+
+		// Check that both diffs are non-empty
+		if ourDiff == "" || goCmpDiff == "" {
+			t.Errorf("Expected non-empty diffs, got ourDiff: %v, goCmpDiff: %v",
+				ourDiff == "", goCmpDiff == "")
+		}
+	})
+
+	// Test with slices and maps
+	t.Run("SlicesAndMaps", func(t *testing.T) {
+		// Test with slices
+		a1 := []int{1, 2, 3, 4, 5}
+		b1 := []int{1, 2, 6, 4, 7}
+
+		ourDiff1 := Diff(a1, b1)
+		goCmpDiff1 := cmp.Diff(a1, b1)
+
+		t.Logf("Our diff (slices):\n%s\n\nGo-cmp diff (slices):\n%s", ourDiff1, goCmpDiff1)
+
+		// Check that our diff contains the differences
+		if !strings.Contains(ourDiff1, "3") || !strings.Contains(ourDiff1, "6") ||
+			!strings.Contains(ourDiff1, "5") || !strings.Contains(ourDiff1, "7") {
+			t.Errorf("Our diff doesn't contain all expected differences for slices")
+		}
+
+		// Test with maps
+		a2 := map[string]int{"a": 1, "b": 2, "c": 3}
+		b2 := map[string]int{"a": 1, "b": 5, "d": 4}
+
+		ourDiff2 := Diff(a2, b2)
+		goCmpDiff2 := cmp.Diff(a2, b2)
+
+		t.Logf("Our diff (maps):\n%s\n\nGo-cmp diff (maps):\n%s", ourDiff2, goCmpDiff2)
+
+		// Check that our diff contains the differences
+		if !strings.Contains(ourDiff2, "b") || !strings.Contains(ourDiff2, "5") ||
+			!strings.Contains(ourDiff2, "c") || !strings.Contains(ourDiff2, "d") {
+			t.Errorf("Our diff doesn't contain all expected differences for maps")
+		}
+	})
+
+	// Test with unexported fields
+	t.Run("UnexportedFields", func(t *testing.T) {
+		type WithUnexported struct {
+			Exported   int
+			unexported int
+		}
+
+		a := WithUnexported{Exported: 1, unexported: 2}
+		b := WithUnexported{Exported: 3, unexported: 4}
+
+		ourDiff := Diff(a, b)
+		// Use cmpopts.IgnoreUnexported to ignore unexported fields in go-cmp
+		goCmpDiff := cmp.Diff(a, b, cmpopts.IgnoreUnexported(WithUnexported{}))
+
+		t.Logf("Our diff (unexported):\n%s\n\nGo-cmp diff (unexported):\n%s", ourDiff, goCmpDiff)
+
+		// Check that our diff contains only the exported field difference
+		if !strings.Contains(ourDiff, "Exported") || !strings.Contains(ourDiff, "1") || !strings.Contains(ourDiff, "3") {
+			t.Errorf("Our diff doesn't contain the exported field difference")
+		}
+	})
+
+	// Test with embedded structs
+	t.Run("EmbeddedStructs", func(t *testing.T) {
+		type Embedded struct {
+			Value int
+		}
+
+		type Container struct {
+			Embedded
+			Extra string
+		}
+
+		a := Container{Embedded: Embedded{Value: 1}, Extra: "a"}
+		b := Container{Embedded: Embedded{Value: 2}, Extra: "b"}
+
+		ourDiff := Diff(a, b)
+		goCmpDiff := cmp.Diff(a, b)
+
+		t.Logf("Our diff (embedded):\n%s\n\nGo-cmp diff (embedded):\n%s", ourDiff, goCmpDiff)
+
+		// Check that our diff contains the container field difference
+		if !strings.Contains(ourDiff, "Extra") || !strings.Contains(ourDiff, "a") || !strings.Contains(ourDiff, "b") {
+			t.Errorf("Our diff doesn't contain the container field difference")
+		}
+	})
+
+	// Test with interface values of same type
+	t.Run("InterfaceValues", func(t *testing.T) {
+		type Container struct {
+			Value interface{}
+		}
+
+		// Test with same type in interface
+		c := Container{Value: 42}
+		d := Container{Value: 43}
+
+		ourDiff := Diff(c, d)
+		goCmpDiff := cmp.Diff(c, d)
+
+		t.Logf("Our diff (interface same type):\n%s\n\nGo-cmp diff (interface same type):\n%s", ourDiff, goCmpDiff)
+
+		// Check that our diff contains the value difference
+		if !strings.Contains(ourDiff, "42") || !strings.Contains(ourDiff, "43") {
+			t.Errorf("Our diff doesn't contain the value difference for interface values of same type")
+		}
+	})
+
+	// Test with objects that cannot be marshaled to JSON
+	t.Run("UnmarshalableObjects", func(t *testing.T) {
+		// Test with a circular reference, which cannot be marshaled to JSON
+		type Node struct {
+			Value int
+			Next  *Node
+		}
+
+		// Create a circular reference
+		nodeA := &Node{Value: 1}
+		nodeA.Next = nodeA // Points to itself
+
+		nodeB := &Node{Value: 2}
+		nodeB.Next = nodeB // Points to itself
+
+		// This should fall back to using dump.Pretty
+		circularDiff := Diff(nodeA, nodeB)
+
+		t.Logf("Diff for circular references:\n%s", circularDiff)
+
+		// Verify the diff contains the values
+		if !strings.Contains(circularDiff, "1") || !strings.Contains(circularDiff, "2") {
+			t.Errorf("Diff doesn't contain expected value differences for circular references")
+		}
+	})
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/diff/diff.go b/third_party/k8s.io/apimachinery/pkg/util/diff/diff.go
new file mode 100644
index 0000000000..7bfa6088bc
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/diff/diff.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package diff
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/pmezard/go-difflib/difflib"
+
+	"k8s.io/utils/dump"
+)
+
+// Diff returns a string representation of the difference between two objects.
+// When built without the usegocmp tag, it uses go-difflib/difflib to generate a
+// unified diff of the objects. It attempts to use JSON serialization first,
+// falling back to an object dump via the dump package if JSON marshaling fails.
+func Diff(a, b any) string {
+
+	aStr, aErr := toPrettyJSON(a)
+	bStr, bErr := toPrettyJSON(b)
+	if aErr != nil || bErr != nil {
+		aStr = dump.Pretty(a)
+		bStr = dump.Pretty(b)
+	}
+
+	diff := difflib.UnifiedDiff{
+		A:       difflib.SplitLines(aStr),
+		B:       difflib.SplitLines(bStr),
+		Context: 3,
+	}
+
+	diffstr, err := difflib.GetUnifiedDiffString(diff)
+	if err != nil {
+		return fmt.Sprintf("error generating diff: %v", err)
+	}
+
+	return diffstr
+}
+
+// toPrettyJSON converts an object to a pretty-printed JSON string.
+func toPrettyJSON(data any) (string, error) {
+	jsonData, err := json.MarshalIndent(data, "", " ")
+	return string(jsonData), err
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/diff/legacy_diff.go b/third_party/k8s.io/apimachinery/pkg/util/diff/legacy_diff.go
new file mode 100644
index 0000000000..9f0dc2f6ad
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/diff/legacy_diff.go
@@ -0,0 +1,67 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package diff
+
+import (
+	"bytes"
+	"fmt"
+	"strings"
+	"text/tabwriter"
+
+	"k8s.io/utils/dump"
+)
+
+// ObjectGoPrintSideBySide prints a and b as textual dumps side by side,
+// enabling easy visual scanning for mismatches.
+func ObjectGoPrintSideBySide(a, b interface{}) string {
+	sA := dump.Pretty(a)
+	sB := dump.Pretty(b)
+
+	linesA := strings.Split(sA, "\n")
+	linesB := strings.Split(sB, "\n")
+	width := 0
+	for _, s := range linesA {
+		l := len(s)
+		if l > width {
+			width = l
+		}
+	}
+	for _, s := range linesB {
+		l := len(s)
+		if l > width {
+			width = l
+		}
+	}
+	buf := &bytes.Buffer{}
+	w := tabwriter.NewWriter(buf, width, 0, 1, ' ', 0)
+	max := len(linesA)
+	if len(linesB) > max {
+		max = len(linesB)
+	}
+	for i := 0; i < max; i++ {
+		var a, b string
+		if i < len(linesA) {
+			a = linesA[i]
+		}
+		if i < len(linesB) {
+			b = linesB[i]
+		}
+		_, _ = fmt.Fprintf(w, "%s\t%s\n", a, b)
+	}
+	_ = w.Flush()
+	return buf.String()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/dump/dump.go b/third_party/k8s.io/apimachinery/pkg/util/dump/dump.go
new file mode 100644
index 0000000000..5cf55473c3
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/dump/dump.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package dump
+
+import (
+	"k8s.io/utils/dump"
+)
+
+// Deprecated: Use k8s.io/utils/dump.Pretty instead.
+//
+//go:fix inline
+func Pretty(a interface{}) string {
+	return dump.Pretty(a)
+}
+
+// Deprecated: Use k8s.io/utils/dump.ForHash instead.
+//
+//go:fix inline
+func ForHash(a interface{}) string {
+	return dump.ForHash(a)
+}
+
+// Deprecated: Use k8s.io/utils/dump.OneLine instead.
+//
+//go:fix inline
+func OneLine(a interface{}) string {
+	return dump.OneLine(a)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/duration/duration.go b/third_party/k8s.io/apimachinery/pkg/util/duration/duration.go
new file mode 100644
index 0000000000..a20136a4e5
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/duration/duration.go
@@ -0,0 +1,93 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package duration
+
+import (
+	"fmt"
+	"time"
+)
+
+// ShortHumanDuration returns a succinct representation of the provided duration
+// with limited precision for consumption by humans.
+func ShortHumanDuration(d time.Duration) string {
+	// Allow deviation no more than 2 seconds(excluded) to tolerate machine time
+	// inconsistence, it can be considered as almost now.
+	if seconds := int(d.Seconds()); seconds < -1 {
+		return "<invalid>"
+	} else if seconds < 0 {
+		return "0s"
+	} else if seconds < 60 {
+		return fmt.Sprintf("%ds", seconds)
+	} else if minutes := int(d.Minutes()); minutes < 60 {
+		return fmt.Sprintf("%dm", minutes)
+	} else if hours := int(d.Hours()); hours < 24 {
+		return fmt.Sprintf("%dh", hours)
+	} else if hours < 24*365 {
+		return fmt.Sprintf("%dd", hours/24)
+	}
+	return fmt.Sprintf("%dy", int(d.Hours()/24/365))
+}
+
+// HumanDuration returns a succinct representation of the provided duration
+// with limited precision for consumption by humans. It provides ~2-3 significant
+// figures of duration.
+func HumanDuration(d time.Duration) string {
+	// Allow deviation no more than 2 seconds(excluded) to tolerate machine time
+	// inconsistence, it can be considered as almost now.
+	if seconds := int(d.Seconds()); seconds < -1 {
+		return "<invalid>"
+	} else if seconds < 0 {
+		return "0s"
+	} else if seconds < 60*2 {
+		return fmt.Sprintf("%ds", seconds)
+	}
+	minutes := int(d / time.Minute)
+	if minutes < 10 {
+		s := int(d/time.Second) % 60
+		if s == 0 {
+			return fmt.Sprintf("%dm", minutes)
+		}
+		return fmt.Sprintf("%dm%ds", minutes, s)
+	} else if minutes < 60*3 {
+		return fmt.Sprintf("%dm", minutes)
+	}
+	hours := int(d / time.Hour)
+	if hours < 8 {
+		m := int(d/time.Minute) % 60
+		if m == 0 {
+			return fmt.Sprintf("%dh", hours)
+		}
+		return fmt.Sprintf("%dh%dm", hours, m)
+	} else if hours < 48 {
+		return fmt.Sprintf("%dh", hours)
+	} else if hours < 24*8 {
+		h := hours % 24
+		if h == 0 {
+			return fmt.Sprintf("%dd", hours/24)
+		}
+		return fmt.Sprintf("%dd%dh", hours/24, h)
+	} else if hours < 24*365*2 {
+		return fmt.Sprintf("%dd", hours/24)
+	} else if hours < 24*365*8 {
+		dy := int(hours/24) % 365
+		if dy == 0 {
+			return fmt.Sprintf("%dy", hours/24/365)
+		}
+		return fmt.Sprintf("%dy%dd", hours/24/365, dy)
+	}
+	return fmt.Sprintf("%dy", int(hours/24/365))
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/duration/duration_test.go b/third_party/k8s.io/apimachinery/pkg/util/duration/duration_test.go
new file mode 100644
index 0000000000..ae56b08567
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/duration/duration_test.go
@@ -0,0 +1,133 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package duration
+
+import (
+	"testing"
+	"time"
+)
+
+func TestHumanDuration(t *testing.T) {
+	tests := []struct {
+		d    time.Duration
+		want string
+	}{
+		{d: time.Second, want: "1s"},
+		{d: 70 * time.Second, want: "70s"},
+		{d: 190 * time.Second, want: "3m10s"},
+		{d: 70 * time.Minute, want: "70m"},
+		{d: 47 * time.Hour, want: "47h"},
+		{d: 49 * time.Hour, want: "2d1h"},
+		{d: (8*24 + 2) * time.Hour, want: "8d"},
+		{d: (367 * 24) * time.Hour, want: "367d"},
+		{d: (365*2*24 + 25) * time.Hour, want: "2y1d"},
+		{d: (365*8*24 + 2) * time.Hour, want: "8y"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.d.String(), func(t *testing.T) {
+			if got := HumanDuration(tt.d); got != tt.want {
+				t.Errorf("HumanDuration() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestHumanDurationBoundaries(t *testing.T) {
+	tests := []struct {
+		d    time.Duration
+		want string
+	}{
+		{d: -2 * time.Second, want: "<invalid>"},
+		{d: -2*time.Second + 1, want: "0s"},
+		{d: 0, want: "0s"},
+		{d: time.Second - time.Millisecond, want: "0s"},
+		{d: 2*time.Minute - time.Millisecond, want: "119s"},
+		{d: 2 * time.Minute, want: "2m"},
+		{d: 2*time.Minute + time.Second, want: "2m1s"},
+		{d: 10*time.Minute - time.Millisecond, want: "9m59s"},
+		{d: 10 * time.Minute, want: "10m"},
+		{d: 10*time.Minute + time.Second, want: "10m"},
+		{d: 3*time.Hour - time.Millisecond, want: "179m"},
+		{d: 3 * time.Hour, want: "3h"},
+		{d: 3*time.Hour + time.Minute, want: "3h1m"},
+		{d: 8*time.Hour - time.Millisecond, want: "7h59m"},
+		{d: 8 * time.Hour, want: "8h"},
+		{d: 8*time.Hour + 59*time.Minute, want: "8h"},
+		{d: 2*24*time.Hour - time.Millisecond, want: "47h"},
+		{d: 2 * 24 * time.Hour, want: "2d"},
+		{d: 2*24*time.Hour + time.Hour, want: "2d1h"},
+		{d: 8*24*time.Hour - time.Millisecond, want: "7d23h"},
+		{d: 8 * 24 * time.Hour, want: "8d"},
+		{d: 8*24*time.Hour + 23*time.Hour, want: "8d"},
+		{d: 2*365*24*time.Hour - time.Millisecond, want: "729d"},
+		{d: 2 * 365 * 24 * time.Hour, want: "2y"},
+		{d: 2*365*24*time.Hour + 23*time.Hour, want: "2y"},
+		{d: 2*365*24*time.Hour + 23*time.Hour + 59*time.Minute, want: "2y"},
+		{d: 2*365*24*time.Hour + 24*time.Hour - time.Millisecond, want: "2y"},
+		{d: 2*365*24*time.Hour + 24*time.Hour, want: "2y1d"},
+		{d: 3 * 365 * 24 * time.Hour, want: "3y"},
+		{d: 4 * 365 * 24 * time.Hour, want: "4y"},
+		{d: 5 * 365 * 24 * time.Hour, want: "5y"},
+		{d: 6 * 365 * 24 * time.Hour, want: "6y"},
+		{d: 7 * 365 * 24 * time.Hour, want: "7y"},
+		{d: 8*365*24*time.Hour - time.Millisecond, want: "7y364d"},
+		{d: 8 * 365 * 24 * time.Hour, want: "8y"},
+		{d: 8*365*24*time.Hour + 364*24*time.Hour, want: "8y"},
+		{d: 9 * 365 * 24 * time.Hour, want: "9y"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.d.String(), func(t *testing.T) {
+			if got := HumanDuration(tt.d); got != tt.want {
+				t.Errorf("HumanDuration() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestShortHumanDurationBoundaries(t *testing.T) {
+	tests := []struct {
+		d    time.Duration
+		want string
+	}{
+		{d: -2 * time.Second, want: "<invalid>"},
+		{d: -2*time.Second + 1, want: "0s"},
+		{d: 0, want: "0s"},
+		{d: time.Second - time.Millisecond, want: "0s"},
+		{d: time.Second, want: "1s"},
+		{d: 2*time.Second - time.Millisecond, want: "1s"},
+		{d: time.Minute - time.Millisecond, want: "59s"},
+		{d: time.Minute, want: "1m"},
+		{d: 2*time.Minute - time.Millisecond, want: "1m"},
+		{d: time.Hour - time.Millisecond, want: "59m"},
+		{d: time.Hour, want: "1h"},
+		{d: 2*time.Hour - time.Millisecond, want: "1h"},
+		{d: 24*time.Hour - time.Millisecond, want: "23h"},
+		{d: 24 * time.Hour, want: "1d"},
+		{d: 2*24*time.Hour - time.Millisecond, want: "1d"},
+		{d: 365*24*time.Hour - time.Millisecond, want: "364d"},
+		{d: 365 * 24 * time.Hour, want: "1y"},
+		{d: 2*365*24*time.Hour - time.Millisecond, want: "1y"},
+		{d: 2 * 365 * 24 * time.Hour, want: "2y"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.d.String(), func(t *testing.T) {
+			if got := ShortHumanDuration(tt.d); got != tt.want {
+				t.Errorf("ShortHumanDuration() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/errors/doc.go b/third_party/k8s.io/apimachinery/pkg/util/errors/doc.go
new file mode 100644
index 0000000000..b3b39bc388
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/errors/doc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package errors implements various utility functions and types around errors.
+package errors
diff --git a/third_party/k8s.io/apimachinery/pkg/util/errors/errors.go b/third_party/k8s.io/apimachinery/pkg/util/errors/errors.go
new file mode 100644
index 0000000000..6f458d13d7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/errors/errors.go
@@ -0,0 +1,251 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package errors
+
+import (
+	"errors"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// MessageCountMap contains occurrence for each error message.
+// Deprecated: Not used anymore in the k8s.io codebase, use `errors.Join` instead.
+type MessageCountMap map[string]int
+
+// Aggregate represents an object that contains multiple errors, but does not
+// necessarily have singular semantic meaning.
+// The aggregate can be used with `errors.Is()` to check for the occurrence of
+// a specific error type.
+// Errors.As() is not supported, because the caller presumably cares about a
+// specific error of potentially multiple that match the given type.
+type Aggregate interface {
+	error
+	Errors() []error
+	Is(error) bool
+}
+
+// NewAggregate converts a slice of errors into an Aggregate interface, which
+// is itself an implementation of the error interface.  If the slice is empty,
+// this returns nil.
+// It will check if any of the element of input error list is nil, to avoid
+// nil pointer panic when call Error().
+func NewAggregate(errlist []error) Aggregate {
+	if len(errlist) == 0 {
+		return nil
+	}
+	// In case of input error list contains nil
+	var errs []error
+	for _, e := range errlist {
+		if e != nil {
+			errs = append(errs, e)
+		}
+	}
+	if len(errs) == 0 {
+		return nil
+	}
+	return aggregate(errs)
+}
+
+// This helper implements the error and Errors interfaces.  Keeping it private
+// prevents people from making an aggregate of 0 errors, which is not
+// an error, but does satisfy the error interface.
+type aggregate []error
+
+// Error is part of the error interface.
+func (agg aggregate) Error() string {
+	if len(agg) == 0 {
+		// This should never happen, really.
+		return ""
+	}
+	if len(agg) == 1 {
+		return agg[0].Error()
+	}
+	seenerrs := sets.NewString()
+	result := ""
+	agg.visit(func(err error) bool {
+		msg := err.Error()
+		if seenerrs.Has(msg) {
+			return false
+		}
+		seenerrs.Insert(msg)
+		if len(seenerrs) > 1 {
+			result += ", "
+		}
+		result += msg
+		return false
+	})
+	if len(seenerrs) == 1 {
+		return result
+	}
+	return "[" + result + "]"
+}
+
+func (agg aggregate) Is(target error) bool {
+	return agg.visit(func(err error) bool {
+		return errors.Is(err, target)
+	})
+}
+
+func (agg aggregate) visit(f func(err error) bool) bool {
+	for _, err := range agg {
+		switch err := err.(type) {
+		case aggregate:
+			if match := err.visit(f); match {
+				return match
+			}
+		case Aggregate:
+			for _, nestedErr := range err.Errors() {
+				if match := f(nestedErr); match {
+					return match
+				}
+			}
+		default:
+			if match := f(err); match {
+				return match
+			}
+		}
+	}
+
+	return false
+}
+
+// Errors is part of the Aggregate interface.
+func (agg aggregate) Errors() []error {
+	return []error(agg)
+}
+
+// Matcher is used to match errors.  Returns true if the error matches.
+type Matcher func(error) bool
+
+// FilterOut removes all errors that match any of the matchers from the input
+// error.  If the input is a singular error, only that error is tested.  If the
+// input implements the Aggregate interface, the list of errors will be
+// processed recursively.
+//
+// This can be used, for example, to remove known-OK errors (such as io.EOF or
+// os.PathNotFound) from a list of errors.
+func FilterOut(err error, fns ...Matcher) error {
+	if err == nil {
+		return nil
+	}
+	if agg, ok := err.(Aggregate); ok {
+		return NewAggregate(filterErrors(agg.Errors(), fns...))
+	}
+	if !matchesError(err, fns...) {
+		return err
+	}
+	return nil
+}
+
+// matchesError returns true if any Matcher returns true
+func matchesError(err error, fns ...Matcher) bool {
+	for _, fn := range fns {
+		if fn(err) {
+			return true
+		}
+	}
+	return false
+}
+
+// filterErrors returns any errors (or nested errors, if the list contains
+// nested Errors) for which all fns return false. If no errors
+// remain a nil list is returned. The resulting slice will have all
+// nested slices flattened as a side effect.
+func filterErrors(list []error, fns ...Matcher) []error {
+	result := []error{}
+	for _, err := range list {
+		r := FilterOut(err, fns...)
+		if r != nil {
+			result = append(result, r)
+		}
+	}
+	return result
+}
+
+// Flatten takes an Aggregate, which may hold other Aggregates in arbitrary
+// nesting, and flattens them all into a single Aggregate, recursively.
+func Flatten(agg Aggregate) Aggregate {
+	result := []error{}
+	if agg == nil {
+		return nil
+	}
+	for _, err := range agg.Errors() {
+		if a, ok := err.(Aggregate); ok {
+			r := Flatten(a)
+			if r != nil {
+				result = append(result, r.Errors()...)
+			}
+		} else {
+			if err != nil {
+				result = append(result, err)
+			}
+		}
+	}
+	return NewAggregate(result)
+}
+
+// CreateAggregateFromMessageCountMap converts MessageCountMap Aggregate
+// Deprecated: Not used anymore in the k8s.io codebase, use `errors.Join` instead.
+func CreateAggregateFromMessageCountMap(m MessageCountMap) Aggregate {
+	if m == nil {
+		return nil
+	}
+	result := make([]error, 0, len(m))
+	for errStr, count := range m {
+		var countStr string
+		if count > 1 {
+			countStr = fmt.Sprintf(" (repeated %v times)", count)
+		}
+		result = append(result, fmt.Errorf("%v%v", errStr, countStr))
+	}
+	return NewAggregate(result)
+}
+
+// Reduce will return err or nil, if err is an Aggregate and only has one item,
+// the first item in the aggregate.
+func Reduce(err error) error {
+	if agg, ok := err.(Aggregate); ok && err != nil {
+		switch len(agg.Errors()) {
+		case 1:
+			return agg.Errors()[0]
+		case 0:
+			return nil
+		}
+	}
+	return err
+}
+
+// AggregateGoroutines runs the provided functions in parallel, stuffing all
+// non-nil errors into the returned Aggregate.
+// Returns nil if all the functions complete successfully.
+func AggregateGoroutines(funcs ...func() error) Aggregate {
+	errChan := make(chan error, len(funcs))
+	for _, f := range funcs {
+		go func(f func() error) { errChan <- f() }(f)
+	}
+	errs := make([]error, 0)
+	for i := 0; i < cap(errChan); i++ {
+		if err := <-errChan; err != nil {
+			errs = append(errs, err)
+		}
+	}
+	return NewAggregate(errs)
+}
+
+// ErrPreconditionViolated is returned when the precondition is violated
+var ErrPreconditionViolated = errors.New("precondition is violated")
diff --git a/third_party/k8s.io/apimachinery/pkg/util/errors/errors_test.go b/third_party/k8s.io/apimachinery/pkg/util/errors/errors_test.go
new file mode 100644
index 0000000000..02386aa48d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/errors/errors_test.go
@@ -0,0 +1,530 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package errors
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+	"sort"
+	"testing"
+)
+
+func TestEmptyAggregate(t *testing.T) {
+	var slice []error
+	var agg Aggregate
+	var err error
+
+	agg = NewAggregate(slice)
+	if agg != nil {
+		t.Errorf("expected nil, got %#v", agg)
+	}
+	err = NewAggregate(slice)
+	if err != nil {
+		t.Errorf("expected nil, got %#v", err)
+	}
+
+	// This is not normally possible, but pedantry demands I test it.
+	agg = aggregate(slice) // empty aggregate
+	if s := agg.Error(); s != "" {
+		t.Errorf("expected empty string, got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 0 {
+		t.Errorf("expected empty slice, got %#v", s)
+	}
+	err = agg.(error)
+	if s := err.Error(); s != "" {
+		t.Errorf("expected empty string, got %q", s)
+	}
+}
+
+func TestAggregateWithNil(t *testing.T) {
+	var slice []error
+	slice = []error{nil}
+	var agg Aggregate
+	var err error
+
+	agg = NewAggregate(slice)
+	if agg != nil {
+		t.Errorf("expected nil, got %#v", agg)
+	}
+	err = NewAggregate(slice)
+	if err != nil {
+		t.Errorf("expected nil, got %#v", err)
+	}
+
+	// Append a non-nil error
+	slice = append(slice, fmt.Errorf("err"))
+	agg = NewAggregate(slice)
+	if agg == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := agg.Error(); s != "err" {
+		t.Errorf("expected 'err', got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 1 {
+		t.Errorf("expected one-element slice, got %#v", s)
+	}
+	if s := agg.Errors()[0].Error(); s != "err" {
+		t.Errorf("expected 'err', got %q", s)
+	}
+
+	err = agg.(error)
+	if err == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := err.Error(); s != "err" {
+		t.Errorf("expected 'err', got %q", s)
+	}
+}
+
+func TestSingularAggregate(t *testing.T) {
+	var slice = []error{fmt.Errorf("err")}
+	var agg Aggregate
+	var err error
+
+	agg = NewAggregate(slice)
+	if agg == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := agg.Error(); s != "err" {
+		t.Errorf("expected 'err', got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 1 {
+		t.Errorf("expected one-element slice, got %#v", s)
+	}
+	if s := agg.Errors()[0].Error(); s != "err" {
+		t.Errorf("expected 'err', got %q", s)
+	}
+
+	err = agg.(error)
+	if err == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := err.Error(); s != "err" {
+		t.Errorf("expected 'err', got %q", s)
+	}
+}
+
+func TestPluralAggregate(t *testing.T) {
+	var slice = []error{fmt.Errorf("abc"), fmt.Errorf("123")}
+	var agg Aggregate
+	var err error
+
+	agg = NewAggregate(slice)
+	if agg == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := agg.Error(); s != "[abc, 123]" {
+		t.Errorf("expected '[abc, 123]', got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 2 {
+		t.Errorf("expected two-elements slice, got %#v", s)
+	}
+	if s := agg.Errors()[0].Error(); s != "abc" {
+		t.Errorf("expected '[abc, 123]', got %q", s)
+	}
+
+	err = agg.(error)
+	if err == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := err.Error(); s != "[abc, 123]" {
+		t.Errorf("expected '[abc, 123]', got %q", s)
+	}
+}
+
+func TestDedupeAggregate(t *testing.T) {
+	var slice = []error{fmt.Errorf("abc"), fmt.Errorf("abc")}
+	var agg Aggregate
+
+	agg = NewAggregate(slice)
+	if agg == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := agg.Error(); s != "abc" {
+		t.Errorf("expected 'abc', got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 2 {
+		t.Errorf("expected two-elements slice, got %#v", s)
+	}
+}
+
+func TestDedupePluralAggregate(t *testing.T) {
+	var slice = []error{fmt.Errorf("abc"), fmt.Errorf("abc"), fmt.Errorf("123")}
+	var agg Aggregate
+
+	agg = NewAggregate(slice)
+	if agg == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := agg.Error(); s != "[abc, 123]" {
+		t.Errorf("expected '[abc, 123]', got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 3 {
+		t.Errorf("expected three-elements slice, got %#v", s)
+	}
+}
+
+func TestFlattenAndDedupeAggregate(t *testing.T) {
+	var slice = []error{fmt.Errorf("abc"), fmt.Errorf("abc"), NewAggregate([]error{fmt.Errorf("abc")})}
+	var agg Aggregate
+
+	agg = NewAggregate(slice)
+	if agg == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := agg.Error(); s != "abc" {
+		t.Errorf("expected 'abc', got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 3 {
+		t.Errorf("expected three-elements slice, got %#v", s)
+	}
+}
+
+func TestFlattenAggregate(t *testing.T) {
+	var slice = []error{fmt.Errorf("abc"), fmt.Errorf("abc"), NewAggregate([]error{fmt.Errorf("abc"), fmt.Errorf("def"), NewAggregate([]error{fmt.Errorf("def"), fmt.Errorf("ghi")})})}
+	var agg Aggregate
+
+	agg = NewAggregate(slice)
+	if agg == nil {
+		t.Errorf("expected non-nil")
+	}
+	if s := agg.Error(); s != "[abc, def, ghi]" {
+		t.Errorf("expected '[abc, def, ghi]', got %q", s)
+	}
+	if s := agg.Errors(); len(s) != 3 {
+		t.Errorf("expected three-elements slice, got %#v", s)
+	}
+}
+
+func TestFilterOut(t *testing.T) {
+	testCases := []struct {
+		err      error
+		filter   []Matcher
+		expected error
+	}{
+		{
+			nil,
+			[]Matcher{},
+			nil,
+		},
+		{
+			aggregate{},
+			[]Matcher{},
+			nil,
+		},
+		{
+			aggregate{fmt.Errorf("abc")},
+			[]Matcher{},
+			aggregate{fmt.Errorf("abc")},
+		},
+		{
+			aggregate{fmt.Errorf("abc")},
+			[]Matcher{func(err error) bool { return false }},
+			aggregate{fmt.Errorf("abc")},
+		},
+		{
+			aggregate{fmt.Errorf("abc")},
+			[]Matcher{func(err error) bool { return true }},
+			nil,
+		},
+		{
+			aggregate{fmt.Errorf("abc")},
+			[]Matcher{func(err error) bool { return false }, func(err error) bool { return false }},
+			aggregate{fmt.Errorf("abc")},
+		},
+		{
+			aggregate{fmt.Errorf("abc")},
+			[]Matcher{func(err error) bool { return false }, func(err error) bool { return true }},
+			nil,
+		},
+		{
+			aggregate{fmt.Errorf("abc"), fmt.Errorf("def"), fmt.Errorf("ghi")},
+			[]Matcher{func(err error) bool { return err.Error() == "def" }},
+			aggregate{fmt.Errorf("abc"), fmt.Errorf("ghi")},
+		},
+		{
+			aggregate{aggregate{fmt.Errorf("abc")}},
+			[]Matcher{},
+			aggregate{aggregate{fmt.Errorf("abc")}},
+		},
+		{
+			aggregate{aggregate{fmt.Errorf("abc"), aggregate{fmt.Errorf("def")}}},
+			[]Matcher{},
+			aggregate{aggregate{fmt.Errorf("abc"), aggregate{fmt.Errorf("def")}}},
+		},
+		{
+			aggregate{aggregate{fmt.Errorf("abc"), aggregate{fmt.Errorf("def")}}},
+			[]Matcher{func(err error) bool { return err.Error() == "def" }},
+			aggregate{aggregate{fmt.Errorf("abc")}},
+		},
+	}
+	for i, testCase := range testCases {
+		err := FilterOut(testCase.err, testCase.filter...)
+		if !reflect.DeepEqual(testCase.expected, err) {
+			t.Errorf("%d: expected %v, got %v", i, testCase.expected, err)
+		}
+	}
+}
+
+func TestFlatten(t *testing.T) {
+	testCases := []struct {
+		agg      Aggregate
+		expected Aggregate
+	}{
+		{
+			nil,
+			nil,
+		},
+		{
+			aggregate{},
+			nil,
+		},
+		{
+			aggregate{fmt.Errorf("abc")},
+			aggregate{fmt.Errorf("abc")},
+		},
+		{
+			aggregate{fmt.Errorf("abc"), fmt.Errorf("def"), fmt.Errorf("ghi")},
+			aggregate{fmt.Errorf("abc"), fmt.Errorf("def"), fmt.Errorf("ghi")},
+		},
+		{
+			aggregate{aggregate{fmt.Errorf("abc")}},
+			aggregate{fmt.Errorf("abc")},
+		},
+		{
+			aggregate{aggregate{aggregate{fmt.Errorf("abc")}}},
+			aggregate{fmt.Errorf("abc")},
+		},
+		{
+			aggregate{aggregate{fmt.Errorf("abc"), aggregate{fmt.Errorf("def")}}},
+			aggregate{fmt.Errorf("abc"), fmt.Errorf("def")},
+		},
+		{
+			aggregate{aggregate{aggregate{fmt.Errorf("abc")}, fmt.Errorf("def"), aggregate{fmt.Errorf("ghi")}}},
+			aggregate{fmt.Errorf("abc"), fmt.Errorf("def"), fmt.Errorf("ghi")},
+		},
+	}
+	for i, testCase := range testCases {
+		agg := Flatten(testCase.agg)
+		if !reflect.DeepEqual(testCase.expected, agg) {
+			t.Errorf("%d: expected %v, got %v", i, testCase.expected, agg)
+		}
+	}
+}
+
+func TestCreateAggregateFromMessageCountMap(t *testing.T) {
+	testCases := []struct {
+		name     string
+		mcm      MessageCountMap
+		expected Aggregate
+	}{
+		{
+			"input has single instance of one message",
+			MessageCountMap{"abc": 1},
+			aggregate{fmt.Errorf("abc")},
+		},
+		{
+			"input has multiple messages",
+			MessageCountMap{"abc": 2, "ghi": 1},
+			aggregate{fmt.Errorf("abc (repeated 2 times)"), fmt.Errorf("ghi")},
+		},
+		{
+			"input has multiple messages",
+			MessageCountMap{"ghi": 1, "abc": 2},
+			aggregate{fmt.Errorf("abc (repeated 2 times)"), fmt.Errorf("ghi")},
+		},
+	}
+
+	var expected, agg []error
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			if testCase.expected != nil {
+				expected = testCase.expected.Errors()
+				sort.Slice(expected, func(i, j int) bool { return expected[i].Error() < expected[j].Error() })
+			}
+			if testCase.mcm != nil {
+				agg = CreateAggregateFromMessageCountMap(testCase.mcm).Errors()
+				sort.Slice(agg, func(i, j int) bool { return agg[i].Error() < agg[j].Error() })
+			}
+			if !reflect.DeepEqual(expected, agg) {
+				t.Errorf("expected %v, got %v", expected, agg)
+			}
+		})
+	}
+}
+
+func TestAggregateGoroutines(t *testing.T) {
+	testCases := []struct {
+		errs     []error
+		expected map[string]bool // can't compare directly to Aggregate due to non-deterministic ordering
+	}{
+		{
+			[]error{},
+			nil,
+		},
+		{
+			[]error{nil},
+			nil,
+		},
+		{
+			[]error{nil, nil},
+			nil,
+		},
+		{
+			[]error{fmt.Errorf("1")},
+			map[string]bool{"1": true},
+		},
+		{
+			[]error{fmt.Errorf("1"), nil},
+			map[string]bool{"1": true},
+		},
+		{
+			[]error{fmt.Errorf("1"), fmt.Errorf("267")},
+			map[string]bool{"1": true, "267": true},
+		},
+		{
+			[]error{fmt.Errorf("1"), nil, fmt.Errorf("1234")},
+			map[string]bool{"1": true, "1234": true},
+		},
+		{
+			[]error{nil, fmt.Errorf("1"), nil, fmt.Errorf("1234"), fmt.Errorf("22")},
+			map[string]bool{"1": true, "1234": true, "22": true},
+		},
+	}
+	for i, testCase := range testCases {
+		funcs := make([]func() error, len(testCase.errs))
+		for i := range testCase.errs {
+			err := testCase.errs[i]
+			funcs[i] = func() error { return err }
+		}
+		agg := AggregateGoroutines(funcs...)
+		if agg == nil {
+			if len(testCase.expected) > 0 {
+				t.Errorf("%d: expected %v, got nil", i, testCase.expected)
+			}
+			continue
+		}
+		if len(agg.Errors()) != len(testCase.expected) {
+			t.Errorf("%d: expected %d errors in aggregate, got %v", i, len(testCase.expected), agg)
+			continue
+		}
+		for _, err := range agg.Errors() {
+			if !testCase.expected[err.Error()] {
+				t.Errorf("%d: expected %v, got aggregate containing %v", i, testCase.expected, err)
+			}
+		}
+	}
+}
+
+type alwaysMatchingError struct{}
+
+func (_ alwaysMatchingError) Error() string {
+	return "error"
+}
+
+func (_ alwaysMatchingError) Is(_ error) bool {
+	return true
+}
+
+type someError struct{ msg string }
+
+func (se someError) Error() string {
+	if se.msg != "" {
+		return se.msg
+	}
+	return "err"
+}
+
+func TestAggregateWithErrorsIs(t *testing.T) {
+	testCases := []struct {
+		name         string
+		err          error
+		matchAgainst error
+		expectMatch  bool
+	}{
+		{
+			name:         "no match",
+			err:          aggregate{errors.New("my-error"), errors.New("my-other-error")},
+			matchAgainst: fmt.Errorf("no entry %s", "here"),
+		},
+		{
+			name:         "match via .Is()",
+			err:          aggregate{errors.New("forbidden"), alwaysMatchingError{}},
+			matchAgainst: errors.New("unauthorized"),
+			expectMatch:  true,
+		},
+		{
+			name:         "match via equality",
+			err:          aggregate{errors.New("err"), someError{}},
+			matchAgainst: someError{},
+			expectMatch:  true,
+		},
+		{
+			name:         "match via nested aggregate",
+			err:          aggregate{errors.New("closed today"), aggregate{aggregate{someError{}}}},
+			matchAgainst: someError{},
+			expectMatch:  true,
+		},
+		{
+			name:         "match via wrapped aggregate",
+			err:          fmt.Errorf("wrap: %w", aggregate{errors.New("err"), someError{}}),
+			matchAgainst: someError{},
+			expectMatch:  true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := errors.Is(tc.err, tc.matchAgainst)
+			if result != tc.expectMatch {
+				t.Errorf("expected match: %t, got match: %t", tc.expectMatch, result)
+			}
+		})
+	}
+}
+
+type accessTrackingError struct {
+	wasAccessed bool
+}
+
+func (accessTrackingError) Error() string {
+	return "err"
+}
+
+func (ate *accessTrackingError) Is(_ error) bool {
+	ate.wasAccessed = true
+	return true
+}
+
+var _ error = &accessTrackingError{}
+
+func TestErrConfigurationInvalidWithErrorsIsShortCircuitsOnFirstMatch(t *testing.T) {
+	errC := aggregate{&accessTrackingError{}, &accessTrackingError{}}
+	_ = errors.Is(errC, &accessTrackingError{})
+
+	var numAccessed int
+	for _, err := range errC {
+		if ate := err.(*accessTrackingError); ate.wasAccessed {
+			numAccessed++
+		}
+	}
+	if numAccessed != 1 {
+		t.Errorf("expected exactly one error to get accessed, got %d", numAccessed)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/framer/framer.go b/third_party/k8s.io/apimachinery/pkg/util/framer/framer.go
new file mode 100644
index 0000000000..f18845a417
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/framer/framer.go
@@ -0,0 +1,176 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package framer implements simple frame decoding techniques for an io.ReadCloser
+package framer
+
+import (
+	"encoding/binary"
+	"encoding/json"
+	"io"
+)
+
+type lengthDelimitedFrameWriter struct {
+	w io.Writer
+	h [4]byte
+}
+
+func NewLengthDelimitedFrameWriter(w io.Writer) io.Writer {
+	return &lengthDelimitedFrameWriter{w: w}
+}
+
+// Write writes a single frame to the nested writer, prepending it with the length
+// in bytes of data (as a 4 byte, bigendian uint32).
+func (w *lengthDelimitedFrameWriter) Write(data []byte) (int, error) {
+	binary.BigEndian.PutUint32(w.h[:], uint32(len(data)))
+	n, err := w.w.Write(w.h[:])
+	if err != nil {
+		return 0, err
+	}
+	if n != len(w.h) {
+		return 0, io.ErrShortWrite
+	}
+	return w.w.Write(data)
+}
+
+type lengthDelimitedFrameReader struct {
+	r         io.ReadCloser
+	remaining int
+}
+
+// NewLengthDelimitedFrameReader returns an io.Reader that will decode length-prefixed
+// frames off of a stream.
+//
+// The protocol is:
+//
+//	stream: message ...
+//	message: prefix body
+//	prefix: 4 byte uint32 in BigEndian order, denotes length of body
+//	body: bytes (0..prefix)
+//
+// If the buffer passed to Read is not long enough to contain an entire frame, io.ErrShortRead
+// will be returned along with the number of bytes read.
+func NewLengthDelimitedFrameReader(r io.ReadCloser) io.ReadCloser {
+	return &lengthDelimitedFrameReader{r: r}
+}
+
+// Read attempts to read an entire frame into data. If that is not possible, io.ErrShortBuffer
+// is returned and subsequent calls will attempt to read the last frame. A frame is complete when
+// err is nil.
+func (r *lengthDelimitedFrameReader) Read(data []byte) (int, error) {
+	if r.remaining <= 0 {
+		header := [4]byte{}
+		n, err := io.ReadAtLeast(r.r, header[:4], 4)
+		if err != nil {
+			return 0, err
+		}
+		if n != 4 {
+			return 0, io.ErrUnexpectedEOF
+		}
+		frameLength := int(binary.BigEndian.Uint32(header[:]))
+		r.remaining = frameLength
+	}
+
+	expect := r.remaining
+	max := expect
+	if max > len(data) {
+		max = len(data)
+	}
+	n, err := io.ReadAtLeast(r.r, data[:max], int(max))
+	r.remaining -= n
+	if err != nil {
+		return n, err
+	}
+	if r.remaining > 0 {
+		return n, io.ErrShortBuffer
+	}
+	if n != expect {
+		return n, io.ErrUnexpectedEOF
+	}
+
+	return n, nil
+}
+
+func (r *lengthDelimitedFrameReader) Close() error {
+	return r.r.Close()
+}
+
+type jsonFrameReader struct {
+	r         io.ReadCloser
+	decoder   *json.Decoder
+	remaining []byte
+}
+
+// NewJSONFramedReader returns an io.Reader that will decode individual JSON objects off
+// of a wire.
+//
+// The boundaries between each frame are valid JSON objects. A JSON parsing error will terminate
+// the read.
+func NewJSONFramedReader(r io.ReadCloser) io.ReadCloser {
+	return &jsonFrameReader{
+		r:       r,
+		decoder: json.NewDecoder(r),
+	}
+}
+
+// ReadFrame decodes the next JSON object in the stream, or returns an error. The returned
+// byte slice will be modified the next time ReadFrame is invoked and should not be altered.
+func (r *jsonFrameReader) Read(data []byte) (int, error) {
+	// Return whatever remaining data exists from an in progress frame
+	if n := len(r.remaining); n > 0 {
+		if n <= len(data) {
+			//nolint:staticcheck // SA4006,SA4010 underlying array of data is modified here.
+			data = append(data[0:0], r.remaining...)
+			r.remaining = nil
+			return n, nil
+		}
+
+		n = len(data)
+		//nolint:staticcheck // SA4006,SA4010 underlying array of data is modified here.
+		data = append(data[0:0], r.remaining[:n]...)
+		r.remaining = r.remaining[n:]
+		return n, io.ErrShortBuffer
+	}
+
+	// RawMessage#Unmarshal appends to data - we reset the slice down to 0 and will either see
+	// data written to data, or be larger than data and a different array.
+	m := json.RawMessage(data[:0])
+	if err := r.decoder.Decode(&m); err != nil {
+		return 0, err
+	}
+
+	// If capacity of data is less than length of the message, decoder will allocate a new slice
+	// and set m to it, which means we need to copy the partial result back into data and preserve
+	// the remaining result for subsequent reads.
+	if len(m) > cap(data) {
+		copy(data, m)
+		r.remaining = m[len(data):]
+		return len(data), io.ErrShortBuffer
+	}
+
+	if len(m) > len(data) {
+		// The bytes beyond len(data) were stored in data's underlying array, which we do
+		// not own after this function returns.
+		r.remaining = append([]byte(nil), m[len(data):]...)
+		return len(data), io.ErrShortBuffer
+	}
+
+	return len(m), nil
+}
+
+func (r *jsonFrameReader) Close() error {
+	return r.r.Close()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/framer/framer_test.go b/third_party/k8s.io/apimachinery/pkg/util/framer/framer_test.go
new file mode 100644
index 0000000000..7a04fc1b7a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/framer/framer_test.go
@@ -0,0 +1,236 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package framer
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	netutil "k8s.io/apimachinery/pkg/util/net"
+)
+
+func TestRead(t *testing.T) {
+	data := []byte{
+		0x00, 0x00, 0x00, 0x04,
+		0x01, 0x02, 0x03, 0x04,
+		0x00, 0x00, 0x00, 0x03,
+		0x05, 0x06, 0x07,
+		0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x01,
+		0x08,
+	}
+	b := bytes.NewBuffer(data)
+	r := NewLengthDelimitedFrameReader(io.NopCloser(b))
+	buf := make([]byte, 1)
+	if n, err := r.Read(buf); err != io.ErrShortBuffer && n != 1 && bytes.Equal(buf, []byte{0x01}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != io.ErrShortBuffer && n != 1 && bytes.Equal(buf, []byte{0x02}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read the remaining frame
+	buf = make([]byte, 2)
+	if n, err := r.Read(buf); err != nil && n != 2 && bytes.Equal(buf, []byte{0x03, 0x04}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read with buffer equal to frame
+	buf = make([]byte, 3)
+	if n, err := r.Read(buf); err != nil && n != 3 && bytes.Equal(buf, []byte{0x05, 0x06, 0x07}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read empty frame
+	buf = make([]byte, 3)
+	if n, err := r.Read(buf); err != nil && n != 0 && bytes.Equal(buf, []byte{}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read with larger buffer than frame
+	buf = make([]byte, 3)
+	if n, err := r.Read(buf); err != nil && n != 1 && bytes.Equal(buf, []byte{0x08}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read EOF
+	if n, err := r.Read(buf); err != io.EOF && n != 0 {
+		t.Fatalf("unexpected: %v %d", err, n)
+	}
+}
+
+func TestReadLarge(t *testing.T) {
+	data := []byte{
+		0x00, 0x00, 0x00, 0x04,
+		0x01, 0x02, 0x03, 0x04,
+		0x00, 0x00, 0x00, 0x03,
+		0x05, 0x06, 0x07,
+		0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x01,
+		0x08,
+	}
+	b := bytes.NewBuffer(data)
+	r := NewLengthDelimitedFrameReader(io.NopCloser(b))
+	buf := make([]byte, 40)
+	if n, err := r.Read(buf); err != nil && n != 4 && bytes.Equal(buf, []byte{0x01, 0x02, 0x03, 0x04}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != nil && n != 3 && bytes.Equal(buf, []byte{0x05, 0x06, 0x7}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != nil && n != 0 && bytes.Equal(buf, []byte{}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != nil && n != 1 && bytes.Equal(buf, []byte{0x08}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read EOF
+	if n, err := r.Read(buf); err != io.EOF && n != 0 {
+		t.Fatalf("unexpected: %v %d", err, n)
+	}
+}
+
+func TestReadInvalidFrame(t *testing.T) {
+	data := []byte{
+		0x00, 0x00, 0x00, 0x04,
+		0x01, 0x02,
+	}
+	b := bytes.NewBuffer(data)
+	r := NewLengthDelimitedFrameReader(io.NopCloser(b))
+	buf := make([]byte, 1)
+	if n, err := r.Read(buf); err != io.ErrShortBuffer && n != 1 && bytes.Equal(buf, []byte{0x01}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read the remaining frame
+	buf = make([]byte, 3)
+	if n, err := r.Read(buf); err != io.ErrUnexpectedEOF && n != 1 && bytes.Equal(buf, []byte{0x02}) {
+		t.Fatalf("unexpected: %v %d %v", err, n, buf)
+	}
+	// read EOF
+	if n, err := r.Read(buf); err != io.EOF && n != 0 {
+		t.Fatalf("unexpected: %v %d", err, n)
+	}
+}
+
+func TestReadClientTimeout(t *testing.T) {
+	header := []byte{
+		0x00, 0x00, 0x00, 0x04,
+	}
+	data := []byte{
+		0x01, 0x02, 0x03, 0x04,
+		0x00, 0x00, 0x00, 0x03,
+		0x05, 0x06, 0x07,
+		0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x01,
+		0x08,
+	}
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write(header)
+		if flusher, ok := w.(http.Flusher); ok {
+			flusher.Flush()
+		}
+		time.Sleep(1 * time.Second)
+		_, _ = w.Write(data)
+	}))
+	defer server.Close()
+
+	client := &http.Client{
+		Timeout: 500 * time.Millisecond,
+	}
+
+	resp, err := client.Get(server.URL)
+	if err != nil {
+		t.Fatalf("unexpected: %v", err)
+	}
+
+	r := NewLengthDelimitedFrameReader(resp.Body)
+	buf := make([]byte, 1)
+	if n, err := r.Read(buf); err == nil || !netutil.IsTimeout(err) {
+		t.Fatalf("unexpected: %v %d", err, n)
+	}
+}
+
+func TestJSONFrameReader(t *testing.T) {
+	b := bytes.NewBufferString("{\"test\":true}\n1\n[\"a\"]")
+	r := NewJSONFramedReader(io.NopCloser(b))
+	buf := make([]byte, 20)
+	if n, err := r.Read(buf); err != nil || n != 13 || string(buf[:n]) != `{"test":true}` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != nil || n != 1 || string(buf[:n]) != `1` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != nil || n != 5 || string(buf[:n]) != `["a"]` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != io.EOF || n != 0 {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+}
+
+func TestJSONFrameReaderShortBuffer(t *testing.T) {
+	b := bytes.NewBufferString("{\"test\":true}\n1\n[\"a\"]")
+	r := NewJSONFramedReader(io.NopCloser(b))
+	buf := make([]byte, 3)
+
+	if n, err := r.Read(buf); err != io.ErrShortBuffer || n != 3 || string(buf[:n]) != `{"t` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != io.ErrShortBuffer || n != 3 || string(buf[:n]) != `est` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != io.ErrShortBuffer || n != 3 || string(buf[:n]) != `":t` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != io.ErrShortBuffer || n != 3 || string(buf[:n]) != `rue` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != nil || n != 1 || string(buf[:n]) != `}` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+
+	if n, err := r.Read(buf); err != nil || n != 1 || string(buf[:n]) != `1` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+
+	if n, err := r.Read(buf); err != io.ErrShortBuffer || n != 3 || string(buf[:n]) != `["a` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	if n, err := r.Read(buf); err != nil || n != 2 || string(buf[:n]) != `"]` {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+
+	if n, err := r.Read(buf); err != io.EOF || n != 0 {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+}
+
+func TestJSONFrameReaderShortBufferNoUnderlyingArrayReuse(t *testing.T) {
+	b := bytes.NewBufferString("{}")
+	r := NewJSONFramedReader(io.NopCloser(b))
+	buf := make([]byte, 1, 2) // cap(buf) > len(buf) && cap(buf) <= len("{}")
+
+	if n, err := r.Read(buf); !errors.Is(err, io.ErrShortBuffer) || n != 1 || string(buf[:n]) != "{" {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+	buf = append(buf, make([]byte, 1)...) // stomps the second byte of the backing array
+	if n, err := r.Read(buf[1:]); err != nil || n != 1 || string(buf[1:1+n]) != "}" {
+		t.Fatalf("unexpected: %v %d %q", err, n, buf)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/httpstream/doc.go b/third_party/k8s.io/apimachinery/pkg/util/httpstream/doc.go
new file mode 100644
index 0000000000..5fdc7955fa
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/httpstream/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package httpstream contains compatibility wrappers for streaming transport APIs.
+//
+// Deprecated: use k8s.io/streaming/pkg/httpstream directly.
+package httpstream
diff --git a/third_party/k8s.io/apimachinery/pkg/util/httpstream/httpstream.go b/third_party/k8s.io/apimachinery/pkg/util/httpstream/httpstream.go
new file mode 100644
index 0000000000..a7c8d897dc
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/httpstream/httpstream.go
@@ -0,0 +1,201 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package httpstream
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+)
+
+const (
+	HeaderConnection               = "Connection"
+	HeaderUpgrade                  = "Upgrade"
+	HeaderProtocolVersion          = "X-Stream-Protocol-Version"
+	HeaderAcceptedProtocolVersions = "X-Accepted-Stream-Protocol-Versions"
+)
+
+// NewStreamHandler defines a function that is called when a new Stream is
+// received. If no error is returned, the Stream is accepted; otherwise,
+// the stream is rejected. After the reply frame has been sent, replySent is closed.
+type NewStreamHandler func(stream Stream, replySent <-chan struct{}) error
+
+// NoOpNewStreamHandler is a stream handler that accepts a new stream and
+// performs no other logic.
+func NoOpNewStreamHandler(stream Stream, replySent <-chan struct{}) error { return nil }
+
+// Dialer knows how to open a streaming connection to a server.
+type Dialer interface {
+
+	// Dial opens a streaming connection to a server using one of the protocols
+	// specified (in order of most preferred to least preferred).
+	Dial(protocols ...string) (Connection, string, error)
+}
+
+// UpgradeRoundTripper is a type of http.RoundTripper that is able to upgrade
+// HTTP requests to support multiplexed bidirectional streams. After RoundTrip()
+// is invoked, if the upgrade is successful, clients may retrieve the upgraded
+// connection by calling UpgradeRoundTripper.Connection().
+type UpgradeRoundTripper interface {
+	http.RoundTripper
+	// NewConnection validates the response and creates a new Connection.
+	NewConnection(resp *http.Response) (Connection, error)
+}
+
+// ResponseUpgrader knows how to upgrade HTTP requests and responses to
+// add streaming support to them.
+type ResponseUpgrader interface {
+	// UpgradeResponse upgrades an HTTP response to one that supports multiplexed
+	// streams. newStreamHandler will be called asynchronously whenever the
+	// other end of the upgraded connection creates a new stream.
+	UpgradeResponse(w http.ResponseWriter, req *http.Request, newStreamHandler NewStreamHandler) Connection
+}
+
+// Connection represents an upgraded HTTP connection.
+type Connection interface {
+	// CreateStream creates a new Stream with the supplied headers.
+	CreateStream(headers http.Header) (Stream, error)
+	// Close resets all streams and closes the connection.
+	Close() error
+	// CloseChan returns a channel that is closed when the underlying connection is closed.
+	CloseChan() <-chan bool
+	// SetIdleTimeout sets the amount of time the connection may remain idle before
+	// it is automatically closed.
+	SetIdleTimeout(timeout time.Duration)
+	// RemoveStreams can be used to remove a set of streams from the Connection.
+	RemoveStreams(streams ...Stream)
+}
+
+// Stream represents a bidirectional communications channel that is part of an
+// upgraded connection.
+type Stream interface {
+	io.ReadWriteCloser
+	// Reset closes both directions of the stream, indicating that neither client
+	// or server can use it any more.
+	Reset() error
+	// Headers returns the headers used to create the stream.
+	Headers() http.Header
+	// Identifier returns the stream's ID.
+	Identifier() uint32
+}
+
+// UpgradeFailureError encapsulates the cause for why the streaming
+// upgrade request failed. Implements error interface.
+type UpgradeFailureError struct {
+	Cause error
+}
+
+func (u *UpgradeFailureError) Error() string {
+	return fmt.Sprintf("unable to upgrade streaming request: %s", u.Cause)
+}
+
+// IsUpgradeFailure returns true if the passed error is (or wrapped error contains)
+// the UpgradeFailureError.
+func IsUpgradeFailure(err error) bool {
+	if err == nil {
+		return false
+	}
+	var upgradeErr *UpgradeFailureError
+	return errors.As(err, &upgradeErr)
+}
+
+// isHTTPSProxyError returns true if error is Gorilla/Websockets HTTPS Proxy dial error;
+// false otherwise (see https://github.com/kubernetes/kubernetes/issues/126134).
+func IsHTTPSProxyError(err error) bool {
+	if err == nil {
+		return false
+	}
+	return strings.Contains(err.Error(), "proxy: unknown scheme: https")
+}
+
+// IsUpgradeRequest returns true if the given request is a connection upgrade request
+func IsUpgradeRequest(req *http.Request) bool {
+	for _, h := range req.Header[http.CanonicalHeaderKey(HeaderConnection)] {
+		if strings.Contains(strings.ToLower(h), strings.ToLower(HeaderUpgrade)) {
+			return true
+		}
+	}
+	return false
+}
+
+func negotiateProtocol(clientProtocols, serverProtocols []string) string {
+	for i := range clientProtocols {
+		for j := range serverProtocols {
+			if clientProtocols[i] == serverProtocols[j] {
+				return clientProtocols[i]
+			}
+		}
+	}
+	return ""
+}
+
+func commaSeparatedHeaderValues(header []string) []string {
+	var parsedClientProtocols []string
+	for i := range header {
+		for _, clientProtocol := range strings.Split(header[i], ",") {
+			if proto := strings.Trim(clientProtocol, " "); len(proto) > 0 {
+				parsedClientProtocols = append(parsedClientProtocols, proto)
+			}
+		}
+	}
+	return parsedClientProtocols
+}
+
+// Handshake performs a subprotocol negotiation. If the client did request a
+// subprotocol, Handshake will select the first common value found in
+// serverProtocols, otherwise it will return an error and write an HTTP BadRequest to the response.
+// If a match is found, Handshake adds a response header indicating the chosen subprotocol.
+// If no match is found, HTTP forbidden is returned, along with a response header containing
+// the list of protocols the server can accept.
+func Handshake(req *http.Request, w http.ResponseWriter, serverProtocols []string) (string, error) {
+	if len(serverProtocols) == 0 {
+		panic(fmt.Errorf("unable to upgrade: serverProtocols is required"))
+	}
+	values, ok := req.Header[http.CanonicalHeaderKey(HeaderProtocolVersion)]
+	if !ok {
+		err := fmt.Errorf("unable to upgrade: header %s does not exist in request with %d headers", HeaderProtocolVersion, len(req.Header))
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return "", err
+	}
+	if len(values) == 0 {
+		err := fmt.Errorf("unable to upgrade: header %s is empty", HeaderProtocolVersion)
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return "", err
+	}
+	clientProtocols := commaSeparatedHeaderValues(values)
+	if len(clientProtocols) == 0 {
+		err := fmt.Errorf("unable to upgrade: header %s contains %s, but no valid protocols", HeaderProtocolVersion, values)
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return "", err
+	}
+
+	negotiatedProtocol := negotiateProtocol(clientProtocols, serverProtocols)
+	if len(negotiatedProtocol) == 0 {
+		for i := range serverProtocols {
+			w.Header().Add(HeaderAcceptedProtocolVersions, serverProtocols[i])
+		}
+		err := fmt.Errorf("unable to upgrade: unable to negotiate protocol: client supports %v, server accepts %v", clientProtocols, serverProtocols)
+		http.Error(w, err.Error(), http.StatusForbidden)
+		return "", err
+	}
+
+	w.Header().Add(HeaderProtocolVersion, negotiatedProtocol)
+	return negotiatedProtocol, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/httpstream/spdy/doc.go b/third_party/k8s.io/apimachinery/pkg/util/httpstream/spdy/doc.go
new file mode 100644
index 0000000000..d03acb0eed
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/httpstream/spdy/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package spdy contains compatibility wrappers for the SPDY transport stack.
+//
+// Deprecated: use k8s.io/streaming/pkg/httpstream/spdy directly.
+package spdy
diff --git a/third_party/k8s.io/apimachinery/pkg/util/httpstream/spdy/spdy.go b/third_party/k8s.io/apimachinery/pkg/util/httpstream/spdy/spdy.go
new file mode 100644
index 0000000000..37dfe81894
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/httpstream/spdy/spdy.go
@@ -0,0 +1,236 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package spdy
+
+import (
+	"crypto/tls"
+	"net"
+	"net/http"
+	"net/url"
+	"time"
+
+	apihttpstream "k8s.io/apimachinery/pkg/util/httpstream"
+	streamhttp "k8s.io/streaming/pkg/httpstream"
+	streamspdy "k8s.io/streaming/pkg/httpstream/spdy"
+)
+
+const HeaderSpdy31 = streamspdy.HeaderSpdy31
+
+// SpdyRoundTripper is a compatibility wrapper around the streaming module's
+// SPDY round tripper.
+type SpdyRoundTripper struct {
+	delegate *streamspdy.SpdyRoundTripper
+}
+
+func NewRoundTripper(tlsConfig *tls.Config) (*SpdyRoundTripper, error) {
+	delegate, err := streamspdy.NewRoundTripper(tlsConfig)
+	if err != nil {
+		return nil, err
+	}
+	return &SpdyRoundTripper{delegate: delegate}, nil
+}
+
+func NewRoundTripperWithProxy(tlsConfig *tls.Config, proxier func(*http.Request) (*url.URL, error)) (*SpdyRoundTripper, error) {
+	delegate, err := streamspdy.NewRoundTripperWithProxy(tlsConfig, proxier)
+	if err != nil {
+		return nil, err
+	}
+	return &SpdyRoundTripper{delegate: delegate}, nil
+}
+
+// RoundTripperConfig is a set of options for an SpdyRoundTripper.
+type RoundTripperConfig struct {
+	// TLS configuration used by the round tripper if UpgradeTransport not present.
+	TLS *tls.Config
+	// Proxier is a proxy function invoked on each request. Optional.
+	Proxier func(*http.Request) (*url.URL, error)
+	// PingPeriod is a period for sending SPDY Pings on the connection.
+	// Optional.
+	PingPeriod time.Duration
+	// UpgradeTransport is a subtitute transport used for dialing. If set,
+	// this field will be used instead of "TLS" and "Proxier" for connection creation.
+	// Optional.
+	UpgradeTransport http.RoundTripper
+}
+
+func NewRoundTripperWithConfig(cfg RoundTripperConfig) (*SpdyRoundTripper, error) {
+	delegate, err := streamspdy.NewRoundTripperWithConfig(streamspdy.RoundTripperConfig{
+		TLS:              cfg.TLS,
+		Proxier:          cfg.Proxier,
+		PingPeriod:       cfg.PingPeriod,
+		UpgradeTransport: cfg.UpgradeTransport,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &SpdyRoundTripper{delegate: delegate}, nil
+}
+
+// TLSClientConfig implements pkg/util/net.TLSClientConfigHolder for proper TLS checking during
+// proxying with a spdy roundtripper.
+func (s *SpdyRoundTripper) TLSClientConfig() *tls.Config {
+	return s.delegate.TLSClientConfig()
+}
+
+// Dial opens a network connection for an upgrade request.
+func (s *SpdyRoundTripper) Dial(req *http.Request) (net.Conn, error) {
+	return s.delegate.Dial(req)
+}
+
+// RoundTrip executes a request and upgrades the connection.
+func (s *SpdyRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	return s.delegate.RoundTrip(req)
+}
+
+// NewConnection validates a server upgrade response and prepares the transport.
+func (s *SpdyRoundTripper) NewConnection(resp *http.Response) (apihttpstream.Connection, error) {
+	conn, err := s.delegate.NewConnection(resp)
+	if err != nil {
+		return nil, err
+	}
+	return wrapConnection(conn), nil
+}
+
+type responseUpgraderAdapter struct {
+	delegate streamhttp.ResponseUpgrader
+}
+
+func (r *responseUpgraderAdapter) UpgradeResponse(w http.ResponseWriter, req *http.Request, newStreamHandler apihttpstream.NewStreamHandler) apihttpstream.Connection {
+	conn := r.delegate.UpgradeResponse(w, req, wrapNewStreamHandler(newStreamHandler))
+	return wrapConnection(conn)
+}
+
+func NewResponseUpgrader() apihttpstream.ResponseUpgrader {
+	return &responseUpgraderAdapter{delegate: streamspdy.NewResponseUpgrader()}
+}
+
+func NewResponseUpgraderWithPings(pingPeriod time.Duration) apihttpstream.ResponseUpgrader {
+	return &responseUpgraderAdapter{delegate: streamspdy.NewResponseUpgraderWithPings(pingPeriod)}
+}
+
+func NewClientConnection(conn net.Conn) (apihttpstream.Connection, error) {
+	c, err := streamspdy.NewClientConnection(conn)
+	if err != nil {
+		return nil, err
+	}
+	return wrapConnection(c), nil
+}
+
+func NewClientConnectionWithPings(conn net.Conn, pingPeriod time.Duration) (apihttpstream.Connection, error) {
+	c, err := streamspdy.NewClientConnectionWithPings(conn, pingPeriod)
+	if err != nil {
+		return nil, err
+	}
+	return wrapConnection(c), nil
+}
+
+func NewServerConnection(conn net.Conn, newStreamHandler apihttpstream.NewStreamHandler) (apihttpstream.Connection, error) {
+	c, err := streamspdy.NewServerConnection(conn, wrapNewStreamHandler(newStreamHandler))
+	if err != nil {
+		return nil, err
+	}
+	return wrapConnection(c), nil
+}
+
+func NewServerConnectionWithPings(conn net.Conn, newStreamHandler apihttpstream.NewStreamHandler, pingPeriod time.Duration) (apihttpstream.Connection, error) {
+	c, err := streamspdy.NewServerConnectionWithPings(conn, wrapNewStreamHandler(newStreamHandler), pingPeriod)
+	if err != nil {
+		return nil, err
+	}
+	return wrapConnection(c), nil
+}
+
+type streamAdapter struct {
+	delegate streamhttp.Stream
+}
+
+func (s *streamAdapter) Read(p []byte) (int, error) {
+	return s.delegate.Read(p)
+}
+
+func (s *streamAdapter) Write(p []byte) (int, error) {
+	return s.delegate.Write(p)
+}
+
+func (s *streamAdapter) Close() error {
+	return s.delegate.Close()
+}
+
+func (s *streamAdapter) Reset() error {
+	return s.delegate.Reset()
+}
+
+func (s *streamAdapter) Headers() http.Header {
+	return s.delegate.Headers()
+}
+
+func (s *streamAdapter) Identifier() uint32 {
+	return s.delegate.Identifier()
+}
+
+type connectionAdapter struct {
+	delegate streamhttp.Connection
+}
+
+func (c *connectionAdapter) CreateStream(headers http.Header) (apihttpstream.Stream, error) {
+	stream, err := c.delegate.CreateStream(headers)
+	if err != nil {
+		return nil, err
+	}
+	return &streamAdapter{delegate: stream}, nil
+}
+
+func (c *connectionAdapter) Close() error {
+	return c.delegate.Close()
+}
+
+func (c *connectionAdapter) CloseChan() <-chan bool {
+	return c.delegate.CloseChan()
+}
+
+func (c *connectionAdapter) SetIdleTimeout(timeout time.Duration) {
+	c.delegate.SetIdleTimeout(timeout)
+}
+
+func (c *connectionAdapter) RemoveStreams(streams ...apihttpstream.Stream) {
+	streamingStreams := make([]streamhttp.Stream, 0, len(streams))
+	for _, stream := range streams {
+		if stream == nil {
+			continue
+		}
+		if s, ok := stream.(streamhttp.Stream); ok {
+			streamingStreams = append(streamingStreams, s)
+		}
+	}
+	c.delegate.RemoveStreams(streamingStreams...)
+}
+
+func wrapConnection(conn streamhttp.Connection) apihttpstream.Connection {
+	if conn == nil {
+		return nil
+	}
+	return &connectionAdapter{delegate: conn}
+}
+
+func wrapNewStreamHandler(newStreamHandler apihttpstream.NewStreamHandler) streamhttp.NewStreamHandler {
+	if newStreamHandler == nil {
+		return nil
+	}
+	return func(stream streamhttp.Stream, replySent <-chan struct{}) error {
+		return newStreamHandler(&streamAdapter{delegate: stream}, replySent)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/httpstream/wsstream/doc.go b/third_party/k8s.io/apimachinery/pkg/util/httpstream/wsstream/doc.go
new file mode 100644
index 0000000000..9b07bfbb13
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/httpstream/wsstream/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package wsstream contains compatibility wrappers for websocket streaming.
+//
+// Deprecated: use k8s.io/streaming/pkg/httpstream/wsstream directly.
+package wsstream
diff --git a/third_party/k8s.io/apimachinery/pkg/util/httpstream/wsstream/wsstream.go b/third_party/k8s.io/apimachinery/pkg/util/httpstream/wsstream/wsstream.go
new file mode 100644
index 0000000000..73abcdc6ea
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/httpstream/wsstream/wsstream.go
@@ -0,0 +1,92 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wsstream
+
+import (
+	"io"
+	"net/http"
+	"time"
+
+	"golang.org/x/net/websocket"
+
+	"k8s.io/klog/v2"
+	streamws "k8s.io/streaming/pkg/httpstream/wsstream"
+)
+
+const (
+	WebSocketProtocolHeader        = streamws.WebSocketProtocolHeader
+	ChannelWebSocketProtocol       = streamws.ChannelWebSocketProtocol
+	Base64ChannelWebSocketProtocol = streamws.Base64ChannelWebSocketProtocol
+)
+
+type ChannelType = streamws.ChannelType
+
+const (
+	IgnoreChannel    = streamws.IgnoreChannel
+	ReadChannel      = streamws.ReadChannel
+	WriteChannel     = streamws.WriteChannel
+	ReadWriteChannel = streamws.ReadWriteChannel
+)
+
+func IsWebSocketRequest(req *http.Request) bool {
+	return streamws.IsWebSocketRequest(req)
+}
+
+func IsWebSocketRequestWithStreamCloseProtocol(req *http.Request) bool {
+	return streamws.IsWebSocketRequestWithStreamCloseProtocol(req)
+}
+
+func IsWebSocketRequestWithTunnelingProtocol(req *http.Request) bool {
+	return streamws.IsWebSocketRequestWithTunnelingProtocol(req)
+}
+
+func IgnoreReceives(ws *websocket.Conn, timeout time.Duration) {
+	streamws.IgnoreReceives(ws, timeout)
+}
+
+func IgnoreReceivesWithLogger(logger klog.Logger, ws *websocket.Conn, timeout time.Duration) {
+	streamws.IgnoreReceivesWithLogger(logger, ws, timeout)
+}
+
+type ChannelProtocolConfig = streamws.ChannelProtocolConfig
+
+func NewDefaultChannelProtocols(channels []ChannelType) map[string]ChannelProtocolConfig {
+	return streamws.NewDefaultChannelProtocols(channels)
+}
+
+type Conn = streamws.Conn
+
+func NewConn(protocols map[string]ChannelProtocolConfig) *Conn {
+	return streamws.NewConn(protocols)
+}
+
+type ReaderProtocolConfig = streamws.ReaderProtocolConfig
+
+func NewDefaultReaderProtocols() map[string]ReaderProtocolConfig {
+	return streamws.NewDefaultReaderProtocols()
+}
+
+type Reader = streamws.Reader
+
+func NewReader(r io.Reader, ping bool, protocols map[string]ReaderProtocolConfig) *Reader {
+	//nolint:logcheck // Intentionally using the non-contextual variant here.
+	return streamws.NewReader(r, ping, protocols)
+}
+
+func NewReaderWithLogger(logger klog.Logger, r io.Reader, ping bool, protocols map[string]ReaderProtocolConfig) *Reader {
+	return streamws.NewReaderWithLogger(logger, r, ping, protocols)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/intstr/generated.pb.go b/third_party/k8s.io/apimachinery/pkg/util/intstr/generated.pb.go
new file mode 100644
index 0000000000..5be552e1eb
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/intstr/generated.pb.go
@@ -0,0 +1,298 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/apimachinery/pkg/util/intstr/generated.proto
+
+package intstr
+
+import (
+	fmt "fmt"
+
+	io "io"
+	math_bits "math/bits"
+)
+
+func (m *IntOrString) Reset() { *m = IntOrString{} }
+
+func (m *IntOrString) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *IntOrString) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *IntOrString) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.StrVal)
+	copy(dAtA[i:], m.StrVal)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.StrVal)))
+	i--
+	dAtA[i] = 0x1a
+	i = encodeVarintGenerated(dAtA, i, uint64(m.IntVal))
+	i--
+	dAtA[i] = 0x10
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Type))
+	i--
+	dAtA[i] = 0x8
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *IntOrString) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 1 + sovGenerated(uint64(m.Type))
+	n += 1 + sovGenerated(uint64(m.IntVal))
+	l = len(m.StrVal)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozGenerated(x uint64) (n int) {
+	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (m *IntOrString) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: IntOrString: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: IntOrString: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			m.Type = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Type |= Type(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IntVal", wireType)
+			}
+			m.IntVal = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.IntVal |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StrVal", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.StrVal = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipGenerated(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLengthGenerated
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupGenerated
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthGenerated
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+var (
+	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/util/intstr/generated.proto b/third_party/k8s.io/apimachinery/pkg/util/intstr/generated.proto
new file mode 100644
index 0000000000..e3d26a59a5
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/intstr/generated.proto
@@ -0,0 +1,44 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.apimachinery.pkg.util.intstr;
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/apimachinery/pkg/util/intstr";
+
+// IntOrString is a type that can hold an int32 or a string.  When used in
+// JSON or YAML marshalling and unmarshalling, it produces or consumes the
+// inner type.  This allows you to have, for example, a JSON field that can
+// accept a name or number.
+// TODO: Rename to Int32OrString
+//
+// +protobuf=true
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.util.intstr
+message IntOrString {
+  optional int64 type = 1;
+
+  optional int32 intVal = 2;
+
+  optional string strVal = 3;
+}
+
diff --git a/third_party/k8s.io/apimachinery/pkg/util/intstr/instr_fuzz.go b/third_party/k8s.io/apimachinery/pkg/util/intstr/instr_fuzz.go
new file mode 100644
index 0000000000..494325c1f3
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/intstr/instr_fuzz.go
@@ -0,0 +1,42 @@
+//go:build !notest
+
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package intstr
+
+import (
+	"sigs.k8s.io/randfill"
+)
+
+// RandFill satisfies randfill.NativeSelfFiller
+func (intstr *IntOrString) RandFill(c randfill.Continue) {
+	if intstr == nil {
+		return
+	}
+	if c.Bool() {
+		intstr.Type = Int
+		c.Fill(&intstr.IntVal)
+		intstr.StrVal = ""
+	} else {
+		intstr.Type = String
+		intstr.IntVal = 0
+		c.Fill(&intstr.StrVal)
+	}
+}
+
+// ensure IntOrString implements fuzz.Interface
+var _ randfill.NativeSelfFiller = &IntOrString{}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/intstr/intstr.go b/third_party/k8s.io/apimachinery/pkg/util/intstr/intstr.go
new file mode 100644
index 0000000000..b0ca3803e4
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/intstr/intstr.go
@@ -0,0 +1,260 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package intstr
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"math"
+	"runtime/debug"
+	"strconv"
+	"strings"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	"k8s.io/klog/v2"
+)
+
+// IntOrString is a type that can hold an int32 or a string.  When used in
+// JSON or YAML marshalling and unmarshalling, it produces or consumes the
+// inner type.  This allows you to have, for example, a JSON field that can
+// accept a name or number.
+// TODO: Rename to Int32OrString
+//
+// +protobuf=true
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.util.intstr
+type IntOrString struct {
+	Type   Type   `protobuf:"varint,1,opt,name=type,casttype=Type"`
+	IntVal int32  `protobuf:"varint,2,opt,name=intVal"`
+	StrVal string `protobuf:"bytes,3,opt,name=strVal"`
+}
+
+// Type represents the stored type of IntOrString.
+type Type int64
+
+const (
+	Int    Type = iota // The IntOrString holds an int.
+	String             // The IntOrString holds a string.
+)
+
+// FromInt creates an IntOrString object with an int32 value. It is
+// your responsibility not to call this method with a value greater
+// than int32.
+// Deprecated: use FromInt32 instead.
+func FromInt(val int) IntOrString {
+	if val > math.MaxInt32 || val < math.MinInt32 {
+		//nolint:logcheck // Should not be reached.
+		klog.Errorf("value: %d overflows int32\n%s\n", val, debug.Stack())
+	}
+	return IntOrString{Type: Int, IntVal: int32(val)}
+}
+
+// FromInt32 creates an IntOrString object with an int32 value.
+func FromInt32(val int32) IntOrString {
+	return IntOrString{Type: Int, IntVal: val}
+}
+
+// FromString creates an IntOrString object with a string value.
+func FromString(val string) IntOrString {
+	return IntOrString{Type: String, StrVal: val}
+}
+
+// Parse the given string and try to convert it to an int32 integer before
+// setting it as a string value.
+func Parse(val string) IntOrString {
+	i, err := strconv.ParseInt(val, 10, 32)
+	if err != nil {
+		return FromString(val)
+	}
+	return FromInt32(int32(i))
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+func (intstr *IntOrString) UnmarshalJSON(value []byte) error {
+	if value[0] == '"' {
+		intstr.Type = String
+		return json.Unmarshal(value, &intstr.StrVal)
+	}
+	intstr.Type = Int
+	return json.Unmarshal(value, &intstr.IntVal)
+}
+
+func (intstr *IntOrString) UnmarshalCBOR(value []byte) error {
+	if err := cbor.Unmarshal(value, &intstr.StrVal); err == nil {
+		intstr.Type = String
+		return nil
+	}
+
+	if err := cbor.Unmarshal(value, &intstr.IntVal); err != nil {
+		return err
+	}
+
+	intstr.Type = Int
+	return nil
+}
+
+// String returns the string value, or the Itoa of the int value.
+func (intstr *IntOrString) String() string {
+	if intstr == nil {
+		return "<nil>"
+	}
+	if intstr.Type == String {
+		return intstr.StrVal
+	}
+	return strconv.Itoa(intstr.IntValue())
+}
+
+// IntValue returns the IntVal if type Int, or if
+// it is a String, will attempt a conversion to int,
+// returning 0 if a parsing error occurs.
+func (intstr *IntOrString) IntValue() int {
+	if intstr.Type == String {
+		i, _ := strconv.Atoi(intstr.StrVal)
+		return i
+	}
+	return int(intstr.IntVal)
+}
+
+// MarshalJSON implements the json.Marshaller interface.
+func (intstr IntOrString) MarshalJSON() ([]byte, error) {
+	switch intstr.Type {
+	case Int:
+		return json.Marshal(intstr.IntVal)
+	case String:
+		return json.Marshal(intstr.StrVal)
+	default:
+		return []byte{}, fmt.Errorf("impossible IntOrString.Type")
+	}
+}
+
+func (intstr IntOrString) MarshalCBOR() ([]byte, error) {
+	switch intstr.Type {
+	case Int:
+		return cbor.Marshal(intstr.IntVal)
+	case String:
+		return cbor.Marshal(intstr.StrVal)
+	default:
+		return nil, fmt.Errorf("impossible IntOrString.Type")
+	}
+}
+
+// OpenAPISchemaType is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+//
+// See: https://github.com/kubernetes/kube-openapi/tree/master/pkg/generators
+func (IntOrString) OpenAPISchemaType() []string { return []string{"string"} }
+
+// OpenAPISchemaFormat is used by the kube-openapi generator when constructing
+// the OpenAPI spec of this type.
+func (IntOrString) OpenAPISchemaFormat() string { return "int-or-string" }
+
+// OpenAPIV3OneOfTypes is used by the kube-openapi generator when constructing
+// the OpenAPI v3 spec of this type.
+func (IntOrString) OpenAPIV3OneOfTypes() []string { return []string{"integer", "string"} }
+
+func ValueOrDefault(intOrPercent *IntOrString, defaultValue IntOrString) *IntOrString {
+	if intOrPercent == nil {
+		return &defaultValue
+	}
+	return intOrPercent
+}
+
+// GetScaledValueFromIntOrPercent is meant to replace GetValueFromIntOrPercent.
+// This method returns a scaled value from an IntOrString type. If the IntOrString
+// is a percentage string value it's treated as a percentage and scaled appropriately
+// in accordance to the total, if it's an int value it's treated as a simple value and
+// if it is a string value which is either non-numeric or numeric but lacking a trailing '%' it returns an error.
+func GetScaledValueFromIntOrPercent(intOrPercent *IntOrString, total int, roundUp bool) (int, error) {
+	if intOrPercent == nil {
+		return 0, errors.New("nil value for IntOrString")
+	}
+	value, isPercent, err := getIntOrPercentValueSafely(intOrPercent)
+	if err != nil {
+		return 0, fmt.Errorf("invalid value for IntOrString: %v", err)
+	}
+	if isPercent {
+		if roundUp {
+			value = int(math.Ceil(float64(value) * (float64(total)) / 100))
+		} else {
+			value = int(math.Floor(float64(value) * (float64(total)) / 100))
+		}
+	}
+	return value, nil
+}
+
+// GetValueFromIntOrPercent was deprecated in favor of
+// GetScaledValueFromIntOrPercent. This method was treating all int as a numeric value and all
+// strings with or without a percent symbol as a percentage value.
+// Deprecated
+func GetValueFromIntOrPercent(intOrPercent *IntOrString, total int, roundUp bool) (int, error) {
+	if intOrPercent == nil {
+		return 0, errors.New("nil value for IntOrString")
+	}
+	value, isPercent, err := getIntOrPercentValue(intOrPercent)
+	if err != nil {
+		return 0, fmt.Errorf("invalid value for IntOrString: %v", err)
+	}
+	if isPercent {
+		if roundUp {
+			value = int(math.Ceil(float64(value) * (float64(total)) / 100))
+		} else {
+			value = int(math.Floor(float64(value) * (float64(total)) / 100))
+		}
+	}
+	return value, nil
+}
+
+// getIntOrPercentValue is a legacy function and only meant to be called by GetValueFromIntOrPercent
+// For a more correct implementation call getIntOrPercentSafely
+func getIntOrPercentValue(intOrStr *IntOrString) (int, bool, error) {
+	switch intOrStr.Type {
+	case Int:
+		return intOrStr.IntValue(), false, nil
+	case String:
+		s := strings.Replace(intOrStr.StrVal, "%", "", -1)
+		v, err := strconv.Atoi(s)
+		if err != nil {
+			return 0, false, fmt.Errorf("invalid value %q: %v", intOrStr.StrVal, err)
+		}
+		return int(v), true, nil
+	}
+	return 0, false, fmt.Errorf("invalid type: neither int nor percentage")
+}
+
+func getIntOrPercentValueSafely(intOrStr *IntOrString) (int, bool, error) {
+	switch intOrStr.Type {
+	case Int:
+		return intOrStr.IntValue(), false, nil
+	case String:
+		isPercent := false
+		s := intOrStr.StrVal
+		if strings.HasSuffix(s, "%") {
+			isPercent = true
+			s = strings.TrimSuffix(intOrStr.StrVal, "%")
+		} else {
+			return 0, false, fmt.Errorf("invalid type: string is not a percentage")
+		}
+		v, err := strconv.Atoi(s)
+		if err != nil {
+			return 0, false, fmt.Errorf("invalid value %q: %v", intOrStr.StrVal, err)
+		}
+		return int(v), isPercent, nil
+	}
+	return 0, false, fmt.Errorf("invalid type: neither int nor percentage")
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/intstr/intstr_test.go b/third_party/k8s.io/apimachinery/pkg/util/intstr/intstr_test.go
new file mode 100644
index 0000000000..eb63854bbc
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/intstr/intstr_test.go
@@ -0,0 +1,568 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package intstr
+
+import (
+	"encoding/json"
+	"fmt"
+	"math"
+	"reflect"
+	"testing"
+
+	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
+	"sigs.k8s.io/yaml"
+
+	"github.com/google/go-cmp/cmp"
+	"sigs.k8s.io/randfill"
+)
+
+func TestFromInt(t *testing.T) {
+	i := FromInt(93)
+	if i.Type != Int || i.IntVal != 93 {
+		t.Errorf("Expected IntVal=93, got %+v", i)
+	}
+}
+
+func TestFromInt32(t *testing.T) {
+	i := FromInt32(93)
+	if i.Type != Int || i.IntVal != 93 {
+		t.Errorf("Expected IntVal=93, got %+v", i)
+	}
+}
+
+func TestFromString(t *testing.T) {
+	i := FromString("76")
+	if i.Type != String || i.StrVal != "76" {
+		t.Errorf("Expected StrVal=\"76\", got %+v", i)
+	}
+}
+
+type IntOrStringHolder struct {
+	IOrS IntOrString `json:"val"`
+}
+
+func TestIntOrStringUnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  string
+		result IntOrString
+	}{
+		{"{\"val\": 123}", FromInt32(123)},
+		{"{\"val\": \"123\"}", FromString("123")},
+	}
+
+	for _, c := range cases {
+		var result IntOrStringHolder
+		if err := json.Unmarshal([]byte(c.input), &result); err != nil {
+			t.Errorf("Failed to unmarshal input '%v': %v", c.input, err)
+		}
+		if result.IOrS != c.result {
+			t.Errorf("Failed to unmarshal input '%v': expected %+v, got %+v", c.input, c.result, result)
+		}
+	}
+}
+
+func TestIntOrStringMarshalJSON(t *testing.T) {
+	cases := []struct {
+		input  IntOrString
+		result string
+	}{
+		{FromInt32(123), "{\"val\":123}"},
+		{FromString("123"), "{\"val\":\"123\"}"},
+	}
+
+	for _, c := range cases {
+		input := IntOrStringHolder{c.input}
+		result, err := json.Marshal(&input)
+		if err != nil {
+			t.Errorf("Failed to marshal input '%v': %v", input, err)
+		}
+		if string(result) != c.result {
+			t.Errorf("Failed to marshal input '%v': expected: %+v, got %q", input, c.result, string(result))
+		}
+	}
+}
+
+func TestIntOrStringMarshalJSONUnmarshalYAML(t *testing.T) {
+	cases := []struct {
+		input IntOrString
+	}{
+		{FromInt32(123)},
+		{FromString("123")},
+	}
+
+	for _, c := range cases {
+		input := IntOrStringHolder{c.input}
+		jsonMarshalled, err := json.Marshal(&input)
+		if err != nil {
+			t.Errorf("1: Failed to marshal input: '%v': %v", input, err)
+		}
+
+		var result IntOrStringHolder
+		err = yaml.Unmarshal(jsonMarshalled, &result)
+		if err != nil {
+			t.Errorf("2: Failed to unmarshal '%+v': %v", string(jsonMarshalled), err)
+		}
+
+		if !reflect.DeepEqual(input, result) {
+			t.Errorf("3: Failed to marshal input '%+v': got %+v", input, result)
+		}
+	}
+}
+
+func TestGetIntFromIntOrString(t *testing.T) {
+	tests := []struct {
+		input      IntOrString
+		expectErr  bool
+		expectVal  int
+		expectPerc bool
+	}{
+		{
+			input:      FromInt32(200),
+			expectErr:  false,
+			expectVal:  200,
+			expectPerc: false,
+		},
+		{
+			input:      FromString("200"),
+			expectErr:  true,
+			expectPerc: false,
+		},
+		{
+			input:      FromString("30%0"),
+			expectErr:  true,
+			expectPerc: false,
+		},
+		{
+			input:      FromString("40%"),
+			expectErr:  false,
+			expectVal:  40,
+			expectPerc: true,
+		},
+		{
+			input:      FromString("%"),
+			expectErr:  true,
+			expectPerc: false,
+		},
+		{
+			input:      FromString("a%"),
+			expectErr:  true,
+			expectPerc: false,
+		},
+		{
+			input:      FromString("a"),
+			expectErr:  true,
+			expectPerc: false,
+		},
+		{
+			input:      FromString("40#"),
+			expectErr:  true,
+			expectPerc: false,
+		},
+		{
+			input:      FromString("40%%"),
+			expectErr:  true,
+			expectPerc: false,
+		},
+	}
+	for _, test := range tests {
+		t.Run("", func(t *testing.T) {
+			value, isPercent, err := getIntOrPercentValueSafely(&test.input)
+			if test.expectVal != value {
+				t.Fatalf("expected value does not match, expected: %d, got: %d", test.expectVal, value)
+			}
+			if test.expectPerc != isPercent {
+				t.Fatalf("expected percent does not match, expected: %t, got: %t", test.expectPerc, isPercent)
+			}
+			if test.expectErr != (err != nil) {
+				t.Fatalf("expected error does not match, expected error: %v, got: %v", test.expectErr, err)
+			}
+		})
+	}
+
+}
+
+func TestGetIntFromIntOrPercent(t *testing.T) {
+	tests := []struct {
+		input     IntOrString
+		total     int
+		roundUp   bool
+		expectErr bool
+		expectVal int
+	}{
+		{
+			input:     FromInt32(123),
+			expectErr: false,
+			expectVal: 123,
+		},
+		{
+			input:     FromString("90%"),
+			total:     100,
+			roundUp:   true,
+			expectErr: false,
+			expectVal: 90,
+		},
+		{
+			input:     FromString("90%"),
+			total:     95,
+			roundUp:   true,
+			expectErr: false,
+			expectVal: 86,
+		},
+		{
+			input:     FromString("90%"),
+			total:     95,
+			roundUp:   false,
+			expectErr: false,
+			expectVal: 85,
+		},
+		{
+			input:     FromString("%"),
+			expectErr: true,
+		},
+		{
+			input:     FromString("90#"),
+			expectErr: true,
+		},
+		{
+			input:     FromString("#%"),
+			expectErr: true,
+		},
+		{
+			input:     FromString("90"),
+			expectErr: true,
+		},
+	}
+
+	for i, test := range tests {
+		t.Logf("test case %d", i)
+		value, err := GetScaledValueFromIntOrPercent(&test.input, test.total, test.roundUp)
+		if test.expectErr && err == nil {
+			t.Errorf("expected error, but got none")
+			continue
+		}
+		if !test.expectErr && err != nil {
+			t.Errorf("unexpected err: %v", err)
+			continue
+		}
+		if test.expectVal != value {
+			t.Errorf("expected %v, but got %v", test.expectVal, value)
+		}
+	}
+}
+
+func TestGetValueFromIntOrPercentNil(t *testing.T) {
+	_, err := GetScaledValueFromIntOrPercent(nil, 0, false)
+	if err == nil {
+		t.Errorf("expected error got none")
+	}
+}
+
+func TestParse(t *testing.T) {
+	tests := []struct {
+		input  string
+		output IntOrString
+	}{
+		{
+			input:  "0",
+			output: IntOrString{Type: Int, IntVal: 0},
+		},
+		{
+			input:  "2147483647", // math.MaxInt32
+			output: IntOrString{Type: Int, IntVal: 2147483647},
+		},
+		{
+			input:  "-2147483648", // math.MinInt32
+			output: IntOrString{Type: Int, IntVal: -2147483648},
+		},
+		{
+			input:  "2147483648", // math.MaxInt32+1
+			output: IntOrString{Type: String, StrVal: "2147483648"},
+		},
+		{
+			input:  "-2147483649", // math.MinInt32-1
+			output: IntOrString{Type: String, StrVal: "-2147483649"},
+		},
+		{
+			input:  "9223372036854775807", // math.MaxInt64
+			output: IntOrString{Type: String, StrVal: "9223372036854775807"},
+		},
+		{
+			input:  "-9223372036854775808", // math.MinInt64
+			output: IntOrString{Type: String, StrVal: "-9223372036854775808"},
+		},
+		{
+			input:  "9223372036854775808", // math.MaxInt64+1
+			output: IntOrString{Type: String, StrVal: "9223372036854775808"},
+		},
+		{
+			input:  "-9223372036854775809", // math.MinInt64-1
+			output: IntOrString{Type: String, StrVal: "-9223372036854775809"},
+		},
+	}
+
+	for i, test := range tests {
+		t.Logf("test case %d", i)
+		value := Parse(test.input)
+		if test.output.Type != value.Type {
+			t.Errorf("expected type %d (%v), but got %d (%v)", test.output.Type, test.output, value.Type, value)
+			continue
+		}
+		if value.Type == Int && test.output.IntVal != value.IntVal {
+			t.Errorf("expected int value %d (%v), but got %d (%v)", test.output.IntVal, test.output, value.IntVal, value)
+			continue
+		}
+		if value.Type == String && test.output.StrVal != value.StrVal {
+			t.Errorf("expected string value %q (%v), but got %q (%v)", test.output.StrVal, test.output, value.StrVal, value)
+		}
+	}
+}
+
+func TestMarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		in            IntOrString
+		want          []byte
+		assertOnError func(*testing.T, error)
+	}{
+		{
+			in: IntOrString{Type: 42},
+			assertOnError: func(t *testing.T, err error) {
+				if err == nil {
+					t.Fatal("expected non-nil error")
+				}
+				const want = "impossible IntOrString.Type"
+				if got := err.Error(); got != want {
+					t.Fatalf("want error message %q, got %q", want, got)
+				}
+			},
+		},
+		{
+			in:   FromString(""),
+			want: []byte{0x40},
+		},
+		{
+			in:   FromString("abc"),
+			want: []byte{0x43, 'a', 'b', 'c'},
+		},
+		{
+			in:   FromInt32(0), // min positive integer representable in one byte
+			want: []byte{0x00},
+		},
+		{
+			in:   FromInt32(23), // max positive integer representable in one byte
+			want: []byte{0x17},
+		},
+		{
+			in:   FromInt32(24), // min positive integer representable in two bytes
+			want: []byte{0x18, 0x18},
+		},
+		{
+			in:   FromInt32(math.MaxUint8), // max positive integer representable in two bytes
+			want: []byte{0x18, 0xff},
+		},
+		{
+			in:   FromInt32(math.MaxUint8 + 1), // min positive integer representable in three bytes
+			want: []byte{0x19, 0x01, 0x00},
+		},
+		{
+			in:   FromInt32(math.MaxUint16), // max positive integer representable in three bytes
+			want: []byte{0x19, 0xff, 0xff},
+		},
+		{
+			in:   FromInt32(math.MaxUint16 + 1), // min positive integer representable in five bytes
+			want: []byte{0x1a, 0x00, 0x01, 0x00, 0x00},
+		},
+		{
+			in:   FromInt32(math.MaxInt32), // max positive integer representable by Go int32
+			want: []byte{0x1a, 0x7f, 0xff, 0xff, 0xff},
+		},
+		{
+			in:   FromInt32(-1), // max negative integer representable in one byte
+			want: []byte{0x20},
+		},
+		{
+			in:   FromInt32(-24), // min negative integer representable in one byte
+			want: []byte{0x37},
+		},
+		{
+			in:   FromInt32(-1 - 24), // max negative integer representable in two bytes
+			want: []byte{0x38, 0x18},
+		},
+		{
+			in:   FromInt32(-1 - math.MaxUint8), // min negative integer representable in two bytes
+			want: []byte{0x38, 0xff},
+		},
+		{
+			in:   FromInt32(-2 - math.MaxUint8), // max negative integer representable in three bytes
+			want: []byte{0x39, 0x01, 0x00},
+		},
+		{
+			in:   FromInt32(-1 - math.MaxUint16), // min negative integer representable in three bytes
+			want: []byte{0x39, 0xff, 0xff},
+		},
+		{
+			in:   FromInt32(-2 - math.MaxUint16), // max negative integer representable in five bytes
+			want: []byte{0x3a, 0x00, 0x01, 0x00, 0x00},
+		},
+		{
+			in:   FromInt32(math.MinInt32), // min negative integer representable by Go int32
+			want: []byte{0x3a, 0x7f, 0xff, 0xff, 0xff},
+		},
+	} {
+		t.Run(fmt.Sprintf("{Type:%d,IntVal:%d,StrVal:%q}", tc.in.Type, tc.in.IntVal, tc.in.StrVal), func(t *testing.T) {
+			got, err := tc.in.MarshalCBOR()
+			if tc.assertOnError != nil {
+				tc.assertOnError(t, err)
+			} else if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if diff := cmp.Diff(got, tc.want); diff != "" {
+				t.Errorf("unexpected difference between expected and actual output:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestUnmarshalCBOR(t *testing.T) {
+	for _, tc := range []struct {
+		in            []byte
+		want          IntOrString
+		assertOnError func(*testing.T, error)
+	}{
+		{
+			in: []byte{0xa0}, // {}
+			assertOnError: func(t *testing.T, err error) {
+				if err == nil {
+					t.Fatal("expected non-nil error")
+				}
+				const want = "cbor: cannot unmarshal map into Go value of type int32"
+				if got := err.Error(); got != want {
+					t.Fatalf("want error message %q, got %q", want, got)
+				}
+
+			},
+		},
+		{
+			in:   []byte{0x40},
+			want: FromString(""),
+		},
+		{
+			in:   []byte{0x43, 'a', 'b', 'c'},
+			want: FromString("abc"),
+		},
+		{
+			in:   []byte{0x00},
+			want: FromInt32(0), // min positive integer representable in one byte
+		},
+		{
+			in:   []byte{0x17},
+			want: FromInt32(23), // max positive integer representable in one byte
+		},
+		{
+			in:   []byte{0x18, 0x18},
+			want: FromInt32(24), // min positive integer representable in two bytes
+		},
+		{
+			in:   []byte{0x18, 0xff},
+			want: FromInt32(math.MaxUint8), // max positive integer representable in two bytes
+		},
+		{
+			in:   []byte{0x19, 0x01, 0x00},
+			want: FromInt32(math.MaxUint8 + 1), // min positive integer representable in three bytes
+		},
+		{
+			in:   []byte{0x19, 0xff, 0xff},
+			want: FromInt32(math.MaxUint16), // max positive integer representable in three bytes
+		},
+		{
+			in:   []byte{0x1a, 0x00, 0x01, 0x00, 0x00},
+			want: FromInt32(math.MaxUint16 + 1), // min positive integer representable in five bytes
+		},
+		{
+			in:   []byte{0x1a, 0x7f, 0xff, 0xff, 0xff},
+			want: FromInt32(math.MaxInt32), // max positive integer representable by Go int32
+		},
+		{
+			in:   []byte{0x20},
+			want: FromInt32(-1), // max negative integer representable in one byte
+		},
+		{
+			in:   []byte{0x37},
+			want: FromInt32(-24), // min negative integer representable in one byte
+		},
+		{
+			in:   []byte{0x38, 0x18},
+			want: FromInt32(-1 - 24), // max negative integer representable in two bytes
+		},
+		{
+			in:   []byte{0x38, 0xff},
+			want: FromInt32(-1 - math.MaxUint8), // min negative integer representable in two bytes
+		},
+		{
+			in:   []byte{0x39, 0x01, 0x00},
+			want: FromInt32(-2 - math.MaxUint8), // max negative integer representable in three bytes
+		},
+		{
+			in:   []byte{0x39, 0xff, 0xff},
+			want: FromInt32(-1 - math.MaxUint16), // min negative integer representable in three bytes
+		},
+		{
+			in:   []byte{0x3a, 0x00, 0x01, 0x00, 0x00},
+			want: FromInt32(-2 - math.MaxUint16), // max negative integer representable in five bytes
+		},
+		{
+			in:   []byte{0x3a, 0x7f, 0xff, 0xff, 0xff},
+			want: FromInt32(math.MinInt32), // min negative integer representable by Go int32
+		},
+	} {
+		t.Run(fmt.Sprintf("{Type:%d,IntVal:%d,StrVal:%q}", tc.want.Type, tc.want.IntVal, tc.want.StrVal), func(t *testing.T) {
+			var got IntOrString
+			err := got.UnmarshalCBOR(tc.in)
+			if tc.assertOnError != nil {
+				tc.assertOnError(t, err)
+			} else if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if diff := cmp.Diff(got, tc.want); diff != "" {
+				t.Errorf("unexpected difference between expected and actual output:\n%s", diff)
+			}
+		})
+	}
+}
+
+func TestIntOrStringRoundtripCBOR(t *testing.T) {
+	fuzzer := randfill.New()
+	for i := 0; i < 500; i++ {
+		var initial, final IntOrString
+		fuzzer.Fill(&initial)
+		b, err := cbor.Marshal(initial)
+		if err != nil {
+			t.Errorf("error encoding %v: %v", initial, err)
+			continue
+		}
+		err = cbor.Unmarshal(b, &final)
+		if err != nil {
+			t.Errorf("%v: error decoding %v: %v", initial, string(b), err)
+		}
+		if diff := cmp.Diff(initial, final); diff != "" {
+			diag, err := cbor.Diagnose(b)
+			if err != nil {
+				t.Logf("failed to produce diagnostic encoding of 0x%x: %v", b, err)
+			}
+			t.Errorf("unexpected diff:\n%s\ncbor: %s", diff, diag)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/intstr/zz_generated.model_name.go b/third_party/k8s.io/apimachinery/pkg/util/intstr/zz_generated.model_name.go
new file mode 100644
index 0000000000..b2d6e0ae3c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/intstr/zz_generated.model_name.go
@@ -0,0 +1,27 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package intstr
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in IntOrString) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.util.intstr.IntOrString"
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/json/json.go b/third_party/k8s.io/apimachinery/pkg/util/json/json.go
new file mode 100644
index 0000000000..55dba361c3
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/json/json.go
@@ -0,0 +1,121 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+
+	kjson "sigs.k8s.io/json"
+)
+
+// NewEncoder delegates to json.NewEncoder
+// It is only here so this package can be a drop-in for common encoding/json uses
+func NewEncoder(w io.Writer) *json.Encoder {
+	return json.NewEncoder(w)
+}
+
+// Marshal delegates to json.Marshal
+// It is only here so this package can be a drop-in for common encoding/json uses
+func Marshal(v interface{}) ([]byte, error) {
+	return json.Marshal(v)
+}
+
+// limit recursive depth to prevent stack overflow errors
+const maxDepth = 10000
+
+// Unmarshal unmarshals the given data.
+// Object keys are case-sensitive.
+// Numbers decoded into interface{} fields are converted to int64 or float64.
+func Unmarshal(data []byte, v interface{}) error {
+	return kjson.UnmarshalCaseSensitivePreserveInts(data, v)
+}
+
+// ConvertInterfaceNumbers converts any json.Number values to int64 or float64.
+// Values which are map[string]interface{} or []interface{} are recursively visited
+func ConvertInterfaceNumbers(v *interface{}, depth int) error {
+	var err error
+	switch v2 := (*v).(type) {
+	case json.Number:
+		*v, err = convertNumber(v2)
+	case map[string]interface{}:
+		err = ConvertMapNumbers(v2, depth+1)
+	case []interface{}:
+		err = ConvertSliceNumbers(v2, depth+1)
+	}
+	return err
+}
+
+// ConvertMapNumbers traverses the map, converting any json.Number values to int64 or float64.
+// values which are map[string]interface{} or []interface{} are recursively visited
+func ConvertMapNumbers(m map[string]interface{}, depth int) error {
+	if depth > maxDepth {
+		return fmt.Errorf("exceeded max depth of %d", maxDepth)
+	}
+
+	var err error
+	for k, v := range m {
+		switch v := v.(type) {
+		case json.Number:
+			m[k], err = convertNumber(v)
+		case map[string]interface{}:
+			err = ConvertMapNumbers(v, depth+1)
+		case []interface{}:
+			err = ConvertSliceNumbers(v, depth+1)
+		}
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// ConvertSliceNumbers traverses the slice, converting any json.Number values to int64 or float64.
+// values which are map[string]interface{} or []interface{} are recursively visited
+func ConvertSliceNumbers(s []interface{}, depth int) error {
+	if depth > maxDepth {
+		return fmt.Errorf("exceeded max depth of %d", maxDepth)
+	}
+
+	var err error
+	for i, v := range s {
+		switch v := v.(type) {
+		case json.Number:
+			s[i], err = convertNumber(v)
+		case map[string]interface{}:
+			err = ConvertMapNumbers(v, depth+1)
+		case []interface{}:
+			err = ConvertSliceNumbers(v, depth+1)
+		}
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// convertNumber converts a json.Number to an int64 or float64, or returns an error
+func convertNumber(n json.Number) (interface{}, error) {
+	// Attempt to convert to an int64 first
+	if i, err := n.Int64(); err == nil {
+		return i, nil
+	}
+	// Return a float64 (default json.Decode() behavior)
+	// An overflow will return an error
+	return n.Float64()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/json/json_test.go b/third_party/k8s.io/apimachinery/pkg/util/json/json_test.go
new file mode 100644
index 0000000000..8caaa274a7
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/json/json_test.go
@@ -0,0 +1,418 @@
+//go:build go1.8
+
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	gojson "encoding/json"
+
+	"fmt"
+	"math"
+	"reflect"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+func TestEvaluateTypes(t *testing.T) {
+	testCases := []struct {
+		In   string
+		Data interface{}
+		Out  string
+		Err  bool
+	}{
+		// Invalid syntaxes
+		{
+			In:  `x`,
+			Err: true,
+		},
+		{
+			In:  ``,
+			Err: true,
+		},
+
+		// Null
+		{
+			In:   `null`,
+			Data: nil,
+			Out:  `null`,
+		},
+		// Booleans
+		{
+			In:   `true`,
+			Data: true,
+			Out:  `true`,
+		},
+		{
+			In:   `false`,
+			Data: false,
+			Out:  `false`,
+		},
+
+		// Integers
+		{
+			In:   `0`,
+			Data: int64(0),
+			Out:  `0`,
+		},
+		{
+			In:   `-0`,
+			Data: int64(-0),
+			Out:  `0`,
+		},
+		{
+			In:   `1`,
+			Data: int64(1),
+			Out:  `1`,
+		},
+		{
+			In:   `2147483647`,
+			Data: int64(math.MaxInt32),
+			Out:  `2147483647`,
+		},
+		{
+			In:   `-2147483648`,
+			Data: int64(math.MinInt32),
+			Out:  `-2147483648`,
+		},
+		{
+			In:   `9223372036854775807`,
+			Data: int64(math.MaxInt64),
+			Out:  `9223372036854775807`,
+		},
+		{
+			In:   `-9223372036854775808`,
+			Data: int64(math.MinInt64),
+			Out:  `-9223372036854775808`,
+		},
+
+		// Int overflow
+		{
+			In:   `9223372036854775808`, // MaxInt64 + 1
+			Data: float64(9223372036854775808),
+			Out:  `9223372036854776000`,
+		},
+		{
+			In:   `-9223372036854775809`, // MinInt64 - 1
+			Data: float64(math.MinInt64),
+			Out:  `-9223372036854776000`,
+		},
+
+		// Floats
+		{
+			In:   `0.0`,
+			Data: float64(0),
+			Out:  `0`,
+		},
+		{
+			In:   `-0.0`,
+			Data: float64(-0.0), //nolint:staticcheck // SA4026: in Go, the floating-point literal '-0.0' is the same as '0.0'
+			Out:  `-0`,
+		},
+		{
+			In:   `0.5`,
+			Data: float64(0.5),
+			Out:  `0.5`,
+		},
+		{
+			In:   `1e3`,
+			Data: float64(1e3),
+			Out:  `1000`,
+		},
+		{
+			In:   `1.5`,
+			Data: float64(1.5),
+			Out:  `1.5`,
+		},
+		{
+			In:   `-0.3`,
+			Data: float64(-.3),
+			Out:  `-0.3`,
+		},
+		{
+			// Largest representable float32
+			In:   `3.40282346638528859811704183484516925440e+38`,
+			Data: float64(math.MaxFloat32),
+			Out:  strconv.FormatFloat(math.MaxFloat32, 'g', -1, 64),
+		},
+		{
+			// Smallest float32 without losing precision
+			In:   `1.175494351e-38`,
+			Data: float64(1.175494351e-38),
+			Out:  `1.175494351e-38`,
+		},
+		{
+			// float32 closest to zero
+			In:   `1.401298464324817070923729583289916131280e-45`,
+			Data: float64(math.SmallestNonzeroFloat32),
+			Out:  strconv.FormatFloat(math.SmallestNonzeroFloat32, 'g', -1, 64),
+		},
+		{
+			// Largest representable float64
+			In:   `1.797693134862315708145274237317043567981e+308`,
+			Data: float64(math.MaxFloat64),
+			Out:  strconv.FormatFloat(math.MaxFloat64, 'g', -1, 64),
+		},
+		{
+			// Closest to zero without losing precision
+			In:   `2.2250738585072014e-308`,
+			Data: float64(2.2250738585072014e-308),
+			Out:  `2.2250738585072014e-308`,
+		},
+
+		{
+			// float64 closest to zero
+			In:   `4.940656458412465441765687928682213723651e-324`,
+			Data: float64(math.SmallestNonzeroFloat64),
+			Out:  strconv.FormatFloat(math.SmallestNonzeroFloat64, 'g', -1, 64),
+		},
+
+		{
+			// math.MaxFloat64 + 2 overflow
+			In:  `1.7976931348623159e+308`,
+			Err: true,
+		},
+
+		// Strings
+		{
+			In:   `""`,
+			Data: string(""),
+			Out:  `""`,
+		},
+		{
+			In:   `"0"`,
+			Data: string("0"),
+			Out:  `"0"`,
+		},
+		{
+			In:   `"A"`,
+			Data: string("A"),
+			Out:  `"A"`,
+		},
+		{
+			In:   `"Iñtërnâtiônàlizætiøn"`,
+			Data: string("Iñtërnâtiônàlizætiøn"),
+			Out:  `"Iñtërnâtiônàlizætiøn"`,
+		},
+
+		// Arrays
+		{
+			In:   `[]`,
+			Data: []interface{}{},
+			Out:  `[]`,
+		},
+		{
+			In: `[` + strings.Join([]string{
+				`null`,
+				`true`,
+				`false`,
+				`0`,
+				`9223372036854775807`,
+				`0.0`,
+				`0.5`,
+				`1.0`,
+				`1.797693134862315708145274237317043567981e+308`,
+				`"0"`,
+				`"A"`,
+				`"Iñtërnâtiônàlizætiøn"`,
+				`[null,true,1,1.0,1.5]`,
+				`{"boolkey":true,"floatkey":1.0,"intkey":1,"nullkey":null}`,
+			}, ",") + `]`,
+			Data: []interface{}{
+				nil,
+				true,
+				false,
+				int64(0),
+				int64(math.MaxInt64),
+				float64(0.0),
+				float64(0.5),
+				float64(1.0),
+				float64(math.MaxFloat64),
+				string("0"),
+				string("A"),
+				string("Iñtërnâtiônàlizætiøn"),
+				[]interface{}{nil, true, int64(1), float64(1.0), float64(1.5)},
+				map[string]interface{}{"nullkey": nil, "boolkey": true, "intkey": int64(1), "floatkey": float64(1.0)},
+			},
+			Out: `[` + strings.Join([]string{
+				`null`,
+				`true`,
+				`false`,
+				`0`,
+				`9223372036854775807`,
+				`0`,
+				`0.5`,
+				`1`,
+				strconv.FormatFloat(math.MaxFloat64, 'g', -1, 64),
+				`"0"`,
+				`"A"`,
+				`"Iñtërnâtiônàlizætiøn"`,
+				`[null,true,1,1,1.5]`,
+				`{"boolkey":true,"floatkey":1,"intkey":1,"nullkey":null}`, // gets alphabetized by Marshal
+			}, ",") + `]`,
+		},
+
+		// Maps
+		{
+			In:   `{}`,
+			Data: map[string]interface{}{},
+			Out:  `{}`,
+		},
+		{
+			In:   `{"boolkey":true,"floatkey":1.0,"intkey":1,"nullkey":null}`,
+			Data: map[string]interface{}{"nullkey": nil, "boolkey": true, "intkey": int64(1), "floatkey": float64(1.0)},
+			Out:  `{"boolkey":true,"floatkey":1,"intkey":1,"nullkey":null}`, // gets alphabetized by Marshal
+		},
+	}
+
+	for i, tc := range testCases {
+		t.Run(fmt.Sprintf("%d_map", i), func(t *testing.T) {
+			// decode the input as a map item
+			inputJSON := fmt.Sprintf(`{"data":%s}`, tc.In)
+			expectedJSON := fmt.Sprintf(`{"data":%s}`, tc.Out)
+			m := map[string]interface{}{}
+			err := Unmarshal([]byte(inputJSON), &m)
+			if tc.Err && err != nil {
+				// Expected error
+				return
+			}
+			if err != nil {
+				t.Fatalf("%s: error decoding: %v", tc.In, err)
+			}
+			if tc.Err {
+				t.Fatalf("%s: expected error, got none", tc.In)
+			}
+			data, ok := m["data"]
+			if !ok {
+				t.Fatalf("%s: decoded object missing data key: %#v", tc.In, m)
+			}
+			if !reflect.DeepEqual(tc.Data, data) {
+				t.Fatalf("%s: expected\n\t%#v (%v), got\n\t%#v (%v)", tc.In, tc.Data, reflect.TypeOf(tc.Data), data, reflect.TypeOf(data))
+			}
+
+			outputJSON, err := Marshal(m)
+			if err != nil {
+				t.Fatalf("%s: error encoding: %v", tc.In, err)
+			}
+
+			if expectedJSON != string(outputJSON) {
+				t.Fatalf("%s: expected\n\t%s, got\n\t%s", tc.In, expectedJSON, string(outputJSON))
+			}
+		})
+
+		t.Run(fmt.Sprintf("%d_slice", i), func(t *testing.T) {
+			// decode the input as an array item
+			inputJSON := fmt.Sprintf(`[0,%s]`, tc.In)
+			expectedJSON := fmt.Sprintf(`[0,%s]`, tc.Out)
+			m := []interface{}{}
+			err := Unmarshal([]byte(inputJSON), &m)
+			if tc.Err && err != nil {
+				// Expected error
+				return
+			}
+			if err != nil {
+				t.Fatalf("%s: error decoding: %v", tc.In, err)
+			}
+			if tc.Err {
+				t.Fatalf("%s: expected error, got none", tc.In)
+			}
+			if len(m) != 2 {
+				t.Fatalf("%s: decoded object wasn't the right length: %#v", tc.In, m)
+			}
+			data := m[1]
+			if !reflect.DeepEqual(tc.Data, data) {
+				t.Fatalf("%s: expected\n\t%#v (%v), got\n\t%#v (%v)", tc.In, tc.Data, reflect.TypeOf(tc.Data), data, reflect.TypeOf(data))
+			}
+
+			outputJSON, err := Marshal(m)
+			if err != nil {
+				t.Fatalf("%s: error encoding: %v", tc.In, err)
+			}
+
+			if expectedJSON != string(outputJSON) {
+				t.Fatalf("%s: expected\n\t%s, got\n\t%s", tc.In, expectedJSON, string(outputJSON))
+			}
+		})
+
+		t.Run(fmt.Sprintf("%d_raw", i), func(t *testing.T) {
+			// decode the input as a standalone object
+			inputJSON := tc.In
+			expectedJSON := tc.Out
+			var m interface{}
+			err := Unmarshal([]byte(inputJSON), &m)
+			if tc.Err && err != nil {
+				// Expected error
+				return
+			}
+			if err != nil {
+				t.Fatalf("%s: error decoding: %v", tc.In, err)
+			}
+			if tc.Err {
+				t.Fatalf("%s: expected error, got none", tc.In)
+			}
+			data := m
+			if !reflect.DeepEqual(tc.Data, data) {
+				t.Fatalf("%s: expected\n\t%#v (%v), got\n\t%#v (%v)", tc.In, tc.Data, reflect.TypeOf(tc.Data), data, reflect.TypeOf(data))
+			}
+
+			outputJSON, err := Marshal(m)
+			if err != nil {
+				t.Fatalf("%s: error encoding: %v", tc.In, err)
+			}
+
+			if expectedJSON != string(outputJSON) {
+				t.Fatalf("%s: expected\n\t%s, got\n\t%s", tc.In, expectedJSON, string(outputJSON))
+			}
+		})
+	}
+}
+
+func TestUnmarshalNil(t *testing.T) {
+	{
+		var v *interface{}
+		err := Unmarshal([]byte(`0`), v)
+		goerr := gojson.Unmarshal([]byte(`0`), v)
+		if err == nil || goerr == nil || err.Error() != goerr.Error() {
+			t.Fatalf("expected error matching stdlib, got %v, %v", err, goerr)
+		} else {
+			t.Log(err)
+		}
+	}
+
+	{
+		var v *[]interface{}
+		err := Unmarshal([]byte(`[]`), v)
+		goerr := gojson.Unmarshal([]byte(`[]`), v)
+		if err == nil || goerr == nil || err.Error() != goerr.Error() {
+			t.Fatalf("expected error matching stdlib, got %v, %v", err, goerr)
+		} else {
+			t.Log(err)
+		}
+	}
+
+	{
+		var v *map[string]interface{}
+		err := Unmarshal([]byte(`{}`), v)
+		goerr := gojson.Unmarshal([]byte(`{}`), v)
+		if err == nil || goerr == nil || err.Error() != goerr.Error() {
+			t.Fatalf("expected error matching stdlib, got %v, %v", err, goerr)
+		} else {
+			t.Log(err)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/jsonmergepatch/patch.go b/third_party/k8s.io/apimachinery/pkg/util/jsonmergepatch/patch.go
new file mode 100644
index 0000000000..786c16e27a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/jsonmergepatch/patch.go
@@ -0,0 +1,160 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package jsonmergepatch
+
+import (
+	"fmt"
+	"reflect"
+
+	"gopkg.in/evanphx/json-patch.v4"
+	"k8s.io/apimachinery/pkg/util/json"
+	"k8s.io/apimachinery/pkg/util/mergepatch"
+)
+
+// Create a 3-way merge patch based-on JSON merge patch.
+// Calculate addition-and-change patch between current and modified.
+// Calculate deletion patch between original and modified.
+func CreateThreeWayJSONMergePatch(original, modified, current []byte, fns ...mergepatch.PreconditionFunc) ([]byte, error) {
+	if len(original) == 0 {
+		original = []byte(`{}`)
+	}
+	if len(modified) == 0 {
+		modified = []byte(`{}`)
+	}
+	if len(current) == 0 {
+		current = []byte(`{}`)
+	}
+
+	addAndChangePatch, err := jsonpatch.CreateMergePatch(current, modified)
+	if err != nil {
+		return nil, err
+	}
+	// Only keep addition and changes
+	addAndChangePatch, addAndChangePatchObj, err := keepOrDeleteNullInJsonPatch(addAndChangePatch, false)
+	if err != nil {
+		return nil, err
+	}
+
+	deletePatch, err := jsonpatch.CreateMergePatch(original, modified)
+	if err != nil {
+		return nil, err
+	}
+	// Only keep deletion
+	deletePatch, deletePatchObj, err := keepOrDeleteNullInJsonPatch(deletePatch, true)
+	if err != nil {
+		return nil, err
+	}
+
+	hasConflicts, err := mergepatch.HasConflicts(addAndChangePatchObj, deletePatchObj)
+	if err != nil {
+		return nil, err
+	}
+	if hasConflicts {
+		return nil, mergepatch.NewErrConflict(mergepatch.ToYAMLOrError(addAndChangePatchObj), mergepatch.ToYAMLOrError(deletePatchObj))
+	}
+	patch, err := jsonpatch.MergePatch(deletePatch, addAndChangePatch)
+	if err != nil {
+		return nil, err
+	}
+
+	var patchMap map[string]interface{}
+	err = json.Unmarshal(patch, &patchMap)
+	if err != nil {
+		return nil, fmt.Errorf("failed to unmarshal patch for precondition check: %s", patch)
+	}
+	meetPreconditions, err := meetPreconditions(patchMap, fns...)
+	if err != nil {
+		return nil, err
+	}
+	if !meetPreconditions {
+		return nil, mergepatch.NewErrPreconditionFailed(patchMap)
+	}
+
+	return patch, nil
+}
+
+// keepOrDeleteNullInJsonPatch takes a json-encoded byte array and a boolean.
+// It returns a filtered object and its corresponding json-encoded byte array.
+// It is a wrapper of func keepOrDeleteNullInObj
+func keepOrDeleteNullInJsonPatch(patch []byte, keepNull bool) ([]byte, map[string]interface{}, error) {
+	var patchMap map[string]interface{}
+	err := json.Unmarshal(patch, &patchMap)
+	if err != nil {
+		return nil, nil, err
+	}
+	filteredMap, err := keepOrDeleteNullInObj(patchMap, keepNull)
+	if err != nil {
+		return nil, nil, err
+	}
+	o, err := json.Marshal(filteredMap)
+	return o, filteredMap, err
+}
+
+// keepOrDeleteNullInObj will keep only the null value and delete all the others,
+// if keepNull is true. Otherwise, it will delete all the null value and keep the others.
+func keepOrDeleteNullInObj(m map[string]interface{}, keepNull bool) (map[string]interface{}, error) {
+	filteredMap := make(map[string]interface{})
+	var err error
+	for key, val := range m {
+		switch {
+		case keepNull && val == nil:
+			filteredMap[key] = nil
+		case val != nil:
+			switch typedVal := val.(type) {
+			case map[string]interface{}:
+				// Explicitly-set empty maps are treated as values instead of empty patches
+				if len(typedVal) == 0 {
+					if !keepNull {
+						filteredMap[key] = typedVal
+					}
+					continue
+				}
+
+				var filteredSubMap map[string]interface{}
+				filteredSubMap, err = keepOrDeleteNullInObj(typedVal, keepNull)
+				if err != nil {
+					return nil, err
+				}
+
+				// If the returned filtered submap was empty, this is an empty patch for the entire subdict, so the key
+				// should not be set
+				if len(filteredSubMap) != 0 {
+					filteredMap[key] = filteredSubMap
+				}
+
+			case []interface{}, string, float64, bool, int64, nil:
+				// Lists are always replaced in Json, no need to check each entry in the list.
+				if !keepNull {
+					filteredMap[key] = val
+				}
+			default:
+				return nil, fmt.Errorf("unknown type: %v", reflect.TypeOf(typedVal))
+			}
+		}
+	}
+	return filteredMap, nil
+}
+
+func meetPreconditions(patchObj map[string]interface{}, fns ...mergepatch.PreconditionFunc) (bool, error) {
+	// Apply the preconditions to the patch, and return an error if any of them fail.
+	for _, fn := range fns {
+		if !fn(patchObj) {
+			return false, fmt.Errorf("precondition failed for: %v", patchObj)
+		}
+	}
+	return true, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/jsonmergepatch/patch_test.go b/third_party/k8s.io/apimachinery/pkg/util/jsonmergepatch/patch_test.go
new file mode 100644
index 0000000000..1a9eb0f874
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/jsonmergepatch/patch_test.go
@@ -0,0 +1,747 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package jsonmergepatch
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	jsonpatch "gopkg.in/evanphx/json-patch.v4"
+	"k8s.io/apimachinery/pkg/util/json"
+	"k8s.io/utils/dump"
+	"sigs.k8s.io/yaml"
+)
+
+type FilterNullTestCases struct {
+	TestCases []FilterNullTestCase
+}
+
+type FilterNullTestCase struct {
+	Description         string
+	OriginalObj         map[string]interface{}
+	ExpectedWithNull    map[string]interface{}
+	ExpectedWithoutNull map[string]interface{}
+}
+
+var filterNullTestCaseData = []byte(`
+testCases:
+  - description: nil original
+    originalObj: {}
+    expectedWithNull: {}
+    expectedWithoutNull: {}
+  - description: simple map
+    originalObj:
+      nilKey: null
+      nonNilKey: foo
+    expectedWithNull:
+      nilKey: null
+    expectedWithoutNull:
+      nonNilKey: foo
+  - description: simple map with all nil values
+    originalObj:
+      nilKey1: null
+      nilKey2: null
+    expectedWithNull:
+      nilKey1: null
+      nilKey2: null
+    expectedWithoutNull: {}
+  - description: simple map with all non-nil values
+    originalObj:
+      nonNilKey1: foo
+      nonNilKey2: bar
+    expectedWithNull: {}
+    expectedWithoutNull:
+      nonNilKey1: foo
+      nonNilKey2: bar
+  - description: nested map
+    originalObj:
+      mapKey:
+        nilKey: null
+        nonNilKey: foo
+    expectedWithNull:
+      mapKey:
+        nilKey: null
+    expectedWithoutNull:
+      mapKey:
+        nonNilKey: foo
+  - description: nested map that all subkeys are nil
+    originalObj:
+      mapKey:
+        nilKey1: null
+        nilKey2: null
+    expectedWithNull:
+      mapKey:
+        nilKey1: null
+        nilKey2: null
+    expectedWithoutNull: {}
+  - description: nested map that all subkeys are non-nil
+    originalObj:
+      mapKey:
+        nonNilKey1: foo
+        nonNilKey2: bar
+    expectedWithNull: {}
+    expectedWithoutNull:
+      mapKey:
+        nonNilKey1: foo
+        nonNilKey2: bar
+  - description: explicitly empty map as value
+    originalObj:
+      mapKey: {}
+    expectedWithNull: {}
+    expectedWithoutNull:
+      mapKey: {}
+  - description: explicitly empty nested map
+    originalObj:
+      mapKey:
+        nonNilKey: {}
+    expectedWithNull: {}
+    expectedWithoutNull:
+      mapKey:
+        nonNilKey: {}
+  - description: multiple expliclty empty nested maps
+    originalObj:
+      mapKey:
+        nonNilKey1: {}
+        nonNilKey2: {}
+    expectedWithNull: {}
+    expectedWithoutNull:
+      mapKey:
+        nonNilKey1: {}
+        nonNilKey2: {}
+  - description: nested map with non-null value as empty map
+    originalObj:
+      mapKey:
+        nonNilKey: {}
+        nilKey: null
+    expectedWithNull:
+      mapKey:
+        nilKey: null
+    expectedWithoutNull:
+      mapKey:
+        nonNilKey: {}
+  - description: empty list
+    originalObj:
+      listKey: []
+    expectedWithNull: {}
+    expectedWithoutNull:
+      listKey: []
+  - description: list of primitives
+    originalObj:
+      listKey:
+      - 1
+      - 2
+    expectedWithNull: {}
+    expectedWithoutNull:
+      listKey:
+      - 1
+      - 2
+  - description: list of maps
+    originalObj:
+      listKey:
+      - k1: v1
+      - k2: null
+      - k3: v3
+        k4: null
+    expectedWithNull: {}
+    expectedWithoutNull:
+      listKey:
+      - k1: v1
+      - k2: null
+      - k3: v3
+        k4: null
+  - description: list of different types
+    originalObj:
+      listKey:
+      - k1: v1
+      - k2: null
+      - v3
+    expectedWithNull: {}
+    expectedWithoutNull:
+      listKey:
+      - k1: v1
+      - k2: null
+      - v3
+`)
+
+func TestKeepOrDeleteNullInObj(t *testing.T) {
+	tc := FilterNullTestCases{}
+	err := yaml.Unmarshal(filterNullTestCaseData, &tc)
+	if err != nil {
+		t.Fatalf("can't unmarshal test cases: %s\n", err)
+	}
+
+	for _, test := range tc.TestCases {
+		resultWithNull, err := keepOrDeleteNullInObj(test.OriginalObj, true)
+		if err != nil {
+			t.Errorf("Failed in test case %q when trying to keep null values: %s", test.Description, err)
+		}
+		if !reflect.DeepEqual(test.ExpectedWithNull, resultWithNull) {
+			t.Errorf("Failed in test case %q when trying to keep null values:\nexpected expectedWithNull:\n%+v\nbut got:\n%+v\n", test.Description, test.ExpectedWithNull, resultWithNull)
+		}
+
+		resultWithoutNull, err := keepOrDeleteNullInObj(test.OriginalObj, false)
+		if err != nil {
+			t.Errorf("Failed in test case %q when trying to keep non-null values: %s", test.Description, err)
+		}
+		if !reflect.DeepEqual(test.ExpectedWithoutNull, resultWithoutNull) {
+			t.Errorf("Failed in test case %q when trying to keep non-null values:\n expected expectedWithoutNull:\n%+v\nbut got:\n%+v\n", test.Description, test.ExpectedWithoutNull, resultWithoutNull)
+		}
+	}
+}
+
+type JSONMergePatchTestCases struct {
+	TestCases []JSONMergePatchTestCase
+}
+
+type JSONMergePatchTestCase struct {
+	Description string
+	JSONMergePatchTestCaseData
+}
+
+type JSONMergePatchTestCaseData struct {
+	// Original is the original object (last-applied config in annotation)
+	Original map[string]interface{}
+	// Modified is the modified object (new config we want)
+	Modified map[string]interface{}
+	// Current is the current object (live config in the server)
+	Current map[string]interface{}
+	// ThreeWay is the expected three-way merge patch
+	ThreeWay map[string]interface{}
+	// Result is the expected object after applying the three-way patch on current object.
+	Result map[string]interface{}
+}
+
+var createJSONMergePatchTestCaseData = []byte(`
+testCases:
+  - description: nil original
+    modified:
+      name: 1
+      value: 1
+    current:
+      name: 1
+      other: a
+    threeWay:
+      value: 1
+    result:
+      name: 1
+      value: 1
+      other: a
+  - description: nil patch
+    original:
+      name: 1
+    modified:
+      name: 1
+    current:
+      name: 1
+    threeWay:
+      {}
+    result:
+      name: 1
+  - description: add field to map
+    original:
+      name: 1
+    modified:
+      name: 1
+      value: 1
+    current:
+      name: 1
+      other: a
+    threeWay:
+      value: 1
+    result:
+      name: 1
+      value: 1
+      other: a
+  - description: add field to map with conflict
+    original:
+      name: 1
+    modified:
+      name: 1
+      value: 1
+    current:
+      name: a
+      other: a
+    threeWay:
+      name: 1
+      value: 1
+    result:
+      name: 1
+      value: 1
+      other: a
+  - description: add field and delete field from map
+    original:
+      name: 1
+    modified:
+      value: 1
+    current:
+      name: 1
+      other: a
+    threeWay:
+      name: null
+      value: 1
+    result:
+      value: 1
+      other: a
+  - description: add field and delete field from map with conflict
+    original:
+      name: 1
+    modified:
+      value: 1
+    current:
+      name: a
+      other: a
+    threeWay:
+      name: null
+      value: 1
+    result:
+      value: 1
+      other: a
+  - description: delete field from nested map
+    original:
+      simpleMap:
+        key1: 1
+        key2: 1
+    modified:
+      simpleMap:
+        key1: 1
+    current:
+      simpleMap:
+        key1: 1
+        key2: 1
+        other: a
+    threeWay:
+      simpleMap:
+        key2: null
+    result:
+      simpleMap:
+        key1: 1
+        other: a
+  - description: delete field from nested map with conflict
+    original:
+      simpleMap:
+        key1: 1
+        key2: 1
+    modified:
+      simpleMap:
+        key1: 1
+    current:
+      simpleMap:
+        key1: a
+        key2: 1
+        other: a
+    threeWay:
+      simpleMap:
+        key1: 1
+        key2: null
+    result:
+      simpleMap:
+        key1: 1
+        other: a
+  - description: delete all fields from map
+    original:
+      name: 1
+      value: 1
+    modified: {}
+    current:
+      name: 1
+      value: 1
+      other: a
+    threeWay:
+      name: null
+      value: null
+    result:
+      other: a
+  - description: delete all fields from map with conflict
+    original:
+      name: 1
+      value: 1
+    modified: {}
+    current:
+      name: 1
+      value: a
+      other: a
+    threeWay:
+      name: null
+      value: null
+    result:
+      other: a
+  - description: add field and delete all fields from map
+    original:
+      name: 1
+      value: 1
+    modified:
+      other: a
+    current:
+      name: 1
+      value: 1
+      other: a
+    threeWay:
+      name: null
+      value: null
+    result:
+      other: a
+  - description: add field and delete all fields from map with conflict
+    original:
+      name: 1
+      value: 1
+    modified:
+      other: a
+    current:
+      name: 1
+      value: 1
+      other: b
+    threeWay:
+      name: null
+      value: null
+      other: a
+    result:
+      other: a
+  - description: replace list of scalars
+    original:
+      intList:
+        - 1
+        - 2
+    modified:
+      intList:
+        - 2
+        - 3
+    current:
+      intList:
+        - 1
+        - 2
+    threeWay:
+      intList:
+        - 2
+        - 3
+    result:
+      intList:
+        - 2
+        - 3
+  - description: replace list of scalars with conflict
+    original:
+      intList:
+        - 1
+        - 2
+    modified:
+      intList:
+        - 2
+        - 3
+    current:
+      intList:
+        - 1
+        - 4
+    threeWay:
+      intList:
+        - 2
+        - 3
+    result:
+      intList:
+        - 2
+        - 3
+  - description: patch with different scalar type
+    original:
+      foo: 1
+    modified:
+      foo: true
+    current:
+      foo: 1
+      bar: 2
+    threeWay:
+      foo: true
+    result:
+      foo: true
+      bar: 2
+  - description: patch from scalar to list
+    original:
+      foo: 0
+    modified:
+      foo:
+      - 1
+      - 2
+    current:
+      foo: 0
+      bar: 2
+    threeWay:
+      foo:
+      - 1
+      - 2
+    result:
+      foo:
+      - 1
+      - 2
+      bar: 2
+  - description: patch from list to scalar
+    original:
+      foo:
+      - 1
+      - 2
+    modified:
+      foo: 0
+    current:
+      foo:
+      - 1
+      - 2
+      bar: 2
+    threeWay:
+      foo: 0
+    result:
+      foo: 0
+      bar: 2
+  - description: patch from scalar to map
+    original:
+      foo: 0
+    modified:
+      foo:
+        baz: 1
+    current:
+      foo: 0
+      bar: 2
+    threeWay:
+      foo:
+        baz: 1
+    result:
+      foo:
+        baz: 1
+      bar: 2
+  - description: patch from map to scalar
+    original:
+      foo:
+        baz: 1
+    modified:
+      foo: 0
+    current:
+      foo:
+        baz: 1
+      bar: 2
+    threeWay:
+      foo: 0
+    result:
+      foo: 0
+      bar: 2
+  - description: patch from map to list
+    original:
+      foo:
+        baz: 1
+    modified:
+      foo:
+      - 1
+      - 2
+    current:
+      foo:
+        baz: 1
+      bar: 2
+    threeWay:
+      foo:
+      - 1
+      - 2
+    result:
+      foo:
+      - 1
+      - 2
+      bar: 2
+  - description: patch from list to map
+    original:
+      foo:
+      - 1
+      - 2
+    modified:
+      foo:
+        baz: 0
+    current:
+      foo:
+      - 1
+      - 2
+      bar: 2
+    threeWay:
+      foo:
+        baz: 0
+    result:
+      foo:
+        baz: 0
+      bar: 2
+  - description: patch with different nested types
+    original:
+      foo:
+      - a: true
+      - 2
+      - false
+    modified:
+      foo:
+      - 1
+      - false
+      - b: 1
+    current:
+      foo:
+      - a: true
+      - 2
+      - false
+      bar: 0
+    threeWay:
+      foo:
+      - 1
+      - false
+      - b: 1
+    result:
+      foo:
+      - 1
+      - false
+      - b: 1
+      bar: 0
+  - description: patch array with nil
+    original:
+      foo:
+      - a: true
+      - null
+      - false
+      bar: []
+      drop:
+      - 1
+    modified:
+      foo:
+      - 1
+      - false
+      - b: 1
+      bar:
+      - c
+      - null
+      - null
+      - a
+      drop:
+      - null
+    current:
+      foo:
+      - a: true
+      - 2
+      - false
+      bar:
+      - c
+      - null
+      - null
+      - a
+      drop:
+    threeWay:
+      foo:
+      - 1
+      - false
+      - b: 1
+      drop:
+      - null
+    result:
+      foo:
+      - 1
+      - false
+      - b: 1
+      drop:
+      - null
+      bar:
+      - c
+      - null
+      - null
+      - a
+`)
+
+func TestCreateThreeWayJSONMergePatch(t *testing.T) {
+	tc := JSONMergePatchTestCases{}
+	err := yaml.Unmarshal(createJSONMergePatchTestCaseData, &tc)
+	if err != nil {
+		t.Errorf("can't unmarshal test cases: %s\n", err)
+		return
+	}
+
+	for _, c := range tc.TestCases {
+		testThreeWayPatch(t, c)
+	}
+}
+
+func testThreeWayPatch(t *testing.T, c JSONMergePatchTestCase) {
+	original, modified, current, expected, result := threeWayTestCaseToJSONOrFail(t, c)
+	actual, err := CreateThreeWayJSONMergePatch(original, modified, current)
+	if err != nil {
+		t.Fatalf("error: %s", err)
+	}
+	testPatchCreation(t, expected, actual, c.Description)
+	testPatchApplication(t, current, actual, result, c.Description)
+}
+
+func testPatchCreation(t *testing.T, expected, actual []byte, description string) {
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("error in test case: %s\nexpected patch:\n%s\ngot:\n%s\n",
+			description, jsonToYAMLOrError(expected), jsonToYAMLOrError(actual))
+		return
+	}
+}
+
+func testPatchApplication(t *testing.T, original, patch, expected []byte, description string) {
+	result, err := jsonpatch.MergePatch(original, patch)
+	if err != nil {
+		t.Errorf("error: %s\nin test case: %s\ncannot apply patch:\n%s\nto original:\n%s\n",
+			err, description, jsonToYAMLOrError(patch), jsonToYAMLOrError(original))
+		return
+	}
+
+	if !reflect.DeepEqual(result, expected) {
+		format := "error in test case: %s\npatch application failed:\noriginal:\n%s\npatch:\n%s\nexpected:\n%s\ngot:\n%s\n"
+		t.Errorf(format, description,
+			jsonToYAMLOrError(original), jsonToYAMLOrError(patch),
+			jsonToYAMLOrError(expected), jsonToYAMLOrError(result))
+		return
+	}
+}
+
+func threeWayTestCaseToJSONOrFail(t *testing.T, c JSONMergePatchTestCase) ([]byte, []byte, []byte, []byte, []byte) {
+	return testObjectToJSONOrFail(t, c.Original),
+		testObjectToJSONOrFail(t, c.Modified),
+		testObjectToJSONOrFail(t, c.Current),
+		testObjectToJSONOrFail(t, c.ThreeWay),
+		testObjectToJSONOrFail(t, c.Result)
+}
+
+func testObjectToJSONOrFail(t *testing.T, o map[string]interface{}) []byte {
+	if o == nil {
+		return nil
+	}
+	j, err := toJSON(o)
+	if err != nil {
+		t.Error(err)
+	}
+	return j
+}
+
+func jsonToYAMLOrError(j []byte) string {
+	y, err := jsonToYAML(j)
+	if err != nil {
+		return err.Error()
+	}
+	return string(y)
+}
+
+func toJSON(v interface{}) ([]byte, error) {
+	j, err := json.Marshal(v)
+	if err != nil {
+		return nil, fmt.Errorf("json marshal failed: %v\n%v\n", err, dump.Pretty(v))
+	}
+	return j, nil
+}
+
+func jsonToYAML(j []byte) ([]byte, error) {
+	y, err := yaml.JSONToYAML(j)
+	if err != nil {
+		return nil, fmt.Errorf("json to yaml failed: %v\n%v\n", err, j)
+	}
+	return y, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/endpoints.yaml b/third_party/k8s.io/apimachinery/pkg/util/managedfields/endpoints.yaml
new file mode 100644
index 0000000000..a667e98342
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/endpoints.yaml
@@ -0,0 +1,7018 @@
+apiVersion: v1
+kind: Endpoints
+metadata:
+  creationTimestamp: '2016-10-04T17:45:58Z'
+  labels:
+    app: my-app
+  name: app-server
+  namespace: default
+  resourceVersion: '184597135'
+  selfLink: /self/link
+  uid: 6826f086-8a5a-11e6-8d09-42010a800005
+subsets:
+- addresses:
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0000
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0001
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0002
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0003
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0004
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0005
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0006
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0007
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0008
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0009
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0010
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0011
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0012
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0013
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0014
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0015
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0016
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0017
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0018
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0019
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0020
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0021
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0022
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0023
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0024
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0025
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0026
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0027
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0028
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0029
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0030
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0031
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0032
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0033
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0034
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0035
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0036
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0037
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0038
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0039
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0040
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0041
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0042
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0043
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0044
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0045
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0046
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0047
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0048
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0049
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0050
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0051
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0052
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0053
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0054
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0055
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0056
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0057
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0058
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0059
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0060
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0061
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0062
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0063
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0064
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0065
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0066
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0067
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0068
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0069
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0070
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0071
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0072
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0073
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0074
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0075
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0076
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0077
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0078
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0079
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0080
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0081
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0082
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0083
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0084
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0085
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0086
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0087
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0088
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0089
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0090
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0091
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0092
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0093
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0094
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0095
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0096
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0097
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0098
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0099
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0100
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0101
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0102
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0103
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0104
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0105
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0106
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0107
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0108
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0109
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0110
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0111
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0112
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0113
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0114
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0115
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0116
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0117
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0118
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0119
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0120
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0121
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0122
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0123
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0124
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0125
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0126
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0127
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0128
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0129
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0130
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0131
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0132
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0133
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0134
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0135
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0136
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0137
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0138
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0139
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0140
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0141
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0142
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0143
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0144
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0145
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0146
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0147
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0148
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0149
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0150
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0151
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0152
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0153
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0154
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0155
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0156
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0157
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0158
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0159
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0160
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0161
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0162
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0163
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0164
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0165
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0166
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0167
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0168
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0169
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0170
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0171
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0172
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0173
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0174
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0175
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0176
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0177
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0178
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0179
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0180
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0181
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0182
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0183
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0184
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0185
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0186
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0187
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0188
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0189
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0190
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0191
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0192
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0193
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0194
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0195
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0196
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0197
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0198
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0199
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0200
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0201
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0202
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0203
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0204
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0205
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0206
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0207
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0208
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0209
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0210
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0211
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0212
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0213
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0214
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0215
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0216
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0217
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0218
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0219
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0220
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0221
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0222
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0223
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0224
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0225
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0226
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0227
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0228
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0229
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0230
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0231
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0232
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0233
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0234
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0235
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0236
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0237
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0238
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0239
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0240
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0241
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0242
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0243
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0244
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0245
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0246
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0247
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0248
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0249
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0250
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0251
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0252
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0253
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0254
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0255
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0256
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0257
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0258
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0259
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0260
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0261
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0262
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0263
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0264
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0265
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0266
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0267
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0268
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0269
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0270
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0271
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0272
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0273
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0274
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0275
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0276
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0277
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0278
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0279
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0280
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0281
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0282
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0283
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0284
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0285
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0286
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0287
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0288
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0289
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0290
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0291
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0292
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0293
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0294
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0295
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0296
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0297
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0298
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0299
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0300
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0301
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0302
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0303
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0304
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0305
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0306
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0307
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0308
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0309
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0310
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0311
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0312
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0313
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0314
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0315
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0316
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0317
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0318
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0319
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0320
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0321
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0322
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0323
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0324
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0325
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0326
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0327
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0328
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0329
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0330
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0331
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0332
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0333
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0334
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0335
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0336
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0337
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0338
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0339
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0340
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0341
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0342
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0343
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0344
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0345
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0346
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0347
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0348
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0349
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0350
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0351
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0352
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0353
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0354
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0355
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0356
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0357
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0358
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0359
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0360
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0361
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0362
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0363
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0364
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0365
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0366
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0367
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0368
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0369
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0370
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0371
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0372
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0373
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0374
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0375
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0376
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0377
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0378
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0379
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0380
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0381
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0382
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0383
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0384
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0385
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0386
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0387
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0388
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0389
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0390
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0391
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0392
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0393
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0394
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0395
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0396
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0397
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0398
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0399
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0400
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0401
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0402
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0403
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0404
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0405
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0406
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0407
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0408
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0409
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0410
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0411
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0412
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0413
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0414
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0415
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0416
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0417
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0418
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0419
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0420
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0421
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0422
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0423
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0424
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0425
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0426
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0427
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0428
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0429
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0430
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0431
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0432
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0433
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0434
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0435
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0436
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0437
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0438
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0439
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0440
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0441
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0442
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0443
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0444
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0445
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0446
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0447
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0448
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0449
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0450
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0451
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0452
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0453
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0454
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0455
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0456
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0457
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0458
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0459
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0460
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0461
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0462
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0463
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0464
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0465
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0466
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0467
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0468
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0469
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0470
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0471
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0472
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0473
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0474
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0475
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0476
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0477
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0478
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0479
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0480
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0481
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0482
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0483
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0484
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0485
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0486
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0487
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0488
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0489
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0490
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0491
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0492
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0493
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0494
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0495
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0496
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0497
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0498
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0499
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0500
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0501
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0502
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0503
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0504
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0505
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0506
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0507
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0508
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0509
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0510
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0511
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0512
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0513
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0514
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0515
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0516
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0517
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0518
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0519
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0520
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0521
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0522
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0523
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0524
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0525
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0526
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0527
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0528
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0529
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0530
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0531
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0532
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0533
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0534
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0535
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0536
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0537
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0538
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0539
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0540
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0541
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0542
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0543
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0544
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0545
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0546
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0547
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0548
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0549
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0550
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0551
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0552
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0553
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0554
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0555
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0556
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0557
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0558
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0559
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0560
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0561
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0562
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0563
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0564
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0565
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0566
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0567
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0568
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0569
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0570
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0571
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0572
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0573
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0574
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0575
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0576
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0577
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0578
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0579
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0580
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0581
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0582
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0583
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0584
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0585
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0586
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0587
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0588
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0589
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0590
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0591
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0592
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0593
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0594
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0595
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0596
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0597
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0598
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0599
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0600
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0601
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0602
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0603
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0604
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0605
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0606
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0607
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0608
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0609
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0610
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0611
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0612
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0613
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0614
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0615
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0616
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0617
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0618
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0619
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0620
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0621
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0622
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0623
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0624
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0625
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0626
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0627
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0628
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0629
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0630
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0631
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0632
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0633
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0634
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0635
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0636
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0637
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0638
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0639
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0640
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0641
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0642
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0643
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0644
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0645
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0646
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0647
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0648
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0649
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0650
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0651
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0652
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0653
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0654
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0655
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0656
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0657
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0658
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0659
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0660
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0661
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0662
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0663
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0664
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0665
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0666
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0667
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0668
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0669
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0670
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0671
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0672
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0673
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0674
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0675
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0676
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0677
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0678
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0679
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0680
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0681
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0682
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0683
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0684
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0685
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0686
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0687
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0688
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0689
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0690
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0691
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0692
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0693
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0694
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0695
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0696
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0697
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0698
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0699
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0700
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0701
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0702
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0703
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0704
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0705
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0706
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0707
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0708
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0709
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0710
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0711
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0712
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0713
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0714
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0715
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0716
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0717
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0718
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0719
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0720
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0721
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0722
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0723
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0724
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0725
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0726
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0727
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0728
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0729
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0730
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0731
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0732
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0733
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0734
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0735
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0736
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0737
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0738
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0739
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0740
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0741
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0742
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0743
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0744
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0745
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0746
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0747
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0748
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0749
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0750
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0751
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0752
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0753
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0754
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0755
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0756
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0757
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0758
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0759
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0760
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0761
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0762
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0763
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0764
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0765
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0766
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0767
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0768
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0769
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0770
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0771
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0772
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0773
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0774
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0775
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0776
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0777
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0778
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0779
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0780
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0781
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0782
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0783
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0784
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0785
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0786
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0787
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0788
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0789
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0790
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0791
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0792
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0793
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0794
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0795
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0796
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0797
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0798
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0799
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0800
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0801
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0802
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0803
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0804
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0805
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0806
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0807
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0808
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0809
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0810
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0811
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0812
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0813
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0814
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0815
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0816
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0817
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0818
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0819
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0820
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0821
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0822
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0823
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0824
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0825
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0826
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0827
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0828
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0829
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0830
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0831
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0832
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0833
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0834
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0835
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0836
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0837
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0838
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0839
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0840
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0841
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0842
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0843
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0844
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0845
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0846
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0847
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0848
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0849
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0850
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0851
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0852
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0853
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0854
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0855
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0856
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0857
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0858
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0859
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0860
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0861
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0862
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0863
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0864
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0865
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0866
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0867
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0868
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0869
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0870
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0871
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0872
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0873
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0874
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0875
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0876
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0877
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0878
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0879
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0880
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0881
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0882
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0883
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0884
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0885
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0886
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0887
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0888
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0889
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0890
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0891
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0892
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0893
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0894
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0895
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0896
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0897
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0898
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0899
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0900
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0901
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0902
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0903
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0904
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0905
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0906
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0907
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0908
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0909
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0910
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0911
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0912
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0913
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0914
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0915
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0916
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0917
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0918
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0919
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0920
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0921
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0922
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0923
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0924
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0925
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0926
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0927
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0928
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0929
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0930
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0931
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0932
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0933
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0934
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0935
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0936
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0937
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0938
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0939
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0940
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0941
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0942
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0943
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0944
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0945
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0946
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0947
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0948
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0949
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0950
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0951
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0952
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0953
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0954
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0955
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0956
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0957
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0958
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0959
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0960
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0961
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0962
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0963
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0964
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0965
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0966
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0967
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0968
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0969
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0970
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0971
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0972
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0973
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0974
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0975
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0976
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0977
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0978
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0979
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0980
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0981
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0982
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0983
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0984
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0985
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0986
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0987
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0988
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0989
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0990
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0991
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0992
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0993
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0994
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0995
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0996
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0997
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0998
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  - ip: 10.0.0.1
+    targetRef:
+      kind: Pod
+      name: pod-name-1234-0999
+      namespace: default
+      resourceVersion: '1234567890'
+      uid: 11111111-2222-3333-4444-555555555555
+  ports:
+  - name: port-name
+    port: 8080
+    protocol: TCP
+
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/extract.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/extract.go
new file mode 100644
index 0000000000..ff7dda1a50
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/extract.go
@@ -0,0 +1,107 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// ExtractInto extracts the applied configuration state from object for fieldManager
+// into applyConfiguration. If no managed fields are found for the given fieldManager,
+// no error is returned, but applyConfiguration is left unpopulated. It is possible
+// that no managed fields were found for the fieldManager because other field managers
+// have taken ownership of all the fields previously owned by the fieldManager. It is
+// also possible the fieldManager never owned fields.
+//
+// The provided object MUST bo a root resource object since subresource objects
+// do not contain their own managed fields. For example, an autoscaling.Scale
+// object read from a "scale" subresource does not have any managed fields and so
+// cannot be used as the object.
+//
+// If the fields of a subresource are a subset of the fields of the root object,
+// and their field paths and types are exactly the same, then ExtractInto can be
+// called with the root resource as the object and the subresource as the
+// applyConfiguration. This works for "status", obviously, because status is
+// represented by the exact same object as the root resource. This does NOT
+// work, for example, with the "scale" subresources of Deployment, ReplicaSet and
+// StatefulSet. While the spec.replicas, status.replicas fields are in the same
+// exact field path locations as they are in autoscaling.Scale, the selector
+// fields are in different locations, and are a different type.
+func ExtractInto(object runtime.Object, objectType typed.ParseableType, fieldManager string, applyConfiguration interface{}, subresource string) error {
+	typedObj, err := toTyped(object, objectType)
+	if err != nil {
+		return fmt.Errorf("error converting obj to typed: %w", err)
+	}
+
+	accessor, err := meta.Accessor(object)
+	if err != nil {
+		return fmt.Errorf("error accessing metadata: %w", err)
+	}
+	fieldsEntry, ok := findManagedFields(accessor, fieldManager, subresource)
+	if !ok {
+		return nil
+	}
+	fieldset := &fieldpath.Set{}
+	err = fieldset.FromJSON(fieldsEntry.FieldsV1.GetRawReader())
+	if err != nil {
+		return fmt.Errorf("error marshalling FieldsV1 to JSON: %w", err)
+	}
+
+	u := typedObj.ExtractItems(fieldset.Leaves()).AsValue().Unstructured()
+	m, ok := u.(map[string]interface{})
+	if !ok {
+		return fmt.Errorf("unable to convert managed fields for %s to unstructured, expected map, got %T", fieldManager, u)
+	}
+
+	// set the type meta manually if it doesn't exist to avoid missing kind errors
+	// when decoding from unstructured JSON
+	if _, ok := m["kind"]; !ok && object.GetObjectKind().GroupVersionKind().Kind != "" {
+		m["kind"] = object.GetObjectKind().GroupVersionKind().Kind
+		m["apiVersion"] = object.GetObjectKind().GroupVersionKind().GroupVersion().String()
+	}
+	if err := runtime.DefaultUnstructuredConverter.FromUnstructured(m, applyConfiguration); err != nil {
+		return fmt.Errorf("error extracting into obj from unstructured: %w", err)
+	}
+	return nil
+}
+
+func findManagedFields(accessor metav1.Object, fieldManager string, subresource string) (metav1.ManagedFieldsEntry, bool) {
+	objManagedFields := accessor.GetManagedFields()
+	for _, mf := range objManagedFields {
+		if mf.Manager == fieldManager && mf.Operation == metav1.ManagedFieldsOperationApply && mf.Subresource == subresource {
+			return mf, true
+		}
+	}
+	return metav1.ManagedFieldsEntry{}, false
+}
+
+func toTyped(obj runtime.Object, objectType typed.ParseableType) (*typed.TypedValue, error) {
+	switch o := obj.(type) {
+	case *unstructured.Unstructured:
+		return objectType.FromUnstructured(o.Object)
+	default:
+		return objectType.FromStructured(o)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/extract_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/extract_test.go
new file mode 100644
index 0000000000..50d6273de0
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/extract_test.go
@@ -0,0 +1,272 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+
+	"k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	runtimeschema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestExtractInto(t *testing.T) {
+	one := int32(1)
+	parser, err := typed.NewParser(schemaYAML)
+	if err != nil {
+		t.Fatalf("Failed to parse schema: %v", err)
+	}
+	cases := []struct {
+		name          string
+		obj           runtime.Object
+		objType       typed.ParseableType
+		managedFields []metav1.ManagedFieldsEntry // written to object before test is run
+		fieldManager  string
+		expectedOut   interface{}
+		subresource   string
+	}{
+		{
+			name:    "unstructured, no matching manager",
+			obj:     &unstructured.Unstructured{Object: map[string]interface{}{"spec": map[string]interface{}{"replicas": 1}}},
+			objType: parser.Type("io.k8s.api.apps.v1.Deployment"),
+			managedFields: []metav1.ManagedFieldsEntry{
+				applyFieldsEntry("mgr999", `{ "f:spec": { "f:replicas": {}}}`, ""),
+			},
+			fieldManager: "mgr1",
+			expectedOut:  map[string]interface{}{},
+		},
+		{
+			name:    "unstructured, one manager",
+			obj:     &unstructured.Unstructured{Object: map[string]interface{}{"spec": map[string]interface{}{"replicas": 1}}},
+			objType: parser.Type("io.k8s.api.apps.v1.Deployment"),
+			managedFields: []metav1.ManagedFieldsEntry{
+				applyFieldsEntry("mgr1", `{ "f:spec": { "f:replicas": {}}}`, ""),
+			},
+			fieldManager: "mgr1",
+			expectedOut:  map[string]interface{}{"spec": map[string]interface{}{"replicas": 1}},
+		},
+		{
+			name:    "unstructured, multiple manager",
+			obj:     &unstructured.Unstructured{Object: map[string]interface{}{"spec": map[string]interface{}{"paused": true}}},
+			objType: parser.Type("io.k8s.api.apps.v1.Deployment"),
+			managedFields: []metav1.ManagedFieldsEntry{
+				applyFieldsEntry("mgr1", `{ "f:spec": { "f:replicas": {}}}`, ""),
+				applyFieldsEntry("mgr2", `{ "f:spec": { "f:paused": {}}}`, ""),
+			},
+			fieldManager: "mgr2",
+			expectedOut:  map[string]interface{}{"spec": map[string]interface{}{"paused": true}},
+		},
+		{
+			name:    "structured, no matching manager",
+			obj:     &fakeDeployment{Spec: fakeDeploymentSpec{Replicas: &one}},
+			objType: parser.Type("io.k8s.api.apps.v1.Deployment"),
+			managedFields: []metav1.ManagedFieldsEntry{
+				applyFieldsEntry("mgr999", `{ "f:spec": { "f:replicas": {}}}`, ""),
+			},
+			fieldManager: "mgr1",
+			expectedOut:  map[string]interface{}{},
+		},
+		{
+			name:    "structured, one manager",
+			obj:     &fakeDeployment{Spec: fakeDeploymentSpec{Replicas: &one}},
+			objType: parser.Type("io.k8s.api.apps.v1.Deployment"),
+			managedFields: []metav1.ManagedFieldsEntry{
+				applyFieldsEntry("mgr1", `{ "f:spec": { "f:replicas": {}}}`, ""),
+			},
+			fieldManager: "mgr1",
+			expectedOut:  map[string]interface{}{"spec": map[string]interface{}{"replicas": int64(1)}},
+		},
+		{
+			name:    "structured, multiple manager",
+			obj:     &fakeDeployment{Spec: fakeDeploymentSpec{Replicas: &one, Paused: true}},
+			objType: parser.Type("io.k8s.api.apps.v1.Deployment"),
+			managedFields: []metav1.ManagedFieldsEntry{
+				applyFieldsEntry("mgr1", `{ "f:spec": { "f:replicas": {}}}`, ""),
+				applyFieldsEntry("mgr2", `{ "f:spec": { "f:paused": {}}}`, ""),
+			},
+			fieldManager: "mgr2",
+			expectedOut:  map[string]interface{}{"spec": map[string]interface{}{"paused": true}},
+		},
+		{
+			name:    "subresource",
+			obj:     &fakeDeployment{Status: fakeDeploymentStatus{Replicas: &one}},
+			objType: parser.Type("io.k8s.api.apps.v1.Deployment"),
+			managedFields: []metav1.ManagedFieldsEntry{
+				applyFieldsEntry("mgr1", `{ "f:status": { "f:replicas": {}}}`, "status"),
+			},
+			fieldManager: "mgr1",
+			expectedOut:  map[string]interface{}{"status": map[string]interface{}{"replicas": int64(1)}},
+			subresource:  "status",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			out := map[string]interface{}{}
+			accessor, err := meta.Accessor(tc.obj)
+			if err != nil {
+				t.Fatalf("Error accessing object: %v", err)
+			}
+			accessor.SetManagedFields(tc.managedFields)
+			err = ExtractInto(tc.obj, tc.objType, tc.fieldManager, &out, tc.subresource)
+			if err != nil {
+				t.Fatalf("Unexpected extract error: %v", err)
+			}
+			if !equality.Semantic.DeepEqual(out, tc.expectedOut) {
+				t.Fatalf("Expected output did not match actual output: %s", cmp.Diff(out, tc.expectedOut))
+			}
+		})
+	}
+}
+
+func applyFieldsEntry(fieldManager string, fieldsJSON string, subresource string) metav1.ManagedFieldsEntry {
+	return metav1.ManagedFieldsEntry{
+		Manager:     fieldManager,
+		Operation:   metav1.ManagedFieldsOperationApply,
+		APIVersion:  "v1",
+		FieldsType:  "FieldsV1",
+		FieldsV1:    metav1.NewFieldsV1(fieldsJSON),
+		Subresource: subresource,
+	}
+}
+
+type fakeDeployment struct {
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	Spec              fakeDeploymentSpec   `json:"spec"`
+	Status            fakeDeploymentStatus `json:"status"`
+}
+
+type fakeDeploymentSpec struct {
+	Replicas *int32 `json:"replicas"`
+	Paused   bool   `json:"paused,omitempty"`
+}
+
+type fakeDeploymentStatus struct {
+	Replicas *int32 `json:"replicas"`
+}
+
+func (o *fakeDeployment) GetObjectMeta() metav1.ObjectMeta {
+	return o.ObjectMeta
+}
+func (o *fakeDeployment) GetObjectKind() runtimeschema.ObjectKind {
+	return runtimeschema.EmptyObjectKind
+}
+func (o *fakeDeployment) DeepCopyObject() runtime.Object {
+	return o
+}
+
+// trimmed up schema for test purposes
+const schemaYAML = typed.YAMLObject(`types:
+- name: io.k8s.api.apps.v1.Deployment
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+    - name: spec
+      type:
+        namedType: io.k8s.api.apps.v1.DeploymentSpec
+    - name: status
+      type:
+        namedType: io.k8s.api.apps.v1.DeploymentStatus
+- name: io.k8s.api.apps.v1.DeploymentSpec
+  map:
+    fields:
+    - name: paused
+      type:
+        scalar: boolean
+    - name: replicas
+      type:
+        scalar: numeric
+- name: io.k8s.api.apps.v1.DeploymentStatus
+  map:
+    fields:
+    - name: replicas
+      type:
+        scalar: numeric
+- name: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+  map:
+    fields:
+    - name: creationTimestamp
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+    - name: managedFields
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry
+          elementRelationship: atomic
+- name: io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: fieldsType
+      type:
+        scalar: string
+    - name: fieldsV1
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1
+    - name: manager
+      type:
+        scalar: string
+    - name: operation
+      type:
+        scalar: string
+    - name: time
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+    - name: subresource
+      type:
+        scalar: string
+- name: io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1
+  map:
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+- name: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+  scalar: untyped
+- name: __untyped_atomic_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+`)
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/fieldmanager.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/fieldmanager.go
new file mode 100644
index 0000000000..b1e621f390
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/fieldmanager.go
@@ -0,0 +1,58 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+)
+
+// FieldManager updates the managed fields and merges applied
+// configurations.
+type FieldManager = internal.FieldManager
+
+// NewDefaultFieldManager creates a new FieldManager that merges apply requests
+// and update managed fields for other types of requests.
+func NewDefaultFieldManager(typeConverter TypeConverter, objectConverter runtime.ObjectConvertor, objectDefaulter runtime.ObjectDefaulter, objectCreater runtime.ObjectCreater, kind schema.GroupVersionKind, hub schema.GroupVersion, subresource string, resetFields map[fieldpath.APIVersion]fieldpath.Filter) (*FieldManager, error) {
+	f, err := internal.NewStructuredMergeManager(typeConverter, objectConverter, objectDefaulter, kind.GroupVersion(), hub, resetFields)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create field manager: %v", err)
+	}
+	return internal.NewDefaultFieldManager(f, typeConverter, objectConverter, objectCreater, kind, subresource), nil
+}
+
+// NewDefaultCRDFieldManager creates a new FieldManager specifically for
+// CRDs. This allows for the possibility of fields which are not defined
+// in models, as well as having no models defined at all.
+func NewDefaultCRDFieldManager(typeConverter TypeConverter, objectConverter runtime.ObjectConvertor, objectDefaulter runtime.ObjectDefaulter, objectCreater runtime.ObjectCreater, kind schema.GroupVersionKind, hub schema.GroupVersion, subresource string, resetFields map[fieldpath.APIVersion]fieldpath.Filter) (_ *FieldManager, err error) {
+	f, err := internal.NewCRDStructuredMergeManager(typeConverter, objectConverter, objectDefaulter, kind.GroupVersion(), hub, resetFields)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create field manager: %v", err)
+	}
+	return internal.NewDefaultFieldManager(f, typeConverter, objectConverter, objectCreater, kind, subresource), nil
+}
+
+func ValidateManagedFields(encodedManagedFields []metav1.ManagedFieldsEntry) error {
+	_, err := internal.DecodeManagedFields(encodedManagedFields)
+	return err
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/fieldmanager_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/fieldmanager_test.go
new file mode 100644
index 0000000000..6ba8dc5679
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/fieldmanager_test.go
@@ -0,0 +1,1139 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	"k8s.io/apimachinery/pkg/util/managedfields/managedfieldstest"
+	yamlutil "k8s.io/apimachinery/pkg/util/yaml"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+	"sigs.k8s.io/yaml"
+)
+
+var fakeTypeConverter = func() managedfields.TypeConverter {
+	data, err := os.ReadFile(filepath.Join(strings.Repeat(".."+string(filepath.Separator), 7),
+		"api", "openapi-spec", "swagger.json"))
+	if err != nil {
+		panic(err)
+	}
+	swag := spec.Swagger{}
+	if err := json.Unmarshal(data, &swag); err != nil {
+		panic(err)
+	}
+	convertedDefs := map[string]*spec.Schema{}
+	for k, v := range swag.Definitions {
+		vCopy := v
+		convertedDefs[k] = &vCopy
+	}
+	typeConverter, err := managedfields.NewTypeConverter(convertedDefs, false)
+	if err != nil {
+		panic(err)
+	}
+	return typeConverter
+}()
+
+// TestUpdateApplyConflict tests that applying to an object, which
+// wasn't created by apply, will give conflicts
+func TestUpdateApplyConflict(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	patch := []byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+		"metadata": {
+			"name": "deployment",
+			"labels": {"app": "nginx"}
+		},
+		"spec": {
+                        "replicas": 3,
+                        "selector": {
+                                "matchLabels": {
+                                         "app": "nginx"
+                                }
+                        },
+                        "template": {
+                                "metadata": {
+                                        "labels": {
+                                                "app": "nginx"
+                                        }
+                                },
+                                "spec": {
+				        "containers": [{
+					        "name":  "nginx",
+					        "image": "nginx:latest"
+				        }]
+                                }
+                        }
+		}
+	}`)
+	newObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal(patch, &newObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	if err := f.Update(newObj, "fieldmanager_test"); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+		"metadata": {
+			"name": "deployment",
+		},
+		"spec": {
+			"replicas": 101,
+		}
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	err := f.Apply(appliedObj, "fieldmanager_conflict", false)
+	if err == nil || !apierrors.IsConflict(err) {
+		t.Fatalf("Expecting to get conflicts but got %v", err)
+	}
+}
+
+func TestApplyStripsFields(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	newObj := &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": "apps/v1",
+			"kind":       "Deployment",
+		},
+	}
+
+	newObj.SetName("b")
+	newObj.SetNamespace("b")
+	newObj.SetUID("b")
+	newObj.SetGeneration(0)
+	newObj.SetResourceVersion("b")
+	newObj.SetCreationTimestamp(metav1.NewTime(time.Now()))
+	newObj.SetManagedFields([]metav1.ManagedFieldsEntry{
+		{
+			Manager:    "update",
+			Operation:  metav1.ManagedFieldsOperationApply,
+			APIVersion: "apps/v1",
+		},
+	})
+	if err := f.Update(newObj, "fieldmanager_test"); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	if m := f.ManagedFields(); len(m) != 0 {
+		t.Fatalf("fields did not get stripped: %v", m)
+	}
+}
+
+func TestVersionCheck(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	// patch has 'apiVersion: apps/v1' and live version is apps/v1 -> no errors
+	err := f.Apply(appliedObj, "fieldmanager_test", false)
+	if err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	appliedObj = &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1beta1",
+		"kind": "Deployment",
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	// patch has 'apiVersion: apps/v1beta1' but live version is apps/v1 -> error
+	err = f.Apply(appliedObj, "fieldmanager_test", false)
+	if err == nil {
+		t.Fatalf("expected an error from mismatched patch and live versions")
+	}
+	switch typ := err.(type) {
+	default:
+		t.Fatalf("expected error to be of type %T was %T (%v)", apierrors.StatusError{}, typ, err)
+	case apierrors.APIStatus:
+		if typ.Status().Code != http.StatusBadRequest {
+			t.Fatalf("expected status code to be %d but was %d",
+				http.StatusBadRequest, typ.Status().Code)
+		}
+	}
+}
+
+func TestVersionCheckDoesNotPanic(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	// patch has 'apiVersion: apps/v1' and live version is apps/v1 -> no errors
+	err := f.Apply(appliedObj, "fieldmanager_test", false)
+	if err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	appliedObj = &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	// patch has 'apiVersion: apps/v2' but live version is apps/v1 -> error
+	err = f.Apply(appliedObj, "fieldmanager_test", false)
+	if err == nil {
+		t.Fatalf("expected an error from mismatched patch and live versions")
+	}
+	switch typ := err.(type) {
+	default:
+		t.Fatalf("expected error to be of type %T was %T (%v)", apierrors.StatusError{}, typ, err)
+	case apierrors.APIStatus:
+		if typ.Status().Code != http.StatusBadRequest {
+			t.Fatalf("expected status code to be %d but was %d",
+				http.StatusBadRequest, typ.Status().Code)
+		}
+	}
+}
+
+func TestApplyDoesNotStripLabels(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"))
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"labels": {
+				"a": "b"
+			},
+		}
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	err := f.Apply(appliedObj, "fieldmanager_test", false)
+	if err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	if m := f.ManagedFields(); len(m) != 1 {
+		t.Fatalf("labels shouldn't get stripped on apply: %v", m)
+	}
+}
+
+func getObjectBytes(file string) []byte {
+	s, err := os.ReadFile(file)
+	if err != nil {
+		panic(err)
+	}
+	return s
+}
+
+func TestApplyNewObject(t *testing.T) {
+	tests := []struct {
+		gvk schema.GroupVersionKind
+		obj []byte
+	}{
+		{
+			gvk: schema.FromAPIVersionAndKind("v1", "Pod"),
+			obj: getObjectBytes("pod.yaml"),
+		},
+		{
+			gvk: schema.FromAPIVersionAndKind("v1", "Node"),
+			obj: getObjectBytes("node.yaml"),
+		},
+		{
+			gvk: schema.FromAPIVersionAndKind("v1", "Endpoints"),
+			obj: getObjectBytes("endpoints.yaml"),
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.gvk.String(), func(t *testing.T) {
+			f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, test.gvk)
+
+			appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+			if err := yaml.Unmarshal(test.obj, &appliedObj.Object); err != nil {
+				t.Fatalf("error decoding YAML: %v", err)
+			}
+
+			if err := f.Apply(appliedObj, "fieldmanager_test", false); err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+
+func TestApplyFailsWithManagedFields(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"))
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"managedFields": [
+				{
+				  "manager": "test",
+				}
+			]
+		}
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	err := f.Apply(appliedObj, "fieldmanager_test", false)
+
+	if err == nil {
+		t.Fatalf("successfully applied with set managed fields")
+	}
+}
+
+func TestApplySuccessWithNoManagedFields(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"))
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"labels": {
+				"a": "b"
+			},
+		}
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+	err := f.Apply(appliedObj, "fieldmanager_test", false)
+
+	if err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+}
+
+// Run an update and apply, and make sure that nothing has changed.
+func TestNoOpChanges(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"))
+
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"labels": {
+				"a": "b"
+			},
+			"creationTimestamp": null,
+		}
+	}`), &obj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+	if err := f.Apply(obj.DeepCopyObject(), "fieldmanager_test_apply", false); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+	before := f.Live()
+	// Wait to make sure the timestamp is different
+	time.Sleep(time.Second)
+	// Applying with a different fieldmanager will create an entry..
+	if err := f.Apply(obj.DeepCopyObject(), "fieldmanager_test_apply_other", false); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+	if reflect.DeepEqual(before, f.Live()) {
+		t.Fatalf("Applying no-op apply with new manager didn't change object: \n%v", f.Live())
+	}
+	before = f.Live()
+	// Wait to make sure the timestamp is different
+	time.Sleep(time.Second)
+	if err := f.Update(obj.DeepCopyObject(), "fieldmanager_test_update"); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+	if !reflect.DeepEqual(before, f.Live()) {
+		t.Fatalf("No-op update has changed the object:\n%v\n---\n%v", before, f.Live())
+	}
+	before = f.Live()
+	// Wait to make sure the timestamp is different
+	time.Sleep(time.Second)
+	if err := f.Apply(obj.DeepCopyObject(), "fieldmanager_test_apply", true); err != nil {
+		t.Fatalf("failed to re-apply object: %v", err)
+	}
+	if !reflect.DeepEqual(before, f.Live()) {
+		t.Fatalf("No-op apply has changed the object:\n%v\n---\n%v", before, f.Live())
+	}
+}
+
+// Tests that one can reset the managedFields by sending either an empty
+// list
+func TestResetManagedFieldsEmptyList(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"))
+
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"labels": {
+				"a": "b"
+			},
+		}
+	}`), &obj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+	if err := f.Apply(obj, "fieldmanager_test_apply", false); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"managedFields": [],
+			"labels": {
+				"a": "b"
+			},
+		}
+	}`), &obj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+	if err := f.Update(obj, "update_manager"); err != nil {
+		t.Fatalf("failed to update with empty manager: %v", err)
+	}
+
+	if len(f.ManagedFields()) != 0 {
+		t.Fatalf("failed to reset managedFields: %v", f.ManagedFields())
+	}
+}
+
+// Tests that one can reset the managedFields by sending either a list with one empty item.
+func TestResetManagedFieldsEmptyItem(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"))
+
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"labels": {
+				"a": "b"
+			},
+		}
+	}`), &obj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+	if err := f.Apply(obj, "fieldmanager_test_apply", false); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"managedFields": [{}],
+			"labels": {
+				"a": "b"
+			},
+		}
+	}`), &obj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+	if err := f.Update(obj, "update_manager"); err != nil {
+		t.Fatalf("failed to update with empty manager: %v", err)
+	}
+
+	if len(f.ManagedFields()) != 0 {
+		t.Fatalf("failed to reset managedFields: %v", f.ManagedFields())
+	}
+}
+
+func TestServerSideApplyWithInvalidLastApplied(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	// create object with client-side apply
+	newObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	deployment := []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app-v1
+spec:
+  replicas: 1
+`)
+	if err := yaml.Unmarshal(deployment, &newObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+
+	invalidLastApplied := "invalid-object"
+	if err := internal.SetLastApplied(newObj, invalidLastApplied); err != nil {
+		t.Errorf("failed to set last applied: %v", err)
+	}
+
+	if err := f.Update(newObj, "kubectl-client-side-apply-test"); err != nil {
+		t.Errorf("failed to update object: %v", err)
+	}
+
+	lastApplied, err := getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+	if lastApplied != invalidLastApplied {
+		t.Errorf("expected last applied annotation to be set to %q, but got: %q", invalidLastApplied, lastApplied)
+	}
+
+	// upgrade management of the object from client-side apply to server-side apply
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	appliedDeployment := []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app-v2
+spec:
+  replicas: 100
+`)
+	if err := yaml.Unmarshal(appliedDeployment, &appliedObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+
+	if err := f.Apply(appliedObj, "kubectl", false); err == nil || !apierrors.IsConflict(err) {
+		t.Errorf("expected conflict when applying with invalid last-applied annotation, but got no error for object: \n%+v", appliedObj)
+	}
+
+	lastApplied, err = getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+	if lastApplied != invalidLastApplied {
+		t.Errorf("expected last applied annotation to be NOT be updated, but got: %q", lastApplied)
+	}
+
+	// force server-side apply should work and fix the annotation
+	if err := f.Apply(appliedObj, "kubectl", true); err != nil {
+		t.Errorf("failed to force server-side apply with: %v", err)
+	}
+
+	lastApplied, err = getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+	if lastApplied == invalidLastApplied ||
+		!strings.Contains(lastApplied, "my-app-v2") {
+		t.Errorf("expected last applied annotation to be updated, but got: %q", lastApplied)
+	}
+}
+
+func TestInteropForClientSideApplyAndServerSideApply(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	// create object with client-side apply
+	newObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	deployment := []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-v1
+`)
+	if err := yaml.Unmarshal(deployment, &newObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+	if err := setLastAppliedFromEncoded(newObj, deployment); err != nil {
+		t.Errorf("failed to set last applied: %v", err)
+	}
+
+	if err := f.Update(newObj, "kubectl-client-side-apply-test"); err != nil {
+		t.Errorf("failed to update object: %v", err)
+	}
+	lastApplied, err := getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+	if !strings.Contains(lastApplied, "my-image-v1") {
+		t.Errorf("expected last applied annotation to be set properly, but got: %q", lastApplied)
+	}
+
+	// upgrade management of the object from client-side apply to server-side apply
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	appliedDeployment := []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app-v2 # change
+spec:
+  replicas: 8 # change
+  selector:
+    matchLabels:
+      app: my-app-v2 # change
+  template:
+    metadata:
+      labels:
+        app: my-app-v2 # change
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-v2 # change
+`)
+	if err := yaml.Unmarshal(appliedDeployment, &appliedObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+
+	if err := f.Apply(appliedObj, "kubectl", false); err != nil {
+		t.Errorf("error applying object: %v", err)
+	}
+
+	lastApplied, err = getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+	if !strings.Contains(lastApplied, "my-image-v2") {
+		t.Errorf("expected last applied annotation to be updated, but got: %q", lastApplied)
+	}
+}
+
+func TestNoTrackManagedFieldsForClientSideApply(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	// create object
+	newObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	deployment := []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+`)
+	if err := yaml.Unmarshal(deployment, &newObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+	if err := f.Update(newObj, "test_kubectl_create"); err != nil {
+		t.Errorf("failed to update object: %v", err)
+	}
+	if m := f.ManagedFields(); len(m) == 0 {
+		t.Errorf("expected to have managed fields, but got: %v", m)
+	}
+
+	// stop tracking managed fields
+	newObj = &unstructured.Unstructured{Object: map[string]interface{}{}}
+	deployment = []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  managedFields: [] # stop tracking managed fields
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+`)
+	if err := yaml.Unmarshal(deployment, &newObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+	newObj.SetUID("nonempty")
+	if err := f.Update(newObj, "test_kubectl_replace"); err != nil {
+		t.Errorf("failed to update object: %v", err)
+	}
+	if m := f.ManagedFields(); len(m) != 0 {
+		t.Errorf("expected to have stop tracking managed fields, but got: %v", m)
+	}
+
+	// check that we still don't track managed fields
+	newObj = &unstructured.Unstructured{Object: map[string]interface{}{}}
+	deployment = []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+`)
+	if err := yaml.Unmarshal(deployment, &newObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+	if err := setLastAppliedFromEncoded(newObj, deployment); err != nil {
+		t.Errorf("failed to set last applied: %v", err)
+	}
+	if err := f.Update(newObj, "test_k_client_side_apply"); err != nil {
+		t.Errorf("failed to update object: %v", err)
+	}
+	if m := f.ManagedFields(); len(m) != 0 {
+		t.Errorf("expected to continue to not track managed fields, but got: %v", m)
+	}
+	lastApplied, err := getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+	if !strings.Contains(lastApplied, "my-app") {
+		t.Errorf("expected last applied annotation to be set properly, but got: %q", lastApplied)
+	}
+
+	// start tracking managed fields
+	newObj = &unstructured.Unstructured{Object: map[string]interface{}{}}
+	deployment = []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+`)
+	if err := yaml.Unmarshal(deployment, &newObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+	if err := f.Apply(newObj, "test_server_side_apply_without_upgrade", false); err != nil {
+		t.Errorf("error applying object: %v", err)
+	}
+	if m := f.ManagedFields(); len(m) < 2 {
+		t.Errorf("expected to start tracking managed fields with at least 2 field managers, but got: %v", m)
+	}
+	if e, a := "test_server_side_apply_without_upgrade", f.ManagedFields()[0].Manager; e != a {
+		t.Fatalf("exected first manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+	if e, a := "before-first-apply", f.ManagedFields()[1].Manager; e != a {
+		t.Fatalf("exected second manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	// upgrade management of the object from client-side apply to server-side apply
+	newObj = &unstructured.Unstructured{Object: map[string]interface{}{}}
+	deployment = []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app-v2 # change
+spec:
+  replicas: 8 # change
+`)
+	if err := yaml.Unmarshal(deployment, &newObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+	if err := f.Apply(newObj, "kubectl", false); err != nil {
+		t.Errorf("error applying object: %v", err)
+	}
+	if m := f.ManagedFields(); len(m) == 0 {
+		t.Errorf("expected to track managed fields, but got: %v", m)
+	}
+	lastApplied, err = getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+	if !strings.Contains(lastApplied, "my-app-v2") {
+		t.Errorf("expected last applied annotation to be updated, but got: %q", lastApplied)
+	}
+}
+
+func yamlToJSON(y []byte) (string, error) {
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal(y, &obj.Object); err != nil {
+		return "", fmt.Errorf("error decoding YAML: %v", err)
+	}
+	serialization, err := runtime.Encode(unstructured.UnstructuredJSONScheme, obj)
+	if err != nil {
+		return "", fmt.Errorf("error encoding object: %v", err)
+	}
+	json, err := yamlutil.ToJSON(serialization)
+	if err != nil {
+		return "", fmt.Errorf("error converting to json: %v", err)
+	}
+	return string(json), nil
+}
+
+func setLastAppliedFromEncoded(obj runtime.Object, lastApplied []byte) error {
+	lastAppliedJSON, err := yamlToJSON(lastApplied)
+	if err != nil {
+		return err
+	}
+	return internal.SetLastApplied(obj, lastAppliedJSON)
+}
+
+func getLastApplied(obj runtime.Object) (string, error) {
+	accessor := meta.NewAccessor()
+	annotations, err := accessor.Annotations(obj)
+	if err != nil {
+		return "", fmt.Errorf("failed to access annotations: %v", err)
+	}
+	if annotations == nil {
+		return "", fmt.Errorf("no annotations on obj: %v", obj)
+	}
+
+	lastApplied, ok := annotations[internal.LastAppliedConfigAnnotation]
+	if !ok {
+		return "", fmt.Errorf("expected last applied annotation, but got none for object: %v", obj)
+	}
+	return lastApplied, nil
+}
+
+func TestUpdateViaSubresources(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManagerSubresource(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"), "scale")
+
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"labels": {
+				"a":"b"
+			},
+		}
+	}`), &obj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+	obj.SetManagedFields([]metav1.ManagedFieldsEntry{
+		{
+			Manager:    "test",
+			Operation:  metav1.ManagedFieldsOperationApply,
+			APIVersion: "apps/v1",
+			FieldsType: "FieldsV1",
+			FieldsV1: metav1.NewFieldsV1(
+				`{"f:metadata":{"f:labels":{"f:another_field":{}}}}`,
+			),
+		},
+	})
+
+	// Check that managed fields cannot be changed explicitly via subresources
+	expectedManager := "fieldmanager_test_subresource"
+	if err := f.Update(obj, expectedManager); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	managedFields := f.ManagedFields()
+	if len(managedFields) != 1 {
+		t.Fatalf("Expected new managed fields to have one entry. Got:\n%#v", managedFields)
+	}
+	if managedFields[0].Manager != expectedManager {
+		t.Fatalf("Expected first item to have manager set to: %s. Got: %s", expectedManager, managedFields[0].Manager)
+	}
+
+	// Check that managed fields cannot be reset via subresources
+	newObj := obj.DeepCopy()
+	newObj.SetManagedFields([]metav1.ManagedFieldsEntry{})
+	if err := f.Update(newObj, expectedManager); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+	newManagedFields := f.ManagedFields()
+	if len(newManagedFields) != 1 {
+		t.Fatalf("Expected new managed fields to have one entry. Got:\n%#v", newManagedFields)
+	}
+}
+
+// Ensures that a no-op Apply does not mutate managed fields
+func TestApplyDoesNotChangeManagedFields(t *testing.T) {
+	originalManagedFields := []metav1.ManagedFieldsEntry{}
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter,
+		schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+	newObj := &unstructured.Unstructured{
+		Object: map[string]interface{}{},
+	}
+	appliedObj := &unstructured.Unstructured{
+		Object: map[string]interface{}{},
+	}
+
+	// Convert YAML string inputs to unstructured instances
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+		"metadata": {
+			"name": "deployment",
+			"labels": {"app": "nginx"}
+		},
+		"spec": {
+			"selector": {
+				"matchLabels": {
+					"app": "nginx"
+				}
+			},
+			"template": {
+				"metadata": {
+					"labels": {
+						"app": "nginx"
+					}
+				},
+				"spec": {
+					"containers": [{
+						"name":  "nginx",
+						"image": "nginx:latest"
+					}]
+				}
+			}
+		}
+	}`), &newObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+		"metadata": {
+			"name": "deployment",
+		},
+		"spec": {
+			"replicas": 101,
+		}
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	// Agent A applies initial configuration
+	if err := f.Apply(newObj.DeepCopyObject(), "fieldmanager_z", false); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	// Agent B applies additive configuration
+	if err := f.Apply(appliedObj, "fieldmanager_b", false); err != nil {
+		t.Fatalf("failed to apply object %v", err)
+	}
+
+	// Next, agent A applies the initial configuration again, but we expect
+	// a no-op to managed fields.
+	//
+	// The following update is expected not to change the liveObj, save off
+	//	the fields
+	for _, field := range f.ManagedFields() {
+		originalManagedFields = append(originalManagedFields, *field.DeepCopy())
+	}
+
+	// Make sure timestamp change would be caught
+	time.Sleep(2 * time.Second)
+
+	if err := f.Apply(newObj, "fieldmanager_z", false); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	// ensure that the live object is unchanged
+	if !reflect.DeepEqual(originalManagedFields, f.ManagedFields()) {
+		originalYAML, _ := yaml.Marshal(originalManagedFields)
+		current, _ := yaml.Marshal(f.ManagedFields())
+
+		// should have been a no-op w.r.t. managed fields
+		t.Fatalf("managed fields changed: ORIGINAL\n%v\nCURRENT\n%v",
+			string(originalYAML), string(current))
+	}
+}
+
+// Ensures that a no-op Update does not mutate managed fields
+func TestUpdateDoesNotChangeManagedFields(t *testing.T) {
+	originalManagedFields := []metav1.ManagedFieldsEntry{}
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter,
+		schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+	newObj := &unstructured.Unstructured{
+		Object: map[string]interface{}{},
+	}
+
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+		"metadata": {
+			"name": "deployment",
+			"labels": {"app": "nginx"}
+		},
+		"spec": {
+			"selector": {
+				"matchLabels": {
+					"app": "nginx"
+				}
+			},
+			"template": {
+				"metadata": {
+					"labels": {
+						"app": "nginx"
+					}
+				},
+				"spec": {
+					"containers": [{
+						"name":  "nginx",
+						"image": "nginx:latest"
+					}]
+				}
+			}
+		}
+	}`), &newObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	// Agent A updates with initial configuration
+	if err := f.Update(newObj.DeepCopyObject(), "fieldmanager_z"); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	for _, field := range f.ManagedFields() {
+		originalManagedFields = append(originalManagedFields, *field.DeepCopy())
+	}
+
+	// Make sure timestamp change would be caught
+	time.Sleep(2 * time.Second)
+
+	// If the same exact configuration is updated once again, the
+	// managed fields are not expected to change
+	//
+	// However, a change in field ownership WOULD be a semantic change which
+	// should cause managed fields to change.
+	if err := f.Update(newObj, "fieldmanager_z"); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	// ensure that the live object is unchanged
+	if !reflect.DeepEqual(originalManagedFields, f.ManagedFields()) {
+		originalYAML, _ := yaml.Marshal(originalManagedFields)
+		current, _ := yaml.Marshal(f.ManagedFields())
+
+		// should have been a no-op w.r.t. managed fields
+		t.Fatalf("managed fields changed: ORIGINAL\n%v\nCURRENT\n%v",
+			string(originalYAML), string(current))
+	}
+}
+
+// This test makes sure that the liveObject during a patch does not mutate
+// its managed fields.
+func TestLiveObjectManagedFieldsNotRemoved(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter,
+		schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+	newObj := &unstructured.Unstructured{
+		Object: map[string]interface{}{},
+	}
+	appliedObj := &unstructured.Unstructured{
+		Object: map[string]interface{}{},
+	}
+	// Convert YAML string inputs to unstructured instances
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+		"metadata": {
+			"name": "deployment",
+			"labels": {"app": "nginx"}
+		},
+		"spec": {
+			"selector": {
+				"matchLabels": {
+					"app": "nginx"
+				}
+			},
+			"template": {
+				"metadata": {
+					"labels": {
+						"app": "nginx"
+					}
+				},
+				"spec": {
+					"containers": [{
+						"name":  "nginx",
+						"image": "nginx:latest"
+					}]
+				}
+			}
+		}
+	}`), &newObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "apps/v1",
+		"kind": "Deployment",
+		"metadata": {
+			"name": "deployment",
+		},
+		"spec": {
+			"replicas": 101,
+		}
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	// Agent A applies initial configuration
+	if err := f.Apply(newObj.DeepCopyObject(), "fieldmanager_z", false); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	originalLiveObj := f.Live()
+
+	accessor, err := meta.Accessor(originalLiveObj)
+	if err != nil {
+		panic(fmt.Errorf("couldn't get accessor: %v", err))
+	}
+
+	// Managed fields should not be stripped
+	if len(accessor.GetManagedFields()) == 0 {
+		t.Fatalf("empty managed fields of object which expected nonzero fields")
+	}
+
+	// Agent A applies the exact same configuration
+	if err := f.Apply(appliedObj.DeepCopyObject(), "fieldmanager_z", false); err != nil {
+		t.Fatalf("failed to apply object: %v", err)
+	}
+
+	accessor, err = meta.Accessor(originalLiveObj)
+	if err != nil {
+		panic(fmt.Errorf("couldn't get accessor: %v", err))
+	}
+
+	// Managed fields should not be stripped
+	if len(accessor.GetManagedFields()) == 0 {
+		t.Fatalf("empty managed fields of object which expected nonzero fields")
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/gvkparser.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/gvkparser.go
new file mode 100644
index 0000000000..89e4470548
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/gvkparser.go
@@ -0,0 +1,128 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kube-openapi/pkg/schemaconv"
+	"k8s.io/kube-openapi/pkg/util/proto"
+	smdschema "sigs.k8s.io/structured-merge-diff/v6/schema"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+)
+
+// groupVersionKindExtensionKey is the key used to lookup the
+// GroupVersionKind value for an object definition from the
+// definition's "extensions" map.
+const groupVersionKindExtensionKey = "x-kubernetes-group-version-kind"
+
+// GvkParser contains a Parser that allows introspecting the schema.
+type GvkParser struct {
+	gvks   map[schema.GroupVersionKind]string
+	parser typed.Parser
+}
+
+// Type returns a helper which can produce objects of the given type. Any
+// errors are deferred until a further function is called.
+func (p *GvkParser) Type(gvk schema.GroupVersionKind) *typed.ParseableType {
+	typeName, ok := p.gvks[gvk]
+	if !ok {
+		return nil
+	}
+	t := p.parser.Type(typeName)
+	return &t
+}
+
+// NewGVKParser builds a GVKParser from a proto.Models. This
+// will automatically find the proper version of the object, and the
+// corresponding schema information.
+func NewGVKParser(models proto.Models, preserveUnknownFields bool) (*GvkParser, error) {
+	typeSchema, err := schemaconv.ToSchemaWithPreserveUnknownFields(models, preserveUnknownFields)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert models to schema: %v", err)
+	}
+	parser := GvkParser{
+		gvks: map[schema.GroupVersionKind]string{},
+	}
+	parser.parser = typed.Parser{Schema: smdschema.Schema{Types: typeSchema.Types}}
+	for _, modelName := range models.ListModels() {
+		model := models.LookupModel(modelName)
+		if model == nil {
+			panic(fmt.Sprintf("ListModels returns a model that can't be looked-up for: %v", modelName))
+		}
+		gvkList := parseGroupVersionKind(model)
+		for _, gvk := range gvkList {
+			if len(gvk.Kind) > 0 {
+				_, ok := parser.gvks[gvk]
+				if ok {
+					return nil, fmt.Errorf("duplicate entry for %v", gvk)
+				}
+				parser.gvks[gvk] = modelName
+			}
+		}
+	}
+	return &parser, nil
+}
+
+// Get and parse GroupVersionKind from the extension. Returns empty if it doesn't have one.
+func parseGroupVersionKind(s proto.Schema) []schema.GroupVersionKind {
+	extensions := s.GetExtensions()
+
+	gvkListResult := []schema.GroupVersionKind{}
+
+	// Get the extensions
+	gvkExtension, ok := extensions[groupVersionKindExtensionKey]
+	if !ok {
+		return []schema.GroupVersionKind{}
+	}
+
+	// gvk extension must be a list of at least 1 element.
+	gvkList, ok := gvkExtension.([]interface{})
+	if !ok {
+		return []schema.GroupVersionKind{}
+	}
+
+	for _, gvk := range gvkList {
+		// gvk extension list must be a map with group, version, and
+		// kind fields
+		gvkMap, ok := gvk.(map[interface{}]interface{})
+		if !ok {
+			continue
+		}
+		group, ok := gvkMap["group"].(string)
+		if !ok {
+			continue
+		}
+		version, ok := gvkMap["version"].(string)
+		if !ok {
+			continue
+		}
+		kind, ok := gvkMap["kind"].(string)
+		if !ok {
+			continue
+		}
+
+		gvkListResult = append(gvkListResult, schema.GroupVersionKind{
+			Group:   group,
+			Version: version,
+			Kind:    kind,
+		})
+	}
+
+	return gvkListResult
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/atmostevery.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/atmostevery.go
new file mode 100644
index 0000000000..b75ef7416e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/atmostevery.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"sync"
+	"time"
+)
+
+// AtMostEvery will never run the method more than once every specified
+// duration.
+type AtMostEvery struct {
+	delay    time.Duration
+	lastCall time.Time
+	mutex    sync.Mutex
+}
+
+// NewAtMostEvery creates a new AtMostEvery, that will run the method at
+// most every given duration.
+func NewAtMostEvery(delay time.Duration) *AtMostEvery {
+	return &AtMostEvery{
+		delay: delay,
+	}
+}
+
+// updateLastCall returns true if the lastCall time has been updated,
+// false if it was too early.
+func (s *AtMostEvery) updateLastCall() bool {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+	if time.Since(s.lastCall) < s.delay {
+		return false
+	}
+	s.lastCall = time.Now()
+	return true
+}
+
+// Do will run the method if enough time has passed, and return true.
+// Otherwise, it does nothing and returns false.
+func (s *AtMostEvery) Do(fn func()) bool {
+	if !s.updateLastCall() {
+		return false
+	}
+	fn()
+	return true
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/atmostevery_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/atmostevery_test.go
new file mode 100644
index 0000000000..8dea4add71
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/atmostevery_test.go
@@ -0,0 +1,51 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+)
+
+func TestAtMostEvery(t *testing.T) {
+	duration := time.Second
+	delay := 179 * time.Millisecond
+	atMostEvery := internal.NewAtMostEvery(delay)
+	count := 0
+	exit := time.NewTicker(duration)
+	tick := time.NewTicker(2 * time.Millisecond)
+	defer exit.Stop()
+	defer tick.Stop()
+
+	done := false
+	for !done {
+		select {
+		case <-exit.C:
+			done = true
+		case <-tick.C:
+			atMostEvery.Do(func() {
+				count++
+			})
+		}
+	}
+
+	if expected := int(duration/delay) + 1; count > expected {
+		t.Fatalf("Function called %d times, should have been called less than or equal to %d times", count, expected)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/buildmanagerinfo.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/buildmanagerinfo.go
new file mode 100644
index 0000000000..fa342ca135
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/buildmanagerinfo.go
@@ -0,0 +1,74 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type buildManagerInfoManager struct {
+	fieldManager Manager
+	groupVersion schema.GroupVersion
+	subresource  string
+}
+
+var _ Manager = &buildManagerInfoManager{}
+
+// NewBuildManagerInfoManager creates a new Manager that converts the manager name into a unique identifier
+// combining operation and version for update requests, and just operation for apply requests.
+func NewBuildManagerInfoManager(f Manager, gv schema.GroupVersion, subresource string) Manager {
+	return &buildManagerInfoManager{
+		fieldManager: f,
+		groupVersion: gv,
+		subresource:  subresource,
+	}
+}
+
+// Update implements Manager.
+func (f *buildManagerInfoManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	manager, err := f.buildManagerInfo(manager, metav1.ManagedFieldsOperationUpdate)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to build manager identifier: %v", err)
+	}
+	return f.fieldManager.Update(liveObj, newObj, managed, manager)
+}
+
+// Apply implements Manager.
+func (f *buildManagerInfoManager) Apply(liveObj, appliedObj runtime.Object, managed Managed, manager string, force bool) (runtime.Object, Managed, error) {
+	manager, err := f.buildManagerInfo(manager, metav1.ManagedFieldsOperationApply)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to build manager identifier: %v", err)
+	}
+	return f.fieldManager.Apply(liveObj, appliedObj, managed, manager, force)
+}
+
+func (f *buildManagerInfoManager) buildManagerInfo(prefix string, operation metav1.ManagedFieldsOperationType) (string, error) {
+	managerInfo := metav1.ManagedFieldsEntry{
+		Manager:     prefix,
+		Operation:   operation,
+		APIVersion:  f.groupVersion.String(),
+		Subresource: f.subresource,
+	}
+	if managerInfo.Manager == "" {
+		managerInfo.Manager = "unknown"
+	}
+	return BuildManagerIdentifier(&managerInfo)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/capmanagers.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/capmanagers.go
new file mode 100644
index 0000000000..a9530ff2b4
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/capmanagers.go
@@ -0,0 +1,133 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+	"sort"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+type capManagersManager struct {
+	fieldManager          Manager
+	maxUpdateManagers     int
+	oldUpdatesManagerName string
+}
+
+var _ Manager = &capManagersManager{}
+
+// NewCapManagersManager creates a new wrapped FieldManager which ensures that the number of managers from updates
+// does not exceed maxUpdateManagers, by merging some of the oldest entries on each update.
+func NewCapManagersManager(fieldManager Manager, maxUpdateManagers int) Manager {
+	return &capManagersManager{
+		fieldManager:          fieldManager,
+		maxUpdateManagers:     maxUpdateManagers,
+		oldUpdatesManagerName: "ancient-changes",
+	}
+}
+
+// Update implements Manager.
+func (f *capManagersManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	object, managed, err := f.fieldManager.Update(liveObj, newObj, managed, manager)
+	if err != nil {
+		return object, managed, err
+	}
+	if managed, err = f.capUpdateManagers(managed); err != nil {
+		return nil, nil, fmt.Errorf("failed to cap update managers: %v", err)
+	}
+	return object, managed, nil
+}
+
+// Apply implements Manager.
+func (f *capManagersManager) Apply(liveObj, appliedObj runtime.Object, managed Managed, fieldManager string, force bool) (runtime.Object, Managed, error) {
+	return f.fieldManager.Apply(liveObj, appliedObj, managed, fieldManager, force)
+}
+
+// capUpdateManagers merges a number of the oldest update entries into versioned buckets,
+// such that the number of entries from updates does not exceed f.maxUpdateManagers.
+func (f *capManagersManager) capUpdateManagers(managed Managed) (newManaged Managed, err error) {
+	// Gather all entries from updates
+	updaters := []string{}
+	for manager, fields := range managed.Fields() {
+		if !fields.Applied() {
+			updaters = append(updaters, manager)
+		}
+	}
+	if len(updaters) <= f.maxUpdateManagers {
+		return managed, nil
+	}
+
+	// If we have more than the maximum, sort the update entries by time, oldest first.
+	sort.Slice(updaters, func(i, j int) bool {
+		iTime, jTime, iSeconds, jSeconds := managed.Times()[updaters[i]], managed.Times()[updaters[j]], int64(0), int64(0)
+		if iTime != nil {
+			iSeconds = iTime.Unix()
+		}
+		if jTime != nil {
+			jSeconds = jTime.Unix()
+		}
+		if iSeconds != jSeconds {
+			return iSeconds < jSeconds
+		}
+		return updaters[i] < updaters[j]
+	})
+
+	// Merge the oldest updaters with versioned bucket managers until the number of updaters is under the cap
+	versionToFirstManager := map[string]string{}
+	for i, length := 0, len(updaters); i < len(updaters) && length > f.maxUpdateManagers; i++ {
+		manager := updaters[i]
+		vs := managed.Fields()[manager]
+		time := managed.Times()[manager]
+		version := string(vs.APIVersion())
+
+		// Create a new manager identifier for the versioned bucket entry.
+		// The version for this manager comes from the version of the update being merged into the bucket.
+		bucket, err := BuildManagerIdentifier(&metav1.ManagedFieldsEntry{
+			Manager:    f.oldUpdatesManagerName,
+			Operation:  metav1.ManagedFieldsOperationUpdate,
+			APIVersion: version,
+		})
+		if err != nil {
+			return managed, fmt.Errorf("failed to create bucket manager for version %v: %v", version, err)
+		}
+
+		// Merge the fieldets if this is not the first time the version was seen.
+		// Otherwise just record the manager name in versionToFirstManager
+		if first, ok := versionToFirstManager[version]; ok {
+			// If the bucket doesn't exists yet, create one.
+			if _, ok := managed.Fields()[bucket]; !ok {
+				s := managed.Fields()[first]
+				delete(managed.Fields(), first)
+				managed.Fields()[bucket] = s
+			}
+
+			managed.Fields()[bucket] = fieldpath.NewVersionedSet(vs.Set().Union(managed.Fields()[bucket].Set()), vs.APIVersion(), vs.Applied())
+			delete(managed.Fields(), manager)
+			length--
+
+			// Use the time from the update being merged into the bucket, since it is more recent.
+			managed.Times()[bucket] = time
+		} else {
+			versionToFirstManager[version] = manager
+		}
+	}
+
+	return managed, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/capmanagers_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/capmanagers_test.go
new file mode 100644
index 0000000000..366b299a58
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/capmanagers_test.go
@@ -0,0 +1,303 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"testing"
+	"time"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	internaltesting "k8s.io/apimachinery/pkg/util/managedfields/internal/testing"
+	"k8s.io/apimachinery/pkg/util/managedfields/managedfieldstest"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+type fakeManager struct {
+	Manager internal.Manager
+	Error   error
+}
+
+var _ internal.Manager = &fakeManager{}
+
+func (f *fakeManager) Update(liveObj, newObj runtime.Object, managed internal.Managed, manager string) (runtime.Object, internal.Managed, error) {
+	if f.Error != nil {
+		return nil, nil, f.Error
+	}
+	if f.Manager != nil {
+		return f.Manager.Update(liveObj, newObj, managed, manager)
+	}
+	return newObj, managed, nil
+}
+
+func (f *fakeManager) Apply(_, _ runtime.Object, _ internal.Managed, _ string, _ bool) (runtime.Object, internal.Managed, error) {
+	panic("not implemented")
+}
+
+func TestCapManagersManagerMergesEntries(t *testing.T) {
+	f := internaltesting.NewTestFieldManagerImpl(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"),
+		"",
+		func(m internal.Manager) internal.Manager {
+			return internal.NewCapManagersManager(m, 3)
+		})
+
+	podWithLabels := func(labels ...string) runtime.Object {
+		labelMap := map[string]interface{}{}
+		for _, key := range labels {
+			labelMap[key] = "true"
+		}
+		obj := &unstructured.Unstructured{
+			Object: map[string]interface{}{
+				"metadata": map[string]interface{}{
+					"labels": labelMap,
+				},
+			},
+		}
+		obj.SetKind("Pod")
+		obj.SetAPIVersion("v1")
+		return obj
+	}
+
+	if err := f.Update(podWithLabels("one"), "fieldmanager_test_update_1"); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+	expectIdempotence(t, f)
+
+	if err := f.Update(podWithLabels("one", "two"), "fieldmanager_test_update_2"); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+	expectIdempotence(t, f)
+
+	if err := f.Update(podWithLabels("one", "two", "three"), "fieldmanager_test_update_3"); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+	expectIdempotence(t, f)
+
+	if err := f.Update(podWithLabels("one", "two", "three", "four"), "fieldmanager_test_update_4"); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+	expectIdempotence(t, f)
+
+	if e, a := 3, len(f.ManagedFields()); e != a {
+		t.Fatalf("exected %v entries in managedFields, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	if e, a := "ancient-changes", f.ManagedFields()[0].Manager; e != a {
+		t.Fatalf("exected first manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	if e, a := "fieldmanager_test_update_3", f.ManagedFields()[1].Manager; e != a {
+		t.Fatalf("exected second manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	if e, a := "fieldmanager_test_update_4", f.ManagedFields()[2].Manager; e != a {
+		t.Fatalf("exected third manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	expectManagesField(t, f, "ancient-changes", fieldpath.MakePathOrDie("metadata", "labels", "one"))
+	expectManagesField(t, f, "ancient-changes", fieldpath.MakePathOrDie("metadata", "labels", "two"))
+	expectManagesField(t, f, "fieldmanager_test_update_3", fieldpath.MakePathOrDie("metadata", "labels", "three"))
+	expectManagesField(t, f, "fieldmanager_test_update_4", fieldpath.MakePathOrDie("metadata", "labels", "four"))
+}
+
+func TestCapUpdateManagers(t *testing.T) {
+	f := internaltesting.NewTestFieldManagerImpl(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"),
+		"",
+		func(m internal.Manager) internal.Manager {
+			return internal.NewCapManagersManager(m, 3)
+		})
+
+	set := func(fields ...string) *metav1.FieldsV1 {
+		s := fieldpath.NewSet()
+		for _, f := range fields {
+			s.Insert(fieldpath.MakePathOrDie(f))
+		}
+		b, err := s.ToJSON()
+		if err != nil {
+			panic(fmt.Sprintf("error building ManagedFieldsEntry for test: %v", err))
+		}
+		return metav1.NewFieldsV1(string(b))
+	}
+
+	entry := func(name string, version string, order int, fields *metav1.FieldsV1) metav1.ManagedFieldsEntry {
+		return metav1.ManagedFieldsEntry{
+			Manager:    name,
+			APIVersion: version,
+			Operation:  "Update",
+			FieldsType: "FieldsV1",
+			FieldsV1:   fields,
+			Time:       &metav1.Time{Time: time.Time{}.Add(time.Hour * time.Duration(order))},
+		}
+	}
+
+	testCases := []struct {
+		name     string
+		input    []metav1.ManagedFieldsEntry
+		expected []metav1.ManagedFieldsEntry
+	}{
+		{
+			name: "one version, no ancient changes",
+			input: []metav1.ManagedFieldsEntry{
+				entry("update-manager1", "v1", 1, set("a")),
+				entry("update-manager2", "v1", 2, set("b")),
+				entry("update-manager3", "v1", 3, set("c")),
+				entry("update-manager4", "v1", 4, set("d")),
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 2, set("a", "b")),
+				entry("update-manager3", "v1", 3, set("c")),
+				entry("update-manager4", "v1", 4, set("d")),
+			},
+		}, {
+			name: "one version, one ancient changes",
+			input: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 2, set("a", "b")),
+				entry("update-manager3", "v1", 3, set("c")),
+				entry("update-manager4", "v1", 4, set("d")),
+				entry("update-manager5", "v1", 5, set("e")),
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 3, set("a", "b", "c")),
+				entry("update-manager4", "v1", 4, set("d")),
+				entry("update-manager5", "v1", 5, set("e")),
+			},
+		}, {
+			name: "two versions, no ancient changes",
+			input: []metav1.ManagedFieldsEntry{
+				entry("update-manager1", "v1", 1, set("a")),
+				entry("update-manager2", "v2", 2, set("b")),
+				entry("update-manager3", "v1", 3, set("c")),
+				entry("update-manager4", "v1", 4, set("d")),
+				entry("update-manager5", "v1", 5, set("e")),
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				entry("update-manager2", "v2", 2, set("b")),
+				entry("ancient-changes", "v1", 4, set("a", "c", "d")),
+				entry("update-manager5", "v1", 5, set("e")),
+			},
+		}, {
+			name: "three versions, one ancient changes",
+			input: []metav1.ManagedFieldsEntry{
+				entry("update-manager2", "v2", 2, set("b")),
+				entry("ancient-changes", "v1", 4, set("a", "c", "d")),
+				entry("update-manager5", "v1", 5, set("e")),
+				entry("update-manager6", "v3", 6, set("f")),
+				entry("update-manager7", "v2", 7, set("g")),
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 5, set("a", "c", "d", "e")),
+				entry("update-manager6", "v3", 6, set("f")),
+				entry("ancient-changes", "v2", 7, set("b", "g")),
+			},
+		}, {
+			name: "three versions, two ancient changes",
+			input: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 5, set("a", "c", "d", "e")),
+				entry("update-manager6", "v3", 6, set("f")),
+				entry("ancient-changes", "v2", 7, set("b", "g")),
+				entry("update-manager8", "v3", 8, set("h")),
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 5, set("a", "c", "d", "e")),
+				entry("ancient-changes", "v2", 7, set("b", "g")),
+				entry("ancient-changes", "v3", 8, set("f", "h")),
+			},
+		}, {
+			name: "four versions, two ancient changes",
+			input: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 5, set("a", "c", "d", "e")),
+				entry("update-manager6", "v3", 6, set("f")),
+				entry("ancient-changes", "v2", 7, set("b", "g")),
+				entry("update-manager8", "v4", 8, set("h")),
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				entry("ancient-changes", "v1", 5, set("a", "c", "d", "e")),
+				entry("update-manager6", "v3", 6, set("f")),
+				entry("ancient-changes", "v2", 7, set("b", "g")),
+				entry("update-manager8", "v4", 8, set("h")),
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		f.Reset()
+		live := f.Live()
+		accessor, err := meta.Accessor(live)
+		if err != nil {
+			t.Fatalf("%v: couldn't get accessor: %v", tc.name, err)
+		}
+		accessor.SetManagedFields(tc.input)
+		if err := f.Update(live, "no-op-update"); err != nil {
+			t.Fatalf("%v: failed to do no-op update to object: %v", tc.name, err)
+		}
+
+		if e, a := tc.expected, f.ManagedFields(); !apiequality.Semantic.DeepEqual(e, a) {
+			t.Errorf("%v: unexpected value for managedFields:\nexpected: %v\n but got: %v", tc.name, mustMarshal(e), mustMarshal(a))
+		}
+		expectIdempotence(t, f)
+	}
+}
+
+// expectIdempotence does a no-op update and ensures that managedFields doesn't change by calling capUpdateManagers.
+func expectIdempotence(t *testing.T, f managedfieldstest.TestFieldManager) {
+	before := []metav1.ManagedFieldsEntry{}
+	for _, m := range f.ManagedFields() {
+		before = append(before, *m.DeepCopy())
+	}
+
+	if err := f.Update(f.Live(), "no-op-update"); err != nil {
+		t.Fatalf("failed to do no-op update to object: %v", err)
+	}
+
+	if after := f.ManagedFields(); !apiequality.Semantic.DeepEqual(before, after) {
+		t.Fatalf("exected idempotence, but managedFields changed:\nbefore: %v\n after: %v", mustMarshal(before), mustMarshal(after))
+	}
+}
+
+// expectManagesField ensures that manager m currently manages field path p.
+func expectManagesField(t *testing.T, f managedfieldstest.TestFieldManager, m string, p fieldpath.Path) {
+	for _, e := range f.ManagedFields() {
+		if e.Manager == m {
+			var s fieldpath.Set
+			err := s.FromJSON(bytes.NewReader(e.FieldsV1.GetRawBytes()))
+			if err != nil {
+				t.Fatalf("error parsing managedFields for %v: %v: %#v", m, err, f.ManagedFields())
+			}
+			if !s.Has(p) {
+				t.Fatalf("expected managedFields for %v to contain %v, but got:\n%v", m, p.String(), s.String())
+			}
+			return
+		}
+	}
+	t.Fatalf("exected to find manager name %v, but got: %#v", m, f.ManagedFields())
+}
+
+func mustMarshal(i interface{}) string {
+	b, err := json.MarshalIndent(i, "", "  ")
+	if err != nil {
+		panic(fmt.Sprintf("error marshalling %v to json: %v", i, err))
+	}
+	return string(b)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/conflict.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/conflict.go
new file mode 100644
index 0000000000..1f07b004de
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/conflict.go
@@ -0,0 +1,89 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+)
+
+// NewConflictError returns an error including details on the requests apply conflicts
+func NewConflictError(conflicts merge.Conflicts) *errors.StatusError {
+	causes := []metav1.StatusCause{}
+	for _, conflict := range conflicts {
+		causes = append(causes, metav1.StatusCause{
+			Type:    metav1.CauseTypeFieldManagerConflict,
+			Message: fmt.Sprintf("conflict with %v", printManager(conflict.Manager)),
+			Field:   conflict.Path.String(),
+		})
+	}
+	return errors.NewApplyConflict(causes, getConflictMessage(conflicts))
+}
+
+func getConflictMessage(conflicts merge.Conflicts) string {
+	if len(conflicts) == 1 {
+		return fmt.Sprintf("Apply failed with 1 conflict: conflict with %v: %v", printManager(conflicts[0].Manager), conflicts[0].Path)
+	}
+
+	m := map[string][]fieldpath.Path{}
+	for _, conflict := range conflicts {
+		m[conflict.Manager] = append(m[conflict.Manager], conflict.Path)
+	}
+
+	uniqueManagers := []string{}
+	for manager := range m {
+		uniqueManagers = append(uniqueManagers, manager)
+	}
+
+	// Print conflicts by sorted managers.
+	sort.Strings(uniqueManagers)
+
+	messages := []string{}
+	for _, manager := range uniqueManagers {
+		messages = append(messages, fmt.Sprintf("conflicts with %v:", printManager(manager)))
+		for _, path := range m[manager] {
+			messages = append(messages, fmt.Sprintf("- %v", path))
+		}
+	}
+	return fmt.Sprintf("Apply failed with %d conflicts: %s", len(conflicts), strings.Join(messages, "\n"))
+}
+
+func printManager(manager string) string {
+	encodedManager := &metav1.ManagedFieldsEntry{}
+	if err := json.Unmarshal([]byte(manager), encodedManager); err != nil {
+		return fmt.Sprintf("%q", manager)
+	}
+	managerStr := fmt.Sprintf("%q", encodedManager.Manager)
+	if encodedManager.Subresource != "" {
+		managerStr = fmt.Sprintf("%s with subresource %q", managerStr, encodedManager.Subresource)
+	}
+	if encodedManager.Operation == metav1.ManagedFieldsOperationUpdate {
+		if encodedManager.Time == nil {
+			return fmt.Sprintf("%s using %v", managerStr, encodedManager.APIVersion)
+		}
+		return fmt.Sprintf("%s using %v at %v", managerStr, encodedManager.APIVersion, encodedManager.Time.UTC().Format(time.RFC3339))
+	}
+	return managerStr
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/conflict_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/conflict_test.go
new file mode 100644
index 0000000000..cf13711253
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/conflict_test.go
@@ -0,0 +1,131 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"net/http"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+)
+
+// TestNewConflictError tests that NewConflictError creates the correct StatusError for a given smd Conflicts
+func TestNewConflictError(t *testing.T) {
+	testCases := []struct {
+		conflict merge.Conflicts
+		expected *errors.StatusError
+	}{
+		{
+			conflict: merge.Conflicts{
+				merge.Conflict{
+					Manager: `{"manager":"foo","operation":"Update","apiVersion":"v1","time":"2001-02-03T04:05:06Z"}`,
+					Path:    fieldpath.MakePathOrDie("spec", "replicas"),
+				},
+			},
+			expected: &errors.StatusError{
+				ErrStatus: metav1.Status{
+					Status: metav1.StatusFailure,
+					Code:   http.StatusConflict,
+					Reason: metav1.StatusReasonConflict,
+					Details: &metav1.StatusDetails{
+						Causes: []metav1.StatusCause{
+							{
+								Type:    metav1.CauseTypeFieldManagerConflict,
+								Message: `conflict with "foo" using v1 at 2001-02-03T04:05:06Z`,
+								Field:   ".spec.replicas",
+							},
+						},
+					},
+					Message: `Apply failed with 1 conflict: conflict with "foo" using v1 at 2001-02-03T04:05:06Z: .spec.replicas`,
+				},
+			},
+		},
+		{
+			conflict: merge.Conflicts{
+				merge.Conflict{
+					Manager: `{"manager":"foo","operation":"Update","apiVersion":"v1","time":"2001-02-03T04:05:06Z"}`,
+					Path:    fieldpath.MakePathOrDie("spec", "replicas"),
+				},
+				merge.Conflict{
+					Manager: `{"manager":"bar","operation":"Apply"}`,
+					Path:    fieldpath.MakePathOrDie("metadata", "labels", "app"),
+				},
+			},
+			expected: &errors.StatusError{
+				ErrStatus: metav1.Status{
+					Status: metav1.StatusFailure,
+					Code:   http.StatusConflict,
+					Reason: metav1.StatusReasonConflict,
+					Details: &metav1.StatusDetails{
+						Causes: []metav1.StatusCause{
+							{
+								Type:    metav1.CauseTypeFieldManagerConflict,
+								Message: `conflict with "foo" using v1 at 2001-02-03T04:05:06Z`,
+								Field:   ".spec.replicas",
+							},
+							{
+								Type:    metav1.CauseTypeFieldManagerConflict,
+								Message: `conflict with "bar"`,
+								Field:   ".metadata.labels.app",
+							},
+						},
+					},
+					Message: `Apply failed with 2 conflicts: conflicts with "bar":
+- .metadata.labels.app
+conflicts with "foo" using v1 at 2001-02-03T04:05:06Z:
+- .spec.replicas`,
+				},
+			},
+		},
+		{
+			conflict: merge.Conflicts{
+				merge.Conflict{
+					Manager: `{"manager":"foo","operation":"Update","subresource":"scale","apiVersion":"v1","time":"2001-02-03T04:05:06Z"}`,
+					Path:    fieldpath.MakePathOrDie("spec", "replicas"),
+				},
+			},
+			expected: &errors.StatusError{
+				ErrStatus: metav1.Status{
+					Status: metav1.StatusFailure,
+					Code:   http.StatusConflict,
+					Reason: metav1.StatusReasonConflict,
+					Details: &metav1.StatusDetails{
+						Causes: []metav1.StatusCause{
+							{
+								Type:    metav1.CauseTypeFieldManagerConflict,
+								Message: `conflict with "foo" with subresource "scale" using v1 at 2001-02-03T04:05:06Z`,
+								Field:   ".spec.replicas",
+							},
+						},
+					},
+					Message: `Apply failed with 1 conflict: conflict with "foo" with subresource "scale" using v1 at 2001-02-03T04:05:06Z: .spec.replicas`,
+				},
+			},
+		},
+	}
+	for _, tc := range testCases {
+		actual := internal.NewConflictError(tc.conflict)
+		if !reflect.DeepEqual(tc.expected, actual) {
+			t.Errorf("Expected to get\n%+v\nbut got\n%+v", tc.expected.ErrStatus, actual.ErrStatus)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager.go
new file mode 100644
index 0000000000..2e2db65561
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager.go
@@ -0,0 +1,213 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+	"reflect"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/klog/v2"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+)
+
+// DefaultMaxUpdateManagers defines the default maximum retained number of managedFields entries from updates
+// if the number of update managers exceeds this, the oldest entries will be merged until the number is below the maximum.
+// TODO(jennybuckley): Determine if this is really the best value. Ideally we wouldn't unnecessarily merge too many entries.
+const DefaultMaxUpdateManagers int = 10
+
+// DefaultTrackOnCreateProbability defines the default probability that the field management of an object
+// starts being tracked from the object's creation, instead of from the first time the object is applied to.
+const DefaultTrackOnCreateProbability float32 = 1
+
+var atMostEverySecond = NewAtMostEvery(time.Second)
+
+// FieldManager updates the managed fields and merges applied
+// configurations.
+type FieldManager struct {
+	fieldManager Manager
+	subresource  string
+}
+
+// NewFieldManager creates a new FieldManager that decodes, manages, then re-encodes managedFields
+// on update and apply requests.
+func NewFieldManager(f Manager, subresource string) *FieldManager {
+	return &FieldManager{fieldManager: f, subresource: subresource}
+}
+
+// newDefaultFieldManager is a helper function which wraps a Manager with certain default logic.
+func NewDefaultFieldManager(f Manager, typeConverter TypeConverter, objectConverter runtime.ObjectConvertor, objectCreater runtime.ObjectCreater, kind schema.GroupVersionKind, subresource string) *FieldManager {
+	return NewFieldManager(
+		NewVersionCheckManager(
+			NewLastAppliedUpdater(
+				NewLastAppliedManager(
+					NewProbabilisticSkipNonAppliedManager(
+						NewCapManagersManager(
+							NewBuildManagerInfoManager(
+								NewManagedFieldsUpdater(
+									NewStripMetaManager(f),
+								), kind.GroupVersion(), subresource,
+							), DefaultMaxUpdateManagers,
+						), objectCreater, DefaultTrackOnCreateProbability,
+					), typeConverter, objectConverter, kind.GroupVersion(),
+				),
+			), kind,
+		), subresource,
+	)
+}
+
+func decodeLiveOrNew(liveObj, newObj runtime.Object, ignoreManagedFieldsFromRequestObject bool) (Managed, error) {
+	liveAccessor, err := meta.Accessor(liveObj)
+	if err != nil {
+		return nil, err
+	}
+
+	// We take the managedFields of the live object in case the request tries to
+	// manually set managedFields via a subresource.
+	if ignoreManagedFieldsFromRequestObject {
+		return emptyManagedFieldsOnErr(DecodeManagedFields(liveAccessor.GetManagedFields()))
+	}
+
+	// If the object doesn't have metadata, we should just return without trying to
+	// set the managedFields at all, so creates/updates/patches will work normally.
+	newAccessor, err := meta.Accessor(newObj)
+	if err != nil {
+		return nil, err
+	}
+
+	if isResetManagedFields(newAccessor.GetManagedFields()) {
+		return NewEmptyManaged(), nil
+	}
+
+	// If the managed field is empty or we failed to decode it,
+	// let's try the live object. This is to prevent clients who
+	// don't understand managedFields from deleting it accidentally.
+	managed, err := DecodeManagedFields(newAccessor.GetManagedFields())
+	if err != nil || len(managed.Fields()) == 0 {
+		return emptyManagedFieldsOnErr(DecodeManagedFields(liveAccessor.GetManagedFields()))
+	}
+	return managed, nil
+}
+
+func emptyManagedFieldsOnErr(managed Managed, err error) (Managed, error) {
+	if err != nil {
+		return NewEmptyManaged(), nil
+	}
+	return managed, nil
+}
+
+// Update is used when the object has already been merged (non-apply
+// use-case), and simply updates the managed fields in the output
+// object.
+func (f *FieldManager) Update(liveObj, newObj runtime.Object, manager string) (object runtime.Object, err error) {
+	// First try to decode the managed fields provided in the update,
+	// This is necessary to allow directly updating managed fields.
+	isSubresource := f.subresource != ""
+	managed, err := decodeLiveOrNew(liveObj, newObj, isSubresource)
+	if err != nil {
+		return newObj, nil
+	}
+
+	RemoveObjectManagedFields(newObj)
+
+	if object, managed, err = f.fieldManager.Update(liveObj, newObj, managed, manager); err != nil {
+		return nil, err
+	}
+
+	if err = EncodeObjectManagedFields(object, managed); err != nil {
+		return nil, fmt.Errorf("failed to encode managed fields: %v", err)
+	}
+
+	return object, nil
+}
+
+// UpdateNoErrors is the same as Update, but it will not return
+// errors. If an error happens, we preserve the managedFields from
+// liveObj.
+func (f *FieldManager) UpdateNoErrors(liveObj, newObj runtime.Object, manager string) runtime.Object {
+	obj, err := f.Update(liveObj, newObj, manager)
+	if err != nil {
+		// Preserve the managedFields from the live object rather than
+		// stripping them entirely, to avoid silent data loss when the
+		// managedFields update fails (e.g. due to an unavailable
+		// conversion webhook).
+		// Note: meta.Accessor for liveObj and newObj below never return an error in this code branch,
+		// because if they would f.Update above would return "newObj, nil". Accordingly, the case
+		// where one of the accessors returns an error is not handled here.
+		if liveAccessor, aErr := meta.Accessor(liveObj); aErr == nil {
+			if newAccessor, aErr := meta.Accessor(newObj); aErr == nil {
+				atMostEverySecond.Do(func() {
+					//nolint:logcheck // Should not be reached.
+					klog.ErrorS(err, "[SHOULD NOT HAPPEN] failed to update managedFields (restored previous managedFields from live object)", "versionKind",
+						newObj.GetObjectKind().GroupVersionKind(), "namespace", newAccessor.GetNamespace(), "name", newAccessor.GetName())
+				})
+				newAccessor.SetManagedFields(liveAccessor.GetManagedFields())
+			}
+		}
+		return newObj
+	}
+	return obj
+}
+
+// Returns true if the managedFields indicate that the user is trying to
+// reset the managedFields, i.e. if the list is non-nil but empty, or if
+// the list has one empty item.
+func isResetManagedFields(managedFields []metav1.ManagedFieldsEntry) bool {
+	if len(managedFields) == 0 {
+		return managedFields != nil
+	}
+
+	if len(managedFields) == 1 {
+		return reflect.DeepEqual(managedFields[0], metav1.ManagedFieldsEntry{})
+	}
+
+	return false
+}
+
+// Apply is used when server-side apply is called, as it merges the
+// object and updates the managed fields.
+func (f *FieldManager) Apply(liveObj, appliedObj runtime.Object, manager string, force bool) (object runtime.Object, err error) {
+	// If the object doesn't have metadata, apply isn't allowed.
+	accessor, err := meta.Accessor(liveObj)
+	if err != nil {
+		return nil, fmt.Errorf("couldn't get accessor: %v", err)
+	}
+
+	// Decode the managed fields in the live object, since it isn't allowed in the patch.
+	managed, err := DecodeManagedFields(accessor.GetManagedFields())
+	if err != nil {
+		return nil, fmt.Errorf("failed to decode managed fields: %v", err)
+	}
+
+	object, managed, err = f.fieldManager.Apply(liveObj, appliedObj, managed, manager, force)
+	if err != nil {
+		if conflicts, ok := err.(merge.Conflicts); ok {
+			return nil, NewConflictError(conflicts)
+		}
+		return nil, err
+	}
+
+	if err = EncodeObjectManagedFields(object, managed); err != nil {
+		return nil, fmt.Errorf("failed to encode managed fields: %v", err)
+	}
+
+	return object, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager_test.go
new file mode 100644
index 0000000000..67ec621532
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager_test.go
@@ -0,0 +1,105 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	internaltesting "k8s.io/apimachinery/pkg/util/managedfields/internal/testing"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+)
+
+func TestFieldManagerUpdateNoErrors(t *testing.T) {
+	fm := &fakeManager{}
+	f := internaltesting.NewTestFieldManagerImpl(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"),
+		"",
+		func(m internal.Manager) internal.Manager {
+			fm.Manager = m
+			return fm
+		})
+
+	podWithLabels := func(labels ...string) runtime.Object {
+		labelMap := map[string]interface{}{}
+		for _, key := range labels {
+			labelMap[key] = "true"
+		}
+		obj := &unstructured.Unstructured{
+			Object: map[string]interface{}{
+				"metadata": map[string]interface{}{
+					"labels": labelMap,
+				},
+			},
+		}
+		obj.SetKind("Pod")
+		obj.SetAPIVersion("v1")
+		return obj
+	}
+
+	f.UpdateNoErrors(podWithLabels("one"), "fieldmanager_test_update_1")
+	if len(f.ManagedFields()) == 0 {
+		t.Fatalf("expected managedFields to be set, but they are empty")
+	}
+
+	before := []metav1.ManagedFieldsEntry{}
+	for _, m := range f.ManagedFields() {
+		before = append(before, *m.DeepCopy())
+	}
+
+	// Inject an error so UpdateNoErrors will hit the error code path.
+	fm.Error = errors.New("test error")
+	f.UpdateNoErrors(podWithLabels("one", "two"), "fieldmanager_test_update_1")
+
+	if after := f.ManagedFields(); !apiequality.Semantic.DeepEqual(before, after) {
+		t.Fatalf("expected idempotence, but managedFields changed:\nbefore: %v\n after: %v", mustMarshal(before), mustMarshal(after))
+	}
+}
+
+var fakeTypeConverter = func() internal.TypeConverter {
+	data, err := os.ReadFile(filepath.Join(
+		strings.Repeat(".."+string(filepath.Separator), 8),
+		"api", "openapi-spec", "swagger.json"))
+	if err != nil {
+		panic(err)
+	}
+	convertedDefs := map[string]*spec.Schema{}
+	spec := spec.Swagger{}
+	if err := json.Unmarshal(data, &spec); err != nil {
+		panic(err)
+	}
+
+	for k, v := range spec.Definitions {
+		vCopy := v
+		convertedDefs[k] = &vCopy
+	}
+
+	typeConverter, err := internal.NewTypeConverter(convertedDefs, false)
+	if err != nil {
+		panic(err)
+	}
+	return typeConverter
+}()
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fields.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fields.go
new file mode 100644
index 0000000000..549412b41d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fields.go
@@ -0,0 +1,46 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+// EmptyFields represents a set with no paths
+// It looks like metav1.Fields{Raw: []byte("{}")}
+var EmptyFields = func() metav1.FieldsV1 {
+	f, err := SetToFields(*fieldpath.NewSet())
+	if err != nil {
+		panic("should never happen")
+	}
+	return f
+}()
+
+// FieldsToSet creates a set paths from an input trie of fields
+func FieldsToSet(f metav1.FieldsV1) (s fieldpath.Set, err error) {
+	err = s.FromJSON(f.GetRawReader())
+	return s, err
+}
+
+// SetToFields creates a trie of fields from an input set of paths
+func SetToFields(s fieldpath.Set) (f metav1.FieldsV1, err error) {
+	raw, err := s.ToJSON()
+	f.SetRawBytes(raw)
+	return f, err
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fields_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fields_test.go
new file mode 100644
index 0000000000..e397d2c681
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/fields_test.go
@@ -0,0 +1,143 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+// TestFieldsRoundTrip tests that a fields trie can be round tripped as a path set
+func TestFieldsRoundTrip(t *testing.T) {
+	tests := []metav1.FieldsV1{
+		*metav1.NewFieldsV1(`{"f:metadata":{".":{},"f:name":{}}}`),
+		EmptyFields,
+	}
+
+	for _, test := range tests {
+		set, err := FieldsToSet(test)
+		if err != nil {
+			t.Fatalf("Failed to create path set: %v", err)
+		}
+		output, err := SetToFields(set)
+		if err != nil {
+			t.Fatalf("Failed to create fields trie from path set: %v", err)
+		}
+		if !reflect.DeepEqual(test, output) {
+			t.Fatalf("Expected round-trip:\ninput: %v\noutput: %v", test, output)
+		}
+	}
+}
+
+// TestFieldsToSetError tests that errors are picked up by FieldsToSet
+func TestFieldsToSetError(t *testing.T) {
+	tests := []struct {
+		fields    metav1.FieldsV1
+		errString string
+	}{
+		{
+			fields: *metav1.NewFieldsV1(
+				`{"k:{invalid json}":{"f:name":{},".":{}}}`,
+			),
+			errString: "ReadObjectCB",
+		},
+	}
+
+	for _, test := range tests {
+		_, err := FieldsToSet(test.fields)
+		if err == nil || !strings.Contains(err.Error(), test.errString) {
+			t.Fatalf("Expected error to contain %q but got: %v", test.errString, err)
+		}
+	}
+}
+
+// TestSetToFieldsError tests that errors are picked up by SetToFields
+func TestSetToFieldsError(t *testing.T) {
+	validName := "ok"
+	invalidPath := fieldpath.Path([]fieldpath.PathElement{{}, {FieldName: &validName}})
+
+	tests := []struct {
+		set       fieldpath.Set
+		errString string
+	}{
+		{
+			set:       *fieldpath.NewSet(invalidPath),
+			errString: "invalid PathElement",
+		},
+	}
+
+	for _, test := range tests {
+		_, err := SetToFields(test.set)
+		if err == nil || !strings.Contains(err.Error(), test.errString) {
+			t.Fatalf("Expected error to contain %q but got: %v", test.errString, err)
+		}
+	}
+}
+
+func BenchmarkSetToFields(b *testing.B) {
+	set := fieldpath.NewSet(
+		fieldpath.MakePathOrDie("foo", 0, "bar", "baz"),
+		fieldpath.MakePathOrDie("foo", 0, "bar", "zot"),
+		fieldpath.MakePathOrDie("foo", 0, "bar"),
+		fieldpath.MakePathOrDie("foo", 0),
+		fieldpath.MakePathOrDie("foo", 1, "bar", "baz"),
+		fieldpath.MakePathOrDie("foo", 1, "bar"),
+		fieldpath.MakePathOrDie("qux", fieldpath.KeyByFields("name", "first")),
+		fieldpath.MakePathOrDie("qux", fieldpath.KeyByFields("name", "first"), "bar"),
+		fieldpath.MakePathOrDie("qux", fieldpath.KeyByFields("name", "second"), "bar"),
+	)
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for n := 0; n < b.N; n++ {
+		_, err := SetToFields(*set)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func BenchmarkFieldsToSet(b *testing.B) {
+	set := fieldpath.NewSet(
+		fieldpath.MakePathOrDie("foo", 0, "bar", "baz"),
+		fieldpath.MakePathOrDie("foo", 0, "bar", "zot"),
+		fieldpath.MakePathOrDie("foo", 0, "bar"),
+		fieldpath.MakePathOrDie("foo", 0),
+		fieldpath.MakePathOrDie("foo", 1, "bar", "baz"),
+		fieldpath.MakePathOrDie("foo", 1, "bar"),
+		fieldpath.MakePathOrDie("qux", fieldpath.KeyByFields("name", "first")),
+		fieldpath.MakePathOrDie("qux", fieldpath.KeyByFields("name", "first"), "bar"),
+		fieldpath.MakePathOrDie("qux", fieldpath.KeyByFields("name", "second"), "bar"),
+	)
+	fields, err := SetToFields(*set)
+	if err != nil {
+		b.Fatal(err)
+	}
+	b.ReportAllocs()
+	b.ResetTimer()
+	for n := 0; n < b.N; n++ {
+		_, err := FieldsToSet(fields)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastapplied.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastapplied.go
new file mode 100644
index 0000000000..b00b6b8298
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastapplied.go
@@ -0,0 +1,50 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	apimachineryvalidation "k8s.io/apimachinery/pkg/api/validation"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// LastAppliedConfigAnnotation is the annotation used to store the previous
+// configuration of a resource for use in a three way diff by UpdateApplyAnnotation.
+//
+// This is a copy of the corev1 annotation since we don't want to depend on the whole package.
+const LastAppliedConfigAnnotation = "kubectl.kubernetes.io/last-applied-configuration"
+
+// SetLastApplied sets the last-applied annotation the given value in
+// the object.
+func SetLastApplied(obj runtime.Object, value string) error {
+	accessor, err := meta.Accessor(obj)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't get accessor: %v", err))
+	}
+	var annotations = accessor.GetAnnotations()
+	if annotations == nil {
+		annotations = map[string]string{}
+	}
+	annotations[LastAppliedConfigAnnotation] = value
+	if err := apimachineryvalidation.ValidateAnnotationsSize(annotations); err != nil {
+		delete(annotations, LastAppliedConfigAnnotation)
+	}
+	accessor.SetAnnotations(annotations)
+	return nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedmanager.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedmanager.go
new file mode 100644
index 0000000000..d58a1108dc
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedmanager.go
@@ -0,0 +1,171 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+)
+
+type lastAppliedManager struct {
+	fieldManager    Manager
+	typeConverter   TypeConverter
+	objectConverter runtime.ObjectConvertor
+	groupVersion    schema.GroupVersion
+}
+
+var _ Manager = &lastAppliedManager{}
+
+// NewLastAppliedManager converts the client-side apply annotation to
+// server-side apply managed fields
+func NewLastAppliedManager(fieldManager Manager, typeConverter TypeConverter, objectConverter runtime.ObjectConvertor, groupVersion schema.GroupVersion) Manager {
+	return &lastAppliedManager{
+		fieldManager:    fieldManager,
+		typeConverter:   typeConverter,
+		objectConverter: objectConverter,
+		groupVersion:    groupVersion,
+	}
+}
+
+// Update implements Manager.
+func (f *lastAppliedManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	return f.fieldManager.Update(liveObj, newObj, managed, manager)
+}
+
+// Apply will consider the last-applied annotation
+// for upgrading an object managed by client-side apply to server-side apply
+// without conflicts.
+func (f *lastAppliedManager) Apply(liveObj, newObj runtime.Object, managed Managed, manager string, force bool) (runtime.Object, Managed, error) {
+	newLiveObj, newManaged, newErr := f.fieldManager.Apply(liveObj, newObj, managed, manager, force)
+	// Upgrade the client-side apply annotation only from kubectl server-side-apply.
+	// To opt-out of this behavior, users may specify a different field manager.
+	if manager != "kubectl" {
+		return newLiveObj, newManaged, newErr
+	}
+
+	// Check if we have conflicts
+	if newErr == nil {
+		return newLiveObj, newManaged, newErr
+	}
+	conflicts, ok := newErr.(merge.Conflicts)
+	if !ok {
+		return newLiveObj, newManaged, newErr
+	}
+	conflictSet := conflictsToSet(conflicts)
+
+	// Check if conflicts are allowed due to client-side apply,
+	// and if so, then force apply
+	allowedConflictSet, err := f.allowedConflictsFromLastApplied(liveObj)
+	if err != nil {
+		return newLiveObj, newManaged, newErr
+	}
+	if !conflictSet.Difference(allowedConflictSet).Empty() {
+		newConflicts := conflictsDifference(conflicts, allowedConflictSet)
+		return newLiveObj, newManaged, newConflicts
+	}
+
+	return f.fieldManager.Apply(liveObj, newObj, managed, manager, true)
+}
+
+func (f *lastAppliedManager) allowedConflictsFromLastApplied(liveObj runtime.Object) (*fieldpath.Set, error) {
+	var accessor, err = meta.Accessor(liveObj)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't get accessor: %v", err))
+	}
+
+	// If there is no client-side apply annotation, then there is nothing to do
+	var annotations = accessor.GetAnnotations()
+	if annotations == nil {
+		return nil, fmt.Errorf("no last applied annotation")
+	}
+	var lastApplied, ok = annotations[LastAppliedConfigAnnotation]
+	if !ok || lastApplied == "" {
+		return nil, fmt.Errorf("no last applied annotation")
+	}
+
+	liveObjVersioned, err := f.objectConverter.ConvertToVersion(liveObj, f.groupVersion)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert live obj to versioned: %v", err)
+	}
+
+	liveObjTyped, err := f.typeConverter.ObjectToTyped(liveObjVersioned)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert live obj to typed: %v", err)
+	}
+
+	var lastAppliedObj = &unstructured.Unstructured{Object: map[string]interface{}{}}
+	err = json.Unmarshal([]byte(lastApplied), lastAppliedObj)
+	if err != nil {
+		return nil, fmt.Errorf("failed to decode last applied obj: %v in '%s'", err, lastApplied)
+	}
+
+	if lastAppliedObj.GetAPIVersion() != f.groupVersion.String() {
+		return nil, fmt.Errorf("expected version of last applied to match live object '%s', but got '%s': %v", f.groupVersion.String(), lastAppliedObj.GetAPIVersion(), err)
+	}
+
+	lastAppliedObjTyped, err := f.typeConverter.ObjectToTyped(lastAppliedObj)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert last applied to typed: %v", err)
+	}
+
+	lastAppliedObjFieldSet, err := lastAppliedObjTyped.ToFieldSet()
+	if err != nil {
+		return nil, fmt.Errorf("failed to create fieldset for last applied object: %v", err)
+	}
+
+	comparison, err := lastAppliedObjTyped.Compare(liveObjTyped)
+	if err != nil {
+		return nil, fmt.Errorf("failed to compare last applied object and live object: %v", err)
+	}
+
+	// Remove fields in last applied that are different, added, or missing in
+	// the live object.
+	// Because last-applied fields don't match the live object fields,
+	// then we don't own these fields.
+	lastAppliedObjFieldSet = lastAppliedObjFieldSet.
+		Difference(comparison.Modified).
+		Difference(comparison.Added).
+		Difference(comparison.Removed)
+
+	return lastAppliedObjFieldSet, nil
+}
+
+// TODO: replace with merge.Conflicts.ToSet()
+func conflictsToSet(conflicts merge.Conflicts) *fieldpath.Set {
+	conflictSet := fieldpath.NewSet()
+	for _, conflict := range []merge.Conflict(conflicts) {
+		conflictSet.Insert(conflict.Path)
+	}
+	return conflictSet
+}
+
+func conflictsDifference(conflicts merge.Conflicts, s *fieldpath.Set) merge.Conflicts {
+	newConflicts := []merge.Conflict{}
+	for _, conflict := range []merge.Conflict(conflicts) {
+		if !s.Has(conflict.Path) {
+			newConflicts = append(newConflicts, conflict)
+		}
+	}
+	return newConflicts
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedmanager_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedmanager_test.go
new file mode 100644
index 0000000000..7824409569
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedmanager_test.go
@@ -0,0 +1,1007 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	apiequality "k8s.io/apimachinery/pkg/api/equality"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	"k8s.io/apimachinery/pkg/util/managedfields/managedfieldstest"
+	yamlutil "k8s.io/apimachinery/pkg/util/yaml"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+	"sigs.k8s.io/yaml"
+)
+
+type testArgs struct {
+	lastApplied       []byte
+	original          []byte
+	applied           []byte
+	fieldManager      string
+	expectConflictSet *fieldpath.Set
+}
+
+// TestApplyUsingLastAppliedAnnotation tests that applying to an object
+// created with the client-side apply last-applied annotation
+// will not give conflicts
+func TestApplyUsingLastAppliedAnnotation(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"))
+
+	tests := []testArgs{
+		{
+			fieldManager: "kubectl",
+			lastApplied: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-v1
+      - name: my-c2
+        image: my-image2
+`),
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app # missing from last-applied
+spec:
+  replicas: 100 # does not match last-applied
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-v2 # does no match last-applied
+      # note that second container in last-applied is missing
+`),
+			applied: []byte(`
+# test conflicts due to fields not allowed by last-applied
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-new-label # NOT allowed: update label
+spec:
+  replicas: 333 # NOT allowed: update replicas
+  selector:
+    matchLabels:
+      app: my-new-label # allowed: update label
+  template:
+    metadata:
+      labels:
+        app: my-new-label # allowed: update-label
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-new # NOT allowed: update image
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("metadata", "labels", "app"),
+				fieldpath.MakePathOrDie("spec", "replicas"),
+				fieldpath.MakePathOrDie("spec", "template", "spec", "containers", fieldpath.KeyByFields("name", "my-c"), "image"),
+			),
+		},
+		{
+			fieldManager: "kubectl",
+			lastApplied: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100 # does not match last applied
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+			applied: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-new-label
+spec:
+  replicas: 3 # expect conflict
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "replicas"),
+			),
+		},
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+			applied: []byte(`
+# applied object matches original
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+		},
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+			applied: []byte(`
+# test allowed update with no conflicts
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-new-label # update label
+spec:
+  replicas: 333 # update replicas
+  selector:
+    matchLabels:
+      app: my-new-label # update label
+  template:
+    metadata:
+      labels:
+        app: my-new-label # update-label
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+		},
+		{
+			fieldManager: "not_kubectl",
+			lastApplied: []byte(`
+# expect conflicts because field manager is NOT kubectl
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-v1
+`),
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100 # does not match last-applied
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-v2 # does no match last-applied
+`),
+			applied: []byte(`
+# test conflicts due to fields not allowed by last-applied
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-new-label # update label
+spec:
+  replicas: 333 # update replicas
+  selector:
+    matchLabels:
+      app: my-new-label # update label
+  template:
+    metadata:
+      labels:
+        app: my-new-label # update-label
+    spec:
+      containers:
+      - name: my-c
+        image: my-image-new # update image
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("metadata", "labels", "app"),
+				fieldpath.MakePathOrDie("spec", "replicas"),
+				fieldpath.MakePathOrDie("spec", "selector"), // selector is atomic
+				fieldpath.MakePathOrDie("spec", "template", "metadata", "labels", "app"),
+				fieldpath.MakePathOrDie("spec", "template", "spec", "containers", fieldpath.KeyByFields("name", "my-c"), "image"),
+			),
+		},
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+			applied: []byte(`
+# test allowed update with no conflicts
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-new-label
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-new-image # update image
+`),
+		},
+		{
+			fieldManager: "not_kubectl",
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-app
+spec:
+  replicas: 100
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`),
+			applied: []byte(`
+
+# expect changes to fail because field manager is not kubectl
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  labels:
+    app: my-new-label # update label
+spec:
+  replicas: 3 # update replicas
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-new-image # update image
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("metadata", "labels", "app"),
+				fieldpath.MakePathOrDie("spec", "replicas"),
+				fieldpath.MakePathOrDie("spec", "template", "spec", "containers", fieldpath.KeyByFields("name", "my-c"), "image"),
+			),
+		},
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 3
+`),
+			applied: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 100 # update replicas
+`),
+		},
+		{
+			fieldManager: "kubectl",
+			lastApplied: []byte(`
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 3
+`),
+			original: []byte(`
+apiVersion: apps/v1 # expect conflict due to apiVersion mismatch with last-applied
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 3
+`),
+			applied: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 100 # update replicas
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "replicas"),
+			),
+		},
+		{
+			fieldManager: "kubectl",
+			lastApplied: []byte(`
+apiVerison: foo
+kind: bar
+spec: expect conflict due to invalid object
+`),
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 3
+`),
+			applied: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 100 # update replicas
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "replicas"),
+			),
+		},
+		{
+			fieldManager: "kubectl",
+			// last-applied is empty
+			lastApplied: []byte{},
+			original: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 3
+`),
+			applied: []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 100 # update replicas
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "replicas"),
+			),
+		},
+	}
+
+	testConflicts(t, f, tests)
+}
+
+func TestServiceApply(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Service"))
+
+	tests := []testArgs{
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: Service
+metadata:
+  name: test
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 8443
+  selector:
+    old: test
+`),
+			applied: []byte(`
+# All accepted while using the same field manager
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: test
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 8444
+  selector:
+    new: test
+`),
+		},
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: Service
+metadata:
+  name: test
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 8443
+  selector:
+    old: test
+`),
+			applied: []byte(`
+# Allowed to remove selectors while using the same field manager
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: test
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 8444
+  selector: {}
+`),
+		},
+		{
+			fieldManager: "not_kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: Service
+metadata:
+  name: test
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP # TODO: issue - this is a defaulted field, should not be required in a new spec
+    targetPort: 8443
+  selector:
+    old: test
+`),
+			applied: []byte(`
+# test selector update not allowed by last-applied
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: test
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 8444
+  selector:
+    new: test
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "selector"), // selector is atomic
+				fieldpath.MakePathOrDie("spec", "ports", fieldpath.KeyByFields("port", 443, "protocol", "TCP"), "targetPort"),
+			),
+		},
+	}
+
+	testConflicts(t, f, tests)
+}
+
+func TestReplicationControllerApply(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ReplicationController"))
+
+	tests := []testArgs{
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: ReplicationController
+metadata:
+  name: test
+spec:
+  replicas: 0
+  selector:
+    old: test
+`),
+			applied: []byte(`
+# All accepted while using the same field manager
+
+apiVersion: v1
+kind: ReplicationController
+metadata:
+  name: test
+spec:
+  replicas: 3
+  selector:
+    new: test
+`),
+		},
+		{
+			fieldManager: "not_kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: ReplicationController
+metadata:
+  name: test
+spec:
+  replicas: 0
+  selector:
+    old: test
+`),
+			applied: []byte(`
+# test selector update not allowed by last-applied
+
+apiVersion: v1
+kind: ReplicationController
+metadata:
+  name: test
+spec:
+  replicas: 3
+  selector:
+    new: test
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "selector"), // selector is atomic
+				fieldpath.MakePathOrDie("spec", "replicas"),
+			),
+		},
+	}
+
+	testConflicts(t, f, tests)
+}
+
+func TestPodApply(t *testing.T) {
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"))
+
+	tests := []testArgs{
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeName: definetlyControlPlane
+  nodeSelector:
+    node-role.kubernetes.io/master: ""
+`),
+			applied: []byte(`
+# All accepted while using the same field manager
+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeSelector:
+    node-role.kubernetes.io/worker: ""
+`),
+		},
+		{
+			fieldManager: "not_kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeName: definetlyControlPlane
+  nodeSelector:
+    node-role.kubernetes.io/master: ""
+`),
+			applied: []byte(`
+# test selector update not allowed by last-applied
+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeName: definetlyControlPlane
+  nodeSelector:
+    node-role.kubernetes.io/master: ""
+    otherNodeType: ""
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "nodeSelector"), // selector is atomic
+			),
+		},
+		{
+			fieldManager: "not_kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeName: definetlyControlPlane
+  nodeSelector:
+    node-role.kubernetes.io/master: ""
+`),
+			applied: []byte(`
+# purging selector not allowed for different manager
+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeName: another
+  nodeSelector: {}
+`),
+			expectConflictSet: fieldpath.NewSet(
+				fieldpath.MakePathOrDie("spec", "nodeSelector"), // selector is atomic
+				fieldpath.MakePathOrDie("spec", "nodeName"),
+			),
+		},
+		{
+			fieldManager: "kubectl",
+			original: []byte(`
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeName: definetlyControlPlane
+  nodeSelector:
+    node-role.kubernetes.io/master: ""
+`),
+			applied: []byte(`
+# same manager could purge nodeSelector
+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test
+  namespace: test
+spec:
+  containers:
+  - args:
+    - -v=2
+    command:
+    - controller
+    image: some.registry/app:latest
+    name: doJob
+  nodeName: another
+  nodeSelector: {}
+`),
+		},
+	}
+
+	testConflicts(t, f, tests)
+}
+
+func testConflicts(t *testing.T, f managedfieldstest.TestFieldManager, tests []testArgs) {
+	for i, test := range tests {
+		t.Run(fmt.Sprintf("test %d", i), func(t *testing.T) {
+			f.Reset()
+
+			originalObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+			if err := yaml.Unmarshal(test.original, &originalObj.Object); err != nil {
+				t.Errorf("error decoding YAML: %v", err)
+			}
+
+			if test.lastApplied == nil {
+				test.lastApplied = test.original
+			}
+			if err := setLastAppliedFromEncoded(originalObj, test.lastApplied); err != nil {
+				t.Errorf("failed to set last applied: %v", err)
+			}
+
+			if err := f.Update(originalObj, "test_client_side_apply"); err != nil {
+				t.Errorf("failed to apply object: %v", err)
+			}
+
+			appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+			if err := yaml.Unmarshal(test.applied, &appliedObj.Object); err != nil {
+				t.Errorf("error decoding YAML: %v", err)
+			}
+
+			err := f.Apply(appliedObj, test.fieldManager, false)
+
+			if test.expectConflictSet == nil {
+				if err != nil {
+					t.Errorf("expected no error but got %v", err)
+				}
+			} else {
+				if err == nil || !apierrors.IsConflict(err) {
+					t.Errorf("expected to get conflicts but got %v", err)
+				}
+
+				expectedConflicts := merge.Conflicts{}
+				test.expectConflictSet.Iterate(func(p fieldpath.Path) {
+					expectedConflicts = append(expectedConflicts, merge.Conflict{
+						Manager: fmt.Sprintf(`{"manager":"test_client_side_apply","operation":"Update","apiVersion":"%s"}`, f.APIVersion()),
+						Path:    p,
+					})
+				})
+				expectedConflictErr := internal.NewConflictError(expectedConflicts)
+				if !reflect.DeepEqual(expectedConflictErr, err) {
+					t.Errorf("expected to get\n%+v\nbut got\n%+v", expectedConflictErr, err)
+				}
+
+				// Yet force should resolve all conflicts
+				err = f.Apply(appliedObj, test.fieldManager, true)
+				if err != nil {
+					t.Errorf("unexpected error during force ownership apply: %v", err)
+				}
+
+			}
+
+			// Eventually resource should contain applied changes
+			if !apiequality.Semantic.DeepDerivative(appliedObj, f.Live()) {
+				t.Errorf("expected equal resource: \n%#v, got: \n%#v", appliedObj, f.Live())
+			}
+		})
+	}
+}
+
+func yamlToJSON(y []byte) (string, error) {
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal(y, &obj.Object); err != nil {
+		return "", fmt.Errorf("error decoding YAML: %v", err)
+	}
+	serialization, err := runtime.Encode(unstructured.UnstructuredJSONScheme, obj)
+	if err != nil {
+		return "", fmt.Errorf("error encoding object: %v", err)
+	}
+	json, err := yamlutil.ToJSON(serialization)
+	if err != nil {
+		return "", fmt.Errorf("error converting to json: %v", err)
+	}
+	return string(json), nil
+}
+
+func setLastAppliedFromEncoded(obj runtime.Object, lastApplied []byte) error {
+	lastAppliedJSON, err := yamlToJSON(lastApplied)
+	if err != nil {
+		return err
+	}
+	return internal.SetLastApplied(obj, lastAppliedJSON)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedupdater.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedupdater.go
new file mode 100644
index 0000000000..06e6c5d8ce
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedupdater.go
@@ -0,0 +1,102 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+type lastAppliedUpdater struct {
+	fieldManager Manager
+}
+
+var _ Manager = &lastAppliedUpdater{}
+
+// NewLastAppliedUpdater sets the client-side apply annotation up to date with
+// server-side apply managed fields
+func NewLastAppliedUpdater(fieldManager Manager) Manager {
+	return &lastAppliedUpdater{
+		fieldManager: fieldManager,
+	}
+}
+
+// Update implements Manager.
+func (f *lastAppliedUpdater) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	return f.fieldManager.Update(liveObj, newObj, managed, manager)
+}
+
+// server-side apply managed fields
+func (f *lastAppliedUpdater) Apply(liveObj, newObj runtime.Object, managed Managed, manager string, force bool) (runtime.Object, Managed, error) {
+	liveObj, managed, err := f.fieldManager.Apply(liveObj, newObj, managed, manager, force)
+	if err != nil {
+		return liveObj, managed, err
+	}
+
+	// Sync the client-side apply annotation only from kubectl server-side apply.
+	// To opt-out of this behavior, users may specify a different field manager.
+	//
+	// If the client-side apply annotation doesn't exist,
+	// then continue because we have no annotation to update
+	if manager == "kubectl" && hasLastApplied(liveObj) {
+		lastAppliedValue, err := buildLastApplied(newObj)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to build last-applied annotation: %v", err)
+		}
+		err = SetLastApplied(liveObj, lastAppliedValue)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to set last-applied annotation: %v", err)
+		}
+	}
+	return liveObj, managed, err
+}
+
+func hasLastApplied(obj runtime.Object) bool {
+	var accessor, err = meta.Accessor(obj)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't get accessor: %v", err))
+	}
+	var annotations = accessor.GetAnnotations()
+	if annotations == nil {
+		return false
+	}
+	lastApplied, ok := annotations[LastAppliedConfigAnnotation]
+	return ok && len(lastApplied) > 0
+}
+
+func buildLastApplied(obj runtime.Object) (string, error) {
+	obj = obj.DeepCopyObject()
+
+	var accessor, err = meta.Accessor(obj)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't get accessor: %v", err))
+	}
+
+	// Remove the annotation from the object before encoding the object
+	var annotations = accessor.GetAnnotations()
+	delete(annotations, LastAppliedConfigAnnotation)
+	accessor.SetAnnotations(annotations)
+
+	lastApplied, err := runtime.Encode(unstructured.UnstructuredJSONScheme, obj)
+	if err != nil {
+		return "", fmt.Errorf("couldn't encode object into last applied annotation: %v", err)
+	}
+	return string(lastApplied), nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedupdater_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedupdater_test.go
new file mode 100644
index 0000000000..ede066ea24
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/lastappliedupdater_test.go
@@ -0,0 +1,268 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	internaltesting "k8s.io/apimachinery/pkg/util/managedfields/internal/testing"
+	"sigs.k8s.io/yaml"
+)
+
+func TestLastAppliedUpdater(t *testing.T) {
+	f := internaltesting.NewTestFieldManagerImpl(fakeTypeConverter, schema.FromAPIVersionAndKind("apps/v1", "Deployment"),
+		"",
+		func(m internal.Manager) internal.Manager {
+			return internal.NewLastAppliedUpdater(m)
+		})
+
+	originalLastApplied := `nonempty`
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	appliedDeployment := []byte(`
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+  annotations:
+    "kubectl.kubernetes.io/last-applied-configuration": "` + originalLastApplied + `"
+  labels:
+    app: my-app
+spec:
+  replicas: 20
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-c
+        image: my-image
+`)
+	if err := yaml.Unmarshal(appliedDeployment, &appliedObj.Object); err != nil {
+		t.Errorf("error decoding YAML: %v", err)
+	}
+
+	if err := f.Apply(appliedObj, "NOT-KUBECTL", false); err != nil {
+		t.Errorf("error applying object: %v", err)
+	}
+
+	lastApplied, err := getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+
+	if lastApplied != originalLastApplied {
+		t.Errorf("expected last applied annotation to be %q and NOT be updated, but got: %q", originalLastApplied, lastApplied)
+	}
+
+	if err := f.Apply(appliedObj, "kubectl", false); err != nil {
+		t.Errorf("error applying object: %v", err)
+	}
+
+	lastApplied, err = getLastApplied(f.Live())
+	if err != nil {
+		t.Errorf("failed to get last applied: %v", err)
+	}
+
+	if lastApplied == originalLastApplied ||
+		!strings.Contains(lastApplied, "my-app") ||
+		!strings.Contains(lastApplied, "my-image") {
+		t.Errorf("expected last applied annotation to be updated, but got: %q", lastApplied)
+	}
+}
+
+func TestLargeLastApplied(t *testing.T) {
+	tests := []struct {
+		name      string
+		oldObject *unstructured.Unstructured
+		newObject *unstructured.Unstructured
+	}{
+		{
+			name: "old object + new object last-applied annotation is too big",
+			oldObject: func() *unstructured.Unstructured {
+				u := &unstructured.Unstructured{}
+				err := json.Unmarshal([]byte(`
+{
+   "metadata": {
+      "name": "large-update-test-cm",
+      "namespace": "default",
+      "annotations": {
+         "kubectl.kubernetes.io/last-applied-configuration": "nonempty"
+      }
+   },
+   "apiVersion": "v1",
+   "kind": "ConfigMap",
+   "data": {
+      "k": "v"
+   }
+}`), &u)
+				if err != nil {
+					panic(err)
+				}
+				return u
+			}(),
+			newObject: func() *unstructured.Unstructured {
+				u := &unstructured.Unstructured{}
+				err := json.Unmarshal([]byte(`
+{
+   "metadata": {
+      "name": "large-update-test-cm",
+      "namespace": "default",
+      "annotations": {
+         "kubectl.kubernetes.io/last-applied-configuration": "nonempty"
+      }
+   },
+   "apiVersion": "v1",
+   "kind": "ConfigMap",
+   "data": {
+      "k": "v"
+   }
+}`), &u)
+				if err != nil {
+					panic(err)
+				}
+				for i := 0; i < 9999; i++ {
+					unique := fmt.Sprintf("this-key-is-very-long-so-as-to-create-a-very-large-serialized-fieldset-%v", i)
+					unstructured.SetNestedField(u.Object, "A", "data", unique)
+				}
+				return u
+			}(),
+		},
+		{
+			name: "old object + new object annotations + new object last-applied annotation is too big",
+			oldObject: func() *unstructured.Unstructured {
+				u := &unstructured.Unstructured{}
+				err := json.Unmarshal([]byte(`
+{
+   "metadata": {
+      "name": "large-update-test-cm",
+      "namespace": "default",
+      "annotations": {
+         "kubectl.kubernetes.io/last-applied-configuration": "nonempty"
+      }
+   },
+   "apiVersion": "v1",
+   "kind": "ConfigMap",
+   "data": {
+      "k": "v"
+   }
+}`), &u)
+				if err != nil {
+					panic(err)
+				}
+				for i := 0; i < 2000; i++ {
+					unique := fmt.Sprintf("this-key-is-very-long-so-as-to-create-a-very-large-serialized-fieldset-%v", i)
+					unstructured.SetNestedField(u.Object, "A", "data", unique)
+				}
+				return u
+			}(),
+			newObject: func() *unstructured.Unstructured {
+				u := &unstructured.Unstructured{}
+				err := json.Unmarshal([]byte(`
+{
+   "metadata": {
+      "name": "large-update-test-cm",
+      "namespace": "default",
+      "annotations": {
+         "kubectl.kubernetes.io/last-applied-configuration": "nonempty"
+      }
+   },
+   "apiVersion": "v1",
+   "kind": "ConfigMap",
+   "data": {
+      "k": "v"
+   }
+}`), &u)
+				if err != nil {
+					panic(err)
+				}
+				for i := 0; i < 2000; i++ {
+					unique := fmt.Sprintf("this-key-is-very-long-so-as-to-create-a-very-large-serialized-fieldset-%v", i)
+					unstructured.SetNestedField(u.Object, "A", "data", unique)
+					unstructured.SetNestedField(u.Object, "A", "metadata", "annotations", unique)
+				}
+				return u
+			}(),
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			f := internaltesting.NewTestFieldManagerImpl(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"),
+				"",
+				func(m internal.Manager) internal.Manager {
+					return internal.NewLastAppliedUpdater(m)
+				})
+
+			if err := f.Apply(test.oldObject, "kubectl", false); err != nil {
+				t.Errorf("Error applying object: %v", err)
+			}
+
+			lastApplied, err := getLastApplied(f.Live())
+			if err != nil {
+				t.Errorf("Failed to access last applied annotation: %v", err)
+			}
+			if len(lastApplied) == 0 || lastApplied == "nonempty" {
+				t.Errorf("Expected an updated last-applied annotation, but got: %q", lastApplied)
+			}
+
+			if err := f.Apply(test.newObject, "kubectl", false); err != nil {
+				t.Errorf("Error applying object: %v", err)
+			}
+
+			accessor := meta.NewAccessor()
+			annotations, err := accessor.Annotations(f.Live())
+			if err != nil {
+				t.Errorf("Failed to access annotations: %v", err)
+			}
+			if annotations == nil {
+				t.Errorf("No annotations on obj: %v", f.Live())
+			}
+			lastApplied, ok := annotations[internal.LastAppliedConfigAnnotation]
+			if ok || len(lastApplied) > 0 {
+				t.Errorf("Expected no last applied annotation, but got last applied with length: %d", len(lastApplied))
+			}
+		})
+	}
+}
+
+func getLastApplied(obj runtime.Object) (string, error) {
+	accessor := meta.NewAccessor()
+	annotations, err := accessor.Annotations(obj)
+	if err != nil {
+		return "", fmt.Errorf("failed to access annotations: %v", err)
+	}
+	if annotations == nil {
+		return "", fmt.Errorf("no annotations on obj: %v", obj)
+	}
+
+	lastApplied, ok := annotations[internal.LastAppliedConfigAnnotation]
+	if !ok {
+		return "", fmt.Errorf("expected last applied annotation, but got none for object: %v", obj)
+	}
+	return lastApplied, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfields.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfields.go
new file mode 100644
index 0000000000..bba2014e20
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfields.go
@@ -0,0 +1,248 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"encoding/json"
+	"fmt"
+	"sort"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+// ManagedInterface groups a fieldpath.ManagedFields together with the timestamps associated with each operation.
+type ManagedInterface interface {
+	// Fields gets the fieldpath.ManagedFields.
+	Fields() fieldpath.ManagedFields
+
+	// Times gets the timestamps associated with each operation.
+	Times() map[string]*metav1.Time
+}
+
+type managedStruct struct {
+	fields fieldpath.ManagedFields
+	times  map[string]*metav1.Time
+}
+
+var _ ManagedInterface = &managedStruct{}
+
+// Fields implements ManagedInterface.
+func (m *managedStruct) Fields() fieldpath.ManagedFields {
+	return m.fields
+}
+
+// Times implements ManagedInterface.
+func (m *managedStruct) Times() map[string]*metav1.Time {
+	return m.times
+}
+
+// NewEmptyManaged creates an empty ManagedInterface.
+func NewEmptyManaged() ManagedInterface {
+	return NewManaged(fieldpath.ManagedFields{}, map[string]*metav1.Time{})
+}
+
+// NewManaged creates a ManagedInterface from a fieldpath.ManagedFields and the timestamps associated with each operation.
+func NewManaged(f fieldpath.ManagedFields, t map[string]*metav1.Time) ManagedInterface {
+	return &managedStruct{
+		fields: f,
+		times:  t,
+	}
+}
+
+// RemoveObjectManagedFields removes the ManagedFields from the object
+// before we merge so that it doesn't appear in the ManagedFields
+// recursively.
+func RemoveObjectManagedFields(obj runtime.Object) {
+	accessor, err := meta.Accessor(obj)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't get accessor: %v", err))
+	}
+	accessor.SetManagedFields(nil)
+}
+
+// EncodeObjectManagedFields converts and stores the fieldpathManagedFields into the objects ManagedFields
+func EncodeObjectManagedFields(obj runtime.Object, managed ManagedInterface) error {
+	accessor, err := meta.Accessor(obj)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't get accessor: %v", err))
+	}
+
+	encodedManagedFields, err := encodeManagedFields(managed)
+	if err != nil {
+		return fmt.Errorf("failed to convert back managed fields to API: %v", err)
+	}
+	accessor.SetManagedFields(encodedManagedFields)
+
+	return nil
+}
+
+// DecodeManagedFields converts ManagedFields from the wire format (api format)
+// to the format used by sigs.k8s.io/structured-merge-diff
+func DecodeManagedFields(encodedManagedFields []metav1.ManagedFieldsEntry) (ManagedInterface, error) {
+	managed := managedStruct{}
+	managed.fields = make(fieldpath.ManagedFields, len(encodedManagedFields))
+	managed.times = make(map[string]*metav1.Time, len(encodedManagedFields))
+
+	for i, encodedVersionedSet := range encodedManagedFields {
+		switch encodedVersionedSet.Operation {
+		case metav1.ManagedFieldsOperationApply, metav1.ManagedFieldsOperationUpdate:
+		default:
+			return nil, fmt.Errorf("operation must be `Apply` or `Update`")
+		}
+		if len(encodedVersionedSet.APIVersion) < 1 {
+			return nil, fmt.Errorf("apiVersion must not be empty")
+		}
+		switch encodedVersionedSet.FieldsType {
+		case "FieldsV1":
+			// Valid case.
+		case "":
+			return nil, fmt.Errorf("missing fieldsType in managed fields entry %d", i)
+		default:
+			return nil, fmt.Errorf("invalid fieldsType %q in managed fields entry %d", encodedVersionedSet.FieldsType, i)
+		}
+		manager, err := BuildManagerIdentifier(&encodedVersionedSet)
+		if err != nil {
+			return nil, fmt.Errorf("error decoding manager from %v: %v", encodedVersionedSet, err)
+		}
+		managed.fields[manager], err = decodeVersionedSet(&encodedVersionedSet)
+		if err != nil {
+			return nil, fmt.Errorf("error decoding versioned set from %v: %v", encodedVersionedSet, err)
+		}
+		managed.times[manager] = encodedVersionedSet.Time
+	}
+	return &managed, nil
+}
+
+// BuildManagerIdentifier creates a manager identifier string from a ManagedFieldsEntry
+func BuildManagerIdentifier(encodedManager *metav1.ManagedFieldsEntry) (manager string, err error) {
+	encodedManagerCopy := *encodedManager
+
+	// Never include fields type in the manager identifier
+	encodedManagerCopy.FieldsType = ""
+
+	// Never include the fields in the manager identifier
+	encodedManagerCopy.FieldsV1 = nil
+
+	// Never include the time in the manager identifier
+	encodedManagerCopy.Time = nil
+
+	// For appliers, don't include the APIVersion in the manager identifier,
+	// so it will always have the same manager identifier each time it applied.
+	if encodedManager.Operation == metav1.ManagedFieldsOperationApply {
+		encodedManagerCopy.APIVersion = ""
+	}
+
+	// Use the remaining fields to build the manager identifier
+	b, err := json.Marshal(&encodedManagerCopy)
+	if err != nil {
+		return "", fmt.Errorf("error marshalling manager identifier: %v", err)
+	}
+
+	return string(b), nil
+}
+
+func decodeVersionedSet(encodedVersionedSet *metav1.ManagedFieldsEntry) (versionedSet fieldpath.VersionedSet, err error) {
+	fields := EmptyFields
+	if encodedVersionedSet.FieldsV1 != nil {
+		fields = *encodedVersionedSet.FieldsV1
+	}
+	set, err := FieldsToSet(fields)
+	if err != nil {
+		return nil, fmt.Errorf("error decoding set: %v", err)
+	}
+	return fieldpath.NewVersionedSet(&set, fieldpath.APIVersion(encodedVersionedSet.APIVersion), encodedVersionedSet.Operation == metav1.ManagedFieldsOperationApply), nil
+}
+
+// encodeManagedFields converts ManagedFields from the format used by
+// sigs.k8s.io/structured-merge-diff to the wire format (api format)
+func encodeManagedFields(managed ManagedInterface) (encodedManagedFields []metav1.ManagedFieldsEntry, err error) {
+	if len(managed.Fields()) == 0 {
+		return nil, nil
+	}
+	encodedManagedFields = []metav1.ManagedFieldsEntry{}
+	for manager := range managed.Fields() {
+		versionedSet := managed.Fields()[manager]
+		v, err := encodeManagerVersionedSet(manager, versionedSet)
+		if err != nil {
+			return nil, fmt.Errorf("error encoding versioned set for %v: %v", manager, err)
+		}
+		if t, ok := managed.Times()[manager]; ok {
+			v.Time = t
+		}
+		encodedManagedFields = append(encodedManagedFields, *v)
+	}
+	return sortEncodedManagedFields(encodedManagedFields)
+}
+
+func sortEncodedManagedFields(encodedManagedFields []metav1.ManagedFieldsEntry) (sortedManagedFields []metav1.ManagedFieldsEntry, err error) {
+	sort.Slice(encodedManagedFields, func(i, j int) bool {
+		p, q := encodedManagedFields[i], encodedManagedFields[j]
+
+		if p.Operation != q.Operation {
+			return p.Operation < q.Operation
+		}
+
+		pSeconds, qSeconds := int64(0), int64(0)
+		if p.Time != nil {
+			pSeconds = p.Time.Unix()
+		}
+		if q.Time != nil {
+			qSeconds = q.Time.Unix()
+		}
+		if pSeconds != qSeconds {
+			return pSeconds < qSeconds
+		}
+
+		if p.Manager != q.Manager {
+			return p.Manager < q.Manager
+		}
+
+		if p.APIVersion != q.APIVersion {
+			return p.APIVersion < q.APIVersion
+		}
+		return p.Subresource < q.Subresource
+	})
+
+	return encodedManagedFields, nil
+}
+
+func encodeManagerVersionedSet(manager string, versionedSet fieldpath.VersionedSet) (encodedVersionedSet *metav1.ManagedFieldsEntry, err error) {
+	encodedVersionedSet = &metav1.ManagedFieldsEntry{}
+
+	// Get as many fields as we can from the manager identifier
+	err = json.Unmarshal([]byte(manager), encodedVersionedSet)
+	if err != nil {
+		return nil, fmt.Errorf("error unmarshalling manager identifier %v: %v", manager, err)
+	}
+
+	// Get the APIVersion, Operation, and Fields from the VersionedSet
+	encodedVersionedSet.APIVersion = string(versionedSet.APIVersion())
+	if versionedSet.Applied() {
+		encodedVersionedSet.Operation = metav1.ManagedFieldsOperationApply
+	}
+	encodedVersionedSet.FieldsType = "FieldsV1"
+	fields, err := SetToFields(*versionedSet.Set())
+	if err != nil {
+		return nil, fmt.Errorf("error encoding set: %v", err)
+	}
+	encodedVersionedSet.FieldsV1 = &fields
+
+	return encodedVersionedSet, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfields_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfields_test.go
new file mode 100644
index 0000000000..2d8cb12405
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfields_test.go
@@ -0,0 +1,520 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"sigs.k8s.io/yaml"
+)
+
+// TestHasFieldsType makes sure that we fail if we don't have a
+// FieldsType set properly.
+func TestHasFieldsType(t *testing.T) {
+	var unmarshaled []metav1.ManagedFieldsEntry
+	if err := yaml.Unmarshal([]byte(`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:field: {}
+  manager: foo
+  operation: Apply
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err != nil {
+		t.Fatalf("did not expect decoding error but got: %v", err)
+	}
+
+	// Invalid fieldsType V2.
+	if err := yaml.Unmarshal([]byte(`- apiVersion: v1
+  fieldsType: FieldsV2
+  fieldsV1:
+    f:field: {}
+  manager: foo
+  operation: Apply
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err == nil {
+		t.Fatal("Expect decoding error but got none")
+	}
+
+	// Missing fieldsType.
+	if err := yaml.Unmarshal([]byte(`- apiVersion: v1
+  fieldsV1:
+    f:field: {}
+  manager: foo
+  operation: Apply
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err == nil {
+		t.Fatal("Expect decoding error but got none")
+	}
+}
+
+// TestHasAPIVersion makes sure that we fail if we don't have an
+// APIVersion set.
+func TestHasAPIVersion(t *testing.T) {
+	var unmarshaled []metav1.ManagedFieldsEntry
+	if err := yaml.Unmarshal([]byte(`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:field: {}
+  manager: foo
+  operation: Apply
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err != nil {
+		t.Fatalf("did not expect decoding error but got: %v", err)
+	}
+
+	// Missing apiVersion.
+	unmarshaled = nil
+	if err := yaml.Unmarshal([]byte(`- fieldsType: FieldsV1
+  fieldsV1:
+    f:field: {}
+  manager: foo
+  operation: Apply
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err == nil {
+		t.Fatal("Expect decoding error but got none")
+	}
+}
+
+// TestHasOperation makes sure that we fail if we don't have an
+// Operation set properly.
+func TestHasOperation(t *testing.T) {
+	var unmarshaled []metav1.ManagedFieldsEntry
+	if err := yaml.Unmarshal([]byte(`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:field: {}
+  manager: foo
+  operation: Apply
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err != nil {
+		t.Fatalf("did not expect decoding error but got: %v", err)
+	}
+
+	// Invalid operation.
+	if err := yaml.Unmarshal([]byte(`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:field: {}
+  manager: foo
+  operation: Invalid
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err == nil {
+		t.Fatal("Expect decoding error but got none")
+	}
+
+	// Missing operation.
+	unmarshaled = nil
+	if err := yaml.Unmarshal([]byte(`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:field: {}
+  manager: foo
+`), &unmarshaled); err != nil {
+		t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+	}
+	if _, err := DecodeManagedFields(unmarshaled); err == nil {
+		t.Fatal("Expect decoding error but got none")
+	}
+}
+
+// TestRoundTripManagedFields will roundtrip ManagedFields from the wire format
+// (api format) to the format used by sigs.k8s.io/structured-merge-diff and back
+func TestRoundTripManagedFields(t *testing.T) {
+	tests := []string{
+		`null
+`,
+		`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    v:3:
+      f:alsoPi: {}
+    v:3.1415:
+      f:pi: {}
+    v:false:
+      f:notTrue: {}
+  manager: foo
+  operation: Update
+  time: "2001-02-03T04:05:06Z"
+- apiVersion: v1beta1
+  fieldsType: FieldsV1
+  fieldsV1:
+    i:5:
+      f:i: {}
+  manager: foo
+  operation: Update
+  time: "2011-12-13T14:15:16Z"
+`,
+		`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:spec:
+      f:containers:
+        k:{"name":"c"}:
+          f:image: {}
+          f:name: {}
+  manager: foo
+  operation: Apply
+`,
+		`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:apiVersion: {}
+    f:kind: {}
+    f:metadata:
+      f:labels:
+        f:app: {}
+      f:name: {}
+    f:spec:
+      f:replicas: {}
+      f:selector:
+        f:matchLabels:
+          f:app: {}
+      f:template:
+        f:medatada:
+          f:labels:
+            f:app: {}
+        f:spec:
+          f:containers:
+            k:{"name":"nginx"}:
+              .: {}
+              f:image: {}
+              f:name: {}
+              f:ports:
+                i:0:
+                  f:containerPort: {}
+  manager: foo
+  operation: Update
+`,
+		`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:allowVolumeExpansion: {}
+    f:apiVersion: {}
+    f:kind: {}
+    f:metadata:
+      f:name: {}
+      f:parameters:
+        f:resturl: {}
+        f:restuser: {}
+        f:secretName: {}
+        f:secretNamespace: {}
+    f:provisioner: {}
+  manager: foo
+  operation: Apply
+`,
+		`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:apiVersion: {}
+    f:kind: {}
+    f:metadata:
+      f:name: {}
+    f:spec:
+      f:group: {}
+      f:names:
+        f:kind: {}
+        f:plural: {}
+        f:shortNames:
+          i:0: {}
+        f:singular: {}
+      f:scope: {}
+      f:versions:
+        k:{"name":"v1"}:
+          f:name: {}
+          f:served: {}
+          f:storage: {}
+  manager: foo
+  operation: Update
+`,
+		`- apiVersion: v1
+  fieldsType: FieldsV1
+  fieldsV1:
+    f:spec:
+      f:replicas: {}
+  manager: foo
+  operation: Update
+  subresource: scale
+`,
+	}
+
+	for _, test := range tests {
+		t.Run(test, func(t *testing.T) {
+			var unmarshaled []metav1.ManagedFieldsEntry
+			if err := yaml.Unmarshal([]byte(test), &unmarshaled); err != nil {
+				t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+			}
+			decoded, err := DecodeManagedFields(unmarshaled)
+			if err != nil {
+				t.Fatalf("did not expect decoding error but got: %v", err)
+			}
+			encoded, err := encodeManagedFields(decoded)
+			if err != nil {
+				t.Fatalf("did not expect encoding error but got: %v", err)
+			}
+			marshaled, err := yaml.Marshal(&encoded)
+			if err != nil {
+				t.Fatalf("did not expect yaml marshalling error but got: %v", err)
+			}
+			if !reflect.DeepEqual(string(marshaled), test) {
+				t.Fatalf("expected:\n%v\nbut got:\n%v", test, string(marshaled))
+			}
+		})
+	}
+}
+
+func TestBuildManagerIdentifier(t *testing.T) {
+	tests := []struct {
+		managedFieldsEntry string
+		expected           string
+	}{
+		{
+			managedFieldsEntry: `
+apiVersion: v1
+fieldsV1:
+  f:apiVersion: {}
+manager: foo
+operation: Update
+time: "2001-02-03T04:05:06Z"
+`,
+			expected: "{\"manager\":\"foo\",\"operation\":\"Update\",\"apiVersion\":\"v1\"}",
+		},
+		{
+			managedFieldsEntry: `
+apiVersion: v1
+fieldsV1:
+  f:apiVersion: {}
+manager: foo
+operation: Apply
+time: "2001-02-03T04:05:06Z"
+`,
+			expected: "{\"manager\":\"foo\",\"operation\":\"Apply\"}",
+		},
+		{
+			managedFieldsEntry: `
+apiVersion: v1
+fieldsV1:
+  f:apiVersion: {}
+manager: foo
+operation: Apply
+subresource: scale
+time: "2001-02-03T04:05:06Z"
+`,
+			expected: "{\"manager\":\"foo\",\"operation\":\"Apply\",\"subresource\":\"scale\"}",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.managedFieldsEntry, func(t *testing.T) {
+			var unmarshaled metav1.ManagedFieldsEntry
+			if err := yaml.Unmarshal([]byte(test.managedFieldsEntry), &unmarshaled); err != nil {
+				t.Fatalf("did not expect yaml unmarshalling error but got: %v", err)
+			}
+			decoded, err := BuildManagerIdentifier(&unmarshaled)
+			if err != nil {
+				t.Fatalf("did not expect decoding error but got: %v", err)
+			}
+			if !reflect.DeepEqual(decoded, test.expected) {
+				t.Fatalf("expected:\n%v\nbut got:\n%v", test.expected, decoded)
+			}
+		})
+	}
+}
+
+func TestSortEncodedManagedFields(t *testing.T) {
+	tests := []struct {
+		name          string
+		managedFields []metav1.ManagedFieldsEntry
+		expected      []metav1.ManagedFieldsEntry
+	}{
+		{
+			name:          "empty",
+			managedFields: []metav1.ManagedFieldsEntry{},
+			expected:      []metav1.ManagedFieldsEntry{},
+		},
+		{
+			name:          "nil",
+			managedFields: nil,
+			expected:      nil,
+		},
+		{
+			name: "remains untouched",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+			},
+		},
+		{
+			name: "manager without time first",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+			},
+		},
+		{
+			name: "manager without time first name last",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+			},
+		},
+		{
+			name: "apply first",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+			},
+		},
+		{
+			name: "newest last",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2002-01-01T01:00:00Z")},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2002-01-01T01:00:00Z")},
+			},
+		},
+		{
+			name: "manager last",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "d", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "d", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+			},
+		},
+		{
+			name: "manager sorted",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "g", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "f", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2002-01-01T01:00:00Z")},
+				{Manager: "i", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "d", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2002-01-01T01:00:00Z")},
+				{Manager: "h", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "e", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2003-01-01T01:00:00Z")},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "g", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "h", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "i", Operation: metav1.ManagedFieldsOperationApply, Time: nil},
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2001-01-01T01:00:00Z")},
+				{Manager: "d", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2002-01-01T01:00:00Z")},
+				{Manager: "f", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2002-01-01T01:00:00Z")},
+				{Manager: "e", Operation: metav1.ManagedFieldsOperationUpdate, Time: parseTimeOrPanic("2003-01-01T01:00:00Z")},
+			},
+		},
+		{
+			name: "sort drops nanoseconds",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: &metav1.Time{Time: time.Date(2000, time.January, 0, 0, 0, 0, 1, time.UTC)}},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationUpdate, Time: &metav1.Time{Time: time.Date(2000, time.January, 0, 0, 0, 0, 2, time.UTC)}},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationUpdate, Time: &metav1.Time{Time: time.Date(2000, time.January, 0, 0, 0, 0, 3, time.UTC)}},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationUpdate, Time: &metav1.Time{Time: time.Date(2000, time.January, 0, 0, 0, 0, 2, time.UTC)}},
+				{Manager: "b", Operation: metav1.ManagedFieldsOperationUpdate, Time: &metav1.Time{Time: time.Date(2000, time.January, 0, 0, 0, 0, 3, time.UTC)}},
+				{Manager: "c", Operation: metav1.ManagedFieldsOperationUpdate, Time: &metav1.Time{Time: time.Date(2000, time.January, 0, 0, 0, 0, 1, time.UTC)}},
+			},
+		},
+		{
+			name: "entries with subresource field",
+			managedFields: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Subresource: "status"},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Subresource: "scale"},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Subresource: "scale"},
+				{Manager: "a", Operation: metav1.ManagedFieldsOperationApply, Subresource: "status"},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			sorted, err := sortEncodedManagedFields(test.managedFields)
+			if err != nil {
+				t.Fatalf("did not expect error when sorting but got: %v", err)
+			}
+			if !reflect.DeepEqual(sorted, test.expected) {
+				t.Fatalf("expected:\n%v\nbut got:\n%v", test.expected, sorted)
+			}
+		})
+	}
+}
+
+func parseTimeOrPanic(s string) *metav1.Time {
+	t, err := time.Parse(time.RFC3339, s)
+	if err != nil {
+		panic(fmt.Sprintf("failed to parse time %s, got: %v", s, err))
+	}
+	return &metav1.Time{Time: t.UTC()}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfieldsupdater.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfieldsupdater.go
new file mode 100644
index 0000000000..66215d87a1
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfieldsupdater.go
@@ -0,0 +1,82 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+type managedFieldsUpdater struct {
+	fieldManager Manager
+}
+
+var _ Manager = &managedFieldsUpdater{}
+
+// NewManagedFieldsUpdater is responsible for updating the managedfields
+// in the object, updating the time of the operation as necessary. For
+// updates, it uses a hard-coded manager to detect if things have
+// changed, and swaps back the correct manager after the operation is
+// done.
+func NewManagedFieldsUpdater(fieldManager Manager) Manager {
+	return &managedFieldsUpdater{
+		fieldManager: fieldManager,
+	}
+}
+
+// Update implements Manager.
+func (f *managedFieldsUpdater) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	self := "current-operation"
+	object, managed, err := f.fieldManager.Update(liveObj, newObj, managed, self)
+	if err != nil {
+		return object, managed, err
+	}
+
+	// If the current operation took any fields from anything, it means the object changed,
+	// so update the timestamp of the managedFieldsEntry and merge with any previous updates from the same manager
+	if vs, ok := managed.Fields()[self]; ok {
+		delete(managed.Fields(), self)
+
+		if previous, ok := managed.Fields()[manager]; ok {
+			managed.Fields()[manager] = fieldpath.NewVersionedSet(vs.Set().Union(previous.Set()), vs.APIVersion(), vs.Applied())
+		} else {
+			managed.Fields()[manager] = vs
+		}
+
+		managed.Times()[manager] = &metav1.Time{Time: time.Now().UTC()}
+	}
+
+	return object, managed, nil
+}
+
+// Apply implements Manager.
+func (f *managedFieldsUpdater) Apply(liveObj, appliedObj runtime.Object, managed Managed, fieldManager string, force bool) (runtime.Object, Managed, error) {
+	object, managed, err := f.fieldManager.Apply(liveObj, appliedObj, managed, fieldManager, force)
+	if err != nil {
+		return object, managed, err
+	}
+	if object != nil {
+		managed.Times()[fieldManager] = &metav1.Time{Time: time.Now().UTC()}
+	} else {
+		object = liveObj.DeepCopyObject()
+		RemoveObjectManagedFields(object)
+	}
+	return object, managed, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfieldsupdater_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfieldsupdater_test.go
new file mode 100644
index 0000000000..631eed7f7b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/managedfieldsupdater_test.go
@@ -0,0 +1,524 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+	"time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/managedfields/managedfieldstest"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	"sigs.k8s.io/yaml"
+)
+
+func TestManagedFieldsUpdateDoesModifyTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = updateObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+
+	time.Sleep(time.Second)
+
+	err = updateObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "new-value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+
+	if previousManagedFields[0].Time.Equal(newManagedFields[0].Time) {
+		t.Errorf("ManagedFields time has not been updated:\n%v", newManagedFields)
+	}
+}
+
+func TestManagedFieldsApplyDoesModifyTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = applyObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+
+	time.Sleep(time.Second)
+
+	err = applyObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "new-value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+
+	if previousManagedFields[0].Time.Equal(newManagedFields[0].Time) {
+		t.Errorf("ManagedFields time has not been updated:\n%v", newManagedFields)
+	}
+}
+
+func TestManagedFieldsUpdateWithoutChangesDoesNotModifyTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = updateObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+
+	time.Sleep(time.Second)
+
+	err = updateObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+
+	if !previousManagedFields[0].Time.Equal(newManagedFields[0].Time) {
+		t.Errorf("ManagedFields time has changed:\nBefore:\n%v\nAfter:\n%v", previousManagedFields, newManagedFields)
+	}
+}
+
+func TestManagedFieldsApplyWithoutChangesDoesNotModifyTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = applyObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+
+	time.Sleep(time.Second)
+
+	err = applyObject(f, "fieldmanager_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+
+	if !previousManagedFields[0].Time.Equal(newManagedFields[0].Time) {
+		t.Errorf("ManagedFields time has changed:\nBefore:\n%v\nAfter:\n%v", previousManagedFields, newManagedFields)
+	}
+}
+
+func TestNonManagedFieldsUpdateDoesNotModifyTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = updateObject(f, "fieldmanager_a_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_a": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = updateObject(f, "fieldmanager_b_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_b": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+	previousEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range previousManagedFields {
+		previousEntries[entry.Manager] = entry
+	}
+
+	time.Sleep(time.Second)
+
+	err = updateObject(f, "fieldmanager_a_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_a": "value",
+			"key_b": "new-value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+	newEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range newManagedFields {
+		newEntries[entry.Manager] = entry
+	}
+
+	if _, ok := newEntries["fieldmanager_b_test"]; ok {
+		t.Errorf("FieldManager B ManagedFields has changed:\n%v", newEntries["fieldmanager_b_test"])
+	}
+}
+
+func TestNonManagedFieldsApplyDoesNotModifyTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = applyObject(f, "fieldmanager_a_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_a": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = applyObject(f, "fieldmanager_b_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_b": "value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+	previousEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range previousManagedFields {
+		previousEntries[entry.Manager] = entry
+	}
+
+	time.Sleep(time.Second)
+
+	err = applyObject(f, "fieldmanager_a_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_a": "new-value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+	newEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range newManagedFields {
+		newEntries[entry.Manager] = entry
+	}
+
+	if !previousEntries["fieldmanager_b_test"].Time.Equal(newEntries["fieldmanager_b_test"].Time) {
+		t.Errorf("FieldManager B ManagedFields time changed:\nBefore:\n%v\nAfter:\n%v",
+			previousEntries["fieldmanager_b_test"], newEntries["fieldmanager_b_test"])
+	}
+}
+
+func TestTakingOverManagedFieldsDuringUpdateDoesNotModifyPreviousManagerTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = updateObject(f, "fieldmanager_a_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_a": "value",
+			"key_b": value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+	previousEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range previousManagedFields {
+		previousEntries[entry.Manager] = entry
+	}
+
+	time.Sleep(time.Second)
+
+	err = updateObject(f, "fieldmanager_b_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_b": "new-value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+	newEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range newManagedFields {
+		newEntries[entry.Manager] = entry
+	}
+
+	if !previousEntries["fieldmanager_a_test"].Time.Equal(newEntries["fieldmanager_a_test"].Time) {
+		t.Errorf("FieldManager A ManagedFields time has been updated:\nBefore:\n%v\nAfter:\n%v",
+			previousEntries["fieldmanager_a_test"], newEntries["fieldmanager_a_test"])
+	}
+}
+
+func TestTakingOverManagedFieldsDuringApplyDoesNotModifyPreviousManagerTime(t *testing.T) {
+	var err error
+	f := managedfieldstest.NewTestFieldManager(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "ConfigMap"))
+
+	err = applyObject(f, "fieldmanager_a_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_a": "value",
+			"key_b": value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	previousManagedFields := f.ManagedFields()
+	previousEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range previousManagedFields {
+		previousEntries[entry.Manager] = entry
+	}
+
+	time.Sleep(time.Second)
+
+	err = applyObject(f, "fieldmanager_b_test", []byte(`{
+		"apiVersion": "v1",
+		"kind": "ConfigMap",
+		"metadata": {
+			"name": "configmap"
+		},
+		"data": {
+			"key_b": "new-value"
+		}
+	}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	newManagedFields := f.ManagedFields()
+	newEntries := map[string]v1.ManagedFieldsEntry{}
+	for _, entry := range newManagedFields {
+		newEntries[entry.Manager] = entry
+	}
+
+	if !previousEntries["fieldmanager_a_test"].Time.Equal(newEntries["fieldmanager_a_test"].Time) {
+		t.Errorf("FieldManager A ManagedFields time has been updated:\nBefore:\n%v\nAfter:\n%v",
+			previousEntries["fieldmanager_a_test"], newEntries["fieldmanager_a_test"])
+	}
+}
+
+type NoopManager struct{}
+
+func (NoopManager) Apply(liveObj, appliedObj runtime.Object, managed internal.Managed, fieldManager string, force bool) (runtime.Object, internal.Managed, error) {
+	return nil, managed, nil
+}
+
+func (NoopManager) Update(liveObj, newObj runtime.Object, managed internal.Managed, manager string) (runtime.Object, internal.Managed, error) {
+	return nil, nil, nil
+}
+
+func updateObject(f managedfieldstest.TestFieldManager, fieldManagerName string, object []byte) error {
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal(object, &obj.Object); err != nil {
+		return fmt.Errorf("error decoding YAML: %v", err)
+	}
+	if err := f.Update(obj, fieldManagerName); err != nil {
+		return fmt.Errorf("failed to update object: %v", err)
+	}
+	return nil
+}
+
+func applyObject(f managedfieldstest.TestFieldManager, fieldManagerName string, object []byte) error {
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal(object, &obj.Object); err != nil {
+		return fmt.Errorf("error decoding YAML: %v", err)
+	}
+	if err := f.Apply(obj, fieldManagerName, true); err != nil {
+		return fmt.Errorf("failed to apply object: %v", err)
+	}
+	return nil
+}
+
+// Ensures that if ManagedFieldsUpdater gets a nil value from its nested manager
+// chain (meaning the operation was a no-op), then the ManagedFieldsUpdater
+// itself will return a copy of the input live object, with its managed fields
+// removed
+func TestNilNewObjectReplacedWithDeepCopyExcludingManagedFields(t *testing.T) {
+	// Initialize our "live object" with some managed fields
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"name": "pod",
+			"labels": {"app": "nginx"},
+			"managedFields": [
+				{
+					"apiVersion": "v1",
+					"fieldsType": "FieldsV1",
+					"fieldsV1": {
+						"f:metadata": {
+							"f:labels": {
+								"f:app": {}
+							}
+						}
+					},
+					"manager": "fieldmanager_test",
+					"operation": "Apply",
+					"time": "2021-11-11T18:41:17Z"
+				}
+			]
+		}
+	}`), &obj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	accessor, err := meta.Accessor(obj)
+	if err != nil {
+		t.Fatalf("couldn't get accessor: %v", err)
+	}
+
+	// Decode the managed fields in the live object, since it isn't allowed in the patch.
+	managed, err := internal.DecodeManagedFields(accessor.GetManagedFields())
+	if err != nil {
+		t.Fatalf("failed to decode managed fields: %v", err)
+	}
+
+	updater := internal.NewManagedFieldsUpdater(NoopManager{})
+
+	newObject, _, err := updater.Apply(obj, obj.DeepCopyObject(), managed, "some_manager", false)
+	if err != nil {
+		t.Fatalf("failed to apply configuration %v", err)
+	}
+
+	if newObject == obj {
+		t.Fatalf("returned newObject must not be the same instance as the passed in liveObj")
+	}
+
+	// Rip off managed fields of live, and check that it is deeply
+	// equal to newObject
+	liveWithoutManaged := obj.DeepCopyObject()
+	internal.RemoveObjectManagedFields(liveWithoutManaged)
+
+	if !reflect.DeepEqual(liveWithoutManaged, newObject) {
+		t.Fatalf("returned newObject must be deeply equal to the input live object, without managed fields")
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/manager.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/manager.go
new file mode 100644
index 0000000000..78830d0cf5
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/manager.go
@@ -0,0 +1,52 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+// Managed groups a fieldpath.ManagedFields together with the timestamps associated with each operation.
+type Managed interface {
+	// Fields gets the fieldpath.ManagedFields.
+	Fields() fieldpath.ManagedFields
+
+	// Times gets the timestamps associated with each operation.
+	Times() map[string]*metav1.Time
+}
+
+// Manager updates the managed fields and merges applied configurations.
+type Manager interface {
+	// Update is used when the object has already been merged (non-apply
+	// use-case), and simply updates the managed fields in the output
+	// object.
+	//  * `liveObj` is not mutated by this function
+	//  * `newObj` may be mutated by this function
+	// Returns the new object with managedFields removed, and the object's new
+	// proposed managedFields separately.
+	Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error)
+
+	// Apply is used when server-side apply is called, as it merges the
+	// object and updates the managed fields.
+	//  * `liveObj` is not mutated by this function
+	//  * `newObj` may be mutated by this function
+	// Returns the new object with managedFields removed, and the object's new
+	// proposed managedFields separately.
+	Apply(liveObj, appliedObj runtime.Object, managed Managed, fieldManager string, force bool) (runtime.Object, Managed, error)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/pathelement.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/pathelement.go
new file mode 100644
index 0000000000..1b5dddfd70
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/pathelement.go
@@ -0,0 +1,140 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/value"
+)
+
+const (
+	// Field indicates that the content of this path element is a field's name
+	Field = "f"
+
+	// Value indicates that the content of this path element is a field's value
+	Value = "v"
+
+	// Index indicates that the content of this path element is an index in an array
+	Index = "i"
+
+	// Key indicates that the content of this path element is a key value map
+	Key = "k"
+
+	// Separator separates the type of a path element from the contents
+	Separator = ":"
+)
+
+// NewPathElement parses a serialized path element
+func NewPathElement(s string) (fieldpath.PathElement, error) {
+	split := strings.SplitN(s, Separator, 2)
+	if len(split) < 2 {
+		return fieldpath.PathElement{}, fmt.Errorf("missing colon: %v", s)
+	}
+	switch split[0] {
+	case Field:
+		return fieldpath.PathElement{
+			FieldName: &split[1],
+		}, nil
+	case Value:
+		val, err := value.FromJSON([]byte(split[1]))
+		if err != nil {
+			return fieldpath.PathElement{}, err
+		}
+		return fieldpath.PathElement{
+			Value: &val,
+		}, nil
+	case Index:
+		i, err := strconv.Atoi(split[1])
+		if err != nil {
+			return fieldpath.PathElement{}, err
+		}
+		return fieldpath.PathElement{
+			Index: &i,
+		}, nil
+	case Key:
+		kv := map[string]json.RawMessage{}
+		err := json.Unmarshal([]byte(split[1]), &kv)
+		if err != nil {
+			return fieldpath.PathElement{}, err
+		}
+		fields := value.FieldList{}
+		for k, v := range kv {
+			b, err := json.Marshal(v)
+			if err != nil {
+				return fieldpath.PathElement{}, err
+			}
+			val, err := value.FromJSON(b)
+			if err != nil {
+				return fieldpath.PathElement{}, err
+			}
+
+			fields = append(fields, value.Field{
+				Name:  k,
+				Value: val,
+			})
+		}
+		return fieldpath.PathElement{
+			Key: &fields,
+		}, nil
+	default:
+		// Ignore unknown key types
+		return fieldpath.PathElement{}, nil
+	}
+}
+
+// PathElementString serializes a path element
+func PathElementString(pe fieldpath.PathElement) (string, error) {
+	switch {
+	case pe.FieldName != nil:
+		return Field + Separator + *pe.FieldName, nil
+	case pe.Key != nil:
+		kv := map[string]json.RawMessage{}
+		for _, k := range *pe.Key {
+			b, err := value.ToJSON(k.Value)
+			if err != nil {
+				return "", err
+			}
+			m := json.RawMessage{}
+			err = json.Unmarshal(b, &m)
+			if err != nil {
+				return "", err
+			}
+			kv[k.Name] = m
+		}
+		b, err := json.Marshal(kv)
+		if err != nil {
+			return "", err
+		}
+		return Key + ":" + string(b), nil
+	case pe.Value != nil:
+		b, err := value.ToJSON(*pe.Value)
+		if err != nil {
+			return "", err
+		}
+		return Value + ":" + string(b), nil
+	case pe.Index != nil:
+		return Index + ":" + strconv.Itoa(*pe.Index), nil
+	default:
+		return "", errors.New("Invalid type of path element")
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/pathelement_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/pathelement_test.go
new file mode 100644
index 0000000000..bd119e03c2
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/pathelement_test.go
@@ -0,0 +1,84 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import "testing"
+
+func TestPathElementRoundTrip(t *testing.T) {
+	tests := []string{
+		`i:0`,
+		`i:1234`,
+		`f:`,
+		`f:spec`,
+		`f:more-complicated-string`,
+		`k:{"name":"my-container"}`,
+		`k:{"port":"8080","protocol":"TCP"}`,
+		`k:{"optionalField":null}`,
+		`k:{"jsonField":{"A":1,"B":null,"C":"D","E":{"F":"G"}}}`,
+		`k:{"listField":["1","2","3"]}`,
+		`v:null`,
+		`v:"some-string"`,
+		`v:1234`,
+		`v:{"some":"json"}`,
+	}
+
+	for _, test := range tests {
+		t.Run(test, func(t *testing.T) {
+			pe, err := NewPathElement(test)
+			if err != nil {
+				t.Fatalf("Failed to create path element: %v", err)
+			}
+			output, err := PathElementString(pe)
+			if err != nil {
+				t.Fatalf("Failed to create string from path element: %v", err)
+			}
+			if test != output {
+				t.Fatalf("Expected round-trip:\ninput: %v\noutput: %v", test, output)
+			}
+		})
+	}
+}
+
+func TestPathElementIgnoreUnknown(t *testing.T) {
+	_, err := NewPathElement("r:Hello")
+	if err != nil {
+		t.Fatalf("Unknown qualifiers should be ignored")
+	}
+}
+
+func TestNewPathElementError(t *testing.T) {
+	tests := []string{
+		``,
+		`no-colon`,
+		`i:index is not a number`,
+		`i:1.23`,
+		`i:`,
+		`v:invalid json`,
+		`v:`,
+		`k:invalid json`,
+		`k:{"name":invalid}`,
+	}
+
+	for _, test := range tests {
+		t.Run(test, func(t *testing.T) {
+			_, err := NewPathElement(test)
+			if err == nil {
+				t.Fatalf("Expected error, no error found")
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/runtimetypeconverter.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/runtimetypeconverter.go
new file mode 100644
index 0000000000..366ff73363
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/runtimetypeconverter.go
@@ -0,0 +1,62 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+)
+
+type schemeTypeConverter struct {
+	scheme *runtime.Scheme
+	parser *typed.Parser
+}
+
+var _ TypeConverter = &schemeTypeConverter{}
+
+// NewSchemeTypeConverter creates a TypeConverter that uses the provided scheme to
+// convert between runtime.Objects and TypedValues.
+func NewSchemeTypeConverter(scheme *runtime.Scheme, parser *typed.Parser) TypeConverter {
+	return &schemeTypeConverter{scheme: scheme, parser: parser}
+}
+
+func (tc schemeTypeConverter) ObjectToTyped(obj runtime.Object, opts ...typed.ValidationOptions) (*typed.TypedValue, error) {
+	gvk := obj.GetObjectKind().GroupVersionKind()
+	name, err := tc.scheme.ToOpenAPIDefinitionName(gvk)
+	if err != nil {
+		return nil, err
+	}
+	t := tc.parser.Type(name)
+	switch o := obj.(type) {
+	case *unstructured.Unstructured:
+		return t.FromUnstructured(o.UnstructuredContent(), opts...)
+	default:
+		return t.FromStructured(obj, opts...)
+	}
+}
+
+func (tc schemeTypeConverter) TypedToObject(value *typed.TypedValue) (runtime.Object, error) {
+	vu := value.AsValue().Unstructured()
+	switch o := vu.(type) {
+	case map[string]interface{}:
+		return &unstructured.Unstructured{Object: o}, nil
+	default:
+		return nil, fmt.Errorf("failed to convert value to unstructured for type %T", vu)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/skipnonapplied.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/skipnonapplied.go
new file mode 100644
index 0000000000..15357a34d8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/skipnonapplied.go
@@ -0,0 +1,92 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+	"math/rand"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+type skipNonAppliedManager struct {
+	fieldManager           Manager
+	objectCreater          runtime.ObjectCreater
+	beforeApplyManagerName string
+	probability            float32
+}
+
+var _ Manager = &skipNonAppliedManager{}
+
+// NewSkipNonAppliedManager creates a new wrapped FieldManager that only starts tracking managers after the first apply.
+func NewSkipNonAppliedManager(fieldManager Manager, objectCreater runtime.ObjectCreater) Manager {
+	return NewProbabilisticSkipNonAppliedManager(fieldManager, objectCreater, 0.0)
+}
+
+// NewProbabilisticSkipNonAppliedManager creates a new wrapped FieldManager that starts tracking managers after the first apply,
+// or starts tracking on create with p probability.
+func NewProbabilisticSkipNonAppliedManager(fieldManager Manager, objectCreater runtime.ObjectCreater, p float32) Manager {
+	return &skipNonAppliedManager{
+		fieldManager:           fieldManager,
+		objectCreater:          objectCreater,
+		beforeApplyManagerName: "before-first-apply",
+		probability:            p,
+	}
+}
+
+// Update implements Manager.
+func (f *skipNonAppliedManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	accessor, err := meta.Accessor(liveObj)
+	if err != nil {
+		return newObj, managed, nil
+	}
+
+	// If managed fields is empty, we need to determine whether to skip tracking managed fields.
+	if len(managed.Fields()) == 0 {
+		// Check if the operation is a create, by checking whether lastObj's UID is empty.
+		// If the operation is create, P(tracking managed fields) = f.probability
+		// If the operation is update, skip tracking managed fields, since we already know managed fields is empty.
+		if len(accessor.GetUID()) == 0 {
+			if f.probability <= rand.Float32() {
+				return newObj, managed, nil
+			}
+		} else {
+			return newObj, managed, nil
+		}
+	}
+	return f.fieldManager.Update(liveObj, newObj, managed, manager)
+}
+
+// Apply implements Manager.
+func (f *skipNonAppliedManager) Apply(liveObj, appliedObj runtime.Object, managed Managed, fieldManager string, force bool) (runtime.Object, Managed, error) {
+	if len(managed.Fields()) == 0 {
+		gvk := appliedObj.GetObjectKind().GroupVersionKind()
+		emptyObj, err := f.objectCreater.New(gvk)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to create empty object of type %v: %v", gvk, err)
+		}
+		if unstructured, isUnstructured := emptyObj.(runtime.Unstructured); isUnstructured {
+			unstructured.GetObjectKind().SetGroupVersionKind(gvk)
+		}
+		liveObj, managed, err = f.fieldManager.Update(emptyObj, liveObj, managed, f.beforeApplyManagerName)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to create manager for existing fields: %v", err)
+		}
+	}
+	return f.fieldManager.Apply(liveObj, appliedObj, managed, fieldManager, force)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/skipnonapplied_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/skipnonapplied_test.go
new file mode 100644
index 0000000000..2863a76326
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/skipnonapplied_test.go
@@ -0,0 +1,133 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal_test
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	internaltesting "k8s.io/apimachinery/pkg/util/managedfields/internal/testing"
+	"sigs.k8s.io/yaml"
+)
+
+func TestNoUpdateBeforeFirstApply(t *testing.T) {
+	f := internaltesting.NewTestFieldManagerImpl(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"), "", func(m internal.Manager) internal.Manager {
+		return internal.NewSkipNonAppliedManager(m, &internaltesting.FakeObjectCreater{})
+	})
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"name": "pod",
+			"labels": {"app": "nginx"}
+		},
+		"spec": {
+			"containers": [{
+				"name":  "nginx",
+				"image": "nginx:latest"
+			}]
+        }
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	if err := f.Apply(appliedObj, "fieldmanager_test_apply", false); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+
+	if e, a := 1, len(f.ManagedFields()); e != a {
+		t.Fatalf("exected %v entries in managedFields, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	if e, a := "fieldmanager_test_apply", f.ManagedFields()[0].Manager; e != a {
+		t.Fatalf("exected manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+}
+
+func TestUpdateBeforeFirstApply(t *testing.T) {
+	f := internaltesting.NewTestFieldManagerImpl(fakeTypeConverter, schema.FromAPIVersionAndKind("v1", "Pod"), "", func(m internal.Manager) internal.Manager {
+		return internal.NewSkipNonAppliedManager(m, &internaltesting.FakeObjectCreater{})
+	})
+
+	updatedObj := &unstructured.Unstructured{}
+	if err := json.Unmarshal([]byte(`{"kind": "Pod", "apiVersion": "v1", "metadata": {"labels": {"app": "my-nginx"}}}`), updatedObj); err != nil {
+		t.Fatalf("Failed to unmarshal object: %v", err)
+	}
+
+	if err := f.Update(updatedObj, "fieldmanager_test_update"); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+
+	if m := f.ManagedFields(); len(m) != 0 {
+		t.Fatalf("managedFields were tracked on update only: %v", m)
+	}
+
+	appliedObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(`{
+		"apiVersion": "v1",
+		"kind": "Pod",
+		"metadata": {
+			"name": "pod",
+			"labels": {"app": "nginx"}
+		},
+		"spec": {
+			"containers": [{
+				"name":  "nginx",
+				"image": "nginx:latest"
+			}]
+        }
+	}`), &appliedObj.Object); err != nil {
+		t.Fatalf("error decoding YAML: %v", err)
+	}
+
+	err := f.Apply(appliedObj, "fieldmanager_test_apply", false)
+	apiStatus, _ := err.(apierrors.APIStatus)
+	if err == nil || !apierrors.IsConflict(err) || len(apiStatus.Status().Details.Causes) != 1 {
+		t.Fatalf("Expecting to get one conflict but got %v", err)
+	}
+
+	if e, a := ".metadata.labels.app", apiStatus.Status().Details.Causes[0].Field; e != a {
+		t.Fatalf("Expecting to conflict on field %q but conflicted on field %q: %v", e, a, err)
+	}
+
+	if e, a := "before-first-apply", apiStatus.Status().Details.Causes[0].Message; !strings.Contains(a, e) {
+		t.Fatalf("Expecting conflict message to contain %q but got %q: %v", e, a, err)
+	}
+
+	if err := f.Apply(appliedObj, "fieldmanager_test_apply", true); err != nil {
+		t.Fatalf("failed to update object: %v", err)
+	}
+
+	if e, a := 2, len(f.ManagedFields()); e != a {
+		t.Fatalf("exected %v entries in managedFields, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	if e, a := "fieldmanager_test_apply", f.ManagedFields()[0].Manager; e != a {
+		t.Fatalf("exected first manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+
+	if e, a := "before-first-apply", f.ManagedFields()[1].Manager; e != a {
+		t.Fatalf("exected second manager name to be %v, but got %v: %#v", e, a, f.ManagedFields())
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/stripmeta.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/stripmeta.go
new file mode 100644
index 0000000000..8a2b7e4e63
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/stripmeta.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+type stripMetaManager struct {
+	fieldManager Manager
+
+	// stripSet is the list of fields that should never be part of a mangedFields.
+	stripSet *fieldpath.Set
+}
+
+var _ Manager = &stripMetaManager{}
+
+// NewStripMetaManager creates a new Manager that strips metadata and typemeta fields from the manager's fieldset.
+func NewStripMetaManager(fieldManager Manager) Manager {
+	return &stripMetaManager{
+		fieldManager: fieldManager,
+		stripSet: fieldpath.NewSet(
+			fieldpath.MakePathOrDie("apiVersion"),
+			fieldpath.MakePathOrDie("kind"),
+			fieldpath.MakePathOrDie("metadata"),
+			fieldpath.MakePathOrDie("metadata", "name"),
+			fieldpath.MakePathOrDie("metadata", "namespace"),
+			fieldpath.MakePathOrDie("metadata", "creationTimestamp"),
+			fieldpath.MakePathOrDie("metadata", "selfLink"),
+			fieldpath.MakePathOrDie("metadata", "uid"),
+			fieldpath.MakePathOrDie("metadata", "clusterName"),
+			fieldpath.MakePathOrDie("metadata", "generation"),
+			fieldpath.MakePathOrDie("metadata", "managedFields"),
+			fieldpath.MakePathOrDie("metadata", "resourceVersion"),
+		),
+	}
+}
+
+// Update implements Manager.
+func (f *stripMetaManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	newObj, managed, err := f.fieldManager.Update(liveObj, newObj, managed, manager)
+	if err != nil {
+		return nil, nil, err
+	}
+	f.stripFields(managed.Fields(), manager)
+	return newObj, managed, nil
+}
+
+// Apply implements Manager.
+func (f *stripMetaManager) Apply(liveObj, appliedObj runtime.Object, managed Managed, manager string, force bool) (runtime.Object, Managed, error) {
+	newObj, managed, err := f.fieldManager.Apply(liveObj, appliedObj, managed, manager, force)
+	if err != nil {
+		return nil, nil, err
+	}
+	f.stripFields(managed.Fields(), manager)
+	return newObj, managed, nil
+}
+
+// stripFields removes a predefined set of paths found in typed from managed
+func (f *stripMetaManager) stripFields(managed fieldpath.ManagedFields, manager string) {
+	vs, ok := managed[manager]
+	if ok {
+		if vs == nil {
+			panic(fmt.Sprintf("Found unexpected nil manager which should never happen: %s", manager))
+		}
+		newSet := vs.Set().Difference(f.stripSet)
+		if newSet.Empty() {
+			delete(managed, manager)
+		} else {
+			managed[manager] = fieldpath.NewVersionedSet(newSet, vs.APIVersion(), vs.Applied())
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/structuredmerge.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/structuredmerge.go
new file mode 100644
index 0000000000..8e9a270108
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/structuredmerge.go
@@ -0,0 +1,190 @@
+/*
+Copyright 2019 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type structuredMergeManager struct {
+	typeConverter   TypeConverter
+	objectConverter runtime.ObjectConvertor
+	objectDefaulter runtime.ObjectDefaulter
+	groupVersion    schema.GroupVersion
+	hubVersion      schema.GroupVersion
+	updater         merge.Updater
+}
+
+var _ Manager = &structuredMergeManager{}
+
+// NewStructuredMergeManager creates a new Manager that merges apply requests
+// and update managed fields for other types of requests.
+func NewStructuredMergeManager(typeConverter TypeConverter, objectConverter runtime.ObjectConvertor, objectDefaulter runtime.ObjectDefaulter, gv schema.GroupVersion, hub schema.GroupVersion, resetFields map[fieldpath.APIVersion]fieldpath.Filter) (Manager, error) {
+	if typeConverter == nil {
+		return nil, fmt.Errorf("typeconverter must not be nil")
+	}
+	return &structuredMergeManager{
+		typeConverter:   typeConverter,
+		objectConverter: objectConverter,
+		objectDefaulter: objectDefaulter,
+		groupVersion:    gv,
+		hubVersion:      hub,
+		updater: merge.Updater{
+			Converter:    newVersionConverter(typeConverter, objectConverter, hub), // This is the converter provided to SMD from k8s
+			IgnoreFilter: resetFields,
+		},
+	}, nil
+}
+
+// NewCRDStructuredMergeManager creates a new Manager specifically for
+// CRDs. This allows for the possibility of fields which are not defined
+// in models, as well as having no models defined at all.
+func NewCRDStructuredMergeManager(typeConverter TypeConverter, objectConverter runtime.ObjectConvertor, objectDefaulter runtime.ObjectDefaulter, gv schema.GroupVersion, hub schema.GroupVersion, resetFields map[fieldpath.APIVersion]fieldpath.Filter) (_ Manager, err error) {
+	return &structuredMergeManager{
+		typeConverter:   typeConverter,
+		objectConverter: objectConverter,
+		objectDefaulter: objectDefaulter,
+		groupVersion:    gv,
+		hubVersion:      hub,
+		updater: merge.Updater{
+			Converter:    newCRDVersionConverter(typeConverter, objectConverter, hub),
+			IgnoreFilter: resetFields,
+		},
+	}, nil
+}
+
+func objectGVKNN(obj runtime.Object) string {
+	name := "<unknown>"
+	namespace := "<unknown>"
+	if accessor, err := meta.Accessor(obj); err == nil {
+		name = accessor.GetName()
+		namespace = accessor.GetNamespace()
+	}
+
+	return fmt.Sprintf("%v/%v; %v", namespace, name, obj.GetObjectKind().GroupVersionKind())
+}
+
+// Update implements Manager.
+func (f *structuredMergeManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	newObjVersioned, err := f.toVersioned(newObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert new object (%v) to proper version (%v): %v", objectGVKNN(newObj), f.groupVersion, err)
+	}
+	liveObjVersioned, err := f.toVersioned(liveObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert live object (%v) to proper version: %v", objectGVKNN(liveObj), err)
+	}
+	newObjTyped, err := f.typeConverter.ObjectToTyped(newObjVersioned, typed.AllowDuplicates)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert new object (%v) to smd typed: %v", objectGVKNN(newObjVersioned), err)
+	}
+	liveObjTyped, err := f.typeConverter.ObjectToTyped(liveObjVersioned, typed.AllowDuplicates)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert live object (%v) to smd typed: %v", objectGVKNN(liveObjVersioned), err)
+	}
+	apiVersion := fieldpath.APIVersion(f.groupVersion.String())
+
+	// TODO(apelisse) use the first return value when unions are implemented
+	_, managedFields, err := f.updater.Update(liveObjTyped, newObjTyped, apiVersion, managed.Fields(), manager)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to update ManagedFields (%v): %v", objectGVKNN(newObjVersioned), err)
+	}
+	managed = NewManaged(managedFields, managed.Times())
+
+	return newObj, managed, nil
+}
+
+// Apply implements Manager.
+func (f *structuredMergeManager) Apply(liveObj, patchObj runtime.Object, managed Managed, manager string, force bool) (runtime.Object, Managed, error) {
+	// Check that the patch object has the same version as the live object
+	if patchVersion := patchObj.GetObjectKind().GroupVersionKind().GroupVersion(); patchVersion != f.groupVersion {
+		return nil, nil,
+			errors.NewBadRequest(
+				fmt.Sprintf("Incorrect version specified in apply patch. "+
+					"Specified patch version: %s, expected: %s",
+					patchVersion, f.groupVersion))
+	}
+
+	patchObjMeta, err := meta.Accessor(patchObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("couldn't get accessor: %v", err)
+	}
+	if patchObjMeta.GetManagedFields() != nil {
+		return nil, nil, errors.NewBadRequest("metadata.managedFields must be nil")
+	}
+
+	liveObjVersioned, err := f.toVersioned(liveObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert live object (%v) to proper version: %v", objectGVKNN(liveObj), err)
+	}
+
+	// Don't allow duplicates in the applied object.
+	patchObjTyped, err := f.typeConverter.ObjectToTyped(patchObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create typed patch object (%v): %v", objectGVKNN(patchObj), err)
+	}
+
+	liveObjTyped, err := f.typeConverter.ObjectToTyped(liveObjVersioned, typed.AllowDuplicates)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create typed live object (%v): %v", objectGVKNN(liveObjVersioned), err)
+	}
+
+	apiVersion := fieldpath.APIVersion(f.groupVersion.String())
+	newObjTyped, managedFields, err := f.updater.Apply(liveObjTyped, patchObjTyped, apiVersion, managed.Fields(), manager, force)
+	if err != nil {
+		return nil, nil, err
+	}
+	managed = NewManaged(managedFields, managed.Times())
+
+	if newObjTyped == nil {
+		return nil, managed, nil
+	}
+
+	newObj, err := f.typeConverter.TypedToObject(newObjTyped)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert new typed object (%v) to object: %v", objectGVKNN(patchObj), err)
+	}
+
+	newObjVersioned, err := f.toVersioned(newObj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert new object (%v) to proper version: %v", objectGVKNN(patchObj), err)
+	}
+	f.objectDefaulter.Default(newObjVersioned)
+
+	newObjUnversioned, err := f.toUnversioned(newObjVersioned)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to convert to unversioned (%v): %v", objectGVKNN(patchObj), err)
+	}
+	return newObjUnversioned, managed, nil
+}
+
+func (f *structuredMergeManager) toVersioned(obj runtime.Object) (runtime.Object, error) {
+	return f.objectConverter.ConvertToVersion(obj, f.groupVersion)
+}
+
+func (f *structuredMergeManager) toUnversioned(obj runtime.Object) (runtime.Object, error) {
+	return f.objectConverter.ConvertToVersion(obj, f.hubVersion)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/testdata/swagger.json b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/testdata/swagger.json
new file mode 100644
index 0000000000..b067dfc29f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/testdata/swagger.json
@@ -0,0 +1,4195 @@
+{
+  "definitions": {
+    "io.k8s.api.apps.v1.Deployment": {
+      "description": "Deployment enables declarative updates for Pods and ReplicaSets.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object metadata."
+        },
+        "spec": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1.DeploymentSpec",
+          "description": "Specification of the desired behavior of the Deployment."
+        },
+        "status": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1.DeploymentStatus",
+          "description": "Most recently observed status of the Deployment."
+        }
+      },
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "apps",
+          "kind": "Deployment",
+          "version": "v1"
+        }
+      ]
+    },
+    "io.k8s.api.apps.v1.DeploymentCondition": {
+      "description": "DeploymentCondition describes the state of a deployment at a certain point.",
+      "properties": {
+        "lastTransitionTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Last time the condition transitioned from one status to another."
+        },
+        "lastUpdateTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "The last time this condition was updated."
+        },
+        "message": {
+          "description": "A human readable message indicating details about the transition.",
+          "type": "string"
+        },
+        "reason": {
+          "description": "The reason for the condition's last transition.",
+          "type": "string"
+        },
+        "status": {
+          "description": "Status of the condition, one of True, False, Unknown.",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type of deployment condition.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "status"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1.DeploymentSpec": {
+      "description": "DeploymentSpec is the specification of the desired behavior of the Deployment.",
+      "properties": {
+        "minReadySeconds": {
+          "description": "Minimum number of seconds for which a newly created pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready)",
+          "format": "int32",
+          "type": "integer"
+        },
+        "paused": {
+          "description": "Indicates that the deployment is paused.",
+          "type": "boolean"
+        },
+        "progressDeadlineSeconds": {
+          "description": "The maximum time in seconds for a deployment to make progress before it is considered to be failed. The deployment controller will continue to process failed deployments and a condition with a ProgressDeadlineExceeded reason will be surfaced in the deployment status. Note that progress will not be estimated during the time a deployment is paused. Defaults to 600s.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Number of desired pods. This is a pointer to distinguish between explicit zero and not specified. Defaults to 1.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "revisionHistoryLimit": {
+          "description": "The number of old ReplicaSets to retain to allow rollback. This is a pointer to distinguish between explicit zero and not specified. Defaults to 10.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "selector": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector",
+          "description": "Label selector for pods. Existing ReplicaSets whose pods are selected by this will be the ones affected by this deployment. It must match the pod template's labels."
+        },
+        "strategy": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1.DeploymentStrategy",
+          "description": "The deployment strategy to use to replace existing pods with new ones.",
+          "x-kubernetes-patch-strategy": "retainKeys"
+        },
+        "template": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodTemplateSpec",
+          "description": "Template describes the pods that will be created."
+        }
+      },
+      "required": [
+        "selector",
+        "template"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1.DeploymentStatus": {
+      "description": "DeploymentStatus is the most recently observed status of the Deployment.",
+      "properties": {
+        "availableReplicas": {
+          "description": "Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "collisionCount": {
+          "description": "Count of hash collisions for the Deployment. The Deployment controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ReplicaSet.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "conditions": {
+          "description": "Represents the latest available observations of a deployment's current state.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.apps.v1.DeploymentCondition"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "type",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "observedGeneration": {
+          "description": "The generation observed by the deployment controller.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "readyReplicas": {
+          "description": "Total number of ready pods targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment (their labels match the selector).",
+          "format": "int32",
+          "type": "integer"
+        },
+        "unavailableReplicas": {
+          "description": "Total number of unavailable pods targeted by this deployment. This is the total number of pods that are still required for the deployment to have 100% available capacity. They may either be pods that are running but not yet available or pods that still have not been created.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "updatedReplicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment that have the desired template spec.",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1.DeploymentStrategy": {
+      "description": "DeploymentStrategy describes how to replace existing pods with new ones.",
+      "properties": {
+        "rollingUpdate": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1.RollingUpdateDeployment",
+          "description": "Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate."
+        },
+        "type": {
+          "description": "Type of deployment. Can be \"Recreate\" or \"RollingUpdate\". Default is RollingUpdate.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1.RollingUpdateDeployment": {
+      "description": "Spec to control the desired behavior of rolling update.",
+      "properties": {
+        "maxSurge": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be scheduled above the desired number of pods. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). This can not be 0 if MaxUnavailable is 0. Absolute number is calculated from percentage by rounding up. Defaults to 25%. Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when the rolling update starts, such that the total number of old and new pods do not exceed 130% of desired pods. Once old pods have been killed, new ReplicaSet can be scaled up further, ensuring that total number of pods running at any time during the update is at most 130% of desired pods."
+        },
+        "maxUnavailable": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be unavailable during the update. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). Absolute number is calculated from percentage by rounding down. This can not be 0 if MaxSurge is 0. Defaults to 25%. Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods immediately when the rolling update starts. Once new pods are ready, old ReplicaSet can be scaled down further, followed by scaling up the new ReplicaSet, ensuring that the total number of pods available at all times during the update is at least 70% of desired pods."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta1.Deployment": {
+      "description": "DEPRECATED - This group version of Deployment is deprecated by apps/v1beta2/Deployment. See the release notes for more information. Deployment enables declarative updates for Pods and ReplicaSets.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object metadata."
+        },
+        "spec": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta1.DeploymentSpec",
+          "description": "Specification of the desired behavior of the Deployment."
+        },
+        "status": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta1.DeploymentStatus",
+          "description": "Most recently observed status of the Deployment."
+        }
+      },
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "apps",
+          "kind": "Deployment",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "io.k8s.api.apps.v1beta1.DeploymentCondition": {
+      "description": "DeploymentCondition describes the state of a deployment at a certain point.",
+      "properties": {
+        "lastTransitionTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Last time the condition transitioned from one status to another."
+        },
+        "lastUpdateTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "The last time this condition was updated."
+        },
+        "message": {
+          "description": "A human readable message indicating details about the transition.",
+          "type": "string"
+        },
+        "reason": {
+          "description": "The reason for the condition's last transition.",
+          "type": "string"
+        },
+        "status": {
+          "description": "Status of the condition, one of True, False, Unknown.",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type of deployment condition.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "status"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta1.DeploymentRollback": {
+      "description": "DEPRECATED. DeploymentRollback stores the information required to rollback a deployment.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "name": {
+          "description": "Required: This must match the Name of a deployment.",
+          "type": "string"
+        },
+        "rollbackTo": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta1.RollbackConfig",
+          "description": "The config of this deployment rollback."
+        },
+        "updatedAnnotations": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "The annotations to be updated to a deployment",
+          "type": "object"
+        }
+      },
+      "required": [
+        "name",
+        "rollbackTo"
+      ],
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "apps",
+          "kind": "DeploymentRollback",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "io.k8s.api.apps.v1beta1.DeploymentSpec": {
+      "description": "DeploymentSpec is the specification of the desired behavior of the Deployment.",
+      "properties": {
+        "minReadySeconds": {
+          "description": "Minimum number of seconds for which a newly created pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready)",
+          "format": "int32",
+          "type": "integer"
+        },
+        "paused": {
+          "description": "Indicates that the deployment is paused.",
+          "type": "boolean"
+        },
+        "progressDeadlineSeconds": {
+          "description": "The maximum time in seconds for a deployment to make progress before it is considered to be failed. The deployment controller will continue to process failed deployments and a condition with a ProgressDeadlineExceeded reason will be surfaced in the deployment status. Note that progress will not be estimated during the time a deployment is paused. Defaults to 600s.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Number of desired pods. This is a pointer to distinguish between explicit zero and not specified. Defaults to 1.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "revisionHistoryLimit": {
+          "description": "The number of old ReplicaSets to retain to allow rollback. This is a pointer to distinguish between explicit zero and not specified. Defaults to 2.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "rollbackTo": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta1.RollbackConfig",
+          "description": "DEPRECATED. The config this deployment is rolling back to. Will be cleared after rollback is done."
+        },
+        "selector": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector",
+          "description": "Label selector for pods. Existing ReplicaSets whose pods are selected by this will be the ones affected by this deployment."
+        },
+        "strategy": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta1.DeploymentStrategy",
+          "description": "The deployment strategy to use to replace existing pods with new ones.",
+          "x-kubernetes-patch-strategy": "retainKeys"
+        },
+        "template": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodTemplateSpec",
+          "description": "Template describes the pods that will be created."
+        }
+      },
+      "required": [
+        "template"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta1.DeploymentStatus": {
+      "description": "DeploymentStatus is the most recently observed status of the Deployment.",
+      "properties": {
+        "availableReplicas": {
+          "description": "Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "collisionCount": {
+          "description": "Count of hash collisions for the Deployment. The Deployment controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ReplicaSet.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "conditions": {
+          "description": "Represents the latest available observations of a deployment's current state.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.apps.v1beta1.DeploymentCondition"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "type",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "observedGeneration": {
+          "description": "The generation observed by the deployment controller.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "readyReplicas": {
+          "description": "Total number of ready pods targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment (their labels match the selector).",
+          "format": "int32",
+          "type": "integer"
+        },
+        "unavailableReplicas": {
+          "description": "Total number of unavailable pods targeted by this deployment. This is the total number of pods that are still required for the deployment to have 100% available capacity. They may either be pods that are running but not yet available or pods that still have not been created.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "updatedReplicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment that have the desired template spec.",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta1.DeploymentStrategy": {
+      "description": "DeploymentStrategy describes how to replace existing pods with new ones.",
+      "properties": {
+        "rollingUpdate": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta1.RollingUpdateDeployment",
+          "description": "Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate."
+        },
+        "type": {
+          "description": "Type of deployment. Can be \"Recreate\" or \"RollingUpdate\". Default is RollingUpdate.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta1.RollbackConfig": {
+      "description": "DEPRECATED.",
+      "properties": {
+        "revision": {
+          "description": "The revision to rollback to. If set to 0, rollback to the last revision.",
+          "format": "int64",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta1.RollingUpdateDeployment": {
+      "description": "Spec to control the desired behavior of rolling update.",
+      "properties": {
+        "maxSurge": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be scheduled above the desired number of pods. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). This can not be 0 if MaxUnavailable is 0. Absolute number is calculated from percentage by rounding up. Defaults to 25%. Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when the rolling update starts, such that the total number of old and new pods do not exceed 130% of desired pods. Once old pods have been killed, new ReplicaSet can be scaled up further, ensuring that total number of pods running at any time during the update is at most 130% of desired pods."
+        },
+        "maxUnavailable": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be unavailable during the update. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). Absolute number is calculated from percentage by rounding down. This can not be 0 if MaxSurge is 0. Defaults to 25%. Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods immediately when the rolling update starts. Once new pods are ready, old ReplicaSet can be scaled down further, followed by scaling up the new ReplicaSet, ensuring that the total number of pods available at all times during the update is at least 70% of desired pods."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta2.Deployment": {
+      "description": "DEPRECATED - This group version of Deployment is deprecated by apps/v1/Deployment. See the release notes for more information. Deployment enables declarative updates for Pods and ReplicaSets.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object metadata."
+        },
+        "spec": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta2.DeploymentSpec",
+          "description": "Specification of the desired behavior of the Deployment."
+        },
+        "status": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta2.DeploymentStatus",
+          "description": "Most recently observed status of the Deployment."
+        }
+      },
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "apps",
+          "kind": "Deployment",
+          "version": "v1beta2"
+        }
+      ]
+    },
+    "io.k8s.api.apps.v1beta2.DeploymentCondition": {
+      "description": "DeploymentCondition describes the state of a deployment at a certain point.",
+      "properties": {
+        "lastTransitionTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Last time the condition transitioned from one status to another."
+        },
+        "lastUpdateTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "The last time this condition was updated."
+        },
+        "message": {
+          "description": "A human readable message indicating details about the transition.",
+          "type": "string"
+        },
+        "reason": {
+          "description": "The reason for the condition's last transition.",
+          "type": "string"
+        },
+        "status": {
+          "description": "Status of the condition, one of True, False, Unknown.",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type of deployment condition.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "status"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta2.DeploymentSpec": {
+      "description": "DeploymentSpec is the specification of the desired behavior of the Deployment.",
+      "properties": {
+        "minReadySeconds": {
+          "description": "Minimum number of seconds for which a newly created pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready)",
+          "format": "int32",
+          "type": "integer"
+        },
+        "paused": {
+          "description": "Indicates that the deployment is paused.",
+          "type": "boolean"
+        },
+        "progressDeadlineSeconds": {
+          "description": "The maximum time in seconds for a deployment to make progress before it is considered to be failed. The deployment controller will continue to process failed deployments and a condition with a ProgressDeadlineExceeded reason will be surfaced in the deployment status. Note that progress will not be estimated during the time a deployment is paused. Defaults to 600s.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Number of desired pods. This is a pointer to distinguish between explicit zero and not specified. Defaults to 1.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "revisionHistoryLimit": {
+          "description": "The number of old ReplicaSets to retain to allow rollback. This is a pointer to distinguish between explicit zero and not specified. Defaults to 10.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "selector": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector",
+          "description": "Label selector for pods. Existing ReplicaSets whose pods are selected by this will be the ones affected by this deployment. It must match the pod template's labels."
+        },
+        "strategy": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta2.DeploymentStrategy",
+          "description": "The deployment strategy to use to replace existing pods with new ones.",
+          "x-kubernetes-patch-strategy": "retainKeys"
+        },
+        "template": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodTemplateSpec",
+          "description": "Template describes the pods that will be created."
+        }
+      },
+      "required": [
+        "selector",
+        "template"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta2.DeploymentStatus": {
+      "description": "DeploymentStatus is the most recently observed status of the Deployment.",
+      "properties": {
+        "availableReplicas": {
+          "description": "Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "collisionCount": {
+          "description": "Count of hash collisions for the Deployment. The Deployment controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ReplicaSet.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "conditions": {
+          "description": "Represents the latest available observations of a deployment's current state.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.apps.v1beta2.DeploymentCondition"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "type",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "observedGeneration": {
+          "description": "The generation observed by the deployment controller.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "readyReplicas": {
+          "description": "Total number of ready pods targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment (their labels match the selector).",
+          "format": "int32",
+          "type": "integer"
+        },
+        "unavailableReplicas": {
+          "description": "Total number of unavailable pods targeted by this deployment. This is the total number of pods that are still required for the deployment to have 100% available capacity. They may either be pods that are running but not yet available or pods that still have not been created.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "updatedReplicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment that have the desired template spec.",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta2.DeploymentStrategy": {
+      "description": "DeploymentStrategy describes how to replace existing pods with new ones.",
+      "properties": {
+        "rollingUpdate": {
+          "$ref": "#/definitions/io.k8s.api.apps.v1beta2.RollingUpdateDeployment",
+          "description": "Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate."
+        },
+        "type": {
+          "description": "Type of deployment. Can be \"Recreate\" or \"RollingUpdate\". Default is RollingUpdate.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.apps.v1beta2.RollingUpdateDeployment": {
+      "description": "Spec to control the desired behavior of rolling update.",
+      "properties": {
+        "maxSurge": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be scheduled above the desired number of pods. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). This can not be 0 if MaxUnavailable is 0. Absolute number is calculated from percentage by rounding up. Defaults to 25%. Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when the rolling update starts, such that the total number of old and new pods do not exceed 130% of desired pods. Once old pods have been killed, new ReplicaSet can be scaled up further, ensuring that total number of pods running at any time during the update is at most 130% of desired pods."
+        },
+        "maxUnavailable": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be unavailable during the update. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). Absolute number is calculated from percentage by rounding down. This can not be 0 if MaxSurge is 0. Defaults to 25%. Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods immediately when the rolling update starts. Once new pods are ready, old ReplicaSet can be scaled down further, followed by scaling up the new ReplicaSet, ensuring that the total number of pods available at all times during the update is at least 70% of desired pods."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.AWSElasticBlockStoreVolumeSource": {
+      "description": "Represents a Persistent Disk resource in AWS.\n\nAn AWS EBS disk must exist before mounting to a container. The disk must also be in the same AWS zone as the kubelet. An AWS EBS disk can only be mounted as read/write once. AWS EBS volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore",
+          "type": "string"
+        },
+        "partition": {
+          "description": "The partition in the volume that you want to mount. If omitted, the default is to mount by volume name. Examples: For volume /dev/sda1, you specify the partition as \"1\". Similarly, the volume partition for /dev/sda is \"0\" (or you can leave the property empty).",
+          "format": "int32",
+          "type": "integer"
+        },
+        "readOnly": {
+          "description": "Specify \"true\" to force and set the ReadOnly property in VolumeMounts to \"true\". If omitted, the default is \"false\". More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore",
+          "type": "boolean"
+        },
+        "volumeID": {
+          "description": "Unique ID of the persistent disk resource in AWS (Amazon EBS volume). More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore",
+          "type": "string"
+        }
+      },
+      "required": [
+        "volumeID"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Affinity": {
+      "description": "Affinity is a group of affinity scheduling rules.",
+      "properties": {
+        "nodeAffinity": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.NodeAffinity",
+          "description": "Describes node affinity scheduling rules for the pod."
+        },
+        "podAffinity": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodAffinity",
+          "description": "Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s))."
+        },
+        "podAntiAffinity": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodAntiAffinity",
+          "description": "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s))."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.AttachedVolume": {
+      "description": "AttachedVolume describes a volume attached to a node",
+      "properties": {
+        "devicePath": {
+          "description": "DevicePath represents the device path where the volume should be available",
+          "type": "string"
+        },
+        "name": {
+          "description": "Name of the attached volume",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "devicePath"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.AzureDiskVolumeSource": {
+      "description": "AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.",
+      "properties": {
+        "cachingMode": {
+          "description": "Host Caching mode: None, Read Only, Read Write.",
+          "type": "string"
+        },
+        "diskName": {
+          "description": "The Name of the data disk in the blob storage",
+          "type": "string"
+        },
+        "diskURI": {
+          "description": "The URI the data disk in the blob storage",
+          "type": "string"
+        },
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Expected values Shared: multiple blob disks per storage account  Dedicated: single blob disk per storage account  Managed: azure managed data disk (only in managed availability set). defaults to shared",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "diskName",
+        "diskURI"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.AzureFileVolumeSource": {
+      "description": "AzureFile represents an Azure File Service mount on the host and bind mount to the pod.",
+      "properties": {
+        "readOnly": {
+          "description": "Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+          "type": "boolean"
+        },
+        "secretName": {
+          "description": "the name of secret that contains Azure Storage Account Name and Key",
+          "type": "string"
+        },
+        "shareName": {
+          "description": "Share Name",
+          "type": "string"
+        }
+      },
+      "required": [
+        "secretName",
+        "shareName"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.CSIVolumeSource": {
+      "description": "Represents a source location of a volume to mount, managed by an external CSI driver",
+      "properties": {
+        "driver": {
+          "description": "Driver is the name of the CSI driver that handles this volume. Consult with your admin for the correct name as registered in the cluster.",
+          "type": "string"
+        },
+        "fsType": {
+          "description": "Filesystem type to mount. Ex. \"ext4\", \"xfs\", \"ntfs\". If not provided, the empty value is passed to the associated CSI driver which will determine the default filesystem to apply.",
+          "type": "string"
+        },
+        "nodePublishSecretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "NodePublishSecretRef is a reference to the secret object containing sensitive information to pass to the CSI driver to complete the CSI NodePublishVolume and NodeUnpublishVolume calls. This field is optional, and  may be empty if no secret is required. If the secret object contains more than one secret, all secret references are passed."
+        },
+        "readOnly": {
+          "description": "Specifies a read-only configuration for the volume. Defaults to false (read/write).",
+          "type": "boolean"
+        },
+        "volumeAttributes": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "VolumeAttributes stores driver-specific properties that are passed to the CSI driver. Consult your driver's documentation for supported values.",
+          "type": "object"
+        }
+      },
+      "required": [
+        "driver"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Capabilities": {
+      "description": "Adds and removes POSIX capabilities from running containers.",
+      "properties": {
+        "add": {
+          "description": "Added capabilities",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "drop": {
+          "description": "Removed capabilities",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.CephFSVolumeSource": {
+      "description": "Represents a Ceph Filesystem mount that lasts the lifetime of a pod Cephfs volumes do not support ownership management or SELinux relabeling.",
+      "properties": {
+        "monitors": {
+          "description": "Required: Monitors is a collection of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "path": {
+          "description": "Optional: Used as the mounted root, rather than the full Ceph tree, default is /",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it",
+          "type": "boolean"
+        },
+        "secretFile": {
+          "description": "Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it",
+          "type": "string"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "Optional: SecretRef is reference to the authentication secret for User, default is empty. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it"
+        },
+        "user": {
+          "description": "Optional: User is the rados user name, default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it",
+          "type": "string"
+        }
+      },
+      "required": [
+        "monitors"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.CinderVolumeSource": {
+      "description": "Represents a cinder volume resource in Openstack. A Cinder volume must exist before mounting to a container. The volume must also be in the same region as the kubelet. Cinder volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Examples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. More info: https://examples.k8s.io/mysql-cinder-pd/README.md",
+          "type": "boolean"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "Optional: points to a secret object containing parameters used to connect to OpenStack."
+        },
+        "volumeID": {
+          "description": "volume id used to identify the volume in cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md",
+          "type": "string"
+        }
+      },
+      "required": [
+        "volumeID"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ClientIPConfig": {
+      "description": "ClientIPConfig represents the configurations of Client IP based session affinity.",
+      "properties": {
+        "timeoutSeconds": {
+          "description": "timeoutSeconds specifies the seconds of ClientIP type session sticky time. The value must be >0 && <=86400(for 1 day) if ServiceAffinity == \"ClientIP\". Default value is 10800(for 3 hours).",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ComponentCondition": {
+      "description": "Information about the condition of a component.",
+      "properties": {
+        "error": {
+          "description": "Condition error code for a component. For example, a health check error code.",
+          "type": "string"
+        },
+        "message": {
+          "description": "Message about the condition for a component. For example, information about a health check.",
+          "type": "string"
+        },
+        "status": {
+          "description": "Status of the condition for a component. Valid values for \"Healthy\": \"True\", \"False\", or \"Unknown\".",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type of condition for a component. Valid value: \"Healthy\"",
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "status"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ConfigMapEnvSource": {
+      "description": "ConfigMapEnvSource selects a ConfigMap to populate the environment variables with.\n\nThe contents of the target ConfigMap's Data field will represent the key-value pairs as environment variables.",
+      "properties": {
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "optional": {
+          "description": "Specify whether the ConfigMap must be defined",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ConfigMapKeySelector": {
+      "description": "Selects a key from a ConfigMap.",
+      "properties": {
+        "key": {
+          "description": "The key to select.",
+          "type": "string"
+        },
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "optional": {
+          "description": "Specify whether the ConfigMap or its key must be defined",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "key"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ConfigMapNodeConfigSource": {
+      "description": "ConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node.",
+      "properties": {
+        "kubeletConfigKey": {
+          "description": "KubeletConfigKey declares which key of the referenced ConfigMap corresponds to the KubeletConfiguration structure This field is required in all cases.",
+          "type": "string"
+        },
+        "name": {
+          "description": "Name is the metadata.name of the referenced ConfigMap. This field is required in all cases.",
+          "type": "string"
+        },
+        "namespace": {
+          "description": "Namespace is the metadata.namespace of the referenced ConfigMap. This field is required in all cases.",
+          "type": "string"
+        },
+        "resourceVersion": {
+          "description": "ResourceVersion is the metadata.ResourceVersion of the referenced ConfigMap. This field is forbidden in Node.Spec, and required in Node.Status.",
+          "type": "string"
+        },
+        "uid": {
+          "description": "UID is the metadata.UID of the referenced ConfigMap. This field is forbidden in Node.Spec, and required in Node.Status.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "namespace",
+        "name",
+        "kubeletConfigKey"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ConfigMapProjection": {
+      "description": "Adapts a ConfigMap into a projected volume.\n\nThe contents of the target ConfigMap's Data field will be presented in a projected volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths. Note that this is identical to a configmap volume source without the default mode.",
+      "properties": {
+        "items": {
+          "description": "If unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.KeyToPath"
+          },
+          "type": "array"
+        },
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "optional": {
+          "description": "Specify whether the ConfigMap or its keys must be defined",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ConfigMapVolumeSource": {
+      "description": "Adapts a ConfigMap into a volume.\n\nThe contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths. ConfigMap volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "defaultMode": {
+          "description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "items": {
+          "description": "If unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.KeyToPath"
+          },
+          "type": "array"
+        },
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "optional": {
+          "description": "Specify whether the ConfigMap or its keys must be defined",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Container": {
+      "description": "A single application container that you want to run within a pod.",
+      "properties": {
+        "args": {
+          "description": "Arguments to the entrypoint. The container image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "command": {
+          "description": "Entrypoint array. Not executed within a shell. The container image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "env": {
+          "description": "List of environment variables to set in the container. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.EnvVar"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "envFrom": {
+          "description": "List of sources to populate environment variables in the container. The keys defined within a source must be a C_IDENTIFIER. All invalid keys will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.EnvFromSource"
+          },
+          "type": "array"
+        },
+        "image": {
+          "description": "Docker image name. More info: https://kubernetes.io/docs/concepts/containers/images This field is optional to allow higher level config management to default or override container images in workload controllers like Deployments and StatefulSets.",
+          "type": "string"
+        },
+        "imagePullPolicy": {
+          "description": "Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images",
+          "type": "string"
+        },
+        "lifecycle": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Lifecycle",
+          "description": "Actions that the management system should take in response to container lifecycle events. Cannot be updated."
+        },
+        "livenessProbe": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Probe",
+          "description": "Periodic probe of container liveness. Container will be restarted if the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes"
+        },
+        "name": {
+          "description": "Name of the container specified as a DNS_LABEL. Each container in a pod must have a unique name (DNS_LABEL). Cannot be updated.",
+          "type": "string"
+        },
+        "ports": {
+          "description": "List of ports to expose from the container. Exposing a port here gives the system additional information about the network connections a container uses, but is primarily informational. Not specifying a port here DOES NOT prevent that port from being exposed. Any port which is listening on the default \"0.0.0.0\" address inside a container will be accessible from the network. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.ContainerPort"
+          },
+          "type": "array",
+          "x-kubernetes-list-map-keys": [
+            "containerPort",
+            "protocol"
+          ],
+          "x-kubernetes-list-type": "map",
+          "x-kubernetes-patch-merge-key": "containerPort",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "readinessProbe": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Probe",
+          "description": "Periodic probe of container service readiness. Container will be removed from service endpoints if the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes"
+        },
+        "resources": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ResourceRequirements",
+          "description": "Compute Resources required by this container. Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/"
+        },
+        "securityContext": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SecurityContext",
+          "description": "Security options the pod should run with. More info: https://kubernetes.io/docs/concepts/policy/security-context/ More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/"
+        },
+        "startupProbe": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Probe",
+          "description": "StartupProbe indicates that the Pod has successfully initialized. If specified, no other probes are executed until this completes successfully. If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, when it might take a long time to load data or warm a cache, than during steady-state operation. This cannot be updated. This is an alpha feature enabled by the StartupProbe feature flag. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes"
+        },
+        "stdin": {
+          "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this is not set, reads from stdin in the container will always result in EOF. Default is false.",
+          "type": "boolean"
+        },
+        "stdinOnce": {
+          "description": "Whether the container runtime should close the stdin channel after it has been opened by a single attach. When stdin is true the stdin stream will remain open across multiple attach sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the first client attaches to stdin, and then remains open and accepts data until the client disconnects, at which time stdin is closed and remains closed until the container is restarted. If this flag is false, a container processes that reads from stdin will never receive an EOF. Default is false",
+          "type": "boolean"
+        },
+        "terminationMessagePath": {
+          "description": "Optional: Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log. Cannot be updated.",
+          "type": "string"
+        },
+        "terminationMessagePolicy": {
+          "description": "Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.",
+          "type": "string"
+        },
+        "tty": {
+          "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true. Default is false.",
+          "type": "boolean"
+        },
+        "volumeDevices": {
+          "description": "volumeDevices is the list of block devices to be used by the container. This is a beta feature.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.VolumeDevice"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "devicePath",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "volumeMounts": {
+          "description": "Pod volumes to mount into the container's filesystem. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.VolumeMount"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "mountPath",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "workingDir": {
+          "description": "Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. Cannot be updated.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ContainerImage": {
+      "description": "Describe a container image",
+      "properties": {
+        "names": {
+          "description": "Names by which this image is known. e.g. [\"registry.k8s.io/hyperkube:v1.0.7\", \"dockerhub.io/google_containers/hyperkube:v1.0.7\"]",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "sizeBytes": {
+          "description": "The size of the image in bytes.",
+          "format": "int64",
+          "type": "integer"
+        }
+      },
+      "required": [
+        "names"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ContainerPort": {
+      "description": "ContainerPort represents a network port in a single container.",
+      "properties": {
+        "containerPort": {
+          "description": "Number of port to expose on the pod's IP address. This must be a valid port number, 0 < x < 65536.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "hostIP": {
+          "description": "What host IP to bind the external port to.",
+          "type": "string"
+        },
+        "hostPort": {
+          "description": "Number of port to expose on the host. If specified, this must be a valid port number, 0 < x < 65536. If HostNetwork is specified, this must match ContainerPort. Most containers do not need this.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "name": {
+          "description": "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each named port in a pod must have a unique name. Name for the port that can be referred to by services.",
+          "type": "string"
+        },
+        "protocol": {
+          "description": "Protocol for port. Must be UDP, TCP, or SCTP. Defaults to \"TCP\".",
+          "type": "string"
+        }
+      },
+      "required": [
+        "containerPort"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ContainerState": {
+      "description": "ContainerState holds a possible state of container. Only one of its members may be specified. If none of them is specified, the default one is ContainerStateWaiting.",
+      "properties": {
+        "running": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ContainerStateRunning",
+          "description": "Details about a running container"
+        },
+        "terminated": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ContainerStateTerminated",
+          "description": "Details about a terminated container"
+        },
+        "waiting": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ContainerStateWaiting",
+          "description": "Details about a waiting container"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ContainerStateRunning": {
+      "description": "ContainerStateRunning is a running state of a container.",
+      "properties": {
+        "startedAt": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Time at which the container was last (re-)started"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ContainerStateTerminated": {
+      "description": "ContainerStateTerminated is a terminated state of a container.",
+      "properties": {
+        "containerID": {
+          "description": "Container's ID in the format 'docker://<container_id>'",
+          "type": "string"
+        },
+        "exitCode": {
+          "description": "Exit status from the last termination of the container",
+          "format": "int32",
+          "type": "integer"
+        },
+        "finishedAt": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Time at which the container last terminated"
+        },
+        "message": {
+          "description": "Message regarding the last termination of the container",
+          "type": "string"
+        },
+        "reason": {
+          "description": "(brief) reason from the last termination of the container",
+          "type": "string"
+        },
+        "signal": {
+          "description": "Signal from the last termination of the container",
+          "format": "int32",
+          "type": "integer"
+        },
+        "startedAt": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Time at which previous execution of the container started"
+        }
+      },
+      "required": [
+        "exitCode"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ContainerStateWaiting": {
+      "description": "ContainerStateWaiting is a waiting state of a container.",
+      "properties": {
+        "message": {
+          "description": "Message regarding why the container is not yet running.",
+          "type": "string"
+        },
+        "reason": {
+          "description": "(brief) reason the container is not yet running.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ContainerStatus": {
+      "description": "ContainerStatus contains details for the current status of this container.",
+      "properties": {
+        "containerID": {
+          "description": "Container's ID in the format 'docker://<container_id>'.",
+          "type": "string"
+        },
+        "image": {
+          "description": "The image the container is running. More info: https://kubernetes.io/docs/concepts/containers/images",
+          "type": "string"
+        },
+        "imageID": {
+          "description": "ImageID of the container's image.",
+          "type": "string"
+        },
+        "lastState": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ContainerState",
+          "description": "Details about the container's last termination condition."
+        },
+        "name": {
+          "description": "This must be a DNS_LABEL. Each container in a pod must have a unique name. Cannot be updated.",
+          "type": "string"
+        },
+        "ready": {
+          "description": "Specifies whether the container has passed its readiness probe.",
+          "type": "boolean"
+        },
+        "restartCount": {
+          "description": "The number of times the container has been restarted, currently based on the number of dead containers that have not yet been removed. Note that this is calculated from dead containers. But those containers are subject to garbage collection. This value will get capped at 5 by GC.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "started": {
+          "description": "Specifies whether the container has passed its startup probe. Initialized as false, becomes true after startupProbe is considered successful. Resets to false when the container is restarted, or if kubelet loses state temporarily. Is always true when no startupProbe is defined.",
+          "type": "boolean"
+        },
+        "state": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ContainerState",
+          "description": "Details about the container's current condition."
+        }
+      },
+      "required": [
+        "name",
+        "ready",
+        "restartCount",
+        "image",
+        "imageID"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.DownwardAPIProjection": {
+      "description": "Represents downward API info for projecting into a projected volume. Note that this is identical to a downwardAPI volume source without the default mode.",
+      "properties": {
+        "items": {
+          "description": "Items is a list of DownwardAPIVolume file",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.DownwardAPIVolumeFile"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.DownwardAPIVolumeFile": {
+      "description": "DownwardAPIVolumeFile represents information to create the file containing the pod field",
+      "properties": {
+        "fieldRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ObjectFieldSelector",
+          "description": "Required: Selects a field of the pod: only annotations, labels, name and namespace are supported."
+        },
+        "mode": {
+          "description": "Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "path": {
+          "description": "Required: Path is  the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'",
+          "type": "string"
+        },
+        "resourceFieldRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ResourceFieldSelector",
+          "description": "Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported."
+        }
+      },
+      "required": [
+        "path"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.DownwardAPIVolumeSource": {
+      "description": "DownwardAPIVolumeSource represents a volume containing downward API info. Downward API volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "defaultMode": {
+          "description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "items": {
+          "description": "Items is a list of downward API volume file",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.DownwardAPIVolumeFile"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.EmptyDirVolumeSource": {
+      "description": "Represents an empty directory for a pod. Empty directory volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "medium": {
+          "description": "What type of storage medium should back this directory. The default is \"\" which means to use the node's default medium. Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir",
+          "type": "string"
+        },
+        "sizeLimit": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity",
+          "description": "Total amount of local storage required for this EmptyDir volume. The size limit is also applicable for memory medium. The maximum usage on memory medium EmptyDir would be the minimum value between the SizeLimit specified here and the sum of memory limits of all containers in a pod. The default is nil which means that the limit is undefined. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.EnvFromSource": {
+      "description": "EnvFromSource represents the source of a set of ConfigMaps",
+      "properties": {
+        "configMapRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ConfigMapEnvSource",
+          "description": "The ConfigMap to select from"
+        },
+        "prefix": {
+          "description": "An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.",
+          "type": "string"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SecretEnvSource",
+          "description": "The Secret to select from"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.EnvVar": {
+      "description": "EnvVar represents an environment variable present in a Container.",
+      "properties": {
+        "name": {
+          "description": "Name of the environment variable. Must be a C_IDENTIFIER.",
+          "type": "string"
+        },
+        "value": {
+          "description": "Variable references $(VAR_NAME) are expanded using the previous defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to \"\".",
+          "type": "string"
+        },
+        "valueFrom": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.EnvVarSource",
+          "description": "Source for the environment variable's value. Cannot be used if value is not empty."
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.EnvVarSource": {
+      "description": "EnvVarSource represents a source for the value of an EnvVar.",
+      "properties": {
+        "configMapKeyRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ConfigMapKeySelector",
+          "description": "Selects a key of a ConfigMap."
+        },
+        "fieldRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ObjectFieldSelector",
+          "description": "Selects a field of the pod: supports metadata.name, metadata.namespace, metadata.labels, metadata.annotations, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs."
+        },
+        "resourceFieldRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ResourceFieldSelector",
+          "description": "Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported."
+        },
+        "secretKeyRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SecretKeySelector",
+          "description": "Selects a key of a secret in the pod's namespace"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.EphemeralContainer": {
+      "description": "An EphemeralContainer is a container that may be added temporarily to an existing pod for user-initiated activities such as debugging. Ephemeral containers have no resource or scheduling guarantees, and they will not be restarted when they exit or when a pod is removed or restarted. If an ephemeral container causes a pod to exceed its resource allocation, the pod may be evicted. Ephemeral containers may not be added by directly updating the pod spec. They must be added via the pod's ephemeralcontainers subresource, and they will appear in the pod spec once added.",
+      "properties": {
+        "args": {
+          "description": "Arguments to the entrypoint. The container image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "command": {
+          "description": "Entrypoint array. Not executed within a shell. The container image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "env": {
+          "description": "List of environment variables to set in the container. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.EnvVar"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "envFrom": {
+          "description": "List of sources to populate environment variables in the container. The keys defined within a source must be a C_IDENTIFIER. All invalid keys will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.EnvFromSource"
+          },
+          "type": "array"
+        },
+        "image": {
+          "description": "Docker image name. More info: https://kubernetes.io/docs/concepts/containers/images",
+          "type": "string"
+        },
+        "imagePullPolicy": {
+          "description": "Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images",
+          "type": "string"
+        },
+        "lifecycle": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Lifecycle",
+          "description": "Lifecycle is not allowed for ephemeral containers."
+        },
+        "livenessProbe": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Probe",
+          "description": "Probes are not allowed for ephemeral containers."
+        },
+        "name": {
+          "description": "Name of the ephemeral container specified as a DNS_LABEL. This name must be unique among all containers, init containers and ephemeral containers.",
+          "type": "string"
+        },
+        "ports": {
+          "description": "Ports are not allowed for ephemeral containers.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.ContainerPort"
+          },
+          "type": "array"
+        },
+        "readinessProbe": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Probe",
+          "description": "Probes are not allowed for ephemeral containers."
+        },
+        "resources": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ResourceRequirements",
+          "description": "Resources are not allowed for ephemeral containers. Ephemeral containers use spare resources already allocated to the pod."
+        },
+        "securityContext": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SecurityContext",
+          "description": "SecurityContext is not allowed for ephemeral containers."
+        },
+        "startupProbe": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Probe",
+          "description": "Probes are not allowed for ephemeral containers."
+        },
+        "stdin": {
+          "description": "Whether this container should allocate a buffer for stdin in the container runtime. If this is not set, reads from stdin in the container will always result in EOF. Default is false.",
+          "type": "boolean"
+        },
+        "stdinOnce": {
+          "description": "Whether the container runtime should close the stdin channel after it has been opened by a single attach. When stdin is true the stdin stream will remain open across multiple attach sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the first client attaches to stdin, and then remains open and accepts data until the client disconnects, at which time stdin is closed and remains closed until the container is restarted. If this flag is false, a container processes that reads from stdin will never receive an EOF. Default is false",
+          "type": "boolean"
+        },
+        "targetContainerName": {
+          "description": "If set, the name of the container from PodSpec that this ephemeral container targets. The ephemeral container will be run in the namespaces (IPC, PID, etc) of this container. If not set then the ephemeral container is run in whatever namespaces are shared for the pod. Note that the container runtime must support this feature.",
+          "type": "string"
+        },
+        "terminationMessagePath": {
+          "description": "Optional: Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log. Cannot be updated.",
+          "type": "string"
+        },
+        "terminationMessagePolicy": {
+          "description": "Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.",
+          "type": "string"
+        },
+        "tty": {
+          "description": "Whether this container should allocate a TTY for itself, also requires 'stdin' to be true. Default is false.",
+          "type": "boolean"
+        },
+        "volumeDevices": {
+          "description": "volumeDevices is the list of block devices to be used by the container. This is a beta feature.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.VolumeDevice"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "devicePath",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "volumeMounts": {
+          "description": "Pod volumes to mount into the container's filesystem. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.VolumeMount"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "mountPath",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "workingDir": {
+          "description": "Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. Cannot be updated.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ExecAction": {
+      "description": "ExecAction describes a \"run in container\" action.",
+      "properties": {
+        "command": {
+          "description": "Command is the command line to execute inside the container, the working directory for the command  is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.FCVolumeSource": {
+      "description": "Represents a Fibre Channel volume. Fibre Channel volumes can only be mounted as read/write once. Fibre Channel volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.",
+          "type": "string"
+        },
+        "lun": {
+          "description": "Optional: FC target lun number",
+          "format": "int32",
+          "type": "integer"
+        },
+        "readOnly": {
+          "description": "Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+          "type": "boolean"
+        },
+        "targetWWNs": {
+          "description": "Optional: FC target worldwide names (WWNs)",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "wwids": {
+          "description": "Optional: FC volume world wide identifiers (wwids) Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.FlexVolumeSource": {
+      "description": "FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin.",
+      "properties": {
+        "driver": {
+          "description": "Driver is the name of the driver to use for this volume.",
+          "type": "string"
+        },
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". The default filesystem depends on FlexVolume script.",
+          "type": "string"
+        },
+        "options": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Optional: Extra command options if any.",
+          "type": "object"
+        },
+        "readOnly": {
+          "description": "Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+          "type": "boolean"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "Optional: SecretRef is reference to the secret object containing sensitive information to pass to the plugin scripts. This may be empty if no secret object is specified. If the secret object contains more than one secret, all secrets are passed to the plugin scripts."
+        }
+      },
+      "required": [
+        "driver"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.FlockerVolumeSource": {
+      "description": "Represents a Flocker volume mounted by the Flocker agent. One and only one of datasetName and datasetUUID should be set. Flocker volumes do not support ownership management or SELinux relabeling.",
+      "properties": {
+        "datasetName": {
+          "description": "Name of the dataset stored as metadata -> name on the dataset for Flocker should be considered as deprecated",
+          "type": "string"
+        },
+        "datasetUUID": {
+          "description": "UUID of the dataset. This is unique identifier of a Flocker dataset",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.GCEPersistentDiskVolumeSource": {
+      "description": "Represents a Persistent Disk resource in Google Compute Engine.\n\nA GCE PD must exist before mounting to a container. The disk must also be in the same GCE project and zone as the kubelet. A GCE PD can only be mounted as read/write once or read-only many times. GCE PDs support ownership management and SELinux relabeling.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk",
+          "type": "string"
+        },
+        "partition": {
+          "description": "The partition in the volume that you want to mount. If omitted, the default is to mount by volume name. Examples: For volume /dev/sda1, you specify the partition as \"1\". Similarly, the volume partition for /dev/sda is \"0\" (or you can leave the property empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk",
+          "format": "int32",
+          "type": "integer"
+        },
+        "pdName": {
+          "description": "Unique name of the PD resource in GCE. Used to identify the disk in GCE. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "ReadOnly here will force the ReadOnly setting in VolumeMounts. Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "pdName"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.GitRepoVolumeSource": {
+      "description": "Represents a volume that is populated with the contents of a git repository. Git repo volumes do not support ownership management. Git repo volumes support SELinux relabeling.\n\nDEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir into the Pod's container.",
+      "properties": {
+        "directory": {
+          "description": "Target directory name. Must not contain or start with '..'.  If '.' is supplied, the volume directory will be the git repository.  Otherwise, if specified, the volume will contain the git repository in the subdirectory with the given name.",
+          "type": "string"
+        },
+        "repository": {
+          "description": "Repository URL",
+          "type": "string"
+        },
+        "revision": {
+          "description": "Commit hash for the specified revision.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "repository"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.GlusterfsVolumeSource": {
+      "description": "Represents a Glusterfs mount that lasts the lifetime of a pod. Glusterfs volumes do not support ownership management or SELinux relabeling.",
+      "properties": {
+        "endpoints": {
+          "description": "EndpointsName is the endpoint name that details Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod",
+          "type": "string"
+        },
+        "path": {
+          "description": "Path is the Glusterfs volume path. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "ReadOnly here will force the Glusterfs volume to be mounted with read-only permissions. Defaults to false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "endpoints",
+        "path"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.HTTPGetAction": {
+      "description": "HTTPGetAction describes an action based on HTTP Get requests.",
+      "properties": {
+        "host": {
+          "description": "Host name to connect to, defaults to the pod IP. You probably want to set \"Host\" in httpHeaders instead.",
+          "type": "string"
+        },
+        "httpHeaders": {
+          "description": "Custom headers to set in the request. HTTP allows repeated headers.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.HTTPHeader"
+          },
+          "type": "array"
+        },
+        "path": {
+          "description": "Path to access on the HTTP server.",
+          "type": "string"
+        },
+        "port": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "Name or number of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME."
+        },
+        "scheme": {
+          "description": "Scheme to use for connecting to the host. Defaults to HTTP.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "port"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.HTTPHeader": {
+      "description": "HTTPHeader describes a custom header to be used in HTTP probes",
+      "properties": {
+        "name": {
+          "description": "The header field name",
+          "type": "string"
+        },
+        "value": {
+          "description": "The header field value",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "value"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Handler": {
+      "description": "Handler defines a specific action that should be taken",
+      "properties": {
+        "exec": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ExecAction",
+          "description": "One and only one of the following should be specified. Exec specifies the action to take."
+        },
+        "httpGet": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.HTTPGetAction",
+          "description": "HTTPGet specifies the http request to perform."
+        },
+        "tcpSocket": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.TCPSocketAction",
+          "description": "TCPSocket specifies an action involving a TCP port. TCP hooks not yet supported"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.HostAlias": {
+      "description": "HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the pod's hosts file.",
+      "properties": {
+        "hostnames": {
+          "description": "Hostnames for the above IP address.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "ip": {
+          "description": "IP address of the host file entry.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.HostPathVolumeSource": {
+      "description": "Represents a host path mapped into a pod. Host path volumes do not support ownership management or SELinux relabeling.",
+      "properties": {
+        "path": {
+          "description": "Path of the directory on the host. If the path is a symlink, it will follow the link to the real path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type for HostPath Volume Defaults to \"\" More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath",
+          "type": "string"
+        }
+      },
+      "required": [
+        "path"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ISCSIVolumeSource": {
+      "description": "Represents an ISCSI disk. ISCSI volumes can only be mounted as read/write once. ISCSI volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "chapAuthDiscovery": {
+          "description": "whether support iSCSI Discovery CHAP authentication",
+          "type": "boolean"
+        },
+        "chapAuthSession": {
+          "description": "whether support iSCSI Session CHAP authentication",
+          "type": "boolean"
+        },
+        "fsType": {
+          "description": "Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi",
+          "type": "string"
+        },
+        "initiatorName": {
+          "description": "Custom iSCSI Initiator Name. If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface <target portal>:<volume name> will be created for the connection.",
+          "type": "string"
+        },
+        "iqn": {
+          "description": "Target iSCSI Qualified Name.",
+          "type": "string"
+        },
+        "iscsiInterface": {
+          "description": "iSCSI Interface Name that uses an iSCSI transport. Defaults to 'default' (tcp).",
+          "type": "string"
+        },
+        "lun": {
+          "description": "iSCSI Target Lun number.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "portals": {
+          "description": "iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port is other than default (typically TCP ports 860 and 3260).",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "readOnly": {
+          "description": "ReadOnly here will force the ReadOnly setting in VolumeMounts. Defaults to false.",
+          "type": "boolean"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "CHAP Secret for iSCSI target and initiator authentication"
+        },
+        "targetPortal": {
+          "description": "iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port is other than default (typically TCP ports 860 and 3260).",
+          "type": "string"
+        }
+      },
+      "required": [
+        "targetPortal",
+        "iqn",
+        "lun"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.KeyToPath": {
+      "description": "Maps a string key to a path within a volume.",
+      "properties": {
+        "key": {
+          "description": "The key to project.",
+          "type": "string"
+        },
+        "mode": {
+          "description": "Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "path": {
+          "description": "The relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "key",
+        "path"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Lifecycle": {
+      "description": "Lifecycle describes actions that the management system should take in response to container lifecycle events. For the PostStart and PreStop lifecycle handlers, management of the container blocks until the action is complete, unless the container process fails, in which case the handler is aborted.",
+      "properties": {
+        "postStart": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Handler",
+          "description": "PostStart is called immediately after a container is created. If the handler fails, the container is terminated and restarted according to its restart policy. Other management of the container blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks"
+        },
+        "preStop": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Handler",
+          "description": "PreStop is called immediately before a container is terminated due to an API request or management event such as liveness/startup probe failure, preemption, resource contention, etc. The handler is not called if the container crashes or exits. The reason for termination is passed to the handler. The Pod's termination grace period countdown begins before the PreStop hooked is executed. Regardless of the outcome of the handler, the container will eventually terminate within the Pod's termination grace period. Other management of the container blocks until the hook completes or until the termination grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.LocalObjectReference": {
+      "description": "LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.",
+      "properties": {
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.LocalVolumeSource": {
+      "description": "Local represents directly-attached storage with node affinity (Beta feature)",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type to mount. It applies only when the Path is a block device. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". The default value is to auto-select a fileystem if unspecified.",
+          "type": "string"
+        },
+        "path": {
+          "description": "The full path to the volume on the node. It can be either a directory or block device (disk, partition, ...).",
+          "type": "string"
+        }
+      },
+      "required": [
+        "path"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.NFSVolumeSource": {
+      "description": "Represents an NFS mount that lasts the lifetime of a pod. NFS volumes do not support ownership management or SELinux relabeling.",
+      "properties": {
+        "path": {
+          "description": "Path that is exported by the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "ReadOnly here will force the NFS export to be mounted with read-only permissions. Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs",
+          "type": "boolean"
+        },
+        "server": {
+          "description": "Server is the hostname or IP address of the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs",
+          "type": "string"
+        }
+      },
+      "required": [
+        "server",
+        "path"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.NodeAffinity": {
+      "description": "Node affinity is a group of node affinity scheduling rules.",
+      "properties": {
+        "preferredDuringSchedulingIgnoredDuringExecution": {
+          "description": "The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding \"weight\" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.PreferredSchedulingTerm"
+          },
+          "type": "array"
+        },
+        "requiredDuringSchedulingIgnoredDuringExecution": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.NodeSelector",
+          "description": "If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.NodeSelector": {
+      "description": "A node selector represents the union of the results of one or more label queries over a set of nodes; that is, it represents the OR of the selectors represented by the node selector terms.",
+      "properties": {
+        "nodeSelectorTerms": {
+          "description": "Required. A list of node selector terms. The terms are ORed.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.NodeSelectorTerm"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "nodeSelectorTerms"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.NodeSelectorRequirement": {
+      "description": "A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
+      "properties": {
+        "key": {
+          "description": "The label key that the selector applies to.",
+          "type": "string"
+        },
+        "operator": {
+          "description": "Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.",
+          "type": "string"
+        },
+        "values": {
+          "description": "An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "key",
+        "operator"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.NodeSelectorTerm": {
+      "description": "A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.",
+      "properties": {
+        "matchExpressions": {
+          "description": "A list of node selector requirements by node's labels.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.NodeSelectorRequirement"
+          },
+          "type": "array"
+        },
+        "matchFields": {
+          "description": "A list of node selector requirements by node's fields.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.NodeSelectorRequirement"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ObjectFieldSelector": {
+      "description": "ObjectFieldSelector selects an APIVersioned field of an object.",
+      "properties": {
+        "apiVersion": {
+          "description": "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".",
+          "type": "string"
+        },
+        "fieldPath": {
+          "description": "Path of the field to select in the specified API version.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "fieldPath"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ObjectReference": {
+      "description": "ObjectReference contains enough information to let you inspect or modify the referred object.",
+      "properties": {
+        "apiVersion": {
+          "description": "API version of the referent.",
+          "type": "string"
+        },
+        "fieldPath": {
+          "description": "If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: \"spec.containers{name}\" (where \"name\" refers to the name of the container that triggered the event) or if no container name is specified \"spec.containers[2]\" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object.",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "namespace": {
+          "description": "Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/",
+          "type": "string"
+        },
+        "resourceVersion": {
+          "description": "Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency",
+          "type": "string"
+        },
+        "uid": {
+          "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PersistentVolumeClaimVolumeSource": {
+      "description": "PersistentVolumeClaimVolumeSource references the user's PVC in the same namespace. This volume finds the bound PV and mounts that volume for the pod. A PersistentVolumeClaimVolumeSource is, essentially, a wrapper around another type of volume that is owned by someone else (the system).",
+      "properties": {
+        "claimName": {
+          "description": "ClaimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Will force the ReadOnly setting in VolumeMounts. Default false.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "claimName"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PhotonPersistentDiskVolumeSource": {
+      "description": "Represents a Photon Controller persistent disk resource.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.",
+          "type": "string"
+        },
+        "pdID": {
+          "description": "ID that identifies Photon Controller persistent disk",
+          "type": "string"
+        }
+      },
+      "required": [
+        "pdID"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Pod": {
+      "description": "Pod is a collection of containers that can run on a host. This resource is created by clients and scheduled onto hosts.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata"
+        },
+        "spec": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodSpec",
+          "description": "Specification of the desired behavior of the pod. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status"
+        },
+        "status": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodStatus",
+          "description": "Most recently observed status of the pod. This data may not be up to date. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status"
+        }
+      },
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "",
+          "kind": "Pod",
+          "version": "v1"
+        }
+      ]
+    },
+    "io.k8s.api.core.v1.PodAffinity": {
+      "description": "Pod affinity is a group of inter pod affinity scheduling rules.",
+      "properties": {
+        "preferredDuringSchedulingIgnoredDuringExecution": {
+          "description": "The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding \"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.WeightedPodAffinityTerm"
+          },
+          "type": "array"
+        },
+        "requiredDuringSchedulingIgnoredDuringExecution": {
+          "description": "If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.PodAffinityTerm"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodAffinityTerm": {
+      "description": "Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key <topologyKey> matches that of any node on which a pod of the set of pods is running",
+      "properties": {
+        "labelSelector": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector",
+          "description": "A label query over a set of resources, in this case pods."
+        },
+        "namespaces": {
+          "description": "namespaces specifies which namespaces the labelSelector applies to (matches against); null or empty list means \"this pod's namespace\"",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "topologyKey": {
+          "description": "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "topologyKey"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodAntiAffinity": {
+      "description": "Pod anti affinity is a group of inter pod anti affinity scheduling rules.",
+      "properties": {
+        "preferredDuringSchedulingIgnoredDuringExecution": {
+          "description": "The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding \"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.WeightedPodAffinityTerm"
+          },
+          "type": "array"
+        },
+        "requiredDuringSchedulingIgnoredDuringExecution": {
+          "description": "If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.PodAffinityTerm"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodCondition": {
+      "description": "PodCondition contains details for the current condition of this pod.",
+      "properties": {
+        "lastProbeTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Last time we probed the condition."
+        },
+        "lastTransitionTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Last time the condition transitioned from one status to another."
+        },
+        "message": {
+          "description": "Human-readable message indicating details about last transition.",
+          "type": "string"
+        },
+        "reason": {
+          "description": "Unique, one-word, CamelCase reason for the condition's last transition.",
+          "type": "string"
+        },
+        "status": {
+          "description": "Status is the status of the condition. Can be True, False, Unknown. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type is the type of the condition. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions",
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "status"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodDNSConfig": {
+      "description": "PodDNSConfig defines the DNS parameters of a pod in addition to those generated from DNSPolicy.",
+      "properties": {
+        "nameservers": {
+          "description": "A list of DNS name server IP addresses. This will be appended to the base nameservers generated from DNSPolicy. Duplicated nameservers will be removed.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "options": {
+          "description": "A list of DNS resolver options. This will be merged with the base options generated from DNSPolicy. Duplicated entries will be removed. Resolution options given in Options will override those that appear in the base DNSPolicy.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.PodDNSConfigOption"
+          },
+          "type": "array"
+        },
+        "searches": {
+          "description": "A list of DNS search domains for host-name lookup. This will be appended to the base search paths generated from DNSPolicy. Duplicated search paths will be removed.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodDNSConfigOption": {
+      "description": "PodDNSConfigOption defines DNS resolver options of a pod.",
+      "properties": {
+        "name": {
+          "description": "Required.",
+          "type": "string"
+        },
+        "value": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodIP": {
+      "description": "IP address information for entries in the (plural) PodIPs field. Each entry includes:\n   IP: An IP address allocated to the pod. Routable at least within the cluster.",
+      "properties": {
+        "ip": {
+          "description": "ip is an IP address (IPv4 or IPv6) assigned to the pod",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodReadinessGate": {
+      "description": "PodReadinessGate contains the reference to a pod condition",
+      "properties": {
+        "conditionType": {
+          "description": "ConditionType refers to a condition in the pod's condition list with matching type.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "conditionType"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodSecurityContext": {
+      "description": "PodSecurityContext holds pod-level security attributes and common container settings. Some fields are also present in container.securityContext.  Field values of container.securityContext take precedence over field values of PodSecurityContext.",
+      "properties": {
+        "fsGroup": {
+          "description": "A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod:\n\n1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "runAsGroup": {
+          "description": "The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in SecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "runAsNonRoot": {
+          "description": "Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in SecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.",
+          "type": "boolean"
+        },
+        "runAsUser": {
+          "description": "The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "seLinuxOptions": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SELinuxOptions",
+          "description": "The SELinux context to be applied to all containers. If unspecified, the container runtime will allocate a random SELinux context for each container.  May also be set in SecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container."
+        },
+        "supplementalGroups": {
+          "description": "A list of groups applied to the first process run in each container, in addition to the container's primary GID.  If unspecified, no groups will be added to any container.",
+          "items": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "type": "array"
+        },
+        "sysctls": {
+          "description": "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.Sysctl"
+          },
+          "type": "array"
+        },
+        "windowsOptions": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.WindowsSecurityContextOptions",
+          "description": "The Windows specific settings applied to all containers. If unspecified, the options within a container's SecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodSpec": {
+      "description": "PodSpec is a description of a pod.",
+      "properties": {
+        "activeDeadlineSeconds": {
+          "description": "Optional duration in seconds the pod may be active on the node relative to StartTime before the system will actively try to mark it failed and kill associated containers. Value must be a positive integer.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "affinity": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Affinity",
+          "description": "If specified, the pod's scheduling constraints"
+        },
+        "automountServiceAccountToken": {
+          "description": "AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.",
+          "type": "boolean"
+        },
+        "containers": {
+          "description": "List of containers belonging to the pod. Containers cannot currently be added or removed. There must be at least one container in a Pod. Cannot be updated.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.Container"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "dnsConfig": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodDNSConfig",
+          "description": "Specifies the DNS parameters of a pod. Parameters specified here will be merged to the generated DNS configuration based on DNSPolicy."
+        },
+        "dnsPolicy": {
+          "description": "Set DNS policy for the pod. Defaults to \"ClusterFirst\". Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy. To have DNS options set along with hostNetwork, you have to specify DNS policy explicitly to 'ClusterFirstWithHostNet'.",
+          "type": "string"
+        },
+        "enableServiceLinks": {
+          "description": "EnableServiceLinks indicates whether information about services should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Defaults to true.",
+          "type": "boolean"
+        },
+        "ephemeralContainers": {
+          "description": "List of ephemeral containers run in this pod. Ephemeral containers may be run in an existing pod to perform user-initiated actions such as debugging. This list cannot be specified when creating a pod, and it cannot be modified by updating the pod spec. In order to add an ephemeral container to an existing pod, use the pod's ephemeralcontainers subresource.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.EphemeralContainer"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "hostAliases": {
+          "description": "HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts file if specified. This is only valid for non-hostNetwork pods.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.HostAlias"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "ip",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "hostIPC": {
+          "description": "Use the host's ipc namespace. Optional: Default to false.",
+          "type": "boolean"
+        },
+        "hostNetwork": {
+          "description": "Host networking requested for this pod. Use the host's network namespace. If this option is set, the ports that will be used must be specified. Default to false.",
+          "type": "boolean"
+        },
+        "hostPID": {
+          "description": "Use the host's pid namespace. Optional: Default to false.",
+          "type": "boolean"
+        },
+        "hostname": {
+          "description": "Specifies the hostname of the Pod If not specified, the pod's hostname will be set to a system-defined value.",
+          "type": "string"
+        },
+        "imagePullSecrets": {
+          "description": "ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. If specified, these secrets will be passed to individual puller implementations for them to use. More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "initContainers": {
+          "description": "List of initialization containers belonging to the pod. Init containers are executed in order prior to containers being started. If any init container fails, the pod is considered to have failed and is handled according to its restartPolicy. The name for an init container or normal container must be unique among all containers. Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. The resourceRequirements of an init container are taken into account during scheduling by finding the highest request/limit for each resource type, and then using the max of of that value or the sum of the normal containers. Limits are applied to init containers in a similar fashion. Init containers cannot currently be added or removed. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.Container"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "nodeName": {
+          "description": "NodeName is a request to schedule this pod onto a specific node. If it is non-empty, the scheduler simply schedules this pod onto that node, assuming that it fits resource requirements.",
+          "type": "string"
+        },
+        "nodeSelector": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/",
+          "type": "object"
+        },
+        "overhead": {
+          "additionalProperties": {
+            "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity"
+          },
+          "description": "Overhead represents the resource overhead associated with running a pod for a given RuntimeClass. This field will be autopopulated at admission time by the RuntimeClass admission controller. If the RuntimeClass admission controller is enabled, overhead must not be set in Pod create requests. The RuntimeClass admission controller will reject Pod create requests which have the overhead already set. If RuntimeClass is configured and selected in the PodSpec, Overhead will be set to the value defined in the corresponding RuntimeClass, otherwise it will remain unset and treated as zero. More info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead This field is alpha-level as of Kubernetes v1.16, and is only honored by servers that enable the PodOverhead feature.",
+          "type": "object"
+        },
+        "preemptionPolicy": {
+          "description": "PreemptionPolicy is the Policy for preempting pods with lower priority. One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset. This field is alpha-level and is only honored by servers that enable the NonPreemptingPriority feature.",
+          "type": "string"
+        },
+        "priority": {
+          "description": "The priority value. Various system components use this field to find the priority of the pod. When Priority Admission Controller is enabled, it prevents users from setting this field. The admission controller populates this field from PriorityClassName. The higher the value, the higher the priority.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "priorityClassName": {
+          "description": "If specified, indicates the pod's priority. \"system-node-critical\" and \"system-cluster-critical\" are two special keywords which indicate the highest priorities with the former being the highest priority. Any other name must be defined by creating a PriorityClass object with that name. If not specified, the pod priority will be default or zero if there is no default.",
+          "type": "string"
+        },
+        "readinessGates": {
+          "description": "If specified, all readiness gates will be evaluated for pod readiness. A pod is ready when all its containers are ready AND all conditions specified in the readiness gates have status equal to \"True\" More info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.PodReadinessGate"
+          },
+          "type": "array"
+        },
+        "restartPolicy": {
+          "description": "Restart policy for all containers within the pod. One of Always, OnFailure, Never. Default to Always. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy",
+          "type": "string"
+        },
+        "runtimeClassName": {
+          "description": "RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used to run this pod.  If no RuntimeClass resource matches the named class, the pod will not be run. If unset or empty, the \"legacy\" RuntimeClass will be used, which is an implicit class with an empty definition that uses the default runtime handler. More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class This is a beta feature as of Kubernetes v1.14.",
+          "type": "string"
+        },
+        "schedulerName": {
+          "description": "If specified, the pod will be dispatched by specified scheduler. If not specified, the pod will be dispatched by default scheduler.",
+          "type": "string"
+        },
+        "securityContext": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodSecurityContext",
+          "description": "SecurityContext holds pod-level security attributes and common container settings. Optional: Defaults to empty.  See type description for default values of each field."
+        },
+        "serviceAccount": {
+          "description": "DeprecatedServiceAccount is a deprecated alias for ServiceAccountName. Deprecated: Use serviceAccountName instead.",
+          "type": "string"
+        },
+        "serviceAccountName": {
+          "description": "ServiceAccountName is the name of the ServiceAccount to use to run this pod. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/",
+          "type": "string"
+        },
+        "shareProcessNamespace": {
+          "description": "Share a single process namespace between all of the containers in a pod. When this is set containers will be able to view and signal processes from other containers in the same pod, and the first process in each container will not be assigned PID 1. HostPID and ShareProcessNamespace cannot both be set. Optional: Default to false.",
+          "type": "boolean"
+        },
+        "subdomain": {
+          "description": "If specified, the fully qualified Pod hostname will be \"<hostname>.<subdomain>.<pod namespace>.svc.<cluster domain>\". If not specified, the pod will not have a domainname at all.",
+          "type": "string"
+        },
+        "terminationGracePeriodSeconds": {
+          "description": "Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period will be used instead. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. Defaults to 30 seconds.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "tolerations": {
+          "description": "If specified, the pod's tolerations.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.Toleration"
+          },
+          "type": "array"
+        },
+        "topologySpreadConstraints": {
+          "description": "TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.TopologySpreadConstraint"
+          },
+          "type": "array",
+          "x-kubernetes-list-map-keys": [
+            "topologyKey",
+            "whenUnsatisfiable"
+          ],
+          "x-kubernetes-list-type": "map",
+          "x-kubernetes-patch-merge-key": "topologyKey",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "volumes": {
+          "description": "List of volumes that can be mounted by containers belonging to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.Volume"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge,retainKeys"
+        }
+      },
+      "required": [
+        "containers"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodStatus": {
+      "description": "PodStatus represents information about the status of a pod. Status may trail the actual state of a system, especially if the node that hosts the pod cannot contact the control plane.",
+      "properties": {
+        "conditions": {
+          "description": "Current service state of pod. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.PodCondition"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "type",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "containerStatuses": {
+          "description": "The list has one entry per container in the manifest. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-and-container-status",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.ContainerStatus"
+          },
+          "type": "array"
+        },
+        "ephemeralContainerStatuses": {
+          "description": "Status for any ephemeral containers that have run in this pod.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.ContainerStatus"
+          },
+          "type": "array"
+        },
+        "hostIP": {
+          "description": "IP address of the host to which the pod is assigned. Empty if not yet scheduled.",
+          "type": "string"
+        },
+        "initContainerStatuses": {
+          "description": "The list has one entry per init container in the manifest. The most recent successful init container will have ready = true, the most recently started container will have startTime set. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-and-container-status",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.ContainerStatus"
+          },
+          "type": "array"
+        },
+        "message": {
+          "description": "A human readable message indicating details about why the pod is in this condition.",
+          "type": "string"
+        },
+        "nominatedNodeName": {
+          "description": "nominatedNodeName is set only when this pod preempts other pods on the node, but it cannot be scheduled right away as preemption victims receive their graceful termination periods. This field does not guarantee that the pod will be scheduled on this node. Scheduler may decide to place the pod elsewhere if other nodes become available sooner. Scheduler may also decide to give the resources on this node to a higher priority pod that is created after preemption. As a result, this field may be different than PodSpec.nodeName when the pod is scheduled.",
+          "type": "string"
+        },
+        "phase": {
+          "description": "The phase of a Pod is a simple, high-level summary of where the Pod is in its lifecycle. The conditions array, the reason and message fields, and the individual container status arrays contain more detail about the pod's status. There are five possible phase values:\n\nPending: The pod has been accepted by the Kubernetes system, but one or more of the container images has not been created. This includes time before being scheduled as well as time spent downloading images over the network, which could take a while. Running: The pod has been bound to a node, and all of the containers have been created. At least one container is still running, or is in the process of starting or restarting. Succeeded: All containers in the pod have terminated in success, and will not be restarted. Failed: All containers in the pod have terminated, and at least one container has terminated in failure. The container either exited with non-zero status or was terminated by the system. Unknown: For some reason the state of the pod could not be obtained, typically due to an error in communicating with the host of the pod.\n\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-phase",
+          "type": "string"
+        },
+        "podIP": {
+          "description": "IP address allocated to the pod. Routable at least within the cluster. Empty if not yet allocated.",
+          "type": "string"
+        },
+        "podIPs": {
+          "description": "podIPs holds the IP addresses allocated to the pod. If this field is specified, the 0th entry must match the podIP field. Pods may be allocated at most 1 value for each of IPv4 and IPv6. This list is empty if no IPs have been allocated yet.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.PodIP"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "ip",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "qosClass": {
+          "description": "The Quality of Service (QOS) classification assigned to the pod based on resource requirements See PodQOSClass type for available QOS classes More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-qos/#quality-of-service-classes",
+          "type": "string"
+        },
+        "reason": {
+          "description": "A brief CamelCase message indicating details about why the pod is in this state. e.g. 'Evicted'",
+          "type": "string"
+        },
+        "startTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "RFC 3339 date and time at which the object was acknowledged by the Kubelet. This is before the Kubelet pulled the container image(s) for the pod."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PodTemplate": {
+      "description": "PodTemplate describes a template for creating copies of a predefined pod.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata"
+        },
+        "template": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodTemplateSpec",
+          "description": "Template defines the pods that will be created from this pod template. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status"
+        }
+      },
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "",
+          "kind": "PodTemplate",
+          "version": "v1"
+        }
+      ]
+    },
+    "io.k8s.api.core.v1.PodTemplateSpec": {
+      "description": "PodTemplateSpec describes the data a pod should have when created from a template",
+      "properties": {
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata"
+        },
+        "spec": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodSpec",
+          "description": "Specification of the desired behavior of the pod. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PortworxVolumeSource": {
+      "description": "PortworxVolumeSource represents a Portworx volume resource.",
+      "properties": {
+        "fsType": {
+          "description": "FSType represents the filesystem type to mount Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\". Implicitly inferred to be \"ext4\" if unspecified.",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+          "type": "boolean"
+        },
+        "volumeID": {
+          "description": "VolumeID uniquely identifies a Portworx volume",
+          "type": "string"
+        }
+      },
+      "required": [
+        "volumeID"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.PreferredSchedulingTerm": {
+      "description": "An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).",
+      "properties": {
+        "preference": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.NodeSelectorTerm",
+          "description": "A node selector term, associated with the corresponding weight."
+        },
+        "weight": {
+          "description": "Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "required": [
+        "weight",
+        "preference"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Probe": {
+      "description": "Probe describes a health check to be performed against a container to determine whether it is alive or ready to receive traffic.",
+      "properties": {
+        "exec": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ExecAction",
+          "description": "One and only one of the following should be specified. Exec specifies the action to take."
+        },
+        "failureThreshold": {
+          "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "httpGet": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.HTTPGetAction",
+          "description": "HTTPGet specifies the http request to perform."
+        },
+        "initialDelaySeconds": {
+          "description": "Number of seconds after the container has started before liveness probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes",
+          "format": "int32",
+          "type": "integer"
+        },
+        "periodSeconds": {
+          "description": "How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "successThreshold": {
+          "description": "Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "tcpSocket": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.TCPSocketAction",
+          "description": "TCPSocket specifies an action involving a TCP port. TCP hooks not yet supported"
+        },
+        "timeoutSeconds": {
+          "description": "Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ProjectedVolumeSource": {
+      "description": "Represents a projected volume source",
+      "properties": {
+        "defaultMode": {
+          "description": "Mode bits to use on created files by default. Must be a value between 0 and 0777. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "sources": {
+          "description": "list of volume projections",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.VolumeProjection"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "sources"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.QuobyteVolumeSource": {
+      "description": "Represents a Quobyte mount that lasts the lifetime of a pod. Quobyte volumes do not support ownership management or SELinux relabeling.",
+      "properties": {
+        "group": {
+          "description": "Group to map volume access to Default is no group",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "ReadOnly here will force the Quobyte volume to be mounted with read-only permissions. Defaults to false.",
+          "type": "boolean"
+        },
+        "registry": {
+          "description": "Registry represents a single or multiple Quobyte Registry services specified as a string as host:port pair (multiple entries are separated with commas) which acts as the central registry for volumes",
+          "type": "string"
+        },
+        "tenant": {
+          "description": "Tenant owning the given Quobyte volume in the Backend Used with dynamically provisioned Quobyte volumes, value is set by the plugin",
+          "type": "string"
+        },
+        "user": {
+          "description": "User to map volume access to Defaults to serivceaccount user",
+          "type": "string"
+        },
+        "volume": {
+          "description": "Volume is a string that references an already created Quobyte volume by name.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "registry",
+        "volume"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.RBDVolumeSource": {
+      "description": "Represents a Rados Block Device mount that lasts the lifetime of a pod. RBD volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd",
+          "type": "string"
+        },
+        "image": {
+          "description": "The rados image name. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it",
+          "type": "string"
+        },
+        "keyring": {
+          "description": "Keyring is the path to key ring for RBDUser. Default is /etc/ceph/keyring. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it",
+          "type": "string"
+        },
+        "monitors": {
+          "description": "A collection of Ceph monitors. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "pool": {
+          "description": "The rados pool name. Default is rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "ReadOnly here will force the ReadOnly setting in VolumeMounts. Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it",
+          "type": "boolean"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "SecretRef is name of the authentication secret for RBDUser. If provided overrides keyring. Default is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it"
+        },
+        "user": {
+          "description": "The rados user name. Default is admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it",
+          "type": "string"
+        }
+      },
+      "required": [
+        "monitors",
+        "image"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ResourceFieldSelector": {
+      "description": "ResourceFieldSelector represents container resources (cpu, memory) and their output format",
+      "properties": {
+        "containerName": {
+          "description": "Container name: required for volumes, optional for env vars",
+          "type": "string"
+        },
+        "divisor": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity",
+          "description": "Specifies the output format of the exposed resources, defaults to \"1\""
+        },
+        "resource": {
+          "description": "Required: resource to select",
+          "type": "string"
+        }
+      },
+      "required": [
+        "resource"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ResourceRequirements": {
+      "description": "ResourceRequirements describes the compute resource requirements.",
+      "properties": {
+        "limits": {
+          "additionalProperties": {
+            "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity"
+          },
+          "description": "Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/",
+          "type": "object"
+        },
+        "requests": {
+          "additionalProperties": {
+            "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity"
+          },
+          "description": "Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/",
+          "type": "object"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.SELinuxOptions": {
+      "description": "SELinuxOptions are the labels to be applied to the container",
+      "properties": {
+        "level": {
+          "description": "Level is SELinux level label that applies to the container.",
+          "type": "string"
+        },
+        "role": {
+          "description": "Role is a SELinux role label that applies to the container.",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type is a SELinux type label that applies to the container.",
+          "type": "string"
+        },
+        "user": {
+          "description": "User is a SELinux user label that applies to the container.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ScaleIOVolumeSource": {
+      "description": "ScaleIOVolumeSource represents a persistent ScaleIO volume",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Default is \"xfs\".",
+          "type": "string"
+        },
+        "gateway": {
+          "description": "The host address of the ScaleIO API Gateway.",
+          "type": "string"
+        },
+        "protectionDomain": {
+          "description": "The name of the ScaleIO Protection Domain for the configured storage.",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+          "type": "boolean"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "SecretRef references to the secret for ScaleIO user and other sensitive information. If this is not provided, Login operation will fail."
+        },
+        "sslEnabled": {
+          "description": "Flag to enable/disable SSL communication with Gateway, default false",
+          "type": "boolean"
+        },
+        "storageMode": {
+          "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned. Default is ThinProvisioned.",
+          "type": "string"
+        },
+        "storagePool": {
+          "description": "The ScaleIO Storage Pool associated with the protection domain.",
+          "type": "string"
+        },
+        "system": {
+          "description": "The name of the storage system as configured in ScaleIO.",
+          "type": "string"
+        },
+        "volumeName": {
+          "description": "The name of a volume already created in the ScaleIO system that is associated with this volume source.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "gateway",
+        "system",
+        "secretRef"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ScopeSelector": {
+      "description": "A scope selector represents the AND of the selectors represented by the scoped-resource selector requirements.",
+      "properties": {
+        "matchExpressions": {
+          "description": "A list of scope selector requirements by scope of the resources.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.ScopedResourceSelectorRequirement"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ScopedResourceSelectorRequirement": {
+      "description": "A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.",
+      "properties": {
+        "operator": {
+          "description": "Represents a scope's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.",
+          "type": "string"
+        },
+        "scopeName": {
+          "description": "The name of the scope that the selector applies to.",
+          "type": "string"
+        },
+        "values": {
+          "description": "An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "scopeName",
+        "operator"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Secret": {
+      "description": "Secret holds secret data of a certain type. The total bytes of the values in the Data field must be less than MaxSecretSize bytes.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "data": {
+          "additionalProperties": {
+            "format": "byte",
+            "type": "string"
+          },
+          "description": "Data contains the secret data. Each key must consist of alphanumeric characters, '-', '_' or '.'. The serialized form of the secret data is a base64 encoded string, representing the arbitrary (possibly non-string) data value here. Described in https://tools.ietf.org/html/rfc4648#section-4",
+          "type": "object"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata"
+        },
+        "stringData": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "stringData allows specifying non-binary secret data in string form. It is provided as a write-only input field for convenience. All keys and values are merged into the data field on write, overwriting any existing values. The stringData field is never output when reading from the API.",
+          "type": "object"
+        },
+        "type": {
+          "description": "Used to facilitate programmatic handling of secret data.",
+          "type": "string"
+        }
+      },
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "",
+          "kind": "Secret",
+          "version": "v1"
+        }
+      ]
+    },
+    "io.k8s.api.core.v1.SecretEnvSource": {
+      "description": "SecretEnvSource selects a Secret to populate the environment variables with.\n\nThe contents of the target Secret's Data field will represent the key-value pairs as environment variables.",
+      "properties": {
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "optional": {
+          "description": "Specify whether the Secret must be defined",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.SecretKeySelector": {
+      "description": "SecretKeySelector selects a key of a Secret.",
+      "properties": {
+        "key": {
+          "description": "The key of the secret to select from.  Must be a valid secret key.",
+          "type": "string"
+        },
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "optional": {
+          "description": "Specify whether the Secret or its key must be defined",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "key"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.SecretProjection": {
+      "description": "Adapts a secret into a projected volume.\n\nThe contents of the target Secret's Data field will be presented in a projected volume as files using the keys in the Data field as the file names. Note that this is identical to a secret volume source without the default mode.",
+      "properties": {
+        "items": {
+          "description": "If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.KeyToPath"
+          },
+          "type": "array"
+        },
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "optional": {
+          "description": "Specify whether the Secret or its key must be defined",
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.SecretReference": {
+      "description": "SecretReference represents a Secret Reference. It has enough information to retrieve secret in any namespace",
+      "properties": {
+        "name": {
+          "description": "Name is unique within a namespace to reference a secret resource.",
+          "type": "string"
+        },
+        "namespace": {
+          "description": "Namespace defines the space within which the secret name must be unique.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.SecretVolumeSource": {
+      "description": "Adapts a Secret into a volume.\n\nThe contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names. Secret volumes support ownership management and SELinux relabeling.",
+      "properties": {
+        "defaultMode": {
+          "description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "items": {
+          "description": "If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.KeyToPath"
+          },
+          "type": "array"
+        },
+        "optional": {
+          "description": "Specify whether the Secret or its keys must be defined",
+          "type": "boolean"
+        },
+        "secretName": {
+          "description": "Name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.SecurityContext": {
+      "description": "SecurityContext holds security configuration that will be applied to a container. Some fields are present in both SecurityContext and PodSecurityContext.  When both are set, the values in SecurityContext take precedence.",
+      "properties": {
+        "allowPrivilegeEscalation": {
+          "description": "AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN",
+          "type": "boolean"
+        },
+        "capabilities": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.Capabilities",
+          "description": "The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime."
+        },
+        "privileged": {
+          "description": "Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false.",
+          "type": "boolean"
+        },
+        "procMount": {
+          "description": "procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled.",
+          "type": "string"
+        },
+        "readOnlyRootFilesystem": {
+          "description": "Whether this container has a read-only root filesystem. Default is false.",
+          "type": "boolean"
+        },
+        "runAsGroup": {
+          "description": "The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "runAsNonRoot": {
+          "description": "Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.",
+          "type": "boolean"
+        },
+        "runAsUser": {
+          "description": "The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "seLinuxOptions": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SELinuxOptions",
+          "description": "The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container.  May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence."
+        },
+        "windowsOptions": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.WindowsSecurityContextOptions",
+          "description": "The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.ServiceAccountTokenProjection": {
+      "description": "ServiceAccountTokenProjection represents a projected service account token volume. This projection can be used to insert a service account token into the pods runtime filesystem for use against APIs (Kubernetes API Server or otherwise).",
+      "properties": {
+        "audience": {
+          "description": "Audience is the intended audience of the token. A recipient of a token must identify itself with an identifier specified in the audience of the token, and otherwise should reject the token. The audience defaults to the identifier of the apiserver.",
+          "type": "string"
+        },
+        "expirationSeconds": {
+          "description": "ExpirationSeconds is the requested duration of validity of the service account token. As the token approaches expiration, the kubelet volume plugin will proactively rotate the service account token. The kubelet will start trying to rotate the token if the token is older than 80 percent of its time to live or if the token is older than 24 hours.Defaults to 1 hour and must be at least 10 minutes.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "path": {
+          "description": "Path is the path relative to the mount point of the file to project the token into.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "path"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.SessionAffinityConfig": {
+      "description": "SessionAffinityConfig represents the configurations of session affinity.",
+      "properties": {
+        "clientIP": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ClientIPConfig",
+          "description": "clientIP contains the configurations of Client IP based session affinity."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.StorageOSVolumeSource": {
+      "description": "Represents a StorageOS persistent volume resource.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+          "type": "boolean"
+        },
+        "secretRef": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.LocalObjectReference",
+          "description": "SecretRef specifies the secret to use for obtaining the StorageOS API credentials.  If not specified, default values will be attempted."
+        },
+        "volumeName": {
+          "description": "VolumeName is the human-readable name of the StorageOS volume.  Volume names are only unique within a namespace.",
+          "type": "string"
+        },
+        "volumeNamespace": {
+          "description": "VolumeNamespace specifies the scope of the volume within StorageOS.  If no namespace is specified then the Pod's namespace will be used.  This allows the Kubernetes name scoping to be mirrored within StorageOS for tighter integration. Set VolumeName to any name to override the default behaviour. Set to \"default\" if you are not using namespaces within StorageOS. Namespaces that do not pre-exist within StorageOS will be created.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Sysctl": {
+      "description": "Sysctl defines a kernel parameter to be set",
+      "properties": {
+        "name": {
+          "description": "Name of a property to set",
+          "type": "string"
+        },
+        "value": {
+          "description": "Value of a property to set",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "value"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.TCPSocketAction": {
+      "description": "TCPSocketAction describes an action based on opening a socket",
+      "properties": {
+        "host": {
+          "description": "Optional: Host name to connect to, defaults to the pod IP.",
+          "type": "string"
+        },
+        "port": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "Number or name of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME."
+        }
+      },
+      "required": [
+        "port"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Toleration": {
+      "description": "The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>.",
+      "properties": {
+        "effect": {
+          "description": "Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.",
+          "type": "string"
+        },
+        "key": {
+          "description": "Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.",
+          "type": "string"
+        },
+        "operator": {
+          "description": "Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category.",
+          "type": "string"
+        },
+        "tolerationSeconds": {
+          "description": "TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "value": {
+          "description": "Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.TopologySelectorLabelRequirement": {
+      "description": "A topology selector requirement is a selector that matches given label. This is an alpha feature and may change in the future.",
+      "properties": {
+        "key": {
+          "description": "The label key that the selector applies to.",
+          "type": "string"
+        },
+        "values": {
+          "description": "An array of string values. One value must match the label to be selected. Each entry in Values is ORed.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "key",
+        "values"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.TopologySelectorTerm": {
+      "description": "A topology selector term represents the result of label queries. A null or empty topology selector term matches no objects. The requirements of them are ANDed. It provides a subset of functionality as NodeSelectorTerm. This is an alpha feature and may change in the future.",
+      "properties": {
+        "matchLabelExpressions": {
+          "description": "A list of topology selector requirements by labels.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.core.v1.TopologySelectorLabelRequirement"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.TopologySpreadConstraint": {
+      "description": "TopologySpreadConstraint specifies how to spread matching pods among the given topology.",
+      "properties": {
+        "labelSelector": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector",
+          "description": "LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain."
+        },
+        "maxSkew": {
+          "description": "MaxSkew describes the degree to which pods may be unevenly distributed. It's the maximum permitted difference between the number of matching pods in any two topology domains of a given topology type. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 1/1/0: | zone1 | zone2 | zone3 | |   P   |   P   |       | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 1/1/1; scheduling it onto zone1(zone2) would make the ActualSkew(2-0) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. It's a required field. Default value is 1 and 0 is not allowed.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "topologyKey": {
+          "description": "TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each <key, value> as a \"bucket\", and try to put balanced number of pods into each bucket. It's a required field.",
+          "type": "string"
+        },
+        "whenUnsatisfiable": {
+          "description": "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it - ScheduleAnyway tells the scheduler to still schedule it It's considered as \"Unsatisfiable\" if and only if placing incoming pod on any topology violates \"MaxSkew\". For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P |   P   |   P   | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "maxSkew",
+        "topologyKey",
+        "whenUnsatisfiable"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.Volume": {
+      "description": "Volume represents a named volume in a pod that may be accessed by any container in the pod.",
+      "properties": {
+        "awsElasticBlockStore": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.AWSElasticBlockStoreVolumeSource",
+          "description": "AWSElasticBlockStore represents an AWS Disk resource that is attached to a kubelet's host machine and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore"
+        },
+        "azureDisk": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.AzureDiskVolumeSource",
+          "description": "AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod."
+        },
+        "azureFile": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.AzureFileVolumeSource",
+          "description": "AzureFile represents an Azure File Service mount on the host and bind mount to the pod."
+        },
+        "cephfs": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.CephFSVolumeSource",
+          "description": "CephFS represents a Ceph FS mount on the host that shares a pod's lifetime"
+        },
+        "cinder": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.CinderVolumeSource",
+          "description": "Cinder represents a cinder volume attached and mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md"
+        },
+        "configMap": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ConfigMapVolumeSource",
+          "description": "ConfigMap represents a configMap that should populate this volume"
+        },
+        "csi": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.CSIVolumeSource",
+          "description": "CSI (Container Storage Interface) represents storage that is handled by an external CSI driver (Alpha feature)."
+        },
+        "downwardAPI": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.DownwardAPIVolumeSource",
+          "description": "DownwardAPI represents downward API about the pod that should populate this volume"
+        },
+        "emptyDir": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.EmptyDirVolumeSource",
+          "description": "EmptyDir represents a temporary directory that shares a pod's lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir"
+        },
+        "fc": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.FCVolumeSource",
+          "description": "FC represents a Fibre Channel resource that is attached to a kubelet's host machine and then exposed to the pod."
+        },
+        "flexVolume": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.FlexVolumeSource",
+          "description": "FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin."
+        },
+        "flocker": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.FlockerVolumeSource",
+          "description": "Flocker represents a Flocker volume attached to a kubelet's host machine. This depends on the Flocker control service being running"
+        },
+        "gcePersistentDisk": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.GCEPersistentDiskVolumeSource",
+          "description": "GCEPersistentDisk represents a GCE Disk resource that is attached to a kubelet's host machine and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk"
+        },
+        "gitRepo": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.GitRepoVolumeSource",
+          "description": "GitRepo represents a git repository at a particular revision. DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir into the Pod's container."
+        },
+        "glusterfs": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.GlusterfsVolumeSource",
+          "description": "Glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md"
+        },
+        "hostPath": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.HostPathVolumeSource",
+          "description": "HostPath represents a pre-existing file or directory on the host machine that is directly exposed to the container. This is generally used for system agents or other privileged things that are allowed to see the host machine. Most containers will NOT need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath"
+        },
+        "iscsi": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ISCSIVolumeSource",
+          "description": "ISCSI represents an ISCSI Disk resource that is attached to a kubelet's host machine and then exposed to the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md"
+        },
+        "name": {
+          "description": "Volume's name. Must be a DNS_LABEL and unique within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
+          "type": "string"
+        },
+        "nfs": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.NFSVolumeSource",
+          "description": "NFS represents an NFS mount on the host that shares a pod's lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs"
+        },
+        "persistentVolumeClaim": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PersistentVolumeClaimVolumeSource",
+          "description": "PersistentVolumeClaimVolumeSource represents a reference to a PersistentVolumeClaim in the same namespace. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims"
+        },
+        "photonPersistentDisk": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PhotonPersistentDiskVolumeSource",
+          "description": "PhotonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine"
+        },
+        "portworxVolume": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PortworxVolumeSource",
+          "description": "PortworxVolume represents a portworx volume attached and mounted on kubelets host machine"
+        },
+        "projected": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ProjectedVolumeSource",
+          "description": "Items for all in one resources secrets, configmaps, and downward API"
+        },
+        "quobyte": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.QuobyteVolumeSource",
+          "description": "Quobyte represents a Quobyte mount on the host that shares a pod's lifetime"
+        },
+        "rbd": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.RBDVolumeSource",
+          "description": "RBD represents a Rados Block Device mount on the host that shares a pod's lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md"
+        },
+        "scaleIO": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ScaleIOVolumeSource",
+          "description": "ScaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes."
+        },
+        "secret": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SecretVolumeSource",
+          "description": "Secret represents a secret that should populate this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret"
+        },
+        "storageos": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.StorageOSVolumeSource",
+          "description": "StorageOS represents a StorageOS volume attached and mounted on Kubernetes nodes."
+        },
+        "vsphereVolume": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.VsphereVirtualDiskVolumeSource",
+          "description": "VsphereVolume represents a vSphere volume attached and mounted on kubelets host machine"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.VolumeDevice": {
+      "description": "volumeDevice describes a mapping of a raw block device within a container.",
+      "properties": {
+        "devicePath": {
+          "description": "devicePath is the path inside of the container that the device will be mapped to.",
+          "type": "string"
+        },
+        "name": {
+          "description": "name must match the name of a persistentVolumeClaim in the pod",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "devicePath"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.VolumeMount": {
+      "description": "VolumeMount describes a mounting of a Volume within a container.",
+      "properties": {
+        "mountPath": {
+          "description": "Path within the container at which the volume should be mounted.  Must not contain ':'.",
+          "type": "string"
+        },
+        "mountPropagation": {
+          "description": "mountPropagation determines how mounts are propagated from the host to container and the other way around. When not set, MountPropagationNone is used. This field is beta in 1.10.",
+          "type": "string"
+        },
+        "name": {
+          "description": "This must match the Name of a Volume.",
+          "type": "string"
+        },
+        "readOnly": {
+          "description": "Mounted read-only if true, read-write otherwise (false or unspecified). Defaults to false.",
+          "type": "boolean"
+        },
+        "subPath": {
+          "description": "Path within the volume from which the container's volume should be mounted. Defaults to \"\" (volume's root).",
+          "type": "string"
+        },
+        "subPathExpr": {
+          "description": "Expanded path within the volume from which the container's volume should be mounted. Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. Defaults to \"\" (volume's root). SubPathExpr and SubPath are mutually exclusive.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "mountPath"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.VolumeNodeAffinity": {
+      "description": "VolumeNodeAffinity defines constraints that limit what nodes this volume can be accessed from.",
+      "properties": {
+        "required": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.NodeSelector",
+          "description": "Required specifies hard node constraints that must be met."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.VolumeProjection": {
+      "description": "Projection that may be projected along with other supported volume types",
+      "properties": {
+        "configMap": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ConfigMapProjection",
+          "description": "information about the configMap data to project"
+        },
+        "downwardAPI": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.DownwardAPIProjection",
+          "description": "information about the downwardAPI data to project"
+        },
+        "secret": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.SecretProjection",
+          "description": "information about the secret data to project"
+        },
+        "serviceAccountToken": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.ServiceAccountTokenProjection",
+          "description": "information about the serviceAccountToken data to project"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.VsphereVirtualDiskVolumeSource": {
+      "description": "Represents a vSphere volume resource.",
+      "properties": {
+        "fsType": {
+          "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.",
+          "type": "string"
+        },
+        "storagePolicyID": {
+          "description": "Storage Policy Based Management (SPBM) profile ID associated with the StoragePolicyName.",
+          "type": "string"
+        },
+        "storagePolicyName": {
+          "description": "Storage Policy Based Management (SPBM) profile name.",
+          "type": "string"
+        },
+        "volumePath": {
+          "description": "Path that identifies vSphere volume vmdk",
+          "type": "string"
+        }
+      },
+      "required": [
+        "volumePath"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.WeightedPodAffinityTerm": {
+      "description": "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)",
+      "properties": {
+        "podAffinityTerm": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodAffinityTerm",
+          "description": "Required. A pod affinity term, associated with the corresponding weight."
+        },
+        "weight": {
+          "description": "weight associated with matching the corresponding podAffinityTerm, in the range 1-100.",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "required": [
+        "weight",
+        "podAffinityTerm"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.core.v1.WindowsSecurityContextOptions": {
+      "description": "WindowsSecurityContextOptions contain Windows-specific options and credentials.",
+      "properties": {
+        "gmsaCredentialSpec": {
+          "description": "GMSACredentialSpec is where the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field. This field is alpha-level and is only honored by servers that enable the WindowsGMSA feature flag.",
+          "type": "string"
+        },
+        "gmsaCredentialSpecName": {
+          "description": "GMSACredentialSpecName is the name of the GMSA credential spec to use. This field is alpha-level and is only honored by servers that enable the WindowsGMSA feature flag.",
+          "type": "string"
+        },
+        "runAsUserName": {
+          "description": "The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. This field is beta-level and may be disabled with the WindowsRunAsUserName feature flag.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.extensions.v1beta1.Deployment": {
+      "description": "DEPRECATED - This group version of Deployment is deprecated by apps/v1beta2/Deployment. See the release notes for more information. Deployment enables declarative updates for Pods and ReplicaSets.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "metadata": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+          "description": "Standard object metadata."
+        },
+        "spec": {
+          "$ref": "#/definitions/io.k8s.api.extensions.v1beta1.DeploymentSpec",
+          "description": "Specification of the desired behavior of the Deployment."
+        },
+        "status": {
+          "$ref": "#/definitions/io.k8s.api.extensions.v1beta1.DeploymentStatus",
+          "description": "Most recently observed status of the Deployment."
+        }
+      },
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "extensions",
+          "kind": "Deployment",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "io.k8s.api.extensions.v1beta1.DeploymentCondition": {
+      "description": "DeploymentCondition describes the state of a deployment at a certain point.",
+      "properties": {
+        "lastTransitionTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Last time the condition transitioned from one status to another."
+        },
+        "lastUpdateTime": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "The last time this condition was updated."
+        },
+        "message": {
+          "description": "A human readable message indicating details about the transition.",
+          "type": "string"
+        },
+        "reason": {
+          "description": "The reason for the condition's last transition.",
+          "type": "string"
+        },
+        "status": {
+          "description": "Status of the condition, one of True, False, Unknown.",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type of deployment condition.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "status"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.extensions.v1beta1.DeploymentRollback": {
+      "description": "DEPRECATED. DeploymentRollback stores the information required to rollback a deployment.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+          "type": "string"
+        },
+        "kind": {
+          "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "name": {
+          "description": "Required: This must match the Name of a deployment.",
+          "type": "string"
+        },
+        "rollbackTo": {
+          "$ref": "#/definitions/io.k8s.api.extensions.v1beta1.RollbackConfig",
+          "description": "The config of this deployment rollback."
+        },
+        "updatedAnnotations": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "The annotations to be updated to a deployment",
+          "type": "object"
+        }
+      },
+      "required": [
+        "name",
+        "rollbackTo"
+      ],
+      "type": "object",
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "extensions",
+          "kind": "DeploymentRollback",
+          "version": "v1beta1"
+        }
+      ]
+    },
+    "io.k8s.api.extensions.v1beta1.DeploymentSpec": {
+      "description": "DeploymentSpec is the specification of the desired behavior of the Deployment.",
+      "properties": {
+        "minReadySeconds": {
+          "description": "Minimum number of seconds for which a newly created pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready)",
+          "format": "int32",
+          "type": "integer"
+        },
+        "paused": {
+          "description": "Indicates that the deployment is paused and will not be processed by the deployment controller.",
+          "type": "boolean"
+        },
+        "progressDeadlineSeconds": {
+          "description": "The maximum time in seconds for a deployment to make progress before it is considered to be failed. The deployment controller will continue to process failed deployments and a condition with a ProgressDeadlineExceeded reason will be surfaced in the deployment status. Note that progress will not be estimated during the time a deployment is paused. This is set to the max value of int32 (i.e. 2147483647) by default, which means \"no deadline\".",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Number of desired pods. This is a pointer to distinguish between explicit zero and not specified. Defaults to 1.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "revisionHistoryLimit": {
+          "description": "The number of old ReplicaSets to retain to allow rollback. This is a pointer to distinguish between explicit zero and not specified. This is set to the max value of int32 (i.e. 2147483647) by default, which means \"retaining all old ReplicaSets\".",
+          "format": "int32",
+          "type": "integer"
+        },
+        "rollbackTo": {
+          "$ref": "#/definitions/io.k8s.api.extensions.v1beta1.RollbackConfig",
+          "description": "DEPRECATED. The config this deployment is rolling back to. Will be cleared after rollback is done."
+        },
+        "selector": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector",
+          "description": "Label selector for pods. Existing ReplicaSets whose pods are selected by this will be the ones affected by this deployment."
+        },
+        "strategy": {
+          "$ref": "#/definitions/io.k8s.api.extensions.v1beta1.DeploymentStrategy",
+          "description": "The deployment strategy to use to replace existing pods with new ones.",
+          "x-kubernetes-patch-strategy": "retainKeys"
+        },
+        "template": {
+          "$ref": "#/definitions/io.k8s.api.core.v1.PodTemplateSpec",
+          "description": "Template describes the pods that will be created."
+        }
+      },
+      "required": [
+        "template"
+      ],
+      "type": "object"
+    },
+    "io.k8s.api.extensions.v1beta1.DeploymentStatus": {
+      "description": "DeploymentStatus is the most recently observed status of the Deployment.",
+      "properties": {
+        "availableReplicas": {
+          "description": "Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "collisionCount": {
+          "description": "Count of hash collisions for the Deployment. The Deployment controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ReplicaSet.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "conditions": {
+          "description": "Represents the latest available observations of a deployment's current state.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.api.extensions.v1beta1.DeploymentCondition"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "type",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "observedGeneration": {
+          "description": "The generation observed by the deployment controller.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "readyReplicas": {
+          "description": "Total number of ready pods targeted by this deployment.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "replicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment (their labels match the selector).",
+          "format": "int32",
+          "type": "integer"
+        },
+        "unavailableReplicas": {
+          "description": "Total number of unavailable pods targeted by this deployment. This is the total number of pods that are still required for the deployment to have 100% available capacity. They may either be pods that are running but not yet available or pods that still have not been created.",
+          "format": "int32",
+          "type": "integer"
+        },
+        "updatedReplicas": {
+          "description": "Total number of non-terminated pods targeted by this deployment that have the desired template spec.",
+          "format": "int32",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.extensions.v1beta1.DeploymentStrategy": {
+      "description": "DeploymentStrategy describes how to replace existing pods with new ones.",
+      "properties": {
+        "rollingUpdate": {
+          "$ref": "#/definitions/io.k8s.api.extensions.v1beta1.RollingUpdateDeployment",
+          "description": "Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate."
+        },
+        "type": {
+          "description": "Type of deployment. Can be \"Recreate\" or \"RollingUpdate\". Default is RollingUpdate.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.extensions.v1beta1.RollbackConfig": {
+      "description": "DEPRECATED.",
+      "properties": {
+        "revision": {
+          "description": "The revision to rollback to. If set to 0, rollback to the last revision.",
+          "format": "int64",
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.api.extensions.v1beta1.RollingUpdateDeployment": {
+      "description": "Spec to control the desired behavior of rolling update.",
+      "properties": {
+        "maxSurge": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be scheduled above the desired number of pods. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). This can not be 0 if MaxUnavailable is 0. Absolute number is calculated from percentage by rounding up. By default, a value of 1 is used. Example: when this is set to 30%, the new RC can be scaled up immediately when the rolling update starts, such that the total number of old and new pods do not exceed 130% of desired pods. Once old pods have been killed, new RC can be scaled up further, ensuring that total number of pods running at any time during the update is at most 130% of desired pods."
+        },
+        "maxUnavailable": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.util.intstr.IntOrString",
+          "description": "The maximum number of pods that can be unavailable during the update. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). Absolute number is calculated from percentage by rounding down. This can not be 0 if MaxSurge is 0. By default, a fixed value of 1 is used. Example: when this is set to 30%, the old RC can be scaled down to 70% of desired pods immediately when the rolling update starts. Once new pods are ready, old RC can be scaled down further, followed by scaling up the new RC, ensuring that the total number of pods available at all times during the update is at least 70% of desired pods."
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.api.resource.Quantity": {
+      "description": "Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.\n\nThe serialization format is:\n\n<quantity>        ::= <signedNumber><suffix>\n  (Note that <suffix> may be empty, from the \"\" case in <decimalSI>.)\n<digit>           ::= 0 | 1 | ... | 9 <digits>          ::= <digit> | <digit><digits> <number>          ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign>            ::= \"+\" | \"-\" <signedNumber>    ::= <number> | <sign><number> <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei\n  (International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)\n<decimalSI>       ::= m | \"\" | k | M | G | T | P | E\n  (Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)\n<decimalExponent> ::= \"e\" <signedNumber> | \"E\" <signedNumber>\n\nNo matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.\n\nWhen a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.\n\nBefore serializing, Quantity will be put in \"canonical form\". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:\n  a. No precision is lost\n  b. No fractional digits will be emitted\n  c. The exponent (or suffix) is as large as possible.\nThe sign will be omitted unless the number is negative.\n\nExamples:\n  1.5 will be serialized as \"1500m\"\n  1.5Gi will be serialized as \"1536Mi\"\n\nNote that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.\n\nNon-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)\n\nThis format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.",
+      "type": "string"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1": {
+      "description": "FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.\n\nEach key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:<name>', where <name> is the name of a field in a struct, or key in a map 'v:<value>', where <value> is the exact json formatted value of a list item 'i:<index>', where <index> is position of a item in a list 'k:<keys>', where <keys> is a map of  a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set.\n\nThe exact format is defined in sigs.k8s.io/structured-merge-diff",
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector": {
+      "description": "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.",
+      "properties": {
+        "matchExpressions": {
+          "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement"
+          },
+          "type": "array"
+        },
+        "matchLabels": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+          "type": "object"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelectorRequirement": {
+      "description": "A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
+      "properties": {
+        "key": {
+          "description": "key is the label key that the selector applies to.",
+          "type": "string",
+          "x-kubernetes-patch-merge-key": "key",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "operator": {
+          "description": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.",
+          "type": "string"
+        },
+        "values": {
+          "description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "key",
+        "operator"
+      ],
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.ListMeta": {
+      "description": "ListMeta describes metadata that synthetic resources must have, including lists and various status objects. A resource may have only one of {ObjectMeta, ListMeta}.",
+      "properties": {
+        "continue": {
+          "description": "continue may be set if the user set a limit on the number of items returned, and indicates that the server has more data available. The value is opaque and may be used to issue another request to the endpoint that served this list to retrieve the next set of available objects. Continuing a consistent list may not be possible if the server configuration has changed or more than a few minutes have passed. The resourceVersion field returned when using this continue value will be identical to the value in the first response, unless you have received this token from an error message.",
+          "type": "string"
+        },
+        "remainingItemCount": {
+          "description": "remainingItemCount is the number of subsequent items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the field will be left unset and omitted during serialization. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and this field will be left unset and omitted during serialization. Servers older than v1.15 do not set this field. The intended use of the remainingItemCount is *estimating* the size of a collection. Clients should not rely on the remainingItemCount to be set or to be exact.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "resourceVersion": {
+          "description": "String that identifies the server's internal version of this object that can be used by clients to determine when objects have changed. Value must be treated as opaque by clients and passed unmodified back to the server. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency",
+          "type": "string"
+        },
+        "selfLink": {
+          "description": "selfLink is a URL representing this object. Populated by the system. Read-only.\n\nDEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry": {
+      "description": "ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.",
+      "properties": {
+        "apiVersion": {
+          "description": "APIVersion defines the version of this resource that this field set applies to. The format is \"group/version\" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.",
+          "type": "string"
+        },
+        "fieldsType": {
+          "description": "FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: \"FieldsV1\"",
+          "type": "string"
+        },
+        "fieldsV1": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.FieldsV1",
+          "description": "FieldsV1 holds the first JSON version format as described in the \"FieldsV1\" type."
+        },
+        "manager": {
+          "description": "Manager is an identifier of the workflow managing these fields.",
+          "type": "string"
+        },
+        "operation": {
+          "description": "Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.",
+          "type": "string"
+        },
+        "time": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "Time is timestamp of when these fields were set. It should always be empty if Operation is 'Apply'"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta": {
+      "description": "ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.",
+      "properties": {
+        "annotations": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations",
+          "type": "object"
+        },
+        "clusterName": {
+          "description": "The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.",
+          "type": "string"
+        },
+        "creationTimestamp": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.\n\nPopulated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata"
+        },
+        "deletionGracePeriodSeconds": {
+          "description": "Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "deletionTimestamp": {
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time",
+          "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata"
+        },
+        "finalizers": {
+          "description": "Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order.  Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "generateName": {
+          "description": "GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will return a 409.\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency",
+          "type": "string"
+        },
+        "generation": {
+          "description": "A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "labels": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels",
+          "type": "object"
+        },
+        "managedFields": {
+          "description": "ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like \"ci-cd\". The set of fields is always in the version that the workflow used when modifying the object.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ManagedFieldsEntry"
+          },
+          "type": "array"
+        },
+        "name": {
+          "description": "Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names",
+          "type": "string"
+        },
+        "namespace": {
+          "description": "Namespace defines the space within each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces",
+          "type": "string"
+        },
+        "ownerReferences": {
+          "description": "List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.",
+          "items": {
+            "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference"
+          },
+          "type": "array",
+          "x-kubernetes-patch-merge-key": "uid",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "resourceVersion": {
+          "description": "An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency",
+          "type": "string"
+        },
+        "selfLink": {
+          "description": "SelfLink is a URL representing this object. Populated by the system. Read-only.\n\nDEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release.",
+          "type": "string"
+        },
+        "uid": {
+          "description": "UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.OwnerReference": {
+      "description": "OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.",
+      "properties": {
+        "apiVersion": {
+          "description": "API version of the referent.",
+          "type": "string"
+        },
+        "blockOwnerDeletion": {
+          "description": "If true, AND if the owner has the \"foregroundDeletion\" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. Defaults to false. To set this field, a user needs \"delete\" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.",
+          "type": "boolean"
+        },
+        "controller": {
+          "description": "If true, this reference points to the managing controller.",
+          "type": "boolean"
+        },
+        "kind": {
+          "description": "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+          "type": "string"
+        },
+        "name": {
+          "description": "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names",
+          "type": "string"
+        },
+        "uid": {
+          "description": "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids",
+          "type": "string"
+        }
+      },
+      "required": [
+        "apiVersion",
+        "kind",
+        "name",
+        "uid"
+      ],
+      "type": "object"
+    },
+    "io.k8s.apimachinery.pkg.apis.meta.v1.Time": {
+      "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON.  Wrappers are provided for many of the factory methods that the time package offers.",
+      "format": "date-time",
+      "type": "string"
+    },
+    "io.k8s.apimachinery.pkg.util.intstr.IntOrString": {
+      "description": "IntOrString is a type that can hold an int32 or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a name or number.",
+      "format": "int-or-string",
+      "type": "string"
+    }
+  },
+  "info": {
+    "title": "Kubernetes",
+    "version": "test"
+  },
+  "paths": {
+  },
+  "swagger": "2.0"
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/testing/testfieldmanager.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/testing/testfieldmanager.go
new file mode 100644
index 0000000000..07558232ab
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/testing/testfieldmanager.go
@@ -0,0 +1,167 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"errors"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+)
+
+// FakeObjectCreater implements ObjectCreater, it can create empty
+// objects (unstructured) of the given GVK.
+type FakeObjectCreater struct{}
+
+func (f *FakeObjectCreater) New(gvk schema.GroupVersionKind) (runtime.Object, error) {
+	u := unstructured.Unstructured{Object: map[string]interface{}{}}
+	u.SetAPIVersion(gvk.GroupVersion().String())
+	u.SetKind(gvk.Kind)
+	return &u, nil
+}
+
+// FakeObjectConvertor implements runtime.ObjectConvertor but it
+// actually does nothing but return its input.
+type FakeObjectConvertor struct{}
+
+//nolint:staticcheck,ineffassign // SA4009 backwards compatibility
+func (c *FakeObjectConvertor) Convert(in, out, context interface{}) error {
+	out = in
+	return nil
+}
+
+func (c *FakeObjectConvertor) ConvertToVersion(in runtime.Object, _ runtime.GroupVersioner) (runtime.Object, error) {
+	return in, nil
+}
+
+func (c *FakeObjectConvertor) ConvertFieldLabel(_ schema.GroupVersionKind, _, _ string) (string, string, error) {
+	return "", "", errors.New("not implemented")
+}
+
+// FakeObjectDefaulter implements runtime.Defaulter, but it actually
+// does nothing.
+type FakeObjectDefaulter struct{}
+
+func (d *FakeObjectDefaulter) Default(in runtime.Object) {}
+
+type TestFieldManagerImpl struct {
+	fieldManager *internal.FieldManager
+	apiVersion   string
+	emptyObj     runtime.Object
+	liveObj      runtime.Object
+}
+
+// APIVersion of the object that we're tracking.
+func (f *TestFieldManagerImpl) APIVersion() string {
+	return f.apiVersion
+}
+
+// Reset resets the state of the liveObject by resetting it to an empty object.
+func (f *TestFieldManagerImpl) Reset() {
+	f.liveObj = f.emptyObj.DeepCopyObject()
+}
+
+// Live returns a copy of the current liveObject.
+func (f *TestFieldManagerImpl) Live() runtime.Object {
+	return f.liveObj.DeepCopyObject()
+}
+
+// Apply applies the given object on top of the current liveObj, for the
+// given manager and force flag.
+func (f *TestFieldManagerImpl) Apply(obj runtime.Object, manager string, force bool) error {
+	out, err := f.fieldManager.Apply(f.liveObj, obj, manager, force)
+	if err == nil {
+		f.liveObj = out
+	}
+	return err
+}
+
+// Update will updates the managed fields in the liveObj based on the
+// changes performed by the update.
+func (f *TestFieldManagerImpl) Update(obj runtime.Object, manager string) error {
+	out, err := f.fieldManager.Update(f.liveObj, obj, manager)
+	if err == nil {
+		f.liveObj = out
+	}
+	return err
+}
+
+// UpdateNoErrors is the same as Update, but it will not return errors.
+func (f *TestFieldManagerImpl) UpdateNoErrors(obj runtime.Object, manager string) {
+	f.liveObj = f.fieldManager.UpdateNoErrors(f.liveObj, obj, manager)
+}
+
+// ManagedFields returns the list of existing managed fields for the
+// liveObj.
+func (f *TestFieldManagerImpl) ManagedFields() []metav1.ManagedFieldsEntry {
+	accessor, err := meta.Accessor(f.liveObj)
+	if err != nil {
+		panic(fmt.Errorf("couldn't get accessor: %v", err))
+	}
+
+	return accessor.GetManagedFields()
+}
+
+// NewTestFieldManager creates a new manager for the given GVK.
+func NewTestFieldManagerImpl(typeConverter managedfields.TypeConverter, gvk schema.GroupVersionKind, subresource string, chainFieldManager func(internal.Manager) internal.Manager) *TestFieldManagerImpl {
+	f, err := internal.NewStructuredMergeManager(
+		typeConverter,
+		&FakeObjectConvertor{},
+		&FakeObjectDefaulter{},
+		gvk.GroupVersion(),
+		gvk.GroupVersion(),
+		nil,
+	)
+	if err != nil {
+		panic(err)
+	}
+	live := &unstructured.Unstructured{}
+	live.SetKind(gvk.Kind)
+	live.SetAPIVersion(gvk.GroupVersion().String())
+	// This is different from `internal.NewDefaultFieldManager` because:
+	// 1. We don't want to create a `internal.FieldManager`
+	// 2. We don't want to use the CapManager that is tested separately with
+	// a smaller than the default cap.
+	f = internal.NewVersionCheckManager(
+		internal.NewLastAppliedUpdater(
+			internal.NewLastAppliedManager(
+				internal.NewProbabilisticSkipNonAppliedManager(
+					internal.NewBuildManagerInfoManager(
+						internal.NewManagedFieldsUpdater(
+							internal.NewStripMetaManager(f),
+						), gvk.GroupVersion(), subresource,
+					), &FakeObjectCreater{}, internal.DefaultTrackOnCreateProbability,
+				), typeConverter, &FakeObjectConvertor{}, gvk.GroupVersion(),
+			),
+		), gvk,
+	)
+	if chainFieldManager != nil {
+		f = chainFieldManager(f)
+	}
+	return &TestFieldManagerImpl{
+		fieldManager: internal.NewFieldManager(f, subresource),
+		apiVersion:   gvk.GroupVersion().String(),
+		emptyObj:     live,
+		liveObj:      live.DeepCopyObject(),
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter.go
new file mode 100644
index 0000000000..40cc90da78
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter.go
@@ -0,0 +1,211 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kube-openapi/pkg/schemaconv"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+	smdschema "sigs.k8s.io/structured-merge-diff/v6/schema"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+	"sigs.k8s.io/structured-merge-diff/v6/value"
+)
+
+// TypeConverter allows you to convert from runtime.Object to
+// typed.TypedValue and the other way around.
+type TypeConverter interface {
+	ObjectToTyped(runtime.Object, ...typed.ValidationOptions) (*typed.TypedValue, error)
+	TypedToObject(*typed.TypedValue) (runtime.Object, error)
+}
+
+type typeConverter struct {
+	parser map[schema.GroupVersionKind]*typed.ParseableType
+}
+
+var _ TypeConverter = &typeConverter{}
+
+func NewTypeConverter(openapiSpec map[string]*spec.Schema, preserveUnknownFields bool) (TypeConverter, error) {
+	typeSchema, err := schemaconv.ToSchemaFromOpenAPI(openapiSpec, preserveUnknownFields)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert models to schema: %v", err)
+	}
+
+	typeParser := typed.Parser{Schema: smdschema.Schema{Types: typeSchema.Types}}
+	tr := indexModels(&typeParser, openapiSpec)
+
+	return &typeConverter{parser: tr}, nil
+}
+
+func (c *typeConverter) ObjectToTyped(obj runtime.Object, opts ...typed.ValidationOptions) (*typed.TypedValue, error) {
+	gvk := obj.GetObjectKind().GroupVersionKind()
+	t := c.parser[gvk]
+	if t == nil {
+		return nil, NewNoCorrespondingTypeError(gvk)
+	}
+	switch o := obj.(type) {
+	case *unstructured.Unstructured:
+		return t.FromUnstructured(o.UnstructuredContent(), opts...)
+	default:
+		return t.FromStructured(obj, opts...)
+	}
+}
+
+func (c *typeConverter) TypedToObject(value *typed.TypedValue) (runtime.Object, error) {
+	return valueToObject(value.AsValue())
+}
+
+type deducedTypeConverter struct{}
+
+// DeducedTypeConverter is a TypeConverter for CRDs that don't have a
+// schema. It does implement the same interface though (and create the
+// same types of objects), so that everything can still work the same.
+// CRDs are merged with all their fields being "atomic" (lists
+// included).
+func NewDeducedTypeConverter() TypeConverter {
+	return deducedTypeConverter{}
+}
+
+// ObjectToTyped converts an object into a TypedValue with a "deduced type".
+func (deducedTypeConverter) ObjectToTyped(obj runtime.Object, opts ...typed.ValidationOptions) (*typed.TypedValue, error) {
+	switch o := obj.(type) {
+	case *unstructured.Unstructured:
+		return typed.DeducedParseableType.FromUnstructured(o.UnstructuredContent(), opts...)
+	default:
+		return typed.DeducedParseableType.FromStructured(obj, opts...)
+	}
+}
+
+// TypedToObject transforms the typed value into a runtime.Object. That
+// is not specific to deduced type.
+func (deducedTypeConverter) TypedToObject(value *typed.TypedValue) (runtime.Object, error) {
+	return valueToObject(value.AsValue())
+}
+
+func valueToObject(val value.Value) (runtime.Object, error) {
+	vu := val.Unstructured()
+	switch o := vu.(type) {
+	case map[string]interface{}:
+		return &unstructured.Unstructured{Object: o}, nil
+	default:
+		return nil, fmt.Errorf("failed to convert value to unstructured for type %T", vu)
+	}
+}
+
+// GroupVersionOfTypedValue returns the extracted GroupVersion from the TypeMeta
+// fields of a TypedValue, or return false if no TypeMeta fields are found.
+func GroupVersionOfTypedValue(object *typed.TypedValue) (schema.GroupVersion, bool) {
+	val := object.AsValue()
+	if val == nil || !val.IsMap() {
+		return schema.GroupVersion{}, false
+	}
+	apiVersion, ok := val.AsMap().Get("apiVersion")
+	if !ok || !apiVersion.IsString() {
+		return schema.GroupVersion{}, false
+	}
+	groupVersion, err := schema.ParseGroupVersion(apiVersion.AsString())
+	if err != nil {
+		return schema.GroupVersion{}, false
+	}
+	return groupVersion, true
+}
+
+func indexModels(
+	typeParser *typed.Parser,
+	openAPISchemas map[string]*spec.Schema,
+) map[schema.GroupVersionKind]*typed.ParseableType {
+	tr := map[schema.GroupVersionKind]*typed.ParseableType{}
+	for modelName, model := range openAPISchemas {
+		gvkList := parseGroupVersionKind(model.Extensions)
+		if len(gvkList) == 0 {
+			continue
+		}
+
+		parsedType := typeParser.Type(modelName)
+		for _, gvk := range gvkList {
+			if len(gvk.Kind) > 0 {
+				tr[schema.GroupVersionKind(gvk)] = &parsedType
+			}
+		}
+	}
+	return tr
+}
+
+// Get and parse GroupVersionKind from the extension. Returns empty if it doesn't have one.
+func parseGroupVersionKind(extensions map[string]interface{}) []schema.GroupVersionKind {
+	gvkListResult := []schema.GroupVersionKind{}
+
+	// Get the extensions
+	gvkExtension, ok := extensions["x-kubernetes-group-version-kind"]
+	if !ok {
+		return []schema.GroupVersionKind{}
+	}
+
+	// gvk extension must be a list of at least 1 element.
+	gvkList, ok := gvkExtension.([]interface{})
+	if !ok {
+		return []schema.GroupVersionKind{}
+	}
+
+	for _, gvk := range gvkList {
+		var group, version, kind string
+
+		// gvk extension list must be a map with group, version, and
+		// kind fields
+		if gvkMap, ok := gvk.(map[interface{}]interface{}); ok {
+			group, ok = gvkMap["group"].(string)
+			if !ok {
+				continue
+			}
+			version, ok = gvkMap["version"].(string)
+			if !ok {
+				continue
+			}
+			kind, ok = gvkMap["kind"].(string)
+			if !ok {
+				continue
+			}
+
+		} else if gvkMap, ok := gvk.(map[string]interface{}); ok {
+			group, ok = gvkMap["group"].(string)
+			if !ok {
+				continue
+			}
+			version, ok = gvkMap["version"].(string)
+			if !ok {
+				continue
+			}
+			kind, ok = gvkMap["kind"].(string)
+			if !ok {
+				continue
+			}
+		} else {
+			continue
+		}
+
+		gvkListResult = append(gvkListResult, schema.GroupVersionKind{
+			Group:   group,
+			Version: version,
+			Kind:    kind,
+		})
+	}
+
+	return gvkListResult
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter_test.go
new file mode 100644
index 0000000000..e1094bf5f8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter_test.go
@@ -0,0 +1,317 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	smdschema "sigs.k8s.io/structured-merge-diff/v6/schema"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+	"sigs.k8s.io/yaml"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+)
+
+func TestTypeConverter(t *testing.T) {
+	dtc := NewDeducedTypeConverter()
+
+	testCases := []struct {
+		name string
+		yaml string
+	}{
+		{
+			name: "apps/v1.Deployment",
+			yaml: `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+  labels:
+    app: nginx
+spec:
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.15.4
+`,
+		}, {
+			name: "extensions/v1beta1.Deployment",
+			yaml: `
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+  labels:
+    app: nginx
+spec:
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.15.4
+`,
+		}, {
+			name: "v1.Pod",
+			yaml: `
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-pod
+  labels:
+    app: nginx
+spec:
+  containers:
+  - name: nginx
+    image: nginx:1.15.4
+`,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(fmt.Sprintf("%v ObjectToTyped with TypeConverter", testCase.name), func(t *testing.T) {
+			testObjectToTyped(t, testTypeConverter, testCase.yaml)
+		})
+		t.Run(fmt.Sprintf("%v ObjectToTyped with DeducedTypeConverter", testCase.name), func(t *testing.T) {
+			testObjectToTyped(t, dtc, testCase.yaml)
+		})
+	}
+}
+
+func testObjectToTyped(t *testing.T, tc TypeConverter, y string) {
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(y), &obj.Object); err != nil {
+		t.Fatalf("Failed to parse yaml object: %v", err)
+	}
+	typed, err := tc.ObjectToTyped(obj)
+	if err != nil {
+		t.Fatalf("Failed to convert object to typed: %v", err)
+	}
+	newObj, err := tc.TypedToObject(typed)
+	if err != nil {
+		t.Fatalf("Failed to convert typed to object: %v", err)
+	}
+	if !reflect.DeepEqual(obj, newObj) {
+		t.Errorf(`Round-trip failed:
+Original object:
+%#v
+Final object:
+%#v`, obj, newObj)
+	}
+}
+
+var result typed.TypedValue
+
+func BenchmarkObjectToTyped(b *testing.B) {
+	y := `
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+  labels:
+    app: nginx
+spec:
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.15.4
+`
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal([]byte(y), &obj.Object); err != nil {
+		b.Fatalf("Failed to parse yaml object: %v", err)
+	}
+
+	b.ResetTimer()
+	b.ReportAllocs()
+
+	var r *typed.TypedValue
+	for i := 0; i < b.N; i++ {
+		var err error
+		r, err = testTypeConverter.ObjectToTyped(obj)
+		if err != nil {
+			b.Fatalf("Failed to convert object to typed: %v", err)
+		}
+	}
+	result = *r
+}
+
+func TestIndexModels(t *testing.T) {
+	myDefs := map[string]*spec.Schema{
+		// Show empty GVK extension is ignored
+		"def0": {
+			VendorExtensible: spec.VendorExtensible{
+				Extensions: spec.Extensions{
+					"x-kubernetes-group-version-kind": []interface{}{},
+				},
+			},
+		},
+		// Show nil GVK is ignored
+		"def0.0": {
+			VendorExtensible: spec.VendorExtensible{
+				Extensions: spec.Extensions{
+					"x-kubernetes-group-version-kind": nil,
+				},
+			},
+		},
+		// Show this is ignored
+		"def0.1": {},
+		// Show allows binding a single GVK
+		"def1": {
+			VendorExtensible: spec.VendorExtensible{
+				Extensions: spec.Extensions{
+					"x-kubernetes-group-version-kind": []interface{}{
+						map[string]interface{}{
+							"group":   "mygroup",
+							"version": "v1",
+							"kind":    "MyKind",
+						},
+					},
+				},
+			},
+		},
+		// Show allows bindings with two versions
+		"def2": {
+			VendorExtensible: spec.VendorExtensible{
+				Extensions: spec.Extensions{
+					"x-kubernetes-group-version-kind": []interface{}{
+						map[string]interface{}{
+							"group":   "mygroup",
+							"version": "v1",
+							"kind":    "MyOtherKind",
+						},
+						map[string]interface{}{
+							"group":   "mygroup",
+							"version": "v2",
+							"kind":    "MyOtherKind",
+						},
+					},
+				},
+			},
+		},
+		// Show that we can mix and match GVKs from other definitions, and
+		// that both map[interface{}]interface{} and map[string]interface{}
+		// are allowed
+		"def3": {
+			VendorExtensible: spec.VendorExtensible{
+				Extensions: spec.Extensions{
+					"x-kubernetes-group-version-kind": []interface{}{
+						map[string]interface{}{
+							"group":   "mygroup",
+							"version": "v3",
+							"kind":    "MyKind",
+						},
+						map[interface{}]interface{}{
+							"group":   "mygroup",
+							"version": "v3",
+							"kind":    "MyOtherKind",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	myTypes := []smdschema.TypeDef{
+		{
+			Name: "def0",
+			Atom: smdschema.Atom{},
+		},
+		{
+			Name: "def0.1",
+			Atom: smdschema.Atom{},
+		},
+		{
+			Name: "def0.2",
+			Atom: smdschema.Atom{},
+		},
+		{
+			Name: "def1",
+			Atom: smdschema.Atom{},
+		},
+		{
+			Name: "def2",
+			Atom: smdschema.Atom{},
+		},
+		{
+			Name: "def3",
+			Atom: smdschema.Atom{},
+		},
+	}
+
+	parser := typed.Parser{Schema: smdschema.Schema{Types: myTypes}}
+	gvkIndex := indexModels(&parser, myDefs)
+
+	require.Len(t, gvkIndex, 5)
+
+	resultNames := map[schema.GroupVersionKind]string{}
+	for k, v := range gvkIndex {
+		require.NotNil(t, v.TypeRef.NamedType)
+		resultNames[k] = *v.TypeRef.NamedType
+	}
+
+	require.Equal(t, map[schema.GroupVersionKind]string{
+		{
+			Group:   "mygroup",
+			Version: "v1",
+			Kind:    "MyKind",
+		}: "def1",
+		{
+			Group:   "mygroup",
+			Version: "v1",
+			Kind:    "MyOtherKind",
+		}: "def2",
+		{
+			Group:   "mygroup",
+			Version: "v2",
+			Kind:    "MyOtherKind",
+		}: "def2",
+		{
+			Group:   "mygroup",
+			Version: "v3",
+			Kind:    "MyKind",
+		}: "def3",
+		{
+			Group:   "mygroup",
+			Version: "v3",
+			Kind:    "MyOtherKind",
+		}: "def3",
+	}, resultNames)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versioncheck.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versioncheck.go
new file mode 100644
index 0000000000..ee1e2bca70
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versioncheck.go
@@ -0,0 +1,52 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+type versionCheckManager struct {
+	fieldManager Manager
+	gvk          schema.GroupVersionKind
+}
+
+var _ Manager = &versionCheckManager{}
+
+// NewVersionCheckManager creates a manager that makes sure that the
+// applied object is in the proper version.
+func NewVersionCheckManager(fieldManager Manager, gvk schema.GroupVersionKind) Manager {
+	return &versionCheckManager{fieldManager: fieldManager, gvk: gvk}
+}
+
+// Update implements Manager.
+func (f *versionCheckManager) Update(liveObj, newObj runtime.Object, managed Managed, manager string) (runtime.Object, Managed, error) {
+	// Nothing to do for updates, this is checked in many other places.
+	return f.fieldManager.Update(liveObj, newObj, managed, manager)
+}
+
+// Apply implements Manager.
+func (f *versionCheckManager) Apply(liveObj, appliedObj runtime.Object, managed Managed, fieldManager string, force bool) (runtime.Object, Managed, error) {
+	if gvk := appliedObj.GetObjectKind().GroupVersionKind(); gvk != f.gvk {
+		return nil, nil, errors.NewBadRequest(fmt.Sprintf("invalid object type: %v", gvk))
+	}
+	return f.fieldManager.Apply(liveObj, appliedObj, managed, fieldManager, force)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter.go
new file mode 100644
index 0000000000..917bdcd75f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter.go
@@ -0,0 +1,122 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+)
+
+// versionConverter is an implementation of
+// sigs.k8s.io/structured-merge-diff/merge.Converter
+type versionConverter struct {
+	typeConverter   TypeConverter
+	objectConvertor runtime.ObjectConvertor
+	hubGetter       func(from schema.GroupVersion) schema.GroupVersion
+}
+
+var _ merge.Converter = &versionConverter{}
+
+// NewVersionConverter builds a VersionConverter from a TypeConverter and an ObjectConvertor.
+func newVersionConverter(t TypeConverter, o runtime.ObjectConvertor, h schema.GroupVersion) merge.Converter {
+	return &versionConverter{
+		typeConverter:   t,
+		objectConvertor: o,
+		hubGetter: func(from schema.GroupVersion) schema.GroupVersion {
+			return schema.GroupVersion{
+				Group:   from.Group,
+				Version: h.Version,
+			}
+		},
+	}
+}
+
+// NewCRDVersionConverter builds a VersionConverter for CRDs from a TypeConverter and an ObjectConvertor.
+func newCRDVersionConverter(t TypeConverter, o runtime.ObjectConvertor, h schema.GroupVersion) merge.Converter {
+	return &versionConverter{
+		typeConverter:   t,
+		objectConvertor: o,
+		hubGetter: func(from schema.GroupVersion) schema.GroupVersion {
+			return h
+		},
+	}
+}
+
+// Convert implements sigs.k8s.io/structured-merge-diff/merge.Converter
+func (v *versionConverter) Convert(object *typed.TypedValue, version fieldpath.APIVersion) (*typed.TypedValue, error) {
+	groupVersion, err := schema.ParseGroupVersion(string(version))
+	if err != nil {
+		return object, err
+	}
+
+	// If attempting to convert to the same version as we already have, just return it.
+	if typedVersion, ok := GroupVersionOfTypedValue(object); ok && typedVersion == groupVersion {
+		return object, nil
+	}
+
+	// Convert the smd typed value to a kubernetes object.
+	objectToConvert, err := v.typeConverter.TypedToObject(object)
+	if err != nil {
+		return object, err
+	}
+	fromVersion := objectToConvert.GetObjectKind().GroupVersionKind().GroupVersion()
+
+	// Convert to internal
+	internalObject, err := v.objectConvertor.ConvertToVersion(objectToConvert, v.hubGetter(fromVersion))
+	if err != nil {
+		return object, err
+	}
+
+	// Convert the object into the target version
+	convertedObject, err := v.objectConvertor.ConvertToVersion(internalObject, groupVersion)
+	if err != nil {
+		return object, err
+	}
+
+	// Convert the object back to a smd typed value and return it.
+	return v.typeConverter.ObjectToTyped(convertedObject)
+}
+
+// IsMissingVersionError
+func (v *versionConverter) IsMissingVersionError(err error) bool {
+	return runtime.IsNotRegisteredError(err) || isNoCorrespondingTypeError(err)
+}
+
+type noCorrespondingTypeErr struct {
+	gvk schema.GroupVersionKind
+}
+
+func NewNoCorrespondingTypeError(gvk schema.GroupVersionKind) error {
+	return &noCorrespondingTypeErr{gvk: gvk}
+}
+
+func (k *noCorrespondingTypeErr) Error() string {
+	return fmt.Sprintf("no corresponding type for %v", k.gvk)
+}
+
+func isNoCorrespondingTypeError(err error) bool {
+	if err == nil {
+		return false
+	}
+	_, ok := err.(*noCorrespondingTypeErr)
+	return ok
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter_bench_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter_bench_test.go
new file mode 100644
index 0000000000..d1dd65fe0f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter_bench_test.go
@@ -0,0 +1,197 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"fmt"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/merge"
+)
+
+// benchDeployment is a structured (reflect-backed) object whose JSON shape is a
+// subset of the apps Deployment schema. Built-in types reach the version
+// converter as reflect-backed typed values, so the pre-fast-path Convert had to
+// deep-copy the whole object via TypedToObject just to read its apiVersion;
+// this type reproduces that cost.
+type benchDeployment struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+}
+
+func (d *benchDeployment) DeepCopyObject() runtime.Object {
+	out := &benchDeployment{TypeMeta: d.TypeMeta}
+	d.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	return out
+}
+
+// structuredDeployment returns a reflect-backed Deployment with n labels and n
+// annotations, exercising the built-in-type code path.
+func structuredDeployment(apiVersion string, n int) runtime.Object {
+	labels, annotations := metaMaps(n)
+	return &benchDeployment{
+		TypeMeta: metav1.TypeMeta{APIVersion: apiVersion, Kind: "Deployment"},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:        "nginx-deployment",
+			Namespace:   "default",
+			Labels:      labels,
+			Annotations: annotations,
+		},
+	}
+}
+
+// unstructuredDeployment returns a value-backed Deployment, exercising the CRD
+// code path (the typed value already holds a map, so TypedToObject is cheap).
+func unstructuredDeployment(apiVersion string, n int) runtime.Object {
+	labels, annotations := metaMaps(n)
+	return &unstructured.Unstructured{Object: map[string]interface{}{
+		"apiVersion": apiVersion,
+		"kind":       "Deployment",
+		"metadata": map[string]interface{}{
+			"name":        "nginx-deployment",
+			"namespace":   "default",
+			"labels":      toInterfaceMap(labels),
+			"annotations": toInterfaceMap(annotations),
+		},
+	}}
+}
+
+func metaMaps(n int) (labels, annotations map[string]string) {
+	labels = make(map[string]string, n)
+	annotations = make(map[string]string, n)
+	for i := range n {
+		labels[fmt.Sprintf("k8s.io/label-%d", i)] = fmt.Sprintf("value-%d", i)
+		annotations[fmt.Sprintf("k8s.io/annotation-%d", i)] = fmt.Sprintf("value-%d", i)
+	}
+	return labels, annotations
+}
+
+func toInterfaceMap(m map[string]string) map[string]interface{} {
+	out := make(map[string]interface{}, len(m))
+	for k, v := range m {
+		out[k] = v
+	}
+	return out
+}
+
+func benchVersionConverter() merge.Converter {
+	oc := fakeObjectConvertorForTestSchema{
+		gvkForVersion("v1beta1"): objForGroupVersion("apps/v1beta1"),
+		gvkForVersion("v1"):      objForGroupVersion("apps/v1"),
+	}
+	return newVersionConverter(testTypeConverter, oc, schema.GroupVersion{Group: "apps", Version: runtime.APIVersionInternal})
+}
+
+var benchBackings = []struct {
+	name  string
+	build func(apiVersion string, n int) runtime.Object
+}{
+	{"structured", structuredDeployment},
+	{"unstructured", unstructuredDeployment},
+}
+
+var benchConversions = []struct {
+	name    string
+	version fieldpath.APIVersion
+}{
+	{"same-version", "apps/v1beta1"},
+	{"cross-version", "apps/v1"},
+}
+
+var benchSizes = []int{0, 10, 100, 1000}
+
+// BenchmarkVersionConverter measures versionConverter.Convert across reflect-backed
+// (built-in) and value-backed (CRD) inputs, for the same-version (fast path) and
+// cross-version (fallback) cases, over a range of object sizes.
+func BenchmarkVersionConverter(b *testing.B) {
+	vc := benchVersionConverter()
+	for _, backing := range benchBackings {
+		for _, conv := range benchConversions {
+			for _, n := range benchSizes {
+				input, err := testTypeConverter.ObjectToTyped(backing.build("apps/v1beta1", n))
+				if err != nil {
+					b.Fatalf("ObjectToTyped(%s, fields=%d): %v", backing.name, n, err)
+				}
+				b.Run(fmt.Sprintf("%s/%s/fields=%d", backing.name, conv.name, n), func(b *testing.B) {
+					b.ReportAllocs()
+					b.ResetTimer()
+					for i := 0; i < b.N; i++ {
+						if _, err := vc.Convert(input, conv.version); err != nil {
+							b.Fatalf("Convert: %v", err)
+						}
+					}
+				})
+			}
+		}
+	}
+}
+
+// TestBenchmarkFastPathEngages guards the benchmark: it confirms the same-version
+// case takes the fast path (no TypedToObject / ConvertToVersion) for both
+// reflect-backed and value-backed inputs, and that the cross-version case does
+// not, so the before/after comparison measures the intended code paths.
+func TestBenchmarkFastPathEngages(t *testing.T) {
+	for _, backing := range benchBackings {
+		t.Run(backing.name, func(t *testing.T) {
+			input, err := testTypeConverter.ObjectToTyped(backing.build("apps/v1beta1", 10))
+			if err != nil {
+				t.Fatalf("ObjectToTyped: %v", err)
+			}
+
+			// Same version: fast path, no materialization or conversion.
+			tc := &countingTypeConverter{TypeConverter: testTypeConverter}
+			oc := &countingObjectConvertor{ObjectConvertor: benchObjectConvertor()}
+			vc := newVersionConverter(tc, oc, schema.GroupVersion{Group: "apps", Version: runtime.APIVersionInternal})
+			out, err := vc.Convert(input, fieldpath.APIVersion("apps/v1beta1"))
+			if err != nil {
+				t.Fatalf("Convert same-version: %v", err)
+			}
+			if out != input {
+				t.Errorf("same-version Convert should return input unchanged")
+			}
+			if tc.typedToObjectCalls != 0 {
+				t.Errorf("same-version Convert called TypedToObject %d times, want 0", tc.typedToObjectCalls)
+			}
+			if oc.convertToVersionCalls != 0 {
+				t.Errorf("same-version Convert called ConvertToVersion %d times, want 0", oc.convertToVersionCalls)
+			}
+
+			// Cross version: fallback path materializes the object.
+			tc = &countingTypeConverter{TypeConverter: testTypeConverter}
+			oc = &countingObjectConvertor{ObjectConvertor: benchObjectConvertor()}
+			vc = newVersionConverter(tc, oc, schema.GroupVersion{Group: "apps", Version: runtime.APIVersionInternal})
+			if _, err := vc.Convert(input, fieldpath.APIVersion("apps/v1")); err != nil {
+				t.Fatalf("Convert cross-version: %v", err)
+			}
+			if tc.typedToObjectCalls == 0 {
+				t.Errorf("cross-version Convert should call TypedToObject")
+			}
+		})
+	}
+}
+
+func benchObjectConvertor() fakeObjectConvertorForTestSchema {
+	return fakeObjectConvertorForTestSchema{
+		gvkForVersion("v1beta1"): objForGroupVersion("apps/v1beta1"),
+		gvkForVersion("v1"):      objForGroupVersion("apps/v1"),
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter_test.go
new file mode 100644
index 0000000000..ced691d158
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter_test.go
@@ -0,0 +1,164 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+)
+
+var testTypeConverter = func() TypeConverter {
+	data, err := os.ReadFile(filepath.Join("testdata", "swagger.json"))
+	if err != nil {
+		panic(err)
+	}
+	swag := spec.Swagger{}
+	if err := json.Unmarshal(data, &swag); err != nil {
+		panic(err)
+	}
+
+	convertedDefs := map[string]*spec.Schema{}
+	for k, v := range swag.Definitions {
+		vCopy := v
+		convertedDefs[k] = &vCopy
+	}
+	typeConverter, err := NewTypeConverter(convertedDefs, false)
+	if err != nil {
+		panic(err)
+	}
+	return typeConverter
+}()
+
+// TestVersionConverter tests the version converter
+func TestVersionConverter(t *testing.T) {
+	oc := fakeObjectConvertorForTestSchema{
+		gvkForVersion("v1beta1"): objForGroupVersion("apps/v1beta1"),
+		gvkForVersion("v1"):      objForGroupVersion("apps/v1"),
+	}
+	vc := newVersionConverter(testTypeConverter, oc, schema.GroupVersion{Group: "apps", Version: runtime.APIVersionInternal})
+
+	input, err := testTypeConverter.ObjectToTyped(objForGroupVersion("apps/v1beta1"))
+	if err != nil {
+		t.Fatalf("error creating converting input object to a typed value: %v", err)
+	}
+	expected := objForGroupVersion("apps/v1")
+	output, err := vc.Convert(input, fieldpath.APIVersion("apps/v1"))
+	if err != nil {
+		t.Fatalf("expected err to be nil but got %v", err)
+	}
+	actual, err := testTypeConverter.TypedToObject(output)
+	if err != nil {
+		t.Fatalf("error converting output typed value to an object %v", err)
+	}
+
+	if !reflect.DeepEqual(expected, actual) {
+		t.Fatalf("expected to get %v but got %v", expected, actual)
+	}
+}
+
+func TestVersionConverterSameVersion(t *testing.T) {
+	tc := &countingTypeConverter{TypeConverter: testTypeConverter}
+	oc := &countingObjectConvertor{ObjectConvertor: fakeObjectConvertorForTestSchema{}}
+	vc := newVersionConverter(tc, oc, schema.GroupVersion{Group: "apps", Version: runtime.APIVersionInternal})
+
+	input, err := testTypeConverter.ObjectToTyped(objForGroupVersion("apps/v1beta1"))
+	if err != nil {
+		t.Fatalf("error converting input object to a typed value: %v", err)
+	}
+	output, err := vc.Convert(input, fieldpath.APIVersion("apps/v1beta1"))
+	if err != nil {
+		t.Fatalf("expected err to be nil but got %v", err)
+	}
+	if output != input {
+		t.Errorf("expected same-version conversion to return the input unchanged")
+	}
+	if tc.typedToObjectCalls != 0 {
+		t.Errorf("expected no TypedToObject calls for same-version conversion, got %d", tc.typedToObjectCalls)
+	}
+	if oc.convertToVersionCalls != 0 {
+		t.Errorf("expected no ConvertToVersion calls for same-version conversion, got %d", oc.convertToVersionCalls)
+	}
+}
+
+type countingTypeConverter struct {
+	TypeConverter
+	typedToObjectCalls int
+}
+
+func (c *countingTypeConverter) TypedToObject(value *typed.TypedValue) (runtime.Object, error) {
+	c.typedToObjectCalls++
+	return c.TypeConverter.TypedToObject(value)
+}
+
+type countingObjectConvertor struct {
+	runtime.ObjectConvertor
+	convertToVersionCalls int
+}
+
+func (c *countingObjectConvertor) ConvertToVersion(in runtime.Object, gv runtime.GroupVersioner) (runtime.Object, error) {
+	c.convertToVersionCalls++
+	return c.ObjectConvertor.ConvertToVersion(in, gv)
+}
+
+func gvkForVersion(v string) schema.GroupVersionKind {
+	return schema.GroupVersionKind{
+		Group:   "apps",
+		Version: v,
+		Kind:    "Deployment",
+	}
+}
+
+func objForGroupVersion(gv string) runtime.Object {
+	return &unstructured.Unstructured{
+		Object: map[string]interface{}{
+			"apiVersion": gv,
+			"kind":       "Deployment",
+		},
+	}
+}
+
+type fakeObjectConvertorForTestSchema map[schema.GroupVersionKind]runtime.Object
+
+var _ runtime.ObjectConvertor = fakeObjectConvertorForTestSchema{}
+
+func (c fakeObjectConvertorForTestSchema) ConvertToVersion(_ runtime.Object, gv runtime.GroupVersioner) (runtime.Object, error) {
+	allKinds := make([]schema.GroupVersionKind, 0)
+	for kind := range c {
+		allKinds = append(allKinds, kind)
+	}
+	gvk, _ := gv.KindForGroupVersionKinds(allKinds)
+	return c[gvk], nil
+}
+
+func (fakeObjectConvertorForTestSchema) Convert(_, _, _ interface{}) error {
+	return fmt.Errorf("function not implemented")
+}
+
+func (fakeObjectConvertorForTestSchema) ConvertFieldLabel(_ schema.GroupVersionKind, _, _ string) (string, string, error) {
+	return "", "", fmt.Errorf("function not implemented")
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/managedfieldstest/testfieldmanager.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/managedfieldstest/testfieldmanager.go
new file mode 100644
index 0000000000..afa7b06df9
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/managedfieldstest/testfieldmanager.go
@@ -0,0 +1,94 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfieldstest
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal/testing"
+)
+
+// TestFieldManager is a FieldManager that can be used in test to
+// simulate the behavior of Server-Side Apply and field tracking. This
+// also has a few methods to get a sense of the state of the object.
+//
+// This TestFieldManager uses a series of "fake" objects to simulate
+// some behavior which come with the limitation that you can only use
+// one version since there is no version conversion logic.
+//
+// You can use this rather than NewDefaultTestFieldManager if you want
+// to specify either a sub-resource, or a set of modified Manager to
+// test them specifically.
+type TestFieldManager interface {
+	// APIVersion of the object that we're tracking.
+	APIVersion() string
+	// Reset resets the state of the liveObject by resetting it to an empty object.
+	Reset()
+	// Live returns a copy of the current liveObject.
+	Live() runtime.Object
+	// Apply applies the given object on top of the current liveObj, for the
+	// given manager and force flag.
+	Apply(obj runtime.Object, manager string, force bool) error
+	// Update will updates the managed fields in the liveObj based on the
+	// changes performed by the update.
+	Update(obj runtime.Object, manager string) error
+	// ManagedFields returns the list of existing managed fields for the
+	// liveObj.
+	ManagedFields() []metav1.ManagedFieldsEntry
+}
+
+// NewTestFieldManager returns a new TestFieldManager built for the
+// given gvk, on the main resource.
+func NewTestFieldManager(typeConverter managedfields.TypeConverter, gvk schema.GroupVersionKind) TestFieldManager {
+	return testing.NewTestFieldManagerImpl(typeConverter, gvk, "", nil)
+}
+
+// NewTestFieldManagerSubresource returns a new TestFieldManager built
+// for the given gvk, on the given sub-resource.
+func NewTestFieldManagerSubresource(typeConverter managedfields.TypeConverter, gvk schema.GroupVersionKind, subresource string) TestFieldManager {
+	return testing.NewTestFieldManagerImpl(typeConverter, gvk, subresource, nil)
+
+}
+
+// NewFakeFieldManager creates an actual FieldManager but that doesn't
+// perform any conversion. This is just a convenience for tests to
+// create an actual manager that they can use but in very restricted
+// ways.
+//
+// This is different from the TestFieldManager because it's not meant to
+// assert values, or hold the state, this acts like a normal
+// FieldManager.
+//
+// Also, this only operates on the main-resource, and sub-resource can't
+// be configured.
+func NewFakeFieldManager(typeConverter managedfields.TypeConverter, gvk schema.GroupVersionKind) *managedfields.FieldManager {
+	ffm, err := managedfields.NewDefaultFieldManager(
+		typeConverter,
+		&testing.FakeObjectConvertor{},
+		&testing.FakeObjectDefaulter{},
+		&testing.FakeObjectCreater{},
+		gvk,
+		gvk.GroupVersion(),
+		"",
+		nil)
+	if err != nil {
+		panic(err)
+	}
+	return ffm
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/node.yaml b/third_party/k8s.io/apimachinery/pkg/util/managedfields/node.yaml
new file mode 100644
index 0000000000..a7f2d54fdf
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/node.yaml
@@ -0,0 +1,261 @@
+apiVersion: v1
+kind: Node
+metadata:
+  annotations:
+    container.googleapis.com/instance_id: "123456789321654789"
+    node.alpha.kubernetes.io/ttl: "0"
+    volumes.kubernetes.io/controller-managed-attach-detach: "true"
+  creationTimestamp: "2019-07-09T16:17:29Z"
+  labels:
+    kubernetes.io/arch: amd64
+    beta.kubernetes.io/fluentd-ds-ready: "true"
+    beta.kubernetes.io/instance-type: n1-standard-4
+    kubernetes.io/os: linux
+    cloud.google.com/gke-nodepool: default-pool
+    cloud.google.com/gke-os-distribution: cos
+    failure-domain.beta.kubernetes.io/region: us-central1
+    failure-domain.beta.kubernetes.io/zone: us-central1-b
+    topology.kubernetes.io/region: us-central1
+    topology.kubernetes.io/zone: us-central1-b
+    kubernetes.io/hostname: node-default-pool-something
+  name: node-default-pool-something
+  resourceVersion: "211582541"
+  selfLink: /api/v1/nodes/node-default-pool-something
+  uid: 0c24d0e1-a265-11e9-abe4-42010a80026b
+spec:
+  podCIDR: 10.0.0.1/24
+  providerID: some-provider-id-of-some-sort
+status:
+  addresses:
+  - address: 10.0.0.1
+    type: InternalIP
+  - address: 192.168.0.1
+    type: ExternalIP
+  - address: node-default-pool-something
+    type: Hostname
+  allocatable:
+    cpu: 3920m
+    ephemeral-storage: "104638878617"
+    hugepages-2Mi: "0"
+    memory: 12700100Ki
+    pods: "110"
+  capacity:
+    cpu: "4"
+    ephemeral-storage: 202086868Ki
+    hugepages-2Mi: "0"
+    memory: 15399364Ki
+    pods: "110"
+  conditions:
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:22:08Z"
+    message: containerd is functioning properly
+    reason: FrequentContainerdRestart
+    status: "False"
+    type: FrequentContainerdRestart
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:22:06Z"
+    message: docker overlay2 is functioning properly
+    reason: CorruptDockerOverlay2
+    status: "False"
+    type: CorruptDockerOverlay2
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:22:06Z"
+    message: node is functioning properly
+    reason: UnregisterNetDevice
+    status: "False"
+    type: FrequentUnregisterNetDevice
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:17:04Z"
+    message: kernel has no deadlock
+    reason: KernelHasNoDeadlock
+    status: "False"
+    type: KernelDeadlock
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:17:04Z"
+    message: Filesystem is not read-only
+    reason: FilesystemIsNotReadOnly
+    status: "False"
+    type: ReadonlyFilesystem
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:22:05Z"
+    message: kubelet is functioning properly
+    reason: FrequentKubeletRestart
+    status: "False"
+    type: FrequentKubeletRestart
+  - lastHeartbeatTime: "2019-09-20T19:32:08Z"
+    lastTransitionTime: "2019-07-09T16:22:06Z"
+    message: docker is functioning properly
+    reason: FrequentDockerRestart
+    status: "False"
+    type: FrequentDockerRestart
+  - lastHeartbeatTime: "2019-07-09T16:17:47Z"
+    lastTransitionTime: "2019-07-09T16:17:47Z"
+    message: RouteController created a route
+    reason: RouteCreated
+    status: "False"
+    type: NetworkUnavailable
+  - lastHeartbeatTime: "2019-09-20T19:32:50Z"
+    lastTransitionTime: "2019-07-09T16:17:29Z"
+    message: kubelet has sufficient disk space available
+    reason: KubeletHasSufficientDisk
+    status: "False"
+    type: OutOfDisk
+  - lastHeartbeatTime: "2019-09-20T19:32:50Z"
+    lastTransitionTime: "2019-07-09T16:17:29Z"
+    message: kubelet has sufficient memory available
+    reason: KubeletHasSufficientMemory
+    status: "False"
+    type: MemoryPressure
+  - lastHeartbeatTime: "2019-09-20T19:32:50Z"
+    lastTransitionTime: "2019-07-09T16:17:29Z"
+    message: kubelet has no disk pressure
+    reason: KubeletHasNoDiskPressure
+    status: "False"
+    type: DiskPressure
+  - lastHeartbeatTime: "2019-09-20T19:32:50Z"
+    lastTransitionTime: "2019-07-09T16:17:29Z"
+    message: kubelet has sufficient PID available
+    reason: KubeletHasSufficientPID
+    status: "False"
+    type: PIDPressure
+  - lastHeartbeatTime: "2019-09-20T19:32:50Z"
+    lastTransitionTime: "2019-07-09T16:17:49Z"
+    message: kubelet is posting ready status
+    reason: KubeletReady
+    status: "True"
+    type: Ready
+  daemonEndpoints:
+    kubeletEndpoint:
+      Port: 10250
+  images:
+  - names:
+    - grafana/grafana@sha256:80e5e113a984d74836aa16f5b4524012099436b1a50df293f00ac6377fb512c8
+    - grafana/grafana:4.4.2
+    sizeBytes: 287008013
+  - names:
+    - registry.k8s.io/node-problem-detector@sha256:f95cab985c26b2f46e9bd43283e0bfa88860c14e0fb0649266babe8b65e9eb2b
+    - registry.k8s.io/node-problem-detector:v0.4.1
+    sizeBytes: 286572743
+  - names:
+    - grafana/grafana@sha256:7ff7f9b2501a5d55b55ce3f58d21771b1c5af1f2a4ab7dbf11bef7142aae7033
+    - grafana/grafana:4.2.0
+    sizeBytes: 277940263
+  - names:
+    - influxdb@sha256:7dddf03376348876ed4bdf33d6dfa3326f45a2bae0930dbd80781a374eb519bc
+    - influxdb:1.2.2
+    sizeBytes: 223948571
+  - names:
+    - gcr.io/stackdriver-agents/stackdriver-logging-agent@sha256:f8d5231b67b9c53f60068b535a11811d29d1b3efd53d2b79f2a2591ea338e4f2
+    - gcr.io/stackdriver-agents/stackdriver-logging-agent:0.6-1.6.0-1
+    sizeBytes: 223242132
+  - names:
+    - nginx@sha256:35779791c05d119df4fe476db8f47c0bee5943c83eba5656a15fc046db48178b
+    - nginx:1.10.1
+    sizeBytes: 180708613
+  - names:
+    - registry.k8s.io/fluentd-elasticsearch@sha256:b8c94527b489fb61d3d81ce5ad7f3ddbb7be71e9620a3a36e2bede2f2e487d73
+    - registry.k8s.io/fluentd-elasticsearch:v2.0.4
+    sizeBytes: 135716379
+  - names:
+    - nginx@sha256:00be67d6ba53d5318cd91c57771530f5251cfbe028b7be2c4b70526f988cfc9f
+    - nginx:latest
+    sizeBytes: 109357355
+  - names:
+    - registry.k8s.io/kubernetes-dashboard-amd64@sha256:dc4026c1b595435ef5527ca598e1e9c4343076926d7d62b365c44831395adbd0
+    - registry.k8s.io/kubernetes-dashboard-amd64:v1.8.3
+    sizeBytes: 102319441
+  - names:
+    - gcr.io/google_containers/kube-proxy:v1.11.10-gke.5
+    - registry.k8s.io/kube-proxy:v1.11.10-gke.5
+    sizeBytes: 102279340
+  - names:
+    - registry.k8s.io/event-exporter@sha256:7f9cd7cb04d6959b0aa960727d04fa86759008048c785397b7b0d9dff0007516
+    - registry.k8s.io/event-exporter:v0.2.3
+    sizeBytes: 94171943
+  - names:
+    - registry.k8s.io/prometheus-to-sd@sha256:6c0c742475363d537ff059136e5d5e4ab1f512ee0fd9b7ca42ea48bc309d1662
+    - registry.k8s.io/prometheus-to-sd:v0.3.1
+    sizeBytes: 88077694
+  - names:
+    - registry.k8s.io/fluentd-gcp-scaler@sha256:a5ace7506d393c4ed65eb2cbb6312c64ab357fcea16dff76b9055bc6e498e5ff
+    - registry.k8s.io/fluentd-gcp-scaler:0.5.1
+    sizeBytes: 86637208
+  - names:
+    - registry.k8s.io/heapster-amd64@sha256:9fae0af136ce0cf4f88393b3670f7139ffc464692060c374d2ae748e13144521
+    - registry.k8s.io/heapster-amd64:v1.6.0-beta.1
+    sizeBytes: 76016169
+  - names:
+    - registry.k8s.io/ingress-glbc-amd64@sha256:31d36bbd9c44caffa135fc78cf0737266fcf25e3cf0cd1c2fcbfbc4f7309cc52
+    - registry.k8s.io/ingress-glbc-amd64:v1.1.1
+    sizeBytes: 67801919
+  - names:
+    - registry.k8s.io/kube-addon-manager@sha256:d53486c3a0b49ebee019932878dc44232735d5622a51dbbdcec7124199020d09
+    - registry.k8s.io/kube-addon-manager:v8.7
+    sizeBytes: 63322109
+  - names:
+    - nginx@sha256:4aacdcf186934dcb02f642579314075910f1855590fd3039d8fa4c9f96e48315
+    - nginx:1.10-alpine
+    sizeBytes: 54042627
+  - names:
+    - registry.k8s.io/cpvpa-amd64@sha256:cfe7b0a11c9c8e18c87b1eb34fef9a7cbb8480a8da11fc2657f78dbf4739f869
+    - registry.k8s.io/cpvpa-amd64:v0.6.0
+    sizeBytes: 51785854
+  - names:
+    - registry.k8s.io/cluster-proportional-autoscaler-amd64@sha256:003f98d9f411ddfa6ff6d539196355e03ddd69fa4ed38c7ffb8fec6f729afe2d
+    - registry.k8s.io/cluster-proportional-autoscaler-amd64:1.1.2-r2
+    sizeBytes: 49648481
+  - names:
+    - registry.k8s.io/ip-masq-agent-amd64@sha256:1ffda57d87901bc01324c82ceb2145fe6a0448d3f0dd9cb65aa76a867cd62103
+    - registry.k8s.io/ip-masq-agent-amd64:v2.1.1
+    sizeBytes: 49612505
+  - names:
+    - registry.k8s.io/k8s-dns-kube-dns-amd64@sha256:b99fc3eee2a9f052f7eb4cc00f15eb12fc405fa41019baa2d6b79847ae7284a8
+    - registry.k8s.io/k8s-dns-kube-dns-amd64:1.14.10
+    sizeBytes: 49549457
+  - names:
+    - registry.k8s.io/rescheduler@sha256:156cfbfd05a5a815206fd2eeb6cbdaf1596d71ea4b415d3a6c43071dd7b99450
+    - registry.k8s.io/rescheduler:v0.4.0
+    sizeBytes: 48973149
+  - names:
+    - registry.k8s.io/event-exporter@sha256:16ca66e2b5dc7a1ce6a5aafcb21d0885828b75cdfc08135430480f7ad2364adc
+    - registry.k8s.io/event-exporter:v0.2.4
+    sizeBytes: 47261019
+  - names:
+    - registry.k8s.io/coredns@sha256:db2bf53126ed1c761d5a41f24a1b82a461c85f736ff6e90542e9522be4757848
+    - registry.k8s.io/coredns:1.1.3
+    sizeBytes: 45587362
+  - names:
+    - prom/prometheus@sha256:483f4c9d7733699ba79facca9f8bcce1cef1af43dfc3e7c5a1882aa85f53cb74
+    - prom/prometheus:v1.1.3
+    sizeBytes: 45493941
+  nodeInfo:
+    architecture: amd64
+    bootID: a32eca78-4ad4-4b76-9252-f143d6c2ae61
+    containerRuntimeVersion: docker://17.3.2
+    kernelVersion: 4.14.127+
+    kubeProxyVersion: v1.11.10-gke.5
+    kubeletVersion: v1.11.10-gke.5
+    machineID: 1739555e5b231057f0f9a0b5fa29511b
+    operatingSystem: linux
+    osImage: Container-Optimized OS from Google
+    systemUUID: 1739555E-5B23-1057-F0F9-A0B5FA29511B
+  volumesAttached:
+  - devicePath: /dev/disk/by-id/b9772-pvc-c787c67d-14d7-11e7-9baf-42010a800049
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-c787c67d-14d7-11e7-9baf-42010a800049
+  - devicePath: /dev/disk/by-id/b9772-pvc-8895a852-fd42-11e6-94d4-42010a800049
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-8895a852-fd42-11e6-94d4-42010a800049
+  - devicePath: /dev/disk/by-id/some-random-clusterb9772-pvc-72e1c7f1-fd41-11e6-94d4-42010a800049
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-72e1c7f1-fd41-11e6-94d4-42010a800049
+  - devicePath: /dev/disk/by-id/some-random-clusterb9772-pvc-c2435a06-14d7-11e7-9baf-42010a800049
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-c2435a06-14d7-11e7-9baf-42010a800049
+  - devicePath: /dev/disk/by-id/some-random-clusterb9772-pvc-8bf50554-fd42-11e6-94d4-42010a800049
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-8bf50554-fd42-11e6-94d4-42010a800049
+  - devicePath: /dev/disk/by-id/some-random-clusterb9772-pvc-8fb5e386-4641-11e7-a490-42010a800283
+    name: kubernetes.io/pd/some-random-clusterb9772-pvc-8fb5e386-4641-11e7-a490-42010a800283
+  volumesInUse:
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-72e1c7f1-fd41-11e6-94d4-42010a800049
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-8895a852-fd42-11e6-94d4-42010a800049
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-8bf50554-fd42-11e6-94d4-42010a800049
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-8fb5e386-4641-11e7-a490-42010a800283
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-c2435a06-14d7-11e7-9baf-42010a800049
+  - kubernetes.io/pd/some-random-clusterb9772-pvc-c787c67d-14d7-11e7-9baf-42010a800049
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/pod.yaml b/third_party/k8s.io/apimachinery/pkg/util/managedfields/pod.yaml
new file mode 100644
index 0000000000..3fb0877d67
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/pod.yaml
@@ -0,0 +1,121 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  labels:
+    app: some-app
+    plugin1: some-value
+    plugin2: some-value
+    plugin3: some-value
+    plugin4: some-value
+  name: some-name
+  namespace: default
+  ownerReferences:
+  - apiVersion: apps/v1
+    blockOwnerDeletion: true
+    controller: true
+    kind: ReplicaSet
+    name: some-name
+    uid: 0a9d2b9e-779e-11e7-b422-42010a8001be
+spec:
+  containers:
+  - args:
+    - one
+    - two
+    - three
+    - four
+    - five
+    - six
+    - seven
+    - eight
+    - nine
+    env:
+    - name: VAR_3
+      valueFrom:
+        secretKeyRef:
+          key: some-other-key
+          name: some-oher-name
+    - name: VAR_2
+      valueFrom:
+        secretKeyRef:
+          key: other-key
+          name: other-name
+    - name: VAR_1
+      valueFrom:
+        secretKeyRef:
+          key: some-key
+          name: some-name
+    image: some-image-name
+    imagePullPolicy: IfNotPresent
+    name: some-name
+    resources:
+      requests:
+        cpu: '0'
+    terminationMessagePath: /dev/termination-log
+    terminationMessagePolicy: File
+    volumeMounts:
+    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+      name: default-token-hu5jz
+      readOnly: true
+  dnsPolicy: ClusterFirst
+  nodeName: node-name
+  priority: 0
+  restartPolicy: Always
+  schedulerName: default-scheduler
+  securityContext: {}
+  serviceAccount: default
+  serviceAccountName: default
+  terminationGracePeriodSeconds: 30
+  tolerations:
+  - effect: NoExecute
+    key: node.kubernetes.io/not-ready
+    operator: Exists
+    tolerationSeconds: 300
+  - effect: NoExecute
+    key: node.kubernetes.io/unreachable
+    operator: Exists
+    tolerationSeconds: 300
+  volumes:
+  - name: default-token-hu5jz
+    secret:
+      defaultMode: 420
+      secretName: default-token-hu5jz
+status:
+  conditions:
+  - lastProbeTime: null
+    lastTransitionTime: '2019-07-08T09:31:18Z'
+    status: 'True'
+    type: Initialized
+  - lastProbeTime: null
+    lastTransitionTime: '2019-07-08T09:41:59Z'
+    status: 'True'
+    type: Ready
+  - lastProbeTime: null
+    lastTransitionTime: null
+    status: 'True'
+    type: ContainersReady
+  - lastProbeTime: null
+    lastTransitionTime: '2019-07-08T09:31:18Z'
+    status: 'True'
+    type: PodScheduled
+  containerStatuses:
+  - containerID: docker://885e82a1ed0b7356541bb410a0126921ac42439607c09875cd8097dd5d7b5376
+    image: some-image-name
+    imageID: docker-pullable://some-image-id
+    lastState:
+      terminated:
+        containerID: docker://d57290f9e00fad626b20d2dd87a3cf69bbc22edae07985374f86a8b2b4e39565
+        exitCode: 255
+        finishedAt: '2019-07-08T09:39:09Z'
+        reason: Error
+        startedAt: '2019-07-08T09:38:54Z'
+    name: name
+    ready: true
+    restartCount: 6
+    state:
+      running:
+        startedAt: '2019-07-08T09:41:59Z'
+  hostIP: 10.0.0.1
+  phase: Running
+  podIP: 10.0.0.1
+  qosClass: BestEffort
+  startTime: '2019-07-08T09:31:18Z'
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/scalehandler.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/scalehandler.go
new file mode 100644
index 0000000000..ca96ca9834
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/scalehandler.go
@@ -0,0 +1,174 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+var (
+	scaleGroupVersion   = schema.GroupVersion{Group: "autoscaling", Version: "v1"}
+	replicasPathInScale = fieldpath.MakePathOrDie("spec", "replicas")
+)
+
+// ResourcePathMappings maps a group/version to its replicas path. The
+// assumption is that all the paths correspond to leaf fields.
+type ResourcePathMappings map[string]fieldpath.Path
+
+// ScaleHandler manages the conversion of managed fields between a main
+// resource and the scale subresource
+type ScaleHandler struct {
+	parentEntries []metav1.ManagedFieldsEntry
+	groupVersion  schema.GroupVersion
+	mappings      ResourcePathMappings
+}
+
+// NewScaleHandler creates a new ScaleHandler
+func NewScaleHandler(parentEntries []metav1.ManagedFieldsEntry, groupVersion schema.GroupVersion, mappings ResourcePathMappings) *ScaleHandler {
+	return &ScaleHandler{
+		parentEntries: parentEntries,
+		groupVersion:  groupVersion,
+		mappings:      mappings,
+	}
+}
+
+// ToSubresource filter the managed fields of the main resource and convert
+// them so that they can be handled by scale.
+// For the managed fields that have a replicas path it performs two changes:
+//  1. APIVersion is changed to the APIVersion of the scale subresource
+//  2. Replicas path of the main resource is transformed to the replicas path of
+//     the scale subresource
+func (h *ScaleHandler) ToSubresource() ([]metav1.ManagedFieldsEntry, error) {
+	managed, err := internal.DecodeManagedFields(h.parentEntries)
+	if err != nil {
+		return nil, err
+	}
+
+	f := fieldpath.ManagedFields{}
+	t := map[string]*metav1.Time{}
+	for manager, versionedSet := range managed.Fields() {
+		path, ok := h.mappings[string(versionedSet.APIVersion())]
+		// Skip the entry if the APIVersion is unknown
+		if !ok || path == nil {
+			continue
+		}
+
+		if versionedSet.Set().Has(path) {
+			newVersionedSet := fieldpath.NewVersionedSet(
+				fieldpath.NewSet(replicasPathInScale),
+				fieldpath.APIVersion(scaleGroupVersion.String()),
+				versionedSet.Applied(),
+			)
+
+			f[manager] = newVersionedSet
+			t[manager] = managed.Times()[manager]
+		}
+	}
+
+	return managedFieldsEntries(internal.NewManaged(f, t))
+}
+
+// ToParent merges `scaleEntries` with the entries of the main resource and
+// transforms them accordingly
+func (h *ScaleHandler) ToParent(scaleEntries []metav1.ManagedFieldsEntry) ([]metav1.ManagedFieldsEntry, error) {
+	decodedParentEntries, err := internal.DecodeManagedFields(h.parentEntries)
+	if err != nil {
+		return nil, err
+	}
+	parentFields := decodedParentEntries.Fields()
+
+	decodedScaleEntries, err := internal.DecodeManagedFields(scaleEntries)
+	if err != nil {
+		return nil, err
+	}
+	scaleFields := decodedScaleEntries.Fields()
+
+	f := fieldpath.ManagedFields{}
+	t := map[string]*metav1.Time{}
+
+	for manager, versionedSet := range parentFields {
+		// Get the main resource "replicas" path
+		path, ok := h.mappings[string(versionedSet.APIVersion())]
+		// Drop the entry if the APIVersion is unknown.
+		if !ok {
+			continue
+		}
+
+		// If the parent entry does not have the replicas path or it is nil, just
+		// keep it as it is. The path is nil for Custom Resources without scale
+		// subresource.
+		if path == nil || !versionedSet.Set().Has(path) {
+			f[manager] = versionedSet
+			t[manager] = decodedParentEntries.Times()[manager]
+			continue
+		}
+
+		if _, ok := scaleFields[manager]; !ok {
+			// "Steal" the replicas path from the main resource entry
+			newSet := versionedSet.Set().Difference(fieldpath.NewSet(path))
+
+			if !newSet.Empty() {
+				newVersionedSet := fieldpath.NewVersionedSet(
+					newSet,
+					versionedSet.APIVersion(),
+					versionedSet.Applied(),
+				)
+				f[manager] = newVersionedSet
+				t[manager] = decodedParentEntries.Times()[manager]
+			}
+		} else {
+			// Field wasn't stolen, let's keep the entry as it is.
+			f[manager] = versionedSet
+			t[manager] = decodedParentEntries.Times()[manager]
+			delete(scaleFields, manager)
+		}
+	}
+
+	for manager, versionedSet := range scaleFields {
+		if !versionedSet.Set().Has(replicasPathInScale) {
+			continue
+		}
+		newVersionedSet := fieldpath.NewVersionedSet(
+			fieldpath.NewSet(h.mappings[h.groupVersion.String()]),
+			fieldpath.APIVersion(h.groupVersion.String()),
+			versionedSet.Applied(),
+		)
+		f[manager] = newVersionedSet
+		t[manager] = decodedParentEntries.Times()[manager]
+	}
+
+	return managedFieldsEntries(internal.NewManaged(f, t))
+}
+
+func managedFieldsEntries(entries internal.ManagedInterface) ([]metav1.ManagedFieldsEntry, error) {
+	obj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := internal.EncodeObjectManagedFields(obj, entries); err != nil {
+		return nil, err
+	}
+	accessor, err := meta.Accessor(obj)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't get accessor: %v", err))
+	}
+	return accessor.GetManagedFields(), nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/scalehandler_test.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/scalehandler_test.go
new file mode 100644
index 0000000000..8b35974ed6
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/scalehandler_test.go
@@ -0,0 +1,785 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields
+
+import (
+	"reflect"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/structured-merge-diff/v6/fieldpath"
+)
+
+func TestTransformManagedFieldsToSubresource(t *testing.T) {
+	testTime, _ := time.ParseInLocation("2006-Jan-02", "2013-Feb-03", time.Local)
+	managedFieldTime := metav1.NewTime(testTime)
+
+	tests := []struct {
+		desc     string
+		input    []metav1.ManagedFieldsEntry
+		expected []metav1.ManagedFieldsEntry
+	}{
+		{
+			desc: "filter one entry and transform it into a subresource entry",
+			input: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "manager-1",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:another-field":{}}}`),
+				},
+				{
+					Manager:    "manager-2",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Time:       &managedFieldTime,
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "manager-2",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "autoscaling/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Time:       &managedFieldTime,
+				},
+			},
+		},
+		{
+			desc: "transform all entries",
+			input: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "manager-1",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+				{
+					Manager:    "manager-2",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+				{
+					Manager:     "manager-3",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "manager-1",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "autoscaling/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+				{
+					Manager:    "manager-2",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "autoscaling/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+				{
+					Manager:     "manager-3",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc: "drops fields if the api version is unknown",
+			input: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "manager-1",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v10",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+			},
+			expected: nil,
+		},
+	}
+
+	for _, test := range tests {
+		handler := NewScaleHandler(
+			test.input,
+			schema.GroupVersion{Group: "apps", Version: "v1"},
+			defaultMappings(),
+		)
+		subresourceEntries, err := handler.ToSubresource()
+		if err != nil {
+			t.Fatalf("test %q - expected no error but got %v", test.desc, err)
+		}
+
+		if !reflect.DeepEqual(subresourceEntries, test.expected) {
+			t.Fatalf("test %q - expected output to be:\n%v\n\nbut got:\n%v", test.desc, test.expected, subresourceEntries)
+		}
+	}
+}
+
+func TestTransformingManagedFieldsToParent(t *testing.T) {
+	tests := []struct {
+		desc        string
+		parent      []metav1.ManagedFieldsEntry
+		subresource []metav1.ManagedFieldsEntry
+		expected    []metav1.ManagedFieldsEntry
+	}{
+		{
+			desc: "different-managers: apply -> update",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc: "different-managers: apply -> apply",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+			},
+		},
+		{
+			desc: "different-managers: update -> update",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+			},
+		},
+		{
+			desc: "different-managers: update -> apply",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+			},
+		},
+		{
+			desc: "same manager: apply -> apply",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc: "same manager: update -> update",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc: "same manager: update -> apply",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+			},
+		},
+		{
+			desc: "same manager: apply -> update",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc: "subresource doesn't own the path anymore",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:status":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+			},
+		},
+		{
+			desc: "Subresource steals all the fields of the parent resource",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc: "apply without stealing",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "autoscaling/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{},"f:selector":{}}}`),
+				},
+				{
+					Manager:     "test",
+					Operation:   metav1.ManagedFieldsOperationApply,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc: "drops the entry if the api version is unknown",
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+				{
+					Manager:    "another-manager",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v10",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "scale",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "autoscaling/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "scale",
+					Operation:  metav1.ManagedFieldsOperationUpdate,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			handler := NewScaleHandler(
+				test.parent,
+				schema.GroupVersion{Group: "apps", Version: "v1"},
+				defaultMappings(),
+			)
+			parentEntries, err := handler.ToParent(test.subresource)
+			if err != nil {
+				t.Fatalf("test: %q - expected no error but got %v", test.desc, err)
+			}
+			if !reflect.DeepEqual(parentEntries, test.expected) {
+				t.Fatalf("test: %q - expected output to be:\n%v\n\nbut got:\n%v", test.desc, test.expected, parentEntries)
+			}
+		})
+	}
+}
+
+func TestTransformingManagedFieldsToParentMultiVersion(t *testing.T) {
+	tests := []struct {
+		desc         string
+		groupVersion schema.GroupVersion
+		mappings     ResourcePathMappings
+		parent       []metav1.ManagedFieldsEntry
+		subresource  []metav1.ManagedFieldsEntry
+		expected     []metav1.ManagedFieldsEntry
+	}{
+		{
+			desc:         "multi-version",
+			groupVersion: schema.GroupVersion{Group: "apps", Version: "v1"},
+			mappings: ResourcePathMappings{
+				"apps/v1": fieldpath.MakePathOrDie("spec", "the-replicas"),
+				"apps/v2": fieldpath.MakePathOrDie("spec", "not-the-replicas"),
+			},
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:the-replicas":{},"f:selector":{}}}`),
+				},
+				{
+					Manager:    "test-other",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v2",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:not-the-replicas":{},"f:selector":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+				{
+					Manager:    "test-other",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "apps/v2",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "apps/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:the-replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+		{
+			desc:         "Custom resource without scale subresource, scaling a version with `scale`",
+			groupVersion: schema.GroupVersion{Group: "mygroup", Version: "v1"},
+			mappings: ResourcePathMappings{
+				"mygroup/v1": fieldpath.MakePathOrDie("spec", "the-replicas"),
+				"mygroup/v2": nil,
+			},
+			parent: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "mygroup/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:the-replicas":{},"f:selector":{}}}`),
+				},
+				{
+					Manager:    "test-other",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "mygroup/v2",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:test-other":{}}}`),
+				},
+			},
+			subresource: []metav1.ManagedFieldsEntry{
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "autoscaling/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+			expected: []metav1.ManagedFieldsEntry{
+				{
+					Manager:    "test",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "mygroup/v1",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:selector":{}}}`),
+				},
+				{
+					Manager:    "test-other",
+					Operation:  metav1.ManagedFieldsOperationApply,
+					APIVersion: "mygroup/v2",
+					FieldsType: "FieldsV1",
+					FieldsV1:   metav1.NewFieldsV1(`{"f:spec":{"f:test-other":{}}}`),
+				},
+				{
+					Manager:     "scale",
+					Operation:   metav1.ManagedFieldsOperationUpdate,
+					APIVersion:  "mygroup/v1",
+					FieldsType:  "FieldsV1",
+					FieldsV1:    metav1.NewFieldsV1(`{"f:spec":{"f:the-replicas":{}}}`),
+					Subresource: "scale",
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.desc, func(t *testing.T) {
+			handler := NewScaleHandler(
+				test.parent,
+				test.groupVersion,
+				test.mappings,
+			)
+			parentEntries, err := handler.ToParent(test.subresource)
+			if err != nil {
+				t.Fatalf("test: %q - expected no error but got %v", test.desc, err)
+			}
+			if !reflect.DeepEqual(parentEntries, test.expected) {
+				t.Fatalf("test: %q - expected output to be:\n%v\n\nbut got:\n%v", test.desc, test.expected, parentEntries)
+			}
+		})
+	}
+}
+
+func defaultMappings() ResourcePathMappings {
+	return ResourcePathMappings{
+		"apps/v1": fieldpath.MakePathOrDie("spec", "replicas"),
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/managedfields/typeconverter.go b/third_party/k8s.io/apimachinery/pkg/util/managedfields/typeconverter.go
new file mode 100644
index 0000000000..e706ac8221
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/managedfields/typeconverter.go
@@ -0,0 +1,56 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package managedfields
+
+import (
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/managedfields/internal"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+)
+
+// TypeConverter allows you to convert from runtime.Object to
+// typed.TypedValue and the other way around.
+type TypeConverter = internal.TypeConverter
+
+// NewDeducedTypeConverter creates a TypeConverter for CRDs that don't
+// have a schema. It does implement the same interface though (and
+// create the same types of objects), so that everything can still work
+// the same. CRDs are merged with all their fields being "atomic" (lists
+// included).
+func NewDeducedTypeConverter() TypeConverter {
+	return internal.NewDeducedTypeConverter()
+}
+
+// NewTypeConverter builds a TypeConverter from a map of OpenAPIV3 schemas.
+// This will automatically find the proper version of the object, and the
+// corresponding schema information.
+// The keys to the map must be consistent with the names
+// used by Refs within the schemas.
+// The schemas should conform to the Kubernetes Structural Schema OpenAPI
+// restrictions found in docs:
+// https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#specifying-a-structural-schema
+func NewTypeConverter(openapiSpec map[string]*spec.Schema, preserveUnknownFields bool) (TypeConverter, error) {
+	return internal.NewTypeConverter(openapiSpec, preserveUnknownFields)
+}
+
+// NewSchemeTypeConverter creates a TypeConverter that uses the provided scheme to
+// convert between runtime.Objects and TypedValues.
+func NewSchemeTypeConverter(scheme *runtime.Scheme, parser *typed.Parser) TypeConverter {
+	return internal.NewSchemeTypeConverter(scheme, parser)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/mergepatch/OWNERS b/third_party/k8s.io/apimachinery/pkg/util/mergepatch/OWNERS
new file mode 100644
index 0000000000..349bc69d65
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/mergepatch/OWNERS
@@ -0,0 +1,6 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+  - pwittrock
+reviewers:
+  - apelisse
diff --git a/third_party/k8s.io/apimachinery/pkg/util/mergepatch/errors.go b/third_party/k8s.io/apimachinery/pkg/util/mergepatch/errors.go
new file mode 100644
index 0000000000..16501d5afe
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/mergepatch/errors.go
@@ -0,0 +1,102 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mergepatch
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+)
+
+var (
+	ErrBadJSONDoc                           = errors.New("invalid JSON document")
+	ErrNoListOfLists                        = errors.New("lists of lists are not supported")
+	ErrBadPatchFormatForPrimitiveList       = errors.New("invalid patch format of primitive list")
+	ErrBadPatchFormatForRetainKeys          = errors.New("invalid patch format of retainKeys")
+	ErrBadPatchFormatForSetElementOrderList = errors.New("invalid patch format of setElementOrder list")
+	ErrPatchContentNotMatchRetainKeys       = errors.New("patch content doesn't match retainKeys list")
+	ErrUnsupportedStrategicMergePatchFormat = errors.New("strategic merge patch format is not supported")
+)
+
+func ErrNoMergeKey(m map[string]interface{}, k string) error {
+	return fmt.Errorf("map: %v does not contain declared merge key: %s", m, k)
+}
+
+func ErrBadArgType(expected, actual interface{}) error {
+	return fmt.Errorf("expected a %s, but received a %s",
+		reflect.TypeOf(expected),
+		reflect.TypeOf(actual))
+}
+
+func ErrBadArgKind(expected, actual interface{}) error {
+	var expectedKindString, actualKindString string
+	if expected == nil {
+		expectedKindString = "nil"
+	} else {
+		expectedKindString = reflect.TypeOf(expected).Kind().String()
+	}
+	if actual == nil {
+		actualKindString = "nil"
+	} else {
+		actualKindString = reflect.TypeOf(actual).Kind().String()
+	}
+	return fmt.Errorf("expected a %s, but received a %s", expectedKindString, actualKindString)
+}
+
+func ErrBadPatchType(t interface{}, m map[string]interface{}) error {
+	return fmt.Errorf("unknown patch type: %s in map: %v", t, m)
+}
+
+// IsPreconditionFailed returns true if the provided error indicates
+// a precondition failed.
+func IsPreconditionFailed(err error) bool {
+	_, ok := err.(ErrPreconditionFailed)
+	return ok
+}
+
+type ErrPreconditionFailed struct {
+	message string
+}
+
+func NewErrPreconditionFailed(target map[string]interface{}) ErrPreconditionFailed {
+	s := fmt.Sprintf("precondition failed for: %v", target)
+	return ErrPreconditionFailed{s}
+}
+
+func (err ErrPreconditionFailed) Error() string {
+	return err.message
+}
+
+type ErrConflict struct {
+	message string
+}
+
+func NewErrConflict(patch, current string) ErrConflict {
+	s := fmt.Sprintf("patch:\n%s\nconflicts with changes made from original to current:\n%s\n", patch, current)
+	return ErrConflict{s}
+}
+
+func (err ErrConflict) Error() string {
+	return err.message
+}
+
+// IsConflict returns true if the provided error indicates
+// a conflict between the patch and the current configuration.
+func IsConflict(err error) bool {
+	_, ok := err.(ErrConflict)
+	return ok
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/mergepatch/util.go b/third_party/k8s.io/apimachinery/pkg/util/mergepatch/util.go
new file mode 100644
index 0000000000..46e3bb75dd
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/mergepatch/util.go
@@ -0,0 +1,133 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mergepatch
+
+import (
+	"fmt"
+	"reflect"
+
+	"k8s.io/utils/dump"
+	"sigs.k8s.io/yaml"
+)
+
+// PreconditionFunc asserts that an incompatible change is not present within a patch.
+type PreconditionFunc func(interface{}) bool
+
+// RequireKeyUnchanged returns a precondition function that fails if the provided key
+// is present in the patch (indicating that its value has changed).
+func RequireKeyUnchanged(key string) PreconditionFunc {
+	return func(patch interface{}) bool {
+		patchMap, ok := patch.(map[string]interface{})
+		if !ok {
+			return true
+		}
+
+		// The presence of key means that its value has been changed, so the test fails.
+		_, ok = patchMap[key]
+		return !ok
+	}
+}
+
+// RequireMetadataKeyUnchanged creates a precondition function that fails
+// if the metadata.key is present in the patch (indicating its value
+// has changed).
+func RequireMetadataKeyUnchanged(key string) PreconditionFunc {
+	return func(patch interface{}) bool {
+		patchMap, ok := patch.(map[string]interface{})
+		if !ok {
+			return true
+		}
+		patchMap1, ok := patchMap["metadata"]
+		if !ok {
+			return true
+		}
+		patchMap2, ok := patchMap1.(map[string]interface{})
+		if !ok {
+			return true
+		}
+		_, ok = patchMap2[key]
+		return !ok
+	}
+}
+
+func ToYAMLOrError(v interface{}) string {
+	y, err := toYAML(v)
+	if err != nil {
+		return err.Error()
+	}
+
+	return y
+}
+
+func toYAML(v interface{}) (string, error) {
+	y, err := yaml.Marshal(v)
+	if err != nil {
+		return "", fmt.Errorf("yaml marshal failed:%v\n%v\n", err, dump.Pretty(v))
+	}
+
+	return string(y), nil
+}
+
+// HasConflicts returns true if the left and right JSON interface objects overlap with
+// different values in any key. All keys are required to be strings. Since patches of the
+// same Type have congruent keys, this is valid for multiple patch types. This method
+// supports JSON merge patch semantics.
+//
+// NOTE: Numbers with different types (e.g. int(0) vs int64(0)) will be detected as conflicts.
+// Make sure the unmarshaling of left and right are consistent (e.g. use the same library).
+func HasConflicts(left, right interface{}) (bool, error) {
+	switch typedLeft := left.(type) {
+	case map[string]interface{}:
+		switch typedRight := right.(type) {
+		case map[string]interface{}:
+			for key, leftValue := range typedLeft {
+				rightValue, ok := typedRight[key]
+				if !ok {
+					continue
+				}
+				if conflict, err := HasConflicts(leftValue, rightValue); err != nil || conflict {
+					return conflict, err
+				}
+			}
+
+			return false, nil
+		default:
+			return true, nil
+		}
+	case []interface{}:
+		switch typedRight := right.(type) {
+		case []interface{}:
+			if len(typedLeft) != len(typedRight) {
+				return true, nil
+			}
+
+			for i := range typedLeft {
+				if conflict, err := HasConflicts(typedLeft[i], typedRight[i]); err != nil || conflict {
+					return conflict, err
+				}
+			}
+
+			return false, nil
+		default:
+			return true, nil
+		}
+	case string, float64, bool, int64, nil:
+		return !reflect.DeepEqual(left, right), nil
+	default:
+		return true, fmt.Errorf("unknown type: %v", reflect.TypeOf(left))
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/mergepatch/util_test.go b/third_party/k8s.io/apimachinery/pkg/util/mergepatch/util_test.go
new file mode 100644
index 0000000000..e74dfabd4f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/mergepatch/util_test.go
@@ -0,0 +1,136 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mergepatch
+
+import (
+	"fmt"
+	"testing"
+)
+
+func TestHasConflicts(t *testing.T) {
+	testCases := []struct {
+		A   interface{}
+		B   interface{}
+		Ret bool
+	}{
+		{A: "hello", B: "hello", Ret: false},
+		{A: "hello", B: "hell", Ret: true},
+		{A: "hello", B: nil, Ret: true},
+		{A: "hello", B: int64(1), Ret: true},
+		{A: "hello", B: float64(1.0), Ret: true},
+		{A: "hello", B: false, Ret: true},
+		{A: int64(1), B: int64(1), Ret: false},
+		{A: nil, B: nil, Ret: false},
+		{A: false, B: false, Ret: false},
+		{A: float64(3), B: float64(3), Ret: false},
+
+		{A: "hello", B: []interface{}{}, Ret: true},
+		{A: []interface{}{int64(1)}, B: []interface{}{}, Ret: true},
+		{A: []interface{}{}, B: []interface{}{}, Ret: false},
+		{A: []interface{}{int64(1)}, B: []interface{}{int64(1)}, Ret: false},
+		{A: map[string]interface{}{}, B: []interface{}{int64(1)}, Ret: true},
+
+		{A: map[string]interface{}{}, B: map[string]interface{}{"a": int64(1)}, Ret: false},
+		{A: map[string]interface{}{"a": int64(1)}, B: map[string]interface{}{"a": int64(1)}, Ret: false},
+		{A: map[string]interface{}{"a": int64(1)}, B: map[string]interface{}{"a": int64(2)}, Ret: true},
+		{A: map[string]interface{}{"a": int64(1)}, B: map[string]interface{}{"b": int64(2)}, Ret: false},
+
+		{
+			A:   map[string]interface{}{"a": []interface{}{int64(1)}},
+			B:   map[string]interface{}{"a": []interface{}{int64(1)}},
+			Ret: false,
+		},
+		{
+			A:   map[string]interface{}{"a": []interface{}{int64(1)}},
+			B:   map[string]interface{}{"a": []interface{}{}},
+			Ret: true,
+		},
+		{
+			A:   map[string]interface{}{"a": []interface{}{int64(1)}},
+			B:   map[string]interface{}{"a": int64(1)},
+			Ret: true,
+		},
+
+		// Maps and lists with multiple entries.
+		{
+			A:   map[string]interface{}{"a": int64(1), "b": int64(2)},
+			B:   map[string]interface{}{"a": int64(1), "b": int64(0)},
+			Ret: true,
+		},
+		{
+			A:   map[string]interface{}{"a": int64(1), "b": int64(2)},
+			B:   map[string]interface{}{"a": int64(1), "b": int64(2)},
+			Ret: false,
+		},
+		{
+			A:   map[string]interface{}{"a": int64(1), "b": int64(2)},
+			B:   map[string]interface{}{"a": int64(1), "b": int64(0), "c": int64(3)},
+			Ret: true,
+		},
+		{
+			A:   map[string]interface{}{"a": int64(1), "b": int64(2)},
+			B:   map[string]interface{}{"a": int64(1), "b": int64(2), "c": int64(3)},
+			Ret: false,
+		},
+		{
+			A:   map[string]interface{}{"a": []interface{}{int64(1), int64(2)}},
+			B:   map[string]interface{}{"a": []interface{}{int64(1), int64(0)}},
+			Ret: true,
+		},
+		{
+			A:   map[string]interface{}{"a": []interface{}{int64(1), int64(2)}},
+			B:   map[string]interface{}{"a": []interface{}{int64(1), int64(2)}},
+			Ret: false,
+		},
+
+		// Numeric types are not interchangeable.
+		// Callers are expected to ensure numeric types are consistent in 'left' and 'right'.
+		{A: int64(0), B: float64(0), Ret: true},
+		// Other types are not interchangeable.
+		{A: int64(0), B: "0", Ret: true},
+		{A: int64(0), B: nil, Ret: true},
+		{A: int64(0), B: false, Ret: true},
+		{A: "true", B: true, Ret: true},
+		{A: "null", B: nil, Ret: true},
+	}
+
+	for _, testCase := range testCases {
+		testStr := fmt.Sprintf("A = %#v, B = %#v", testCase.A, testCase.B)
+		// Run each test case multiple times if it passes because HasConflicts()
+		// uses map iteration, which returns keys in nondeterministic order.
+		for try := 0; try < 10; try++ {
+			out, err := HasConflicts(testCase.A, testCase.B)
+			if err != nil {
+				t.Errorf("%v: unexpected error: %v", testStr, err)
+				break
+			}
+			if out != testCase.Ret {
+				t.Errorf("%v: expected %t got %t", testStr, testCase.Ret, out)
+				break
+			}
+			out, err = HasConflicts(testCase.B, testCase.A)
+			if err != nil {
+				t.Errorf("%v: unexpected error: %v", testStr, err)
+				break
+			}
+			if out != testCase.Ret {
+				t.Errorf("%v: expected reversed %t got %t", testStr, testCase.Ret, out)
+				break
+			}
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/naming/from_stack.go b/third_party/k8s.io/apimachinery/pkg/util/naming/from_stack.go
new file mode 100644
index 0000000000..d69bf32caa
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/naming/from_stack.go
@@ -0,0 +1,93 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package naming
+
+import (
+	"fmt"
+	"regexp"
+	goruntime "runtime"
+	"runtime/debug"
+	"strconv"
+	"strings"
+)
+
+// GetNameFromCallsite walks back through the call stack until we find a caller from outside of the ignoredPackages
+// it returns back a shortpath/filename:line to aid in identification of this reflector when it starts logging
+func GetNameFromCallsite(ignoredPackages ...string) string {
+	name := "????"
+	const maxStack = 10
+	for i := 1; i < maxStack; i++ {
+		_, file, line, ok := goruntime.Caller(i)
+		if !ok {
+			file, line, ok = extractStackCreator()
+			if !ok {
+				break
+			}
+			i += maxStack
+		}
+		if hasPackage(file, append(ignoredPackages, "/runtime/asm_")) {
+			continue
+		}
+
+		file = trimPackagePrefix(file)
+		name = fmt.Sprintf("%s:%d", file, line)
+		break
+	}
+	return name
+}
+
+// hasPackage returns true if the file is in one of the ignored packages.
+func hasPackage(file string, ignoredPackages []string) bool {
+	for _, ignoredPackage := range ignoredPackages {
+		if strings.Contains(file, ignoredPackage) {
+			return true
+		}
+	}
+	return false
+}
+
+// trimPackagePrefix reduces duplicate values off the front of a package name.
+func trimPackagePrefix(file string) string {
+	if l := strings.LastIndex(file, "/vendor/"); l >= 0 {
+		return file[l+len("/vendor/"):]
+	}
+	if l := strings.LastIndex(file, "/src/"); l >= 0 {
+		return file[l+5:]
+	}
+	if l := strings.LastIndex(file, "/pkg/"); l >= 0 {
+		return file[l+1:]
+	}
+	return file
+}
+
+var stackCreator = regexp.MustCompile(`(?m)^created by (.*)\n\s+(.*):(\d+) \+0x[[:xdigit:]]+$`)
+
+// extractStackCreator retrieves the goroutine file and line that launched this stack. Returns false
+// if the creator cannot be located.
+// TODO: Go does not expose this via runtime https://github.com/golang/go/issues/11440
+func extractStackCreator() (string, int, bool) {
+	stack := debug.Stack()
+	matches := stackCreator.FindStringSubmatch(string(stack))
+	if len(matches) != 4 {
+		return "", 0, false
+	}
+	line, err := strconv.Atoi(matches[3])
+	if err != nil {
+		return "", 0, false
+	}
+	return matches[2], line, true
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/naming/from_stack_test.go b/third_party/k8s.io/apimachinery/pkg/util/naming/from_stack_test.go
new file mode 100644
index 0000000000..0eaafae577
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/naming/from_stack_test.go
@@ -0,0 +1,59 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package naming
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestGetNameFromCallsite(t *testing.T) {
+	tests := []struct {
+		name            string
+		ignoredPackages []string
+		expected        string
+	}{
+		{
+			name:     "simple",
+			expected: "k8s.io/apimachinery/pkg/util/naming/from_stack_test.go:",
+		},
+		{
+			name:            "ignore-package",
+			ignoredPackages: []string{"k8s.io/apimachinery/pkg/util/naming"},
+			expected:        "testing/testing.go:",
+		},
+		{
+			name:            "ignore-file",
+			ignoredPackages: []string{"k8s.io/apimachinery/pkg/util/naming/from_stack_test.go"},
+			expected:        "testing/testing.go:",
+		},
+		{
+			name:            "ignore-multiple",
+			ignoredPackages: []string{"k8s.io/apimachinery/pkg/util/naming/from_stack_test.go", "testing/testing.go"},
+			expected:        "????",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			actual := GetNameFromCallsite(tc.ignoredPackages...)
+			if !strings.HasPrefix(actual, tc.expected) {
+				t.Fatalf("expected string with prefix %q, got %q", tc.expected, actual)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/net/http.go b/third_party/k8s.io/apimachinery/pkg/util/net/http.go
new file mode 100644
index 0000000000..8912804c50
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/net/http.go
@@ -0,0 +1,704 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"mime"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+	"unicode"
+	"unicode/utf8"
+
+	"golang.org/x/net/http2"
+	"k8s.io/klog/v2"
+	netutils "k8s.io/utils/net"
+)
+
+// JoinPreservingTrailingSlash does a path.Join of the specified elements,
+// preserving any trailing slash on the last non-empty segment
+func JoinPreservingTrailingSlash(elem ...string) string {
+	// do the basic path join
+	result := path.Join(elem...)
+
+	// find the last non-empty segment
+	for i := len(elem) - 1; i >= 0; i-- {
+		if len(elem[i]) > 0 {
+			// if the last segment ended in a slash, ensure our result does as well
+			if strings.HasSuffix(elem[i], "/") && !strings.HasSuffix(result, "/") {
+				result += "/"
+			}
+			break
+		}
+	}
+
+	return result
+}
+
+// IsTimeout returns true if the given error is a network timeout error
+func IsTimeout(err error) bool {
+	var neterr net.Error
+	if errors.As(err, &neterr) {
+		return neterr != nil && neterr.Timeout()
+	}
+	return false
+}
+
+// IsProbableEOF returns true if the given error resembles a connection termination
+// scenario that would justify assuming that the watch is empty.
+// These errors are what the Go http stack returns back to us which are general
+// connection closure errors (strongly correlated) and callers that need to
+// differentiate probable errors in connection behavior between normal "this is
+// disconnected" should use the method.
+func IsProbableEOF(err error) bool {
+	if err == nil {
+		return false
+	}
+	var uerr *url.Error
+	if errors.As(err, &uerr) {
+		err = uerr.Err
+	}
+	msg := err.Error()
+	switch {
+	case err == io.EOF:
+		return true
+	case err == io.ErrUnexpectedEOF:
+		return true
+	case msg == "http: can't write HTTP request on broken connection":
+		return true
+	case strings.Contains(msg, "http2: server sent GOAWAY and closed the connection"):
+		return true
+	case strings.Contains(msg, "connection reset by peer"):
+		return true
+	case strings.Contains(strings.ToLower(msg), "use of closed network connection"):
+		return true
+	}
+	return false
+}
+
+var defaultTransport = http.DefaultTransport.(*http.Transport)
+
+// SetOldTransportDefaults applies the defaults from http.DefaultTransport
+// for the Proxy, Dial, and TLSHandshakeTimeout fields if unset
+func SetOldTransportDefaults(t *http.Transport) *http.Transport {
+	if t.Proxy == nil || isDefault(t.Proxy) {
+		// http.ProxyFromEnvironment doesn't respect CIDRs and that makes it impossible to exclude things like pod and service IPs from proxy settings
+		// ProxierWithNoProxyCIDR allows CIDR rules in NO_PROXY
+		t.Proxy = NewProxierWithNoProxyCIDR(http.ProxyFromEnvironment)
+	}
+	// If no custom dialer is set, use the default context dialer
+	//lint:file-ignore SA1019 Keep supporting deprecated Dial method of custom transports
+	if t.DialContext == nil && t.Dial == nil {
+		t.DialContext = defaultTransport.DialContext
+	}
+	if t.TLSHandshakeTimeout == 0 {
+		t.TLSHandshakeTimeout = defaultTransport.TLSHandshakeTimeout
+	}
+	if t.IdleConnTimeout == 0 {
+		t.IdleConnTimeout = defaultTransport.IdleConnTimeout
+	}
+	return t
+}
+
+// SetTransportDefaults applies the defaults from http.DefaultTransport
+// for the Proxy, Dial, and TLSHandshakeTimeout fields if unset
+func SetTransportDefaults(t *http.Transport) *http.Transport {
+	t = SetOldTransportDefaults(t)
+	// Allow clients to disable http2 if needed.
+	if s := os.Getenv("DISABLE_HTTP2"); len(s) > 0 {
+		//nolint:logcheck // Should be rare, not worth converting.
+		klog.Info("HTTP2 has been explicitly disabled")
+	} else if allowsHTTP2(t) {
+		if err := configureHTTP2Transport(t); err != nil {
+			//nolint:logcheck // Should be rare, not worth converting.
+			klog.Warningf("Transport failed http2 configuration: %v", err)
+		}
+	}
+	return t
+}
+
+func readIdleTimeoutSeconds() int {
+	ret := 30
+	// User can set the readIdleTimeout to 0 to disable the HTTP/2
+	// connection health check.
+	if s := os.Getenv("HTTP2_READ_IDLE_TIMEOUT_SECONDS"); len(s) > 0 {
+		i, err := strconv.Atoi(s)
+		if err != nil {
+			//nolint:logcheck // Should be rare, not worth converting.
+			klog.Warningf("Illegal HTTP2_READ_IDLE_TIMEOUT_SECONDS(%q): %v."+
+				" Default value %d is used", s, err, ret)
+			return ret
+		}
+		ret = i
+	}
+	return ret
+}
+
+func pingTimeoutSeconds() int {
+	ret := 15
+	if s := os.Getenv("HTTP2_PING_TIMEOUT_SECONDS"); len(s) > 0 {
+		i, err := strconv.Atoi(s)
+		if err != nil {
+			//nolint:logcheck // Should be rare, not worth converting.
+			klog.Warningf("Illegal HTTP2_PING_TIMEOUT_SECONDS(%q): %v."+
+				" Default value %d is used", s, err, ret)
+			return ret
+		}
+		ret = i
+	}
+	return ret
+}
+
+func configureHTTP2Transport(t *http.Transport) error {
+	t2, err := http2.ConfigureTransports(t)
+	if err != nil {
+		return err
+	}
+	// The following enables the HTTP/2 connection health check added in
+	// https://github.com/golang/net/pull/55. The health check detects and
+	// closes broken transport layer connections. Without the health check,
+	// a broken connection can linger too long, e.g., a broken TCP
+	// connection will be closed by the Linux kernel after 13 to 30 minutes
+	// by default, which caused
+	// https://github.com/kubernetes/client-go/issues/374 and
+	// https://github.com/kubernetes/kubernetes/issues/87615.
+	t2.ReadIdleTimeout = time.Duration(readIdleTimeoutSeconds()) * time.Second
+	t2.PingTimeout = time.Duration(pingTimeoutSeconds()) * time.Second
+	return nil
+}
+
+func allowsHTTP2(t *http.Transport) bool {
+	if t.TLSClientConfig == nil || len(t.TLSClientConfig.NextProtos) == 0 {
+		// the transport expressed no NextProto preference, allow
+		return true
+	}
+	for _, p := range t.TLSClientConfig.NextProtos {
+		if p == http2.NextProtoTLS {
+			// the transport explicitly allowed http/2
+			return true
+		}
+	}
+	// the transport explicitly set NextProtos and excluded http/2
+	return false
+}
+
+type RoundTripperWrapper interface {
+	http.RoundTripper
+	WrappedRoundTripper() http.RoundTripper
+}
+
+type DialFunc func(ctx context.Context, net, addr string) (net.Conn, error)
+
+func DialerFor(transport http.RoundTripper) (DialFunc, error) {
+	if transport == nil {
+		return nil, nil
+	}
+
+	switch transport := transport.(type) {
+	case *http.Transport:
+		// transport.DialContext takes precedence over transport.Dial
+		if transport.DialContext != nil {
+			return transport.DialContext, nil
+		}
+		// adapt transport.Dial to the DialWithContext signature
+		if transport.Dial != nil {
+			return func(ctx context.Context, net, addr string) (net.Conn, error) {
+				return transport.Dial(net, addr)
+			}, nil
+		}
+		// otherwise return nil
+		return nil, nil
+	case RoundTripperWrapper:
+		return DialerFor(transport.WrappedRoundTripper())
+	default:
+		return nil, fmt.Errorf("unknown transport type: %T", transport)
+	}
+}
+
+// CloseIdleConnectionsFor close idles connections for the Transport.
+// If the Transport is wrapped it iterates over the wrapped round trippers
+// until it finds one that implements the CloseIdleConnections method.
+// If the Transport does not have a CloseIdleConnections method
+// then this function does nothing.
+func CloseIdleConnectionsFor(transport http.RoundTripper) {
+	if transport == nil {
+		return
+	}
+	type closeIdler interface {
+		CloseIdleConnections()
+	}
+
+	switch transport := transport.(type) {
+	case closeIdler:
+		transport.CloseIdleConnections()
+	case RoundTripperWrapper:
+		CloseIdleConnectionsFor(transport.WrappedRoundTripper())
+	default:
+		//nolint:logcheck // Should be rare, not worth converting.
+		klog.Warningf("unknown transport type: %T", transport)
+	}
+}
+
+type TLSClientConfigHolder interface {
+	TLSClientConfig() *tls.Config
+}
+
+func TLSClientConfig(transport http.RoundTripper) (*tls.Config, error) {
+	if transport == nil {
+		return nil, nil
+	}
+
+	switch transport := transport.(type) {
+	case *http.Transport:
+		return transport.TLSClientConfig, nil
+	case TLSClientConfigHolder:
+		return transport.TLSClientConfig(), nil
+	case RoundTripperWrapper:
+		return TLSClientConfig(transport.WrappedRoundTripper())
+	default:
+		return nil, fmt.Errorf("unknown transport type: %T", transport)
+	}
+}
+
+func FormatURL(scheme string, host string, port int, path string) *url.URL {
+	return &url.URL{
+		Scheme: scheme,
+		Host:   net.JoinHostPort(host, strconv.Itoa(port)),
+		Path:   path,
+	}
+}
+
+func GetHTTPClient(req *http.Request) string {
+	if ua := req.UserAgent(); len(ua) != 0 {
+		return ua
+	}
+	return "unknown"
+}
+
+// SourceIPs splits the comma separated X-Forwarded-For header and joins it with
+// the X-Real-Ip header and/or req.RemoteAddr, ignoring invalid IPs.
+// The X-Real-Ip is omitted if it's already present in the X-Forwarded-For chain.
+// The req.RemoteAddr is always the last IP in the returned list.
+// It returns nil if all of these are empty or invalid.
+func SourceIPs(req *http.Request) []net.IP {
+	var srcIPs []net.IP
+
+	hdr := req.Header
+	// First check the X-Forwarded-For header for requests via proxy.
+	hdrForwardedFor := hdr.Get("X-Forwarded-For")
+	if hdrForwardedFor != "" {
+		// X-Forwarded-For can be a csv of IPs in case of multiple proxies.
+		// Use the first valid one.
+		parts := strings.Split(hdrForwardedFor, ",")
+		for _, part := range parts {
+			ip := netutils.ParseIPSloppy(strings.TrimSpace(part))
+			if ip != nil {
+				srcIPs = append(srcIPs, ip)
+			}
+		}
+	}
+
+	// Try the X-Real-Ip header.
+	hdrRealIp := hdr.Get("X-Real-Ip")
+	if hdrRealIp != "" {
+		ip := netutils.ParseIPSloppy(hdrRealIp)
+		// Only append the X-Real-Ip if it's not already contained in the X-Forwarded-For chain.
+		if ip != nil && !containsIP(srcIPs, ip) {
+			srcIPs = append(srcIPs, ip)
+		}
+	}
+
+	// Always include the request Remote Address as it cannot be easily spoofed.
+	var remoteIP net.IP
+	// Remote Address in Go's HTTP server is in the form host:port so we need to split that first.
+	host, _, err := net.SplitHostPort(req.RemoteAddr)
+	if err == nil {
+		remoteIP = netutils.ParseIPSloppy(host)
+	}
+	// Fallback if Remote Address was just IP.
+	if remoteIP == nil {
+		remoteIP = netutils.ParseIPSloppy(req.RemoteAddr)
+	}
+
+	// Don't duplicate remote IP if it's already the last address in the chain.
+	if remoteIP != nil && (len(srcIPs) == 0 || !remoteIP.Equal(srcIPs[len(srcIPs)-1])) {
+		srcIPs = append(srcIPs, remoteIP)
+	}
+
+	return srcIPs
+}
+
+// Checks whether the given IP address is contained in the list of IPs.
+func containsIP(ips []net.IP, ip net.IP) bool {
+	for _, v := range ips {
+		if v.Equal(ip) {
+			return true
+		}
+	}
+	return false
+}
+
+// Extracts and returns the clients IP from the given request.
+// Looks at X-Forwarded-For header, X-Real-Ip header and request.RemoteAddr in that order.
+// Returns nil if none of them are set or is set to an invalid value.
+func GetClientIP(req *http.Request) net.IP {
+	ips := SourceIPs(req)
+	if len(ips) == 0 {
+		return nil
+	}
+	return ips[0]
+}
+
+// Prepares the X-Forwarded-For header for another forwarding hop by appending the previous sender's
+// IP address to the X-Forwarded-For chain.
+func AppendForwardedForHeader(req *http.Request) {
+	// Copied from net/http/httputil/reverseproxy.go:
+	if clientIP, _, err := net.SplitHostPort(req.RemoteAddr); err == nil {
+		// If we aren't the first proxy retain prior
+		// X-Forwarded-For information as a comma+space
+		// separated list and fold multiple headers into one.
+		if prior, ok := req.Header["X-Forwarded-For"]; ok {
+			clientIP = strings.Join(prior, ", ") + ", " + clientIP
+		}
+		req.Header.Set("X-Forwarded-For", clientIP)
+	}
+}
+
+var defaultProxyFuncPointer = fmt.Sprintf("%p", http.ProxyFromEnvironment)
+
+// isDefault checks to see if the transportProxierFunc is pointing to the default one
+func isDefault(transportProxier func(*http.Request) (*url.URL, error)) bool {
+	transportProxierPointer := fmt.Sprintf("%p", transportProxier)
+	return transportProxierPointer == defaultProxyFuncPointer
+}
+
+// NewProxierWithNoProxyCIDR constructs a Proxier function that respects CIDRs in NO_PROXY and delegates if
+// no matching CIDRs are found
+func NewProxierWithNoProxyCIDR(delegate func(req *http.Request) (*url.URL, error)) func(req *http.Request) (*url.URL, error) {
+	// we wrap the default method, so we only need to perform our check if the NO_PROXY (or no_proxy) envvar has a CIDR in it
+	noProxyEnv := os.Getenv("NO_PROXY")
+	if noProxyEnv == "" {
+		noProxyEnv = os.Getenv("no_proxy")
+	}
+	noProxyRules := strings.Split(noProxyEnv, ",")
+
+	cidrs := []*net.IPNet{}
+	for _, noProxyRule := range noProxyRules {
+		_, cidr, _ := netutils.ParseCIDRSloppy(noProxyRule)
+		if cidr != nil {
+			cidrs = append(cidrs, cidr)
+		}
+	}
+
+	if len(cidrs) == 0 {
+		return delegate
+	}
+
+	return func(req *http.Request) (*url.URL, error) {
+		ip := netutils.ParseIPSloppy(req.URL.Hostname())
+		if ip == nil {
+			return delegate(req)
+		}
+
+		for _, cidr := range cidrs {
+			if cidr.Contains(ip) {
+				return nil, nil
+			}
+		}
+
+		return delegate(req)
+	}
+}
+
+// DialerFunc implements Dialer for the provided function.
+type DialerFunc func(req *http.Request) (net.Conn, error)
+
+func (fn DialerFunc) Dial(req *http.Request) (net.Conn, error) {
+	return fn(req)
+}
+
+// Dialer dials a host and writes a request to it.
+type Dialer interface {
+	// Dial connects to the host specified by req's URL, writes the request to the connection, and
+	// returns the opened net.Conn.
+	Dial(req *http.Request) (net.Conn, error)
+}
+
+// CloneRequest creates a shallow copy of the request along with a deep copy of the Headers.
+func CloneRequest(req *http.Request) *http.Request {
+	r := new(http.Request)
+
+	// shallow clone
+	*r = *req
+
+	// deep copy headers
+	r.Header = CloneHeader(req.Header)
+
+	return r
+}
+
+// CloneHeader creates a deep copy of an http.Header.
+func CloneHeader(in http.Header) http.Header {
+	out := make(http.Header, len(in))
+	for key, values := range in {
+		newValues := make([]string, len(values))
+		copy(newValues, values)
+		out[key] = newValues
+	}
+	return out
+}
+
+// WarningHeader contains a single RFC2616 14.46 warnings header
+type WarningHeader struct {
+	// Codeindicates the type of warning. 299 is a miscellaneous persistent warning
+	Code int
+	// Agent contains the name or pseudonym of the server adding the Warning header.
+	// A single "-" is recommended when agent is unknown.
+	Agent string
+	// Warning text
+	Text string
+}
+
+// ParseWarningHeaders extract RFC2616 14.46 warnings headers from the specified set of header values.
+// Multiple comma-separated warnings per header are supported.
+// If errors are encountered on a header, the remainder of that header are skipped and subsequent headers are parsed.
+// Returns successfully parsed warnings and any errors encountered.
+func ParseWarningHeaders(headers []string) ([]WarningHeader, []error) {
+	var (
+		results []WarningHeader
+		errs    []error
+	)
+	for _, header := range headers {
+		for len(header) > 0 {
+			result, remainder, err := ParseWarningHeader(header)
+			if err != nil {
+				errs = append(errs, err)
+				break
+			}
+			results = append(results, result)
+			header = remainder
+		}
+	}
+	return results, errs
+}
+
+var (
+	codeMatcher = regexp.MustCompile(`^[0-9]{3}$`)
+	wordDecoder = &mime.WordDecoder{}
+)
+
+// ParseWarningHeader extracts one RFC2616 14.46 warning from the specified header,
+// returning an error if the header does not contain a correctly formatted warning.
+// Any remaining content in the header is returned.
+func ParseWarningHeader(header string) (result WarningHeader, remainder string, err error) {
+	// https://tools.ietf.org/html/rfc2616#section-14.46
+	//   updated by
+	// https://tools.ietf.org/html/rfc7234#section-5.5
+	//   https://tools.ietf.org/html/rfc7234#appendix-A
+	//     Some requirements regarding production and processing of the Warning
+	//     header fields have been relaxed, as it is not widely implemented.
+	//     Furthermore, the Warning header field no longer uses RFC 2047
+	//     encoding, nor does it allow multiple languages, as these aspects were
+	//     not implemented.
+	//
+	// Format is one of:
+	// warn-code warn-agent "warn-text"
+	// warn-code warn-agent "warn-text" "warn-date"
+	//
+	// warn-code is a three digit number
+	// warn-agent is unquoted and contains no spaces
+	// warn-text is quoted with backslash escaping (RFC2047-encoded according to RFC2616, not encoded according to RFC7234)
+	// warn-date is optional, quoted, and in HTTP-date format (no embedded or escaped quotes)
+	//
+	// additional warnings can optionally be included in the same header by comma-separating them:
+	// warn-code warn-agent "warn-text" "warn-date"[, warn-code warn-agent "warn-text" "warn-date", ...]
+
+	// tolerate leading whitespace
+	header = strings.TrimSpace(header)
+
+	parts := strings.SplitN(header, " ", 3)
+	if len(parts) != 3 {
+		return WarningHeader{}, "", errors.New("invalid warning header: fewer than 3 segments")
+	}
+	code, agent, textDateRemainder := parts[0], parts[1], parts[2]
+
+	// verify code format
+	if !codeMatcher.Match([]byte(code)) {
+		return WarningHeader{}, "", errors.New("invalid warning header: code segment is not 3 digits between 100-299")
+	}
+	codeInt, _ := strconv.ParseInt(code, 10, 64)
+
+	// verify agent presence
+	if len(agent) == 0 {
+		return WarningHeader{}, "", errors.New("invalid warning header: empty agent segment")
+	}
+	if !utf8.ValidString(agent) || hasAnyRunes(agent, unicode.IsControl) {
+		return WarningHeader{}, "", errors.New("invalid warning header: invalid agent")
+	}
+
+	// verify textDateRemainder presence
+	if len(textDateRemainder) == 0 {
+		return WarningHeader{}, "", errors.New("invalid warning header: empty text segment")
+	}
+
+	// extract text
+	text, dateAndRemainder, err := parseQuotedString(textDateRemainder)
+	if err != nil {
+		return WarningHeader{}, "", fmt.Errorf("invalid warning header: %v", err)
+	}
+	// tolerate RFC2047-encoded text from warnings produced according to RFC2616
+	if decodedText, err := wordDecoder.DecodeHeader(text); err == nil {
+		text = decodedText
+	}
+	if !utf8.ValidString(text) || hasAnyRunes(text, unicode.IsControl) {
+		return WarningHeader{}, "", errors.New("invalid warning header: invalid text")
+	}
+	result = WarningHeader{Code: int(codeInt), Agent: agent, Text: text}
+
+	if len(dateAndRemainder) > 0 {
+		if dateAndRemainder[0] == '"' {
+			// consume date
+			foundEndQuote := false
+			for i := 1; i < len(dateAndRemainder); i++ {
+				if dateAndRemainder[i] == '"' {
+					foundEndQuote = true
+					remainder = strings.TrimSpace(dateAndRemainder[i+1:])
+					break
+				}
+			}
+			if !foundEndQuote {
+				return WarningHeader{}, "", errors.New("invalid warning header: unterminated date segment")
+			}
+		} else {
+			remainder = dateAndRemainder
+		}
+	}
+	if len(remainder) > 0 {
+		if remainder[0] == ',' {
+			// consume comma if present
+			remainder = strings.TrimSpace(remainder[1:])
+		} else {
+			return WarningHeader{}, "", errors.New("invalid warning header: unexpected token after warn-date")
+		}
+	}
+
+	return result, remainder, nil
+}
+
+func parseQuotedString(quotedString string) (string, string, error) {
+	if len(quotedString) == 0 {
+		return "", "", errors.New("invalid quoted string: 0-length")
+	}
+
+	if quotedString[0] != '"' {
+		return "", "", errors.New("invalid quoted string: missing initial quote")
+	}
+
+	quotedString = quotedString[1:]
+	var remainder string
+	escaping := false
+	closedQuote := false
+	result := &strings.Builder{}
+loop:
+	for i := 0; i < len(quotedString); i++ {
+		b := quotedString[i]
+		switch b {
+		case '"':
+			if escaping {
+				result.WriteByte(b)
+				escaping = false
+			} else {
+				closedQuote = true
+				remainder = strings.TrimSpace(quotedString[i+1:])
+				break loop
+			}
+		case '\\':
+			if escaping {
+				result.WriteByte(b)
+				escaping = false
+			} else {
+				escaping = true
+			}
+		default:
+			result.WriteByte(b)
+			escaping = false
+		}
+	}
+
+	if !closedQuote {
+		return "", "", errors.New("invalid quoted string: missing closing quote")
+	}
+	return result.String(), remainder, nil
+}
+
+func NewWarningHeader(code int, agent, text string) (string, error) {
+	if code < 0 || code > 999 {
+		return "", errors.New("code must be between 0 and 999")
+	}
+	if len(agent) == 0 {
+		agent = "-"
+	} else if !utf8.ValidString(agent) || strings.ContainsAny(agent, `\"`) || hasAnyRunes(agent, unicode.IsSpace, unicode.IsControl) {
+		return "", errors.New("agent must be valid UTF-8 and must not contain spaces, quotes, backslashes, or control characters")
+	}
+	if !utf8.ValidString(text) || hasAnyRunes(text, unicode.IsControl) {
+		return "", errors.New("text must be valid UTF-8 and must not contain control characters")
+	}
+	return fmt.Sprintf("%03d %s %s", code, agent, makeQuotedString(text)), nil
+}
+
+func hasAnyRunes(s string, runeCheckers ...func(rune) bool) bool {
+	for _, r := range s {
+		for _, checker := range runeCheckers {
+			if checker(r) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func makeQuotedString(s string) string {
+	result := &bytes.Buffer{}
+	// opening quote
+	result.WriteRune('"')
+	for _, c := range s {
+		switch c {
+		case '"', '\\':
+			// escape " and \
+			result.WriteRune('\\')
+			result.WriteRune(c)
+		default:
+			// write everything else as-is
+			result.WriteRune(c)
+		}
+	}
+	// closing quote
+	result.WriteRune('"')
+	return result.String()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/net/http_test.go b/third_party/k8s.io/apimachinery/pkg/util/net/http_test.go
new file mode 100644
index 0000000000..8cced587d2
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/net/http_test.go
@@ -0,0 +1,958 @@
+//go:build go1.8
+
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	netutils "k8s.io/utils/net"
+)
+
+func TestGetClientIP(t *testing.T) {
+	ipString := "10.0.0.1"
+	ip := netutils.ParseIPSloppy(ipString)
+	invalidIPString := "invalidIPString"
+	testCases := []struct {
+		Request    http.Request
+		ExpectedIP net.IP
+	}{
+		{
+			Request: http.Request{},
+		},
+		{
+			Request: http.Request{
+				Header: map[string][]string{
+					"X-Real-Ip": {ipString},
+				},
+			},
+			ExpectedIP: ip,
+		},
+		{
+			Request: http.Request{
+				Header: map[string][]string{
+					"X-Real-Ip": {invalidIPString},
+				},
+			},
+		},
+		{
+			Request: http.Request{
+				Header: map[string][]string{
+					"X-Forwarded-For": {ipString},
+				},
+			},
+			ExpectedIP: ip,
+		},
+		{
+			Request: http.Request{
+				Header: map[string][]string{
+					"X-Forwarded-For": {invalidIPString},
+				},
+			},
+		},
+		{
+			Request: http.Request{
+				Header: map[string][]string{
+					"X-Forwarded-For": {invalidIPString + "," + ipString},
+				},
+			},
+			ExpectedIP: ip,
+		},
+		{
+			Request: http.Request{
+				// RemoteAddr is in the form host:port
+				RemoteAddr: ipString + ":1234",
+			},
+			ExpectedIP: ip,
+		},
+		{
+			Request: http.Request{
+				RemoteAddr: invalidIPString,
+			},
+		},
+		{
+			Request: http.Request{
+				Header: map[string][]string{
+					"X-Forwarded-For": {invalidIPString},
+				},
+				// RemoteAddr is in the form host:port
+				RemoteAddr: ipString,
+			},
+			ExpectedIP: ip,
+		},
+	}
+
+	for i, test := range testCases {
+		if a, e := GetClientIP(&test.Request), test.ExpectedIP; reflect.DeepEqual(e, a) != true {
+			t.Fatalf("test case %d failed. expected: %v, actual: %v", i, e, a)
+		}
+	}
+}
+
+func TestAppendForwardedForHeader(t *testing.T) {
+	testCases := []struct {
+		addr, forwarded, expected string
+	}{
+		{"1.2.3.4:8000", "", "1.2.3.4"},
+		{"1.2.3.4:8000", "8.8.8.8", "8.8.8.8, 1.2.3.4"},
+		{"1.2.3.4:8000", "8.8.8.8, 1.2.3.4", "8.8.8.8, 1.2.3.4, 1.2.3.4"},
+		{"1.2.3.4:8000", "foo,bar", "foo,bar, 1.2.3.4"},
+	}
+	for i, test := range testCases {
+		req := &http.Request{
+			RemoteAddr: test.addr,
+			Header:     make(http.Header),
+		}
+		if test.forwarded != "" {
+			req.Header.Set("X-Forwarded-For", test.forwarded)
+		}
+
+		AppendForwardedForHeader(req)
+		actual := req.Header.Get("X-Forwarded-For")
+		if actual != test.expected {
+			t.Errorf("[%d] Expected %q, Got %q", i, test.expected, actual)
+		}
+	}
+}
+
+func TestProxierWithNoProxyCIDR(t *testing.T) {
+	testCases := []struct {
+		name    string
+		noProxy string
+		url     string
+
+		expectedDelegated bool
+	}{
+		{
+			name:              "no env",
+			url:               "https://192.168.143.1/api",
+			expectedDelegated: true,
+		},
+		{
+			name:              "no cidr",
+			noProxy:           "192.168.63.1",
+			url:               "https://192.168.143.1/api",
+			expectedDelegated: true,
+		},
+		{
+			name:              "hostname",
+			noProxy:           "192.168.63.0/24,192.168.143.0/24",
+			url:               "https://my-hostname/api",
+			expectedDelegated: true,
+		},
+		{
+			name:              "match second cidr",
+			noProxy:           "192.168.63.0/24,192.168.143.0/24",
+			url:               "https://192.168.143.1/api",
+			expectedDelegated: false,
+		},
+		{
+			name:              "match second cidr with host:port",
+			noProxy:           "192.168.63.0/24,192.168.143.0/24",
+			url:               "https://192.168.143.1:8443/api",
+			expectedDelegated: false,
+		},
+		{
+			name:              "IPv6 cidr",
+			noProxy:           "2001:db8::/48",
+			url:               "https://[2001:db8::1]/api",
+			expectedDelegated: false,
+		},
+		{
+			name:              "IPv6+port cidr",
+			noProxy:           "2001:db8::/48",
+			url:               "https://[2001:db8::1]:8443/api",
+			expectedDelegated: false,
+		},
+		{
+			name:              "IPv6, not matching cidr",
+			noProxy:           "2001:db8::/48",
+			url:               "https://[2001:db8:1::1]/api",
+			expectedDelegated: true,
+		},
+		{
+			name:              "IPv6+port, not matching cidr",
+			noProxy:           "2001:db8::/48",
+			url:               "https://[2001:db8:1::1]:8443/api",
+			expectedDelegated: true,
+		},
+	}
+
+	for _, test := range testCases {
+		t.Setenv("NO_PROXY", test.noProxy)
+		actualDelegated := false
+		proxyFunc := NewProxierWithNoProxyCIDR(func(req *http.Request) (*url.URL, error) {
+			actualDelegated = true
+			return nil, nil
+		})
+
+		req, err := http.NewRequest(http.MethodGet, test.url, nil)
+		if err != nil {
+			t.Errorf("%s: unexpected err: %v", test.name, err)
+			continue
+		}
+		if _, err := proxyFunc(req); err != nil {
+			t.Errorf("%s: unexpected err: %v", test.name, err)
+			continue
+		}
+
+		if test.expectedDelegated != actualDelegated {
+			t.Errorf("%s: expected %v, got %v", test.name, test.expectedDelegated, actualDelegated)
+			continue
+		}
+	}
+}
+
+type fakeTLSClientConfigHolder struct {
+	called bool
+}
+
+func (f *fakeTLSClientConfigHolder) TLSClientConfig() *tls.Config {
+	f.called = true
+	return nil
+}
+func (f *fakeTLSClientConfigHolder) RoundTrip(*http.Request) (*http.Response, error) {
+	return nil, nil
+}
+
+func TestTLSClientConfigHolder(t *testing.T) {
+	rt := &fakeTLSClientConfigHolder{}
+	TLSClientConfig(rt)
+
+	if !rt.called {
+		t.Errorf("didn't find tls config")
+	}
+}
+
+func TestJoinPreservingTrailingSlash(t *testing.T) {
+	tests := []struct {
+		a    string
+		b    string
+		want string
+	}{
+		// All empty
+		{"", "", ""},
+
+		// Empty a
+		{"", "/", "/"},
+		{"", "foo", "foo"},
+		{"", "/foo", "/foo"},
+		{"", "/foo/", "/foo/"},
+
+		// Empty b
+		{"/", "", "/"},
+		{"foo", "", "foo"},
+		{"/foo", "", "/foo"},
+		{"/foo/", "", "/foo/"},
+
+		// Both populated
+		{"/", "/", "/"},
+		{"foo", "foo", "foo/foo"},
+		{"/foo", "/foo", "/foo/foo"},
+		{"/foo/", "/foo/", "/foo/foo/"},
+	}
+	for _, tt := range tests {
+		name := fmt.Sprintf("%q+%q=%q", tt.a, tt.b, tt.want)
+		t.Run(name, func(t *testing.T) {
+			if got := JoinPreservingTrailingSlash(tt.a, tt.b); got != tt.want {
+				t.Errorf("JoinPreservingTrailingSlash() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestAllowsHTTP2(t *testing.T) {
+	testcases := []struct {
+		Name         string
+		Transport    *http.Transport
+		ExpectAllows bool
+	}{
+		{
+			Name:         "empty",
+			Transport:    &http.Transport{},
+			ExpectAllows: true,
+		},
+		{
+			Name:         "empty tlsconfig",
+			Transport:    &http.Transport{TLSClientConfig: &tls.Config{}},
+			ExpectAllows: true,
+		},
+		{
+			Name:         "zero-length NextProtos",
+			Transport:    &http.Transport{TLSClientConfig: &tls.Config{NextProtos: []string{}}},
+			ExpectAllows: true,
+		},
+		{
+			Name:         "includes h2 in NextProtos after",
+			Transport:    &http.Transport{TLSClientConfig: &tls.Config{NextProtos: []string{"http/1.1", "h2"}}},
+			ExpectAllows: true,
+		},
+		{
+			Name:         "includes h2 in NextProtos before",
+			Transport:    &http.Transport{TLSClientConfig: &tls.Config{NextProtos: []string{"h2", "http/1.1"}}},
+			ExpectAllows: true,
+		},
+		{
+			Name:         "includes h2 in NextProtos between",
+			Transport:    &http.Transport{TLSClientConfig: &tls.Config{NextProtos: []string{"http/1.1", "h2", "h3"}}},
+			ExpectAllows: true,
+		},
+		{
+			Name:         "excludes h2 in NextProtos",
+			Transport:    &http.Transport{TLSClientConfig: &tls.Config{NextProtos: []string{"http/1.1"}}},
+			ExpectAllows: false,
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.Name, func(t *testing.T) {
+			allows := allowsHTTP2(tc.Transport)
+			if allows != tc.ExpectAllows {
+				t.Errorf("expected %v, got %v", tc.ExpectAllows, allows)
+			}
+		})
+	}
+}
+
+func TestSourceIPs(t *testing.T) {
+	tests := []struct {
+		name         string
+		realIP       string
+		forwardedFor string
+		remoteAddr   string
+		expected     []string
+	}{{
+		name:     "no headers, missing remoteAddr",
+		expected: []string{},
+	}, {
+		name:       "no headers, just remoteAddr host:port",
+		remoteAddr: "1.2.3.4:555",
+		expected:   []string{"1.2.3.4"},
+	}, {
+		name:       "no headers, just remoteAddr host",
+		remoteAddr: "1.2.3.4",
+		expected:   []string{"1.2.3.4"},
+	}, {
+		name:         "empty forwarded-for chain",
+		forwardedFor: " ",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"1.2.3.4"},
+	}, {
+		name:         "invalid forwarded-for chain",
+		forwardedFor: "garbage garbage values!",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"1.2.3.4"},
+	}, {
+		name:         "partially invalid forwarded-for chain",
+		forwardedFor: "garbage garbage values!,4.5.6.7",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"4.5.6.7", "1.2.3.4"},
+	}, {
+		name:         "valid forwarded-for chain",
+		forwardedFor: "120.120.120.126,2.2.2.2,4.5.6.7",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"120.120.120.126", "2.2.2.2", "4.5.6.7", "1.2.3.4"},
+	}, {
+		name:         "valid forwarded-for chain with redundant remoteAddr",
+		forwardedFor: "2.2.2.2,1.2.3.4",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"2.2.2.2", "1.2.3.4"},
+	}, {
+		name:       "invalid Real-Ip",
+		realIP:     "garbage, just garbage!",
+		remoteAddr: "1.2.3.4",
+		expected:   []string{"1.2.3.4"},
+	}, {
+		name:         "invalid Real-Ip with forwarded-for",
+		realIP:       "garbage, just garbage!",
+		forwardedFor: "2.2.2.2",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"2.2.2.2", "1.2.3.4"},
+	}, {
+		name:       "valid Real-Ip",
+		realIP:     "2.2.2.2",
+		remoteAddr: "1.2.3.4",
+		expected:   []string{"2.2.2.2", "1.2.3.4"},
+	}, {
+		name:       "redundant Real-Ip",
+		realIP:     "1.2.3.4",
+		remoteAddr: "1.2.3.4",
+		expected:   []string{"1.2.3.4"},
+	}, {
+		name:         "valid Real-Ip with forwarded-for",
+		realIP:       "2.2.2.2",
+		forwardedFor: "120.120.120.126,4.5.6.7",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"120.120.120.126", "4.5.6.7", "2.2.2.2", "1.2.3.4"},
+	}, {
+		name:         "redundant Real-Ip with forwarded-for",
+		realIP:       "2.2.2.2",
+		forwardedFor: "120.120.120.126,2.2.2.2,4.5.6.7",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"120.120.120.126", "2.2.2.2", "4.5.6.7", "1.2.3.4"},
+	}, {
+		name:         "full redundancy",
+		realIP:       "1.2.3.4",
+		forwardedFor: "1.2.3.4",
+		remoteAddr:   "1.2.3.4",
+		expected:     []string{"1.2.3.4"},
+	}, {
+		name:         "full ipv6",
+		realIP:       "abcd:ef01:2345:6789:abcd:ef01:2345:6789",
+		forwardedFor: "aaaa:bbbb:cccc:dddd:eeee:ffff:0:1111,0:1111:2222:3333:4444:5555:6666:7777",
+		remoteAddr:   "aaaa:aaaa:aaaa:aaaa:aaaa:aaaa:aaaa:aaaa",
+		expected: []string{
+			"aaaa:bbbb:cccc:dddd:eeee:ffff:0:1111",
+			"0:1111:2222:3333:4444:5555:6666:7777",
+			"abcd:ef01:2345:6789:abcd:ef01:2345:6789",
+			"aaaa:aaaa:aaaa:aaaa:aaaa:aaaa:aaaa:aaaa",
+		},
+	}, {
+		name:         "mixed ipv4 ipv6",
+		forwardedFor: "aaaa:bbbb:cccc:dddd:eeee:ffff:0:1111,1.2.3.4",
+		remoteAddr:   "0:0:0:0:0:ffff:102:304", // ipv6 equivalent to 1.2.3.4
+		expected: []string{
+			"aaaa:bbbb:cccc:dddd:eeee:ffff:0:1111",
+			"1.2.3.4",
+		},
+	}}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			req, _ := http.NewRequest(http.MethodGet, "https://cluster.k8s.io/apis/foobars/v1/foo/bar", nil)
+			req.RemoteAddr = test.remoteAddr
+			if test.forwardedFor != "" {
+				req.Header.Set("X-Forwarded-For", test.forwardedFor)
+			}
+			if test.realIP != "" {
+				req.Header.Set("X-Real-Ip", test.realIP)
+			}
+
+			actualIPs := SourceIPs(req)
+			actual := make([]string, len(actualIPs))
+			for i, ip := range actualIPs {
+				actual[i] = ip.String()
+			}
+
+			assert.Equal(t, test.expected, actual)
+		})
+	}
+}
+
+func TestParseWarningHeader(t *testing.T) {
+	tests := []struct {
+		name string
+
+		header string
+
+		wantResult    WarningHeader
+		wantRemainder string
+		wantErr       string
+	}{
+		// invalid cases
+		{
+			name:    "empty",
+			header:  ``,
+			wantErr: "fewer than 3 segments",
+		},
+		{
+			name:    "bad code",
+			header:  `A B`,
+			wantErr: "fewer than 3 segments",
+		},
+		{
+			name:    "short code",
+			header:  `1 - "text"`,
+			wantErr: "not 3 digits",
+		},
+		{
+			name:    "bad code",
+			header:  `A - "text"`,
+			wantErr: "not 3 digits",
+		},
+		{
+			name:    "invalid date quoting",
+			header:  `  299 - "text\"\\\a\b\c"  "Tue, 15 Nov 1994 08:12:31 GMT `,
+			wantErr: "unterminated date segment",
+		},
+		{
+			name:    "invalid post-date",
+			header:  `  299 - "text\"\\\a\b\c"  "Tue, 15 Nov 1994 08:12:31 GMT" other`,
+			wantErr: "unexpected token after warn-date",
+		},
+		{
+			name:    "agent control character",
+			header:  "  299 agent\u0000name \"text\"",
+			wantErr: "invalid agent",
+		},
+		{
+			name:    "agent non-utf8 character",
+			header:  "  299 agent\xc5name \"text\"",
+			wantErr: "invalid agent",
+		},
+		{
+			name:    "text control character",
+			header:  "  299 - \"text\u0000\"content",
+			wantErr: "invalid text",
+		},
+		{
+			name:    "text non-utf8 character",
+			header:  "  299 - \"text\xc5\"content",
+			wantErr: "invalid text",
+		},
+
+		// valid cases
+		{
+			name:       "ok",
+			header:     `299 - "text"`,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `text`},
+		},
+		{
+			name:       "ok",
+			header:     `299 - "text\"\\\a\b\c"`,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `text"\abc`},
+		},
+		// big code
+		{
+			name:       "big code",
+			header:     `321 - "text"`,
+			wantResult: WarningHeader{Code: 321, Agent: "-", Text: "text"},
+		},
+		// RFC 2047 decoding
+		{
+			name:       "ok, rfc 2047, iso-8859-1, q",
+			header:     `299 - "=?iso-8859-1?q?this=20is=20some=20text?="`,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `this is some text`},
+		},
+		{
+			name:       "ok, rfc 2047, utf-8, b",
+			header:     `299 - "=?UTF-8?B?VGhpcyBpcyBhIGhvcnNleTog8J+Qjg==?= And =?UTF-8?B?VGhpcyBpcyBhIGhvcnNleTog8J+Qjg==?="`,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `This is a horsey: 🐎 And This is a horsey: 🐎`},
+		},
+		{
+			name:       "ok, rfc 2047, utf-8, q",
+			header:     `299 - "=?UTF-8?Q?This is a \"horsey\": =F0=9F=90=8E?="`,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `This is a "horsey": 🐎`},
+		},
+		{
+			name:       "ok, rfc 2047, unknown charset",
+			header:     `299 - "=?UTF-9?Q?This is a horsey: =F0=9F=90=8E?="`,
+			wantResult: WarningHeader{Code: 299, Agent: "-", Text: `=?UTF-9?Q?This is a horsey: =F0=9F=90=8E?=`},
+		},
+		{
+			name:       "ok with spaces",
+			header:     `  299 - "text\"\\\a\b\c"  `,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `text"\abc`},
+		},
+		{
+			name:       "ok with date",
+			header:     `  299 - "text\"\\\a\b\c"  "Tue, 15 Nov 1994 08:12:31 GMT" `,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `text"\abc`},
+		},
+		{
+			name:       "ok with date and comma",
+			header:     `  299 - "text\"\\\a\b\c"  "Tue, 15 Nov 1994 08:12:31 GMT" , `,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `text"\abc`},
+		},
+		{
+			name:       "ok with comma",
+			header:     `  299 - "text\"\\\a\b\c"  , `,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `text"\abc`},
+		},
+		{
+			name:          "ok with date and comma and remainder",
+			header:        `  299 - "text\"\\\a\b\c"  "Tue, 15 Nov 1994 08:12:31 GMT" , remainder `,
+			wantResult:    WarningHeader{Code: 299, Agent: `-`, Text: `text"\abc`},
+			wantRemainder: "remainder",
+		},
+		{
+			name:          "ok with comma and remainder",
+			header:        `  299 - "text\"\\\a\b\c"  ,remainder text,second remainder`,
+			wantResult:    WarningHeader{Code: 299, Agent: `-`, Text: `text"\abc`},
+			wantRemainder: "remainder text,second remainder",
+		},
+		{
+			name:       "ok with utf-8 content directly in warn-text",
+			header:     ` 299 - "Test of Iñtërnâtiônàlizætiøn,💝🐹🌇⛔" `,
+			wantResult: WarningHeader{Code: 299, Agent: `-`, Text: `Test of Iñtërnâtiônàlizætiøn,💝🐹🌇⛔`},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotResult, gotRemainder, err := ParseWarningHeader(tt.header)
+			switch {
+			case err == nil && len(tt.wantErr) > 0:
+				t.Errorf("ParseWarningHeader() no error, expected error %q", tt.wantErr)
+				return
+			case err != nil && len(tt.wantErr) == 0:
+				t.Errorf("ParseWarningHeader() error %q, expected no error", err)
+				return
+			case err != nil && len(tt.wantErr) > 0 && !strings.Contains(err.Error(), tt.wantErr):
+				t.Errorf("ParseWarningHeader() error %q, expected error %q", err, tt.wantErr)
+				return
+			}
+			if err != nil {
+				return
+			}
+			if !reflect.DeepEqual(gotResult, tt.wantResult) {
+				t.Errorf("ParseWarningHeader() gotResult = %#v, want %#v", gotResult, tt.wantResult)
+			}
+			if gotRemainder != tt.wantRemainder {
+				t.Errorf("ParseWarningHeader() gotRemainder = %v, want %v", gotRemainder, tt.wantRemainder)
+			}
+		})
+	}
+}
+
+func TestNewWarningHeader(t *testing.T) {
+	tests := []struct {
+		name string
+
+		code  int
+		agent string
+		text  string
+
+		want    string
+		wantErr string
+	}{
+		// invalid cases
+		{
+			name:    "code too low",
+			code:    -1,
+			agent:   `-`,
+			text:    `example warning`,
+			wantErr: "between 0 and 999",
+		},
+		{
+			name:    "code too high",
+			code:    1000,
+			agent:   `-`,
+			text:    `example warning`,
+			wantErr: "between 0 and 999",
+		},
+		{
+			name:    "agent with space",
+			code:    299,
+			agent:   `test agent`,
+			text:    `example warning`,
+			wantErr: `agent must be valid`,
+		},
+		{
+			name:    "agent with newline",
+			code:    299,
+			agent:   "test\nagent",
+			text:    `example warning`,
+			wantErr: `agent must be valid`,
+		},
+		{
+			name:    "agent with backslash",
+			code:    299,
+			agent:   `test\agent`,
+			text:    `example warning`,
+			wantErr: `agent must be valid`,
+		},
+		{
+			name:    "agent with quote",
+			code:    299,
+			agent:   `test"agent"`,
+			text:    `example warning`,
+			wantErr: `agent must be valid`,
+		},
+		{
+			name:    "agent with control character",
+			code:    299,
+			agent:   "test\u0000agent",
+			text:    `example warning`,
+			wantErr: `agent must be valid`,
+		},
+		{
+			name:    "agent with non-UTF8",
+			code:    299,
+			agent:   "test\xc5agent",
+			text:    `example warning`,
+			wantErr: `agent must be valid`,
+		},
+		{
+			name:    "text with newline",
+			code:    299,
+			agent:   `-`,
+			text:    "Test of new\nline",
+			wantErr: "text must be valid",
+		},
+		{
+			name:    "text with control character",
+			code:    299,
+			agent:   `-`,
+			text:    "Test of control\u0000character",
+			wantErr: "text must be valid",
+		},
+		{
+			name:    "text with non-UTF8",
+			code:    299,
+			agent:   `-`,
+			text:    "Test of control\xc5character",
+			wantErr: "text must be valid",
+		},
+
+		{
+			name:  "valid empty text",
+			code:  299,
+			agent: `-`,
+			text:  ``,
+			want:  `299 - ""`,
+		},
+		{
+			name:  "valid empty agent",
+			code:  299,
+			agent: ``,
+			text:  `example warning`,
+			want:  `299 - "example warning"`,
+		},
+		{
+			name:  "valid low code",
+			code:  1,
+			agent: `-`,
+			text:  `example warning`,
+			want:  `001 - "example warning"`,
+		},
+		{
+			name:  "valid high code",
+			code:  999,
+			agent: `-`,
+			text:  `example warning`,
+			want:  `999 - "example warning"`,
+		},
+		{
+			name:  "valid utf-8",
+			code:  299,
+			agent: `-`,
+			text:  `Test of "Iñtërnâtiônàlizætiøn,💝🐹🌇⛔"`,
+			want:  `299 - "Test of \"Iñtërnâtiônàlizætiøn,💝🐹🌇⛔\""`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := NewWarningHeader(tt.code, tt.agent, tt.text)
+
+			switch {
+			case err == nil && len(tt.wantErr) > 0:
+				t.Fatalf("ParseWarningHeader() no error, expected error %q", tt.wantErr)
+			case err != nil && len(tt.wantErr) == 0:
+				t.Fatalf("ParseWarningHeader() error %q, expected no error", err)
+			case err != nil && len(tt.wantErr) > 0 && !strings.Contains(err.Error(), tt.wantErr):
+				t.Fatalf("ParseWarningHeader() error %q, expected error %q", err, tt.wantErr)
+			}
+			if err != nil {
+				return
+			}
+
+			if got != tt.want {
+				t.Fatalf("NewWarningHeader() = %v, want %v", got, tt.want)
+			}
+
+			roundTrip, remaining, err := ParseWarningHeader(got)
+			if err != nil {
+				t.Fatalf("error roundtripping: %v", err)
+			}
+			if len(remaining) > 0 {
+				t.Fatalf("unexpected remainder roundtripping: %s", remaining)
+			}
+			agent := tt.agent
+			if len(agent) == 0 {
+				agent = "-"
+			}
+			expect := WarningHeader{Code: tt.code, Agent: agent, Text: tt.text}
+			if roundTrip != expect {
+				t.Fatalf("after round trip, want:\n%#v\ngot\n%#v", expect, roundTrip)
+			}
+		})
+	}
+}
+
+func TestParseWarningHeaders(t *testing.T) {
+	tests := []struct {
+		name string
+
+		headers []string
+
+		want     []WarningHeader
+		wantErrs []string
+	}{
+		{
+			name:     "empty",
+			headers:  []string{},
+			want:     nil,
+			wantErrs: []string{},
+		},
+		{
+			name: "multi-header with error",
+			headers: []string{
+				`299 - "warning 1.1",299 - "warning 1.2"`,
+				`299 - "warning 2", 299 - "warning unquoted`,
+				` 299 - "warning 3.1" ,  299 - "warning 3.2" `,
+			},
+			want: []WarningHeader{
+				{Code: 299, Agent: "-", Text: "warning 1.1"},
+				{Code: 299, Agent: "-", Text: "warning 1.2"},
+				{Code: 299, Agent: "-", Text: "warning 2"},
+				{Code: 299, Agent: "-", Text: "warning 3.1"},
+				{Code: 299, Agent: "-", Text: "warning 3.2"},
+			},
+			wantErrs: []string{"invalid warning header: invalid quoted string: missing closing quote"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, gotErrs := ParseWarningHeaders(tt.headers)
+
+			switch {
+			case len(gotErrs) != len(tt.wantErrs):
+				t.Fatalf("ParseWarningHeader() got %v, expected %v", gotErrs, tt.wantErrs)
+			case len(gotErrs) == len(tt.wantErrs) && len(gotErrs) > 0:
+				gotErrStrings := []string{}
+				for _, err := range gotErrs {
+					gotErrStrings = append(gotErrStrings, err.Error())
+				}
+				if !reflect.DeepEqual(gotErrStrings, tt.wantErrs) {
+					t.Fatalf("ParseWarningHeader() got %v, expected %v", gotErrs, tt.wantErrs)
+				}
+			}
+			if len(gotErrs) > 0 {
+				return
+			}
+
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("ParseWarningHeaders() got %#v, want %#v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestIsProbableEOF(t *testing.T) {
+	tests := []struct {
+		name     string
+		err      error
+		expected bool
+	}{
+		{
+			name:     "with no error",
+			expected: false,
+		},
+		{
+			name:     "with EOF error",
+			err:      io.EOF,
+			expected: true,
+		},
+		{
+			name:     "with unexpected EOF error",
+			err:      io.ErrUnexpectedEOF,
+			expected: true,
+		},
+		{
+			name:     "with broken connection error",
+			err:      fmt.Errorf("http: can't write HTTP request on broken connection"),
+			expected: true,
+		},
+		{
+			name:     "with server sent GOAWAY error",
+			err:      fmt.Errorf("error foo - http2: server sent GOAWAY and closed the connection - error bar"),
+			expected: true,
+		},
+		{
+			name:     "with connection reset by peer error",
+			err:      fmt.Errorf("error foo - connection reset by peer - error bar"),
+			expected: true,
+		},
+		{
+			name:     "with use of closed network connection error",
+			err:      fmt.Errorf("error foo - Use of closed network connection - error bar"),
+			expected: true,
+		},
+		{
+			name: "with url error",
+			err: &url.Error{
+				Err: io.ErrUnexpectedEOF,
+			},
+			expected: true,
+		},
+		{
+			name:     "with unrecognized error",
+			err:      fmt.Errorf("error foo"),
+			expected: false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := IsProbableEOF(test.err)
+			assert.Equal(t, test.expected, actual)
+		})
+	}
+}
+
+func TestReadIdleTimeoutSeconds(t *testing.T) {
+	t.Setenv("HTTP2_READ_IDLE_TIMEOUT_SECONDS", "60")
+	if e, a := 60, readIdleTimeoutSeconds(); e != a {
+		t.Errorf("expected %d, got %d", e, a)
+	}
+
+	t.Setenv("HTTP2_READ_IDLE_TIMEOUT_SECONDS", "illegal value")
+	if e, a := 30, readIdleTimeoutSeconds(); e != a {
+		t.Errorf("expected %d, got %d", e, a)
+	}
+}
+
+func TestPingTimeoutSeconds(t *testing.T) {
+	t.Setenv("HTTP2_PING_TIMEOUT_SECONDS", "60")
+	if e, a := 60, pingTimeoutSeconds(); e != a {
+		t.Errorf("expected %d, got %d", e, a)
+	}
+
+	t.Setenv("HTTP2_PING_TIMEOUT_SECONDS", "illegal value")
+	if e, a := 15, pingTimeoutSeconds(); e != a {
+		t.Errorf("expected %d, got %d", e, a)
+	}
+}
+
+func Benchmark_ParseQuotedString(b *testing.B) {
+	str := `"The quick brown" fox jumps over the lazy dog`
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		quoted, remainder, err := parseQuotedString(str)
+		if err != nil {
+			b.Errorf("Unexpected error %s", err)
+		}
+		if quoted != "The quick brown" {
+			b.Errorf("Unexpected quoted string %s", quoted)
+		}
+		if remainder != "fox jumps over the lazy dog" {
+			b.Errorf("Unexpected remainder string %s", quoted)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/net/interface.go b/third_party/k8s.io/apimachinery/pkg/util/net/interface.go
new file mode 100644
index 0000000000..3ccf227af0
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/net/interface.go
@@ -0,0 +1,532 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"bufio"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"net"
+	"os"
+
+	"strings"
+
+	"k8s.io/klog/v2"
+	netutils "k8s.io/utils/net"
+)
+
+type AddressFamily uint
+
+const (
+	familyIPv4 AddressFamily = 4
+	familyIPv6 AddressFamily = 6
+)
+
+type AddressFamilyPreference []AddressFamily
+
+var (
+	preferIPv4 = AddressFamilyPreference{familyIPv4, familyIPv6}
+	preferIPv6 = AddressFamilyPreference{familyIPv6, familyIPv4}
+)
+
+const (
+	// LoopbackInterfaceName is the default name of the loopback interface
+	LoopbackInterfaceName = "lo"
+)
+
+const (
+	ipv4RouteFile = "/proc/net/route"
+	ipv6RouteFile = "/proc/net/ipv6_route"
+)
+
+type Route struct {
+	Interface   string
+	Destination net.IP
+	Gateway     net.IP
+	Family      AddressFamily
+}
+
+type RouteFile struct {
+	name  string
+	parse func(input io.Reader) ([]Route, error)
+}
+
+// noRoutesError can be returned in case of no routes
+type noRoutesError struct {
+	message string
+}
+
+func (e noRoutesError) Error() string {
+	return e.message
+}
+
+// IsNoRoutesError checks if an error is of type noRoutesError
+func IsNoRoutesError(err error) bool {
+	if err == nil {
+		return false
+	}
+	switch err.(type) {
+	case noRoutesError:
+		return true
+	default:
+		return false
+	}
+}
+
+var (
+	v4File = RouteFile{name: ipv4RouteFile, parse: getIPv4DefaultRoutes}
+	v6File = RouteFile{name: ipv6RouteFile, parse: getIPv6DefaultRoutes}
+)
+
+func (rf RouteFile) extract() ([]Route, error) {
+	file, err := os.Open(rf.name)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+	return rf.parse(file)
+}
+
+// getIPv4DefaultRoutes obtains the IPv4 routes, and filters out non-default routes.
+func getIPv4DefaultRoutes(input io.Reader) ([]Route, error) {
+	routes := []Route{}
+	scanner := bufio.NewReader(input)
+	for {
+		line, err := scanner.ReadString('\n')
+		if err == io.EOF {
+			break
+		}
+		//ignore the headers in the route info
+		if strings.HasPrefix(line, "Iface") {
+			continue
+		}
+		fields := strings.Fields(line)
+		// Interested in fields:
+		//  0 - interface name
+		//  1 - destination address
+		//  2 - gateway
+		dest, err := parseIP(fields[1], familyIPv4)
+		if err != nil {
+			return nil, err
+		}
+		gw, err := parseIP(fields[2], familyIPv4)
+		if err != nil {
+			return nil, err
+		}
+		if !dest.Equal(net.IPv4zero) {
+			continue
+		}
+		routes = append(routes, Route{
+			Interface:   fields[0],
+			Destination: dest,
+			Gateway:     gw,
+			Family:      familyIPv4,
+		})
+	}
+	return routes, nil
+}
+
+func getIPv6DefaultRoutes(input io.Reader) ([]Route, error) {
+	routes := []Route{}
+	scanner := bufio.NewReader(input)
+	for {
+		line, err := scanner.ReadString('\n')
+		if err == io.EOF {
+			break
+		}
+		fields := strings.Fields(line)
+		// Interested in fields:
+		//  0 - destination address
+		//  4 - gateway
+		//  9 - interface name
+		dest, err := parseIP(fields[0], familyIPv6)
+		if err != nil {
+			return nil, err
+		}
+		gw, err := parseIP(fields[4], familyIPv6)
+		if err != nil {
+			return nil, err
+		}
+		if !dest.Equal(net.IPv6zero) {
+			continue
+		}
+		if gw.Equal(net.IPv6zero) {
+			continue // loopback
+		}
+		routes = append(routes, Route{
+			Interface:   fields[9],
+			Destination: dest,
+			Gateway:     gw,
+			Family:      familyIPv6,
+		})
+	}
+	return routes, nil
+}
+
+// parseIP takes the hex IP address string from route file and converts it
+// to a net.IP address. For IPv4, the value must be converted to big endian.
+func parseIP(str string, family AddressFamily) (net.IP, error) {
+	if str == "" {
+		return nil, fmt.Errorf("input is nil")
+	}
+	bytes, err := hex.DecodeString(str)
+	if err != nil {
+		return nil, err
+	}
+	if family == familyIPv4 {
+		if len(bytes) != net.IPv4len {
+			return nil, fmt.Errorf("invalid IPv4 address in route")
+		}
+		return net.IP([]byte{bytes[3], bytes[2], bytes[1], bytes[0]}), nil
+	}
+	// Must be IPv6
+	if len(bytes) != net.IPv6len {
+		return nil, fmt.Errorf("invalid IPv6 address in route")
+	}
+	return net.IP(bytes), nil
+}
+
+func isInterfaceUp(logger klog.Logger, intf *net.Interface) bool {
+	if intf == nil {
+		return false
+	}
+	if intf.Flags&net.FlagUp != 0 {
+		logger.V(4).Info("Interface is up", "interface", intf.Name)
+		return true
+	}
+	return false
+}
+
+func isLoopbackOrPointToPoint(intf *net.Interface) bool {
+	return intf.Flags&(net.FlagLoopback|net.FlagPointToPoint) != 0
+}
+
+// getMatchingGlobalIP returns the first valid global unicast address of the given
+// 'family' from the list of 'addrs'.
+func getMatchingGlobalIP(logger klog.Logger, addrs []net.Addr, family AddressFamily) (net.IP, error) {
+	if len(addrs) > 0 {
+		for i := range addrs {
+			logger.V(4).Info("Checking for matching global IP", "address", addrs[i])
+			ip, _, err := netutils.ParseCIDRSloppy(addrs[i].String())
+			if err != nil {
+				return nil, err
+			}
+			if memberOf(ip, family) {
+				if ip.IsGlobalUnicast() {
+					logger.V(4).Info("IP found", "IP", ip)
+					return ip, nil
+				} else {
+					logger.V(4).Info("Non-global unicast address found", "IP", ip)
+				}
+			} else {
+				logger.V(4).Info("IP address has wrong version", "IP", ip, "IPVersion", int(family))
+			}
+
+		}
+	}
+	return nil, nil
+}
+
+// getIPFromInterface gets the IPs on an interface and returns a global unicast address, if any. The
+// interface must be up, the IP must in the family requested, and the IP must be a global unicast address.
+func getIPFromInterface(logger klog.Logger, intfName string, forFamily AddressFamily, nw networkInterfacer) (net.IP, error) {
+	intf, err := nw.InterfaceByName(intfName)
+	if err != nil {
+		return nil, err
+	}
+	if isInterfaceUp(logger, intf) {
+		addrs, err := nw.Addrs(intf)
+		if err != nil {
+			return nil, err
+		}
+		logger.V(4).Info("Found addresses for interface", "interface", intfName, "numAddresses", len(addrs), "addresses", addrs)
+		matchingIP, err := getMatchingGlobalIP(logger, addrs, forFamily)
+		if err != nil {
+			return nil, err
+		}
+		if matchingIP != nil {
+			logger.V(4).Info("Found valid address", "IPVersion", int(forFamily), "IP", matchingIP, "interface", intfName)
+			return matchingIP, nil
+		}
+	}
+	return nil, nil
+}
+
+// getIPFromLoopbackInterface gets the IPs on a loopback interface and returns a global unicast address, if any.
+// The loopback interface must be up, the IP must in the family requested, and the IP must be a global unicast address.
+func getIPFromLoopbackInterface(logger klog.Logger, forFamily AddressFamily, nw networkInterfacer) (net.IP, error) {
+	intfs, err := nw.Interfaces()
+	if err != nil {
+		return nil, err
+	}
+	for _, intf := range intfs {
+		if !isInterfaceUp(logger, &intf) {
+			continue
+		}
+		if intf.Flags&(net.FlagLoopback) != 0 {
+			addrs, err := nw.Addrs(&intf)
+			if err != nil {
+				return nil, err
+			}
+			logger.V(4).Info("Found addresses for interface", "interface", intf.Name, "numAddresses", len(addrs), "addresses", addrs)
+			matchingIP, err := getMatchingGlobalIP(logger, addrs, forFamily)
+			if err != nil {
+				return nil, err
+			}
+			if matchingIP != nil {
+				logger.V(4).Info("Found valid address", "IPVersion", int(forFamily), "IP", matchingIP, "interface", intf.Name)
+				return matchingIP, nil
+			}
+		}
+	}
+	return nil, nil
+}
+
+// memberOf tells if the IP is of the desired family. Used for checking interface addresses.
+func memberOf(ip net.IP, family AddressFamily) bool {
+	if ip.To4() != nil {
+		return family == familyIPv4
+	} else {
+		return family == familyIPv6
+	}
+}
+
+// chooseIPFromHostInterfaces looks at all system interfaces, trying to find one that is up that
+// has a global unicast address (non-loopback, non-link local, non-point2point), and returns the IP.
+// addressFamilies determines whether it prefers IPv4 or IPv6
+func chooseIPFromHostInterfaces(logger klog.Logger, nw networkInterfacer, addressFamilies AddressFamilyPreference) (net.IP, error) {
+	intfs, err := nw.Interfaces()
+	if err != nil {
+		return nil, err
+	}
+	if len(intfs) == 0 {
+		return nil, fmt.Errorf("no interfaces found on host.")
+	}
+	for _, family := range addressFamilies {
+		logger.V(4).Info("Looking for system interface with a global address", "IPVersion", uint(family))
+		for _, intf := range intfs {
+			if !isInterfaceUp(logger, &intf) {
+				logger.V(4).Info("Skipping: interface is down", "interface", intf.Name)
+				continue
+			}
+			if isLoopbackOrPointToPoint(&intf) {
+				logger.V(4).Info("Skipping: is LB or P2P", "interface", intf.Name)
+				continue
+			}
+			addrs, err := nw.Addrs(&intf)
+			if err != nil {
+				return nil, err
+			}
+			if len(addrs) == 0 {
+				logger.V(4).Info("Skipping: no addresses", "interface", intf.Name)
+				continue
+			}
+			for _, addr := range addrs {
+				ip, _, err := netutils.ParseCIDRSloppy(addr.String())
+				if err != nil {
+					return nil, fmt.Errorf("unable to parse CIDR for interface %q: %s", intf.Name, err)
+				}
+				if !memberOf(ip, family) {
+					logger.V(4).Info("Skipping: no address family match", "IP", ip, "interface", intf.Name)
+					continue
+				}
+				// TODO: Decide if should open up to allow IPv6 LLAs in future.
+				if !ip.IsGlobalUnicast() {
+					logger.V(4).Info("Skipping: non-global address", "IP", ip, "interface", intf.Name)
+					continue
+				}
+				logger.V(4).Info("Found global unicast address", "IP", ip, "interface", intf.Name)
+				return ip, nil
+			}
+		}
+	}
+	return nil, fmt.Errorf("no acceptable interface with global unicast address found on host")
+}
+
+// ChooseHostInterface is a method used fetch an IP for a daemon.
+// If there is no routing info file, it will choose a global IP from the system
+// interfaces. Otherwise, it will use IPv4 and IPv6 route information to return the
+// IP of the interface with a gateway on it (with priority given to IPv4). For a node
+// with no internet connection, it returns error.
+//
+//logcheck:context // [ChooseHostInterfaceWithLogger] should be used instead of ChooseHostInterface in code which supports contextual logging.
+func ChooseHostInterface() (net.IP, error) {
+	return ChooseHostInterfaceWithLogger(klog.Background())
+}
+
+// ChooseHostInterfaceWithLogger is a method used fetch an IP for a daemon.
+// If there is no routing info file, it will choose a global IP from the system
+// interfaces. Otherwise, it will use IPv4 and IPv6 route information to return the
+// IP of the interface with a gateway on it (with priority given to IPv4). For a node
+// with no internet connection, it returns error.
+func ChooseHostInterfaceWithLogger(logger klog.Logger) (net.IP, error) {
+	return chooseHostInterface(logger, preferIPv4)
+}
+
+func chooseHostInterface(logger klog.Logger, addressFamilies AddressFamilyPreference) (net.IP, error) {
+	var nw networkInterfacer = networkInterface{}
+	if _, err := os.Stat(ipv4RouteFile); os.IsNotExist(err) {
+		return chooseIPFromHostInterfaces(logger, nw, addressFamilies)
+	}
+	routes, err := getAllDefaultRoutes()
+	if err != nil {
+		return nil, err
+	}
+	return chooseHostInterfaceFromRoute(logger, routes, nw, addressFamilies)
+}
+
+// networkInterfacer defines an interface for several net library functions. Production
+// code will forward to net library functions, and unit tests will override the methods
+// for testing purposes.
+type networkInterfacer interface {
+	InterfaceByName(intfName string) (*net.Interface, error)
+	Addrs(intf *net.Interface) ([]net.Addr, error)
+	Interfaces() ([]net.Interface, error)
+}
+
+// networkInterface implements the networkInterfacer interface for production code, just
+// wrapping the underlying net library function calls.
+type networkInterface struct{}
+
+func (_ networkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return net.InterfaceByName(intfName)
+}
+
+func (_ networkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	return intf.Addrs()
+}
+
+func (_ networkInterface) Interfaces() ([]net.Interface, error) {
+	return net.Interfaces()
+}
+
+// getAllDefaultRoutes obtains IPv4 and IPv6 default routes on the node. If unable
+// to read the IPv4 routing info file, we return an error. If unable to read the IPv6
+// routing info file (which is optional), we'll just use the IPv4 route information.
+// Using all the routing info, if no default routes are found, an error is returned.
+func getAllDefaultRoutes() ([]Route, error) {
+	routes, err := v4File.extract()
+	if err != nil {
+		return nil, err
+	}
+	v6Routes, _ := v6File.extract()
+	routes = append(routes, v6Routes...)
+	if len(routes) == 0 {
+		return nil, noRoutesError{
+			message: fmt.Sprintf("no default routes found in %q or %q", v4File.name, v6File.name),
+		}
+	}
+	return routes, nil
+}
+
+// chooseHostInterfaceFromRoute cycles through each default route provided, looking for a
+// global IP address from the interface for the route. If there are routes but no global
+// address is obtained from the interfaces, it checks if the loopback interface has a global address.
+// addressFamilies determines whether it prefers IPv4 or IPv6
+func chooseHostInterfaceFromRoute(logger klog.Logger, routes []Route, nw networkInterfacer, addressFamilies AddressFamilyPreference) (net.IP, error) {
+	for _, family := range addressFamilies {
+		logger.V(4).Info("Looking for default routes with IP addresses", "IPVersion", uint(family))
+		for _, route := range routes {
+			if route.Family != family {
+				continue
+			}
+			logger.V(4).Info("Default route transits interface", "interface", route.Interface)
+			finalIP, err := getIPFromInterface(logger, route.Interface, family, nw)
+			if err != nil {
+				return nil, err
+			}
+			if finalIP != nil {
+				logger.V(4).Info("Found active IP", "IP", finalIP)
+				return finalIP, nil
+			}
+			// In case of network setups where default routes are present, but network
+			// interfaces use only link-local addresses (e.g. as described in RFC5549).
+			// the global IP is assigned to the loopback interface, and we should use it
+			loopbackIP, err := getIPFromLoopbackInterface(logger, family, nw)
+			if err != nil {
+				return nil, err
+			}
+			if loopbackIP != nil {
+				logger.V(4).Info("Found active IP on Loopback interface", "IP", loopbackIP)
+				return loopbackIP, nil
+			}
+		}
+	}
+	logger.V(4).Info("No active IP found by looking at default routes")
+	return nil, fmt.Errorf("unable to select an IP from default routes.")
+}
+
+// ResolveBindAddress returns the IP address of a daemon, based on the given bindAddress:
+// If bindAddress is unset, it returns the host's default IP, as with ChooseHostInterface().
+// If bindAddress is unspecified or loopback, it returns the default IP of the same
+// address family as bindAddress.
+// Otherwise, it just returns bindAddress.
+//
+//logcheck:context // [ResolveBindAddressWithLogger] should be used instead of ResolveBindAddress in code which supports contextual logging.
+func ResolveBindAddress(bindAddress net.IP) (net.IP, error) {
+	return ResolveBindAddressWithLogger(klog.Background(), bindAddress)
+}
+
+// ResolveBindAddressWithLogger returns the IP address of a daemon, based on the given bindAddress:
+// If bindAddress is unset, it returns the host's default IP, as with ChooseHostInterface().
+// If bindAddress is unspecified or loopback, it returns the default IP of the same
+// address family as bindAddress.
+// Otherwise, it just returns bindAddress.
+func ResolveBindAddressWithLogger(logger klog.Logger, bindAddress net.IP) (net.IP, error) {
+	addressFamilies := preferIPv4
+	if bindAddress != nil && memberOf(bindAddress, familyIPv6) {
+		addressFamilies = preferIPv6
+	}
+
+	if bindAddress == nil || bindAddress.IsUnspecified() || bindAddress.IsLoopback() {
+		hostIP, err := chooseHostInterface(logger, addressFamilies)
+		if err != nil {
+			return nil, err
+		}
+		bindAddress = hostIP
+	}
+	return bindAddress, nil
+}
+
+// ChooseBindAddressForInterface choose a global IP for a specific interface, with priority given to IPv4.
+// This is required in case of network setups where default routes are present, but network
+// interfaces use only link-local addresses (e.g. as described in RFC5549).
+// e.g when using BGP to announce a host IP over link-local ip addresses and this ip address is attached to the lo interface.
+//
+//logcheck:context // [ChooseBindAddressForInterfaceWithLogger] should be used instead of ChooseBindAddressForInterface in code which supports contextual logging.
+func ChooseBindAddressForInterface(intfName string) (net.IP, error) {
+	return ChooseBindAddressForInterfaceWithLogger(klog.Background(), intfName)
+}
+
+// ChooseBindAddressForInterfaceWithLogger choose a global IP for a specific interface, with priority given to IPv4.
+// This is required in case of network setups where default routes are present, but network
+// interfaces use only link-local addresses (e.g. as described in RFC5549).
+// e.g when using BGP to announce a host IP over link-local ip addresses and this ip address is attached to the lo interface.
+func ChooseBindAddressForInterfaceWithLogger(logger klog.Logger, intfName string) (net.IP, error) {
+	var nw networkInterfacer = networkInterface{}
+	for _, family := range preferIPv4 {
+		ip, err := getIPFromInterface(logger, intfName, family, nw)
+		if err != nil {
+			return nil, err
+		}
+		if ip != nil {
+			return ip, nil
+		}
+	}
+	return nil, fmt.Errorf("unable to select an IP from %s network interface", intfName)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/net/interface_test.go b/third_party/k8s.io/apimachinery/pkg/util/net/interface_test.go
new file mode 100644
index 0000000000..b791aa1090
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/net/interface_test.go
@@ -0,0 +1,828 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"strings"
+	"testing"
+
+	"k8s.io/klog/v2/ktesting"
+	netutils "k8s.io/utils/net"
+)
+
+const gatewayfirst = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT                                                       
+eth3	00000000	0100FE0A	0003	0	0	1024	00000000	0	0	0                                                                   
+eth3	0000FE0A	00000000	0001	0	0	0	0080FFFF	0	0	0                                                                      
+docker0	000011AC	00000000	0001	0	0	0	0000FFFF	0	0	0                                                                            
+virbr0	007AA8C0	00000000	0001	0	0	0	00FFFFFF	0	0	0
+`
+const gatewaylast = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT  
+docker0	000011AC	00000000	0001	0	0	0	0000FFFF	0	0	0                                                                            
+virbr0	007AA8C0	00000000	0001	0	0	0	00FFFFFF	0	0	0                                                                                                                     
+eth3	0000FE0A	00000000	0001	0	0	0	0080FFFF	0	0	0       
+eth3	00000000	0100FE0A	0003	0	0	1024	00000000	0	0	0                                                                 
+`
+const gatewaymiddle = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT                                                                                                                     
+eth3	0000FE0A	00000000	0001	0	0	0	0080FFFF	0	0	0                                                                      
+docker0	000011AC	00000000	0001	0	0	0	0000FFFF	0	0	0       
+eth3	00000000	0100FE0A	0003	0	0	1024	00000000	0	0	0                                                                         
+virbr0	007AA8C0	00000000	0001	0	0	0	00FFFFFF	0	0	0
+`
+const noInternetConnection = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT                                                       
+docker0	000011AC	00000000	0001	0	0	0	0000FFFF	0	0	0                                                                            
+virbr0	007AA8C0	00000000	0001	0	0	0	00FFFFFF	0	0	0            
+`
+const nothing = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT                                                            
+`
+const badDestination = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT                                                       
+eth3	00000000	0100FE0A	0003	0	0	1024	00000000	0	0	0                                                                   
+eth3	0000FE0AA1	00000000	0001	0	0	0	0080FFFF	0	0	0                                                                      
+docker0	000011AC	00000000	0001	0	0	0	0000FFFF	0	0	0                                                                            
+virbr0	007AA8C0	00000000	0001	0	0	0	00FFFFFF	0	0	0
+`
+const badGateway = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT
+eth3	00000000	0100FE0AA1	0003	0	0	1024	00000000	0	0	0                                                                   
+eth3	0000FE0A	00000000	0001	0	0	0	0080FFFF	0	0	0                                                                      
+docker0	000011AC	00000000	0001	0	0	0	0000FFFF	0	0	0                                                                            
+virbr0	007AA8C0	00000000	0001	0	0	0	00FFFFFF	0	0	0
+`
+const route_Invalidhex = `Iface	Destination	Gateway 	Flags	RefCnt	Use	Metric	Mask		MTU	Window	IRTT
+eth3	00000000	0100FE0AA	0003	0	0	1024	00000000	0	0	0                                                                   
+eth3	0000FE0A	00000000	0001	0	0	0	0080FFFF	0	0	0                                                                      
+docker0	000011AC	00000000	0001	0	0	0	0000FFFF	0	0	0                                                                            
+virbr0	007AA8C0	00000000	0001	0	0	0	00FFFFFF	0	0	0
+`
+
+const v6gatewayfirst = `00000000000000000000000000000000 00 00000000000000000000000000000000 00 20010001000000000000000000000001 00000064 00000000 00000000 00000003 eth3
+20010002000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000100 00000000 00000000 00000001 eth3
+00000000000000000000000000000000 60 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000000 00000000 00200200       lo
+`
+const v6gatewaylast = `20010002000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000100 00000000 00000000 00000001 eth3
+00000000000000000000000000000000 60 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000000 00000000 00200200       lo
+00000000000000000000000000000000 00 00000000000000000000000000000000 00 20010001000000000000000000000001 00000064 00000000 00000000 00000003 eth3
+`
+const v6gatewaymiddle = `20010002000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000100 00000000 00000000 00000001 eth3
+00000000000000000000000000000000 00 00000000000000000000000000000000 00 20010001000000000000000000000001 00000064 00000000 00000000 00000003 eth3
+00000000000000000000000000000000 60 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000000 00000000 00200200       lo
+`
+const v6noDefaultRoutes = `00000000000000000000000000000000 60 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000000 00000000 00200200       lo
+20010001000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000000 00000000 00000001  docker0
+20010002000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000100 00000000 00000000 00000001   eth3
+fe800000000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000100 00000000 00000000 00000001   eth3
+`
+const v6nothing = ``
+const v6badDestination = `2001000200000000 7a 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000000 00000000 00200200       lo
+`
+const v6badGateway = `00000000000000000000000000000000 00 00000000000000000000000000000000 00 200100010000000000000000000000000012 00000064 00000000 00000000 00000003 eth3
+`
+const v6route_Invalidhex = `000000000000000000000000000000000 00 00000000000000000000000000000000 00 fe80000000000000021fcafffea0ec00 00000064 00000000 00000000 00000003 enp1s0f0
+
+`
+
+const (
+	flagUp       = net.FlagUp | net.FlagBroadcast | net.FlagMulticast
+	flagDown     = net.FlagBroadcast | net.FlagMulticast
+	flagLoopback = net.FlagUp | net.FlagLoopback
+	flagP2P      = net.FlagUp | net.FlagPointToPoint
+)
+
+func makeIntf(index int, name string, flags net.Flags) net.Interface {
+	mac := net.HardwareAddr{0, 0x32, 0x7d, 0x69, 0xf7, byte(0x30 + index)}
+	return net.Interface{
+		Index:        index,
+		MTU:          1500,
+		Name:         name,
+		HardwareAddr: mac,
+		Flags:        flags}
+}
+
+var (
+	downIntf     = makeIntf(1, "eth3", flagDown)
+	loopbackIntf = makeIntf(1, "lo", flagLoopback)
+	p2pIntf      = makeIntf(1, "lo", flagP2P)
+	upIntf       = makeIntf(1, "eth3", flagUp)
+)
+
+var (
+	ipv4Route = Route{Interface: "eth3", Destination: netutils.ParseIPSloppy("0.0.0.0"), Gateway: netutils.ParseIPSloppy("10.254.0.1"), Family: familyIPv4}
+	ipv6Route = Route{Interface: "eth3", Destination: netutils.ParseIPSloppy("::"), Gateway: netutils.ParseIPSloppy("2001:1::1"), Family: familyIPv6}
+)
+
+var (
+	noRoutes   = []Route{}
+	routeV4    = []Route{ipv4Route}
+	routeV6    = []Route{ipv6Route}
+	bothRoutes = []Route{ipv4Route, ipv6Route}
+)
+
+func TestGetIPv4Routes(t *testing.T) {
+	testCases := []struct {
+		tcase      string
+		route      string
+		count      int
+		expected   *Route
+		errStrFrag string
+	}{
+		{"gatewayfirst", gatewayfirst, 1, &ipv4Route, ""},
+		{"gatewaymiddle", gatewaymiddle, 1, &ipv4Route, ""},
+		{"gatewaylast", gatewaylast, 1, &ipv4Route, ""},
+		{"no routes", nothing, 0, nil, ""},
+		{"badDestination", badDestination, 0, nil, "invalid IPv4"},
+		{"badGateway", badGateway, 0, nil, "invalid IPv4"},
+		{"route_Invalidhex", route_Invalidhex, 0, nil, "odd length hex string"},
+		{"no default routes", noInternetConnection, 0, nil, ""},
+	}
+	for _, tc := range testCases {
+		r := strings.NewReader(tc.route)
+		routes, err := getIPv4DefaultRoutes(r)
+		if err != nil {
+			if !strings.Contains(err.Error(), tc.errStrFrag) {
+				t.Errorf("case[%s]: Error string %q does not contain %q", tc.tcase, err, tc.errStrFrag)
+			}
+		} else if tc.errStrFrag != "" {
+			t.Errorf("case[%s]: Error %q expected, but not seen", tc.tcase, tc.errStrFrag)
+		} else {
+			if tc.count != len(routes) {
+				t.Errorf("case[%s]: expected %d routes, have %v", tc.tcase, tc.count, routes)
+			} else if tc.count == 1 {
+				if !tc.expected.Gateway.Equal(routes[0].Gateway) {
+					t.Errorf("case[%s]: expected %v, got %v .err : %v", tc.tcase, tc.expected, routes, err)
+				}
+				if !routes[0].Destination.Equal(net.IPv4zero) {
+					t.Errorf("case[%s}: destination is not for default route (not zero)", tc.tcase)
+				}
+
+			}
+		}
+	}
+}
+
+func TestGetIPv6Routes(t *testing.T) {
+	testCases := []struct {
+		tcase      string
+		route      string
+		count      int
+		expected   *Route
+		errStrFrag string
+	}{
+		{"v6 gatewayfirst", v6gatewayfirst, 1, &ipv6Route, ""},
+		{"v6 gatewaymiddle", v6gatewaymiddle, 1, &ipv6Route, ""},
+		{"v6 gatewaylast", v6gatewaylast, 1, &ipv6Route, ""},
+		{"v6 no routes", v6nothing, 0, nil, ""},
+		{"v6 badDestination", v6badDestination, 0, nil, "invalid IPv6"},
+		{"v6 badGateway", v6badGateway, 0, nil, "invalid IPv6"},
+		{"v6 route_Invalidhex", v6route_Invalidhex, 0, nil, "odd length hex string"},
+		{"v6 no default routes", v6noDefaultRoutes, 0, nil, ""},
+	}
+	for _, tc := range testCases {
+		r := strings.NewReader(tc.route)
+		routes, err := getIPv6DefaultRoutes(r)
+		if err != nil {
+			if !strings.Contains(err.Error(), tc.errStrFrag) {
+				t.Errorf("case[%s]: Error string %q does not contain %q", tc.tcase, err, tc.errStrFrag)
+			}
+		} else if tc.errStrFrag != "" {
+			t.Errorf("case[%s]: Error %q expected, but not seen", tc.tcase, tc.errStrFrag)
+		} else {
+			if tc.count != len(routes) {
+				t.Errorf("case[%s]: expected %d routes, have %v", tc.tcase, tc.count, routes)
+			} else if tc.count == 1 {
+				if !tc.expected.Gateway.Equal(routes[0].Gateway) {
+					t.Errorf("case[%s]: expected %v, got %v .err : %v", tc.tcase, tc.expected, routes, err)
+				}
+				if !routes[0].Destination.Equal(net.IPv6zero) {
+					t.Errorf("case[%s}: destination is not for default route (not zero)", tc.tcase)
+				}
+			}
+		}
+	}
+}
+
+func TestParseIP(t *testing.T) {
+	testCases := []struct {
+		tcase    string
+		ip       string
+		family   AddressFamily
+		success  bool
+		expected net.IP
+	}{
+		{"empty", "", familyIPv4, false, nil},
+		{"too short", "AA", familyIPv4, false, nil},
+		{"too long", "0011223344", familyIPv4, false, nil},
+		{"invalid", "invalid!", familyIPv4, false, nil},
+		{"zero", "00000000", familyIPv4, true, net.IP{0, 0, 0, 0}},
+		{"ffff", "FFFFFFFF", familyIPv4, true, net.IP{0xff, 0xff, 0xff, 0xff}},
+		{"valid v4", "12345678", familyIPv4, true, net.IP{120, 86, 52, 18}},
+		{"valid v6", "fe800000000000000000000000000000", familyIPv6, true, net.IP{0xfe, 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}},
+		{"v6 too short", "fe80000000000000021fcafffea0ec0", familyIPv6, false, nil},
+		{"v6 too long", "fe80000000000000021fcafffea0ec002", familyIPv6, false, nil},
+	}
+	for _, tc := range testCases {
+		ip, err := parseIP(tc.ip, tc.family)
+		if !ip.Equal(tc.expected) {
+			t.Errorf("case[%v]: expected %q, got %q . err : %v", tc.tcase, tc.expected, ip, err)
+		}
+	}
+}
+
+func TestIsInterfaceUp(t *testing.T) {
+	logger, _ := ktesting.NewTestContext(t)
+	testCases := []struct {
+		tcase    string
+		intf     *net.Interface
+		expected bool
+	}{
+		{"up", &net.Interface{Index: 0, MTU: 0, Name: "eth3", HardwareAddr: nil, Flags: net.FlagUp}, true},
+		{"down", &net.Interface{Index: 0, MTU: 0, Name: "eth3", HardwareAddr: nil, Flags: 0}, false},
+		{"no interface", nil, false},
+	}
+	for _, tc := range testCases {
+		it := isInterfaceUp(logger, tc.intf)
+		if it != tc.expected {
+			t.Errorf("case[%v]: expected %v, got %v .", tc.tcase, tc.expected, it)
+		}
+	}
+}
+
+type addrStruct struct{ val string }
+
+func (a addrStruct) Network() string {
+	return a.val
+}
+func (a addrStruct) String() string {
+	return a.val
+}
+
+func TestFinalIP(t *testing.T) {
+	logger, _ := ktesting.NewTestContext(t)
+	testCases := []struct {
+		tcase    string
+		addr     []net.Addr
+		family   AddressFamily
+		expected net.IP
+	}{
+		{"no ipv4", []net.Addr{addrStruct{val: "2001::5/64"}}, familyIPv4, nil},
+		{"no ipv6", []net.Addr{addrStruct{val: "10.128.0.4/32"}}, familyIPv6, nil},
+		{"invalidV4CIDR", []net.Addr{addrStruct{val: "10.20.30.40.50/24"}}, familyIPv4, nil},
+		{"invalidV6CIDR", []net.Addr{addrStruct{val: "fe80::2f7:67fff:fe6e:2956/64"}}, familyIPv6, nil},
+		{"loopback", []net.Addr{addrStruct{val: "127.0.0.1/24"}}, familyIPv4, nil},
+		{"loopbackv6", []net.Addr{addrStruct{val: "::1/128"}}, familyIPv6, nil},
+		{"link local v4", []net.Addr{addrStruct{val: "169.254.1.10/16"}}, familyIPv4, nil},
+		{"link local v6", []net.Addr{addrStruct{val: "fe80::2f7:6fff:fe6e:2956/64"}}, familyIPv6, nil},
+		{"ip4", []net.Addr{addrStruct{val: "10.254.12.132/17"}}, familyIPv4, netutils.ParseIPSloppy("10.254.12.132")},
+		{"ip6", []net.Addr{addrStruct{val: "2001::5/64"}}, familyIPv6, netutils.ParseIPSloppy("2001::5")},
+
+		{"no addresses", []net.Addr{}, familyIPv4, nil},
+	}
+	for _, tc := range testCases {
+		ip, err := getMatchingGlobalIP(logger, tc.addr, tc.family)
+		if !ip.Equal(tc.expected) {
+			t.Errorf("case[%v]: expected %v, got %v .err : %v", tc.tcase, tc.expected, ip, err)
+		}
+	}
+}
+
+func TestAddrs(t *testing.T) {
+	var nw networkInterfacer = validNetworkInterface{}
+	intf := net.Interface{Index: 0, MTU: 0, Name: "eth3", HardwareAddr: nil, Flags: 0}
+	addrs, err := nw.Addrs(&intf)
+	if err != nil {
+		t.Errorf("expected no error got : %v", err)
+	}
+	if len(addrs) != 2 {
+		t.Errorf("expected addrs: 2 got null")
+	}
+}
+
+// Has a valid IPv4 address (IPv6 is LLA)
+type validNetworkInterface struct {
+}
+
+func (_ validNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &upIntf, nil
+}
+func (_ validNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{
+		addrStruct{val: "fe80::2f7:6fff:fe6e:2956/64"}, addrStruct{val: "10.254.71.145/17"}}
+	return ifat, nil
+}
+func (_ validNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf}, nil
+}
+
+// Both IPv4 and IPv6 addresses (expecting IPv4 to be used)
+type v4v6NetworkInterface struct {
+}
+
+func (_ v4v6NetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &upIntf, nil
+}
+func (_ v4v6NetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{
+		addrStruct{val: "2001::10/64"}, addrStruct{val: "10.254.71.145/17"}}
+	return ifat, nil
+}
+func (_ v4v6NetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf}, nil
+}
+
+// Interface with only IPv6 address
+type ipv6NetworkInterface struct {
+}
+
+func (_ ipv6NetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &upIntf, nil
+}
+func (_ ipv6NetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{addrStruct{val: "2001::200/64"}}
+	return ifat, nil
+}
+
+func (_ ipv6NetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf}, nil
+}
+
+// Only with link local addresses
+type networkInterfaceWithOnlyLinkLocals struct {
+}
+
+func (_ networkInterfaceWithOnlyLinkLocals) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &upIntf, nil
+}
+func (_ networkInterfaceWithOnlyLinkLocals) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{addrStruct{val: "169.254.162.166/16"}, addrStruct{val: "fe80::200/10"}}
+	return ifat, nil
+}
+func (_ networkInterfaceWithOnlyLinkLocals) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf}, nil
+}
+
+// Unable to get interface(s)
+type failGettingNetworkInterface struct {
+}
+
+func (_ failGettingNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return nil, fmt.Errorf("unable get Interface")
+}
+func (_ failGettingNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	return nil, nil
+}
+func (_ failGettingNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return nil, fmt.Errorf("mock failed getting all interfaces")
+}
+
+// No interfaces
+type noNetworkInterface struct {
+}
+
+func (_ noNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return nil, fmt.Errorf("no such network interface")
+}
+func (_ noNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	return nil, nil
+}
+func (_ noNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{}, nil
+}
+
+// Interface is down
+type downNetworkInterface struct {
+}
+
+func (_ downNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &downIntf, nil
+}
+func (_ downNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{
+		addrStruct{val: "fe80::2f7:6fff:fe6e:2956/64"}, addrStruct{val: "10.254.71.145/17"}}
+	return ifat, nil
+}
+func (_ downNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{downIntf}, nil
+}
+
+// Loopback interface
+type loopbackNetworkInterface struct {
+}
+
+func (_ loopbackNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &loopbackIntf, nil
+}
+func (_ loopbackNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{
+		addrStruct{val: "::1/128"}, addrStruct{val: "127.0.0.1/8"}}
+	return ifat, nil
+}
+func (_ loopbackNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{loopbackIntf}, nil
+}
+
+// Point to point interface
+type p2pNetworkInterface struct {
+}
+
+func (_ p2pNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &p2pIntf, nil
+}
+func (_ p2pNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{
+		addrStruct{val: "::1/128"}, addrStruct{val: "127.0.0.1/8"}}
+	return ifat, nil
+}
+func (_ p2pNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{p2pIntf}, nil
+}
+
+// Interface with link locals and loopback interface with global addresses
+type linkLocalLoopbackNetworkInterface struct {
+}
+
+func (_ linkLocalLoopbackNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	if intfName == LoopbackInterfaceName {
+		return &loopbackIntf, nil
+	}
+	return &upIntf, nil
+}
+func (_ linkLocalLoopbackNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{addrStruct{val: "169.254.162.166/16"}, addrStruct{val: "fe80::200/10"}}
+	if intf.Name == LoopbackInterfaceName {
+		ifat = []net.Addr{addrStruct{val: "::1/128"}, addrStruct{val: "127.0.0.1/8"},
+			// global addresses on loopback interface
+			addrStruct{val: "10.1.1.1/32"}, addrStruct{val: "fd00:1:1::1/128"}}
+	}
+	return ifat, nil
+}
+func (_ linkLocalLoopbackNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf, loopbackIntf}, nil
+}
+
+// Interface and loopback interface with global addresses
+type globalsNetworkInterface struct {
+}
+
+func (_ globalsNetworkInterface) InterfaceByName(intfName string) (*net.Interface, error) {
+	if intfName == LoopbackInterfaceName {
+		return &loopbackIntf, nil
+	}
+	return &upIntf, nil
+}
+func (_ globalsNetworkInterface) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{addrStruct{val: "169.254.162.166/16"}, addrStruct{val: "fe80::200/10"},
+		addrStruct{val: "192.168.1.1/31"}, addrStruct{val: "fd00::200/127"}}
+	if intf.Name == LoopbackInterfaceName {
+		ifat = []net.Addr{addrStruct{val: "::1/128"}, addrStruct{val: "127.0.0.1/8"},
+			// global addresses on loopback interface
+			addrStruct{val: "10.1.1.1/32"}, addrStruct{val: "fd00:1:1::1/128"}}
+	}
+	return ifat, nil
+}
+func (_ globalsNetworkInterface) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf, loopbackIntf}, nil
+}
+
+// Unable to get IP addresses for interface
+type networkInterfaceFailGetAddrs struct {
+}
+
+func (_ networkInterfaceFailGetAddrs) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &upIntf, nil
+}
+func (_ networkInterfaceFailGetAddrs) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	return nil, fmt.Errorf("unable to get Addrs")
+}
+func (_ networkInterfaceFailGetAddrs) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf}, nil
+}
+
+// No addresses for interface
+type networkInterfaceWithNoAddrs struct {
+}
+
+func (_ networkInterfaceWithNoAddrs) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &upIntf, nil
+}
+func (_ networkInterfaceWithNoAddrs) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	ifat := []net.Addr{}
+	return ifat, nil
+}
+func (_ networkInterfaceWithNoAddrs) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf}, nil
+}
+
+// Invalid addresses for interface
+type networkInterfaceWithInvalidAddr struct {
+}
+
+func (_ networkInterfaceWithInvalidAddr) InterfaceByName(intfName string) (*net.Interface, error) {
+	return &upIntf, nil
+}
+func (_ networkInterfaceWithInvalidAddr) Addrs(intf *net.Interface) ([]net.Addr, error) {
+	var ifat []net.Addr
+	ifat = []net.Addr{addrStruct{val: "10.20.30.40.50/24"}}
+	return ifat, nil
+}
+func (_ networkInterfaceWithInvalidAddr) Interfaces() ([]net.Interface, error) {
+	return []net.Interface{upIntf}, nil
+}
+
+func TestGetIPFromInterface(t *testing.T) {
+	logger, _ := ktesting.NewTestContext(t)
+	testCases := []struct {
+		tcase      string
+		nwname     string
+		family     AddressFamily
+		nw         networkInterfacer
+		expected   net.IP
+		errStrFrag string
+	}{
+		{"ipv4", "eth3", familyIPv4, validNetworkInterface{}, netutils.ParseIPSloppy("10.254.71.145"), ""},
+		{"ipv6", "eth3", familyIPv6, ipv6NetworkInterface{}, netutils.ParseIPSloppy("2001::200"), ""},
+		{"no ipv4", "eth3", familyIPv4, ipv6NetworkInterface{}, nil, ""},
+		{"no ipv6", "eth3", familyIPv6, validNetworkInterface{}, nil, ""},
+		{"I/F down", "eth3", familyIPv4, downNetworkInterface{}, nil, ""},
+		{"I/F get fail", "eth3", familyIPv4, noNetworkInterface{}, nil, "no such network interface"},
+		{"fail get addr", "eth3", familyIPv4, networkInterfaceFailGetAddrs{}, nil, "unable to get Addrs"},
+		{"bad addr", "eth3", familyIPv4, networkInterfaceWithInvalidAddr{}, nil, "invalid CIDR"},
+	}
+	for _, tc := range testCases {
+		ip, err := getIPFromInterface(logger, tc.nwname, tc.family, tc.nw)
+		if err != nil {
+			if !strings.Contains(err.Error(), tc.errStrFrag) {
+				t.Errorf("case[%s]: Error string %q does not contain %q", tc.tcase, err, tc.errStrFrag)
+			}
+		} else if tc.errStrFrag != "" {
+			t.Errorf("case[%s]: Error %q expected, but not seen", tc.tcase, tc.errStrFrag)
+		} else if !ip.Equal(tc.expected) {
+			t.Errorf("case[%v]: expected %v, got %+v .err : %v", tc.tcase, tc.expected, ip, err)
+		}
+	}
+}
+
+func TestGetIPFromLoopbackInterface(t *testing.T) {
+	logger, _ := ktesting.NewTestContext(t)
+	testCases := []struct {
+		tcase      string
+		family     AddressFamily
+		nw         networkInterfacer
+		expected   net.IP
+		errStrFrag string
+	}{
+		{"ipv4", familyIPv4, linkLocalLoopbackNetworkInterface{}, netutils.ParseIPSloppy("10.1.1.1"), ""},
+		{"ipv6", familyIPv6, linkLocalLoopbackNetworkInterface{}, netutils.ParseIPSloppy("fd00:1:1::1"), ""},
+		{"no global ipv4", familyIPv4, loopbackNetworkInterface{}, nil, ""},
+		{"no global ipv6", familyIPv6, loopbackNetworkInterface{}, nil, ""},
+	}
+	for _, tc := range testCases {
+		ip, err := getIPFromLoopbackInterface(logger, tc.family, tc.nw)
+		if err != nil {
+			if !strings.Contains(err.Error(), tc.errStrFrag) {
+				t.Errorf("case[%s]: Error string %q does not contain %q", tc.tcase, err, tc.errStrFrag)
+			}
+		} else if tc.errStrFrag != "" {
+			t.Errorf("case[%s]: Error %q expected, but seen %v", tc.tcase, tc.errStrFrag, err)
+		} else if !ip.Equal(tc.expected) {
+			t.Errorf("case[%v]: expected %v, got %+v .err : %v", tc.tcase, tc.expected, ip, err)
+		}
+	}
+}
+
+func TestChooseHostInterfaceFromRoute(t *testing.T) {
+	logger, _ := ktesting.NewTestContext(t)
+	testCases := []struct {
+		tcase    string
+		routes   []Route
+		nw       networkInterfacer
+		order    AddressFamilyPreference
+		expected net.IP
+	}{
+		{"single-stack ipv4", routeV4, validNetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("10.254.71.145")},
+		{"single-stack ipv4, prefer v6", routeV4, validNetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("10.254.71.145")},
+		{"single-stack ipv6", routeV6, ipv6NetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("2001::200")},
+		{"single-stack ipv6, prefer v6", routeV6, ipv6NetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("2001::200")},
+		{"dual stack", bothRoutes, v4v6NetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("10.254.71.145")},
+		{"dual stack, prefer v6", bothRoutes, v4v6NetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("2001::10")},
+		{"LLA and loopback with global, IPv4", routeV4, linkLocalLoopbackNetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("10.1.1.1")},
+		{"LLA and loopback with global, IPv6", routeV6, linkLocalLoopbackNetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("fd00:1:1::1")},
+		{"LLA and loopback with global, dual stack prefer IPv4", bothRoutes, linkLocalLoopbackNetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("10.1.1.1")},
+		{"LLA and loopback with global, dual stack prefer IPv6", bothRoutes, linkLocalLoopbackNetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("fd00:1:1::1")},
+		{"LLA and loopback with global, no routes", noRoutes, linkLocalLoopbackNetworkInterface{}, preferIPv6, nil},
+		{"interface and loopback with global, IPv4", routeV4, globalsNetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("192.168.1.1")},
+		{"interface and loopback with global, IPv6", routeV6, globalsNetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("fd00::200")},
+		{"interface and loopback with global, dual stack prefer IPv4", bothRoutes, globalsNetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("192.168.1.1")},
+		{"interface and loopback with global, dual stack prefer IPv6", bothRoutes, globalsNetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("fd00::200")},
+		{"interface and loopback with global, no routes", noRoutes, globalsNetworkInterface{}, preferIPv6, nil},
+		{"all LLA", routeV4, networkInterfaceWithOnlyLinkLocals{}, preferIPv4, nil},
+		{"no routes", noRoutes, validNetworkInterface{}, preferIPv4, nil},
+		{"fail get IP", routeV4, networkInterfaceFailGetAddrs{}, preferIPv4, nil},
+	}
+	for _, tc := range testCases {
+		ip, err := chooseHostInterfaceFromRoute(logger, tc.routes, tc.nw, tc.order)
+		if !ip.Equal(tc.expected) {
+			t.Errorf("case[%v]: expected %v, got %+v .err : %v", tc.tcase, tc.expected, ip, err)
+		}
+	}
+}
+
+func TestMemberOf(t *testing.T) {
+	testCases := []struct {
+		tcase    string
+		ip       net.IP
+		family   AddressFamily
+		expected bool
+	}{
+		{"ipv4 is 4", netutils.ParseIPSloppy("10.20.30.40"), familyIPv4, true},
+		{"ipv4 is 6", netutils.ParseIPSloppy("10.10.10.10"), familyIPv6, false},
+		{"ipv6 is 4", netutils.ParseIPSloppy("2001::100"), familyIPv4, false},
+		{"ipv6 is 6", netutils.ParseIPSloppy("2001::100"), familyIPv6, true},
+	}
+	for _, tc := range testCases {
+		if memberOf(tc.ip, tc.family) != tc.expected {
+			t.Errorf("case[%s]: expected %+v", tc.tcase, tc.expected)
+		}
+	}
+}
+
+func TestGetIPFromHostInterfaces(t *testing.T) {
+	logger, _ := ktesting.NewTestContext(t)
+	testCases := []struct {
+		tcase      string
+		nw         networkInterfacer
+		order      AddressFamilyPreference
+		expected   net.IP
+		errStrFrag string
+	}{
+		{"fail get I/Fs", failGettingNetworkInterface{}, preferIPv4, nil, "failed getting all interfaces"},
+		{"no interfaces", noNetworkInterface{}, preferIPv4, nil, "no interfaces"},
+		{"I/F not up", downNetworkInterface{}, preferIPv4, nil, "no acceptable"},
+		{"loopback only", loopbackNetworkInterface{}, preferIPv4, nil, "no acceptable"},
+		{"P2P I/F only", p2pNetworkInterface{}, preferIPv4, nil, "no acceptable"},
+		{"fail get addrs", networkInterfaceFailGetAddrs{}, preferIPv4, nil, "unable to get Addrs"},
+		{"no addresses", networkInterfaceWithNoAddrs{}, preferIPv4, nil, "no acceptable"},
+		{"invalid addr", networkInterfaceWithInvalidAddr{}, preferIPv4, nil, "invalid CIDR"},
+		{"no matches", networkInterfaceWithOnlyLinkLocals{}, preferIPv4, nil, "no acceptable"},
+		{"single-stack ipv4", validNetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("10.254.71.145"), ""},
+		{"single-stack ipv4, prefer ipv6", validNetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("10.254.71.145"), ""},
+		{"single-stack ipv6", ipv6NetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("2001::200"), ""},
+		{"single-stack ipv6, prefer ipv6", ipv6NetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("2001::200"), ""},
+		{"dual stack", v4v6NetworkInterface{}, preferIPv4, netutils.ParseIPSloppy("10.254.71.145"), ""},
+		{"dual stack, prefer ipv6", v4v6NetworkInterface{}, preferIPv6, netutils.ParseIPSloppy("2001::10"), ""},
+	}
+
+	for _, tc := range testCases {
+		ip, err := chooseIPFromHostInterfaces(logger, tc.nw, tc.order)
+		if !ip.Equal(tc.expected) {
+			t.Errorf("case[%s]: expected %+v, got %+v with err : %v", tc.tcase, tc.expected, ip, err)
+		}
+		if err != nil && !strings.Contains(err.Error(), tc.errStrFrag) {
+			t.Errorf("case[%s]: unable to find %q in error string %q", tc.tcase, tc.errStrFrag, err.Error())
+		}
+	}
+}
+
+func makeRouteFile(content string, t *testing.T) (*os.File, error) {
+	routeFile, err := os.CreateTemp("", "route")
+	if err != nil {
+		return nil, err
+	}
+
+	if _, err := routeFile.Write([]byte(content)); err != nil {
+		return routeFile, err
+	}
+	err = routeFile.Close()
+	return routeFile, err
+}
+
+func TestFailGettingIPv4Routes(t *testing.T) {
+	defer func() { v4File.name = ipv4RouteFile }()
+
+	// Try failure to open file (should not occur, as caller ensures we have IPv4 route file, but being thorough)
+	v4File.name = "no-such-file"
+	errStrFrag := "no such file"
+	_, err := v4File.extract()
+	if err == nil {
+		t.Errorf("Expected error trying to read non-existent v4 route file")
+	}
+	if !strings.Contains(err.Error(), errStrFrag) {
+		t.Errorf("Unable to find %q in error string %q", errStrFrag, err.Error())
+	}
+}
+
+func TestFailGettingIPv6Routes(t *testing.T) {
+	defer func() { v6File.name = ipv6RouteFile }()
+
+	// Try failure to open file (this would be ignored by caller)
+	v6File.name = "no-such-file"
+	errStrFrag := "no such file"
+	_, err := v6File.extract()
+	if err == nil {
+		t.Errorf("Expected error trying to read non-existent v6 route file")
+	}
+	if !strings.Contains(err.Error(), errStrFrag) {
+		t.Errorf("Unable to find %q in error string %q", errStrFrag, err.Error())
+	}
+}
+
+func TestGetAllDefaultRoutesFailNoV4RouteFile(t *testing.T) {
+	defer func() { v4File.name = ipv4RouteFile }()
+
+	// Should not occur, as caller ensures we have IPv4 route file, but being thorough
+	v4File.name = "no-such-file"
+	errStrFrag := "no such file"
+	_, err := getAllDefaultRoutes()
+	if err == nil {
+		t.Errorf("Expected error trying to read non-existent v4 route file")
+	}
+	if !strings.Contains(err.Error(), errStrFrag) {
+		t.Errorf("Unable to find %q in error string %q", errStrFrag, err.Error())
+	}
+}
+
+func TestGetAllDefaultRoutes(t *testing.T) {
+	testCases := []struct {
+		tcase      string
+		v4Info     string
+		v6Info     string
+		count      int
+		expected   []Route
+		errStrFrag string
+	}{
+		{"no routes", noInternetConnection, v6noDefaultRoutes, 0, nil, "no default routes"},
+		{"only v4 route", gatewayfirst, v6noDefaultRoutes, 1, routeV4, ""},
+		{"only v6 route", noInternetConnection, v6gatewayfirst, 1, routeV6, ""},
+		{"v4 and v6 routes", gatewayfirst, v6gatewayfirst, 2, bothRoutes, ""},
+	}
+	defer func() {
+		v4File.name = ipv4RouteFile
+		v6File.name = ipv6RouteFile
+	}()
+
+	for _, tc := range testCases {
+		routeFile, err := makeRouteFile(tc.v4Info, t)
+		if routeFile != nil {
+			defer os.Remove(routeFile.Name())
+		}
+		if err != nil {
+			t.Errorf("case[%s]: test setup failure for IPv4 route file: %v", tc.tcase, err)
+		}
+		v4File.name = routeFile.Name()
+		v6routeFile, err := makeRouteFile(tc.v6Info, t)
+		if v6routeFile != nil {
+			defer os.Remove(v6routeFile.Name())
+		}
+		if err != nil {
+			t.Errorf("case[%s]: test setup failure for IPv6 route file: %v", tc.tcase, err)
+		}
+		v6File.name = v6routeFile.Name()
+
+		routes, err := getAllDefaultRoutes()
+		if err != nil {
+			if !strings.Contains(err.Error(), tc.errStrFrag) {
+				t.Errorf("case[%s]: Error string %q does not contain %q", tc.tcase, err, tc.errStrFrag)
+			}
+		} else if tc.errStrFrag != "" {
+			t.Errorf("case[%s]: Error %q expected, but not seen", tc.tcase, tc.errStrFrag)
+		} else {
+			if tc.count != len(routes) {
+				t.Errorf("case[%s]: expected %d routes, have %v", tc.tcase, tc.count, routes)
+			}
+			for i, expected := range tc.expected {
+				if !expected.Gateway.Equal(routes[i].Gateway) {
+					t.Errorf("case[%s]: at %d expected %v, got %v .err : %v", tc.tcase, i, tc.expected, routes, err)
+				}
+				zeroIP := net.IPv4zero
+				if expected.Family == familyIPv6 {
+					zeroIP = net.IPv6zero
+				}
+				if !routes[i].Destination.Equal(zeroIP) {
+					t.Errorf("case[%s}: at %d destination is not for default route (not %v)", tc.tcase, i, zeroIP)
+				}
+			}
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/net/port_range.go b/third_party/k8s.io/apimachinery/pkg/util/net/port_range.go
new file mode 100644
index 0000000000..42ecffcca0
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/net/port_range.go
@@ -0,0 +1,149 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+// PortRange represents a range of TCP/UDP ports.  To represent a single port,
+// set Size to 1.
+type PortRange struct {
+	Base int
+	Size int
+}
+
+// Contains tests whether a given port falls within the PortRange.
+func (pr *PortRange) Contains(p int) bool {
+	return (p >= pr.Base) && ((p - pr.Base) < pr.Size)
+}
+
+// String converts the PortRange to a string representation, which can be
+// parsed by PortRange.Set or ParsePortRange.
+func (pr PortRange) String() string {
+	if pr.Size == 0 {
+		return ""
+	}
+	return fmt.Sprintf("%d-%d", pr.Base, pr.Base+pr.Size-1)
+}
+
+// Set parses a string of the form "value", "min-max", or "min+offset", inclusive at both ends, and
+// sets the PortRange from it.  This is part of the flag.Value and pflag.Value
+// interfaces.
+func (pr *PortRange) Set(value string) error {
+	const (
+		SinglePortNotation = 1 << iota
+		HyphenNotation
+		PlusNotation
+	)
+
+	value = strings.TrimSpace(value)
+	hyphenIndex := strings.Index(value, "-")
+	plusIndex := strings.Index(value, "+")
+
+	if value == "" {
+		pr.Base = 0
+		pr.Size = 0
+		return nil
+	}
+
+	var err error
+	var low, high int
+	var notation int
+
+	if plusIndex == -1 && hyphenIndex == -1 {
+		notation |= SinglePortNotation
+	}
+	if hyphenIndex != -1 {
+		notation |= HyphenNotation
+	}
+	if plusIndex != -1 {
+		notation |= PlusNotation
+	}
+
+	switch notation {
+	case SinglePortNotation:
+		var port int
+		port, err = strconv.Atoi(value)
+		if err != nil {
+			return err
+		}
+		low = port
+		high = port
+	case HyphenNotation:
+		low, err = strconv.Atoi(value[:hyphenIndex])
+		if err != nil {
+			return err
+		}
+		high, err = strconv.Atoi(value[hyphenIndex+1:])
+		if err != nil {
+			return err
+		}
+	case PlusNotation:
+		var offset int
+		low, err = strconv.Atoi(value[:plusIndex])
+		if err != nil {
+			return err
+		}
+		offset, err = strconv.Atoi(value[plusIndex+1:])
+		if err != nil {
+			return err
+		}
+		high = low + offset
+	default:
+		return fmt.Errorf("unable to parse port range: %s", value)
+	}
+
+	if low > 65535 || high > 65535 {
+		return fmt.Errorf("the port range cannot be greater than 65535: %s", value)
+	}
+
+	if high < low {
+		return fmt.Errorf("end port cannot be less than start port: %s", value)
+	}
+
+	pr.Base = low
+	pr.Size = 1 + high - low
+	return nil
+}
+
+// Type returns a descriptive string about this type.  This is part of the
+// pflag.Value interface.
+func (*PortRange) Type() string {
+	return "portRange"
+}
+
+// ParsePortRange parses a string of the form "min-max", inclusive at both
+// ends, and initializes a new PortRange from it.
+func ParsePortRange(value string) (*PortRange, error) {
+	pr := &PortRange{}
+	err := pr.Set(value)
+	if err != nil {
+		return nil, err
+	}
+	return pr, nil
+}
+
+func ParsePortRangeOrDie(value string) *PortRange {
+	pr, err := ParsePortRange(value)
+	if err != nil {
+		panic(fmt.Sprintf("couldn't parse port range %q: %v", value, err))
+	}
+	return pr
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/net/port_range_test.go b/third_party/k8s.io/apimachinery/pkg/util/net/port_range_test.go
new file mode 100644
index 0000000000..94a1b7f881
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/net/port_range_test.go
@@ -0,0 +1,77 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"testing"
+
+	flag "github.com/spf13/pflag"
+)
+
+func TestPortRange(t *testing.T) {
+	testCases := []struct {
+		input    string
+		success  bool
+		expected string
+		included int
+		excluded int
+	}{
+		{"100-200", true, "100-200", 200, 201},
+		{" 100-200 ", true, "100-200", 200, 201},
+		{"0-0", true, "0-0", 0, 1},
+		{"", true, "", -1, 0},
+		{"100", true, "100-100", 100, 101},
+		{"100 - 200", false, "", -1, -1},
+		{"-100", false, "", -1, -1},
+		{"100-", false, "", -1, -1},
+		{"200-100", false, "", -1, -1},
+		{"60000-70000", false, "", -1, -1},
+		{"70000-80000", false, "", -1, -1},
+		{"70000+80000", false, "", -1, -1},
+		{"1+0", true, "1-1", 1, 2},
+		{"0+0", true, "0-0", 0, 1},
+		{"1+-1", false, "", -1, -1},
+		{"1-+1", false, "", -1, -1},
+		{"100+200", true, "100-300", 300, 301},
+		{"1+65535", false, "", -1, -1},
+		{"0+65535", true, "0-65535", 65535, 65536},
+	}
+
+	for i := range testCases {
+		tc := &testCases[i]
+		pr := &PortRange{}
+		var f flag.Value = pr
+		err := f.Set(tc.input)
+		if err != nil && tc.success {
+			t.Errorf("expected success, got %q", err)
+			continue
+		} else if err == nil && !tc.success {
+			t.Errorf("expected failure %#v", testCases[i])
+			continue
+		} else if tc.success {
+			if f.String() != tc.expected {
+				t.Errorf("expected %q, got %q", tc.expected, f.String())
+			}
+			if tc.included >= 0 && !pr.Contains(tc.included) {
+				t.Errorf("expected %q to include %d", f.String(), tc.included)
+			}
+			if tc.excluded >= 0 && pr.Contains(tc.excluded) {
+				t.Errorf("expected %q to exclude %d", f.String(), tc.excluded)
+			}
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/net/port_split.go b/third_party/k8s.io/apimachinery/pkg/util/net/port_split.go
new file mode 100644
index 0000000000..f54bb1e71c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/net/port_split.go
@@ -0,0 +1,78 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+var validSchemes = sets.NewString("http", "https", "")
+
+// SplitSchemeNamePort takes a string of the following forms:
+//   - "<name>",                 returns "",        "<name>","",      true
+//   - "<name>:<port>",          returns "",        "<name>","<port>",true
+//   - "<scheme>:<name>:<port>", returns "<scheme>","<name>","<port>",true
+//
+// Name must be non-empty or valid will be returned false.
+// Scheme must be "http" or "https" if specified
+// Port is returned as a string, and it is not required to be numeric (could be
+// used for a named port, for example).
+func SplitSchemeNamePort(id string) (scheme, name, port string, valid bool) {
+	parts := strings.Split(id, ":")
+	switch len(parts) {
+	case 1:
+		name = parts[0]
+	case 2:
+		name = parts[0]
+		port = parts[1]
+	case 3:
+		scheme = parts[0]
+		name = parts[1]
+		port = parts[2]
+	default:
+		return "", "", "", false
+	}
+
+	if len(name) > 0 && validSchemes.Has(scheme) {
+		return scheme, name, port, true
+	} else {
+		return "", "", "", false
+	}
+}
+
+// JoinSchemeNamePort returns a string that specifies the scheme, name, and port:
+//   - "<name>"
+//   - "<name>:<port>"
+//   - "<scheme>:<name>:<port>"
+//
+// None of the parameters may contain a ':' character
+// Name is required
+// Scheme must be "", "http", or "https"
+func JoinSchemeNamePort(scheme, name, port string) string {
+	if len(scheme) > 0 {
+		// Must include three segments to specify scheme
+		return scheme + ":" + name + ":" + port
+	}
+	if len(port) > 0 {
+		// Must include two segments to specify port
+		return name + ":" + port
+	}
+	// Return name alone
+	return name
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/net/port_split_test.go b/third_party/k8s.io/apimachinery/pkg/util/net/port_split_test.go
new file mode 100644
index 0000000000..e801bdbea0
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/net/port_split_test.go
@@ -0,0 +1,121 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"testing"
+)
+
+func TestSplitSchemeNamePort(t *testing.T) {
+	table := []struct {
+		in                 string
+		name, port, scheme string
+		valid              bool
+		normalized         bool
+	}{
+		{
+			in:         "aoeu:asdf",
+			name:       "aoeu",
+			port:       "asdf",
+			valid:      true,
+			normalized: true,
+		}, {
+			in:         "http:aoeu:asdf",
+			scheme:     "http",
+			name:       "aoeu",
+			port:       "asdf",
+			valid:      true,
+			normalized: true,
+		}, {
+			in:         "https:aoeu:",
+			scheme:     "https",
+			name:       "aoeu",
+			port:       "",
+			valid:      true,
+			normalized: false,
+		}, {
+			in:         "https:aoeu:asdf",
+			scheme:     "https",
+			name:       "aoeu",
+			port:       "asdf",
+			valid:      true,
+			normalized: true,
+		}, {
+			in:         "aoeu:",
+			name:       "aoeu",
+			valid:      true,
+			normalized: false,
+		}, {
+			in:         "aoeu",
+			name:       "aoeu",
+			valid:      true,
+			normalized: true,
+		}, {
+			in:    ":asdf",
+			valid: false,
+		}, {
+			in:    "aoeu:asdf:htns",
+			valid: false,
+		}, {
+			in:    "http::asdf",
+			valid: false,
+		}, {
+			in:    "http::",
+			valid: false,
+		}, {
+			in:    "",
+			valid: false,
+		},
+	}
+
+	for _, item := range table {
+		scheme, name, port, valid := SplitSchemeNamePort(item.in)
+		if e, a := item.scheme, scheme; e != a {
+			t.Errorf("%q: Wanted %q, got %q", item.in, e, a)
+		}
+		if e, a := item.name, name; e != a {
+			t.Errorf("%q: Wanted %q, got %q", item.in, e, a)
+		}
+		if e, a := item.port, port; e != a {
+			t.Errorf("%q: Wanted %q, got %q", item.in, e, a)
+		}
+		if e, a := item.valid, valid; e != a {
+			t.Errorf("%q: Wanted %t, got %t", item.in, e, a)
+		}
+
+		// Make sure valid items round trip through JoinSchemeNamePort
+		if item.valid {
+			out := JoinSchemeNamePort(scheme, name, port)
+			if item.normalized && out != item.in {
+				t.Errorf("%q: Wanted %s, got %s", item.in, item.in, out)
+			}
+			scheme, name, port, valid := SplitSchemeNamePort(out)
+			if e, a := item.scheme, scheme; e != a {
+				t.Errorf("%q: Wanted %q, got %q", item.in, e, a)
+			}
+			if e, a := item.name, name; e != a {
+				t.Errorf("%q: Wanted %q, got %q", item.in, e, a)
+			}
+			if e, a := item.port, port; e != a {
+				t.Errorf("%q: Wanted %q, got %q", item.in, e, a)
+			}
+			if e, a := item.valid, valid; e != a {
+				t.Errorf("%q: Wanted %t, got %t", item.in, e, a)
+			}
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/net/testing/http.go b/third_party/k8s.io/apimachinery/pkg/util/net/testing/http.go
new file mode 100644
index 0000000000..439bb38140
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/net/testing/http.go
@@ -0,0 +1,139 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package nettesting contains utilities for testing networking functionality.
+// Don't use these utilities in production code. They have not been security
+// reviewed.
+package nettesting
+
+import (
+	"io"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"sync"
+	"testing"
+)
+
+// NewHTTPProxyHandler returns a new HTTPProxyHandler. It accepts an optional
+// hook which is called early in the handler to export request state. If the
+// hook returns false, the handler returns immediately with a server error.
+// Ensure that this is only used in tests. This code has not been security
+// reviewed.
+func NewHTTPProxyHandler(t testing.TB, hook func(req *http.Request) bool) *HTTPProxyHandler {
+	h := &HTTPProxyHandler{
+		hook: hook,
+		httpProxy: httputil.ReverseProxy{
+			Director: func(req *http.Request) {
+				req.URL.Scheme = "http"
+				req.URL.Host = req.Host
+			},
+		},
+		t: t,
+	}
+	return h
+}
+
+// HTTPProxyHandler implements a simple handler for http_proxy and https_proxy
+// requests for use in testing.
+type HTTPProxyHandler struct {
+	handlerDone sync.WaitGroup
+	hook        func(r *http.Request) bool
+	// httpProxy is the reverse proxy we use for standard http proxy requests.
+	httpProxy httputil.ReverseProxy
+	t         testing.TB
+}
+
+// ServeHTTP handles an HTTP proxy request.
+func (h *HTTPProxyHandler) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+	h.handlerDone.Add(1)
+	defer h.handlerDone.Done()
+
+	if h.hook != nil {
+		if ok := h.hook(req); !ok {
+			rw.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+	}
+
+	b, err := httputil.DumpRequest(req, false)
+	if err != nil {
+		h.t.Logf("Failed to dump request, host=%s: %v", req.Host, err)
+	} else {
+		h.t.Logf("Proxy Request: %s", string(b))
+	}
+
+	if req.Method != http.MethodConnect {
+		h.httpProxy.ServeHTTP(rw, req)
+		return
+	}
+
+	// CONNECT proxy
+
+	sconn, err := net.Dial("tcp", req.Host)
+	if err != nil {
+		h.t.Logf("Failed to dial proxy backend, host=%s: %v", req.Host, err)
+		rw.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+	defer sconn.Close()
+
+	hj, ok := rw.(http.Hijacker)
+	if !ok {
+		h.t.Logf("Can't switch protocols using non-Hijacker ResponseWriter: type=%T, host=%s", rw, req.Host)
+		rw.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	rw.WriteHeader(http.StatusOK)
+
+	conn, brw, err := hj.Hijack()
+	if err != nil {
+		h.t.Logf("Failed to hijack client connection, host=%s: %v", req.Host, err)
+		return
+	}
+	defer conn.Close()
+
+	if err := brw.Flush(); err != nil {
+		h.t.Logf("Failed to flush pending writes to client, host=%s: %v", req.Host, err)
+		return
+	}
+	if _, err := io.Copy(sconn, io.LimitReader(brw, int64(brw.Reader.Buffered()))); err != nil {
+		h.t.Logf("Failed to flush buffered reads to server, host=%s: %v", req.Host, err)
+		return
+	}
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+
+	go func() {
+		defer wg.Done()
+		defer h.t.Logf("Server read close, host=%s", req.Host)
+		io.Copy(conn, sconn)
+	}()
+	go func() {
+		defer wg.Done()
+		defer h.t.Logf("Server write close, host=%s", req.Host)
+		io.Copy(sconn, conn)
+	}()
+
+	wg.Wait()
+	h.t.Logf("Done handling CONNECT request, host=%s", req.Host)
+}
+
+func (h *HTTPProxyHandler) Wait() {
+	h.handlerDone.Wait()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/net/testing/socket.go b/third_party/k8s.io/apimachinery/pkg/util/net/testing/socket.go
new file mode 100644
index 0000000000..4bf868aac8
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/net/testing/socket.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package nettesting contains utilities for testing networking functionality.
+// Don't use these utilities in production code. They have not been security
+// reviewed.
+package nettesting
+
+import (
+	"os"
+	goruntime "runtime"
+	"testing"
+)
+
+// MakeSocketNameForTest returns a socket name to use for the duration of a test.
+// On Operating systems that support abstract sockets, it the name is prefixed with `@` to make it an abstract socket.
+// On Operating systems that do not support abstract sockets, the name is treated as a filename and a cleanup hook is
+// registered to delete the socket at the end of the test.
+func MakeSocketNameForTest(t testing.TB, name string) string {
+	var sockname = name
+	switch goruntime.GOOS {
+	case "darwin", "windows":
+		t.Cleanup(func() { _ = os.Remove(sockname) })
+	default:
+		sockname = "@" + name
+	}
+	return sockname
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/net/util.go b/third_party/k8s.io/apimachinery/pkg/util/net/util.go
new file mode 100644
index 0000000000..1635e69a5c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/net/util.go
@@ -0,0 +1,63 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"errors"
+	"net"
+	"reflect"
+	"strings"
+	"syscall"
+)
+
+// IPNetEqual checks if the two input IPNets are representing the same subnet.
+// For example,
+//
+//	10.0.0.1/24 and 10.0.0.0/24 are the same subnet.
+//	10.0.0.1/24 and 10.0.0.0/25 are not the same subnet.
+func IPNetEqual(ipnet1, ipnet2 *net.IPNet) bool {
+	if ipnet1 == nil || ipnet2 == nil {
+		return false
+	}
+	if reflect.DeepEqual(ipnet1.Mask, ipnet2.Mask) && ipnet1.Contains(ipnet2.IP) && ipnet2.Contains(ipnet1.IP) {
+		return true
+	}
+	return false
+}
+
+// Returns if the given err is "connection reset by peer" error.
+func IsConnectionReset(err error) bool {
+	var errno syscall.Errno
+	if errors.As(err, &errno) {
+		return errno == syscall.ECONNRESET
+	}
+	return false
+}
+
+// Returns if the given err is "http2: client connection lost" error.
+func IsHTTP2ConnectionLost(err error) bool {
+	return err != nil && strings.Contains(err.Error(), "http2: client connection lost")
+}
+
+// Returns if the given err is "connection refused" error
+func IsConnectionRefused(err error) bool {
+	var errno syscall.Errno
+	if errors.As(err, &errno) {
+		return errno == syscall.ECONNREFUSED
+	}
+	return false
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/net/util_test.go b/third_party/k8s.io/apimachinery/pkg/util/net/util_test.go
new file mode 100644
index 0000000000..90b14a864c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/net/util_test.go
@@ -0,0 +1,201 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package net
+
+import (
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"syscall"
+	"testing"
+	"time"
+
+	"golang.org/x/net/http2"
+
+	netutils "k8s.io/utils/net"
+)
+
+func getIPNet(cidr string) *net.IPNet {
+	_, ipnet, _ := netutils.ParseCIDRSloppy(cidr)
+	return ipnet
+}
+
+func TestIPNetEqual(t *testing.T) {
+	testCases := []struct {
+		ipnet1 *net.IPNet
+		ipnet2 *net.IPNet
+		expect bool
+	}{
+		// null case
+		{
+			getIPNet("10.0.0.1/24"),
+			getIPNet(""),
+			false,
+		},
+		{
+			getIPNet("10.0.0.0/24"),
+			getIPNet("10.0.0.0/24"),
+			true,
+		},
+		{
+			getIPNet("10.0.0.0/24"),
+			getIPNet("10.0.0.1/24"),
+			true,
+		},
+		{
+			getIPNet("10.0.0.0/25"),
+			getIPNet("10.0.0.0/24"),
+			false,
+		},
+		{
+			getIPNet("10.0.1.0/24"),
+			getIPNet("10.0.0.0/24"),
+			false,
+		},
+	}
+
+	for _, tc := range testCases {
+		if tc.expect != IPNetEqual(tc.ipnet1, tc.ipnet2) {
+			t.Errorf("Expect equality of %s and %s be to %v", tc.ipnet1.String(), tc.ipnet2.String(), tc.expect)
+		}
+	}
+}
+
+func TestIsConnectionRefused(t *testing.T) {
+	testCases := []struct {
+		err    error
+		expect bool
+	}{
+		{
+			&url.Error{Err: &net.OpError{Err: syscall.ECONNRESET}},
+			false,
+		},
+		{
+			&url.Error{Err: &net.OpError{Err: syscall.ECONNREFUSED}},
+			true,
+		},
+		{&url.Error{Err: &net.OpError{Err: &os.SyscallError{Err: syscall.ECONNREFUSED}}},
+			true,
+		},
+	}
+
+	for _, tc := range testCases {
+		if result := IsConnectionRefused(tc.err); result != tc.expect {
+			t.Errorf("Expect to be %v, but actual is %v", tc.expect, result)
+		}
+	}
+}
+
+type tcpLB struct {
+	t         *testing.T
+	ln        net.Listener
+	serverURL string
+}
+
+func (lb *tcpLB) handleConnection(in net.Conn, stopCh chan struct{}) {
+	out, err := net.Dial("tcp", lb.serverURL)
+	if err != nil {
+		lb.t.Log(err)
+		return
+	}
+	go io.Copy(out, in)
+	go io.Copy(in, out)
+	<-stopCh
+	if err := out.Close(); err != nil {
+		lb.t.Fatalf("failed to close connection: %v", err)
+	}
+}
+
+func (lb *tcpLB) serve(stopCh chan struct{}) {
+	conn, err := lb.ln.Accept()
+	if err != nil {
+		lb.t.Fatalf("failed to accept: %v", err)
+	}
+	lb.handleConnection(conn, stopCh)
+}
+
+func newLB(t *testing.T, serverURL string) *tcpLB {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("failed to bind: %v", err)
+	}
+	lb := tcpLB{
+		serverURL: serverURL,
+		ln:        ln,
+		t:         t,
+	}
+	return &lb
+}
+
+func TestIsConnectionReset(t *testing.T) {
+	ts := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintf(w, "Hello, %s", r.Proto)
+	}))
+	ts.EnableHTTP2 = true
+	ts.StartTLS()
+	defer ts.Close()
+
+	u, err := url.Parse(ts.URL)
+	if err != nil {
+		t.Fatalf("failed to parse URL from %q: %v", ts.URL, err)
+	}
+	lb := newLB(t, u.Host)
+	defer lb.ln.Close()
+	stopCh, stoppedCh := make(chan struct{}), make(chan struct{})
+	go func() {
+		defer close(stoppedCh)
+		lb.serve(stopCh)
+	}()
+
+	c := ts.Client()
+	transport, ok := ts.Client().Transport.(*http.Transport)
+	if !ok {
+		t.Fatalf("failed to assert *http.Transport")
+	}
+	t2, err := http2.ConfigureTransports(transport)
+	if err != nil {
+		t.Fatalf("failed to configure *http.Transport: %+v", err)
+	}
+	t2.ReadIdleTimeout = time.Second
+	t2.PingTimeout = time.Second
+	resp, err := c.Get("https://" + lb.ln.Addr().String())
+	if err != nil {
+		t.Fatalf("unexpected error: %+v", err)
+	}
+	defer resp.Body.Close()
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatalf("unexpected error: %+v", err)
+	}
+	if string(data) != "Hello, HTTP/2.0" {
+		t.Fatalf("unexpected response: %s", data)
+	}
+
+	// Deliberately let the LB stop proxying traffic for the current
+	// connection. This mimics a broken TCP connection that's not properly
+	// closed.
+	close(stopCh)
+	<-stoppedCh
+	_, err = c.Get("https://" + lb.ln.Addr().String())
+	if !IsHTTP2ConnectionLost(err) {
+		t.Fatalf("expected HTTP2ConnectionLost error, got %v", err)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/portforward/constants.go b/third_party/k8s.io/apimachinery/pkg/util/portforward/constants.go
new file mode 100644
index 0000000000..6853288156
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/portforward/constants.go
@@ -0,0 +1,24 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package portforward
+
+const (
+	PortForwardV1Name                    = "portforward.k8s.io"
+	WebsocketsSPDYTunnelingPrefix        = "SPDY/3.1+"
+	KubernetesSuffix                     = ".k8s.io"
+	WebsocketsSPDYTunnelingPortForwardV1 = WebsocketsSPDYTunnelingPrefix + PortForwardV1Name
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/util/proxy/dial.go b/third_party/k8s.io/apimachinery/pkg/util/proxy/dial.go
new file mode 100644
index 0000000000..d6ba23d416
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/proxy/dial.go
@@ -0,0 +1,122 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+
+	utilnet "k8s.io/apimachinery/pkg/util/net"
+	"k8s.io/apimachinery/third_party/forked/golang/netutil"
+	"k8s.io/klog/v2"
+)
+
+// DialURL will dial the specified URL using the underlying dialer held by the passed
+// RoundTripper. The primary use of this method is to support proxying upgradable connections.
+// For this reason this method will prefer to negotiate http/1.1 if the URL scheme is https.
+// If you wish to ensure ALPN negotiates http2 then set NextProto=[]string{"http2"} in the
+// TLSConfig of the http.Transport
+func DialURL(ctx context.Context, url *url.URL, transport http.RoundTripper) (net.Conn, error) {
+	dialAddr := netutil.CanonicalAddr(url)
+
+	dialer, err := utilnet.DialerFor(transport)
+	if err != nil {
+		klog.FromContext(ctx).V(5).Info("Unable to unwrap transport to get dialer", "type", fmt.Sprintf("%T", transport), "err", err)
+	}
+
+	switch url.Scheme {
+	case "http":
+		if dialer != nil {
+			return dialer(ctx, "tcp", dialAddr)
+		}
+		var d net.Dialer
+		return d.DialContext(ctx, "tcp", dialAddr)
+	case "https":
+		// Get the tls config from the transport if we recognize it
+		tlsConfig, err := utilnet.TLSClientConfig(transport)
+		if err != nil {
+			klog.FromContext(ctx).V(5).Info("Unable to unwrap transport to get at TLS config", "type", fmt.Sprintf("%T", transport), "err", err)
+		}
+
+		if dialer != nil {
+			// We have a dialer; use it to open the connection, then
+			// create a tls client using the connection.
+			netConn, err := dialer(ctx, "tcp", dialAddr)
+			if err != nil {
+				return nil, err
+			}
+			if tlsConfig == nil {
+				// tls.Client requires non-nil config
+				klog.FromContext(ctx).Info("Warning: using custom dialer with no TLSClientConfig, defaulting to InsecureSkipVerify")
+				// tls.Handshake() requires ServerName or InsecureSkipVerify
+				tlsConfig = &tls.Config{
+					InsecureSkipVerify: true,
+				}
+			} else if len(tlsConfig.ServerName) == 0 && !tlsConfig.InsecureSkipVerify {
+				// tls.HandshakeContext() requires ServerName or InsecureSkipVerify
+				// infer the ServerName from the hostname we're connecting to.
+				inferredHost := dialAddr
+				if host, _, err := net.SplitHostPort(dialAddr); err == nil {
+					inferredHost = host
+				}
+				// Make a copy to avoid polluting the provided config
+				tlsConfigCopy := tlsConfig.Clone()
+				tlsConfigCopy.ServerName = inferredHost
+				tlsConfig = tlsConfigCopy
+			}
+
+			// Since this method is primarily used within a "Connection: Upgrade" call we assume the caller is
+			// going to write HTTP/1.1 request to the wire. http2 should not be allowed in the TLSConfig.NextProtos,
+			// so we explicitly set that here. We only do this check if the TLSConfig support http/1.1.
+			if supportsHTTP11(tlsConfig.NextProtos) {
+				tlsConfig = tlsConfig.Clone()
+				tlsConfig.NextProtos = []string{"http/1.1"}
+			}
+
+			tlsConn := tls.Client(netConn, tlsConfig)
+			if err := tlsConn.HandshakeContext(ctx); err != nil {
+				netConn.Close()
+				return nil, err
+			}
+			return tlsConn, nil
+		} else {
+			// Dial.
+			tlsDialer := tls.Dialer{
+				Config: tlsConfig,
+			}
+			return tlsDialer.DialContext(ctx, "tcp", dialAddr)
+		}
+	default:
+		return nil, fmt.Errorf("unknown scheme: %s", url.Scheme)
+	}
+}
+
+func supportsHTTP11(nextProtos []string) bool {
+	if len(nextProtos) == 0 {
+		return true
+	}
+	for _, proto := range nextProtos {
+		if proto == "http/1.1" {
+			return true
+		}
+	}
+	return false
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/proxy/dial_test.go b/third_party/k8s.io/apimachinery/pkg/util/proxy/dial_test.go
new file mode 100644
index 0000000000..488e878b72
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/proxy/dial_test.go
@@ -0,0 +1,230 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"reflect"
+	"regexp"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	utilnet "k8s.io/apimachinery/pkg/util/net"
+)
+
+func TestDialURL(t *testing.T) {
+	roots := x509.NewCertPool()
+	if !roots.AppendCertsFromPEM(localhostCert) {
+		t.Fatal("error setting up localhostCert pool")
+	}
+
+	cert, err := tls.X509KeyPair(localhostCert, localhostKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var d net.Dialer
+
+	testcases := map[string]struct {
+		TLSConfig   *tls.Config
+		Dial        utilnet.DialFunc
+		ExpectError string
+		ExpectProto string
+	}{
+		"insecure": {
+			TLSConfig: &tls.Config{InsecureSkipVerify: true},
+		},
+		"secure, no roots": {
+			TLSConfig:   &tls.Config{InsecureSkipVerify: false},
+			ExpectError: "unknown authority|not trusted",
+		},
+		"secure with roots": {
+			TLSConfig: &tls.Config{InsecureSkipVerify: false, RootCAs: roots},
+		},
+		"secure with mismatched server": {
+			TLSConfig:   &tls.Config{InsecureSkipVerify: false, RootCAs: roots, ServerName: "bogus.com"},
+			ExpectError: "not bogus.com",
+		},
+		"secure with matched server": {
+			TLSConfig: &tls.Config{InsecureSkipVerify: false, RootCAs: roots, ServerName: "example.com"},
+		},
+
+		"insecure, custom dial": {
+			TLSConfig: &tls.Config{InsecureSkipVerify: true},
+			Dial:      d.DialContext,
+		},
+		"secure, no roots, custom dial": {
+			TLSConfig:   &tls.Config{InsecureSkipVerify: false},
+			Dial:        d.DialContext,
+			ExpectError: "unknown authority|not trusted",
+		},
+		"secure with roots, custom dial": {
+			TLSConfig: &tls.Config{InsecureSkipVerify: false, RootCAs: roots},
+			Dial:      d.DialContext,
+		},
+		"secure with mismatched server, custom dial": {
+			TLSConfig:   &tls.Config{InsecureSkipVerify: false, RootCAs: roots, ServerName: "bogus.com"},
+			Dial:        d.DialContext,
+			ExpectError: "not bogus.com",
+		},
+		"secure with matched server, custom dial": {
+			TLSConfig: &tls.Config{InsecureSkipVerify: false, RootCAs: roots, ServerName: "example.com"},
+			Dial:      d.DialContext,
+		},
+		"ensure we use http2 if specified": {
+			TLSConfig:   &tls.Config{InsecureSkipVerify: false, RootCAs: roots, ServerName: "example.com", NextProtos: []string{"http2"}},
+			Dial:        d.DialContext,
+			ExpectProto: "http2",
+		},
+		"ensure we use http/1.1 if unspecified": {
+			TLSConfig:   &tls.Config{InsecureSkipVerify: false, RootCAs: roots, ServerName: "example.com"},
+			Dial:        d.DialContext,
+			ExpectProto: "http/1.1",
+		},
+		"ensure we use http/1.1 if available": {
+			TLSConfig:   &tls.Config{InsecureSkipVerify: false, RootCAs: roots, ServerName: "example.com", NextProtos: []string{"http2", "http/1.1"}},
+			Dial:        d.DialContext,
+			ExpectProto: "http/1.1",
+		},
+	}
+
+	for k, tc := range testcases {
+		func() {
+			ts := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {}))
+			defer ts.Close()
+			ts.TLS = &tls.Config{Certificates: []tls.Certificate{cert}, NextProtos: []string{"http2", "http/1.1"}}
+			ts.StartTLS()
+
+			// Make a copy of the config
+			tlsConfigCopy := tc.TLSConfig.Clone()
+			// Clone() mutates the receiver (!), so also call it on the copy
+			tlsConfigCopy.Clone()
+			transport := &http.Transport{
+				DialContext:     tc.Dial,
+				TLSClientConfig: tlsConfigCopy,
+			}
+
+			extractedDial, err := utilnet.DialerFor(transport)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if fmt.Sprintf("%p", extractedDial) != fmt.Sprintf("%p", tc.Dial) {
+				t.Fatalf("%s: Unexpected dial", k)
+			}
+
+			extractedTLSConfig, err := utilnet.TLSClientConfig(transport)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if extractedTLSConfig == nil {
+				t.Fatalf("%s: Expected tlsConfig", k)
+			}
+
+			u, _ := url.Parse(ts.URL)
+			_, p, _ := net.SplitHostPort(u.Host)
+			u.Host = net.JoinHostPort("127.0.0.1", p)
+			conn, err := DialURL(context.Background(), u, transport)
+
+			// Make sure dialing doesn't mutate the transport's TLSConfig
+			if !reflect.DeepEqual(tc.TLSConfig, tlsConfigCopy) {
+				t.Errorf("%s: transport's copy of TLSConfig was mutated\n%s", k, cmp.Diff(tc.TLSConfig, tlsConfigCopy))
+			}
+
+			if err != nil {
+				if tc.ExpectError == "" {
+					t.Errorf("%s: expected no error, got %q", k, err.Error())
+				}
+				if tc.ExpectError != "" && !regexp.MustCompile(tc.ExpectError).MatchString(err.Error()) {
+					t.Errorf("%s: expected error containing %q, got %q", k, tc.ExpectError, err.Error())
+				}
+				return
+			}
+
+			tlsConn := conn.(*tls.Conn)
+			if tc.ExpectProto != "" {
+				if tlsConn.ConnectionState().NegotiatedProtocol != tc.ExpectProto {
+					t.Errorf("%s: expected proto %s, got %s", k, tc.ExpectProto, tlsConn.ConnectionState().NegotiatedProtocol)
+				}
+			}
+
+			conn.Close()
+			if tc.ExpectError != "" {
+				t.Errorf("%s: expected error %q, got none", k, tc.ExpectError)
+			}
+		}()
+	}
+
+}
+
+// localhostCert was generated from crypto/tls/generate_cert.go with the following command:
+//
+//	go run generate_cert.go  --rsa-bits 2048 --host 127.0.0.1,::1,example.com --ca --start-date "Jan 1 00:00:00 1970" --duration=1000000h
+var localhostCert = []byte(`-----BEGIN CERTIFICATE-----
+MIIDGTCCAgGgAwIBAgIRAKfNl1LEAt7nFPYvHBnpv2swDQYJKoZIhvcNAQELBQAw
+EjEQMA4GA1UEChMHQWNtZSBDbzAgFw03MDAxMDEwMDAwMDBaGA8yMDg0MDEyOTE2
+MDAwMFowEjEQMA4GA1UEChMHQWNtZSBDbzCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAKww39FwmV5lDIbAUIAuSYYVtZke6bca1oyq19ZrRL0uavwPXSJm
++Qxt4RKUQhzYhZ/alJp8iRfu/Z+Yv9Beez89dQB9V8YnHj/AX4Jph9lJ2aawWMI6
+AqPLdIzKLQVVvPw+UVKH9x8yy08H/23AIFGyK4Dbht+KZJeUbJQFiGlRFJim8atx
+KA3C9NzCHw6hyhP46jguLl65rcxLMSzcTz97ToG0MP66YEUbsA/YzFTKDwht7ESH
+nRMBnQ4wZfWpvAiXMr3XJGOa3NYJy1A+WkWyrfZO7guwsZ4L6dGqnlPpzA5QkKYx
+H9Z5K1bUaYEi0Yi2ug7Jkvd1HE179nkF7t0CAwEAAaNoMGYwDgYDVR0PAQH/BAQD
+AgKkMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wLgYDVR0R
+BCcwJYILZXhhbXBsZS5jb22HBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZI
+hvcNAQELBQADggEBAAKSQToD1iLujFhQwaLnPVRV6r4nEFVXCxXYtQNEX1DVSKSj
+JYbBGJnL50oc0N4Ar+Spqofm+THkiTQJUzptPtnYIzNpKYdE6+bPwqURWzFEI2OF
+ks3fYZ4ZdbMbmJRo1qPJO34emm4KrOl9aoV0qwp2QyTvHgLroU3icKoe4e7+p4KK
+02Rt3qczHvCKoUnw6m07Ql0n9e7Ncpujcs2A8PaQ1iPX+BVOmvjTVT8y5NSRDzwL
+a2wur8BSZ5E8SVzzvNZJlLSi6BbObQUjALHkjVYm11dWv/BY8jHdt+iFhbNBRASx
+ENuih3pX1Poki1qRYOtB/vAS99E1ORj9zJlUlzo=
+-----END CERTIFICATE-----`)
+
+// localhostKey is the private key for localhostCert.
+var localhostKey = []byte(`-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEArDDf0XCZXmUMhsBQgC5JhhW1mR7ptxrWjKrX1mtEvS5q/A9d
+Imb5DG3hEpRCHNiFn9qUmnyJF+79n5i/0F57Pz11AH1XxiceP8BfgmmH2UnZprBY
+wjoCo8t0jMotBVW8/D5RUof3HzLLTwf/bcAgUbIrgNuG34pkl5RslAWIaVEUmKbx
+q3EoDcL03MIfDqHKE/jqOC4uXrmtzEsxLNxPP3tOgbQw/rpgRRuwD9jMVMoPCG3s
+RIedEwGdDjBl9am8CJcyvdckY5rc1gnLUD5aRbKt9k7uC7Cxngvp0aqeU+nMDlCQ
+pjEf1nkrVtRpgSLRiLa6DsmS93UcTXv2eQXu3QIDAQABAoIBACAYnB+2FWB7BXK4
+tkiuWBYeRdNc58OxxPxDfCgDprR8yoRheMLI3vNqJ+IGsKwf0AiT/c8uF3/WlIAD
+QP3eHqsTEZQdyRaug/zuJt9wPFpMYb2ocWMC3Ssa6Ya0yN+Ns8Rw+UehAHdYSH1a
+yEn03hFcXK+QO/u/GDEJAZQ108+NdznT4ql59tt791d97meNlMVJwkwVf/NqtDqi
+UNx6BvSj5+6MoWjU8hqrYv9pkzP386QRsl70tVH+0LZd5XUZsSyof/IdV1EmfGUR
+5les8tsd+fuo3LaPObksJu+GBwvEStmQPjZjiBUzw0Sx8VYTJfZr7gl2h4mmk/AJ
+F5P+fSECgYEAzwDcJCuYPA8nzVB+ZOM+Wl+3uUKG/Xn8Yx8uWtWU7o9qsJmasLqO
+sLtz1zadPtYOBXsb4H5PisNPuosVEqnthjRwmPhIA3tK/X3UzhnriACCrKpg3Ix0
+uJG2vqpdaPXYxmyTQfI8YSp5X0gTg3R4xQqmbGMyAQg+1NzcGAf+qQ8CgYEA1PKX
+vkxzJuSPsfQYr34fnZRuogANNGUaWCTYMhH6sK8qrJu5RXmEemaraqT/esUUu1fl
+cTAxRqUb8ysexA+RKR848hFkrvAR5M1t6xK2hPuSec1Lm9HNfHoFB7Pa5t7APoJ9
+8NkjNzI0mL9YqYcfJpzfFrxtzfLwlm6B3irS8VMCgYBg3skmUBRcvsbkiO+tLL7I
+MhTbKGvdgNGAXV4m+d5JSWonHKrMW3Fc+Uv7gb5SYn+LRxJDmziD+mR8KowBAO57
+qFys6TtiDbeJKvKERJL5QSvlu5G6hCw3F1GKplUyQiJgsPy0lrR00BieYy9mjAHc
+S+CXxk/nNcGZgYWp5UviNwKBgC7t46kpmfsJRe222LXcOsV0j8kd78sLOPoR7J9k
+PPYxNFtj2jnIZPzAoahYAoGg60e6QDNopoNmIbm+WAJnV9tTKS6XzLOM7rSY3U+A
+CT9XXdl/99i4LOvwzCj9ZxGYJ4/fHDg28j7YzqSXDsgVojTVP4j4L87CamkMo4w9
+rc1HAoGARE2WActS2PF75jRXCjj4SjB/3vOJVGKxrJdoo2HPzY0psTmdJJULOGYZ
+MU1KC4EDzhSfM3juBbEhaZx9NFZOHVp2hxZpg77B5cQXGH6HIiZ20jCNjdcioHl9
+HeVeFG/9rJG0NcQe3pIm9f0EY5JCbzr0fa2tTPV3N9jGHc0sFtI=
+-----END RSA PRIVATE KEY-----
+`)
diff --git a/third_party/k8s.io/apimachinery/pkg/util/proxy/doc.go b/third_party/k8s.io/apimachinery/pkg/util/proxy/doc.go
new file mode 100644
index 0000000000..ea710f6b15
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/proxy/doc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package proxy provides transport and upgrade support for proxies.
+package proxy
diff --git a/third_party/k8s.io/apimachinery/pkg/util/proxy/transport.go b/third_party/k8s.io/apimachinery/pkg/util/proxy/transport.go
new file mode 100644
index 0000000000..1c17f53df0
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/proxy/transport.go
@@ -0,0 +1,272 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"bytes"
+	"compress/flate"
+	"compress/gzip"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"path"
+	"strings"
+
+	"golang.org/x/net/html"
+	"golang.org/x/net/html/atom"
+	"k8s.io/klog/v2"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/util/net"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// atomsToAttrs states which attributes of which tags require URL substitution.
+// Sources: http://www.w3.org/TR/REC-html40/index/attributes.html
+//
+//	http://www.w3.org/html/wg/drafts/html/master/index.html#attributes-1
+var atomsToAttrs = map[atom.Atom]sets.String{
+	atom.A:          sets.NewString("href"),
+	atom.Applet:     sets.NewString("codebase"),
+	atom.Area:       sets.NewString("href"),
+	atom.Audio:      sets.NewString("src"),
+	atom.Base:       sets.NewString("href"),
+	atom.Blockquote: sets.NewString("cite"),
+	atom.Body:       sets.NewString("background"),
+	atom.Button:     sets.NewString("formaction"),
+	atom.Command:    sets.NewString("icon"),
+	atom.Del:        sets.NewString("cite"),
+	atom.Embed:      sets.NewString("src"),
+	atom.Form:       sets.NewString("action"),
+	atom.Frame:      sets.NewString("longdesc", "src"),
+	atom.Head:       sets.NewString("profile"),
+	atom.Html:       sets.NewString("manifest"),
+	atom.Iframe:     sets.NewString("longdesc", "src"),
+	atom.Img:        sets.NewString("longdesc", "src", "usemap"),
+	atom.Input:      sets.NewString("src", "usemap", "formaction"),
+	atom.Ins:        sets.NewString("cite"),
+	atom.Link:       sets.NewString("href"),
+	atom.Object:     sets.NewString("classid", "codebase", "data", "usemap"),
+	atom.Q:          sets.NewString("cite"),
+	atom.Script:     sets.NewString("src"),
+	atom.Source:     sets.NewString("src"),
+	atom.Video:      sets.NewString("poster", "src"),
+
+	// TODO: css URLs hidden in style elements.
+}
+
+// Transport is a transport for text/html content that replaces URLs in html
+// content with the prefix of the proxy server
+type Transport struct {
+	Scheme      string
+	Host        string
+	PathPrepend string
+
+	http.RoundTripper
+}
+
+// RoundTrip implements the http.RoundTripper interface
+func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
+	// Add reverse proxy headers.
+	forwardedURI := path.Join(t.PathPrepend, req.URL.EscapedPath())
+	if strings.HasSuffix(req.URL.Path, "/") {
+		forwardedURI = forwardedURI + "/"
+	}
+	req.Header.Set("X-Forwarded-Uri", forwardedURI)
+	if len(t.Host) > 0 {
+		req.Header.Set("X-Forwarded-Host", t.Host)
+	}
+	if len(t.Scheme) > 0 {
+		req.Header.Set("X-Forwarded-Proto", t.Scheme)
+	}
+
+	rt := t.RoundTripper
+	if rt == nil {
+		rt = http.DefaultTransport
+	}
+	resp, err := rt.RoundTrip(req)
+
+	if err != nil {
+		return nil, errors.NewServiceUnavailable(fmt.Sprintf("error trying to reach service: %v", err))
+	}
+
+	if redirect := resp.Header.Get("Location"); redirect != "" {
+		targetURL, err := url.Parse(redirect)
+		if err != nil {
+			return nil, errors.NewInternalError(fmt.Errorf("error trying to parse Location header: %v", err))
+		}
+		resp.Header.Set("Location", t.rewriteURL(targetURL, req.URL, req.Host))
+		return resp, nil
+	}
+
+	cType := resp.Header.Get("Content-Type")
+	cType = strings.TrimSpace(strings.SplitN(cType, ";", 2)[0])
+	if cType != "text/html" {
+		// Do nothing, simply pass through
+		return resp, nil
+	}
+
+	return t.rewriteResponse(req, resp)
+}
+
+var _ = net.RoundTripperWrapper(&Transport{})
+
+func (rt *Transport) WrappedRoundTripper() http.RoundTripper {
+	return rt.RoundTripper
+}
+
+// rewriteURL rewrites a single URL to go through the proxy, if the URL refers
+// to the same host as sourceURL, which is the page on which the target URL
+// occurred, or if the URL matches the sourceRequestHost.
+func (t *Transport) rewriteURL(url *url.URL, sourceURL *url.URL, sourceRequestHost string) string {
+	// Example:
+	//      When API server processes a proxy request to a service (e.g. /api/v1/namespace/foo/service/bar/proxy/),
+	//      the sourceURL.Host (i.e. req.URL.Host) is the endpoint IP address of the service. The
+	//      sourceRequestHost (i.e. req.Host) is the Host header that specifies the host on which the
+	//      URL is sought, which can be different from sourceURL.Host. For example, if user sends the
+	//      request through "kubectl proxy" locally (i.e. localhost:8001/api/v1/namespace/foo/service/bar/proxy/),
+	//      sourceRequestHost is "localhost:8001".
+	//
+	//      If the service's response URL contains non-empty host, and url.Host is equal to either sourceURL.Host
+	//      or sourceRequestHost, we should not consider the returned URL to be a completely different host.
+	//      It's the API server's responsibility to rewrite a same-host-and-absolute-path URL and append the
+	//      necessary URL prefix (i.e. /api/v1/namespace/foo/service/bar/proxy/).
+	isDifferentHost := url.Host != "" && url.Host != sourceURL.Host && url.Host != sourceRequestHost
+	isRelative := !strings.HasPrefix(url.Path, "/")
+	if isDifferentHost || isRelative {
+		return url.String()
+	}
+
+	// Do not rewrite scheme and host if the Transport has empty scheme and host
+	// when targetURL already contains the sourceRequestHost
+	if !(url.Host == sourceRequestHost && t.Scheme == "" && t.Host == "") {
+		url.Scheme = t.Scheme
+		url.Host = t.Host
+	}
+
+	origPath := url.Path
+	// Do not rewrite URL if the sourceURL already contains the necessary prefix.
+	if strings.HasPrefix(url.Path, t.PathPrepend) {
+		return url.String()
+	}
+	url.Path = path.Join(t.PathPrepend, url.Path)
+	if strings.HasSuffix(origPath, "/") {
+		// Add back the trailing slash, which was stripped by path.Join().
+		url.Path += "/"
+	}
+
+	return url.String()
+}
+
+// rewriteHTML scans the HTML for tags with url-valued attributes, and updates
+// those values with the urlRewriter function. The updated HTML is output to the
+// writer.
+func rewriteHTML(reader io.Reader, writer io.Writer, urlRewriter func(*url.URL) string) error {
+	// Note: This assumes the content is UTF-8.
+	tokenizer := html.NewTokenizer(reader)
+
+	var err error
+	for err == nil {
+		tokenType := tokenizer.Next()
+		switch tokenType {
+		case html.ErrorToken:
+			err = tokenizer.Err()
+		case html.StartTagToken, html.SelfClosingTagToken:
+			token := tokenizer.Token()
+			if urlAttrs, ok := atomsToAttrs[token.DataAtom]; ok {
+				for i, attr := range token.Attr {
+					if urlAttrs.Has(attr.Key) {
+						url, err := url.Parse(attr.Val)
+						if err != nil {
+							// Do not rewrite the URL if it isn't valid.  It is intended not
+							// to error here to prevent the inability to understand the
+							// content of the body to cause a fatal error.
+							continue
+						}
+						token.Attr[i].Val = urlRewriter(url)
+					}
+				}
+			}
+			_, err = writer.Write([]byte(token.String()))
+		default:
+			_, err = writer.Write(tokenizer.Raw())
+		}
+	}
+	if err != io.EOF {
+		return err
+	}
+	return nil
+}
+
+// rewriteResponse modifies an HTML response by updating absolute links referring
+// to the original host to instead refer to the proxy transport.
+func (t *Transport) rewriteResponse(req *http.Request, resp *http.Response) (*http.Response, error) {
+	origBody := resp.Body
+	defer origBody.Close()
+
+	newContent := &bytes.Buffer{}
+	var reader io.Reader = origBody
+	var writer io.Writer = newContent
+	encoding := resp.Header.Get("Content-Encoding")
+	switch encoding {
+	case "gzip":
+		var err error
+		reader, err = gzip.NewReader(reader)
+		if err != nil {
+			return nil, fmt.Errorf("errorf making gzip reader: %v", err)
+		}
+		gzw := gzip.NewWriter(writer)
+		defer gzw.Close()
+		writer = gzw
+	case "deflate":
+		var err error
+		reader = flate.NewReader(reader)
+		flw, err := flate.NewWriter(writer, flate.BestCompression)
+		if err != nil {
+			return nil, fmt.Errorf("errorf making flate writer: %v", err)
+		}
+		defer func() {
+			flw.Close()
+			flw.Flush()
+		}()
+		writer = flw
+	case "":
+		// This is fine
+	default:
+		// Some encoding we don't understand-- don't try to parse this
+		klog.FromContext(req.Context()).Error(nil, "Proxy encountered unknown encoding for text/html, can't understand this so not fixing links", "encoding", encoding)
+		return resp, nil
+	}
+
+	urlRewriter := func(targetUrl *url.URL) string {
+		return t.rewriteURL(targetUrl, req.URL, req.Host)
+	}
+	err := rewriteHTML(reader, writer, urlRewriter)
+	if err != nil {
+		klog.FromContext(req.Context()).Error(err, "Failed to rewrite URLs")
+		return resp, err
+	}
+
+	resp.Body = io.NopCloser(newContent)
+	// Update header node with new content-length
+	// TODO: Remove any hash/signature headers here?
+	resp.Header.Del("Content-Length")
+	resp.ContentLength = int64(newContent.Len())
+
+	return resp, err
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/proxy/transport_test.go b/third_party/k8s.io/apimachinery/pkg/util/proxy/transport_test.go
new file mode 100644
index 0000000000..a50f1e406c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/proxy/transport_test.go
@@ -0,0 +1,396 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"bytes"
+	"compress/flate"
+	"compress/gzip"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+)
+
+func parseURLOrDie(inURL string) *url.URL {
+	parsed, err := url.Parse(inURL)
+	if err != nil {
+		panic(err)
+	}
+	return parsed
+}
+
+func TestProxyTransport(t *testing.T) {
+	testTransport := &Transport{
+		Scheme:      "http",
+		Host:        "foo.com",
+		PathPrepend: "/proxy/node/node1:10250",
+	}
+	testTransport2 := &Transport{
+		Scheme:      "https",
+		Host:        "foo.com",
+		PathPrepend: "/proxy/node/node1:8080",
+	}
+	emptyHostTransport := &Transport{
+		Scheme:      "https",
+		PathPrepend: "/proxy/node/node1:10250",
+	}
+	emptySchemeTransport := &Transport{
+		Host:        "foo.com",
+		PathPrepend: "/proxy/node/node1:10250",
+	}
+	emptyHostAndSchemeTransport := &Transport{
+		PathPrepend: "/proxy/node/node1:10250",
+	}
+	type Item struct {
+		input        string
+		sourceURL    string
+		transport    *Transport
+		output       string
+		contentType  string
+		forwardedURI string
+		redirect     string
+		redirectWant string
+		reqHost      string
+	}
+
+	table := map[string]Item{
+		"normal": {
+			input:        `<pre><a href="kubelet.log">kubelet.log</a><a href="/google.log">google.log</a></pre>`,
+			sourceURL:    "http://mynode.com/logs/log.log",
+			transport:    testTransport,
+			output:       `<pre><a href="kubelet.log">kubelet.log</a><a href="http://foo.com/proxy/node/node1:10250/google.log">google.log</a></pre>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"full document": {
+			input:        `<html><header></header><body><pre><a href="kubelet.log">kubelet.log</a><a href="/google.log">google.log</a></pre></body></html>`,
+			sourceURL:    "http://mynode.com/logs/log.log",
+			transport:    testTransport,
+			output:       `<html><header></header><body><pre><a href="kubelet.log">kubelet.log</a><a href="http://foo.com/proxy/node/node1:10250/google.log">google.log</a></pre></body></html>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"trailing slash": {
+			input:        `<pre><a href="kubelet.log">kubelet.log</a><a href="/google.log/">google.log</a></pre>`,
+			sourceURL:    "http://mynode.com/logs/log.log",
+			transport:    testTransport,
+			output:       `<pre><a href="kubelet.log">kubelet.log</a><a href="http://foo.com/proxy/node/node1:10250/google.log/">google.log</a></pre>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"content-type charset": {
+			input:        `<pre><a href="kubelet.log">kubelet.log</a><a href="/google.log">google.log</a></pre>`,
+			sourceURL:    "http://mynode.com/logs/log.log",
+			transport:    testTransport,
+			output:       `<pre><a href="kubelet.log">kubelet.log</a><a href="http://foo.com/proxy/node/node1:10250/google.log">google.log</a></pre>`,
+			contentType:  "text/html; charset=utf-8",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"content-type passthrough": {
+			input:        `<pre><a href="kubelet.log">kubelet.log</a><a href="/google.log">google.log</a></pre>`,
+			sourceURL:    "http://mynode.com/logs/log.log",
+			transport:    testTransport,
+			output:       `<pre><a href="kubelet.log">kubelet.log</a><a href="/google.log">google.log</a></pre>`,
+			contentType:  "text/plain",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"subdir": {
+			input:        `<a href="kubelet.log">kubelet.log</a><a href="/google.log">google.log</a>`,
+			sourceURL:    "http://mynode.com/whatever/apt/somelog.log",
+			transport:    testTransport2,
+			output:       `<a href="kubelet.log">kubelet.log</a><a href="https://foo.com/proxy/node/node1:8080/google.log">google.log</a>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:8080/whatever/apt/somelog.log",
+		},
+		"image": {
+			input:        `<pre><img src="kubernetes.jpg"/><img src="/kubernetes_abs.jpg"/></pre>`,
+			sourceURL:    "http://mynode.com/",
+			transport:    testTransport,
+			output:       `<pre><img src="kubernetes.jpg"/><img src="http://foo.com/proxy/node/node1:10250/kubernetes_abs.jpg"/></pre>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/",
+		},
+		"abs": {
+			input:        `<script src="http://google.com/kubernetes.js"/>`,
+			sourceURL:    "http://mynode.com/any/path/",
+			transport:    testTransport,
+			output:       `<script src="http://google.com/kubernetes.js"/>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/any/path/",
+		},
+		"abs but same host": {
+			input:        `<script src="http://mynode.com/kubernetes.js"/>`,
+			sourceURL:    "http://mynode.com/any/path/",
+			transport:    testTransport,
+			output:       `<script src="http://foo.com/proxy/node/node1:10250/kubernetes.js"/>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/any/path/",
+		},
+		"redirect rel": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    testTransport,
+			redirect:     "/redirected/target/",
+			redirectWant: "http://foo.com/proxy/node/node1:10250/redirected/target/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+		},
+		"redirect abs same host": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    testTransport,
+			redirect:     "http://mynode.com/redirected/target/",
+			redirectWant: "http://foo.com/proxy/node/node1:10250/redirected/target/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+		},
+		"redirect abs other host": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    testTransport,
+			redirect:     "http://example.com/redirected/target/",
+			redirectWant: "http://example.com/redirected/target/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+		},
+		"redirect abs use reqHost no host no scheme": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    emptyHostAndSchemeTransport,
+			redirect:     "http://10.0.0.1:8001/redirected/target/",
+			redirectWant: "http://10.0.0.1:8001/proxy/node/node1:10250/redirected/target/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+			reqHost:      "10.0.0.1:8001",
+		},
+		"source contains the redirect already": {
+			input:        `<pre><a href="kubelet.log">kubelet.log</a><a href="http://foo.com/proxy/node/node1:10250/google.log">google.log</a></pre>`,
+			sourceURL:    "http://foo.com/logs/log.log",
+			transport:    testTransport,
+			output:       `<pre><a href="kubelet.log">kubelet.log</a><a href="http://foo.com/proxy/node/node1:10250/google.log">google.log</a></pre>`,
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"no host": {
+			input:        "<html></html>",
+			sourceURL:    "http://mynode.com/logs/log.log",
+			transport:    emptyHostTransport,
+			output:       "<html></html>",
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"no scheme": {
+			input:        "<html></html>",
+			sourceURL:    "http://mynode.com/logs/log.log",
+			transport:    emptySchemeTransport,
+			output:       "<html></html>",
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log",
+		},
+		"forwarded URI must be escaped": {
+			input:        "<html></html>",
+			sourceURL:    "http://mynode.com/logs/log.log%00<script>alert(1)</script>",
+			transport:    testTransport,
+			output:       "<html></html>",
+			contentType:  "text/html",
+			forwardedURI: "/proxy/node/node1:10250/logs/log.log%00%3Cscript%3Ealert%281%29%3C/script%3E",
+		},
+		"redirect rel must be escaped": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    testTransport,
+			redirect:     "/redirected/target/%00<script>alert(1)</script>/",
+			redirectWant: "http://foo.com/proxy/node/node1:10250/redirected/target/%00%3Cscript%3Ealert%281%29%3C/script%3E/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+		},
+		"redirect abs same host must be escaped": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    testTransport,
+			redirect:     "http://mynode.com/redirected/target/%00<script>alert(1)</script>/",
+			redirectWant: "http://foo.com/proxy/node/node1:10250/redirected/target/%00%3Cscript%3Ealert%281%29%3C/script%3E/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+		},
+		"redirect abs other host must be escaped": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    testTransport,
+			redirect:     "http://example.com/redirected/target/%00<script>alert(1)</script>/",
+			redirectWant: "http://example.com/redirected/target/%00%3Cscript%3Ealert%281%29%3C/script%3E/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+		},
+		"redirect abs use reqHost no host no scheme must be escaped": {
+			sourceURL:    "http://mynode.com/redirect",
+			transport:    emptyHostAndSchemeTransport,
+			redirect:     "http://10.0.0.1:8001/redirected/target/%00<script>alert(1)</script>/",
+			redirectWant: "http://10.0.0.1:8001/proxy/node/node1:10250/redirected/target/%00%3Cscript%3Ealert%281%29%3C/script%3E/",
+			forwardedURI: "/proxy/node/node1:10250/redirect",
+			reqHost:      "10.0.0.1:8001",
+		},
+	}
+
+	testItem := func(name string, item *Item) {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// Check request headers.
+			if got, want := r.Header.Get("X-Forwarded-Uri"), item.forwardedURI; got != want {
+				t.Errorf("%v: X-Forwarded-Uri = %q, want %q", name, got, want)
+			}
+			if len(item.transport.Host) == 0 {
+				_, present := r.Header["X-Forwarded-Host"]
+				if present {
+					t.Errorf("%v: X-Forwarded-Host header should not be present", name)
+				}
+			} else {
+				if got, want := r.Header.Get("X-Forwarded-Host"), item.transport.Host; got != want {
+					t.Errorf("%v: X-Forwarded-Host = %q, want %q", name, got, want)
+				}
+			}
+			if len(item.transport.Scheme) == 0 {
+				_, present := r.Header["X-Forwarded-Proto"]
+				if present {
+					t.Errorf("%v: X-Forwarded-Proto header should not be present", name)
+				}
+			} else {
+				if got, want := r.Header.Get("X-Forwarded-Proto"), item.transport.Scheme; got != want {
+					t.Errorf("%v: X-Forwarded-Proto = %q, want %q", name, got, want)
+				}
+			}
+
+			// Send response.
+			if item.redirect != "" {
+				http.Redirect(w, r, item.redirect, http.StatusMovedPermanently)
+				return
+			}
+			w.Header().Set("Content-Type", item.contentType)
+			fmt.Fprint(w, item.input)
+		}))
+		defer server.Close()
+
+		// Replace source URL with our test server address.
+		sourceURL := parseURLOrDie(item.sourceURL)
+		serverURL := parseURLOrDie(server.URL)
+		item.input = strings.Replace(item.input, sourceURL.Host, serverURL.Host, -1)
+		item.redirect = strings.Replace(item.redirect, sourceURL.Host, serverURL.Host, -1)
+		sourceURL.Host = serverURL.Host
+
+		req, err := http.NewRequest(http.MethodGet, sourceURL.String(), nil)
+		if err != nil {
+			t.Errorf("%v: Unexpected error: %v", name, err)
+			return
+		}
+		if item.reqHost != "" {
+			req.Host = item.reqHost
+		}
+		resp, err := item.transport.RoundTrip(req)
+		if err != nil {
+			t.Errorf("%v: Unexpected error: %v", name, err)
+			return
+		}
+		if item.redirect != "" {
+			// Check that redirect URLs get rewritten properly.
+			if got, want := resp.Header.Get("Location"), item.redirectWant; got != want {
+				t.Errorf("%v: Location header = %q, want %q", name, got, want)
+			}
+			return
+		}
+		body, err := io.ReadAll(resp.Body)
+		if err != nil {
+			t.Errorf("%v: Unexpected error: %v", name, err)
+			return
+		}
+		if e, a := item.output, string(body); e != a {
+			t.Errorf("%v: expected %v, but got %v", name, e, a)
+		}
+	}
+
+	for name, item := range table {
+		testItem(name, &item)
+	}
+}
+
+func TestRewriteResponse(t *testing.T) {
+	gzipbuf := bytes.NewBuffer(nil)
+	flatebuf := bytes.NewBuffer(nil)
+
+	testTransport := &Transport{
+		Scheme:      "http",
+		Host:        "foo.com",
+		PathPrepend: "/proxy/node/node1:10250",
+	}
+	expected := []string{
+		"short body test",
+		strings.Repeat("long body test", 4097),
+	}
+	test := []struct {
+		encodeType string
+		writer     func(string) *http.Response
+		reader     func(*http.Response) string
+	}{
+		{
+			encodeType: "gzip",
+			writer: func(ept string) *http.Response {
+				gzw := gzip.NewWriter(gzipbuf)
+				defer gzw.Close()
+
+				gzw.Write([]byte(ept))
+				gzw.Flush()
+				return &http.Response{
+					Body: io.NopCloser(gzipbuf),
+				}
+			},
+			reader: func(rep *http.Response) string {
+				reader, _ := gzip.NewReader(rep.Body)
+				s, _ := io.ReadAll(reader)
+				return string(s)
+			},
+		},
+		{
+			encodeType: "deflate",
+			writer: func(ept string) *http.Response {
+				flw, _ := flate.NewWriter(flatebuf, flate.BestCompression)
+				defer flw.Close()
+
+				flw.Write([]byte(ept))
+				flw.Flush()
+				return &http.Response{
+					Body: io.NopCloser(flatebuf),
+				}
+			},
+			reader: func(rep *http.Response) string {
+				reader := flate.NewReader(rep.Body)
+				s, _ := io.ReadAll(reader)
+				return string(s)
+			},
+		},
+	}
+
+	errFn := func(encode string, err error) {
+		t.Errorf("%s failed to read and write: %v", encode, err)
+	}
+	for _, v := range test {
+		request, _ := http.NewRequest(http.MethodGet, "http://mynode.com/", nil)
+		request.Header.Set("Content-Encoding", v.encodeType)
+		request.Header.Add("Accept-Encoding", v.encodeType)
+
+		for _, exp := range expected {
+			resp := v.writer(exp)
+			gotResponse, err := testTransport.rewriteResponse(request, resp)
+
+			if err != nil {
+				errFn(v.encodeType, err)
+			}
+
+			result := v.reader(gotResponse)
+			if result != exp {
+				errFn(v.encodeType, fmt.Errorf("expected %s, get %s", exp, result))
+			}
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/proxy/upgradeaware.go b/third_party/k8s.io/apimachinery/pkg/util/proxy/upgradeaware.go
new file mode 100644
index 0000000000..56f6214834
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/proxy/upgradeaware.go
@@ -0,0 +1,559 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	utilnet "k8s.io/apimachinery/pkg/util/net"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/streaming/pkg/httpstream"
+
+	"github.com/mxk/go-flowrate/flowrate"
+
+	"k8s.io/klog/v2"
+)
+
+// UpgradeRequestRoundTripper provides an additional method to decorate a request
+// with any authentication or other protocol level information prior to performing
+// an upgrade on the server. Any response will be handled by the intercepting
+// proxy.
+type UpgradeRequestRoundTripper interface {
+	http.RoundTripper
+	// WrapRequest takes a valid HTTP request and returns a suitably altered version
+	// of request with any HTTP level values required to complete the request half of
+	// an upgrade on the server. It does not get a chance to see the response and
+	// should bypass any request side logic that expects to see the response.
+	WrapRequest(*http.Request) (*http.Request, error)
+}
+
+// UpgradeAwareHandler is a handler for proxy requests that may require an upgrade
+type UpgradeAwareHandler struct {
+	// UpgradeRequired will reject non-upgrade connections if true.
+	UpgradeRequired bool
+	// Location is the location of the upstream proxy. It is used as the location to Dial on the upstream server
+	// for upgrade requests unless UseRequestLocationOnUpgrade is true.
+	Location *url.URL
+	// AppendLocationPath determines if the original path of the Location should be appended to the upstream proxy request path
+	AppendLocationPath bool
+	// Transport provides an optional round tripper to use to proxy. If nil, the default proxy transport is used
+	Transport http.RoundTripper
+	// UpgradeTransport, if specified, will be used as the backend transport when upgrade requests are provided.
+	// This allows clients to disable HTTP/2.
+	UpgradeTransport UpgradeRequestRoundTripper
+	// WrapTransport indicates whether the provided Transport should be wrapped with default proxy transport behavior (URL rewriting, X-Forwarded-* header setting)
+	WrapTransport bool
+	// UseRequestLocation will use the incoming request URL when talking to the backend server.
+	UseRequestLocation bool
+	// UseLocationHost overrides the HTTP host header in requests to the backend server to use the Host from Location.
+	// This will override the req.Host field of a request, while UseRequestLocation will override the req.URL field
+	// of a request. The req.URL.Host specifies the server to connect to, while the req.Host field
+	// specifies the Host header value to send in the HTTP request. If this is false, the incoming req.Host header will
+	// just be forwarded to the backend server.
+	UseLocationHost bool
+	// FlushInterval controls how often the standard HTTP proxy will flush content from the upstream.
+	FlushInterval time.Duration
+	// MaxBytesPerSec controls the maximum rate for an upstream connection. No rate is imposed if the value is zero.
+	MaxBytesPerSec int64
+	// Responder is passed errors that occur while setting up proxying.
+	Responder ErrorResponder
+	// Reject to forward redirect response
+	RejectForwardingRedirects bool
+}
+
+const defaultFlushInterval = 200 * time.Millisecond
+
+// ErrorResponder abstracts error reporting to the proxy handler to remove the need to hardcode a particular
+// error format.
+type ErrorResponder interface {
+	Error(w http.ResponseWriter, req *http.Request, err error)
+}
+
+// SimpleErrorResponder is the legacy implementation of ErrorResponder for callers that only
+// service a single request/response per proxy.
+type SimpleErrorResponder interface {
+	Error(err error)
+}
+
+func NewErrorResponder(r SimpleErrorResponder) ErrorResponder {
+	return simpleResponder{r}
+}
+
+type simpleResponder struct {
+	responder SimpleErrorResponder
+}
+
+func (r simpleResponder) Error(w http.ResponseWriter, req *http.Request, err error) {
+	r.responder.Error(err)
+}
+
+// upgradeRequestRoundTripper implements proxy.UpgradeRequestRoundTripper.
+type upgradeRequestRoundTripper struct {
+	http.RoundTripper
+	upgrader http.RoundTripper
+}
+
+var (
+	_ UpgradeRequestRoundTripper  = &upgradeRequestRoundTripper{}
+	_ utilnet.RoundTripperWrapper = &upgradeRequestRoundTripper{}
+)
+
+// WrappedRoundTripper returns the round tripper that a caller would use.
+func (rt *upgradeRequestRoundTripper) WrappedRoundTripper() http.RoundTripper {
+	return rt.RoundTripper
+}
+
+// WriteToRequest calls the nested upgrader and then copies the returned request
+// fields onto the passed request.
+func (rt *upgradeRequestRoundTripper) WrapRequest(req *http.Request) (*http.Request, error) {
+	resp, err := rt.upgrader.RoundTrip(req)
+	if err != nil {
+		return nil, err
+	}
+	return resp.Request, nil
+}
+
+// onewayRoundTripper captures the provided request - which is assumed to have
+// been modified by other round trippers - and then returns a fake response.
+type onewayRoundTripper struct{}
+
+// RoundTrip returns a simple 200 OK response that captures the provided request.
+func (onewayRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	return &http.Response{
+		Status:     "200 OK",
+		StatusCode: http.StatusOK,
+		Body:       io.NopCloser(&bytes.Buffer{}),
+		Request:    req,
+	}, nil
+}
+
+// MirrorRequest is a round tripper that can be called to get back the calling request as
+// the core round tripper in a chain.
+var MirrorRequest http.RoundTripper = onewayRoundTripper{}
+
+// NewUpgradeRequestRoundTripper takes two round trippers - one for the underlying TCP connection, and
+// one that is able to write headers to an HTTP request. The request rt is used to set the request headers
+// and that is written to the underlying connection rt.
+func NewUpgradeRequestRoundTripper(connection, request http.RoundTripper) UpgradeRequestRoundTripper {
+	return &upgradeRequestRoundTripper{
+		RoundTripper: connection,
+		upgrader:     request,
+	}
+}
+
+// normalizeLocation returns the result of parsing the full URL, with scheme set to http if missing
+func normalizeLocation(location *url.URL) *url.URL {
+	normalized, _ := url.Parse(location.String())
+	if len(normalized.Scheme) == 0 {
+		normalized.Scheme = "http"
+	}
+	return normalized
+}
+
+// NewUpgradeAwareHandler creates a new proxy handler with a default flush interval. Responder is required for returning
+// errors to the caller.
+func NewUpgradeAwareHandler(location *url.URL, transport http.RoundTripper, wrapTransport, upgradeRequired bool, responder ErrorResponder) *UpgradeAwareHandler {
+	return &UpgradeAwareHandler{
+		Location:        normalizeLocation(location),
+		Transport:       transport,
+		WrapTransport:   wrapTransport,
+		UpgradeRequired: upgradeRequired,
+		FlushInterval:   defaultFlushInterval,
+		Responder:       responder,
+	}
+}
+
+func proxyRedirectsforRootPath(path string, w http.ResponseWriter, req *http.Request) bool {
+	redirect := false
+	method := req.Method
+
+	// From pkg/genericapiserver/endpoints/handlers/proxy.go#ServeHTTP:
+	// Redirect requests with an empty path to a location that ends with a '/'
+	// This is essentially a hack for https://issue.k8s.io/4958.
+	// Note: Keep this code after tryUpgrade to not break that flow.
+	if len(path) == 0 && (method == http.MethodGet || method == http.MethodHead) {
+		var queryPart string
+		if len(req.URL.RawQuery) > 0 {
+			queryPart = "?" + req.URL.RawQuery
+		}
+		w.Header().Set("Location", req.URL.Path+"/"+queryPart)
+		w.WriteHeader(http.StatusMovedPermanently)
+		redirect = true
+	}
+	return redirect
+}
+
+// ServeHTTP handles the proxy request
+func (h *UpgradeAwareHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
+	if h.tryUpgrade(w, req) {
+		return
+	}
+	if h.UpgradeRequired {
+		h.Responder.Error(w, req, errors.NewBadRequest("Upgrade request required"))
+		return
+	}
+
+	loc := *h.Location
+	loc.RawQuery = req.URL.RawQuery
+
+	// If original request URL ended in '/', append a '/' at the end of the
+	// of the proxy URL
+	if !strings.HasSuffix(loc.Path, "/") && strings.HasSuffix(req.URL.Path, "/") {
+		loc.Path += "/"
+	}
+
+	proxyRedirect := proxyRedirectsforRootPath(loc.Path, w, req)
+	if proxyRedirect {
+		return
+	}
+
+	if h.Transport == nil || h.WrapTransport {
+		h.Transport = h.defaultProxyTransport(req.URL, h.Transport)
+	}
+
+	// WithContext creates a shallow clone of the request with the same context.
+	newReq := req.WithContext(req.Context())
+	newReq.Header = utilnet.CloneHeader(req.Header)
+	if !h.UseRequestLocation {
+		newReq.URL = &loc
+	}
+	if h.UseLocationHost {
+		// exchanging req.Host with the backend location is necessary for backends that act on the HTTP host header (e.g. API gateways),
+		// because req.Host has preference over req.URL.Host in filling this header field
+		newReq.Host = h.Location.Host
+	}
+
+	// create the target location to use for the reverse proxy
+	reverseProxyLocation := &url.URL{Scheme: h.Location.Scheme, Host: h.Location.Host}
+	if h.AppendLocationPath {
+		reverseProxyLocation.Path = h.Location.Path
+	}
+
+	proxy := httputil.NewSingleHostReverseProxy(reverseProxyLocation)
+	proxy.Transport = h.Transport
+	proxy.FlushInterval = h.FlushInterval
+	proxy.ErrorLog = log.New(noSuppressPanicError{}, "", log.LstdFlags)
+	if h.RejectForwardingRedirects {
+		oldModifyResponse := proxy.ModifyResponse
+		proxy.ModifyResponse = func(response *http.Response) error {
+			code := response.StatusCode
+			if code >= 300 && code <= 399 && len(response.Header.Get("Location")) > 0 {
+				// close the original response
+				response.Body.Close()
+				msg := "the backend attempted to redirect this request, which is not permitted"
+				// replace the response
+				*response = http.Response{
+					StatusCode:    http.StatusBadGateway,
+					Status:        fmt.Sprintf("%d %s", response.StatusCode, http.StatusText(response.StatusCode)),
+					Body:          io.NopCloser(strings.NewReader(msg)),
+					ContentLength: int64(len(msg)),
+				}
+			} else {
+				if oldModifyResponse != nil {
+					if err := oldModifyResponse(response); err != nil {
+						return err
+					}
+				}
+			}
+			return nil
+		}
+	}
+	if h.Responder != nil {
+		// if an optional error interceptor/responder was provided wire it
+		// the custom responder might be used for providing a unified error reporting
+		// or supporting retry mechanisms by not sending non-fatal errors to the clients
+		proxy.ErrorHandler = h.Responder.Error
+	}
+	proxy.ServeHTTP(w, newReq)
+}
+
+type noSuppressPanicError struct{}
+
+func (noSuppressPanicError) Write(p []byte) (n int, err error) {
+	// skip "suppressing panic for copyResponse error in test; copy error" error message
+	// that ends up in CI tests on each kube-apiserver termination as noise and
+	// everybody thinks this is fatal.
+	if strings.Contains(string(p), "suppressing panic") {
+		return len(p), nil
+	}
+	return os.Stderr.Write(p)
+}
+
+// tryUpgrade returns true if the request was handled.
+func (h *UpgradeAwareHandler) tryUpgrade(w http.ResponseWriter, req *http.Request) bool {
+	logger := klog.FromContext(req.Context())
+	if !httpstream.IsUpgradeRequest(req) {
+		logger.V(6).Info("Request was not an upgrade")
+		return false
+	}
+
+	var (
+		backendConn net.Conn
+		rawResponse []byte
+		err         error
+	)
+
+	location := *h.Location
+	if h.UseRequestLocation {
+		location = *req.URL
+		location.Scheme = h.Location.Scheme
+		location.Host = h.Location.Host
+		if h.AppendLocationPath {
+			location.Path = singleJoiningSlash(h.Location.Path, location.Path)
+		}
+	}
+
+	clone := utilnet.CloneRequest(req)
+	// Only append X-Forwarded-For in the upgrade path, since httputil.NewSingleHostReverseProxy
+	// handles this in the non-upgrade path.
+	utilnet.AppendForwardedForHeader(clone)
+	logger.V(6).Info("Connecting to backend proxy (direct dial)", "location", &location, "headers", clone.Header)
+	if h.UseLocationHost {
+		clone.Host = h.Location.Host
+	}
+	clone.URL = &location
+	logger.V(6).Info("UpgradeAwareProxy: dialing for SPDY upgrade with headers", "headers", clone.Header)
+	backendConn, err = h.DialForUpgrade(clone)
+	if err != nil {
+		logger.V(6).Info("Proxy connection error", "err", err)
+		h.Responder.Error(w, req, err)
+		return true
+	}
+	defer backendConn.Close()
+
+	// determine the http response code from the backend by reading from rawResponse+backendConn
+	backendHTTPResponse, headerBytes, err := getResponse(io.MultiReader(bytes.NewReader(rawResponse), backendConn))
+	if err != nil {
+		logger.V(6).Info("Proxy connection error", "err", err)
+		h.Responder.Error(w, req, err)
+		return true
+	}
+	if len(headerBytes) > len(rawResponse) {
+		// we read beyond the bytes stored in rawResponse, update rawResponse to the full set of bytes read from the backend
+		rawResponse = headerBytes
+	}
+
+	// If the backend did not upgrade the request, return an error to the client. If the response was
+	// an error, the error is forwarded directly after the connection is hijacked. Otherwise, just
+	// return a generic error here.
+	if backendHTTPResponse.StatusCode != http.StatusSwitchingProtocols && backendHTTPResponse.StatusCode < 400 {
+		err := fmt.Errorf("invalid upgrade response: status code %d", backendHTTPResponse.StatusCode)
+		logger.Error(err, "Proxy upgrade error")
+		h.Responder.Error(w, req, err)
+		return true
+	}
+
+	// Once the connection is hijacked, the ErrorResponder will no longer work, so
+	// hijacking should be the last step in the upgrade.
+	requestHijacker, ok := w.(http.Hijacker)
+	if !ok {
+		logger.Error(nil, "Unable to hijack response writer", "type", fmt.Sprintf("%T", w))
+		h.Responder.Error(w, req, fmt.Errorf("request connection cannot be hijacked: %T", w))
+		return true
+	}
+	requestHijackedConn, _, err := requestHijacker.Hijack()
+	if err != nil {
+		logger.Error(err, "Unable to hijack response")
+		h.Responder.Error(w, req, fmt.Errorf("error hijacking connection: %v", err))
+		return true
+	}
+	defer requestHijackedConn.Close()
+
+	if backendHTTPResponse.StatusCode != http.StatusSwitchingProtocols {
+		// If the backend did not upgrade the request, echo the response from the backend to the client and return, closing the connection.
+		logger.V(6).Info("Proxy upgrade error", "statusCode", backendHTTPResponse.StatusCode)
+		// set read/write deadlines
+		deadline := time.Now().Add(10 * time.Second)
+		backendConn.SetReadDeadline(deadline)
+		requestHijackedConn.SetWriteDeadline(deadline)
+		// write the response to the client
+		err := backendHTTPResponse.Write(requestHijackedConn)
+		if err != nil && !strings.Contains(err.Error(), "use of closed network connection") {
+			logger.Error(err, "Error proxying data from backend to client")
+		}
+		// Indicate we handled the request
+		return true
+	}
+
+	// Forward raw response bytes back to client.
+	if len(rawResponse) > 0 {
+		logger.V(6).Info("Writing to hijacked connection", "length", len(rawResponse))
+		if _, err = requestHijackedConn.Write(rawResponse); err != nil {
+			utilruntime.HandleErrorWithLogger(logger, err, "Error proxying response from backend to client")
+		}
+	}
+
+	// Proxy the connection. This is bidirectional, so we need a goroutine
+	// to copy in each direction. Once one side of the connection exits, we
+	// exit the function which performs cleanup and in the process closes
+	// the other half of the connection in the defer.
+	writerComplete := make(chan struct{})
+	readerComplete := make(chan struct{})
+
+	go func() {
+		var writer io.WriteCloser
+		if h.MaxBytesPerSec > 0 {
+			writer = flowrate.NewWriter(backendConn, h.MaxBytesPerSec)
+		} else {
+			writer = backendConn
+		}
+		_, err := io.Copy(writer, requestHijackedConn)
+		if err != nil && !strings.Contains(err.Error(), "use of closed network connection") {
+			logger.Error(err, "Error proxying data from client to backend")
+		}
+		close(writerComplete)
+	}()
+
+	go func() {
+		var reader io.ReadCloser
+		if h.MaxBytesPerSec > 0 {
+			reader = flowrate.NewReader(backendConn, h.MaxBytesPerSec)
+		} else {
+			reader = backendConn
+		}
+		_, err := io.Copy(requestHijackedConn, reader)
+		if err != nil && !strings.Contains(err.Error(), "use of closed network connection") {
+			logger.Error(err, "Error proxying data from backend to client")
+		}
+		close(readerComplete)
+	}()
+
+	// Wait for one half the connection to exit. Once it does the defer will
+	// clean up the other half of the connection.
+	select {
+	case <-writerComplete:
+	case <-readerComplete:
+	}
+	logger.V(6).Info("Disconnecting from backend proxy", "location", &location, "headers", clone.Header)
+
+	return true
+}
+
+// FIXME: Taken from net/http/httputil/reverseproxy.go as singleJoiningSlash is not exported to be re-used.
+// See-also: https://github.com/golang/go/issues/44290
+func singleJoiningSlash(a, b string) string {
+	aslash := strings.HasSuffix(a, "/")
+	bslash := strings.HasPrefix(b, "/")
+	switch {
+	case aslash && bslash:
+		return a + b[1:]
+	case !aslash && !bslash:
+		return a + "/" + b
+	}
+	return a + b
+}
+
+func (h *UpgradeAwareHandler) DialForUpgrade(req *http.Request) (net.Conn, error) {
+	if h.UpgradeTransport == nil {
+		return dial(req, h.Transport)
+	}
+	updatedReq, err := h.UpgradeTransport.WrapRequest(req)
+	if err != nil {
+		return nil, err
+	}
+	return dial(updatedReq, h.UpgradeTransport)
+}
+
+// getResponseCode reads a http response from the given reader, returns the response,
+// the bytes read from the reader, and any error encountered
+func getResponse(r io.Reader) (*http.Response, []byte, error) {
+	rawResponse := bytes.NewBuffer(make([]byte, 0, 256))
+	// Save the bytes read while reading the response headers into the rawResponse buffer
+	resp, err := http.ReadResponse(bufio.NewReader(io.TeeReader(r, rawResponse)), nil)
+	if err != nil {
+		return nil, nil, err
+	}
+	// return the http response and the raw bytes consumed from the reader in the process
+	return resp, rawResponse.Bytes(), nil
+}
+
+// dial dials the backend at req.URL and writes req to it.
+func dial(req *http.Request, transport http.RoundTripper) (net.Conn, error) {
+	conn, err := DialURL(req.Context(), req.URL, transport)
+	if err != nil {
+		return nil, fmt.Errorf("error dialing backend: %v", err)
+	}
+
+	if err = req.Write(conn); err != nil {
+		conn.Close()
+		return nil, fmt.Errorf("error sending request: %v", err)
+	}
+
+	return conn, err
+}
+
+func (h *UpgradeAwareHandler) defaultProxyTransport(url *url.URL, internalTransport http.RoundTripper) http.RoundTripper {
+	scheme := url.Scheme
+	host := url.Host
+	suffix := h.Location.Path
+	if strings.HasSuffix(url.Path, "/") && !strings.HasSuffix(suffix, "/") {
+		suffix += "/"
+	}
+	pathPrepend := strings.TrimSuffix(url.Path, suffix)
+	rewritingTransport := &Transport{
+		Scheme:       scheme,
+		Host:         host,
+		PathPrepend:  pathPrepend,
+		RoundTripper: internalTransport,
+	}
+	return &corsRemovingTransport{
+		RoundTripper: rewritingTransport,
+	}
+}
+
+// corsRemovingTransport is a wrapper for an internal transport. It removes CORS headers
+// from the internal response.
+// Implements pkg/util/net.RoundTripperWrapper
+type corsRemovingTransport struct {
+	http.RoundTripper
+}
+
+var _ = utilnet.RoundTripperWrapper(&corsRemovingTransport{})
+
+func (rt *corsRemovingTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	resp, err := rt.RoundTripper.RoundTrip(req)
+	if err != nil {
+		return nil, err
+	}
+	removeCORSHeaders(resp)
+	return resp, nil
+}
+
+func (rt *corsRemovingTransport) WrappedRoundTripper() http.RoundTripper {
+	return rt.RoundTripper
+}
+
+// removeCORSHeaders strip CORS headers sent from the backend
+// This should be called on all responses before returning
+func removeCORSHeaders(resp *http.Response) {
+	resp.Header.Del("Access-Control-Allow-Credentials")
+	resp.Header.Del("Access-Control-Allow-Headers")
+	resp.Header.Del("Access-Control-Allow-Methods")
+	resp.Header.Del("Access-Control-Allow-Origin")
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/proxy/upgradeaware_test.go b/third_party/k8s.io/apimachinery/pkg/util/proxy/upgradeaware_test.go
new file mode 100644
index 0000000000..4a0f821feb
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/proxy/upgradeaware_test.go
@@ -0,0 +1,1261 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package proxy
+
+import (
+	"bufio"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/http/httputil"
+	"net/url"
+	"reflect"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"golang.org/x/net/websocket"
+
+	utilnet "k8s.io/apimachinery/pkg/util/net"
+	"k8s.io/streaming/pkg/httpstream"
+)
+
+const fakeStatusCode = 567
+
+type fakeResponder struct {
+	t      *testing.T
+	called bool
+	err    error
+	// called chan error
+	w http.ResponseWriter
+}
+
+func (r *fakeResponder) Error(w http.ResponseWriter, req *http.Request, err error) {
+	if r.called {
+		r.t.Errorf("Error responder called again!\nprevious error: %v\nnew error: %v", r.err, err)
+	}
+
+	w.WriteHeader(fakeStatusCode)
+	_, writeErr := w.Write([]byte(err.Error()))
+	assert.NoError(r.t, writeErr)
+
+	r.called = true
+	r.err = err
+}
+
+type fakeConn struct {
+	err error // The error to return when io is performed over the connection.
+}
+
+func (f *fakeConn) Read([]byte) (int, error)        { return 0, f.err }
+func (f *fakeConn) Write([]byte) (int, error)       { return 0, f.err }
+func (f *fakeConn) Close() error                    { return nil }
+func (fakeConn) LocalAddr() net.Addr                { return nil }
+func (fakeConn) RemoteAddr() net.Addr               { return nil }
+func (fakeConn) SetDeadline(t time.Time) error      { return nil }
+func (fakeConn) SetReadDeadline(t time.Time) error  { return nil }
+func (fakeConn) SetWriteDeadline(t time.Time) error { return nil }
+
+type SimpleBackendHandler struct {
+	requestURL     url.URL
+	requestHost    string
+	requestHeader  http.Header
+	requestBody    []byte
+	requestMethod  string
+	responseBody   string
+	responseHeader map[string]string
+	t              *testing.T
+}
+
+func (s *SimpleBackendHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
+	s.requestURL = *req.URL
+	s.requestHost = req.Host
+	s.requestHeader = req.Header
+	s.requestMethod = req.Method
+	var err error
+	s.requestBody, err = io.ReadAll(req.Body)
+	if err != nil {
+		s.t.Errorf("Unexpected error: %v", err)
+		return
+	}
+
+	if s.responseHeader != nil {
+		for k, v := range s.responseHeader {
+			w.Header().Add(k, v)
+		}
+	}
+	w.Write([]byte(s.responseBody))
+}
+
+func validateParameters(t *testing.T, name string, actual url.Values, expected map[string]string) {
+	for k, v := range expected {
+		actualValue, ok := actual[k]
+		if !ok {
+			t.Errorf("%s: Expected parameter %s not received", name, k)
+			continue
+		}
+		if actualValue[0] != v {
+			t.Errorf("%s: Parameter %s values don't match. Actual: %#v, Expected: %s",
+				name, k, actualValue, v)
+		}
+	}
+}
+
+func validateHeaders(t *testing.T, name string, actual http.Header, expected map[string]string, notExpected []string) {
+	for k, v := range expected {
+		actualValue, ok := actual[k]
+		if !ok {
+			t.Errorf("%s: Expected header %s not received", name, k)
+			continue
+		}
+		if actualValue[0] != v {
+			t.Errorf("%s: Header %s values don't match. Actual: %s, Expected: %s",
+				name, k, actualValue, v)
+		}
+	}
+	if notExpected == nil {
+		return
+	}
+	for _, h := range notExpected {
+		if _, present := actual[h]; present {
+			t.Errorf("%s: unexpected header: %s", name, h)
+		}
+	}
+}
+
+func TestServeHTTP(t *testing.T) {
+	tests := []struct {
+		name                  string
+		method                string
+		requestPath           string
+		expectedPath          string
+		requestBody           string
+		requestParams         map[string]string
+		requestHeader         map[string]string
+		responseHeader        map[string]string
+		expectedRespHeader    map[string]string
+		notExpectedRespHeader []string
+		upgradeRequired       bool
+		appendLocationPath    bool
+		expectError           func(err error) bool
+		useLocationHost       bool
+	}{
+		{
+			name:         "root path, simple get",
+			method:       http.MethodGet,
+			requestPath:  "/",
+			expectedPath: "/",
+		},
+		{
+			name:            "no upgrade header sent",
+			method:          http.MethodGet,
+			requestPath:     "/",
+			upgradeRequired: true,
+			expectError: func(err error) bool {
+				return err != nil && strings.Contains(err.Error(), "Upgrade request required")
+			},
+		},
+		{
+			name:         "simple path, get",
+			method:       http.MethodGet,
+			requestPath:  "/path/to/test",
+			expectedPath: "/path/to/test",
+		},
+		{
+			name:          "request params",
+			method:        http.MethodPost,
+			requestPath:   "/some/path/",
+			expectedPath:  "/some/path/",
+			requestParams: map[string]string{"param1": "value/1", "param2": "value%2"},
+			requestBody:   "test request body",
+		},
+		{
+			name:          "request headers",
+			method:        http.MethodPut,
+			requestPath:   "/some/path",
+			expectedPath:  "/some/path",
+			requestHeader: map[string]string{"Header1": "value1", "Header2": "value2"},
+		},
+		{
+			name:         "empty path - slash should be added",
+			method:       http.MethodGet,
+			requestPath:  "",
+			expectedPath: "/",
+		},
+		{
+			name:         "remove CORS headers",
+			method:       http.MethodGet,
+			requestPath:  "/some/path",
+			expectedPath: "/some/path",
+			responseHeader: map[string]string{
+				"Header1":                      "value1",
+				"Access-Control-Allow-Origin":  "some.server",
+				"Access-Control-Allow-Methods": http.MethodGet},
+			expectedRespHeader: map[string]string{
+				"Header1": "value1",
+			},
+			notExpectedRespHeader: []string{
+				"Access-Control-Allow-Origin",
+				"Access-Control-Allow-Methods",
+			},
+		},
+		{
+			name:            "use location host",
+			method:          http.MethodGet,
+			requestPath:     "/some/path",
+			expectedPath:    "/some/path",
+			useLocationHost: true,
+		},
+		{
+			name:            "use location host - invalid upgrade",
+			method:          http.MethodGet,
+			upgradeRequired: true,
+			requestHeader: map[string]string{
+				httpstream.HeaderConnection: httpstream.HeaderUpgrade,
+			},
+			expectError: func(err error) bool {
+				return err != nil && strings.Contains(err.Error(), "invalid upgrade response: status code 200")
+			},
+			requestPath:     "/some/path",
+			expectedPath:    "/some/path",
+			useLocationHost: true,
+		},
+		{
+			name:               "append server path to request path",
+			method:             http.MethodGet,
+			requestPath:        "/base",
+			expectedPath:       "/base/base",
+			appendLocationPath: true,
+		},
+		{
+			name:               "append server path to request path with ending slash",
+			method:             http.MethodGet,
+			requestPath:        "/base/",
+			expectedPath:       "/base/base/",
+			appendLocationPath: true,
+		},
+		{
+			name:               "don't append server path to request path",
+			method:             http.MethodGet,
+			requestPath:        "/base",
+			expectedPath:       "/base",
+			appendLocationPath: false,
+		},
+	}
+
+	for i, test := range tests {
+		func() {
+			backendResponse := "<html><head></head><body><a href=\"/test/path\">Hello</a></body></html>"
+			backendResponseHeader := test.responseHeader
+			// Test a simple header if not specified in the test
+			if backendResponseHeader == nil && test.expectedRespHeader == nil {
+				backendResponseHeader = map[string]string{"Content-Type": "text/html"}
+				test.expectedRespHeader = map[string]string{"Content-Type": "text/html"}
+			}
+			backendHandler := &SimpleBackendHandler{
+				responseBody:   backendResponse,
+				responseHeader: backendResponseHeader,
+			}
+			backendServer := httptest.NewServer(backendHandler)
+			defer backendServer.Close()
+
+			responder := &fakeResponder{t: t}
+			backendURL, _ := url.Parse(backendServer.URL)
+			backendURL.Path = test.requestPath
+			proxyHandler := NewUpgradeAwareHandler(backendURL, nil, false, test.upgradeRequired, responder)
+			proxyHandler.UseLocationHost = test.useLocationHost
+			proxyHandler.AppendLocationPath = test.appendLocationPath
+			proxyServer := httptest.NewServer(proxyHandler)
+			defer proxyServer.Close()
+			proxyURL, _ := url.Parse(proxyServer.URL)
+			proxyURL.Path = test.requestPath
+			paramValues := url.Values{}
+			for k, v := range test.requestParams {
+				paramValues[k] = []string{v}
+			}
+			proxyURL.RawQuery = paramValues.Encode()
+			var requestBody io.Reader
+			if test.requestBody != "" {
+				requestBody = bytes.NewBufferString(test.requestBody)
+			}
+			req, err := http.NewRequest(test.method, proxyURL.String(), requestBody)
+			if test.requestHeader != nil {
+				header := http.Header{}
+				for k, v := range test.requestHeader {
+					header.Add(k, v)
+				}
+				req.Header = header
+			}
+			if err != nil {
+				t.Errorf("Error creating client request: %v", err)
+			}
+			client := &http.Client{}
+			res, err := client.Do(req)
+			if err != nil {
+				t.Errorf("Error from proxy request: %v", err)
+			}
+
+			// Host
+			if test.useLocationHost && backendHandler.requestHost != backendURL.Host {
+				t.Errorf("Unexpected request host: %s", backendHandler.requestHost)
+			} else if !test.useLocationHost && backendHandler.requestHost == backendURL.Host {
+				t.Errorf("Unexpected request host: %s", backendHandler.requestHost)
+			}
+
+			if test.expectError != nil {
+				if !responder.called {
+					t.Errorf("%d: responder was not invoked", i)
+					return
+				}
+				if !test.expectError(responder.err) {
+					t.Errorf("%d: unexpected error: %v", i, responder.err)
+				}
+				return
+			}
+
+			// Validate backend request
+			// Method
+			if backendHandler.requestMethod != test.method {
+				t.Errorf("Unexpected request method: %s. Expected: %s",
+					backendHandler.requestMethod, test.method)
+			}
+
+			// Body
+			if string(backendHandler.requestBody) != test.requestBody {
+				t.Errorf("Unexpected request body: %s. Expected: %s",
+					string(backendHandler.requestBody), test.requestBody)
+			}
+
+			// Path
+			if backendHandler.requestURL.Path != test.expectedPath {
+				t.Errorf("Unexpected request path: %s", backendHandler.requestURL.Path)
+			}
+			// Parameters
+			validateParameters(t, test.name, backendHandler.requestURL.Query(), test.requestParams)
+
+			// Headers
+			validateHeaders(t, test.name+" backend request", backendHandler.requestHeader,
+				test.requestHeader, nil)
+
+			// Validate proxy response
+
+			// Response Headers
+			validateHeaders(t, test.name+" backend headers", res.Header, test.expectedRespHeader, test.notExpectedRespHeader)
+
+			// Validate Body
+			responseBody, err := io.ReadAll(res.Body)
+			if err != nil {
+				t.Errorf("Unexpected error reading response body: %v", err)
+			}
+			if rb := string(responseBody); rb != backendResponse {
+				t.Errorf("Did not get expected response body: %s. Expected: %s", rb, backendResponse)
+			}
+
+			// Error
+			if responder.called {
+				t.Errorf("Unexpected proxy handler error: %v", responder.err)
+			}
+		}()
+	}
+}
+
+type RoundTripperFunc func(req *http.Request) (*http.Response, error)
+
+func (fn RoundTripperFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return fn(req)
+}
+
+func TestProxyUpgrade(t *testing.T) {
+
+	localhostPool := x509.NewCertPool()
+	if !localhostPool.AppendCertsFromPEM(localhostCert) {
+		t.Errorf("error setting up localhostCert pool")
+	}
+	var d net.Dialer
+
+	testcases := map[string]struct {
+		ServerFunc       func(http.Handler) *httptest.Server
+		ProxyTransport   http.RoundTripper
+		UpgradeTransport UpgradeRequestRoundTripper
+		ExpectedAuth     string
+	}{
+		"http": {
+			ServerFunc:     httptest.NewServer,
+			ProxyTransport: nil,
+		},
+		"both client and server support http2, but force to http/1.1 for upgrade": {
+			ServerFunc: func(h http.Handler) *httptest.Server {
+				cert, err := tls.X509KeyPair(exampleCert, exampleKey)
+				if err != nil {
+					t.Errorf("https (invalid hostname): proxy_test: %v", err)
+				}
+				ts := httptest.NewUnstartedServer(h)
+				ts.TLS = &tls.Config{
+					Certificates: []tls.Certificate{cert},
+					NextProtos:   []string{"http2", "http/1.1"},
+				}
+				ts.StartTLS()
+				return ts
+			},
+			ProxyTransport: utilnet.SetTransportDefaults(&http.Transport{TLSClientConfig: &tls.Config{
+				NextProtos:         []string{"http2", "http/1.1"},
+				InsecureSkipVerify: true,
+			}}),
+		},
+		"https (invalid hostname + InsecureSkipVerify)": {
+			ServerFunc: func(h http.Handler) *httptest.Server {
+				cert, err := tls.X509KeyPair(exampleCert, exampleKey)
+				if err != nil {
+					t.Errorf("https (invalid hostname): proxy_test: %v", err)
+				}
+				ts := httptest.NewUnstartedServer(h)
+				ts.TLS = &tls.Config{
+					Certificates: []tls.Certificate{cert},
+				}
+				ts.StartTLS()
+				return ts
+			},
+			ProxyTransport: utilnet.SetTransportDefaults(&http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}),
+		},
+		"https (valid hostname + RootCAs)": {
+			ServerFunc: func(h http.Handler) *httptest.Server {
+				cert, err := tls.X509KeyPair(localhostCert, localhostKey)
+				if err != nil {
+					t.Errorf("https (valid hostname): proxy_test: %v", err)
+				}
+				ts := httptest.NewUnstartedServer(h)
+				ts.TLS = &tls.Config{
+					Certificates: []tls.Certificate{cert},
+				}
+				ts.StartTLS()
+				return ts
+			},
+			ProxyTransport: utilnet.SetTransportDefaults(&http.Transport{TLSClientConfig: &tls.Config{RootCAs: localhostPool}}),
+		},
+		"https (valid hostname + RootCAs + custom dialer)": {
+			ServerFunc: func(h http.Handler) *httptest.Server {
+				cert, err := tls.X509KeyPair(localhostCert, localhostKey)
+				if err != nil {
+					t.Errorf("https (valid hostname): proxy_test: %v", err)
+				}
+				ts := httptest.NewUnstartedServer(h)
+				ts.TLS = &tls.Config{
+					Certificates: []tls.Certificate{cert},
+				}
+				ts.StartTLS()
+				return ts
+			},
+			ProxyTransport: utilnet.SetTransportDefaults(&http.Transport{DialContext: d.DialContext, TLSClientConfig: &tls.Config{RootCAs: localhostPool}}),
+		},
+		"https (valid hostname + RootCAs + custom dialer + bearer token)": {
+			ServerFunc: func(h http.Handler) *httptest.Server {
+				cert, err := tls.X509KeyPair(localhostCert, localhostKey)
+				if err != nil {
+					t.Errorf("https (valid hostname): proxy_test: %v", err)
+				}
+				ts := httptest.NewUnstartedServer(h)
+				ts.TLS = &tls.Config{
+					Certificates: []tls.Certificate{cert},
+				}
+				ts.StartTLS()
+				return ts
+			},
+			ProxyTransport: utilnet.SetTransportDefaults(&http.Transport{DialContext: d.DialContext, TLSClientConfig: &tls.Config{RootCAs: localhostPool}}),
+			UpgradeTransport: NewUpgradeRequestRoundTripper(
+				utilnet.SetOldTransportDefaults(&http.Transport{DialContext: d.DialContext, TLSClientConfig: &tls.Config{RootCAs: localhostPool}}),
+				RoundTripperFunc(func(req *http.Request) (*http.Response, error) {
+					req = utilnet.CloneRequest(req)
+					req.Header.Set("Authorization", "Bearer 1234")
+					return MirrorRequest.RoundTrip(req)
+				}),
+			),
+			ExpectedAuth: "Bearer 1234",
+		},
+	}
+
+	for k, tc := range testcases {
+		tcName := k
+		backendPath := "/hello"
+		func() { // Cleanup after each test case.
+			backend := http.NewServeMux()
+			backend.Handle("/hello", websocket.Handler(func(ws *websocket.Conn) {
+				if ws.Request().Header.Get("Authorization") != tc.ExpectedAuth {
+					t.Errorf("%s: unexpected headers on request: %v", k, ws.Request().Header)
+					defer ws.Close()
+					ws.Write([]byte("you failed"))
+					return
+				}
+				defer ws.Close()
+				body := make([]byte, 5)
+				ws.Read(body)
+				ws.Write([]byte("hello " + string(body)))
+			}))
+			backend.Handle("/redirect", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				http.Redirect(w, r, "/hello", http.StatusFound)
+			}))
+			backendServer := tc.ServerFunc(backend)
+			defer backendServer.Close()
+
+			serverURL, _ := url.Parse(backendServer.URL)
+			serverURL.Path = backendPath
+			proxyHandler := NewUpgradeAwareHandler(serverURL, tc.ProxyTransport, false, false, &noErrorsAllowed{t: t})
+			proxyHandler.UpgradeTransport = tc.UpgradeTransport
+			proxy := httptest.NewServer(proxyHandler)
+			defer proxy.Close()
+
+			ws, err := websocket.Dial("ws://"+proxy.Listener.Addr().String()+"/some/path", "", "http://127.0.0.1/")
+			if err != nil {
+				t.Fatalf("%s: websocket dial err: %s", tcName, err)
+			}
+			defer ws.Close()
+
+			if _, err := ws.Write([]byte("world")); err != nil {
+				t.Fatalf("%s: write err: %s", tcName, err)
+			}
+
+			response := make([]byte, 20)
+			n, err := ws.Read(response)
+			if err != nil {
+				t.Fatalf("%s: read err: %s", tcName, err)
+			}
+			if e, a := "hello world", string(response[0:n]); e != a {
+				t.Fatalf("%s: expected '%#v', got '%#v'", tcName, e, a)
+			}
+		}()
+	}
+}
+
+type noErrorsAllowed struct {
+	t *testing.T
+}
+
+func (r *noErrorsAllowed) Error(w http.ResponseWriter, req *http.Request, err error) {
+	r.t.Error(err)
+}
+
+func TestProxyUpgradeConnectionErrorResponse(t *testing.T) {
+	var (
+		responder   *fakeResponder
+		expectedErr = errors.New("EXPECTED")
+	)
+	proxy := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		transport := &http.Transport{
+			Proxy: http.ProxyFromEnvironment,
+			DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+				return &fakeConn{err: expectedErr}, nil
+			},
+			MaxIdleConns:          100,
+			IdleConnTimeout:       90 * time.Second,
+			TLSHandshakeTimeout:   10 * time.Second,
+			ExpectContinueTimeout: 1 * time.Second,
+		}
+		responder = &fakeResponder{t: t, w: w}
+		proxyHandler := NewUpgradeAwareHandler(
+			&url.URL{
+				Host: "fake-backend",
+			},
+			transport,
+			false,
+			true,
+			responder,
+		)
+		proxyHandler.ServeHTTP(w, r)
+	}))
+	defer proxy.Close()
+
+	// Send request to proxy server.
+	req, err := http.NewRequest(http.MethodPost, "http://"+proxy.Listener.Addr().String()+"/some/path", nil)
+	require.NoError(t, err)
+	req.Header.Set(httpstream.HeaderConnection, httpstream.HeaderUpgrade)
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	// Expect error response.
+	assert.True(t, responder.called)
+	assert.Equal(t, fakeStatusCode, resp.StatusCode)
+	msg, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	assert.Contains(t, string(msg), expectedErr.Error())
+}
+
+func TestProxyUpgradeErrorResponseTerminates(t *testing.T) {
+	for _, code := range []int{400, 500} {
+		t.Run(fmt.Sprintf("code=%v", code), func(t *testing.T) {
+			// Set up a backend server
+			backend := http.NewServeMux()
+			backend.Handle("/hello", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(code)
+				w.Write([]byte(`some data`))
+			}))
+			backend.Handle("/there", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				t.Error("request to /there")
+			}))
+			backendServer := httptest.NewServer(backend)
+			defer backendServer.Close()
+			backendServerURL, _ := url.Parse(backendServer.URL)
+			backendServerURL.Path = "/hello"
+
+			// Set up a proxy pointing to a specific path on the backend
+			proxyHandler := NewUpgradeAwareHandler(backendServerURL, nil, false, false, &noErrorsAllowed{t: t})
+			proxy := httptest.NewServer(proxyHandler)
+			defer proxy.Close()
+			proxyURL, _ := url.Parse(proxy.URL)
+
+			conn, err := net.Dial("tcp", proxyURL.Host)
+			require.NoError(t, err)
+			bufferedReader := bufio.NewReader(conn)
+
+			// Send upgrade request resulting in a non-101 response from the backend
+			req, _ := http.NewRequest(http.MethodGet, "/", nil)
+			req.Header.Set(httpstream.HeaderConnection, httpstream.HeaderUpgrade)
+			require.NoError(t, req.Write(conn))
+			// Verify we get the correct response and full message body content
+			resp, err := http.ReadResponse(bufferedReader, nil)
+			require.NoError(t, err)
+			data, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			require.Equal(t, resp.StatusCode, code)
+			require.Equal(t, data, []byte(`some data`))
+			resp.Body.Close()
+
+			// try to read from the connection to verify it was closed
+			b := make([]byte, 1)
+			conn.SetReadDeadline(time.Now().Add(time.Second))
+			if _, err := conn.Read(b); err != io.EOF {
+				t.Errorf("expected EOF, got %v", err)
+			}
+
+			// Send another request to another endpoint to verify it is not received
+			req, _ = http.NewRequest(http.MethodGet, "/there", nil)
+			req.Write(conn)
+			// wait to ensure the handler does not receive the request
+			time.Sleep(time.Second)
+
+			// clean up
+			conn.Close()
+		})
+	}
+}
+
+func TestProxyUpgradeErrorResponse(t *testing.T) {
+	for _, code := range []int{200, 300, 302, 307} {
+		t.Run(fmt.Sprintf("code=%v", code), func(t *testing.T) {
+			// Set up a backend server
+			backend := http.NewServeMux()
+			backend.Handle("/hello", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				http.Redirect(w, r, "https://example.com/there", code)
+			}))
+			backendServer := httptest.NewServer(backend)
+			defer backendServer.Close()
+			backendServerURL, _ := url.Parse(backendServer.URL)
+			backendServerURL.Path = "/hello"
+
+			// Set up a proxy pointing to a specific path on the backend
+			proxyHandler := NewUpgradeAwareHandler(backendServerURL, nil, false, false, &fakeResponder{t: t})
+			proxy := httptest.NewServer(proxyHandler)
+			defer proxy.Close()
+			proxyURL, _ := url.Parse(proxy.URL)
+
+			conn, err := net.Dial("tcp", proxyURL.Host)
+			require.NoError(t, err)
+			bufferedReader := bufio.NewReader(conn)
+
+			// Send upgrade request resulting in a non-101 response from the backend
+			req, _ := http.NewRequest(http.MethodGet, "/", nil)
+			req.Header.Set(httpstream.HeaderConnection, httpstream.HeaderUpgrade)
+			require.NoError(t, req.Write(conn))
+			// Verify we get the correct response and full message body content
+			resp, err := http.ReadResponse(bufferedReader, nil)
+			require.NoError(t, err)
+			assert.Equal(t, fakeStatusCode, resp.StatusCode)
+			resp.Body.Close()
+
+			// clean up
+			conn.Close()
+		})
+	}
+}
+
+func TestRejectForwardingRedirectsOption(t *testing.T) {
+	originalBody := []byte(`some data`)
+	testCases := []struct {
+		name                      string
+		rejectForwardingRedirects bool
+		serverStatusCode          int
+		redirect                  string
+		expectStatusCode          int
+		expectBody                []byte
+	}{
+		{
+			name:                      "reject redirection enabled in proxy, backend server sending 200 response",
+			rejectForwardingRedirects: true,
+			serverStatusCode:          200,
+			expectStatusCode:          200,
+			expectBody:                originalBody,
+		},
+		{
+			name:                      "reject redirection enabled in proxy, backend server sending 301 response",
+			rejectForwardingRedirects: true,
+			serverStatusCode:          301,
+			redirect:                  "/",
+			expectStatusCode:          502,
+			expectBody:                []byte(`the backend attempted to redirect this request, which is not permitted`),
+		},
+		{
+			name:                      "reject redirection enabled in proxy, backend server sending 304 response with a location header",
+			rejectForwardingRedirects: true,
+			serverStatusCode:          304,
+			redirect:                  "/",
+			expectStatusCode:          502,
+			expectBody:                []byte(`the backend attempted to redirect this request, which is not permitted`),
+		},
+		{
+			name:                      "reject redirection enabled in proxy, backend server sending 304 response with no location header",
+			rejectForwardingRedirects: true,
+			serverStatusCode:          304,
+			expectStatusCode:          304,
+			expectBody:                []byte{}, // client doesn't read the body for 304 responses
+		},
+		{
+			name:                      "reject redirection disabled in proxy, backend server sending 200 response",
+			rejectForwardingRedirects: false,
+			serverStatusCode:          200,
+			expectStatusCode:          200,
+			expectBody:                originalBody,
+		},
+		{
+			name:                      "reject redirection disabled in proxy, backend server sending 301 response",
+			rejectForwardingRedirects: false,
+			serverStatusCode:          301,
+			redirect:                  "/",
+			expectStatusCode:          301,
+			expectBody:                originalBody,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Set up a backend server
+			backendServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if tc.redirect != "" {
+					w.Header().Set("Location", tc.redirect)
+				}
+				w.WriteHeader(tc.serverStatusCode)
+				w.Write(originalBody)
+			}))
+			defer backendServer.Close()
+			backendServerURL, _ := url.Parse(backendServer.URL)
+
+			// Set up a proxy pointing to the backend
+			proxyHandler := NewUpgradeAwareHandler(backendServerURL, nil, false, false, &fakeResponder{t: t})
+			proxyHandler.RejectForwardingRedirects = tc.rejectForwardingRedirects
+			proxy := httptest.NewServer(proxyHandler)
+			defer proxy.Close()
+			proxyURL, _ := url.Parse(proxy.URL)
+
+			conn, err := net.Dial("tcp", proxyURL.Host)
+			require.NoError(t, err)
+			bufferedReader := bufio.NewReader(conn)
+
+			req, _ := http.NewRequest(http.MethodGet, proxyURL.String(), nil)
+			require.NoError(t, req.Write(conn))
+			// Verify we get the correct response and message body content
+			resp, err := http.ReadResponse(bufferedReader, nil)
+			require.NoError(t, err)
+			assert.Equal(t, tc.expectStatusCode, resp.StatusCode)
+			data, err := io.ReadAll(resp.Body)
+			require.NoError(t, err)
+			assert.Equal(t, tc.expectBody, data)
+			assert.Equal(t, int64(len(tc.expectBody)), resp.ContentLength)
+			resp.Body.Close()
+
+			// clean up
+			conn.Close()
+		})
+	}
+}
+
+func TestDefaultProxyTransport(t *testing.T) {
+	tests := []struct {
+		name,
+		url,
+		location,
+		expectedScheme,
+		expectedHost,
+		expectedPathPrepend string
+	}{
+		{
+			name:                "simple path",
+			url:                 "http://test.server:8080/a/test/location",
+			location:            "http://localhost/location",
+			expectedScheme:      "http",
+			expectedHost:        "test.server:8080",
+			expectedPathPrepend: "/a/test",
+		},
+		{
+			name:                "empty path",
+			url:                 "http://test.server:8080/a/test/",
+			location:            "http://localhost",
+			expectedScheme:      "http",
+			expectedHost:        "test.server:8080",
+			expectedPathPrepend: "/a/test",
+		},
+		{
+			name:                "location ending in slash",
+			url:                 "http://test.server:8080/a/test/",
+			location:            "http://localhost/",
+			expectedScheme:      "http",
+			expectedHost:        "test.server:8080",
+			expectedPathPrepend: "/a/test",
+		},
+	}
+
+	for _, test := range tests {
+		locURL, _ := url.Parse(test.location)
+		URL, _ := url.Parse(test.url)
+		h := NewUpgradeAwareHandler(locURL, nil, false, false, nil)
+		result := h.defaultProxyTransport(URL, nil)
+		transport := result.(*corsRemovingTransport).RoundTripper.(*Transport)
+		if transport.Scheme != test.expectedScheme {
+			t.Errorf("%s: unexpected scheme. Actual: %s, Expected: %s", test.name, transport.Scheme, test.expectedScheme)
+		}
+		if transport.Host != test.expectedHost {
+			t.Errorf("%s: unexpected host. Actual: %s, Expected: %s", test.name, transport.Host, test.expectedHost)
+		}
+		if transport.PathPrepend != test.expectedPathPrepend {
+			t.Errorf("%s: unexpected path prepend. Actual: %s, Expected: %s", test.name, transport.PathPrepend, test.expectedPathPrepend)
+		}
+	}
+}
+
+func TestProxyRequestContentLengthAndTransferEncoding(t *testing.T) {
+	chunk := func(data []byte) []byte {
+		out := &bytes.Buffer{}
+		chunker := httputil.NewChunkedWriter(out)
+		for _, b := range data {
+			if _, err := chunker.Write([]byte{b}); err != nil {
+				panic(err)
+			}
+		}
+		chunker.Close()
+		out.Write([]byte("\r\n"))
+		return out.Bytes()
+	}
+
+	zip := func(data []byte) []byte {
+		out := &bytes.Buffer{}
+		zipper := gzip.NewWriter(out)
+		if _, err := zipper.Write(data); err != nil {
+			panic(err)
+		}
+		zipper.Close()
+		return out.Bytes()
+	}
+
+	sampleData := []byte("abcde")
+
+	table := map[string]struct {
+		reqHeaders http.Header
+		reqBody    []byte
+
+		expectedHeaders http.Header
+		expectedBody    []byte
+	}{
+		"content-length": {
+			reqHeaders: http.Header{
+				"Content-Length": []string{"5"},
+			},
+			reqBody: sampleData,
+
+			expectedHeaders: http.Header{
+				"Content-Length":    []string{"5"},
+				"Content-Encoding":  nil, // none set
+				"Transfer-Encoding": nil, // none set
+			},
+			expectedBody: sampleData,
+		},
+
+		"content-length + gzip content-encoding": {
+			reqHeaders: http.Header{
+				"Content-Length":   []string{strconv.Itoa(len(zip(sampleData)))},
+				"Content-Encoding": []string{"gzip"},
+			},
+			reqBody: zip(sampleData),
+
+			expectedHeaders: http.Header{
+				"Content-Length":    []string{strconv.Itoa(len(zip(sampleData)))},
+				"Content-Encoding":  []string{"gzip"},
+				"Transfer-Encoding": nil, // none set
+			},
+			expectedBody: zip(sampleData),
+		},
+
+		"chunked transfer-encoding": {
+			reqHeaders: http.Header{
+				"Transfer-Encoding": []string{"chunked"},
+			},
+			reqBody: chunk(sampleData),
+
+			expectedHeaders: http.Header{
+				"Content-Length":    nil, // none set
+				"Content-Encoding":  nil, // none set
+				"Transfer-Encoding": nil, // Transfer-Encoding gets removed
+			},
+			expectedBody: sampleData, // sample data is unchunked
+		},
+
+		"chunked transfer-encoding + gzip content-encoding": {
+			reqHeaders: http.Header{
+				"Content-Encoding":  []string{"gzip"},
+				"Transfer-Encoding": []string{"chunked"},
+			},
+			reqBody: chunk(zip(sampleData)),
+
+			expectedHeaders: http.Header{
+				"Content-Length":    nil, // none set
+				"Content-Encoding":  []string{"gzip"},
+				"Transfer-Encoding": nil, // gets removed
+			},
+			expectedBody: zip(sampleData), // sample data is unchunked, but content-encoding is preserved
+		},
+
+		// "Transfer-Encoding: gzip" is not supported by go
+		// See http/transfer.go#fixTransferEncoding (https://golang.org/src/net/http/transfer.go#L427)
+		// Once it is supported, this test case should succeed
+		//
+		// "gzip+chunked transfer-encoding": {
+		// 	reqHeaders: http.Header{
+		// 		"Transfer-Encoding": []string{"chunked,gzip"},
+		// 	},
+		// 	reqBody: chunk(zip(sampleData)),
+		//
+		// 	expectedHeaders: http.Header{
+		// 		"Content-Length":    nil, // no content-length headers
+		// 		"Transfer-Encoding": nil, // Transfer-Encoding gets removed
+		// 	},
+		// 	expectedBody: sampleData,
+		// },
+	}
+
+	successfulResponse := "backend passed tests"
+	for k, item := range table {
+		// Start the downstream server
+		downstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			// Verify headers
+			for header, v := range item.expectedHeaders {
+				if !reflect.DeepEqual(v, req.Header[header]) {
+					t.Errorf("%s: Expected headers for %s to be %v, got %v", k, header, v, req.Header[header])
+				}
+			}
+
+			// Read body
+			body, err := io.ReadAll(req.Body)
+			if err != nil {
+				t.Errorf("%s: unexpected error %v", k, err)
+			}
+			req.Body.Close()
+
+			// Verify length
+			if req.ContentLength > 0 && req.ContentLength != int64(len(body)) {
+				t.Errorf("%s: ContentLength was %d, len(data) was %d", k, req.ContentLength, len(body))
+			}
+
+			// Verify content
+			if !bytes.Equal(item.expectedBody, body) {
+				t.Errorf("%s: Expected %q, got %q", k, string(item.expectedBody), string(body))
+			}
+
+			// Write successful response
+			w.Write([]byte(successfulResponse))
+		}))
+		defer downstreamServer.Close()
+
+		responder := &fakeResponder{t: t}
+		backendURL, _ := url.Parse(downstreamServer.URL)
+		proxyHandler := NewUpgradeAwareHandler(backendURL, nil, false, false, responder)
+		proxyServer := httptest.NewServer(proxyHandler)
+		defer proxyServer.Close()
+
+		// Dial the proxy server
+		conn, err := net.Dial(proxyServer.Listener.Addr().Network(), proxyServer.Listener.Addr().String())
+		if err != nil {
+			t.Errorf("unexpected error %v", err)
+			continue
+		}
+		defer conn.Close()
+
+		// Add standard http 1.1 headers
+		if item.reqHeaders == nil {
+			item.reqHeaders = http.Header{}
+		}
+		item.reqHeaders.Add("Connection", "close")
+		item.reqHeaders.Add("Host", proxyServer.Listener.Addr().String())
+
+		// Write the request headers
+		if _, err := fmt.Fprint(conn, "POST / HTTP/1.1\r\n"); err != nil {
+			t.Fatalf("%s unexpected error %v", k, err)
+		}
+		for header, values := range item.reqHeaders {
+			for _, value := range values {
+				if _, err := fmt.Fprintf(conn, "%s: %s\r\n", header, value); err != nil {
+					t.Fatalf("%s: unexpected error %v", k, err)
+				}
+			}
+		}
+		// Header separator
+		if _, err := fmt.Fprint(conn, "\r\n"); err != nil {
+			t.Fatalf("%s: unexpected error %v", k, err)
+		}
+		// Body
+		if _, err := conn.Write(item.reqBody); err != nil {
+			t.Fatalf("%s: unexpected error %v", k, err)
+		}
+
+		// Read response
+		response, err := io.ReadAll(conn)
+		if err != nil {
+			t.Errorf("%s: unexpected error %v", k, err)
+			continue
+		}
+		if !strings.HasSuffix(string(response), successfulResponse) {
+			t.Errorf("%s: Did not get successful response: %s", k, string(response))
+			continue
+		}
+	}
+}
+
+func TestFlushIntervalHeaders(t *testing.T) {
+	const expected = "hi"
+	stopCh := make(chan struct{})
+	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("MyHeader", expected)
+		w.WriteHeader(200)
+		w.(http.Flusher).Flush()
+		<-stopCh
+	}))
+	defer backend.Close()
+	defer close(stopCh)
+
+	backendURL, err := url.Parse(backend.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	responder := &fakeResponder{t: t}
+	proxyHandler := NewUpgradeAwareHandler(backendURL, nil, false, false, responder)
+
+	frontend := httptest.NewServer(proxyHandler)
+	defer frontend.Close()
+
+	req, _ := http.NewRequest(http.MethodGet, frontend.URL, nil)
+	req.Close = true
+
+	ctx, cancel := context.WithTimeout(req.Context(), 10*time.Second)
+	defer cancel()
+	req = req.WithContext(ctx)
+
+	res, err := frontend.Client().Do(req)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	defer res.Body.Close()
+
+	if res.Header.Get("MyHeader") != expected {
+		t.Errorf("got header %q; expected %q", res.Header.Get("MyHeader"), expected)
+	}
+}
+
+type fakeRT struct {
+	err error
+}
+
+func (frt *fakeRT) RoundTrip(*http.Request) (*http.Response, error) {
+	return nil, frt.err
+}
+
+// TestErrorPropagation checks if the default transport doesn't swallow the errors by providing a fakeResponder that intercepts and stores the error.
+func TestErrorPropagation(t *testing.T) {
+	backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		panic("unreachable")
+	}))
+	defer backend.Close()
+
+	backendURL, err := url.Parse(backend.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	responder := &fakeResponder{t: t}
+	expectedErr := errors.New("nasty error")
+	proxyHandler := NewUpgradeAwareHandler(backendURL, &fakeRT{err: expectedErr}, true, false, responder)
+
+	frontend := httptest.NewServer(proxyHandler)
+	defer frontend.Close()
+
+	req, _ := http.NewRequest(http.MethodGet, frontend.URL, nil)
+	req.Close = true
+
+	ctx, cancel := context.WithTimeout(req.Context(), 10*time.Second)
+	defer cancel()
+	req = req.WithContext(ctx)
+
+	res, err := frontend.Client().Do(req)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	defer res.Body.Close()
+	if res.StatusCode != fakeStatusCode {
+		t.Fatalf("unexpected HTTP status code returned: %v, expected: %v", res.StatusCode, fakeStatusCode)
+	}
+	if !strings.Contains(responder.err.Error(), expectedErr.Error()) {
+		t.Fatalf("responder got unexpected error: %v, expected the error to contain %q", responder.err.Error(), expectedErr.Error())
+	}
+}
+
+func TestProxyRedirectsforRootPath(t *testing.T) {
+
+	tests := []struct {
+		name               string
+		method             string
+		requestPath        string
+		expectedHeader     http.Header
+		expectedStatusCode int
+		redirect           bool
+	}{
+		{
+			name:               "root path, simple get",
+			method:             http.MethodGet,
+			requestPath:        "",
+			redirect:           true,
+			expectedStatusCode: 301,
+			expectedHeader: http.Header{
+				"Location": []string{"/"},
+			},
+		},
+		{
+			name:               "root path, simple put",
+			method:             http.MethodPut,
+			requestPath:        "",
+			redirect:           false,
+			expectedStatusCode: 200,
+		},
+		{
+			name:               "root path, simple head",
+			method:             http.MethodHead,
+			requestPath:        "",
+			redirect:           true,
+			expectedStatusCode: 301,
+			expectedHeader: http.Header{
+				"Location": []string{"/"},
+			},
+		},
+		{
+			name:               "root path, simple delete with params",
+			method:             http.MethodDelete,
+			requestPath:        "",
+			redirect:           false,
+			expectedStatusCode: 200,
+		},
+	}
+
+	for _, test := range tests {
+		func() {
+			w := httptest.NewRecorder()
+			req, err := http.NewRequest(test.method, test.requestPath, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			redirect := proxyRedirectsforRootPath(test.requestPath, w, req)
+			if got, want := redirect, test.redirect; got != want {
+				t.Errorf("Expected redirect state %v; got %v", want, got)
+			}
+
+			res := w.Result()
+			if got, want := res.StatusCode, test.expectedStatusCode; got != want {
+				t.Errorf("Expected status code %d; got %d", want, got)
+			}
+
+			if res.StatusCode == 301 && !reflect.DeepEqual(res.Header, test.expectedHeader) {
+				t.Errorf("Expected location header to be %v, got %v", test.expectedHeader, res.Header)
+			}
+		}()
+	}
+}
+
+// exampleCert was generated from crypto/tls/generate_cert.go with the following command:
+//
+//	go run generate_cert.go  --rsa-bits 1024 --host example.com --ca --start-date "Jan 1 00:00:00 1970" --duration=1000000h
+var exampleCert = []byte(`-----BEGIN CERTIFICATE-----
+MIIDADCCAeigAwIBAgIQVHG3Fn9SdWayyLOZKCW1vzANBgkqhkiG9w0BAQsFADAS
+MRAwDgYDVQQKEwdBY21lIENvMCAXDTcwMDEwMTAwMDAwMFoYDzIwODQwMTI5MTYw
+MDAwWjASMRAwDgYDVQQKEwdBY21lIENvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEArTCu9fiIclNgDdWHphewM+JW55dCb5yYGlJgCBvwbOx547M9p+tn
+zm9QOhsdZDHDZsG9tqnWxE2Nc1HpIJyOlfYsOoonpEoG/Ep6nnK91ngj0bn/JlNy
++i/bwU4r97MOukvnOIQez9/D9jAJaOX2+b8/d4lRz9BsqiwJyg+ynZ5tVVYj7aMi
+vXnd6HOnJmtqutOtr3beucJnkd6XbwRkLUcAYATT+ZihOWRbTuKqhCg6zGkJOoUG
+f8sX61JjoilxiURA//ftGVbdTCU3DrmGmardp5NNOHbumMYU8Vhmqgx1Bqxb+9he
+7G42uW5YWYK/GqJzgVPjjlB2dOGj9KrEWQIDAQABo1AwTjAOBgNVHQ8BAf8EBAMC
+AqQwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB/zAWBgNVHREE
+DzANggtleGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAig4AIi9xWs1+pLES
+eeGGdSDoclplFpcbXANnsYYFyLf+8pcWgVi2bOmb2gXMbHFkB07MA82wRJAUTaA+
+2iNXVQMhPCoA7J6ADUbww9doJX2S9HGyArhiV/MhHtE8txzMn2EKNLdhhk3N9rmV
+x/qRbWAY1U2z4BpdrAR87Fe81Nlj7h45csW9K+eS+NgXipiNTIfEShKgCFM8EdxL
+1WXg7r9AvYV3TNDPWTjLsm1rQzzZQ7Uvcf6deWiNodZd8MOT/BFLclDPTK6cF2Hr
+UU4dq6G4kCwMSxWE4cM3HlZ4u1dyIt47VbkP0rtvkBCXx36y+NXYA5lzntchNFZP
+uvEQdw==
+-----END CERTIFICATE-----`)
+
+var exampleKey = []byte(`-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEArTCu9fiIclNgDdWHphewM+JW55dCb5yYGlJgCBvwbOx547M9
+p+tnzm9QOhsdZDHDZsG9tqnWxE2Nc1HpIJyOlfYsOoonpEoG/Ep6nnK91ngj0bn/
+JlNy+i/bwU4r97MOukvnOIQez9/D9jAJaOX2+b8/d4lRz9BsqiwJyg+ynZ5tVVYj
+7aMivXnd6HOnJmtqutOtr3beucJnkd6XbwRkLUcAYATT+ZihOWRbTuKqhCg6zGkJ
+OoUGf8sX61JjoilxiURA//ftGVbdTCU3DrmGmardp5NNOHbumMYU8Vhmqgx1Bqxb
++9he7G42uW5YWYK/GqJzgVPjjlB2dOGj9KrEWQIDAQABAoIBAQClt4CiYaaF5ltx
+wVDjz6TNcJUBUs3CKE+uWAYFnF5Ii1nyU876Pxj8Aaz9fHZ6Kde0GkwiXY7gFOj1
+YHo2tzcELSKS/SEDZcYbYFTGCjq13g1AH74R+SV6WZLn+5m8kPvVrM1ZWap188H5
+bmuCkRDqVmIvShkbRW7EwhC35J9fiuW3majC/sjmsxtxyP6geWmu4f5/Ttqahcdb
+osPZIgIIPzqAkNtkLTi7+meHYI9wlrGhL7XZTwnJ1Oc/Y67zzmbthLYB5YFSLUew
+rXT58jtSjX4gbiQyheBSrWxW08QE4qYg6jJlAdffHhWv72hJW2MCXhuXp8gJs/Do
+XLRHGwSBAoGBAMdNtsbe4yae/QeHUPGxNW0ipa0yoTF6i+VYoxvqiRMzDM3+3L8k
+dgI1rr4330SivqDahMA/odWtM/9rVwJI2B2QhZLMHA0n9ytH007OO9TghgVB12nN
+xosRYBpKdHXyyvV/MUZl7Jux6zKIzRDWOkF95VVYPcAaxJqd1E5/jJ6JAoGBAN51
+QrebA1w/jfydeqQTz1sK01sbO4HYj4qGfo/JarVqGEkm1azeBBPPRnHz3jNKnCkM
+S4PpqRDased3NIcViXlAgoqPqivZ8mQa/Rb146l7WaTErASHsZ023OGrxsr/Ed6N
+P3GrmvxVJjebaFNaQ9sP80dLkpgeas0t2TY8iQNRAoGATOcnx8TpUVW3vNfx29DN
+FLdxxkrq9/SZVn3FMlhlXAsuva3B799ZybB9JNjaRdmmRNsMrkHfaFvU3JHGmRMS
+kRXa9LHdgRYSwZiNaLMbUyDvlce6HxFPswmZU4u3NGvi9KeHk+pwSgN1BaLTvdNr
+1ymE/FF4QlAR3LdZ3JBK6kECgYEA0wW4/CJ31ZIURoW8SNjh4iMqy0nR8SJVR7q9
+Y/hU2TKDRyEnoIwaohAFayNCrLUh3W5kVAXa8roB+OgDVAECH5sqOfZ+HorofD19
+x8II7ESujLZj1whBXDkm3ovsT7QWZ17lyBZZNvQvBKDPHgKKS8udowv1S4fPGENd
+wS07a4ECgYEAwLSbmMIVJme0jFjsp5d1wOGA2Qi2ZwGIAVlsbnJtygrU/hSBfnu8
+VfyJSCgg3fPe7kChWKlfcOebVKSb68LKRsz1Lz1KdbY0HOJFp/cT4lKmDAlRY9gq
+LB4rdf46lV0mUkvd2/oofIbTrzukjQSnyfLawb/2uJGV1IkTcZcn9CI=
+-----END RSA PRIVATE KEY-----`)
diff --git a/third_party/k8s.io/apimachinery/pkg/util/rand/rand.go b/third_party/k8s.io/apimachinery/pkg/util/rand/rand.go
new file mode 100644
index 0000000000..82a473bb14
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/rand/rand.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package rand provides utilities related to randomization.
+package rand
+
+import (
+	"math/rand"
+	"sync"
+	"time"
+)
+
+var rng = struct {
+	sync.Mutex
+	rand *rand.Rand
+}{
+	rand: rand.New(rand.NewSource(time.Now().UnixNano())),
+}
+
+// Int returns a non-negative pseudo-random int.
+func Int() int {
+	rng.Lock()
+	defer rng.Unlock()
+	return rng.rand.Int()
+}
+
+// Intn generates an integer in range [0,max).
+// By design this should panic if input is invalid, <= 0.
+func Intn(max int) int {
+	rng.Lock()
+	defer rng.Unlock()
+	return rng.rand.Intn(max)
+}
+
+// IntnRange generates an integer in range [min,max).
+// By design this should panic if input is invalid, <= 0.
+func IntnRange(min, max int) int {
+	rng.Lock()
+	defer rng.Unlock()
+	return rng.rand.Intn(max-min) + min
+}
+
+// IntnRange generates an int64 integer in range [min,max).
+// By design this should panic if input is invalid, <= 0.
+func Int63nRange(min, max int64) int64 {
+	rng.Lock()
+	defer rng.Unlock()
+	return rng.rand.Int63n(max-min) + min
+}
+
+// Seed seeds the rng with the provided seed.
+func Seed(seed int64) {
+	rng.Lock()
+	defer rng.Unlock()
+
+	rng.rand = rand.New(rand.NewSource(seed))
+}
+
+// Perm returns, as a slice of n ints, a pseudo-random permutation of the integers [0,n)
+// from the default Source.
+func Perm(n int) []int {
+	rng.Lock()
+	defer rng.Unlock()
+	return rng.rand.Perm(n)
+}
+
+const (
+	// We omit vowels from the set of available characters to reduce the chances
+	// of "bad words" being formed.
+	alphanums = "bcdfghjklmnpqrstvwxz2456789"
+	// No. of bits required to index into alphanums string.
+	alphanumsIdxBits = 5
+	// Mask used to extract last alphanumsIdxBits of an int.
+	alphanumsIdxMask = 1<<alphanumsIdxBits - 1
+	// No. of random letters we can extract from a single int63.
+	maxAlphanumsPerInt = 63 / alphanumsIdxBits
+)
+
+// String generates a random alphanumeric string, without vowels, which is n
+// characters long.  This will panic if n is less than zero.
+// How the random string is created:
+// - we generate random int63's
+// - from each int63, we are extracting multiple random letters by bit-shifting and masking
+// - if some index is out of range of alphanums we neglect it (unlikely to happen multiple times in a row)
+func String(n int) string {
+	b := make([]byte, n)
+	rng.Lock()
+	defer rng.Unlock()
+
+	randomInt63 := rng.rand.Int63()
+	remaining := maxAlphanumsPerInt
+	for i := 0; i < n; {
+		if remaining == 0 {
+			randomInt63, remaining = rng.rand.Int63(), maxAlphanumsPerInt
+		}
+		if idx := int(randomInt63 & alphanumsIdxMask); idx < len(alphanums) {
+			b[i] = alphanums[idx]
+			i++
+		}
+		randomInt63 >>= alphanumsIdxBits
+		remaining--
+	}
+	return string(b)
+}
+
+// SafeEncodeString encodes s using the same characters as rand.String. This reduces the chances of bad words and
+// ensures that strings generated from hash functions appear consistent throughout the API.
+func SafeEncodeString(s string) string {
+	r := make([]byte, len(s))
+	for i, b := range []rune(s) {
+		r[i] = alphanums[(int(b) % len(alphanums))]
+	}
+	return string(r)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/rand/rand_test.go b/third_party/k8s.io/apimachinery/pkg/util/rand/rand_test.go
new file mode 100644
index 0000000000..e677aa9750
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/rand/rand_test.go
@@ -0,0 +1,114 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package rand
+
+import (
+	"math/rand"
+	"strings"
+	"testing"
+)
+
+const (
+	maxRangeTestCount = 500
+	testStringLength  = 32
+)
+
+func TestString(t *testing.T) {
+	valid := "bcdfghjklmnpqrstvwxz2456789"
+	for _, l := range []int{0, 1, 2, 10, 123} {
+		s := String(l)
+		if len(s) != l {
+			t.Errorf("expected string of size %d, got %q", l, s)
+		}
+		for _, c := range s {
+			if !strings.ContainsRune(valid, c) {
+				t.Errorf("expected valid characters, got %v", c)
+			}
+		}
+	}
+}
+
+// Confirm that panic occurs on invalid input.
+func TestRangePanic(t *testing.T) {
+	defer func() {
+		if err := recover(); err == nil {
+			t.Errorf("Panic didn't occur!")
+		}
+	}()
+	// Should result in an error...
+	Intn(0)
+}
+
+func TestIntn(t *testing.T) {
+	// 0 is invalid.
+	for _, max := range []int{1, 2, 10, 123} {
+		inrange := Intn(max)
+		if inrange < 0 || inrange > max {
+			t.Errorf("%v out of range (0,%v)", inrange, max)
+		}
+	}
+}
+
+func TestPerm(t *testing.T) {
+	Seed(5)
+	r := rand.New(rand.NewSource(5))
+	for i := 1; i < 20; i++ {
+		actual := Perm(i)
+		expected := r.Perm(i)
+		for j := 0; j < i; j++ {
+			if actual[j] != expected[j] {
+				t.Errorf("Perm call result is unexpected")
+			}
+		}
+	}
+}
+
+func TestIntnRange(t *testing.T) {
+	// 0 is invalid.
+	for min, max := range map[int]int{1: 2, 10: 123, 100: 500} {
+		for i := 0; i < maxRangeTestCount; i++ {
+			inrange := IntnRange(min, max)
+			if inrange < min || inrange >= max {
+				t.Errorf("%v out of range (%v,%v)", inrange, min, max)
+			}
+		}
+	}
+}
+
+func TestInt63nRange(t *testing.T) {
+	// 0 is invalid.
+	for min, max := range map[int64]int64{1: 2, 10: 123, 100: 500} {
+		for i := 0; i < maxRangeTestCount; i++ {
+			inrange := Int63nRange(min, max)
+			if inrange < min || inrange >= max {
+				t.Errorf("%v out of range (%v,%v)", inrange, min, max)
+			}
+		}
+	}
+}
+
+func BenchmarkRandomStringGeneration(b *testing.B) {
+	b.ResetTimer()
+	var s string
+	for i := 0; i < b.N; i++ {
+		s = String(testStringLength)
+	}
+	b.StopTimer()
+	if len(s) == 0 {
+		b.Fatal(s)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/remotecommand/constants.go b/third_party/k8s.io/apimachinery/pkg/util/remotecommand/constants.go
new file mode 100644
index 0000000000..ba153ee24f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/remotecommand/constants.go
@@ -0,0 +1,67 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package remotecommand
+
+import (
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	DefaultStreamCreationTimeout = 30 * time.Second
+
+	// The SPDY subprotocol "channel.k8s.io" is used for remote command
+	// attachment/execution. This represents the initial unversioned subprotocol,
+	// which has the known bugs https://issues.k8s.io/13394 and
+	// https://issues.k8s.io/13395.
+	StreamProtocolV1Name = "channel.k8s.io"
+
+	// The SPDY subprotocol "v2.channel.k8s.io" is used for remote command
+	// attachment/execution. It is the second version of the subprotocol and
+	// resolves the issues present in the first version.
+	StreamProtocolV2Name = "v2.channel.k8s.io"
+
+	// The SPDY subprotocol "v3.channel.k8s.io" is used for remote command
+	// attachment/execution. It is the third version of the subprotocol and
+	// adds support for resizing container terminals.
+	StreamProtocolV3Name = "v3.channel.k8s.io"
+
+	// The SPDY subprotocol "v4.channel.k8s.io" is used for remote command
+	// attachment/execution. It is the 4th version of the subprotocol and
+	// adds support for exit codes.
+	StreamProtocolV4Name = "v4.channel.k8s.io"
+
+	// The subprotocol "v5.channel.k8s.io" is used for remote command
+	// attachment/execution. It is the 5th version of the subprotocol and
+	// adds support for a CLOSE signal.
+	StreamProtocolV5Name = "v5.channel.k8s.io"
+
+	NonZeroExitCodeReason = metav1.StatusReason("NonZeroExitCode")
+	ExitCodeCauseType     = metav1.CauseType("ExitCode")
+
+	// RemoteCommand stream identifiers. The first three identifiers (for STDIN,
+	// STDOUT, STDERR) are the same as their file descriptors.
+	StreamStdIn  = 0
+	StreamStdOut = 1
+	StreamStdErr = 2
+	StreamErr    = 3
+	StreamResize = 4
+	StreamClose  = 255
+)
+
+var SupportedStreamingProtocols = []string{StreamProtocolV4Name, StreamProtocolV3Name, StreamProtocolV2Name, StreamProtocolV1Name}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/resourceversion/resourceversion.go b/third_party/k8s.io/apimachinery/pkg/util/resourceversion/resourceversion.go
new file mode 100644
index 0000000000..6f672c4b46
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/resourceversion/resourceversion.go
@@ -0,0 +1,85 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resourceversion
+
+import (
+	"fmt"
+	"strings"
+)
+
+type InvalidResourceVersion struct {
+	rv string
+}
+
+func (i InvalidResourceVersion) Error() string {
+	return fmt.Sprintf("resource version is not well formed: %s", i.rv)
+}
+
+// CompareResourceVersion runs a comparison between two ResourceVersions. This
+// only has semantic meaning when the comparison is done on two objects of the
+// same resource. The return values are:
+//
+//	-1: If RV a < RV b
+//	 0: If RV a == RV b
+//	+1: If RV a > RV b
+//
+// The function will return an error if the resource version is not a properly
+// formatted positive integer, but has no restriction on length. A properly
+// formatted integer will not contain leading zeros or non integer characters.
+// Zero is also considered an invalid value as it is used as a special value in
+// list/watch events and will never be a live resource version.
+func CompareResourceVersion(a, b string) (int, error) {
+	if !isWellFormed(a) {
+		return 0, InvalidResourceVersion{rv: a}
+	}
+	if !isWellFormed(b) {
+		return 0, InvalidResourceVersion{rv: b}
+	}
+	// both are well-formed integer strings with no leading zeros
+	aLen := len(a)
+	bLen := len(b)
+	switch {
+	case aLen < bLen:
+		// shorter is less
+		return -1, nil
+	case aLen > bLen:
+		// longer is greater
+		return 1, nil
+	default:
+		// equal-length compares lexically
+		return strings.Compare(a, b), nil
+	}
+}
+
+func isWellFormed(s string) bool {
+	if len(s) == 0 {
+		return false
+	}
+	if s[0] == '0' {
+		return false
+	}
+	for i := range s {
+		if !isDigit(s[i]) {
+			return false
+		}
+	}
+	return true
+}
+
+func isDigit(b byte) bool {
+	return b >= '0' && b <= '9'
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/resourceversion/resourceversion_test.go b/third_party/k8s.io/apimachinery/pkg/util/resourceversion/resourceversion_test.go
new file mode 100644
index 0000000000..dd3785e9ac
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/resourceversion/resourceversion_test.go
@@ -0,0 +1,162 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resourceversion
+
+import (
+	"testing"
+)
+
+func TestCompareResourceVersion(t *testing.T) {
+	testCases := []struct {
+		name     string
+		a        string
+		b        string
+		expected int
+		err      bool
+	}{
+		{
+			name:     "a less than b",
+			a:        "100",
+			b:        "200",
+			expected: -1,
+		},
+		{
+			name: "a is zero, invalid",
+			a:    "0",
+			b:    "1",
+			err:  true,
+		},
+		{
+			name: "both zero",
+			a:    "0",
+			b:    "0",
+			err:  true,
+		},
+		{
+			name:     "a greater than b",
+			a:        "200",
+			b:        "100",
+			expected: 1,
+		},
+		{
+			name: "b is 0, invalid",
+			a:    "1",
+			b:    "0",
+			err:  true,
+		},
+		{
+			name:     "a equal to b small",
+			a:        "1",
+			b:        "1",
+			expected: 0,
+		},
+		{
+			name:     "a equal to b",
+			a:        "100",
+			b:        "100",
+			expected: 0,
+		},
+		{
+			name:     "a shorter than b",
+			a:        "99",
+			b:        "100",
+			expected: -1,
+		},
+		{
+			name:     "a longer than b",
+			a:        "100",
+			b:        "99",
+			expected: 1,
+		},
+		{
+			name:     "a with leading zero",
+			a:        "0100",
+			b:        "100",
+			expected: 0,
+			err:      true,
+		},
+		{
+			name:     "b with leading zero",
+			a:        "100",
+			b:        "0100",
+			expected: 0,
+			err:      true,
+		},
+		{
+			name:     "a empty",
+			a:        "",
+			b:        "100",
+			expected: 0,
+			err:      true,
+		},
+		{
+			name:     "b empty",
+			a:        "100",
+			b:        "",
+			expected: 0,
+			err:      true,
+		},
+		{
+			name: "a non-digit",
+			a:    "100a",
+			b:    "100",
+			err:  true,
+		},
+		{
+			name: "b non-digit",
+			a:    "100",
+			b:    "100a",
+			err:  true,
+		},
+		{
+			name:     "large int a less than b",
+			a:        "99999999999999999999999999999999999999999999999999",
+			b:        "100000000000000000000000000000000000000000000000000",
+			expected: -1,
+		},
+		{
+			name:     "large int a greater than b",
+			a:        "100000000000000000000000000000000000000000000000000",
+			b:        "99999999999999999999999999999999999999999999999999",
+			expected: 1,
+		},
+		{
+			name:     "large int a equal to b",
+			a:        "12345678901234567890123456789012345678901234567890",
+			b:        "12345678901234567890123456789012345678901234567890",
+			expected: 0,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			actual, err := CompareResourceVersion(tc.a, tc.b)
+			if tc.err {
+				if err == nil {
+					t.Fatalf("expected error, but got none")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if actual != tc.expected {
+				t.Errorf("expected %d, got %d", tc.expected, actual)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime.go b/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime.go
new file mode 100644
index 0000000000..38c1f7b03c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime.go
@@ -0,0 +1,326 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net/http"
+	"runtime"
+	"strings"
+	"sync"
+	"time"
+
+	"k8s.io/klog/v2"
+	"k8s.io/klog/v2/textlogger"
+)
+
+var (
+	// ReallyCrash controls the behavior of HandleCrash and defaults to
+	// true. It's exposed so components can optionally set to false
+	// to restore prior behavior. This flag is mostly used for tests to validate
+	// crash conditions.
+	ReallyCrash = true
+)
+
+// PanicHandlers is a list of functions which will be invoked when a panic happens.
+//
+// The code invoking these handlers prepares a contextual logger so that
+// klog.FromContext(ctx) already skips over the panic handler itself and
+// several other intermediate functions, ideally such that the log output
+// is attributed to the code which triggered the panic.
+var PanicHandlers = []func(context.Context, interface{}){logPanic}
+
+// HandleCrash simply catches a crash and logs an error. Meant to be called via
+// defer.  Additional context-specific handlers can be provided, and will be
+// called in case of panic.  HandleCrash actually crashes, after calling the
+// handlers and logging the panic message.
+//
+// E.g., you can provide one or more additional handlers for something like shutting down go routines gracefully.
+//
+// Contextual logging: HandleCrashWithContext or HandleCrashWithLogger should be used instead of HandleCrash in code which supports contextual logging.
+func HandleCrash(additionalHandlers ...func(interface{})) {
+	if r := recover(); r != nil {
+		additionalHandlersWithContext := make([]func(context.Context, interface{}), len(additionalHandlers))
+		for i, handler := range additionalHandlers {
+			additionalHandlersWithContext[i] = func(_ context.Context, r interface{}) {
+				handler(r)
+			}
+		}
+
+		handleCrash(context.Background(), r, additionalHandlersWithContext...)
+	}
+}
+
+// HandleCrashWithContext simply catches a crash and logs an error. Meant to be called via
+// defer.  Additional context-specific handlers can be provided, and will be
+// called in case of panic.  HandleCrash actually crashes, after calling the
+// handlers and logging the panic message.
+//
+// E.g., you can provide one or more additional handlers for something like shutting down go routines gracefully.
+//
+// The context is used to determine how to log.
+func HandleCrashWithContext(ctx context.Context, additionalHandlers ...func(context.Context, interface{})) {
+	if r := recover(); r != nil {
+		handleCrash(ctx, r, additionalHandlers...)
+	}
+}
+
+// HandleCrashWithLogger simply catches a crash and logs an error. Meant to be called via
+// defer.  Additional context-specific handlers can be provided, and will be
+// called in case of panic.  HandleCrash actually crashes, after calling the
+// handlers and logging the panic message.
+//
+// E.g., you can provide one or more additional handlers for something like shutting down go routines gracefully.
+func HandleCrashWithLogger(logger klog.Logger, additionalHandlers ...func(context.Context, interface{})) {
+	if r := recover(); r != nil {
+		ctx := klog.NewContext(context.Background(), logger)
+		handleCrash(ctx, r, additionalHandlers...)
+	}
+}
+
+// handleCrash is the common implementation of the HandleCrash* variants.
+// Having those call a common implementation ensures that the stack depth
+// is the same regardless through which path the handlers get invoked.
+func handleCrash(ctx context.Context, r any, additionalHandlers ...func(context.Context, interface{})) {
+	// We don't really know how many call frames to skip because the Go
+	// panic handler is between us and the code where the panic occurred.
+	// If it's one function (as in Go 1.21), then skipping four levels
+	// gets us to the function which called the `defer HandleCrashWithontext(...)`.
+	logger := klog.FromContext(ctx).WithCallDepth(4)
+	ctx = klog.NewContext(ctx, logger)
+
+	for _, fn := range PanicHandlers {
+		fn(ctx, r)
+	}
+	for _, fn := range additionalHandlers {
+		fn(ctx, r)
+	}
+	if ReallyCrash {
+		// Actually proceed to panic.
+		panic(r)
+	}
+}
+
+// logPanic logs the caller tree when a panic occurs (except in the special case of http.ErrAbortHandler).
+func logPanic(ctx context.Context, r interface{}) {
+	if r == http.ErrAbortHandler {
+		// honor the http.ErrAbortHandler sentinel panic value:
+		//   ErrAbortHandler is a sentinel panic value to abort a handler.
+		//   While any panic from ServeHTTP aborts the response to the client,
+		//   panicking with ErrAbortHandler also suppresses logging of a stack trace to the server's error log.
+		return
+	}
+
+	// Same as stdlib http server code. Manually allocate stack trace buffer size
+	// to prevent excessively large logs
+	const size = 64 << 10
+	stacktrace := make([]byte, size)
+	stacktrace = stacktrace[:runtime.Stack(stacktrace, false)]
+
+	logger := klog.FromContext(ctx)
+
+	// For backwards compatibility, conversion to string
+	// is handled here instead of defering to the logging
+	// backend.
+	if _, ok := r.(string); ok {
+		logger.Error(nil, "Observed a panic", "panic", r, "stacktrace", string(stacktrace))
+	} else {
+		logger.Error(nil, "Observed a panic", "panic", fmt.Sprintf("%v", r), "panicGoValue", fmt.Sprintf("%#v", r), "stacktrace", string(stacktrace))
+	}
+}
+
+// ErrorHandlers is a list of functions which will be invoked when a nonreturnable
+// error occurs.
+// TODO(lavalamp): for testability, this and the below HandleError function
+// should be packaged up into a testable and reusable object.
+var ErrorHandlers = []ErrorHandler{
+	logError,
+	// 1ms was the number folks were able to stomach as a global rate limit.
+	// If you need to log errors more than 1000 times a second, you
+	// should probably consider fixing your code instead. :)
+	backoffError(1 * time.Millisecond),
+}
+
+// ErrorHandler is called indirectly through [HandleError], [HandleErrorWithContext] or [HandleErrorWithLogger].
+// It is passed the same parameters that a structured logging backend needs to log a problem.
+// It follows the semantic described for [HandleErrorWithContext] and [logr.Logger.Error]:
+// - err is optional and may be nil
+// - msg is string that describes the problem
+// - keysAndValues contains additional information that varies between different occurrences of the problem
+//
+// [ErrorToString] can be used to convert these parameters into a single string, using the klog text output.
+type ErrorHandler func(ctx context.Context, err error, msg string, keysAndValues ...interface{})
+
+// ErrorToString takes the parameters passed to [ErrorHandler] and
+// formats them as a string using the klog text output.
+//
+// If any of the values is a multi-line string, then the resulting
+// string also uses line breaks and indention for the sake of readability.
+// Does not include a trailing newline.
+//
+// Use errors.New if an error instead of a string is needed.
+func ErrorToString(err error, msg string, keysAndValues ...interface{}) string {
+	var buffer bytes.Buffer
+	config := textlogger.NewConfig(
+		textlogger.Output(&buffer),
+		textlogger.WithHeader(false),
+	)
+	logger := textlogger.NewLogger(config)
+	logger.Error(err, msg, keysAndValues...)
+	result := buffer.String()
+	result = strings.TrimSpace(result)
+	return result
+}
+
+// HandlerError is a method to invoke when a non-user facing piece of code cannot
+// return an error and needs to indicate it has been ignored. Invoking this method
+// is preferable to logging the error - the default behavior is to log but the
+// errors may be sent to a remote server for analysis.
+//
+// Contextual logging: HandleErrorWithContext should be used instead of HandleError in code which supports contextual logging.
+func HandleError(err error) {
+	// this is sometimes called with a nil error.  We probably shouldn't fail and should do nothing instead
+	if err == nil {
+		return
+	}
+
+	handleError(context.Background(), err, "Unhandled Error")
+}
+
+// HandlerErrorWithContext is a method to invoke when a non-user facing piece of code cannot
+// return an error and needs to indicate it has been ignored. Invoking this method
+// is preferable to logging the error - the default behavior is to log but the
+// errors may be sent to a remote server for analysis. The context is used to
+// determine how to log the error.
+//
+// If contextual logging is enabled, the default log output is equivalent to
+//
+//	logr.FromContext(ctx).WithName("UnhandledError").Error(err, msg, keysAndValues...)
+//
+// Without contextual logging, it is equivalent to:
+//
+//	klog.ErrorS(err, msg, keysAndValues...)
+//
+// In contrast to HandleError, passing nil for the error is still going to
+// trigger a log entry. Don't construct a new error or wrap an error
+// with fmt.Errorf. Instead, add additional information via the mssage
+// and key/value pairs.
+//
+// This variant should be used instead of HandleError because it supports
+// structured, contextual logging. Alternatively, [HandleErrorWithLogger] can
+// be used if a logger is available instead of a context.
+func HandleErrorWithContext(ctx context.Context, err error, msg string, keysAndValues ...interface{}) {
+	handleError(ctx, err, msg, keysAndValues...)
+}
+
+// HandleErrorWithLogger is an alternative to [HandlerErrorWithContext] which accepts
+// a logger for contextual logging.
+func HandleErrorWithLogger(logger klog.Logger, err error, msg string, keysAndValues ...interface{}) {
+	handleError(klog.NewContext(context.Background(), logger), err, msg, keysAndValues...)
+}
+
+// handleError is the common implementation of the HandleError* variants.
+// Using this common implementation ensures that the stack depth
+// is the same regardless through which path the handlers get invoked.
+func handleError(ctx context.Context, err error, msg string, keysAndValues ...interface{}) {
+	for _, fn := range ErrorHandlers {
+		fn(ctx, err, msg, keysAndValues...)
+	}
+}
+
+// logError prints an error with the call stack of the location it was reported.
+// It expects to be called as <caller> -> HandleError[WithContext] -> handleError -> logError.
+func logError(ctx context.Context, err error, msg string, keysAndValues ...interface{}) {
+	logger := klog.FromContext(ctx).WithCallDepth(3)
+	logger = klog.LoggerWithName(logger, "UnhandledError")
+	logger.Error(err, msg, keysAndValues...) //nolint:logcheck // logcheck complains about unknown key/value pairs.
+}
+
+// backoffError blocks if it is called more often than the minPeriod.
+func backoffError(minPeriod time.Duration) ErrorHandler {
+	r := &rudimentaryErrorBackoff{
+		lastErrorTime: time.Now(),
+		minPeriod:     minPeriod,
+	}
+
+	return func(ctx context.Context, err error, msg string, keysAndValues ...interface{}) {
+		r.OnError()
+	}
+}
+
+type rudimentaryErrorBackoff struct {
+	minPeriod time.Duration // immutable
+	// TODO(lavalamp): use the clock for testability. Need to move that
+	// package for that to be accessible here.
+	lastErrorTimeLock sync.Mutex
+	lastErrorTime     time.Time
+}
+
+// OnError will block if it is called more often than the embedded period time.
+// This will prevent overly tight hot error loops.
+func (r *rudimentaryErrorBackoff) OnError() {
+	now := time.Now() // start the timer before acquiring the lock
+	r.lastErrorTimeLock.Lock()
+	d := now.Sub(r.lastErrorTime)
+	r.lastErrorTime = time.Now()
+	r.lastErrorTimeLock.Unlock()
+
+	// Do not sleep with the lock held because that causes all callers of HandleError to block.
+	// We only want the current goroutine to block.
+	// A negative or zero duration causes time.Sleep to return immediately.
+	// If the time moves backwards for any reason, do nothing.
+	time.Sleep(r.minPeriod - d)
+}
+
+// GetCaller returns the caller of the function that calls it.
+func GetCaller() string {
+	var pc [1]uintptr
+	runtime.Callers(3, pc[:])
+	f := runtime.FuncForPC(pc[0])
+	if f == nil {
+		return "Unable to find caller"
+	}
+	return f.Name()
+}
+
+// RecoverFromPanic replaces the specified error with an error containing the
+// original error, and  the call tree when a panic occurs. This enables error
+// handlers to handle errors and panics the same way.
+func RecoverFromPanic(err *error) {
+	if r := recover(); r != nil {
+		// Same as stdlib http server code. Manually allocate stack trace buffer size
+		// to prevent excessively large logs
+		const size = 64 << 10
+		stacktrace := make([]byte, size)
+		stacktrace = stacktrace[:runtime.Stack(stacktrace, false)]
+
+		*err = fmt.Errorf(
+			"recovered from panic %q. (err=%v) Call stack:\n%s",
+			r,
+			*err,
+			stacktrace)
+	}
+}
+
+// Must panics on non-nil errors. Useful to handling programmer level errors.
+func Must(err error) {
+	if err != nil {
+		panic(err)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime_stack_test.go b/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime_stack_test.go
new file mode 100644
index 0000000000..380ad5b1a5
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime_stack_test.go
@@ -0,0 +1,71 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"regexp"
+
+	"k8s.io/klog/v2"
+)
+
+//nolint:logcheck // Several functions are normally not okay in a package.
+func ExampleHandleErrorWithContext() {
+	state := klog.CaptureState()
+	defer state.Restore()
+	var fs flag.FlagSet
+	klog.InitFlags(&fs)
+	for flag, value := range map[string]string{
+		"one_output":  "true",
+		"logtostderr": "false",
+	} {
+		if err := fs.Set(flag, value); err != nil {
+			fmt.Printf("Unexpected error configuring klog: %v", err)
+			return
+		}
+	}
+	var buffer bytes.Buffer
+	klog.SetOutput(&buffer)
+
+	logger := klog.Background()
+	logger = klog.LoggerWithValues(logger, "request", 42)
+	ctx := klog.NewContext(context.Background(), logger)
+
+	// The line number of the next call must be at line 60. Here are some
+	// blank lines that can be removed to keep the line unchanged.
+	//
+	//
+	//
+	//
+	//
+	//
+	HandleErrorWithContext(ctx, errors.New("fake error"), "test")
+
+	klog.Flush()
+	// Strip varying header. Code location should be constant and something
+	// that needs to be tested.
+	output := buffer.String()
+	output = regexp.MustCompile(`^.* ([^[:space:]]*.go:[[:digit:]]*)\] `).ReplaceAllString(output, `xxx $1] `)
+	fmt.Print(output)
+
+	// Output:
+	// xxx runtime_stack_test.go:60] "test" err="fake error" logger="UnhandledError" request=42
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime_test.go b/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime_test.go
new file mode 100644
index 0000000000..5af48a7a80
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/runtime/runtime_test.go
@@ -0,0 +1,349 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"regexp"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	"k8s.io/klog/v2"
+	"k8s.io/klog/v2/textlogger"
+)
+
+func TestHandleCrash(t *testing.T) {
+	defer func() {
+		if x := recover(); x == nil {
+			t.Errorf("Expected a panic to recover from")
+		}
+	}()
+	//nolint:logcheck // Intentionally uses the old API.
+	defer HandleCrash()
+	panic("Test Panic")
+}
+
+func TestCustomHandleCrash(t *testing.T) {
+	old := PanicHandlers
+	defer func() { PanicHandlers = old }()
+	var result interface{}
+	PanicHandlers = []func(context.Context, interface{}){
+		func(_ context.Context, r interface{}) {
+			result = r
+		},
+	}
+	func() {
+		defer func() {
+			if x := recover(); x == nil {
+				t.Errorf("Expected a panic to recover from")
+			}
+		}()
+		//nolint:logcheck // Intentionally uses the old API.
+		defer HandleCrash()
+		panic("test")
+	}()
+	if result != "test" {
+		t.Errorf("did not receive custom handler")
+	}
+}
+
+func TestCustomHandleError(t *testing.T) {
+	old := ErrorHandlers
+	defer func() { ErrorHandlers = old }()
+	var result error
+	ErrorHandlers = []ErrorHandler{
+		func(_ context.Context, err error, msg string, keysAndValues ...interface{}) {
+			result = err
+		},
+	}
+	err := fmt.Errorf("test")
+	//nolint:logcheck // Intentionally uses the old API.
+	HandleError(err)
+	if result != err {
+		t.Errorf("did not receive custom handler")
+	}
+}
+
+func TestHandleCrashLog(t *testing.T) {
+	log, err := captureStderr(func() {
+		defer func() {
+			if r := recover(); r == nil {
+				t.Fatalf("expected a panic to recover from")
+			}
+		}()
+		//nolint:logcheck // Intentionally uses the old API.
+		defer HandleCrash()
+		panic("test panic")
+	})
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	// Example log:
+	//
+	// ...] Observed a panic: test panic
+	// goroutine 6 [running]:
+	// command-line-arguments.logPanic(0x..., 0x...)
+	// 	.../src/k8s.io/kubernetes/staging/src/k8s.io/apimachinery/pkg/util/runtime/runtime.go:69 +0x...
+	lines := strings.Split(log, "\n")
+	if len(lines) < 4 {
+		t.Fatalf("panic log should have 1 line of message, 1 line per goroutine and 2 lines per function call")
+	}
+	t.Logf("Got log output:\n%s", strings.Join(lines, "\n"))
+	if match, _ := regexp.MatchString(`"Observed a panic" panic="test panic"`, lines[0]); !match {
+		t.Errorf("mismatch panic message: %s", lines[0])
+	}
+	// The following regexp's verify that Kubernetes panic log matches Golang stdlib
+	// stacktrace pattern. We need to update these regexp's if stdlib changes its pattern.
+	if match, _ := regexp.MatchString(`goroutine [0-9]+ \[.+\]:`, lines[1]); !match {
+		t.Errorf("mismatch goroutine: %s", lines[1])
+	}
+	if match, _ := regexp.MatchString(`logPanic(.*)`, lines[2]); !match {
+		t.Errorf("mismatch symbolized function name: %s", lines[2])
+	}
+	if match, _ := regexp.MatchString(`runtime\.go:[0-9]+ \+0x`, lines[3]); !match {
+		t.Errorf("mismatch file/line/offset information: %s", lines[3])
+	}
+}
+
+func TestHandleCrashContextual(t *testing.T) {
+	for name, handleCrash := range map[string]func(logger klog.Logger, trigger func(), additionalHandlers ...func(context.Context, interface{})){
+		"WithLogger": func(logger klog.Logger, trigger func(), additionalHandlers ...func(context.Context, interface{})) {
+			logger = logger.WithCallDepth(2) // This function *and* the trigger helper.
+			defer HandleCrashWithLogger(logger, additionalHandlers...)
+			trigger()
+		},
+		"WithContext": func(logger klog.Logger, trigger func(), additionalHandlers ...func(context.Context, interface{})) {
+			logger = logger.WithCallDepth(2)
+			defer HandleCrashWithContext(klog.NewContext(context.Background(), logger), additionalHandlers...)
+			trigger()
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			for name, tt := range map[string]struct {
+				trigger     func()
+				expectPanic string
+			}{
+				"no-panic": {
+					trigger:     func() {},
+					expectPanic: "",
+				},
+				"string-panic": {
+					trigger:     func() { panic("fake") },
+					expectPanic: "fake",
+				},
+				"int-panic": {
+					trigger:     func() { panic(42) },
+					expectPanic: "42",
+				},
+			} {
+				t.Run(name, func(t *testing.T) {
+					var buffer bytes.Buffer
+					timeInUTC := time.Date(2009, 12, 1, 13, 30, 40, 42000, time.UTC)
+					timeString := "1201 13:30:40.000042"
+					logger := textlogger.NewLogger(textlogger.NewConfig(
+						textlogger.FixedTime(timeInUTC),
+						textlogger.Output(&buffer),
+					))
+					ReallyCrash = false
+					defer func() { ReallyCrash = true }()
+
+					handler := func(ctx context.Context, r interface{}) {
+						// Same formatting as in HandleCrash.
+						str, ok := r.(string)
+						if !ok {
+							str = fmt.Sprintf("%v", r)
+						}
+						klog.FromContext(ctx).Info("handler called", "panic", str)
+					}
+
+					_, _, line, _ := runtime.Caller(0)
+					handleCrash(logger, tt.trigger, handler)
+					if tt.expectPanic != "" {
+						assert.Contains(t, buffer.String(), fmt.Sprintf(`E%s %7d runtime_test.go:%d] "Observed a panic" panic=%q`, timeString, os.Getpid(), line+1, tt.expectPanic))
+						assert.Contains(t, buffer.String(), fmt.Sprintf(`I%s %7d runtime_test.go:%d] "handler called" panic=%q
+`, timeString, os.Getpid(), line+1, tt.expectPanic))
+					} else {
+						assert.Empty(t, buffer.String())
+					}
+				})
+			}
+		})
+	}
+}
+
+func TestHandleCrashLogSilenceHTTPErrAbortHandler(t *testing.T) {
+	log, err := captureStderr(func() {
+		defer func() {
+			if r := recover(); r != http.ErrAbortHandler {
+				t.Fatalf("expected to recover from http.ErrAbortHandler")
+			}
+		}()
+		//nolint:logcheck // Intentionally uses the old API.
+		defer HandleCrash()
+		panic(http.ErrAbortHandler)
+	})
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	if len(log) > 0 {
+		t.Fatalf("expected no stderr log, got: %s", log)
+	}
+}
+
+// captureStderr redirects stderr to result string, and then restore stderr from backup
+func captureStderr(f func()) (string, error) {
+	r, w, err := os.Pipe()
+	if err != nil {
+		return "", err
+	}
+	bak := os.Stderr
+	os.Stderr = w
+	defer func() { os.Stderr = bak }()
+
+	resultCh := make(chan string)
+	// copy the output in a separate goroutine so printing can't block indefinitely
+	go func() {
+		var buf bytes.Buffer
+		io.Copy(&buf, r)
+		resultCh <- buf.String()
+	}()
+
+	f()
+	w.Close()
+
+	return <-resultCh, nil
+}
+
+func Test_rudimentaryErrorBackoff_OnError_ParallelSleep(t *testing.T) {
+	r := &rudimentaryErrorBackoff{
+		minPeriod: time.Second,
+	}
+
+	start := make(chan struct{})
+	var wg sync.WaitGroup
+	for i := 0; i < 30; i++ {
+		wg.Add(1)
+		go func() {
+			<-start
+			r.OnError()
+			wg.Done()
+		}()
+	}
+	st := time.Now()
+	close(start)
+	wg.Wait()
+
+	if since := time.Since(st); since > 5*time.Second {
+		t.Errorf("OnError slept for too long: %s", since)
+	}
+}
+
+func TestHandleError(t *testing.T) {
+	for name, handleError := range map[string]func(logger klog.Logger, err error, msg string, keysAndValues ...interface{}){
+		"WithLogger": func(logger klog.Logger, err error, msg string, keysAndValues ...interface{}) {
+			helper, logger := logger.WithCallStackHelper()
+			helper()
+			HandleErrorWithLogger(logger, err, msg, keysAndValues...)
+		},
+		"WithContext": func(logger klog.Logger, err error, msg string, keysAndValues ...interface{}) {
+			helper, logger := logger.WithCallStackHelper()
+			helper()
+			HandleErrorWithContext(klog.NewContext(context.Background(), logger), err, msg, keysAndValues...)
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			for name, tc := range map[string]struct {
+				err           error
+				msg           string
+				keysAndValues []interface{}
+				expectLog     string
+			}{
+				"no-error": {
+					msg:       "hello world",
+					expectLog: `"hello world" logger="UnhandledError"`,
+				},
+				"complex": {
+					err:           errors.New("fake error"),
+					msg:           "ignore",
+					keysAndValues: []interface{}{"a", 1, "b", "c"},
+					expectLog:     `"ignore" err="fake error" logger="UnhandledError" a=1 b="c"`,
+				},
+			} {
+				t.Run(name, func(t *testing.T) {
+					var buffer bytes.Buffer
+					timeInUTC := time.Date(2009, 12, 1, 13, 30, 40, 42000, time.UTC)
+					timeString := "1201 13:30:40.000042"
+					logger := textlogger.NewLogger(textlogger.NewConfig(
+						textlogger.FixedTime(timeInUTC),
+						textlogger.Output(&buffer),
+					))
+
+					_, _, line, _ := runtime.Caller(0)
+					handleError(logger, tc.err, tc.msg, tc.keysAndValues...)
+					assert.Equal(t, fmt.Sprintf("E%s %7d runtime_test.go:%d] %s\n", timeString, os.Getpid(), line+1, tc.expectLog), buffer.String())
+				})
+			}
+		})
+	}
+}
+
+func TestErrorToString(t *testing.T) {
+	for name, tt := range map[string]struct {
+		err          error
+		msg          string
+		kvs          []any
+		expectString string
+	}{
+		"simple": {
+			errors.New("some error"),
+			"Unhandled error",
+			nil,
+			`"Unhandled error" err="some error"`,
+		},
+		"nil-error": {
+			nil,
+			"Some problem occurred",
+			nil,
+			`"Some problem occurred"`,
+		},
+		"keys-and-values": {
+			errors.New("some error"),
+			"Some error occurred",
+			[]any{"str", "foobar", "int", 1, "multiLine", "line 1\nline 2"},
+			`"Some error occurred" err="some error" str="foobar" int=1 multiLine=<
+	line 1
+	line 2
+ >`,
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			actualString := ErrorToString(tt.err, tt.msg, tt.kvs...)
+			assert.Equal(t, tt.expectString, actualString)
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/sets/byte.go b/third_party/k8s.io/apimachinery/pkg/util/sets/byte.go
new file mode 100644
index 0000000000..4d7a17c3af
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/sets/byte.go
@@ -0,0 +1,137 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+// Byte is a set of bytes, implemented via map[byte]struct{} for minimal memory consumption.
+//
+// Deprecated: use generic Set instead.
+// new ways:
+// s1 := Set[byte]{}
+// s2 := New[byte]()
+type Byte map[byte]Empty
+
+// NewByte creates a Byte from a list of values.
+func NewByte(items ...byte) Byte {
+	return Byte(New[byte](items...))
+}
+
+// ByteKeySet creates a Byte from a keys of a map[byte](? extends interface{}).
+// If the value passed in is not actually a map, this will panic.
+func ByteKeySet[T any](theMap map[byte]T) Byte {
+	return Byte(KeySet(theMap))
+}
+
+// Insert adds items to the set.
+func (s Byte) Insert(items ...byte) Byte {
+	return Byte(cast(s).Insert(items...))
+}
+
+// Delete removes all items from the set.
+func (s Byte) Delete(items ...byte) Byte {
+	return Byte(cast(s).Delete(items...))
+}
+
+// Has returns true if and only if item is contained in the set.
+func (s Byte) Has(item byte) bool {
+	return cast(s).Has(item)
+}
+
+// HasAll returns true if and only if all items are contained in the set.
+func (s Byte) HasAll(items ...byte) bool {
+	return cast(s).HasAll(items...)
+}
+
+// HasAny returns true if any items are contained in the set.
+func (s Byte) HasAny(items ...byte) bool {
+	return cast(s).HasAny(items...)
+}
+
+// Clone returns a new set which is a copy of the current set.
+func (s Byte) Clone() Byte {
+	return Byte(cast(s).Clone())
+}
+
+// Difference returns a set of objects that are not in s2.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.Difference(s2) = {a3}
+// s2.Difference(s1) = {a4, a5}
+func (s1 Byte) Difference(s2 Byte) Byte {
+	return Byte(cast(s1).Difference(cast(s2)))
+}
+
+// SymmetricDifference returns a set of elements which are in either of the sets, but not in their intersection.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.SymmetricDifference(s2) = {a3, a4, a5}
+// s2.SymmetricDifference(s1) = {a3, a4, a5}
+func (s1 Byte) SymmetricDifference(s2 Byte) Byte {
+	return Byte(cast(s1).SymmetricDifference(cast(s2)))
+}
+
+// Union returns a new set which includes items in either s1 or s2.
+// For example:
+// s1 = {a1, a2}
+// s2 = {a3, a4}
+// s1.Union(s2) = {a1, a2, a3, a4}
+// s2.Union(s1) = {a1, a2, a3, a4}
+func (s1 Byte) Union(s2 Byte) Byte {
+	return Byte(cast(s1).Union(cast(s2)))
+}
+
+// Intersection returns a new set which includes the item in BOTH s1 and s2
+// For example:
+// s1 = {a1, a2}
+// s2 = {a2, a3}
+// s1.Intersection(s2) = {a2}
+func (s1 Byte) Intersection(s2 Byte) Byte {
+	return Byte(cast(s1).Intersection(cast(s2)))
+}
+
+// IsSuperset returns true if and only if s1 is a superset of s2.
+func (s1 Byte) IsSuperset(s2 Byte) bool {
+	return cast(s1).IsSuperset(cast(s2))
+}
+
+// Equal returns true if and only if s1 is equal (as a set) to s2.
+// Two sets are equal if their membership is identical.
+// (In practice, this means same elements, order doesn't matter)
+func (s1 Byte) Equal(s2 Byte) bool {
+	return cast(s1).Equal(cast(s2))
+}
+
+// List returns the contents as a sorted byte slice.
+func (s Byte) List() []byte {
+	return List(cast(s))
+}
+
+// UnsortedList returns the slice with contents in random order.
+func (s Byte) UnsortedList() []byte {
+	return cast(s).UnsortedList()
+}
+
+// PopAny returns a single element from the set.
+func (s Byte) PopAny() (byte, bool) {
+	return cast(s).PopAny()
+}
+
+// Len returns the size of the set.
+func (s Byte) Len() int {
+	return len(s)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/sets/doc.go b/third_party/k8s.io/apimachinery/pkg/util/sets/doc.go
new file mode 100644
index 0000000000..194883390c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/sets/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package sets has generic set and specified sets. Generic set will
+// replace specified ones over time. And specific ones are deprecated.
+package sets
diff --git a/third_party/k8s.io/apimachinery/pkg/util/sets/empty.go b/third_party/k8s.io/apimachinery/pkg/util/sets/empty.go
new file mode 100644
index 0000000000..fbb1df06d9
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/sets/empty.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+// Empty is public since it is used by some internal API objects for conversions between external
+// string arrays and internal sets, and conversion logic requires public types today.
+type Empty struct{}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/sets/int.go b/third_party/k8s.io/apimachinery/pkg/util/sets/int.go
new file mode 100644
index 0000000000..5876fc9deb
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/sets/int.go
@@ -0,0 +1,137 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+// Int is a set of ints, implemented via map[int]struct{} for minimal memory consumption.
+//
+// Deprecated: use generic Set instead.
+// new ways:
+// s1 := Set[int]{}
+// s2 := New[int]()
+type Int map[int]Empty
+
+// NewInt creates a Int from a list of values.
+func NewInt(items ...int) Int {
+	return Int(New[int](items...))
+}
+
+// IntKeySet creates a Int from a keys of a map[int](? extends interface{}).
+// If the value passed in is not actually a map, this will panic.
+func IntKeySet[T any](theMap map[int]T) Int {
+	return Int(KeySet(theMap))
+}
+
+// Insert adds items to the set.
+func (s Int) Insert(items ...int) Int {
+	return Int(cast(s).Insert(items...))
+}
+
+// Delete removes all items from the set.
+func (s Int) Delete(items ...int) Int {
+	return Int(cast(s).Delete(items...))
+}
+
+// Has returns true if and only if item is contained in the set.
+func (s Int) Has(item int) bool {
+	return cast(s).Has(item)
+}
+
+// HasAll returns true if and only if all items are contained in the set.
+func (s Int) HasAll(items ...int) bool {
+	return cast(s).HasAll(items...)
+}
+
+// HasAny returns true if any items are contained in the set.
+func (s Int) HasAny(items ...int) bool {
+	return cast(s).HasAny(items...)
+}
+
+// Clone returns a new set which is a copy of the current set.
+func (s Int) Clone() Int {
+	return Int(cast(s).Clone())
+}
+
+// Difference returns a set of objects that are not in s2.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.Difference(s2) = {a3}
+// s2.Difference(s1) = {a4, a5}
+func (s1 Int) Difference(s2 Int) Int {
+	return Int(cast(s1).Difference(cast(s2)))
+}
+
+// SymmetricDifference returns a set of elements which are in either of the sets, but not in their intersection.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.SymmetricDifference(s2) = {a3, a4, a5}
+// s2.SymmetricDifference(s1) = {a3, a4, a5}
+func (s1 Int) SymmetricDifference(s2 Int) Int {
+	return Int(cast(s1).SymmetricDifference(cast(s2)))
+}
+
+// Union returns a new set which includes items in either s1 or s2.
+// For example:
+// s1 = {a1, a2}
+// s2 = {a3, a4}
+// s1.Union(s2) = {a1, a2, a3, a4}
+// s2.Union(s1) = {a1, a2, a3, a4}
+func (s1 Int) Union(s2 Int) Int {
+	return Int(cast(s1).Union(cast(s2)))
+}
+
+// Intersection returns a new set which includes the item in BOTH s1 and s2
+// For example:
+// s1 = {a1, a2}
+// s2 = {a2, a3}
+// s1.Intersection(s2) = {a2}
+func (s1 Int) Intersection(s2 Int) Int {
+	return Int(cast(s1).Intersection(cast(s2)))
+}
+
+// IsSuperset returns true if and only if s1 is a superset of s2.
+func (s1 Int) IsSuperset(s2 Int) bool {
+	return cast(s1).IsSuperset(cast(s2))
+}
+
+// Equal returns true if and only if s1 is equal (as a set) to s2.
+// Two sets are equal if their membership is identical.
+// (In practice, this means same elements, order doesn't matter)
+func (s1 Int) Equal(s2 Int) bool {
+	return cast(s1).Equal(cast(s2))
+}
+
+// List returns the contents as a sorted int slice.
+func (s Int) List() []int {
+	return List(cast(s))
+}
+
+// UnsortedList returns the slice with contents in random order.
+func (s Int) UnsortedList() []int {
+	return cast(s).UnsortedList()
+}
+
+// PopAny returns a single element from the set.
+func (s Int) PopAny() (int, bool) {
+	return cast(s).PopAny()
+}
+
+// Len returns the size of the set.
+func (s Int) Len() int {
+	return len(s)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/sets/int32.go b/third_party/k8s.io/apimachinery/pkg/util/sets/int32.go
new file mode 100644
index 0000000000..2c640c5d0f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/sets/int32.go
@@ -0,0 +1,137 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+// Int32 is a set of int32s, implemented via map[int32]struct{} for minimal memory consumption.
+//
+// Deprecated: use generic Set instead.
+// new ways:
+// s1 := Set[int32]{}
+// s2 := New[int32]()
+type Int32 map[int32]Empty
+
+// NewInt32 creates a Int32 from a list of values.
+func NewInt32(items ...int32) Int32 {
+	return Int32(New[int32](items...))
+}
+
+// Int32KeySet creates a Int32 from a keys of a map[int32](? extends interface{}).
+// If the value passed in is not actually a map, this will panic.
+func Int32KeySet[T any](theMap map[int32]T) Int32 {
+	return Int32(KeySet(theMap))
+}
+
+// Insert adds items to the set.
+func (s Int32) Insert(items ...int32) Int32 {
+	return Int32(cast(s).Insert(items...))
+}
+
+// Delete removes all items from the set.
+func (s Int32) Delete(items ...int32) Int32 {
+	return Int32(cast(s).Delete(items...))
+}
+
+// Has returns true if and only if item is contained in the set.
+func (s Int32) Has(item int32) bool {
+	return cast(s).Has(item)
+}
+
+// HasAll returns true if and only if all items are contained in the set.
+func (s Int32) HasAll(items ...int32) bool {
+	return cast(s).HasAll(items...)
+}
+
+// HasAny returns true if any items are contained in the set.
+func (s Int32) HasAny(items ...int32) bool {
+	return cast(s).HasAny(items...)
+}
+
+// Clone returns a new set which is a copy of the current set.
+func (s Int32) Clone() Int32 {
+	return Int32(cast(s).Clone())
+}
+
+// Difference returns a set of objects that are not in s2.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.Difference(s2) = {a3}
+// s2.Difference(s1) = {a4, a5}
+func (s1 Int32) Difference(s2 Int32) Int32 {
+	return Int32(cast(s1).Difference(cast(s2)))
+}
+
+// SymmetricDifference returns a set of elements which are in either of the sets, but not in their intersection.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.SymmetricDifference(s2) = {a3, a4, a5}
+// s2.SymmetricDifference(s1) = {a3, a4, a5}
+func (s1 Int32) SymmetricDifference(s2 Int32) Int32 {
+	return Int32(cast(s1).SymmetricDifference(cast(s2)))
+}
+
+// Union returns a new set which includes items in either s1 or s2.
+// For example:
+// s1 = {a1, a2}
+// s2 = {a3, a4}
+// s1.Union(s2) = {a1, a2, a3, a4}
+// s2.Union(s1) = {a1, a2, a3, a4}
+func (s1 Int32) Union(s2 Int32) Int32 {
+	return Int32(cast(s1).Union(cast(s2)))
+}
+
+// Intersection returns a new set which includes the item in BOTH s1 and s2
+// For example:
+// s1 = {a1, a2}
+// s2 = {a2, a3}
+// s1.Intersection(s2) = {a2}
+func (s1 Int32) Intersection(s2 Int32) Int32 {
+	return Int32(cast(s1).Intersection(cast(s2)))
+}
+
+// IsSuperset returns true if and only if s1 is a superset of s2.
+func (s1 Int32) IsSuperset(s2 Int32) bool {
+	return cast(s1).IsSuperset(cast(s2))
+}
+
+// Equal returns true if and only if s1 is equal (as a set) to s2.
+// Two sets are equal if their membership is identical.
+// (In practice, this means same elements, order doesn't matter)
+func (s1 Int32) Equal(s2 Int32) bool {
+	return cast(s1).Equal(cast(s2))
+}
+
+// List returns the contents as a sorted int32 slice.
+func (s Int32) List() []int32 {
+	return List(cast(s))
+}
+
+// UnsortedList returns the slice with contents in random order.
+func (s Int32) UnsortedList() []int32 {
+	return cast(s).UnsortedList()
+}
+
+// PopAny returns a single element from the set.
+func (s Int32) PopAny() (int32, bool) {
+	return cast(s).PopAny()
+}
+
+// Len returns the size of the set.
+func (s Int32) Len() int {
+	return len(s)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/sets/int64.go b/third_party/k8s.io/apimachinery/pkg/util/sets/int64.go
new file mode 100644
index 0000000000..bf3eb3ffa2
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/sets/int64.go
@@ -0,0 +1,137 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+// Int64 is a set of int64s, implemented via map[int64]struct{} for minimal memory consumption.
+//
+// Deprecated: use generic Set instead.
+// new ways:
+// s1 := Set[int64]{}
+// s2 := New[int64]()
+type Int64 map[int64]Empty
+
+// NewInt64 creates a Int64 from a list of values.
+func NewInt64(items ...int64) Int64 {
+	return Int64(New[int64](items...))
+}
+
+// Int64KeySet creates a Int64 from a keys of a map[int64](? extends interface{}).
+// If the value passed in is not actually a map, this will panic.
+func Int64KeySet[T any](theMap map[int64]T) Int64 {
+	return Int64(KeySet(theMap))
+}
+
+// Insert adds items to the set.
+func (s Int64) Insert(items ...int64) Int64 {
+	return Int64(cast(s).Insert(items...))
+}
+
+// Delete removes all items from the set.
+func (s Int64) Delete(items ...int64) Int64 {
+	return Int64(cast(s).Delete(items...))
+}
+
+// Has returns true if and only if item is contained in the set.
+func (s Int64) Has(item int64) bool {
+	return cast(s).Has(item)
+}
+
+// HasAll returns true if and only if all items are contained in the set.
+func (s Int64) HasAll(items ...int64) bool {
+	return cast(s).HasAll(items...)
+}
+
+// HasAny returns true if any items are contained in the set.
+func (s Int64) HasAny(items ...int64) bool {
+	return cast(s).HasAny(items...)
+}
+
+// Clone returns a new set which is a copy of the current set.
+func (s Int64) Clone() Int64 {
+	return Int64(cast(s).Clone())
+}
+
+// Difference returns a set of objects that are not in s2.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.Difference(s2) = {a3}
+// s2.Difference(s1) = {a4, a5}
+func (s1 Int64) Difference(s2 Int64) Int64 {
+	return Int64(cast(s1).Difference(cast(s2)))
+}
+
+// SymmetricDifference returns a set of elements which are in either of the sets, but not in their intersection.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.SymmetricDifference(s2) = {a3, a4, a5}
+// s2.SymmetricDifference(s1) = {a3, a4, a5}
+func (s1 Int64) SymmetricDifference(s2 Int64) Int64 {
+	return Int64(cast(s1).SymmetricDifference(cast(s2)))
+}
+
+// Union returns a new set which includes items in either s1 or s2.
+// For example:
+// s1 = {a1, a2}
+// s2 = {a3, a4}
+// s1.Union(s2) = {a1, a2, a3, a4}
+// s2.Union(s1) = {a1, a2, a3, a4}
+func (s1 Int64) Union(s2 Int64) Int64 {
+	return Int64(cast(s1).Union(cast(s2)))
+}
+
+// Intersection returns a new set which includes the item in BOTH s1 and s2
+// For example:
+// s1 = {a1, a2}
+// s2 = {a2, a3}
+// s1.Intersection(s2) = {a2}
+func (s1 Int64) Intersection(s2 Int64) Int64 {
+	return Int64(cast(s1).Intersection(cast(s2)))
+}
+
+// IsSuperset returns true if and only if s1 is a superset of s2.
+func (s1 Int64) IsSuperset(s2 Int64) bool {
+	return cast(s1).IsSuperset(cast(s2))
+}
+
+// Equal returns true if and only if s1 is equal (as a set) to s2.
+// Two sets are equal if their membership is identical.
+// (In practice, this means same elements, order doesn't matter)
+func (s1 Int64) Equal(s2 Int64) bool {
+	return cast(s1).Equal(cast(s2))
+}
+
+// List returns the contents as a sorted int64 slice.
+func (s Int64) List() []int64 {
+	return List(cast(s))
+}
+
+// UnsortedList returns the slice with contents in random order.
+func (s Int64) UnsortedList() []int64 {
+	return cast(s).UnsortedList()
+}
+
+// PopAny returns a single element from the set.
+func (s Int64) PopAny() (int64, bool) {
+	return cast(s).PopAny()
+}
+
+// Len returns the size of the set.
+func (s Int64) Len() int {
+	return len(s)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/sets/set.go b/third_party/k8s.io/apimachinery/pkg/util/sets/set.go
new file mode 100644
index 0000000000..ae3d15eb25
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/sets/set.go
@@ -0,0 +1,223 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+import (
+	"cmp"
+	"slices"
+)
+
+// Set is a set of the same type elements, implemented via map[comparable]struct{} for minimal memory consumption.
+type Set[T comparable] map[T]Empty
+
+// cast transforms specified set to generic Set[T].
+func cast[T comparable](s map[T]Empty) Set[T] { return s }
+
+// New creates a Set from a list of values.
+// NOTE: type param must be explicitly instantiated if given items are empty.
+func New[T comparable](items ...T) Set[T] {
+	ss := make(Set[T], len(items))
+	ss.Insert(items...)
+	return ss
+}
+
+// KeySet creates a Set from a keys of a map[comparable](? extends interface{}).
+// If the value passed in is not actually a map, this will panic.
+func KeySet[T comparable, V any](theMap map[T]V) Set[T] {
+	ret := make(Set[T], len(theMap))
+	for keyValue := range theMap {
+		ret.Insert(keyValue)
+	}
+	return ret
+}
+
+// Insert adds items to the set.
+func (s Set[T]) Insert(items ...T) Set[T] {
+	for _, item := range items {
+		s[item] = Empty{}
+	}
+	return s
+}
+
+func Insert[T comparable](set Set[T], items ...T) Set[T] {
+	return set.Insert(items...)
+}
+
+// Delete removes all items from the set.
+func (s Set[T]) Delete(items ...T) Set[T] {
+	for _, item := range items {
+		delete(s, item)
+	}
+	return s
+}
+
+// Clear empties the set.
+// It is preferable to replace the set with a newly constructed set,
+// but not all callers can do that (when there are other references to the map).
+func (s Set[T]) Clear() Set[T] {
+	clear(s)
+	return s
+}
+
+// Has returns true if and only if item is contained in the set.
+func (s Set[T]) Has(item T) bool {
+	_, contained := s[item]
+	return contained
+}
+
+// HasAll returns true if and only if all items are contained in the set.
+func (s Set[T]) HasAll(items ...T) bool {
+	for _, item := range items {
+		if !s.Has(item) {
+			return false
+		}
+	}
+	return true
+}
+
+// HasAny returns true if any items are contained in the set.
+func (s Set[T]) HasAny(items ...T) bool {
+	for _, item := range items {
+		if s.Has(item) {
+			return true
+		}
+	}
+	return false
+}
+
+// Clone returns a new set which is a copy of the current set.
+func (s Set[T]) Clone() Set[T] {
+	result := make(Set[T], len(s))
+	for key := range s {
+		result.Insert(key)
+	}
+	return result
+}
+
+// Difference returns a set of objects that are not in s2.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.Difference(s2) = {a3}
+// s2.Difference(s1) = {a4, a5}
+func (s1 Set[T]) Difference(s2 Set[T]) Set[T] {
+	result := New[T]()
+	for key := range s1 {
+		if !s2.Has(key) {
+			result.Insert(key)
+		}
+	}
+	return result
+}
+
+// SymmetricDifference returns a set of elements which are in either of the sets, but not in their intersection.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.SymmetricDifference(s2) = {a3, a4, a5}
+// s2.SymmetricDifference(s1) = {a3, a4, a5}
+func (s1 Set[T]) SymmetricDifference(s2 Set[T]) Set[T] {
+	return s1.Difference(s2).Union(s2.Difference(s1))
+}
+
+// Union returns a new set which includes items in either s1 or s2.
+// For example:
+// s1 = {a1, a2}
+// s2 = {a3, a4}
+// s1.Union(s2) = {a1, a2, a3, a4}
+// s2.Union(s1) = {a1, a2, a3, a4}
+func (s1 Set[T]) Union(s2 Set[T]) Set[T] {
+	result := s1.Clone()
+	for key := range s2 {
+		result.Insert(key)
+	}
+	return result
+}
+
+// Intersection returns a new set which includes the item in BOTH s1 and s2
+// For example:
+// s1 = {a1, a2}
+// s2 = {a2, a3}
+// s1.Intersection(s2) = {a2}
+func (s1 Set[T]) Intersection(s2 Set[T]) Set[T] {
+	var walk, other Set[T]
+	result := New[T]()
+	if s1.Len() < s2.Len() {
+		walk = s1
+		other = s2
+	} else {
+		walk = s2
+		other = s1
+	}
+	for key := range walk {
+		if other.Has(key) {
+			result.Insert(key)
+		}
+	}
+	return result
+}
+
+// IsSuperset returns true if and only if s1 is a superset of s2.
+func (s1 Set[T]) IsSuperset(s2 Set[T]) bool {
+	for item := range s2 {
+		if !s1.Has(item) {
+			return false
+		}
+	}
+	return true
+}
+
+// Equal returns true if and only if s1 is equal (as a set) to s2.
+// Two sets are equal if their membership is identical.
+// (In practice, this means same elements, order doesn't matter)
+func (s1 Set[T]) Equal(s2 Set[T]) bool {
+	return len(s1) == len(s2) && s1.IsSuperset(s2)
+}
+
+// List returns the contents as a sorted T slice.
+//
+// This is a separate function and not a method because not all types supported
+// by Generic are ordered and only those can be sorted.
+func List[T cmp.Ordered](s Set[T]) []T {
+	res := s.UnsortedList()
+	slices.Sort(res)
+	return res
+}
+
+// UnsortedList returns the slice with contents in random order.
+func (s Set[T]) UnsortedList() []T {
+	res := make([]T, 0, len(s))
+	for key := range s {
+		res = append(res, key)
+	}
+	return res
+}
+
+// PopAny returns a single element from the set.
+func (s Set[T]) PopAny() (T, bool) {
+	for key := range s {
+		s.Delete(key)
+		return key, true
+	}
+	var zeroValue T
+	return zeroValue, false
+}
+
+// Len returns the size of the set.
+func (s Set[T]) Len() int {
+	return len(s)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/sets/set_generic_test.go b/third_party/k8s.io/apimachinery/pkg/util/sets/set_generic_test.go
new file mode 100644
index 0000000000..e439a553d0
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/sets/set_generic_test.go
@@ -0,0 +1,375 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets_test
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+func TestSet(t *testing.T) {
+	s := sets.Set[string]{}
+	s2 := sets.Set[string]{}
+	if len(s) != 0 {
+		t.Errorf("Expected len=0: %d", len(s))
+	}
+	s.Insert("a", "b")
+	if len(s) != 2 {
+		t.Errorf("Expected len=2: %d", len(s))
+	}
+	s.Insert("c")
+	if s.Has("d") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if !s.Has("a") {
+		t.Errorf("Missing contents: %#v", s)
+	}
+	s.Delete("a")
+	if s.Has("a") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	s.Insert("a")
+	if s.HasAll("a", "b", "d") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if !s.HasAll("a", "b") {
+		t.Errorf("Missing contents: %#v", s)
+	}
+	s2.Insert("a", "b", "d")
+	if s.IsSuperset(s2) {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	s2.Delete("d")
+	if !s.IsSuperset(s2) {
+		t.Errorf("Missing contents: %#v", s)
+	}
+}
+
+func TestSetDeleteMultiples(t *testing.T) {
+	s := sets.Set[string]{}
+	s.Insert("a", "b", "c")
+	if len(s) != 3 {
+		t.Errorf("Expected len=3: %d", len(s))
+	}
+
+	s.Delete("a", "c")
+	if len(s) != 1 {
+		t.Errorf("Expected len=1: %d", len(s))
+	}
+	if s.Has("a") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if s.Has("c") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if !s.Has("b") {
+		t.Errorf("Missing contents: %#v", s)
+	}
+
+}
+
+func TestSetClear(t *testing.T) {
+	s := sets.Set[string]{}
+	s.Insert("a", "b", "c")
+	if s.Len() != 3 {
+		t.Errorf("Expected len=3: %d", s.Len())
+	}
+
+	s.Clear()
+	if s.Len() != 0 {
+		t.Errorf("Expected len=0: %d", s.Len())
+	}
+}
+
+func TestSetClearWithSharedReference(t *testing.T) {
+	s := sets.Set[string]{}
+	s.Insert("a", "b", "c")
+	if s.Len() != 3 {
+		t.Errorf("Expected len=3: %d", s.Len())
+	}
+
+	m := s
+	s.Clear()
+	if s.Len() != 0 {
+		t.Errorf("Expected len=0 on the cleared set: %d", s.Len())
+	}
+	if m.Len() != 0 {
+		t.Errorf("Expected len=0 on the shared reference: %d", m.Len())
+	}
+}
+
+func TestSetClearInSeparateFunction(t *testing.T) {
+	s := sets.Set[string]{}
+	s.Insert("a", "b", "c")
+	if s.Len() != 3 {
+		t.Errorf("Expected len=3: %d", s.Len())
+	}
+
+	clearSetAndAdd(s, "d")
+	if s.Len() != 1 {
+		t.Errorf("Expected len=1: %d", s.Len())
+	}
+	if !s.Has("d") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+}
+
+func clearSetAndAdd[T comparable](s sets.Set[T], a T) {
+	s.Clear()
+	s.Insert(a)
+}
+
+func TestNewSet(t *testing.T) {
+	s := sets.New("a", "b", "c")
+	if len(s) != 3 {
+		t.Errorf("Expected len=3: %d", len(s))
+	}
+	if !s.Has("a") || !s.Has("b") || !s.Has("c") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+}
+
+func TestKeySet(t *testing.T) {
+	m := map[string]int{"a": 1, "b": 2, "c": 3}
+	ss := sets.KeySet[string](m)
+	if !ss.Equal(sets.New("a", "b", "c")) {
+		t.Errorf("Unexpected contents: %#v", sets.List(ss))
+	}
+}
+
+func TestNewEmptySet(t *testing.T) {
+	s := sets.New[string]()
+	if len(s) != 0 {
+		t.Errorf("Expected len=0: %d", len(s))
+	}
+	s.Insert("a", "b", "c")
+	if len(s) != 3 {
+		t.Errorf("Expected len=3: %d", len(s))
+	}
+	if !s.Has("a") || !s.Has("b") || !s.Has("c") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+}
+
+func TestSortedList(t *testing.T) {
+	s := sets.New("z", "y", "x", "a")
+	if !reflect.DeepEqual(sets.List(s), []string{"a", "x", "y", "z"}) {
+		t.Errorf("List gave unexpected result: %#v", sets.List(s))
+	}
+}
+
+func TestSetDifference(t *testing.T) {
+	a := sets.New("1", "2", "3")
+	b := sets.New("1", "2", "4", "5")
+	c := a.Difference(b)
+	d := b.Difference(a)
+	if len(c) != 1 {
+		t.Errorf("Expected len=1: %d", len(c))
+	}
+	if !c.Has("3") {
+		t.Errorf("Unexpected contents: %#v", sets.List(c))
+	}
+	if len(d) != 2 {
+		t.Errorf("Expected len=2: %d", len(d))
+	}
+	if !d.Has("4") || !d.Has("5") {
+		t.Errorf("Unexpected contents: %#v", sets.List(d))
+	}
+}
+
+func TestSetSymmetricDifference(t *testing.T) {
+	a := sets.New("1", "2", "3")
+	b := sets.New("1", "2", "4", "5")
+	c := a.SymmetricDifference(b)
+	d := b.SymmetricDifference(a)
+	if !c.Equal(sets.New("3", "4", "5")) {
+		t.Errorf("Unexpected contents: %#v", sets.List(c))
+	}
+	if !d.Equal(sets.New("3", "4", "5")) {
+		t.Errorf("Unexpected contents: %#v", sets.List(d))
+	}
+}
+
+func TestSetHasAny(t *testing.T) {
+	a := sets.New("1", "2", "3")
+
+	if !a.HasAny("1", "4") {
+		t.Errorf("expected true, got false")
+	}
+
+	if a.HasAny("0", "4") {
+		t.Errorf("expected false, got true")
+	}
+}
+
+func TestSetEquals(t *testing.T) {
+	// Simple case (order doesn't matter)
+	a := sets.New("1", "2")
+	b := sets.New("2", "1")
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	// It is a set; duplicates are ignored
+	b = sets.New("2", "2", "1")
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	// Edge cases around empty sets / empty strings
+	a = sets.New[string]()
+	b = sets.New[string]()
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	b = sets.New("1", "2", "3")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	b = sets.New("1", "2", "")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	// Check for equality after mutation
+	a = sets.New[string]()
+	a.Insert("1")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	a.Insert("2")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	a.Insert("")
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	a.Delete("")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+}
+
+func TestUnion(t *testing.T) {
+	tests := []struct {
+		s1       sets.Set[string]
+		s2       sets.Set[string]
+		expected sets.Set[string]
+	}{
+		{
+			sets.New("1", "2", "3", "4"),
+			sets.New("3", "4", "5", "6"),
+			sets.New("1", "2", "3", "4", "5", "6"),
+		},
+		{
+			sets.New("1", "2", "3", "4"),
+			sets.New[string](),
+			sets.New("1", "2", "3", "4"),
+		},
+		{
+			sets.New[string](),
+			sets.New("1", "2", "3", "4"),
+			sets.New("1", "2", "3", "4"),
+		},
+		{
+			sets.New[string](),
+			sets.New[string](),
+			sets.New[string](),
+		},
+	}
+
+	for _, test := range tests {
+		union := test.s1.Union(test.s2)
+		if union.Len() != test.expected.Len() {
+			t.Errorf("Expected union.Len()=%d but got %d", test.expected.Len(), union.Len())
+		}
+
+		if !union.Equal(test.expected) {
+			t.Errorf("Expected union.Equal(expected) but not true.  union:%v expected:%v", sets.List(union), sets.List(test.expected))
+		}
+	}
+}
+
+func TestIntersection(t *testing.T) {
+	tests := []struct {
+		s1       sets.Set[string]
+		s2       sets.Set[string]
+		expected sets.Set[string]
+	}{
+		{
+			sets.New("1", "2", "3", "4"),
+			sets.New("3", "4", "5", "6"),
+			sets.New("3", "4"),
+		},
+		{
+			sets.New("1", "2", "3", "4"),
+			sets.New("1", "2", "3", "4"),
+			sets.New("1", "2", "3", "4"),
+		},
+		{
+			sets.New("1", "2", "3", "4"),
+			sets.New[string](),
+			sets.New[string](),
+		},
+		{
+			sets.New[string](),
+			sets.New("1", "2", "3", "4"),
+			sets.New[string](),
+		},
+		{
+			sets.New[string](),
+			sets.New[string](),
+			sets.New[string](),
+		},
+	}
+
+	for _, test := range tests {
+		intersection := test.s1.Intersection(test.s2)
+		if intersection.Len() != test.expected.Len() {
+			t.Errorf("Expected intersection.Len()=%d but got %d", test.expected.Len(), intersection.Len())
+		}
+
+		if !intersection.Equal(test.expected) {
+			t.Errorf("Expected intersection.Equal(expected) but not true.  intersection:%v expected:%v", sets.List(intersection), sets.List(intersection))
+		}
+	}
+}
+
+func BenchmarkListSmall(b *testing.B) {
+	s := sets.New("a", "b", "c", "d", "e", "f", "g", "h", "i", "j")
+	for b.Loop() {
+		sets.List(s)
+	}
+}
+
+func BenchmarkListLarge(b *testing.B) {
+	s := make(sets.Set[int], 12345)
+	for i := range 12345 {
+		s.Insert(i * 7)
+	}
+	for b.Loop() {
+		sets.List(s)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/sets/set_test.go b/third_party/k8s.io/apimachinery/pkg/util/sets/set_test.go
new file mode 100644
index 0000000000..9f492c1f4b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/sets/set_test.go
@@ -0,0 +1,373 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+import (
+	"fmt"
+	"math/rand"
+	"reflect"
+	"testing"
+)
+
+func TestStringSet(t *testing.T) {
+	s := String{}
+	s2 := String{}
+	if len(s) != 0 {
+		t.Errorf("Expected len=0: %d", len(s))
+	}
+	s.Insert("a", "b")
+	if len(s) != 2 {
+		t.Errorf("Expected len=2: %d", len(s))
+	}
+	s.Insert("c")
+	if s.Has("d") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if !s.Has("a") {
+		t.Errorf("Missing contents: %#v", s)
+	}
+	s.Delete("a")
+	if s.Has("a") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	s.Insert("a")
+	if s.HasAll("a", "b", "d") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if !s.HasAll("a", "b") {
+		t.Errorf("Missing contents: %#v", s)
+	}
+	s2.Insert("a", "b", "d")
+	if s.IsSuperset(s2) {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	s2.Delete("d")
+	if !s.IsSuperset(s2) {
+		t.Errorf("Missing contents: %#v", s)
+	}
+}
+
+func TestStringSetDeleteMultiples(t *testing.T) {
+	s := String{}
+	s.Insert("a", "b", "c")
+	if len(s) != 3 {
+		t.Errorf("Expected len=3: %d", len(s))
+	}
+
+	s.Delete("a", "c")
+	if len(s) != 1 {
+		t.Errorf("Expected len=1: %d", len(s))
+	}
+	if s.Has("a") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if s.Has("c") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+	if !s.Has("b") {
+		t.Errorf("Missing contents: %#v", s)
+	}
+
+}
+
+func TestNewStringSet(t *testing.T) {
+	s := NewString("a", "b", "c")
+	if len(s) != 3 {
+		t.Errorf("Expected len=3: %d", len(s))
+	}
+	if !s.Has("a") || !s.Has("b") || !s.Has("c") {
+		t.Errorf("Unexpected contents: %#v", s)
+	}
+}
+
+func TestStringSetList(t *testing.T) {
+	s := NewString("z", "y", "x", "a")
+	if !reflect.DeepEqual(s.List(), []string{"a", "x", "y", "z"}) {
+		t.Errorf("List gave unexpected result: %#v", s.List())
+	}
+}
+
+func TestStringSetDifference(t *testing.T) {
+	a := NewString("1", "2", "3")
+	b := NewString("1", "2", "4", "5")
+	c := a.Difference(b)
+	d := b.Difference(a)
+	if len(c) != 1 {
+		t.Errorf("Expected len=1: %d", len(c))
+	}
+	if !c.Has("3") {
+		t.Errorf("Unexpected contents: %#v", c.List())
+	}
+	if len(d) != 2 {
+		t.Errorf("Expected len=2: %d", len(d))
+	}
+	if !d.Has("4") || !d.Has("5") {
+		t.Errorf("Unexpected contents: %#v", d.List())
+	}
+}
+
+func TestStringSetSymmetricDifference(t *testing.T) {
+	a := NewString("1", "2", "3")
+	b := NewString("1", "2", "4", "5")
+	c := a.SymmetricDifference(b)
+	d := b.SymmetricDifference(a)
+	if !c.Equal(NewString("3", "4", "5")) {
+		t.Errorf("Unexpected contents: %#v", c.List())
+	}
+	if !d.Equal(NewString("3", "4", "5")) {
+		t.Errorf("Unexpected contents: %#v", d.List())
+	}
+}
+
+func TestStringSetHasAny(t *testing.T) {
+	a := NewString("1", "2", "3")
+
+	if !a.HasAny("1", "4") {
+		t.Errorf("expected true, got false")
+	}
+
+	if a.HasAny("0", "4") {
+		t.Errorf("expected false, got true")
+	}
+}
+
+func TestStringSetEquals(t *testing.T) {
+	// Simple case (order doesn't matter)
+	a := NewString("1", "2")
+	b := NewString("2", "1")
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	// It is a set; duplicates are ignored
+	b = NewString("2", "2", "1")
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	// Edge cases around empty sets / empty strings
+	a = NewString()
+	b = NewString()
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	b = NewString("1", "2", "3")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	b = NewString("1", "2", "")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	// Check for equality after mutation
+	a = NewString()
+	a.Insert("1")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	a.Insert("2")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+
+	a.Insert("")
+	if !a.Equal(b) {
+		t.Errorf("Expected to be equal: %v vs %v", a, b)
+	}
+
+	a.Delete("")
+	if a.Equal(b) {
+		t.Errorf("Expected to be not-equal: %v vs %v", a, b)
+	}
+}
+
+func TestStringUnion(t *testing.T) {
+	tests := []struct {
+		s1       String
+		s2       String
+		expected String
+	}{
+		{
+			NewString("1", "2", "3", "4"),
+			NewString("3", "4", "5", "6"),
+			NewString("1", "2", "3", "4", "5", "6"),
+		},
+		{
+			NewString("1", "2", "3", "4"),
+			NewString(),
+			NewString("1", "2", "3", "4"),
+		},
+		{
+			NewString(),
+			NewString("1", "2", "3", "4"),
+			NewString("1", "2", "3", "4"),
+		},
+		{
+			NewString(),
+			NewString(),
+			NewString(),
+		},
+	}
+
+	for _, test := range tests {
+		union := test.s1.Union(test.s2)
+		if union.Len() != test.expected.Len() {
+			t.Errorf("Expected union.Len()=%d but got %d", test.expected.Len(), union.Len())
+		}
+
+		if !union.Equal(test.expected) {
+			t.Errorf("Expected union.Equal(expected) but not true.  union:%v expected:%v", union.List(), test.expected.List())
+		}
+	}
+}
+
+func TestStringIntersection(t *testing.T) {
+	tests := []struct {
+		s1       String
+		s2       String
+		expected String
+	}{
+		{
+			NewString("1", "2", "3", "4"),
+			NewString("3", "4", "5", "6"),
+			NewString("3", "4"),
+		},
+		{
+			NewString("1", "2", "3", "4"),
+			NewString("1", "2", "3", "4"),
+			NewString("1", "2", "3", "4"),
+		},
+		{
+			NewString("1", "2", "3", "4"),
+			NewString(),
+			NewString(),
+		},
+		{
+			NewString(),
+			NewString("1", "2", "3", "4"),
+			NewString(),
+		},
+		{
+			NewString(),
+			NewString(),
+			NewString(),
+		},
+	}
+
+	for _, test := range tests {
+		intersection := test.s1.Intersection(test.s2)
+		if intersection.Len() != test.expected.Len() {
+			t.Errorf("Expected intersection.Len()=%d but got %d", test.expected.Len(), intersection.Len())
+		}
+
+		if !intersection.Equal(test.expected) {
+			t.Errorf("Expected intersection.Equal(expected) but not true.  intersection:%v expected:%v", intersection.List(), test.expected.List())
+		}
+	}
+}
+
+type randomStringAlphabet string
+
+func (a randomStringAlphabet) makeString(minLen, maxLen int) string {
+	n := minLen
+	if minLen < maxLen {
+		n += rand.Intn(maxLen - minLen)
+	}
+	var s string
+	for i := 0; i < n; i++ {
+		s += string(a[rand.Intn(len(a))])
+	}
+	return s
+}
+
+var randomStringMaker = randomStringAlphabet("abcdefghijklmnopqrstuvwxyz0123456789")
+
+func BenchmarkStringSet(b *testing.B) {
+	cases := []struct {
+		size         int
+		minStringLen int
+		maxStringLen int
+	}{
+		{20, 10, 20},
+		{50, 10, 30},
+		{100, 20, 40},
+		{500, 20, 50},
+		{1000, 20, 60},
+	}
+
+	for i := range cases {
+		here := cases[i]
+		makeSet := func() String {
+			s := NewString()
+			for j := 0; j < here.size; j++ {
+				s.Insert(randomStringMaker.makeString(here.minStringLen, here.maxStringLen))
+			}
+			return s
+		}
+		operands := make([]String, 500)
+		for i := range operands {
+			operands[i] = makeSet()
+		}
+		randOperand := func() String { return operands[rand.Intn(len(operands))] }
+
+		b.Run(fmt.Sprintf("insert-%v", here.size), func(b *testing.B) {
+			b.ReportAllocs()
+			for i := 0; i < b.N; i++ {
+				makeSet()
+			}
+		})
+
+		b.Run(fmt.Sprintf("key-set-%v", here.size), func(b *testing.B) {
+			b.ReportAllocs()
+			for i := 0; i < b.N; i++ {
+				StringKeySet(randOperand())
+			}
+		})
+
+		b.Run(fmt.Sprintf("has-%v", here.size), func(b *testing.B) {
+			b.ReportAllocs()
+			for i := 0; i < b.N; i++ {
+				randOperand().Has(randomStringMaker.makeString(here.minStringLen, here.maxStringLen))
+			}
+		})
+
+		b.Run(fmt.Sprintf("intersection-%v", here.size), func(b *testing.B) {
+			b.ReportAllocs()
+			for i := 0; i < b.N; i++ {
+				randOperand().Intersection(randOperand())
+			}
+		})
+
+		b.Run(fmt.Sprintf("symmetric-difference-%v", here.size), func(b *testing.B) {
+			b.ReportAllocs()
+			for i := 0; i < b.N; i++ {
+				randOperand().SymmetricDifference(randOperand())
+			}
+		})
+
+		b.Run(fmt.Sprintf("list-%v", here.size), func(b *testing.B) {
+			b.ReportAllocs()
+			for i := 0; i < b.N; i++ {
+				randOperand().List()
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/sets/string.go b/third_party/k8s.io/apimachinery/pkg/util/sets/string.go
new file mode 100644
index 0000000000..1dab6d13cc
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/sets/string.go
@@ -0,0 +1,137 @@
+/*
+Copyright 2022 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sets
+
+// String is a set of strings, implemented via map[string]struct{} for minimal memory consumption.
+//
+// Deprecated: use generic Set instead.
+// new ways:
+// s1 := Set[string]{}
+// s2 := New[string]()
+type String map[string]Empty
+
+// NewString creates a String from a list of values.
+func NewString(items ...string) String {
+	return String(New[string](items...))
+}
+
+// StringKeySet creates a String from a keys of a map[string](? extends interface{}).
+// If the value passed in is not actually a map, this will panic.
+func StringKeySet[T any](theMap map[string]T) String {
+	return String(KeySet(theMap))
+}
+
+// Insert adds items to the set.
+func (s String) Insert(items ...string) String {
+	return String(cast(s).Insert(items...))
+}
+
+// Delete removes all items from the set.
+func (s String) Delete(items ...string) String {
+	return String(cast(s).Delete(items...))
+}
+
+// Has returns true if and only if item is contained in the set.
+func (s String) Has(item string) bool {
+	return cast(s).Has(item)
+}
+
+// HasAll returns true if and only if all items are contained in the set.
+func (s String) HasAll(items ...string) bool {
+	return cast(s).HasAll(items...)
+}
+
+// HasAny returns true if any items are contained in the set.
+func (s String) HasAny(items ...string) bool {
+	return cast(s).HasAny(items...)
+}
+
+// Clone returns a new set which is a copy of the current set.
+func (s String) Clone() String {
+	return String(cast(s).Clone())
+}
+
+// Difference returns a set of objects that are not in s2.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.Difference(s2) = {a3}
+// s2.Difference(s1) = {a4, a5}
+func (s1 String) Difference(s2 String) String {
+	return String(cast(s1).Difference(cast(s2)))
+}
+
+// SymmetricDifference returns a set of elements which are in either of the sets, but not in their intersection.
+// For example:
+// s1 = {a1, a2, a3}
+// s2 = {a1, a2, a4, a5}
+// s1.SymmetricDifference(s2) = {a3, a4, a5}
+// s2.SymmetricDifference(s1) = {a3, a4, a5}
+func (s1 String) SymmetricDifference(s2 String) String {
+	return String(cast(s1).SymmetricDifference(cast(s2)))
+}
+
+// Union returns a new set which includes items in either s1 or s2.
+// For example:
+// s1 = {a1, a2}
+// s2 = {a3, a4}
+// s1.Union(s2) = {a1, a2, a3, a4}
+// s2.Union(s1) = {a1, a2, a3, a4}
+func (s1 String) Union(s2 String) String {
+	return String(cast(s1).Union(cast(s2)))
+}
+
+// Intersection returns a new set which includes the item in BOTH s1 and s2
+// For example:
+// s1 = {a1, a2}
+// s2 = {a2, a3}
+// s1.Intersection(s2) = {a2}
+func (s1 String) Intersection(s2 String) String {
+	return String(cast(s1).Intersection(cast(s2)))
+}
+
+// IsSuperset returns true if and only if s1 is a superset of s2.
+func (s1 String) IsSuperset(s2 String) bool {
+	return cast(s1).IsSuperset(cast(s2))
+}
+
+// Equal returns true if and only if s1 is equal (as a set) to s2.
+// Two sets are equal if their membership is identical.
+// (In practice, this means same elements, order doesn't matter)
+func (s1 String) Equal(s2 String) bool {
+	return cast(s1).Equal(cast(s2))
+}
+
+// List returns the contents as a sorted string slice.
+func (s String) List() []string {
+	return List(cast(s))
+}
+
+// UnsortedList returns the slice with contents in random order.
+func (s String) UnsortedList() []string {
+	return cast(s).UnsortedList()
+}
+
+// PopAny returns a single element from the set.
+func (s String) PopAny() (string, bool) {
+	return cast(s).PopAny()
+}
+
+// Len returns the size of the set.
+func (s String) Len() int {
+	return len(s)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/sort/sort.go b/third_party/k8s.io/apimachinery/pkg/util/sort/sort.go
new file mode 100644
index 0000000000..6c2e0eb7a5
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/sort/sort.go
@@ -0,0 +1,191 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sort
+
+import (
+	"container/heap"
+	"fmt"
+	"sort"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// MergePreservingRelativeOrder performs a topological consensus sort of items from multiple sources.
+// It merges multiple lists of strings into a single list, preserving the relative order of
+// elements within each source list.
+//
+// For any two items, if one appears before the other in any of the input lists,
+// that relative order will be preserved in the output. If no relative ordering is
+// defined between two items, they are sorted lexicographically.
+//
+// The function uses Kahn's algorithm for topological sorting with a min-heap to ensure
+// deterministic output. Items with no dependencies are processed in lexicographic order,
+// guaranteeing consistent results across multiple invocations with the same input.
+//
+// This function contains a shortcut optimization that returns an input list directly
+// if it already contains all unique items. This provides O(n) performance in the best case.
+//
+// Example:
+//   - Input: {{"a", "b", "c"}, {"b", "c"}} returns {"a", "b", "c"}
+//   - Input: {{"a", "c"}, {"b", "c"}} returns {"a", "b", "c"} (lexicographic tie-breaking)
+//   - Input: {{"a", "b"}, {"b", "a"}} returns error (cycle detected)
+//
+// Complexity: O(L*n + V*log(V) + E) where L is the number of lists, n is the average
+// list size, V is the number of unique items, and E is the number of precedence edges.
+//
+// This is useful for creating a stable, consistent ordering when merging data from
+// multiple sources that may have partial but not conflicting orderings.
+func MergePreservingRelativeOrder(inputLists [][]string) []string {
+	if len(inputLists) == 0 {
+		return nil
+	}
+
+	// Build a directed graph of precedence relationships
+	graph := make(map[string]*graphNode)
+	for _, list := range inputLists {
+		for i, item := range list {
+			node := getOrCreateNode(graph, item)
+
+			// Add edge from current item to next item in list
+			if i < len(list)-1 {
+				nextItem := list[i+1]
+				nextNode := getOrCreateNode(graph, nextItem)
+
+				// Only add edge if not already present (avoid incrementing in-degree multiple times)
+				if !node.outEdges.Has(nextItem) {
+					node.outEdges.Insert(nextItem)
+					nextNode.inDegree++
+				}
+			}
+		}
+	}
+
+	// Shortcut: if any input list contains all items (no duplicates), use it
+	allItems := sets.New[string]()
+	for name := range graph {
+		allItems.Insert(name)
+	}
+	for _, list := range inputLists {
+		if len(list) == allItems.Len() && isUnique(list) {
+			return list
+		}
+	}
+
+	// Perform topological sort using Kahn's algorithm with min-heap for determinism
+	result, err := topologicalSort(graph)
+	if err != nil {
+		// This should not happen with valid input, but if it does,
+		// fall back to lexicographic sort to provide some result
+		items := make([]string, 0, len(graph))
+		for name := range graph {
+			items = append(items, name)
+		}
+		sort.Strings(items)
+		return items
+	}
+
+	return result
+}
+
+// getOrCreateNode retrieves or creates a graph node for the given name
+func getOrCreateNode(graph map[string]*graphNode, name string) *graphNode {
+	if graph[name] == nil {
+		graph[name] = &graphNode{
+			outEdges: sets.New[string](),
+			inDegree: 0,
+		}
+	}
+	return graph[name]
+}
+
+// isUnique checks if a list contains no duplicate items
+func isUnique(list []string) bool {
+	seen := make(map[string]bool, len(list))
+	for _, item := range list {
+		if seen[item] {
+			return false
+		}
+		seen[item] = true
+	}
+	return true
+}
+
+// topologicalSort performs Kahn's algorithm with a min-heap for deterministic ordering
+func topologicalSort(graph map[string]*graphNode) ([]string, error) {
+	// Initialize min-heap with all nodes that have no incoming edges
+	pq := &stringMinHeap{}
+	heap.Init(pq)
+
+	for name, node := range graph {
+		if node.inDegree == 0 {
+			heap.Push(pq, name)
+		}
+	}
+
+	result := make([]string, 0, len(graph))
+
+	for pq.Len() > 0 {
+		// Pop item with lowest lexicographic value
+		current := heap.Pop(pq).(string)
+		result = append(result, current)
+
+		currentNode := graph[current]
+
+		// Reduce in-degree for all neighbors
+		for neighbor := range currentNode.outEdges {
+			neighborNode := graph[neighbor]
+			neighborNode.inDegree--
+
+			// If in-degree becomes 0, add to heap
+			if neighborNode.inDegree == 0 {
+				heap.Push(pq, neighbor)
+			}
+		}
+	}
+
+	// Check for cycles
+	if len(result) != len(graph) {
+		return nil, fmt.Errorf("cycle detected in precedence graph: sorted %d items but graph has %d items", len(result), len(graph))
+	}
+
+	return result, nil
+}
+
+// graphNode represents a node in the precedence graph
+type graphNode struct {
+	// Items that should come after this item
+	outEdges sets.Set[string]
+	// Number of items that should come before this item
+	inDegree int
+}
+
+// stringMinHeap implements heap.Interface for strings (min-heap with lexicographic ordering)
+type stringMinHeap []string
+
+func (h stringMinHeap) Len() int           { return len(h) }
+func (h stringMinHeap) Less(i, j int) bool { return h[i] < h[j] }
+func (h stringMinHeap) Swap(i, j int)      { h[i], h[j] = h[j], h[i] }
+func (h *stringMinHeap) Push(x interface{}) {
+	*h = append(*h, x.(string))
+}
+func (h *stringMinHeap) Pop() interface{} {
+	old := *h
+	n := len(old)
+	x := old[n-1]
+	*h = old[0 : n-1]
+	return x
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/sort/sort_test.go b/third_party/k8s.io/apimachinery/pkg/util/sort/sort_test.go
new file mode 100644
index 0000000000..a21b97b5ab
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/sort/sort_test.go
@@ -0,0 +1,148 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sort
+
+import (
+	"testing"
+)
+
+func TestSortDiscoveryGroupsTopo(t *testing.T) {
+	cases := []struct {
+		name  string
+		input [][]string
+		want  []string
+	}{
+		{
+			name: "consensus ordering",
+			input: [][]string{
+				{"A", "B", "C", "D"},
+				{"A", "B", "C", "D"},
+				{"A", "X", "Z", "D"},
+				{"Z", "Y"},
+				{"Q"},
+			},
+			want: []string{"A", "B", "C", "Q", "X", "Z", "D", "Y"},
+		},
+		{
+			name:  "empty input",
+			input: [][]string{},
+			want:  []string{},
+		},
+		{
+			name:  "single peer",
+			input: [][]string{{"foo", "bar", "baz"}},
+			want:  []string{"foo", "bar", "baz"},
+		},
+		{
+			name:  "conflicting orderings",
+			input: [][]string{{"A", "B"}, {"B", "A"}},
+			want:  []string{"A", "B"},
+		},
+		{
+			name:  "empty list merged with non-empty list",
+			input: [][]string{{}, {"A", "B", "C"}},
+			want:  []string{"A", "B", "C"},
+		},
+		{
+			name:  "multiple empty lists merged",
+			input: [][]string{{}, {}, {}},
+			want:  []string{},
+		},
+		{
+			name: "lexical tiebreak at beginning",
+			input: [][]string{
+				{"C", "D", "E"},
+				{"B", "D", "E"},
+				{"A", "D", "E"},
+			},
+			// A, B, C have no precedence constraints, so lexical order
+			want: []string{"A", "B", "C", "D", "E"},
+		},
+		{
+			name: "lexical tiebreak in middle",
+			input: [][]string{
+				{"A", "D", "E"},
+				{"A", "C", "E"},
+				{"A", "B", "E"},
+			},
+			// A comes first (consensus), then B, C, D (lexical), then E (consensus)
+			want: []string{"A", "B", "C", "D", "E"},
+		},
+		{
+			name: "conflicting orderings of 3 lists",
+			input: [][]string{
+				{"A", "B", "C"},
+				{"B", "C", "A"},
+				{"C", "A", "B"},
+			},
+			// Creates cycle: A->B, B->C, C->A
+			// Fallback to lexicographic sort
+			want: []string{"A", "B", "C"},
+		},
+		{
+			name: "conflicting ordering with different list lengths",
+			input: [][]string{
+				{"A", "B", "C", "D"},
+				{"B", "A"},
+				{"C", "D"},
+			},
+			// A->B->C->D from first list, but B->A from second
+			// Creates cycle between A and B
+			// Fallback to lexicographic sort
+			want: []string{"A", "B", "C", "D"},
+		},
+		{
+			name: "conflicting partial lists",
+			input: [][]string{
+				{"A", "B"},
+				{"C", "D"},
+				{"B", "A"},
+			},
+			// A->B from first, B->A from third (cycle)
+			// C->D is independent
+			// Fallback to lexicographic sort
+			want: []string{"A", "B", "C", "D"},
+		},
+		{
+			name: "cycle",
+			input: [][]string{
+				{"A", "B"},
+				{"B", "C"},
+				{"C", "A"},
+			},
+			// Creates cycle: A->B->C->A
+			// Fallback to lexicographic sort
+			want: []string{"A", "B", "C"},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := MergePreservingRelativeOrder(tc.input)
+			if len(got) != len(tc.want) {
+				t.Errorf("length mismatch:\n  got: %d\n  want: %d", len(got), len(tc.want))
+				return
+			}
+			for i := range got {
+				if got[i] != tc.want[i] {
+					t.Errorf("mismatch got: %v\n  want: %v", got, tc.want)
+					return
+				}
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/OWNERS b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/OWNERS
new file mode 100644
index 0000000000..73244449f2
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/OWNERS
@@ -0,0 +1,9 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+  - apelisse
+  - pwittrock
+reviewers:
+  - apelisse
+emeritus_approvers:
+  - mengqiy
diff --git a/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/errors.go b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/errors.go
new file mode 100644
index 0000000000..ab66d04523
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/errors.go
@@ -0,0 +1,49 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package strategicpatch
+
+import (
+	"fmt"
+)
+
+type LookupPatchMetaError struct {
+	Path string
+	Err  error
+}
+
+func (e LookupPatchMetaError) Error() string {
+	return fmt.Sprintf("LookupPatchMetaError(%s): %v", e.Path, e.Err)
+}
+
+type FieldNotFoundError struct {
+	Path  string
+	Field string
+}
+
+func (e FieldNotFoundError) Error() string {
+	return fmt.Sprintf("unable to find api field %q in %s", e.Field, e.Path)
+}
+
+type InvalidTypeError struct {
+	Path     string
+	Expected string
+	Actual   string
+}
+
+func (e InvalidTypeError) Error() string {
+	return fmt.Sprintf("invalid type for %s: got %q, expected %q", e.Path, e.Actual, e.Expected)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/meta.go b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/meta.go
new file mode 100644
index 0000000000..1bfed1c2ec
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/meta.go
@@ -0,0 +1,283 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package strategicpatch
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/mergepatch"
+	forkedjson "k8s.io/apimachinery/third_party/forked/golang/json"
+	openapi "k8s.io/kube-openapi/pkg/util/proto"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+)
+
+const patchMergeKey = "x-kubernetes-patch-merge-key"
+const patchStrategy = "x-kubernetes-patch-strategy"
+
+type PatchMeta struct {
+	patchStrategies []string
+	patchMergeKey   string
+}
+
+func (pm *PatchMeta) GetPatchStrategies() []string {
+	if pm.patchStrategies == nil {
+		return []string{}
+	}
+	return pm.patchStrategies
+}
+
+func (pm *PatchMeta) SetPatchStrategies(ps []string) {
+	pm.patchStrategies = ps
+}
+
+func (pm *PatchMeta) GetPatchMergeKey() string {
+	return pm.patchMergeKey
+}
+
+func (pm *PatchMeta) SetPatchMergeKey(pmk string) {
+	pm.patchMergeKey = pmk
+}
+
+type LookupPatchMeta interface {
+	// LookupPatchMetadataForStruct gets subschema and the patch metadata (e.g. patch strategy and merge key) for map.
+	LookupPatchMetadataForStruct(key string) (LookupPatchMeta, PatchMeta, error)
+	// LookupPatchMetadataForSlice get subschema and the patch metadata for slice.
+	LookupPatchMetadataForSlice(key string) (LookupPatchMeta, PatchMeta, error)
+	// Get the type name of the field
+	Name() string
+}
+
+type PatchMetaFromStruct struct {
+	T reflect.Type
+}
+
+func NewPatchMetaFromStruct(dataStruct interface{}) (PatchMetaFromStruct, error) {
+	t, err := getTagStructType(dataStruct)
+	return PatchMetaFromStruct{T: t}, err
+}
+
+var _ LookupPatchMeta = PatchMetaFromStruct{}
+
+func (s PatchMetaFromStruct) LookupPatchMetadataForStruct(key string) (LookupPatchMeta, PatchMeta, error) {
+	fieldType, fieldPatchStrategies, fieldPatchMergeKey, err := forkedjson.LookupPatchMetadataForStruct(s.T, key)
+	if err != nil {
+		return nil, PatchMeta{}, err
+	}
+
+	return PatchMetaFromStruct{T: fieldType},
+		PatchMeta{
+			patchStrategies: fieldPatchStrategies,
+			patchMergeKey:   fieldPatchMergeKey,
+		}, nil
+}
+
+func (s PatchMetaFromStruct) LookupPatchMetadataForSlice(key string) (LookupPatchMeta, PatchMeta, error) {
+	subschema, patchMeta, err := s.LookupPatchMetadataForStruct(key)
+	if err != nil {
+		return nil, PatchMeta{}, err
+	}
+	elemPatchMetaFromStruct := subschema.(PatchMetaFromStruct)
+	t := elemPatchMetaFromStruct.T
+
+	var elemType reflect.Type
+	switch t.Kind() {
+	// If t is an array or a slice, get the element type.
+	// If element is still an array or a slice, return an error.
+	// Otherwise, return element type.
+	case reflect.Array, reflect.Slice:
+		elemType = t.Elem()
+		if elemType.Kind() == reflect.Array || elemType.Kind() == reflect.Slice {
+			return nil, PatchMeta{}, errors.New("unexpected slice of slice")
+		}
+	// If t is an pointer, get the underlying element.
+	// If the underlying element is neither an array nor a slice, the pointer is pointing to a slice,
+	// e.g. https://github.com/kubernetes/kubernetes/blob/bc22e206c79282487ea0bf5696d5ccec7e839a76/staging/src/k8s.io/apimachinery/pkg/util/strategicpatch/patch_test.go#L2782-L2822
+	// If the underlying element is either an array or a slice, return its element type.
+	case reflect.Pointer:
+		t = t.Elem()
+		if t.Kind() == reflect.Array || t.Kind() == reflect.Slice {
+			t = t.Elem()
+		}
+		elemType = t
+	default:
+		return nil, PatchMeta{}, fmt.Errorf("expected slice or array type, but got: %s", s.T.Kind().String())
+	}
+
+	return PatchMetaFromStruct{T: elemType}, patchMeta, nil
+}
+
+func (s PatchMetaFromStruct) Name() string {
+	return s.T.Kind().String()
+}
+
+func getTagStructType(dataStruct interface{}) (reflect.Type, error) {
+	if dataStruct == nil {
+		return nil, mergepatch.ErrBadArgKind(struct{}{}, nil)
+	}
+
+	t := reflect.TypeOf(dataStruct)
+	// Get the underlying type for pointers
+	if t.Kind() == reflect.Pointer {
+		t = t.Elem()
+	}
+
+	if t.Kind() != reflect.Struct {
+		return nil, mergepatch.ErrBadArgKind(struct{}{}, dataStruct)
+	}
+
+	return t, nil
+}
+
+func GetTagStructTypeOrDie(dataStruct interface{}) reflect.Type {
+	t, err := getTagStructType(dataStruct)
+	if err != nil {
+		panic(err)
+	}
+	return t
+}
+
+type PatchMetaFromOpenAPIV3 struct {
+	// SchemaList is required to resolve OpenAPI V3 references
+	SchemaList map[string]*spec.Schema
+	Schema     *spec.Schema
+}
+
+func (s PatchMetaFromOpenAPIV3) traverse(key string) (PatchMetaFromOpenAPIV3, error) {
+	if s.Schema == nil {
+		return PatchMetaFromOpenAPIV3{}, nil
+	}
+	if len(s.Schema.Properties) == 0 {
+		return PatchMetaFromOpenAPIV3{}, fmt.Errorf("unable to find api field \"%s\"", key)
+	}
+	subschema, ok := s.Schema.Properties[key]
+	if !ok {
+		return PatchMetaFromOpenAPIV3{}, fmt.Errorf("unable to find api field \"%s\"", key)
+	}
+	return PatchMetaFromOpenAPIV3{SchemaList: s.SchemaList, Schema: &subschema}, nil
+}
+
+func resolve(l *PatchMetaFromOpenAPIV3) error {
+	if len(l.Schema.AllOf) > 0 {
+		l.Schema = &l.Schema.AllOf[0]
+	}
+	if refString := l.Schema.Ref.String(); refString != "" {
+		str := strings.TrimPrefix(refString, "#/components/schemas/")
+		sch, ok := l.SchemaList[str]
+		if ok {
+			l.Schema = sch
+		} else {
+			return fmt.Errorf("unable to resolve %s in OpenAPI V3", refString)
+		}
+	}
+	return nil
+}
+
+func (s PatchMetaFromOpenAPIV3) LookupPatchMetadataForStruct(key string) (LookupPatchMeta, PatchMeta, error) {
+	l, err := s.traverse(key)
+	if err != nil {
+		return l, PatchMeta{}, err
+	}
+	p := PatchMeta{}
+	f, ok := l.Schema.Extensions[patchMergeKey]
+	if ok {
+		p.SetPatchMergeKey(f.(string))
+	}
+	g, ok := l.Schema.Extensions[patchStrategy]
+	if ok {
+		p.SetPatchStrategies(strings.Split(g.(string), ","))
+	}
+
+	err = resolve(&l)
+	return l, p, err
+}
+
+func (s PatchMetaFromOpenAPIV3) LookupPatchMetadataForSlice(key string) (LookupPatchMeta, PatchMeta, error) {
+	l, err := s.traverse(key)
+	if err != nil {
+		return l, PatchMeta{}, err
+	}
+	p := PatchMeta{}
+	f, ok := l.Schema.Extensions[patchMergeKey]
+	if ok {
+		p.SetPatchMergeKey(f.(string))
+	}
+	g, ok := l.Schema.Extensions[patchStrategy]
+	if ok {
+		p.SetPatchStrategies(strings.Split(g.(string), ","))
+	}
+	if l.Schema.Items != nil {
+		l.Schema = l.Schema.Items.Schema
+	}
+	err = resolve(&l)
+	return l, p, err
+}
+
+func (s PatchMetaFromOpenAPIV3) Name() string {
+	schema := s.Schema
+	if len(schema.Type) > 0 {
+		return strings.Join(schema.Type, "")
+	}
+	return "Struct"
+}
+
+type PatchMetaFromOpenAPI struct {
+	Schema openapi.Schema
+}
+
+func NewPatchMetaFromOpenAPI(s openapi.Schema) PatchMetaFromOpenAPI {
+	return PatchMetaFromOpenAPI{Schema: s}
+}
+
+var _ LookupPatchMeta = PatchMetaFromOpenAPI{}
+
+func (s PatchMetaFromOpenAPI) LookupPatchMetadataForStruct(key string) (LookupPatchMeta, PatchMeta, error) {
+	if s.Schema == nil {
+		return &PatchMetaFromOpenAPI{}, PatchMeta{}, nil
+	}
+	kindItem := NewKindItem(key, s.Schema.GetPath())
+	s.Schema.Accept(kindItem)
+
+	err := kindItem.Error()
+	if err != nil {
+		return nil, PatchMeta{}, err
+	}
+	return PatchMetaFromOpenAPI{Schema: kindItem.subschema},
+		kindItem.patchmeta, nil
+}
+
+func (s PatchMetaFromOpenAPI) LookupPatchMetadataForSlice(key string) (LookupPatchMeta, PatchMeta, error) {
+	if s.Schema == nil {
+		return nil, PatchMeta{}, nil
+	}
+	sliceItem := NewSliceItem(key, s.Schema.GetPath())
+	s.Schema.Accept(sliceItem)
+
+	err := sliceItem.Error()
+	if err != nil {
+		return nil, PatchMeta{}, err
+	}
+	return PatchMetaFromOpenAPI{Schema: sliceItem.subschema},
+		sliceItem.patchmeta, nil
+}
+
+func (s PatchMetaFromOpenAPI) Name() string {
+	schema := s.Schema
+	return schema.GetName()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/patch.go b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/patch.go
new file mode 100644
index 0000000000..71f6b5e875
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/patch.go
@@ -0,0 +1,2253 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package strategicpatch
+
+import (
+	"fmt"
+	"reflect"
+	"sort"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/util/json"
+	"k8s.io/apimachinery/pkg/util/mergepatch"
+)
+
+// An alternate implementation of JSON Merge Patch
+// (https://tools.ietf.org/html/rfc7386) which supports the ability to annotate
+// certain fields with metadata that indicates whether the elements of JSON
+// lists should be merged or replaced.
+//
+// For more information, see the PATCH section of docs/devel/api-conventions.md.
+//
+// Some of the content of this package was borrowed with minor adaptations from
+// evanphx/json-patch and openshift/origin.
+
+const (
+	directiveMarker  = "$patch"
+	deleteDirective  = "delete"
+	replaceDirective = "replace"
+	mergeDirective   = "merge"
+
+	retainKeysStrategy = "retainKeys"
+
+	deleteFromPrimitiveListDirectivePrefix = "$deleteFromPrimitiveList"
+	retainKeysDirective                    = "$" + retainKeysStrategy
+	setElementOrderDirectivePrefix         = "$setElementOrder"
+)
+
+// JSONMap is a representations of JSON object encoded as map[string]interface{}
+// where the children can be either map[string]interface{}, []interface{} or
+// primitive type).
+// Operating on JSONMap representation is much faster as it doesn't require any
+// json marshaling and/or unmarshaling operations.
+type JSONMap map[string]interface{}
+
+type DiffOptions struct {
+	// SetElementOrder determines whether we generate the $setElementOrder parallel list.
+	SetElementOrder bool
+	// IgnoreChangesAndAdditions indicates if we keep the changes and additions in the patch.
+	IgnoreChangesAndAdditions bool
+	// IgnoreDeletions indicates if we keep the deletions in the patch.
+	IgnoreDeletions bool
+	// We introduce a new value retainKeys for patchStrategy.
+	// It indicates that all fields needing to be preserved must be
+	// present in the `retainKeys` list.
+	// And the fields that are present will be merged with live object.
+	// All the missing fields will be cleared when patching.
+	BuildRetainKeysDirective bool
+}
+
+type MergeOptions struct {
+	// MergeParallelList indicates if we are merging the parallel list.
+	// We don't merge parallel list when calling mergeMap() in CreateThreeWayMergePatch()
+	// which is called client-side.
+	// We merge parallel list iff when calling mergeMap() in StrategicMergeMapPatch()
+	// which is called server-side
+	MergeParallelList bool
+	// IgnoreUnmatchedNulls indicates if we should process the unmatched nulls.
+	IgnoreUnmatchedNulls bool
+}
+
+// The following code is adapted from github.com/openshift/origin/pkg/util/jsonmerge.
+// Instead of defining a Delta that holds an original, a patch and a set of preconditions,
+// the reconcile method accepts a set of preconditions as an argument.
+
+// CreateTwoWayMergePatch creates a patch that can be passed to StrategicMergePatch from an original
+// document and a modified document, which are passed to the method as json encoded content. It will
+// return a patch that yields the modified document when applied to the original document, or an error
+// if either of the two documents is invalid.
+func CreateTwoWayMergePatch(original, modified []byte, dataStruct interface{}, fns ...mergepatch.PreconditionFunc) ([]byte, error) {
+	schema, err := NewPatchMetaFromStruct(dataStruct)
+	if err != nil {
+		return nil, err
+	}
+
+	return CreateTwoWayMergePatchUsingLookupPatchMeta(original, modified, schema, fns...)
+}
+
+func CreateTwoWayMergePatchUsingLookupPatchMeta(
+	original, modified []byte, schema LookupPatchMeta, fns ...mergepatch.PreconditionFunc) ([]byte, error) {
+	originalMap := map[string]interface{}{}
+	if len(original) > 0 {
+		if err := json.Unmarshal(original, &originalMap); err != nil {
+			return nil, mergepatch.ErrBadJSONDoc
+		}
+	}
+
+	modifiedMap := map[string]interface{}{}
+	if len(modified) > 0 {
+		if err := json.Unmarshal(modified, &modifiedMap); err != nil {
+			return nil, mergepatch.ErrBadJSONDoc
+		}
+	}
+
+	patchMap, err := CreateTwoWayMergeMapPatchUsingLookupPatchMeta(originalMap, modifiedMap, schema, fns...)
+	if err != nil {
+		return nil, err
+	}
+
+	return json.Marshal(patchMap)
+}
+
+// CreateTwoWayMergeMapPatch creates a patch from an original and modified JSON objects,
+// encoded JSONMap.
+// The serialized version of the map can then be passed to StrategicMergeMapPatch.
+func CreateTwoWayMergeMapPatch(original, modified JSONMap, dataStruct interface{}, fns ...mergepatch.PreconditionFunc) (JSONMap, error) {
+	schema, err := NewPatchMetaFromStruct(dataStruct)
+	if err != nil {
+		return nil, err
+	}
+
+	return CreateTwoWayMergeMapPatchUsingLookupPatchMeta(original, modified, schema, fns...)
+}
+
+func CreateTwoWayMergeMapPatchUsingLookupPatchMeta(original, modified JSONMap, schema LookupPatchMeta, fns ...mergepatch.PreconditionFunc) (JSONMap, error) {
+	diffOptions := DiffOptions{
+		SetElementOrder: true,
+	}
+	patchMap, err := diffMaps(original, modified, schema, diffOptions)
+	if err != nil {
+		return nil, err
+	}
+
+	// Apply the preconditions to the patch, and return an error if any of them fail.
+	for _, fn := range fns {
+		if !fn(patchMap) {
+			return nil, mergepatch.NewErrPreconditionFailed(patchMap)
+		}
+	}
+
+	return patchMap, nil
+}
+
+// Returns a (recursive) strategic merge patch that yields modified when applied to original.
+// Including:
+// - Adding fields to the patch present in modified, missing from original
+// - Setting fields to the patch present in modified and original with different values
+// - Delete fields present in original, missing from modified through
+// - IFF map field - set to nil in patch
+// - IFF list of maps && merge strategy - use deleteDirective for the elements
+// - IFF list of primitives && merge strategy - use parallel deletion list
+// - IFF list of maps or primitives with replace strategy (default) - set patch value to the value in modified
+// - Build $retainKeys directive for fields with retainKeys patch strategy
+func diffMaps(original, modified map[string]interface{}, schema LookupPatchMeta, diffOptions DiffOptions) (map[string]interface{}, error) {
+	patch := map[string]interface{}{}
+
+	// This will be used to build the $retainKeys directive sent in the patch
+	retainKeysList := make([]interface{}, 0, len(modified))
+
+	// Compare each value in the modified map against the value in the original map
+	for key, modifiedValue := range modified {
+		// Get the underlying type for pointers
+		if diffOptions.BuildRetainKeysDirective && modifiedValue != nil {
+			retainKeysList = append(retainKeysList, key)
+		}
+
+		originalValue, ok := original[key]
+		if !ok {
+			// Key was added, so add to patch
+			if !diffOptions.IgnoreChangesAndAdditions {
+				patch[key] = modifiedValue
+			}
+			continue
+		}
+
+		// The patch may have a patch directive
+		// TODO: figure out if we need this. This shouldn't be needed by apply. When would the original map have patch directives in it?
+		foundDirectiveMarker, err := handleDirectiveMarker(key, originalValue, modifiedValue, patch)
+		if err != nil {
+			return nil, err
+		}
+		if foundDirectiveMarker {
+			continue
+		}
+
+		if reflect.TypeOf(originalValue) != reflect.TypeOf(modifiedValue) {
+			// Types have changed, so add to patch
+			if !diffOptions.IgnoreChangesAndAdditions {
+				patch[key] = modifiedValue
+			}
+			continue
+		}
+
+		// Types are the same, so compare values
+		switch originalValueTyped := originalValue.(type) {
+		case map[string]interface{}:
+			modifiedValueTyped := modifiedValue.(map[string]interface{})
+			err = handleMapDiff(key, originalValueTyped, modifiedValueTyped, patch, schema, diffOptions)
+		case []interface{}:
+			modifiedValueTyped := modifiedValue.([]interface{})
+			err = handleSliceDiff(key, originalValueTyped, modifiedValueTyped, patch, schema, diffOptions)
+		default:
+			replacePatchFieldIfNotEqual(key, originalValue, modifiedValue, patch, diffOptions)
+		}
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	updatePatchIfMissing(original, modified, patch, diffOptions)
+	// Insert the retainKeysList iff there are values present in the retainKeysList and
+	// either of the following is true:
+	// - the patch is not empty
+	// - there are additional field in original that need to be cleared
+	if len(retainKeysList) > 0 &&
+		(len(patch) > 0 || hasAdditionalNewField(original, modified)) {
+		patch[retainKeysDirective] = sortScalars(retainKeysList)
+	}
+	return patch, nil
+}
+
+// handleDirectiveMarker handles how to diff directive marker between 2 objects
+func handleDirectiveMarker(key string, originalValue, modifiedValue interface{}, patch map[string]interface{}) (bool, error) {
+	if key == directiveMarker {
+		originalString, ok := originalValue.(string)
+		if !ok {
+			return false, fmt.Errorf("invalid value for special key: %s", directiveMarker)
+		}
+		modifiedString, ok := modifiedValue.(string)
+		if !ok {
+			return false, fmt.Errorf("invalid value for special key: %s", directiveMarker)
+		}
+		if modifiedString != originalString {
+			patch[directiveMarker] = modifiedValue
+		}
+		return true, nil
+	}
+	return false, nil
+}
+
+// handleMapDiff diff between 2 maps `originalValueTyped` and `modifiedValue`,
+// puts the diff in the `patch` associated with `key`
+// key is the key associated with originalValue and modifiedValue.
+// originalValue, modifiedValue are the old and new value respectively.They are both maps
+// patch is the patch map that contains key and the updated value, and it is the parent of originalValue, modifiedValue
+// diffOptions contains multiple options to control how we do the diff.
+func handleMapDiff(key string, originalValue, modifiedValue, patch map[string]interface{},
+	schema LookupPatchMeta, diffOptions DiffOptions) error {
+	subschema, patchMeta, err := schema.LookupPatchMetadataForStruct(key)
+
+	if err != nil {
+		// We couldn't look up metadata for the field
+		// If the values are identical, this doesn't matter, no patch is needed
+		if reflect.DeepEqual(originalValue, modifiedValue) {
+			return nil
+		}
+		// Otherwise, return the error
+		return err
+	}
+	retainKeys, patchStrategy, err := extractRetainKeysPatchStrategy(patchMeta.GetPatchStrategies())
+	if err != nil {
+		return err
+	}
+	diffOptions.BuildRetainKeysDirective = retainKeys
+	switch patchStrategy {
+	// The patch strategic from metadata tells us to replace the entire object instead of diffing it
+	case replaceDirective:
+		if !diffOptions.IgnoreChangesAndAdditions {
+			patch[key] = modifiedValue
+		}
+	default:
+		patchValue, err := diffMaps(originalValue, modifiedValue, subschema, diffOptions)
+		if err != nil {
+			return err
+		}
+		// Maps were not identical, use provided patch value
+		if len(patchValue) > 0 {
+			patch[key] = patchValue
+		}
+	}
+	return nil
+}
+
+// handleSliceDiff diff between 2 slices `originalValueTyped` and `modifiedValue`,
+// puts the diff in the `patch` associated with `key`
+// key is the key associated with originalValue and modifiedValue.
+// originalValue, modifiedValue are the old and new value respectively.They are both slices
+// patch is the patch map that contains key and the updated value, and it is the parent of originalValue, modifiedValue
+// diffOptions contains multiple options to control how we do the diff.
+func handleSliceDiff(key string, originalValue, modifiedValue []interface{}, patch map[string]interface{},
+	schema LookupPatchMeta, diffOptions DiffOptions) error {
+	subschema, patchMeta, err := schema.LookupPatchMetadataForSlice(key)
+	if err != nil {
+		// We couldn't look up metadata for the field
+		// If the values are identical, this doesn't matter, no patch is needed
+		if reflect.DeepEqual(originalValue, modifiedValue) {
+			return nil
+		}
+		// Otherwise, return the error
+		return err
+	}
+	retainKeys, patchStrategy, err := extractRetainKeysPatchStrategy(patchMeta.GetPatchStrategies())
+	if err != nil {
+		return err
+	}
+	switch patchStrategy {
+	// Merge the 2 slices using mergePatchKey
+	case mergeDirective:
+		diffOptions.BuildRetainKeysDirective = retainKeys
+		addList, deletionList, setOrderList, err := diffLists(originalValue, modifiedValue, subschema, patchMeta.GetPatchMergeKey(), diffOptions)
+		if err != nil {
+			return err
+		}
+		if len(addList) > 0 {
+			patch[key] = addList
+		}
+		// generate a parallel list for deletion
+		if len(deletionList) > 0 {
+			parallelDeletionListKey := fmt.Sprintf("%s/%s", deleteFromPrimitiveListDirectivePrefix, key)
+			patch[parallelDeletionListKey] = deletionList
+		}
+		if len(setOrderList) > 0 {
+			parallelSetOrderListKey := fmt.Sprintf("%s/%s", setElementOrderDirectivePrefix, key)
+			patch[parallelSetOrderListKey] = setOrderList
+		}
+	default:
+		replacePatchFieldIfNotEqual(key, originalValue, modifiedValue, patch, diffOptions)
+	}
+	return nil
+}
+
+// replacePatchFieldIfNotEqual updates the patch if original and modified are not deep equal
+// if diffOptions.IgnoreChangesAndAdditions is false.
+// original is the old value, maybe either the live cluster object or the last applied configuration
+// modified is the new value, is always the users new config
+func replacePatchFieldIfNotEqual(key string, original, modified interface{},
+	patch map[string]interface{}, diffOptions DiffOptions) {
+	if diffOptions.IgnoreChangesAndAdditions {
+		// Ignoring changes - do nothing
+		return
+	}
+	if reflect.DeepEqual(original, modified) {
+		// Contents are identical - do nothing
+		return
+	}
+	// Create a patch to replace the old value with the new one
+	patch[key] = modified
+}
+
+// updatePatchIfMissing iterates over `original` when ignoreDeletions is false.
+// Clear the field whose key is not present in `modified`.
+// original is the old value, maybe either the live cluster object or the last applied configuration
+// modified is the new value, is always the users new config
+func updatePatchIfMissing(original, modified, patch map[string]interface{}, diffOptions DiffOptions) {
+	if diffOptions.IgnoreDeletions {
+		// Ignoring deletion - do nothing
+		return
+	}
+	// Add nils for deleted values
+	for key := range original {
+		if _, found := modified[key]; !found {
+			patch[key] = nil
+		}
+	}
+}
+
+// validateMergeKeyInLists checks if each map in the list has the mentryerge key.
+func validateMergeKeyInLists(mergeKey string, lists ...[]interface{}) error {
+	for _, list := range lists {
+		for _, item := range list {
+			m, ok := item.(map[string]interface{})
+			if !ok {
+				return mergepatch.ErrBadArgType(m, item)
+			}
+			if _, ok = m[mergeKey]; !ok {
+				return mergepatch.ErrNoMergeKey(m, mergeKey)
+			}
+		}
+	}
+	return nil
+}
+
+// normalizeElementOrder sort `patch` list by `patchOrder` and sort `serverOnly` list by `serverOrder`.
+// Then it merges the 2 sorted lists.
+// It guarantee the relative order in the patch list and in the serverOnly list is kept.
+// `patch` is a list of items in the patch, and `serverOnly` is a list of items in the live object.
+// `patchOrder` is the order we want `patch` list to have and
+// `serverOrder` is the order we want `serverOnly` list to have.
+// kind is the kind of each item in the lists `patch` and `serverOnly`.
+func normalizeElementOrder(patch, serverOnly, patchOrder, serverOrder []interface{}, mergeKey string, kind reflect.Kind) ([]interface{}, error) {
+	patch, err := normalizeSliceOrder(patch, patchOrder, mergeKey, kind)
+	if err != nil {
+		return nil, err
+	}
+	serverOnly, err = normalizeSliceOrder(serverOnly, serverOrder, mergeKey, kind)
+	if err != nil {
+		return nil, err
+	}
+	all := mergeSortedSlice(serverOnly, patch, serverOrder, mergeKey, kind)
+
+	return all, nil
+}
+
+// mergeSortedSlice merges the 2 sorted lists by serverOrder with best effort.
+// It will insert each item in `left` list to `right` list. In most cases, the 2 lists will be interleaved.
+// The relative order of left and right are guaranteed to be kept.
+// They have higher precedence than the order in the live list.
+// The place for a item in `left` is found by:
+// scan from the place of last insertion in `right` to the end of `right`,
+// the place is before the first item that is greater than the item we want to insert.
+// example usage: using server-only items as left and patch items as right. We insert server-only items
+// to patch list. We use the order of live object as record for comparison.
+func mergeSortedSlice(left, right, serverOrder []interface{}, mergeKey string, kind reflect.Kind) []interface{} {
+	// Returns if l is less than r, and if both have been found.
+	// If l and r both present and l is in front of r, l is less than r.
+	less := func(l, r interface{}) (bool, bool) {
+		li := index(serverOrder, l, mergeKey, kind)
+		ri := index(serverOrder, r, mergeKey, kind)
+		if li >= 0 && ri >= 0 {
+			return li < ri, true
+		} else {
+			return false, false
+		}
+	}
+
+	// left and right should be non-overlapping.
+	size := len(left) + len(right)
+	i, j := 0, 0
+	s := make([]interface{}, size, size)
+
+	for k := 0; k < size; k++ {
+		if i >= len(left) && j < len(right) {
+			// have items left in `right` list
+			s[k] = right[j]
+			j++
+		} else if j >= len(right) && i < len(left) {
+			// have items left in `left` list
+			s[k] = left[i]
+			i++
+		} else {
+			// compare them if i and j are both in bound
+			less, foundBoth := less(left[i], right[j])
+			if foundBoth && less {
+				s[k] = left[i]
+				i++
+			} else {
+				s[k] = right[j]
+				j++
+			}
+		}
+	}
+	return s
+}
+
+// index returns the index of the item in the given items, or -1 if it doesn't exist
+// l must NOT be a slice of slices, this should be checked before calling.
+func index(l []interface{}, valToLookUp interface{}, mergeKey string, kind reflect.Kind) int {
+	var getValFn func(interface{}) interface{}
+	// Get the correct `getValFn` based on item `kind`.
+	// It should return the value of merge key for maps and
+	// return the item for other kinds.
+	switch kind {
+	case reflect.Map:
+		getValFn = func(item interface{}) interface{} {
+			typedItem, ok := item.(map[string]interface{})
+			if !ok {
+				return nil
+			}
+			val := typedItem[mergeKey]
+			return val
+		}
+	default:
+		getValFn = func(item interface{}) interface{} {
+			return item
+		}
+	}
+
+	for i, v := range l {
+		if getValFn(valToLookUp) == getValFn(v) {
+			return i
+		}
+	}
+	return -1
+}
+
+// extractToDeleteItems takes a list and
+// returns 2 lists: one contains items that should be kept and the other contains items to be deleted.
+func extractToDeleteItems(l []interface{}) ([]interface{}, []interface{}, error) {
+	var nonDelete, toDelete []interface{}
+	for _, v := range l {
+		m, ok := v.(map[string]interface{})
+		if !ok {
+			return nil, nil, mergepatch.ErrBadArgType(m, v)
+		}
+
+		directive, foundDirective := m[directiveMarker]
+		if foundDirective && directive == deleteDirective {
+			toDelete = append(toDelete, v)
+		} else {
+			nonDelete = append(nonDelete, v)
+		}
+	}
+	return nonDelete, toDelete, nil
+}
+
+// normalizeSliceOrder sort `toSort` list by `order`
+func normalizeSliceOrder(toSort, order []interface{}, mergeKey string, kind reflect.Kind) ([]interface{}, error) {
+	var toDelete []interface{}
+	if kind == reflect.Map {
+		// make sure each item in toSort, order has merge key
+		err := validateMergeKeyInLists(mergeKey, toSort, order)
+		if err != nil {
+			return nil, err
+		}
+		toSort, toDelete, err = extractToDeleteItems(toSort)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	sort.SliceStable(toSort, func(i, j int) bool {
+		if ii := index(order, toSort[i], mergeKey, kind); ii >= 0 {
+			if ij := index(order, toSort[j], mergeKey, kind); ij >= 0 {
+				return ii < ij
+			}
+		}
+		return true
+	})
+	toSort = append(toSort, toDelete...)
+	return toSort, nil
+}
+
+// Returns a (recursive) strategic merge patch, a parallel deletion list if necessary and
+// another list to set the order of the list
+// Only list of primitives with merge strategy will generate a parallel deletion list.
+// These two lists should yield modified when applied to original, for lists with merge semantics.
+func diffLists(original, modified []interface{}, schema LookupPatchMeta, mergeKey string, diffOptions DiffOptions) ([]interface{}, []interface{}, []interface{}, error) {
+	if len(original) == 0 {
+		// Both slices are empty - do nothing
+		if len(modified) == 0 || diffOptions.IgnoreChangesAndAdditions {
+			return nil, nil, nil, nil
+		}
+
+		// Old slice was empty - add all elements from the new slice
+		return modified, nil, nil, nil
+	}
+
+	elementType, err := sliceElementType(original, modified)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	var patchList, deleteList, setOrderList []interface{}
+	kind := elementType.Kind()
+	switch kind {
+	case reflect.Map:
+		patchList, deleteList, err = diffListsOfMaps(original, modified, schema, mergeKey, diffOptions)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+		patchList, err = normalizeSliceOrder(patchList, modified, mergeKey, kind)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+		orderSame, err := isOrderSame(original, modified, mergeKey)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+		// append the deletions to the end of the patch list.
+		patchList = append(patchList, deleteList...)
+		deleteList = nil
+		// generate the setElementOrder list when there are content changes or order changes
+		if diffOptions.SetElementOrder &&
+			((!diffOptions.IgnoreChangesAndAdditions && (len(patchList) > 0 || !orderSame)) ||
+				(!diffOptions.IgnoreDeletions && len(patchList) > 0)) {
+			// Generate a list of maps that each item contains only the merge key.
+			setOrderList = make([]interface{}, len(modified))
+			for i, v := range modified {
+				typedV := v.(map[string]interface{})
+				setOrderList[i] = map[string]interface{}{
+					mergeKey: typedV[mergeKey],
+				}
+			}
+		}
+	case reflect.Slice:
+		// Lists of Lists are not permitted by the api
+		return nil, nil, nil, mergepatch.ErrNoListOfLists
+	default:
+		patchList, deleteList, err = diffListsOfScalars(original, modified, diffOptions)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+		patchList, err = normalizeSliceOrder(patchList, modified, mergeKey, kind)
+		// generate the setElementOrder list when there are content changes or order changes
+		if diffOptions.SetElementOrder && ((!diffOptions.IgnoreDeletions && len(deleteList) > 0) ||
+			(!diffOptions.IgnoreChangesAndAdditions && !reflect.DeepEqual(original, modified))) {
+			setOrderList = modified
+		}
+	}
+	return patchList, deleteList, setOrderList, err
+}
+
+// isOrderSame checks if the order in a list has changed
+func isOrderSame(original, modified []interface{}, mergeKey string) (bool, error) {
+	if len(original) != len(modified) {
+		return false, nil
+	}
+	for i, modifiedItem := range modified {
+		equal, err := mergeKeyValueEqual(original[i], modifiedItem, mergeKey)
+		if err != nil || !equal {
+			return equal, err
+		}
+	}
+	return true, nil
+}
+
+// diffListsOfScalars returns 2 lists, the first one is addList and the second one is deletionList.
+// Argument diffOptions.IgnoreChangesAndAdditions controls if calculate addList. true means not calculate.
+// Argument diffOptions.IgnoreDeletions controls if calculate deletionList. true means not calculate.
+// original may be changed, but modified is guaranteed to not be changed
+func diffListsOfScalars(original, modified []interface{}, diffOptions DiffOptions) ([]interface{}, []interface{}, error) {
+	modifiedCopy := make([]interface{}, len(modified))
+	copy(modifiedCopy, modified)
+	// Sort the scalars for easier calculating the diff
+	originalScalars := sortScalars(original)
+	modifiedScalars := sortScalars(modifiedCopy)
+
+	originalIndex, modifiedIndex := 0, 0
+	addList := []interface{}{}
+	deletionList := []interface{}{}
+
+	for {
+		originalInBounds := originalIndex < len(originalScalars)
+		modifiedInBounds := modifiedIndex < len(modifiedScalars)
+		if !originalInBounds && !modifiedInBounds {
+			break
+		}
+		// we need to compare the string representation of the scalar,
+		// because the scalar is an interface which doesn't support either < or >
+		// And that's how func sortScalars compare scalars.
+		var originalString, modifiedString string
+		var originalValue, modifiedValue interface{}
+		if originalInBounds {
+			originalValue = originalScalars[originalIndex]
+			originalString = fmt.Sprintf("%v", originalValue)
+		}
+		if modifiedInBounds {
+			modifiedValue = modifiedScalars[modifiedIndex]
+			modifiedString = fmt.Sprintf("%v", modifiedValue)
+		}
+
+		originalV, modifiedV := compareListValuesAtIndex(originalInBounds, modifiedInBounds, originalString, modifiedString)
+		switch {
+		case originalV == nil && modifiedV == nil:
+			originalIndex++
+			modifiedIndex++
+		case originalV != nil && modifiedV == nil:
+			if !diffOptions.IgnoreDeletions {
+				deletionList = append(deletionList, originalValue)
+			}
+			originalIndex++
+		case originalV == nil && modifiedV != nil:
+			if !diffOptions.IgnoreChangesAndAdditions {
+				addList = append(addList, modifiedValue)
+			}
+			modifiedIndex++
+		default:
+			return nil, nil, fmt.Errorf("Unexpected returned value from compareListValuesAtIndex: %v and %v", originalV, modifiedV)
+		}
+	}
+
+	return addList, deduplicateScalars(deletionList), nil
+}
+
+// If first return value is non-nil, list1 contains an element not present in list2
+// If second return value is non-nil, list2 contains an element not present in list1
+func compareListValuesAtIndex(list1Inbounds, list2Inbounds bool, list1Value, list2Value string) (interface{}, interface{}) {
+	bothInBounds := list1Inbounds && list2Inbounds
+	switch {
+	// scalars are identical
+	case bothInBounds && list1Value == list2Value:
+		return nil, nil
+	// only list2 is in bound
+	case !list1Inbounds:
+		fallthrough
+	// list2 has additional scalar
+	case bothInBounds && list1Value > list2Value:
+		return nil, list2Value
+	// only original is in bound
+	case !list2Inbounds:
+		fallthrough
+	// original has additional scalar
+	case bothInBounds && list1Value < list2Value:
+		return list1Value, nil
+	default:
+		return nil, nil
+	}
+}
+
+// diffListsOfMaps takes a pair of lists and
+// returns a (recursive) strategic merge patch list contains additions and changes and
+// a deletion list contains deletions
+func diffListsOfMaps(original, modified []interface{}, schema LookupPatchMeta, mergeKey string, diffOptions DiffOptions) ([]interface{}, []interface{}, error) {
+	patch := make([]interface{}, 0, len(modified))
+	deletionList := make([]interface{}, 0, len(original))
+
+	originalSorted, err := sortMergeListsByNameArray(original, schema, mergeKey, false)
+	if err != nil {
+		return nil, nil, err
+	}
+	modifiedSorted, err := sortMergeListsByNameArray(modified, schema, mergeKey, false)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	originalIndex, modifiedIndex := 0, 0
+	for {
+		originalInBounds := originalIndex < len(originalSorted)
+		modifiedInBounds := modifiedIndex < len(modifiedSorted)
+		bothInBounds := originalInBounds && modifiedInBounds
+		if !originalInBounds && !modifiedInBounds {
+			break
+		}
+
+		var originalElementMergeKeyValueString, modifiedElementMergeKeyValueString string
+		var originalElementMergeKeyValue, modifiedElementMergeKeyValue interface{}
+		var originalElement, modifiedElement map[string]interface{}
+		if originalInBounds {
+			originalElement, originalElementMergeKeyValue, err = getMapAndMergeKeyValueByIndex(originalIndex, mergeKey, originalSorted)
+			if err != nil {
+				return nil, nil, err
+			}
+			originalElementMergeKeyValueString = fmt.Sprintf("%v", originalElementMergeKeyValue)
+		}
+		if modifiedInBounds {
+			modifiedElement, modifiedElementMergeKeyValue, err = getMapAndMergeKeyValueByIndex(modifiedIndex, mergeKey, modifiedSorted)
+			if err != nil {
+				return nil, nil, err
+			}
+			modifiedElementMergeKeyValueString = fmt.Sprintf("%v", modifiedElementMergeKeyValue)
+		}
+
+		switch {
+		case bothInBounds && ItemMatchesOriginalAndModifiedSlice(originalElementMergeKeyValueString, modifiedElementMergeKeyValueString):
+			// Merge key values are equal, so recurse
+			patchValue, err := diffMaps(originalElement, modifiedElement, schema, diffOptions)
+			if err != nil {
+				return nil, nil, err
+			}
+			if len(patchValue) > 0 {
+				patchValue[mergeKey] = modifiedElementMergeKeyValue
+				patch = append(patch, patchValue)
+			}
+			originalIndex++
+			modifiedIndex++
+		// only modified is in bound
+		case !originalInBounds:
+			fallthrough
+		// modified has additional map
+		case bothInBounds && ItemAddedToModifiedSlice(originalElementMergeKeyValueString, modifiedElementMergeKeyValueString):
+			if !diffOptions.IgnoreChangesAndAdditions {
+				patch = append(patch, modifiedElement)
+			}
+			modifiedIndex++
+		// only original is in bound
+		case !modifiedInBounds:
+			fallthrough
+		// original has additional map
+		case bothInBounds && ItemRemovedFromModifiedSlice(originalElementMergeKeyValueString, modifiedElementMergeKeyValueString):
+			if !diffOptions.IgnoreDeletions {
+				// Item was deleted, so add delete directive
+				deletionList = append(deletionList, CreateDeleteDirective(mergeKey, originalElementMergeKeyValue))
+			}
+			originalIndex++
+		}
+	}
+
+	return patch, deletionList, nil
+}
+
+// getMapAndMergeKeyValueByIndex return a map in the list and its merge key value given the index of the map.
+func getMapAndMergeKeyValueByIndex(index int, mergeKey string, listOfMaps []interface{}) (map[string]interface{}, interface{}, error) {
+	m, ok := listOfMaps[index].(map[string]interface{})
+	if !ok {
+		return nil, nil, mergepatch.ErrBadArgType(m, listOfMaps[index])
+	}
+
+	val, ok := m[mergeKey]
+	if !ok {
+		return nil, nil, mergepatch.ErrNoMergeKey(m, mergeKey)
+	}
+	return m, val, nil
+}
+
+// StrategicMergePatch applies a strategic merge patch. The patch and the original document
+// must be json encoded content. A patch can be created from an original and a modified document
+// by calling CreateStrategicMergePatch.
+func StrategicMergePatch(original, patch []byte, dataStruct interface{}) ([]byte, error) {
+	schema, err := NewPatchMetaFromStruct(dataStruct)
+	if err != nil {
+		return nil, err
+	}
+
+	return StrategicMergePatchUsingLookupPatchMeta(original, patch, schema)
+}
+
+func StrategicMergePatchUsingLookupPatchMeta(original, patch []byte, schema LookupPatchMeta) ([]byte, error) {
+	originalMap, err := handleUnmarshal(original)
+	if err != nil {
+		return nil, err
+	}
+	patchMap, err := handleUnmarshal(patch)
+	if err != nil {
+		return nil, err
+	}
+
+	result, err := StrategicMergeMapPatchUsingLookupPatchMeta(originalMap, patchMap, schema)
+	if err != nil {
+		return nil, err
+	}
+
+	return json.Marshal(result)
+}
+
+func handleUnmarshal(j []byte) (map[string]interface{}, error) {
+	if j == nil {
+		j = []byte("{}")
+	}
+
+	m := map[string]interface{}{}
+	err := json.Unmarshal(j, &m)
+	if err != nil {
+		return nil, mergepatch.ErrBadJSONDoc
+	}
+	return m, nil
+}
+
+// StrategicMergeMapPatch applies a strategic merge patch. The original and patch documents
+// must be JSONMap. A patch can be created from an original and modified document by
+// calling CreateTwoWayMergeMapPatch.
+// Warning: the original and patch JSONMap objects are mutated by this function and should not be reused.
+func StrategicMergeMapPatch(original, patch JSONMap, dataStruct interface{}) (JSONMap, error) {
+	schema, err := NewPatchMetaFromStruct(dataStruct)
+	if err != nil {
+		return nil, err
+	}
+
+	// We need the go struct tags `patchMergeKey` and `patchStrategy` for fields that support a strategic merge patch.
+	// For native resources, we can easily figure out these tags since we know the fields.
+
+	// Because custom resources are decoded as Unstructured and because we're missing the metadata about how to handle
+	// each field in a strategic merge patch, we can't find the go struct tags. Hence, we can't easily  do a strategic merge
+	// for custom resources. So we should fail fast and return an error.
+	if _, ok := dataStruct.(*unstructured.Unstructured); ok {
+		return nil, mergepatch.ErrUnsupportedStrategicMergePatchFormat
+	}
+
+	return StrategicMergeMapPatchUsingLookupPatchMeta(original, patch, schema)
+}
+
+func StrategicMergeMapPatchUsingLookupPatchMeta(original, patch JSONMap, schema LookupPatchMeta) (JSONMap, error) {
+	mergeOptions := MergeOptions{
+		MergeParallelList:    true,
+		IgnoreUnmatchedNulls: true,
+	}
+	return mergeMap(original, patch, schema, mergeOptions)
+}
+
+// MergeStrategicMergeMapPatchUsingLookupPatchMeta merges strategic merge
+// patches retaining `null` fields and parallel lists. If 2 patches change the
+// same fields and the latter one will override the former one. If you don't
+// want that happen, you need to run func MergingMapsHaveConflicts before
+// merging these patches. Applying the resulting merged merge patch to a JSONMap
+// yields the same as merging each strategic merge patch to the JSONMap in
+// succession.
+func MergeStrategicMergeMapPatchUsingLookupPatchMeta(schema LookupPatchMeta, patches ...JSONMap) (JSONMap, error) {
+	mergeOptions := MergeOptions{
+		MergeParallelList:    false,
+		IgnoreUnmatchedNulls: false,
+	}
+	merged := JSONMap{}
+	var err error
+	for _, patch := range patches {
+		merged, err = mergeMap(merged, patch, schema, mergeOptions)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return merged, nil
+}
+
+// handleDirectiveInMergeMap handles the patch directive when merging 2 maps.
+func handleDirectiveInMergeMap(directive interface{}, patch map[string]interface{}) (map[string]interface{}, error) {
+	if directive == replaceDirective {
+		// If the patch contains "$patch: replace", don't merge it, just use the
+		// patch directly. Later on, we can add a single level replace that only
+		// affects the map that the $patch is in.
+		delete(patch, directiveMarker)
+		return patch, nil
+	}
+
+	if directive == deleteDirective {
+		// If the patch contains "$patch: delete", don't merge it, just return
+		//  an empty map.
+		return map[string]interface{}{}, nil
+	}
+
+	return nil, mergepatch.ErrBadPatchType(directive, patch)
+}
+
+func containsDirectiveMarker(item interface{}) bool {
+	m, ok := item.(map[string]interface{})
+	if ok {
+		if _, foundDirectiveMarker := m[directiveMarker]; foundDirectiveMarker {
+			return true
+		}
+	}
+	return false
+}
+
+func mergeKeyValueEqual(left, right interface{}, mergeKey string) (bool, error) {
+	if len(mergeKey) == 0 {
+		return left == right, nil
+	}
+	typedLeft, ok := left.(map[string]interface{})
+	if !ok {
+		return false, mergepatch.ErrBadArgType(typedLeft, left)
+	}
+	typedRight, ok := right.(map[string]interface{})
+	if !ok {
+		return false, mergepatch.ErrBadArgType(typedRight, right)
+	}
+	mergeKeyLeft, ok := typedLeft[mergeKey]
+	if !ok {
+		return false, mergepatch.ErrNoMergeKey(typedLeft, mergeKey)
+	}
+	mergeKeyRight, ok := typedRight[mergeKey]
+	if !ok {
+		return false, mergepatch.ErrNoMergeKey(typedRight, mergeKey)
+	}
+	return mergeKeyLeft == mergeKeyRight, nil
+}
+
+// extractKey trims the prefix and return the original key
+func extractKey(s, prefix string) (string, error) {
+	substrings := strings.SplitN(s, "/", 2)
+	if len(substrings) <= 1 || substrings[0] != prefix {
+		switch prefix {
+		case deleteFromPrimitiveListDirectivePrefix:
+			return "", mergepatch.ErrBadPatchFormatForPrimitiveList
+		case setElementOrderDirectivePrefix:
+			return "", mergepatch.ErrBadPatchFormatForSetElementOrderList
+		default:
+			return "", fmt.Errorf("fail to find unknown prefix %q in %s\n", prefix, s)
+		}
+	}
+	return substrings[1], nil
+}
+
+// validatePatchUsingSetOrderList verifies:
+// the relative order of any two items in the setOrderList list matches that in the patch list.
+// the items in the patch list must be a subset or the same as the $setElementOrder list (deletions are ignored).
+func validatePatchWithSetOrderList(patchList, setOrderList interface{}, mergeKey string) error {
+	typedSetOrderList, ok := setOrderList.([]interface{})
+	if !ok {
+		return mergepatch.ErrBadPatchFormatForSetElementOrderList
+	}
+	typedPatchList, ok := patchList.([]interface{})
+	if !ok {
+		return mergepatch.ErrBadPatchFormatForSetElementOrderList
+	}
+	if len(typedSetOrderList) == 0 || len(typedPatchList) == 0 {
+		return nil
+	}
+
+	var nonDeleteList []interface{}
+	var err error
+	if len(mergeKey) > 0 {
+		nonDeleteList, _, err = extractToDeleteItems(typedPatchList)
+		if err != nil {
+			return err
+		}
+	} else {
+		nonDeleteList = typedPatchList
+	}
+
+	patchIndex, setOrderIndex := 0, 0
+	for patchIndex < len(nonDeleteList) && setOrderIndex < len(typedSetOrderList) {
+		if containsDirectiveMarker(nonDeleteList[patchIndex]) {
+			patchIndex++
+			continue
+		}
+		mergeKeyEqual, err := mergeKeyValueEqual(nonDeleteList[patchIndex], typedSetOrderList[setOrderIndex], mergeKey)
+		if err != nil {
+			return err
+		}
+		if mergeKeyEqual {
+			patchIndex++
+		}
+		setOrderIndex++
+	}
+	// If patchIndex is inbound but setOrderIndex if out of bound mean there are items mismatching between the patch list and setElementOrder list.
+	// the second check is a sanity check, and should always be true if the first is true.
+	if patchIndex < len(nonDeleteList) && setOrderIndex >= len(typedSetOrderList) {
+		return fmt.Errorf("The order in patch list:\n%v\n doesn't match %s list:\n%v\n", typedPatchList, setElementOrderDirectivePrefix, setOrderList)
+	}
+	return nil
+}
+
+// preprocessDeletionListForMerging preprocesses the deletion list.
+// it returns shouldContinue, isDeletionList, noPrefixKey
+func preprocessDeletionListForMerging(key string, original map[string]interface{},
+	patchVal interface{}, mergeDeletionList bool) (bool, bool, string, error) {
+	// If found a parallel list for deletion and we are going to merge the list,
+	// overwrite the key to the original key and set flag isDeleteList
+	foundParallelListPrefix := strings.HasPrefix(key, deleteFromPrimitiveListDirectivePrefix)
+	if foundParallelListPrefix {
+		if !mergeDeletionList {
+			original[key] = patchVal
+			return true, false, "", nil
+		}
+		originalKey, err := extractKey(key, deleteFromPrimitiveListDirectivePrefix)
+		return false, true, originalKey, err
+	}
+	return false, false, "", nil
+}
+
+// applyRetainKeysDirective looks for a retainKeys directive and applies to original
+// - if no directive exists do nothing
+// - if directive is found, clear keys in original missing from the directive list
+// - validate that all keys present in the patch are present in the retainKeys directive
+// note: original may be another patch request, e.g. applying the add+modified patch to the deletions patch. In this case it may have directives
+func applyRetainKeysDirective(original, patch map[string]interface{}, options MergeOptions) error {
+	retainKeysInPatch, foundInPatch := patch[retainKeysDirective]
+	if !foundInPatch {
+		return nil
+	}
+	// cleanup the directive
+	delete(patch, retainKeysDirective)
+
+	if !options.MergeParallelList {
+		// If original is actually a patch, make sure the retainKeys directives are the same in both patches if present in both.
+		// If not present in the original patch, copy from the modified patch.
+		retainKeysInOriginal, foundInOriginal := original[retainKeysDirective]
+		if foundInOriginal {
+			if !reflect.DeepEqual(retainKeysInOriginal, retainKeysInPatch) {
+				// This error actually should never happen.
+				return fmt.Errorf("%v and %v are not deep equal: this may happen when calculating the 3-way diff patch", retainKeysInOriginal, retainKeysInPatch)
+			}
+		} else {
+			original[retainKeysDirective] = retainKeysInPatch
+		}
+		return nil
+	}
+
+	retainKeysList, ok := retainKeysInPatch.([]interface{})
+	if !ok {
+		return mergepatch.ErrBadPatchFormatForRetainKeys
+	}
+
+	// validate patch to make sure all fields in the patch are present in the retainKeysList.
+	// The map is used only as a set, the value is never referenced
+	m := map[interface{}]struct{}{}
+	for _, v := range retainKeysList {
+		m[v] = struct{}{}
+	}
+	for k, v := range patch {
+		if v == nil || strings.HasPrefix(k, deleteFromPrimitiveListDirectivePrefix) ||
+			strings.HasPrefix(k, setElementOrderDirectivePrefix) {
+			continue
+		}
+		// If there is an item present in the patch but not in the retainKeys list,
+		// the patch is invalid.
+		if _, found := m[k]; !found {
+			return mergepatch.ErrBadPatchFormatForRetainKeys
+		}
+	}
+
+	// clear not present fields
+	for k := range original {
+		if _, found := m[k]; !found {
+			delete(original, k)
+		}
+	}
+	return nil
+}
+
+// mergePatchIntoOriginal processes $setElementOrder list.
+// When not merging the directive, it will make sure $setElementOrder list exist only in original.
+// When merging the directive, it will try to find the $setElementOrder list and
+// its corresponding patch list, validate it and merge it.
+// Then, sort them by the relative order in setElementOrder, patch list and live list.
+// The precedence is $setElementOrder > order in patch list > order in live list.
+// This function will delete the item after merging it to prevent process it again in the future.
+// Ref: https://git.k8s.io/design-proposals-archive/cli/preserve-order-in-strategic-merge-patch.md
+func mergePatchIntoOriginal(original, patch map[string]interface{}, schema LookupPatchMeta, mergeOptions MergeOptions) error {
+	for key, patchV := range patch {
+		// Do nothing if there is no ordering directive
+		if !strings.HasPrefix(key, setElementOrderDirectivePrefix) {
+			continue
+		}
+
+		setElementOrderInPatch := patchV
+		// Copies directive from the second patch (`patch`) to the first patch (`original`)
+		// and checks they are equal and delete the directive in the second patch
+		if !mergeOptions.MergeParallelList {
+			setElementOrderListInOriginal, ok := original[key]
+			if ok {
+				// check if the setElementOrder list in original and the one in patch matches
+				if !reflect.DeepEqual(setElementOrderListInOriginal, setElementOrderInPatch) {
+					return mergepatch.ErrBadPatchFormatForSetElementOrderList
+				}
+			} else {
+				// move the setElementOrder list from patch to original
+				original[key] = setElementOrderInPatch
+			}
+		}
+		delete(patch, key)
+
+		var (
+			ok                                          bool
+			originalFieldValue, patchFieldValue, merged []interface{}
+			patchStrategy                               string
+			patchMeta                                   PatchMeta
+			subschema                                   LookupPatchMeta
+		)
+		typedSetElementOrderList, ok := setElementOrderInPatch.([]interface{})
+		if !ok {
+			return mergepatch.ErrBadArgType(typedSetElementOrderList, setElementOrderInPatch)
+		}
+		// Trim the setElementOrderDirectivePrefix to get the key of the list field in original.
+		originalKey, err := extractKey(key, setElementOrderDirectivePrefix)
+		if err != nil {
+			return err
+		}
+		// try to find the list with `originalKey` in `original` and `modified` and merge them.
+		originalList, foundOriginal := original[originalKey]
+		patchList, foundPatch := patch[originalKey]
+		if foundOriginal {
+			originalFieldValue, ok = originalList.([]interface{})
+			if !ok {
+				return mergepatch.ErrBadArgType(originalFieldValue, originalList)
+			}
+		}
+		if foundPatch {
+			patchFieldValue, ok = patchList.([]interface{})
+			if !ok {
+				return mergepatch.ErrBadArgType(patchFieldValue, patchList)
+			}
+		}
+		subschema, patchMeta, err = schema.LookupPatchMetadataForSlice(originalKey)
+		if err != nil {
+			return err
+		}
+		_, patchStrategy, err = extractRetainKeysPatchStrategy(patchMeta.GetPatchStrategies())
+		if err != nil {
+			return err
+		}
+		// Check for consistency between the element order list and the field it applies to
+		err = validatePatchWithSetOrderList(patchFieldValue, typedSetElementOrderList, patchMeta.GetPatchMergeKey())
+		if err != nil {
+			return err
+		}
+
+		switch {
+		case foundOriginal && !foundPatch:
+			// no change to list contents
+			merged = originalFieldValue
+		case !foundOriginal && foundPatch:
+			// list was added
+			v, keep := removeDirectives(patchFieldValue)
+			if !keep {
+				// Shouldn't be possible since patchFieldValue is a slice
+				continue
+			}
+
+			merged = v.([]interface{})
+		case foundOriginal && foundPatch:
+			merged, err = mergeSliceHandler(originalList, patchList, subschema,
+				patchStrategy, patchMeta.GetPatchMergeKey(), false, mergeOptions)
+			if err != nil {
+				return err
+			}
+		case !foundOriginal && !foundPatch:
+			continue
+		}
+
+		// Split all items into patch items and server-only items and then enforce the order.
+		var patchItems, serverOnlyItems []interface{}
+		if len(patchMeta.GetPatchMergeKey()) == 0 {
+			// Primitives doesn't need merge key to do partitioning.
+			patchItems, serverOnlyItems = partitionPrimitivesByPresentInList(merged, typedSetElementOrderList)
+
+		} else {
+			// Maps need merge key to do partitioning.
+			patchItems, serverOnlyItems, err = partitionMapsByPresentInList(merged, typedSetElementOrderList, patchMeta.GetPatchMergeKey())
+			if err != nil {
+				return err
+			}
+		}
+
+		elementType, err := sliceElementType(originalFieldValue, patchFieldValue)
+		if err != nil {
+			return err
+		}
+		kind := elementType.Kind()
+		// normalize merged list
+		// typedSetElementOrderList contains all the relative order in typedPatchList,
+		// so don't need to use typedPatchList
+		both, err := normalizeElementOrder(patchItems, serverOnlyItems, typedSetElementOrderList, originalFieldValue, patchMeta.GetPatchMergeKey(), kind)
+		if err != nil {
+			return err
+		}
+		original[originalKey] = both
+		// delete patch list from patch to prevent process again in the future
+		delete(patch, originalKey)
+	}
+	return nil
+}
+
+// partitionPrimitivesByPresentInList partitions elements into 2 slices, the first containing items present in partitionBy, the other not.
+func partitionPrimitivesByPresentInList(original, partitionBy []interface{}) ([]interface{}, []interface{}) {
+	patch := make([]interface{}, 0, len(original))
+	serverOnly := make([]interface{}, 0, len(original))
+	inPatch := map[interface{}]bool{}
+	for _, v := range partitionBy {
+		inPatch[v] = true
+	}
+	for _, v := range original {
+		if !inPatch[v] {
+			serverOnly = append(serverOnly, v)
+		} else {
+			patch = append(patch, v)
+		}
+	}
+	return patch, serverOnly
+}
+
+// partitionMapsByPresentInList partitions elements into 2 slices, the first containing items present in partitionBy, the other not.
+func partitionMapsByPresentInList(original, partitionBy []interface{}, mergeKey string) ([]interface{}, []interface{}, error) {
+	patch := make([]interface{}, 0, len(original))
+	serverOnly := make([]interface{}, 0, len(original))
+	for _, v := range original {
+		typedV, ok := v.(map[string]interface{})
+		if !ok {
+			return nil, nil, mergepatch.ErrBadArgType(typedV, v)
+		}
+		mergeKeyValue, foundMergeKey := typedV[mergeKey]
+		if !foundMergeKey {
+			return nil, nil, mergepatch.ErrNoMergeKey(typedV, mergeKey)
+		}
+		_, _, found, err := findMapInSliceBasedOnKeyValue(partitionBy, mergeKey, mergeKeyValue)
+		if err != nil {
+			return nil, nil, err
+		}
+		if !found {
+			serverOnly = append(serverOnly, v)
+		} else {
+			patch = append(patch, v)
+		}
+	}
+	return patch, serverOnly, nil
+}
+
+// Removes directives from an object and returns value to use instead and whether
+// or not the field/index should even be kept
+// May modify input
+func removeDirectives(obj interface{}) (interface{}, bool) {
+	if obj == nil {
+		return obj, true
+	} else if typedV, ok := obj.(map[string]interface{}); ok {
+		if _, hasDirective := typedV[directiveMarker]; hasDirective {
+			return nil, false
+		}
+
+		for k, v := range typedV {
+			var keep bool
+			typedV[k], keep = removeDirectives(v)
+			if !keep {
+				delete(typedV, k)
+			}
+		}
+		return typedV, true
+	} else if typedV, ok := obj.([]interface{}); ok {
+		var res []interface{}
+		if typedV != nil {
+			// Make sure res is non-nil if patch is non-nil
+			res = []interface{}{}
+		}
+		for _, v := range typedV {
+			if newV, keep := removeDirectives(v); keep {
+				res = append(res, newV)
+			}
+		}
+		return res, true
+	} else {
+		return obj, true
+	}
+}
+
+// Merge fields from a patch map into the original map. Note: This may modify
+// both the original map and the patch because getting a deep copy of a map in
+// golang is highly non-trivial.
+// flag mergeOptions.MergeParallelList controls if using the parallel list to delete or keeping the list.
+// If patch contains any null field (e.g. field_1: null) that is not
+// present in original, then to propagate it to the end result use
+// mergeOptions.IgnoreUnmatchedNulls == false.
+func mergeMap(original, patch map[string]interface{}, schema LookupPatchMeta, mergeOptions MergeOptions) (map[string]interface{}, error) {
+	if v, ok := patch[directiveMarker]; ok {
+		return handleDirectiveInMergeMap(v, patch)
+	}
+
+	// nil is an accepted value for original to simplify logic in other places.
+	// If original is nil, replace it with an empty map and then apply the patch.
+	if original == nil {
+		original = map[string]interface{}{}
+	}
+
+	err := applyRetainKeysDirective(original, patch, mergeOptions)
+	if err != nil {
+		return nil, err
+	}
+
+	// Process $setElementOrder list and other lists sharing the same key.
+	// When not merging the directive, it will make sure $setElementOrder list exist only in original.
+	// When merging the directive, it will process $setElementOrder and its patch list together.
+	// This function will delete the merged elements from patch so they will not be reprocessed
+	err = mergePatchIntoOriginal(original, patch, schema, mergeOptions)
+	if err != nil {
+		return nil, err
+	}
+
+	// Start merging the patch into the original.
+	for k, patchV := range patch {
+		skipProcessing, isDeleteList, noPrefixKey, err := preprocessDeletionListForMerging(k, original, patchV, mergeOptions.MergeParallelList)
+		if err != nil {
+			return nil, err
+		}
+		if skipProcessing {
+			continue
+		}
+		if len(noPrefixKey) > 0 {
+			k = noPrefixKey
+		}
+
+		// If the value of this key is null, delete the key if it exists in the
+		// original. Otherwise, check if we want to preserve it or skip it.
+		// Preserving the null value is useful when we want to send an explicit
+		// delete to the API server.
+		// In some cases, this may lead to inconsistent behavior with create.
+		// ref: https://github.com/kubernetes/kubernetes/issues/123304
+		// To avoid breaking compatibility,
+		// we made corresponding changes on the client side to ensure that the create and patch behaviors are idempotent.
+		if patchV == nil {
+			delete(original, k)
+			if mergeOptions.IgnoreUnmatchedNulls {
+				continue
+			}
+		}
+
+		_, ok := original[k]
+		if !ok {
+			if !isDeleteList {
+				// If it's not in the original document, just take the patch value.
+				if mergeOptions.IgnoreUnmatchedNulls {
+					discardNullValuesFromPatch(patchV)
+				}
+				original[k], ok = removeDirectives(patchV)
+				if !ok {
+					delete(original, k)
+				}
+			}
+			continue
+		}
+
+		originalType := reflect.TypeOf(original[k])
+		patchType := reflect.TypeOf(patchV)
+		if originalType != patchType {
+			if !isDeleteList {
+				if mergeOptions.IgnoreUnmatchedNulls {
+					discardNullValuesFromPatch(patchV)
+				}
+				original[k], ok = removeDirectives(patchV)
+				if !ok {
+					delete(original, k)
+				}
+			}
+			continue
+		}
+		// If they're both maps or lists, recurse into the value.
+		switch originalType.Kind() {
+		case reflect.Map:
+			subschema, patchMeta, err2 := schema.LookupPatchMetadataForStruct(k)
+			if err2 != nil {
+				return nil, err2
+			}
+			_, patchStrategy, err2 := extractRetainKeysPatchStrategy(patchMeta.GetPatchStrategies())
+			if err2 != nil {
+				return nil, err2
+			}
+			original[k], err = mergeMapHandler(original[k], patchV, subschema, patchStrategy, mergeOptions)
+		case reflect.Slice:
+			subschema, patchMeta, err2 := schema.LookupPatchMetadataForSlice(k)
+			if err2 != nil {
+				return nil, err2
+			}
+			_, patchStrategy, err2 := extractRetainKeysPatchStrategy(patchMeta.GetPatchStrategies())
+			if err2 != nil {
+				return nil, err2
+			}
+			original[k], err = mergeSliceHandler(original[k], patchV, subschema, patchStrategy, patchMeta.GetPatchMergeKey(), isDeleteList, mergeOptions)
+		default:
+			original[k], ok = removeDirectives(patchV)
+			if !ok {
+				// if patchV itself is a directive, then don't keep it
+				delete(original, k)
+			}
+		}
+		if err != nil {
+			return nil, err
+		}
+	}
+	return original, nil
+}
+
+// discardNullValuesFromPatch discards all null property values from patch.
+// It traverses all slices and map types.
+func discardNullValuesFromPatch(patchV interface{}) {
+	switch patchV := patchV.(type) {
+	case map[string]interface{}:
+		for k, v := range patchV {
+			if v == nil {
+				delete(patchV, k)
+			} else {
+				discardNullValuesFromPatch(v)
+			}
+		}
+	case []interface{}:
+		for _, v := range patchV {
+			discardNullValuesFromPatch(v)
+		}
+	}
+}
+
+// mergeMapHandler handles how to merge `patchV` whose key is `key` with `original` respecting
+// fieldPatchStrategy and mergeOptions.
+func mergeMapHandler(original, patch interface{}, schema LookupPatchMeta,
+	fieldPatchStrategy string, mergeOptions MergeOptions) (map[string]interface{}, error) {
+	typedOriginal, typedPatch, err := mapTypeAssertion(original, patch)
+	if err != nil {
+		return nil, err
+	}
+
+	if fieldPatchStrategy != replaceDirective {
+		return mergeMap(typedOriginal, typedPatch, schema, mergeOptions)
+	} else {
+		return typedPatch, nil
+	}
+}
+
+// mergeSliceHandler handles how to merge `patchV` whose key is `key` with `original` respecting
+// fieldPatchStrategy, fieldPatchMergeKey, isDeleteList and mergeOptions.
+func mergeSliceHandler(original, patch interface{}, schema LookupPatchMeta,
+	fieldPatchStrategy, fieldPatchMergeKey string, isDeleteList bool, mergeOptions MergeOptions) ([]interface{}, error) {
+	typedOriginal, typedPatch, err := sliceTypeAssertion(original, patch)
+	if err != nil {
+		return nil, err
+	}
+
+	// Delete lists are handled the same way regardless of what the field's patch strategy is
+	if fieldPatchStrategy == mergeDirective || isDeleteList {
+		return mergeSlice(typedOriginal, typedPatch, schema, fieldPatchMergeKey, mergeOptions, isDeleteList)
+	} else {
+		return typedPatch, nil
+	}
+}
+
+// Merge two slices together. Note: This may modify both the original slice and
+// the patch because getting a deep copy of a slice in golang is highly
+// non-trivial.
+func mergeSlice(original, patch []interface{}, schema LookupPatchMeta, mergeKey string, mergeOptions MergeOptions, isDeleteList bool) ([]interface{}, error) {
+	if len(original) == 0 && len(patch) == 0 {
+		return original, nil
+	}
+
+	// All the values must be of the same type, but not a list.
+	t, err := sliceElementType(original, patch)
+	if err != nil {
+		return nil, err
+	}
+
+	var merged []interface{}
+	kind := t.Kind()
+	// If the elements are not maps, merge the slices of scalars.
+	if kind != reflect.Map {
+		if mergeOptions.MergeParallelList && isDeleteList {
+			return deleteFromSlice(original, patch), nil
+		}
+		// Maybe in the future add a "concat" mode that doesn't
+		// deduplicate.
+		both := append(original, patch...)
+		merged = deduplicateScalars(both)
+
+	} else {
+		if mergeKey == "" {
+			return nil, fmt.Errorf("cannot merge lists without merge key for %s", schema.Name())
+		}
+
+		original, patch, err = mergeSliceWithSpecialElements(original, patch, mergeKey)
+		if err != nil {
+			return nil, err
+		}
+
+		merged, err = mergeSliceWithoutSpecialElements(original, patch, mergeKey, schema, mergeOptions)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// enforce the order
+	var patchItems, serverOnlyItems []interface{}
+	if len(mergeKey) == 0 {
+		patchItems, serverOnlyItems = partitionPrimitivesByPresentInList(merged, patch)
+	} else {
+		patchItems, serverOnlyItems, err = partitionMapsByPresentInList(merged, patch, mergeKey)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return normalizeElementOrder(patchItems, serverOnlyItems, patch, original, mergeKey, kind)
+}
+
+// mergeSliceWithSpecialElements handles special elements with directiveMarker
+// before merging the slices. It returns a updated `original` and a patch without special elements.
+// original and patch must be slices of maps, they should be checked before calling this function.
+func mergeSliceWithSpecialElements(original, patch []interface{}, mergeKey string) ([]interface{}, []interface{}, error) {
+	patchWithoutSpecialElements := []interface{}{}
+	replace := false
+	for _, v := range patch {
+		typedV := v.(map[string]interface{})
+		patchType, ok := typedV[directiveMarker]
+		if !ok {
+			patchWithoutSpecialElements = append(patchWithoutSpecialElements, v)
+		} else {
+			switch patchType {
+			case deleteDirective:
+				mergeValue, ok := typedV[mergeKey]
+				if ok {
+					var err error
+					original, err = deleteMatchingEntries(original, mergeKey, mergeValue)
+					if err != nil {
+						return nil, nil, err
+					}
+				} else {
+					return nil, nil, mergepatch.ErrNoMergeKey(typedV, mergeKey)
+				}
+			case replaceDirective:
+				replace = true
+				// Continue iterating through the array to prune any other $patch elements.
+			case mergeDirective:
+				return nil, nil, fmt.Errorf("merging lists cannot yet be specified in the patch")
+			default:
+				return nil, nil, mergepatch.ErrBadPatchType(patchType, typedV)
+			}
+		}
+	}
+	if replace {
+		return patchWithoutSpecialElements, nil, nil
+	}
+	return original, patchWithoutSpecialElements, nil
+}
+
+// delete all matching entries (based on merge key) from a merging list
+func deleteMatchingEntries(original []interface{}, mergeKey string, mergeValue interface{}) ([]interface{}, error) {
+	for {
+		_, originalKey, found, err := findMapInSliceBasedOnKeyValue(original, mergeKey, mergeValue)
+		if err != nil {
+			return nil, err
+		}
+
+		if !found {
+			break
+		}
+		// Delete the element at originalKey.
+		original = append(original[:originalKey], original[originalKey+1:]...)
+	}
+	return original, nil
+}
+
+// mergeSliceWithoutSpecialElements merges slices with non-special elements.
+// original and patch must be slices of maps, they should be checked before calling this function.
+func mergeSliceWithoutSpecialElements(original, patch []interface{}, mergeKey string, schema LookupPatchMeta, mergeOptions MergeOptions) ([]interface{}, error) {
+	for _, v := range patch {
+		typedV := v.(map[string]interface{})
+		mergeValue, ok := typedV[mergeKey]
+		if !ok {
+			return nil, mergepatch.ErrNoMergeKey(typedV, mergeKey)
+		}
+
+		// If we find a value with this merge key value in original, merge the
+		// maps. Otherwise append onto original.
+		originalMap, originalKey, found, err := findMapInSliceBasedOnKeyValue(original, mergeKey, mergeValue)
+		if err != nil {
+			return nil, err
+		}
+
+		if found {
+			var mergedMaps interface{}
+			var err error
+			// Merge into original.
+			mergedMaps, err = mergeMap(originalMap, typedV, schema, mergeOptions)
+			if err != nil {
+				return nil, err
+			}
+
+			original[originalKey] = mergedMaps
+		} else {
+			original = append(original, v)
+		}
+	}
+	return original, nil
+}
+
+// deleteFromSlice uses the parallel list to delete the items in a list of scalars
+func deleteFromSlice(current, toDelete []interface{}) []interface{} {
+	toDeleteMap := map[interface{}]interface{}{}
+	processed := make([]interface{}, 0, len(current))
+	for _, v := range toDelete {
+		toDeleteMap[v] = true
+	}
+	for _, v := range current {
+		if _, found := toDeleteMap[v]; !found {
+			processed = append(processed, v)
+		}
+	}
+	return processed
+}
+
+// This method no longer panics if any element of the slice is not a map.
+func findMapInSliceBasedOnKeyValue(m []interface{}, key string, value interface{}) (map[string]interface{}, int, bool, error) {
+	for k, v := range m {
+		typedV, ok := v.(map[string]interface{})
+		if !ok {
+			return nil, 0, false, fmt.Errorf("value for key %v is not a map", k)
+		}
+
+		valueToMatch, ok := typedV[key]
+		if ok && valueToMatch == value {
+			return typedV, k, true, nil
+		}
+	}
+
+	return nil, 0, false, nil
+}
+
+// This function takes a JSON map and sorts all the lists that should be merged
+// by key. This is needed by tests because in JSON, list order is significant,
+// but in Strategic Merge Patch, merge lists do not have significant order.
+// Sorting the lists allows for order-insensitive comparison of patched maps.
+func sortMergeListsByName(mapJSON []byte, schema LookupPatchMeta) ([]byte, error) {
+	var m map[string]interface{}
+	err := json.Unmarshal(mapJSON, &m)
+	if err != nil {
+		return nil, mergepatch.ErrBadJSONDoc
+	}
+
+	newM, err := sortMergeListsByNameMap(m, schema)
+	if err != nil {
+		return nil, err
+	}
+
+	return json.Marshal(newM)
+}
+
+// Function sortMergeListsByNameMap recursively sorts the merge lists by its mergeKey in a map.
+func sortMergeListsByNameMap(s map[string]interface{}, schema LookupPatchMeta) (map[string]interface{}, error) {
+	newS := map[string]interface{}{}
+	for k, v := range s {
+		if k == retainKeysDirective {
+			typedV, ok := v.([]interface{})
+			if !ok {
+				return nil, mergepatch.ErrBadPatchFormatForRetainKeys
+			}
+			v = sortScalars(typedV)
+		} else if strings.HasPrefix(k, deleteFromPrimitiveListDirectivePrefix) {
+			typedV, ok := v.([]interface{})
+			if !ok {
+				return nil, mergepatch.ErrBadPatchFormatForPrimitiveList
+			}
+			v = sortScalars(typedV)
+		} else if strings.HasPrefix(k, setElementOrderDirectivePrefix) {
+			_, ok := v.([]interface{})
+			if !ok {
+				return nil, mergepatch.ErrBadPatchFormatForSetElementOrderList
+			}
+		} else if k != directiveMarker {
+			// recurse for map and slice.
+			switch typedV := v.(type) {
+			case map[string]interface{}:
+				subschema, _, err := schema.LookupPatchMetadataForStruct(k)
+				if err != nil {
+					return nil, err
+				}
+				v, err = sortMergeListsByNameMap(typedV, subschema)
+				if err != nil {
+					return nil, err
+				}
+			case []interface{}:
+				subschema, patchMeta, err := schema.LookupPatchMetadataForSlice(k)
+				if err != nil {
+					return nil, err
+				}
+				_, patchStrategy, err := extractRetainKeysPatchStrategy(patchMeta.GetPatchStrategies())
+				if err != nil {
+					return nil, err
+				}
+				if patchStrategy == mergeDirective {
+					var err error
+					v, err = sortMergeListsByNameArray(typedV, subschema, patchMeta.GetPatchMergeKey(), true)
+					if err != nil {
+						return nil, err
+					}
+				}
+			}
+		}
+
+		newS[k] = v
+	}
+
+	return newS, nil
+}
+
+// Function sortMergeListsByNameMap recursively sorts the merge lists by its mergeKey in an array.
+func sortMergeListsByNameArray(s []interface{}, schema LookupPatchMeta, mergeKey string, recurse bool) ([]interface{}, error) {
+	if len(s) == 0 {
+		return s, nil
+	}
+
+	// We don't support lists of lists yet.
+	t, err := sliceElementType(s)
+	if err != nil {
+		return nil, err
+	}
+
+	// If the elements are not maps...
+	if t.Kind() != reflect.Map {
+		// Sort the elements, because they may have been merged out of order.
+		return deduplicateAndSortScalars(s), nil
+	}
+
+	// Elements are maps - if one of the keys of the map is a map or a
+	// list, we may need to recurse into it.
+	newS := []interface{}{}
+	for _, elem := range s {
+		if recurse {
+			typedElem := elem.(map[string]interface{})
+			newElem, err := sortMergeListsByNameMap(typedElem, schema)
+			if err != nil {
+				return nil, err
+			}
+
+			newS = append(newS, newElem)
+		} else {
+			newS = append(newS, elem)
+		}
+	}
+
+	// Sort the maps.
+	newS = sortMapsBasedOnField(newS, mergeKey)
+	return newS, nil
+}
+
+func sortMapsBasedOnField(m []interface{}, fieldName string) []interface{} {
+	mapM := mapSliceFromSlice(m)
+	ss := SortableSliceOfMaps{mapM, fieldName}
+	sort.Sort(ss)
+	newS := sliceFromMapSlice(ss.s)
+	return newS
+}
+
+func mapSliceFromSlice(m []interface{}) []map[string]interface{} {
+	newM := []map[string]interface{}{}
+	for _, v := range m {
+		vt := v.(map[string]interface{})
+		newM = append(newM, vt)
+	}
+
+	return newM
+}
+
+func sliceFromMapSlice(s []map[string]interface{}) []interface{} {
+	newS := []interface{}{}
+	for _, v := range s {
+		newS = append(newS, v)
+	}
+
+	return newS
+}
+
+type SortableSliceOfMaps struct {
+	s []map[string]interface{}
+	k string // key to sort on
+}
+
+func (ss SortableSliceOfMaps) Len() int {
+	return len(ss.s)
+}
+
+func (ss SortableSliceOfMaps) Less(i, j int) bool {
+	iStr := fmt.Sprintf("%v", ss.s[i][ss.k])
+	jStr := fmt.Sprintf("%v", ss.s[j][ss.k])
+	return sort.StringsAreSorted([]string{iStr, jStr})
+}
+
+func (ss SortableSliceOfMaps) Swap(i, j int) {
+	ss.s[i], ss.s[j] = ss.s[j], ss.s[i]
+}
+
+func deduplicateAndSortScalars(s []interface{}) []interface{} {
+	s = deduplicateScalars(s)
+	return sortScalars(s)
+}
+
+func sortScalars(s []interface{}) []interface{} {
+	ss := SortableSliceOfScalars{s}
+	sort.Sort(ss)
+	return ss.s
+}
+
+func deduplicateScalars(s []interface{}) []interface{} {
+	// Clever algorithm to deduplicate.
+	length := len(s) - 1
+	for i := 0; i < length; i++ {
+		for j := i + 1; j <= length; j++ {
+			if s[i] == s[j] {
+				s[j] = s[length]
+				s = s[0:length]
+				length--
+				j--
+			}
+		}
+	}
+
+	return s
+}
+
+type SortableSliceOfScalars struct {
+	s []interface{}
+}
+
+func (ss SortableSliceOfScalars) Len() int {
+	return len(ss.s)
+}
+
+func (ss SortableSliceOfScalars) Less(i, j int) bool {
+	iStr := fmt.Sprintf("%v", ss.s[i])
+	jStr := fmt.Sprintf("%v", ss.s[j])
+	return sort.StringsAreSorted([]string{iStr, jStr})
+}
+
+func (ss SortableSliceOfScalars) Swap(i, j int) {
+	ss.s[i], ss.s[j] = ss.s[j], ss.s[i]
+}
+
+// Returns the type of the elements of N slice(s). If the type is different,
+// another slice or undefined, returns an error.
+func sliceElementType(slices ...[]interface{}) (reflect.Type, error) {
+	var prevType reflect.Type
+	for _, s := range slices {
+		// Go through elements of all given slices and make sure they are all the same type.
+		for _, v := range s {
+			currentType := reflect.TypeOf(v)
+			if prevType == nil {
+				prevType = currentType
+				// We don't support lists of lists yet.
+				if prevType.Kind() == reflect.Slice {
+					return nil, mergepatch.ErrNoListOfLists
+				}
+			} else {
+				if prevType != currentType {
+					return nil, fmt.Errorf("list element types are not identical: %v", fmt.Sprint(slices))
+				}
+				prevType = currentType
+			}
+		}
+	}
+
+	if prevType == nil {
+		return nil, fmt.Errorf("no elements in any of the given slices")
+	}
+
+	return prevType, nil
+}
+
+// MergingMapsHaveConflicts returns true if the left and right JSON interface
+// objects overlap with different values in any key. All keys are required to be
+// strings. Since patches of the same Type have congruent keys, this is valid
+// for multiple patch types. This method supports strategic merge patch semantics.
+func MergingMapsHaveConflicts(left, right map[string]interface{}, schema LookupPatchMeta) (bool, error) {
+	return mergingMapFieldsHaveConflicts(left, right, schema, "", "")
+}
+
+func mergingMapFieldsHaveConflicts(
+	left, right interface{},
+	schema LookupPatchMeta,
+	fieldPatchStrategy, fieldPatchMergeKey string,
+) (bool, error) {
+	switch leftType := left.(type) {
+	case map[string]interface{}:
+		rightType, ok := right.(map[string]interface{})
+		if !ok {
+			return true, nil
+		}
+		leftMarker, okLeft := leftType[directiveMarker]
+		rightMarker, okRight := rightType[directiveMarker]
+		// if one or the other has a directive marker,
+		// then we need to consider that before looking at the individual keys,
+		// since a directive operates on the whole map.
+		if okLeft || okRight {
+			// if one has a directive marker and the other doesn't,
+			// then we have a conflict, since one is deleting or replacing the whole map,
+			// and the other is doing things to individual keys.
+			if okLeft != okRight {
+				return true, nil
+			}
+			// if they both have markers, but they are not the same directive,
+			// then we have a conflict because they're doing different things to the map.
+			if leftMarker != rightMarker {
+				return true, nil
+			}
+		}
+		if fieldPatchStrategy == replaceDirective {
+			return false, nil
+		}
+		// Check the individual keys.
+		return mapsHaveConflicts(leftType, rightType, schema)
+
+	case []interface{}:
+		rightType, ok := right.([]interface{})
+		if !ok {
+			return true, nil
+		}
+		return slicesHaveConflicts(leftType, rightType, schema, fieldPatchStrategy, fieldPatchMergeKey)
+	case string, float64, bool, int64, nil:
+		return !reflect.DeepEqual(left, right), nil
+	default:
+		return true, fmt.Errorf("unknown type: %v", reflect.TypeOf(left))
+	}
+}
+
+func mapsHaveConflicts(typedLeft, typedRight map[string]interface{}, schema LookupPatchMeta) (bool, error) {
+	for key, leftValue := range typedLeft {
+		if key != directiveMarker && key != retainKeysDirective {
+			if rightValue, ok := typedRight[key]; ok {
+				var subschema LookupPatchMeta
+				var patchMeta PatchMeta
+				var patchStrategy string
+				var err error
+				switch leftValue.(type) {
+				case []interface{}:
+					subschema, patchMeta, err = schema.LookupPatchMetadataForSlice(key)
+					if err != nil {
+						return true, err
+					}
+					_, patchStrategy, err = extractRetainKeysPatchStrategy(patchMeta.patchStrategies)
+					if err != nil {
+						return true, err
+					}
+				case map[string]interface{}:
+					subschema, patchMeta, err = schema.LookupPatchMetadataForStruct(key)
+					if err != nil {
+						return true, err
+					}
+					_, patchStrategy, err = extractRetainKeysPatchStrategy(patchMeta.patchStrategies)
+					if err != nil {
+						return true, err
+					}
+				}
+
+				if hasConflicts, err := mergingMapFieldsHaveConflicts(leftValue, rightValue,
+					subschema, patchStrategy, patchMeta.GetPatchMergeKey()); hasConflicts {
+					return true, err
+				}
+			}
+		}
+	}
+
+	return false, nil
+}
+
+func slicesHaveConflicts(
+	typedLeft, typedRight []interface{},
+	schema LookupPatchMeta,
+	fieldPatchStrategy, fieldPatchMergeKey string,
+) (bool, error) {
+	elementType, err := sliceElementType(typedLeft, typedRight)
+	if err != nil {
+		return true, err
+	}
+
+	if fieldPatchStrategy == mergeDirective {
+		// Merging lists of scalars have no conflicts by definition
+		// So we only need to check further if the elements are maps
+		if elementType.Kind() != reflect.Map {
+			return false, nil
+		}
+
+		// Build a map for each slice and then compare the two maps
+		leftMap, err := sliceOfMapsToMapOfMaps(typedLeft, fieldPatchMergeKey)
+		if err != nil {
+			return true, err
+		}
+
+		rightMap, err := sliceOfMapsToMapOfMaps(typedRight, fieldPatchMergeKey)
+		if err != nil {
+			return true, err
+		}
+
+		return mapsOfMapsHaveConflicts(leftMap, rightMap, schema)
+	}
+
+	// Either we don't have type information, or these are non-merging lists
+	if len(typedLeft) != len(typedRight) {
+		return true, nil
+	}
+
+	// Sort scalar slices to prevent ordering issues
+	// We have no way to sort non-merging lists of maps
+	if elementType.Kind() != reflect.Map {
+		typedLeft = deduplicateAndSortScalars(typedLeft)
+		typedRight = deduplicateAndSortScalars(typedRight)
+	}
+
+	// Compare the slices element by element in order
+	// This test will fail if the slices are not sorted
+	for i := range typedLeft {
+		if hasConflicts, err := mergingMapFieldsHaveConflicts(typedLeft[i], typedRight[i], schema, "", ""); hasConflicts {
+			return true, err
+		}
+	}
+
+	return false, nil
+}
+
+func sliceOfMapsToMapOfMaps(slice []interface{}, mergeKey string) (map[string]interface{}, error) {
+	result := make(map[string]interface{}, len(slice))
+	for _, value := range slice {
+		typedValue, ok := value.(map[string]interface{})
+		if !ok {
+			return nil, fmt.Errorf("invalid element type in merging list:%v", slice)
+		}
+
+		mergeValue, ok := typedValue[mergeKey]
+		if !ok {
+			return nil, fmt.Errorf("cannot find merge key `%s` in merging list element:%v", mergeKey, typedValue)
+		}
+
+		result[fmt.Sprintf("%s", mergeValue)] = typedValue
+	}
+
+	return result, nil
+}
+
+func mapsOfMapsHaveConflicts(typedLeft, typedRight map[string]interface{}, schema LookupPatchMeta) (bool, error) {
+	for key, leftValue := range typedLeft {
+		if rightValue, ok := typedRight[key]; ok {
+			if hasConflicts, err := mergingMapFieldsHaveConflicts(leftValue, rightValue, schema, "", ""); hasConflicts {
+				return true, err
+			}
+		}
+	}
+
+	return false, nil
+}
+
+// CreateThreeWayMergePatch reconciles a modified configuration with an original configuration,
+// while preserving any changes or deletions made to the original configuration in the interim,
+// and not overridden by the current configuration. All three documents must be passed to the
+// method as json encoded content. It will return a strategic merge patch, or an error if any
+// of the documents is invalid, or if there are any preconditions that fail against the modified
+// configuration, or, if overwrite is false and there are conflicts between the modified and current
+// configurations. Conflicts are defined as keys changed differently from original to modified
+// than from original to current. In other words, a conflict occurs if modified changes any key
+// in a way that is different from how it is changed in current (e.g., deleting it, changing its
+// value). We also propagate values fields that do not exist in original but are explicitly
+// defined in modified.
+func CreateThreeWayMergePatch(original, modified, current []byte, schema LookupPatchMeta, overwrite bool, fns ...mergepatch.PreconditionFunc) ([]byte, error) {
+	originalMap := map[string]interface{}{}
+	if len(original) > 0 {
+		if err := json.Unmarshal(original, &originalMap); err != nil {
+			return nil, mergepatch.ErrBadJSONDoc
+		}
+	}
+
+	modifiedMap := map[string]interface{}{}
+	if len(modified) > 0 {
+		if err := json.Unmarshal(modified, &modifiedMap); err != nil {
+			return nil, mergepatch.ErrBadJSONDoc
+		}
+	}
+
+	currentMap := map[string]interface{}{}
+	if len(current) > 0 {
+		if err := json.Unmarshal(current, &currentMap); err != nil {
+			return nil, mergepatch.ErrBadJSONDoc
+		}
+	}
+
+	// The patch is the difference from current to modified without deletions, plus deletions
+	// from original to modified. To find it, we compute deletions, which are the deletions from
+	// original to modified, and delta, which is the difference from current to modified without
+	// deletions, and then apply delta to deletions as a patch, which should be strictly additive.
+	deltaMapDiffOptions := DiffOptions{
+		IgnoreDeletions: true,
+		SetElementOrder: true,
+	}
+	deltaMap, err := diffMaps(currentMap, modifiedMap, schema, deltaMapDiffOptions)
+	if err != nil {
+		return nil, err
+	}
+	deletionsMapDiffOptions := DiffOptions{
+		SetElementOrder:           true,
+		IgnoreChangesAndAdditions: true,
+	}
+	deletionsMap, err := diffMaps(originalMap, modifiedMap, schema, deletionsMapDiffOptions)
+	if err != nil {
+		return nil, err
+	}
+
+	mergeOptions := MergeOptions{}
+	patchMap, err := mergeMap(deletionsMap, deltaMap, schema, mergeOptions)
+	if err != nil {
+		return nil, err
+	}
+
+	// Apply the preconditions to the patch, and return an error if any of them fail.
+	for _, fn := range fns {
+		if !fn(patchMap) {
+			return nil, mergepatch.NewErrPreconditionFailed(patchMap)
+		}
+	}
+
+	// If overwrite is false, and the patch contains any keys that were changed differently,
+	// then return a conflict error.
+	if !overwrite {
+		changeMapDiffOptions := DiffOptions{}
+		changedMap, err := diffMaps(originalMap, currentMap, schema, changeMapDiffOptions)
+		if err != nil {
+			return nil, err
+		}
+
+		hasConflicts, err := MergingMapsHaveConflicts(patchMap, changedMap, schema)
+		if err != nil {
+			return nil, err
+		}
+
+		if hasConflicts {
+			return nil, mergepatch.NewErrConflict(mergepatch.ToYAMLOrError(patchMap), mergepatch.ToYAMLOrError(changedMap))
+		}
+	}
+
+	return json.Marshal(patchMap)
+}
+
+func ItemAddedToModifiedSlice(original, modified string) bool { return original > modified }
+
+func ItemRemovedFromModifiedSlice(original, modified string) bool { return original < modified }
+
+func ItemMatchesOriginalAndModifiedSlice(original, modified string) bool { return original == modified }
+
+func CreateDeleteDirective(mergeKey string, mergeKeyValue interface{}) map[string]interface{} {
+	return map[string]interface{}{mergeKey: mergeKeyValue, directiveMarker: deleteDirective}
+}
+
+func mapTypeAssertion(original, patch interface{}) (map[string]interface{}, map[string]interface{}, error) {
+	typedOriginal, ok := original.(map[string]interface{})
+	if !ok {
+		return nil, nil, mergepatch.ErrBadArgType(typedOriginal, original)
+	}
+	typedPatch, ok := patch.(map[string]interface{})
+	if !ok {
+		return nil, nil, mergepatch.ErrBadArgType(typedPatch, patch)
+	}
+	return typedOriginal, typedPatch, nil
+}
+
+func sliceTypeAssertion(original, patch interface{}) ([]interface{}, []interface{}, error) {
+	typedOriginal, ok := original.([]interface{})
+	if !ok {
+		return nil, nil, mergepatch.ErrBadArgType(typedOriginal, original)
+	}
+	typedPatch, ok := patch.([]interface{})
+	if !ok {
+		return nil, nil, mergepatch.ErrBadArgType(typedPatch, patch)
+	}
+	return typedOriginal, typedPatch, nil
+}
+
+// extractRetainKeysPatchStrategy process patch strategy, which is a string may contains multiple
+// patch strategies separated by ",". It returns a boolean var indicating if it has
+// retainKeys strategies and a string for the other strategy.
+func extractRetainKeysPatchStrategy(strategies []string) (bool, string, error) {
+	switch len(strategies) {
+	case 0:
+		return false, "", nil
+	case 1:
+		singleStrategy := strategies[0]
+		switch singleStrategy {
+		case retainKeysStrategy:
+			return true, "", nil
+		default:
+			return false, singleStrategy, nil
+		}
+	case 2:
+		switch {
+		case strategies[0] == retainKeysStrategy:
+			return true, strategies[1], nil
+		case strategies[1] == retainKeysStrategy:
+			return true, strategies[0], nil
+		default:
+			return false, "", fmt.Errorf("unexpected patch strategy: %v", strategies)
+		}
+	default:
+		return false, "", fmt.Errorf("unexpected patch strategy: %v", strategies)
+	}
+}
+
+// hasAdditionalNewField returns if original map has additional key with non-nil value than modified.
+func hasAdditionalNewField(original, modified map[string]interface{}) bool {
+	for k, v := range original {
+		if v == nil {
+			continue
+		}
+		if _, found := modified[k]; !found {
+			return true
+		}
+	}
+	return false
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/patch_test.go b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/patch_test.go
new file mode 100644
index 0000000000..fe88937c57
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/patch_test.go
@@ -0,0 +1,7061 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package strategicpatch
+
+import (
+	"fmt"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"sigs.k8s.io/yaml"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/json"
+	"k8s.io/apimachinery/pkg/util/mergepatch"
+	"k8s.io/apimachinery/pkg/util/sets"
+	sptest "k8s.io/apimachinery/pkg/util/strategicpatch/testing"
+	"k8s.io/utils/dump"
+)
+
+var (
+	fakeMergeItemSchema     = sptest.Fake{Path: filepath.Join("testdata", "swagger-merge-item.json")}
+	fakePrecisionItemSchema = sptest.Fake{Path: filepath.Join("testdata", "swagger-precision-item.json")}
+
+	fakeMergeItemV3Schema     = sptest.OpenAPIV3Getter{Path: filepath.Join("testdata", "swagger-merge-item-v3.json")}
+	fakePrecisionItemV3Schema = sptest.OpenAPIV3Getter{Path: filepath.Join("testdata", "swagger-precision-item-v3.json")}
+)
+
+type SortMergeListTestCases struct {
+	TestCases []SortMergeListTestCase
+}
+
+type SortMergeListTestCase struct {
+	Description string
+	Original    map[string]interface{}
+	Sorted      map[string]interface{}
+}
+
+type StrategicMergePatchTestCases struct {
+	TestCases []StrategicMergePatchTestCase
+}
+
+type StrategicMergePatchTestCase struct {
+	Description string
+	StrategicMergePatchTestCaseData
+}
+
+type StrategicMergePatchRawTestCase struct {
+	Description string
+	StrategicMergePatchRawTestCaseData
+}
+
+type StrategicMergePatchTestCaseData struct {
+	// Original is the original object (last-applied config in annotation)
+	Original map[string]interface{}
+	// Modified is the modified object (new config we want)
+	Modified map[string]interface{}
+	// Current is the current object (live config in the server)
+	Current map[string]interface{}
+	// TwoWay is the expected two-way merge patch diff between original and modified
+	TwoWay map[string]interface{}
+	// ThreeWay is the expected three-way merge patch
+	ThreeWay map[string]interface{}
+	// Result is the expected object after applying the three-way patch on current object.
+	Result map[string]interface{}
+	// TwoWayResult is the expected object after applying the two-way patch on current object.
+	// If nil, Modified is used.
+	TwoWayResult map[string]interface{}
+}
+
+// The meaning of each field is the same as StrategicMergePatchTestCaseData's.
+// The difference is that all the fields in StrategicMergePatchRawTestCaseData are json-encoded data.
+type StrategicMergePatchRawTestCaseData struct {
+	Original      []byte
+	Modified      []byte
+	Current       []byte
+	TwoWay        []byte
+	ThreeWay      []byte
+	Result        []byte
+	TwoWayResult  []byte
+	ExpectedError string
+}
+
+type MergeItem struct {
+	Name                  string               `json:"name,omitempty"`
+	Value                 string               `json:"value,omitempty"`
+	Other                 string               `json:"other,omitempty"`
+	MergingList           []MergeItem          `json:"mergingList,omitempty" patchStrategy:"merge" patchMergeKey:"name"`
+	NonMergingList        []MergeItem          `json:"nonMergingList,omitempty"`
+	MergingIntList        []int                `json:"mergingIntList,omitempty" patchStrategy:"merge"`
+	NonMergingIntList     []int                `json:"nonMergingIntList,omitempty"`
+	MergeItemPtr          *MergeItem           `json:"mergeItemPtr,omitempty" patchStrategy:"merge" patchMergeKey:"name"`
+	SimpleMap             map[string]string    `json:"simpleMap,omitempty"`
+	ReplacingItem         runtime.RawExtension `json:"replacingItem,omitempty" patchStrategy:"replace"`
+	JSONItem              struct{ Raw []byte } `json:"jsonItem,omitempty"`
+	RetainKeysMap         RetainKeysMergeItem  `json:"retainKeysMap,omitempty" patchStrategy:"retainKeys"`
+	RetainKeysMergingList []MergeItem          `json:"retainKeysMergingList,omitempty" patchStrategy:"merge,retainKeys" patchMergeKey:"name"`
+}
+
+type RetainKeysMergeItem struct {
+	Name           string            `json:"name,omitempty"`
+	Value          string            `json:"value,omitempty"`
+	Other          string            `json:"other,omitempty"`
+	SimpleMap      map[string]string `json:"simpleMap,omitempty"`
+	MergingIntList []int             `json:"mergingIntList,omitempty" patchStrategy:"merge"`
+	MergingList    []MergeItem       `json:"mergingList,omitempty" patchStrategy:"merge" patchMergeKey:"name"`
+	NonMergingList []MergeItem       `json:"nonMergingList,omitempty"`
+}
+
+var (
+	mergeItem             MergeItem
+	mergeItemStructSchema = PatchMetaFromStruct{T: GetTagStructTypeOrDie(mergeItem)}
+)
+
+// These are test cases for SortMergeList, used to assert that it (recursively)
+// sorts both merging and non merging lists correctly.
+var sortMergeListTestCaseData = []byte(`
+testCases:
+  - description: sort one list of maps
+    original:
+      mergingList:
+        - name: 1
+        - name: 3
+        - name: 2
+    sorted:
+      mergingList:
+        - name: 1
+        - name: 2
+        - name: 3
+  - description: sort lists of maps but not nested lists of maps
+    original:
+      mergingList:
+        - name: 2
+          nonMergingList:
+            - name: 1
+            - name: 3
+            - name: 2
+        - name: 1
+          nonMergingList:
+            - name: 2
+            - name: 1
+    sorted:
+      mergingList:
+        - name: 1
+          nonMergingList:
+            - name: 2
+            - name: 1
+        - name: 2
+          nonMergingList:
+            - name: 1
+            - name: 3
+            - name: 2
+  - description: sort lists of maps and nested lists of maps
+    original:
+      mergingList:
+        - name: 2
+          mergingList:
+            - name: 1
+            - name: 3
+            - name: 2
+        - name: 1
+          mergingList:
+            - name: 2
+            - name: 1
+    sorted:
+      mergingList:
+        - name: 1
+          mergingList:
+            - name: 1
+            - name: 2
+        - name: 2
+          mergingList:
+            - name: 1
+            - name: 2
+            - name: 3
+  - description: merging list should NOT sort when nested in non merging list
+    original:
+      nonMergingList:
+        - name: 2
+          mergingList:
+            - name: 1
+            - name: 3
+            - name: 2
+        - name: 1
+          mergingList:
+            - name: 2
+            - name: 1
+    sorted:
+      nonMergingList:
+        - name: 2
+          mergingList:
+            - name: 1
+            - name: 3
+            - name: 2
+        - name: 1
+          mergingList:
+            - name: 2
+            - name: 1
+  - description: sort very nested list of maps
+    fieldTypes:
+    original:
+      mergingList:
+        - mergingList:
+            - mergingList:
+                - name: 2
+                - name: 1
+    sorted:
+      mergingList:
+        - mergingList:
+            - mergingList:
+                - name: 1
+                - name: 2
+  - description: sort nested lists of ints
+    original:
+      mergingList:
+        - name: 2
+          mergingIntList:
+            - 1
+            - 3
+            - 2
+        - name: 1
+          mergingIntList:
+            - 2
+            - 1
+    sorted:
+      mergingList:
+        - name: 1
+          mergingIntList:
+            - 1
+            - 2
+        - name: 2
+          mergingIntList:
+            - 1
+            - 2
+            - 3
+  - description: sort nested pointers of ints
+    original:
+      mergeItemPtr:
+        - name: 2
+          mergingIntList:
+            - 1
+            - 3
+            - 2
+        - name: 1
+          mergingIntList:
+            - 2
+            - 1
+    sorted:
+      mergeItemPtr:
+        - name: 1
+          mergingIntList:
+            - 1
+            - 2
+        - name: 2
+          mergingIntList:
+            - 1
+            - 2
+            - 3
+  - description: sort merging list by pointer
+    original:
+      mergeItemPtr:
+        - name: 1
+        - name: 3
+        - name: 2
+    sorted:
+      mergeItemPtr:
+        - name: 1
+        - name: 2
+        - name: 3
+`)
+
+func TestSortMergeLists(t *testing.T) {
+	mergeItemOpenapiSchema := PatchMetaFromOpenAPI{
+		Schema: sptest.GetSchemaOrDie(&fakeMergeItemSchema, "mergeItem"),
+	}
+	mergeItemOpenapiV3Schema := PatchMetaFromOpenAPIV3{
+		SchemaList: fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas,
+		Schema:     fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas["mergeItem"],
+	}
+	schemas := []LookupPatchMeta{
+		mergeItemStructSchema,
+		mergeItemOpenapiSchema,
+		mergeItemOpenapiV3Schema,
+	}
+
+	tc := SortMergeListTestCases{}
+	err := yaml.Unmarshal(sortMergeListTestCaseData, &tc)
+	if err != nil {
+		t.Errorf("can't unmarshal test cases: %s\n", err)
+		return
+	}
+
+	for _, schema := range schemas {
+		for _, c := range tc.TestCases {
+			temp := testObjectToJSONOrFail(t, c.Original)
+			got := sortJsonOrFail(t, temp, c.Description, schema)
+			expected := testObjectToJSONOrFail(t, c.Sorted)
+			if !reflect.DeepEqual(got, expected) {
+				t.Errorf("using %s error in test case: %s\ncannot sort object:\n%s\nexpected:\n%s\ngot:\n%s\n",
+					getSchemaType(schema), c.Description, mergepatch.ToYAMLOrError(c.Original), mergepatch.ToYAMLOrError(c.Sorted), jsonToYAMLOrError(got))
+			}
+		}
+	}
+}
+
+// These are test cases for StrategicMergePatch that cannot be generated using
+// CreateTwoWayMergePatch because it may be one of the following cases:
+// - not use the replace directive.
+// - generate duplicate integers for a merging list patch.
+// - generate empty merging lists.
+// - use patch format from an old client.
+var customStrategicMergePatchTestCaseData = []byte(`
+testCases:
+  - description: unique scalars when merging lists
+    original:
+      mergingIntList:
+        - 1
+        - 2
+    twoWay:
+      mergingIntList:
+        - 2
+        - 3
+    modified:
+      mergingIntList:
+        - 1
+        - 2
+        - 3
+  - description: delete map from nested map
+    original:
+      simpleMap:
+        key1: 1
+        key2: 1
+    twoWay:
+      simpleMap:
+        $patch: delete
+    modified:
+      simpleMap:
+        {}
+  - description: delete all items from merging list
+    original:
+      mergingList:
+        - name: 1
+        - name: 2
+    twoWay:
+      mergingList:
+        - $patch: replace
+    modified:
+      mergingList: []
+  - description: merge empty merging lists
+    original:
+      mergingList: []
+    twoWay:
+      mergingList: []
+    modified:
+      mergingList: []
+  - description: delete all keys from map
+    original:
+      name: 1
+      value: 1
+    twoWay:
+      $patch: replace
+    modified: {}
+  - description: add key and delete all keys from map
+    original:
+      name: 1
+      value: 1
+    twoWay:
+      other: a
+      $patch: replace
+    modified:
+      other: a
+  - description: delete all duplicate entries in a merging list
+    original:
+      mergingList:
+        - name: 1
+        - name: 1
+        - name: 2
+          value: a
+        - name: 3
+        - name: 3
+    twoWay:
+      mergingList:
+        - name: 1
+          $patch: delete
+        - name: 3
+          $patch: delete
+    modified:
+      mergingList:
+        - name: 2
+          value: a
+  - description: retainKeys map can add a field when no retainKeys directive present
+    original:
+      retainKeysMap:
+        name: foo
+    twoWay:
+      retainKeysMap:
+        value: bar
+    modified:
+      retainKeysMap:
+        name: foo
+        value: bar
+  - description: retainKeys map can change a field when no retainKeys directive present
+    original:
+      retainKeysMap:
+        name: foo
+        value: a
+    twoWay:
+      retainKeysMap:
+        value: b
+    modified:
+      retainKeysMap:
+        name: foo
+        value: b
+  - description: retainKeys map can delete a field when no retainKeys directive present
+    original:
+      retainKeysMap:
+        name: foo
+        value: a
+    twoWay:
+      retainKeysMap:
+        value: null
+    modified:
+      retainKeysMap:
+        name: foo
+  - description: retainKeys map merge an empty map
+    original:
+      retainKeysMap:
+        name: foo
+        value: a
+    twoWay:
+      retainKeysMap: {}
+    modified:
+      retainKeysMap:
+        name: foo
+        value: a
+  - description: retainKeys list can add a field when no retainKeys directive present
+    original:
+      retainKeysMergingList:
+      - name: bar
+      - name: foo
+    twoWay:
+      retainKeysMergingList:
+      - name: foo
+        value: a
+    modified:
+      retainKeysMergingList:
+      - name: bar
+      - name: foo
+        value: a
+  - description: retainKeys list can change a field when no retainKeys directive present
+    original:
+      retainKeysMergingList:
+      - name: bar
+      - name: foo
+        value: a
+    twoWay:
+      retainKeysMergingList:
+      - name: foo
+        value: b
+    modified:
+      retainKeysMergingList:
+      - name: bar
+      - name: foo
+        value: b
+  - description: retainKeys list can delete a field when no retainKeys directive present
+    original:
+      retainKeysMergingList:
+      - name: bar
+      - name: foo
+        value: a
+    twoWay:
+      retainKeysMergingList:
+      - name: foo
+        value: null
+    modified:
+      retainKeysMergingList:
+      - name: bar
+      - name: foo
+  - description: preserve the order from the patch in a merging list
+    original:
+      mergingList:
+        - name: 1
+        - name: 2
+          value: b
+        - name: 3
+    twoWay:
+      mergingList:
+        - name: 3
+          value: c
+        - name: 1
+          value: a
+        - name: 2
+          other: x
+    modified:
+      mergingList:
+        - name: 3
+          value: c
+        - name: 1
+          value: a
+        - name: 2
+          value: b
+          other: x
+  - description: preserve the order from the patch in a merging list 2
+    original:
+      mergingList:
+        - name: 1
+        - name: 2
+          value: b
+        - name: 3
+    twoWay:
+      mergingList:
+        - name: 3
+          value: c
+        - name: 1
+          value: a
+    modified:
+      mergingList:
+        - name: 2
+          value: b
+        - name: 3
+          value: c
+        - name: 1
+          value: a
+  - description: preserve the order from the patch in a merging int list
+    original:
+      mergingIntList:
+        - 1
+        - 2
+        - 3
+    twoWay:
+      mergingIntList:
+        - 3
+        - 1
+        - 2
+    modified:
+      mergingIntList:
+        - 3
+        - 1
+        - 2
+  - description: preserve the order from the patch in a merging int list
+    original:
+      mergingIntList:
+        - 1
+        - 2
+        - 3
+    twoWay:
+      mergingIntList:
+        - 3
+        - 1
+    modified:
+      mergingIntList:
+        - 2
+        - 3
+        - 1
+`)
+
+var customStrategicMergePatchRawTestCases = []StrategicMergePatchRawTestCase{
+	{
+		Description: "$setElementOrder contains item that is not present in the list to be merged",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 3
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 3
+  - name: 2
+  - name: 1
+mergingList:
+  - name: 3
+    value: 3
+  - name: 1
+    value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 3
+    value: 3
+  - name: 1
+    value: 1
+`),
+		},
+	},
+	{
+		Description: "$setElementOrder contains item that is not present in the int list to be merged",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 3
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 3
+  - 2
+  - 1
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 3
+  - 1
+`),
+		},
+	},
+	{
+		Description: "should check if order in $setElementOrder and patch list match",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 3
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 3
+    value: 3
+  - name: 1
+    value: 1
+`),
+			ExpectedError: "doesn't match",
+		},
+	},
+	{
+		Description: "$setElementOrder contains item that is not present in the int list to be merged",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 3
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+  - 3
+mergingIntList:
+  - 3
+  - 1
+`),
+			ExpectedError: "doesn't match",
+		},
+	},
+	{
+		Description: "missing merge key should error out",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: a
+`),
+			TwoWay: []byte(`
+mergingList:
+  - value: b
+`),
+			ExpectedError: "does not contain declared merge key",
+		},
+	},
+	{
+		Description: "$deleteFromPrimitiveList of nonexistent item in primitive list should not add the item to the list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			TwoWay: []byte(`
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+		},
+	},
+	{
+		Description: "$deleteFromPrimitiveList on empty primitive list should not add the item to the list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+`),
+			TwoWay: []byte(`
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+`),
+		},
+	},
+	{
+		Description: "$deleteFromPrimitiveList on nonexistent primitive list should not add the primitive list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+foo:
+  - bar
+`),
+			TwoWay: []byte(`
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+foo:
+  - bar
+`),
+		},
+	},
+	{
+		Description: "$deleteFromPrimitiveList should delete item from a list with merge patch strategy",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			TwoWay: []byte(`
+$deleteFromPrimitiveList/mergingIntList:
+  - 2
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 1
+  - 3
+`),
+		},
+	},
+	{
+		Description: "$deleteFromPrimitiveList should delete item from a list without merge patch strategy",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+nonMergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			TwoWay: []byte(`
+$deleteFromPrimitiveList/nonMergingIntList:
+  - 2
+`),
+			Modified: []byte(`
+nonMergingIntList:
+  - 1
+  - 3
+`),
+		},
+	},
+}
+
+func TestCustomStrategicMergePatch(t *testing.T) {
+	mergeItemOpenapiSchema := PatchMetaFromOpenAPI{
+		Schema: sptest.GetSchemaOrDie(&fakeMergeItemSchema, "mergeItem"),
+	}
+	mergeItemOpenapiV3Schema := PatchMetaFromOpenAPIV3{
+		SchemaList: fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas,
+		Schema:     fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas["mergeItem"],
+	}
+	schemas := []LookupPatchMeta{
+		mergeItemStructSchema,
+		mergeItemOpenapiSchema,
+		mergeItemOpenapiV3Schema,
+	}
+
+	tc := StrategicMergePatchTestCases{}
+	err := yaml.Unmarshal(customStrategicMergePatchTestCaseData, &tc)
+	if err != nil {
+		t.Errorf("can't unmarshal test cases: %v\n", err)
+		return
+	}
+
+	for _, c := range tc.TestCases {
+		t.Run(c.Description, func(t *testing.T) {
+			for _, schema := range schemas {
+				t.Run(schema.Name(), func(t *testing.T) {
+					original, expectedTwoWayPatch, _, expectedResult := twoWayTestCaseToJSONOrFail(t, c, schema)
+					testPatchApplication(t, original, expectedTwoWayPatch, expectedResult, c.Description, "", schema)
+				})
+
+				for _, c := range customStrategicMergePatchRawTestCases {
+					original, expectedTwoWayPatch, _, expectedResult := twoWayRawTestCaseToJSONOrFail(t, c)
+					testPatchApplication(t, original, expectedTwoWayPatch, expectedResult, c.Description, c.ExpectedError, schema)
+				}
+			}
+		})
+	}
+}
+
+// These are test cases for StrategicMergePatch, to assert that applying  a patch
+// yields the correct outcome. They are also test cases for CreateTwoWayMergePatch
+// and CreateThreeWayMergePatch, to assert that they both generate the correct patch
+// for the given set of input documents.
+var createStrategicMergePatchTestCaseData = []byte(`
+testCases:
+  - description: nil original
+    twoWay:
+      name: 1
+      value: 1
+    modified:
+      name: 1
+      value: 1
+    current:
+      name: 1
+      other: a
+    threeWay:
+      value: 1
+    result:
+      name: 1
+      value: 1
+      other: a
+  - description: nil patch
+    original:
+      name: 1
+    twoWay:
+      {}
+    modified:
+      name: 1
+    current:
+      name: 1
+    threeWay:
+      {}
+    result:
+      name: 1
+  - description: add field to map
+    original:
+      name: 1
+    twoWay:
+      value: 1
+    modified:
+      name: 1
+      value: 1
+    current:
+      name: 1
+      other: a
+    threeWay:
+      value: 1
+    result:
+      name: 1
+      value: 1
+      other: a
+  - description: add field to map with conflict
+    original:
+      name: 1
+    twoWay:
+      value: 1
+    modified:
+      name: 1
+      value: 1
+    current:
+      name: a
+      other: a
+    threeWay:
+      name: 1
+      value: 1
+    result:
+      name: 1
+      value: 1
+      other: a
+  - description: add field and delete field from map
+    original:
+      name: 1
+    twoWay:
+      name: null
+      value: 1
+    modified:
+      value: 1
+    current:
+      name: 1
+      other: a
+    threeWay:
+      name: null
+      value: 1
+    result:
+      value: 1
+      other: a
+  - description: add field and delete field from map with conflict
+    original:
+      name: 1
+    twoWay:
+      name: null
+      value: 1
+    modified:
+      value: 1
+    current:
+      name: a
+      other: a
+    threeWay:
+      name: null
+      value: 1
+    result:
+      value: 1
+      other: a
+  - description: delete field from nested map
+    original:
+      simpleMap:
+        key1: 1
+        key2: 1
+    twoWay:
+      simpleMap:
+        key2: null
+    modified:
+      simpleMap:
+        key1: 1
+    current:
+      simpleMap:
+        key1: 1
+        key2: 1
+        other: a
+    threeWay:
+      simpleMap:
+        key2: null
+    result:
+      simpleMap:
+        key1: 1
+        other: a
+  - description: delete field from nested map with conflict
+    original:
+      simpleMap:
+        key1: 1
+        key2: 1
+    twoWay:
+      simpleMap:
+        key2: null
+    modified:
+      simpleMap:
+        key1: 1
+    current:
+      simpleMap:
+        key1: a
+        key2: 1
+        other: a
+    threeWay:
+      simpleMap:
+        key1: 1
+        key2: null
+    result:
+      simpleMap:
+        key1: 1
+        other: a
+  - description: delete all fields from map
+    original:
+      name: 1
+      value: 1
+    twoWay:
+      name: null
+      value: null
+    modified: {}
+    current:
+      name: 1
+      value: 1
+      other: a
+    threeWay:
+      name: null
+      value: null
+    result:
+      other: a
+  - description: delete all fields from map with conflict
+    original:
+      name: 1
+      value: 1
+    twoWay:
+      name: null
+      value: null
+    modified: {}
+    current:
+      name: 1
+      value: a
+      other: a
+    threeWay:
+      name: null
+      value: null
+    result:
+      other: a
+  - description: add field and delete all fields from map
+    original:
+      name: 1
+      value: 1
+    twoWay:
+      name: null
+      value: null
+      other: a
+    modified:
+      other: a
+    current:
+      name: 1
+      value: 1
+      other: a
+    threeWay:
+      name: null
+      value: null
+    result:
+      other: a
+  - description: add field and delete all fields from map with conflict
+    original:
+      name: 1
+      value: 1
+    twoWay:
+      name: null
+      value: null
+      other: a
+    modified:
+      other: a
+    current:
+      name: 1
+      value: 1
+      other: b
+    threeWay:
+      name: null
+      value: null
+      other: a
+    result:
+      other: a
+  - description: replace list of scalars
+    original:
+      nonMergingIntList:
+        - 1
+        - 2
+    twoWay:
+      nonMergingIntList:
+        - 2
+        - 3
+    modified:
+      nonMergingIntList:
+        - 2
+        - 3
+    current:
+      nonMergingIntList:
+        - 1
+        - 2
+    threeWay:
+      nonMergingIntList:
+        - 2
+        - 3
+    result:
+      nonMergingIntList:
+        - 2
+        - 3
+  - description: replace list of scalars with conflict
+    original:
+      nonMergingIntList:
+        - 1
+        - 2
+    twoWay:
+      nonMergingIntList:
+        - 2
+        - 3
+    modified:
+      nonMergingIntList:
+        - 2
+        - 3
+    current:
+      nonMergingIntList:
+        - 1
+        - 4
+    threeWay:
+      nonMergingIntList:
+        - 2
+        - 3
+    result:
+      nonMergingIntList:
+        - 2
+        - 3
+  - description: delete all maps from merging list
+    original:
+      mergingList:
+        - name: 1
+        - name: 2
+    twoWay:
+      mergingList:
+        - name: 1
+          $patch: delete
+        - name: 2
+          $patch: delete
+    modified:
+      mergingList: []
+    current:
+      mergingList:
+        - name: 1
+        - name: 2
+    threeWay:
+      mergingList:
+        - name: 1
+          $patch: delete
+        - name: 2
+          $patch: delete
+    result:
+      mergingList: []
+  - description: delete all maps from merging list with conflict
+    original:
+      mergingList:
+        - name: 1
+        - name: 2
+    twoWay:
+      mergingList:
+        - name: 1
+          $patch: delete
+        - name: 2
+          $patch: delete
+    modified:
+      mergingList: []
+    current:
+      mergingList:
+        - name: 1
+          other: a
+        - name: 2
+          other: b
+    threeWay:
+      mergingList:
+        - name: 1
+          $patch: delete
+        - name: 2
+          $patch: delete
+    result:
+      mergingList: []
+  - description: delete all maps from empty merging list
+    original:
+      mergingList:
+        - name: 1
+        - name: 2
+    twoWay:
+      mergingList:
+        - name: 1
+          $patch: delete
+        - name: 2
+          $patch: delete
+    modified:
+      mergingList: []
+    current:
+      mergingList: []
+    threeWay:
+      mergingList:
+        - name: 1
+          $patch: delete
+        - name: 2
+          $patch: delete
+    result:
+      mergingList: []
+  - description: merge empty merging lists
+    original:
+      mergingList: []
+    twoWay:
+      {}
+    modified:
+      mergingList: []
+    current:
+      mergingList: []
+    threeWay:
+      {}
+    result:
+      mergingList: []
+  - description: defined null values should propagate overwrite current fields (with conflict)
+    original:
+      name: 2
+    twoWay:
+      name: 1
+      value: 1
+      other: null
+    twoWayResult:
+      name: 1
+      value: 1
+    modified:
+      name: 1
+      value: 1
+      other: null
+    current:
+      name: a
+      other: a
+    threeWay:
+      name: 1
+      value: 1
+      other: null
+    result:
+      name: 1
+      value: 1
+  - description: defined null values should propagate removing original fields
+    original:
+      name: original-name
+      value: original-value
+    current:
+      name: original-name
+      value: original-value
+      other: current-other
+    modified:
+      name: modified-name
+      value: null
+    twoWay:
+      name: modified-name
+      value: null
+    twoWayResult:
+      name: modified-name
+    threeWay:
+      name: modified-name
+      value: null
+    result:
+      name: modified-name
+      other: current-other
+  - description: nil patch with retainKeys map
+    original:
+      name: a
+      retainKeysMap:
+        name: foo
+    current:
+      name: a
+      value: b
+      retainKeysMap:
+        name: foo
+    modified:
+      name: a
+      retainKeysMap:
+        name: foo
+    twoWay: {}
+    threeWay: {}
+    result:
+      name: a
+      value: b
+      retainKeysMap:
+        name: foo
+  - description: retainKeys map with no change should not be present
+    original:
+      name: a
+      retainKeysMap:
+        name: foo
+    current:
+      name: a
+      other: c
+      retainKeysMap:
+        name: foo
+    modified:
+      name: a
+      value: b
+      retainKeysMap:
+        name: foo
+    twoWay:
+      value: b
+    threeWay:
+      value: b
+    result:
+      name: a
+      value: b
+      other: c
+      retainKeysMap:
+        name: foo
+`)
+
+var strategicMergePatchRawTestCases = []StrategicMergePatchRawTestCase{
+	{
+		Description: "nested patch merge with empty list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+name: hi
+`),
+			Current: []byte(`
+name: hi
+mergingList:
+- name: hello2
+`),
+			Modified: []byte(`
+name: hi
+mergingList:
+- name: hello
+- $patch: delete
+  name: doesntexist
+`),
+			TwoWay: []byte(`
+mergingList:
+- name: hello
+- $patch: delete
+  name: doesntexist
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+- name: hello
+- name: doesntexist
+mergingList:
+- name: hello
+`),
+			TwoWayResult: []byte(`
+name: hi
+mergingList:
+- name: hello
+`),
+			Result: []byte(`
+name: hi
+mergingList:
+- name: hello
+- name: hello2
+`),
+		},
+	},
+	{
+		Description: "delete items in lists of scalars",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 4
+`),
+		},
+	},
+	{
+		Description: "delete all duplicate items in lists of scalars",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 3
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 3
+  - 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 4
+`),
+		},
+	},
+	{
+		Description: "add and delete items in lists of scalars",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+  - 4
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+mergingIntList:
+  - 4
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 4
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+  - 4
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 4
+`),
+		},
+	},
+	{
+		Description: "merge lists of maps",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 1
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 1
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 1
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+			Result: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+  - name: 3
+    value: 3
+`),
+		},
+	},
+	{
+		Description: "merge lists of maps with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 3
+    value: 3
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 3
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+  - name: 3
+    value: 3
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 3
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+  - name: 3
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add duplicate field to map in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`{}`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add an item that already exists in current object in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: a
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 3
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: a
+  - name: 2
+  - name: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    value: a
+    other: x
+  - name: 2
+  - name: 3
+`),
+			ThreeWay: []byte(`{}`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: a
+    other: x
+  - name: 2
+  - name: 3
+`),
+		},
+	},
+	{
+		Description: "add duplicate field to map in merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 3
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 2
+    value: 2
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "replace map field value in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: a
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: a
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: a
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: a
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "replace map field value in merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: a
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    value: a
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    value: 3
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: a
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    value: a
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "delete map from merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 1
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 1
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "delete map from merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 1
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 1
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "delete missing map from merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 1
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 1
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "delete missing map from merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 1
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 3
+    other: a
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+mergingList:
+  - name: 2
+  - name: 1
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+  - name: 3
+    other: a
+`),
+		},
+	},
+	{
+		Description: "add map and delete map from merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 3
+  - name: 1
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+  - name: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    other: b
+  - name: 4
+    other: c
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 3
+  - name: 1
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    other: b
+  - name: 4
+    other: c
+  - name: 3
+`),
+		},
+	},
+	{
+		Description: "add map and delete map from merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 3
+  - name: 1
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+  - name: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 4
+    other: c
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 2
+  - name: 3
+  - name: 1
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 4
+    other: c
+  - name: 2
+  - name: 3
+`),
+		},
+	},
+	{
+		Description: "delete field from map in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "delete field from map in merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    value: a
+    other: a
+  - name: 2
+    value: 2
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+`),
+		},
+	},
+	{
+		Description: "delete missing field from map in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "delete missing field from map in merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    value: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    value: null
+  - name: 2
+    value: 2
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "replace non merging list nested in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    nonMergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    nonMergingList:
+      - name: 1
+        value: 1
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "replace non merging list nested in merging list with value conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    nonMergingList:
+      - name: 1
+        value: c
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    nonMergingList:
+      - name: 1
+        value: 1
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "replace non merging list nested in merging list with deletion conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    nonMergingList:
+      - name: 2
+        value: 2
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 1
+    nonMergingList:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    nonMergingList:
+      - name: 1
+        value: 1
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list nested in merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 1
+      - name: 2
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 1
+      - name: 2
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list nested in merging list with value conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 1
+      - name: 2
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 1
+        value: a
+        other: c
+      - name: 2
+        value: b
+        other: d
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 1
+      - name: 2
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 1
+        value: 1
+        other: c
+      - name: 2
+        value: 2
+        other: d
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list nested in merging list with deletion conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 1
+      - name: 2
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 2
+        value: 2
+        other: d
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 1
+      - name: 2
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+        other: d
+  - name: 2
+    other: b
+`),
+		},
+	},
+
+	{
+		Description: "add field to map in merging list nested in merging list with deletion conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 2
+      - name: 1
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+    mergingList:
+      - name: 2
+        value: 2
+      - name: 1
+        value: 1
+  - name: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 2
+        value: 2
+        other: d
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - $setElementOrder/mergingList:
+      - name: 2
+      - name: 1
+    name: 1
+    mergingList:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+    mergingList:
+      - name: 2
+        value: 2
+        other: d
+      - name: 1
+        value: 1
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add map to merging list by pointer",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergeItemPtr:
+  - name: 1
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - name: 2
+`),
+			Modified: []byte(`
+mergeItemPtr:
+  - name: 1
+  - name: 2
+`),
+			Current: []byte(`
+mergeItemPtr:
+  - name: 1
+    other: a
+  - name: 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - name: 2
+`),
+			Result: []byte(`
+mergeItemPtr:
+  - name: 1
+    other: a
+  - name: 2
+  - name: 3
+`),
+		},
+	},
+	{
+		Description: "add map to merging list by pointer with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergeItemPtr:
+  - name: 1
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - name: 2
+`),
+			Modified: []byte(`
+mergeItemPtr:
+  - name: 1
+  - name: 2
+`),
+			Current: []byte(`
+mergeItemPtr:
+  - name: 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - name: 1
+  - name: 2
+`),
+			Result: []byte(`
+mergeItemPtr:
+  - name: 1
+  - name: 2
+  - name: 3
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list by pointer",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergeItemPtr:
+  - name: 1
+    mergeItemPtr:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - $setElementOrder/mergeItemPtr:
+      - name: 1
+      - name: 2
+    name: 1
+    mergeItemPtr:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergeItemPtr:
+  - name: 1
+    mergeItemPtr:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			Current: []byte(`
+mergeItemPtr:
+  - name: 1
+    other: a
+    mergeItemPtr:
+      - name: 1
+        other: a
+      - name: 2
+        value: 2
+        other: b
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - $setElementOrder/mergeItemPtr:
+      - name: 1
+      - name: 2
+    name: 1
+    mergeItemPtr:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergeItemPtr:
+  - name: 1
+    other: a
+    mergeItemPtr:
+      - name: 1
+        value: 1
+        other: a
+      - name: 2
+        value: 2
+        other: b
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add field to map in merging list by pointer with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergeItemPtr:
+  - name: 1
+    mergeItemPtr:
+      - name: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - $setElementOrder/mergeItemPtr:
+      - name: 1
+      - name: 2
+    name: 1
+    mergeItemPtr:
+      - name: 1
+        value: 1
+`),
+			Modified: []byte(`
+mergeItemPtr:
+  - name: 1
+    mergeItemPtr:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+  - name: 2
+`),
+			Current: []byte(`
+mergeItemPtr:
+  - name: 1
+    other: a
+    mergeItemPtr:
+      - name: 1
+        value: a
+      - name: 2
+        value: 2
+        other: b
+  - name: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergeItemPtr:
+  - name: 1
+  - name: 2
+mergeItemPtr:
+  - $setElementOrder/mergeItemPtr:
+      - name: 1
+      - name: 2
+    name: 1
+    mergeItemPtr:
+      - name: 1
+        value: 1
+`),
+			Result: []byte(`
+mergeItemPtr:
+  - name: 1
+    other: a
+    mergeItemPtr:
+      - name: 1
+        value: 1
+      - name: 2
+        value: 2
+        other: b
+  - name: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "merge lists of scalars",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+- 1
+- 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+- 1
+- 2
+- 3
+mergingIntList:
+- 3
+`),
+			Modified: []byte(`
+mergingIntList:
+- 1
+- 2
+- 3
+`),
+			Current: []byte(`
+mergingIntList:
+- 1
+- 2
+- 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+- 1
+- 2
+- 3
+mergingIntList:
+- 3
+`),
+			Result: []byte(`
+mergingIntList:
+- 1
+- 2
+- 3
+- 4
+`),
+		},
+	},
+	{
+		Description: "add duplicate field to map in merging int list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 2
+  - 3
+mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			ThreeWay: []byte(`{}`),
+			Result: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+		},
+	},
+	// test case for setElementOrder
+	{
+		Description: "add an item in a list of primitives and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+- 1
+- 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+- 3
+- 1
+- 2
+mergingIntList:
+- 3
+`),
+			Modified: []byte(`
+mergingIntList:
+- 3
+- 1
+- 2
+`),
+			Current: []byte(`
+mergingIntList:
+- 1
+- 4
+- 2
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+- 3
+- 1
+- 2
+mergingIntList:
+- 3
+`),
+			Result: []byte(`
+mergingIntList:
+- 3
+- 1
+- 4
+- 2
+`),
+		},
+	},
+	{
+		Description: "delete an item in a list of primitives and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+- 1
+- 2
+- 3
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+- 2
+- 1
+$deleteFromPrimitiveList/mergingIntList:
+- 3
+`),
+			Modified: []byte(`
+mergingIntList:
+- 2
+- 1
+`),
+			Current: []byte(`
+mergingIntList:
+- 1
+- 2
+- 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+- 2
+- 1
+$deleteFromPrimitiveList/mergingIntList:
+- 3
+`),
+			Result: []byte(`
+mergingIntList:
+- 2
+- 1
+`),
+		},
+	},
+	{
+		Description: "add an item in a list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 3
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 3
+    value: 3
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 3
+    value: 3
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 3
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 3
+    value: 3
+`),
+			Result: []byte(`
+mergingList:
+  - name: 3
+    value: 3
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+		},
+	},
+	{
+		Description: "add multiple items in a list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 4
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 1
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 4
+  - name: 2
+  - name: 3
+mergingList:
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+			Result: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+    other: b
+  - name: 3
+    value: 3
+`),
+		},
+	},
+	{
+		Description: "delete an item in a list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 3
+    value: 3
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 1
+mergingList:
+  - name: 3
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+  - name: 1
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+  - name: 3
+    value: 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 1
+mergingList:
+  - name: 3
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+    other: b
+  - name: 1
+    other: a
+`),
+		},
+	},
+	{
+		Description: "change an item in a list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 3
+    value: 3
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 3
+  - name: 1
+mergingList:
+  - name: 3
+    value: x
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+  - name: 3
+    value: x
+  - name: 1
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+  - name: 3
+    value: 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 3
+  - name: 1
+mergingList:
+  - name: 3
+    value: x
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+    other: b
+  - name: 3
+    value: x
+  - name: 1
+    other: a
+`),
+		},
+	},
+	{
+		Description: "add and delete an item in a list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 3
+    value: 3
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 2
+  - name: 1
+mergingList:
+  - name: 4
+    value: 4
+  - name: 3
+    $patch: delete
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+  - name: 1
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+    other: b
+  - name: 3
+    value: 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 2
+  - name: 1
+mergingList:
+  - name: 4
+    value: 4
+  - name: 3
+    $patch: delete
+`),
+			Result: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+    other: b
+  - name: 1
+    other: a
+`),
+		},
+	},
+	{
+		Description: "set elements order in a list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 2
+  - name: 3
+  - name: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+  - name: 1
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 2
+  - name: 3
+  - name: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+  - name: 1
+    other: a
+`),
+		},
+	},
+	{
+		Description: "set elements order in a list with server-only items",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 2
+  - name: 3
+  - name: 1
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+  - name: 1
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+  - name: 9
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 4
+  - name: 2
+  - name: 3
+  - name: 1
+`),
+			Result: []byte(`
+mergingList:
+  - name: 4
+    value: 4
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+  - name: 1
+    other: a
+  - name: 9
+`),
+		},
+	},
+	{
+		Description: "set elements order in a list with server-only items 2",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 1
+  - name: 4
+  - name: 3
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+  - name: 1
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+  - name: 9
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 1
+  - name: 4
+  - name: 3
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+  - name: 1
+    other: a
+  - name: 9
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+		},
+	},
+	{
+		Description: "set elements order in a list with server-only items 3",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+    value: 2
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 1
+  - name: 4
+  - name: 3
+`),
+			Modified: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+  - name: 1
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+			Current: []byte(`
+mergingList:
+  - name: 1
+    other: a
+  - name: 2
+    value: 2
+  - name: 7
+  - name: 9
+  - name: 8
+  - name: 3
+    value: 3
+  - name: 4
+    value: 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 2
+  - name: 1
+  - name: 4
+  - name: 3
+`),
+			Result: []byte(`
+mergingList:
+  - name: 2
+    value: 2
+  - name: 1
+    other: a
+  - name: 7
+  - name: 9
+  - name: 8
+  - name: 4
+    value: 4
+  - name: 3
+    value: 3
+`),
+		},
+	},
+	{
+		Description: "add an item in a int list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 3
+  - 1
+  - 2
+mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 3
+  - 1
+  - 2
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 3
+  - 1
+  - 2
+mergingIntList:
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 3
+  - 1
+  - 2
+`),
+		},
+	},
+	{
+		Description: "add multiple items in a int list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 4
+  - 2
+  - 3
+mergingIntList:
+  - 4
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 1
+  - 4
+  - 2
+  - 3
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 1
+  - 4
+  - 2
+  - 3
+mergingIntList:
+  - 4
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 1
+  - 4
+  - 2
+  - 3
+`),
+		},
+	},
+	{
+		Description: "delete an item in a int list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 3
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 2
+  - 1
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 2
+  - 1
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 2
+  - 1
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 2
+  - 1
+`),
+		},
+	},
+	{
+		Description: "add and delete an item in a int list and preserve order",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 3
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 4
+  - 2
+  - 1
+mergingIntList:
+  - 4
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 4
+  - 2
+  - 1
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 4
+  - 2
+  - 1
+mergingIntList:
+  - 4
+$deleteFromPrimitiveList/mergingIntList:
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 4
+  - 2
+  - 1
+`),
+		},
+	},
+	{
+		Description: "set elements order in a int list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 3
+  - 4
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 3
+  - 4
+  - 2
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+`),
+			Result: []byte(`
+mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+`),
+		},
+	},
+	{
+		Description: "set elements order in a int list with server-only items",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 3
+  - 4
+  - 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 3
+  - 4
+  - 2
+  - 9
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+`),
+			Result: []byte(`
+mergingIntList:
+  - 4
+  - 2
+  - 3
+  - 1
+  - 9
+`),
+		},
+	},
+	{
+		Description: "set elements order in a int list with server-only items 2",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 4
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 2
+  - 1
+  - 4
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 2
+  - 1
+  - 4
+  - 3
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 9
+  - 3
+  - 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 2
+  - 1
+  - 4
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 2
+  - 1
+  - 9
+  - 4
+  - 3
+`),
+		},
+	},
+	{
+		Description: "set elements order in a int list with server-only items 3",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 4
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 2
+  - 1
+  - 4
+  - 3
+`),
+			Modified: []byte(`
+mergingIntList:
+  - 2
+  - 1
+  - 4
+  - 3
+`),
+			Current: []byte(`
+mergingIntList:
+  - 1
+  - 2
+  - 7
+  - 9
+  - 8
+  - 3
+  - 4
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+  - 2
+  - 1
+  - 4
+  - 3
+`),
+			Result: []byte(`
+mergingIntList:
+  - 2
+  - 1
+  - 7
+  - 9
+  - 8
+  - 4
+  - 3
+`),
+		},
+	},
+	{
+		// This test case is used just to demonstrate the behavior when dealing with a list with duplicate
+		Description: "behavior of set element order for a merging list with duplicate",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+- name: 1
+- name: 2
+  value: dup1
+- name: 3
+- name: 2
+  value: dup2
+- name: 4
+`),
+			Current: []byte(`
+mergingList:
+- name: 1
+- name: 2
+  value: dup1
+- name: 3
+- name: 2
+  value: dup2
+- name: 4
+`),
+			Modified: []byte(`
+mergingList:
+- name: 2
+  value: dup1
+- name: 1
+- name: 4
+- name: 3
+- name: 2
+  value: dup2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+- name: 2
+- name: 1
+- name: 4
+- name: 3
+- name: 2
+`),
+			TwoWayResult: []byte(`
+mergingList:
+- name: 2
+  value: dup1
+- name: 2
+  value: dup2
+- name: 1
+- name: 4
+- name: 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+- name: 2
+- name: 1
+- name: 4
+- name: 3
+- name: 2
+`),
+			Result: []byte(`
+mergingList:
+- name: 2
+  value: dup1
+- name: 2
+  value: dup2
+- name: 1
+- name: 4
+- name: 3
+`),
+		},
+	},
+	{
+		// This test case is used just to demonstrate the behavior when dealing with a list with duplicate
+		Description: "behavior of set element order for a merging int list with duplicate",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingIntList:
+- 1
+- 2
+- 3
+- 2
+- 4
+`),
+			Current: []byte(`
+mergingIntList:
+- 1
+- 2
+- 3
+- 2
+- 4
+`),
+			Modified: []byte(`
+mergingIntList:
+- 2
+- 1
+- 4
+- 3
+- 2
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingIntList:
+- 2
+- 1
+- 4
+- 3
+- 2
+`),
+			TwoWayResult: []byte(`
+mergingIntList:
+- 2
+- 2
+- 1
+- 4
+- 3
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingIntList:
+- 2
+- 1
+- 4
+- 3
+- 2
+`),
+			Result: []byte(`
+mergingIntList:
+- 2
+- 2
+- 1
+- 4
+- 3
+`),
+		},
+	},
+	{
+		Description: "retainKeys map should clear defaulted field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`{}`),
+			Current: []byte(`
+retainKeysMap:
+  value: foo
+`),
+			Modified: []byte(`
+retainKeysMap:
+  other: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  other: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - other
+  other: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  other: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map should clear defaulted field with conflict (discriminated union)",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`{}`),
+			Current: []byte(`
+retainKeysMap:
+  name: type1
+  value: foo
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: type2
+  other: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  name: type2
+  other: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - other
+  name: type2
+  other: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: type2
+  other: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map adds a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map adds a field and clear a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  other: a
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+  value: null
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+  value: null
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes a field and clears a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  other: a
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+  value: null
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+  value: null
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+`),
+		},
+	},
+	{
+		Description: "retainKeys map clears a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  other: a
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			TwoWay: []byte(`{}`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map nested map with no change",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  simpleMap:
+    key1: a
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  simpleMap:
+    key1: a
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  value: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+`),
+		},
+	},
+	{
+		Description: "retainKeys map adds a field in a nested map",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key3: c
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key2: b
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key2: b
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key2: b
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key2: b
+    key3: c
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes a field in a nested map",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key2: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key2: b
+    key3: c
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key2: null
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key2: null
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key3: c
+`),
+		},
+	},
+	{
+		Description: "retainKeys map changes a field in a nested map",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key2: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: a
+    key2: b
+    key3: c
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: x
+    key2: b
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key1: x
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key1: x
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: x
+    key2: b
+    key3: c
+`),
+		},
+	},
+	{
+		Description: "retainKeys map changes a field in a nested map with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: old
+    key2: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: new
+    key2: b
+    key3: c
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: modified
+    key2: b
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key1: modified
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - simpleMap
+    - value
+  simpleMap:
+    key1: modified
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  simpleMap:
+    key1: modified
+    key2: b
+    key3: c
+`),
+		},
+	},
+	{
+		Description: "retainKeys map replaces non-merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: c
+  - name: b
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - nonMergingList
+    - value
+  nonMergingList:
+  - name: a
+  - name: c
+  - name: b
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - nonMergingList
+    - value
+  nonMergingList:
+  - name: a
+  - name: c
+  - name: b
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: c
+  - name: b
+`),
+		},
+	},
+	{
+		Description: "retainKeys map nested non-merging list with no change",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - nonMergingList
+    - value
+  value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - nonMergingList
+    - value
+  value: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+		},
+	},
+	{
+		Description: "retainKeys map nested non-merging list with no change with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+  - name: c
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - nonMergingList
+    - value
+  value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - nonMergingList
+    - value
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes nested non-merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+  nonMergingList: null
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+  nonMergingList: null
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map delete nested non-merging list with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  nonMergingList:
+  - name: a
+  - name: b
+  - name: c
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+  nonMergingList: null
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+  nonMergingList: null
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map nested merging int list with no change",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  mergingIntList:
+  - 1
+  - 2
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingIntList
+    - name
+    - value
+  value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingIntList
+    - name
+    - value
+  $setElementOrder/mergingIntList:
+    - 1
+    - 2
+  value: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+		},
+	},
+	{
+		Description: "retainKeys map adds an item in nested merging int list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 4
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $setElementOrder/mergingIntList:
+    - 1
+    - 2
+    - 4
+  $retainKeys:
+    - mergingIntList
+    - name
+  mergingIntList:
+  - 4
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $setElementOrder/mergingIntList:
+    - 1
+    - 2
+    - 4
+  $retainKeys:
+    - mergingIntList
+    - name
+  mergingIntList:
+  - 4
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 4
+  - 3
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes an item in nested merging int list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 4
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 3
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingIntList
+    - name
+  $deleteFromPrimitiveList/mergingIntList:
+  - 2
+  $setElementOrder/mergingIntList:
+    - 1
+    - 3
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingIntList
+    - name
+  $deleteFromPrimitiveList/mergingIntList:
+  - 2
+  $setElementOrder/mergingIntList:
+    - 1
+    - 3
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 3
+  - 4
+`),
+		},
+	},
+	{
+		Description: "retainKeys map adds an item and deletes an item in nested merging int list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+  - 4
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 3
+  - 5
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingIntList
+    - name
+  mergingIntList:
+  - 5
+  $deleteFromPrimitiveList/mergingIntList:
+  - 2
+  $setElementOrder/mergingIntList:
+    - 1
+    - 3
+    - 5
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingIntList
+    - name
+  mergingIntList:
+  - 5
+  $deleteFromPrimitiveList/mergingIntList:
+  - 2
+  $setElementOrder/mergingIntList:
+    - 1
+    - 3
+    - 5
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 3
+  - 5
+  - 4
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes nested merging int list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingIntList:
+  - 1
+  - 2
+  - 3
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+  mergingIntList: null
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+  mergingIntList: null
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+`),
+		},
+	},
+	{
+		Description: "retainKeys map nested merging list with no change",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+  - name: c
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  mergingList:
+  - name: a
+  - name: b
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+    - value
+  value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+    - value
+  $setElementOrder/mergingList:
+    - name: a
+    - name: b
+  value: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+  mergingList:
+  - name: a
+  - name: b
+  - name: c
+`),
+		},
+	},
+	{
+		Description: "retainKeys map adds an item in nested merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+  - name: x
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+  - name: c
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+  $setElementOrder/mergingList:
+    - name: a
+    - name: b
+    - name: c
+  mergingList:
+  - name: c
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+  $setElementOrder/mergingList:
+    - name: a
+    - name: b
+    - name: c
+  mergingList:
+  - name: c
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+  - name: c
+  - name: x
+`),
+		},
+	},
+	{
+		Description: "retainKeys map changes an item in nested merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+    value: foo
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+    value: foo
+  - name: x
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+    value: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+  $setElementOrder/mergingList:
+    - name: a
+    - name: b
+  mergingList:
+  - name: b
+    value: bar
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+  $setElementOrder/mergingList:
+    - name: a
+    - name: b
+  mergingList:
+  - name: b
+    value: bar
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+    value: bar
+  - name: x
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes nested merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+  mergingList: null
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - name
+    - value
+  value: bar
+  mergingList: null
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  value: bar
+`),
+		},
+	},
+	{
+		Description: "retainKeys map deletes an item in nested merging list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+`),
+			Current: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: b
+  - name: x
+`),
+			Modified: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+`),
+			TwoWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+  $setElementOrder/mergingList:
+    - name: a
+  mergingList:
+  - name: b
+    $patch: delete
+`),
+			ThreeWay: []byte(`
+retainKeysMap:
+  $retainKeys:
+    - mergingList
+    - name
+  $setElementOrder/mergingList:
+    - name: a
+  mergingList:
+  - name: b
+    $patch: delete
+`),
+			Result: []byte(`
+retainKeysMap:
+  name: foo
+  mergingList:
+  - name: a
+  - name: x
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps clears a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+  other: x
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+			TwoWay: []byte(`{}`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps clears a field with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: old
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: new
+  other: x
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: modified
+`),
+			TwoWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: modified
+`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: modified
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: modified
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps changes a field and clear a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: old
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: old
+  other: x
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: new
+`),
+			TwoWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: new
+`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: new
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: new
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps changes a field and clear a field with conflict",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: old
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: modified
+  other: x
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: new
+`),
+			TwoWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: new
+`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: new
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: new
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps adds a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+			TwoWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: a
+`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: a
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps adds a field and clear a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  other: x
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+			TwoWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: a
+`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+    - value
+  name: foo
+  value: a
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps deletes a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+`),
+			TwoWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+  name: foo
+  value: null
+`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+  name: foo
+  value: null
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+`),
+		},
+	},
+	{
+		Description: "retainKeys list of maps deletes a field and clear a field",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+`),
+			Current: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+  value: a
+  other: x
+`),
+			Modified: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+`),
+			TwoWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+  name: foo
+  value: null
+`),
+			ThreeWay: []byte(`
+$setElementOrder/retainKeysMergingList:
+  - name: bar
+  - name: foo
+retainKeysMergingList:
+- $retainKeys:
+    - name
+  name: foo
+  value: null
+`),
+			Result: []byte(`
+retainKeysMergingList:
+- name: bar
+- name: foo
+`),
+		},
+	},
+	{
+		Description: "delete and reorder in one list, reorder in another",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+mergingList:
+- name: a
+  value: a
+- name: b
+  value: b
+mergeItemPtr:
+- name: c
+  value: c
+- name: d
+  value: d
+`),
+			Current: []byte(`
+mergingList:
+- name: a
+  value: a
+- name: b
+  value: b
+mergeItemPtr:
+- name: c
+  value: c
+- name: d
+  value: d
+`),
+			Modified: []byte(`
+mergingList:
+- name: b
+  value: b
+mergeItemPtr:
+- name: d
+  value: d
+- name: c
+  value: c
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+- name: b
+$setElementOrder/mergeItemPtr:
+- name: d
+- name: c
+mergingList:
+- $patch: delete
+  name: a
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+- name: b
+$setElementOrder/mergeItemPtr:
+- name: d
+- name: c
+mergingList:
+- $patch: delete
+  name: a
+`),
+			Result: []byte(`
+mergingList:
+- name: b
+  value: b
+mergeItemPtr:
+- name: d
+  value: d
+- name: c
+  value: c
+`),
+		},
+	},
+}
+
+func TestStrategicMergePatch(t *testing.T) {
+	testStrategicMergePatchWithCustomArgumentsUsingStruct(t, "bad struct",
+		"{}", "{}", []byte("<THIS IS NOT A STRUCT>"), mergepatch.ErrBadArgKind(struct{}{}, []byte{}))
+
+	mergeItemOpenapiSchema := PatchMetaFromOpenAPI{
+		Schema: sptest.GetSchemaOrDie(&fakeMergeItemSchema, "mergeItem"),
+	}
+	mergeItemOpenapiV3Schema := PatchMetaFromOpenAPIV3{
+		SchemaList: fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas,
+		Schema:     fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas["mergeItem"],
+	}
+	schemas := []LookupPatchMeta{
+		mergeItemStructSchema,
+		mergeItemOpenapiSchema,
+		mergeItemOpenapiV3Schema,
+	}
+
+	tc := StrategicMergePatchTestCases{}
+	err := yaml.Unmarshal(createStrategicMergePatchTestCaseData, &tc)
+	if err != nil {
+		t.Errorf("can't unmarshal test cases: %s\n", err)
+		return
+	}
+
+	for _, schema := range schemas {
+		t.Run(schema.Name(), func(t *testing.T) {
+
+			testStrategicMergePatchWithCustomArguments(t, "bad original",
+				"<THIS IS NOT JSON>", "{}", schema, mergepatch.ErrBadJSONDoc)
+			testStrategicMergePatchWithCustomArguments(t, "bad patch",
+				"{}", "<THIS IS NOT JSON>", schema, mergepatch.ErrBadJSONDoc)
+			testStrategicMergePatchWithCustomArguments(t, "nil struct",
+				"{}", "{}", nil, mergepatch.ErrBadArgKind(struct{}{}, nil))
+
+			for _, c := range tc.TestCases {
+				t.Run(c.Description+"/TwoWay", func(t *testing.T) {
+					testTwoWayPatch(t, c, schema)
+				})
+				t.Run(c.Description+"/ThreeWay", func(t *testing.T) {
+					testThreeWayPatch(t, c, schema)
+				})
+			}
+		})
+
+		// run multiple times to exercise different map traversal orders
+		for i := 0; i < 10; i++ {
+			for _, c := range strategicMergePatchRawTestCases {
+				t.Run(c.Description+"/TwoWay", func(t *testing.T) {
+					testTwoWayPatchForRawTestCase(t, c, schema)
+				})
+				t.Run(c.Description+"/ThreeWay", func(t *testing.T) {
+					testThreeWayPatchForRawTestCase(t, c, schema)
+				})
+			}
+		}
+	}
+}
+
+func testStrategicMergePatchWithCustomArgumentsUsingStruct(t *testing.T, description, original, patch string, dataStruct interface{}, expected error) {
+	schema, actual := NewPatchMetaFromStruct(dataStruct)
+	// If actual is not nil, check error. If errors match, return.
+	if actual != nil {
+		checkErrorsEqual(t, description, expected, actual, schema)
+		return
+	}
+	testStrategicMergePatchWithCustomArguments(t, description, original, patch, schema, expected)
+}
+
+func testStrategicMergePatchWithCustomArguments(t *testing.T, description, original, patch string, schema LookupPatchMeta, expected error) {
+	_, actual := StrategicMergePatch([]byte(original), []byte(patch), schema)
+	checkErrorsEqual(t, description, expected, actual, schema)
+}
+
+func checkErrorsEqual(t *testing.T, description string, expected, actual error, schema LookupPatchMeta) {
+	if actual != expected {
+		if actual == nil {
+			t.Errorf("using %s expected error: %s\ndid not occur in test case: %s", getSchemaType(schema), expected, description)
+			return
+		}
+
+		if expected == nil || actual.Error() != expected.Error() {
+			t.Errorf("using %s unexpected error: %s\noccurred in test case: %s", getSchemaType(schema), actual, description)
+			return
+		}
+	}
+}
+
+func testTwoWayPatch(t *testing.T, c StrategicMergePatchTestCase, schema LookupPatchMeta) {
+	original, expectedPatch, modified, expectedResult := twoWayTestCaseToJSONOrFail(t, c, schema)
+
+	actualPatch, err := CreateTwoWayMergePatchUsingLookupPatchMeta(original, modified, schema)
+	if err != nil {
+		t.Errorf("using %s error: %s\nin test case: %s\ncannot create two way patch: %s:\n%s\n",
+			getSchemaType(schema), err, c.Description, original, mergepatch.ToYAMLOrError(c.StrategicMergePatchTestCaseData))
+		return
+	}
+
+	testPatchCreation(t, expectedPatch, actualPatch, c.Description)
+	testPatchApplication(t, original, actualPatch, expectedResult, c.Description, "", schema)
+}
+
+func testTwoWayPatchForRawTestCase(t *testing.T, c StrategicMergePatchRawTestCase, schema LookupPatchMeta) {
+	original, expectedPatch, modified, expectedResult := twoWayRawTestCaseToJSONOrFail(t, c)
+
+	actualPatch, err := CreateTwoWayMergePatchUsingLookupPatchMeta(original, modified, schema)
+	if err != nil {
+		t.Errorf("error: %s\nin test case: %s\ncannot create two way patch:\noriginal:%s\ntwoWay:%s\nmodified:%s\ncurrent:%s\nthreeWay:%s\nresult:%s\n",
+			err, c.Description, c.Original, c.TwoWay, c.Modified, c.Current, c.ThreeWay, c.Result)
+		return
+	}
+
+	testPatchCreation(t, expectedPatch, actualPatch, c.Description)
+	testPatchApplication(t, original, actualPatch, expectedResult, c.Description, c.ExpectedError, schema)
+}
+
+func twoWayTestCaseToJSONOrFail(t *testing.T, c StrategicMergePatchTestCase, schema LookupPatchMeta) ([]byte, []byte, []byte, []byte) {
+	expectedResult := c.TwoWayResult
+	if expectedResult == nil {
+		expectedResult = c.Modified
+	}
+	return sortJsonOrFail(t, testObjectToJSONOrFail(t, c.Original), c.Description, schema),
+		sortJsonOrFail(t, testObjectToJSONOrFail(t, c.TwoWay), c.Description, schema),
+		sortJsonOrFail(t, testObjectToJSONOrFail(t, c.Modified), c.Description, schema),
+		sortJsonOrFail(t, testObjectToJSONOrFail(t, expectedResult), c.Description, schema)
+}
+
+func twoWayRawTestCaseToJSONOrFail(t *testing.T, c StrategicMergePatchRawTestCase) ([]byte, []byte, []byte, []byte) {
+	expectedResult := c.TwoWayResult
+	if expectedResult == nil {
+		expectedResult = c.Modified
+	}
+	return yamlToJSONOrError(t, c.Original),
+		yamlToJSONOrError(t, c.TwoWay),
+		yamlToJSONOrError(t, c.Modified),
+		yamlToJSONOrError(t, expectedResult)
+}
+
+func testThreeWayPatch(t *testing.T, c StrategicMergePatchTestCase, schema LookupPatchMeta) {
+	original, modified, current, expected, result := threeWayTestCaseToJSONOrFail(t, c, schema)
+	actual, err := CreateThreeWayMergePatch(original, modified, current, schema, false)
+	if err != nil {
+		if !mergepatch.IsConflict(err) {
+			t.Errorf("using %s error: %s\nin test case: %s\ncannot create three way patch:\n%s\n",
+				getSchemaType(schema), err, c.Description, mergepatch.ToYAMLOrError(c.StrategicMergePatchTestCaseData))
+			return
+		}
+
+		if !strings.Contains(c.Description, "conflict") {
+			t.Errorf("using %s unexpected conflict: %s\nin test case: %s\ncannot create three way patch:\n%s\n",
+				getSchemaType(schema), err, c.Description, mergepatch.ToYAMLOrError(c.StrategicMergePatchTestCaseData))
+			return
+		}
+
+		if len(c.Result) > 0 {
+			actual, err := CreateThreeWayMergePatch(original, modified, current, schema, true)
+			if err != nil {
+				t.Errorf("using %s error: %s\nin test case: %s\ncannot force three way patch application:\n%s\n",
+					getSchemaType(schema), err, c.Description, mergepatch.ToYAMLOrError(c.StrategicMergePatchTestCaseData))
+				return
+			}
+
+			testPatchCreation(t, expected, actual, c.Description)
+			testPatchApplication(t, current, actual, result, c.Description, "", schema)
+		}
+
+		return
+	}
+
+	if strings.Contains(c.Description, "conflict") || len(c.Result) < 1 {
+		t.Errorf("using %s error in test case: %s\nexpected conflict did not occur:\n%s\n",
+			getSchemaType(schema), c.Description, mergepatch.ToYAMLOrError(c.StrategicMergePatchTestCaseData))
+		return
+	}
+
+	testPatchCreation(t, expected, actual, c.Description)
+	testPatchApplication(t, current, actual, result, c.Description, "", schema)
+}
+
+func testThreeWayPatchForRawTestCase(t *testing.T, c StrategicMergePatchRawTestCase, schema LookupPatchMeta) {
+	original, modified, current, expected, result := threeWayRawTestCaseToJSONOrFail(t, c)
+	actual, err := CreateThreeWayMergePatch(original, modified, current, schema, false)
+	if err != nil {
+		if !mergepatch.IsConflict(err) {
+			t.Errorf("using %s error: %s\nin test case: %s\ncannot create three way patch:\noriginal:%s\ntwoWay:%s\nmodified:%s\ncurrent:%s\nthreeWay:%s\nresult:%s\n",
+				getSchemaType(schema), err, c.Description, c.Original, c.TwoWay, c.Modified, c.Current, c.ThreeWay, c.Result)
+			return
+		}
+
+		if !strings.Contains(c.Description, "conflict") {
+			t.Errorf("using %s unexpected conflict: %s\nin test case: %s\ncannot create three way patch:\noriginal:%s\ntwoWay:%s\nmodified:%s\ncurrent:%s\nthreeWay:%s\nresult:%s\n",
+				getSchemaType(schema), err, c.Description, c.Original, c.TwoWay, c.Modified, c.Current, c.ThreeWay, c.Result)
+			return
+		}
+
+		if len(c.Result) > 0 {
+			actual, err := CreateThreeWayMergePatch(original, modified, current, schema, true)
+			if err != nil {
+				t.Errorf("using %s error: %s\nin test case: %s\ncannot force three way patch application:\noriginal:%s\ntwoWay:%s\nmodified:%s\ncurrent:%s\nthreeWay:%s\nresult:%s\n",
+					getSchemaType(schema), err, c.Description, c.Original, c.TwoWay, c.Modified, c.Current, c.ThreeWay, c.Result)
+				return
+			}
+
+			testPatchCreation(t, expected, actual, c.Description)
+			testPatchApplication(t, current, actual, result, c.Description, c.ExpectedError, schema)
+		}
+
+		return
+	}
+
+	if strings.Contains(c.Description, "conflict") || len(c.Result) < 1 {
+		t.Errorf("using %s error: %s\nin test case: %s\nexpected conflict did not occur:\noriginal:%s\ntwoWay:%s\nmodified:%s\ncurrent:%s\nthreeWay:%s\nresult:%s\n",
+			getSchemaType(schema), err, c.Description, c.Original, c.TwoWay, c.Modified, c.Current, c.ThreeWay, c.Result)
+		return
+	}
+
+	testPatchCreation(t, expected, actual, c.Description)
+	testPatchApplication(t, current, actual, result, c.Description, c.ExpectedError, schema)
+}
+
+func threeWayTestCaseToJSONOrFail(t *testing.T, c StrategicMergePatchTestCase, schema LookupPatchMeta) ([]byte, []byte, []byte, []byte, []byte) {
+	return sortJsonOrFail(t, testObjectToJSONOrFail(t, c.Original), c.Description, schema),
+		sortJsonOrFail(t, testObjectToJSONOrFail(t, c.Modified), c.Description, schema),
+		sortJsonOrFail(t, testObjectToJSONOrFail(t, c.Current), c.Description, schema),
+		sortJsonOrFail(t, testObjectToJSONOrFail(t, c.ThreeWay), c.Description, schema),
+		sortJsonOrFail(t, testObjectToJSONOrFail(t, c.Result), c.Description, schema)
+}
+
+func threeWayRawTestCaseToJSONOrFail(t *testing.T, c StrategicMergePatchRawTestCase) ([]byte, []byte, []byte, []byte, []byte) {
+	return yamlToJSONOrError(t, c.Original),
+		yamlToJSONOrError(t, c.Modified),
+		yamlToJSONOrError(t, c.Current),
+		yamlToJSONOrError(t, c.ThreeWay),
+		yamlToJSONOrError(t, c.Result)
+}
+
+func testPatchCreation(t *testing.T, expected, actual []byte, description string) {
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("error in test case: %s\nexpected patch:\n%s\ngot:\n%s\n",
+			description, jsonToYAMLOrError(expected), jsonToYAMLOrError(actual))
+		return
+	}
+}
+
+func testPatchApplication(t *testing.T, original, patch, expected []byte, description, expectedError string, schema LookupPatchMeta) {
+	result, err := StrategicMergePatchUsingLookupPatchMeta(original, patch, schema)
+	if len(expectedError) != 0 {
+		if err != nil && strings.Contains(err.Error(), expectedError) {
+			return
+		}
+		t.Errorf("using %s expected error should contain:\n%s\nin test case: %s\nbut got:\n%s\n", getSchemaType(schema), expectedError, description, err)
+	}
+	if err != nil {
+		t.Errorf("using %s error: %s\nin test case: %s\ncannot apply patch:\n%s\nto original:\n%s\n",
+			getSchemaType(schema), err, description, jsonToYAMLOrError(patch), jsonToYAMLOrError(original))
+		return
+	}
+
+	if !reflect.DeepEqual(result, expected) {
+		format := "using error in test case: %s\npatch application failed:\noriginal:\n%s\npatch:\n%s\nexpected:\n%s\ngot:\n%s\n"
+		t.Errorf(format, description,
+			jsonToYAMLOrError(original), jsonToYAMLOrError(patch),
+			jsonToYAMLOrError(expected), jsonToYAMLOrError(result))
+		return
+	}
+}
+
+func testObjectToJSONOrFail(t *testing.T, o map[string]interface{}) []byte {
+	if o == nil {
+		return nil
+	}
+
+	j, err := toJSON(o)
+	if err != nil {
+		t.Error(err)
+	}
+	return j
+}
+
+func sortJsonOrFail(t *testing.T, j []byte, description string, schema LookupPatchMeta) []byte {
+	if j == nil {
+		return nil
+	}
+	r, err := sortMergeListsByName(j, schema)
+	if err != nil {
+		t.Errorf("using %s error: %s\n in test case: %s\ncannot sort object:\n%s\n", getSchemaType(schema), err, description, j)
+		return nil
+	}
+
+	return r
+}
+
+func getSchemaType(schema LookupPatchMeta) string {
+	return reflect.TypeOf(schema).String()
+}
+
+func jsonToYAMLOrError(j []byte) string {
+	y, err := jsonToYAML(j)
+	if err != nil {
+		return err.Error()
+	}
+
+	return string(y)
+}
+
+func toJSON(v interface{}) ([]byte, error) {
+	j, err := json.Marshal(v)
+	if err != nil {
+		return nil, fmt.Errorf("json marshal failed: %v\n%v\n", err, dump.Pretty(v))
+	}
+
+	return j, nil
+}
+
+func jsonToYAML(j []byte) ([]byte, error) {
+	y, err := yaml.JSONToYAML(j)
+	if err != nil {
+		return nil, fmt.Errorf("json to yaml failed: %v\n%v\n", err, j)
+	}
+
+	return y, nil
+}
+
+func yamlToJSON(y []byte) ([]byte, error) {
+	j, err := yaml.YAMLToJSON(y)
+	if err != nil {
+		return nil, fmt.Errorf("yaml to json failed: %v\n%v\n", err, y)
+	}
+
+	return j, nil
+}
+
+func yamlToJSONOrError(t *testing.T, y []byte) []byte {
+	j, err := yamlToJSON(y)
+	if err != nil {
+		t.Errorf("%v", err)
+	}
+
+	return j
+}
+
+type PrecisionItem struct {
+	Name    string  `json:"name,omitempty"`
+	Int32   int32   `json:"int32,omitempty"`
+	Int64   int64   `json:"int64,omitempty"`
+	Float32 float32 `json:"float32,omitempty"`
+	Float64 float64 `json:"float64,omitempty"`
+}
+
+var (
+	precisionItem             PrecisionItem
+	precisionItemStructSchema = PatchMetaFromStruct{T: GetTagStructTypeOrDie(precisionItem)}
+)
+
+func TestNumberConversion(t *testing.T) {
+	testcases := map[string]struct {
+		Old            string
+		New            string
+		ExpectedPatch  string
+		ExpectedResult string
+	}{
+		"empty": {
+			Old:            `{}`,
+			New:            `{}`,
+			ExpectedPatch:  `{}`,
+			ExpectedResult: `{}`,
+		},
+		"int32 medium": {
+			Old:            `{"int32":1000000}`,
+			New:            `{"int32":1000000,"name":"newname"}`,
+			ExpectedPatch:  `{"name":"newname"}`,
+			ExpectedResult: `{"int32":1000000,"name":"newname"}`,
+		},
+		"int32 max": {
+			Old:            `{"int32":2147483647}`,
+			New:            `{"int32":2147483647,"name":"newname"}`,
+			ExpectedPatch:  `{"name":"newname"}`,
+			ExpectedResult: `{"int32":2147483647,"name":"newname"}`,
+		},
+		"int64 medium": {
+			Old:            `{"int64":1000000}`,
+			New:            `{"int64":1000000,"name":"newname"}`,
+			ExpectedPatch:  `{"name":"newname"}`,
+			ExpectedResult: `{"int64":1000000,"name":"newname"}`,
+		},
+		"int64 max": {
+			Old:            `{"int64":9223372036854775807}`,
+			New:            `{"int64":9223372036854775807,"name":"newname"}`,
+			ExpectedPatch:  `{"name":"newname"}`,
+			ExpectedResult: `{"int64":9223372036854775807,"name":"newname"}`,
+		},
+		"float32 max": {
+			Old:            `{"float32":3.4028234663852886e+38}`,
+			New:            `{"float32":3.4028234663852886e+38,"name":"newname"}`,
+			ExpectedPatch:  `{"name":"newname"}`,
+			ExpectedResult: `{"float32":3.4028234663852886e+38,"name":"newname"}`,
+		},
+		"float64 max": {
+			Old:            `{"float64":1.7976931348623157e+308}`,
+			New:            `{"float64":1.7976931348623157e+308,"name":"newname"}`,
+			ExpectedPatch:  `{"name":"newname"}`,
+			ExpectedResult: `{"float64":1.7976931348623157e+308,"name":"newname"}`,
+		},
+	}
+
+	precisionItemOpenapiSchema := PatchMetaFromOpenAPI{
+		Schema: sptest.GetSchemaOrDie(&fakePrecisionItemSchema, "precisionItem"),
+	}
+	precisionItemOpenapiV3Schema := PatchMetaFromOpenAPIV3{
+		SchemaList: fakePrecisionItemV3Schema.SchemaOrDie().Components.Schemas,
+		Schema:     fakePrecisionItemV3Schema.SchemaOrDie().Components.Schemas["precisionItem"],
+	}
+	precisionItemSchemas := []LookupPatchMeta{
+		precisionItemStructSchema,
+		precisionItemOpenapiSchema,
+		precisionItemOpenapiV3Schema,
+	}
+
+	for _, schema := range precisionItemSchemas {
+		for k, tc := range testcases {
+			patch, err := CreateTwoWayMergePatchUsingLookupPatchMeta([]byte(tc.Old), []byte(tc.New), schema)
+			if err != nil {
+				t.Errorf("using %s in testcase %s: unexpected error %v", getSchemaType(schema), k, err)
+				continue
+			}
+			if tc.ExpectedPatch != string(patch) {
+				t.Errorf("using %s in testcase %s: expected %s, got %s", getSchemaType(schema), k, tc.ExpectedPatch, string(patch))
+				continue
+			}
+
+			result, err := StrategicMergePatchUsingLookupPatchMeta([]byte(tc.Old), patch, schema)
+			if err != nil {
+				t.Errorf("using %s in testcase %s: unexpected error %v", getSchemaType(schema), k, err)
+				continue
+			}
+			if tc.ExpectedResult != string(result) {
+				t.Errorf("using %s in testcase %s: expected %s, got %s", getSchemaType(schema), k, tc.ExpectedResult, string(result))
+				continue
+			}
+		}
+	}
+}
+
+var replaceRawExtensionPatchTestCases = []StrategicMergePatchRawTestCase{
+	{
+		Description: "replace RawExtension field, rest unchanched",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+name: my-object
+value: some-value
+other: current-other
+replacingItem:
+  Some: Generic
+  Yaml: Inside
+  The: RawExtension
+  Field: Period
+`),
+			Current: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+replacingItem:
+  Some: Generic
+  Yaml: Inside
+  The: RawExtension
+  Field: Period
+`),
+			Modified: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			TwoWay: []byte(`
+mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			TwoWayResult: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			ThreeWay: []byte(`
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			Result: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+		},
+	},
+	{
+		Description: "replace RawExtension field and merge list",
+		StrategicMergePatchRawTestCaseData: StrategicMergePatchRawTestCaseData{
+			Original: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+replacingItem:
+  Some: Generic
+  Yaml: Inside
+  The: RawExtension
+  Field: Period
+`),
+			Current: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 3
+replacingItem:
+  Some: Generic
+  Yaml: Inside
+  The: RawExtension
+  Field: Period
+`),
+			Modified: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 2
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			TwoWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 2
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			TwoWayResult: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 2
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			ThreeWay: []byte(`
+$setElementOrder/mergingList:
+  - name: 1
+  - name: 2
+mergingList:
+  - name: 2
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+			Result: []byte(`
+name: my-object
+value: some-value
+other: current-other
+mergingList:
+  - name: 1
+  - name: 2
+  - name: 3
+replacingItem:
+  Newly: Modified
+  Yaml: Inside
+  The: RawExtension
+`),
+		},
+	},
+}
+
+func TestReplaceWithRawExtension(t *testing.T) {
+	mergeItemOpenapiSchema := PatchMetaFromOpenAPI{
+		Schema: sptest.GetSchemaOrDie(&fakeMergeItemSchema, "mergeItem"),
+	}
+	mergeItemOpenapiV3Schema := PatchMetaFromOpenAPIV3{
+		SchemaList: fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas,
+		Schema:     fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas["mergeItem"],
+	}
+	schemas := []LookupPatchMeta{
+		mergeItemStructSchema,
+		mergeItemOpenapiSchema,
+		mergeItemOpenapiV3Schema,
+	}
+
+	for _, schema := range schemas {
+		for _, c := range replaceRawExtensionPatchTestCases {
+			testTwoWayPatchForRawTestCase(t, c, schema)
+			testThreeWayPatchForRawTestCase(t, c, schema)
+		}
+	}
+}
+
+func TestUnknownField(t *testing.T) {
+	testcases := map[string]struct {
+		Original string
+		Current  string
+		Modified string
+
+		ExpectedTwoWay         string
+		ExpectedTwoWayErr      string
+		ExpectedTwoWayResult   string
+		ExpectedThreeWay       string
+		ExpectedThreeWayErr    string
+		ExpectedThreeWayResult string
+	}{
+		// cases we can successfully strategically merge
+		"no diff": {
+			Original: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Current:  `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Modified: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+
+			ExpectedTwoWay:         `{}`,
+			ExpectedTwoWayResult:   `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			ExpectedThreeWay:       `{}`,
+			ExpectedThreeWayResult: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+		},
+		"no diff even if modified null": {
+			Original: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Current:  `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Modified: `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":{"key":null},"name":"foo","scalar":true}`,
+
+			ExpectedTwoWay:         `{"complex_nullable":{"key":null}}`,
+			ExpectedTwoWayResult:   `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":{},"name":"foo","scalar":true}`,
+			ExpectedThreeWay:       `{"complex_nullable":{"key":null}}`,
+			ExpectedThreeWayResult: `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":{},"name":"foo","scalar":true}`,
+		},
+		"discard nulls in nested and adds not nulls": {
+			Original: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Current:  `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Modified: `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":{"key":{"keynotnull":"value","keynull":null}},"name":"foo","scalar":true}`,
+
+			ExpectedTwoWay:         `{"complex_nullable":{"key":{"keynotnull":"value","keynull":null}}}`,
+			ExpectedTwoWayResult:   `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":{"key":{"keynotnull":"value"}},"name":"foo","scalar":true}`,
+			ExpectedThreeWay:       `{"complex_nullable":{"key":{"keynotnull":"value","keynull":null}}}`,
+			ExpectedThreeWayResult: `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":{"key":{"keynotnull":"value"}},"name":"foo","scalar":true}`,
+		},
+		"discard if modified all nulls": {
+			Original: `{}`,
+			Current:  `{}`,
+			Modified: `{"complex":{"nested":null}}`,
+
+			ExpectedTwoWay:         `{"complex":{"nested":null}}`,
+			ExpectedTwoWayResult:   `{"complex":{}}`,
+			ExpectedThreeWay:       `{"complex":{"nested":null}}`,
+			ExpectedThreeWayResult: `{"complex":{}}`,
+		},
+		"add only not nulls": {
+			Original: `{}`,
+			Current:  `{}`,
+			Modified: `{"complex":{"nested":null,"nested2":"foo"}}`,
+
+			ExpectedTwoWay:         `{"complex":{"nested":null,"nested2":"foo"}}`,
+			ExpectedTwoWayResult:   `{"complex":{"nested2":"foo"}}`,
+			ExpectedThreeWay:       `{"complex":{"nested":null,"nested2":"foo"}}`,
+			ExpectedThreeWayResult: `{"complex":{"nested2":"foo"}}`,
+		},
+		"null values in original are preserved": {
+			Original: `{"thing":null}`,
+			Current:  `{"thing":null}`,
+			Modified: `{"nested":{"value":5},"thing":null}`,
+
+			ExpectedTwoWay:         `{"nested":{"value":5}}`,
+			ExpectedTwoWayResult:   `{"nested":{"value":5},"thing":null}`,
+			ExpectedThreeWay:       `{"nested":{"value":5}}`,
+			ExpectedThreeWayResult: `{"nested":{"value":5},"thing":null}`,
+		},
+		"nested null values in original are preserved": {
+			Original: `{"complex":{"key":null},"thing":null}`,
+			Current:  `{"complex":{"key":null},"thing":null}`,
+			Modified: `{"complex":{"key":null},"nested":{"value":5},"thing":null}`,
+
+			ExpectedTwoWay:         `{"nested":{"value":5}}`,
+			ExpectedTwoWayResult:   `{"complex":{"key":null},"nested":{"value":5},"thing":null}`,
+			ExpectedThreeWay:       `{"nested":{"value":5}}`,
+			ExpectedThreeWayResult: `{"complex":{"key":null},"nested":{"value":5},"thing":null}`,
+		},
+		"add empty slices": {
+			Original: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Current:  `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Modified: `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":[],"name":"foo","scalar":true}`,
+
+			ExpectedTwoWay:         `{"complex_nullable":[]}`,
+			ExpectedTwoWayResult:   `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":[],"name":"foo","scalar":true}`,
+			ExpectedThreeWay:       `{"complex_nullable":[]}`,
+			ExpectedThreeWayResult: `{"array":[1,2,3],"complex":{"nested":true},"complex_nullable":[],"name":"foo","scalar":true}`,
+		},
+		"filter nulls from nested slices": {
+			Original: `{}`,
+			Current:  `{}`,
+			Modified: `{"complex_nullable":[{"inner_one":{"key_one":"foo","key_two":null}}]}`,
+
+			ExpectedTwoWay:         `{"complex_nullable":[{"inner_one":{"key_one":"foo","key_two":null}}]}`,
+			ExpectedTwoWayResult:   `{"complex_nullable":[{"inner_one":{"key_one":"foo"}}]}`,
+			ExpectedThreeWay:       `{"complex_nullable":[{"inner_one":{"key_one":"foo","key_two":null}}]}`,
+			ExpectedThreeWayResult: `{"complex_nullable":[{"inner_one":{"key_one":"foo"}}]}`,
+		},
+		"filter if slice is all empty": {
+			Original: `{}`,
+			Current:  `{}`,
+			Modified: `{"complex_nullable":[{"inner_one":{"key_one":null,"key_two":null}}]}`,
+
+			ExpectedTwoWay:         `{"complex_nullable":[{"inner_one":{"key_one":null,"key_two":null}}]}`,
+			ExpectedTwoWayResult:   `{"complex_nullable":[{"inner_one":{}}]}`,
+			ExpectedThreeWay:       `{"complex_nullable":[{"inner_one":{"key_one":null,"key_two":null}}]}`,
+			ExpectedThreeWayResult: `{"complex_nullable":[{"inner_one":{}}]}`,
+		},
+		"not filter nulls from non-associative slice": {
+			Original: `{}`,
+			Current:  `{}`,
+			Modified: `{"complex_nullable":["key1",null,"key2"]}`,
+
+			ExpectedTwoWay:         `{"complex_nullable":["key1",null,"key2"]}`,
+			ExpectedTwoWayResult:   `{"complex_nullable":["key1",null,"key2"]}`,
+			ExpectedThreeWay:       `{"complex_nullable":["key1",null,"key2"]}`,
+			ExpectedThreeWayResult: `{"complex_nullable":["key1",null,"key2"]}`,
+		},
+		"added only": {
+			Original: `{"name":"foo"}`,
+			Current:  `{"name":"foo"}`,
+			Modified: `{"name":"foo","scalar":true,"complex":{"nested":true},"array":[1,2,3]}`,
+
+			ExpectedTwoWay:         `{"array":[1,2,3],"complex":{"nested":true},"scalar":true}`,
+			ExpectedTwoWayResult:   `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			ExpectedThreeWay:       `{"array":[1,2,3],"complex":{"nested":true},"scalar":true}`,
+			ExpectedThreeWayResult: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+		},
+		"removed only": {
+			Original: `{"name":"foo","scalar":true,"complex":{"nested":true}}`,
+			Current:  `{"name":"foo","scalar":true,"complex":{"nested":true},"array":[1,2,3]}`,
+			Modified: `{"name":"foo"}`,
+
+			ExpectedTwoWay:         `{"complex":null,"scalar":null}`,
+			ExpectedTwoWayResult:   `{"name":"foo"}`,
+			ExpectedThreeWay:       `{"complex":null,"scalar":null}`,
+			ExpectedThreeWayResult: `{"array":[1,2,3],"name":"foo"}`,
+		},
+
+		// cases we cannot successfully strategically merge (expect errors)
+		"diff": {
+			Original: `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Current:  `{"array":[1,2,3],"complex":{"nested":true},"name":"foo","scalar":true}`,
+			Modified: `{"array":[1,2,3],"complex":{"nested":false},"name":"foo","scalar":true}`,
+
+			ExpectedTwoWayErr:   `unable to find api field`,
+			ExpectedThreeWayErr: `unable to find api field`,
+		},
+
+		"json": {
+			Original: `{"name":"foo","jsonItem":{"nested":{"nested2":{"nested3":{}}}}}`,
+			Current:  `{"name":"foo","jsonItem":{"nested":{"nested2":{"nested3":{}}}}}`,
+			Modified: `{"name":"foo","jsonItem":{"nested":{"nested2":{"nested3":{"a":"b"}}}}}`,
+
+			ExpectedTwoWay:         `{"jsonItem":{"nested":{"nested2":{"nested3":{"a":"b"}}}}}`,
+			ExpectedTwoWayResult:   `{"jsonItem":{"nested":{"nested2":{"nested3":{"a":"b"}}}},"name":"foo"}`,
+			ExpectedThreeWay:       `{"jsonItem":{"nested":{"nested2":{"nested3":{"a":"b"}}}}}`,
+			ExpectedThreeWayResult: `{"jsonItem":{"nested":{"nested2":{"nested3":{"a":"b"}}}},"name":"foo"}`,
+			ExpectedTwoWayErr:      `unable to find api field`,
+			ExpectedThreeWayErr:    `unable to find api field`,
+		},
+	}
+
+	mergeItemOpenapiSchema := PatchMetaFromOpenAPI{
+		Schema: sptest.GetSchemaOrDie(&fakeMergeItemSchema, "mergeItem"),
+	}
+	mergeItemOpenapiV3Schema := PatchMetaFromOpenAPIV3{
+		SchemaList: fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas,
+		Schema:     fakeMergeItemV3Schema.SchemaOrDie().Components.Schemas["mergeItem"],
+	}
+	schemas := []LookupPatchMeta{
+		mergeItemStructSchema,
+		mergeItemOpenapiSchema,
+		mergeItemOpenapiV3Schema,
+	}
+
+	for _, k := range sets.StringKeySet(testcases).List() {
+		t.Run(k, func(t *testing.T) {
+			tc := testcases[k]
+			for _, schema := range schemas {
+				t.Run(schema.Name()+"/TwoWay", func(t *testing.T) {
+					twoWay, err := CreateTwoWayMergePatchUsingLookupPatchMeta([]byte(tc.Original), []byte(tc.Modified), schema)
+					if err != nil {
+						if len(tc.ExpectedTwoWayErr) == 0 {
+							t.Errorf("using %s in testcase %s: error making two-way patch: %v", getSchemaType(schema), k, err)
+						}
+						if !strings.Contains(err.Error(), tc.ExpectedTwoWayErr) {
+							t.Errorf("using %s in testcase %s: expected error making two-way patch to contain '%s', got %s", getSchemaType(schema), k, tc.ExpectedTwoWayErr, err)
+						}
+						return
+					}
+
+					if string(twoWay) != tc.ExpectedTwoWay {
+						t.Errorf("using %s in testcase %s: expected two-way patch:\n\t%s\ngot\n\t%s", getSchemaType(schema), k, string(tc.ExpectedTwoWay), string(twoWay))
+						return
+					}
+
+					twoWayResult, err := StrategicMergePatchUsingLookupPatchMeta([]byte(tc.Original), twoWay, schema)
+					if err != nil {
+						t.Errorf("using %s in testcase %s: error applying two-way patch: %v", getSchemaType(schema), k, err)
+						return
+					}
+					if string(twoWayResult) != tc.ExpectedTwoWayResult {
+						t.Errorf("using %s in testcase %s: expected two-way result:\n\t%s\ngot\n\t%s", getSchemaType(schema), k, string(tc.ExpectedTwoWayResult), string(twoWayResult))
+						return
+					}
+				})
+
+				t.Run(schema.Name()+"/ThreeWay", func(t *testing.T) {
+					threeWay, err := CreateThreeWayMergePatch([]byte(tc.Original), []byte(tc.Modified), []byte(tc.Current), schema, false)
+					if err != nil {
+						if len(tc.ExpectedThreeWayErr) == 0 {
+							t.Errorf("using %s in testcase %s: error making three-way patch: %v", getSchemaType(schema), k, err)
+						} else if !strings.Contains(err.Error(), tc.ExpectedThreeWayErr) {
+							t.Errorf("using %s in testcase %s: expected error making three-way patch to contain '%s', got %s", getSchemaType(schema), k, tc.ExpectedThreeWayErr, err)
+						}
+						return
+					}
+
+					if string(threeWay) != tc.ExpectedThreeWay {
+						t.Errorf("using %s in testcase %s: expected three-way patch:\n\t%s\ngot\n\t%s", getSchemaType(schema), k, string(tc.ExpectedThreeWay), string(threeWay))
+						return
+					}
+
+					threeWayResult, err := StrategicMergePatchUsingLookupPatchMeta([]byte(tc.Current), threeWay, schema)
+					if err != nil {
+						t.Errorf("using %s in testcase %s: error applying three-way patch: %v", getSchemaType(schema), k, err)
+						return
+					} else if string(threeWayResult) != tc.ExpectedThreeWayResult {
+						t.Errorf("using %s in testcase %s: expected three-way result:\n\t%s\ngot\n\t%s", getSchemaType(schema), k, string(tc.ExpectedThreeWayResult), string(threeWayResult))
+						return
+					}
+				})
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-merge-item-v3.json b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-merge-item-v3.json
new file mode 100644
index 0000000000..f5178156e2
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-merge-item-v3.json
@@ -0,0 +1,183 @@
+{
+  "openapi": "3.0",
+  "info": {
+    "title": "StrategicMergePatchTestingMergeItem",
+    "version": "v3.0"
+  },
+  "paths": {},
+  "components": {
+    "schemas": {
+      "mergeItem": {
+        "description": "MergeItem is type definition for testing strategic merge.",
+        "required": [],
+        "properties": {
+          "name": {
+            "description": "Name field.",
+            "type": "string"
+          },
+          "value": {
+            "description": "Value field.",
+            "type": "string"
+          },
+          "other": {
+            "description": "Other field.",
+            "type": "string"
+          },
+          "mergingList": {
+            "description": "MergingList field.",
+            "type": "array",
+            "items": {
+              "default": {},
+              "allOf": [
+                {"$ref": "#/components/schemas/mergeItem"}
+              ]
+            },
+            "x-kubernetes-patch-merge-key": "name",
+            "x-kubernetes-patch-strategy": "merge"
+          },
+          "nonMergingList": {
+            "description": "NonMergingList field.",
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/mergeItem"
+            }
+          },
+          "mergingIntList": {
+            "description": "MergingIntList field.",
+            "type": "array",
+            "items": {
+              "type": "integer",
+              "format": "int32"
+            },
+            "x-kubernetes-patch-strategy": "merge"
+          },
+          "nonMergingIntList": {
+            "description": "NonMergingIntList field.",
+            "type": "array",
+            "items": {
+              "type": "integer",
+              "format": "int32"
+            }
+          },
+          "mergeItemPtr": {
+            "description": "MergeItemPtr field.",
+            "allOf": [
+              {"$ref": "#/components/schemas/mergeItem"}
+            ],
+            "x-kubernetes-patch-merge-key": "name",
+            "x-kubernetes-patch-strategy": "merge"
+          },
+          "simpleMap": {
+            "description": "SimpleMap field.",
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            }
+          },
+          "replacingItem": {
+            "description": "ReplacingItem field.",
+            "allOf": [
+              {"$ref": "#/components/schemas/io.k8s.apimachinery.pkg.runtime.RawExtension"}
+            ],
+            "x-kubernetes-patch-strategy": "replace"
+          },
+          "retainKeysMap": {
+            "description": "RetainKeysMap field.",
+            "allOf": [
+              {"$ref": "#/components/schemas/retainKeysMergeItem"}
+            ],
+            "x-kubernetes-patch-strategy": "retainKeys"
+          },
+          "retainKeysMergingList": {
+            "description": "RetainKeysMergingList field.",
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/mergeItem"
+            },
+            "x-kubernetes-patch-merge-key": "name",
+            "x-kubernetes-patch-strategy": "merge,retainKeys"
+          },
+          "jsonItem": {
+            "description": "Values are the chart values."
+          }
+        },
+        "x-kubernetes-group-version-kind": [
+          {
+            "group": "fake-group",
+            "kind": "mergeItem",
+            "version": "some-version"
+          }
+        ]
+      },
+      "retainKeysMergeItem": {
+        "description": "RetainKeysMergeItem is type definition for testing strategic merge.",
+        "required": [],
+        "properties": {
+          "name": {
+            "description": "Name field.",
+            "type": "string"
+          },
+          "value": {
+            "description": "Value field.",
+            "type": "string"
+          },
+          "other": {
+            "description": "Other field.",
+            "type": "string"
+          },
+          "simpleMap": {
+            "description": "SimpleMap field.",
+            "items": {
+              "type": "string"
+            }
+          },
+          "mergingList": {
+            "description": "MergingList field.",
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/mergeItem"
+            },
+            "x-kubernetes-patch-merge-key": "name",
+            "x-kubernetes-patch-strategy": "merge"
+          },
+          "nonMergingList": {
+            "description": "NonMergingList field.",
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/mergeItem"
+            }
+          },
+          "mergingIntList": {
+            "description": "MergingIntList field.",
+            "type": "array",
+            "items": {
+              "type": "integer",
+              "format": "int32"
+            },
+            "x-kubernetes-patch-strategy": "merge"
+          }
+        },
+        "x-kubernetes-group-version-kind": [
+          {
+            "group": "fake-group",
+            "kind": "retainKeysMergeItem",
+            "version": "some-version"
+          }
+        ]
+      },
+      "io.k8s.apimachinery.pkg.runtime.RawExtension": {
+        "description": "RawExtension is used to hold extensions in external versions.",
+        "required": [
+          "Raw"
+        ],
+        "properties": {
+          "Raw": {
+            "description": "Raw is the underlying serialization of this object.",
+            "type": "string",
+            "format": "byte"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-merge-item.json b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-merge-item.json
new file mode 100644
index 0000000000..c5abe757ec
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-merge-item.json
@@ -0,0 +1,173 @@
+{
+  "swagger": "2.0",
+  "info": {
+    "title": "StrategicMergePatchTestingMergeItem",
+    "version": "v1.9.0"
+  },
+  "paths": {},
+  "definitions": {
+    "mergeItem": {
+      "description": "MergeItem is type definition for testing strategic merge.",
+      "required": [],
+      "properties": {
+        "name": {
+          "description": "Name field.",
+          "type": "string"
+        },
+        "value": {
+          "description": "Value field.",
+          "type": "string"
+        },
+        "other": {
+          "description": "Other field.",
+          "type": "string"
+        },
+        "mergingList": {
+          "description": "MergingList field.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/mergeItem"
+          },
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "nonMergingList": {
+          "description": "NonMergingList field.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/mergeItem"
+          }
+        },
+        "mergingIntList": {
+          "description": "MergingIntList field.",
+          "type": "array",
+          "items": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "nonMergingIntList": {
+          "description": "NonMergingIntList field.",
+          "type": "array",
+          "items": {
+            "type": "integer",
+            "format": "int32"
+          }
+        },
+        "mergeItemPtr": {
+          "description": "MergeItemPtr field.",
+          "$ref": "#/definitions/mergeItem",
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "simpleMap": {
+          "description": "SimpleMap field.",
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+        "replacingItem": {
+          "description": "ReplacingItem field.",
+          "$ref": "#/definitions/io.k8s.apimachinery.pkg.runtime.RawExtension",
+          "x-kubernetes-patch-strategy": "replace"
+        },
+        "retainKeysMap": {
+          "description": "RetainKeysMap field.",
+          "$ref": "#/definitions/retainKeysMergeItem",
+          "x-kubernetes-patch-strategy": "retainKeys"
+        },
+        "retainKeysMergingList": {
+          "description": "RetainKeysMergingList field.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/mergeItem"
+          },
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge,retainKeys"
+        },
+        "jsonItem": {
+          "description": "JSON field",
+        }
+      },
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "fake-group",
+          "kind": "mergeItem",
+          "version": "some-version"
+        }
+      ]
+    },
+    "retainKeysMergeItem": {
+      "description": "RetainKeysMergeItem is type definition for testing strategic merge.",
+      "required": [],
+      "properties": {
+        "name": {
+          "description": "Name field.",
+          "type": "string"
+        },
+        "value": {
+          "description": "Value field.",
+          "type": "string"
+        },
+        "other": {
+          "description": "Other field.",
+          "type": "string"
+        },
+        "simpleMap": {
+          "description": "SimpleMap field.",
+          "additionalProperties": "object",
+          "items": {
+            "type": "string"
+          }
+        },
+        "mergingList": {
+          "description": "MergingList field.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/mergeItem"
+          },
+          "x-kubernetes-patch-merge-key": "name",
+          "x-kubernetes-patch-strategy": "merge"
+        },
+        "nonMergingList": {
+          "description": "NonMergingList field.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/mergeItem"
+          }
+        },
+        "mergingIntList": {
+          "description": "MergingIntList field.",
+          "type": "array",
+          "items": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "x-kubernetes-patch-strategy": "merge"
+        }
+      },
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "fake-group",
+          "kind": "retainKeysMergeItem",
+          "version": "some-version"
+        }
+      ]
+    },
+    "io.k8s.apimachinery.pkg.runtime.RawExtension": {
+      "description": "RawExtension is used to hold extensions in external versions.",
+      "required": [
+        "Raw"
+      ],
+      "properties": {
+        "Raw": {
+          "description": "Raw is the underlying serialization of this object.",
+          "type": "string",
+          "format": "byte"
+        }
+      }
+    }
+  }
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-precision-item-v3.json b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-precision-item-v3.json
new file mode 100644
index 0000000000..0101c41028
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-precision-item-v3.json
@@ -0,0 +1,49 @@
+{
+  "openapi": "3.0",
+  "info": {
+    "title": "StrategicMergePatchTestingPrecisionItem",
+    "version": "v1.9.0"
+  },
+  "paths": {},
+  "components": {
+    "schemas": {
+      "precisionItem": {
+        "description": "PrecisionItem is type definition for testing strategic merge.",
+        "required": [],
+        "properties": {
+          "name": {
+            "description": "Name field.",
+            "type": "string"
+          },
+          "int32": {
+            "description": "Int32 field.",
+            "type": "integer",
+            "format": "int32"
+          },
+          "int64": {
+            "description": "Int64 field.",
+            "type": "integer",
+            "format": "int64"
+          },
+          "float32": {
+            "description": "Float32 field.",
+            "type": "number",
+            "format": "float32"
+          },
+          "float64": {
+            "description": "Float64 field.",
+            "type": "number",
+            "format": "float64"
+          }
+        },
+        "x-kubernetes-group-version-kind": [
+          {
+            "group": "fake-group",
+            "kind": "precisionItem",
+            "version": "some-version"
+          }
+        ]
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-precision-item.json b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-precision-item.json
new file mode 100644
index 0000000000..a35ae31f65
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testdata/swagger-precision-item.json
@@ -0,0 +1,47 @@
+{
+  "swagger": "2.0",
+  "info": {
+    "title": "StrategicMergePatchTestingPrecisionItem",
+    "version": "v1.9.0"
+  },
+  "paths": {},
+  "definitions": {
+    "precisionItem": {
+      "description": "PrecisionItem is type definition for testing strategic merge.",
+      "required": [],
+      "properties": {
+        "name": {
+          "description": "Name field.",
+          "type": "string"
+        },
+        "int32": {
+          "description": "Int32 field.",
+          "type": "integer",
+          "format": "int32"
+        },
+        "int64": {
+          "description": "Int64 field.",
+          "type": "integer",
+          "format": "int64"
+        },
+        "float32": {
+          "description": "Float32 field.",
+          "type": "number",
+          "format": "float32"
+        },
+        "float64": {
+          "description": "Float64 field.",
+          "type": "number",
+          "format": "float64"
+        }
+      },
+      "x-kubernetes-group-version-kind": [
+        {
+          "group": "fake-group",
+          "kind": "precisionItem",
+          "version": "some-version"
+        }
+      ]
+    }
+  }
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testing/openapi.go b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testing/openapi.go
new file mode 100644
index 0000000000..ae8fbfafac
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testing/openapi.go
@@ -0,0 +1,74 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"os"
+	"sync"
+
+	openapi_v2 "github.com/google/gnostic-models/openapiv2"
+	openapi "k8s.io/kube-openapi/pkg/util/proto"
+)
+
+// Fake opens and returns a openapi swagger from a file Path. It will
+// parse only once and then return the same copy everytime.
+type Fake struct {
+	Path string
+
+	once     sync.Once
+	document *openapi_v2.Document
+	err      error
+}
+
+// OpenAPISchema returns the openapi document and a potential error.
+func (f *Fake) OpenAPISchema() (*openapi_v2.Document, error) {
+	f.once.Do(func() {
+		_, err := os.Stat(f.Path)
+		if err != nil {
+			f.err = err
+			return
+		}
+		spec, err := os.ReadFile(f.Path)
+		if err != nil {
+			f.err = err
+			return
+		}
+		f.document, f.err = openapi_v2.ParseDocument(spec)
+	})
+	return f.document, f.err
+}
+
+func getSchema(f *Fake, model string) (openapi.Schema, error) {
+	s, err := f.OpenAPISchema()
+	if err != nil {
+		return nil, err
+	}
+	m, err := openapi.NewOpenAPIData(s)
+	if err != nil {
+		return nil, err
+	}
+	return m.LookupModel(model), nil
+}
+
+// GetSchemaOrDie returns the openapi schema.
+func GetSchemaOrDie(f *Fake, model string) openapi.Schema {
+	s, err := getSchema(f, model)
+	if err != nil {
+		panic(err)
+	}
+	return s
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testing/openapi3.go b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testing/openapi3.go
new file mode 100644
index 0000000000..895522b31a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/testing/openapi3.go
@@ -0,0 +1,65 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package testing
+
+import (
+	"os"
+	"sync"
+
+	"k8s.io/kube-openapi/pkg/spec3"
+)
+
+type OpenAPIV3Getter struct {
+	Path      string
+	once      sync.Once
+	bytes     []byte
+	openapiv3 spec3.OpenAPI
+}
+
+func (f *OpenAPIV3Getter) SchemaBytesOrDie() []byte {
+	f.once.Do(func() {
+		_, err := os.Stat(f.Path)
+		if err != nil {
+			panic(err)
+		}
+		spec, err := os.ReadFile(f.Path)
+		if err != nil {
+			panic(err)
+		}
+		f.bytes = spec
+	})
+	return f.bytes
+}
+
+func (f *OpenAPIV3Getter) SchemaOrDie() *spec3.OpenAPI {
+	f.once.Do(func() {
+		_, err := os.Stat(f.Path)
+		if err != nil {
+			panic(err)
+		}
+		spec, err := os.ReadFile(f.Path)
+		if err != nil {
+			panic(err)
+		}
+
+		err = f.openapiv3.UnmarshalJSON(spec)
+		if err != nil {
+			panic(err)
+		}
+	})
+	return &f.openapiv3
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/types.go b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/types.go
new file mode 100644
index 0000000000..f84d65aacb
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/strategicpatch/types.go
@@ -0,0 +1,193 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package strategicpatch
+
+import (
+	"errors"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/mergepatch"
+	openapi "k8s.io/kube-openapi/pkg/util/proto"
+)
+
+const (
+	patchStrategyOpenapiextensionKey = "x-kubernetes-patch-strategy"
+	patchMergeKeyOpenapiextensionKey = "x-kubernetes-patch-merge-key"
+)
+
+type LookupPatchItem interface {
+	openapi.SchemaVisitor
+
+	Error() error
+	Path() *openapi.Path
+}
+
+type kindItem struct {
+	key          string
+	path         *openapi.Path
+	err          error
+	patchmeta    PatchMeta
+	subschema    openapi.Schema
+	hasVisitKind bool
+}
+
+func NewKindItem(key string, path *openapi.Path) *kindItem {
+	return &kindItem{
+		key:  key,
+		path: path,
+	}
+}
+
+var _ LookupPatchItem = &kindItem{}
+
+func (item *kindItem) Error() error {
+	return item.err
+}
+
+func (item *kindItem) Path() *openapi.Path {
+	return item.path
+}
+
+func (item *kindItem) VisitPrimitive(schema *openapi.Primitive) {
+	item.err = errors.New("expected kind, but got primitive")
+}
+
+func (item *kindItem) VisitArray(schema *openapi.Array) {
+	item.err = errors.New("expected kind, but got slice")
+}
+
+func (item *kindItem) VisitMap(schema *openapi.Map) {
+	item.err = errors.New("expected kind, but got map")
+}
+
+func (item *kindItem) VisitReference(schema openapi.Reference) {
+	if !item.hasVisitKind {
+		schema.SubSchema().Accept(item)
+	}
+}
+
+func (item *kindItem) VisitKind(schema *openapi.Kind) {
+	subschema, ok := schema.Fields[item.key]
+	if !ok {
+		item.err = FieldNotFoundError{Path: schema.GetPath().String(), Field: item.key}
+		return
+	}
+
+	mergeKey, patchStrategies, err := parsePatchMetadata(subschema.GetExtensions())
+	if err != nil {
+		item.err = err
+		return
+	}
+	item.patchmeta = PatchMeta{
+		patchStrategies: patchStrategies,
+		patchMergeKey:   mergeKey,
+	}
+	item.subschema = subschema
+}
+
+type sliceItem struct {
+	key          string
+	path         *openapi.Path
+	err          error
+	patchmeta    PatchMeta
+	subschema    openapi.Schema
+	hasVisitKind bool
+}
+
+func NewSliceItem(key string, path *openapi.Path) *sliceItem {
+	return &sliceItem{
+		key:  key,
+		path: path,
+	}
+}
+
+var _ LookupPatchItem = &sliceItem{}
+
+func (item *sliceItem) Error() error {
+	return item.err
+}
+
+func (item *sliceItem) Path() *openapi.Path {
+	return item.path
+}
+
+func (item *sliceItem) VisitPrimitive(schema *openapi.Primitive) {
+	item.err = errors.New("expected slice, but got primitive")
+}
+
+func (item *sliceItem) VisitArray(schema *openapi.Array) {
+	if !item.hasVisitKind {
+		item.err = errors.New("expected visit kind first, then visit array")
+	}
+	subschema := schema.SubType
+	item.subschema = subschema
+}
+
+func (item *sliceItem) VisitMap(schema *openapi.Map) {
+	item.err = errors.New("expected slice, but got map")
+}
+
+func (item *sliceItem) VisitReference(schema openapi.Reference) {
+	if !item.hasVisitKind {
+		schema.SubSchema().Accept(item)
+	} else {
+		item.subschema = schema.SubSchema()
+	}
+}
+
+func (item *sliceItem) VisitKind(schema *openapi.Kind) {
+	subschema, ok := schema.Fields[item.key]
+	if !ok {
+		item.err = FieldNotFoundError{Path: schema.GetPath().String(), Field: item.key}
+		return
+	}
+
+	mergeKey, patchStrategies, err := parsePatchMetadata(subschema.GetExtensions())
+	if err != nil {
+		item.err = err
+		return
+	}
+	item.patchmeta = PatchMeta{
+		patchStrategies: patchStrategies,
+		patchMergeKey:   mergeKey,
+	}
+	item.hasVisitKind = true
+	subschema.Accept(item)
+}
+
+func parsePatchMetadata(extensions map[string]interface{}) (string, []string, error) {
+	ps, foundPS := extensions[patchStrategyOpenapiextensionKey]
+	var patchStrategies []string
+	var mergeKey, patchStrategy string
+	var ok bool
+	if foundPS {
+		patchStrategy, ok = ps.(string)
+		if ok {
+			patchStrategies = strings.Split(patchStrategy, ",")
+		} else {
+			return "", nil, mergepatch.ErrBadArgType(patchStrategy, ps)
+		}
+	}
+	mk, foundMK := extensions[patchMergeKeyOpenapiextensionKey]
+	if foundMK {
+		mergeKey, ok = mk.(string)
+		if !ok {
+			return "", nil, mergepatch.ErrBadArgType(mergeKey, mk)
+		}
+	}
+	return mergeKey, patchStrategies, nil
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/uuid/uuid.go b/third_party/k8s.io/apimachinery/pkg/util/uuid/uuid.go
new file mode 100644
index 0000000000..1fa351aab6
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/uuid/uuid.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package uuid
+
+import (
+	"github.com/google/uuid"
+
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func NewUUID() types.UID {
+	return types.UID(uuid.New().String())
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/validation/OWNERS b/third_party/k8s.io/apimachinery/pkg/util/validation/OWNERS
new file mode 100644
index 0000000000..4023732476
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/validation/OWNERS
@@ -0,0 +1,11 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+# Disable inheritance as this is an api owners file
+options:
+  no_parent_owners: true
+approvers:
+  - api-approvers
+reviewers:
+  - api-reviewers
+labels:
+  - kind/api-change
diff --git a/third_party/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go b/third_party/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go
new file mode 100644
index 0000000000..1a18b27666
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go
@@ -0,0 +1,397 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package field
+
+import (
+	"fmt"
+	"reflect"
+	"regexp"
+	"strings"
+)
+
+// NormalizationRule holds a pre-compiled regular expression and its replacement string
+// for normalizing field paths.
+type NormalizationRule struct {
+	Regexp      *regexp.Regexp
+	Replacement string
+}
+
+// ErrorMatcher is a helper for comparing Error objects.
+type ErrorMatcher struct {
+	// TODO(thockin): consider whether type is ever NOT required, maybe just
+	// assume it.
+	matchType bool
+	// TODO(thockin): consider whether field could be assumed - if the
+	// "want" error has a nil field, don't match on field.
+	matchField bool
+	// TODO(thockin): consider whether value could be assumed - if the
+	// "want" error has a nil value, don't match on value.
+	matchValue                    bool
+	matchOrigin                   bool
+	matchDetail                   func(want, got string) bool
+	requireOriginWhenInvalid      bool
+	matchValidationStabilityLevel bool
+	matchSource                   bool
+	matchAncestorShortCircuit     bool
+	matchShortCircuit             bool
+	// normalizationRules holds the pre-compiled regex patterns for path normalization.
+	normalizationRules []NormalizationRule
+}
+
+// isChildPath returns true if child is a descendant path of parent.
+// It avoids false positives like "spec.containers" being a child of "spec.container"
+// by explicitly checking for '.' or '[' path separators.
+func isChildPath(parent, child string) bool {
+	// "" as parent path not supported. It can un-intentionally match with any path.
+	// theoretically system errors can be matched with any path errors.
+	if len(parent) == 0 {
+		return false
+	}
+	if len(child) <= len(parent) {
+		return false
+	}
+	if child[:len(parent)] != parent {
+		return false
+	}
+	sep := child[len(parent)]
+	return sep == '.' || sep == '['
+}
+
+// Matches returns true if the two Error objects match according to the
+// configured criteria. When field normalization is configured, only the
+// "got" error's field path is normalized (to bring older API versions up
+// to the internal/latest format), while "want" is assumed to already be
+// in the canonical internal API format.
+func (m ErrorMatcher) Matches(want, got *Error) bool {
+	gotField := got.Field
+	if want.Field != gotField {
+		gotField = m.normalizePath(gotField)
+	}
+	if m.matchAncestorShortCircuit {
+		if got.ShortCircuit && (isChildPath(gotField, want.Field) || isChildPath(got.Field, want.Field)) {
+			return true
+		}
+	}
+
+	if m.matchType && want.Type != got.Type {
+		return false
+	}
+	if m.matchField && want.Field != gotField {
+		return false
+	}
+	if m.matchValue && !reflect.DeepEqual(want.BadValue, got.BadValue) {
+		return false
+	}
+
+	if m.matchOrigin {
+		if want.Origin != got.Origin {
+			return false
+		}
+		if m.requireOriginWhenInvalid && want.Type == ErrorTypeInvalid {
+			if want.Origin == "" || got.Origin == "" {
+				return false
+			}
+		}
+	}
+	if m.matchDetail != nil && !m.matchDetail(want.Detail, got.Detail) {
+		return false
+	}
+	if m.matchValidationStabilityLevel && want.ValidationStabilityLevel != got.ValidationStabilityLevel {
+		return false
+	}
+	if m.matchSource && want.FromImperative != got.FromImperative {
+		return false
+	}
+	if m.matchShortCircuit && want.ShortCircuit != got.ShortCircuit {
+		return false
+	}
+
+	return true
+}
+
+// normalizePath applies configured path normalization rules.
+func (m ErrorMatcher) normalizePath(path string) string {
+	for _, rule := range m.normalizationRules {
+		normalized := rule.Regexp.ReplaceAllString(path, rule.Replacement)
+		if normalized != path {
+			// Only apply the first matching rule.
+			return normalized
+		}
+	}
+	return path
+}
+
+// Render returns a string representation of the specified Error object,
+// according to the criteria configured in the ErrorMatcher.
+func (m ErrorMatcher) Render(e *Error) string {
+	buf := strings.Builder{}
+
+	comma := func() {
+		if buf.Len() > 0 {
+			buf.WriteString(", ")
+		}
+	}
+
+	if m.matchType {
+		comma()
+		fmt.Fprintf(&buf, "Type=%q", e.Type)
+	}
+	if m.matchField {
+		comma()
+		if normalized := m.normalizePath(e.Field); normalized != e.Field {
+			fmt.Fprintf(&buf, "Field=%q (aka %q)", normalized, e.Field)
+		} else {
+			fmt.Fprintf(&buf, "Field=%q", e.Field)
+		}
+	}
+	if m.matchValue {
+		comma()
+		if s, ok := e.BadValue.(string); ok {
+			fmt.Fprintf(&buf, "Value=%q", s)
+		} else {
+			rv := reflect.ValueOf(e.BadValue)
+			if rv.Kind() == reflect.Pointer && !rv.IsNil() {
+				rv = rv.Elem()
+			}
+			if rv.IsValid() && rv.CanInterface() {
+				fmt.Fprintf(&buf, "Value=%v", rv.Interface())
+			} else {
+				fmt.Fprintf(&buf, "Value=%v", e.BadValue)
+			}
+		}
+	}
+	if m.matchOrigin || m.requireOriginWhenInvalid && e.Type == ErrorTypeInvalid {
+		comma()
+		fmt.Fprintf(&buf, "Origin=%q", e.Origin)
+	}
+	if m.matchDetail != nil {
+		comma()
+		fmt.Fprintf(&buf, "Detail=%q", e.Detail)
+	}
+	if m.matchValidationStabilityLevel {
+		comma()
+		fmt.Fprintf(&buf, "ValidationStabilityLevel=%s", e.ValidationStabilityLevel)
+	}
+	if m.matchSource {
+		comma()
+		fmt.Fprintf(&buf, "FromImperative=%t", e.FromImperative)
+	}
+	if m.matchShortCircuit {
+		comma()
+		fmt.Fprintf(&buf, "ShortCircuit=%t", e.ShortCircuit)
+	}
+	return "{" + buf.String() + "}"
+}
+
+// Exactly returns a derived ErrorMatcher which matches all fields exactly.
+func (m ErrorMatcher) Exactly() ErrorMatcher {
+	return m.ByType().ByField().ByValue().ByOrigin().ByDetailExact()
+}
+
+// ByType returns a derived ErrorMatcher which also matches by type.
+func (m ErrorMatcher) ByType() ErrorMatcher {
+	m.matchType = true
+	return m
+}
+
+// ByField returns a derived ErrorMatcher which also matches by field path.
+// If you need to mutate the field path (e.g. to normalize across versions),
+// see ByFieldNormalized.
+func (m ErrorMatcher) ByField() ErrorMatcher {
+	m.matchField = true
+	return m
+}
+
+// ByFieldNormalized returns a derived ErrorMatcher which also matches by field path
+// after applying normalization rules to the actual (got) error's field path.
+// This allows matching field paths from older API versions against the canonical
+// internal API format.
+//
+// The normalization rules are applied ONLY to the "got" error's field path, bringing
+// older API version field paths up to the latest/internal format. The "want" error
+// is assumed to always be in the internal API format (latest).
+//
+// The rules slice holds pre-compiled regular expressions and their replacement strings.
+//
+// Example:
+//
+//	rules := []NormalizationRule{
+//	  {
+//	    Regexp:      regexp.MustCompile(`spec\.devices\.requests\[(\d+)\]\.allocationMode`),
+//	    Replacement: "spec.devices.requests[$1].exactly.allocationMode",
+//	  },
+//	}
+//	matcher := ErrorMatcher{}.ByFieldNormalized(rules)
+func (m ErrorMatcher) ByFieldNormalized(rules []NormalizationRule) ErrorMatcher {
+	m.matchField = true
+	m.normalizationRules = rules
+	return m
+}
+
+// ByValue returns a derived ErrorMatcher which also matches by the errant
+// value.
+func (m ErrorMatcher) ByValue() ErrorMatcher {
+	m.matchValue = true
+	return m
+}
+
+// ByOrigin returns a derived ErrorMatcher which also matches by the origin.
+// When this is used and an origin is set in the error, the matcher will
+// consider all expected errors with the same origin to be a match. The only
+// expception to this is when it finds two errors which are exactly identical,
+// which is too suspicious to ignore. This multi-matching allows tests to
+// express a single expectation ("I set the X field to an invalid value, and I
+// expect an error from origin Y") without having to know exactly how many
+// errors might be returned, or in what order, or with what wording.
+func (m ErrorMatcher) ByOrigin() ErrorMatcher {
+	m.matchOrigin = true
+	return m
+}
+
+// RequireOriginWhenInvalid returns a derived ErrorMatcher which also requires
+// the Origin field to be set when the Type is Invalid and the matcher is
+// matching by Origin.
+func (m ErrorMatcher) RequireOriginWhenInvalid() ErrorMatcher {
+	m.requireOriginWhenInvalid = true
+	return m
+}
+
+// BySource returns a derived ErrorMatcher which also matches by the error origination
+// value of field errors.
+func (m ErrorMatcher) BySource() ErrorMatcher {
+	m.matchSource = true
+	return m
+}
+
+// MatchAncestorShortCircuit returns a derived ErrorMatcher which also matches when the "got" error short-circuited at an ancestor of the "want" error's field path.
+func (m ErrorMatcher) MatchAncestorShortCircuit() ErrorMatcher {
+	m.matchAncestorShortCircuit = true
+	return m
+}
+
+// MatchShortCircuit returns a derived ErrorMatcher which also matches by the ShortCircuit value.
+func (m ErrorMatcher) MatchShortCircuit() ErrorMatcher {
+	m.matchShortCircuit = true
+	return m
+}
+
+// ByValidationStabilityLevel returns a derived ErrorMatcher which also matches by the validation stability level
+// value of field errors.
+func (m ErrorMatcher) ByValidationStabilityLevel() ErrorMatcher {
+	m.matchValidationStabilityLevel = true
+	return m
+}
+
+// ByDetailExact returns a derived ErrorMatcher which also matches errors by
+// the exact detail string.
+func (m ErrorMatcher) ByDetailExact() ErrorMatcher {
+	m.matchDetail = func(want, got string) bool {
+		return got == want
+	}
+	return m
+}
+
+// ByDetailSubstring returns a derived ErrorMatcher which also matches errors
+// by a substring of the detail string.
+func (m ErrorMatcher) ByDetailSubstring() ErrorMatcher {
+	m.matchDetail = func(want, got string) bool {
+		return strings.Contains(got, want)
+	}
+	return m
+}
+
+// ByDetailRegexp returns a derived ErrorMatcher which also matches errors by a
+// regular expression of the detail string, where the "want" string is assumed
+// to be a valid regular expression.
+func (m ErrorMatcher) ByDetailRegexp() ErrorMatcher {
+	m.matchDetail = func(want, got string) bool {
+		return regexp.MustCompile(want).MatchString(got)
+	}
+	return m
+}
+
+// TestIntf lets users pass a testing.T while not coupling this package to Go's
+// testing package.
+type TestIntf interface {
+	Helper()
+	Errorf(format string, args ...any)
+}
+
+// Test compares two ErrorLists by the criteria configured in this matcher, and
+// fails the test if they don't match. The "want" errors are expected to be in
+// the internal API format (latest), while "got" errors may be from any API version
+// and will be normalized if field normalization rules are configured.
+//
+// If matching by origin is enabled and the error has a non-empty origin, a given
+// "want" error can match multiple "got" errors, and they will all be consumed.
+// The only exception to this is if the matcher got multiple identical (in every way,
+// even those not being matched on) errors, which is likely to indicate a bug.
+// This doesn't support matchAncestorShortCircuit as it it not needed to be used in the tests.
+func (m ErrorMatcher) Test(tb TestIntf, want, got ErrorList) {
+	tb.Helper()
+
+	if m.matchAncestorShortCircuit {
+		tb.Errorf("matchAncestorShortCircuit is not supported for test")
+	}
+	exactly := m.Exactly() // makes a copy
+
+	// If we ever find an EXACT duplicate error, it's almost certainly a bug
+	// worth reporting. If we ever find a use-case where this is not a bug, we
+	// can revisit this assumption.
+	seen := map[string]bool{}
+	for _, g := range got {
+		key := exactly.Render(g)
+		if seen[key] {
+			tb.Errorf("exact duplicate error:\n%s", key)
+		}
+		seen[key] = true
+	}
+
+	remaining := got
+	for _, w := range want {
+		tmp := make(ErrorList, 0, len(remaining))
+		matched := false
+		for i, g := range remaining {
+			if m.Matches(w, g) {
+				matched = true
+				if m.matchOrigin && w.Origin != "" {
+					// When origin is included in the match, we allow multiple
+					// matches against the same wanted error, so that tests
+					// can be insulated from the exact number, order, and
+					// wording of cases that might return more than one error.
+					continue
+				} else {
+					// Single-match, save the rest of the "got" errors and move
+					// on to the next "want" error.
+					tmp = append(tmp, remaining[i+1:]...)
+					break
+				}
+			} else {
+				tmp = append(tmp, g)
+			}
+		}
+		if !matched {
+			tb.Errorf("expected an error matching:\n%s", m.Render(w))
+		}
+		remaining = tmp
+	}
+	if len(remaining) > 0 {
+		for _, e := range remaining {
+			tb.Errorf("unmatched error:\n%s", exactly.Render(e))
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/validation/field/error_matcher_test.go b/third_party/k8s.io/apimachinery/pkg/util/validation/field/error_matcher_test.go
new file mode 100644
index 0000000000..bf7a94e3ae
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/validation/field/error_matcher_test.go
@@ -0,0 +1,789 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package field
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+func TestErrorMatcher_Matches(t *testing.T) {
+	baseErr := func() *Error {
+		return &Error{
+			Type:     ErrorTypeInvalid,
+			Field:    "field",
+			BadValue: "value",
+			Detail:   "detail",
+			Origin:   "origin",
+		}
+	}
+
+	testCases := []struct {
+		name      string
+		matcher   ErrorMatcher
+		wantedErr func() *Error
+		actualErr *Error
+		matches   bool
+	}{{
+		name:      "ByType: match",
+		matcher:   ErrorMatcher{}.ByType(),
+		wantedErr: baseErr,
+		actualErr: &Error{Type: ErrorTypeInvalid},
+		matches:   true,
+	}, {
+		name:      "ByType: no match",
+		matcher:   ErrorMatcher{}.ByType(),
+		wantedErr: baseErr,
+		actualErr: &Error{Type: ErrorTypeRequired},
+		matches:   false,
+	}, {
+		name:      "ByField: match",
+		matcher:   ErrorMatcher{}.ByField(),
+		wantedErr: baseErr,
+		actualErr: &Error{Field: "field"},
+		matches:   true,
+	}, {
+		name:      "ByField: no match",
+		matcher:   ErrorMatcher{}.ByField(),
+		wantedErr: baseErr,
+		actualErr: &Error{Field: "other"},
+		matches:   false,
+	}, {
+		name: "ByFieldNormalized: older API to latest",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "f[0].x.a"
+			return e
+		},
+		actualErr: &Error{Field: "f[0].a"},
+		matches:   true,
+	}, {
+		name: "ByFieldNormalized: both latest format",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "f[0].x.a"
+			return e
+		},
+		actualErr: &Error{Field: "f[0].x.a"},
+		matches:   true,
+	}, {
+		name: "ByFieldNormalized: different index",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "f[0].x.a"
+			return e
+		},
+		actualErr: &Error{Field: "f[1].a"},
+		matches:   false,
+	}, {
+		name: "ByFieldNormalized: multiple patterns",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.b`), Replacement: "f[$1].x.b"},
+		}),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "f[2].x.b"
+			return e
+		},
+		actualErr: &Error{Field: "f[2].b"},
+		matches:   true,
+	}, {
+		name: "ByFieldNormalized: no normalization needed",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "other.field"
+			return e
+		},
+		actualErr: &Error{Field: "other.field"},
+		matches:   true,
+	}, {
+		name:      "ByValue: match",
+		matcher:   ErrorMatcher{}.ByValue(),
+		wantedErr: baseErr,
+		actualErr: &Error{BadValue: "value"},
+		matches:   true,
+	}, {
+		name:      "ByValue: no match",
+		matcher:   ErrorMatcher{}.ByValue(),
+		wantedErr: baseErr,
+		actualErr: &Error{BadValue: "other"},
+		matches:   false,
+	}, {
+		name:      "ByOrigin: match",
+		matcher:   ErrorMatcher{}.ByOrigin(),
+		wantedErr: baseErr,
+		actualErr: &Error{Origin: "origin"},
+		matches:   true,
+	}, {
+		name:      "ByOrigin: no match",
+		matcher:   ErrorMatcher{}.ByOrigin(),
+		wantedErr: baseErr,
+		actualErr: &Error{Origin: "other"},
+		matches:   false,
+	}, {
+		name:      "ByDetailExact: match",
+		matcher:   ErrorMatcher{}.ByDetailExact(),
+		wantedErr: baseErr,
+		actualErr: &Error{Detail: "detail"},
+		matches:   true,
+	}, {
+		name:      "ByDetailExact: no match",
+		matcher:   ErrorMatcher{}.ByDetailExact(),
+		wantedErr: baseErr,
+		actualErr: &Error{Detail: "other"},
+		matches:   false,
+	}, {
+		name:    "ByDetailSubstring: match empty",
+		matcher: ErrorMatcher{}.ByDetailSubstring(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = ""
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailSubstring: match full",
+		matcher: ErrorMatcher{}.ByDetailSubstring(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "is the"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailSubstring: match start",
+		matcher: ErrorMatcher{}.ByDetailSubstring(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "this is"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailSubstring: match middle",
+		matcher: ErrorMatcher{}.ByDetailSubstring(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "is the"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailSubstring: match end",
+		matcher: ErrorMatcher{}.ByDetailSubstring(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "the detail"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailSubstring: no match",
+		matcher: ErrorMatcher{}.ByDetailSubstring(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "is not the"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   false,
+	}, {
+		name:    "ByDetailRegexp: match empty",
+		matcher: ErrorMatcher{}.ByDetailRegexp(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = ".*"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailRegexp: match full",
+		matcher: ErrorMatcher{}.ByDetailRegexp(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "^this is the detail$"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailRegexp: match start",
+		matcher: ErrorMatcher{}.ByDetailRegexp(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "^this is"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailRegexp: match middle",
+		matcher: ErrorMatcher{}.ByDetailRegexp(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "is the"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailRegexp: match end",
+		matcher: ErrorMatcher{}.ByDetailRegexp(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "the detail$"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailRegexp: match parts",
+		matcher: ErrorMatcher{}.ByDetailRegexp(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "^this .* .* detail$"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   true,
+	}, {
+		name:    "ByDetailRegexp: no match",
+		matcher: ErrorMatcher{}.ByDetailRegexp(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Detail = "is not the"
+			return e
+		},
+		actualErr: &Error{Detail: "this is the detail"},
+		matches:   false,
+	}, {
+		name:      "Exactly: match",
+		matcher:   ErrorMatcher{}.Exactly(),
+		wantedErr: baseErr,
+		actualErr: baseErr(),
+		matches:   true,
+	}, {
+		name:      "Exactly: no match (type)",
+		matcher:   ErrorMatcher{}.Exactly(),
+		wantedErr: baseErr,
+		actualErr: &Error{Type: ErrorTypeRequired, Field: "field", BadValue: "value", Detail: "detail", Origin: "origin"},
+		matches:   false,
+	}, {
+		name:      "RequireOriginWhenInvalid: match",
+		matcher:   ErrorMatcher{}.ByOrigin().RequireOriginWhenInvalid(),
+		wantedErr: baseErr,
+		actualErr: &Error{Type: ErrorTypeInvalid, Origin: "origin"},
+		matches:   true,
+	}, {
+		name:      "RequireOriginWhenInvalid: no match (missing origin)",
+		matcher:   ErrorMatcher{}.ByOrigin().RequireOriginWhenInvalid(),
+		wantedErr: baseErr,
+		actualErr: &Error{Type: ErrorTypeInvalid},
+		matches:   false,
+	}, {
+		name:    "BySource: match",
+		matcher: ErrorMatcher{}.BySource(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.FromImperative = true
+			return e
+		},
+		actualErr: &Error{FromImperative: true},
+		matches:   true,
+	}, {
+		name:    "BySource: no match",
+		matcher: ErrorMatcher{}.BySource(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.FromImperative = true
+			return e
+		},
+		actualErr: &Error{FromImperative: false},
+		matches:   false,
+	}, {
+		name:    "MatchShortCircuit: match",
+		matcher: ErrorMatcher{}.MatchShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.ShortCircuit = true
+			return e
+		},
+		actualErr: &Error{ShortCircuit: true},
+		matches:   true,
+	}, {
+		name:    "MatchShortCircuit: no match",
+		matcher: ErrorMatcher{}.MatchShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.ShortCircuit = true
+			return e
+		},
+		actualErr: &Error{ShortCircuit: false},
+		matches:   false,
+	}, {
+		name:    "MatchAncestorShortCircuit: child field match",
+		matcher: ErrorMatcher{}.ByType().ByField().MatchAncestorShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "field.child"
+			e.Type = ErrorTypeRequired // child error can be a different type
+			return e
+		},
+		actualErr: &Error{Field: "field", Type: ErrorTypeInvalid, Origin: "immutable", ShortCircuit: true}, // parent error short-circuited
+		matches:   true,
+	}, {
+		name:    "MatchAncestorShortCircuit: array child match",
+		matcher: ErrorMatcher{}.ByType().ByField().MatchAncestorShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "field[0]"
+			e.Type = ErrorTypeRequired
+			return e
+		},
+		actualErr: &Error{Field: "field", Type: ErrorTypeInvalid, Origin: "immutable", ShortCircuit: true},
+		matches:   true,
+	}, {
+		name:    "MatchAncestorShortCircuit: not a child",
+		matcher: ErrorMatcher{}.ByType().ByField().MatchAncestorShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "other.child"
+			return e
+		},
+		actualErr: &Error{Field: "field", Type: ErrorTypeInvalid, Origin: "immutable", ShortCircuit: true},
+		matches:   false,
+	}, {
+		name:    "MatchAncestorShortCircuit: substring but not child",
+		matcher: ErrorMatcher{}.ByType().ByField().MatchAncestorShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "field_other"
+			return e
+		},
+		actualErr: &Error{Field: "field", Type: ErrorTypeInvalid, Origin: "immutable", ShortCircuit: true},
+		matches:   false,
+	}, {
+		name:    "MatchAncestorShortCircuit: parent path is empty string",
+		matcher: ErrorMatcher{}.ByType().ByField().MatchAncestorShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "field.child"
+			return e
+		},
+		actualErr: &Error{Field: "", Type: ErrorTypeInvalid, Origin: "immutable", ShortCircuit: true},
+		matches:   false,
+	}, {
+		name: "MatchAncestorShortCircuit: child field match with normalized parent",
+		matcher: ErrorMatcher{}.ByType().ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}).MatchAncestorShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "f[0].x.a.child"
+			e.Type = ErrorTypeRequired
+			return e
+		},
+		actualErr: &Error{Field: "f[0].a", Type: ErrorTypeInvalid, Origin: "immutable", ShortCircuit: true},
+		matches:   true,
+	}, {
+		name: "MatchAncestorShortCircuit: child field match with unnormalized parent",
+		matcher: ErrorMatcher{}.ByType().ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}).MatchAncestorShortCircuit(),
+		wantedErr: func() *Error {
+			e := baseErr()
+			e.Field = "f[0].a.child"
+			e.Type = ErrorTypeRequired
+			return e
+		},
+		actualErr: &Error{Field: "f[0].a", Type: ErrorTypeInvalid, Origin: "immutable", ShortCircuit: true},
+		matches:   true,
+	}}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.matcher.Matches(tc.wantedErr(), tc.actualErr) != tc.matches {
+				t.Errorf("Matches() = %v, want %v", !tc.matches, tc.matches)
+			}
+		})
+	}
+}
+
+// fakeTestIntf is used to test the testing support.
+type fakeTestIntf struct {
+	errs []string
+}
+
+var _ TestIntf = &fakeTestIntf{}
+
+func (*fakeTestIntf) Helper() {}
+
+func (ft *fakeTestIntf) Errorf(format string, args ...any) {
+	ft.errs = append(ft.errs, fmt.Sprintf(format, args...))
+}
+
+func TestErrorMatcher_Test(t *testing.T) {
+	testCases := []struct {
+		name           string
+		matcher        ErrorMatcher
+		want           ErrorList
+		got            ErrorList
+		expectedErrors []string
+		expectedLogs   []string
+	}{{
+		name:    "no origin: perfect match",
+		matcher: ErrorMatcher{}.ByField(),
+		want:    ErrorList{Invalid(NewPath("f"), nil, "")},
+		got:     ErrorList{Invalid(NewPath("f"), "v", "d")},
+	}, {
+		name:           "no origin: got too few errors",
+		matcher:        ErrorMatcher{}.ByField(),
+		want:           ErrorList{Invalid(NewPath("f"), nil, "")},
+		got:            ErrorList{},
+		expectedErrors: []string{"expected an error matching:"},
+	}, {
+		name:           "no origin: got too many errors",
+		matcher:        ErrorMatcher{}.ByField(),
+		want:           ErrorList{},
+		got:            ErrorList{Invalid(NewPath("f"), "v", "d")},
+		expectedErrors: []string{"unmatched error:"},
+	}, {
+		name:           "no origin: got wrong errors",
+		matcher:        ErrorMatcher{}.ByField(),
+		want:           ErrorList{Invalid(NewPath("f1"), nil, "")},
+		got:            ErrorList{Invalid(NewPath("f2"), "v", "d")},
+		expectedErrors: []string{"expected an error matching:", "unmatched error:"},
+	}, {
+		name: "with normalization: older API to latest",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}),
+		want: ErrorList{Invalid(NewPath("f").Index(0).Child("x", "a"), nil, "")},
+		got:  ErrorList{Invalid(NewPath("f").Index(0).Child("a"), "v", "d")},
+	}, {
+		name: "with normalization: both latest",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}),
+		want: ErrorList{Invalid(NewPath("f").Index(0).Child("x", "a"), nil, "")},
+		got:  ErrorList{Invalid(NewPath("f").Index(0).Child("x", "a"), "v", "d")},
+	}, {
+		name: "with normalization: multiple",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.b`), Replacement: "f[$1].x.b"},
+		}),
+		want: ErrorList{
+			Invalid(NewPath("f").Index(0).Child("x", "a"), nil, ""),
+			Invalid(NewPath("f").Index(1).Child("x", "b"), nil, ""),
+		},
+		got: ErrorList{
+			Invalid(NewPath("f").Index(0).Child("a"), "v1", "d1"),
+			Invalid(NewPath("f").Index(1).Child("b"), "v2", "d2"),
+		},
+	}, {
+		name: "with normalization: no match",
+		matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+			{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+		}),
+		want:           ErrorList{Invalid(NewPath("f").Index(0).Child("x", "a"), nil, "")},
+		got:            ErrorList{Invalid(NewPath("f").Index(1).Child("a"), "v", "d")},
+		expectedErrors: []string{"expected an error matching:", "unmatched error:"},
+	}, {
+		name:    "validation level: match",
+		matcher: ErrorMatcher{}.ByValidationStabilityLevel(),
+		want:    ErrorList{{}}.MarkAlpha(),
+		got:     ErrorList{{}}.MarkAlpha(),
+	}, {
+		name:           "validation level: no match",
+		matcher:        ErrorMatcher{}.ByValidationStabilityLevel(),
+		want:           ErrorList{{}}.MarkAlpha(),
+		got:            ErrorList{{}}.MarkBeta(),
+		expectedErrors: []string{"expected an error matching:", "unmatched error:"},
+	}, {
+		name:    "by source: match",
+		matcher: ErrorMatcher{}.BySource(),
+		want:    ErrorList{{FromImperative: true}},
+		got:     ErrorList{{FromImperative: true}},
+	}, {
+		name:           "by source: no match",
+		matcher:        ErrorMatcher{}.BySource(),
+		want:           ErrorList{{FromImperative: true}},
+		got:            ErrorList{{FromImperative: false}},
+		expectedErrors: []string{"expected an error matching:", "unmatched error:"},
+	}, {
+		name:    "with origin: single match",
+		matcher: ErrorMatcher{}.ByField().ByOrigin(),
+		want:    ErrorList{Invalid(NewPath("f"), nil, "").WithOrigin("o")},
+		got:     ErrorList{Invalid(NewPath("f"), "v", "d").WithOrigin("o")},
+	}, {
+		name:    "with origin: multiple matches, different details",
+		matcher: ErrorMatcher{}.ByField().ByOrigin(),
+		want: ErrorList{
+			Invalid(NewPath("f1"), nil, "").WithOrigin("o"),
+			Invalid(NewPath("f2"), nil, "").WithOrigin("o"),
+		},
+		got: ErrorList{
+			Invalid(NewPath("f1"), "v", "d1").WithOrigin("o"),
+			Invalid(NewPath("f2"), "v", "d1").WithOrigin("o"),
+			Invalid(NewPath("f1"), "v", "d2").WithOrigin("o"),
+			Invalid(NewPath("f2"), "v", "d2").WithOrigin("o"),
+		},
+	}, {
+		name:    "with origin: multiple matches, same exact error",
+		matcher: ErrorMatcher{}.ByField().ByOrigin(),
+		want: ErrorList{
+			Invalid(NewPath("f1"), nil, "").WithOrigin("o"),
+			Invalid(NewPath("f2"), nil, "").WithOrigin("o"),
+		},
+		got: ErrorList{
+			Invalid(NewPath("f1"), "v", "d").WithOrigin("o"),
+			Invalid(NewPath("f1"), "v", "d").WithOrigin("o"),
+			Invalid(NewPath("f2"), "v", "d").WithOrigin("o"),
+			Invalid(NewPath("f2"), "v", "d").WithOrigin("o"),
+		},
+		expectedErrors: []string{"exact duplicate error:", "exact duplicate error:"},
+	}, {
+		name:    "match short circuit: match",
+		matcher: ErrorMatcher{}.MatchShortCircuit(),
+		want:    ErrorList{{ShortCircuit: true}},
+		got:     ErrorList{{ShortCircuit: true}},
+	}, {
+		name:           "match short circuit: no match",
+		matcher:        ErrorMatcher{}.MatchShortCircuit(),
+		want:           ErrorList{{ShortCircuit: true}},
+		got:            ErrorList{{ShortCircuit: false}},
+		expectedErrors: []string{"expected an error matching:", "unmatched error:"},
+	}}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			fakeT := &fakeTestIntf{}
+			tc.matcher.Test(fakeT, tc.want, tc.got)
+			if want, got := len(tc.expectedErrors), len(fakeT.errs); got != want {
+				if got == 0 {
+					t.Errorf("expected %d errors, got %d", want, got)
+				} else {
+					q := make([]string, len(fakeT.errs))
+					for i, err := range fakeT.errs {
+						q[i] = fmt.Sprintf("%q", err)
+					}
+					t.Errorf("expected %d errors, got %d:\n%s", want, got, strings.Join(q, "\n"))
+				}
+			} else {
+				for i := range tc.expectedErrors {
+					if !strings.HasPrefix(fakeT.errs[i], tc.expectedErrors[i]) {
+						t.Errorf("error %d: expected prefix %q, got %q", i, tc.expectedErrors[i], fakeT.errs[i])
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestErrorMatcher_Render(t *testing.T) {
+	testCases := []struct {
+		name     string
+		matcher  ErrorMatcher
+		err      *Error
+		expected string
+	}{
+		{
+			name:     "empty matcher",
+			matcher:  ErrorMatcher{},
+			err:      Invalid(NewPath("field"), "value", "detail"),
+			expected: "{}",
+		},
+		{
+			name:     "single field - type",
+			matcher:  ErrorMatcher{}.ByType(),
+			err:      Invalid(NewPath("field"), "value", "detail"),
+			expected: `{Type="Invalid value"}`,
+		},
+		{
+			name:     "single field - value with string",
+			matcher:  ErrorMatcher{}.ByValue(),
+			err:      Invalid(NewPath("field"), "string_value", "detail"),
+			expected: `{Value="string_value"}`,
+		},
+		{
+			name:     "single field - value with nil",
+			matcher:  ErrorMatcher{}.ByValue(),
+			err:      Invalid(NewPath("field"), nil, "detail"),
+			expected: `{Value=<nil>}`,
+		},
+		{
+			name:     "multiple fields",
+			matcher:  ErrorMatcher{}.ByType().ByField().ByValue(),
+			err:      Invalid(NewPath("field"), "value", "detail"),
+			expected: `{Type="Invalid value", Field="field", Value="value"}`,
+		},
+		{
+			name:     "all fields",
+			matcher:  ErrorMatcher{}.ByType().ByField().ByValue().ByOrigin().ByDetailExact(),
+			err:      Invalid(NewPath("field"), "value", "detail").WithOrigin("origin"),
+			expected: `{Type="Invalid value", Field="field", Value="value", Origin="origin", Detail="detail"}`,
+		},
+		{
+			name: "with normalization: normalized",
+			matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+				{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+			}),
+			err:      Invalid(NewPath("f").Index(0).Child("a"), "value", "detail"),
+			expected: `{Field="f[0].x.a" (aka "f[0].a")}`,
+		},
+		{
+			name: "with normalization: no normalization",
+			matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+				{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+			}),
+			err:      Invalid(NewPath("other", "field"), "value", "detail"),
+			expected: `{Field="other.field"}`,
+		},
+		{
+			name: "with normalization: already normalized",
+			matcher: ErrorMatcher{}.ByFieldNormalized([]NormalizationRule{
+				{Regexp: regexp.MustCompile(`f\[(\d+)\]\.a`), Replacement: "f[$1].x.a"},
+			}),
+			err:      Invalid(NewPath("f").Index(0).Child("x", "a"), "value", "detail"),
+			expected: `{Field="f[0].x.a"}`,
+		},
+		{
+			name:     "requireOriginWhenInvalid with origin",
+			matcher:  ErrorMatcher{}.ByOrigin().RequireOriginWhenInvalid(),
+			err:      Invalid(NewPath("field"), "value", "detail").WithOrigin("origin"),
+			expected: `{Origin="origin"}`,
+		},
+		{
+			name:     "different error types",
+			matcher:  ErrorMatcher{}.ByType().ByValue(),
+			err:      Required(NewPath("field"), "detail"),
+			expected: `{Type="Required value", Value=""}`,
+		},
+		{
+			name:    "with from imperative",
+			matcher: ErrorMatcher{}.BySource(),
+			err: func() *Error {
+				e := Invalid(NewPath("field"), "value", "detail")
+				e.FromImperative = true
+				return e
+			}(),
+			expected: `{FromImperative=true}`,
+		},
+		{
+			name:    "all fields with from imperative",
+			matcher: ErrorMatcher{}.ByType().ByField().ByValue().ByOrigin().ByDetailExact().BySource(),
+			err: func() *Error {
+				e := Invalid(NewPath("field"), "value", "detail").WithOrigin("origin")
+				e.FromImperative = true
+				return e
+			}(),
+			expected: `{Type="Invalid value", Field="field", Value="value", Origin="origin", Detail="detail", FromImperative=true}`,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := tc.matcher.Render(tc.err)
+			if result != tc.expected {
+				t.Errorf("Render() = %v, want %v", result, tc.expected)
+			}
+		})
+	}
+}
+
+func TestIsChildPath(t *testing.T) {
+	testCases := []struct {
+		name     string
+		parent   string
+		child    string
+		expected bool
+	}{
+		{
+			name:     "child is a descendant array element",
+			parent:   "spec.containers",
+			child:    "spec.containers[0]",
+			expected: true,
+		},
+		{
+			name:     "child is a subfield",
+			parent:   "spec.container",
+			child:    "spec.container.name",
+			expected: true,
+		},
+		{
+			name:     "not a child, just common prefix",
+			parent:   "spec.container",
+			child:    "spec.containers",
+			expected: false,
+		},
+		{
+			name:     "parent is empty",
+			parent:   "",
+			child:    "spec.containers",
+			expected: false,
+		},
+		{
+			name:     "child is shorter than parent",
+			parent:   "spec.containers",
+			child:    "spec",
+			expected: false,
+		},
+		{
+			name:     "child is equal to parent",
+			parent:   "spec.containers",
+			child:    "spec.containers",
+			expected: false,
+		},
+		{
+			name:     "child does not match parent prefix",
+			parent:   "spec.containers",
+			child:    "status.conditions",
+			expected: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := isChildPath(tc.parent, tc.child)
+			if result != tc.expected {
+				t.Errorf("isChildPath(%q, %q) = %v, want %v", tc.parent, tc.child, result, tc.expected)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/validation/field/errors.go b/third_party/k8s.io/apimachinery/pkg/util/validation/field/errors.go
new file mode 100644
index 0000000000..0d00acb42d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/validation/field/errors.go
@@ -0,0 +1,635 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package field
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+// Error is an implementation of the 'error' interface, which represents a
+// field-level validation error.
+type Error struct {
+	Type     ErrorType
+	Field    string
+	BadValue interface{}
+	Detail   string
+
+	// Origin uniquely identifies where this error was generated from. It is used in testing to
+	// compare expected errors against actual errors without relying on exact detail string matching.
+	// This allows tests to verify the correct validation logic triggered the error
+	// regardless of how the error message might be formatted or localized.
+	//
+	// The value should be either:
+	// - A simple camelCase identifier (e.g., "maximum", "maxItems")
+	// - A structured format using "format=<dash-style-identifier>" for validation errors related to specific formats
+	//   (e.g. "format=k8s-short-name")
+	//
+	// If the Origin corresponds to an existing declarative validation tag or JSON Schema keyword,
+	// use that same name for consistency.
+	//
+	// Origin should be set in the most deeply nested validation function that
+	// can still identify the unique source of the error.
+	Origin string
+
+	// CoveredByDeclarative is true when this error is covered by declarative
+	// validation. This field is to identify errors from imperative validation
+	// that should also be caught by declarative validation.
+	CoveredByDeclarative bool
+
+	// FromImperative denotes these errors are originating from  the hand written validations.
+	FromImperative bool
+
+	// ShortCircuit denotes that this error prevents further validation of the current field's children.
+	ShortCircuit bool
+
+	// ShortCircuitedInDeclarative denotes this error is covered by declarative validation. But not returned by declarative validation due to a short circuiting behavior for the current input.
+	ShortCircuitedInDeclarative bool
+
+	// ValidationStabilityLevel denotes the validation stability level of the declarative validation from this error is returned. This should be used in the declarative validations only.
+	ValidationStabilityLevel ValidationStabilityLevel
+}
+
+// ValidationStabilityLevel denotes the stability level of a validation.
+type ValidationStabilityLevel int
+
+const (
+	stabilityLevelUnknown ValidationStabilityLevel = iota
+	stabilityLevelAlpha
+	stabilityLevelBeta
+)
+
+func (v ValidationStabilityLevel) String() string {
+	switch v {
+	case stabilityLevelAlpha:
+		return "alpha"
+	case stabilityLevelBeta:
+		return "beta"
+	default:
+		return "unknown"
+	}
+}
+
+var _ error = &Error{}
+
+// IsAlpha returns true if the error is an alpha validation error.
+func (e *Error) IsAlpha() bool {
+	return e.ValidationStabilityLevel == stabilityLevelAlpha
+}
+
+// IsBeta returns true if the error is a beta validation error.
+func (e *Error) IsBeta() bool {
+	return e.ValidationStabilityLevel == stabilityLevelBeta
+}
+
+// Error implements the error interface.
+func (e *Error) Error() string {
+	return fmt.Sprintf("%s: %s", e.Field, e.ErrorBody())
+}
+
+type OmitValueType struct{}
+
+var omitValue = OmitValueType{}
+
+// ErrorBody returns the error message without the field name.  This is useful
+// for building nice-looking higher-level error reporting.
+func (e *Error) ErrorBody() string {
+	var s string
+	switch e.Type {
+	case ErrorTypeRequired, ErrorTypeForbidden, ErrorTypeTooLong, ErrorTypeTooShort, ErrorTypeInternal:
+		s = e.Type.String()
+	case ErrorTypeInvalid, ErrorTypeTypeInvalid, ErrorTypeNotSupported,
+		ErrorTypeNotFound, ErrorTypeDuplicate, ErrorTypeTooMany, ErrorTypeTooFew:
+		if e.BadValue == omitValue {
+			s = e.Type.String()
+			break
+		}
+		switch t := e.BadValue.(type) {
+		case int64, int32, float64, float32, bool:
+			// use simple printer for simple types
+			s = fmt.Sprintf("%s: %v", e.Type, t)
+		case string:
+			s = fmt.Sprintf("%s: %q", e.Type, t)
+		default:
+			// use more complex techniques to render more complex types
+			valstr := ""
+			jb, err := json.Marshal(e.BadValue)
+			if err == nil {
+				// best case
+				valstr = string(jb)
+			} else if stringer, ok := e.BadValue.(fmt.Stringer); ok {
+				// anything that defines String() is better than raw struct
+				valstr = stringer.String()
+			} else {
+				// worst case - fallback to raw struct
+				// TODO: internal types have panic guards against json.Marshalling to prevent
+				// accidental use of internal types in external serialized form.  For now, use
+				// %#v, although it would be better to show a more expressive output in the future
+				valstr = fmt.Sprintf("%#v", e.BadValue)
+			}
+			s = fmt.Sprintf("%s: %s", e.Type, valstr)
+		}
+	default:
+		internal := InternalError(nil, fmt.Errorf("unhandled error code: %s: please report this", e.Type))
+		s = internal.ErrorBody()
+	}
+	if len(e.Detail) != 0 {
+		s += fmt.Sprintf(": %s", e.Detail)
+	}
+
+	return s
+}
+
+// WithOrigin adds origin information to the FieldError
+func (e *Error) WithOrigin(o string) *Error {
+	e.Origin = o
+	return e
+}
+
+// MarkCoveredByDeclarative marks the error as covered by declarative validation.
+func (e *Error) MarkCoveredByDeclarative() *Error {
+	e.CoveredByDeclarative = true
+	return e
+}
+
+// ErrorType is a machine readable value providing more detail about why
+// a field is invalid.  These values are expected to match 1-1 with
+// CauseType in api/types.go.
+type ErrorType string
+
+// TODO: These values are duplicated in api/types.go, but there's a circular dep.  Fix it.
+const (
+	// ErrorTypeNotFound is used to report failure to find a requested value
+	// (e.g. looking up an ID).  See NotFound().
+	ErrorTypeNotFound ErrorType = "FieldValueNotFound"
+	// ErrorTypeRequired is used to report required values that are not
+	// provided (e.g. empty strings, null values, or empty arrays).  See
+	// Required().
+	ErrorTypeRequired ErrorType = "FieldValueRequired"
+	// ErrorTypeDuplicate is used to report collisions of values that must be
+	// unique (e.g. unique IDs).  See Duplicate().
+	ErrorTypeDuplicate ErrorType = "FieldValueDuplicate"
+	// ErrorTypeInvalid is used to report malformed values (e.g. failed regex
+	// match, too long, out of bounds).  See Invalid().
+	ErrorTypeInvalid ErrorType = "FieldValueInvalid"
+	// ErrorTypeNotSupported is used to report unknown values for enumerated
+	// fields (e.g. a list of valid values).  See NotSupported().
+	ErrorTypeNotSupported ErrorType = "FieldValueNotSupported"
+	// ErrorTypeForbidden is used to report valid (as per formatting rules)
+	// values which would be accepted under some conditions, but which are not
+	// permitted by the current conditions (such as security policy).  See
+	// Forbidden().
+	ErrorTypeForbidden ErrorType = "FieldValueForbidden"
+	// ErrorTypeTooLong is used to report that the given value is too long.
+	// This is similar to ErrorTypeInvalid, but the error will not include the
+	// too-long value.  See TooLong().
+	ErrorTypeTooLong ErrorType = "FieldValueTooLong"
+	// ErrorTypeTooMany is used to report "too many". This is used to
+	// report that a given list has too many items. This is similar to FieldValueTooLong,
+	// but the error indicates quantity instead of length.
+	ErrorTypeTooMany ErrorType = "FieldValueTooMany"
+	// ErrorTypeTooFew is used to report "too few". This is used to
+	// report that a given list has too few items. This is similar to FieldValueTooLong,
+	// but the error indicates quantity instead of length.
+	ErrorTypeTooFew ErrorType = "FieldValueTooFew"
+	// ErrorTypeInternal is used to report other errors that are not related
+	// to user input.  See InternalError().
+	ErrorTypeInternal ErrorType = "InternalError"
+	// ErrorTypeTypeInvalid is for the value did not match the schema type for that field
+	ErrorTypeTypeInvalid ErrorType = "FieldValueTypeInvalid"
+	// ErrorTypeTooShort is used to report that the given value is too short.
+	// This is similar to ErrorTypeInvalid. See TooShort().
+	ErrorTypeTooShort ErrorType = "FieldValueTooShort"
+)
+
+// String converts a ErrorType into its corresponding canonical error message.
+func (t ErrorType) String() string {
+	switch t {
+	case ErrorTypeNotFound:
+		return "Not found"
+	case ErrorTypeRequired:
+		return "Required value"
+	case ErrorTypeDuplicate:
+		return "Duplicate value"
+	case ErrorTypeInvalid:
+		return "Invalid value"
+	case ErrorTypeNotSupported:
+		return "Unsupported value"
+	case ErrorTypeForbidden:
+		return "Forbidden"
+	case ErrorTypeTooLong:
+		return "Too long"
+	case ErrorTypeTooMany:
+		return "Too many"
+	case ErrorTypeTooFew:
+		return "Too few"
+	case ErrorTypeInternal:
+		return "Internal error"
+	case ErrorTypeTypeInvalid:
+		return "Invalid value"
+	case ErrorTypeTooShort:
+		return "Too short"
+	default:
+		return fmt.Sprintf("<unknown error %q>", string(t))
+	}
+}
+
+// TypeInvalid returns a *Error indicating "type is invalid"
+func TypeInvalid(field *Path, value interface{}, detail string) *Error {
+	return &Error{
+		Type:     ErrorTypeTypeInvalid,
+		Field:    field.String(),
+		BadValue: value,
+		Detail:   detail,
+	}
+}
+
+// NotFound returns a *Error indicating "value not found".  This is
+// used to report failure to find a requested value (e.g. looking up an ID).
+func NotFound(field *Path, value interface{}) *Error {
+	return &Error{
+		Type:     ErrorTypeNotFound,
+		Field:    field.String(),
+		BadValue: value,
+	}
+}
+
+// Required returns a *Error indicating "value required".  This is used
+// to report required values that are not provided (e.g. empty strings, null
+// values, or empty arrays).
+func Required(field *Path, detail string) *Error {
+	return &Error{
+		Type:     ErrorTypeRequired,
+		Field:    field.String(),
+		Detail:   detail,
+		BadValue: "",
+	}
+}
+
+// Duplicate returns a *Error indicating "duplicate value".  This is
+// used to report collisions of values that must be unique (e.g. names or IDs).
+func Duplicate(field *Path, value interface{}) *Error {
+	return &Error{
+		Type:     ErrorTypeDuplicate,
+		Field:    field.String(),
+		BadValue: value,
+	}
+}
+
+// Invalid returns a *Error indicating "invalid value".  This is used
+// to report malformed values (e.g. failed regex match, too long, out of bounds).
+func Invalid(field *Path, value interface{}, detail string) *Error {
+	return &Error{
+		Type:     ErrorTypeInvalid,
+		Field:    field.String(),
+		BadValue: value,
+		Detail:   detail,
+	}
+
+}
+
+// NotSupported returns a *Error indicating "unsupported value".
+// This is used to report unknown values for enumerated fields (e.g. a list of
+// valid values).
+func NotSupported[T ~string](field *Path, value interface{}, validValues []T) *Error {
+	detail := ""
+	if len(validValues) > 0 {
+		quotedValues := make([]string, len(validValues))
+		for i, v := range validValues {
+			quotedValues[i] = strconv.Quote(fmt.Sprint(v))
+		}
+		detail = "supported values: " + strings.Join(quotedValues, ", ")
+	}
+	return &Error{
+		Type:     ErrorTypeNotSupported,
+		Field:    field.String(),
+		BadValue: value,
+		Detail:   detail,
+	}
+}
+
+// Forbidden returns a *Error indicating "forbidden".  This is used to
+// report valid (as per formatting rules) values which would be accepted under
+// some conditions, but which are not permitted by current conditions (e.g.
+// security policy).
+func Forbidden(field *Path, detail string) *Error {
+	return &Error{
+		Type:     ErrorTypeForbidden,
+		Field:    field.String(),
+		Detail:   detail,
+		BadValue: "",
+	}
+}
+
+// TooLong returns a *Error indicating "too long".  This is used to report that
+// the given value is too long.  This is similar to Invalid, but the returned
+// error will not include the too-long value. If maxLength is negative, it will
+// be included in the message.  The value argument is not used.
+func TooLong(field *Path, _ interface{}, maxLength int) *Error {
+	var msg string
+	if maxLength >= 0 {
+		bs := "bytes"
+		if maxLength == 1 {
+			bs = "byte"
+		}
+		msg = fmt.Sprintf("may not be more than %d %s", maxLength, bs)
+	} else {
+		msg = "value is too long"
+	}
+	return &Error{
+		Type:     ErrorTypeTooLong,
+		Field:    field.String(),
+		BadValue: "<value omitted>",
+		Detail:   msg,
+	}
+}
+
+// TooLongCharacters returns a *Error indicating "too long".  This is used to report that
+// the given value is too long in characters (including multi-byte characters).
+// This is similar to Invalid, but the returned  error will not include the too-long value.
+// If maxLength is negative, it will be included in the message. The value argument is not used.
+func TooLongCharacters[T ~string](field *Path, _ T, maxLength int) *Error {
+	var msg string
+	if maxLength >= 0 {
+		bs := "characters"
+		if maxLength == 1 {
+			bs = "character"
+		}
+		msg = fmt.Sprintf("may not be more than %d %s", maxLength, bs)
+	} else {
+		msg = "value is too long"
+	}
+	return &Error{
+		Type:     ErrorTypeTooLong,
+		Field:    field.String(),
+		BadValue: "<value omitted>",
+		Detail:   msg,
+	}
+}
+
+// TooLongMaxLength returns a *Error indicating "too long".
+// Deprecated: Use TooLong instead.
+func TooLongMaxLength(field *Path, value interface{}, maxLength int) *Error {
+	return TooLong(field, "", maxLength)
+}
+
+// TooMany returns a *Error indicating "too many". This is used to
+// report that a given list has too many items. This is similar to TooLong,
+// but the returned error indicates quantity instead of length.
+func TooMany(field *Path, actualQuantity, maxQuantity int) *Error {
+	var msg string
+
+	if maxQuantity >= 0 {
+		is := "items"
+		if maxQuantity == 1 {
+			is = "item"
+		}
+		msg = fmt.Sprintf("must have at most %d %s", maxQuantity, is)
+	} else {
+		msg = "has too many items"
+	}
+
+	var actual interface{}
+	if actualQuantity >= 0 {
+		actual = actualQuantity
+	} else {
+		actual = omitValue
+	}
+
+	return &Error{
+		Type:     ErrorTypeTooMany,
+		Field:    field.String(),
+		BadValue: actual,
+		Detail:   msg,
+	}
+}
+
+// InternalError returns a *Error indicating "internal error".  This is used
+// to signal that an error was found that was not directly related to user
+// input.  The err argument must be non-nil.
+func InternalError(field *Path, err error) *Error {
+	return &Error{
+		Type:     ErrorTypeInternal,
+		Field:    field.String(),
+		BadValue: err,
+		Detail:   err.Error(),
+	}
+}
+
+// TooShort returns a *Error indicating "too short".  This is used to report that
+// the given value is too short in characters. This is similar to Invalid.
+// If minLength is non-negative, it will  be included in the message.
+func TooShort[T ~string](field *Path, value T, minLength int) *Error {
+	var msg string
+	if minLength >= 0 {
+		bs := "characters"
+		if minLength == 1 {
+			bs = "character"
+		}
+		msg = fmt.Sprintf("must be at least %d %s", minLength, bs)
+	} else {
+		msg = "value is too short"
+	}
+	return &Error{
+		Type:     ErrorTypeTooShort,
+		Field:    field.String(),
+		BadValue: value,
+		Detail:   msg,
+	}
+}
+
+// ErrorList holds a set of Errors.  It is plausible that we might one day have
+// non-field errors in this same umbrella package, but for now we don't, so
+// we can keep it simple and leave ErrorList here.
+type ErrorList []*Error
+
+// NewErrorTypeMatcher returns an errors.Matcher that returns true
+// if the provided error is a Error and has the provided ErrorType.
+func NewErrorTypeMatcher(t ErrorType) utilerrors.Matcher {
+	return func(err error) bool {
+		if e, ok := err.(*Error); ok {
+			return e.Type == t
+		}
+		return false
+	}
+}
+
+// WithOrigin sets the origin for all errors in the list and returns the updated list.
+func (list ErrorList) WithOrigin(origin string) ErrorList {
+	for _, err := range list {
+		err.Origin = origin
+	}
+	return list
+}
+
+// MarkCoveredByDeclarative marks all errors in the list as covered by declarative validation.
+func (list ErrorList) MarkCoveredByDeclarative() ErrorList {
+	for _, err := range list {
+		err.CoveredByDeclarative = true
+	}
+	return list
+}
+
+// PrefixDetail adds a prefix to the Detail for all errors in the list and returns the updated list.
+func (list ErrorList) PrefixDetail(prefix string) ErrorList {
+	for _, err := range list {
+		err.Detail = prefix + err.Detail
+	}
+	return list
+}
+
+// ToAggregate converts the ErrorList into an errors.Aggregate.
+func (list ErrorList) ToAggregate() utilerrors.Aggregate {
+	if len(list) == 0 {
+		return nil
+	}
+	errs := make([]error, 0, len(list))
+	errorMsgs := sets.NewString()
+	for _, err := range list {
+		msg := fmt.Sprintf("%v", err)
+		if errorMsgs.Has(msg) {
+			continue
+		}
+		errorMsgs.Insert(msg)
+		errs = append(errs, err)
+	}
+	return utilerrors.NewAggregate(errs)
+}
+
+func fromAggregate(agg utilerrors.Aggregate) ErrorList {
+	errs := agg.Errors()
+	list := make(ErrorList, len(errs))
+	for i := range errs {
+		list[i] = errs[i].(*Error)
+	}
+	return list
+}
+
+// Filter removes items from the ErrorList that match the provided fns.
+func (list ErrorList) Filter(fns ...utilerrors.Matcher) ErrorList {
+	err := utilerrors.FilterOut(list.ToAggregate(), fns...)
+	if err == nil {
+		return nil
+	}
+	// FilterOut takes an Aggregate and returns an Aggregate
+	return fromAggregate(err.(utilerrors.Aggregate))
+}
+
+// ExtractCoveredByDeclarative returns a new ErrorList containing only the errors that should be covered by declarative validation.
+func (list ErrorList) ExtractCoveredByDeclarative() ErrorList {
+	newList := ErrorList{}
+	for _, err := range list {
+		if err.CoveredByDeclarative {
+			newList = append(newList, err)
+		}
+	}
+	return newList
+}
+
+// MarkAlpha marks the error as an alpha validation error.
+func (e *Error) MarkAlpha() *Error {
+	e.ValidationStabilityLevel = stabilityLevelAlpha
+	return e
+}
+
+// MarkShortCircuitedInDV marks that this error is not returned by declarative validations, because DV returns before running the current validation. Handwritten validations still return it.
+func (e *Error) MarkShortCircuitedInDV() *Error {
+	e.ShortCircuitedInDeclarative = true
+	return e
+}
+
+// MarkAlpha marks the errors as alpha validation errors.
+func (list ErrorList) MarkAlpha() ErrorList {
+	for _, err := range list {
+		err.ValidationStabilityLevel = stabilityLevelAlpha
+	}
+	return list
+}
+
+// MarkBeta marks the error as a beta validation error.
+func (e *Error) MarkBeta() *Error {
+	e.ValidationStabilityLevel = stabilityLevelBeta
+	return e
+}
+
+// MarkBeta marks the errors as beta validation errors.
+func (list ErrorList) MarkBeta() ErrorList {
+	for _, err := range list {
+		err.ValidationStabilityLevel = stabilityLevelBeta
+	}
+	return list
+}
+
+func (e *Error) MarkFromImperative() *Error {
+	e.FromImperative = true
+	return e
+}
+
+func (list ErrorList) MarkFromImperative() ErrorList {
+	for _, err := range list {
+		err.FromImperative = true
+	}
+	return list
+}
+
+// MarkShortCircuit marks the errors as short-circuit errors.
+func (list ErrorList) MarkShortCircuit() ErrorList {
+	for _, err := range list {
+		err.ShortCircuit = true
+	}
+	return list
+}
+
+// RemoveCoveredByDeclarative returns a new ErrorList containing only the errors that should not be covered by declarative validation.
+func (list ErrorList) RemoveCoveredByDeclarative() ErrorList {
+	newList := ErrorList{}
+	for _, err := range list {
+		if !err.CoveredByDeclarative {
+			newList = append(newList, err)
+		}
+	}
+	return newList
+}
+
+// TooFew returns a *Error indicating "too few". This is used to
+// report that a given list has too few items. This is similar to TooLong,
+// but the returned error indicates quantity instead of length.
+func TooFew(field *Path, actualQuantity, minQuantity int) *Error {
+	var msg string
+
+	if minQuantity >= 0 {
+		is := "items"
+		if minQuantity == 1 {
+			is = "item"
+		}
+		msg = fmt.Sprintf("must have at least %d %s", minQuantity, is)
+	} else {
+		msg = "has too few items"
+	}
+
+	return &Error{
+		Type:     ErrorTypeTooFew,
+		Field:    field.String(),
+		BadValue: actualQuantity,
+		Detail:   msg,
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/validation/field/errors_test.go b/third_party/k8s.io/apimachinery/pkg/util/validation/field/errors_test.go
new file mode 100644
index 0000000000..229595d900
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/validation/field/errors_test.go
@@ -0,0 +1,725 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package field
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+	"time"
+
+	"k8s.io/utils/ptr"
+)
+
+func TestMakeFuncs(t *testing.T) {
+	testCases := []struct {
+		fn       func() *Error
+		expected ErrorType
+	}{
+		{
+			func() *Error { return Invalid(NewPath("f"), "v", "d") },
+			ErrorTypeInvalid,
+		},
+		{
+			func() *Error { return NotSupported[string](NewPath("f"), "v", nil) },
+			ErrorTypeNotSupported,
+		},
+		{
+			func() *Error { return Duplicate(NewPath("f"), "v") },
+			ErrorTypeDuplicate,
+		},
+		{
+			func() *Error { return NotFound(NewPath("f"), "v") },
+			ErrorTypeNotFound,
+		},
+		{
+			func() *Error { return Required(NewPath("f"), "d") },
+			ErrorTypeRequired,
+		},
+		{
+			func() *Error { return InternalError(NewPath("f"), fmt.Errorf("e")) },
+			ErrorTypeInternal,
+		},
+	}
+
+	for _, testCase := range testCases {
+		err := testCase.fn()
+		if err.Type != testCase.expected {
+			t.Errorf("expected Type %q, got %q", testCase.expected, err.Type)
+		}
+	}
+}
+
+func TestToAggregate(t *testing.T) {
+	testCases := struct {
+		ErrList         []ErrorList
+		NumExpectedErrs []int
+	}{
+		[]ErrorList{
+			nil,
+			{},
+			{Invalid(NewPath("f"), "v", "d")},
+			{Invalid(NewPath("f"), "v", "d"), Invalid(NewPath("f"), "v", "d")},
+			{Invalid(NewPath("f"), "v", "d"), InternalError(NewPath(""), fmt.Errorf("e"))},
+		},
+		[]int{
+			0,
+			0,
+			1,
+			1,
+			2,
+		},
+	}
+
+	if len(testCases.ErrList) != len(testCases.NumExpectedErrs) {
+		t.Errorf("Mismatch: length of NumExpectedErrs does not match length of ErrList")
+	}
+	for i, tc := range testCases.ErrList {
+		agg := tc.ToAggregate()
+		numErrs := 0
+
+		if agg != nil {
+			numErrs = len(agg.Errors())
+		}
+		if numErrs != testCases.NumExpectedErrs[i] {
+			t.Errorf("[%d] Expected %d, got %d", i, testCases.NumExpectedErrs[i], numErrs)
+		}
+
+		if len(tc) == 0 {
+			if agg != nil {
+				t.Errorf("[%d] Expected nil, got %#v", i, agg)
+			}
+		} else if agg == nil {
+			t.Errorf("[%d] Expected non-nil", i)
+		}
+	}
+}
+
+func TestErrListFilter(t *testing.T) {
+	list := ErrorList{
+		Invalid(NewPath("test.field"), "", ""),
+		Invalid(NewPath("field.test"), "", ""),
+		Duplicate(NewPath("test"), "value"),
+	}
+	if len(list.Filter(NewErrorTypeMatcher(ErrorTypeDuplicate))) != 2 {
+		t.Errorf("should not filter")
+	}
+	if len(list.Filter(NewErrorTypeMatcher(ErrorTypeInvalid))) != 1 {
+		t.Errorf("should filter")
+	}
+}
+
+func TestErrorOrigin(t *testing.T) {
+	err := Invalid(NewPath("field"), "value", "detail")
+
+	// Test WithOrigin
+	newErr := err.WithOrigin("origin1")
+	if newErr.Origin != "origin1" {
+		t.Errorf("Expected Origin to be 'origin1', got '%s'", newErr.Origin)
+	}
+	if err.Origin != "origin1" {
+		t.Errorf("Expected Origin to be 'origin1', got '%s'", err.Origin)
+	}
+}
+
+func TestErrorListOrigin(t *testing.T) {
+	// Create an ErrorList with multiple errors
+	list := ErrorList{
+		Invalid(NewPath("field1"), "value1", "detail1"),
+		Invalid(NewPath("field2"), "value2", "detail2"),
+		Required(NewPath("field3"), "detail3"),
+	}
+
+	// Test WithOrigin
+	newList := list.WithOrigin("origin1")
+	// Check that WithOrigin returns the modified list
+	for i, err := range newList {
+		if err.Origin != "origin1" {
+			t.Errorf("Error %d: Expected Origin to be 'origin2', got '%s'", i, err.Origin)
+		}
+	}
+
+	// Check that the original list was also modified (WithOrigin modifies and returns the same list)
+	for i, err := range list {
+		if err.Origin != "origin1" {
+			t.Errorf("Error %d: Expected original list Origin to be 'origin2', got '%s'", i, err.Origin)
+		}
+	}
+}
+
+func TestErrorMarkDeclarative(t *testing.T) {
+	// Test for single Error
+	err := Invalid(NewPath("field"), "value", "detail")
+	if err.CoveredByDeclarative {
+		t.Errorf("New error should not be declarative by default")
+	}
+
+	// Mark as declarative
+	err.MarkCoveredByDeclarative() //nolint:errcheck // The "error" here is not an unexpected error from the function.
+	if !err.CoveredByDeclarative {
+		t.Errorf("Error should be declarative after marking")
+	}
+}
+
+func TestErrorListMarkDeclarative(t *testing.T) {
+	// Test for ErrorList
+	list := ErrorList{
+		Invalid(NewPath("field1"), "value1", "detail1"),
+		Invalid(NewPath("field2"), "value2", "detail2"),
+	}
+
+	// Verify none are declarative by default
+	for i, err := range list {
+		if err.CoveredByDeclarative {
+			t.Errorf("Error %d should not be declarative by default", i)
+		}
+	}
+
+	// Mark list as declarative
+	list.MarkCoveredByDeclarative()
+
+	// Verify all errors in the list are now declarative
+	for i, err := range list {
+		if !err.CoveredByDeclarative {
+			t.Errorf("Error %d should be declarative after marking the list", i)
+		}
+	}
+}
+
+func TestErrorMarkFromImperative(t *testing.T) {
+	// Test for single Error
+	err := Invalid(NewPath("field"), "value", "detail")
+	if err.FromImperative {
+		t.Errorf("New error should not be from imperative by default")
+	}
+
+	// Mark as FromImperative
+	err.MarkFromImperative() //nolint:errcheck // The "error" here is not an unexpected error from the function.
+	if !err.FromImperative {
+		t.Errorf("Error should be from imperative after marking")
+	}
+}
+
+func TestErrorListMarkFromImperative(t *testing.T) {
+	// Test for ErrorList
+	list := ErrorList{
+		Invalid(NewPath("field1"), "value1", "detail1"),
+		Invalid(NewPath("field2"), "value2", "detail2"),
+	}
+
+	// Verify none are from imperative by default
+	for i, err := range list {
+		if err.FromImperative {
+			t.Errorf("Error %d should not be from imperative by default", i)
+		}
+	}
+
+	// Mark list as from imperative
+	list.MarkFromImperative()
+
+	// Verify all errors in the list are now from imperative
+	for i, err := range list {
+		if !err.FromImperative {
+			t.Errorf("Error %d should be from imperative after marking the list", i)
+		}
+	}
+}
+
+func TestErrorListExtractCoveredByDeclarative(t *testing.T) {
+	testCases := []struct {
+		list         ErrorList
+		expectedList ErrorList
+	}{
+		{
+			ErrorList{},
+			ErrorList{},
+		},
+		{
+			ErrorList{Invalid(NewPath("field1"), nil, "")},
+			ErrorList{},
+		},
+		{
+			ErrorList{Invalid(NewPath("field1"), nil, "").MarkCoveredByDeclarative(), Required(NewPath("field2"), "detail2")},
+			ErrorList{Invalid(NewPath("field1"), nil, "").MarkCoveredByDeclarative()},
+		},
+	}
+
+	for _, tc := range testCases {
+		got := tc.list.ExtractCoveredByDeclarative()
+		if !reflect.DeepEqual(got, tc.expectedList) {
+			t.Errorf("For list %v, expected %v, got %v", tc.list, tc.expectedList, got)
+		}
+	}
+}
+
+func TestErrorListRemoveCoveredByDeclarative(t *testing.T) {
+	testCases := []struct {
+		list         ErrorList
+		expectedList ErrorList
+	}{
+		{
+			ErrorList{},
+			ErrorList{},
+		},
+		{
+			ErrorList{Invalid(NewPath("field1"), nil, "").MarkCoveredByDeclarative(), Required(NewPath("field2"), "detail2")},
+			ErrorList{Required(NewPath("field2"), "detail2")},
+		},
+	}
+
+	for _, tc := range testCases {
+		got := tc.list.RemoveCoveredByDeclarative()
+		if !reflect.DeepEqual(got, tc.expectedList) {
+			t.Errorf("For list %v, expected %v, got %v", tc.list, tc.expectedList, got)
+		}
+	}
+}
+
+func TestErrorFormatting(t *testing.T) {
+	cases := []struct {
+		name   string
+		input  *Error
+		expect string
+	}{{
+		name: "required",
+		input: &Error{
+			Type:                 ErrorTypeRequired,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Required value: the details`,
+	}, {
+		name:   "required func",
+		input:  Required(NewPath("path.to.field"), "the details"),
+		expect: `path.to.field: Required value: the details`,
+	}, {
+		name: "forbidden",
+		input: &Error{
+			Type:                 ErrorTypeForbidden,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Forbidden: the details`,
+	}, {
+		name:   "forbidden func",
+		input:  Forbidden(NewPath("path.to.field"), "the details"),
+		expect: `path.to.field: Forbidden: the details`,
+	}, {
+		name: "too long",
+		input: &Error{
+			Type:                 ErrorTypeTooLong,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Too long: the details`,
+	}, {
+		name:   "too long func(1)",
+		input:  TooLong(NewPath("path.to.field"), "the value", 1),
+		expect: `path.to.field: Too long: may not be more than 1 byte`,
+	}, {
+		name:   "too long func(2)",
+		input:  TooLong(NewPath("path.to.field"), "the value", 2),
+		expect: `path.to.field: Too long: may not be more than 2 bytes`,
+	}, {
+		name:   "too long func(-1)",
+		input:  TooLong(NewPath("path.to.field"), "the value", -1),
+		expect: `path.to.field: Too long: value is too long`,
+	}, {
+		name: "too many",
+		input: &Error{
+			Type:                 ErrorTypeTooMany,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Too many: "the value": the details`,
+	}, {
+		name:   "too many func(2, 1)",
+		input:  TooMany(NewPath("path.to.field"), 2, 1),
+		expect: `path.to.field: Too many: 2: must have at most 1 item`,
+	}, {
+		name:   "too many func(3, 2)",
+		input:  TooMany(NewPath("path.to.field"), 3, 2),
+		expect: `path.to.field: Too many: 3: must have at most 2 items`,
+	}, {
+		name:   "too many func(2, -1)",
+		input:  TooMany(NewPath("path.to.field"), 2, -1),
+		expect: `path.to.field: Too many: 2: has too many items`,
+	}, {
+		name:   "too many func(-1, 1)",
+		input:  TooMany(NewPath("path.to.field"), -1, 1),
+		expect: `path.to.field: Too many: must have at most 1 item`,
+	}, {
+		name: "internal error",
+		input: &Error{
+			Type:                 ErrorTypeInternal,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Internal error: the details`,
+	}, {
+		name:   "internal error func",
+		input:  InternalError(NewPath("path.to.field"), fmt.Errorf("the error")),
+		expect: `path.to.field: Internal error: the error`,
+	}, {
+		name: "invalid string",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: "the value": the details`,
+	}, {
+		name: "invalid string type",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             StringType("the value"),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: "the value": the details`,
+	}, {
+		name: "invalid int",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             -42,
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: -42: the details`,
+	}, {
+		name: "invalid bool",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             true,
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: true: the details`,
+	}, {
+		name: "invalid struct",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             mkTinyStruct(),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: {"stringField":"stringval","intField":9376,"boolField":true}: the details`,
+	}, {
+		name: "invalid list",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             []string{"one", "two", "three"},
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: ["one","two","three"]: the details`,
+	}, {
+		name: "invalid map",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             map[string]int{"one": 1, "two": 2, "three": 3},
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: {"one":1,"three":3,"two":2}: the details`,
+	}, {
+		name: "invalid time",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             time.Time{},
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: "0001-01-01T00:00:00Z": the details`,
+	}, {
+		name: "invalid omitValue",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             omitValue,
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: the details`,
+	}, {
+		name: "invalid untyped nil",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             nil,
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: null: the details`,
+	}, {
+		name: "invalid typed nil",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             (*string)(nil),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: null: the details`,
+	}, {
+		name: "invalid string ptr",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             ptr.To("the value"),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: "the value": the details`,
+	}, {
+		name: "invalid string type ptr",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             ptr.To(StringType("the value")),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: "the value": the details`,
+	}, {
+		name: "invalid int ptr",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             ptr.To(-42),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: -42: the details`,
+	}, {
+		name: "invalid bool ptr",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             ptr.To(true),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: true: the details`,
+	}, {
+		name: "invalid struct ptr",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             ptr.To(mkTinyStruct()),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: {"stringField":"stringval","intField":9376,"boolField":true}: the details`,
+	}, {
+		name: "invalid list ptr",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             ptr.To([]string{"one", "two", "three"}),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: ["one","two","three"]: the details`,
+	}, {
+		name: "invalid map ptr",
+		input: &Error{
+			Type:                 ErrorTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             ptr.To(map[string]int{"one": 1, "two": 2, "three": 3}),
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: {"one":1,"three":3,"two":2}: the details`,
+	}, {
+		name:   "invalid func",
+		input:  Invalid(NewPath("path.to.field"), "the value", "the details"),
+		expect: `path.to.field: Invalid value: "the value": the details`,
+	}, {
+		name: "not found",
+		input: &Error{
+			Type:                 ErrorTypeNotFound,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Not found: "the value": the details`,
+	}, {
+		name: "not supported",
+		input: &Error{
+			Type:                 ErrorTypeNotSupported,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Unsupported value: "the value": the details`,
+	}, {
+		name:   "not supported func",
+		input:  NotSupported(NewPath("path.to.field"), "the value", []string{"val1", "val2"}),
+		expect: `path.to.field: Unsupported value: "the value": supported values: "val1", "val2"`,
+	}, {
+		name: "duplicate",
+		input: &Error{
+			Type:                 ErrorTypeDuplicate,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Duplicate value: "the value": the details`,
+	}, {
+		name:   "duplicate func",
+		input:  Duplicate(NewPath("path.to.field"), "the value"),
+		expect: `path.to.field: Duplicate value: "the value"`,
+	}, {
+		name: "type invalid",
+		input: &Error{
+			Type:                 ErrorTypeTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             "the value",
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: "the value": the details`,
+	}, {
+		name:   "type invalid func",
+		input:  TypeInvalid(NewPath("path.to.field"), "the value", "the details"),
+		expect: `path.to.field: Invalid value: "the value": the details`,
+	}, {
+		name: "failed marshal stringer",
+		input: &Error{
+			Type:                 ErrorTypeTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             SelfMarshalerStringer{"invisible"},
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: magic: the details`,
+	}, {
+		name: "failed marshal non-stringer",
+		input: &Error{
+			Type:                 ErrorTypeTypeInvalid,
+			Field:                "path.to.field",
+			BadValue:             SelfMarshalerNonStringer{"visible"},
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Invalid value: field.SelfMarshalerNonStringer{S:"visible"}: the details`,
+	}, {
+		name: "unknown error type",
+		input: &Error{
+			Type:                 "not real",
+			Field:                "path.to.field",
+			BadValue:             SelfMarshalerNonStringer{"visible"},
+			Detail:               "the details",
+			Origin:               "theOrigin",
+			CoveredByDeclarative: true,
+		},
+		expect: `path.to.field: Internal error: unhandled error code: <unknown error "not real">: please report this: the details`,
+	}}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := tc.input.Error()
+			if want := tc.expect; result != want {
+				t.Errorf("wrong error string:\n  expected: %q\n       got: %q", want, result)
+			}
+		})
+	}
+}
+
+type StringType string
+
+type TinyStruct struct {
+	StringField string `json:"stringField"`
+	IntField    int    `json:"intField"`
+	BoolField   bool   `json:"boolField"`
+}
+
+func mkTinyStruct() TinyStruct {
+	return TinyStruct{
+		StringField: "stringval",
+		IntField:    9376,
+		BoolField:   true,
+	}
+}
+
+type SelfMarshalerStringer struct{ S string }
+
+func (SelfMarshalerStringer) MarshalJSON() ([]byte, error) {
+	return nil, fmt.Errorf("this always fails")
+}
+
+func (SelfMarshalerStringer) String() string {
+	return "magic"
+}
+
+type SelfMarshalerNonStringer struct{ S string }
+
+func (SelfMarshalerNonStringer) MarshalJSON() ([]byte, error) {
+	return nil, fmt.Errorf("this always fails")
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/validation/field/path.go b/third_party/k8s.io/apimachinery/pkg/util/validation/field/path.go
new file mode 100644
index 0000000000..daccb05890
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/validation/field/path.go
@@ -0,0 +1,117 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package field
+
+import (
+	"bytes"
+	"fmt"
+	"strconv"
+)
+
+type pathOptions struct {
+	path *Path
+}
+
+// PathOption modifies a pathOptions
+type PathOption func(o *pathOptions)
+
+// WithPath generates a PathOption
+func WithPath(p *Path) PathOption {
+	return func(o *pathOptions) {
+		o.path = p
+	}
+}
+
+// ToPath produces *Path from a set of PathOption
+func ToPath(opts ...PathOption) *Path {
+	c := &pathOptions{}
+	for _, opt := range opts {
+		opt(c)
+	}
+	return c.path
+}
+
+// Path represents the path from some root to a particular field.
+type Path struct {
+	name   string // the name of this field or "" if this is an index
+	index  string // if name == "", this is a subscript (index or map key) of the previous element
+	parent *Path  // nil if this is the root element
+}
+
+// NewPath creates a root Path object.
+func NewPath(name string, moreNames ...string) *Path {
+	r := &Path{name: name, parent: nil}
+	for _, anotherName := range moreNames {
+		r = &Path{name: anotherName, parent: r}
+	}
+	return r
+}
+
+// Root returns the root element of this Path.
+func (p *Path) Root() *Path {
+	for ; p.parent != nil; p = p.parent {
+		// Do nothing.
+	}
+	return p
+}
+
+// Child creates a new Path that is a child of the method receiver.
+func (p *Path) Child(name string, moreNames ...string) *Path {
+	r := NewPath(name, moreNames...)
+	r.Root().parent = p
+	return r
+}
+
+// Index indicates that the previous Path is to be subscripted by an int.
+// This sets the same underlying value as Key.
+func (p *Path) Index(index int) *Path {
+	return &Path{index: strconv.Itoa(index), parent: p}
+}
+
+// Key indicates that the previous Path is to be subscripted by a string.
+// This sets the same underlying value as Index.
+func (p *Path) Key(key string) *Path {
+	return &Path{index: key, parent: p}
+}
+
+// String produces a string representation of the Path.
+func (p *Path) String() string {
+	if p == nil {
+		return "<nil>"
+	}
+	// make a slice to iterate
+	elems := []*Path{}
+	for ; p != nil; p = p.parent {
+		elems = append(elems, p)
+	}
+
+	// iterate, but it has to be backwards
+	buf := bytes.NewBuffer(nil)
+	for i := range elems {
+		p := elems[len(elems)-1-i]
+		if p.parent != nil && len(p.name) > 0 {
+			// This is either the root or it is a subscript.
+			buf.WriteString(".")
+		}
+		if len(p.name) > 0 {
+			buf.WriteString(p.name)
+		} else {
+			fmt.Fprintf(buf, "[%s]", p.index)
+		}
+	}
+	return buf.String()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/validation/field/path_test.go b/third_party/k8s.io/apimachinery/pkg/util/validation/field/path_test.go
new file mode 100644
index 0000000000..d2f568c36f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/validation/field/path_test.go
@@ -0,0 +1,123 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package field
+
+import "testing"
+
+func TestPath(t *testing.T) {
+	testCases := []struct {
+		op       func(*Path) *Path
+		expected string
+	}{
+		{
+			func(p *Path) *Path { return p },
+			"root",
+		},
+		{
+			func(p *Path) *Path { return p.Child("first") },
+			"root.first",
+		},
+		{
+			func(p *Path) *Path { return p.Child("second") },
+			"root.first.second",
+		},
+		{
+			func(p *Path) *Path { return p.Index(0) },
+			"root.first.second[0]",
+		},
+		{
+			func(p *Path) *Path { return p.Child("third") },
+			"root.first.second[0].third",
+		},
+		{
+			func(p *Path) *Path { return p.Index(93) },
+			"root.first.second[0].third[93]",
+		},
+		{
+			func(p *Path) *Path { return p.parent },
+			"root.first.second[0].third",
+		},
+		{
+			func(p *Path) *Path { return p.parent },
+			"root.first.second[0]",
+		},
+		{
+			func(p *Path) *Path { return p.Key("key") },
+			"root.first.second[0][key]",
+		},
+	}
+
+	root := NewPath("root")
+	p := root
+	for i, tc := range testCases {
+		p = tc.op(p)
+		if p.String() != tc.expected {
+			t.Errorf("[%d] Expected %q, got %q", i, tc.expected, p.String())
+		}
+		if p.Root() != root {
+			t.Errorf("[%d] Wrong root: %#v", i, p.Root())
+		}
+	}
+}
+
+func TestPathMultiArg(t *testing.T) {
+	testCases := []struct {
+		op       func(*Path) *Path
+		expected string
+	}{
+		{
+			func(p *Path) *Path { return p },
+			"root.first",
+		},
+		{
+			func(p *Path) *Path { return p.Child("second", "third") },
+			"root.first.second.third",
+		},
+		{
+			func(p *Path) *Path { return p.Index(0) },
+			"root.first.second.third[0]",
+		},
+		{
+			func(p *Path) *Path { return p.parent },
+			"root.first.second.third",
+		},
+		{
+			func(p *Path) *Path { return p.parent },
+			"root.first.second",
+		},
+		{
+			func(p *Path) *Path { return p.parent },
+			"root.first",
+		},
+		{
+			func(p *Path) *Path { return p.parent },
+			"root",
+		},
+	}
+
+	root := NewPath("root", "first")
+	p := root
+	for i, tc := range testCases {
+		p = tc.op(p)
+		if p.String() != tc.expected {
+			t.Errorf("[%d] Expected %q, got %q", i, tc.expected, p.String())
+		}
+		if p.Root() != root.Root() {
+			t.Errorf("[%d] Wrong root: %#v", i, p.Root())
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/validation/ip.go b/third_party/k8s.io/apimachinery/pkg/util/validation/ip.go
new file mode 100644
index 0000000000..95f4e6218f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/validation/ip.go
@@ -0,0 +1,280 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"fmt"
+	"net"
+	"net/netip"
+	"slices"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/klog/v2"
+	netutils "k8s.io/utils/net"
+)
+
+func parseIP(fldPath *field.Path, value string, strictValidation bool) (net.IP, field.ErrorList) {
+	var allErrors field.ErrorList
+
+	ip := netutils.ParseIPSloppy(value)
+	if ip == nil {
+		allErrors = append(allErrors, field.Invalid(fldPath, value, "must be a valid IP address, (e.g. 10.9.8.7 or 2001:db8::ffff)"))
+		return nil, allErrors
+	}
+
+	if strictValidation {
+		addr, err := netip.ParseAddr(value)
+		if err != nil {
+			// If netutils.ParseIPSloppy parsed it, but netip.ParseAddr
+			// doesn't, then it must have illegal leading 0s.
+			allErrors = append(allErrors, field.Invalid(fldPath, value, "must not have leading 0s"))
+		}
+		if addr.Is4In6() {
+			allErrors = append(allErrors, field.Invalid(fldPath, value, "must not be an IPv4-mapped IPv6 address"))
+		}
+	}
+
+	return ip, allErrors
+}
+
+// IsValidIPForLegacyField tests that the argument is a valid IP address for a "legacy"
+// API field that predates strict IP validation. In particular, this allows IPs that are
+// not in canonical form (e.g., "FE80:0:0:0:0:0:0:0abc" instead of "fe80::abc").
+//
+// If strictValidation is false, this also allows IPs in certain invalid or ambiguous
+// formats:
+//
+//  1. IPv4 IPs are allowed to have leading "0"s in octets (e.g. "010.002.003.004").
+//     Historically, net.ParseIP (and later netutils.ParseIPSloppy) simply ignored leading
+//     "0"s in IPv4 addresses, but most libc-based software treats 0-prefixed IPv4 octets
+//     as octal, meaning different software might interpret the same string as two
+//     different IPs, potentially leading to security issues. (Current net.ParseIP and
+//     netip.ParseAddr simply reject inputs with leading "0"s.)
+//
+//  2. IPv4-mapped IPv6 IPs (e.g. "::ffff:1.2.3.4") are allowed. These can also lead to
+//     different software interpreting the value in different ways, because they may be
+//     treated as IPv4 by some software and IPv6 by other software. (net.ParseIP and
+//     netip.ParseAddr both allow these, but there are no use cases for representing IPv4
+//     addresses as IPv4-mapped IPv6 addresses in Kubernetes.)
+//
+// Alternatively, when validating an update to an existing field, you can pass a list of
+// IP values from the old object that should be accepted if they appear in the new object
+// even if they are not valid.
+//
+// This function should only be used to validate the existing fields that were
+// historically validated in this way, and strictValidation should be true unless the
+// StrictIPCIDRValidation feature gate is disabled. Use IsValidIP for parsing new fields.
+func IsValidIPForLegacyField(fldPath *field.Path, value string, strictValidation bool, validOldIPs []string) field.ErrorList {
+	if slices.Contains(validOldIPs, value) {
+		return nil
+	}
+	_, allErrors := parseIP(fldPath, value, strictValidation)
+	return allErrors.WithOrigin("format=ip-sloppy")
+}
+
+// IsValidIP tests that the argument is a valid IP address, according to current
+// Kubernetes standards for IP address validation.
+func IsValidIP(fldPath *field.Path, value string) field.ErrorList {
+	ip, allErrors := parseIP(fldPath, value, true)
+	if len(allErrors) != 0 {
+		return allErrors.WithOrigin("format=ip-strict")
+	}
+
+	if value != ip.String() {
+		allErrors = append(allErrors, field.Invalid(fldPath, value, fmt.Sprintf("must be in canonical form (%q)", ip.String())))
+	}
+	return allErrors.WithOrigin("format=ip-strict")
+}
+
+// GetWarningsForIP returns warnings for IP address values in non-standard forms. This
+// should only be used with fields that are validated with IsValidIPForLegacyField().
+func GetWarningsForIP(fldPath *field.Path, value string) []string {
+	ip := netutils.ParseIPSloppy(value)
+	if ip == nil {
+		//nolint:logcheck // Should not be reached.
+		klog.ErrorS(nil, "GetWarningsForIP called on value that was not validated with IsValidIPForLegacyField", "field", fldPath, "value", value)
+		return nil
+	}
+
+	addr, _ := netip.ParseAddr(value)
+	if !addr.IsValid() || addr.Is4In6() {
+		// This catches 2 cases: leading 0s (if ParseIPSloppy() accepted it but
+		// ParseAddr() doesn't) or IPv4-mapped IPv6 (.Is4In6()). Either way,
+		// re-stringifying the net.IP value will give the preferred form.
+		return []string{
+			fmt.Sprintf("%s: non-standard IP address %q is invalid: use %q", fldPath, value, ip.String()),
+		}
+	}
+
+	// If ParseIPSloppy() and ParseAddr() both accept it then it's fully valid, though
+	// it may be non-canonical.
+	if addr.Is6() && addr.String() != value {
+		return []string{
+			fmt.Sprintf("%s: IPv6 address %q should be in RFC 5952 canonical format (%q)", fldPath, value, addr.String()),
+		}
+	}
+
+	return nil
+}
+
+func parseCIDR(fldPath *field.Path, value string, strictValidation bool) (*net.IPNet, field.ErrorList) {
+	var allErrors field.ErrorList
+
+	_, ipnet, err := netutils.ParseCIDRSloppy(value)
+	if err != nil {
+		allErrors = append(allErrors, field.Invalid(fldPath, value, "must be a valid CIDR value, (e.g. 10.9.8.0/24 or 2001:db8::/64)"))
+		return nil, allErrors
+	}
+
+	if strictValidation {
+		prefix, err := netip.ParsePrefix(value)
+		if err != nil {
+			// If netutils.ParseCIDRSloppy parsed it, but netip.ParsePrefix
+			// doesn't, then it must have illegal leading 0s (either in the
+			// IP part or the prefix).
+			allErrors = append(allErrors, field.Invalid(fldPath, value, "must not have leading 0s in IP or prefix length"))
+		} else if prefix.Addr().Is4In6() {
+			allErrors = append(allErrors, field.Invalid(fldPath, value, "must not have an IPv4-mapped IPv6 address"))
+		} else if prefix.Addr() != prefix.Masked().Addr() {
+			allErrors = append(allErrors, field.Invalid(fldPath, value, "must not have bits set beyond the prefix length"))
+		}
+	}
+
+	return ipnet, allErrors
+}
+
+// IsValidCIDRForLegacyField tests that the argument is a valid CIDR value for a "legacy"
+// API field that predates strict IP validation. In particular, this allows IPs that are
+// not in canonical form (e.g., "FE80:0abc:0:0:0:0:0:0/64" instead of "fe80:abc::/64").
+//
+// If strictValidation is false, this also allows CIDR values in certain invalid or
+// ambiguous formats:
+//
+//  1. The IP part of the CIDR value is parsed as with IsValidIPForLegacyField with
+//     strictValidation=false.
+//
+//  2. The CIDR value is allowed to be either a "subnet"/"mask" (with the lower bits after
+//     the prefix length all being 0), or an "interface address" as with `ip addr` (with a
+//     complete IP address and associated subnet length). With strict validation, the
+//     value is required to be in "subnet"/"mask" form.
+//
+//  3. The prefix length is allowed to have leading 0s.
+//
+// Alternatively, when validating an update to an existing field, you can pass a list of
+// CIDR values from the old object that should be accepted if they appear in the new
+// object even if they are not valid.
+//
+// This function should only be used to validate the existing fields that were
+// historically validated in this way, and strictValidation should be true unless the
+// StrictIPCIDRValidation feature gate is disabled. Use IsValidCIDR or
+// IsValidInterfaceAddress for parsing new fields.
+func IsValidCIDRForLegacyField(fldPath *field.Path, value string, strictValidation bool, validOldCIDRs []string) field.ErrorList {
+	if slices.Contains(validOldCIDRs, value) {
+		return nil
+	}
+
+	_, allErrors := parseCIDR(fldPath, value, strictValidation)
+	return allErrors
+}
+
+// IsValidCIDR tests that the argument is a valid CIDR value, according to current
+// Kubernetes standards for CIDR validation. This function is only for
+// "subnet"/"mask"-style CIDR values (e.g., "192.168.1.0/24", with no bits set beyond the
+// prefix length). Use IsValidInterfaceAddress for "ifaddr"-style CIDR values.
+func IsValidCIDR(fldPath *field.Path, value string) field.ErrorList {
+	ipnet, allErrors := parseCIDR(fldPath, value, true)
+	if len(allErrors) != 0 {
+		return allErrors
+	}
+
+	if value != ipnet.String() {
+		allErrors = append(allErrors, field.Invalid(fldPath, value, fmt.Sprintf("must be in canonical form (%q)", ipnet.String())))
+	}
+	return allErrors
+}
+
+// GetWarningsForCIDR returns warnings for CIDR values in non-standard forms. This should
+// only be used with fields that are validated with IsValidCIDRForLegacyField().
+func GetWarningsForCIDR(fldPath *field.Path, value string) []string {
+	ip, ipnet, err := netutils.ParseCIDRSloppy(value)
+	if err != nil {
+		//nolint:logcheck // Should not be reached.
+		klog.ErrorS(err, "GetWarningsForCIDR called on value that was not validated with IsValidCIDRForLegacyField", "field", fldPath, "value", value)
+		return nil
+	}
+
+	var warnings []string
+
+	// Check for bits set after prefix length
+	if !ip.Equal(ipnet.IP) {
+		_, addrlen := ipnet.Mask.Size()
+		singleIPCIDR := fmt.Sprintf("%s/%d", ip.String(), addrlen)
+		warnings = append(warnings,
+			fmt.Sprintf("%s: CIDR value %q is ambiguous in this context (should be %q or %q?)", fldPath, value, ipnet.String(), singleIPCIDR),
+		)
+	}
+
+	prefix, _ := netip.ParsePrefix(value)
+	addr := prefix.Addr()
+	if !prefix.IsValid() || addr.Is4In6() {
+		// This catches 2 cases: leading 0s (if ParseCIDRSloppy() accepted it but
+		// ParsePrefix() doesn't) or IPv4-mapped IPv6 (.Is4In6()). Either way,
+		// re-stringifying the net.IPNet value will give the preferred form.
+		warnings = append(warnings,
+			fmt.Sprintf("%s: non-standard CIDR value %q is invalid: use %q", fldPath, value, ipnet.String()),
+		)
+	}
+
+	// If ParseCIDRSloppy() and ParsePrefix() both accept it then it's fully valid,
+	// though it may be non-canonical. But only check this if there are no other
+	// warnings, since either of the other warnings would also cause a round-trip
+	// failure.
+	if len(warnings) == 0 && addr.Is6() && prefix.String() != value {
+		warnings = append(warnings,
+			fmt.Sprintf("%s: IPv6 CIDR value %q should be in RFC 5952 canonical format (%q)", fldPath, value, prefix.String()),
+		)
+	}
+
+	return warnings
+}
+
+// IsValidInterfaceAddress tests that the argument is a valid "ifaddr"-style CIDR value in
+// canonical form (e.g., "192.168.1.5/24", with a complete IP address and associated
+// subnet length). Use IsValidCIDR for "subnet"/"mask"-style CIDR values (e.g.,
+// "192.168.1.0/24").
+func IsValidInterfaceAddress(fldPath *field.Path, value string) field.ErrorList {
+	var allErrors field.ErrorList
+	ip, ipnet, err := netutils.ParseCIDRSloppy(value)
+	if err != nil {
+		allErrors = append(allErrors, field.Invalid(fldPath, value, "must be a valid address in CIDR form, (e.g. 10.9.8.7/24 or 2001:db8::1/64)"))
+		return allErrors
+	}
+
+	// The canonical form of `value` is not `ipnet.String()`, because `ipnet` doesn't
+	// include the bits after the prefix. We need to construct the canonical form
+	// ourselves from `ip` and `ipnet.Mask`.
+	maskSize, _ := ipnet.Mask.Size()
+	if netutils.IsIPv4(ip) && maskSize > net.IPv4len*8 {
+		// "::ffff:192.168.0.1/120" -> "192.168.0.1/24"
+		maskSize -= (net.IPv6len - net.IPv4len) * 8
+	}
+	canonical := fmt.Sprintf("%s/%d", ip.String(), maskSize)
+	if value != canonical {
+		allErrors = append(allErrors, field.Invalid(fldPath, value, fmt.Sprintf("must be in canonical form (%q)", canonical)))
+	}
+	return allErrors
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/validation/ip_test.go b/third_party/k8s.io/apimachinery/pkg/util/validation/ip_test.go
new file mode 100644
index 0000000000..a96ced3cad
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/validation/ip_test.go
@@ -0,0 +1,709 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestIsValidIP(t *testing.T) {
+	testCases := []struct {
+		name string
+		in   string
+
+		err             string
+		legacyErr       string
+		legacyStrictErr string
+	}{
+		// GOOD VALUES
+		{
+			name: "ipv4",
+			in:   "1.2.3.4",
+		},
+		{
+			name: "ipv4, all zeros",
+			in:   "0.0.0.0",
+		},
+		{
+			name: "ipv4, max",
+			in:   "255.255.255.255",
+		},
+		{
+			name: "ipv6",
+			in:   "1234::abcd",
+		},
+		{
+			name: "ipv6, all zeros, collapsed",
+			in:   "::",
+		},
+		{
+			name: "ipv6, max",
+			in:   "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff",
+		},
+
+		// NON-CANONICAL VALUES
+		{
+			name: "ipv6, all zeros, expanded (non-canonical)",
+			in:   "0:0:0:0:0:0:0:0",
+
+			err: `must be in canonical form ("::")`,
+		},
+		{
+			name: "ipv6, leading 0s (non-canonical)",
+			in:   "0001:002:03:4::",
+
+			err: `must be in canonical form ("1:2:3:4::")`,
+		},
+		{
+			name: "ipv6, capital letters (non-canonical)",
+			in:   "1234::ABCD",
+
+			err: `must be in canonical form ("1234::abcd")`,
+		},
+
+		// GOOD WITH LEGACY VALIDATION, BAD WITH STRICT VALIDATION
+		{
+			name: "ipv4 with leading 0s",
+			in:   "1.1.1.01",
+
+			err:             "must not have leading 0s",
+			legacyErr:       "",
+			legacyStrictErr: "must not have leading 0s",
+		},
+		{
+			name: "ipv4-in-ipv6 value",
+			in:   "::ffff:1.1.1.1",
+
+			err:             "must not be an IPv4-mapped IPv6 address",
+			legacyErr:       "",
+			legacyStrictErr: "must not be an IPv4-mapped IPv6 address",
+		},
+
+		// BAD VALUES
+		{
+			name: "empty string",
+			in:   "",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "junk",
+			in:   "aaaaaaa",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "domain name",
+			in:   "myhost.mydomain",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "cidr",
+			in:   "1.2.3.0/24",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "ipv4 with out-of-range octets",
+			in:   "1.2.3.400",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "ipv4 with negative octets",
+			in:   "-1.0.0.0",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "ipv6 with out-of-range segment",
+			in:   "2001:db8::10005",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "ipv4:port",
+			in:   "1.2.3.4:80",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "ipv6 with brackets",
+			in:   "[2001:db8::1]",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "[ipv6]:port",
+			in:   "[2001:db8::1]:80",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "host:port",
+			in:   "example.com:80",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "ipv6 with zone",
+			in:   "1234::abcd%eth0",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+		{
+			name: "ipv4 with zone",
+			in:   "169.254.0.0%eth0",
+
+			err:             "must be a valid IP address",
+			legacyErr:       "must be a valid IP address",
+			legacyStrictErr: "must be a valid IP address",
+		},
+	}
+
+	var badIPs []string
+	for _, tc := range testCases {
+		if tc.legacyStrictErr != "" {
+			badIPs = append(badIPs, tc.in)
+		}
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := IsValidIP(field.NewPath(""), tc.in)
+			if tc.err == "" {
+				if len(errs) != 0 {
+					t.Errorf("expected %q to be valid but got: %v", tc.in, errs)
+				}
+			} else {
+				if len(errs) != 1 {
+					t.Errorf("expected %q to have 1 error but got: %v", tc.in, errs)
+				} else if !strings.Contains(errs[0].Detail, tc.err) {
+					t.Errorf("expected error for %q to contain %q but got: %q", tc.in, tc.err, errs[0].Detail)
+				}
+			}
+
+			errs = IsValidIPForLegacyField(field.NewPath(""), tc.in, false, nil)
+			if tc.legacyErr == "" {
+				if len(errs) != 0 {
+					t.Errorf("expected %q to be valid according to IsValidIPForLegacyField but got: %v", tc.in, errs)
+				}
+			} else {
+				if len(errs) != 1 {
+					t.Errorf("expected %q to have 1 error from IsValidIPForLegacyField but got: %v", tc.in, errs)
+				} else if !strings.Contains(errs[0].Detail, tc.legacyErr) {
+					t.Errorf("expected error from IsValidIPForLegacyField for %q to contain %q but got: %q", tc.in, tc.legacyErr, errs[0].Detail)
+				}
+			}
+
+			errs = IsValidIPForLegacyField(field.NewPath(""), tc.in, true, nil)
+			if tc.legacyStrictErr == "" {
+				if len(errs) != 0 {
+					t.Errorf("expected %q to be valid according to IsValidIPForLegacyField with strict validation, but got: %v", tc.in, errs)
+				}
+			} else {
+				if len(errs) != 1 {
+					t.Errorf("expected %q to have 1 error from IsValidIPForLegacyField with strict validation, but got: %v", tc.in, errs)
+				} else if !strings.Contains(errs[0].Detail, tc.legacyStrictErr) {
+					t.Errorf("expected error from IsValidIPForLegacyField with strict validation for %q to contain %q but got: %q", tc.in, tc.legacyStrictErr, errs[0].Detail)
+				}
+			}
+
+			errs = IsValidIPForLegacyField(field.NewPath(""), tc.in, true, badIPs)
+			if len(errs) != 0 {
+				t.Errorf("expected %q to be accepted when using validOldIPs, but got: %v", tc.in, errs)
+			}
+		})
+	}
+}
+
+func TestGetWarningsForIP(t *testing.T) {
+	tests := []struct {
+		name      string
+		fieldPath *field.Path
+		address   string
+		want      []string
+	}{
+		{
+			name:      "IPv4 No failures",
+			address:   "192.12.2.2",
+			fieldPath: field.NewPath("spec").Child("clusterIPs").Index(0),
+			want:      nil,
+		},
+		{
+			name:      "IPv6 No failures",
+			address:   "2001:db8::2",
+			fieldPath: field.NewPath("spec").Child("clusterIPs").Index(0),
+			want:      nil,
+		},
+		{
+			name:      "IPv4 with leading zeros",
+			address:   "192.012.2.2",
+			fieldPath: field.NewPath("spec").Child("clusterIPs").Index(0),
+			want: []string{
+				`spec.clusterIPs[0]: non-standard IP address "192.012.2.2" is invalid: use "192.12.2.2"`,
+			},
+		},
+		{
+			name:      "IPv4-mapped IPv6",
+			address:   "::ffff:192.12.2.2",
+			fieldPath: field.NewPath("spec").Child("clusterIPs").Index(0),
+			want: []string{
+				`spec.clusterIPs[0]: non-standard IP address "::ffff:192.12.2.2" is invalid: use "192.12.2.2"`,
+			},
+		},
+		{
+			name:      "IPv6 non-canonical format",
+			address:   "2001:db8:0:0::2",
+			fieldPath: field.NewPath("spec").Child("loadBalancerIP"),
+			want: []string{
+				`spec.loadBalancerIP: IPv6 address "2001:db8:0:0::2" should be in RFC 5952 canonical format ("2001:db8::2")`,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := GetWarningsForIP(tt.fieldPath, tt.address); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("getWarningsForIP() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestIsValidCIDR(t *testing.T) {
+	testCases := []struct {
+		name string
+		in   string
+
+		err             string
+		legacyErr       string
+		legacyStrictErr string
+	}{
+		// GOOD VALUES
+		{
+			name: "ipv4",
+			in:   "1.0.0.0/8",
+		},
+		{
+			name: "ipv4, all IPs",
+			in:   "0.0.0.0/0",
+		},
+		{
+			name: "ipv4, single IP",
+			in:   "1.1.1.1/32",
+		},
+		{
+			name: "ipv6",
+			in:   "2001:4860:4860::/48",
+		},
+		{
+			name: "ipv6, all IPs",
+			in:   "::/0",
+		},
+		{
+			name: "ipv6, single IP",
+			in:   "::1/128",
+		},
+
+		// NON-CANONICAL VALUES
+		{
+			name: "ipv6, extra 0s (non-canonical)",
+			in:   "2a00:79e0:2:0::/64",
+
+			err: `must be in canonical form ("2a00:79e0:2::/64")`,
+		},
+		{
+			name: "ipv6, capital letters (non-canonical)",
+			in:   "2001:DB8::/64",
+
+			err: `must be in canonical form ("2001:db8::/64")`,
+		},
+
+		// GOOD WITH LEGACY VALIDATION, BAD WITH STRICT VALIDATION
+		{
+			name: "ipv4 with leading 0s",
+			in:   "1.1.01.0/24",
+
+			err:             "must not have leading 0s in IP",
+			legacyErr:       "",
+			legacyStrictErr: "must not have leading 0s in IP",
+		},
+		{
+			name: "ipv4-in-ipv6 with ipv4-sized prefix",
+			in:   "::ffff:1.1.1.0/24",
+
+			err:             "must not have an IPv4-mapped IPv6 address",
+			legacyErr:       "",
+			legacyStrictErr: "must not have an IPv4-mapped IPv6 address",
+		},
+		{
+			name: "ipv4-in-ipv6 with ipv6-sized prefix",
+			in:   "::ffff:1.1.1.0/120",
+
+			err:             "must not have an IPv4-mapped IPv6 address",
+			legacyErr:       "",
+			legacyStrictErr: "must not have an IPv4-mapped IPv6 address",
+		},
+		{
+			name: "ipv4 ifaddr",
+			in:   "1.2.3.4/24",
+
+			err:             "must not have bits set beyond the prefix length",
+			legacyErr:       "",
+			legacyStrictErr: "must not have bits set beyond the prefix length",
+		},
+		{
+			name: "ipv6 ifaddr",
+			in:   "2001:db8::1/64",
+
+			err:             "must not have bits set beyond the prefix length",
+			legacyErr:       "",
+			legacyStrictErr: "must not have bits set beyond the prefix length",
+		},
+		{
+			name: "prefix length with leading 0s",
+			in:   "192.168.0.0/016",
+
+			err:             "must not have leading 0s",
+			legacyErr:       "",
+			legacyStrictErr: "must not have leading 0s",
+		},
+
+		// BAD VALUES
+		{
+			name: "empty string",
+			in:   "",
+
+			err:             "must be a valid CIDR value",
+			legacyErr:       "must be a valid CIDR value",
+			legacyStrictErr: "must be a valid CIDR value",
+		},
+		{
+			name: "junk",
+			in:   "aaaaaaa",
+
+			err:             "must be a valid CIDR value",
+			legacyErr:       "must be a valid CIDR value",
+			legacyStrictErr: "must be a valid CIDR value",
+		},
+		{
+			name: "IP address",
+			in:   "1.2.3.4",
+
+			err:             "must be a valid CIDR value",
+			legacyErr:       "must be a valid CIDR value",
+			legacyStrictErr: "must be a valid CIDR value",
+		},
+		{
+			name: "partial URL",
+			in:   "192.168.0.1/healthz",
+
+			err:             "must be a valid CIDR value",
+			legacyErr:       "must be a valid CIDR value",
+			legacyStrictErr: "must be a valid CIDR value",
+		},
+		{
+			name: "partial URL 2",
+			in:   "192.168.0.1/0/99",
+
+			err:             "must be a valid CIDR value",
+			legacyErr:       "must be a valid CIDR value",
+			legacyStrictErr: "must be a valid CIDR value",
+		},
+		{
+			name: "negative prefix length",
+			in:   "192.168.0.0/-16",
+
+			err:             "must be a valid CIDR value",
+			legacyErr:       "must be a valid CIDR value",
+			legacyStrictErr: "must be a valid CIDR value",
+		},
+		{
+			name: "prefix length with sign",
+			in:   "192.168.0.0/+16",
+
+			err:             "must be a valid CIDR value",
+			legacyErr:       "must be a valid CIDR value",
+			legacyStrictErr: "must be a valid CIDR value",
+		},
+	}
+
+	var badCIDRs []string
+	for _, tc := range testCases {
+		if tc.legacyStrictErr != "" {
+			badCIDRs = append(badCIDRs, tc.in)
+		}
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := IsValidCIDR(field.NewPath(""), tc.in)
+			if tc.err == "" {
+				if len(errs) != 0 {
+					t.Errorf("expected %q to be valid but got: %v", tc.in, errs)
+				}
+			} else {
+				if len(errs) != 1 {
+					t.Errorf("expected %q to have 1 error but got: %v", tc.in, errs)
+				} else if !strings.Contains(errs[0].Detail, tc.err) {
+					t.Errorf("expected error for %q to contain %q but got: %q", tc.in, tc.err, errs[0].Detail)
+				}
+			}
+
+			errs = IsValidCIDRForLegacyField(field.NewPath(""), tc.in, false, nil)
+			if tc.legacyErr == "" {
+				if len(errs) != 0 {
+					t.Errorf("expected %q to be valid according to IsValidCIDRForLegacyField but got: %v", tc.in, errs)
+				}
+			} else {
+				if len(errs) != 1 {
+					t.Errorf("expected %q to have 1 error from IsValidCIDRForLegacyField but got: %v", tc.in, errs)
+				} else if !strings.Contains(errs[0].Detail, tc.legacyErr) {
+					t.Errorf("expected error for %q from IsValidCIDRForLegacyField to contain %q but got: %q", tc.in, tc.legacyErr, errs[0].Detail)
+				}
+			}
+
+			errs = IsValidCIDRForLegacyField(field.NewPath(""), tc.in, true, nil)
+			if tc.legacyStrictErr == "" {
+				if len(errs) != 0 {
+					t.Errorf("expected %q to be valid according to IsValidCIDRForLegacyField with strict validation but got: %v", tc.in, errs)
+				}
+			} else {
+				if len(errs) != 1 {
+					t.Errorf("expected %q to have 1 error from IsValidCIDRForLegacyField with strict validation but got: %v", tc.in, errs)
+				} else if !strings.Contains(errs[0].Detail, tc.legacyStrictErr) {
+					t.Errorf("expected error for %q from IsValidCIDRForLegacyField with strict validation to contain %q but got: %q", tc.in, tc.legacyStrictErr, errs[0].Detail)
+				}
+			}
+
+			errs = IsValidCIDRForLegacyField(field.NewPath(""), tc.in, true, badCIDRs)
+			if len(errs) != 0 {
+				t.Errorf("expected %q to be accepted when using validOldCIDRs, but got: %v", tc.in, errs)
+			}
+		})
+	}
+}
+
+func TestGetWarningsForCIDR(t *testing.T) {
+	tests := []struct {
+		name      string
+		fieldPath *field.Path
+		cidr      string
+		want      []string
+	}{
+		{
+			name:      "IPv4 No failures",
+			cidr:      "192.12.2.0/24",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want:      nil,
+		},
+		{
+			name:      "IPv6 No failures",
+			cidr:      "2001:db8::/64",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want:      nil,
+		},
+		{
+			name:      "IPv4 with leading zeros",
+			cidr:      "192.012.2.0/24",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want: []string{
+				`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "192.012.2.0/24" is invalid: use "192.12.2.0/24"`,
+			},
+		},
+		{
+			name:      "leading zeros in prefix length",
+			cidr:      "192.12.2.0/024",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want: []string{
+				`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "192.12.2.0/024" is invalid: use "192.12.2.0/24"`,
+			},
+		},
+		{
+			name:      "IPv4-mapped IPv6",
+			cidr:      "::ffff:192.12.2.0/120",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want: []string{
+				`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "::ffff:192.12.2.0/120" is invalid: use "192.12.2.0/24"`,
+			},
+		},
+		{
+			name:      "bits after prefix length",
+			cidr:      "192.12.2.8/24",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want: []string{
+				`spec.loadBalancerSourceRanges[0]: CIDR value "192.12.2.8/24" is ambiguous in this context (should be "192.12.2.0/24" or "192.12.2.8/32"?)`,
+			},
+		},
+		{
+			name:      "multiple problems",
+			cidr:      "192.012.2.8/24",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want: []string{
+				`spec.loadBalancerSourceRanges[0]: CIDR value "192.012.2.8/24" is ambiguous in this context (should be "192.12.2.0/24" or "192.12.2.8/32"?)`,
+				`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "192.012.2.8/24" is invalid: use "192.12.2.0/24"`,
+			},
+		},
+		{
+			name:      "IPv6 non-canonical format",
+			cidr:      "2001:db8:0:0::/64",
+			fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
+			want: []string{
+				`spec.loadBalancerSourceRanges[0]: IPv6 CIDR value "2001:db8:0:0::/64" should be in RFC 5952 canonical format ("2001:db8::/64")`,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := GetWarningsForCIDR(tt.fieldPath, tt.cidr); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("getWarningsForCIDR() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestIsValidInterfaceAddress(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		in   string
+		err  string
+	}{
+		// GOOD VALUES
+		{
+			name: "ipv4",
+			in:   "1.2.3.4/24",
+		},
+		{
+			name: "ipv4, single IP",
+			in:   "1.1.1.1/32",
+		},
+		{
+			name: "ipv6",
+			in:   "2001:4860:4860::1/48",
+		},
+		{
+			name: "ipv6, single IP",
+			in:   "::1/128",
+		},
+
+		// BAD VALUES
+		{
+			name: "empty string",
+			in:   "",
+			err:  "must be a valid address in CIDR form",
+		},
+		{
+			name: "junk",
+			in:   "aaaaaaa",
+			err:  "must be a valid address in CIDR form",
+		},
+		{
+			name: "IP address",
+			in:   "1.2.3.4",
+			err:  "must be a valid address in CIDR form",
+		},
+		{
+			name: "partial URL",
+			in:   "192.168.0.1/healthz",
+			err:  "must be a valid address in CIDR form",
+		},
+		{
+			name: "partial URL 2",
+			in:   "192.168.0.1/0/99",
+			err:  "must be a valid address in CIDR form",
+		},
+		{
+			name: "negative prefix length",
+			in:   "192.168.0.0/-16",
+			err:  "must be a valid address in CIDR form",
+		},
+		{
+			name: "prefix length with sign",
+			in:   "192.168.0.0/+16",
+			err:  "must be a valid address in CIDR form",
+		},
+		{
+			name: "ipv6 non-canonical",
+			in:   "2001:0:0:0::0BCD/64",
+			err:  `must be in canonical form ("2001::bcd/64")`,
+		},
+		{
+			name: "ipv4 with leading 0s",
+			in:   "1.1.01.002/24",
+			err:  `must be in canonical form ("1.1.1.2/24")`,
+		},
+		{
+			name: "ipv4-in-ipv6 with ipv4-sized prefix",
+			in:   "::ffff:1.1.1.1/24",
+			err:  `must be in canonical form ("1.1.1.1/24")`,
+		},
+		{
+			name: "ipv4-in-ipv6 with ipv6-sized prefix",
+			in:   "::ffff:1.1.1.1/120",
+			err:  `must be in canonical form ("1.1.1.1/24")`,
+		},
+		{
+			name: "prefix length with leading 0s",
+			in:   "192.168.0.5/016",
+			err:  `must be in canonical form ("192.168.0.5/16")`,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := IsValidInterfaceAddress(field.NewPath(""), tc.in)
+			if tc.err == "" {
+				if len(errs) != 0 {
+					t.Errorf("expected %q to be valid but got: %v", tc.in, errs)
+				}
+			} else {
+				if len(errs) != 1 {
+					t.Errorf("expected %q to have 1 error but got: %v", tc.in, errs)
+				} else if !strings.Contains(errs[0].Detail, tc.err) {
+					t.Errorf("expected error for %q to contain %q but got: %q", tc.in, tc.err, errs[0].Detail)
+				}
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/validation/validation.go b/third_party/k8s.io/apimachinery/pkg/util/validation/validation.go
new file mode 100644
index 0000000000..352ff19ae5
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/validation/validation.go
@@ -0,0 +1,468 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"fmt"
+	"math"
+	"regexp"
+	"strings"
+	"unicode"
+
+	"k8s.io/apimachinery/pkg/api/validate/content"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// IsQualifiedName tests whether the value passed is what Kubernetes calls a
+// "qualified name".  This is a format used in various places throughout the
+// system.  If the value is not valid, a list of error strings is returned.
+// Otherwise an empty list (or nil) is returned.
+// Deprecated: Use k8s.io/apimachinery/pkg/api/validate/content.IsQualifiedName instead.
+var IsQualifiedName = content.IsLabelKey
+
+// IsFullyQualifiedName checks if the name is fully qualified. This is similar
+// to IsFullyQualifiedDomainName but requires a minimum of 3 segments instead of
+// 2 and does not accept a trailing . as valid.
+// TODO: This function is deprecated and preserved until all callers migrate to
+// IsFullyQualifiedDomainName; please don't add new callers.
+func IsFullyQualifiedName(fldPath *field.Path, name string) field.ErrorList {
+	var allErrors field.ErrorList
+	if len(name) == 0 {
+		return append(allErrors, field.Required(fldPath, ""))
+	}
+	if errs := IsDNS1123Subdomain(name); len(errs) > 0 {
+		return append(allErrors, field.Invalid(fldPath, name, strings.Join(errs, ",")))
+	}
+	if len(strings.Split(name, ".")) < 3 {
+		return append(allErrors, field.Invalid(fldPath, name, "should be a domain with at least three segments separated by dots"))
+	}
+	return allErrors
+}
+
+// IsFullyQualifiedDomainName checks if the domain name is fully qualified. This
+// is similar to IsFullyQualifiedName but only requires a minimum of 2 segments
+// instead of 3 and accepts a trailing . as valid.
+func IsFullyQualifiedDomainName(fldPath *field.Path, name string) field.ErrorList {
+	var allErrors field.ErrorList
+	if len(name) == 0 {
+		return append(allErrors, field.Required(fldPath, ""))
+	}
+	if strings.HasSuffix(name, ".") {
+		name = name[:len(name)-1]
+	}
+	if errs := IsDNS1123Subdomain(name); len(errs) > 0 {
+		return append(allErrors, field.Invalid(fldPath, name, strings.Join(errs, ",")))
+	}
+	if len(strings.Split(name, ".")) < 2 {
+		return append(allErrors, field.Invalid(fldPath, name, "should be a domain with at least two segments separated by dots"))
+	}
+	for _, label := range strings.Split(name, ".") {
+		if errs := IsDNS1123Label(label); len(errs) > 0 {
+			return append(allErrors, field.Invalid(fldPath, label, strings.Join(errs, ",")))
+		}
+	}
+	return allErrors
+}
+
+// Allowed characters in an HTTP Path as defined by RFC 3986. A HTTP path may
+// contain:
+// * unreserved characters (alphanumeric, '-', '.', '_', '~')
+// * percent-encoded octets
+// * sub-delims ("!", "$", "&", "'", "(", ")", "*", "+", ",", ";", "=")
+// * a colon character (":")
+const httpPathFmt string = `[A-Za-z0-9/\-._~%!$&'()*+,;=:]+`
+
+var httpPathRegexp = regexp.MustCompile("^" + httpPathFmt + "$")
+
+// IsDomainPrefixedPath checks if the given string is a domain-prefixed path
+// (e.g. acme.io/foo). All characters before the first "/" must be a valid
+// subdomain as defined by RFC 1123. All characters trailing the first "/" must
+// be valid HTTP Path characters as defined by RFC 3986.
+func IsDomainPrefixedPath(fldPath *field.Path, dpPath string) field.ErrorList {
+	var allErrs field.ErrorList
+	if len(dpPath) == 0 {
+		return append(allErrs, field.Required(fldPath, ""))
+	}
+
+	segments := strings.SplitN(dpPath, "/", 2)
+	if len(segments) != 2 || len(segments[0]) == 0 || len(segments[1]) == 0 {
+		return append(allErrs, field.Invalid(fldPath, dpPath, "must be a domain-prefixed path (such as \"acme.io/foo\")"))
+	}
+
+	host := segments[0]
+	for _, err := range IsDNS1123Subdomain(host) {
+		allErrs = append(allErrs, field.Invalid(fldPath, host, err))
+	}
+
+	path := segments[1]
+	if !httpPathRegexp.MatchString(path) {
+		return append(allErrs, field.Invalid(fldPath, path, RegexError("Invalid path", httpPathFmt)))
+	}
+
+	return allErrs
+}
+
+// IsDomainPrefixedKey checks if the given key string is a domain-prefixed key
+// (e.g. acme.io/foo). All characters before the first "/" must be a valid
+// subdomain as defined by RFC 1123. All characters trailing the first "/" must
+// be non-empty and match the regex ^([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]$.
+func IsDomainPrefixedKey(fldPath *field.Path, key string) field.ErrorList {
+	var allErrs field.ErrorList
+	if len(key) == 0 {
+		return append(allErrs, field.Required(fldPath, ""))
+	}
+	for _, errMessages := range content.IsLabelKey(key) {
+		allErrs = append(allErrs, field.Invalid(fldPath, key, errMessages))
+	}
+
+	if len(allErrs) > 0 {
+		return allErrs
+	}
+
+	segments := strings.Split(key, "/")
+	if len(segments) != 2 {
+		return append(allErrs, field.Invalid(fldPath, key, "must be a domain-prefixed key (such as \"acme.io/foo\")"))
+	}
+
+	return allErrs
+}
+
+// LabelValueMaxLength is a label's max length
+// Deprecated: Use k8s.io/apimachinery/pkg/api/validate/content.LabelValueMaxLength instead.
+const LabelValueMaxLength int = content.LabelValueMaxLength
+
+// IsValidLabelValue tests whether the value passed is a valid label value.  If
+// the value is not valid, a list of error strings is returned.  Otherwise an
+// empty list (or nil) is returned.
+// Deprecated: Use k8s.io/apimachinery/pkg/api/validate/content.IsLabelValue instead.
+var IsValidLabelValue = content.IsLabelValue
+
+const dns1123LabelFmt string = "[a-z0-9]([-a-z0-9]*[a-z0-9])?"
+const dns1123LabelFmtWithUnderscore string = "_?[a-z0-9]([-_a-z0-9]*[a-z0-9])?"
+
+const dns1123LabelErrMsg string = "a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character"
+
+// DNS1123LabelMaxLength is a label's max length in DNS (RFC 1123)
+const DNS1123LabelMaxLength int = 63
+
+var dns1123LabelRegexp = regexp.MustCompile("^" + dns1123LabelFmt + "$")
+
+// IsDNS1123Label tests for a string that conforms to the definition of a label in
+// DNS (RFC 1123).
+func IsDNS1123Label(value string) []string {
+	var errs []string
+	if len(value) > DNS1123LabelMaxLength {
+		errs = append(errs, MaxLenError(DNS1123LabelMaxLength))
+	}
+	if !dns1123LabelRegexp.MatchString(value) {
+		if dns1123SubdomainRegexp.MatchString(value) {
+			// It was a valid subdomain and not a valid label.  Since we
+			// already checked length, it must be dots.
+			errs = append(errs, "must not contain dots")
+		} else {
+			errs = append(errs, RegexError(dns1123LabelErrMsg, dns1123LabelFmt, "my-name", "123-abc"))
+		}
+	}
+	return errs
+}
+
+const dns1123SubdomainFmt string = dns1123LabelFmt + "(\\." + dns1123LabelFmt + ")*"
+const dns1123SubdomainErrorMsg string = "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character"
+
+const dns1123SubdomainFmtWithUnderscore string = dns1123LabelFmtWithUnderscore + "(\\." + dns1123LabelFmtWithUnderscore + ")*"
+const dns1123SubdomainErrorMsgFG string = "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '_', '-' or '.', and must start and end with an alphanumeric character"
+
+// DNS1123SubdomainMaxLength is a subdomain's max length in DNS (RFC 1123)
+const DNS1123SubdomainMaxLength int = 253
+
+var dns1123SubdomainRegexp = regexp.MustCompile("^" + dns1123SubdomainFmt + "$")
+var dns1123SubdomainRegexpWithUnderscore = regexp.MustCompile("^" + dns1123SubdomainFmtWithUnderscore + "$")
+
+// IsDNS1123Subdomain tests for a string that conforms to the definition of a
+// subdomain in DNS (RFC 1123).
+func IsDNS1123Subdomain(value string) []string {
+	var errs []string
+	if len(value) > DNS1123SubdomainMaxLength {
+		errs = append(errs, MaxLenError(DNS1123SubdomainMaxLength))
+	}
+	if !dns1123SubdomainRegexp.MatchString(value) {
+		errs = append(errs, RegexError(dns1123SubdomainErrorMsg, dns1123SubdomainFmt, "example.com"))
+	}
+	return errs
+}
+
+// IsDNS1123SubdomainWithUnderscore tests for a string that conforms to the definition of a
+// subdomain in DNS (RFC 1123), but allows the use of an underscore in the string
+func IsDNS1123SubdomainWithUnderscore(value string) []string {
+	var errs []string
+	if len(value) > DNS1123SubdomainMaxLength {
+		errs = append(errs, MaxLenError(DNS1123SubdomainMaxLength))
+	}
+	if !dns1123SubdomainRegexpWithUnderscore.MatchString(value) {
+		errs = append(errs, RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com"))
+	}
+	return errs
+}
+
+const dns1035LabelFmt string = "[a-z]([-a-z0-9]*[a-z0-9])?"
+const dns1035LabelErrMsg string = "a DNS-1035 label must consist of lower case alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character"
+
+// DNS1035LabelMaxLength is a label's max length in DNS (RFC 1035)
+const DNS1035LabelMaxLength int = 63
+
+var dns1035LabelRegexp = regexp.MustCompile("^" + dns1035LabelFmt + "$")
+
+// IsDNS1035Label tests for a string that conforms to the definition of a label in
+// DNS (RFC 1035).
+func IsDNS1035Label(value string) []string {
+	var errs []string
+	if len(value) > DNS1035LabelMaxLength {
+		errs = append(errs, MaxLenError(DNS1035LabelMaxLength))
+	}
+	if !dns1035LabelRegexp.MatchString(value) {
+		errs = append(errs, RegexError(dns1035LabelErrMsg, dns1035LabelFmt, "my-name", "abc-123"))
+	}
+	return errs
+}
+
+// wildcard definition - RFC 1034 section 4.3.3.
+// examples:
+// - valid: *.bar.com, *.foo.bar.com
+// - invalid: *.*.bar.com, *.foo.*.com, *bar.com, f*.bar.com, *
+const wildcardDNS1123SubdomainFmt = "\\*\\." + dns1123SubdomainFmt
+const wildcardDNS1123SubdomainErrMsg = "a wildcard DNS-1123 subdomain must start with '*.', followed by a valid DNS subdomain, which must consist of lower case alphanumeric characters, '-' or '.' and end with an alphanumeric character"
+
+// IsWildcardDNS1123Subdomain tests for a string that conforms to the definition of a
+// wildcard subdomain in DNS (RFC 1034 section 4.3.3).
+func IsWildcardDNS1123Subdomain(value string) []string {
+	wildcardDNS1123SubdomainRegexp := regexp.MustCompile("^" + wildcardDNS1123SubdomainFmt + "$")
+
+	var errs []string
+	if len(value) > DNS1123SubdomainMaxLength {
+		errs = append(errs, MaxLenError(DNS1123SubdomainMaxLength))
+	}
+	if !wildcardDNS1123SubdomainRegexp.MatchString(value) {
+		errs = append(errs, RegexError(wildcardDNS1123SubdomainErrMsg, wildcardDNS1123SubdomainFmt, "*.example.com"))
+	}
+	return errs
+}
+
+// IsCIdentifier tests for a string that conforms the definition of an identifier
+// in C. This checks the format, but not the length.
+// Deprecated: Use k8s.io/apimachinery/pkg/api/validate/content.IsCIdentifier instead.
+var IsCIdentifier = content.IsCIdentifier
+
+// IsValidPortNum tests that the argument is a valid, non-zero port number.
+func IsValidPortNum(port int) []string {
+	if 1 <= port && port <= 65535 {
+		return nil
+	}
+	return []string{InclusiveRangeError(1, 65535)}
+}
+
+// IsInRange tests that the argument is in an inclusive range.
+func IsInRange(value int, min int, max int) []string {
+	if value >= min && value <= max {
+		return nil
+	}
+	return []string{InclusiveRangeError(min, max)}
+}
+
+// Now in libcontainer UID/GID limits is 0 ~ 1<<31 - 1
+// TODO: once we have a type for UID/GID we should make these that type.
+const (
+	minUserID  = 0
+	maxUserID  = math.MaxInt32
+	minGroupID = 0
+	maxGroupID = math.MaxInt32
+)
+
+// IsValidGroupID tests that the argument is a valid Unix GID.
+func IsValidGroupID(gid int64) []string {
+	if minGroupID <= gid && gid <= maxGroupID {
+		return nil
+	}
+	return []string{InclusiveRangeError(minGroupID, maxGroupID)}
+}
+
+// IsValidUserID tests that the argument is a valid Unix UID.
+func IsValidUserID(uid int64) []string {
+	if minUserID <= uid && uid <= maxUserID {
+		return nil
+	}
+	return []string{InclusiveRangeError(minUserID, maxUserID)}
+}
+
+var portNameCharsetRegex = regexp.MustCompile("^[-a-z0-9]+$")
+var portNameOneLetterRegexp = regexp.MustCompile("[a-z]")
+
+// IsValidPortName check that the argument is valid syntax. It must be
+// non-empty and no more than 15 characters long. It may contain only [-a-z0-9]
+// and must contain at least one letter [a-z]. It must not start or end with a
+// hyphen, nor contain adjacent hyphens.
+//
+// Note: We only allow lower-case characters, even though RFC 6335 is case
+// insensitive.
+func IsValidPortName(port string) []string {
+	var errs []string
+	if len(port) > 15 {
+		errs = append(errs, MaxLenError(15))
+	}
+	if !portNameCharsetRegex.MatchString(port) {
+		errs = append(errs, "must contain only alpha-numeric characters (a-z, 0-9), and hyphens (-)")
+	}
+	if !portNameOneLetterRegexp.MatchString(port) {
+		errs = append(errs, "must contain at least one letter (a-z)")
+	}
+	if strings.Contains(port, "--") {
+		errs = append(errs, "must not contain consecutive hyphens")
+	}
+	if len(port) > 0 && (port[0] == '-' || port[len(port)-1] == '-') {
+		errs = append(errs, "must not begin or end with a hyphen")
+	}
+	return errs
+}
+
+const percentFmt string = "[0-9]+%"
+const percentErrMsg string = "a valid percent string must be a numeric string followed by an ending '%'"
+
+var percentRegexp = regexp.MustCompile("^" + percentFmt + "$")
+
+// IsValidPercent checks that string is in the form of a percentage
+func IsValidPercent(percent string) []string {
+	if !percentRegexp.MatchString(percent) {
+		return []string{RegexError(percentErrMsg, percentFmt, "1%", "93%")}
+	}
+	return nil
+}
+
+const httpHeaderNameFmt string = "[-A-Za-z0-9]+"
+const httpHeaderNameErrMsg string = "a valid HTTP header must consist of alphanumeric characters or '-'"
+
+var httpHeaderNameRegexp = regexp.MustCompile("^" + httpHeaderNameFmt + "$")
+
+// IsHTTPHeaderName checks that a string conforms to the Go HTTP library's
+// definition of a valid header field name (a stricter subset than RFC7230).
+func IsHTTPHeaderName(value string) []string {
+	if !httpHeaderNameRegexp.MatchString(value) {
+		return []string{RegexError(httpHeaderNameErrMsg, httpHeaderNameFmt, "X-Header-Name")}
+	}
+	return nil
+}
+
+const envVarNameFmt = "[-._a-zA-Z][-._a-zA-Z0-9]*"
+const envVarNameFmtErrMsg string = "a valid environment variable name must consist of alphabetic characters, digits, '_', '-', or '.', and must not start with a digit"
+
+// TODO(hirazawaui): Rename this when the RelaxedEnvironmentVariableValidation gate is removed.
+const relaxedEnvVarNameFmtErrMsg string = "a valid environment variable name must consist only of printable ASCII characters other than '='"
+
+var envVarNameRegexp = regexp.MustCompile("^" + envVarNameFmt + "$")
+
+// IsEnvVarName tests if a string is a valid environment variable name.
+func IsEnvVarName(value string) []string {
+	var errs []string
+	if !envVarNameRegexp.MatchString(value) {
+		errs = append(errs, RegexError(envVarNameFmtErrMsg, envVarNameFmt, "my.env-name", "MY_ENV.NAME", "MyEnvName1"))
+	}
+
+	errs = append(errs, hasChDirPrefix(value)...)
+	return errs
+}
+
+// IsRelaxedEnvVarName tests if a string is a valid environment variable name.
+func IsRelaxedEnvVarName(value string) []string {
+	var errs []string
+
+	if len(value) == 0 {
+		errs = append(errs, "environment variable name "+EmptyError())
+	}
+
+	for _, r := range value {
+		if r > unicode.MaxASCII || !unicode.IsPrint(r) || r == '=' {
+			errs = append(errs, relaxedEnvVarNameFmtErrMsg)
+			break
+		}
+	}
+
+	return errs
+}
+
+const configMapKeyFmt = `[-._a-zA-Z0-9]+`
+const configMapKeyErrMsg string = "a valid config key must consist of alphanumeric characters, '-', '_' or '.'"
+
+var configMapKeyRegexp = regexp.MustCompile("^" + configMapKeyFmt + "$")
+
+// IsConfigMapKey tests for a string that is a valid key for a ConfigMap or Secret
+func IsConfigMapKey(value string) []string {
+	var errs []string
+	if len(value) > DNS1123SubdomainMaxLength {
+		errs = append(errs, MaxLenError(DNS1123SubdomainMaxLength))
+	}
+	if !configMapKeyRegexp.MatchString(value) {
+		errs = append(errs, RegexError(configMapKeyErrMsg, configMapKeyFmt, "key.name", "KEY_NAME", "key-name"))
+	}
+	errs = append(errs, hasChDirPrefix(value)...)
+	return errs
+}
+
+// MaxLenError returns a string explanation of a "string too long" validation
+// failure.
+func MaxLenError(length int) string {
+	return fmt.Sprintf("must be no more than %d characters", length)
+}
+
+// RegexError returns a string explanation of a regex validation failure.
+func RegexError(msg string, fmt string, examples ...string) string {
+	if len(examples) == 0 {
+		return msg + " (regex used for validation is '" + fmt + "')"
+	}
+	msg += " (e.g. "
+	for i := range examples {
+		if i > 0 {
+			msg += " or "
+		}
+		msg += "'" + examples[i] + "', "
+	}
+	msg += "regex used for validation is '" + fmt + "')"
+	return msg
+}
+
+// EmptyError returns a string explanation of a "must not be empty" validation
+// failure.
+func EmptyError() string {
+	return "must be non-empty"
+}
+
+// InclusiveRangeError returns a string explanation of a numeric "must be
+// between" validation failure.
+func InclusiveRangeError(lo, hi int) string {
+	return fmt.Sprintf(`must be between %d and %d, inclusive`, lo, hi)
+}
+
+func hasChDirPrefix(value string) []string {
+	var errs []string
+	switch {
+	case value == ".":
+		errs = append(errs, `must not be '.'`)
+	case value == "..":
+		errs = append(errs, `must not be '..'`)
+	case strings.HasPrefix(value, ".."):
+		errs = append(errs, `must not start with '..'`)
+	}
+	return errs
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/validation/validation_test.go b/third_party/k8s.io/apimachinery/pkg/util/validation/validation_test.go
new file mode 100644
index 0000000000..7affccfb29
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/validation/validation_test.go
@@ -0,0 +1,764 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validation
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestIsDNS1123Label(t *testing.T) {
+	goodValues := []string{
+		"a", "ab", "abc", "a1", "a-1", "a--1--2--b",
+		"0", "01", "012", "1a", "1-a", "1--a--b--2",
+		strings.Repeat("a", 63),
+	}
+	for _, val := range goodValues {
+		if msgs := IsDNS1123Label(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"", "A", "ABC", "aBc", "A1", "A-1", "1-A",
+		"-", "a-", "-a", "1-", "-1",
+		"_", "a_", "_a", "a_b", "1_", "_1", "1_2",
+		".", "a.", ".a", "a.b", "1.", ".1", "1.2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2",
+		strings.Repeat("a", 64),
+	}
+	for _, val := range badValues {
+		if msgs := IsDNS1123Label(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
+
+func TestIsDNS1123Subdomain(t *testing.T) {
+	goodValues := []string{
+		"a", "ab", "abc", "a1", "a-1", "a--1--2--b",
+		"0", "01", "012", "1a", "1-a", "1--a--b--2",
+		"a.a", "ab.a", "abc.a", "a1.a", "a-1.a", "a--1--2--b.a",
+		"a.1", "ab.1", "abc.1", "a1.1", "a-1.1", "a--1--2--b.1",
+		"0.a", "01.a", "012.a", "1a.a", "1-a.a", "1--a--b--2",
+		"0.1", "01.1", "012.1", "1a.1", "1-a.1", "1--a--b--2.1",
+		"a.b.c.d.e", "aa.bb.cc.dd.ee", "1.2.3.4.5", "11.22.33.44.55",
+		strings.Repeat("a", 253),
+	}
+	for _, val := range goodValues {
+		if msgs := IsDNS1123Subdomain(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"", "A", "ABC", "aBc", "A1", "A-1", "1-A",
+		"-", "a-", "-a", "1-", "-1",
+		"_", "a_", "_a", "a_b", "1_", "_1", "1_2",
+		".", "a.", ".a", "a..b", "1.", ".1", "1..2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2",
+		"A.a", "aB.a", "ab.A", "A1.a", "a1.A",
+		"A.1", "aB.1", "A1.1", "1A.1",
+		"0.A", "01.A", "012.A", "1A.a", "1a.A",
+		"A.B.C.D.E", "AA.BB.CC.DD.EE", "a.B.c.d.e", "aa.bB.cc.dd.ee",
+		"a@b", "a,b", "a_b", "a;b",
+		"a:b", "a%b", "a?b", "a$b",
+		strings.Repeat("a", 254),
+	}
+	for _, val := range badValues {
+		if msgs := IsDNS1123Subdomain(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
+
+func TestIsDNS1035Label(t *testing.T) {
+	goodValues := []string{
+		"a", "ab", "abc", "a1", "a-1", "a--1--2--b",
+		strings.Repeat("a", 63),
+	}
+	for _, val := range goodValues {
+		if msgs := IsDNS1035Label(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"0", "01", "012", "1a", "1-a", "1--a--b--2",
+		"", "A", "ABC", "aBc", "A1", "A-1", "1-A",
+		"-", "a-", "-a", "1-", "-1",
+		"_", "a_", "_a", "a_b", "1_", "_1", "1_2",
+		".", "a.", ".a", "a.b", "1.", ".1", "1.2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2",
+		strings.Repeat("a", 64),
+	}
+	for _, val := range badValues {
+		if msgs := IsDNS1035Label(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
+
+func TestIsValidPortNum(t *testing.T) {
+	goodValues := []int{1, 2, 1000, 16384, 32768, 65535}
+	for _, val := range goodValues {
+		if msgs := IsValidPortNum(val); len(msgs) != 0 {
+			t.Errorf("expected true for %d, got %v", val, msgs)
+		}
+	}
+
+	badValues := []int{0, -1, 65536, 100000}
+	for _, val := range badValues {
+		if msgs := IsValidPortNum(val); len(msgs) == 0 {
+			t.Errorf("expected false for %d", val)
+		}
+	}
+}
+
+func TestIsInRange(t *testing.T) {
+	goodValues := []struct {
+		value int
+		min   int
+		max   int
+	}{{1, 0, 10}, {5, 5, 20}, {25, 10, 25}}
+	for _, val := range goodValues {
+		if msgs := IsInRange(val.value, val.min, val.max); len(msgs) > 0 {
+			t.Errorf("expected no errors for %#v, but got %v", val, msgs)
+		}
+	}
+
+	badValues := []struct {
+		value int
+		min   int
+		max   int
+	}{{1, 2, 10}, {5, -4, 2}, {25, 100, 120}}
+	for _, val := range badValues {
+		if msgs := IsInRange(val.value, val.min, val.max); len(msgs) == 0 {
+			t.Errorf("expected errors for %#v", val)
+		}
+	}
+}
+
+func createGroupIDs(ids ...int64) []int64 {
+	var output []int64
+	for _, id := range ids {
+		output = append(output, int64(id))
+	}
+	return output
+}
+
+func createUserIDs(ids ...int64) []int64 {
+	var output []int64
+	for _, id := range ids {
+		output = append(output, int64(id))
+	}
+	return output
+}
+
+func TestIsValidGroupID(t *testing.T) {
+	goodValues := createGroupIDs(0, 1, 1000, 65535, 2147483647)
+	for _, val := range goodValues {
+		if msgs := IsValidGroupID(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%d': %v", val, msgs)
+		}
+	}
+
+	badValues := createGroupIDs(-1, -1003, 2147483648, 4147483647)
+	for _, val := range badValues {
+		if msgs := IsValidGroupID(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%d'", val)
+		}
+	}
+}
+
+func TestIsValidUserID(t *testing.T) {
+	goodValues := createUserIDs(0, 1, 1000, 65535, 2147483647)
+	for _, val := range goodValues {
+		if msgs := IsValidUserID(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%d': %v", val, msgs)
+		}
+	}
+
+	badValues := createUserIDs(-1, -1003, 2147483648, 4147483647)
+	for _, val := range badValues {
+		if msgs := IsValidUserID(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%d'", val)
+		}
+	}
+}
+
+func TestIsValidPortName(t *testing.T) {
+	goodValues := []string{"telnet", "re-mail-ck", "pop3", "a", "a-1", "1-a", "a-1-b-2-c", "1-a-2-b-3"}
+	for _, val := range goodValues {
+		if msgs := IsValidPortName(val); len(msgs) != 0 {
+			t.Errorf("expected true for %q: %v", val, msgs)
+		}
+	}
+
+	badValues := []string{"longerthan15characters", "", strings.Repeat("a", 16), "12345", "1-2-3-4", "-begin", "end-", "two--hyphens", "whois++"}
+	for _, val := range badValues {
+		if msgs := IsValidPortName(val); len(msgs) == 0 {
+			t.Errorf("expected false for %q", val)
+		}
+	}
+}
+
+func TestIsQualifiedName(t *testing.T) {
+	successCases := []string{
+		"simple",
+		"now-with-dashes",
+		"1-starts-with-num",
+		"1234",
+		"simple/simple",
+		"now-with-dashes/simple",
+		"now-with-dashes/now-with-dashes",
+		"now.with.dots/simple",
+		"now-with.dashes-and.dots/simple",
+		"1-num.2-num/3-num",
+		"1234/5678",
+		"1.2.3.4/5678",
+		"Uppercase_Is_OK_123",
+		"example.com/Uppercase_Is_OK_123",
+		"requests.storage-foo",
+		strings.Repeat("a", 63),
+		strings.Repeat("a", 253) + "/" + strings.Repeat("b", 63),
+	}
+	for i := range successCases {
+		if errs := IsQualifiedName(successCases[i]); len(errs) != 0 {
+			t.Errorf("case[%d]: %q: expected success: %v", i, successCases[i], errs)
+		}
+	}
+
+	errorCases := []string{
+		"nospecialchars%^=@",
+		"cantendwithadash-",
+		"-cantstartwithadash-",
+		"only/one/slash",
+		"Example.com/abc",
+		"example_com/abc",
+		"example.com/",
+		"/simple",
+		strings.Repeat("a", 64),
+		strings.Repeat("a", 254) + "/abc",
+	}
+	for i := range errorCases {
+		if errs := IsQualifiedName(errorCases[i]); len(errs) == 0 {
+			t.Errorf("case[%d]: %q: expected failure", i, errorCases[i])
+		}
+	}
+}
+
+func TestIsValidLabelValue(t *testing.T) {
+	successCases := []string{
+		"simple",
+		"now-with-dashes",
+		"1-starts-with-num",
+		"end-with-num-1",
+		"1234",                  // only num
+		strings.Repeat("a", 63), // to the limit
+		"",                      // empty value
+	}
+	for i := range successCases {
+		if errs := IsValidLabelValue(successCases[i]); len(errs) != 0 {
+			t.Errorf("case %s expected success: %v", successCases[i], errs)
+		}
+	}
+
+	errorCases := []string{
+		"nospecialchars%^=@",
+		"Tama-nui-te-rā.is.Māori.sun",
+		"\\backslashes\\are\\bad",
+		"-starts-with-dash",
+		"ends-with-dash-",
+		".starts.with.dot",
+		"ends.with.dot.",
+		strings.Repeat("a", 64), // over the limit
+	}
+	for i := range errorCases {
+		if errs := IsValidLabelValue(errorCases[i]); len(errs) == 0 {
+			t.Errorf("case[%d] expected failure", i)
+		}
+	}
+}
+
+func TestIsHTTPHeaderName(t *testing.T) {
+	goodValues := []string{
+		// Common ones
+		"Accept-Encoding", "Host", "If-Modified-Since", "X-Forwarded-For",
+		// Weirdo, but still conforming names
+		"a", "ab", "abc", "a1", "-a", "a-", "a-b", "a-1", "a--1--2--b", "--abc-123",
+		"A", "AB", "AbC", "A1", "-A", "A-", "A-B", "A-1", "A--1--2--B", "--123-ABC",
+	}
+	for _, val := range goodValues {
+		if msgs := IsHTTPHeaderName(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"Host:", "X-Forwarded-For:", "X-@Home",
+		"", "_", "a_", "_a", "1_", "1_2", ".", "a.", ".a", "a.b", "1.", ".1", "1.2",
+		" ", "a ", " a", "a b", "1 ", " 1", "1 2", "#a#", "^", ",", ";", "=", "<",
+		"?", "@", "{",
+	}
+	for _, val := range badValues {
+		if msgs := IsHTTPHeaderName(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
+
+func TestIsValidPercent(t *testing.T) {
+	goodValues := []string{
+		"0%",
+		"00000%",
+		"1%",
+		"01%",
+		"99%",
+		"100%",
+		"101%",
+	}
+	for _, val := range goodValues {
+		if msgs := IsValidPercent(val); len(msgs) != 0 {
+			t.Errorf("expected true for %q: %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"",
+		"0",
+		"100",
+		"0.0%",
+		"99.9%",
+		"hundred",
+		" 1%",
+		"1% ",
+		"-0%",
+		"-1%",
+		"+1%",
+	}
+	for _, val := range badValues {
+		if msgs := IsValidPercent(val); len(msgs) == 0 {
+			t.Errorf("expected false for %q", val)
+		}
+	}
+}
+
+func TestIsConfigMapKey(t *testing.T) {
+	successCases := []string{
+		"a",
+		"good",
+		"good-good",
+		"still.good",
+		"this.is.also.good",
+		".so.is.this",
+		"THIS_IS_GOOD",
+		"so_is_this_17",
+	}
+
+	for i := range successCases {
+		if errs := IsConfigMapKey(successCases[i]); len(errs) != 0 {
+			t.Errorf("[%d] expected success: %v", i, errs)
+		}
+	}
+
+	failureCases := []string{
+		".",
+		"..",
+		"..bad",
+		"b*d",
+		"bad!&bad",
+	}
+
+	for i := range failureCases {
+		if errs := IsConfigMapKey(failureCases[i]); len(errs) == 0 {
+			t.Errorf("[%d] expected failure", i)
+		}
+	}
+}
+
+func TestIsWildcardDNS1123Subdomain(t *testing.T) {
+	goodValues := []string{
+		"*.example.com",
+		"*.bar.com",
+		"*.foo.bar.com",
+	}
+	for _, val := range goodValues {
+		if errs := IsWildcardDNS1123Subdomain(val); len(errs) != 0 {
+			t.Errorf("expected no errors for %q: %v", val, errs)
+		}
+	}
+
+	badValues := []string{
+		"*.*.bar.com",
+		"*.foo.*.com",
+		"*bar.com",
+		"f*.bar.com",
+		"*",
+	}
+	for _, val := range badValues {
+		if errs := IsWildcardDNS1123Subdomain(val); len(errs) == 0 {
+			t.Errorf("expected errors for %q", val)
+		}
+	}
+}
+
+func TestIsFullyQualifiedDomainName(t *testing.T) {
+	goodValues := []string{
+		"a.com",
+		"k8s.io",
+		"dev.k8s.io",
+		"dev.k8s.io.",
+		"foo.example.com",
+		"this.is.a.really.long.fqdn",
+		"bbc.co.uk",
+		"10.0.0.1", // DNS labels can start with numbers and there is no requirement for letters.
+		"hyphens-are-good.k8s.io",
+		strings.Repeat("a", 63) + ".k8s.io",
+		strings.Repeat("a", 63) + "." + strings.Repeat("b", 63) + "." + strings.Repeat("c", 63) + "." + strings.Repeat("d", 54) + ".k8s.io",
+	}
+	for _, val := range goodValues {
+		if err := IsFullyQualifiedDomainName(field.NewPath(""), val).ToAggregate(); err != nil {
+			t.Errorf("expected no errors for %q: %v", val, err)
+		}
+	}
+
+	badValues := []string{
+		".",
+		"...",
+		".io",
+		"com",
+		".com",
+		"Dev.k8s.io",
+		".foo.example.com",
+		"*.example.com",
+		"*.bar.com",
+		"*.foo.bar.com",
+		"underscores_are_bad.k8s.io",
+		"foo@bar.example.com",
+		"http://foo.example.com",
+		strings.Repeat("a", 64) + ".k8s.io",
+		strings.Repeat("a", 63) + "." + strings.Repeat("b", 63) + "." + strings.Repeat("c", 63) + "." + strings.Repeat("d", 55) + ".k8s.io",
+	}
+	for _, val := range badValues {
+		if err := IsFullyQualifiedDomainName(field.NewPath(""), val).ToAggregate(); err == nil {
+			t.Errorf("expected errors for %q", val)
+		}
+	}
+}
+
+func TestIsFullyQualifiedName(t *testing.T) {
+	goodValues := []string{
+		"dev.k8s.io",
+		"foo.example.com",
+		"this.is.a.really.long.fqdn",
+		"bbc.co.uk",
+		"10.0.0.1", // DNS labels can start with numbers and there is no requirement for letters.
+		"hyphens-are-good.k8s.io",
+		strings.Repeat("a", 246) + ".k8s.io",
+	}
+	for _, val := range goodValues {
+		if err := IsFullyQualifiedName(field.NewPath(""), val).ToAggregate(); err != nil {
+			t.Errorf("expected no errors for %q: %v", val, err)
+		}
+	}
+
+	badValues := []string{
+		"...",
+		"dev.k8s.io.",
+		".io",
+		"Dev.k8s.io",
+		"k8s.io",
+		"*.example.com",
+		"*.bar.com",
+		"*.foo.bar.com",
+		"underscores_are_bad.k8s.io",
+		"foo@bar.example.com",
+		"http://foo.example.com",
+		strings.Repeat("a", 247) + ".k8s.io",
+	}
+	for _, val := range badValues {
+		if err := IsFullyQualifiedName(field.NewPath(""), val).ToAggregate(); err == nil {
+			t.Errorf("expected errors for %q", val)
+		}
+	}
+
+	messageTests := []struct {
+		name       string
+		targetName string
+		err        string
+	}{{
+		name:       "name needs to be fully qualified, i.e., contains at least 2 dots",
+		targetName: "k8s.io",
+		err:        "should be a domain with at least three segments separated by dots",
+	}, {
+		name:       "name should not include scheme",
+		targetName: "http://foo.k8s.io",
+		err:        "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters",
+	}, {
+		name:       "email should be invalid",
+		targetName: "example@foo.k8s.io",
+		err:        "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters",
+	}, {
+		name:       "name cannot be empty",
+		targetName: "",
+		err:        "Required value",
+	}, {
+		name:       "name must conform to RFC 1123",
+		targetName: "A.B.C",
+		err:        "a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters",
+	}}
+	for _, tc := range messageTests {
+		err := IsFullyQualifiedName(field.NewPath(""), tc.targetName).ToAggregate()
+		switch {
+		case tc.err == "" && err != nil:
+			t.Errorf("%q: unexpected error: %v", tc.name, err)
+		case tc.err != "" && err == nil:
+			t.Errorf("%q: unexpected no error, expected %s", tc.name, tc.err)
+		case tc.err != "" && err != nil && !strings.Contains(err.Error(), tc.err):
+			t.Errorf("%q: expected %s, got %v", tc.name, tc.err, err)
+		}
+	}
+}
+
+func TestIsDomainPrefixedPath(t *testing.T) {
+	goodValues := []string{
+		"a/b",
+		"a/b/c/d",
+		"a.com/foo",
+		"a.b.c.d/foo",
+		"k8s.io/foo/bar",
+		"k8s.io/FOO/BAR",
+		"dev.k8s.io/more/path",
+		"this.is.a.really.long.fqdn/even/longer/path/just/because",
+		"bbc.co.uk/path/goes/here",
+		"10.0.0.1/foo",
+		"hyphens-are-good.k8s.io/and-in-paths-too",
+		strings.Repeat("a", 240) + ".k8s.io/a",
+		"k8s.io/" + strings.Repeat("a", 240),
+	}
+	for _, val := range goodValues {
+		if err := IsDomainPrefixedPath(field.NewPath(""), val).ToAggregate(); err != nil {
+			t.Errorf("expected no errors for %q: %v", val, err)
+		}
+	}
+
+	badValues := []string{
+		".",
+		"...",
+		"/b",
+		"com",
+		".com",
+		"a.b.c.d/foo?a=b",
+		"a.b.c.d/foo#a",
+		"Dev.k8s.io",
+		".foo.example.com",
+		"*.example.com",
+		"example.com/foo{}[]@^`",
+		"underscores_are_bad.k8s.io",
+		"underscores_are_bad.k8s.io/foo",
+		"foo@bar.example.com",
+		"foo@bar.example.com/foo",
+		strings.Repeat("a", 247) + ".k8s.io",
+	}
+	for _, val := range badValues {
+		if err := IsDomainPrefixedPath(field.NewPath(""), val).ToAggregate(); err == nil {
+			t.Errorf("expected errors for %q", val)
+		}
+	}
+}
+
+func TestIsRelaxedEnvVarName(t *testing.T) {
+	goodValues := []string{
+		"-", ":", "_", "+a", ">a", "<a",
+		"a.", "a..", "*a", "%a", "?a",
+		"a:a", "a_a", "aAz", "~a", "|a",
+		"a0a", "a9", "/a", "a ", "#a",
+		"0a", "0 a", "'a", "(a", "@a",
+	}
+	for _, val := range goodValues {
+		if msgs := IsRelaxedEnvVarName(val); len(msgs) != 0 {
+			t.Errorf("expected true for '%s': %v", val, msgs)
+		}
+	}
+
+	badValues := []string{
+		"", "=", "a=", "1=a", "a=b", "#%=&&",
+		string(rune(1)) + "abc", string(rune(130)) + "abc",
+		"Ç ç", "Ä ä", "Ñ ñ", "Ø ø",
+	}
+
+	for _, val := range badValues {
+		if msgs := IsRelaxedEnvVarName(val); len(msgs) == 0 {
+			t.Errorf("expected false for '%s'", val)
+		}
+	}
+}
+
+func TestIsDNS1123SubdomainWithUnderscore(t *testing.T) {
+	tests := []struct {
+		name     string
+		value    string
+		expected []string
+	}{
+		{
+			name:     "valid subdomain",
+			value:    "example.com",
+			expected: nil,
+		},
+		{
+			name:     "valid subdomain with underscore",
+			value:    "_example.com",
+			expected: nil,
+		},
+		{
+			name:     "valid subdomain with multiple segments",
+			value:    "sub._example.com",
+			expected: nil,
+		},
+		{
+			name:     "valid subdomain with hyphen",
+			value:    "sub-domain.example.com",
+			expected: nil,
+		},
+		{
+			name:     "valid subdomain with underscore in middle",
+			value:    "sub_domain.example.com",
+			expected: nil,
+		},
+		{
+			name:     "empty string",
+			value:    "",
+			expected: []string{RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+		{
+			name:     "invalid uppercase characters",
+			value:    "Example.com",
+			expected: []string{RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+		{
+			name:     "invalid starting character",
+			value:    "-example.com",
+			expected: []string{RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+		{
+			name:     "invalid ending character",
+			value:    "example.com-",
+			expected: []string{RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+		{
+			name:     "invalid characters",
+			value:    "example@.com",
+			expected: []string{RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+		{
+			name:     "too long subdomain",
+			value:    "a." + string(make([]byte, 251)) + ".com",
+			expected: []string{MaxLenError(DNS1123SubdomainMaxLength), RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+		{
+			name:     "multiple dots",
+			value:    "example..com",
+			expected: []string{RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+		{
+			name:     "underscore only",
+			value:    "_",
+			expected: []string{RegexError(dns1123SubdomainErrorMsgFG, dns1123SubdomainFmtWithUnderscore, "example.com")},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := IsDNS1123SubdomainWithUnderscore(tt.value)
+			if !reflect.DeepEqual(result, tt.expected) {
+				t.Errorf("IsDNS1123SubdomainWithUnderscore(%q) = %v; want %v", tt.value, result, tt.expected)
+			}
+		})
+	}
+}
+
+func TestIsDomainPrefixedKey(t *testing.T) {
+	tests := []struct {
+		name     string
+		value    string
+		expected field.ErrorList
+	}{
+		{
+			name:     "valid domain-prefixed key 1",
+			value:    "example.com/foo",
+			expected: nil,
+		},
+		{
+			name:     "valid domain-prefixed key  2",
+			value:    "example/com",
+			expected: nil,
+		},
+		{
+			name:     "invalid key 1",
+			value:    "example",
+			expected: field.ErrorList{field.Invalid(field.NewPath("test"), "example", "must be a domain-prefixed key (such as \"acme.io/foo\")")},
+		},
+		{
+			name:     "invalid key 2",
+			value:    "example/foo/bar",
+			expected: field.ErrorList{field.Invalid(field.NewPath("test"), "example/foo/bar", "a valid label key must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')")},
+		},
+		{
+			name:     "invalid key 3",
+			value:    "/example/foo",
+			expected: field.ErrorList{field.Invalid(field.NewPath("test"), "/example/foo", "a valid label key must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')")},
+		},
+		{
+			name:     "invalid key 4",
+			value:    "",
+			expected: field.ErrorList{field.Required(field.NewPath("test"), "")},
+		},
+		{
+			name:     "invalid key 5",
+			value:    "example.com/_e",
+			expected: field.ErrorList{field.Invalid(field.NewPath("test"), "example.com/_e", "name part must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]')")},
+		},
+		{
+			name:     "invalid key 6",
+			value:    "example.com/e_",
+			expected: field.ErrorList{field.Invalid(field.NewPath("test"), "example.com/e_", "name part must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]')")},
+		},
+		{
+			name:     "invalid key 7",
+			value:    "example.com/e?",
+			expected: field.ErrorList{field.Invalid(field.NewPath("test"), "example.com/e?", "name part must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]')")},
+		},
+		{
+			name:     "invalid key 8",
+			value:    "example.com/e_$",
+			expected: field.ErrorList{field.Invalid(field.NewPath("test"), "example.com/e_$", "name part must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]')")},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := IsDomainPrefixedKey(field.NewPath("test"), tt.value)
+			if !reflect.DeepEqual(result, tt.expected) {
+				t.Errorf("IsDomainPrefixedKey(%q) = %v; want %v", tt.value, result, tt.expected)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/version/doc.go b/third_party/k8s.io/apimachinery/pkg/util/version/doc.go
new file mode 100644
index 0000000000..da88813da2
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/version/doc.go
@@ -0,0 +1,18 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package version provides utilities for version number comparisons
+package version
diff --git a/third_party/k8s.io/apimachinery/pkg/util/version/version.go b/third_party/k8s.io/apimachinery/pkg/util/version/version.go
new file mode 100644
index 0000000000..72c0769e6c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/version/version.go
@@ -0,0 +1,484 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package version
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+
+	apimachineryversion "k8s.io/apimachinery/pkg/version"
+)
+
+// Version is an opaque representation of a version number
+type Version struct {
+	components    []uint
+	semver        bool
+	preRelease    string
+	buildMetadata string
+}
+
+var (
+	// versionMatchRE splits a version string into numeric and "extra" parts
+	versionMatchRE = regexp.MustCompile(`^\s*v?([0-9]+(?:\.[0-9]+)*)(.*)*$`)
+	// extraMatchRE splits the "extra" part of versionMatchRE into semver pre-release and build metadata; it does not validate the "no leading zeroes" constraint for pre-release
+	extraMatchRE = regexp.MustCompile(`^(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?\s*$`)
+)
+
+func parse(str string, semver bool) (*Version, error) {
+	parts := versionMatchRE.FindStringSubmatch(str)
+	if parts == nil {
+		return nil, fmt.Errorf("could not parse %q as version", str)
+	}
+	numbers, extra := parts[1], parts[2]
+
+	components := strings.Split(numbers, ".")
+	if (semver && len(components) != 3) || (!semver && len(components) < 2) {
+		return nil, fmt.Errorf("illegal version string %q", str)
+	}
+
+	v := &Version{
+		components: make([]uint, len(components)),
+		semver:     semver,
+	}
+	for i, comp := range components {
+		if (i == 0 || semver) && strings.HasPrefix(comp, "0") && comp != "0" {
+			return nil, fmt.Errorf("illegal zero-prefixed version component %q in %q", comp, str)
+		}
+		num, err := strconv.ParseUint(comp, 10, 0)
+		if err != nil {
+			return nil, fmt.Errorf("illegal non-numeric version component %q in %q: %v", comp, str, err)
+		}
+		v.components[i] = uint(num)
+	}
+
+	if semver && extra != "" {
+		extraParts := extraMatchRE.FindStringSubmatch(extra)
+		if extraParts == nil {
+			return nil, fmt.Errorf("could not parse pre-release/metadata (%s) in version %q", extra, str)
+		}
+		v.preRelease, v.buildMetadata = extraParts[1], extraParts[2]
+
+		for _, comp := range strings.Split(v.preRelease, ".") {
+			if _, err := strconv.ParseUint(comp, 10, 0); err == nil {
+				if strings.HasPrefix(comp, "0") && comp != "0" {
+					return nil, fmt.Errorf("illegal zero-prefixed version component %q in %q", comp, str)
+				}
+			}
+		}
+	}
+
+	return v, nil
+}
+
+// HighestSupportedVersion returns the highest supported version
+// This function assumes that the highest supported version must be v1.x.
+func HighestSupportedVersion(versions []string) (*Version, error) {
+	if len(versions) == 0 {
+		return nil, errors.New("empty array for supported versions")
+	}
+
+	var (
+		highestSupportedVersion *Version
+		theErr                  error
+	)
+
+	for i := len(versions) - 1; i >= 0; i-- {
+		currentHighestVer, err := ParseGeneric(versions[i])
+		if err != nil {
+			theErr = err
+			continue
+		}
+
+		if currentHighestVer.Major() > 1 {
+			continue
+		}
+
+		if highestSupportedVersion == nil || highestSupportedVersion.LessThan(currentHighestVer) {
+			highestSupportedVersion = currentHighestVer
+		}
+	}
+
+	if highestSupportedVersion == nil {
+		return nil, fmt.Errorf(
+			"could not find a highest supported version from versions (%v) reported: %+v",
+			versions, theErr)
+	}
+
+	if highestSupportedVersion.Major() != 1 {
+		return nil, fmt.Errorf("highest supported version reported is %v, must be v1.x", highestSupportedVersion)
+	}
+
+	return highestSupportedVersion, nil
+}
+
+// ParseGeneric parses a "generic" version string. The version string must consist of two
+// or more dot-separated numeric fields (the first of which can't have leading zeroes),
+// followed by arbitrary uninterpreted data (which need not be separated from the final
+// numeric field by punctuation). For convenience, leading and trailing whitespace is
+// ignored, and the version can be preceded by the letter "v". See also ParseSemantic.
+func ParseGeneric(str string) (*Version, error) {
+	return parse(str, false)
+}
+
+// MustParseGeneric is like ParseGeneric except that it panics on error
+func MustParseGeneric(str string) *Version {
+	v, err := ParseGeneric(str)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// Parse tries to do ParseSemantic first to keep more information.
+// If ParseSemantic fails, it would just do ParseGeneric.
+func Parse(str string) (*Version, error) {
+	v, err := parse(str, true)
+	if err != nil {
+		return parse(str, false)
+	}
+	return v, err
+}
+
+// MustParse is like Parse except that it panics on error
+func MustParse(str string) *Version {
+	v, err := Parse(str)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// ParseMajorMinor parses a "generic" version string and returns a version with the major and minor version.
+func ParseMajorMinor(str string) (*Version, error) {
+	v, err := ParseGeneric(str)
+	if err != nil {
+		return nil, err
+	}
+	return MajorMinor(v.Major(), v.Minor()), nil
+}
+
+// MustParseMajorMinor is like ParseMajorMinor except that it panics on error
+func MustParseMajorMinor(str string) *Version {
+	v, err := ParseMajorMinor(str)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// ParseSemantic parses a version string that exactly obeys the syntax and semantics of
+// the "Semantic Versioning" specification (http://semver.org/) (although it ignores
+// leading and trailing whitespace, and allows the version to be preceded by "v"). For
+// version strings that are not guaranteed to obey the Semantic Versioning syntax, use
+// ParseGeneric.
+func ParseSemantic(str string) (*Version, error) {
+	return parse(str, true)
+}
+
+// MustParseSemantic is like ParseSemantic except that it panics on error
+func MustParseSemantic(str string) *Version {
+	v, err := ParseSemantic(str)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// MajorMinor returns a version with the provided major and minor version.
+func MajorMinor(major, minor uint) *Version {
+	return &Version{components: []uint{major, minor}}
+}
+
+// Major returns the major release number
+func (v *Version) Major() uint {
+	return v.components[0]
+}
+
+// Minor returns the minor release number
+func (v *Version) Minor() uint {
+	return v.components[1]
+}
+
+// Patch returns the patch release number if v is a Semantic Version, or 0
+func (v *Version) Patch() uint {
+	if len(v.components) < 3 {
+		return 0
+	}
+	return v.components[2]
+}
+
+// BuildMetadata returns the build metadata, if v is a Semantic Version, or ""
+func (v *Version) BuildMetadata() string {
+	return v.buildMetadata
+}
+
+// PreRelease returns the prerelease metadata, if v is a Semantic Version, or ""
+func (v *Version) PreRelease() string {
+	return v.preRelease
+}
+
+// Components returns the version number components
+func (v *Version) Components() []uint {
+	return v.components
+}
+
+// WithMajor returns copy of the version object with requested major number
+func (v *Version) WithMajor(major uint) *Version {
+	result := *v
+	result.components = []uint{major, v.Minor(), v.Patch()}
+	return &result
+}
+
+// WithMinor returns copy of the version object with requested minor number
+func (v *Version) WithMinor(minor uint) *Version {
+	result := *v
+	result.components = []uint{v.Major(), minor, v.Patch()}
+	return &result
+}
+
+// SubtractMinor returns the version with offset from the original minor, with the same major and no patch.
+// If -offset >= current minor, the minor would be 0.
+func (v *Version) OffsetMinor(offset int) *Version {
+	var minor uint
+	if offset >= 0 {
+		minor = v.Minor() + uint(offset)
+	} else {
+		diff := uint(-offset)
+		if diff < v.Minor() {
+			minor = v.Minor() - diff
+		}
+	}
+	return MajorMinor(v.Major(), minor)
+}
+
+// SubtractMinor returns the version diff minor versions back, with the same major and no patch.
+// If diff >= current minor, the minor would be 0.
+func (v *Version) SubtractMinor(diff uint) *Version {
+	return v.OffsetMinor(-int(diff))
+}
+
+// AddMinor returns the version diff minor versions forward, with the same major and no patch.
+func (v *Version) AddMinor(diff uint) *Version {
+	return v.OffsetMinor(int(diff))
+}
+
+// WithPatch returns copy of the version object with requested patch number
+func (v *Version) WithPatch(patch uint) *Version {
+	result := *v
+	result.components = []uint{v.Major(), v.Minor(), patch}
+	return &result
+}
+
+// WithPreRelease returns copy of the version object with requested prerelease
+func (v *Version) WithPreRelease(preRelease string) *Version {
+	if len(preRelease) == 0 {
+		return v
+	}
+	result := *v
+	result.components = []uint{v.Major(), v.Minor(), v.Patch()}
+	result.preRelease = preRelease
+	return &result
+}
+
+// WithBuildMetadata returns copy of the version object with requested buildMetadata
+func (v *Version) WithBuildMetadata(buildMetadata string) *Version {
+	result := *v
+	result.components = []uint{v.Major(), v.Minor(), v.Patch()}
+	result.buildMetadata = buildMetadata
+	return &result
+}
+
+// String converts a Version back to a string; note that for versions parsed with
+// ParseGeneric, this will not include the trailing uninterpreted portion of the version
+// number.
+func (v *Version) String() string {
+	if v == nil {
+		return "<nil>"
+	}
+	var buffer bytes.Buffer
+
+	for i, comp := range v.components {
+		if i > 0 {
+			buffer.WriteString(".")
+		}
+		buffer.WriteString(fmt.Sprintf("%d", comp))
+	}
+	if v.preRelease != "" {
+		buffer.WriteString("-")
+		buffer.WriteString(v.preRelease)
+	}
+	if v.buildMetadata != "" {
+		buffer.WriteString("+")
+		buffer.WriteString(v.buildMetadata)
+	}
+
+	return buffer.String()
+}
+
+// compareInternal returns -1 if v is less than other, 1 if it is greater than other, or 0
+// if they are equal
+func (v *Version) compareInternal(other *Version) int {
+
+	vLen := len(v.components)
+	oLen := len(other.components)
+	for i := 0; i < vLen && i < oLen; i++ {
+		switch {
+		case other.components[i] < v.components[i]:
+			return 1
+		case other.components[i] > v.components[i]:
+			return -1
+		}
+	}
+
+	// If components are common but one has more items and they are not zeros, it is bigger
+	switch {
+	case oLen < vLen && !onlyZeros(v.components[oLen:]):
+		return 1
+	case oLen > vLen && !onlyZeros(other.components[vLen:]):
+		return -1
+	}
+
+	if !v.semver || !other.semver {
+		return 0
+	}
+
+	switch {
+	case v.preRelease == "" && other.preRelease != "":
+		return 1
+	case v.preRelease != "" && other.preRelease == "":
+		return -1
+	case v.preRelease == other.preRelease: // includes case where both are ""
+		return 0
+	}
+
+	vPR := strings.Split(v.preRelease, ".")
+	oPR := strings.Split(other.preRelease, ".")
+	for i := 0; i < len(vPR) && i < len(oPR); i++ {
+		vNum, err := strconv.ParseUint(vPR[i], 10, 0)
+		if err == nil {
+			oNum, err := strconv.ParseUint(oPR[i], 10, 0)
+			if err == nil {
+				switch {
+				case oNum < vNum:
+					return 1
+				case oNum > vNum:
+					return -1
+				default:
+					continue
+				}
+			}
+		}
+		if oPR[i] < vPR[i] {
+			return 1
+		} else if oPR[i] > vPR[i] {
+			return -1
+		}
+	}
+
+	switch {
+	case len(oPR) < len(vPR):
+		return 1
+	case len(oPR) > len(vPR):
+		return -1
+	}
+
+	return 0
+}
+
+// returns false if array contain any non-zero element
+func onlyZeros(array []uint) bool {
+	for _, num := range array {
+		if num != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+// EqualTo tests if a version is equal to a given version.
+func (v *Version) EqualTo(other *Version) bool {
+	if v == nil {
+		return other == nil
+	}
+	if other == nil {
+		return false
+	}
+	return v.compareInternal(other) == 0
+}
+
+// AtLeast tests if a version is at least equal to a given minimum version. If both
+// Versions are Semantic Versions, this will use the Semantic Version comparison
+// algorithm. Otherwise, it will compare only the numeric components, with non-present
+// components being considered "0" (ie, "1.4" is equal to "1.4.0").
+func (v *Version) AtLeast(min *Version) bool {
+	return v.compareInternal(min) != -1
+}
+
+// LessThan tests if a version is less than a given version. (It is exactly the opposite
+// of AtLeast, for situations where asking "is v too old?" makes more sense than asking
+// "is v new enough?".)
+func (v *Version) LessThan(other *Version) bool {
+	return v.compareInternal(other) == -1
+}
+
+// GreaterThan tests if a version is greater than a given version.
+func (v *Version) GreaterThan(other *Version) bool {
+	return v.compareInternal(other) == 1
+}
+
+// Compare compares v against a version string (which will be parsed as either Semantic
+// or non-Semantic depending on v). On success it returns -1 if v is less than other, 1 if
+// it is greater than other, or 0 if they are equal.
+func (v *Version) Compare(other string) (int, error) {
+	ov, err := parse(other, v.semver)
+	if err != nil {
+		return 0, err
+	}
+	return v.compareInternal(ov), nil
+}
+
+// WithInfo returns copy of the version object.
+// Deprecated: The Info field has been removed from the Version struct. This method no longer modifies the Version object.
+func (v *Version) WithInfo(info apimachineryversion.Info) *Version {
+	result := *v
+	return &result
+}
+
+// Info returns the version information of a component.
+// Deprecated: Use Info() from effective version instead.
+func (v *Version) Info() *apimachineryversion.Info {
+	if v == nil {
+		return nil
+	}
+	// in case info is empty, or the major and minor in info is different from the actual major and minor
+	return &apimachineryversion.Info{
+		Major:      Itoa(v.Major()),
+		Minor:      Itoa(v.Minor()),
+		GitVersion: v.String(),
+	}
+}
+
+func Itoa(i uint) string {
+	if i == 0 {
+		return ""
+	}
+	return strconv.Itoa(int(i))
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/version/version_test.go b/third_party/k8s.io/apimachinery/pkg/util/version/version_test.go
new file mode 100644
index 0000000000..a3345ddfdd
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/version/version_test.go
@@ -0,0 +1,550 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package version
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+)
+
+type testItem struct {
+	version    string
+	unparsed   string
+	equalsPrev bool
+}
+
+func testOne(v *Version, item, prev testItem) error {
+	str := v.String()
+	if item.unparsed == "" {
+		if str != item.version {
+			return fmt.Errorf("bad round-trip: %q -> %q", item.version, str)
+		}
+	} else {
+		if str != item.unparsed {
+			return fmt.Errorf("bad unparse: %q -> %q, expected %q", item.version, str, item.unparsed)
+		}
+	}
+
+	if prev.version != "" {
+		cmp, err := v.Compare(prev.version)
+		if err != nil {
+			return fmt.Errorf("unexpected parse error: %v", err)
+		}
+		rv, err := parse(prev.version, v.semver)
+		if err != nil {
+			return fmt.Errorf("unexpected parse error: %v", err)
+		}
+		rcmp, err := rv.Compare(item.version)
+		if err != nil {
+			return fmt.Errorf("unexpected parse error: %v", err)
+		}
+
+		switch {
+		case cmp == -1:
+			return fmt.Errorf("unexpected ordering %q < %q", item.version, prev.version)
+		case cmp == 0 && !item.equalsPrev:
+			return fmt.Errorf("unexpected comparison %q == %q", item.version, prev.version)
+		case cmp == 1 && item.equalsPrev:
+			return fmt.Errorf("unexpected comparison %q != %q", item.version, prev.version)
+		case cmp != -rcmp:
+			return fmt.Errorf("unexpected reverse comparison %q <=> %q %v %v %v %v", item.version, prev.version, cmp, rcmp, v.Components(), rv.Components())
+		}
+	}
+
+	return nil
+}
+
+func TestSemanticVersions(t *testing.T) {
+	tests := []testItem{
+		// This is every version string that appears in the 2.0 semver spec,
+		// sorted in strictly increasing order except as noted.
+		{version: "0.1.0"},
+		{version: "1.0.0-0.3.7"},
+		{version: "1.0.0-alpha"},
+		{version: "1.0.0-alpha+001", equalsPrev: true},
+		{version: "1.0.0-alpha.1"},
+		{version: "1.0.0-alpha.beta"},
+		{version: "1.0.0-beta"},
+		{version: "1.0.0-beta+exp.sha.5114f85", equalsPrev: true},
+		{version: "1.0.0-beta.2"},
+		{version: "1.0.0-beta.11"},
+		{version: "1.0.0-rc.1"},
+		{version: "1.0.0-x.7.z.92"},
+		{version: "1.0.0"},
+		{version: "1.0.0+20130313144700", equalsPrev: true},
+		{version: "1.8.0-alpha.3"},
+		{version: "1.8.0-alpha.3.673+73326ef01d2d7c"},
+		{version: "1.9.0"},
+		{version: "1.10.0"},
+		{version: "1.11.0"},
+		{version: "2.0.0"},
+		{version: "2.1.0"},
+		{version: "2.1.1"},
+		{version: "42.0.0"},
+
+		// We also allow whitespace and "v" prefix
+		{version: "   42.0.0", unparsed: "42.0.0", equalsPrev: true},
+		{version: "\t42.0.0  ", unparsed: "42.0.0", equalsPrev: true},
+		{version: "43.0.0-1", unparsed: "43.0.0-1"},
+		{version: "43.0.0-1  ", unparsed: "43.0.0-1", equalsPrev: true},
+		{version: "v43.0.0-1", unparsed: "43.0.0-1", equalsPrev: true},
+		{version: "  v43.0.0", unparsed: "43.0.0"},
+		{version: " 43.0.0 ", unparsed: "43.0.0", equalsPrev: true},
+	}
+
+	var prev testItem
+	for _, item := range tests {
+		v, err := ParseSemantic(item.version)
+		if err != nil {
+			t.Errorf("unexpected parse error: %v", err)
+			continue
+		}
+		err = testOne(v, item, prev)
+		if err != nil {
+			t.Errorf("%v", err)
+		}
+		prev = item
+	}
+}
+
+func TestBadSemanticVersions(t *testing.T) {
+	tests := []string{
+		// "MUST take the form X.Y.Z"
+		"1",
+		"1.2",
+		"1.2.3.4",
+		".2.3",
+		"1..3",
+		"1.2.",
+		"",
+		"..",
+		// "where X, Y, and Z are non-negative integers"
+		"-1.2.3",
+		"1.-2.3",
+		"1.2.-3",
+		"1a.2.3",
+		"1.2a.3",
+		"1.2.3a",
+		"a1.2.3",
+		"a.b.c",
+		"1 .2.3",
+		"1. 2.3",
+		// "and MUST NOT contain leading zeroes."
+		"01.2.3",
+		"1.02.3",
+		"1.2.03",
+		// "[pre-release] identifiers MUST comprise only ASCII alphanumerics and hyphen"
+		"1.2.3-/",
+		// "[pre-release] identifiers MUST NOT be empty"
+		"1.2.3-",
+		"1.2.3-.",
+		"1.2.3-foo.",
+		"1.2.3-.foo",
+		// "Numeric [pre-release] identifiers MUST NOT include leading zeroes"
+		"1.2.3-01",
+		// "[build metadata] identifiers MUST comprise only ASCII alphanumerics and hyphen"
+		"1.2.3+/",
+		// "[build metadata] identifiers MUST NOT be empty"
+		"1.2.3+",
+		"1.2.3+.",
+		"1.2.3+foo.",
+		"1.2.3+.foo",
+
+		// whitespace/"v"-prefix checks
+		"v 1.2.3",
+		"vv1.2.3",
+	}
+
+	for i := range tests {
+		_, err := ParseSemantic(tests[i])
+		if err == nil {
+			t.Errorf("unexpected success parsing invalid semver %q", tests[i])
+		}
+	}
+}
+
+func TestGenericVersions(t *testing.T) {
+	tests := []testItem{
+		// This is all of the strings from TestSemanticVersions, plus some strings
+		// from TestBadSemanticVersions that should parse as generic versions,
+		// plus some additional strings.
+		{version: "0.1.0", unparsed: "0.1.0"},
+		{version: "1.0.0-0.3.7", unparsed: "1.0.0"},
+		{version: "1.0.0-alpha", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0-alpha+001", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0-alpha.1", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0-alpha.beta", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0.beta", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0-beta+exp.sha.5114f85", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0.beta.2", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0.beta.11", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0.rc.1", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0-x.7.z.92", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.0.0+20130313144700", unparsed: "1.0.0", equalsPrev: true},
+		{version: "1.2", unparsed: "1.2"},
+		{version: "1.2a.3", unparsed: "1.2", equalsPrev: true},
+		{version: "1.2.3", unparsed: "1.2.3"},
+		{version: "1.2.3.0", unparsed: "1.2.3.0", equalsPrev: true},
+		{version: "1.2.3a", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.3-foo.", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.3-.foo", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.3-01", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.3+", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.3+foo.", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.3+.foo", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.02.3", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.03", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.003", unparsed: "1.2.3", equalsPrev: true},
+		{version: "1.2.3.4", unparsed: "1.2.3.4"},
+		{version: "1.2.3.4b3", unparsed: "1.2.3.4", equalsPrev: true},
+		{version: "1.2.3.4.5", unparsed: "1.2.3.4.5"},
+		{version: "1.9.0", unparsed: "1.9.0"},
+		{version: "1.9.0.0.0.0.0.0", unparsed: "1.9.0.0.0.0.0.0", equalsPrev: true},
+		{version: "1.10.0", unparsed: "1.10.0"},
+		{version: "1.11.0", unparsed: "1.11.0"},
+		{version: "1.11.0.0.5", unparsed: "1.11.0.0.5"},
+		{version: "2.0.0", unparsed: "2.0.0"},
+		{version: "2.1.0", unparsed: "2.1.0"},
+		{version: "2.1.1", unparsed: "2.1.1"},
+		{version: "42.0.0", unparsed: "42.0.0"},
+		{version: "   42.0.0", unparsed: "42.0.0", equalsPrev: true},
+		{version: "\t42.0.0  ", unparsed: "42.0.0", equalsPrev: true},
+		{version: "42.0.0-1", unparsed: "42.0.0", equalsPrev: true},
+		{version: "42.0.0-1  ", unparsed: "42.0.0", equalsPrev: true},
+		{version: "v42.0.0-1", unparsed: "42.0.0", equalsPrev: true},
+		{version: "  v43.0.0", unparsed: "43.0.0"},
+		{version: " 43.0.0 ", unparsed: "43.0.0", equalsPrev: true},
+	}
+
+	var prev testItem
+	for _, item := range tests {
+		v, err := ParseGeneric(item.version)
+		if err != nil {
+			t.Errorf("unexpected parse error: %v", err)
+			continue
+		}
+		err = testOne(v, item, prev)
+		if err != nil {
+			t.Errorf("%v", err)
+		}
+		prev = item
+	}
+}
+
+func TestBadGenericVersions(t *testing.T) {
+	tests := []string{
+		"1",
+		"01.2.3",
+		"-1.2.3",
+		"1.-2.3",
+		".2.3",
+		"1..3",
+		"1a.2.3",
+		"a1.2.3",
+		"1 .2.3",
+		"1. 2.3",
+		"1.bob",
+		"bob",
+		"v 1.2.3",
+		"vv1.2.3",
+		"",
+		".",
+	}
+
+	for i := range tests {
+		_, err := ParseGeneric(tests[i])
+		if err == nil {
+			t.Errorf("unexpected success parsing invalid version %q", tests[i])
+		}
+	}
+}
+
+func TestComponents(t *testing.T) {
+
+	var tests = []struct {
+		version               string
+		semver                bool
+		expectedComponents    []uint
+		expectedMajor         uint
+		expectedMinor         uint
+		expectedPatch         uint
+		expectedPreRelease    string
+		expectedBuildMetadata string
+	}{
+		{
+			version:            "1.0.2",
+			semver:             true,
+			expectedComponents: []uint{1, 0, 2},
+			expectedMajor:      1,
+			expectedMinor:      0,
+			expectedPatch:      2,
+		},
+		{
+			version:               "1.0.2-alpha+001",
+			semver:                true,
+			expectedComponents:    []uint{1, 0, 2},
+			expectedMajor:         1,
+			expectedMinor:         0,
+			expectedPatch:         2,
+			expectedPreRelease:    "alpha",
+			expectedBuildMetadata: "001",
+		},
+		{
+			version:            "1.2",
+			semver:             false,
+			expectedComponents: []uint{1, 2},
+			expectedMajor:      1,
+			expectedMinor:      2,
+		},
+		{
+			version:               "1.0.2-beta+exp.sha.5114f85",
+			semver:                true,
+			expectedComponents:    []uint{1, 0, 2},
+			expectedMajor:         1,
+			expectedMinor:         0,
+			expectedPatch:         2,
+			expectedPreRelease:    "beta",
+			expectedBuildMetadata: "exp.sha.5114f85",
+		},
+	}
+
+	for _, test := range tests {
+		version, _ := parse(test.version, test.semver)
+		if !reflect.DeepEqual(test.expectedComponents, version.Components()) {
+			t.Error("parse returned un'expected components")
+		}
+		if test.expectedMajor != version.Major() {
+			t.Errorf("parse returned version.Major %d, expected %d", test.expectedMajor, version.Major())
+		}
+		if test.expectedMinor != version.Minor() {
+			t.Errorf("parse returned version.Minor %d, expected %d", test.expectedMinor, version.Minor())
+		}
+		if test.expectedPatch != version.Patch() {
+			t.Errorf("parse returned version.Patch %d, expected %d", test.expectedPatch, version.Patch())
+		}
+		if test.expectedPreRelease != version.PreRelease() {
+			t.Errorf("parse returned version.PreRelease %s, expected %s", test.expectedPreRelease, version.PreRelease())
+		}
+		if test.expectedBuildMetadata != version.BuildMetadata() {
+			t.Errorf("parse returned version.BuildMetadata %s, expected %s", test.expectedBuildMetadata, version.BuildMetadata())
+		}
+	}
+}
+
+func TestHighestSupportedVersion(t *testing.T) {
+	testCases := []struct {
+		versions                        []string
+		expectedHighestSupportedVersion string
+		shouldFail                      bool
+	}{
+		{
+			versions:                        []string{"v1.0.0"},
+			expectedHighestSupportedVersion: "1.0.0",
+			shouldFail:                      false,
+		},
+		{
+			versions:   []string{"0.3.0"},
+			shouldFail: true,
+		},
+		{
+			versions:   []string{"0.2.0"},
+			shouldFail: true,
+		},
+		{
+			versions:                        []string{"1.0.0"},
+			expectedHighestSupportedVersion: "1.0.0",
+			shouldFail:                      false,
+		},
+		{
+			versions:   []string{"v0.3.0"},
+			shouldFail: true,
+		},
+		{
+			versions:   []string{"v0.2.0"},
+			shouldFail: true,
+		},
+		{
+			versions:   []string{"0.2.0", "v0.3.0"},
+			shouldFail: true,
+		},
+		{
+			versions:                        []string{"0.2.0", "v1.0.0"},
+			expectedHighestSupportedVersion: "1.0.0",
+			shouldFail:                      false,
+		},
+		{
+			versions:                        []string{"0.2.0", "v1.2.3"},
+			expectedHighestSupportedVersion: "1.2.3",
+			shouldFail:                      false,
+		},
+		{
+			versions:                        []string{"v1.2.3", "v0.3.0"},
+			expectedHighestSupportedVersion: "1.2.3",
+			shouldFail:                      false,
+		},
+		{
+			versions:                        []string{"v1.2.3", "v0.3.0", "2.0.1"},
+			expectedHighestSupportedVersion: "1.2.3",
+			shouldFail:                      false,
+		},
+		{
+			versions:                        []string{"v1.2.3", "4.9.12", "v0.3.0", "2.0.1"},
+			expectedHighestSupportedVersion: "1.2.3",
+			shouldFail:                      false,
+		},
+		{
+			versions:                        []string{"4.9.12", "2.0.1"},
+			expectedHighestSupportedVersion: "",
+			shouldFail:                      true,
+		},
+		{
+			versions:                        []string{"v1.2.3", "boo", "v0.3.0", "2.0.1"},
+			expectedHighestSupportedVersion: "1.2.3",
+			shouldFail:                      false,
+		},
+		{
+			versions:                        []string{},
+			expectedHighestSupportedVersion: "",
+			shouldFail:                      true,
+		},
+		{
+			versions:                        []string{"var", "boo", "foo"},
+			expectedHighestSupportedVersion: "",
+			shouldFail:                      true,
+		},
+	}
+
+	for _, tc := range testCases {
+		// Arrange & Act
+		actual, err := HighestSupportedVersion(tc.versions)
+
+		// Assert
+		if tc.shouldFail && err == nil {
+			t.Fatalf("expecting highestSupportedVersion to fail, but got nil error for testcase: %#v", tc)
+		}
+		if !tc.shouldFail && err != nil {
+			t.Fatalf("unexpected error during ValidatePlugin for testcase: %#v\r\n err:%v", tc, err)
+		}
+		if tc.expectedHighestSupportedVersion != "" {
+			result, err := actual.Compare(tc.expectedHighestSupportedVersion)
+			if err != nil {
+				t.Fatalf("comparison failed with %v for testcase %#v", err, tc)
+			}
+			if result != 0 {
+				t.Fatalf("expectedHighestSupportedVersion %v, but got %v for tc: %#v", tc.expectedHighestSupportedVersion, actual, tc)
+			}
+		}
+	}
+}
+
+func TestOffsetMinor(t *testing.T) {
+	var tests = []struct {
+		version            string
+		diff               int
+		expectedComponents []uint
+	}{
+		{
+			version:            "1.0.2",
+			diff:               -3,
+			expectedComponents: []uint{1, 0},
+		},
+		{
+			version:            "1.3.2-alpha+001",
+			diff:               -2,
+			expectedComponents: []uint{1, 1},
+		},
+		{
+			version:            "1.3.2-alpha+001",
+			diff:               -3,
+			expectedComponents: []uint{1, 0},
+		},
+		{
+			version:            "1.20",
+			diff:               -5,
+			expectedComponents: []uint{1, 15},
+		},
+		{
+			version:            "1.20",
+			diff:               5,
+			expectedComponents: []uint{1, 25},
+		},
+	}
+
+	for _, test := range tests {
+		version, _ := ParseGeneric(test.version)
+		if !reflect.DeepEqual(test.expectedComponents, version.OffsetMinor(test.diff).Components()) {
+			t.Error("parse returned un'expected components")
+		}
+	}
+}
+
+func TestParse(t *testing.T) {
+
+	var tests = []struct {
+		version               string
+		expectErr             bool
+		expectedComponents    []uint
+		expectedPreRelease    string
+		expectedBuildMetadata string
+	}{
+		{
+			version:            "1.0.2",
+			expectedComponents: []uint{1, 0, 2},
+		},
+		{
+			version:               "1.0.2-alpha+001",
+			expectedComponents:    []uint{1, 0, 2},
+			expectedPreRelease:    "alpha",
+			expectedBuildMetadata: "001",
+		},
+		{
+			version:            "1.2",
+			expectedComponents: []uint{1, 2},
+		},
+		{
+			version:               "1.0.2-beta+exp.sha.5114f85",
+			expectedComponents:    []uint{1, 0, 2},
+			expectedPreRelease:    "beta",
+			expectedBuildMetadata: "exp.sha.5114f85",
+		},
+		{
+			version:   "a.b.c",
+			expectErr: true,
+		},
+	}
+
+	for _, test := range tests {
+		version, err := Parse(test.version)
+		if test.expectErr {
+			if err == nil {
+				t.Fatalf("got no err, expected err")
+			}
+			continue
+		}
+		if !reflect.DeepEqual(test.expectedComponents, version.Components()) {
+			t.Error("parse returned un'expected components")
+		}
+		if test.expectedPreRelease != version.PreRelease() {
+			t.Errorf("parse returned version.PreRelease %s, expected %s", test.expectedPreRelease, version.PreRelease())
+		}
+		if test.expectedBuildMetadata != version.BuildMetadata() {
+			t.Errorf("parse returned version.BuildMetadata %s, expected %s", test.expectedBuildMetadata, version.BuildMetadata())
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/wait/backoff.go b/third_party/k8s.io/apimachinery/pkg/util/wait/backoff.go
new file mode 100644
index 0000000000..177be09a95
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/wait/backoff.go
@@ -0,0 +1,518 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"math"
+	"sync"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/utils/clock"
+)
+
+// Backoff holds parameters applied to a Backoff function.
+type Backoff struct {
+	// The initial duration.
+	Duration time.Duration
+	// Duration is multiplied by factor each iteration, if factor is not zero
+	// and the limits imposed by Steps and Cap have not been reached.
+	// Should not be negative.
+	// The jitter does not contribute to the updates to the duration parameter.
+	Factor float64
+	// The sleep at each iteration is the duration plus an additional
+	// amount chosen uniformly at random from the interval between
+	// zero and `jitter*duration`.
+	Jitter float64
+	// The remaining number of iterations in which the duration
+	// parameter may change (but progress can be stopped earlier by
+	// hitting the cap). If not positive, the duration is not
+	// changed. Used for exponential backoff in combination with
+	// Factor and Cap.
+	Steps int
+	// A limit on revised values of the duration parameter. If a
+	// multiplication by the factor parameter would make the duration
+	// exceed the cap then the duration is set to the cap and the
+	// steps parameter is set to zero.
+	Cap time.Duration
+}
+
+// Step returns an amount of time to sleep determined by the original
+// Duration and Jitter. The backoff is mutated to update its Steps and
+// Duration. A nil Backoff always has a zero-duration step.
+func (b *Backoff) Step() time.Duration {
+	if b == nil {
+		return 0
+	}
+	var nextDuration time.Duration
+	nextDuration, b.Duration, b.Steps = delay(b.Steps, b.Duration, b.Cap, b.Factor, b.Jitter)
+	return nextDuration
+}
+
+// DelayFunc returns a function that will compute the next interval to
+// wait given the arguments in b. It does not mutate the original backoff
+// but the function is safe to use only from a single goroutine.
+func (b Backoff) DelayFunc() DelayFunc {
+	steps := b.Steps
+	duration := b.Duration
+	cap := b.Cap
+	factor := b.Factor
+	jitter := b.Jitter
+
+	return func() time.Duration {
+		var nextDuration time.Duration
+		// jitter is applied per step and is not cumulative over multiple steps
+		nextDuration, duration, steps = delay(steps, duration, cap, factor, jitter)
+		return nextDuration
+	}
+}
+
+// Timer returns a timer implementation appropriate to this backoff's parameters
+// for use with wait functions.
+func (b Backoff) Timer() Timer {
+	if b.Steps > 1 || b.Jitter != 0 {
+		return &variableTimer{new: internalClock.NewTimer, fn: b.DelayFunc()}
+	}
+	if b.Duration > 0 {
+		return &fixedTimer{new: internalClock.NewTicker, interval: b.Duration}
+	}
+	return newNoopTimer()
+}
+
+// delay implements the core delay algorithm used in this package.
+func delay(steps int, duration, cap time.Duration, factor, jitter float64) (_ time.Duration, next time.Duration, nextSteps int) {
+	// when steps is non-positive, do not alter the base duration
+	if steps < 1 {
+		if jitter > 0 {
+			return Jitter(duration, jitter), duration, 0
+		}
+		return duration, duration, 0
+	}
+	steps--
+
+	// calculate the next step's interval
+	if factor != 0 {
+		next = time.Duration(float64(duration) * factor)
+		if cap > 0 && next > cap {
+			next = cap
+			steps = 0
+		}
+	} else {
+		next = duration
+	}
+
+	// add jitter for this step
+	if jitter > 0 {
+		duration = Jitter(duration, jitter)
+	}
+
+	return duration, next, steps
+
+}
+
+// DelayWithReset returns a DelayFunc that will return the appropriate next interval to
+// wait. Every resetInterval the backoff parameters are reset to their initial state.
+// This method is safe to invoke from multiple goroutines, but all calls will advance
+// the backoff state when Factor is set. If Factor is zero, this method is the same as
+// invoking b.DelayFunc() since Steps has no impact without Factor. If resetInterval is
+// zero no backoff will be performed as the same calling DelayFunc with a zero factor
+// and steps.
+func (b Backoff) DelayWithReset(c clock.Clock, resetInterval time.Duration) DelayFunc {
+	if b.Factor <= 0 {
+		return b.DelayFunc()
+	}
+	if resetInterval <= 0 {
+		b.Steps = 0
+		b.Factor = 0
+		return b.DelayFunc()
+	}
+	return (&backoffManager{
+		backoff:        b,
+		initialBackoff: b,
+		resetInterval:  resetInterval,
+
+		clock:     c,
+		lastStart: c.Now(),
+		timer:     nil,
+	}).Step
+}
+
+// Until loops until stop channel is closed, running f every period.
+//
+// Until is syntactic sugar on top of JitterUntil with zero jitter factor and
+// with sliding = true (which means the timer for period starts after the f
+// completes).
+//
+// Contextual logging: UntilWithContext should be used instead of Until in code which supports contextual logging.
+func Until(f func(), period time.Duration, stopCh <-chan struct{}) {
+	JitterUntil(f, period, 0.0, true, stopCh)
+}
+
+// UntilWithContext loops until context is done, running f every period.
+//
+// UntilWithContext is syntactic sugar on top of JitterUntilWithContext
+// with zero jitter factor and with sliding = true (which means the timer
+// for period starts after the f completes).
+func UntilWithContext(ctx context.Context, f func(context.Context), period time.Duration) {
+	JitterUntilWithContext(ctx, f, period, 0.0, true)
+}
+
+// NonSlidingUntil loops until stop channel is closed, running f every
+// period.
+//
+// NonSlidingUntil is syntactic sugar on top of JitterUntil with zero jitter
+// factor, with sliding = false (meaning the timer for period starts at the same
+// time as the function starts).
+//
+// Contextual logging: NonSlidingUntilWithContext should be used instead of NonSlidingUntil in code which supports contextual logging.
+func NonSlidingUntil(f func(), period time.Duration, stopCh <-chan struct{}) {
+	JitterUntil(f, period, 0.0, false, stopCh)
+}
+
+// NonSlidingUntilWithContext loops until context is done, running f every
+// period.
+//
+// NonSlidingUntilWithContext is syntactic sugar on top of JitterUntilWithContext
+// with zero jitter factor, with sliding = false (meaning the timer for period
+// starts at the same time as the function starts).
+func NonSlidingUntilWithContext(ctx context.Context, f func(context.Context), period time.Duration) {
+	JitterUntilWithContext(ctx, f, period, 0.0, false)
+}
+
+// JitterUntil loops until stop channel is closed, running f every period.
+//
+// If jitterFactor is positive, the period is jittered before every run of f.
+// If jitterFactor is not positive, the period is unchanged and not jittered.
+//
+// If sliding is true, the period is computed after f runs. If it is false then
+// period includes the runtime for f.
+//
+// Close stopCh to stop. f may not be invoked if stop channel is already
+// closed. Pass NeverStop to if you don't want it stop.
+//
+// Contextual logging: JitterUntilWithContext should be used instead of JitterUntil in code which supports contextual logging.
+func JitterUntil(f func(), period time.Duration, jitterFactor float64, sliding bool, stopCh <-chan struct{}) {
+	BackoffUntil(f, NewJitteredBackoffManager(period, jitterFactor, &clock.RealClock{}), sliding, stopCh)
+}
+
+// JitterUntilWithContext loops until context is done, running f every period.
+//
+// If jitterFactor is positive, the period is jittered before every run of f.
+// If jitterFactor is not positive, the period is unchanged and not jittered.
+//
+// If sliding is true, the period is computed after f runs. If it is false then
+// period includes the runtime for f.
+//
+// Cancel context to stop. f may not be invoked if context is already done.
+func JitterUntilWithContext(ctx context.Context, f func(context.Context), period time.Duration, jitterFactor float64, sliding bool) {
+	BackoffUntilWithContext(ctx, f, NewJitteredBackoffManager(period, jitterFactor, &clock.RealClock{}), sliding)
+}
+
+// BackoffUntil loops until stop channel is closed, run f every duration given by BackoffManager.
+//
+// If sliding is true, the period is computed after f runs. If it is false then
+// period includes the runtime for f.
+//
+// Contextual logging: BackoffUntilWithContext should be used instead of BackoffUntil in code which supports contextual logging.
+func BackoffUntil(f func(), backoff BackoffManager, sliding bool, stopCh <-chan struct{}) {
+	BackoffUntilWithContext(ContextForChannel(stopCh), func(context.Context) { f() }, backoff, sliding)
+}
+
+// BackoffUntilWithContext loops until context is done, run f every duration given by BackoffManager.
+//
+// If sliding is true, the period is computed after f runs. If it is false then
+// period includes the runtime for f.
+func BackoffUntilWithContext(ctx context.Context, f func(ctx context.Context), backoff BackoffManager, sliding bool) {
+	var t clock.Timer
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		default:
+		}
+
+		if !sliding {
+			t = backoff.Backoff()
+		}
+
+		func() {
+			defer runtime.HandleCrashWithContext(ctx)
+			f(ctx)
+		}()
+
+		if sliding {
+			t = backoff.Backoff()
+		}
+
+		// NOTE: b/c there is no priority selection in golang
+		// it is possible for this to race, meaning we could
+		// trigger t.C and stopCh, and t.C select falls through.
+		// In order to mitigate we re-check stopCh at the beginning
+		// of every loop to prevent extra executions of f().
+		select {
+		case <-ctx.Done():
+			if !t.Stop() {
+				<-t.C()
+			}
+			return
+		case <-t.C():
+		}
+	}
+}
+
+// backoffManager provides simple backoff behavior in a threadsafe manner to a caller.
+type backoffManager struct {
+	backoff        Backoff
+	initialBackoff Backoff
+	resetInterval  time.Duration
+
+	clock clock.Clock
+
+	lock      sync.Mutex
+	lastStart time.Time
+	timer     clock.Timer
+}
+
+// Step returns the expected next duration to wait.
+func (b *backoffManager) Step() time.Duration {
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	switch {
+	case b.resetInterval == 0:
+		b.backoff = b.initialBackoff
+	case b.clock.Now().Sub(b.lastStart) > b.resetInterval:
+		b.backoff = b.initialBackoff
+		b.lastStart = b.clock.Now()
+	}
+	return b.backoff.Step()
+}
+
+// Backoff implements BackoffManager.Backoff, it returns a timer so caller can block on the timer
+// for exponential backoff. The returned timer must be drained before calling Backoff() the second
+// time.
+func (b *backoffManager) Backoff() clock.Timer {
+	b.lock.Lock()
+	defer b.lock.Unlock()
+	if b.timer == nil {
+		b.timer = b.clock.NewTimer(b.Step())
+	} else {
+		b.timer.Reset(b.Step())
+	}
+	return b.timer
+}
+
+// Timer returns a new Timer instance that shares the clock and the reset behavior with all other
+// timers.
+func (b *backoffManager) Timer() Timer {
+	return DelayFunc(b.Step).Timer(b.clock)
+}
+
+// BackoffManager manages backoff with a particular scheme based on its underlying implementation.
+type BackoffManager interface {
+	// Backoff returns a shared clock.Timer that is Reset on every invocation. This method is not
+	// safe for use from multiple threads. It returns a timer for backoff, and caller shall backoff
+	// until Timer.C() drains. If the second Backoff() is called before the timer from the first
+	// Backoff() call finishes, the first timer will NOT be drained and result in undetermined
+	// behavior.
+	Backoff() clock.Timer
+}
+
+// Deprecated: Will be removed when the legacy polling functions are removed.
+type exponentialBackoffManagerImpl struct {
+	backoff              *Backoff
+	backoffTimer         clock.Timer
+	lastBackoffStart     time.Time
+	initialBackoff       time.Duration
+	backoffResetDuration time.Duration
+	clock                clock.Clock
+}
+
+// NewExponentialBackoffManager returns a manager for managing exponential backoff. Each backoff is jittered and
+// backoff will not exceed the given max. If the backoff is not called within resetDuration, the backoff is reset.
+// This backoff manager is used to reduce load during upstream unhealthiness.
+//
+// Deprecated: Will be removed when the legacy Poll methods are removed. Callers should construct a
+// Backoff struct, use DelayWithReset() to get a DelayFunc that periodically resets itself, and then
+// invoke Timer() when calling wait.BackoffUntil.
+//
+// Instead of:
+//
+//	bm := wait.NewExponentialBackoffManager(init, max, reset, factor, jitter, clock)
+//	...
+//	wait.BackoffUntil(..., bm.Backoff, ...)
+//
+// Use:
+//
+//	delayFn := wait.Backoff{
+//	  Duration: init,
+//	  Cap:      max,
+//	  Steps:    int(math.Ceil(float64(max) / float64(init))), // now a required argument
+//	  Factor:   factor,
+//	  Jitter:   jitter,
+//	}.DelayWithReset(reset, clock)
+//	wait.BackoffUntil(..., delayFn.Timer(), ...)
+func NewExponentialBackoffManager(initBackoff, maxBackoff, resetDuration time.Duration, backoffFactor, jitter float64, c clock.Clock) BackoffManager {
+	return &exponentialBackoffManagerImpl{
+		backoff: &Backoff{
+			Duration: initBackoff,
+			Factor:   backoffFactor,
+			Jitter:   jitter,
+
+			// the current impl of wait.Backoff returns Backoff.Duration once steps are used up, which is not
+			// what we ideally need here, we set it to max int and assume we will never use up the steps
+			Steps: math.MaxInt32,
+			Cap:   maxBackoff,
+		},
+		backoffTimer:         nil,
+		initialBackoff:       initBackoff,
+		lastBackoffStart:     c.Now(),
+		backoffResetDuration: resetDuration,
+		clock:                c,
+	}
+}
+
+func (b *exponentialBackoffManagerImpl) getNextBackoff() time.Duration {
+	if b.clock.Now().Sub(b.lastBackoffStart) > b.backoffResetDuration {
+		b.backoff.Steps = math.MaxInt32
+		b.backoff.Duration = b.initialBackoff
+	}
+	b.lastBackoffStart = b.clock.Now()
+	return b.backoff.Step()
+}
+
+// Backoff implements BackoffManager.Backoff, it returns a timer so caller can block on the timer for exponential backoff.
+// The returned timer must be drained before calling Backoff() the second time
+func (b *exponentialBackoffManagerImpl) Backoff() clock.Timer {
+	if b.backoffTimer == nil {
+		b.backoffTimer = b.clock.NewTimer(b.getNextBackoff())
+	} else {
+		b.backoffTimer.Reset(b.getNextBackoff())
+	}
+	return b.backoffTimer
+}
+
+// Deprecated: Will be removed when the legacy polling functions are removed.
+type jitteredBackoffManagerImpl struct {
+	clock        clock.Clock
+	duration     time.Duration
+	jitter       float64
+	backoffTimer clock.Timer
+}
+
+// NewJitteredBackoffManager returns a BackoffManager that backoffs with given duration plus given jitter. If the jitter
+// is negative, backoff will not be jittered.
+//
+// Deprecated: Will be removed when the legacy Poll methods are removed. Callers should construct a
+// Backoff struct and invoke Timer() when calling wait.BackoffUntil.
+//
+// Instead of:
+//
+//	bm := wait.NewJitteredBackoffManager(duration, jitter, clock)
+//	...
+//	wait.BackoffUntil(..., bm.Backoff, ...)
+//
+// Use:
+//
+//	wait.BackoffUntil(..., wait.Backoff{Duration: duration, Jitter: jitter}.Timer(), ...)
+func NewJitteredBackoffManager(duration time.Duration, jitter float64, c clock.Clock) BackoffManager {
+	return &jitteredBackoffManagerImpl{
+		clock:        c,
+		duration:     duration,
+		jitter:       jitter,
+		backoffTimer: nil,
+	}
+}
+
+func (j *jitteredBackoffManagerImpl) getNextBackoff() time.Duration {
+	jitteredPeriod := j.duration
+	if j.jitter > 0.0 {
+		jitteredPeriod = Jitter(j.duration, j.jitter)
+	}
+	return jitteredPeriod
+}
+
+// Backoff implements BackoffManager.Backoff, it returns a timer so caller can block on the timer for jittered backoff.
+// The returned timer must be drained before calling Backoff() the second time
+func (j *jitteredBackoffManagerImpl) Backoff() clock.Timer {
+	backoff := j.getNextBackoff()
+	if j.backoffTimer == nil {
+		j.backoffTimer = j.clock.NewTimer(backoff)
+	} else {
+		j.backoffTimer.Reset(backoff)
+	}
+	return j.backoffTimer
+}
+
+// ExponentialBackoff repeats a condition check with exponential backoff.
+//
+// It repeatedly checks the condition and then sleeps, using `backoff.Step()`
+// to determine the length of the sleep and adjust Duration and Steps.
+// Stops and returns as soon as:
+// 1. the condition check returns true or an error,
+// 2. `backoff.Steps` checks of the condition have been done, or
+// 3. a sleep truncated by the cap on duration has been completed.
+// In case (1) the returned error is what the condition function returned.
+// In all other cases, ErrWaitTimeout is returned.
+//
+// Since backoffs are often subject to cancellation, we recommend using
+// ExponentialBackoffWithContext and passing a context to the method.
+func ExponentialBackoff(backoff Backoff, condition ConditionFunc) error {
+	for backoff.Steps > 0 {
+		if ok, err := runConditionWithCrashProtection(condition); err != nil || ok {
+			return err
+		}
+		if backoff.Steps == 1 {
+			break
+		}
+		time.Sleep(backoff.Step())
+	}
+	return ErrWaitTimeout
+}
+
+// ExponentialBackoffWithContext repeats a condition check with exponential backoff.
+// It immediately returns an error if the condition returns an error, the context is cancelled
+// or hits the deadline, or if the maximum attempts defined in backoff is exceeded (ErrWaitTimeout).
+// If an error is returned by the condition the backoff stops immediately. The condition will
+// never be invoked more than backoff.Steps times.
+func ExponentialBackoffWithContext(ctx context.Context, backoff Backoff, condition ConditionWithContextFunc) error {
+	for backoff.Steps > 0 {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+
+		if ok, err := runConditionWithCrashProtectionWithContext(ctx, condition); err != nil || ok {
+			return err
+		}
+
+		if backoff.Steps == 1 {
+			break
+		}
+
+		waitBeforeRetry := backoff.Step()
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-time.After(waitBeforeRetry):
+		}
+	}
+
+	return ErrWaitTimeout
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/wait/delay.go b/third_party/k8s.io/apimachinery/pkg/util/wait/delay.go
new file mode 100644
index 0000000000..1d3dcaa74e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/wait/delay.go
@@ -0,0 +1,51 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"k8s.io/utils/clock"
+)
+
+// DelayFunc returns the next time interval to wait.
+type DelayFunc func() time.Duration
+
+// Timer takes an arbitrary delay function and returns a timer that can handle arbitrary interval changes.
+// Use Backoff{...}.Timer() for simple delays and more efficient timers.
+func (fn DelayFunc) Timer(c clock.Clock) Timer {
+	return &variableTimer{fn: fn, new: c.NewTimer}
+}
+
+// Until takes an arbitrary delay function and runs until cancelled or the condition indicates exit. This
+// offers all of the functionality of the methods in this package.
+func (fn DelayFunc) Until(ctx context.Context, immediate, sliding bool, condition ConditionWithContextFunc) error {
+	return loopConditionUntilContext(ctx, &variableTimer{fn: fn, new: internalClock.NewTimer}, immediate, sliding, condition)
+}
+
+// Concurrent returns a version of this DelayFunc that is safe for use by multiple goroutines that
+// wish to share a single delay timer.
+func (fn DelayFunc) Concurrent() DelayFunc {
+	var lock sync.Mutex
+	return func() time.Duration {
+		lock.Lock()
+		defer lock.Unlock()
+		return fn()
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/wait/doc.go b/third_party/k8s.io/apimachinery/pkg/util/wait/doc.go
new file mode 100644
index 0000000000..ff89dc170e
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/wait/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package wait provides tools for polling or listening for changes
+// to a condition.
+package wait
diff --git a/third_party/k8s.io/apimachinery/pkg/util/wait/error.go b/third_party/k8s.io/apimachinery/pkg/util/wait/error.go
new file mode 100644
index 0000000000..dd75801d82
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/wait/error.go
@@ -0,0 +1,96 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"errors"
+)
+
+// ErrWaitTimeout is returned when the condition was not satisfied in time.
+//
+// Deprecated: This type will be made private in favor of Interrupted()
+// for checking errors or ErrorInterrupted(err) for returning a wrapped error.
+var ErrWaitTimeout = ErrorInterrupted(errors.New("timed out waiting for the condition"))
+
+// Interrupted returns true if the error indicates a Poll, ExponentialBackoff, or
+// Until loop exited for any reason besides the condition returning true or an
+// error. A loop is considered interrupted if the calling context is cancelled,
+// the context reaches its deadline, or a backoff reaches its maximum allowed
+// steps.
+//
+// Callers should use this method instead of comparing the error value directly to
+// ErrWaitTimeout, as methods that cancel a context may not return that error.
+//
+// Instead of:
+//
+//	err := wait.Poll(...)
+//	if err == wait.ErrWaitTimeout {
+//	    log.Infof("Wait for operation exceeded")
+//	} else ...
+//
+// Use:
+//
+//	err := wait.Poll(...)
+//	if wait.Interrupted(err) {
+//	    log.Infof("Wait for operation exceeded")
+//	} else ...
+func Interrupted(err error) bool {
+	switch {
+	case errors.Is(err, errWaitTimeout),
+		errors.Is(err, context.Canceled),
+		errors.Is(err, context.DeadlineExceeded):
+		return true
+	default:
+		return false
+	}
+}
+
+// errInterrupted
+type errInterrupted struct {
+	cause error
+}
+
+// ErrorInterrupted returns an error that indicates the wait was ended
+// early for a given reason. If no cause is provided a generic error
+// will be used but callers are encouraged to provide a real cause for
+// clarity in debugging.
+func ErrorInterrupted(cause error) error {
+	switch cause.(type) {
+	case errInterrupted:
+		// no need to wrap twice since errInterrupted is only needed
+		// once in a chain
+		return cause
+	default:
+		return errInterrupted{cause}
+	}
+}
+
+// errWaitTimeout is the private version of the previous ErrWaitTimeout
+// and is private to prevent direct comparison. Use ErrorInterrupted(err)
+// to get an error that will return true for Interrupted(err).
+var errWaitTimeout = errInterrupted{}
+
+func (e errInterrupted) Unwrap() error        { return e.cause }
+func (e errInterrupted) Is(target error) bool { return target == errWaitTimeout }
+func (e errInterrupted) Error() string {
+	if e.cause == nil {
+		// returns the same error message as historical behavior
+		return "timed out waiting for the condition"
+	}
+	return e.cause.Error()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/wait/error_test.go b/third_party/k8s.io/apimachinery/pkg/util/wait/error_test.go
new file mode 100644
index 0000000000..0c96f06198
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/wait/error_test.go
@@ -0,0 +1,144 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+)
+
+type errWrapper struct {
+	wrapped error
+}
+
+func (w errWrapper) Unwrap() error {
+	return w.wrapped
+}
+func (w errWrapper) Error() string {
+	return fmt.Sprintf("wrapped: %v", w.wrapped)
+}
+
+type errNotWrapper struct {
+	wrapped error
+}
+
+func (w errNotWrapper) Error() string {
+	return fmt.Sprintf("wrapped: %v", w.wrapped)
+}
+
+func TestInterrupted(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{
+			err:  ErrWaitTimeout,
+			want: true,
+		},
+		{
+			err:  context.Canceled,
+			want: true,
+		}, {
+			err:  context.DeadlineExceeded,
+			want: true,
+		},
+		{
+			err:  errWrapper{ErrWaitTimeout},
+			want: true,
+		},
+		{
+			err:  errWrapper{context.Canceled},
+			want: true,
+		},
+		{
+			err:  errWrapper{context.DeadlineExceeded},
+			want: true,
+		},
+		{
+			err:  ErrorInterrupted(nil),
+			want: true,
+		},
+		{
+			err:  ErrorInterrupted(errors.New("unknown")),
+			want: true,
+		},
+		{
+			err:  ErrorInterrupted(context.Canceled),
+			want: true,
+		},
+		{
+			err:  ErrorInterrupted(ErrWaitTimeout),
+			want: true,
+		},
+
+		{
+			err: nil,
+		},
+		{
+			err: errors.New("not a cancellation"),
+		},
+		{
+			err: errNotWrapper{ErrWaitTimeout},
+		},
+		{
+			err: errNotWrapper{context.Canceled},
+		},
+		{
+			err: errNotWrapper{context.DeadlineExceeded},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := Interrupted(tt.err); got != tt.want {
+				t.Errorf("Interrupted() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestErrorInterrupted(t *testing.T) {
+	internalErr := errInterrupted{}
+	if ErrorInterrupted(internalErr) != internalErr {
+		t.Fatalf("error should not be wrapped twice")
+	}
+
+	internalErr = errInterrupted{errInterrupted{}}
+	if ErrorInterrupted(internalErr) != internalErr {
+		t.Fatalf("object should be identical")
+	}
+
+	in := errors.New("test")
+	actual, expected := ErrorInterrupted(in), (errInterrupted{in})
+	if actual != expected {
+		t.Fatalf("did not wrap error")
+	}
+	if !errors.Is(actual, errWaitTimeout) {
+		t.Fatalf("does not obey errors.Is contract")
+	}
+	if actual.Error() != in.Error() {
+		t.Fatalf("unexpected error output")
+	}
+	if !Interrupted(actual) {
+		t.Fatalf("is not Interrupted")
+	}
+	if Interrupted(in) {
+		t.Fatalf("should not be Interrupted")
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/wait/loop.go b/third_party/k8s.io/apimachinery/pkg/util/wait/loop.go
new file mode 100644
index 0000000000..9f9b929ffa
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/wait/loop.go
@@ -0,0 +1,95 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// loopConditionUntilContext executes the provided condition at intervals defined by
+// the provided timer until the provided context is cancelled, the condition returns
+// true, or the condition returns an error. If sliding is true, the period is computed
+// after condition runs. If it is false then period includes the runtime for condition.
+// If immediate is false the first delay happens before any call to condition, if
+// immediate is true the condition will be invoked before waiting and guarantees that
+// the condition is invoked at least once, regardless of whether the context has been
+// cancelled. The returned error is the error returned by the last condition or the
+// context error if the context was terminated.
+//
+// This is the common loop construct for all polling in the wait package.
+func loopConditionUntilContext(ctx context.Context, t Timer, immediate, sliding bool, condition ConditionWithContextFunc) error {
+	defer t.Stop()
+
+	var timeCh <-chan time.Time
+	doneCh := ctx.Done()
+
+	if !sliding {
+		timeCh = t.C()
+	}
+
+	// if immediate is true the condition is
+	// guaranteed to be executed at least once,
+	// if we haven't requested immediate execution, delay once
+	if immediate {
+		if ok, err := func() (bool, error) {
+			defer runtime.HandleCrashWithContext(ctx)
+			return condition(ctx)
+		}(); err != nil || ok {
+			return err
+		}
+	}
+
+	if sliding {
+		timeCh = t.C()
+	}
+
+	for {
+
+		// Wait for either the context to be cancelled or the next invocation be called
+		select {
+		case <-doneCh:
+			return ctx.Err()
+		case <-timeCh:
+		}
+
+		// IMPORTANT: Because there is no channel priority selection in golang
+		// it is possible for very short timers to "win" the race in the previous select
+		// repeatedly even when the context has been canceled.  We therefore must
+		// explicitly check for context cancellation on every loop and exit if true to
+		// guarantee that we don't invoke condition more than once after context has
+		// been cancelled.
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+
+		if !sliding {
+			t.Next()
+		}
+		if ok, err := func() (bool, error) {
+			defer runtime.HandleCrashWithContext(ctx)
+			return condition(ctx)
+		}(); err != nil || ok {
+			return err
+		}
+		if sliding {
+			t.Next()
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/wait/loop_test.go b/third_party/k8s.io/apimachinery/pkg/util/wait/loop_test.go
new file mode 100644
index 0000000000..63bfa8540f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/wait/loop_test.go
@@ -0,0 +1,535 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"k8s.io/utils/clock"
+	testingclock "k8s.io/utils/clock/testing"
+)
+
+func timerWithClock(t Timer, c clock.WithTicker) Timer {
+	switch t := t.(type) {
+	case *fixedTimer:
+		t.new = c.NewTicker
+	case *variableTimer:
+		t.new = c.NewTimer
+	default:
+		panic("unrecognized timer type, cannot inject clock")
+	}
+	return t
+}
+
+func Test_loopConditionWithContextImmediateDelay(t *testing.T) {
+	fakeClock := testingclock.NewFakeClock(time.Time{})
+	backoff := Backoff{Duration: time.Second}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	expectedError := errors.New("Expected error")
+	var attempt int
+	f := ConditionFunc(func() (bool, error) {
+		attempt++
+		return false, expectedError
+	})
+
+	doneCh := make(chan struct{})
+	go func() {
+		defer close(doneCh)
+		if err := loopConditionUntilContext(ctx, timerWithClock(backoff.Timer(), fakeClock), false, true, f.WithContext()); err == nil || err != expectedError {
+			t.Errorf("unexpected error: %v", err)
+		}
+	}()
+
+	for !fakeClock.HasWaiters() {
+		time.Sleep(time.Microsecond)
+	}
+
+	fakeClock.Step(time.Second - time.Millisecond)
+	if attempt != 0 {
+		t.Fatalf("should still be waiting for condition")
+	}
+	fakeClock.Step(2 * time.Millisecond)
+
+	select {
+	case <-doneCh:
+	case <-time.After(time.Second):
+		t.Fatalf("should have exited after a single loop")
+	}
+	if attempt != 1 {
+		t.Fatalf("expected attempt")
+	}
+}
+
+func Test_loopConditionUntilContext_semantic(t *testing.T) {
+	defaultCallback := func(_ int) (bool, error) {
+		return false, nil
+	}
+
+	conditionErr := errors.New("condition failed")
+
+	tests := []struct {
+		name               string
+		immediate          bool
+		sliding            bool
+		context            func() (context.Context, context.CancelFunc)
+		callback           func(calls int) (bool, error)
+		cancelContextAfter int
+		attemptsExpected   int
+		errExpected        error
+		timer              Timer
+	}{
+		{
+			name: "condition successful is only one attempt",
+			callback: func(attempts int) (bool, error) {
+				return true, nil
+			},
+			attemptsExpected: 1,
+		},
+		{
+			name: "delayed condition successful causes return and attempts",
+			callback: func(attempts int) (bool, error) {
+				return attempts > 1, nil
+			},
+			attemptsExpected: 2,
+		},
+		{
+			name: "delayed condition successful causes return and attempts many times",
+			callback: func(attempts int) (bool, error) {
+				return attempts >= 100, nil
+			},
+			attemptsExpected: 100,
+		},
+		{
+			name: "condition returns error even if ok is true",
+			callback: func(_ int) (bool, error) {
+				return true, conditionErr
+			},
+			attemptsExpected: 1,
+			errExpected:      conditionErr,
+		},
+		{
+			name: "condition exits after an error",
+			callback: func(_ int) (bool, error) {
+				return false, conditionErr
+			},
+			attemptsExpected: 1,
+			errExpected:      conditionErr,
+		},
+		{
+			name:             "context already canceled no attempts expected",
+			context:          cancelledContext,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      context.Canceled,
+		},
+		{
+			name:    "context already canceled condition success and immediate 1 attempt expected",
+			context: cancelledContext,
+			callback: func(_ int) (bool, error) {
+				return true, nil
+			},
+			immediate:        true,
+			attemptsExpected: 1,
+		},
+		{
+			name:    "context already canceled condition fail and immediate 1 attempt expected",
+			context: cancelledContext,
+			callback: func(_ int) (bool, error) {
+				return false, conditionErr
+			},
+			immediate:        true,
+			attemptsExpected: 1,
+			errExpected:      conditionErr,
+		},
+		{
+			name:             "context already canceled and immediate 1 attempt expected",
+			context:          cancelledContext,
+			callback:         defaultCallback,
+			immediate:        true,
+			attemptsExpected: 1,
+			errExpected:      context.Canceled,
+		},
+		{
+			name:               "context cancelled after 5 attempts",
+			context:            defaultContext,
+			callback:           defaultCallback,
+			cancelContextAfter: 5,
+			attemptsExpected:   5,
+			errExpected:        context.Canceled,
+		},
+		{
+			name:               "context cancelled and immediate after 5 attempts",
+			context:            defaultContext,
+			callback:           defaultCallback,
+			immediate:          true,
+			cancelContextAfter: 5,
+			attemptsExpected:   5,
+			errExpected:        context.Canceled,
+		},
+		{
+			name:             "context at deadline and immediate 1 attempt expected",
+			context:          deadlinedContext,
+			callback:         defaultCallback,
+			immediate:        true,
+			attemptsExpected: 1,
+			errExpected:      context.DeadlineExceeded,
+		},
+		{
+			name:             "context at deadline no attempts expected",
+			context:          deadlinedContext,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      context.DeadlineExceeded,
+		},
+		{
+			name:      "context canceled before the second execution and immediate",
+			immediate: true,
+			context: func() (context.Context, context.CancelFunc) {
+				return context.WithTimeout(context.Background(), time.Second)
+			},
+			callback: func(attempts int) (bool, error) {
+				return false, nil
+			},
+			attemptsExpected: 1,
+			errExpected:      context.DeadlineExceeded,
+			timer:            Backoff{Duration: 2 * time.Second}.Timer(),
+		},
+		{
+			name:      "immediate and long duration of condition and sliding false",
+			immediate: true,
+			sliding:   false,
+			context: func() (context.Context, context.CancelFunc) {
+				return context.WithTimeout(context.Background(), time.Second)
+			},
+			callback: func(attempts int) (bool, error) {
+				if attempts >= 4 {
+					return true, nil
+				}
+				time.Sleep(time.Second / 5)
+				return false, nil
+			},
+			attemptsExpected: 4,
+			timer:            Backoff{Duration: time.Second / 5, Jitter: 0.001}.Timer(),
+		},
+		{
+			name:      "immediate and long duration of condition and sliding true",
+			immediate: true,
+			sliding:   true,
+			context: func() (context.Context, context.CancelFunc) {
+				return context.WithTimeout(context.Background(), time.Second)
+			},
+			callback: func(attempts int) (bool, error) {
+				if attempts >= 4 {
+					return true, nil
+				}
+				time.Sleep(time.Second / 5)
+				return false, nil
+			},
+			errExpected:      context.DeadlineExceeded,
+			attemptsExpected: 3,
+			timer:            Backoff{Duration: time.Second / 5, Jitter: 0.001}.Timer(),
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			contextFn := test.context
+			if contextFn == nil {
+				contextFn = defaultContext
+			}
+			ctx, cancel := contextFn()
+			defer cancel()
+
+			timer := test.timer
+			if timer == nil {
+				timer = Backoff{Duration: time.Microsecond}.Timer()
+			}
+			attempts := 0
+			err := loopConditionUntilContext(ctx, timer, test.immediate, test.sliding, func(_ context.Context) (bool, error) {
+				attempts++
+				defer func() {
+					if test.cancelContextAfter > 0 && test.cancelContextAfter == attempts {
+						cancel()
+					}
+				}()
+				return test.callback(attempts)
+			})
+
+			if test.errExpected != err {
+				t.Errorf("expected error: %v but got: %v", test.errExpected, err)
+			}
+
+			if test.attemptsExpected != attempts {
+				t.Errorf("expected attempts count: %d but got: %d", test.attemptsExpected, attempts)
+			}
+		})
+	}
+}
+
+type timerWrapper struct {
+	timer   clock.Timer
+	resets  []time.Duration
+	onReset func(d time.Duration)
+}
+
+func (w *timerWrapper) C() <-chan time.Time { return w.timer.C() }
+func (w *timerWrapper) Stop() bool          { return w.timer.Stop() }
+func (w *timerWrapper) Reset(d time.Duration) bool {
+	w.resets = append(w.resets, d)
+	b := w.timer.Reset(d)
+	if w.onReset != nil {
+		w.onReset(d)
+	}
+	return b
+}
+
+func Test_loopConditionUntilContext_timings(t *testing.T) {
+	// Verify that timings returned by the delay func are passed to the timer, and that
+	// the timer advancing is enough to drive the state machine. Not a deep verification
+	// of the behavior of the loop, but tests that we drive the scenario to completion.
+	tests := []struct {
+		name               string
+		delayFn            DelayFunc
+		immediate          bool
+		sliding            bool
+		context            func() (context.Context, context.CancelFunc)
+		callback           func(calls int, lastInterval time.Duration) (bool, error)
+		cancelContextAfter int
+		attemptsExpected   int
+		errExpected        error
+		expectedIntervals  func(t *testing.T, delays []time.Duration, delaysRequested []time.Duration)
+	}{
+		{
+			name:    "condition success",
+			delayFn: Backoff{Duration: time.Second, Steps: 2, Factor: 2.0, Jitter: 0}.DelayFunc(),
+			callback: func(attempts int, _ time.Duration) (bool, error) {
+				return true, nil
+			},
+			attemptsExpected: 1,
+			expectedIntervals: func(t *testing.T, delays []time.Duration, delaysRequested []time.Duration) {
+				if reflect.DeepEqual(delays, []time.Duration{time.Second, 2 * time.Second}) {
+					return
+				}
+				if reflect.DeepEqual(delaysRequested, []time.Duration{time.Second}) {
+					return
+				}
+			},
+		},
+		{
+			name:      "condition success and immediate",
+			immediate: true,
+			delayFn:   Backoff{Duration: time.Second, Steps: 2, Factor: 2.0, Jitter: 0}.DelayFunc(),
+			callback: func(attempts int, _ time.Duration) (bool, error) {
+				return true, nil
+			},
+			attemptsExpected: 1,
+			expectedIntervals: func(t *testing.T, delays []time.Duration, delaysRequested []time.Duration) {
+				if reflect.DeepEqual(delays, []time.Duration{time.Second}) {
+					return
+				}
+				if reflect.DeepEqual(delaysRequested, []time.Duration{}) {
+					return
+				}
+			},
+		},
+		{
+			name:    "condition success and sliding",
+			sliding: true,
+			delayFn: Backoff{Duration: time.Second, Steps: 2, Factor: 2.0, Jitter: 0}.DelayFunc(),
+			callback: func(attempts int, _ time.Duration) (bool, error) {
+				return true, nil
+			},
+			attemptsExpected: 1,
+			expectedIntervals: func(t *testing.T, delays []time.Duration, delaysRequested []time.Duration) {
+				if reflect.DeepEqual(delays, []time.Duration{time.Second}) {
+					return
+				}
+				if !reflect.DeepEqual(delays, delaysRequested) {
+					t.Fatalf("sliding non-immediate should have equal delays: %v", cmp.Diff(delays, delaysRequested))
+				}
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%s/sliding=%t/immediate=%t", test.name, test.sliding, test.immediate), func(t *testing.T) {
+			contextFn := test.context
+			if contextFn == nil {
+				contextFn = defaultContext
+			}
+			ctx, cancel := contextFn()
+			defer cancel()
+
+			fakeClock := &testingclock.FakeClock{}
+			var fakeTimers []*timerWrapper
+			timerFn := func(d time.Duration) clock.Timer {
+				t := fakeClock.NewTimer(d)
+				fakeClock.Step(d + 1)
+				w := &timerWrapper{timer: t, resets: []time.Duration{d}, onReset: func(d time.Duration) {
+					fakeClock.Step(d + 1)
+				}}
+				fakeTimers = append(fakeTimers, w)
+				return w
+			}
+
+			delayFn := test.delayFn
+			if delayFn == nil {
+				delayFn = Backoff{Duration: time.Microsecond}.DelayFunc()
+			}
+			var delays []time.Duration
+			wrappedDelayFn := func() time.Duration {
+				d := delayFn()
+				delays = append(delays, d)
+				return d
+			}
+			timer := &variableTimer{fn: wrappedDelayFn, new: timerFn}
+
+			attempts := 0
+			err := loopConditionUntilContext(ctx, timer, test.immediate, test.sliding, func(_ context.Context) (bool, error) {
+				attempts++
+				defer func() {
+					if test.cancelContextAfter > 0 && test.cancelContextAfter == attempts {
+						cancel()
+					}
+				}()
+				lastInterval := time.Duration(-1)
+				if len(delays) > 0 {
+					lastInterval = delays[len(delays)-1]
+				}
+				return test.callback(attempts, lastInterval)
+			})
+
+			if test.errExpected != err {
+				t.Errorf("expected error: %v but got: %v", test.errExpected, err)
+			}
+
+			if test.attemptsExpected != attempts {
+				t.Errorf("expected attempts count: %d but got: %d", test.attemptsExpected, attempts)
+			}
+			switch len(fakeTimers) {
+			case 0:
+				test.expectedIntervals(t, delays, nil)
+			case 1:
+				test.expectedIntervals(t, delays, fakeTimers[0].resets)
+			default:
+				t.Fatalf("expected zero or one timers: %#v", fakeTimers)
+			}
+		})
+	}
+}
+
+// Test_loopConditionUntilContext_timings runs actual timing loops and calculates the delta. This
+// test depends on high precision wakeups which depends on low CPU contention so it is not a
+// candidate to run during normal unit test execution (nor is it a benchmark or example). Instead,
+// it can be run manually if there is a scenario where we suspect the timings are off and other
+// tests haven't caught it. A final sanity test that would have to be run serially in isolation.
+func Test_loopConditionUntilContext_Elapsed(t *testing.T) {
+	const maxAttempts = 10
+	// TODO: this may be too aggressive, but the overhead should be minor
+	const estimatedLoopOverhead = time.Millisecond
+	// estimate how long this delay can be
+	intervalMax := func(backoff Backoff) time.Duration {
+		d := backoff.Duration
+		if backoff.Jitter > 0 {
+			d += time.Duration(backoff.Jitter * float64(d))
+		}
+		return d
+	}
+	// estimate how short this delay can be
+	intervalMin := func(backoff Backoff) time.Duration {
+		d := backoff.Duration
+		return d
+	}
+
+	// Because timing is dependent other factors in test environments, such as
+	// whether the OS or go runtime scheduler wake the timers, excess duration
+	// is logged by default and can be converted to a fatal error for testing.
+	// fail := t.Fatalf
+	fail := t.Logf
+
+	for _, test := range []struct {
+		name    string
+		backoff Backoff
+		t       reflect.Type
+	}{
+		{name: "variable timer with jitter", backoff: Backoff{Duration: time.Millisecond, Jitter: 1.0}, t: reflect.TypeOf(&variableTimer{})},
+		{name: "fixed timer", backoff: Backoff{Duration: time.Millisecond}, t: reflect.TypeOf(&fixedTimer{})},
+		{name: "no-op timer", backoff: Backoff{}, t: reflect.TypeOf(noopTimer{})},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			var attempts int
+			start := time.Now()
+			timer := test.backoff.Timer()
+			if test.t != reflect.ValueOf(timer).Type() {
+				t.Fatalf("unexpected timer type %T: expected %v", timer, test.t)
+			}
+			if err := loopConditionUntilContext(context.Background(), timer, false, false, func(_ context.Context) (bool, error) {
+				attempts++
+				if attempts > maxAttempts {
+					t.Fatalf("should not reach %d attempts", maxAttempts+1)
+				}
+				return attempts >= maxAttempts, nil
+			}); err != nil {
+				t.Fatal(err)
+			}
+			duration := time.Since(start)
+			if min := maxAttempts * intervalMin(test.backoff); duration < min {
+				fail("elapsed duration %v < expected min duration %v", duration, min)
+			}
+			if max := maxAttempts * (intervalMax(test.backoff) + estimatedLoopOverhead); duration > max {
+				fail("elapsed duration %v > expected max duration %v", duration, max)
+			}
+		})
+	}
+}
+
+func Benchmark_loopConditionUntilContext_ZeroDuration(b *testing.B) {
+	ctx := context.Background()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		attempts := 0
+		if err := loopConditionUntilContext(ctx, Backoff{Duration: 0}.Timer(), true, false, func(_ context.Context) (bool, error) {
+			attempts++
+			return attempts >= 100, nil
+		}); err != nil {
+			b.Fatalf("unexpected err: %v", err)
+		}
+	}
+}
+
+func Benchmark_loopConditionUntilContext_ShortDuration(b *testing.B) {
+	ctx := context.Background()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		attempts := 0
+		if err := loopConditionUntilContext(ctx, Backoff{Duration: time.Microsecond}.Timer(), true, false, func(_ context.Context) (bool, error) {
+			attempts++
+			return attempts >= 100, nil
+		}); err != nil {
+			b.Fatalf("unexpected err: %v", err)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/wait/poll.go b/third_party/k8s.io/apimachinery/pkg/util/wait/poll.go
new file mode 100644
index 0000000000..231d4c3842
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/wait/poll.go
@@ -0,0 +1,315 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"time"
+)
+
+// PollUntilContextCancel tries a condition func until it returns true, an error, or the context
+// is cancelled or hits a deadline. condition will be invoked after the first interval if the
+// context is not cancelled first. The returned error will be from ctx.Err(), the condition's
+// err return value, or nil. If invoking condition takes longer than interval the next condition
+// will be invoked immediately. When using very short intervals, condition may be invoked multiple
+// times before a context cancellation is detected. If immediate is true, condition will be
+// invoked before waiting and guarantees that condition is invoked at least once, regardless of
+// whether the context has been cancelled.
+func PollUntilContextCancel(ctx context.Context, interval time.Duration, immediate bool, condition ConditionWithContextFunc) error {
+	return loopConditionUntilContext(ctx, Backoff{Duration: interval}.Timer(), immediate, false, condition)
+}
+
+// PollUntilContextTimeout will terminate polling after timeout duration by setting a context
+// timeout. This is provided as a convenience function for callers not currently executing under
+// a deadline and is equivalent to:
+//
+//	deadlineCtx, deadlineCancel := context.WithTimeout(ctx, timeout)
+//	err := PollUntilContextCancel(deadlineCtx, interval, immediate, condition)
+//
+// The deadline context will be cancelled if the Poll succeeds before the timeout, simplifying
+// inline usage. All other behavior is identical to PollUntilContextCancel.
+func PollUntilContextTimeout(ctx context.Context, interval, timeout time.Duration, immediate bool, condition ConditionWithContextFunc) error {
+	deadlineCtx, deadlineCancel := context.WithTimeout(ctx, timeout)
+	defer deadlineCancel()
+	return loopConditionUntilContext(deadlineCtx, Backoff{Duration: interval}.Timer(), immediate, false, condition)
+}
+
+// Poll tries a condition func until it returns true, an error, or the timeout
+// is reached.
+//
+// Poll always waits the interval before the run of 'condition'.
+// 'condition' will always be invoked at least once.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// If you want to Poll something forever, see PollInfinite.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextTimeout.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func Poll(interval, timeout time.Duration, condition ConditionFunc) error {
+	return PollWithContext(context.Background(), interval, timeout, condition.WithContext())
+}
+
+// PollWithContext tries a condition func until it returns true, an error,
+// or when the context expires or the timeout is reached, whichever
+// happens first.
+//
+// PollWithContext always waits the interval before the run of 'condition'.
+// 'condition' will always be invoked at least once.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// If you want to Poll something forever, see PollInfinite.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextTimeout.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollWithContext(ctx context.Context, interval, timeout time.Duration, condition ConditionWithContextFunc) error {
+	return poll(ctx, false, poller(interval, timeout), condition)
+}
+
+// PollUntil tries a condition func until it returns true, an error or stopCh is
+// closed.
+//
+// PollUntil always waits interval before the first run of 'condition'.
+// 'condition' will always be invoked at least once.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollUntil(interval time.Duration, condition ConditionFunc, stopCh <-chan struct{}) error {
+	return PollUntilWithContext(ContextForChannel(stopCh), interval, condition.WithContext())
+}
+
+// PollUntilWithContext tries a condition func until it returns true,
+// an error or the specified context is cancelled or expired.
+//
+// PollUntilWithContext always waits interval before the first run of 'condition'.
+// 'condition' will always be invoked at least once.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollUntilWithContext(ctx context.Context, interval time.Duration, condition ConditionWithContextFunc) error {
+	return poll(ctx, false, poller(interval, 0), condition)
+}
+
+// PollInfinite tries a condition func until it returns true or an error
+//
+// PollInfinite always waits the interval before the run of 'condition'.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollInfinite(interval time.Duration, condition ConditionFunc) error {
+	return PollInfiniteWithContext(context.Background(), interval, condition.WithContext())
+}
+
+// PollInfiniteWithContext tries a condition func until it returns true or an error
+//
+// PollInfiniteWithContext always waits the interval before the run of 'condition'.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollInfiniteWithContext(ctx context.Context, interval time.Duration, condition ConditionWithContextFunc) error {
+	return poll(ctx, false, poller(interval, 0), condition)
+}
+
+// PollImmediate tries a condition func until it returns true, an error, or the timeout
+// is reached.
+//
+// PollImmediate always checks 'condition' before waiting for the interval. 'condition'
+// will always be invoked at least once.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// If you want to immediately Poll something forever, see PollImmediateInfinite.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextTimeout.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollImmediate(interval, timeout time.Duration, condition ConditionFunc) error {
+	return PollImmediateWithContext(context.Background(), interval, timeout, condition.WithContext())
+}
+
+// PollImmediateWithContext tries a condition func until it returns true, an error,
+// or the timeout is reached or the specified context expires, whichever happens first.
+//
+// PollImmediateWithContext always checks 'condition' before waiting for the interval.
+// 'condition' will always be invoked at least once.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// If you want to immediately Poll something forever, see PollImmediateInfinite.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextTimeout.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollImmediateWithContext(ctx context.Context, interval, timeout time.Duration, condition ConditionWithContextFunc) error {
+	return poll(ctx, true, poller(interval, timeout), condition)
+}
+
+// PollImmediateUntil tries a condition func until it returns true, an error or stopCh is closed.
+//
+// PollImmediateUntil runs the 'condition' before waiting for the interval.
+// 'condition' will always be invoked at least once.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollImmediateUntil(interval time.Duration, condition ConditionFunc, stopCh <-chan struct{}) error {
+	return PollImmediateUntilWithContext(ContextForChannel(stopCh), interval, condition.WithContext())
+}
+
+// PollImmediateUntilWithContext tries a condition func until it returns true,
+// an error or the specified context is cancelled or expired.
+//
+// PollImmediateUntilWithContext runs the 'condition' before waiting for the interval.
+// 'condition' will always be invoked at least once.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollImmediateUntilWithContext(ctx context.Context, interval time.Duration, condition ConditionWithContextFunc) error {
+	return poll(ctx, true, poller(interval, 0), condition)
+}
+
+// PollImmediateInfinite tries a condition func until it returns true or an error
+//
+// PollImmediateInfinite runs the 'condition' before waiting for the interval.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollImmediateInfinite(interval time.Duration, condition ConditionFunc) error {
+	return PollImmediateInfiniteWithContext(context.Background(), interval, condition.WithContext())
+}
+
+// PollImmediateInfiniteWithContext tries a condition func until it returns true
+// or an error or the specified context gets cancelled or expired.
+//
+// PollImmediateInfiniteWithContext runs the 'condition' before waiting for the interval.
+//
+// Some intervals may be missed if the condition takes too long or the time
+// window is too short.
+//
+// Deprecated: This method does not return errors from context, use PollUntilContextCancel.
+// Note that the new method will no longer return ErrWaitTimeout and instead return errors
+// defined by the context package. Will be removed in a future release.
+func PollImmediateInfiniteWithContext(ctx context.Context, interval time.Duration, condition ConditionWithContextFunc) error {
+	return poll(ctx, true, poller(interval, 0), condition)
+}
+
+// Internally used, each of the public 'Poll*' function defined in this
+// package should invoke this internal function with appropriate parameters.
+// ctx: the context specified by the caller, for infinite polling pass
+// a context that never gets cancelled or expired.
+// immediate: if true, the 'condition' will be invoked before waiting for the interval,
+// in this case 'condition' will always be invoked at least once.
+// wait: user specified WaitFunc function that controls at what interval the condition
+// function should be invoked periodically and whether it is bound by a timeout.
+// condition: user specified ConditionWithContextFunc function.
+//
+// Deprecated: will be removed in favor of loopConditionUntilContext.
+func poll(ctx context.Context, immediate bool, wait waitWithContextFunc, condition ConditionWithContextFunc) error {
+	if immediate {
+		done, err := runConditionWithCrashProtectionWithContext(ctx, condition)
+		if err != nil {
+			return err
+		}
+		if done {
+			return nil
+		}
+	}
+
+	select {
+	case <-ctx.Done():
+		// returning ctx.Err() will break backward compatibility, use new PollUntilContext*
+		// methods instead
+		return ErrWaitTimeout
+	default:
+		return waitForWithContext(ctx, wait, condition)
+	}
+}
+
+// poller returns a WaitFunc that will send to the channel every interval until
+// timeout has elapsed and then closes the channel.
+//
+// Over very short intervals you may receive no ticks before the channel is
+// closed. A timeout of 0 is interpreted as an infinity, and in such a case
+// it would be the caller's responsibility to close the done channel.
+// Failure to do so would result in a leaked goroutine.
+//
+// Output ticks are not buffered. If the channel is not ready to receive an
+// item, the tick is skipped.
+//
+// Deprecated: Will be removed in a future release.
+func poller(interval, timeout time.Duration) waitWithContextFunc {
+	return waitWithContextFunc(func(ctx context.Context) <-chan struct{} {
+		ch := make(chan struct{})
+
+		go func() {
+			defer close(ch)
+
+			tick := time.NewTicker(interval)
+			defer tick.Stop()
+
+			var after <-chan time.Time
+			if timeout != 0 {
+				// time.After is more convenient, but it
+				// potentially leaves timers around much longer
+				// than necessary if we exit early.
+				timer := time.NewTimer(timeout)
+				after = timer.C
+				defer timer.Stop()
+			}
+
+			for {
+				select {
+				case <-tick.C:
+					// If the consumer isn't ready for this signal drop it and
+					// check the other channels.
+					select {
+					case ch <- struct{}{}:
+					default:
+					}
+				case <-after:
+					return
+				case <-ctx.Done():
+					return
+				}
+			}
+		}()
+
+		return ch
+	})
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/wait/timer.go b/third_party/k8s.io/apimachinery/pkg/util/wait/timer.go
new file mode 100644
index 0000000000..3efba32132
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/wait/timer.go
@@ -0,0 +1,121 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"time"
+
+	"k8s.io/utils/clock"
+)
+
+// Timer abstracts how wait functions interact with time runtime efficiently. Test
+// code may implement this interface directly but package consumers are encouraged
+// to use the Backoff type as the primary mechanism for acquiring a Timer. The
+// interface is a simplification of clock.Timer to prevent misuse. Timers are not
+// expected to be safe for calls from multiple goroutines.
+type Timer interface {
+	// C returns a channel that will receive a struct{} each time the timer fires.
+	// The channel should not be waited on after Stop() is invoked. It is allowed
+	// to cache the returned value of C() for the lifetime of the Timer.
+	C() <-chan time.Time
+	// Next is invoked by wait functions to signal timers that the next interval
+	// should begin. You may only use Next() if you have drained the channel C().
+	// You should not call Next() after Stop() is invoked.
+	Next()
+	// Stop releases the timer. It is safe to invoke if no other methods have been
+	// called.
+	Stop()
+}
+
+type noopTimer struct {
+	closedCh <-chan time.Time
+}
+
+// newNoopTimer creates a timer with a unique channel to avoid contention
+// for the channel's lock across multiple unrelated timers.
+func newNoopTimer() noopTimer {
+	ch := make(chan time.Time)
+	close(ch)
+	return noopTimer{closedCh: ch}
+}
+
+func (t noopTimer) C() <-chan time.Time {
+	return t.closedCh
+}
+func (noopTimer) Next() {}
+func (noopTimer) Stop() {}
+
+type variableTimer struct {
+	fn  DelayFunc
+	t   clock.Timer
+	new func(time.Duration) clock.Timer
+}
+
+func (t *variableTimer) C() <-chan time.Time {
+	if t.t == nil {
+		d := t.fn()
+		t.t = t.new(d)
+	}
+	return t.t.C()
+}
+func (t *variableTimer) Next() {
+	if t.t == nil {
+		return
+	}
+	d := t.fn()
+	t.t.Reset(d)
+}
+func (t *variableTimer) Stop() {
+	if t.t == nil {
+		return
+	}
+	t.t.Stop()
+	t.t = nil
+}
+
+type fixedTimer struct {
+	interval time.Duration
+	t        clock.Ticker
+	new      func(time.Duration) clock.Ticker
+}
+
+func (t *fixedTimer) C() <-chan time.Time {
+	if t.t == nil {
+		t.t = t.new(t.interval)
+	}
+	return t.t.C()
+}
+func (t *fixedTimer) Next() {
+	// no-op for fixed timers
+}
+func (t *fixedTimer) Stop() {
+	if t.t == nil {
+		return
+	}
+	t.t.Stop()
+	t.t = nil
+}
+
+var (
+	// RealTimer can be passed to methods that need a clock.Timer.
+	RealTimer = clock.RealClock{}.NewTimer
+)
+
+var (
+	// internalClock is used for test injection of clocks
+	internalClock = clock.RealClock{}
+)
diff --git a/third_party/k8s.io/apimachinery/pkg/util/wait/wait.go b/third_party/k8s.io/apimachinery/pkg/util/wait/wait.go
new file mode 100644
index 0000000000..7379a8d5ac
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/wait/wait.go
@@ -0,0 +1,228 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"math/rand"
+	"sync"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// For any test of the style:
+//
+//	...
+//	<- time.After(timeout):
+//	   t.Errorf("Timed out")
+//
+// The value for timeout should effectively be "forever." Obviously we don't want our tests to truly lock up forever, but 30s
+// is long enough that it is effectively forever for the things that can slow down a run on a heavily contended machine
+// (GC, seeks, etc), but not so long as to make a developer ctrl-c a test run if they do happen to break that test.
+var ForeverTestTimeout = time.Second * 30
+
+// NeverStop may be passed to Until to make it never stop.
+var NeverStop <-chan struct{} = make(chan struct{})
+
+// Group allows to start a group of goroutines and wait for their completion.
+type Group struct {
+	wg sync.WaitGroup
+}
+
+func (g *Group) Wait() {
+	g.wg.Wait()
+}
+
+// StartWithChannel starts f in a new goroutine in the group.
+// stopCh is passed to f as an argument. f should stop when stopCh is available.
+func (g *Group) StartWithChannel(stopCh <-chan struct{}, f func(stopCh <-chan struct{})) {
+	g.Start(func() {
+		f(stopCh)
+	})
+}
+
+// StartWithContext starts f in a new goroutine in the group.
+// ctx is passed to f as an argument. f should stop when ctx.Done() is available.
+func (g *Group) StartWithContext(ctx context.Context, f func(context.Context)) {
+	g.Start(func() {
+		f(ctx)
+	})
+}
+
+// Start starts f in a new goroutine in the group.
+func (g *Group) Start(f func()) {
+	g.wg.Add(1)
+	go func() {
+		defer g.wg.Done()
+		f()
+	}()
+}
+
+// Forever calls f every period for ever.
+//
+// Forever is syntactic sugar on top of Until.
+func Forever(f func(), period time.Duration) {
+	Until(f, period, NeverStop)
+}
+
+// jitterRand is a dedicated random source for jitter calculations.
+// It defaults to rand.Float64, but is a package variable so it can be overridden to make unit tests deterministic.
+var jitterRand = rand.Float64
+
+// Jitter returns a time.Duration between duration and duration + maxFactor *
+// duration.
+//
+// This allows clients to avoid converging on periodic behavior. If maxFactor
+// is 0.0, a suggested default value will be chosen.
+func Jitter(duration time.Duration, maxFactor float64) time.Duration {
+	if maxFactor <= 0.0 {
+		maxFactor = 1.0
+	}
+	wait := duration + time.Duration(jitterRand()*maxFactor*float64(duration))
+	return wait
+}
+
+// ConditionFunc returns true if the condition is satisfied, or an error
+// if the loop should be aborted.
+type ConditionFunc func() (done bool, err error)
+
+// ConditionWithContextFunc returns true if the condition is satisfied, or an error
+// if the loop should be aborted.
+//
+// The caller passes along a context that can be used by the condition function.
+type ConditionWithContextFunc func(context.Context) (done bool, err error)
+
+// WithContext converts a ConditionFunc into a ConditionWithContextFunc
+func (cf ConditionFunc) WithContext() ConditionWithContextFunc {
+	return func(context.Context) (done bool, err error) {
+		return cf()
+	}
+}
+
+// ContextForChannel provides a context that will be treated as cancelled
+// when the provided parentCh is closed. The implementation returns
+// context.Canceled for Err() if and only if the parentCh is closed.
+func ContextForChannel(parentCh <-chan struct{}) context.Context {
+	return channelContext{stopCh: parentCh}
+}
+
+var _ context.Context = channelContext{}
+
+// channelContext will behave as if the context were cancelled when stopCh is
+// closed.
+type channelContext struct {
+	stopCh <-chan struct{}
+}
+
+func (c channelContext) Done() <-chan struct{} { return c.stopCh }
+func (c channelContext) Err() error {
+	select {
+	case <-c.stopCh:
+		return context.Canceled
+	default:
+		return nil
+	}
+}
+func (c channelContext) Deadline() (time.Time, bool) { return time.Time{}, false }
+func (c channelContext) Value(key any) any           { return nil }
+
+// runConditionWithCrashProtection runs a ConditionFunc with crash protection.
+//
+// Deprecated: Will be removed when the legacy polling methods are removed.
+func runConditionWithCrashProtection(condition ConditionFunc) (bool, error) {
+	//nolint:logcheck // Already deprecated.
+	defer runtime.HandleCrash()
+	return condition()
+}
+
+// runConditionWithCrashProtectionWithContext runs a ConditionWithContextFunc
+// with crash protection.
+//
+// Deprecated: Will be removed when the legacy polling methods are removed.
+func runConditionWithCrashProtectionWithContext(ctx context.Context, condition ConditionWithContextFunc) (bool, error) {
+	defer runtime.HandleCrashWithContext(ctx)
+	return condition(ctx)
+}
+
+// waitFunc creates a channel that receives an item every time a test
+// should be executed and is closed when the last test should be invoked.
+//
+// Deprecated: Will be removed in a future release in favor of
+// loopConditionUntilContext.
+type waitFunc func(done <-chan struct{}) <-chan struct{}
+
+// WithContext converts the WaitFunc to an equivalent WaitWithContextFunc
+func (w waitFunc) WithContext() waitWithContextFunc {
+	return func(ctx context.Context) <-chan struct{} {
+		return w(ctx.Done())
+	}
+}
+
+// waitWithContextFunc creates a channel that receives an item every time a test
+// should be executed and is closed when the last test should be invoked.
+//
+// When the specified context gets cancelled or expires the function
+// stops sending item and returns immediately.
+//
+// Deprecated: Will be removed in a future release in favor of
+// loopConditionUntilContext.
+type waitWithContextFunc func(ctx context.Context) <-chan struct{}
+
+// waitForWithContext continually checks 'fn' as driven by 'wait'.
+//
+// waitForWithContext gets a channel from 'wait()”, and then invokes 'fn'
+// once for every value placed on the channel and once more when the
+// channel is closed. If the channel is closed and 'fn'
+// returns false without error, waitForWithContext returns ErrWaitTimeout.
+//
+// If 'fn' returns an error the loop ends and that error is returned. If
+// 'fn' returns true the loop ends and nil is returned.
+//
+// context.Canceled will be returned if the ctx.Done() channel is closed
+// without fn ever returning true.
+//
+// When the ctx.Done() channel is closed, because the golang `select` statement is
+// "uniform pseudo-random", the `fn` might still run one or multiple times,
+// though eventually `waitForWithContext` will return.
+//
+// Deprecated: Will be removed in a future release in favor of
+// loopConditionUntilContext.
+func waitForWithContext(ctx context.Context, wait waitWithContextFunc, fn ConditionWithContextFunc) error {
+	waitCtx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	c := wait(waitCtx)
+	for {
+		select {
+		case _, open := <-c:
+			ok, err := runConditionWithCrashProtectionWithContext(ctx, fn)
+			if err != nil {
+				return err
+			}
+			if ok {
+				return nil
+			}
+			if !open {
+				return ErrWaitTimeout
+			}
+		case <-ctx.Done():
+			// returning ctx.Err() will break backward compatibility, use new PollUntilContext*
+			// methods instead
+			return ErrWaitTimeout
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/wait/wait_test.go b/third_party/k8s.io/apimachinery/pkg/util/wait/wait_test.go
new file mode 100644
index 0000000000..39c5d29910
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/wait/wait_test.go
@@ -0,0 +1,1575 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package wait
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math/rand"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/utils/clock"
+	testingclock "k8s.io/utils/clock/testing"
+)
+
+func TestUntil(t *testing.T) {
+	ch := make(chan struct{})
+	close(ch)
+	Until(func() {
+		t.Fatal("should not have been invoked")
+	}, 0, ch)
+
+	ch = make(chan struct{})
+	called := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		Until(func() {
+			called <- struct{}{}
+		}, 0, ch)
+		close(called)
+	}()
+	<-called
+	close(ch)
+	<-called
+	wg.Wait()
+}
+
+func TestUntilWithContext(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.TODO())
+	cancel()
+	UntilWithContext(ctx, func(context.Context) {
+		t.Fatal("should not have been invoked")
+	}, 0)
+
+	ctx, cancel = context.WithCancel(context.TODO())
+	called := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		UntilWithContext(ctx, func(context.Context) {
+			called <- struct{}{}
+		}, 0)
+		close(called)
+	}()
+	<-called
+	cancel()
+	<-called
+	wg.Wait()
+}
+
+func TestNonSlidingUntil(t *testing.T) {
+	ch := make(chan struct{})
+	close(ch)
+	NonSlidingUntil(func() {
+		t.Fatal("should not have been invoked")
+	}, 0, ch)
+
+	ch = make(chan struct{})
+	called := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		NonSlidingUntil(func() {
+			called <- struct{}{}
+		}, 0, ch)
+		close(called)
+	}()
+	<-called
+	close(ch)
+	<-called
+	wg.Wait()
+}
+
+func TestNonSlidingUntilWithContext(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.TODO())
+	cancel()
+	NonSlidingUntilWithContext(ctx, func(context.Context) {
+		t.Fatal("should not have been invoked")
+	}, 0)
+
+	ctx, cancel = context.WithCancel(context.TODO())
+	called := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		NonSlidingUntilWithContext(ctx, func(context.Context) {
+			called <- struct{}{}
+		}, 0)
+		close(called)
+	}()
+	<-called
+	cancel()
+	<-called
+	wg.Wait()
+}
+
+func TestUntilReturnsImmediately(t *testing.T) {
+	now := time.Now()
+	ch := make(chan struct{})
+	var attempts int
+	Until(func() {
+		attempts++
+		if attempts > 1 {
+			t.Fatalf("invoked after close of channel")
+		}
+		close(ch)
+	}, 30*time.Second, ch)
+	if now.Add(25 * time.Second).Before(time.Now()) {
+		t.Errorf("Until did not return immediately when the stop chan was closed inside the func")
+	}
+}
+
+func TestJitterUntil(t *testing.T) {
+	ch := make(chan struct{})
+	// if a channel is closed JitterUntil never calls function f
+	// and returns immediately
+	close(ch)
+	JitterUntil(func() {
+		t.Fatal("should not have been invoked")
+	}, 0, 1.0, true, ch)
+
+	ch = make(chan struct{})
+	called := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		JitterUntil(func() {
+			called <- struct{}{}
+		}, 0, 1.0, true, ch)
+		close(called)
+	}()
+	<-called
+	close(ch)
+	<-called
+	wg.Wait()
+}
+
+func TestJitterUntilWithContext(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.TODO())
+	cancel()
+	JitterUntilWithContext(ctx, func(context.Context) {
+		t.Fatal("should not have been invoked")
+	}, 0, 1.0, true)
+
+	ctx, cancel = context.WithCancel(context.TODO())
+	called := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		JitterUntilWithContext(ctx, func(context.Context) {
+			called <- struct{}{}
+		}, 0, 1.0, true)
+		close(called)
+	}()
+	<-called
+	cancel()
+	<-called
+	wg.Wait()
+}
+
+func TestJitterUntilReturnsImmediately(t *testing.T) {
+	now := time.Now()
+	ch := make(chan struct{})
+	JitterUntil(func() {
+		close(ch)
+	}, 30*time.Second, 1.0, true, ch)
+	if now.Add(25 * time.Second).Before(time.Now()) {
+		t.Errorf("JitterUntil did not return immediately when the stop chan was closed inside the func")
+	}
+}
+
+func TestJitterUntilRecoversPanic(t *testing.T) {
+	// Save and restore crash handlers
+	originalReallyCrash := runtime.ReallyCrash
+	originalHandlers := runtime.PanicHandlers
+	defer func() {
+		runtime.ReallyCrash = originalReallyCrash
+		runtime.PanicHandlers = originalHandlers
+	}()
+
+	called := 0
+	handled := 0
+
+	// Hook up a custom crash handler to ensure it is called when a jitter function panics
+	runtime.ReallyCrash = false
+	runtime.PanicHandlers = []func(context.Context, interface{}){
+		func(_ context.Context, p interface{}) {
+			handled++
+		},
+	}
+
+	ch := make(chan struct{})
+	JitterUntil(func() {
+		called++
+		if called > 2 {
+			close(ch)
+			return
+		}
+		panic("TestJitterUntilRecoversPanic")
+	}, time.Millisecond, 1.0, true, ch)
+
+	if called != 3 {
+		t.Errorf("Expected panic recovers")
+	}
+}
+
+func TestJitterUntilNegativeFactor(t *testing.T) {
+	now := time.Now()
+	ch := make(chan struct{})
+	called := make(chan struct{})
+	received := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		JitterUntil(func() {
+			called <- struct{}{}
+			<-received
+		}, time.Second, -30.0, true, ch)
+	}()
+	// first loop
+	<-called
+	received <- struct{}{}
+	// second loop
+	<-called
+	close(ch)
+	received <- struct{}{}
+
+	// it should take at most 2 seconds + some overhead, not 3
+	if now.Add(3 * time.Second).Before(time.Now()) {
+		t.Errorf("JitterUntil did not returned after predefined period with negative jitter factor when the stop chan was closed inside the func")
+	}
+	wg.Wait()
+}
+
+func TestExponentialBackoff(t *testing.T) {
+	// exits immediately
+	i := 0
+	err := ExponentialBackoff(Backoff{Factor: 1.0}, func() (bool, error) {
+		i++
+		return false, nil
+	})
+	if err != ErrWaitTimeout || i != 0 {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	opts := Backoff{Factor: 1.0, Steps: 3}
+
+	// waits up to steps
+	i = 0
+	err = ExponentialBackoff(opts, func() (bool, error) {
+		i++
+		return false, nil
+	})
+	if err != ErrWaitTimeout || i != opts.Steps {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	// returns immediately
+	i = 0
+	err = ExponentialBackoff(opts, func() (bool, error) {
+		i++
+		return true, nil
+	})
+	if err != nil || i != 1 {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	// returns immediately on error
+	testErr := fmt.Errorf("some other error")
+	err = ExponentialBackoff(opts, func() (bool, error) {
+		return false, testErr
+	})
+	if err != testErr {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	// invoked multiple times
+	i = 1
+	err = ExponentialBackoff(opts, func() (bool, error) {
+		if i < opts.Steps {
+			i++
+			return false, nil
+		}
+		return true, nil
+	})
+	if err != nil || i != opts.Steps {
+		t.Errorf("unexpected error: %v", err)
+	}
+}
+
+func TestPoller(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	w := poller(time.Millisecond, 2*time.Millisecond)
+	ch := w(ctx)
+	count := 0
+DRAIN:
+	for {
+		select {
+		case _, open := <-ch:
+			if !open {
+				break DRAIN
+			}
+			count++
+		case <-time.After(ForeverTestTimeout):
+			t.Errorf("unexpected timeout after poll")
+		}
+	}
+	if count > 3 {
+		t.Errorf("expected up to three values, got %d", count)
+	}
+}
+
+type fakePoller struct {
+	max  int
+	used int32 // accessed with atomics
+	wg   sync.WaitGroup
+}
+
+func fakeTicker(max int, used *int32, doneFunc func()) waitFunc {
+	return func(done <-chan struct{}) <-chan struct{} {
+		ch := make(chan struct{})
+		go func() {
+			defer doneFunc()
+			defer close(ch)
+			for i := 0; i < max; i++ {
+				select {
+				case ch <- struct{}{}:
+				case <-done:
+					return
+				}
+				if used != nil {
+					atomic.AddInt32(used, 1)
+				}
+			}
+		}()
+		return ch
+	}
+}
+
+func (fp *fakePoller) GetwaitFunc() waitFunc {
+	fp.wg.Add(1)
+	return fakeTicker(fp.max, &fp.used, fp.wg.Done)
+}
+
+func TestPoll(t *testing.T) {
+	invocations := 0
+	f := ConditionWithContextFunc(func(ctx context.Context) (bool, error) {
+		invocations++
+		return true, nil
+	})
+	fp := fakePoller{max: 1}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	if err := poll(ctx, false, fp.GetwaitFunc().WithContext(), f); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	fp.wg.Wait()
+	if invocations != 1 {
+		t.Errorf("Expected exactly one invocation, got %d", invocations)
+	}
+	used := atomic.LoadInt32(&fp.used)
+	if used != 1 {
+		t.Errorf("Expected exactly one tick, got %d", used)
+	}
+}
+
+func TestPollError(t *testing.T) {
+	expectedError := errors.New("Expected error")
+	f := ConditionFunc(func() (bool, error) {
+		return false, expectedError
+	})
+	fp := fakePoller{max: 1}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	if err := poll(ctx, false, fp.GetwaitFunc().WithContext(), f.WithContext()); err == nil || err != expectedError {
+		t.Fatalf("Expected error %v, got none %v", expectedError, err)
+	}
+	fp.wg.Wait()
+	used := atomic.LoadInt32(&fp.used)
+	if used != 1 {
+		t.Errorf("Expected exactly one tick, got %d", used)
+	}
+}
+
+func TestPollImmediate(t *testing.T) {
+	invocations := 0
+	f := ConditionFunc(func() (bool, error) {
+		invocations++
+		return true, nil
+	})
+	fp := fakePoller{max: 0}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	if err := poll(ctx, true, fp.GetwaitFunc().WithContext(), f.WithContext()); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+	// We don't need to wait for fp.wg, as pollImmediate shouldn't call waitFunc at all.
+	if invocations != 1 {
+		t.Errorf("Expected exactly one invocation, got %d", invocations)
+	}
+	used := atomic.LoadInt32(&fp.used)
+	if used != 0 {
+		t.Errorf("Expected exactly zero ticks, got %d", used)
+	}
+}
+
+func TestPollImmediateError(t *testing.T) {
+	expectedError := errors.New("Expected error")
+	f := ConditionFunc(func() (bool, error) {
+		return false, expectedError
+	})
+	fp := fakePoller{max: 0}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	if err := poll(ctx, true, fp.GetwaitFunc().WithContext(), f.WithContext()); err == nil || err != expectedError {
+		t.Fatalf("Expected error %v, got none %v", expectedError, err)
+	}
+	// We don't need to wait for fp.wg, as pollImmediate shouldn't call waitFunc at all.
+	used := atomic.LoadInt32(&fp.used)
+	if used != 0 {
+		t.Errorf("Expected exactly zero ticks, got %d", used)
+	}
+}
+
+func TestPollForever(t *testing.T) {
+	ch := make(chan struct{})
+	errc := make(chan error, 1)
+	done := make(chan struct{}, 1)
+	complete := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		f := ConditionFunc(func() (bool, error) {
+			ch <- struct{}{}
+			select {
+			case <-done:
+				return true, nil
+			default:
+			}
+			return false, nil
+		})
+
+		if err := PollInfinite(time.Microsecond, f); err != nil {
+			errc <- fmt.Errorf("unexpected error %v", err)
+		}
+
+		close(ch)
+		complete <- struct{}{}
+	}()
+
+	// ensure the condition is opened
+	<-ch
+
+	// ensure channel sends events
+	for i := 0; i < 10; i++ {
+		select {
+		case _, open := <-ch:
+			if !open {
+				if len(errc) != 0 {
+					t.Fatalf("did not expect channel to be closed, %v", <-errc)
+				}
+				t.Fatal("did not expect channel to be closed")
+			}
+		case <-time.After(ForeverTestTimeout):
+			t.Fatalf("channel did not return at least once within the poll interval")
+		}
+	}
+
+	// at most one poll notification should be sent once we return from the condition
+	done <- struct{}{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		for i := 0; i < 2; i++ {
+			_, open := <-ch
+			if !open {
+				return
+			}
+		}
+		t.Error("expected closed channel after two iterations")
+	}()
+	<-complete
+
+	if len(errc) != 0 {
+		t.Fatal(<-errc)
+	}
+	wg.Wait()
+}
+
+func Test_waitFor(t *testing.T) {
+	var invocations int
+	testCases := map[string]struct {
+		F       ConditionFunc
+		Ticks   int
+		Invoked int
+		Err     bool
+	}{
+		"invoked once": {
+			ConditionFunc(func() (bool, error) {
+				invocations++
+				return true, nil
+			}),
+			2,
+			1,
+			false,
+		},
+		"invoked and returns a timeout": {
+			ConditionFunc(func() (bool, error) {
+				invocations++
+				return false, nil
+			}),
+			2,
+			3, // the contract of waitFor() says the func is called once more at the end of the wait
+			true,
+		},
+		"returns immediately on error": {
+			ConditionFunc(func() (bool, error) {
+				invocations++
+				return false, errors.New("test")
+			}),
+			2,
+			1,
+			true,
+		},
+	}
+	for k, c := range testCases {
+		invocations = 0
+		ticker := fakeTicker(c.Ticks, nil, func() {})
+		err := func() error {
+			done := make(chan struct{})
+			defer close(done)
+			ctx := ContextForChannel(done)
+			return waitForWithContext(ctx, ticker.WithContext(), c.F.WithContext())
+		}()
+		switch {
+		case c.Err && err == nil:
+			t.Errorf("%s: Expected error, got nil", k)
+			continue
+		case !c.Err && err != nil:
+			t.Errorf("%s: Expected no error, got: %#v", k, err)
+			continue
+		}
+		if invocations != c.Invoked {
+			t.Errorf("%s: Expected %d invocations, got %d", k, c.Invoked, invocations)
+		}
+	}
+}
+
+// Test_waitForWithEarlyClosing_waitFunc tests WaitFor when the waitFunc closes its channel. The WaitFor should
+// always return ErrWaitTimeout.
+func Test_waitForWithEarlyClosing_waitFunc(t *testing.T) {
+	stopCh := make(chan struct{})
+	defer close(stopCh)
+
+	ctx := ContextForChannel(stopCh)
+	start := time.Now()
+	err := waitForWithContext(ctx, func(ctx context.Context) <-chan struct{} {
+		c := make(chan struct{})
+		close(c)
+		return c
+	}, func(_ context.Context) (bool, error) {
+		return false, nil
+	})
+	duration := time.Since(start)
+
+	// The waitFor should return immediately, so the duration is close to 0s.
+	if duration >= ForeverTestTimeout/2 {
+		t.Errorf("expected short timeout duration")
+	}
+	if err != ErrWaitTimeout {
+		t.Errorf("expected ErrWaitTimeout from WaitFunc")
+	}
+}
+
+// Test_waitForWithClosedChannel tests waitFor when it receives a closed channel. The waitFor should
+// always return ErrWaitTimeout.
+func Test_waitForWithClosedChannel(t *testing.T) {
+	stopCh := make(chan struct{})
+	close(stopCh)
+	c := make(chan struct{})
+	defer close(c)
+	ctx := ContextForChannel(stopCh)
+
+	start := time.Now()
+	err := waitForWithContext(ctx, func(_ context.Context) <-chan struct{} {
+		return c
+	}, func(_ context.Context) (bool, error) {
+		return false, nil
+	})
+	duration := time.Since(start)
+	// The waitFor should return immediately, so the duration is close to 0s.
+	if duration >= ForeverTestTimeout/2 {
+		t.Errorf("expected short timeout duration")
+	}
+	// The interval of the poller is ForeverTestTimeout, so the waitFor should always return ErrWaitTimeout.
+	if err != ErrWaitTimeout {
+		t.Errorf("expected ErrWaitTimeout from WaitFunc")
+	}
+}
+
+// Test_waitForWithContextCancelsContext verifies that after the condition func returns true,
+// waitForWithContext cancels the context it supplies to the WaitWithContextFunc.
+func Test_waitForWithContextCancelsContext(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	waitFn := poller(time.Millisecond, ForeverTestTimeout)
+
+	var ctxPassedToWait context.Context
+	waitForWithContext(ctx, func(ctx context.Context) <-chan struct{} {
+		ctxPassedToWait = ctx
+		return waitFn(ctx)
+	}, func(ctx context.Context) (bool, error) {
+		time.Sleep(10 * time.Millisecond)
+		return true, nil
+	})
+	// The polling goroutine should be closed after waitForWithContext returning.
+	if ctxPassedToWait.Err() != context.Canceled {
+		t.Errorf("expected the context passed to waitForWithContext to be closed with: %v, but got: %v", context.Canceled, ctxPassedToWait.Err())
+	}
+}
+
+func TestPollUntil(t *testing.T) {
+	stopCh := make(chan struct{})
+	called := make(chan bool)
+	pollDone := make(chan struct{})
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		PollUntil(time.Microsecond, ConditionFunc(func() (bool, error) {
+			called <- true
+			return false, nil
+		}), stopCh)
+
+		close(pollDone)
+	}()
+
+	// make sure we're called once
+	<-called
+	// this should trigger a "done"
+	close(stopCh)
+
+	go func() {
+		// release the condition func if needed
+		for range called {
+		}
+	}()
+
+	// make sure we finished the poll
+	<-pollDone
+	close(called)
+	wg.Wait()
+}
+
+func TestBackoff_Step(t *testing.T) {
+	tests := []struct {
+		initial *Backoff
+		want    []time.Duration
+	}{
+		{initial: nil, want: []time.Duration{0, 0, 0, 0}},
+		{initial: &Backoff{Duration: time.Second, Steps: -1}, want: []time.Duration{time.Second, time.Second, time.Second}},
+		{initial: &Backoff{Duration: time.Second, Steps: 0}, want: []time.Duration{time.Second, time.Second, time.Second}},
+		{initial: &Backoff{Duration: time.Second, Steps: 1}, want: []time.Duration{time.Second, time.Second, time.Second}},
+		{initial: &Backoff{Duration: time.Second, Factor: 1.0, Steps: 1}, want: []time.Duration{time.Second, time.Second, time.Second}},
+		{initial: &Backoff{Duration: time.Second, Factor: 2, Steps: 3}, want: []time.Duration{1 * time.Second, 2 * time.Second, 4 * time.Second}},
+		{initial: &Backoff{Duration: time.Second, Factor: 2, Steps: 3, Cap: 3 * time.Second}, want: []time.Duration{1 * time.Second, 2 * time.Second, 3 * time.Second}},
+		{initial: &Backoff{Duration: time.Second, Factor: 2, Steps: 2, Cap: 3 * time.Second, Jitter: 0.5}, want: []time.Duration{2 * time.Second, 3 * time.Second, 3 * time.Second}},
+		{initial: &Backoff{Duration: time.Second, Factor: 2, Steps: 6, Jitter: 4}, want: []time.Duration{1 * time.Second, 2 * time.Second, 4 * time.Second, 8 * time.Second, 16 * time.Second, 32 * time.Second}},
+	}
+	for seed := int64(0); seed < 5; seed++ {
+		for _, tt := range tests {
+			var initial *Backoff
+			if tt.initial != nil {
+				copied := *tt.initial
+				initial = &copied
+			} else {
+				initial = nil
+			}
+			t.Run(fmt.Sprintf("%#v seed=%d", initial, seed), func(t *testing.T) {
+				jitterRand = rand.New(rand.NewSource(seed)).Float64
+				for i := 0; i < len(tt.want); i++ {
+					got := initial.Step()
+					t.Logf("[%d]=%s", i, got)
+					if initial != nil && initial.Jitter > 0 {
+						if got == tt.want[i] {
+							// this is statistically unlikely to happen by chance
+							t.Errorf("Backoff.Step(%d) = %v, no jitter", i, got)
+							continue
+						}
+						diff := float64(tt.want[i]-got) / float64(tt.want[i])
+						if diff > initial.Jitter {
+							t.Errorf("Backoff.Step(%d) = %v, want %v, outside range", i, got, tt.want)
+							continue
+						}
+					} else {
+						if got != tt.want[i] {
+							t.Errorf("Backoff.Step(%d) = %v, want %v", i, got, tt.want)
+							continue
+						}
+					}
+				}
+			})
+		}
+	}
+}
+
+func TestContextForChannel(t *testing.T) {
+	var wg sync.WaitGroup
+	parentCh := make(chan struct{})
+	done := make(chan struct{})
+
+	for i := 0; i < 3; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			ctx := ContextForChannel(parentCh)
+			<-ctx.Done()
+		}()
+	}
+
+	go func() {
+		wg.Wait()
+		close(done)
+	}()
+
+	// Closing parent channel should cancel all children contexts
+	close(parentCh)
+
+	select {
+	case <-done:
+	case <-time.After(ForeverTestTimeout):
+		t.Errorf("unexpected timeout waiting for parent to cancel child contexts")
+	}
+}
+
+func TestExponentialBackoffManagerGetNextBackoff(t *testing.T) {
+	fc := testingclock.NewFakeClock(time.Now())
+	backoff := NewExponentialBackoffManager(1, 10, 10, 2.0, 0.0, fc)
+	durations := []time.Duration{1, 2, 4, 8, 10, 10, 10}
+	for i := 0; i < len(durations); i++ {
+		generatedBackoff := backoff.(*exponentialBackoffManagerImpl).getNextBackoff()
+		if generatedBackoff != durations[i] {
+			t.Errorf("unexpected %d-th backoff: %d, expecting %d", i, generatedBackoff, durations[i])
+		}
+	}
+
+	fc.Step(11)
+	resetDuration := backoff.(*exponentialBackoffManagerImpl).getNextBackoff()
+	if resetDuration != 1 {
+		t.Errorf("after reset, backoff should be 1, but got %d", resetDuration)
+	}
+}
+
+func TestJitteredBackoffManagerGetNextBackoff(t *testing.T) {
+	// positive jitter
+	backoffMgr := NewJitteredBackoffManager(1, 1, testingclock.NewFakeClock(time.Now()))
+	for i := 0; i < 5; i++ {
+		backoff := backoffMgr.(*jitteredBackoffManagerImpl).getNextBackoff()
+		if backoff < 1 || backoff > 2 {
+			t.Errorf("backoff out of range: %d", backoff)
+		}
+	}
+
+	// negative jitter, shall be a fixed backoff
+	backoffMgr = NewJitteredBackoffManager(1, -1, testingclock.NewFakeClock(time.Now()))
+	backoff := backoffMgr.(*jitteredBackoffManagerImpl).getNextBackoff()
+	if backoff != 1 {
+		t.Errorf("backoff should be 1, but got %d", backoff)
+	}
+}
+
+func TestJitterBackoffManagerWithRealClock(t *testing.T) {
+	backoffMgr := NewJitteredBackoffManager(1*time.Millisecond, 0, &clock.RealClock{})
+	for i := 0; i < 5; i++ {
+		start := time.Now()
+		<-backoffMgr.Backoff().C()
+		passed := time.Since(start)
+		if passed < 1*time.Millisecond {
+			t.Errorf("backoff should be at least 1ms, but got %s", passed.String())
+		}
+	}
+}
+
+func TestExponentialBackoffManagerWithRealClock(t *testing.T) {
+	// backoff at least 1ms, 2ms, 4ms, 8ms, 10ms, 10ms, 10ms
+	durationFactors := []time.Duration{1, 2, 4, 8, 10, 10, 10}
+	backoffMgr := NewExponentialBackoffManager(1*time.Millisecond, 10*time.Millisecond, 1*time.Hour, 2.0, 0.0, &clock.RealClock{})
+
+	for i := range durationFactors {
+		start := time.Now()
+		<-backoffMgr.Backoff().C()
+		passed := time.Since(start)
+		if passed < durationFactors[i]*time.Millisecond {
+			t.Errorf("backoff should be at least %d ms, but got %s", durationFactors[i], passed.String())
+		}
+	}
+}
+
+func TestBackoffDelayWithResetExponential(t *testing.T) {
+	fc := testingclock.NewFakeClock(time.Now())
+	backoff := Backoff{Duration: 1, Cap: 10, Factor: 2.0, Jitter: 0.0, Steps: 10}.DelayWithReset(fc, 10)
+	durations := []time.Duration{1, 2, 4, 8, 10, 10, 10}
+	for i := 0; i < len(durations); i++ {
+		generatedBackoff := backoff()
+		if generatedBackoff != durations[i] {
+			t.Errorf("unexpected %d-th backoff: %d, expecting %d", i, generatedBackoff, durations[i])
+		}
+	}
+
+	fc.Step(11)
+	resetDuration := backoff()
+	if resetDuration != 1 {
+		t.Errorf("after reset, backoff should be 1, but got %d", resetDuration)
+	}
+}
+
+func TestBackoffDelayWithResetEmpty(t *testing.T) {
+	fc := testingclock.NewFakeClock(time.Now())
+	backoff := Backoff{Duration: 1, Cap: 10, Factor: 2.0, Jitter: 0.0, Steps: 10}.DelayWithReset(fc, 0)
+	// we reset to initial duration because the resetInterval is 0, immediate
+	durations := []time.Duration{1, 1, 1, 1, 1, 1, 1}
+	for i := 0; i < len(durations); i++ {
+		generatedBackoff := backoff()
+		if generatedBackoff != durations[i] {
+			t.Errorf("unexpected %d-th backoff: %d, expecting %d", i, generatedBackoff, durations[i])
+		}
+	}
+
+	fc.Step(11)
+	resetDuration := backoff()
+	if resetDuration != 1 {
+		t.Errorf("after reset, backoff should be 1, but got %d", resetDuration)
+	}
+}
+
+func TestBackoffDelayWithResetJitter(t *testing.T) {
+	// positive jitter
+	backoff := Backoff{Duration: 1, Jitter: 1}.DelayWithReset(testingclock.NewFakeClock(time.Now()), 0)
+	for i := 0; i < 5; i++ {
+		value := backoff()
+		if value < 1 || value > 2 {
+			t.Errorf("backoff out of range: %d", value)
+		}
+	}
+
+	// negative jitter, shall be a fixed backoff
+	backoff = Backoff{Duration: 1, Jitter: -1}.DelayWithReset(testingclock.NewFakeClock(time.Now()), 0)
+	value := backoff()
+	if value != 1 {
+		t.Errorf("backoff should be 1, but got %d", value)
+	}
+}
+
+func TestBackoffDelayWithResetWithRealClockJitter(t *testing.T) {
+	backoff := Backoff{Duration: 1 * time.Millisecond, Jitter: 0}.DelayWithReset(&clock.RealClock{}, 0)
+	for i := 0; i < 5; i++ {
+		start := time.Now()
+		<-RealTimer(backoff()).C()
+		passed := time.Since(start)
+		if passed < 1*time.Millisecond {
+			t.Errorf("backoff should be at least 1ms, but got %s", passed.String())
+		}
+	}
+}
+
+func TestBackoffDelayWithResetWithRealClockExponential(t *testing.T) {
+	// backoff at least 1ms, 2ms, 4ms, 8ms, 10ms, 10ms, 10ms
+	durationFactors := []time.Duration{1, 2, 4, 8, 10, 10, 10}
+	backoff := Backoff{Duration: 1 * time.Millisecond, Cap: 10 * time.Millisecond, Factor: 2.0, Jitter: 0.0, Steps: 10}.DelayWithReset(&clock.RealClock{}, 1*time.Hour)
+
+	for i := range durationFactors {
+		start := time.Now()
+		<-RealTimer(backoff()).C()
+		passed := time.Since(start)
+		if passed < durationFactors[i]*time.Millisecond {
+			t.Errorf("backoff should be at least %d ms, but got %s", durationFactors[i], passed.String())
+		}
+	}
+}
+
+func defaultContext() (context.Context, context.CancelFunc) {
+	return context.WithCancel(context.Background())
+}
+func cancelledContext() (context.Context, context.CancelFunc) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	return ctx, cancel
+}
+func deadlinedContext() (context.Context, context.CancelFunc) {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Millisecond)
+	for ctx.Err() != context.DeadlineExceeded {
+		time.Sleep(501 * time.Microsecond)
+	}
+	return ctx, cancel
+}
+
+func TestExponentialBackoffWithContext(t *testing.T) {
+	defaultCallback := func(_ int) (bool, error) {
+		return false, nil
+	}
+
+	conditionErr := errors.New("condition failed")
+
+	tests := []struct {
+		name               string
+		steps              int
+		zeroDuration       bool
+		context            func() (context.Context, context.CancelFunc)
+		callback           func(calls int) (bool, error)
+		cancelContextAfter int
+		attemptsExpected   int
+		errExpected        error
+	}{
+		{
+			name:             "no attempts expected with zero backoff steps",
+			steps:            0,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:             "condition returns false with single backoff step",
+			steps:            1,
+			callback:         defaultCallback,
+			attemptsExpected: 1,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:  "condition returns true with single backoff step",
+			steps: 1,
+			callback: func(_ int) (bool, error) {
+				return true, nil
+			},
+			attemptsExpected: 1,
+			errExpected:      nil,
+		},
+		{
+			name:             "condition always returns false with multiple backoff steps",
+			steps:            5,
+			callback:         defaultCallback,
+			attemptsExpected: 5,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:  "condition returns true after certain attempts with multiple backoff steps",
+			steps: 5,
+			callback: func(attempts int) (bool, error) {
+				if attempts == 3 {
+					return true, nil
+				}
+				return false, nil
+			},
+			attemptsExpected: 3,
+			errExpected:      nil,
+		},
+		{
+			name:  "condition returns error no further attempts expected",
+			steps: 5,
+			callback: func(_ int) (bool, error) {
+				return true, conditionErr
+			},
+			attemptsExpected: 1,
+			errExpected:      conditionErr,
+		},
+		{
+			name:             "context already canceled no attempts expected",
+			steps:            5,
+			context:          cancelledContext,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      context.Canceled,
+		},
+		{
+			name:             "context at deadline no attempts expected",
+			steps:            5,
+			context:          deadlinedContext,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      context.DeadlineExceeded,
+		},
+		{
+			name:             "no attempts expected with zero backoff steps",
+			steps:            0,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:             "condition returns false with single backoff step",
+			steps:            1,
+			callback:         defaultCallback,
+			attemptsExpected: 1,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:  "condition returns true with single backoff step",
+			steps: 1,
+			callback: func(_ int) (bool, error) {
+				return true, nil
+			},
+			attemptsExpected: 1,
+			errExpected:      nil,
+		},
+		{
+			name:               "condition always returns false with multiple backoff steps but is cancelled at step 4",
+			steps:              5,
+			callback:           defaultCallback,
+			attemptsExpected:   4,
+			cancelContextAfter: 4,
+			errExpected:        context.Canceled,
+		},
+		{
+			name:         "condition returns true after certain attempts with multiple backoff steps and zero duration",
+			steps:        5,
+			zeroDuration: true,
+			callback: func(attempts int) (bool, error) {
+				if attempts == 3 {
+					return true, nil
+				}
+				return false, nil
+			},
+			attemptsExpected: 3,
+			errExpected:      nil,
+		},
+		{
+			name:  "condition returns error no further attempts expected",
+			steps: 5,
+			callback: func(_ int) (bool, error) {
+				return true, conditionErr
+			},
+			attemptsExpected: 1,
+			errExpected:      conditionErr,
+		},
+		{
+			name:             "context already canceled no attempts expected",
+			steps:            5,
+			context:          cancelledContext,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      context.Canceled,
+		},
+		{
+			name:             "context at deadline no attempts expected",
+			steps:            5,
+			context:          deadlinedContext,
+			callback:         defaultCallback,
+			attemptsExpected: 0,
+			errExpected:      context.DeadlineExceeded,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			backoff := Backoff{
+				Duration: 1 * time.Microsecond,
+				Factor:   1.0,
+				Steps:    test.steps,
+			}
+			if test.zeroDuration {
+				backoff.Duration = 0
+			}
+
+			contextFn := test.context
+			if contextFn == nil {
+				contextFn = defaultContext
+			}
+			ctx, cancel := contextFn()
+			defer cancel()
+
+			attempts := 0
+			err := ExponentialBackoffWithContext(ctx, backoff, func(_ context.Context) (bool, error) {
+				attempts++
+				defer func() {
+					if test.cancelContextAfter > 0 && test.cancelContextAfter == attempts {
+						cancel()
+					}
+				}()
+				return test.callback(attempts)
+			})
+
+			if test.errExpected != err {
+				t.Errorf("expected error: %v but got: %v", test.errExpected, err)
+			}
+
+			if test.attemptsExpected != attempts {
+				t.Errorf("expected attempts count: %d but got: %d", test.attemptsExpected, attempts)
+			}
+		})
+	}
+}
+
+func BenchmarkExponentialBackoffWithContext(b *testing.B) {
+	backoff := Backoff{
+		Duration: 0,
+		Factor:   0,
+		Steps:    101,
+	}
+	ctx := context.Background()
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		attempts := 0
+		if err := ExponentialBackoffWithContext(ctx, backoff, func(_ context.Context) (bool, error) {
+			attempts++
+			return attempts >= 100, nil
+		}); err != nil {
+			b.Fatalf("unexpected err: %v", err)
+		}
+	}
+}
+
+func TestPollImmediateUntilWithContext(t *testing.T) {
+	fakeErr := errors.New("my error")
+	tests := []struct {
+		name                         string
+		condition                    func(int) ConditionWithContextFunc
+		context                      func() (context.Context, context.CancelFunc)
+		cancelContextAfterNthAttempt int
+		errExpected                  error
+		attemptsExpected             int
+	}{
+		{
+			name: "condition throws error on immediate attempt, no retry is attempted",
+			condition: func(int) ConditionWithContextFunc {
+				return func(context.Context) (done bool, err error) {
+					return false, fakeErr
+				}
+			},
+			errExpected:      fakeErr,
+			attemptsExpected: 1,
+		},
+		{
+			name: "condition returns done=true on immediate attempt, no retry is attempted",
+			condition: func(int) ConditionWithContextFunc {
+				return func(context.Context) (done bool, err error) {
+					return true, nil
+				}
+			},
+			errExpected:      nil,
+			attemptsExpected: 1,
+		},
+		{
+			name: "condition returns done=false on immediate attempt, context is already cancelled, no retry is attempted",
+			condition: func(int) ConditionWithContextFunc {
+				return func(context.Context) (done bool, err error) {
+					return false, nil
+				}
+			},
+			context:          cancelledContext,
+			errExpected:      ErrWaitTimeout, // this should be context.Canceled but that would break callers that assume all errors are ErrWaitTimeout
+			attemptsExpected: 1,
+		},
+		{
+			name: "condition returns done=false on immediate attempt, context is not cancelled, retry is attempted",
+			condition: func(attempts int) ConditionWithContextFunc {
+				return func(context.Context) (done bool, err error) {
+					// let first 3 attempts fail and the last one succeed
+					if attempts <= 3 {
+						return false, nil
+					}
+					return true, nil
+				}
+			},
+			errExpected:      nil,
+			attemptsExpected: 4,
+		},
+		{
+			name: "condition always returns done=false, context gets cancelled after N attempts",
+			condition: func(attempts int) ConditionWithContextFunc {
+				return func(ctx context.Context) (done bool, err error) {
+					return false, nil
+				}
+			},
+			cancelContextAfterNthAttempt: 4,
+			errExpected:                  ErrWaitTimeout, // this should be context.Canceled, but this method cannot change
+			attemptsExpected:             4,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			contextFn := test.context
+			if contextFn == nil {
+				contextFn = defaultContext
+			}
+			ctx, cancel := contextFn()
+			defer cancel()
+
+			var attempts int
+			conditionWrapper := func(ctx context.Context) (done bool, err error) {
+				attempts++
+				defer func() {
+					if test.cancelContextAfterNthAttempt == attempts {
+						cancel()
+					}
+				}()
+
+				c := test.condition(attempts)
+				return c(ctx)
+			}
+
+			err := PollImmediateUntilWithContext(ctx, time.Millisecond, conditionWrapper)
+			if test.errExpected != err {
+				t.Errorf("Expected error: %v, but got: %v", test.errExpected, err)
+			}
+			if test.attemptsExpected != attempts {
+				t.Errorf("Expected ConditionFunc to be invoked: %d times, but got: %d", test.attemptsExpected, attempts)
+			}
+		})
+	}
+}
+
+func Test_waitForWithContext(t *testing.T) {
+	fakeErr := errors.New("fake error")
+	tests := []struct {
+		name             string
+		context          func() (context.Context, context.CancelFunc)
+		condition        ConditionWithContextFunc
+		waitFunc         func() waitFunc
+		attemptsExpected int
+		errExpected      error
+	}{
+		{
+			name:    "condition returns done=true on first attempt, no retry is attempted",
+			context: defaultContext,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return true, nil
+			}),
+			waitFunc:         func() waitFunc { return fakeTicker(2, nil, func() {}) },
+			attemptsExpected: 1,
+			errExpected:      nil,
+		},
+		{
+			name:    "condition always returns done=false, timeout error expected",
+			context: defaultContext,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc: func() waitFunc { return fakeTicker(2, nil, func() {}) },
+			// the contract of waitForWithContext() says the func is called once more at the end of the wait
+			attemptsExpected: 3,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:    "condition returns an error on first attempt, the error is returned",
+			context: defaultContext,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, fakeErr
+			}),
+			waitFunc:         func() waitFunc { return fakeTicker(2, nil, func() {}) },
+			attemptsExpected: 1,
+			errExpected:      fakeErr,
+		},
+		{
+			name:    "context is cancelled, context cancelled error expected",
+			context: cancelledContext,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc: func() waitFunc {
+				return func(done <-chan struct{}) <-chan struct{} {
+					ch := make(chan struct{})
+					// never tick on this channel
+					return ch
+				}
+			},
+			attemptsExpected: 0,
+			errExpected:      ErrWaitTimeout,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			var attempts int
+			conditionWrapper := func(ctx context.Context) (done bool, err error) {
+				attempts++
+				return test.condition(ctx)
+			}
+
+			ticker := test.waitFunc()
+			err := func() error {
+				contextFn := test.context
+				if contextFn == nil {
+					contextFn = defaultContext
+				}
+				ctx, cancel := contextFn()
+				defer cancel()
+
+				return waitForWithContext(ctx, ticker.WithContext(), conditionWrapper)
+			}()
+
+			if test.errExpected != err {
+				t.Errorf("Expected error: %v, but got: %v", test.errExpected, err)
+			}
+			if test.attemptsExpected != attempts {
+				t.Errorf("Expected %d invocations, got %d", test.attemptsExpected, attempts)
+			}
+		})
+	}
+}
+
+func Test_poll(t *testing.T) {
+	fakeErr := errors.New("fake error")
+	tests := []struct {
+		name               string
+		context            func() (context.Context, context.CancelFunc)
+		immediate          bool
+		waitFunc           func() waitFunc
+		condition          ConditionWithContextFunc
+		cancelContextAfter int
+		attemptsExpected   int
+		errExpected        error
+	}{
+		{
+			name:      "immediate is true, condition returns an error",
+			immediate: true,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, fakeErr
+			}),
+			waitFunc:         nil,
+			attemptsExpected: 1,
+			errExpected:      fakeErr,
+		},
+		{
+			name:      "immediate is true, condition returns true",
+			immediate: true,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return true, nil
+			}),
+			waitFunc:         nil,
+			attemptsExpected: 1,
+			errExpected:      nil,
+		},
+		{
+			name:      "immediate is true, context is cancelled, condition return false",
+			immediate: true,
+			context:   cancelledContext,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc:         nil,
+			attemptsExpected: 1,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:      "immediate is false, context is cancelled",
+			immediate: false,
+			context:   cancelledContext,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc:         nil,
+			attemptsExpected: 0,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:      "immediate is false, condition returns an error",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, fakeErr
+			}),
+			waitFunc:         func() waitFunc { return fakeTicker(5, nil, func() {}) },
+			attemptsExpected: 1,
+			errExpected:      fakeErr,
+		},
+		{
+			name:      "immediate is false, condition returns true",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return true, nil
+			}),
+			waitFunc:         func() waitFunc { return fakeTicker(5, nil, func() {}) },
+			attemptsExpected: 1,
+			errExpected:      nil,
+		},
+		{
+			name:      "immediate is false, ticker channel is closed, condition returns true",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return true, nil
+			}),
+			waitFunc: func() waitFunc {
+				return func(done <-chan struct{}) <-chan struct{} {
+					ch := make(chan struct{})
+					close(ch)
+					return ch
+				}
+			},
+			attemptsExpected: 1,
+			errExpected:      nil,
+		},
+		{
+			name:      "immediate is false, ticker channel is closed, condition returns error",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, fakeErr
+			}),
+			waitFunc: func() waitFunc {
+				return func(done <-chan struct{}) <-chan struct{} {
+					ch := make(chan struct{})
+					close(ch)
+					return ch
+				}
+			},
+			attemptsExpected: 1,
+			errExpected:      fakeErr,
+		},
+		{
+			name:      "immediate is false, ticker channel is closed, condition returns false",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc: func() waitFunc {
+				return func(done <-chan struct{}) <-chan struct{} {
+					ch := make(chan struct{})
+					close(ch)
+					return ch
+				}
+			},
+			attemptsExpected: 1,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:      "condition always returns false, timeout error expected",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc: func() waitFunc { return fakeTicker(2, nil, func() {}) },
+			// the contract of waitForWithContext() says the func is called once more at the end of the wait
+			attemptsExpected: 3,
+			errExpected:      ErrWaitTimeout,
+		},
+		{
+			name:      "context is cancelled after N attempts, timeout error expected",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc: func() waitFunc {
+				return func(done <-chan struct{}) <-chan struct{} {
+					ch := make(chan struct{})
+					// just tick twice
+					go func() {
+						ch <- struct{}{}
+						ch <- struct{}{}
+					}()
+					return ch
+				}
+			},
+			cancelContextAfter: 2,
+			attemptsExpected:   2,
+			errExpected:        ErrWaitTimeout,
+		},
+		{
+			name:      "context is cancelled after N attempts, context error not expected (legacy behavior)",
+			immediate: false,
+			condition: ConditionWithContextFunc(func(context.Context) (bool, error) {
+				return false, nil
+			}),
+			waitFunc: func() waitFunc {
+				return func(done <-chan struct{}) <-chan struct{} {
+					ch := make(chan struct{})
+					// just tick twice
+					go func() {
+						ch <- struct{}{}
+						ch <- struct{}{}
+					}()
+					return ch
+				}
+			},
+			cancelContextAfter: 2,
+			attemptsExpected:   2,
+			errExpected:        ErrWaitTimeout,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			var attempts int
+			ticker := waitFunc(func(done <-chan struct{}) <-chan struct{} {
+				return nil
+			})
+			if test.waitFunc != nil {
+				ticker = test.waitFunc()
+			}
+			err := func() error {
+				contextFn := test.context
+				if contextFn == nil {
+					contextFn = defaultContext
+				}
+				ctx, cancel := contextFn()
+				defer cancel()
+
+				conditionWrapper := func(ctx context.Context) (done bool, err error) {
+					attempts++
+
+					defer func() {
+						if test.cancelContextAfter == attempts {
+							cancel()
+						}
+					}()
+
+					return test.condition(ctx)
+				}
+
+				return poll(ctx, test.immediate, ticker.WithContext(), conditionWrapper)
+			}()
+
+			if test.errExpected != err {
+				t.Errorf("Expected error: %v, but got: %v", test.errExpected, err)
+			}
+			if test.attemptsExpected != attempts {
+				t.Errorf("Expected %d invocations, got %d", test.attemptsExpected, attempts)
+			}
+		})
+	}
+}
+
+func Benchmark_poll(b *testing.B) {
+	ctx := context.Background()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		attempts := 0
+		if err := poll(ctx, true, poller(time.Microsecond, 0), func(_ context.Context) (bool, error) {
+			attempts++
+			return attempts >= 100, nil
+		}); err != nil {
+			b.Fatalf("unexpected err: %v", err)
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/waitgroup/doc.go b/third_party/k8s.io/apimachinery/pkg/util/waitgroup/doc.go
new file mode 100644
index 0000000000..6eb7903a73
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/waitgroup/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package waitgroup implements SafeWaitGroup wrap of sync.WaitGroup.
+// Add with positive delta when waiting will fail, to prevent sync.WaitGroup race issue.
+package waitgroup
diff --git a/third_party/k8s.io/apimachinery/pkg/util/waitgroup/ratelimited_waitgroup.go b/third_party/k8s.io/apimachinery/pkg/util/waitgroup/ratelimited_waitgroup.go
new file mode 100644
index 0000000000..8766390fc2
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/waitgroup/ratelimited_waitgroup.go
@@ -0,0 +1,134 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package waitgroup
+
+import (
+	"context"
+	"fmt"
+	"sync"
+)
+
+// RateLimiter abstracts the rate limiter used by RateLimitedSafeWaitGroup.
+// The implementation must be thread-safe.
+type RateLimiter interface {
+	Wait(ctx context.Context) error
+}
+
+// RateLimiterFactoryFunc is used by the RateLimitedSafeWaitGroup to create a new
+// instance of a RateLimiter that will be used to rate limit the return rate
+// of the active number of request(s). 'count' is the number of requests in
+// flight that are expected to invoke 'Done' on this wait group.
+type RateLimiterFactoryFunc func(count int) (RateLimiter, context.Context, context.CancelFunc)
+
+// RateLimitedSafeWaitGroup must not be copied after first use.
+type RateLimitedSafeWaitGroup struct {
+	wg sync.WaitGroup
+	// Once Wait is initiated, all consecutive Done invocation will be
+	// rate limited using this rate limiter.
+	limiter RateLimiter
+	stopCtx context.Context
+
+	mu sync.Mutex
+	// wait indicate whether Wait is called, if true,
+	// then any Add with positive delta will return error.
+	wait bool
+	// number of request(s) currently using the wait group
+	count int
+}
+
+// Add adds delta, which may be negative, similar to sync.WaitGroup.
+// If Add with a positive delta happens after Wait, it will return error,
+// which prevent unsafe Add.
+func (wg *RateLimitedSafeWaitGroup) Add(delta int) error {
+	wg.mu.Lock()
+	defer wg.mu.Unlock()
+
+	if wg.wait && delta > 0 {
+		return fmt.Errorf("add with positive delta after Wait is forbidden")
+	}
+	wg.wg.Add(delta)
+	wg.count += delta
+	return nil
+}
+
+// Done decrements the WaitGroup counter, rate limiting is applied only
+// when the wait group is in waiting mode.
+func (wg *RateLimitedSafeWaitGroup) Done() {
+	var limiter RateLimiter
+	func() {
+		wg.mu.Lock()
+		defer wg.mu.Unlock()
+
+		wg.count -= 1
+		if wg.wait {
+			// we are using the limiter outside the scope of the lock
+			limiter = wg.limiter
+		}
+	}()
+
+	defer wg.wg.Done()
+	if limiter != nil {
+		limiter.Wait(wg.stopCtx)
+	}
+}
+
+// Wait blocks until the WaitGroup counter is zero or a hard limit has elapsed.
+// It returns the number of active request(s) accounted for at the time Wait
+// has been invoked, number of request(s) that have drianed (done using the
+// wait group immediately before Wait returns).
+// Ideally, the both numbers returned should be equal, to indicate that all
+// request(s) using the wait group have released their lock.
+func (wg *RateLimitedSafeWaitGroup) Wait(limiterFactory RateLimiterFactoryFunc) (int, int, error) {
+	if limiterFactory == nil {
+		return 0, 0, fmt.Errorf("rate limiter factory must be specified")
+	}
+
+	var cancel context.CancelFunc
+	var countNow, countAfter int
+	func() {
+		wg.mu.Lock()
+		defer wg.mu.Unlock()
+
+		wg.limiter, wg.stopCtx, cancel = limiterFactory(wg.count)
+		countNow = wg.count
+		wg.wait = true
+	}()
+
+	defer cancel()
+	// there should be a hard stop, in case request(s) are not responsive
+	// enough to invoke Done before the grace period is over.
+	waitDoneCh := make(chan struct{})
+	go func() {
+		defer close(waitDoneCh)
+		wg.wg.Wait()
+	}()
+
+	var err error
+	select {
+	case <-wg.stopCtx.Done():
+		err = wg.stopCtx.Err()
+	case <-waitDoneCh:
+	}
+
+	func() {
+		wg.mu.Lock()
+		defer wg.mu.Unlock()
+
+		countAfter = wg.count
+	}()
+	return countNow, countAfter, err
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/waitgroup/ratelimited_waitgroup_test.go b/third_party/k8s.io/apimachinery/pkg/util/waitgroup/ratelimited_waitgroup_test.go
new file mode 100644
index 0000000000..dcaefe44a4
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/waitgroup/ratelimited_waitgroup_test.go
@@ -0,0 +1,320 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package waitgroup
+
+import (
+	"context"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"golang.org/x/time/rate"
+	"k8s.io/apimachinery/pkg/util/wait"
+)
+
+func TestRateLimitedSafeWaitGroup(t *testing.T) {
+	// we want to keep track of how many times rate limiter Wait method is
+	// being invoked, both before and after the wait group is in waiting mode.
+	limiter := &limiterWrapper{}
+
+	// we expect the context passed by the factory to be used
+	var cancelInvoked int
+	factory := &factory{
+		limiter: limiter,
+		grace:   2 * time.Second,
+		ctx:     context.Background(),
+		cancel: func() {
+			cancelInvoked++
+		},
+	}
+	target := &rateLimitedSafeWaitGroupWrapper{
+		RateLimitedSafeWaitGroup: &RateLimitedSafeWaitGroup{limiter: limiter},
+	}
+
+	// two set of requests
+	//  - n1: this set will finish using this waitgroup before Wait is invoked
+	//  - n2: this set will be in flight after Wait is invoked
+	n1, n2 := 100, 101
+
+	// so we know when all requests in n1 are done using the waitgroup
+	n1DoneWG := sync.WaitGroup{}
+
+	// so we know when all requests in n2 have called Add,
+	// but not finished with the waitgroup yet.
+	// this will allow the test to invoke 'Wait' once all requests
+	// in n2 have called `Add`, but none has called `Done` yet.
+	n2BeforeWaitWG := sync.WaitGroup{}
+	// so we know when all requests in n2 have called Done and
+	// are finished using the waitgroup
+	n2DoneWG := sync.WaitGroup{}
+
+	startCh, blockedCh := make(chan struct{}), make(chan struct{})
+	n1DoneWG.Add(n1)
+	for i := 0; i < n1; i++ {
+		go func() {
+			defer n1DoneWG.Done()
+			<-startCh
+
+			target.Add(1)
+			// let's finish using the waitgroup immediately
+			target.Done()
+		}()
+	}
+
+	n2BeforeWaitWG.Add(n2)
+	n2DoneWG.Add(n2)
+	for i := 0; i < n2; i++ {
+		go func() {
+			func() {
+				defer n2BeforeWaitWG.Done()
+				<-startCh
+
+				target.Add(1)
+			}()
+
+			func() {
+				defer n2DoneWG.Done()
+				// let's wait for the test to instruct the requests in n2
+				// that it is time to finish using the waitgroup.
+				<-blockedCh
+
+				target.Done()
+			}()
+		}()
+	}
+
+	// initially the count should be zero
+	if count := target.Count(); count != 0 {
+		t.Errorf("expected count to be zero, but got: %d", count)
+	}
+	// start the test
+	close(startCh)
+	// wait for the first set of requests (n1) to be done
+	n1DoneWG.Wait()
+
+	// after the first set of requests (n1) are done, the count should be zero
+	if invoked := limiter.invoked(); invoked != 0 {
+		t.Errorf("expected no call to rate limiter before Wait is called, but got: %d", invoked)
+	}
+
+	// make sure all requetss in the second group (n2) have started using the
+	// waitgroup (Add invoked) but no request is done using the waitgroup yet.
+	n2BeforeWaitWG.Wait()
+
+	// count should be n2, since every request in n2 is still using the waitgroup
+	if count := target.Count(); count != n2 {
+		t.Errorf("expected count to be: %d, but got: %d", n2, count)
+	}
+
+	// time for us to mark the waitgroup as `Waiting`
+	waitDoneCh := make(chan waitResult)
+	go func() {
+		factory.grace = 2 * time.Second
+		before, after, err := target.Wait(factory.NewRateLimiter)
+		waitDoneCh <- waitResult{before: before, after: after, err: err}
+	}()
+
+	// make sure there is no flake in the test due to this race condition
+	var waitingGot bool
+	wait.PollImmediate(500*time.Millisecond, wait.ForeverTestTimeout, func() (done bool, err error) {
+		if waiting := target.Waiting(); waiting {
+			waitingGot = true
+			return true, nil
+		}
+		return false, nil
+	})
+	// verify that the waitgroup is in 'Waiting' mode
+	if !waitingGot {
+		t.Errorf("expected to be in waiting")
+	}
+
+	// we should not allow any new request to use this waitgroup any longer
+	if err := target.Add(1); err == nil ||
+		!strings.Contains(err.Error(), "add with positive delta after Wait is forbidden") {
+		t.Errorf("expected Add to return error while in waiting mode: %v", err)
+	}
+
+	// make sure that RateLimitedSafeWaitGroup passes the right
+	// request count to the limiter factory.
+	if factory.countGot != n2 {
+		t.Errorf("expected count passed to factory to be: %d, but got: %d", n2, factory.countGot)
+	}
+
+	// indicate to all requests (each request in n2) that are
+	// currently using this waitgroup that they can go ahead
+	// and invoke 'Done' to finish using this waitgroup.
+	close(blockedCh)
+	n2DoneWG.Wait()
+
+	if invoked := limiter.invoked(); invoked != n2 {
+		t.Errorf("expected rate limiter to be called %d times, but got: %d", n2, invoked)
+	}
+
+	waitResult := <-waitDoneCh
+	if count := target.Count(); count != 0 {
+		t.Errorf("expected count to be zero, but got: %d", count)
+	}
+	if waitResult.before != n2 {
+		t.Errorf("expected count before Wait to be: %d, but got: %d", n2, waitResult.before)
+	}
+	if waitResult.after != 0 {
+		t.Errorf("expected count after Wait to be zero, but got: %d", waitResult.after)
+	}
+	if cancelInvoked != 1 {
+		t.Errorf("expected context cancel to be invoked once, but got: %d", cancelInvoked)
+	}
+}
+
+func TestRateLimitedSafeWaitGroupWithHardTimeout(t *testing.T) {
+	target := &rateLimitedSafeWaitGroupWrapper{
+		RateLimitedSafeWaitGroup: &RateLimitedSafeWaitGroup{},
+	}
+	n := 10
+	wg := sync.WaitGroup{}
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func() {
+			defer wg.Done()
+			target.Add(1)
+		}()
+	}
+
+	wg.Wait()
+	if count := target.Count(); count != n {
+		t.Errorf("expected count to be: %d, but got: %d", n, count)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	activeAt, activeNow, err := target.Wait(func(count int) (RateLimiter, context.Context, context.CancelFunc) {
+		return nil, ctx, cancel
+	})
+	if activeAt != n {
+		t.Errorf("expected active at Wait to be: %d, but got: %d", n, activeAt)
+	}
+	if activeNow != n {
+		t.Errorf("expected active after Wait to be: %d, but got: %d", n, activeNow)
+	}
+	if err != context.Canceled {
+		t.Errorf("expected error: %v, but got: %v", context.Canceled, err)
+	}
+}
+
+func TestRateLimitedSafeWaitGroupWithBurstOfOne(t *testing.T) {
+	target := &rateLimitedSafeWaitGroupWrapper{
+		RateLimitedSafeWaitGroup: &RateLimitedSafeWaitGroup{},
+	}
+	n := 200
+	grace := 5 * time.Second
+	wg := sync.WaitGroup{}
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func() {
+			defer wg.Done()
+			target.Add(1)
+		}()
+	}
+	wg.Wait()
+
+	waitingCh := make(chan struct{})
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func() {
+			defer wg.Done()
+
+			<-waitingCh
+			target.Done()
+		}()
+	}
+	defer wg.Wait()
+
+	now := time.Now()
+	t.Logf("Wait starting, N=%d, grace: %s, at: %s", n, grace, now)
+	activeAt, activeNow, err := target.Wait(func(count int) (RateLimiter, context.Context, context.CancelFunc) {
+		defer close(waitingCh)
+		// no deadline in context, Wait will wait forever, we want to measure
+		// how long it takes for the requests to drain.
+		return rate.NewLimiter(rate.Limit(n/int(grace.Seconds())), 1), context.Background(), func() {}
+	})
+	took := time.Since(now)
+	t.Logf("Wait finished, count(before): %d, count(after): %d, took: %s, err: %v", activeAt, activeNow, took, err)
+
+	// in CPU starved environment, the go routines may not finish in time
+	if took > 2*grace {
+		t.Errorf("expected Wait to take: %s, but it took: %s", grace, took)
+	}
+}
+
+type waitResult struct {
+	before, after int
+	err           error
+}
+
+type rateLimitedSafeWaitGroupWrapper struct {
+	*RateLimitedSafeWaitGroup
+}
+
+// used by test only
+func (wg *rateLimitedSafeWaitGroupWrapper) Count() int {
+	wg.mu.Lock()
+	defer wg.mu.Unlock()
+
+	return wg.count
+}
+func (wg *rateLimitedSafeWaitGroupWrapper) Waiting() bool {
+	wg.mu.Lock()
+	defer wg.mu.Unlock()
+
+	return wg.wait
+}
+
+type limiterWrapper struct {
+	delegate RateLimiter
+	lock     sync.Mutex
+	invokedN int
+}
+
+func (w *limiterWrapper) invoked() int {
+	w.lock.Lock()
+	defer w.lock.Unlock()
+	return w.invokedN
+}
+func (w *limiterWrapper) Wait(ctx context.Context) error {
+	w.lock.Lock()
+	w.invokedN++
+	w.lock.Unlock()
+
+	if w.delegate != nil {
+		w.delegate.Wait(ctx)
+	}
+	return nil
+}
+
+type factory struct {
+	limiter  *limiterWrapper
+	grace    time.Duration
+	ctx      context.Context
+	cancel   context.CancelFunc
+	countGot int
+}
+
+func (f *factory) NewRateLimiter(count int) (RateLimiter, context.Context, context.CancelFunc) {
+	f.countGot = count
+	f.limiter.delegate = rate.NewLimiter(rate.Limit(count/int(f.grace.Seconds())), 20)
+	return f.limiter, f.ctx, f.cancel
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/waitgroup/waitgroup.go b/third_party/k8s.io/apimachinery/pkg/util/waitgroup/waitgroup.go
new file mode 100644
index 0000000000..e080a5e92f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/waitgroup/waitgroup.go
@@ -0,0 +1,57 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package waitgroup
+
+import (
+	"fmt"
+	"sync"
+)
+
+// SafeWaitGroup must not be copied after first use.
+type SafeWaitGroup struct {
+	wg sync.WaitGroup
+	mu sync.RWMutex
+	// wait indicate whether Wait is called, if true,
+	// then any Add with positive delta will return error.
+	wait bool
+}
+
+// Add adds delta, which may be negative, similar to sync.WaitGroup.
+// If Add with a positive delta happens after Wait, it will return error,
+// which prevent unsafe Add.
+func (wg *SafeWaitGroup) Add(delta int) error {
+	wg.mu.RLock()
+	defer wg.mu.RUnlock()
+	if wg.wait && delta > 0 {
+		return fmt.Errorf("add with positive delta after Wait is forbidden")
+	}
+	wg.wg.Add(delta)
+	return nil
+}
+
+// Done decrements the WaitGroup counter.
+func (wg *SafeWaitGroup) Done() {
+	wg.wg.Done()
+}
+
+// Wait blocks until the WaitGroup counter is zero.
+func (wg *SafeWaitGroup) Wait() {
+	wg.mu.Lock()
+	wg.wait = true
+	wg.mu.Unlock()
+	wg.wg.Wait()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/waitgroup/waitgroup_test.go b/third_party/k8s.io/apimachinery/pkg/util/waitgroup/waitgroup_test.go
new file mode 100644
index 0000000000..b5b7557b85
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/waitgroup/waitgroup_test.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package waitgroup test cases reference golang sync.WaitGroup https://golang.org/src/sync/waitgroup_test.go.
+package waitgroup
+
+import (
+	"testing"
+)
+
+func TestWaitGroup(t *testing.T) {
+	wg1 := &SafeWaitGroup{}
+	wg2 := &SafeWaitGroup{}
+	n := 16
+	wg1.Add(n)
+	wg2.Add(n)
+	exited := make(chan bool, n)
+	for i := 0; i != n; i++ {
+		go func(i int) {
+			wg1.Done()
+			wg2.Wait()
+			exited <- true
+		}(i)
+	}
+	wg1.Wait()
+	for i := 0; i != n; i++ {
+		select {
+		case <-exited:
+			t.Fatal("SafeWaitGroup released group too soon")
+		default:
+		}
+		wg2.Done()
+	}
+	for i := 0; i != n; i++ {
+		<-exited // Will block if barrier fails to unlock someone.
+	}
+}
+
+func TestWaitGroupAddFail(t *testing.T) {
+	wg := &SafeWaitGroup{}
+	wg.Add(1)
+	wg.Done()
+	wg.Wait()
+	if err := wg.Add(1); err == nil {
+		t.Errorf("Should return error when add positive after Wait")
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/yaml/decoder.go b/third_party/k8s.io/apimachinery/pkg/util/yaml/decoder.go
new file mode 100644
index 0000000000..66bf31eea1
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/yaml/decoder.go
@@ -0,0 +1,485 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+
+	jsonutil "k8s.io/apimachinery/pkg/util/json"
+
+	"sigs.k8s.io/yaml"
+)
+
+// Unmarshal unmarshals the given data
+// If v is a *map[string]interface{}, *[]interface{}, or *interface{} numbers
+// are converted to int64 or float64
+func Unmarshal(data []byte, v interface{}) error {
+	preserveIntFloat := func(d *json.Decoder) *json.Decoder {
+		d.UseNumber()
+		return d
+	}
+	switch v := v.(type) {
+	case *map[string]interface{}:
+		if err := yaml.Unmarshal(data, v, preserveIntFloat); err != nil {
+			return err
+		}
+		return jsonutil.ConvertMapNumbers(*v, 0)
+	case *[]interface{}:
+		if err := yaml.Unmarshal(data, v, preserveIntFloat); err != nil {
+			return err
+		}
+		return jsonutil.ConvertSliceNumbers(*v, 0)
+	case *interface{}:
+		if err := yaml.Unmarshal(data, v, preserveIntFloat); err != nil {
+			return err
+		}
+		return jsonutil.ConvertInterfaceNumbers(v, 0)
+	default:
+		return yaml.Unmarshal(data, v)
+	}
+}
+
+// UnmarshalStrict unmarshals the given data
+// strictly (erroring when there are duplicate fields).
+func UnmarshalStrict(data []byte, v interface{}) error {
+	preserveIntFloat := func(d *json.Decoder) *json.Decoder {
+		d.UseNumber()
+		return d
+	}
+	switch v := v.(type) {
+	case *map[string]interface{}:
+		if err := yaml.UnmarshalStrict(data, v, preserveIntFloat); err != nil {
+			return err
+		}
+		return jsonutil.ConvertMapNumbers(*v, 0)
+	case *[]interface{}:
+		if err := yaml.UnmarshalStrict(data, v, preserveIntFloat); err != nil {
+			return err
+		}
+		return jsonutil.ConvertSliceNumbers(*v, 0)
+	case *interface{}:
+		if err := yaml.UnmarshalStrict(data, v, preserveIntFloat); err != nil {
+			return err
+		}
+		return jsonutil.ConvertInterfaceNumbers(v, 0)
+	default:
+		return yaml.UnmarshalStrict(data, v)
+	}
+}
+
+// ToJSON converts a single YAML document into a JSON document
+// or returns an error. If the document appears to be JSON the
+// YAML decoding path is not used (so that error messages are
+// JSON specific).
+func ToJSON(data []byte) ([]byte, error) {
+	if IsJSONBuffer(data) {
+		return data, nil
+	}
+	return yaml.YAMLToJSON(data)
+}
+
+// YAMLToJSONDecoder decodes YAML documents from an io.Reader by
+// separating individual documents. It first converts the YAML
+// body to JSON, then unmarshals the JSON.
+type YAMLToJSONDecoder struct {
+	reader      Reader
+	inputOffset int
+}
+
+// NewYAMLToJSONDecoder decodes YAML documents from the provided
+// stream in chunks by converting each document (as defined by
+// the YAML spec) into its own chunk, converting it to JSON via
+// yaml.YAMLToJSON, and then passing it to json.Decoder.
+func NewYAMLToJSONDecoder(r io.Reader) *YAMLToJSONDecoder {
+	reader := bufio.NewReader(r)
+	return &YAMLToJSONDecoder{
+		reader: NewYAMLReader(reader),
+	}
+}
+
+// Decode reads a YAML document as JSON from the stream or returns
+// an error. The decoding rules match json.Unmarshal, not
+// yaml.Unmarshal.
+func (d *YAMLToJSONDecoder) Decode(into interface{}) error {
+	bytes, err := d.reader.Read()
+	if err != nil && err != io.EOF { //nolint:errorlint
+		return err
+	}
+
+	if len(bytes) != 0 {
+		err := yaml.Unmarshal(bytes, into)
+		if err != nil {
+			return YAMLSyntaxError{err}
+		}
+	}
+	d.inputOffset += len(bytes)
+	return err
+}
+
+func (d *YAMLToJSONDecoder) InputOffset() int {
+	return d.inputOffset
+}
+
+// YAMLDecoder reads chunks of objects and returns ErrShortBuffer if
+// the data is not sufficient.
+type YAMLDecoder struct {
+	r         io.ReadCloser
+	scanner   *bufio.Scanner
+	remaining []byte
+}
+
+// NewDocumentDecoder decodes YAML documents from the provided
+// stream in chunks by converting each document (as defined by
+// the YAML spec) into its own chunk. io.ErrShortBuffer will be
+// returned if the entire buffer could not be read to assist
+// the caller in framing the chunk.
+func NewDocumentDecoder(r io.ReadCloser) io.ReadCloser {
+	scanner := bufio.NewScanner(r)
+	// the size of initial allocation for buffer 4k
+	buf := make([]byte, 4*1024)
+	// the maximum size used to buffer a token 5M
+	scanner.Buffer(buf, 5*1024*1024)
+	scanner.Split(splitYAMLDocument)
+	return &YAMLDecoder{
+		r:       r,
+		scanner: scanner,
+	}
+}
+
+// Read reads the previous slice into the buffer, or attempts to read
+// the next chunk.
+// TODO: switch to readline approach.
+func (d *YAMLDecoder) Read(data []byte) (n int, err error) {
+	left := len(d.remaining)
+	if left == 0 {
+		// return the next chunk from the stream
+		if !d.scanner.Scan() {
+			err := d.scanner.Err()
+			if err == nil {
+				err = io.EOF
+			}
+			return 0, err
+		}
+		out := d.scanner.Bytes()
+		d.remaining = out
+		left = len(out)
+	}
+
+	// fits within data
+	if left <= len(data) {
+		copy(data, d.remaining)
+		d.remaining = nil
+		return left, nil
+	}
+
+	// caller will need to reread
+	copy(data, d.remaining[:len(data)])
+	d.remaining = d.remaining[len(data):]
+	return len(data), io.ErrShortBuffer
+}
+
+func (d *YAMLDecoder) Close() error {
+	return d.r.Close()
+}
+
+const yamlSeparator = "\n---"
+const separator = "---"
+
+// splitYAMLDocument is a bufio.SplitFunc for splitting YAML streams into individual documents.
+func splitYAMLDocument(data []byte, atEOF bool) (advance int, token []byte, err error) {
+	if atEOF && len(data) == 0 {
+		return 0, nil, nil
+	}
+	sep := len([]byte(yamlSeparator))
+	if i := bytes.Index(data, []byte(yamlSeparator)); i >= 0 {
+		// We have a potential document terminator
+		i += sep
+		after := data[i:]
+		if len(after) == 0 {
+			// we can't read any more characters
+			if atEOF {
+				return len(data), data[:len(data)-sep], nil
+			}
+			return 0, nil, nil
+		}
+		if j := bytes.IndexByte(after, '\n'); j >= 0 {
+			return i + j + 1, data[0 : i-sep], nil
+		}
+		return 0, nil, nil
+	}
+	// If we're at EOF, we have a final, non-terminated line. Return it.
+	if atEOF {
+		return len(data), data, nil
+	}
+	// Request more data.
+	return 0, nil, nil
+}
+
+// YAMLOrJSONDecoder attempts to decode a stream of JSON or YAML documents.
+// While JSON is YAML, the way Go's JSON decode defines a multi-document stream
+// is a series of JSON objects (e.g. {}{}), but YAML defines a multi-document
+// stream as a series of documents separated by "---".
+//
+// This decoder will attempt to decode the stream as JSON first, and if that
+// fails, it will switch to YAML. Once it determines the stream is JSON (by
+// finding a non-YAML-delimited series of objects), it will not switch to YAML.
+// Once it switches to YAML it will not switch back to JSON.
+type YAMLOrJSONDecoder struct {
+	json         *json.Decoder
+	jsonConsumed int64 // of the stream total, how much was JSON?
+	yaml         *YAMLToJSONDecoder
+	yamlConsumed int64 // of the stream total, how much was YAML?
+	stream       *StreamReader
+	count        int // how many objects have been decoded
+}
+
+type JSONSyntaxError struct {
+	Offset int64
+	Err    error
+}
+
+func (e JSONSyntaxError) Error() string {
+	return fmt.Sprintf("json: offset %d: %s", e.Offset, e.Err.Error())
+}
+
+type YAMLSyntaxError struct {
+	err error
+}
+
+func (e YAMLSyntaxError) Error() string {
+	return e.err.Error()
+}
+
+// NewYAMLOrJSONDecoder returns a decoder that will process YAML documents
+// or JSON documents from the given reader as a stream. bufferSize determines
+// how far into the stream the decoder will look to figure out whether this
+// is a JSON stream (has whitespace followed by an open brace).
+func NewYAMLOrJSONDecoder(r io.Reader, bufferSize int) *YAMLOrJSONDecoder {
+	d := &YAMLOrJSONDecoder{}
+
+	reader, _, mightBeJSON := GuessJSONStream(r, bufferSize)
+	d.stream = reader
+	if mightBeJSON {
+		d.json = json.NewDecoder(reader)
+	} else {
+		d.yaml = NewYAMLToJSONDecoder(reader)
+	}
+	return d
+}
+
+// Decode unmarshals the next object from the underlying stream into the
+// provide object, or returns an error.
+func (d *YAMLOrJSONDecoder) Decode(into interface{}) error {
+	// Because we don't know if this is a JSON or YAML stream, a failure from
+	// both decoders is ambiguous. When in doubt, it will return the error from
+	// the JSON decoder.  Unfortunately, this means that if the first document
+	// is invalid YAML, the error won't be awesome.
+	// TODO: the errors from YAML are not great, we could improve them a lot.
+	var firstErr error
+	if d.json != nil {
+		err := d.json.Decode(into)
+		if err == nil {
+			d.count++
+			consumed := d.json.InputOffset() - d.jsonConsumed
+			d.stream.Consume(int(consumed))
+			d.jsonConsumed += consumed
+			return nil
+		}
+		if err == io.EOF { //nolint:errorlint
+			return err
+		}
+		var syntax *json.SyntaxError
+		if ok := errors.As(err, &syntax); ok {
+			firstErr = JSONSyntaxError{
+				Offset: syntax.Offset,
+				Err:    syntax,
+			}
+		} else {
+			firstErr = err
+		}
+		if d.count > 1 {
+			// If we found 0 or 1 JSON object(s), this stream is still
+			// ambiguous.  But if we found more than 1 JSON object, then this
+			// is an unambiguous JSON stream, and we should not switch to YAML.
+			return err
+		}
+		// If JSON decoding hits the end of one object and then fails on the
+		// next, it leaves any leading whitespace in the buffer, which can
+		// confuse the YAML decoder. We just eat any whitespace we find, up to
+		// and including the first newline.
+		d.stream.Rewind()
+		if err := d.consumeWhitespace(); err == nil {
+			d.yaml = NewYAMLToJSONDecoder(d.stream)
+		}
+		d.json = nil
+	}
+	if d.yaml != nil {
+		err := d.yaml.Decode(into)
+		if err == nil {
+			d.count++
+			consumed := int64(d.yaml.InputOffset()) - d.yamlConsumed
+			d.stream.Consume(int(consumed))
+			d.yamlConsumed += consumed
+			return nil
+		}
+		if err == io.EOF { //nolint:errorlint
+			return err
+		}
+		if firstErr == nil {
+			firstErr = err
+		}
+	}
+	if firstErr != nil {
+		return firstErr
+	}
+	return fmt.Errorf("decoding failed as both JSON and YAML")
+}
+
+func (d *YAMLOrJSONDecoder) consumeWhitespace() error {
+	consumed := 0
+	for {
+		buf, err := d.stream.ReadN(4)
+		if err != nil && err == io.EOF { //nolint:errorlint
+			return err
+		}
+		r, sz := utf8.DecodeRune(buf)
+		if r == utf8.RuneError || sz == 0 {
+			return fmt.Errorf("invalid utf8 rune")
+		}
+		d.stream.RewindN(len(buf) - sz)
+		if !unicode.IsSpace(r) {
+			d.stream.RewindN(sz)
+			d.stream.Consume(consumed)
+			return nil
+		}
+		consumed += sz
+		if r == '\n' {
+			d.stream.Consume(consumed)
+			return nil
+		}
+		if err == io.EOF { //nolint:errorlint
+			break
+		}
+	}
+	return io.EOF
+}
+
+type Reader interface {
+	Read() ([]byte, error)
+}
+
+type YAMLReader struct {
+	reader Reader
+}
+
+func NewYAMLReader(r *bufio.Reader) *YAMLReader {
+	return &YAMLReader{
+		reader: &LineReader{reader: r},
+	}
+}
+
+// Read returns a full YAML document.
+func (r *YAMLReader) Read() ([]byte, error) {
+	var buffer bytes.Buffer
+	for {
+		line, err := r.reader.Read()
+		if err != nil && err != io.EOF { //nolint:errorlint
+			return nil, err
+		}
+
+		sep := len([]byte(separator))
+		if i := bytes.Index(line, []byte(separator)); i == 0 {
+			// We have a potential document terminator
+			i += sep
+			trimmed := strings.TrimSpace(string(line[i:]))
+			// We only allow comments and spaces following the yaml doc separator, otherwise we'll return an error
+			if len(trimmed) > 0 && string(trimmed[0]) != "#" {
+				return nil, YAMLSyntaxError{
+					err: fmt.Errorf("invalid Yaml document separator: %s", trimmed),
+				}
+			}
+			if buffer.Len() != 0 {
+				return buffer.Bytes(), nil
+			}
+			if err == io.EOF { //nolint:errorlint
+				return nil, err
+			}
+		}
+		if err == io.EOF { //nolint:errorlint
+			if buffer.Len() != 0 {
+				// If we're at EOF, we have a final, non-terminated line. Return it.
+				return buffer.Bytes(), nil
+			}
+			return nil, err
+		}
+		buffer.Write(line)
+	}
+}
+
+type LineReader struct {
+	reader *bufio.Reader
+}
+
+// Read returns a single line (with '\n' ended) from the underlying reader.
+// An error is returned iff there is an error with the underlying reader.
+func (r *LineReader) Read() ([]byte, error) {
+	var (
+		isPrefix bool  = true
+		err      error = nil
+		line     []byte
+		buffer   bytes.Buffer
+	)
+
+	for isPrefix && err == nil {
+		line, isPrefix, err = r.reader.ReadLine()
+		buffer.Write(line)
+	}
+	buffer.WriteByte('\n')
+	return buffer.Bytes(), err
+}
+
+// GuessJSONStream scans the provided reader up to size, looking
+// for an open brace indicating this is JSON. It will return the
+// bufio.Reader it creates for the consumer.
+func GuessJSONStream(r io.Reader, size int) (*StreamReader, []byte, bool) {
+	buffer := NewStreamReader(r, size)
+	b, _ := buffer.Peek(size)
+	return buffer, b, IsJSONBuffer(b)
+}
+
+// IsJSONBuffer scans the provided buffer, looking
+// for an open brace indicating this is JSON.
+func IsJSONBuffer(buf []byte) bool {
+	return hasPrefix(buf, jsonPrefix)
+}
+
+var jsonPrefix = []byte("{")
+
+// Return true if the first non-whitespace bytes in buf is
+// prefix.
+func hasPrefix(buf []byte, prefix []byte) bool {
+	trim := bytes.TrimLeftFunc(buf, unicode.IsSpace)
+	return bytes.HasPrefix(trim, prefix)
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/yaml/decoder_test.go b/third_party/k8s.io/apimachinery/pkg/util/yaml/decoder_test.go
new file mode 100644
index 0000000000..60a5ec80f4
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/yaml/decoder_test.go
@@ -0,0 +1,559 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"math/rand"
+	"reflect"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+func TestYAMLDecoderReadBytesLength(t *testing.T) {
+	d := `---
+stuff: 1
+	test-foo: 1
+`
+	testCases := []struct {
+		bufLen    int
+		expectLen int
+		expectErr error
+	}{
+		{len(d), len(d), nil},
+		{len(d) + 10, len(d), nil},
+		{len(d) - 10, len(d) - 10, io.ErrShortBuffer},
+	}
+
+	for i, testCase := range testCases {
+		r := NewDocumentDecoder(io.NopCloser(bytes.NewReader([]byte(d))))
+		b := make([]byte, testCase.bufLen)
+		n, err := r.Read(b)
+		if err != testCase.expectErr || n != testCase.expectLen {
+			t.Fatalf("%d: unexpected body: %d / %v", i, n, err)
+		}
+	}
+}
+
+func TestBigYAML(t *testing.T) {
+	d := `
+stuff: 1
+`
+	maxLen := 5 * 1024 * 1024
+	bufferLen := 4 * 1024
+	//  maxLen 5 M
+	dd := strings.Repeat(d, 512*1024)
+	r := NewDocumentDecoder(io.NopCloser(bytes.NewReader([]byte(dd[:maxLen-1]))))
+	b := make([]byte, bufferLen)
+	n, err := r.Read(b)
+	if err != io.ErrShortBuffer {
+		t.Fatalf("expected ErrShortBuffer: %d / %v", n, err)
+	}
+	b = make([]byte, maxLen)
+	n, err = r.Read(b)
+	if err != nil {
+		t.Fatalf("expected nil: %d / %v", n, err)
+	}
+	r = NewDocumentDecoder(io.NopCloser(bytes.NewReader([]byte(dd))))
+	b = make([]byte, maxLen)
+	n, err = r.Read(b)
+	if err != bufio.ErrTooLong {
+		t.Fatalf("bufio.Scanner: token too long: %d / %v", n, err)
+	}
+}
+
+func TestYAMLDecoderCallsAfterErrShortBufferRestOfFrame(t *testing.T) {
+	d := `---
+stuff: 1
+	test-foo: 1`
+	r := NewDocumentDecoder(io.NopCloser(bytes.NewReader([]byte(d))))
+	b := make([]byte, 12)
+	n, err := r.Read(b)
+	if err != io.ErrShortBuffer || n != 12 {
+		t.Fatalf("expected ErrShortBuffer: %d / %v", n, err)
+	}
+	expected := "---\nstuff: 1"
+	if string(b) != expected {
+		t.Fatalf("expected bytes read to be: %s  got: %s", expected, string(b))
+	}
+	b = make([]byte, 13)
+	n, err = r.Read(b)
+	if err != nil || n != 13 {
+		t.Fatalf("expected nil: %d / %v", n, err)
+	}
+	expected = "\n\ttest-foo: 1"
+	if string(b) != expected {
+		t.Fatalf("expected bytes read to be: '%s'  got: '%s'", expected, string(b))
+	}
+	b = make([]byte, 15)
+	n, err = r.Read(b)
+	if err != io.EOF || n != 0 { //nolint:errorlint
+		t.Fatalf("expected EOF: %d / %v", n, err)
+	}
+}
+
+func TestSplitYAMLDocument(t *testing.T) {
+	testCases := []struct {
+		input  string
+		atEOF  bool
+		expect string
+		adv    int
+	}{
+		{"foo", true, "foo", 3},
+		{"fo", false, "", 0},
+
+		{"---", true, "---", 3},
+		{"---\n", true, "---\n", 4},
+		{"---\n", false, "", 0},
+
+		{"\n---\n", false, "", 5},
+		{"\n---\n", true, "", 5},
+
+		{"abc\n---\ndef", true, "abc", 8},
+		{"def", true, "def", 3},
+		{"", true, "", 0},
+	}
+	for i, testCase := range testCases {
+		adv, token, err := splitYAMLDocument([]byte(testCase.input), testCase.atEOF)
+		if err != nil {
+			t.Errorf("%d: unexpected error: %v", i, err)
+			continue
+		}
+		if adv != testCase.adv {
+			t.Errorf("%d: advance did not match: %d %d", i, testCase.adv, adv)
+		}
+		if testCase.expect != string(token) {
+			t.Errorf("%d: token did not match: %q %q", i, testCase.expect, string(token))
+		}
+	}
+}
+
+func TestGuessJSON(t *testing.T) {
+	if r, _, isJSON := GuessJSONStream(bytes.NewReader([]byte(" \n{}")), 100); !isJSON {
+		t.Fatalf("expected stream to be JSON")
+	} else {
+		b := make([]byte, 30)
+		n, err := r.Read(b)
+		if err != nil || n != 4 {
+			t.Fatalf("unexpected body: %d / %v", n, err)
+		}
+		if string(b[:n]) != " \n{}" {
+			t.Fatalf("unexpected body: %q", string(b[:n]))
+		}
+	}
+}
+
+func TestScanYAML(t *testing.T) {
+	s := bufio.NewScanner(bytes.NewReader([]byte(`---
+stuff: 1
+
+---
+  `)))
+	s.Split(splitYAMLDocument)
+	if !s.Scan() {
+		t.Fatalf("should have been able to scan")
+	}
+	t.Logf("scan: %s", s.Text())
+	if !s.Scan() {
+		t.Fatalf("should have been able to scan")
+	}
+	t.Logf("scan: %s", s.Text())
+	if s.Scan() {
+		t.Fatalf("scan should have been done")
+	}
+	if s.Err() != nil {
+		t.Fatalf("err should have been nil: %v", s.Err())
+	}
+}
+
+func TestDecodeYAML(t *testing.T) {
+	s := NewYAMLToJSONDecoder(bytes.NewReader([]byte(`---
+stuff: 1
+
+---   
+  `)))
+	obj := generic{}
+	if err := s.Decode(&obj); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if fmt.Sprintf("%#v", obj) != `yaml.generic{"stuff":1}` {
+		t.Errorf("unexpected object: %#v", obj)
+	}
+	obj = generic{}
+	if err := s.Decode(&obj); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(obj) != 0 {
+		t.Fatalf("unexpected object: %#v", obj)
+	}
+	obj = generic{}
+	if err := s.Decode(&obj); err != io.EOF { //nolint:errorlint
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func TestDecodeYAMLSeparatorValidation(t *testing.T) {
+	s := NewYAMLToJSONDecoder(bytes.NewReader([]byte(`---
+stuff: 1
+---    # Make sure termination happen with inline comment
+stuff: 2
+---
+stuff: 3
+--- Make sure uncommented content results YAMLSyntaxError
+
+ `)))
+	obj := generic{}
+	if err := s.Decode(&obj); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if fmt.Sprintf("%#v", obj) != `yaml.generic{"stuff":1}` {
+		t.Errorf("unexpected object: %#v", obj)
+	}
+	obj = generic{}
+	if err := s.Decode(&obj); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if fmt.Sprintf("%#v", obj) != `yaml.generic{"stuff":2}` {
+		t.Errorf("unexpected object: %#v", obj)
+	}
+	obj = generic{}
+	err := s.Decode(&obj)
+	if err == nil {
+		t.Fatalf("expected YamlSyntaxError, got nil instead")
+	}
+	if _, ok := err.(YAMLSyntaxError); !ok {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func TestDecodeBrokenYAML(t *testing.T) {
+	s := NewYAMLOrJSONDecoder(bytes.NewReader([]byte(`---
+stuff: 1
+		test-foo: 1
+
+---
+  `)), 100)
+	obj := generic{}
+	err := s.Decode(&obj)
+	if err == nil {
+		t.Fatal("expected error with yaml: violate, got no error")
+	}
+	fmt.Printf("err: %s\n", err.Error())
+	if !strings.Contains(err.Error(), "yaml: line 3:") {
+		t.Fatalf("expected %q to have 'yaml: line 3:' found a tab character", err.Error())
+	}
+}
+
+func TestDecodeBrokenJSON(t *testing.T) {
+	s := NewYAMLOrJSONDecoder(bytes.NewReader([]byte(`{
+	"foo": {
+		"stuff": 1
+		"otherStuff": 2
+	}
+}
+  `)), 100)
+	obj := generic{}
+	err := s.Decode(&obj)
+	if err == nil {
+		t.Fatal("expected error with json: prefix, got no error")
+	}
+	const msg = `json: .*invalid character.*".*after object key:value pair`
+	if matched, _ := regexp.MatchString(msg, err.Error()); !matched {
+		t.Fatalf("expected string matching %q, got %q", msg, err.Error())
+	}
+}
+
+type generic map[string]interface{}
+
+func TestYAMLOrJSONDecoder(t *testing.T) {
+	testCases := []struct {
+		input  string
+		buffer int
+		isJSON bool
+		err    bool
+		out    []generic
+	}{
+		{` {"1":2}{"3":4}`, 2, true, false, []generic{
+			{"1": 2},
+			{"3": 4},
+		}},
+		{" \n{}", 3, true, false, []generic{
+			{},
+		}},
+		{" \na: b", 2, false, false, []generic{
+			{"a": "b"},
+		}},
+		{" \n{\"a\": \"b\"}", 2, false, true, []generic{
+			{"a": "b"},
+		}},
+		{" \n{\"a\": \"b\"}", 3, true, false, []generic{
+			{"a": "b"},
+		}},
+		{`   {"a":"b"}`, 100, true, false, []generic{
+			{"a": "b"},
+		}},
+		{"", 1, false, false, []generic{}},
+		{"foo: bar\n---\nbaz: biz", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz"},
+		}},
+		{"---\nfoo: bar\n--- # with Comment\nbaz: biz", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz"},
+		}},
+		// Spaces for indent, tabs are not allowed in YAML.
+		{"foo:\n  field: bar\n---\nbaz:\n  field: biz", 100, false, false, []generic{
+			{"foo": map[string]any{"field": "bar"}},
+			{"baz": map[string]any{"field": "biz"}},
+		}},
+		{"foo: bar\n---\n", 100, false, false, []generic{
+			{"foo": "bar"},
+		}},
+		{"foo: bar\n---", 100, false, false, []generic{
+			{"foo": "bar"},
+		}},
+		{"foo: bar\n--", 100, false, true, []generic{
+			{"foo": "bar"},
+		}},
+		{"foo: bar\n-", 100, false, true, []generic{
+			{"foo": "bar"},
+		}},
+		{"foo: bar\n", 100, false, false, []generic{
+			{"foo": "bar"},
+		}},
+		// First document is JSON, second is YAML
+		{"{\"foo\": \"bar\"}\n---\n{baz: biz}", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz"},
+		}},
+		// First document is JSON, second is YAML but with smaller size.
+		{"{\"foo\": \"bar\"}\n---\na: b", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"a": "b"},
+		}},
+		// First document is JSON, second is YAML,but with smaller size and
+		// trailing whitespace.
+		{"{\"foo\": \"bar\"}    \n---\na: b", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"a": "b"},
+		}},
+		// First document is JSON, second is YAML, longer than the buffer
+		{"{\"foo\": \"bar\"}\n---\n{baz: biz0123456780123456780123456780123456780123456789}", 20, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz0123456780123456780123456780123456780123456789"},
+		}},
+		// First document is JSON, then whitespace, then YAML
+		{"{\"foo\": \"bar\"}    \n---\n{baz: biz}", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz"},
+		}},
+		// First document is YAML, second is JSON
+		{"{foo: bar}\n---\n{\"baz\": \"biz\"}", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz"},
+		}},
+		// First document is JSON, second is YAML, using spaces
+		{"{\n  \"foo\": \"bar\"\n}\n---\n{\n  baz: biz\n}", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz"},
+		}},
+		// First document is JSON, second is YAML, using tabs
+		{"{\n\t\"foo\": \"bar\"\n}\n---\n{\n\tbaz: biz\n}", 100, false, false, []generic{
+			{"foo": "bar"},
+			{"baz": "biz"},
+		}},
+		// First 2 documents are JSON, third is YAML (stream is JSON)
+		{"{\"foo\": \"bar\"}\n{\"baz\": \"biz\"}\n---\n{qux: zrb}", 100, true, true, nil},
+	}
+	for i, testCase := range testCases {
+		decoder := NewYAMLOrJSONDecoder(bytes.NewReader([]byte(testCase.input)), testCase.buffer)
+		objs := []generic{}
+
+		var err error
+		for {
+			out := make(generic)
+			err = decoder.Decode(&out)
+			if err != nil {
+				break
+			}
+			objs = append(objs, out)
+		}
+		if err != io.EOF { //nolint:errorlint
+			switch {
+			case testCase.err && err == nil:
+				t.Errorf("%d: unexpected non-error", i)
+				continue
+			case !testCase.err && err != nil:
+				t.Errorf("%d: unexpected error: %v", i, err)
+				continue
+			case err != nil:
+				continue
+			}
+		}
+		switch {
+		case decoder.yaml != nil:
+			if testCase.isJSON {
+				t.Errorf("%d: expected JSON decoder, got YAML", i)
+			}
+		case decoder.json != nil:
+			if !testCase.isJSON {
+				t.Errorf("%d: expected YAML decoder, got JSON", i)
+			}
+		}
+		if fmt.Sprintf("%#v", testCase.out) != fmt.Sprintf("%#v", objs) {
+			t.Errorf("%d: objects were not equal: \n%#v\n%#v", i, testCase.out, objs)
+		}
+	}
+}
+
+func TestReadSingleLongLine(t *testing.T) {
+	testReadLines(t, []int{128 * 1024})
+}
+
+func TestReadRandomLineLengths(t *testing.T) {
+	minLength := 100
+	maxLength := 96 * 1024
+	maxLines := 100
+
+	lineLengths := make([]int, maxLines)
+	for i := 0; i < maxLines; i++ {
+		lineLengths[i] = rand.Intn(maxLength-minLength) + minLength
+	}
+
+	testReadLines(t, lineLengths)
+}
+
+func testReadLines(t *testing.T, lineLengths []int) {
+	var (
+		lines       [][]byte
+		inputStream []byte
+	)
+	for _, lineLength := range lineLengths {
+		inputLine := make([]byte, lineLength+1)
+		for i := 0; i < lineLength; i++ {
+			char := rand.Intn('z'-'A') + 'A'
+			inputLine[i] = byte(char)
+		}
+		inputLine[len(inputLine)-1] = '\n'
+		lines = append(lines, inputLine)
+	}
+	for _, line := range lines {
+		inputStream = append(inputStream, line...)
+	}
+
+	// init Reader
+	reader := bufio.NewReader(bytes.NewReader(inputStream))
+	lineReader := &LineReader{reader: reader}
+
+	// read lines
+	var readLines [][]byte
+	for range lines {
+		bytes, err := lineReader.Read()
+		if err != nil && err != io.EOF { //nolint:errorlint
+			t.Fatalf("failed to read lines: %v", err)
+		}
+		readLines = append(readLines, bytes)
+	}
+
+	// validate
+	for i := range lines {
+		if len(lines[i]) != len(readLines[i]) {
+			t.Fatalf("expected line length: %d, but got %d", len(lines[i]), len(readLines[i]))
+		}
+		if !reflect.DeepEqual(lines[i], readLines[i]) {
+			t.Fatalf("expected line: %v, but got %v", lines[i], readLines[i])
+		}
+	}
+}
+
+func TestTypedJSONOrYamlErrors(t *testing.T) {
+	s := NewYAMLOrJSONDecoder(bytes.NewReader([]byte(`{
+	"foo": {
+		"stuff": 1
+		"otherStuff": 2
+	}
+}
+  `)), 100)
+	obj := generic{}
+	err := s.Decode(&obj)
+	if err == nil {
+		t.Fatal("expected error with json: prefix, got no error")
+	}
+	if _, ok := err.(JSONSyntaxError); !ok {
+		t.Fatalf("expected %q to be of type JSONSyntaxError", err.Error())
+	}
+
+	s = NewYAMLOrJSONDecoder(bytes.NewReader([]byte(`---
+stuff: 1
+		test-foo: 1
+
+---
+  `)), 100)
+	obj = generic{}
+	err = s.Decode(&obj)
+	if err == nil {
+		t.Fatal("expected error with yaml: prefix, got no error")
+	}
+	if _, ok := err.(YAMLSyntaxError); !ok {
+		t.Fatalf("expected %q to be of type YAMLSyntaxError", err.Error())
+	}
+}
+
+func TestUnmarshal(t *testing.T) {
+	mapWithIntegerBytes := []byte(`replicas: 1`)
+	mapWithInteger := make(map[string]interface{})
+	if err := Unmarshal(mapWithIntegerBytes, &mapWithInteger); err != nil {
+		t.Fatalf("unexpected error unmarshaling yaml: %v", err)
+	}
+	if _, ok := mapWithInteger["replicas"].(int64); !ok {
+		t.Fatalf(`Expected number in map to be int64 but got "%T"`, mapWithInteger["replicas"])
+	}
+
+	sliceWithIntegerBytes := []byte(`- 1`)
+	var sliceWithInteger []interface{}
+	if err := Unmarshal(sliceWithIntegerBytes, &sliceWithInteger); err != nil {
+		t.Fatalf("unexpected error unmarshaling yaml: %v", err)
+	}
+	if _, ok := sliceWithInteger[0].(int64); !ok {
+		t.Fatalf(`Expected number in slice to be int64 but got "%T"`, sliceWithInteger[0])
+	}
+
+	integerBytes := []byte(`1`)
+	var integer interface{}
+	if err := Unmarshal(integerBytes, &integer); err != nil {
+		t.Fatalf("unexpected error unmarshaling yaml: %v", err)
+	}
+	if _, ok := integer.(int64); !ok {
+		t.Fatalf(`Expected number to be int64 but got "%T"`, integer)
+	}
+
+	otherTypeBytes := []byte(`123: 2`)
+	otherType := make(map[int]interface{})
+	if err := Unmarshal(otherTypeBytes, &otherType); err != nil {
+		t.Fatalf("unexpected error unmarshaling yaml: %v", err)
+	}
+	if _, ok := otherType[123].(int64); ok {
+		t.Fatalf(`Expected number not to be converted to int64`)
+	}
+	if _, ok := otherType[123].(float64); !ok {
+		t.Fatalf(`Expected number to be float64 but got "%T"`, otherType[123])
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/yaml/stream_reader.go b/third_party/k8s.io/apimachinery/pkg/util/yaml/stream_reader.go
new file mode 100644
index 0000000000..d06991057f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/yaml/stream_reader.go
@@ -0,0 +1,130 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import "io"
+
+// StreamReader is a reader designed for consuming streams of variable-length
+// messages. It buffers data until it is explicitly consumed, and can be
+// rewound to re-read previous data.
+type StreamReader struct {
+	r           io.Reader
+	buf         []byte
+	head        int // current read offset into buf
+	ttlConsumed int // number of bytes which have been consumed
+}
+
+// NewStreamReader creates a new StreamReader wrapping the provided
+// io.Reader.
+func NewStreamReader(r io.Reader, size int) *StreamReader {
+	if size == 0 {
+		size = 4096
+	}
+	return &StreamReader{
+		r:   r,
+		buf: make([]byte, 0, size), // Start with a reasonable capacity
+	}
+}
+
+// Read implements io.Reader. It first returns any buffered data after the
+// current offset, and if that's exhausted, reads from the underlying reader
+// and buffers the data. The returned data is not considered consumed until the
+// Consume method is called.
+func (r *StreamReader) Read(p []byte) (n int, err error) {
+	// If we have buffered data, return it
+	if r.head < len(r.buf) {
+		n = copy(p, r.buf[r.head:])
+		r.head += n
+		return n, nil
+	}
+
+	// If we've already hit EOF, return it
+	if r.r == nil {
+		return 0, io.EOF
+	}
+
+	// Read from the underlying reader
+	n, err = r.r.Read(p)
+	if n > 0 {
+		r.buf = append(r.buf, p[:n]...)
+		r.head += n
+	}
+	if err == nil {
+		return n, nil
+	}
+	if err == io.EOF {
+		// Store that we've hit EOF by setting r to nil
+		r.r = nil
+	}
+	return n, err
+}
+
+// ReadN reads exactly n bytes from the reader, blocking until all bytes are
+// read or an error occurs. If an error occurs, the number of bytes read is
+// returned along with the error. If EOF is hit before n bytes are read, this
+// will return the bytes read so far, along with io.EOF. The returned data is
+// not considered consumed until the Consume method is called.
+func (r *StreamReader) ReadN(want int) ([]byte, error) {
+	ret := make([]byte, want)
+	off := 0
+	for off < want {
+		n, err := r.Read(ret[off:])
+		if err != nil {
+			return ret[:off+n], err
+		}
+		off += n
+	}
+	return ret, nil
+}
+
+// Peek returns the next n bytes without advancing the reader. The returned
+// bytes are valid until the next call to Consume.
+func (r *StreamReader) Peek(n int) ([]byte, error) {
+	buf, err := r.ReadN(n)
+	r.RewindN(len(buf))
+	if err != nil {
+		return buf, err
+	}
+	return buf, nil
+}
+
+// Rewind resets the reader to the beginning of the buffered data.
+func (r *StreamReader) Rewind() {
+	r.head = 0
+}
+
+// RewindN rewinds the reader by n bytes. If n is greater than the current
+// buffer, the reader is rewound to the beginning of the buffer.
+func (r *StreamReader) RewindN(n int) {
+	r.head -= min(n, r.head)
+}
+
+// Consume discards up to n bytes of previously read data from the beginning of
+// the buffer. Once consumed, that data is no longer available for rewinding.
+// If n is greater than the current buffer, the buffer is cleared. Consume
+// never consume data from the underlying reader.
+func (r *StreamReader) Consume(n int) {
+	n = min(n, len(r.buf))
+	r.buf = r.buf[n:]
+	r.head -= n
+	r.ttlConsumed += n
+}
+
+// Consumed returns the number of bytes consumed from the input reader.
+func (r *StreamReader) Consumed() int {
+	return r.ttlConsumed
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/util/yaml/stream_reader_test.go b/third_party/k8s.io/apimachinery/pkg/util/yaml/stream_reader_test.go
new file mode 100644
index 0000000000..b010610c47
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/util/yaml/stream_reader_test.go
@@ -0,0 +1,388 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package yaml
+
+import (
+	"io"
+	"strings"
+	"testing"
+)
+
+// srt = StreamReaderTest
+type srtStep struct {
+	op       string
+	expected string
+	err      error
+	size     int
+}
+
+func srtRead(size int, expected string, err error) srtStep {
+	return srtStep{op: "Read", size: size, expected: expected, err: err}
+}
+func srtReadN(size int, expected string, err error) srtStep {
+	return srtStep{op: "ReadN", size: size, expected: expected, err: err}
+}
+func srtPeek(size int, expected string, err error) srtStep {
+	return srtStep{op: "Peek", size: size, expected: expected, err: err}
+}
+func srtRewind() srtStep {
+	return srtStep{op: "Rewind"}
+}
+func srtRewindN(size int) srtStep {
+	return srtStep{op: "RewindN", size: size}
+}
+func srtConsume(size int) srtStep {
+	return srtStep{op: "Consume", size: size}
+}
+func srtConsumed(exp int) srtStep {
+	return srtStep{op: "Consumed", size: exp}
+}
+
+func srtRun(t *testing.T, reader *StreamReader, steps []srtStep) {
+	t.Helper()
+
+	checkRead := func(i int, step srtStep, buf []byte, err error) {
+		t.Helper()
+		if err != nil && step.err == nil {
+			t.Errorf("step %d: unexpected error: %v", i, err)
+		} else if err == nil && step.err != nil {
+			t.Errorf("step %d: expected error %v", i, step.err)
+		} else if err != nil && err != step.err { //nolint:errorlint
+			t.Errorf("step %d: expected error %v, got %v", i, step.err, err)
+		}
+		if got := string(buf); got != step.expected {
+			t.Errorf("step %d: expected %q, got %q", i, step.expected, got)
+		}
+	}
+
+	for i, step := range steps {
+		switch step.op {
+		case "Read":
+			buf := make([]byte, step.size)
+			n, err := reader.Read(buf)
+			buf = buf[:n]
+			checkRead(i, step, buf, err)
+		case "ReadN":
+			buf, err := reader.ReadN(step.size)
+			checkRead(i, step, buf, err)
+		case "Peek":
+			buf, err := reader.Peek(step.size)
+			checkRead(i, step, buf, err)
+		case "Rewind":
+			reader.Rewind()
+		case "RewindN":
+			reader.RewindN(step.size)
+		case "Consume":
+			reader.Consume(step.size)
+		case "Consumed":
+			if n := reader.Consumed(); n != step.size {
+				t.Errorf("step %d: expected %d consumed, got %d", i, step.size, n)
+			}
+		default:
+			t.Fatalf("step %d: unknown operation %q", i, step.op)
+		}
+	}
+}
+
+func TestStreamReader_Read(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		steps []srtStep
+	}{{
+		name:  "empty input",
+		input: "",
+		steps: []srtStep{
+			srtRead(1, "", io.EOF),
+			srtRead(1, "", io.EOF), // still EOF
+		},
+	}, {
+		name:  "simple reads",
+		input: "0123456789",
+		steps: []srtStep{
+			srtRead(5, "01234", nil),
+			srtRead(5, "56789", nil),
+			srtRead(1, "", io.EOF),
+		},
+	}, {
+		name:  "short read at EOF",
+		input: "0123456789",
+		steps: []srtStep{
+			srtRead(8, "01234567", nil),
+			srtRead(8, "89", nil), // short read, no error
+			srtRead(1, "", io.EOF),
+		},
+	}, {
+		name:  "short reads from buffer",
+		input: "0123456789",
+		steps: []srtStep{
+			srtRead(3, "012", nil), // fill buffer
+			srtRewind(),
+			srtRead(4, "012", nil), // short read from buffer
+			srtRewind(),
+			srtRead(4, "012", nil),  // still short
+			srtRead(4, "3456", nil), // from reader
+			srtRewind(),
+			srtRead(10, "0123456", nil), // short read from buffer
+		},
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewStreamReader(strings.NewReader(tt.input), 4) // small initial buffer
+			srtRun(t, reader, tt.steps)
+		})
+	}
+}
+
+func TestStreamReader_Rewind(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		steps []srtStep
+	}{{
+		name:  "simple read and rewind",
+		input: "0123456789",
+		steps: []srtStep{
+			srtRead(4, "0123", nil),
+			srtRead(4, "4567", nil),
+			srtRead(4, "89", nil),
+			srtRead(1, "", io.EOF),
+			srtRewind(),
+			srtRead(4, "0123", nil),
+			srtRead(4, "4567", nil),
+			srtRead(4, "89", nil),
+			srtRead(1, "", io.EOF),
+		},
+	}, {
+		name:  "multiple rewinds",
+		input: "01234",
+		steps: []srtStep{
+			srtRead(2, "01", nil),
+			srtRewind(),
+			srtRead(2, "01", nil),
+			srtRead(2, "23", nil),
+			srtRewind(),
+			srtRead(2, "01", nil),
+			srtRead(2, "23", nil),
+			srtRead(2, "4", nil),
+			srtRead(1, "", io.EOF),
+			srtRewind(),
+			srtRead(100, "01234", nil),
+			srtRead(1, "", io.EOF),
+		},
+	}, {
+		name:  "empty input",
+		input: "",
+		steps: []srtStep{
+			srtRead(1, "", io.EOF),
+			srtRewind(),
+			srtRead(1, "", io.EOF),
+		},
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewStreamReader(strings.NewReader(tt.input), 4) // small initial buffer
+			srtRun(t, reader, tt.steps)
+		})
+	}
+}
+
+func TestStreamReader_RewindN(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		steps []srtStep
+	}{{
+		name:  "simple rewindn",
+		input: "0123456789",
+		steps: []srtStep{
+			srtRead(4, "0123", nil),
+			srtRead(4, "4567", nil),
+			srtRead(4, "89", nil),
+			srtRead(1, "", io.EOF),
+			srtRewindN(4),
+			srtRead(2, "67", nil),
+			srtRewindN(4),
+			srtRead(10, "456789", nil),
+			srtRead(1, "", io.EOF),
+		},
+	}, {
+		name:  "empty input",
+		input: "",
+		steps: []srtStep{
+			srtRead(1, "", io.EOF),
+			srtRewindN(100),
+			srtRead(1, "", io.EOF),
+		},
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewStreamReader(strings.NewReader(tt.input), 4) // small initial buffer
+			srtRun(t, reader, tt.steps)
+		})
+	}
+}
+
+func TestStreamReader_Consume(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		steps []srtStep
+	}{{
+		name:  "simple consume",
+		input: "0123456789",
+		steps: []srtStep{
+			srtConsumed(0),
+			srtRead(4, "0123", nil),
+			srtRead(4, "4567", nil),
+			srtConsume(2), // drops 01
+			srtConsumed(2),
+			srtRead(4, "89", nil),
+			srtRead(1, "", io.EOF),
+			srtRewind(),
+			srtRead(5, "23456", nil),
+			srtRead(5, "789", nil),
+			srtRead(1, "", io.EOF),
+			srtConsumed(2),
+		},
+	}, {
+		name:  "consume too much",
+		input: "01234",
+		steps: []srtStep{
+			srtConsumed(0),
+			srtRead(5, "01234", nil),
+			srtConsume(5),
+			srtConsumed(5),
+			srtConsume(5),
+			srtConsumed(5),
+			srtRead(1, "", io.EOF),
+			srtConsume(5),
+			srtConsumed(5),
+			srtRead(1, "", io.EOF),
+			srtConsumed(5),
+		},
+	}, {
+		name:  "empty input",
+		input: "",
+		steps: []srtStep{
+			srtConsumed(0),
+			srtConsume(5),
+			srtRead(1, "", io.EOF),
+			srtConsumed(0),
+		},
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewStreamReader(strings.NewReader(tt.input), 4) // small initial buffer
+			srtRun(t, reader, tt.steps)
+		})
+	}
+}
+
+func TestStreamReader_ReadN(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		steps []srtStep
+	}{{
+		name:  "short read full readN",
+		input: "0123456789",
+		steps: []srtStep{
+			srtRead(3, "012", nil), // fill buffer
+			srtRewind(),
+			srtRead(5, "012", nil), // short read from buffer
+			srtRewind(),
+			srtReadN(5, "01234", nil), // full readN
+			srtRewind(),
+			srtRead(10, "01234", nil), // short read from buffer
+			srtRewind(),
+			srtReadN(10, "0123456789", nil), // full readN
+			srtRewind(),
+			srtRead(10, "0123456789", nil), // full read from buffer
+			srtRead(1, "", io.EOF),
+		},
+	}, {
+		name:  "short read consume readN",
+		input: "0123456789",
+		steps: []srtStep{
+			srtRead(3, "012", nil), // fill buffer
+			srtRewind(),
+			srtRead(4, "012", nil), // short read from buffer
+			srtConsume(1),
+			srtRewind(),
+			srtRead(4, "12", nil), // short read from buffer
+			srtRewind(),
+			srtReadN(4, "1234", nil), // full read
+			srtConsume(1),
+			srtRewind(),
+			srtRead(4, "234", nil), // short read from buffer
+			srtRewind(),
+			srtReadN(10, "23456789", io.EOF), // short readN, EOF
+			srtRewind(),
+			srtRead(10, "23456789", nil), // full read from buffer
+			srtRead(1, "", io.EOF),
+		},
+	}, {
+		name:  "empty input",
+		input: "",
+		steps: []srtStep{
+			srtReadN(1, "", io.EOF),
+		},
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewStreamReader(strings.NewReader(tt.input), 4) // small initial buffer
+			srtRun(t, reader, tt.steps)
+		})
+	}
+}
+
+func TestStreamReader_Peek(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		steps []srtStep
+	}{{
+		name:  "simple peek",
+		input: "0123456789",
+		steps: []srtStep{
+			srtPeek(3, "012", nil), // fill buffer
+			srtRead(5, "012", nil), // short read from buffer
+			srtRewind(),
+			srtPeek(6, "012345", nil),  // fill buffer
+			srtRead(10, "012345", nil), // short read from buffer
+		},
+	}, {
+		name:  "empty input",
+		input: "",
+		steps: []srtStep{
+			srtPeek(1, "", io.EOF),
+		},
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := NewStreamReader(strings.NewReader(tt.input), 0)
+			srtRun(t, reader, tt.steps)
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/version/doc.go b/third_party/k8s.io/apimachinery/pkg/version/doc.go
new file mode 100644
index 0000000000..70e3f76b23
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/version/doc.go
@@ -0,0 +1,22 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=io.k8s.apimachinery.pkg.version
+//
+
+// Package version supplies the type for version information.
+package version
diff --git a/third_party/k8s.io/apimachinery/pkg/version/helpers.go b/third_party/k8s.io/apimachinery/pkg/version/helpers.go
new file mode 100644
index 0000000000..5e041d6f3f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/version/helpers.go
@@ -0,0 +1,88 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package version
+
+import (
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+type versionType int
+
+const (
+	// Bigger the version type number, higher priority it is
+	versionTypeAlpha versionType = iota
+	versionTypeBeta
+	versionTypeGA
+)
+
+var kubeVersionRegex = regexp.MustCompile("^v([\\d]+)(?:(alpha|beta)([\\d]+))?$")
+
+func parseKubeVersion(v string) (majorVersion int, vType versionType, minorVersion int, ok bool) {
+	var err error
+	submatches := kubeVersionRegex.FindStringSubmatch(v)
+	if len(submatches) != 4 {
+		return 0, 0, 0, false
+	}
+	switch submatches[2] {
+	case "alpha":
+		vType = versionTypeAlpha
+	case "beta":
+		vType = versionTypeBeta
+	case "":
+		vType = versionTypeGA
+	default:
+		return 0, 0, 0, false
+	}
+	if majorVersion, err = strconv.Atoi(submatches[1]); err != nil {
+		return 0, 0, 0, false
+	}
+	if vType != versionTypeGA {
+		if minorVersion, err = strconv.Atoi(submatches[3]); err != nil {
+			return 0, 0, 0, false
+		}
+	}
+	return majorVersion, vType, minorVersion, true
+}
+
+// CompareKubeAwareVersionStrings compares two kube-like version strings.
+// Kube-like version strings are starting with a v, followed by a major version, optional "alpha" or "beta" strings
+// followed by a minor version (e.g. v1, v2beta1). Versions will be sorted based on GA/alpha/beta first and then major
+// and minor versions. e.g. v2, v1, v1beta2, v1beta1, v1alpha1.
+func CompareKubeAwareVersionStrings(v1, v2 string) int {
+	if v1 == v2 {
+		return 0
+	}
+	v1major, v1type, v1minor, ok1 := parseKubeVersion(v1)
+	v2major, v2type, v2minor, ok2 := parseKubeVersion(v2)
+	switch {
+	case !ok1 && !ok2:
+		return strings.Compare(v2, v1)
+	case !ok1 && ok2:
+		return -1
+	case ok1 && !ok2:
+		return 1
+	}
+	if v1type != v2type {
+		return int(v1type) - int(v2type)
+	}
+	if v1major != v2major {
+		return v1major - v2major
+	}
+	return v1minor - v2minor
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/version/helpers_test.go b/third_party/k8s.io/apimachinery/pkg/version/helpers_test.go
new file mode 100644
index 0000000000..a98ed70e2a
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/version/helpers_test.go
@@ -0,0 +1,121 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package version
+
+import (
+	"testing"
+)
+
+func TestCompareKubeAwareVersionStrings(t *testing.T) {
+	tests := []*struct {
+		v1, v2          string
+		expectedGreater bool
+	}{
+		{"v1", "v2", false},
+		{"v2", "v1", true},
+		{"v10", "v2", true},
+		{"v1", "v2alpha1", true},
+		{"v1", "v2beta1", true},
+		{"v1alpha2", "v1alpha1", true},
+		{"v1beta1", "v2alpha3", true},
+		{"v1alpha10", "v1alpha2", true},
+		{"v1beta10", "v1beta2", true},
+		{"foo", "v1beta2", false},
+		{"bar", "foo", true},
+		{"version1", "version2", true},  // Non kube-like versions are sorted alphabetically
+		{"version1", "version10", true}, // Non kube-like versions are sorted alphabetically
+	}
+
+	for _, tc := range tests {
+		if e, a := tc.expectedGreater, CompareKubeAwareVersionStrings(tc.v1, tc.v2) > 0; e != a {
+			if e {
+				t.Errorf("expected %s to be greater than %s", tc.v1, tc.v2)
+			} else {
+				t.Errorf("expected %s to be less than %s", tc.v1, tc.v2)
+			}
+		}
+	}
+}
+
+func Test_parseKubeVersion(t *testing.T) {
+	tests := []struct {
+		name             string
+		v                string
+		wantMajorVersion int
+		wantVType        versionType
+		wantMinorVersion int
+		wantOk           bool
+	}{
+		{
+			name:             "invalid version for ga",
+			v:                "v1.1",
+			wantMajorVersion: 0,
+			wantVType:        0,
+			wantMinorVersion: 0,
+			wantOk:           false,
+		},
+		{
+			name:             "invalid version for alpha",
+			v:                "v1alpha1.1",
+			wantMajorVersion: 0,
+			wantVType:        0,
+			wantMinorVersion: 0,
+			wantOk:           false,
+		},
+		{
+			name:             "alpha version",
+			v:                "v1alpha1",
+			wantMajorVersion: 1,
+			wantVType:        0,
+			wantMinorVersion: 1,
+			wantOk:           true,
+		},
+		{
+			name:             "beta version",
+			v:                "v2beta10",
+			wantMajorVersion: 2,
+			wantVType:        1,
+			wantMinorVersion: 10,
+			wantOk:           true,
+		},
+		{
+			name:             "ga version",
+			v:                "v3",
+			wantMajorVersion: 3,
+			wantVType:        2,
+			wantMinorVersion: 0,
+			wantOk:           true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotMajorVersion, gotVType, gotMinorVersion, gotOk := parseKubeVersion(tt.v)
+			if gotMajorVersion != tt.wantMajorVersion {
+				t.Errorf("parseKubeVersion() gotMajorVersion = %v, want %v", gotMajorVersion, tt.wantMajorVersion)
+			}
+			if gotVType != tt.wantVType {
+				t.Errorf("parseKubeVersion() gotVType = %v, want %v", gotVType, tt.wantVType)
+			}
+			if gotMinorVersion != tt.wantMinorVersion {
+				t.Errorf("parseKubeVersion() gotMinorVersion = %v, want %v", gotMinorVersion, tt.wantMinorVersion)
+			}
+			if gotOk != tt.wantOk {
+				t.Errorf("parseKubeVersion() gotOk = %v, want %v", gotOk, tt.wantOk)
+			}
+		})
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/version/types.go b/third_party/k8s.io/apimachinery/pkg/version/types.go
new file mode 100644
index 0000000000..6a18f9e91d
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/version/types.go
@@ -0,0 +1,47 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package version
+
+// Info contains versioning information.
+// TODO: Add []string of api versions supported? It's still unclear
+// how we'll want to distribute that information.
+type Info struct {
+	// Major is the major version of the binary version
+	Major string `json:"major"`
+	// Minor is the minor version of the binary version
+	Minor string `json:"minor"`
+	// EmulationMajor is the major version of the emulation version
+	EmulationMajor string `json:"emulationMajor,omitempty"`
+	// EmulationMinor is the minor version of the emulation version
+	EmulationMinor string `json:"emulationMinor,omitempty"`
+	// MinCompatibilityMajor is the major version of the minimum compatibility version
+	MinCompatibilityMajor string `json:"minCompatibilityMajor,omitempty"`
+	// MinCompatibilityMinor is the minor version of the minimum compatibility version
+	MinCompatibilityMinor string `json:"minCompatibilityMinor,omitempty"`
+	GitVersion            string `json:"gitVersion"`
+	GitCommit             string `json:"gitCommit"`
+	GitTreeState          string `json:"gitTreeState"`
+	BuildDate             string `json:"buildDate"`
+	GoVersion             string `json:"goVersion"`
+	Compiler              string `json:"compiler"`
+	Platform              string `json:"platform"`
+}
+
+// String returns info as a human-friendly version string.
+func (info Info) String() string {
+	return info.GitVersion
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/version/zz_generated.model_name.go b/third_party/k8s.io/apimachinery/pkg/version/zz_generated.model_name.go
new file mode 100644
index 0000000000..e5a6d395ad
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/version/zz_generated.model_name.go
@@ -0,0 +1,27 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package version
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Info) OpenAPIModelName() string {
+	return "io.k8s.apimachinery.pkg.version.Info"
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/watch/doc.go b/third_party/k8s.io/apimachinery/pkg/watch/doc.go
new file mode 100644
index 0000000000..5fde5e7427
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/watch/doc.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package watch contains a generic watchable interface, and a fake for
+// testing code that uses the watch interface.
+package watch
diff --git a/third_party/k8s.io/apimachinery/pkg/watch/filter.go b/third_party/k8s.io/apimachinery/pkg/watch/filter.go
new file mode 100644
index 0000000000..a5735a0b47
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/watch/filter.go
@@ -0,0 +1,104 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch
+
+import (
+	"sync"
+)
+
+// FilterFunc should take an event, possibly modify it in some way, and return
+// the modified event. If the event should be ignored, then return keep=false.
+type FilterFunc func(in Event) (out Event, keep bool)
+
+// Filter passes all events through f before allowing them to pass on.
+// Putting a filter on a watch, as an unavoidable side-effect due to the way
+// go channels work, effectively causes the watch's event channel to have its
+// queue length increased by one.
+//
+// WARNING: filter has a fatal flaw, in that it can't properly update the
+// Type field (Add/Modified/Deleted) to reflect items beginning to pass the
+// filter when they previously didn't.
+func Filter(w Interface, f FilterFunc) Interface {
+	fw := &filteredWatch{
+		incoming: w,
+		result:   make(chan Event),
+		f:        f,
+	}
+	go fw.loop()
+	return fw
+}
+
+type filteredWatch struct {
+	incoming Interface
+	result   chan Event
+	f        FilterFunc
+}
+
+// ResultChan returns a channel which will receive filtered events.
+func (fw *filteredWatch) ResultChan() <-chan Event {
+	return fw.result
+}
+
+// Stop stops the upstream watch, which will eventually stop this watch.
+func (fw *filteredWatch) Stop() {
+	fw.incoming.Stop()
+}
+
+// loop waits for new values, filters them, and resends them.
+func (fw *filteredWatch) loop() {
+	defer close(fw.result)
+	for event := range fw.incoming.ResultChan() {
+		filtered, keep := fw.f(event)
+		if keep {
+			fw.result <- filtered
+		}
+	}
+}
+
+// Recorder records all events that are sent from the watch until it is closed.
+type Recorder struct {
+	Interface
+
+	lock   sync.Mutex
+	events []Event
+}
+
+var _ Interface = &Recorder{}
+
+// NewRecorder wraps an Interface and records any changes sent across it.
+func NewRecorder(w Interface) *Recorder {
+	r := &Recorder{}
+	r.Interface = Filter(w, r.record)
+	return r
+}
+
+// record is a FilterFunc and tracks each received event.
+func (r *Recorder) record(in Event) (Event, bool) {
+	r.lock.Lock()
+	defer r.lock.Unlock()
+	r.events = append(r.events, in)
+	return in, true
+}
+
+// Events returns a copy of the events sent across this recorder.
+func (r *Recorder) Events() []Event {
+	r.lock.Lock()
+	defer r.lock.Unlock()
+	copied := make([]Event, len(r.events))
+	copy(copied, r.events)
+	return copied
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/watch/filter_test.go b/third_party/k8s.io/apimachinery/pkg/watch/filter_test.go
new file mode 100644
index 0000000000..106e06b46f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/watch/filter_test.go
@@ -0,0 +1,114 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch_test
+
+import (
+	"reflect"
+	"testing"
+
+	. "k8s.io/apimachinery/pkg/watch"
+)
+
+func TestFilter(t *testing.T) {
+	table := []Event{
+		{Type: Added, Object: testType("foo")},
+		{Type: Added, Object: testType("bar")},
+		{Type: Added, Object: testType("baz")},
+		{Type: Added, Object: testType("qux")},
+		{Type: Added, Object: testType("zoo")},
+	}
+
+	source := NewFake()
+	filtered := Filter(source, func(e Event) (Event, bool) {
+		return e, e.Object.(testType)[0] != 'b'
+	})
+
+	go func() {
+		for _, item := range table {
+			source.Action(item.Type, item.Object)
+		}
+		source.Stop()
+	}()
+
+	var got []string
+	for {
+		event, ok := <-filtered.ResultChan()
+		if !ok {
+			break
+		}
+		got = append(got, string(event.Object.(testType)))
+	}
+
+	if e, a := []string{"foo", "qux", "zoo"}, got; !reflect.DeepEqual(e, a) {
+		t.Errorf("got %v, wanted %v", e, a)
+	}
+}
+
+func TestFilterStop(t *testing.T) {
+	source := NewFake()
+	filtered := Filter(source, func(e Event) (Event, bool) {
+		return e, e.Object.(testType)[0] != 'b'
+	})
+
+	go func() {
+		source.Add(testType("foo"))
+		filtered.Stop()
+	}()
+
+	var got []string
+	for {
+		event, ok := <-filtered.ResultChan()
+		if !ok {
+			break
+		}
+		got = append(got, string(event.Object.(testType)))
+	}
+
+	if e, a := []string{"foo"}, got; !reflect.DeepEqual(e, a) {
+		t.Errorf("got %v, wanted %v", e, a)
+	}
+}
+
+func TestRecorder(t *testing.T) {
+	events := []Event{
+		{Type: Added, Object: testType("foo")},
+		{Type: Added, Object: testType("bar")},
+		{Type: Added, Object: testType("baz")},
+		{Type: Added, Object: testType("qux")},
+		{Type: Added, Object: testType("zoo")},
+	}
+
+	source := NewFake()
+	go func() {
+		for _, item := range events {
+			source.Action(item.Type, item.Object)
+		}
+		source.Stop()
+	}()
+
+	recorder := NewRecorder(source)
+	for {
+		_, ok := <-recorder.Interface.ResultChan()
+		if !ok {
+			break
+		}
+	}
+	recordedEvents := recorder.Events()
+	if !reflect.DeepEqual(recordedEvents, events) {
+		t.Errorf("got %v, expected %v", recordedEvents, events)
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/watch/mux.go b/third_party/k8s.io/apimachinery/pkg/watch/mux.go
new file mode 100644
index 0000000000..d51f9567e4
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/watch/mux.go
@@ -0,0 +1,320 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch
+
+import (
+	"fmt"
+	"sync"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// FullChannelBehavior controls how the Broadcaster reacts if a watcher's watch
+// channel is full.
+type FullChannelBehavior int
+
+const (
+	WaitIfChannelFull FullChannelBehavior = iota
+	DropIfChannelFull
+)
+
+// Buffer the incoming queue a little bit even though it should rarely ever accumulate
+// anything, just in case a few events are received in such a short window that
+// Broadcaster can't move them onto the watchers' queues fast enough.
+const incomingQueueLength = 25
+
+// Broadcaster distributes event notifications among any number of watchers. Every event
+// is delivered to every watcher.
+type Broadcaster struct {
+	watchers     map[int64]*broadcasterWatcher
+	nextWatcher  int64
+	distributing sync.WaitGroup
+
+	// incomingBlock allows us to ensure we don't race and end up sending events
+	// to a closed channel following a broadcaster shutdown.
+	incomingBlock sync.Mutex
+	incoming      chan Event
+	stopped       chan struct{}
+
+	// How large to make watcher's channel.
+	watchQueueLength int
+	// If one of the watch channels is full, don't wait for it to become empty.
+	// Instead just deliver it to the watchers that do have space in their
+	// channels and move on to the next event.
+	// It's more fair to do this on a per-watcher basis than to do it on the
+	// "incoming" channel, which would allow one slow watcher to prevent all
+	// other watchers from getting new events.
+	fullChannelBehavior FullChannelBehavior
+}
+
+// NewBroadcaster creates a new Broadcaster. queueLength is the maximum number of events to queue per watcher.
+// It is guaranteed that events will be distributed in the order in which they occur,
+// but the order in which a single event is distributed among all of the watchers is unspecified.
+func NewBroadcaster(queueLength int, fullChannelBehavior FullChannelBehavior) *Broadcaster {
+	m := &Broadcaster{
+		watchers:            map[int64]*broadcasterWatcher{},
+		incoming:            make(chan Event, incomingQueueLength),
+		stopped:             make(chan struct{}),
+		watchQueueLength:    queueLength,
+		fullChannelBehavior: fullChannelBehavior,
+	}
+	m.distributing.Add(1)
+	go m.loop()
+	return m
+}
+
+// NewLongQueueBroadcaster functions nearly identically to NewBroadcaster,
+// except that the incoming queue is the same size as the outgoing queues
+// (specified by queueLength).
+func NewLongQueueBroadcaster(queueLength int, fullChannelBehavior FullChannelBehavior) *Broadcaster {
+	m := &Broadcaster{
+		watchers:            map[int64]*broadcasterWatcher{},
+		incoming:            make(chan Event, queueLength),
+		stopped:             make(chan struct{}),
+		watchQueueLength:    queueLength,
+		fullChannelBehavior: fullChannelBehavior,
+	}
+	m.distributing.Add(1)
+	go m.loop()
+	return m
+}
+
+const internalRunFunctionMarker = "internal-do-function"
+
+// a function type we can shoehorn into the queue.
+type functionFakeRuntimeObject func()
+
+func (obj functionFakeRuntimeObject) GetObjectKind() schema.ObjectKind {
+	return schema.EmptyObjectKind
+}
+func (obj functionFakeRuntimeObject) DeepCopyObject() runtime.Object {
+	if obj == nil {
+		return nil
+	}
+	// funcs are immutable. Hence, just return the original func.
+	return obj
+}
+
+// Execute f, blocking the incoming queue (and waiting for it to drain first).
+// The purpose of this terrible hack is so that watchers added after an event
+// won't ever see that event, and will always see any event after they are
+// added.
+func (m *Broadcaster) blockQueue(f func()) {
+	m.incomingBlock.Lock()
+	defer m.incomingBlock.Unlock()
+	select {
+	case <-m.stopped:
+		return
+	default:
+	}
+	var wg sync.WaitGroup
+	wg.Add(1)
+	m.incoming <- Event{
+		Type: internalRunFunctionMarker,
+		Object: functionFakeRuntimeObject(func() {
+			defer wg.Done()
+			f()
+		}),
+	}
+	wg.Wait()
+}
+
+// Watch adds a new watcher to the list and returns an Interface for it.
+// Note: new watchers will only receive new events. They won't get an entire history
+// of previous events. It will block until the watcher is actually added to the
+// broadcaster.
+func (m *Broadcaster) Watch() (Interface, error) {
+	var w *broadcasterWatcher
+	m.blockQueue(func() {
+		id := m.nextWatcher
+		m.nextWatcher++
+		w = &broadcasterWatcher{
+			result:  make(chan Event, m.watchQueueLength),
+			stopped: make(chan struct{}),
+			id:      id,
+			m:       m,
+		}
+		m.watchers[id] = w
+	})
+	if w == nil {
+		return nil, fmt.Errorf("broadcaster already stopped")
+	}
+	return w, nil
+}
+
+// WatchWithPrefix adds a new watcher to the list and returns an Interface for it. It sends
+// queuedEvents down the new watch before beginning to send ordinary events from Broadcaster.
+// The returned watch will have a queue length that is at least large enough to accommodate
+// all of the items in queuedEvents. It will block until the watcher is actually added to
+// the broadcaster.
+func (m *Broadcaster) WatchWithPrefix(queuedEvents []Event) (Interface, error) {
+	var w *broadcasterWatcher
+	m.blockQueue(func() {
+		id := m.nextWatcher
+		m.nextWatcher++
+		length := m.watchQueueLength
+		if n := len(queuedEvents) + 1; n > length {
+			length = n
+		}
+		w = &broadcasterWatcher{
+			result:  make(chan Event, length),
+			stopped: make(chan struct{}),
+			id:      id,
+			m:       m,
+		}
+		m.watchers[id] = w
+		for _, e := range queuedEvents {
+			w.result <- e
+		}
+	})
+	if w == nil {
+		return nil, fmt.Errorf("broadcaster already stopped")
+	}
+	return w, nil
+}
+
+// stopWatching stops the given watcher and removes it from the list.
+func (m *Broadcaster) stopWatching(id int64) {
+	m.blockQueue(func() {
+		w, ok := m.watchers[id]
+		if !ok {
+			// No need to do anything, it's already been removed from the list.
+			return
+		}
+		delete(m.watchers, id)
+		close(w.result)
+	})
+}
+
+// closeAll disconnects all watchers (presumably in response to a Shutdown call).
+func (m *Broadcaster) closeAll() {
+	for _, w := range m.watchers {
+		close(w.result)
+	}
+	// Delete everything from the map, since presence/absence in the map is used
+	// by stopWatching to avoid double-closing the channel.
+	m.watchers = map[int64]*broadcasterWatcher{}
+}
+
+// Action distributes the given event among all watchers.
+func (m *Broadcaster) Action(action EventType, obj runtime.Object) error {
+	m.incomingBlock.Lock()
+	defer m.incomingBlock.Unlock()
+	select {
+	case <-m.stopped:
+		return fmt.Errorf("broadcaster already stopped")
+	default:
+	}
+
+	m.incoming <- Event{action, obj}
+	return nil
+}
+
+// Action distributes the given event among all watchers, or drops it on the floor
+// if too many incoming actions are queued up.  Returns true if the action was sent,
+// false if dropped.
+func (m *Broadcaster) ActionOrDrop(action EventType, obj runtime.Object) (bool, error) {
+	m.incomingBlock.Lock()
+	defer m.incomingBlock.Unlock()
+
+	// Ensure that if the broadcaster is stopped we do not send events to it.
+	select {
+	case <-m.stopped:
+		return false, fmt.Errorf("broadcaster already stopped")
+	default:
+	}
+
+	select {
+	case m.incoming <- Event{action, obj}:
+		return true, nil
+	default:
+		return false, nil
+	}
+}
+
+// Shutdown disconnects all watchers (but any queued events will still be distributed).
+// You must not call Action or Watch* after calling Shutdown. This call blocks
+// until all events have been distributed through the outbound channels. Note
+// that since they can be buffered, this means that the watchers might not
+// have received the data yet as it can remain sitting in the buffered
+// channel. It will block until the broadcaster stop request is actually executed
+func (m *Broadcaster) Shutdown() {
+	m.blockQueue(func() {
+		close(m.stopped)
+		close(m.incoming)
+	})
+	m.distributing.Wait()
+}
+
+// loop receives from m.incoming and distributes to all watchers.
+func (m *Broadcaster) loop() {
+	// Deliberately not catching crashes here. Yes, bring down the process if there's a
+	// bug in watch.Broadcaster.
+	for event := range m.incoming {
+		if event.Type == internalRunFunctionMarker {
+			event.Object.(functionFakeRuntimeObject)()
+			continue
+		}
+		m.distribute(event)
+	}
+	m.closeAll()
+	m.distributing.Done()
+}
+
+// distribute sends event to all watchers. Blocking.
+func (m *Broadcaster) distribute(event Event) {
+	if m.fullChannelBehavior == DropIfChannelFull {
+		for _, w := range m.watchers {
+			select {
+			case w.result <- event:
+			case <-w.stopped:
+			default: // Don't block if the event can't be queued.
+			}
+		}
+	} else {
+		for _, w := range m.watchers {
+			select {
+			case w.result <- event:
+			case <-w.stopped:
+			}
+		}
+	}
+}
+
+// broadcasterWatcher handles a single watcher of a broadcaster
+type broadcasterWatcher struct {
+	result  chan Event
+	stopped chan struct{}
+	stop    sync.Once
+	id      int64
+	m       *Broadcaster
+}
+
+// ResultChan returns a channel to use for waiting on events.
+func (mw *broadcasterWatcher) ResultChan() <-chan Event {
+	return mw.result
+}
+
+// Stop stops watching and removes mw from its list.
+// It will block until the watcher stop request is actually executed
+func (mw *broadcasterWatcher) Stop() {
+	mw.stop.Do(func() {
+		close(mw.stopped)
+		mw.m.stopWatching(mw.id)
+	})
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/watch/mux_test.go b/third_party/k8s.io/apimachinery/pkg/watch/mux_test.go
new file mode 100644
index 0000000000..9b46ce77e9
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/watch/mux_test.go
@@ -0,0 +1,291 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch
+
+import (
+	"reflect"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/wait"
+)
+
+type myType struct {
+	ID    string
+	Value string
+}
+
+func (obj *myType) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+func (obj *myType) DeepCopyObject() runtime.Object {
+	if obj == nil {
+		return nil
+	}
+	clone := *obj
+	return &clone
+}
+
+func TestBroadcaster(t *testing.T) {
+	table := []Event{
+		{Type: Added, Object: &myType{"foo", "hello world 1"}},
+		{Type: Added, Object: &myType{"bar", "hello world 2"}},
+		{Type: Modified, Object: &myType{"foo", "goodbye world 3"}},
+		{Type: Deleted, Object: &myType{"bar", "hello world 4"}},
+	}
+
+	// The broadcaster we're testing
+	m := NewBroadcaster(0, WaitIfChannelFull)
+
+	// Add a bunch of watchers
+	const testWatchers = 2
+	wg := sync.WaitGroup{}
+	wg.Add(testWatchers)
+	for i := 0; i < testWatchers; i++ {
+		w, err := m.Watch()
+		if err != nil {
+			t.Fatalf("Unable start event watcher: '%v' (will not retry!)", err)
+		}
+		// Verify that each watcher gets the events in the correct order
+		go func(watcher int, w Interface) {
+			tableLine := 0
+			for {
+				event, ok := <-w.ResultChan()
+				if !ok {
+					break
+				}
+				if e, a := table[tableLine], event; !reflect.DeepEqual(e, a) {
+					t.Errorf("Watcher %v, line %v: Expected (%v, %#v), got (%v, %#v)",
+						watcher, tableLine, e.Type, e.Object, a.Type, a.Object)
+				} else {
+					t.Logf("Got (%v, %#v)", event.Type, event.Object)
+				}
+				tableLine++
+			}
+			wg.Done()
+		}(i, w)
+	}
+
+	for i, item := range table {
+		t.Logf("Sending %v", i)
+		m.Action(item.Type, item.Object)
+	}
+
+	m.Shutdown()
+
+	wg.Wait()
+}
+
+func TestBroadcasterWatcherClose(t *testing.T) {
+	m := NewBroadcaster(0, WaitIfChannelFull)
+	w, err := m.Watch()
+	if err != nil {
+		t.Fatalf("Unable start event watcher: '%v' (will not retry!)", err)
+	}
+	w2, err := m.Watch()
+	if err != nil {
+		t.Fatalf("Unable start event watcher: '%v' (will not retry!)", err)
+	}
+	w.Stop()
+	m.Shutdown()
+	if _, open := <-w.ResultChan(); open {
+		t.Errorf("Stop didn't work?")
+	}
+	if _, open := <-w2.ResultChan(); open {
+		t.Errorf("Shutdown didn't work?")
+	}
+	// Extra stops don't hurt things
+	w.Stop()
+	w2.Stop()
+}
+
+func TestBroadcasterWatcherStopDeadlock(t *testing.T) {
+	done := make(chan bool)
+	m := NewBroadcaster(0, WaitIfChannelFull)
+	w, err := m.Watch()
+	if err != nil {
+		t.Fatalf("Unable start event watcher: '%v' (will not retry!)", err)
+	}
+	w2, err := m.Watch()
+	if err != nil {
+		t.Fatalf("Unable start event watcher: '%v' (will not retry!)", err)
+	}
+	go func(w0, w1 Interface) {
+		// We know Broadcaster is in the distribute loop once one watcher receives
+		// an event. Stop the other watcher while distribute is trying to
+		// send to it.
+		select {
+		case <-w0.ResultChan():
+			w1.Stop()
+		case <-w1.ResultChan():
+			w0.Stop()
+		}
+		close(done)
+	}(w, w2)
+	m.Action(Added, &myType{})
+	select {
+	case <-time.After(wait.ForeverTestTimeout):
+		t.Error("timeout: deadlocked")
+	case <-done:
+	}
+	m.Shutdown()
+}
+
+func TestBroadcasterDropIfChannelFull(t *testing.T) {
+	m := NewBroadcaster(1, DropIfChannelFull)
+
+	event1 := Event{Type: Added, Object: &myType{"foo", "hello world 1"}}
+	event2 := Event{Type: Added, Object: &myType{"bar", "hello world 2"}}
+
+	// Add a couple watchers
+	watches := make([]Interface, 2)
+	var err error
+	for i := range watches {
+		watches[i], err = m.Watch()
+		if err != nil {
+			t.Fatalf("Unable start event watcher: '%v' (will not retry!)", err)
+		}
+	}
+
+	// Send a couple events before closing the broadcast channel.
+	t.Log("Sending event 1")
+	m.Action(event1.Type, event1.Object)
+	t.Log("Sending event 2")
+	m.Action(event2.Type, event2.Object)
+	m.Shutdown()
+
+	// Pull events from the queue.
+	wg := sync.WaitGroup{}
+	wg.Add(len(watches))
+	for i := range watches {
+		// Verify that each watcher only gets the first event because its watch
+		// queue of length one was full from the first one.
+		go func(watcher int, w Interface) {
+			defer wg.Done()
+			e1, ok := <-w.ResultChan()
+			if !ok {
+				t.Errorf("Watcher %v failed to retrieve first event.", watcher)
+			}
+			if e, a := event1, e1; !reflect.DeepEqual(e, a) {
+				t.Errorf("Watcher %v: Expected (%v, %#v), got (%v, %#v)",
+					watcher, e.Type, e.Object, a.Type, a.Object)
+			}
+			t.Logf("Got (%v, %#v)", e1.Type, e1.Object)
+			e2, ok := <-w.ResultChan()
+			if ok {
+				t.Errorf("Watcher %v received second event (%v, %#v) even though it shouldn't have.",
+					watcher, e2.Type, e2.Object)
+			}
+		}(i, watches[i])
+	}
+	wg.Wait()
+}
+
+func BenchmarkBroadCaster(b *testing.B) {
+	event1 := Event{Type: Added, Object: &myType{"foo", "hello world 1"}}
+	m := NewBroadcaster(0, WaitIfChannelFull)
+	b.ResetTimer()
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			m.Action(event1.Type, event1.Object)
+		}
+	})
+	b.StopTimer()
+}
+
+func TestBroadcasterWatchAfterShutdown(t *testing.T) {
+	event1 := Event{Type: Added, Object: &myType{"foo", "hello world 1"}}
+	event2 := Event{Type: Added, Object: &myType{"bar", "hello world 2"}}
+
+	m := NewBroadcaster(0, WaitIfChannelFull)
+	m.Shutdown()
+
+	_, err := m.Watch()
+	assert.EqualError(t, err, "broadcaster already stopped", "Watch should report error id broadcaster is shutdown")
+
+	_, err = m.WatchWithPrefix([]Event{event1, event2})
+	assert.EqualError(t, err, "broadcaster already stopped", "WatchWithPrefix should report error id broadcaster is shutdown")
+}
+
+func TestBroadcasterSendEventAfterShutdown(t *testing.T) {
+	m := NewBroadcaster(1, DropIfChannelFull)
+
+	event := Event{Type: Added, Object: &myType{"foo", "hello world"}}
+
+	// Add a couple watchers
+	watches := make([]Interface, 2)
+	for i := range watches {
+		watches[i], _ = m.Watch()
+	}
+	m.Shutdown()
+
+	// Send a couple events after closing the broadcast channel.
+	t.Log("Sending event")
+
+	err := m.Action(event.Type, event.Object)
+	assert.EqualError(t, err, "broadcaster already stopped", "ActionOrDrop should report error id broadcaster is shutdown")
+
+	sendOnClosed, err := m.ActionOrDrop(event.Type, event.Object)
+	assert.False(t, sendOnClosed, "ActionOrDrop should return false if broadcaster is already shutdown")
+	assert.EqualError(t, err, "broadcaster already stopped", "ActionOrDrop should report error id broadcaster is shutdown")
+}
+
+// Test this since we see usage patterns where the broadcaster and watchers are
+// stopped simultaneously leading to races.
+func TestBroadcasterShutdownRace(t *testing.T) {
+	m := NewBroadcaster(1, WaitIfChannelFull)
+	stopCh := make(chan struct{})
+
+	// Add a bunch of watchers
+	const testWatchers = 2
+	for i := 0; i < testWatchers; i++ {
+		i := i
+
+		_, err := m.Watch()
+		if err != nil {
+			t.Fatalf("Unable start event watcher: '%v' (will not retry!)", err)
+		}
+		// This is how we force the watchers to close down independently of the
+		// eventbroadcaster, see real usage pattern in startRecordingEvents()
+		go func() {
+			<-stopCh
+			t.Log("Stopping Watchers")
+			m.stopWatching(int64(i))
+		}()
+	}
+
+	event := Event{Type: Added, Object: &myType{"foo", "hello world"}}
+	err := m.Action(event.Type, event.Object)
+	if err != nil {
+		t.Fatalf("error sending event: %v", err)
+	}
+
+	// Manually simulate m.Shutdown() but change it to force a race scenario
+	// 1. Close watcher stopchannel, so watchers are closed independently of the
+	// eventBroadcaster
+	// 2. Shutdown the m.incoming slightly Before m.stopped so that the watcher's
+	// call of Blockqueue can pass the m.stopped check.
+	m.blockQueue(func() {
+		close(stopCh)
+		close(m.incoming)
+		time.Sleep(1 * time.Millisecond)
+		close(m.stopped)
+	})
+	m.distributing.Wait()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/watch/streamwatcher.go b/third_party/k8s.io/apimachinery/pkg/watch/streamwatcher.go
new file mode 100644
index 0000000000..b422ca9f55
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/watch/streamwatcher.go
@@ -0,0 +1,145 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch
+
+import (
+	"fmt"
+	"io"
+	"sync"
+
+	"k8s.io/klog/v2"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/net"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+// Decoder allows StreamWatcher to watch any stream for which a Decoder can be written.
+type Decoder interface {
+	// Decode should return the type of event, the decoded object, or an error.
+	// An error will cause StreamWatcher to call Close(). Decode should block until
+	// it has data or an error occurs.
+	Decode() (action EventType, object runtime.Object, err error)
+
+	// Close should close the underlying io.Reader, signalling to the source of
+	// the stream that it is no longer being watched. Close() must cause any
+	// outstanding call to Decode() to return with an error of some sort.
+	Close()
+}
+
+// Reporter hides the details of how an error is turned into a runtime.Object for
+// reporting on a watch stream since this package may not import a higher level report.
+type Reporter interface {
+	// AsObject must convert err into a valid runtime.Object for the watch stream.
+	AsObject(err error) runtime.Object
+}
+
+// StreamWatcher turns any stream for which you can write a Decoder interface
+// into a watch.Interface.
+type StreamWatcher struct {
+	logger klog.Logger
+	sync.Mutex
+	source   Decoder
+	reporter Reporter
+	result   chan Event
+	done     chan struct{}
+}
+
+// NewStreamWatcher creates a StreamWatcher from the given decoder.
+//
+// Contextual logging: NewStreamWatcherWithLogger should be used instead of NewStreamWatcher in code which supports contextual logging.
+func NewStreamWatcher(d Decoder, r Reporter) *StreamWatcher {
+	return NewStreamWatcherWithLogger(klog.Background(), d, r)
+}
+
+// NewStreamWatcherWithLogger creates a StreamWatcher from the given decoder and logger.
+func NewStreamWatcherWithLogger(logger klog.Logger, d Decoder, r Reporter) *StreamWatcher {
+	sw := &StreamWatcher{
+		logger:   logger,
+		source:   d,
+		reporter: r,
+		// It's easy for a consumer to add buffering via an extra
+		// goroutine/channel, but impossible for them to remove it,
+		// so nonbuffered is better.
+		result: make(chan Event),
+		// If the watcher is externally stopped there is no receiver anymore
+		// and the send operations on the result channel, especially the
+		// error reporting might block forever.
+		// Therefore a dedicated stop channel is used to resolve this blocking.
+		done: make(chan struct{}),
+	}
+	go sw.receive()
+	return sw
+}
+
+// ResultChan implements Interface.
+func (sw *StreamWatcher) ResultChan() <-chan Event {
+	return sw.result
+}
+
+// Stop implements Interface.
+func (sw *StreamWatcher) Stop() {
+	// Call Close() exactly once by locking and setting a flag.
+	sw.Lock()
+	defer sw.Unlock()
+	// closing a closed channel always panics, therefore check before closing
+	select {
+	case <-sw.done:
+	default:
+		close(sw.done)
+		sw.source.Close()
+	}
+}
+
+// receive reads result from the decoder in a loop and sends down the result channel.
+func (sw *StreamWatcher) receive() {
+	defer utilruntime.HandleCrashWithLogger(sw.logger)
+	defer close(sw.result)
+	defer sw.Stop()
+	for {
+		action, obj, err := sw.source.Decode()
+		if err != nil {
+			switch err {
+			case io.EOF:
+				// watch closed normally
+			case io.ErrUnexpectedEOF:
+				sw.logger.V(1).Info("Unexpected EOF during watch stream event decoding", "err", err)
+			default:
+				if net.IsProbableEOF(err) || net.IsTimeout(err) {
+					sw.logger.V(5).Info("Unable to decode an event from the watch stream", "err", err)
+				} else {
+					select {
+					case <-sw.done:
+					case sw.result <- Event{
+						Type:   Error,
+						Object: sw.reporter.AsObject(fmt.Errorf("unable to decode an event from the watch stream: %v", err)),
+					}:
+					}
+				}
+			}
+			return
+		}
+		select {
+		case <-sw.done:
+			return
+		case sw.result <- Event{
+			Type:   action,
+			Object: obj,
+		}:
+		}
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/watch/streamwatcher_test.go b/third_party/k8s.io/apimachinery/pkg/watch/streamwatcher_test.go
new file mode 100644
index 0000000000..e6f68f6679
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/watch/streamwatcher_test.go
@@ -0,0 +1,124 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch_test
+
+import (
+	"fmt"
+	"io"
+	"reflect"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	. "k8s.io/apimachinery/pkg/watch"
+)
+
+type fakeDecoder struct {
+	items chan Event
+	err   error
+}
+
+func (f fakeDecoder) Decode() (action EventType, object runtime.Object, err error) {
+	if f.err != nil {
+		return "", nil, f.err
+	}
+	item, open := <-f.items
+	if !open {
+		return action, nil, io.EOF
+	}
+	return item.Type, item.Object, nil
+}
+
+func (f fakeDecoder) Close() {
+	if f.items != nil {
+		close(f.items)
+	}
+}
+
+type fakeReporter struct {
+	err error
+}
+
+func (f *fakeReporter) AsObject(err error) runtime.Object {
+	f.err = err
+	return runtime.Unstructured(nil)
+}
+
+func TestStreamWatcher(t *testing.T) {
+	table := []Event{
+		{Type: Added, Object: testType("foo")},
+	}
+
+	fd := fakeDecoder{items: make(chan Event, 5)}
+	//nolint:logcheck // Intentionally uses the old API.
+	sw := NewStreamWatcher(fd, nil)
+
+	for _, item := range table {
+		fd.items <- item
+		got, open := <-sw.ResultChan()
+		if !open {
+			t.Errorf("unexpected early close")
+		}
+		if e, a := item, got; !reflect.DeepEqual(e, a) {
+			t.Errorf("expected %v, got %v", e, a)
+		}
+	}
+
+	sw.Stop()
+	_, open := <-sw.ResultChan()
+	if open {
+		t.Errorf("Unexpected failure to close")
+	}
+}
+
+func TestStreamWatcherError(t *testing.T) {
+	fd := fakeDecoder{err: fmt.Errorf("test error")}
+	fr := &fakeReporter{}
+	//nolint:logcheck // Intentionally uses the old API.
+	sw := NewStreamWatcher(fd, fr)
+	evt, ok := <-sw.ResultChan()
+	if !ok {
+		t.Fatalf("unexpected close")
+	}
+	if evt.Type != Error || evt.Object != runtime.Unstructured(nil) {
+		t.Fatalf("unexpected object: %#v", evt)
+	}
+	_, ok = <-sw.ResultChan()
+	if ok {
+		t.Fatalf("unexpected open channel")
+	}
+
+	sw.Stop()
+	_, ok = <-sw.ResultChan()
+	if ok {
+		t.Fatalf("unexpected open channel")
+	}
+}
+
+func TestStreamWatcherRace(t *testing.T) {
+	fd := fakeDecoder{err: fmt.Errorf("test error")}
+	fr := &fakeReporter{}
+	//nolint:logcheck // Intentionally uses the old API.
+	sw := NewStreamWatcher(fd, fr)
+	time.Sleep(10 * time.Millisecond)
+	sw.Stop()
+	time.Sleep(10 * time.Millisecond)
+	_, ok := <-sw.ResultChan()
+	if ok {
+		t.Fatalf("unexpected pending send")
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/watch/watch.go b/third_party/k8s.io/apimachinery/pkg/watch/watch.go
new file mode 100644
index 0000000000..251459834b
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/watch/watch.go
@@ -0,0 +1,377 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch
+
+import (
+	"fmt"
+	"sync"
+
+	"k8s.io/klog/v2"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/utils/ptr"
+)
+
+// Interface can be implemented by anything that knows how to watch and report changes.
+type Interface interface {
+	// Stop tells the producer that the consumer is done watching, so the
+	// producer should stop sending events and close the result channel. The
+	// consumer should keep watching for events until the result channel is
+	// closed.
+	//
+	// Because some implementations may create channels when constructed, Stop
+	// must always be called, even if the consumer has not yet called
+	// ResultChan().
+	//
+	// Only the consumer should call Stop(), not the producer. If the producer
+	// errors and needs to stop the watch prematurely, it should instead send
+	// an error event and close the result channel.
+	Stop()
+
+	// ResultChan returns a channel which will receive events from the event
+	// producer. If an error occurs or Stop() is called, the producer must
+	// close this channel and release any resources used by the watch.
+	// Closing the result channel tells the consumer that no more events will be
+	// sent.
+	ResultChan() <-chan Event
+}
+
+// EventType defines the possible types of events.
+type EventType string
+
+const (
+	Added    EventType = "ADDED"
+	Modified EventType = "MODIFIED"
+	Deleted  EventType = "DELETED"
+	Bookmark EventType = "BOOKMARK"
+	Error    EventType = "ERROR"
+)
+
+var (
+	DefaultChanSize int32 = 100
+)
+
+// Event represents a single event to a watched resource.
+// +k8s:deepcopy-gen=true
+type Event struct {
+	Type EventType
+
+	// Object is:
+	//  * If Type is Added or Modified: the new state of the object.
+	//  * If Type is Deleted: the state of the object immediately before deletion.
+	//  * If Type is Bookmark: the object (instance of a type being watched) where
+	//    only ResourceVersion field is set. On successful restart of watch from a
+	//    bookmark resourceVersion, client is guaranteed to not get repeat event
+	//    nor miss any events.
+	//  * If Type is Error: *api.Status is recommended; other types may make sense
+	//    depending on context.
+	Object runtime.Object
+}
+
+type emptyWatch chan Event
+
+// NewEmptyWatch returns a watch interface that returns no results and is closed.
+// May be used in certain error conditions where no information is available but
+// an error is not warranted.
+func NewEmptyWatch() Interface {
+	ch := make(chan Event)
+	close(ch)
+	return emptyWatch(ch)
+}
+
+// Stop implements Interface
+func (w emptyWatch) Stop() {
+}
+
+// ResultChan implements Interface
+func (w emptyWatch) ResultChan() <-chan Event {
+	return chan Event(w)
+}
+
+// FakeWatcher lets you test anything that consumes a watch.Interface; threadsafe.
+type FakeWatcher struct {
+	logger  klog.Logger
+	result  chan Event
+	stopped bool
+	sync.Mutex
+}
+
+var _ Interface = &FakeWatcher{}
+
+// Contextual logging: NewFakeWithOptions and a logger in the FakeOptions should be used instead in code which supports contextual logging.
+func NewFake() *FakeWatcher {
+	return NewFakeWithOptions(FakeOptions{})
+}
+
+// Contextual logging: NewFakeWithOptions and a logger in the FakeOptions should be used instead in code which supports contextual logging.
+func NewFakeWithChanSize(size int, blocking bool) *FakeWatcher {
+	return NewFakeWithOptions(FakeOptions{ChannelSize: size})
+}
+
+func NewFakeWithOptions(options FakeOptions) *FakeWatcher {
+	return &FakeWatcher{
+		logger: ptr.Deref(options.Logger, klog.Background()),
+		result: make(chan Event, options.ChannelSize),
+	}
+}
+
+type FakeOptions struct {
+	Logger      *klog.Logger
+	ChannelSize int
+}
+
+// Stop implements Interface.Stop().
+func (f *FakeWatcher) Stop() {
+	f.Lock()
+	defer f.Unlock()
+	if !f.stopped {
+		f.logger.V(4).Info("Stopping fake watcher")
+		close(f.result)
+		f.stopped = true
+	}
+}
+
+func (f *FakeWatcher) IsStopped() bool {
+	f.Lock()
+	defer f.Unlock()
+	return f.stopped
+}
+
+// Reset prepares the watcher to be reused.
+func (f *FakeWatcher) Reset() {
+	f.Lock()
+	defer f.Unlock()
+	f.stopped = false
+	f.result = make(chan Event)
+}
+
+func (f *FakeWatcher) ResultChan() <-chan Event {
+	return f.result
+}
+
+// Add sends an add event.
+func (f *FakeWatcher) Add(obj runtime.Object) {
+	f.result <- Event{Added, obj}
+}
+
+// Modify sends a modify event.
+func (f *FakeWatcher) Modify(obj runtime.Object) {
+	f.result <- Event{Modified, obj}
+}
+
+// Delete sends a delete event.
+func (f *FakeWatcher) Delete(lastValue runtime.Object) {
+	f.result <- Event{Deleted, lastValue}
+}
+
+// Error sends an Error event.
+func (f *FakeWatcher) Error(errValue runtime.Object) {
+	f.result <- Event{Error, errValue}
+}
+
+// Action sends an event of the requested type, for table-based testing.
+func (f *FakeWatcher) Action(action EventType, obj runtime.Object) {
+	f.result <- Event{action, obj}
+}
+
+// RaceFreeFakeWatcher lets you test anything that consumes a watch.Interface; threadsafe.
+type RaceFreeFakeWatcher struct {
+	logger  klog.Logger
+	result  chan Event
+	Stopped bool
+	sync.Mutex
+}
+
+var _ Interface = &RaceFreeFakeWatcher{}
+
+// Contextual logging: RaceFreeFakeWatcherWithLogger should be used instead of NewRaceFreeFake in code which supports contextual logging.
+func NewRaceFreeFake() *RaceFreeFakeWatcher {
+	return NewRaceFreeFakeWithLogger(klog.Background())
+}
+
+func NewRaceFreeFakeWithLogger(logger klog.Logger) *RaceFreeFakeWatcher {
+	return &RaceFreeFakeWatcher{
+		logger: logger,
+		result: make(chan Event, DefaultChanSize),
+	}
+}
+
+// Stop implements Interface.Stop().
+func (f *RaceFreeFakeWatcher) Stop() {
+	f.Lock()
+	defer f.Unlock()
+	if !f.Stopped {
+		f.logger.V(4).Info("Stopping fake watcher")
+		close(f.result)
+		f.Stopped = true
+	}
+}
+
+func (f *RaceFreeFakeWatcher) IsStopped() bool {
+	f.Lock()
+	defer f.Unlock()
+	return f.Stopped
+}
+
+// Reset prepares the watcher to be reused.
+func (f *RaceFreeFakeWatcher) Reset() {
+	f.Lock()
+	defer f.Unlock()
+	f.Stopped = false
+	f.result = make(chan Event, DefaultChanSize)
+}
+
+func (f *RaceFreeFakeWatcher) ResultChan() <-chan Event {
+	f.Lock()
+	defer f.Unlock()
+	return f.result
+}
+
+// Add sends an add event.
+func (f *RaceFreeFakeWatcher) Add(obj runtime.Object) {
+	f.Lock()
+	defer f.Unlock()
+	if !f.Stopped {
+		select {
+		case f.result <- Event{Added, obj}:
+			return
+		default:
+			panic(fmt.Errorf("channel full"))
+		}
+	}
+}
+
+// Modify sends a modify event.
+func (f *RaceFreeFakeWatcher) Modify(obj runtime.Object) {
+	f.Lock()
+	defer f.Unlock()
+	if !f.Stopped {
+		select {
+		case f.result <- Event{Modified, obj}:
+			return
+		default:
+			panic(fmt.Errorf("channel full"))
+		}
+	}
+}
+
+// Delete sends a delete event.
+func (f *RaceFreeFakeWatcher) Delete(lastValue runtime.Object) {
+	f.Lock()
+	defer f.Unlock()
+	if !f.Stopped {
+		select {
+		case f.result <- Event{Deleted, lastValue}:
+			return
+		default:
+			panic(fmt.Errorf("channel full"))
+		}
+	}
+}
+
+// Error sends an Error event.
+func (f *RaceFreeFakeWatcher) Error(errValue runtime.Object) {
+	f.Lock()
+	defer f.Unlock()
+	if !f.Stopped {
+		select {
+		case f.result <- Event{Error, errValue}:
+			return
+		default:
+			panic(fmt.Errorf("channel full"))
+		}
+	}
+}
+
+// Action sends an event of the requested type, for table-based testing.
+func (f *RaceFreeFakeWatcher) Action(action EventType, obj runtime.Object) {
+	f.Lock()
+	defer f.Unlock()
+	if !f.Stopped {
+		select {
+		case f.result <- Event{action, obj}:
+			return
+		default:
+			panic(fmt.Errorf("channel full"))
+		}
+	}
+}
+
+// ProxyWatcher lets you wrap your channel in watch Interface. threadsafe.
+type ProxyWatcher struct {
+	result chan Event
+	stopCh chan struct{}
+
+	mutex   sync.Mutex
+	stopped bool
+}
+
+var _ Interface = &ProxyWatcher{}
+
+// NewProxyWatcher creates new ProxyWatcher by wrapping a channel
+func NewProxyWatcher(ch chan Event) *ProxyWatcher {
+	return &ProxyWatcher{
+		result:  ch,
+		stopCh:  make(chan struct{}),
+		stopped: false,
+	}
+}
+
+// Stop implements Interface
+func (pw *ProxyWatcher) Stop() {
+	pw.mutex.Lock()
+	defer pw.mutex.Unlock()
+	if !pw.stopped {
+		pw.stopped = true
+		close(pw.stopCh)
+	}
+}
+
+// Stopping returns true if Stop() has been called
+func (pw *ProxyWatcher) Stopping() bool {
+	pw.mutex.Lock()
+	defer pw.mutex.Unlock()
+	return pw.stopped
+}
+
+// ResultChan implements Interface
+func (pw *ProxyWatcher) ResultChan() <-chan Event {
+	return pw.result
+}
+
+// StopChan returns stop channel
+func (pw *ProxyWatcher) StopChan() <-chan struct{} {
+	return pw.stopCh
+}
+
+// MockWatcher implements watch.Interface with mockable functions.
+type MockWatcher struct {
+	StopFunc       func()
+	ResultChanFunc func() <-chan Event
+}
+
+var _ Interface = &MockWatcher{}
+
+// Stop calls StopFunc
+func (mw MockWatcher) Stop() {
+	mw.StopFunc()
+}
+
+// ResultChan calls ResultChanFunc
+func (mw MockWatcher) ResultChan() <-chan Event {
+	return mw.ResultChanFunc()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/watch/watch_test.go b/third_party/k8s.io/apimachinery/pkg/watch/watch_test.go
new file mode 100644
index 0000000000..4fb159b0dd
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/watch/watch_test.go
@@ -0,0 +1,175 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package watch_test
+
+import (
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	. "k8s.io/apimachinery/pkg/watch"
+)
+
+type testType string
+
+func (obj testType) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+func (obj testType) DeepCopyObject() runtime.Object   { return obj }
+
+func TestFake(t *testing.T) {
+	f := NewFake()
+
+	table := []struct {
+		t EventType
+		s testType
+	}{
+		{Added, testType("foo")},
+		{Modified, testType("qux")},
+		{Modified, testType("bar")},
+		{Deleted, testType("bar")},
+		{Error, testType("error: blah")},
+	}
+
+	// Prove that f implements Interface by phrasing this as a function.
+	consumer := func(w Interface) {
+		for _, expect := range table {
+			got, ok := <-w.ResultChan()
+			if !ok {
+				t.Fatalf("closed early")
+			}
+			if e, a := expect.t, got.Type; e != a {
+				t.Fatalf("Expected %v, got %v", e, a)
+			}
+			if a, ok := got.Object.(testType); !ok || a != expect.s {
+				t.Fatalf("Expected %v, got %v", expect.s, a)
+			}
+		}
+		_, stillOpen := <-w.ResultChan()
+		if stillOpen {
+			t.Fatal("Never stopped")
+		}
+	}
+
+	sender := func() {
+		f.Add(testType("foo"))
+		f.Action(Modified, testType("qux"))
+		f.Modify(testType("bar"))
+		f.Delete(testType("bar"))
+		f.Error(testType("error: blah"))
+		f.Stop()
+	}
+
+	go sender()
+	consumer(f)
+}
+
+func TestRaceFreeFake(t *testing.T) {
+	f := NewRaceFreeFake()
+
+	table := []struct {
+		t EventType
+		s testType
+	}{
+		{Added, testType("foo")},
+		{Modified, testType("qux")},
+		{Modified, testType("bar")},
+		{Deleted, testType("bar")},
+		{Error, testType("error: blah")},
+	}
+
+	// Prove that f implements Interface by phrasing this as a function.
+	consumer := func(w Interface) {
+		for _, expect := range table {
+			got, ok := <-w.ResultChan()
+			if !ok {
+				t.Fatalf("closed early")
+			}
+			if e, a := expect.t, got.Type; e != a {
+				t.Fatalf("Expected %v, got %v", e, a)
+			}
+			if a, ok := got.Object.(testType); !ok || a != expect.s {
+				t.Fatalf("Expected %v, got %v", expect.s, a)
+			}
+		}
+		_, stillOpen := <-w.ResultChan()
+		if stillOpen {
+			t.Fatal("Never stopped")
+		}
+	}
+
+	sender := func() {
+		f.Add(testType("foo"))
+		f.Action(Modified, testType("qux"))
+		f.Modify(testType("bar"))
+		f.Delete(testType("bar"))
+		f.Error(testType("error: blah"))
+		f.Stop()
+	}
+
+	go sender()
+	consumer(f)
+}
+
+func TestEmpty(t *testing.T) {
+	w := NewEmptyWatch()
+	_, ok := <-w.ResultChan()
+	if ok {
+		t.Errorf("unexpected result channel result")
+	}
+	w.Stop()
+	_, ok = <-w.ResultChan()
+	if ok {
+		t.Errorf("unexpected result channel result")
+	}
+}
+
+func TestProxyWatcher(t *testing.T) {
+	events := []Event{
+		{Added, testType("foo")},
+		{Modified, testType("qux")},
+		{Modified, testType("bar")},
+		{Deleted, testType("bar")},
+		{Error, testType("error: blah")},
+	}
+
+	ch := make(chan Event, len(events))
+	w := NewProxyWatcher(ch)
+
+	for _, e := range events {
+		ch <- e
+	}
+
+	for _, e := range events {
+		g := <-w.ResultChan()
+		if !reflect.DeepEqual(e, g) {
+			t.Errorf("Expected %#v, got %#v", e, g)
+			continue
+		}
+	}
+
+	w.Stop()
+
+	select {
+	// Closed channel always reads immediately
+	case <-w.StopChan():
+	default:
+		t.Error("Channel isn't closed")
+	}
+
+	// Test double close
+	w.Stop()
+}
diff --git a/third_party/k8s.io/apimachinery/pkg/watch/zz_generated.deepcopy.go b/third_party/k8s.io/apimachinery/pkg/watch/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..dd27d4526f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/pkg/watch/zz_generated.deepcopy.go
@@ -0,0 +1,41 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package watch
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Event) DeepCopyInto(out *Event) {
+	*out = *in
+	if in.Object != nil {
+		out.Object = in.Object.DeepCopyObject()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Event.
+func (in *Event) DeepCopy() *Event {
+	if in == nil {
+		return nil
+	}
+	out := new(Event)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/third_party/k8s.io/apimachinery/third_party/forked/golang/LICENSE b/third_party/k8s.io/apimachinery/third_party/forked/golang/LICENSE
new file mode 100644
index 0000000000..6a66aea5ea
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/third_party/forked/golang/LICENSE
@@ -0,0 +1,27 @@
+Copyright (c) 2009 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/third_party/k8s.io/apimachinery/third_party/forked/golang/PATENTS b/third_party/k8s.io/apimachinery/third_party/forked/golang/PATENTS
new file mode 100644
index 0000000000..733099041f
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/third_party/forked/golang/PATENTS
@@ -0,0 +1,22 @@
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
diff --git a/third_party/k8s.io/apimachinery/third_party/forked/golang/json/OWNERS b/third_party/k8s.io/apimachinery/third_party/forked/golang/json/OWNERS
new file mode 100644
index 0000000000..349bc69d65
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/third_party/forked/golang/json/OWNERS
@@ -0,0 +1,6 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+  - pwittrock
+reviewers:
+  - apelisse
diff --git a/third_party/k8s.io/apimachinery/third_party/forked/golang/json/fields.go b/third_party/k8s.io/apimachinery/third_party/forked/golang/json/fields.go
new file mode 100644
index 0000000000..5b8514b3fa
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/third_party/forked/golang/json/fields.go
@@ -0,0 +1,513 @@
+// Copyright 2013 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package json is forked from the Go standard library to enable us to find the
+// field of a struct that a given JSON key maps to.
+package json
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"sort"
+	"strings"
+	"sync"
+	"unicode"
+	"unicode/utf8"
+)
+
+const (
+	patchStrategyTagKey = "patchStrategy"
+	patchMergeKeyTagKey = "patchMergeKey"
+)
+
+// Finds the patchStrategy and patchMergeKey struct tag fields on a given
+// struct field given the struct type and the JSON name of the field.
+// It returns field type, a slice of patch strategies, merge key and error.
+// TODO: fix the returned errors to be introspectable.
+func LookupPatchMetadataForStruct(t reflect.Type, jsonField string) (
+	elemType reflect.Type, patchStrategies []string, patchMergeKey string, e error) {
+	if t.Kind() == reflect.Pointer {
+		t = t.Elem()
+	}
+
+	if t.Kind() != reflect.Struct {
+		e = fmt.Errorf("merging an object in json but data type is not struct, instead is: %s",
+			t.Kind().String())
+		return
+	}
+	jf := []byte(jsonField)
+	// Find the field that the JSON library would use.
+	var f *field
+	fields := cachedTypeFields(t)
+	for i := range fields {
+		ff := &fields[i]
+		if bytes.Equal(ff.nameBytes, jf) {
+			f = ff
+			break
+		}
+		// Do case-insensitive comparison.
+		if f == nil && ff.equalFold(ff.nameBytes, jf) {
+			f = ff
+		}
+	}
+	if f != nil {
+		// Find the reflect.Value of the most preferential struct field.
+		tjf := t.Field(f.index[0])
+		// we must navigate down all the anonymously included structs in the chain
+		for i := 1; i < len(f.index); i++ {
+			tjf = tjf.Type.Field(f.index[i])
+		}
+		patchStrategy := tjf.Tag.Get(patchStrategyTagKey)
+		patchMergeKey = tjf.Tag.Get(patchMergeKeyTagKey)
+		patchStrategies = strings.Split(patchStrategy, ",")
+		elemType = tjf.Type
+		return
+	}
+	e = fmt.Errorf("unable to find api field in struct %s for the json field %q", t.Name(), jsonField)
+	return
+}
+
+// A field represents a single field found in a struct.
+type field struct {
+	name      string
+	nameBytes []byte                 // []byte(name)
+	equalFold func(s, t []byte) bool // bytes.EqualFold or equivalent
+
+	tag bool
+	// index is the sequence of indexes from the containing type fields to this field.
+	// it is a slice because anonymous structs will need multiple navigation steps to correctly
+	// resolve the proper fields
+	index     []int
+	typ       reflect.Type
+	omitEmpty bool
+	quoted    bool
+}
+
+func (f field) String() string {
+	return fmt.Sprintf("{name: %s, type: %v, tag: %v, index: %v, omitEmpty: %v, quoted: %v}", f.name, f.typ, f.tag, f.index, f.omitEmpty, f.quoted)
+}
+
+func fillField(f field) field {
+	f.nameBytes = []byte(f.name)
+	f.equalFold = foldFunc(f.nameBytes)
+	return f
+}
+
+// byName sorts field by name, breaking ties with depth,
+// then breaking ties with "name came from json tag", then
+// breaking ties with index sequence.
+type byName []field
+
+func (x byName) Len() int { return len(x) }
+
+func (x byName) Swap(i, j int) { x[i], x[j] = x[j], x[i] }
+
+func (x byName) Less(i, j int) bool {
+	if x[i].name != x[j].name {
+		return x[i].name < x[j].name
+	}
+	if len(x[i].index) != len(x[j].index) {
+		return len(x[i].index) < len(x[j].index)
+	}
+	if x[i].tag != x[j].tag {
+		return x[i].tag
+	}
+	return byIndex(x).Less(i, j)
+}
+
+// byIndex sorts field by index sequence.
+type byIndex []field
+
+func (x byIndex) Len() int { return len(x) }
+
+func (x byIndex) Swap(i, j int) { x[i], x[j] = x[j], x[i] }
+
+func (x byIndex) Less(i, j int) bool {
+	for k, xik := range x[i].index {
+		if k >= len(x[j].index) {
+			return false
+		}
+		if xik != x[j].index[k] {
+			return xik < x[j].index[k]
+		}
+	}
+	return len(x[i].index) < len(x[j].index)
+}
+
+// typeFields returns a list of fields that JSON should recognize for the given type.
+// The algorithm is breadth-first search over the set of structs to include - the top struct
+// and then any reachable anonymous structs.
+func typeFields(t reflect.Type) []field {
+	// Anonymous fields to explore at the current level and the next.
+	current := []field{}
+	next := []field{{typ: t}}
+
+	// Count of queued names for current level and the next.
+	count := map[reflect.Type]int{}
+	nextCount := map[reflect.Type]int{}
+
+	// Types already visited at an earlier level.
+	visited := map[reflect.Type]bool{}
+
+	// Fields found.
+	var fields []field
+
+	for len(next) > 0 {
+		current, next = next, current[:0]
+		count, nextCount = nextCount, map[reflect.Type]int{}
+
+		for _, f := range current {
+			if visited[f.typ] {
+				continue
+			}
+			visited[f.typ] = true
+
+			// Scan f.typ for fields to include.
+			for i := 0; i < f.typ.NumField(); i++ {
+				sf := f.typ.Field(i)
+				if sf.PkgPath != "" { // unexported
+					continue
+				}
+				tag := sf.Tag.Get("json")
+				if tag == "-" {
+					continue
+				}
+				name, opts := parseTag(tag)
+				if !isValidTag(name) {
+					name = ""
+				}
+				index := make([]int, len(f.index)+1)
+				copy(index, f.index)
+				index[len(f.index)] = i
+
+				ft := sf.Type
+				if ft.Name() == "" && ft.Kind() == reflect.Pointer {
+					// Follow pointer.
+					ft = ft.Elem()
+				}
+
+				// Record found field and index sequence.
+				if name != "" || !sf.Anonymous || ft.Kind() != reflect.Struct {
+					tagged := name != ""
+					if name == "" {
+						name = sf.Name
+					}
+					fields = append(fields, fillField(field{
+						name:      name,
+						tag:       tagged,
+						index:     index,
+						typ:       ft,
+						omitEmpty: opts.Contains("omitempty"),
+						quoted:    opts.Contains("string"),
+					}))
+					if count[f.typ] > 1 {
+						// If there were multiple instances, add a second,
+						// so that the annihilation code will see a duplicate.
+						// It only cares about the distinction between 1 or 2,
+						// so don't bother generating any more copies.
+						fields = append(fields, fields[len(fields)-1])
+					}
+					continue
+				}
+
+				// Record new anonymous struct to explore in next round.
+				nextCount[ft]++
+				if nextCount[ft] == 1 {
+					next = append(next, fillField(field{name: ft.Name(), index: index, typ: ft}))
+				}
+			}
+		}
+	}
+
+	sort.Sort(byName(fields))
+
+	// Delete all fields that are hidden by the Go rules for embedded fields,
+	// except that fields with JSON tags are promoted.
+
+	// The fields are sorted in primary order of name, secondary order
+	// of field index length. Loop over names; for each name, delete
+	// hidden fields by choosing the one dominant field that survives.
+	out := fields[:0]
+	for advance, i := 0, 0; i < len(fields); i += advance {
+		// One iteration per name.
+		// Find the sequence of fields with the name of this first field.
+		fi := fields[i]
+		name := fi.name
+		for advance = 1; i+advance < len(fields); advance++ {
+			fj := fields[i+advance]
+			if fj.name != name {
+				break
+			}
+		}
+		if advance == 1 { // Only one field with this name
+			out = append(out, fi)
+			continue
+		}
+		dominant, ok := dominantField(fields[i : i+advance])
+		if ok {
+			out = append(out, dominant)
+		}
+	}
+
+	fields = out
+	sort.Sort(byIndex(fields))
+
+	return fields
+}
+
+// dominantField looks through the fields, all of which are known to
+// have the same name, to find the single field that dominates the
+// others using Go's embedding rules, modified by the presence of
+// JSON tags. If there are multiple top-level fields, the boolean
+// will be false: This condition is an error in Go and we skip all
+// the fields.
+func dominantField(fields []field) (field, bool) {
+	// The fields are sorted in increasing index-length order. The winner
+	// must therefore be one with the shortest index length. Drop all
+	// longer entries, which is easy: just truncate the slice.
+	length := len(fields[0].index)
+	tagged := -1 // Index of first tagged field.
+	for i, f := range fields {
+		if len(f.index) > length {
+			fields = fields[:i]
+			break
+		}
+		if f.tag {
+			if tagged >= 0 {
+				// Multiple tagged fields at the same level: conflict.
+				// Return no field.
+				return field{}, false
+			}
+			tagged = i
+		}
+	}
+	if tagged >= 0 {
+		return fields[tagged], true
+	}
+	// All remaining fields have the same length. If there's more than one,
+	// we have a conflict (two fields named "X" at the same level) and we
+	// return no field.
+	if len(fields) > 1 {
+		return field{}, false
+	}
+	return fields[0], true
+}
+
+var fieldCache struct {
+	sync.RWMutex
+	m map[reflect.Type][]field
+}
+
+// cachedTypeFields is like typeFields but uses a cache to avoid repeated work.
+func cachedTypeFields(t reflect.Type) []field {
+	fieldCache.RLock()
+	f := fieldCache.m[t]
+	fieldCache.RUnlock()
+	if f != nil {
+		return f
+	}
+
+	// Compute fields without lock.
+	// Might duplicate effort but won't hold other computations back.
+	f = typeFields(t)
+	if f == nil {
+		f = []field{}
+	}
+
+	fieldCache.Lock()
+	if fieldCache.m == nil {
+		fieldCache.m = map[reflect.Type][]field{}
+	}
+	fieldCache.m[t] = f
+	fieldCache.Unlock()
+	return f
+}
+
+func isValidTag(s string) bool {
+	if s == "" {
+		return false
+	}
+	for _, c := range s {
+		switch {
+		case strings.ContainsRune("!#$%&()*+-./:<=>?@[]^_{|}~ ", c):
+			// Backslash and quote chars are reserved, but
+			// otherwise any punctuation chars are allowed
+			// in a tag name.
+		default:
+			if !unicode.IsLetter(c) && !unicode.IsDigit(c) {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+const (
+	caseMask     = ^byte(0x20) // Mask to ignore case in ASCII.
+	kelvin       = '\u212a'
+	smallLongEss = '\u017f'
+)
+
+// foldFunc returns one of four different case folding equivalence
+// functions, from most general (and slow) to fastest:
+//
+// 1) bytes.EqualFold, if the key s contains any non-ASCII UTF-8
+// 2) equalFoldRight, if s contains special folding ASCII ('k', 'K', 's', 'S')
+// 3) asciiEqualFold, no special, but includes non-letters (including _)
+// 4) simpleLetterEqualFold, no specials, no non-letters.
+//
+// The letters S and K are special because they map to 3 runes, not just 2:
+//  * S maps to s and to U+017F 'ſ' Latin small letter long s
+//  * k maps to K and to U+212A 'K' Kelvin sign
+// See http://play.golang.org/p/tTxjOc0OGo
+//
+// The returned function is specialized for matching against s and
+// should only be given s. It's not curried for performance reasons.
+func foldFunc(s []byte) func(s, t []byte) bool {
+	nonLetter := false
+	special := false // special letter
+	for _, b := range s {
+		if b >= utf8.RuneSelf {
+			return bytes.EqualFold
+		}
+		upper := b & caseMask
+		if upper < 'A' || upper > 'Z' {
+			nonLetter = true
+		} else if upper == 'K' || upper == 'S' {
+			// See above for why these letters are special.
+			special = true
+		}
+	}
+	if special {
+		return equalFoldRight
+	}
+	if nonLetter {
+		return asciiEqualFold
+	}
+	return simpleLetterEqualFold
+}
+
+// equalFoldRight is a specialization of bytes.EqualFold when s is
+// known to be all ASCII (including punctuation), but contains an 's',
+// 'S', 'k', or 'K', requiring a Unicode fold on the bytes in t.
+// See comments on foldFunc.
+func equalFoldRight(s, t []byte) bool {
+	for _, sb := range s {
+		if len(t) == 0 {
+			return false
+		}
+		tb := t[0]
+		if tb < utf8.RuneSelf {
+			if sb != tb {
+				sbUpper := sb & caseMask
+				if 'A' <= sbUpper && sbUpper <= 'Z' {
+					if sbUpper != tb&caseMask {
+						return false
+					}
+				} else {
+					return false
+				}
+			}
+			t = t[1:]
+			continue
+		}
+		// sb is ASCII and t is not. t must be either kelvin
+		// sign or long s; sb must be s, S, k, or K.
+		tr, size := utf8.DecodeRune(t)
+		switch sb {
+		case 's', 'S':
+			if tr != smallLongEss {
+				return false
+			}
+		case 'k', 'K':
+			if tr != kelvin {
+				return false
+			}
+		default:
+			return false
+		}
+		t = t[size:]
+
+	}
+	if len(t) > 0 {
+		return false
+	}
+	return true
+}
+
+// asciiEqualFold is a specialization of bytes.EqualFold for use when
+// s is all ASCII (but may contain non-letters) and contains no
+// special-folding letters.
+// See comments on foldFunc.
+func asciiEqualFold(s, t []byte) bool {
+	if len(s) != len(t) {
+		return false
+	}
+	for i, sb := range s {
+		tb := t[i]
+		if sb == tb {
+			continue
+		}
+		if ('a' <= sb && sb <= 'z') || ('A' <= sb && sb <= 'Z') {
+			if sb&caseMask != tb&caseMask {
+				return false
+			}
+		} else {
+			return false
+		}
+	}
+	return true
+}
+
+// simpleLetterEqualFold is a specialization of bytes.EqualFold for
+// use when s is all ASCII letters (no underscores, etc) and also
+// doesn't contain 'k', 'K', 's', or 'S'.
+// See comments on foldFunc.
+func simpleLetterEqualFold(s, t []byte) bool {
+	if len(s) != len(t) {
+		return false
+	}
+	for i, b := range s {
+		if b&caseMask != t[i]&caseMask {
+			return false
+		}
+	}
+	return true
+}
+
+// tagOptions is the string following a comma in a struct field's "json"
+// tag, or the empty string. It does not include the leading comma.
+type tagOptions string
+
+// parseTag splits a struct field's json tag into its name and
+// comma-separated options.
+func parseTag(tag string) (string, tagOptions) {
+	if idx := strings.Index(tag, ","); idx != -1 {
+		return tag[:idx], tagOptions(tag[idx+1:])
+	}
+	return tag, tagOptions("")
+}
+
+// Contains reports whether a comma-separated list of options
+// contains a particular substr flag. substr must be surrounded by a
+// string boundary or commas.
+func (o tagOptions) Contains(optionName string) bool {
+	if len(o) == 0 {
+		return false
+	}
+	s := string(o)
+	for s != "" {
+		var next string
+		i := strings.Index(s, ",")
+		if i >= 0 {
+			s, next = s[:i], s[i+1:]
+		}
+		if s == optionName {
+			return true
+		}
+		s = next
+	}
+	return false
+}
diff --git a/third_party/k8s.io/apimachinery/third_party/forked/golang/json/fields_test.go b/third_party/k8s.io/apimachinery/third_party/forked/golang/json/fields_test.go
new file mode 100644
index 0000000000..33b78bc43c
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/third_party/forked/golang/json/fields_test.go
@@ -0,0 +1,30 @@
+package json
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestLookupPtrToStruct(t *testing.T) {
+	type Elem struct {
+		Key   string
+		Value string
+	}
+	type Outer struct {
+		Inner []Elem `json:"inner" patchStrategy:"merge" patchMergeKey:"key"`
+	}
+	outer := &Outer{}
+	elemType, patchStrategies, patchMergeKey, err := LookupPatchMetadataForStruct(reflect.TypeOf(outer), "inner")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if elemType != reflect.TypeOf([]Elem{}) {
+		t.Errorf("elemType = %v, want: %v", elemType, reflect.TypeOf([]Elem{}))
+	}
+	if !reflect.DeepEqual(patchStrategies, []string{"merge"}) {
+		t.Errorf("patchStrategies = %v, want: %v", patchStrategies, []string{"merge"})
+	}
+	if patchMergeKey != "key" {
+		t.Errorf("patchMergeKey = %v, want: %v", patchMergeKey, "key")
+	}
+}
diff --git a/third_party/k8s.io/apimachinery/third_party/forked/golang/netutil/addr.go b/third_party/k8s.io/apimachinery/third_party/forked/golang/netutil/addr.go
new file mode 100644
index 0000000000..bd26f427e3
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/third_party/forked/golang/netutil/addr.go
@@ -0,0 +1,28 @@
+package netutil
+
+import (
+	"net/url"
+	"strings"
+)
+
+// FROM: http://golang.org/src/net/http/client.go
+// Given a string of the form "host", "host:port", or "[ipv6::address]:port",
+// return true if the string includes a port.
+func hasPort(s string) bool { return strings.LastIndex(s, ":") > strings.LastIndex(s, "]") }
+
+// FROM: http://golang.org/src/net/http/transport.go
+var portMap = map[string]string{
+	"http":   "80",
+	"https":  "443",
+	"socks5": "1080",
+}
+
+// FROM: http://golang.org/src/net/http/transport.go
+// canonicalAddr returns url.Host but always with a ":port" suffix
+func CanonicalAddr(url *url.URL) string {
+	addr := url.Host
+	if !hasPort(addr) {
+		return addr + ":" + portMap[url.Scheme]
+	}
+	return addr
+}
diff --git a/third_party/k8s.io/apimachinery/third_party/forked/golang/reflect/deep_equal.go b/third_party/k8s.io/apimachinery/third_party/forked/golang/reflect/deep_equal.go
new file mode 100644
index 0000000000..bb0fa55f21
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/third_party/forked/golang/reflect/deep_equal.go
@@ -0,0 +1,434 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package reflect is a fork of go's standard library reflection package, which
+// allows for deep equal with equality functions defined.
+package reflect
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+)
+
+// Equalities is a map from type to a function comparing two values of
+// that type.
+type Equalities map[reflect.Type]reflect.Value
+
+// For convenience, panics on errors
+func EqualitiesOrDie(funcs ...interface{}) Equalities {
+	e := Equalities{}
+	if err := e.AddFuncs(funcs...); err != nil {
+		panic(err)
+	}
+	return e
+}
+
+// AddFuncs is a shortcut for multiple calls to AddFunc.
+func (e Equalities) AddFuncs(funcs ...interface{}) error {
+	for _, f := range funcs {
+		if err := e.AddFunc(f); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// AddFunc uses func as an equality function: it must take
+// two parameters of the same type, and return a boolean.
+func (e Equalities) AddFunc(eqFunc interface{}) error {
+	fv := reflect.ValueOf(eqFunc)
+	ft := fv.Type()
+	if ft.Kind() != reflect.Func {
+		return fmt.Errorf("expected func, got: %v", ft)
+	}
+	if ft.NumIn() != 2 {
+		return fmt.Errorf("expected two 'in' params, got: %v", ft)
+	}
+	if ft.NumOut() != 1 {
+		return fmt.Errorf("expected one 'out' param, got: %v", ft)
+	}
+	if ft.In(0) != ft.In(1) {
+		return fmt.Errorf("expected arg 1 and 2 to have same type, but got %v", ft)
+	}
+	var forReturnType bool
+	boolType := reflect.TypeOf(forReturnType)
+	if ft.Out(0) != boolType {
+		return fmt.Errorf("expected bool return, got: %v", ft)
+	}
+	e[ft.In(0)] = fv
+	return nil
+}
+
+// Below here is forked from go's reflect/deepequal.go
+
+// During deepValueEqual, must keep track of checks that are
+// in progress.  The comparison algorithm assumes that all
+// checks in progress are true when it reencounters them.
+// Visited comparisons are stored in a map indexed by visit.
+type visit struct {
+	a1  uintptr
+	a2  uintptr
+	typ reflect.Type
+}
+
+// unexportedTypePanic is thrown when you use this DeepEqual on something that has an
+// unexported type. It indicates a programmer error, so should not occur at runtime,
+// which is why it's not public and thus impossible to catch.
+type unexportedTypePanic []reflect.Type
+
+func (u unexportedTypePanic) Error() string { return u.String() }
+func (u unexportedTypePanic) String() string {
+	strs := make([]string, len(u))
+	for i, t := range u {
+		strs[i] = fmt.Sprintf("%v", t)
+	}
+	return "an unexported field was encountered, nested like this: " + strings.Join(strs, " -> ")
+}
+
+func makeUsefulPanic(v reflect.Value) {
+	if x := recover(); x != nil {
+		if u, ok := x.(unexportedTypePanic); ok {
+			u = append(unexportedTypePanic{v.Type()}, u...)
+			x = u
+		}
+		panic(x)
+	}
+}
+
+// Tests for deep equality using reflected types. The map argument tracks
+// comparisons that have already been seen, which allows short circuiting on
+// recursive types.
+// equateNilAndEmpty controls whether empty maps/slices are equivalent to nil
+func (e Equalities) deepValueEqual(v1, v2 reflect.Value, visited map[visit]bool, equateNilAndEmpty bool, depth int) bool {
+	defer makeUsefulPanic(v1)
+
+	if !v1.IsValid() || !v2.IsValid() {
+		return v1.IsValid() == v2.IsValid()
+	}
+	if v1.Type() != v2.Type() {
+		return false
+	}
+	if fv, ok := e[v1.Type()]; ok {
+		return fv.Call([]reflect.Value{v1, v2})[0].Bool()
+	}
+
+	hard := func(k reflect.Kind) bool {
+		switch k {
+		case reflect.Array, reflect.Map, reflect.Slice, reflect.Struct:
+			return true
+		}
+		return false
+	}
+
+	if v1.CanAddr() && v2.CanAddr() && hard(v1.Kind()) {
+		addr1 := v1.UnsafeAddr()
+		addr2 := v2.UnsafeAddr()
+		if addr1 > addr2 {
+			// Canonicalize order to reduce number of entries in visited.
+			addr1, addr2 = addr2, addr1
+		}
+
+		// Short circuit if references are identical ...
+		if addr1 == addr2 {
+			return true
+		}
+
+		// ... or already seen
+		typ := v1.Type()
+		v := visit{addr1, addr2, typ}
+		if visited[v] {
+			return true
+		}
+
+		// Remember for later.
+		visited[v] = true
+	}
+
+	switch v1.Kind() {
+	case reflect.Array:
+		// We don't need to check length here because length is part of
+		// an array's type, which has already been filtered for.
+		for i := 0; i < v1.Len(); i++ {
+			if !e.deepValueEqual(v1.Index(i), v2.Index(i), visited, equateNilAndEmpty, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.Slice:
+		if equateNilAndEmpty {
+			if (v1.IsNil() || v1.Len() == 0) != (v2.IsNil() || v2.Len() == 0) {
+				return false
+			}
+
+			if v1.IsNil() || v1.Len() == 0 {
+				return true
+			}
+		} else {
+			if v1.IsNil() != v2.IsNil() {
+				return false
+			}
+
+			// Optimize nil and empty cases
+			// Two lists that are BOTH nil are equal
+			// No need to check v2 is nil since v1.IsNil == v2.IsNil from above
+			if v1.IsNil() {
+				return true
+			}
+
+			// Two lists that are both empty and both non nil are equal
+			if v1.Len() == 0 && v2.Len() == 0 {
+				return true
+			}
+		}
+		if v1.Len() != v2.Len() {
+			return false
+		}
+		if v1.Pointer() == v2.Pointer() {
+			return true
+		}
+		for i := 0; i < v1.Len(); i++ {
+			if !e.deepValueEqual(v1.Index(i), v2.Index(i), visited, equateNilAndEmpty, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.Interface:
+		if v1.IsNil() || v2.IsNil() {
+			return v1.IsNil() == v2.IsNil()
+		}
+		return e.deepValueEqual(v1.Elem(), v2.Elem(), visited, equateNilAndEmpty, depth+1)
+	case reflect.Ptr:
+		return e.deepValueEqual(v1.Elem(), v2.Elem(), visited, equateNilAndEmpty, depth+1)
+	case reflect.Struct:
+		for i, n := 0, v1.NumField(); i < n; i++ {
+			if !e.deepValueEqual(v1.Field(i), v2.Field(i), visited, equateNilAndEmpty, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.Map:
+		if equateNilAndEmpty {
+			if (v1.IsNil() || v1.Len() == 0) != (v2.IsNil() || v2.Len() == 0) {
+				return false
+			}
+			if v1.IsNil() || v1.Len() == 0 {
+				return true
+			}
+		} else {
+			if v1.IsNil() != v2.IsNil() {
+				return false
+			}
+
+			// Optimize nil and empty cases
+			// Two maps that are BOTH nil are equal
+			// No need to check v2 is nil since v1.IsNil == v2.IsNil from above
+			if v1.IsNil() {
+				return true
+			}
+
+			// Two maps that are both empty and both non nil are equal
+			if v1.Len() == 0 && v2.Len() == 0 {
+				return true
+			}
+		}
+		if v1.Len() != v2.Len() {
+			return false
+		}
+		if v1.Pointer() == v2.Pointer() {
+			return true
+		}
+		for _, k := range v1.MapKeys() {
+			if !e.deepValueEqual(v1.MapIndex(k), v2.MapIndex(k), visited, equateNilAndEmpty, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.Func:
+		if v1.IsNil() && v2.IsNil() {
+			return true
+		}
+		// Can't do better than this:
+		return false
+	default:
+		// Normal equality suffices
+		if !v1.CanInterface() || !v2.CanInterface() {
+			panic(unexportedTypePanic{})
+		}
+		return v1.Interface() == v2.Interface()
+	}
+}
+
+// DeepEqual is like reflect.DeepEqual, but focused on semantic equality
+// instead of memory equality.
+//
+// It will use e's equality functions if it finds types that match.
+//
+// An empty slice *is* equal to a nil slice for our purposes; same for maps.
+//
+// Unexported field members cannot be compared and will cause an informative panic; you must add an Equality
+// function for these types.
+func (e Equalities) DeepEqual(a1, a2 interface{}) bool {
+	return e.deepEqual(a1, a2, true)
+}
+
+func (e Equalities) DeepEqualWithNilDifferentFromEmpty(a1, a2 interface{}) bool {
+	return e.deepEqual(a1, a2, false)
+}
+
+func (e Equalities) deepEqual(a1, a2 interface{}, equateNilAndEmpty bool) bool {
+	if a1 == nil || a2 == nil {
+		return a1 == a2
+	}
+	v1 := reflect.ValueOf(a1)
+	v2 := reflect.ValueOf(a2)
+	if v1.Type() != v2.Type() {
+		return false
+	}
+	return e.deepValueEqual(v1, v2, make(map[visit]bool), equateNilAndEmpty, 0)
+}
+
+func (e Equalities) deepValueDerive(v1, v2 reflect.Value, visited map[visit]bool, depth int) bool {
+	defer makeUsefulPanic(v1)
+
+	if !v1.IsValid() || !v2.IsValid() {
+		return v1.IsValid() == v2.IsValid()
+	}
+	if v1.Type() != v2.Type() {
+		return false
+	}
+	if fv, ok := e[v1.Type()]; ok {
+		return fv.Call([]reflect.Value{v1, v2})[0].Bool()
+	}
+
+	hard := func(k reflect.Kind) bool {
+		switch k {
+		case reflect.Array, reflect.Map, reflect.Slice, reflect.Struct:
+			return true
+		}
+		return false
+	}
+
+	if v1.CanAddr() && v2.CanAddr() && hard(v1.Kind()) {
+		addr1 := v1.UnsafeAddr()
+		addr2 := v2.UnsafeAddr()
+		if addr1 > addr2 {
+			// Canonicalize order to reduce number of entries in visited.
+			addr1, addr2 = addr2, addr1
+		}
+
+		// Short circuit if references are identical ...
+		if addr1 == addr2 {
+			return true
+		}
+
+		// ... or already seen
+		typ := v1.Type()
+		v := visit{addr1, addr2, typ}
+		if visited[v] {
+			return true
+		}
+
+		// Remember for later.
+		visited[v] = true
+	}
+
+	switch v1.Kind() {
+	case reflect.Array:
+		// We don't need to check length here because length is part of
+		// an array's type, which has already been filtered for.
+		for i := 0; i < v1.Len(); i++ {
+			if !e.deepValueDerive(v1.Index(i), v2.Index(i), visited, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.Slice:
+		if v1.IsNil() || v1.Len() == 0 {
+			return true
+		}
+		if v1.Len() > v2.Len() {
+			return false
+		}
+		if v1.Pointer() == v2.Pointer() {
+			return true
+		}
+		for i := 0; i < v1.Len(); i++ {
+			if !e.deepValueDerive(v1.Index(i), v2.Index(i), visited, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.String:
+		if v1.Len() == 0 {
+			return true
+		}
+		if v1.Len() > v2.Len() {
+			return false
+		}
+		return v1.String() == v2.String()
+	case reflect.Interface:
+		if v1.IsNil() {
+			return true
+		}
+		return e.deepValueDerive(v1.Elem(), v2.Elem(), visited, depth+1)
+	case reflect.Pointer:
+		if v1.IsNil() {
+			return true
+		}
+		return e.deepValueDerive(v1.Elem(), v2.Elem(), visited, depth+1)
+	case reflect.Struct:
+		for i, n := 0, v1.NumField(); i < n; i++ {
+			if !e.deepValueDerive(v1.Field(i), v2.Field(i), visited, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.Map:
+		if v1.IsNil() || v1.Len() == 0 {
+			return true
+		}
+		if v1.Len() > v2.Len() {
+			return false
+		}
+		if v1.Pointer() == v2.Pointer() {
+			return true
+		}
+		for _, k := range v1.MapKeys() {
+			if !e.deepValueDerive(v1.MapIndex(k), v2.MapIndex(k), visited, depth+1) {
+				return false
+			}
+		}
+		return true
+	case reflect.Func:
+		if v1.IsNil() && v2.IsNil() {
+			return true
+		}
+		// Can't do better than this:
+		return false
+	default:
+		// Normal equality suffices
+		if !v1.CanInterface() || !v2.CanInterface() {
+			panic(unexportedTypePanic{})
+		}
+		return v1.Interface() == v2.Interface()
+	}
+}
+
+// DeepDerivative is similar to DeepEqual except that unset fields in a1 are
+// ignored (not compared). This allows us to focus on the fields that matter to
+// the semantic comparison.
+//
+// The unset fields include a nil pointer and an empty string.
+func (e Equalities) DeepDerivative(a1, a2 interface{}) bool {
+	if a1 == nil {
+		return true
+	}
+	v1 := reflect.ValueOf(a1)
+	v2 := reflect.ValueOf(a2)
+	if v1.Type() != v2.Type() {
+		return false
+	}
+	return e.deepValueDerive(v1, v2, make(map[visit]bool), 0)
+}
diff --git a/third_party/k8s.io/apimachinery/third_party/forked/golang/reflect/deep_equal_test.go b/third_party/k8s.io/apimachinery/third_party/forked/golang/reflect/deep_equal_test.go
new file mode 100644
index 0000000000..6e1e6d0d38
--- /dev/null
+++ b/third_party/k8s.io/apimachinery/third_party/forked/golang/reflect/deep_equal_test.go
@@ -0,0 +1,163 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package reflect
+
+import (
+	"testing"
+)
+
+func TestEqualities(t *testing.T) {
+	e := Equalities{}
+	type Bar struct {
+		X int
+	}
+	type Baz struct {
+		Y Bar
+	}
+	type Zap struct {
+		A []int
+		B map[string][]int
+	}
+	err := e.AddFuncs(
+		func(a, b int) bool {
+			return a+1 == b
+		},
+		func(a, b Bar) bool {
+			return a.X*10 == b.X
+		},
+	)
+	if err != nil {
+		t.Fatalf("Unexpected: %v", err)
+	}
+
+	type Foo struct {
+		X int
+	}
+
+	table := []struct {
+		a, b                               interface{}
+		deepEqual                          bool // Expected result for DeepEqual
+		deepEqualWithNilDifferentFromEmpty bool // Expected result for DeepEqualWithNilDifferentFromEmpty
+	}{
+		// Custom equality functions
+		{1, 2, true, true},
+		{2, 1, false, false},
+		{"foo", "fo", false, false},
+		{"foo", "foo", true, true},
+		{"foo", "foobar", false, false},
+		{Foo{1}, Foo{2}, true, true},
+		{Foo{2}, Foo{1}, false, false},
+		{Bar{1}, Bar{10}, true, true},
+		{&Bar{1}, &Bar{10}, true, true},
+		{Baz{Bar{1}}, Baz{Bar{10}}, true, true},
+		// Arrays
+		{[...]string{}, [...]string{"1", "2", "3"}, false, false},
+		{[...]string{"1"}, [...]string{"1", "2", "3"}, false, false},
+		{[...]string{"1", "2", "3"}, [...]string{}, false, false},
+		{[...]string{"1", "2", "3"}, [...]string{"1", "2", "3"}, true, true},
+		// Maps with custom equality
+		{map[string]int{"foo": 1}, map[string]int{}, false, false},
+		{map[string]int{"foo": 1}, map[string]int{"foo": 2}, true, true},
+		{map[string]int{"foo": 2}, map[string]int{"foo": 1}, false, false},
+		{map[string]int{"foo": 1}, map[string]int{"foo": 2, "bar": 6}, false, false},
+		{map[string]int{"foo": 1, "bar": 6}, map[string]int{"foo": 2}, false, false},
+		// Nil vs empty (DeepEqual treats as equal, DeepEqualWithNilDifferentFromEmpty treats as different)
+		{map[string]int{}, map[string]int(nil), true, false},
+		{[]string(nil), []string(nil), true, true},
+		{[]string{}, []string(nil), true, false},
+		{[]string(nil), []string{}, true, false},
+		{[]int{}, []int(nil), true, false},
+		// Nil vs filled (both functions should return false)
+		{[]string{"1"}, []string(nil), false, false},
+		// Empty vs filled (both functions should return false)
+		{[]string{}, []string{"1"}, false, false},
+		{[]string{}, []string{"1", "2", "3"}, false, false},
+		{[]int{}, []int{1, 2, 3}, false, false},
+		{map[string]int{}, map[string]int{"foo": 1}, false, false},
+		// Filled vs empty (both functions should return false)
+		{[]string{"1"}, []string{}, false, false},
+		{[]string{"1"}, []string{"1", "2", "3"}, false, false},
+		{[]string{"1", "2", "3"}, []string{}, false, false},
+		{[]int{1, 2, 3}, []int{}, false, false},
+		{map[string]int{"foo": 1}, map[string]int{}, false, false},
+		// Nested nil/empty (DeepEqual treats as equal, DeepEqualWithNilDifferentFromEmpty treats as different)
+		{map[string][]int{}, map[string][]int(nil), true, false},
+		{map[string][]int{"foo": nil}, map[string][]int{"foo": {}}, true, false},
+		{Zap{A: nil, B: map[string][]int{"foo": nil}}, Zap{A: []int{}, B: map[string][]int{"foo": {}}}, true, false},
+	}
+
+	for _, item := range table {
+		if e, a := item.deepEqual, e.DeepEqual(item.a, item.b); e != a {
+			t.Errorf("DeepEqual: Expected (%+v == %+v) == %v, but got %v", item.a, item.b, e, a)
+		}
+		if e, a := item.deepEqualWithNilDifferentFromEmpty, e.DeepEqualWithNilDifferentFromEmpty(item.a, item.b); e != a {
+			t.Errorf("DeepEqualWithNilDifferentFromEmpty: Expected (%+v == %+v) == %v, but got %v", item.a, item.b, e, a)
+		}
+	}
+}
+
+func TestDerivatives(t *testing.T) {
+	e := Equalities{}
+	type Bar struct {
+		X int
+	}
+	type Baz struct {
+		Y Bar
+	}
+	err := e.AddFuncs(
+		func(a, b int) bool {
+			return a+1 == b
+		},
+		func(a, b Bar) bool {
+			return a.X*10 == b.X
+		},
+	)
+	if err != nil {
+		t.Fatalf("Unexpected: %v", err)
+	}
+
+	type Foo struct {
+		X int
+	}
+
+	table := []struct {
+		a, b  interface{}
+		equal bool
+	}{
+		{1, 2, true},
+		{2, 1, false},
+		{"foo", "fo", false},
+		{"foo", "foo", true},
+		{"foo", "foobar", false},
+		{Foo{1}, Foo{2}, true},
+		{Foo{2}, Foo{1}, false},
+		{Bar{1}, Bar{10}, true},
+		{&Bar{1}, &Bar{10}, true},
+		{Baz{Bar{1}}, Baz{Bar{10}}, true},
+		{[...]string{}, [...]string{"1", "2", "3"}, false},
+		{[...]string{"1"}, [...]string{"1", "2", "3"}, false},
+		{[...]string{"1", "2", "3"}, [...]string{}, false},
+		{[...]string{"1", "2", "3"}, [...]string{"1", "2", "3"}, true},
+		{map[string]int{"foo": 1}, map[string]int{}, false},
+		{map[string]int{"foo": 1}, map[string]int{"foo": 2}, true},
+		{map[string]int{"foo": 2}, map[string]int{"foo": 1}, false},
+		{map[string]int{"foo": 1}, map[string]int{"foo": 2, "bar": 6}, true},
+		{map[string]int{"foo": 1, "bar": 6}, map[string]int{"foo": 2}, false},
+		{map[string]int{}, map[string]int(nil), true},
+		{[]string(nil), []string(nil), true},
+		{[]string{}, []string(nil), true},
+		{[]string(nil), []string{}, true},
+		{[]string{"1"}, []string(nil), false},
+		{[]string{}, []string{"1", "2", "3"}, true},
+		{[]string{"1"}, []string{"1", "2", "3"}, true},
+		{[]string{"1", "2", "3"}, []string{}, false},
+	}
+
+	for _, item := range table {
+		if e, a := item.equal, e.DeepDerivative(item.a, item.b); e != a {
+			t.Errorf("Expected (%+v ~ %+v) == %v, but got %v", item.a, item.b, e, a)
+		}
+	}
+}
diff --git a/third_party/k_k_141395.diff b/third_party/k_k_141395.diff
new file mode 100644
index 0000000000..3a5052cbb9
--- /dev/null
+++ b/third_party/k_k_141395.diff
@@ -0,0 +1,4558 @@
+diff --git a/pkg/apis/admissionregistration/v1/zz_generated.validations.go b/pkg/apis/admissionregistration/v1/zz_generated.validations.go
+index c2562dc0936b0..b4b638ed6458a 100644
+--- a/pkg/apis/admissionregistration/v1/zz_generated.validations.go
++++ b/pkg/apis/admissionregistration/v1/zz_generated.validations.go
+@@ -453,7 +453,7 @@ func Validate_ValidatingAdmissionPolicyStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -501,3 +501,8 @@ func Validate_ValidatingWebhookConfiguration(
+ 	// field admissionregistrationv1.ValidatingWebhookConfiguration.Webhooks has no validation
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/admissionregistration/v1alpha1/zz_generated.validations.go b/pkg/apis/admissionregistration/v1alpha1/zz_generated.validations.go
+index 93f66e798e3ab..a08534553e18a 100644
+--- a/pkg/apis/admissionregistration/v1alpha1/zz_generated.validations.go
++++ b/pkg/apis/admissionregistration/v1alpha1/zz_generated.validations.go
+@@ -389,7 +389,7 @@ func Validate_ValidatingAdmissionPolicyStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -403,3 +403,8 @@ func Validate_ValidatingAdmissionPolicyStatus(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/admissionregistration/v1beta1/zz_generated.validations.go b/pkg/apis/admissionregistration/v1beta1/zz_generated.validations.go
+index 3c1b50fa66d94..6d6d394f124b4 100644
+--- a/pkg/apis/admissionregistration/v1beta1/zz_generated.validations.go
++++ b/pkg/apis/admissionregistration/v1beta1/zz_generated.validations.go
+@@ -453,7 +453,7 @@ func Validate_ValidatingAdmissionPolicyStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -501,3 +501,8 @@ func Validate_ValidatingWebhookConfiguration(
+ 	// field admissionregistrationv1beta1.ValidatingWebhookConfiguration.Webhooks has no validation
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/batch/v1/zz_generated.validations.go b/pkg/apis/batch/v1/zz_generated.validations.go
+index 0a830fdeb62b3..8f0b35bb016f5 100644
+--- a/pkg/apis/batch/v1/zz_generated.validations.go
++++ b/pkg/apis/batch/v1/zz_generated.validations.go
+@@ -403,7 +403,7 @@ func Validate_JobSchedulingConfiguration(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.WorkloadPodGroupResourceClaim, b *schedulingv1alpha3.WorkloadPodGroupResourceClaim) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, v1alpha3.Validate_WorkloadPodGroupResourceClaim); len(e) != 0 {
++				}, deepEqualImpl_, v1alpha3.Validate_WorkloadPodGroupResourceClaim); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -583,3 +583,8 @@ func Validate_JobTemplateSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/certificates/v1/zz_generated.validations.go b/pkg/apis/certificates/v1/zz_generated.validations.go
+index 35af1f3579770..bb98173b9a2c2 100644
+--- a/pkg/apis/certificates/v1/zz_generated.validations.go
++++ b/pkg/apis/certificates/v1/zz_generated.validations.go
+@@ -392,7 +392,7 @@ func Validate_PodCertificateRequestStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -410,3 +410,8 @@ func Validate_PodCertificateRequestStatus(
+ 	// field certificatesv1.PodCertificateRequestStatus.NotAfter has no validation
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/certificates/v1beta1/zz_generated.validations.go b/pkg/apis/certificates/v1beta1/zz_generated.validations.go
+index 9af5455cf75c3..d64104e9a2e97 100644
+--- a/pkg/apis/certificates/v1beta1/zz_generated.validations.go
++++ b/pkg/apis/certificates/v1beta1/zz_generated.validations.go
+@@ -392,7 +392,7 @@ func Validate_PodCertificateRequestStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -410,3 +410,8 @@ func Validate_PodCertificateRequestStatus(
+ 	// field certificatesv1beta1.PodCertificateRequestStatus.NotAfter has no validation
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/core/v1/zz_generated.validations.go b/pkg/apis/core/v1/zz_generated.validations.go
+index cd8ad94525e30..8e0d53348368e 100644
+--- a/pkg/apis/core/v1/zz_generated.validations.go
++++ b/pkg/apis/core/v1/zz_generated.validations.go
+@@ -855,7 +855,7 @@ func Validate_NodeAllocatableResourceClaimStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *corev1.NodeAllocatableMappedResources, b *corev1.NodeAllocatableMappedResources) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_NodeAllocatableMappedResources); len(e) != 0 {
++				}, deepEqualImpl_, Validate_NodeAllocatableMappedResources); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -897,7 +897,7 @@ func Validate_NodeAllocatableResourceClaimStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *corev1.NodeAllocatableOverheadResources, b *corev1.NodeAllocatableOverheadResources) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_NodeAllocatableOverheadResources); len(e) != 0 {
++				}, deepEqualImpl_, Validate_NodeAllocatableOverheadResources); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -985,7 +985,8 @@ func Validate_NodeSpec(
+ 			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+ 				earlyReturn = true
+ 			}
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoUnset, validate.NoModify).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoUnset, validate.NoModify).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -1390,7 +1391,7 @@ func Validate_PodSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *corev1.EvictionResponder, b *corev1.EvictionResponder) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_EvictionResponder); len(e) != 0 {
++				func(a *corev1.EvictionResponder, b *corev1.EvictionResponder) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_EvictionResponder); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1462,7 +1463,7 @@ func Validate_PodStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *corev1.NodeAllocatableResourceClaimStatus, b *corev1.NodeAllocatableResourceClaimStatus) bool {
+ 					return a.ResourceClaimName == b.ResourceClaimName
+-				}, validate.SemanticDeepEqual, Validate_NodeAllocatableResourceClaimStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_NodeAllocatableResourceClaimStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1500,7 +1501,7 @@ func Validate_PodStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *corev1.PodVolumeHealth, b *corev1.PodVolumeHealth) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodVolumeHealth); len(e) != 0 {
++				func(a *corev1.PodVolumeHealth, b *corev1.PodVolumeHealth) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_PodVolumeHealth); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2250,3 +2251,8 @@ func Validate_VolumeHealthStatusType(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/flowcontrol/v1/zz_generated.validations.go b/pkg/apis/flowcontrol/v1/zz_generated.validations.go
+index d8484235332a3..8b590e900f5e2 100644
+--- a/pkg/apis/flowcontrol/v1/zz_generated.validations.go
++++ b/pkg/apis/flowcontrol/v1/zz_generated.validations.go
+@@ -307,7 +307,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1.PriorityLevelConfigurationSpec) flowcontrolv1.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1.ExemptPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -338,7 +338,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1.PriorityLevelConfigurationSpec) flowcontrolv1.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1.LimitedPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -454,3 +454,8 @@ func Validate_PriorityLevelConfigurationSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/flowcontrol/v1beta1/zz_generated.validations.go b/pkg/apis/flowcontrol/v1beta1/zz_generated.validations.go
+index b5bf044c847af..1079f7f7b4ae7 100644
+--- a/pkg/apis/flowcontrol/v1beta1/zz_generated.validations.go
++++ b/pkg/apis/flowcontrol/v1beta1/zz_generated.validations.go
+@@ -309,7 +309,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1beta1.PriorityLevelConfigurationSpec) flowcontrolv1beta1.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1beta1.ExemptPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -340,7 +340,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1beta1.PriorityLevelConfigurationSpec) flowcontrolv1beta1.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1beta1.LimitedPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -456,3 +456,8 @@ func Validate_PriorityLevelConfigurationSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/flowcontrol/v1beta2/zz_generated.validations.go b/pkg/apis/flowcontrol/v1beta2/zz_generated.validations.go
+index c598fd02c48cb..56b84e881aa46 100644
+--- a/pkg/apis/flowcontrol/v1beta2/zz_generated.validations.go
++++ b/pkg/apis/flowcontrol/v1beta2/zz_generated.validations.go
+@@ -309,7 +309,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1beta2.PriorityLevelConfigurationSpec) flowcontrolv1beta2.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1beta2.ExemptPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -340,7 +340,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1beta2.PriorityLevelConfigurationSpec) flowcontrolv1beta2.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1beta2.LimitedPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -456,3 +456,8 @@ func Validate_PriorityLevelConfigurationSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/flowcontrol/v1beta3/zz_generated.validations.go b/pkg/apis/flowcontrol/v1beta3/zz_generated.validations.go
+index b7dece4e10418..213f621973b55 100644
+--- a/pkg/apis/flowcontrol/v1beta3/zz_generated.validations.go
++++ b/pkg/apis/flowcontrol/v1beta3/zz_generated.validations.go
+@@ -309,7 +309,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1beta3.PriorityLevelConfigurationSpec) flowcontrolv1beta3.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1beta3.ExemptPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -340,7 +340,7 @@ func Validate_PriorityLevelConfigurationSpec(
+ 		},
+ 		func(obj *flowcontrolv1beta3.PriorityLevelConfigurationSpec) flowcontrolv1beta3.PriorityLevelEnablement {
+ 			return obj.Type
+-		}, validate.SemanticDeepEqual,
++		}, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *flowcontrolv1beta3.LimitedPriorityLevelConfiguration) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenPointer(ctx, op, fldPath, obj, oldObj).MarkBeta()...)
+@@ -456,3 +456,8 @@ func Validate_PriorityLevelConfigurationSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/lifecycle/v1alpha1/zz_generated.validations.go b/pkg/apis/lifecycle/v1alpha1/zz_generated.validations.go
+index dbc18b7e8c986..2335b86d38d80 100644
+--- a/pkg/apis/lifecycle/v1alpha1/zz_generated.validations.go
++++ b/pkg/apis/lifecycle/v1alpha1/zz_generated.validations.go
+@@ -552,7 +552,7 @@ func Validate_EvictionRequestStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -732,7 +732,7 @@ func Validate_EvictionStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -858,7 +858,7 @@ func Validate_EvictionStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *lifecyclev1alpha1.TargetResponder, b *lifecyclev1alpha1.TargetResponder) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_TargetResponder); len(e) != 0 {
++				}, deepEqualImpl_, Validate_TargetResponder); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -904,7 +904,7 @@ func Validate_EvictionStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *lifecyclev1alpha1.ResponderStatus, b *lifecyclev1alpha1.ResponderStatus) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_ResponderStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_ResponderStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1374,3 +1374,8 @@ func Validate_TargetResponder(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/lifecycle/validation/validation.go b/pkg/apis/lifecycle/validation/validation.go
+index bf3f2e29df13b..28bb04bfb9709 100644
+--- a/pkg/apis/lifecycle/validation/validation.go
++++ b/pkg/apis/lifecycle/validation/validation.go
+@@ -23,6 +23,7 @@ import (
+ 	"strings"
+ 	"time"
+ 
++	"k8s.io/apimachinery/pkg/api/equality"
+ 	"k8s.io/apimachinery/pkg/api/meta"
+ 	"k8s.io/apimachinery/pkg/api/operation"
+ 	"k8s.io/apimachinery/pkg/api/validate"
+@@ -487,7 +488,7 @@ func ValidateEvictionStatusResponder(status, oldStatus *lifecycle.ResponderStatu
+ 		oldDefaultedStatus = *oldStatus // +k8s:verify-mutation:reason=clone
+ 	}
+ 
+-	if oldStatus != nil && !validate.SemanticDeepEqual(status, oldStatus) && opts.responderState != lifecycle.ResponderStateActive {
++	if oldStatus != nil && !equality.Semantic.DeepEqual(status, oldStatus) && opts.responderState != lifecycle.ResponderStateActive {
+ 		// immutable; changes to the ResponderStatus are only allowed by the active responder or during initialization
+ 		return append(allErrs, field.Invalid(fldPath, status, validation.FieldImmutableErrorMsg).WithOrigin("immutable"))
+ 	}
+diff --git a/pkg/apis/lifecycle/validation/validation_test.go b/pkg/apis/lifecycle/validation/validation_test.go
+index 0c92b20367be6..0f962d44a5a54 100644
+--- a/pkg/apis/lifecycle/validation/validation_test.go
++++ b/pkg/apis/lifecycle/validation/validation_test.go
+@@ -23,7 +23,7 @@ import (
+ 	"time"
+ 
+ 	"github.com/google/go-cmp/cmp"
+-	"k8s.io/apimachinery/pkg/api/validate"
++	"k8s.io/apimachinery/pkg/api/equality"
+ 	"k8s.io/apimachinery/pkg/api/validation"
+ 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+ 	"k8s.io/apimachinery/pkg/util/validation/field"
+@@ -143,7 +143,7 @@ func TestValidateEvictionRequestStatusUpdate(t *testing.T) {
+ 	}
+ 	for name, tc := range successCases {
+ 		t.Run(name, func(t *testing.T) {
+-			if validate.SemanticDeepEqual(tc.oldInput, tc.input) {
++			if equality.Semantic.DeepEqual(tc.oldInput, tc.input) {
+ 				t.Errorf("Expected oldInput and input to differ")
+ 			}
+ 			oldEvictionRequest := mkValidEvictionRequest()
+@@ -812,7 +812,7 @@ func TestValidateEvictionStatusUpdate(t *testing.T) {
+ 	}
+ 	for name, tc := range successCases {
+ 		t.Run(name, func(t *testing.T) {
+-			if !tc.explicitEmptyUpdate && validate.SemanticDeepEqual(tc.oldInput, tc.input) {
++			if !tc.explicitEmptyUpdate && equality.Semantic.DeepEqual(tc.oldInput, tc.input) {
+ 				t.Errorf("Expected oldInput and input to differ")
+ 			}
+ 			// Ensure that the validation doesn't depend on the order of list elements.
+diff --git a/pkg/apis/policy/v1/zz_generated.validations.go b/pkg/apis/policy/v1/zz_generated.validations.go
+index f153234e54e76..df2d2e74fe77f 100644
+--- a/pkg/apis/policy/v1/zz_generated.validations.go
++++ b/pkg/apis/policy/v1/zz_generated.validations.go
+@@ -155,7 +155,7 @@ func Validate_PodDisruptionBudgetStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -169,3 +169,8 @@ func Validate_PodDisruptionBudgetStatus(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/policy/v1beta1/zz_generated.validations.go b/pkg/apis/policy/v1beta1/zz_generated.validations.go
+index def9d2dd2d8a1..369d266ce91c1 100644
+--- a/pkg/apis/policy/v1beta1/zz_generated.validations.go
++++ b/pkg/apis/policy/v1beta1/zz_generated.validations.go
+@@ -155,7 +155,7 @@ func Validate_PodDisruptionBudgetStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -169,3 +169,8 @@ func Validate_PodDisruptionBudgetStatus(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/resource/v1/zz_generated.validations.go b/pkg/apis/resource/v1/zz_generated.validations.go
+index 5353b062bb69e..716aa0f343c96 100644
+--- a/pkg/apis/resource/v1/zz_generated.validations.go
++++ b/pkg/apis/resource/v1/zz_generated.validations.go
+@@ -190,7 +190,7 @@ func Validate_AllocatedDeviceStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -386,7 +386,7 @@ func Validate_Device(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_DeviceAttribute); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_DeviceAttribute); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -434,7 +434,7 @@ func Validate_Device(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1.DeviceCounterConsumption, b *resourcev1.DeviceCounterConsumption) bool {
+ 					return a.CounterSet == b.CounterSet
+-				}, validate.SemanticDeepEqual, Validate_DeviceCounterConsumption); len(e) != 0 {
++				}, deepEqualImpl_, Validate_DeviceCounterConsumption); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -570,7 +570,7 @@ func Validate_Device(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_NodeAllocatableResource); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_NodeAllocatableResource); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1108,7 +1108,7 @@ func Validate_DeviceClaim(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *resourcev1.DeviceRequest, b *resourcev1.DeviceRequest) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_DeviceRequest); len(e) != 0 {
++				func(a *resourcev1.DeviceRequest, b *resourcev1.DeviceRequest) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_DeviceRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1867,7 +1867,7 @@ func Validate_DeviceRequest(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *resourcev1.DeviceSubRequest, b *resourcev1.DeviceSubRequest) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_DeviceSubRequest); len(e) != 0 {
++				func(a *resourcev1.DeviceSubRequest, b *resourcev1.DeviceSubRequest) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_DeviceSubRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2506,7 +2506,7 @@ func Validate_DeviceTaintRuleStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3440,7 +3440,7 @@ func Validate_ResourceClaimStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1.AllocatedDeviceStatus, b *resourcev1.AllocatedDeviceStatus) bool {
+ 					return a.Driver == b.Driver && a.Device == b.Device && a.Pool == b.Pool && ((a.ShareID == nil && b.ShareID == nil) || (a.ShareID != nil && b.ShareID != nil && *a.ShareID == *b.ShareID))
+-				}, validate.SemanticDeepEqual, Validate_AllocatedDeviceStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_AllocatedDeviceStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3674,7 +3674,7 @@ func Validate_ResourceSliceSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *resourcev1.CounterSet, b *resourcev1.CounterSet) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_CounterSet); len(e) != 0 {
++				func(a *resourcev1.CounterSet, b *resourcev1.CounterSet) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_CounterSet); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3777,3 +3777,8 @@ func Validate_SkipNodeOperation(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/resource/v1alpha3/zz_generated.validations.go b/pkg/apis/resource/v1alpha3/zz_generated.validations.go
+index 26768c1f0834f..ec13b717c6ee4 100644
+--- a/pkg/apis/resource/v1alpha3/zz_generated.validations.go
++++ b/pkg/apis/resource/v1alpha3/zz_generated.validations.go
+@@ -277,7 +277,7 @@ func Validate_DeviceTaintRuleStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -776,7 +776,7 @@ func Validate_PoolStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1alpha3.PartitionTypeStatus, b *resourcev1alpha3.PartitionTypeStatus) bool {
+ 					return a.Attribute == b.Attribute && a.Type == b.Type
+-				}, validate.SemanticDeepEqual, Validate_PartitionTypeStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PartitionTypeStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1165,7 +1165,7 @@ func Validate_ResourcePoolStatusRequestStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1413,3 +1413,8 @@ func Validate_ShareableSummaryStatus(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/resource/v1beta1/zz_generated.validations.go b/pkg/apis/resource/v1beta1/zz_generated.validations.go
+index 62ab9a8bfc35c..c78f404aeddd8 100644
+--- a/pkg/apis/resource/v1beta1/zz_generated.validations.go
++++ b/pkg/apis/resource/v1beta1/zz_generated.validations.go
+@@ -175,7 +175,7 @@ func Validate_AllocatedDeviceStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -296,7 +296,7 @@ func Validate_BasicDevice(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_DeviceAttribute); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_DeviceAttribute); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -344,7 +344,7 @@ func Validate_BasicDevice(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1beta1.DeviceCounterConsumption, b *resourcev1beta1.DeviceCounterConsumption) bool {
+ 					return a.CounterSet == b.CounterSet
+-				}, validate.SemanticDeepEqual, Validate_DeviceCounterConsumption); len(e) != 0 {
++				}, deepEqualImpl_, Validate_DeviceCounterConsumption); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -480,7 +480,7 @@ func Validate_BasicDevice(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_NodeAllocatableResource); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_NodeAllocatableResource); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1132,7 +1132,7 @@ func Validate_DeviceClaim(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *resourcev1beta1.DeviceRequest, b *resourcev1beta1.DeviceRequest) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_DeviceRequest); len(e) != 0 {
++				func(a *resourcev1beta1.DeviceRequest, b *resourcev1beta1.DeviceRequest) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_DeviceRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1931,7 +1931,7 @@ func Validate_DeviceRequest(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1beta1.DeviceSubRequest, b *resourcev1beta1.DeviceSubRequest) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_DeviceSubRequest); len(e) != 0 {
++				}, deepEqualImpl_, Validate_DeviceSubRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3271,7 +3271,7 @@ func Validate_ResourceClaimStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1beta1.AllocatedDeviceStatus, b *resourcev1beta1.AllocatedDeviceStatus) bool {
+ 					return a.Driver == b.Driver && a.Device == b.Device && a.Pool == b.Pool && ((a.ShareID == nil && b.ShareID == nil) || (a.ShareID != nil && b.ShareID != nil && *a.ShareID == *b.ShareID))
+-				}, validate.SemanticDeepEqual, Validate_AllocatedDeviceStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_AllocatedDeviceStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3505,7 +3505,7 @@ func Validate_ResourceSliceSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *resourcev1beta1.CounterSet, b *resourcev1beta1.CounterSet) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_CounterSet); len(e) != 0 {
++				func(a *resourcev1beta1.CounterSet, b *resourcev1beta1.CounterSet) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_CounterSet); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3608,3 +3608,8 @@ func Validate_SkipNodeOperation(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/resource/v1beta2/zz_generated.validations.go b/pkg/apis/resource/v1beta2/zz_generated.validations.go
+index 5858ddd09b4f4..c4a76b3e8f07f 100644
+--- a/pkg/apis/resource/v1beta2/zz_generated.validations.go
++++ b/pkg/apis/resource/v1beta2/zz_generated.validations.go
+@@ -190,7 +190,7 @@ func Validate_AllocatedDeviceStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -386,7 +386,7 @@ func Validate_Device(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_DeviceAttribute); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_DeviceAttribute); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -434,7 +434,7 @@ func Validate_Device(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1beta2.DeviceCounterConsumption, b *resourcev1beta2.DeviceCounterConsumption) bool {
+ 					return a.CounterSet == b.CounterSet
+-				}, validate.SemanticDeepEqual, Validate_DeviceCounterConsumption); len(e) != 0 {
++				}, deepEqualImpl_, Validate_DeviceCounterConsumption); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -570,7 +570,7 @@ func Validate_Device(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_NodeAllocatableResource); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_NodeAllocatableResource); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1108,7 +1108,7 @@ func Validate_DeviceClaim(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *resourcev1beta2.DeviceRequest, b *resourcev1beta2.DeviceRequest) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_DeviceRequest); len(e) != 0 {
++				func(a *resourcev1beta2.DeviceRequest, b *resourcev1beta2.DeviceRequest) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_DeviceRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1871,7 +1871,7 @@ func Validate_DeviceRequest(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1beta2.DeviceSubRequest, b *resourcev1beta2.DeviceSubRequest) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_DeviceSubRequest); len(e) != 0 {
++				}, deepEqualImpl_, Validate_DeviceSubRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2510,7 +2510,7 @@ func Validate_DeviceTaintRuleStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3444,7 +3444,7 @@ func Validate_ResourceClaimStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *resourcev1beta2.AllocatedDeviceStatus, b *resourcev1beta2.AllocatedDeviceStatus) bool {
+ 					return a.Driver == b.Driver && a.Device == b.Device && a.Pool == b.Pool && ((a.ShareID == nil && b.ShareID == nil) || (a.ShareID != nil && b.ShareID != nil && *a.ShareID == *b.ShareID))
+-				}, validate.SemanticDeepEqual, Validate_AllocatedDeviceStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_AllocatedDeviceStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3678,7 +3678,7 @@ func Validate_ResourceSliceSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *resourcev1beta2.CounterSet, b *resourcev1beta2.CounterSet) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_CounterSet); len(e) != 0 {
++				func(a *resourcev1beta2.CounterSet, b *resourcev1beta2.CounterSet) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_CounterSet); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3781,3 +3781,8 @@ func Validate_SkipNodeOperation(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/scheduling/v1alpha3/zz_generated.validations.go b/pkg/apis/scheduling/v1alpha3/zz_generated.validations.go
+index 797660524af64..ae573cfc6b99b 100644
+--- a/pkg/apis/scheduling/v1alpha3/zz_generated.validations.go
++++ b/pkg/apis/scheduling/v1alpha3/zz_generated.validations.go
+@@ -752,7 +752,7 @@ func Validate_CompositePodGroupStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1047,7 +1047,7 @@ func Validate_CompositePodGroupTemplate(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.PodGroupTemplate, b *schedulingv1alpha3.PodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1100,7 +1100,7 @@ func Validate_CompositePodGroupTemplate(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.CompositePodGroupTemplate, b *schedulingv1alpha3.CompositePodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_CompositePodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_CompositePodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1816,7 +1816,7 @@ func Validate_PodGroupSpec(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.PodGroupResourceClaim, b *schedulingv1alpha3.PodGroupResourceClaim) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupResourceClaim); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupResourceClaim); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2010,7 +2010,7 @@ func Validate_PodGroupStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2056,7 +2056,7 @@ func Validate_PodGroupStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.PodGroupResourceClaimStatus, b *schedulingv1alpha3.PodGroupResourceClaimStatus) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupResourceClaimStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupResourceClaimStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2210,7 +2210,7 @@ func Validate_PodGroupTemplate(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.PodGroupResourceClaim, b *schedulingv1alpha3.PodGroupResourceClaim) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupResourceClaim); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupResourceClaim); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3171,7 +3171,7 @@ func Validate_WorkloadSpec(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.PodGroupTemplate, b *schedulingv1alpha3.PodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3231,7 +3231,7 @@ func Validate_WorkloadSpec(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1alpha3.CompositePodGroupTemplate, b *schedulingv1alpha3.CompositePodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_CompositePodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_CompositePodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3245,3 +3245,8 @@ func Validate_WorkloadSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/scheduling/v1beta1/zz_generated.validations.go b/pkg/apis/scheduling/v1beta1/zz_generated.validations.go
+index 6914741407314..ccc3d7ff6a927 100644
+--- a/pkg/apis/scheduling/v1beta1/zz_generated.validations.go
++++ b/pkg/apis/scheduling/v1beta1/zz_generated.validations.go
+@@ -632,7 +632,7 @@ func Validate_CompositePodGroupTemplate(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1beta1.PodGroupTemplate, b *schedulingv1beta1.PodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -685,7 +685,7 @@ func Validate_CompositePodGroupTemplate(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1beta1.CompositePodGroupTemplate, b *schedulingv1beta1.CompositePodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_CompositePodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_CompositePodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1401,7 +1401,7 @@ func Validate_PodGroupSpec(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1beta1.PodGroupResourceClaim, b *schedulingv1beta1.PodGroupResourceClaim) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupResourceClaim); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupResourceClaim); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1595,7 +1595,7 @@ func Validate_PodGroupStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1641,7 +1641,7 @@ func Validate_PodGroupStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1beta1.PodGroupResourceClaimStatus, b *schedulingv1beta1.PodGroupResourceClaimStatus) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupResourceClaimStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupResourceClaimStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1795,7 +1795,7 @@ func Validate_PodGroupTemplate(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1beta1.PodGroupResourceClaim, b *schedulingv1beta1.PodGroupResourceClaim) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupResourceClaim); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupResourceClaim); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2379,7 +2379,7 @@ func Validate_WorkloadSpec(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1beta1.PodGroupTemplate, b *schedulingv1beta1.PodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_PodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2439,7 +2439,7 @@ func Validate_WorkloadSpec(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *schedulingv1beta1.CompositePodGroupTemplate, b *schedulingv1beta1.CompositePodGroupTemplate) bool {
+ 					return a.Name == b.Name
+-				}, validate.SemanticDeepEqual, Validate_CompositePodGroupTemplate); len(e) != 0 {
++				}, deepEqualImpl_, Validate_CompositePodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2453,3 +2453,8 @@ func Validate_WorkloadSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/storagemigration/v1/zz_generated.validations.go b/pkg/apis/storagemigration/v1/zz_generated.validations.go
+index 3462185867b85..480bbb54c4f61 100644
+--- a/pkg/apis/storagemigration/v1/zz_generated.validations.go
++++ b/pkg/apis/storagemigration/v1/zz_generated.validations.go
+@@ -148,7 +148,7 @@ func Validate_StorageVersionMigrationStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -163,3 +163,8 @@ func Validate_StorageVersionMigrationStatus(
+ 	// field storagemigrationv1.StorageVersionMigrationStatus.ResourceVersion has no validation
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/pkg/apis/storagemigration/v1beta1/zz_generated.validations.go b/pkg/apis/storagemigration/v1beta1/zz_generated.validations.go
+index 0f4a1e3feedd3..b76128cb3ba9f 100644
+--- a/pkg/apis/storagemigration/v1beta1/zz_generated.validations.go
++++ b/pkg/apis/storagemigration/v1beta1/zz_generated.validations.go
+@@ -148,7 +148,7 @@ func Validate_StorageVersionMigrationStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -163,3 +163,8 @@ func Validate_StorageVersionMigrationStatus(
+ 	// field storagemigrationv1beta1.StorageVersionMigrationStatus.ResourceVersion has no validation
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/api/resource/v1/zz_generated.validations.go b/staging/src/k8s.io/api/resource/v1/zz_generated.validations.go
+index b771d5b92a349..2c77f7412ac17 100644
+--- a/staging/src/k8s.io/api/resource/v1/zz_generated.validations.go
++++ b/staging/src/k8s.io/api/resource/v1/zz_generated.validations.go
+@@ -104,7 +104,7 @@ func Validate_AllocatedDeviceStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -300,7 +300,7 @@ func Validate_Device(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_DeviceAttribute); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_DeviceAttribute); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -348,7 +348,7 @@ func Validate_Device(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *DeviceCounterConsumption, b *DeviceCounterConsumption) bool {
+ 					return a.CounterSet == b.CounterSet
+-				}, validate.SemanticDeepEqual, Validate_DeviceCounterConsumption); len(e) != 0 {
++				}, deepEqualImpl_, Validate_DeviceCounterConsumption); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -484,7 +484,7 @@ func Validate_Device(
+ 				return // do not proceed
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_NodeAllocatableResource); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_NodeAllocatableResource); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1022,7 +1022,7 @@ func Validate_DeviceClaim(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *DeviceRequest, b *DeviceRequest) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_DeviceRequest); len(e) != 0 {
++				func(a *DeviceRequest, b *DeviceRequest) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_DeviceRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1711,7 +1711,7 @@ func Validate_DeviceRequest(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *DeviceSubRequest, b *DeviceSubRequest) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_DeviceSubRequest); len(e) != 0 {
++				func(a *DeviceSubRequest, b *DeviceSubRequest) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_DeviceSubRequest); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2273,7 +2273,7 @@ func Validate_DeviceTaintRuleStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3119,7 +3119,7 @@ func Validate_ResourceClaimStatus(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *AllocatedDeviceStatus, b *AllocatedDeviceStatus) bool {
+ 					return a.Driver == b.Driver && a.Device == b.Device && a.Pool == b.Pool && ((a.ShareID == nil && b.ShareID == nil) || (a.ShareID != nil && b.ShareID != nil && *a.ShareID == *b.ShareID))
+-				}, validate.SemanticDeepEqual, Validate_AllocatedDeviceStatus); len(e) != 0 {
++				}, deepEqualImpl_, Validate_AllocatedDeviceStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3243,7 +3243,7 @@ func Validate_ResourceSliceSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *CounterSet, b *CounterSet) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_CounterSet); len(e) != 0 {
++				func(a *CounterSet, b *CounterSet) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_CounterSet); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3346,3 +3346,8 @@ func Validate_SkipNodeOperation(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/api/scheduling/v1alpha3/zz_generated.validations.go b/staging/src/k8s.io/api/scheduling/v1alpha3/zz_generated.validations.go
+index 3202dbe2bea07..b7e1aa6954d65 100644
+--- a/staging/src/k8s.io/api/scheduling/v1alpha3/zz_generated.validations.go
++++ b/staging/src/k8s.io/api/scheduling/v1alpha3/zz_generated.validations.go
+@@ -696,7 +696,7 @@ func Validate_CompositePodGroupStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -985,7 +985,7 @@ func Validate_CompositePodGroupTemplate(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *PodGroupTemplate, b *PodGroupTemplate) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodGroupTemplate); len(e) != 0 {
++				func(a *PodGroupTemplate, b *PodGroupTemplate) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_PodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1032,7 +1032,7 @@ func Validate_CompositePodGroupTemplate(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *CompositePodGroupTemplate, b *CompositePodGroupTemplate) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_CompositePodGroupTemplate); len(e) != 0 {
++				func(a *CompositePodGroupTemplate, b *CompositePodGroupTemplate) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_CompositePodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1744,7 +1744,7 @@ func Validate_PodGroupSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *PodGroupResourceClaim, b *PodGroupResourceClaim) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodGroupResourceClaim); len(e) != 0 {
++				func(a *PodGroupResourceClaim, b *PodGroupResourceClaim) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_PodGroupResourceClaim); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1938,7 +1938,7 @@ func Validate_PodGroupStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
++				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, deepEqualImpl_, validation.Validate_Condition); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -1980,7 +1980,7 @@ func Validate_PodGroupStatus(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *PodGroupResourceClaimStatus, b *PodGroupResourceClaimStatus) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodGroupResourceClaimStatus); len(e) != 0 {
++				func(a *PodGroupResourceClaimStatus, b *PodGroupResourceClaimStatus) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_PodGroupResourceClaimStatus); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -2130,7 +2130,7 @@ func Validate_PodGroupTemplate(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *PodGroupResourceClaim, b *PodGroupResourceClaim) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodGroupResourceClaim); len(e) != 0 {
++				func(a *PodGroupResourceClaim, b *PodGroupResourceClaim) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_PodGroupResourceClaim); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3298,7 +3298,7 @@ func Validate_WorkloadSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *PodGroupTemplate, b *PodGroupTemplate) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodGroupTemplate); len(e) != 0 {
++				func(a *PodGroupTemplate, b *PodGroupTemplate) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_PodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3352,7 +3352,7 @@ func Validate_WorkloadSpec(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *CompositePodGroupTemplate, b *CompositePodGroupTemplate) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_CompositePodGroupTemplate); len(e) != 0 {
++				func(a *CompositePodGroupTemplate, b *CompositePodGroupTemplate) bool { return a.Name == b.Name }, deepEqualImpl_, Validate_CompositePodGroupTemplate); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -3366,3 +3366,8 @@ func Validate_WorkloadSpec(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/apimachinery/pkg/api/validate/each.go b/staging/src/k8s.io/apimachinery/pkg/api/validate/each.go
+index 2930c21836cc7..affc44576bfee 100644
+--- a/staging/src/k8s.io/apimachinery/pkg/api/validate/each.go
++++ b/staging/src/k8s.io/apimachinery/pkg/api/validate/each.go
+@@ -18,6 +18,7 @@ package validate
+ 
+ import (
+ 	"context"
++	"reflect"
+ 	"slices"
+ 	"sort"
+ 
+@@ -163,6 +164,38 @@ func EachMapVal[K ~string, V any](ctx context.Context, op operation.Operation, f
+ 	return errs
+ }
+ 
++// EachPtrMapVal validates each value in newMap (which is a map of pointers)
++// using the specified validation function, passing the corresponding old value
++// from oldMap if the key exists in oldMap.
++// For update operations, it implements validation ratcheting by skipping validation
++// when the old value exists and the equiv function confirms the values are equivalent.
++//
++// The equiv function will never be called with nil arguments.
++//
++// If equiv is nil, value-based ratcheting is disabled and all values will be validated.
++func EachPtrMapVal[K ~string, V any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]*V,
++	equiv MatchFunc[*V], validator ValidateFunc[*V]) field.ErrorList {
++	var errs field.ErrorList
++	for key, val := range newMap {
++		if val == nil {
++			// Ignore nil items; they are supposed to have been checked by PtrMapNoNils.
++			continue
++		}
++
++		var old *V
++		if o, found := oldMap[key]; found {
++			old = o
++		}
++		// If the operation is an update, for validation ratcheting, skip re-validating if the old
++		// value is found and the equiv function confirms the values are equivalent.
++		if op.Type == operation.Update && old != nil && equiv != nil && equiv(val, old) {
++			continue
++		}
++		errs = append(errs, validator(ctx, op, fldPath.Key(string(key)), val, old)...)
++	}
++	return errs
++}
++
+ // EachMapKey validates each element of newMap with the specified
+ // validation function.
+ func EachMapKey[K ~string, T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]T,
+@@ -261,10 +294,22 @@ func PtrSliceUnique[T any](_ context.Context, _ operation.Operation, fldPath *fi
+ // arguments of type interface{}/any. The wrapper satisfies the type
+ // constraints of MatchFunc while leveraging the underlying semantic equality
+ // logic. It can be used by any other function that needs to call DeepEqual.
++//
++// Deprecated: Callers should use equality.Semantic.DeepEqual directly.
+ func SemanticDeepEqual[T any](a, b T) bool {
+ 	return equality.Semantic.DeepEqual(a, b)
+ }
+ 
++// ReflectDeepEqual is a MatchFunc that uses reflect.DeepEqual to compare two
++// values.
++// This wrapper is needed because MatchFunc requires a function that takes two
++// arguments of specific type T, while reflect.DeepEqual takes arguments of
++// type interface{}/any. It can be used by any other function that needs to
++// call DeepEqual.
++func ReflectDeepEqual[T any](a, b T) bool {
++	return reflect.DeepEqual(a, b)
++}
++
+ // DirectEqual is a MatchFunc that dereferences two pointers and uses the ==
+ // operator to compare the values. If both pointers are nil, it returns true.
+ // If one pointer is nil and the other is not, it returns false.
+@@ -290,3 +335,14 @@ func PtrSliceNoNils[T any](_ context.Context, _ operation.Operation, fldPath *fi
+ 	}
+ 	return
+ }
++
++// PtrMapNoNils returns a Required error for each nil element in a map of
++// pointers.
++func PtrMapNoNils[K ~string, V any](_ context.Context, _ operation.Operation, fldPath *field.Path, newMap, _ map[K]*V) (errs field.ErrorList) {
++	for key, val := range newMap {
++		if val == nil {
++			errs = append(errs, field.Required(fldPath.Key(string(key)), ""))
++		}
++	}
++	return
++}
+diff --git a/staging/src/k8s.io/apimachinery/pkg/api/validate/each_test.go b/staging/src/k8s.io/apimachinery/pkg/api/validate/each_test.go
+index 3b98fcb0460bd..a8b73ae6fccc3 100644
+--- a/staging/src/k8s.io/apimachinery/pkg/api/validate/each_test.go
++++ b/staging/src/k8s.io/apimachinery/pkg/api/validate/each_test.go
+@@ -137,7 +137,7 @@ func TestEachValSliceValRatcheting(t *testing.T) {
+ 		[]TestStruct{
+ 			{11, "a"}, {13, "c"}, {12, "b"},
+ 		},
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 		nil,
+ 	)
+ 	testEachValSliceValRatcheting(t, "ComparableStruct less data in new, exist in old",
+@@ -181,7 +181,7 @@ func TestEachValSliceValRatcheting(t *testing.T) {
+ 		[]NonComparableStruct{
+ 			{I: 11, S: []string{"a"}}, {I: 13, S: []string{"c"}}, {I: 12, S: []string{"b"}},
+ 		},
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 		nil,
+ 	)
+ 	testEachValSliceValRatcheting(t, "NonComparableStructWithKey same data different order",
+@@ -194,7 +194,7 @@ func TestEachValSliceValRatcheting(t *testing.T) {
+ 		MatchFunc[*NonComparableStructWithKey](func(a, b *NonComparableStructWithKey) bool {
+ 			return a.Key == b.Key
+ 		}),
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 	)
+ 
+ }
+@@ -276,7 +276,7 @@ func TestEachMapValRatcheting(t *testing.T) {
+ 			"three": {I: 13, S: []string{"c"}},
+ 			"two":   {I: 12, S: []string{"b"}},
+ 		},
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 		0,
+ 	)
+ 	testEachMapValRatcheting(t, "non comparable value, less data in new, exist in old",
+@@ -289,7 +289,7 @@ func TestEachMapValRatcheting(t *testing.T) {
+ 			"one":   {I: 11, S: []string{"a"}},
+ 			"three": {I: 13, S: []string{"c"}},
+ 		},
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 		0,
+ 	)
+ 	testEachMapValRatcheting(t, "non comparable value, new data, not exist in old",
+@@ -304,7 +304,7 @@ func TestEachMapValRatcheting(t *testing.T) {
+ 			"two":   {I: 12, S: []string{"b"}},
+ 			"four":  {I: 14, S: []string{"d"}},
+ 		},
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 		1,
+ 	)
+ 	testEachMapValRatcheting(t, "struct with pointer field, same value different pointer",
+@@ -316,7 +316,7 @@ func TestEachMapValRatcheting(t *testing.T) {
+ 			"one": {I: 11, P: new(1)},
+ 			"two": {I: 12, P: new(2)},
+ 		},
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 		0,
+ 	)
+ 	testEachMapValRatcheting(t, "nil map to empty map",
+@@ -364,6 +364,173 @@ func testEachMapValRatcheting[K ~string, V any](t *testing.T, name string, old,
+ 	})
+ }
+ 
++func TestEachPtrMapVal(t *testing.T) {
++	testEachPtrMapVal(t, "valid", map[string]*int{"one": new(11), "two": new(12), "three": new(13)})
++	testEachPtrMapVal(t, "valid", map[string]*string{"A": new("a"), "B": new("b"), "C": new("c")})
++	testEachPtrMapVal(t, "valid", map[string]*TestStruct{"one": {11, "a"}, "two": {12, "b"}, "three": {13, "c"}})
++
++	testEachPtrMapVal(t, "empty", map[string]*int{})
++	testEachPtrMapVal(t, "empty", map[string]*string{})
++	testEachPtrMapVal(t, "empty", map[string]*TestStruct{})
++
++	testEachPtrMapVal[int](t, "nil", nil)
++	testEachPtrMapVal[string](t, "nil", nil)
++	testEachPtrMapVal[TestStruct](t, "nil", nil)
++
++	t.Run("nil element ignored", func(t *testing.T) {
++		calls := 0
++		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *int) field.ErrorList {
++			calls++
++			return nil
++		}
++		input := map[string]*int{"a": new(1), "b": nil, "c": new(3)}
++		errs := EachPtrMapVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, vfn)
++		if len(errs) != 0 {
++			t.Errorf("expected 0 errors, got %d: %v", len(errs), errs)
++		}
++		if calls != 2 {
++			t.Errorf("expected 2 calls, got %d", calls)
++		}
++	})
++}
++
++func testEachPtrMapVal[T any](t *testing.T, name string, input map[string]*T) {
++	t.Helper()
++	var zero T
++	t.Run(fmt.Sprintf("%s(*%T)", name, zero), func(t *testing.T) {
++		calls := 0
++		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
++			if oldVal != nil {
++				t.Errorf("expected nil oldVal, got %v", *oldVal)
++			}
++			calls++
++			return nil
++		}
++		errs := EachPtrMapVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, vfn)
++		if len(errs) != 0 {
++			t.Errorf("expected 0 errors, got %d: %v", len(errs), errs)
++		}
++		if calls != len(input) {
++			t.Errorf("expected %d calls, got %d", len(input), calls)
++		}
++	})
++}
++
++func TestEachPtrMapValRatcheting(t *testing.T) {
++	testEachPtrMapValRatcheting(t, "primitive same data",
++		map[string]*int{"one": new(11), "two": new(12), "three": new(13)},
++		map[string]*int{"one": new(11), "three": new(13), "two": new(12)},
++		DirectEqual,
++		0,
++	)
++	testEachPtrMapValRatcheting(t, "primitive less data in new, exist in old",
++		map[string]*int{"one": new(11), "two": new(12), "three": new(13)},
++		map[string]*int{"one": new(11), "three": new(13)},
++		DirectEqual,
++		0,
++	)
++	testEachPtrMapValRatcheting(t, "primitive new data, not exist in old",
++		map[string]*int{"one": new(11), "two": new(12)},
++		map[string]*int{"one": new(11), "two": new(12), "three": new(13)},
++		DirectEqual,
++		1,
++	)
++	testEachPtrMapValRatcheting(t, "non comparable value, same data",
++		map[string]*NonComparableStruct{
++			"one":   {I: 11, S: []string{"a"}},
++			"two":   {I: 12, S: []string{"b"}},
++			"three": {I: 13, S: []string{"c"}},
++		},
++		map[string]*NonComparableStruct{
++			"one":   {I: 11, S: []string{"a"}},
++			"three": {I: 13, S: []string{"c"}},
++			"two":   {I: 12, S: []string{"b"}},
++		},
++		ReflectDeepEqual,
++		0,
++	)
++	testEachPtrMapValRatcheting(t, "non comparable value, less data in new, exist in old",
++		map[string]*NonComparableStruct{
++			"one":   {I: 11, S: []string{"a"}},
++			"two":   {I: 12, S: []string{"b"}},
++			"three": {I: 13, S: []string{"c"}},
++		},
++		map[string]*NonComparableStruct{
++			"one":   {I: 11, S: []string{"a"}},
++			"three": {I: 13, S: []string{"c"}},
++		},
++		ReflectDeepEqual,
++		0,
++	)
++	testEachPtrMapValRatcheting(t, "non comparable value, new data, not exist in old",
++		map[string]*NonComparableStruct{
++			"one":   {I: 11, S: []string{"a"}},
++			"two":   {I: 12, S: []string{"b"}},
++			"three": {I: 13, S: []string{"c"}},
++		},
++		map[string]*NonComparableStruct{
++			"one":   {I: 11, S: []string{"a"}},
++			"three": {I: 13, S: []string{"c"}},
++			"two":   {I: 12, S: []string{"b"}},
++			"four":  {I: 14, S: []string{"d"}},
++		},
++		ReflectDeepEqual,
++		1,
++	)
++	testEachPtrMapValRatcheting(t, "struct with pointer field, same value different pointer",
++		map[string]*NonComparableStructWithPtr{
++			"one": {I: 11, P: new(1)},
++			"two": {I: 12, P: new(2)},
++		},
++		map[string]*NonComparableStructWithPtr{
++			"one": {I: 11, P: new(1)},
++			"two": {I: 12, P: new(2)},
++		},
++		ReflectDeepEqual,
++		0,
++	)
++	testEachPtrMapValRatcheting(t, "nil map to empty map",
++		nil,
++		map[string]*int{},
++		DirectEqual,
++		0,
++	)
++	testEachPtrMapValRatcheting(t, "nil map to non-empty map",
++		nil,
++		map[string]*int{"one": new(1)},
++		DirectEqual,
++		1,
++	)
++	testEachPtrMapValRatcheting(t, "empty map to nil map",
++		map[string]*int{},
++		nil,
++		DirectEqual,
++		0,
++	)
++	testEachPtrMapValRatcheting(t, "non-empty map to nil map",
++		map[string]*int{"one": new(1)},
++		nil,
++		DirectEqual,
++		0,
++	)
++}
++
++func testEachPtrMapValRatcheting[K ~string, V any](t *testing.T, name string, old, new map[K]*V, equiv MatchFunc[*V], wantCalls int) {
++	t.Helper()
++	var zero V
++	t.Run(fmt.Sprintf("%s(*%T)", name, zero), func(t *testing.T) {
++		calls := 0
++		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *V) field.ErrorList {
++			calls++
++			return nil
++		}
++		_ = EachPtrMapVal(context.Background(), operation.Operation{Type: operation.Update}, field.NewPath("test"), new, old, equiv, vfn)
++		if calls != wantCalls {
++			t.Errorf("expected %d calls, got %d", wantCalls, calls)
++		}
++	})
++}
++
+ type StringType string
+ 
+ func TestEachMapKey(t *testing.T) {
+@@ -455,7 +622,7 @@ func testValSliceUnique[T comparable](t *testing.T, name string, input []T, want
+ 		}
+ 	})
+ 	t.Run(fmt.Sprintf("%s(reflect)", name), func(t *testing.T) {
+-		errs := ValSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, SemanticDeepEqual)
++		errs := ValSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, ReflectDeepEqual)
+ 		if len(errs) != wantErrs {
+ 			t.Errorf("expected %d errors, got %d: %s", wantErrs, len(errs), fmtErrs(errs))
+ 		}
+@@ -483,7 +650,7 @@ func testValSliceUniqueByReflect[T any](t *testing.T, name string, input []T, wa
+ 	t.Helper()
+ 	var zero T
+ 	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+-		errs := ValSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, SemanticDeepEqual)
++		errs := ValSliceUnique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, ReflectDeepEqual)
+ 		if len(errs) != wantErrs {
+ 			t.Errorf("expected %d errors, got %d: %s", wantErrs, len(errs), fmtErrs(errs))
+ 		}
+@@ -573,7 +740,7 @@ func TestEachPtrSliceValRatcheting(t *testing.T) {
+ 	testEachPtrSliceValRatcheting(t, "ComparableStruct same data different order",
+ 		[]*TestStruct{{11, "a"}, {12, "b"}, {13, "c"}},
+ 		[]*TestStruct{{11, "a"}, {13, "c"}, {12, "b"}},
+-		SemanticDeepEqual,
++		ReflectDeepEqual,
+ 		nil,
+ 	)
+ }
+@@ -650,3 +817,30 @@ func TestPtrSliceNoNils(t *testing.T) {
+ 		})
+ 	}
+ }
++
++func TestPtrMapNoNils(t *testing.T) {
++	tests := []struct {
++		name     string
++		input    map[string]*int
++		wantErrs int
++	}{
++		{"nil", nil, 0},
++		{"empty", map[string]*int{}, 0},
++		{"no_nil", map[string]*int{"a": new(1), "b": new(2)}, 0},
++		{"has_nil", map[string]*int{"a": new(1), "b": nil, "c": new(3), "d": nil}, 2},
++	}
++
++	for _, tt := range tests {
++		t.Run(tt.name, func(t *testing.T) {
++			errs := PtrMapNoNils(context.Background(), operation.Operation{}, field.NewPath("test"), tt.input, nil)
++			if len(errs) != tt.wantErrs {
++				t.Errorf("expected %d errors, got %d: %v", tt.wantErrs, len(errs), errs)
++			}
++			for _, err := range errs {
++				if err.Type != field.ErrorTypeRequired {
++					t.Errorf("expected Required error, got %v", err.Type)
++				}
++			}
++		})
++	}
++}
+diff --git a/staging/src/k8s.io/apimachinery/pkg/api/validate/item_test.go b/staging/src/k8s.io/apimachinery/pkg/api/validate/item_test.go
+index 2efd68c0d2b0a..180b8da62c0cd 100644
+--- a/staging/src/k8s.io/apimachinery/pkg/api/validate/item_test.go
++++ b/staging/src/k8s.io/apimachinery/pkg/api/validate/item_test.go
+@@ -157,7 +157,7 @@ func TestValSliceItem(t *testing.T) {
+ 			op := operation.Operation{Type: operation.Update}
+ 			fp := field.NewPath("")
+ 
+-			got := ValSliceItem(ctx, op, fp, tc.new, tc.old, tc.match, SemanticDeepEqual, tc.validator)
++			got := ValSliceItem(ctx, op, fp, tc.new, tc.old, tc.match, ReflectDeepEqual, tc.validator)
+ 
+ 			if !reflect.DeepEqual(got, tc.expected) {
+ 				t.Errorf("got %v want %v", got, tc.expected)
+@@ -227,7 +227,7 @@ func TestPtrSliceItem(t *testing.T) {
+ 			op := operation.Operation{Type: operation.Update}
+ 			fp := field.NewPath("")
+ 
+-			got := PtrSliceItem(ctx, op, fp, tc.new, tc.old, tc.match, SemanticDeepEqual, tc.validator)
++			got := PtrSliceItem(ctx, op, fp, tc.new, tc.old, tc.match, ReflectDeepEqual, tc.validator)
+ 
+ 			if !reflect.DeepEqual(got, tc.expected) {
+ 				t.Errorf("got %v want %v", got, tc.expected)
+diff --git a/staging/src/k8s.io/apimachinery/pkg/api/validate/update.go b/staging/src/k8s.io/apimachinery/pkg/api/validate/update.go
+index c258e6d112c65..cf4db5b5294f1 100644
+--- a/staging/src/k8s.io/apimachinery/pkg/api/validate/update.go
++++ b/staging/src/k8s.io/apimachinery/pkg/api/validate/update.go
+@@ -42,8 +42,8 @@ const (
+ 	NoRemoveItem
+ )
+ 
+-// UpdateValueByCompare verifies update constraints for comparable value types.
+-func UpdateValueByCompare[T comparable](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
++// UpdateValue verifies update constraints for value types.
++func UpdateValue[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, equiv MatchFunc[T], constraints ...UpdateConstraint) field.ErrorList {
+ 	// nil oldValue means no prior value to compare against (eg: a new item at +k8s:eachVal scope) -> no transition to check.
+ 	if op.Type != operation.Update || oldValue == nil {
+ 		return nil
+@@ -51,22 +51,24 @@ func UpdateValueByCompare[T comparable](_ context.Context, op operation.Operatio
+ 
+ 	var errs field.ErrorList
+ 	var zero T
++	valueIsZero := equiv(*value, zero)
++	oldValueIsZero := equiv(*oldValue, zero)
+ 
+ 	for _, constraint := range constraints {
+ 		switch constraint {
+ 		case NoSet:
+-			if *oldValue == zero && *value != zero {
++			if oldValueIsZero && !valueIsZero {
+ 				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+ 			}
+ 		case NoUnset:
+-			if *oldValue != zero && *value == zero {
++			if !oldValueIsZero && valueIsZero {
+ 				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+ 			}
+ 		case NoModify:
+ 			// Rely on validation ratcheting to detect that the value has changed.
+ 			// This check only verifies that the field was set in both the old and
+ 			// new objects, confirming it was a modification, not a set/unset.
+-			if *oldValue != zero && *value != zero {
++			if !oldValueIsZero && !valueIsZero {
+ 				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be modified once set").WithOrigin("update"))
+ 			}
+ 		}
+@@ -75,6 +77,13 @@ func UpdateValueByCompare[T comparable](_ context.Context, op operation.Operatio
+ 	return errs
+ }
+ 
++// UpdateValueByCompare verifies update constraints for comparable value types.
++//
++// Deprecated: Use UpdateValue instead.
++func UpdateValueByCompare[T comparable](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
++	return UpdateValue(ctx, op, fldPath, value, oldValue, func(a, b T) bool { return a == b }, constraints...)
++}
++
+ // UpdatePointer verifies update constraints for pointer types.
+ func UpdatePointer[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+ 	if op.Type != operation.Update {
+@@ -107,38 +116,10 @@ func UpdatePointer[T any](_ context.Context, op operation.Operation, fldPath *fi
+ }
+ 
+ // UpdateValueByReflect verifies update constraints for non-comparable value types using reflection.
+-func UpdateValueByReflect[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+-	// nil oldValue means no prior value to compare against (eg: a new item at +k8s:eachVal scope) -> no transition to check.
+-	if op.Type != operation.Update || oldValue == nil {
+-		return nil
+-	}
+-
+-	var errs field.ErrorList
+-	var zero T
+-	valueIsZero := equality.Semantic.DeepEqual(*value, zero)
+-	oldValueIsZero := equality.Semantic.DeepEqual(*oldValue, zero)
+-
+-	for _, constraint := range constraints {
+-		switch constraint {
+-		case NoSet:
+-			if oldValueIsZero && !valueIsZero {
+-				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+-			}
+-		case NoUnset:
+-			if !oldValueIsZero && valueIsZero {
+-				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+-			}
+-		case NoModify:
+-			// Rely on validation ratcheting to detect that the value has changed.
+-			// This check only verifies that the field was set in both the old and
+-			// new objects, confirming it was a modification, not a set/unset.
+-			if !oldValueIsZero && !valueIsZero {
+-				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be modified once set").WithOrigin("update"))
+-			}
+-		}
+-	}
+-
+-	return errs
++//
++// Deprecated: Use UpdateValue instead.
++func UpdateValueByReflect[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
++	return UpdateValue(ctx, op, fldPath, value, oldValue, func(a, b T) bool { return equality.Semantic.DeepEqual(a, b) }, constraints...)
+ }
+ 
+ // UpdateStruct verifies update constraints for non-pointer struct types.
+diff --git a/staging/src/k8s.io/apimachinery/pkg/api/validate/update_test.go b/staging/src/k8s.io/apimachinery/pkg/api/validate/update_test.go
+index f9e13e0e99dd6..1978ced8d72ab 100644
+--- a/staging/src/k8s.io/apimachinery/pkg/api/validate/update_test.go
++++ b/staging/src/k8s.io/apimachinery/pkg/api/validate/update_test.go
+@@ -138,10 +138,153 @@ func TestUpdateValue(t *testing.T) {
+ 		},
+ 	}
+ 
++	for _, tt := range tests {
++		t.Run(tt.name, func(t *testing.T) {
++			op := operation.Operation{Type: tt.op}
++			errs := UpdateValue(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, func(a, b string) bool { return a == b }, tt.constraints...)
++			if len(errs) != tt.wantErrs {
++				t.Errorf("UpdateValue() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
++			}
++			for i, msg := range tt.wantMsgs {
++				if i >= len(errs) {
++					t.Errorf("Expected error message %q not found", msg)
++					continue
++				}
++				if errs[i].Detail != msg {
++					t.Errorf("UpdateValue() error message = %q, want %q", errs[i].Detail, msg)
++				}
++			}
++		})
++	}
++}
++
++func TestUpdateValueByCompare(t *testing.T) {
++	tests := []struct {
++		name        string
++		op          operation.Type
++		value       string
++		oldValue    string
++		constraints []UpdateConstraint
++		wantErrs    int
++		wantMsgs    []string
++	}{
++		{
++			name:        "NoSet - unset to set transition (forbidden)",
++			op:          operation.Update,
++			value:       "value",
++			oldValue:    "",
++			constraints: []UpdateConstraint{NoSet},
++			wantErrs:    1,
++			wantMsgs:    []string{"field cannot be set once created"},
++		},
++		{
++			name:        "NoUnset - set to unset transition (forbidden)",
++			op:          operation.Update,
++			value:       "",
++			oldValue:    "value",
++			constraints: []UpdateConstraint{NoUnset},
++			wantErrs:    1,
++			wantMsgs:    []string{"field cannot be cleared once set"},
++		},
++		{
++			name:        "NoModify - set to different value (forbidden)",
++			op:          operation.Update,
++			value:       "value2",
++			oldValue:    "value1",
++			constraints: []UpdateConstraint{NoModify},
++			wantErrs:    1,
++			wantMsgs:    []string{"field cannot be modified once set"},
++		},
++	}
++
+ 	for _, tt := range tests {
+ 		t.Run(tt.name, func(t *testing.T) {
+ 			op := operation.Operation{Type: tt.op}
+ 			errs := UpdateValueByCompare(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, tt.constraints...)
++			if len(errs) != tt.wantErrs {
++				t.Errorf("UpdateValueByCompare() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
++			}
++			for i, msg := range tt.wantMsgs {
++				if i >= len(errs) {
++					t.Errorf("Expected error message %q not found", msg)
++					continue
++				}
++				if errs[i].Detail != msg {
++					t.Errorf("UpdateValueByCompare() error message = %q, want %q", errs[i].Detail, msg)
++				}
++			}
++		})
++	}
++}
++
++func TestUpdateValue_CustomMatchFunc(t *testing.T) {
++	type NonComparableStruct struct {
++		Name string
++		Tags []string
++	}
++
++	customEquiv := func(a, b NonComparableStruct) bool {
++		return a.Name == b.Name && (len(a.Tags) == 0 && len(b.Tags) == 0 || (len(a.Tags) == len(b.Tags) && a.Tags[0] == b.Tags[0]))
++	}
++
++	tests := []struct {
++		name        string
++		op          operation.Type
++		value       NonComparableStruct
++		oldValue    NonComparableStruct
++		constraints []UpdateConstraint
++		wantErrs    int
++		wantMsgs    []string
++	}{
++		{
++			name:        "NoSet - unset to set (forbidden)",
++			op:          operation.Update,
++			value:       NonComparableStruct{Name: "foo", Tags: []string{"a"}},
++			oldValue:    NonComparableStruct{},
++			constraints: []UpdateConstraint{NoSet},
++			wantErrs:    1,
++			wantMsgs:    []string{"field cannot be set once created"},
++		},
++		{
++			name:        "NoUnset - set to unset (forbidden)",
++			op:          operation.Update,
++			value:       NonComparableStruct{},
++			oldValue:    NonComparableStruct{Name: "foo", Tags: []string{"a"}},
++			constraints: []UpdateConstraint{NoUnset},
++			wantErrs:    1,
++			wantMsgs:    []string{"field cannot be cleared once set"},
++		},
++		{
++			name:        "NoModify - zero to non-zero transition (allowed)",
++			op:          operation.Update,
++			value:       NonComparableStruct{Name: "foo", Tags: []string{"a"}},
++			oldValue:    NonComparableStruct{},
++			constraints: []UpdateConstraint{NoModify},
++			wantErrs:    0,
++		},
++		{
++			name:        "NoModify - non-zero to zero transition (allowed)",
++			op:          operation.Update,
++			value:       NonComparableStruct{},
++			oldValue:    NonComparableStruct{Name: "foo", Tags: []string{"a"}},
++			constraints: []UpdateConstraint{NoModify},
++			wantErrs:    0,
++		},
++		{
++			name:        "NoModify - non-zero to non-zero transition (forbidden)",
++			op:          operation.Update,
++			value:       NonComparableStruct{Name: "foo", Tags: []string{"b"}},
++			oldValue:    NonComparableStruct{Name: "foo", Tags: []string{"a"}},
++			constraints: []UpdateConstraint{NoModify},
++			wantErrs:    1,
++			wantMsgs:    []string{"field cannot be modified once set"},
++		},
++	}
++
++	for _, tt := range tests {
++		t.Run(tt.name, func(t *testing.T) {
++			op := operation.Operation{Type: tt.op}
++			errs := UpdateValue(context.TODO(), op, field.NewPath("test"), &tt.value, &tt.oldValue, customEquiv, tt.constraints...)
+ 			if len(errs) != tt.wantErrs {
+ 				t.Errorf("UpdateValue() returned %d errors, want %d: %v", len(errs), tt.wantErrs, errs)
+ 			}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/doc.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/doc.go
+index 25f869adadfb6..a8017edc07723 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/doc.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/doc.go
+@@ -39,6 +39,16 @@ type Struct struct {
+ 	MapTypedefField map[string]StringType `json:"mapTypedefField"`
+ 
+ 	UnvalidatedMapField map[string]string `json:"UnvalidatedMapField"`
++
++	// +k8s:validateFalse="field Struct.MapPtrField"
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrField[*]"
++	MapPtrField map[string]*string `json:"mapPtrField"`
++
++	// +k8s:validateFalse="field Struct.MapPtrTypedefField"
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrTypedefField[*]"
++	MapPtrTypedefField map[string]*StringType `json:"mapPtrTypedefField"`
++
++	UnvalidatedMapPtrField map[string]*string `json:"UnvalidatedMapPtrField"`
+ }
+ 
+ // +k8s:validateFalse="type StringType"
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/testdata/validate-false.json b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/testdata/validate-false.json
+index 5076a6fcff727..b7758a6448905 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/testdata/validate-false.json
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/testdata/validate-false.json
+@@ -12,6 +12,26 @@
+     "mapField[岯Ȉ\u0026\u003c沲3]": [
+       "field Struct.MapField[*]"
+     ],
++    "mapPtrField": [
++      "field Struct.MapPtrField"
++    ],
++    "mapPtrField[`ȝ懿沇]": [
++      "field Struct.MapPtrField[*]"
++    ],
++    "mapPtrField[ǝ祇Fæƭō]": [
++      "field Struct.MapPtrField[*]"
++    ],
++    "mapPtrTypedefField": [
++      "field Struct.MapPtrTypedefField"
++    ],
++    "mapPtrTypedefField[ʈ劉j蕓ư銩6ij憏歅%ɜ¤0Ȼ]": [
++      "field Struct.MapPtrTypedefField[*]",
++      "type StringType"
++    ],
++    "mapPtrTypedefField[剛ň=Z?ǿ\u003c]": [
++      "field Struct.MapPtrTypedefField[*]",
++      "type StringType"
++    ],
+     "mapTypedefField": [
+       "field Struct.MapTypedefField"
+     ],
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/zz_generated.validations.go
+index e2520a6146e80..a4c8f92c3abda 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_primitive/zz_generated.validations.go
+@@ -146,5 +146,87 @@ func Validate_Struct(
+ 	}
+ 
+ 	// field Struct.UnvalidatedMapField has no validation
++
++	{ // field Struct.MapPtrField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*string,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField"); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) map[string]*string {
++				return oldObj.MapPtrField
++			})
++		errs = append(errs, fn(fldPath.Child("mapPtrField"), obj.MapPtrField, oldVal, oldObj != nil)...)
++	}
++
++	{ // field Struct.MapPtrTypedefField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*StringType,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, StringType](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField"); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// iterate the map and call the value type's validation function
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_StringType); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) map[string]*StringType {
++				return oldObj.MapPtrTypedefField
++			})
++		errs = append(errs, fn(fldPath.Child("mapPtrTypedefField"), obj.MapPtrTypedefField, oldVal, oldObj != nil)...)
++	}
++
++	// field Struct.UnvalidatedMapPtrField has no validation
+ 	return errs
+ }
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/doc.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/doc.go
+index 4e39a1de8e8ab..2f771fb1deae0 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/doc.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/doc.go
+@@ -38,7 +38,17 @@ type Struct struct {
+ 	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapTypedefField[*]"
+ 	MapTypedefField map[string]OtherTypedefStruct `json:"mapTypedefField"`
+ 
+-	UnvalidatedMapField map[string]string `json:"UnvalidatedMapField"`
++	UnvalidatedMapField map[string]UnvalidatedStruct `json:"UnvalidatedMapField"`
++
++	// +k8s:validateFalse="field Struct.MapPtrField"
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrField[*]"
++	MapPtrField map[string]*OtherStruct `json:"mapPtrField"`
++
++	// +k8s:validateFalse="field Struct.MapPtrTypedefField"
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrTypedefField[*]"
++	MapPtrTypedefField map[string]*OtherTypedefStruct `json:"mapPtrTypedefField"`
++
++	UnvalidatedMapPtrField map[string]*UnvalidatedStruct `json:"UnvalidatedMapPtrField"`
+ }
+ 
+ // +k8s:validateFalse="type OtherStruct"
+@@ -46,3 +56,5 @@ type OtherStruct struct{}
+ 
+ // +k8s:validateFalse="type OtherTypedefStruct"
+ type OtherTypedefStruct OtherStruct
++
++type UnvalidatedStruct struct{}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/testdata/validate-false.json b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/testdata/validate-false.json
+index ec038cbc5e682..2253b92760894 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/testdata/validate-false.json
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/testdata/validate-false.json
+@@ -14,6 +14,28 @@
+       "field Struct.MapField[*]",
+       "type OtherStruct"
+     ],
++    "mapPtrField": [
++      "field Struct.MapPtrField"
++    ],
++    "mapPtrField[\u003eóDz岋笨Gń條]": [
++      "field Struct.MapPtrField[*]",
++      "type OtherStruct"
++    ],
++    "mapPtrField[]": [
++      "field Struct.MapPtrField[*]",
++      "type OtherStruct"
++    ],
++    "mapPtrTypedefField": [
++      "field Struct.MapPtrTypedefField"
++    ],
++    "mapPtrTypedefField[v$蛷)讻IeYF墄[C_睿ȉǫ蹟t´]": [
++      "field Struct.MapPtrTypedefField[*]",
++      "type OtherTypedefStruct"
++    ],
++    "mapPtrTypedefField[ș$0đ\u003eƯ]ɹȽ東]": [
++      "field Struct.MapPtrTypedefField[*]",
++      "type OtherTypedefStruct"
++    ],
+     "mapTypedefField": [
+       "field Struct.MapTypedefField"
+     ],
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/zz_generated.validations.go
+index 0b45bc834b4bd..ebe69b0254344 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/map_of_struct/zz_generated.validations.go
+@@ -163,5 +163,91 @@ func Validate_Struct(
+ 	}
+ 
+ 	// field Struct.UnvalidatedMapField has no validation
++
++	{ // field Struct.MapPtrField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*OtherStruct,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, OtherStruct](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField"); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// iterate the map and call the value type's validation function
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_OtherStruct); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) map[string]*OtherStruct {
++				return oldObj.MapPtrField
++			})
++		errs = append(errs, fn(fldPath.Child("mapPtrField"), obj.MapPtrField, oldVal, oldObj != nil)...)
++	}
++
++	{ // field Struct.MapPtrTypedefField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*OtherTypedefStruct,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, OtherTypedefStruct](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField"); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherTypedefStruct) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// iterate the map and call the value type's validation function
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_OtherTypedefStruct); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) map[string]*OtherTypedefStruct {
++				return oldObj.MapPtrTypedefField
++			})
++		errs = append(errs, fn(fldPath.Child("mapPtrTypedefField"), obj.MapPtrTypedefField, oldVal, oldObj != nil)...)
++	}
++
++	// field Struct.UnvalidatedMapPtrField has no validation
+ 	return errs
+ }
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/doc.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/doc.go
+index d21f559c00da1..a4b62cc13e9e0 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/doc.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/doc.go
+@@ -29,20 +29,28 @@ var localSchemeBuilder = testscheme.New()
+ // Note: no validation here
+ type UnvalidatedType map[string]string
+ 
++// Note: no validation here
++type UnvalidatedPtrType map[string]*string
++
+ // +k8s:validateFalse="type MapType"
+ // +k8s:eachVal=+k8s:validateFalse="type MapType[*]"
+ type MapType map[string]string
+ 
+-// Note: no validation here
+-type UnvalidatedPtrType map[string]*string
+-
+-// +k8s:validateFalse="type StringType"
+-type StringType string
++// +k8s:validateFalse="type MapPtrType"
++// +k8s:eachVal=+k8s:validateFalse="type MapPtrType[*]"
++type MapPtrType map[string]*string
+ 
+ // +k8s:validateFalse="type MapTypedefType"
+ // +k8s:eachVal=+k8s:validateFalse="type MapTypedefType[*]"
+ type MapTypedefType map[string]StringType
+ 
++// +k8s:validateFalse="type MapPtrTypedefType"
++// +k8s:eachVal=+k8s:validateFalse="type MapPtrTypedefType[*]"
++type MapPtrTypedefType map[string]*StringType
++
++// +k8s:validateFalse="type StringType"
++type StringType string
++
+ // +k8s:validateFalse="type Struct"
+ type Struct struct {
+ 	TypeMeta int
+@@ -54,4 +62,16 @@ type Struct struct {
+ 	// +k8s:validateFalse="field Struct.MapTypedefField"
+ 	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapTypedefField[*]"
+ 	MapTypedefField MapTypedefType `json:"mapTypedefField"`
++
++	UnvalidatedMapField UnvalidatedType `json:"UnvalidatedMapField"`
++
++	// +k8s:validateFalse="field Struct.MapPtrField"
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrField[*]"
++	MapPtrField MapPtrType `json:"mapPtrField"`
++
++	// +k8s:validateFalse="field Struct.MapPtrTypedefField"
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPtrTypedefField[*]"
++	MapPtrTypedefField MapPtrTypedefType `json:"mapPtrTypedefField"`
++
++	UnvalidatedMapPtrField UnvalidatedPtrType `json:"UnvalidatedMapPtrField"`
+ }
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/testdata/validate-false.json b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/testdata/validate-false.json
+index c4b147c06f9f2..65a321116f417 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/testdata/validate-false.json
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/testdata/validate-false.json
+@@ -15,6 +15,32 @@
+       "field Struct.MapField[*]",
+       "type MapType[*]"
+     ],
++    "mapPtrField": [
++      "field Struct.MapPtrField",
++      "type MapPtrType"
++    ],
++    "mapPtrField[`ȝ懿沇]": [
++      "field Struct.MapPtrField[*]",
++      "type MapPtrType[*]"
++    ],
++    "mapPtrField[ǝ祇Fæƭō]": [
++      "field Struct.MapPtrField[*]",
++      "type MapPtrType[*]"
++    ],
++    "mapPtrTypedefField": [
++      "field Struct.MapPtrTypedefField",
++      "type MapPtrTypedefType"
++    ],
++    "mapPtrTypedefField[ʈ劉j蕓ư銩6ij憏歅%ɜ¤0Ȼ]": [
++      "field Struct.MapPtrTypedefField[*]",
++      "type MapPtrTypedefType[*]",
++      "type StringType"
++    ],
++    "mapPtrTypedefField[剛ň=Z?ǿ\u003c]": [
++      "field Struct.MapPtrTypedefField[*]",
++      "type MapPtrTypedefType[*]",
++      "type StringType"
++    ],
+     "mapTypedefField": [
+       "field Struct.MapTypedefField",
+       "type MapTypedefType"
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/zz_generated.validations.go
+index a5da56f4c5832..15a29c153d037 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/maps/typedef_to_map/zz_generated.validations.go
+@@ -56,6 +56,49 @@ func RegisterValidations(scheme *testscheme.Scheme) error {
+ 	return nil
+ }
+ 
++// Validate_MapPtrType validates an instance of MapPtrType according
++// to declarative validation rules in the API schema.
++func Validate_MapPtrType(
++	ctx context.Context, op operation.Operation, fldPath *field.Path,
++	obj, oldObj MapPtrType) (errs field.ErrorList) {
++
++	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapPtrType"); len(e) != 0 {
++		errs = append(errs, e...)
++	}
++	if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
++			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapPtrType[*]")
++		}); len(e) != 0 {
++		errs = append(errs, e...)
++	}
++
++	return errs
++}
++
++// Validate_MapPtrTypedefType validates an instance of MapPtrTypedefType according
++// to declarative validation rules in the API schema.
++func Validate_MapPtrTypedefType(
++	ctx context.Context, op operation.Operation, fldPath *field.Path,
++	obj, oldObj MapPtrTypedefType) (errs field.ErrorList) {
++
++	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapPtrTypedefType"); len(e) != 0 {
++		errs = append(errs, e...)
++	}
++	if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
++			return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type MapPtrTypedefType[*]")
++		}); len(e) != 0 {
++		errs = append(errs, e...)
++	}
++
++	// iterate the map and call the value type's validation function
++	if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_StringType); len(e) != 0 {
++		errs = append(errs, e...)
++	}
++
++	return errs
++}
++
+ // Validate_MapType validates an instance of MapType according
+ // to declarative validation rules in the API schema.
+ func Validate_MapType(
+@@ -188,5 +231,88 @@ func Validate_Struct(
+ 		errs = append(errs, fn(fldPath.Child("mapTypedefField"), obj.MapTypedefField, oldVal, oldObj != nil)...)
+ 	}
+ 
++	// field Struct.UnvalidatedMapField has no validation
++
++	{ // field Struct.MapPtrField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj MapPtrType,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField"); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// call the type's validation function
++			errs = append(errs, Validate_MapPtrType(ctx, op, fldPath, obj, oldObj)...)
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) MapPtrType {
++				return oldObj.MapPtrField
++			})
++		errs = append(errs, fn(fldPath.Child("mapPtrField"), obj.MapPtrField, oldVal, oldObj != nil)...)
++	}
++
++	{ // field Struct.MapPtrTypedefField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj MapPtrTypedefType,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, StringType](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField"); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *StringType) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPtrTypedefField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// call the type's validation function
++			errs = append(errs, Validate_MapPtrTypedefType(ctx, op, fldPath, obj, oldObj)...)
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) MapPtrTypedefType {
++				return oldObj.MapPtrTypedefField
++			})
++		errs = append(errs, fn(fldPath.Child("mapPtrTypedefField"), obj.MapPtrTypedefField, oldVal, oldObj != nil)...)
++	}
++
++	// field Struct.UnvalidatedMapPtrField has no validation
+ 	return errs
+ }
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc.go
+new file mode 100644
+index 0000000000000..74beb7963a20c
+--- /dev/null
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc.go
+@@ -0,0 +1,54 @@
++/*
++Copyright The Kubernetes Authors.
++
++Licensed under the Apache License, Version 2.0 (the "License");
++you may not use this file except in compliance with the License.
++You may obtain a copy of the License at
++
++    http://www.apache.org/licenses/LICENSE-2.0
++
++Unless required by applicable law or agreed to in writing, software
++distributed under the License is distributed on an "AS IS" BASIS,
++WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++See the License for the specific language governing permissions and
++limitations under the License.
++*/
++
++// +k8s:validation-gen=TypesWithField=TypeMeta
++// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
++// +k8s:validation-gen-deep-equal-func=k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func.CustomDeepEqual
++
++// This is a test package.
++// +k8s:validation-gen-nolint
++package deepequalfunc
++
++import (
++	"reflect"
++
++	"k8s.io/code-generator/cmd/validation-gen/testscheme"
++)
++
++var localSchemeBuilder = testscheme.New()
++
++var CustomDeepEqualCalls int
++
++func CustomDeepEqual(a, b any) bool {
++	CustomDeepEqualCalls++
++	return reflect.DeepEqual(a, b)
++}
++
++type Struct struct {
++	TypeMeta int
++
++	// +k8s:validateFalse="field Struct.NonComparableField"
++	NonComparableField NonComparableStruct `json:"nonComparableField"`
++
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapField[*]"
++	MapField map[string]NonComparableStruct `json:"mapField"`
++}
++
++// +k8s:validateFalse="type NonComparableStruct"
++type NonComparableStruct struct {
++	// Ptr makes it not direct-comparable
++	Ptr *int `json:"ptr"`
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc_test.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc_test.go
+new file mode 100644
+index 0000000000000..595e71d26c1bd
+--- /dev/null
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/doc_test.go
+@@ -0,0 +1,71 @@
++/*
++Copyright The Kubernetes Authors.
++
++Licensed under the Apache License, Version 2.0 (the "License");
++you may not use this file except in compliance with the License.
++You may obtain a copy of the License at
++
++    http://www.apache.org/licenses/LICENSE-2.0
++
++Unless required by applicable law or agreed to in writing, software
++distributed under the License is distributed on an "AS IS" BASIS,
++WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++See the License for the specific language governing permissions and
++limitations under the License.
++*/
++
++package deepequalfunc
++
++import (
++	"testing"
++)
++
++func TestDeepEqualFunc(t *testing.T) {
++	st := localSchemeBuilder.Test(t)
++
++	// Create
++	val1 := 10
++	obj := &Struct{
++		NonComparableField: NonComparableStruct{Ptr: &val1},
++		MapField: map[string]NonComparableStruct{
++			"a": {Ptr: &val1},
++		},
++	}
++	st.Value(obj).ExpectValidateFalseByPath(map[string][]string{
++		"nonComparableField": {"field Struct.NonComparableField", "type NonComparableStruct"},
++		"mapField[a]":        {"field Struct.MapField[*]", "type NonComparableStruct"},
++	})
++
++	// Update with same values should ratchet (skip validation) using CustomDeepEqual
++	CustomDeepEqualCalls = 0
++	oldObj := &Struct{
++		NonComparableField: NonComparableStruct{Ptr: &val1},
++		MapField: map[string]NonComparableStruct{
++			"a": {Ptr: &val1},
++		},
++	}
++	newObj := &Struct{
++		NonComparableField: NonComparableStruct{Ptr: &val1},
++		MapField: map[string]NonComparableStruct{
++			"a": {Ptr: &val1},
++		},
++	}
++	st.Value(newObj).OldValue(oldObj).ExpectValid()
++	if CustomDeepEqualCalls == 0 {
++		t.Errorf("expected CustomDeepEqual to be called during update ratcheting, got %d calls", CustomDeepEqualCalls)
++	}
++
++	// Update with a new map key added: old key "a" ratchets via deepEqualImpl_ -> CustomDeepEqual,
++	// only new key "b" fails.
++	val2 := 20
++	updateObj := &Struct{
++		NonComparableField: NonComparableStruct{Ptr: &val1},
++		MapField: map[string]NonComparableStruct{
++			"a": {Ptr: &val1},
++			"b": {Ptr: &val2},
++		},
++	}
++	st.Value(updateObj).OldValue(oldObj).ExpectValidateFalseByPath(map[string][]string{
++		"mapField[b]": {"field Struct.MapField[*]", "type NonComparableStruct"},
++	})
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/zz_generated.validations.go
+new file mode 100644
+index 0000000000000..2ec646bb0e067
+--- /dev/null
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/deep_equal_func/zz_generated.validations.go
+@@ -0,0 +1,143 @@
++//go:build !ignore_autogenerated
++// +build !ignore_autogenerated
++
++/*
++Copyright The Kubernetes Authors.
++
++Licensed under the Apache License, Version 2.0 (the "License");
++you may not use this file except in compliance with the License.
++You may obtain a copy of the License at
++
++    http://www.apache.org/licenses/LICENSE-2.0
++
++Unless required by applicable law or agreed to in writing, software
++distributed under the License is distributed on an "AS IS" BASIS,
++WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++See the License for the specific language governing permissions and
++limitations under the License.
++*/
++
++// Code generated by validation-gen. DO NOT EDIT.
++
++package deepequalfunc
++
++import (
++	context "context"
++	fmt "fmt"
++
++	operation "k8s.io/apimachinery/pkg/api/operation"
++	safe "k8s.io/apimachinery/pkg/api/safe"
++	validate "k8s.io/apimachinery/pkg/api/validate"
++	field "k8s.io/apimachinery/pkg/util/validation/field"
++	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
++)
++
++func init() { localSchemeBuilder.Register(RegisterValidations) }
++
++// RegisterValidations adds validation functions to the given scheme.
++// Public to allow building arbitrary schemes.
++func RegisterValidations(scheme *testscheme.Scheme) error {
++	// type Struct
++	scheme.AddValidationFunc(
++		(*Struct)(nil),
++		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
++			switch op.Request.SubresourcePath() {
++			case "/":
++				return Validate_Struct(
++					ctx, op, nil, /* fldPath */
++					obj.(*Struct),
++					safe.Cast[*Struct](oldObj))
++			}
++			return field.ErrorList{
++				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
++			}
++		})
++	return nil
++}
++
++// Validate_NonComparableStruct validates an instance of NonComparableStruct according
++// to declarative validation rules in the API schema.
++func Validate_NonComparableStruct(
++	ctx context.Context, op operation.Operation, fldPath *field.Path,
++	obj, oldObj *NonComparableStruct) (errs field.ErrorList) {
++
++	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type NonComparableStruct"); len(e) != 0 {
++		errs = append(errs, e...)
++	}
++
++	// field NonComparableStruct.Ptr has no validation
++	return errs
++}
++
++// Validate_Struct validates an instance of Struct according
++// to declarative validation rules in the API schema.
++func Validate_Struct(
++	ctx context.Context, op operation.Operation, fldPath *field.Path,
++	obj, oldObj *Struct) (errs field.ErrorList) {
++
++	// field Struct.TypeMeta has no validation
++
++	{ // field Struct.NonComparableField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj *NonComparableStruct,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if CustomDeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.NonComparableField"); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// call the type's validation function
++			errs = append(errs, Validate_NonComparableStruct(ctx, op, fldPath, obj, oldObj)...)
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) *NonComparableStruct {
++				return &oldObj.NonComparableField
++			})
++		errs = append(errs, fn(fldPath.Child("nonComparableField"), &obj.NonComparableField, oldVal, oldObj != nil)...)
++	}
++
++	{ // field Struct.MapField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]NonComparableStruct,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if CustomDeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// iterate the map and call the value type's validation function
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_NonComparableStruct); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) map[string]NonComparableStruct {
++				return oldObj.MapField
++			})
++		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
++	}
++
++	return errs
++}
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return CustomDeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/zz_generated.validations.go
+index eb7d8cd0c62dd..9b6ecf48a5b03 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/list/zz_generated.validations.go
+@@ -133,7 +133,7 @@ func Validate_ItemList(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *Item, b *Item) bool { return a.Key == b.Key }, validate.SemanticDeepEqual, Validate_Item); len(e) != 0 {
++				func(a *Item, b *Item) bool { return a.Key == b.Key }, deepEqualImpl_, Validate_Item); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -371,18 +371,18 @@ func Validate_StructSlice(
+ 				}
+ 			}
+ 			// call field-attached validations
+-			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, nil,
++			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, nil,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
+ 					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field SetSliceNonComparableField[*]")
+ 				}); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			// lists with set semantics require unique values
+-			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual); len(e) != 0 {
++			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			// iterate the list and call the type's validation function
+-			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, nil, Validate_NonComparableStruct); len(e) != 0 {
++			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, nil, Validate_NonComparableStruct); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -440,7 +440,7 @@ func Validate_StructSlice(
+ 			}
+ 			// call field-attached validations
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *NonComparableStructWithKey, b *NonComparableStructWithKey) bool { return a.Key == b.Key }, validate.SemanticDeepEqual,
++				func(a *NonComparableStructWithKey, b *NonComparableStructWithKey) bool { return a.Key == b.Key }, deepEqualImpl_,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStructWithKey) field.ErrorList {
+ 					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapSliceNonComparableField[*]")
+ 				}); len(e) != 0 {
+@@ -453,7 +453,7 @@ func Validate_StructSlice(
+ 			}
+ 			// iterate the list and call the type's validation function
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *NonComparableStructWithKey, b *NonComparableStructWithKey) bool { return a.Key == b.Key }, validate.SemanticDeepEqual, Validate_NonComparableStructWithKey); len(e) != 0 {
++				func(a *NonComparableStructWithKey, b *NonComparableStructWithKey) bool { return a.Key == b.Key }, deepEqualImpl_, Validate_NonComparableStructWithKey); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -480,7 +480,7 @@ func Validate_StructSlice(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *PtrKeyStruct, b *PtrKeyStruct) bool {
+ 					return ((a.Key == nil && b.Key == nil) || (a.Key != nil && b.Key != nil && *a.Key == *b.Key))
+-				}, validate.SemanticDeepEqual,
++				}, deepEqualImpl_,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *PtrKeyStruct) field.ErrorList {
+ 					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapSlicePtrKeyField[*]")
+ 				}); len(e) != 0 {
+@@ -497,7 +497,7 @@ func Validate_StructSlice(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *PtrKeyStruct, b *PtrKeyStruct) bool {
+ 					return ((a.Key == nil && b.Key == nil) || (a.Key != nil && b.Key != nil && *a.Key == *b.Key))
+-				}, validate.SemanticDeepEqual, Validate_PtrKeyStruct); len(e) != 0 {
++				}, deepEqualImpl_, Validate_PtrKeyStruct); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -524,7 +524,7 @@ func Validate_StructSlice(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *MixedKeyStruct, b *MixedKeyStruct) bool {
+ 					return ((a.Key1 == nil && b.Key1 == nil) || (a.Key1 != nil && b.Key1 != nil && *a.Key1 == *b.Key1)) && a.Key2 == b.Key2
+-				}, validate.SemanticDeepEqual,
++				}, deepEqualImpl_,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MixedKeyStruct) field.ErrorList {
+ 					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapSliceMixedKeyField[*]")
+ 				}); len(e) != 0 {
+@@ -541,7 +541,7 @@ func Validate_StructSlice(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *MixedKeyStruct, b *MixedKeyStruct) bool {
+ 					return ((a.Key1 == nil && b.Key1 == nil) || (a.Key1 != nil && b.Key1 != nil && *a.Key1 == *b.Key1)) && a.Key2 == b.Key2
+-				}, validate.SemanticDeepEqual, Validate_MixedKeyStruct); len(e) != 0 {
++				}, deepEqualImpl_, Validate_MixedKeyStruct); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -555,3 +555,8 @@ func Validate_StructSlice(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/zz_generated.validations.go
+index e9364e922abcb..183797afbb0c9 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/ratcheting/maps/eachval/zz_generated.validations.go
+@@ -157,7 +157,7 @@ func Validate_StructWithMaps(
+ 				}
+ 			}
+ 			// call field-attached validations
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual,
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
+ 					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field MapTest.MapNonComparableStructField[*]")
+ 				}); len(e) != 0 {
+@@ -174,3 +174,8 @@ func Validate_StructWithMaps(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/zz_generated.validations.go
+index 8dea5b21bba98..0c9ae1e747285 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/recursive/maps/zz_generated.validations.go
+@@ -193,7 +193,7 @@ func Validate_T1(
+ 				}
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_T5); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T5); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -217,7 +217,7 @@ func Validate_T1(
+ 				}
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_T6); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T6); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -250,7 +250,7 @@ func Validate_T2(
+ 				}
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_T1); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T1); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -318,7 +318,7 @@ func Validate_T4(
+ 				}
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_T3); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T3); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -355,7 +355,7 @@ func Validate_T5(
+ 				errs = append(errs, e...)
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_T5); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T5); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -412,7 +412,7 @@ func Validate_T6(
+ 				}
+ 			}
+ 			// iterate the map and call the value type's validation function
+-			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_T6); len(e) != 0 {
++			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, Validate_T6); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -426,3 +426,8 @@ func Validate_T6(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc.go
+new file mode 100644
+index 0000000000000..dfa903970c25e
+--- /dev/null
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc.go
+@@ -0,0 +1,41 @@
++/*
++Copyright The Kubernetes Authors.
++
++Licensed under the Apache License, Version 2.0 (the "License");
++you may not use this file except in compliance with the License.
++You may obtain a copy of the License at
++
++    http://www.apache.org/licenses/LICENSE-2.0
++
++Unless required by applicable law or agreed to in writing, software
++distributed under the License is distributed on an "AS IS" BASIS,
++WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++See the License for the specific language governing permissions and
++limitations under the License.
++*/
++
++// +k8s:validation-gen=TypesWithField=TypeMeta
++// +k8s:validation-gen-scheme-registry=k8s.io/code-generator/cmd/validation-gen/testscheme.Scheme
++
++// This is a test package.
++// +k8s:validation-gen-nolint
++package mapofpointers
++
++import "k8s.io/code-generator/cmd/validation-gen/testscheme"
++
++var localSchemeBuilder = testscheme.New()
++
++type Struct struct {
++	TypeMeta int
++
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapField[*]"
++	MapField map[string]*OtherStruct `json:"mapField"`
++
++	// +k8s:eachVal=+k8s:validateFalse="field Struct.MapPrimitiveField[*]"
++	MapPrimitiveField map[string]*string `json:"mapPrimitiveField"`
++}
++
++// +k8s:validateFalse="type OtherStruct"
++type OtherStruct struct {
++	Value string `json:"value"`
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc_test.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc_test.go
+new file mode 100644
+index 0000000000000..b9e93fe5666a8
+--- /dev/null
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/doc_test.go
+@@ -0,0 +1,52 @@
++/*
++Copyright The Kubernetes Authors.
++
++Licensed under the Apache License, Version 2.0 (the "License");
++you may not use this file except in compliance with the License.
++You may obtain a copy of the License at
++
++    http://www.apache.org/licenses/LICENSE-2.0
++
++Unless required by applicable law or agreed to in writing, software
++distributed under the License is distributed on an "AS IS" BASIS,
++WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++See the License for the specific language governing permissions and
++limitations under the License.
++*/
++
++package mapofpointers
++
++import (
++	"testing"
++
++	"k8s.io/apimachinery/pkg/util/validation/field"
++)
++
++func Test(t *testing.T) {
++	st := localSchemeBuilder.Test(t)
++
++	// 1. Zero values should be valid
++	st.Value(&Struct{
++		// All zero values.
++	}).ExpectValid()
++
++	// 2. Non-nil elements trigger validation errors
++	st.Value(&Struct{
++		MapField:          map[string]*OtherStruct{"k1": {}, "k2": {}},
++		MapPrimitiveField: map[string]*string{"k1": new("a"), "k2": new("b")},
++	}).ExpectValidateFalseByPath(map[string][]string{
++		"mapField[k1]":          {"field Struct.MapField[*]", "type OtherStruct"},
++		"mapField[k2]":          {"field Struct.MapField[*]", "type OtherStruct"},
++		"mapPrimitiveField[k1]": {"field Struct.MapPrimitiveField[*]"},
++		"mapPrimitiveField[k2]": {"field Struct.MapPrimitiveField[*]"},
++	})
++
++	// 3. Nil elements trigger Required errors from PtrMapNoNils
++	st.Value(&Struct{
++		MapField:          map[string]*OtherStruct{"k1": nil},
++		MapPrimitiveField: map[string]*string{"k1": nil},
++	}).ExpectMatches(field.ErrorMatcher{}.ByType().ByField(), field.ErrorList{
++		field.Required(field.NewPath("mapField").Key("k1"), ""),
++		field.Required(field.NewPath("mapPrimitiveField").Key("k1"), ""),
++	})
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/zz_generated.validations.go
+new file mode 100644
+index 0000000000000..641eb0e3fc9b9
+--- /dev/null
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/eachval/map_of_pointers/zz_generated.validations.go
+@@ -0,0 +1,156 @@
++//go:build !ignore_autogenerated
++// +build !ignore_autogenerated
++
++/*
++Copyright The Kubernetes Authors.
++
++Licensed under the Apache License, Version 2.0 (the "License");
++you may not use this file except in compliance with the License.
++You may obtain a copy of the License at
++
++    http://www.apache.org/licenses/LICENSE-2.0
++
++Unless required by applicable law or agreed to in writing, software
++distributed under the License is distributed on an "AS IS" BASIS,
++WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++See the License for the specific language governing permissions and
++limitations under the License.
++*/
++
++// Code generated by validation-gen. DO NOT EDIT.
++
++package mapofpointers
++
++import (
++	context "context"
++	fmt "fmt"
++
++	equality "k8s.io/apimachinery/pkg/api/equality"
++	operation "k8s.io/apimachinery/pkg/api/operation"
++	safe "k8s.io/apimachinery/pkg/api/safe"
++	validate "k8s.io/apimachinery/pkg/api/validate"
++	field "k8s.io/apimachinery/pkg/util/validation/field"
++	testscheme "k8s.io/code-generator/cmd/validation-gen/testscheme"
++)
++
++func init() { localSchemeBuilder.Register(RegisterValidations) }
++
++// RegisterValidations adds validation functions to the given scheme.
++// Public to allow building arbitrary schemes.
++func RegisterValidations(scheme *testscheme.Scheme) error {
++	// type Struct
++	scheme.AddValidationFunc(
++		(*Struct)(nil),
++		func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
++			switch op.Request.SubresourcePath() {
++			case "/":
++				return Validate_Struct(
++					ctx, op, nil, /* fldPath */
++					obj.(*Struct),
++					safe.Cast[*Struct](oldObj))
++			}
++			return field.ErrorList{
++				field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath())),
++			}
++		})
++	return nil
++}
++
++// Validate_OtherStruct validates an instance of OtherStruct according
++// to declarative validation rules in the API schema.
++func Validate_OtherStruct(
++	ctx context.Context, op operation.Operation, fldPath *field.Path,
++	obj, oldObj *OtherStruct) (errs field.ErrorList) {
++
++	if e := validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "type OtherStruct"); len(e) != 0 {
++		errs = append(errs, e...)
++	}
++
++	// field OtherStruct.Value has no validation
++	return errs
++}
++
++// Validate_Struct validates an instance of Struct according
++// to declarative validation rules in the API schema.
++func Validate_Struct(
++	ctx context.Context, op operation.Operation, fldPath *field.Path,
++	obj, oldObj *Struct) (errs field.ErrorList) {
++
++	// field Struct.TypeMeta has no validation
++
++	{ // field Struct.MapField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*OtherStruct,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, OtherStruct](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *OtherStruct) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			// iterate the map and call the value type's validation function
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, Validate_OtherStruct); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) map[string]*OtherStruct {
++				return oldObj.MapField
++			})
++		errs = append(errs, fn(fldPath.Child("mapField"), obj.MapField, oldVal, oldObj != nil)...)
++	}
++
++	{ // field Struct.MapPrimitiveField
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*string,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			if e := validate.EachPtrMapVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual,
++				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
++					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.MapPrimitiveField[*]")
++				}); len(e) != 0 {
++				errs = append(errs, e...)
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *Struct) map[string]*string {
++				return oldObj.MapPrimitiveField
++			})
++		errs = append(errs, fn(fldPath.Child("mapPrimitiveField"), obj.MapPrimitiveField, oldVal, oldObj != nil)...)
++	}
++
++	return errs
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/zz_generated.validations.go
+index 85cc57c4600f8..78c8f3462e128 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/multiple_keys/zz_generated.validations.go
+@@ -168,7 +168,7 @@ func Validate_Struct(
+ 				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+ 					func(item *PtrItem) bool {
+ 						return item.StringKey != nil && *item.StringKey == "target-ptr" && item.IntKey == 42 && item.BoolKey == true
+-					}, validate.SemanticDeepEqual,
++					}, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *PtrItem) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item PtrItems[stringKey=target-ptr,intKey=42,boolKey=true]")
+ 					}); len(e) != 0 {
+@@ -207,7 +207,7 @@ func Validate_Struct(
+ 				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+ 					func(item *MixedPtrItem) bool {
+ 						return item.StringPtrKey != nil && *item.StringPtrKey == "target-ptr" && item.StringKey == "target"
+-					}, validate.SemanticDeepEqual,
++					}, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MixedPtrItem) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item MixedPtrItems")
+ 					}); len(e) != 0 {
+@@ -225,3 +225,8 @@ func Validate_Struct(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/zz_generated.validations.go
+index 870b19161765c..9556a0689460c 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/item/single_key/zz_generated.validations.go
+@@ -303,7 +303,7 @@ func Validate_Struct(
+ 			}
+ 			func() { // cohort = "{"key": "target-ptr"}"
+ 				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+-					func(item *PtrKeyItem) bool { return item.Key != nil && *item.Key == "target-ptr" }, validate.SemanticDeepEqual,
++					func(item *PtrKeyItem) bool { return item.Key != nil && *item.Key == "target-ptr" }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *PtrKeyItem) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item PtrKeyItems[key=target-ptr]")
+ 					}); len(e) != 0 {
+@@ -410,3 +410,8 @@ func Validate_StructWithNestedTypedef(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/zz_generated.validations.go
+index 40c4c8a1d6ca0..c176df16c859d 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/levels/simple/zz_generated.validations.go
+@@ -219,7 +219,8 @@ func Validate_SpecialValidationStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoModify).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -248,7 +249,8 @@ func Validate_SpecialValidationStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkBeta().MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoModify).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/zz_generated.validations.go
+index 8e9c0e99c504f..bd1654a64c5f1 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/multiple_keys/zz_generated.validations.go
+@@ -245,7 +245,7 @@ func Validate_Struct(
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+ 				func(a *NonComparableStruct, b *NonComparableStruct) bool {
+ 					return a.Key1Field == b.Key1Field && a.Key2Field == b.Key2Field
+-				}, validate.SemanticDeepEqual,
++				}, deepEqualImpl_,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
+ 					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListNonComparableField[*]")
+ 				}); len(e) != 0 {
+@@ -290,7 +290,7 @@ func Validate_Struct(
+ 				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+ 					func(item *PtrKeyStruct) bool {
+ 						return item.Key1Field != nil && *item.Key1Field == "target-ptr" && item.Key2Field == 42
+-					}, validate.SemanticDeepEqual,
++					}, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *PtrKeyStruct) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item ListPtrKeyField[key1Field=target-ptr,key2Field=42]")
+ 					}); len(e) != 0 {
+@@ -329,7 +329,7 @@ func Validate_Struct(
+ 				if e := validate.ValSliceItem(ctx, op, fldPath, obj, oldObj,
+ 					func(item *MixedPtrKeyStruct) bool {
+ 						return item.StringPtrKey != nil && *item.StringPtrKey == "target-ptr" && item.StringKey == "target"
+-					}, validate.SemanticDeepEqual,
++					}, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *MixedPtrKeyStruct) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "item ListMixedPtrKeyField")
+ 					}); len(e) != 0 {
+@@ -347,3 +347,8 @@ func Validate_Struct(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/zz_generated.validations.go
+index 79c4099dfb3e0..fb48c34721b80 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listmap/single_key/zz_generated.validations.go
+@@ -227,7 +227,7 @@ func Validate_Struct(
+ 			}
+ 			// call field-attached validations
+ 			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+-				func(a *NonComparableStruct, b *NonComparableStruct) bool { return a.KeyField == b.KeyField }, validate.SemanticDeepEqual,
++				func(a *NonComparableStruct, b *NonComparableStruct) bool { return a.KeyField == b.KeyField }, deepEqualImpl_,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NonComparableStruct) field.ErrorList {
+ 					return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "field Struct.ListNonComparableField[*]")
+ 				}); len(e) != 0 {
+@@ -277,3 +277,8 @@ func Validate_Struct(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/zz_generated.validations.go
+index 8a8b743054e9d..77b155ffdda58 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/listset/zz_generated.validations.go
+@@ -183,7 +183,7 @@ func Validate_ImmutableStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, nil, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, nil, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -191,7 +191,7 @@ func Validate_ImmutableStruct(
+ 				return // do not proceed
+ 			}
+ 			// lists with set semantics require unique values
+-			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual); len(e) != 0 {
++			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -278,7 +278,7 @@ func Validate_ImmutableStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, nil, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, nil, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -286,7 +286,7 @@ func Validate_ImmutableStruct(
+ 				return // do not proceed
+ 			}
+ 			// lists with set semantics require unique values
+-			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual); len(e) != 0 {
++			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -397,7 +397,7 @@ func Validate_Struct(
+ 			}
+ 			// call field-attached validations
+ 			// lists with set semantics require unique values
+-			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual); len(e) != 0 {
++			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -422,7 +422,7 @@ func Validate_Struct(
+ 			}
+ 			// call field-attached validations
+ 			// lists with set semantics require unique values
+-			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual); len(e) != 0 {
++			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -436,3 +436,8 @@ func Validate_Struct(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/zz_generated.validations.go
+index 00cd01fb9ceae..d3968299c2140 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/mode/zz_generated.validations.go
+@@ -25,6 +25,7 @@ import (
+ 	context "context"
+ 	fmt "fmt"
+ 
++	equality "k8s.io/apimachinery/pkg/api/equality"
+ 	operation "k8s.io/apimachinery/pkg/api/operation"
+ 	safe "k8s.io/apimachinery/pkg/api/safe"
+ 	validate "k8s.io/apimachinery/pkg/api/validate"
+@@ -195,7 +196,7 @@ func Validate_Collections(
+ 
+ 	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "listField",
+ 		func(obj *Collections) []string { return obj.ListField },
+-		func(obj *Collections) string { return obj.D1 }, validate.SemanticDeepEqual,
++		func(obj *Collections) string { return obj.D1 }, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenSlice(ctx, op, fldPath, obj, oldObj)...)
+@@ -222,7 +223,7 @@ func Validate_Collections(
+ 	}
+ 	if e := validate.Discriminated(ctx, op, fldPath, obj, oldObj, "mapField",
+ 		func(obj *Collections) map[string]string { return obj.MapField },
+-		func(obj *Collections) string { return obj.D1 }, validate.SemanticDeepEqual,
++		func(obj *Collections) string { return obj.D1 }, deepEqualImpl_,
+ 		func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+ 			errs := field.ErrorList{}
+ 			errs = append(errs, validate.ForbiddenMap(ctx, op, fldPath, obj, oldObj)...)
+@@ -531,3 +532,8 @@ func Validate_StrictUnion(
+ 	// field StrictUnion.FieldB has no validation
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/zz_generated.validations.go
+index ef8c3bc1ef004..120b2c9072d41 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/monotonic/zz_generated.validations.go
+@@ -258,7 +258,8 @@ func Validate_Struct(
+ 			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+ 				earlyReturn = true
+ 			}
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a int, b int) bool { return a == b }, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/zz_generated.validations.go
+index 2134450e65b06..b96320a866dcd 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/options/update/zz_generated.validations.go
+@@ -136,7 +136,8 @@ func Validate_Struct(
+ 			earlyReturn := false
+ 			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", true,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+-					return validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify)
++					return validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++						func(a string, b string) bool { return a == b }, validate.NoModify)
+ 				}).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+@@ -168,7 +169,8 @@ func Validate_Struct(
+ 			earlyReturn := false
+ 			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "FeatureX", false,
+ 				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+-					return validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify)
++					return validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++						func(a string, b string) bool { return a == b }, validate.NoModify)
+ 				}).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/zz_generated.validations.go
+index b9d799f3e64e2..de5a185c66a68 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/list/zz_generated.validations.go
+@@ -79,7 +79,7 @@ func Validate_Struct(
+ 			// call field-attached validations
+ 			func() { // cohort = "labels"
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "labels",
+-					func(o *v1.ObjectMeta) map[string]string { return o.Labels }, validate.SemanticDeepEqual,
++					func(o *v1.ObjectMeta) map[string]string { return o.Labels }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+ 						return validate.EachMapKey(ctx, op, fldPath, obj, oldObj,
+ 							func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+@@ -91,7 +91,7 @@ func Validate_Struct(
+ 			}()
+ 			func() { // cohort = "ownerReferences"
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "ownerReferences",
+-					func(o *v1.ObjectMeta) []v1.OwnerReference { return o.OwnerReferences }, validate.SemanticDeepEqual,
++					func(o *v1.ObjectMeta) []v1.OwnerReference { return o.OwnerReferences }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []v1.OwnerReference) field.ErrorList {
+ 						return validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+ 							func(a *v1.OwnerReference, b *v1.OwnerReference) bool { return a.UID == b.UID })
+@@ -101,7 +101,7 @@ func Validate_Struct(
+ 			}()
+ 			func() { // cohort = "finalizers"
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "finalizers",
+-					func(o *v1.ObjectMeta) []string { return o.Finalizers }, validate.SemanticDeepEqual,
++					func(o *v1.ObjectMeta) []string { return o.Finalizers }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+ 						return validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual)
+ 					}); len(e) != 0 {
+@@ -119,3 +119,8 @@ func Validate_Struct(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/zz_generated.validations.go
+index e9c369fdf7722..d9cf158b01398 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shallow/zz_generated.validations.go
+@@ -112,7 +112,7 @@ func Validate_Struct(
+ 			}()
+ 			func() { // cohort = "sliceField"
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "sliceField",
+-					func(o *OtherStruct) []string { return o.SliceField }, validate.SemanticDeepEqual,
++					func(o *OtherStruct) []string { return o.SliceField }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructField.SliceField")
+ 					}); len(e) != 0 {
+@@ -121,7 +121,7 @@ func Validate_Struct(
+ 			}()
+ 			func() { // cohort = "mapField"
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "mapField",
+-					func(o *OtherStruct) map[string]string { return o.MapField }, validate.SemanticDeepEqual,
++					func(o *OtherStruct) map[string]string { return o.MapField }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructField.MapField")
+ 					}); len(e) != 0 {
+@@ -185,7 +185,7 @@ func Validate_Struct(
+ 			}()
+ 			func() { // cohort = "sliceField"
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "sliceField",
+-					func(o *OtherStruct) []string { return o.SliceField }, validate.SemanticDeepEqual,
++					func(o *OtherStruct) []string { return o.SliceField }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructPtrField.SliceField")
+ 					}); len(e) != 0 {
+@@ -194,7 +194,7 @@ func Validate_Struct(
+ 			}()
+ 			func() { // cohort = "mapField"
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "mapField",
+-					func(o *OtherStruct) map[string]string { return o.MapField }, validate.SemanticDeepEqual,
++					func(o *OtherStruct) map[string]string { return o.MapField }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield Struct.StructPtrField.MapField")
+ 					}); len(e) != 0 {
+@@ -212,3 +212,8 @@ func Validate_Struct(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/zz_generated.validations.go
+index b21f8fbf63bcf..2c0282191a3d1 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/subfield/shortcircuit/zz_generated.validations.go
+@@ -492,7 +492,7 @@ func Validate_ParentWithMaxItems(
+ 			func() { // cohort = "value"
+ 				earlyReturn := false
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+-					func(o *TargetWithMaxItems) []string { return o.Value }, validate.SemanticDeepEqual,
++					func(o *TargetWithMaxItems) []string { return o.Value }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+ 						return validate.MaxItems(ctx, op, fldPath, obj, oldObj, 2)
+ 					}).MarkShortCircuit(); len(e) != 0 {
+@@ -502,7 +502,7 @@ func Validate_ParentWithMaxItems(
+ 					return // do not proceed
+ 				}
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+-					func(o *TargetWithMaxItems) []string { return o.Value }, validate.SemanticDeepEqual,
++					func(o *TargetWithMaxItems) []string { return o.Value }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj []string) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithMaxItems.Field.Value")
+ 					}); len(e) != 0 {
+@@ -546,7 +546,7 @@ func Validate_ParentWithMaxProperties(
+ 			func() { // cohort = "value"
+ 				earlyReturn := false
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+-					func(o *TargetWithMaxProperties) map[string]string { return o.Value }, validate.SemanticDeepEqual,
++					func(o *TargetWithMaxProperties) map[string]string { return o.Value }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+ 						return validate.MaxProperties(ctx, op, fldPath, obj, oldObj, 2)
+ 					}).MarkShortCircuit(); len(e) != 0 {
+@@ -556,7 +556,7 @@ func Validate_ParentWithMaxProperties(
+ 					return // do not proceed
+ 				}
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+-					func(o *TargetWithMaxProperties) map[string]string { return o.Value }, validate.SemanticDeepEqual,
++					func(o *TargetWithMaxProperties) map[string]string { return o.Value }, deepEqualImpl_,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj map[string]string) field.ErrorList {
+ 						return validate.FixedResult(ctx, op, fldPath, obj, oldObj, false, "subfield ParentWithMaxProperties.Field.Value")
+ 					}); len(e) != 0 {
+@@ -1029,7 +1029,8 @@ func Validate_ParentWithUpdate(
+ 				if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "value",
+ 					func(o *TargetWithUpdate) *string { return &o.Value }, validate.DirectEqual,
+ 					func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+-						return validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify)
++						return validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++							func(a string, b string) bool { return a == b }, validate.NoModify)
+ 					}).MarkShortCircuit(); len(e) != 0 {
+ 					earlyReturn = true
+ 				}
+@@ -1308,7 +1309,8 @@ func Validate_TargetWithUpdate(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -1326,3 +1328,8 @@ func Validate_TargetWithUpdate(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/zz_generated.validations.go
+index 23dfb6e20603c..b0e1a4e3fb7f8 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/lists/zz_generated.validations.go
+@@ -426,7 +426,7 @@ func Validate_UpdateListStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, validate.NoAddItem, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj, deepEqualImpl_, validate.NoAddItem, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -434,7 +434,7 @@ func Validate_UpdateListStruct(
+ 				return // do not proceed
+ 			}
+ 			// lists with set semantics require unique values
+-			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual); len(e) != 0 {
++			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, deepEqualImpl_); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 			}
+ 			return
+@@ -627,3 +627,8 @@ func Validate_UpdateListStruct(
+ 
+ 	return errs
+ }
++
++// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.
++func deepEqualImpl_[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc.go
+index 8737cf5e61f67..465888aea1f33 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc.go
+@@ -52,6 +52,18 @@ type UpdateMapStruct struct {
+ 
+ 	// +k8s:eachVal=+k8s:update=NoModify
+ 	EachValNoModifyMap map[string]MapItem `json:"eachValNoModifyMap"`
++
++	// Pointer Map NoSet
++	// +k8s:update=NoSet
++	PointerMapNoSet map[string]*string `json:"pointerMapNoSet"`
++
++	// Pointer Map NoAdd
++	// +k8s:update=NoAddItem
++	PointerMapNoAdd map[string]*string `json:"pointerMapNoAdd"`
++
++	// Pointer Map NoRemove
++	// +k8s:update=NoRemoveItem
++	PointerMapNoRemove map[string]*MapItem `json:"pointerMapNoRemove"`
+ }
+ 
+ type MapItem struct {
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc_test.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc_test.go
+index bb5e84ded9b00..3917898a1c416 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc_test.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/doc_test.go
+@@ -129,4 +129,60 @@ func TestUpdateMapTags(t *testing.T) {
+ 			field.Invalid(field.NewPath("eachValNoModifyMap").Key("a"), nil, "cannot be modified").WithOrigin("update"),
+ 		})
+ 	}
++
++	// Pointer Map NoSet
++	{
++		old := base
++		old.PointerMapNoSet = nil
++		cur := base
++		cur.PointerMapNoSet = map[string]*string{"a": new("1")}
++
++		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
++			field.Invalid(field.NewPath("pointerMapNoSet"), nil, "field cannot be set once created").WithOrigin("update"),
++		})
++
++		// nil -> nil is allowed
++		st.Value(&old).OldValue(&old).ExpectValid()
++	}
++
++	// Pointer Map NoAddItem
++	{
++		old := base
++		old.PointerMapNoAdd = map[string]*string{"a": new("1")}
++		cur := base
++		cur.PointerMapNoAdd = map[string]*string{"a": new("1"), "b": new("2")}
++
++		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
++			field.Forbidden(field.NewPath("pointerMapNoAdd").Key("b"), "item may not be added").WithOrigin("update"),
++		})
++	}
++
++	// Pointer Map NoRemoveItem
++	{
++		old := base
++		old.PointerMapNoRemove = map[string]*MapItem{
++			"a": {Name: "a", Value: "1"},
++			"b": {Name: "b", Value: "2"},
++		}
++		cur := base
++		cur.PointerMapNoRemove = map[string]*MapItem{
++			"a": {Name: "a", Value: "1"},
++		}
++
++		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
++			field.Forbidden(field.NewPath("pointerMapNoRemove").Key("b"), "item may not be removed").WithOrigin("update"),
++		})
++	}
++
++	// Nil element in pointer map on update should trigger Required error from PtrMapNoNils
++	{
++		old := base
++		old.PointerMapNoAdd = map[string]*string{"a": new("1")}
++		cur := base
++		cur.PointerMapNoAdd = map[string]*string{"a": nil}
++
++		st.Value(&cur).OldValue(&old).ExpectMatches(matcher, field.ErrorList{
++			field.Required(field.NewPath("pointerMapNoAdd").Key("a"), ""),
++		})
++	}
+ }
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/zz_generated.validations.go
+index 38588d3eb9fbc..e471ab147021d 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/maps/zz_generated.validations.go
+@@ -270,5 +270,104 @@ func Validate_UpdateMapStruct(
+ 		errs = append(errs, fn(fldPath.Child("eachValNoModifyMap"), obj.EachValNoModifyMap, oldVal, oldObj != nil)...)
+ 	}
+ 
++	{ // field UpdateMapStruct.PointerMapNoSet
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*string,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if e := validate.UpdateMap(ctx, op, fldPath, obj, oldObj, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *UpdateMapStruct) map[string]*string {
++				return oldObj.PointerMapNoSet
++			})
++		errs = append(errs, fn(fldPath.Child("pointerMapNoSet"), obj.PointerMapNoSet, oldVal, oldObj != nil)...)
++	}
++
++	{ // field UpdateMapStruct.PointerMapNoAdd
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*string,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, string](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if e := validate.UpdateMap(ctx, op, fldPath, obj, oldObj, validate.NoAddItem).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *UpdateMapStruct) map[string]*string {
++				return oldObj.PointerMapNoAdd
++			})
++		errs = append(errs, fn(fldPath.Child("pointerMapNoAdd"), obj.PointerMapNoAdd, oldVal, oldObj != nil)...)
++	}
++
++	{ // field UpdateMapStruct.PointerMapNoRemove
++		fn := func(
++			fldPath *field.Path,
++			obj, oldObj map[string]*MapItem,
++			oldValueCorrelated bool) (errs field.ErrorList) {
++			// don't revalidate unchanged data
++			if oldValueCorrelated && op.Type == operation.Update {
++				if equality.Semantic.DeepEqual(obj, oldObj) {
++					return nil
++				}
++			}
++			// call field-attached validations
++			earlyReturn := false
++			if e := validate.PtrMapNoNils[string, MapItem](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if e := validate.UpdateMap(ctx, op, fldPath, obj, oldObj, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
++				errs = append(errs, e...)
++				earlyReturn = true
++			}
++			if earlyReturn {
++				return // do not proceed
++			}
++			return
++		}
++		oldVal := safe.Field(oldObj,
++			func(oldObj *UpdateMapStruct) map[string]*MapItem {
++				return oldObj.PointerMapNoRemove
++			})
++		errs = append(errs, fn(fldPath.Child("pointerMapNoRemove"), obj.PointerMapNoRemove, oldVal, oldObj != nil)...)
++	}
++
+ 	return errs
+ }
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/zz_generated.validations.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/zz_generated.validations.go
+index 888cb51b17a87..61e82e9fdecb6 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/zz_generated.validations.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/output_tests/tags/update/primitives/zz_generated.validations.go
+@@ -77,7 +77,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -106,7 +107,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -135,7 +137,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -164,7 +167,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoSet, validate.NoUnset, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoSet, validate.NoUnset, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -193,7 +197,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoUnset, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a string, b string) bool { return a == b }, validate.NoUnset, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -222,7 +227,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a int, b int) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -251,7 +257,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a int32, b int32) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -280,7 +287,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a int64, b int64) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -309,7 +317,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a uint, b uint) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -338,7 +347,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a bool, b bool) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -367,7 +377,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a float32, b float32) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -396,7 +407,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a float64, b float64) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -425,7 +437,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a byte, b byte) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -715,7 +728,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a CustomString, b CustomString) bool { return a == b }, validate.NoModify).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+@@ -744,7 +758,8 @@ func Validate_UpdateTestStruct(
+ 			}
+ 			// call field-attached validations
+ 			earlyReturn := false
+-			if e := validate.UpdateValueByCompare(ctx, op, fldPath, obj, oldObj, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
++			if e := validate.UpdateValue(ctx, op, fldPath, obj, oldObj,
++				func(a CustomInt, b CustomInt) bool { return a == b }, validate.NoSet).MarkShortCircuit(); len(e) != 0 {
+ 				errs = append(errs, e...)
+ 				earlyReturn = true
+ 			}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/targets.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/targets.go
+index 29a676b040ddd..90692c7f40266 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/targets.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/targets.go
+@@ -54,6 +54,9 @@ const (
+ 	// (e.g. in tests), or set to "nil" to disable scheme registration for this
+ 	// package.
+ 	schemeRegistryTagName = "k8s:validation-gen-scheme-registry"
++	// Defines the deep-equal function used for equivalence and ratcheting checks.
++	// Defaults to "k8s.io/apimachinery/pkg/api/equality.Semantic.DeepEqual".
++	deepEqualFuncTagName = "k8s:validation-gen-deep-equal-func"
+ 	// If set, generate go test files for test fixtures.  Supported values: "validateFalse".
+ 	testFixtureTagName = "k8s:validation-gen-test-fixture"
+ 
+@@ -69,10 +72,11 @@ const (
+ )
+ 
+ var (
+-	runtimePkg   = "k8s.io/apimachinery/pkg/runtime"
+-	schemeType   = types.Name{Package: runtimePkg, Name: "Scheme"}
+-	metav1Pkg    = "k8s.io/apimachinery/pkg/apis/meta/v1"
+-	listMetaType = types.Name{Package: metav1Pkg, Name: "ListMeta"}
++	runtimePkg           = "k8s.io/apimachinery/pkg/runtime"
++	schemeType           = types.Name{Package: runtimePkg, Name: "Scheme"}
++	defaultDeepEqualFunc = types.Name{Package: "k8s.io/apimachinery/pkg/api/equality", Name: "Semantic.DeepEqual"}
++	metav1Pkg            = "k8s.io/apimachinery/pkg/apis/meta/v1"
++	listMetaType         = types.Name{Package: metav1Pkg, Name: "ListMeta"}
+ )
+ 
+ // extractAndParseTag extracts all the values for a given tag, according to the
+@@ -157,6 +161,48 @@ func registerScheme(pkg *types.Package) bool {
+ 	return ok
+ }
+ 
++func deepEqualFuncTag(pkg *types.Package) types.Name {
++	// TODO: convert to extractAndParseTag() and update all callers to use quoted values
++	tags, err := gengo.ExtractFunctionStyleCommentTags("+", []string{deepEqualFuncTagName}, pkg.Comments)
++	if err != nil {
++		klog.Fatalf("Failed to extract deep equal func tags: %v", err)
++	}
++	values, found := tags[deepEqualFuncTagName]
++	if !found || len(values) == 0 {
++		return defaultDeepEqualFunc
++	}
++	if len(values) > 1 {
++		panic(fmt.Sprintf("Package %q contains more than one usage of %q", pkg.Path, deepEqualFuncTagName))
++	}
++	val := values[0].Value
++	if val == "" {
++		return defaultDeepEqualFunc
++	}
++	return parseDeepEqualFunc(val)
++}
++
++func parseDeepEqualFunc(val string) types.Name {
++	lastSlash := strings.LastIndex(val, "/")
++	if lastSlash == -1 {
++		dot := strings.Index(val, ".")
++		if dot == -1 {
++			return types.Name{Name: val}
++		}
++		return types.Name{
++			Package: val[:dot],
++			Name:    val[dot+1:],
++		}
++	}
++	dot := lastSlash + strings.Index(val[lastSlash:], ".")
++	if dot == lastSlash {
++		return types.Name{Package: val}
++	}
++	return types.Name{
++		Package: val[:dot],
++		Name:    val[dot+1:],
++	}
++}
++
+ func isSubresourceTag(t *types.Type) (string, bool) {
+ 	var comments []string
+ 	comments = append(comments, t.SecondClosestCommentLines...)
+@@ -358,6 +404,7 @@ func GetTargets(context *generator.Context, args *Args) []generator.Target {
+ 		pkg := context.Universe[input]
+ 
+ 		schemeRegistry, registerThisPkg := schemeRegistryTag(pkg)
++		deepEqualFunc := deepEqualFuncTag(pkg)
+ 
+ 		criteria, found := validationTypeMatch(pkg, idOpts)
+ 		if !found {
+@@ -485,7 +532,7 @@ func GetTargets(context *generator.Context, args *Args) []generator.Target {
+ 
+ 				GeneratorsFunc: func(c *generator.Context) (generators []generator.Generator) {
+ 					generators = []generator.Generator{
+-						NewGenValidations(args.OutputFile, pkg.Path, typesPkg.Path, rootTypes, td, inputToCanonicalPkg, schemeRegistry, registerThisPkg),
++						NewGenValidations(args.OutputFile, pkg.Path, typesPkg.Path, rootTypes, td, inputToCanonicalPkg, schemeRegistry, registerThisPkg, deepEqualFunc),
+ 					}
+ 					testFixtureTags := testFixtureTag(pkg)
+ 					if testFixtureTags.Len() > 0 {
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/targets_test.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/targets_test.go
+new file mode 100644
+index 0000000000000..ff67234ed3261
+--- /dev/null
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/targets_test.go
+@@ -0,0 +1,64 @@
++/*
++Copyright The Kubernetes Authors.
++
++Licensed under the Apache License, Version 2.0 (the "License");
++you may not use this file except in compliance with the License.
++You may obtain a copy of the License at
++
++    http://www.apache.org/licenses/LICENSE-2.0
++
++Unless required by applicable law or agreed to in writing, software
++distributed under the License is distributed on an "AS IS" BASIS,
++WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++See the License for the specific language governing permissions and
++limitations under the License.
++*/
++
++package main
++
++import (
++	"testing"
++
++	"k8s.io/gengo/v2/types"
++)
++
++func TestParseDeepEqualFunc(t *testing.T) {
++	testCases := []struct {
++		name     string
++		input    string
++		expected types.Name
++	}{{
++		name:     "fully qualified with struct field",
++		input:    "k8s.io/apimachinery/pkg/api/equality.Semantic.DeepEqual",
++		expected: types.Name{Package: "k8s.io/apimachinery/pkg/api/equality", Name: "Semantic.DeepEqual"},
++	}, {
++		name:     "fully qualified package function",
++		input:    "k8s.io/code-generator/cmd/validation-gen/testscheme.CustomEqual",
++		expected: types.Name{Package: "k8s.io/code-generator/cmd/validation-gen/testscheme", Name: "CustomEqual"},
++	}, {
++		name:     "single level package function",
++		input:    "testscheme.CustomEqual",
++		expected: types.Name{Package: "testscheme", Name: "CustomEqual"},
++	}, {
++		name:     "single level package struct field",
++		input:    "testscheme.Semantic.DeepEqual",
++		expected: types.Name{Package: "testscheme", Name: "Semantic.DeepEqual"},
++	}, {
++		name:     "package-local function",
++		input:    "CustomDeepEqual",
++		expected: types.Name{Package: "", Name: "CustomDeepEqual"},
++	}, {
++		name:     "empty input",
++		input:    "",
++		expected: types.Name{Package: "", Name: ""},
++	}}
++
++	for _, tc := range testCases {
++		t.Run(tc.name, func(t *testing.T) {
++			result := parseDeepEqualFunc(tc.input)
++			if want, got := tc.expected, result; got != want {
++				t.Errorf("expected %v, got %v", want, got)
++			}
++		})
++	}
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/validation.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/validation.go
+index 16725be28ccb7..a4368afa96d8e 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/validation.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/validation.go
+@@ -56,8 +56,6 @@ var (
+ 	operationPkgSymbols = mkPkgNames(operationPkg, "Operation", "MatchesSubresource", "Update")
+ 	contextPkg          = "context"
+ 	contextPkgSymbols   = mkPkgNames(contextPkg, "Context")
+-	equalityPkg         = "k8s.io/apimachinery/pkg/api/equality"
+-	equalityPkgSymbols  = mkPkgNames(equalityPkg, "Semantic")
+ )
+ 
+ // genValidations produces a file with autogenerated validations.
+@@ -71,10 +69,12 @@ type genValidations struct {
+ 	imports             namer.ImportTracker
+ 	schemeRegistry      types.Name
+ 	emitRegisterFunc    bool
++	deepEqualFunc       types.Name
++	usedDeepEqualImpl   bool
+ }
+ 
+ // NewGenValidations creates a new generator for the specified package.
+-func NewGenValidations(outputFilename, outputPackage, inputPackage string, rootTypes []*types.Type, discovered *typeDiscoverer, inputToCanonicalPkg map[string]string, schemeRegistry types.Name, emitRegisterFunc bool) generator.Generator {
++func NewGenValidations(outputFilename, outputPackage, inputPackage string, rootTypes []*types.Type, discovered *typeDiscoverer, inputToCanonicalPkg map[string]string, schemeRegistry types.Name, emitRegisterFunc bool, deepEqualFunc types.Name) generator.Generator {
+ 	return &genValidations{
+ 		GoGenerator: generator.GoGenerator{
+ 			OutputFilename: outputFilename,
+@@ -87,6 +87,7 @@ func NewGenValidations(outputFilename, outputPackage, inputPackage string, rootT
+ 		imports:             generator.NewImportTrackerForPackage(outputPackage),
+ 		schemeRegistry:      schemeRegistry,
+ 		emitRegisterFunc:    emitRegisterFunc,
++		deepEqualFunc:       deepEqualFunc,
+ 	}
+ }
+ 
+@@ -169,6 +170,26 @@ func (g *genValidations) GenerateType(c *generator.Context, t *types.Type, w io.
+ 	return nil
+ }
+ 
++func (g *genValidations) Finalize(c *generator.Context, w io.Writer) error {
++	if g.usedDeepEqualImpl {
++		sw := generator.NewSnippetWriter(w, c, "$", "$")
++		sw.Do("\n", nil)
++		sw.Do("// deepEqualImpl_ is a validate.MatchFunc which allows the implementation of deep-equality to be defined at codegen time.\n", nil)
++		sw.Do("func deepEqualImpl_[T any](a, b T) bool {\n", nil)
++		if g.deepEqualFunc.Package == "" {
++			sw.Do("	return $.$(a, b)\n", g.deepEqualFunc.Name)
++		} else {
++			targs := generator.Args{
++				"deepEqualFunc": c.Universe.Type(g.deepEqualFunc),
++			}
++			sw.Do("	return $.deepEqualFunc|raw$(a, b)\n", targs)
++		}
++		sw.Do("}\n", nil)
++		return sw.Error()
++	}
++	return nil
++}
++
+ // typeDiscoverer contains fields necessary to build graphs of types.
+ type typeDiscoverer struct {
+ 	initialized         bool
+@@ -670,8 +691,6 @@ func (td *typeDiscoverer) verifySupportedType(t *types.Type) error {
+ 		}
+ 		elem := util.NativeType(t.Elem)
+ 		switch elem.Kind {
+-		case types.Pointer:
+-			return fmt.Errorf("maps of pointers are not supported")
+ 		case types.Map:
+ 			return fmt.Errorf("maps of maps are not supported")
+ 		}
+@@ -1289,7 +1308,7 @@ func (g *genValidations) emitValidationForChild(c *generator.Context, thisChild
+ 			//      need to be executed, but if no fields changed they can be
+ 			//      skipped).
+ 			//
+-			// For the same reasons, in the specific case of lists of pointers,
++			// For the same reasons, in the specific case of lists and maps of pointers,
+ 			// we do not emit nil-checks inside type-specific validation
+ 			// functions.  If we solve for the duplicative ratcheting, then we
+ 			// should also solve for nil-checks.
+@@ -1307,6 +1326,19 @@ func (g *genValidations) emitValidationForChild(c *generator.Context, thisChild
+ 					nilCheck := validators.PtrSliceNoNils(nt.Elem.Elem.Name)
+ 					fld.fieldValidations.Functions = append([]validators.FunctionGen{nilCheck}, fld.fieldValidations.Functions...)
+ 				}
++			} else if nt := util.NativeType(fld.childType); nt.Kind == types.Map && nt.Elem.Kind == types.Pointer {
++				hasFieldValidations := len(fld.fieldValidations.Functions) > 0
++				hasPropagation := fld.node != nil && g.hasValidations(fld.node)
++				hasKeyIterations := len(fld.fieldKeyIterations.Functions) > 0 && hasPropagation
++				hasValIterations := len(fld.fieldValIterations.Functions) > 0 && hasPropagation
++
++				if hasFieldValidations || hasPropagation || hasKeyIterations || hasValIterations {
++					// Prepend the nil-check so it runs before any other
++					// validations. This is important because the other
++					// validations may assume that the map has no nil values.
++					nilCheck := validators.PtrMapNoNils(nt.Key.Name, nt.Elem.Elem.Name)
++					fld.fieldValidations.Functions = append([]validators.FunctionGen{nilCheck}, fld.fieldValidations.Functions...)
++				}
+ 			}
+ 
+ 			validations := fld.fieldValidations
+@@ -1314,7 +1346,7 @@ func (g *genValidations) emitValidationForChild(c *generator.Context, thisChild
+ 			if !validations.Empty() {
+ 				emitComments(validations.Comments, bufsw)
+ 				if len(validations.Functions) > 0 {
+-					emitRatchetingCheck(c, fld.childType, bufsw)
++					g.emitRatchetingCheck(c, fld.childType, bufsw)
+ 					fldRatchetingChecked = true
+ 					bufsw.Do("// call field-attached validations\n", nil)
+ 					g.emitCallsToValidators(c, validations.Functions, bufsw)
+@@ -1332,7 +1364,7 @@ func (g *genValidations) emitValidationForChild(c *generator.Context, thisChild
+ 					// (transitively) then we don't need to do anything.
+ 					if g.hasValidations(fld.node) {
+ 						if !fldRatchetingChecked {
+-							emitRatchetingCheck(c, fld.childType, bufsw)
++							g.emitRatchetingCheck(c, fld.childType, bufsw)
+ 							fldRatchetingChecked = true
+ 						}
+ 						g.emitCallToOtherTypeFunc(c, fld.node, bufsw)
+@@ -1347,7 +1379,7 @@ func (g *genValidations) emitValidationForChild(c *generator.Context, thisChild
+ 						emitComments(iterations.Comments, bufsw)
+ 						if len(iterations.Functions) > 0 {
+ 							if !fldRatchetingChecked {
+-								emitRatchetingCheck(c, fld.childType, bufsw)
++								g.emitRatchetingCheck(c, fld.childType, bufsw)
+ 								fldRatchetingChecked = true
+ 							}
+ 							g.emitCallsToValidators(c, iterations.Functions, bufsw)
+@@ -1448,7 +1480,7 @@ func (g *genValidations) emitCallToOtherTypeFunc(c *generator.Context, node *typ
+ }
+ 
+ // emitRatchetingCheck emits an equivalence check for default ratcheting.
+-func emitRatchetingCheck(c *generator.Context, t *types.Type, sw *generator.SnippetWriter) {
++func (g *genValidations) emitRatchetingCheck(c *generator.Context, t *types.Type, sw *generator.SnippetWriter) {
+ 	// Emit equivalence check for default ratcheting.
+ 	targs := generator.Args{
+ 		"operation": mkSymbolArgs(c, operationPkgSymbols),
+@@ -1467,8 +1499,12 @@ func emitRatchetingCheck(c *generator.Context, t *types.Type, sw *generator.Snip
+ 		// - *obj == *oldObj : compare values
+ 		sw.Do("  if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {\n", targs)
+ 	} else {
+-		targs["equality"] = mkSymbolArgs(c, equalityPkgSymbols)
+-		sw.Do("  if $.equality.Semantic|raw$.DeepEqual(obj, oldObj) {\n", targs)
++		if g.deepEqualFunc.Package == "" {
++			sw.Do("  if $.$(obj, oldObj) {\n", g.deepEqualFunc.Name)
++		} else {
++			targs["deepEqualFunc"] = c.Universe.Type(g.deepEqualFunc)
++			sw.Do("  if $.deepEqualFunc|raw$(obj, oldObj) {\n", targs)
++		}
+ 	}
+ 	sw.Do("    return nil\n", nil)
+ 	sw.Do("  }\n", nil)
+@@ -1755,9 +1791,23 @@ func (g *genValidations) toGolangSourceDataLiteral(sw *generator.SnippetWriter,
+ 	case *types.Member:
+ 		sw.Do("obj."+v.Name, nil)
+ 	case validators.Identifier:
+-		sw.Do("$.|raw$", c.Universe.Type(types.Name(v)))
++		if types.Name(v) == validators.DeepEqualImpl {
++			g.usedDeepEqualImpl = true
++		}
++		if v.Package == "" {
++			sw.Do(v.Name, nil)
++		} else {
++			sw.Do("$.|raw$", c.Universe.Type(types.Name(v)))
++		}
+ 	case *validators.Identifier:
+-		sw.Do("$.|raw$", c.Universe.Type(types.Name(*v)))
++		if types.Name(*v) == validators.DeepEqualImpl {
++			g.usedDeepEqualImpl = true
++		}
++		if v.Package == "" {
++			sw.Do(v.Name, nil)
++		} else {
++			sw.Do("$.|raw$", c.Universe.Type(types.Name(*v)))
++		}
+ 	case validators.PrivateVar:
+ 		sw.Do("$.|private$", c.Universe.Type(types.Name(v)))
+ 	case *validators.PrivateVar:
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/each.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/each.go
+index e5e5fc30a54b2..75709c87d33fb 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/each.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/each.go
+@@ -70,6 +70,7 @@ var (
+ 	validateEachValSliceVal = types.Name{Package: libValidationPkg, Name: "EachValSliceVal"}
+ 	validateEachPtrSliceVal = types.Name{Package: libValidationPkg, Name: "EachPtrSliceVal"}
+ 	validateEachMapVal      = types.Name{Package: libValidationPkg, Name: "EachMapVal"}
++	validateEachPtrMapVal   = types.Name{Package: libValidationPkg, Name: "EachPtrMapVal"}
+ )
+ 
+ func (evtv eachValTagValidator) GetValidations(context Context, tag codetags.Tag) (Validations, error) {
+@@ -240,10 +241,16 @@ func (evtv eachValTagValidator) getMapValidations(t *types.Type, validations Val
+ 	if util.IsDirectComparable(util.NonPointer(util.NativeType(nt.Elem))) {
+ 		equivArg = Identifier(validateDirectEqual)
+ 	}
++
++	validateFunc := validateEachMapVal
++	if nt.Elem.Kind == types.Pointer {
++		validateFunc = validateEachPtrMapVal
++	}
++
+ 	wrapped := WrapFunctions(validations, func(vfn FunctionGen, _ DeferredScope) FunctionGen {
+ 		comm := vfn.Comments
+ 		vfn.Comments = nil
+-		return Function(eachValTagName, vfn.Flags, validateEachMapVal, equivArg, WrapperFunction{Function: vfn, ObjType: nt.Elem, PathFragment: "[*]"}).WithComments(comm...)
++		return Function(eachValTagName, vfn.Flags, validateFunc, equivArg, WrapperFunction{Function: vfn, ObjType: nt.Elem, PathFragment: "[*]"}).WithComments(comm...)
+ 	})
+ 	return Validations{
+ 		Functions:     wrapped.Functions,
+@@ -387,6 +394,7 @@ func (ektv eachKeyTagValidator) Docs() TagDoc {
+ 
+ var (
+ 	validatePtrSliceNoNils = types.Name{Package: libValidationPkg, Name: "PtrSliceNoNils"}
++	validatePtrMapNoNils   = types.Name{Package: libValidationPkg, Name: "PtrMapNoNils"}
+ )
+ 
+ // PtrSliceNoNils returns a synthetic validation that rejects nil elements of a
+@@ -394,3 +402,9 @@ var (
+ func PtrSliceNoNils(elemType types.Name) FunctionGen {
+ 	return Function("PtrSliceNoNils", ShortCircuit, validatePtrSliceNoNils).WithTypeArgs(elemType)
+ }
++
++// PtrMapNoNils returns a synthetic validation that rejects nil elements of a
++// pointer map. It is not tag-driven; the generator injects it for map[K]*V fields.
++func PtrMapNoNils(keyType, elemType types.Name) FunctionGen {
++	return Function("PtrMapNoNils", ShortCircuit, validatePtrMapNoNils).WithTypeArgs(keyType, elemType)
++}
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/list.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/list.go
+index adb25196f9a84..16103556a3560 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/list.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/list.go
+@@ -408,7 +408,7 @@ func (cutv customUniqueTagValidator) Docs() TagDoc {
+ var (
+ 	validateValSliceUnique    = types.Name{Package: libValidationPkg, Name: "ValSliceUnique"}
+ 	validatePtrSliceUnique    = types.Name{Package: libValidationPkg, Name: "PtrSliceUnique"}
+-	validateSemanticDeepEqual = types.Name{Package: libValidationPkg, Name: "SemanticDeepEqual"}
++	validateSemanticDeepEqual = DeepEqualImpl
+ 	validateDirectEqual       = types.Name{Package: libValidationPkg, Name: "DirectEqual"}
+ )
+ 
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/update.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/update.go
+index d883e20c1caaf..f0cfd3264db4d 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/update.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/update.go
+@@ -199,13 +199,12 @@ func (utc updateTagCollector) Docs() TagDoc {
+ }
+ 
+ var (
+-	updateValueValidator          = types.Name{Package: libValidationPkg, Name: "UpdateValueByCompare"}
+-	updatePointerValidator        = types.Name{Package: libValidationPkg, Name: "UpdatePointer"}
+-	updateValueByReflectValidator = types.Name{Package: libValidationPkg, Name: "UpdateValueByReflect"}
+-	updateStructValidator         = types.Name{Package: libValidationPkg, Name: "UpdateStruct"}
+-	valSliceUpdateValidator       = types.Name{Package: libValidationPkg, Name: "ValSliceUpdate"}
+-	ptrSliceUpdateValidator       = types.Name{Package: libValidationPkg, Name: "PtrSliceUpdate"}
+-	updateMapValidator            = types.Name{Package: libValidationPkg, Name: "UpdateMap"}
++	updateValueValidator    = types.Name{Package: libValidationPkg, Name: "UpdateValue"}
++	updatePointerValidator  = types.Name{Package: libValidationPkg, Name: "UpdatePointer"}
++	updateStructValidator   = types.Name{Package: libValidationPkg, Name: "UpdateStruct"}
++	valSliceUpdateValidator = types.Name{Package: libValidationPkg, Name: "ValSliceUpdate"}
++	ptrSliceUpdateValidator = types.Name{Package: libValidationPkg, Name: "PtrSliceUpdate"}
++	updateMapValidator      = types.Name{Package: libValidationPkg, Name: "UpdateMap"}
+ 
+ 	// Constraint constants that will be used as arguments
+ 	noSetConstraint        = types.Name{Package: libValidationPkg, Name: "NoSet"}
+@@ -314,9 +313,8 @@ func generateMapValidation(constraints []validate.UpdateConstraint) Validations
+ 	return Validations{Functions: []FunctionGen{fn}}
+ }
+ 
+-// emitScalarUpdate emits a call to
+-// UpdateValueByCompare/UpdatePointer/UpdateStruct/UpdateValueByReflect based
+-// on the Go kind of context.Type.
++// emitScalarUpdate emits a call to UpdateValue/UpdatePointer/UpdateStruct
++// based on the Go kind of context.Type.
+ // Used for both field scope (scalar/pointer/struct) and list/map element
+ // scope via +k8s:eachVal.
+ func emitScalarUpdate(context Context, constraints []validate.UpdateConstraint) Validations {
+@@ -327,21 +325,33 @@ func emitScalarUpdate(context Context, constraints []validate.UpdateConstraint)
+ 	isComparable := util.IsDirectComparable(t)
+ 
+ 	var validatorFunc types.Name
++	var args []any
+ 	if isPointer {
+ 		validatorFunc = updatePointerValidator
++		args = constraintIdentifierArgs(constraints)
+ 	} else if isStruct {
+ 		validatorFunc = updateStructValidator
+-	} else if isComparable {
+-		validatorFunc = updateValueValidator
++		args = constraintIdentifierArgs(constraints)
+ 	} else {
+-		validatorFunc = updateValueByReflectValidator
++		validatorFunc = updateValueValidator
++		var matchArg any
++		if isComparable {
++			matchArg = FunctionLiteral{
++				Parameters: []ParamResult{{"a", context.Type}, {"b", context.Type}},
++				Results:    []ParamResult{{"", types.Bool}},
++				Body:       "return a == b",
++			}
++		} else {
++			matchArg = Identifier(validateSemanticDeepEqual)
++		}
++		args = append([]any{matchArg}, constraintIdentifierArgs(constraints)...)
+ 	}
+ 
+ 	// Use ShortCircuit flag so these run in the same group as +k8s:optional.
+ 	// Scalar/pointer/struct fields only accept NoSet/NoUnset/NoModify
+ 	// (validateConstraintsForType rejects the rest), all of which emit
+ 	// field.Invalid at the field path.
+-	fn := Function(updateTagName, ShortCircuit, validatorFunc, constraintIdentifierArgs(constraints)...).
++	fn := Function(updateTagName, ShortCircuit, validatorFunc, args...).
+ 		WithEmits(Emission{field.ErrorTypeInvalid, "update", ""})
+ 	return Validations{Functions: []FunctionGen{fn}}
+ }
+diff --git a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/validators.go b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/validators.go
+index 196c94bbeb1f1..235897dddc26c 100644
+--- a/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/validators.go
++++ b/staging/src/k8s.io/code-generator/cmd/validation-gen/validators/validators.go
+@@ -26,6 +26,10 @@ import (
+ 	"k8s.io/gengo/v2/types"
+ )
+ 
++var (
++	DeepEqualImpl = types.Name{Name: "deepEqualImpl_"}
++)
++
+ // TagValidator describes a single validation tag and how to use it. To be
+ // findable by validation-gen, a TagValidator must be registered - see
+ // RegisterTagValidator.
+diff --git a/staging/src/k8s.io/code-generator/pkg/apidefinitions/activation_test.go b/staging/src/k8s.io/code-generator/pkg/apidefinitions/activation_test.go
+index fa7c8e29f6408..c4d35d8d5f227 100644
+--- a/staging/src/k8s.io/code-generator/pkg/apidefinitions/activation_test.go
++++ b/staging/src/k8s.io/code-generator/pkg/apidefinitions/activation_test.go
+@@ -178,6 +178,7 @@ func TestIdentify(t *testing.T) {
+ 				"+k8s:defaulter-gen-input=k8s.io/api/foo/v1",
+ 				"+k8s:validation-gen=TypesWithField=TypeMeta",
+ 				"+k8s:validation-gen-input=k8s.io/api/foo/v1",
++				"+k8s:validation-gen-deep-equal-func=foo",
+ 				"+k8s:validation-gen-nolint",
+ 				"+k8s:validation-gen-scheme-registry=foo",
+ 				"+k8s:validation-gen-test-fixture=bar",
+diff --git a/staging/src/k8s.io/code-generator/pkg/apidefinitions/lint_test.go b/staging/src/k8s.io/code-generator/pkg/apidefinitions/lint_test.go
+index a30549a216844..5c11d765bb261 100644
+--- a/staging/src/k8s.io/code-generator/pkg/apidefinitions/lint_test.go
++++ b/staging/src/k8s.io/code-generator/pkg/apidefinitions/lint_test.go
+@@ -49,6 +49,7 @@ func TestLintRules(t *testing.T) {
+ 		"+k8s:defaulter-gen-input=k8s.io/api/foo/v1",
+ 		"+k8s:validation-gen=TypesWithField=TypeMeta",
+ 		"+k8s:validation-gen-input=k8s.io/api/foo/v1",
++		"+k8s:validation-gen-deep-equal-func=foo",
+ 		"+k8s:validation-gen-nolint",
+ 		"+k8s:validation-gen-scheme-registry=foo",
+ 		"+k8s:validation-gen-test-fixture=bar",
+diff --git a/staging/src/k8s.io/code-generator/pkg/apidefinitions/spec.go b/staging/src/k8s.io/code-generator/pkg/apidefinitions/spec.go
+index 58c5da6cb01a1..96289c97bb434 100644
+--- a/staging/src/k8s.io/code-generator/pkg/apidefinitions/spec.go
++++ b/staging/src/k8s.io/code-generator/pkg/apidefinitions/spec.go
+@@ -96,6 +96,7 @@ var (
+ 		InputTag:      "k8s:validation-gen-input",
+ 		ValueMode:     TypeFilterList,
+ 		AuxTags: []string{
++			"k8s:validation-gen-deep-equal-func",
+ 			"k8s:validation-gen-nolint",
+ 			"k8s:validation-gen-scheme-registry",
+ 			"k8s:validation-gen-test-fixture",
+diff --git a/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1alpha1/validation.go b/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1alpha1/validation.go
+index 6c0dbe3bc8ecb..d2aae78012279 100644
+--- a/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1alpha1/validation.go
++++ b/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1alpha1/validation.go
+@@ -20,6 +20,7 @@ import (
+ 	"context"
+ 
+ 	resourceapi "k8s.io/api/resource/v1"
++	"k8s.io/apimachinery/pkg/api/equality"
+ 	"k8s.io/apimachinery/pkg/api/operation"
+ 	"k8s.io/apimachinery/pkg/api/validate"
+ 	"k8s.io/apimachinery/pkg/util/validation/field"
+@@ -29,7 +30,7 @@ func ValidateCustom_Device_Attributes(
+ 	ctx context.Context, op operation.Operation, fldPath *field.Path,
+ 	obj, oldObj map[resourceapi.QualifiedName]resourceapi.DeviceAttribute,
+ ) field.ErrorList {
+-	return validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, resourceapi.Validate_DeviceAttribute)
++	return validate.EachMapVal(ctx, op, fldPath, obj, oldObj, semanticDeepEqual, resourceapi.Validate_DeviceAttribute)
+ }
+ 
+ func ValidateCustom_Device_NetworkData(
+@@ -38,3 +39,12 @@ func ValidateCustom_Device_NetworkData(
+ ) field.ErrorList {
+ 	return resourceapi.Validate_NetworkDeviceData(ctx, op, fldPath, obj, oldObj)
+ }
++
++// semanticDeepEqual is a MatchFunc that uses equality.Semantic.DeepEqual to
++// compare two values.
++// This wrapper is needed because MatchFunc requires a function that takes two
++// arguments of specific type T, while equality.Semantic.DeepEqual takes
++// arguments of type interface{}/any.
++func semanticDeepEqual[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
+diff --git a/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1beta1/validation.go b/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1beta1/validation.go
+index d4df1c48f5e37..00cad29f34893 100644
+--- a/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1beta1/validation.go
++++ b/staging/src/k8s.io/dynamic-resource-allocation/api/metadata/v1beta1/validation.go
+@@ -20,6 +20,7 @@ import (
+ 	"context"
+ 
+ 	resourceapi "k8s.io/api/resource/v1"
++	"k8s.io/apimachinery/pkg/api/equality"
+ 	"k8s.io/apimachinery/pkg/api/operation"
+ 	"k8s.io/apimachinery/pkg/api/validate"
+ 	"k8s.io/apimachinery/pkg/util/validation/field"
+@@ -29,7 +30,7 @@ func ValidateCustom_Device_Attributes(
+ 	ctx context.Context, op operation.Operation, fldPath *field.Path,
+ 	obj, oldObj map[resourceapi.QualifiedName]resourceapi.DeviceAttribute,
+ ) field.ErrorList {
+-	return validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, resourceapi.Validate_DeviceAttribute)
++	return validate.EachMapVal(ctx, op, fldPath, obj, oldObj, semanticDeepEqual, resourceapi.Validate_DeviceAttribute)
+ }
+ 
+ func ValidateCustom_Device_NetworkData(
+@@ -38,3 +39,12 @@ func ValidateCustom_Device_NetworkData(
+ ) field.ErrorList {
+ 	return resourceapi.Validate_NetworkDeviceData(ctx, op, fldPath, obj, oldObj)
+ }
++
++// semanticDeepEqual is a MatchFunc that uses equality.Semantic.DeepEqual to
++// compare two values.
++// This wrapper is needed because MatchFunc requires a function that takes two
++// arguments of specific type T, while equality.Semantic.DeepEqual takes
++// arguments of type interface{}/any.
++func semanticDeepEqual[T any](a, b T) bool {
++	return equality.Semantic.DeepEqual(a, b)
++}
diff --git a/vendor/github.com/fxamacker/cbor/v2/.golangci.yml b/vendor/github.com/fxamacker/cbor/v2/.golangci.yml
index 38cb9ae101..08081fbde5 100644
--- a/vendor/github.com/fxamacker/cbor/v2/.golangci.yml
+++ b/vendor/github.com/fxamacker/cbor/v2/.golangci.yml
@@ -1,104 +1,116 @@
-# Do not delete linter settings. Linters like gocritic can be enabled on the command line.
-
-linters-settings:
-  depguard:
-    rules:
-      prevent_unmaintained_packages:
-        list-mode: strict
-        files:
-          - $all
-          - "!$test"
-        allow:
-          - $gostd
-          - github.com/x448/float16
-        deny:
-          - pkg: io/ioutil
-            desc: "replaced by io and os packages since Go 1.16: https://tip.golang.org/doc/go1.16#ioutil"
-  dupl:
-    threshold: 100
-  funlen:
-    lines: 100
-    statements: 50
-  goconst:
-    ignore-tests: true
-    min-len: 2
-    min-occurrences: 3
-  gocritic:
-    enabled-tags:
-      - diagnostic
-      - experimental
-      - opinionated
-      - performance
-      - style
-    disabled-checks:
-      - commentedOutCode
-      - dupImport # https://github.com/go-critic/go-critic/issues/845
-      - ifElseChain
-      - octalLiteral
-      - paramTypeCombine
-      - whyNoLint
-  gofmt:
-    simplify: false
-  goimports:
-    local-prefixes: github.com/fxamacker/cbor
-  golint:
-    min-confidence: 0
-  govet:
-    check-shadowing: true
-  lll:
-    line-length: 140
-  maligned:
-    suggest-new: true
-  misspell:
-    locale: US
-  staticcheck:
-    checks: ["all"]
-
+version: "2"
 linters:
-  disable-all: true
+  default: none
   enable:
     - asciicheck
     - bidichk
     - depguard
     - errcheck
-    - exportloopref
+    - forbidigo
     - goconst
     - gocritic
     - gocyclo
-    - gofmt
-    - goimports
     - goprintffuncname
     - gosec
-    - gosimple
     - govet
     - ineffassign
     - misspell
     - nilerr
     - revive
     - staticcheck
-    - stylecheck
-    - typecheck
     - unconvert
     - unused
-
+  settings:
+    depguard:
+      rules:
+        prevent_unmaintained_packages:
+          list-mode: strict
+          files:
+            - $all
+            - '!$test'
+          allow:
+            - $gostd
+            - github.com/x448/float16
+          deny:
+            - pkg: io/ioutil
+              desc: 'replaced by io and os packages since Go 1.16: https://tip.golang.org/doc/go1.16#ioutil'
+    dupl:
+      threshold: 100
+    funlen:
+      lines: 100
+      statements: 50
+    goconst:
+      min-len: 2
+      min-occurrences: 3
+    gocritic:
+      disabled-checks:
+        - commentedOutCode
+        - dupImport
+        - ifElseChain
+        - octalLiteral
+        - paramTypeCombine
+        - whyNoLint
+      enabled-tags:
+        - diagnostic
+        - experimental
+        - opinionated
+        - performance
+        - style
+    govet:
+      enable:
+        - shadow
+    lll:
+      line-length: 140
+    misspell:
+      locale: US
+    staticcheck:
+      checks:
+        - all
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - path: decode.go
+        text: string ` overflows ` has (\d+) occurrences, make it a constant
+      - path: decode.go
+        text: string ` \(range is \[` has (\d+) occurrences, make it a constant
+      - path: decode.go
+        text: string `, ` has (\d+) occurrences, make it a constant
+      - path: decode.go
+        text: string ` overflows Go's int64` has (\d+) occurrences, make it a constant
+      - path: decode.go
+        text: string `\]\)` has (\d+) occurrences, make it a constant
+      - path: valid.go
+        text: string ` for type ` has (\d+) occurrences, make it a constant
+      - path: valid.go
+        text: 'string `cbor: ` has (\d+) occurrences, make it a constant'
+      - linters:
+          - goconst
+        path: (.+)_test\.go
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
 issues:
-  # max-issues-per-linter default is 50.  Set to 0 to disable limit.
   max-issues-per-linter: 0
-  # max-same-issues default is 3.  Set to 0 to disable limit.
   max-same-issues: 0
-
-  exclude-rules:
-    - path: decode.go
-      text: "string ` overflows ` has (\\d+) occurrences, make it a constant"
-    - path: decode.go
-      text: "string ` \\(range is \\[` has (\\d+) occurrences, make it a constant"
-    - path: decode.go
-      text: "string `, ` has (\\d+) occurrences, make it a constant"
-    - path: decode.go
-      text: "string ` overflows Go's int64` has (\\d+) occurrences, make it a constant"
-    - path: decode.go
-      text: "string `\\]\\)` has (\\d+) occurrences, make it a constant"
-    - path: valid.go
-      text: "string ` for type ` has (\\d+) occurrences, make it a constant"
-    - path: valid.go
-      text: "string `cbor: ` has (\\d+) occurrences, make it a constant"
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    gofmt:
+      simplify: false
+    goimports:
+      local-prefixes:
+        - github.com/fxamacker/cbor
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
diff --git a/vendor/github.com/fxamacker/cbor/v2/README.md b/vendor/github.com/fxamacker/cbor/v2/README.md
index d072b81c73..f9ae78ec9e 100644
--- a/vendor/github.com/fxamacker/cbor/v2/README.md
+++ b/vendor/github.com/fxamacker/cbor/v2/README.md
@@ -702,21 +702,20 @@ Default limits may need to be increased for systems handling very large data (e.
 
 ## Status
 
-[v2.9.0](https://github.com/fxamacker/cbor/releases/tag/v2.9.0) (Jul 13, 2025) improved interoperability/transcoding between CBOR & JSON, refactored tests, and improved docs.
-- Add opt-in support for `encoding.TextMarshaler` and `encoding.TextUnmarshaler` to encode and decode from CBOR text string.
-- Add opt-in support for `json.Marshaler` and `json.Unmarshaler` via user-provided transcoding function.
-- Update docs for TimeMode, Tag, RawTag, and add example for Embedded JSON Tag for CBOR.
+v2.9.1 (Mar 29-30, 2026) includes important bugfixes, defensive checks, improved code quality, and more tests.  Although not public, the fuzzer was also improved by adding more fuzz tests.
 
-v2.9.0 passed fuzz tests and is production quality.
+v2.9.1 passed fuzz tests and is production quality.
 
 The minimum version of Go required to build:
 - v2.8.0 and newer releases require go 1.20+.
 - v2.7.1 and older releases require go 1.17+.
 
-For more details, see [release notes](https://github.com/fxamacker/cbor/releases).
+For more details, see [v2.9.1 release notes](https://github.com/fxamacker/cbor/releases).
 
 ### Prior Releases
 
+[v2.9.0](https://github.com/fxamacker/cbor/releases/tag/v2.9.0) (Jul 13, 2025) improved interoperability/transcoding between CBOR & JSON, refactored tests, and improved docs.   It passed fuzz tests (billions of executions) and is production quality.
+
 [v2.8.0](https://github.com/fxamacker/cbor/releases/tag/v2.8.0) (March 30, 2025) is a small release primarily to add `omitzero` option to struct field tags and fix bugs.   It passed fuzz tests (billions of executions) and is production quality.
 
 [v2.7.0](https://github.com/fxamacker/cbor/releases/tag/v2.7.0) (June 23, 2024) adds features and improvements that help large projects (e.g. Kubernetes) use CBOR as an alternative to JSON and Protocol Buffers. Other improvements include speedups, improved memory use, bug fixes, new serialization options, etc.   It passed fuzz tests (5+ billion executions) and is production quality.
diff --git a/vendor/github.com/fxamacker/cbor/v2/cache.go b/vendor/github.com/fxamacker/cbor/v2/cache.go
index 5051f110fb..5743f3eb25 100644
--- a/vendor/github.com/fxamacker/cbor/v2/cache.go
+++ b/vendor/github.com/fxamacker/cbor/v2/cache.go
@@ -92,94 +92,126 @@ func newTypeInfo(t reflect.Type) *typeInfo {
 }
 
 type decodingStructType struct {
-	fields             fields
-	fieldIndicesByName map[string]int
-	err                error
-	toArray            bool
+	fields               decodingFields
+	fieldIndicesByName   map[string]int // Only populated if toArray is false
+	fieldIndicesByIntKey map[int64]int  // Only populated if toArray is false
+	err                  error
+	toArray              bool
 }
 
-// The stdlib errors.Join was introduced in Go 1.20, and we still support Go 1.17, so instead,
-// here's a very basic implementation of an aggregated error.
-type multierror []error
-
-func (m multierror) Error() string {
-	var sb strings.Builder
-	for i, err := range m {
-		sb.WriteString(err.Error())
-		if i < len(m)-1 {
-			sb.WriteString(", ")
-		}
-	}
-	return sb.String()
-}
-
-func getDecodingStructType(t reflect.Type) *decodingStructType {
+func getDecodingStructType(t reflect.Type) (*decodingStructType, error) {
 	if v, _ := decodingStructTypeCache.Load(t); v != nil {
-		return v.(*decodingStructType)
+		structType := v.(*decodingStructType)
+		if structType.err != nil {
+			return nil, structType.err
+		}
+		return structType, nil
 	}
 
 	flds, structOptions := getFields(t)
 
 	toArray := hasToArrayOption(structOptions)
 
-	var errs []error
-	for i := 0; i < len(flds); i++ {
-		if flds[i].keyAsInt {
-			nameAsInt, numErr := strconv.Atoi(flds[i].name)
-			if numErr != nil {
-				errs = append(errs, errors.New("cbor: failed to parse field name \""+flds[i].name+"\" to int ("+numErr.Error()+")"))
-				break
+	if toArray {
+		return getDecodingStructToArrayType(t, flds)
+	}
+
+	fieldIndicesByName := make(map[string]int, len(flds))
+	var fieldIndicesByIntKey map[int64]int
+
+	decFlds := make(decodingFields, len(flds))
+	for i, f := range flds {
+		// nameAsInt is set in getFields() except for fields with an unparsable tagged name.
+		// Atoi() is called here to catch and save parsing errors.
+		if f.keyAsInt && f.nameAsInt == 0 {
+			if _, numErr := strconv.Atoi(f.name); numErr != nil {
+				structType := &decodingStructType{
+					err: errors.New("cbor: failed to parse field name \"" + f.name + "\" to int (" + numErr.Error() + ")"),
+				}
+				decodingStructTypeCache.Store(t, structType)
+				return nil, structType.err
 			}
-			flds[i].nameAsInt = int64(nameAsInt)
 		}
 
-		flds[i].typInfo = getTypeInfo(flds[i].typ)
-	}
+		if f.keyAsInt {
+			if fieldIndicesByIntKey == nil {
+				fieldIndicesByIntKey = make(map[int64]int, len(flds))
+			}
+			// The duplication check is only a safeguard, since getFields() already deduplicates fields.
+			if _, ok := fieldIndicesByIntKey[f.nameAsInt]; ok {
+				structType := &decodingStructType{
+					err: fmt.Errorf("cbor: two or more fields of %v have the same keyasint value %d", t, f.nameAsInt),
+				}
+				decodingStructTypeCache.Store(t, structType)
+				return nil, structType.err
+			}
+			fieldIndicesByIntKey[f.nameAsInt] = i
+		} else {
+			// The duplication check is only a safeguard, since getFields() already deduplicates fields.
+			if _, ok := fieldIndicesByName[f.name]; ok {
+				structType := &decodingStructType{
+					err: fmt.Errorf("cbor: two or more fields of %v have the same name %q", t, f.name),
+				}
+				decodingStructTypeCache.Store(t, structType)
+				return nil, structType.err
+			}
+			fieldIndicesByName[f.name] = i
+		}
 
-	fieldIndicesByName := make(map[string]int, len(flds))
-	for i, fld := range flds {
-		if _, ok := fieldIndicesByName[fld.name]; ok {
-			errs = append(errs, fmt.Errorf("cbor: two or more fields of %v have the same name %q", t, fld.name))
-			continue
+		decFlds[i] = &decodingField{
+			field:   *f,
+			typInfo: getTypeInfo(f.typ),
 		}
-		fieldIndicesByName[fld.name] = i
 	}
 
-	var err error
-	{
-		var multi multierror
-		for _, each := range errs {
-			if each != nil {
-				multi = append(multi, each)
+	structType := &decodingStructType{
+		fields:               decFlds,
+		fieldIndicesByName:   fieldIndicesByName,
+		fieldIndicesByIntKey: fieldIndicesByIntKey,
+	}
+	decodingStructTypeCache.Store(t, structType)
+	return structType, nil
+}
+
+func getDecodingStructToArrayType(t reflect.Type, flds fields) (*decodingStructType, error) {
+	decFlds := make(decodingFields, len(flds))
+	for i, f := range flds {
+		// nameAsInt is set in getFields() except for fields with an unparsable tagged name.
+		// Atoi() is called here to catch and save parsing errors.
+		if f.keyAsInt && f.nameAsInt == 0 {
+			if _, numErr := strconv.Atoi(f.name); numErr != nil {
+				structType := &decodingStructType{
+					err: errors.New("cbor: failed to parse field name \"" + f.name + "\" to int (" + numErr.Error() + ")"),
+				}
+				decodingStructTypeCache.Store(t, structType)
+				return nil, structType.err
 			}
 		}
-		if len(multi) == 1 {
-			err = multi[0]
-		} else if len(multi) > 1 {
-			err = multi
+
+		decFlds[i] = &decodingField{
+			field:   *f,
+			typInfo: getTypeInfo(f.typ),
 		}
 	}
 
 	structType := &decodingStructType{
-		fields:             flds,
-		fieldIndicesByName: fieldIndicesByName,
-		err:                err,
-		toArray:            toArray,
+		fields:  decFlds,
+		toArray: true,
 	}
 	decodingStructTypeCache.Store(t, structType)
-	return structType
+	return structType, nil
 }
 
 type encodingStructType struct {
-	fields             fields
-	bytewiseFields     fields
-	lengthFirstFields  fields
-	omitEmptyFieldsIdx []int
+	fields             encodingFields
+	bytewiseFields     encodingFields // Only populated if toArray is false
+	lengthFirstFields  encodingFields // Only populated if toArray is false
+	omitEmptyFieldsIdx []int          // Only populated if toArray is false
 	err                error
 	toArray            bool
 }
 
-func (st *encodingStructType) getFields(em *encMode) fields {
+func (st *encodingStructType) getFields(em *encMode) encodingFields {
 	switch em.sort {
 	case SortNone, SortFastShuffle:
 		return st.fields
@@ -191,7 +223,7 @@ func (st *encodingStructType) getFields(em *encMode) fields {
 }
 
 type bytewiseFieldSorter struct {
-	fields fields
+	fields encodingFields
 }
 
 func (x *bytewiseFieldSorter) Len() int {
@@ -203,11 +235,11 @@ func (x *bytewiseFieldSorter) Swap(i, j int) {
 }
 
 func (x *bytewiseFieldSorter) Less(i, j int) bool {
-	return bytes.Compare(x.fields[i].cborName, x.fields[j].cborName) <= 0
+	return bytes.Compare(x.fields[i].cborName, x.fields[j].cborName) < 0
 }
 
 type lengthFirstFieldSorter struct {
-	fields fields
+	fields encodingFields
 }
 
 func (x *lengthFirstFieldSorter) Len() int {
@@ -222,13 +254,16 @@ func (x *lengthFirstFieldSorter) Less(i, j int) bool {
 	if len(x.fields[i].cborName) != len(x.fields[j].cborName) {
 		return len(x.fields[i].cborName) < len(x.fields[j].cborName)
 	}
-	return bytes.Compare(x.fields[i].cborName, x.fields[j].cborName) <= 0
+	return bytes.Compare(x.fields[i].cborName, x.fields[j].cborName) < 0
 }
 
 func getEncodingStructType(t reflect.Type) (*encodingStructType, error) {
 	if v, _ := encodingStructTypeCache.Load(t); v != nil {
 		structType := v.(*encodingStructType)
-		return structType, structType.err
+		if structType.err != nil {
+			return nil, structType.err
+		}
+		return structType, nil
 	}
 
 	flds, structOptions := getFields(t)
@@ -237,111 +272,119 @@ func getEncodingStructType(t reflect.Type) (*encodingStructType, error) {
 		return getEncodingStructToArrayType(t, flds)
 	}
 
-	var err error
 	var hasKeyAsInt bool
 	var hasKeyAsStr bool
 	var omitEmptyIdx []int
+
+	encFlds := make(encodingFields, len(flds))
+
 	e := getEncodeBuffer()
-	for i := 0; i < len(flds); i++ {
+	defer putEncodeBuffer(e)
+
+	for i, f := range flds {
+		encFlds[i] = &encodingField{field: *f}
+		ef := encFlds[i]
+
 		// Get field's encodeFunc
-		flds[i].ef, flds[i].ief, flds[i].izf = getEncodeFunc(flds[i].typ)
-		if flds[i].ef == nil {
-			err = &UnsupportedTypeError{t}
-			break
+		ef.ef, ef.ief, ef.izf = getEncodeFunc(f.typ)
+		if ef.ef == nil {
+			structType := &encodingStructType{err: &UnsupportedTypeError{t}}
+			encodingStructTypeCache.Store(t, structType)
+			return nil, structType.err
 		}
 
 		// Encode field name
-		if flds[i].keyAsInt {
-			nameAsInt, numErr := strconv.Atoi(flds[i].name)
-			if numErr != nil {
-				err = errors.New("cbor: failed to parse field name \"" + flds[i].name + "\" to int (" + numErr.Error() + ")")
-				break
+		if f.keyAsInt {
+			if f.nameAsInt == 0 {
+				// nameAsInt is set in getFields() except for fields with an unparsable tagged name.
+				// Atoi() is called here to catch and save parsing errors.
+				if _, numErr := strconv.Atoi(f.name); numErr != nil {
+					structType := &encodingStructType{
+						err: errors.New("cbor: failed to parse field name \"" + f.name + "\" to int (" + numErr.Error() + ")"),
+					}
+					encodingStructTypeCache.Store(t, structType)
+					return nil, structType.err
+				}
 			}
-			flds[i].nameAsInt = int64(nameAsInt)
+			nameAsInt := f.nameAsInt
 			if nameAsInt >= 0 {
-				encodeHead(e, byte(cborTypePositiveInt), uint64(nameAsInt))
+				encodeHead(e, byte(cborTypePositiveInt), uint64(nameAsInt)) //nolint:gosec
 			} else {
 				n := nameAsInt*(-1) - 1
-				encodeHead(e, byte(cborTypeNegativeInt), uint64(n))
+				encodeHead(e, byte(cborTypeNegativeInt), uint64(n)) //nolint:gosec
 			}
-			flds[i].cborName = make([]byte, e.Len())
-			copy(flds[i].cborName, e.Bytes())
+			ef.cborName = make([]byte, e.Len())
+			copy(ef.cborName, e.Bytes())
 			e.Reset()
 
 			hasKeyAsInt = true
 		} else {
-			encodeHead(e, byte(cborTypeTextString), uint64(len(flds[i].name)))
-			flds[i].cborName = make([]byte, e.Len()+len(flds[i].name))
-			n := copy(flds[i].cborName, e.Bytes())
-			copy(flds[i].cborName[n:], flds[i].name)
+			encodeHead(e, byte(cborTypeTextString), uint64(len(f.name)))
+			ef.cborName = make([]byte, e.Len()+len(f.name))
+			n := copy(ef.cborName, e.Bytes())
+			copy(ef.cborName[n:], f.name)
 			e.Reset()
 
 			// If cborName contains a text string, then cborNameByteString contains a
 			// string that has the byte string major type but is otherwise identical to
 			// cborName.
-			flds[i].cborNameByteString = make([]byte, len(flds[i].cborName))
-			copy(flds[i].cborNameByteString, flds[i].cborName)
+			ef.cborNameByteString = make([]byte, len(ef.cborName))
+			copy(ef.cborNameByteString, ef.cborName)
 			// Reset encoded CBOR type to byte string, preserving the "additional
 			// information" bits:
-			flds[i].cborNameByteString[0] = byte(cborTypeByteString) |
-				getAdditionalInformation(flds[i].cborNameByteString[0])
+			ef.cborNameByteString[0] = byte(cborTypeByteString) |
+				getAdditionalInformation(ef.cborNameByteString[0])
 
 			hasKeyAsStr = true
 		}
 
 		// Check if field can be omitted when empty
-		if flds[i].omitEmpty {
+		if f.omitEmpty {
 			omitEmptyIdx = append(omitEmptyIdx, i)
 		}
 	}
-	putEncodeBuffer(e)
-
-	if err != nil {
-		structType := &encodingStructType{err: err}
-		encodingStructTypeCache.Store(t, structType)
-		return structType, structType.err
-	}
 
 	// Sort fields by canonical order
-	bytewiseFields := make(fields, len(flds))
-	copy(bytewiseFields, flds)
+	bytewiseFields := make(encodingFields, len(encFlds))
+	copy(bytewiseFields, encFlds)
 	sort.Sort(&bytewiseFieldSorter{bytewiseFields})
 
 	lengthFirstFields := bytewiseFields
 	if hasKeyAsInt && hasKeyAsStr {
-		lengthFirstFields = make(fields, len(flds))
-		copy(lengthFirstFields, flds)
+		lengthFirstFields = make(encodingFields, len(encFlds))
+		copy(lengthFirstFields, encFlds)
 		sort.Sort(&lengthFirstFieldSorter{lengthFirstFields})
 	}
 
 	structType := &encodingStructType{
-		fields:             flds,
+		fields:             encFlds,
 		bytewiseFields:     bytewiseFields,
 		lengthFirstFields:  lengthFirstFields,
 		omitEmptyFieldsIdx: omitEmptyIdx,
 	}
 
 	encodingStructTypeCache.Store(t, structType)
-	return structType, structType.err
+	return structType, nil
 }
 
 func getEncodingStructToArrayType(t reflect.Type, flds fields) (*encodingStructType, error) {
-	for i := 0; i < len(flds); i++ {
-		// Get field's encodeFunc
-		flds[i].ef, flds[i].ief, flds[i].izf = getEncodeFunc(flds[i].typ)
-		if flds[i].ef == nil {
+	encFlds := make(encodingFields, len(flds))
+	for i, f := range flds {
+		encFlds[i] = &encodingField{field: *f}
+		encFlds[i].ef, encFlds[i].ief, encFlds[i].izf = getEncodeFunc(f.typ)
+		if encFlds[i].ef == nil {
 			structType := &encodingStructType{err: &UnsupportedTypeError{t}}
 			encodingStructTypeCache.Store(t, structType)
-			return structType, structType.err
+			return nil, structType.err
 		}
 	}
 
 	structType := &encodingStructType{
-		fields:  flds,
+		fields:  encFlds,
 		toArray: true,
 	}
 	encodingStructTypeCache.Store(t, structType)
-	return structType, structType.err
+	return structType, nil
 }
 
 func getEncodeFunc(t reflect.Type) (encodeFunc, isEmptyFunc, isZeroFunc) {
diff --git a/vendor/github.com/fxamacker/cbor/v2/decode.go b/vendor/github.com/fxamacker/cbor/v2/decode.go
index f0bdc3b38d..03fd7f8b04 100644
--- a/vendor/github.com/fxamacker/cbor/v2/decode.go
+++ b/vendor/github.com/fxamacker/cbor/v2/decode.go
@@ -16,7 +16,6 @@ import (
 	"math/big"
 	"reflect"
 	"strconv"
-	"strings"
 	"time"
 	"unicode/utf8"
 
@@ -326,14 +325,14 @@ func (dmkm DupMapKeyMode) valid() bool {
 	return dmkm >= 0 && dmkm < maxDupMapKeyMode
 }
 
-// IndefLengthMode specifies whether to allow indefinite length items.
+// IndefLengthMode specifies whether to allow indefinite-length items.
 type IndefLengthMode int
 
 const (
-	// IndefLengthAllowed allows indefinite length items.
+	// IndefLengthAllowed allows indefinite-length items.
 	IndefLengthAllowed IndefLengthMode = iota
 
-	// IndefLengthForbidden disallows indefinite length items.
+	// IndefLengthForbidden disallows indefinite-length items.
 	IndefLengthForbidden
 
 	maxIndefLengthMode
@@ -378,6 +377,7 @@ const (
 	// - int64 if value fits
 	// - big.Int or *big.Int (see BigIntDecMode) if value < math.MinInt64
 	// - return UnmarshalTypeError if value > math.MaxInt64
+	//
 	// Deprecated: IntDecConvertSigned should not be used.
 	// Please use other options, such as IntDecConvertSignedOrError, IntDecConvertSignedOrBigInt, IntDecConvertNone.
 	IntDecConvertSigned
@@ -811,7 +811,7 @@ type DecOptions struct {
 	// Default is 128*1024=131072 and it can be set to [16, 2147483647]
 	MaxMapPairs int
 
-	// IndefLength specifies whether to allow indefinite length CBOR items.
+	// IndefLength specifies whether to allow indefinite-length CBOR items.
 	IndefLength IndefLengthMode
 
 	// TagsMd specifies whether to allow CBOR tags (major type 6).
@@ -1055,7 +1055,7 @@ func (opts DecOptions) decMode() (*decMode, error) { //nolint:gocritic // ignore
 	}
 
 	if !opts.ExtraReturnErrors.valid() {
-		return nil, errors.New("cbor: invalid ExtraReturnErrors " + strconv.Itoa(int(opts.ExtraReturnErrors)))
+		return nil, errors.New("cbor: invalid ExtraReturnErrors " + strconv.Itoa(int(opts.ExtraReturnErrors))) //nolint:gosec
 	}
 
 	if opts.DefaultMapType != nil && opts.DefaultMapType.Kind() != reflect.Map {
@@ -1149,8 +1149,8 @@ func (opts DecOptions) decMode() (*decMode, error) { //nolint:gocritic // ignore
 		unrecognizedTagToAny:      opts.UnrecognizedTagToAny,
 		timeTagToAny:              opts.TimeTagToAny,
 		simpleValues:              simpleValues,
-		nanDec:                    opts.NaN,
-		infDec:                    opts.Inf,
+		nan:                       opts.NaN,
+		inf:                       opts.Inf,
 		byteStringToTime:          opts.ByteStringToTime,
 		byteStringExpectedFormat:  opts.ByteStringExpectedFormat,
 		bignumTag:                 opts.BignumTag,
@@ -1230,8 +1230,8 @@ type decMode struct {
 	unrecognizedTagToAny      UnrecognizedTagToAnyMode
 	timeTagToAny              TimeTagToAnyMode
 	simpleValues              *SimpleValueRegistry
-	nanDec                    NaNMode
-	infDec                    InfMode
+	nan                       NaNMode
+	inf                       InfMode
 	byteStringToTime          ByteStringToTimeMode
 	byteStringExpectedFormat  ByteStringExpectedFormatMode
 	bignumTag                 BignumTagMode
@@ -1272,8 +1272,8 @@ func (dm *decMode) DecOptions() DecOptions {
 		UnrecognizedTagToAny:      dm.unrecognizedTagToAny,
 		TimeTagToAny:              dm.timeTagToAny,
 		SimpleValues:              simpleValues,
-		NaN:                       dm.nanDec,
-		Inf:                       dm.infDec,
+		NaN:                       dm.nan,
+		Inf:                       dm.inf,
 		ByteStringToTime:          dm.byteStringToTime,
 		ByteStringExpectedFormat:  dm.byteStringExpectedFormat,
 		BignumTag:                 dm.bignumTag,
@@ -1583,11 +1583,11 @@ func (d *decoder) parseToValue(v reflect.Value, tInfo *typeInfo) error { //nolin
 		_, ai, val := d.getHead()
 		switch ai {
 		case additionalInformationAsFloat16:
-			f := float64(float16.Frombits(uint16(val)).Float32())
+			f := float64(float16.Frombits(uint16(val)).Float32()) //nolint:gosec
 			return fillFloat(t, f, v)
 
 		case additionalInformationAsFloat32:
-			f := float64(math.Float32frombits(uint32(val)))
+			f := float64(math.Float32frombits(uint32(val))) //nolint:gosec
 			return fillFloat(t, f, v)
 
 		case additionalInformationAsFloat64:
@@ -1595,10 +1595,10 @@ func (d *decoder) parseToValue(v reflect.Value, tInfo *typeInfo) error { //nolin
 			return fillFloat(t, f, v)
 
 		default: // ai <= 24
-			if d.dm.simpleValues.rejected[SimpleValue(val)] {
+			if d.dm.simpleValues.rejected[SimpleValue(val)] { //nolint:gosec
 				return &UnacceptableDataItemError{
 					CBORType: t.String(),
-					Message:  "simple value " + strconv.FormatInt(int64(val), 10) + " is not recognized",
+					Message:  "simple value " + strconv.FormatInt(int64(val), 10) + " is not recognized", //nolint:gosec
 				}
 			}
 
@@ -1677,20 +1677,23 @@ func (d *decoder) parseToValue(v reflect.Value, tInfo *typeInfo) error { //nolin
 		return d.parseToValue(v, tInfo)
 
 	case cborTypeArray:
-		if tInfo.nonPtrKind == reflect.Slice {
+		switch tInfo.nonPtrKind {
+		case reflect.Slice:
 			return d.parseArrayToSlice(v, tInfo)
-		} else if tInfo.nonPtrKind == reflect.Array {
+		case reflect.Array:
 			return d.parseArrayToArray(v, tInfo)
-		} else if tInfo.nonPtrKind == reflect.Struct {
+		case reflect.Struct:
 			return d.parseArrayToStruct(v, tInfo)
 		}
+
 		d.skip()
 		return &UnmarshalTypeError{CBORType: t.String(), GoType: tInfo.nonPtrType.String()}
 
 	case cborTypeMap:
-		if tInfo.nonPtrKind == reflect.Struct {
+		switch tInfo.nonPtrKind {
+		case reflect.Struct:
 			return d.parseMapToStruct(v, tInfo)
-		} else if tInfo.nonPtrKind == reflect.Map {
+		case reflect.Map:
 			return d.parseMapToMap(v, tInfo)
 		}
 		d.skip()
@@ -1745,8 +1748,8 @@ func (d *decoder) parseToTime() (time.Time, bool, error) {
 			// Read tag number
 			_, _, tagNum := d.getHead()
 			if tagNum != 0 && tagNum != 1 {
-				d.skip() // skip tag content
-				return time.Time{}, false, errors.New("cbor: wrong tag number for time.Time, got " + strconv.Itoa(int(tagNum)) + ", expect 0 or 1")
+				d.skip()                                                                                                                            // skip tag content
+				return time.Time{}, false, errors.New("cbor: wrong tag number for time.Time, got " + strconv.Itoa(int(tagNum)) + ", expect 0 or 1") //nolint:gosec
 			}
 		}
 	} else {
@@ -1815,10 +1818,10 @@ func (d *decoder) parseToTime() (time.Time, bool, error) {
 		var f float64
 		switch ai {
 		case additionalInformationAsFloat16:
-			f = float64(float16.Frombits(uint16(val)).Float32())
+			f = float64(float16.Frombits(uint16(val)).Float32()) //nolint:gosec
 
 		case additionalInformationAsFloat32:
-			f = float64(math.Float32frombits(uint32(val)))
+			f = float64(math.Float32frombits(uint32(val))) //nolint:gosec
 
 		case additionalInformationAsFloat64:
 			f = math.Float64frombits(val)
@@ -1832,6 +1835,13 @@ func (d *decoder) parseToTime() (time.Time, bool, error) {
 			return time.Time{}, true, nil
 		}
 		seconds, fractional := math.Modf(f)
+		if seconds > math.MaxInt64 || seconds < math.MinInt64 {
+			return time.Time{}, false, &UnmarshalTypeError{
+				CBORType: t.String(),
+				GoType:   typeTime.String(),
+				errorMsg: fmt.Sprintf("%v overflows Go's int64", f),
+			}
+		}
 		return time.Unix(int64(seconds), int64(fractional*1e9)), true, nil
 
 	default:
@@ -2145,14 +2155,14 @@ func (d *decoder) parse(skipSelfDescribedTag bool) (any, error) { //nolint:gocyc
 
 	case cborTypePrimitives:
 		_, ai, val := d.getHead()
-		if ai <= 24 && d.dm.simpleValues.rejected[SimpleValue(val)] {
+		if ai <= 24 && d.dm.simpleValues.rejected[SimpleValue(val)] { //nolint:gosec
 			return nil, &UnacceptableDataItemError{
 				CBORType: t.String(),
-				Message:  "simple value " + strconv.FormatInt(int64(val), 10) + " is not recognized",
+				Message:  "simple value " + strconv.FormatInt(int64(val), 10) + " is not recognized", //nolint:gosec
 			}
 		}
 		if ai < 20 || ai == 24 {
-			return SimpleValue(val), nil
+			return SimpleValue(val), nil //nolint:gosec
 		}
 
 		switch ai {
@@ -2165,11 +2175,11 @@ func (d *decoder) parse(skipSelfDescribedTag bool) (any, error) { //nolint:gocyc
 			return nil, nil
 
 		case additionalInformationAsFloat16:
-			f := float64(float16.Frombits(uint16(val)).Float32())
+			f := float64(float16.Frombits(uint16(val)).Float32()) //nolint:gosec
 			return f, nil
 
 		case additionalInformationAsFloat32:
-			f := float64(math.Float32frombits(uint32(val)))
+			f := float64(math.Float32frombits(uint32(val))) //nolint:gosec
 			return f, nil
 
 		case additionalInformationAsFloat64:
@@ -2202,16 +2212,16 @@ func (d *decoder) parse(skipSelfDescribedTag bool) (any, error) { //nolint:gocyc
 func (d *decoder) parseByteString() ([]byte, bool) {
 	_, _, val, indefiniteLength := d.getHeadWithIndefiniteLengthFlag()
 	if !indefiniteLength {
-		b := d.data[d.off : d.off+int(val)]
-		d.off += int(val)
+		b := d.data[d.off : d.off+int(val)] //nolint:gosec
+		d.off += int(val)                   //nolint:gosec
 		return b, false
 	}
-	// Process indefinite length string chunks.
+	// Process indefinite-length string chunks.
 	b := []byte{}
 	for !d.foundBreak() {
 		_, _, val = d.getHead()
-		b = append(b, d.data[d.off:d.off+int(val)]...)
-		d.off += int(val)
+		b = append(b, d.data[d.off:d.off+int(val)]...) //nolint:gosec
+		d.off += int(val)                              //nolint:gosec
 	}
 	return b, true
 }
@@ -2300,19 +2310,19 @@ func (d *decoder) applyByteStringTextConversion(
 func (d *decoder) parseTextString() ([]byte, error) {
 	_, _, val, indefiniteLength := d.getHeadWithIndefiniteLengthFlag()
 	if !indefiniteLength {
-		b := d.data[d.off : d.off+int(val)]
-		d.off += int(val)
+		b := d.data[d.off : d.off+int(val)] //nolint:gosec
+		d.off += int(val)                   //nolint:gosec
 		if d.dm.utf8 == UTF8RejectInvalid && !utf8.Valid(b) {
 			return nil, &SemanticError{"cbor: invalid UTF-8 string"}
 		}
 		return b, nil
 	}
-	// Process indefinite length string chunks.
+	// Process indefinite-length string chunks.
 	b := []byte{}
 	for !d.foundBreak() {
 		_, _, val = d.getHead()
-		x := d.data[d.off : d.off+int(val)]
-		d.off += int(val)
+		x := d.data[d.off : d.off+int(val)] //nolint:gosec
+		d.off += int(val)                   //nolint:gosec
 		if d.dm.utf8 == UTF8RejectInvalid && !utf8.Valid(x) {
 			for !d.foundBreak() {
 				d.skip() // Skip remaining chunk on error
@@ -2327,7 +2337,7 @@ func (d *decoder) parseTextString() ([]byte, error) {
 func (d *decoder) parseArray() ([]any, error) {
 	_, _, val, indefiniteLength := d.getHeadWithIndefiniteLengthFlag()
 	hasSize := !indefiniteLength
-	count := int(val)
+	count := int(val) //nolint:gosec
 	if !hasSize {
 		count = d.numOfItemsUntilBreak() // peek ahead to get array size to preallocate slice for better performance
 	}
@@ -2349,7 +2359,7 @@ func (d *decoder) parseArray() ([]any, error) {
 func (d *decoder) parseArrayToSlice(v reflect.Value, tInfo *typeInfo) error {
 	_, _, val, indefiniteLength := d.getHeadWithIndefiniteLengthFlag()
 	hasSize := !indefiniteLength
-	count := int(val)
+	count := int(val) //nolint:gosec
 	if !hasSize {
 		count = d.numOfItemsUntilBreak() // peek ahead to get array size to preallocate slice for better performance
 	}
@@ -2371,7 +2381,7 @@ func (d *decoder) parseArrayToSlice(v reflect.Value, tInfo *typeInfo) error {
 func (d *decoder) parseArrayToArray(v reflect.Value, tInfo *typeInfo) error {
 	_, _, val, indefiniteLength := d.getHeadWithIndefiniteLengthFlag()
 	hasSize := !indefiniteLength
-	count := int(val)
+	count := int(val) //nolint:gosec
 	gi := 0
 	vLen := v.Len()
 	var err error
@@ -2400,7 +2410,7 @@ func (d *decoder) parseArrayToArray(v reflect.Value, tInfo *typeInfo) error {
 func (d *decoder) parseMap() (any, error) {
 	_, _, val, indefiniteLength := d.getHeadWithIndefiniteLengthFlag()
 	hasSize := !indefiniteLength
-	count := int(val)
+	count := int(val) //nolint:gosec
 	m := make(map[any]any)
 	var k, e any
 	var err, lastErr error
@@ -2465,7 +2475,7 @@ func (d *decoder) parseMap() (any, error) {
 func (d *decoder) parseMapToMap(v reflect.Value, tInfo *typeInfo) error { //nolint:gocyclo
 	_, _, val, indefiniteLength := d.getHeadWithIndefiniteLengthFlag()
 	hasSize := !indefiniteLength
-	count := int(val)
+	count := int(val) //nolint:gosec
 	if v.IsNil() {
 		mapsize := count
 		if !hasSize {
@@ -2566,9 +2576,9 @@ func (d *decoder) parseMapToMap(v reflect.Value, tInfo *typeInfo) error { //noli
 }
 
 func (d *decoder) parseArrayToStruct(v reflect.Value, tInfo *typeInfo) error {
-	structType := getDecodingStructType(tInfo.nonPtrType)
-	if structType.err != nil {
-		return structType.err
+	structType, structTypeErr := getDecodingStructType(tInfo.nonPtrType)
+	if structTypeErr != nil {
+		return structTypeErr
 	}
 
 	if !structType.toArray {
@@ -2584,7 +2594,7 @@ func (d *decoder) parseArrayToStruct(v reflect.Value, tInfo *typeInfo) error {
 	start := d.off
 	_, _, val, indefiniteLength := d.getHeadWithIndefiniteLengthFlag()
 	hasSize := !indefiniteLength
-	count := int(val)
+	count := int(val) //nolint:gosec
 	if !hasSize {
 		count = d.numOfItemsUntilBreak() // peek ahead to get array size
 	}
@@ -2637,11 +2647,72 @@ func (d *decoder) parseArrayToStruct(v reflect.Value, tInfo *typeInfo) error {
 	return err
 }
 
-// parseMapToStruct needs to be fast so gocyclo can be ignored for now.
+// skipMapEntriesFromIndex skips remaining map entries starting from index i.
+func (d *decoder) skipMapEntriesFromIndex(i, count int, hasSize bool) {
+	for ; (hasSize && i < count) || (!hasSize && !d.foundBreak()); i++ {
+		d.skip()
+		d.skip()
+	}
+}
+
+// skipMapForDupKey skips the current map value and all remaining map entries,
+// then returns a DupMapKeyError for the given key at map index i.
+func (d *decoder) skipMapForDupKey(dupKey any, i, count int, hasSize bool) error {
+	// Skip the value of the duplicate key.
+	d.skip()
+	// Skip all remaining map entries.
+	d.skipMapEntriesFromIndex(i+1, count, hasSize)
+	return &DupMapKeyError{dupKey, i}
+}
+
+// skipMapForUnknownField skips the current map value and all remaining map entries,
+// then returns a UnknownFieldError for the given key at map index i.
+func (d *decoder) skipMapForUnknownField(i, count int, hasSize bool) error {
+	// Skip the value of the unknown key.
+	d.skip()
+	// Skip all remaining map entries.
+	d.skipMapEntriesFromIndex(i+1, count, hasSize)
+	return &UnknownFieldError{i}
+}
+
+// decodeToStructField decodes the next CBOR value into the struct field f in v.
+// If the field cannot be resolved, the CBOR value is skipped.
+func (d *decoder) decodeToStructField(v reflect.Value, f *decodingField, tInfo *typeInfo) error {
+	var fv reflect.Value
+
+	if len(f.idx) == 1 {
+		fv = v.Field(f.idx[0])
+	} else {
+		var err error
+		fv, err = getFieldValue(v, f.idx, func(v reflect.Value) (reflect.Value, error) {
+			// Return a new value for embedded field null pointer to point to, or return error.
+			if !v.CanSet() {
+				return reflect.Value{}, errors.New("cbor: cannot set embedded pointer to unexported struct: " + v.Type().String())
+			}
+			v.Set(reflect.New(v.Type().Elem()))
+			return v, nil
+		})
+		if !fv.IsValid() {
+			d.skip()
+			return err
+		}
+	}
+
+	err := d.parseToValue(fv, f.typInfo)
+	if err != nil {
+		if typeError, ok := err.(*UnmarshalTypeError); ok {
+			typeError.StructFieldName = tInfo.nonPtrType.String() + "." + f.name
+		}
+		return err
+	}
+
+	return nil
+}
+
 func (d *decoder) parseMapToStruct(v reflect.Value, tInfo *typeInfo) error { //nolint:gocyclo
-	structType := getDecodingStructType(tInfo.nonPtrType)
-	if structType.err != nil {
-		return structType.err
+	structType, structTypeErr := getDecodingStructType(tInfo.nonPtrType)
+	if structTypeErr != nil {
+		return structTypeErr
 	}
 
 	if structType.toArray {
@@ -2654,14 +2725,12 @@ func (d *decoder) parseMapToStruct(v reflect.Value, tInfo *typeInfo) error { //n
 		}
 	}
 
-	var err, lastErr error
-
 	// Get CBOR map size
 	_, _, val, indefiniteLength := d.getHeadWithIndefiniteLengthFlag()
 	hasSize := !indefiniteLength
-	count := int(val)
+	count := int(val) //nolint:gosec
 
-	// Keeps track of matched struct fields
+	// Keep track of matched struct fields to detect duplicate map keys.
 	var foundFldIdx []bool
 	{
 		const maxStackFields = 128
@@ -2675,99 +2744,80 @@ func (d *decoder) parseMapToStruct(v reflect.Value, tInfo *typeInfo) error { //n
 		}
 	}
 
-	// Keeps track of CBOR map keys to detect duplicate map key
-	keyCount := 0
-	var mapKeys map[any]struct{}
-
-	errOnUnknownField := (d.dm.extraReturnErrors & ExtraDecErrorUnknownField) > 0
+	// Keep track of unmatched CBOR map keys to detect duplicate map keys.
+	var unmatchedMapKeys map[any]struct{}
 
-MapEntryLoop:
-	for j := 0; (hasSize && j < count) || (!hasSize && !d.foundBreak()); j++ {
-		var f *field
+	var err error
 
-		// If duplicate field detection is enabled and the key at index j did not match any
-		// field, k will hold the map key.
-		var k any
+	caseInsensitive := d.dm.fieldNameMatching == FieldNameMatchingPreferCaseSensitive
 
+	for i := 0; (hasSize && i < count) || (!hasSize && !d.foundBreak()); i++ {
 		t := d.nextCBORType()
-		if t == cborTypeTextString || (t == cborTypeByteString && d.dm.fieldNameByteString == FieldNameByteStringAllowed) {
+
+		// Reclassify disallowed byte string keys so they fall to the default case.
+		// keyType is only used for branch control.
+		keyType := t
+		if t == cborTypeByteString && d.dm.fieldNameByteString != FieldNameByteStringAllowed {
+			keyType = 0xff
+		}
+
+		switch keyType {
+		case cborTypeTextString, cborTypeByteString:
 			var keyBytes []byte
 			if t == cborTypeTextString {
-				keyBytes, lastErr = d.parseTextString()
-				if lastErr != nil {
+				var parseErr error
+				keyBytes, parseErr = d.parseTextString()
+				if parseErr != nil {
 					if err == nil {
-						err = lastErr
+						err = parseErr
 					}
-					d.skip() // skip value
+					d.skip() // Skip value
 					continue
 				}
 			} else { // cborTypeByteString
 				keyBytes, _ = d.parseByteString()
 			}
 
-			// Check for exact match on field name.
-			if i, ok := structType.fieldIndicesByName[string(keyBytes)]; ok {
-				fld := structType.fields[i]
+			// Find matching struct field (exact match, then case-insensitive fallback).
+			if fldIdx, ok := findStructFieldByKey(structType, keyBytes, caseInsensitive); ok {
+				fld := structType.fields[fldIdx]
 
-				if !foundFldIdx[i] {
-					f = fld
-					foundFldIdx[i] = true
-				} else if d.dm.dupMapKey == DupMapKeyEnforcedAPF {
-					err = &DupMapKeyError{fld.name, j}
-					d.skip() // skip value
-					j++
-					// skip the rest of the map
-					for ; (hasSize && j < count) || (!hasSize && !d.foundBreak()); j++ {
-						d.skip()
-						d.skip()
+				switch checkDupField(d.dm, foundFldIdx, fldIdx) {
+				case mapActionParseValueAndContinue:
+					if fieldErr := d.decodeToStructField(v, fld, tInfo); fieldErr != nil && err == nil {
+						err = fieldErr
 					}
-					return err
-				} else {
-					// discard repeated match
+					continue
+				case mapActionSkipAllAndReturnError:
+					return d.skipMapForDupKey(string(keyBytes), i, count, hasSize)
+				case mapActionSkipValueAndContinue:
 					d.skip()
-					continue MapEntryLoop
+					continue
 				}
 			}
 
-			// Find field with case-insensitive match
-			if f == nil && d.dm.fieldNameMatching == FieldNameMatchingPreferCaseSensitive {
-				keyLen := len(keyBytes)
-				keyString := string(keyBytes)
-				for i := 0; i < len(structType.fields); i++ {
-					fld := structType.fields[i]
-					if len(fld.name) == keyLen && strings.EqualFold(fld.name, keyString) {
-						if !foundFldIdx[i] {
-							f = fld
-							foundFldIdx[i] = true
-						} else if d.dm.dupMapKey == DupMapKeyEnforcedAPF {
-							err = &DupMapKeyError{keyString, j}
-							d.skip() // skip value
-							j++
-							// skip the rest of the map
-							for ; (hasSize && j < count) || (!hasSize && !d.foundBreak()); j++ {
-								d.skip()
-								d.skip()
-							}
-							return err
-						} else {
-							// discard repeated match
-							d.skip()
-							continue MapEntryLoop
-						}
-						break
-					}
-				}
+			// No matching struct field found.
+			if unmatchedErr := handleUnmatchedMapKey(d, string(keyBytes), i, count, hasSize, &unmatchedMapKeys); unmatchedErr != nil {
+				return unmatchedErr
 			}
 
-			if d.dm.dupMapKey == DupMapKeyEnforcedAPF && f == nil {
-				k = string(keyBytes)
-			}
-		} else if t <= cborTypeNegativeInt { // uint/int
+		case cborTypePositiveInt, cborTypeNegativeInt:
 			var nameAsInt int64
 
 			if t == cborTypePositiveInt {
 				_, _, val := d.getHead()
-				nameAsInt = int64(val)
+				if val > math.MaxInt64 {
+					if err == nil {
+						err = &UnmarshalTypeError{
+							CBORType: t.String(),
+							GoType:   reflect.TypeOf(int64(0)).String(),
+							errorMsg: strconv.FormatUint(val, 10) + " overflows Go's int64",
+						}
+					}
+					d.skip() // skip value
+					continue
+				}
+				nameAsInt = int64(val) //nolint:gosec
 			} else {
 				_, _, val := d.getHead()
 				if val > math.MaxInt64 {
@@ -2781,39 +2831,35 @@ MapEntryLoop:
 					d.skip() // skip value
 					continue
 				}
-				nameAsInt = int64(-1) ^ int64(val)
-			}
-
-			// Find field
-			for i := 0; i < len(structType.fields); i++ {
-				fld := structType.fields[i]
-				if fld.keyAsInt && fld.nameAsInt == nameAsInt {
-					if !foundFldIdx[i] {
-						f = fld
-						foundFldIdx[i] = true
-					} else if d.dm.dupMapKey == DupMapKeyEnforcedAPF {
-						err = &DupMapKeyError{nameAsInt, j}
-						d.skip() // skip value
-						j++
-						// skip the rest of the map
-						for ; (hasSize && j < count) || (!hasSize && !d.foundBreak()); j++ {
-							d.skip()
-							d.skip()
-						}
-						return err
-					} else {
-						// discard repeated match
-						d.skip()
-						continue MapEntryLoop
+				nameAsInt = int64(-1) ^ int64(val) //nolint:gosec
+			}
+
+			// Find field by integer key
+			if fldIdx, ok := structType.fieldIndicesByIntKey[nameAsInt]; ok {
+				fld := structType.fields[fldIdx]
+
+				switch checkDupField(d.dm, foundFldIdx, fldIdx) {
+				case mapActionParseValueAndContinue:
+					if fieldErr := d.decodeToStructField(v, fld, tInfo); fieldErr != nil && err == nil {
+						err = fieldErr
 					}
-					break
+					continue
+				case mapActionSkipAllAndReturnError:
+					return d.skipMapForDupKey(nameAsInt, i, count, hasSize)
+				case mapActionSkipValueAndContinue:
+					d.skip()
+					continue
 				}
 			}
 
-			if d.dm.dupMapKey == DupMapKeyEnforcedAPF && f == nil {
-				k = nameAsInt
+			// No matching struct field found.
+			if unmatchedErr := handleUnmatchedMapKey(d, nameAsInt, i, count, hasSize, &unmatchedMapKeys); unmatchedErr != nil {
+				return unmatchedErr
 			}
-		} else {
+
+		default:
+			// CBOR map keys that can't be matched to any struct field.
+
 			if err == nil {
 				err = &UnmarshalTypeError{
 					CBORType: t.String(),
@@ -2821,97 +2867,31 @@ MapEntryLoop:
 					errorMsg: "map key is of type " + t.String() + " and cannot be used to match struct field name",
 				}
 			}
+
+			var otherKey any
 			if d.dm.dupMapKey == DupMapKeyEnforcedAPF {
 				// parse key
-				k, lastErr = d.parse(true)
-				if lastErr != nil {
+				var parseErr error
+				otherKey, parseErr = d.parse(true)
+				if parseErr != nil {
 					d.skip() // skip value
 					continue
 				}
 				// Detect if CBOR map key can be used as Go map key.
-				if !isHashableValue(reflect.ValueOf(k)) {
+				if !isHashableValue(reflect.ValueOf(otherKey)) {
 					d.skip() // skip value
 					continue
 				}
 			} else {
 				d.skip() // skip key
 			}
-		}
-
-		if f == nil {
-			if errOnUnknownField {
-				err = &UnknownFieldError{j}
-				d.skip() // Skip value
-				j++
-				// skip the rest of the map
-				for ; (hasSize && j < count) || (!hasSize && !d.foundBreak()); j++ {
-					d.skip()
-					d.skip()
-				}
-				return err
-			}
-
-			// Two map keys that match the same struct field are immediately considered
-			// duplicates. This check detects duplicates between two map keys that do
-			// not match a struct field. If unknown field errors are enabled, then this
-			// check is never reached.
-			if d.dm.dupMapKey == DupMapKeyEnforcedAPF {
-				if mapKeys == nil {
-					mapKeys = make(map[any]struct{}, 1)
-				}
-				mapKeys[k] = struct{}{}
-				newKeyCount := len(mapKeys)
-				if newKeyCount == keyCount {
-					err = &DupMapKeyError{k, j}
-					d.skip() // skip value
-					j++
-					// skip the rest of the map
-					for ; (hasSize && j < count) || (!hasSize && !d.foundBreak()); j++ {
-						d.skip()
-						d.skip()
-					}
-					return err
-				}
-				keyCount = newKeyCount
-			}
-
-			d.skip() // Skip value
-			continue
-		}
-
-		// Get field value by index
-		var fv reflect.Value
-		if len(f.idx) == 1 {
-			fv = v.Field(f.idx[0])
-		} else {
-			fv, lastErr = getFieldValue(v, f.idx, func(v reflect.Value) (reflect.Value, error) {
-				// Return a new value for embedded field null pointer to point to, or return error.
-				if !v.CanSet() {
-					return reflect.Value{}, errors.New("cbor: cannot set embedded pointer to unexported struct: " + v.Type().String())
-				}
-				v.Set(reflect.New(v.Type().Elem()))
-				return v, nil
-			})
-			if lastErr != nil && err == nil {
-				err = lastErr
-			}
-			if !fv.IsValid() {
-				d.skip()
-				continue
-			}
-		}
 
-		if lastErr = d.parseToValue(fv, f.typInfo); lastErr != nil {
-			if err == nil {
-				if typeError, ok := lastErr.(*UnmarshalTypeError); ok {
-					typeError.StructFieldName = tInfo.nonPtrType.String() + "." + f.name
-					err = typeError
-				} else {
-					err = lastErr
-				}
+			if unmatchedErr := handleUnmatchedMapKey(d, otherKey, i, count, hasSize, &unmatchedMapKeys); unmatchedErr != nil {
+				return unmatchedErr
 			}
 		}
 	}
+
 	return err
 }
 
@@ -2958,15 +2938,15 @@ func (d *decoder) skip() {
 
 	switch t {
 	case cborTypeByteString, cborTypeTextString:
-		d.off += int(val)
+		d.off += int(val) //nolint:gosec
 
 	case cborTypeArray:
-		for i := 0; i < int(val); i++ {
+		for i := 0; i < int(val); i++ { //nolint:gosec
 			d.skip()
 		}
 
 	case cborTypeMap:
-		for i := 0; i < int(val)*2; i++ {
+		for i := 0; i < int(val)*2; i++ { //nolint:gosec
 			d.skip()
 		}
 
diff --git a/vendor/github.com/fxamacker/cbor/v2/decode_map_utils.go b/vendor/github.com/fxamacker/cbor/v2/decode_map_utils.go
new file mode 100644
index 0000000000..3c8c423ad1
--- /dev/null
+++ b/vendor/github.com/fxamacker/cbor/v2/decode_map_utils.go
@@ -0,0 +1,98 @@
+// Copyright (c) Faye Amacker. All rights reserved.
+// Licensed under the MIT License. See LICENSE in the project root for license information.
+
+package cbor
+
+import "strings"
+
+// mapAction represents the next action during decoding a CBOR map to a Go struct.
+type mapAction int
+
+const (
+	mapActionParseValueAndContinue mapAction = iota // The caller should process the map value.
+	mapActionSkipValueAndContinue                   // The caller should skip the map value.
+	mapActionSkipAllAndReturnError                  // The caller should skip the rest of the map and return an error.
+)
+
+// checkDupField checks if a struct field at index i has already been matched and returns the next action.
+// If not matched, it marks the field as matched and returns mapActionParseValueAndContinue.
+// If matched and DupMapKeyEnforcedAPF is specified in the given dm, it returns mapActionSkipAllAndReturnError.
+// If matched and DupMapKeyEnforcedAPF is not specified in the given dm, it returns mapActionSkipValueAndContinue.
+func checkDupField(dm *decMode, foundFldIdx []bool, i int) mapAction {
+	if !foundFldIdx[i] {
+		foundFldIdx[i] = true
+		return mapActionParseValueAndContinue
+	}
+	if dm.dupMapKey == DupMapKeyEnforcedAPF {
+		return mapActionSkipAllAndReturnError
+	}
+	return mapActionSkipValueAndContinue
+}
+
+// findStructFieldByKey finds a struct field matching keyBytes by name.
+// It tries an exact match first. If no exact match is found and
+// caseInsensitive is true, it falls back to a case-insensitive search.
+// findStructFieldByKey returns the field index and true, or -1 and false.
+func findStructFieldByKey(
+	structType *decodingStructType,
+	keyBytes []byte,
+	caseInsensitive bool,
+) (int, bool) {
+	if fldIdx, ok := structType.fieldIndicesByName[string(keyBytes)]; ok {
+		return fldIdx, true
+	}
+	if caseInsensitive {
+		return findFieldCaseInsensitive(structType.fields, string(keyBytes))
+	}
+	return -1, false
+}
+
+// findFieldCaseInsensitive returns the index of the first field whose name
+// case-insensitively matches key, or -1 and false if no field matches.
+func findFieldCaseInsensitive(flds decodingFields, key string) (int, bool) {
+	keyLen := len(key)
+	for i, f := range flds {
+		if f.keyAsInt {
+			continue
+		}
+		if len(f.name) == keyLen && strings.EqualFold(f.name, key) {
+			return i, true
+		}
+	}
+	return -1, false
+}
+
+// handleUnmatchedMapKey handles a map entry whose key does not match any struct
+// field. It can return UnknownFieldError or DupMapKeyError.
+// handleUnmatchedMapKey consumes the CBOR value, so the caller doesn't need to skip any values.
+// If an error is returned, the caller should abort parsing the map and return the error.
+// If no error is returned, the caller should continue to process the next map pair.
+func handleUnmatchedMapKey(
+	d *decoder,
+	key any,
+	i int,
+	count int,
+	hasSize bool,
+	// *map[any]struct{} is used here because we use lazy initialization for uks
+	uks *map[any]struct{}, //nolint:gocritic
+) error {
+	errOnUnknownField := (d.dm.extraReturnErrors & ExtraDecErrorUnknownField) > 0
+
+	if errOnUnknownField {
+		return d.skipMapForUnknownField(i, count, hasSize)
+	}
+
+	if d.dm.dupMapKey == DupMapKeyEnforcedAPF {
+		if *uks == nil {
+			*uks = make(map[any]struct{})
+		}
+		if _, dup := (*uks)[key]; dup {
+			return d.skipMapForDupKey(key, i, count, hasSize)
+		}
+		(*uks)[key] = struct{}{}
+	}
+
+	// Skip value.
+	d.skip()
+	return nil
+}
diff --git a/vendor/github.com/fxamacker/cbor/v2/diagnose.go b/vendor/github.com/fxamacker/cbor/v2/diagnose.go
index 44afb86608..42a67ad11f 100644
--- a/vendor/github.com/fxamacker/cbor/v2/diagnose.go
+++ b/vendor/github.com/fxamacker/cbor/v2/diagnose.go
@@ -51,11 +51,8 @@ const (
 	maxByteStringEncoding
 )
 
-func (bse ByteStringEncoding) valid() error {
-	if bse >= maxByteStringEncoding {
-		return errors.New("cbor: invalid ByteStringEncoding " + strconv.Itoa(int(bse)))
-	}
-	return nil
+func (bse ByteStringEncoding) valid() bool {
+	return bse < maxByteStringEncoding
 }
 
 // DiagOptions specifies Diag options.
@@ -104,8 +101,8 @@ func (opts DiagOptions) DiagMode() (DiagMode, error) {
 }
 
 func (opts DiagOptions) diagMode() (*diagMode, error) {
-	if err := opts.ByteStringEncoding.valid(); err != nil {
-		return nil, err
+	if !opts.ByteStringEncoding.valid() {
+		return nil, errors.New("cbor: invalid ByteStringEncoding " + strconv.Itoa(int(opts.ByteStringEncoding)))
 	}
 
 	decMode, err := DecOptions{
@@ -360,7 +357,7 @@ func (di *diagnose) item() error { //nolint:gocyclo
 
 	case cborTypeArray:
 		_, _, val := di.d.getHead()
-		count := int(val)
+		count := int(val) //nolint:gosec
 		di.w.WriteByte('[')
 
 		for i := 0; i < count; i++ {
@@ -376,7 +373,7 @@ func (di *diagnose) item() error { //nolint:gocyclo
 
 	case cborTypeMap:
 		_, _, val := di.d.getHead()
-		count := int(val)
+		count := int(val) //nolint:gosec
 		di.w.WriteByte('{')
 
 		for i := 0; i < count; i++ {
@@ -477,8 +474,8 @@ func (di *diagnose) item() error { //nolint:gocyclo
 func (di *diagnose) writeU16(val rune) {
 	di.w.WriteString("\\u")
 	var in [2]byte
-	in[0] = byte(val >> 8)
-	in[1] = byte(val)
+	in[0] = byte(val >> 8) //nolint:gosec
+	in[1] = byte(val)      //nolint:gosec
 	sz := hex.EncodedLen(len(in))
 	di.w.Grow(sz)
 	dst := di.w.Bytes()[di.w.Len() : di.w.Len()+sz]
@@ -608,7 +605,7 @@ func (di *diagnose) encodeTextString(val string, quote byte) error {
 
 		c, size := utf8.DecodeRuneInString(val[i:])
 		switch {
-		case c == utf8.RuneError:
+		case c == utf8.RuneError && size == 1:
 			return &SemanticError{"cbor: invalid UTF-8 string"}
 
 		case c < utf16SurrSelf:
@@ -631,7 +628,7 @@ func (di *diagnose) encodeFloat(ai byte, val uint64) error {
 	f64 := float64(0)
 	switch ai {
 	case additionalInformationAsFloat16:
-		f16 := float16.Frombits(uint16(val))
+		f16 := float16.Frombits(uint16(val)) //nolint:gosec
 		switch {
 		case f16.IsNaN():
 			di.w.WriteString("NaN")
@@ -647,7 +644,7 @@ func (di *diagnose) encodeFloat(ai byte, val uint64) error {
 		}
 
 	case additionalInformationAsFloat32:
-		f32 := math.Float32frombits(uint32(val))
+		f32 := math.Float32frombits(uint32(val)) //nolint:gosec
 		switch {
 		case f32 != f32:
 			di.w.WriteString("NaN")
diff --git a/vendor/github.com/fxamacker/cbor/v2/encode.go b/vendor/github.com/fxamacker/cbor/v2/encode.go
index c550617c38..e65a29d8a6 100644
--- a/vendor/github.com/fxamacker/cbor/v2/encode.go
+++ b/vendor/github.com/fxamacker/cbor/v2/encode.go
@@ -30,7 +30,7 @@ import (
 // If value implements the Marshaler interface, Marshal calls its
 // MarshalCBOR method.
 //
-// If value implements encoding.BinaryMarshaler, Marhsal calls its
+// If value implements encoding.BinaryMarshaler, Marshal calls its
 // MarshalBinary method and encode it as CBOR byte string.
 //
 // Boolean values encode as CBOR booleans (type 7).
@@ -343,7 +343,7 @@ const (
 	// non-UTC timezone then a "localtime - UTC" numeric offset will be included as specified in RFC3339.
 	// NOTE: User applications can avoid including the RFC3339 numeric offset by:
 	// - providing a time.Time value set to UTC, or
-	// - using the TimeUnix, TimeUnixMicro, or TimeUnixDynamic option instead of TimeRFC3339.
+	// - using the TimeUnix, TimeUnixMicro, TimeUnixDynamic, or TimeRFC3339NanoUTC option.
 	TimeRFC3339
 
 	// TimeRFC3339Nano causes time.Time to encode to a CBOR time (tag 0) with a text string content
@@ -351,9 +351,13 @@ const (
 	// non-UTC timezone then a "localtime - UTC" numeric offset will be included as specified in RFC3339.
 	// NOTE: User applications can avoid including the RFC3339 numeric offset by:
 	// - providing a time.Time value set to UTC, or
-	// - using the TimeUnix, TimeUnixMicro, or TimeUnixDynamic option instead of TimeRFC3339Nano.
+	// - using the TimeUnix, TimeUnixMicro, TimeUnixDynamic, or TimeRFC3339NanoUTC option.
 	TimeRFC3339Nano
 
+	// TimeRFC3339NanoUTC causes time.Time to encode to a CBOR time (tag 0) with a text string content
+	// representing UTC time using nanosecond precision in RFC3339 format.
+	TimeRFC3339NanoUTC
+
 	maxTimeMode
 )
 
@@ -436,7 +440,7 @@ const (
 	// FieldNameToTextString encodes struct fields to CBOR text string (major type 3).
 	FieldNameToTextString FieldNameMode = iota
 
-	// FieldNameToTextString encodes struct fields to CBOR byte string (major type 2).
+	// FieldNameToByteString encodes struct fields to CBOR byte string (major type 2).
 	FieldNameToByteString
 
 	maxFieldNameMode
@@ -567,7 +571,7 @@ type EncOptions struct {
 	// RFC3339 format gets tag number 0, and numeric epoch time tag number 1.
 	TimeTag EncTagMode
 
-	// IndefLength specifies whether to allow indefinite length CBOR items.
+	// IndefLength specifies whether to allow indefinite-length CBOR items.
 	IndefLength IndefLengthMode
 
 	// NilContainers specifies how to encode nil slices and maps.
@@ -1132,10 +1136,11 @@ func encodeFloat(e *bytes.Buffer, em *encMode, v reflect.Value) error {
 	if fopt == ShortestFloat16 {
 		var f16 float16.Float16
 		p := float16.PrecisionFromfloat32(f32)
-		if p == float16.PrecisionExact {
+		switch p {
+		case float16.PrecisionExact:
 			// Roundtrip float32->float16->float32 test isn't needed.
 			f16 = float16.Fromfloat32(f32)
-		} else if p == float16.PrecisionUnknown {
+		case float16.PrecisionUnknown:
 			// Try roundtrip float32->float16->float32 to determine if float32 can fit into float16.
 			f16 = float16.Fromfloat32(f32)
 			if f16.Float32() == f32 {
@@ -1293,10 +1298,10 @@ func encodeByteString(e *bytes.Buffer, em *encMode, v reflect.Value) error {
 	if slen == 0 {
 		return e.WriteByte(byte(cborTypeByteString))
 	}
-	encodeHead(e, byte(cborTypeByteString), uint64(slen))
+	encodeHead(e, byte(cborTypeByteString), uint64(slen)) //nolint:gosec
 	if vk == reflect.Array {
 		for i := 0; i < slen; i++ {
-			e.WriteByte(byte(v.Index(i).Uint()))
+			e.WriteByte(byte(v.Index(i).Uint())) //nolint:gosec
 		}
 		return nil
 	}
@@ -1333,7 +1338,7 @@ func (ae arrayEncodeFunc) encode(e *bytes.Buffer, em *encMode, v reflect.Value)
 	if alen == 0 {
 		return e.WriteByte(byte(cborTypeArray))
 	}
-	encodeHead(e, byte(cborTypeArray), uint64(alen))
+	encodeHead(e, byte(cborTypeArray), uint64(alen)) //nolint:gosec
 	for i := 0; i < alen; i++ {
 		if err := ae.f(e, em, v.Index(i)); err != nil {
 			return err
@@ -1364,7 +1369,7 @@ func (me mapEncodeFunc) encode(e *bytes.Buffer, em *encMode, v reflect.Value) er
 		return e.WriteByte(byte(cborTypeMap))
 	}
 
-	encodeHead(e, byte(cborTypeMap), uint64(mlen))
+	encodeHead(e, byte(cborTypeMap), uint64(mlen)) //nolint:gosec
 	if em.sort == SortNone || em.sort == SortFastShuffle || mlen <= 1 {
 		return me.e(e, em, v, nil)
 	}
@@ -1427,7 +1432,7 @@ func (x *bytewiseKeyValueSorter) Swap(i, j int) {
 
 func (x *bytewiseKeyValueSorter) Less(i, j int) bool {
 	kvi, kvj := x.kvs[i], x.kvs[j]
-	return bytes.Compare(x.data[kvi.offset:kvi.valueOffset], x.data[kvj.offset:kvj.valueOffset]) <= 0
+	return bytes.Compare(x.data[kvi.offset:kvi.valueOffset], x.data[kvj.offset:kvj.valueOffset]) < 0
 }
 
 type lengthFirstKeyValueSorter struct {
@@ -1448,7 +1453,7 @@ func (x *lengthFirstKeyValueSorter) Less(i, j int) bool {
 	if keyLengthDifference := (kvi.valueOffset - kvi.offset) - (kvj.valueOffset - kvj.offset); keyLengthDifference != 0 {
 		return keyLengthDifference < 0
 	}
-	return bytes.Compare(x.data[kvi.offset:kvi.valueOffset], x.data[kvj.offset:kvj.valueOffset]) <= 0
+	return bytes.Compare(x.data[kvi.offset:kvi.valueOffset], x.data[kvj.offset:kvj.valueOffset]) < 0
 }
 
 var keyValuePool = sync.Pool{}
@@ -1535,8 +1540,8 @@ func encodeStruct(e *bytes.Buffer, em *encMode, v reflect.Value) (err error) {
 	// Head is rewritten later if actual encoded field count is different from struct field count.
 	encodedHeadLen := encodeHead(e, byte(cborTypeMap), uint64(len(flds)))
 
-	kvbegin := e.Len()
-	kvcount := 0
+	kvBeginOffset := e.Len()
+	kvCount := 0
 	for offset := 0; offset < len(flds); offset++ {
 		f := flds[(start+offset)%len(flds)]
 
@@ -1582,10 +1587,10 @@ func encodeStruct(e *bytes.Buffer, em *encMode, v reflect.Value) (err error) {
 			return err
 		}
 
-		kvcount++
+		kvCount++
 	}
 
-	if len(flds) == kvcount {
+	if len(flds) == kvCount {
 		// Encoded element count in head is the same as actual element count.
 		return nil
 	}
@@ -1593,8 +1598,8 @@ func encodeStruct(e *bytes.Buffer, em *encMode, v reflect.Value) (err error) {
 	// Overwrite the bytes that were reserved for the head before encoding the map entries.
 	var actualHeadLen int
 	{
-		headbuf := *bytes.NewBuffer(e.Bytes()[kvbegin-encodedHeadLen : kvbegin-encodedHeadLen : kvbegin])
-		actualHeadLen = encodeHead(&headbuf, byte(cborTypeMap), uint64(kvcount))
+		headbuf := *bytes.NewBuffer(e.Bytes()[kvBeginOffset-encodedHeadLen : kvBeginOffset-encodedHeadLen : kvBeginOffset])
+		actualHeadLen = encodeHead(&headbuf, byte(cborTypeMap), uint64(kvCount))
 	}
 
 	if actualHeadLen == encodedHeadLen {
@@ -1607,8 +1612,8 @@ func encodeStruct(e *bytes.Buffer, em *encMode, v reflect.Value) (err error) {
 	// encoded. The encoded entries are offset to the right by the number of excess reserved
 	// bytes. Shift the entries left to remove the gap.
 	excessReservedBytes := encodedHeadLen - actualHeadLen
-	dst := e.Bytes()[kvbegin-excessReservedBytes : e.Len()-excessReservedBytes]
-	src := e.Bytes()[kvbegin:e.Len()]
+	dst := e.Bytes()[kvBeginOffset-excessReservedBytes : e.Len()-excessReservedBytes]
+	src := e.Bytes()[kvBeginOffset:e.Len()]
 	copy(dst, src)
 
 	// After shifting, the excess bytes are at the end of the output buffer and they are
@@ -1633,7 +1638,7 @@ func encodeTime(e *bytes.Buffer, em *encMode, v reflect.Value) error {
 	}
 	if em.timeTag == EncTagRequired {
 		tagNumber := 1
-		if em.time == TimeRFC3339 || em.time == TimeRFC3339Nano {
+		if em.time == TimeRFC3339 || em.time == TimeRFC3339Nano || em.time == TimeRFC3339NanoUTC {
 			tagNumber = 0
 		}
 		encodeHead(e, byte(cborTypeTag), uint64(tagNumber))
@@ -1650,7 +1655,7 @@ func encodeTime(e *bytes.Buffer, em *encMode, v reflect.Value) error {
 
 	case TimeUnixDynamic:
 		t = t.UTC().Round(time.Microsecond)
-		secs, nsecs := t.Unix(), uint64(t.Nanosecond())
+		secs, nsecs := t.Unix(), uint64(t.Nanosecond()) //nolint:gosec
 		if nsecs == 0 {
 			return encodeInt(e, em, reflect.ValueOf(secs))
 		}
@@ -1661,6 +1666,10 @@ func encodeTime(e *bytes.Buffer, em *encMode, v reflect.Value) error {
 		s := t.Format(time.RFC3339)
 		return encodeString(e, em, reflect.ValueOf(s))
 
+	case TimeRFC3339NanoUTC:
+		s := t.UTC().Format(time.RFC3339Nano)
+		return encodeString(e, em, reflect.ValueOf(s))
+
 	default: // TimeRFC3339Nano
 		s := t.Format(time.RFC3339Nano)
 		return encodeString(e, em, reflect.ValueOf(s))
diff --git a/vendor/github.com/fxamacker/cbor/v2/simplevalue.go b/vendor/github.com/fxamacker/cbor/v2/simplevalue.go
index 30f72814f6..9912e855c2 100644
--- a/vendor/github.com/fxamacker/cbor/v2/simplevalue.go
+++ b/vendor/github.com/fxamacker/cbor/v2/simplevalue.go
@@ -93,6 +93,6 @@ func (sv *SimpleValue) unmarshalCBOR(data []byte) error {
 	// It is safe to cast val to uint8 here because
 	// - data is already verified to be well-formed CBOR simple value and
 	// - val is <= math.MaxUint8.
-	*sv = SimpleValue(val)
+	*sv = SimpleValue(val) //nolint:gosec
 	return nil
 }
diff --git a/vendor/github.com/fxamacker/cbor/v2/stream.go b/vendor/github.com/fxamacker/cbor/v2/stream.go
index 7ac6d7d671..da4c8f210f 100644
--- a/vendor/github.com/fxamacker/cbor/v2/stream.go
+++ b/vendor/github.com/fxamacker/cbor/v2/stream.go
@@ -171,14 +171,20 @@ func NewEncoder(w io.Writer) *Encoder {
 
 // Encode writes the CBOR encoding of v.
 func (enc *Encoder) Encode(v any) error {
-	if len(enc.indefTypes) > 0 && v != nil {
-		indefType := enc.indefTypes[len(enc.indefTypes)-1]
-		if indefType == cborTypeTextString {
+	if len(enc.indefTypes) > 0 {
+		switch enc.indefTypes[len(enc.indefTypes)-1] {
+		case cborTypeTextString:
+			if v == nil {
+				return errors.New("cbor: cannot encode nil for indefinite-length text string")
+			}
 			k := reflect.TypeOf(v).Kind()
 			if k != reflect.String {
 				return errors.New("cbor: cannot encode item type " + k.String() + " for indefinite-length text string")
 			}
-		} else if indefType == cborTypeByteString {
+		case cborTypeByteString:
+			if v == nil {
+				return errors.New("cbor: cannot encode nil for indefinite-length byte string")
+			}
 			t := reflect.TypeOf(v)
 			k := t.Kind()
 			if (k != reflect.Array && k != reflect.Slice) || t.Elem().Kind() != reflect.Uint8 {
@@ -198,35 +204,35 @@ func (enc *Encoder) Encode(v any) error {
 	return err
 }
 
-// StartIndefiniteByteString starts byte string encoding of indefinite length.
+// StartIndefiniteByteString starts indefinite-length byte string encoding.
 // Subsequent calls of (*Encoder).Encode() encodes definite length byte strings
 // ("chunks") as one contiguous string until EndIndefinite is called.
 func (enc *Encoder) StartIndefiniteByteString() error {
 	return enc.startIndefinite(cborTypeByteString)
 }
 
-// StartIndefiniteTextString starts text string encoding of indefinite length.
+// StartIndefiniteTextString starts indefinite-length text string encoding.
 // Subsequent calls of (*Encoder).Encode() encodes definite length text strings
 // ("chunks") as one contiguous string until EndIndefinite is called.
 func (enc *Encoder) StartIndefiniteTextString() error {
 	return enc.startIndefinite(cborTypeTextString)
 }
 
-// StartIndefiniteArray starts array encoding of indefinite length.
+// StartIndefiniteArray starts indefinite-length array encoding.
 // Subsequent calls of (*Encoder).Encode() encodes elements of the array
 // until EndIndefinite is called.
 func (enc *Encoder) StartIndefiniteArray() error {
 	return enc.startIndefinite(cborTypeArray)
 }
 
-// StartIndefiniteMap starts array encoding of indefinite length.
+// StartIndefiniteMap starts indefinite-length map encoding.
 // Subsequent calls of (*Encoder).Encode() encodes elements of the map
 // until EndIndefinite is called.
 func (enc *Encoder) StartIndefiniteMap() error {
 	return enc.startIndefinite(cborTypeMap)
 }
 
-// EndIndefinite closes last opened indefinite length value.
+// EndIndefinite closes last opened indefinite-length value.
 func (enc *Encoder) EndIndefinite() error {
 	if len(enc.indefTypes) == 0 {
 		return errors.New("cbor: cannot encode \"break\" code outside indefinite length values")
@@ -238,18 +244,22 @@ func (enc *Encoder) EndIndefinite() error {
 	return err
 }
 
-var cborIndefHeader = map[cborType][]byte{
-	cborTypeByteString: {cborByteStringWithIndefiniteLengthHead},
-	cborTypeTextString: {cborTextStringWithIndefiniteLengthHead},
-	cborTypeArray:      {cborArrayWithIndefiniteLengthHead},
-	cborTypeMap:        {cborMapWithIndefiniteLengthHead},
-}
-
 func (enc *Encoder) startIndefinite(typ cborType) error {
 	if enc.em.indefLength == IndefLengthForbidden {
 		return &IndefiniteLengthError{typ}
 	}
-	_, err := enc.w.Write(cborIndefHeader[typ])
+	var head byte
+	switch typ {
+	case cborTypeByteString:
+		head = cborByteStringWithIndefiniteLengthHead
+	case cborTypeTextString:
+		head = cborTextStringWithIndefiniteLengthHead
+	case cborTypeArray:
+		head = cborArrayWithIndefiniteLengthHead
+	case cborTypeMap:
+		head = cborMapWithIndefiniteLengthHead
+	}
+	_, err := enc.w.Write([]byte{head})
 	if err == nil {
 		enc.indefTypes = append(enc.indefTypes, typ)
 	}
@@ -262,7 +272,9 @@ type RawMessage []byte
 // MarshalCBOR returns m or CBOR nil if m is nil.
 func (m RawMessage) MarshalCBOR() ([]byte, error) {
 	if len(m) == 0 {
-		return cborNil, nil
+		b := make([]byte, len(cborNil))
+		copy(b, cborNil)
+		return b, nil
 	}
 	return m, nil
 }
diff --git a/vendor/github.com/fxamacker/cbor/v2/structfields.go b/vendor/github.com/fxamacker/cbor/v2/structfields.go
index cf0a922cd7..b2d71f2e9a 100644
--- a/vendor/github.com/fxamacker/cbor/v2/structfields.go
+++ b/vendor/github.com/fxamacker/cbor/v2/structfields.go
@@ -6,27 +6,43 @@ package cbor
 import (
 	"reflect"
 	"sort"
+	"strconv"
 	"strings"
 )
 
+// field holds shared struct field metadata returned by getFields().
 type field struct {
-	name               string
-	nameAsInt          int64 // used to decoder to match field name with CBOR int
+	name      string
+	nameAsInt int64 // used to match field name with CBOR int
+	idx       []int
+	typ       reflect.Type // used during cache building only
+	keyAsInt  bool         // used to encode/decode field name as int
+	tagged    bool         // used to choose dominant field (at the same level tagged fields dominate untagged fields)
+	omitEmpty bool         // used to skip empty field
+	omitZero  bool         // used to skip zero field
+}
+
+type fields []*field
+
+// encodingField extends field with encoding-specific data.
+type encodingField struct {
+	field
 	cborName           []byte
-	cborNameByteString []byte // major type 2 name encoding iff cborName has major type 3
-	idx                []int
-	typ                reflect.Type
+	cborNameByteString []byte // major type 2 name encoding if cborName has major type 3
 	ef                 encodeFunc
 	ief                isEmptyFunc
 	izf                isZeroFunc
-	typInfo            *typeInfo // used to decoder to reuse type info
-	tagged             bool      // used to choose dominant field (at the same level tagged fields dominate untagged fields)
-	omitEmpty          bool      // used to skip empty field
-	omitZero           bool      // used to skip zero field
-	keyAsInt           bool      // used to encode/decode field name as int
 }
 
-type fields []*field
+type encodingFields []*encodingField
+
+// decodingField extends field with decoding-specific data.
+type decodingField struct {
+	field
+	typInfo *typeInfo // used by decoder to reuse type info
+}
+
+type decodingFields []*decodingField
 
 // indexFieldSorter sorts fields by field idx at each level, breaking ties with idx depth.
 type indexFieldSorter struct {
@@ -48,7 +64,7 @@ func (x *indexFieldSorter) Less(i, j int) bool {
 			return iIdx[k] < jIdx[k]
 		}
 	}
-	return len(iIdx) <= len(jIdx)
+	return len(iIdx) < len(jIdx)
 }
 
 // nameLevelAndTagFieldSorter sorts fields by field name, idx depth, and presence of tag.
@@ -69,6 +85,10 @@ func (x *nameLevelAndTagFieldSorter) Less(i, j int) bool {
 	if fi.name != fj.name {
 		return fi.name < fj.name
 	}
+	// Fields with the same name but different keyAsInt are in separate namespaces.
+	if fi.keyAsInt != fj.keyAsInt {
+		return fi.keyAsInt
+	}
 	if len(fi.idx) != len(fj.idx) {
 		return len(fi.idx) < len(fj.idx)
 	}
@@ -117,22 +137,37 @@ func getFields(t reflect.Type) (flds fields, structOptions string) {
 		}
 	}
 
+	// Normalize keyasint field names to their canonical integer string form.
+	// This ensures that "01", "+1", and "1" are treated as the same key
+	// during deduplication.
+	for _, f := range flds {
+		if f.keyAsInt {
+			nameAsInt, err := strconv.Atoi(f.name)
+			if err != nil {
+				continue // Leave invalid names for callers to report.
+			}
+			f.nameAsInt = int64(nameAsInt)
+			f.name = strconv.Itoa(nameAsInt)
+		}
+	}
+
 	sort.Sort(&nameLevelAndTagFieldSorter{flds})
 
 	// Keep visible fields.
 	j := 0 // index of next unique field
 	for i := 0; i < len(flds); {
 		name := flds[i].name
+		keyAsInt := flds[i].keyAsInt
 		if i == len(flds)-1 || // last field
-			name != flds[i+1].name || // field i has unique field name
+			name != flds[i+1].name || flds[i+1].keyAsInt != keyAsInt || // field i has unique (name, keyAsInt)
 			len(flds[i].idx) < len(flds[i+1].idx) || // field i is at a less nested level than field i+1
 			(flds[i].tagged && !flds[i+1].tagged) { // field i is tagged while field i+1 is not
 			flds[j] = flds[i]
 			j++
 		}
 
-		// Skip fields with the same field name.
-		for i++; i < len(flds) && name == flds[i].name; i++ { //nolint:revive
+		// Skip fields with the same (name, keyAsInt).
+		for i++; i < len(flds) && name == flds[i].name && keyAsInt == flds[i].keyAsInt; i++ { //nolint:revive
 		}
 	}
 	if j != len(flds) {
diff --git a/vendor/github.com/fxamacker/cbor/v2/valid.go b/vendor/github.com/fxamacker/cbor/v2/valid.go
index b40793b95e..850b95019c 100644
--- a/vendor/github.com/fxamacker/cbor/v2/valid.go
+++ b/vendor/github.com/fxamacker/cbor/v2/valid.go
@@ -54,7 +54,7 @@ func (e *MaxMapPairsError) Error() string {
 	return "cbor: exceeded max number of key-value pairs " + strconv.Itoa(e.maxMapPairs) + " for CBOR map"
 }
 
-// IndefiniteLengthError indicates found disallowed indefinite length items.
+// IndefiniteLengthError indicates found disallowed indefinite-length items.
 type IndefiniteLengthError struct {
 	t cborType
 }
@@ -113,7 +113,7 @@ func (d *decoder) wellformedInternal(depth int, checkBuiltinTags bool) (int, err
 			}
 			return d.wellformedIndefiniteString(t, depth, checkBuiltinTags)
 		}
-		valInt := int(val)
+		valInt := int(val) //nolint:gosec
 		if valInt < 0 {
 			// Detect integer overflow
 			return 0, errors.New("cbor: " + t.String() + " length " + strconv.FormatUint(val, 10) + " is too large, causing integer overflow")
@@ -136,7 +136,7 @@ func (d *decoder) wellformedInternal(depth int, checkBuiltinTags bool) (int, err
 			return d.wellformedIndefiniteArrayOrMap(t, depth, checkBuiltinTags)
 		}
 
-		valInt := int(val)
+		valInt := int(val) //nolint:gosec
 		if valInt < 0 {
 			// Detect integer overflow
 			return 0, errors.New("cbor: " + t.String() + " length " + strconv.FormatUint(val, 10) + " is too large, it would cause integer overflow")
@@ -212,7 +212,7 @@ func (d *decoder) wellformedInternal(depth int, checkBuiltinTags bool) (int, err
 	return depth, nil
 }
 
-// wellformedIndefiniteString checks indefinite length byte/text string's well-formedness and returns max depth and error.
+// wellformedIndefiniteString checks indefinite-length byte/text string's well-formedness and returns max depth and error.
 func (d *decoder) wellformedIndefiniteString(t cborType, depth int, checkBuiltinTags bool) (int, error) {
 	var err error
 	for {
@@ -223,7 +223,7 @@ func (d *decoder) wellformedIndefiniteString(t cborType, depth int, checkBuiltin
 			d.off++
 			break
 		}
-		// Peek ahead to get next type and indefinite length status.
+		// Peek ahead to get next type and indefinite-length status.
 		nt, ai := parseInitialByte(d.data[d.off])
 		if t != nt {
 			return 0, &SyntaxError{"cbor: wrong element type " + nt.String() + " for indefinite-length " + t.String()}
@@ -238,7 +238,7 @@ func (d *decoder) wellformedIndefiniteString(t cborType, depth int, checkBuiltin
 	return depth, nil
 }
 
-// wellformedIndefiniteArrayOrMap checks indefinite length array/map's well-formedness and returns max depth and error.
+// wellformedIndefiniteArrayOrMap checks indefinite-length array/map's well-formedness and returns max depth and error.
 func (d *decoder) wellformedIndefiniteArrayOrMap(t cborType, depth int, checkBuiltinTags bool) (int, error) {
 	var err error
 	maxDepth := depth
@@ -326,7 +326,7 @@ func (d *decoder) wellformedHead() (t cborType, ai byte, val uint64, err error)
 		val = uint64(binary.BigEndian.Uint16(d.data[d.off : d.off+argumentSize]))
 		d.off += argumentSize
 		if t == cborTypePrimitives {
-			if err := d.acceptableFloat(float64(float16.Frombits(uint16(val)).Float32())); err != nil {
+			if err := d.acceptableFloat(float64(float16.Frombits(uint16(val)).Float32())); err != nil { //nolint:gosec
 				return 0, 0, 0, err
 			}
 		}
@@ -341,7 +341,7 @@ func (d *decoder) wellformedHead() (t cborType, ai byte, val uint64, err error)
 		val = uint64(binary.BigEndian.Uint32(d.data[d.off : d.off+argumentSize]))
 		d.off += argumentSize
 		if t == cborTypePrimitives {
-			if err := d.acceptableFloat(float64(math.Float32frombits(uint32(val)))); err != nil {
+			if err := d.acceptableFloat(float64(math.Float32frombits(uint32(val)))); err != nil { //nolint:gosec
 				return 0, 0, 0, err
 			}
 		}
@@ -379,12 +379,12 @@ func (d *decoder) wellformedHead() (t cborType, ai byte, val uint64, err error)
 
 func (d *decoder) acceptableFloat(f float64) error {
 	switch {
-	case d.dm.nanDec == NaNDecodeForbidden && math.IsNaN(f):
+	case d.dm.nan == NaNDecodeForbidden && math.IsNaN(f):
 		return &UnacceptableDataItemError{
 			CBORType: cborTypePrimitives.String(),
 			Message:  "floating-point NaN",
 		}
-	case d.dm.infDec == InfDecodeForbidden && math.IsInf(f, 0):
+	case d.dm.inf == InfDecodeForbidden && math.IsInf(f, 0):
 		return &UnacceptableDataItemError{
 			CBORType: cborTypePrimitives.String(),
 			Message:  "floating-point infinity",
diff --git a/vendor/github.com/go-openapi/jsonpointer/.cliff.toml b/vendor/github.com/go-openapi/jsonpointer/.cliff.toml
deleted file mode 100644
index 702629f5dc..0000000000
--- a/vendor/github.com/go-openapi/jsonpointer/.cliff.toml
+++ /dev/null
@@ -1,181 +0,0 @@
-# git-cliff ~ configuration file
-# https://git-cliff.org/docs/configuration
-
-[changelog]
-header = """
-"""
-
-footer = """
-
------
-
-**[{{ remote.github.repo }}]({{ self::remote_url() }}) license terms**
-
-[![License][license-badge]][license-url]
-
-[license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
-[license-url]: {{ self::remote_url() }}/?tab=Apache-2.0-1-ov-file#readme
-
-{%- macro remote_url() -%}
-  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
-{%- endmacro -%}
-"""
-
-body = """
-{%- if version %}
-## [{{ version | trim_start_matches(pat="v") }}]({{ self::remote_url() }}/tree/{{ version }}) - {{ timestamp | date(format="%Y-%m-%d") }}
-{%- else %}
-## [unreleased]
-{%- endif %}
-{%- if message %}
-  {%- raw %}\n{% endraw %}
-{{ message }}
-  {%- raw %}\n{% endraw %}
-{%- endif %}
-{%- if version %}
-  {%- if previous.version %}
-
-**Full Changelog**: <{{ self::remote_url() }}/compare/{{ previous.version }}...{{ version }}>
-  {%- endif %}
-{%- else %}
-  {%- raw %}\n{% endraw %}
-{%- endif %}
-
-{%- if statistics %}{% if statistics.commit_count %}
-  {%- raw %}\n{% endraw %}
-{{ statistics.commit_count }} commits in this release.
-  {%- raw %}\n{% endraw %}
-{%- endif %}{% endif %}
------
-
-{%- for group, commits in commits | group_by(attribute="group") %}
-  {%- raw %}\n{% endraw %}
-### {{ group | upper_first }}
-    {%- raw %}\n{% endraw %}
-    {%- for commit in commits %}
-      {%- if commit.remote.pr_title %}
-        {%- set commit_message = commit.remote.pr_title %}
-      {%- else %}
-        {%- set commit_message = commit.message %}
-      {%- endif %}
-* {{ commit_message | split(pat="\n") | first | trim }}
-      {%- if commit.remote.username %}
-{%- raw %} {% endraw %}by [@{{ commit.remote.username }}](https://github.com/{{ commit.remote.username }})
-      {%- endif %}
-      {%- if commit.remote.pr_number %}
-{%- raw %} {% endraw %}in [#{{ commit.remote.pr_number }}]({{ self::remote_url() }}/pull/{{ commit.remote.pr_number }})
-      {%- endif %}
-{%- raw %} {% endraw %}[...]({{ self::remote_url() }}/commit/{{ commit.id }})
-  {%- endfor %}
-{%- endfor %}
-
-{%- if github %}
-{%- raw %}\n{% endraw -%}
-  {%- set all_contributors = github.contributors | length %}
-  {%- if github.contributors | filter(attribute="username", value="dependabot[bot]") | length < all_contributors %}
------
-
-### People who contributed to this release
-  {% endif %}
-  {%- for contributor in github.contributors | filter(attribute="username") | sort(attribute="username") %}
-    {%- if contributor.username != "dependabot[bot]" and contributor.username != "github-actions[bot]" %}
-* [@{{ contributor.username }}](https://github.com/{{ contributor.username }})
-    {%- endif %}
-  {%- endfor %}
-
-  {% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}
------
-    {%- raw %}\n{% endraw %}
-
-### New Contributors
-  {%- endif %}
-
-  {%- for contributor in github.contributors | filter(attribute="is_first_time", value=true) %}
-    {%- if contributor.username != "dependabot[bot]" and contributor.username != "github-actions[bot]" %}
-* @{{ contributor.username }} made their first contribution
-      {%- if contributor.pr_number %}
-  in [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) \
-      {%- endif %}
-    {%- endif %}
-  {%- endfor %}
-{%- endif %}
-
-{%- raw %}\n{% endraw %}
-
-{%- macro remote_url() -%}
-  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
-{%- endmacro -%}
-"""
-# Remove leading and trailing whitespaces from the changelog's body.
-trim = true
-# Render body even when there are no releases to process.
-render_always = true
-# An array of regex based postprocessors to modify the changelog.
-postprocessors = [
-    # Replace the placeholder <REPO> with a URL.
-    #{ pattern = '<REPO>', replace = "https://github.com/orhun/git-cliff" },
-]
-# output file path
-# output = "test.md"
-
-[git]
-# Parse commits according to the conventional commits specification.
-# See https://www.conventionalcommits.org
-conventional_commits = false
-# Exclude commits that do not match the conventional commits specification.
-filter_unconventional = false
-# Require all commits to be conventional.
-# Takes precedence over filter_unconventional.
-require_conventional = false
-# Split commits on newlines, treating each line as an individual commit.
-split_commits = false
-# An array of regex based parsers to modify commit messages prior to further processing.
-commit_preprocessors = [
-    # Replace issue numbers with link templates to be updated in `changelog.postprocessors`.
-    #{ pattern = '\((\w+\s)?#([0-9]+)\)', replace = "([#${2}](<REPO>/issues/${2}))"},
-    # Check spelling of the commit message using https://github.com/crate-ci/typos.
-    # If the spelling is incorrect, it will be fixed automatically.
-    #{ pattern = '.*', replace_command = 'typos --write-changes -' }
-]
-# Prevent commits that are breaking from being excluded by commit parsers.
-protect_breaking_commits = false
-# An array of regex based parsers for extracting data from the commit message.
-# Assigns commits to groups.
-# Optionally sets the commit's scope and can decide to exclude commits from further processing.
-commit_parsers = [
-    { message = "^[Cc]hore\\([Rr]elease\\): prepare for", skip = true },
-    { message = "(^[Mm]erge)|([Mm]erge conflict)", skip = true },
-    { field = "author.name", pattern = "dependabot*", group = "<!-- 0A -->Updates" },
-    { message = "([Ss]ecurity)|([Vv]uln)", group = "<!-- 08 -->Security" },
-    { body = "(.*[Ss]ecurity)|([Vv]uln)", group = "<!-- 08 -->Security" },
-    { message = "([Cc]hore\\(lint\\))|(style)|(lint)|(codeql)|(golangci)", group = "<!-- 05 -->Code quality" },
-    { message = "(^[Dd]oc)|((?i)readme)|(badge)|(typo)|(documentation)", group = "<!-- 03 -->Documentation" },
-    { message = "(^[Ff]eat)|(^[Ee]nhancement)", group = "<!-- 00 -->Implemented enhancements" },
-    { message = "(^ci)|(\\(ci\\))|(fixup\\s+ci)|(fix\\s+ci)|(license)|(example)", group = "<!-- 07 -->Miscellaneous tasks" },
-    { message = "^test", group = "<!-- 06 -->Testing" },
-    { message = "(^fix)|(panic)", group = "<!-- 01 -->Fixed bugs" },
-    { message = "(^refact)|(rework)", group = "<!-- 02 -->Refactor" },
-    { message = "(^[Pp]erf)|(performance)", group = "<!-- 04 -->Performance" },
-    { message = "(^[Cc]hore)", group = "<!-- 07 -->Miscellaneous tasks" },
-    { message = "^[Rr]evert", group = "<!-- 09 -->Reverted changes" },
-    { message = "(upgrade.*?go)|(go\\s+version)", group = "<!-- 0A -->Updates" },
-    { message = ".*", group = "<!-- 0B -->Other" },
-]
-# Exclude commits that are not matched by any commit parser.
-filter_commits = false
-# An array of link parsers for extracting external references, and turning them into URLs, using regex.
-link_parsers = []
-# Include only the tags that belong to the current branch.
-use_branch_tags = false
-# Order releases topologically instead of chronologically.
-topo_order = false
-# Order releases topologically instead of chronologically.
-topo_order_commits = true
-# Order of commits in each group/release within the changelog.
-# Allowed values: newest, oldest
-sort_commits = "newest"
-# Process submodules commits
-recurse_submodules = false
-
-#[remote.github]
-#owner = "go-openapi"
diff --git a/vendor/github.com/go-openapi/jsonpointer/.gitignore b/vendor/github.com/go-openapi/jsonpointer/.gitignore
index 59cd294891..d8f4186fe5 100644
--- a/vendor/github.com/go-openapi/jsonpointer/.gitignore
+++ b/vendor/github.com/go-openapi/jsonpointer/.gitignore
@@ -2,3 +2,4 @@
 *.cov
 .idea
 .env
+.mcp.json
diff --git a/vendor/github.com/go-openapi/jsonpointer/.golangci.yml b/vendor/github.com/go-openapi/jsonpointer/.golangci.yml
index fdae591bce..9d2733176e 100644
--- a/vendor/github.com/go-openapi/jsonpointer/.golangci.yml
+++ b/vendor/github.com/go-openapi/jsonpointer/.golangci.yml
@@ -4,7 +4,10 @@ linters:
   disable:
     - depguard
     - funlen
+    - goconst
     - godox
+    - gomodguard
+    - gomodguard_v2
     - exhaustruct
     - nlreturn
     - nonamedreturns
@@ -12,6 +15,7 @@ linters:
     - paralleltest
     - recvcheck
     - testpackage
+    - thelper
     - tparallel
     - varnamelen
     - whitespace
diff --git a/vendor/github.com/go-openapi/jsonpointer/CODE_OF_CONDUCT.md b/vendor/github.com/go-openapi/jsonpointer/CODE_OF_CONDUCT.md
index 9322b065e3..bac878f216 100644
--- a/vendor/github.com/go-openapi/jsonpointer/CODE_OF_CONDUCT.md
+++ b/vendor/github.com/go-openapi/jsonpointer/CODE_OF_CONDUCT.md
@@ -23,7 +23,9 @@ include:
 Examples of unacceptable behavior by participants include:
 
 * The use of sexualized language or imagery and unwelcome sexual attention or
+
 advances
+
 * Trolling, insulting/derogatory comments, and personal or political attacks
 * Public or private harassment
 * Publishing others' private information, such as a physical or electronic
@@ -55,7 +57,7 @@ further defined and clarified by project maintainers.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at ivan+abuse@flanders.co.nz. All
+reported by contacting the project team at <ivan+abuse@flanders.co.nz>. All
 complaints will be reviewed and investigated and will result in a response that
 is deemed necessary and appropriate to the circumstances. The project team is
 obligated to maintain confidentiality with regard to the reporter of an incident.
@@ -68,7 +70,7 @@ members of the project's leadership.
 ## Attribution
 
 This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
-available at [http://contributor-covenant.org/version/1/4][version]
+available at [<http://contributor-covenant.org/version/1/4>][version]
 
 [homepage]: http://contributor-covenant.org
 [version]: http://contributor-covenant.org/version/1/4/
diff --git a/vendor/github.com/go-openapi/jsonpointer/CONTRIBUTORS.md b/vendor/github.com/go-openapi/jsonpointer/CONTRIBUTORS.md
index 03c098316d..de0bf5c04b 100644
--- a/vendor/github.com/go-openapi/jsonpointer/CONTRIBUTORS.md
+++ b/vendor/github.com/go-openapi/jsonpointer/CONTRIBUTORS.md
@@ -4,21 +4,22 @@
 
 | Total Contributors | Total Contributions |
 | --- | --- |
-| 12  | 95  |
+| 13  | 132  |
 
 | Username | All Time Contribution Count | All Commits |
 | --- | --- | --- |
-| @fredbi | 48 | https://github.com/go-openapi/jsonpointer/commits?author=fredbi |
-| @casualjim | 33 | https://github.com/go-openapi/jsonpointer/commits?author=casualjim |
-| @magodo | 3 | https://github.com/go-openapi/jsonpointer/commits?author=magodo |
-| @youyuanwu | 3 | https://github.com/go-openapi/jsonpointer/commits?author=youyuanwu |
-| @gaiaz-iusipov | 1 | https://github.com/go-openapi/jsonpointer/commits?author=gaiaz-iusipov |
-| @gbjk | 1 | https://github.com/go-openapi/jsonpointer/commits?author=gbjk |
-| @gordallott | 1 | https://github.com/go-openapi/jsonpointer/commits?author=gordallott |
-| @ianlancetaylor | 1 | https://github.com/go-openapi/jsonpointer/commits?author=ianlancetaylor |
-| @mfleader | 1 | https://github.com/go-openapi/jsonpointer/commits?author=mfleader |
-| @Neo2308 | 1 | https://github.com/go-openapi/jsonpointer/commits?author=Neo2308 |
-| @olivierlemasle | 1 | https://github.com/go-openapi/jsonpointer/commits?author=olivierlemasle |
-| @testwill | 1 | https://github.com/go-openapi/jsonpointer/commits?author=testwill |
+| @fredbi | 83 | <https://github.com/go-openapi/jsonpointer/commits?author=fredbi> |
+| @casualjim | 33 | <https://github.com/go-openapi/jsonpointer/commits?author=casualjim> |
+| @magodo | 3 | <https://github.com/go-openapi/jsonpointer/commits?author=magodo> |
+| @youyuanwu | 3 | <https://github.com/go-openapi/jsonpointer/commits?author=youyuanwu> |
+| @alexandear | 2 | <https://github.com/go-openapi/jsonpointer/commits?author=alexandear> |
+| @gaiaz-iusipov | 1 | <https://github.com/go-openapi/jsonpointer/commits?author=gaiaz-iusipov> |
+| @gbjk | 1 | <https://github.com/go-openapi/jsonpointer/commits?author=gbjk> |
+| @gordallott | 1 | <https://github.com/go-openapi/jsonpointer/commits?author=gordallott> |
+| @ianlancetaylor | 1 | <https://github.com/go-openapi/jsonpointer/commits?author=ianlancetaylor> |
+| @mfleader | 1 | <https://github.com/go-openapi/jsonpointer/commits?author=mfleader> |
+| @Neo2308 | 1 | <https://github.com/go-openapi/jsonpointer/commits?author=Neo2308> |
+| @olivierlemasle | 1 | <https://github.com/go-openapi/jsonpointer/commits?author=olivierlemasle> |
+| @testwill | 1 | <https://github.com/go-openapi/jsonpointer/commits?author=testwill> |
 
- _this file was generated by the [Contributors GitHub Action](https://github.com/github/contributors)_
+ _this file was generated by the [Contributors GitHub Action](https://github.com/github-community-projects/contributors)_
diff --git a/vendor/github.com/go-openapi/jsonpointer/NOTICE b/vendor/github.com/go-openapi/jsonpointer/NOTICE
index f3b51939a9..201908d2f0 100644
--- a/vendor/github.com/go-openapi/jsonpointer/NOTICE
+++ b/vendor/github.com/go-openapi/jsonpointer/NOTICE
@@ -18,7 +18,7 @@ It ships with copies of other software which license terms are recalled below.
 
 The original software was authored on 25-02-2013 by sigu-399 (https://github.com/sigu-399, sigu.399@gmail.com).
 
-github.com/sigh-399/jsonpointer
+github.com/sigu-399/jsonpointer
 ===========================
 
 // SPDX-FileCopyrightText: Copyright 2013 sigu-399 ( https://github.com/sigu-399 )
diff --git a/vendor/github.com/go-openapi/jsonpointer/README.md b/vendor/github.com/go-openapi/jsonpointer/README.md
index b61b63fd9a..6e7929c64b 100644
--- a/vendor/github.com/go-openapi/jsonpointer/README.md
+++ b/vendor/github.com/go-openapi/jsonpointer/README.md
@@ -8,15 +8,42 @@
 [![Release][release-badge]][release-url] [![Go Report Card][gocard-badge]][gocard-url] [![CodeFactor Grade][codefactor-badge]][codefactor-url] [![License][license-badge]][license-url]
 <!-- Badges: documentation & support -->
 <!-- Badges: others & stats -->
-[![GoDoc][godoc-badge]][godoc-url] [![Slack Channel][slack-logo]![slack-badge]][slack-url] [![go version][goversion-badge]][goversion-url] ![Top language][top-badge] ![Commits since latest release][commits-badge]
+[![GoDoc][godoc-badge]][godoc-url] [![Discord Channel][discord-badge]][discord-url] [![go version][goversion-badge]][goversion-url] ![Top language][top-badge] ![Commits since latest release][commits-badge]
 
 ---
 
 An implementation of JSON Pointer for golang, which supports go `struct`.
 
+## Announcements
+
+* **2026-07-07** : landing v1.0.0
+  * stable API pledge
+
+* **2026-06-29** : reinsourced external dependency to swag (v0.24.0)
+  * module `github.com/go-openapi/swag/jsonname` is source directly here, so we no longer have any external dependency
+  * `jsonname` was never really used by any other package, so it makes sense to deprecate it away from the `swag` family
+    and retrofit its functionality here. `jsonpointer` no longer get external dependencies, besides test dependencies.
+
+* **2026-04-15** : added support for trailing "-" for arrays (v0.23.0)
+  * this brings full support of [RFC6901][RFC6901]
+  * this is supported for types relying on the reflection-based implemented
+  * API semantics remain essentially unaltered. Exception: `Pointer.Set(document any,value any) (document any, err error)` 
+    can only perform a best-effort to mutate the input document in place. In the case of adding elements to an array with a
+    trailing "-", either pass a mutable array (`*[]T`) as the input document, or use the returned updated document instead.
+  * types that implement the `JSONSetable` interface may not implement the mutation implied by the trailing "-"
+
+* **2026-04-15** : added support for optional alternate JSON name providers
+  * for struct support the defaults might not suit all situations: there are known limitations
+    when it comes to handle untagged fields or embedded types.
+  * the default name provider in use is not fully aligned with go JSON stdlib
+  * exposed an option (or global setting) to change the provider that resolves a struct into json keys
+  * the default behavior is not altered
+
 ## Status
 
-API is stable.
+API is stable and feature-complete.
+
+The project continues to receive regular updates, bug fixes and hygiene maintenance (CI, linting, etc).
 
 ## Import this library in your project
 
@@ -78,7 +105,7 @@ See <https://github.com/go-openapi/jsonpointer/releases>
 
 <https://tools.ietf.org/html/draft-ietf-appsawg-json-pointer-07>
 
-also known as [RFC6901](https://www.rfc-editor.org/rfc/rfc6901)
+also known as [RFC6901][RFC6901].
 
 ## Licensing
 
@@ -89,19 +116,19 @@ on top of which it has been built.
 
 ## Limitations
 
-The 4.Evaluation part of the previous reference, starting with 'If the currently referenced value is a JSON array,
-the reference token MUST contain either...' is not implemented.
-
-That is because our implementation of the JSON pointer only supports explicit references to array elements:
-the provision in the spec to resolve non-existent members as "the last element in the array",
-using the special trailing character "-" is not implemented.
+* [RFC6901][RFC6901] is now fully supported, including trailing "-" semantics for arrays (for `Set` operations).
+* Default behavior: JSON name detection in go `struct`s
+   - Unlike go standard marshaling, untagged fields do not default to the go field name and are ignored.
+   - anonymous fields are not traversed if untagged
+   - the above limitations may be overcome by calling `UseGoNameProvider()` at initialization time.
+   - alternatively, users may inject the desired custom behavior for naming fields as an option.
 
 ## Other documentation
 
 * [All-time contributors](./CONTRIBUTORS.md)
-* [Contributing guidelines](.github/CONTRIBUTING.md)
-* [Maintainers documentation](docs/MAINTAINERS.md)
-* [Code style](docs/STYLE.md)
+* [Contributing guidelines][contributing-doc-site]
+* [Maintainers documentation][maintainers-doc-site]
+* [Code style][style-doc-site]
 
 ## Cutting a new release
 
@@ -124,21 +151,17 @@ Maintainers can cut a new release by either:
 <!-- Badges: release & docker images  -->
 [release-badge]: https://badge.fury.io/gh/go-openapi%2Fjsonpointer.svg
 [release-url]: https://badge.fury.io/gh/go-openapi%2Fjsonpointer
-[gomod-badge]: https://badge.fury.io/go/github.com%2Fgo-openapi%2Fjsonpointer.svg
-[gomod-url]: https://badge.fury.io/go/github.com%2Fgo-openapi%2Fjsonpointer
 <!-- Badges: code quality  -->
 [gocard-badge]: https://goreportcard.com/badge/github.com/go-openapi/jsonpointer
 [gocard-url]: https://goreportcard.com/report/github.com/go-openapi/jsonpointer
 [codefactor-badge]: https://img.shields.io/codefactor/grade/github/go-openapi/jsonpointer
 [codefactor-url]: https://www.codefactor.io/repository/github/go-openapi/jsonpointer
 <!-- Badges: documentation & support -->
-[doc-badge]: https://img.shields.io/badge/doc-site-blue?link=https%3A%2F%2Fgoswagger.io%2Fgo-openapi%2F
-[doc-url]: https://goswagger.io/go-openapi
 [godoc-badge]: https://pkg.go.dev/badge/github.com/go-openapi/jsonpointer
 [godoc-url]: http://pkg.go.dev/github.com/go-openapi/jsonpointer
-[slack-logo]: https://a.slack-edge.com/e6a93c1/img/icons/favicon-32.png
-[slack-badge]: https://img.shields.io/badge/slack-blue?link=https%3A%2F%2Fgoswagger.slack.com%2Farchives%2FC04R30YM
-[slack-url]: https://goswagger.slack.com/archives/C04R30YMU
+[discord-badge]: https://img.shields.io/discord/1446918742398341256?logo=discord&label=discord&color=blue
+[discord-url]: https://discord.gg/FfnFYaC3k5
+
 <!-- Badges: license & compliance -->
 [license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
 [license-url]: https://github.com/go-openapi/jsonpointer/?tab=Apache-2.0-1-ov-file#readme
@@ -147,3 +170,8 @@ Maintainers can cut a new release by either:
 [goversion-url]: https://github.com/go-openapi/jsonpointer/blob/master/go.mod
 [top-badge]: https://img.shields.io/github/languages/top/go-openapi/jsonpointer
 [commits-badge]: https://img.shields.io/github/commits-since/go-openapi/jsonpointer/latest
+[RFC6901]: https://www.rfc-editor.org/rfc/rfc6901
+<!-- Organization docs -->
+[contributing-doc-site]: https://go-openapi.github.io/doc-site/contributing/contributing/index.html
+[maintainers-doc-site]: https://go-openapi.github.io/doc-site/maintainers/index.html
+[style-doc-site]: https://go-openapi.github.io/doc-site/contributing/style/index.html
diff --git a/vendor/github.com/go-openapi/jsonpointer/SECURITY.md b/vendor/github.com/go-openapi/jsonpointer/SECURITY.md
index 2a7b6f0910..1fea2c5736 100644
--- a/vendor/github.com/go-openapi/jsonpointer/SECURITY.md
+++ b/vendor/github.com/go-openapi/jsonpointer/SECURITY.md
@@ -6,14 +6,32 @@ This policy outlines the commitment and practices of the go-openapi maintainers
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 0.22.x  | :white_check_mark: |
+| O.x     | :white_check_mark: |
+
+## Vulnerability checks in place
+
+This repository uses automated vulnerability scans, at every merged commit and at least once a week.
+
+We use:
+
+* [`GitHub CodeQL`][codeql-url]
+* [`trivy`][trivy-url]
+* [`govulncheck`][govulncheck-url]
+
+Reports are centralized in github security reports and visible only to the maintainers.
 
 ## Reporting a vulnerability
 
 If you become aware of a security vulnerability that affects the current repository,
-please report it privately to the maintainers.
+**please report it privately to the maintainers**
+rather than opening a publicly visible GitHub issue.
+
+Please follow the instructions provided by github to [Privately report a security vulnerability][github-guidance-url].
 
-Please follow the instructions provided by github to
-[Privately report a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability).
+> [!NOTE]
+> On Github, navigate to the project's "Security" tab then click on "Report a vulnerability".
 
-TL;DR: on Github, navigate to the project's "Security" tab then click on "Report a vulnerability".
+[codeql-url]: https://github.com/github/codeql
+[trivy-url]: https://trivy.dev/docs/latest/getting-started
+[govulncheck-url]: https://go.dev/blog/govulncheck
+[github-guidance-url]: https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability
diff --git a/vendor/github.com/go-openapi/jsonpointer/errors.go b/vendor/github.com/go-openapi/jsonpointer/errors.go
index 8c50dde8bc..2ae6e3cfb3 100644
--- a/vendor/github.com/go-openapi/jsonpointer/errors.go
+++ b/vendor/github.com/go-openapi/jsonpointer/errors.go
@@ -16,12 +16,25 @@ const (
 	ErrPointer pointerError = "JSON pointer error"
 
 	// ErrInvalidStart states that a JSON pointer must start with a separator ("/").
-	ErrInvalidStart pointerError = `JSON pointer must be empty or start with a "` + pointerSeparator
+	ErrInvalidStart pointerError = `JSON pointer must be empty or start with a "` + pointerSeparator + `"`
 
 	// ErrUnsupportedValueType indicates that a value of the wrong type is being set.
 	ErrUnsupportedValueType pointerError = "only structs, pointers, maps and slices are supported for setting values"
+
+	// ErrDashToken indicates use of the RFC 6901 "-" reference token in a context where it cannot be
+	// resolved.
+	//
+	// Per RFC 6901 §4 the "-" token refers to the (nonexistent) element after the last array element.
+	// It may only be used as the terminal token of a [Pointer.Set] against a slice, where it means
+	// "append".
+	//
+	// Any other use (get, offset, intermediate traversal, non-slice target) is an error condition that
+	// wraps this sentinel.
+	ErrDashToken pointerError = `the "-" array token cannot be resolved here` //nolint:gosec // G101 false positive: this is a JSON Pointer reference token, not a credential.
 )
 
+const dashToken = "-"
+
 func errNoKey(key string) error {
 	return fmt.Errorf("object has no key %q: %w", key, ErrPointer)
 }
@@ -33,3 +46,15 @@ func errOutOfBounds(length, idx int) error {
 func errInvalidReference(token string) error {
 	return fmt.Errorf("invalid token reference %q: %w", token, ErrPointer)
 }
+
+func errDashOnGet() error {
+	return fmt.Errorf("cannot resolve %q token on get: %w: %w", dashToken, ErrDashToken, ErrPointer)
+}
+
+func errDashIntermediate() error {
+	return fmt.Errorf("the %q token may only appear as the terminal token of a pointer: %w: %w", dashToken, ErrDashToken, ErrPointer)
+}
+
+func errDashOnOffset() error {
+	return fmt.Errorf("cannot compute offset for %q token (nonexistent element): %w: %w", dashToken, ErrDashToken, ErrPointer)
+}
diff --git a/vendor/github.com/go-openapi/jsonpointer/ifaces.go b/vendor/github.com/go-openapi/jsonpointer/ifaces.go
new file mode 100644
index 0000000000..31359c48fa
--- /dev/null
+++ b/vendor/github.com/go-openapi/jsonpointer/ifaces.go
@@ -0,0 +1,50 @@
+// SPDX-FileCopyrightText: Copyright (c) 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package jsonpointer
+
+import "reflect"
+
+// JSONPointable is an interface for structs to implement, when they need to customize the json
+// pointer process or want to avoid the use of reflection.
+type JSONPointable interface {
+	// JSONLookup returns a value pointed at this (unescaped) key.
+	JSONLookup(key string) (any, error)
+}
+
+// JSONSetable is an interface for structs to implement, when they need to customize the json
+// pointer process or want to avoid the use of reflection.
+//
+// # Handling of the RFC 6901 "-" token
+//
+// When a type implementing JSONSetable is the terminal parent of a [Pointer.Set] call, the library
+// passes the raw reference token to JSONSet without interpretation.
+//
+// In particular, the RFC 6901 "-" token (which conventionally means "append" for arrays, per RFC
+// 6902) is forwarded verbatim as the key argument.
+//
+// Implementations that model an array-like container are expected to give "-" the append semantics;
+// implementations that do not should return an error wrapping [ErrDashToken] (or [ErrPointer]) for
+// clarity.
+//
+// Implementations are responsible for any in-place mutation: the library does not attempt to rebind
+// the result of JSONSet into a parent container.
+type JSONSetable interface {
+	// JSONSet sets the value pointed at the (unescaped) key.
+	//
+	// The key may be the RFC 6901 "-" token when the pointer targets a slice-like member; see the
+	// interface documentation for details.
+	JSONSet(key string, value any) error
+}
+
+// NameProvider knows how to resolve go struct fields into json names.
+//
+// The default provider is brought by
+// [github.com/go-openapi/jsonpointer/jsonname.DefaultJSONNameProvider].
+type NameProvider interface {
+	// GetGoName gets the go name for a json property name
+	GetGoName(subject any, name string) (string, bool)
+
+	// GetGoNameForType gets the go name for a given type for a json property name
+	GetGoNameForType(tpe reflect.Type, name string) (string, bool)
+}
diff --git a/vendor/github.com/go-openapi/swag/jsonname/doc.go b/vendor/github.com/go-openapi/jsonpointer/jsonname/doc.go
similarity index 100%
rename from vendor/github.com/go-openapi/swag/jsonname/doc.go
rename to vendor/github.com/go-openapi/jsonpointer/jsonname/doc.go
diff --git a/vendor/github.com/go-openapi/jsonpointer/jsonname/go_name_provider.go b/vendor/github.com/go-openapi/jsonpointer/jsonname/go_name_provider.go
new file mode 100644
index 0000000000..5eec18fbfd
--- /dev/null
+++ b/vendor/github.com/go-openapi/jsonpointer/jsonname/go_name_provider.go
@@ -0,0 +1,288 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package jsonname
+
+import (
+	"reflect"
+	"strings"
+	"sync"
+)
+
+var _ providerIface = (*GoNameProvider)(nil)
+
+// GoNameProvider resolves json property names to go struct field names following the same rules as
+// the standard library's [encoding/json] package.
+//
+// Contrary to [NameProvider], it considers exported fields without a json tag, and promotes fields
+// from anonymous embedded struct types.
+//
+// Rules (aligned with encoding/json):
+//
+//   - unexported fields are ignored;
+//   - a field tagged `json:"-"` is ignored;
+//   - a field tagged `json:"-,"` is kept under the json name "-" (stdlib quirk);
+//   - a field tagged `json:""` or with no json tag at all keeps its Go name as json name;
+//   - anonymous struct fields without an explicit json tag have their fields
+//     promoted into the parent, following breadth-first depth rules:
+//     a shallower field wins over a deeper one; at equal depth, a conflict
+//     discards all conflicting fields unless exactly one has an explicit json tag.
+//
+// This type is safe for concurrent use.
+type GoNameProvider struct {
+	lock  sync.Mutex
+	index map[reflect.Type]nameIndex
+}
+
+// NewGoNameProvider creates a new [GoNameProvider].
+func NewGoNameProvider() *GoNameProvider {
+	return &GoNameProvider{
+		index: make(map[reflect.Type]nameIndex),
+	}
+}
+
+// GetJSONNames gets all the json property names for a type.
+func (n *GoNameProvider) GetJSONNames(subject any) []string {
+	n.lock.Lock()
+	defer n.lock.Unlock()
+
+	tpe := reflect.Indirect(reflect.ValueOf(subject)).Type()
+	names := n.nameIndexFor(tpe)
+
+	res := make([]string, 0, len(names.jsonNames))
+	for k := range names.jsonNames {
+		res = append(res, k)
+	}
+
+	return res
+}
+
+// GetJSONName gets the json name for a go property name.
+func (n *GoNameProvider) GetJSONName(subject any, name string) (string, bool) {
+	tpe := reflect.Indirect(reflect.ValueOf(subject)).Type()
+
+	return n.GetJSONNameForType(tpe, name)
+}
+
+// GetJSONNameForType gets the json name for a go property name on a given type.
+func (n *GoNameProvider) GetJSONNameForType(tpe reflect.Type, name string) (string, bool) {
+	n.lock.Lock()
+	defer n.lock.Unlock()
+
+	names := n.nameIndexFor(tpe)
+	nme, ok := names.goNames[name]
+
+	return nme, ok
+}
+
+// GetGoName gets the go name for a json property name.
+func (n *GoNameProvider) GetGoName(subject any, name string) (string, bool) {
+	tpe := reflect.Indirect(reflect.ValueOf(subject)).Type()
+
+	return n.GetGoNameForType(tpe, name)
+}
+
+// GetGoNameForType gets the go name for a given type for a json property name.
+func (n *GoNameProvider) GetGoNameForType(tpe reflect.Type, name string) (string, bool) {
+	n.lock.Lock()
+	defer n.lock.Unlock()
+
+	names := n.nameIndexFor(tpe)
+	nme, ok := names.jsonNames[name]
+
+	return nme, ok
+}
+
+func (n *GoNameProvider) nameIndexFor(tpe reflect.Type) nameIndex {
+	if names, ok := n.index[tpe]; ok {
+		return names
+	}
+
+	names := buildGoNameIndex(tpe)
+	n.index[tpe] = names
+
+	return names
+}
+
+// fieldEntry captures a candidate field discovered while walking a struct along with the
+// indirection path from the root type (used to resolve conflicts by depth in the same way
+// encoding/json does).
+type fieldEntry struct {
+	goName   string
+	jsonName string
+	index    []int
+	tagged   bool
+}
+
+func buildGoNameIndex(tpe reflect.Type) nameIndex {
+	fields := collectGoFields(tpe)
+
+	idx := make(map[string]string, len(fields))
+	reverseIdx := make(map[string]string, len(fields))
+	for _, f := range fields {
+		idx[f.jsonName] = f.goName
+		reverseIdx[f.goName] = f.jsonName
+	}
+
+	return nameIndex{jsonNames: idx, goNames: reverseIdx}
+}
+
+// collectGoFields walks tpe breadth-first along anonymous struct fields,
+// reproducing the field selection performed by encoding/json.typeFields.
+//
+//nolint:gocognit // everything is inlined to help the compiler determine what escapes and what doesn't
+func collectGoFields(tpe reflect.Type) []fieldEntry {
+	if tpe.Kind() != reflect.Struct {
+		return nil
+	}
+
+	type queued struct {
+		typ   reflect.Type
+		index []int
+	}
+
+	current := []queued{}
+	next := []queued{{typ: tpe}}
+	visited := map[reflect.Type]bool{tpe: true}
+
+	var (
+		candidates []fieldEntry
+		count      = map[string]int{}
+		nextCount  = map[string]int{}
+	)
+
+	for len(next) > 0 {
+		current, next = next, current[:0]
+		count, nextCount = nextCount, count
+		for k := range nextCount {
+			delete(nextCount, k)
+		}
+
+		for _, q := range current {
+			for i := range q.typ.NumField() {
+				sf := q.typ.Field(i)
+
+				if sf.Anonymous {
+					ft := sf.Type
+					if ft.Kind() == reflect.Pointer {
+						ft = ft.Elem()
+					}
+					if !sf.IsExported() && ft.Kind() != reflect.Struct {
+						continue
+					}
+				} else if !sf.IsExported() {
+					continue
+				}
+
+				tag := sf.Tag.Get("json")
+				if tag == "-" {
+					continue
+				}
+				jsonName, _ := parseJSONTag(tag)
+				tagged := jsonName != ""
+
+				ft := sf.Type
+				if ft.Kind() == reflect.Pointer {
+					ft = ft.Elem()
+				}
+
+				if sf.Anonymous && ft.Kind() == reflect.Struct && !tagged {
+					if visited[ft] {
+						continue
+					}
+					visited[ft] = true
+
+					index := make([]int, len(q.index)+1)
+					copy(index, q.index)
+					index[len(q.index)] = i
+					next = append(next, queued{typ: ft, index: index})
+
+					continue
+				}
+
+				name := jsonName
+				if name == "" {
+					name = sf.Name
+				}
+
+				index := make([]int, len(q.index)+1)
+				copy(index, q.index)
+				index[len(q.index)] = i
+
+				candidates = append(candidates, fieldEntry{
+					goName:   sf.Name,
+					jsonName: name,
+					index:    index,
+					tagged:   tagged,
+				})
+				nextCount[name]++
+			}
+		}
+	}
+
+	return dominantFields(candidates)
+}
+
+// dominantFields applies the Go encoding/json conflict resolution rules: at each JSON name, the
+// shallowest field wins; at equal depth, a uniquely tagged candidate wins; otherwise all candidates
+// for that name are dropped.
+func dominantFields(candidates []fieldEntry) []fieldEntry {
+	byName := make(map[string][]fieldEntry, len(candidates))
+	for _, c := range candidates {
+		byName[c.jsonName] = append(byName[c.jsonName], c)
+	}
+
+	out := make([]fieldEntry, 0, len(byName))
+	for _, group := range byName {
+		if len(group) == 1 {
+			out = append(out, group[0])
+
+			continue
+		}
+
+		minDepth := len(group[0].index)
+		for _, c := range group[1:] {
+			if len(c.index) < minDepth {
+				minDepth = len(c.index)
+			}
+		}
+
+		var shallow []fieldEntry
+		for _, c := range group {
+			if len(c.index) == minDepth {
+				shallow = append(shallow, c)
+			}
+		}
+
+		if len(shallow) == 1 {
+			out = append(out, shallow[0])
+
+			continue
+		}
+
+		var tagged []fieldEntry
+		for _, c := range shallow {
+			if c.tagged {
+				tagged = append(tagged, c)
+			}
+		}
+		if len(tagged) == 1 {
+			out = append(out, tagged[0])
+		}
+	}
+
+	return out
+}
+
+// parseJSONTag returns the name component of a json struct tag and whether it carried any non-name
+// option (kept for future-proofing, e.g. "omitempty").
+func parseJSONTag(tag string) (string, string) {
+	if tag == "" {
+		return "", ""
+	}
+	if before, after, ok := strings.Cut(tag, ","); ok {
+		return before, after
+	}
+
+	return tag, ""
+}
diff --git a/vendor/github.com/go-openapi/jsonpointer/jsonname/ifaces.go b/vendor/github.com/go-openapi/jsonpointer/jsonname/ifaces.go
new file mode 100644
index 0000000000..64871f0d27
--- /dev/null
+++ b/vendor/github.com/go-openapi/jsonpointer/jsonname/ifaces.go
@@ -0,0 +1,16 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package jsonname
+
+import "reflect"
+
+// providerIface is an unexported compile-time contract that every name provider in this package is
+// expected to satisfy.
+//
+// It mirrors the interface declared by the main consumer of this module:
+// [github.com/go-openapi/jsonpointer.NameProvider].
+type providerIface interface {
+	GetGoName(subject any, name string) (string, bool)
+	GetGoNameForType(tpe reflect.Type, name string) (string, bool)
+}
diff --git a/vendor/github.com/go-openapi/swag/jsonname/name_provider.go b/vendor/github.com/go-openapi/jsonpointer/jsonname/name_provider.go
similarity index 82%
rename from vendor/github.com/go-openapi/swag/jsonname/name_provider.go
rename to vendor/github.com/go-openapi/jsonpointer/jsonname/name_provider.go
index 8eaf1bece8..1bec2406b5 100644
--- a/vendor/github.com/go-openapi/swag/jsonname/name_provider.go
+++ b/vendor/github.com/go-openapi/jsonpointer/jsonname/name_provider.go
@@ -10,10 +10,12 @@ import (
 )
 
 // DefaultJSONNameProvider is the default cache for types.
-var DefaultJSONNameProvider = NewNameProvider()
+var DefaultJSONNameProvider = NewNameProvider() //nolint:gochecknoglobals // default settings, for backward compatible package-level settings
 
-// NameProvider represents an object capable of translating from go property names
-// to json property names.
+var _ providerIface = (*NameProvider)(nil)
+
+// NameProvider represents an object capable of translating from go property names to json property
+// names.
 //
 // This type is thread-safe.
 //
@@ -28,7 +30,7 @@ type nameIndex struct {
 	goNames   map[string]string
 }
 
-// NewNameProvider creates a new name provider
+// NewNameProvider creates a new name provider.
 func NewNameProvider() *NameProvider {
 	return &NameProvider{
 		lock:  &sync.Mutex{},
@@ -37,7 +39,7 @@ func NewNameProvider() *NameProvider {
 }
 
 func buildnameIndex(tpe reflect.Type, idx, reverseIdx map[string]string) {
-	for i := 0; i < tpe.NumField(); i++ {
+	for i := range tpe.NumField() {
 		targetDes := tpe.Field(i)
 
 		if targetDes.PkgPath != "" { // unexported
@@ -71,14 +73,14 @@ func buildnameIndex(tpe reflect.Type, idx, reverseIdx map[string]string) {
 }
 
 func newNameIndex(tpe reflect.Type) nameIndex {
-	var idx = make(map[string]string, tpe.NumField())
-	var reverseIdx = make(map[string]string, tpe.NumField())
+	idx := make(map[string]string, tpe.NumField())
+	reverseIdx := make(map[string]string, tpe.NumField())
 
 	buildnameIndex(tpe, idx, reverseIdx)
 	return nameIndex{jsonNames: idx, goNames: reverseIdx}
 }
 
-// GetJSONNames gets all the json property names for a type
+// GetJSONNames gets all the json property names for a type.
 func (n *NameProvider) GetJSONNames(subject any) []string {
 	n.lock.Lock()
 	defer n.lock.Unlock()
@@ -95,13 +97,13 @@ func (n *NameProvider) GetJSONNames(subject any) []string {
 	return res
 }
 
-// GetJSONName gets the json name for a go property name
+// GetJSONName gets the json name for a go property name.
 func (n *NameProvider) GetJSONName(subject any, name string) (string, bool) {
 	tpe := reflect.Indirect(reflect.ValueOf(subject)).Type()
 	return n.GetJSONNameForType(tpe, name)
 }
 
-// GetJSONNameForType gets the json name for a go property name on a given type
+// GetJSONNameForType gets the json name for a go property name on a given type.
 func (n *NameProvider) GetJSONNameForType(tpe reflect.Type, name string) (string, bool) {
 	n.lock.Lock()
 	defer n.lock.Unlock()
@@ -113,13 +115,13 @@ func (n *NameProvider) GetJSONNameForType(tpe reflect.Type, name string) (string
 	return nme, ok
 }
 
-// GetGoName gets the go name for a json property name
+// GetGoName gets the go name for a json property name.
 func (n *NameProvider) GetGoName(subject any, name string) (string, bool) {
 	tpe := reflect.Indirect(reflect.ValueOf(subject)).Type()
 	return n.GetGoNameForType(tpe, name)
 }
 
-// GetGoNameForType gets the go name for a given type for a json property name
+// GetGoNameForType gets the go name for a given type for a json property name.
 func (n *NameProvider) GetGoNameForType(tpe reflect.Type, name string) (string, bool) {
 	n.lock.Lock()
 	defer n.lock.Unlock()
diff --git a/vendor/github.com/go-openapi/jsonpointer/options.go b/vendor/github.com/go-openapi/jsonpointer/options.go
new file mode 100644
index 0000000000..223c1e5ff0
--- /dev/null
+++ b/vendor/github.com/go-openapi/jsonpointer/options.go
@@ -0,0 +1,85 @@
+// SPDX-FileCopyrightText: Copyright (c) 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package jsonpointer
+
+import (
+	"sync"
+
+	"github.com/go-openapi/jsonpointer/jsonname"
+)
+
+// Option to tune the behavior of a JSON [Pointer].
+type Option func(*options)
+
+var (
+	//nolint:gochecknoglobals // package level defaults are provided as a convenient, backward-compatible way to adopt options.
+	defaultOptions = options{
+		provider: jsonname.DefaultJSONNameProvider,
+	}
+	//nolint:gochecknoglobals // guards defaultOptions against concurrent SetDefaultNameProvider / read races (testing)
+	defaultOptionsMu sync.RWMutex
+)
+
+// SetDefaultNameProvider sets the [NameProvider] as a package-level default.
+//
+// By default, the default provider is [jsonname.DefaultJSONNameProvider].
+//
+// It is safe to call concurrently with [Pointer.Get], [Pointer.Set], [GetForToken] and
+// [SetForToken].
+// The typical usage is to call it once at initialization time.
+//
+// A nil provider is ignored.
+func SetDefaultNameProvider(provider NameProvider) {
+	if provider == nil {
+		return
+	}
+
+	defaultOptionsMu.Lock()
+	defer defaultOptionsMu.Unlock()
+
+	defaultOptions.provider = provider
+}
+
+// UseGoNameProvider sets the [NameProvider] as a package-level default to the alternative provider
+// [jsonname.GoNameProvider], that covers a few areas not supported by the default name provider.
+//
+// This implementation supports untagged exported fields and embedded types in go struct.
+// It follows strictly the behavior of the JSON standard library regarding field naming conventions.
+//
+// It is safe to call concurrently with [Pointer.Get], [Pointer.Set], [GetForToken] and
+// [SetForToken].
+// The typical usage is to call it once at initialization time.
+func UseGoNameProvider() {
+	SetDefaultNameProvider(jsonname.NewGoNameProvider())
+}
+
+// DefaultNameProvider returns the current package-level [NameProvider].
+func DefaultNameProvider() NameProvider { //nolint:ireturn // returning the interface is the point — callers pick their own implementation.
+	defaultOptionsMu.RLock()
+	defer defaultOptionsMu.RUnlock()
+
+	return defaultOptions.provider
+}
+
+// WithNameProvider injects a custom [NameProvider] to resolve json names from go struct types.
+func WithNameProvider(provider NameProvider) Option {
+	return func(o *options) {
+		o.provider = provider
+	}
+}
+
+type options struct {
+	provider NameProvider
+}
+
+func optionsWithDefaults(opts []Option) options {
+	var o options
+	o.provider = DefaultNameProvider()
+
+	for _, apply := range opts {
+		apply(&o)
+	}
+
+	return o
+}
diff --git a/vendor/github.com/go-openapi/jsonpointer/pointer.go b/vendor/github.com/go-openapi/jsonpointer/pointer.go
index 7df49af3b9..05fc863ee6 100644
--- a/vendor/github.com/go-openapi/jsonpointer/pointer.go
+++ b/vendor/github.com/go-openapi/jsonpointer/pointer.go
@@ -11,8 +11,6 @@ import (
 	"reflect"
 	"strconv"
 	"strings"
-
-	"github.com/go-openapi/swag/jsonname"
 )
 
 const (
@@ -20,20 +18,6 @@ const (
 	pointerSeparator = `/`
 )
 
-// JSONPointable is an interface for structs to implement,
-// when they need to customize the json pointer process or want to avoid the use of reflection.
-type JSONPointable interface {
-	// JSONLookup returns a value pointed at this (unescaped) key.
-	JSONLookup(key string) (any, error)
-}
-
-// JSONSetable is an interface for structs to implement,
-// when they need to customize the json pointer process or want to avoid the use of reflection.
-type JSONSetable interface {
-	// JSONSet sets the value pointed at the (unescaped) key.
-	JSONSet(key string, value any) error
-}
-
 // Pointer is a representation of a json pointer.
 //
 // Use [Pointer.Get] to retrieve a value or [Pointer.Set] to set a value.
@@ -41,7 +25,7 @@ type JSONSetable interface {
 // It works with any go type interpreted as a JSON document, which means:
 //
 //   - if a type implements [JSONPointable], its [JSONPointable.JSONLookup] method is used to resolve [Pointer.Get]
-//   - if a type implements [JSONSetable], its [JSONPointable.JSONSet] method is used to resolve [Pointer.Set]
+//   - if a type implements [JSONSetable], its [JSONSetable.JSONSet] method is used to resolve [Pointer.Set]
 //   - a go map[K]V is interpreted as an object, with type K assignable to a string
 //   - a go slice []T is interpreted as an array
 //   - a go struct is interpreted as an object, with exported fields interpreted as keys
@@ -50,7 +34,8 @@ type JSONSetable interface {
 //
 // For struct s resolved by reflection, key mappings honor the conventional struct tag `json`.
 //
-// Fields that do not specify a `json` tag, or specify an empty one, or are tagged as `json:"-"` are ignored.
+// Fields that do not specify a `json` tag, or specify an empty one, or are tagged as `json:"-"` are
+// ignored.
 //
 // # Limitations
 //
@@ -71,16 +56,36 @@ func New(jsonPointerString string) (Pointer, error) {
 // Get uses the pointer to retrieve a value from a JSON document.
 //
 // It returns the value with its type as a [reflect.Kind] or an error.
-func (p *Pointer) Get(document any) (any, reflect.Kind, error) {
-	return p.get(document, jsonname.DefaultJSONNameProvider)
+func (p *Pointer) Get(document any, opts ...Option) (any, reflect.Kind, error) {
+	o := optionsWithDefaults(opts)
+
+	return p.get(document, o.provider)
 }
 
-// Set uses the pointer to set a value from a data type
-// that represent a JSON document.
+// Set uses the pointer to set a value from a data type that represent a JSON document.
+//
+// # Mutation contract
 //
-// It returns the updated document.
-func (p *Pointer) Set(document any, value any) (any, error) {
-	return document, p.set(document, value, jsonname.DefaultJSONNameProvider)
+// Set mutates the provided document in place whenever Go's type system allows it: when document is
+// a map, a pointer, or when the targeted value is reached through an addressable ancestor (e.g. a
+// struct field traversed via a pointer, a slice element).
+//
+// Callers that rely on this in-place behavior may continue to ignore the returned document.
+//
+// The returned document is only load-bearing when Set cannot mutate in place.
+//
+// This happens in one specific case: appending to a top-level slice passed by value (e.g. document
+// of type []T rather than *[]T) via the RFC 6901 "-" terminal token. reflect.Append produces a new
+// slice header that the library cannot rebind into the caller's variable; the updated document is
+// returned instead.
+//
+// Pass *[]T if you want in-place rebind for that case as well.
+//
+// See [ErrDashToken] for the semantics of the "-" token.
+func (p *Pointer) Set(document any, value any, opts ...Option) (any, error) {
+	o := optionsWithDefaults(opts)
+
+	return p.set(document, value, o.provider)
 }
 
 // DecodedTokens returns the decoded (unescaped) tokens of this JSON pointer.
@@ -109,6 +114,46 @@ func (p *Pointer) String() string {
 	return pointerSeparator + strings.Join(p.referenceTokens, pointerSeparator)
 }
 
+// Offset returns the byte offset, in the raw JSON text of document, of the location referenced by
+// this pointer's terminal token.
+//
+// Unlike [Pointer.Get] and [Pointer.Set], which operate on a decoded Go value, Offset operates
+// directly on the textual JSON source.
+//
+// It drives an [encoding/json.Decoder] over the string and stops at the terminal token, returning
+// the position at which the decoder was about to read that token.
+//
+// It is primarily intended for tooling that needs to map a pointer back to a region of the original
+// source: reporting line/column for validation or parse diagnostics, extracting a sub-document by
+// slicing the raw bytes, or highlighting the referenced span in an editor.
+//
+// # Offset semantics
+//
+// The meaning of the returned offset depends on whether the terminal token addresses an object
+// property or an array element:
+//
+//   - Object property: the offset points to the first byte of the key (its
+//     opening quote character), not to the associated value. For example,
+//     pointer "/foo/bar" against {"foo": {"bar": 21}} returns 9, the index of
+//     the opening quote of "bar".
+//   - Array element: the offset points to the first byte of the value at that
+//     index. For example, pointer "/0/1" against [[1,2], [3,4]] returns 4,
+//     the index of the digit 2.
+//
+// # Errors
+//
+// Offset returns an error in any of these cases:
+//
+//   - document is not syntactically valid JSON;
+//   - the structure of document does not match the pointer (e.g. traversing
+//     into a scalar, or a token that is neither a valid key nor a valid
+//     numeric index);
+//   - a referenced key or index does not exist in document;
+//   - the pointer's terminal token is the RFC 6901 "-" array token, which
+//     designates a nonexistent element and therefore has no offset in the
+//     source. The returned error wraps [ErrDashToken].
+//
+// All errors wrap [ErrPointer].
 func (p *Pointer) Offset(document string) (int64, error) {
 	dec := json.NewDecoder(strings.NewReader(document))
 	var offset int64
@@ -137,7 +182,34 @@ func (p *Pointer) Offset(document string) (int64, error) {
 			return 0, fmt.Errorf("invalid token %#v: %w", tk, ErrPointer)
 		}
 	}
-	return offset, nil
+	return skipJSONSeparator(document, offset), nil
+}
+
+// skipJSONSeparator advances offset past trailing JSON whitespace and at most one value separator
+// (comma) in document, so the result points at the first byte of the next JSON token.
+//
+// The streaming decoder's InputOffset sits right after the most recently consumed token, which
+// between values is the comma (or whitespace) — not the following token.
+//
+// Normalizing here keeps Offset's contract uniform: for both object keys and array elements, and
+// regardless of position within the parent container, the returned offset always points at the
+// first byte of the addressed token.
+func skipJSONSeparator(document string, offset int64) int64 {
+	n := int64(len(document))
+	for offset < n && isJSONWhitespace(document[offset]) {
+		offset++
+	}
+	if offset < n && document[offset] == ',' {
+		offset++
+	}
+	for offset < n && isJSONWhitespace(document[offset]) {
+		offset++
+	}
+	return offset
+}
+
+func isJSONWhitespace(c byte) bool {
+	return c == ' ' || c == '\t' || c == '\n' || c == '\r'
 }
 
 // "Constructor", parses the given string JSON pointer.
@@ -157,9 +229,9 @@ func (p *Pointer) parse(jsonPointerString string) error {
 	return nil
 }
 
-func (p *Pointer) get(node any, nameProvider *jsonname.NameProvider) (any, reflect.Kind, error) {
+func (p *Pointer) get(node any, nameProvider NameProvider) (any, reflect.Kind, error) {
 	if nameProvider == nil {
-		nameProvider = jsonname.DefaultJSONNameProvider
+		nameProvider = defaultOptions.provider
 	}
 
 	kind := reflect.Invalid
@@ -185,50 +257,128 @@ func (p *Pointer) get(node any, nameProvider *jsonname.NameProvider) (any, refle
 	return node, kind, nil
 }
 
-func (p *Pointer) set(node, data any, nameProvider *jsonname.NameProvider) error {
+func (p *Pointer) set(node, data any, nameProvider NameProvider) (any, error) {
 	knd := reflect.ValueOf(node).Kind()
 
 	if knd != reflect.Pointer && knd != reflect.Struct && knd != reflect.Map && knd != reflect.Slice && knd != reflect.Array {
-		return errors.Join(
+		return node, errors.Join(
 			fmt.Errorf("unexpected type: %T", node), //nolint:err113 // err wrapping is carried out by errors.Join, not fmt.Errorf.
 			ErrUnsupportedValueType,
 			ErrPointer,
 		)
 	}
 
-	l := len(p.referenceTokens)
-
 	// full document when empty
-	if l == 0 {
-		return nil
+	if len(p.referenceTokens) == 0 {
+		return node, nil
 	}
 
 	if nameProvider == nil {
-		nameProvider = jsonname.DefaultJSONNameProvider
+		nameProvider = defaultOptions.provider
 	}
 
-	var decodedToken string
-	lastIndex := l - 1
+	return p.setAt(node, p.referenceTokens, data, nameProvider)
+}
 
-	if lastIndex > 0 { // skip if we only have one token in pointer
-		for _, token := range p.referenceTokens[:lastIndex] {
-			decodedToken = Unescape(token)
-			next, err := p.resolveNodeForToken(node, decodedToken, nameProvider)
-			if err != nil {
-				return err
-			}
+// setAt recursively walks the token list, setting the data at the terminal token and rebinding any
+// new child reference (e.g. a slice header returned by an "-" append) into its parent on the way
+// back up.
+//
+// Returning the (possibly new) node at each level is what makes append work at any depth without
+// requiring the caller to pass a pointer to the containing slice: the new slice header propagates
+// up and each parent rebinds it via the appropriate kind-specific setter.
+func (p *Pointer) setAt(node any, tokens []string, data any, nameProvider NameProvider) (any, error) {
+	decodedToken := Unescape(tokens[0])
+
+	if len(tokens) == 1 {
+		return setSingleImpl(node, data, decodedToken, nameProvider)
+	}
 
-			node = next
-		}
+	child, err := p.resolveNodeForToken(node, decodedToken, nameProvider)
+	if err != nil {
+		return node, err
 	}
 
-	// last token
-	decodedToken = Unescape(p.referenceTokens[lastIndex])
+	newChild, err := p.setAt(child, tokens[1:], data, nameProvider)
+	if err != nil {
+		return node, err
+	}
 
-	return setSingleImpl(node, data, decodedToken, nameProvider)
+	return rebindChild(node, decodedToken, newChild, nameProvider)
 }
 
-func (p *Pointer) resolveNodeForToken(node any, decodedToken string, nameProvider *jsonname.NameProvider) (next any, err error) {
+// rebindChild writes newChild back into node at decodedToken.
+//
+// For cases where the child was already mutated in place (pointer aliasing, addressable slice
+// elements) the rebind is a safe no-op.
+//
+// For cases where the child was returned by value (map entries holding a slice, slices reached
+// through a non-addressable ancestor), the rebind propagates the new value into the parent.
+//
+// Parents implementing [JSONPointable] are left alone: they took ownership of the child via
+// JSONLookup and did not opt into a JSONSet-based rebind on intermediate tokens.
+func rebindChild(node any, decodedToken string, newChild any, nameProvider NameProvider) (any, error) {
+	if _, ok := node.(JSONPointable); ok {
+		return node, nil
+	}
+
+	rValue := reflect.Indirect(reflect.ValueOf(node))
+
+	switch rValue.Kind() {
+	case reflect.Struct:
+		nm, ok := nameProvider.GetGoNameForType(rValue.Type(), decodedToken)
+		if !ok {
+			return node, fmt.Errorf("object has no field %q: %w", decodedToken, ErrPointer)
+		}
+		fld := rValue.FieldByName(nm)
+		if !fld.CanSet() {
+			return node, nil
+		}
+		assignReflectValue(fld, newChild)
+		return node, nil
+
+	case reflect.Map:
+		rValue.SetMapIndex(reflect.ValueOf(decodedToken), reflect.ValueOf(newChild))
+		return node, nil
+
+	case reflect.Slice:
+		if decodedToken == dashToken {
+			return node, errDashIntermediate()
+		}
+		idx, err := strconv.Atoi(decodedToken)
+		if err != nil {
+			return node, errors.Join(err, ErrPointer)
+		}
+		elem := rValue.Index(idx)
+		if !elem.CanSet() {
+			return node, nil
+		}
+		assignReflectValue(elem, newChild)
+		return node, nil
+
+	default:
+		return node, errInvalidReference(decodedToken)
+	}
+}
+
+// assignReflectValue assigns src into dst, unwrapping a pointer when dst expects the pointee type.
+//
+// This tolerates the pointer-wrapping performed by [typeFromValue] for addressable fields.
+func assignReflectValue(dst reflect.Value, src any) {
+	nv := reflect.ValueOf(src)
+	if !nv.IsValid() {
+		return
+	}
+	if nv.Type().AssignableTo(dst.Type()) {
+		dst.Set(nv)
+		return
+	}
+	if nv.Kind() == reflect.Pointer && nv.Elem().Type().AssignableTo(dst.Type()) {
+		dst.Set(nv.Elem())
+	}
+}
+
+func (p *Pointer) resolveNodeForToken(node any, decodedToken string, nameProvider NameProvider) (next any, err error) {
 	// check for nil during traversal
 	if isNil(node) {
 		return nil, fmt.Errorf("cannot traverse through nil value at %q: %w", decodedToken, ErrPointer)
@@ -272,6 +422,9 @@ func (p *Pointer) resolveNodeForToken(node any, decodedToken string, nameProvide
 		return typeFromValue(mv), nil
 
 	case reflect.Slice:
+		if decodedToken == dashToken {
+			return nil, errDashIntermediate()
+		}
 		tokenIndex, err := strconv.Atoi(decodedToken)
 		if err != nil {
 			return nil, errors.Join(err, ErrPointer)
@@ -312,16 +465,23 @@ func typeFromValue(v reflect.Value) any {
 }
 
 // GetForToken gets a value for a json pointer token 1 level deep.
-func GetForToken(document any, decodedToken string) (any, reflect.Kind, error) {
-	return getSingleImpl(document, decodedToken, jsonname.DefaultJSONNameProvider)
+func GetForToken(document any, decodedToken string, opts ...Option) (any, reflect.Kind, error) {
+	o := optionsWithDefaults(opts)
+
+	return getSingleImpl(document, decodedToken, o.provider)
 }
 
 // SetForToken sets a value for a json pointer token 1 level deep.
-func SetForToken(document any, decodedToken string, value any) (any, error) {
-	return document, setSingleImpl(document, value, decodedToken, jsonname.DefaultJSONNameProvider)
+//
+// See [Pointer.Set] for the mutation contract, in particular the handling of the RFC 6901 "-" token
+// on slices.
+func SetForToken(document any, decodedToken string, value any, opts ...Option) (any, error) {
+	o := optionsWithDefaults(opts)
+
+	return setSingleImpl(document, value, decodedToken, o.provider)
 }
 
-func getSingleImpl(node any, decodedToken string, nameProvider *jsonname.NameProvider) (any, reflect.Kind, error) {
+func getSingleImpl(node any, decodedToken string, nameProvider NameProvider) (any, reflect.Kind, error) {
 	rValue := reflect.Indirect(reflect.ValueOf(node))
 	kind := rValue.Kind()
 	if isNil(node) {
@@ -361,6 +521,9 @@ func getSingleImpl(node any, decodedToken string, nameProvider *jsonname.NamePro
 		return nil, kind, errNoKey(decodedToken)
 
 	case reflect.Slice:
+		if decodedToken == dashToken {
+			return nil, kind, errDashOnGet()
+		}
 		tokenIndex, err := strconv.Atoi(decodedToken)
 		if err != nil {
 			return nil, kind, errors.Join(err, ErrPointer)
@@ -378,14 +541,14 @@ func getSingleImpl(node any, decodedToken string, nameProvider *jsonname.NamePro
 	}
 }
 
-func setSingleImpl(node, data any, decodedToken string, nameProvider *jsonname.NameProvider) error {
+func setSingleImpl(node, data any, decodedToken string, nameProvider NameProvider) (any, error) {
 	// check for nil to prevent panic when calling rValue.Type()
 	if isNil(node) {
-		return fmt.Errorf("cannot set field %q on nil value: %w", decodedToken, ErrPointer)
+		return node, fmt.Errorf("cannot set field %q on nil value: %w", decodedToken, ErrPointer)
 	}
 
 	if ns, ok := node.(JSONSetable); ok {
-		return ns.JSONSet(decodedToken, data)
+		return node, ns.JSONSet(decodedToken, data)
 	}
 
 	rValue := reflect.Indirect(reflect.ValueOf(node))
@@ -394,12 +557,12 @@ func setSingleImpl(node, data any, decodedToken string, nameProvider *jsonname.N
 	case reflect.Struct:
 		nm, ok := nameProvider.GetGoNameForType(rValue.Type(), decodedToken)
 		if !ok {
-			return fmt.Errorf("object has no field %q: %w", decodedToken, ErrPointer)
+			return node, fmt.Errorf("object has no field %q: %w", decodedToken, ErrPointer)
 		}
 
 		fld := rValue.FieldByName(nm)
 		if !fld.CanSet() {
-			return fmt.Errorf("can't set struct field %s to %v: %w", nm, data, ErrPointer)
+			return node, fmt.Errorf("can't set struct field %s to %v: %w", nm, data, ErrPointer)
 		}
 
 		value := reflect.ValueOf(data)
@@ -407,33 +570,51 @@ func setSingleImpl(node, data any, decodedToken string, nameProvider *jsonname.N
 		assignedType := fld.Type()
 
 		if !valueType.AssignableTo(assignedType) {
-			return fmt.Errorf("can't set value with type %T to field %s with type %v: %w", data, nm, assignedType, ErrPointer)
+			return node, fmt.Errorf("can't set value with type %T to field %s with type %v: %w", data, nm, assignedType, ErrPointer)
 		}
 
 		fld.Set(value)
 
-		return nil
+		return node, nil
 
 	case reflect.Map:
 		kv := reflect.ValueOf(decodedToken)
 		rValue.SetMapIndex(kv, reflect.ValueOf(data))
 
-		return nil
+		return node, nil
 
 	case reflect.Slice:
+		if decodedToken == dashToken {
+			// RFC 6901 §4 / RFC 6902 append semantics: terminal "-" appends the value to the slice.
+			//
+			// We rebind in place when the slice is reachable via an addressable ancestor; otherwise we
+			// return the new slice header for the parent (or the public Set) to rebind.
+			value := reflect.ValueOf(data)
+			elemType := rValue.Type().Elem()
+			if !value.Type().AssignableTo(elemType) {
+				return node, fmt.Errorf("can't append value of type %T to slice of %v: %w", data, elemType, ErrPointer)
+			}
+			newSlice := reflect.Append(rValue, value)
+			if rValue.CanSet() {
+				rValue.Set(newSlice)
+				return node, nil
+			}
+			return newSlice.Interface(), nil
+		}
+
 		tokenIndex, err := strconv.Atoi(decodedToken)
 		if err != nil {
-			return errors.Join(err, ErrPointer)
+			return node, errors.Join(err, ErrPointer)
 		}
 
 		sLength := rValue.Len()
 		if tokenIndex < 0 || tokenIndex >= sLength {
-			return errOutOfBounds(sLength, tokenIndex)
+			return node, errOutOfBounds(sLength, tokenIndex)
 		}
 
 		elem := rValue.Index(tokenIndex)
 		if !elem.CanSet() {
-			return fmt.Errorf("can't set slice index %s to %v: %w", decodedToken, data, ErrPointer)
+			return node, fmt.Errorf("can't set slice index %s to %v: %w", decodedToken, data, ErrPointer)
 		}
 
 		value := reflect.ValueOf(data)
@@ -441,15 +622,15 @@ func setSingleImpl(node, data any, decodedToken string, nameProvider *jsonname.N
 		assignedType := elem.Type()
 
 		if !valueType.AssignableTo(assignedType) {
-			return fmt.Errorf("can't set value with type %T to slice element %d with type %v: %w", data, tokenIndex, assignedType, ErrPointer)
+			return node, fmt.Errorf("can't set value with type %T to slice element %d with type %v: %w", data, tokenIndex, assignedType, ErrPointer)
 		}
 
 		elem.Set(value)
 
-		return nil
+		return node, nil
 
 	default:
-		return errInvalidReference(decodedToken)
+		return node, errInvalidReference(decodedToken)
 	}
 }
 
@@ -460,24 +641,27 @@ func offsetSingleObject(dec *json.Decoder, decodedToken string) (int64, error) {
 		if err != nil {
 			return 0, err
 		}
-		switch tk := tk.(type) {
-		case json.Delim:
-			switch tk {
-			case '{':
-				if err = drainSingle(dec); err != nil {
-					return 0, err
-				}
-			case '[':
+		key, ok := tk.(string)
+		if !ok {
+			return 0, fmt.Errorf("invalid key token %#v: %w", tk, ErrPointer)
+		}
+		if key == decodedToken {
+			return offset, nil
+		}
+
+		// Consume the associated value.
+		// Scalars are fully read by a single Token() call; composite values must be drained.
+		tk, err = dec.Token()
+		if err != nil {
+			return 0, err
+		}
+		if delim, isDelim := tk.(json.Delim); isDelim {
+			switch delim {
+			case '{', '[':
 				if err = drainSingle(dec); err != nil {
 					return 0, err
 				}
 			}
-		case string:
-			if tk == decodedToken {
-				return offset, nil
-			}
-		default:
-			return 0, fmt.Errorf("invalid token %#v: %w", tk, ErrPointer)
 		}
 	}
 
@@ -485,6 +669,9 @@ func offsetSingleObject(dec *json.Decoder, decodedToken string) (int64, error) {
 }
 
 func offsetSingleArray(dec *json.Decoder, decodedToken string) (int64, error) {
+	if decodedToken == dashToken {
+		return 0, errDashOnOffset()
+	}
 	idx, err := strconv.Atoi(decodedToken)
 	if err != nil {
 		return 0, fmt.Errorf("token reference %q is not a number: %w: %w", decodedToken, err, ErrPointer)
@@ -548,10 +735,7 @@ func drainSingle(dec *json.Decoder) error {
 	return nil
 }
 
-// JSON pointer encoding:
-// ~0 => ~
-// ~1 => /
-// ... and vice versa
+// JSON pointer encoding: ~0 => ~ ~1 => / ... and vice versa.
 
 const (
 	encRefTok0 = `~0`
diff --git a/vendor/github.com/go-openapi/jsonreference/.cliff.toml b/vendor/github.com/go-openapi/jsonreference/.cliff.toml
deleted file mode 100644
index 702629f5dc..0000000000
--- a/vendor/github.com/go-openapi/jsonreference/.cliff.toml
+++ /dev/null
@@ -1,181 +0,0 @@
-# git-cliff ~ configuration file
-# https://git-cliff.org/docs/configuration
-
-[changelog]
-header = """
-"""
-
-footer = """
-
------
-
-**[{{ remote.github.repo }}]({{ self::remote_url() }}) license terms**
-
-[![License][license-badge]][license-url]
-
-[license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
-[license-url]: {{ self::remote_url() }}/?tab=Apache-2.0-1-ov-file#readme
-
-{%- macro remote_url() -%}
-  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
-{%- endmacro -%}
-"""
-
-body = """
-{%- if version %}
-## [{{ version | trim_start_matches(pat="v") }}]({{ self::remote_url() }}/tree/{{ version }}) - {{ timestamp | date(format="%Y-%m-%d") }}
-{%- else %}
-## [unreleased]
-{%- endif %}
-{%- if message %}
-  {%- raw %}\n{% endraw %}
-{{ message }}
-  {%- raw %}\n{% endraw %}
-{%- endif %}
-{%- if version %}
-  {%- if previous.version %}
-
-**Full Changelog**: <{{ self::remote_url() }}/compare/{{ previous.version }}...{{ version }}>
-  {%- endif %}
-{%- else %}
-  {%- raw %}\n{% endraw %}
-{%- endif %}
-
-{%- if statistics %}{% if statistics.commit_count %}
-  {%- raw %}\n{% endraw %}
-{{ statistics.commit_count }} commits in this release.
-  {%- raw %}\n{% endraw %}
-{%- endif %}{% endif %}
------
-
-{%- for group, commits in commits | group_by(attribute="group") %}
-  {%- raw %}\n{% endraw %}
-### {{ group | upper_first }}
-    {%- raw %}\n{% endraw %}
-    {%- for commit in commits %}
-      {%- if commit.remote.pr_title %}
-        {%- set commit_message = commit.remote.pr_title %}
-      {%- else %}
-        {%- set commit_message = commit.message %}
-      {%- endif %}
-* {{ commit_message | split(pat="\n") | first | trim }}
-      {%- if commit.remote.username %}
-{%- raw %} {% endraw %}by [@{{ commit.remote.username }}](https://github.com/{{ commit.remote.username }})
-      {%- endif %}
-      {%- if commit.remote.pr_number %}
-{%- raw %} {% endraw %}in [#{{ commit.remote.pr_number }}]({{ self::remote_url() }}/pull/{{ commit.remote.pr_number }})
-      {%- endif %}
-{%- raw %} {% endraw %}[...]({{ self::remote_url() }}/commit/{{ commit.id }})
-  {%- endfor %}
-{%- endfor %}
-
-{%- if github %}
-{%- raw %}\n{% endraw -%}
-  {%- set all_contributors = github.contributors | length %}
-  {%- if github.contributors | filter(attribute="username", value="dependabot[bot]") | length < all_contributors %}
------
-
-### People who contributed to this release
-  {% endif %}
-  {%- for contributor in github.contributors | filter(attribute="username") | sort(attribute="username") %}
-    {%- if contributor.username != "dependabot[bot]" and contributor.username != "github-actions[bot]" %}
-* [@{{ contributor.username }}](https://github.com/{{ contributor.username }})
-    {%- endif %}
-  {%- endfor %}
-
-  {% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}
------
-    {%- raw %}\n{% endraw %}
-
-### New Contributors
-  {%- endif %}
-
-  {%- for contributor in github.contributors | filter(attribute="is_first_time", value=true) %}
-    {%- if contributor.username != "dependabot[bot]" and contributor.username != "github-actions[bot]" %}
-* @{{ contributor.username }} made their first contribution
-      {%- if contributor.pr_number %}
-  in [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) \
-      {%- endif %}
-    {%- endif %}
-  {%- endfor %}
-{%- endif %}
-
-{%- raw %}\n{% endraw %}
-
-{%- macro remote_url() -%}
-  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
-{%- endmacro -%}
-"""
-# Remove leading and trailing whitespaces from the changelog's body.
-trim = true
-# Render body even when there are no releases to process.
-render_always = true
-# An array of regex based postprocessors to modify the changelog.
-postprocessors = [
-    # Replace the placeholder <REPO> with a URL.
-    #{ pattern = '<REPO>', replace = "https://github.com/orhun/git-cliff" },
-]
-# output file path
-# output = "test.md"
-
-[git]
-# Parse commits according to the conventional commits specification.
-# See https://www.conventionalcommits.org
-conventional_commits = false
-# Exclude commits that do not match the conventional commits specification.
-filter_unconventional = false
-# Require all commits to be conventional.
-# Takes precedence over filter_unconventional.
-require_conventional = false
-# Split commits on newlines, treating each line as an individual commit.
-split_commits = false
-# An array of regex based parsers to modify commit messages prior to further processing.
-commit_preprocessors = [
-    # Replace issue numbers with link templates to be updated in `changelog.postprocessors`.
-    #{ pattern = '\((\w+\s)?#([0-9]+)\)', replace = "([#${2}](<REPO>/issues/${2}))"},
-    # Check spelling of the commit message using https://github.com/crate-ci/typos.
-    # If the spelling is incorrect, it will be fixed automatically.
-    #{ pattern = '.*', replace_command = 'typos --write-changes -' }
-]
-# Prevent commits that are breaking from being excluded by commit parsers.
-protect_breaking_commits = false
-# An array of regex based parsers for extracting data from the commit message.
-# Assigns commits to groups.
-# Optionally sets the commit's scope and can decide to exclude commits from further processing.
-commit_parsers = [
-    { message = "^[Cc]hore\\([Rr]elease\\): prepare for", skip = true },
-    { message = "(^[Mm]erge)|([Mm]erge conflict)", skip = true },
-    { field = "author.name", pattern = "dependabot*", group = "<!-- 0A -->Updates" },
-    { message = "([Ss]ecurity)|([Vv]uln)", group = "<!-- 08 -->Security" },
-    { body = "(.*[Ss]ecurity)|([Vv]uln)", group = "<!-- 08 -->Security" },
-    { message = "([Cc]hore\\(lint\\))|(style)|(lint)|(codeql)|(golangci)", group = "<!-- 05 -->Code quality" },
-    { message = "(^[Dd]oc)|((?i)readme)|(badge)|(typo)|(documentation)", group = "<!-- 03 -->Documentation" },
-    { message = "(^[Ff]eat)|(^[Ee]nhancement)", group = "<!-- 00 -->Implemented enhancements" },
-    { message = "(^ci)|(\\(ci\\))|(fixup\\s+ci)|(fix\\s+ci)|(license)|(example)", group = "<!-- 07 -->Miscellaneous tasks" },
-    { message = "^test", group = "<!-- 06 -->Testing" },
-    { message = "(^fix)|(panic)", group = "<!-- 01 -->Fixed bugs" },
-    { message = "(^refact)|(rework)", group = "<!-- 02 -->Refactor" },
-    { message = "(^[Pp]erf)|(performance)", group = "<!-- 04 -->Performance" },
-    { message = "(^[Cc]hore)", group = "<!-- 07 -->Miscellaneous tasks" },
-    { message = "^[Rr]evert", group = "<!-- 09 -->Reverted changes" },
-    { message = "(upgrade.*?go)|(go\\s+version)", group = "<!-- 0A -->Updates" },
-    { message = ".*", group = "<!-- 0B -->Other" },
-]
-# Exclude commits that are not matched by any commit parser.
-filter_commits = false
-# An array of link parsers for extracting external references, and turning them into URLs, using regex.
-link_parsers = []
-# Include only the tags that belong to the current branch.
-use_branch_tags = false
-# Order releases topologically instead of chronologically.
-topo_order = false
-# Order releases topologically instead of chronologically.
-topo_order_commits = true
-# Order of commits in each group/release within the changelog.
-# Allowed values: newest, oldest
-sort_commits = "newest"
-# Process submodules commits
-recurse_submodules = false
-
-#[remote.github]
-#owner = "go-openapi"
diff --git a/vendor/github.com/go-openapi/jsonreference/.gitignore b/vendor/github.com/go-openapi/jsonreference/.gitignore
index 769c244007..d8f4186fe5 100644
--- a/vendor/github.com/go-openapi/jsonreference/.gitignore
+++ b/vendor/github.com/go-openapi/jsonreference/.gitignore
@@ -1 +1,5 @@
-secrets.yml
+*.out
+*.cov
+.idea
+.env
+.mcp.json
diff --git a/vendor/github.com/go-openapi/jsonreference/.golangci.yml b/vendor/github.com/go-openapi/jsonreference/.golangci.yml
index fdae591bce..dc7c96053d 100644
--- a/vendor/github.com/go-openapi/jsonreference/.golangci.yml
+++ b/vendor/github.com/go-openapi/jsonreference/.golangci.yml
@@ -12,6 +12,7 @@ linters:
     - paralleltest
     - recvcheck
     - testpackage
+    - thelper
     - tparallel
     - varnamelen
     - whitespace
diff --git a/vendor/github.com/go-openapi/jsonreference/CODE_OF_CONDUCT.md b/vendor/github.com/go-openapi/jsonreference/CODE_OF_CONDUCT.md
index 9322b065e3..bac878f216 100644
--- a/vendor/github.com/go-openapi/jsonreference/CODE_OF_CONDUCT.md
+++ b/vendor/github.com/go-openapi/jsonreference/CODE_OF_CONDUCT.md
@@ -23,7 +23,9 @@ include:
 Examples of unacceptable behavior by participants include:
 
 * The use of sexualized language or imagery and unwelcome sexual attention or
+
 advances
+
 * Trolling, insulting/derogatory comments, and personal or political attacks
 * Public or private harassment
 * Publishing others' private information, such as a physical or electronic
@@ -55,7 +57,7 @@ further defined and clarified by project maintainers.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at ivan+abuse@flanders.co.nz. All
+reported by contacting the project team at <ivan+abuse@flanders.co.nz>. All
 complaints will be reviewed and investigated and will result in a response that
 is deemed necessary and appropriate to the circumstances. The project team is
 obligated to maintain confidentiality with regard to the reporter of an incident.
@@ -68,7 +70,7 @@ members of the project's leadership.
 ## Attribution
 
 This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
-available at [http://contributor-covenant.org/version/1/4][version]
+available at [<http://contributor-covenant.org/version/1/4>][version]
 
 [homepage]: http://contributor-covenant.org
 [version]: http://contributor-covenant.org/version/1/4/
diff --git a/vendor/github.com/go-openapi/jsonreference/CONTRIBUTORS.md b/vendor/github.com/go-openapi/jsonreference/CONTRIBUTORS.md
index 9907d5d212..d20737c946 100644
--- a/vendor/github.com/go-openapi/jsonreference/CONTRIBUTORS.md
+++ b/vendor/github.com/go-openapi/jsonreference/CONTRIBUTORS.md
@@ -4,18 +4,18 @@
 
 | Total Contributors | Total Contributions |
 | --- | --- |
-| 9  | 68  |
+| 9  | 83  |
 
 | Username | All Time Contribution Count | All Commits |
 | --- | --- | --- |
-| @fredbi | 31 | https://github.com/go-openapi/jsonreference/commits?author=fredbi |
-| @casualjim | 25 | https://github.com/go-openapi/jsonreference/commits?author=casualjim |
-| @youyuanwu | 5 | https://github.com/go-openapi/jsonreference/commits?author=youyuanwu |
-| @olivierlemasle | 2 | https://github.com/go-openapi/jsonreference/commits?author=olivierlemasle |
-| @apelisse | 1 | https://github.com/go-openapi/jsonreference/commits?author=apelisse |
-| @gbjk | 1 | https://github.com/go-openapi/jsonreference/commits?author=gbjk |
-| @honza | 1 | https://github.com/go-openapi/jsonreference/commits?author=honza |
-| @Neo2308 | 1 | https://github.com/go-openapi/jsonreference/commits?author=Neo2308 |
-| @erraggy | 1 | https://github.com/go-openapi/jsonreference/commits?author=erraggy |
+| @fredbi | 46 | <https://github.com/go-openapi/jsonreference/commits?author=fredbi> |
+| @casualjim | 25 | <https://github.com/go-openapi/jsonreference/commits?author=casualjim> |
+| @youyuanwu | 5 | <https://github.com/go-openapi/jsonreference/commits?author=youyuanwu> |
+| @olivierlemasle | 2 | <https://github.com/go-openapi/jsonreference/commits?author=olivierlemasle> |
+| @apelisse | 1 | <https://github.com/go-openapi/jsonreference/commits?author=apelisse> |
+| @gbjk | 1 | <https://github.com/go-openapi/jsonreference/commits?author=gbjk> |
+| @honza | 1 | <https://github.com/go-openapi/jsonreference/commits?author=honza> |
+| @Neo2308 | 1 | <https://github.com/go-openapi/jsonreference/commits?author=Neo2308> |
+| @erraggy | 1 | <https://github.com/go-openapi/jsonreference/commits?author=erraggy> |
 
- _this file was generated by the [Contributors GitHub Action](https://github.com/github/contributors)_
+ _this file was generated by the [Contributors GitHub Action](https://github.com/github-community-projects/contributors)_
diff --git a/vendor/github.com/go-openapi/jsonreference/NOTICE b/vendor/github.com/go-openapi/jsonreference/NOTICE
index f3b51939a9..814e87ef8c 100644
--- a/vendor/github.com/go-openapi/jsonreference/NOTICE
+++ b/vendor/github.com/go-openapi/jsonreference/NOTICE
@@ -3,7 +3,7 @@ Copyright 2015-2025 go-swagger maintainers
 // SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
 // SPDX-License-Identifier: Apache-2.0
 
-This software library, github.com/go-openapi/jsonpointer, includes software developed
+This software library, github.com/go-openapi/jsonreference, includes software developed
 by the go-swagger and go-openapi maintainers ("go-swagger maintainers").
 
 Licensed under the Apache License, Version 2.0 (the "License");
@@ -18,7 +18,7 @@ It ships with copies of other software which license terms are recalled below.
 
 The original software was authored on 25-02-2013 by sigu-399 (https://github.com/sigu-399, sigu.399@gmail.com).
 
-github.com/sigh-399/jsonpointer
+github.com/sigh-399/jsonreference
 ===========================
 
 // SPDX-FileCopyrightText: Copyright 2013 sigu-399 ( https://github.com/sigu-399 )
diff --git a/vendor/github.com/go-openapi/jsonreference/README.md b/vendor/github.com/go-openapi/jsonreference/README.md
index d479dbdc73..fbd16cf892 100644
--- a/vendor/github.com/go-openapi/jsonreference/README.md
+++ b/vendor/github.com/go-openapi/jsonreference/README.md
@@ -8,12 +8,17 @@
 [![Release][release-badge]][release-url] [![Go Report Card][gocard-badge]][gocard-url] [![CodeFactor Grade][codefactor-badge]][codefactor-url] [![License][license-badge]][license-url]
 <!-- Badges: documentation & support -->
 <!-- Badges: others & stats -->
-[![GoDoc][godoc-badge]][godoc-url] [![Slack Channel][slack-logo]![slack-badge]][slack-url] [![go version][goversion-badge]][goversion-url] ![Top language][top-badge] ![Commits since latest release][commits-badge]
+[![GoDoc][godoc-badge]][godoc-url] [![Discord Channel][discord-badge]][discord-url] [![go version][goversion-badge]][goversion-url] ![Top language][top-badge] ![Commits since latest release][commits-badge]
 
 ---
 
 An implementation of JSON Reference for golang.
 
+## Announcements
+
+* **2026-07-07** : landing v1.0.0
+  * stable API pledge
+
 ## Status
 
 API is stable.
@@ -26,18 +31,33 @@ go get github.com/go-openapi/jsonreference
 
 ## Dependencies
 
-* https://github.com/go-openapi/jsonpointer
+* <https://github.com/go-openapi/jsonpointer>
 
 ## Basic usage
 
+```go
+// Creating a new reference
+ref, err := jsonreference.New("http://example.com/doc.json#/definitions/Pet")
+
+// Fragment-only reference
+fragRef := jsonreference.MustCreateRef("#/definitions/Pet")
+
+// Resolving references
+parent, _ := jsonreference.New("http://example.com/base.json")
+child, _ := jsonreference.New("#/definitions/Pet")
+resolved, _ := parent.Inherits(child)
+// Result: "http://example.com/base.json#/definitions/Pet"
+```
+
+
 ## Change log
 
 See <https://github.com/go-openapi/jsonreference/releases>
 
 ## References
 
-* http://tools.ietf.org/html/draft-ietf-appsawg-json-pointer-07
-* http://tools.ietf.org/html/draft-pbryan-zyp-json-ref-03
+* <http://tools.ietf.org/html/draft-ietf-appsawg-json-pointer-07>
+* <http://tools.ietf.org/html/draft-pbryan-zyp-json-ref-03>
 
 ## Licensing
 
@@ -49,9 +69,9 @@ on top of which it has been built.
 ## Other documentation
 
 * [All-time contributors](./CONTRIBUTORS.md)
-* [Contributing guidelines](.github/CONTRIBUTING.md)
-* [Maintainers documentation](docs/MAINTAINERS.md)
-* [Code style](docs/STYLE.md)
+* [Contributing guidelines][contributing-doc-site]
+* [Maintainers documentation][maintainers-doc-site]
+* [Code style][style-doc-site]
 
 ## Cutting a new release
 
@@ -86,9 +106,9 @@ Maintainers can cut a new release by either:
 [doc-url]: https://goswagger.io/go-openapi
 [godoc-badge]: https://pkg.go.dev/badge/github.com/go-openapi/jsonreference
 [godoc-url]: http://pkg.go.dev/github.com/go-openapi/jsonreference
-[slack-logo]: https://a.slack-edge.com/e6a93c1/img/icons/favicon-32.png
-[slack-badge]: https://img.shields.io/badge/slack-blue?link=https%3A%2F%2Fgoswagger.slack.com%2Farchives%2FC04R30YM
-[slack-url]: https://goswagger.slack.com/archives/C04R30YMU
+[discord-badge]: https://img.shields.io/discord/1446918742398341256?logo=discord&label=discord&color=blue
+[discord-url]: https://discord.gg/FfnFYaC3k5
+
 <!-- Badges: license & compliance -->
 [license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
 [license-url]: https://github.com/go-openapi/jsonreference/?tab=Apache-2.0-1-ov-file#readme
@@ -97,3 +117,7 @@ Maintainers can cut a new release by either:
 [goversion-url]: https://github.com/go-openapi/jsonreference/blob/master/go.mod
 [top-badge]: https://img.shields.io/github/languages/top/go-openapi/jsonreference
 [commits-badge]: https://img.shields.io/github/commits-since/go-openapi/jsonreference/latest
+<!-- Organization docs -->
+[contributing-doc-site]: https://go-openapi.github.io/doc-site/contributing/contributing/index.html
+[maintainers-doc-site]: https://go-openapi.github.io/doc-site/maintainers/index.html
+[style-doc-site]: https://go-openapi.github.io/doc-site/contributing/style/index.html
diff --git a/vendor/github.com/go-openapi/jsonreference/SECURITY.md b/vendor/github.com/go-openapi/jsonreference/SECURITY.md
index 2a7b6f0910..1fea2c5736 100644
--- a/vendor/github.com/go-openapi/jsonreference/SECURITY.md
+++ b/vendor/github.com/go-openapi/jsonreference/SECURITY.md
@@ -6,14 +6,32 @@ This policy outlines the commitment and practices of the go-openapi maintainers
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 0.22.x  | :white_check_mark: |
+| O.x     | :white_check_mark: |
+
+## Vulnerability checks in place
+
+This repository uses automated vulnerability scans, at every merged commit and at least once a week.
+
+We use:
+
+* [`GitHub CodeQL`][codeql-url]
+* [`trivy`][trivy-url]
+* [`govulncheck`][govulncheck-url]
+
+Reports are centralized in github security reports and visible only to the maintainers.
 
 ## Reporting a vulnerability
 
 If you become aware of a security vulnerability that affects the current repository,
-please report it privately to the maintainers.
+**please report it privately to the maintainers**
+rather than opening a publicly visible GitHub issue.
+
+Please follow the instructions provided by github to [Privately report a security vulnerability][github-guidance-url].
 
-Please follow the instructions provided by github to
-[Privately report a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability).
+> [!NOTE]
+> On Github, navigate to the project's "Security" tab then click on "Report a vulnerability".
 
-TL;DR: on Github, navigate to the project's "Security" tab then click on "Report a vulnerability".
+[codeql-url]: https://github.com/github/codeql
+[trivy-url]: https://trivy.dev/docs/latest/getting-started
+[govulncheck-url]: https://go.dev/blog/govulncheck
+[github-guidance-url]: https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability
diff --git a/vendor/github.com/go-openapi/jsonreference/reference.go b/vendor/github.com/go-openapi/jsonreference/reference.go
index 6e3ae49951..003ba7a838 100644
--- a/vendor/github.com/go-openapi/jsonreference/reference.go
+++ b/vendor/github.com/go-openapi/jsonreference/reference.go
@@ -16,6 +16,7 @@ const (
 	fragmentRune = `#`
 )
 
+// ErrChildURL is raised when there is no child.
 var ErrChildURL = errors.New("child url is nil")
 
 // Ref represents a json reference object.
diff --git a/vendor/github.com/go-openapi/swag/.gitignore b/vendor/github.com/go-openapi/swag/.gitignore
index c4b1b64f04..3ceb596fa2 100644
--- a/vendor/github.com/go-openapi/swag/.gitignore
+++ b/vendor/github.com/go-openapi/swag/.gitignore
@@ -3,3 +3,5 @@ vendor
 Godeps
 .idea
 *.out
+.mcp.json
+.worktrees
diff --git a/vendor/github.com/go-openapi/swag/.golangci.yml b/vendor/github.com/go-openapi/swag/.golangci.yml
index 126264a6b8..099c0a78c6 100644
--- a/vendor/github.com/go-openapi/swag/.golangci.yml
+++ b/vendor/github.com/go-openapi/swag/.golangci.yml
@@ -14,7 +14,10 @@ linters:
     - gocognit
     - godot
     - godox
+    - goconst
     - gomoddirectives
+    - gomodguard
+    - gomodguard_v2
     - gosmopolitan
     - inamedparam
     - intrange
diff --git a/vendor/github.com/go-openapi/swag/CODE_OF_CONDUCT.md b/vendor/github.com/go-openapi/swag/CODE_OF_CONDUCT.md
index 9322b065e3..bac878f216 100644
--- a/vendor/github.com/go-openapi/swag/CODE_OF_CONDUCT.md
+++ b/vendor/github.com/go-openapi/swag/CODE_OF_CONDUCT.md
@@ -23,7 +23,9 @@ include:
 Examples of unacceptable behavior by participants include:
 
 * The use of sexualized language or imagery and unwelcome sexual attention or
+
 advances
+
 * Trolling, insulting/derogatory comments, and personal or political attacks
 * Public or private harassment
 * Publishing others' private information, such as a physical or electronic
@@ -55,7 +57,7 @@ further defined and clarified by project maintainers.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at ivan+abuse@flanders.co.nz. All
+reported by contacting the project team at <ivan+abuse@flanders.co.nz>. All
 complaints will be reviewed and investigated and will result in a response that
 is deemed necessary and appropriate to the circumstances. The project team is
 obligated to maintain confidentiality with regard to the reporter of an incident.
@@ -68,7 +70,7 @@ members of the project's leadership.
 ## Attribution
 
 This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
-available at [http://contributor-covenant.org/version/1/4][version]
+available at [<http://contributor-covenant.org/version/1/4>][version]
 
 [homepage]: http://contributor-covenant.org
 [version]: http://contributor-covenant.org/version/1/4/
diff --git a/vendor/github.com/go-openapi/swag/CONTRIBUTORS.md b/vendor/github.com/go-openapi/swag/CONTRIBUTORS.md
new file mode 100644
index 0000000000..0f0711cd5f
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/CONTRIBUTORS.md
@@ -0,0 +1,36 @@
+# Contributors
+
+- Repository: ['go-openapi/swag']
+
+| Total Contributors | Total Contributions |
+| --- | --- |
+| 24  | 251  |
+
+| Username | All Time Contribution Count | All Commits |
+| --- | --- | --- |
+| @fredbi | 121 | <https://github.com/go-openapi/swag/commits?author=fredbi> |
+| @casualjim | 98 | <https://github.com/go-openapi/swag/commits?author=casualjim> |
+| @alexandear | 4 | <https://github.com/go-openapi/swag/commits?author=alexandear> |
+| @orisano | 3 | <https://github.com/go-openapi/swag/commits?author=orisano> |
+| @reinerRubin | 2 | <https://github.com/go-openapi/swag/commits?author=reinerRubin> |
+| @n-inja | 2 | <https://github.com/go-openapi/swag/commits?author=n-inja> |
+| @nitinmohan87 | 2 | <https://github.com/go-openapi/swag/commits?author=nitinmohan87> |
+| @Neo2308 | 2 | <https://github.com/go-openapi/swag/commits?author=Neo2308> |
+| @michaelbowler-form3 | 2 | <https://github.com/go-openapi/swag/commits?author=michaelbowler-form3> |
+| @ujjwalsh | 1 | <https://github.com/go-openapi/swag/commits?author=ujjwalsh> |
+| @griffin-stewie | 1 | <https://github.com/go-openapi/swag/commits?author=griffin-stewie> |
+| @POD666 | 1 | <https://github.com/go-openapi/swag/commits?author=POD666> |
+| @pytlesk4 | 1 | <https://github.com/go-openapi/swag/commits?author=pytlesk4> |
+| @shirou | 1 | <https://github.com/go-openapi/swag/commits?author=shirou> |
+| @seanprince | 1 | <https://github.com/go-openapi/swag/commits?author=seanprince> |
+| @petrkotas | 1 | <https://github.com/go-openapi/swag/commits?author=petrkotas> |
+| @mszczygiel | 1 | <https://github.com/go-openapi/swag/commits?author=mszczygiel> |
+| @sosiska | 1 | <https://github.com/go-openapi/swag/commits?author=sosiska> |
+| @kzys | 1 | <https://github.com/go-openapi/swag/commits?author=kzys> |
+| @faguirre1 | 1 | <https://github.com/go-openapi/swag/commits?author=faguirre1> |
+| @posener | 1 | <https://github.com/go-openapi/swag/commits?author=posener> |
+| @diego-fu-hs | 1 | <https://github.com/go-openapi/swag/commits?author=diego-fu-hs> |
+| @davidalpert | 1 | <https://github.com/go-openapi/swag/commits?author=davidalpert> |
+| @Xe | 1 | <https://github.com/go-openapi/swag/commits?author=Xe> |
+
+ _this file was generated by the [Contributors GitHub Action](https://github.com/github-community-projects/contributors)_
diff --git a/vendor/github.com/go-openapi/swag/README.md b/vendor/github.com/go-openapi/swag/README.md
index 371fd55fdc..c6c2d21e94 100644
--- a/vendor/github.com/go-openapi/swag/README.md
+++ b/vendor/github.com/go-openapi/swag/README.md
@@ -1,26 +1,57 @@
-# Swag [![Build Status](https://github.com/go-openapi/swag/actions/workflows/go-test.yml/badge.svg)](https://github.com/go-openapi/swag/actions?query=workflow%3A"go+test") [![codecov](https://codecov.io/gh/go-openapi/swag/branch/master/graph/badge.svg)](https://codecov.io/gh/go-openapi/swag)
+# Swag
+
+<!-- Badges: status  -->
+[![Tests][test-badge]][test-url] [![Coverage][cov-badge]][cov-url] [![CI vuln scan][vuln-scan-badge]][vuln-scan-url] [![CodeQL][codeql-badge]][codeql-url]
+<!-- Badges: release & docker images  -->
+<!-- Badges: code quality  -->
+<!-- Badges: license & compliance -->
+[![Release][release-badge]][release-url] [![Go Report Card][gocard-badge]][gocard-url] [![CodeFactor Grade][codefactor-badge]][codefactor-url] [![License][license-badge]][license-url]
+<!-- Badges: documentation & support -->
+<!-- Badges: others & stats -->
+[![GoDoc][godoc-badge]][godoc-url] [![Discord Channel][discord-badge]][discord-url] [![go version][goversion-badge]][goversion-url] ![Top language][top-badge] ![Commits since latest release][commits-badge]
 
-[![Slack Status](https://slackin.goswagger.io/badge.svg)](https://slackin.goswagger.io)
-[![license](https://img.shields.io/badge/license-Apache%20v2-orange.svg)](https://raw.githubusercontent.com/go-openapi/swag/master/LICENSE)
-[![Go Reference](https://pkg.go.dev/badge/github.com/go-openapi/swag.svg)](https://pkg.go.dev/github.com/go-openapi/swag)
-[![Go Report Card](https://goreportcard.com/badge/github.com/go-openapi/swag)](https://goreportcard.com/report/github.com/go-openapi/swag)
+---
 
-Package `swag` contains a bunch of helper functions for go-openapi and go-swagger projects.
+A bunch of helper functions for go-openapi and go-swagger projects.
 
 You may also use it standalone for your projects.
 
 > **NOTE**
 > `swag` is one of the foundational building blocks of the go-openapi initiative.
+>
 > Most repositories in `github.com/go-openapi/...` depend on it in some way.
 > And so does our CLI tool `github.com/go-swagger/go-swagger`,
 > as well as the code generated by this tool.
 
 * [Contents](#contents)
 * [Dependencies](#dependencies)
-* [Release Notes](#release-notes)
+* [Change log](#change-log)
 * [Licensing](#licensing)
 * [Note to contributors](#note-to-contributors)
-* [TODOs, suggestions and plans](#todos-suggestions-and-plans)
+* [Roadmap](#roadmap)
+
+## Announcements
+
+* **2025-12-19** : new community chat on discord
+  * a new discord community channel is available to be notified of changes and support users
+
+You may join the discord community by clicking the invite link on the discord badge (also above). [![Discord Channel][discord-badge]][discord-url]
+
+## Status
+
+API is stable.
+
+## Import this library in your project
+
+```cmd
+go get github.com/go-openapi/swag/{module}
+```
+
+Or for backward compatibility:
+
+```cmd
+go get github.com/go-openapi/swag
+```
 
 ## Contents
 
@@ -36,11 +67,12 @@ Child modules will continue to evolve and some new ones may be added in the futu
 | `cmdutils`     | utilities to work with CLIs ||
 | `conv`        | type conversion utilities | convert between values and pointers for any types<br />convert from string to builtin types (wraps `strconv`)<br />require `./typeutils` (test dependency)<br /> |
 | `fileutils`   | file utilities | |
-| `jsonname`    | JSON utilities | infer JSON names from `go` properties<br /> | 
+| `jsonname`    | JSON utilities (deprecated) | infer JSON names from `go` properties<br />use `github.com/go-openapi/jsonpointer/jsonname` instead |
 | `jsonutils`   | JSON utilities | fast json concatenation<br />read and write JSON from and to dynamic `go` data structures<br />~require `github.com/mailru/easyjson`~<br /> |
 | `loading`     | file loading | load from file or http<br />require `./yamlutils`<br /> |
 | `mangling`    | safe name generation | name mangling for `go`<br /> |
 | `netutils`    | networking utilities | host, port from address<br /> |
+| `pools`       | utilities to work with sync.Pools | |
 | `stringutils` | `string` utilities | search in slice (with case-insensitive)<br />split/join query parameters as arrays<br /> |
 | `typeutils`   | `go` types utilities | check the zero value for any type<br />safe check for a nil value<br /> |
 | `yamlutils`   | YAML utilities | converting YAML to JSON<br />loading YAML into a dynamic YAML document<br />maintaining the original order of keys in YAML objects<br />require `./jsonutils`<br />~require `github.com/mailru/easyjson`~<br />require `go.yaml.in/yaml/v3`<br /> |
@@ -49,84 +81,19 @@ Child modules will continue to evolve and some new ones may be added in the futu
 
 ## Dependencies
 
-The root module `github.com/go-openapi/swag` at the repo level maintains a few 
+The root module `github.com/go-openapi/swag` at the repo level maintains a few
 dependencies outside of the standard library.
 
 * YAML utilities depend on `go.yaml.in/yaml/v3`
 * JSON utilities depend on their registered adapter module:
-   * by default, only the standard library is used
-   * `github.com/mailru/easyjson` is now only a dependency for module
-     `github.com/go-openapi/swag/jsonutils/adapters/easyjson/json`,
-     for users willing to import that module.
-   * integration tests and benchmarks use all the dependencies are published as their own module
+    * by default, only the standard library is used
+    * `github.com/mailru/easyjson` is now only a dependency for module
+      `github.com/go-openapi/swag/jsonutils/adapters/easyjson/json`,
+      for users willing to import that module.
+    * integration tests and benchmarks use all the dependencies are published as their own module
 * other dependencies are test dependencies drawn from `github.com/stretchr/testify`
 
-## Release notes
-
-### v0.25.4
-
-** mangling**
-
-Bug fix
-
-* [x] mangler may panic with pluralized overlapping initialisms
-
-Tests
-
-* [x] introduced fuzz tests
-
-### v0.25.3
-
-** mangling**
-
-Bug fix
-
-* [x] mangler may panic with pluralized initialisms
-
-### v0.25.2
-
-Minor changes due to internal maintenance that don't affect the behavior of the library.
-
-* [x] removed indirect test dependencies by switching all tests to `go-openapi/testify`,
-  a fork of `stretch/testify` with zero-dependencies.
-* [x] improvements to CI to catch test reports.
-* [x] modernized licensing annotations in source code, using the more compact SPDX annotations
-  rather than the full license terms.
-* [x] simplified a bit JSON & YAML testing by using newly available assertions
-* started the journey to an OpenSSF score card badge:
-  * [x] explicited permissions in CI workflows
-  * [x] published security policy
-  * pinned dependencies to github actions
-  * introduced fuzzing in tests
-
-### v0.25.1
-
-* fixes a data race that could occur when using the standard library implementation of a JSON ordered map
-
-### v0.25.0
-
-**New with this release**:
-
-* requires `go1.24`, as iterators are being introduced
-* removes the dependency to `mailru/easyjson` by default (#68)
-  * functionality remains the same, but performance may somewhat degrade for applications
-    that relied on `easyjson`
-  * users of the JSON or YAML utilities who want to use `easyjson` as their preferred JSON serializer library
-    will be able to do so by registering this the corresponding JSON adapter at runtime. See below.
-  * ordered keys in JSON and YAML objects: this feature used to rely solely on `easyjson`.
-    With this release, an implementation relying on the standard `encoding/json` is provided.
-  * an independent [benchmark](./jsonutils/adapters/testintegration/benchmarks/README.md) to compare the different adapters
-* improves the "float is integer" check (`conv.IsFloat64AJSONInteger`) (#59)
-* removes the _direct_ dependency to `gopkg.in/yaml.v3` (indirect dependency is still incurred through `stretchr/testify`) (#127)
-* exposed `conv.IsNil()` (previously kept private): a safe nil check (accounting for the "non-nil interface with nil value" nonsensical go trick)
-
-**What coming next?**
-
-Moving forward, we want to :
-* provide an implementation of the JSON adapter based on `encoding/json/v2`, for `go1.25` builds.
-* provide similar implementations for `goccy/go-json` and `jsoniterator/go`, and perhaps some other
-  similar libraries may be interesting too.
-
+## Usage
 
 **How to explicitly register a dependency at runtime**?
 
@@ -150,90 +117,107 @@ or fallback to the standard library.
 For more details, you may also look at our
 [integration tests](jsonutils/adapters/testintegration/integration_suite_test.go#29).
 
-### v0.24.0
+---
 
-With this release, we have largely modernized the API of `swag`:
+## Note to contributors
 
-* The traditional `swag` API is still supported: code that imports `swag` will still
-  compile and work the same.
-* A deprecation notice is published to encourage consumers of this library to adopt
-  the newer API
-* **Deprecation notice** 
-  * configuration through global variables is now deprecated, in favor of options passed as parameters
-  * all helper functions are moved to more specialized packages, which are exposed as 
-    go modules. Importing such a module would reduce the footprint of dependencies.
-  * _all_ functions, variables, constants exposed by the deprecated API have now moved, so
-    that consumers of the new API no longer need to import github.com/go-openapi/swag, but
-    should import the desired sub-module(s).
+All kinds of contributions are welcome.
 
-**New with this release**:
+This repo is a go mono-repo. See [docs](docs/MAINTAINERS.md).
 
-* [x] type converters and pointer to value helpers now support generic types
-* [x] name mangling now support pluralized initialisms (issue #46)
-      Strings like "contact IDs" are now recognized as such a plural form and mangled as a linter would expect.
-* [x] performance: small improvements to reduce the overhead of convert/format wrappers (see issues #110, or PR #108)
-* [x] performance: name mangling utilities run ~ 10% faster (PR #115)
+More general guidelines are available [here](.github/CONTRIBUTING.md).
 
----
+## Roadmap
 
-## Licensing
+See the current [TODO list](docs/TODOS.md)
 
-This library ships under the [SPDX-License-Identifier: Apache-2.0](./LICENSE).
+## Change log
 
-## Note to contributors
+See <https://github.com/go-openapi/swag/releases>
 
-A mono-repo structure comes with some unavoidable extra pains...
+For pre-v0.26.0 releases, see [release notes](./docs/NOTES.md).
 
-* Testing
+**What coming next?**
 
-> The usual `go test ./...` command, run from the root of this repo won't work any longer to test all submodules.
->
-> Each module constitutes an independant unit of test. So you have to run `go test` inside each module.
-> Or you may take a look at how this is achieved by CI
-> [here] https://github.com/go-openapi/swag/blob/master/.github/workflows/go-test.yml).
->
-> There are also some alternative tricks using `go work`, for local development, if you feel comfortable with
-> go workspaces. Perhaps some day, we'll have a `go work test` to run all tests without any hack.
+Moving forward, we want to :
 
-* Releasing
+* provide an implementation of the JSON adapter based on `encoding/json/v2`, for `go1.25` builds.
+* provide similar implementations for `goccy/go-json` and `jsoniterator/go`, and perhaps some other
+  similar libraries may be interesting too.
 
-> Each module follows its own independant module versioning.
->
-> So you have tags like `mangling/v0.24.0`, `fileutils/v0.24.0` etc that are used by `go mod` and `go get`
-> to refer to the tagged version of each module specifically.
->
-> This means we may release patches etc to each module independently.
->
-> We'd like to adopt the rule that modules in this repo would only differ by a patch version
-> (e.g. `v0.24.5` vs `v0.24.3`), and we'll level all modules whenever a minor version is introduced.
->
-> A script in `./hack` is provided to tag all modules with the same version in one go.
+<!--
 
-* Continuous integration
+## References
 
-> At this moment, all tests in all modules are systematically run over the full test matrix (3 platform x 2 go releases).
-> This generates quite a lot of jobs.
->
-> We ought to reduce the number of jobs required to test a PR focused on only a few modules.
+-->
 
-## Todos, suggestions and plans
+## Licensing
 
-All kinds of contributions are welcome.
+This library ships under the [SPDX-License-Identifier: Apache-2.0](./LICENSE).
 
-A few ideas:
-
-* [x] Complete the split of dependencies to isolate easyjson from the rest
-* [x] Improve CI to reduce needed tests
-* [x] Replace dependency to `gopkg.in/yaml.v3` (`yamlutil`)
-* [ ] Improve mangling utilities (improve readability, support for capitalized words,
-      better word substitution for non-letter symbols...)
-* [ ] Move back to this common shared pot a few of the technical features introduced by go-swagger independently
-      (e.g. mangle go package names, search package with go modules support, ...)
-* [ ] Apply a similar mono-repo approach to go-openapi/strfmt which suffer from similar woes: bloated API,
-      imposed dependency to some database driver.
-* [ ] Adapt `go-swagger` (incl. generated code) to the new `swag` API.
-* [ ] Factorize some tests, as there is a lot of redundant testing code in `jsonutils`
-* [ ] Benchmark & profiling: publish independently the tool built to analyze and chart benchmarks (e.g. similar to `benchvisual`)
-* [ ] more thorough testing for nil / null case
-* [ ] ci pipeline to manage releases
-* [ ] cleaner mockery generation (doesn't work out of the box for all sub-modules)
+<!--
+See the license [NOTICE](./NOTICE), which recalls the licensing terms of all the pieces of software
+on top of which it has been built.
+-->
+
+<!--
+
+## Limitations
+
+-->
+
+## Other documentation
+
+* [All-time contributors](./CONTRIBUTORS.md)
+* [Contributing guidelines][contributing-doc-site]
+* [Maintainers documentation][maintainers-doc-site]
+* [Code style][style-doc-site]
+
+## Cutting a new release
+
+Maintainers can cut a new release by either:
+
+* running [this workflow](https://github.com/go-openapi/swag/actions/workflows/bump-release.yml)
+* or pushing a semver tag
+  * signed tags are preferred
+  * The tag message is prepended to release notes
+
+<!-- Badges: status  -->
+[test-badge]: https://github.com/go-openapi/swag/actions/workflows/go-test.yml/badge.svg
+[test-url]: https://github.com/go-openapi/swag/actions/workflows/go-test.yml
+[cov-badge]: https://codecov.io/gh/go-openapi/swag/branch/master/graph/badge.svg
+[cov-url]: https://codecov.io/gh/go-openapi/swag
+[vuln-scan-badge]: https://github.com/go-openapi/swag/actions/workflows/scanner.yml/badge.svg
+[vuln-scan-url]: https://github.com/go-openapi/swag/actions/workflows/scanner.yml
+[codeql-badge]: https://github.com/go-openapi/swag/actions/workflows/codeql.yml/badge.svg
+[codeql-url]: https://github.com/go-openapi/swag/actions/workflows/codeql.yml
+<!-- Badges: release & docker images  -->
+[release-badge]: https://badge.fury.io/gh/go-openapi%2Fswag.svg
+[release-url]: https://badge.fury.io/gh/go-openapi%2Fswag
+[gomod-badge]: https://badge.fury.io/go/github.com%2Fgo-openapi%2Fswag.svg
+[gomod-url]: https://badge.fury.io/go/github.com%2Fgo-openapi%2Fswag
+<!-- Badges: code quality  -->
+[gocard-badge]: https://goreportcard.com/badge/github.com/go-openapi/swag
+[gocard-url]: https://goreportcard.com/report/github.com/go-openapi/swag
+[codefactor-badge]: https://img.shields.io/codefactor/grade/github/go-openapi/swag
+[codefactor-url]: https://www.codefactor.io/repository/github/go-openapi/swag
+<!-- Badges: documentation & support -->
+[doc-badge]: https://img.shields.io/badge/doc-site-blue?link=https%3A%2F%2Fgoswagger.io%2Fgo-openapi%2F
+[doc-url]: https://goswagger.io/go-openapi
+[godoc-badge]: https://pkg.go.dev/badge/github.com/go-openapi/swag
+[godoc-url]: http://pkg.go.dev/github.com/go-openapi/swag
+[discord-badge]: https://img.shields.io/discord/1446918742398341256?logo=discord&label=discord&color=blue
+[discord-url]: https://discord.gg/FfnFYaC3k5
+
+<!-- Badges: license & compliance -->
+[license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
+[license-url]: https://github.com/go-openapi/swag/?tab=Apache-2.0-1-ov-file#readme
+<!-- Badges: others & stats -->
+[goversion-badge]: https://img.shields.io/github/go-mod/go-version/go-openapi/swag
+[goversion-url]: https://github.com/go-openapi/swag/blob/master/go.mod
+[top-badge]: https://img.shields.io/github/languages/top/go-openapi/swag
+[commits-badge]: https://img.shields.io/github/commits-since/go-openapi/swag/latest
+<!-- Organization docs -->
+[contributing-doc-site]: https://go-openapi.github.io/doc-site/contributing/contributing/index.html
+[maintainers-doc-site]: https://go-openapi.github.io/doc-site/maintainers/index.html
+[style-doc-site]: https://go-openapi.github.io/doc-site/contributing/style/index.html
diff --git a/vendor/github.com/go-openapi/swag/SECURITY.md b/vendor/github.com/go-openapi/swag/SECURITY.md
index 72296a8313..1fea2c5736 100644
--- a/vendor/github.com/go-openapi/swag/SECURITY.md
+++ b/vendor/github.com/go-openapi/swag/SECURITY.md
@@ -6,14 +6,32 @@ This policy outlines the commitment and practices of the go-openapi maintainers
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 0.25.x  | :white_check_mark: |
+| O.x     | :white_check_mark: |
+
+## Vulnerability checks in place
+
+This repository uses automated vulnerability scans, at every merged commit and at least once a week.
+
+We use:
+
+* [`GitHub CodeQL`][codeql-url]
+* [`trivy`][trivy-url]
+* [`govulncheck`][govulncheck-url]
+
+Reports are centralized in github security reports and visible only to the maintainers.
 
 ## Reporting a vulnerability
 
 If you become aware of a security vulnerability that affects the current repository,
-please report it privately to the maintainers.
+**please report it privately to the maintainers**
+rather than opening a publicly visible GitHub issue.
+
+Please follow the instructions provided by github to [Privately report a security vulnerability][github-guidance-url].
 
-Please follow the instructions provided by github to
-[Privately report a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability).
+> [!NOTE]
+> On Github, navigate to the project's "Security" tab then click on "Report a vulnerability".
 
-TL;DR: on Github, navigate to the project's "Security" tab then click on "Report a vulnerability".
+[codeql-url]: https://github.com/github/codeql
+[trivy-url]: https://trivy.dev/docs/latest/getting-started
+[govulncheck-url]: https://go.dev/blog/govulncheck
+[github-guidance-url]: https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability
diff --git a/vendor/github.com/go-openapi/swag/go.work b/vendor/github.com/go-openapi/swag/go.work
index 1e537f0749..f1dddc436e 100644
--- a/vendor/github.com/go-openapi/swag/go.work
+++ b/vendor/github.com/go-openapi/swag/go.work
@@ -12,9 +12,10 @@ use (
 	./loading
 	./mangling
 	./netutils
+	./pools
 	./stringutils
 	./typeutils
 	./yamlutils
 )
 
-go 1.24.0
+go 1.25.0
diff --git a/vendor/github.com/go-openapi/swag/jsonname_iface.go b/vendor/github.com/go-openapi/swag/jsonname_iface.go
index 303a007f6f..443560caad 100644
--- a/vendor/github.com/go-openapi/swag/jsonname_iface.go
+++ b/vendor/github.com/go-openapi/swag/jsonname_iface.go
@@ -4,21 +4,21 @@
 package swag
 
 import (
-	"github.com/go-openapi/swag/jsonname"
+	"github.com/go-openapi/jsonpointer/jsonname"
 )
 
 // DefaultJSONNameProvider is the default cache for types
 //
-// Deprecated: use [jsonname.DefaultJSONNameProvider] instead.
+// Deprecated: use [github.com/go-openapi/jsonpointer/jsonname.DefaultJSONNameProvider] instead.
 var DefaultJSONNameProvider = jsonname.DefaultJSONNameProvider
 
 // NameProvider represents an object capable of translating from go property names
 // to json property names.
 //
-// Deprecated: use [jsonname.NameProvider] instead.
+// Deprecated: use [github.com/go-openapi/jsonpointer/jsonname.NameProvider] instead.
 type NameProvider = jsonname.NameProvider
 
 // NewNameProvider creates a new name provider
 //
-// Deprecated: use [jsonname.NewNameProvider] instead.
+// Deprecated: use [github.com/go-openapi/jsonpointer/jsonname.NewNameProvider] instead.
 func NewNameProvider() *NameProvider { return jsonname.NewNameProvider() }
diff --git a/vendor/github.com/go-openapi/swag/jsonutils/README.md b/vendor/github.com/go-openapi/swag/jsonutils/README.md
index d745cdb466..07a2ca1d71 100644
--- a/vendor/github.com/go-openapi/swag/jsonutils/README.md
+++ b/vendor/github.com/go-openapi/swag/jsonutils/README.md
@@ -1,11 +1,11 @@
- # jsonutils
+# jsonutils
 
 `jsonutils` exposes a few tools to work with JSON:
 
 - a fast, simple `Concat` to concatenate (not merge) JSON objects and arrays
 - `FromDynamicJSON` to convert a data structure into a "dynamic JSON" data structure
 - `ReadJSON` and `WriteJSON` behave like `json.Unmarshal` and `json.Marshal`,
-   with the ability to use another underlying serialization library through an `Adapter` 
+   with the ability to use another underlying serialization library through an `Adapter`
    configured at runtime
 - a `JSONMapSlice` structure that may be used to store JSON objects with the order of keys maintained
 
@@ -64,7 +64,7 @@ find a registered implementation that support ordered keys in objects.
 Our standard library implementation supports this.
 
 As of `v0.25.0`, we support through such an adapter the popular `mailru/easyjson`
-library, which kicks in when the passed values support the `easyjson.Unmarshaler` 
+library, which kicks in when the passed values support the `easyjson.Unmarshaler`
 or `easyjson.Marshaler` interfaces.
 
 In the future, we plan to add more similar libraries that compete on the go JSON
@@ -77,8 +77,9 @@ In package `github.com/go-openapi/swag/easyjson/adapters`, several adapters are
 Each adapter is an independent go module. Hence you'll pick its dependencies only if you import it.
 
 At this moment we provide:
-* `stdlib`: JSON adapter based on the standard library
-* `easyjson`: JSON adapter based on the `github.com/mailru/easyjson`
+
+- `stdlib`: JSON adapter based on the standard library
+- `easyjson`: JSON adapter based on the `github.com/mailru/easyjson`
 
 The adapters provide the basic `Marshal` and `Unmarshal` capabilities, plus an implementation
 of the `MapSlice` pattern.
diff --git a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/adapter.go b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/adapter.go
index 0213ff5c29..94185f79c1 100644
--- a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/adapter.go
+++ b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/adapter.go
@@ -5,6 +5,7 @@ package json
 
 import (
 	stdjson "encoding/json"
+	"fmt"
 
 	"github.com/go-openapi/swag/jsonutils/adapters/ifaces"
 	"github.com/go-openapi/swag/typeutils"
@@ -24,11 +25,16 @@ var ErrStdlib jsonError = "error from the JSON adapter stdlib"
 var _ ifaces.Adapter = &Adapter{}
 
 type Adapter struct {
+	options
 }
 
 // NewAdapter yields an [ifaces.Adapter] using the standard library.
-func NewAdapter() *Adapter {
-	return &Adapter{}
+func NewAdapter(opts ...Option) *Adapter {
+	var o options
+
+	return &Adapter{
+		options: buildOptions(o, opts),
+	}
 }
 
 func (a *Adapter) Marshal(value any) ([]byte, error) {
@@ -40,45 +46,18 @@ func (a *Adapter) Unmarshal(data []byte, value any) error {
 }
 
 func (a *Adapter) OrderedMarshal(value ifaces.Ordered) ([]byte, error) {
-	w := poolOfWriters.Borrow()
-	defer func() {
-		poolOfWriters.Redeem(w)
-	}()
-
-	if typeutils.IsNil(value) {
-		w.RawString("null")
-
-		return w.BuildBytes()
-	}
-
-	w.RawByte('{')
-	first := true
-	for k, v := range value.OrderedItems() {
-		if first {
-			first = false
-		} else {
-			w.RawByte(',')
-		}
+	w, redeem := poolOfWriters.BorrowWithRedeem()
+	defer redeem()
+	w.setBuf()
 
-		w.String(k)
-		w.RawByte(':')
-
-		switch val := v.(type) {
-		case ifaces.Ordered:
-			w.Raw(a.OrderedMarshal(val))
-		default:
-			w.Raw(stdjson.Marshal(v))
-		}
-	}
-
-	w.RawByte('}')
+	a.orderedMarshal(w, value, 1)
 
 	return w.BuildBytes()
 }
 
 func (a *Adapter) OrderedUnmarshal(data []byte, value ifaces.SetOrdered) error {
 	var m MapSlice
-	if err := m.OrderedUnmarshalJSON(data); err != nil {
+	if err := m.orderedUnmarshalJSON(data, a.maxDepth()); err != nil {
 		return err
 	}
 
@@ -112,4 +91,43 @@ func (a *Adapter) Redeem() {
 }
 
 func (a *Adapter) Reset() {
+	a.options = options{}
+}
+
+// orderedMarshal writes value to w, tracking the container nesting depth to guard
+// against stack overflow on deeply nested structures.
+func (a *Adapter) orderedMarshal(w *jwriter, value ifaces.Ordered, depth int) {
+	if typeutils.IsNil(value) {
+		w.RawString("null")
+
+		return
+	}
+
+	if maxDepth := a.maxDepth(); depth > maxDepth {
+		w.SetErr(fmt.Errorf("maximum nesting depth of %d exceeded: %w", maxDepth, ErrStdlib))
+
+		return
+	}
+
+	w.RawByte('{')
+	first := true
+	for k, v := range value.OrderedItems() {
+		if first {
+			first = false
+		} else {
+			w.RawByte(',')
+		}
+
+		w.String(k)
+		w.RawByte(':')
+
+		switch val := v.(type) {
+		case ifaces.Ordered:
+			a.orderedMarshal(w, val, depth+1)
+		default:
+			w.Raw(stdjson.Marshal(v))
+		}
+	}
+
+	w.RawByte('}')
 }
diff --git a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/lexer.go b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/lexer.go
index b5aa1c7972..ac81cbc75f 100644
--- a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/lexer.go
+++ b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/lexer.go
@@ -54,7 +54,7 @@ func (t token) Delim() byte {
 		return 0
 	}
 
-	return byte(r)
+	return byte(r) //nolint:gosec // delimiter runes are single byte
 }
 
 type tokenKind uint8
@@ -91,6 +91,13 @@ type jlexer struct {
 	// current token
 	next token
 	// started bool
+
+	// depth tracks the current JSON container nesting level, and maxDepth caps it
+	// to guard against stack-overflow on adversarially deep documents. The standard
+	// library's streaming [encoding/json.Decoder.Token] API (used here) does not
+	// enforce the max-depth guard that [encoding/json.Unmarshal] provides, so we do.
+	depth    int
+	maxDepth int
 }
 
 type bytesReader struct {
@@ -130,7 +137,8 @@ var _ io.Reader = &bytesReader{}
 func newLexer(data []byte) *jlexer {
 	l := &jlexer{
 		// current: undefToken,
-		next: undefToken,
+		next:     undefToken,
+		maxDepth: defaultMaxNestingDepth,
 	}
 	l.buf = &bytesReader{
 		buf: data,
@@ -143,7 +151,11 @@ func newLexer(data []byte) *jlexer {
 func (l *jlexer) Reset() {
 	l.err = nil
 	l.next = undefToken
-	// leave l.dec and l.buf alone, since they are replaced at every Borrow
+	l.depth = 0
+	l.maxDepth = defaultMaxNestingDepth
+	l.dec = nil
+	// leave l.buf alone, since they are replaced at every Borrow
+	l.buf = nil
 }
 
 func (l *jlexer) Error() error {
@@ -228,6 +240,21 @@ func (l *jlexer) Delim(c byte) {
 
 	if tok.Delim() != c {
 		l.err = fmt.Errorf("expected delimiter '%q' but got '%q': %w", c, tok.Delim(), ErrStdlib)
+
+		return
+	}
+
+	// Track container nesting depth centrally: every '{' or '[' opens a level and
+	// every '}' or ']' closes one. This guards the mutually-recursive unmarshal
+	// routines (unmarshalObject/unmarshalArray/asInterface) against stack overflow.
+	switch c {
+	case '{', '[':
+		l.depth++
+		if l.maxDepth > 0 && l.depth > l.maxDepth {
+			l.err = fmt.Errorf("maximum nesting depth of %d exceeded: %w", l.maxDepth, ErrStdlib)
+		}
+	case '}', ']':
+		l.depth--
 	}
 }
 
@@ -318,3 +345,12 @@ func (l *jlexer) fetchToken() token {
 
 	return token{Token: jtok}
 }
+
+func (l *jlexer) setBuf(data []byte) func() {
+	rdr, redeemBuf := poolOfReaders.BorrowWithRedeem()
+	l.buf = rdr
+	l.buf.buf = data
+	l.dec = stdjson.NewDecoder(l.buf) // cannot pool, not exposed by the encoding/json API
+
+	return redeemBuf
+}
diff --git a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/options.go b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/options.go
new file mode 100644
index 0000000000..f114f1f1a1
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/options.go
@@ -0,0 +1,52 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package json
+
+// defaultMaxNestingDepth is the default maximum number of nested JSON containers
+// ('{' or '[') that the ordered-JSON marshaler and unmarshaler will process before
+// returning an error.
+//
+// It mirrors the limit enforced by the standard library's [encoding/json] decoder
+// (see encoding/json's internal maxNestingDepth), which this adapter would otherwise
+// not benefit from since it drives [encoding/json.Decoder.Token] directly.
+const defaultMaxNestingDepth = 10000
+
+// Option selects options for the stdlib adapter.
+type Option func(o options) options
+
+type options struct {
+	maxNestingDepth int
+}
+
+func buildOptions(o options, opts []Option) options {
+	for _, apply := range opts {
+		o = apply(o)
+	}
+
+	return o
+}
+
+// maxDepth returns the configured maximum nesting depth, or the default when unset.
+func (o options) maxDepth() int {
+	if o.maxNestingDepth <= 0 {
+		return defaultMaxNestingDepth
+	}
+
+	return o.maxNestingDepth
+}
+
+// WithMaxNestingDepth sets the maximum number of nested JSON containers accepted
+// when marshaling or unmarshaling ordered JSON.
+//
+// A value <= 0 selects the default (10,000).
+//
+// This guards against stack-overflow crashes on deeply nested (possibly adversarial)
+// JSON documents or in-memory structures.
+func WithMaxNestingDepth(depth int) Option {
+	return func(o options) options {
+		o.maxNestingDepth = depth
+
+		return o
+	}
+}
diff --git a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/ordered_map.go b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/ordered_map.go
index 54deef406f..a5a8f4b631 100644
--- a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/ordered_map.go
+++ b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/ordered_map.go
@@ -70,12 +70,11 @@ func (s MapSlice) MarshalJSON() ([]byte, error) {
 }
 
 func (s MapSlice) OrderedMarshalJSON() ([]byte, error) {
-	w := poolOfWriters.Borrow()
-	defer func() {
-		poolOfWriters.Redeem(w)
-	}()
+	w, redeem := poolOfWriters.BorrowWithRedeem()
+	defer redeem()
+	w.setBuf()
 
-	s.marshalObject(w)
+	s.marshalObject(w, 1)
 
 	return w.BuildBytes() // this clones data, so it's okay to redeem the writer and its buffer
 }
@@ -88,23 +87,38 @@ func (s *MapSlice) UnmarshalJSON(data []byte) error {
 }
 
 func (s *MapSlice) OrderedUnmarshalJSON(data []byte) error {
-	l := poolOfLexers.Borrow(data)
-	defer func() {
-		poolOfLexers.Redeem(l)
-	}()
+	return s.orderedUnmarshalJSON(data, defaultMaxNestingDepth)
+}
+
+func (s *MapSlice) orderedUnmarshalJSON(data []byte, maxDepth int) error {
+	l, redeem := poolOfLexers.BorrowWithRedeem()
+	defer redeem()
+
+	redeemBuf := l.setBuf(data)
+	defer redeemBuf()
+
+	if maxDepth > 0 {
+		l.maxDepth = maxDepth
+	}
 
 	s.unmarshalObject(l)
 
 	return l.Error()
 }
 
-func (s MapSlice) marshalObject(w *jwriter) {
+func (s MapSlice) marshalObject(w *jwriter, depth int) {
 	if s == nil {
 		w.RawString("null")
 
 		return
 	}
 
+	if depth > defaultMaxNestingDepth {
+		w.SetErr(fmt.Errorf("maximum nesting depth of %d exceeded: %w", defaultMaxNestingDepth, ErrStdlib))
+
+		return
+	}
+
 	w.RawByte('{')
 
 	if len(s) == 0 {
@@ -113,11 +127,11 @@ func (s MapSlice) marshalObject(w *jwriter) {
 		return
 	}
 
-	s[0].marshalJSON(w)
+	s[0].marshalJSON(w, depth)
 
 	for i := 1; i < len(s); i++ {
 		w.RawByte(',')
-		s[i].marshalJSON(w)
+		s[i].marshalJSON(w, depth)
 	}
 
 	w.RawByte('}')
@@ -162,9 +176,18 @@ type MapItem struct {
 	Value any
 }
 
-func (s MapItem) marshalJSON(w *jwriter) {
+func (s MapItem) marshalJSON(w *jwriter, depth int) {
 	w.String(s.Key)
 	w.RawByte(':')
+
+	// Recurse internally for nested ordered maps so the depth guard is not lost across
+	// the stdjson.Marshal boundary (which would reset it and re-enable stack overflow).
+	if nested, ok := s.Value.(MapSlice); ok {
+		nested.marshalObject(w, depth+1)
+
+		return
+	}
+
 	w.Raw(stdjson.Marshal(s.Value))
 }
 
diff --git a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/pool.go b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/pool.go
index 709b97c304..2f06b88e80 100644
--- a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/pool.go
+++ b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/pool.go
@@ -4,118 +4,15 @@
 package json
 
 import (
-	"encoding/json"
-	"sync"
-
 	"github.com/go-openapi/swag/jsonutils/adapters/ifaces"
+	"github.com/go-openapi/swag/pools"
 )
 
-type adaptersPool struct {
-	sync.Pool
-}
-
-func (p *adaptersPool) Borrow() *Adapter {
-	return p.Get().(*Adapter)
-}
-
-func (p *adaptersPool) BorrowIface() ifaces.Adapter {
-	return p.Get().(*Adapter)
-}
-
-func (p *adaptersPool) Redeem(a *Adapter) {
-	p.Put(a)
-}
-
-type writersPool struct {
-	sync.Pool
-}
-
-func (p *writersPool) Borrow() *jwriter {
-	ptr := p.Get()
-
-	jw := ptr.(*jwriter)
-	jw.Reset()
-
-	return jw
-}
-
-func (p *writersPool) Redeem(w *jwriter) {
-	p.Put(w)
-}
-
-type lexersPool struct {
-	sync.Pool
-}
-
-func (p *lexersPool) Borrow(data []byte) *jlexer {
-	ptr := p.Get()
-
-	l := ptr.(*jlexer)
-	l.buf = poolOfReaders.Borrow(data)
-	l.dec = json.NewDecoder(l.buf) // cannot pool, not exposed by the encoding/json API
-	l.Reset()
-
-	return l
-}
-
-func (p *lexersPool) Redeem(l *jlexer) {
-	l.dec = nil
-	discard := l.buf
-	l.buf = nil
-	poolOfReaders.Redeem(discard)
-	p.Put(l)
-}
-
-type readersPool struct {
-	sync.Pool
-}
-
-func (p *readersPool) Borrow(data []byte) *bytesReader {
-	ptr := p.Get()
-
-	b := ptr.(*bytesReader)
-	b.Reset()
-	b.buf = data
-
-	return b
-}
-
-func (p *readersPool) Redeem(b *bytesReader) {
-	p.Put(b)
-}
-
 var (
-	poolOfAdapters = &adaptersPool{
-		Pool: sync.Pool{
-			New: func() any {
-				return NewAdapter()
-			},
-		},
-	}
-
-	poolOfWriters = &writersPool{
-		Pool: sync.Pool{
-			New: func() any {
-				return newJWriter()
-			},
-		},
-	}
-
-	poolOfLexers = &lexersPool{
-		Pool: sync.Pool{
-			New: func() any {
-				return newLexer(nil)
-			},
-		},
-	}
-
-	poolOfReaders = &readersPool{
-		Pool: sync.Pool{
-			New: func() any {
-				return &bytesReader{}
-			},
-		},
-	}
+	poolOfAdapters = pools.New[Adapter]()
+	poolOfWriters  = pools.NewRedeemable[jwriter]()
+	poolOfLexers   = pools.NewRedeemable[jlexer]()
+	poolOfReaders  = pools.NewRedeemable[bytesReader]()
 )
 
 // BorrowAdapter borrows an [Adapter] from the pool, recycling already allocated instances.
@@ -124,10 +21,12 @@ func BorrowAdapter() *Adapter {
 }
 
 // BorrowAdapterIface borrows a stdlib [Adapter] and converts it directly
-// to [ifaces.Adapter]. This is useful to avoid further allocations when
-// translating the concrete type into an interface.
+// to [ifaces.Adapter].
+//
+// This is useful to avoid further allocations when translating the concrete type into
+// an interface.
 func BorrowAdapterIface() ifaces.Adapter {
-	return poolOfAdapters.BorrowIface()
+	return poolOfAdapters.Borrow()
 }
 
 // RedeemAdapter redeems an [Adapter] to the pool, so it may be recycled.
diff --git a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/register.go b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/register.go
index fc8818694e..0dec85425b 100644
--- a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/register.go
+++ b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/register.go
@@ -10,14 +10,22 @@ import (
 	"github.com/go-openapi/swag/jsonutils/adapters/ifaces"
 )
 
-func Register(dispatcher ifaces.Registrar) {
+func Register(dispatcher ifaces.Registrar, opts ...Option) {
 	t := reflect.TypeOf(Adapter{})
+	var o options
+	o = buildOptions(o, opts)
+
 	dispatcher.RegisterFor(
 		ifaces.RegistryEntry{
-			Who:         fmt.Sprintf("%s.%s", t.PkgPath(), t.Name()),
-			What:        ifaces.AllCapabilities,
-			Constructor: BorrowAdapterIface,
-			Support:     support,
+			Who:  fmt.Sprintf("%s.%s", t.PkgPath(), t.Name()),
+			What: ifaces.AllCapabilities,
+			Constructor: func() ifaces.Adapter {
+				a := BorrowAdapter()
+				a.options = o
+
+				return a
+			},
+			Support: support,
 		})
 }
 
diff --git a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/writer.go b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/writer.go
index dc2325c1a3..c84e02cd83 100644
--- a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/writer.go
+++ b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/writer.go
@@ -14,17 +14,21 @@ type jwriter struct {
 	err error
 }
 
-func newJWriter() *jwriter {
-	buf := make([]byte, 0, sensibleBufferSize)
-
-	return &jwriter{buf: bytes.NewBuffer(buf)}
-}
-
 func (w *jwriter) Reset() {
-	w.buf.Reset()
+	if w.buf != nil {
+		w.buf.Reset()
+	}
 	w.err = nil
 }
 
+// SetErr records the first error encountered while building the JSON output.
+func (w *jwriter) SetErr(err error) {
+	if w.err != nil {
+		return
+	}
+	w.err = err
+}
+
 func (w *jwriter) RawString(s string) {
 	if w.err != nil {
 		return
@@ -73,3 +77,12 @@ func (w *jwriter) BuildBytes() ([]byte, error) {
 
 	return bytes.Clone(w.buf.Bytes()), nil
 }
+
+func (w *jwriter) setBuf() {
+	if w.buf != nil {
+		return
+	}
+
+	buf := make([]byte, 0, sensibleBufferSize)
+	w.buf = bytes.NewBuffer(buf)
+}
diff --git a/vendor/github.com/go-openapi/swag/loading/doc.go b/vendor/github.com/go-openapi/swag/loading/doc.go
index 8cf7bcb8b9..112c49968b 100644
--- a/vendor/github.com/go-openapi/swag/loading/doc.go
+++ b/vendor/github.com/go-openapi/swag/loading/doc.go
@@ -2,4 +2,28 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // Package loading provides tools to load a file from http or from a local file system.
+//
+// # Security
+//
+// By default, the local loader reads any path the process can access, including absolute
+// paths and "file://" URIs (for example "file:///etc/passwd"). Applications that pass
+// untrusted input to [LoadFromFileOrHTTP], [JSONDoc] (or to downstream consumers such as
+// go-openapi/loads) must confine local loading to a trusted directory.
+//
+// Use [WithRoot] to do so: it resolves every requested path relative to a chosen directory
+// and rejects anything that escapes it, including via symlink. It is built on [os.Root]
+// and is therefore safer than passing an [os.DirFS] to [WithFS], which does not block
+// symlink escapes.
+//
+// Remote loading uses a standard [net/http] client.
+// By default it follows redirects and performs no destination filtering — exactly like [net/http.DefaultClient].
+//
+// A caller-controlled URL may therefore reach internal services or cloud metadata endpoints
+// (server-side request forgery).
+//
+// This package does not, and should not, embed a network policy:
+// when the URL may derive from untrusted input, supply a restricted client with
+// [WithHTTPClient] whose transport rejects unwanted destinations at dial time — which also
+// covers redirects and DNS rebinding.
+// See the example on [LoadFromFileOrHTTP].
 package loading
diff --git a/vendor/github.com/go-openapi/swag/loading/loading.go b/vendor/github.com/go-openapi/swag/loading/loading.go
index 269fb74d16..0b38ac1e38 100644
--- a/vendor/github.com/go-openapi/swag/loading/loading.go
+++ b/vendor/github.com/go-openapi/swag/loading/loading.go
@@ -17,7 +17,11 @@ import (
 	"strings"
 )
 
-// LoadFromFileOrHTTP loads the bytes from a file or a remote http server based on the path passed in
+// LoadFromFileOrHTTP loads the bytes from a file or a remote http server based on the path passed in.
+//
+// Security: by default a local path is read with no confinement, so a caller-controlled path
+// (including a "file://" URI or an absolute path) may read any file the process can access.
+// When the path may derive from untrusted input, confine local loading with [WithRoot].
 func LoadFromFileOrHTTP(pth string, opts ...Option) ([]byte, error) {
 	o := optionsWithDefaults(opts)
 	return LoadStrategy(pth, o.ReadFileFunc(), loadHTTPBytes(opts...), opts...)(pth)
@@ -54,11 +58,14 @@ func LoadFromFileOrHTTP(pth string, opts ...Option) ([]byte, error) {
 // - `file:///c:/folder/file` becomes `C:\folder\file`
 // - `file://c:/folder/file` is tolerated (without leading `/`) and becomes `c:\folder\file`
 func LoadStrategy(pth string, local, remote func(string) ([]byte, error), opts ...Option) func(string) ([]byte, error) {
-	if strings.HasPrefix(pth, "http") {
+	if hasHTTPScheme(pth) {
 		return remote
 	}
 	o := optionsWithDefaults(opts)
 	_, isEmbedFS := o.fs.(embed.FS)
+	// any loader backed by an fs.FS or an os.Root consumes forward-slash paths on every
+	// platform, so it must not go through the windows-native file:// preprocessing below.
+	isFSBacked := o.fs != nil || o.root != ""
 
 	return func(p string) ([]byte, error) {
 		upth, err := url.PathUnescape(p)
@@ -67,14 +74,20 @@ func LoadStrategy(pth string, local, remote func(string) ([]byte, error), opts .
 		}
 
 		cpth, hasPrefix := strings.CutPrefix(upth, "file://")
-		if !hasPrefix || isEmbedFS || runtime.GOOS != "windows" {
+		if !hasPrefix || isFSBacked || runtime.GOOS != "windows" {
 			// crude processing: trim the file:// prefix. This leaves full URIs with a host with a (mostly) unexpected result
 			// regular file path provided: just normalize slashes
 			if isEmbedFS {
-				// on windows, we need to slash the path if FS is an embed FS.
+				// embed.FS always uses "/" as separator, even on windows, and rejects leading "./" or "/".
 				return local(strings.TrimLeft(filepath.ToSlash(cpth), "./")) // remove invalid leading characters for embed FS
 			}
 
+			if isFSBacked {
+				// other fs.FS (e.g. os.DirFS) and os.Root loaders also use "/" on every platform.
+				// Escaping paths (absolute, "..", escaping symlinks) are rejected by the loader, not rewritten here.
+				return local(filepath.ToSlash(cpth))
+			}
+
 			return local(filepath.FromSlash(cpth))
 		}
 
@@ -113,6 +126,21 @@ func LoadStrategy(pth string, local, remote func(string) ([]byte, error), opts .
 	}
 }
 
+// hasHTTPScheme reports whether pth is an absolute URL with an http or https scheme,
+// selecting the remote loader. The comparison is case-insensitive, as URL schemes are.
+//
+// Requiring the "://" separator (rather than a bare "http" prefix) avoids misrouting a
+// local file whose name merely starts with "http" (e.g. "httpbin.json") to the remote loader.
+func hasHTTPScheme(pth string) bool {
+	for _, scheme := range [...]string{"http://", "https://"} {
+		if len(pth) >= len(scheme) && strings.EqualFold(pth[:len(scheme)], scheme) {
+			return true
+		}
+	}
+
+	return false
+}
+
 func loadHTTPBytes(opts ...Option) func(path string) ([]byte, error) {
 	o := optionsWithDefaults(opts)
 
diff --git a/vendor/github.com/go-openapi/swag/loading/options.go b/vendor/github.com/go-openapi/swag/loading/options.go
index 6674ac69e6..2c12823172 100644
--- a/vendor/github.com/go-openapi/swag/loading/options.go
+++ b/vendor/github.com/go-openapi/swag/loading/options.go
@@ -4,6 +4,7 @@
 package loading
 
 import (
+	"errors"
 	"io/fs"
 	"net/http"
 	"os"
@@ -23,7 +24,8 @@ type (
 	}
 
 	fileOptions struct {
-		fs fs.ReadFileFS
+		fs   fs.ReadFileFS
+		root string // when non-empty, local reads are confined to this directory via os.Root
 	}
 
 	options struct {
@@ -33,6 +35,20 @@ type (
 )
 
 func (fo fileOptions) ReadFileFunc() func(string) ([]byte, error) {
+	if fo.root != "" {
+		root := fo.root
+
+		return func(name string) ([]byte, error) {
+			r, err := os.OpenRoot(root)
+			if err != nil {
+				return nil, errors.Join(err, ErrLoader)
+			}
+			defer func() { _ = r.Close() }()
+
+			return r.ReadFile(name)
+		}
+	}
+
 	if fo.fs == nil {
 		return os.ReadFile
 	}
@@ -87,8 +103,15 @@ func WithHTTPClient(client *http.Client) Option {
 // By default, the file system is the one provided by the os package.
 //
 // For example, this may be set to consume from an embedded file system, or a rooted FS.
+//
+// WithFS and [WithRoot] are mutually exclusive: the last one applied wins.
+//
+// Security note: a file system built from [os.DirFS] confines paths but does NOT protect
+// against symlinks that escape the root. To load from a directory derived from untrusted
+// input, prefer [WithRoot], which is symlink-escape resistant.
 func WithFS(filesystem fs.FS) Option {
 	return func(o *options) {
+		o.root = "" // last-wins vs WithRoot
 		if rfs, ok := filesystem.(fs.ReadFileFS); ok {
 			o.fs = rfs
 
@@ -98,6 +121,28 @@ func WithFS(filesystem fs.FS) Option {
 	}
 }
 
+// WithRoot confines local file loading to dir.
+//
+// Every requested path is resolved relative to dir, and any path that would escape dir —
+// whether through an absolute path, ".." traversal, or a symlink pointing outside dir — is
+// rejected. This is built on [os.Root] and is therefore resistant to the symlink escapes
+// that a plain [os.DirFS] does not prevent.
+//
+// WithRoot is the recommended option when loading specs from a location derived from
+// untrusted input. It applies to local loading only and has no effect on remote
+// (http/https) loading. WithRoot and [WithFS] are mutually exclusive: the last one applied
+// wins.
+//
+// Note: [os.Root] confines path resolution but does not, by itself, protect against
+// traversal of mount/bind boundaries, /proc special files, or device files. Point WithRoot
+// at a directory that holds only the documents you intend to expose.
+func WithRoot(dir string) Option {
+	return func(o *options) {
+		o.root = dir
+		o.fs = nil // last-wins vs WithFS
+	}
+}
+
 type readFileFS struct {
 	fs.FS
 }
diff --git a/vendor/github.com/go-openapi/swag/loading_iface.go b/vendor/github.com/go-openapi/swag/loading_iface.go
index 27ec3fb8c3..78dadfccdf 100644
--- a/vendor/github.com/go-openapi/swag/loading_iface.go
+++ b/vendor/github.com/go-openapi/swag/loading_iface.go
@@ -80,11 +80,13 @@ func YAMLData(path string) (any, error) {
 // loadingOptionsWithDefaults bridges deprecated default settings that use package-level variables,
 // with the recommended use of loading.Option.
 func loadingOptionsWithDefaults(opts []loading.Option) []loading.Option {
-	o := []loading.Option{
+	const defaultOptions = 3
+	o := make([]loading.Option, 0, defaultOptions+len(opts))
+	o = append(o, []loading.Option{
 		loading.WithTimeout(LoadHTTPTimeout),
 		loading.WithBasicAuth(LoadHTTPBasicAuthUsername, LoadHTTPBasicAuthPassword),
 		loading.WithCustomHeaders(LoadHTTPCustomHeaders),
-	}
+	}...)
 	o = append(o, opts...)
 
 	return o
diff --git a/vendor/github.com/go-openapi/swag/mangling/BENCHMARK.md b/vendor/github.com/go-openapi/swag/mangling/BENCHMARK.md
index 6674c63b72..abe6e9533e 100644
--- a/vendor/github.com/go-openapi/swag/mangling/BENCHMARK.md
+++ b/vendor/github.com/go-openapi/swag/mangling/BENCHMARK.md
@@ -4,7 +4,7 @@
 go test -bench XXX -run XXX -benchtime 30s
 ```
 
-## Benchmarks at b3e7a5386f996177e4808f11acb2aa93a0f660df
+## Benchmarks at `b3e7a5386f996177e4808f11acb2aa93a0f660df`
 
 ```
 goos: linux
@@ -49,7 +49,7 @@ BenchmarkToXXXName/ToHumanNameLower-16 	18599661	      1946 ns/op	      92 B/op
 BenchmarkToXXXName/ToHumanNameTitle-16 	17581353	      2054 ns/op	     105 B/op	       6 allocs/op
 ```
 
-## Benchmarks at d7d2d1b895f5b6747afaff312dd2a402e69e818b
+## Benchmarks at `d7d2d1b895f5b6747afaff312dd2a402e69e818b`
 
 go1.24
 
diff --git a/vendor/github.com/go-openapi/swag/pools/LICENSE b/vendor/github.com/go-openapi/swag/pools/LICENSE
new file mode 100644
index 0000000000..d645695673
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/pools/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/go-openapi/swag/pools/README.md b/vendor/github.com/go-openapi/swag/pools/README.md
new file mode 100644
index 0000000000..1966461cb5
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/pools/README.md
@@ -0,0 +1 @@
+# pools
diff --git a/vendor/github.com/go-openapi/swag/pools/debug.go b/vendor/github.com/go-openapi/swag/pools/debug.go
new file mode 100644
index 0000000000..94415e989e
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/pools/debug.go
@@ -0,0 +1,17 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package pools
+
+// TB is the subset of [testing.TB] used by [AssertNoLeaks].
+//
+// It is satisfied by *[testing.T] and *[testing.B].
+//
+// A local interface is used (rather than importing "testing") so that the
+// release build does not pull the testing package — and its flags — into
+// production binaries.
+type TB interface {
+	Helper()
+	Errorf(format string, args ...any)
+	Logf(format string, args ...any)
+}
diff --git a/vendor/github.com/go-openapi/swag/pools/debug_off.go b/vendor/github.com/go-openapi/swag/pools/debug_off.go
new file mode 100644
index 0000000000..9163d6d60e
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/pools/debug_off.go
@@ -0,0 +1,51 @@
+//go:build !poolsdebug
+
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package pools
+
+// This is the release implementation of the pool instrumentation: it does
+// nothing.
+//
+// tracker is an empty struct, so it adds no field to the pool types and its
+// methods inline away to nothing.
+//
+// Build with -tags poolsdebug to get the instrumented variant (see
+// debug_on.go).
+
+// debugBuild reports whether the pool instrumentation is compiled in (the
+// poolsdebug tag).
+const debugBuild = false
+
+// DebugBuild reports whether the pool instrumentation is compiled in (the
+// poolsdebug build tag).
+//
+// It lets a test that must run in both modes skip the parts that are invalid
+// under instrumentation — e.g. an allocation-count assertion, since the
+// instrumented build allocates a per-borrow tracker.
+const DebugBuild = debugBuild
+
+type tracker[T any] struct{}
+
+func (tracker[T]) register() {}
+
+func (tracker[T]) onBorrow(*T) {}
+
+func (tracker[T]) onRedeem(*T) {}
+
+func (tracker[T]) borrowRedeemer(_ *T, cached func()) func() { return cached }
+
+// AssertNoLeaks reports whether every borrowed object has been redeemed across
+// all pools.
+//
+// It is only meaningful in the instrumented build (-tags poolsdebug).
+//
+// In a release build it is a no-op that always reports true, so the same test
+// can run in both modes.
+func AssertNoLeaks(TB) bool { return true }
+
+// ResetTracking clears all recorded borrow/redeem tracking.
+//
+// This is a no-op in a release build.
+func ResetTracking() {}
diff --git a/vendor/github.com/go-openapi/swag/pools/debug_on.go b/vendor/github.com/go-openapi/swag/pools/debug_on.go
new file mode 100644
index 0000000000..64ccc57d38
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/pools/debug_on.go
@@ -0,0 +1,237 @@
+//go:build poolsdebug
+
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package pools
+
+import (
+	"fmt"
+	"runtime"
+	"sync"
+)
+
+// This is the instrumented implementation of the pool tracking, enabled with
+// -tags poolsdebug.
+//
+// Each pool carries a tracker that records, per recycled pointer, whether it is
+// currently borrowed or redeemed, together with the call sites of the last
+// borrow and redeem.
+// It panics loudly (with those call sites) when it detects misuse:
+//
+//   - a double redeem (the same object returned to the pool twice — corrupts sync.Pool);
+//   - for the redeemable pools, a redeem of a stale borrow (the slot was re-borrowed since — the
+//     ABA case the production atomic guard cannot catch), thanks to a per-borrow generation;
+//   - a redeem of an object the pool never handed out;
+//   - a borrow of an object still checked out (a symptom of an earlier double-Put).
+//
+// Borrowed-but-never-redeemed objects (leaks) are reported by [AssertNoLeaks].
+
+// debugBuild reports whether the pool instrumentation is compiled in (the
+// poolsdebug tag).
+const debugBuild = true
+
+// DebugBuild reports whether the pool instrumentation is compiled in (the
+// poolsdebug build tag).
+//
+// See the release-build doc for usage.
+const DebugBuild = debugBuild
+
+type trackStatus uint8
+
+const (
+	trackBorrowed trackStatus = iota + 1
+	trackRedeemed
+)
+
+type trackEntry struct {
+	status     trackStatus
+	gen        uint64 // identifies the current borrow, to detect a redeem racing a re-borrow (ABA)
+	borrowedAt string
+	redeemedAt string
+}
+
+type tracker[T any] struct {
+	mu      sync.Mutex
+	entries map[*T]*trackEntry
+	nextGen uint64
+}
+
+func (t *tracker[T]) register() {
+	t.mu.Lock()
+	if t.entries == nil {
+		t.entries = make(map[*T]*trackEntry)
+	}
+	t.mu.Unlock()
+
+	registerLeakChecker(t)
+}
+
+// markBorrow records a borrow of ptr and returns its generation.
+//
+// Caller must hold no lock.
+func (t *tracker[T]) markBorrow(ptr *T, site string) uint64 {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	e := t.entries[ptr]
+	if e == nil {
+		e = &trackEntry{}
+		t.entries[ptr] = e
+	} else if e.status == trackBorrowed {
+		panic(fmt.Sprintf(
+			"pools: borrow of an object still checked out (borrowed at %s); "+
+				"this usually means it was redeemed twice earlier", e.borrowedAt))
+	}
+
+	t.nextGen++
+	e.status = trackBorrowed
+	e.gen = t.nextGen
+	e.borrowedAt = site
+
+	return t.nextGen
+}
+
+// markRedeem validates and records a redeem of ptr. gen is the borrow
+// generation the caller is redeeming, or 0 to skip the ABA check (plain
+// Pool[T], which has no per-borrow token).
+func (t *tracker[T]) markRedeem(ptr *T, gen uint64, site string) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	e := t.entries[ptr]
+	switch {
+	case e == nil:
+		panic("pools: redeem of an object this pool never handed out")
+	case e.status != trackBorrowed:
+		panic(fmt.Sprintf("pools: double redeem (first redeemed at %s)", e.redeemedAt))
+	case gen != 0 && e.gen != gen:
+		panic(fmt.Sprintf(
+			"pools: redeem of a stale borrow (the slot was re-borrowed at %s since this borrow); "+
+				"a redeem is racing a re-borrow of the same slot (ABA)", e.borrowedAt))
+	}
+
+	e.status = trackRedeemed
+	e.redeemedAt = site
+}
+
+const stackOffset = 3
+
+func (t *tracker[T]) onBorrow(ptr *T) {
+	t.markBorrow(ptr, caller(stackOffset))
+}
+
+func (t *tracker[T]) onRedeem(ptr *T) {
+	t.markRedeem(ptr, 0, caller(stackOffset))
+}
+
+// borrowRedeemer records the borrow and returns a generation-stamped redeemer
+// that validates the redeem (catching double-redeem and ABA) before delegating
+// to the cached redeemer.
+func (t *tracker[T]) borrowRedeemer(ptr *T, cached func()) func() {
+	gen := t.markBorrow(ptr, caller(stackOffset))
+
+	return func() {
+		t.markRedeem(ptr, gen, caller(stackOffset-1))
+		cached()
+	}
+}
+
+func (t *tracker[T]) checkLeaks(tb TB) bool {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	ok := true
+	for _, e := range t.entries {
+		if e.status != trackRedeemed {
+			tb.Logf("pools: object borrowed but never redeemed (borrowed at %s)", e.borrowedAt)
+			ok = false
+		}
+	}
+
+	return ok
+}
+
+func (t *tracker[T]) resetTracking() {
+	t.mu.Lock()
+	t.entries = make(map[*T]*trackEntry)
+	t.nextGen = 0
+	t.mu.Unlock()
+}
+
+// leakChecker is the build-erased view of a tracker that the global registry
+// holds, so trackers of different element types can be checked uniformly.
+type leakChecker interface {
+	checkLeaks(tb TB) bool
+	resetTracking()
+}
+
+var (
+	registryMu sync.Mutex
+	registry   []leakChecker
+)
+
+func registerLeakChecker(c leakChecker) {
+	registryMu.Lock()
+	registry = append(registry, c)
+	registryMu.Unlock()
+}
+
+// AssertNoLeaks reports whether every borrowed object has been redeemed across
+// all pools created so far.
+//
+// It logs the borrow call site of each leaked object and fails tb when any are
+// found.
+//
+// Typical use, with [ResetTracking] to isolate the test from earlier ones:
+//
+//	func TestX(t *testing.T) {
+//		pools.ResetTracking()
+//		t.Cleanup(func() { pools.AssertNoLeaks(t) })
+//		// ... exercise code that borrows/redeems ...
+//	}
+func AssertNoLeaks(tb TB) bool {
+	tb.Helper()
+	registryMu.Lock()
+	defer registryMu.Unlock()
+
+	ok := true
+	for _, c := range registry {
+		if !c.checkLeaks(tb) {
+			ok = false
+		}
+	}
+	if !ok {
+		tb.Errorf("pools: leaked pooled objects detected (borrowed but never redeemed)")
+	}
+
+	return ok
+}
+
+// ResetTracking clears all recorded borrow/redeem tracking across every pool.
+//
+// Call it at the start of a test so leaks from earlier tests are not attributed
+// to it.
+func ResetTracking() {
+	registryMu.Lock()
+	defer registryMu.Unlock()
+
+	for _, c := range registry {
+		c.resetTracking()
+	}
+}
+
+// caller returns "file:line" of the frame skip levels above caller itself.
+func caller(skip int) string {
+	pc, _, _, ok := runtime.Caller(skip)
+	if !ok {
+		return "unknown"
+	}
+	fn := runtime.FuncForPC(pc)
+	if fn == nil {
+		return "unknown"
+	}
+	file, line := fn.FileLine(pc)
+
+	return fmt.Sprintf("%s:%d", file, line)
+}
diff --git a/vendor/github.com/go-openapi/swag/pools/doc.go b/vendor/github.com/go-openapi/swag/pools/doc.go
new file mode 100644
index 0000000000..395c24d29a
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/pools/doc.go
@@ -0,0 +1,26 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+// Package pools provide utilities to recycle allocated objects.
+//
+// This package provides:
+//
+// - a generic [Pool] type that wraps [sync.Pool],
+// - a [PoolRedeemable] variant that hands out a cached redeem closure,
+// - a [PoolSlice] for recycling slices without juggling pointers.
+//
+// # Debug build
+//
+// Building with the "poolsdebug" tag (go test -tags poolsdebug ./...) turns on
+// instrumentation that tracks every borrow and redeem and panics on misuse:
+//
+// - double redeem (including the A -> B -> A case for the redeemable pools),
+// - redeem of a foreign object,
+// - borrow of an object still checked out
+//
+// It reports the offending call sites.
+//
+// [AssertNoLeaks] then reports any object borrowed but never redeemed.
+//
+// The instrumentation is a no-op with zero overhead when the tag is absent.
+package pools
diff --git a/vendor/github.com/go-openapi/swag/pools/pools.go b/vendor/github.com/go-openapi/swag/pools/pools.go
new file mode 100644
index 0000000000..d78ea5790a
--- /dev/null
+++ b/vendor/github.com/go-openapi/swag/pools/pools.go
@@ -0,0 +1,410 @@
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
+
+package pools
+
+import (
+	"iter"
+	"slices"
+	"sync"
+	"sync/atomic"
+)
+
+// Resettable is an interface for types that want to recycle a clean instance
+// from a [Pool].
+//
+// When T (or rather *T) implements [Resettable], the pool calls Reset on an
+// instance both when it is redeemed and when it is borrowed:
+//
+//   - on redeem, so that no references held by the instance are retained while it sits idle in the
+//     pool (which would pin a reference graph alive across a GC cycle);
+//   - on borrow, so that the next borrower receives a clean object regardless of how the instance
+//     reached the pool.
+//
+// Reset must be safe to call more than once on the same instance (it runs at
+// least twice per cycle).
+type Resettable interface {
+	Reset()
+}
+
+// resetIfResettable calls Reset on v when *T implements [Resettable].
+func resetIfResettable[T any](v *T) {
+	if r, ok := any(v).(Resettable); ok {
+		r.Reset()
+	}
+}
+
+// borrow state of a [redeemable] wrapper, used to detect double-redeem.
+const (
+	stateIdle     uint32 = iota // sitting in the pool (or freshly created), not checked out
+	stateBorrowed               // checked out by a borrower
+)
+
+type redeemable[T any] struct {
+	inner    *T
+	redeemer func()
+	// state guards against a double-redeem (the same wrapper Put into the pool
+	// twice, which would let one object be handed to two borrowers).
+	//
+	// It is set to stateBorrowed on borrow and atomically flipped back to
+	// stateIdle on redeem; a redeem that finds it already idle panics.
+	state atomic.Uint32
+}
+
+// redeemPanic is the message raised when a slot is redeemed while already idle.
+const redeemPanic = "pools: " +
+	"double redeem detected (object already returned to the pool); " +
+	"a borrowed object must be redeemed exactly once"
+
+// Pool wraps a [sync.Pool] to make it available for any type.
+//
+// T must be the value type of the pooled object (e.g. Pool[bytes.Buffer]):
+// [Pool.Borrow] returns a *T. Using a pointer type as T (e.g.
+// Pool[*bytes.Buffer]) would yield a **T and is almost certainly a mistake.
+type Pool[T any] struct {
+	pool    sync.Pool
+	tracker tracker[T] // empty (zero-cost) unless built with the poolsdebug tag
+}
+
+// PoolRedeemable wraps a [sync.Pool] to make it available for any type.
+//
+// It differs from [Pool] in the way objects are redeemed to the pool: borrowing
+// also yields a cached redeem closure, so no closure is allocated at redeem
+// time.
+type PoolRedeemable[T any] struct {
+	pool    sync.Pool
+	tracker tracker[redeemable[T]] // empty (zero-cost) unless built with the poolsdebug tag
+}
+
+// New builds a new [Pool] to recycle allocations of type T explicitly using
+// [Pool.Redeem] and the allocated pointer.
+//
+// Freshly allocated instances of type T are set to their zero value; like
+// recycled instances they are reset (if [Resettable]) when borrowed, so
+// [Pool.Borrow] always yields a clean object.
+func New[T any]() *Pool[T] {
+	p := &Pool[T]{}
+	p.pool = sync.Pool{
+		New: func() any {
+			return new(T)
+		},
+	}
+	p.tracker.register()
+
+	return p
+}
+
+// NewRedeemable builds a new redeemable [Pool] to recycle allocations of type
+// T, and use the inner redeemer to relinquish objects to the pool.
+func NewRedeemable[T any]() *PoolRedeemable[T] {
+	p := &PoolRedeemable[T]{}
+	p.pool = sync.Pool{
+		New: func() any {
+			r := &redeemable[T]{inner: new(T)}
+			r.redeemer = func() {
+				if !r.state.CompareAndSwap(stateBorrowed, stateIdle) {
+					panic(redeemPanic)
+				}
+				resetIfResettable(r.inner)
+				p.pool.Put(r)
+			}
+
+			return r
+		},
+	}
+	p.tracker.register()
+
+	return p
+}
+
+// Borrow an instance from the pool.
+//
+// If the type implements [Resettable], the returned instance is reset before
+// being handed out, so it is always clean.
+func (p *Pool[T]) Borrow() *T {
+	target := p.pool.Get().(*T)
+	resetIfResettable(target)
+	p.tracker.onBorrow(target)
+
+	return target
+}
+
+// Redeem a borrowed instance to the pool.
+//
+// A nil pointer is ignored (it would otherwise corrupt the pool: a typed-nil
+// boxed into an interface is not the nil interface that [sync.Pool.Put] skips).
+//
+// The instance is reset (if it implements [Resettable]) before being returned
+// to the pool.
+// After calling Redeem, the caller must drop its reference to ptr: continuing
+// to use it is a use-after-redeem bug.
+//
+// Unlike [PoolRedeemable], this plain pool holds no per-object state, so it
+// cannot detect a double-redeem of the same pointer (which corrupts the pool).
+//
+// Prefer [PoolRedeemable] when you want that guard, or the debug build for full
+// tracking.
+func (p *Pool[T]) Redeem(ptr *T) {
+	if ptr == nil {
+		return
+	}
+	p.tracker.onRedeem(ptr)
+	resetIfResettable(ptr)
+	p.pool.Put(ptr)
+}
+
+// BorrowWithRedeem borrows an instance from the pool and provides the
+// corresponding redeem function.
+//
+// This is useful for instance to use with defer.
+//
+// The instance is reset (if it implements [Resettable]) both when borrowed and
+// when the returned redeem closure is called.
+// After calling the redeem closure, the caller must drop its reference to the
+// returned instance.
+//
+// Calling the redeem closure more than once panics (see [redeemable.state]): a
+// borrowed instance must be redeemed exactly once.
+func (p *PoolRedeemable[T]) BorrowWithRedeem() (*T, func()) {
+	container := p.pool.Get().(*redeemable[T])
+	container.state.Store(stateBorrowed)
+	resetIfResettable(container.inner)
+
+	// In release builds borrowRedeemer returns container.redeemer unchanged (zero
+	// cost).
+	// Under the poolsdebug tag it returns a generation-stamped wrapper that tracks
+	// the borrow and detects double-redeem (incl.
+	//
+	// ABA), foreign-redeem and leaks.
+	return container.inner, p.tracker.borrowRedeemer(container, container.redeemer)
+}
+
+// Slice is a struct that wraps a slice []T.
+//
+// This is useful to borrow and redeem slices from a pool, without having to
+// constantly manipulate pointers to the slice.
+//
+// The wrapper holds the authoritative slice header.
+//
+// Its mutating methods ([Slice.Append], [Slice.Concat], [Slice.Grow]) return
+// the current backing slice for convenience, so it reads as an idiomatic []T.
+//
+// But the returned slice is only a snapshot of the wrapper's state at that
+// moment: if you keep it and grow it yourself with the builtin append and it
+// reallocates, the new backing array lives only in your local copy and is NOT
+// tracked by the wrapper — it will not be recycled when the wrapper is
+// redeemed (and a later borrower would get the old, smaller array).
+//
+// Rule of thumb: it is fine to read or pass the returned []T to a consumer; but
+// if you plan to grow the slice, keep calling the wrapper's methods so the
+// growth is tracked and recycled.
+type Slice[T any] struct {
+	length int
+	inner  []T
+}
+
+// Slice returns the inner slice.
+//
+// Treat the result as a read-only view (for ranging or passing to a consumer),
+// valid until the next mutation or redeem.
+// To grow or append, use the wrapper methods so the new backing array is
+// tracked and recycled (see [Slice]).
+func (s *Slice[T]) Slice() []T {
+	return s.inner
+}
+
+// Grow the inner slice so it can accommodate at least size more elements
+// without reallocating, and return the current backing slice.
+//
+// Growth is tracked by the wrapper, so the enlarged backing array is recycled
+// on redeem.
+// See [Slice] for the caveat about growing the returned slice yourself.
+func (s *Slice[T]) Grow(size int) []T {
+	s.inner = slices.Grow(s.inner, size)
+
+	return s.inner
+}
+
+func (s *Slice[T]) Len() int {
+	return len(s.inner)
+}
+
+func (s *Slice[T]) Cap() int {
+	return cap(s.inner)
+}
+
+// Append elements to the inner slice and return the current backing slice.
+//
+// This should be preferred to the append builtin if you plan that the slice will
+// grow and you want the newly allocated space to be tracked and recycled.
+// See [Slice] for the caveat about growing the returned slice yourself.
+func (s *Slice[T]) Append(elems ...T) []T {
+	s.inner = append(s.inner, elems...)
+
+	return s.inner
+}
+
+// Concat another slice to the inner slice and return the current backing slice.
+//
+// Unlike [slices.Concat], this reuses the inner slice's capacity instead of
+// always allocating a fresh backing array.
+// See [Slice] for the caveat about growing the returned slice yourself.
+func (s *Slice[T]) Concat(slice []T) []T {
+	s.inner = append(s.inner, slice...)
+
+	return s.inner
+}
+
+// IndexedElems iterates over the inner slice.
+func (s *Slice[T]) IndexedElems() iter.Seq2[int, T] {
+	return func(yield func(int, T) bool) {
+		for i, elem := range s.inner {
+			if !yield(i, elem) {
+				return
+			}
+		}
+	}
+}
+
+// Reset the inner slice to its configured initial length, keeping allocated
+// capacity.
+//
+// All elements are zeroed, so the pool never retains stale element references
+// (which would keep a referenced graph alive for slices of pointers) and so a
+// [WithLength] slice is handed out clean rather than carrying data from a
+// previous borrower.
+func (s *Slice[T]) Reset() {
+	clear(s.inner)
+	if s.length > cap(s.inner) {
+		s.inner = slices.Grow(s.inner[:0], s.length)
+	}
+	s.inner = s.inner[:s.length]
+}
+
+// Clip removes unused capacity from the inner slice.
+func (s *Slice[T]) Clip() {
+	s.inner = slices.Clip(s.inner)
+}
+
+// resetWithCapacity discards the current backing array and replaces it with a
+// fresh one of the configured length and the given capacity.
+//
+// It is used by a capacity-capped pool to stop recycling an oversized backing
+// array (the old array is left for the GC).
+func (s *Slice[T]) resetWithCapacity(capacity int) {
+	s.inner = make([]T, s.length, max(s.length, capacity))
+}
+
+// PoolSlice is a pool of [Slice[T]].
+//
+// [PoolSlice.BorrowWithRedeem] will return an empty inner slice by default.
+// This default may be altered using [WithMinimumCapacity].
+//
+// Use [PoolSlice.BorrowWithSizeAndRedeem] or [Slice.Grow] to grow the capacity
+// of the inner slice.
+type PoolSlice[T any] struct {
+	// redeemable is held as an unexported field rather than embedded, so the
+	// underlying [PoolRedeemable] and its [sync.Pool] are not part of PoolSlice's
+	// public surface.
+	redeemable *PoolRedeemable[Slice[T]]
+}
+
+// PoolSliceOption alters the default settings to allocate new pooled slices
+type PoolSliceOption func(*poolSliceOptions)
+
+type poolSliceOptions struct {
+	minCapacity int
+	length      int
+	maxCapacity int
+}
+
+func WithMinimumCapacity(size int) PoolSliceOption {
+	return func(o *poolSliceOptions) {
+		o.minCapacity = size
+	}
+}
+
+// WithMaxCapacity bounds the capacity of recycled slices.
+//
+// When a borrowed slice has grown past size at redeem time, its (oversized)
+// backing array is discarded and replaced with a fresh one sized to the minimum
+// capacity, instead of being recycled.
+//
+// This stops the pool from accumulating large backing arrays after an
+// occasional large request, keeping the steady-state memory bounded.
+//
+// The trade-off: a workload that genuinely needs slices larger than size will
+// reallocate on every cycle.
+// Set size from the high-water mark you actually expect, not below it.
+// A size of 0 (the default) means no cap: grown slices are recycled as-is.
+func WithMaxCapacity(size int) PoolSliceOption {
+	return func(o *poolSliceOptions) {
+		o.maxCapacity = size
+	}
+}
+
+// WithLength ensures that the borrowed slices have a fixed given initial
+// length.
+//
+// By default, the borrowed slices are reset to length 0.
+func WithLength(size int) PoolSliceOption {
+	return func(o *poolSliceOptions) {
+		o.length = size
+	}
+}
+
+// NewPoolSlice builds a pool to recycle slices of type []T.
+func NewPoolSlice[T any](opts ...PoolSliceOption) *PoolSlice[T] {
+	var o poolSliceOptions
+	for _, apply := range opts {
+		apply(&o)
+	}
+
+	rp := &PoolRedeemable[Slice[T]]{}
+	rp.pool = sync.Pool{
+		New: func() any {
+			s := &redeemable[Slice[T]]{
+				inner: &Slice[T]{
+					length: o.length,
+					inner:  make([]T, o.length, max(o.length, o.minCapacity)),
+				},
+			}
+
+			s.redeemer = func() {
+				if !s.state.CompareAndSwap(stateBorrowed, stateIdle) {
+					panic(redeemPanic)
+				}
+				if o.maxCapacity > 0 && s.inner.Cap() > o.maxCapacity {
+					s.inner.resetWithCapacity(o.minCapacity)
+				} else {
+					s.inner.Reset()
+				}
+				rp.pool.Put(s)
+			}
+
+			return s
+		},
+	}
+	rp.tracker.register()
+
+	return &PoolSlice[T]{redeemable: rp}
+}
+
+// BorrowWithRedeem returns the slice wrapper and the redeem closure to
+// relinquish the allocated wrapper.
+//
+// The wrapper is reset (elements zeroed, length restored) both on borrow and
+// when the redeem closure is called.
+// Calling the redeem closure more than once panics.
+func (p *PoolSlice[T]) BorrowWithRedeem() (*Slice[T], func()) {
+	return p.redeemable.BorrowWithRedeem()
+}
+
+// BorrowWithSizeAndRedeem borrows a slice []T from the pool and ensures that
+// its capacity is at least the provided size.
+func (p *PoolSlice[T]) BorrowWithSizeAndRedeem(size int) (*Slice[T], func()) {
+	s, redeem := p.BorrowWithRedeem()
+	s.Grow(size)
+
+	return s, redeem
+}
diff --git a/vendor/github.com/go-openapi/swag/yamlutils/ordered_map.go b/vendor/github.com/go-openapi/swag/yamlutils/ordered_map.go
index 3daf68dbba..24d951f8de 100644
--- a/vendor/github.com/go-openapi/swag/yamlutils/ordered_map.go
+++ b/vendor/github.com/go-openapi/swag/yamlutils/ordered_map.go
@@ -123,7 +123,7 @@ func (s YAMLMapSlice) MarshalYAML() (any, error) {
 	var nodes []*yaml.Node
 
 	for _, item := range s {
-		nn, err := json2yaml(item.Value)
+		nn, err := json2yaml(item.Value, 1)
 		if err != nil {
 			return nil, err
 		}
@@ -153,6 +153,17 @@ func (s YAMLMapSlice) MarshalYAML() (any, error) {
 //
 // It implements [yaml.Unmarshaler].
 func (s *YAMLMapSlice) UnmarshalYAML(node *yaml.Node) error {
+	return s.unmarshalYAML(newYAMLWalker(), node, 0)
+}
+
+// unmarshalYAML builds the slice from a [yaml.Node], tracking the recursion depth (against
+// stack-overflow) and threading the [yamlWalker] so anchor/alias expansion stays bounded
+// across the whole document.
+func (s *YAMLMapSlice) unmarshalYAML(w *yamlWalker, node *yaml.Node, depth int) error {
+	if depth > defaultMaxNestingDepth {
+		return errMaxNestingDepth
+	}
+
 	if typeutils.IsNil(*s) {
 		// allow to unmarshal with a simple var declaration (nil slice)
 		*s = YAMLMapSlice{}
@@ -167,13 +178,17 @@ func (s *YAMLMapSlice) UnmarshalYAML(node *yaml.Node) error {
 	m = m[:0]
 
 	for i := 0; i < len(node.Content); i += 2 {
+		if err := w.account(); err != nil { // account the key node
+			return err
+		}
+
 		var nmi YAMLMapItem
 		k, err := yamlStringScalarC(node.Content[i])
 		if err != nil {
 			return fmt.Errorf("unable to decode YAML map key: %w: %w", err, ErrYAML)
 		}
 		nmi.Key = k
-		v, err := yamlNode(node.Content[i+1])
+		v, err := w.node(node.Content[i+1], depth+1)
 		if err != nil {
 			return fmt.Errorf("unable to process YAML map value for key %q: %w: %w", k, err, ErrYAML)
 		}
@@ -186,7 +201,11 @@ func (s *YAMLMapSlice) UnmarshalYAML(node *yaml.Node) error {
 	return nil
 }
 
-func json2yaml(item any) (*yaml.Node, error) {
+func json2yaml(item any, depth int) (*yaml.Node, error) {
+	if depth > defaultMaxNestingDepth {
+		return nil, errMaxNestingDepth
+	}
+
 	if typeutils.IsNil(item) {
 		return &yaml.Node{
 			Kind:  yaml.ScalarNode,
@@ -196,7 +215,7 @@ func json2yaml(item any) (*yaml.Node, error) {
 
 	switch val := item.(type) {
 	case ifaces.Ordered:
-		return orderedYAML(val)
+		return orderedYAML(val, depth)
 
 	case map[string]any:
 		var n yaml.Node
@@ -209,7 +228,7 @@ func json2yaml(item any) (*yaml.Node, error) {
 
 		for _, k := range keys {
 			v := val[k]
-			childNode, err := json2yaml(v)
+			childNode, err := json2yaml(v, depth+1)
 			if err != nil {
 				return nil, err
 			}
@@ -225,7 +244,7 @@ func json2yaml(item any) (*yaml.Node, error) {
 		var n yaml.Node
 		n.Kind = yaml.SequenceNode
 		for i := range val {
-			childNode, err := json2yaml(val[i])
+			childNode, err := json2yaml(val[i], depth+1)
 			if err != nil {
 				return nil, err
 			}
@@ -297,11 +316,11 @@ func uintegerNode[T conv.Unsigned](val T) (*yaml.Node, error) {
 	}, nil
 }
 
-func orderedYAML[T ifaces.Ordered](val T) (*yaml.Node, error) {
+func orderedYAML[T ifaces.Ordered](val T, depth int) (*yaml.Node, error) {
 	var n yaml.Node
 	n.Kind = yaml.MappingNode
 	for key, value := range val.OrderedItems() {
-		childNode, err := json2yaml(value)
+		childNode, err := json2yaml(value, depth+1)
 		if err != nil {
 			return nil, err
 		}
diff --git a/vendor/github.com/go-openapi/swag/yamlutils/yaml.go b/vendor/github.com/go-openapi/swag/yamlutils/yaml.go
index e3aff3c2fd..d4b5335f6f 100644
--- a/vendor/github.com/go-openapi/swag/yamlutils/yaml.go
+++ b/vendor/github.com/go-openapi/swag/yamlutils/yaml.go
@@ -12,13 +12,99 @@ import (
 	yaml "go.yaml.in/yaml/v3"
 )
 
+// defaultMaxNestingDepth caps the recursion depth of the YAML<->JSON transforms to
+// guard against stack-overflow on deeply nested (possibly adversarial) input.
+//
+// It matches the limit enforced by go.yaml.in/yaml/v3's own parser and by
+// encoding/json's decoder.
+const defaultMaxNestingDepth = 10000
+
+// Bounds on YAML anchor/alias expansion.
+//
+// go.yaml.in/yaml/v3 enforces these when decoding into Go values, but that guard is
+// coupled to the library's own tree walk: when we decode into a low-level [yaml.Node]
+// (to preserve key order) and expand aliases ourselves in [yamlWalker.node], we bypass
+// it. We therefore reproduce it here, with the same constants and ratio schedule as the
+// library's decoder (see go.yaml.in/yaml/v3 decode.go, "excessive aliasing").
+const (
+	aliasCountThreshold  = 100
+	decodeCountThreshold = 1000
+
+	// 400,000 decode operations is ~500kb of dense object declarations, or
+	// ~5kb of dense object declarations with 10000% alias expansion.
+	aliasRatioRangeLow = 400000
+	// 4,000,000 decode operations is ~5MB of dense object declarations.
+	aliasRatioRangeHigh = 4000000
+	aliasRatioRange     = float64(aliasRatioRangeHigh - aliasRatioRangeLow)
+
+	// tolerated share of alias-driven decodes: from aliasRatioSmall (small/medium documents)
+	// down to aliasRatioLarge (very large ones), interpolated with slope aliasRatioSlope.
+	aliasRatioSmall = 0.99
+	aliasRatioLarge = 0.10
+	aliasRatioSlope = aliasRatioSmall - aliasRatioLarge
+)
+
+var (
+	// errMaxNestingDepth is returned when a document nests deeper than [defaultMaxNestingDepth].
+	errMaxNestingDepth = fmt.Errorf("maximum nesting depth of %d exceeded: %w", defaultMaxNestingDepth, ErrYAML)
+
+	// errExcessiveAliasing is returned when anchor/alias expansion is disproportionate to the
+	// size of the document, i.e. an "alias bomb".
+	errExcessiveAliasing = fmt.Errorf("document contains excessive aliasing: %w", ErrYAML)
+)
+
+// allowedAliasRatio scales the tolerated share of alias-driven decode operations from 99%
+// for small-to-medium documents down to 10% for very large ones, mirroring go.yaml.in/yaml/v3.
+func allowedAliasRatio(decodeCount int) float64 {
+	switch {
+	case decodeCount <= aliasRatioRangeLow:
+		return aliasRatioSmall
+	case decodeCount >= aliasRatioRangeHigh:
+		return aliasRatioLarge
+	default:
+		return aliasRatioSmall - aliasRatioSlope*(float64(decodeCount-aliasRatioRangeLow)/aliasRatioRange)
+	}
+}
+
+// yamlWalker carries the state needed to bound a single YAML-tree traversal:
+// anchor/alias expansion accounting and cycle detection.
+//
+// A fresh walker is created per top-level conversion; it is threaded (not copied) through
+// the whole recursive walk so its counters accumulate across the entire document.
+type yamlWalker struct {
+	decodeCount int
+	aliasCount  int
+	aliasDepth  int
+	aliases     map[*yaml.Node]bool // anchors currently being expanded, for cycle detection
+}
+
+func newYAMLWalker() *yamlWalker {
+	return &yamlWalker{aliases: make(map[*yaml.Node]bool)}
+}
+
+// account records one processed node and fails if alias expansion has become excessive.
+func (w *yamlWalker) account() error {
+	w.decodeCount++
+	if w.aliasDepth > 0 {
+		w.aliasCount++
+	}
+
+	if w.aliasCount > aliasCountThreshold &&
+		w.decodeCount > decodeCountThreshold &&
+		float64(w.aliasCount)/float64(w.decodeCount) > allowedAliasRatio(w.decodeCount) {
+		return errExcessiveAliasing
+	}
+
+	return nil
+}
+
 // YAMLToJSON converts a YAML document into JSON bytes.
 //
 // Note: a YAML document is the output from a [yaml.Marshaler], e.g a pointer to a [yaml.Node].
 //
 // [YAMLToJSON] is typically called after [BytesToYAMLDoc].
 func YAMLToJSON(value any) (json.RawMessage, error) {
-	jm, err := transformData(value)
+	jm, err := transformData(value, 0)
 	if err != nil {
 		return nil, err
 	}
@@ -44,46 +130,73 @@ func BytesToYAMLDoc(data []byte) (any, error) {
 	return &document, nil
 }
 
-func yamlNode(root *yaml.Node) (any, error) {
+func (w *yamlWalker) node(root *yaml.Node, depth int) (any, error) {
+	if depth > defaultMaxNestingDepth {
+		return nil, errMaxNestingDepth
+	}
+	if err := w.account(); err != nil {
+		return nil, err
+	}
+
 	switch root.Kind {
 	case yaml.DocumentNode:
-		return yamlDocument(root)
+		return w.document(root, depth)
 	case yaml.SequenceNode:
-		return yamlSequence(root)
+		return w.sequence(root, depth)
 	case yaml.MappingNode:
-		return yamlMapping(root)
+		return w.mapping(root, depth)
 	case yaml.ScalarNode:
 		return yamlScalar(root)
 	case yaml.AliasNode:
-		return yamlNode(root.Alias)
+		return w.alias(root, depth)
 	default:
 		return nil, fmt.Errorf("unsupported YAML node type: %v: %w", root.Kind, ErrYAML)
 	}
 }
 
-func yamlDocument(node *yaml.Node) (any, error) {
+// alias resolves an anchor reference, expanding the anchored subtree. It detects cycles
+// (an anchor whose expansion transitively references itself) and accounts the expansion
+// against the alias-bomb budget via [yamlWalker.aliasDepth].
+func (w *yamlWalker) alias(node *yaml.Node, depth int) (any, error) {
+	if node.Alias == nil {
+		return nil, fmt.Errorf("invalid YAML alias node %q: %w", node.Value, ErrYAML)
+	}
+	if w.aliases[node.Alias] {
+		return nil, fmt.Errorf("anchor %q contains itself: %w", node.Value, ErrYAML)
+	}
+
+	w.aliases[node.Alias] = true
+	w.aliasDepth++
+	out, err := w.node(node.Alias, depth+1)
+	w.aliasDepth--
+	delete(w.aliases, node.Alias)
+
+	return out, err
+}
+
+func (w *yamlWalker) document(node *yaml.Node, depth int) (any, error) {
 	if len(node.Content) != 1 {
 		return nil, fmt.Errorf("unexpected YAML Document node content length: %d: %w", len(node.Content), ErrYAML)
 	}
-	return yamlNode(node.Content[0])
+	return w.node(node.Content[0], depth+1)
 }
 
-func yamlMapping(node *yaml.Node) (any, error) {
+func (w *yamlWalker) mapping(node *yaml.Node, depth int) (any, error) {
 	const sensibleAllocDivider = 2 // nodes concatenate (key,value) sequences
 	m := make(YAMLMapSlice, len(node.Content)/sensibleAllocDivider)
 
-	if err := m.UnmarshalYAML(node); err != nil {
+	if err := m.unmarshalYAML(w, node, depth); err != nil {
 		return nil, err
 	}
 
 	return m, nil
 }
 
-func yamlSequence(node *yaml.Node) (any, error) {
+func (w *yamlWalker) sequence(node *yaml.Node, depth int) (any, error) {
 	s := make([]any, 0)
 
 	for i := range len(node.Content) {
-		v, err := yamlNode(node.Content[i])
+		v, err := w.node(node.Content[i], depth+1)
 		if err != nil {
 			return nil, fmt.Errorf("unable to decode YAML sequence value: %w: %w", err, ErrYAML)
 		}
@@ -174,12 +287,16 @@ func format(t any) (string, error) {
 	}
 }
 
-func transformData(input any) (out any, err error) {
+func transformData(input any, depth int) (out any, err error) {
+	if depth > defaultMaxNestingDepth {
+		return nil, errMaxNestingDepth
+	}
+
 	switch in := input.(type) {
 	case yaml.Node:
-		return yamlNode(&in)
+		return newYAMLWalker().node(&in, depth)
 	case *yaml.Node:
-		return yamlNode(in)
+		return newYAMLWalker().node(in, depth)
 	case map[any]any:
 		o := make(YAMLMapSlice, 0, len(in))
 		for ke, va := range in {
@@ -188,7 +305,7 @@ func transformData(input any) (out any, err error) {
 				return nil, err
 			}
 
-			v, ert := transformData(va)
+			v, ert := transformData(va, depth+1)
 			if ert != nil {
 				return nil, ert
 			}
@@ -200,7 +317,7 @@ func transformData(input any) (out any, err error) {
 		len1 := len(in)
 		o := make([]any, len1)
 		for i := range len1 {
-			o[i], err = transformData(in[i])
+			o[i], err = transformData(in[i], depth+1)
 			if err != nil {
 				return nil, err
 			}
diff --git a/vendor/k8s.io/api/admission/v1/types.go b/vendor/k8s.io/api/admission/v1/types.go
index 34cbf2f59b..f9a79ecd75 100644
--- a/vendor/k8s.io/api/admission/v1/types.go
+++ b/vendor/k8s.io/api/admission/v1/types.go
@@ -28,7 +28,7 @@ import (
 
 // AdmissionReview describes an admission review request/response.
 type AdmissionReview struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// request describes the attributes for the admission request.
 	// +optional
 	Request *AdmissionRequest `json:"request,omitempty" protobuf:"bytes,1,opt,name=request"`
diff --git a/vendor/k8s.io/api/admission/v1beta1/types.go b/vendor/k8s.io/api/admission/v1beta1/types.go
index 015dc8ba3e..cb32a2fa07 100644
--- a/vendor/k8s.io/api/admission/v1beta1/types.go
+++ b/vendor/k8s.io/api/admission/v1beta1/types.go
@@ -32,7 +32,7 @@ import (
 
 // AdmissionReview describes an admission review request/response.
 type AdmissionReview struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// request describes the attributes for the admission request.
 	// +optional
 	Request *AdmissionRequest `json:"request,omitempty" protobuf:"bytes,1,opt,name=request"`
diff --git a/vendor/k8s.io/api/admissionregistration/v1/generated.proto b/vendor/k8s.io/api/admissionregistration/v1/generated.proto
index 89c1475b2e..718b7c14e8 100644
--- a/vendor/k8s.io/api/admissionregistration/v1/generated.proto
+++ b/vendor/k8s.io/api/admissionregistration/v1/generated.proto
@@ -872,6 +872,7 @@ message TypeChecking {
 }
 
 // ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
+// +k8s:supportsSubresource="/status"
 message ValidatingAdmissionPolicy {
   // metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
   // +optional
@@ -926,7 +927,7 @@ message ValidatingAdmissionPolicyBindingSpec {
   // If the referenced resource does not exist, this binding is considered invalid and will be ignored
   // Required.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string policyName = 1;
 
   // paramRef specifies the parameter resource used to configure the admission control policy.
@@ -985,7 +986,7 @@ message ValidatingAdmissionPolicyBindingSpec {
   // Required.
   // +listType=set
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   repeated string validationActions = 4;
 }
 
@@ -1099,6 +1100,9 @@ message ValidatingAdmissionPolicyStatus {
   // +optional
   // +listType=map
   // +listMapKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 3;
 }
 
diff --git a/vendor/k8s.io/api/admissionregistration/v1/types.go b/vendor/k8s.io/api/admissionregistration/v1/types.go
index f7a07b6453..8047d5c5f9 100644
--- a/vendor/k8s.io/api/admissionregistration/v1/types.go
+++ b/vendor/k8s.io/api/admissionregistration/v1/types.go
@@ -139,8 +139,9 @@ const (
 // +k8s:prerelease-lifecycle-gen:introduced=1.30
 
 // ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
+// +k8s:supportsSubresource="/status"
 type ValidatingAdmissionPolicy struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -167,6 +168,9 @@ type ValidatingAdmissionPolicyStatus struct {
 	// +optional
 	// +listType=map
 	// +listMapKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 	Conditions []metav1.Condition `json:"conditions,omitempty" protobuf:"bytes,3,rep,name=conditions"`
 }
 
@@ -199,7 +203,7 @@ type ExpressionWarning struct {
 
 // ValidatingAdmissionPolicyList is a list of ValidatingAdmissionPolicy.
 type ValidatingAdmissionPolicyList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -447,7 +451,7 @@ type AuditAnnotation struct {
 // Adding/removing policies, bindings, or params can not affect whether a
 // given (policy, binding, param) combination is within its own CEL budget.
 type ValidatingAdmissionPolicyBinding struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -461,7 +465,7 @@ type ValidatingAdmissionPolicyBinding struct {
 
 // ValidatingAdmissionPolicyBindingList is a list of ValidatingAdmissionPolicyBinding.
 type ValidatingAdmissionPolicyBindingList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -476,7 +480,7 @@ type ValidatingAdmissionPolicyBindingSpec struct {
 	// If the referenced resource does not exist, this binding is considered invalid and will be ignored
 	// Required.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	PolicyName string `json:"policyName,omitempty" protobuf:"bytes,1,rep,name=policyName"`
 
 	// paramRef specifies the parameter resource used to configure the admission control policy.
@@ -535,7 +539,7 @@ type ValidatingAdmissionPolicyBindingSpec struct {
 	// Required.
 	// +listType=set
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	ValidationActions []ValidationAction `json:"validationActions,omitempty" protobuf:"bytes,4,rep,name=validationActions"`
 }
 
@@ -714,7 +718,7 @@ type NamedRuleWithOperations struct {
 	// +optional
 	ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,1,rep,name=resourceNames"`
 	// RuleWithOperations is a tuple of Operations and Resources.
-	RuleWithOperations `json:",inline" protobuf:"bytes,2,opt,name=ruleWithOperations"`
+	RuleWithOperations `json:"" protobuf:"bytes,2,opt,name=ruleWithOperations"`
 }
 
 // +genclient
@@ -724,7 +728,7 @@ type NamedRuleWithOperations struct {
 
 // ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.
 type ValidatingWebhookConfiguration struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -742,7 +746,7 @@ type ValidatingWebhookConfiguration struct {
 
 // ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration.
 type ValidatingWebhookConfigurationList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -758,7 +762,7 @@ type ValidatingWebhookConfigurationList struct {
 
 // MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.
 type MutatingWebhookConfiguration struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -776,7 +780,7 @@ type MutatingWebhookConfiguration struct {
 
 // MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration.
 type MutatingWebhookConfigurationList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -1110,7 +1114,7 @@ type MutatingWebhook struct {
 
 // MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
 type MutatingAdmissionPolicy struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -1123,7 +1127,7 @@ type MutatingAdmissionPolicy struct {
 
 // MutatingAdmissionPolicyList is a list of MutatingAdmissionPolicy.
 type MutatingAdmissionPolicyList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -1383,7 +1387,7 @@ type JSONPatch struct {
 // Adding/removing policies, bindings, or params can not affect whether a
 // given (policy, binding, param) combination is within its own CEL budget.
 type MutatingAdmissionPolicyBinding struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -1396,7 +1400,7 @@ type MutatingAdmissionPolicyBinding struct {
 
 // MutatingAdmissionPolicyBindingList is a list of MutatingAdmissionPolicyBinding.
 type MutatingAdmissionPolicyBindingList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -1458,7 +1462,7 @@ type RuleWithOperations struct {
 	Operations []OperationType `json:"operations,omitempty" protobuf:"bytes,1,rep,name=operations,casttype=OperationType"`
 	// Rule is embedded, it describes other criteria of the rule, like
 	// APIGroups, APIVersions, Resources, etc.
-	Rule `json:",inline" protobuf:"bytes,2,opt,name=rule"`
+	Rule `json:"" protobuf:"bytes,2,opt,name=rule"`
 }
 
 // OperationType specifies an operation for a request.
diff --git a/vendor/k8s.io/api/admissionregistration/v1alpha1/generated.proto b/vendor/k8s.io/api/admissionregistration/v1alpha1/generated.proto
index 57c7cd2b1d..8802ac92db 100644
--- a/vendor/k8s.io/api/admissionregistration/v1alpha1/generated.proto
+++ b/vendor/k8s.io/api/admissionregistration/v1alpha1/generated.proto
@@ -594,6 +594,7 @@ message TypeChecking {
 }
 
 // ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
+// +k8s:supportsSubresource="/status"
 message ValidatingAdmissionPolicy {
   // metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
   // +optional
@@ -648,7 +649,7 @@ message ValidatingAdmissionPolicyBindingSpec {
   // If the referenced resource does not exist, this binding is considered invalid and will be ignored
   // Required.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string policyName = 1;
 
   // paramRef specifies the parameter resource used to configure the admission control policy.
@@ -707,7 +708,7 @@ message ValidatingAdmissionPolicyBindingSpec {
   // Required.
   // +listType=set
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   repeated string validationActions = 4;
 }
 
@@ -821,6 +822,9 @@ message ValidatingAdmissionPolicyStatus {
   // +optional
   // +listType=map
   // +listMapKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 3;
 }
 
diff --git a/vendor/k8s.io/api/admissionregistration/v1alpha1/types.go b/vendor/k8s.io/api/admissionregistration/v1alpha1/types.go
index 6a789b2d7f..39ff0abdc3 100644
--- a/vendor/k8s.io/api/admissionregistration/v1alpha1/types.go
+++ b/vendor/k8s.io/api/admissionregistration/v1alpha1/types.go
@@ -81,8 +81,9 @@ const (
 // +k8s:prerelease-lifecycle-gen:introduced=1.26
 
 // ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
+// +k8s:supportsSubresource="/status"
 type ValidatingAdmissionPolicy struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -109,6 +110,9 @@ type ValidatingAdmissionPolicyStatus struct {
 	// +optional
 	// +listType=map
 	// +listMapKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 	Conditions []metav1.Condition `json:"conditions,omitempty" protobuf:"bytes,3,rep,name=conditions"`
 }
 
@@ -138,7 +142,7 @@ type ExpressionWarning struct {
 
 // ValidatingAdmissionPolicyList is a list of ValidatingAdmissionPolicy.
 type ValidatingAdmissionPolicyList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -387,7 +391,7 @@ type AuditAnnotation struct {
 // Adding/removing policies, bindings, or params can not affect whether a
 // given (policy, binding, param) combination is within its own CEL budget.
 type ValidatingAdmissionPolicyBinding struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -401,7 +405,7 @@ type ValidatingAdmissionPolicyBinding struct {
 
 // ValidatingAdmissionPolicyBindingList is a list of ValidatingAdmissionPolicyBinding.
 type ValidatingAdmissionPolicyBindingList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -416,7 +420,7 @@ type ValidatingAdmissionPolicyBindingSpec struct {
 	// If the referenced resource does not exist, this binding is considered invalid and will be ignored
 	// Required.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	PolicyName string `json:"policyName,omitempty" protobuf:"bytes,1,rep,name=policyName"`
 
 	// paramRef specifies the parameter resource used to configure the admission control policy.
@@ -475,7 +479,7 @@ type ValidatingAdmissionPolicyBindingSpec struct {
 	// Required.
 	// +listType=set
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	ValidationActions []ValidationAction `json:"validationActions,omitempty" protobuf:"bytes,4,rep,name=validationActions"`
 }
 
@@ -652,7 +656,7 @@ type NamedRuleWithOperations struct {
 	// +optional
 	ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,1,rep,name=resourceNames"`
 	// RuleWithOperations is a tuple of Operations and Resources.
-	RuleWithOperations `json:",inline" protobuf:"bytes,2,opt,name=ruleWithOperations"`
+	RuleWithOperations `json:"" protobuf:"bytes,2,opt,name=ruleWithOperations"`
 }
 
 // RuleWithOperations is a tuple of Operations and Resources. It is recommended to make
@@ -679,7 +683,7 @@ const (
 
 // MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
 type MutatingAdmissionPolicy struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -692,7 +696,7 @@ type MutatingAdmissionPolicy struct {
 
 // MutatingAdmissionPolicyList is a list of MutatingAdmissionPolicy.
 type MutatingAdmissionPolicyList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -967,7 +971,7 @@ const (
 // Adding/removing policies, bindings, or params can not affect whether a
 // given (policy, binding, param) combination is within its own CEL budget.
 type MutatingAdmissionPolicyBinding struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -980,7 +984,7 @@ type MutatingAdmissionPolicyBinding struct {
 
 // MutatingAdmissionPolicyBindingList is a list of MutatingAdmissionPolicyBinding.
 type MutatingAdmissionPolicyBindingList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
diff --git a/vendor/k8s.io/api/admissionregistration/v1beta1/generated.proto b/vendor/k8s.io/api/admissionregistration/v1beta1/generated.proto
index 5fcb74f8ba..4654292316 100644
--- a/vendor/k8s.io/api/admissionregistration/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/admissionregistration/v1beta1/generated.proto
@@ -820,6 +820,7 @@ message TypeChecking {
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +k8s:prerelease-lifecycle-gen:introduced=1.28
 // ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
+// +k8s:supportsSubresource="/status"
 message ValidatingAdmissionPolicy {
   // metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
   // +optional
@@ -874,7 +875,7 @@ message ValidatingAdmissionPolicyBindingSpec {
   // If the referenced resource does not exist, this binding is considered invalid and will be ignored
   // Required.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string policyName = 1;
 
   // paramRef specifies the parameter resource used to configure the admission control policy.
@@ -933,7 +934,7 @@ message ValidatingAdmissionPolicyBindingSpec {
   // Required.
   // +listType=set
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   repeated string validationActions = 4;
 }
 
@@ -1049,6 +1050,9 @@ message ValidatingAdmissionPolicyStatus {
   // +optional
   // +listType=map
   // +listMapKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 3;
 }
 
diff --git a/vendor/k8s.io/api/admissionregistration/v1beta1/types.go b/vendor/k8s.io/api/admissionregistration/v1beta1/types.go
index 734a606f4b..1fb6728fc0 100644
--- a/vendor/k8s.io/api/admissionregistration/v1beta1/types.go
+++ b/vendor/k8s.io/api/admissionregistration/v1beta1/types.go
@@ -93,8 +93,9 @@ const (
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +k8s:prerelease-lifecycle-gen:introduced=1.28
 // ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
+// +k8s:supportsSubresource="/status"
 type ValidatingAdmissionPolicy struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -121,6 +122,9 @@ type ValidatingAdmissionPolicyStatus struct {
 	// +optional
 	// +listType=map
 	// +listMapKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 	Conditions []metav1.Condition `json:"conditions,omitempty" protobuf:"bytes,3,rep,name=conditions"`
 }
 
@@ -152,7 +156,7 @@ type ExpressionWarning struct {
 // +k8s:prerelease-lifecycle-gen:introduced=1.28
 // ValidatingAdmissionPolicyList is a list of ValidatingAdmissionPolicy.
 type ValidatingAdmissionPolicyList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -400,7 +404,7 @@ type AuditAnnotation struct {
 // Adding/removing policies, bindings, or params can not affect whether a
 // given (policy, binding, param) combination is within its own CEL budget.
 type ValidatingAdmissionPolicyBinding struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -414,7 +418,7 @@ type ValidatingAdmissionPolicyBinding struct {
 
 // ValidatingAdmissionPolicyBindingList is a list of ValidatingAdmissionPolicyBinding.
 type ValidatingAdmissionPolicyBindingList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -429,7 +433,7 @@ type ValidatingAdmissionPolicyBindingSpec struct {
 	// If the referenced resource does not exist, this binding is considered invalid and will be ignored
 	// Required.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	PolicyName string `json:"policyName,omitempty" protobuf:"bytes,1,rep,name=policyName"`
 
 	// paramRef specifies the parameter resource used to configure the admission control policy.
@@ -488,7 +492,7 @@ type ValidatingAdmissionPolicyBindingSpec struct {
 	// Required.
 	// +listType=set
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	ValidationActions []ValidationAction `json:"validationActions,omitempty" protobuf:"bytes,4,rep,name=validationActions"`
 }
 
@@ -667,7 +671,7 @@ type NamedRuleWithOperations struct {
 	// +optional
 	ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,1,rep,name=resourceNames"`
 	// RuleWithOperations is a tuple of Operations and Resources.
-	RuleWithOperations `json:",inline" protobuf:"bytes,2,opt,name=ruleWithOperations"`
+	RuleWithOperations `json:"" protobuf:"bytes,2,opt,name=ruleWithOperations"`
 }
 
 // +genclient
@@ -681,7 +685,7 @@ type NamedRuleWithOperations struct {
 // ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.
 // Deprecated in v1.16, planned for removal in v1.19. Use admissionregistration.k8s.io/v1 ValidatingWebhookConfiguration instead.
 type ValidatingWebhookConfiguration struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -702,7 +706,7 @@ type ValidatingWebhookConfiguration struct {
 
 // ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration.
 type ValidatingWebhookConfigurationList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -722,7 +726,7 @@ type ValidatingWebhookConfigurationList struct {
 // MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.
 // Deprecated in v1.16, planned for removal in v1.19. Use admissionregistration.k8s.io/v1 MutatingWebhookConfiguration instead.
 type MutatingWebhookConfiguration struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -743,7 +747,7 @@ type MutatingWebhookConfiguration struct {
 
 // MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration.
 type MutatingWebhookConfigurationList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -1213,7 +1217,7 @@ type MatchCondition struct {
 
 // MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
 type MutatingAdmissionPolicy struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -1227,7 +1231,7 @@ type MutatingAdmissionPolicy struct {
 
 // MutatingAdmissionPolicyList is a list of MutatingAdmissionPolicy.
 type MutatingAdmissionPolicyList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -1488,7 +1492,7 @@ type JSONPatch struct {
 // Adding/removing policies, bindings, or params can not affect whether a
 // given (policy, binding, param) combination is within its own CEL budget.
 type MutatingAdmissionPolicyBinding struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -1502,7 +1506,7 @@ type MutatingAdmissionPolicyBinding struct {
 
 // MutatingAdmissionPolicyBindingList is a list of MutatingAdmissionPolicyBinding.
 type MutatingAdmissionPolicyBindingList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
diff --git a/vendor/k8s.io/api/apidiscovery/v2/generated.proto b/vendor/k8s.io/api/apidiscovery/v2/generated.proto
index 7f58048e17..e42fec4711 100644
--- a/vendor/k8s.io/api/apidiscovery/v2/generated.proto
+++ b/vendor/k8s.io/api/apidiscovery/v2/generated.proto
@@ -38,12 +38,14 @@ message APIGroupDiscovery {
   // name is allowed to be "" to represent the legacy, ungroupified resources.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // versions are the versions supported in this group. They are sorted in descending order of preference,
   // with the preferred version being the first entry.
   // +listType=map
   // +listMapKey=version
+  // +optional
   repeated APIVersionDiscovery versions = 2;
 }
 
@@ -58,6 +60,7 @@ message APIGroupDiscoveryList {
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
 
   // items is the list of groups for discovery. The groups are listed in priority order.
+  // +optional
   repeated APIGroupDiscovery items = 2;
 }
 
@@ -67,40 +70,48 @@ message APIResourceDiscovery {
   // for this resource across all versions in the API group.
   // Resources with non-empty groups are located at /apis/<APIGroupDiscovery.objectMeta.name>/<APIVersionDiscovery.version>/<APIResourceDiscovery.Resource>
   // Resources with empty groups are located at /api/v1/<APIResourceDiscovery.Resource>
+  // +optional
   optional string resource = 1;
 
   // responseKind describes the group, version, and kind of the serialization schema for the object type this endpoint typically returns.
   // APIs may return other objects types at their discretion, such as error conditions, requests for alternate representations, or other operation specific behavior.
   // This value will be null or empty if an APIService reports subresources but supports no operations on the parent resource
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind responseKind = 2;
 
   // scope indicates the scope of a resource, either Cluster or Namespaced
+  // +optional
   optional string scope = 3;
 
   // singularResource is the singular name of the resource.  This allows clients to handle plural and singular opaquely.
   // For many clients the singular form of the resource will be more understandable to users reading messages and should be used when integrating the name of the resource into a sentence.
   // The command line tool kubectl, for example, allows use of the singular resource name in place of plurals.
   // The singular form of a resource should always be an optional element - when in doubt use the canonical resource name.
+  // +optional
   optional string singularResource = 4;
 
   // verbs is a list of supported API operation types (this includes
   // but is not limited to get, list, watch, create, update, patch,
   // delete, deletecollection, and proxy).
   // +listType=set
+  // +optional
   repeated string verbs = 5;
 
   // shortNames is a list of suggested short names of the resource.
   // +listType=set
+  // +optional
   repeated string shortNames = 6;
 
   // categories is a list of the grouped resources this resource belongs to (e.g. 'all').
   // Clients may use this to simplify acting on multiple resource types at once.
   // +listType=set
+  // +optional
   repeated string categories = 7;
 
   // subresources is a list of subresources provided by this resource. Subresources are located at /apis/<APIGroupDiscovery.objectMeta.name>/<APIVersionDiscovery.version>/<APIResourceDiscovery.Resource>/name-of-instance/<APIResourceDiscovery.subresources[i].subresource>
   // +listType=map
   // +listMapKey=subresource
+  // +optional
   repeated APISubresourceDiscovery subresources = 8;
 }
 
@@ -108,10 +119,12 @@ message APIResourceDiscovery {
 message APISubresourceDiscovery {
   // subresource is the name of the subresource.  This is used in the URL path and is the unique identifier
   // for this resource across all versions.
+  // +optional
   optional string subresource = 1;
 
   // responseKind describes the group, version, and kind of the serialization schema for the object type this endpoint typically returns.
   // Some subresources do not return normal resources, these will have null or empty return types.
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind responseKind = 2;
 
   // acceptedTypes describes the kinds that this endpoint accepts.
@@ -122,6 +135,7 @@ message APISubresourceDiscovery {
   // +listMapKey=group
   // +listMapKey=version
   // +listMapKey=kind
+  // +optional
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind acceptedTypes = 3;
 
   // verbs is a list of supported API operation types (this includes
@@ -131,17 +145,20 @@ message APISubresourceDiscovery {
   // should expect the behavior of standard verbs to align with
   // Kubernetes interaction conventions.
   // +listType=set
+  // +optional
   repeated string verbs = 4;
 }
 
 // APIVersionDiscovery holds a list of APIResourceDiscovery types that are served for a particular version within an API Group.
 message APIVersionDiscovery {
   // version is the name of the version within a group version.
+  // +optional
   optional string version = 1;
 
   // resources is a list of APIResourceDiscovery objects for the corresponding group version.
   // +listType=map
   // +listMapKey=resource
+  // +optional
   repeated APIResourceDiscovery resources = 2;
 
   // freshness marks whether a group version's discovery document is up to date.
@@ -151,6 +168,7 @@ message APIVersionDiscovery {
   // significantly out of date. Clients that require the latest
   // version of the discovery information be retrieved before
   // performing an operation should not use the aggregated document
+  // +optional
   optional string freshness = 3;
 }
 
diff --git a/vendor/k8s.io/api/apidiscovery/v2/types.go b/vendor/k8s.io/api/apidiscovery/v2/types.go
index 761bb6990b..5cf6d9c551 100644
--- a/vendor/k8s.io/api/apidiscovery/v2/types.go
+++ b/vendor/k8s.io/api/apidiscovery/v2/types.go
@@ -28,12 +28,13 @@ import (
 // list of API resources (built-ins, Custom Resource Definitions, resources from aggregated servers)
 // that a cluster supports.
 type APIGroupDiscoveryList struct {
-	v1.TypeMeta `json:",inline"`
+	v1.TypeMeta `json:""`
 	// ResourceVersion will not be set, because this does not have a replayable ordering among multiple apiservers.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	v1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	// items is the list of groups for discovery. The groups are listed in priority order.
+	// +optional
 	Items []APIGroupDiscovery `json:"items" protobuf:"bytes,2,rep,name=items"`
 }
 
@@ -44,28 +45,32 @@ type APIGroupDiscoveryList struct {
 // It contains a list of APIVersionDiscovery that holds a list of APIResourceDiscovery types served for a version.
 // Versions are in descending order of preference, with the first version being the preferred entry.
 type APIGroupDiscovery struct {
-	v1.TypeMeta `json:",inline"`
+	v1.TypeMeta `json:""`
 	// metadata is standard object's metadata.
 	// The only field completed will be name. For instance, resourceVersion will be empty.
 	// name is the name of the API group whose discovery information is presented here.
 	// name is allowed to be "" to represent the legacy, ungroupified resources.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	v1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	// versions are the versions supported in this group. They are sorted in descending order of preference,
 	// with the preferred version being the first entry.
 	// +listType=map
 	// +listMapKey=version
+	// +optional
 	Versions []APIVersionDiscovery `json:"versions,omitempty" protobuf:"bytes,2,rep,name=versions"`
 }
 
 // APIVersionDiscovery holds a list of APIResourceDiscovery types that are served for a particular version within an API Group.
 type APIVersionDiscovery struct {
 	// version is the name of the version within a group version.
+	// +optional
 	Version string `json:"version" protobuf:"bytes,1,opt,name=version"`
 	// resources is a list of APIResourceDiscovery objects for the corresponding group version.
 	// +listType=map
 	// +listMapKey=resource
+	// +optional
 	Resources []APIResourceDiscovery `json:"resources,omitempty" protobuf:"bytes,2,rep,name=resources"`
 	// freshness marks whether a group version's discovery document is up to date.
 	// "Current" indicates the discovery document was recently
@@ -74,6 +79,7 @@ type APIVersionDiscovery struct {
 	// significantly out of date. Clients that require the latest
 	// version of the discovery information be retrieved before
 	// performing an operation should not use the aggregated document
+	// +optional
 	Freshness DiscoveryFreshness `json:"freshness,omitempty" protobuf:"bytes,3,opt,name=freshness"`
 }
 
@@ -83,33 +89,41 @@ type APIResourceDiscovery struct {
 	// for this resource across all versions in the API group.
 	// Resources with non-empty groups are located at /apis/<APIGroupDiscovery.objectMeta.name>/<APIVersionDiscovery.version>/<APIResourceDiscovery.Resource>
 	// Resources with empty groups are located at /api/v1/<APIResourceDiscovery.Resource>
+	// +optional
 	Resource string `json:"resource" protobuf:"bytes,1,opt,name=resource"`
 	// responseKind describes the group, version, and kind of the serialization schema for the object type this endpoint typically returns.
 	// APIs may return other objects types at their discretion, such as error conditions, requests for alternate representations, or other operation specific behavior.
 	// This value will be null or empty if an APIService reports subresources but supports no operations on the parent resource
+	// +optional
 	ResponseKind *v1.GroupVersionKind `json:"responseKind,omitempty" protobuf:"bytes,2,opt,name=responseKind"`
 	// scope indicates the scope of a resource, either Cluster or Namespaced
+	// +optional
 	Scope ResourceScope `json:"scope" protobuf:"bytes,3,opt,name=scope"`
 	// singularResource is the singular name of the resource.  This allows clients to handle plural and singular opaquely.
 	// For many clients the singular form of the resource will be more understandable to users reading messages and should be used when integrating the name of the resource into a sentence.
 	// The command line tool kubectl, for example, allows use of the singular resource name in place of plurals.
 	// The singular form of a resource should always be an optional element - when in doubt use the canonical resource name.
+	// +optional
 	SingularResource string `json:"singularResource" protobuf:"bytes,4,opt,name=singularResource"`
 	// verbs is a list of supported API operation types (this includes
 	// but is not limited to get, list, watch, create, update, patch,
 	// delete, deletecollection, and proxy).
 	// +listType=set
+	// +optional
 	Verbs []string `json:"verbs" protobuf:"bytes,5,opt,name=verbs"`
 	// shortNames is a list of suggested short names of the resource.
 	// +listType=set
+	// +optional
 	ShortNames []string `json:"shortNames,omitempty" protobuf:"bytes,6,rep,name=shortNames"`
 	// categories is a list of the grouped resources this resource belongs to (e.g. 'all').
 	// Clients may use this to simplify acting on multiple resource types at once.
 	// +listType=set
+	// +optional
 	Categories []string `json:"categories,omitempty" protobuf:"bytes,7,rep,name=categories"`
 	// subresources is a list of subresources provided by this resource. Subresources are located at /apis/<APIGroupDiscovery.objectMeta.name>/<APIVersionDiscovery.version>/<APIResourceDiscovery.Resource>/name-of-instance/<APIResourceDiscovery.subresources[i].subresource>
 	// +listType=map
 	// +listMapKey=subresource
+	// +optional
 	Subresources []APISubresourceDiscovery `json:"subresources,omitempty" protobuf:"bytes,8,rep,name=subresources"`
 }
 
@@ -133,9 +147,11 @@ const (
 type APISubresourceDiscovery struct {
 	// subresource is the name of the subresource.  This is used in the URL path and is the unique identifier
 	// for this resource across all versions.
+	// +optional
 	Subresource string `json:"subresource" protobuf:"bytes,1,opt,name=subresource"`
 	// responseKind describes the group, version, and kind of the serialization schema for the object type this endpoint typically returns.
 	// Some subresources do not return normal resources, these will have null or empty return types.
+	// +optional
 	ResponseKind *v1.GroupVersionKind `json:"responseKind,omitempty" protobuf:"bytes,2,opt,name=responseKind"`
 	// acceptedTypes describes the kinds that this endpoint accepts.
 	// Subresources may accept the standard content types or define
@@ -145,6 +161,7 @@ type APISubresourceDiscovery struct {
 	// +listMapKey=group
 	// +listMapKey=version
 	// +listMapKey=kind
+	// +optional
 	AcceptedTypes []v1.GroupVersionKind `json:"acceptedTypes,omitempty" protobuf:"bytes,3,rep,name=acceptedTypes"`
 	// verbs is a list of supported API operation types (this includes
 	// but is not limited to get, list, watch, create, update, patch,
@@ -153,5 +170,6 @@ type APISubresourceDiscovery struct {
 	// should expect the behavior of standard verbs to align with
 	// Kubernetes interaction conventions.
 	// +listType=set
+	// +optional
 	Verbs []string `json:"verbs" protobuf:"bytes,4,opt,name=verbs"`
 }
diff --git a/vendor/k8s.io/api/apidiscovery/v2beta1/generated.pb.go b/vendor/k8s.io/api/apidiscovery/v2beta1/generated.pb.go
deleted file mode 100644
index 8994f570f5..0000000000
--- a/vendor/k8s.io/api/apidiscovery/v2beta1/generated.pb.go
+++ /dev/null
@@ -1,1537 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: k8s.io/api/apidiscovery/v2beta1/generated.proto
-
-package v2beta1
-
-import (
-	fmt "fmt"
-
-	io "io"
-
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-	math_bits "math/bits"
-	reflect "reflect"
-	strings "strings"
-)
-
-func (m *APIGroupDiscovery) Reset() { *m = APIGroupDiscovery{} }
-
-func (m *APIGroupDiscoveryList) Reset() { *m = APIGroupDiscoveryList{} }
-
-func (m *APIResourceDiscovery) Reset() { *m = APIResourceDiscovery{} }
-
-func (m *APISubresourceDiscovery) Reset() { *m = APISubresourceDiscovery{} }
-
-func (m *APIVersionDiscovery) Reset() { *m = APIVersionDiscovery{} }
-
-func (m *APIGroupDiscovery) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *APIGroupDiscovery) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *APIGroupDiscovery) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if len(m.Versions) > 0 {
-		for iNdEx := len(m.Versions) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.Versions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintGenerated(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x12
-		}
-	}
-	{
-		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
-func (m *APIGroupDiscoveryList) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *APIGroupDiscoveryList) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *APIGroupDiscoveryList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if len(m.Items) > 0 {
-		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintGenerated(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x12
-		}
-	}
-	{
-		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
-func (m *APIResourceDiscovery) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *APIResourceDiscovery) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *APIResourceDiscovery) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if len(m.Subresources) > 0 {
-		for iNdEx := len(m.Subresources) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.Subresources[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintGenerated(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x42
-		}
-	}
-	if len(m.Categories) > 0 {
-		for iNdEx := len(m.Categories) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Categories[iNdEx])
-			copy(dAtA[i:], m.Categories[iNdEx])
-			i = encodeVarintGenerated(dAtA, i, uint64(len(m.Categories[iNdEx])))
-			i--
-			dAtA[i] = 0x3a
-		}
-	}
-	if len(m.ShortNames) > 0 {
-		for iNdEx := len(m.ShortNames) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.ShortNames[iNdEx])
-			copy(dAtA[i:], m.ShortNames[iNdEx])
-			i = encodeVarintGenerated(dAtA, i, uint64(len(m.ShortNames[iNdEx])))
-			i--
-			dAtA[i] = 0x32
-		}
-	}
-	if len(m.Verbs) > 0 {
-		for iNdEx := len(m.Verbs) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Verbs[iNdEx])
-			copy(dAtA[i:], m.Verbs[iNdEx])
-			i = encodeVarintGenerated(dAtA, i, uint64(len(m.Verbs[iNdEx])))
-			i--
-			dAtA[i] = 0x2a
-		}
-	}
-	i -= len(m.SingularResource)
-	copy(dAtA[i:], m.SingularResource)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.SingularResource)))
-	i--
-	dAtA[i] = 0x22
-	i -= len(m.Scope)
-	copy(dAtA[i:], m.Scope)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Scope)))
-	i--
-	dAtA[i] = 0x1a
-	if m.ResponseKind != nil {
-		{
-			size, err := m.ResponseKind.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintGenerated(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x12
-	}
-	i -= len(m.Resource)
-	copy(dAtA[i:], m.Resource)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Resource)))
-	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
-func (m *APISubresourceDiscovery) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *APISubresourceDiscovery) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *APISubresourceDiscovery) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if len(m.Verbs) > 0 {
-		for iNdEx := len(m.Verbs) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Verbs[iNdEx])
-			copy(dAtA[i:], m.Verbs[iNdEx])
-			i = encodeVarintGenerated(dAtA, i, uint64(len(m.Verbs[iNdEx])))
-			i--
-			dAtA[i] = 0x22
-		}
-	}
-	if len(m.AcceptedTypes) > 0 {
-		for iNdEx := len(m.AcceptedTypes) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.AcceptedTypes[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintGenerated(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x1a
-		}
-	}
-	if m.ResponseKind != nil {
-		{
-			size, err := m.ResponseKind.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintGenerated(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x12
-	}
-	i -= len(m.Subresource)
-	copy(dAtA[i:], m.Subresource)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Subresource)))
-	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
-func (m *APIVersionDiscovery) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *APIVersionDiscovery) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *APIVersionDiscovery) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	i -= len(m.Freshness)
-	copy(dAtA[i:], m.Freshness)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Freshness)))
-	i--
-	dAtA[i] = 0x1a
-	if len(m.Resources) > 0 {
-		for iNdEx := len(m.Resources) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.Resources[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintGenerated(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x12
-		}
-	}
-	i -= len(m.Version)
-	copy(dAtA[i:], m.Version)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Version)))
-	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
-func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
-	offset -= sovGenerated(v)
-	base := offset
-	for v >= 1<<7 {
-		dAtA[offset] = uint8(v&0x7f | 0x80)
-		v >>= 7
-		offset++
-	}
-	dAtA[offset] = uint8(v)
-	return base
-}
-func (m *APIGroupDiscovery) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = m.ObjectMeta.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	if len(m.Versions) > 0 {
-		for _, e := range m.Versions {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
-		}
-	}
-	return n
-}
-
-func (m *APIGroupDiscoveryList) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = m.ListMeta.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	if len(m.Items) > 0 {
-		for _, e := range m.Items {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
-		}
-	}
-	return n
-}
-
-func (m *APIResourceDiscovery) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = len(m.Resource)
-	n += 1 + l + sovGenerated(uint64(l))
-	if m.ResponseKind != nil {
-		l = m.ResponseKind.Size()
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	l = len(m.Scope)
-	n += 1 + l + sovGenerated(uint64(l))
-	l = len(m.SingularResource)
-	n += 1 + l + sovGenerated(uint64(l))
-	if len(m.Verbs) > 0 {
-		for _, s := range m.Verbs {
-			l = len(s)
-			n += 1 + l + sovGenerated(uint64(l))
-		}
-	}
-	if len(m.ShortNames) > 0 {
-		for _, s := range m.ShortNames {
-			l = len(s)
-			n += 1 + l + sovGenerated(uint64(l))
-		}
-	}
-	if len(m.Categories) > 0 {
-		for _, s := range m.Categories {
-			l = len(s)
-			n += 1 + l + sovGenerated(uint64(l))
-		}
-	}
-	if len(m.Subresources) > 0 {
-		for _, e := range m.Subresources {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
-		}
-	}
-	return n
-}
-
-func (m *APISubresourceDiscovery) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = len(m.Subresource)
-	n += 1 + l + sovGenerated(uint64(l))
-	if m.ResponseKind != nil {
-		l = m.ResponseKind.Size()
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	if len(m.AcceptedTypes) > 0 {
-		for _, e := range m.AcceptedTypes {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
-		}
-	}
-	if len(m.Verbs) > 0 {
-		for _, s := range m.Verbs {
-			l = len(s)
-			n += 1 + l + sovGenerated(uint64(l))
-		}
-	}
-	return n
-}
-
-func (m *APIVersionDiscovery) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = len(m.Version)
-	n += 1 + l + sovGenerated(uint64(l))
-	if len(m.Resources) > 0 {
-		for _, e := range m.Resources {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
-		}
-	}
-	l = len(m.Freshness)
-	n += 1 + l + sovGenerated(uint64(l))
-	return n
-}
-
-func sovGenerated(x uint64) (n int) {
-	return (math_bits.Len64(x|1) + 6) / 7
-}
-func sozGenerated(x uint64) (n int) {
-	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
-}
-func (this *APIGroupDiscovery) String() string {
-	if this == nil {
-		return "nil"
-	}
-	repeatedStringForVersions := "[]APIVersionDiscovery{"
-	for _, f := range this.Versions {
-		repeatedStringForVersions += strings.Replace(strings.Replace(f.String(), "APIVersionDiscovery", "APIVersionDiscovery", 1), `&`, ``, 1) + ","
-	}
-	repeatedStringForVersions += "}"
-	s := strings.Join([]string{`&APIGroupDiscovery{`,
-		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
-		`Versions:` + repeatedStringForVersions + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func (this *APIGroupDiscoveryList) String() string {
-	if this == nil {
-		return "nil"
-	}
-	repeatedStringForItems := "[]APIGroupDiscovery{"
-	for _, f := range this.Items {
-		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "APIGroupDiscovery", "APIGroupDiscovery", 1), `&`, ``, 1) + ","
-	}
-	repeatedStringForItems += "}"
-	s := strings.Join([]string{`&APIGroupDiscoveryList{`,
-		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
-		`Items:` + repeatedStringForItems + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func (this *APIResourceDiscovery) String() string {
-	if this == nil {
-		return "nil"
-	}
-	repeatedStringForSubresources := "[]APISubresourceDiscovery{"
-	for _, f := range this.Subresources {
-		repeatedStringForSubresources += strings.Replace(strings.Replace(f.String(), "APISubresourceDiscovery", "APISubresourceDiscovery", 1), `&`, ``, 1) + ","
-	}
-	repeatedStringForSubresources += "}"
-	s := strings.Join([]string{`&APIResourceDiscovery{`,
-		`Resource:` + fmt.Sprintf("%v", this.Resource) + `,`,
-		`ResponseKind:` + strings.Replace(fmt.Sprintf("%v", this.ResponseKind), "GroupVersionKind", "v1.GroupVersionKind", 1) + `,`,
-		`Scope:` + fmt.Sprintf("%v", this.Scope) + `,`,
-		`SingularResource:` + fmt.Sprintf("%v", this.SingularResource) + `,`,
-		`Verbs:` + fmt.Sprintf("%v", this.Verbs) + `,`,
-		`ShortNames:` + fmt.Sprintf("%v", this.ShortNames) + `,`,
-		`Categories:` + fmt.Sprintf("%v", this.Categories) + `,`,
-		`Subresources:` + repeatedStringForSubresources + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func (this *APISubresourceDiscovery) String() string {
-	if this == nil {
-		return "nil"
-	}
-	repeatedStringForAcceptedTypes := "[]GroupVersionKind{"
-	for _, f := range this.AcceptedTypes {
-		repeatedStringForAcceptedTypes += fmt.Sprintf("%v", f) + ","
-	}
-	repeatedStringForAcceptedTypes += "}"
-	s := strings.Join([]string{`&APISubresourceDiscovery{`,
-		`Subresource:` + fmt.Sprintf("%v", this.Subresource) + `,`,
-		`ResponseKind:` + strings.Replace(fmt.Sprintf("%v", this.ResponseKind), "GroupVersionKind", "v1.GroupVersionKind", 1) + `,`,
-		`AcceptedTypes:` + repeatedStringForAcceptedTypes + `,`,
-		`Verbs:` + fmt.Sprintf("%v", this.Verbs) + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func (this *APIVersionDiscovery) String() string {
-	if this == nil {
-		return "nil"
-	}
-	repeatedStringForResources := "[]APIResourceDiscovery{"
-	for _, f := range this.Resources {
-		repeatedStringForResources += strings.Replace(strings.Replace(f.String(), "APIResourceDiscovery", "APIResourceDiscovery", 1), `&`, ``, 1) + ","
-	}
-	repeatedStringForResources += "}"
-	s := strings.Join([]string{`&APIVersionDiscovery{`,
-		`Version:` + fmt.Sprintf("%v", this.Version) + `,`,
-		`Resources:` + repeatedStringForResources + `,`,
-		`Freshness:` + fmt.Sprintf("%v", this.Freshness) + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func valueToStringGenerated(v interface{}) string {
-	rv := reflect.ValueOf(v)
-	if rv.IsNil() {
-		return "nil"
-	}
-	pv := reflect.Indirect(rv).Interface()
-	return fmt.Sprintf("*%v", pv)
-}
-func (m *APIGroupDiscovery) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: APIGroupDiscovery: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: APIGroupDiscovery: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Versions", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Versions = append(m.Versions, APIVersionDiscovery{})
-			if err := m.Versions[len(m.Versions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *APIGroupDiscoveryList) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: APIGroupDiscoveryList: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: APIGroupDiscoveryList: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Items = append(m.Items, APIGroupDiscovery{})
-			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *APIResourceDiscovery) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: APIResourceDiscovery: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: APIResourceDiscovery: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Resource", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Resource = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResponseKind", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if m.ResponseKind == nil {
-				m.ResponseKind = &v1.GroupVersionKind{}
-			}
-			if err := m.ResponseKind.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Scope", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Scope = ResourceScope(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SingularResource", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.SingularResource = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Verbs", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Verbs = append(m.Verbs, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		case 6:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ShortNames", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.ShortNames = append(m.ShortNames, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		case 7:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Categories", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Categories = append(m.Categories, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		case 8:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Subresources", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Subresources = append(m.Subresources, APISubresourceDiscovery{})
-			if err := m.Subresources[len(m.Subresources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *APISubresourceDiscovery) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: APISubresourceDiscovery: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: APISubresourceDiscovery: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Subresource", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Subresource = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResponseKind", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if m.ResponseKind == nil {
-				m.ResponseKind = &v1.GroupVersionKind{}
-			}
-			if err := m.ResponseKind.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AcceptedTypes", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.AcceptedTypes = append(m.AcceptedTypes, v1.GroupVersionKind{})
-			if err := m.AcceptedTypes[len(m.AcceptedTypes)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Verbs", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Verbs = append(m.Verbs, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *APIVersionDiscovery) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: APIVersionDiscovery: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: APIVersionDiscovery: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Version = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Resources", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Resources = append(m.Resources, APIResourceDiscovery{})
-			if err := m.Resources[len(m.Resources)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Freshness", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Freshness = DiscoveryFreshness(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func skipGenerated(dAtA []byte) (n int, err error) {
-	l := len(dAtA)
-	iNdEx := 0
-	depth := 0
-	for iNdEx < l {
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return 0, ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return 0, io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= (uint64(b) & 0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		wireType := int(wire & 0x7)
-		switch wireType {
-		case 0:
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return 0, ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return 0, io.ErrUnexpectedEOF
-				}
-				iNdEx++
-				if dAtA[iNdEx-1] < 0x80 {
-					break
-				}
-			}
-		case 1:
-			iNdEx += 8
-		case 2:
-			var length int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return 0, ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return 0, io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				length |= (int(b) & 0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if length < 0 {
-				return 0, ErrInvalidLengthGenerated
-			}
-			iNdEx += length
-		case 3:
-			depth++
-		case 4:
-			if depth == 0 {
-				return 0, ErrUnexpectedEndOfGroupGenerated
-			}
-			depth--
-		case 5:
-			iNdEx += 4
-		default:
-			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
-		}
-		if iNdEx < 0 {
-			return 0, ErrInvalidLengthGenerated
-		}
-		if depth == 0 {
-			return iNdEx, nil
-		}
-	}
-	return 0, io.ErrUnexpectedEOF
-}
-
-var (
-	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
-	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
-	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
-)
diff --git a/vendor/k8s.io/api/apidiscovery/v2beta1/generated.proto b/vendor/k8s.io/api/apidiscovery/v2beta1/generated.proto
deleted file mode 100644
index f81449e6a9..0000000000
--- a/vendor/k8s.io/api/apidiscovery/v2beta1/generated.proto
+++ /dev/null
@@ -1,156 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-
-// This file was autogenerated by go-to-protobuf. Do not edit it manually!
-
-syntax = "proto2";
-
-package k8s.io.api.apidiscovery.v2beta1;
-
-import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
-import "k8s.io/apimachinery/pkg/runtime/generated.proto";
-import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
-
-// Package-wide variables from generator "generated".
-option go_package = "k8s.io/api/apidiscovery/v2beta1";
-
-// APIGroupDiscovery holds information about which resources are being served for all version of the API Group.
-// It contains a list of APIVersionDiscovery that holds a list of APIResourceDiscovery types served for a version.
-// Versions are in descending order of preference, with the first version being the preferred entry.
-message APIGroupDiscovery {
-  // metadata is standard object's metadata.
-  // The only field completed will be name. For instance, resourceVersion will be empty.
-  // name is the name of the API group whose discovery information is presented here.
-  // name is allowed to be "" to represent the legacy, ungroupified resources.
-  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-  // +optional
-  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
-
-  // versions are the versions supported in this group. They are sorted in descending order of preference,
-  // with the preferred version being the first entry.
-  // +listType=map
-  // +listMapKey=version
-  repeated APIVersionDiscovery versions = 2;
-}
-
-// APIGroupDiscoveryList is a resource containing a list of APIGroupDiscovery.
-// This is one of the types able to be returned from the /api and /apis endpoint and contains an aggregated
-// list of API resources (built-ins, Custom Resource Definitions, resources from aggregated servers)
-// that a cluster supports.
-message APIGroupDiscoveryList {
-  // ResourceVersion will not be set, because this does not have a replayable ordering among multiple apiservers.
-  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-  // +optional
-  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
-
-  // items is the list of groups for discovery. The groups are listed in priority order.
-  repeated APIGroupDiscovery items = 2;
-}
-
-// APIResourceDiscovery provides information about an API resource for discovery.
-message APIResourceDiscovery {
-  // resource is the plural name of the resource.  This is used in the URL path and is the unique identifier
-  // for this resource across all versions in the API group.
-  // Resources with non-empty groups are located at /apis/<APIGroupDiscovery.objectMeta.name>/<APIVersionDiscovery.version>/<APIResourceDiscovery.Resource>
-  // Resources with empty groups are located at /api/v1/<APIResourceDiscovery.Resource>
-  optional string resource = 1;
-
-  // responseKind describes the group, version, and kind of the serialization schema for the object type this endpoint typically returns.
-  // APIs may return other objects types at their discretion, such as error conditions, requests for alternate representations, or other operation specific behavior.
-  // This value will be null or empty if an APIService reports subresources but supports no operations on the parent resource
-  optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind responseKind = 2;
-
-  // scope indicates the scope of a resource, either Cluster or Namespaced
-  optional string scope = 3;
-
-  // singularResource is the singular name of the resource.  This allows clients to handle plural and singular opaquely.
-  // For many clients the singular form of the resource will be more understandable to users reading messages and should be used when integrating the name of the resource into a sentence.
-  // The command line tool kubectl, for example, allows use of the singular resource name in place of plurals.
-  // The singular form of a resource should always be an optional element - when in doubt use the canonical resource name.
-  optional string singularResource = 4;
-
-  // verbs is a list of supported API operation types (this includes
-  // but is not limited to get, list, watch, create, update, patch,
-  // delete, deletecollection, and proxy).
-  // +listType=set
-  repeated string verbs = 5;
-
-  // shortNames is a list of suggested short names of the resource.
-  // +listType=set
-  repeated string shortNames = 6;
-
-  // categories is a list of the grouped resources this resource belongs to (e.g. 'all').
-  // Clients may use this to simplify acting on multiple resource types at once.
-  // +listType=set
-  repeated string categories = 7;
-
-  // subresources is a list of subresources provided by this resource. Subresources are located at /apis/<APIGroupDiscovery.objectMeta.name>/<APIVersionDiscovery.version>/<APIResourceDiscovery.Resource>/name-of-instance/<APIResourceDiscovery.subresources[i].subresource>
-  // +listType=map
-  // +listMapKey=subresource
-  repeated APISubresourceDiscovery subresources = 8;
-}
-
-// APISubresourceDiscovery provides information about an API subresource for discovery.
-message APISubresourceDiscovery {
-  // subresource is the name of the subresource.  This is used in the URL path and is the unique identifier
-  // for this resource across all versions.
-  optional string subresource = 1;
-
-  // responseKind describes the group, version, and kind of the serialization schema for the object type this endpoint typically returns.
-  // Some subresources do not return normal resources, these will have null or empty return types.
-  optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind responseKind = 2;
-
-  // acceptedTypes describes the kinds that this endpoint accepts.
-  // Subresources may accept the standard content types or define
-  // custom negotiation schemes. The list may not be exhaustive for
-  // all operations.
-  // +listType=map
-  // +listMapKey=group
-  // +listMapKey=version
-  // +listMapKey=kind
-  repeated .k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind acceptedTypes = 3;
-
-  // verbs is a list of supported API operation types (this includes
-  // but is not limited to get, list, watch, create, update, patch,
-  // delete, deletecollection, and proxy). Subresources may define
-  // custom verbs outside the standard Kubernetes verb set. Clients
-  // should expect the behavior of standard verbs to align with
-  // Kubernetes interaction conventions.
-  // +listType=set
-  repeated string verbs = 4;
-}
-
-// APIVersionDiscovery holds a list of APIResourceDiscovery types that are served for a particular version within an API Group.
-message APIVersionDiscovery {
-  // version is the name of the version within a group version.
-  optional string version = 1;
-
-  // resources is a list of APIResourceDiscovery objects for the corresponding group version.
-  // +listType=map
-  // +listMapKey=resource
-  repeated APIResourceDiscovery resources = 2;
-
-  // freshness marks whether a group version's discovery document is up to date.
-  // "Current" indicates the discovery document was recently
-  // refreshed. "Stale" indicates the discovery document could not
-  // be retrieved and the returned discovery document may be
-  // significantly out of date. Clients that require the latest
-  // version of the discovery information be retrieved before
-  // performing an operation should not use the aggregated document
-  optional string freshness = 3;
-}
-
diff --git a/vendor/k8s.io/api/apidiscovery/v2beta1/types.go b/vendor/k8s.io/api/apidiscovery/v2beta1/types.go
deleted file mode 100644
index 306264da4d..0000000000
--- a/vendor/k8s.io/api/apidiscovery/v2beta1/types.go
+++ /dev/null
@@ -1,163 +0,0 @@
-/*
-Copyright 2022 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v2beta1
-
-import (
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +k8s:prerelease-lifecycle-gen:introduced=1.26
-// +k8s:prerelease-lifecycle-gen:deprecated=1.32
-// +k8s:prerelease-lifecycle-gen:removed=1.35
-// The deprecate and remove versions stated above are rough estimates and may be subject to change. We are estimating v2 types will be available in 1.28 and will support 4 versions where both v2beta1 and v2 are supported before deprecation.
-
-// APIGroupDiscoveryList is a resource containing a list of APIGroupDiscovery.
-// This is one of the types able to be returned from the /api and /apis endpoint and contains an aggregated
-// list of API resources (built-ins, Custom Resource Definitions, resources from aggregated servers)
-// that a cluster supports.
-type APIGroupDiscoveryList struct {
-	v1.TypeMeta `json:",inline"`
-	// ResourceVersion will not be set, because this does not have a replayable ordering among multiple apiservers.
-	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-	// +optional
-	v1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-	// items is the list of groups for discovery. The groups are listed in priority order.
-	Items []APIGroupDiscovery `json:"items" protobuf:"bytes,2,rep,name=items"`
-}
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +k8s:prerelease-lifecycle-gen:introduced=1.26
-// +k8s:prerelease-lifecycle-gen:deprecated=1.32
-// +k8s:prerelease-lifecycle-gen:removed=1.35
-// The deprecate and remove versions stated above are rough estimates and may be subject to change. We are estimating v2 types will be available in 1.28 and will support 4 versions where both v2beta1 and v2 are supported before deprecation.
-
-// APIGroupDiscovery holds information about which resources are being served for all version of the API Group.
-// It contains a list of APIVersionDiscovery that holds a list of APIResourceDiscovery types served for a version.
-// Versions are in descending order of preference, with the first version being the preferred entry.
-type APIGroupDiscovery struct {
-	v1.TypeMeta `json:",inline"`
-	// metadata is standard object's metadata.
-	// The only field completed will be name. For instance, resourceVersion will be empty.
-	// name is the name of the API group whose discovery information is presented here.
-	// name is allowed to be "" to represent the legacy, ungroupified resources.
-	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-	// +optional
-	v1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-	// versions are the versions supported in this group. They are sorted in descending order of preference,
-	// with the preferred version being the first entry.
-	// +listType=map
-	// +listMapKey=version
-	Versions []APIVersionDiscovery `json:"versions,omitempty" protobuf:"bytes,2,rep,name=versions"`
-}
-
-// APIVersionDiscovery holds a list of APIResourceDiscovery types that are served for a particular version within an API Group.
-type APIVersionDiscovery struct {
-	// version is the name of the version within a group version.
-	Version string `json:"version" protobuf:"bytes,1,opt,name=version"`
-	// resources is a list of APIResourceDiscovery objects for the corresponding group version.
-	// +listType=map
-	// +listMapKey=resource
-	Resources []APIResourceDiscovery `json:"resources,omitempty" protobuf:"bytes,2,rep,name=resources"`
-	// freshness marks whether a group version's discovery document is up to date.
-	// "Current" indicates the discovery document was recently
-	// refreshed. "Stale" indicates the discovery document could not
-	// be retrieved and the returned discovery document may be
-	// significantly out of date. Clients that require the latest
-	// version of the discovery information be retrieved before
-	// performing an operation should not use the aggregated document
-	Freshness DiscoveryFreshness `json:"freshness,omitempty" protobuf:"bytes,3,opt,name=freshness"`
-}
-
-// APIResourceDiscovery provides information about an API resource for discovery.
-type APIResourceDiscovery struct {
-	// resource is the plural name of the resource.  This is used in the URL path and is the unique identifier
-	// for this resource across all versions in the API group.
-	// Resources with non-empty groups are located at /apis/<APIGroupDiscovery.objectMeta.name>/<APIVersionDiscovery.version>/<APIResourceDiscovery.Resource>
-	// Resources with empty groups are located at /api/v1/<APIResourceDiscovery.Resource>
-	Resource string `json:"resource" protobuf:"bytes,1,opt,name=resource"`
-	// responseKind describes the group, version, and kind of the serialization schema for the object type this endpoint typically returns.
-	// APIs may return other objects types at their discretion, such as error conditions, requests for alternate representations, or other operation specific behavior.
-	// This value will be null or empty if an APIService reports subresources but supports no operations on the parent resource
-	ResponseKind *v1.GroupVersionKind `json:"responseKind,omitempty" protobuf:"bytes,2,opt,name=responseKind"`
-	// scope indicates the scope of a resource, either Cluster or Namespaced
-	Scope ResourceScope `json:"scope" protobuf:"bytes,3,opt,name=scope"`
-	// singularResource is the singular name of the resource.  This allows clients to handle plural and singular opaquely.
-	// For many clients the singular form of the resource will be more understandable to users reading messages and should be used when integrating the name of the resource into a sentence.
-	// The command line tool kubectl, for example, allows use of the singular resource name in place of plurals.
-	// The singular form of a resource should always be an optional element - when in doubt use the canonical resource name.
-	SingularResource string `json:"singularResource" protobuf:"bytes,4,opt,name=singularResource"`
-	// verbs is a list of supported API operation types (this includes
-	// but is not limited to get, list, watch, create, update, patch,
-	// delete, deletecollection, and proxy).
-	// +listType=set
-	Verbs []string `json:"verbs" protobuf:"bytes,5,opt,name=verbs"`
-	// shortNames is a list of suggested short names of the resource.
-	// +listType=set
-	ShortNames []string `json:"shortNames,omitempty" protobuf:"bytes,6,rep,name=shortNames"`
-	// categories is a list of the grouped resources this resource belongs to (e.g. 'all').
-	// Clients may use this to simplify acting on multiple resource types at once.
-	// +listType=set
-	Categories []string `json:"categories,omitempty" protobuf:"bytes,7,rep,name=categories"`
-	// subresources is a list of subresources provided by this resource. Subresources are located at /apis/<APIGroupDiscovery.objectMeta.name>/<APIVersionDiscovery.version>/<APIResourceDiscovery.Resource>/name-of-instance/<APIResourceDiscovery.subresources[i].subresource>
-	// +listType=map
-	// +listMapKey=subresource
-	Subresources []APISubresourceDiscovery `json:"subresources,omitempty" protobuf:"bytes,8,rep,name=subresources"`
-}
-
-// ResourceScope is an enum defining the different scopes available to a resource.
-type ResourceScope string
-
-const (
-	ScopeCluster   ResourceScope = "Cluster"
-	ScopeNamespace ResourceScope = "Namespaced"
-)
-
-// DiscoveryFreshness is an enum defining whether the Discovery document published by an apiservice is up to date (fresh).
-type DiscoveryFreshness string
-
-const (
-	DiscoveryFreshnessCurrent DiscoveryFreshness = "Current"
-	DiscoveryFreshnessStale   DiscoveryFreshness = "Stale"
-)
-
-// APISubresourceDiscovery provides information about an API subresource for discovery.
-type APISubresourceDiscovery struct {
-	// subresource is the name of the subresource.  This is used in the URL path and is the unique identifier
-	// for this resource across all versions.
-	Subresource string `json:"subresource" protobuf:"bytes,1,opt,name=subresource"`
-	// responseKind describes the group, version, and kind of the serialization schema for the object type this endpoint typically returns.
-	// Some subresources do not return normal resources, these will have null or empty return types.
-	ResponseKind *v1.GroupVersionKind `json:"responseKind,omitempty" protobuf:"bytes,2,opt,name=responseKind"`
-	// acceptedTypes describes the kinds that this endpoint accepts.
-	// Subresources may accept the standard content types or define
-	// custom negotiation schemes. The list may not be exhaustive for
-	// all operations.
-	// +listType=map
-	// +listMapKey=group
-	// +listMapKey=version
-	// +listMapKey=kind
-	AcceptedTypes []v1.GroupVersionKind `json:"acceptedTypes,omitempty" protobuf:"bytes,3,rep,name=acceptedTypes"`
-	// verbs is a list of supported API operation types (this includes
-	// but is not limited to get, list, watch, create, update, patch,
-	// delete, deletecollection, and proxy). Subresources may define
-	// custom verbs outside the standard Kubernetes verb set. Clients
-	// should expect the behavior of standard verbs to align with
-	// Kubernetes interaction conventions.
-	// +listType=set
-	Verbs []string `json:"verbs" protobuf:"bytes,4,opt,name=verbs"`
-}
diff --git a/vendor/k8s.io/api/apidiscovery/v2beta1/zz_generated.prerelease-lifecycle.go b/vendor/k8s.io/api/apidiscovery/v2beta1/zz_generated.prerelease-lifecycle.go
deleted file mode 100644
index aa8f15fb4c..0000000000
--- a/vendor/k8s.io/api/apidiscovery/v2beta1/zz_generated.prerelease-lifecycle.go
+++ /dev/null
@@ -1,58 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by prerelease-lifecycle-gen. DO NOT EDIT.
-
-package v2beta1
-
-// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
-// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
-func (in *APIGroupDiscovery) APILifecycleIntroduced() (major, minor int) {
-	return 1, 26
-}
-
-// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
-// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or  "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
-func (in *APIGroupDiscovery) APILifecycleDeprecated() (major, minor int) {
-	return 1, 32
-}
-
-// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
-// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
-func (in *APIGroupDiscovery) APILifecycleRemoved() (major, minor int) {
-	return 1, 35
-}
-
-// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
-// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
-func (in *APIGroupDiscoveryList) APILifecycleIntroduced() (major, minor int) {
-	return 1, 26
-}
-
-// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
-// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or  "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
-func (in *APIGroupDiscoveryList) APILifecycleDeprecated() (major, minor int) {
-	return 1, 32
-}
-
-// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
-// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
-func (in *APIGroupDiscoveryList) APILifecycleRemoved() (major, minor int) {
-	return 1, 35
-}
diff --git a/vendor/k8s.io/api/apiserverinternal/v1alpha1/generated.proto b/vendor/k8s.io/api/apiserverinternal/v1alpha1/generated.proto
index e8f8c339df..73f007a651 100644
--- a/vendor/k8s.io/api/apiserverinternal/v1alpha1/generated.proto
+++ b/vendor/k8s.io/api/apiserverinternal/v1alpha1/generated.proto
@@ -55,6 +55,7 @@ message ServerStorageVersion {
 }
 
 // Storage version of a specific resource.
+// +k8s:supportsSubresource="/status"
 message StorageVersion {
   // metadata is the standard object metadata.
   // The name is <group>.<resource>.
diff --git a/vendor/k8s.io/api/apiserverinternal/v1alpha1/types.go b/vendor/k8s.io/api/apiserverinternal/v1alpha1/types.go
index 69c21fd3c4..f30cc53813 100644
--- a/vendor/k8s.io/api/apiserverinternal/v1alpha1/types.go
+++ b/vendor/k8s.io/api/apiserverinternal/v1alpha1/types.go
@@ -25,8 +25,9 @@ import (
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
 // Storage version of a specific resource.
+// +k8s:supportsSubresource="/status"
 type StorageVersion struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata.
 	// The name is <group>.<resource>.
 	// +required
@@ -135,7 +136,7 @@ type StorageVersionCondition struct {
 
 // A list of StorageVersions.
 type StorageVersionList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
diff --git a/vendor/k8s.io/api/apps/v1/generated.proto b/vendor/k8s.io/api/apps/v1/generated.proto
index 42d5415c2f..0c55e2ebce 100644
--- a/vendor/k8s.io/api/apps/v1/generated.proto
+++ b/vendor/k8s.io/api/apps/v1/generated.proto
@@ -46,9 +46,11 @@ message ControllerRevision {
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Data is the serialized representation of the state.
+  // +required
   optional .k8s.io.apimachinery.pkg.runtime.RawExtension data = 2;
 
   // Revision indicates the revision of the state represented by Data.
+  // +optional
   optional int64 revision = 3;
 }
 
@@ -63,6 +65,7 @@ message ControllerRevisionList {
 }
 
 // DaemonSet represents the configuration of a daemon set.
+// +k8s:supportsSubresource="/status"
 message DaemonSet {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -71,7 +74,7 @@ message DaemonSet {
 
   // The desired behavior of this daemon set.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-  // +optional
+  // +required
   optional DaemonSetSpec spec = 2;
 
   // The current status of this daemon set. This data may be
@@ -86,9 +89,11 @@ message DaemonSet {
 // DaemonSetCondition describes the state of a DaemonSet at a certain point.
 message DaemonSetCondition {
   // Type of DaemonSet condition.
+  // +optional
   optional string type = 1;
 
   // Status of the condition, one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // Last time the condition transitioned from one status to another.
@@ -121,6 +126,7 @@ message DaemonSetSpec {
   // Must match in order to be controlled.
   // It must match the pod template's labels.
   // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
+  // +required
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 1;
 
   // An object that describes the pod that will be created.
@@ -129,6 +135,7 @@ message DaemonSetSpec {
   // selector is specified).
   // The only allowed template.spec.restartPolicy value is "Always".
   // More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
+  // +required
   optional .k8s.io.api.core.v1.PodTemplateSpec template = 2;
 
   // An update strategy to replace existing DaemonSet pods with new pods.
@@ -221,6 +228,8 @@ message DaemonSetUpdateStrategy {
 }
 
 // Deployment enables declarative updates for Pods and ReplicaSets.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 message Deployment {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -228,7 +237,7 @@ message Deployment {
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Specification of the desired behavior of the Deployment.
-  // +optional
+  // +required
   optional DeploymentSpec spec = 2;
 
   // Most recently observed status of the Deployment.
@@ -239,21 +248,27 @@ message Deployment {
 // DeploymentCondition describes the state of a deployment at a certain point.
 message DeploymentCondition {
   // Type of deployment condition.
+  // +optional
   optional string type = 1;
 
   // Status of the condition, one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // The last time this condition was updated.
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastUpdateTime = 6;
 
   // Last time the condition transitioned from one status to another.
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 7;
 
   // The reason for the condition's last transition.
+  // +optional
   optional string reason = 4;
 
   // A human readable message indicating details about the transition.
+  // +optional
   optional string message = 5;
 }
 
@@ -277,10 +292,12 @@ message DeploymentSpec {
   // Label selector for pods. Existing ReplicaSets whose pods are
   // selected by this will be the ones affected by this deployment.
   // It must match the pod template's labels.
+  // +required
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;
 
   // Template describes the pods that will be created.
   // The only allowed template.spec.restartPolicy value is "Always".
+  // +required
   optional .k8s.io.api.core.v1.PodTemplateSpec template = 3;
 
   // The deployment strategy to use to replace existing pods with new ones.
@@ -309,6 +326,7 @@ message DeploymentSpec {
   // process failed deployments and a condition with a ProgressDeadlineExceeded
   // reason will be surfaced in the deployment status. Note that progress will
   // not be estimated during the time a deployment is paused. Defaults to 600s.
+  // +optional
   optional int32 progressDeadlineSeconds = 9;
 }
 
@@ -377,6 +395,8 @@ message DeploymentStrategy {
 }
 
 // ReplicaSet ensures that a specified number of pod replicas are running at any given time.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 message ReplicaSet {
   // If the Labels of a ReplicaSet are empty, they are defaulted to
   // be the same as the Pod(s) that the ReplicaSet manages.
@@ -387,7 +407,7 @@ message ReplicaSet {
 
   // Spec defines the specification of the desired behavior of the ReplicaSet.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-  // +optional
+  // +required
   optional ReplicaSetSpec spec = 2;
 
   // Status is the most recently observed status of the ReplicaSet.
@@ -402,9 +422,11 @@ message ReplicaSet {
 // ReplicaSetCondition describes the state of a replica set at a certain point.
 message ReplicaSetCondition {
   // Type of replica set condition.
+  // +optional
   optional string type = 1;
 
   // Status of the condition, one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // The last time the condition transitioned from one status to another.
@@ -451,6 +473,7 @@ message ReplicaSetSpec {
   // Label keys and values that must match in order to be controlled by this replica set.
   // It must match the pod template's labels.
   // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
+  // +required
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;
 
   // Template is the object that describes the pod that will be created if
@@ -598,6 +621,8 @@ message RollingUpdateStatefulSetStrategy {
 //
 // The StatefulSet guarantees that a given network identity will always
 // map to the same storage identity.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 message StatefulSet {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -605,7 +630,7 @@ message StatefulSet {
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Spec defines the desired identities of pods in this set.
-  // +optional
+  // +required
   optional StatefulSetSpec spec = 2;
 
   // Status is the current status of Pods in this StatefulSet. This data
@@ -617,9 +642,11 @@ message StatefulSet {
 // StatefulSetCondition describes the state of a statefulset at a certain point.
 message StatefulSetCondition {
   // Type of statefulset condition.
+  // +optional
   optional string type = 1;
 
   // Status of the condition, one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // Last time the condition transitioned from one status to another.
@@ -668,6 +695,7 @@ message StatefulSetPersistentVolumeClaimRetentionPolicy {
   // VolumeClaimTemplates when the StatefulSet is deleted. The default policy
   // of `Retain` causes PVCs to not be affected by StatefulSet deletion. The
   // `Delete` policy causes those PVCs to be deleted.
+  // +optional
   optional string whenDeleted = 1;
 
   // WhenScaled specifies what happens to PVCs created from StatefulSet
@@ -675,6 +703,7 @@ message StatefulSetPersistentVolumeClaimRetentionPolicy {
   // policy of `Retain` causes PVCs to not be affected by a scaledown. The
   // `Delete` policy causes the associated PVCs for any excess pods above
   // the replica count to be deleted.
+  // +optional
   optional string whenScaled = 2;
 }
 
@@ -691,6 +720,9 @@ message StatefulSetSpec {
   // selector is a label query over pods that should match the replica count.
   // It must match the pod template's labels.
   // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
+  // +required
+  // +k8s:alpha(since: "1.37")=+k8s:required
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;
 
   // template is the object that describes the pod that will be created if
@@ -700,6 +732,7 @@ message StatefulSetSpec {
   // <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named
   // "web" with index number "3" would be named "web-3".
   // The only allowed template.spec.restartPolicy value is "Always".
+  // +required
   optional .k8s.io.api.core.v1.PodTemplateSpec template = 3;
 
   // volumeClaimTemplates is a list of claims that pods are allowed to reference.
@@ -710,6 +743,9 @@ message StatefulSetSpec {
   // any volumes in the template, with the same name.
   // TODO: Define the behavior if a claim already exists with the same name.
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:opaqueType
   // +listType=atomic
   repeated .k8s.io.api.core.v1.PersistentVolumeClaim volumeClaimTemplates = 4;
 
@@ -719,6 +755,8 @@ message StatefulSetSpec {
   // pattern: pod-specific-string.serviceName.default.svc.cluster.local
   // where "pod-specific-string" is managed by the StatefulSet controller.
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   optional string serviceName = 5;
 
   // podManagementPolicy controls how pods are created during initial scale up,
@@ -730,17 +768,21 @@ message StatefulSetSpec {
   // to match the desired scale without waiting, and on scale down will delete
   // all pods at once.
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   optional string podManagementPolicy = 6;
 
   // updateStrategy indicates the StatefulSetUpdateStrategy that will be
   // employed to update Pods in the StatefulSet when a revision is made to
   // Template.
+  // +optional
   optional StatefulSetUpdateStrategy updateStrategy = 7;
 
   // revisionHistoryLimit is the maximum number of revisions that will
   // be maintained in the StatefulSet's revision history. The revision history
   // consists of all revisions not represented by a currently applied
   // StatefulSetSpec version. The default value is 10.
+  // +optional
   optional int32 revisionHistoryLimit = 8;
 
   // Minimum number of seconds for which a newly created pod should be ready
diff --git a/vendor/k8s.io/api/apps/v1/types.go b/vendor/k8s.io/api/apps/v1/types.go
index b8989c1406..c43afb8819 100644
--- a/vendor/k8s.io/api/apps/v1/types.go
+++ b/vendor/k8s.io/api/apps/v1/types.go
@@ -46,15 +46,17 @@ const (
 //
 // The StatefulSet guarantees that a given network identity will always
 // map to the same storage identity.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 type StatefulSet struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec defines the desired identities of pods in this set.
-	// +optional
+	// +required
 	Spec StatefulSetSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 
 	// Status is the current status of Pods in this StatefulSet. This data
@@ -104,12 +106,22 @@ const (
 	// strategy, new Pods will be created from the specification version indicated
 	// by the StatefulSet's updateRevision.
 	RollingUpdateStatefulSetStrategyType StatefulSetUpdateStrategyType = "RollingUpdate"
-	// OnDeleteStatefulSetStrategyType triggers the legacy behavior. Version
-	// tracking and ordered rolling restarts are disabled. Pods are recreated
-	// from the StatefulSetSpec when they are manually deleted. When a scale
-	// operation is performed with this strategy,specification version indicated
-	// by the StatefulSet's currentRevision.
+	// OnDeleteStatefulSetStrategyType disables ordered rolling restarts. Version
+	// tracking is done on a best-effort basis - the controller will try to
+	// eventually converge StatefulSet's currentRevision with updateRevision.
+	// Pods are recreated from the StatefulSetSpec when they are manually deleted.
+	// When a scale operation is performed with this strategy, new Pods will be
+	// created from the specification version indicated by the StatefulSet's updateRevision.
 	OnDeleteStatefulSetStrategyType StatefulSetUpdateStrategyType = "OnDelete"
+	// RecreateStatefulSetStrategyType indicates that all existing pods will be
+	// deleted and fully terminated before any new-revision pods are created.
+	// This ensures that old and new revision Pods never run at the same time.
+	// This is an alpha type and requires enabling StatefulSetRecreateStrategy feature gate.
+	// Switching to the Recreate strategy is allowed when the feature gate is enabled,
+	// and switching away from it to a different update strategy is also allowed.
+	//
+	// +featureGate=StatefulSetRecreateStrategy
+	RecreateStatefulSetStrategyType StatefulSetUpdateStrategyType = "Recreate"
 )
 
 // RollingUpdateStatefulSetStrategy is used to communicate parameter for RollingUpdateStatefulSetStrategyType.
@@ -158,12 +170,14 @@ type StatefulSetPersistentVolumeClaimRetentionPolicy struct {
 	// VolumeClaimTemplates when the StatefulSet is deleted. The default policy
 	// of `Retain` causes PVCs to not be affected by StatefulSet deletion. The
 	// `Delete` policy causes those PVCs to be deleted.
+	// +optional
 	WhenDeleted PersistentVolumeClaimRetentionPolicyType `json:"whenDeleted,omitempty" protobuf:"bytes,1,opt,name=whenDeleted,casttype=PersistentVolumeClaimRetentionPolicyType"`
 	// WhenScaled specifies what happens to PVCs created from StatefulSet
 	// VolumeClaimTemplates when the StatefulSet is scaled down. The default
 	// policy of `Retain` causes PVCs to not be affected by a scaledown. The
 	// `Delete` policy causes the associated PVCs for any excess pods above
 	// the replica count to be deleted.
+	// +optional
 	WhenScaled PersistentVolumeClaimRetentionPolicyType `json:"whenScaled,omitempty" protobuf:"bytes,2,opt,name=whenScaled,casttype=PersistentVolumeClaimRetentionPolicyType"`
 }
 
@@ -195,6 +209,9 @@ type StatefulSetSpec struct {
 	// selector is a label query over pods that should match the replica count.
 	// It must match the pod template's labels.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
+	// +required
+	// +k8s:alpha(since: "1.37")=+k8s:required
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
 	Selector *metav1.LabelSelector `json:"selector" protobuf:"bytes,2,opt,name=selector"`
 
 	// template is the object that describes the pod that will be created if
@@ -204,6 +221,7 @@ type StatefulSetSpec struct {
 	// <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named
 	// "web" with index number "3" would be named "web-3".
 	// The only allowed template.spec.restartPolicy value is "Always".
+	// +required
 	Template v1.PodTemplateSpec `json:"template" protobuf:"bytes,3,opt,name=template"`
 
 	// volumeClaimTemplates is a list of claims that pods are allowed to reference.
@@ -214,6 +232,9 @@ type StatefulSetSpec struct {
 	// any volumes in the template, with the same name.
 	// TODO: Define the behavior if a claim already exists with the same name.
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:opaqueType
 	// +listType=atomic
 	VolumeClaimTemplates []v1.PersistentVolumeClaim `json:"volumeClaimTemplates,omitempty" protobuf:"bytes,4,rep,name=volumeClaimTemplates"`
 
@@ -223,6 +244,8 @@ type StatefulSetSpec struct {
 	// pattern: pod-specific-string.serviceName.default.svc.cluster.local
 	// where "pod-specific-string" is managed by the StatefulSet controller.
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	ServiceName string `json:"serviceName" protobuf:"bytes,5,opt,name=serviceName"`
 
 	// podManagementPolicy controls how pods are created during initial scale up,
@@ -234,17 +257,21 @@ type StatefulSetSpec struct {
 	// to match the desired scale without waiting, and on scale down will delete
 	// all pods at once.
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	PodManagementPolicy PodManagementPolicyType `json:"podManagementPolicy,omitempty" protobuf:"bytes,6,opt,name=podManagementPolicy,casttype=PodManagementPolicyType"`
 
 	// updateStrategy indicates the StatefulSetUpdateStrategy that will be
 	// employed to update Pods in the StatefulSet when a revision is made to
 	// Template.
+	// +optional
 	UpdateStrategy StatefulSetUpdateStrategy `json:"updateStrategy,omitempty" protobuf:"bytes,7,opt,name=updateStrategy"`
 
 	// revisionHistoryLimit is the maximum number of revisions that will
 	// be maintained in the StatefulSet's revision history. The revision history
 	// consists of all revisions not represented by a currently applied
 	// StatefulSetSpec version. The default value is 10.
+	// +optional
 	RevisionHistoryLimit *int32 `json:"revisionHistoryLimit,omitempty" protobuf:"varint,8,opt,name=revisionHistoryLimit"`
 
 	// Minimum number of seconds for which a newly created pod should be ready
@@ -319,11 +346,19 @@ type StatefulSetStatus struct {
 
 type StatefulSetConditionType string
 
+const (
+	// StatefulSetProgressing means the StatefulSet is progressing through an update.
+	// This condition is an alpha type and requires enabling StatefulSetRecreateStrategy feature gate.
+	StatefulSetProgressing StatefulSetConditionType = "Progressing"
+)
+
 // StatefulSetCondition describes the state of a statefulset at a certain point.
 type StatefulSetCondition struct {
 	// Type of statefulset condition.
+	// +optional
 	Type StatefulSetConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=StatefulSetConditionType"`
 	// Status of the condition, one of True, False, Unknown.
+	// +optional
 	Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=k8s.io/api/core/v1.ConditionStatus"`
 	// Last time the condition transitioned from one status to another.
 	// +optional
@@ -341,7 +376,7 @@ type StatefulSetCondition struct {
 
 // StatefulSetList is a collection of StatefulSets.
 type StatefulSetList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -359,15 +394,17 @@ type StatefulSetList struct {
 // +k8s:prerelease-lifecycle-gen:introduced=1.9
 
 // Deployment enables declarative updates for Pods and ReplicaSets.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 type Deployment struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Specification of the desired behavior of the Deployment.
-	// +optional
+	// +required
 	Spec DeploymentSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 
 	// Most recently observed status of the Deployment.
@@ -385,10 +422,12 @@ type DeploymentSpec struct {
 	// Label selector for pods. Existing ReplicaSets whose pods are
 	// selected by this will be the ones affected by this deployment.
 	// It must match the pod template's labels.
+	// +required
 	Selector *metav1.LabelSelector `json:"selector" protobuf:"bytes,2,opt,name=selector"`
 
 	// Template describes the pods that will be created.
 	// The only allowed template.spec.restartPolicy value is "Always".
+	// +required
 	Template v1.PodTemplateSpec `json:"template" protobuf:"bytes,3,opt,name=template"`
 
 	// The deployment strategy to use to replace existing pods with new ones.
@@ -417,6 +456,7 @@ type DeploymentSpec struct {
 	// process failed deployments and a condition with a ProgressDeadlineExceeded
 	// reason will be surfaced in the deployment status. Note that progress will
 	// not be estimated during the time a deployment is paused. Defaults to 600s.
+	// +optional
 	ProgressDeadlineSeconds *int32 `json:"progressDeadlineSeconds,omitempty" protobuf:"varint,9,opt,name=progressDeadlineSeconds"`
 }
 
@@ -552,16 +592,22 @@ const (
 // DeploymentCondition describes the state of a deployment at a certain point.
 type DeploymentCondition struct {
 	// Type of deployment condition.
+	// +optional
 	Type DeploymentConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=DeploymentConditionType"`
 	// Status of the condition, one of True, False, Unknown.
+	// +optional
 	Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=k8s.io/api/core/v1.ConditionStatus"`
 	// The last time this condition was updated.
+	// +optional
 	LastUpdateTime metav1.Time `json:"lastUpdateTime,omitempty" protobuf:"bytes,6,opt,name=lastUpdateTime"`
 	// Last time the condition transitioned from one status to another.
+	// +optional
 	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,7,opt,name=lastTransitionTime"`
 	// The reason for the condition's last transition.
+	// +optional
 	Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 	// A human readable message indicating details about the transition.
+	// +optional
 	Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
 }
 
@@ -570,7 +616,7 @@ type DeploymentCondition struct {
 
 // DeploymentList is a list of Deployments.
 type DeploymentList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -652,6 +698,7 @@ type DaemonSetSpec struct {
 	// Must match in order to be controlled.
 	// It must match the pod template's labels.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
+	// +required
 	Selector *metav1.LabelSelector `json:"selector" protobuf:"bytes,1,opt,name=selector"`
 
 	// An object that describes the pod that will be created.
@@ -660,6 +707,7 @@ type DaemonSetSpec struct {
 	// selector is specified).
 	// The only allowed template.spec.restartPolicy value is "Always".
 	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
+	// +required
 	Template v1.PodTemplateSpec `json:"template" protobuf:"bytes,2,opt,name=template"`
 
 	// An update strategy to replace existing DaemonSet pods with new pods.
@@ -743,8 +791,10 @@ type DaemonSetConditionType string
 // DaemonSetCondition describes the state of a DaemonSet at a certain point.
 type DaemonSetCondition struct {
 	// Type of DaemonSet condition.
+	// +optional
 	Type DaemonSetConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=DaemonSetConditionType"`
 	// Status of the condition, one of True, False, Unknown.
+	// +optional
 	Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=k8s.io/api/core/v1.ConditionStatus"`
 	// Last time the condition transitioned from one status to another.
 	// +optional
@@ -762,8 +812,9 @@ type DaemonSetCondition struct {
 // +k8s:prerelease-lifecycle-gen:introduced=1.9
 
 // DaemonSet represents the configuration of a daemon set.
+// +k8s:supportsSubresource="/status"
 type DaemonSet struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -771,7 +822,7 @@ type DaemonSet struct {
 
 	// The desired behavior of this daemon set.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-	// +optional
+	// +required
 	Spec DaemonSetSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 
 	// The current status of this daemon set. This data may be
@@ -795,7 +846,7 @@ const (
 
 // DaemonSetList is a collection of daemon sets.
 type DaemonSetList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -813,8 +864,10 @@ type DaemonSetList struct {
 // +k8s:prerelease-lifecycle-gen:introduced=1.9
 
 // ReplicaSet ensures that a specified number of pod replicas are running at any given time.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 type ReplicaSet struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// If the Labels of a ReplicaSet are empty, they are defaulted to
 	// be the same as the Pod(s) that the ReplicaSet manages.
@@ -825,7 +878,7 @@ type ReplicaSet struct {
 
 	// Spec defines the specification of the desired behavior of the ReplicaSet.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-	// +optional
+	// +required
 	Spec ReplicaSetSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 
 	// Status is the most recently observed status of the ReplicaSet.
@@ -842,7 +895,7 @@ type ReplicaSet struct {
 
 // ReplicaSetList is a collection of ReplicaSets.
 type ReplicaSetList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -872,6 +925,7 @@ type ReplicaSetSpec struct {
 	// Label keys and values that must match in order to be controlled by this replica set.
 	// It must match the pod template's labels.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
+	// +required
 	Selector *metav1.LabelSelector `json:"selector" protobuf:"bytes,2,opt,name=selector"`
 
 	// Template is the object that describes the pod that will be created if
@@ -932,8 +986,10 @@ const (
 // ReplicaSetCondition describes the state of a replica set at a certain point.
 type ReplicaSetCondition struct {
 	// Type of replica set condition.
+	// +optional
 	Type ReplicaSetConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=ReplicaSetConditionType"`
 	// Status of the condition, one of True, False, Unknown.
+	// +optional
 	Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=k8s.io/api/core/v1.ConditionStatus"`
 	// The last time the condition transitioned from one status to another.
 	// +optional
@@ -960,16 +1016,18 @@ type ReplicaSetCondition struct {
 // it may be subject to name and representation changes in future releases, and clients should not
 // depend on its stability. It is primarily for internal use by controllers.
 type ControllerRevision struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Data is the serialized representation of the state.
-	Data runtime.RawExtension `json:"data,omitempty" protobuf:"bytes,2,opt,name=data"`
+	// +required
+	Data runtime.RawExtension `json:"data" protobuf:"bytes,2,opt,name=data"`
 
 	// Revision indicates the revision of the state represented by Data.
+	// +optional
 	Revision int64 `json:"revision" protobuf:"varint,3,opt,name=revision"`
 }
 
@@ -978,7 +1036,7 @@ type ControllerRevision struct {
 
 // ControllerRevisionList is a resource containing a list of ControllerRevision objects.
 type ControllerRevisionList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
diff --git a/vendor/k8s.io/api/apps/v1beta1/generated.proto b/vendor/k8s.io/api/apps/v1beta1/generated.proto
index c6f0628e0c..9d23883347 100644
--- a/vendor/k8s.io/api/apps/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/apps/v1beta1/generated.proto
@@ -48,9 +48,11 @@ message ControllerRevision {
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // data is the serialized representation of the state.
+  // +required
   optional .k8s.io.apimachinery.pkg.runtime.RawExtension data = 2;
 
   // revision indicates the revision of the state represented by Data.
+  // +optional
   optional int64 revision = 3;
 }
 
@@ -67,13 +69,15 @@ message ControllerRevisionList {
 // DEPRECATED - This group version of Deployment is deprecated by apps/v1beta2/Deployment. See the release notes for
 // more information.
 // Deployment enables declarative updates for Pods and ReplicaSets.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 message Deployment {
   // Standard object metadata.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Specification of the desired behavior of the Deployment.
-  // +optional
+  // +required
   optional DeploymentSpec spec = 2;
 
   // Most recently observed status of the Deployment.
@@ -84,21 +88,27 @@ message Deployment {
 // DeploymentCondition describes the state of a deployment at a certain point.
 message DeploymentCondition {
   // Type of deployment condition.
+  // +optional
   optional string type = 1;
 
   // Status of the condition, one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // The last time this condition was updated.
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastUpdateTime = 6;
 
   // Last time the condition transitioned from one status to another.
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 7;
 
   // The reason for the condition's last transition.
+  // +optional
   optional string reason = 4;
 
   // A human readable message indicating details about the transition.
+  // +optional
   optional string message = 5;
 }
 
@@ -116,6 +126,7 @@ message DeploymentList {
 // DeploymentRollback stores the information required to rollback a deployment.
 message DeploymentRollback {
   // Required: This must match the Name of a deployment.
+  // +required
   optional string name = 1;
 
   // The annotations to be updated to a deployment
@@ -123,6 +134,7 @@ message DeploymentRollback {
   map<string, string> updatedAnnotations = 2;
 
   // The config of this deployment rollback.
+  // +optional
   optional RollbackConfig rollbackTo = 3;
 }
 
@@ -140,6 +152,7 @@ message DeploymentSpec {
 
   // Template describes the pods that will be created.
   // The only allowed template.spec.restartPolicy value is "Always".
+  // +required
   optional .k8s.io.api.core.v1.PodTemplateSpec template = 3;
 
   // The deployment strategy to use to replace existing pods with new ones.
@@ -284,6 +297,7 @@ message RollingUpdateStatefulSetStrategy {
   // for updates. During a rolling update, all pods from ordinal Replicas-1 to
   // Partition are updated. All pods from ordinal Partition-1 to 0 remain untouched.
   // This is helpful in being able to do a canary based deployment. The default value is 0.
+  // +optional
   optional int32 partition = 1;
 
   // maxUnavailable is the maximum number of pods that can be unavailable during the update.
@@ -303,6 +317,7 @@ message RollingUpdateStatefulSetStrategy {
 message Scale {
   // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec defines the behavior of the scale. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
@@ -318,15 +333,16 @@ message Scale {
 message ScaleSpec {
   // replicas is the number of observed instances of the scaled object.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +default=0
-  // +k8s:alpha(since: "1.36")=+k8s:minimum=0
+  // +k8s:beta(since: "1.37")=+k8s:minimum=0
   optional int32 replicas = 1;
 }
 
 // ScaleStatus represents the current status of a scale subresource.
 message ScaleStatus {
   // replias is the actual number of observed instances of the scaled object.
+  // +optional
   optional int32 replicas = 1;
 
   // selector is a label query over pods that should match the replicas count. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
@@ -352,12 +368,14 @@ message ScaleStatus {
 //
 // The StatefulSet guarantees that a given network identity will always
 // map to the same storage identity.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 message StatefulSet {
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Spec defines the desired identities of pods in this set.
-  // +optional
+  // +required
   optional StatefulSetSpec spec = 2;
 
   // Status is the current status of Pods in this StatefulSet. This data
@@ -369,9 +387,11 @@ message StatefulSet {
 // StatefulSetCondition describes the state of a statefulset at a certain point.
 message StatefulSetCondition {
   // Type of statefulset condition.
+  // +optional
   optional string type = 1;
 
   // Status of the condition, one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // Last time the condition transitioned from one status to another.
@@ -417,6 +437,7 @@ message StatefulSetPersistentVolumeClaimRetentionPolicy {
   // VolumeClaimTemplates when the StatefulSet is deleted. The default policy
   // of `Retain` causes PVCs to not be affected by StatefulSet deletion. The
   // `Delete` policy causes those PVCs to be deleted.
+  // +optional
   optional string whenDeleted = 1;
 
   // whenScaled specifies what happens to PVCs created from StatefulSet
@@ -424,6 +445,7 @@ message StatefulSetPersistentVolumeClaimRetentionPolicy {
   // policy of `Retain` causes PVCs to not be affected by a scaledown. The
   // `Delete` policy causes the associated PVCs for any excess pods above
   // the replica count to be deleted.
+  // +optional
   optional string whenScaled = 2;
 }
 
@@ -438,9 +460,11 @@ message StatefulSetSpec {
   optional int32 replicas = 1;
 
   // selector is a label query over pods that should match the replica count.
-  // If empty, defaulted to labels on the pod template.
+  // It must match the pod template's labels.
   // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
-  // +optional
+  // +required
+  // +k8s:alpha(since: "1.37")=+k8s:required
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;
 
   // template is the object that describes the pod that will be created if
@@ -449,6 +473,7 @@ message StatefulSetSpec {
   // of the StatefulSet. Each pod will be named with the format
   // <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named
   // "web" with index number "3" would be named "web-3".
+  // +required
   optional .k8s.io.api.core.v1.PodTemplateSpec template = 3;
 
   // volumeClaimTemplates is a list of claims that pods are allowed to reference.
@@ -459,7 +484,10 @@ message StatefulSetSpec {
   // any volumes in the template, with the same name.
   // TODO: Define the behavior if a claim already exists with the same name.
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   // +listType=atomic
+  // +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:opaqueType
   repeated .k8s.io.api.core.v1.PersistentVolumeClaim volumeClaimTemplates = 4;
 
   // serviceName is the name of the service that governs this StatefulSet.
@@ -468,6 +496,8 @@ message StatefulSetSpec {
   // pattern: pod-specific-string.serviceName.default.svc.cluster.local
   // where "pod-specific-string" is managed by the StatefulSet controller.
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   optional string serviceName = 5;
 
   // podManagementPolicy controls how pods are created during initial scale up,
@@ -479,17 +509,21 @@ message StatefulSetSpec {
   // to match the desired scale without waiting, and on scale down will delete
   // all pods at once.
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   optional string podManagementPolicy = 6;
 
   // updateStrategy indicates the StatefulSetUpdateStrategy that will be
   // employed to update Pods in the StatefulSet when a revision is made to
   // Template.
+  // +optional
   optional StatefulSetUpdateStrategy updateStrategy = 7;
 
   // revisionHistoryLimit is the maximum number of revisions that will
   // be maintained in the StatefulSet's revision history. The revision history
   // consists of all revisions not represented by a currently applied
   // StatefulSetSpec version. The default value is 10.
+  // +optional
   optional int32 revisionHistoryLimit = 8;
 
   // minReadySeconds is the minimum number of seconds for which a newly created pod should be ready
@@ -567,9 +601,11 @@ message StatefulSetStatus {
 // necessary to perform the update for the indicated strategy.
 message StatefulSetUpdateStrategy {
   // Type indicates the type of the StatefulSetUpdateStrategy.
+  // +optional
   optional string type = 1;
 
   // RollingUpdate is used to communicate parameters when Type is RollingUpdateStatefulSetStrategyType.
+  // +optional
   optional RollingUpdateStatefulSetStrategy rollingUpdate = 2;
 }
 
diff --git a/vendor/k8s.io/api/apps/v1beta1/types.go b/vendor/k8s.io/api/apps/v1beta1/types.go
index 4e67338e36..9960ac0b39 100644
--- a/vendor/k8s.io/api/apps/v1beta1/types.go
+++ b/vendor/k8s.io/api/apps/v1beta1/types.go
@@ -33,15 +33,16 @@ const (
 type ScaleSpec struct {
 	// replicas is the number of observed instances of the scaled object.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +default=0
-	// +k8s:alpha(since: "1.36")=+k8s:minimum=0
+	// +k8s:beta(since: "1.37")=+k8s:minimum=0
 	Replicas int32 `json:"replicas,omitempty" protobuf:"varint,1,opt,name=replicas"`
 }
 
 // ScaleStatus represents the current status of a scale subresource.
 type ScaleStatus struct {
 	// replias is the actual number of observed instances of the scaled object.
+	// +optional
 	Replicas int32 `json:"replicas" protobuf:"varint,1,opt,name=replicas"`
 
 	// selector is a label query over pods that should match the replicas count. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
@@ -67,9 +68,10 @@ type ScaleStatus struct {
 
 // Scale represents a scaling request for a resource.
 type Scale struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec defines the behavior of the scale. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
@@ -97,13 +99,15 @@ type Scale struct {
 //
 // The StatefulSet guarantees that a given network identity will always
 // map to the same storage identity.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 type StatefulSet struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec defines the desired identities of pods in this set.
-	// +optional
+	// +required
 	Spec StatefulSetSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 
 	// Status is the current status of Pods in this StatefulSet. This data
@@ -132,8 +136,10 @@ const (
 // necessary to perform the update for the indicated strategy.
 type StatefulSetUpdateStrategy struct {
 	// Type indicates the type of the StatefulSetUpdateStrategy.
+	// +optional
 	Type StatefulSetUpdateStrategyType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type,casttype=StatefulSetStrategyType"`
 	// RollingUpdate is used to communicate parameters when Type is RollingUpdateStatefulSetStrategyType.
+	// +optional
 	RollingUpdate *RollingUpdateStatefulSetStrategy `json:"rollingUpdate,omitempty" protobuf:"bytes,2,opt,name=rollingUpdate"`
 }
 
@@ -148,11 +154,12 @@ const (
 	// strategy, new Pods will be created from the specification version indicated
 	// by the StatefulSet's updateRevision.
 	RollingUpdateStatefulSetStrategyType StatefulSetUpdateStrategyType = "RollingUpdate"
-	// OnDeleteStatefulSetStrategyType triggers the legacy behavior. Version
-	// tracking and ordered rolling restarts are disabled. Pods are recreated
-	// from the StatefulSetSpec when they are manually deleted. When a scale
-	// operation is performed with this strategy,specification version indicated
-	// by the StatefulSet's currentRevision.
+	// OnDeleteStatefulSetStrategyType disables ordered rolling restarts. Version
+	// tracking is done on a best-effort basis - the controller will try to
+	// eventually converge StatefulSet's currentRevision with updateRevision.
+	// Pods are recreated from the StatefulSetSpec when they are manually deleted.
+	// When a scale operation is performed with this strategy, new Pods will be
+	// created from the specification version indicated by the StatefulSet's updateRevision.
 	OnDeleteStatefulSetStrategyType StatefulSetUpdateStrategyType = "OnDelete"
 )
 
@@ -162,6 +169,7 @@ type RollingUpdateStatefulSetStrategy struct {
 	// for updates. During a rolling update, all pods from ordinal Replicas-1 to
 	// Partition are updated. All pods from ordinal Partition-1 to 0 remain untouched.
 	// This is helpful in being able to do a canary based deployment. The default value is 0.
+	// +optional
 	Partition *int32 `json:"partition,omitempty" protobuf:"varint,1,opt,name=partition"`
 	// maxUnavailable is the maximum number of pods that can be unavailable during the update.
 	// Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
@@ -201,12 +209,14 @@ type StatefulSetPersistentVolumeClaimRetentionPolicy struct {
 	// VolumeClaimTemplates when the StatefulSet is deleted. The default policy
 	// of `Retain` causes PVCs to not be affected by StatefulSet deletion. The
 	// `Delete` policy causes those PVCs to be deleted.
+	// +optional
 	WhenDeleted PersistentVolumeClaimRetentionPolicyType `json:"whenDeleted,omitempty" protobuf:"bytes,1,opt,name=whenDeleted,casttype=PersistentVolumeClaimRetentionPolicyType"`
 	// whenScaled specifies what happens to PVCs created from StatefulSet
 	// VolumeClaimTemplates when the StatefulSet is scaled down. The default
 	// policy of `Retain` causes PVCs to not be affected by a scaledown. The
 	// `Delete` policy causes the associated PVCs for any excess pods above
 	// the replica count to be deleted.
+	// +optional
 	WhenScaled PersistentVolumeClaimRetentionPolicyType `json:"whenScaled,omitempty" protobuf:"bytes,2,opt,name=whenScaled,casttype=PersistentVolumeClaimRetentionPolicyType"`
 }
 
@@ -236,9 +246,11 @@ type StatefulSetSpec struct {
 	Replicas *int32 `json:"replicas,omitempty" protobuf:"varint,1,opt,name=replicas"`
 
 	// selector is a label query over pods that should match the replica count.
-	// If empty, defaulted to labels on the pod template.
+	// It must match the pod template's labels.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
-	// +optional
+	// +required
+	// +k8s:alpha(since: "1.37")=+k8s:required
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
 	Selector *metav1.LabelSelector `json:"selector,omitempty" protobuf:"bytes,2,opt,name=selector"`
 
 	// template is the object that describes the pod that will be created if
@@ -247,6 +259,7 @@ type StatefulSetSpec struct {
 	// of the StatefulSet. Each pod will be named with the format
 	// <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named
 	// "web" with index number "3" would be named "web-3".
+	// +required
 	Template v1.PodTemplateSpec `json:"template" protobuf:"bytes,3,opt,name=template"`
 
 	// volumeClaimTemplates is a list of claims that pods are allowed to reference.
@@ -257,7 +270,10 @@ type StatefulSetSpec struct {
 	// any volumes in the template, with the same name.
 	// TODO: Define the behavior if a claim already exists with the same name.
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	// +listType=atomic
+	// +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:opaqueType
 	VolumeClaimTemplates []v1.PersistentVolumeClaim `json:"volumeClaimTemplates,omitempty" protobuf:"bytes,4,rep,name=volumeClaimTemplates"`
 
 	// serviceName is the name of the service that governs this StatefulSet.
@@ -266,6 +282,8 @@ type StatefulSetSpec struct {
 	// pattern: pod-specific-string.serviceName.default.svc.cluster.local
 	// where "pod-specific-string" is managed by the StatefulSet controller.
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	ServiceName string `json:"serviceName" protobuf:"bytes,5,opt,name=serviceName"`
 
 	// podManagementPolicy controls how pods are created during initial scale up,
@@ -277,17 +295,21 @@ type StatefulSetSpec struct {
 	// to match the desired scale without waiting, and on scale down will delete
 	// all pods at once.
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	PodManagementPolicy PodManagementPolicyType `json:"podManagementPolicy,omitempty" protobuf:"bytes,6,opt,name=podManagementPolicy,casttype=PodManagementPolicyType"`
 
 	// updateStrategy indicates the StatefulSetUpdateStrategy that will be
 	// employed to update Pods in the StatefulSet when a revision is made to
 	// Template.
+	// +optional
 	UpdateStrategy StatefulSetUpdateStrategy `json:"updateStrategy,omitempty" protobuf:"bytes,7,opt,name=updateStrategy"`
 
 	// revisionHistoryLimit is the maximum number of revisions that will
 	// be maintained in the StatefulSet's revision history. The revision history
 	// consists of all revisions not represented by a currently applied
 	// StatefulSetSpec version. The default value is 10.
+	// +optional
 	RevisionHistoryLimit *int32 `json:"revisionHistoryLimit,omitempty" protobuf:"varint,8,opt,name=revisionHistoryLimit"`
 
 	// minReadySeconds is the minimum number of seconds for which a newly created pod should be ready
@@ -365,8 +387,10 @@ type StatefulSetConditionType string
 // StatefulSetCondition describes the state of a statefulset at a certain point.
 type StatefulSetCondition struct {
 	// Type of statefulset condition.
+	// +optional
 	Type StatefulSetConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=StatefulSetConditionType"`
 	// Status of the condition, one of True, False, Unknown.
+	// +optional
 	Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=k8s.io/api/core/v1.ConditionStatus"`
 	// Last time the condition transitioned from one status to another.
 	// +optional
@@ -387,7 +411,7 @@ type StatefulSetCondition struct {
 
 // StatefulSetList is a collection of StatefulSets.
 type StatefulSetList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	Items           []StatefulSet `json:"items" protobuf:"bytes,2,rep,name=items"`
@@ -403,14 +427,16 @@ type StatefulSetList struct {
 // DEPRECATED - This group version of Deployment is deprecated by apps/v1beta2/Deployment. See the release notes for
 // more information.
 // Deployment enables declarative updates for Pods and ReplicaSets.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 type Deployment struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Specification of the desired behavior of the Deployment.
-	// +optional
+	// +required
 	Spec DeploymentSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 
 	// Most recently observed status of the Deployment.
@@ -432,6 +458,7 @@ type DeploymentSpec struct {
 
 	// Template describes the pods that will be created.
 	// The only allowed template.spec.restartPolicy value is "Always".
+	// +required
 	Template v1.PodTemplateSpec `json:"template" protobuf:"bytes,3,opt,name=template"`
 
 	// The deployment strategy to use to replace existing pods with new ones.
@@ -478,13 +505,15 @@ type DeploymentSpec struct {
 // DEPRECATED.
 // DeploymentRollback stores the information required to rollback a deployment.
 type DeploymentRollback struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Required: This must match the Name of a deployment.
+	// +required
 	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 	// The annotations to be updated to a deployment
 	// +optional
 	UpdatedAnnotations map[string]string `json:"updatedAnnotations,omitempty" protobuf:"bytes,2,rep,name=updatedAnnotations"`
 	// The config of this deployment rollback.
+	// +optional
 	RollbackTo RollbackConfig `json:"rollbackTo" protobuf:"bytes,3,opt,name=rollbackTo"`
 }
 
@@ -626,16 +655,22 @@ const (
 // DeploymentCondition describes the state of a deployment at a certain point.
 type DeploymentCondition struct {
 	// Type of deployment condition.
+	// +optional
 	Type DeploymentConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=DeploymentConditionType"`
 	// Status of the condition, one of True, False, Unknown.
+	// +optional
 	Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=k8s.io/api/core/v1.ConditionStatus"`
 	// The last time this condition was updated.
+	// +optional
 	LastUpdateTime metav1.Time `json:"lastUpdateTime,omitempty" protobuf:"bytes,6,opt,name=lastUpdateTime"`
 	// Last time the condition transitioned from one status to another.
+	// +optional
 	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,7,opt,name=lastTransitionTime"`
 	// The reason for the condition's last transition.
+	// +optional
 	Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 	// A human readable message indicating details about the transition.
+	// +optional
 	Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
 }
 
@@ -647,7 +682,7 @@ type DeploymentCondition struct {
 
 // DeploymentList is a list of Deployments.
 type DeploymentList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -675,16 +710,18 @@ type DeploymentList struct {
 // it may be subject to name and representation changes in future releases, and clients should not
 // depend on its stability. It is primarily for internal use by controllers.
 type ControllerRevision struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// data is the serialized representation of the state.
-	Data runtime.RawExtension `json:"data,omitempty" protobuf:"bytes,2,opt,name=data"`
+	// +required
+	Data runtime.RawExtension `json:"data" protobuf:"bytes,2,opt,name=data"`
 
 	// revision indicates the revision of the state represented by Data.
+	// +optional
 	Revision int64 `json:"revision" protobuf:"varint,3,opt,name=revision"`
 }
 
@@ -696,7 +733,7 @@ type ControllerRevision struct {
 
 // ControllerRevisionList is a resource containing a list of ControllerRevision objects.
 type ControllerRevisionList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
diff --git a/vendor/k8s.io/api/apps/v1beta1/types_swagger_doc_generated.go b/vendor/k8s.io/api/apps/v1beta1/types_swagger_doc_generated.go
index a6f7a11927..e0efc96cd2 100644
--- a/vendor/k8s.io/api/apps/v1beta1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/apps/v1beta1/types_swagger_doc_generated.go
@@ -251,7 +251,7 @@ func (StatefulSetPersistentVolumeClaimRetentionPolicy) SwaggerDoc() map[string]s
 var map_StatefulSetSpec = map[string]string{
 	"":                                     "A StatefulSetSpec is the specification of a StatefulSet.",
 	"replicas":                             "replicas is the desired number of replicas of the given Template. These are replicas in the sense that they are instantiations of the same Template, but individual replicas also have a consistent identity. If unspecified, defaults to 1.",
-	"selector":                             "selector is a label query over pods that should match the replica count. If empty, defaulted to labels on the pod template. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors",
+	"selector":                             "selector is a label query over pods that should match the replica count. It must match the pod template's labels. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors",
 	"template":                             "template is the object that describes the pod that will be created if insufficient replicas are detected. Each pod stamped out by the StatefulSet will fulfill this Template, but have a unique identity from the rest of the StatefulSet. Each pod will be named with the format <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named \"web\" with index number \"3\" would be named \"web-3\".",
 	"volumeClaimTemplates":                 "volumeClaimTemplates is a list of claims that pods are allowed to reference. The StatefulSet controller is responsible for mapping network identities to claims in a way that maintains the identity of a pod. Every claim in this list must have at least one matching (by name) volumeMount in one container in the template. A claim in this list takes precedence over any volumes in the template, with the same name.",
 	"serviceName":                          "serviceName is the name of the service that governs this StatefulSet. This service must exist before the StatefulSet, and is responsible for the network identity of the set. Pods get DNS/hostnames that follow the pattern: pod-specific-string.serviceName.default.svc.cluster.local where \"pod-specific-string\" is managed by the StatefulSet controller.",
diff --git a/vendor/k8s.io/api/apps/v1beta2/generated.proto b/vendor/k8s.io/api/apps/v1beta2/generated.proto
index d680c9663e..738b1236e2 100644
--- a/vendor/k8s.io/api/apps/v1beta2/generated.proto
+++ b/vendor/k8s.io/api/apps/v1beta2/generated.proto
@@ -48,9 +48,11 @@ message ControllerRevision {
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Data is the serialized representation of the state.
+  // +required
   optional .k8s.io.apimachinery.pkg.runtime.RawExtension data = 2;
 
   // Revision indicates the revision of the state represented by Data.
+  // +optional
   optional int64 revision = 3;
 }
 
@@ -67,6 +69,7 @@ message ControllerRevisionList {
 // DEPRECATED - This group version of DaemonSet is deprecated by apps/v1/DaemonSet. See the release notes for
 // more information.
 // DaemonSet represents the configuration of a daemon set.
+// +k8s:supportsSubresource="/status"
 message DaemonSet {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -75,7 +78,7 @@ message DaemonSet {
 
   // The desired behavior of this daemon set.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-  // +optional
+  // +required
   optional DaemonSetSpec spec = 2;
 
   // The current status of this daemon set. This data may be
@@ -90,9 +93,11 @@ message DaemonSet {
 // DaemonSetCondition describes the state of a DaemonSet at a certain point.
 message DaemonSetCondition {
   // Type of DaemonSet condition.
+  // +optional
   optional string type = 1;
 
   // Status of the condition, one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // Last time the condition transitioned from one status to another.
@@ -125,6 +130,7 @@ message DaemonSetSpec {
   // Must match in order to be controlled.
   // It must match the pod template's labels.
   // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
+  // +required
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 1;
 
   // An object that describes the pod that will be created.
@@ -133,6 +139,7 @@ message DaemonSetSpec {
   // selector is specified).
   // The only allowed template.spec.restartPolicy value is "Always".
   // More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
+  // +required
   optional .k8s.io.api.core.v1.PodTemplateSpec template = 2;
 
   // An update strategy to replace existing DaemonSet pods with new pods.
@@ -227,13 +234,15 @@ message DaemonSetUpdateStrategy {
 // DEPRECATED - This group version of Deployment is deprecated by apps/v1/Deployment. See the release notes for
 // more information.
 // Deployment enables declarative updates for Pods and ReplicaSets.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 message Deployment {
   // Standard object metadata.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Specification of the desired behavior of the Deployment.
-  // +optional
+  // +required
   optional DeploymentSpec spec = 2;
 
   // Most recently observed status of the Deployment.
@@ -244,21 +253,27 @@ message Deployment {
 // DeploymentCondition describes the state of a deployment at a certain point.
 message DeploymentCondition {
   // Type of deployment condition.
+  // +optional
   optional string type = 1;
 
   // Status of the condition, one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // The last time this condition was updated.
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastUpdateTime = 6;
 
   // Last time the condition transitioned from one status to another.
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 7;
 
   // The reason for the condition's last transition.
+  // +optional
   optional string reason = 4;
 
   // A human readable message indicating details about the transition.
+  // +optional
   optional string message = 5;
 }
 
@@ -282,10 +297,12 @@ message DeploymentSpec {
   // Label selector for pods. Existing ReplicaSets whose pods are
   // selected by this will be the ones affected by this deployment.
   // It must match the pod template's labels.
+  // +required
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;
 
   // Template describes the pods that will be created.
   // The only allowed template.spec.restartPolicy value is "Always".
+  // +required
   optional .k8s.io.api.core.v1.PodTemplateSpec template = 3;
 
   // The deployment strategy to use to replace existing pods with new ones.
@@ -314,6 +331,7 @@ message DeploymentSpec {
   // process failed deployments and a condition with a ProgressDeadlineExceeded
   // reason will be surfaced in the deployment status. Note that progress will
   // not be estimated during the time a deployment is paused. Defaults to 600s.
+  // +optional
   optional int32 progressDeadlineSeconds = 9;
 }
 
@@ -384,6 +402,8 @@ message DeploymentStrategy {
 // DEPRECATED - This group version of ReplicaSet is deprecated by apps/v1/ReplicaSet. See the release notes for
 // more information.
 // ReplicaSet ensures that a specified number of pod replicas are running at any given time.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 message ReplicaSet {
   // If the Labels of a ReplicaSet are empty, they are defaulted to
   // be the same as the Pod(s) that the ReplicaSet manages.
@@ -393,7 +413,7 @@ message ReplicaSet {
 
   // Spec defines the specification of the desired behavior of the ReplicaSet.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-  // +optional
+  // +required
   optional ReplicaSetSpec spec = 2;
 
   // Status is the most recently observed status of the ReplicaSet.
@@ -408,9 +428,11 @@ message ReplicaSet {
 // ReplicaSetCondition describes the state of a replica set at a certain point.
 message ReplicaSetCondition {
   // Type of replica set condition.
+  // +optional
   optional string type = 1;
 
   // Status of the condition, one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // The last time the condition transitioned from one status to another.
@@ -457,6 +479,7 @@ message ReplicaSetSpec {
   // Label keys and values that must match in order to be controlled by this replica set.
   // It must match the pod template's labels.
   // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
+  // +required
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;
 
   // Template is the object that describes the pod that will be created if
@@ -601,6 +624,7 @@ message RollingUpdateStatefulSetStrategy {
 message Scale {
   // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // defines the behavior of the scale. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
@@ -616,15 +640,16 @@ message Scale {
 message ScaleSpec {
   // desired number of instances for the scaled object.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +default=0
-  // +k8s:alpha(since: "1.36")=+k8s:minimum=0
+  // +k8s:beta(since: "1.37")=+k8s:minimum=0
   optional int32 replicas = 1;
 }
 
 // ScaleStatus represents the current status of a scale subresource.
 message ScaleStatus {
   // actual number of observed instances of the scaled object.
+  // +optional
   optional int32 replicas = 1;
 
   // selector is a label query over pods that should match the replicas count. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
@@ -651,12 +676,14 @@ message ScaleStatus {
 //
 // The StatefulSet guarantees that a given network identity will always
 // map to the same storage identity.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 message StatefulSet {
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Spec defines the desired identities of pods in this set.
-  // +optional
+  // +required
   optional StatefulSetSpec spec = 2;
 
   // Status is the current status of Pods in this StatefulSet. This data
@@ -668,9 +695,11 @@ message StatefulSet {
 // StatefulSetCondition describes the state of a statefulset at a certain point.
 message StatefulSetCondition {
   // Type of statefulset condition.
+  // +optional
   optional string type = 1;
 
   // Status of the condition, one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // Last time the condition transitioned from one status to another.
@@ -716,6 +745,7 @@ message StatefulSetPersistentVolumeClaimRetentionPolicy {
   // VolumeClaimTemplates when the StatefulSet is deleted. The default policy
   // of `Retain` causes PVCs to not be affected by StatefulSet deletion. The
   // `Delete` policy causes those PVCs to be deleted.
+  // +optional
   optional string whenDeleted = 1;
 
   // WhenScaled specifies what happens to PVCs created from StatefulSet
@@ -723,6 +753,7 @@ message StatefulSetPersistentVolumeClaimRetentionPolicy {
   // policy of `Retain` causes PVCs to not be affected by a scaledown. The
   // `Delete` policy causes the associated PVCs for any excess pods above
   // the replica count to be deleted.
+  // +optional
   optional string whenScaled = 2;
 }
 
@@ -739,6 +770,9 @@ message StatefulSetSpec {
   // selector is a label query over pods that should match the replica count.
   // It must match the pod template's labels.
   // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
+  // +required
+  // +k8s:alpha(since: "1.37")=+k8s:required
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;
 
   // template is the object that describes the pod that will be created if
@@ -748,6 +782,7 @@ message StatefulSetSpec {
   // <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named
   // "web" with index number "3" would be named "web-3".
   // The only allowed template.spec.restartPolicy value is "Always".
+  // +required
   optional .k8s.io.api.core.v1.PodTemplateSpec template = 3;
 
   // volumeClaimTemplates is a list of claims that pods are allowed to reference.
@@ -758,7 +793,10 @@ message StatefulSetSpec {
   // any volumes in the template, with the same name.
   // TODO: Define the behavior if a claim already exists with the same name.
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   // +listType=atomic
+  // +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:opaqueType
   repeated .k8s.io.api.core.v1.PersistentVolumeClaim volumeClaimTemplates = 4;
 
   // serviceName is the name of the service that governs this StatefulSet.
@@ -767,6 +805,8 @@ message StatefulSetSpec {
   // pattern: pod-specific-string.serviceName.default.svc.cluster.local
   // where "pod-specific-string" is managed by the StatefulSet controller.
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   optional string serviceName = 5;
 
   // podManagementPolicy controls how pods are created during initial scale up,
@@ -778,17 +818,21 @@ message StatefulSetSpec {
   // to match the desired scale without waiting, and on scale down will delete
   // all pods at once.
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   optional string podManagementPolicy = 6;
 
   // updateStrategy indicates the StatefulSetUpdateStrategy that will be
   // employed to update Pods in the StatefulSet when a revision is made to
   // Template.
+  // +optional
   optional StatefulSetUpdateStrategy updateStrategy = 7;
 
   // revisionHistoryLimit is the maximum number of revisions that will
   // be maintained in the StatefulSet's revision history. The revision history
   // consists of all revisions not represented by a currently applied
   // StatefulSetSpec version. The default value is 10.
+  // +optional
   optional int32 revisionHistoryLimit = 8;
 
   // Minimum number of seconds for which a newly created pod should be ready
diff --git a/vendor/k8s.io/api/apps/v1beta2/types.go b/vendor/k8s.io/api/apps/v1beta2/types.go
index d4d4a7e0dc..138039f025 100644
--- a/vendor/k8s.io/api/apps/v1beta2/types.go
+++ b/vendor/k8s.io/api/apps/v1beta2/types.go
@@ -35,15 +35,16 @@ const (
 type ScaleSpec struct {
 	// desired number of instances for the scaled object.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +default=0
-	// +k8s:alpha(since: "1.36")=+k8s:minimum=0
+	// +k8s:beta(since: "1.37")=+k8s:minimum=0
 	Replicas int32 `json:"replicas,omitempty" protobuf:"varint,1,opt,name=replicas"`
 }
 
 // ScaleStatus represents the current status of a scale subresource.
 type ScaleStatus struct {
 	// actual number of observed instances of the scaled object.
+	// +optional
 	Replicas int32 `json:"replicas" protobuf:"varint,1,opt,name=replicas"`
 
 	// selector is a label query over pods that should match the replicas count. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
@@ -70,9 +71,10 @@ type ScaleStatus struct {
 
 // Scale represents a scaling request for a resource.
 type Scale struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// defines the behavior of the scale. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
@@ -103,13 +105,15 @@ type Scale struct {
 //
 // The StatefulSet guarantees that a given network identity will always
 // map to the same storage identity.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 type StatefulSet struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec defines the desired identities of pods in this set.
-	// +optional
+	// +required
 	Spec StatefulSetSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 
 	// Status is the current status of Pods in this StatefulSet. This data
@@ -157,11 +161,12 @@ const (
 	// strategy, new Pods will be created from the specification version indicated
 	// by the StatefulSet's updateRevision.
 	RollingUpdateStatefulSetStrategyType StatefulSetUpdateStrategyType = "RollingUpdate"
-	// OnDeleteStatefulSetStrategyType triggers the legacy behavior. Version
-	// tracking and ordered rolling restarts are disabled. Pods are recreated
-	// from the StatefulSetSpec when they are manually deleted. When a scale
-	// operation is performed with this strategy,specification version indicated
-	// by the StatefulSet's currentRevision.
+	// OnDeleteStatefulSetStrategyType disables ordered rolling restarts. Version
+	// tracking is done on a best-effort basis - the controller will try to
+	// eventually converge StatefulSet's currentRevision with updateRevision.
+	// Pods are recreated from the StatefulSetSpec when they are manually deleted.
+	// When a scale operation is performed with this strategy, new Pods will be
+	// created from the specification version indicated by the StatefulSet's updateRevision.
 	OnDeleteStatefulSetStrategyType StatefulSetUpdateStrategyType = "OnDelete"
 )
 
@@ -211,12 +216,14 @@ type StatefulSetPersistentVolumeClaimRetentionPolicy struct {
 	// VolumeClaimTemplates when the StatefulSet is deleted. The default policy
 	// of `Retain` causes PVCs to not be affected by StatefulSet deletion. The
 	// `Delete` policy causes those PVCs to be deleted.
+	// +optional
 	WhenDeleted PersistentVolumeClaimRetentionPolicyType `json:"whenDeleted,omitempty" protobuf:"bytes,1,opt,name=whenDeleted,casttype=PersistentVolumeClaimRetentionPolicyType"`
 	// WhenScaled specifies what happens to PVCs created from StatefulSet
 	// VolumeClaimTemplates when the StatefulSet is scaled down. The default
 	// policy of `Retain` causes PVCs to not be affected by a scaledown. The
 	// `Delete` policy causes the associated PVCs for any excess pods above
 	// the replica count to be deleted.
+	// +optional
 	WhenScaled PersistentVolumeClaimRetentionPolicyType `json:"whenScaled,omitempty" protobuf:"bytes,2,opt,name=whenScaled,casttype=PersistentVolumeClaimRetentionPolicyType"`
 }
 
@@ -248,6 +255,9 @@ type StatefulSetSpec struct {
 	// selector is a label query over pods that should match the replica count.
 	// It must match the pod template's labels.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
+	// +required
+	// +k8s:alpha(since: "1.37")=+k8s:required
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
 	Selector *metav1.LabelSelector `json:"selector" protobuf:"bytes,2,opt,name=selector"`
 
 	// template is the object that describes the pod that will be created if
@@ -257,6 +267,7 @@ type StatefulSetSpec struct {
 	// <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named
 	// "web" with index number "3" would be named "web-3".
 	// The only allowed template.spec.restartPolicy value is "Always".
+	// +required
 	Template v1.PodTemplateSpec `json:"template" protobuf:"bytes,3,opt,name=template"`
 
 	// volumeClaimTemplates is a list of claims that pods are allowed to reference.
@@ -267,7 +278,10 @@ type StatefulSetSpec struct {
 	// any volumes in the template, with the same name.
 	// TODO: Define the behavior if a claim already exists with the same name.
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	// +listType=atomic
+	// +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:opaqueType
 	VolumeClaimTemplates []v1.PersistentVolumeClaim `json:"volumeClaimTemplates,omitempty" protobuf:"bytes,4,rep,name=volumeClaimTemplates"`
 
 	// serviceName is the name of the service that governs this StatefulSet.
@@ -276,6 +290,8 @@ type StatefulSetSpec struct {
 	// pattern: pod-specific-string.serviceName.default.svc.cluster.local
 	// where "pod-specific-string" is managed by the StatefulSet controller.
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	ServiceName string `json:"serviceName" protobuf:"bytes,5,opt,name=serviceName"`
 
 	// podManagementPolicy controls how pods are created during initial scale up,
@@ -287,17 +303,21 @@ type StatefulSetSpec struct {
 	// to match the desired scale without waiting, and on scale down will delete
 	// all pods at once.
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	PodManagementPolicy PodManagementPolicyType `json:"podManagementPolicy,omitempty" protobuf:"bytes,6,opt,name=podManagementPolicy,casttype=PodManagementPolicyType"`
 
 	// updateStrategy indicates the StatefulSetUpdateStrategy that will be
 	// employed to update Pods in the StatefulSet when a revision is made to
 	// Template.
+	// +optional
 	UpdateStrategy StatefulSetUpdateStrategy `json:"updateStrategy,omitempty" protobuf:"bytes,7,opt,name=updateStrategy"`
 
 	// revisionHistoryLimit is the maximum number of revisions that will
 	// be maintained in the StatefulSet's revision history. The revision history
 	// consists of all revisions not represented by a currently applied
 	// StatefulSetSpec version. The default value is 10.
+	// +optional
 	RevisionHistoryLimit *int32 `json:"revisionHistoryLimit,omitempty" protobuf:"varint,8,opt,name=revisionHistoryLimit"`
 
 	// Minimum number of seconds for which a newly created pod should be ready
@@ -375,8 +395,10 @@ type StatefulSetConditionType string
 // StatefulSetCondition describes the state of a statefulset at a certain point.
 type StatefulSetCondition struct {
 	// Type of statefulset condition.
+	// +optional
 	Type StatefulSetConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=StatefulSetConditionType"`
 	// Status of the condition, one of True, False, Unknown.
+	// +optional
 	Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=k8s.io/api/core/v1.ConditionStatus"`
 	// Last time the condition transitioned from one status to another.
 	// +optional
@@ -397,7 +419,7 @@ type StatefulSetCondition struct {
 
 // StatefulSetList is a collection of StatefulSets.
 type StatefulSetList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	Items           []StatefulSet `json:"items" protobuf:"bytes,2,rep,name=items"`
@@ -413,14 +435,16 @@ type StatefulSetList struct {
 // DEPRECATED - This group version of Deployment is deprecated by apps/v1/Deployment. See the release notes for
 // more information.
 // Deployment enables declarative updates for Pods and ReplicaSets.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 type Deployment struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Specification of the desired behavior of the Deployment.
-	// +optional
+	// +required
 	Spec DeploymentSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 
 	// Most recently observed status of the Deployment.
@@ -438,10 +462,12 @@ type DeploymentSpec struct {
 	// Label selector for pods. Existing ReplicaSets whose pods are
 	// selected by this will be the ones affected by this deployment.
 	// It must match the pod template's labels.
+	// +required
 	Selector *metav1.LabelSelector `json:"selector" protobuf:"bytes,2,opt,name=selector"`
 
 	// Template describes the pods that will be created.
 	// The only allowed template.spec.restartPolicy value is "Always".
+	// +required
 	Template v1.PodTemplateSpec `json:"template" protobuf:"bytes,3,opt,name=template"`
 
 	// The deployment strategy to use to replace existing pods with new ones.
@@ -470,6 +496,7 @@ type DeploymentSpec struct {
 	// process failed deployments and a condition with a ProgressDeadlineExceeded
 	// reason will be surfaced in the deployment status. Note that progress will
 	// not be estimated during the time a deployment is paused. Defaults to 600s.
+	// +optional
 	ProgressDeadlineSeconds *int32 `json:"progressDeadlineSeconds,omitempty" protobuf:"varint,9,opt,name=progressDeadlineSeconds"`
 }
 
@@ -604,16 +631,22 @@ const (
 // DeploymentCondition describes the state of a deployment at a certain point.
 type DeploymentCondition struct {
 	// Type of deployment condition.
+	// +optional
 	Type DeploymentConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=DeploymentConditionType"`
 	// Status of the condition, one of True, False, Unknown.
+	// +optional
 	Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=k8s.io/api/core/v1.ConditionStatus"`
 	// The last time this condition was updated.
+	// +optional
 	LastUpdateTime metav1.Time `json:"lastUpdateTime,omitempty" protobuf:"bytes,6,opt,name=lastUpdateTime"`
 	// Last time the condition transitioned from one status to another.
+	// +optional
 	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,7,opt,name=lastTransitionTime"`
 	// The reason for the condition's last transition.
+	// +optional
 	Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 	// A human readable message indicating details about the transition.
+	// +optional
 	Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
 }
 
@@ -625,7 +658,7 @@ type DeploymentCondition struct {
 
 // DeploymentList is a list of Deployments.
 type DeploymentList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -706,6 +739,7 @@ type DaemonSetSpec struct {
 	// Must match in order to be controlled.
 	// It must match the pod template's labels.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
+	// +required
 	Selector *metav1.LabelSelector `json:"selector" protobuf:"bytes,1,opt,name=selector"`
 
 	// An object that describes the pod that will be created.
@@ -714,6 +748,7 @@ type DaemonSetSpec struct {
 	// selector is specified).
 	// The only allowed template.spec.restartPolicy value is "Always".
 	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
+	// +required
 	Template v1.PodTemplateSpec `json:"template" protobuf:"bytes,2,opt,name=template"`
 
 	// An update strategy to replace existing DaemonSet pods with new pods.
@@ -797,8 +832,10 @@ type DaemonSetConditionType string
 // DaemonSetCondition describes the state of a DaemonSet at a certain point.
 type DaemonSetCondition struct {
 	// Type of DaemonSet condition.
+	// +optional
 	Type DaemonSetConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=DaemonSetConditionType"`
 	// Status of the condition, one of True, False, Unknown.
+	// +optional
 	Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=k8s.io/api/core/v1.ConditionStatus"`
 	// Last time the condition transitioned from one status to another.
 	// +optional
@@ -821,8 +858,9 @@ type DaemonSetCondition struct {
 // DEPRECATED - This group version of DaemonSet is deprecated by apps/v1/DaemonSet. See the release notes for
 // more information.
 // DaemonSet represents the configuration of a daemon set.
+// +k8s:supportsSubresource="/status"
 type DaemonSet struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -830,7 +868,7 @@ type DaemonSet struct {
 
 	// The desired behavior of this daemon set.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-	// +optional
+	// +required
 	Spec DaemonSetSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 
 	// The current status of this daemon set. This data may be
@@ -857,7 +895,7 @@ const (
 
 // DaemonSetList is a collection of daemon sets.
 type DaemonSetList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -877,8 +915,10 @@ type DaemonSetList struct {
 // DEPRECATED - This group version of ReplicaSet is deprecated by apps/v1/ReplicaSet. See the release notes for
 // more information.
 // ReplicaSet ensures that a specified number of pod replicas are running at any given time.
+// +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 type ReplicaSet struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// If the Labels of a ReplicaSet are empty, they are defaulted to
 	// be the same as the Pod(s) that the ReplicaSet manages.
@@ -888,7 +928,7 @@ type ReplicaSet struct {
 
 	// Spec defines the specification of the desired behavior of the ReplicaSet.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-	// +optional
+	// +required
 	Spec ReplicaSetSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 
 	// Status is the most recently observed status of the ReplicaSet.
@@ -908,7 +948,7 @@ type ReplicaSet struct {
 
 // ReplicaSetList is a collection of ReplicaSets.
 type ReplicaSetList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -938,6 +978,7 @@ type ReplicaSetSpec struct {
 	// Label keys and values that must match in order to be controlled by this replica set.
 	// It must match the pod template's labels.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
+	// +required
 	Selector *metav1.LabelSelector `json:"selector" protobuf:"bytes,2,opt,name=selector"`
 
 	// Template is the object that describes the pod that will be created if
@@ -998,8 +1039,10 @@ const (
 // ReplicaSetCondition describes the state of a replica set at a certain point.
 type ReplicaSetCondition struct {
 	// Type of replica set condition.
+	// +optional
 	Type ReplicaSetConditionType `json:"type" protobuf:"bytes,1,opt,name=type,casttype=ReplicaSetConditionType"`
 	// Status of the condition, one of True, False, Unknown.
+	// +optional
 	Status v1.ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status,casttype=k8s.io/api/core/v1.ConditionStatus"`
 	// The last time the condition transitioned from one status to another.
 	// +optional
@@ -1031,16 +1074,18 @@ type ReplicaSetCondition struct {
 // it may be subject to name and representation changes in future releases, and clients should not
 // depend on its stability. It is primarily for internal use by controllers.
 type ControllerRevision struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Data is the serialized representation of the state.
-	Data runtime.RawExtension `json:"data,omitempty" protobuf:"bytes,2,opt,name=data"`
+	// +required
+	Data runtime.RawExtension `json:"data" protobuf:"bytes,2,opt,name=data"`
 
 	// Revision indicates the revision of the state represented by Data.
+	// +optional
 	Revision int64 `json:"revision" protobuf:"varint,3,opt,name=revision"`
 }
 
@@ -1052,7 +1097,7 @@ type ControllerRevision struct {
 
 // ControllerRevisionList is a resource containing a list of ControllerRevision objects.
 type ControllerRevisionList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
diff --git a/vendor/k8s.io/api/authentication/v1/generated.pb.go b/vendor/k8s.io/api/authentication/v1/generated.pb.go
index 2b872c453e..8547b769fd 100644
--- a/vendor/k8s.io/api/authentication/v1/generated.pb.go
+++ b/vendor/k8s.io/api/authentication/v1/generated.pb.go
@@ -32,6 +32,8 @@ import (
 	k8s_io_apimachinery_pkg_types "k8s.io/apimachinery/pkg/types"
 )
 
+func (m *AttestationValue) Reset() { *m = AttestationValue{} }
+
 func (m *BoundObjectReference) Reset() { *m = BoundObjectReference{} }
 
 func (m *ExtraValue) Reset() { *m = ExtraValue{} }
@@ -54,6 +56,38 @@ func (m *TokenReviewStatus) Reset() { *m = TokenReviewStatus{} }
 
 func (m *UserInfo) Reset() { *m = UserInfo{} }
 
+func (m AttestationValue) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m AttestationValue) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m AttestationValue) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m) > 0 {
+		for iNdEx := len(m) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m[iNdEx])
+			copy(dAtA[i:], m[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *BoundObjectReference) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -278,6 +312,35 @@ func (m *TokenRequestSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if len(m.Attestations) > 0 {
+		keysForAttestations := make([]string, 0, len(m.Attestations))
+		for k := range m.Attestations {
+			keysForAttestations = append(keysForAttestations, string(k))
+		}
+		sort.Strings(keysForAttestations)
+		for iNdEx := len(keysForAttestations) - 1; iNdEx >= 0; iNdEx-- {
+			v := m.Attestations[string(keysForAttestations[iNdEx])]
+			baseI := i
+			{
+				size, err := (&v).MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+			i -= len(keysForAttestations[iNdEx])
+			copy(dAtA[i:], keysForAttestations[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForAttestations[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintGenerated(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x2a
+		}
+	}
 	if m.ExpirationSeconds != nil {
 		i = encodeVarintGenerated(dAtA, i, uint64(*m.ExpirationSeconds))
 		i--
@@ -572,6 +635,21 @@ func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
 	dAtA[offset] = uint8(v)
 	return base
 }
+func (m AttestationValue) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m) > 0 {
+		for _, s := range m {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
 func (m *BoundObjectReference) Size() (n int) {
 	if m == nil {
 		return 0
@@ -662,6 +740,15 @@ func (m *TokenRequestSpec) Size() (n int) {
 	if m.ExpirationSeconds != nil {
 		n += 1 + sovGenerated(uint64(*m.ExpirationSeconds))
 	}
+	if len(m.Attestations) > 0 {
+		for k, v := range m.Attestations {
+			_ = k
+			_ = v
+			l = v.Size()
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + l + sovGenerated(uint64(l))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
 	return n
 }
 
@@ -814,10 +901,21 @@ func (this *TokenRequestSpec) String() string {
 	if this == nil {
 		return "nil"
 	}
+	keysForAttestations := make([]string, 0, len(this.Attestations))
+	for k := range this.Attestations {
+		keysForAttestations = append(keysForAttestations, k)
+	}
+	sort.Strings(keysForAttestations)
+	mapStringForAttestations := "map[string]AttestationValue{"
+	for _, k := range keysForAttestations {
+		mapStringForAttestations += fmt.Sprintf("%v: %v,", k, this.Attestations[k])
+	}
+	mapStringForAttestations += "}"
 	s := strings.Join([]string{`&TokenRequestSpec{`,
 		`Audiences:` + fmt.Sprintf("%v", this.Audiences) + `,`,
 		`BoundObjectRef:` + strings.Replace(this.BoundObjectRef.String(), "BoundObjectReference", "BoundObjectReference", 1) + `,`,
 		`ExpirationSeconds:` + valueToStringGenerated(this.ExpirationSeconds) + `,`,
+		`Attestations:` + mapStringForAttestations + `,`,
 		`}`,
 	}, "")
 	return s
@@ -900,6 +998,88 @@ func valueToStringGenerated(v interface{}) string {
 	pv := reflect.Indirect(rv).Interface()
 	return fmt.Sprintf("*%v", pv)
 }
+func (m *AttestationValue) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AttestationValue: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AttestationValue: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			*m = append(*m, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *BoundObjectReference) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -1625,6 +1805,135 @@ func (m *TokenRequestSpec) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.ExpirationSeconds = &v
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Attestations", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Attestations == nil {
+				m.Attestations = make(map[string]AttestationValue)
+			}
+			var mapkey string
+			mapvalue := &AttestationValue{}
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var mapmsglen int
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapmsglen |= int(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					if mapmsglen < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postmsgIndex := iNdEx + mapmsglen
+					if postmsgIndex < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postmsgIndex > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = &AttestationValue{}
+					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
+						return err
+					}
+					iNdEx = postmsgIndex
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipGenerated(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.Attestations[mapkey] = *mapvalue
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
diff --git a/vendor/k8s.io/api/authentication/v1/generated.proto b/vendor/k8s.io/api/authentication/v1/generated.proto
index 82ff7c3c51..c7b99158a0 100644
--- a/vendor/k8s.io/api/authentication/v1/generated.proto
+++ b/vendor/k8s.io/api/authentication/v1/generated.proto
@@ -28,9 +28,19 @@ import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
 // Package-wide variables from generator "generated".
 option go_package = "k8s.io/api/authentication/v1";
 
+// AttestationValue masks the value so protobuf can generate
+// +protobuf.nullable=true
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+message AttestationValue {
+  // items, if empty, will result in an empty slice
+
+  repeated string items = 1;
+}
+
 // BoundObjectReference is a reference to an object that a token is bound to.
 message BoundObjectReference {
-  // kind of the referent. Valid kinds are 'Pod' and 'Secret'.
+  // kind of the referent. Valid kinds are 'Pod', 'Secret', 'Node',
+  // 'ValidatingWebhookConfiguration', and 'MutatingWebhookConfiguration'.
   // +optional
   optional string kind = 1;
 
@@ -59,10 +69,12 @@ message ExtraValue {
 // SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request.
 // When using impersonation, users will receive the user info of the user being impersonated.  If impersonation or
 // request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
+// +k8s:supportsSubresource="/status"
 message SelfSubjectReview {
   // metadata is standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // status is filled in by the server with the user attributes.
@@ -82,6 +94,7 @@ message TokenRequest {
   // metadata is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec holds information about the request being evaluated
@@ -118,6 +131,14 @@ message TokenRequestSpec {
   // small if you want prompt revocation.
   // +optional
   optional BoundObjectReference boundObjectRef = 3;
+
+  // attestations is a map of well-known keys to string-slice values.
+  // The values for each key have a specific semantic meaning, which is
+  // documented on the key definition. Requesters of tokens may ask
+  // the Kubernetes API Server to attest to certain claims. The API Server
+  // may perform authorization checks depending on the key of this map.
+  // +optional
+  map<string, AttestationValue> attestations = 5;
 }
 
 // TokenRequestStatus is the result of a token request.
@@ -134,10 +155,12 @@ message TokenRequestStatus {
 // TokenReview attempts to authenticate a token to a known user.
 // Note: TokenReview requests may be cached by the webhook token authenticator
 // plugin in the kube-apiserver.
+// +k8s:supportsSubresource="/status"
 message TokenReview {
   // metadata is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec holds information about the request being evaluated
diff --git a/vendor/k8s.io/api/authentication/v1/types.go b/vendor/k8s.io/api/authentication/v1/types.go
index c28bded50a..1eee2b5049 100644
--- a/vendor/k8s.io/api/authentication/v1/types.go
+++ b/vendor/k8s.io/api/authentication/v1/types.go
@@ -39,6 +39,33 @@ const (
 	// It can be repeated multiplied times for multiple map keys and the same key can be repeated multiple
 	// times to have multiple elements in the slice under a single key
 	ImpersonateUserExtraHeaderPrefix = "Impersonate-Extra-"
+
+	// AttestationAdmissionReviewAPIGroups is the map key for the
+	// admissionReviewAPIGroups claim. It represents the APIGroup that a token
+	// authorizes its bearer to query admission webhooks about. The value
+	// corresponding to this key must be a slice of length 1, and the first and
+	// only element of this slice must match the APIGroup of the AdmissionReview
+	// request being made of the webhook. The empty string is invalid as the
+	// first and only element of the value slice. The special value "*" means
+	// "all api groups", and requires matching permissions (described below).
+	//
+	// For this claim to be considered valid, the TokenRequest must meet two
+	// conditions. First, the BoundObjectRef must be one of
+	// ValidatingWebhookConfiguration or MutatingWebhookConfiguration; the
+	// Webhook Configuration in question must have a Rule governing a resource
+	// under the APIGroup named in the value to this key. Second, the requested
+	// audience must match one of the following patterns:
+	//   1. When the webhook is configured with a URL, the audience must match
+	//      the URL field exactly.
+	//   2. When the webhook is configured with a service, the audience must
+	//      match the pattern `https://$name.$namespace.svc:$port[/$path]`, where
+	//      `/$path` is optional.
+	//
+	// The service account for which the TokenRequest is being made must have
+	// "attest" permissions on group "authentication.k8s.io", resource
+	// "admissionReviewAPIGroups", and a resource name matching exactly either
+	// "*", or the API group named in the value to this key.
+	AttestationAdmissionReviewAPIGroups = "admissionReviewAPIGroups"
 )
 
 // +genclient
@@ -50,11 +77,13 @@ const (
 // TokenReview attempts to authenticate a token to a known user.
 // Note: TokenReview requests may be cached by the webhook token authenticator
 // plugin in the kube-apiserver.
+// +k8s:supportsSubresource="/status"
 type TokenReview struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec holds information about the request being evaluated
@@ -135,15 +164,25 @@ func (t ExtraValue) String() string {
 	return fmt.Sprintf("%v", []string(t))
 }
 
+// AttestationValue masks the value so protobuf can generate
+// +protobuf.nullable=true
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type AttestationValue []string
+
+func (a AttestationValue) String() string {
+	return fmt.Sprintf("%v", []string(a))
+}
+
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +k8s:prerelease-lifecycle-gen:introduced=1.10
 
 // TokenRequest requests a token for a given service account.
 type TokenRequest struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec holds information about the request being evaluated
@@ -180,6 +219,14 @@ type TokenRequestSpec struct {
 	// small if you want prompt revocation.
 	// +optional
 	BoundObjectRef *BoundObjectReference `json:"boundObjectRef" protobuf:"bytes,3,opt,name=boundObjectRef"`
+
+	// attestations is a map of well-known keys to string-slice values.
+	// The values for each key have a specific semantic meaning, which is
+	// documented on the key definition. Requesters of tokens may ask
+	// the Kubernetes API Server to attest to certain claims. The API Server
+	// may perform authorization checks depending on the key of this map.
+	// +optional
+	Attestations map[string]AttestationValue `json:"attestations,omitempty" protobuf:"bytes,5,rep,name=attestations"`
 }
 
 // TokenRequestStatus is the result of a token request.
@@ -194,7 +241,8 @@ type TokenRequestStatus struct {
 
 // BoundObjectReference is a reference to an object that a token is bound to.
 type BoundObjectReference struct {
-	// kind of the referent. Valid kinds are 'Pod' and 'Secret'.
+	// kind of the referent. Valid kinds are 'Pod', 'Secret', 'Node',
+	// 'ValidatingWebhookConfiguration', and 'MutatingWebhookConfiguration'.
 	// +optional
 	Kind string `json:"kind,omitempty" protobuf:"bytes,1,opt,name=kind"`
 	// apiVersion is API version of the referent.
@@ -218,11 +266,13 @@ type BoundObjectReference struct {
 // SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request.
 // When using impersonation, users will receive the user info of the user being impersonated.  If impersonation or
 // request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
+// +k8s:supportsSubresource="/status"
 type SelfSubjectReview struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	// status is filled in by the server with the user attributes.
 	// +optional
diff --git a/vendor/k8s.io/api/authentication/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/authentication/v1/types_swagger_doc_generated.go
index ea3acbb681..eb50e71546 100644
--- a/vendor/k8s.io/api/authentication/v1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/authentication/v1/types_swagger_doc_generated.go
@@ -29,7 +29,7 @@ package v1
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_BoundObjectReference = map[string]string{
 	"":           "BoundObjectReference is a reference to an object that a token is bound to.",
-	"kind":       "kind of the referent. Valid kinds are 'Pod' and 'Secret'.",
+	"kind":       "kind of the referent. Valid kinds are 'Pod', 'Secret', 'Node', 'ValidatingWebhookConfiguration', and 'MutatingWebhookConfiguration'.",
 	"apiVersion": "apiVersion is API version of the referent.",
 	"name":       "name of the referent.",
 	"uid":        "uid of the referent.",
@@ -74,6 +74,7 @@ var map_TokenRequestSpec = map[string]string{
 	"audiences":         "audiences are the intendend audiences of the token. A recipient of a token must identify themself with an identifier in the list of audiences of the token, and otherwise should reject the token. A token issued for multiple audiences may be used to authenticate against any of the audiences listed but implies a high degree of trust between the target audiences.",
 	"expirationSeconds": "expirationSeconds is the requested duration of validity of the request. The token issuer may return a token with a different validity duration so a client needs to check the 'expiration' field in a response.",
 	"boundObjectRef":    "boundObjectRef is a reference to an object that the token will be bound to. The token will only be valid for as long as the bound object exists. NOTE: The API server's TokenReview endpoint will validate the BoundObjectRef, but other audiences may not. Keep ExpirationSeconds small if you want prompt revocation.",
+	"attestations":      "attestations is a map of well-known keys to string-slice values. The values for each key have a specific semantic meaning, which is documented on the key definition. Requesters of tokens may ask the Kubernetes API Server to attest to certain claims. The API Server may perform authorization checks depending on the key of this map.",
 }
 
 func (TokenRequestSpec) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/authentication/v1/zz_generated.deepcopy.go b/vendor/k8s.io/api/authentication/v1/zz_generated.deepcopy.go
index 369c89b863..6bc649268d 100644
--- a/vendor/k8s.io/api/authentication/v1/zz_generated.deepcopy.go
+++ b/vendor/k8s.io/api/authentication/v1/zz_generated.deepcopy.go
@@ -25,6 +25,26 @@ import (
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in AttestationValue) DeepCopyInto(out *AttestationValue) {
+	{
+		in := &in
+		*out = make(AttestationValue, len(*in))
+		copy(*out, *in)
+		return
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AttestationValue.
+func (in AttestationValue) DeepCopy() AttestationValue {
+	if in == nil {
+		return nil
+	}
+	out := new(AttestationValue)
+	in.DeepCopyInto(out)
+	return *out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *BoundObjectReference) DeepCopyInto(out *BoundObjectReference) {
 	*out = *in
@@ -151,6 +171,21 @@ func (in *TokenRequestSpec) DeepCopyInto(out *TokenRequestSpec) {
 		*out = new(BoundObjectReference)
 		**out = **in
 	}
+	if in.Attestations != nil {
+		in, out := &in.Attestations, &out.Attestations
+		*out = make(map[string]AttestationValue, len(*in))
+		for key, val := range *in {
+			var outVal []string
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				in, out := &val, &outVal
+				*out = make(AttestationValue, len(*in))
+				copy(*out, *in)
+			}
+			(*out)[key] = outVal
+		}
+	}
 	return
 }
 
diff --git a/vendor/k8s.io/api/authentication/v1alpha1/generated.proto b/vendor/k8s.io/api/authentication/v1alpha1/generated.proto
index 2bf836d730..cd806bb8aa 100644
--- a/vendor/k8s.io/api/authentication/v1alpha1/generated.proto
+++ b/vendor/k8s.io/api/authentication/v1alpha1/generated.proto
@@ -32,10 +32,12 @@ option go_package = "k8s.io/api/authentication/v1alpha1";
 // SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request.
 // When using impersonation, users will receive the user info of the user being impersonated.  If impersonation or
 // request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
+// +k8s:supportsSubresource="/status"
 message SelfSubjectReview {
   // metadata is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // status is filled in by the server with the user attributes.
diff --git a/vendor/k8s.io/api/authentication/v1alpha1/types.go b/vendor/k8s.io/api/authentication/v1alpha1/types.go
index 7e02470c96..5a76a91a37 100644
--- a/vendor/k8s.io/api/authentication/v1alpha1/types.go
+++ b/vendor/k8s.io/api/authentication/v1alpha1/types.go
@@ -30,11 +30,13 @@ import (
 // SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request.
 // When using impersonation, users will receive the user info of the user being impersonated.  If impersonation or
 // request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
+// +k8s:supportsSubresource="/status"
 type SelfSubjectReview struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	// status is filled in by the server with the user attributes.
 	// +optional
diff --git a/vendor/k8s.io/api/authentication/v1beta1/generated.proto b/vendor/k8s.io/api/authentication/v1beta1/generated.proto
index 999c65156d..e5992bcaa2 100644
--- a/vendor/k8s.io/api/authentication/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/authentication/v1beta1/generated.proto
@@ -41,10 +41,12 @@ message ExtraValue {
 // SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request.
 // When using impersonation, users will receive the user info of the user being impersonated.  If impersonation or
 // request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
+// +k8s:supportsSubresource="/status"
 message SelfSubjectReview {
   // metadata is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // status is filled in by the server with the user attributes.
@@ -62,10 +64,12 @@ message SelfSubjectReviewStatus {
 // TokenReview attempts to authenticate a token to a known user.
 // Note: TokenReview requests may be cached by the webhook token authenticator
 // plugin in the kube-apiserver.
+// +k8s:supportsSubresource="/status"
 message TokenReview {
   // metadata is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec holds information about the request being evaluated
diff --git a/vendor/k8s.io/api/authentication/v1beta1/types.go b/vendor/k8s.io/api/authentication/v1beta1/types.go
index 33dacdb723..8873d5d2a7 100644
--- a/vendor/k8s.io/api/authentication/v1beta1/types.go
+++ b/vendor/k8s.io/api/authentication/v1beta1/types.go
@@ -34,11 +34,13 @@ import (
 // TokenReview attempts to authenticate a token to a known user.
 // Note: TokenReview requests may be cached by the webhook token authenticator
 // plugin in the kube-apiserver.
+// +k8s:supportsSubresource="/status"
 type TokenReview struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec holds information about the request being evaluated
@@ -128,11 +130,13 @@ func (t ExtraValue) String() string {
 // SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request.
 // When using impersonation, users will receive the user info of the user being impersonated.  If impersonation or
 // request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
+// +k8s:supportsSubresource="/status"
 type SelfSubjectReview struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	// status is filled in by the server with the user attributes.
 	// +optional
diff --git a/vendor/k8s.io/api/authorization/v1/generated.proto b/vendor/k8s.io/api/authorization/v1/generated.proto
index c47449f911..40753aa434 100644
--- a/vendor/k8s.io/api/authorization/v1/generated.proto
+++ b/vendor/k8s.io/api/authorization/v1/generated.proto
@@ -94,10 +94,12 @@ message LabelSelectorAttributes {
 // LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace.
 // Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions
 // checking.
+// +k8s:supportsSubresource="/status"
 message LocalSubjectAccessReview {
   // metadata is the standard list metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec holds information about the request being evaluated.  spec.namespace must be equal to the namespace
@@ -203,10 +205,12 @@ message ResourceRule {
 // SelfSubjectAccessReview checks whether or the current user can perform an action.  Not filling in a
 // spec.namespace means "in all namespaces".  Self is a special case, because users should always be able
 // to check whether they can perform an action
+// +k8s:supportsSubresource="/status"
 message SelfSubjectAccessReview {
   // metadata is the standard list metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec holds information about the request being evaluated.  user and groups must be empty
@@ -222,10 +226,14 @@ message SelfSubjectAccessReview {
 message SelfSubjectAccessReviewSpec {
   // resourceAttributes describes information for a resource access request
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:unionMember
   optional ResourceAttributes resourceAttributes = 1;
 
   // nonResourceAttributes describes information for a non-resource access request
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:unionMember
   optional NonResourceAttributes nonResourceAttributes = 2;
 }
 
@@ -235,10 +243,12 @@ message SelfSubjectAccessReviewSpec {
 // or to quickly let an end user reason about their permissions. It should NOT Be used by external systems to
 // drive authorization decisions as this raises confused deputy, cache lifetime/revocation, and correctness concerns.
 // SubjectAccessReview, and LocalAccessReview are the correct way to defer authorization decisions to the API server.
+// +k8s:supportsSubresource="/status"
 message SelfSubjectRulesReview {
   // metadata is the standard list metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec holds information about the request being evaluated.
@@ -256,10 +266,12 @@ message SelfSubjectRulesReviewSpec {
 }
 
 // SubjectAccessReview checks whether or not a user or group can perform an action.
+// +k8s:supportsSubresource="/status"
 message SubjectAccessReview {
   // metadata is the standard list metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec holds information about the request being evaluated
@@ -275,10 +287,14 @@ message SubjectAccessReview {
 message SubjectAccessReviewSpec {
   // resourceAttributes describes information for a resource access request
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:unionMember
   optional ResourceAttributes resourceAttributes = 1;
 
   // nonResourceAttributes describes information for a non-resource access request
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:unionMember
   optional NonResourceAttributes nonResourceAttributes = 2;
 
   // user is the user you're testing for.
diff --git a/vendor/k8s.io/api/authorization/v1/types.go b/vendor/k8s.io/api/authorization/v1/types.go
index dcc9b0f853..eb9f808cf7 100644
--- a/vendor/k8s.io/api/authorization/v1/types.go
+++ b/vendor/k8s.io/api/authorization/v1/types.go
@@ -29,11 +29,13 @@ import (
 // +k8s:prerelease-lifecycle-gen:introduced=1.6
 
 // SubjectAccessReview checks whether or not a user or group can perform an action.
+// +k8s:supportsSubresource="/status"
 type SubjectAccessReview struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec holds information about the request being evaluated
@@ -53,11 +55,13 @@ type SubjectAccessReview struct {
 // SelfSubjectAccessReview checks whether or the current user can perform an action.  Not filling in a
 // spec.namespace means "in all namespaces".  Self is a special case, because users should always be able
 // to check whether they can perform an action
+// +k8s:supportsSubresource="/status"
 type SelfSubjectAccessReview struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec holds information about the request being evaluated.  user and groups must be empty
@@ -76,11 +80,13 @@ type SelfSubjectAccessReview struct {
 // LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace.
 // Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions
 // checking.
+// +k8s:supportsSubresource="/status"
 type LocalSubjectAccessReview struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec holds information about the request being evaluated.  spec.namespace must be equal to the namespace
@@ -195,9 +201,13 @@ type NonResourceAttributes struct {
 type SubjectAccessReviewSpec struct {
 	// resourceAttributes describes information for a resource access request
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:unionMember
 	ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty" protobuf:"bytes,1,opt,name=resourceAttributes"`
 	// nonResourceAttributes describes information for a non-resource access request
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:unionMember
 	NonResourceAttributes *NonResourceAttributes `json:"nonResourceAttributes,omitempty" protobuf:"bytes,2,opt,name=nonResourceAttributes"`
 
 	// user is the user you're testing for.
@@ -231,9 +241,13 @@ func (t ExtraValue) String() string {
 type SelfSubjectAccessReviewSpec struct {
 	// resourceAttributes describes information for a resource access request
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:unionMember
 	ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty" protobuf:"bytes,1,opt,name=resourceAttributes"`
 	// nonResourceAttributes describes information for a non-resource access request
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:unionMember
 	NonResourceAttributes *NonResourceAttributes `json:"nonResourceAttributes,omitempty" protobuf:"bytes,2,opt,name=nonResourceAttributes"`
 }
 
@@ -269,11 +283,13 @@ type SubjectAccessReviewStatus struct {
 // or to quickly let an end user reason about their permissions. It should NOT Be used by external systems to
 // drive authorization decisions as this raises confused deputy, cache lifetime/revocation, and correctness concerns.
 // SubjectAccessReview, and LocalAccessReview are the correct way to defer authorization decisions to the API server.
+// +k8s:supportsSubresource="/status"
 type SelfSubjectRulesReview struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec holds information about the request being evaluated.
diff --git a/vendor/k8s.io/api/authorization/v1beta1/generated.proto b/vendor/k8s.io/api/authorization/v1beta1/generated.proto
index 8095ab4dbb..37618f077f 100644
--- a/vendor/k8s.io/api/authorization/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/authorization/v1beta1/generated.proto
@@ -41,10 +41,12 @@ message ExtraValue {
 // LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace.
 // Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions
 // checking.
+// +k8s:supportsSubresource="/status"
 message LocalSubjectAccessReview {
   // metadata is the standard list metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec holds information about the request being evaluated.  spec.namespace must be equal to the namespace
@@ -150,10 +152,12 @@ message ResourceRule {
 // SelfSubjectAccessReview checks whether or the current user can perform an action.  Not filling in a
 // spec.namespace means "in all namespaces".  Self is a special case, because users should always be able
 // to check whether they can perform an action
+// +k8s:supportsSubresource="/status"
 message SelfSubjectAccessReview {
   // metadata is the standard list metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec holds information about the request being evaluated.  user and groups must be empty
@@ -169,10 +173,14 @@ message SelfSubjectAccessReview {
 message SelfSubjectAccessReviewSpec {
   // resourceAttributes describes information for a resource access request
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:unionMember
   optional ResourceAttributes resourceAttributes = 1;
 
   // nonResourceAttributes describes information for a non-resource access request
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:unionMember
   optional NonResourceAttributes nonResourceAttributes = 2;
 }
 
@@ -182,10 +190,12 @@ message SelfSubjectAccessReviewSpec {
 // or to quickly let an end user reason about their permissions. It should NOT Be used by external systems to
 // drive authorization decisions as this raises confused deputy, cache lifetime/revocation, and correctness concerns.
 // SubjectAccessReview, and LocalAccessReview are the correct way to defer authorization decisions to the API server.
+// +k8s:supportsSubresource="/status"
 message SelfSubjectRulesReview {
   // metadata is the standard list metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec holds information about the request being evaluated.
@@ -203,10 +213,12 @@ message SelfSubjectRulesReviewSpec {
 }
 
 // SubjectAccessReview checks whether or not a user or group can perform an action.
+// +k8s:supportsSubresource="/status"
 message SubjectAccessReview {
   // metadata is the standard list metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec holds information about the request being evaluated
@@ -222,10 +234,14 @@ message SubjectAccessReview {
 message SubjectAccessReviewSpec {
   // resourceAttributes describes information for a resource access request
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:unionMember
   optional ResourceAttributes resourceAttributes = 1;
 
   // nonResourceAttributes describes information for a non-resource access request
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:unionMember
   optional NonResourceAttributes nonResourceAttributes = 2;
 
   // user is the user you're testing for.
diff --git a/vendor/k8s.io/api/authorization/v1beta1/types.go b/vendor/k8s.io/api/authorization/v1beta1/types.go
index 204559fd20..7dc8409af6 100644
--- a/vendor/k8s.io/api/authorization/v1beta1/types.go
+++ b/vendor/k8s.io/api/authorization/v1beta1/types.go
@@ -32,11 +32,13 @@ import (
 // +k8s:prerelease-lifecycle-gen:replacement=authorization.k8s.io,v1,SubjectAccessReview
 
 // SubjectAccessReview checks whether or not a user or group can perform an action.
+// +k8s:supportsSubresource="/status"
 type SubjectAccessReview struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec holds information about the request being evaluated
@@ -58,11 +60,13 @@ type SubjectAccessReview struct {
 // SelfSubjectAccessReview checks whether or the current user can perform an action.  Not filling in a
 // spec.namespace means "in all namespaces".  Self is a special case, because users should always be able
 // to check whether they can perform an action
+// +k8s:supportsSubresource="/status"
 type SelfSubjectAccessReview struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec holds information about the request being evaluated.  user and groups must be empty
@@ -83,11 +87,13 @@ type SelfSubjectAccessReview struct {
 // LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace.
 // Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions
 // checking.
+// +k8s:supportsSubresource="/status"
 type LocalSubjectAccessReview struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec holds information about the request being evaluated.  spec.namespace must be equal to the namespace
@@ -148,9 +154,13 @@ type NonResourceAttributes struct {
 type SubjectAccessReviewSpec struct {
 	// resourceAttributes describes information for a resource access request
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:unionMember
 	ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty" protobuf:"bytes,1,opt,name=resourceAttributes"`
 	// nonResourceAttributes describes information for a non-resource access request
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:unionMember
 	NonResourceAttributes *NonResourceAttributes `json:"nonResourceAttributes,omitempty" protobuf:"bytes,2,opt,name=nonResourceAttributes"`
 
 	// user is the user you're testing for.
@@ -184,9 +194,13 @@ func (t ExtraValue) String() string {
 type SelfSubjectAccessReviewSpec struct {
 	// resourceAttributes describes information for a resource access request
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:unionMember
 	ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty" protobuf:"bytes,1,opt,name=resourceAttributes"`
 	// nonResourceAttributes describes information for a non-resource access request
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:unionMember
 	NonResourceAttributes *NonResourceAttributes `json:"nonResourceAttributes,omitempty" protobuf:"bytes,2,opt,name=nonResourceAttributes"`
 }
 
@@ -224,11 +238,13 @@ type SubjectAccessReviewStatus struct {
 // or to quickly let an end user reason about their permissions. It should NOT Be used by external systems to
 // drive authorization decisions as this raises confused deputy, cache lifetime/revocation, and correctness concerns.
 // SubjectAccessReview, and LocalAccessReview are the correct way to defer authorization decisions to the API server.
+// +k8s:supportsSubresource="/status"
 type SelfSubjectRulesReview struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec holds information about the request being evaluated.
diff --git a/vendor/k8s.io/api/autoscaling/v1/generated.pb.go b/vendor/k8s.io/api/autoscaling/v1/generated.pb.go
index 6028054aef..681c0c44c7 100644
--- a/vendor/k8s.io/api/autoscaling/v1/generated.pb.go
+++ b/vendor/k8s.io/api/autoscaling/v1/generated.pb.go
@@ -410,6 +410,11 @@ func (m *HorizontalPodAutoscalerCondition) MarshalToSizedBuffer(dAtA []byte) (in
 	_ = i
 	var l int
 	_ = l
+	if m.ObservedGeneration != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.ObservedGeneration))
+		i--
+		dAtA[i] = 0x30
+	}
 	i -= len(m.Message)
 	copy(dAtA[i:], m.Message)
 	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message)))
@@ -1344,6 +1349,9 @@ func (m *HorizontalPodAutoscalerCondition) Size() (n int) {
 	n += 1 + l + sovGenerated(uint64(l))
 	l = len(m.Message)
 	n += 1 + l + sovGenerated(uint64(l))
+	if m.ObservedGeneration != nil {
+		n += 1 + sovGenerated(uint64(*m.ObservedGeneration))
+	}
 	return n
 }
 
@@ -1708,6 +1716,7 @@ func (this *HorizontalPodAutoscalerCondition) String() string {
 		`LastTransitionTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastTransitionTime), "Time", "v1.Time", 1), `&`, ``, 1) + `,`,
 		`Reason:` + fmt.Sprintf("%v", this.Reason) + `,`,
 		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`ObservedGeneration:` + valueToStringGenerated(this.ObservedGeneration) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -3101,6 +3110,26 @@ func (m *HorizontalPodAutoscalerCondition) Unmarshal(dAtA []byte) error {
 			}
 			m.Message = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObservedGeneration", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.ObservedGeneration = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
diff --git a/vendor/k8s.io/api/autoscaling/v1/generated.proto b/vendor/k8s.io/api/autoscaling/v1/generated.proto
index 6ef1facb6a..a20b92a793 100644
--- a/vendor/k8s.io/api/autoscaling/v1/generated.proto
+++ b/vendor/k8s.io/api/autoscaling/v1/generated.proto
@@ -88,9 +88,11 @@ message ContainerResourceMetricStatus {
 // +structType=atomic
 message CrossVersionObjectReference {
   // kind is the kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +k8s:alpha(since: "1.37")=+k8s:required
   optional string kind = 1;
 
   // name is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+  // +k8s:alpha(since: "1.37")=+k8s:required
   optional string name = 2;
 
   // apiVersion is the API version of the referent
@@ -142,8 +144,9 @@ message ExternalMetricStatus {
 }
 
 // configuration of a horizontal pod autoscaler.
+// +k8s:supportsSubresource="/status"
 message HorizontalPodAutoscaler {
-  // Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  // metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
@@ -178,6 +181,12 @@ message HorizontalPodAutoscalerCondition {
   // the transition
   // +optional
   optional string message = 5;
+
+  // observedGeneration represents the .metadata.generation that the condition was set based upon.
+  // For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+  // with respect to the current state of the instance.
+  // +optional
+  optional int64 observedGeneration = 6;
 }
 
 // list of horizontal pod autoscaler objects.
@@ -192,7 +201,7 @@ message HorizontalPodAutoscalerList {
 
 // specification of a horizontal pod autoscaler.
 message HorizontalPodAutoscalerSpec {
-  // reference to scaled resource; horizontal pod autoscaler will learn the current resource consumption
+  // scaleTargetRef is the reference to scaled resource; horizontal pod autoscaler will learn the current resource consumption
   // and will set the desired number of pods by using its Scale subresource.
   optional CrossVersionObjectReference scaleTargetRef = 1;
 
@@ -202,15 +211,15 @@ message HorizontalPodAutoscalerSpec {
   // metric is configured.  Scaling is active as long as at least one metric value is
   // available.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:ifEnabled(HPAScaleToZero)=+k8s:minimum=0
-  // +k8s:alpha(since: "1.36")=+k8s:ifDisabled(HPAScaleToZero)=+k8s:minimum=1
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:ifEnabled(HPAScaleToZero)=+k8s:minimum=0
+  // +k8s:beta(since: "1.37")=+k8s:ifDisabled(HPAScaleToZero)=+k8s:minimum=1
   optional int32 minReplicas = 2;
 
   // maxReplicas is the upper limit for the number of pods that can be set by the autoscaler; cannot be smaller than MinReplicas.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:minimum=1
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:minimum=1
   optional int32 maxReplicas = 3;
 
   // targetCPUUtilizationPercentage is the target average CPU utilization (represented as a percentage of requested CPU) over all the pods;
@@ -461,8 +470,9 @@ message ResourceMetricStatus {
 
 // Scale represents a scaling request for a resource.
 message Scale {
-  // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
+  // metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec defines the behavior of the scale. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
@@ -478,9 +488,9 @@ message Scale {
 message ScaleSpec {
   // replicas is the desired number of instances for the scaled object.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +default=0
-  // +k8s:alpha(since: "1.36")=+k8s:minimum=0
+  // +k8s:beta(since: "1.37")=+k8s:minimum=0
   optional int32 replicas = 1;
 }
 
diff --git a/vendor/k8s.io/api/autoscaling/v1/types.go b/vendor/k8s.io/api/autoscaling/v1/types.go
index 97222afc08..5554e62713 100644
--- a/vendor/k8s.io/api/autoscaling/v1/types.go
+++ b/vendor/k8s.io/api/autoscaling/v1/types.go
@@ -26,9 +26,11 @@ import (
 // +structType=atomic
 type CrossVersionObjectReference struct {
 	// kind is the kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +k8s:alpha(since: "1.37")=+k8s:required
 	Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"`
 
 	// name is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+	// +k8s:alpha(since: "1.37")=+k8s:required
 	Name string `json:"name" protobuf:"bytes,2,opt,name=name"`
 
 	// apiVersion is the API version of the referent
@@ -38,7 +40,7 @@ type CrossVersionObjectReference struct {
 
 // specification of a horizontal pod autoscaler.
 type HorizontalPodAutoscalerSpec struct {
-	// reference to scaled resource; horizontal pod autoscaler will learn the current resource consumption
+	// scaleTargetRef is the reference to scaled resource; horizontal pod autoscaler will learn the current resource consumption
 	// and will set the desired number of pods by using its Scale subresource.
 	ScaleTargetRef CrossVersionObjectReference `json:"scaleTargetRef" protobuf:"bytes,1,opt,name=scaleTargetRef"`
 	// minReplicas is the lower limit for the number of replicas to which the autoscaler
@@ -47,15 +49,15 @@ type HorizontalPodAutoscalerSpec struct {
 	// metric is configured.  Scaling is active as long as at least one metric value is
 	// available.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:ifEnabled(HPAScaleToZero)=+k8s:minimum=0
-	// +k8s:alpha(since: "1.36")=+k8s:ifDisabled(HPAScaleToZero)=+k8s:minimum=1
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:ifEnabled(HPAScaleToZero)=+k8s:minimum=0
+	// +k8s:beta(since: "1.37")=+k8s:ifDisabled(HPAScaleToZero)=+k8s:minimum=1
 	MinReplicas *int32 `json:"minReplicas,omitempty" protobuf:"varint,2,opt,name=minReplicas"`
 
 	// maxReplicas is the upper limit for the number of pods that can be set by the autoscaler; cannot be smaller than MinReplicas.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:minimum=1
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:minimum=1
 	MaxReplicas int32 `json:"maxReplicas" protobuf:"varint,3,opt,name=maxReplicas"`
 
 	// targetCPUUtilizationPercentage is the target average CPU utilization (represented as a percentage of requested CPU) over all the pods;
@@ -92,9 +94,10 @@ type HorizontalPodAutoscalerStatus struct {
 // +k8s:prerelease-lifecycle-gen:introduced=1.2
 
 // configuration of a horizontal pod autoscaler.
+// +k8s:supportsSubresource="/status"
 type HorizontalPodAutoscaler struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
@@ -112,7 +115,7 @@ type HorizontalPodAutoscaler struct {
 
 // list of horizontal pod autoscaler objects.
 type HorizontalPodAutoscalerList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -127,9 +130,10 @@ type HorizontalPodAutoscalerList struct {
 
 // Scale represents a scaling request for a resource.
 type Scale struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec defines the behavior of the scale. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
@@ -145,9 +149,9 @@ type Scale struct {
 type ScaleSpec struct {
 	// replicas is the desired number of instances for the scaled object.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +default=0
-	// +k8s:alpha(since: "1.36")=+k8s:minimum=0
+	// +k8s:beta(since: "1.37")=+k8s:minimum=0
 	Replicas int32 `json:"replicas,omitempty" protobuf:"varint,1,opt,name=replicas"`
 }
 
@@ -440,6 +444,12 @@ type HorizontalPodAutoscalerCondition struct {
 	// the transition
 	// +optional
 	Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
+
+	// observedGeneration represents the .metadata.generation that the condition was set based upon.
+	// For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+	// with respect to the current state of the instance.
+	// +optional
+	ObservedGeneration *int64 `json:"observedGeneration,omitempty" protobuf:"varint,6,opt,name=observedGeneration"`
 }
 
 // ObjectMetricStatus indicates the current value of a metric describing a
diff --git a/vendor/k8s.io/api/autoscaling/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/autoscaling/v1/types_swagger_doc_generated.go
index ba43d06c10..4132f42d68 100644
--- a/vendor/k8s.io/api/autoscaling/v1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/autoscaling/v1/types_swagger_doc_generated.go
@@ -88,7 +88,7 @@ func (ExternalMetricStatus) SwaggerDoc() map[string]string {
 
 var map_HorizontalPodAutoscaler = map[string]string{
 	"":         "configuration of a horizontal pod autoscaler.",
-	"metadata": "Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec defines the behaviour of autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.",
 	"status":   "status is the current information about the autoscaler.",
 }
@@ -104,6 +104,7 @@ var map_HorizontalPodAutoscalerCondition = map[string]string{
 	"lastTransitionTime": "lastTransitionTime is the last time the condition transitioned from one status to another",
 	"reason":             "reason is the reason for the condition's last transition.",
 	"message":            "message is a human-readable explanation containing details about the transition",
+	"observedGeneration": "observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.",
 }
 
 func (HorizontalPodAutoscalerCondition) SwaggerDoc() map[string]string {
@@ -122,7 +123,7 @@ func (HorizontalPodAutoscalerList) SwaggerDoc() map[string]string {
 
 var map_HorizontalPodAutoscalerSpec = map[string]string{
 	"":                               "specification of a horizontal pod autoscaler.",
-	"scaleTargetRef":                 "reference to scaled resource; horizontal pod autoscaler will learn the current resource consumption and will set the desired number of pods by using its Scale subresource.",
+	"scaleTargetRef":                 "scaleTargetRef is the reference to scaled resource; horizontal pod autoscaler will learn the current resource consumption and will set the desired number of pods by using its Scale subresource.",
 	"minReplicas":                    "minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down.  It defaults to 1 pod.  minReplicas is allowed to be 0 if the alpha feature gate HPAScaleToZero is enabled and at least one Object or External metric is configured.  Scaling is active as long as at least one metric value is available.",
 	"maxReplicas":                    "maxReplicas is the upper limit for the number of pods that can be set by the autoscaler; cannot be smaller than MinReplicas.",
 	"targetCPUUtilizationPercentage": "targetCPUUtilizationPercentage is the target average CPU utilization (represented as a percentage of requested CPU) over all the pods; if not specified the default autoscaling policy will be used.",
@@ -245,7 +246,7 @@ func (ResourceMetricStatus) SwaggerDoc() map[string]string {
 
 var map_Scale = map[string]string{
 	"":         "Scale represents a scaling request for a resource.",
-	"metadata": "Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
+	"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
 	"spec":     "spec defines the behavior of the scale. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.",
 	"status":   "status is the current status of the scale. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status. Read-only.",
 }
diff --git a/vendor/k8s.io/api/autoscaling/v1/zz_generated.deepcopy.go b/vendor/k8s.io/api/autoscaling/v1/zz_generated.deepcopy.go
index 603e6aa8cb..e0ad1668ce 100644
--- a/vendor/k8s.io/api/autoscaling/v1/zz_generated.deepcopy.go
+++ b/vendor/k8s.io/api/autoscaling/v1/zz_generated.deepcopy.go
@@ -180,6 +180,11 @@ func (in *HorizontalPodAutoscaler) DeepCopyObject() runtime.Object {
 func (in *HorizontalPodAutoscalerCondition) DeepCopyInto(out *HorizontalPodAutoscalerCondition) {
 	*out = *in
 	in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
+	if in.ObservedGeneration != nil {
+		in, out := &in.ObservedGeneration, &out.ObservedGeneration
+		*out = new(int64)
+		**out = **in
+	}
 	return
 }
 
diff --git a/vendor/k8s.io/api/autoscaling/v2/generated.pb.go b/vendor/k8s.io/api/autoscaling/v2/generated.pb.go
index 7505c7592f..0f663d46e3 100644
--- a/vendor/k8s.io/api/autoscaling/v2/generated.pb.go
+++ b/vendor/k8s.io/api/autoscaling/v2/generated.pb.go
@@ -506,6 +506,11 @@ func (m *HorizontalPodAutoscalerCondition) MarshalToSizedBuffer(dAtA []byte) (in
 	_ = i
 	var l int
 	_ = l
+	if m.ObservedGeneration != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.ObservedGeneration))
+		i--
+		dAtA[i] = 0x30
+	}
 	i -= len(m.Message)
 	copy(dAtA[i:], m.Message)
 	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message)))
@@ -1489,6 +1494,9 @@ func (m *HorizontalPodAutoscalerCondition) Size() (n int) {
 	n += 1 + l + sovGenerated(uint64(l))
 	l = len(m.Message)
 	n += 1 + l + sovGenerated(uint64(l))
+	if m.ObservedGeneration != nil {
+		n += 1 + sovGenerated(uint64(*m.ObservedGeneration))
+	}
 	return n
 }
 
@@ -1892,6 +1900,7 @@ func (this *HorizontalPodAutoscalerCondition) String() string {
 		`LastTransitionTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastTransitionTime), "Time", "v1.Time", 1), `&`, ``, 1) + `,`,
 		`Reason:` + fmt.Sprintf("%v", this.Reason) + `,`,
 		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`ObservedGeneration:` + valueToStringGenerated(this.ObservedGeneration) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -3524,6 +3533,26 @@ func (m *HorizontalPodAutoscalerCondition) Unmarshal(dAtA []byte) error {
 			}
 			m.Message = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObservedGeneration", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.ObservedGeneration = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
diff --git a/vendor/k8s.io/api/autoscaling/v2/generated.proto b/vendor/k8s.io/api/autoscaling/v2/generated.proto
index f56b8c749d..d9a31f941a 100644
--- a/vendor/k8s.io/api/autoscaling/v2/generated.proto
+++ b/vendor/k8s.io/api/autoscaling/v2/generated.proto
@@ -67,9 +67,11 @@ message ContainerResourceMetricStatus {
 // CrossVersionObjectReference contains enough information to let you identify the referred resource.
 message CrossVersionObjectReference {
   // kind is the kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +k8s:alpha(since: "1.37")=+k8s:required
   optional string kind = 1;
 
   // name is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+  // +k8s:alpha(since: "1.37")=+k8s:required
   optional string name = 2;
 
   // apiVersion is the API version of the referent
@@ -122,8 +124,7 @@ message HPAScalingPolicy {
 // window is chosen.
 //
 // The tolerance is applied to the metric values and prevents scaling too
-// eagerly for small metric variations. (Note that setting a tolerance requires
-// the beta HPAConfigurableTolerance feature gate to be enabled.)
+// eagerly for small metric variations.
 message HPAScalingRules {
   // stabilizationWindowSeconds is the number of seconds for which past recommendations should be
   // considered while scaling up or scaling down.
@@ -156,9 +157,6 @@ message HPAScalingRules {
   // and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be
   // triggered when the actual consumption falls below 95Mi or exceeds 101Mi.
   //
-  // This is an beta field and requires the HPAConfigurableTolerance feature
-  // gate to be enabled.
-  //
   // +featureGate=HPAConfigurableTolerance
   // +optional
   optional .k8s.io.apimachinery.pkg.api.resource.Quantity tolerance = 4;
@@ -167,6 +165,7 @@ message HPAScalingRules {
 // HorizontalPodAutoscaler is the configuration for a horizontal pod
 // autoscaler, which automatically manages the replica count of any resource
 // implementing the scale subresource based on the metrics specified.
+// +k8s:supportsSubresource="/status"
 message HorizontalPodAutoscaler {
   // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -224,6 +223,12 @@ message HorizontalPodAutoscalerCondition {
   // the transition
   // +optional
   optional string message = 5;
+
+  // observedGeneration represents the .metadata.generation that the condition was set based upon.
+  // For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+  // with respect to the current state of the instance.
+  // +optional
+  optional int64 observedGeneration = 6;
 }
 
 // HorizontalPodAutoscalerList is a list of horizontal pod autoscaler objects.
@@ -248,16 +253,16 @@ message HorizontalPodAutoscalerSpec {
   // metric is configured.  Scaling is active as long as at least one metric value is
   // available.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:ifEnabled(HPAScaleToZero)=+k8s:minimum=0
-  // +k8s:alpha(since: "1.36")=+k8s:ifDisabled(HPAScaleToZero)=+k8s:minimum=1
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:ifEnabled(HPAScaleToZero)=+k8s:minimum=0
+  // +k8s:beta(since: "1.37")=+k8s:ifDisabled(HPAScaleToZero)=+k8s:minimum=1
   optional int32 minReplicas = 2;
 
   // maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up.
   // It cannot be less that minReplicas.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:minimum=1
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:minimum=1
   optional int32 maxReplicas = 3;
 
   // metrics contains the specifications for which to use to calculate the
@@ -270,6 +275,7 @@ message HorizontalPodAutoscalerSpec {
   // If not set, the default metric will be set to 80% average CPU utilization.
   // +listType=atomic
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   repeated MetricSpec metrics = 4;
 
   // behavior configures the scaling behavior of the target
@@ -302,6 +308,7 @@ message HorizontalPodAutoscalerStatus {
   // currentMetrics is the last read state of the metrics used by this autoscaler.
   // +listType=atomic
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   repeated MetricStatus currentMetrics = 5;
 
   // conditions is the set of conditions required for this autoscaler to scale its target,
@@ -336,6 +343,8 @@ message MetricSpec {
   // object refers to a metric describing a single kubernetes object
   // (for example, hits-per-second on an Ingress object).
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:opaqueType
   optional ObjectMetricSource object = 2;
 
   // pods refers to a metric describing each pod in the current scale target
@@ -378,6 +387,8 @@ message MetricStatus {
   // object refers to a metric describing a single kubernetes object
   // (for example, hits-per-second on an Ingress object).
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:opaqueType
   optional ObjectMetricStatus object = 2;
 
   // pods refers to a metric describing each pod in the current scale target
@@ -394,7 +405,7 @@ message MetricStatus {
   // +optional
   optional ResourceMetricStatus resource = 4;
 
-  // container resource refers to a resource metric (such as those specified in
+  // containerResource refers to a resource metric (such as those specified in
   // requests and limits) known to Kubernetes describing a single container in each pod in the
   // current scale target (e.g. CPU or memory). Such metrics are built in to
   // Kubernetes, and have special scaling options on top of those available
@@ -444,7 +455,7 @@ message MetricValueStatus {
   // +optional
   optional .k8s.io.apimachinery.pkg.api.resource.Quantity averageValue = 2;
 
-  // currentAverageUtilization is the current value of the average of the
+  // averageUtilization is the current value of the average of the
   // resource metric across all relevant pods, represented as a percentage of
   // the requested value of the resource for the pods.
   // +optional
@@ -473,7 +484,7 @@ message ObjectMetricStatus {
   // current contains the current value for the given metric
   optional MetricValueStatus current = 2;
 
-  // DescribedObject specifies the descriptions of a object,such as kind,name apiVersion
+  // describedObject specifies the descriptions of a object,such as kind,name apiVersion
   optional CrossVersionObjectReference describedObject = 3;
 }
 
diff --git a/vendor/k8s.io/api/autoscaling/v2/types.go b/vendor/k8s.io/api/autoscaling/v2/types.go
index ad10169a01..49c9e751c2 100644
--- a/vendor/k8s.io/api/autoscaling/v2/types.go
+++ b/vendor/k8s.io/api/autoscaling/v2/types.go
@@ -31,8 +31,9 @@ import (
 // HorizontalPodAutoscaler is the configuration for a horizontal pod
 // autoscaler, which automatically manages the replica count of any resource
 // implementing the scale subresource based on the metrics specified.
+// +k8s:supportsSubresource="/status"
 type HorizontalPodAutoscaler struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -59,16 +60,16 @@ type HorizontalPodAutoscalerSpec struct {
 	// metric is configured.  Scaling is active as long as at least one metric value is
 	// available.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:ifEnabled(HPAScaleToZero)=+k8s:minimum=0
-	// +k8s:alpha(since: "1.36")=+k8s:ifDisabled(HPAScaleToZero)=+k8s:minimum=1
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:ifEnabled(HPAScaleToZero)=+k8s:minimum=0
+	// +k8s:beta(since: "1.37")=+k8s:ifDisabled(HPAScaleToZero)=+k8s:minimum=1
 	MinReplicas *int32 `json:"minReplicas,omitempty" protobuf:"varint,2,opt,name=minReplicas"`
 
 	// maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up.
 	// It cannot be less that minReplicas.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:minimum=1
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:minimum=1
 	MaxReplicas int32 `json:"maxReplicas" protobuf:"varint,3,opt,name=maxReplicas"`
 
 	// metrics contains the specifications for which to use to calculate the
@@ -81,6 +82,7 @@ type HorizontalPodAutoscalerSpec struct {
 	// If not set, the default metric will be set to 80% average CPU utilization.
 	// +listType=atomic
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	Metrics []MetricSpec `json:"metrics,omitempty" protobuf:"bytes,4,rep,name=metrics"`
 
 	// behavior configures the scaling behavior of the target
@@ -93,9 +95,11 @@ type HorizontalPodAutoscalerSpec struct {
 // CrossVersionObjectReference contains enough information to let you identify the referred resource.
 type CrossVersionObjectReference struct {
 	// kind is the kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +k8s:alpha(since: "1.37")=+k8s:required
 	Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"`
 
 	// name is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+	// +k8s:alpha(since: "1.37")=+k8s:required
 	Name string `json:"name" protobuf:"bytes,2,opt,name=name"`
 
 	// apiVersion is the API version of the referent
@@ -113,6 +117,8 @@ type MetricSpec struct {
 	// object refers to a metric describing a single kubernetes object
 	// (for example, hits-per-second on an Ingress object).
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:opaqueType
 	Object *ObjectMetricSource `json:"object,omitempty" protobuf:"bytes,2,opt,name=object"`
 
 	// pods refers to a metric describing each pod in the current scale target
@@ -187,8 +193,7 @@ const (
 // window is chosen.
 //
 // The tolerance is applied to the metric values and prevents scaling too
-// eagerly for small metric variations. (Note that setting a tolerance requires
-// the beta HPAConfigurableTolerance feature gate to be enabled.)
+// eagerly for small metric variations.
 type HPAScalingRules struct {
 	// stabilizationWindowSeconds is the number of seconds for which past recommendations should be
 	// considered while scaling up or scaling down.
@@ -221,9 +226,6 @@ type HPAScalingRules struct {
 	// and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be
 	// triggered when the actual consumption falls below 95Mi or exceeds 101Mi.
 	//
-	// This is an beta field and requires the HPAConfigurableTolerance feature
-	// gate to be enabled.
-	//
 	// +featureGate=HPAConfigurableTolerance
 	// +optional
 	Tolerance *resource.Quantity `json:"tolerance,omitempty" protobuf:"bytes,4,opt,name=tolerance"`
@@ -424,6 +426,7 @@ type HorizontalPodAutoscalerStatus struct {
 	// currentMetrics is the last read state of the metrics used by this autoscaler.
 	// +listType=atomic
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	CurrentMetrics []MetricStatus `json:"currentMetrics" protobuf:"bytes,5,rep,name=currentMetrics"`
 
 	// conditions is the set of conditions required for this autoscaler to scale its target,
@@ -476,6 +479,12 @@ type HorizontalPodAutoscalerCondition struct {
 	// the transition
 	// +optional
 	Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
+
+	// observedGeneration represents the .metadata.generation that the condition was set based upon.
+	// For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+	// with respect to the current state of the instance.
+	// +optional
+	ObservedGeneration *int64 `json:"observedGeneration,omitempty" protobuf:"varint,6,opt,name=observedGeneration"`
 }
 
 // MetricStatus describes the last-read state of a single metric.
@@ -487,6 +496,8 @@ type MetricStatus struct {
 	// object refers to a metric describing a single kubernetes object
 	// (for example, hits-per-second on an Ingress object).
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:opaqueType
 	Object *ObjectMetricStatus `json:"object,omitempty" protobuf:"bytes,2,opt,name=object"`
 
 	// pods refers to a metric describing each pod in the current scale target
@@ -503,7 +514,7 @@ type MetricStatus struct {
 	// +optional
 	Resource *ResourceMetricStatus `json:"resource,omitempty" protobuf:"bytes,4,opt,name=resource"`
 
-	// container resource refers to a resource metric (such as those specified in
+	// containerResource refers to a resource metric (such as those specified in
 	// requests and limits) known to Kubernetes describing a single container in each pod in the
 	// current scale target (e.g. CPU or memory). Such metrics are built in to
 	// Kubernetes, and have special scaling options on top of those available
@@ -529,7 +540,7 @@ type ObjectMetricStatus struct {
 	// current contains the current value for the given metric
 	Current MetricValueStatus `json:"current" protobuf:"bytes,2,name=current"`
 
-	// DescribedObject specifies the descriptions of a object,such as kind,name apiVersion
+	// describedObject specifies the descriptions of a object,such as kind,name apiVersion
 	DescribedObject CrossVersionObjectReference `json:"describedObject" protobuf:"bytes,3,name=describedObject"`
 }
 
@@ -593,7 +604,7 @@ type MetricValueStatus struct {
 	// +optional
 	AverageValue *resource.Quantity `json:"averageValue,omitempty" protobuf:"bytes,2,opt,name=averageValue"`
 
-	// currentAverageUtilization is the current value of the average of the
+	// averageUtilization is the current value of the average of the
 	// resource metric across all relevant pods, represented as a percentage of
 	// the requested value of the resource for the pods.
 	// +optional
@@ -605,7 +616,7 @@ type MetricValueStatus struct {
 
 // HorizontalPodAutoscalerList is a list of horizontal pod autoscaler objects.
 type HorizontalPodAutoscalerList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// metadata is the standard list metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
diff --git a/vendor/k8s.io/api/autoscaling/v2/types_swagger_doc_generated.go b/vendor/k8s.io/api/autoscaling/v2/types_swagger_doc_generated.go
index af3f3022da..de5a6b3897 100644
--- a/vendor/k8s.io/api/autoscaling/v2/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/autoscaling/v2/types_swagger_doc_generated.go
@@ -92,11 +92,11 @@ func (HPAScalingPolicy) SwaggerDoc() map[string]string {
 }
 
 var map_HPAScalingRules = map[string]string{
-	"":                           "HPAScalingRules configures the scaling behavior for one direction via scaling Policy Rules and a configurable metric tolerance.\n\nScaling Policy Rules are applied after calculating DesiredReplicas from metrics for the HPA. They can limit the scaling velocity by specifying scaling policies. They can prevent flapping by specifying the stabilization window, so that the number of replicas is not set instantly, instead, the safest value from the stabilization window is chosen.\n\nThe tolerance is applied to the metric values and prevents scaling too eagerly for small metric variations. (Note that setting a tolerance requires the beta HPAConfigurableTolerance feature gate to be enabled.)",
+	"":                           "HPAScalingRules configures the scaling behavior for one direction via scaling Policy Rules and a configurable metric tolerance.\n\nScaling Policy Rules are applied after calculating DesiredReplicas from metrics for the HPA. They can limit the scaling velocity by specifying scaling policies. They can prevent flapping by specifying the stabilization window, so that the number of replicas is not set instantly, instead, the safest value from the stabilization window is chosen.\n\nThe tolerance is applied to the metric values and prevents scaling too eagerly for small metric variations.",
 	"stabilizationWindowSeconds": "stabilizationWindowSeconds is the number of seconds for which past recommendations should be considered while scaling up or scaling down. StabilizationWindowSeconds must be greater than or equal to zero and less than or equal to 3600 (one hour). If not set, use the default values: - For scale up: 0 (i.e. no stabilization is done). - For scale down: 300 (i.e. the stabilization window is 300 seconds long).",
 	"selectPolicy":               "selectPolicy is used to specify which policy should be used. If not set, the default value Max is used.",
 	"policies":                   "policies is a list of potential scaling polices which can be used during scaling. If not set, use the default values: - For scale up: allow doubling the number of pods, or an absolute change of 4 pods in a 15s window. - For scale down: allow all pods to be removed in a 15s window.",
-	"tolerance":                  "tolerance is the tolerance on the ratio between the current and desired metric value under which no updates are made to the desired number of replicas (e.g. 0.01 for 1%). Must be greater than or equal to zero. If not set, the default cluster-wide tolerance is applied (by default 10%).\n\nFor example, if autoscaling is configured with a memory consumption target of 100Mi, and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be triggered when the actual consumption falls below 95Mi or exceeds 101Mi.\n\nThis is an beta field and requires the HPAConfigurableTolerance feature gate to be enabled.",
+	"tolerance":                  "tolerance is the tolerance on the ratio between the current and desired metric value under which no updates are made to the desired number of replicas (e.g. 0.01 for 1%). Must be greater than or equal to zero. If not set, the default cluster-wide tolerance is applied (by default 10%).\n\nFor example, if autoscaling is configured with a memory consumption target of 100Mi, and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be triggered when the actual consumption falls below 95Mi or exceeds 101Mi.",
 }
 
 func (HPAScalingRules) SwaggerDoc() map[string]string {
@@ -131,6 +131,7 @@ var map_HorizontalPodAutoscalerCondition = map[string]string{
 	"lastTransitionTime": "lastTransitionTime is the last time the condition transitioned from one status to another",
 	"reason":             "reason is the reason for the condition's last transition.",
 	"message":            "message is a human-readable explanation containing details about the transition",
+	"observedGeneration": "observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.",
 }
 
 func (HorizontalPodAutoscalerCondition) SwaggerDoc() map[string]string {
@@ -204,7 +205,7 @@ var map_MetricStatus = map[string]string{
 	"object":            "object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object).",
 	"pods":              "pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second).  The values will be averaged together before being compared to the target value.",
 	"resource":          "resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.",
-	"containerResource": "container resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.",
+	"containerResource": "containerResource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.",
 	"external":          "external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).",
 }
 
@@ -228,7 +229,7 @@ var map_MetricValueStatus = map[string]string{
 	"":                   "MetricValueStatus holds the current value for a metric",
 	"value":              "value is the current value of the metric (as a quantity).",
 	"averageValue":       "averageValue is the current value of the average of the metric across all relevant pods (as a quantity)",
-	"averageUtilization": "currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods.",
+	"averageUtilization": "averageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods.",
 }
 
 func (MetricValueStatus) SwaggerDoc() map[string]string {
@@ -250,7 +251,7 @@ var map_ObjectMetricStatus = map[string]string{
 	"":                "ObjectMetricStatus indicates the current value of a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).",
 	"metric":          "metric identifies the target metric by name and selector",
 	"current":         "current contains the current value for the given metric",
-	"describedObject": "DescribedObject specifies the descriptions of a object,such as kind,name apiVersion",
+	"describedObject": "describedObject specifies the descriptions of a object,such as kind,name apiVersion",
 }
 
 func (ObjectMetricStatus) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/autoscaling/v2/zz_generated.deepcopy.go b/vendor/k8s.io/api/autoscaling/v2/zz_generated.deepcopy.go
index 5fbcf9f807..ace4fa2fd3 100644
--- a/vendor/k8s.io/api/autoscaling/v2/zz_generated.deepcopy.go
+++ b/vendor/k8s.io/api/autoscaling/v2/zz_generated.deepcopy.go
@@ -222,6 +222,11 @@ func (in *HorizontalPodAutoscalerBehavior) DeepCopy() *HorizontalPodAutoscalerBe
 func (in *HorizontalPodAutoscalerCondition) DeepCopyInto(out *HorizontalPodAutoscalerCondition) {
 	*out = *in
 	in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
+	if in.ObservedGeneration != nil {
+		in, out := &in.ObservedGeneration, &out.ObservedGeneration
+		*out = new(int64)
+		**out = **in
+	}
 	return
 }
 
diff --git a/vendor/k8s.io/api/batch/v1/generated.pb.go b/vendor/k8s.io/api/batch/v1/generated.pb.go
index 099350e734..7c086a41c2 100644
--- a/vendor/k8s.io/api/batch/v1/generated.pb.go
+++ b/vendor/k8s.io/api/batch/v1/generated.pb.go
@@ -26,6 +26,7 @@ import (
 
 	k8s_io_api_core_v1 "k8s.io/api/core/v1"
 	v11 "k8s.io/api/core/v1"
+	v1alpha3 "k8s.io/api/scheduling/v1alpha3"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	math_bits "math/bits"
@@ -49,6 +50,8 @@ func (m *JobCondition) Reset() { *m = JobCondition{} }
 
 func (m *JobList) Reset() { *m = JobList{} }
 
+func (m *JobSchedulingConfiguration) Reset() { *m = JobSchedulingConfiguration{} }
+
 func (m *JobSpec) Reset() { *m = JobSpec{} }
 
 func (m *JobStatus) Reset() { *m = JobStatus{} }
@@ -472,6 +475,79 @@ func (m *JobList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *JobSchedulingConfiguration) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *JobSchedulingConfiguration) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *JobSchedulingConfiguration) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.ResourceClaims) > 0 {
+		for iNdEx := len(m.ResourceClaims) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ResourceClaims[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x22
+		}
+	}
+	if m.DisruptionMode != nil {
+		{
+			size, err := m.DisruptionMode.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.SchedulingConstraints != nil {
+		{
+			size, err := m.SchedulingConstraints.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.SchedulingPolicy != nil {
+		{
+			size, err := m.SchedulingPolicy.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *JobSpec) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -492,6 +568,20 @@ func (m *JobSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.Scheduling != nil {
+		{
+			size, err := m.Scheduling.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x8a
+	}
 	if m.SuccessPolicy != nil {
 		{
 			size, err := m.SuccessPolicy.MarshalToSizedBuffer(dAtA[:i])
@@ -1195,6 +1285,33 @@ func (m *JobList) Size() (n int) {
 	return n
 }
 
+func (m *JobSchedulingConfiguration) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.SchedulingPolicy != nil {
+		l = m.SchedulingPolicy.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.SchedulingConstraints != nil {
+		l = m.SchedulingConstraints.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.DisruptionMode != nil {
+		l = m.DisruptionMode.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.ResourceClaims) > 0 {
+		for _, e := range m.ResourceClaims {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
 func (m *JobSpec) Size() (n int) {
 	if m == nil {
 		return 0
@@ -1254,6 +1371,10 @@ func (m *JobSpec) Size() (n int) {
 		l = m.SuccessPolicy.Size()
 		n += 2 + l + sovGenerated(uint64(l))
 	}
+	if m.Scheduling != nil {
+		l = m.Scheduling.Size()
+		n += 2 + l + sovGenerated(uint64(l))
+	}
 	return n
 }
 
@@ -1544,6 +1665,24 @@ func (this *JobList) String() string {
 	}, "")
 	return s
 }
+func (this *JobSchedulingConfiguration) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForResourceClaims := "[]WorkloadPodGroupResourceClaim{"
+	for _, f := range this.ResourceClaims {
+		repeatedStringForResourceClaims += fmt.Sprintf("%v", f) + ","
+	}
+	repeatedStringForResourceClaims += "}"
+	s := strings.Join([]string{`&JobSchedulingConfiguration{`,
+		`SchedulingPolicy:` + strings.Replace(fmt.Sprintf("%v", this.SchedulingPolicy), "WorkloadPodGroupSchedulingPolicy", "v1alpha3.WorkloadPodGroupSchedulingPolicy", 1) + `,`,
+		`SchedulingConstraints:` + strings.Replace(fmt.Sprintf("%v", this.SchedulingConstraints), "WorkloadPodGroupSchedulingConstraints", "v1alpha3.WorkloadPodGroupSchedulingConstraints", 1) + `,`,
+		`DisruptionMode:` + strings.Replace(fmt.Sprintf("%v", this.DisruptionMode), "WorkloadPodGroupDisruptionMode", "v1alpha3.WorkloadPodGroupDisruptionMode", 1) + `,`,
+		`ResourceClaims:` + repeatedStringForResourceClaims + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func (this *JobSpec) String() string {
 	if this == nil {
 		return "nil"
@@ -1565,6 +1704,7 @@ func (this *JobSpec) String() string {
 		`PodReplacementPolicy:` + valueToStringGenerated(this.PodReplacementPolicy) + `,`,
 		`ManagedBy:` + valueToStringGenerated(this.ManagedBy) + `,`,
 		`SuccessPolicy:` + strings.Replace(this.SuccessPolicy.String(), "SuccessPolicy", "SuccessPolicy", 1) + `,`,
+		`Scheduling:` + strings.Replace(this.Scheduling.String(), "JobSchedulingConfiguration", "JobSchedulingConfiguration", 1) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -2898,6 +3038,198 @@ func (m *JobList) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *JobSchedulingConfiguration) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: JobSchedulingConfiguration: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: JobSchedulingConfiguration: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingPolicy", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SchedulingPolicy == nil {
+				m.SchedulingPolicy = &v1alpha3.WorkloadPodGroupSchedulingPolicy{}
+			}
+			if err := m.SchedulingPolicy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingConstraints", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SchedulingConstraints == nil {
+				m.SchedulingConstraints = &v1alpha3.WorkloadPodGroupSchedulingConstraints{}
+			}
+			if err := m.SchedulingConstraints.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DisruptionMode", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.DisruptionMode == nil {
+				m.DisruptionMode = &v1alpha3.WorkloadPodGroupDisruptionMode{}
+			}
+			if err := m.DisruptionMode.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaims", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceClaims = append(m.ResourceClaims, v1alpha3.WorkloadPodGroupResourceClaim{})
+			if err := m.ResourceClaims[len(m.ResourceClaims)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *JobSpec) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -3349,6 +3681,42 @@ func (m *JobSpec) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 17:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Scheduling", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Scheduling == nil {
+				m.Scheduling = &JobSchedulingConfiguration{}
+			}
+			if err := m.Scheduling.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
diff --git a/vendor/k8s.io/api/batch/v1/generated.proto b/vendor/k8s.io/api/batch/v1/generated.proto
index 5c35012852..da24d6d939 100644
--- a/vendor/k8s.io/api/batch/v1/generated.proto
+++ b/vendor/k8s.io/api/batch/v1/generated.proto
@@ -22,6 +22,7 @@ syntax = "proto2";
 package k8s.io.api.batch.v1;
 
 import "k8s.io/api/core/v1/generated.proto";
+import "k8s.io/api/scheduling/v1alpha3/generated.proto";
 import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
 import "k8s.io/apimachinery/pkg/runtime/generated.proto";
 import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
@@ -30,6 +31,7 @@ import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
 option go_package = "k8s.io/api/batch/v1";
 
 // CronJob represents the configuration of a single cron job.
+// +k8s:supportsSubresource="/status"
 message CronJob {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -62,7 +64,7 @@ message CronJobList {
 message CronJobSpec {
   // The schedule in Cron format, see https://en.wikipedia.org/wiki/Cron.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string schedule = 1;
 
   // The time zone name for the given schedule, see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones.
@@ -127,6 +129,7 @@ message CronJobStatus {
 }
 
 // Job represents the configuration of a single job.
+// +k8s:supportsSubresource="/status"
 message Job {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -180,6 +183,62 @@ message JobList {
   repeated Job items = 2;
 }
 
+// JobSchedulingConfiguration composes the reusable workload-aware
+// scheduling building blocks.
+message JobSchedulingConfiguration {
+  // SchedulingPolicy defines the scheduling policy for this Job.
+  // Exactly one of Basic or Gang must be set.
+  // This field is immutable after creation: the policy may not be added or
+  // removed. The policy variant (basic/gang) is frozen by hand-written
+  // validation; only schedulingPolicy.gang.minCount may be changed.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:update=NoSet
+  // +k8s:update=NoUnset
+  optional .k8s.io.api.scheduling.v1alpha3.WorkloadPodGroupSchedulingPolicy schedulingPolicy = 1;
+
+  // SchedulingConstraints defines scheduling constraints (e.g. topology)
+  // for the Job's pods.
+  // This field is immutable after creation.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional .k8s.io.api.scheduling.v1alpha3.WorkloadPodGroupSchedulingConstraints schedulingConstraints = 2;
+
+  // DisruptionMode defines the mode in which the Job's pods can be disrupted.
+  // One of Single, All.
+  // This field is immutable after creation: it may not be added or removed,
+  // and the selected mode may not be changed.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional .k8s.io.api.scheduling.v1alpha3.WorkloadPodGroupDisruptionMode disruptionMode = 3;
+
+  // ResourceClaims defines which ResourceClaims may be shared among Pods in
+  // the Job. Pods consume the devices allocated to a PodGroup's claim by
+  // defining a claim in its own Spec.ResourceClaims that matches the
+  // PodGroup's claim exactly. The claim must have the same name and refer to
+  // the same ResourceClaim or ResourceClaimTemplate.
+  // At most 4 claims may be set, matching the limit on the resulting PodGroup.
+  // This list is immutable after creation: entries may neither be added,
+  // removed, nor modified.
+  //
+  // +optional
+  // +patchMergeKey=name
+  // +patchStrategy=merge
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=4
+  // +k8s:immutable
+  repeated .k8s.io.api.scheduling.v1alpha3.WorkloadPodGroupResourceClaim resourceClaims = 4;
+}
+
 // JobSpec describes how the job execution will look like.
 message JobSpec {
   // Specifies the maximum desired number of pods the job should
@@ -251,6 +310,8 @@ message JobSpec {
   // It can be null or up to completions. It is required and must be
   // less than or equal to 10^4 when is completions greater than 10^5.
   // +optional
+  // +k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:dependentRequired("backoffLimitPerIndex")
   optional int32 maxFailedIndexes = 13;
 
   // A label query over pods that should match the pod count.
@@ -346,6 +407,23 @@ message JobSpec {
   // This field is immutable.
   // +optional
   optional string managedBy = 15;
+
+  // scheduling defines the Workload-aware Scheduling configuration for this Job.
+  // When set, it specifies the scheduling policy (basic or gang), topology
+  // constraints, disruption mode, and shared resource claims.
+  // When omitted, the Job defaults to the basic scheduling policy, which behaves
+  // as standard pod-by-pod scheduling.
+  // This field is alpha-level and requires the WorkloadWithJob feature gate.
+  // This field is immutable, including whether it is set at all, only
+  // policy.gang.minCount may be changed after creation.
+  //
+  // +featureGate=WorkloadWithJob
+  // +optional
+  // +k8s:ifDisabled(WorkloadWithJob)=+k8s:forbidden
+  // +k8s:optional
+  // +k8s:update=NoSet
+  // +k8s:update=NoUnset
+  optional JobSchedulingConfiguration scheduling = 17;
 }
 
 // JobStatus represents the current state of a Job.
@@ -408,9 +486,6 @@ message JobStatus {
 
   // The number of pods which are terminating (in phase Pending or Running
   // and have a deletionTimestamp).
-  //
-  // This field is beta-level. The job controller populates the field when
-  // the feature gate JobPodReplacementPolicy is enabled (enabled by default).
   // +optional
   optional int32 terminating = 11;
 
@@ -465,6 +540,7 @@ message JobTemplateSpec {
   // Standard object's metadata of the jobs created from this template.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Specification of the desired behavior of the job.
diff --git a/vendor/k8s.io/api/batch/v1/types.go b/vendor/k8s.io/api/batch/v1/types.go
index d4894e2ef6..8e35cb228f 100644
--- a/vendor/k8s.io/api/batch/v1/types.go
+++ b/vendor/k8s.io/api/batch/v1/types.go
@@ -18,6 +18,7 @@ package v1
 
 import (
 	corev1 "k8s.io/api/core/v1"
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 )
@@ -66,8 +67,9 @@ const (
 // +k8s:prerelease-lifecycle-gen:introduced=1.2
 
 // Job represents the configuration of a single job.
+// +k8s:supportsSubresource="/status"
 type Job struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -89,7 +91,7 @@ type Job struct {
 
 // JobList is a collection of jobs.
 type JobList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -371,6 +373,8 @@ type JobSpec struct {
 	// It can be null or up to completions. It is required and must be
 	// less than or equal to 10^4 when is completions greater than 10^5.
 	// +optional
+	// +k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:dependentRequired("backoffLimitPerIndex")
 	MaxFailedIndexes *int32 `json:"maxFailedIndexes,omitempty" protobuf:"varint,13,opt,name=maxFailedIndexes"`
 
 	// TODO enabled it when https://github.com/kubernetes/kubernetes/issues/28486 has been fixed
@@ -471,6 +475,79 @@ type JobSpec struct {
 	// This field is immutable.
 	// +optional
 	ManagedBy *string `json:"managedBy,omitempty" protobuf:"bytes,15,opt,name=managedBy"`
+
+	// scheduling defines the Workload-aware Scheduling configuration for this Job.
+	// When set, it specifies the scheduling policy (basic or gang), topology
+	// constraints, disruption mode, and shared resource claims.
+	// When omitted, the Job defaults to the basic scheduling policy, which behaves
+	// as standard pod-by-pod scheduling.
+	// This field is alpha-level and requires the WorkloadWithJob feature gate.
+	// This field is immutable, including whether it is set at all, only
+	// policy.gang.minCount may be changed after creation.
+	//
+	// +featureGate=WorkloadWithJob
+	// +optional
+	// +k8s:ifDisabled(WorkloadWithJob)=+k8s:forbidden
+	// +k8s:optional
+	// +k8s:update=NoSet
+	// +k8s:update=NoUnset
+	Scheduling *JobSchedulingConfiguration `json:"scheduling,omitempty" protobuf:"bytes,17,opt,name=scheduling"`
+}
+
+// JobSchedulingConfiguration composes the reusable workload-aware
+// scheduling building blocks.
+type JobSchedulingConfiguration struct {
+	// SchedulingPolicy defines the scheduling policy for this Job.
+	// Exactly one of Basic or Gang must be set.
+	// This field is immutable after creation: the policy may not be added or
+	// removed. The policy variant (basic/gang) is frozen by hand-written
+	// validation; only schedulingPolicy.gang.minCount may be changed.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:update=NoSet
+	// +k8s:update=NoUnset
+	SchedulingPolicy *schedulingv1alpha3.WorkloadPodGroupSchedulingPolicy `json:"schedulingPolicy,omitempty" protobuf:"bytes,1,opt,name=schedulingPolicy"`
+
+	// SchedulingConstraints defines scheduling constraints (e.g. topology)
+	// for the Job's pods.
+	// This field is immutable after creation.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	SchedulingConstraints *schedulingv1alpha3.WorkloadPodGroupSchedulingConstraints `json:"schedulingConstraints,omitempty" protobuf:"bytes,2,opt,name=schedulingConstraints"`
+
+	// DisruptionMode defines the mode in which the Job's pods can be disrupted.
+	// One of Single, All.
+	// This field is immutable after creation: it may not be added or removed,
+	// and the selected mode may not be changed.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	DisruptionMode *schedulingv1alpha3.WorkloadPodGroupDisruptionMode `json:"disruptionMode,omitempty" protobuf:"bytes,3,opt,name=disruptionMode"`
+
+	// ResourceClaims defines which ResourceClaims may be shared among Pods in
+	// the Job. Pods consume the devices allocated to a PodGroup's claim by
+	// defining a claim in its own Spec.ResourceClaims that matches the
+	// PodGroup's claim exactly. The claim must have the same name and refer to
+	// the same ResourceClaim or ResourceClaimTemplate.
+	// At most 4 claims may be set, matching the limit on the resulting PodGroup.
+	// This list is immutable after creation: entries may neither be added,
+	// removed, nor modified.
+	//
+	// +optional
+	// +patchMergeKey=name
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=4
+	// +k8s:immutable
+	ResourceClaims []schedulingv1alpha3.WorkloadPodGroupResourceClaim `json:"resourceClaims,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,4,rep,name=resourceClaims"`
 }
 
 // JobStatus represents the current state of a Job.
@@ -533,9 +610,6 @@ type JobStatus struct {
 
 	// The number of pods which are terminating (in phase Pending or Running
 	// and have a deletionTimestamp).
-	//
-	// This field is beta-level. The job controller populates the field when
-	// the feature gate JobPodReplacementPolicy is enabled (enabled by default).
 	// +optional
 	Terminating *int32 `json:"terminating,omitempty" protobuf:"varint,11,opt,name=terminating"`
 
@@ -626,10 +700,8 @@ const (
 	// JobReasponDeadlineExceeded means job duration is past ActiveDeadline
 	JobReasonDeadlineExceeded string = "DeadlineExceeded"
 	// JobReasonMaxFailedIndexesExceeded indicates that an indexed of a job failed
-	// This const is used in beta-level feature: https://kep.k8s.io/3850.
 	JobReasonMaxFailedIndexesExceeded string = "MaxFailedIndexesExceeded"
 	// JobReasonFailedIndexes means Job has failed indexes.
-	// This const is used in beta-level feature: https://kep.k8s.io/3850.
 	JobReasonFailedIndexes string = "FailedIndexes"
 	// JobReasonSuccessPolicy reason indicates a SuccessCriteriaMet condition is added due to
 	// a Job met successPolicy.
@@ -664,6 +736,7 @@ type JobTemplateSpec struct {
 	// Standard object's metadata of the jobs created from this template.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Specification of the desired behavior of the job.
@@ -677,8 +750,9 @@ type JobTemplateSpec struct {
 // +k8s:prerelease-lifecycle-gen:introduced=1.21
 
 // CronJob represents the configuration of a single cron job.
+// +k8s:supportsSubresource="/status"
 type CronJob struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -700,7 +774,7 @@ type CronJob struct {
 
 // CronJobList is a collection of cron jobs.
 type CronJobList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -716,7 +790,7 @@ type CronJobSpec struct {
 
 	// The schedule in Cron format, see https://en.wikipedia.org/wiki/Cron.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Schedule string `json:"schedule" protobuf:"bytes,1,opt,name=schedule"`
 
 	// The time zone name for the given schedule, see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones.
diff --git a/vendor/k8s.io/api/batch/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/batch/v1/types_swagger_doc_generated.go
index 267df42926..ddf64555a4 100644
--- a/vendor/k8s.io/api/batch/v1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/batch/v1/types_swagger_doc_generated.go
@@ -110,6 +110,18 @@ func (JobList) SwaggerDoc() map[string]string {
 	return map_JobList
 }
 
+var map_JobSchedulingConfiguration = map[string]string{
+	"":                      "JobSchedulingConfiguration composes the reusable workload-aware scheduling building blocks.",
+	"schedulingPolicy":      "SchedulingPolicy defines the scheduling policy for this Job. Exactly one of Basic or Gang must be set. This field is immutable after creation: the policy may not be added or removed. The policy variant (basic/gang) is frozen by hand-written validation; only schedulingPolicy.gang.minCount may be changed.",
+	"schedulingConstraints": "SchedulingConstraints defines scheduling constraints (e.g. topology) for the Job's pods. This field is immutable after creation.",
+	"disruptionMode":        "DisruptionMode defines the mode in which the Job's pods can be disrupted. One of Single, All. This field is immutable after creation: it may not be added or removed, and the selected mode may not be changed.",
+	"resourceClaims":        "ResourceClaims defines which ResourceClaims may be shared among Pods in the Job. Pods consume the devices allocated to a PodGroup's claim by defining a claim in its own Spec.ResourceClaims that matches the PodGroup's claim exactly. The claim must have the same name and refer to the same ResourceClaim or ResourceClaimTemplate. At most 4 claims may be set, matching the limit on the resulting PodGroup. This list is immutable after creation: entries may neither be added, removed, nor modified.",
+}
+
+func (JobSchedulingConfiguration) SwaggerDoc() map[string]string {
+	return map_JobSchedulingConfiguration
+}
+
 var map_JobSpec = map[string]string{
 	"":                        "JobSpec describes how the job execution will look like.",
 	"parallelism":             "Specifies the maximum desired number of pods the job should run at any given time. The actual number of pods running in steady state will be less than this number when ((.spec.completions - .status.successful) < .spec.parallelism), i.e. when the work left to do is less than max parallelism. More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/",
@@ -128,6 +140,7 @@ var map_JobSpec = map[string]string{
 	"suspend":                 "suspend specifies whether the Job controller should create Pods or not. If a Job is created with suspend set to true, no Pods are created by the Job controller. If a Job is suspended after creation (i.e. the flag goes from false to true), the Job controller will delete all active Pods associated with this Job. Users must design their workload to gracefully handle this. Suspending a Job will reset the StartTime field of the Job, effectively resetting the ActiveDeadlineSeconds timer too. Defaults to false.",
 	"podReplacementPolicy":    "podReplacementPolicy specifies when to create replacement Pods. Possible values are: - TerminatingOrFailed means that we recreate pods\n  when they are terminating (has a metadata.deletionTimestamp) or failed.\n- Failed means to wait until a previously created Pod is fully terminated (has phase\n  Failed or Succeeded) before creating a replacement Pod.\n\nWhen using podFailurePolicy, Failed is the the only allowed value. TerminatingOrFailed and Failed are allowed values when podFailurePolicy is not in use.",
 	"managedBy":               "ManagedBy field indicates the controller that manages a Job. The k8s Job controller reconciles jobs which don't have this field at all or the field value is the reserved string `kubernetes.io/job-controller`, but skips reconciling Jobs with a custom value for this field. The value must be a valid domain-prefixed path (e.g. acme.io/foo) - all characters before the first \"/\" must be a valid subdomain as defined by RFC 1123. All characters trailing the first \"/\" must be valid HTTP Path characters as defined by RFC 3986. The value cannot exceed 63 characters. This field is immutable.",
+	"scheduling":              "scheduling defines the Workload-aware Scheduling configuration for this Job. When set, it specifies the scheduling policy (basic or gang), topology constraints, disruption mode, and shared resource claims. When omitted, the Job defaults to the basic scheduling policy, which behaves as standard pod-by-pod scheduling. This field is alpha-level and requires the WorkloadWithJob feature gate. This field is immutable, including whether it is set at all, only policy.gang.minCount may be changed after creation.",
 }
 
 func (JobSpec) SwaggerDoc() map[string]string {
@@ -142,7 +155,7 @@ var map_JobStatus = map[string]string{
 	"active":                  "The number of pending and running pods which are not terminating (without a deletionTimestamp). The value is zero for finished jobs.",
 	"succeeded":               "The number of pods which reached phase Succeeded. The value increases monotonically for a given spec. However, it may decrease in reaction to scale down of elastic indexed jobs.",
 	"failed":                  "The number of pods which reached phase Failed. The value increases monotonically.",
-	"terminating":             "The number of pods which are terminating (in phase Pending or Running and have a deletionTimestamp).\n\nThis field is beta-level. The job controller populates the field when the feature gate JobPodReplacementPolicy is enabled (enabled by default).",
+	"terminating":             "The number of pods which are terminating (in phase Pending or Running and have a deletionTimestamp).",
 	"completedIndexes":        "completedIndexes holds the completed indexes when .spec.completionMode = \"Indexed\" in a text format. The indexes are represented as decimal integers separated by commas. The numbers are listed in increasing order. Three or more consecutive numbers are compressed and represented by the first and last element of the series, separated by a hyphen. For example, if the completed indexes are 1, 3, 4, 5 and 7, they are represented as \"1,3-5,7\".",
 	"failedIndexes":           "FailedIndexes holds the failed indexes when spec.backoffLimitPerIndex is set. The indexes are represented in the text format analogous as for the `completedIndexes` field, ie. they are kept as decimal integers separated by commas. The numbers are listed in increasing order. Three or more consecutive numbers are compressed and represented by the first and last element of the series, separated by a hyphen. For example, if the failed indexes are 1, 3, 4, 5 and 7, they are represented as \"1,3-5,7\". The set of failed indexes cannot overlap with the set of completed indexes.",
 	"uncountedTerminatedPods": "uncountedTerminatedPods holds the UIDs of Pods that have terminated but the job controller hasn't yet accounted for in the status counters.\n\nThe job controller creates pods with a finalizer. When a pod terminates (succeeded or failed), the controller does three steps to account for it in the job status:\n\n1. Add the pod UID to the arrays in this field. 2. Remove the pod finalizer. 3. Remove the pod UID from the arrays while increasing the corresponding\n    counter.\n\nOld jobs might not be tracked using this field, in which case the field remains null. The structure is empty for finished jobs.",
diff --git a/vendor/k8s.io/api/batch/v1/zz_generated.deepcopy.go b/vendor/k8s.io/api/batch/v1/zz_generated.deepcopy.go
index 88c58b3d11..50d47596f4 100644
--- a/vendor/k8s.io/api/batch/v1/zz_generated.deepcopy.go
+++ b/vendor/k8s.io/api/batch/v1/zz_generated.deepcopy.go
@@ -23,6 +23,7 @@ package v1
 
 import (
 	corev1 "k8s.io/api/core/v1"
+	v1alpha3 "k8s.io/api/scheduling/v1alpha3"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	types "k8s.io/apimachinery/pkg/types"
@@ -239,6 +240,44 @@ func (in *JobList) DeepCopyObject() runtime.Object {
 	return nil
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *JobSchedulingConfiguration) DeepCopyInto(out *JobSchedulingConfiguration) {
+	*out = *in
+	if in.SchedulingPolicy != nil {
+		in, out := &in.SchedulingPolicy, &out.SchedulingPolicy
+		*out = new(v1alpha3.WorkloadPodGroupSchedulingPolicy)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.SchedulingConstraints != nil {
+		in, out := &in.SchedulingConstraints, &out.SchedulingConstraints
+		*out = new(v1alpha3.WorkloadPodGroupSchedulingConstraints)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.DisruptionMode != nil {
+		in, out := &in.DisruptionMode, &out.DisruptionMode
+		*out = new(v1alpha3.WorkloadPodGroupDisruptionMode)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ResourceClaims != nil {
+		in, out := &in.ResourceClaims, &out.ResourceClaims
+		*out = make([]v1alpha3.WorkloadPodGroupResourceClaim, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JobSchedulingConfiguration.
+func (in *JobSchedulingConfiguration) DeepCopy() *JobSchedulingConfiguration {
+	if in == nil {
+		return nil
+	}
+	out := new(JobSchedulingConfiguration)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *JobSpec) DeepCopyInto(out *JobSpec) {
 	*out = *in
@@ -318,6 +357,11 @@ func (in *JobSpec) DeepCopyInto(out *JobSpec) {
 		*out = new(string)
 		**out = **in
 	}
+	if in.Scheduling != nil {
+		in, out := &in.Scheduling, &out.Scheduling
+		*out = new(JobSchedulingConfiguration)
+		(*in).DeepCopyInto(*out)
+	}
 	return
 }
 
diff --git a/vendor/k8s.io/api/batch/v1/zz_generated.model_name.go b/vendor/k8s.io/api/batch/v1/zz_generated.model_name.go
index c5b86f29cd..d7305143a7 100644
--- a/vendor/k8s.io/api/batch/v1/zz_generated.model_name.go
+++ b/vendor/k8s.io/api/batch/v1/zz_generated.model_name.go
@@ -56,6 +56,11 @@ func (in JobList) OpenAPIModelName() string {
 	return "io.k8s.api.batch.v1.JobList"
 }
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in JobSchedulingConfiguration) OpenAPIModelName() string {
+	return "io.k8s.api.batch.v1.JobSchedulingConfiguration"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in JobSpec) OpenAPIModelName() string {
 	return "io.k8s.api.batch.v1.JobSpec"
diff --git a/vendor/k8s.io/api/batch/v1beta1/generated.proto b/vendor/k8s.io/api/batch/v1beta1/generated.proto
index 47000470c6..411d681d0a 100644
--- a/vendor/k8s.io/api/batch/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/batch/v1beta1/generated.proto
@@ -31,6 +31,7 @@ import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
 option go_package = "k8s.io/api/batch/v1beta1";
 
 // CronJob represents the configuration of a single cron job.
+// +k8s:supportsSubresource="/status"
 message CronJob {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -63,7 +64,7 @@ message CronJobList {
 message CronJobSpec {
   // The schedule in Cron format, see https://en.wikipedia.org/wiki/Cron.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string schedule = 1;
 
   // The time zone name for the given schedule, see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones.
@@ -134,6 +135,7 @@ message JobTemplateSpec {
   // Standard object's metadata of the jobs created from this template.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Specification of the desired behavior of the job.
diff --git a/vendor/k8s.io/api/batch/v1beta1/types.go b/vendor/k8s.io/api/batch/v1beta1/types.go
index 9e1a1b4704..dea910b828 100644
--- a/vendor/k8s.io/api/batch/v1beta1/types.go
+++ b/vendor/k8s.io/api/batch/v1beta1/types.go
@@ -27,6 +27,7 @@ type JobTemplateSpec struct {
 	// Standard object's metadata of the jobs created from this template.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Specification of the desired behavior of the job.
@@ -43,8 +44,9 @@ type JobTemplateSpec struct {
 // +k8s:prerelease-lifecycle-gen:replacement=batch,v1,CronJob
 
 // CronJob represents the configuration of a single cron job.
+// +k8s:supportsSubresource="/status"
 type CronJob struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -69,7 +71,7 @@ type CronJob struct {
 
 // CronJobList is a collection of cron jobs.
 type CronJobList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -85,7 +87,7 @@ type CronJobSpec struct {
 
 	// The schedule in Cron format, see https://en.wikipedia.org/wiki/Cron.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Schedule string `json:"schedule" protobuf:"bytes,1,opt,name=schedule"`
 
 	// The time zone name for the given schedule, see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones.
diff --git a/vendor/k8s.io/api/certificates/v1/generated.pb.go b/vendor/k8s.io/api/certificates/v1/generated.pb.go
index e47a42e62e..5b103ff8d5 100644
--- a/vendor/k8s.io/api/certificates/v1/generated.pb.go
+++ b/vendor/k8s.io/api/certificates/v1/generated.pb.go
@@ -26,10 +26,13 @@ import (
 	"sort"
 
 	k8s_io_api_core_v1 "k8s.io/api/core/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	math_bits "math/bits"
 	reflect "reflect"
 	strings "strings"
+
+	k8s_io_apimachinery_pkg_types "k8s.io/apimachinery/pkg/types"
 )
 
 func (m *CertificateSigningRequest) Reset() { *m = CertificateSigningRequest{} }
@@ -42,8 +45,22 @@ func (m *CertificateSigningRequestSpec) Reset() { *m = CertificateSigningRequest
 
 func (m *CertificateSigningRequestStatus) Reset() { *m = CertificateSigningRequestStatus{} }
 
+func (m *ClusterTrustBundle) Reset() { *m = ClusterTrustBundle{} }
+
+func (m *ClusterTrustBundleList) Reset() { *m = ClusterTrustBundleList{} }
+
+func (m *ClusterTrustBundleSpec) Reset() { *m = ClusterTrustBundleSpec{} }
+
 func (m *ExtraValue) Reset() { *m = ExtraValue{} }
 
+func (m *PodCertificateRequest) Reset() { *m = PodCertificateRequest{} }
+
+func (m *PodCertificateRequestList) Reset() { *m = PodCertificateRequestList{} }
+
+func (m *PodCertificateRequestSpec) Reset() { *m = PodCertificateRequestSpec{} }
+
+func (m *PodCertificateRequestStatus) Reset() { *m = PodCertificateRequestStatus{} }
+
 func (m *CertificateSigningRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -348,7 +365,7 @@ func (m *CertificateSigningRequestStatus) MarshalToSizedBuffer(dAtA []byte) (int
 	return len(dAtA) - i, nil
 }
 
-func (m ExtraValue) Marshal() (dAtA []byte, err error) {
+func (m *ClusterTrustBundle) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -358,270 +375,2058 @@ func (m ExtraValue) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m ExtraValue) MarshalTo(dAtA []byte) (int, error) {
+func (m *ClusterTrustBundle) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m ExtraValue) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ClusterTrustBundle) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if len(m) > 0 {
-		for iNdEx := len(m) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m[iNdEx])
-			copy(dAtA[i:], m[iNdEx])
-			i = encodeVarintGenerated(dAtA, i, uint64(len(m[iNdEx])))
-			i--
-			dAtA[i] = 0xa
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
+	i--
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
-	offset -= sovGenerated(v)
-	base := offset
-	for v >= 1<<7 {
-		dAtA[offset] = uint8(v&0x7f | 0x80)
-		v >>= 7
-		offset++
+func (m *ClusterTrustBundleList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	dAtA[offset] = uint8(v)
-	return base
+	return dAtA[:n], nil
 }
-func (m *CertificateSigningRequest) Size() (n int) {
-	if m == nil {
-		return 0
-	}
+
+func (m *ClusterTrustBundleList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ClusterTrustBundleList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = m.ObjectMeta.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	l = m.Spec.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	return n
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *CertificateSigningRequestCondition) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *ClusterTrustBundleSpec) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterTrustBundleSpec) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ClusterTrustBundleSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = len(m.Type)
-	n += 1 + l + sovGenerated(uint64(l))
-	l = len(m.Reason)
-	n += 1 + l + sovGenerated(uint64(l))
-	l = len(m.Message)
-	n += 1 + l + sovGenerated(uint64(l))
-	l = m.LastUpdateTime.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	l = m.LastTransitionTime.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	l = len(m.Status)
-	n += 1 + l + sovGenerated(uint64(l))
-	return n
+	i -= len(m.TrustBundle)
+	copy(dAtA[i:], m.TrustBundle)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.TrustBundle)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.SignerName)
+	copy(dAtA[i:], m.SignerName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.SignerName)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *CertificateSigningRequestList) Size() (n int) {
-	if m == nil {
-		return 0
+func (m ExtraValue) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m ExtraValue) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m ExtraValue) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = m.ListMeta.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	if len(m.Items) > 0 {
-		for _, e := range m.Items {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
+	if len(m) > 0 {
+		for iNdEx := len(m) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m[iNdEx])
+			copy(dAtA[i:], m[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m[iNdEx])))
+			i--
+			dAtA[i] = 0xa
 		}
 	}
-	return n
+	return len(dAtA) - i, nil
 }
 
-func (m *CertificateSigningRequestSpec) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *PodCertificateRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *PodCertificateRequest) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodCertificateRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	if m.Request != nil {
-		l = len(m.Request)
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	l = len(m.Username)
-	n += 1 + l + sovGenerated(uint64(l))
-	l = len(m.UID)
-	n += 1 + l + sovGenerated(uint64(l))
-	if len(m.Groups) > 0 {
-		for _, s := range m.Groups {
-			l = len(s)
-			n += 1 + l + sovGenerated(uint64(l))
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	if len(m.Usages) > 0 {
-		for _, s := range m.Usages {
-			l = len(s)
-			n += 1 + l + sovGenerated(uint64(l))
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	if len(m.Extra) > 0 {
-		for k, v := range m.Extra {
-			_ = k
-			_ = v
-			l = v.Size()
-			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + l + sovGenerated(uint64(l))
-			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	l = len(m.SignerName)
-	n += 1 + l + sovGenerated(uint64(l))
-	if m.ExpirationSeconds != nil {
-		n += 1 + sovGenerated(uint64(*m.ExpirationSeconds))
-	}
-	return n
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *CertificateSigningRequestStatus) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *PodCertificateRequestList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *PodCertificateRequestList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodCertificateRequestList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	if len(m.Conditions) > 0 {
-		for _, e := range m.Conditions {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
 		}
 	}
-	if m.Certificate != nil {
-		l = len(m.Certificate)
-		n += 1 + l + sovGenerated(uint64(l))
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m ExtraValue) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *PodCertificateRequestSpec) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *PodCertificateRequestSpec) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodCertificateRequestSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	if len(m) > 0 {
-		for _, s := range m {
-			l = len(s)
-			n += 1 + l + sovGenerated(uint64(l))
+	if m.StubPKCS10Request != nil {
+		i -= len(m.StubPKCS10Request)
+		copy(dAtA[i:], m.StubPKCS10Request)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(m.StubPKCS10Request)))
+		i--
+		dAtA[i] = 0x62
+	}
+	if len(m.UnverifiedUserAnnotations) > 0 {
+		keysForUnverifiedUserAnnotations := make([]string, 0, len(m.UnverifiedUserAnnotations))
+		for k := range m.UnverifiedUserAnnotations {
+			keysForUnverifiedUserAnnotations = append(keysForUnverifiedUserAnnotations, string(k))
+		}
+		sort.Strings(keysForUnverifiedUserAnnotations)
+		for iNdEx := len(keysForUnverifiedUserAnnotations) - 1; iNdEx >= 0; iNdEx-- {
+			v := m.UnverifiedUserAnnotations[string(keysForUnverifiedUserAnnotations[iNdEx])]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = encodeVarintGenerated(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(keysForUnverifiedUserAnnotations[iNdEx])
+			copy(dAtA[i:], keysForUnverifiedUserAnnotations[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForUnverifiedUserAnnotations[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+			i = encodeVarintGenerated(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x5a
 		}
 	}
-	return n
+	if m.MaxExpirationSeconds != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.MaxExpirationSeconds))
+		i--
+		dAtA[i] = 0x40
+	}
+	i -= len(m.NodeUID)
+	copy(dAtA[i:], m.NodeUID)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.NodeUID)))
+	i--
+	dAtA[i] = 0x3a
+	i -= len(m.NodeName)
+	copy(dAtA[i:], m.NodeName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.NodeName)))
+	i--
+	dAtA[i] = 0x32
+	i -= len(m.ServiceAccountUID)
+	copy(dAtA[i:], m.ServiceAccountUID)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ServiceAccountUID)))
+	i--
+	dAtA[i] = 0x2a
+	i -= len(m.ServiceAccountName)
+	copy(dAtA[i:], m.ServiceAccountName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ServiceAccountName)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.PodUID)
+	copy(dAtA[i:], m.PodUID)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.PodUID)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.PodName)
+	copy(dAtA[i:], m.PodName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.PodName)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.SignerName)
+	copy(dAtA[i:], m.SignerName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.SignerName)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func sovGenerated(x uint64) (n int) {
-	return (math_bits.Len64(x|1) + 6) / 7
-}
-func sozGenerated(x uint64) (n int) {
-	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
-}
-func (this *CertificateSigningRequest) String() string {
-	if this == nil {
-		return "nil"
+func (m *PodCertificateRequestStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	s := strings.Join([]string{`&CertificateSigningRequest{`,
-		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
-		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "CertificateSigningRequestSpec", "CertificateSigningRequestSpec", 1), `&`, ``, 1) + `,`,
-		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "CertificateSigningRequestStatus", "CertificateSigningRequestStatus", 1), `&`, ``, 1) + `,`,
-		`}`,
-	}, "")
-	return s
+	return dAtA[:n], nil
 }
-func (this *CertificateSigningRequestCondition) String() string {
-	if this == nil {
-		return "nil"
-	}
-	s := strings.Join([]string{`&CertificateSigningRequestCondition{`,
-		`Type:` + fmt.Sprintf("%v", this.Type) + `,`,
-		`Reason:` + fmt.Sprintf("%v", this.Reason) + `,`,
-		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
-		`LastUpdateTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastUpdateTime), "Time", "v1.Time", 1), `&`, ``, 1) + `,`,
-		`LastTransitionTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastTransitionTime), "Time", "v1.Time", 1), `&`, ``, 1) + `,`,
-		`Status:` + fmt.Sprintf("%v", this.Status) + `,`,
-		`}`,
-	}, "")
-	return s
+
+func (m *PodCertificateRequestStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
 }
-func (this *CertificateSigningRequestList) String() string {
-	if this == nil {
-		return "nil"
+
+func (m *PodCertificateRequestStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.NotAfter != nil {
+		{
+			size, err := m.NotAfter.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x32
 	}
-	repeatedStringForItems := "[]CertificateSigningRequest{"
-	for _, f := range this.Items {
-		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "CertificateSigningRequest", "CertificateSigningRequest", 1), `&`, ``, 1) + ","
+	if m.BeginRefreshAt != nil {
+		{
+			size, err := m.BeginRefreshAt.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2a
 	}
-	repeatedStringForItems += "}"
-	s := strings.Join([]string{`&CertificateSigningRequestList{`,
-		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
-		`Items:` + repeatedStringForItems + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func (this *CertificateSigningRequestSpec) String() string {
-	if this == nil {
-		return "nil"
+	if m.NotBefore != nil {
+		{
+			size, err := m.NotBefore.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
 	}
-	keysForExtra := make([]string, 0, len(this.Extra))
-	for k := range this.Extra {
-		keysForExtra = append(keysForExtra, k)
+	i -= len(m.CertificateChain)
+	copy(dAtA[i:], m.CertificateChain)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.CertificateChain)))
+	i--
+	dAtA[i] = 0x12
+	if len(m.Conditions) > 0 {
+		for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
 	}
-	sort.Strings(keysForExtra)
-	mapStringForExtra := "map[string]ExtraValue{"
-	for _, k := range keysForExtra {
-		mapStringForExtra += fmt.Sprintf("%v: %v,", k, this.Extra[k])
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
 	}
-	mapStringForExtra += "}"
-	s := strings.Join([]string{`&CertificateSigningRequestSpec{`,
-		`Request:` + valueToStringGenerated(this.Request) + `,`,
-		`Username:` + fmt.Sprintf("%v", this.Username) + `,`,
-		`UID:` + fmt.Sprintf("%v", this.UID) + `,`,
-		`Groups:` + fmt.Sprintf("%v", this.Groups) + `,`,
-		`Usages:` + fmt.Sprintf("%v", this.Usages) + `,`,
-		`Extra:` + mapStringForExtra + `,`,
-		`SignerName:` + fmt.Sprintf("%v", this.SignerName) + `,`,
-		`ExpirationSeconds:` + valueToStringGenerated(this.ExpirationSeconds) + `,`,
-		`}`,
-	}, "")
-	return s
+	dAtA[offset] = uint8(v)
+	return base
 }
-func (this *CertificateSigningRequestStatus) String() string {
-	if this == nil {
-		return "nil"
+func (m *CertificateSigningRequest) Size() (n int) {
+	if m == nil {
+		return 0
 	}
-	repeatedStringForConditions := "[]CertificateSigningRequestCondition{"
-	for _, f := range this.Conditions {
-		repeatedStringForConditions += strings.Replace(strings.Replace(f.String(), "CertificateSigningRequestCondition", "CertificateSigningRequestCondition", 1), `&`, ``, 1) + ","
+	var l int
+	_ = l
+	l = m.ObjectMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Spec.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *CertificateSigningRequestCondition) Size() (n int) {
+	if m == nil {
+		return 0
 	}
-	repeatedStringForConditions += "}"
-	s := strings.Join([]string{`&CertificateSigningRequestStatus{`,
-		`Conditions:` + repeatedStringForConditions + `,`,
-		`Certificate:` + valueToStringGenerated(this.Certificate) + `,`,
-		`}`,
-	}, "")
-	return s
+	var l int
+	_ = l
+	l = len(m.Type)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Reason)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Message)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.LastUpdateTime.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.LastTransitionTime.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Status)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
 }
-func valueToStringGenerated(v interface{}) string {
-	rv := reflect.ValueOf(v)
-	if rv.IsNil() {
-		return "nil"
+
+func (m *CertificateSigningRequestList) Size() (n int) {
+	if m == nil {
+		return 0
 	}
-	pv := reflect.Indirect(rv).Interface()
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *CertificateSigningRequestSpec) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Request != nil {
+		l = len(m.Request)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = len(m.Username)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.UID)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Groups) > 0 {
+		for _, s := range m.Groups {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.Usages) > 0 {
+		for _, s := range m.Usages {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.Extra) > 0 {
+		for k, v := range m.Extra {
+			_ = k
+			_ = v
+			l = v.Size()
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + l + sovGenerated(uint64(l))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
+	l = len(m.SignerName)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.ExpirationSeconds != nil {
+		n += 1 + sovGenerated(uint64(*m.ExpirationSeconds))
+	}
+	return n
+}
+
+func (m *CertificateSigningRequestStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Conditions) > 0 {
+		for _, e := range m.Conditions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if m.Certificate != nil {
+		l = len(m.Certificate)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *ClusterTrustBundle) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ObjectMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Spec.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *ClusterTrustBundleList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *ClusterTrustBundleSpec) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.SignerName)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.TrustBundle)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m ExtraValue) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m) > 0 {
+		for _, s := range m {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *PodCertificateRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ObjectMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Spec.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *PodCertificateRequestList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *PodCertificateRequestSpec) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.SignerName)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.PodName)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.PodUID)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.ServiceAccountName)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.ServiceAccountUID)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.NodeName)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.NodeUID)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.MaxExpirationSeconds != nil {
+		n += 1 + sovGenerated(uint64(*m.MaxExpirationSeconds))
+	}
+	if len(m.UnverifiedUserAnnotations) > 0 {
+		for k, v := range m.UnverifiedUserAnnotations {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + len(v) + sovGenerated(uint64(len(v)))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
+	if m.StubPKCS10Request != nil {
+		l = len(m.StubPKCS10Request)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *PodCertificateRequestStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Conditions) > 0 {
+		for _, e := range m.Conditions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = len(m.CertificateChain)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.NotBefore != nil {
+		l = m.NotBefore.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.BeginRefreshAt != nil {
+		l = m.BeginRefreshAt.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.NotAfter != nil {
+		l = m.NotAfter.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozGenerated(x uint64) (n int) {
+	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *CertificateSigningRequest) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CertificateSigningRequest{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "CertificateSigningRequestSpec", "CertificateSigningRequestSpec", 1), `&`, ``, 1) + `,`,
+		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "CertificateSigningRequestStatus", "CertificateSigningRequestStatus", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CertificateSigningRequestCondition) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CertificateSigningRequestCondition{`,
+		`Type:` + fmt.Sprintf("%v", this.Type) + `,`,
+		`Reason:` + fmt.Sprintf("%v", this.Reason) + `,`,
+		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`LastUpdateTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastUpdateTime), "Time", "v1.Time", 1), `&`, ``, 1) + `,`,
+		`LastTransitionTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastTransitionTime), "Time", "v1.Time", 1), `&`, ``, 1) + `,`,
+		`Status:` + fmt.Sprintf("%v", this.Status) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CertificateSigningRequestList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]CertificateSigningRequest{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "CertificateSigningRequest", "CertificateSigningRequest", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&CertificateSigningRequestList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CertificateSigningRequestSpec) String() string {
+	if this == nil {
+		return "nil"
+	}
+	keysForExtra := make([]string, 0, len(this.Extra))
+	for k := range this.Extra {
+		keysForExtra = append(keysForExtra, k)
+	}
+	sort.Strings(keysForExtra)
+	mapStringForExtra := "map[string]ExtraValue{"
+	for _, k := range keysForExtra {
+		mapStringForExtra += fmt.Sprintf("%v: %v,", k, this.Extra[k])
+	}
+	mapStringForExtra += "}"
+	s := strings.Join([]string{`&CertificateSigningRequestSpec{`,
+		`Request:` + valueToStringGenerated(this.Request) + `,`,
+		`Username:` + fmt.Sprintf("%v", this.Username) + `,`,
+		`UID:` + fmt.Sprintf("%v", this.UID) + `,`,
+		`Groups:` + fmt.Sprintf("%v", this.Groups) + `,`,
+		`Usages:` + fmt.Sprintf("%v", this.Usages) + `,`,
+		`Extra:` + mapStringForExtra + `,`,
+		`SignerName:` + fmt.Sprintf("%v", this.SignerName) + `,`,
+		`ExpirationSeconds:` + valueToStringGenerated(this.ExpirationSeconds) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CertificateSigningRequestStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForConditions := "[]CertificateSigningRequestCondition{"
+	for _, f := range this.Conditions {
+		repeatedStringForConditions += strings.Replace(strings.Replace(f.String(), "CertificateSigningRequestCondition", "CertificateSigningRequestCondition", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForConditions += "}"
+	s := strings.Join([]string{`&CertificateSigningRequestStatus{`,
+		`Conditions:` + repeatedStringForConditions + `,`,
+		`Certificate:` + valueToStringGenerated(this.Certificate) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ClusterTrustBundle) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ClusterTrustBundle{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "ClusterTrustBundleSpec", "ClusterTrustBundleSpec", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ClusterTrustBundleList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]ClusterTrustBundle{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "ClusterTrustBundle", "ClusterTrustBundle", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&ClusterTrustBundleList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ClusterTrustBundleSpec) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ClusterTrustBundleSpec{`,
+		`SignerName:` + fmt.Sprintf("%v", this.SignerName) + `,`,
+		`TrustBundle:` + fmt.Sprintf("%v", this.TrustBundle) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodCertificateRequest) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&PodCertificateRequest{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "PodCertificateRequestSpec", "PodCertificateRequestSpec", 1), `&`, ``, 1) + `,`,
+		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "PodCertificateRequestStatus", "PodCertificateRequestStatus", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodCertificateRequestList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]PodCertificateRequest{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "PodCertificateRequest", "PodCertificateRequest", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&PodCertificateRequestList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodCertificateRequestSpec) String() string {
+	if this == nil {
+		return "nil"
+	}
+	keysForUnverifiedUserAnnotations := make([]string, 0, len(this.UnverifiedUserAnnotations))
+	for k := range this.UnverifiedUserAnnotations {
+		keysForUnverifiedUserAnnotations = append(keysForUnverifiedUserAnnotations, k)
+	}
+	sort.Strings(keysForUnverifiedUserAnnotations)
+	mapStringForUnverifiedUserAnnotations := "map[string]string{"
+	for _, k := range keysForUnverifiedUserAnnotations {
+		mapStringForUnverifiedUserAnnotations += fmt.Sprintf("%v: %v,", k, this.UnverifiedUserAnnotations[k])
+	}
+	mapStringForUnverifiedUserAnnotations += "}"
+	s := strings.Join([]string{`&PodCertificateRequestSpec{`,
+		`SignerName:` + fmt.Sprintf("%v", this.SignerName) + `,`,
+		`PodName:` + fmt.Sprintf("%v", this.PodName) + `,`,
+		`PodUID:` + fmt.Sprintf("%v", this.PodUID) + `,`,
+		`ServiceAccountName:` + fmt.Sprintf("%v", this.ServiceAccountName) + `,`,
+		`ServiceAccountUID:` + fmt.Sprintf("%v", this.ServiceAccountUID) + `,`,
+		`NodeName:` + fmt.Sprintf("%v", this.NodeName) + `,`,
+		`NodeUID:` + fmt.Sprintf("%v", this.NodeUID) + `,`,
+		`MaxExpirationSeconds:` + valueToStringGenerated(this.MaxExpirationSeconds) + `,`,
+		`UnverifiedUserAnnotations:` + mapStringForUnverifiedUserAnnotations + `,`,
+		`StubPKCS10Request:` + valueToStringGenerated(this.StubPKCS10Request) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodCertificateRequestStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForConditions := "[]Condition{"
+	for _, f := range this.Conditions {
+		repeatedStringForConditions += fmt.Sprintf("%v", f) + ","
+	}
+	repeatedStringForConditions += "}"
+	s := strings.Join([]string{`&PodCertificateRequestStatus{`,
+		`Conditions:` + repeatedStringForConditions + `,`,
+		`CertificateChain:` + fmt.Sprintf("%v", this.CertificateChain) + `,`,
+		`NotBefore:` + strings.Replace(fmt.Sprintf("%v", this.NotBefore), "Time", "v1.Time", 1) + `,`,
+		`BeginRefreshAt:` + strings.Replace(fmt.Sprintf("%v", this.BeginRefreshAt), "Time", "v1.Time", 1) + `,`,
+		`NotAfter:` + strings.Replace(fmt.Sprintf("%v", this.NotAfter), "Time", "v1.Time", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringGenerated(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
 	return fmt.Sprintf("*%v", pv)
 }
-func (m *CertificateSigningRequest) Unmarshal(dAtA []byte) error {
+func (m *CertificateSigningRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CertificateSigningRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CertificateSigningRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CertificateSigningRequestCondition) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CertificateSigningRequestCondition: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CertificateSigningRequestCondition: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = RequestConditionType(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastUpdateTime", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.LastUpdateTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastTransitionTime", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.LastTransitionTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Status = k8s_io_api_core_v1.ConditionStatus(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CertificateSigningRequestList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CertificateSigningRequestList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CertificateSigningRequestList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, CertificateSigningRequest{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CertificateSigningRequestSpec) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CertificateSigningRequestSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CertificateSigningRequestSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Request", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Request = append(m.Request[:0], dAtA[iNdEx:postIndex]...)
+			if m.Request == nil {
+				m.Request = []byte{}
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Username = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Groups", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Groups = append(m.Groups, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Usages", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Usages = append(m.Usages, KeyUsage(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Extra", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Extra == nil {
+				m.Extra = make(map[string]ExtraValue)
+			}
+			var mapkey string
+			mapvalue := &ExtraValue{}
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var mapmsglen int
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapmsglen |= int(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					if mapmsglen < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postmsgIndex := iNdEx + mapmsglen
+					if postmsgIndex < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postmsgIndex > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = &ExtraValue{}
+					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
+						return err
+					}
+					iNdEx = postmsgIndex
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipGenerated(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.Extra[mapkey] = *mapvalue
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SignerName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SignerName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExpirationSeconds", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.ExpirationSeconds = &v
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CertificateSigningRequestStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CertificateSigningRequestStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CertificateSigningRequestStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Conditions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Conditions = append(m.Conditions, CertificateSigningRequestCondition{})
+			if err := m.Conditions[len(m.Conditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Certificate", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Certificate = append(m.Certificate[:0], dAtA[iNdEx:postIndex]...)
+			if m.Certificate == nil {
+				m.Certificate = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterTrustBundle) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterTrustBundle: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterTrustBundle: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterTrustBundleList) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -644,15 +2449,15 @@ func (m *CertificateSigningRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CertificateSigningRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: ClusterTrustBundleList: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CertificateSigningRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ClusterTrustBundleList: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -679,46 +2484,13 @@ func (m *CertificateSigningRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -745,7 +2517,8 @@ func (m *CertificateSigningRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Items = append(m.Items, ClusterTrustBundle{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -770,7 +2543,7 @@ func (m *CertificateSigningRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CertificateSigningRequestCondition) Unmarshal(dAtA []byte) error {
+func (m *ClusterTrustBundleSpec) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -793,15 +2566,15 @@ func (m *CertificateSigningRequestCondition) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CertificateSigningRequestCondition: wiretype end group for non-group")
+			return fmt.Errorf("proto: ClusterTrustBundleSpec: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CertificateSigningRequestCondition: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ClusterTrustBundleSpec: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SignerName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -829,11 +2602,11 @@ func (m *CertificateSigningRequestCondition) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Type = RequestConditionType(dAtA[iNdEx:postIndex])
+			m.SignerName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TrustBundle", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -861,11 +2634,61 @@ func (m *CertificateSigningRequestCondition) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Reason = string(dAtA[iNdEx:postIndex])
+			m.TrustBundle = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ExtraValue) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ExtraValue: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ExtraValue: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -893,11 +2716,61 @@ func (m *CertificateSigningRequestCondition) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Message = string(dAtA[iNdEx:postIndex])
+			*m = append(*m, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 4:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodCertificateRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodCertificateRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodCertificateRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field LastUpdateTime", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -924,13 +2797,13 @@ func (m *CertificateSigningRequestCondition) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.LastUpdateTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field LastTransitionTime", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -957,15 +2830,15 @@ func (m *CertificateSigningRequestCondition) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.LastTransitionTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 3:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -975,23 +2848,24 @@ func (m *CertificateSigningRequestCondition) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Status = k8s_io_api_core_v1.ConditionStatus(dAtA[iNdEx:postIndex])
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -1014,7 +2888,7 @@ func (m *CertificateSigningRequestCondition) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CertificateSigningRequestList) Unmarshal(dAtA []byte) error {
+func (m *PodCertificateRequestList) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -1037,10 +2911,10 @@ func (m *CertificateSigningRequestList) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CertificateSigningRequestList: wiretype end group for non-group")
+			return fmt.Errorf("proto: PodCertificateRequestList: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CertificateSigningRequestList: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PodCertificateRequestList: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -1105,7 +2979,7 @@ func (m *CertificateSigningRequestList) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Items = append(m.Items, CertificateSigningRequest{})
+			m.Items = append(m.Items, PodCertificateRequest{})
 			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
@@ -1131,7 +3005,7 @@ func (m *CertificateSigningRequestList) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CertificateSigningRequestSpec) Unmarshal(dAtA []byte) error {
+func (m *PodCertificateRequestSpec) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -1141,30 +3015,94 @@ func (m *CertificateSigningRequestSpec) Unmarshal(dAtA []byte) error {
 			if shift >= 64 {
 				return ErrIntOverflowGenerated
 			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodCertificateRequestSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodCertificateRequestSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SignerName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SignerName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PodName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: CertificateSigningRequestSpec: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CertificateSigningRequestSpec: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.PodName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Request", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PodUID", wireType)
 			}
-			var byteLen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -1174,29 +3112,27 @@ func (m *CertificateSigningRequestSpec) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Request = append(m.Request[:0], dAtA[iNdEx:postIndex]...)
-			if m.Request == nil {
-				m.Request = []byte{}
-			}
+			m.PodUID = k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 2:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Username", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceAccountName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -1224,11 +3160,11 @@ func (m *CertificateSigningRequestSpec) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Username = string(dAtA[iNdEx:postIndex])
+			m.ServiceAccountName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceAccountUID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -1256,11 +3192,11 @@ func (m *CertificateSigningRequestSpec) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.UID = string(dAtA[iNdEx:postIndex])
+			m.ServiceAccountUID = k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Groups", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -1288,11 +3224,11 @@ func (m *CertificateSigningRequestSpec) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Groups = append(m.Groups, string(dAtA[iNdEx:postIndex]))
+			m.NodeName = k8s_io_apimachinery_pkg_types.NodeName(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Usages", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeUID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -1320,11 +3256,31 @@ func (m *CertificateSigningRequestSpec) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Usages = append(m.Usages, KeyUsage(dAtA[iNdEx:postIndex]))
+			m.NodeUID = k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MaxExpirationSeconds", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.MaxExpirationSeconds = &v
+		case 11:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Extra", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UnverifiedUserAnnotations", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -1351,11 +3307,11 @@ func (m *CertificateSigningRequestSpec) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Extra == nil {
-				m.Extra = make(map[string]ExtraValue)
+			if m.UnverifiedUserAnnotations == nil {
+				m.UnverifiedUserAnnotations = make(map[string]string)
 			}
 			var mapkey string
-			mapvalue := &ExtraValue{}
+			var mapvalue string
 			for iNdEx < postIndex {
 				entryPreIndex := iNdEx
 				var wire uint64
@@ -1404,7 +3360,7 @@ func (m *CertificateSigningRequestSpec) Unmarshal(dAtA []byte) error {
 					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
 					iNdEx = postStringIndexmapkey
 				} else if fieldNum == 2 {
-					var mapmsglen int
+					var stringLenmapvalue uint64
 					for shift := uint(0); ; shift += 7 {
 						if shift >= 64 {
 							return ErrIntOverflowGenerated
@@ -1414,26 +3370,24 @@ func (m *CertificateSigningRequestSpec) Unmarshal(dAtA []byte) error {
 						}
 						b := dAtA[iNdEx]
 						iNdEx++
-						mapmsglen |= int(b&0x7F) << shift
+						stringLenmapvalue |= uint64(b&0x7F) << shift
 						if b < 0x80 {
 							break
 						}
 					}
-					if mapmsglen < 0 {
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
 						return ErrInvalidLengthGenerated
 					}
-					postmsgIndex := iNdEx + mapmsglen
-					if postmsgIndex < 0 {
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
 						return ErrInvalidLengthGenerated
 					}
-					if postmsgIndex > l {
+					if postStringIndexmapvalue > l {
 						return io.ErrUnexpectedEOF
 					}
-					mapvalue = &ExtraValue{}
-					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
-						return err
-					}
-					iNdEx = postmsgIndex
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
 				} else {
 					iNdEx = entryPreIndex
 					skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -1449,13 +3403,13 @@ func (m *CertificateSigningRequestSpec) Unmarshal(dAtA []byte) error {
 					iNdEx += skippy
 				}
 			}
-			m.Extra[mapkey] = *mapvalue
+			m.UnverifiedUserAnnotations[mapkey] = mapvalue
 			iNdEx = postIndex
-		case 7:
+		case 12:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SignerName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StubPKCS10Request", wireType)
 			}
-			var stringLen uint64
+			var byteLen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -1465,44 +3419,26 @@ func (m *CertificateSigningRequestSpec) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				byteLen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if byteLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + byteLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SignerName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 8:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ExpirationSeconds", wireType)
-			}
-			var v int32
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			m.StubPKCS10Request = append(m.StubPKCS10Request[:0], dAtA[iNdEx:postIndex]...)
+			if m.StubPKCS10Request == nil {
+				m.StubPKCS10Request = []byte{}
 			}
-			m.ExpirationSeconds = &v
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -1524,7 +3460,7 @@ func (m *CertificateSigningRequestSpec) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CertificateSigningRequestStatus) Unmarshal(dAtA []byte) error {
+func (m *PodCertificateRequestStatus) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -1547,10 +3483,10 @@ func (m *CertificateSigningRequestStatus) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CertificateSigningRequestStatus: wiretype end group for non-group")
+			return fmt.Errorf("proto: PodCertificateRequestStatus: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CertificateSigningRequestStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PodCertificateRequestStatus: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -1582,16 +3518,16 @@ func (m *CertificateSigningRequestStatus) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Conditions = append(m.Conditions, CertificateSigningRequestCondition{})
+			m.Conditions = append(m.Conditions, v1.Condition{})
 			if err := m.Conditions[len(m.Conditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Certificate", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CertificateChain", wireType)
 			}
-			var byteLen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -1601,81 +3537,101 @@ func (m *CertificateSigningRequestStatus) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				byteLen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if byteLen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + byteLen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Certificate = append(m.Certificate[:0], dAtA[iNdEx:postIndex]...)
-			if m.Certificate == nil {
-				m.Certificate = []byte{}
-			}
+			m.CertificateChain = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NotBefore", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			if (iNdEx + skippy) > l {
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *ExtraValue) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
+			if m.NotBefore == nil {
+				m.NotBefore = &v1.Time{}
 			}
-			if iNdEx >= l {
+			if err := m.NotBefore.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BeginRefreshAt", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			if m.BeginRefreshAt == nil {
+				m.BeginRefreshAt = &v1.Time{}
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: ExtraValue: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ExtraValue: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			if err := m.BeginRefreshAt.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NotAfter", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -1685,23 +3641,27 @@ func (m *ExtraValue) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			*m = append(*m, string(dAtA[iNdEx:postIndex]))
+			if m.NotAfter == nil {
+				m.NotAfter = &v1.Time{}
+			}
+			if err := m.NotAfter.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
diff --git a/vendor/k8s.io/api/certificates/v1/generated.proto b/vendor/k8s.io/api/certificates/v1/generated.proto
index a334db4e18..8c97f12395 100644
--- a/vendor/k8s.io/api/certificates/v1/generated.proto
+++ b/vendor/k8s.io/api/certificates/v1/generated.proto
@@ -204,12 +204,12 @@ message CertificateSigningRequestStatus {
   // +listType=map
   // +listMapKey=type
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:listType=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=type
-  // +k8s:alpha(since: "1.36")=+k8s:customUnique
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:item(type: "Approved")=+k8s:zeroOrOneOfMember
-  // +k8s:alpha(since: "1.36")=+k8s:item(type: "Denied")=+k8s:zeroOrOneOfMember
+  // +k8s:beta(since: "1.37")=+k8s:listType=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=type
+  // +k8s:beta(since: "1.37")=+k8s:customUnique
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:item(type: "Approved")=+k8s:zeroOrOneOfMember
+  // +k8s:beta(since: "1.37")=+k8s:item(type: "Denied")=+k8s:zeroOrOneOfMember
   repeated CertificateSigningRequestCondition conditions = 1;
 
   // certificate is populated with an issued certificate by the signer after an Approved condition is present.
@@ -243,6 +243,81 @@ message CertificateSigningRequestStatus {
   optional bytes certificate = 2;
 }
 
+// ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors
+// (root certificates).
+//
+// ClusterTrustBundle objects are considered to be readable by any authenticated
+// user in the cluster, because they can be mounted by pods using the
+// `clusterTrustBundle` projection.  All service accounts have read access to
+// ClusterTrustBundles by default.  Users who only have namespace-level access
+// to a cluster can read ClusterTrustBundles by impersonating a serviceaccount
+// that they have access to.
+//
+// It can be optionally associated with a particular signer, in which case it
+// contains one valid set of trust anchors for that signer. Signers may have
+// multiple associated ClusterTrustBundles; each is an independent set of trust
+// anchors for that signer. Admission control is used to enforce that only users
+// with permissions on the signer can create or modify the corresponding bundle.
+message ClusterTrustBundle {
+  // metadata contains the object metadata.
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
+
+  // spec contains the signer (if any) and trust anchors.
+  optional ClusterTrustBundleSpec spec = 2;
+}
+
+// ClusterTrustBundleList is a collection of ClusterTrustBundle objects
+message ClusterTrustBundleList {
+  // metadata contains the list metadata.
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
+
+  // items is a collection of ClusterTrustBundle objects
+  repeated ClusterTrustBundle items = 2;
+}
+
+// ClusterTrustBundleSpec contains the signer and trust anchors.
+message ClusterTrustBundleSpec {
+  // signerName indicates the associated signer, if any.
+  //
+  // In order to create or update a ClusterTrustBundle that sets signerName,
+  // you must have the following cluster-scoped permission:
+  // group=certificates.k8s.io resource=signers resourceName=<the signer name>
+  // verb=attest.
+  //
+  // If signerName is not empty, then the ClusterTrustBundle object must be
+  // named with the signer name as a prefix (translating slashes to colons).
+  // For example, for the signer name `example.com/foo`, valid
+  // ClusterTrustBundle object names include `example.com:foo:abc` and
+  // `example.com:foo:v1`.
+  //
+  // If signerName is empty, then the ClusterTrustBundle object's name must
+  // not have such a prefix.
+  //
+  // List/watch requests for ClusterTrustBundles can filter on this field
+  // using a `spec.signerName=NAME` field selector.
+  //
+  // +optional
+  // +k8s:alpha(since:"1.37")=+k8s:optional
+  // +k8s:alpha(since:"1.37")=+k8s:immutable
+  optional string signerName = 1;
+
+  // trustBundle contains the individual X.509 trust anchors for this
+  // bundle, as PEM bundle of PEM-wrapped, DER-formatted X.509 certificates.
+  //
+  // The data must consist only of PEM certificate blocks that parse as valid
+  // X.509 certificates.  Each certificate must include a basic constraints
+  // extension with the CA bit set.  The API server will reject objects that
+  // contain duplicate certificates, or that use PEM block headers.
+  //
+  // Users of ClusterTrustBundles, including Kubelet, are free to reorder and
+  // deduplicate certificate blocks in this file according to their own logic,
+  // as well as to drop PEM block headers and inter-block data.
+  optional string trustBundle = 2;
+}
+
 // ExtraValue masks the value so protobuf can generate
 // +protobuf.nullable=true
 // +protobuf.options.(gogoproto.goproto_stringer)=false
@@ -252,3 +327,209 @@ message ExtraValue {
   repeated string items = 1;
 }
 
+// PodCertificateRequest encodes a pod requesting a certificate from a given
+// signer.
+//
+// Kubelets use this API to implement podCertificate projected volumes
+// +k8s:supportsSubresource="/status"
+message PodCertificateRequest {
+  // metadata contains the object metadata.
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
+
+  // spec contains the details about the certificate being requested.
+  // +required
+  optional PodCertificateRequestSpec spec = 2;
+
+  // status contains the issued certificate, and a standard set of conditions.
+  // +optional
+  optional PodCertificateRequestStatus status = 3;
+}
+
+// PodCertificateRequestList is a collection of PodCertificateRequest objects
+message PodCertificateRequestList {
+  // metadata contains the list metadata.
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
+
+  // items is a collection of PodCertificateRequest objects
+  repeated PodCertificateRequest items = 2;
+}
+
+// PodCertificateRequestSpec describes the certificate request.  All fields are
+// immutable after creation.
+message PodCertificateRequestSpec {
+  // signerName indicates the requested signer.
+  //
+  // All signer names beginning with `kubernetes.io` are reserved for use by
+  // the Kubernetes project.  There is currently one well-known signer
+  // documented by the Kubernetes project,
+  // `kubernetes.io/kube-apiserver-client-pod`, which will issue client
+  // certificates understood by kube-apiserver.  It is currently
+  // unimplemented.
+  //
+  // +required
+  optional string signerName = 1;
+
+  // podName is the name of the pod into which the certificate will be mounted.
+  //
+  // +required
+  optional string podName = 2;
+
+  // podUID is the UID of the pod into which the certificate will be mounted.
+  //
+  // +required
+  optional string podUID = 3;
+
+  // serviceAccountName is the name of the service account the pod is running as.
+  //
+  // +required
+  optional string serviceAccountName = 4;
+
+  // serviceAccountUID is the UID of the service account the pod is running as.
+  //
+  // +required
+  optional string serviceAccountUID = 5;
+
+  // nodeName is the name of the node the pod is assigned to.
+  //
+  // +required
+  optional string nodeName = 6;
+
+  // nodeUID is the UID of the node the pod is assigned to.
+  //
+  // +required
+  optional string nodeUID = 7;
+
+  // maxExpirationSeconds is the maximum lifetime permitted for the
+  // certificate.
+  //
+  // If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+  // will reject values shorter than 3600 (1 hour).  The maximum allowable
+  // value is 7862400 (91 days).
+  //
+  // The signer implementation is then free to issue a certificate with any
+  // lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+  // seconds (1 hour).  This constraint is enforced by kube-apiserver.
+  // `kubernetes.io` signers will never issue certificates with a lifetime
+  // longer than 24 hours.
+  //
+  // +optional
+  // +default=86400
+  optional int32 maxExpirationSeconds = 8;
+
+  // A PKCS#10 certificate signing request (DER-serialized) generated by
+  // Kubelet using the subject private key.
+  //
+  // Most signer implementations will ignore the contents of the CSR except to
+  // extract the subject public key. The API server automatically verifies the
+  // CSR signature during admission, so the signer does not need to repeat the
+  // verification.  CSRs generated by kubelet are completely empty.
+  //
+  // The subject public key must be one of RSA3072, RSA4096, ECDSAP256,
+  // ECDSAP384, ECDSAP521, or ED25519. Note that this list may be expanded in
+  // the future.
+  //
+  // Signer implementations do not need to support all key types supported by
+  // kube-apiserver and kubelet.  If a signer does not support the key type
+  // used for a given PodCertificateRequest, it must deny the request by
+  // setting a status.conditions entry with a type of "Denied" and a reason of
+  // "UnsupportedKeyType". It may also suggest a key type that it does support
+  // in the message field.
+  //
+  // +required
+  optional bytes stubPKCS10Request = 12;
+
+  // unverifiedUserAnnotations allow pod authors to pass additional information to
+  // the signer implementation.  Kubernetes does not restrict or validate this
+  // metadata in any way.
+  //
+  // Entries are subject to the same validation as object metadata annotations,
+  // with the addition that all keys must be domain-prefixed. No restrictions
+  // are placed on values, except an overall size limitation on the entire field.
+  //
+  // Signers should document the keys and values they support.  Signers should
+  // deny requests that contain keys they do not recognize.
+  //
+  // +optional
+  map<string, string> unverifiedUserAnnotations = 11;
+}
+
+// PodCertificateRequestStatus describes the status of the request, and holds
+// the certificate data if the request is issued.
+message PodCertificateRequestStatus {
+  // conditions applied to the request.
+  //
+  // The types "Issued", "Denied", and "Failed" have special handling.  At
+  // most one of these conditions may be present, and they must have status
+  // "True".
+  //
+  // If the request is denied with `Reason=UnsupportedKeyType`, the signer may
+  // suggest a key type that will work in the message field.
+  //
+  // +patchMergeKey=type
+  // +patchStrategy=merge
+  // +listType=map
+  // +listMapKey=type
+  // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 1;
+
+  // certificateChain is populated with an issued certificate by the signer.
+  // This field is set via the /status subresource. Once populated, this field
+  // is immutable.
+  //
+  // If the certificate signing request is denied, a condition of type
+  // "Denied" is added and this field remains empty. If the signer cannot
+  // issue the certificate, a condition of type "Failed" is added and this
+  // field remains empty.
+  //
+  // Validation requirements:
+  //  1. certificateChain must consist of one or more PEM-formatted certificates.
+  //  2. Each entry must be a valid PEM-wrapped, DER-encoded ASN.1 Certificate as
+  //     described in section 4 of RFC5280.
+  //
+  // If more than one block is present, and the definition of the requested
+  // spec.signerName does not indicate otherwise, the first block is the
+  // issued certificate, and subsequent blocks should be treated as
+  // intermediate certificates and presented in TLS handshakes.  When
+  // projecting the chain into a pod volume, kubelet will drop any data
+  // in-between the PEM blocks, as well as any PEM block headers.
+  //
+  // +optional
+  optional string certificateChain = 2;
+
+  // notBefore is the time at which the certificate becomes valid.  The value
+  // must be the same as the notBefore value in the leaf certificate in
+  // certificateChain.  This field is set via the /status subresource.  Once
+  // populated, it is immutable. The signer must set this field at the same
+  // time it sets certificateChain.
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time notBefore = 4;
+
+  // beginRefreshAt is the time at which the kubelet should begin trying to
+  // refresh the certificate.  This field is set via the /status subresource,
+  // and must be set at the same time as certificateChain.  Once populated,
+  // this field is immutable.
+  //
+  // This field is only a hint.  Kubelet may start refreshing before or after
+  // this time if necessary.
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time beginRefreshAt = 5;
+
+  // notAfter is the time at which the certificate expires.  The value must be
+  // the same as the notAfter value in the leaf certificate in
+  // certificateChain.  This field is set via the /status subresource.  Once
+  // populated, it is immutable.  The signer must set this field at the same
+  // time it sets certificateChain.
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time notAfter = 6;
+}
+
diff --git a/vendor/k8s.io/api/certificates/v1/register.go b/vendor/k8s.io/api/certificates/v1/register.go
index 2dac94ada0..474b8b032c 100644
--- a/vendor/k8s.io/api/certificates/v1/register.go
+++ b/vendor/k8s.io/api/certificates/v1/register.go
@@ -53,6 +53,10 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
 		&CertificateSigningRequest{},
 		&CertificateSigningRequestList{},
+		&ClusterTrustBundle{},
+		&ClusterTrustBundleList{},
+		&PodCertificateRequest{},
+		&PodCertificateRequestList{},
 	)
 
 	// Add the watch version that applies
diff --git a/vendor/k8s.io/api/certificates/v1/types.go b/vendor/k8s.io/api/certificates/v1/types.go
index 9a86af13a8..b90179ea4c 100644
--- a/vendor/k8s.io/api/certificates/v1/types.go
+++ b/vendor/k8s.io/api/certificates/v1/types.go
@@ -21,6 +21,7 @@ import (
 
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
 )
 
 // +genclient
@@ -42,7 +43,7 @@ import (
 // +k8s:supportsSubresource="/status"
 // +k8s:supportsSubresource="/approval"
 type CertificateSigningRequest struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
@@ -179,12 +180,12 @@ type CertificateSigningRequestStatus struct {
 	// +listType=map
 	// +listMapKey=type
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:listType=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=type
-	// +k8s:alpha(since: "1.36")=+k8s:customUnique
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:item(type: "Approved")=+k8s:zeroOrOneOfMember
-	// +k8s:alpha(since: "1.36")=+k8s:item(type: "Denied")=+k8s:zeroOrOneOfMember
+	// +k8s:beta(since: "1.37")=+k8s:listType=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=type
+	// +k8s:beta(since: "1.37")=+k8s:customUnique
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:item(type: "Approved")=+k8s:zeroOrOneOfMember
+	// +k8s:beta(since: "1.37")=+k8s:item(type: "Denied")=+k8s:zeroOrOneOfMember
 	Conditions []CertificateSigningRequestCondition `json:"conditions,omitempty" protobuf:"bytes,1,rep,name=conditions"`
 
 	// certificate is populated with an issued certificate by the signer after an Approved condition is present.
@@ -273,7 +274,7 @@ type CertificateSigningRequestCondition struct {
 
 // CertificateSigningRequestList is a collection of CertificateSigningRequest objects
 type CertificateSigningRequestList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
@@ -316,3 +317,326 @@ const (
 	UsageMicrosoftSGC      KeyUsage = "microsoft sgc"
 	UsageNetscapeSGC       KeyUsage = "netscape sgc"
 )
+
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+
+// ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors
+// (root certificates).
+//
+// ClusterTrustBundle objects are considered to be readable by any authenticated
+// user in the cluster, because they can be mounted by pods using the
+// `clusterTrustBundle` projection.  All service accounts have read access to
+// ClusterTrustBundles by default.  Users who only have namespace-level access
+// to a cluster can read ClusterTrustBundles by impersonating a serviceaccount
+// that they have access to.
+//
+// It can be optionally associated with a particular signer, in which case it
+// contains one valid set of trust anchors for that signer. Signers may have
+// multiple associated ClusterTrustBundles; each is an independent set of trust
+// anchors for that signer. Admission control is used to enforce that only users
+// with permissions on the signer can create or modify the corresponding bundle.
+type ClusterTrustBundle struct {
+	metav1.TypeMeta `json:""`
+
+	// metadata contains the object metadata.
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// spec contains the signer (if any) and trust anchors.
+	Spec ClusterTrustBundleSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
+}
+
+// ClusterTrustBundleSpec contains the signer and trust anchors.
+type ClusterTrustBundleSpec struct {
+	// signerName indicates the associated signer, if any.
+	//
+	// In order to create or update a ClusterTrustBundle that sets signerName,
+	// you must have the following cluster-scoped permission:
+	// group=certificates.k8s.io resource=signers resourceName=<the signer name>
+	// verb=attest.
+	//
+	// If signerName is not empty, then the ClusterTrustBundle object must be
+	// named with the signer name as a prefix (translating slashes to colons).
+	// For example, for the signer name `example.com/foo`, valid
+	// ClusterTrustBundle object names include `example.com:foo:abc` and
+	// `example.com:foo:v1`.
+	//
+	// If signerName is empty, then the ClusterTrustBundle object's name must
+	// not have such a prefix.
+	//
+	// List/watch requests for ClusterTrustBundles can filter on this field
+	// using a `spec.signerName=NAME` field selector.
+	//
+	// +optional
+	// +k8s:alpha(since:"1.37")=+k8s:optional
+	// +k8s:alpha(since:"1.37")=+k8s:immutable
+	SignerName string `json:"signerName,omitempty" protobuf:"bytes,1,opt,name=signerName"`
+
+	// trustBundle contains the individual X.509 trust anchors for this
+	// bundle, as PEM bundle of PEM-wrapped, DER-formatted X.509 certificates.
+	//
+	// The data must consist only of PEM certificate blocks that parse as valid
+	// X.509 certificates.  Each certificate must include a basic constraints
+	// extension with the CA bit set.  The API server will reject objects that
+	// contain duplicate certificates, or that use PEM block headers.
+	//
+	// Users of ClusterTrustBundles, including Kubelet, are free to reorder and
+	// deduplicate certificate blocks in this file according to their own logic,
+	// as well as to drop PEM block headers and inter-block data.
+	TrustBundle string `json:"trustBundle" protobuf:"bytes,2,opt,name=trustBundle"`
+}
+
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// ClusterTrustBundleList is a collection of ClusterTrustBundle objects
+type ClusterTrustBundleList struct {
+	metav1.TypeMeta `json:""`
+
+	// metadata contains the list metadata.
+	//
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// items is a collection of ClusterTrustBundle objects
+	Items []ClusterTrustBundle `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+// +genclient
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// PodCertificateRequest encodes a pod requesting a certificate from a given
+// signer.
+//
+// Kubelets use this API to implement podCertificate projected volumes
+// +k8s:supportsSubresource="/status"
+type PodCertificateRequest struct {
+	metav1.TypeMeta `json:""`
+
+	// metadata contains the object metadata.
+	//
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// spec contains the details about the certificate being requested.
+	// +required
+	Spec PodCertificateRequestSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
+
+	// status contains the issued certificate, and a standard set of conditions.
+	// +optional
+	Status PodCertificateRequestStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
+}
+
+// PodCertificateRequestSpec describes the certificate request.  All fields are
+// immutable after creation.
+type PodCertificateRequestSpec struct {
+	// signerName indicates the requested signer.
+	//
+	// All signer names beginning with `kubernetes.io` are reserved for use by
+	// the Kubernetes project.  There is currently one well-known signer
+	// documented by the Kubernetes project,
+	// `kubernetes.io/kube-apiserver-client-pod`, which will issue client
+	// certificates understood by kube-apiserver.  It is currently
+	// unimplemented.
+	//
+	// +required
+	SignerName string `json:"signerName" protobuf:"bytes,1,opt,name=signerName"`
+
+	// podName is the name of the pod into which the certificate will be mounted.
+	//
+	// +required
+	PodName string `json:"podName" protobuf:"bytes,2,opt,name=podName"`
+	// podUID is the UID of the pod into which the certificate will be mounted.
+	//
+	// +required
+	PodUID types.UID `json:"podUID" protobuf:"bytes,3,opt,name=podUID"`
+
+	// serviceAccountName is the name of the service account the pod is running as.
+	//
+	// +required
+	ServiceAccountName string `json:"serviceAccountName" protobuf:"bytes,4,opt,name=serviceAccountName"`
+	// serviceAccountUID is the UID of the service account the pod is running as.
+	//
+	// +required
+	ServiceAccountUID types.UID `json:"serviceAccountUID" protobuf:"bytes,5,opt,name=serviceAccountUID"`
+
+	// nodeName is the name of the node the pod is assigned to.
+	//
+	// +required
+	NodeName types.NodeName `json:"nodeName" protobuf:"bytes,6,opt,name=nodeName"`
+	// nodeUID is the UID of the node the pod is assigned to.
+	//
+	// +required
+	NodeUID types.UID `json:"nodeUID" protobuf:"bytes,7,opt,name=nodeUID"`
+
+	// maxExpirationSeconds is the maximum lifetime permitted for the
+	// certificate.
+	//
+	// If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+	// will reject values shorter than 3600 (1 hour).  The maximum allowable
+	// value is 7862400 (91 days).
+	//
+	// The signer implementation is then free to issue a certificate with any
+	// lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+	// seconds (1 hour).  This constraint is enforced by kube-apiserver.
+	// `kubernetes.io` signers will never issue certificates with a lifetime
+	// longer than 24 hours.
+	//
+	// +optional
+	// +default=86400
+	MaxExpirationSeconds *int32 `json:"maxExpirationSeconds,omitempty" protobuf:"varint,8,opt,name=maxExpirationSeconds"`
+
+	// A PKCS#10 certificate signing request (DER-serialized) generated by
+	// Kubelet using the subject private key.
+	//
+	// Most signer implementations will ignore the contents of the CSR except to
+	// extract the subject public key. The API server automatically verifies the
+	// CSR signature during admission, so the signer does not need to repeat the
+	// verification.  CSRs generated by kubelet are completely empty.
+	//
+	// The subject public key must be one of RSA3072, RSA4096, ECDSAP256,
+	// ECDSAP384, ECDSAP521, or ED25519. Note that this list may be expanded in
+	// the future.
+	//
+	// Signer implementations do not need to support all key types supported by
+	// kube-apiserver and kubelet.  If a signer does not support the key type
+	// used for a given PodCertificateRequest, it must deny the request by
+	// setting a status.conditions entry with a type of "Denied" and a reason of
+	// "UnsupportedKeyType". It may also suggest a key type that it does support
+	// in the message field.
+	//
+	// +required
+	StubPKCS10Request []byte `json:"stubPKCS10Request" protobuf:"bytes,12,opt,name=stubPKCS10Request"`
+
+	// unverifiedUserAnnotations allow pod authors to pass additional information to
+	// the signer implementation.  Kubernetes does not restrict or validate this
+	// metadata in any way.
+	//
+	// Entries are subject to the same validation as object metadata annotations,
+	// with the addition that all keys must be domain-prefixed. No restrictions
+	// are placed on values, except an overall size limitation on the entire field.
+	//
+	// Signers should document the keys and values they support.  Signers should
+	// deny requests that contain keys they do not recognize.
+	//
+	// +optional
+	UnverifiedUserAnnotations map[string]string `json:"unverifiedUserAnnotations,omitempty" protobuf:"bytes,11,opt,name=unverifiedUserAnnotations"`
+}
+
+// PodCertificateRequestStatus describes the status of the request, and holds
+// the certificate data if the request is issued.
+type PodCertificateRequestStatus struct {
+	// conditions applied to the request.
+	//
+	// The types "Issued", "Denied", and "Failed" have special handling.  At
+	// most one of these conditions may be present, and they must have status
+	// "True".
+	//
+	// If the request is denied with `Reason=UnsupportedKeyType`, the signer may
+	// suggest a key type that will work in the message field.
+	//
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
+
+	// certificateChain is populated with an issued certificate by the signer.
+	// This field is set via the /status subresource. Once populated, this field
+	// is immutable.
+	//
+	// If the certificate signing request is denied, a condition of type
+	// "Denied" is added and this field remains empty. If the signer cannot
+	// issue the certificate, a condition of type "Failed" is added and this
+	// field remains empty.
+	//
+	// Validation requirements:
+	//  1. certificateChain must consist of one or more PEM-formatted certificates.
+	//  2. Each entry must be a valid PEM-wrapped, DER-encoded ASN.1 Certificate as
+	//     described in section 4 of RFC5280.
+	//
+	// If more than one block is present, and the definition of the requested
+	// spec.signerName does not indicate otherwise, the first block is the
+	// issued certificate, and subsequent blocks should be treated as
+	// intermediate certificates and presented in TLS handshakes.  When
+	// projecting the chain into a pod volume, kubelet will drop any data
+	// in-between the PEM blocks, as well as any PEM block headers.
+	//
+	// +optional
+	CertificateChain string `json:"certificateChain,omitempty" protobuf:"bytes,2,opt,name=certificateChain"`
+
+	// notBefore is the time at which the certificate becomes valid.  The value
+	// must be the same as the notBefore value in the leaf certificate in
+	// certificateChain.  This field is set via the /status subresource.  Once
+	// populated, it is immutable. The signer must set this field at the same
+	// time it sets certificateChain.
+	//
+	// +optional
+	NotBefore *metav1.Time `json:"notBefore,omitempty" protobuf:"bytes,4,opt,name=notBefore"`
+
+	// beginRefreshAt is the time at which the kubelet should begin trying to
+	// refresh the certificate.  This field is set via the /status subresource,
+	// and must be set at the same time as certificateChain.  Once populated,
+	// this field is immutable.
+	//
+	// This field is only a hint.  Kubelet may start refreshing before or after
+	// this time if necessary.
+	//
+	// +optional
+	BeginRefreshAt *metav1.Time `json:"beginRefreshAt,omitempty" protobuf:"bytes,5,opt,name=beginRefreshAt"`
+
+	// notAfter is the time at which the certificate expires.  The value must be
+	// the same as the notAfter value in the leaf certificate in
+	// certificateChain.  This field is set via the /status subresource.  Once
+	// populated, it is immutable.  The signer must set this field at the same
+	// time it sets certificateChain.
+	//
+	// +optional
+	NotAfter *metav1.Time `json:"notAfter,omitempty" protobuf:"bytes,6,opt,name=notAfter"`
+}
+
+// Well-known condition types for PodCertificateRequests
+const (
+	// Denied indicates the request was denied by the signer.
+	PodCertificateRequestConditionTypeDenied string = "Denied"
+	// Failed indicates the signer failed to issue the certificate.
+	PodCertificateRequestConditionTypeFailed string = "Failed"
+	// Issued indicates the certificate has been issued.
+	PodCertificateRequestConditionTypeIssued string = "Issued"
+)
+
+// Well-known condition reasons for PodCertificateRequests
+const (
+	// UnsupportedKeyType should be set on "Denied" conditions when the signer
+	// doesn't support the key type of publicKey.
+	PodCertificateRequestConditionUnsupportedKeyType string = "UnsupportedKeyType"
+
+	// InvalidUnverifiedUserAnnotations should be set on "Denied" conditions when the signer
+	// does not recognize one of the keys passed in userConfig, or if the signer
+	// otherwise considers the userConfig of the request to be invalid.
+	PodCertificateRequestConditionInvalidUserConfig string = "InvalidUnverifiedUserAnnotations"
+)
+
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// PodCertificateRequestList is a collection of PodCertificateRequest objects
+type PodCertificateRequestList struct {
+	metav1.TypeMeta `json:""`
+
+	// metadata contains the list metadata.
+	//
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// items is a collection of PodCertificateRequest objects
+	Items []PodCertificateRequest `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
diff --git a/vendor/k8s.io/api/certificates/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/certificates/v1/types_swagger_doc_generated.go
index 4bdf39ebb3..503de052a7 100644
--- a/vendor/k8s.io/api/certificates/v1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/certificates/v1/types_swagger_doc_generated.go
@@ -86,4 +86,86 @@ func (CertificateSigningRequestStatus) SwaggerDoc() map[string]string {
 	return map_CertificateSigningRequestStatus
 }
 
+var map_ClusterTrustBundle = map[string]string{
+	"":         "ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors (root certificates).\n\nClusterTrustBundle objects are considered to be readable by any authenticated user in the cluster, because they can be mounted by pods using the `clusterTrustBundle` projection.  All service accounts have read access to ClusterTrustBundles by default.  Users who only have namespace-level access to a cluster can read ClusterTrustBundles by impersonating a serviceaccount that they have access to.\n\nIt can be optionally associated with a particular signer, in which case it contains one valid set of trust anchors for that signer. Signers may have multiple associated ClusterTrustBundles; each is an independent set of trust anchors for that signer. Admission control is used to enforce that only users with permissions on the signer can create or modify the corresponding bundle.",
+	"metadata": "metadata contains the object metadata.",
+	"spec":     "spec contains the signer (if any) and trust anchors.",
+}
+
+func (ClusterTrustBundle) SwaggerDoc() map[string]string {
+	return map_ClusterTrustBundle
+}
+
+var map_ClusterTrustBundleList = map[string]string{
+	"":         "ClusterTrustBundleList is a collection of ClusterTrustBundle objects",
+	"metadata": "metadata contains the list metadata.",
+	"items":    "items is a collection of ClusterTrustBundle objects",
+}
+
+func (ClusterTrustBundleList) SwaggerDoc() map[string]string {
+	return map_ClusterTrustBundleList
+}
+
+var map_ClusterTrustBundleSpec = map[string]string{
+	"":            "ClusterTrustBundleSpec contains the signer and trust anchors.",
+	"signerName":  "signerName indicates the associated signer, if any.\n\nIn order to create or update a ClusterTrustBundle that sets signerName, you must have the following cluster-scoped permission: group=certificates.k8s.io resource=signers resourceName=<the signer name> verb=attest.\n\nIf signerName is not empty, then the ClusterTrustBundle object must be named with the signer name as a prefix (translating slashes to colons). For example, for the signer name `example.com/foo`, valid ClusterTrustBundle object names include `example.com:foo:abc` and `example.com:foo:v1`.\n\nIf signerName is empty, then the ClusterTrustBundle object's name must not have such a prefix.\n\nList/watch requests for ClusterTrustBundles can filter on this field using a `spec.signerName=NAME` field selector.",
+	"trustBundle": "trustBundle contains the individual X.509 trust anchors for this bundle, as PEM bundle of PEM-wrapped, DER-formatted X.509 certificates.\n\nThe data must consist only of PEM certificate blocks that parse as valid X.509 certificates.  Each certificate must include a basic constraints extension with the CA bit set.  The API server will reject objects that contain duplicate certificates, or that use PEM block headers.\n\nUsers of ClusterTrustBundles, including Kubelet, are free to reorder and deduplicate certificate blocks in this file according to their own logic, as well as to drop PEM block headers and inter-block data.",
+}
+
+func (ClusterTrustBundleSpec) SwaggerDoc() map[string]string {
+	return map_ClusterTrustBundleSpec
+}
+
+var map_PodCertificateRequest = map[string]string{
+	"":         "PodCertificateRequest encodes a pod requesting a certificate from a given signer.\n\nKubelets use this API to implement podCertificate projected volumes",
+	"metadata": "metadata contains the object metadata.",
+	"spec":     "spec contains the details about the certificate being requested.",
+	"status":   "status contains the issued certificate, and a standard set of conditions.",
+}
+
+func (PodCertificateRequest) SwaggerDoc() map[string]string {
+	return map_PodCertificateRequest
+}
+
+var map_PodCertificateRequestList = map[string]string{
+	"":         "PodCertificateRequestList is a collection of PodCertificateRequest objects",
+	"metadata": "metadata contains the list metadata.",
+	"items":    "items is a collection of PodCertificateRequest objects",
+}
+
+func (PodCertificateRequestList) SwaggerDoc() map[string]string {
+	return map_PodCertificateRequestList
+}
+
+var map_PodCertificateRequestSpec = map[string]string{
+	"":                          "PodCertificateRequestSpec describes the certificate request.  All fields are immutable after creation.",
+	"signerName":                "signerName indicates the requested signer.\n\nAll signer names beginning with `kubernetes.io` are reserved for use by the Kubernetes project.  There is currently one well-known signer documented by the Kubernetes project, `kubernetes.io/kube-apiserver-client-pod`, which will issue client certificates understood by kube-apiserver.  It is currently unimplemented.",
+	"podName":                   "podName is the name of the pod into which the certificate will be mounted.",
+	"podUID":                    "podUID is the UID of the pod into which the certificate will be mounted.",
+	"serviceAccountName":        "serviceAccountName is the name of the service account the pod is running as.",
+	"serviceAccountUID":         "serviceAccountUID is the UID of the service account the pod is running as.",
+	"nodeName":                  "nodeName is the name of the node the pod is assigned to.",
+	"nodeUID":                   "nodeUID is the UID of the node the pod is assigned to.",
+	"maxExpirationSeconds":      "maxExpirationSeconds is the maximum lifetime permitted for the certificate.\n\nIf omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver will reject values shorter than 3600 (1 hour).  The maximum allowable value is 7862400 (91 days).\n\nThe signer implementation is then free to issue a certificate with any lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 seconds (1 hour).  This constraint is enforced by kube-apiserver. `kubernetes.io` signers will never issue certificates with a lifetime longer than 24 hours.",
+	"stubPKCS10Request":         "A PKCS#10 certificate signing request (DER-serialized) generated by Kubelet using the subject private key.\n\nMost signer implementations will ignore the contents of the CSR except to extract the subject public key. The API server automatically verifies the CSR signature during admission, so the signer does not need to repeat the verification.  CSRs generated by kubelet are completely empty.\n\nThe subject public key must be one of RSA3072, RSA4096, ECDSAP256, ECDSAP384, ECDSAP521, or ED25519. Note that this list may be expanded in the future.\n\nSigner implementations do not need to support all key types supported by kube-apiserver and kubelet.  If a signer does not support the key type used for a given PodCertificateRequest, it must deny the request by setting a status.conditions entry with a type of \"Denied\" and a reason of \"UnsupportedKeyType\". It may also suggest a key type that it does support in the message field.",
+	"unverifiedUserAnnotations": "unverifiedUserAnnotations allow pod authors to pass additional information to the signer implementation.  Kubernetes does not restrict or validate this metadata in any way.\n\nEntries are subject to the same validation as object metadata annotations, with the addition that all keys must be domain-prefixed. No restrictions are placed on values, except an overall size limitation on the entire field.\n\nSigners should document the keys and values they support.  Signers should deny requests that contain keys they do not recognize.",
+}
+
+func (PodCertificateRequestSpec) SwaggerDoc() map[string]string {
+	return map_PodCertificateRequestSpec
+}
+
+var map_PodCertificateRequestStatus = map[string]string{
+	"":                 "PodCertificateRequestStatus describes the status of the request, and holds the certificate data if the request is issued.",
+	"conditions":       "conditions applied to the request.\n\nThe types \"Issued\", \"Denied\", and \"Failed\" have special handling.  At most one of these conditions may be present, and they must have status \"True\".\n\nIf the request is denied with `Reason=UnsupportedKeyType`, the signer may suggest a key type that will work in the message field.",
+	"certificateChain": "certificateChain is populated with an issued certificate by the signer. This field is set via the /status subresource. Once populated, this field is immutable.\n\nIf the certificate signing request is denied, a condition of type \"Denied\" is added and this field remains empty. If the signer cannot issue the certificate, a condition of type \"Failed\" is added and this field remains empty.\n\nValidation requirements:\n 1. certificateChain must consist of one or more PEM-formatted certificates.\n 2. Each entry must be a valid PEM-wrapped, DER-encoded ASN.1 Certificate as\n    described in section 4 of RFC5280.\n\nIf more than one block is present, and the definition of the requested spec.signerName does not indicate otherwise, the first block is the issued certificate, and subsequent blocks should be treated as intermediate certificates and presented in TLS handshakes.  When projecting the chain into a pod volume, kubelet will drop any data in-between the PEM blocks, as well as any PEM block headers.",
+	"notBefore":        "notBefore is the time at which the certificate becomes valid.  The value must be the same as the notBefore value in the leaf certificate in certificateChain.  This field is set via the /status subresource.  Once populated, it is immutable. The signer must set this field at the same time it sets certificateChain.",
+	"beginRefreshAt":   "beginRefreshAt is the time at which the kubelet should begin trying to refresh the certificate.  This field is set via the /status subresource, and must be set at the same time as certificateChain.  Once populated, this field is immutable.\n\nThis field is only a hint.  Kubelet may start refreshing before or after this time if necessary.",
+	"notAfter":         "notAfter is the time at which the certificate expires.  The value must be the same as the notAfter value in the leaf certificate in certificateChain.  This field is set via the /status subresource.  Once populated, it is immutable.  The signer must set this field at the same time it sets certificateChain.",
+}
+
+func (PodCertificateRequestStatus) SwaggerDoc() map[string]string {
+	return map_PodCertificateRequestStatus
+}
+
 // AUTO-GENERATED FUNCTIONS END HERE
diff --git a/vendor/k8s.io/api/certificates/v1/zz_generated.deepcopy.go b/vendor/k8s.io/api/certificates/v1/zz_generated.deepcopy.go
index aefa604117..b25937758d 100644
--- a/vendor/k8s.io/api/certificates/v1/zz_generated.deepcopy.go
+++ b/vendor/k8s.io/api/certificates/v1/zz_generated.deepcopy.go
@@ -22,6 +22,7 @@ limitations under the License.
 package v1
 
 import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
@@ -183,6 +184,82 @@ func (in *CertificateSigningRequestStatus) DeepCopy() *CertificateSigningRequest
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterTrustBundle) DeepCopyInto(out *ClusterTrustBundle) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Spec = in.Spec
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTrustBundle.
+func (in *ClusterTrustBundle) DeepCopy() *ClusterTrustBundle {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterTrustBundle)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterTrustBundle) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterTrustBundleList) DeepCopyInto(out *ClusterTrustBundleList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ClusterTrustBundle, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTrustBundleList.
+func (in *ClusterTrustBundleList) DeepCopy() *ClusterTrustBundleList {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterTrustBundleList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterTrustBundleList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterTrustBundleSpec) DeepCopyInto(out *ClusterTrustBundleSpec) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTrustBundleSpec.
+func (in *ClusterTrustBundleSpec) DeepCopy() *ClusterTrustBundleSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterTrustBundleSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in ExtraValue) DeepCopyInto(out *ExtraValue) {
 	{
@@ -202,3 +279,132 @@ func (in ExtraValue) DeepCopy() ExtraValue {
 	in.DeepCopyInto(out)
 	return *out
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodCertificateRequest) DeepCopyInto(out *PodCertificateRequest) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodCertificateRequest.
+func (in *PodCertificateRequest) DeepCopy() *PodCertificateRequest {
+	if in == nil {
+		return nil
+	}
+	out := new(PodCertificateRequest)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PodCertificateRequest) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodCertificateRequestList) DeepCopyInto(out *PodCertificateRequestList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]PodCertificateRequest, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodCertificateRequestList.
+func (in *PodCertificateRequestList) DeepCopy() *PodCertificateRequestList {
+	if in == nil {
+		return nil
+	}
+	out := new(PodCertificateRequestList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PodCertificateRequestList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodCertificateRequestSpec) DeepCopyInto(out *PodCertificateRequestSpec) {
+	*out = *in
+	if in.MaxExpirationSeconds != nil {
+		in, out := &in.MaxExpirationSeconds, &out.MaxExpirationSeconds
+		*out = new(int32)
+		**out = **in
+	}
+	if in.StubPKCS10Request != nil {
+		in, out := &in.StubPKCS10Request, &out.StubPKCS10Request
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.UnverifiedUserAnnotations != nil {
+		in, out := &in.UnverifiedUserAnnotations, &out.UnverifiedUserAnnotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodCertificateRequestSpec.
+func (in *PodCertificateRequestSpec) DeepCopy() *PodCertificateRequestSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(PodCertificateRequestSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodCertificateRequestStatus) DeepCopyInto(out *PodCertificateRequestStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]metav1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.NotBefore != nil {
+		in, out := &in.NotBefore, &out.NotBefore
+		*out = (*in).DeepCopy()
+	}
+	if in.BeginRefreshAt != nil {
+		in, out := &in.BeginRefreshAt, &out.BeginRefreshAt
+		*out = (*in).DeepCopy()
+	}
+	if in.NotAfter != nil {
+		in, out := &in.NotAfter, &out.NotAfter
+		*out = (*in).DeepCopy()
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodCertificateRequestStatus.
+func (in *PodCertificateRequestStatus) DeepCopy() *PodCertificateRequestStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(PodCertificateRequestStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/vendor/k8s.io/api/certificates/v1/zz_generated.model_name.go b/vendor/k8s.io/api/certificates/v1/zz_generated.model_name.go
index 9c7ad07a2c..73457044cc 100644
--- a/vendor/k8s.io/api/certificates/v1/zz_generated.model_name.go
+++ b/vendor/k8s.io/api/certificates/v1/zz_generated.model_name.go
@@ -45,3 +45,38 @@ func (in CertificateSigningRequestSpec) OpenAPIModelName() string {
 func (in CertificateSigningRequestStatus) OpenAPIModelName() string {
 	return "io.k8s.api.certificates.v1.CertificateSigningRequestStatus"
 }
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ClusterTrustBundle) OpenAPIModelName() string {
+	return "io.k8s.api.certificates.v1.ClusterTrustBundle"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ClusterTrustBundleList) OpenAPIModelName() string {
+	return "io.k8s.api.certificates.v1.ClusterTrustBundleList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ClusterTrustBundleSpec) OpenAPIModelName() string {
+	return "io.k8s.api.certificates.v1.ClusterTrustBundleSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodCertificateRequest) OpenAPIModelName() string {
+	return "io.k8s.api.certificates.v1.PodCertificateRequest"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodCertificateRequestList) OpenAPIModelName() string {
+	return "io.k8s.api.certificates.v1.PodCertificateRequestList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodCertificateRequestSpec) OpenAPIModelName() string {
+	return "io.k8s.api.certificates.v1.PodCertificateRequestSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodCertificateRequestStatus) OpenAPIModelName() string {
+	return "io.k8s.api.certificates.v1.PodCertificateRequestStatus"
+}
diff --git a/vendor/k8s.io/api/certificates/v1/zz_generated.prerelease-lifecycle.go b/vendor/k8s.io/api/certificates/v1/zz_generated.prerelease-lifecycle.go
index 3a2b274030..522a9bee5d 100644
--- a/vendor/k8s.io/api/certificates/v1/zz_generated.prerelease-lifecycle.go
+++ b/vendor/k8s.io/api/certificates/v1/zz_generated.prerelease-lifecycle.go
@@ -32,3 +32,27 @@ func (in *CertificateSigningRequest) APILifecycleIntroduced() (major, minor int)
 func (in *CertificateSigningRequestList) APILifecycleIntroduced() (major, minor int) {
 	return 1, 19
 }
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *ClusterTrustBundle) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *ClusterTrustBundleList) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *PodCertificateRequest) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *PodCertificateRequestList) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
diff --git a/vendor/k8s.io/api/certificates/v1alpha1/generated.proto b/vendor/k8s.io/api/certificates/v1alpha1/generated.proto
index 7155f778cf..914d8e269d 100644
--- a/vendor/k8s.io/api/certificates/v1alpha1/generated.proto
+++ b/vendor/k8s.io/api/certificates/v1alpha1/generated.proto
@@ -38,7 +38,7 @@ option go_package = "k8s.io/api/certificates/v1alpha1";
 // to a cluster can read ClusterTrustBundles by impersonating a serviceaccount
 // that they have access to.
 //
-// It can be optionally associated with a particular assigner, in which case it
+// It can be optionally associated with a particular signer, in which case it
 // contains one valid set of trust anchors for that signer. Signers may have
 // multiple associated ClusterTrustBundles; each is an independent set of trust
 // anchors for that signer. Admission control is used to enforce that only users
@@ -85,6 +85,8 @@ message ClusterTrustBundleSpec {
   // using a `spec.signerName=NAME` field selector.
   //
   // +optional
+  // +k8s:alpha(since:"1.37")=+k8s:optional
+  // +k8s:alpha(since:"1.37")=+k8s:immutable
   optional string signerName = 1;
 
   // trustBundle contains the individual X.509 trust anchors for this
diff --git a/vendor/k8s.io/api/certificates/v1alpha1/types.go b/vendor/k8s.io/api/certificates/v1alpha1/types.go
index beef02599d..bdac6657cc 100644
--- a/vendor/k8s.io/api/certificates/v1alpha1/types.go
+++ b/vendor/k8s.io/api/certificates/v1alpha1/types.go
@@ -36,13 +36,13 @@ import (
 // to a cluster can read ClusterTrustBundles by impersonating a serviceaccount
 // that they have access to.
 //
-// It can be optionally associated with a particular assigner, in which case it
+// It can be optionally associated with a particular signer, in which case it
 // contains one valid set of trust anchors for that signer. Signers may have
 // multiple associated ClusterTrustBundles; each is an independent set of trust
 // anchors for that signer. Admission control is used to enforce that only users
 // with permissions on the signer can create or modify the corresponding bundle.
 type ClusterTrustBundle struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// metadata contains the object metadata.
 	// +optional
@@ -74,6 +74,8 @@ type ClusterTrustBundleSpec struct {
 	// using a `spec.signerName=NAME` field selector.
 	//
 	// +optional
+	// +k8s:alpha(since:"1.37")=+k8s:optional
+	// +k8s:alpha(since:"1.37")=+k8s:immutable
 	SignerName string `json:"signerName,omitempty" protobuf:"bytes,1,opt,name=signerName"`
 
 	// trustBundle contains the individual X.509 trust anchors for this
@@ -96,7 +98,7 @@ type ClusterTrustBundleSpec struct {
 
 // ClusterTrustBundleList is a collection of ClusterTrustBundle objects
 type ClusterTrustBundleList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// metadata contains the list metadata.
 	//
diff --git a/vendor/k8s.io/api/certificates/v1alpha1/types_swagger_doc_generated.go b/vendor/k8s.io/api/certificates/v1alpha1/types_swagger_doc_generated.go
index bff649e3cb..862897e97b 100644
--- a/vendor/k8s.io/api/certificates/v1alpha1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/certificates/v1alpha1/types_swagger_doc_generated.go
@@ -28,7 +28,7 @@ package v1alpha1
 
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_ClusterTrustBundle = map[string]string{
-	"":         "ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors (root certificates).\n\nClusterTrustBundle objects are considered to be readable by any authenticated user in the cluster, because they can be mounted by pods using the `clusterTrustBundle` projection.  All service accounts have read access to ClusterTrustBundles by default.  Users who only have namespace-level access to a cluster can read ClusterTrustBundles by impersonating a serviceaccount that they have access to.\n\nIt can be optionally associated with a particular assigner, in which case it contains one valid set of trust anchors for that signer. Signers may have multiple associated ClusterTrustBundles; each is an independent set of trust anchors for that signer. Admission control is used to enforce that only users with permissions on the signer can create or modify the corresponding bundle.",
+	"":         "ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors (root certificates).\n\nClusterTrustBundle objects are considered to be readable by any authenticated user in the cluster, because they can be mounted by pods using the `clusterTrustBundle` projection.  All service accounts have read access to ClusterTrustBundles by default.  Users who only have namespace-level access to a cluster can read ClusterTrustBundles by impersonating a serviceaccount that they have access to.\n\nIt can be optionally associated with a particular signer, in which case it contains one valid set of trust anchors for that signer. Signers may have multiple associated ClusterTrustBundles; each is an independent set of trust anchors for that signer. Admission control is used to enforce that only users with permissions on the signer can create or modify the corresponding bundle.",
 	"metadata": "metadata contains the object metadata.",
 	"spec":     "spec contains the signer (if any) and trust anchors.",
 }
diff --git a/vendor/k8s.io/api/certificates/v1beta1/generated.proto b/vendor/k8s.io/api/certificates/v1beta1/generated.proto
index cc46dee16d..25561abbc3 100644
--- a/vendor/k8s.io/api/certificates/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/certificates/v1beta1/generated.proto
@@ -183,12 +183,12 @@ message CertificateSigningRequestStatus {
   // +listType=map
   // +listMapKey=type
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:listType=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=type
-  // +k8s:alpha(since: "1.36")=+k8s:customUnique
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:item(type: "Approved")=+k8s:zeroOrOneOfMember
-  // +k8s:alpha(since: "1.36")=+k8s:item(type: "Denied")=+k8s:zeroOrOneOfMember
+  // +k8s:beta(since: "1.37")=+k8s:listType=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=type
+  // +k8s:beta(since: "1.37")=+k8s:customUnique
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:item(type: "Approved")=+k8s:zeroOrOneOfMember
+  // +k8s:beta(since: "1.37")=+k8s:item(type: "Denied")=+k8s:zeroOrOneOfMember
   repeated CertificateSigningRequestCondition conditions = 1;
 
   // If request was approved, the controller will place the issued certificate here.
@@ -206,7 +206,7 @@ message CertificateSigningRequestStatus {
 // to a cluster can read ClusterTrustBundles by impersonating a serviceaccount
 // that they have access to.
 //
-// It can be optionally associated with a particular assigner, in which case it
+// It can be optionally associated with a particular signer, in which case it
 // contains one valid set of trust anchors for that signer. Signers may have
 // multiple associated ClusterTrustBundles; each is an independent set of trust
 // anchors for that signer. Admission control is used to enforce that only users
@@ -253,6 +253,8 @@ message ClusterTrustBundleSpec {
   // using a `spec.signerName=NAME` field selector.
   //
   // +optional
+  // +k8s:alpha(since:"1.37")=+k8s:optional
+  // +k8s:alpha(since:"1.37")=+k8s:immutable
   optional string signerName = 1;
 
   // trustBundle contains the individual X.509 trust anchors for this
@@ -282,6 +284,7 @@ message ExtraValue {
 // signer.
 //
 // Kubelets use this API to implement podCertificate projected volumes
+// +k8s:supportsSubresource="/status"
 message PodCertificateRequest {
   // metadata contains the object metadata.
   //
@@ -467,6 +470,9 @@ message PodCertificateRequestStatus {
   // +listType=map
   // +listMapKey=type
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 1;
 
   // certificateChain is populated with an issued certificate by the signer.
diff --git a/vendor/k8s.io/api/certificates/v1beta1/types.go b/vendor/k8s.io/api/certificates/v1beta1/types.go
index e8ffa41e6d..eaa77c194d 100644
--- a/vendor/k8s.io/api/certificates/v1beta1/types.go
+++ b/vendor/k8s.io/api/certificates/v1beta1/types.go
@@ -35,7 +35,7 @@ import (
 // +k8s:supportsSubresource="/status"
 // +k8s:supportsSubresource="/approval"
 type CertificateSigningRequest struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
@@ -177,12 +177,12 @@ type CertificateSigningRequestStatus struct {
 	// +listType=map
 	// +listMapKey=type
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:listType=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=type
-	// +k8s:alpha(since: "1.36")=+k8s:customUnique
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:item(type: "Approved")=+k8s:zeroOrOneOfMember
-	// +k8s:alpha(since: "1.36")=+k8s:item(type: "Denied")=+k8s:zeroOrOneOfMember
+	// +k8s:beta(since: "1.37")=+k8s:listType=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=type
+	// +k8s:beta(since: "1.37")=+k8s:customUnique
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:item(type: "Approved")=+k8s:zeroOrOneOfMember
+	// +k8s:beta(since: "1.37")=+k8s:item(type: "Denied")=+k8s:zeroOrOneOfMember
 	Conditions []CertificateSigningRequestCondition `json:"conditions,omitempty" protobuf:"bytes,1,rep,name=conditions"`
 
 	// If request was approved, the controller will place the issued certificate here.
@@ -230,7 +230,7 @@ type CertificateSigningRequestCondition struct {
 // +k8s:prerelease-lifecycle-gen:replacement=certificates.k8s.io,v1,CertificateSigningRequestList
 
 type CertificateSigningRequestList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
@@ -274,6 +274,7 @@ const (
 // +genclient:nonNamespaced
 // +k8s:prerelease-lifecycle-gen:introduced=1.33
 // +k8s:prerelease-lifecycle-gen:deprecated=1.37
+// +k8s:prerelease-lifecycle-gen:replacement=certificates.k8s.io,v1,ClusterTrustBundle
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
 // ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors
@@ -286,13 +287,13 @@ const (
 // to a cluster can read ClusterTrustBundles by impersonating a serviceaccount
 // that they have access to.
 //
-// It can be optionally associated with a particular assigner, in which case it
+// It can be optionally associated with a particular signer, in which case it
 // contains one valid set of trust anchors for that signer. Signers may have
 // multiple associated ClusterTrustBundles; each is an independent set of trust
 // anchors for that signer. Admission control is used to enforce that only users
 // with permissions on the signer can create or modify the corresponding bundle.
 type ClusterTrustBundle struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// metadata contains the object metadata.
 	// +optional
@@ -324,6 +325,8 @@ type ClusterTrustBundleSpec struct {
 	// using a `spec.signerName=NAME` field selector.
 	//
 	// +optional
+	// +k8s:alpha(since:"1.37")=+k8s:optional
+	// +k8s:alpha(since:"1.37")=+k8s:immutable
 	SignerName string `json:"signerName,omitempty" protobuf:"bytes,1,opt,name=signerName"`
 
 	// trustBundle contains the individual X.509 trust anchors for this
@@ -342,11 +345,12 @@ type ClusterTrustBundleSpec struct {
 
 // +k8s:prerelease-lifecycle-gen:introduced=1.33
 // +k8s:prerelease-lifecycle-gen:deprecated=1.37
+// +k8s:prerelease-lifecycle-gen:replacement=certificates.k8s.io,v1,ClusterTrustBundleList
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
 // ClusterTrustBundleList is a collection of ClusterTrustBundle objects
 type ClusterTrustBundleList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// metadata contains the list metadata.
 	//
@@ -359,14 +363,17 @@ type ClusterTrustBundleList struct {
 
 // +genclient
 // +k8s:prerelease-lifecycle-gen:introduced=1.35
+// +k8s:prerelease-lifecycle-gen:deprecated=1.37
+// +k8s:prerelease-lifecycle-gen:replacement=certificates.k8s.io,v1,PodCertificateRequest
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
 // PodCertificateRequest encodes a pod requesting a certificate from a given
 // signer.
 //
 // Kubelets use this API to implement podCertificate projected volumes
+// +k8s:supportsSubresource="/status"
 type PodCertificateRequest struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// metadata contains the object metadata.
 	//
@@ -538,6 +545,9 @@ type PodCertificateRequestStatus struct {
 	// +listType=map
 	// +listMapKey=type
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
 
 	// certificateChain is populated with an issued certificate by the signer.
@@ -618,10 +628,12 @@ const (
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +k8s:prerelease-lifecycle-gen:introduced=1.35
+// +k8s:prerelease-lifecycle-gen:deprecated=1.37
+// +k8s:prerelease-lifecycle-gen:replacement=certificates.k8s.io,v1,PodCertificateRequestList
 
 // PodCertificateRequestList is a collection of PodCertificateRequest objects
 type PodCertificateRequestList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// metadata contains the list metadata.
 	//
diff --git a/vendor/k8s.io/api/certificates/v1beta1/types_swagger_doc_generated.go b/vendor/k8s.io/api/certificates/v1beta1/types_swagger_doc_generated.go
index cad8768a59..c5352a7aca 100644
--- a/vendor/k8s.io/api/certificates/v1beta1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/certificates/v1beta1/types_swagger_doc_generated.go
@@ -76,7 +76,7 @@ func (CertificateSigningRequestStatus) SwaggerDoc() map[string]string {
 }
 
 var map_ClusterTrustBundle = map[string]string{
-	"":         "ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors (root certificates).\n\nClusterTrustBundle objects are considered to be readable by any authenticated user in the cluster, because they can be mounted by pods using the `clusterTrustBundle` projection.  All service accounts have read access to ClusterTrustBundles by default.  Users who only have namespace-level access to a cluster can read ClusterTrustBundles by impersonating a serviceaccount that they have access to.\n\nIt can be optionally associated with a particular assigner, in which case it contains one valid set of trust anchors for that signer. Signers may have multiple associated ClusterTrustBundles; each is an independent set of trust anchors for that signer. Admission control is used to enforce that only users with permissions on the signer can create or modify the corresponding bundle.",
+	"":         "ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors (root certificates).\n\nClusterTrustBundle objects are considered to be readable by any authenticated user in the cluster, because they can be mounted by pods using the `clusterTrustBundle` projection.  All service accounts have read access to ClusterTrustBundles by default.  Users who only have namespace-level access to a cluster can read ClusterTrustBundles by impersonating a serviceaccount that they have access to.\n\nIt can be optionally associated with a particular signer, in which case it contains one valid set of trust anchors for that signer. Signers may have multiple associated ClusterTrustBundles; each is an independent set of trust anchors for that signer. Admission control is used to enforce that only users with permissions on the signer can create or modify the corresponding bundle.",
 	"metadata": "metadata contains the object metadata.",
 	"spec":     "spec contains the signer (if any) and trust anchors.",
 }
diff --git a/vendor/k8s.io/api/certificates/v1beta1/zz_generated.prerelease-lifecycle.go b/vendor/k8s.io/api/certificates/v1beta1/zz_generated.prerelease-lifecycle.go
index d541ffb005..3b6f17e3e5 100644
--- a/vendor/k8s.io/api/certificates/v1beta1/zz_generated.prerelease-lifecycle.go
+++ b/vendor/k8s.io/api/certificates/v1beta1/zz_generated.prerelease-lifecycle.go
@@ -85,6 +85,12 @@ func (in *ClusterTrustBundle) APILifecycleDeprecated() (major, minor int) {
 	return 1, 37
 }
 
+// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
+// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
+func (in *ClusterTrustBundle) APILifecycleReplacement() schema.GroupVersionKind {
+	return schema.GroupVersionKind{Group: "certificates.k8s.io", Version: "v1", Kind: "ClusterTrustBundle"}
+}
+
 // APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
 // It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
 func (in *ClusterTrustBundle) APILifecycleRemoved() (major, minor int) {
@@ -103,6 +109,12 @@ func (in *ClusterTrustBundleList) APILifecycleDeprecated() (major, minor int) {
 	return 1, 37
 }
 
+// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
+// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
+func (in *ClusterTrustBundleList) APILifecycleReplacement() schema.GroupVersionKind {
+	return schema.GroupVersionKind{Group: "certificates.k8s.io", Version: "v1", Kind: "ClusterTrustBundleList"}
+}
+
 // APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
 // It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
 func (in *ClusterTrustBundleList) APILifecycleRemoved() (major, minor int) {
@@ -118,13 +130,19 @@ func (in *PodCertificateRequest) APILifecycleIntroduced() (major, minor int) {
 // APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
 // It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or  "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
 func (in *PodCertificateRequest) APILifecycleDeprecated() (major, minor int) {
-	return 1, 38
+	return 1, 37
+}
+
+// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
+// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
+func (in *PodCertificateRequest) APILifecycleReplacement() schema.GroupVersionKind {
+	return schema.GroupVersionKind{Group: "certificates.k8s.io", Version: "v1", Kind: "PodCertificateRequest"}
 }
 
 // APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
 // It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
 func (in *PodCertificateRequest) APILifecycleRemoved() (major, minor int) {
-	return 1, 41
+	return 1, 40
 }
 
 // APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
@@ -136,11 +154,17 @@ func (in *PodCertificateRequestList) APILifecycleIntroduced() (major, minor int)
 // APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
 // It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or  "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
 func (in *PodCertificateRequestList) APILifecycleDeprecated() (major, minor int) {
-	return 1, 38
+	return 1, 37
+}
+
+// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
+// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
+func (in *PodCertificateRequestList) APILifecycleReplacement() schema.GroupVersionKind {
+	return schema.GroupVersionKind{Group: "certificates.k8s.io", Version: "v1", Kind: "PodCertificateRequestList"}
 }
 
 // APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
 // It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
 func (in *PodCertificateRequestList) APILifecycleRemoved() (major, minor int) {
-	return 1, 41
+	return 1, 40
 }
diff --git a/vendor/k8s.io/api/coordination/v1/generated.proto b/vendor/k8s.io/api/coordination/v1/generated.proto
index 4d4f7e08f4..75f1c9acff 100644
--- a/vendor/k8s.io/api/coordination/v1/generated.proto
+++ b/vendor/k8s.io/api/coordination/v1/generated.proto
@@ -30,6 +30,7 @@ option go_package = "k8s.io/api/coordination/v1";
 
 // Lease defines a lease concept.
 message Lease {
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -79,14 +80,14 @@ message LeaseSpec {
   // +optional
   optional int32 leaseTransitions = 5;
 
-  // Strategy indicates the strategy for picking the leader for coordinated leader election.
+  // strategy indicates the strategy for picking the leader for coordinated leader election.
   // If the field is not specified, there is no active coordination for this lease.
   // (Alpha) Using this field requires the CoordinatedLeaderElection feature gate to be enabled.
   // +featureGate=CoordinatedLeaderElection
   // +optional
   optional string strategy = 6;
 
-  // PreferredHolder signals to a lease holder that the lease has a
+  // preferredHolder signals to a lease holder that the lease has a
   // more optimal holder and should be given up.
   // This field can only be set if Strategy is also set.
   // +featureGate=CoordinatedLeaderElection
diff --git a/vendor/k8s.io/api/coordination/v1/types.go b/vendor/k8s.io/api/coordination/v1/types.go
index 5307cea88f..297ec32cb9 100644
--- a/vendor/k8s.io/api/coordination/v1/types.go
+++ b/vendor/k8s.io/api/coordination/v1/types.go
@@ -38,7 +38,8 @@ const (
 
 // Lease defines a lease concept.
 type Lease struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -72,13 +73,13 @@ type LeaseSpec struct {
 	// holders.
 	// +optional
 	LeaseTransitions *int32 `json:"leaseTransitions,omitempty" protobuf:"varint,5,opt,name=leaseTransitions"`
-	// Strategy indicates the strategy for picking the leader for coordinated leader election.
+	// strategy indicates the strategy for picking the leader for coordinated leader election.
 	// If the field is not specified, there is no active coordination for this lease.
 	// (Alpha) Using this field requires the CoordinatedLeaderElection feature gate to be enabled.
 	// +featureGate=CoordinatedLeaderElection
 	// +optional
 	Strategy *CoordinatedLeaseStrategy `json:"strategy,omitempty" protobuf:"bytes,6,opt,name=strategy"`
-	// PreferredHolder signals to a lease holder that the lease has a
+	// preferredHolder signals to a lease holder that the lease has a
 	// more optimal holder and should be given up.
 	// This field can only be set if Strategy is also set.
 	// +featureGate=CoordinatedLeaderElection
@@ -91,7 +92,7 @@ type LeaseSpec struct {
 
 // LeaseList is a list of Lease objects.
 type LeaseList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
diff --git a/vendor/k8s.io/api/coordination/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/coordination/v1/types_swagger_doc_generated.go
index 6c1a7ea8b9..c8bdb1e42e 100644
--- a/vendor/k8s.io/api/coordination/v1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/coordination/v1/types_swagger_doc_generated.go
@@ -29,7 +29,7 @@ package v1
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_Lease = map[string]string{
 	"":         "Lease defines a lease concept.",
-	"metadata": "More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec contains the specification of the Lease. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 }
 
@@ -54,8 +54,8 @@ var map_LeaseSpec = map[string]string{
 	"acquireTime":          "acquireTime is a time when the current lease was acquired.",
 	"renewTime":            "renewTime is a time when the current holder of a lease has last updated the lease.",
 	"leaseTransitions":     "leaseTransitions is the number of transitions of a lease between holders.",
-	"strategy":             "Strategy indicates the strategy for picking the leader for coordinated leader election. If the field is not specified, there is no active coordination for this lease. (Alpha) Using this field requires the CoordinatedLeaderElection feature gate to be enabled.",
-	"preferredHolder":      "PreferredHolder signals to a lease holder that the lease has a more optimal holder and should be given up. This field can only be set if Strategy is also set.",
+	"strategy":             "strategy indicates the strategy for picking the leader for coordinated leader election. If the field is not specified, there is no active coordination for this lease. (Alpha) Using this field requires the CoordinatedLeaderElection feature gate to be enabled.",
+	"preferredHolder":      "preferredHolder signals to a lease holder that the lease has a more optimal holder and should be given up. This field can only be set if Strategy is also set.",
 }
 
 func (LeaseSpec) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/coordination/v1alpha2/generated.proto b/vendor/k8s.io/api/coordination/v1alpha2/generated.proto
index 379fcf0d5d..7e1c0e0efa 100644
--- a/vendor/k8s.io/api/coordination/v1alpha2/generated.proto
+++ b/vendor/k8s.io/api/coordination/v1alpha2/generated.proto
@@ -32,6 +32,7 @@ option go_package = "k8s.io/api/coordination/v1alpha2";
 // LeaseCandidate defines a candidate for a Lease object.
 // Candidates are created such that coordinated leader election will pick the best leader from the list of candidates.
 message LeaseCandidate {
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -55,19 +56,19 @@ message LeaseCandidateList {
 
 // LeaseCandidateSpec is a specification of a Lease.
 message LeaseCandidateSpec {
-  // LeaseName is the name of the lease for which this candidate is contending.
+  // leaseName is the name of the lease for which this candidate is contending.
   // This field is immutable.
   // +required
   optional string leaseName = 1;
 
-  // PingTime is the last time that the server has requested the LeaseCandidate
+  // pingTime is the last time that the server has requested the LeaseCandidate
   // to renew. It is only done during leader election to check if any
   // LeaseCandidates have become ineligible. When PingTime is updated, the
   // LeaseCandidate will respond by updating RenewTime.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime pingTime = 2;
 
-  // RenewTime is the time that the LeaseCandidate was last updated.
+  // renewTime is the time that the LeaseCandidate was last updated.
   // Any time a Lease needs to do leader election, the PingTime field
   // is updated to signal to the LeaseCandidate that they should update
   // the RenewTime.
@@ -77,18 +78,18 @@ message LeaseCandidateSpec {
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime renewTime = 3;
 
-  // BinaryVersion is the binary version. It must be in a semver format without leading `v`.
+  // binaryVersion is the binary version. It must be in a semver format without leading `v`.
   // This field is required.
   // +required
   optional string binaryVersion = 4;
 
-  // EmulationVersion is the emulation version. It must be in a semver format without leading `v`.
+  // emulationVersion is the emulation version. It must be in a semver format without leading `v`.
   // EmulationVersion must be less than or equal to BinaryVersion.
   // This field is required when strategy is "OldestEmulationVersion"
   // +optional
   optional string emulationVersion = 5;
 
-  // Strategy is the strategy that coordinated leader election will use for picking the leader.
+  // strategy is the strategy that coordinated leader election will use for picking the leader.
   // If multiple candidates for the same Lease return different strategies, the strategy provided
   // by the candidate with the latest BinaryVersion will be used. If there is still conflict,
   // this is a user error and coordinated leader election will not operate the Lease until resolved.
diff --git a/vendor/k8s.io/api/coordination/v1alpha2/types.go b/vendor/k8s.io/api/coordination/v1alpha2/types.go
index f8a6d33af1..ff32ee16fb 100644
--- a/vendor/k8s.io/api/coordination/v1alpha2/types.go
+++ b/vendor/k8s.io/api/coordination/v1alpha2/types.go
@@ -28,7 +28,8 @@ import (
 // LeaseCandidate defines a candidate for a Lease object.
 // Candidates are created such that coordinated leader election will pick the best leader from the list of candidates.
 type LeaseCandidate struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -41,17 +42,17 @@ type LeaseCandidate struct {
 
 // LeaseCandidateSpec is a specification of a Lease.
 type LeaseCandidateSpec struct {
-	// LeaseName is the name of the lease for which this candidate is contending.
+	// leaseName is the name of the lease for which this candidate is contending.
 	// This field is immutable.
 	// +required
 	LeaseName string `json:"leaseName" protobuf:"bytes,1,name=leaseName"`
-	// PingTime is the last time that the server has requested the LeaseCandidate
+	// pingTime is the last time that the server has requested the LeaseCandidate
 	// to renew. It is only done during leader election to check if any
 	// LeaseCandidates have become ineligible. When PingTime is updated, the
 	// LeaseCandidate will respond by updating RenewTime.
 	// +optional
 	PingTime *metav1.MicroTime `json:"pingTime,omitempty" protobuf:"bytes,2,opt,name=pingTime"`
-	// RenewTime is the time that the LeaseCandidate was last updated.
+	// renewTime is the time that the LeaseCandidate was last updated.
 	// Any time a Lease needs to do leader election, the PingTime field
 	// is updated to signal to the LeaseCandidate that they should update
 	// the RenewTime.
@@ -60,16 +61,16 @@ type LeaseCandidateSpec struct {
 	// garbage collection for still active LeaseCandidates.
 	// +optional
 	RenewTime *metav1.MicroTime `json:"renewTime,omitempty" protobuf:"bytes,3,opt,name=renewTime"`
-	// BinaryVersion is the binary version. It must be in a semver format without leading `v`.
+	// binaryVersion is the binary version. It must be in a semver format without leading `v`.
 	// This field is required.
 	// +required
 	BinaryVersion string `json:"binaryVersion" protobuf:"bytes,4,name=binaryVersion"`
-	// EmulationVersion is the emulation version. It must be in a semver format without leading `v`.
+	// emulationVersion is the emulation version. It must be in a semver format without leading `v`.
 	// EmulationVersion must be less than or equal to BinaryVersion.
 	// This field is required when strategy is "OldestEmulationVersion"
 	// +optional
 	EmulationVersion string `json:"emulationVersion,omitempty" protobuf:"bytes,5,opt,name=emulationVersion"`
-	// Strategy is the strategy that coordinated leader election will use for picking the leader.
+	// strategy is the strategy that coordinated leader election will use for picking the leader.
 	// If multiple candidates for the same Lease return different strategies, the strategy provided
 	// by the candidate with the latest BinaryVersion will be used. If there is still conflict,
 	// this is a user error and coordinated leader election will not operate the Lease until resolved.
@@ -82,7 +83,7 @@ type LeaseCandidateSpec struct {
 
 // LeaseCandidateList is a list of Lease objects.
 type LeaseCandidateList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
diff --git a/vendor/k8s.io/api/coordination/v1alpha2/types_swagger_doc_generated.go b/vendor/k8s.io/api/coordination/v1alpha2/types_swagger_doc_generated.go
index f7e29849e4..2ab18a6f6b 100644
--- a/vendor/k8s.io/api/coordination/v1alpha2/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/coordination/v1alpha2/types_swagger_doc_generated.go
@@ -29,7 +29,7 @@ package v1alpha2
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_LeaseCandidate = map[string]string{
 	"":         "LeaseCandidate defines a candidate for a Lease object. Candidates are created such that coordinated leader election will pick the best leader from the list of candidates.",
-	"metadata": "More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec contains the specification of the Lease. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 }
 
@@ -49,12 +49,12 @@ func (LeaseCandidateList) SwaggerDoc() map[string]string {
 
 var map_LeaseCandidateSpec = map[string]string{
 	"":                 "LeaseCandidateSpec is a specification of a Lease.",
-	"leaseName":        "LeaseName is the name of the lease for which this candidate is contending. This field is immutable.",
-	"pingTime":         "PingTime is the last time that the server has requested the LeaseCandidate to renew. It is only done during leader election to check if any LeaseCandidates have become ineligible. When PingTime is updated, the LeaseCandidate will respond by updating RenewTime.",
-	"renewTime":        "RenewTime is the time that the LeaseCandidate was last updated. Any time a Lease needs to do leader election, the PingTime field is updated to signal to the LeaseCandidate that they should update the RenewTime. Old LeaseCandidate objects are also garbage collected if it has been hours since the last renew. The PingTime field is updated regularly to prevent garbage collection for still active LeaseCandidates.",
-	"binaryVersion":    "BinaryVersion is the binary version. It must be in a semver format without leading `v`. This field is required.",
-	"emulationVersion": "EmulationVersion is the emulation version. It must be in a semver format without leading `v`. EmulationVersion must be less than or equal to BinaryVersion. This field is required when strategy is \"OldestEmulationVersion\"",
-	"strategy":         "Strategy is the strategy that coordinated leader election will use for picking the leader. If multiple candidates for the same Lease return different strategies, the strategy provided by the candidate with the latest BinaryVersion will be used. If there is still conflict, this is a user error and coordinated leader election will not operate the Lease until resolved.",
+	"leaseName":        "leaseName is the name of the lease for which this candidate is contending. This field is immutable.",
+	"pingTime":         "pingTime is the last time that the server has requested the LeaseCandidate to renew. It is only done during leader election to check if any LeaseCandidates have become ineligible. When PingTime is updated, the LeaseCandidate will respond by updating RenewTime.",
+	"renewTime":        "renewTime is the time that the LeaseCandidate was last updated. Any time a Lease needs to do leader election, the PingTime field is updated to signal to the LeaseCandidate that they should update the RenewTime. Old LeaseCandidate objects are also garbage collected if it has been hours since the last renew. The PingTime field is updated regularly to prevent garbage collection for still active LeaseCandidates.",
+	"binaryVersion":    "binaryVersion is the binary version. It must be in a semver format without leading `v`. This field is required.",
+	"emulationVersion": "emulationVersion is the emulation version. It must be in a semver format without leading `v`. EmulationVersion must be less than or equal to BinaryVersion. This field is required when strategy is \"OldestEmulationVersion\"",
+	"strategy":         "strategy is the strategy that coordinated leader election will use for picking the leader. If multiple candidates for the same Lease return different strategies, the strategy provided by the candidate with the latest BinaryVersion will be used. If there is still conflict, this is a user error and coordinated leader election will not operate the Lease until resolved.",
 }
 
 func (LeaseCandidateSpec) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/coordination/v1beta1/generated.proto b/vendor/k8s.io/api/coordination/v1beta1/generated.proto
index 74df40c64f..510b230f79 100644
--- a/vendor/k8s.io/api/coordination/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/coordination/v1beta1/generated.proto
@@ -31,6 +31,7 @@ option go_package = "k8s.io/api/coordination/v1beta1";
 
 // Lease defines a lease concept.
 message Lease {
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -44,6 +45,7 @@ message Lease {
 // LeaseCandidate defines a candidate for a Lease object.
 // Candidates are created such that coordinated leader election will pick the best leader from the list of candidates.
 message LeaseCandidate {
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -67,21 +69,21 @@ message LeaseCandidateList {
 
 // LeaseCandidateSpec is a specification of a Lease.
 message LeaseCandidateSpec {
-  // LeaseName is the name of the lease for which this candidate is contending.
+  // leaseName is the name of the lease for which this candidate is contending.
   // The limits on this field are the same as on Lease.name. Multiple lease candidates
   // may reference the same Lease.name.
   // This field is immutable.
   // +required
   optional string leaseName = 1;
 
-  // PingTime is the last time that the server has requested the LeaseCandidate
+  // pingTime is the last time that the server has requested the LeaseCandidate
   // to renew. It is only done during leader election to check if any
   // LeaseCandidates have become ineligible. When PingTime is updated, the
   // LeaseCandidate will respond by updating RenewTime.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime pingTime = 2;
 
-  // RenewTime is the time that the LeaseCandidate was last updated.
+  // renewTime is the time that the LeaseCandidate was last updated.
   // Any time a Lease needs to do leader election, the PingTime field
   // is updated to signal to the LeaseCandidate that they should update
   // the RenewTime.
@@ -91,18 +93,18 @@ message LeaseCandidateSpec {
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime renewTime = 3;
 
-  // BinaryVersion is the binary version. It must be in a semver format without leading `v`.
+  // binaryVersion is the binary version. It must be in a semver format without leading `v`.
   // This field is required.
   // +required
   optional string binaryVersion = 4;
 
-  // EmulationVersion is the emulation version. It must be in a semver format without leading `v`.
+  // emulationVersion is the emulation version. It must be in a semver format without leading `v`.
   // EmulationVersion must be less than or equal to BinaryVersion.
   // This field is required when strategy is "OldestEmulationVersion"
   // +optional
   optional string emulationVersion = 5;
 
-  // Strategy is the strategy that coordinated leader election will use for picking the leader.
+  // strategy is the strategy that coordinated leader election will use for picking the leader.
   // If multiple candidates for the same Lease return different strategies, the strategy provided
   // by the candidate with the latest BinaryVersion will be used. If there is still conflict,
   // this is a user error and coordinated leader election will not operate the Lease until resolved.
@@ -149,13 +151,13 @@ message LeaseSpec {
   // +optional
   optional int32 leaseTransitions = 5;
 
-  // Strategy indicates the strategy for picking the leader for coordinated leader election
+  // strategy indicates the strategy for picking the leader for coordinated leader election.
   // (Alpha) Using this field requires the CoordinatedLeaderElection feature gate to be enabled.
   // +featureGate=CoordinatedLeaderElection
   // +optional
   optional string strategy = 6;
 
-  // PreferredHolder signals to a lease holder that the lease has a
+  // preferredHolder signals to a lease holder that the lease has a
   // more optimal holder and should be given up.
   // +featureGate=CoordinatedLeaderElection
   // +optional
diff --git a/vendor/k8s.io/api/coordination/v1beta1/types.go b/vendor/k8s.io/api/coordination/v1beta1/types.go
index ba6d6aa095..3141d7062a 100644
--- a/vendor/k8s.io/api/coordination/v1beta1/types.go
+++ b/vendor/k8s.io/api/coordination/v1beta1/types.go
@@ -29,7 +29,8 @@ import (
 
 // Lease defines a lease concept.
 type Lease struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -63,12 +64,12 @@ type LeaseSpec struct {
 	// holders.
 	// +optional
 	LeaseTransitions *int32 `json:"leaseTransitions,omitempty" protobuf:"varint,5,opt,name=leaseTransitions"`
-	// Strategy indicates the strategy for picking the leader for coordinated leader election
+	// strategy indicates the strategy for picking the leader for coordinated leader election.
 	// (Alpha) Using this field requires the CoordinatedLeaderElection feature gate to be enabled.
 	// +featureGate=CoordinatedLeaderElection
 	// +optional
 	Strategy *v1.CoordinatedLeaseStrategy `json:"strategy,omitempty" protobuf:"bytes,6,opt,name=strategy"`
-	// PreferredHolder signals to a lease holder that the lease has a
+	// preferredHolder signals to a lease holder that the lease has a
 	// more optimal holder and should be given up.
 	// +featureGate=CoordinatedLeaderElection
 	// +optional
@@ -82,7 +83,7 @@ type LeaseSpec struct {
 
 // LeaseList is a list of Lease objects.
 type LeaseList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -99,7 +100,8 @@ type LeaseList struct {
 // LeaseCandidate defines a candidate for a Lease object.
 // Candidates are created such that coordinated leader election will pick the best leader from the list of candidates.
 type LeaseCandidate struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -112,19 +114,19 @@ type LeaseCandidate struct {
 
 // LeaseCandidateSpec is a specification of a Lease.
 type LeaseCandidateSpec struct {
-	// LeaseName is the name of the lease for which this candidate is contending.
+	// leaseName is the name of the lease for which this candidate is contending.
 	// The limits on this field are the same as on Lease.name. Multiple lease candidates
 	// may reference the same Lease.name.
 	// This field is immutable.
 	// +required
 	LeaseName string `json:"leaseName" protobuf:"bytes,1,name=leaseName"`
-	// PingTime is the last time that the server has requested the LeaseCandidate
+	// pingTime is the last time that the server has requested the LeaseCandidate
 	// to renew. It is only done during leader election to check if any
 	// LeaseCandidates have become ineligible. When PingTime is updated, the
 	// LeaseCandidate will respond by updating RenewTime.
 	// +optional
 	PingTime *metav1.MicroTime `json:"pingTime,omitempty" protobuf:"bytes,2,opt,name=pingTime"`
-	// RenewTime is the time that the LeaseCandidate was last updated.
+	// renewTime is the time that the LeaseCandidate was last updated.
 	// Any time a Lease needs to do leader election, the PingTime field
 	// is updated to signal to the LeaseCandidate that they should update
 	// the RenewTime.
@@ -133,16 +135,16 @@ type LeaseCandidateSpec struct {
 	// garbage collection for still active LeaseCandidates.
 	// +optional
 	RenewTime *metav1.MicroTime `json:"renewTime,omitempty" protobuf:"bytes,3,opt,name=renewTime"`
-	// BinaryVersion is the binary version. It must be in a semver format without leading `v`.
+	// binaryVersion is the binary version. It must be in a semver format without leading `v`.
 	// This field is required.
 	// +required
 	BinaryVersion string `json:"binaryVersion" protobuf:"bytes,4,name=binaryVersion"`
-	// EmulationVersion is the emulation version. It must be in a semver format without leading `v`.
+	// emulationVersion is the emulation version. It must be in a semver format without leading `v`.
 	// EmulationVersion must be less than or equal to BinaryVersion.
 	// This field is required when strategy is "OldestEmulationVersion"
 	// +optional
 	EmulationVersion string `json:"emulationVersion,omitempty" protobuf:"bytes,5,opt,name=emulationVersion"`
-	// Strategy is the strategy that coordinated leader election will use for picking the leader.
+	// strategy is the strategy that coordinated leader election will use for picking the leader.
 	// If multiple candidates for the same Lease return different strategies, the strategy provided
 	// by the candidate with the latest BinaryVersion will be used. If there is still conflict,
 	// this is a user error and coordinated leader election will not operate the Lease until resolved.
@@ -155,7 +157,7 @@ type LeaseCandidateSpec struct {
 
 // LeaseCandidateList is a list of Lease objects.
 type LeaseCandidateList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
diff --git a/vendor/k8s.io/api/coordination/v1beta1/types_swagger_doc_generated.go b/vendor/k8s.io/api/coordination/v1beta1/types_swagger_doc_generated.go
index 35812b77f3..c4297c5698 100644
--- a/vendor/k8s.io/api/coordination/v1beta1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/coordination/v1beta1/types_swagger_doc_generated.go
@@ -29,7 +29,7 @@ package v1beta1
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_Lease = map[string]string{
 	"":         "Lease defines a lease concept.",
-	"metadata": "More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec contains the specification of the Lease. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 }
 
@@ -39,7 +39,7 @@ func (Lease) SwaggerDoc() map[string]string {
 
 var map_LeaseCandidate = map[string]string{
 	"":         "LeaseCandidate defines a candidate for a Lease object. Candidates are created such that coordinated leader election will pick the best leader from the list of candidates.",
-	"metadata": "More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec contains the specification of the Lease. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 }
 
@@ -59,12 +59,12 @@ func (LeaseCandidateList) SwaggerDoc() map[string]string {
 
 var map_LeaseCandidateSpec = map[string]string{
 	"":                 "LeaseCandidateSpec is a specification of a Lease.",
-	"leaseName":        "LeaseName is the name of the lease for which this candidate is contending. The limits on this field are the same as on Lease.name. Multiple lease candidates may reference the same Lease.name. This field is immutable.",
-	"pingTime":         "PingTime is the last time that the server has requested the LeaseCandidate to renew. It is only done during leader election to check if any LeaseCandidates have become ineligible. When PingTime is updated, the LeaseCandidate will respond by updating RenewTime.",
-	"renewTime":        "RenewTime is the time that the LeaseCandidate was last updated. Any time a Lease needs to do leader election, the PingTime field is updated to signal to the LeaseCandidate that they should update the RenewTime. Old LeaseCandidate objects are also garbage collected if it has been hours since the last renew. The PingTime field is updated regularly to prevent garbage collection for still active LeaseCandidates.",
-	"binaryVersion":    "BinaryVersion is the binary version. It must be in a semver format without leading `v`. This field is required.",
-	"emulationVersion": "EmulationVersion is the emulation version. It must be in a semver format without leading `v`. EmulationVersion must be less than or equal to BinaryVersion. This field is required when strategy is \"OldestEmulationVersion\"",
-	"strategy":         "Strategy is the strategy that coordinated leader election will use for picking the leader. If multiple candidates for the same Lease return different strategies, the strategy provided by the candidate with the latest BinaryVersion will be used. If there is still conflict, this is a user error and coordinated leader election will not operate the Lease until resolved.",
+	"leaseName":        "leaseName is the name of the lease for which this candidate is contending. The limits on this field are the same as on Lease.name. Multiple lease candidates may reference the same Lease.name. This field is immutable.",
+	"pingTime":         "pingTime is the last time that the server has requested the LeaseCandidate to renew. It is only done during leader election to check if any LeaseCandidates have become ineligible. When PingTime is updated, the LeaseCandidate will respond by updating RenewTime.",
+	"renewTime":        "renewTime is the time that the LeaseCandidate was last updated. Any time a Lease needs to do leader election, the PingTime field is updated to signal to the LeaseCandidate that they should update the RenewTime. Old LeaseCandidate objects are also garbage collected if it has been hours since the last renew. The PingTime field is updated regularly to prevent garbage collection for still active LeaseCandidates.",
+	"binaryVersion":    "binaryVersion is the binary version. It must be in a semver format without leading `v`. This field is required.",
+	"emulationVersion": "emulationVersion is the emulation version. It must be in a semver format without leading `v`. EmulationVersion must be less than or equal to BinaryVersion. This field is required when strategy is \"OldestEmulationVersion\"",
+	"strategy":         "strategy is the strategy that coordinated leader election will use for picking the leader. If multiple candidates for the same Lease return different strategies, the strategy provided by the candidate with the latest BinaryVersion will be used. If there is still conflict, this is a user error and coordinated leader election will not operate the Lease until resolved.",
 }
 
 func (LeaseCandidateSpec) SwaggerDoc() map[string]string {
@@ -88,8 +88,8 @@ var map_LeaseSpec = map[string]string{
 	"acquireTime":          "acquireTime is a time when the current lease was acquired.",
 	"renewTime":            "renewTime is a time when the current holder of a lease has last updated the lease.",
 	"leaseTransitions":     "leaseTransitions is the number of transitions of a lease between holders.",
-	"strategy":             "Strategy indicates the strategy for picking the leader for coordinated leader election (Alpha) Using this field requires the CoordinatedLeaderElection feature gate to be enabled.",
-	"preferredHolder":      "PreferredHolder signals to a lease holder that the lease has a more optimal holder and should be given up.",
+	"strategy":             "strategy indicates the strategy for picking the leader for coordinated leader election. (Alpha) Using this field requires the CoordinatedLeaderElection feature gate to be enabled.",
+	"preferredHolder":      "preferredHolder signals to a lease holder that the lease has a more optimal holder and should be given up.",
 }
 
 func (LeaseSpec) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/core/v1/generated.pb.go b/vendor/k8s.io/api/core/v1/generated.pb.go
index 0fcbd5edf7..41bf20df28 100644
--- a/vendor/k8s.io/api/core/v1/generated.pb.go
+++ b/vendor/k8s.io/api/core/v1/generated.pb.go
@@ -158,6 +158,8 @@ func (m *EventSeries) Reset() { *m = EventSeries{} }
 
 func (m *EventSource) Reset() { *m = EventSource{} }
 
+func (m *EvictionResponder) Reset() { *m = EvictionResponder{} }
+
 func (m *ExecAction) Reset() { *m = ExecAction{} }
 
 func (m *FCVolumeSource) Reset() { *m = FCVolumeSource{} }
@@ -244,6 +246,10 @@ func (m *NodeAddress) Reset() { *m = NodeAddress{} }
 
 func (m *NodeAffinity) Reset() { *m = NodeAffinity{} }
 
+func (m *NodeAllocatableMappedResources) Reset() { *m = NodeAllocatableMappedResources{} }
+
+func (m *NodeAllocatableOverheadResources) Reset() { *m = NodeAllocatableOverheadResources{} }
+
 func (m *NodeAllocatableResourceClaimStatus) Reset() { *m = NodeAllocatableResourceClaimStatus{} }
 
 func (m *NodeCondition) Reset() { *m = NodeCondition{} }
@@ -258,6 +264,8 @@ func (m *NodeFeatures) Reset() { *m = NodeFeatures{} }
 
 func (m *NodeList) Reset() { *m = NodeList{} }
 
+func (m *NodePodPreemptionPolicy) Reset() { *m = NodePodPreemptionPolicy{} }
+
 func (m *NodeProxyOptions) Reset() { *m = NodeProxyOptions{} }
 
 func (m *NodeRuntimeHandler) Reset() { *m = NodeRuntimeHandler{} }
@@ -360,14 +368,14 @@ func (m *PodSpec) Reset() { *m = PodSpec{} }
 
 func (m *PodStatus) Reset() { *m = PodStatus{} }
 
-func (m *PodStatusResult) Reset() { *m = PodStatusResult{} }
-
 func (m *PodTemplate) Reset() { *m = PodTemplate{} }
 
 func (m *PodTemplateList) Reset() { *m = PodTemplateList{} }
 
 func (m *PodTemplateSpec) Reset() { *m = PodTemplateSpec{} }
 
+func (m *PodVolumeHealth) Reset() { *m = PodVolumeHealth{} }
+
 func (m *PortStatus) Reset() { *m = PortStatus{} }
 
 func (m *PortworxVolumeSource) Reset() { *m = PortworxVolumeSource{} }
@@ -498,6 +506,10 @@ func (m *Volume) Reset() { *m = Volume{} }
 
 func (m *VolumeDevice) Reset() { *m = VolumeDevice{} }
 
+func (m *VolumeHealthCondition) Reset() { *m = VolumeHealthCondition{} }
+
+func (m *VolumeHealthStatus) Reset() { *m = VolumeHealthStatus{} }
+
 func (m *VolumeMount) Reset() { *m = VolumeMount{} }
 
 func (m *VolumeMountStatus) Reset() { *m = VolumeMountStatus{} }
@@ -1462,6 +1474,11 @@ func (m *ClusterTrustBundleProjection) MarshalToSizedBuffer(dAtA []byte) (int, e
 	_ = i
 	var l int
 	_ = l
+	if m.User != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.User))
+		i--
+		dAtA[i] = 0x30
+	}
 	if m.Optional != nil {
 		i--
 		if *m.Optional {
@@ -1999,6 +2016,11 @@ func (m *ConfigMapVolumeSource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.DefaultUser != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.DefaultUser))
+		i--
+		dAtA[i] = 0x28
+	}
 	if m.Optional != nil {
 		i--
 		if *m.Optional {
@@ -3035,6 +3057,11 @@ func (m *DownwardAPIVolumeFile) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.User != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.User))
+		i--
+		dAtA[i] = 0x28
+	}
 	if m.Mode != nil {
 		i = encodeVarintGenerated(dAtA, i, uint64(*m.Mode))
 		i--
@@ -3092,6 +3119,11 @@ func (m *DownwardAPIVolumeSource) MarshalToSizedBuffer(dAtA []byte) (int, error)
 	_ = i
 	var l int
 	_ = l
+	if m.DefaultUser != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.DefaultUser))
+		i--
+		dAtA[i] = 0x18
+	}
 	if m.DefaultMode != nil {
 		i = encodeVarintGenerated(dAtA, i, uint64(*m.DefaultMode))
 		i--
@@ -3134,6 +3166,11 @@ func (m *EmptyDirVolumeSource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.Mode != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.Mode))
+		i--
+		dAtA[i] = 0x18
+	}
 	if m.SizeLimit != nil {
 		{
 			size, err := m.SizeLimit.MarshalToSizedBuffer(dAtA[:i])
@@ -4207,6 +4244,39 @@ func (m *EventSource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *EvictionResponder) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *EvictionResponder) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *EvictionResponder) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.Priority != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.Priority))
+		i--
+		dAtA[i] = 0x10
+	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
 func (m *ExecAction) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -4597,6 +4667,13 @@ func (m *GRPCAction) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.Mode != nil {
+		i -= len(*m.Mode)
+		copy(dAtA[i:], *m.Mode)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.Mode)))
+		i--
+		dAtA[i] = 0x1a
+	}
 	if m.Service != nil {
 		i -= len(*m.Service)
 		copy(dAtA[i:], *m.Service)
@@ -4757,6 +4834,13 @@ func (m *HTTPGetAction) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.Protocol != nil {
+		i -= len(*m.Protocol)
+		copy(dAtA[i:], *m.Protocol)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.Protocol)))
+		i--
+		dAtA[i] = 0x32
+	}
 	if len(m.HTTPHeaders) > 0 {
 		for iNdEx := len(m.HTTPHeaders) - 1; iNdEx >= 0; iNdEx-- {
 			{
@@ -5209,6 +5293,11 @@ func (m *KeyToPath) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.User != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.User))
+		i--
+		dAtA[i] = 0x20
+	}
 	if m.Mode != nil {
 		i = encodeVarintGenerated(dAtA, i, uint64(*m.Mode))
 		i--
@@ -6325,6 +6414,98 @@ func (m *NodeAffinity) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *NodeAllocatableMappedResources) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *NodeAllocatableMappedResources) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *NodeAllocatableMappedResources) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.Quantity != nil {
+		{
+			size, err := m.Quantity.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *NodeAllocatableOverheadResources) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *NodeAllocatableOverheadResources) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *NodeAllocatableOverheadResources) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.PerContainer != nil {
+		{
+			size, err := m.PerContainer.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.PerPod != nil {
+		{
+			size, err := m.PerPod.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
 func (m *NodeAllocatableResourceClaimStatus) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -6345,17 +6526,10 @@ func (m *NodeAllocatableResourceClaimStatus) MarshalToSizedBuffer(dAtA []byte) (
 	_ = i
 	var l int
 	_ = l
-	if len(m.Resources) > 0 {
-		keysForResources := make([]string, 0, len(m.Resources))
-		for k := range m.Resources {
-			keysForResources = append(keysForResources, string(k))
-		}
-		sort.Strings(keysForResources)
-		for iNdEx := len(keysForResources) - 1; iNdEx >= 0; iNdEx-- {
-			v := m.Resources[ResourceName(keysForResources[iNdEx])]
-			baseI := i
+	if len(m.Overhead) > 0 {
+		for iNdEx := len(m.Overhead) - 1; iNdEx >= 0; iNdEx-- {
 			{
-				size, err := (&v).MarshalToSizedBuffer(dAtA[:i])
+				size, err := m.Overhead[iNdEx].MarshalToSizedBuffer(dAtA[:i])
 				if err != nil {
 					return 0, err
 				}
@@ -6363,15 +6537,21 @@ func (m *NodeAllocatableResourceClaimStatus) MarshalToSizedBuffer(dAtA []byte) (
 				i = encodeVarintGenerated(dAtA, i, uint64(size))
 			}
 			i--
-			dAtA[i] = 0x12
-			i -= len(keysForResources[iNdEx])
-			copy(dAtA[i:], keysForResources[iNdEx])
-			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForResources[iNdEx])))
-			i--
-			dAtA[i] = 0xa
-			i = encodeVarintGenerated(dAtA, i, uint64(baseI-i))
+			dAtA[i] = 0x2a
+		}
+	}
+	if len(m.Mapping) > 0 {
+		for iNdEx := len(m.Mapping) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Mapping[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
 			i--
-			dAtA[i] = 0x1a
+			dAtA[i] = 0x22
 		}
 	}
 	if len(m.Containers) > 0 {
@@ -6666,6 +6846,38 @@ func (m *NodeList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *NodePodPreemptionPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *NodePodPreemptionPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *NodePodPreemptionPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.DisableResizePreemption) > 0 {
+		for iNdEx := len(m.DisableResizePreemption) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.DisableResizePreemption[iNdEx])
+			copy(dAtA[i:], m.DisableResizePreemption[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.DisableResizePreemption[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *NodeProxyOptions) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -6927,6 +7139,18 @@ func (m *NodeSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.PodPreemptionPolicy != nil {
+		{
+			size, err := m.PodPreemptionPolicy.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x42
+	}
 	if len(m.PodCIDRs) > 0 {
 		for iNdEx := len(m.PodCIDRs) - 1; iNdEx >= 0; iNdEx-- {
 			i -= len(m.PodCIDRs[iNdEx])
@@ -7254,6 +7478,16 @@ func (m *NodeSystemInfo) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.RunningInUserNamespace != nil {
+		i--
+		if *m.RunningInUserNamespace {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x60
+	}
 	if m.Swap != nil {
 		{
 			size, err := m.Swap.MarshalToSizedBuffer(dAtA[:i])
@@ -7750,6 +7984,18 @@ func (m *PersistentVolumeClaimStatus) MarshalToSizedBuffer(dAtA []byte) (int, er
 	_ = i
 	var l int
 	_ = l
+	if m.HealthStatus != nil {
+		{
+			size, err := m.HealthStatus.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x52
+	}
 	if m.ModifyVolumeStatus != nil {
 		{
 			size, err := m.ModifyVolumeStatus.MarshalToSizedBuffer(dAtA[:i])
@@ -8834,6 +9080,11 @@ func (m *PodCertificateProjection) MarshalToSizedBuffer(dAtA []byte) (int, error
 	_ = i
 	var l int
 	_ = l
+	if m.User != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.User))
+		i--
+		dAtA[i] = 0x40
+	}
 	if len(m.UserAnnotations) > 0 {
 		keysForUserAnnotations := make([]string, 0, len(m.UserAnnotations))
 		for k := range m.UserAnnotations {
@@ -9769,6 +10020,22 @@ func (m *PodSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if len(m.EvictionResponders) > 0 {
+		for iNdEx := len(m.EvictionResponders) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.EvictionResponders[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x2
+			i--
+			dAtA[i] = 0xe2
+		}
+	}
 	if m.SchedulingGroup != nil {
 		{
 			size, err := m.SchedulingGroup.MarshalToSizedBuffer(dAtA[:i])
@@ -10280,6 +10547,22 @@ func (m *PodStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if len(m.VolumeHealth) > 0 {
+		for iNdEx := len(m.VolumeHealth) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.VolumeHealth[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x1
+			i--
+			dAtA[i] = 0xb2
+		}
+	}
 	if len(m.NodeAllocatableResourceClaimStatuses) > 0 {
 		for iNdEx := len(m.NodeAllocatableResourceClaimStatuses) - 1; iNdEx >= 0; iNdEx-- {
 			{
@@ -10515,49 +10798,6 @@ func (m *PodStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *PodStatusResult) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *PodStatusResult) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *PodStatusResult) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0x12
-	{
-		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
-	}
-	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
 func (m *PodTemplate) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -10691,6 +10931,58 @@ func (m *PodTemplateSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *PodVolumeHealth) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodVolumeHealth) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodVolumeHealth) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.LastTransitionTime.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	if len(m.HealthConditions) > 0 {
+		for iNdEx := len(m.HealthConditions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.HealthConditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
 func (m *PortStatus) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -11033,6 +11325,11 @@ func (m *ProjectedVolumeSource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.DefaultUser != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.DefaultUser))
+		i--
+		dAtA[i] = 0x18
+	}
 	if m.DefaultMode != nil {
 		i = encodeVarintGenerated(dAtA, i, uint64(*m.DefaultMode))
 		i--
@@ -12764,6 +13061,11 @@ func (m *SecretVolumeSource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.DefaultUser != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.DefaultUser))
+		i--
+		dAtA[i] = 0x28
+	}
 	if m.Optional != nil {
 		i--
 		if *m.Optional {
@@ -13165,6 +13467,11 @@ func (m *ServiceAccountTokenProjection) MarshalToSizedBuffer(dAtA []byte) (int,
 	_ = i
 	var l int
 	_ = l
+	if m.User != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.User))
+		i--
+		dAtA[i] = 0x20
+	}
 	i -= len(m.Path)
 	copy(dAtA[i:], m.Path)
 	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Path)))
@@ -14217,6 +14524,91 @@ func (m *VolumeDevice) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *VolumeHealthCondition) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *VolumeHealthCondition) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *VolumeHealthCondition) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Message)
+	copy(dAtA[i:], m.Message)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Reason)
+	copy(dAtA[i:], m.Reason)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Reason)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Status)
+	copy(dAtA[i:], m.Status)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *VolumeHealthStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *VolumeHealthStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *VolumeHealthStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.LastTransitionTime.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	if len(m.HealthConditions) > 0 {
+		for iNdEx := len(m.HealthConditions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.HealthConditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *VolumeMount) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -14237,6 +14629,15 @@ func (m *VolumeMount) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if len(m.BindMountOptions) > 0 {
+		for iNdEx := len(m.BindMountOptions) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.BindMountOptions[iNdEx])
+			copy(dAtA[i:], m.BindMountOptions[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.BindMountOptions[iNdEx])))
+			i--
+			dAtA[i] = 0x42
+		}
+	}
 	if m.RecursiveReadOnly != nil {
 		i -= len(*m.RecursiveReadOnly)
 		copy(dAtA[i:], *m.RecursiveReadOnly)
@@ -15515,6 +15916,9 @@ func (m *ClusterTrustBundleProjection) Size() (n int) {
 	if m.Optional != nil {
 		n += 2
 	}
+	if m.User != nil {
+		n += 1 + sovGenerated(uint64(*m.User))
+	}
 	return n
 }
 
@@ -15709,6 +16113,9 @@ func (m *ConfigMapVolumeSource) Size() (n int) {
 	if m.Optional != nil {
 		n += 2
 	}
+	if m.DefaultUser != nil {
+		n += 1 + sovGenerated(uint64(*m.DefaultUser))
+	}
 	return n
 }
 
@@ -16090,6 +16497,9 @@ func (m *DownwardAPIVolumeFile) Size() (n int) {
 	if m.Mode != nil {
 		n += 1 + sovGenerated(uint64(*m.Mode))
 	}
+	if m.User != nil {
+		n += 1 + sovGenerated(uint64(*m.User))
+	}
 	return n
 }
 
@@ -16108,6 +16518,9 @@ func (m *DownwardAPIVolumeSource) Size() (n int) {
 	if m.DefaultMode != nil {
 		n += 1 + sovGenerated(uint64(*m.DefaultMode))
 	}
+	if m.DefaultUser != nil {
+		n += 1 + sovGenerated(uint64(*m.DefaultUser))
+	}
 	return n
 }
 
@@ -16123,6 +16536,9 @@ func (m *EmptyDirVolumeSource) Size() (n int) {
 		l = m.SizeLimit.Size()
 		n += 1 + l + sovGenerated(uint64(l))
 	}
+	if m.Mode != nil {
+		n += 1 + sovGenerated(uint64(*m.Mode))
+	}
 	return n
 }
 
@@ -16505,6 +16921,20 @@ func (m *EventSource) Size() (n int) {
 	return n
 }
 
+func (m *EvictionResponder) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Priority != nil {
+		n += 1 + sovGenerated(uint64(*m.Priority))
+	}
+	return n
+}
+
 func (m *ExecAction) Size() (n int) {
 	if m == nil {
 		return 0
@@ -16656,6 +17086,10 @@ func (m *GRPCAction) Size() (n int) {
 		l = len(*m.Service)
 		n += 1 + l + sovGenerated(uint64(l))
 	}
+	if m.Mode != nil {
+		l = len(*m.Mode)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
 	return n
 }
 
@@ -16726,6 +17160,10 @@ func (m *HTTPGetAction) Size() (n int) {
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
+	if m.Protocol != nil {
+		l = len(*m.Protocol)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
 	return n
 }
 
@@ -16892,6 +17330,9 @@ func (m *KeyToPath) Size() (n int) {
 	if m.Mode != nil {
 		n += 1 + sovGenerated(uint64(*m.Mode))
 	}
+	if m.User != nil {
+		n += 1 + sovGenerated(uint64(*m.User))
+	}
 	return n
 }
 
@@ -17296,6 +17737,40 @@ func (m *NodeAffinity) Size() (n int) {
 	return n
 }
 
+func (m *NodeAllocatableMappedResources) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Quantity != nil {
+		l = m.Quantity.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *NodeAllocatableOverheadResources) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.PerPod != nil {
+		l = m.PerPod.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.PerContainer != nil {
+		l = m.PerContainer.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
 func (m *NodeAllocatableResourceClaimStatus) Size() (n int) {
 	if m == nil {
 		return 0
@@ -17310,13 +17785,16 @@ func (m *NodeAllocatableResourceClaimStatus) Size() (n int) {
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
-	if len(m.Resources) > 0 {
-		for k, v := range m.Resources {
-			_ = k
-			_ = v
-			l = v.Size()
-			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + l + sovGenerated(uint64(l))
-			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+	if len(m.Mapping) > 0 {
+		for _, e := range m.Mapping {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.Overhead) > 0 {
+		for _, e := range m.Overhead {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
 	return n
@@ -17419,6 +17897,21 @@ func (m *NodeList) Size() (n int) {
 	return n
 }
 
+func (m *NodePodPreemptionPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.DisableResizePreemption) > 0 {
+		for _, s := range m.DisableResizePreemption {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
 func (m *NodeProxyOptions) Size() (n int) {
 	if m == nil {
 		return 0
@@ -17544,6 +18037,10 @@ func (m *NodeSpec) Size() (n int) {
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
+	if m.PodPreemptionPolicy != nil {
+		l = m.PodPreemptionPolicy.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
 	return n
 }
 
@@ -17672,6 +18169,9 @@ func (m *NodeSystemInfo) Size() (n int) {
 		l = m.Swap.Size()
 		n += 1 + l + sovGenerated(uint64(l))
 	}
+	if m.RunningInUserNamespace != nil {
+		n += 2
+	}
 	return n
 }
 
@@ -17876,6 +18376,10 @@ func (m *PersistentVolumeClaimStatus) Size() (n int) {
 		l = m.ModifyVolumeStatus.Size()
 		n += 1 + l + sovGenerated(uint64(l))
 	}
+	if m.HealthStatus != nil {
+		l = m.HealthStatus.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
 	return n
 }
 
@@ -18238,6 +18742,9 @@ func (m *PodCertificateProjection) Size() (n int) {
 			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
 		}
 	}
+	if m.User != nil {
+		n += 1 + sovGenerated(uint64(*m.User))
+	}
 	return n
 }
 
@@ -18751,6 +19258,12 @@ func (m *PodSpec) Size() (n int) {
 		l = m.SchedulingGroup.Size()
 		n += 2 + l + sovGenerated(uint64(l))
 	}
+	if len(m.EvictionResponders) > 0 {
+		for _, e := range m.EvictionResponders {
+			l = e.Size()
+			n += 2 + l + sovGenerated(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -18846,19 +19359,12 @@ func (m *PodStatus) Size() (n int) {
 			n += 2 + l + sovGenerated(uint64(l))
 		}
 	}
-	return n
-}
-
-func (m *PodStatusResult) Size() (n int) {
-	if m == nil {
-		return 0
+	if len(m.VolumeHealth) > 0 {
+		for _, e := range m.VolumeHealth {
+			l = e.Size()
+			n += 2 + l + sovGenerated(uint64(l))
+		}
 	}
-	var l int
-	_ = l
-	l = m.ObjectMeta.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	l = m.Status.Size()
-	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
@@ -18905,6 +19411,25 @@ func (m *PodTemplateSpec) Size() (n int) {
 	return n
 }
 
+func (m *PodVolumeHealth) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.HealthConditions) > 0 {
+		for _, e := range m.HealthConditions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = m.LastTransitionTime.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
 func (m *PortStatus) Size() (n int) {
 	if m == nil {
 		return 0
@@ -19036,6 +19561,9 @@ func (m *ProjectedVolumeSource) Size() (n int) {
 	if m.DefaultMode != nil {
 		n += 1 + sovGenerated(uint64(*m.DefaultMode))
 	}
+	if m.DefaultUser != nil {
+		n += 1 + sovGenerated(uint64(*m.DefaultUser))
+	}
 	return n
 }
 
@@ -19674,6 +20202,9 @@ func (m *SecretVolumeSource) Size() (n int) {
 	if m.Optional != nil {
 		n += 2
 	}
+	if m.DefaultUser != nil {
+		n += 1 + sovGenerated(uint64(*m.DefaultUser))
+	}
 	return n
 }
 
@@ -19810,6 +20341,9 @@ func (m *ServiceAccountTokenProjection) Size() (n int) {
 	}
 	l = len(m.Path)
 	n += 1 + l + sovGenerated(uint64(l))
+	if m.User != nil {
+		n += 1 + sovGenerated(uint64(*m.User))
+	}
 	return n
 }
 
@@ -20222,6 +20756,38 @@ func (m *VolumeDevice) Size() (n int) {
 	return n
 }
 
+func (m *VolumeHealthCondition) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Status)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Reason)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Message)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *VolumeHealthStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.HealthConditions) > 0 {
+		for _, e := range m.HealthConditions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = m.LastTransitionTime.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
 func (m *VolumeMount) Size() (n int) {
 	if m == nil {
 		return 0
@@ -20245,6 +20811,12 @@ func (m *VolumeMount) Size() (n int) {
 		l = len(*m.RecursiveReadOnly)
 		n += 1 + l + sovGenerated(uint64(l))
 	}
+	if len(m.BindMountOptions) > 0 {
+		for _, s := range m.BindMountOptions {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -20797,6 +21369,7 @@ func (this *ClusterTrustBundleProjection) String() string {
 		`LabelSelector:` + strings.Replace(fmt.Sprintf("%v", this.LabelSelector), "LabelSelector", "v1.LabelSelector", 1) + `,`,
 		`Path:` + fmt.Sprintf("%v", this.Path) + `,`,
 		`Optional:` + valueToStringGenerated(this.Optional) + `,`,
+		`User:` + valueToStringGenerated(this.User) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -20963,6 +21536,7 @@ func (this *ConfigMapVolumeSource) String() string {
 		`Items:` + repeatedStringForItems + `,`,
 		`DefaultMode:` + valueToStringGenerated(this.DefaultMode) + `,`,
 		`Optional:` + valueToStringGenerated(this.Optional) + `,`,
+		`DefaultUser:` + valueToStringGenerated(this.DefaultUser) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -21243,6 +21817,7 @@ func (this *DownwardAPIVolumeFile) String() string {
 		`FieldRef:` + strings.Replace(this.FieldRef.String(), "ObjectFieldSelector", "ObjectFieldSelector", 1) + `,`,
 		`ResourceFieldRef:` + strings.Replace(this.ResourceFieldRef.String(), "ResourceFieldSelector", "ResourceFieldSelector", 1) + `,`,
 		`Mode:` + valueToStringGenerated(this.Mode) + `,`,
+		`User:` + valueToStringGenerated(this.User) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -21259,6 +21834,7 @@ func (this *DownwardAPIVolumeSource) String() string {
 	s := strings.Join([]string{`&DownwardAPIVolumeSource{`,
 		`Items:` + repeatedStringForItems + `,`,
 		`DefaultMode:` + valueToStringGenerated(this.DefaultMode) + `,`,
+		`DefaultUser:` + valueToStringGenerated(this.DefaultUser) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -21270,6 +21846,7 @@ func (this *EmptyDirVolumeSource) String() string {
 	s := strings.Join([]string{`&EmptyDirVolumeSource{`,
 		`Medium:` + fmt.Sprintf("%v", this.Medium) + `,`,
 		`SizeLimit:` + strings.Replace(fmt.Sprintf("%v", this.SizeLimit), "Quantity", "resource.Quantity", 1) + `,`,
+		`Mode:` + valueToStringGenerated(this.Mode) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -21549,6 +22126,17 @@ func (this *EventSource) String() string {
 	}, "")
 	return s
 }
+func (this *EvictionResponder) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&EvictionResponder{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`Priority:` + valueToStringGenerated(this.Priority) + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func (this *ExecAction) String() string {
 	if this == nil {
 		return "nil"
@@ -21665,6 +22253,7 @@ func (this *GRPCAction) String() string {
 	s := strings.Join([]string{`&GRPCAction{`,
 		`Port:` + fmt.Sprintf("%v", this.Port) + `,`,
 		`Service:` + valueToStringGenerated(this.Service) + `,`,
+		`Mode:` + valueToStringGenerated(this.Mode) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -21721,6 +22310,7 @@ func (this *HTTPGetAction) String() string {
 		`Host:` + fmt.Sprintf("%v", this.Host) + `,`,
 		`Scheme:` + fmt.Sprintf("%v", this.Scheme) + `,`,
 		`HTTPHeaders:` + repeatedStringForHTTPHeaders + `,`,
+		`Protocol:` + valueToStringGenerated(this.Protocol) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -21837,6 +22427,7 @@ func (this *KeyToPath) String() string {
 		`Key:` + fmt.Sprintf("%v", this.Key) + `,`,
 		`Path:` + fmt.Sprintf("%v", this.Path) + `,`,
 		`Mode:` + valueToStringGenerated(this.Mode) + `,`,
+		`User:` + valueToStringGenerated(this.User) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -22185,24 +22776,48 @@ func (this *NodeAffinity) String() string {
 	}, "")
 	return s
 }
+func (this *NodeAllocatableMappedResources) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&NodeAllocatableMappedResources{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`Quantity:` + strings.Replace(fmt.Sprintf("%v", this.Quantity), "Quantity", "resource.Quantity", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *NodeAllocatableOverheadResources) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&NodeAllocatableOverheadResources{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`PerPod:` + strings.Replace(fmt.Sprintf("%v", this.PerPod), "Quantity", "resource.Quantity", 1) + `,`,
+		`PerContainer:` + strings.Replace(fmt.Sprintf("%v", this.PerContainer), "Quantity", "resource.Quantity", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func (this *NodeAllocatableResourceClaimStatus) String() string {
 	if this == nil {
 		return "nil"
 	}
-	keysForResources := make([]string, 0, len(this.Resources))
-	for k := range this.Resources {
-		keysForResources = append(keysForResources, string(k))
+	repeatedStringForMapping := "[]NodeAllocatableMappedResources{"
+	for _, f := range this.Mapping {
+		repeatedStringForMapping += strings.Replace(strings.Replace(f.String(), "NodeAllocatableMappedResources", "NodeAllocatableMappedResources", 1), `&`, ``, 1) + ","
 	}
-	sort.Strings(keysForResources)
-	mapStringForResources := "map[ResourceName]resource.Quantity{"
-	for _, k := range keysForResources {
-		mapStringForResources += fmt.Sprintf("%v: %v,", k, this.Resources[ResourceName(k)])
+	repeatedStringForMapping += "}"
+	repeatedStringForOverhead := "[]NodeAllocatableOverheadResources{"
+	for _, f := range this.Overhead {
+		repeatedStringForOverhead += strings.Replace(strings.Replace(f.String(), "NodeAllocatableOverheadResources", "NodeAllocatableOverheadResources", 1), `&`, ``, 1) + ","
 	}
-	mapStringForResources += "}"
+	repeatedStringForOverhead += "}"
 	s := strings.Join([]string{`&NodeAllocatableResourceClaimStatus{`,
 		`ResourceClaimName:` + fmt.Sprintf("%v", this.ResourceClaimName) + `,`,
 		`Containers:` + fmt.Sprintf("%v", this.Containers) + `,`,
-		`Resources:` + mapStringForResources + `,`,
+		`Mapping:` + repeatedStringForMapping + `,`,
+		`Overhead:` + repeatedStringForOverhead + `,`,
 		`}`,
 	}, "")
 	return s
@@ -22281,6 +22896,16 @@ func (this *NodeList) String() string {
 	}, "")
 	return s
 }
+func (this *NodePodPreemptionPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&NodePodPreemptionPolicy{`,
+		`DisableResizePreemption:` + fmt.Sprintf("%v", this.DisableResizePreemption) + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func (this *NodeProxyOptions) String() string {
 	if this == nil {
 		return "nil"
@@ -22378,6 +23003,7 @@ func (this *NodeSpec) String() string {
 		`Taints:` + repeatedStringForTaints + `,`,
 		`ConfigSource:` + strings.Replace(this.ConfigSource.String(), "NodeConfigSource", "NodeConfigSource", 1) + `,`,
 		`PodCIDRs:` + fmt.Sprintf("%v", this.PodCIDRs) + `,`,
+		`PodPreemptionPolicy:` + strings.Replace(this.PodPreemptionPolicy.String(), "NodePodPreemptionPolicy", "NodePodPreemptionPolicy", 1) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -22476,6 +23102,7 @@ func (this *NodeSystemInfo) String() string {
 		`OperatingSystem:` + fmt.Sprintf("%v", this.OperatingSystem) + `,`,
 		`Architecture:` + fmt.Sprintf("%v", this.Architecture) + `,`,
 		`Swap:` + strings.Replace(this.Swap.String(), "NodeSwapStatus", "NodeSwapStatus", 1) + `,`,
+		`RunningInUserNamespace:` + valueToStringGenerated(this.RunningInUserNamespace) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -22628,6 +23255,7 @@ func (this *PersistentVolumeClaimStatus) String() string {
 		`AllocatedResourceStatuses:` + mapStringForAllocatedResourceStatuses + `,`,
 		`CurrentVolumeAttributesClassName:` + valueToStringGenerated(this.CurrentVolumeAttributesClassName) + `,`,
 		`ModifyVolumeStatus:` + strings.Replace(this.ModifyVolumeStatus.String(), "ModifyVolumeStatus", "ModifyVolumeStatus", 1) + `,`,
+		`HealthStatus:` + strings.Replace(this.HealthStatus.String(), "VolumeHealthStatus", "VolumeHealthStatus", 1) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -22859,6 +23487,7 @@ func (this *PodCertificateProjection) String() string {
 		`KeyPath:` + fmt.Sprintf("%v", this.KeyPath) + `,`,
 		`CertificateChainPath:` + fmt.Sprintf("%v", this.CertificateChainPath) + `,`,
 		`UserAnnotations:` + mapStringForUserAnnotations + `,`,
+		`User:` + valueToStringGenerated(this.User) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -23162,6 +23791,11 @@ func (this *PodSpec) String() string {
 		repeatedStringForResourceClaims += strings.Replace(strings.Replace(f.String(), "PodResourceClaim", "PodResourceClaim", 1), `&`, ``, 1) + ","
 	}
 	repeatedStringForResourceClaims += "}"
+	repeatedStringForEvictionResponders := "[]EvictionResponder{"
+	for _, f := range this.EvictionResponders {
+		repeatedStringForEvictionResponders += strings.Replace(strings.Replace(f.String(), "EvictionResponder", "EvictionResponder", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForEvictionResponders += "}"
 	keysForNodeSelector := make([]string, 0, len(this.NodeSelector))
 	for k := range this.NodeSelector {
 		keysForNodeSelector = append(keysForNodeSelector, k)
@@ -23225,6 +23859,7 @@ func (this *PodSpec) String() string {
 		`Resources:` + strings.Replace(this.Resources.String(), "ResourceRequirements", "ResourceRequirements", 1) + `,`,
 		`HostnameOverride:` + valueToStringGenerated(this.HostnameOverride) + `,`,
 		`SchedulingGroup:` + strings.Replace(this.SchedulingGroup.String(), "PodSchedulingGroup", "PodSchedulingGroup", 1) + `,`,
+		`EvictionResponders:` + repeatedStringForEvictionResponders + `,`,
 		`}`,
 	}, "")
 	return s
@@ -23273,6 +23908,11 @@ func (this *PodStatus) String() string {
 		repeatedStringForNodeAllocatableResourceClaimStatuses += strings.Replace(strings.Replace(f.String(), "NodeAllocatableResourceClaimStatus", "NodeAllocatableResourceClaimStatus", 1), `&`, ``, 1) + ","
 	}
 	repeatedStringForNodeAllocatableResourceClaimStatuses += "}"
+	repeatedStringForVolumeHealth := "[]PodVolumeHealth{"
+	for _, f := range this.VolumeHealth {
+		repeatedStringForVolumeHealth += strings.Replace(strings.Replace(f.String(), "PodVolumeHealth", "PodVolumeHealth", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForVolumeHealth += "}"
 	keysForAllocatedResources := make([]string, 0, len(this.AllocatedResources))
 	for k := range this.AllocatedResources {
 		keysForAllocatedResources = append(keysForAllocatedResources, string(k))
@@ -23305,17 +23945,7 @@ func (this *PodStatus) String() string {
 		`AllocatedResources:` + mapStringForAllocatedResources + `,`,
 		`Resources:` + strings.Replace(this.Resources.String(), "ResourceRequirements", "ResourceRequirements", 1) + `,`,
 		`NodeAllocatableResourceClaimStatuses:` + repeatedStringForNodeAllocatableResourceClaimStatuses + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func (this *PodStatusResult) String() string {
-	if this == nil {
-		return "nil"
-	}
-	s := strings.Join([]string{`&PodStatusResult{`,
-		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
-		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "PodStatus", "PodStatus", 1), `&`, ``, 1) + `,`,
+		`VolumeHealth:` + repeatedStringForVolumeHealth + `,`,
 		`}`,
 	}, "")
 	return s
@@ -23358,6 +23988,23 @@ func (this *PodTemplateSpec) String() string {
 	}, "")
 	return s
 }
+func (this *PodVolumeHealth) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForHealthConditions := "[]VolumeHealthCondition{"
+	for _, f := range this.HealthConditions {
+		repeatedStringForHealthConditions += strings.Replace(strings.Replace(f.String(), "VolumeHealthCondition", "VolumeHealthCondition", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForHealthConditions += "}"
+	s := strings.Join([]string{`&PodVolumeHealth{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`HealthConditions:` + repeatedStringForHealthConditions + `,`,
+		`LastTransitionTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastTransitionTime), "Time", "v1.Time", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func (this *PortStatus) String() string {
 	if this == nil {
 		return "nil"
@@ -23457,6 +24104,7 @@ func (this *ProjectedVolumeSource) String() string {
 	s := strings.Join([]string{`&ProjectedVolumeSource{`,
 		`Sources:` + repeatedStringForSources + `,`,
 		`DefaultMode:` + valueToStringGenerated(this.DefaultMode) + `,`,
+		`DefaultUser:` + valueToStringGenerated(this.DefaultUser) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -23980,6 +24628,7 @@ func (this *SecretVolumeSource) String() string {
 		`Items:` + repeatedStringForItems + `,`,
 		`DefaultMode:` + valueToStringGenerated(this.DefaultMode) + `,`,
 		`Optional:` + valueToStringGenerated(this.Optional) + `,`,
+		`DefaultUser:` + valueToStringGenerated(this.DefaultUser) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -24074,6 +24723,7 @@ func (this *ServiceAccountTokenProjection) String() string {
 		`Audience:` + fmt.Sprintf("%v", this.Audience) + `,`,
 		`ExpirationSeconds:` + valueToStringGenerated(this.ExpirationSeconds) + `,`,
 		`Path:` + fmt.Sprintf("%v", this.Path) + `,`,
+		`User:` + valueToStringGenerated(this.User) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -24366,6 +25016,34 @@ func (this *VolumeDevice) String() string {
 	}, "")
 	return s
 }
+func (this *VolumeHealthCondition) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&VolumeHealthCondition{`,
+		`Status:` + fmt.Sprintf("%v", this.Status) + `,`,
+		`Reason:` + fmt.Sprintf("%v", this.Reason) + `,`,
+		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *VolumeHealthStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForHealthConditions := "[]VolumeHealthCondition{"
+	for _, f := range this.HealthConditions {
+		repeatedStringForHealthConditions += strings.Replace(strings.Replace(f.String(), "VolumeHealthCondition", "VolumeHealthCondition", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForHealthConditions += "}"
+	s := strings.Join([]string{`&VolumeHealthStatus{`,
+		`HealthConditions:` + repeatedStringForHealthConditions + `,`,
+		`LastTransitionTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastTransitionTime), "Time", "v1.Time", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func (this *VolumeMount) String() string {
 	if this == nil {
 		return "nil"
@@ -24378,6 +25056,7 @@ func (this *VolumeMount) String() string {
 		`MountPropagation:` + valueToStringGenerated(this.MountPropagation) + `,`,
 		`SubPathExpr:` + fmt.Sprintf("%v", this.SubPathExpr) + `,`,
 		`RecursiveReadOnly:` + valueToStringGenerated(this.RecursiveReadOnly) + `,`,
+		`BindMountOptions:` + fmt.Sprintf("%v", this.BindMountOptions) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -27769,6 +28448,26 @@ func (m *ClusterTrustBundleProjection) Unmarshal(dAtA []byte) error {
 			}
 			b := bool(v != 0)
 			m.Optional = &b
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.User = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -29403,6 +30102,26 @@ func (m *ConfigMapVolumeSource) Unmarshal(dAtA []byte) error {
 			}
 			b := bool(v != 0)
 			m.Optional = &b
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DefaultUser", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.DefaultUser = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -32698,6 +33417,26 @@ func (m *DownwardAPIVolumeFile) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.Mode = &v
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.User = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -32802,6 +33541,26 @@ func (m *DownwardAPIVolumeSource) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.DefaultMode = &v
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DefaultUser", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.DefaultUser = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -32920,6 +33679,26 @@ func (m *EmptyDirVolumeSource) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Mode", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Mode = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -36125,6 +36904,108 @@ func (m *EventSource) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *EvictionResponder) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EvictionResponder: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EvictionResponder: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Priority", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Priority = &v
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *ExecAction) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -37502,6 +38383,39 @@ func (m *GRPCAction) Unmarshal(dAtA []byte) error {
 			s := string(dAtA[iNdEx:postIndex])
 			m.Service = &s
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Mode", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := GRPCProbeMode(dAtA[iNdEx:postIndex])
+			m.Mode = &s
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -38162,6 +39076,39 @@ func (m *HTTPGetAction) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Protocol", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := HTTPProtocol(dAtA[iNdEx:postIndex])
+			m.Protocol = &s
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -39633,6 +40580,26 @@ func (m *KeyToPath) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.Mode = &v
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.User = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -42489,8 +43456,206 @@ func (m *NamespaceList) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Items = append(m.Items, Namespace{})
-			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Items = append(m.Items, Namespace{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *NamespaceSpec) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NamespaceSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NamespaceSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Finalizers", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Finalizers = append(m.Finalizers, FinalizerName(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *NamespaceStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NamespaceStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NamespaceStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Phase", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Phase = NamespacePhase(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Conditions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Conditions = append(m.Conditions, NamespaceCondition{})
+			if err := m.Conditions[len(m.Conditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -42515,7 +43680,7 @@ func (m *NamespaceList) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *NamespaceSpec) Unmarshal(dAtA []byte) error {
+func (m *Node) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -42538,17 +43703,17 @@ func (m *NamespaceSpec) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: NamespaceSpec: wiretype end group for non-group")
+			return fmt.Errorf("proto: Node: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: NamespaceSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: Node: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Finalizers", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -42558,23 +43723,90 @@ func (m *NamespaceSpec) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Finalizers = append(m.Finalizers, FinalizerName(dAtA[iNdEx:postIndex]))
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -42597,7 +43829,7 @@ func (m *NamespaceSpec) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *NamespaceStatus) Unmarshal(dAtA []byte) error {
+func (m *NodeAddress) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -42620,15 +43852,15 @@ func (m *NamespaceStatus) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: NamespaceStatus: wiretype end group for non-group")
+			return fmt.Errorf("proto: NodeAddress: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: NamespaceStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: NodeAddress: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Phase", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -42656,13 +43888,13 @@ func (m *NamespaceStatus) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Phase = NamespacePhase(dAtA[iNdEx:postIndex])
+			m.Type = NodeAddressType(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Conditions", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Address", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -42672,25 +43904,23 @@ func (m *NamespaceStatus) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Conditions = append(m.Conditions, NamespaceCondition{})
-			if err := m.Conditions[len(m.Conditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Address = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -42713,7 +43943,7 @@ func (m *NamespaceStatus) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *Node) Unmarshal(dAtA []byte) error {
+func (m *NodeAffinity) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -42736,15 +43966,15 @@ func (m *Node) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: Node: wiretype end group for non-group")
+			return fmt.Errorf("proto: NodeAffinity: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Node: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: NodeAffinity: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field RequiredDuringSchedulingIgnoredDuringExecution", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -42771,46 +44001,16 @@ func (m *Node) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			if m.RequiredDuringSchedulingIgnoredDuringExecution == nil {
+				m.RequiredDuringSchedulingIgnoredDuringExecution = &NodeSelector{}
 			}
-			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.RequiredDuringSchedulingIgnoredDuringExecution.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PreferredDuringSchedulingIgnoredDuringExecution", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -42837,7 +44037,8 @@ func (m *Node) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.PreferredDuringSchedulingIgnoredDuringExecution = append(m.PreferredDuringSchedulingIgnoredDuringExecution, PreferredSchedulingTerm{})
+			if err := m.PreferredDuringSchedulingIgnoredDuringExecution[len(m.PreferredDuringSchedulingIgnoredDuringExecution)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -42862,7 +44063,7 @@ func (m *Node) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *NodeAddress) Unmarshal(dAtA []byte) error {
+func (m *NodeAllocatableMappedResources) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -42885,15 +44086,15 @@ func (m *NodeAddress) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: NodeAddress: wiretype end group for non-group")
+			return fmt.Errorf("proto: NodeAllocatableMappedResources: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: NodeAddress: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: NodeAllocatableMappedResources: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -42921,13 +44122,13 @@ func (m *NodeAddress) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Type = NodeAddressType(dAtA[iNdEx:postIndex])
+			m.Name = ResourceName(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Address", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Quantity", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -42937,23 +44138,27 @@ func (m *NodeAddress) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Address = string(dAtA[iNdEx:postIndex])
+			if m.Quantity == nil {
+				m.Quantity = &resource.Quantity{}
+			}
+			if err := m.Quantity.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -42976,7 +44181,7 @@ func (m *NodeAddress) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *NodeAffinity) Unmarshal(dAtA []byte) error {
+func (m *NodeAllocatableOverheadResources) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -42999,15 +44204,83 @@ func (m *NodeAffinity) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: NodeAffinity: wiretype end group for non-group")
+			return fmt.Errorf("proto: NodeAllocatableOverheadResources: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: NodeAffinity: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: NodeAllocatableOverheadResources: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RequiredDuringSchedulingIgnoredDuringExecution", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = ResourceName(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PerPod", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.PerPod == nil {
+				m.PerPod = &resource.Quantity{}
+			}
+			if err := m.PerPod.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PerContainer", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -43034,44 +44307,10 @@ func (m *NodeAffinity) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.RequiredDuringSchedulingIgnoredDuringExecution == nil {
-				m.RequiredDuringSchedulingIgnoredDuringExecution = &NodeSelector{}
-			}
-			if err := m.RequiredDuringSchedulingIgnoredDuringExecution.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PreferredDuringSchedulingIgnoredDuringExecution", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			if m.PerContainer == nil {
+				m.PerContainer = &resource.Quantity{}
 			}
-			m.PreferredDuringSchedulingIgnoredDuringExecution = append(m.PreferredDuringSchedulingIgnoredDuringExecution, PreferredSchedulingTerm{})
-			if err := m.PreferredDuringSchedulingIgnoredDuringExecution[len(m.PreferredDuringSchedulingIgnoredDuringExecution)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.PerContainer.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -43189,9 +44428,9 @@ func (m *NodeAllocatableResourceClaimStatus) Unmarshal(dAtA []byte) error {
 			}
 			m.Containers = append(m.Containers, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 3:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Resources", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Mapping", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -43218,105 +44457,44 @@ func (m *NodeAllocatableResourceClaimStatus) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Resources == nil {
-				m.Resources = make(map[ResourceName]resource.Quantity)
+			m.Mapping = append(m.Mapping, NodeAllocatableMappedResources{})
+			if err := m.Mapping[len(m.Mapping)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			var mapkey ResourceName
-			mapvalue := &resource.Quantity{}
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowGenerated
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Overhead", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
 				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowGenerated
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = ResourceName(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var mapmsglen int
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowGenerated
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						mapmsglen |= int(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					if mapmsglen < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					postmsgIndex := iNdEx + mapmsglen
-					if postmsgIndex < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					if postmsgIndex > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = &resource.Quantity{}
-					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
-						return err
-					}
-					iNdEx = postmsgIndex
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipGenerated(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
 				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Overhead = append(m.Overhead, NodeAllocatableOverheadResources{})
+			if err := m.Overhead[len(m.Overhead)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.Resources[ResourceName(mapkey)] = *mapvalue
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -44130,6 +45308,88 @@ func (m *NodeList) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *NodePodPreemptionPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NodePodPreemptionPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NodePodPreemptionPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DisableResizePreemption", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DisableResizePreemption = append(m.DisableResizePreemption, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *NodeProxyOptions) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -45017,6 +46277,42 @@ func (m *NodeSpec) Unmarshal(dAtA []byte) error {
 			}
 			m.PodCIDRs = append(m.PodCIDRs, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PodPreemptionPolicy", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.PodPreemptionPolicy == nil {
+				m.PodPreemptionPolicy = &NodePodPreemptionPolicy{}
+			}
+			if err := m.PodPreemptionPolicy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -46205,6 +47501,27 @@ func (m *NodeSystemInfo) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 12:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RunningInUserNamespace", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.RunningInUserNamespace = &b
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -48208,6 +49525,42 @@ func (m *PersistentVolumeClaimStatus) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HealthStatus", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.HealthStatus == nil {
+				m.HealthStatus = &VolumeHealthStatus{}
+			}
+			if err := m.HealthStatus.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -51313,6 +52666,26 @@ func (m *PodCertificateProjection) Unmarshal(dAtA []byte) error {
 			}
 			m.UserAnnotations[mapkey] = mapvalue
 			iNdEx = postIndex
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.User = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -55517,6 +56890,40 @@ func (m *PodSpec) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 44:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EvictionResponders", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.EvictionResponders = append(m.EvictionResponders, EvictionResponder{})
+			if err := m.EvictionResponders[len(m.EvictionResponders)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -56351,6 +57758,40 @@ func (m *PodStatus) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 22:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field VolumeHealth", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.VolumeHealth = append(m.VolumeHealth, PodVolumeHealth{})
+			if err := m.VolumeHealth[len(m.VolumeHealth)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -56372,7 +57813,7 @@ func (m *PodStatus) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PodStatusResult) Unmarshal(dAtA []byte) error {
+func (m *PodTemplate) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56395,10 +57836,10 @@ func (m *PodStatusResult) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PodStatusResult: wiretype end group for non-group")
+			return fmt.Errorf("proto: PodTemplate: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PodStatusResult: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PodTemplate: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -56436,7 +57877,7 @@ func (m *PodStatusResult) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Template", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -56463,7 +57904,7 @@ func (m *PodStatusResult) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Template.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -56488,7 +57929,7 @@ func (m *PodStatusResult) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PodTemplate) Unmarshal(dAtA []byte) error {
+func (m *PodTemplateList) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56511,10 +57952,127 @@ func (m *PodTemplate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PodTemplate: wiretype end group for non-group")
+			return fmt.Errorf("proto: PodTemplateList: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PodTemplate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PodTemplateList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, PodTemplate{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodTemplateSpec) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodTemplateSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodTemplateSpec: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -56552,7 +58110,7 @@ func (m *PodTemplate) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Template", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -56579,7 +58137,7 @@ func (m *PodTemplate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Template.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -56604,7 +58162,7 @@ func (m *PodTemplate) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PodTemplateList) Unmarshal(dAtA []byte) error {
+func (m *PodVolumeHealth) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -56627,17 +58185,17 @@ func (m *PodTemplateList) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PodTemplateList: wiretype end group for non-group")
+			return fmt.Errorf("proto: PodVolumeHealth: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PodTemplateList: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PodVolumeHealth: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -56647,28 +58205,27 @@ func (m *PodTemplateList) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field HealthConditions", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -56695,97 +58252,14 @@ func (m *PodTemplateList) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Items = append(m.Items, PodTemplate{})
-			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.HealthConditions = append(m.HealthConditions, VolumeHealthCondition{})
+			if err := m.HealthConditions[len(m.HealthConditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *PodTemplateSpec) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: PodTemplateSpec: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PodTemplateSpec: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field LastTransitionTime", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -56812,7 +58286,7 @@ func (m *PodTemplateSpec) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.LastTransitionTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -57945,6 +59419,26 @@ func (m *ProjectedVolumeSource) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.DefaultMode = &v
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DefaultUser", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.DefaultUser = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -63895,6 +65389,26 @@ func (m *SecretVolumeSource) Unmarshal(dAtA []byte) error {
 			}
 			b := bool(v != 0)
 			m.Optional = &b
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DefaultUser", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.DefaultUser = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -64937,6 +66451,26 @@ func (m *ServiceAccountTokenProjection) Unmarshal(dAtA []byte) error {
 			}
 			m.Path = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.User = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -68111,11 +69645,158 @@ func (m *TypedObjectReference) Unmarshal(dAtA []byte) error {
 				return io.ErrUnexpectedEOF
 			}
 			s := string(dAtA[iNdEx:postIndex])
-			m.APIGroup = &s
+			m.APIGroup = &s
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.Namespace = &s
 			iNdEx = postIndex
-		case 2:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Volume) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Volume: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Volume: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -68143,9 +69824,92 @@ func (m *TypedObjectReference) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Kind = string(dAtA[iNdEx:postIndex])
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field VolumeSource", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.VolumeSource.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *VolumeDevice) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: VolumeDevice: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: VolumeDevice: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
@@ -68177,9 +69941,9 @@ func (m *TypedObjectReference) Unmarshal(dAtA []byte) error {
 			}
 			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DevicePath", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -68207,8 +69971,7 @@ func (m *TypedObjectReference) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			s := string(dAtA[iNdEx:postIndex])
-			m.Namespace = &s
+			m.DevicePath = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -68231,7 +69994,7 @@ func (m *TypedObjectReference) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *Volume) Unmarshal(dAtA []byte) error {
+func (m *VolumeHealthCondition) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -68254,15 +70017,15 @@ func (m *Volume) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: Volume: wiretype end group for non-group")
+			return fmt.Errorf("proto: VolumeHealthCondition: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Volume: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: VolumeHealthCondition: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -68290,13 +70053,13 @@ func (m *Volume) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.Status = VolumeHealthStatusType(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field VolumeSource", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -68306,24 +70069,55 @@ func (m *Volume) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.VolumeSource.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			m.Reason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
 			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -68346,7 +70140,7 @@ func (m *Volume) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *VolumeDevice) Unmarshal(dAtA []byte) error {
+func (m *VolumeHealthStatus) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -68369,17 +70163,17 @@ func (m *VolumeDevice) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: VolumeDevice: wiretype end group for non-group")
+			return fmt.Errorf("proto: VolumeHealthStatus: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: VolumeDevice: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: VolumeHealthStatus: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field HealthConditions", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -68389,29 +70183,31 @@ func (m *VolumeDevice) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.HealthConditions = append(m.HealthConditions, VolumeHealthCondition{})
+			if err := m.HealthConditions[len(m.HealthConditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DevicePath", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field LastTransitionTime", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -68421,23 +70217,24 @@ func (m *VolumeDevice) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DevicePath = string(dAtA[iNdEx:postIndex])
+			if err := m.LastTransitionTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -68703,6 +70500,38 @@ func (m *VolumeMount) Unmarshal(dAtA []byte) error {
 			s := RecursiveReadOnlyMode(dAtA[iNdEx:postIndex])
 			m.RecursiveReadOnly = &s
 			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BindMountOptions", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.BindMountOptions = append(m.BindMountOptions, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
diff --git a/vendor/k8s.io/api/core/v1/generated.proto b/vendor/k8s.io/api/core/v1/generated.proto
index ba4f80e5ec..878555a6ec 100644
--- a/vendor/k8s.io/api/core/v1/generated.proto
+++ b/vendor/k8s.io/api/core/v1/generated.proto
@@ -185,6 +185,7 @@ message Binding {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // The target object that you want to bind to the standard object.
@@ -466,6 +467,13 @@ message ClusterTrustBundleProjection {
 
   // Relative path from the volume root to write the bundle.
   optional string path = 4;
+
+  // user is Optional: The owner UID of the created file.
+  // If specified, the item-level user field takes precedence over defaultUser.
+  // (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+  // +featureGate=AtomicWriteVolumeUserFields
+  // +optional
+  optional int64 user = 6;
 }
 
 // Information about the condition of a component.
@@ -495,6 +503,7 @@ message ComponentStatus {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // List of component conditions observed
@@ -547,6 +556,8 @@ message ConfigMap {
   // the Data field, this is enforced during validation process.
   // Using this field will require 1.10+ apiserver and
   // kubelet.
+  // Note: BinaryData keys are not currently propagated to container env vars
+  // via ConfigMapKeyRef or ConfigMapRef env sources; only Data keys are used.
   // +optional
   map<string, bytes> binaryData = 3;
 }
@@ -556,6 +567,7 @@ message ConfigMap {
 //
 // The contents of the target ConfigMap's Data field will represent the
 // key-value pairs as environment variables.
+// Keys in the BinaryData field are not currently propagated to container env vars.
 message ConfigMapEnvSource {
   // The ConfigMap to select from.
   optional LocalObjectReference localObjectReference = 1;
@@ -571,7 +583,8 @@ message ConfigMapKeySelector {
   // The ConfigMap to select from.
   optional LocalObjectReference localObjectReference = 1;
 
-  // The key to select.
+  // The key to select from the ConfigMap's Data field.
+  // Keys in the BinaryData field are not currently propagated to container env vars.
   optional string key = 2;
 
   // Specify whether the ConfigMap or its key must be defined
@@ -674,6 +687,13 @@ message ConfigMapVolumeSource {
   // optional specify whether the ConfigMap or its keys must be defined
   // +optional
   optional bool optional = 4;
+
+  // defaultUser is Optional: The owner UID of the created files by default.
+  // The defaultUser field is only used as a fallback when the item-level user field is unset.
+  // (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+  // +featureGate=AtomicWriteVolumeUserFields
+  // +optional
+  optional int64 defaultUser = 5;
 }
 
 // A single application container that you want to run within a pod.
@@ -1216,6 +1236,13 @@ message DownwardAPIVolumeFile {
   // mode, like fsGroup, and the result can be other mode bits set.
   // +optional
   optional int32 mode = 4;
+
+  // user is Optional: The owner UID of the created file.
+  // If specified, the item-level user field takes precedence over defaultUser.
+  // (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+  // +featureGate=AtomicWriteVolumeUserFields
+  // +optional
+  optional int64 user = 5;
 }
 
 // DownwardAPIVolumeSource represents a volume containing downward API info.
@@ -1236,6 +1263,13 @@ message DownwardAPIVolumeSource {
   // mode, like fsGroup, and the result can be other mode bits set.
   // +optional
   optional int32 defaultMode = 2;
+
+  // defaultUser is Optional: The owner UID of the created files by default.
+  // The defaultUser field is only used as a fallback when the item-level user field is unset.
+  // (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+  // +featureGate=AtomicWriteVolumeUserFields
+  // +optional
+  optional int64 defaultUser = 3;
 }
 
 // Represents an empty directory for a pod.
@@ -1256,6 +1290,18 @@ message EmptyDirVolumeSource {
   // More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
   // +optional
   optional .k8s.io.apimachinery.pkg.api.resource.Quantity sizeLimit = 2;
+
+  // mode specifies the permission bits for the emptyDir directory, in numeric
+  // notation (e.g., 0755, 01777). Must be a value between 0000 and 01777.
+  // If not specified, defaults to 0777.
+  // This might be in conflict with other options that affect the file
+  // mode, like fsGroup. If fsGroup is specified, the fsGroup permissions
+  // will override the mode specified here.
+  // This field has no effect on Windows.
+  // This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled.
+  // +featureGate=EmptyDirVolumeMode
+  // +optional
+  optional int32 mode = 3;
 }
 
 // EndpointAddress is a tuple that describes single IP address.
@@ -1807,6 +1853,43 @@ message EventSource {
   optional string host = 2;
 }
 
+// EvictionResponder allows you to specify the responder reacting to an Eviction.
+// Responders should observe and communicate through the Eviction Resource API to help with
+// the graceful eviction of a target (e.g. termination of a pod).
+// +structType=atomic
+message EvictionResponder {
+  // name allows you to identify the responder responding to the Eviction.
+  //
+  // It must be a valid domain-prefixed key (such as "acme.io/foo").
+  // Domain names *.k8s.io and *.kubernetes.io are reserved.
+  // This field must be unique for each responder.
+  // This field is required.
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-prefixed-label-key
+  // +k8s:customValidation
+  optional string name = 1;
+
+  // priority for this responder. Higher priorities are selected first by the evictionrequest-controller.
+  // If there are responders with the same priority, the responder whose domain name comes first in the
+  // alphabetical higher domain order, will be picked. This means that the top domain labels are compared
+  // alphabetically first, followed by the lower domain labels. The key is compared last.
+  //
+  // The responder that is the managing controller of the pod should set the value of
+  // this field to 10000 to allow both for preemption or fallback registration by other
+  // responders.
+  //
+  // The minimum value is 0 and the maximum value is 100000.
+  // The interval 0-999 is reserved for responders with *.k8s.io suffix.
+  // This field is required.
+  // +required
+  // +k8s:required
+  // +k8s:minimum=0
+  // +k8s:maximum=100000
+  // +k8s:customValidation
+  optional int32 priority = 2;
+}
+
 // ExecAction describes a "run in container" action.
 message ExecAction {
   // Command is the command line to execute inside the container, the working directory for the
@@ -2001,6 +2084,14 @@ message GRPCAction {
   // +optional
   // +default=""
   optional string service = 2;
+
+  // mode specifies the connection mode for the gRPC health probe.
+  // Set to "TLS" to use TLS without certificate verification.
+  // Set to "Plaintext" to use a plaintext (insecure) connection explicitly.
+  // If not specified, the probe uses a plaintext (insecure) connection.
+  // +featureGate=GRPCContainerProbeTLS
+  // +optional
+  optional string mode = 3;
 }
 
 // Represents a volume that is populated with the contents of a git repository.
@@ -2092,6 +2183,12 @@ message HTTPGetAction {
   // +optional
   // +listType=atomic
   repeated HTTPHeader httpHeaders = 5;
+
+  // Protocol selects the wire protocol for the probe connection.
+  // Nil defaults to HTTP/1.1.
+  // +optional
+  // +featureGate=H2CContainerProbe
+  optional string protocol = 6;
 }
 
 // HTTPHeader describes a custom header to be used in HTTP probes
@@ -2303,6 +2400,13 @@ message KeyToPath {
   // mode, like fsGroup, and the result can be other mode bits set.
   // +optional
   optional int32 mode = 3;
+
+  // user is Optional: The owner UID of the created file.
+  // If specified, the item-level user field takes precedence over defaultUser.
+  // (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+  // +featureGate=AtomicWriteVolumeUserFields
+  // +optional
+  optional int64 user = 4;
 }
 
 // Lifecycle describes actions that the management system should take in response to container lifecycle
@@ -2557,6 +2661,8 @@ message NFSVolumeSource {
 
 // Namespace provides a scope for Names.
 // Use of multiple namespaces is optional.
+// +k8s:supportsSubresource="/status"
+// +k8s:supportsSubresource="/finalize"
 message Namespace {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -2634,6 +2740,8 @@ message NamespaceStatus {
 
 // Node is a worker node in Kubernetes.
 // Each node will have a unique identifier in the cache (i.e. in etcd).
+// +k8s:supportsSubresource="/status"
+// +k8s:supportsSubresource="/proxy"
 message Node {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -2686,20 +2794,86 @@ message NodeAffinity {
   repeated PreferredSchedulingTerm preferredDuringSchedulingIgnoredDuringExecution = 2;
 }
 
+// NodeAllocatableMappedResources describes mapped node allocatable resource allocations.
+message NodeAllocatableMappedResources {
+  // Name is the name of the resource (e.g., cpu, memory).
+  // +required
+  // +k8s:required
+  optional string name = 1;
+
+  // Quantity is the total node allocatable resource capacity allocated for the claim.
+  // This claim's allocated devices is shared by all the containers referencing the claim.
+  // Kubelet adds this value to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.
+  // +required
+  // +k8s:required
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity quantity = 2;
+}
+
+// NodeAllocatableOverheadResources describes auxiliary overhead resource allocations.
+message NodeAllocatableOverheadResources {
+  // Name is the name of the resource (e.g., cpu, memory).
+  // +required
+  // +k8s:required
+  optional string name = 1;
+
+  // PerPod is the flat overhead quantity allocated per pod.
+  // Adding to each container limit allows individual containers to utilize the overhead, while the parent pod-level cgroup limit caps the total usage at the pod boundary where the overhead is accounted for exactly once.
+  // At least one of PerPod or PerContainer must be specified. Specifying neither is an invalid configuration.
+  // +optional
+  // +k8s:optional
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity perPod = 2;
+
+  // PerContainer is the variable overhead quantity applied for each container referencing the claim.
+  // The container references are recorded in `nodeAllocatableResourceClaimStatuses.containers`.
+  // The total overhead quantity allocated for the claim is computed as:
+  // Quantity = PerPod + (PerContainer * NumReferences)
+  // Kubelet accounts for this overhead in cgroups:
+  // - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences).
+  // - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container.
+  // This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once.
+  // At least one of PerPod or PerContainer must be specified. Specifying neither is an invalid configuration.
+  // +optional
+  // +k8s:optional
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity perContainer = 3;
+}
+
 // NodeAllocatableResourceClaimStatus describes the status of node allocatable resources allocated via DRA.
 message NodeAllocatableResourceClaimStatus {
   // ResourceClaimName is the resource claim referenced by the pod that resulted in this node allocatable resource allocation.
   // +required
+  // +k8s:required
   optional string resourceClaimName = 1;
 
   // Containers lists the names of all containers in this pod that reference the claim.
   // +optional
   // +listType=set
+  // +k8s:optional
+  // +k8s:listType=set
   repeated string containers = 2;
 
-  // Resources is a map of the node-allocatable resource name to the aggregate quantity allocated to the claim.
-  // +required
-  map<string, .k8s.io.apimachinery.pkg.api.resource.Quantity> resources = 3;
+  // Mapping contains allocations through devices mapped in the device spec's `nodeAllocatableResources[...].mapping` field.
+  // This is used by kubelet for pod level and container-level cgroup enforcement.
+  // +optional
+  // +patchStrategy=merge
+  // +patchMergeKey=name
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  repeated NodeAllocatableMappedResources mapping = 4;
+
+  // Overhead contains allocations through devices mapped in the device spec's `nodeAllocatableResources[...].overhead` field.
+  // This is used by kubelet for pod level and container-level cgroup enforcement.
+  // +optional
+  // +patchStrategy=merge
+  // +patchMergeKey=name
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  repeated NodeAllocatableOverheadResources overhead = 5;
 }
 
 // NodeCondition contains condition information for a node.
@@ -2811,6 +2985,21 @@ message NodeList {
   repeated Node items = 2;
 }
 
+// NodePodPreemptionPolicy defines the node-level policies governing preemption for pods on this node.
+message NodePodPreemptionPolicy {
+  // DisableResizePreemption lists the owners (e.g., autoscalers, operators, administrators)
+  // that have requested to disable scheduler and Kubelet preemption for in-place pod resize on this node.
+  // If this list is non-empty, resize-induced preemption is disabled on this node.
+  // This is an alpha field and requires enabling the InPlacePodVerticalScalingSchedulerPreemption feature gate.
+  // +listType=set
+  // +k8s:listType=set
+  // +optional
+  // +k8s:maxItems=20
+  // +k8s:optional
+  // +k8s:eachVal=+k8s:format=k8s-label-key
+  repeated string disableResizePreemption = 1;
+}
+
 // NodeProxyOptions is the query options to a Node's proxy call.
 message NodeProxyOptions {
   // Path is the URL path to use for the current proxy request to node.
@@ -2903,6 +3092,9 @@ message NodeSpec {
 
   // ID of the node assigned by the cloud provider in the format: <ProviderName>://<ProviderSpecificNodeID>
   // +optional
+  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:alpha(since: "1.36")=+k8s:update=NoModify
+  // +k8s:alpha(since: "1.36")=+k8s:update=NoUnset
   optional string providerID = 3;
 
   // Unschedulable controls node schedulability of new pods. By default, node is schedulable.
@@ -2923,6 +3115,14 @@ message NodeSpec {
   // see: https://issues.k8s.io/61966
   // +optional
   optional string externalID = 2;
+
+  // PodPreemptionPolicy controls the node-level preemption behaviors for pods on this node.
+  // This is an alpha field and requires enabling the InPlacePodVerticalScalingSchedulerPreemption feature gate.
+  // +featureGate=InPlacePodVerticalScalingSchedulerPreemption
+  // +optional
+  // +k8s:optional
+  // +k8s:ifDisabled(InPlacePodVerticalScalingSchedulerPreemption)=+k8s:forbidden
+  optional NodePodPreemptionPolicy podPreemptionPolicy = 8;
 }
 
 // NodeStatus is information about the current status of a node.
@@ -3059,6 +3259,11 @@ message NodeSystemInfo {
 
   // Swap Info reported by the node.
   optional NodeSwapStatus swap = 11;
+
+  // Whether the node is running in a user namespace.
+  // +featureGate=KubeletInUserNamespace
+  // +optional
+  optional bool runningInUserNamespace = 12;
 }
 
 // ObjectFieldSelector selects an APIVersioned field of an object.
@@ -3135,6 +3340,7 @@ message ObjectReference {
 // PersistentVolume (PV) is a storage resource provisioned by an administrator.
 // It is analogous to a node.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes
+// +k8s:supportsSubresource="/status"
 message PersistentVolume {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -3156,6 +3362,7 @@ message PersistentVolume {
 }
 
 // PersistentVolumeClaim is a user's request for and claim to a persistent volume
+// +k8s:supportsSubresource="/status"
 message PersistentVolumeClaim {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -3256,8 +3463,8 @@ message PersistentVolumeClaimSpec {
   // * An existing PVC (PersistentVolumeClaim)
   // If the provisioner or an external controller can support the specified data source,
   // it will create a new volume based on the contents of the specified data source.
-  // When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-  // and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
+  // dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be
+  // copied to dataSource when dataSourceRef.namespace is not specified.
   // If the namespace is specified, then dataSourceRef will not be copied to dataSource.
   // +optional
   optional TypedLocalObjectReference dataSource = 7;
@@ -3283,7 +3490,6 @@ message PersistentVolumeClaimSpec {
   //   specified.
   // * While dataSource only allows local objects, dataSourceRef allows objects
   //   in any namespaces.
-  // (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
   // (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
   // +optional
   optional TypedObjectReference dataSourceRef = 8;
@@ -3399,6 +3605,13 @@ message PersistentVolumeClaimStatus {
   // +featureGate=VolumeAttributesClass
   // +optional
   optional ModifyVolumeStatus modifyVolumeStatus = 9;
+
+  // healthStatus contains the latest controller-reported health information
+  // for the volume bound to this claim.
+  // +featureGate=CSIVolumeHealth
+  // +optional
+  // +k8s:optional
+  optional VolumeHealthStatus healthStatus = 10;
 }
 
 // PersistentVolumeClaimTemplate is used to produce
@@ -3409,6 +3622,7 @@ message PersistentVolumeClaimTemplate {
   // validation.
   //
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // The specification for the PersistentVolumeClaim. The entire content is
@@ -3676,6 +3890,10 @@ message PhotonPersistentDiskVolumeSource {
 
 // Pod is a collection of containers that can run on a host. This resource is created
 // by clients and scheduled onto hosts.
+// +k8s:supportsSubresource="/status"
+// +k8s:supportsSubresource="/ephemeralcontainers"
+// +k8s:supportsSubresource="/resize"
+// +k8s:supportsSubresource="/eviction"
 message Pod {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -3931,6 +4149,13 @@ message PodCertificateProjection {
   // Signers should document the keys and values they support. Signers should
   // deny requests that contain keys they do not recognize.
   map<string, string> userAnnotations = 7;
+
+  // user is Optional: The owner UID of the created file.
+  // If specified, the item-level user field takes precedence over defaultUser.
+  // (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+  // +featureGate=AtomicWriteVolumeUserFields
+  // +optional
+  optional int64 user = 8;
 }
 
 // PodCondition contains details for the current condition of this pod.
@@ -4390,11 +4615,8 @@ message PodSecurityContext {
   // Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
   // whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
   // CSIDriver instance. Other volumes are always re-labelled recursively.
-  // "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
   //
-  // If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
-  // If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
-  // and "Recursive" for all other volumes.
+  // If not specified, "MountOption" is used.
   //
   // This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
   //
@@ -4511,7 +4733,6 @@ message PodSpec {
 
   // DeprecatedServiceAccount is a deprecated alias for ServiceAccountName.
   // Deprecated: Use serviceAccountName instead.
-  // +k8s:conversion-gen=false
   // +optional
   optional string serviceAccount = 9;
 
@@ -4532,19 +4753,16 @@ message PodSpec {
   // When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
   // and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
   // Default to false.
-  // +k8s:conversion-gen=false
   // +optional
   optional bool hostNetwork = 11;
 
   // Use the host's pid namespace.
   // Optional: Default to false.
-  // +k8s:conversion-gen=false
   // +optional
   optional bool hostPID = 12;
 
   // Use the host's ipc namespace.
   // Optional: Default to false.
-  // +k8s:conversion-gen=false
   // +optional
   optional bool hostIPC = 13;
 
@@ -4553,7 +4771,6 @@ message PodSpec {
   // in the same pod, and the first process in each container will not be assigned PID 1.
   // HostPID and ShareProcessNamespace cannot both be set.
   // Optional: Default to false.
-  // +k8s:conversion-gen=false
   // +optional
   optional bool shareProcessNamespace = 27;
 
@@ -4594,6 +4811,7 @@ message PodSpec {
   // If specified, the pod's tolerations.
   // +optional
   // +listType=atomic
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   repeated Toleration tolerations = 22;
 
   // HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts
@@ -4652,6 +4870,8 @@ message PodSpec {
 
   // PreemptionPolicy is the Policy for preempting pods with lower priority.
   // One of Never, PreemptLowerPriority.
+  // When Priority Admission Controller is enabled, it prevents users from setting
+  // this field. The admission controller populates this field from PriorityClassName.
   // Defaults to PreemptLowerPriority if unset.
   // +optional
   optional string preemptionPolicy = 31;
@@ -4728,7 +4948,6 @@ message PodSpec {
   // When set to false, a new userns is created for the pod. Setting false is useful for
   // mitigating container breakout vulnerabilities even allowing users to run their
   // containers as root without actually having root privileges on the host.
-  // +k8s:conversion-gen=false
   // +optional
   optional bool hostUsers = 37;
 
@@ -4787,7 +5006,6 @@ message PodSpec {
   // - `hostNetwork` must be set to false.
   //
   // This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
-  // Requires the HostnameOverride feature gate to be enabled.
   //
   // +featureGate=HostnameOverride
   // +optional
@@ -4809,6 +5027,34 @@ message PodSpec {
   // +featureGate=GenericWorkload
   // +optional
   optional PodSchedulingGroup schedulingGroup = 43;
+
+  // evictionResponders reference responders that react to Evictions based on EvictionRequests.
+  // Responders should observe and communicate through the Eviction Resource API to help with
+  // the graceful termination of a pod. The responders are selected sequentially, according to
+  // their specified priority.
+  //
+  // Responders should periodically report on an eviction progress by updating the
+  // .status.responders[].heartbeatTime field of the Eviction object. If this field is not updated
+  // within the heartbeat deadline defined by the Eviction API (currently 20 minutes), the eviction
+  // is passed over to the next responder with a lower priority. If there is no other responder,
+  // the last default imperative-eviction.k8s.io/evictor responder with a priority of 100 will
+  // evict the pod using the imperative Eviction API (pods/<name>/eviction subresource).
+  //
+  // The maximum length of the responders list is 10.
+  // Responders are not supported when the pod is part of a PodGroup (.spec.schedulingGroup is set).
+  // This field can only be set on creation and is immutable afterwards.
+  // +featureGate=EvictionRequestAPI
+  // +optional
+  // +patchMergeKey=name
+  // +patchStrategy=merge
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=10
+  // +k8s:alpha(since: "1.37")=+k8s:dependentForbidden("schedulingGroup")
+  repeated EvictionResponder evictionResponders = 44;
 }
 
 // PodStatus represents information about the status of a pod. Status may trail the actual
@@ -4993,24 +5239,25 @@ message PodStatus {
   // Examples include "cpu", "memory", "ephemeral-storage", and hugepages.
   // +featureGate=DRANodeAllocatableResources
   // +optional
-  // +listType=atomic
+  // +patchStrategy=merge
+  // +patchMergeKey=resourceClaimName
+  // +listType=map
+  // +listMapKey=resourceClaimName
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=resourceClaimName
   repeated NodeAllocatableResourceClaimStatus nodeAllocatableResourceClaimStatuses = 21;
-}
 
-// PodStatusResult is a wrapper for PodStatus returned by kubelet that can be encode/decoded
-message PodStatusResult {
-  // Standard object's metadata.
-  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  // volumeHealth contains node-reported health for each volume the pod is using.
+  // Populated by the kubelet on the pod's node.
+  // +featureGate=CSIVolumeHealth
   // +optional
-  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
-
-  // Most recently observed status of the pod.
-  // This data may not be up to date.
-  // Populated by the system.
-  // Read-only.
-  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-  // +optional
-  optional PodStatus status = 2;
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  repeated PodVolumeHealth volumeHealth = 22;
 }
 
 // PodTemplate describes a template for creating copies of a predefined pod.
@@ -5042,6 +5289,7 @@ message PodTemplateSpec {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Specification of the desired behavior of the pod.
@@ -5050,6 +5298,35 @@ message PodTemplateSpec {
   optional PodSpec spec = 2;
 }
 
+// PodVolumeHealth contains health information for a volume used by a pod,
+// reported by the CSI node plugin via the kubelet.
+message PodVolumeHealth {
+  // name matches an entry in pod.spec.volumes.
+  // +required
+  // +k8s:required
+  optional string name = 1;
+
+  // conditions is the set of adverse conditions reported by
+  // the CSI node plugin for this volume on this node.
+  // At most 16 conditions may be reported.
+  // +optional
+  // +listType=map
+  // +listMapKey=status
+  // +patchMergeKey=status
+  // +patchStrategy=merge
+  // +listMapKey=reason
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=status
+  // +k8s:listMapKey=reason
+  // +k8s:maxItems=16
+  repeated VolumeHealthCondition healthConditions = 2;
+
+  // lastTransitionTime is when the current set of conditions first appeared.
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3;
+}
+
 // PortStatus represents the error condition of a service port
 message PortStatus {
   // Port is the port number of the service port of which status is recorded here
@@ -5208,6 +5485,13 @@ message ProjectedVolumeSource {
   // mode, like fsGroup, and the result can be other mode bits set.
   // +optional
   optional int32 defaultMode = 2;
+
+  // defaultUser is Optional: The owner UID of the created files by default.
+  // The defaultUser field is only used as a fallback when the item-level user field is unset.
+  // (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+  // +featureGate=AtomicWriteVolumeUserFields
+  // +optional
+  optional int64 defaultUser = 3;
 }
 
 // Represents a Quobyte mount that lasts the lifetime of a pod.
@@ -5357,6 +5641,7 @@ message RangeAllocation {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Range is string that identifies the range represented by 'data'.
@@ -5372,8 +5657,8 @@ message ReplicationController {
   // be the same as the Pod(s) that the replication controller manages.
   // Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:format=k8s-long-name
+  // +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:format=k8s-long-name
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Spec defines the specification of the desired behavior of the replication controller.
@@ -5430,18 +5715,18 @@ message ReplicationControllerSpec {
   // Defaults to 1.
   // More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#what-is-a-replicationcontroller
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +default=1
-  // +k8s:alpha(since: "1.36")=+k8s:minimum=0
+  // +k8s:beta(since: "1.37")=+k8s:minimum=0
   optional int32 replicas = 1;
 
   // Minimum number of seconds for which a newly created pod should be ready
   // without any of its container crashing, for it to be considered available.
   // Defaults to 0 (pod will be considered available as soon as it is ready)
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +default=0
-  // +k8s:alpha(since: "1.36")=+k8s:minimum=0
+  // +k8s:beta(since: "1.37")=+k8s:minimum=0
   optional int32 minReadySeconds = 4;
 
   // Selector is a label query over pods that should match the Replicas count.
@@ -5458,6 +5743,7 @@ message ReplicationControllerSpec {
   // The only allowed template.spec.restartPolicy value is "Always".
   // More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   optional PodTemplateSpec template = 3;
 }
 
@@ -5549,6 +5835,7 @@ message ResourceHealth {
 }
 
 // ResourceQuota sets aggregate quota restrictions enforced per namespace
+// +k8s:supportsSubresource="/status"
 message ResourceQuota {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -5642,8 +5929,13 @@ message ResourceRequirements {
 // ResourceStatus represents the status of a single resource allocated to a Pod.
 message ResourceStatus {
   // Name of the resource. Must be unique within the pod and in case of non-DRA resource, match one of the resources from the pod spec.
-  // For DRA resources, the value must be "claim:<claim_name>/<request>".
-  // When this status is reported about a container, the "claim_name" and "request" must match one of the claims of this container.
+  // For DRA resources, the value must be "claim:<claim_name>/<request>" when
+  // container.resources.claims[*].request is set or "claim:<claim_name>" when
+  // container.resources.claims[*].request is empty.
+  // For DRA-backed extended resources, "claim:<claim_name>/<request>" is used
+  // when the claim name and request name are recorded in pod.status.extendedResourceClaimStatus.
+  // When this status is reported about a container, the "claim_name" and "request"
+  // must match one of the claims of this container.
   // +required
   optional string name = 1;
 
@@ -5854,6 +6146,8 @@ message Secret {
   // Used to facilitate programmatic handling of secret data.
   // More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types
   // +optional
+  // +k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
   optional string type = 3;
 }
 
@@ -5970,6 +6264,13 @@ message SecretVolumeSource {
   // optional field specify whether the Secret or its keys must be defined
   // +optional
   optional bool optional = 4;
+
+  // defaultUser is Optional: The owner UID of the created files by default.
+  // The defaultUser field is only used as a fallback when the item-level user field is unset.
+  // (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+  // +featureGate=AtomicWriteVolumeUserFields
+  // +optional
+  optional int64 defaultUser = 5;
 }
 
 // SecurityContext holds security configuration that will be applied to a container.
@@ -6076,6 +6377,8 @@ message SerializedReference {
 // Service is a named abstraction of software service (for example, mysql) consisting of local port
 // (for example 3306) that the proxy listens on, and the selector that determines which pods
 // will answer requests sent through the proxy.
+// +k8s:supportsSubresource="/status"
+// +k8s:supportsSubresource="/proxy"
 message Service {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -6169,6 +6472,13 @@ message ServiceAccountTokenProjection {
   // path is the path relative to the mount point of the file to project the
   // token into.
   optional string path = 3;
+
+  // user is Optional: The owner UID of the created file.
+  // If specified, the item-level user field takes precedence over defaultUser.
+  // (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+  // +featureGate=AtomicWriteVolumeUserFields
+  // +optional
+  optional int64 user = 4;
 }
 
 // ServiceList holds a list of services.
@@ -6511,6 +6821,7 @@ message ServiceStatus {
   // +patchStrategy=merge
   // +listType=map
   // +listMapKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:opaqueType
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 2;
 }
 
@@ -6638,6 +6949,8 @@ message Toleration {
   // Key is the taint key that the toleration applies to. Empty means match all taint keys.
   // If the key is empty, operator must be Exists; this combination means to match all values and all keys.
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:format=k8s-label-key
   optional string key = 1;
 
   // Operator represents a key's relationship to the value.
@@ -6890,6 +7203,57 @@ message VolumeDevice {
   optional string devicePath = 2;
 }
 
+// VolumeHealthCondition represents an adverse health condition reported for a volume.
+message VolumeHealthCondition {
+  // status is the machine-parseable health category.
+  // Possible values:
+  // - "Inaccessible": the volume cannot be accessed.
+  // - "DataLoss": data loss has been detected on the volume.
+  // - "Degraded": the volume is functioning with reduced capability.
+  // +required
+  // +k8s:required
+  optional string status = 1;
+
+  // reason is a brief CamelCase machine-parseable reason.
+  // Together with status it forms the unique identity of a condition entry.
+  // Maximum permitted length of a reason is 256 bytes.
+  // +required
+  // +k8s:required
+  // +k8s:maxBytes=256
+  optional string reason = 2;
+
+  // message is a human-readable description.
+  // Maximum permitted length of a message is 1024 bytes.
+  // +optional
+  // +k8s:optional
+  // +k8s:maxBytes=1024
+  optional string message = 3;
+}
+
+// VolumeHealthStatus contains health information for a volume reported
+// by the CSI controller plugin.
+message VolumeHealthStatus {
+  // conditions is the set of adverse conditions reported by
+  // the CSI controller plugin. An empty list means no adverse condition.
+  // At most 16 conditions may be reported.
+  // +optional
+  // +listType=map
+  // +listMapKey=status
+  // +patchMergeKey=status
+  // +patchStrategy=merge
+  // +listMapKey=reason
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=status
+  // +k8s:listMapKey=reason
+  // +k8s:maxItems=16
+  repeated VolumeHealthCondition healthConditions = 1;
+
+  // lastTransitionTime is when the current set of conditions first appeared.
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 2;
+}
+
 // VolumeMount describes a mounting of a Volume within a container.
 message VolumeMount {
   // This must match the Name of a Volume.
@@ -6919,8 +7283,7 @@ message VolumeMount {
   // +optional
   optional string recursiveReadOnly = 7;
 
-  // Path within the container at which the volume should be mounted.  Must
-  // not contain ':'.
+  // Path within the container at which the volume should be mounted.
   optional string mountPath = 3;
 
   // Path within the volume from which the container's volume should be mounted.
@@ -6943,6 +7306,17 @@ message VolumeMount {
   // SubPathExpr and SubPath are mutually exclusive.
   // +optional
   optional string subPathExpr = 6;
+
+  // bindMountOptions is the list of additional bind mount options to apply when
+  // mounting this volume into the container. Allowed values are noexec,
+  // nodev, and nosuid. These are Linux mount options and have no effect on
+  // Windows nodes.
+  // This field is not supported with image volumes.
+  // This is an alpha field and requires enabling the VolumeBindMountOptions feature gate.
+  // +featureGate=VolumeBindMountOptions
+  // +optional
+  // +listType=set
+  repeated string bindMountOptions = 8;
 }
 
 // VolumeMountStatus shows status of volume mounts.
diff --git a/vendor/k8s.io/api/core/v1/register.go b/vendor/k8s.io/api/core/v1/register.go
index 1aac0cb41e..0a42d182f4 100644
--- a/vendor/k8s.io/api/core/v1/register.go
+++ b/vendor/k8s.io/api/core/v1/register.go
@@ -46,7 +46,6 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
 		&Pod{},
 		&PodList{},
-		&PodStatusResult{},
 		&PodTemplate{},
 		&PodTemplateList{},
 		&ReplicationController{},
diff --git a/vendor/k8s.io/api/core/v1/types.go b/vendor/k8s.io/api/core/v1/types.go
index ac0494f3c5..90b09fb9b2 100644
--- a/vendor/k8s.io/api/core/v1/types.go
+++ b/vendor/k8s.io/api/core/v1/types.go
@@ -41,7 +41,7 @@ type Volume struct {
 	// volumeSource represents the location and type of the mounted volume.
 	// If not specified, the Volume is implied to be an EmptyDir.
 	// This implied behavior is deprecated and will be removed in a future version.
-	VolumeSource `json:",inline" protobuf:"bytes,2,opt,name=volumeSource"`
+	VolumeSource `json:"" protobuf:"bytes,2,opt,name=volumeSource"`
 }
 
 // Represents the source of a volume to mount.
@@ -360,8 +360,9 @@ const (
 // PersistentVolume (PV) is a storage resource provisioned by an administrator.
 // It is analogous to a node.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes
+// +k8s:supportsSubresource="/status"
 type PersistentVolume struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -388,7 +389,7 @@ type PersistentVolumeSpec struct {
 	// +optional
 	Capacity ResourceList `json:"capacity,omitempty" protobuf:"bytes,1,rep,name=capacity,casttype=ResourceList,castkey=ResourceName"`
 	// persistentVolumeSource is the actual volume backing the persistent volume.
-	PersistentVolumeSource `json:",inline" protobuf:"bytes,2,opt,name=persistentVolumeSource"`
+	PersistentVolumeSource `json:"" protobuf:"bytes,2,opt,name=persistentVolumeSource"`
 	// accessModes contains all ways the volume can be mounted.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes
 	// +optional
@@ -495,7 +496,7 @@ type PersistentVolumeStatus struct {
 
 // PersistentVolumeList is a list of PersistentVolume items.
 type PersistentVolumeList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -510,8 +511,9 @@ type PersistentVolumeList struct {
 // +k8s:prerelease-lifecycle-gen:introduced=1.0
 
 // PersistentVolumeClaim is a user's request for and claim to a persistent volume
+// +k8s:supportsSubresource="/status"
 type PersistentVolumeClaim struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -534,7 +536,7 @@ type PersistentVolumeClaim struct {
 
 // PersistentVolumeClaimList is a list of PersistentVolumeClaim items.
 type PersistentVolumeClaimList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -578,8 +580,8 @@ type PersistentVolumeClaimSpec struct {
 	// * An existing PVC (PersistentVolumeClaim)
 	// If the provisioner or an external controller can support the specified data source,
 	// it will create a new volume based on the contents of the specified data source.
-	// When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-	// and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
+	// dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be
+	// copied to dataSource when dataSourceRef.namespace is not specified.
 	// If the namespace is specified, then dataSourceRef will not be copied to dataSource.
 	// +optional
 	DataSource *TypedLocalObjectReference `json:"dataSource,omitempty" protobuf:"bytes,7,opt,name=dataSource"`
@@ -604,7 +606,6 @@ type PersistentVolumeClaimSpec struct {
 	//   specified.
 	// * While dataSource only allows local objects, dataSourceRef allows objects
 	//   in any namespaces.
-	// (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
 	// (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
 	// +optional
 	DataSourceRef *TypedObjectReference `json:"dataSourceRef,omitempty" protobuf:"bytes,8,opt,name=dataSourceRef"`
@@ -678,7 +679,7 @@ const (
 	// slightly longer than actual in-use time or unused time because of processing delays or
 	// when this feature was enabled in the cluster.
 	//
-	// Requires PersistentVolumeClaimUnusedSinceTime alpha featuregate
+	// Requires PersistentVolumeClaimUnusedSinceTime beta featuregate
 	PersistentVolumeClaimUnused PersistentVolumeClaimConditionType = "Unused"
 )
 
@@ -764,6 +765,95 @@ type PersistentVolumeClaimCondition struct {
 	Message string `json:"message,omitempty" protobuf:"bytes,6,opt,name=message"`
 }
 
+// VolumeHealthStatusType describes the health status category of a volume.
+// +enum
+// +k8s:enum
+type VolumeHealthStatusType string
+
+const (
+	// VolumeHealthInaccessible indicates the volume cannot be accessed.
+	VolumeHealthInaccessible VolumeHealthStatusType = "Inaccessible"
+	// VolumeHealthDataLoss indicates data loss has been detected on the volume.
+	VolumeHealthDataLoss VolumeHealthStatusType = "DataLoss"
+	// VolumeHealthDegraded indicates the volume is functioning but with reduced capability.
+	VolumeHealthDegraded VolumeHealthStatusType = "Degraded"
+)
+
+// VolumeHealthCondition represents an adverse health condition reported for a volume.
+type VolumeHealthCondition struct {
+	// status is the machine-parseable health category.
+	// Possible values:
+	// - "Inaccessible": the volume cannot be accessed.
+	// - "DataLoss": data loss has been detected on the volume.
+	// - "Degraded": the volume is functioning with reduced capability.
+	// +required
+	// +k8s:required
+	Status VolumeHealthStatusType `json:"status" protobuf:"bytes,1,opt,name=status,casttype=VolumeHealthStatusType"`
+	// reason is a brief CamelCase machine-parseable reason.
+	// Together with status it forms the unique identity of a condition entry.
+	// Maximum permitted length of a reason is 256 bytes.
+	// +required
+	// +k8s:required
+	// +k8s:maxBytes=256
+	Reason string `json:"reason" protobuf:"bytes,2,opt,name=reason"`
+	// message is a human-readable description.
+	// Maximum permitted length of a message is 1024 bytes.
+	// +optional
+	// +k8s:optional
+	// +k8s:maxBytes=1024
+	Message string `json:"message,omitempty" protobuf:"bytes,3,opt,name=message"`
+}
+
+// VolumeHealthStatus contains health information for a volume reported
+// by the CSI controller plugin.
+type VolumeHealthStatus struct {
+	// conditions is the set of adverse conditions reported by
+	// the CSI controller plugin. An empty list means no adverse condition.
+	// At most 16 conditions may be reported.
+	// +optional
+	// +listType=map
+	// +listMapKey=status
+	// +patchMergeKey=status
+	// +patchStrategy=merge
+	// +listMapKey=reason
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=status
+	// +k8s:listMapKey=reason
+	// +k8s:maxItems=16
+	HealthConditions []VolumeHealthCondition `json:"healthConditions,omitempty" patchStrategy:"merge" patchMergeKey:"status" protobuf:"bytes,1,rep,name=healthConditions"`
+	// lastTransitionTime is when the current set of conditions first appeared.
+	// +optional
+	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,2,opt,name=lastTransitionTime"`
+}
+
+// PodVolumeHealth contains health information for a volume used by a pod,
+// reported by the CSI node plugin via the kubelet.
+type PodVolumeHealth struct {
+	// name matches an entry in pod.spec.volumes.
+	// +required
+	// +k8s:required
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+	// conditions is the set of adverse conditions reported by
+	// the CSI node plugin for this volume on this node.
+	// At most 16 conditions may be reported.
+	// +optional
+	// +listType=map
+	// +listMapKey=status
+	// +patchMergeKey=status
+	// +patchStrategy=merge
+	// +listMapKey=reason
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=status
+	// +k8s:listMapKey=reason
+	// +k8s:maxItems=16
+	HealthConditions []VolumeHealthCondition `json:"healthConditions,omitempty" patchStrategy:"merge" patchMergeKey:"status" protobuf:"bytes,2,rep,name=healthConditions"`
+	// lastTransitionTime is when the current set of conditions first appeared.
+	// +optional
+	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,3,opt,name=lastTransitionTime"`
+}
+
 // PersistentVolumeClaimStatus is the current status of a persistent volume claim.
 type PersistentVolumeClaimStatus struct {
 	// phase represents the current phase of PersistentVolumeClaim.
@@ -857,6 +947,12 @@ type PersistentVolumeClaimStatus struct {
 	// +featureGate=VolumeAttributesClass
 	// +optional
 	ModifyVolumeStatus *ModifyVolumeStatus `json:"modifyVolumeStatus,omitempty" protobuf:"bytes,9,opt,name=modifyVolumeStatus"`
+	// healthStatus contains the latest controller-reported health information
+	// for the volume bound to this claim.
+	// +featureGate=CSIVolumeHealth
+	// +optional
+	// +k8s:optional
+	HealthStatus *VolumeHealthStatus `json:"healthStatus,omitempty" protobuf:"bytes,10,opt,name=healthStatus"`
 }
 
 // +enum
@@ -962,6 +1058,17 @@ type EmptyDirVolumeSource struct {
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
 	// +optional
 	SizeLimit *resource.Quantity `json:"sizeLimit,omitempty" protobuf:"bytes,2,opt,name=sizeLimit"`
+	// mode specifies the permission bits for the emptyDir directory, in numeric
+	// notation (e.g., 0755, 01777). Must be a value between 0000 and 01777.
+	// If not specified, defaults to 0777.
+	// This might be in conflict with other options that affect the file
+	// mode, like fsGroup. If fsGroup is specified, the fsGroup permissions
+	// will override the mode specified here.
+	// This field has no effect on Windows.
+	// This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled.
+	// +featureGate=EmptyDirVolumeMode
+	// +optional
+	Mode *int32 `json:"mode,omitempty" protobuf:"varint,3,opt,name=mode"`
 }
 
 // Represents a Glusterfs mount that lasts the lifetime of a pod.
@@ -1454,6 +1561,12 @@ type SecretVolumeSource struct {
 	// optional field specify whether the Secret or its keys must be defined
 	// +optional
 	Optional *bool `json:"optional,omitempty" protobuf:"varint,4,opt,name=optional"`
+	// defaultUser is Optional: The owner UID of the created files by default.
+	// The defaultUser field is only used as a fallback when the item-level user field is unset.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	// +featureGate=AtomicWriteVolumeUserFields
+	// +optional
+	DefaultUser *int64 `json:"defaultUser,omitempty" protobuf:"varint,5,opt,name=defaultUser"`
 }
 
 const (
@@ -1467,7 +1580,7 @@ const (
 // Note that this is identical to a secret volume source without the default
 // mode.
 type SecretProjection struct {
-	LocalObjectReference `json:",inline" protobuf:"bytes,1,opt,name=localObjectReference"`
+	LocalObjectReference `json:"" protobuf:"bytes,1,opt,name=localObjectReference"`
 	// items if unspecified, each key-value pair in the Data field of the referenced
 	// Secret will be projected into the volume as a file whose name is the
 	// key and content is the value. If specified, the listed keys will be
@@ -1877,7 +1990,7 @@ type StorageOSPersistentVolumeSource struct {
 // the items element is populated with specific mappings of keys to paths.
 // ConfigMap volumes support ownership management and SELinux relabeling.
 type ConfigMapVolumeSource struct {
-	LocalObjectReference `json:",inline" protobuf:"bytes,1,opt,name=localObjectReference"`
+	LocalObjectReference `json:"" protobuf:"bytes,1,opt,name=localObjectReference"`
 	// items if unspecified, each key-value pair in the Data field of the referenced
 	// ConfigMap will be projected into the volume as a file whose name is the
 	// key and content is the value. If specified, the listed keys will be
@@ -1900,6 +2013,12 @@ type ConfigMapVolumeSource struct {
 	// optional specify whether the ConfigMap or its keys must be defined
 	// +optional
 	Optional *bool `json:"optional,omitempty" protobuf:"varint,4,opt,name=optional"`
+	// defaultUser is Optional: The owner UID of the created files by default.
+	// The defaultUser field is only used as a fallback when the item-level user field is unset.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	// +featureGate=AtomicWriteVolumeUserFields
+	// +optional
+	DefaultUser *int64 `json:"defaultUser,omitempty" protobuf:"varint,5,opt,name=defaultUser"`
 }
 
 const (
@@ -1914,7 +2033,7 @@ const (
 // Note that this is identical to a configmap volume source without the default
 // mode.
 type ConfigMapProjection struct {
-	LocalObjectReference `json:",inline" protobuf:"bytes,1,opt,name=localObjectReference"`
+	LocalObjectReference `json:"" protobuf:"bytes,1,opt,name=localObjectReference"`
 	// items if unspecified, each key-value pair in the Data field of the referenced
 	// ConfigMap will be projected into the volume as a file whose name is the
 	// key and content is the value. If specified, the listed keys will be
@@ -1952,6 +2071,12 @@ type ServiceAccountTokenProjection struct {
 	// path is the path relative to the mount point of the file to project the
 	// token into.
 	Path string `json:"path" protobuf:"bytes,3,opt,name=path"`
+	// user is Optional: The owner UID of the created file.
+	// If specified, the item-level user field takes precedence over defaultUser.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	// +featureGate=AtomicWriteVolumeUserFields
+	// +optional
+	User *int64 `json:"user,omitempty" protobuf:"varint,4,opt,name=user"`
 }
 
 // ClusterTrustBundleProjection describes how to select a set of
@@ -1986,6 +2111,13 @@ type ClusterTrustBundleProjection struct {
 
 	// Relative path from the volume root to write the bundle.
 	Path string `json:"path" protobuf:"bytes,4,rep,name=path"`
+
+	// user is Optional: The owner UID of the created file.
+	// If specified, the item-level user field takes precedence over defaultUser.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	// +featureGate=AtomicWriteVolumeUserFields
+	// +optional
+	User *int64 `json:"user,omitempty" protobuf:"varint,6,opt,name=user"`
 }
 
 // PodCertificateProjection provides a private key and X.509 certificate in the
@@ -2074,6 +2206,13 @@ type PodCertificateProjection struct {
 	// Signers should document the keys and values they support. Signers should
 	// deny requests that contain keys they do not recognize.
 	UserAnnotations map[string]string `json:"userAnnotations,omitempty" protobuf:"bytes,7,rep,name=userAnnotations"`
+
+	// user is Optional: The owner UID of the created file.
+	// If specified, the item-level user field takes precedence over defaultUser.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	// +featureGate=AtomicWriteVolumeUserFields
+	// +optional
+	User *int64 `json:"user,omitempty" protobuf:"varint,8,opt,name=user"`
 }
 
 // Represents a projected volume source
@@ -2091,6 +2230,12 @@ type ProjectedVolumeSource struct {
 	// mode, like fsGroup, and the result can be other mode bits set.
 	// +optional
 	DefaultMode *int32 `json:"defaultMode,omitempty" protobuf:"varint,2,opt,name=defaultMode"`
+	// defaultUser is Optional: The owner UID of the created files by default.
+	// The defaultUser field is only used as a fallback when the item-level user field is unset.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	// +featureGate=AtomicWriteVolumeUserFields
+	// +optional
+	DefaultUser *int64 `json:"defaultUser,omitempty" protobuf:"varint,3,opt,name=defaultUser"`
 }
 
 // Projection that may be projected along with other supported volume types.
@@ -2189,6 +2334,12 @@ type KeyToPath struct {
 	// mode, like fsGroup, and the result can be other mode bits set.
 	// +optional
 	Mode *int32 `json:"mode,omitempty" protobuf:"varint,3,opt,name=mode"`
+	// user is Optional: The owner UID of the created file.
+	// If specified, the item-level user field takes precedence over defaultUser.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	// +featureGate=AtomicWriteVolumeUserFields
+	// +optional
+	User *int64 `json:"user,omitempty" protobuf:"varint,4,opt,name=user"`
 }
 
 // Local represents directly-attached storage with node affinity
@@ -2339,6 +2490,7 @@ type PersistentVolumeClaimTemplate struct {
 	// validation.
 	//
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// The specification for the PersistentVolumeClaim. The entire content is
@@ -2400,8 +2552,7 @@ type VolumeMount struct {
 	// If this field is not specified, it is treated as an equivalent of Disabled.
 	// +optional
 	RecursiveReadOnly *RecursiveReadOnlyMode `json:"recursiveReadOnly,omitempty" protobuf:"bytes,7,opt,name=recursiveReadOnly,casttype=RecursiveReadOnlyMode"`
-	// Path within the container at which the volume should be mounted.  Must
-	// not contain ':'.
+	// Path within the container at which the volume should be mounted.
 	MountPath string `json:"mountPath" protobuf:"bytes,3,opt,name=mountPath"`
 	// Path within the volume from which the container's volume should be mounted.
 	// Defaults to "" (volume's root).
@@ -2421,8 +2572,30 @@ type VolumeMount struct {
 	// SubPathExpr and SubPath are mutually exclusive.
 	// +optional
 	SubPathExpr string `json:"subPathExpr,omitempty" protobuf:"bytes,6,opt,name=subPathExpr"`
+	// bindMountOptions is the list of additional bind mount options to apply when
+	// mounting this volume into the container. Allowed values are noexec,
+	// nodev, and nosuid. These are Linux mount options and have no effect on
+	// Windows nodes.
+	// This field is not supported with image volumes.
+	// This is an alpha field and requires enabling the VolumeBindMountOptions feature gate.
+	// +featureGate=VolumeBindMountOptions
+	// +optional
+	// +listType=set
+	BindMountOptions []string `json:"bindMountOptions,omitempty" protobuf:"bytes,8,rep,name=bindMountOptions"`
 }
 
+// BindMountOption defines the supported bind mount options.
+type BindMountOption string
+
+const (
+	// BindMountOptionNoExec prevents execution of binaries on the mounted volume.
+	BindMountOptionNoExec BindMountOption = "noexec"
+	// BindMountOptionNoDev ignores device special files on the mounted volume.
+	BindMountOptionNoDev BindMountOption = "nodev"
+	// BindMountOptionNoSUID ignores set-user-identifier or set-group-identifier bits on the mounted volume.
+	BindMountOptionNoSUID BindMountOption = "nosuid"
+)
+
 // MountPropagationMode describes mount propagation.
 // +enum
 type MountPropagationMode string
@@ -2571,8 +2744,9 @@ type ResourceFieldSelector struct {
 // +structType=atomic
 type ConfigMapKeySelector struct {
 	// The ConfigMap to select from.
-	LocalObjectReference `json:",inline" protobuf:"bytes,1,opt,name=localObjectReference"`
-	// The key to select.
+	LocalObjectReference `json:"" protobuf:"bytes,1,opt,name=localObjectReference"`
+	// The key to select from the ConfigMap's Data field.
+	// Keys in the BinaryData field are not currently propagated to container env vars.
 	Key string `json:"key" protobuf:"bytes,2,opt,name=key"`
 	// Specify whether the ConfigMap or its key must be defined
 	// +optional
@@ -2583,7 +2757,7 @@ type ConfigMapKeySelector struct {
 // +structType=atomic
 type SecretKeySelector struct {
 	// The name of the secret in the pod's namespace to select from.
-	LocalObjectReference `json:",inline" protobuf:"bytes,1,opt,name=localObjectReference"`
+	LocalObjectReference `json:"" protobuf:"bytes,1,opt,name=localObjectReference"`
 	// The key of the secret to select from.  Must be a valid secret key.
 	Key string `json:"key" protobuf:"bytes,2,opt,name=key"`
 	// Specify whether the Secret or its key must be defined
@@ -2610,9 +2784,10 @@ type EnvFromSource struct {
 //
 // The contents of the target ConfigMap's Data field will represent the
 // key-value pairs as environment variables.
+// Keys in the BinaryData field are not currently propagated to container env vars.
 type ConfigMapEnvSource struct {
 	// The ConfigMap to select from.
-	LocalObjectReference `json:",inline" protobuf:"bytes,1,opt,name=localObjectReference"`
+	LocalObjectReference `json:"" protobuf:"bytes,1,opt,name=localObjectReference"`
 	// Specify whether the ConfigMap must be defined
 	// +optional
 	Optional *bool `json:"optional,omitempty" protobuf:"varint,2,opt,name=optional"`
@@ -2625,7 +2800,7 @@ type ConfigMapEnvSource struct {
 // key-value pairs as environment variables.
 type SecretEnvSource struct {
 	// The Secret to select from.
-	LocalObjectReference `json:",inline" protobuf:"bytes,1,opt,name=localObjectReference"`
+	LocalObjectReference `json:"" protobuf:"bytes,1,opt,name=localObjectReference"`
 	// Specify whether the Secret must be defined
 	// +optional
 	Optional *bool `json:"optional,omitempty" protobuf:"varint,2,opt,name=optional"`
@@ -2640,6 +2815,19 @@ type HTTPHeader struct {
 	Value string `json:"value" protobuf:"bytes,2,opt,name=value"`
 }
 
+// HTTPProtocol selects the wire protocol for the HTTP probe,
+// independently of the URI scheme.
+// +enum
+type HTTPProtocol string
+
+const (
+	// HTTPProtocolHTTP1 uses HTTP/1.1 (the existing default).
+	HTTPProtocolHTTP1 HTTPProtocol = "HTTP1"
+	// HTTPProtocolHTTP2 uses HTTP/2.
+	// Currently, only cleartext with prior knowledge (h2c) is supported, and must be used with scheme HTTP.
+	HTTPProtocolHTTP2 HTTPProtocol = "HTTP2"
+)
+
 // HTTPGetAction describes an action based on HTTP Get requests.
 type HTTPGetAction struct {
 	// Path to access on the HTTP server.
@@ -2661,6 +2849,11 @@ type HTTPGetAction struct {
 	// +optional
 	// +listType=atomic
 	HTTPHeaders []HTTPHeader `json:"httpHeaders,omitempty" protobuf:"bytes,5,rep,name=httpHeaders"`
+	// Protocol selects the wire protocol for the probe connection.
+	// Nil defaults to HTTP/1.1.
+	// +optional
+	// +featureGate=H2CContainerProbe
+	Protocol *HTTPProtocol `json:"protocol,omitempty" protobuf:"bytes,6,opt,name=protocol,casttype=HTTPProtocol"`
 }
 
 // URIScheme identifies the scheme used for connection to a host for Get actions
@@ -2697,8 +2890,29 @@ type GRPCAction struct {
 	// +optional
 	// +default=""
 	Service *string `json:"service" protobuf:"bytes,2,opt,name=service"`
+
+	// mode specifies the connection mode for the gRPC health probe.
+	// Set to "TLS" to use TLS without certificate verification.
+	// Set to "Plaintext" to use a plaintext (insecure) connection explicitly.
+	// If not specified, the probe uses a plaintext (insecure) connection.
+	// +featureGate=GRPCContainerProbeTLS
+	// +optional
+	Mode *GRPCProbeMode `json:"mode,omitempty" protobuf:"bytes,3,opt,name=mode,casttype=GRPCProbeMode"`
 }
 
+// GRPCProbeMode describes the connection mode for a gRPC probe.
+// +enum
+type GRPCProbeMode string
+
+const (
+	// GRPCProbeModePlaintext indicates that the probe should use a plaintext
+	// (insecure) gRPC connection.
+	GRPCProbeModePlaintext GRPCProbeMode = "Plaintext"
+	// GRPCProbeModeTLS indicates that the probe should connect using TLS
+	// without certificate verification.
+	GRPCProbeModeTLS GRPCProbeMode = "TLS"
+)
+
 // ExecAction describes a "run in container" action.
 type ExecAction struct {
 	// Command is the command line to execute inside the container, the working directory for the
@@ -2721,7 +2935,7 @@ type SleepAction struct {
 // alive or ready to receive traffic.
 type Probe struct {
 	// The action taken to determine the health of a container
-	ProbeHandler `json:",inline" protobuf:"bytes,1,opt,name=handler"`
+	ProbeHandler `json:"" protobuf:"bytes,1,opt,name=handler"`
 	// Number of seconds after the container has started before liveness probes are initiated.
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
 	// +optional
@@ -3407,8 +3621,13 @@ type ContainerStatus struct {
 // ResourceStatus represents the status of a single resource allocated to a Pod.
 type ResourceStatus struct {
 	// Name of the resource. Must be unique within the pod and in case of non-DRA resource, match one of the resources from the pod spec.
-	// For DRA resources, the value must be "claim:<claim_name>/<request>".
-	// When this status is reported about a container, the "claim_name" and "request" must match one of the claims of this container.
+	// For DRA resources, the value must be "claim:<claim_name>/<request>" when
+	// container.resources.claims[*].request is set or "claim:<claim_name>" when
+	// container.resources.claims[*].request is empty.
+	// For DRA-backed extended resources, "claim:<claim_name>/<request>" is used
+	// when the claim name and request name are recorded in pod.status.extendedResourceClaimStatus.
+	// When this status is reported about a container, the "claim_name" and "request"
+	// must match one of the claims of this container.
 	// +required
 	Name ResourceName `json:"name" protobuf:"bytes,1,opt,name=name"`
 	// List of unique resources health. Each element in the list contains an unique resource ID and its health.
@@ -4092,6 +4311,8 @@ type Toleration struct {
 	// Key is the taint key that the toleration applies to. Empty means match all taint keys.
 	// If the key is empty, operator must be Exists; this combination means to match all values and all keys.
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:format=k8s-label-key
 	Key string `json:"key,omitempty" protobuf:"bytes,1,opt,name=key"`
 	// Operator represents a key's relationship to the value.
 	// Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
@@ -4222,7 +4443,6 @@ type PodSpec struct {
 	ServiceAccountName string `json:"serviceAccountName,omitempty" protobuf:"bytes,8,opt,name=serviceAccountName"`
 	// DeprecatedServiceAccount is a deprecated alias for ServiceAccountName.
 	// Deprecated: Use serviceAccountName instead.
-	// +k8s:conversion-gen=false
 	// +optional
 	DeprecatedServiceAccount string `json:"serviceAccount,omitempty" protobuf:"bytes,9,opt,name=serviceAccount"`
 	// AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.
@@ -4241,17 +4461,14 @@ type PodSpec struct {
 	// When `hostNetwork` is true, specified `hostPort` fields in port definitions must match `containerPort`,
 	// and unspecified `hostPort` fields in port definitions are defaulted to match `containerPort`.
 	// Default to false.
-	// +k8s:conversion-gen=false
 	// +optional
 	HostNetwork bool `json:"hostNetwork,omitempty" protobuf:"varint,11,opt,name=hostNetwork"`
 	// Use the host's pid namespace.
 	// Optional: Default to false.
-	// +k8s:conversion-gen=false
 	// +optional
 	HostPID bool `json:"hostPID,omitempty" protobuf:"varint,12,opt,name=hostPID"`
 	// Use the host's ipc namespace.
 	// Optional: Default to false.
-	// +k8s:conversion-gen=false
 	// +optional
 	HostIPC bool `json:"hostIPC,omitempty" protobuf:"varint,13,opt,name=hostIPC"`
 	// Share a single process namespace between all of the containers in a pod.
@@ -4259,7 +4476,6 @@ type PodSpec struct {
 	// in the same pod, and the first process in each container will not be assigned PID 1.
 	// HostPID and ShareProcessNamespace cannot both be set.
 	// Optional: Default to false.
-	// +k8s:conversion-gen=false
 	// +optional
 	ShareProcessNamespace *bool `json:"shareProcessNamespace,omitempty" protobuf:"varint,27,opt,name=shareProcessNamespace"`
 	// SecurityContext holds pod-level security attributes and common container settings.
@@ -4293,6 +4509,7 @@ type PodSpec struct {
 	// If specified, the pod's tolerations.
 	// +optional
 	// +listType=atomic
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	Tolerations []Toleration `json:"tolerations,omitempty" protobuf:"bytes,22,opt,name=tolerations"`
 	// HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts
 	// file if specified.
@@ -4343,6 +4560,8 @@ type PodSpec struct {
 	EnableServiceLinks *bool `json:"enableServiceLinks,omitempty" protobuf:"varint,30,opt,name=enableServiceLinks"`
 	// PreemptionPolicy is the Policy for preempting pods with lower priority.
 	// One of Never, PreemptLowerPriority.
+	// When Priority Admission Controller is enabled, it prevents users from setting
+	// this field. The admission controller populates this field from PriorityClassName.
 	// Defaults to PreemptLowerPriority if unset.
 	// +optional
 	PreemptionPolicy *PreemptionPolicy `json:"preemptionPolicy,omitempty" protobuf:"bytes,31,opt,name=preemptionPolicy"`
@@ -4415,7 +4634,6 @@ type PodSpec struct {
 	// When set to false, a new userns is created for the pod. Setting false is useful for
 	// mitigating container breakout vulnerabilities even allowing users to run their
 	// containers as root without actually having root privileges on the host.
-	// +k8s:conversion-gen=false
 	// +optional
 	HostUsers *bool `json:"hostUsers,omitempty" protobuf:"bytes,37,opt,name=hostUsers"`
 
@@ -4471,7 +4689,6 @@ type PodSpec struct {
 	// - `hostNetwork` must be set to false.
 	//
 	// This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
-	// Requires the HostnameOverride feature gate to be enabled.
 	//
 	// +featureGate=HostnameOverride
 	// +optional
@@ -4497,6 +4714,34 @@ type PodSpec struct {
 	// +featureGate=GenericWorkload
 	// +optional
 	SchedulingGroup *PodSchedulingGroup `json:"schedulingGroup,omitempty" protobuf:"bytes,43,opt,name=schedulingGroup"`
+
+	// evictionResponders reference responders that react to Evictions based on EvictionRequests.
+	// Responders should observe and communicate through the Eviction Resource API to help with
+	// the graceful termination of a pod. The responders are selected sequentially, according to
+	// their specified priority.
+	//
+	// Responders should periodically report on an eviction progress by updating the
+	// .status.responders[].heartbeatTime field of the Eviction object. If this field is not updated
+	// within the heartbeat deadline defined by the Eviction API (currently 20 minutes), the eviction
+	// is passed over to the next responder with a lower priority. If there is no other responder,
+	// the last default imperative-eviction.k8s.io/evictor responder with a priority of 100 will
+	// evict the pod using the imperative Eviction API (pods/<name>/eviction subresource).
+	//
+	// The maximum length of the responders list is 10.
+	// Responders are not supported when the pod is part of a PodGroup (.spec.schedulingGroup is set).
+	// This field can only be set on creation and is immutable afterwards.
+	// +featureGate=EvictionRequestAPI
+	// +optional
+	// +patchMergeKey=name
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=10
+	// +k8s:alpha(since: "1.37")=+k8s:dependentForbidden("schedulingGroup")
+	EvictionResponders []EvictionResponder `json:"evictionResponders,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,44,rep,name=evictionResponders"`
 }
 
 // PodResourceClaim references exactly one ResourceClaim, either directly
@@ -4964,11 +5209,8 @@ type PodSecurityContext struct {
 	// Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
 	// whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
 	// CSIDriver instance. Other volumes are always re-labelled recursively.
-	// "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
 	//
-	// If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
-	// If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
-	// and "Recursive" for all other volumes.
+	// If not specified, "MountOption" is used.
 	//
 	// This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
 	//
@@ -5288,7 +5530,7 @@ type EphemeralContainer struct {
 	// specific to ephemeral containers. Fields in common with Container are in the
 	// following inlined struct so than an EphemeralContainer may easily be converted
 	// to a Container.
-	EphemeralContainerCommon `json:",inline" protobuf:"bytes,1,req"`
+	EphemeralContainerCommon `json:"" protobuf:"bytes,1,req"`
 
 	// If set, the name of the container from PodSpec that this ephemeral container targets.
 	// The ephemeral container will be run in the namespaces (IPC, PID, etc) of this container.
@@ -5300,6 +5542,43 @@ type EphemeralContainer struct {
 	TargetContainerName string `json:"targetContainerName,omitempty" protobuf:"bytes,2,opt,name=targetContainerName"`
 }
 
+// EvictionResponder allows you to specify the responder reacting to an Eviction.
+// Responders should observe and communicate through the Eviction Resource API to help with
+// the graceful eviction of a target (e.g. termination of a pod).
+// +structType=atomic
+type EvictionResponder struct {
+	// name allows you to identify the responder responding to the Eviction.
+	//
+	// It must be a valid domain-prefixed key (such as "acme.io/foo").
+	// Domain names *.k8s.io and *.kubernetes.io are reserved.
+	// This field must be unique for each responder.
+	// This field is required.
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-prefixed-label-key
+	// +k8s:customValidation
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+
+	// priority for this responder. Higher priorities are selected first by the evictionrequest-controller.
+	// If there are responders with the same priority, the responder whose domain name comes first in the
+	// alphabetical higher domain order, will be picked. This means that the top domain labels are compared
+	// alphabetically first, followed by the lower domain labels. The key is compared last.
+	//
+	// The responder that is the managing controller of the pod should set the value of
+	// this field to 10000 to allow both for preemption or fallback registration by other
+	// responders.
+	//
+	// The minimum value is 0 and the maximum value is 100000.
+	// The interval 0-999 is reserved for responders with *.k8s.io suffix.
+	// This field is required.
+	// +required
+	// +k8s:required
+	// +k8s:minimum=0
+	// +k8s:maximum=100000
+	// +k8s:customValidation
+	Priority *int32 `json:"priority" protobuf:"varint,2,opt,name=priority"`
+}
+
 // PodStatus represents information about the status of a pod. Status may trail the actual
 // state of a system, especially if the node that hosts the pod cannot contact the control
 // plane.
@@ -5476,27 +5755,25 @@ type PodStatus struct {
 	// Examples include "cpu", "memory", "ephemeral-storage", and hugepages.
 	// +featureGate=DRANodeAllocatableResources
 	// +optional
-	// +listType=atomic
-	NodeAllocatableResourceClaimStatuses []NodeAllocatableResourceClaimStatus `json:"nodeAllocatableResourceClaimStatuses,omitempty" protobuf:"bytes,21,rep,name=nodeAllocatableResourceClaimStatuses"`
-}
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +k8s:prerelease-lifecycle-gen:introduced=1.0
+	// +patchStrategy=merge
+	// +patchMergeKey=resourceClaimName
+	// +listType=map
+	// +listMapKey=resourceClaimName
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=resourceClaimName
+	NodeAllocatableResourceClaimStatuses []NodeAllocatableResourceClaimStatus `json:"nodeAllocatableResourceClaimStatuses,omitempty" patchStrategy:"merge" patchMergeKey:"resourceClaimName" protobuf:"bytes,21,rep,name=nodeAllocatableResourceClaimStatuses"`
 
-// PodStatusResult is a wrapper for PodStatus returned by kubelet that can be encode/decoded
-type PodStatusResult struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
-	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-	// +optional
-	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-	// Most recently observed status of the pod.
-	// This data may not be up to date.
-	// Populated by the system.
-	// Read-only.
-	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	// volumeHealth contains node-reported health for each volume the pod is using.
+	// Populated by the kubelet on the pod's node.
+	// +featureGate=CSIVolumeHealth
 	// +optional
-	Status PodStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	VolumeHealth []PodVolumeHealth `json:"volumeHealth,omitempty" protobuf:"bytes,22,rep,name=volumeHealth"`
 }
 
 // +genclient
@@ -5507,8 +5784,12 @@ type PodStatusResult struct {
 
 // Pod is a collection of containers that can run on a host. This resource is created
 // by clients and scheduled onto hosts.
+// +k8s:supportsSubresource="/status"
+// +k8s:supportsSubresource="/ephemeralcontainers"
+// +k8s:supportsSubresource="/resize"
+// +k8s:supportsSubresource="/eviction"
 type Pod struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -5533,7 +5814,7 @@ type Pod struct {
 
 // PodList is a list of Pods.
 type PodList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -5549,6 +5830,7 @@ type PodTemplateSpec struct {
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Specification of the desired behavior of the pod.
@@ -5563,7 +5845,7 @@ type PodTemplateSpec struct {
 
 // PodTemplate describes a template for creating copies of a predefined pod.
 type PodTemplate struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -5580,7 +5862,7 @@ type PodTemplate struct {
 
 // PodTemplateList is a list of PodTemplates.
 type PodTemplateList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -5597,18 +5879,18 @@ type ReplicationControllerSpec struct {
 	// Defaults to 1.
 	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#what-is-a-replicationcontroller
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +default=1
-	// +k8s:alpha(since: "1.36")=+k8s:minimum=0
+	// +k8s:beta(since: "1.37")=+k8s:minimum=0
 	Replicas *int32 `json:"replicas,omitempty" protobuf:"varint,1,opt,name=replicas"`
 
 	// Minimum number of seconds for which a newly created pod should be ready
 	// without any of its container crashing, for it to be considered available.
 	// Defaults to 0 (pod will be considered available as soon as it is ready)
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +default=0
-	// +k8s:alpha(since: "1.36")=+k8s:minimum=0
+	// +k8s:beta(since: "1.37")=+k8s:minimum=0
 	MinReadySeconds int32 `json:"minReadySeconds,omitempty" protobuf:"varint,4,opt,name=minReadySeconds"`
 
 	// Selector is a label query over pods that should match the Replicas count.
@@ -5631,6 +5913,7 @@ type ReplicationControllerSpec struct {
 	// The only allowed template.spec.restartPolicy value is "Always".
 	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	Template *PodTemplateSpec `json:"template,omitempty" protobuf:"bytes,3,opt,name=template"`
 }
 
@@ -5699,17 +5982,18 @@ type ReplicationControllerCondition struct {
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +k8s:prerelease-lifecycle-gen:introduced=1.0
 // +k8s:supportsSubresource="/scale"
+// +k8s:supportsSubresource="/status"
 
 // ReplicationController represents the configuration of a replication controller.
 type ReplicationController struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// If the Labels of a ReplicationController are empty, they are defaulted to
 	// be the same as the Pod(s) that the replication controller manages.
 	// Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:format=k8s-long-name
+	// +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:format=k8s-long-name
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec defines the specification of the desired behavior of the replication controller.
@@ -5731,7 +6015,7 @@ type ReplicationController struct {
 
 // ReplicationControllerList is a collection of replication controllers.
 type ReplicationControllerList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -5891,6 +6175,7 @@ type ServiceStatus struct {
 	// +patchStrategy=merge
 	// +listType=map
 	// +listMapKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:opaqueType
 	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,2,rep,name=conditions"`
 }
 
@@ -6295,8 +6580,10 @@ type ServicePort struct {
 // Service is a named abstraction of software service (for example, mysql) consisting of local port
 // (for example 3306) that the proxy listens on, and the selector that determines which pods
 // will answer requests sent through the proxy.
+// +k8s:supportsSubresource="/status"
+// +k8s:supportsSubresource="/proxy"
 type Service struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -6326,7 +6613,7 @@ const (
 
 // ServiceList holds a list of services.
 type ServiceList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -6346,7 +6633,7 @@ type ServiceList struct {
 // * a principal that can be authenticated and authorized
 // * a set of secrets
 type ServiceAccount struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -6385,7 +6672,7 @@ type ServiceAccount struct {
 
 // ServiceAccountList is a list of ServiceAccount objects
 type ServiceAccountList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -6419,7 +6706,7 @@ type ServiceAccountList struct {
 //
 // Deprecated: This API is deprecated in v1.33+. Use discoveryv1.EndpointSlice.
 type Endpoints struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -6534,7 +6821,7 @@ type EndpointPort struct {
 // EndpointsList is a list of endpoints.
 // Deprecated: This API is deprecated in v1.33+.
 type EndpointsList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -6560,6 +6847,9 @@ type NodeSpec struct {
 
 	// ID of the node assigned by the cloud provider in the format: <ProviderName>://<ProviderSpecificNodeID>
 	// +optional
+	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:alpha(since: "1.36")=+k8s:update=NoModify
+	// +k8s:alpha(since: "1.36")=+k8s:update=NoUnset
 	ProviderID string `json:"providerID,omitempty" protobuf:"bytes,3,opt,name=providerID"`
 	// Unschedulable controls node schedulability of new pods. By default, node is schedulable.
 	// More info: https://kubernetes.io/docs/concepts/nodes/node/#manual-node-administration
@@ -6578,6 +6868,29 @@ type NodeSpec struct {
 	// see: https://issues.k8s.io/61966
 	// +optional
 	DoNotUseExternalID string `json:"externalID,omitempty" protobuf:"bytes,2,opt,name=externalID"`
+
+	// PodPreemptionPolicy controls the node-level preemption behaviors for pods on this node.
+	// This is an alpha field and requires enabling the InPlacePodVerticalScalingSchedulerPreemption feature gate.
+	// +featureGate=InPlacePodVerticalScalingSchedulerPreemption
+	// +optional
+	// +k8s:optional
+	// +k8s:ifDisabled(InPlacePodVerticalScalingSchedulerPreemption)=+k8s:forbidden
+	PodPreemptionPolicy *NodePodPreemptionPolicy `json:"podPreemptionPolicy,omitempty" protobuf:"bytes,8,opt,name=podPreemptionPolicy"`
+}
+
+// NodePodPreemptionPolicy defines the node-level policies governing preemption for pods on this node.
+type NodePodPreemptionPolicy struct {
+	// DisableResizePreemption lists the owners (e.g., autoscalers, operators, administrators)
+	// that have requested to disable scheduler and Kubelet preemption for in-place pod resize on this node.
+	// If this list is non-empty, resize-induced preemption is disabled on this node.
+	// This is an alpha field and requires enabling the InPlacePodVerticalScalingSchedulerPreemption feature gate.
+	// +listType=set
+	// +k8s:listType=set
+	// +optional
+	// +k8s:maxItems=20
+	// +k8s:optional
+	// +k8s:eachVal=+k8s:format=k8s-label-key
+	DisableResizePreemption []string `json:"disableResizePreemption,omitempty" protobuf:"bytes,1,rep,name=disableResizePreemption"`
 }
 
 // NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil.
@@ -6701,6 +7014,10 @@ type NodeSystemInfo struct {
 	Architecture string `json:"architecture" protobuf:"bytes,10,opt,name=architecture"`
 	// Swap Info reported by the node.
 	Swap *NodeSwapStatus `json:"swap,omitempty" protobuf:"bytes,11,opt,name=swap"`
+	// Whether the node is running in a user namespace.
+	// +featureGate=KubeletInUserNamespace
+	// +optional
+	RunningInUserNamespace *bool `json:"runningInUserNamespace,omitempty" protobuf:"varint,12,opt,name=runningInUserNamespace"`
 }
 
 // NodeSwapStatus represents swap memory information.
@@ -6918,6 +7235,37 @@ const (
 	NodePIDPressure NodeConditionType = "PIDPressure"
 	// NodeNetworkUnavailable means that network for the node is not correctly configured.
 	NodeNetworkUnavailable NodeConditionType = "NetworkUnavailable"
+	// NodeGracefulNodeShutdownInProgress reports whether Graceful Node Shutdown is determined to be in progress on this Node.
+	//
+	// The admin is responsible for setting and clearing this condition.
+	NodeGracefulNodeShutdownInProgress NodeConditionType = "GracefulNodeShutdownInProgress"
+	// NodeDrainInProgress reports that this Node is actively being drained,
+	// according to the admin's definition of drain.
+	// Commonly, this involves removing some amount of Pods, volumes, and networks.
+	//
+	// The admin is responsible for setting and clearing this condition.
+	NodeDrainInProgress NodeConditionType = "DrainInProgress"
+	// NodeDrained reports that this Node has reached the drain criteria selected by the admin.
+	//
+	// The admin is responsible for setting and clearing this condition.
+	NodeDrained NodeConditionType = "Drained"
+	// NodeMaintenancePlanned reports that this Node is expected to undergo a change in the future.
+	// If this change impacts Node users, the admin should drain the Node first.
+	//
+	// Admins can use the Node maintenance condition for cases like hardware or software rollout,
+	// remediation, decommissioning, or debugging.
+	//
+	// The admin is responsible for setting and clearing this condition.
+	NodeMaintenancePlanned NodeConditionType = "MaintenancePlanned"
+	// NodeMaintenanceInProgress reports that this Node is actively undergoing maintenance.
+	//
+	// The admin decides whether the change will impact Node users and require a Node drain.
+	// For example, it is recommended to drain a Node before a Kubernetes upgrade.
+	// In contrast, a kernel live patch may not require a Node drain, but it can still be useful
+	// to communicate that maintenance is in progress.
+	//
+	// The admin is responsible for setting and clearing this condition.
+	NodeMaintenanceInProgress NodeConditionType = "MaintenanceInProgress"
 )
 
 // NodeCondition contains condition information for a node.
@@ -7030,8 +7378,10 @@ type ResourceList map[ResourceName]resource.Quantity
 
 // Node is a worker node in Kubernetes.
 // Each node will have a unique identifier in the cache (i.e. in etcd).
+// +k8s:supportsSubresource="/status"
+// +k8s:supportsSubresource="/proxy"
 type Node struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -7055,7 +7405,7 @@ type Node struct {
 
 // NodeList is the whole list of all Nodes which have been registered with master.
 type NodeList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -7157,8 +7507,10 @@ type NamespaceCondition struct {
 
 // Namespace provides a scope for Names.
 // Use of multiple namespaces is optional.
+// +k8s:supportsSubresource="/status"
+// +k8s:supportsSubresource="/finalize"
 type Namespace struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -7180,7 +7532,7 @@ type Namespace struct {
 
 // NamespaceList is a list of Namespaces.
 type NamespaceList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -7196,10 +7548,11 @@ type NamespaceList struct {
 
 // Binding ties one object to another; for example, a pod is bound to a node by a scheduler.
 type Binding struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// The target object that you want to bind to the standard object.
@@ -7229,7 +7582,7 @@ const (
 
 // PodLogOptions is the query options for a Pod's logs REST call.
 type PodLogOptions struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// The container for which to stream logs. Defaults to only container if there is one container in the pod.
 	// +optional
@@ -7294,7 +7647,7 @@ type PodLogOptions struct {
 // TODO: merge w/ PodExecOptions below for stdin, stdout, etc
 // and also when we cut V2, we should export a "StreamOptions" or somesuch that contains Stdin, Stdout, Stder and TTY
 type PodAttachOptions struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Stdin if true, redirects the standard input stream of the pod for this call.
 	// Defaults to false.
@@ -7333,7 +7686,7 @@ type PodAttachOptions struct {
 // TODO: This is largely identical to PodAttachOptions above, make sure they stay in sync and see about merging
 // and also when we cut V2, we should export a "StreamOptions" or somesuch that contains Stdin, Stdout, Stder and TTY
 type PodExecOptions struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Redirect the standard input stream of the pod for this call.
 	// Defaults to false.
@@ -7374,7 +7727,7 @@ type PodExecOptions struct {
 // Port forwarding over SPDY does not use these options. It requires the port
 // to be passed in the `port` header as part of request.
 type PodPortForwardOptions struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// List of ports to forward
 	// Required when using WebSockets
@@ -7389,7 +7742,7 @@ type PodPortForwardOptions struct {
 
 // PodProxyOptions is the query options to a Pod's proxy call.
 type PodProxyOptions struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Path is the URL path to use for the current proxy request to pod.
 	// +optional
@@ -7402,7 +7755,7 @@ type PodProxyOptions struct {
 
 // NodeProxyOptions is the query options to a Node's proxy call.
 type NodeProxyOptions struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Path is the URL path to use for the current proxy request to node.
 	// +optional
@@ -7415,7 +7768,7 @@ type NodeProxyOptions struct {
 
 // ServiceProxyOptions is the query options to a Service's proxy call.
 type ServiceProxyOptions struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Path is the part of URLs that include service endpoints, suffixes,
 	// and parameters to use for the current proxy request to service.
@@ -7542,7 +7895,7 @@ type TypedLocalObjectReference struct {
 
 // SerializedReference is a reference to serialized object.
 type SerializedReference struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// The reference to an object in the system.
 	// +optional
 	Reference ObjectReference `json:"reference,omitempty" protobuf:"bytes,1,opt,name=reference"`
@@ -7577,7 +7930,7 @@ const (
 // continued existence of events with that Reason.  Events should be
 // treated as informative, best-effort, supplemental data.
 type Event struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	metav1.ObjectMeta `json:"metadata" protobuf:"bytes,1,opt,name=metadata"`
@@ -7657,7 +8010,7 @@ type EventSeries struct {
 
 // EventList is a list of events.
 type EventList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -7720,7 +8073,7 @@ type LimitRangeSpec struct {
 
 // LimitRange sets resource usage limits for each kind of resource in a Namespace.
 type LimitRange struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -7737,7 +8090,7 @@ type LimitRange struct {
 
 // LimitRangeList is a list of LimitRange items.
 type LimitRangeList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -7892,8 +8245,9 @@ type ResourceQuotaStatus struct {
 // +k8s:prerelease-lifecycle-gen:introduced=1.0
 
 // ResourceQuota sets aggregate quota restrictions enforced per namespace
+// +k8s:supportsSubresource="/status"
 type ResourceQuota struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -7915,7 +8269,7 @@ type ResourceQuota struct {
 
 // ResourceQuotaList is a list of ResourceQuota items.
 type ResourceQuotaList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -7933,7 +8287,7 @@ type ResourceQuotaList struct {
 // Secret holds secret data of a certain type. The total bytes of the values in
 // the Data field must be less than MaxSecretSize bytes.
 type Secret struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -7964,6 +8318,8 @@ type Secret struct {
 	// Used to facilitate programmatic handling of secret data.
 	// More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types
 	// +optional
+	// +k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
 	Type SecretType `json:"type,omitempty" protobuf:"bytes,3,opt,name=type,casttype=SecretType"`
 }
 
@@ -8059,7 +8415,7 @@ const (
 
 // SecretList is a list of Secret.
 type SecretList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -8076,7 +8432,7 @@ type SecretList struct {
 
 // ConfigMap holds configuration data for pods to consume.
 type ConfigMap struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -8104,6 +8460,8 @@ type ConfigMap struct {
 	// the Data field, this is enforced during validation process.
 	// Using this field will require 1.10+ apiserver and
 	// kubelet.
+	// Note: BinaryData keys are not currently propagated to container env vars
+	// via ConfigMapKeyRef or ConfigMapRef env sources; only Data keys are used.
 	// +optional
 	BinaryData map[string][]byte `json:"binaryData,omitempty" protobuf:"bytes,3,rep,name=binaryData"`
 }
@@ -8113,7 +8471,7 @@ type ConfigMap struct {
 
 // ConfigMapList is a resource containing a list of ConfigMap objects.
 type ConfigMapList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -8157,10 +8515,11 @@ type ComponentCondition struct {
 // ComponentStatus (and ComponentStatusList) holds the cluster validation info.
 // Deprecated: This API is deprecated in v1.19+
 type ComponentStatus struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// List of component conditions observed
@@ -8178,7 +8537,7 @@ type ComponentStatus struct {
 // Status of all the conditions for the component as a list of ComponentStatus objects.
 // Deprecated: This API is deprecated in v1.19+
 type ComponentStatusList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -8205,6 +8564,12 @@ type DownwardAPIVolumeSource struct {
 	// mode, like fsGroup, and the result can be other mode bits set.
 	// +optional
 	DefaultMode *int32 `json:"defaultMode,omitempty" protobuf:"varint,2,opt,name=defaultMode"`
+	// defaultUser is Optional: The owner UID of the created files by default.
+	// The defaultUser field is only used as a fallback when the item-level user field is unset.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	// +featureGate=AtomicWriteVolumeUserFields
+	// +optional
+	DefaultUser *int64 `json:"defaultUser,omitempty" protobuf:"varint,3,opt,name=defaultUser"`
 }
 
 const (
@@ -8230,6 +8595,12 @@ type DownwardAPIVolumeFile struct {
 	// mode, like fsGroup, and the result can be other mode bits set.
 	// +optional
 	Mode *int32 `json:"mode,omitempty" protobuf:"varint,4,opt,name=mode"`
+	// user is Optional: The owner UID of the created file.
+	// If specified, the item-level user field takes precedence over defaultUser.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	// +featureGate=AtomicWriteVolumeUserFields
+	// +optional
+	User *int64 `json:"user,omitempty" protobuf:"varint,5,opt,name=user"`
 }
 
 // Represents downward API info for projecting into a projected volume.
@@ -8388,10 +8759,11 @@ type WindowsSecurityContextOptions struct {
 
 // RangeAllocation is not a public type.
 type RangeAllocation struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Range is string that identifies the range represented by 'data'.
@@ -8518,12 +8890,78 @@ type ImageVolumeSource struct {
 type NodeAllocatableResourceClaimStatus struct {
 	// ResourceClaimName is the resource claim referenced by the pod that resulted in this node allocatable resource allocation.
 	// +required
+	// +k8s:required
 	ResourceClaimName string `json:"resourceClaimName" protobuf:"bytes,1,opt,name=resourceClaimName"`
 	// Containers lists the names of all containers in this pod that reference the claim.
 	// +optional
 	// +listType=set
+	// +k8s:optional
+	// +k8s:listType=set
 	Containers []string `json:"containers,omitempty" protobuf:"bytes,2,rep,name=containers"`
-	// Resources is a map of the node-allocatable resource name to the aggregate quantity allocated to the claim.
+
+	// Resources is tombstoned since it got replaced with more granular Mapping and Overhead fields.
+	// Resources map[ResourceName]resource.Quantity `json:"resources,omitempty" protobuf:"bytes,3,rep,name=resources"`
+
+	// Mapping contains allocations through devices mapped in the device spec's `nodeAllocatableResources[...].mapping` field.
+	// This is used by kubelet for pod level and container-level cgroup enforcement.
+	// +optional
+	// +patchStrategy=merge
+	// +patchMergeKey=name
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	Mapping []NodeAllocatableMappedResources `json:"mapping,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,4,rep,name=mapping"`
+	// Overhead contains allocations through devices mapped in the device spec's `nodeAllocatableResources[...].overhead` field.
+	// This is used by kubelet for pod level and container-level cgroup enforcement.
+	// +optional
+	// +patchStrategy=merge
+	// +patchMergeKey=name
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	Overhead []NodeAllocatableOverheadResources `json:"overhead,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,5,rep,name=overhead"`
+}
+
+// NodeAllocatableMappedResources describes mapped node allocatable resource allocations.
+type NodeAllocatableMappedResources struct {
+	// Name is the name of the resource (e.g., cpu, memory).
+	// +required
+	// +k8s:required
+	Name ResourceName `json:"name" protobuf:"bytes,1,opt,name=name,casttype=ResourceName"`
+	// Quantity is the total node allocatable resource capacity allocated for the claim.
+	// This claim's allocated devices is shared by all the containers referencing the claim.
+	// Kubelet adds this value to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.
+	// +required
+	// +k8s:required
+	Quantity *resource.Quantity `json:"quantity" protobuf:"bytes,2,opt,name=quantity"`
+}
+
+// NodeAllocatableOverheadResources describes auxiliary overhead resource allocations.
+type NodeAllocatableOverheadResources struct {
+	// Name is the name of the resource (e.g., cpu, memory).
 	// +required
-	Resources map[ResourceName]resource.Quantity `json:"resources" protobuf:"bytes,3,rep,name=resources"`
+	// +k8s:required
+	Name ResourceName `json:"name" protobuf:"bytes,1,opt,name=name,casttype=ResourceName"`
+	// PerPod is the flat overhead quantity allocated per pod.
+	// Adding to each container limit allows individual containers to utilize the overhead, while the parent pod-level cgroup limit caps the total usage at the pod boundary where the overhead is accounted for exactly once.
+	// At least one of PerPod or PerContainer must be specified. Specifying neither is an invalid configuration.
+	// +optional
+	// +k8s:optional
+	PerPod *resource.Quantity `json:"perPod,omitempty" protobuf:"bytes,2,opt,name=perPod"`
+	// PerContainer is the variable overhead quantity applied for each container referencing the claim.
+	// The container references are recorded in `nodeAllocatableResourceClaimStatuses.containers`.
+	// The total overhead quantity allocated for the claim is computed as:
+	// Quantity = PerPod + (PerContainer * NumReferences)
+	// Kubelet accounts for this overhead in cgroups:
+	// - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences).
+	// - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container.
+	// This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once.
+	// At least one of PerPod or PerContainer must be specified. Specifying neither is an invalid configuration.
+	// +optional
+	// +k8s:optional
+	PerContainer *resource.Quantity `json:"perContainer,omitempty" protobuf:"bytes,3,opt,name=perContainer"`
 }
diff --git a/vendor/k8s.io/api/core/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/core/v1/types_swagger_doc_generated.go
index 97eb5ceec3..4b68c56852 100644
--- a/vendor/k8s.io/api/core/v1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/core/v1/types_swagger_doc_generated.go
@@ -235,6 +235,7 @@ var map_ClusterTrustBundleProjection = map[string]string{
 	"labelSelector": "Select all ClusterTrustBundles that match this label selector.  Only has effect if signerName is set.  Mutually-exclusive with name.  If unset, interpreted as \"match nothing\".  If set but empty, interpreted as \"match everything\".",
 	"optional":      "If true, don't block pod startup if the referenced ClusterTrustBundle(s) aren't available.  If using name, then the named ClusterTrustBundle is allowed not to exist.  If using signerName, then the combination of signerName and labelSelector is allowed to match zero ClusterTrustBundles.",
 	"path":          "Relative path from the volume root to write the bundle.",
+	"user":          "user is Optional: The owner UID of the created file. If specified, the item-level user field takes precedence over defaultUser. (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.",
 }
 
 func (ClusterTrustBundleProjection) SwaggerDoc() map[string]string {
@@ -278,7 +279,7 @@ var map_ConfigMap = map[string]string{
 	"metadata":   "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"immutable":  "Immutable, if set to true, ensures that data stored in the ConfigMap cannot be updated (only object metadata can be modified). If not set to true, the field can be modified at any time. Defaulted to nil.",
 	"data":       "Data contains the configuration data. Each key must consist of alphanumeric characters, '-', '_' or '.'. Values with non-UTF-8 byte sequences must use the BinaryData field. The keys stored in Data must not overlap with the keys in the BinaryData field, this is enforced during validation process.",
-	"binaryData": "BinaryData contains the binary data. Each key must consist of alphanumeric characters, '-', '_' or '.'. BinaryData can contain byte sequences that are not in the UTF-8 range. The keys stored in BinaryData must not overlap with the ones in the Data field, this is enforced during validation process. Using this field will require 1.10+ apiserver and kubelet.",
+	"binaryData": "BinaryData contains the binary data. Each key must consist of alphanumeric characters, '-', '_' or '.'. BinaryData can contain byte sequences that are not in the UTF-8 range. The keys stored in BinaryData must not overlap with the ones in the Data field, this is enforced during validation process. Using this field will require 1.10+ apiserver and kubelet. Note: BinaryData keys are not currently propagated to container env vars via ConfigMapKeyRef or ConfigMapRef env sources; only Data keys are used.",
 }
 
 func (ConfigMap) SwaggerDoc() map[string]string {
@@ -286,7 +287,7 @@ func (ConfigMap) SwaggerDoc() map[string]string {
 }
 
 var map_ConfigMapEnvSource = map[string]string{
-	"":         "ConfigMapEnvSource selects a ConfigMap to populate the environment variables with.\n\nThe contents of the target ConfigMap's Data field will represent the key-value pairs as environment variables.",
+	"":         "ConfigMapEnvSource selects a ConfigMap to populate the environment variables with.\n\nThe contents of the target ConfigMap's Data field will represent the key-value pairs as environment variables. Keys in the BinaryData field are not currently propagated to container env vars.",
 	"optional": "Specify whether the ConfigMap must be defined",
 }
 
@@ -296,7 +297,7 @@ func (ConfigMapEnvSource) SwaggerDoc() map[string]string {
 
 var map_ConfigMapKeySelector = map[string]string{
 	"":         "Selects a key from a ConfigMap.",
-	"key":      "The key to select.",
+	"key":      "The key to select from the ConfigMap's Data field. Keys in the BinaryData field are not currently propagated to container env vars.",
 	"optional": "Specify whether the ConfigMap or its key must be defined",
 }
 
@@ -342,6 +343,7 @@ var map_ConfigMapVolumeSource = map[string]string{
 	"items":       "items if unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'.",
 	"defaultMode": "defaultMode is optional: mode bits used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
 	"optional":    "optional specify whether the ConfigMap or its keys must be defined",
+	"defaultUser": "defaultUser is Optional: The owner UID of the created files by default. The defaultUser field is only used as a fallback when the item-level user field is unset. (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.",
 }
 
 func (ConfigMapVolumeSource) SwaggerDoc() map[string]string {
@@ -546,6 +548,7 @@ var map_DownwardAPIVolumeFile = map[string]string{
 	"fieldRef":         "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.",
 	"resourceFieldRef": "Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.",
 	"mode":             "Optional: mode bits used to set permissions on this file, must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+	"user":             "user is Optional: The owner UID of the created file. If specified, the item-level user field takes precedence over defaultUser. (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.",
 }
 
 func (DownwardAPIVolumeFile) SwaggerDoc() map[string]string {
@@ -556,6 +559,7 @@ var map_DownwardAPIVolumeSource = map[string]string{
 	"":            "DownwardAPIVolumeSource represents a volume containing downward API info. Downward API volumes support ownership management and SELinux relabeling.",
 	"items":       "Items is a list of downward API volume file",
 	"defaultMode": "Optional: mode bits to use on created files by default. Must be a Optional: mode bits used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+	"defaultUser": "defaultUser is Optional: The owner UID of the created files by default. The defaultUser field is only used as a fallback when the item-level user field is unset. (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.",
 }
 
 func (DownwardAPIVolumeSource) SwaggerDoc() map[string]string {
@@ -566,6 +570,7 @@ var map_EmptyDirVolumeSource = map[string]string{
 	"":          "Represents an empty directory for a pod. Empty directory volumes support ownership management and SELinux relabeling.",
 	"medium":    "medium represents what type of storage medium should back this directory. The default is \"\" which means to use the node's default medium. Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir",
 	"sizeLimit": "sizeLimit is the total amount of local storage required for this EmptyDir volume. The size limit is also applicable for memory medium. The maximum usage on memory medium EmptyDir would be the minimum value between the SizeLimit specified here and the sum of memory limits of all containers in a pod. The default is nil which means that the limit is undefined. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir",
+	"mode":      "mode specifies the permission bits for the emptyDir directory, in numeric notation (e.g., 0755, 01777). Must be a value between 0000 and 01777. If not specified, defaults to 0777. This might be in conflict with other options that affect the file mode, like fsGroup. If fsGroup is specified, the fsGroup permissions will override the mode specified here. This field has no effect on Windows. This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled.",
 }
 
 func (EmptyDirVolumeSource) SwaggerDoc() map[string]string {
@@ -766,6 +771,16 @@ func (EventSource) SwaggerDoc() map[string]string {
 	return map_EventSource
 }
 
+var map_EvictionResponder = map[string]string{
+	"":         "EvictionResponder allows you to specify the responder reacting to an Eviction. Responders should observe and communicate through the Eviction Resource API to help with the graceful eviction of a target (e.g. termination of a pod).",
+	"name":     "name allows you to identify the responder responding to the Eviction.\n\nIt must be a valid domain-prefixed key (such as \"acme.io/foo\"). Domain names *.k8s.io and *.kubernetes.io are reserved. This field must be unique for each responder. This field is required.",
+	"priority": "priority for this responder. Higher priorities are selected first by the evictionrequest-controller. If there are responders with the same priority, the responder whose domain name comes first in the alphabetical higher domain order, will be picked. This means that the top domain labels are compared alphabetically first, followed by the lower domain labels. The key is compared last.\n\nThe responder that is the managing controller of the pod should set the value of this field to 10000 to allow both for preemption or fallback registration by other responders.\n\nThe minimum value is 0 and the maximum value is 100000. The interval 0-999 is reserved for responders with *.k8s.io suffix. This field is required.",
+}
+
+func (EvictionResponder) SwaggerDoc() map[string]string {
+	return map_EvictionResponder
+}
+
 var map_ExecAction = map[string]string{
 	"":        "ExecAction describes a \"run in container\" action.",
 	"command": "Command is the command line to execute inside the container, the working directory for the command  is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.",
@@ -852,6 +867,7 @@ var map_GRPCAction = map[string]string{
 	"":        "GRPCAction specifies an action involving a GRPC service.",
 	"port":    "Port number of the gRPC service. Number must be in the range 1 to 65535.",
 	"service": "Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.",
+	"mode":    "mode specifies the connection mode for the gRPC health probe. Set to \"TLS\" to use TLS without certificate verification. Set to \"Plaintext\" to use a plaintext (insecure) connection explicitly. If not specified, the probe uses a plaintext (insecure) connection.",
 }
 
 func (GRPCAction) SwaggerDoc() map[string]string {
@@ -899,6 +915,7 @@ var map_HTTPGetAction = map[string]string{
 	"host":        "Host name to connect to, defaults to the pod IP. You probably want to set \"Host\" in httpHeaders instead.",
 	"scheme":      "Scheme to use for connecting to the host. Defaults to HTTP.",
 	"httpHeaders": "Custom headers to set in the request. HTTP allows repeated headers.",
+	"protocol":    "Protocol selects the wire protocol for the probe connection. Nil defaults to HTTP/1.1.",
 }
 
 func (HTTPGetAction) SwaggerDoc() map[string]string {
@@ -1006,6 +1023,7 @@ var map_KeyToPath = map[string]string{
 	"key":  "key is the key to project.",
 	"path": "path is the relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'.",
 	"mode": "mode is Optional: mode bits used to set permissions on this file. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+	"user": "user is Optional: The owner UID of the created file. If specified, the item-level user field takes precedence over defaultUser. (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.",
 }
 
 func (KeyToPath) SwaggerDoc() map[string]string {
@@ -1234,11 +1252,33 @@ func (NodeAffinity) SwaggerDoc() map[string]string {
 	return map_NodeAffinity
 }
 
+var map_NodeAllocatableMappedResources = map[string]string{
+	"":         "NodeAllocatableMappedResources describes mapped node allocatable resource allocations.",
+	"name":     "Name is the name of the resource (e.g., cpu, memory).",
+	"quantity": "Quantity is the total node allocatable resource capacity allocated for the claim. This claim's allocated devices is shared by all the containers referencing the claim. Kubelet adds this value to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.",
+}
+
+func (NodeAllocatableMappedResources) SwaggerDoc() map[string]string {
+	return map_NodeAllocatableMappedResources
+}
+
+var map_NodeAllocatableOverheadResources = map[string]string{
+	"":             "NodeAllocatableOverheadResources describes auxiliary overhead resource allocations.",
+	"name":         "Name is the name of the resource (e.g., cpu, memory).",
+	"perPod":       "PerPod is the flat overhead quantity allocated per pod. Adding to each container limit allows individual containers to utilize the overhead, while the parent pod-level cgroup limit caps the total usage at the pod boundary where the overhead is accounted for exactly once. At least one of PerPod or PerContainer must be specified. Specifying neither is an invalid configuration.",
+	"perContainer": "PerContainer is the variable overhead quantity applied for each container referencing the claim. The container references are recorded in `nodeAllocatableResourceClaimStatuses.containers`. The total overhead quantity allocated for the claim is computed as: Quantity = PerPod + (PerContainer * NumReferences) Kubelet accounts for this overhead in cgroups: - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences). - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container. This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once. At least one of PerPod or PerContainer must be specified. Specifying neither is an invalid configuration.",
+}
+
+func (NodeAllocatableOverheadResources) SwaggerDoc() map[string]string {
+	return map_NodeAllocatableOverheadResources
+}
+
 var map_NodeAllocatableResourceClaimStatus = map[string]string{
 	"":                  "NodeAllocatableResourceClaimStatus describes the status of node allocatable resources allocated via DRA.",
 	"resourceClaimName": "ResourceClaimName is the resource claim referenced by the pod that resulted in this node allocatable resource allocation.",
 	"containers":        "Containers lists the names of all containers in this pod that reference the claim.",
-	"resources":         "Resources is a map of the node-allocatable resource name to the aggregate quantity allocated to the claim.",
+	"mapping":           "Mapping contains allocations through devices mapped in the device spec's `nodeAllocatableResources[...].mapping` field. This is used by kubelet for pod level and container-level cgroup enforcement.",
+	"overhead":          "Overhead contains allocations through devices mapped in the device spec's `nodeAllocatableResources[...].overhead` field. This is used by kubelet for pod level and container-level cgroup enforcement.",
 }
 
 func (NodeAllocatableResourceClaimStatus) SwaggerDoc() map[string]string {
@@ -1308,6 +1348,15 @@ func (NodeList) SwaggerDoc() map[string]string {
 	return map_NodeList
 }
 
+var map_NodePodPreemptionPolicy = map[string]string{
+	"":                        "NodePodPreemptionPolicy defines the node-level policies governing preemption for pods on this node.",
+	"disableResizePreemption": "DisableResizePreemption lists the owners (e.g., autoscalers, operators, administrators) that have requested to disable scheduler and Kubelet preemption for in-place pod resize on this node. If this list is non-empty, resize-induced preemption is disabled on this node. This is an alpha field and requires enabling the InPlacePodVerticalScalingSchedulerPreemption feature gate.",
+}
+
+func (NodePodPreemptionPolicy) SwaggerDoc() map[string]string {
+	return map_NodePodPreemptionPolicy
+}
+
 var map_NodeProxyOptions = map[string]string{
 	"":     "NodeProxyOptions is the query options to a Node's proxy call.",
 	"path": "Path is the URL path to use for the current proxy request to node.",
@@ -1368,14 +1417,15 @@ func (NodeSelectorTerm) SwaggerDoc() map[string]string {
 }
 
 var map_NodeSpec = map[string]string{
-	"":              "NodeSpec describes the attributes that a node is created with.",
-	"podCIDR":       "PodCIDR represents the pod IP range assigned to the node.",
-	"podCIDRs":      "podCIDRs represents the IP ranges assigned to the node for usage by Pods on that node. If this field is specified, the 0th entry must match the podCIDR field. It may contain at most 1 value for each of IPv4 and IPv6.",
-	"providerID":    "ID of the node assigned by the cloud provider in the format: <ProviderName>://<ProviderSpecificNodeID>",
-	"unschedulable": "Unschedulable controls node schedulability of new pods. By default, node is schedulable. More info: https://kubernetes.io/docs/concepts/nodes/node/#manual-node-administration",
-	"taints":        "If specified, the node's taints.",
-	"configSource":  "Deprecated: Previously used to specify the source of the node's configuration for the DynamicKubeletConfig feature. This feature is removed.",
-	"externalID":    "Deprecated. Not all kubelets will set this field. Remove field after 1.13. see: https://issues.k8s.io/61966",
+	"":                    "NodeSpec describes the attributes that a node is created with.",
+	"podCIDR":             "PodCIDR represents the pod IP range assigned to the node.",
+	"podCIDRs":            "podCIDRs represents the IP ranges assigned to the node for usage by Pods on that node. If this field is specified, the 0th entry must match the podCIDR field. It may contain at most 1 value for each of IPv4 and IPv6.",
+	"providerID":          "ID of the node assigned by the cloud provider in the format: <ProviderName>://<ProviderSpecificNodeID>",
+	"unschedulable":       "Unschedulable controls node schedulability of new pods. By default, node is schedulable. More info: https://kubernetes.io/docs/concepts/nodes/node/#manual-node-administration",
+	"taints":              "If specified, the node's taints.",
+	"configSource":        "Deprecated: Previously used to specify the source of the node's configuration for the DynamicKubeletConfig feature. This feature is removed.",
+	"externalID":          "Deprecated. Not all kubelets will set this field. Remove field after 1.13. see: https://issues.k8s.io/61966",
+	"podPreemptionPolicy": "PodPreemptionPolicy controls the node-level preemption behaviors for pods on this node. This is an alpha field and requires enabling the InPlacePodVerticalScalingSchedulerPreemption feature gate.",
 }
 
 func (NodeSpec) SwaggerDoc() map[string]string {
@@ -1426,6 +1476,7 @@ var map_NodeSystemInfo = map[string]string{
 	"operatingSystem":         "The Operating System reported by the node",
 	"architecture":            "The Architecture reported by the node",
 	"swap":                    "Swap Info reported by the node.",
+	"runningInUserNamespace":  "Whether the node is running in a user namespace.",
 }
 
 func (NodeSystemInfo) SwaggerDoc() map[string]string {
@@ -1511,8 +1562,8 @@ var map_PersistentVolumeClaimSpec = map[string]string{
 	"volumeName":                "volumeName is the binding reference to the PersistentVolume backing this claim.",
 	"storageClassName":          "storageClassName is the name of the StorageClass required by the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1",
 	"volumeMode":                "volumeMode defines what type of volume is required by the claim. Value of Filesystem is implied when not included in claim spec.",
-	"dataSource":                "dataSource field can be used to specify either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource.",
-	"dataSourceRef":             "dataSourceRef specifies the object from which to populate the volume with data, if a non-empty volume is desired. This may be any object from a non-empty API group (non core object) or a PersistentVolumeClaim object. When this field is specified, volume binding will only succeed if the type of the specified object matches some installed volume populator or dynamic provisioner. This field will replace the functionality of the dataSource field and as such if both fields are non-empty, they must have the same value. For backwards compatibility, when namespace isn't specified in dataSourceRef, both fields (dataSource and dataSourceRef) will be set to the same value automatically if one of them is empty and the other is non-empty. When namespace is specified in dataSourceRef, dataSource isn't set to the same value and must be empty. There are three important differences between dataSource and dataSourceRef: * While dataSource only allows two specific types of objects, dataSourceRef\n  allows any non-core object, as well as PersistentVolumeClaim objects.\n* While dataSource ignores disallowed values (dropping them), dataSourceRef\n  preserves all values, and generates an error if a disallowed value is\n  specified.\n* While dataSource only allows local objects, dataSourceRef allows objects\n  in any namespaces.\n(Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.",
+	"dataSource":                "dataSource field can be used to specify either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource.",
+	"dataSourceRef":             "dataSourceRef specifies the object from which to populate the volume with data, if a non-empty volume is desired. This may be any object from a non-empty API group (non core object) or a PersistentVolumeClaim object. When this field is specified, volume binding will only succeed if the type of the specified object matches some installed volume populator or dynamic provisioner. This field will replace the functionality of the dataSource field and as such if both fields are non-empty, they must have the same value. For backwards compatibility, when namespace isn't specified in dataSourceRef, both fields (dataSource and dataSourceRef) will be set to the same value automatically if one of them is empty and the other is non-empty. When namespace is specified in dataSourceRef, dataSource isn't set to the same value and must be empty. There are three important differences between dataSource and dataSourceRef: * While dataSource only allows two specific types of objects, dataSourceRef\n  allows any non-core object, as well as PersistentVolumeClaim objects.\n* While dataSource ignores disallowed values (dropping them), dataSourceRef\n  preserves all values, and generates an error if a disallowed value is\n  specified.\n* While dataSource only allows local objects, dataSourceRef allows objects\n  in any namespaces.\n(Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.",
 	"volumeAttributesClassName": "volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. If specified, the CSI driver will create or update the volume with the attributes defined in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, it can be changed after the claim is created. An empty string or nil value indicates that no VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state, this field can be reset to its previous value (including nil) to cancel the modification. If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource exists. More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/",
 }
 
@@ -1530,6 +1581,7 @@ var map_PersistentVolumeClaimStatus = map[string]string{
 	"allocatedResourceStatuses":        "allocatedResourceStatuses stores status of resource being resized for the given PVC. Key names follow standard Kubernetes label syntax. Valid values are either:\n\t* Un-prefixed keys:\n\t\t- storage - the capacity of the volume.\n\t* Custom resources must use implementation-defined prefixed names such as \"example.com/my-custom-resource\"\nApart from above values - keys that are unprefixed or have kubernetes.io prefix are considered reserved and hence may not be used.\n\nClaimResourceStatus can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState set when resize controller starts resizing the volume in control-plane.\n\t- ControllerResizeFailed:\n\t\tState set when resize has failed in resize controller with a terminal error.\n\t- NodeResizePending:\n\t\tState set when resize controller has finished resizing the volume but further resizing of\n\t\tvolume is needed on the node.\n\t- NodeResizeInProgress:\n\t\tState set when kubelet starts resizing the volume.\n\t- NodeResizeFailed:\n\t\tState set when resizing has failed in kubelet with a terminal error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor example: if expanding a PVC for more capacity - this field can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] = \"ControllerResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage'] = \"ControllerResizeFailed\"\n     - pvc.status.allocatedResourceStatus['storage'] = \"NodeResizePending\"\n     - pvc.status.allocatedResourceStatus['storage'] = \"NodeResizeInProgress\"\n     - pvc.status.allocatedResourceStatus['storage'] = \"NodeResizeFailed\"\nWhen this field is not set, it means that no resize operation is in progress for the given PVC.\n\nA controller that receives PVC update with previously unknown resourceName or ClaimResourceStatus should ignore the update for the purpose it was designed. For example - a controller that only is responsible for resizing capacity of the volume, should ignore PVC updates that change other valid resources associated with PVC.",
 	"currentVolumeAttributesClassName": "currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim",
 	"modifyVolumeStatus":               "ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. When this is unset, there is no ModifyVolume operation being attempted.",
+	"healthStatus":                     "healthStatus contains the latest controller-reported health information for the volume bound to this claim.",
 }
 
 func (PersistentVolumeClaimStatus) SwaggerDoc() map[string]string {
@@ -1702,6 +1754,7 @@ var map_PodCertificateProjection = map[string]string{
 	"keyPath":              "Write the key at this path in the projected volume.\n\nMost applications should use credentialBundlePath.  When using keyPath and certificateChainPath, your application needs to check that the key and leaf certificate are consistent, because it is possible to read the files mid-rotation.",
 	"certificateChainPath": "Write the certificate chain at this path in the projected volume.\n\nMost applications should use credentialBundlePath.  When using keyPath and certificateChainPath, your application needs to check that the key and leaf certificate are consistent, because it is possible to read the files mid-rotation.",
 	"userAnnotations":      "userAnnotations allow pod authors to pass additional information to the signer implementation.  Kubernetes does not restrict or validate this metadata in any way.\n\nThese values are copied verbatim into the `spec.unverifiedUserAnnotations` field of the PodCertificateRequest objects that Kubelet creates.\n\nEntries are subject to the same validation as object metadata annotations, with the addition that all keys must be domain-prefixed. No restrictions are placed on values, except an overall size limitation on the entire field.\n\nSigners should document the keys and values they support. Signers should deny requests that contain keys they do not recognize.",
+	"user":                 "user is Optional: The owner UID of the created file. If specified, the item-level user field takes precedence over defaultUser. (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.",
 }
 
 func (PodCertificateProjection) SwaggerDoc() map[string]string {
@@ -1894,7 +1947,7 @@ var map_PodSecurityContext = map[string]string{
 	"fsGroupChangePolicy":      "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are \"OnRootMismatch\" and \"Always\". If not specified, \"Always\" is used. Note that this field cannot be set when spec.os.name is windows.",
 	"seccompProfile":           "The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows.",
 	"appArmorProfile":          "appArmorProfile is the AppArmor options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows.",
-	"seLinuxChangePolicy":      "seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod. It has no effect on nodes that do not support SELinux or to volumes does not support SELinux. Valid values are \"MountOption\" and \"Recursive\".\n\n\"Recursive\" means relabeling of all files on all Pod volumes by the container runtime. This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.\n\n\"MountOption\" mounts all eligible Pod volumes with `-o context` mount option. This requires all Pods that share the same volume to use the same SELinux label. It is not possible to share the same volume among privileged and unprivileged Pods. Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively. \"MountOption\" value is allowed only when SELinuxMount feature gate is enabled.\n\nIf not specified and SELinuxMount feature gate is enabled, \"MountOption\" is used. If not specified and SELinuxMount feature gate is disabled, \"MountOption\" is used for ReadWriteOncePod volumes and \"Recursive\" for all other volumes.\n\nThis field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.\n\nAll Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state. Note that this field cannot be set when spec.os.name is windows.",
+	"seLinuxChangePolicy":      "seLinuxChangePolicy defines how the container's SELinux label is applied to all volumes used by the Pod. It has no effect on nodes that do not support SELinux or to volumes does not support SELinux. Valid values are \"MountOption\" and \"Recursive\".\n\n\"Recursive\" means relabeling of all files on all Pod volumes by the container runtime. This may be slow for large volumes, but allows mixing privileged and unprivileged Pods sharing the same volume on the same node.\n\n\"MountOption\" mounts all eligible Pod volumes with `-o context` mount option. This requires all Pods that share the same volume to use the same SELinux label. It is not possible to share the same volume among privileged and unprivileged Pods. Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their CSIDriver instance. Other volumes are always re-labelled recursively.\n\nIf not specified, \"MountOption\" is used.\n\nThis field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.\n\nAll Pods that use the same volume should use the same seLinuxChangePolicy, otherwise some pods can get stuck in ContainerCreating state. Note that this field cannot be set when spec.os.name is windows.",
 }
 
 func (PodSecurityContext) SwaggerDoc() map[string]string {
@@ -1943,7 +1996,7 @@ var map_PodSpec = map[string]string{
 	"readinessGates":                "If specified, all readiness gates will be evaluated for pod readiness. A pod is ready when all its containers are ready AND all conditions specified in the readiness gates have status equal to \"True\" More info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates",
 	"runtimeClassName":              "RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used to run this pod.  If no RuntimeClass resource matches the named class, the pod will not be run. If unset or empty, the \"legacy\" RuntimeClass will be used, which is an implicit class with an empty definition that uses the default runtime handler. More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class",
 	"enableServiceLinks":            "EnableServiceLinks indicates whether information about services should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Defaults to true.",
-	"preemptionPolicy":              "PreemptionPolicy is the Policy for preempting pods with lower priority. One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset.",
+	"preemptionPolicy":              "PreemptionPolicy is the Policy for preempting pods with lower priority. One of Never, PreemptLowerPriority. When Priority Admission Controller is enabled, it prevents users from setting this field. The admission controller populates this field from PriorityClassName. Defaults to PreemptLowerPriority if unset.",
 	"overhead":                      "Overhead represents the resource overhead associated with running a pod for a given RuntimeClass. This field will be autopopulated at admission time by the RuntimeClass admission controller. If the RuntimeClass admission controller is enabled, overhead must not be set in Pod create requests. The RuntimeClass admission controller will reject Pod create requests which have the overhead already set. If RuntimeClass is configured and selected in the PodSpec, Overhead will be set to the value defined in the corresponding RuntimeClass, otherwise it will remain unset and treated as zero. More info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md",
 	"topologySpreadConstraints":     "TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed.",
 	"setHostnameAsFQDN":             "If true the pod's hostname will be configured as the pod's FQDN, rather than the leaf name (the default). In Linux containers, this means setting the FQDN in the hostname field of the kernel (the nodename field of struct utsname). In Windows containers, this means setting the registry value of hostname for the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters to FQDN. If a pod does not have FQDN, this has no effect. Default to false.",
@@ -1952,8 +2005,9 @@ var map_PodSpec = map[string]string{
 	"schedulingGates":               "SchedulingGates is an opaque list of values that if specified will block scheduling the pod. If schedulingGates is not empty, the pod will stay in the SchedulingGated state and the scheduler will not attempt to schedule the pod.\n\nSchedulingGates can only be set at pod creation time, and be removed only afterwards.",
 	"resourceClaims":                "ResourceClaims defines which ResourceClaims must be allocated and reserved before the Pod is allowed to start. The resources will be made available to those containers which consume them by name.\n\nThis is a stable field but requires that the DynamicResourceAllocation feature gate is enabled.\n\nThis field is immutable.",
 	"resources":                     "Resources is the total amount of CPU and Memory resources required by all containers in the pod. It supports specifying Requests and Limits for \"cpu\", \"memory\" and \"hugepages-\" resource names only. ResourceClaims are not supported.\n\nThis field enables fine-grained control over resource allocation for the entire pod, allowing resource sharing among containers in a pod.\n\nThis is an alpha field and requires enabling the PodLevelResources feature gate.",
-	"hostnameOverride":              "HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod. This field only specifies the pod's hostname and does not affect its DNS records. When this field is set to a non-empty string: - It takes precedence over the values set in `hostname` and `subdomain`. - The Pod's hostname will be set to this value. - `setHostnameAsFQDN` must be nil or set to false. - `hostNetwork` must be set to false.\n\nThis field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters. Requires the HostnameOverride feature gate to be enabled.",
+	"hostnameOverride":              "HostnameOverride specifies an explicit override for the pod's hostname as perceived by the pod. This field only specifies the pod's hostname and does not affect its DNS records. When this field is set to a non-empty string: - It takes precedence over the values set in `hostname` and `subdomain`. - The Pod's hostname will be set to this value. - `setHostnameAsFQDN` must be nil or set to false. - `hostNetwork` must be set to false.\n\nThis field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.",
 	"schedulingGroup":               "SchedulingGroup provides a reference to the immediate scheduling runtime grouping object that this Pod belongs to. This field is used by the scheduler to identify the group and apply the correct group scheduling policies. The association with a group also impacts other lifecycle aspects of a Pod that are relevant in a wider context of scheduling like preemption, resource attachment, etc. If not specified, the Pod is treated as a single unit in all of these aspects. The group object referenced by this field may not exist at the time the Pod is created. This field is immutable, but a group object with the same name may be recreated with different policies. Doing this during pod scheduling may result in the placement not conforming to the expected policies.",
+	"evictionResponders":            "evictionResponders reference responders that react to Evictions based on EvictionRequests. Responders should observe and communicate through the Eviction Resource API to help with the graceful termination of a pod. The responders are selected sequentially, according to their specified priority.\n\nResponders should periodically report on an eviction progress by updating the .status.responders[].heartbeatTime field of the Eviction object. If this field is not updated within the heartbeat deadline defined by the Eviction API (currently 20 minutes), the eviction is passed over to the next responder with a lower priority. If there is no other responder, the last default imperative-eviction.k8s.io/evictor responder with a priority of 100 will evict the pod using the imperative Eviction API (pods/<name>/eviction subresource).\n\nThe maximum length of the responders list is 10. Responders are not supported when the pod is part of a PodGroup (.spec.schedulingGroup is set). This field can only be set on creation and is immutable afterwards.",
 }
 
 func (PodSpec) SwaggerDoc() map[string]string {
@@ -1983,22 +2037,13 @@ var map_PodStatus = map[string]string{
 	"allocatedResources":                   "AllocatedResources is the total requests allocated for this pod by the node. If pod-level requests are not set, this will be the total requests aggregated across containers in the pod.",
 	"resources":                            "Resources represents the compute resource requests and limits that have been applied at the pod level if pod-level requests or limits are set in PodSpec.Resources",
 	"nodeAllocatableResourceClaimStatuses": "NodeAllocatableResourceClaimStatuses contains the status of node-allocatable resources that were allocated for this pod through DRA claims. This includes resources currently reported in v1.Node `status.allocatable` that are not extended resources (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources). Examples include \"cpu\", \"memory\", \"ephemeral-storage\", and hugepages.",
+	"volumeHealth":                         "volumeHealth contains node-reported health for each volume the pod is using. Populated by the kubelet on the pod's node.",
 }
 
 func (PodStatus) SwaggerDoc() map[string]string {
 	return map_PodStatus
 }
 
-var map_PodStatusResult = map[string]string{
-	"":         "PodStatusResult is a wrapper for PodStatus returned by kubelet that can be encode/decoded",
-	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
-	"status":   "Most recently observed status of the pod. This data may not be up to date. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
-}
-
-func (PodStatusResult) SwaggerDoc() map[string]string {
-	return map_PodStatusResult
-}
-
 var map_PodTemplate = map[string]string{
 	"":         "PodTemplate describes a template for creating copies of a predefined pod.",
 	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
@@ -2029,6 +2074,17 @@ func (PodTemplateSpec) SwaggerDoc() map[string]string {
 	return map_PodTemplateSpec
 }
 
+var map_PodVolumeHealth = map[string]string{
+	"":                   "PodVolumeHealth contains health information for a volume used by a pod, reported by the CSI node plugin via the kubelet.",
+	"name":               "name matches an entry in pod.spec.volumes.",
+	"healthConditions":   "conditions is the set of adverse conditions reported by the CSI node plugin for this volume on this node. At most 16 conditions may be reported.",
+	"lastTransitionTime": "lastTransitionTime is when the current set of conditions first appeared.",
+}
+
+func (PodVolumeHealth) SwaggerDoc() map[string]string {
+	return map_PodVolumeHealth
+}
+
 var map_PortStatus = map[string]string{
 	"":         "PortStatus represents the error condition of a service port",
 	"port":     "Port is the port number of the service port of which status is recorded here",
@@ -2112,6 +2168,7 @@ var map_ProjectedVolumeSource = map[string]string{
 	"":            "Represents a projected volume source",
 	"sources":     "sources is the list of volume projections. Each entry in this list handles one source.",
 	"defaultMode": "defaultMode are the mode bits used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
+	"defaultUser": "defaultUser is Optional: The owner UID of the created files by default. The defaultUser field is only used as a fallback when the item-level user field is unset. (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.",
 }
 
 func (ProjectedVolumeSource) SwaggerDoc() map[string]string {
@@ -2322,7 +2379,7 @@ func (ResourceRequirements) SwaggerDoc() map[string]string {
 
 var map_ResourceStatus = map[string]string{
 	"":          "ResourceStatus represents the status of a single resource allocated to a Pod.",
-	"name":      "Name of the resource. Must be unique within the pod and in case of non-DRA resource, match one of the resources from the pod spec. For DRA resources, the value must be \"claim:<claim_name>/<request>\". When this status is reported about a container, the \"claim_name\" and \"request\" must match one of the claims of this container.",
+	"name":      "Name of the resource. Must be unique within the pod and in case of non-DRA resource, match one of the resources from the pod spec. For DRA resources, the value must be \"claim:<claim_name>/<request>\" when container.resources.claims[*].request is set or \"claim:<claim_name>\" when container.resources.claims[*].request is empty. For DRA-backed extended resources, \"claim:<claim_name>/<request>\" is used when the claim name and request name are recorded in pod.status.extendedResourceClaimStatus. When this status is reported about a container, the \"claim_name\" and \"request\" must match one of the claims of this container.",
 	"resources": "List of unique resources health. Each element in the list contains an unique resource ID and its health. At a minimum, for the lifetime of a Pod, resource ID must uniquely identify the resource allocated to the Pod on the Node. If other Pod on the same Node reports the status with the same resource ID, it must be the same resource they share. See ResourceID type definition for a specific format it has in various use cases.",
 }
 
@@ -2476,6 +2533,7 @@ var map_SecretVolumeSource = map[string]string{
 	"items":       "items If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'.",
 	"defaultMode": "defaultMode is Optional: mode bits used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.",
 	"optional":    "optional field specify whether the Secret or its keys must be defined",
+	"defaultUser": "defaultUser is Optional: The owner UID of the created files by default. The defaultUser field is only used as a fallback when the item-level user field is unset. (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.",
 }
 
 func (SecretVolumeSource) SwaggerDoc() map[string]string {
@@ -2549,6 +2607,7 @@ var map_ServiceAccountTokenProjection = map[string]string{
 	"audience":          "audience is the intended audience of the token. A recipient of a token must identify itself with an identifier specified in the audience of the token, and otherwise should reject the token. The audience defaults to the identifier of the apiserver.",
 	"expirationSeconds": "expirationSeconds is the requested duration of validity of the service account token. As the token approaches expiration, the kubelet volume plugin will proactively rotate the service account token. The kubelet will start trying to rotate the token if the token is older than 80 percent of its time to live or if the token is older than 24 hours.Defaults to 1 hour and must be at least 10 minutes.",
 	"path":              "path is the path relative to the mount point of the file to project the token into.",
+	"user":              "user is Optional: The owner UID of the created file. If specified, the item-level user field takes precedence over defaultUser. (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.",
 }
 
 func (ServiceAccountTokenProjection) SwaggerDoc() map[string]string {
@@ -2792,15 +2851,37 @@ func (VolumeDevice) SwaggerDoc() map[string]string {
 	return map_VolumeDevice
 }
 
+var map_VolumeHealthCondition = map[string]string{
+	"":        "VolumeHealthCondition represents an adverse health condition reported for a volume.",
+	"status":  "status is the machine-parseable health category. Possible values: - \"Inaccessible\": the volume cannot be accessed. - \"DataLoss\": data loss has been detected on the volume. - \"Degraded\": the volume is functioning with reduced capability.",
+	"reason":  "reason is a brief CamelCase machine-parseable reason. Together with status it forms the unique identity of a condition entry. Maximum permitted length of a reason is 256 bytes.",
+	"message": "message is a human-readable description. Maximum permitted length of a message is 1024 bytes.",
+}
+
+func (VolumeHealthCondition) SwaggerDoc() map[string]string {
+	return map_VolumeHealthCondition
+}
+
+var map_VolumeHealthStatus = map[string]string{
+	"":                   "VolumeHealthStatus contains health information for a volume reported by the CSI controller plugin.",
+	"healthConditions":   "conditions is the set of adverse conditions reported by the CSI controller plugin. An empty list means no adverse condition. At most 16 conditions may be reported.",
+	"lastTransitionTime": "lastTransitionTime is when the current set of conditions first appeared.",
+}
+
+func (VolumeHealthStatus) SwaggerDoc() map[string]string {
+	return map_VolumeHealthStatus
+}
+
 var map_VolumeMount = map[string]string{
 	"":                  "VolumeMount describes a mounting of a Volume within a container.",
 	"name":              "This must match the Name of a Volume.",
 	"readOnly":          "Mounted read-only if true, read-write otherwise (false or unspecified). Defaults to false.",
 	"recursiveReadOnly": "RecursiveReadOnly specifies whether read-only mounts should be handled recursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made recursively read-only.  If this field is set to IfPossible, the mount is made recursively read-only, if it is supported by the container runtime.  If this field is set to Enabled, the mount is made recursively read-only if it is supported by the container runtime, otherwise the pod will not be started and an error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to None (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.",
-	"mountPath":         "Path within the container at which the volume should be mounted.  Must not contain ':'.",
+	"mountPath":         "Path within the container at which the volume should be mounted.",
 	"subPath":           "Path within the volume from which the container's volume should be mounted. Defaults to \"\" (volume's root).",
 	"mountPropagation":  "mountPropagation determines how mounts are propagated from the host to container and the other way around. When not set, MountPropagationNone is used. This field is beta in 1.10. When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified (which defaults to None).",
 	"subPathExpr":       "Expanded path within the volume from which the container's volume should be mounted. Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. Defaults to \"\" (volume's root). SubPathExpr and SubPath are mutually exclusive.",
+	"bindMountOptions":  "bindMountOptions is the list of additional bind mount options to apply when mounting this volume into the container. Allowed values are noexec, nodev, and nosuid. These are Linux mount options and have no effect on Windows nodes. This field is not supported with image volumes. This is an alpha field and requires enabling the VolumeBindMountOptions feature gate.",
 }
 
 func (VolumeMount) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/core/v1/zz_generated.deepcopy.go b/vendor/k8s.io/api/core/v1/zz_generated.deepcopy.go
index 10af6c17d2..4a0b717f30 100644
--- a/vendor/k8s.io/api/core/v1/zz_generated.deepcopy.go
+++ b/vendor/k8s.io/api/core/v1/zz_generated.deepcopy.go
@@ -22,7 +22,6 @@ limitations under the License.
 package v1
 
 import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	types "k8s.io/apimachinery/pkg/types"
@@ -485,6 +484,11 @@ func (in *ClusterTrustBundleProjection) DeepCopyInto(out *ClusterTrustBundleProj
 		*out = new(bool)
 		**out = **in
 	}
+	if in.User != nil {
+		in, out := &in.User, &out.User
+		*out = new(int64)
+		**out = **in
+	}
 	return
 }
 
@@ -774,6 +778,11 @@ func (in *ConfigMapVolumeSource) DeepCopyInto(out *ConfigMapVolumeSource) {
 		*out = new(bool)
 		**out = **in
 	}
+	if in.DefaultUser != nil {
+		in, out := &in.DefaultUser, &out.DefaultUser
+		*out = new(int64)
+		**out = **in
+	}
 	return
 }
 
@@ -1217,6 +1226,11 @@ func (in *DownwardAPIVolumeFile) DeepCopyInto(out *DownwardAPIVolumeFile) {
 		*out = new(int32)
 		**out = **in
 	}
+	if in.User != nil {
+		in, out := &in.User, &out.User
+		*out = new(int64)
+		**out = **in
+	}
 	return
 }
 
@@ -1245,6 +1259,11 @@ func (in *DownwardAPIVolumeSource) DeepCopyInto(out *DownwardAPIVolumeSource) {
 		*out = new(int32)
 		**out = **in
 	}
+	if in.DefaultUser != nil {
+		in, out := &in.DefaultUser, &out.DefaultUser
+		*out = new(int64)
+		**out = **in
+	}
 	return
 }
 
@@ -1266,6 +1285,11 @@ func (in *EmptyDirVolumeSource) DeepCopyInto(out *EmptyDirVolumeSource) {
 		x := (*in).DeepCopy()
 		*out = &x
 	}
+	if in.Mode != nil {
+		in, out := &in.Mode, &out.Mode
+		*out = new(int32)
+		**out = **in
+	}
 	return
 }
 
@@ -1762,6 +1786,27 @@ func (in *EventSource) DeepCopy() *EventSource {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EvictionResponder) DeepCopyInto(out *EvictionResponder) {
+	*out = *in
+	if in.Priority != nil {
+		in, out := &in.Priority, &out.Priority
+		*out = new(int32)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EvictionResponder.
+func (in *EvictionResponder) DeepCopy() *EvictionResponder {
+	if in == nil {
+		return nil
+	}
+	out := new(EvictionResponder)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ExecAction) DeepCopyInto(out *ExecAction) {
 	*out = *in
@@ -1931,6 +1976,11 @@ func (in *GRPCAction) DeepCopyInto(out *GRPCAction) {
 		*out = new(string)
 		**out = **in
 	}
+	if in.Mode != nil {
+		in, out := &in.Mode, &out.Mode
+		*out = new(GRPCProbeMode)
+		**out = **in
+	}
 	return
 }
 
@@ -2006,6 +2056,11 @@ func (in *HTTPGetAction) DeepCopyInto(out *HTTPGetAction) {
 		*out = make([]HTTPHeader, len(*in))
 		copy(*out, *in)
 	}
+	if in.Protocol != nil {
+		in, out := &in.Protocol, &out.Protocol
+		*out = new(HTTPProtocol)
+		**out = **in
+	}
 	return
 }
 
@@ -2195,6 +2250,11 @@ func (in *KeyToPath) DeepCopyInto(out *KeyToPath) {
 		*out = new(int32)
 		**out = **in
 	}
+	if in.User != nil {
+		in, out := &in.User, &out.User
+		*out = new(int64)
+		**out = **in
+	}
 	return
 }
 
@@ -2777,6 +2837,53 @@ func (in *NodeAffinity) DeepCopy() *NodeAffinity {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NodeAllocatableMappedResources) DeepCopyInto(out *NodeAllocatableMappedResources) {
+	*out = *in
+	if in.Quantity != nil {
+		in, out := &in.Quantity, &out.Quantity
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeAllocatableMappedResources.
+func (in *NodeAllocatableMappedResources) DeepCopy() *NodeAllocatableMappedResources {
+	if in == nil {
+		return nil
+	}
+	out := new(NodeAllocatableMappedResources)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NodeAllocatableOverheadResources) DeepCopyInto(out *NodeAllocatableOverheadResources) {
+	*out = *in
+	if in.PerPod != nil {
+		in, out := &in.PerPod, &out.PerPod
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	if in.PerContainer != nil {
+		in, out := &in.PerContainer, &out.PerContainer
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeAllocatableOverheadResources.
+func (in *NodeAllocatableOverheadResources) DeepCopy() *NodeAllocatableOverheadResources {
+	if in == nil {
+		return nil
+	}
+	out := new(NodeAllocatableOverheadResources)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *NodeAllocatableResourceClaimStatus) DeepCopyInto(out *NodeAllocatableResourceClaimStatus) {
 	*out = *in
@@ -2785,11 +2892,18 @@ func (in *NodeAllocatableResourceClaimStatus) DeepCopyInto(out *NodeAllocatableR
 		*out = make([]string, len(*in))
 		copy(*out, *in)
 	}
-	if in.Resources != nil {
-		in, out := &in.Resources, &out.Resources
-		*out = make(map[ResourceName]resource.Quantity, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val.DeepCopy()
+	if in.Mapping != nil {
+		in, out := &in.Mapping, &out.Mapping
+		*out = make([]NodeAllocatableMappedResources, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Overhead != nil {
+		in, out := &in.Overhead, &out.Overhead
+		*out = make([]NodeAllocatableOverheadResources, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
 	return
@@ -2946,6 +3060,27 @@ func (in *NodeList) DeepCopyObject() runtime.Object {
 	return nil
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NodePodPreemptionPolicy) DeepCopyInto(out *NodePodPreemptionPolicy) {
+	*out = *in
+	if in.DisableResizePreemption != nil {
+		in, out := &in.DisableResizePreemption, &out.DisableResizePreemption
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodePodPreemptionPolicy.
+func (in *NodePodPreemptionPolicy) DeepCopy() *NodePodPreemptionPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(NodePodPreemptionPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *NodeProxyOptions) DeepCopyInto(out *NodeProxyOptions) {
 	*out = *in
@@ -3112,6 +3247,11 @@ func (in *NodeSpec) DeepCopyInto(out *NodeSpec) {
 		*out = new(NodeConfigSource)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.PodPreemptionPolicy != nil {
+		in, out := &in.PodPreemptionPolicy, &out.PodPreemptionPolicy
+		*out = new(NodePodPreemptionPolicy)
+		(*in).DeepCopyInto(*out)
+	}
 	return
 }
 
@@ -3237,6 +3377,11 @@ func (in *NodeSystemInfo) DeepCopyInto(out *NodeSystemInfo) {
 		*out = new(NodeSwapStatus)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.RunningInUserNamespace != nil {
+		in, out := &in.RunningInUserNamespace, &out.RunningInUserNamespace
+		*out = new(bool)
+		**out = **in
+	}
 	return
 }
 
@@ -3495,6 +3640,11 @@ func (in *PersistentVolumeClaimStatus) DeepCopyInto(out *PersistentVolumeClaimSt
 		*out = new(ModifyVolumeStatus)
 		**out = **in
 	}
+	if in.HealthStatus != nil {
+		in, out := &in.HealthStatus, &out.HealthStatus
+		*out = new(VolumeHealthStatus)
+		(*in).DeepCopyInto(*out)
+	}
 	return
 }
 
@@ -3960,6 +4110,11 @@ func (in *PodCertificateProjection) DeepCopyInto(out *PodCertificateProjection)
 			(*out)[key] = val
 		}
 	}
+	if in.User != nil {
+		in, out := &in.User, &out.User
+		*out = new(int64)
+		**out = **in
+	}
 	return
 }
 
@@ -4640,6 +4795,13 @@ func (in *PodSpec) DeepCopyInto(out *PodSpec) {
 		*out = new(PodSchedulingGroup)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.EvictionResponders != nil {
+		in, out := &in.EvictionResponders, &out.EvictionResponders
+		*out = make([]EvictionResponder, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	return
 }
 
@@ -4729,6 +4891,13 @@ func (in *PodStatus) DeepCopyInto(out *PodStatus) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.VolumeHealth != nil {
+		in, out := &in.VolumeHealth, &out.VolumeHealth
+		*out = make([]PodVolumeHealth, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	return
 }
 
@@ -4742,33 +4911,6 @@ func (in *PodStatus) DeepCopy() *PodStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PodStatusResult) DeepCopyInto(out *PodStatusResult) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Status.DeepCopyInto(&out.Status)
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodStatusResult.
-func (in *PodStatusResult) DeepCopy() *PodStatusResult {
-	if in == nil {
-		return nil
-	}
-	out := new(PodStatusResult)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PodStatusResult) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *PodTemplate) DeepCopyInto(out *PodTemplate) {
 	*out = *in
@@ -4847,6 +4989,28 @@ func (in *PodTemplateSpec) DeepCopy() *PodTemplateSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodVolumeHealth) DeepCopyInto(out *PodVolumeHealth) {
+	*out = *in
+	if in.HealthConditions != nil {
+		in, out := &in.HealthConditions, &out.HealthConditions
+		*out = make([]VolumeHealthCondition, len(*in))
+		copy(*out, *in)
+	}
+	in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodVolumeHealth.
+func (in *PodVolumeHealth) DeepCopy() *PodVolumeHealth {
+	if in == nil {
+		return nil
+	}
+	out := new(PodVolumeHealth)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *PortStatus) DeepCopyInto(out *PortStatus) {
 	*out = *in
@@ -5013,6 +5177,11 @@ func (in *ProjectedVolumeSource) DeepCopyInto(out *ProjectedVolumeSource) {
 		*out = new(int32)
 		**out = **in
 	}
+	if in.DefaultUser != nil {
+		in, out := &in.DefaultUser, &out.DefaultUser
+		*out = new(int64)
+		**out = **in
+	}
 	return
 }
 
@@ -5835,6 +6004,11 @@ func (in *SecretVolumeSource) DeepCopyInto(out *SecretVolumeSource) {
 		*out = new(bool)
 		**out = **in
 	}
+	if in.DefaultUser != nil {
+		in, out := &in.DefaultUser, &out.DefaultUser
+		*out = new(int64)
+		**out = **in
+	}
 	return
 }
 
@@ -6060,6 +6234,11 @@ func (in *ServiceAccountTokenProjection) DeepCopyInto(out *ServiceAccountTokenPr
 		*out = new(int64)
 		**out = **in
 	}
+	if in.User != nil {
+		in, out := &in.User, &out.User
+		*out = new(int64)
+		**out = **in
+	}
 	return
 }
 
@@ -6575,6 +6754,44 @@ func (in *VolumeDevice) DeepCopy() *VolumeDevice {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *VolumeHealthCondition) DeepCopyInto(out *VolumeHealthCondition) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VolumeHealthCondition.
+func (in *VolumeHealthCondition) DeepCopy() *VolumeHealthCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(VolumeHealthCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *VolumeHealthStatus) DeepCopyInto(out *VolumeHealthStatus) {
+	*out = *in
+	if in.HealthConditions != nil {
+		in, out := &in.HealthConditions, &out.HealthConditions
+		*out = make([]VolumeHealthCondition, len(*in))
+		copy(*out, *in)
+	}
+	in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VolumeHealthStatus.
+func (in *VolumeHealthStatus) DeepCopy() *VolumeHealthStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(VolumeHealthStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *VolumeMount) DeepCopyInto(out *VolumeMount) {
 	*out = *in
@@ -6588,6 +6805,11 @@ func (in *VolumeMount) DeepCopyInto(out *VolumeMount) {
 		*out = new(MountPropagationMode)
 		**out = **in
 	}
+	if in.BindMountOptions != nil {
+		in, out := &in.BindMountOptions, &out.BindMountOptions
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
diff --git a/vendor/k8s.io/api/core/v1/zz_generated.model_name.go b/vendor/k8s.io/api/core/v1/zz_generated.model_name.go
index 8e79ad909e..65cfb59c13 100644
--- a/vendor/k8s.io/api/core/v1/zz_generated.model_name.go
+++ b/vendor/k8s.io/api/core/v1/zz_generated.model_name.go
@@ -326,6 +326,11 @@ func (in EventSource) OpenAPIModelName() string {
 	return "io.k8s.api.core.v1.EventSource"
 }
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in EvictionResponder) OpenAPIModelName() string {
+	return "io.k8s.api.core.v1.EvictionResponder"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in ExecAction) OpenAPIModelName() string {
 	return "io.k8s.api.core.v1.ExecAction"
@@ -541,6 +546,16 @@ func (in NodeAffinity) OpenAPIModelName() string {
 	return "io.k8s.api.core.v1.NodeAffinity"
 }
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NodeAllocatableMappedResources) OpenAPIModelName() string {
+	return "io.k8s.api.core.v1.NodeAllocatableMappedResources"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NodeAllocatableOverheadResources) OpenAPIModelName() string {
+	return "io.k8s.api.core.v1.NodeAllocatableOverheadResources"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in NodeAllocatableResourceClaimStatus) OpenAPIModelName() string {
 	return "io.k8s.api.core.v1.NodeAllocatableResourceClaimStatus"
@@ -576,6 +591,11 @@ func (in NodeList) OpenAPIModelName() string {
 	return "io.k8s.api.core.v1.NodeList"
 }
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NodePodPreemptionPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.core.v1.NodePodPreemptionPolicy"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in NodeProxyOptions) OpenAPIModelName() string {
 	return "io.k8s.api.core.v1.NodeProxyOptions"
@@ -831,11 +851,6 @@ func (in PodStatus) OpenAPIModelName() string {
 	return "io.k8s.api.core.v1.PodStatus"
 }
 
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in PodStatusResult) OpenAPIModelName() string {
-	return "io.k8s.api.core.v1.PodStatusResult"
-}
-
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in PodTemplate) OpenAPIModelName() string {
 	return "io.k8s.api.core.v1.PodTemplate"
@@ -851,6 +866,11 @@ func (in PodTemplateSpec) OpenAPIModelName() string {
 	return "io.k8s.api.core.v1.PodTemplateSpec"
 }
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodVolumeHealth) OpenAPIModelName() string {
+	return "io.k8s.api.core.v1.PodVolumeHealth"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in PortStatus) OpenAPIModelName() string {
 	return "io.k8s.api.core.v1.PortStatus"
@@ -1176,6 +1196,16 @@ func (in VolumeDevice) OpenAPIModelName() string {
 	return "io.k8s.api.core.v1.VolumeDevice"
 }
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in VolumeHealthCondition) OpenAPIModelName() string {
+	return "io.k8s.api.core.v1.VolumeHealthCondition"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in VolumeHealthStatus) OpenAPIModelName() string {
+	return "io.k8s.api.core.v1.VolumeHealthStatus"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in VolumeMount) OpenAPIModelName() string {
 	return "io.k8s.api.core.v1.VolumeMount"
diff --git a/vendor/k8s.io/api/core/v1/zz_generated.prerelease-lifecycle.go b/vendor/k8s.io/api/core/v1/zz_generated.prerelease-lifecycle.go
index 6710a96d1c..d473e30999 100644
--- a/vendor/k8s.io/api/core/v1/zz_generated.prerelease-lifecycle.go
+++ b/vendor/k8s.io/api/core/v1/zz_generated.prerelease-lifecycle.go
@@ -177,12 +177,6 @@ func (in *PodProxyOptions) APILifecycleIntroduced() (major, minor int) {
 	return 1, 0
 }
 
-// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
-// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
-func (in *PodStatusResult) APILifecycleIntroduced() (major, minor int) {
-	return 1, 0
-}
-
 // APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
 // It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
 func (in *PodTemplate) APILifecycleIntroduced() (major, minor int) {
diff --git a/vendor/k8s.io/api/discovery/v1/generated.proto b/vendor/k8s.io/api/discovery/v1/generated.proto
index edbc4304b1..a1713290dd 100644
--- a/vendor/k8s.io/api/discovery/v1/generated.proto
+++ b/vendor/k8s.io/api/discovery/v1/generated.proto
@@ -39,8 +39,8 @@ message Endpoint {
   // additional addresses beyond the first, and kube-proxy does not look at them.
   // +listType=set
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=100
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=100
   repeated string addresses = 1;
 
   // conditions contains information about the current status of the endpoint.
@@ -185,15 +185,15 @@ message EndpointSlice {
   // slices of addressType "IPv4" and "IPv6". No semantics are defined for
   // the "FQDN" type.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:immutable
   optional string addressType = 4;
 
   // endpoints is a list of unique endpoints in this slice. Each slice may
   // include a maximum of 1000 endpoints.
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated Endpoint endpoints = 2;
 
   // ports specifies the list of network ports exposed by each endpoint in
diff --git a/vendor/k8s.io/api/discovery/v1/types.go b/vendor/k8s.io/api/discovery/v1/types.go
index c291ed85dd..a5b5f827b6 100644
--- a/vendor/k8s.io/api/discovery/v1/types.go
+++ b/vendor/k8s.io/api/discovery/v1/types.go
@@ -32,7 +32,7 @@ import (
 // by listing EndpointSlices in the service's namespace whose `kubernetes.io/service-name`
 // label contains the service's name.
 type EndpointSlice struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard object's metadata.
 	// +optional
@@ -49,15 +49,15 @@ type EndpointSlice struct {
 	// slices of addressType "IPv4" and "IPv6". No semantics are defined for
 	// the "FQDN" type.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:immutable
 	AddressType AddressType `json:"addressType" protobuf:"bytes,4,rep,name=addressType"`
 
 	// endpoints is a list of unique endpoints in this slice. Each slice may
 	// include a maximum of 1000 endpoints.
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Endpoints []Endpoint `json:"endpoints" protobuf:"bytes,2,rep,name=endpoints"`
 
 	// ports specifies the list of network ports exposed by each endpoint in
@@ -73,7 +73,7 @@ type EndpointSlice struct {
 
 // AddressType represents the type of address referred to by an endpoint.
 // +enum
-// +k8s:alpha(since: "1.36")=+k8s:enum
+// +k8s:beta(since: "1.37")=+k8s:enum
 type AddressType string
 
 const (
@@ -97,8 +97,8 @@ type Endpoint struct {
 	// additional addresses beyond the first, and kube-proxy does not look at them.
 	// +listType=set
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=100
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=100
 	Addresses []string `json:"addresses" protobuf:"bytes,1,rep,name=addresses"`
 
 	// conditions contains information about the current status of the endpoint.
@@ -238,7 +238,7 @@ type EndpointPort struct {
 
 // EndpointSliceList represents a list of endpoint slices
 type EndpointSliceList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata.
 	// +optional
diff --git a/vendor/k8s.io/api/discovery/v1beta1/generated.proto b/vendor/k8s.io/api/discovery/v1beta1/generated.proto
index 9b6edb1479..fa45b0ed92 100644
--- a/vendor/k8s.io/api/discovery/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/discovery/v1beta1/generated.proto
@@ -39,8 +39,8 @@ message Endpoint {
   // use the first element. Refer to: https://issue.k8s.io/106267
   // +listType=set
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=100
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=100
   repeated string addresses = 1;
 
   // conditions contains information about the current status of the endpoint.
@@ -171,14 +171,14 @@ message EndpointSlice {
   // * IPv6: Represents an IPv6 Address.
   // * FQDN: Represents a Fully Qualified Domain Name.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:immutable
   optional string addressType = 4;
 
   // endpoints is a list of unique endpoints in this slice. Each slice may
   // include a maximum of 1000 endpoints.
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated Endpoint endpoints = 2;
 
   // ports specifies the list of network ports exposed by each endpoint in
diff --git a/vendor/k8s.io/api/discovery/v1beta1/types.go b/vendor/k8s.io/api/discovery/v1beta1/types.go
index 1334194d2a..ef7cf4ab34 100644
--- a/vendor/k8s.io/api/discovery/v1beta1/types.go
+++ b/vendor/k8s.io/api/discovery/v1beta1/types.go
@@ -32,7 +32,7 @@ import (
 // For a given service there may be multiple EndpointSlice objects, selected by
 // labels, which must be joined to produce the full set of endpoints.
 type EndpointSlice struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard object's metadata.
 	// +optional
@@ -46,14 +46,14 @@ type EndpointSlice struct {
 	// * IPv6: Represents an IPv6 Address.
 	// * FQDN: Represents a Fully Qualified Domain Name.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:immutable
 	AddressType AddressType `json:"addressType" protobuf:"bytes,4,rep,name=addressType"`
 
 	// endpoints is a list of unique endpoints in this slice. Each slice may
 	// include a maximum of 1000 endpoints.
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Endpoints []Endpoint `json:"endpoints" protobuf:"bytes,2,rep,name=endpoints"`
 
 	// ports specifies the list of network ports exposed by each endpoint in
@@ -68,7 +68,7 @@ type EndpointSlice struct {
 
 // AddressType represents the type of address referred to by an endpoint.
 // +enum
-// +k8s:alpha(since: "1.36")=+k8s:enum
+// +k8s:beta(since: "1.37")=+k8s:enum
 type AddressType string
 
 const (
@@ -92,8 +92,8 @@ type Endpoint struct {
 	// use the first element. Refer to: https://issue.k8s.io/106267
 	// +listType=set
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=100
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=100
 	Addresses []string `json:"addresses" protobuf:"bytes,1,rep,name=addresses"`
 
 	// conditions contains information about the current status of the endpoint.
@@ -228,7 +228,7 @@ type EndpointPort struct {
 
 // EndpointSliceList represents a list of endpoint slices
 type EndpointSliceList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata.
 	// +optional
diff --git a/vendor/k8s.io/api/events/v1/generated.proto b/vendor/k8s.io/api/events/v1/generated.proto
index 6c7e4cca19..f1e63a33a2 100644
--- a/vendor/k8s.io/api/events/v1/generated.proto
+++ b/vendor/k8s.io/api/events/v1/generated.proto
@@ -36,7 +36,7 @@ option go_package = "k8s.io/api/events/v1";
 // continued existence of events with that Reason.  Events should be
 // treated as informative, best-effort, supplemental data.
 message Event {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -105,7 +105,7 @@ message Event {
 
 // EventList is a list of Event objects.
 message EventList {
-  // Standard list metadata.
+  // metadata is the standard list metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
diff --git a/vendor/k8s.io/api/events/v1/types.go b/vendor/k8s.io/api/events/v1/types.go
index 86b12eee15..c545284100 100644
--- a/vendor/k8s.io/api/events/v1/types.go
+++ b/vendor/k8s.io/api/events/v1/types.go
@@ -32,9 +32,9 @@ import (
 // continued existence of events with that Reason.  Events should be
 // treated as informative, best-effort, supplemental data.
 type Event struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata.
+	// metadata is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata" protobuf:"bytes,1,opt,name=metadata"`
@@ -114,8 +114,8 @@ type EventSeries struct {
 
 // EventList is a list of Event objects.
 type EventList struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard list metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
diff --git a/vendor/k8s.io/api/events/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/events/v1/types_swagger_doc_generated.go
index 44ac0c3bb6..f5b83f049a 100644
--- a/vendor/k8s.io/api/events/v1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/events/v1/types_swagger_doc_generated.go
@@ -29,7 +29,7 @@ package v1
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_Event = map[string]string{
 	"":                         "Event is a report of an event somewhere in the cluster. It generally denotes some state change in the system. Events have a limited retention time and triggers and messages may evolve with time.  Event consumers should not rely on the timing of an event with a given Reason reflecting a consistent underlying trigger, or the continued existence of events with that Reason.  Events should be treated as informative, best-effort, supplemental data.",
-	"metadata":                 "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata":                 "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"eventTime":                "eventTime is the time when this Event was first observed. It is required.",
 	"series":                   "series is data about the Event series this event represents or nil if it's a singleton Event.",
 	"reportingController":      "reportingController is the name of the controller that emitted this Event, e.g. `kubernetes.io/kubelet`. This field cannot be empty for new Events.",
@@ -52,7 +52,7 @@ func (Event) SwaggerDoc() map[string]string {
 
 var map_EventList = map[string]string{
 	"":         "EventList is a list of Event objects.",
-	"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"items":    "items is a list of schema objects.",
 }
 
diff --git a/vendor/k8s.io/api/events/v1beta1/generated.proto b/vendor/k8s.io/api/events/v1beta1/generated.proto
index fbdb309701..6e39c03bc3 100644
--- a/vendor/k8s.io/api/events/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/events/v1beta1/generated.proto
@@ -36,7 +36,7 @@ option go_package = "k8s.io/api/events/v1beta1";
 // continued existence of events with that Reason.  Events should be
 // treated as informative, best-effort, supplemental data.
 message Event {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -109,7 +109,7 @@ message Event {
 
 // EventList is a list of Event objects.
 message EventList {
-  // Standard list metadata.
+  // metadata is the standard list metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
diff --git a/vendor/k8s.io/api/events/v1beta1/types.go b/vendor/k8s.io/api/events/v1beta1/types.go
index 5bb6f92b22..dfe1e4cc10 100644
--- a/vendor/k8s.io/api/events/v1beta1/types.go
+++ b/vendor/k8s.io/api/events/v1beta1/types.go
@@ -33,9 +33,9 @@ import (
 // continued existence of events with that Reason.  Events should be
 // treated as informative, best-effort, supplemental data.
 type Event struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata.
+	// metadata is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata" protobuf:"bytes,1,opt,name=metadata"`
@@ -120,8 +120,8 @@ type EventSeries struct {
 
 // EventList is a list of Event objects.
 type EventList struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard list metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
diff --git a/vendor/k8s.io/api/events/v1beta1/types_swagger_doc_generated.go b/vendor/k8s.io/api/events/v1beta1/types_swagger_doc_generated.go
index e6c28a4f8c..4f188b2abb 100644
--- a/vendor/k8s.io/api/events/v1beta1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/events/v1beta1/types_swagger_doc_generated.go
@@ -29,7 +29,7 @@ package v1beta1
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_Event = map[string]string{
 	"":                         "Event is a report of an event somewhere in the cluster. It generally denotes some state change in the system. Events have a limited retention time and triggers and messages may evolve with time.  Event consumers should not rely on the timing of an event with a given Reason reflecting a consistent underlying trigger, or the continued existence of events with that Reason.  Events should be treated as informative, best-effort, supplemental data.",
-	"metadata":                 "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata":                 "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"eventTime":                "eventTime is the time when this Event was first observed. It is required.",
 	"series":                   "series is data about the Event series this event represents or nil if it's a singleton Event.",
 	"reportingController":      "reportingController is the name of the controller that emitted this Event, e.g. `kubernetes.io/kubelet`. This field cannot be empty for new Events.",
@@ -52,7 +52,7 @@ func (Event) SwaggerDoc() map[string]string {
 
 var map_EventList = map[string]string{
 	"":         "EventList is a list of Event objects.",
-	"metadata": "Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"items":    "items is a list of schema objects.",
 }
 
diff --git a/vendor/k8s.io/api/extensions/v1beta1/doc.go b/vendor/k8s.io/api/extensions/v1beta1/doc.go
index bf39ca3e1e..98ccb7685f 100644
--- a/vendor/k8s.io/api/extensions/v1beta1/doc.go
+++ b/vendor/k8s.io/api/extensions/v1beta1/doc.go
@@ -19,7 +19,8 @@ limitations under the License.
 // +k8s:openapi-gen=true
 // +k8s:prerelease-lifecycle-gen=true
 // +k8s:openapi-model-package=io.k8s.api.extensions.v1beta1
-// +k8s:validation-gen=TypeMeta
-// +k8s:validation-gen-input=k8s.io/api/extensions/v1beta1
+// extensions/v1beta1 is permanently unserved, so version-specific declarative
+// validation here is unreachable.
+// +k8s:validation-gen=false
 
 package v1beta1
diff --git a/vendor/k8s.io/api/extensions/v1beta1/generated.proto b/vendor/k8s.io/api/extensions/v1beta1/generated.proto
index f090306686..9d45061d5a 100644
--- a/vendor/k8s.io/api/extensions/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/extensions/v1beta1/generated.proto
@@ -33,6 +33,7 @@ option go_package = "k8s.io/api/extensions/v1beta1";
 // DEPRECATED - This group version of DaemonSet is deprecated by apps/v1beta2/DaemonSet. See the release notes for
 // more information.
 // DaemonSet represents the configuration of a daemon set.
+// +k8s:supportsSubresource="/status"
 message DaemonSet {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -202,6 +203,7 @@ message DaemonSetUpdateStrategy {
 // DEPRECATED - This group version of Deployment is deprecated by apps/v1beta2/Deployment. See the release notes for
 // more information.
 // Deployment enables declarative updates for Pods and ReplicaSets.
+// +k8s:supportsSubresource="/status"
 message Deployment {
   // Standard object metadata.
   // +optional
@@ -429,7 +431,7 @@ message IPBlock {
   // CIDR is a string representing the IP Block
   // Valid examples are "192.168.1.0/24" or "2001:db8::/64"
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string cidr = 1;
 
   // Except is a slice of CIDRs that should not be included within an IP Block
@@ -445,6 +447,7 @@ message IPBlock {
 // externally-reachable urls, load balance traffic, terminate SSL, offer name
 // based virtual hosting etc.
 // DEPRECATED - This group version of Ingress is deprecated by networking.k8s.io/v1beta1 Ingress. See the release notes for more information.
+// +k8s:supportsSubresource="/status"
 message Ingress {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -688,7 +691,7 @@ message NetworkPolicyEgressRule {
   // allows traffic only if the traffic matches at least one item in the to list.
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated NetworkPolicyPeer to = 2;
 }
 
@@ -711,7 +714,7 @@ message NetworkPolicyIngressRule {
   // traffic matches at least one item in the from list.
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated NetworkPolicyPeer from = 2;
 }
 
@@ -750,7 +753,7 @@ message NetworkPolicyPeer {
   // IPBlock defines policy on a particular IPBlock. If this field is set then
   // neither of the other fields can be.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional IPBlock ipBlock = 3;
 }
 
@@ -794,7 +797,7 @@ message NetworkPolicySpec {
   // (and serves solely to ensure that the pods it selects are isolated by default).
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated NetworkPolicyIngressRule ingress = 2;
 
   // List of egress rules to be applied to the selected pods. Outgoing traffic is
@@ -806,7 +809,7 @@ message NetworkPolicySpec {
   // This field is beta-level in 1.8
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated NetworkPolicyEgressRule egress = 3;
 
   // List of rule types that the NetworkPolicy relates to.
@@ -827,6 +830,7 @@ message NetworkPolicySpec {
 // DEPRECATED - This group version of ReplicaSet is deprecated by apps/v1beta2/ReplicaSet. See the release notes for
 // more information.
 // ReplicaSet ensures that a specified number of pod replicas are running at any given time.
+// +k8s:supportsSubresource="/status"
 message ReplicaSet {
   // If the Labels of a ReplicaSet are empty, they are defaulted to
   // be the same as the Pod(s) that the ReplicaSet manages.
@@ -1046,9 +1050,9 @@ message Scale {
 message ScaleSpec {
   // desired number of instances for the scaled object.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +default=0
-  // +k8s:alpha(since: "1.36")=+k8s:minimum=0
+  // +k8s:beta(since: "1.37")=+k8s:minimum=0
   optional int32 replicas = 1;
 }
 
diff --git a/vendor/k8s.io/api/extensions/v1beta1/types.go b/vendor/k8s.io/api/extensions/v1beta1/types.go
index 09d143ea60..e0caf19823 100644
--- a/vendor/k8s.io/api/extensions/v1beta1/types.go
+++ b/vendor/k8s.io/api/extensions/v1beta1/types.go
@@ -27,9 +27,9 @@ import (
 type ScaleSpec struct {
 	// desired number of instances for the scaled object.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +default=0
-	// +k8s:alpha(since: "1.36")=+k8s:minimum=0
+	// +k8s:beta(since: "1.37")=+k8s:minimum=0
 	Replicas int32 `json:"replicas,omitempty" protobuf:"varint,1,opt,name=replicas"`
 }
 
@@ -61,7 +61,7 @@ type ScaleStatus struct {
 
 // represents a scaling request for a resource.
 type Scale struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -88,8 +88,9 @@ type Scale struct {
 // DEPRECATED - This group version of Deployment is deprecated by apps/v1beta2/Deployment. See the release notes for
 // more information.
 // Deployment enables declarative updates for Pods and ReplicaSets.
+// +k8s:supportsSubresource="/status"
 type Deployment struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -164,7 +165,7 @@ type DeploymentSpec struct {
 // DEPRECATED.
 // DeploymentRollback stores the information required to rollback a deployment.
 type DeploymentRollback struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Required: This must match the Name of a deployment.
 	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 	// The annotations to be updated to a deployment
@@ -333,7 +334,7 @@ type DeploymentCondition struct {
 
 // DeploymentList is a list of Deployments.
 type DeploymentList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -539,8 +540,9 @@ type DaemonSetCondition struct {
 // DEPRECATED - This group version of DaemonSet is deprecated by apps/v1beta2/DaemonSet. See the release notes for
 // more information.
 // DaemonSet represents the configuration of a daemon set.
+// +k8s:supportsSubresource="/status"
 type DaemonSet struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -581,7 +583,7 @@ const (
 
 // DaemonSetList is a collection of daemon sets.
 type DaemonSetList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -603,8 +605,9 @@ type DaemonSetList struct {
 // externally-reachable urls, load balance traffic, terminate SSL, offer name
 // based virtual hosting etc.
 // DEPRECATED - This group version of Ingress is deprecated by networking.k8s.io/v1beta1 Ingress. See the release notes for more information.
+// +k8s:supportsSubresource="/status"
 type Ingress struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -629,7 +632,7 @@ type Ingress struct {
 
 // IngressList is a collection of Ingress.
 type IngressList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -786,7 +789,7 @@ type IngressRule struct {
 	// default backend, is left to the controller fulfilling the Ingress. Http is
 	// currently the only supported IngressRuleValue.
 	// +optional
-	IngressRuleValue `json:",inline" protobuf:"bytes,2,opt,name=ingressRuleValue"`
+	IngressRuleValue `json:"" protobuf:"bytes,2,opt,name=ingressRuleValue"`
 }
 
 // IngressRuleValue represents a rule to apply against incoming requests. If the
@@ -914,8 +917,9 @@ type IngressBackend struct {
 // DEPRECATED - This group version of ReplicaSet is deprecated by apps/v1beta2/ReplicaSet. See the release notes for
 // more information.
 // ReplicaSet ensures that a specified number of pod replicas are running at any given time.
+// +k8s:supportsSubresource="/status"
 type ReplicaSet struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// If the Labels of a ReplicaSet are empty, they are defaulted to
 	// be the same as the Pod(s) that the ReplicaSet manages.
@@ -945,7 +949,7 @@ type ReplicaSet struct {
 
 // ReplicaSetList is a collection of ReplicaSets.
 type ReplicaSetList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -1060,7 +1064,7 @@ type ReplicaSetCondition struct {
 // DEPRECATED 1.9 - This group version of NetworkPolicy is deprecated by networking/v1/NetworkPolicy.
 // NetworkPolicy describes what network traffic is allowed for a set of Pods
 type NetworkPolicy struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -1106,7 +1110,7 @@ type NetworkPolicySpec struct {
 	// (and serves solely to ensure that the pods it selects are isolated by default).
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Ingress []NetworkPolicyIngressRule `json:"ingress,omitempty" protobuf:"bytes,2,rep,name=ingress"`
 
 	// List of egress rules to be applied to the selected pods. Outgoing traffic is
@@ -1118,7 +1122,7 @@ type NetworkPolicySpec struct {
 	// This field is beta-level in 1.8
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Egress []NetworkPolicyEgressRule `json:"egress,omitempty" protobuf:"bytes,3,rep,name=egress"`
 
 	// List of rule types that the NetworkPolicy relates to.
@@ -1155,7 +1159,7 @@ type NetworkPolicyIngressRule struct {
 	// traffic matches at least one item in the from list.
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	From []NetworkPolicyPeer `json:"from,omitempty" protobuf:"bytes,2,rep,name=from"`
 }
 
@@ -1180,7 +1184,7 @@ type NetworkPolicyEgressRule struct {
 	// allows traffic only if the traffic matches at least one item in the to list.
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	To []NetworkPolicyPeer `json:"to,omitempty" protobuf:"bytes,2,rep,name=to"`
 }
 
@@ -1214,7 +1218,7 @@ type IPBlock struct {
 	// CIDR is a string representing the IP Block
 	// Valid examples are "192.168.1.0/24" or "2001:db8::/64"
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	CIDR string `json:"cidr" protobuf:"bytes,1,name=cidr"`
 	// Except is a slice of CIDRs that should not be included within an IP Block
 	// Valid examples are "192.168.1.0/24" or "2001:db8::/64"
@@ -1247,7 +1251,7 @@ type NetworkPolicyPeer struct {
 	// IPBlock defines policy on a particular IPBlock. If this field is set then
 	// neither of the other fields can be.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	IPBlock *IPBlock `json:"ipBlock,omitempty" protobuf:"bytes,3,rep,name=ipBlock"`
 }
 
@@ -1260,7 +1264,7 @@ type NetworkPolicyPeer struct {
 // DEPRECATED 1.9 - This group version of NetworkPolicyList is deprecated by networking/v1/NetworkPolicyList.
 // Network Policy List is a list of NetworkPolicy objects.
 type NetworkPolicyList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
diff --git a/vendor/k8s.io/api/extensions/v1beta1/zz_generated.validations.go b/vendor/k8s.io/api/extensions/v1beta1/zz_generated.validations.go
deleted file mode 100644
index d504d5452e..0000000000
--- a/vendor/k8s.io/api/extensions/v1beta1/zz_generated.validations.go
+++ /dev/null
@@ -1,279 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by validation-gen. DO NOT EDIT.
-
-package v1beta1
-
-import (
-	context "context"
-	fmt "fmt"
-
-	equality "k8s.io/apimachinery/pkg/api/equality"
-	operation "k8s.io/apimachinery/pkg/api/operation"
-	safe "k8s.io/apimachinery/pkg/api/safe"
-	validate "k8s.io/apimachinery/pkg/api/validate"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-	field "k8s.io/apimachinery/pkg/util/validation/field"
-)
-
-func init() { localSchemeBuilder.Register(RegisterValidations) }
-
-// RegisterValidations adds validation functions to the given scheme.
-// Public to allow building arbitrary schemes.
-func RegisterValidations(scheme *runtime.Scheme) error {
-	// type NetworkPolicy
-	scheme.AddValidationFunc((*NetworkPolicy)(nil), func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
-		switch op.Request.SubresourcePath() {
-		case "/":
-			return Validate_NetworkPolicy(ctx, op, nil /* fldPath */, obj.(*NetworkPolicy), safe.Cast[*NetworkPolicy](oldObj))
-		}
-		return field.ErrorList{field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath()))}
-	})
-	// type Scale
-	scheme.AddValidationFunc((*Scale)(nil), func(ctx context.Context, op operation.Operation, obj, oldObj interface{}) field.ErrorList {
-		switch op.Request.SubresourcePath() {
-		case "/scale":
-			return Validate_Scale(ctx, op, nil /* fldPath */, obj.(*Scale), safe.Cast[*Scale](oldObj))
-		}
-		return field.ErrorList{field.InternalError(nil, fmt.Errorf("no validation found for %T, subresource: %v", obj, op.Request.SubresourcePath()))}
-	})
-	return nil
-}
-
-// Validate_IPBlock validates an instance of IPBlock according
-// to declarative validation rules in the API schema.
-func Validate_IPBlock(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *IPBlock) (errs field.ErrorList) {
-	// field IPBlock.CIDR
-	errs = append(errs,
-		func(fldPath *field.Path, obj, oldObj *string, oldValueCorrelated bool) (errs field.ErrorList) {
-			// don't revalidate unchanged data
-			if oldValueCorrelated && op.Type == operation.Update && (obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj)) {
-				return nil
-			}
-			// call field-attached validations
-			earlyReturn := false
-			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
-				errs = append(errs, e...)
-				earlyReturn = true
-			}
-			if earlyReturn {
-				return // do not proceed
-			}
-			return
-		}(fldPath.Child("cidr"), &obj.CIDR, safe.Field(oldObj, func(oldObj *IPBlock) *string { return &oldObj.CIDR }), oldObj != nil)...)
-
-	// field IPBlock.Except has no validation
-	return errs
-}
-
-// Validate_NetworkPolicy validates an instance of NetworkPolicy according
-// to declarative validation rules in the API schema.
-func Validate_NetworkPolicy(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NetworkPolicy) (errs field.ErrorList) {
-	// field NetworkPolicy.TypeMeta has no validation
-	// field NetworkPolicy.ObjectMeta has no validation
-
-	// field NetworkPolicy.Spec
-	errs = append(errs,
-		func(fldPath *field.Path, obj, oldObj *NetworkPolicySpec, oldValueCorrelated bool) (errs field.ErrorList) {
-			// don't revalidate unchanged data
-			if oldValueCorrelated && op.Type == operation.Update && equality.Semantic.DeepEqual(obj, oldObj) {
-				return nil
-			}
-			// call the type's validation function
-			errs = append(errs, Validate_NetworkPolicySpec(ctx, op, fldPath, obj, oldObj)...)
-			return
-		}(fldPath.Child("spec"), &obj.Spec, safe.Field(oldObj, func(oldObj *NetworkPolicy) *NetworkPolicySpec { return &oldObj.Spec }), oldObj != nil)...)
-
-	return errs
-}
-
-// Validate_NetworkPolicyEgressRule validates an instance of NetworkPolicyEgressRule according
-// to declarative validation rules in the API schema.
-func Validate_NetworkPolicyEgressRule(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NetworkPolicyEgressRule) (errs field.ErrorList) {
-	// field NetworkPolicyEgressRule.Ports has no validation
-
-	// field NetworkPolicyEgressRule.To
-	errs = append(errs,
-		func(fldPath *field.Path, obj, oldObj []NetworkPolicyPeer, oldValueCorrelated bool) (errs field.ErrorList) {
-			// don't revalidate unchanged data
-			if oldValueCorrelated && op.Type == operation.Update && equality.Semantic.DeepEqual(obj, oldObj) {
-				return nil
-			}
-			// call field-attached validations
-			earlyReturn := false
-			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
-				earlyReturn = true
-			}
-			if earlyReturn {
-				return // do not proceed
-			}
-			// iterate the list and call the type's validation function
-			errs = append(errs, validate.EachSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_NetworkPolicyPeer)...)
-			return
-		}(fldPath.Child("to"), obj.To, safe.Field(oldObj, func(oldObj *NetworkPolicyEgressRule) []NetworkPolicyPeer { return oldObj.To }), oldObj != nil)...)
-
-	return errs
-}
-
-// Validate_NetworkPolicyIngressRule validates an instance of NetworkPolicyIngressRule according
-// to declarative validation rules in the API schema.
-func Validate_NetworkPolicyIngressRule(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NetworkPolicyIngressRule) (errs field.ErrorList) {
-	// field NetworkPolicyIngressRule.Ports has no validation
-
-	// field NetworkPolicyIngressRule.From
-	errs = append(errs,
-		func(fldPath *field.Path, obj, oldObj []NetworkPolicyPeer, oldValueCorrelated bool) (errs field.ErrorList) {
-			// don't revalidate unchanged data
-			if oldValueCorrelated && op.Type == operation.Update && equality.Semantic.DeepEqual(obj, oldObj) {
-				return nil
-			}
-			// call field-attached validations
-			earlyReturn := false
-			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
-				earlyReturn = true
-			}
-			if earlyReturn {
-				return // do not proceed
-			}
-			// iterate the list and call the type's validation function
-			errs = append(errs, validate.EachSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_NetworkPolicyPeer)...)
-			return
-		}(fldPath.Child("from"), obj.From, safe.Field(oldObj, func(oldObj *NetworkPolicyIngressRule) []NetworkPolicyPeer { return oldObj.From }), oldObj != nil)...)
-
-	return errs
-}
-
-// Validate_NetworkPolicyPeer validates an instance of NetworkPolicyPeer according
-// to declarative validation rules in the API schema.
-func Validate_NetworkPolicyPeer(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NetworkPolicyPeer) (errs field.ErrorList) {
-	// field NetworkPolicyPeer.PodSelector has no validation
-	// field NetworkPolicyPeer.NamespaceSelector has no validation
-
-	// field NetworkPolicyPeer.IPBlock
-	errs = append(errs,
-		func(fldPath *field.Path, obj, oldObj *IPBlock, oldValueCorrelated bool) (errs field.ErrorList) {
-			// don't revalidate unchanged data
-			if oldValueCorrelated && op.Type == operation.Update && equality.Semantic.DeepEqual(obj, oldObj) {
-				return nil
-			}
-			// call field-attached validations
-			earlyReturn := false
-			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
-				earlyReturn = true
-			}
-			if earlyReturn {
-				return // do not proceed
-			}
-			// call the type's validation function
-			errs = append(errs, Validate_IPBlock(ctx, op, fldPath, obj, oldObj)...)
-			return
-		}(fldPath.Child("ipBlock"), obj.IPBlock, safe.Field(oldObj, func(oldObj *NetworkPolicyPeer) *IPBlock { return oldObj.IPBlock }), oldObj != nil)...)
-
-	return errs
-}
-
-// Validate_NetworkPolicySpec validates an instance of NetworkPolicySpec according
-// to declarative validation rules in the API schema.
-func Validate_NetworkPolicySpec(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *NetworkPolicySpec) (errs field.ErrorList) {
-	// field NetworkPolicySpec.PodSelector has no validation
-
-	// field NetworkPolicySpec.Ingress
-	errs = append(errs,
-		func(fldPath *field.Path, obj, oldObj []NetworkPolicyIngressRule, oldValueCorrelated bool) (errs field.ErrorList) {
-			// don't revalidate unchanged data
-			if oldValueCorrelated && op.Type == operation.Update && equality.Semantic.DeepEqual(obj, oldObj) {
-				return nil
-			}
-			// call field-attached validations
-			earlyReturn := false
-			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
-				earlyReturn = true
-			}
-			if earlyReturn {
-				return // do not proceed
-			}
-			// iterate the list and call the type's validation function
-			errs = append(errs, validate.EachSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_NetworkPolicyIngressRule)...)
-			return
-		}(fldPath.Child("ingress"), obj.Ingress, safe.Field(oldObj, func(oldObj *NetworkPolicySpec) []NetworkPolicyIngressRule { return oldObj.Ingress }), oldObj != nil)...)
-
-	// field NetworkPolicySpec.Egress
-	errs = append(errs,
-		func(fldPath *field.Path, obj, oldObj []NetworkPolicyEgressRule, oldValueCorrelated bool) (errs field.ErrorList) {
-			// don't revalidate unchanged data
-			if oldValueCorrelated && op.Type == operation.Update && equality.Semantic.DeepEqual(obj, oldObj) {
-				return nil
-			}
-			// call field-attached validations
-			earlyReturn := false
-			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
-				earlyReturn = true
-			}
-			if earlyReturn {
-				return // do not proceed
-			}
-			// iterate the list and call the type's validation function
-			errs = append(errs, validate.EachSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_NetworkPolicyEgressRule)...)
-			return
-		}(fldPath.Child("egress"), obj.Egress, safe.Field(oldObj, func(oldObj *NetworkPolicySpec) []NetworkPolicyEgressRule { return oldObj.Egress }), oldObj != nil)...)
-
-	// field NetworkPolicySpec.PolicyTypes has no validation
-	return errs
-}
-
-// Validate_Scale validates an instance of Scale according
-// to declarative validation rules in the API schema.
-func Validate_Scale(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *Scale) (errs field.ErrorList) {
-	// field Scale.TypeMeta has no validation
-	// field Scale.ObjectMeta has no validation
-
-	// field Scale.Spec
-	errs = append(errs,
-		func(fldPath *field.Path, obj, oldObj *ScaleSpec, oldValueCorrelated bool) (errs field.ErrorList) {
-			// don't revalidate unchanged data
-			if oldValueCorrelated && op.Type == operation.Update && (obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj)) {
-				return nil
-			}
-			// call the type's validation function
-			errs = append(errs, Validate_ScaleSpec(ctx, op, fldPath, obj, oldObj)...)
-			return
-		}(fldPath.Child("spec"), &obj.Spec, safe.Field(oldObj, func(oldObj *Scale) *ScaleSpec { return &oldObj.Spec }), oldObj != nil)...)
-
-	// field Scale.Status has no validation
-	return errs
-}
-
-// Validate_ScaleSpec validates an instance of ScaleSpec according
-// to declarative validation rules in the API schema.
-func Validate_ScaleSpec(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ScaleSpec) (errs field.ErrorList) {
-	// field ScaleSpec.Replicas
-	errs = append(errs,
-		func(fldPath *field.Path, obj, oldObj *int32, oldValueCorrelated bool) (errs field.ErrorList) {
-			// don't revalidate unchanged data
-			if oldValueCorrelated && op.Type == operation.Update && (obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj)) {
-				return nil
-			}
-			// call field-attached validations
-			errs = append(errs, validate.Minimum(ctx, op, fldPath, obj, oldObj, 0).MarkAlpha()...)
-			return
-		}(fldPath.Child("replicas"), &obj.Replicas, safe.Field(oldObj, func(oldObj *ScaleSpec) *int32 { return &oldObj.Replicas }), oldObj != nil)...)
-
-	return errs
-}
diff --git a/vendor/k8s.io/api/flowcontrol/v1/generated.proto b/vendor/k8s.io/api/flowcontrol/v1/generated.proto
index eb9186d013..29e51ed05b 100644
--- a/vendor/k8s.io/api/flowcontrol/v1/generated.proto
+++ b/vendor/k8s.io/api/flowcontrol/v1/generated.proto
@@ -67,11 +67,13 @@ message FlowDistinguisherMethod {
   // `type` is the type of flow distinguisher method
   // The supported types are "ByUser" and "ByNamespace".
   // Required.
+  // +required
   optional string type = 1;
 }
 
 // FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with
 // similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
+// +k8s:supportsSubresource="/status"
 message FlowSchema {
   // `metadata` is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -80,7 +82,7 @@ message FlowSchema {
 
   // `spec` is the specification of the desired behavior of a FlowSchema.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-  // +optional
+  // +required
   optional FlowSchemaSpec spec = 2;
 
   // `status` is the current status of a FlowSchema.
@@ -93,20 +95,24 @@ message FlowSchema {
 message FlowSchemaCondition {
   // `type` is the type of the condition.
   // Required.
+  // +required
   optional string type = 1;
 
   // `status` is the status of the condition.
-  // Can be True, False, Unknown.
-  // Required.
+  // Should be specified and set to one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // `lastTransitionTime` is the last time the condition transitioned from one status to another.
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3;
 
   // `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+  // +optional
   optional string reason = 4;
 
   // `message` is a human-readable message indicating details about last transition.
+  // +optional
   optional string message = 5;
 }
 
@@ -126,6 +132,7 @@ message FlowSchemaSpec {
   // `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot
   // be resolved, the FlowSchema will be ignored and marked as invalid in its status.
   // Required.
+  // +required
   optional PriorityLevelConfigurationReference priorityLevelConfiguration = 1;
 
   // `matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen
@@ -165,6 +172,7 @@ message GroupSubject {
   // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
   // well-known group names.
   // Required.
+  // +required
   optional string name = 1;
 }
 
@@ -178,17 +186,17 @@ message LimitResponse {
   // "Reject" means that requests that can not be executed upon arrival
   // are rejected.
   // Required.
+  // +required
   // +unionDiscriminator
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:discriminator
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
   optional string type = 1;
 
   // `queuing` holds the configuration parameters for queuing.
   // This field may be non-empty only if `type` is `"Queue"`.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Queue")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:member("Reject")=+k8s:forbidden
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:ifMode("Queue")=+k8s:required
   optional QueuingConfiguration queuing = 2;
 }
 
@@ -221,6 +229,7 @@ message LimitedPriorityLevelConfiguration {
   optional int32 nominalConcurrencyShares = 1;
 
   // `limitResponse` indicates what to do with requests that can not be executed right now
+  // +required
   optional LimitResponse limitResponse = 2;
 
   // `lendablePercent` prescribes the fraction of the level's NominalCL that
@@ -261,6 +270,7 @@ message NonResourcePolicyRule {
   // "*" matches all verbs. If it is present, it must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string verbs = 1;
 
   // `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty.
@@ -273,6 +283,7 @@ message NonResourcePolicyRule {
   // "*" matches all non-resource urls. if it is present, it must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string nonResourceURLs = 6;
 }
 
@@ -286,6 +297,7 @@ message PolicyRulesWithSubjects {
   // A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request.
   // +listType=atomic
   // Required.
+  // +required
   repeated Subject subjects = 1;
 
   // `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the
@@ -303,6 +315,7 @@ message PolicyRulesWithSubjects {
 }
 
 // PriorityLevelConfiguration represents the configuration of a priority level.
+// +k8s:supportsSubresource="/status"
 message PriorityLevelConfiguration {
   // `metadata` is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -311,7 +324,7 @@ message PriorityLevelConfiguration {
 
   // `spec` is the specification of the desired behavior of a "request-priority".
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-  // +optional
+  // +required
   optional PriorityLevelConfigurationSpec spec = 2;
 
   // `status` is the current status of a "request-priority".
@@ -324,20 +337,24 @@ message PriorityLevelConfiguration {
 message PriorityLevelConfigurationCondition {
   // `type` is the type of the condition.
   // Required.
+  // +required
   optional string type = 1;
 
   // `status` is the status of the condition.
-  // Can be True, False, Unknown.
-  // Required.
+  // Should be specified and set to one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // `lastTransitionTime` is the last time the condition transitioned from one status to another.
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3;
 
   // `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+  // +optional
   optional string reason = 4;
 
   // `message` is a human-readable message indicating details about last transition.
+  // +optional
   optional string message = 5;
 }
 
@@ -356,6 +373,7 @@ message PriorityLevelConfigurationList {
 message PriorityLevelConfigurationReference {
   // `name` is the name of the priority level configuration being referenced
   // Required.
+  // +required
   optional string name = 1;
 }
 
@@ -371,17 +389,17 @@ message PriorityLevelConfigurationSpec {
   // _are_ subject to limits and (b) some of the server's limited
   // capacity is made available exclusively to this priority level.
   // Required.
+  // +required
   // +unionDiscriminator
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:discriminator
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
   optional string type = 1;
 
   // `limited` specifies how requests are handled for a Limited priority level.
   // This field must be non-empty if and only if `type` is `"Limited"`.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:forbidden
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:ifMode("Limited")=+k8s:required
   optional LimitedPriorityLevelConfiguration limited = 2;
 
   // `exempt` specifies how requests are handled for an exempt priority level.
@@ -390,9 +408,8 @@ message PriorityLevelConfigurationSpec {
   // If empty and `type` is `"Exempt"` then the default values
   // for `ExemptPriorityLevelConfiguration` apply.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:forbidden
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:ifMode("Exempt")=+k8s:optional
   optional ExemptPriorityLevelConfiguration exempt = 3;
 }
 
@@ -454,12 +471,14 @@ message ResourcePolicyRule {
   // "*" matches all verbs and, if present, must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string verbs = 1;
 
   // `apiGroups` is a list of matching API groups and may not be empty.
   // "*" matches all API groups and, if present, must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string apiGroups = 2;
 
   // `resources` is a list of matching resources (i.e., lowercase
@@ -468,6 +487,7 @@ message ResourcePolicyRule {
   // "*" matches all resources and, if present, must be the only entry.
   // Required.
   // +listType=set
+  // +required
   repeated string resources = 3;
 
   // `clusterScope` indicates whether to match requests that do not
@@ -495,10 +515,12 @@ message ResourcePolicyRule {
 message ServiceAccountSubject {
   // `namespace` is the namespace of matching ServiceAccount objects.
   // Required.
+  // +required
   optional string namespace = 1;
 
   // `name` is the name of matching ServiceAccount objects, or "*" to match regardless of name.
   // Required.
+  // +required
   optional string name = 2;
 }
 
@@ -508,6 +530,7 @@ message ServiceAccountSubject {
 message Subject {
   // `kind` indicates which one of the other fields is non-empty.
   // Required
+  // +required
   // +unionDiscriminator
   optional string kind = 1;
 
@@ -528,6 +551,7 @@ message Subject {
 message UserSubject {
   // `name` is the username that matches, or "*" to match all usernames.
   // Required.
+  // +required
   optional string name = 1;
 }
 
diff --git a/vendor/k8s.io/api/flowcontrol/v1/types.go b/vendor/k8s.io/api/flowcontrol/v1/types.go
index 4a40bdca42..31e421f280 100644
--- a/vendor/k8s.io/api/flowcontrol/v1/types.go
+++ b/vendor/k8s.io/api/flowcontrol/v1/types.go
@@ -110,15 +110,16 @@ const (
 
 // FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with
 // similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
+// +k8s:supportsSubresource="/status"
 type FlowSchema struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	// `spec` is the specification of the desired behavior of a FlowSchema.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-	// +optional
+	// +required
 	Spec FlowSchemaSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 	// `status` is the current status of a FlowSchema.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
@@ -131,7 +132,7 @@ type FlowSchema struct {
 
 // FlowSchemaList is a list of FlowSchema objects.
 type FlowSchemaList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -146,6 +147,7 @@ type FlowSchemaSpec struct {
 	// `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot
 	// be resolved, the FlowSchema will be ignored and marked as invalid in its status.
 	// Required.
+	// +required
 	PriorityLevelConfiguration PriorityLevelConfigurationReference `json:"priorityLevelConfiguration" protobuf:"bytes,1,opt,name=priorityLevelConfiguration"`
 	// `matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen
 	// FlowSchema is among those with the numerically lowest (which we take to be logically highest)
@@ -187,6 +189,7 @@ type FlowDistinguisherMethod struct {
 	// `type` is the type of flow distinguisher method
 	// The supported types are "ByUser" and "ByNamespace".
 	// Required.
+	// +required
 	Type FlowDistinguisherMethodType `json:"type" protobuf:"bytes,1,opt,name=type"`
 }
 
@@ -194,6 +197,7 @@ type FlowDistinguisherMethod struct {
 type PriorityLevelConfigurationReference struct {
 	// `name` is the name of the priority level configuration being referenced
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 }
 
@@ -207,6 +211,7 @@ type PolicyRulesWithSubjects struct {
 	// A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request.
 	// +listType=atomic
 	// Required.
+	// +required
 	Subjects []Subject `json:"subjects" protobuf:"bytes,1,rep,name=subjects"`
 	// `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the
 	// target resource.
@@ -227,6 +232,7 @@ type PolicyRulesWithSubjects struct {
 type Subject struct {
 	// `kind` indicates which one of the other fields is non-empty.
 	// Required
+	// +required
 	// +unionDiscriminator
 	Kind SubjectKind `json:"kind" protobuf:"bytes,1,opt,name=kind"`
 	// `user` matches based on username.
@@ -254,6 +260,7 @@ const (
 type UserSubject struct {
 	// `name` is the username that matches, or "*" to match all usernames.
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 }
 
@@ -263,6 +270,7 @@ type GroupSubject struct {
 	// See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
 	// well-known group names.
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 }
 
@@ -270,9 +278,11 @@ type GroupSubject struct {
 type ServiceAccountSubject struct {
 	// `namespace` is the namespace of matching ServiceAccount objects.
 	// Required.
+	// +required
 	Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"`
 	// `name` is the name of matching ServiceAccount objects, or "*" to match regardless of name.
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,2,opt,name=name"`
 }
 
@@ -290,12 +300,14 @@ type ResourcePolicyRule struct {
 	// "*" matches all verbs and, if present, must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
 
 	// `apiGroups` is a list of matching API groups and may not be empty.
 	// "*" matches all API groups and, if present, must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	APIGroups []string `json:"apiGroups" protobuf:"bytes,2,rep,name=apiGroups"`
 
 	// `resources` is a list of matching resources (i.e., lowercase
@@ -304,6 +316,7 @@ type ResourcePolicyRule struct {
 	// "*" matches all resources and, if present, must be the only entry.
 	// Required.
 	// +listType=set
+	// +required
 	Resources []string `json:"resources" protobuf:"bytes,3,rep,name=resources"`
 
 	// `clusterScope` indicates whether to match requests that do not
@@ -335,6 +348,7 @@ type NonResourcePolicyRule struct {
 	// "*" matches all verbs. If it is present, it must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
 	// `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty.
 	// For example:
@@ -346,6 +360,7 @@ type NonResourcePolicyRule struct {
 	// "*" matches all non-resource urls. if it is present, it must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	NonResourceURLs []string `json:"nonResourceURLs" protobuf:"bytes,6,rep,name=nonResourceURLs"`
 }
 
@@ -364,16 +379,20 @@ type FlowSchemaStatus struct {
 type FlowSchemaCondition struct {
 	// `type` is the type of the condition.
 	// Required.
+	// +required
 	Type FlowSchemaConditionType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
+	// +optional
 	Status ConditionStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
+	// +optional
 	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,3,opt,name=lastTransitionTime"`
 	// `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+	// +optional
 	Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 	// `message` is a human-readable message indicating details about last transition.
+	// +optional
 	Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
 }
 
@@ -386,15 +405,16 @@ type FlowSchemaConditionType string
 // +k8s:prerelease-lifecycle-gen:introduced=1.29
 
 // PriorityLevelConfiguration represents the configuration of a priority level.
+// +k8s:supportsSubresource="/status"
 type PriorityLevelConfiguration struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	// `spec` is the specification of the desired behavior of a "request-priority".
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-	// +optional
+	// +required
 	Spec PriorityLevelConfigurationSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 	// `status` is the current status of a "request-priority".
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
@@ -407,7 +427,7 @@ type PriorityLevelConfiguration struct {
 
 // PriorityLevelConfigurationList is a list of PriorityLevelConfiguration objects.
 type PriorityLevelConfigurationList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -428,17 +448,17 @@ type PriorityLevelConfigurationSpec struct {
 	// _are_ subject to limits and (b) some of the server's limited
 	// capacity is made available exclusively to this priority level.
 	// Required.
+	// +required
 	// +unionDiscriminator
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:discriminator
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
 	Type PriorityLevelEnablement `json:"type" protobuf:"bytes,1,opt,name=type"`
 
 	// `limited` specifies how requests are handled for a Limited priority level.
 	// This field must be non-empty if and only if `type` is `"Limited"`.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:forbidden
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:ifMode("Limited")=+k8s:required
 	Limited *LimitedPriorityLevelConfiguration `json:"limited,omitempty" protobuf:"bytes,2,opt,name=limited"`
 
 	// `exempt` specifies how requests are handled for an exempt priority level.
@@ -447,9 +467,8 @@ type PriorityLevelConfigurationSpec struct {
 	// If empty and `type` is `"Exempt"` then the default values
 	// for `ExemptPriorityLevelConfiguration` apply.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:forbidden
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:ifMode("Exempt")=+k8s:optional
 	Exempt *ExemptPriorityLevelConfiguration `json:"exempt,omitempty" protobuf:"bytes,3,opt,name=exempt"`
 }
 
@@ -494,6 +513,7 @@ type LimitedPriorityLevelConfiguration struct {
 	NominalConcurrencyShares *int32 `json:"nominalConcurrencyShares" protobuf:"varint,1,opt,name=nominalConcurrencyShares"`
 
 	// `limitResponse` indicates what to do with requests that can not be executed right now
+	// +required
 	LimitResponse LimitResponse `json:"limitResponse,omitempty" protobuf:"bytes,2,opt,name=limitResponse"`
 
 	// `lendablePercent` prescribes the fraction of the level's NominalCL that
@@ -573,17 +593,17 @@ type LimitResponse struct {
 	// "Reject" means that requests that can not be executed upon arrival
 	// are rejected.
 	// Required.
+	// +required
 	// +unionDiscriminator
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:discriminator
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
 	Type LimitResponseType `json:"type" protobuf:"bytes,1,opt,name=type"`
 
 	// `queuing` holds the configuration parameters for queuing.
 	// This field may be non-empty only if `type` is `"Queue"`.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Queue")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:member("Reject")=+k8s:forbidden
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:ifMode("Queue")=+k8s:required
 	Queuing *QueuingConfiguration `json:"queuing,omitempty" protobuf:"bytes,2,opt,name=queuing"`
 }
 
@@ -650,16 +670,20 @@ type PriorityLevelConfigurationStatus struct {
 type PriorityLevelConfigurationCondition struct {
 	// `type` is the type of the condition.
 	// Required.
+	// +required
 	Type PriorityLevelConfigurationConditionType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
+	// +optional
 	Status ConditionStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
+	// +optional
 	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,3,opt,name=lastTransitionTime"`
 	// `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+	// +optional
 	Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 	// `message` is a human-readable message indicating details about last transition.
+	// +optional
 	Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
 }
 
diff --git a/vendor/k8s.io/api/flowcontrol/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/flowcontrol/v1/types_swagger_doc_generated.go
index b8cb436367..96b7a78e7d 100644
--- a/vendor/k8s.io/api/flowcontrol/v1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/flowcontrol/v1/types_swagger_doc_generated.go
@@ -60,7 +60,7 @@ func (FlowSchema) SwaggerDoc() map[string]string {
 var map_FlowSchemaCondition = map[string]string{
 	"":                   "FlowSchemaCondition describes conditions for a FlowSchema.",
 	"type":               "`type` is the type of the condition. Required.",
-	"status":             "`status` is the status of the condition. Can be True, False, Unknown. Required.",
+	"status":             "`status` is the status of the condition. Should be specified and set to one of True, False, Unknown.",
 	"lastTransitionTime": "`lastTransitionTime` is the last time the condition transitioned from one status to another.",
 	"reason":             "`reason` is a unique, one-word, CamelCase reason for the condition's last transition.",
 	"message":            "`message` is a human-readable message indicating details about last transition.",
@@ -167,7 +167,7 @@ func (PriorityLevelConfiguration) SwaggerDoc() map[string]string {
 var map_PriorityLevelConfigurationCondition = map[string]string{
 	"":                   "PriorityLevelConfigurationCondition defines the condition of priority level.",
 	"type":               "`type` is the type of the condition. Required.",
-	"status":             "`status` is the status of the condition. Can be True, False, Unknown. Required.",
+	"status":             "`status` is the status of the condition. Should be specified and set to one of True, False, Unknown.",
 	"lastTransitionTime": "`lastTransitionTime` is the last time the condition transitioned from one status to another.",
 	"reason":             "`reason` is a unique, one-word, CamelCase reason for the condition's last transition.",
 	"message":            "`message` is a human-readable message indicating details about last transition.",
diff --git a/vendor/k8s.io/api/flowcontrol/v1beta1/generated.proto b/vendor/k8s.io/api/flowcontrol/v1beta1/generated.proto
index 8a701a6100..c06ec1a2a6 100644
--- a/vendor/k8s.io/api/flowcontrol/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/flowcontrol/v1beta1/generated.proto
@@ -67,11 +67,13 @@ message FlowDistinguisherMethod {
   // `type` is the type of flow distinguisher method
   // The supported types are "ByUser" and "ByNamespace".
   // Required.
+  // +required
   optional string type = 1;
 }
 
 // FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with
 // similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
+// +k8s:supportsSubresource="/status"
 message FlowSchema {
   // `metadata` is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -80,7 +82,7 @@ message FlowSchema {
 
   // `spec` is the specification of the desired behavior of a FlowSchema.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-  // +optional
+  // +required
   optional FlowSchemaSpec spec = 2;
 
   // `status` is the current status of a FlowSchema.
@@ -93,20 +95,24 @@ message FlowSchema {
 message FlowSchemaCondition {
   // `type` is the type of the condition.
   // Required.
+  // +required
   optional string type = 1;
 
   // `status` is the status of the condition.
-  // Can be True, False, Unknown.
-  // Required.
+  // Should be specified and set to one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // `lastTransitionTime` is the last time the condition transitioned from one status to another.
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3;
 
   // `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+  // +optional
   optional string reason = 4;
 
   // `message` is a human-readable message indicating details about last transition.
+  // +optional
   optional string message = 5;
 }
 
@@ -126,6 +132,7 @@ message FlowSchemaSpec {
   // `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot
   // be resolved, the FlowSchema will be ignored and marked as invalid in its status.
   // Required.
+  // +required
   optional PriorityLevelConfigurationReference priorityLevelConfiguration = 1;
 
   // `matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen
@@ -163,6 +170,7 @@ message GroupSubject {
   // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
   // well-known group names.
   // Required.
+  // +required
   optional string name = 1;
 }
 
@@ -176,17 +184,17 @@ message LimitResponse {
   // "Reject" means that requests that can not be executed upon arrival
   // are rejected.
   // Required.
+  // +required
   // +unionDiscriminator
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:discriminator
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
   optional string type = 1;
 
   // `queuing` holds the configuration parameters for queuing.
   // This field may be non-empty only if `type` is `"Queue"`.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Queue")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:member("Reject")=+k8s:forbidden
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:ifMode("Queue")=+k8s:required
   optional QueuingConfiguration queuing = 2;
 }
 
@@ -214,6 +222,7 @@ message LimitedPriorityLevelConfiguration {
   optional int32 assuredConcurrencyShares = 1;
 
   // `limitResponse` indicates what to do with requests that can not be executed right now
+  // +required
   optional LimitResponse limitResponse = 2;
 
   // `lendablePercent` prescribes the fraction of the level's NominalCL that
@@ -254,6 +263,7 @@ message NonResourcePolicyRule {
   // "*" matches all verbs. If it is present, it must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string verbs = 1;
 
   // `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty.
@@ -266,6 +276,7 @@ message NonResourcePolicyRule {
   // "*" matches all non-resource urls. if it is present, it must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string nonResourceURLs = 6;
 }
 
@@ -279,6 +290,7 @@ message PolicyRulesWithSubjects {
   // A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request.
   // +listType=atomic
   // Required.
+  // +required
   repeated Subject subjects = 1;
 
   // `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the
@@ -296,6 +308,7 @@ message PolicyRulesWithSubjects {
 }
 
 // PriorityLevelConfiguration represents the configuration of a priority level.
+// +k8s:supportsSubresource="/status"
 message PriorityLevelConfiguration {
   // `metadata` is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -304,7 +317,7 @@ message PriorityLevelConfiguration {
 
   // `spec` is the specification of the desired behavior of a "request-priority".
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-  // +optional
+  // +required
   optional PriorityLevelConfigurationSpec spec = 2;
 
   // `status` is the current status of a "request-priority".
@@ -317,20 +330,24 @@ message PriorityLevelConfiguration {
 message PriorityLevelConfigurationCondition {
   // `type` is the type of the condition.
   // Required.
+  // +required
   optional string type = 1;
 
   // `status` is the status of the condition.
-  // Can be True, False, Unknown.
-  // Required.
+  // Should be specified and set to one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // `lastTransitionTime` is the last time the condition transitioned from one status to another.
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3;
 
   // `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+  // +optional
   optional string reason = 4;
 
   // `message` is a human-readable message indicating details about last transition.
+  // +optional
   optional string message = 5;
 }
 
@@ -349,6 +366,7 @@ message PriorityLevelConfigurationList {
 message PriorityLevelConfigurationReference {
   // `name` is the name of the priority level configuration being referenced
   // Required.
+  // +required
   optional string name = 1;
 }
 
@@ -364,17 +382,17 @@ message PriorityLevelConfigurationSpec {
   // _are_ subject to limits and (b) some of the server's limited
   // capacity is made available exclusively to this priority level.
   // Required.
+  // +required
   // +unionDiscriminator
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:discriminator
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
   optional string type = 1;
 
   // `limited` specifies how requests are handled for a Limited priority level.
   // This field must be non-empty if and only if `type` is `"Limited"`.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:forbidden
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:ifMode("Limited")=+k8s:required
   optional LimitedPriorityLevelConfiguration limited = 2;
 
   // `exempt` specifies how requests are handled for an exempt priority level.
@@ -383,9 +401,8 @@ message PriorityLevelConfigurationSpec {
   // If empty and `type` is `"Exempt"` then the default values
   // for `ExemptPriorityLevelConfiguration` apply.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:forbidden
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:ifMode("Exempt")=+k8s:optional
   optional ExemptPriorityLevelConfiguration exempt = 3;
 }
 
@@ -445,12 +462,14 @@ message ResourcePolicyRule {
   // "*" matches all verbs and, if present, must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string verbs = 1;
 
   // `apiGroups` is a list of matching API groups and may not be empty.
   // "*" matches all API groups and, if present, must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string apiGroups = 2;
 
   // `resources` is a list of matching resources (i.e., lowercase
@@ -459,6 +478,7 @@ message ResourcePolicyRule {
   // "*" matches all resources and, if present, must be the only entry.
   // Required.
   // +listType=set
+  // +required
   repeated string resources = 3;
 
   // `clusterScope` indicates whether to match requests that do not
@@ -486,10 +506,12 @@ message ResourcePolicyRule {
 message ServiceAccountSubject {
   // `namespace` is the namespace of matching ServiceAccount objects.
   // Required.
+  // +required
   optional string namespace = 1;
 
   // `name` is the name of matching ServiceAccount objects, or "*" to match regardless of name.
   // Required.
+  // +required
   optional string name = 2;
 }
 
@@ -499,6 +521,7 @@ message ServiceAccountSubject {
 message Subject {
   // `kind` indicates which one of the other fields is non-empty.
   // Required
+  // +required
   // +unionDiscriminator
   optional string kind = 1;
 
@@ -519,6 +542,7 @@ message Subject {
 message UserSubject {
   // `name` is the username that matches, or "*" to match all usernames.
   // Required.
+  // +required
   optional string name = 1;
 }
 
diff --git a/vendor/k8s.io/api/flowcontrol/v1beta1/types.go b/vendor/k8s.io/api/flowcontrol/v1beta1/types.go
index 0de6ea940e..39f869f6c6 100644
--- a/vendor/k8s.io/api/flowcontrol/v1beta1/types.go
+++ b/vendor/k8s.io/api/flowcontrol/v1beta1/types.go
@@ -111,15 +111,16 @@ const (
 
 // FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with
 // similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
+// +k8s:supportsSubresource="/status"
 type FlowSchema struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	// `spec` is the specification of the desired behavior of a FlowSchema.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-	// +optional
+	// +required
 	Spec FlowSchemaSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 	// `status` is the current status of a FlowSchema.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
@@ -133,7 +134,7 @@ type FlowSchema struct {
 
 // FlowSchemaList is a list of FlowSchema objects.
 type FlowSchemaList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -148,6 +149,7 @@ type FlowSchemaSpec struct {
 	// `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot
 	// be resolved, the FlowSchema will be ignored and marked as invalid in its status.
 	// Required.
+	// +required
 	PriorityLevelConfiguration PriorityLevelConfigurationReference `json:"priorityLevelConfiguration" protobuf:"bytes,1,opt,name=priorityLevelConfiguration"`
 	// `matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen
 	// FlowSchema is among those with the numerically lowest (which we take to be logically highest)
@@ -189,6 +191,7 @@ type FlowDistinguisherMethod struct {
 	// `type` is the type of flow distinguisher method
 	// The supported types are "ByUser" and "ByNamespace".
 	// Required.
+	// +required
 	Type FlowDistinguisherMethodType `json:"type" protobuf:"bytes,1,opt,name=type"`
 }
 
@@ -196,6 +199,7 @@ type FlowDistinguisherMethod struct {
 type PriorityLevelConfigurationReference struct {
 	// `name` is the name of the priority level configuration being referenced
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 }
 
@@ -209,6 +213,7 @@ type PolicyRulesWithSubjects struct {
 	// A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request.
 	// +listType=atomic
 	// Required.
+	// +required
 	Subjects []Subject `json:"subjects" protobuf:"bytes,1,rep,name=subjects"`
 	// `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the
 	// target resource.
@@ -229,6 +234,7 @@ type PolicyRulesWithSubjects struct {
 type Subject struct {
 	// `kind` indicates which one of the other fields is non-empty.
 	// Required
+	// +required
 	// +unionDiscriminator
 	Kind SubjectKind `json:"kind" protobuf:"bytes,1,opt,name=kind"`
 	// `user` matches based on username.
@@ -256,6 +262,7 @@ const (
 type UserSubject struct {
 	// `name` is the username that matches, or "*" to match all usernames.
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 }
 
@@ -265,6 +272,7 @@ type GroupSubject struct {
 	// See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
 	// well-known group names.
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 }
 
@@ -272,9 +280,11 @@ type GroupSubject struct {
 type ServiceAccountSubject struct {
 	// `namespace` is the namespace of matching ServiceAccount objects.
 	// Required.
+	// +required
 	Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"`
 	// `name` is the name of matching ServiceAccount objects, or "*" to match regardless of name.
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,2,opt,name=name"`
 }
 
@@ -292,12 +302,14 @@ type ResourcePolicyRule struct {
 	// "*" matches all verbs and, if present, must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
 
 	// `apiGroups` is a list of matching API groups and may not be empty.
 	// "*" matches all API groups and, if present, must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	APIGroups []string `json:"apiGroups" protobuf:"bytes,2,rep,name=apiGroups"`
 
 	// `resources` is a list of matching resources (i.e., lowercase
@@ -306,6 +318,7 @@ type ResourcePolicyRule struct {
 	// "*" matches all resources and, if present, must be the only entry.
 	// Required.
 	// +listType=set
+	// +required
 	Resources []string `json:"resources" protobuf:"bytes,3,rep,name=resources"`
 
 	// `clusterScope` indicates whether to match requests that do not
@@ -337,6 +350,7 @@ type NonResourcePolicyRule struct {
 	// "*" matches all verbs. If it is present, it must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
 	// `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty.
 	// For example:
@@ -348,6 +362,7 @@ type NonResourcePolicyRule struct {
 	// "*" matches all non-resource urls. if it is present, it must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	NonResourceURLs []string `json:"nonResourceURLs" protobuf:"bytes,6,rep,name=nonResourceURLs"`
 }
 
@@ -364,16 +379,20 @@ type FlowSchemaStatus struct {
 type FlowSchemaCondition struct {
 	// `type` is the type of the condition.
 	// Required.
+	// +required
 	Type FlowSchemaConditionType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
+	// +optional
 	Status ConditionStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
+	// +optional
 	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,3,opt,name=lastTransitionTime"`
 	// `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+	// +optional
 	Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 	// `message` is a human-readable message indicating details about last transition.
+	// +optional
 	Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
 }
 
@@ -387,15 +406,16 @@ type FlowSchemaConditionType string
 // +k8s:prerelease-lifecycle-gen:replacement=flowcontrol.apiserver.k8s.io,v1beta3,PriorityLevelConfiguration
 
 // PriorityLevelConfiguration represents the configuration of a priority level.
+// +k8s:supportsSubresource="/status"
 type PriorityLevelConfiguration struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	// `spec` is the specification of the desired behavior of a "request-priority".
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-	// +optional
+	// +required
 	Spec PriorityLevelConfigurationSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 	// `status` is the current status of a "request-priority".
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
@@ -409,7 +429,7 @@ type PriorityLevelConfiguration struct {
 
 // PriorityLevelConfigurationList is a list of PriorityLevelConfiguration objects.
 type PriorityLevelConfigurationList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -430,17 +450,17 @@ type PriorityLevelConfigurationSpec struct {
 	// _are_ subject to limits and (b) some of the server's limited
 	// capacity is made available exclusively to this priority level.
 	// Required.
+	// +required
 	// +unionDiscriminator
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:discriminator
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
 	Type PriorityLevelEnablement `json:"type" protobuf:"bytes,1,opt,name=type"`
 
 	// `limited` specifies how requests are handled for a Limited priority level.
 	// This field must be non-empty if and only if `type` is `"Limited"`.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:forbidden
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:ifMode("Limited")=+k8s:required
 	Limited *LimitedPriorityLevelConfiguration `json:"limited,omitempty" protobuf:"bytes,2,opt,name=limited"`
 
 	// `exempt` specifies how requests are handled for an exempt priority level.
@@ -449,9 +469,8 @@ type PriorityLevelConfigurationSpec struct {
 	// If empty and `type` is `"Exempt"` then the default values
 	// for `ExemptPriorityLevelConfiguration` apply.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:forbidden
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:ifMode("Exempt")=+k8s:optional
 	Exempt *ExemptPriorityLevelConfiguration `json:"exempt,omitempty" protobuf:"bytes,3,opt,name=exempt"`
 }
 
@@ -491,6 +510,7 @@ type LimitedPriorityLevelConfiguration struct {
 	AssuredConcurrencyShares int32 `json:"assuredConcurrencyShares" protobuf:"varint,1,opt,name=assuredConcurrencyShares"`
 
 	// `limitResponse` indicates what to do with requests that can not be executed right now
+	// +required
 	LimitResponse LimitResponse `json:"limitResponse,omitempty" protobuf:"bytes,2,opt,name=limitResponse"`
 
 	// `lendablePercent` prescribes the fraction of the level's NominalCL that
@@ -570,17 +590,17 @@ type LimitResponse struct {
 	// "Reject" means that requests that can not be executed upon arrival
 	// are rejected.
 	// Required.
+	// +required
 	// +unionDiscriminator
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:discriminator
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
 	Type LimitResponseType `json:"type" protobuf:"bytes,1,opt,name=type"`
 
 	// `queuing` holds the configuration parameters for queuing.
 	// This field may be non-empty only if `type` is `"Queue"`.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Queue")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:member("Reject")=+k8s:forbidden
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:ifMode("Queue")=+k8s:required
 	Queuing *QueuingConfiguration `json:"queuing,omitempty" protobuf:"bytes,2,opt,name=queuing"`
 }
 
@@ -645,16 +665,20 @@ type PriorityLevelConfigurationStatus struct {
 type PriorityLevelConfigurationCondition struct {
 	// `type` is the type of the condition.
 	// Required.
+	// +required
 	Type PriorityLevelConfigurationConditionType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
+	// +optional
 	Status ConditionStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
+	// +optional
 	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,3,opt,name=lastTransitionTime"`
 	// `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+	// +optional
 	Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 	// `message` is a human-readable message indicating details about last transition.
+	// +optional
 	Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
 }
 
diff --git a/vendor/k8s.io/api/flowcontrol/v1beta1/types_swagger_doc_generated.go b/vendor/k8s.io/api/flowcontrol/v1beta1/types_swagger_doc_generated.go
index d69bdac622..fee54a89bf 100644
--- a/vendor/k8s.io/api/flowcontrol/v1beta1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/flowcontrol/v1beta1/types_swagger_doc_generated.go
@@ -60,7 +60,7 @@ func (FlowSchema) SwaggerDoc() map[string]string {
 var map_FlowSchemaCondition = map[string]string{
 	"":                   "FlowSchemaCondition describes conditions for a FlowSchema.",
 	"type":               "`type` is the type of the condition. Required.",
-	"status":             "`status` is the status of the condition. Can be True, False, Unknown. Required.",
+	"status":             "`status` is the status of the condition. Should be specified and set to one of True, False, Unknown.",
 	"lastTransitionTime": "`lastTransitionTime` is the last time the condition transitioned from one status to another.",
 	"reason":             "`reason` is a unique, one-word, CamelCase reason for the condition's last transition.",
 	"message":            "`message` is a human-readable message indicating details about last transition.",
@@ -167,7 +167,7 @@ func (PriorityLevelConfiguration) SwaggerDoc() map[string]string {
 var map_PriorityLevelConfigurationCondition = map[string]string{
 	"":                   "PriorityLevelConfigurationCondition defines the condition of priority level.",
 	"type":               "`type` is the type of the condition. Required.",
-	"status":             "`status` is the status of the condition. Can be True, False, Unknown. Required.",
+	"status":             "`status` is the status of the condition. Should be specified and set to one of True, False, Unknown.",
 	"lastTransitionTime": "`lastTransitionTime` is the last time the condition transitioned from one status to another.",
 	"reason":             "`reason` is a unique, one-word, CamelCase reason for the condition's last transition.",
 	"message":            "`message` is a human-readable message indicating details about last transition.",
diff --git a/vendor/k8s.io/api/flowcontrol/v1beta2/generated.proto b/vendor/k8s.io/api/flowcontrol/v1beta2/generated.proto
index 371b90a5cd..a80455d670 100644
--- a/vendor/k8s.io/api/flowcontrol/v1beta2/generated.proto
+++ b/vendor/k8s.io/api/flowcontrol/v1beta2/generated.proto
@@ -67,11 +67,13 @@ message FlowDistinguisherMethod {
   // `type` is the type of flow distinguisher method
   // The supported types are "ByUser" and "ByNamespace".
   // Required.
+  // +required
   optional string type = 1;
 }
 
 // FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with
 // similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
+// +k8s:supportsSubresource="/status"
 message FlowSchema {
   // `metadata` is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -80,7 +82,7 @@ message FlowSchema {
 
   // `spec` is the specification of the desired behavior of a FlowSchema.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-  // +optional
+  // +required
   optional FlowSchemaSpec spec = 2;
 
   // `status` is the current status of a FlowSchema.
@@ -93,20 +95,24 @@ message FlowSchema {
 message FlowSchemaCondition {
   // `type` is the type of the condition.
   // Required.
+  // +required
   optional string type = 1;
 
   // `status` is the status of the condition.
-  // Can be True, False, Unknown.
-  // Required.
+  // Should be specified and set to one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // `lastTransitionTime` is the last time the condition transitioned from one status to another.
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3;
 
   // `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+  // +optional
   optional string reason = 4;
 
   // `message` is a human-readable message indicating details about last transition.
+  // +optional
   optional string message = 5;
 }
 
@@ -126,6 +132,7 @@ message FlowSchemaSpec {
   // `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot
   // be resolved, the FlowSchema will be ignored and marked as invalid in its status.
   // Required.
+  // +required
   optional PriorityLevelConfigurationReference priorityLevelConfiguration = 1;
 
   // `matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen
@@ -163,6 +170,7 @@ message GroupSubject {
   // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
   // well-known group names.
   // Required.
+  // +required
   optional string name = 1;
 }
 
@@ -176,17 +184,17 @@ message LimitResponse {
   // "Reject" means that requests that can not be executed upon arrival
   // are rejected.
   // Required.
+  // +required
   // +unionDiscriminator
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:discriminator
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
   optional string type = 1;
 
   // `queuing` holds the configuration parameters for queuing.
   // This field may be non-empty only if `type` is `"Queue"`.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Queue")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:member("Reject")=+k8s:forbidden
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:ifMode("Queue")=+k8s:required
   optional QueuingConfiguration queuing = 2;
 }
 
@@ -214,6 +222,7 @@ message LimitedPriorityLevelConfiguration {
   optional int32 assuredConcurrencyShares = 1;
 
   // `limitResponse` indicates what to do with requests that can not be executed right now
+  // +required
   optional LimitResponse limitResponse = 2;
 
   // `lendablePercent` prescribes the fraction of the level's NominalCL that
@@ -254,6 +263,7 @@ message NonResourcePolicyRule {
   // "*" matches all verbs. If it is present, it must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string verbs = 1;
 
   // `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty.
@@ -266,6 +276,7 @@ message NonResourcePolicyRule {
   // "*" matches all non-resource urls. if it is present, it must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string nonResourceURLs = 6;
 }
 
@@ -279,6 +290,7 @@ message PolicyRulesWithSubjects {
   // A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request.
   // +listType=atomic
   // Required.
+  // +required
   repeated Subject subjects = 1;
 
   // `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the
@@ -296,6 +308,7 @@ message PolicyRulesWithSubjects {
 }
 
 // PriorityLevelConfiguration represents the configuration of a priority level.
+// +k8s:supportsSubresource="/status"
 message PriorityLevelConfiguration {
   // `metadata` is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -304,7 +317,7 @@ message PriorityLevelConfiguration {
 
   // `spec` is the specification of the desired behavior of a "request-priority".
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-  // +optional
+  // +required
   optional PriorityLevelConfigurationSpec spec = 2;
 
   // `status` is the current status of a "request-priority".
@@ -317,20 +330,24 @@ message PriorityLevelConfiguration {
 message PriorityLevelConfigurationCondition {
   // `type` is the type of the condition.
   // Required.
+  // +required
   optional string type = 1;
 
   // `status` is the status of the condition.
-  // Can be True, False, Unknown.
-  // Required.
+  // Should be specified and set to one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // `lastTransitionTime` is the last time the condition transitioned from one status to another.
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3;
 
   // `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+  // +optional
   optional string reason = 4;
 
   // `message` is a human-readable message indicating details about last transition.
+  // +optional
   optional string message = 5;
 }
 
@@ -349,6 +366,7 @@ message PriorityLevelConfigurationList {
 message PriorityLevelConfigurationReference {
   // `name` is the name of the priority level configuration being referenced
   // Required.
+  // +required
   optional string name = 1;
 }
 
@@ -364,17 +382,17 @@ message PriorityLevelConfigurationSpec {
   // _are_ subject to limits and (b) some of the server's limited
   // capacity is made available exclusively to this priority level.
   // Required.
+  // +required
   // +unionDiscriminator
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:discriminator
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
   optional string type = 1;
 
   // `limited` specifies how requests are handled for a Limited priority level.
   // This field must be non-empty if and only if `type` is `"Limited"`.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:forbidden
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:ifMode("Limited")=+k8s:required
   optional LimitedPriorityLevelConfiguration limited = 2;
 
   // `exempt` specifies how requests are handled for an exempt priority level.
@@ -383,9 +401,8 @@ message PriorityLevelConfigurationSpec {
   // If empty and `type` is `"Exempt"` then the default values
   // for `ExemptPriorityLevelConfiguration` apply.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:forbidden
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:ifMode("Exempt")=+k8s:optional
   optional ExemptPriorityLevelConfiguration exempt = 3;
 }
 
@@ -445,12 +462,14 @@ message ResourcePolicyRule {
   // "*" matches all verbs and, if present, must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string verbs = 1;
 
   // `apiGroups` is a list of matching API groups and may not be empty.
   // "*" matches all API groups and, if present, must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string apiGroups = 2;
 
   // `resources` is a list of matching resources (i.e., lowercase
@@ -459,6 +478,7 @@ message ResourcePolicyRule {
   // "*" matches all resources and, if present, must be the only entry.
   // Required.
   // +listType=set
+  // +required
   repeated string resources = 3;
 
   // `clusterScope` indicates whether to match requests that do not
@@ -486,10 +506,12 @@ message ResourcePolicyRule {
 message ServiceAccountSubject {
   // `namespace` is the namespace of matching ServiceAccount objects.
   // Required.
+  // +required
   optional string namespace = 1;
 
   // `name` is the name of matching ServiceAccount objects, or "*" to match regardless of name.
   // Required.
+  // +required
   optional string name = 2;
 }
 
@@ -499,6 +521,7 @@ message ServiceAccountSubject {
 message Subject {
   // `kind` indicates which one of the other fields is non-empty.
   // Required
+  // +required
   // +unionDiscriminator
   optional string kind = 1;
 
@@ -519,6 +542,7 @@ message Subject {
 message UserSubject {
   // `name` is the username that matches, or "*" to match all usernames.
   // Required.
+  // +required
   optional string name = 1;
 }
 
diff --git a/vendor/k8s.io/api/flowcontrol/v1beta2/types.go b/vendor/k8s.io/api/flowcontrol/v1beta2/types.go
index 2f82a6823b..38ab2a2a7b 100644
--- a/vendor/k8s.io/api/flowcontrol/v1beta2/types.go
+++ b/vendor/k8s.io/api/flowcontrol/v1beta2/types.go
@@ -111,15 +111,16 @@ const (
 
 // FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with
 // similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
+// +k8s:supportsSubresource="/status"
 type FlowSchema struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	// `spec` is the specification of the desired behavior of a FlowSchema.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-	// +optional
+	// +required
 	Spec FlowSchemaSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 	// `status` is the current status of a FlowSchema.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
@@ -133,7 +134,7 @@ type FlowSchema struct {
 
 // FlowSchemaList is a list of FlowSchema objects.
 type FlowSchemaList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -148,6 +149,7 @@ type FlowSchemaSpec struct {
 	// `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot
 	// be resolved, the FlowSchema will be ignored and marked as invalid in its status.
 	// Required.
+	// +required
 	PriorityLevelConfiguration PriorityLevelConfigurationReference `json:"priorityLevelConfiguration" protobuf:"bytes,1,opt,name=priorityLevelConfiguration"`
 	// `matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen
 	// FlowSchema is among those with the numerically lowest (which we take to be logically highest)
@@ -189,6 +191,7 @@ type FlowDistinguisherMethod struct {
 	// `type` is the type of flow distinguisher method
 	// The supported types are "ByUser" and "ByNamespace".
 	// Required.
+	// +required
 	Type FlowDistinguisherMethodType `json:"type" protobuf:"bytes,1,opt,name=type"`
 }
 
@@ -196,6 +199,7 @@ type FlowDistinguisherMethod struct {
 type PriorityLevelConfigurationReference struct {
 	// `name` is the name of the priority level configuration being referenced
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 }
 
@@ -209,6 +213,7 @@ type PolicyRulesWithSubjects struct {
 	// A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request.
 	// +listType=atomic
 	// Required.
+	// +required
 	Subjects []Subject `json:"subjects" protobuf:"bytes,1,rep,name=subjects"`
 	// `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the
 	// target resource.
@@ -229,6 +234,7 @@ type PolicyRulesWithSubjects struct {
 type Subject struct {
 	// `kind` indicates which one of the other fields is non-empty.
 	// Required
+	// +required
 	// +unionDiscriminator
 	Kind SubjectKind `json:"kind" protobuf:"bytes,1,opt,name=kind"`
 	// `user` matches based on username.
@@ -256,6 +262,7 @@ const (
 type UserSubject struct {
 	// `name` is the username that matches, or "*" to match all usernames.
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 }
 
@@ -265,6 +272,7 @@ type GroupSubject struct {
 	// See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
 	// well-known group names.
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 }
 
@@ -272,9 +280,11 @@ type GroupSubject struct {
 type ServiceAccountSubject struct {
 	// `namespace` is the namespace of matching ServiceAccount objects.
 	// Required.
+	// +required
 	Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"`
 	// `name` is the name of matching ServiceAccount objects, or "*" to match regardless of name.
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,2,opt,name=name"`
 }
 
@@ -292,12 +302,14 @@ type ResourcePolicyRule struct {
 	// "*" matches all verbs and, if present, must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
 
 	// `apiGroups` is a list of matching API groups and may not be empty.
 	// "*" matches all API groups and, if present, must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	APIGroups []string `json:"apiGroups" protobuf:"bytes,2,rep,name=apiGroups"`
 
 	// `resources` is a list of matching resources (i.e., lowercase
@@ -306,6 +318,7 @@ type ResourcePolicyRule struct {
 	// "*" matches all resources and, if present, must be the only entry.
 	// Required.
 	// +listType=set
+	// +required
 	Resources []string `json:"resources" protobuf:"bytes,3,rep,name=resources"`
 
 	// `clusterScope` indicates whether to match requests that do not
@@ -337,6 +350,7 @@ type NonResourcePolicyRule struct {
 	// "*" matches all verbs. If it is present, it must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
 	// `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty.
 	// For example:
@@ -348,6 +362,7 @@ type NonResourcePolicyRule struct {
 	// "*" matches all non-resource urls. if it is present, it must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	NonResourceURLs []string `json:"nonResourceURLs" protobuf:"bytes,6,rep,name=nonResourceURLs"`
 }
 
@@ -364,16 +379,20 @@ type FlowSchemaStatus struct {
 type FlowSchemaCondition struct {
 	// `type` is the type of the condition.
 	// Required.
+	// +required
 	Type FlowSchemaConditionType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
+	// +optional
 	Status ConditionStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
+	// +optional
 	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,3,opt,name=lastTransitionTime"`
 	// `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+	// +optional
 	Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 	// `message` is a human-readable message indicating details about last transition.
+	// +optional
 	Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
 }
 
@@ -387,15 +406,16 @@ type FlowSchemaConditionType string
 // +k8s:prerelease-lifecycle-gen:replacement=flowcontrol.apiserver.k8s.io,v1beta3,PriorityLevelConfiguration
 
 // PriorityLevelConfiguration represents the configuration of a priority level.
+// +k8s:supportsSubresource="/status"
 type PriorityLevelConfiguration struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	// `spec` is the specification of the desired behavior of a "request-priority".
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-	// +optional
+	// +required
 	Spec PriorityLevelConfigurationSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 	// `status` is the current status of a "request-priority".
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
@@ -409,7 +429,7 @@ type PriorityLevelConfiguration struct {
 
 // PriorityLevelConfigurationList is a list of PriorityLevelConfiguration objects.
 type PriorityLevelConfigurationList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -430,17 +450,17 @@ type PriorityLevelConfigurationSpec struct {
 	// _are_ subject to limits and (b) some of the server's limited
 	// capacity is made available exclusively to this priority level.
 	// Required.
+	// +required
 	// +unionDiscriminator
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:discriminator
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
 	Type PriorityLevelEnablement `json:"type" protobuf:"bytes,1,opt,name=type"`
 
 	// `limited` specifies how requests are handled for a Limited priority level.
 	// This field must be non-empty if and only if `type` is `"Limited"`.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:forbidden
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:ifMode("Limited")=+k8s:required
 	Limited *LimitedPriorityLevelConfiguration `json:"limited,omitempty" protobuf:"bytes,2,opt,name=limited"`
 
 	// `exempt` specifies how requests are handled for an exempt priority level.
@@ -449,9 +469,8 @@ type PriorityLevelConfigurationSpec struct {
 	// If empty and `type` is `"Exempt"` then the default values
 	// for `ExemptPriorityLevelConfiguration` apply.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:forbidden
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:ifMode("Exempt")=+k8s:optional
 	Exempt *ExemptPriorityLevelConfiguration `json:"exempt,omitempty" protobuf:"bytes,3,opt,name=exempt"`
 }
 
@@ -491,6 +510,7 @@ type LimitedPriorityLevelConfiguration struct {
 	AssuredConcurrencyShares int32 `json:"assuredConcurrencyShares" protobuf:"varint,1,opt,name=assuredConcurrencyShares"`
 
 	// `limitResponse` indicates what to do with requests that can not be executed right now
+	// +required
 	LimitResponse LimitResponse `json:"limitResponse,omitempty" protobuf:"bytes,2,opt,name=limitResponse"`
 
 	// `lendablePercent` prescribes the fraction of the level's NominalCL that
@@ -570,17 +590,17 @@ type LimitResponse struct {
 	// "Reject" means that requests that can not be executed upon arrival
 	// are rejected.
 	// Required.
+	// +required
 	// +unionDiscriminator
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:discriminator
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
 	Type LimitResponseType `json:"type" protobuf:"bytes,1,opt,name=type"`
 
 	// `queuing` holds the configuration parameters for queuing.
 	// This field may be non-empty only if `type` is `"Queue"`.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Queue")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:member("Reject")=+k8s:forbidden
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:ifMode("Queue")=+k8s:required
 	Queuing *QueuingConfiguration `json:"queuing,omitempty" protobuf:"bytes,2,opt,name=queuing"`
 }
 
@@ -645,16 +665,20 @@ type PriorityLevelConfigurationStatus struct {
 type PriorityLevelConfigurationCondition struct {
 	// `type` is the type of the condition.
 	// Required.
+	// +required
 	Type PriorityLevelConfigurationConditionType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
+	// +optional
 	Status ConditionStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
+	// +optional
 	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,3,opt,name=lastTransitionTime"`
 	// `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+	// +optional
 	Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 	// `message` is a human-readable message indicating details about last transition.
+	// +optional
 	Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
 }
 
diff --git a/vendor/k8s.io/api/flowcontrol/v1beta2/types_swagger_doc_generated.go b/vendor/k8s.io/api/flowcontrol/v1beta2/types_swagger_doc_generated.go
index 921122731a..bf12ce5e0b 100644
--- a/vendor/k8s.io/api/flowcontrol/v1beta2/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/flowcontrol/v1beta2/types_swagger_doc_generated.go
@@ -60,7 +60,7 @@ func (FlowSchema) SwaggerDoc() map[string]string {
 var map_FlowSchemaCondition = map[string]string{
 	"":                   "FlowSchemaCondition describes conditions for a FlowSchema.",
 	"type":               "`type` is the type of the condition. Required.",
-	"status":             "`status` is the status of the condition. Can be True, False, Unknown. Required.",
+	"status":             "`status` is the status of the condition. Should be specified and set to one of True, False, Unknown.",
 	"lastTransitionTime": "`lastTransitionTime` is the last time the condition transitioned from one status to another.",
 	"reason":             "`reason` is a unique, one-word, CamelCase reason for the condition's last transition.",
 	"message":            "`message` is a human-readable message indicating details about last transition.",
@@ -167,7 +167,7 @@ func (PriorityLevelConfiguration) SwaggerDoc() map[string]string {
 var map_PriorityLevelConfigurationCondition = map[string]string{
 	"":                   "PriorityLevelConfigurationCondition defines the condition of priority level.",
 	"type":               "`type` is the type of the condition. Required.",
-	"status":             "`status` is the status of the condition. Can be True, False, Unknown. Required.",
+	"status":             "`status` is the status of the condition. Should be specified and set to one of True, False, Unknown.",
 	"lastTransitionTime": "`lastTransitionTime` is the last time the condition transitioned from one status to another.",
 	"reason":             "`reason` is a unique, one-word, CamelCase reason for the condition's last transition.",
 	"message":            "`message` is a human-readable message indicating details about last transition.",
diff --git a/vendor/k8s.io/api/flowcontrol/v1beta3/generated.proto b/vendor/k8s.io/api/flowcontrol/v1beta3/generated.proto
index 7e11de2a28..68344b79b6 100644
--- a/vendor/k8s.io/api/flowcontrol/v1beta3/generated.proto
+++ b/vendor/k8s.io/api/flowcontrol/v1beta3/generated.proto
@@ -67,11 +67,13 @@ message FlowDistinguisherMethod {
   // `type` is the type of flow distinguisher method
   // The supported types are "ByUser" and "ByNamespace".
   // Required.
+  // +required
   optional string type = 1;
 }
 
 // FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with
 // similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
+// +k8s:supportsSubresource="/status"
 message FlowSchema {
   // `metadata` is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -80,7 +82,7 @@ message FlowSchema {
 
   // `spec` is the specification of the desired behavior of a FlowSchema.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-  // +optional
+  // +required
   optional FlowSchemaSpec spec = 2;
 
   // `status` is the current status of a FlowSchema.
@@ -93,20 +95,24 @@ message FlowSchema {
 message FlowSchemaCondition {
   // `type` is the type of the condition.
   // Required.
+  // +required
   optional string type = 1;
 
   // `status` is the status of the condition.
-  // Can be True, False, Unknown.
-  // Required.
+  // Should be specified and set to one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // `lastTransitionTime` is the last time the condition transitioned from one status to another.
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3;
 
   // `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+  // +optional
   optional string reason = 4;
 
   // `message` is a human-readable message indicating details about last transition.
+  // +optional
   optional string message = 5;
 }
 
@@ -126,6 +132,7 @@ message FlowSchemaSpec {
   // `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot
   // be resolved, the FlowSchema will be ignored and marked as invalid in its status.
   // Required.
+  // +required
   optional PriorityLevelConfigurationReference priorityLevelConfiguration = 1;
 
   // `matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen
@@ -165,6 +172,7 @@ message GroupSubject {
   // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
   // well-known group names.
   // Required.
+  // +required
   optional string name = 1;
 }
 
@@ -178,17 +186,17 @@ message LimitResponse {
   // "Reject" means that requests that can not be executed upon arrival
   // are rejected.
   // Required.
+  // +required
   // +unionDiscriminator
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:discriminator
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
   optional string type = 1;
 
   // `queuing` holds the configuration parameters for queuing.
   // This field may be non-empty only if `type` is `"Queue"`.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Queue")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:member("Reject")=+k8s:forbidden
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:ifMode("Queue")=+k8s:required
   optional QueuingConfiguration queuing = 2;
 }
 
@@ -216,6 +224,7 @@ message LimitedPriorityLevelConfiguration {
   optional int32 nominalConcurrencyShares = 1;
 
   // `limitResponse` indicates what to do with requests that can not be executed right now
+  // +required
   optional LimitResponse limitResponse = 2;
 
   // `lendablePercent` prescribes the fraction of the level's NominalCL that
@@ -256,6 +265,7 @@ message NonResourcePolicyRule {
   // "*" matches all verbs. If it is present, it must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string verbs = 1;
 
   // `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty.
@@ -268,6 +278,7 @@ message NonResourcePolicyRule {
   // "*" matches all non-resource urls. if it is present, it must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string nonResourceURLs = 6;
 }
 
@@ -281,6 +292,7 @@ message PolicyRulesWithSubjects {
   // A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request.
   // +listType=atomic
   // Required.
+  // +required
   repeated Subject subjects = 1;
 
   // `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the
@@ -298,6 +310,7 @@ message PolicyRulesWithSubjects {
 }
 
 // PriorityLevelConfiguration represents the configuration of a priority level.
+// +k8s:supportsSubresource="/status"
 message PriorityLevelConfiguration {
   // `metadata` is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -306,7 +319,7 @@ message PriorityLevelConfiguration {
 
   // `spec` is the specification of the desired behavior of a "request-priority".
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-  // +optional
+  // +required
   optional PriorityLevelConfigurationSpec spec = 2;
 
   // `status` is the current status of a "request-priority".
@@ -319,20 +332,24 @@ message PriorityLevelConfiguration {
 message PriorityLevelConfigurationCondition {
   // `type` is the type of the condition.
   // Required.
+  // +required
   optional string type = 1;
 
   // `status` is the status of the condition.
-  // Can be True, False, Unknown.
-  // Required.
+  // Should be specified and set to one of True, False, Unknown.
+  // +optional
   optional string status = 2;
 
   // `lastTransitionTime` is the last time the condition transitioned from one status to another.
+  // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3;
 
   // `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+  // +optional
   optional string reason = 4;
 
   // `message` is a human-readable message indicating details about last transition.
+  // +optional
   optional string message = 5;
 }
 
@@ -351,6 +368,7 @@ message PriorityLevelConfigurationList {
 message PriorityLevelConfigurationReference {
   // `name` is the name of the priority level configuration being referenced
   // Required.
+  // +required
   optional string name = 1;
 }
 
@@ -366,17 +384,17 @@ message PriorityLevelConfigurationSpec {
   // _are_ subject to limits and (b) some of the server's limited
   // capacity is made available exclusively to this priority level.
   // Required.
+  // +required
   // +unionDiscriminator
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:discriminator
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
   optional string type = 1;
 
   // `limited` specifies how requests are handled for a Limited priority level.
   // This field must be non-empty if and only if `type` is `"Limited"`.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:forbidden
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:ifMode("Limited")=+k8s:required
   optional LimitedPriorityLevelConfiguration limited = 2;
 
   // `exempt` specifies how requests are handled for an exempt priority level.
@@ -385,9 +403,8 @@ message PriorityLevelConfigurationSpec {
   // If empty and `type` is `"Exempt"` then the default values
   // for `ExemptPriorityLevelConfiguration` apply.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:forbidden
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:ifMode("Exempt")=+k8s:optional
   optional ExemptPriorityLevelConfiguration exempt = 3;
 }
 
@@ -449,12 +466,14 @@ message ResourcePolicyRule {
   // "*" matches all verbs and, if present, must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string verbs = 1;
 
   // `apiGroups` is a list of matching API groups and may not be empty.
   // "*" matches all API groups and, if present, must be the only entry.
   // +listType=set
   // Required.
+  // +required
   repeated string apiGroups = 2;
 
   // `resources` is a list of matching resources (i.e., lowercase
@@ -463,6 +482,7 @@ message ResourcePolicyRule {
   // "*" matches all resources and, if present, must be the only entry.
   // Required.
   // +listType=set
+  // +required
   repeated string resources = 3;
 
   // `clusterScope` indicates whether to match requests that do not
@@ -490,10 +510,12 @@ message ResourcePolicyRule {
 message ServiceAccountSubject {
   // `namespace` is the namespace of matching ServiceAccount objects.
   // Required.
+  // +required
   optional string namespace = 1;
 
   // `name` is the name of matching ServiceAccount objects, or "*" to match regardless of name.
   // Required.
+  // +required
   optional string name = 2;
 }
 
@@ -503,6 +525,7 @@ message ServiceAccountSubject {
 message Subject {
   // `kind` indicates which one of the other fields is non-empty.
   // Required
+  // +required
   // +unionDiscriminator
   optional string kind = 1;
 
@@ -523,6 +546,7 @@ message Subject {
 message UserSubject {
   // `name` is the username that matches, or "*" to match all usernames.
   // Required.
+  // +required
   optional string name = 1;
 }
 
diff --git a/vendor/k8s.io/api/flowcontrol/v1beta3/types.go b/vendor/k8s.io/api/flowcontrol/v1beta3/types.go
index 26b67629ce..cbebca3574 100644
--- a/vendor/k8s.io/api/flowcontrol/v1beta3/types.go
+++ b/vendor/k8s.io/api/flowcontrol/v1beta3/types.go
@@ -125,15 +125,16 @@ const (
 
 // FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with
 // similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
+// +k8s:supportsSubresource="/status"
 type FlowSchema struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	// `spec` is the specification of the desired behavior of a FlowSchema.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-	// +optional
+	// +required
 	Spec FlowSchemaSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 	// `status` is the current status of a FlowSchema.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
@@ -147,7 +148,7 @@ type FlowSchema struct {
 
 // FlowSchemaList is a list of FlowSchema objects.
 type FlowSchemaList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -162,6 +163,7 @@ type FlowSchemaSpec struct {
 	// `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot
 	// be resolved, the FlowSchema will be ignored and marked as invalid in its status.
 	// Required.
+	// +required
 	PriorityLevelConfiguration PriorityLevelConfigurationReference `json:"priorityLevelConfiguration" protobuf:"bytes,1,opt,name=priorityLevelConfiguration"`
 	// `matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen
 	// FlowSchema is among those with the numerically lowest (which we take to be logically highest)
@@ -203,6 +205,7 @@ type FlowDistinguisherMethod struct {
 	// `type` is the type of flow distinguisher method
 	// The supported types are "ByUser" and "ByNamespace".
 	// Required.
+	// +required
 	Type FlowDistinguisherMethodType `json:"type" protobuf:"bytes,1,opt,name=type"`
 }
 
@@ -210,6 +213,7 @@ type FlowDistinguisherMethod struct {
 type PriorityLevelConfigurationReference struct {
 	// `name` is the name of the priority level configuration being referenced
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 }
 
@@ -223,6 +227,7 @@ type PolicyRulesWithSubjects struct {
 	// A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request.
 	// +listType=atomic
 	// Required.
+	// +required
 	Subjects []Subject `json:"subjects" protobuf:"bytes,1,rep,name=subjects"`
 	// `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the
 	// target resource.
@@ -243,6 +248,7 @@ type PolicyRulesWithSubjects struct {
 type Subject struct {
 	// `kind` indicates which one of the other fields is non-empty.
 	// Required
+	// +required
 	// +unionDiscriminator
 	Kind SubjectKind `json:"kind" protobuf:"bytes,1,opt,name=kind"`
 	// `user` matches based on username.
@@ -270,6 +276,7 @@ const (
 type UserSubject struct {
 	// `name` is the username that matches, or "*" to match all usernames.
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 }
 
@@ -279,6 +286,7 @@ type GroupSubject struct {
 	// See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
 	// well-known group names.
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 }
 
@@ -286,9 +294,11 @@ type GroupSubject struct {
 type ServiceAccountSubject struct {
 	// `namespace` is the namespace of matching ServiceAccount objects.
 	// Required.
+	// +required
 	Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"`
 	// `name` is the name of matching ServiceAccount objects, or "*" to match regardless of name.
 	// Required.
+	// +required
 	Name string `json:"name" protobuf:"bytes,2,opt,name=name"`
 }
 
@@ -306,12 +316,14 @@ type ResourcePolicyRule struct {
 	// "*" matches all verbs and, if present, must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
 
 	// `apiGroups` is a list of matching API groups and may not be empty.
 	// "*" matches all API groups and, if present, must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	APIGroups []string `json:"apiGroups" protobuf:"bytes,2,rep,name=apiGroups"`
 
 	// `resources` is a list of matching resources (i.e., lowercase
@@ -320,6 +332,7 @@ type ResourcePolicyRule struct {
 	// "*" matches all resources and, if present, must be the only entry.
 	// Required.
 	// +listType=set
+	// +required
 	Resources []string `json:"resources" protobuf:"bytes,3,rep,name=resources"`
 
 	// `clusterScope` indicates whether to match requests that do not
@@ -351,6 +364,7 @@ type NonResourcePolicyRule struct {
 	// "*" matches all verbs. If it is present, it must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
 	// `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty.
 	// For example:
@@ -362,6 +376,7 @@ type NonResourcePolicyRule struct {
 	// "*" matches all non-resource urls. if it is present, it must be the only entry.
 	// +listType=set
 	// Required.
+	// +required
 	NonResourceURLs []string `json:"nonResourceURLs" protobuf:"bytes,6,rep,name=nonResourceURLs"`
 }
 
@@ -380,16 +395,20 @@ type FlowSchemaStatus struct {
 type FlowSchemaCondition struct {
 	// `type` is the type of the condition.
 	// Required.
+	// +required
 	Type FlowSchemaConditionType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
+	// +optional
 	Status ConditionStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
+	// +optional
 	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,3,opt,name=lastTransitionTime"`
 	// `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+	// +optional
 	Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 	// `message` is a human-readable message indicating details about last transition.
+	// +optional
 	Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
 }
 
@@ -403,15 +422,16 @@ type FlowSchemaConditionType string
 // +k8s:prerelease-lifecycle-gen:replacement=flowcontrol.apiserver.k8s.io,v1,PriorityLevelConfiguration
 
 // PriorityLevelConfiguration represents the configuration of a priority level.
+// +k8s:supportsSubresource="/status"
 type PriorityLevelConfiguration struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 	// `spec` is the specification of the desired behavior of a "request-priority".
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-	// +optional
+	// +required
 	Spec PriorityLevelConfigurationSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
 	// `status` is the current status of a "request-priority".
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
@@ -425,7 +445,7 @@ type PriorityLevelConfiguration struct {
 
 // PriorityLevelConfigurationList is a list of PriorityLevelConfiguration objects.
 type PriorityLevelConfigurationList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -446,17 +466,17 @@ type PriorityLevelConfigurationSpec struct {
 	// _are_ subject to limits and (b) some of the server's limited
 	// capacity is made available exclusively to this priority level.
 	// Required.
+	// +required
 	// +unionDiscriminator
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:discriminator
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
 	Type PriorityLevelEnablement `json:"type" protobuf:"bytes,1,opt,name=type"`
 
 	// `limited` specifies how requests are handled for a Limited priority level.
 	// This field must be non-empty if and only if `type` is `"Limited"`.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:forbidden
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:ifMode("Limited")=+k8s:required
 	Limited *LimitedPriorityLevelConfiguration `json:"limited,omitempty" protobuf:"bytes,2,opt,name=limited"`
 
 	// `exempt` specifies how requests are handled for an exempt priority level.
@@ -465,9 +485,8 @@ type PriorityLevelConfigurationSpec struct {
 	// If empty and `type` is `"Exempt"` then the default values
 	// for `ExemptPriorityLevelConfiguration` apply.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Exempt")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Limited")=+k8s:forbidden
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:ifMode("Exempt")=+k8s:optional
 	Exempt *ExemptPriorityLevelConfiguration `json:"exempt,omitempty" protobuf:"bytes,3,opt,name=exempt"`
 }
 
@@ -507,6 +526,7 @@ type LimitedPriorityLevelConfiguration struct {
 	NominalConcurrencyShares int32 `json:"nominalConcurrencyShares" protobuf:"varint,1,opt,name=nominalConcurrencyShares"`
 
 	// `limitResponse` indicates what to do with requests that can not be executed right now
+	// +required
 	LimitResponse LimitResponse `json:"limitResponse,omitempty" protobuf:"bytes,2,opt,name=limitResponse"`
 
 	// `lendablePercent` prescribes the fraction of the level's NominalCL that
@@ -586,17 +606,17 @@ type LimitResponse struct {
 	// "Reject" means that requests that can not be executed upon arrival
 	// are rejected.
 	// Required.
+	// +required
 	// +unionDiscriminator
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:discriminator
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:modeDiscriminator
 	Type LimitResponseType `json:"type" protobuf:"bytes,1,opt,name=type"`
 
 	// `queuing` holds the configuration parameters for queuing.
 	// This field may be non-empty only if `type` is `"Queue"`.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:member("Queue")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:member("Reject")=+k8s:forbidden
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:ifMode("Queue")=+k8s:required
 	Queuing *QueuingConfiguration `json:"queuing,omitempty" protobuf:"bytes,2,opt,name=queuing"`
 }
 
@@ -663,16 +683,20 @@ type PriorityLevelConfigurationStatus struct {
 type PriorityLevelConfigurationCondition struct {
 	// `type` is the type of the condition.
 	// Required.
+	// +required
 	Type PriorityLevelConfigurationConditionType `json:"type,omitempty" protobuf:"bytes,1,opt,name=type"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
+	// +optional
 	Status ConditionStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
+	// +optional
 	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,3,opt,name=lastTransitionTime"`
 	// `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
+	// +optional
 	Reason string `json:"reason,omitempty" protobuf:"bytes,4,opt,name=reason"`
 	// `message` is a human-readable message indicating details about last transition.
+	// +optional
 	Message string `json:"message,omitempty" protobuf:"bytes,5,opt,name=message"`
 }
 
diff --git a/vendor/k8s.io/api/flowcontrol/v1beta3/types_swagger_doc_generated.go b/vendor/k8s.io/api/flowcontrol/v1beta3/types_swagger_doc_generated.go
index fa76112a72..c799e5d8d7 100644
--- a/vendor/k8s.io/api/flowcontrol/v1beta3/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/flowcontrol/v1beta3/types_swagger_doc_generated.go
@@ -60,7 +60,7 @@ func (FlowSchema) SwaggerDoc() map[string]string {
 var map_FlowSchemaCondition = map[string]string{
 	"":                   "FlowSchemaCondition describes conditions for a FlowSchema.",
 	"type":               "`type` is the type of the condition. Required.",
-	"status":             "`status` is the status of the condition. Can be True, False, Unknown. Required.",
+	"status":             "`status` is the status of the condition. Should be specified and set to one of True, False, Unknown.",
 	"lastTransitionTime": "`lastTransitionTime` is the last time the condition transitioned from one status to another.",
 	"reason":             "`reason` is a unique, one-word, CamelCase reason for the condition's last transition.",
 	"message":            "`message` is a human-readable message indicating details about last transition.",
@@ -167,7 +167,7 @@ func (PriorityLevelConfiguration) SwaggerDoc() map[string]string {
 var map_PriorityLevelConfigurationCondition = map[string]string{
 	"":                   "PriorityLevelConfigurationCondition defines the condition of priority level.",
 	"type":               "`type` is the type of the condition. Required.",
-	"status":             "`status` is the status of the condition. Can be True, False, Unknown. Required.",
+	"status":             "`status` is the status of the condition. Should be specified and set to one of True, False, Unknown.",
 	"lastTransitionTime": "`lastTransitionTime` is the last time the condition transitioned from one status to another.",
 	"reason":             "`reason` is a unique, one-word, CamelCase reason for the condition's last transition.",
 	"message":            "`message` is a human-readable message indicating details about last transition.",
diff --git a/vendor/k8s.io/api/imagepolicy/v1alpha1/generated.proto b/vendor/k8s.io/api/imagepolicy/v1alpha1/generated.proto
index 03b1ac45c0..b9cd53b108 100644
--- a/vendor/k8s.io/api/imagepolicy/v1alpha1/generated.proto
+++ b/vendor/k8s.io/api/imagepolicy/v1alpha1/generated.proto
@@ -29,59 +29,61 @@ import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
 option go_package = "k8s.io/api/imagepolicy/v1alpha1";
 
 // ImageReview checks if the set of images in a pod are allowed.
+// +k8s:supportsSubresource="/status"
 message ImageReview {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Spec holds information about the pod being evaluated
+  // spec holds information about the pod being evaluated
   // +optional
   optional ImageReviewSpec spec = 2;
 
-  // Status is filled in by the backend and indicates whether the pod should be allowed.
+  // status is filled in by the backend and indicates whether the pod should be allowed.
   // +optional
   optional ImageReviewStatus status = 3;
 }
 
 // ImageReviewContainerSpec is a description of a container within the pod creation request.
 message ImageReviewContainerSpec {
-  // This can be in the form image:tag or image@SHA:012345679abcdef.
+  // image can be in the form image:tag or image@SHA:012345679abcdef.
   // +optional
   optional string image = 1;
 }
 
 // ImageReviewSpec is a description of the pod creation request.
 message ImageReviewSpec {
-  // Containers is a list of a subset of the information in each container of the Pod being created.
+  // containers is a list of a subset of the information in each container of the Pod being created.
   // +optional
   // +listType=atomic
   repeated ImageReviewContainerSpec containers = 1;
 
-  // Annotations is a list of key-value pairs extracted from the Pod's annotations.
+  // annotations is a list of key-value pairs extracted from the Pod's annotations.
   // It only includes keys which match the pattern `*.image-policy.k8s.io/*`.
   // It is up to each webhook backend to determine how to interpret these annotations, if at all.
   // +optional
   map<string, string> annotations = 2;
 
-  // Namespace is the namespace the pod is being created in.
+  // namespace is the namespace the pod is being created in.
   // +optional
   optional string namespace = 3;
 }
 
 // ImageReviewStatus is the result of the review for the pod creation request.
 message ImageReviewStatus {
-  // Allowed indicates that all images were allowed to be run.
+  // allowed indicates that all images were allowed to be run.
   // +optional
   optional bool allowed = 1;
 
-  // Reason should be empty unless Allowed is false in which case it
+  // reason should be empty unless Allowed is false in which case it
   // may contain a short description of what is wrong.  Kubernetes
   // may truncate excessively long errors when displaying to the user.
   // +optional
   optional string reason = 2;
 
-  // AuditAnnotations will be added to the attributes object of the
+  // auditAnnotations will be added to the attributes object of the
   // admission controller request using 'AddAnnotation'.  The keys should
   // be prefix-less (i.e., the admission controller will add an
   // appropriate prefix).
diff --git a/vendor/k8s.io/api/imagepolicy/v1alpha1/types.go b/vendor/k8s.io/api/imagepolicy/v1alpha1/types.go
index cc8f4cf89f..9807c17534 100644
--- a/vendor/k8s.io/api/imagepolicy/v1alpha1/types.go
+++ b/vendor/k8s.io/api/imagepolicy/v1alpha1/types.go
@@ -26,41 +26,43 @@ import (
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
 // ImageReview checks if the set of images in a pod are allowed.
+// +k8s:supportsSubresource="/status"
 type ImageReview struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Spec holds information about the pod being evaluated
+	// spec holds information about the pod being evaluated
 	// +optional
 	Spec ImageReviewSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
 
-	// Status is filled in by the backend and indicates whether the pod should be allowed.
+	// status is filled in by the backend and indicates whether the pod should be allowed.
 	// +optional
 	Status ImageReviewStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
 }
 
 // ImageReviewSpec is a description of the pod creation request.
 type ImageReviewSpec struct {
-	// Containers is a list of a subset of the information in each container of the Pod being created.
+	// containers is a list of a subset of the information in each container of the Pod being created.
 	// +optional
 	// +listType=atomic
 	Containers []ImageReviewContainerSpec `json:"containers,omitempty" protobuf:"bytes,1,rep,name=containers"`
-	// Annotations is a list of key-value pairs extracted from the Pod's annotations.
+	// annotations is a list of key-value pairs extracted from the Pod's annotations.
 	// It only includes keys which match the pattern `*.image-policy.k8s.io/*`.
 	// It is up to each webhook backend to determine how to interpret these annotations, if at all.
 	// +optional
 	Annotations map[string]string `json:"annotations,omitempty" protobuf:"bytes,2,rep,name=annotations"`
-	// Namespace is the namespace the pod is being created in.
+	// namespace is the namespace the pod is being created in.
 	// +optional
 	Namespace string `json:"namespace,omitempty" protobuf:"bytes,3,opt,name=namespace"`
 }
 
 // ImageReviewContainerSpec is a description of a container within the pod creation request.
 type ImageReviewContainerSpec struct {
-	// This can be in the form image:tag or image@SHA:012345679abcdef.
+	// image can be in the form image:tag or image@SHA:012345679abcdef.
 	// +optional
 	Image string `json:"image,omitempty" protobuf:"bytes,1,opt,name=image"`
 	// In future, we may add command line overrides, exec health check command lines, and so on.
@@ -68,15 +70,15 @@ type ImageReviewContainerSpec struct {
 
 // ImageReviewStatus is the result of the review for the pod creation request.
 type ImageReviewStatus struct {
-	// Allowed indicates that all images were allowed to be run.
+	// allowed indicates that all images were allowed to be run.
 	// +optional
 	Allowed bool `json:"allowed" protobuf:"varint,1,opt,name=allowed"`
-	// Reason should be empty unless Allowed is false in which case it
+	// reason should be empty unless Allowed is false in which case it
 	// may contain a short description of what is wrong.  Kubernetes
 	// may truncate excessively long errors when displaying to the user.
 	// +optional
 	Reason string `json:"reason,omitempty" protobuf:"bytes,2,opt,name=reason"`
-	// AuditAnnotations will be added to the attributes object of the
+	// auditAnnotations will be added to the attributes object of the
 	// admission controller request using 'AddAnnotation'.  The keys should
 	// be prefix-less (i.e., the admission controller will add an
 	// appropriate prefix).
diff --git a/vendor/k8s.io/api/imagepolicy/v1alpha1/types_swagger_doc_generated.go b/vendor/k8s.io/api/imagepolicy/v1alpha1/types_swagger_doc_generated.go
index dadf95e1d5..802b79ba7a 100644
--- a/vendor/k8s.io/api/imagepolicy/v1alpha1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/imagepolicy/v1alpha1/types_swagger_doc_generated.go
@@ -29,9 +29,9 @@ package v1alpha1
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_ImageReview = map[string]string{
 	"":         "ImageReview checks if the set of images in a pod are allowed.",
-	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
-	"spec":     "Spec holds information about the pod being evaluated",
-	"status":   "Status is filled in by the backend and indicates whether the pod should be allowed.",
+	"metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"spec":     "spec holds information about the pod being evaluated",
+	"status":   "status is filled in by the backend and indicates whether the pod should be allowed.",
 }
 
 func (ImageReview) SwaggerDoc() map[string]string {
@@ -40,7 +40,7 @@ func (ImageReview) SwaggerDoc() map[string]string {
 
 var map_ImageReviewContainerSpec = map[string]string{
 	"":      "ImageReviewContainerSpec is a description of a container within the pod creation request.",
-	"image": "This can be in the form image:tag or image@SHA:012345679abcdef.",
+	"image": "image can be in the form image:tag or image@SHA:012345679abcdef.",
 }
 
 func (ImageReviewContainerSpec) SwaggerDoc() map[string]string {
@@ -49,9 +49,9 @@ func (ImageReviewContainerSpec) SwaggerDoc() map[string]string {
 
 var map_ImageReviewSpec = map[string]string{
 	"":            "ImageReviewSpec is a description of the pod creation request.",
-	"containers":  "Containers is a list of a subset of the information in each container of the Pod being created.",
-	"annotations": "Annotations is a list of key-value pairs extracted from the Pod's annotations. It only includes keys which match the pattern `*.image-policy.k8s.io/*`. It is up to each webhook backend to determine how to interpret these annotations, if at all.",
-	"namespace":   "Namespace is the namespace the pod is being created in.",
+	"containers":  "containers is a list of a subset of the information in each container of the Pod being created.",
+	"annotations": "annotations is a list of key-value pairs extracted from the Pod's annotations. It only includes keys which match the pattern `*.image-policy.k8s.io/*`. It is up to each webhook backend to determine how to interpret these annotations, if at all.",
+	"namespace":   "namespace is the namespace the pod is being created in.",
 }
 
 func (ImageReviewSpec) SwaggerDoc() map[string]string {
@@ -60,9 +60,9 @@ func (ImageReviewSpec) SwaggerDoc() map[string]string {
 
 var map_ImageReviewStatus = map[string]string{
 	"":                 "ImageReviewStatus is the result of the review for the pod creation request.",
-	"allowed":          "Allowed indicates that all images were allowed to be run.",
-	"reason":           "Reason should be empty unless Allowed is false in which case it may contain a short description of what is wrong.  Kubernetes may truncate excessively long errors when displaying to the user.",
-	"auditAnnotations": "AuditAnnotations will be added to the attributes object of the admission controller request using 'AddAnnotation'.  The keys should be prefix-less (i.e., the admission controller will add an appropriate prefix).",
+	"allowed":          "allowed indicates that all images were allowed to be run.",
+	"reason":           "reason should be empty unless Allowed is false in which case it may contain a short description of what is wrong.  Kubernetes may truncate excessively long errors when displaying to the user.",
+	"auditAnnotations": "auditAnnotations will be added to the attributes object of the admission controller request using 'AddAnnotation'.  The keys should be prefix-less (i.e., the admission controller will add an appropriate prefix).",
 }
 
 func (ImageReviewStatus) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/scheduling/v1alpha2/doc.go b/vendor/k8s.io/api/lifecycle/v1alpha1/doc.go
similarity index 81%
rename from vendor/k8s.io/api/scheduling/v1alpha2/doc.go
rename to vendor/k8s.io/api/lifecycle/v1alpha1/doc.go
index 24ba23e72c..b8ccba674d 100644
--- a/vendor/k8s.io/api/scheduling/v1alpha2/doc.go
+++ b/vendor/k8s.io/api/lifecycle/v1alpha1/doc.go
@@ -17,8 +17,9 @@ limitations under the License.
 // +k8s:deepcopy-gen=package
 // +k8s:protobuf-gen=package
 // +k8s:openapi-gen=true
-// +k8s:openapi-model-package=io.k8s.api.scheduling.v1alpha2
+// +k8s:prerelease-lifecycle-gen=true
+// +k8s:openapi-model-package=io.k8s.api.lifecycle.v1alpha1
 
-// +groupName=scheduling.k8s.io
+// +groupName=lifecycle.k8s.io
 
-package v1alpha2
+package v1alpha1
diff --git a/vendor/k8s.io/api/scheduling/v1alpha2/generated.pb.go b/vendor/k8s.io/api/lifecycle/v1alpha1/generated.pb.go
similarity index 61%
rename from vendor/k8s.io/api/scheduling/v1alpha2/generated.pb.go
rename to vendor/k8s.io/api/lifecycle/v1alpha1/generated.pb.go
index 12402df3d2..f8835cc6a7 100644
--- a/vendor/k8s.io/api/scheduling/v1alpha2/generated.pb.go
+++ b/vendor/k8s.io/api/lifecycle/v1alpha1/generated.pb.go
@@ -15,9 +15,9 @@ limitations under the License.
 */
 
 // Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: k8s.io/api/scheduling/v1alpha2/generated.proto
+// source: k8s.io/api/lifecycle/v1alpha1/generated.proto
 
-package v1alpha2
+package v1alpha1
 
 import (
 	fmt "fmt"
@@ -29,45 +29,94 @@ import (
 	math_bits "math/bits"
 	reflect "reflect"
 	strings "strings"
+
+	k8s_io_apimachinery_pkg_types "k8s.io/apimachinery/pkg/types"
 )
 
-func (m *BasicSchedulingPolicy) Reset() { *m = BasicSchedulingPolicy{} }
+func (m *Eviction) Reset() { *m = Eviction{} }
 
-func (m *GangSchedulingPolicy) Reset() { *m = GangSchedulingPolicy{} }
+func (m *EvictionList) Reset() { *m = EvictionList{} }
 
-func (m *PodGroup) Reset() { *m = PodGroup{} }
+func (m *EvictionPodReference) Reset() { *m = EvictionPodReference{} }
 
-func (m *PodGroupList) Reset() { *m = PodGroupList{} }
+func (m *EvictionRequest) Reset() { *m = EvictionRequest{} }
 
-func (m *PodGroupResourceClaim) Reset() { *m = PodGroupResourceClaim{} }
+func (m *EvictionRequestList) Reset() { *m = EvictionRequestList{} }
 
-func (m *PodGroupResourceClaimStatus) Reset() { *m = PodGroupResourceClaimStatus{} }
+func (m *EvictionRequestPodReference) Reset() { *m = EvictionRequestPodReference{} }
 
-func (m *PodGroupSchedulingConstraints) Reset() { *m = PodGroupSchedulingConstraints{} }
+func (m *EvictionRequestSpec) Reset() { *m = EvictionRequestSpec{} }
 
-func (m *PodGroupSchedulingPolicy) Reset() { *m = PodGroupSchedulingPolicy{} }
+func (m *EvictionRequestStatus) Reset() { *m = EvictionRequestStatus{} }
 
-func (m *PodGroupSpec) Reset() { *m = PodGroupSpec{} }
+func (m *EvictionRequestTarget) Reset() { *m = EvictionRequestTarget{} }
 
-func (m *PodGroupStatus) Reset() { *m = PodGroupStatus{} }
+func (m *EvictionSpec) Reset() { *m = EvictionSpec{} }
 
-func (m *PodGroupTemplate) Reset() { *m = PodGroupTemplate{} }
+func (m *EvictionStatus) Reset() { *m = EvictionStatus{} }
 
-func (m *PodGroupTemplateReference) Reset() { *m = PodGroupTemplateReference{} }
+func (m *EvictionTarget) Reset() { *m = EvictionTarget{} }
 
-func (m *TopologyConstraint) Reset() { *m = TopologyConstraint{} }
+func (m *Requester) Reset() { *m = Requester{} }
 
-func (m *TypedLocalObjectReference) Reset() { *m = TypedLocalObjectReference{} }
+func (m *ResponderStatus) Reset() { *m = ResponderStatus{} }
 
-func (m *Workload) Reset() { *m = Workload{} }
+func (m *TargetResponder) Reset() { *m = TargetResponder{} }
 
-func (m *WorkloadList) Reset() { *m = WorkloadList{} }
+func (m *Eviction) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
 
-func (m *WorkloadPodGroupTemplateReference) Reset() { *m = WorkloadPodGroupTemplateReference{} }
+func (m *Eviction) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
 
-func (m *WorkloadSpec) Reset() { *m = WorkloadSpec{} }
+func (m *Eviction) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
 
-func (m *BasicSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+func (m *EvictionList) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -77,20 +126,44 @@ func (m *BasicSchedulingPolicy) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *BasicSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+func (m *EvictionList) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *BasicSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *EvictionList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *GangSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+func (m *EvictionPodReference) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -100,23 +173,30 @@ func (m *GangSchedulingPolicy) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *GangSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+func (m *EvictionPodReference) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *GangSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *EvictionPodReference) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	i = encodeVarintGenerated(dAtA, i, uint64(m.MinCount))
+	i -= len(m.UID)
+	copy(dAtA[i:], m.UID)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.UID)))
 	i--
-	dAtA[i] = 0x8
+	dAtA[i] = 0x12
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *PodGroup) Marshal() (dAtA []byte, err error) {
+func (m *EvictionRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -126,12 +206,12 @@ func (m *PodGroup) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PodGroup) MarshalTo(dAtA []byte) (int, error) {
+func (m *EvictionRequest) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PodGroup) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *EvictionRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -169,7 +249,7 @@ func (m *PodGroup) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *PodGroupList) Marshal() (dAtA []byte, err error) {
+func (m *EvictionRequestList) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -179,12 +259,12 @@ func (m *PodGroupList) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PodGroupList) MarshalTo(dAtA []byte) (int, error) {
+func (m *EvictionRequestList) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PodGroupList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *EvictionRequestList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
@@ -216,7 +296,7 @@ func (m *PodGroupList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *PodGroupResourceClaim) Marshal() (dAtA []byte, err error) {
+func (m *EvictionRequestPodReference) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -226,30 +306,21 @@ func (m *PodGroupResourceClaim) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PodGroupResourceClaim) MarshalTo(dAtA []byte) (int, error) {
+func (m *EvictionRequestPodReference) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PodGroupResourceClaim) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *EvictionRequestPodReference) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if m.ResourceClaimTemplateName != nil {
-		i -= len(*m.ResourceClaimTemplateName)
-		copy(dAtA[i:], *m.ResourceClaimTemplateName)
-		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ResourceClaimTemplateName)))
-		i--
-		dAtA[i] = 0x1a
-	}
-	if m.ResourceClaimName != nil {
-		i -= len(*m.ResourceClaimName)
-		copy(dAtA[i:], *m.ResourceClaimName)
-		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ResourceClaimName)))
-		i--
-		dAtA[i] = 0x12
-	}
+	i -= len(m.UID)
+	copy(dAtA[i:], m.UID)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.UID)))
+	i--
+	dAtA[i] = 0x12
 	i -= len(m.Name)
 	copy(dAtA[i:], m.Name)
 	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
@@ -258,7 +329,7 @@ func (m *PodGroupResourceClaim) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *PodGroupResourceClaimStatus) Marshal() (dAtA []byte, err error) {
+func (m *EvictionRequestSpec) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -268,32 +339,40 @@ func (m *PodGroupResourceClaimStatus) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PodGroupResourceClaimStatus) MarshalTo(dAtA []byte) (int, error) {
+func (m *EvictionRequestSpec) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PodGroupResourceClaimStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *EvictionRequestSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if m.ResourceClaimName != nil {
-		i -= len(*m.ResourceClaimName)
-		copy(dAtA[i:], *m.ResourceClaimName)
-		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ResourceClaimName)))
-		i--
-		dAtA[i] = 0x12
+	i -= len(m.Intent)
+	copy(dAtA[i:], m.Intent)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Intent)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Requester)
+	copy(dAtA[i:], m.Requester)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Requester)))
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.Target.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	i -= len(m.Name)
-	copy(dAtA[i:], m.Name)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
 	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *PodGroupSchedulingConstraints) Marshal() (dAtA []byte, err error) {
+func (m *EvictionRequestStatus) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -303,20 +382,25 @@ func (m *PodGroupSchedulingConstraints) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PodGroupSchedulingConstraints) MarshalTo(dAtA []byte) (int, error) {
+func (m *EvictionRequestStatus) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PodGroupSchedulingConstraints) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *EvictionRequestStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if len(m.Topology) > 0 {
-		for iNdEx := len(m.Topology) - 1; iNdEx >= 0; iNdEx-- {
+	if m.ObservedGeneration != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.ObservedGeneration))
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.Conditions) > 0 {
+		for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- {
 			{
-				size, err := m.Topology[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
 				if err != nil {
 					return 0, err
 				}
@@ -330,7 +414,7 @@ func (m *PodGroupSchedulingConstraints) MarshalToSizedBuffer(dAtA []byte) (int,
 	return len(dAtA) - i, nil
 }
 
-func (m *PodGroupSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+func (m *EvictionRequestTarget) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -340,31 +424,19 @@ func (m *PodGroupSchedulingPolicy) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PodGroupSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+func (m *EvictionRequestTarget) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PodGroupSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *EvictionRequestTarget) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if m.Gang != nil {
-		{
-			size, err := m.Gang.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintGenerated(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x12
-	}
-	if m.Basic != nil {
+	if m.Pod != nil {
 		{
-			size, err := m.Basic.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.Pod.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -377,7 +449,7 @@ func (m *PodGroupSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error
 	return len(dAtA) - i, nil
 }
 
-func (m *PodGroupSpec) Marshal() (dAtA []byte, err error) {
+func (m *EvictionSpec) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -387,61 +459,18 @@ func (m *PodGroupSpec) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PodGroupSpec) MarshalTo(dAtA []byte) (int, error) {
+func (m *EvictionSpec) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PodGroupSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *EvictionSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if m.Priority != nil {
-		i = encodeVarintGenerated(dAtA, i, uint64(*m.Priority))
-		i--
-		dAtA[i] = 0x38
-	}
-	i -= len(m.PriorityClassName)
-	copy(dAtA[i:], m.PriorityClassName)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.PriorityClassName)))
-	i--
-	dAtA[i] = 0x32
-	if m.DisruptionMode != nil {
-		i -= len(*m.DisruptionMode)
-		copy(dAtA[i:], *m.DisruptionMode)
-		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.DisruptionMode)))
-		i--
-		dAtA[i] = 0x2a
-	}
-	if len(m.ResourceClaims) > 0 {
-		for iNdEx := len(m.ResourceClaims) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.ResourceClaims[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintGenerated(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x22
-		}
-	}
-	if m.SchedulingConstraints != nil {
-		{
-			size, err := m.SchedulingConstraints.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintGenerated(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x1a
-	}
 	{
-		size, err := m.SchedulingPolicy.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Target.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -449,23 +478,11 @@ func (m *PodGroupSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
 	i--
-	dAtA[i] = 0x12
-	if m.PodGroupTemplateRef != nil {
-		{
-			size, err := m.PodGroupTemplateRef.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintGenerated(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0xa
-	}
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *PodGroupStatus) Marshal() (dAtA []byte, err error) {
+func (m *EvictionStatus) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -475,20 +492,20 @@ func (m *PodGroupStatus) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PodGroupStatus) MarshalTo(dAtA []byte) (int, error) {
+func (m *EvictionStatus) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PodGroupStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *EvictionStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if len(m.ResourceClaimStatuses) > 0 {
-		for iNdEx := len(m.ResourceClaimStatuses) - 1; iNdEx >= 0; iNdEx-- {
+	if len(m.Responders) > 0 {
+		for iNdEx := len(m.Responders) - 1; iNdEx >= 0; iNdEx-- {
 			{
-				size, err := m.ResourceClaimStatuses[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				size, err := m.Responders[iNdEx].MarshalToSizedBuffer(dAtA[:i])
 				if err != nil {
 					return 0, err
 				}
@@ -496,13 +513,13 @@ func (m *PodGroupStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 				i = encodeVarintGenerated(dAtA, i, uint64(size))
 			}
 			i--
-			dAtA[i] = 0x12
+			dAtA[i] = 0x2a
 		}
 	}
-	if len(m.Conditions) > 0 {
-		for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- {
+	if len(m.TargetResponders) > 0 {
+		for iNdEx := len(m.TargetResponders) - 1; iNdEx >= 0; iNdEx-- {
 			{
-				size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				size, err := m.TargetResponders[iNdEx].MarshalToSizedBuffer(dAtA[:i])
 				if err != nil {
 					return 0, err
 				}
@@ -510,53 +527,13 @@ func (m *PodGroupStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 				i = encodeVarintGenerated(dAtA, i, uint64(size))
 			}
 			i--
-			dAtA[i] = 0xa
+			dAtA[i] = 0x22
 		}
 	}
-	return len(dAtA) - i, nil
-}
-
-func (m *PodGroupTemplate) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *PodGroupTemplate) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *PodGroupTemplate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.Priority != nil {
-		i = encodeVarintGenerated(dAtA, i, uint64(*m.Priority))
-		i--
-		dAtA[i] = 0x38
-	}
-	i -= len(m.PriorityClassName)
-	copy(dAtA[i:], m.PriorityClassName)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.PriorityClassName)))
-	i--
-	dAtA[i] = 0x32
-	if m.DisruptionMode != nil {
-		i -= len(*m.DisruptionMode)
-		copy(dAtA[i:], *m.DisruptionMode)
-		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.DisruptionMode)))
-		i--
-		dAtA[i] = 0x2a
-	}
-	if len(m.ResourceClaims) > 0 {
-		for iNdEx := len(m.ResourceClaims) - 1; iNdEx >= 0; iNdEx-- {
+	if len(m.Requesters) > 0 {
+		for iNdEx := len(m.Requesters) - 1; iNdEx >= 0; iNdEx-- {
 			{
-				size, err := m.ResourceClaims[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				size, err := m.Requesters[iNdEx].MarshalToSizedBuffer(dAtA[:i])
 				if err != nil {
 					return 0, err
 				}
@@ -564,40 +541,32 @@ func (m *PodGroupTemplate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 				i = encodeVarintGenerated(dAtA, i, uint64(size))
 			}
 			i--
-			dAtA[i] = 0x22
+			dAtA[i] = 0x1a
 		}
 	}
-	if m.SchedulingConstraints != nil {
-		{
-			size, err := m.SchedulingConstraints.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintGenerated(dAtA, i, uint64(size))
-		}
+	if m.ObservedGeneration != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.ObservedGeneration))
 		i--
-		dAtA[i] = 0x1a
+		dAtA[i] = 0x10
 	}
-	{
-		size, err := m.SchedulingPolicy.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if len(m.Conditions) > 0 {
+		for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
 		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	i--
-	dAtA[i] = 0x12
-	i -= len(m.Name)
-	copy(dAtA[i:], m.Name)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *PodGroupTemplateReference) Marshal() (dAtA []byte, err error) {
+func (m *EvictionTarget) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -607,19 +576,19 @@ func (m *PodGroupTemplateReference) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PodGroupTemplateReference) MarshalTo(dAtA []byte) (int, error) {
+func (m *EvictionTarget) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PodGroupTemplateReference) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *EvictionTarget) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if m.Workload != nil {
+	if m.Pod != nil {
 		{
-			size, err := m.Workload.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.Pod.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -632,7 +601,7 @@ func (m *PodGroupTemplateReference) MarshalToSizedBuffer(dAtA []byte) (int, erro
 	return len(dAtA) - i, nil
 }
 
-func (m *TopologyConstraint) Marshal() (dAtA []byte, err error) {
+func (m *Requester) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -642,63 +611,30 @@ func (m *TopologyConstraint) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *TopologyConstraint) MarshalTo(dAtA []byte) (int, error) {
+func (m *Requester) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *TopologyConstraint) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *Requester) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	i -= len(m.Key)
-	copy(dAtA[i:], m.Key)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Key)))
+	i -= len(m.Intent)
+	copy(dAtA[i:], m.Intent)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Intent)))
 	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
-func (m *TypedLocalObjectReference) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *TypedLocalObjectReference) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *TypedLocalObjectReference) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
+	dAtA[i] = 0x12
 	i -= len(m.Name)
 	copy(dAtA[i:], m.Name)
 	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
 	i--
-	dAtA[i] = 0x1a
-	i -= len(m.Kind)
-	copy(dAtA[i:], m.Kind)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
-	i--
-	dAtA[i] = 0x12
-	i -= len(m.APIGroup)
-	copy(dAtA[i:], m.APIGroup)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.APIGroup)))
-	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *Workload) Marshal() (dAtA []byte, err error) {
+func (m *ResponderStatus) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -708,87 +644,80 @@ func (m *Workload) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *Workload) MarshalTo(dAtA []byte) (int, error) {
+func (m *ResponderStatus) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *Workload) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ResponderStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	{
-		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	if m.Message != nil {
+		i -= len(*m.Message)
+		copy(dAtA[i:], *m.Message)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.Message)))
+		i--
+		dAtA[i] = 0x32
 	}
-	i--
-	dAtA[i] = 0x12
-	{
-		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if m.CompletionTime != nil {
+		{
+			size, err := m.CompletionTime.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
 		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x2a
 	}
-	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
-func (m *WorkloadList) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
+	if m.ExpectedCompletionTime != nil {
+		{
+			size, err := m.ExpectedCompletionTime.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
 	}
-	return dAtA[:n], nil
-}
-
-func (m *WorkloadList) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *WorkloadList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if len(m.Items) > 0 {
-		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintGenerated(dAtA, i, uint64(size))
+	if m.HeartbeatTime != nil {
+		{
+			size, err := m.HeartbeatTime.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
 			}
-			i--
-			dAtA[i] = 0x12
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
 		}
+		i--
+		dAtA[i] = 0x1a
 	}
-	{
-		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if m.StartTime != nil {
+		{
+			size, err := m.StartTime.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
 		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
 	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
 	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *WorkloadPodGroupTemplateReference) Marshal() (dAtA []byte, err error) {
+func (m *TargetResponder) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -798,75 +727,31 @@ func (m *WorkloadPodGroupTemplateReference) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *WorkloadPodGroupTemplateReference) MarshalTo(dAtA []byte) (int, error) {
+func (m *TargetResponder) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *WorkloadPodGroupTemplateReference) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *TargetResponder) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	i -= len(m.PodGroupTemplateName)
-	copy(dAtA[i:], m.PodGroupTemplateName)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.PodGroupTemplateName)))
-	i--
-	dAtA[i] = 0x12
-	i -= len(m.WorkloadName)
-	copy(dAtA[i:], m.WorkloadName)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.WorkloadName)))
+	i -= len(m.State)
+	copy(dAtA[i:], m.State)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.State)))
 	i--
-	dAtA[i] = 0xa
-	return len(dAtA) - i, nil
-}
-
-func (m *WorkloadSpec) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *WorkloadSpec) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *WorkloadSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if len(m.PodGroupTemplates) > 0 {
-		for iNdEx := len(m.PodGroupTemplates) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.PodGroupTemplates[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintGenerated(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x12
-		}
-	}
-	if m.ControllerRef != nil {
-		{
-			size, err := m.ControllerRef.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintGenerated(dAtA, i, uint64(size))
-		}
+	dAtA[i] = 0x1a
+	if m.Priority != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.Priority))
 		i--
-		dAtA[i] = 0xa
+		dAtA[i] = 0x10
 	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
@@ -881,26 +766,52 @@ func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
 	dAtA[offset] = uint8(v)
 	return base
 }
-func (m *BasicSchedulingPolicy) Size() (n int) {
+func (m *Eviction) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
+	l = m.ObjectMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Spec.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
-func (m *GangSchedulingPolicy) Size() (n int) {
+func (m *EvictionList) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	n += 1 + sovGenerated(uint64(m.MinCount))
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *EvictionPodReference) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.UID)
+	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
-func (m *PodGroup) Size() (n int) {
+func (m *EvictionRequest) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -915,7 +826,7 @@ func (m *PodGroup) Size() (n int) {
 	return n
 }
 
-func (m *PodGroupList) Size() (n int) {
+func (m *EvictionRequestList) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -932,7 +843,7 @@ func (m *PodGroupList) Size() (n int) {
 	return n
 }
 
-func (m *PodGroupResourceClaim) Size() (n int) {
+func (m *EvictionRequestPodReference) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -940,99 +851,69 @@ func (m *PodGroupResourceClaim) Size() (n int) {
 	_ = l
 	l = len(m.Name)
 	n += 1 + l + sovGenerated(uint64(l))
-	if m.ResourceClaimName != nil {
-		l = len(*m.ResourceClaimName)
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	if m.ResourceClaimTemplateName != nil {
-		l = len(*m.ResourceClaimTemplateName)
-		n += 1 + l + sovGenerated(uint64(l))
-	}
+	l = len(m.UID)
+	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
-func (m *PodGroupResourceClaimStatus) Size() (n int) {
+func (m *EvictionRequestSpec) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.Name)
+	l = m.Target.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Requester)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Intent)
 	n += 1 + l + sovGenerated(uint64(l))
-	if m.ResourceClaimName != nil {
-		l = len(*m.ResourceClaimName)
-		n += 1 + l + sovGenerated(uint64(l))
-	}
 	return n
 }
 
-func (m *PodGroupSchedulingConstraints) Size() (n int) {
+func (m *EvictionRequestStatus) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if len(m.Topology) > 0 {
-		for _, e := range m.Topology {
+	if len(m.Conditions) > 0 {
+		for _, e := range m.Conditions {
 			l = e.Size()
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
+	if m.ObservedGeneration != nil {
+		n += 1 + sovGenerated(uint64(*m.ObservedGeneration))
+	}
 	return n
 }
 
-func (m *PodGroupSchedulingPolicy) Size() (n int) {
+func (m *EvictionRequestTarget) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.Basic != nil {
-		l = m.Basic.Size()
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	if m.Gang != nil {
-		l = m.Gang.Size()
+	if m.Pod != nil {
+		l = m.Pod.Size()
 		n += 1 + l + sovGenerated(uint64(l))
 	}
 	return n
 }
 
-func (m *PodGroupSpec) Size() (n int) {
+func (m *EvictionSpec) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.PodGroupTemplateRef != nil {
-		l = m.PodGroupTemplateRef.Size()
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	l = m.SchedulingPolicy.Size()
+	l = m.Target.Size()
 	n += 1 + l + sovGenerated(uint64(l))
-	if m.SchedulingConstraints != nil {
-		l = m.SchedulingConstraints.Size()
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	if len(m.ResourceClaims) > 0 {
-		for _, e := range m.ResourceClaims {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
-		}
-	}
-	if m.DisruptionMode != nil {
-		l = len(*m.DisruptionMode)
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	l = len(m.PriorityClassName)
-	n += 1 + l + sovGenerated(uint64(l))
-	if m.Priority != nil {
-		n += 1 + sovGenerated(uint64(*m.Priority))
-	}
 	return n
 }
 
-func (m *PodGroupStatus) Size() (n int) {
+func (m *EvictionStatus) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -1044,145 +925,100 @@ func (m *PodGroupStatus) Size() (n int) {
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
-	if len(m.ResourceClaimStatuses) > 0 {
-		for _, e := range m.ResourceClaimStatuses {
+	if m.ObservedGeneration != nil {
+		n += 1 + sovGenerated(uint64(*m.ObservedGeneration))
+	}
+	if len(m.Requesters) > 0 {
+		for _, e := range m.Requesters {
 			l = e.Size()
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
-	return n
-}
-
-func (m *PodGroupTemplate) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = len(m.Name)
-	n += 1 + l + sovGenerated(uint64(l))
-	l = m.SchedulingPolicy.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	if m.SchedulingConstraints != nil {
-		l = m.SchedulingConstraints.Size()
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	if len(m.ResourceClaims) > 0 {
-		for _, e := range m.ResourceClaims {
+	if len(m.TargetResponders) > 0 {
+		for _, e := range m.TargetResponders {
 			l = e.Size()
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
-	if m.DisruptionMode != nil {
-		l = len(*m.DisruptionMode)
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	l = len(m.PriorityClassName)
-	n += 1 + l + sovGenerated(uint64(l))
-	if m.Priority != nil {
-		n += 1 + sovGenerated(uint64(*m.Priority))
+	if len(m.Responders) > 0 {
+		for _, e := range m.Responders {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
 	}
 	return n
 }
 
-func (m *PodGroupTemplateReference) Size() (n int) {
+func (m *EvictionTarget) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.Workload != nil {
-		l = m.Workload.Size()
+	if m.Pod != nil {
+		l = m.Pod.Size()
 		n += 1 + l + sovGenerated(uint64(l))
 	}
 	return n
 }
 
-func (m *TopologyConstraint) Size() (n int) {
+func (m *Requester) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.Key)
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Intent)
 	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
-func (m *TypedLocalObjectReference) Size() (n int) {
+func (m *ResponderStatus) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.APIGroup)
-	n += 1 + l + sovGenerated(uint64(l))
-	l = len(m.Kind)
-	n += 1 + l + sovGenerated(uint64(l))
 	l = len(m.Name)
 	n += 1 + l + sovGenerated(uint64(l))
-	return n
-}
-
-func (m *Workload) Size() (n int) {
-	if m == nil {
-		return 0
+	if m.StartTime != nil {
+		l = m.StartTime.Size()
+		n += 1 + l + sovGenerated(uint64(l))
 	}
-	var l int
-	_ = l
-	l = m.ObjectMeta.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	l = m.Spec.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	return n
-}
-
-func (m *WorkloadList) Size() (n int) {
-	if m == nil {
-		return 0
+	if m.HeartbeatTime != nil {
+		l = m.HeartbeatTime.Size()
+		n += 1 + l + sovGenerated(uint64(l))
 	}
-	var l int
-	_ = l
-	l = m.ListMeta.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	if len(m.Items) > 0 {
-		for _, e := range m.Items {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
-		}
+	if m.ExpectedCompletionTime != nil {
+		l = m.ExpectedCompletionTime.Size()
+		n += 1 + l + sovGenerated(uint64(l))
 	}
-	return n
-}
-
-func (m *WorkloadPodGroupTemplateReference) Size() (n int) {
-	if m == nil {
-		return 0
+	if m.CompletionTime != nil {
+		l = m.CompletionTime.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Message != nil {
+		l = len(*m.Message)
+		n += 1 + l + sovGenerated(uint64(l))
 	}
-	var l int
-	_ = l
-	l = len(m.WorkloadName)
-	n += 1 + l + sovGenerated(uint64(l))
-	l = len(m.PodGroupTemplateName)
-	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
-func (m *WorkloadSpec) Size() (n int) {
+func (m *TargetResponder) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.ControllerRef != nil {
-		l = m.ControllerRef.Size()
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	if len(m.PodGroupTemplates) > 0 {
-		for _, e := range m.PodGroupTemplates {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
-		}
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Priority != nil {
+		n += 1 + sovGenerated(uint64(*m.Priority))
 	}
+	l = len(m.State)
+	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
@@ -1192,124 +1028,97 @@ func sovGenerated(x uint64) (n int) {
 func sozGenerated(x uint64) (n int) {
 	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
 }
-func (this *BasicSchedulingPolicy) String() string {
-	if this == nil {
-		return "nil"
-	}
-	s := strings.Join([]string{`&BasicSchedulingPolicy{`,
-		`}`,
-	}, "")
-	return s
-}
-func (this *GangSchedulingPolicy) String() string {
-	if this == nil {
-		return "nil"
-	}
-	s := strings.Join([]string{`&GangSchedulingPolicy{`,
-		`MinCount:` + fmt.Sprintf("%v", this.MinCount) + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func (this *PodGroup) String() string {
+func (this *Eviction) String() string {
 	if this == nil {
 		return "nil"
 	}
-	s := strings.Join([]string{`&PodGroup{`,
+	s := strings.Join([]string{`&Eviction{`,
 		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
-		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "PodGroupSpec", "PodGroupSpec", 1), `&`, ``, 1) + `,`,
-		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "PodGroupStatus", "PodGroupStatus", 1), `&`, ``, 1) + `,`,
+		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "EvictionSpec", "EvictionSpec", 1), `&`, ``, 1) + `,`,
+		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "EvictionStatus", "EvictionStatus", 1), `&`, ``, 1) + `,`,
 		`}`,
 	}, "")
 	return s
 }
-func (this *PodGroupList) String() string {
+func (this *EvictionList) String() string {
 	if this == nil {
 		return "nil"
 	}
-	repeatedStringForItems := "[]PodGroup{"
+	repeatedStringForItems := "[]Eviction{"
 	for _, f := range this.Items {
-		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "PodGroup", "PodGroup", 1), `&`, ``, 1) + ","
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "Eviction", "Eviction", 1), `&`, ``, 1) + ","
 	}
 	repeatedStringForItems += "}"
-	s := strings.Join([]string{`&PodGroupList{`,
+	s := strings.Join([]string{`&EvictionList{`,
 		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
 		`Items:` + repeatedStringForItems + `,`,
 		`}`,
 	}, "")
 	return s
 }
-func (this *PodGroupResourceClaim) String() string {
+func (this *EvictionPodReference) String() string {
 	if this == nil {
 		return "nil"
 	}
-	s := strings.Join([]string{`&PodGroupResourceClaim{`,
+	s := strings.Join([]string{`&EvictionPodReference{`,
 		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
-		`ResourceClaimName:` + valueToStringGenerated(this.ResourceClaimName) + `,`,
-		`ResourceClaimTemplateName:` + valueToStringGenerated(this.ResourceClaimTemplateName) + `,`,
+		`UID:` + fmt.Sprintf("%v", this.UID) + `,`,
 		`}`,
 	}, "")
 	return s
 }
-func (this *PodGroupResourceClaimStatus) String() string {
+func (this *EvictionRequest) String() string {
 	if this == nil {
 		return "nil"
 	}
-	s := strings.Join([]string{`&PodGroupResourceClaimStatus{`,
-		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
-		`ResourceClaimName:` + valueToStringGenerated(this.ResourceClaimName) + `,`,
+	s := strings.Join([]string{`&EvictionRequest{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "EvictionRequestSpec", "EvictionRequestSpec", 1), `&`, ``, 1) + `,`,
+		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "EvictionRequestStatus", "EvictionRequestStatus", 1), `&`, ``, 1) + `,`,
 		`}`,
 	}, "")
 	return s
 }
-func (this *PodGroupSchedulingConstraints) String() string {
+func (this *EvictionRequestList) String() string {
 	if this == nil {
 		return "nil"
 	}
-	repeatedStringForTopology := "[]TopologyConstraint{"
-	for _, f := range this.Topology {
-		repeatedStringForTopology += strings.Replace(strings.Replace(f.String(), "TopologyConstraint", "TopologyConstraint", 1), `&`, ``, 1) + ","
+	repeatedStringForItems := "[]EvictionRequest{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "EvictionRequest", "EvictionRequest", 1), `&`, ``, 1) + ","
 	}
-	repeatedStringForTopology += "}"
-	s := strings.Join([]string{`&PodGroupSchedulingConstraints{`,
-		`Topology:` + repeatedStringForTopology + `,`,
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&EvictionRequestList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
 		`}`,
 	}, "")
 	return s
 }
-func (this *PodGroupSchedulingPolicy) String() string {
+func (this *EvictionRequestPodReference) String() string {
 	if this == nil {
 		return "nil"
 	}
-	s := strings.Join([]string{`&PodGroupSchedulingPolicy{`,
-		`Basic:` + strings.Replace(this.Basic.String(), "BasicSchedulingPolicy", "BasicSchedulingPolicy", 1) + `,`,
-		`Gang:` + strings.Replace(this.Gang.String(), "GangSchedulingPolicy", "GangSchedulingPolicy", 1) + `,`,
+	s := strings.Join([]string{`&EvictionRequestPodReference{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`UID:` + fmt.Sprintf("%v", this.UID) + `,`,
 		`}`,
 	}, "")
 	return s
 }
-func (this *PodGroupSpec) String() string {
+func (this *EvictionRequestSpec) String() string {
 	if this == nil {
 		return "nil"
 	}
-	repeatedStringForResourceClaims := "[]PodGroupResourceClaim{"
-	for _, f := range this.ResourceClaims {
-		repeatedStringForResourceClaims += strings.Replace(strings.Replace(f.String(), "PodGroupResourceClaim", "PodGroupResourceClaim", 1), `&`, ``, 1) + ","
-	}
-	repeatedStringForResourceClaims += "}"
-	s := strings.Join([]string{`&PodGroupSpec{`,
-		`PodGroupTemplateRef:` + strings.Replace(this.PodGroupTemplateRef.String(), "PodGroupTemplateReference", "PodGroupTemplateReference", 1) + `,`,
-		`SchedulingPolicy:` + strings.Replace(strings.Replace(this.SchedulingPolicy.String(), "PodGroupSchedulingPolicy", "PodGroupSchedulingPolicy", 1), `&`, ``, 1) + `,`,
-		`SchedulingConstraints:` + strings.Replace(this.SchedulingConstraints.String(), "PodGroupSchedulingConstraints", "PodGroupSchedulingConstraints", 1) + `,`,
-		`ResourceClaims:` + repeatedStringForResourceClaims + `,`,
-		`DisruptionMode:` + valueToStringGenerated(this.DisruptionMode) + `,`,
-		`PriorityClassName:` + fmt.Sprintf("%v", this.PriorityClassName) + `,`,
-		`Priority:` + valueToStringGenerated(this.Priority) + `,`,
+	s := strings.Join([]string{`&EvictionRequestSpec{`,
+		`Target:` + strings.Replace(strings.Replace(this.Target.String(), "EvictionRequestTarget", "EvictionRequestTarget", 1), `&`, ``, 1) + `,`,
+		`Requester:` + fmt.Sprintf("%v", this.Requester) + `,`,
+		`Intent:` + fmt.Sprintf("%v", this.Intent) + `,`,
 		`}`,
 	}, "")
 	return s
 }
-func (this *PodGroupStatus) String() string {
+func (this *EvictionRequestStatus) String() string {
 	if this == nil {
 		return "nil"
 	}
@@ -1318,253 +1127,124 @@ func (this *PodGroupStatus) String() string {
 		repeatedStringForConditions += fmt.Sprintf("%v", f) + ","
 	}
 	repeatedStringForConditions += "}"
-	repeatedStringForResourceClaimStatuses := "[]PodGroupResourceClaimStatus{"
-	for _, f := range this.ResourceClaimStatuses {
-		repeatedStringForResourceClaimStatuses += strings.Replace(strings.Replace(f.String(), "PodGroupResourceClaimStatus", "PodGroupResourceClaimStatus", 1), `&`, ``, 1) + ","
-	}
-	repeatedStringForResourceClaimStatuses += "}"
-	s := strings.Join([]string{`&PodGroupStatus{`,
+	s := strings.Join([]string{`&EvictionRequestStatus{`,
 		`Conditions:` + repeatedStringForConditions + `,`,
-		`ResourceClaimStatuses:` + repeatedStringForResourceClaimStatuses + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func (this *PodGroupTemplate) String() string {
-	if this == nil {
-		return "nil"
-	}
-	repeatedStringForResourceClaims := "[]PodGroupResourceClaim{"
-	for _, f := range this.ResourceClaims {
-		repeatedStringForResourceClaims += strings.Replace(strings.Replace(f.String(), "PodGroupResourceClaim", "PodGroupResourceClaim", 1), `&`, ``, 1) + ","
-	}
-	repeatedStringForResourceClaims += "}"
-	s := strings.Join([]string{`&PodGroupTemplate{`,
-		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
-		`SchedulingPolicy:` + strings.Replace(strings.Replace(this.SchedulingPolicy.String(), "PodGroupSchedulingPolicy", "PodGroupSchedulingPolicy", 1), `&`, ``, 1) + `,`,
-		`SchedulingConstraints:` + strings.Replace(this.SchedulingConstraints.String(), "PodGroupSchedulingConstraints", "PodGroupSchedulingConstraints", 1) + `,`,
-		`ResourceClaims:` + repeatedStringForResourceClaims + `,`,
-		`DisruptionMode:` + valueToStringGenerated(this.DisruptionMode) + `,`,
-		`PriorityClassName:` + fmt.Sprintf("%v", this.PriorityClassName) + `,`,
-		`Priority:` + valueToStringGenerated(this.Priority) + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func (this *PodGroupTemplateReference) String() string {
-	if this == nil {
-		return "nil"
-	}
-	s := strings.Join([]string{`&PodGroupTemplateReference{`,
-		`Workload:` + strings.Replace(this.Workload.String(), "WorkloadPodGroupTemplateReference", "WorkloadPodGroupTemplateReference", 1) + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func (this *TopologyConstraint) String() string {
-	if this == nil {
-		return "nil"
-	}
-	s := strings.Join([]string{`&TopologyConstraint{`,
-		`Key:` + fmt.Sprintf("%v", this.Key) + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func (this *TypedLocalObjectReference) String() string {
-	if this == nil {
-		return "nil"
-	}
-	s := strings.Join([]string{`&TypedLocalObjectReference{`,
-		`APIGroup:` + fmt.Sprintf("%v", this.APIGroup) + `,`,
-		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
-		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func (this *Workload) String() string {
-	if this == nil {
-		return "nil"
-	}
-	s := strings.Join([]string{`&Workload{`,
-		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
-		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "WorkloadSpec", "WorkloadSpec", 1), `&`, ``, 1) + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func (this *WorkloadList) String() string {
-	if this == nil {
-		return "nil"
-	}
-	repeatedStringForItems := "[]Workload{"
-	for _, f := range this.Items {
-		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "Workload", "Workload", 1), `&`, ``, 1) + ","
-	}
-	repeatedStringForItems += "}"
-	s := strings.Join([]string{`&WorkloadList{`,
-		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
-		`Items:` + repeatedStringForItems + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func (this *WorkloadPodGroupTemplateReference) String() string {
-	if this == nil {
-		return "nil"
-	}
-	s := strings.Join([]string{`&WorkloadPodGroupTemplateReference{`,
-		`WorkloadName:` + fmt.Sprintf("%v", this.WorkloadName) + `,`,
-		`PodGroupTemplateName:` + fmt.Sprintf("%v", this.PodGroupTemplateName) + `,`,
+		`ObservedGeneration:` + valueToStringGenerated(this.ObservedGeneration) + `,`,
 		`}`,
 	}, "")
 	return s
 }
-func (this *WorkloadSpec) String() string {
+func (this *EvictionRequestTarget) String() string {
 	if this == nil {
 		return "nil"
 	}
-	repeatedStringForPodGroupTemplates := "[]PodGroupTemplate{"
-	for _, f := range this.PodGroupTemplates {
-		repeatedStringForPodGroupTemplates += strings.Replace(strings.Replace(f.String(), "PodGroupTemplate", "PodGroupTemplate", 1), `&`, ``, 1) + ","
-	}
-	repeatedStringForPodGroupTemplates += "}"
-	s := strings.Join([]string{`&WorkloadSpec{`,
-		`ControllerRef:` + strings.Replace(this.ControllerRef.String(), "TypedLocalObjectReference", "TypedLocalObjectReference", 1) + `,`,
-		`PodGroupTemplates:` + repeatedStringForPodGroupTemplates + `,`,
+	s := strings.Join([]string{`&EvictionRequestTarget{`,
+		`Pod:` + strings.Replace(this.Pod.String(), "EvictionRequestPodReference", "EvictionRequestPodReference", 1) + `,`,
 		`}`,
 	}, "")
 	return s
-}
-func valueToStringGenerated(v interface{}) string {
-	rv := reflect.ValueOf(v)
-	if rv.IsNil() {
-		return "nil"
-	}
-	pv := reflect.Indirect(rv).Interface()
-	return fmt.Sprintf("*%v", pv)
-}
-func (m *BasicSchedulingPolicy) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: BasicSchedulingPolicy: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: BasicSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *GangSchedulingPolicy) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: GangSchedulingPolicy: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: GangSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MinCount", wireType)
-			}
-			m.MinCount = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.MinCount |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
+}
+func (this *EvictionSpec) String() string {
+	if this == nil {
+		return "nil"
 	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
+	s := strings.Join([]string{`&EvictionSpec{`,
+		`Target:` + strings.Replace(strings.Replace(this.Target.String(), "EvictionTarget", "EvictionTarget", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *EvictionStatus) String() string {
+	if this == nil {
+		return "nil"
 	}
-	return nil
+	repeatedStringForConditions := "[]Condition{"
+	for _, f := range this.Conditions {
+		repeatedStringForConditions += fmt.Sprintf("%v", f) + ","
+	}
+	repeatedStringForConditions += "}"
+	repeatedStringForRequesters := "[]Requester{"
+	for _, f := range this.Requesters {
+		repeatedStringForRequesters += strings.Replace(strings.Replace(f.String(), "Requester", "Requester", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForRequesters += "}"
+	repeatedStringForTargetResponders := "[]TargetResponder{"
+	for _, f := range this.TargetResponders {
+		repeatedStringForTargetResponders += strings.Replace(strings.Replace(f.String(), "TargetResponder", "TargetResponder", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForTargetResponders += "}"
+	repeatedStringForResponders := "[]ResponderStatus{"
+	for _, f := range this.Responders {
+		repeatedStringForResponders += strings.Replace(strings.Replace(f.String(), "ResponderStatus", "ResponderStatus", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForResponders += "}"
+	s := strings.Join([]string{`&EvictionStatus{`,
+		`Conditions:` + repeatedStringForConditions + `,`,
+		`ObservedGeneration:` + valueToStringGenerated(this.ObservedGeneration) + `,`,
+		`Requesters:` + repeatedStringForRequesters + `,`,
+		`TargetResponders:` + repeatedStringForTargetResponders + `,`,
+		`Responders:` + repeatedStringForResponders + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *EvictionTarget) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&EvictionTarget{`,
+		`Pod:` + strings.Replace(this.Pod.String(), "EvictionPodReference", "EvictionPodReference", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Requester) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Requester{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`Intent:` + fmt.Sprintf("%v", this.Intent) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ResponderStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ResponderStatus{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`StartTime:` + strings.Replace(fmt.Sprintf("%v", this.StartTime), "Time", "v1.Time", 1) + `,`,
+		`HeartbeatTime:` + strings.Replace(fmt.Sprintf("%v", this.HeartbeatTime), "Time", "v1.Time", 1) + `,`,
+		`ExpectedCompletionTime:` + strings.Replace(fmt.Sprintf("%v", this.ExpectedCompletionTime), "Time", "v1.Time", 1) + `,`,
+		`CompletionTime:` + strings.Replace(fmt.Sprintf("%v", this.CompletionTime), "Time", "v1.Time", 1) + `,`,
+		`Message:` + valueToStringGenerated(this.Message) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *TargetResponder) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&TargetResponder{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`Priority:` + valueToStringGenerated(this.Priority) + `,`,
+		`State:` + fmt.Sprintf("%v", this.State) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringGenerated(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
 }
-func (m *PodGroup) Unmarshal(dAtA []byte) error {
+func (m *Eviction) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -1587,10 +1267,10 @@ func (m *PodGroup) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PodGroup: wiretype end group for non-group")
+			return fmt.Errorf("proto: Eviction: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PodGroup: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: Eviction: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -1713,7 +1393,7 @@ func (m *PodGroup) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PodGroupList) Unmarshal(dAtA []byte) error {
+func (m *EvictionList) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -1736,10 +1416,10 @@ func (m *PodGroupList) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PodGroupList: wiretype end group for non-group")
+			return fmt.Errorf("proto: EvictionList: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PodGroupList: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: EvictionList: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -1804,7 +1484,7 @@ func (m *PodGroupList) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Items = append(m.Items, PodGroup{})
+			m.Items = append(m.Items, Eviction{})
 			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
@@ -1830,7 +1510,7 @@ func (m *PodGroupList) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PodGroupResourceClaim) Unmarshal(dAtA []byte) error {
+func (m *EvictionPodReference) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -1853,10 +1533,10 @@ func (m *PodGroupResourceClaim) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PodGroupResourceClaim: wiretype end group for non-group")
+			return fmt.Errorf("proto: EvictionPodReference: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PodGroupResourceClaim: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: EvictionPodReference: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -1893,40 +1573,7 @@ func (m *PodGroupResourceClaim) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaimName", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			s := string(dAtA[iNdEx:postIndex])
-			m.ResourceClaimName = &s
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaimTemplateName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -1954,8 +1601,7 @@ func (m *PodGroupResourceClaim) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			s := string(dAtA[iNdEx:postIndex])
-			m.ResourceClaimTemplateName = &s
+			m.UID = k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -1978,7 +1624,7 @@ func (m *PodGroupResourceClaim) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PodGroupResourceClaimStatus) Unmarshal(dAtA []byte) error {
+func (m *EvictionRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -2001,17 +1647,17 @@ func (m *PodGroupResourceClaimStatus) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PodGroupResourceClaimStatus: wiretype end group for non-group")
+			return fmt.Errorf("proto: EvictionRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PodGroupResourceClaimStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: EvictionRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -2021,29 +1667,30 @@ func (m *PodGroupResourceClaimStatus) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaimName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -2053,78 +1700,28 @@ func (m *PodGroupResourceClaimStatus) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			s := string(dAtA[iNdEx:postIndex])
-			m.ResourceClaimName = &s
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *PodGroupSchedulingConstraints) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: PodGroupSchedulingConstraints: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PodGroupSchedulingConstraints: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Topology", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -2151,8 +1748,7 @@ func (m *PodGroupSchedulingConstraints) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Topology = append(m.Topology, TopologyConstraint{})
-			if err := m.Topology[len(m.Topology)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -2177,7 +1773,7 @@ func (m *PodGroupSchedulingConstraints) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PodGroupSchedulingPolicy) Unmarshal(dAtA []byte) error {
+func (m *EvictionRequestList) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -2200,15 +1796,15 @@ func (m *PodGroupSchedulingPolicy) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PodGroupSchedulingPolicy: wiretype end group for non-group")
+			return fmt.Errorf("proto: EvictionRequestList: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PodGroupSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: EvictionRequestList: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Basic", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -2235,16 +1831,13 @@ func (m *PodGroupSchedulingPolicy) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Basic == nil {
-				m.Basic = &BasicSchedulingPolicy{}
-			}
-			if err := m.Basic.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Gang", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -2271,10 +1864,8 @@ func (m *PodGroupSchedulingPolicy) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Gang == nil {
-				m.Gang = &GangSchedulingPolicy{}
-			}
-			if err := m.Gang.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Items = append(m.Items, EvictionRequest{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -2299,7 +1890,7 @@ func (m *PodGroupSchedulingPolicy) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PodGroupSpec) Unmarshal(dAtA []byte) error {
+func (m *EvictionRequestPodReference) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -2322,17 +1913,17 @@ func (m *PodGroupSpec) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PodGroupSpec: wiretype end group for non-group")
+			return fmt.Errorf("proto: EvictionRequestPodReference: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PodGroupSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: EvictionRequestPodReference: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PodGroupTemplateRef", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -2342,33 +1933,29 @@ func (m *PodGroupSpec) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.PodGroupTemplateRef == nil {
-				m.PodGroupTemplateRef = &PodGroupTemplateReference{}
-			}
-			if err := m.PodGroupTemplateRef.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingPolicy", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field UID", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -2378,64 +1965,77 @@ func (m *PodGroupSpec) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SchedulingPolicy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.UID = k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingConstraints", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.SchedulingConstraints == nil {
-				m.SchedulingConstraints = &PodGroupSchedulingConstraints{}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *EvictionRequestSpec) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
 			}
-			if err := m.SchedulingConstraints.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
 			}
-			iNdEx = postIndex
-		case 4:
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EvictionRequestSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EvictionRequestSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaims", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -2462,14 +2062,13 @@ func (m *PodGroupSpec) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ResourceClaims = append(m.ResourceClaims, PodGroupResourceClaim{})
-			if err := m.ResourceClaims[len(m.ResourceClaims)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Target.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DisruptionMode", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Requester", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -2497,12 +2096,11 @@ func (m *PodGroupSpec) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			s := DisruptionMode(dAtA[iNdEx:postIndex])
-			m.DisruptionMode = &s
+			m.Requester = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PriorityClassName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Intent", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -2530,28 +2128,8 @@ func (m *PodGroupSpec) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PriorityClassName = string(dAtA[iNdEx:postIndex])
+			m.Intent = EvictionRequestIntent(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Priority", wireType)
-			}
-			var v int32
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.Priority = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -2573,7 +2151,7 @@ func (m *PodGroupSpec) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PodGroupStatus) Unmarshal(dAtA []byte) error {
+func (m *EvictionRequestStatus) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -2596,10 +2174,10 @@ func (m *PodGroupStatus) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PodGroupStatus: wiretype end group for non-group")
+			return fmt.Errorf("proto: EvictionRequestStatus: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PodGroupStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: EvictionRequestStatus: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -2637,10 +2215,10 @@ func (m *PodGroupStatus) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaimStatuses", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObservedGeneration", wireType)
 			}
-			var msglen int
+			var v int64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -2650,26 +2228,12 @@ func (m *PodGroupStatus) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				v |= int64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.ResourceClaimStatuses = append(m.ResourceClaimStatuses, PodGroupResourceClaimStatus{})
-			if err := m.ResourceClaimStatuses[len(m.ResourceClaimStatuses)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
+			m.ObservedGeneration = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -2691,7 +2255,7 @@ func (m *PodGroupStatus) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PodGroupTemplate) Unmarshal(dAtA []byte) error {
+func (m *EvictionRequestTarget) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -2714,17 +2278,17 @@ func (m *PodGroupTemplate) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PodGroupTemplate: wiretype end group for non-group")
+			return fmt.Errorf("proto: EvictionRequestTarget: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PodGroupTemplate: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: EvictionRequestTarget: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Pod", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -2734,60 +2298,81 @@ func (m *PodGroupTemplate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingPolicy", wireType)
+			if m.Pod == nil {
+				m.Pod = &EvictionRequestPodReference{}
 			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			if err := m.Pod.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.SchedulingPolicy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *EvictionSpec) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
 			}
-			iNdEx = postIndex
-		case 3:
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EvictionSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EvictionSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingConstraints", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -2814,16 +2399,63 @@ func (m *PodGroupTemplate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.SchedulingConstraints == nil {
-				m.SchedulingConstraints = &PodGroupSchedulingConstraints{}
-			}
-			if err := m.SchedulingConstraints.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Target.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *EvictionStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EvictionStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EvictionStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaims", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Conditions", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -2850,16 +2482,16 @@ func (m *PodGroupTemplate) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ResourceClaims = append(m.ResourceClaims, PodGroupResourceClaim{})
-			if err := m.ResourceClaims[len(m.ResourceClaims)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Conditions = append(m.Conditions, v1.Condition{})
+			if err := m.Conditions[len(m.Conditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DisruptionMode", wireType)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObservedGeneration", wireType)
 			}
-			var stringLen uint64
+			var v int64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -2869,30 +2501,17 @@ func (m *PodGroupTemplate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				v |= int64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			s := DisruptionMode(dAtA[iNdEx:postIndex])
-			m.DisruptionMode = &s
-			iNdEx = postIndex
-		case 6:
+			m.ObservedGeneration = &v
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PriorityClassName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Requesters", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -2902,29 +2521,31 @@ func (m *PodGroupTemplate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PriorityClassName = string(dAtA[iNdEx:postIndex])
+			m.Requesters = append(m.Requesters, Requester{})
+			if err := m.Requesters[len(m.Requesters)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 7:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Priority", wireType)
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TargetResponders", wireType)
 			}
-			var v int32
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -2934,65 +2555,29 @@ func (m *PodGroupTemplate) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.Priority = &v
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *PodGroupTemplateReference) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
 			}
-			if iNdEx >= l {
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			m.TargetResponders = append(m.TargetResponders, TargetResponder{})
+			if err := m.TargetResponders[len(m.TargetResponders)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: PodGroupTemplateReference: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PodGroupTemplateReference: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Workload", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Responders", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -3019,10 +2604,8 @@ func (m *PodGroupTemplateReference) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Workload == nil {
-				m.Workload = &WorkloadPodGroupTemplateReference{}
-			}
-			if err := m.Workload.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Responders = append(m.Responders, ResponderStatus{})
+			if err := m.Responders[len(m.Responders)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -3047,7 +2630,7 @@ func (m *PodGroupTemplateReference) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *TopologyConstraint) Unmarshal(dAtA []byte) error {
+func (m *EvictionTarget) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -3070,17 +2653,17 @@ func (m *TopologyConstraint) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: TopologyConstraint: wiretype end group for non-group")
+			return fmt.Errorf("proto: EvictionTarget: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: TopologyConstraint: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: EvictionTarget: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Pod", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -3090,23 +2673,27 @@ func (m *TopologyConstraint) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Key = string(dAtA[iNdEx:postIndex])
+			if m.Pod == nil {
+				m.Pod = &EvictionPodReference{}
+			}
+			if err := m.Pod.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -3129,7 +2716,7 @@ func (m *TopologyConstraint) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *TypedLocalObjectReference) Unmarshal(dAtA []byte) error {
+func (m *Requester) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -3152,15 +2739,15 @@ func (m *TypedLocalObjectReference) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: TypedLocalObjectReference: wiretype end group for non-group")
+			return fmt.Errorf("proto: Requester: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: TypedLocalObjectReference: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: Requester: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field APIGroup", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -3188,43 +2775,11 @@ func (m *TypedLocalObjectReference) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.APIGroup = string(dAtA[iNdEx:postIndex])
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Kind = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Intent", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -3252,7 +2807,7 @@ func (m *TypedLocalObjectReference) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.Intent = RequesterIntent(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -3275,7 +2830,7 @@ func (m *TypedLocalObjectReference) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *Workload) Unmarshal(dAtA []byte) error {
+func (m *ResponderStatus) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -3298,17 +2853,17 @@ func (m *Workload) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: Workload: wiretype end group for non-group")
+			return fmt.Errorf("proto: ResponderStatus: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Workload: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ResponderStatus: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -3318,28 +2873,27 @@ func (m *Workload) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StartTime", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -3366,63 +2920,16 @@ func (m *Workload) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			if m.StartTime == nil {
+				m.StartTime = &v1.Time{}
 			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.StartTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *WorkloadList) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: WorkloadList: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WorkloadList: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field HeartbeatTime", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -3449,13 +2956,16 @@ func (m *WorkloadList) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.HeartbeatTime == nil {
+				m.HeartbeatTime = &v1.Time{}
+			}
+			if err := m.HeartbeatTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ExpectedCompletionTime", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -3482,66 +2992,18 @@ func (m *WorkloadList) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Items = append(m.Items, Workload{})
-			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			if m.ExpectedCompletionTime == nil {
+				m.ExpectedCompletionTime = &v1.Time{}
 			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
+			if err := m.ExpectedCompletionTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *WorkloadPodGroupTemplateReference) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: WorkloadPodGroupTemplateReference: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WorkloadPodGroupTemplateReference: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			iNdEx = postIndex
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CompletionTime", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -3551,27 +3013,31 @@ func (m *WorkloadPodGroupTemplateReference) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.WorkloadName = string(dAtA[iNdEx:postIndex])
+			if m.CompletionTime == nil {
+				m.CompletionTime = &v1.Time{}
+			}
+			if err := m.CompletionTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 2:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PodGroupTemplateName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -3599,7 +3065,8 @@ func (m *WorkloadPodGroupTemplateReference) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PodGroupTemplateName = string(dAtA[iNdEx:postIndex])
+			s := string(dAtA[iNdEx:postIndex])
+			m.Message = &s
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -3622,7 +3089,7 @@ func (m *WorkloadPodGroupTemplateReference) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *WorkloadSpec) Unmarshal(dAtA []byte) error {
+func (m *TargetResponder) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -3645,17 +3112,17 @@ func (m *WorkloadSpec) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: WorkloadSpec: wiretype end group for non-group")
+			return fmt.Errorf("proto: TargetResponder: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: WorkloadSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: TargetResponder: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ControllerRef", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -3665,33 +3132,49 @@ func (m *WorkloadSpec) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.ControllerRef == nil {
-				m.ControllerRef = &TypedLocalObjectReference{}
-			}
-			if err := m.ControllerRef.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Priority", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Priority = &v
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PodGroupTemplates", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field State", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -3701,25 +3184,23 @@ func (m *WorkloadSpec) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.PodGroupTemplates = append(m.PodGroupTemplates, PodGroupTemplate{})
-			if err := m.PodGroupTemplates[len(m.PodGroupTemplates)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.State = ResponderStateType(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
diff --git a/vendor/k8s.io/api/lifecycle/v1alpha1/generated.proto b/vendor/k8s.io/api/lifecycle/v1alpha1/generated.proto
new file mode 100644
index 0000000000..cef2c730dc
--- /dev/null
+++ b/vendor/k8s.io/api/lifecycle/v1alpha1/generated.proto
@@ -0,0 +1,529 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.api.lifecycle.v1alpha1;
+
+import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
+import "k8s.io/apimachinery/pkg/runtime/generated.proto";
+import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/api/lifecycle/v1alpha1";
+
+// Eviction initiates an eviction process, which should ideally result in a graceful eviction of a
+// .spec.target (e.g. termination of a pod).
+//
+// The evictionrequest-controller observes intents of all EvictionRequests and transforms them into
+// Evictions. It manages the Eviction lifecycle.
+// Requesters are preserved in .status.requesters even after they have withdrawn their request.
+// If all requesters withdraw their eviction intent for a common target, the eviction will be
+// canceled. Once all EvictionRequest corresponding to this Eviction .spec.target have been
+// removed, this Eviction object will eventually be garbage collected.
+//
+// If the target is a pod, the .status.targetResponders is populated from Pod's
+// .spec.evictionResponders.
+//
+// Responders should observe and communicate through the .status to help with the eviction
+// of the target when they see their state == Active in .status.targetResponders. ResponderStatus
+// struct should then be periodically updated to indicate the progress or completion of the eviction
+// process by each responder in .status.responders. If .status.responders[].heartbeatTime is not
+// updated within the heartbeat deadline defined by the Eviction API (currently 20 minutes), the
+// eviction is passed over to the next responder with a lower priority.
+//
+// If there are no other responders and the target is a pod, the last default
+// imperative-eviction.k8s.io/evictor responder with a priority of 100 will evict the pod using the
+// imperative Eviction API (pods/<name>/eviction subresource).
+// +k8s:validation-gen-nolint // Note: remove this when the API got GA
+message Eviction {
+  // metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
+  // .metadata.name set by the evictionrequest-controller is purely informative and subject to change.
+  // .spec.target field should be used to identify the target precisesly.
+  //
+  // The requester and responder names will be used as label keys and added to the labels of the
+  // eviction in one of the following formats:
+  // 1. acme.io/foo: "requester"
+  // 2. acme.io/foo: "responder"
+  // 3. acme.io/foo: "requester-responder"
+  //
+  // Please see EvictionParticipantRole for available role label values.
+  // +optional
+  // +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:format=k8s-long-name
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
+
+  // spec defines the eviction specification.
+  // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+  // +required
+  optional EvictionSpec spec = 2;
+
+  // status represents the most recently observed status of the eviction.
+  // Populated by responders and evictionrequest-controller.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+  // +optional
+  optional EvictionStatus status = 3;
+}
+
+// EvictionList contains a list of Eviction resources.
+message EvictionList {
+  // metadata is the standard list metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
+
+  // items is the list of Evictions.
+  repeated Eviction items = 2;
+}
+
+// EvictionPodReference contains enough information to locate the referenced pod inside the same
+// namespace.
+message EvictionPodReference {
+  // name of the target.
+  // This field is required.
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-long-name
+  optional string name = 1;
+
+  // uid of the target.
+  // It can be found in .metadata.uid of the target and is a lowercase UUID in 8-4-4-4-12 format.
+  // This field is required.
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-uuid
+  optional string uid = 2;
+}
+
+// EvictionRequest defines a request that should ideally result in a graceful eviction of a
+// .spec.target (e.g. termination of a pod).
+//
+// The evictionrequest-controller observes intents of all EvictionRequests and transforms them into
+// Evictions.
+//   - .spec.requester is set as a label on the Eviction for easier lookup.
+//   - Each target can have a set of responders assigned to it. Eviction objects are observed by
+//     these responders, who implement the eviction logic and update the Eviction's status with
+//     progress.
+//
+// There is many-to-many relationship between EvictionRequests and Evictions in general.
+// And many-to-one if the target is a  pod.
+//
+// If all requesters withdraw their eviction intent for a common target, the eviction will be
+// canceled. Deleting an EvictionRequest also counts as a withdrawal.
+// Once all EvictionRequest of a target are removed, the corresponding Evictions are eventually
+// garbage collected.
+//
+// +k8s:validation-gen-nolint // Note: remove this when the API got GA
+message EvictionRequest {
+  // metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
+  // +optional
+  // +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:format=k8s-long-name
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
+
+  // spec defines the eviction request specification.
+  // https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+  // +required
+  optional EvictionRequestSpec spec = 2;
+
+  // status represents the most recently observed status of the eviction request.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+  // +optional
+  optional EvictionRequestStatus status = 3;
+}
+
+// EvictionRequestList contains a list of EvictionRequests resources.
+message EvictionRequestList {
+  // metadata is the standard list metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
+
+  // items is the list of EvictionRequests.
+  repeated EvictionRequest items = 2;
+}
+
+// EvictionRequestPodReference contains enough information to locate the referenced pod inside the
+// same namespace.
+message EvictionRequestPodReference {
+  // name of the target.
+  // This field is required.
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-long-name
+  optional string name = 1;
+
+  // uid of the target.
+  // It can be found in .metadata.uid of the target and is a lowercase UUID in 8-4-4-4-12 format.
+  // This field is required.
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-uuid
+  optional string uid = 2;
+}
+
+// EvictionRequestSpec is a specification of an EvictionRequest.
+message EvictionRequestSpec {
+  // target contains a reference to an object (e.g. a pod) that should be evicted.
+  // This field is required and immutable.
+  // +required
+  // +k8s:immutable
+  optional EvictionRequestTarget target = 1;
+
+  // requester allows you to identify the entity, that requested the eviction of the target.
+  //
+  // It must be a valid domain-prefixed key (such as "acme.io/foo").
+  // Domain names *.k8s.io and *.kubernetes.io are reserved.
+  // This field is required and immutable.
+  // +required
+  // +k8s:required
+  // +k8s:immutable
+  // +k8s:format=k8s-prefixed-label-key
+  // +k8s:customValidation
+  optional string requester = 2;
+
+  // intent specifies the action that should be taken for the specified target.
+  //
+  // - Eviction means that the requester is interested in the eviction of the target.
+  // - Withdrawn means that the requester is no longer interested in the eviction of the target.
+  //   If all requesters' intents are withdrawn for a common target, the eviction will be canceled.
+  //   Cancellation consequences:
+  //   - Inactive responders will never run.
+  //   - Active responders are expected to cancel the eviction.
+  //   - Completed or Interrupted responders should not take any action.
+  // +required
+  // +k8s:required
+  optional string intent = 3;
+}
+
+// EvictionRequestStatus represents the last observed status of the eviction request.
+message EvictionRequestStatus {
+  // conditions contain information about the eviction request.
+  //
+  // EvictionRequest specific conditions are: TargetEvicted or Failed (managed by evictionrequest-controller).
+  // - Failed means that the eviction request is no longer being processed
+  //   by any eviction responder. This can happen if the request is canceled or if no responder
+  //   managed to evict the target (e.g. terminate or delete a pod).
+  // - TargetEvicted means that the target has been evicted (e.g. a pod has been terminated or deleted).
+  //
+  // These conditions can be reset if the eviction was unsuccessful and a new Eviction intent has
+  // been submitted.
+  //
+  // The maximum length of the conditions list is 100.
+  // +optional
+  // +patchMergeKey=type
+  // +patchStrategy=merge
+  // +listType=map
+  // +listMapKey=type
+  // +k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+  // +k8s:maxItems=100
+  repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 1;
+
+  // observedGeneration is EvictionRequest's .metadata.generation observed by the evictionrequest-controller.
+  // The observed generation value cannot be negative and can only be incremented.
+  // The minimum value is 1.
+  // This field is managed by evictionrequest-controller.
+  // +optional
+  // +k8s:optional
+  // +k8s:minimum=1
+  // +k8s:update=NoUnset
+  // +k8s:monotonic
+  optional int64 observedGeneration = 2;
+}
+
+// EvictionRequestTarget contains a reference to an object that should be evicted.
+// +union
+message EvictionRequestTarget {
+  // pod references a pod that is subject to eviction/termination.
+  // Pods that are part of a PodGroup (.spec.schedulingGroup is set) are not supported.
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional EvictionRequestPodReference pod = 1;
+}
+
+// EvictionSpec is a specification of an Eviction.
+message EvictionSpec {
+  // target contains a reference to an object (e.g. a pod) that should be evicted.
+  // This field is required and immutable.
+  // +required
+  // +k8s:immutable
+  optional EvictionTarget target = 1;
+}
+
+// EvictionStatus represents the last observed status of the eviction request.
+message EvictionStatus {
+  // conditions contain information about the eviction request.
+  //
+  // Eviction specific conditions are: TargetEvicted or Failed (managed by evictionrequest-controller).
+  // - Failed means that the eviction request is no longer being processed
+  //   by any eviction responder. This can happen if the request is canceled or if no responder
+  //   managed to evict the target (e.g. terminate or delete a pod).
+  // - TargetEvicted means that the target has been evicted (e.g. a pod has been terminated or deleted).
+  //
+  // 	The maximum length of the conditions list is 100.
+  // +optional
+  // +patchMergeKey=type
+  // +patchStrategy=merge
+  // +listType=map
+  // +listMapKey=type
+  // +k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+  // +k8s:maxItems=100
+  repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 1;
+
+  // observedGeneration is Eviction's .metadata.generation observed by the evictionrequest-controller.
+  // The observed generation value cannot be negative and can only be incremented.
+  // The minimum value is 1.
+  // This field is managed by evictionrequest-controller.
+  // +optional
+  // +k8s:optional
+  // +k8s:minimum=1
+  // +k8s:monotonic
+  // +k8s:update=NoUnset
+  optional int64 observedGeneration = 2;
+
+  // requesters allow you to identify the entities, that requested the eviction of the target.
+  // If all the requesters withdraw their eviction intent, the eviction will be canceled.
+  //
+  // The maximum length of the requesters list is 100.
+  // If this limit is exceeded, requesters with Withdrawn intent should be dropped first.
+  // +optional
+  // +patchMergeKey=name
+  // +patchStrategy=merge
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=100
+  repeated Requester requesters = 3;
+
+  // targetResponders reference responders that should eventually respond to this eviction
+  // to help with the graceful eviction of a target. These responders are selected sequentially,
+  // according to their specified priority by setting the Active state to the TargetResponder
+  // .state field. The maximum number of active responders allowed is 1.
+  // Eventually each responder can end up in an Interrupted, Canceled or, Completed state.
+  // Responders should observe these states in order to navigate their lifecycle.
+  //
+  // If the target is a pod, the field is populated from Pod's .spec.evictionResponders. Default
+  // responders may be added to the list according to the target.
+  //
+  // Default responders:
+  // - imperative-eviction.k8s.io/evictor responder with a priority of 100 is added to the list if the
+  //   target is a pod. It will call the imperative Eviction API (pods/<name>/eviction subresource).
+  //   This call may not succeed due to PodDisruptionBudgets, which may block the pod termination.
+  //   It will update the responder message and try again with a backoff.
+  //
+  // The maximum length of the responders list is 11.
+  // The length and keys of the list cannot change once set.
+  // This field is managed by evictionrequest-controller.
+  // +optional
+  // +patchMergeKey=name
+  // +patchStrategy=merge
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=11
+  repeated TargetResponder targetResponders = 4;
+
+  // responders represents the eviction process status of each declared responder.
+  //
+  // The responder list should be the same length and have the same .name fields as
+  // .status.targetResponders. Only responders with .name that have Active state in
+  // .targetResponders[].state should be updated and can be mutated. First initialization
+  // of the list is allowed.
+  //
+  // Each ResponderStatus is initialized by evictionrequest-controller and then managed by
+  // the designated responder.
+  // +optional
+  // +patchMergeKey=name
+  // +patchStrategy=merge
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=11
+  repeated ResponderStatus responders = 5;
+}
+
+// EvictionTarget contains a reference to an object that should be evicted.
+// +union
+message EvictionTarget {
+  // pod references a pod that is subject to eviction/termination.
+  // Pods that are part of a PodGroup (.spec.schedulingGroup is set) are not supported.
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional EvictionPodReference pod = 1;
+}
+
+// Requester allows you to identify the entity, that requested the eviction of the target.
+// +structType=atomic
+message Requester {
+  // name allows you to identify the entity, that requested the eviction of the target.
+  //
+  // It must be a valid domain-prefixed key (such as "acme.io/foo").
+  // This field must be unique for each requester.
+  // This field is required.
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-prefixed-label-key
+  optional string name = 1;
+
+  // intent specifies the action that should be taken for the specified target.
+  //
+  // - Eviction means that the requester is interested in the eviction of the target.
+  // - Withdrawn means that the requester is no longer interested in the eviction of the target.
+  //   If all requesters' intents are withdrawn, the eviction will be canceled.
+  //   Cancellation consequences:
+  //   - Inactive responders will never run.
+  //   - Active responders are expected to cancel the eviction.
+  //   - Completed or Interrupted responders should not take any action.
+  // +required
+  // +k8s:required
+  optional string intent = 2;
+}
+
+// ResponderStatus represents the last observed status of the eviction process of the responder.
+// It should be only updated by the designated responder whose name is .name field.
+// +structType=granular
+message ResponderStatus {
+  // name allows you to identify the responder reacting to the Eviction.
+  //
+  // It must be a valid domain-prefixed key (such as "acme.io/foo").
+  // This field is initialized by Kubernetes and must be unique for each responder.
+  // This field is required.
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-prefixed-label-key
+  optional string name = 1;
+
+  // startTime tracks the time at which this responder was designated as active and should start
+  // processing the eviction request.
+  // It should reflect the present time when set.
+  // This field is initialized by Kubernetes when this responder becomes active.
+  // This field becomes immutable once set.
+  // +optional
+  // +k8s:optional
+  // +k8s:update=NoModify
+  // +k8s:update=NoUnset
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time startTime = 2;
+
+  // heartbeatTime is the last time at which the eviction process was reported to be in progress
+  // by the responder.
+  // It should reflect the present time when set.
+  // Responders should avoid heartbeats more frequent than 20 seconds to avoid overloading the
+  // control-plane.
+  // +optional
+  // +k8s:optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time heartbeatTime = 3;
+
+  // expectedCompletionTime is the time at which the eviction process step is expected to end for the
+  // responder.
+  // The time cannot be set to the past.
+  // May be omitted if no estimate can be made.
+  // +optional
+  // +k8s:optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time expectedCompletionTime = 4;
+
+  // completionTime tracks the time at which the Responder stopped processing the eviction request.
+  // Completion means that the responders has either fully or partially completed the
+  // eviction process, which may have resulted in target eviction (e.g. pod termination).
+  // It should reflect the present time when set.
+  // This field becomes immutable once set.
+  // +optional
+  // +k8s:optional
+  // +k8s:update=NoModify
+  // +k8s:update=NoUnset
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time completionTime = 5;
+
+  // message provides human-readable details about the state of the responder and the eviction
+  // process.
+  // Maximum length is 4000 characters.
+  // +optional
+  // +k8s:optional
+  // +k8s:maxLength=4000
+  optional string message = 6;
+}
+
+// TargetResponder allows you to specify the responder reacting to the Eviction.
+// Responders should observe and communicate through the Eviction API (see .state) to help
+// with the graceful eviction of a target (e.g. termination of a pod).
+// +structType=atomic
+message TargetResponder {
+  // name allows you to identify the responder reacting to the Eviction.
+  //
+  // It must be a valid domain-prefixed key (such as "acme.io/foo").
+  // This field must be unique for each responder.
+  // This field is required.
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-prefixed-label-key
+  optional string name = 1;
+
+  // priority for this responder. Higher priorities are selected first by the evictionrequest-controller.
+  // If there are responders with the same priority, the responder whose domain name comes first in the
+  // alphabetical higher domain order, will be picked. This means that the top domain labels are compared
+  // alphabetically first, followed by the lower domain labels. The key is compared last.
+  //
+  // The responder that is the managing controller of the pod should set the value of
+  // this field to 10000 to allow both for preemption or fallback registration by other
+  // responders.
+  //
+  // The minimum value is 0 and the maximum value is 100000.
+  // The interval 0-999 is reserved for responders with *.k8s.io suffix.
+  // This field is required and immutable.
+  // +required
+  // +k8s:required
+  // +k8s:minimum=0
+  // +k8s:maximum=100000
+  // +k8s:update=NoModify
+  // +k8s:update=NoUnset
+  optional int32 priority = 2;
+
+  // state specifies a state that is assigned by the evictionrequest-controller. Responders should observe
+  // this state in order to navigate their lifecycle.
+  // - Inactive means that the responder should not yet process this eviction request.
+  // - Active means that the responder is either running or expected to start soon.
+  //   Also, startTime has been set in the ResponderStatus by the evictionrequest-controller.
+  //
+  //   An active responder should currently interact with the eviction process by updating
+  //   .status.responders, where .name is the active responder name. ResponderStatus fields
+  //   should be periodically updated to indicate the progress or completion of the eviction process.
+  //   If .status.responders[].heartbeatTime field is not updated within the heartbeat deadline defined
+  //   by the Eviction API (currently 20 minutes), the eviction is passed over to the next responder
+  // 	 with a lower priority. Only one responder can be active at a time.
+  // - Interrupted means that the responder has failed to start or failed to update
+  //   heartbeatTime in ResponderStatus in a timely manner.
+  // - Canceled means that the responder has been canceled. In other words, there	is no
+  //   EvictionRequest with the same target and Eviction intent in .spec.intent.
+  // - Completed means that the responder has successfully completed and set completionTime
+  //   in ResponderStatus.
+  //
+  // Please refer to the ResponderStatus in .status.responders for more details on each responder.
+  // +required
+  // +k8s:required
+  optional string state = 3;
+}
+
diff --git a/vendor/k8s.io/api/lifecycle/v1alpha1/register.go b/vendor/k8s.io/api/lifecycle/v1alpha1/register.go
new file mode 100644
index 0000000000..1efd341724
--- /dev/null
+++ b/vendor/k8s.io/api/lifecycle/v1alpha1/register.go
@@ -0,0 +1,55 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName is the group name use in this package
+const GroupName = "lifecycle.k8s.io"
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// TODO: move SchemeBuilder with zz_generated.deepcopy.go to k8s.io/api.
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      = runtime.NewSchemeBuilder(addKnownTypes)
+	localSchemeBuilder = &SchemeBuilder
+	AddToScheme        = localSchemeBuilder.AddToScheme
+)
+
+// Adds the list of known types to api.Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&Eviction{},
+		&EvictionList{},
+		&EvictionRequest{},
+		&EvictionRequestList{},
+	)
+
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}
diff --git a/vendor/k8s.io/api/lifecycle/v1alpha1/types.go b/vendor/k8s.io/api/lifecycle/v1alpha1/types.go
new file mode 100644
index 0000000000..42bbb44cf3
--- /dev/null
+++ b/vendor/k8s.io/api/lifecycle/v1alpha1/types.go
@@ -0,0 +1,680 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	apimachinerytypes "k8s.io/apimachinery/pkg/types"
+)
+
+const (
+	// EvictionResponderImperativeEviction is a default responder that will evict pods using the imperative
+	// Eviction API (pods/<name>/eviction subresource) with a backoff.
+	EvictionResponderImperativeEviction string = "imperative-eviction.k8s.io/evictor"
+)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+// +k8s:supportsSubresource="/status"
+
+// EvictionRequest defines a request that should ideally result in a graceful eviction of a
+// .spec.target (e.g. termination of a pod).
+//
+// The evictionrequest-controller observes intents of all EvictionRequests and transforms them into
+// Evictions.
+//   - .spec.requester is set as a label on the Eviction for easier lookup.
+//   - Each target can have a set of responders assigned to it. Eviction objects are observed by
+//     these responders, who implement the eviction logic and update the Eviction's status with
+//     progress.
+//
+// There is many-to-many relationship between EvictionRequests and Evictions in general.
+// And many-to-one if the target is a  pod.
+//
+// If all requesters withdraw their eviction intent for a common target, the eviction will be
+// canceled. Deleting an EvictionRequest also counts as a withdrawal.
+// Once all EvictionRequest of a target are removed, the corresponding Evictions are eventually
+// garbage collected.
+//
+// +k8s:validation-gen-nolint // Note: remove this when the API got GA
+type EvictionRequest struct {
+	metav1.TypeMeta `json:",inline"`
+
+	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
+	// +optional
+	// +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:format=k8s-long-name
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// spec defines the eviction request specification.
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	// +required
+	Spec EvictionRequestSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
+
+	// status represents the most recently observed status of the eviction request.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	// +optional
+	Status EvictionRequestStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
+}
+
+// EvictionRequestSpec is a specification of an EvictionRequest.
+type EvictionRequestSpec struct {
+	// target contains a reference to an object (e.g. a pod) that should be evicted.
+	// This field is required and immutable.
+	// +required
+	// +k8s:immutable
+	Target EvictionRequestTarget `json:"target" protobuf:"bytes,1,opt,name=target"`
+
+	// requester allows you to identify the entity, that requested the eviction of the target.
+	//
+	// It must be a valid domain-prefixed key (such as "acme.io/foo").
+	// Domain names *.k8s.io and *.kubernetes.io are reserved.
+	// This field is required and immutable.
+	// +required
+	// +k8s:required
+	// +k8s:immutable
+	// +k8s:format=k8s-prefixed-label-key
+	// +k8s:customValidation
+	Requester string `json:"requester" protobuf:"bytes,2,opt,name=requester"`
+
+	// intent specifies the action that should be taken for the specified target.
+	//
+	// - Eviction means that the requester is interested in the eviction of the target.
+	// - Withdrawn means that the requester is no longer interested in the eviction of the target.
+	//   If all requesters' intents are withdrawn for a common target, the eviction will be canceled.
+	//   Cancellation consequences:
+	//   - Inactive responders will never run.
+	//   - Active responders are expected to cancel the eviction.
+	//   - Completed or Interrupted responders should not take any action.
+	// +required
+	// +k8s:required
+	Intent EvictionRequestIntent `json:"intent" protobuf:"bytes,3,opt,name=intent,casttype=EvictionRequestIntent"`
+}
+
+// EvictionRequestTarget contains a reference to an object that should be evicted.
+// +union
+type EvictionRequestTarget struct {
+	// pod references a pod that is subject to eviction/termination.
+	// Pods that are part of a PodGroup (.spec.schedulingGroup is set) are not supported.
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	Pod *EvictionRequestPodReference `json:"pod,omitempty" protobuf:"bytes,1,opt,name=pod"`
+}
+
+// EvictionRequestPodReference contains enough information to locate the referenced pod inside the
+// same namespace.
+type EvictionRequestPodReference struct {
+	// name of the target.
+	// This field is required.
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-long-name
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+	// uid of the target.
+	// It can be found in .metadata.uid of the target and is a lowercase UUID in 8-4-4-4-12 format.
+	// This field is required.
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-uuid
+	UID apimachinerytypes.UID `json:"uid" protobuf:"bytes,2,opt,name=uid,casttype=k8s.io/apimachinery/pkg/types.UID"`
+}
+
+// EvictionRequestIntent specifies a requester intent.
+// +enum
+// +k8s:enum
+type EvictionRequestIntent string
+
+// These are intents that can be set by each requester.
+const (
+	// EvictionRequestIntentEviction means that the requester is interested in the eviction of the target.
+	EvictionRequestIntentEviction EvictionRequestIntent = "Eviction"
+
+	// EvictionRequestIntentWithdrawn means that the requester is no longer interested in the eviction of the target.
+	// If all requesters' intents are withdrawn for a common target, the eviction will be canceled.
+	// Cancellation consequences:
+	// - Inactive responders will never run.
+	// - Active responders are expected to cancel the eviction.
+	// - Completed or Interrupted responders should not take any action.
+	EvictionRequestIntentWithdrawn EvictionRequestIntent = "Withdrawn"
+)
+
+// EvictionRequestStatus represents the last observed status of the eviction request.
+type EvictionRequestStatus struct {
+	// conditions contain information about the eviction request.
+	//
+	// EvictionRequest specific conditions are: TargetEvicted or Failed (managed by evictionrequest-controller).
+	// - Failed means that the eviction request is no longer being processed
+	//   by any eviction responder. This can happen if the request is canceled or if no responder
+	//   managed to evict the target (e.g. terminate or delete a pod).
+	// - TargetEvicted means that the target has been evicted (e.g. a pod has been terminated or deleted).
+	//
+	// These conditions can be reset if the eviction was unsuccessful and a new Eviction intent has
+	// been submitted.
+	//
+	// The maximum length of the conditions list is 100.
+	// +optional
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	// +k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+	// +k8s:maxItems=100
+	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
+
+	// observedGeneration is EvictionRequest's .metadata.generation observed by the evictionrequest-controller.
+	// The observed generation value cannot be negative and can only be incremented.
+	// The minimum value is 1.
+	// This field is managed by evictionrequest-controller.
+	// +optional
+	// +k8s:optional
+	// +k8s:minimum=1
+	// +k8s:update=NoUnset
+	// +k8s:monotonic
+	ObservedGeneration *int64 `json:"observedGeneration,omitempty" protobuf:"varint,2,opt,name=observedGeneration"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+
+// EvictionRequestList contains a list of EvictionRequests resources.
+type EvictionRequestList struct {
+	metav1.TypeMeta `json:",inline"`
+	// metadata is the standard list metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// items is the list of EvictionRequests.
+	Items []EvictionRequest `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+// +k8s:supportsSubresource="/status"
+
+// Eviction initiates an eviction process, which should ideally result in a graceful eviction of a
+// .spec.target (e.g. termination of a pod).
+//
+// The evictionrequest-controller observes intents of all EvictionRequests and transforms them into
+// Evictions. It manages the Eviction lifecycle.
+// Requesters are preserved in .status.requesters even after they have withdrawn their request.
+// If all requesters withdraw their eviction intent for a common target, the eviction will be
+// canceled. Once all EvictionRequest corresponding to this Eviction .spec.target have been
+// removed, this Eviction object will eventually be garbage collected.
+//
+// If the target is a pod, the .status.targetResponders is populated from Pod's
+// .spec.evictionResponders.
+//
+// Responders should observe and communicate through the .status to help with the eviction
+// of the target when they see their state == Active in .status.targetResponders. ResponderStatus
+// struct should then be periodically updated to indicate the progress or completion of the eviction
+// process by each responder in .status.responders. If .status.responders[].heartbeatTime is not
+// updated within the heartbeat deadline defined by the Eviction API (currently 20 minutes), the
+// eviction is passed over to the next responder with a lower priority.
+//
+// If there are no other responders and the target is a pod, the last default
+// imperative-eviction.k8s.io/evictor responder with a priority of 100 will evict the pod using the
+// imperative Eviction API (pods/<name>/eviction subresource).
+// +k8s:validation-gen-nolint // Note: remove this when the API got GA
+type Eviction struct {
+	metav1.TypeMeta `json:",inline"`
+
+	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
+	// .metadata.name set by the evictionrequest-controller is purely informative and subject to change.
+	// .spec.target field should be used to identify the target precisesly.
+	//
+	// The requester and responder names will be used as label keys and added to the labels of the
+	// eviction in one of the following formats:
+	// 1. acme.io/foo: "requester"
+	// 2. acme.io/foo: "responder"
+	// 3. acme.io/foo: "requester-responder"
+	//
+	// Please see EvictionParticipantRole for available role label values.
+	// +optional
+	// +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:format=k8s-long-name
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// spec defines the eviction specification.
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	// +required
+	Spec EvictionSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
+
+	// status represents the most recently observed status of the eviction.
+	// Populated by responders and evictionrequest-controller.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	// +optional
+	Status EvictionStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
+}
+
+// EvictionParticipantRole specifies a role of an eviction participant intent.
+type EvictionParticipantRole string
+
+const (
+	// EvictionParticipantRoleRequester identifies a requester which creates EvictionRequests.
+	EvictionParticipantRoleRequester EvictionParticipantRole = "requester"
+
+	// EvictionParticipantRoleResponder identifies a responder which responds to an Eviction.
+	EvictionParticipantRoleResponder EvictionParticipantRole = "responder"
+
+	// EvictionParticipantRoleRequesterResponder is both a "requester" and a "responder" at the same time.
+	EvictionParticipantRoleRequesterResponder EvictionParticipantRole = "requester-responder"
+)
+
+// EvictionSpec is a specification of an Eviction.
+type EvictionSpec struct {
+	// target contains a reference to an object (e.g. a pod) that should be evicted.
+	// This field is required and immutable.
+	// +required
+	// +k8s:immutable
+	Target EvictionTarget `json:"target" protobuf:"bytes,1,opt,name=target"`
+}
+
+// EvictionTarget contains a reference to an object that should be evicted.
+// +union
+type EvictionTarget struct {
+	// pod references a pod that is subject to eviction/termination.
+	// Pods that are part of a PodGroup (.spec.schedulingGroup is set) are not supported.
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	Pod *EvictionPodReference `json:"pod,omitempty" protobuf:"bytes,1,opt,name=pod"`
+}
+
+// EvictionPodReference contains enough information to locate the referenced pod inside the same
+// namespace.
+type EvictionPodReference struct {
+	// name of the target.
+	// This field is required.
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-long-name
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+	// uid of the target.
+	// It can be found in .metadata.uid of the target and is a lowercase UUID in 8-4-4-4-12 format.
+	// This field is required.
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-uuid
+	UID apimachinerytypes.UID `json:"uid" protobuf:"bytes,2,opt,name=uid,casttype=k8s.io/apimachinery/pkg/types.UID"`
+}
+
+// EvictionStatus represents the last observed status of the eviction request.
+type EvictionStatus struct {
+	// conditions contain information about the eviction request.
+	//
+	// Eviction specific conditions are: TargetEvicted or Failed (managed by evictionrequest-controller).
+	// - Failed means that the eviction request is no longer being processed
+	//   by any eviction responder. This can happen if the request is canceled or if no responder
+	//   managed to evict the target (e.g. terminate or delete a pod).
+	// - TargetEvicted means that the target has been evicted (e.g. a pod has been terminated or deleted).
+	//
+	// 	The maximum length of the conditions list is 100.
+	// +optional
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	// +k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+	// +k8s:maxItems=100
+	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
+
+	// observedGeneration is Eviction's .metadata.generation observed by the evictionrequest-controller.
+	// The observed generation value cannot be negative and can only be incremented.
+	// The minimum value is 1.
+	// This field is managed by evictionrequest-controller.
+	// +optional
+	// +k8s:optional
+	// +k8s:minimum=1
+	// +k8s:monotonic
+	// +k8s:update=NoUnset
+	ObservedGeneration *int64 `json:"observedGeneration,omitempty" protobuf:"varint,2,opt,name=observedGeneration"`
+
+	// requesters allow you to identify the entities, that requested the eviction of the target.
+	// If all the requesters withdraw their eviction intent, the eviction will be canceled.
+	//
+	// The maximum length of the requesters list is 100.
+	// If this limit is exceeded, requesters with Withdrawn intent should be dropped first.
+	// +optional
+	// +patchMergeKey=name
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=100
+	Requesters []Requester `json:"requesters,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,3,rep,name=requesters"`
+
+	// targetResponders reference responders that should eventually respond to this eviction
+	// to help with the graceful eviction of a target. These responders are selected sequentially,
+	// according to their specified priority by setting the Active state to the TargetResponder
+	// .state field. The maximum number of active responders allowed is 1.
+	// Eventually each responder can end up in an Interrupted, Canceled or, Completed state.
+	// Responders should observe these states in order to navigate their lifecycle.
+	//
+	// If the target is a pod, the field is populated from Pod's .spec.evictionResponders. Default
+	// responders may be added to the list according to the target.
+	//
+	// Default responders:
+	// - imperative-eviction.k8s.io/evictor responder with a priority of 100 is added to the list if the
+	//   target is a pod. It will call the imperative Eviction API (pods/<name>/eviction subresource).
+	//   This call may not succeed due to PodDisruptionBudgets, which may block the pod termination.
+	//   It will update the responder message and try again with a backoff.
+	//
+	// The maximum length of the responders list is 11.
+	// The length and keys of the list cannot change once set.
+	// This field is managed by evictionrequest-controller.
+	// +optional
+	// +patchMergeKey=name
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=11
+	TargetResponders []TargetResponder `json:"targetResponders,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,4,rep,name=targetResponders"`
+
+	// responders represents the eviction process status of each declared responder.
+	//
+	// The responder list should be the same length and have the same .name fields as
+	// .status.targetResponders. Only responders with .name that have Active state in
+	// .targetResponders[].state should be updated and can be mutated. First initialization
+	// of the list is allowed.
+	//
+	// Each ResponderStatus is initialized by evictionrequest-controller and then managed by
+	// the designated responder.
+	// +optional
+	// +patchMergeKey=name
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=11
+	Responders []ResponderStatus `json:"responders,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,5,rep,name=responders"`
+}
+
+type EvictionConditionType string
+
+// These are built-in conditions of an eviction request.
+const (
+	// EvictionConditionFailed means that the eviction request is no longer being processed
+	// by any eviction responder. This can happen if the request is canceled or if no responder
+	// managed to evict the target (e.g. terminate or delete a pod).
+	EvictionConditionFailed EvictionConditionType = "Failed"
+
+	// EvictionConditionTargetEvicted means that the target has been evicted (e.g. a pod has been
+	// terminated or deleted).
+	EvictionConditionTargetEvicted EvictionConditionType = "TargetEvicted"
+)
+
+type EvictionConditionReason string
+
+// These are built-in condition reasons of an eviction request.
+const (
+	// EvictionConditionReasonAwaitingEviction means that this Eviction works as expected and the target
+	// is scheduled for an eviction.
+	// This reason is set for the Failed and TargetEvicted condition.
+	EvictionConditionReasonAwaitingEviction EvictionConditionReason = "AwaitingEviction"
+	// EvictionConditionReasonEvictionInvalid means that the Eviction is not accepted because the
+	// initial configuration is not valid.
+	// This reason is set for the Failed condition.
+	EvictionConditionReasonEvictionInvalid EvictionConditionReason = "EvictionInvalid"
+	// EvictionConditionReasonCanceledDueToNoRequesters means that the Eviction is canceled because there is no
+	// EvictionRequest with the same target and Eviction intent in .spec.intent.
+	// This reason is set for the Failed condition.
+	EvictionConditionReasonCanceledDueToNoRequesters EvictionConditionReason = "CanceledDueToNoRequesters"
+	// EvictionConditionReasonSucceeded means that the Eviction has successfully evicted the target.
+	// This reason is set for the Failed condition.
+	EvictionConditionReasonSucceeded EvictionConditionReason = "Succeeded"
+	// EvictionConditionReasonNoFurtherResponder means that the Eviction responders failed to evict
+	// the target and that no further responder is available.
+	// This reason is set for the Failed condition.
+	EvictionConditionReasonNoFurtherResponder EvictionConditionReason = "NoFurtherResponder"
+	// EvictionConditionReasonPodDeleted means that the target pod has been deleted.
+	// This reason is set for the TargetEvicted condition.
+	EvictionConditionReasonPodDeleted EvictionConditionReason = "PodDeleted"
+	// EvictionConditionReasonPodTerminal means that the target pod has reached a terminal state.
+	// This reason is set for the TargetEvicted condition.
+	EvictionConditionReasonPodTerminal EvictionConditionReason = "PodTerminal"
+	// EvictionConditionReasonEvictionFailed means that the eviction of the target was unsuccessful.
+	// This reason is set for the TargetEvicted condition.
+	EvictionConditionReasonEvictionFailed EvictionConditionReason = "EvictionFailed"
+)
+
+// Requester allows you to identify the entity, that requested the eviction of the target.
+// +structType=atomic
+type Requester struct {
+	// name allows you to identify the entity, that requested the eviction of the target.
+	//
+	// It must be a valid domain-prefixed key (such as "acme.io/foo").
+	// This field must be unique for each requester.
+	// This field is required.
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-prefixed-label-key
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+
+	// intent specifies the action that should be taken for the specified target.
+	//
+	// - Eviction means that the requester is interested in the eviction of the target.
+	// - Withdrawn means that the requester is no longer interested in the eviction of the target.
+	//   If all requesters' intents are withdrawn, the eviction will be canceled.
+	//   Cancellation consequences:
+	//   - Inactive responders will never run.
+	//   - Active responders are expected to cancel the eviction.
+	//   - Completed or Interrupted responders should not take any action.
+	// +required
+	// +k8s:required
+	Intent RequesterIntent `json:"intent" protobuf:"bytes,2,opt,name=intent,casttype=RequesterIntent"`
+}
+
+// RequesterIntent specifies a requester intent.
+// +enum
+// +k8s:enum
+type RequesterIntent string
+
+// These are intents that can be set by each requester.
+const (
+	// RequesterIntentEviction means that the requester is interested in the eviction of the target.
+	RequesterIntentEviction RequesterIntent = "Eviction"
+
+	// RequesterIntentWithdrawn means that the requester is no longer interested in the eviction of the target.
+	// If all requesters' intents are withdrawn, the eviction will be canceled.
+	// Cancellation consequences:
+	// - Inactive responders will never run.
+	// - Active responders are expected to cancel the eviction.
+	// - Completed or Interrupted responders should not take any action.
+	RequesterIntentWithdrawn RequesterIntent = "Withdrawn"
+)
+
+// TargetResponder allows you to specify the responder reacting to the Eviction.
+// Responders should observe and communicate through the Eviction API (see .state) to help
+// with the graceful eviction of a target (e.g. termination of a pod).
+// +structType=atomic
+type TargetResponder struct {
+	// name allows you to identify the responder reacting to the Eviction.
+	//
+	// It must be a valid domain-prefixed key (such as "acme.io/foo").
+	// This field must be unique for each responder.
+	// This field is required.
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-prefixed-label-key
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+
+	// priority for this responder. Higher priorities are selected first by the evictionrequest-controller.
+	// If there are responders with the same priority, the responder whose domain name comes first in the
+	// alphabetical higher domain order, will be picked. This means that the top domain labels are compared
+	// alphabetically first, followed by the lower domain labels. The key is compared last.
+	//
+	// The responder that is the managing controller of the pod should set the value of
+	// this field to 10000 to allow both for preemption or fallback registration by other
+	// responders.
+	//
+	// The minimum value is 0 and the maximum value is 100000.
+	// The interval 0-999 is reserved for responders with *.k8s.io suffix.
+	// This field is required and immutable.
+	// +required
+	// +k8s:required
+	// +k8s:minimum=0
+	// +k8s:maximum=100000
+	// +k8s:update=NoModify
+	// +k8s:update=NoUnset
+	Priority *int32 `json:"priority" protobuf:"varint,2,opt,name=priority"`
+
+	// state specifies a state that is assigned by the evictionrequest-controller. Responders should observe
+	// this state in order to navigate their lifecycle.
+	// - Inactive means that the responder should not yet process this eviction request.
+	// - Active means that the responder is either running or expected to start soon.
+	//   Also, startTime has been set in the ResponderStatus by the evictionrequest-controller.
+	//
+	//   An active responder should currently interact with the eviction process by updating
+	//   .status.responders, where .name is the active responder name. ResponderStatus fields
+	//   should be periodically updated to indicate the progress or completion of the eviction process.
+	//   If .status.responders[].heartbeatTime field is not updated within the heartbeat deadline defined
+	//   by the Eviction API (currently 20 minutes), the eviction is passed over to the next responder
+	//	 with a lower priority. Only one responder can be active at a time.
+	// - Interrupted means that the responder has failed to start or failed to update
+	//   heartbeatTime in ResponderStatus in a timely manner.
+	// - Canceled means that the responder has been canceled. In other words, there	is no
+	//   EvictionRequest with the same target and Eviction intent in .spec.intent.
+	// - Completed means that the responder has successfully completed and set completionTime
+	//   in ResponderStatus.
+	//
+	// Please refer to the ResponderStatus in .status.responders for more details on each responder.
+	// +required
+	// +k8s:required
+	State ResponderStateType `json:"state" protobuf:"bytes,3,opt,name=state,casttype=ResponderStateType"`
+}
+
+// ResponderStateType specifies a state that is assigned by the evictionrequest-controller.
+// +enum
+// +k8s:enum
+type ResponderStateType string
+
+const (
+	// ResponderStateInactive means that the responder should not yet process this eviction request.
+	ResponderStateInactive ResponderStateType = "Inactive"
+
+	// ResponderStateActive means that the responder is either running or expected to start soon.
+	// Also, startTime has been set in the ResponderStatus by the evictionrequest-controller.
+	//
+	// An active responder should currently interact with the eviction process by updating
+	// .status.responders, where .name is the active responder name. ResponderStatus fields
+	// should be periodically updated to indicate the progress or completion of the eviction process.
+	// If .status.responders[].heartbeatTime field is not updated within the heartbeat deadline defined
+	// by the Eviction API (currently 20 minutes), the eviction is passed over to the next responder
+	// with a lower priority. Only one responder can be active at a time.
+	ResponderStateActive ResponderStateType = "Active"
+
+	// ResponderStateInterrupted means that the responder has failed to start or failed to update
+	// heartbeatTime in ResponderStatus in a timely manner.
+	ResponderStateInterrupted ResponderStateType = "Interrupted"
+
+	// ResponderStateCanceled means that the responder has been canceled. In other words, there
+	// is no EvictionRequest with the same target and Eviction intent in .spec.intent.
+	ResponderStateCanceled ResponderStateType = "Canceled"
+
+	// ResponderStateCompleted means that the responder has successfully completed and set completionTime
+	// in ResponderStatus.
+	ResponderStateCompleted ResponderStateType = "Completed"
+)
+
+// ResponderStatus represents the last observed status of the eviction process of the responder.
+// It should be only updated by the designated responder whose name is .name field.
+// +structType=granular
+type ResponderStatus struct {
+	// name allows you to identify the responder reacting to the Eviction.
+	//
+	// It must be a valid domain-prefixed key (such as "acme.io/foo").
+	// This field is initialized by Kubernetes and must be unique for each responder.
+	// This field is required.
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-prefixed-label-key
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+
+	// startTime tracks the time at which this responder was designated as active and should start
+	// processing the eviction request.
+	// It should reflect the present time when set.
+	// This field is initialized by Kubernetes when this responder becomes active.
+	// This field becomes immutable once set.
+	// +optional
+	// +k8s:optional
+	// +k8s:update=NoModify
+	// +k8s:update=NoUnset
+	StartTime *metav1.Time `json:"startTime,omitempty" protobuf:"bytes,2,opt,name=startTime"`
+
+	// heartbeatTime is the last time at which the eviction process was reported to be in progress
+	// by the responder.
+	// It should reflect the present time when set.
+	// Responders should avoid heartbeats more frequent than 20 seconds to avoid overloading the
+	// control-plane.
+	// +optional
+	// +k8s:optional
+	HeartbeatTime *metav1.Time `json:"heartbeatTime,omitempty" protobuf:"bytes,3,opt,name=heartbeatTime"`
+
+	// expectedCompletionTime is the time at which the eviction process step is expected to end for the
+	// responder.
+	// The time cannot be set to the past.
+	// May be omitted if no estimate can be made.
+	// +optional
+	// +k8s:optional
+	ExpectedCompletionTime *metav1.Time `json:"expectedCompletionTime,omitempty" protobuf:"bytes,4,opt,name=expectedCompletionTime"`
+
+	// completionTime tracks the time at which the Responder stopped processing the eviction request.
+	// Completion means that the responders has either fully or partially completed the
+	// eviction process, which may have resulted in target eviction (e.g. pod termination).
+	// It should reflect the present time when set.
+	// This field becomes immutable once set.
+	// +optional
+	// +k8s:optional
+	// +k8s:update=NoModify
+	// +k8s:update=NoUnset
+	CompletionTime *metav1.Time `json:"completionTime,omitempty" protobuf:"bytes,5,opt,name=completionTime"`
+
+	// message provides human-readable details about the state of the responder and the eviction
+	// process.
+	// Maximum length is 4000 characters.
+	// +optional
+	// +k8s:optional
+	// +k8s:maxLength=4000
+	Message *string `json:"message,omitempty" protobuf:"bytes,6,opt,name=message"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+
+// EvictionList contains a list of Eviction resources.
+type EvictionList struct {
+	metav1.TypeMeta `json:",inline"`
+	// metadata is the standard list metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// items is the list of Evictions.
+	Items []Eviction `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
diff --git a/vendor/k8s.io/api/lifecycle/v1alpha1/types_swagger_doc_generated.go b/vendor/k8s.io/api/lifecycle/v1alpha1/types_swagger_doc_generated.go
new file mode 100644
index 0000000000..3646f84345
--- /dev/null
+++ b/vendor/k8s.io/api/lifecycle/v1alpha1/types_swagger_doc_generated.go
@@ -0,0 +1,188 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+// This file contains a collection of methods that can be used from go-restful to
+// generate Swagger API documentation for its models. Please read this PR for more
+// information on the implementation: https://github.com/emicklei/go-restful/pull/215
+//
+// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if
+// they are on one line! For multiple line or blocks that you want to ignore use ---.
+// Any context after a --- is ignored.
+//
+// Those methods can be generated by using hack/update-codegen.sh
+
+// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
+var map_Eviction = map[string]string{
+	"":         "Eviction initiates an eviction process, which should ideally result in a graceful eviction of a .spec.target (e.g. termination of a pod).\n\nThe evictionrequest-controller observes intents of all EvictionRequests and transforms them into Evictions. It manages the Eviction lifecycle. Requesters are preserved in .status.requesters even after they have withdrawn their request. If all requesters withdraw their eviction intent for a common target, the eviction will be canceled. Once all EvictionRequest corresponding to this Eviction .spec.target have been removed, this Eviction object will eventually be garbage collected.\n\nIf the target is a pod, the .status.targetResponders is populated from Pod's .spec.evictionResponders.\n\nResponders should observe and communicate through the .status to help with the eviction of the target when they see their state == Active in .status.targetResponders. ResponderStatus struct should then be periodically updated to indicate the progress or completion of the eviction process by each responder in .status.responders. If .status.responders[].heartbeatTime is not updated within the heartbeat deadline defined by the Eviction API (currently 20 minutes), the eviction is passed over to the next responder with a lower priority.\n\nIf there are no other responders and the target is a pod, the last default imperative-eviction.k8s.io/evictor responder with a priority of 100 will evict the pod using the imperative Eviction API (pods/<name>/eviction subresource).",
+	"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata. .metadata.name set by the evictionrequest-controller is purely informative and subject to change. .spec.target field should be used to identify the target precisesly.\n\nThe requester and responder names will be used as label keys and added to the labels of the eviction in one of the following formats: 1. acme.io/foo: \"requester\" 2. acme.io/foo: \"responder\" 3. acme.io/foo: \"requester-responder\"\n\nPlease see EvictionParticipantRole for available role label values.",
+	"spec":     "spec defines the eviction specification. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
+	"status":   "status represents the most recently observed status of the eviction. Populated by responders and evictionrequest-controller. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
+}
+
+func (Eviction) SwaggerDoc() map[string]string {
+	return map_Eviction
+}
+
+var map_EvictionList = map[string]string{
+	"":         "EvictionList contains a list of Eviction resources.",
+	"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"items":    "items is the list of Evictions.",
+}
+
+func (EvictionList) SwaggerDoc() map[string]string {
+	return map_EvictionList
+}
+
+var map_EvictionPodReference = map[string]string{
+	"":     "EvictionPodReference contains enough information to locate the referenced pod inside the same namespace.",
+	"name": "name of the target. This field is required.",
+	"uid":  "uid of the target. It can be found in .metadata.uid of the target and is a lowercase UUID in 8-4-4-4-12 format. This field is required.",
+}
+
+func (EvictionPodReference) SwaggerDoc() map[string]string {
+	return map_EvictionPodReference
+}
+
+var map_EvictionRequest = map[string]string{
+	"":         "EvictionRequest defines a request that should ideally result in a graceful eviction of a .spec.target (e.g. termination of a pod).\n\nThe evictionrequest-controller observes intents of all EvictionRequests and transforms them into Evictions.\n  - .spec.requester is set as a label on the Eviction for easier lookup.\n  - Each target can have a set of responders assigned to it. Eviction objects are observed by\n    these responders, who implement the eviction logic and update the Eviction's status with\n    progress.\n\nThere is many-to-many relationship between EvictionRequests and Evictions in general. And many-to-one if the target is a  pod.\n\nIf all requesters withdraw their eviction intent for a common target, the eviction will be canceled. Deleting an EvictionRequest also counts as a withdrawal. Once all EvictionRequest of a target are removed, the corresponding Evictions are eventually garbage collected.",
+	"metadata": "metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.",
+	"spec":     "spec defines the eviction request specification. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
+	"status":   "status represents the most recently observed status of the eviction request. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
+}
+
+func (EvictionRequest) SwaggerDoc() map[string]string {
+	return map_EvictionRequest
+}
+
+var map_EvictionRequestList = map[string]string{
+	"":         "EvictionRequestList contains a list of EvictionRequests resources.",
+	"metadata": "metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"items":    "items is the list of EvictionRequests.",
+}
+
+func (EvictionRequestList) SwaggerDoc() map[string]string {
+	return map_EvictionRequestList
+}
+
+var map_EvictionRequestPodReference = map[string]string{
+	"":     "EvictionRequestPodReference contains enough information to locate the referenced pod inside the same namespace.",
+	"name": "name of the target. This field is required.",
+	"uid":  "uid of the target. It can be found in .metadata.uid of the target and is a lowercase UUID in 8-4-4-4-12 format. This field is required.",
+}
+
+func (EvictionRequestPodReference) SwaggerDoc() map[string]string {
+	return map_EvictionRequestPodReference
+}
+
+var map_EvictionRequestSpec = map[string]string{
+	"":          "EvictionRequestSpec is a specification of an EvictionRequest.",
+	"target":    "target contains a reference to an object (e.g. a pod) that should be evicted. This field is required and immutable.",
+	"requester": "requester allows you to identify the entity, that requested the eviction of the target.\n\nIt must be a valid domain-prefixed key (such as \"acme.io/foo\"). Domain names *.k8s.io and *.kubernetes.io are reserved. This field is required and immutable.",
+	"intent":    "intent specifies the action that should be taken for the specified target.\n\n- Eviction means that the requester is interested in the eviction of the target. - Withdrawn means that the requester is no longer interested in the eviction of the target.\n  If all requesters' intents are withdrawn for a common target, the eviction will be canceled.\n  Cancellation consequences:\n  - Inactive responders will never run.\n  - Active responders are expected to cancel the eviction.\n  - Completed or Interrupted responders should not take any action.",
+}
+
+func (EvictionRequestSpec) SwaggerDoc() map[string]string {
+	return map_EvictionRequestSpec
+}
+
+var map_EvictionRequestStatus = map[string]string{
+	"":                   "EvictionRequestStatus represents the last observed status of the eviction request.",
+	"conditions":         "conditions contain information about the eviction request.\n\nEvictionRequest specific conditions are: TargetEvicted or Failed (managed by evictionrequest-controller). - Failed means that the eviction request is no longer being processed\n  by any eviction responder. This can happen if the request is canceled or if no responder\n  managed to evict the target (e.g. terminate or delete a pod).\n- TargetEvicted means that the target has been evicted (e.g. a pod has been terminated or deleted).\n\nThese conditions can be reset if the eviction was unsuccessful and a new Eviction intent has been submitted.\n\nThe maximum length of the conditions list is 100.",
+	"observedGeneration": "observedGeneration is EvictionRequest's .metadata.generation observed by the evictionrequest-controller. The observed generation value cannot be negative and can only be incremented. The minimum value is 1. This field is managed by evictionrequest-controller.",
+}
+
+func (EvictionRequestStatus) SwaggerDoc() map[string]string {
+	return map_EvictionRequestStatus
+}
+
+var map_EvictionRequestTarget = map[string]string{
+	"":    "EvictionRequestTarget contains a reference to an object that should be evicted.",
+	"pod": "pod references a pod that is subject to eviction/termination. Pods that are part of a PodGroup (.spec.schedulingGroup is set) are not supported.",
+}
+
+func (EvictionRequestTarget) SwaggerDoc() map[string]string {
+	return map_EvictionRequestTarget
+}
+
+var map_EvictionSpec = map[string]string{
+	"":       "EvictionSpec is a specification of an Eviction.",
+	"target": "target contains a reference to an object (e.g. a pod) that should be evicted. This field is required and immutable.",
+}
+
+func (EvictionSpec) SwaggerDoc() map[string]string {
+	return map_EvictionSpec
+}
+
+var map_EvictionStatus = map[string]string{
+	"":                   "EvictionStatus represents the last observed status of the eviction request.",
+	"conditions":         "conditions contain information about the eviction request.\n\nEviction specific conditions are: TargetEvicted or Failed (managed by evictionrequest-controller). - Failed means that the eviction request is no longer being processed\n  by any eviction responder. This can happen if the request is canceled or if no responder\n  managed to evict the target (e.g. terminate or delete a pod).\n- TargetEvicted means that the target has been evicted (e.g. a pod has been terminated or deleted).\n\n\tThe maximum length of the conditions list is 100.",
+	"observedGeneration": "observedGeneration is Eviction's .metadata.generation observed by the evictionrequest-controller. The observed generation value cannot be negative and can only be incremented. The minimum value is 1. This field is managed by evictionrequest-controller.",
+	"requesters":         "requesters allow you to identify the entities, that requested the eviction of the target. If all the requesters withdraw their eviction intent, the eviction will be canceled.\n\nThe maximum length of the requesters list is 100. If this limit is exceeded, requesters with Withdrawn intent should be dropped first.",
+	"targetResponders":   "targetResponders reference responders that should eventually respond to this eviction to help with the graceful eviction of a target. These responders are selected sequentially, according to their specified priority by setting the Active state to the TargetResponder .state field. The maximum number of active responders allowed is 1. Eventually each responder can end up in an Interrupted, Canceled or, Completed state. Responders should observe these states in order to navigate their lifecycle.\n\nIf the target is a pod, the field is populated from Pod's .spec.evictionResponders. Default responders may be added to the list according to the target.\n\nDefault responders: - imperative-eviction.k8s.io/evictor responder with a priority of 100 is added to the list if the\n  target is a pod. It will call the imperative Eviction API (pods/<name>/eviction subresource).\n  This call may not succeed due to PodDisruptionBudgets, which may block the pod termination.\n  It will update the responder message and try again with a backoff.\n\nThe maximum length of the responders list is 11. The length and keys of the list cannot change once set. This field is managed by evictionrequest-controller.",
+	"responders":         "responders represents the eviction process status of each declared responder.\n\nThe responder list should be the same length and have the same .name fields as .status.targetResponders. Only responders with .name that have Active state in .targetResponders[].state should be updated and can be mutated. First initialization of the list is allowed.\n\nEach ResponderStatus is initialized by evictionrequest-controller and then managed by the designated responder.",
+}
+
+func (EvictionStatus) SwaggerDoc() map[string]string {
+	return map_EvictionStatus
+}
+
+var map_EvictionTarget = map[string]string{
+	"":    "EvictionTarget contains a reference to an object that should be evicted.",
+	"pod": "pod references a pod that is subject to eviction/termination. Pods that are part of a PodGroup (.spec.schedulingGroup is set) are not supported.",
+}
+
+func (EvictionTarget) SwaggerDoc() map[string]string {
+	return map_EvictionTarget
+}
+
+var map_Requester = map[string]string{
+	"":       "Requester allows you to identify the entity, that requested the eviction of the target.",
+	"name":   "name allows you to identify the entity, that requested the eviction of the target.\n\nIt must be a valid domain-prefixed key (such as \"acme.io/foo\"). This field must be unique for each requester. This field is required.",
+	"intent": "intent specifies the action that should be taken for the specified target.\n\n- Eviction means that the requester is interested in the eviction of the target. - Withdrawn means that the requester is no longer interested in the eviction of the target.\n  If all requesters' intents are withdrawn, the eviction will be canceled.\n  Cancellation consequences:\n  - Inactive responders will never run.\n  - Active responders are expected to cancel the eviction.\n  - Completed or Interrupted responders should not take any action.",
+}
+
+func (Requester) SwaggerDoc() map[string]string {
+	return map_Requester
+}
+
+var map_ResponderStatus = map[string]string{
+	"":                       "ResponderStatus represents the last observed status of the eviction process of the responder. It should be only updated by the designated responder whose name is .name field.",
+	"name":                   "name allows you to identify the responder reacting to the Eviction.\n\nIt must be a valid domain-prefixed key (such as \"acme.io/foo\"). This field is initialized by Kubernetes and must be unique for each responder. This field is required.",
+	"startTime":              "startTime tracks the time at which this responder was designated as active and should start processing the eviction request. It should reflect the present time when set. This field is initialized by Kubernetes when this responder becomes active. This field becomes immutable once set.",
+	"heartbeatTime":          "heartbeatTime is the last time at which the eviction process was reported to be in progress by the responder. It should reflect the present time when set. Responders should avoid heartbeats more frequent than 20 seconds to avoid overloading the control-plane.",
+	"expectedCompletionTime": "expectedCompletionTime is the time at which the eviction process step is expected to end for the responder. The time cannot be set to the past. May be omitted if no estimate can be made.",
+	"completionTime":         "completionTime tracks the time at which the Responder stopped processing the eviction request. Completion means that the responders has either fully or partially completed the eviction process, which may have resulted in target eviction (e.g. pod termination). It should reflect the present time when set. This field becomes immutable once set.",
+	"message":                "message provides human-readable details about the state of the responder and the eviction process. Maximum length is 4000 characters.",
+}
+
+func (ResponderStatus) SwaggerDoc() map[string]string {
+	return map_ResponderStatus
+}
+
+var map_TargetResponder = map[string]string{
+	"":         "TargetResponder allows you to specify the responder reacting to the Eviction. Responders should observe and communicate through the Eviction API (see .state) to help with the graceful eviction of a target (e.g. termination of a pod).",
+	"name":     "name allows you to identify the responder reacting to the Eviction.\n\nIt must be a valid domain-prefixed key (such as \"acme.io/foo\"). This field must be unique for each responder. This field is required.",
+	"priority": "priority for this responder. Higher priorities are selected first by the evictionrequest-controller. If there are responders with the same priority, the responder whose domain name comes first in the alphabetical higher domain order, will be picked. This means that the top domain labels are compared alphabetically first, followed by the lower domain labels. The key is compared last.\n\nThe responder that is the managing controller of the pod should set the value of this field to 10000 to allow both for preemption or fallback registration by other responders.\n\nThe minimum value is 0 and the maximum value is 100000. The interval 0-999 is reserved for responders with *.k8s.io suffix. This field is required and immutable.",
+	"state":    "state specifies a state that is assigned by the evictionrequest-controller. Responders should observe this state in order to navigate their lifecycle. - Inactive means that the responder should not yet process this eviction request. - Active means that the responder is either running or expected to start soon.\n  Also, startTime has been set in the ResponderStatus by the evictionrequest-controller.\n\n  An active responder should currently interact with the eviction process by updating\n  .status.responders, where .name is the active responder name. ResponderStatus fields\n  should be periodically updated to indicate the progress or completion of the eviction process.\n  If .status.responders[].heartbeatTime field is not updated within the heartbeat deadline defined\n  by the Eviction API (currently 20 minutes), the eviction is passed over to the next responder\n\t with a lower priority. Only one responder can be active at a time.\n- Interrupted means that the responder has failed to start or failed to update\n  heartbeatTime in ResponderStatus in a timely manner.\n- Canceled means that the responder has been canceled. In other words, there\tis no\n  EvictionRequest with the same target and Eviction intent in .spec.intent.\n- Completed means that the responder has successfully completed and set completionTime\n  in ResponderStatus.\n\nPlease refer to the ResponderStatus in .status.responders for more details on each responder.",
+}
+
+func (TargetResponder) SwaggerDoc() map[string]string {
+	return map_TargetResponder
+}
+
+// AUTO-GENERATED FUNCTIONS END HERE
diff --git a/vendor/k8s.io/api/lifecycle/v1alpha1/zz_generated.deepcopy.go b/vendor/k8s.io/api/lifecycle/v1alpha1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..1b71bb99fe
--- /dev/null
+++ b/vendor/k8s.io/api/lifecycle/v1alpha1/zz_generated.deepcopy.go
@@ -0,0 +1,406 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Eviction) DeepCopyInto(out *Eviction) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Eviction.
+func (in *Eviction) DeepCopy() *Eviction {
+	if in == nil {
+		return nil
+	}
+	out := new(Eviction)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Eviction) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EvictionList) DeepCopyInto(out *EvictionList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Eviction, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EvictionList.
+func (in *EvictionList) DeepCopy() *EvictionList {
+	if in == nil {
+		return nil
+	}
+	out := new(EvictionList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *EvictionList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EvictionPodReference) DeepCopyInto(out *EvictionPodReference) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EvictionPodReference.
+func (in *EvictionPodReference) DeepCopy() *EvictionPodReference {
+	if in == nil {
+		return nil
+	}
+	out := new(EvictionPodReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EvictionRequest) DeepCopyInto(out *EvictionRequest) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EvictionRequest.
+func (in *EvictionRequest) DeepCopy() *EvictionRequest {
+	if in == nil {
+		return nil
+	}
+	out := new(EvictionRequest)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *EvictionRequest) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EvictionRequestList) DeepCopyInto(out *EvictionRequestList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]EvictionRequest, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EvictionRequestList.
+func (in *EvictionRequestList) DeepCopy() *EvictionRequestList {
+	if in == nil {
+		return nil
+	}
+	out := new(EvictionRequestList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *EvictionRequestList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EvictionRequestPodReference) DeepCopyInto(out *EvictionRequestPodReference) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EvictionRequestPodReference.
+func (in *EvictionRequestPodReference) DeepCopy() *EvictionRequestPodReference {
+	if in == nil {
+		return nil
+	}
+	out := new(EvictionRequestPodReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EvictionRequestSpec) DeepCopyInto(out *EvictionRequestSpec) {
+	*out = *in
+	in.Target.DeepCopyInto(&out.Target)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EvictionRequestSpec.
+func (in *EvictionRequestSpec) DeepCopy() *EvictionRequestSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(EvictionRequestSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EvictionRequestStatus) DeepCopyInto(out *EvictionRequestStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.ObservedGeneration != nil {
+		in, out := &in.ObservedGeneration, &out.ObservedGeneration
+		*out = new(int64)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EvictionRequestStatus.
+func (in *EvictionRequestStatus) DeepCopy() *EvictionRequestStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(EvictionRequestStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EvictionRequestTarget) DeepCopyInto(out *EvictionRequestTarget) {
+	*out = *in
+	if in.Pod != nil {
+		in, out := &in.Pod, &out.Pod
+		*out = new(EvictionRequestPodReference)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EvictionRequestTarget.
+func (in *EvictionRequestTarget) DeepCopy() *EvictionRequestTarget {
+	if in == nil {
+		return nil
+	}
+	out := new(EvictionRequestTarget)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EvictionSpec) DeepCopyInto(out *EvictionSpec) {
+	*out = *in
+	in.Target.DeepCopyInto(&out.Target)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EvictionSpec.
+func (in *EvictionSpec) DeepCopy() *EvictionSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(EvictionSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EvictionStatus) DeepCopyInto(out *EvictionStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.ObservedGeneration != nil {
+		in, out := &in.ObservedGeneration, &out.ObservedGeneration
+		*out = new(int64)
+		**out = **in
+	}
+	if in.Requesters != nil {
+		in, out := &in.Requesters, &out.Requesters
+		*out = make([]Requester, len(*in))
+		copy(*out, *in)
+	}
+	if in.TargetResponders != nil {
+		in, out := &in.TargetResponders, &out.TargetResponders
+		*out = make([]TargetResponder, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Responders != nil {
+		in, out := &in.Responders, &out.Responders
+		*out = make([]ResponderStatus, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EvictionStatus.
+func (in *EvictionStatus) DeepCopy() *EvictionStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(EvictionStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EvictionTarget) DeepCopyInto(out *EvictionTarget) {
+	*out = *in
+	if in.Pod != nil {
+		in, out := &in.Pod, &out.Pod
+		*out = new(EvictionPodReference)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EvictionTarget.
+func (in *EvictionTarget) DeepCopy() *EvictionTarget {
+	if in == nil {
+		return nil
+	}
+	out := new(EvictionTarget)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Requester) DeepCopyInto(out *Requester) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Requester.
+func (in *Requester) DeepCopy() *Requester {
+	if in == nil {
+		return nil
+	}
+	out := new(Requester)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ResponderStatus) DeepCopyInto(out *ResponderStatus) {
+	*out = *in
+	if in.StartTime != nil {
+		in, out := &in.StartTime, &out.StartTime
+		*out = (*in).DeepCopy()
+	}
+	if in.HeartbeatTime != nil {
+		in, out := &in.HeartbeatTime, &out.HeartbeatTime
+		*out = (*in).DeepCopy()
+	}
+	if in.ExpectedCompletionTime != nil {
+		in, out := &in.ExpectedCompletionTime, &out.ExpectedCompletionTime
+		*out = (*in).DeepCopy()
+	}
+	if in.CompletionTime != nil {
+		in, out := &in.CompletionTime, &out.CompletionTime
+		*out = (*in).DeepCopy()
+	}
+	if in.Message != nil {
+		in, out := &in.Message, &out.Message
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResponderStatus.
+func (in *ResponderStatus) DeepCopy() *ResponderStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ResponderStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TargetResponder) DeepCopyInto(out *TargetResponder) {
+	*out = *in
+	if in.Priority != nil {
+		in, out := &in.Priority, &out.Priority
+		*out = new(int32)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TargetResponder.
+func (in *TargetResponder) DeepCopy() *TargetResponder {
+	if in == nil {
+		return nil
+	}
+	out := new(TargetResponder)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/vendor/k8s.io/api/lifecycle/v1alpha1/zz_generated.model_name.go b/vendor/k8s.io/api/lifecycle/v1alpha1/zz_generated.model_name.go
new file mode 100644
index 0000000000..69d36f25fa
--- /dev/null
+++ b/vendor/k8s.io/api/lifecycle/v1alpha1/zz_generated.model_name.go
@@ -0,0 +1,97 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Eviction) OpenAPIModelName() string {
+	return "io.k8s.api.lifecycle.v1alpha1.Eviction"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in EvictionList) OpenAPIModelName() string {
+	return "io.k8s.api.lifecycle.v1alpha1.EvictionList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in EvictionPodReference) OpenAPIModelName() string {
+	return "io.k8s.api.lifecycle.v1alpha1.EvictionPodReference"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in EvictionRequest) OpenAPIModelName() string {
+	return "io.k8s.api.lifecycle.v1alpha1.EvictionRequest"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in EvictionRequestList) OpenAPIModelName() string {
+	return "io.k8s.api.lifecycle.v1alpha1.EvictionRequestList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in EvictionRequestPodReference) OpenAPIModelName() string {
+	return "io.k8s.api.lifecycle.v1alpha1.EvictionRequestPodReference"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in EvictionRequestSpec) OpenAPIModelName() string {
+	return "io.k8s.api.lifecycle.v1alpha1.EvictionRequestSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in EvictionRequestStatus) OpenAPIModelName() string {
+	return "io.k8s.api.lifecycle.v1alpha1.EvictionRequestStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in EvictionRequestTarget) OpenAPIModelName() string {
+	return "io.k8s.api.lifecycle.v1alpha1.EvictionRequestTarget"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in EvictionSpec) OpenAPIModelName() string {
+	return "io.k8s.api.lifecycle.v1alpha1.EvictionSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in EvictionStatus) OpenAPIModelName() string {
+	return "io.k8s.api.lifecycle.v1alpha1.EvictionStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in EvictionTarget) OpenAPIModelName() string {
+	return "io.k8s.api.lifecycle.v1alpha1.EvictionTarget"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Requester) OpenAPIModelName() string {
+	return "io.k8s.api.lifecycle.v1alpha1.Requester"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ResponderStatus) OpenAPIModelName() string {
+	return "io.k8s.api.lifecycle.v1alpha1.ResponderStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TargetResponder) OpenAPIModelName() string {
+	return "io.k8s.api.lifecycle.v1alpha1.TargetResponder"
+}
diff --git a/vendor/k8s.io/api/lifecycle/v1alpha1/zz_generated.prerelease-lifecycle.go b/vendor/k8s.io/api/lifecycle/v1alpha1/zz_generated.prerelease-lifecycle.go
new file mode 100644
index 0000000000..b4fbbf6951
--- /dev/null
+++ b/vendor/k8s.io/api/lifecycle/v1alpha1/zz_generated.prerelease-lifecycle.go
@@ -0,0 +1,94 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by prerelease-lifecycle-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *Eviction) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
+
+// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or  "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
+func (in *Eviction) APILifecycleDeprecated() (major, minor int) {
+	return 1, 40
+}
+
+// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
+func (in *Eviction) APILifecycleRemoved() (major, minor int) {
+	return 1, 43
+}
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *EvictionList) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
+
+// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or  "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
+func (in *EvictionList) APILifecycleDeprecated() (major, minor int) {
+	return 1, 40
+}
+
+// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
+func (in *EvictionList) APILifecycleRemoved() (major, minor int) {
+	return 1, 43
+}
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *EvictionRequest) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
+
+// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or  "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
+func (in *EvictionRequest) APILifecycleDeprecated() (major, minor int) {
+	return 1, 40
+}
+
+// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
+func (in *EvictionRequest) APILifecycleRemoved() (major, minor int) {
+	return 1, 43
+}
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *EvictionRequestList) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
+
+// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or  "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
+func (in *EvictionRequestList) APILifecycleDeprecated() (major, minor int) {
+	return 1, 40
+}
+
+// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
+func (in *EvictionRequestList) APILifecycleRemoved() (major, minor int) {
+	return 1, 43
+}
diff --git a/vendor/k8s.io/api/networking/v1/generated.proto b/vendor/k8s.io/api/networking/v1/generated.proto
index 26dcfdfcc3..8394f2dc08 100644
--- a/vendor/k8s.io/api/networking/v1/generated.proto
+++ b/vendor/k8s.io/api/networking/v1/generated.proto
@@ -80,7 +80,7 @@ message HTTPIngressRuleValue {
 // Valid: 192.168.1.5 or 2001:db8::1 or 2001:db8:aaaa:bbbb:cccc:dddd:eeee:1
 // Invalid: 10.01.2.3 or 2001:db8:0:0:0::1
 message IPAddress {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -104,11 +104,11 @@ message IPAddressList {
 
 // IPAddressSpec describe the attributes in an IP Address.
 message IPAddressSpec {
-  // ParentRef references the resource that an IPAddress is attached to.
+  // parentRef references the resource that an IPAddress is attached to.
   // An IPAddress must reference a parent object.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:immutable
   optional ParentReference parentRef = 1;
 }
 
@@ -119,7 +119,7 @@ message IPBlock {
   // cidr is a string representing the IPBlock
   // Valid examples are "192.168.1.0/24" or "2001:db8::/64"
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string cidr = 1;
 
   // except is a slice of CIDRs that should not be included within an IPBlock
@@ -134,8 +134,9 @@ message IPBlock {
 // endpoints defined by a backend. An Ingress can be configured to give services
 // externally-reachable urls, load balance traffic, terminate SSL, offer name
 // based virtual hosting etc.
+// +k8s:supportsSubresource="/status"
 message Ingress {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -172,7 +173,7 @@ message IngressBackend {
 // single IngressClass resource has this annotation set to true, new Ingress
 // resources without a class specified will be assigned this default class.
 message IngressClass {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -204,12 +205,12 @@ message IngressClassParametersReference {
 
   // kind is the type of resource being referenced.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string kind = 2;
 
   // name is the name of resource being referenced.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string name = 3;
 
   // scope represents if this refers to a cluster or namespace scoped resource.
@@ -238,7 +239,7 @@ message IngressClassSpec {
   // configuration for the controller. This is optional if the controller does
   // not require extra parameters.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional IngressClassParametersReference parameters = 2;
 }
 
@@ -344,6 +345,7 @@ message IngressRule {
 // mixing different types of rules in a single Ingress is disallowed, so exactly
 // one of the following must be set.
 message IngressRuleValue {
+  // http is a HTTP IngressRuleValue, which contains a list of http selectors
   // +optional
   optional HTTPIngressRuleValue http = 1;
 }
@@ -425,7 +427,7 @@ message IngressTLS {
 
 // NetworkPolicy describes what network traffic is allowed for a set of Pods
 message NetworkPolicy {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -455,7 +457,7 @@ message NetworkPolicyEgressRule {
   // allows traffic only if the traffic matches at least one item in the to list.
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated NetworkPolicyPeer to = 2;
 }
 
@@ -478,7 +480,7 @@ message NetworkPolicyIngressRule {
   // allows traffic only if the traffic matches at least one item in the from list.
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated NetworkPolicyPeer from = 2;
 }
 
@@ -517,7 +519,7 @@ message NetworkPolicyPeer {
   // ipBlock defines policy on a particular IPBlock. If this field is set then
   // neither of the other fields can be.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional IPBlock ipBlock = 3;
 }
 
@@ -563,7 +565,7 @@ message NetworkPolicySpec {
   // solely to ensure that the pods it selects are isolated by default)
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated NetworkPolicyIngressRule ingress = 2;
 
   // egress is a list of egress rules to be applied to the selected pods. Outgoing traffic
@@ -575,7 +577,7 @@ message NetworkPolicySpec {
   // This field is beta-level in 1.8
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated NetworkPolicyEgressRule egress = 3;
 
   // policyTypes is a list of rule types that the NetworkPolicy relates to.
@@ -595,22 +597,22 @@ message NetworkPolicySpec {
 
 // ParentReference describes a reference to a parent object.
 message ParentReference {
-  // Group is the group of the object being referenced.
+  // group is the group of the object being referenced.
   // +optional
   optional string group = 1;
 
-  // Resource is the resource of the object being referenced.
+  // resource is the resource of the object being referenced.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string resource = 2;
 
-  // Namespace is the namespace of the object being referenced.
+  // namespace is the namespace of the object being referenced.
   // +optional
   optional string namespace = 3;
 
-  // Name is the name of the object being referenced.
+  // name is the name of the object being referenced.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string name = 4;
 }
 
@@ -630,8 +632,9 @@ message ServiceBackendPort {
 
 // ServiceCIDR defines a range of IP addresses using CIDR format (e.g. 192.168.0.0/24 or 2001:db2::/64).
 // This range is used to allocate ClusterIPs to Service objects.
+// +k8s:supportsSubresource="/status"
 message ServiceCIDR {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -660,7 +663,7 @@ message ServiceCIDRList {
 
 // ServiceCIDRSpec define the CIDRs the user wants to use for allocating ClusterIPs for Services.
 message ServiceCIDRSpec {
-  // CIDRs defines the IP blocks in CIDR notation (e.g. "192.168.0.0/24" or "2001:db8::/64")
+  // cidrs defines the IP blocks in CIDR notation (e.g. "192.168.0.0/24" or "2001:db8::/64")
   // from which to assign service cluster IPs. Max of two CIDRs is allowed, one of each IP family.
   // This field is immutable.
   // +optional
@@ -677,6 +680,7 @@ message ServiceCIDRStatus {
   // +patchStrategy=merge
   // +listType=map
   // +listMapKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:opaqueType
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 1;
 }
 
diff --git a/vendor/k8s.io/api/networking/v1/types.go b/vendor/k8s.io/api/networking/v1/types.go
index a0e737ee15..b455b46c37 100644
--- a/vendor/k8s.io/api/networking/v1/types.go
+++ b/vendor/k8s.io/api/networking/v1/types.go
@@ -28,9 +28,9 @@ import (
 
 // NetworkPolicy describes what network traffic is allowed for a set of Pods
 type NetworkPolicy struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata.
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -77,7 +77,7 @@ type NetworkPolicySpec struct {
 	// solely to ensure that the pods it selects are isolated by default)
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Ingress []NetworkPolicyIngressRule `json:"ingress,omitempty" protobuf:"bytes,2,rep,name=ingress"`
 
 	// egress is a list of egress rules to be applied to the selected pods. Outgoing traffic
@@ -89,7 +89,7 @@ type NetworkPolicySpec struct {
 	// This field is beta-level in 1.8
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Egress []NetworkPolicyEgressRule `json:"egress,omitempty" protobuf:"bytes,3,rep,name=egress"`
 
 	// policyTypes is a list of rule types that the NetworkPolicy relates to.
@@ -126,7 +126,7 @@ type NetworkPolicyIngressRule struct {
 	// allows traffic only if the traffic matches at least one item in the from list.
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	From []NetworkPolicyPeer `json:"from,omitempty" protobuf:"bytes,2,rep,name=from"`
 }
 
@@ -150,7 +150,7 @@ type NetworkPolicyEgressRule struct {
 	// allows traffic only if the traffic matches at least one item in the to list.
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	To []NetworkPolicyPeer `json:"to,omitempty" protobuf:"bytes,2,rep,name=to"`
 }
 
@@ -183,7 +183,7 @@ type IPBlock struct {
 	// cidr is a string representing the IPBlock
 	// Valid examples are "192.168.1.0/24" or "2001:db8::/64"
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	CIDR string `json:"cidr" protobuf:"bytes,1,name=cidr"`
 
 	// except is a slice of CIDRs that should not be included within an IPBlock
@@ -218,7 +218,7 @@ type NetworkPolicyPeer struct {
 	// ipBlock defines policy on a particular IPBlock. If this field is set then
 	// neither of the other fields can be.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	IPBlock *IPBlock `json:"ipBlock,omitempty" protobuf:"bytes,3,rep,name=ipBlock"`
 }
 
@@ -227,7 +227,7 @@ type NetworkPolicyPeer struct {
 
 // NetworkPolicyList is a list of NetworkPolicy objects.
 type NetworkPolicyList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -246,10 +246,11 @@ type NetworkPolicyList struct {
 // endpoints defined by a backend. An Ingress can be configured to give services
 // externally-reachable urls, load balance traffic, terminate SSL, offer name
 // based virtual hosting etc.
+// +k8s:supportsSubresource="/status"
 type Ingress struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata.
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -270,7 +271,7 @@ type Ingress struct {
 
 // IngressList is a collection of Ingress.
 type IngressList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -427,7 +428,7 @@ type IngressRule struct {
 	// default backend, is left to the controller fulfilling the Ingress. Http is
 	// currently the only supported IngressRuleValue.
 	// +optional
-	IngressRuleValue `json:",inline" protobuf:"bytes,2,opt,name=ingressRuleValue"`
+	IngressRuleValue `json:"" protobuf:"bytes,2,opt,name=ingressRuleValue"`
 }
 
 // IngressRuleValue represents a rule to apply against incoming requests. If the
@@ -435,6 +436,7 @@ type IngressRule struct {
 // mixing different types of rules in a single Ingress is disallowed, so exactly
 // one of the following must be set.
 type IngressRuleValue struct {
+	// http is a HTTP IngressRuleValue, which contains a list of http selectors
 	// +optional
 	HTTP *HTTPIngressRuleValue `json:"http,omitempty" protobuf:"bytes,1,opt,name=http"`
 }
@@ -563,9 +565,9 @@ type ServiceBackendPort struct {
 // single IngressClass resource has this annotation set to true, new Ingress
 // resources without a class specified will be assigned this default class.
 type IngressClass struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata.
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -590,7 +592,7 @@ type IngressClassSpec struct {
 	// configuration for the controller. This is optional if the controller does
 	// not require extra parameters.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Parameters *IngressClassParametersReference `json:"parameters,omitempty" protobuf:"bytes,2,opt,name=parameters"`
 }
 
@@ -614,12 +616,12 @@ type IngressClassParametersReference struct {
 
 	// kind is the type of resource being referenced.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Kind string `json:"kind" protobuf:"bytes,2,opt,name=kind"`
 
 	// name is the name of resource being referenced.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Name string `json:"name" protobuf:"bytes,3,opt,name=name"`
 
 	// scope represents if this refers to a cluster or namespace scoped resource.
@@ -639,7 +641,7 @@ type IngressClassParametersReference struct {
 
 // IngressClassList is a collection of IngressClasses.
 type IngressClassList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata.
 	// +optional
@@ -662,8 +664,8 @@ type IngressClassList struct {
 // Valid: 192.168.1.5 or 2001:db8::1 or 2001:db8:aaaa:bbbb:cccc:dddd:eeee:1
 // Invalid: 10.01.2.3 or 2001:db8:0:0:0::1
 type IPAddress struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -675,29 +677,29 @@ type IPAddress struct {
 
 // IPAddressSpec describe the attributes in an IP Address.
 type IPAddressSpec struct {
-	// ParentRef references the resource that an IPAddress is attached to.
+	// parentRef references the resource that an IPAddress is attached to.
 	// An IPAddress must reference a parent object.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:immutable
 	ParentRef *ParentReference `json:"parentRef,omitempty" protobuf:"bytes,1,opt,name=parentRef"`
 }
 
 // ParentReference describes a reference to a parent object.
 type ParentReference struct {
-	// Group is the group of the object being referenced.
+	// group is the group of the object being referenced.
 	// +optional
 	Group string `json:"group,omitempty" protobuf:"bytes,1,opt,name=group"`
-	// Resource is the resource of the object being referenced.
+	// resource is the resource of the object being referenced.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Resource string `json:"resource,omitempty" protobuf:"bytes,2,opt,name=resource"`
-	// Namespace is the namespace of the object being referenced.
+	// namespace is the namespace of the object being referenced.
 	// +optional
 	Namespace string `json:"namespace,omitempty" protobuf:"bytes,3,opt,name=namespace"`
-	// Name is the name of the object being referenced.
+	// name is the name of the object being referenced.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Name string `json:"name,omitempty" protobuf:"bytes,4,opt,name=name"`
 }
 
@@ -706,7 +708,7 @@ type ParentReference struct {
 
 // IPAddressList contains a list of IPAddress.
 type IPAddressList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -722,9 +724,10 @@ type IPAddressList struct {
 
 // ServiceCIDR defines a range of IP addresses using CIDR format (e.g. 192.168.0.0/24 or 2001:db2::/64).
 // This range is used to allocate ClusterIPs to Service objects.
+// +k8s:supportsSubresource="/status"
 type ServiceCIDR struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -740,7 +743,7 @@ type ServiceCIDR struct {
 
 // ServiceCIDRSpec define the CIDRs the user wants to use for allocating ClusterIPs for Services.
 type ServiceCIDRSpec struct {
-	// CIDRs defines the IP blocks in CIDR notation (e.g. "192.168.0.0/24" or "2001:db8::/64")
+	// cidrs defines the IP blocks in CIDR notation (e.g. "192.168.0.0/24" or "2001:db8::/64")
 	// from which to assign service cluster IPs. Max of two CIDRs is allowed, one of each IP family.
 	// This field is immutable.
 	// +optional
@@ -766,6 +769,7 @@ type ServiceCIDRStatus struct {
 	// +patchStrategy=merge
 	// +listType=map
 	// +listMapKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:opaqueType
 	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
 }
 
@@ -774,7 +778,7 @@ type ServiceCIDRStatus struct {
 
 // ServiceCIDRList contains a list of ServiceCIDR objects.
 type ServiceCIDRList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
diff --git a/vendor/k8s.io/api/networking/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/networking/v1/types_swagger_doc_generated.go
index 6210bb7a5a..cb5816b2fd 100644
--- a/vendor/k8s.io/api/networking/v1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/networking/v1/types_swagger_doc_generated.go
@@ -49,7 +49,7 @@ func (HTTPIngressRuleValue) SwaggerDoc() map[string]string {
 
 var map_IPAddress = map[string]string{
 	"":         "IPAddress represents a single IP of a single IP Family. The object is designed to be used by APIs that operate on IP addresses. The object is used by the Service core API for allocation of IP addresses. An IP address can be represented in different formats, to guarantee the uniqueness of the IP, the name of the object is the IP address in canonical format, four decimal digits separated by dots suppressing leading zeros for IPv4 and the representation defined by RFC 5952 for IPv6. Valid: 192.168.1.5 or 2001:db8::1 or 2001:db8:aaaa:bbbb:cccc:dddd:eeee:1 Invalid: 10.01.2.3 or 2001:db8:0:0:0::1",
-	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec is the desired state of the IPAddress. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 }
 
@@ -69,7 +69,7 @@ func (IPAddressList) SwaggerDoc() map[string]string {
 
 var map_IPAddressSpec = map[string]string{
 	"":          "IPAddressSpec describe the attributes in an IP Address.",
-	"parentRef": "ParentRef references the resource that an IPAddress is attached to. An IPAddress must reference a parent object.",
+	"parentRef": "parentRef references the resource that an IPAddress is attached to. An IPAddress must reference a parent object.",
 }
 
 func (IPAddressSpec) SwaggerDoc() map[string]string {
@@ -88,7 +88,7 @@ func (IPBlock) SwaggerDoc() map[string]string {
 
 var map_Ingress = map[string]string{
 	"":         "Ingress is a collection of rules that allow inbound connections to reach the endpoints defined by a backend. An Ingress can be configured to give services externally-reachable urls, load balance traffic, terminate SSL, offer name based virtual hosting etc.",
-	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec is the desired state of the Ingress. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 	"status":   "status is the current state of the Ingress. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 }
@@ -109,7 +109,7 @@ func (IngressBackend) SwaggerDoc() map[string]string {
 
 var map_IngressClass = map[string]string{
 	"":         "IngressClass represents the class of the Ingress, referenced by the Ingress Spec. The `ingressclass.kubernetes.io/is-default-class` annotation can be used to indicate that an IngressClass should be considered default. When a single IngressClass resource has this annotation set to true, new Ingress resources without a class specified will be assigned this default class.",
-	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec is the desired state of the IngressClass. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 }
 
@@ -201,7 +201,8 @@ func (IngressRule) SwaggerDoc() map[string]string {
 }
 
 var map_IngressRuleValue = map[string]string{
-	"": "IngressRuleValue represents a rule to apply against incoming requests. If the rule is satisfied, the request is routed to the specified backend. Currently mixing different types of rules in a single Ingress is disallowed, so exactly one of the following must be set.",
+	"":     "IngressRuleValue represents a rule to apply against incoming requests. If the rule is satisfied, the request is routed to the specified backend. Currently mixing different types of rules in a single Ingress is disallowed, so exactly one of the following must be set.",
+	"http": "http is a HTTP IngressRuleValue, which contains a list of http selectors",
 }
 
 func (IngressRuleValue) SwaggerDoc() map[string]string {
@@ -251,7 +252,7 @@ func (IngressTLS) SwaggerDoc() map[string]string {
 
 var map_NetworkPolicy = map[string]string{
 	"":         "NetworkPolicy describes what network traffic is allowed for a set of Pods",
-	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec represents the specification of the desired behavior for this NetworkPolicy.",
 }
 
@@ -325,10 +326,10 @@ func (NetworkPolicySpec) SwaggerDoc() map[string]string {
 
 var map_ParentReference = map[string]string{
 	"":          "ParentReference describes a reference to a parent object.",
-	"group":     "Group is the group of the object being referenced.",
-	"resource":  "Resource is the resource of the object being referenced.",
-	"namespace": "Namespace is the namespace of the object being referenced.",
-	"name":      "Name is the name of the object being referenced.",
+	"group":     "group is the group of the object being referenced.",
+	"resource":  "resource is the resource of the object being referenced.",
+	"namespace": "namespace is the namespace of the object being referenced.",
+	"name":      "name is the name of the object being referenced.",
 }
 
 func (ParentReference) SwaggerDoc() map[string]string {
@@ -347,7 +348,7 @@ func (ServiceBackendPort) SwaggerDoc() map[string]string {
 
 var map_ServiceCIDR = map[string]string{
 	"":         "ServiceCIDR defines a range of IP addresses using CIDR format (e.g. 192.168.0.0/24 or 2001:db2::/64). This range is used to allocate ClusterIPs to Service objects.",
-	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec is the desired state of the ServiceCIDR. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 	"status":   "status represents the current state of the ServiceCIDR. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 }
@@ -368,7 +369,7 @@ func (ServiceCIDRList) SwaggerDoc() map[string]string {
 
 var map_ServiceCIDRSpec = map[string]string{
 	"":      "ServiceCIDRSpec define the CIDRs the user wants to use for allocating ClusterIPs for Services.",
-	"cidrs": "CIDRs defines the IP blocks in CIDR notation (e.g. \"192.168.0.0/24\" or \"2001:db8::/64\") from which to assign service cluster IPs. Max of two CIDRs is allowed, one of each IP family. This field is immutable.",
+	"cidrs": "cidrs defines the IP blocks in CIDR notation (e.g. \"192.168.0.0/24\" or \"2001:db8::/64\") from which to assign service cluster IPs. Max of two CIDRs is allowed, one of each IP family. This field is immutable.",
 }
 
 func (ServiceCIDRSpec) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/networking/v1beta1/generated.proto b/vendor/k8s.io/api/networking/v1beta1/generated.proto
index a6944d6034..11e2a0123b 100644
--- a/vendor/k8s.io/api/networking/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/networking/v1beta1/generated.proto
@@ -81,7 +81,7 @@ message HTTPIngressRuleValue {
 // Valid: 192.168.1.5 or 2001:db8::1 or 2001:db8:aaaa:bbbb:cccc:dddd:eeee:1
 // Invalid: 10.01.2.3 or 2001:db8:0:0:0::1
 message IPAddress {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -105,11 +105,11 @@ message IPAddressList {
 
 // IPAddressSpec describe the attributes in an IP Address.
 message IPAddressSpec {
-  // ParentRef references the resource that an IPAddress is attached to.
+  // parentRef references the resource that an IPAddress is attached to.
   // An IPAddress must reference a parent object.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:immutable
   optional ParentReference parentRef = 1;
 }
 
@@ -117,8 +117,9 @@ message IPAddressSpec {
 // endpoints defined by a backend. An Ingress can be configured to give services
 // externally-reachable urls, load balance traffic, terminate SSL, offer name
 // based virtual hosting etc.
+// +k8s:supportsSubresource="/status"
 message Ingress {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -157,7 +158,7 @@ message IngressBackend {
 // single IngressClass resource has this annotation set to true, new Ingress
 // resources without a class specified will be assigned this default class.
 message IngressClass {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -189,12 +190,12 @@ message IngressClassParametersReference {
 
   // kind is the type of resource being referenced.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string kind = 2;
 
   // name is the name of resource being referenced.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string name = 3;
 
   // scope represents if this refers to a cluster or namespace scoped resource.
@@ -222,7 +223,7 @@ message IngressClassSpec {
   // configuration for the controller. This is optional if the controller does
   // not require extra parameters.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional IngressClassParametersReference parameters = 2;
 }
 
@@ -328,6 +329,7 @@ message IngressRule {
 // mixing different types of rules in a single Ingress is disallowed, so exactly
 // one of the following must be set.
 message IngressRuleValue {
+  // http is a HTTP IngressRuleValue, which contains a list of http selectors
   // +optional
   optional HTTPIngressRuleValue http = 1;
 }
@@ -398,29 +400,30 @@ message IngressTLS {
 
 // ParentReference describes a reference to a parent object.
 message ParentReference {
-  // Group is the group of the object being referenced.
+  // group is the group of the object being referenced.
   // +optional
   optional string group = 1;
 
-  // Resource is the resource of the object being referenced.
+  // resource is the resource of the object being referenced.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string resource = 2;
 
-  // Namespace is the namespace of the object being referenced.
+  // namespace is the namespace of the object being referenced.
   // +optional
   optional string namespace = 3;
 
-  // Name is the name of the object being referenced.
+  // name is the name of the object being referenced.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string name = 4;
 }
 
 // ServiceCIDR defines a range of IP addresses using CIDR format (e.g. 192.168.0.0/24 or 2001:db2::/64).
 // This range is used to allocate ClusterIPs to Service objects.
+// +k8s:supportsSubresource="/status"
 message ServiceCIDR {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -449,7 +452,7 @@ message ServiceCIDRList {
 
 // ServiceCIDRSpec define the CIDRs the user wants to use for allocating ClusterIPs for Services.
 message ServiceCIDRSpec {
-  // CIDRs defines the IP blocks in CIDR notation (e.g. "192.168.0.0/24" or "2001:db8::/64")
+  // cidrs defines the IP blocks in CIDR notation (e.g. "192.168.0.0/24" or "2001:db8::/64")
   // from which to assign service cluster IPs. Max of two CIDRs is allowed, one of each IP family.
   // This field is immutable.
   // +optional
@@ -466,6 +469,7 @@ message ServiceCIDRStatus {
   // +patchStrategy=merge
   // +listType=map
   // +listMapKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:opaqueType
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 1;
 }
 
diff --git a/vendor/k8s.io/api/networking/v1beta1/types.go b/vendor/k8s.io/api/networking/v1beta1/types.go
index 7cd9b2b58b..73cddf6a7f 100644
--- a/vendor/k8s.io/api/networking/v1beta1/types.go
+++ b/vendor/k8s.io/api/networking/v1beta1/types.go
@@ -32,10 +32,11 @@ import (
 // endpoints defined by a backend. An Ingress can be configured to give services
 // externally-reachable urls, load balance traffic, terminate SSL, offer name
 // based virtual hosting etc.
+// +k8s:supportsSubresource="/status"
 type Ingress struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata.
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -58,7 +59,7 @@ type Ingress struct {
 
 // IngressList is a collection of Ingress.
 type IngressList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -218,7 +219,7 @@ type IngressRule struct {
 	// default backend, is left to the controller fulfilling the Ingress. Http is
 	// currently the only supported IngressRuleValue.
 	// +optional
-	IngressRuleValue `json:",inline" protobuf:"bytes,2,opt,name=ingressRuleValue"`
+	IngressRuleValue `json:"" protobuf:"bytes,2,opt,name=ingressRuleValue"`
 }
 
 // IngressRuleValue represents a rule to apply against incoming requests. If the
@@ -232,6 +233,7 @@ type IngressRuleValue struct {
 	// 2. Consider adding fields for ingress-type specific global options
 	// usable by a loadbalancer, like http keep-alive.
 
+	// http is a HTTP IngressRuleValue, which contains a list of http selectors
 	// +optional
 	HTTP *HTTPIngressRuleValue `json:"http,omitempty" protobuf:"bytes,1,opt,name=http"`
 }
@@ -341,9 +343,9 @@ type IngressBackend struct {
 // single IngressClass resource has this annotation set to true, new Ingress
 // resources without a class specified will be assigned this default class.
 type IngressClass struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata.
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -368,7 +370,7 @@ type IngressClassSpec struct {
 	// configuration for the controller. This is optional if the controller does
 	// not require extra parameters.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Parameters *IngressClassParametersReference `json:"parameters,omitempty" protobuf:"bytes,2,opt,name=parameters"`
 }
 
@@ -392,12 +394,12 @@ type IngressClassParametersReference struct {
 
 	// kind is the type of resource being referenced.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Kind string `json:"kind" protobuf:"bytes,2,opt,name=kind"`
 
 	// name is the name of resource being referenced.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Name string `json:"name" protobuf:"bytes,3,opt,name=name"`
 
 	// scope represents if this refers to a cluster or namespace scoped resource.
@@ -418,7 +420,7 @@ type IngressClassParametersReference struct {
 
 // IngressClassList is a collection of IngressClasses.
 type IngressClassList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -440,8 +442,8 @@ type IngressClassList struct {
 // Valid: 192.168.1.5 or 2001:db8::1 or 2001:db8:aaaa:bbbb:cccc:dddd:eeee:1
 // Invalid: 10.01.2.3 or 2001:db8:0:0:0::1
 type IPAddress struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -453,29 +455,29 @@ type IPAddress struct {
 
 // IPAddressSpec describe the attributes in an IP Address.
 type IPAddressSpec struct {
-	// ParentRef references the resource that an IPAddress is attached to.
+	// parentRef references the resource that an IPAddress is attached to.
 	// An IPAddress must reference a parent object.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:immutable
 	ParentRef *ParentReference `json:"parentRef,omitempty" protobuf:"bytes,1,opt,name=parentRef"`
 }
 
 // ParentReference describes a reference to a parent object.
 type ParentReference struct {
-	// Group is the group of the object being referenced.
+	// group is the group of the object being referenced.
 	// +optional
 	Group string `json:"group,omitempty" protobuf:"bytes,1,opt,name=group"`
-	// Resource is the resource of the object being referenced.
+	// resource is the resource of the object being referenced.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Resource string `json:"resource,omitempty" protobuf:"bytes,2,opt,name=resource"`
-	// Namespace is the namespace of the object being referenced.
+	// namespace is the namespace of the object being referenced.
 	// +optional
 	Namespace string `json:"namespace,omitempty" protobuf:"bytes,3,opt,name=namespace"`
-	// Name is the name of the object being referenced.
+	// name is the name of the object being referenced.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Name string `json:"name,omitempty" protobuf:"bytes,4,opt,name=name"`
 }
 
@@ -484,7 +486,7 @@ type ParentReference struct {
 
 // IPAddressList contains a list of IPAddress.
 type IPAddressList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -500,9 +502,10 @@ type IPAddressList struct {
 
 // ServiceCIDR defines a range of IP addresses using CIDR format (e.g. 192.168.0.0/24 or 2001:db2::/64).
 // This range is used to allocate ClusterIPs to Service objects.
+// +k8s:supportsSubresource="/status"
 type ServiceCIDR struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -518,7 +521,7 @@ type ServiceCIDR struct {
 
 // ServiceCIDRSpec define the CIDRs the user wants to use for allocating ClusterIPs for Services.
 type ServiceCIDRSpec struct {
-	// CIDRs defines the IP blocks in CIDR notation (e.g. "192.168.0.0/24" or "2001:db8::/64")
+	// cidrs defines the IP blocks in CIDR notation (e.g. "192.168.0.0/24" or "2001:db8::/64")
 	// from which to assign service cluster IPs. Max of two CIDRs is allowed, one of each IP family.
 	// This field is immutable.
 	// +optional
@@ -544,6 +547,7 @@ type ServiceCIDRStatus struct {
 	// +patchStrategy=merge
 	// +listType=map
 	// +listMapKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:opaqueType
 	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
 }
 
@@ -552,7 +556,7 @@ type ServiceCIDRStatus struct {
 
 // ServiceCIDRList contains a list of ServiceCIDR objects.
 type ServiceCIDRList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
diff --git a/vendor/k8s.io/api/networking/v1beta1/types_swagger_doc_generated.go b/vendor/k8s.io/api/networking/v1beta1/types_swagger_doc_generated.go
index 9d27517f3b..03d33b5d48 100644
--- a/vendor/k8s.io/api/networking/v1beta1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/networking/v1beta1/types_swagger_doc_generated.go
@@ -49,7 +49,7 @@ func (HTTPIngressRuleValue) SwaggerDoc() map[string]string {
 
 var map_IPAddress = map[string]string{
 	"":         "IPAddress represents a single IP of a single IP Family. The object is designed to be used by APIs that operate on IP addresses. The object is used by the Service core API for allocation of IP addresses. An IP address can be represented in different formats, to guarantee the uniqueness of the IP, the name of the object is the IP address in canonical format, four decimal digits separated by dots suppressing leading zeros for IPv4 and the representation defined by RFC 5952 for IPv6. Valid: 192.168.1.5 or 2001:db8::1 or 2001:db8:aaaa:bbbb:cccc:dddd:eeee:1 Invalid: 10.01.2.3 or 2001:db8:0:0:0::1",
-	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec is the desired state of the IPAddress. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 }
 
@@ -69,7 +69,7 @@ func (IPAddressList) SwaggerDoc() map[string]string {
 
 var map_IPAddressSpec = map[string]string{
 	"":          "IPAddressSpec describe the attributes in an IP Address.",
-	"parentRef": "ParentRef references the resource that an IPAddress is attached to. An IPAddress must reference a parent object.",
+	"parentRef": "parentRef references the resource that an IPAddress is attached to. An IPAddress must reference a parent object.",
 }
 
 func (IPAddressSpec) SwaggerDoc() map[string]string {
@@ -78,7 +78,7 @@ func (IPAddressSpec) SwaggerDoc() map[string]string {
 
 var map_Ingress = map[string]string{
 	"":         "Ingress is a collection of rules that allow inbound connections to reach the endpoints defined by a backend. An Ingress can be configured to give services externally-reachable urls, load balance traffic, terminate SSL, offer name based virtual hosting etc.",
-	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec is the desired state of the Ingress. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 	"status":   "status is the current state of the Ingress. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 }
@@ -100,7 +100,7 @@ func (IngressBackend) SwaggerDoc() map[string]string {
 
 var map_IngressClass = map[string]string{
 	"":         "IngressClass represents the class of the Ingress, referenced by the Ingress Spec. The `ingressclass.kubernetes.io/is-default-class` annotation can be used to indicate that an IngressClass should be considered default. When a single IngressClass resource has this annotation set to true, new Ingress resources without a class specified will be assigned this default class.",
-	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec is the desired state of the IngressClass. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 }
 
@@ -192,7 +192,8 @@ func (IngressRule) SwaggerDoc() map[string]string {
 }
 
 var map_IngressRuleValue = map[string]string{
-	"": "IngressRuleValue represents a rule to apply against incoming requests. If the rule is satisfied, the request is routed to the specified backend. Currently mixing different types of rules in a single Ingress is disallowed, so exactly one of the following must be set.",
+	"":     "IngressRuleValue represents a rule to apply against incoming requests. If the rule is satisfied, the request is routed to the specified backend. Currently mixing different types of rules in a single Ingress is disallowed, so exactly one of the following must be set.",
+	"http": "http is a HTTP IngressRuleValue, which contains a list of http selectors",
 }
 
 func (IngressRuleValue) SwaggerDoc() map[string]string {
@@ -232,10 +233,10 @@ func (IngressTLS) SwaggerDoc() map[string]string {
 
 var map_ParentReference = map[string]string{
 	"":          "ParentReference describes a reference to a parent object.",
-	"group":     "Group is the group of the object being referenced.",
-	"resource":  "Resource is the resource of the object being referenced.",
-	"namespace": "Namespace is the namespace of the object being referenced.",
-	"name":      "Name is the name of the object being referenced.",
+	"group":     "group is the group of the object being referenced.",
+	"resource":  "resource is the resource of the object being referenced.",
+	"namespace": "namespace is the namespace of the object being referenced.",
+	"name":      "name is the name of the object being referenced.",
 }
 
 func (ParentReference) SwaggerDoc() map[string]string {
@@ -244,7 +245,7 @@ func (ParentReference) SwaggerDoc() map[string]string {
 
 var map_ServiceCIDR = map[string]string{
 	"":         "ServiceCIDR defines a range of IP addresses using CIDR format (e.g. 192.168.0.0/24 or 2001:db2::/64). This range is used to allocate ClusterIPs to Service objects.",
-	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec is the desired state of the ServiceCIDR. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 	"status":   "status represents the current state of the ServiceCIDR. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 }
@@ -265,7 +266,7 @@ func (ServiceCIDRList) SwaggerDoc() map[string]string {
 
 var map_ServiceCIDRSpec = map[string]string{
 	"":      "ServiceCIDRSpec define the CIDRs the user wants to use for allocating ClusterIPs for Services.",
-	"cidrs": "CIDRs defines the IP blocks in CIDR notation (e.g. \"192.168.0.0/24\" or \"2001:db8::/64\") from which to assign service cluster IPs. Max of two CIDRs is allowed, one of each IP family. This field is immutable.",
+	"cidrs": "cidrs defines the IP blocks in CIDR notation (e.g. \"192.168.0.0/24\" or \"2001:db8::/64\") from which to assign service cluster IPs. Max of two CIDRs is allowed, one of each IP family. This field is immutable.",
 }
 
 func (ServiceCIDRSpec) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/node/v1/generated.proto b/vendor/k8s.io/api/node/v1/generated.proto
index 4d77c9b781..f368bd85e6 100644
--- a/vendor/k8s.io/api/node/v1/generated.proto
+++ b/vendor/k8s.io/api/node/v1/generated.proto
@@ -45,6 +45,7 @@ message Overhead {
 // pod.  For more details, see
 // https://kubernetes.io/docs/concepts/containers/runtime-class/
 message RuntimeClass {
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -60,9 +61,9 @@ message RuntimeClass {
   // The Handler must be lowercase, conform to the DNS Label (RFC 1123) requirements,
   // and is immutable.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:format="k8s-short-name"
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format="k8s-short-name"
+  // +k8s:beta(since: "1.37")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string handler = 2;
 
   // overhead represents the resource overhead associated with running a pod for a
@@ -76,6 +77,7 @@ message RuntimeClass {
   // If scheduling is nil, this RuntimeClass is assumed to be supported by all
   // nodes.
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   optional Scheduling scheduling = 4;
 }
 
@@ -107,6 +109,7 @@ message Scheduling {
   // tolerated by the pod and the RuntimeClass.
   // +optional
   // +listType=atomic
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   repeated .k8s.io.api.core.v1.Toleration tolerations = 2;
 }
 
diff --git a/vendor/k8s.io/api/node/v1/types.go b/vendor/k8s.io/api/node/v1/types.go
index c2ea739dc8..4d781af2a0 100644
--- a/vendor/k8s.io/api/node/v1/types.go
+++ b/vendor/k8s.io/api/node/v1/types.go
@@ -34,8 +34,9 @@ import (
 // pod.  For more details, see
 // https://kubernetes.io/docs/concepts/containers/runtime-class/
 type RuntimeClass struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -51,9 +52,9 @@ type RuntimeClass struct {
 	// The Handler must be lowercase, conform to the DNS Label (RFC 1123) requirements,
 	// and is immutable.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:format="k8s-short-name"
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format="k8s-short-name"
+	// +k8s:beta(since: "1.37")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Handler string `json:"handler" protobuf:"bytes,2,opt,name=handler"`
 
 	// overhead represents the resource overhead associated with running a pod for a
@@ -67,6 +68,7 @@ type RuntimeClass struct {
 	// If scheduling is nil, this RuntimeClass is assumed to be supported by all
 	// nodes.
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	Scheduling *Scheduling `json:"scheduling,omitempty" protobuf:"bytes,4,opt,name=scheduling"`
 }
 
@@ -94,6 +96,7 @@ type Scheduling struct {
 	// tolerated by the pod and the RuntimeClass.
 	// +optional
 	// +listType=atomic
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	Tolerations []corev1.Toleration `json:"tolerations,omitempty" protobuf:"bytes,2,rep,name=tolerations"`
 }
 
@@ -102,7 +105,7 @@ type Scheduling struct {
 
 // RuntimeClassList is a list of RuntimeClass objects.
 type RuntimeClassList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
diff --git a/vendor/k8s.io/api/node/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/node/v1/types_swagger_doc_generated.go
index f5e6b32779..168f48a58e 100644
--- a/vendor/k8s.io/api/node/v1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/node/v1/types_swagger_doc_generated.go
@@ -38,7 +38,7 @@ func (Overhead) SwaggerDoc() map[string]string {
 
 var map_RuntimeClass = map[string]string{
 	"":           "RuntimeClass defines a class of container runtime supported in the cluster. The RuntimeClass is used to determine which container runtime is used to run all containers in a pod. RuntimeClasses are manually defined by a user or cluster provisioner, and referenced in the PodSpec. The Kubelet is responsible for resolving the RuntimeClassName reference before running the pod.  For more details, see https://kubernetes.io/docs/concepts/containers/runtime-class/",
-	"metadata":   "More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata":   "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"handler":    "handler specifies the underlying runtime and configuration that the CRI implementation will use to handle pods of this class. The possible values are specific to the node & CRI configuration.  It is assumed that all handlers are available on every node, and handlers of the same name are equivalent on every node. For example, a handler called \"runc\" might specify that the runc OCI runtime (using native Linux containers) will be used to run the containers in a pod. The Handler must be lowercase, conform to the DNS Label (RFC 1123) requirements, and is immutable.",
 	"overhead":   "overhead represents the resource overhead associated with running a pod for a given RuntimeClass. For more details, see\n https://kubernetes.io/docs/concepts/scheduling-eviction/pod-overhead/",
 	"scheduling": "scheduling holds the scheduling constraints to ensure that pods running with this RuntimeClass are scheduled to nodes that support it. If scheduling is nil, this RuntimeClass is assumed to be supported by all nodes.",
diff --git a/vendor/k8s.io/api/node/v1alpha1/generated.proto b/vendor/k8s.io/api/node/v1alpha1/generated.proto
index c50b639065..faf8b8c89e 100644
--- a/vendor/k8s.io/api/node/v1alpha1/generated.proto
+++ b/vendor/k8s.io/api/node/v1alpha1/generated.proto
@@ -45,6 +45,7 @@ message Overhead {
 // pod.  For more details, see
 // https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
 message RuntimeClass {
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -82,9 +83,9 @@ message RuntimeClassSpec {
   // The runtimeHandler must be lowercase, conform to the DNS Label (RFC 1123)
   // requirements, and is immutable.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:format="k8s-short-name"
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format="k8s-short-name"
+  // +k8s:beta(since: "1.37")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string runtimeHandler = 1;
 
   // overhead represents the resource overhead associated with running a pod for a
@@ -98,6 +99,7 @@ message RuntimeClassSpec {
   // If scheduling is nil, this RuntimeClass is assumed to be supported by all
   // nodes.
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   optional Scheduling scheduling = 3;
 }
 
@@ -118,6 +120,7 @@ message Scheduling {
   // tolerated by the pod and the RuntimeClass.
   // +optional
   // +listType=atomic
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   repeated .k8s.io.api.core.v1.Toleration tolerations = 2;
 }
 
diff --git a/vendor/k8s.io/api/node/v1alpha1/types.go b/vendor/k8s.io/api/node/v1alpha1/types.go
index 3521335b07..16d2794d44 100644
--- a/vendor/k8s.io/api/node/v1alpha1/types.go
+++ b/vendor/k8s.io/api/node/v1alpha1/types.go
@@ -33,8 +33,9 @@ import (
 // pod.  For more details, see
 // https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
 type RuntimeClass struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -61,9 +62,9 @@ type RuntimeClassSpec struct {
 	// The runtimeHandler must be lowercase, conform to the DNS Label (RFC 1123)
 	// requirements, and is immutable.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:format="k8s-short-name"
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format="k8s-short-name"
+	// +k8s:beta(since: "1.37")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:required
 	RuntimeHandler string `json:"runtimeHandler" protobuf:"bytes,1,opt,name=runtimeHandler"`
 
 	// overhead represents the resource overhead associated with running a pod for a
@@ -77,6 +78,7 @@ type RuntimeClassSpec struct {
 	// If scheduling is nil, this RuntimeClass is assumed to be supported by all
 	// nodes.
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	Scheduling *Scheduling `json:"scheduling,omitempty" protobuf:"bytes,3,opt,name=scheduling"`
 }
 
@@ -104,6 +106,7 @@ type Scheduling struct {
 	// tolerated by the pod and the RuntimeClass.
 	// +optional
 	// +listType=atomic
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	Tolerations []corev1.Toleration `json:"tolerations,omitempty" protobuf:"bytes,2,rep,name=tolerations"`
 }
 
@@ -111,7 +114,7 @@ type Scheduling struct {
 
 // RuntimeClassList is a list of RuntimeClass objects.
 type RuntimeClassList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
diff --git a/vendor/k8s.io/api/node/v1alpha1/types_swagger_doc_generated.go b/vendor/k8s.io/api/node/v1alpha1/types_swagger_doc_generated.go
index ccc1b70853..5c54384789 100644
--- a/vendor/k8s.io/api/node/v1alpha1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/node/v1alpha1/types_swagger_doc_generated.go
@@ -38,7 +38,7 @@ func (Overhead) SwaggerDoc() map[string]string {
 
 var map_RuntimeClass = map[string]string{
 	"":         "RuntimeClass defines a class of container runtime supported in the cluster. The RuntimeClass is used to determine which container runtime is used to run all containers in a pod. RuntimeClasses are (currently) manually defined by a user or cluster provisioner, and referenced in the PodSpec. The Kubelet is responsible for resolving the RuntimeClassName reference before running the pod.  For more details, see https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class",
-	"metadata": "More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec represents specification of the RuntimeClass More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
 }
 
diff --git a/vendor/k8s.io/api/node/v1beta1/generated.proto b/vendor/k8s.io/api/node/v1beta1/generated.proto
index 073a185e2c..51fbfd5e8b 100644
--- a/vendor/k8s.io/api/node/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/node/v1beta1/generated.proto
@@ -45,6 +45,7 @@ message Overhead {
 // pod.  For more details, see
 // https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
 message RuntimeClass {
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -60,9 +61,9 @@ message RuntimeClass {
   // The handler must be lowercase, conform to the DNS Label (RFC 1123) requirements,
   // and is immutable.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:format="k8s-short-name"
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format="k8s-short-name"
+  // +k8s:beta(since: "1.37")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string handler = 2;
 
   // overhead represents the resource overhead associated with running a pod for a
@@ -76,6 +77,7 @@ message RuntimeClass {
   // If scheduling is nil, this RuntimeClass is assumed to be supported by all
   // nodes.
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   optional Scheduling scheduling = 4;
 }
 
@@ -107,6 +109,7 @@ message Scheduling {
   // tolerated by the pod and the RuntimeClass.
   // +optional
   // +listType=atomic
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   repeated .k8s.io.api.core.v1.Toleration tolerations = 2;
 }
 
diff --git a/vendor/k8s.io/api/node/v1beta1/types.go b/vendor/k8s.io/api/node/v1beta1/types.go
index 145e138663..3af85a9ee4 100644
--- a/vendor/k8s.io/api/node/v1beta1/types.go
+++ b/vendor/k8s.io/api/node/v1beta1/types.go
@@ -35,8 +35,9 @@ import (
 // pod.  For more details, see
 // https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
 type RuntimeClass struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -52,9 +53,9 @@ type RuntimeClass struct {
 	// The handler must be lowercase, conform to the DNS Label (RFC 1123) requirements,
 	// and is immutable.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:format="k8s-short-name"
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format="k8s-short-name"
+	// +k8s:beta(since: "1.37")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Handler string `json:"handler" protobuf:"bytes,2,opt,name=handler"`
 
 	// overhead represents the resource overhead associated with running a pod for a
@@ -68,6 +69,7 @@ type RuntimeClass struct {
 	// If scheduling is nil, this RuntimeClass is assumed to be supported by all
 	// nodes.
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	Scheduling *Scheduling `json:"scheduling,omitempty" protobuf:"bytes,4,opt,name=scheduling"`
 }
 
@@ -95,6 +97,7 @@ type Scheduling struct {
 	// tolerated by the pod and the RuntimeClass.
 	// +optional
 	// +listType=atomic
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	Tolerations []corev1.Toleration `json:"tolerations,omitempty" protobuf:"bytes,2,rep,name=tolerations"`
 }
 
@@ -104,7 +107,7 @@ type Scheduling struct {
 
 // RuntimeClassList is a list of RuntimeClass objects.
 type RuntimeClassList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
diff --git a/vendor/k8s.io/api/node/v1beta1/types_swagger_doc_generated.go b/vendor/k8s.io/api/node/v1beta1/types_swagger_doc_generated.go
index 086105ecc5..74991a89f0 100644
--- a/vendor/k8s.io/api/node/v1beta1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/node/v1beta1/types_swagger_doc_generated.go
@@ -38,7 +38,7 @@ func (Overhead) SwaggerDoc() map[string]string {
 
 var map_RuntimeClass = map[string]string{
 	"":           "RuntimeClass defines a class of container runtime supported in the cluster. The RuntimeClass is used to determine which container runtime is used to run all containers in a pod. RuntimeClasses are (currently) manually defined by a user or cluster provisioner, and referenced in the PodSpec. The Kubelet is responsible for resolving the RuntimeClassName reference before running the pod.  For more details, see https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class",
-	"metadata":   "More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata":   "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"handler":    "handler specifies the underlying runtime and configuration that the CRI implementation will use to handle pods of this class. The possible values are specific to the node & CRI configuration.  It is assumed that all handlers are available on every node, and handlers of the same name are equivalent on every node. For example, a handler called \"runc\" might specify that the runc OCI runtime (using native Linux containers) will be used to run the containers in a pod. The handler must be lowercase, conform to the DNS Label (RFC 1123) requirements, and is immutable.",
 	"overhead":   "overhead represents the resource overhead associated with running a pod for a given RuntimeClass. For more details, see https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md",
 	"scheduling": "scheduling holds the scheduling constraints to ensure that pods running with this RuntimeClass are scheduled to nodes that support it. If scheduling is nil, this RuntimeClass is assumed to be supported by all nodes.",
diff --git a/vendor/k8s.io/api/policy/v1/generated.proto b/vendor/k8s.io/api/policy/v1/generated.proto
index 704cc10b7d..ceec53a11f 100644
--- a/vendor/k8s.io/api/policy/v1/generated.proto
+++ b/vendor/k8s.io/api/policy/v1/generated.proto
@@ -33,27 +33,29 @@ option go_package = "k8s.io/api/policy/v1";
 // This is a subresource of Pod.  A request to cause such an eviction is
 // created by POSTing to .../pods/<pod name>/evictions.
 message Eviction {
-  // ObjectMeta describes the pod that is being evicted.
+  // metadata describes the pod that is being evicted.
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // DeleteOptions may be provided
+  // deleteOptions may be provided
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.DeleteOptions deleteOptions = 2;
 }
 
 // PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods
+// +k8s:supportsSubresource="/status"
 message PodDisruptionBudget {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Specification of the desired behavior of the PodDisruptionBudget.
+  // spec is the specification of the desired behavior of the PodDisruptionBudget.
   // +optional
   optional PodDisruptionBudgetSpec spec = 2;
 
-  // Most recently observed status of the PodDisruptionBudget.
+  // status is the most recently observed status of the PodDisruptionBudget.
   // +optional
   optional PodDisruptionBudgetStatus status = 3;
 }
@@ -71,14 +73,14 @@ message PodDisruptionBudgetList {
 
 // PodDisruptionBudgetSpec is a description of a PodDisruptionBudget.
 message PodDisruptionBudgetSpec {
-  // An eviction is allowed if at least "minAvailable" pods selected by
+  // minAvailable indicates that an eviction is allowed if at least "minAvailable" pods selected by
   // "selector" will still be available after the eviction, i.e. even in the
   // absence of the evicted pod.  So for example you can prevent all voluntary
   // evictions by specifying "100%".
   // +optional
   optional .k8s.io.apimachinery.pkg.util.intstr.IntOrString minAvailable = 1;
 
-  // Label query over pods whose evictions are managed by the disruption
+  // selector is a label query over pods whose evictions are managed by the disruption
   // budget.
   // A null selector will match no pods, while an empty ({}) selector will select
   // all pods within the namespace.
@@ -86,14 +88,14 @@ message PodDisruptionBudgetSpec {
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;
 
-  // An eviction is allowed if at most "maxUnavailable" pods selected by
+  // maxUnavailable indicates that an eviction is allowed if at most "maxUnavailable" pods selected by
   // "selector" are unavailable after the eviction, i.e. even in absence of
   // the evicted pod. For example, one can prevent all voluntary evictions
   // by specifying 0. This is a mutually exclusive setting with "minAvailable".
   // +optional
   optional .k8s.io.apimachinery.pkg.util.intstr.IntOrString maxUnavailable = 3;
 
-  // UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
+  // unhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
   // should be considered for eviction. Current implementation considers healthy pods,
   // as pods that have status.conditions item with type="Ready",status="True".
   //
@@ -175,6 +177,9 @@ message PodDisruptionBudgetStatus {
   // +patchStrategy=merge
   // +listType=map
   // +listMapKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 7;
 }
 
diff --git a/vendor/k8s.io/api/policy/v1/types.go b/vendor/k8s.io/api/policy/v1/types.go
index ebf349e317..1d49f92d1f 100644
--- a/vendor/k8s.io/api/policy/v1/types.go
+++ b/vendor/k8s.io/api/policy/v1/types.go
@@ -26,14 +26,14 @@ const DisruptionBudgetCause metav1.CauseType = "DisruptionBudget"
 
 // PodDisruptionBudgetSpec is a description of a PodDisruptionBudget.
 type PodDisruptionBudgetSpec struct {
-	// An eviction is allowed if at least "minAvailable" pods selected by
+	// minAvailable indicates that an eviction is allowed if at least "minAvailable" pods selected by
 	// "selector" will still be available after the eviction, i.e. even in the
 	// absence of the evicted pod.  So for example you can prevent all voluntary
 	// evictions by specifying "100%".
 	// +optional
 	MinAvailable *intstr.IntOrString `json:"minAvailable,omitempty" protobuf:"bytes,1,opt,name=minAvailable"`
 
-	// Label query over pods whose evictions are managed by the disruption
+	// selector is a label query over pods whose evictions are managed by the disruption
 	// budget.
 	// A null selector will match no pods, while an empty ({}) selector will select
 	// all pods within the namespace.
@@ -41,14 +41,14 @@ type PodDisruptionBudgetSpec struct {
 	// +optional
 	Selector *metav1.LabelSelector `json:"selector,omitempty" patchStrategy:"replace" protobuf:"bytes,2,opt,name=selector"`
 
-	// An eviction is allowed if at most "maxUnavailable" pods selected by
+	// maxUnavailable indicates that an eviction is allowed if at most "maxUnavailable" pods selected by
 	// "selector" are unavailable after the eviction, i.e. even in absence of
 	// the evicted pod. For example, one can prevent all voluntary evictions
 	// by specifying 0. This is a mutually exclusive setting with "minAvailable".
 	// +optional
 	MaxUnavailable *intstr.IntOrString `json:"maxUnavailable,omitempty" protobuf:"bytes,3,opt,name=maxUnavailable"`
 
-	// UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
+	// unhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
 	// should be considered for eviction. Current implementation considers healthy pods,
 	// as pods that have status.conditions item with type="Ready",status="True".
 	//
@@ -150,6 +150,9 @@ type PodDisruptionBudgetStatus struct {
 	// +patchStrategy=merge
 	// +listType=map
 	// +listMapKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,7,rep,name=conditions"`
 }
 
@@ -174,17 +177,18 @@ const (
 // +k8s:prerelease-lifecycle-gen:introduced=1.21
 
 // PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods
+// +k8s:supportsSubresource="/status"
 type PodDisruptionBudget struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Specification of the desired behavior of the PodDisruptionBudget.
+	// spec is the specification of the desired behavior of the PodDisruptionBudget.
 	// +optional
 	Spec PodDisruptionBudgetSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
-	// Most recently observed status of the PodDisruptionBudget.
+	// status is the most recently observed status of the PodDisruptionBudget.
 	// +optional
 	Status PodDisruptionBudgetStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
 }
@@ -194,7 +198,7 @@ type PodDisruptionBudget struct {
 
 // PodDisruptionBudgetList is a collection of PodDisruptionBudgets.
 type PodDisruptionBudgetList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -212,13 +216,14 @@ type PodDisruptionBudgetList struct {
 // This is a subresource of Pod.  A request to cause such an eviction is
 // created by POSTing to .../pods/<pod name>/evictions.
 type Eviction struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// ObjectMeta describes the pod that is being evicted.
+	// metadata describes the pod that is being evicted.
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// DeleteOptions may be provided
+	// deleteOptions may be provided
 	// +optional
 	DeleteOptions *metav1.DeleteOptions `json:"deleteOptions,omitempty" protobuf:"bytes,2,opt,name=deleteOptions"`
 }
diff --git a/vendor/k8s.io/api/policy/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/policy/v1/types_swagger_doc_generated.go
index 9b2f5b9450..cf67a76df6 100644
--- a/vendor/k8s.io/api/policy/v1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/policy/v1/types_swagger_doc_generated.go
@@ -29,8 +29,8 @@ package v1
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_Eviction = map[string]string{
 	"":              "Eviction evicts a pod from its node subject to certain policies and safety constraints. This is a subresource of Pod.  A request to cause such an eviction is created by POSTing to .../pods/<pod name>/evictions.",
-	"metadata":      "ObjectMeta describes the pod that is being evicted.",
-	"deleteOptions": "DeleteOptions may be provided",
+	"metadata":      "metadata describes the pod that is being evicted.",
+	"deleteOptions": "deleteOptions may be provided",
 }
 
 func (Eviction) SwaggerDoc() map[string]string {
@@ -39,9 +39,9 @@ func (Eviction) SwaggerDoc() map[string]string {
 
 var map_PodDisruptionBudget = map[string]string{
 	"":         "PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods",
-	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
-	"spec":     "Specification of the desired behavior of the PodDisruptionBudget.",
-	"status":   "Most recently observed status of the PodDisruptionBudget.",
+	"metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"spec":     "spec is the specification of the desired behavior of the PodDisruptionBudget.",
+	"status":   "status is the most recently observed status of the PodDisruptionBudget.",
 }
 
 func (PodDisruptionBudget) SwaggerDoc() map[string]string {
@@ -60,10 +60,10 @@ func (PodDisruptionBudgetList) SwaggerDoc() map[string]string {
 
 var map_PodDisruptionBudgetSpec = map[string]string{
 	"":                           "PodDisruptionBudgetSpec is a description of a PodDisruptionBudget.",
-	"minAvailable":               "An eviction is allowed if at least \"minAvailable\" pods selected by \"selector\" will still be available after the eviction, i.e. even in the absence of the evicted pod.  So for example you can prevent all voluntary evictions by specifying \"100%\".",
-	"selector":                   "Label query over pods whose evictions are managed by the disruption budget. A null selector will match no pods, while an empty ({}) selector will select all pods within the namespace.",
-	"maxUnavailable":             "An eviction is allowed if at most \"maxUnavailable\" pods selected by \"selector\" are unavailable after the eviction, i.e. even in absence of the evicted pod. For example, one can prevent all voluntary evictions by specifying 0. This is a mutually exclusive setting with \"minAvailable\".",
-	"unhealthyPodEvictionPolicy": "UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods should be considered for eviction. Current implementation considers healthy pods, as pods that have status.conditions item with type=\"Ready\",status=\"True\".\n\nValid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy.\n\nIfHealthyBudget policy means that running pods (status.phase=\"Running\"), but not yet healthy can be evicted only if the guarded application is not disrupted (status.currentHealthy is at least equal to status.desiredHealthy). Healthy pods will be subject to the PDB for eviction.\n\nAlwaysAllow policy means that all running pods (status.phase=\"Running\"), but not yet healthy are considered disrupted and can be evicted regardless of whether the criteria in a PDB is met. This means perspective running pods of a disrupted application might not get a chance to become healthy. Healthy pods will be subject to the PDB for eviction.\n\nAdditional policies may be added in the future. Clients making eviction decisions should disallow eviction of unhealthy pods if they encounter an unrecognized policy in this field.",
+	"minAvailable":               "minAvailable indicates that an eviction is allowed if at least \"minAvailable\" pods selected by \"selector\" will still be available after the eviction, i.e. even in the absence of the evicted pod.  So for example you can prevent all voluntary evictions by specifying \"100%\".",
+	"selector":                   "selector is a label query over pods whose evictions are managed by the disruption budget. A null selector will match no pods, while an empty ({}) selector will select all pods within the namespace.",
+	"maxUnavailable":             "maxUnavailable indicates that an eviction is allowed if at most \"maxUnavailable\" pods selected by \"selector\" are unavailable after the eviction, i.e. even in absence of the evicted pod. For example, one can prevent all voluntary evictions by specifying 0. This is a mutually exclusive setting with \"minAvailable\".",
+	"unhealthyPodEvictionPolicy": "unhealthyPodEvictionPolicy defines the criteria for when unhealthy pods should be considered for eviction. Current implementation considers healthy pods, as pods that have status.conditions item with type=\"Ready\",status=\"True\".\n\nValid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy.\n\nIfHealthyBudget policy means that running pods (status.phase=\"Running\"), but not yet healthy can be evicted only if the guarded application is not disrupted (status.currentHealthy is at least equal to status.desiredHealthy). Healthy pods will be subject to the PDB for eviction.\n\nAlwaysAllow policy means that all running pods (status.phase=\"Running\"), but not yet healthy are considered disrupted and can be evicted regardless of whether the criteria in a PDB is met. This means perspective running pods of a disrupted application might not get a chance to become healthy. Healthy pods will be subject to the PDB for eviction.\n\nAdditional policies may be added in the future. Clients making eviction decisions should disallow eviction of unhealthy pods if they encounter an unrecognized policy in this field.",
 }
 
 func (PodDisruptionBudgetSpec) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/policy/v1beta1/generated.proto b/vendor/k8s.io/api/policy/v1beta1/generated.proto
index a8200a2d78..be469ba611 100644
--- a/vendor/k8s.io/api/policy/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/policy/v1beta1/generated.proto
@@ -33,27 +33,29 @@ option go_package = "k8s.io/api/policy/v1beta1";
 // This is a subresource of Pod.  A request to cause such an eviction is
 // created by POSTing to .../pods/<pod name>/evictions.
 message Eviction {
-  // ObjectMeta describes the pod that is being evicted.
+  // metadata describes the pod that is being evicted.
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // DeleteOptions may be provided
+  // deleteOptions may be provided
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.DeleteOptions deleteOptions = 2;
 }
 
 // PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods
+// +k8s:supportsSubresource="/status"
 message PodDisruptionBudget {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Specification of the desired behavior of the PodDisruptionBudget.
+  // spec is the specification of the desired behavior of the PodDisruptionBudget.
   // +optional
   optional PodDisruptionBudgetSpec spec = 2;
 
-  // Most recently observed status of the PodDisruptionBudget.
+  // status is the most recently observed status of the PodDisruptionBudget.
   // +optional
   optional PodDisruptionBudgetStatus status = 3;
 }
@@ -71,14 +73,14 @@ message PodDisruptionBudgetList {
 
 // PodDisruptionBudgetSpec is a description of a PodDisruptionBudget.
 message PodDisruptionBudgetSpec {
-  // An eviction is allowed if at least "minAvailable" pods selected by
+  // minAvailable indicates that an eviction is allowed if at least "minAvailable" pods selected by
   // "selector" will still be available after the eviction, i.e. even in the
   // absence of the evicted pod.  So for example you can prevent all voluntary
   // evictions by specifying "100%".
   // +optional
   optional .k8s.io.apimachinery.pkg.util.intstr.IntOrString minAvailable = 1;
 
-  // Label query over pods whose evictions are managed by the disruption
+  // selector is a label query over pods whose evictions are managed by the disruption
   // budget.
   // A null selector selects no pods.
   // An empty selector ({}) also selects no pods, which differs from standard behavior of selecting all pods.
@@ -86,14 +88,14 @@ message PodDisruptionBudgetSpec {
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;
 
-  // An eviction is allowed if at most "maxUnavailable" pods selected by
+  // maxUnavailable indicates that an eviction is allowed if at most "maxUnavailable" pods selected by
   // "selector" are unavailable after the eviction, i.e. even in absence of
   // the evicted pod. For example, one can prevent all voluntary evictions
   // by specifying 0. This is a mutually exclusive setting with "minAvailable".
   // +optional
   optional .k8s.io.apimachinery.pkg.util.intstr.IntOrString maxUnavailable = 3;
 
-  // UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
+  // unhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
   // should be considered for eviction. Current implementation considers healthy pods,
   // as pods that have status.conditions item with type="Ready",status="True".
   //
@@ -175,6 +177,9 @@ message PodDisruptionBudgetStatus {
   // +patchStrategy=merge
   // +listType=map
   // +listMapKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 7;
 }
 
diff --git a/vendor/k8s.io/api/policy/v1beta1/types.go b/vendor/k8s.io/api/policy/v1beta1/types.go
index 354c22a3d0..6017d4179d 100644
--- a/vendor/k8s.io/api/policy/v1beta1/types.go
+++ b/vendor/k8s.io/api/policy/v1beta1/types.go
@@ -23,14 +23,14 @@ import (
 
 // PodDisruptionBudgetSpec is a description of a PodDisruptionBudget.
 type PodDisruptionBudgetSpec struct {
-	// An eviction is allowed if at least "minAvailable" pods selected by
+	// minAvailable indicates that an eviction is allowed if at least "minAvailable" pods selected by
 	// "selector" will still be available after the eviction, i.e. even in the
 	// absence of the evicted pod.  So for example you can prevent all voluntary
 	// evictions by specifying "100%".
 	// +optional
 	MinAvailable *intstr.IntOrString `json:"minAvailable,omitempty" protobuf:"bytes,1,opt,name=minAvailable"`
 
-	// Label query over pods whose evictions are managed by the disruption
+	// selector is a label query over pods whose evictions are managed by the disruption
 	// budget.
 	// A null selector selects no pods.
 	// An empty selector ({}) also selects no pods, which differs from standard behavior of selecting all pods.
@@ -38,14 +38,14 @@ type PodDisruptionBudgetSpec struct {
 	// +optional
 	Selector *metav1.LabelSelector `json:"selector,omitempty" protobuf:"bytes,2,opt,name=selector"`
 
-	// An eviction is allowed if at most "maxUnavailable" pods selected by
+	// maxUnavailable indicates that an eviction is allowed if at most "maxUnavailable" pods selected by
 	// "selector" are unavailable after the eviction, i.e. even in absence of
 	// the evicted pod. For example, one can prevent all voluntary evictions
 	// by specifying 0. This is a mutually exclusive setting with "minAvailable".
 	// +optional
 	MaxUnavailable *intstr.IntOrString `json:"maxUnavailable,omitempty" protobuf:"bytes,3,opt,name=maxUnavailable"`
 
-	// UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
+	// unhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
 	// should be considered for eviction. Current implementation considers healthy pods,
 	// as pods that have status.conditions item with type="Ready",status="True".
 	//
@@ -147,6 +147,9 @@ type PodDisruptionBudgetStatus struct {
 	// +patchStrategy=merge
 	// +listType=map
 	// +listMapKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,7,rep,name=conditions"`
 }
 
@@ -174,18 +177,19 @@ const (
 // +k8s:prerelease-lifecycle-gen:replacement=policy,v1,PodDisruptionBudget
 
 // PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods
+// +k8s:supportsSubresource="/status"
 type PodDisruptionBudget struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata.
+	// metadata is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Specification of the desired behavior of the PodDisruptionBudget.
+	// spec is the specification of the desired behavior of the PodDisruptionBudget.
 	// +optional
 	Spec PodDisruptionBudgetSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
-	// Most recently observed status of the PodDisruptionBudget.
+	// status is the most recently observed status of the PodDisruptionBudget.
 	// +optional
 	Status PodDisruptionBudgetStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
 }
@@ -198,7 +202,7 @@ type PodDisruptionBudget struct {
 
 // PodDisruptionBudgetList is a collection of PodDisruptionBudgets.
 type PodDisruptionBudgetList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -218,13 +222,14 @@ type PodDisruptionBudgetList struct {
 // This is a subresource of Pod.  A request to cause such an eviction is
 // created by POSTing to .../pods/<pod name>/evictions.
 type Eviction struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// ObjectMeta describes the pod that is being evicted.
+	// metadata describes the pod that is being evicted.
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// DeleteOptions may be provided
+	// deleteOptions may be provided
 	// +optional
 	DeleteOptions *metav1.DeleteOptions `json:"deleteOptions,omitempty" protobuf:"bytes,2,opt,name=deleteOptions"`
 }
diff --git a/vendor/k8s.io/api/policy/v1beta1/types_swagger_doc_generated.go b/vendor/k8s.io/api/policy/v1beta1/types_swagger_doc_generated.go
index cffc9a548c..cffdcdd42b 100644
--- a/vendor/k8s.io/api/policy/v1beta1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/policy/v1beta1/types_swagger_doc_generated.go
@@ -29,8 +29,8 @@ package v1beta1
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_Eviction = map[string]string{
 	"":              "Eviction evicts a pod from its node subject to certain policies and safety constraints. This is a subresource of Pod.  A request to cause such an eviction is created by POSTing to .../pods/<pod name>/evictions.",
-	"metadata":      "ObjectMeta describes the pod that is being evicted.",
-	"deleteOptions": "DeleteOptions may be provided",
+	"metadata":      "metadata describes the pod that is being evicted.",
+	"deleteOptions": "deleteOptions may be provided",
 }
 
 func (Eviction) SwaggerDoc() map[string]string {
@@ -39,9 +39,9 @@ func (Eviction) SwaggerDoc() map[string]string {
 
 var map_PodDisruptionBudget = map[string]string{
 	"":         "PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods",
-	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
-	"spec":     "Specification of the desired behavior of the PodDisruptionBudget.",
-	"status":   "Most recently observed status of the PodDisruptionBudget.",
+	"metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"spec":     "spec is the specification of the desired behavior of the PodDisruptionBudget.",
+	"status":   "status is the most recently observed status of the PodDisruptionBudget.",
 }
 
 func (PodDisruptionBudget) SwaggerDoc() map[string]string {
@@ -60,10 +60,10 @@ func (PodDisruptionBudgetList) SwaggerDoc() map[string]string {
 
 var map_PodDisruptionBudgetSpec = map[string]string{
 	"":                           "PodDisruptionBudgetSpec is a description of a PodDisruptionBudget.",
-	"minAvailable":               "An eviction is allowed if at least \"minAvailable\" pods selected by \"selector\" will still be available after the eviction, i.e. even in the absence of the evicted pod.  So for example you can prevent all voluntary evictions by specifying \"100%\".",
-	"selector":                   "Label query over pods whose evictions are managed by the disruption budget. A null selector selects no pods. An empty selector ({}) also selects no pods, which differs from standard behavior of selecting all pods. In policy/v1, an empty selector will select all pods in the namespace.",
-	"maxUnavailable":             "An eviction is allowed if at most \"maxUnavailable\" pods selected by \"selector\" are unavailable after the eviction, i.e. even in absence of the evicted pod. For example, one can prevent all voluntary evictions by specifying 0. This is a mutually exclusive setting with \"minAvailable\".",
-	"unhealthyPodEvictionPolicy": "UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods should be considered for eviction. Current implementation considers healthy pods, as pods that have status.conditions item with type=\"Ready\",status=\"True\".\n\nValid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy.\n\nIfHealthyBudget policy means that running pods (status.phase=\"Running\"), but not yet healthy can be evicted only if the guarded application is not disrupted (status.currentHealthy is at least equal to status.desiredHealthy). Healthy pods will be subject to the PDB for eviction.\n\nAlwaysAllow policy means that all running pods (status.phase=\"Running\"), but not yet healthy are considered disrupted and can be evicted regardless of whether the criteria in a PDB is met. This means perspective running pods of a disrupted application might not get a chance to become healthy. Healthy pods will be subject to the PDB for eviction.\n\nAdditional policies may be added in the future. Clients making eviction decisions should disallow eviction of unhealthy pods if they encounter an unrecognized policy in this field.",
+	"minAvailable":               "minAvailable indicates that an eviction is allowed if at least \"minAvailable\" pods selected by \"selector\" will still be available after the eviction, i.e. even in the absence of the evicted pod.  So for example you can prevent all voluntary evictions by specifying \"100%\".",
+	"selector":                   "selector is a label query over pods whose evictions are managed by the disruption budget. A null selector selects no pods. An empty selector ({}) also selects no pods, which differs from standard behavior of selecting all pods. In policy/v1, an empty selector will select all pods in the namespace.",
+	"maxUnavailable":             "maxUnavailable indicates that an eviction is allowed if at most \"maxUnavailable\" pods selected by \"selector\" are unavailable after the eviction, i.e. even in absence of the evicted pod. For example, one can prevent all voluntary evictions by specifying 0. This is a mutually exclusive setting with \"minAvailable\".",
+	"unhealthyPodEvictionPolicy": "unhealthyPodEvictionPolicy defines the criteria for when unhealthy pods should be considered for eviction. Current implementation considers healthy pods, as pods that have status.conditions item with type=\"Ready\",status=\"True\".\n\nValid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy.\n\nIfHealthyBudget policy means that running pods (status.phase=\"Running\"), but not yet healthy can be evicted only if the guarded application is not disrupted (status.currentHealthy is at least equal to status.desiredHealthy). Healthy pods will be subject to the PDB for eviction.\n\nAlwaysAllow policy means that all running pods (status.phase=\"Running\"), but not yet healthy are considered disrupted and can be evicted regardless of whether the criteria in a PDB is met. This means perspective running pods of a disrupted application might not get a chance to become healthy. Healthy pods will be subject to the PDB for eviction.\n\nAdditional policies may be added in the future. Clients making eviction decisions should disallow eviction of unhealthy pods if they encounter an unrecognized policy in this field.",
 }
 
 func (PodDisruptionBudgetSpec) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/rbac/v1/generated.proto b/vendor/k8s.io/api/rbac/v1/generated.proto
index 7b4ec2afc1..9a2489b7a8 100644
--- a/vendor/k8s.io/api/rbac/v1/generated.proto
+++ b/vendor/k8s.io/api/rbac/v1/generated.proto
@@ -30,7 +30,7 @@ option go_package = "k8s.io/api/rbac/v1";
 
 // AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
 message AggregationRule {
-  // ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
+  // clusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
   // If any of the selectors match, then the ClusterRole's permissions will be added
   // +optional
   // +listType=atomic
@@ -39,17 +39,17 @@ message AggregationRule {
 
 // ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
 message ClusterRole {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Rules holds all the PolicyRules for this ClusterRole
+  // rules holds all the PolicyRules for this ClusterRole
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated PolicyRule rules = 2;
 
-  // AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
+  // aggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
   // If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
   // stomped by the controller.
   // +optional
@@ -59,20 +59,21 @@ message ClusterRole {
 // ClusterRoleBinding references a ClusterRole, but not contain it.  It can reference a ClusterRole in the global namespace,
 // and adds who information via Subject.
 message ClusterRoleBinding {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Subjects holds references to the objects the role applies to.
+  // subjects holds references to the objects the role applies to.
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated Subject subjects = 2;
 
-  // RoleRef can only reference a ClusterRole in the global namespace.
+  // roleRef can only reference a ClusterRole in the global namespace.
   // If the RoleRef cannot be resolved, the Authorizer must return an error.
   // This field is immutable.
   // +required
+  // +k8s:alpha(since:"1.37")=+k8s:immutable
   optional RoleRef roleRef = 3;
 }
 
@@ -99,29 +100,29 @@ message ClusterRoleList {
 // PolicyRule holds information that describes a policy rule, but does not contain information
 // about who the rule applies to or which namespace the rule applies to.
 message PolicyRule {
-  // Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
+  // verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
   // +listType=atomic
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   repeated string verbs = 1;
 
-  // APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
+  // apiGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
   // the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
   // +optional
   // +listType=atomic
   repeated string apiGroups = 2;
 
-  // Resources is a list of resources this rule applies to. '*' represents all resources.
+  // resources is a list of resources this rule applies to. '*' represents all resources.
   // +optional
   // +listType=atomic
   repeated string resources = 3;
 
-  // ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
+  // resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
   // +optional
   // +listType=atomic
   repeated string resourceNames = 4;
 
-  // NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
+  // nonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
   // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
   // Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.
   // +optional
@@ -131,14 +132,14 @@ message PolicyRule {
 
 // Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.
 message Role {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Rules holds all the PolicyRules for this Role
+  // rules holds all the PolicyRules for this Role
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated PolicyRule rules = 2;
 }
 
@@ -146,20 +147,21 @@ message Role {
 // It adds who information via Subjects and namespace information by which namespace it exists in.  RoleBindings in a given
 // namespace only have effect in that namespace.
 message RoleBinding {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Subjects holds references to the objects the role applies to.
+  // subjects holds references to the objects the role applies to.
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated Subject subjects = 2;
 
-  // RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
+  // roleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
   // If the RoleRef cannot be resolved, the Authorizer must return an error.
   // This field is immutable.
   // +required
+  // +k8s:alpha(since:"1.37")=+k8s:immutable
   optional RoleRef roleRef = 3;
 }
 
@@ -186,17 +188,17 @@ message RoleList {
 // RoleRef contains information that points to the role being used
 // +structType=atomic
 message RoleRef {
-  // APIGroup is the group for the resource being referenced
+  // apiGroup is the group for the resource being referenced
   // +optional
   optional string apiGroup = 1;
 
-  // Kind is the type of resource being referenced
+  // kind is the type of resource being referenced
   // +required
   optional string kind = 2;
 
-  // Name is the name of resource being referenced
+  // name is the name of resource being referenced
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string name = 3;
 }
 
@@ -204,23 +206,23 @@ message RoleRef {
 // or a value for non-objects such as user and group names.
 // +structType=atomic
 message Subject {
-  // Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
+  // kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
   // If the Authorizer does not recognized the kind value, the Authorizer should report an error.
   // +required
   optional string kind = 1;
 
-  // APIGroup holds the API group of the referenced subject.
+  // apiGroup holds the API group of the referenced subject.
   // Defaults to "" for ServiceAccount subjects.
   // Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
   // +optional
   optional string apiGroup = 2;
 
-  // Name of the object being referenced.
+  // name of the object being referenced.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string name = 3;
 
-  // Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
+  // namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
   // the Authorizer should report an error.
   // +optional
   optional string namespace = 4;
diff --git a/vendor/k8s.io/api/rbac/v1/types.go b/vendor/k8s.io/api/rbac/v1/types.go
index d3bb6d1a9c..a1e96067e2 100644
--- a/vendor/k8s.io/api/rbac/v1/types.go
+++ b/vendor/k8s.io/api/rbac/v1/types.go
@@ -47,27 +47,27 @@ const (
 // PolicyRule holds information that describes a policy rule, but does not contain information
 // about who the rule applies to or which namespace the rule applies to.
 type PolicyRule struct {
-	// Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
+	// verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
 	// +listType=atomic
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
 
-	// APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
+	// apiGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
 	// the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
 	// +optional
 	// +listType=atomic
 	APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,2,rep,name=apiGroups"`
-	// Resources is a list of resources this rule applies to. '*' represents all resources.
+	// resources is a list of resources this rule applies to. '*' represents all resources.
 	// +optional
 	// +listType=atomic
 	Resources []string `json:"resources,omitempty" protobuf:"bytes,3,rep,name=resources"`
-	// ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
+	// resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
 	// +optional
 	// +listType=atomic
 	ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,4,rep,name=resourceNames"`
 
-	// NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
+	// nonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
 	// Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
 	// Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.
 	// +optional
@@ -79,20 +79,20 @@ type PolicyRule struct {
 // or a value for non-objects such as user and group names.
 // +structType=atomic
 type Subject struct {
-	// Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
+	// kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
 	// If the Authorizer does not recognized the kind value, the Authorizer should report an error.
 	// +required
 	Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"`
-	// APIGroup holds the API group of the referenced subject.
+	// apiGroup holds the API group of the referenced subject.
 	// Defaults to "" for ServiceAccount subjects.
 	// Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
 	// +optional
 	APIGroup string `json:"apiGroup,omitempty" protobuf:"bytes,2,opt,name=apiGroup"`
-	// Name of the object being referenced.
+	// name of the object being referenced.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Name string `json:"name" protobuf:"bytes,3,opt,name=name"`
-	// Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
+	// namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
 	// the Authorizer should report an error.
 	// +optional
 	Namespace string `json:"namespace,omitempty" protobuf:"bytes,4,opt,name=namespace"`
@@ -101,15 +101,15 @@ type Subject struct {
 // RoleRef contains information that points to the role being used
 // +structType=atomic
 type RoleRef struct {
-	// APIGroup is the group for the resource being referenced
+	// apiGroup is the group for the resource being referenced
 	// +optional
 	APIGroup string `json:"apiGroup" protobuf:"bytes,1,opt,name=apiGroup"`
-	// Kind is the type of resource being referenced
+	// kind is the type of resource being referenced
 	// +required
 	Kind string `json:"kind" protobuf:"bytes,2,opt,name=kind"`
-	// Name is the name of resource being referenced
+	// name is the name of resource being referenced
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Name string `json:"name" protobuf:"bytes,3,opt,name=name"`
 }
 
@@ -119,15 +119,15 @@ type RoleRef struct {
 
 // Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.
 type Role struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object's metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Rules holds all the PolicyRules for this Role
+	// rules holds all the PolicyRules for this Role
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`
 }
 
@@ -139,21 +139,22 @@ type Role struct {
 // It adds who information via Subjects and namespace information by which namespace it exists in.  RoleBindings in a given
 // namespace only have effect in that namespace.
 type RoleBinding struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object's metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Subjects holds references to the objects the role applies to.
+	// subjects holds references to the objects the role applies to.
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Subjects []Subject `json:"subjects,omitempty" protobuf:"bytes,2,rep,name=subjects"`
 
-	// RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
+	// roleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
 	// If the RoleRef cannot be resolved, the Authorizer must return an error.
 	// This field is immutable.
 	// +required
+	// +k8s:alpha(since:"1.37")=+k8s:immutable
 	RoleRef RoleRef `json:"roleRef" protobuf:"bytes,3,opt,name=roleRef"`
 }
 
@@ -162,7 +163,7 @@ type RoleBinding struct {
 
 // RoleBindingList is a collection of RoleBindings
 type RoleBindingList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -176,7 +177,7 @@ type RoleBindingList struct {
 
 // RoleList is a collection of Roles
 type RoleList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -192,18 +193,18 @@ type RoleList struct {
 
 // ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
 type ClusterRole struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object's metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Rules holds all the PolicyRules for this ClusterRole
+	// rules holds all the PolicyRules for this ClusterRole
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`
 
-	// AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
+	// aggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
 	// If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
 	// stomped by the controller.
 	// +optional
@@ -212,7 +213,7 @@ type ClusterRole struct {
 
 // AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
 type AggregationRule struct {
-	// ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
+	// clusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
 	// If any of the selectors match, then the ClusterRole's permissions will be added
 	// +optional
 	// +listType=atomic
@@ -227,21 +228,22 @@ type AggregationRule struct {
 // ClusterRoleBinding references a ClusterRole, but not contain it.  It can reference a ClusterRole in the global namespace,
 // and adds who information via Subject.
 type ClusterRoleBinding struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object's metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Subjects holds references to the objects the role applies to.
+	// subjects holds references to the objects the role applies to.
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Subjects []Subject `json:"subjects,omitempty" protobuf:"bytes,2,rep,name=subjects"`
 
-	// RoleRef can only reference a ClusterRole in the global namespace.
+	// roleRef can only reference a ClusterRole in the global namespace.
 	// If the RoleRef cannot be resolved, the Authorizer must return an error.
 	// This field is immutable.
 	// +required
+	// +k8s:alpha(since:"1.37")=+k8s:immutable
 	RoleRef RoleRef `json:"roleRef" protobuf:"bytes,3,opt,name=roleRef"`
 }
 
@@ -250,7 +252,7 @@ type ClusterRoleBinding struct {
 
 // ClusterRoleBindingList is a collection of ClusterRoleBindings
 type ClusterRoleBindingList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -264,7 +266,7 @@ type ClusterRoleBindingList struct {
 
 // ClusterRoleList is a collection of ClusterRoles
 type ClusterRoleList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
diff --git a/vendor/k8s.io/api/rbac/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/rbac/v1/types_swagger_doc_generated.go
index 0471a55944..7cc6a0e3fc 100644
--- a/vendor/k8s.io/api/rbac/v1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/rbac/v1/types_swagger_doc_generated.go
@@ -29,7 +29,7 @@ package v1
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_AggregationRule = map[string]string{
 	"":                     "AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole",
-	"clusterRoleSelectors": "ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. If any of the selectors match, then the ClusterRole's permissions will be added",
+	"clusterRoleSelectors": "clusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. If any of the selectors match, then the ClusterRole's permissions will be added",
 }
 
 func (AggregationRule) SwaggerDoc() map[string]string {
@@ -38,9 +38,9 @@ func (AggregationRule) SwaggerDoc() map[string]string {
 
 var map_ClusterRole = map[string]string{
 	"":                "ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.",
-	"metadata":        "Standard object's metadata.",
-	"rules":           "Rules holds all the PolicyRules for this ClusterRole",
-	"aggregationRule": "AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller.",
+	"metadata":        "metadata is the standard object's metadata.",
+	"rules":           "rules holds all the PolicyRules for this ClusterRole",
+	"aggregationRule": "aggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller.",
 }
 
 func (ClusterRole) SwaggerDoc() map[string]string {
@@ -49,9 +49,9 @@ func (ClusterRole) SwaggerDoc() map[string]string {
 
 var map_ClusterRoleBinding = map[string]string{
 	"":         "ClusterRoleBinding references a ClusterRole, but not contain it.  It can reference a ClusterRole in the global namespace, and adds who information via Subject.",
-	"metadata": "Standard object's metadata.",
-	"subjects": "Subjects holds references to the objects the role applies to.",
-	"roleRef":  "RoleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error. This field is immutable.",
+	"metadata": "metadata is the standard object's metadata.",
+	"subjects": "subjects holds references to the objects the role applies to.",
+	"roleRef":  "roleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error. This field is immutable.",
 }
 
 func (ClusterRoleBinding) SwaggerDoc() map[string]string {
@@ -80,11 +80,11 @@ func (ClusterRoleList) SwaggerDoc() map[string]string {
 
 var map_PolicyRule = map[string]string{
 	"":                "PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.",
-	"verbs":           "Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.",
-	"apiGroups":       "APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. \"\" represents the core API group and \"*\" represents all API groups.",
-	"resources":       "Resources is a list of resources this rule applies to. '*' represents all resources.",
-	"resourceNames":   "ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.",
-	"nonResourceURLs": "NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as \"pods\" or \"secrets\") or non-resource URL paths (such as \"/api\"),  but not both.",
+	"verbs":           "verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.",
+	"apiGroups":       "apiGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. \"\" represents the core API group and \"*\" represents all API groups.",
+	"resources":       "resources is a list of resources this rule applies to. '*' represents all resources.",
+	"resourceNames":   "resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.",
+	"nonResourceURLs": "nonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as \"pods\" or \"secrets\") or non-resource URL paths (such as \"/api\"),  but not both.",
 }
 
 func (PolicyRule) SwaggerDoc() map[string]string {
@@ -93,8 +93,8 @@ func (PolicyRule) SwaggerDoc() map[string]string {
 
 var map_Role = map[string]string{
 	"":         "Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.",
-	"metadata": "Standard object's metadata.",
-	"rules":    "Rules holds all the PolicyRules for this Role",
+	"metadata": "metadata is the standard object's metadata.",
+	"rules":    "rules holds all the PolicyRules for this Role",
 }
 
 func (Role) SwaggerDoc() map[string]string {
@@ -103,9 +103,9 @@ func (Role) SwaggerDoc() map[string]string {
 
 var map_RoleBinding = map[string]string{
 	"":         "RoleBinding references a role, but does not contain it.  It can reference a Role in the same namespace or a ClusterRole in the global namespace. It adds who information via Subjects and namespace information by which namespace it exists in.  RoleBindings in a given namespace only have effect in that namespace.",
-	"metadata": "Standard object's metadata.",
-	"subjects": "Subjects holds references to the objects the role applies to.",
-	"roleRef":  "RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error. This field is immutable.",
+	"metadata": "metadata is the standard object's metadata.",
+	"subjects": "subjects holds references to the objects the role applies to.",
+	"roleRef":  "roleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error. This field is immutable.",
 }
 
 func (RoleBinding) SwaggerDoc() map[string]string {
@@ -134,9 +134,9 @@ func (RoleList) SwaggerDoc() map[string]string {
 
 var map_RoleRef = map[string]string{
 	"":         "RoleRef contains information that points to the role being used",
-	"apiGroup": "APIGroup is the group for the resource being referenced",
-	"kind":     "Kind is the type of resource being referenced",
-	"name":     "Name is the name of resource being referenced",
+	"apiGroup": "apiGroup is the group for the resource being referenced",
+	"kind":     "kind is the type of resource being referenced",
+	"name":     "name is the name of resource being referenced",
 }
 
 func (RoleRef) SwaggerDoc() map[string]string {
@@ -145,10 +145,10 @@ func (RoleRef) SwaggerDoc() map[string]string {
 
 var map_Subject = map[string]string{
 	"":          "Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference, or a value for non-objects such as user and group names.",
-	"kind":      "Kind of object being referenced. Values defined by this API group are \"User\", \"Group\", and \"ServiceAccount\". If the Authorizer does not recognized the kind value, the Authorizer should report an error.",
-	"apiGroup":  "APIGroup holds the API group of the referenced subject. Defaults to \"\" for ServiceAccount subjects. Defaults to \"rbac.authorization.k8s.io\" for User and Group subjects.",
-	"name":      "Name of the object being referenced.",
-	"namespace": "Namespace of the referenced object.  If the object kind is non-namespace, such as \"User\" or \"Group\", and this value is not empty the Authorizer should report an error.",
+	"kind":      "kind of object being referenced. Values defined by this API group are \"User\", \"Group\", and \"ServiceAccount\". If the Authorizer does not recognized the kind value, the Authorizer should report an error.",
+	"apiGroup":  "apiGroup holds the API group of the referenced subject. Defaults to \"\" for ServiceAccount subjects. Defaults to \"rbac.authorization.k8s.io\" for User and Group subjects.",
+	"name":      "name of the object being referenced.",
+	"namespace": "namespace of the referenced object.  If the object kind is non-namespace, such as \"User\" or \"Group\", and this value is not empty the Authorizer should report an error.",
 }
 
 func (Subject) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/rbac/v1alpha1/generated.proto b/vendor/k8s.io/api/rbac/v1alpha1/generated.proto
index 9551d11921..2046778ae8 100644
--- a/vendor/k8s.io/api/rbac/v1alpha1/generated.proto
+++ b/vendor/k8s.io/api/rbac/v1alpha1/generated.proto
@@ -30,7 +30,7 @@ option go_package = "k8s.io/api/rbac/v1alpha1";
 
 // AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
 message AggregationRule {
-  // ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
+  // clusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
   // If any of the selectors match, then the ClusterRole's permissions will be added
   // +optional
   // +listType=atomic
@@ -40,17 +40,17 @@ message AggregationRule {
 // ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
 message ClusterRole {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Rules holds all the PolicyRules for this ClusterRole
+  // rules holds all the PolicyRules for this ClusterRole
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated PolicyRule rules = 2;
 
-  // AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
+  // aggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
   // If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
   // stomped by the controller.
   // +optional
@@ -61,19 +61,20 @@ message ClusterRole {
 // and adds who information via Subject.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBinding, and will no longer be served in v1.22.
 message ClusterRoleBinding {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Subjects holds references to the objects the role applies to.
+  // subjects holds references to the objects the role applies to.
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated Subject subjects = 2;
 
-  // RoleRef can only reference a ClusterRole in the global namespace.
+  // roleRef can only reference a ClusterRole in the global namespace.
   // If the RoleRef cannot be resolved, the Authorizer must return an error.
   // +required
+  // +k8s:alpha(since:"1.37")=+k8s:immutable
   optional RoleRef roleRef = 3;
 }
 
@@ -102,29 +103,29 @@ message ClusterRoleList {
 // PolicyRule holds information that describes a policy rule, but does not contain information
 // about who the rule applies to or which namespace the rule applies to.
 message PolicyRule {
-  // Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
+  // verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
   // +listType=atomic
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   repeated string verbs = 1;
 
-  // APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
+  // apiGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
   // the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
   // +optional
   // +listType=atomic
   repeated string apiGroups = 3;
 
-  // Resources is a list of resources this rule applies to. '*' represents all resources.
+  // resources is a list of resources this rule applies to. '*' represents all resources.
   // +optional
   // +listType=atomic
   repeated string resources = 4;
 
-  // ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
+  // resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
   // +optional
   // +listType=atomic
   repeated string resourceNames = 5;
 
-  // NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
+  // nonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
   // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
   // Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.
   // +optional
@@ -135,14 +136,14 @@ message PolicyRule {
 // Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 Role, and will no longer be served in v1.22.
 message Role {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Rules holds all the PolicyRules for this Role
+  // rules holds all the PolicyRules for this Role
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated PolicyRule rules = 2;
 }
 
@@ -151,19 +152,20 @@ message Role {
 // namespace only have effect in that namespace.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBinding, and will no longer be served in v1.22.
 message RoleBinding {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Subjects holds references to the objects the role applies to.
+  // subjects holds references to the objects the role applies to.
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated Subject subjects = 2;
 
-  // RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
+  // roleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
   // If the RoleRef cannot be resolved, the Authorizer must return an error.
   // +required
+  // +k8s:alpha(since:"1.37")=+k8s:immutable
   optional RoleRef roleRef = 3;
 }
 
@@ -191,41 +193,41 @@ message RoleList {
 
 // RoleRef contains information that points to the role being used
 message RoleRef {
-  // APIGroup is the group for the resource being referenced
+  // apiGroup is the group for the resource being referenced
   // +optional
   optional string apiGroup = 1;
 
-  // Kind is the type of resource being referenced
+  // kind is the type of resource being referenced
   // +required
   optional string kind = 2;
 
-  // Name is the name of resource being referenced
+  // name is the name of resource being referenced
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string name = 3;
 }
 
 // Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference,
 // or a value for non-objects such as user and group names.
 message Subject {
-  // Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
+  // kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
   // If the Authorizer does not recognized the kind value, the Authorizer should report an error.
   // +required
   optional string kind = 1;
 
-  // APIVersion holds the API group and version of the referenced subject.
+  // apiVersion holds the API group and version of the referenced subject.
   // Defaults to "v1" for ServiceAccount subjects.
   // Defaults to "rbac.authorization.k8s.io/v1alpha1" for User and Group subjects.
   // +k8s:conversion-gen=false
   // +optional
   optional string apiVersion = 2;
 
-  // Name of the object being referenced.
+  // name of the object being referenced.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string name = 3;
 
-  // Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
+  // namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
   // the Authorizer should report an error.
   // +optional
   optional string namespace = 4;
diff --git a/vendor/k8s.io/api/rbac/v1alpha1/types.go b/vendor/k8s.io/api/rbac/v1alpha1/types.go
index 4ff4c06015..2f560efb4c 100644
--- a/vendor/k8s.io/api/rbac/v1alpha1/types.go
+++ b/vendor/k8s.io/api/rbac/v1alpha1/types.go
@@ -47,27 +47,27 @@ const (
 // PolicyRule holds information that describes a policy rule, but does not contain information
 // about who the rule applies to or which namespace the rule applies to.
 type PolicyRule struct {
-	// Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
+	// verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
 	// +listType=atomic
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
 
-	// APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
+	// apiGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
 	// the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
 	// +optional
 	// +listType=atomic
 	APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,3,rep,name=apiGroups"`
-	// Resources is a list of resources this rule applies to. '*' represents all resources.
+	// resources is a list of resources this rule applies to. '*' represents all resources.
 	// +optional
 	// +listType=atomic
 	Resources []string `json:"resources,omitempty" protobuf:"bytes,4,rep,name=resources"`
-	// ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
+	// resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
 	// +optional
 	// +listType=atomic
 	ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,5,rep,name=resourceNames"`
 
-	// NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
+	// nonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
 	// Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
 	// Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.
 	// +optional
@@ -78,21 +78,21 @@ type PolicyRule struct {
 // Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference,
 // or a value for non-objects such as user and group names.
 type Subject struct {
-	// Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
+	// kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
 	// If the Authorizer does not recognized the kind value, the Authorizer should report an error.
 	// +required
 	Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"`
-	// APIVersion holds the API group and version of the referenced subject.
+	// apiVersion holds the API group and version of the referenced subject.
 	// Defaults to "v1" for ServiceAccount subjects.
 	// Defaults to "rbac.authorization.k8s.io/v1alpha1" for User and Group subjects.
 	// +k8s:conversion-gen=false
 	// +optional
 	APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,2,opt,name=apiVersion"`
-	// Name of the object being referenced.
+	// name of the object being referenced.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Name string `json:"name" protobuf:"bytes,3,opt,name=name"`
-	// Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
+	// namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
 	// the Authorizer should report an error.
 	// +optional
 	Namespace string `json:"namespace,omitempty" protobuf:"bytes,4,opt,name=namespace"`
@@ -100,15 +100,15 @@ type Subject struct {
 
 // RoleRef contains information that points to the role being used
 type RoleRef struct {
-	// APIGroup is the group for the resource being referenced
+	// apiGroup is the group for the resource being referenced
 	// +optional
 	APIGroup string `json:"apiGroup" protobuf:"bytes,1,opt,name=apiGroup"`
-	// Kind is the type of resource being referenced
+	// kind is the type of resource being referenced
 	// +required
 	Kind string `json:"kind" protobuf:"bytes,2,opt,name=kind"`
-	// Name is the name of resource being referenced
+	// name is the name of resource being referenced
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Name string `json:"name" protobuf:"bytes,3,opt,name=name"`
 }
 
@@ -118,15 +118,15 @@ type RoleRef struct {
 // Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 Role, and will no longer be served in v1.22.
 type Role struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object's metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Rules holds all the PolicyRules for this Role
+	// rules holds all the PolicyRules for this Role
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`
 }
 
@@ -138,20 +138,21 @@ type Role struct {
 // namespace only have effect in that namespace.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBinding, and will no longer be served in v1.22.
 type RoleBinding struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object's metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Subjects holds references to the objects the role applies to.
+	// subjects holds references to the objects the role applies to.
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Subjects []Subject `json:"subjects,omitempty" protobuf:"bytes,2,rep,name=subjects"`
 
-	// RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
+	// roleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
 	// If the RoleRef cannot be resolved, the Authorizer must return an error.
 	// +required
+	// +k8s:alpha(since:"1.37")=+k8s:immutable
 	RoleRef RoleRef `json:"roleRef" protobuf:"bytes,3,opt,name=roleRef"`
 }
 
@@ -160,7 +161,7 @@ type RoleBinding struct {
 // RoleBindingList is a collection of RoleBindings
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBindingList, and will no longer be served in v1.22.
 type RoleBindingList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -174,7 +175,7 @@ type RoleBindingList struct {
 // RoleList is a collection of Roles.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleList, and will no longer be served in v1.22.
 type RoleList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -190,18 +191,18 @@ type RoleList struct {
 // ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
 type ClusterRole struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object's metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Rules holds all the PolicyRules for this ClusterRole
+	// rules holds all the PolicyRules for this ClusterRole
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`
 
-	// AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
+	// aggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
 	// If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
 	// stomped by the controller.
 	// +optional
@@ -210,7 +211,7 @@ type ClusterRole struct {
 
 // AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
 type AggregationRule struct {
-	// ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
+	// clusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
 	// If any of the selectors match, then the ClusterRole's permissions will be added
 	// +optional
 	// +listType=atomic
@@ -225,20 +226,21 @@ type AggregationRule struct {
 // and adds who information via Subject.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBinding, and will no longer be served in v1.22.
 type ClusterRoleBinding struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object's metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Subjects holds references to the objects the role applies to.
+	// subjects holds references to the objects the role applies to.
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Subjects []Subject `json:"subjects,omitempty" protobuf:"bytes,2,rep,name=subjects"`
 
-	// RoleRef can only reference a ClusterRole in the global namespace.
+	// roleRef can only reference a ClusterRole in the global namespace.
 	// If the RoleRef cannot be resolved, the Authorizer must return an error.
 	// +required
+	// +k8s:alpha(since:"1.37")=+k8s:immutable
 	RoleRef RoleRef `json:"roleRef" protobuf:"bytes,3,opt,name=roleRef"`
 }
 
@@ -247,7 +249,7 @@ type ClusterRoleBinding struct {
 // ClusterRoleBindingList is a collection of ClusterRoleBindings.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBindings, and will no longer be served in v1.22.
 type ClusterRoleBindingList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -261,7 +263,7 @@ type ClusterRoleBindingList struct {
 // ClusterRoleList is a collection of ClusterRoles.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoles, and will no longer be served in v1.22.
 type ClusterRoleList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
diff --git a/vendor/k8s.io/api/rbac/v1alpha1/types_swagger_doc_generated.go b/vendor/k8s.io/api/rbac/v1alpha1/types_swagger_doc_generated.go
index 6708f3e58e..03d69326d6 100644
--- a/vendor/k8s.io/api/rbac/v1alpha1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/rbac/v1alpha1/types_swagger_doc_generated.go
@@ -29,7 +29,7 @@ package v1alpha1
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_AggregationRule = map[string]string{
 	"":                     "AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole",
-	"clusterRoleSelectors": "ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. If any of the selectors match, then the ClusterRole's permissions will be added",
+	"clusterRoleSelectors": "clusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. If any of the selectors match, then the ClusterRole's permissions will be added",
 }
 
 func (AggregationRule) SwaggerDoc() map[string]string {
@@ -38,9 +38,9 @@ func (AggregationRule) SwaggerDoc() map[string]string {
 
 var map_ClusterRole = map[string]string{
 	"":                "ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.",
-	"metadata":        "Standard object's metadata.",
-	"rules":           "Rules holds all the PolicyRules for this ClusterRole",
-	"aggregationRule": "AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller.",
+	"metadata":        "metadata is the standard object's metadata.",
+	"rules":           "rules holds all the PolicyRules for this ClusterRole",
+	"aggregationRule": "aggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller.",
 }
 
 func (ClusterRole) SwaggerDoc() map[string]string {
@@ -49,9 +49,9 @@ func (ClusterRole) SwaggerDoc() map[string]string {
 
 var map_ClusterRoleBinding = map[string]string{
 	"":         "ClusterRoleBinding references a ClusterRole, but not contain it.  It can reference a ClusterRole in the global namespace, and adds who information via Subject. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBinding, and will no longer be served in v1.22.",
-	"metadata": "Standard object's metadata.",
-	"subjects": "Subjects holds references to the objects the role applies to.",
-	"roleRef":  "RoleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error.",
+	"metadata": "metadata is the standard object's metadata.",
+	"subjects": "subjects holds references to the objects the role applies to.",
+	"roleRef":  "roleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error.",
 }
 
 func (ClusterRoleBinding) SwaggerDoc() map[string]string {
@@ -80,11 +80,11 @@ func (ClusterRoleList) SwaggerDoc() map[string]string {
 
 var map_PolicyRule = map[string]string{
 	"":                "PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.",
-	"verbs":           "Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.",
-	"apiGroups":       "APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. \"\" represents the core API group and \"*\" represents all API groups.",
-	"resources":       "Resources is a list of resources this rule applies to. '*' represents all resources.",
-	"resourceNames":   "ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.",
-	"nonResourceURLs": "NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as \"pods\" or \"secrets\") or non-resource URL paths (such as \"/api\"),  but not both.",
+	"verbs":           "verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.",
+	"apiGroups":       "apiGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. \"\" represents the core API group and \"*\" represents all API groups.",
+	"resources":       "resources is a list of resources this rule applies to. '*' represents all resources.",
+	"resourceNames":   "resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.",
+	"nonResourceURLs": "nonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as \"pods\" or \"secrets\") or non-resource URL paths (such as \"/api\"),  but not both.",
 }
 
 func (PolicyRule) SwaggerDoc() map[string]string {
@@ -93,8 +93,8 @@ func (PolicyRule) SwaggerDoc() map[string]string {
 
 var map_Role = map[string]string{
 	"":         "Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 Role, and will no longer be served in v1.22.",
-	"metadata": "Standard object's metadata.",
-	"rules":    "Rules holds all the PolicyRules for this Role",
+	"metadata": "metadata is the standard object's metadata.",
+	"rules":    "rules holds all the PolicyRules for this Role",
 }
 
 func (Role) SwaggerDoc() map[string]string {
@@ -103,9 +103,9 @@ func (Role) SwaggerDoc() map[string]string {
 
 var map_RoleBinding = map[string]string{
 	"":         "RoleBinding references a role, but does not contain it.  It can reference a Role in the same namespace or a ClusterRole in the global namespace. It adds who information via Subjects and namespace information by which namespace it exists in.  RoleBindings in a given namespace only have effect in that namespace. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBinding, and will no longer be served in v1.22.",
-	"metadata": "Standard object's metadata.",
-	"subjects": "Subjects holds references to the objects the role applies to.",
-	"roleRef":  "RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error.",
+	"metadata": "metadata is the standard object's metadata.",
+	"subjects": "subjects holds references to the objects the role applies to.",
+	"roleRef":  "roleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error.",
 }
 
 func (RoleBinding) SwaggerDoc() map[string]string {
@@ -134,9 +134,9 @@ func (RoleList) SwaggerDoc() map[string]string {
 
 var map_RoleRef = map[string]string{
 	"":         "RoleRef contains information that points to the role being used",
-	"apiGroup": "APIGroup is the group for the resource being referenced",
-	"kind":     "Kind is the type of resource being referenced",
-	"name":     "Name is the name of resource being referenced",
+	"apiGroup": "apiGroup is the group for the resource being referenced",
+	"kind":     "kind is the type of resource being referenced",
+	"name":     "name is the name of resource being referenced",
 }
 
 func (RoleRef) SwaggerDoc() map[string]string {
@@ -145,10 +145,10 @@ func (RoleRef) SwaggerDoc() map[string]string {
 
 var map_Subject = map[string]string{
 	"":           "Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference, or a value for non-objects such as user and group names.",
-	"kind":       "Kind of object being referenced. Values defined by this API group are \"User\", \"Group\", and \"ServiceAccount\". If the Authorizer does not recognized the kind value, the Authorizer should report an error.",
-	"apiVersion": "APIVersion holds the API group and version of the referenced subject. Defaults to \"v1\" for ServiceAccount subjects. Defaults to \"rbac.authorization.k8s.io/v1alpha1\" for User and Group subjects.",
-	"name":       "Name of the object being referenced.",
-	"namespace":  "Namespace of the referenced object.  If the object kind is non-namespace, such as \"User\" or \"Group\", and this value is not empty the Authorizer should report an error.",
+	"kind":       "kind of object being referenced. Values defined by this API group are \"User\", \"Group\", and \"ServiceAccount\". If the Authorizer does not recognized the kind value, the Authorizer should report an error.",
+	"apiVersion": "apiVersion holds the API group and version of the referenced subject. Defaults to \"v1\" for ServiceAccount subjects. Defaults to \"rbac.authorization.k8s.io/v1alpha1\" for User and Group subjects.",
+	"name":       "name of the object being referenced.",
+	"namespace":  "namespace of the referenced object.  If the object kind is non-namespace, such as \"User\" or \"Group\", and this value is not empty the Authorizer should report an error.",
 }
 
 func (Subject) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/rbac/v1beta1/generated.proto b/vendor/k8s.io/api/rbac/v1beta1/generated.proto
index 326f312ec4..d459646be8 100644
--- a/vendor/k8s.io/api/rbac/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/rbac/v1beta1/generated.proto
@@ -30,7 +30,7 @@ option go_package = "k8s.io/api/rbac/v1beta1";
 
 // AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
 message AggregationRule {
-  // ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
+  // clusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
   // If any of the selectors match, then the ClusterRole's permissions will be added
   // +optional
   // +listType=atomic
@@ -40,17 +40,17 @@ message AggregationRule {
 // ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
 message ClusterRole {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Rules holds all the PolicyRules for this ClusterRole
+  // rules holds all the PolicyRules for this ClusterRole
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated PolicyRule rules = 2;
 
-  // AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
+  // aggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
   // If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
   // stomped by the controller.
   // +optional
@@ -61,19 +61,20 @@ message ClusterRole {
 // and adds who information via Subject.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBinding, and will no longer be served in v1.22.
 message ClusterRoleBinding {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Subjects holds references to the objects the role applies to.
+  // subjects holds references to the objects the role applies to.
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated Subject subjects = 2;
 
-  // RoleRef can only reference a ClusterRole in the global namespace.
+  // roleRef can only reference a ClusterRole in the global namespace.
   // If the RoleRef cannot be resolved, the Authorizer must return an error.
   // +required
+  // +k8s:alpha(since:"1.37")=+k8s:immutable
   optional RoleRef roleRef = 3;
 }
 
@@ -102,30 +103,30 @@ message ClusterRoleList {
 // PolicyRule holds information that describes a policy rule, but does not contain information
 // about who the rule applies to or which namespace the rule applies to.
 message PolicyRule {
-  // Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
+  // verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
   // +listType=atomic
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   repeated string verbs = 1;
 
-  // APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
+  // apiGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
   // the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
   // +optional
   // +listType=atomic
   repeated string apiGroups = 2;
 
-  // Resources is a list of resources this rule applies to.  '*' represents all resources in the specified apiGroups.
+  // resources is a list of resources this rule applies to.  '*' represents all resources in the specified apiGroups.
   // '*/foo' represents the subresource 'foo' for all resources in the specified apiGroups.
   // +optional
   // +listType=atomic
   repeated string resources = 3;
 
-  // ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
+  // resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
   // +optional
   // +listType=atomic
   repeated string resourceNames = 4;
 
-  // NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
+  // nonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
   // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
   // Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.
   // +optional
@@ -136,14 +137,14 @@ message PolicyRule {
 // Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 Role, and will no longer be served in v1.22.
 message Role {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Rules holds all the PolicyRules for this Role
+  // rules holds all the PolicyRules for this Role
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated PolicyRule rules = 2;
 }
 
@@ -152,19 +153,20 @@ message Role {
 // namespace only have effect in that namespace.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBinding, and will no longer be served in v1.22.
 message RoleBinding {
-  // Standard object's metadata.
+  // metadata is the standard object's metadata.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Subjects holds references to the objects the role applies to.
+  // subjects holds references to the objects the role applies to.
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated Subject subjects = 2;
 
-  // RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
+  // roleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
   // If the RoleRef cannot be resolved, the Authorizer must return an error.
   // +required
+  // +k8s:alpha(since:"1.37")=+k8s:immutable
   optional RoleRef roleRef = 3;
 }
 
@@ -192,40 +194,40 @@ message RoleList {
 
 // RoleRef contains information that points to the role being used
 message RoleRef {
-  // APIGroup is the group for the resource being referenced
+  // apiGroup is the group for the resource being referenced
   // +optional
   optional string apiGroup = 1;
 
-  // Kind is the type of resource being referenced
+  // kind is the type of resource being referenced
   // +required
   optional string kind = 2;
 
-  // Name is the name of resource being referenced
+  // name is the name of resource being referenced
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string name = 3;
 }
 
 // Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference,
 // or a value for non-objects such as user and group names.
 message Subject {
-  // Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
+  // kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
   // If the Authorizer does not recognized the kind value, the Authorizer should report an error.
   // +required
   optional string kind = 1;
 
-  // APIGroup holds the API group of the referenced subject.
+  // apiGroup holds the API group of the referenced subject.
   // Defaults to "" for ServiceAccount subjects.
   // Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
   // +optional
   optional string apiGroup = 2;
 
-  // Name of the object being referenced.
+  // name of the object being referenced.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string name = 3;
 
-  // Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
+  // namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
   // the Authorizer should report an error.
   // +optional
   optional string namespace = 4;
diff --git a/vendor/k8s.io/api/rbac/v1beta1/types.go b/vendor/k8s.io/api/rbac/v1beta1/types.go
index c653d071fe..a635661a8d 100644
--- a/vendor/k8s.io/api/rbac/v1beta1/types.go
+++ b/vendor/k8s.io/api/rbac/v1beta1/types.go
@@ -47,28 +47,28 @@ const (
 // PolicyRule holds information that describes a policy rule, but does not contain information
 // about who the rule applies to or which namespace the rule applies to.
 type PolicyRule struct {
-	// Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
+	// verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
 	// +listType=atomic
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Verbs []string `json:"verbs" protobuf:"bytes,1,rep,name=verbs"`
 
-	// APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
+	// apiGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
 	// the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
 	// +optional
 	// +listType=atomic
 	APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,2,rep,name=apiGroups"`
-	// Resources is a list of resources this rule applies to.  '*' represents all resources in the specified apiGroups.
+	// resources is a list of resources this rule applies to.  '*' represents all resources in the specified apiGroups.
 	// '*/foo' represents the subresource 'foo' for all resources in the specified apiGroups.
 	// +optional
 	// +listType=atomic
 	Resources []string `json:"resources,omitempty" protobuf:"bytes,3,rep,name=resources"`
-	// ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
+	// resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
 	// +optional
 	// +listType=atomic
 	ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,4,rep,name=resourceNames"`
 
-	// NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
+	// nonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
 	// Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
 	// Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.
 	// +optional
@@ -79,20 +79,20 @@ type PolicyRule struct {
 // Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference,
 // or a value for non-objects such as user and group names.
 type Subject struct {
-	// Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
+	// kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
 	// If the Authorizer does not recognized the kind value, the Authorizer should report an error.
 	// +required
 	Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"`
-	// APIGroup holds the API group of the referenced subject.
+	// apiGroup holds the API group of the referenced subject.
 	// Defaults to "" for ServiceAccount subjects.
 	// Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
 	// +optional
 	APIGroup string `json:"apiGroup,omitempty" protobuf:"bytes,2,opt,name=apiGroup"`
-	// Name of the object being referenced.
+	// name of the object being referenced.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Name string `json:"name" protobuf:"bytes,3,opt,name=name"`
-	// Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
+	// namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
 	// the Authorizer should report an error.
 	// +optional
 	Namespace string `json:"namespace,omitempty" protobuf:"bytes,4,opt,name=namespace"`
@@ -100,15 +100,15 @@ type Subject struct {
 
 // RoleRef contains information that points to the role being used
 type RoleRef struct {
-	// APIGroup is the group for the resource being referenced
+	// apiGroup is the group for the resource being referenced
 	// +optional
 	APIGroup string `json:"apiGroup" protobuf:"bytes,1,opt,name=apiGroup"`
-	// Kind is the type of resource being referenced
+	// kind is the type of resource being referenced
 	// +required
 	Kind string `json:"kind" protobuf:"bytes,2,opt,name=kind"`
-	// Name is the name of resource being referenced
+	// name is the name of resource being referenced
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Name string `json:"name" protobuf:"bytes,3,opt,name=name"`
 }
 
@@ -122,15 +122,15 @@ type RoleRef struct {
 // Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 Role, and will no longer be served in v1.22.
 type Role struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object's metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Rules holds all the PolicyRules for this Role
+	// rules holds all the PolicyRules for this Role
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`
 }
 
@@ -146,20 +146,21 @@ type Role struct {
 // namespace only have effect in that namespace.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBinding, and will no longer be served in v1.22.
 type RoleBinding struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object's metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Subjects holds references to the objects the role applies to.
+	// subjects holds references to the objects the role applies to.
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Subjects []Subject `json:"subjects,omitempty" protobuf:"bytes,2,rep,name=subjects"`
 
-	// RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
+	// roleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
 	// If the RoleRef cannot be resolved, the Authorizer must return an error.
 	// +required
+	// +k8s:alpha(since:"1.37")=+k8s:immutable
 	RoleRef RoleRef `json:"roleRef" protobuf:"bytes,3,opt,name=roleRef"`
 }
 
@@ -172,7 +173,7 @@ type RoleBinding struct {
 // RoleBindingList is a collection of RoleBindings
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBindingList, and will no longer be served in v1.22.
 type RoleBindingList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -190,7 +191,7 @@ type RoleBindingList struct {
 // RoleList is a collection of Roles
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleList, and will no longer be served in v1.22.
 type RoleList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -210,17 +211,17 @@ type RoleList struct {
 // ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
 type ClusterRole struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object's metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Rules holds all the PolicyRules for this ClusterRole
+	// rules holds all the PolicyRules for this ClusterRole
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`
-	// AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
+	// aggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
 	// If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
 	// stomped by the controller.
 	// +optional
@@ -229,7 +230,7 @@ type ClusterRole struct {
 
 // AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
 type AggregationRule struct {
-	// ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
+	// clusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
 	// If any of the selectors match, then the ClusterRole's permissions will be added
 	// +optional
 	// +listType=atomic
@@ -248,20 +249,21 @@ type AggregationRule struct {
 // and adds who information via Subject.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBinding, and will no longer be served in v1.22.
 type ClusterRoleBinding struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object's metadata.
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Subjects holds references to the objects the role applies to.
+	// subjects holds references to the objects the role applies to.
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Subjects []Subject `json:"subjects,omitempty" protobuf:"bytes,2,rep,name=subjects"`
 
-	// RoleRef can only reference a ClusterRole in the global namespace.
+	// roleRef can only reference a ClusterRole in the global namespace.
 	// If the RoleRef cannot be resolved, the Authorizer must return an error.
 	// +required
+	// +k8s:alpha(since:"1.37")=+k8s:immutable
 	RoleRef RoleRef `json:"roleRef" protobuf:"bytes,3,opt,name=roleRef"`
 }
 
@@ -274,7 +276,7 @@ type ClusterRoleBinding struct {
 // ClusterRoleBindingList is a collection of ClusterRoleBindings.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBindingList, and will no longer be served in v1.22.
 type ClusterRoleBindingList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -292,7 +294,7 @@ type ClusterRoleBindingList struct {
 // ClusterRoleList is a collection of ClusterRoles.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoles, and will no longer be served in v1.22.
 type ClusterRoleList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object's metadata.
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
diff --git a/vendor/k8s.io/api/rbac/v1beta1/types_swagger_doc_generated.go b/vendor/k8s.io/api/rbac/v1beta1/types_swagger_doc_generated.go
index fff1fe40fa..0b03d85e62 100644
--- a/vendor/k8s.io/api/rbac/v1beta1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/rbac/v1beta1/types_swagger_doc_generated.go
@@ -29,7 +29,7 @@ package v1beta1
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_AggregationRule = map[string]string{
 	"":                     "AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole",
-	"clusterRoleSelectors": "ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. If any of the selectors match, then the ClusterRole's permissions will be added",
+	"clusterRoleSelectors": "clusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. If any of the selectors match, then the ClusterRole's permissions will be added",
 }
 
 func (AggregationRule) SwaggerDoc() map[string]string {
@@ -38,9 +38,9 @@ func (AggregationRule) SwaggerDoc() map[string]string {
 
 var map_ClusterRole = map[string]string{
 	"":                "ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.",
-	"metadata":        "Standard object's metadata.",
-	"rules":           "Rules holds all the PolicyRules for this ClusterRole",
-	"aggregationRule": "AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller.",
+	"metadata":        "metadata is the standard object's metadata.",
+	"rules":           "rules holds all the PolicyRules for this ClusterRole",
+	"aggregationRule": "aggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller.",
 }
 
 func (ClusterRole) SwaggerDoc() map[string]string {
@@ -49,9 +49,9 @@ func (ClusterRole) SwaggerDoc() map[string]string {
 
 var map_ClusterRoleBinding = map[string]string{
 	"":         "ClusterRoleBinding references a ClusterRole, but not contain it.  It can reference a ClusterRole in the global namespace, and adds who information via Subject. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBinding, and will no longer be served in v1.22.",
-	"metadata": "Standard object's metadata.",
-	"subjects": "Subjects holds references to the objects the role applies to.",
-	"roleRef":  "RoleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error.",
+	"metadata": "metadata is the standard object's metadata.",
+	"subjects": "subjects holds references to the objects the role applies to.",
+	"roleRef":  "roleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error.",
 }
 
 func (ClusterRoleBinding) SwaggerDoc() map[string]string {
@@ -80,11 +80,11 @@ func (ClusterRoleList) SwaggerDoc() map[string]string {
 
 var map_PolicyRule = map[string]string{
 	"":                "PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.",
-	"verbs":           "Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.",
-	"apiGroups":       "APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. \"\" represents the core API group and \"*\" represents all API groups.",
-	"resources":       "Resources is a list of resources this rule applies to.  '*' represents all resources in the specified apiGroups. '*/foo' represents the subresource 'foo' for all resources in the specified apiGroups.",
-	"resourceNames":   "ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.",
-	"nonResourceURLs": "NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as \"pods\" or \"secrets\") or non-resource URL paths (such as \"/api\"),  but not both.",
+	"verbs":           "verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.",
+	"apiGroups":       "apiGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. \"\" represents the core API group and \"*\" represents all API groups.",
+	"resources":       "resources is a list of resources this rule applies to.  '*' represents all resources in the specified apiGroups. '*/foo' represents the subresource 'foo' for all resources in the specified apiGroups.",
+	"resourceNames":   "resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.",
+	"nonResourceURLs": "nonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as \"pods\" or \"secrets\") or non-resource URL paths (such as \"/api\"),  but not both.",
 }
 
 func (PolicyRule) SwaggerDoc() map[string]string {
@@ -93,8 +93,8 @@ func (PolicyRule) SwaggerDoc() map[string]string {
 
 var map_Role = map[string]string{
 	"":         "Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 Role, and will no longer be served in v1.22.",
-	"metadata": "Standard object's metadata.",
-	"rules":    "Rules holds all the PolicyRules for this Role",
+	"metadata": "metadata is the standard object's metadata.",
+	"rules":    "rules holds all the PolicyRules for this Role",
 }
 
 func (Role) SwaggerDoc() map[string]string {
@@ -103,9 +103,9 @@ func (Role) SwaggerDoc() map[string]string {
 
 var map_RoleBinding = map[string]string{
 	"":         "RoleBinding references a role, but does not contain it.  It can reference a Role in the same namespace or a ClusterRole in the global namespace. It adds who information via Subjects and namespace information by which namespace it exists in.  RoleBindings in a given namespace only have effect in that namespace. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBinding, and will no longer be served in v1.22.",
-	"metadata": "Standard object's metadata.",
-	"subjects": "Subjects holds references to the objects the role applies to.",
-	"roleRef":  "RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error.",
+	"metadata": "metadata is the standard object's metadata.",
+	"subjects": "subjects holds references to the objects the role applies to.",
+	"roleRef":  "roleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error.",
 }
 
 func (RoleBinding) SwaggerDoc() map[string]string {
@@ -134,9 +134,9 @@ func (RoleList) SwaggerDoc() map[string]string {
 
 var map_RoleRef = map[string]string{
 	"":         "RoleRef contains information that points to the role being used",
-	"apiGroup": "APIGroup is the group for the resource being referenced",
-	"kind":     "Kind is the type of resource being referenced",
-	"name":     "Name is the name of resource being referenced",
+	"apiGroup": "apiGroup is the group for the resource being referenced",
+	"kind":     "kind is the type of resource being referenced",
+	"name":     "name is the name of resource being referenced",
 }
 
 func (RoleRef) SwaggerDoc() map[string]string {
@@ -145,10 +145,10 @@ func (RoleRef) SwaggerDoc() map[string]string {
 
 var map_Subject = map[string]string{
 	"":          "Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference, or a value for non-objects such as user and group names.",
-	"kind":      "Kind of object being referenced. Values defined by this API group are \"User\", \"Group\", and \"ServiceAccount\". If the Authorizer does not recognized the kind value, the Authorizer should report an error.",
-	"apiGroup":  "APIGroup holds the API group of the referenced subject. Defaults to \"\" for ServiceAccount subjects. Defaults to \"rbac.authorization.k8s.io\" for User and Group subjects.",
-	"name":      "Name of the object being referenced.",
-	"namespace": "Namespace of the referenced object.  If the object kind is non-namespace, such as \"User\" or \"Group\", and this value is not empty the Authorizer should report an error.",
+	"kind":      "kind of object being referenced. Values defined by this API group are \"User\", \"Group\", and \"ServiceAccount\". If the Authorizer does not recognized the kind value, the Authorizer should report an error.",
+	"apiGroup":  "apiGroup holds the API group of the referenced subject. Defaults to \"\" for ServiceAccount subjects. Defaults to \"rbac.authorization.k8s.io\" for User and Group subjects.",
+	"name":      "name of the object being referenced.",
+	"namespace": "namespace of the referenced object.  If the object kind is non-namespace, such as \"User\" or \"Group\", and this value is not empty the Authorizer should report an error.",
 }
 
 func (Subject) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/resource/v1/doc.go b/vendor/k8s.io/api/resource/v1/doc.go
index 645c1cb53f..b3a5d93d13 100644
--- a/vendor/k8s.io/api/resource/v1/doc.go
+++ b/vendor/k8s.io/api/resource/v1/doc.go
@@ -20,6 +20,10 @@ limitations under the License.
 // +k8s:prerelease-lifecycle-gen=true
 // +k8s:openapi-model-package=io.k8s.api.resource.v1
 // +groupName=resource.k8s.io
+// +k8s:validation-gen=TypesWithSuffix=DeviceAttribute
+// +k8s:validation-gen=TypesWithSuffix=NetworkDeviceData
+// +k8s:validation-gen-input=k8s.io/api/resource/v1
+// +k8s:validation-gen-scheme-registry=nil
 
 // Package v1 is the v1 version of the resource API.
 package v1
diff --git a/vendor/k8s.io/api/resource/v1/generated.pb.go b/vendor/k8s.io/api/resource/v1/generated.pb.go
index f59e829057..c0099e888d 100644
--- a/vendor/k8s.io/api/resource/v1/generated.pb.go
+++ b/vendor/k8s.io/api/resource/v1/generated.pb.go
@@ -82,6 +82,8 @@ func (m *DeviceConstraint) Reset() { *m = DeviceConstraint{} }
 
 func (m *DeviceCounterConsumption) Reset() { *m = DeviceCounterConsumption{} }
 
+func (m *DeviceDerivedAttribute) Reset() { *m = DeviceDerivedAttribute{} }
+
 func (m *DeviceRequest) Reset() { *m = DeviceRequest{} }
 
 func (m *DeviceRequestAllocationResult) Reset() { *m = DeviceRequestAllocationResult{} }
@@ -92,13 +94,27 @@ func (m *DeviceSubRequest) Reset() { *m = DeviceSubRequest{} }
 
 func (m *DeviceTaint) Reset() { *m = DeviceTaint{} }
 
+func (m *DeviceTaintRule) Reset() { *m = DeviceTaintRule{} }
+
+func (m *DeviceTaintRuleList) Reset() { *m = DeviceTaintRuleList{} }
+
+func (m *DeviceTaintRuleSpec) Reset() { *m = DeviceTaintRuleSpec{} }
+
+func (m *DeviceTaintRuleStatus) Reset() { *m = DeviceTaintRuleStatus{} }
+
+func (m *DeviceTaintSelector) Reset() { *m = DeviceTaintSelector{} }
+
 func (m *DeviceToleration) Reset() { *m = DeviceToleration{} }
 
 func (m *ExactDeviceRequest) Reset() { *m = ExactDeviceRequest{} }
 
 func (m *NetworkDeviceData) Reset() { *m = NetworkDeviceData{} }
 
-func (m *NodeAllocatableResourceMapping) Reset() { *m = NodeAllocatableResourceMapping{} }
+func (m *NodeAllocatableMapping) Reset() { *m = NodeAllocatableMapping{} }
+
+func (m *NodeAllocatableOverhead) Reset() { *m = NodeAllocatableOverhead{} }
+
+func (m *NodeAllocatableResource) Reset() { *m = NodeAllocatableResource{} }
 
 func (m *OpaqueDeviceConfiguration) Reset() { *m = OpaqueDeviceConfiguration{} }
 
@@ -576,14 +592,14 @@ func (m *Device) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
-	if len(m.NodeAllocatableResourceMappings) > 0 {
-		keysForNodeAllocatableResourceMappings := make([]string, 0, len(m.NodeAllocatableResourceMappings))
-		for k := range m.NodeAllocatableResourceMappings {
-			keysForNodeAllocatableResourceMappings = append(keysForNodeAllocatableResourceMappings, string(k))
-		}
-		sort.Strings(keysForNodeAllocatableResourceMappings)
-		for iNdEx := len(keysForNodeAllocatableResourceMappings) - 1; iNdEx >= 0; iNdEx-- {
-			v := m.NodeAllocatableResourceMappings[k8s_io_api_core_v1.ResourceName(keysForNodeAllocatableResourceMappings[iNdEx])]
+	if len(m.NodeAllocatableResources) > 0 {
+		keysForNodeAllocatableResources := make([]string, 0, len(m.NodeAllocatableResources))
+		for k := range m.NodeAllocatableResources {
+			keysForNodeAllocatableResources = append(keysForNodeAllocatableResources, string(k))
+		}
+		sort.Strings(keysForNodeAllocatableResources)
+		for iNdEx := len(keysForNodeAllocatableResources) - 1; iNdEx >= 0; iNdEx-- {
+			v := m.NodeAllocatableResources[k8s_io_api_core_v1.ResourceName(keysForNodeAllocatableResources[iNdEx])]
 			baseI := i
 			{
 				size, err := (&v).MarshalToSizedBuffer(dAtA[:i])
@@ -595,14 +611,14 @@ func (m *Device) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			}
 			i--
 			dAtA[i] = 0x12
-			i -= len(keysForNodeAllocatableResourceMappings[iNdEx])
-			copy(dAtA[i:], keysForNodeAllocatableResourceMappings[iNdEx])
-			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForNodeAllocatableResourceMappings[iNdEx])))
+			i -= len(keysForNodeAllocatableResources[iNdEx])
+			copy(dAtA[i:], keysForNodeAllocatableResources[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForNodeAllocatableResources[iNdEx])))
 			i--
 			dAtA[i] = 0xa
 			i = encodeVarintGenerated(dAtA, i, uint64(baseI-i))
 			i--
-			dAtA[i] = 0x6a
+			dAtA[i] = 0x72
 		}
 	}
 	if m.AllowMultipleAllocations != nil {
@@ -1387,6 +1403,15 @@ func (m *DeviceCounterConsumption) MarshalToSizedBuffer(dAtA []byte) (int, error
 	_ = i
 	var l int
 	_ = l
+	if len(m.CompatibilityGroups) > 0 {
+		for iNdEx := len(m.CompatibilityGroups) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.CompatibilityGroups[iNdEx])
+			copy(dAtA[i:], m.CompatibilityGroups[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.CompatibilityGroups[iNdEx])))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
 	if len(m.Counters) > 0 {
 		keysForCounters := make([]string, 0, len(m.Counters))
 		for k := range m.Counters {
@@ -1424,6 +1449,39 @@ func (m *DeviceCounterConsumption) MarshalToSizedBuffer(dAtA []byte) (int, error
 	return len(dAtA) - i, nil
 }
 
+func (m *DeviceDerivedAttribute) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DeviceDerivedAttribute) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *DeviceDerivedAttribute) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Expression)
+	copy(dAtA[i:], m.Expression)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Expression)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
 func (m *DeviceRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -1498,6 +1556,15 @@ func (m *DeviceRequestAllocationResult) MarshalToSizedBuffer(dAtA []byte) (int,
 	_ = i
 	var l int
 	_ = l
+	if len(m.SkipNodeOperations) > 0 {
+		for iNdEx := len(m.SkipNodeOperations) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.SkipNodeOperations[iNdEx])
+			copy(dAtA[i:], m.SkipNodeOperations[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.SkipNodeOperations[iNdEx])))
+			i--
+			dAtA[i] = 0x5a
+		}
+	}
 	if len(m.ConsumedCapacity) > 0 {
 		keysForConsumedCapacity := make([]string, 0, len(m.ConsumedCapacity))
 		for k := range m.ConsumedCapacity {
@@ -1654,6 +1721,20 @@ func (m *DeviceSubRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if len(m.DerivedAttributes) > 0 {
+		for iNdEx := len(m.DerivedAttributes) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.DerivedAttributes[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x42
+		}
+	}
 	if m.Capacity != nil {
 		{
 			size, err := m.Capacity.MarshalToSizedBuffer(dAtA[:i])
@@ -1765,7 +1846,7 @@ func (m *DeviceTaint) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *DeviceToleration) Marshal() (dAtA []byte, err error) {
+func (m *DeviceTaintRule) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -1775,45 +1856,50 @@ func (m *DeviceToleration) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *DeviceToleration) MarshalTo(dAtA []byte) (int, error) {
+func (m *DeviceTaintRule) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *DeviceToleration) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DeviceTaintRule) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if m.TolerationSeconds != nil {
-		i = encodeVarintGenerated(dAtA, i, uint64(*m.TolerationSeconds))
-		i--
-		dAtA[i] = 0x28
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	i -= len(m.Effect)
-	copy(dAtA[i:], m.Effect)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Effect)))
-	i--
-	dAtA[i] = 0x22
-	i -= len(m.Value)
-	copy(dAtA[i:], m.Value)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Value)))
 	i--
 	dAtA[i] = 0x1a
-	i -= len(m.Operator)
-	copy(dAtA[i:], m.Operator)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Operator)))
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
 	i--
 	dAtA[i] = 0x12
-	i -= len(m.Key)
-	copy(dAtA[i:], m.Key)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Key)))
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
 	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *ExactDeviceRequest) Marshal() (dAtA []byte, err error) {
+func (m *DeviceTaintRuleList) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -1823,32 +1909,20 @@ func (m *ExactDeviceRequest) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ExactDeviceRequest) MarshalTo(dAtA []byte) (int, error) {
+func (m *DeviceTaintRuleList) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ExactDeviceRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DeviceTaintRuleList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if m.Capacity != nil {
-		{
-			size, err := m.Capacity.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintGenerated(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x3a
-	}
-	if len(m.Tolerations) > 0 {
-		for iNdEx := len(m.Tolerations) - 1; iNdEx >= 0; iNdEx-- {
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
 			{
-				size, err := m.Tolerations[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
 				if err != nil {
 					return 0, err
 				}
@@ -1856,50 +1930,23 @@ func (m *ExactDeviceRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 				i = encodeVarintGenerated(dAtA, i, uint64(size))
 			}
 			i--
-			dAtA[i] = 0x32
-		}
-	}
-	if m.AdminAccess != nil {
-		i--
-		if *m.AdminAccess {
-			dAtA[i] = 1
-		} else {
-			dAtA[i] = 0
+			dAtA[i] = 0x12
 		}
-		i--
-		dAtA[i] = 0x28
 	}
-	i = encodeVarintGenerated(dAtA, i, uint64(m.Count))
-	i--
-	dAtA[i] = 0x20
-	i -= len(m.AllocationMode)
-	copy(dAtA[i:], m.AllocationMode)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.AllocationMode)))
-	i--
-	dAtA[i] = 0x1a
-	if len(m.Selectors) > 0 {
-		for iNdEx := len(m.Selectors) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.Selectors[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintGenerated(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x12
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	i -= len(m.DeviceClassName)
-	copy(dAtA[i:], m.DeviceClassName)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.DeviceClassName)))
 	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *NetworkDeviceData) Marshal() (dAtA []byte, err error) {
+func (m *DeviceTaintRuleSpec) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -1909,39 +1956,42 @@ func (m *NetworkDeviceData) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *NetworkDeviceData) MarshalTo(dAtA []byte) (int, error) {
+func (m *DeviceTaintRuleSpec) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *NetworkDeviceData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DeviceTaintRuleSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	i -= len(m.HardwareAddress)
-	copy(dAtA[i:], m.HardwareAddress)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.HardwareAddress)))
-	i--
-	dAtA[i] = 0x1a
-	if len(m.IPs) > 0 {
-		for iNdEx := len(m.IPs) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.IPs[iNdEx])
-			copy(dAtA[i:], m.IPs[iNdEx])
-			i = encodeVarintGenerated(dAtA, i, uint64(len(m.IPs[iNdEx])))
-			i--
-			dAtA[i] = 0x12
+	{
+		size, err := m.Taint.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	i -= len(m.InterfaceName)
-	copy(dAtA[i:], m.InterfaceName)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.InterfaceName)))
 	i--
-	dAtA[i] = 0xa
+	dAtA[i] = 0x12
+	if m.DeviceSelector != nil {
+		{
+			size, err := m.DeviceSelector.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
 	return len(dAtA) - i, nil
 }
 
-func (m *NodeAllocatableResourceMapping) Marshal() (dAtA []byte, err error) {
+func (m *DeviceTaintRuleStatus) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -1951,39 +2001,34 @@ func (m *NodeAllocatableResourceMapping) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *NodeAllocatableResourceMapping) MarshalTo(dAtA []byte) (int, error) {
+func (m *DeviceTaintRuleStatus) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *NodeAllocatableResourceMapping) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DeviceTaintRuleStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if m.AllocationMultiplier != nil {
-		{
-			size, err := m.AllocationMultiplier.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
+	if len(m.Conditions) > 0 {
+		for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
 			}
-			i -= size
-			i = encodeVarintGenerated(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0xa
 		}
-		i--
-		dAtA[i] = 0x12
-	}
-	if m.CapacityKey != nil {
-		i -= len(*m.CapacityKey)
-		copy(dAtA[i:], *m.CapacityKey)
-		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.CapacityKey)))
-		i--
-		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
 }
 
-func (m *OpaqueDeviceConfiguration) Marshal() (dAtA []byte, err error) {
+func (m *DeviceTaintSelector) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -1993,35 +2038,41 @@ func (m *OpaqueDeviceConfiguration) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *OpaqueDeviceConfiguration) MarshalTo(dAtA []byte) (int, error) {
+func (m *DeviceTaintSelector) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *OpaqueDeviceConfiguration) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DeviceTaintSelector) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	{
-		size, err := m.Parameters.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	if m.Device != nil {
+		i -= len(*m.Device)
+		copy(dAtA[i:], *m.Device)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.Device)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.Pool != nil {
+		i -= len(*m.Pool)
+		copy(dAtA[i:], *m.Pool)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.Pool)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.Driver != nil {
+		i -= len(*m.Driver)
+		copy(dAtA[i:], *m.Driver)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.Driver)))
+		i--
+		dAtA[i] = 0x12
 	}
-	i--
-	dAtA[i] = 0x12
-	i -= len(m.Driver)
-	copy(dAtA[i:], m.Driver)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Driver)))
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *ResourceClaim) Marshal() (dAtA []byte, err error) {
+func (m *DeviceToleration) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -2031,50 +2082,45 @@ func (m *ResourceClaim) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ResourceClaim) MarshalTo(dAtA []byte) (int, error) {
+func (m *DeviceToleration) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ResourceClaim) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *DeviceToleration) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	{
-		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	if m.TolerationSeconds != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.TolerationSeconds))
+		i--
+		dAtA[i] = 0x28
 	}
+	i -= len(m.Effect)
+	copy(dAtA[i:], m.Effect)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Effect)))
+	i--
+	dAtA[i] = 0x22
+	i -= len(m.Value)
+	copy(dAtA[i:], m.Value)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Value)))
 	i--
 	dAtA[i] = 0x1a
-	{
-		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
-	}
+	i -= len(m.Operator)
+	copy(dAtA[i:], m.Operator)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Operator)))
 	i--
 	dAtA[i] = 0x12
-	{
-		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
-	}
+	i -= len(m.Key)
+	copy(dAtA[i:], m.Key)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Key)))
 	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *ResourceClaimConsumerReference) Marshal() (dAtA []byte, err error) {
+func (m *ExactDeviceRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -2084,40 +2130,97 @@ func (m *ResourceClaimConsumerReference) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ResourceClaimConsumerReference) MarshalTo(dAtA []byte) (int, error) {
+func (m *ExactDeviceRequest) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ResourceClaimConsumerReference) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ExactDeviceRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	i -= len(m.UID)
-	copy(dAtA[i:], m.UID)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.UID)))
-	i--
-	dAtA[i] = 0x2a
-	i -= len(m.Name)
-	copy(dAtA[i:], m.Name)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	if len(m.DerivedAttributes) > 0 {
+		for iNdEx := len(m.DerivedAttributes) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.DerivedAttributes[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x42
+		}
+	}
+	if m.Capacity != nil {
+		{
+			size, err := m.Capacity.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.Tolerations) > 0 {
+		for iNdEx := len(m.Tolerations) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Tolerations[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x32
+		}
+	}
+	if m.AdminAccess != nil {
+		i--
+		if *m.AdminAccess {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x28
+	}
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Count))
 	i--
-	dAtA[i] = 0x22
-	i -= len(m.Resource)
-	copy(dAtA[i:], m.Resource)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Resource)))
+	dAtA[i] = 0x20
+	i -= len(m.AllocationMode)
+	copy(dAtA[i:], m.AllocationMode)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.AllocationMode)))
 	i--
 	dAtA[i] = 0x1a
-	i -= len(m.APIGroup)
-	copy(dAtA[i:], m.APIGroup)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.APIGroup)))
+	if len(m.Selectors) > 0 {
+		for iNdEx := len(m.Selectors) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Selectors[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	i -= len(m.DeviceClassName)
+	copy(dAtA[i:], m.DeviceClassName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.DeviceClassName)))
 	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *ResourceClaimList) Marshal() (dAtA []byte, err error) {
+func (m *NetworkDeviceData) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -2127,44 +2230,39 @@ func (m *ResourceClaimList) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ResourceClaimList) MarshalTo(dAtA []byte) (int, error) {
+func (m *NetworkDeviceData) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ResourceClaimList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *NetworkDeviceData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if len(m.Items) > 0 {
-		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintGenerated(dAtA, i, uint64(size))
-			}
+	i -= len(m.HardwareAddress)
+	copy(dAtA[i:], m.HardwareAddress)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.HardwareAddress)))
+	i--
+	dAtA[i] = 0x1a
+	if len(m.IPs) > 0 {
+		for iNdEx := len(m.IPs) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.IPs[iNdEx])
+			copy(dAtA[i:], m.IPs[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.IPs[iNdEx])))
 			i--
 			dAtA[i] = 0x12
 		}
 	}
-	{
-		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
-		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
-	}
+	i -= len(m.InterfaceName)
+	copy(dAtA[i:], m.InterfaceName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.InterfaceName)))
 	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *ResourceClaimSpec) Marshal() (dAtA []byte, err error) {
+func (m *NodeAllocatableMapping) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -2174,30 +2272,51 @@ func (m *ResourceClaimSpec) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ResourceClaimSpec) MarshalTo(dAtA []byte) (int, error) {
+func (m *NodeAllocatableMapping) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ResourceClaimSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *NodeAllocatableMapping) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	{
-		size, err := m.Devices.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if m.DeviceMultiplier != nil {
+		{
+			size, err := m.DeviceMultiplier.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
 		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.CapacityMultiplier != nil {
+		{
+			size, err := m.CapacityMultiplier.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.CapacityKey != nil {
+		i -= len(*m.CapacityKey)
+		copy(dAtA[i:], *m.CapacityKey)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.CapacityKey)))
+		i--
+		dAtA[i] = 0xa
 	}
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *ResourceClaimStatus) Marshal() (dAtA []byte, err error) {
+func (m *NodeAllocatableOverhead) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -2207,47 +2326,31 @@ func (m *ResourceClaimStatus) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ResourceClaimStatus) MarshalTo(dAtA []byte) (int, error) {
+func (m *NodeAllocatableOverhead) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ResourceClaimStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *NodeAllocatableOverhead) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if len(m.Devices) > 0 {
-		for iNdEx := len(m.Devices) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.Devices[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintGenerated(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x22
-		}
-	}
-	if len(m.ReservedFor) > 0 {
-		for iNdEx := len(m.ReservedFor) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.ReservedFor[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintGenerated(dAtA, i, uint64(size))
+	if m.PerContainer != nil {
+		{
+			size, err := m.PerContainer.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
 			}
-			i--
-			dAtA[i] = 0x12
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
 		}
+		i--
+		dAtA[i] = 0x12
 	}
-	if m.Allocation != nil {
+	if m.PerPod != nil {
 		{
-			size, err := m.Allocation.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.PerPod.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -2260,7 +2363,7 @@ func (m *ResourceClaimStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *ResourceClaimTemplate) Marshal() (dAtA []byte, err error) {
+func (m *NodeAllocatableResource) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -2270,40 +2373,44 @@ func (m *ResourceClaimTemplate) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ResourceClaimTemplate) MarshalTo(dAtA []byte) (int, error) {
+func (m *NodeAllocatableResource) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ResourceClaimTemplate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *NodeAllocatableResource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	{
-		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if m.Overhead != nil {
+		{
+			size, err := m.Overhead.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
 		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x22
 	}
-	i--
-	dAtA[i] = 0x12
-	{
-		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if m.Mapping != nil {
+		{
+			size, err := m.Mapping.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
 		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
 	}
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *ResourceClaimTemplateList) Marshal() (dAtA []byte, err error) {
+func (m *OpaqueDeviceConfiguration) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -2313,32 +2420,18 @@ func (m *ResourceClaimTemplateList) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ResourceClaimTemplateList) MarshalTo(dAtA []byte) (int, error) {
+func (m *OpaqueDeviceConfiguration) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ResourceClaimTemplateList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *OpaqueDeviceConfiguration) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if len(m.Items) > 0 {
-		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintGenerated(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x12
-		}
-	}
 	{
-		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Parameters.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -2346,11 +2439,16 @@ func (m *ResourceClaimTemplateList) MarshalToSizedBuffer(dAtA []byte) (int, erro
 		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
 	i--
+	dAtA[i] = 0x12
+	i -= len(m.Driver)
+	copy(dAtA[i:], m.Driver)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Driver)))
+	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *ResourceClaimTemplateSpec) Marshal() (dAtA []byte, err error) {
+func (m *ResourceClaim) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -2360,16 +2458,26 @@ func (m *ResourceClaimTemplateSpec) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ResourceClaimTemplateSpec) MarshalTo(dAtA []byte) (int, error) {
+func (m *ResourceClaim) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ResourceClaimTemplateSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ResourceClaim) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
 	{
 		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -2393,7 +2501,7 @@ func (m *ResourceClaimTemplateSpec) MarshalToSizedBuffer(dAtA []byte) (int, erro
 	return len(dAtA) - i, nil
 }
 
-func (m *ResourcePool) Marshal() (dAtA []byte, err error) {
+func (m *ResourceClaimConsumerReference) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -2403,31 +2511,40 @@ func (m *ResourcePool) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ResourcePool) MarshalTo(dAtA []byte) (int, error) {
+func (m *ResourceClaimConsumerReference) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ResourcePool) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ResourceClaimConsumerReference) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	i = encodeVarintGenerated(dAtA, i, uint64(m.ResourceSliceCount))
-	i--
-	dAtA[i] = 0x18
-	i = encodeVarintGenerated(dAtA, i, uint64(m.Generation))
+	i -= len(m.UID)
+	copy(dAtA[i:], m.UID)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.UID)))
 	i--
-	dAtA[i] = 0x10
+	dAtA[i] = 0x2a
 	i -= len(m.Name)
 	copy(dAtA[i:], m.Name)
 	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
 	i--
+	dAtA[i] = 0x22
+	i -= len(m.Resource)
+	copy(dAtA[i:], m.Resource)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Resource)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.APIGroup)
+	copy(dAtA[i:], m.APIGroup)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.APIGroup)))
+	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func (m *ResourceSlice) Marshal() (dAtA []byte, err error) {
+func (m *ResourceClaimList) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -2437,28 +2554,32 @@ func (m *ResourceSlice) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ResourceSlice) MarshalTo(dAtA []byte) (int, error) {
+func (m *ResourceClaimList) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ResourceSlice) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ResourceClaimList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	{
-		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
 		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	i--
-	dAtA[i] = 0x12
 	{
-		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -2470,7 +2591,7 @@ func (m *ResourceSlice) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *ResourceSliceList) Marshal() (dAtA []byte, err error) {
+func (m *ResourceClaimSpec) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -2480,32 +2601,18 @@ func (m *ResourceSliceList) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ResourceSliceList) MarshalTo(dAtA []byte) (int, error) {
+func (m *ResourceClaimSpec) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ResourceSliceList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ResourceClaimSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if len(m.Items) > 0 {
-		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
-			{
-				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
-				if err != nil {
-					return 0, err
-				}
-				i -= size
-				i = encodeVarintGenerated(dAtA, i, uint64(size))
-			}
-			i--
-			dAtA[i] = 0x12
-		}
-	}
 	{
-		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Devices.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -2517,7 +2624,7 @@ func (m *ResourceSliceList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *ResourceSliceSpec) Marshal() (dAtA []byte, err error) {
+func (m *ResourceClaimStatus) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -2527,20 +2634,20 @@ func (m *ResourceSliceSpec) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *ResourceSliceSpec) MarshalTo(dAtA []byte) (int, error) {
+func (m *ResourceClaimStatus) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *ResourceSliceSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *ResourceClaimStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if len(m.SharedCounters) > 0 {
-		for iNdEx := len(m.SharedCounters) - 1; iNdEx >= 0; iNdEx-- {
+	if len(m.Devices) > 0 {
+		for iNdEx := len(m.Devices) - 1; iNdEx >= 0; iNdEx-- {
 			{
-				size, err := m.SharedCounters[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				size, err := m.Devices[iNdEx].MarshalToSizedBuffer(dAtA[:i])
 				if err != nil {
 					return 0, err
 				}
@@ -2548,23 +2655,13 @@ func (m *ResourceSliceSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 				i = encodeVarintGenerated(dAtA, i, uint64(size))
 			}
 			i--
-			dAtA[i] = 0x42
-		}
-	}
-	if m.PerDeviceNodeSelection != nil {
-		i--
-		if *m.PerDeviceNodeSelection {
-			dAtA[i] = 1
-		} else {
-			dAtA[i] = 0
+			dAtA[i] = 0x22
 		}
-		i--
-		dAtA[i] = 0x38
 	}
-	if len(m.Devices) > 0 {
-		for iNdEx := len(m.Devices) - 1; iNdEx >= 0; iNdEx-- {
+	if len(m.ReservedFor) > 0 {
+		for iNdEx := len(m.ReservedFor) - 1; iNdEx >= 0; iNdEx-- {
 			{
-				size, err := m.Devices[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				size, err := m.ReservedFor[iNdEx].MarshalToSizedBuffer(dAtA[:i])
 				if err != nil {
 					return 0, err
 				}
@@ -2572,22 +2669,12 @@ func (m *ResourceSliceSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 				i = encodeVarintGenerated(dAtA, i, uint64(size))
 			}
 			i--
-			dAtA[i] = 0x32
-		}
-	}
-	if m.AllNodes != nil {
-		i--
-		if *m.AllNodes {
-			dAtA[i] = 1
-		} else {
-			dAtA[i] = 0
+			dAtA[i] = 0x12
 		}
-		i--
-		dAtA[i] = 0x28
 	}
-	if m.NodeSelector != nil {
+	if m.Allocation != nil {
 		{
-			size, err := m.NodeSelector.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.Allocation.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -2595,17 +2682,33 @@ func (m *ResourceSliceSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintGenerated(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x22
+		dAtA[i] = 0xa
 	}
-	if m.NodeName != nil {
-		i -= len(*m.NodeName)
-		copy(dAtA[i:], *m.NodeName)
-		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.NodeName)))
-		i--
-		dAtA[i] = 0x1a
+	return len(dAtA) - i, nil
+}
+
+func (m *ResourceClaimTemplate) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *ResourceClaimTemplate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ResourceClaimTemplate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
 	{
-		size, err := m.Pool.MarshalToSizedBuffer(dAtA[:i])
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
 			return 0, err
 		}
@@ -2614,311 +2717,651 @@ func (m *ResourceSliceSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	}
 	i--
 	dAtA[i] = 0x12
-	i -= len(m.Driver)
-	copy(dAtA[i:], m.Driver)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Driver)))
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
 	i--
 	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
-	offset -= sovGenerated(v)
-	base := offset
-	for v >= 1<<7 {
-		dAtA[offset] = uint8(v&0x7f | 0x80)
-		v >>= 7
-		offset++
+func (m *ResourceClaimTemplateList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	dAtA[offset] = uint8(v)
-	return base
+	return dAtA[:n], nil
 }
-func (m *AllocatedDeviceStatus) Size() (n int) {
-	if m == nil {
-		return 0
-	}
+
+func (m *ResourceClaimTemplateList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ResourceClaimTemplateList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = len(m.Driver)
-	n += 1 + l + sovGenerated(uint64(l))
-	l = len(m.Pool)
-	n += 1 + l + sovGenerated(uint64(l))
-	l = len(m.Device)
-	n += 1 + l + sovGenerated(uint64(l))
-	if len(m.Conditions) > 0 {
-		for _, e := range m.Conditions {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
 		}
 	}
-	if m.Data != nil {
-		l = m.Data.Size()
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	if m.NetworkData != nil {
-		l = m.NetworkData.Size()
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	if m.ShareID != nil {
-		l = len(*m.ShareID)
-		n += 1 + l + sovGenerated(uint64(l))
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *AllocationResult) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = m.Devices.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	if m.NodeSelector != nil {
-		l = m.NodeSelector.Size()
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	if m.AllocationTimestamp != nil {
-		l = m.AllocationTimestamp.Size()
-		n += 1 + l + sovGenerated(uint64(l))
+func (m *ResourceClaimTemplateSpec) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	return n
+	return dAtA[:n], nil
 }
 
-func (m *CELDeviceSelector) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = len(m.Expression)
-	n += 1 + l + sovGenerated(uint64(l))
-	return n
+func (m *ResourceClaimTemplateSpec) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *CapacityRequestPolicy) Size() (n int) {
-	if m == nil {
-		return 0
-	}
+func (m *ResourceClaimTemplateSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	if m.Default != nil {
-		l = m.Default.Size()
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	if len(m.ValidValues) > 0 {
-		for _, e := range m.ValidValues {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	if m.ValidRange != nil {
-		l = m.ValidRange.Size()
-		n += 1 + l + sovGenerated(uint64(l))
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *CapacityRequestPolicyRange) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if m.Min != nil {
-		l = m.Min.Size()
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	if m.Max != nil {
-		l = m.Max.Size()
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	if m.Step != nil {
-		l = m.Step.Size()
-		n += 1 + l + sovGenerated(uint64(l))
+func (m *ResourcePool) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	return n
+	return dAtA[:n], nil
 }
 
-func (m *CapacityRequirements) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if len(m.Requests) > 0 {
-		for k, v := range m.Requests {
-			_ = k
-			_ = v
-			l = v.Size()
-			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + l + sovGenerated(uint64(l))
-			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
-		}
-	}
-	return n
+func (m *ResourcePool) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *Counter) Size() (n int) {
-	if m == nil {
-		return 0
-	}
+func (m *ResourcePool) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = m.Value.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	return n
+	i = encodeVarintGenerated(dAtA, i, uint64(m.ResourceSliceCount))
+	i--
+	dAtA[i] = 0x18
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Generation))
+	i--
+	dAtA[i] = 0x10
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *CounterSet) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *ResourceSlice) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *ResourceSlice) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ResourceSlice) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = len(m.Name)
-	n += 1 + l + sovGenerated(uint64(l))
-	if len(m.Counters) > 0 {
-		for k, v := range m.Counters {
-			_ = k
-			_ = v
-			l = v.Size()
-			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + l + sovGenerated(uint64(l))
-			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	return n
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
 }
 
-func (m *Device) Size() (n int) {
-	if m == nil {
-		return 0
+func (m *ResourceSliceList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *ResourceSliceList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ResourceSliceList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = len(m.Name)
-	n += 1 + l + sovGenerated(uint64(l))
-	if len(m.Attributes) > 0 {
-		for k, v := range m.Attributes {
-			_ = k
-			_ = v
-			l = v.Size()
-			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + l + sovGenerated(uint64(l))
-			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
 		}
 	}
-	if len(m.Capacity) > 0 {
-		for k, v := range m.Capacity {
-			_ = k
-			_ = v
-			l = v.Size()
-			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + l + sovGenerated(uint64(l))
-			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	if len(m.ConsumesCounters) > 0 {
-		for _, e := range m.ConsumesCounters {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *ResourceSliceSpec) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ResourceSliceSpec) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ResourceSliceSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.SkipNodeOperations) > 0 {
+		for iNdEx := len(m.SkipNodeOperations) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.SkipNodeOperations[iNdEx])
+			copy(dAtA[i:], m.SkipNodeOperations[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.SkipNodeOperations[iNdEx])))
+			i--
+			dAtA[i] = 0x52
 		}
 	}
-	if m.NodeName != nil {
-		l = len(*m.NodeName)
-		n += 1 + l + sovGenerated(uint64(l))
+	if m.PartitionTypeAttribute != nil {
+		i -= len(*m.PartitionTypeAttribute)
+		copy(dAtA[i:], *m.PartitionTypeAttribute)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.PartitionTypeAttribute)))
+		i--
+		dAtA[i] = 0x4a
 	}
-	if m.NodeSelector != nil {
-		l = m.NodeSelector.Size()
-		n += 1 + l + sovGenerated(uint64(l))
+	if len(m.SharedCounters) > 0 {
+		for iNdEx := len(m.SharedCounters) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.SharedCounters[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x42
+		}
+	}
+	if m.PerDeviceNodeSelection != nil {
+		i--
+		if *m.PerDeviceNodeSelection {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x38
+	}
+	if len(m.Devices) > 0 {
+		for iNdEx := len(m.Devices) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Devices[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x32
+		}
 	}
 	if m.AllNodes != nil {
-		n += 2
+		i--
+		if *m.AllNodes {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x28
 	}
-	if len(m.Taints) > 0 {
-		for _, e := range m.Taints {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
+	if m.NodeSelector != nil {
+		{
+			size, err := m.NodeSelector.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
 		}
+		i--
+		dAtA[i] = 0x22
 	}
-	if m.BindsToNode != nil {
-		n += 2
+	if m.NodeName != nil {
+		i -= len(*m.NodeName)
+		copy(dAtA[i:], *m.NodeName)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.NodeName)))
+		i--
+		dAtA[i] = 0x1a
 	}
-	if len(m.BindingConditions) > 0 {
-		for _, s := range m.BindingConditions {
-			l = len(s)
-			n += 1 + l + sovGenerated(uint64(l))
+	{
+		size, err := m.Pool.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
 		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	if len(m.BindingFailureConditions) > 0 {
-		for _, s := range m.BindingFailureConditions {
-			l = len(s)
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Driver)
+	copy(dAtA[i:], m.Driver)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Driver)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *AllocatedDeviceStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Driver)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Pool)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Device)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Conditions) > 0 {
+		for _, e := range m.Conditions {
+			l = e.Size()
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
-	if m.AllowMultipleAllocations != nil {
-		n += 2
+	if m.Data != nil {
+		l = m.Data.Size()
+		n += 1 + l + sovGenerated(uint64(l))
 	}
-	if len(m.NodeAllocatableResourceMappings) > 0 {
-		for k, v := range m.NodeAllocatableResourceMappings {
-			_ = k
-			_ = v
-			l = v.Size()
-			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + l + sovGenerated(uint64(l))
-			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
-		}
+	if m.NetworkData != nil {
+		l = m.NetworkData.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.ShareID != nil {
+		l = len(*m.ShareID)
+		n += 1 + l + sovGenerated(uint64(l))
 	}
 	return n
 }
 
-func (m *DeviceAllocationConfiguration) Size() (n int) {
+func (m *AllocationResult) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.Source)
+	l = m.Devices.Size()
 	n += 1 + l + sovGenerated(uint64(l))
-	if len(m.Requests) > 0 {
-		for _, s := range m.Requests {
-			l = len(s)
-			n += 1 + l + sovGenerated(uint64(l))
-		}
+	if m.NodeSelector != nil {
+		l = m.NodeSelector.Size()
+		n += 1 + l + sovGenerated(uint64(l))
 	}
-	l = m.DeviceConfiguration.Size()
+	if m.AllocationTimestamp != nil {
+		l = m.AllocationTimestamp.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *CELDeviceSelector) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Expression)
 	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
-func (m *DeviceAllocationResult) Size() (n int) {
+func (m *CapacityRequestPolicy) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if len(m.Results) > 0 {
-		for _, e := range m.Results {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
-		}
+	if m.Default != nil {
+		l = m.Default.Size()
+		n += 1 + l + sovGenerated(uint64(l))
 	}
-	if len(m.Config) > 0 {
-		for _, e := range m.Config {
+	if len(m.ValidValues) > 0 {
+		for _, e := range m.ValidValues {
 			l = e.Size()
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
+	if m.ValidRange != nil {
+		l = m.ValidRange.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
 	return n
 }
 
-func (m *DeviceAttribute) Size() (n int) {
+func (m *CapacityRequestPolicyRange) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	if m.IntValue != nil {
-		n += 1 + sovGenerated(uint64(*m.IntValue))
-	}
-	if m.BoolValue != nil {
-		n += 2
+	if m.Min != nil {
+		l = m.Min.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Max != nil {
+		l = m.Max.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Step != nil {
+		l = m.Step.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *CapacityRequirements) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Requests) > 0 {
+		for k, v := range m.Requests {
+			_ = k
+			_ = v
+			l = v.Size()
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + l + sovGenerated(uint64(l))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
+	return n
+}
+
+func (m *Counter) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Value.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *CounterSet) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Counters) > 0 {
+		for k, v := range m.Counters {
+			_ = k
+			_ = v
+			l = v.Size()
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + l + sovGenerated(uint64(l))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
+	return n
+}
+
+func (m *Device) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Attributes) > 0 {
+		for k, v := range m.Attributes {
+			_ = k
+			_ = v
+			l = v.Size()
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + l + sovGenerated(uint64(l))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
+	if len(m.Capacity) > 0 {
+		for k, v := range m.Capacity {
+			_ = k
+			_ = v
+			l = v.Size()
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + l + sovGenerated(uint64(l))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
+	if len(m.ConsumesCounters) > 0 {
+		for _, e := range m.ConsumesCounters {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if m.NodeName != nil {
+		l = len(*m.NodeName)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.NodeSelector != nil {
+		l = m.NodeSelector.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.AllNodes != nil {
+		n += 2
+	}
+	if len(m.Taints) > 0 {
+		for _, e := range m.Taints {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if m.BindsToNode != nil {
+		n += 2
+	}
+	if len(m.BindingConditions) > 0 {
+		for _, s := range m.BindingConditions {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.BindingFailureConditions) > 0 {
+		for _, s := range m.BindingFailureConditions {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if m.AllowMultipleAllocations != nil {
+		n += 2
+	}
+	if len(m.NodeAllocatableResources) > 0 {
+		for k, v := range m.NodeAllocatableResources {
+			_ = k
+			_ = v
+			l = v.Size()
+			mapEntrySize := 1 + len(k) + sovGenerated(uint64(len(k))) + 1 + l + sovGenerated(uint64(l))
+			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
+		}
+	}
+	return n
+}
+
+func (m *DeviceAllocationConfiguration) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Source)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Requests) > 0 {
+		for _, s := range m.Requests {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = m.DeviceConfiguration.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *DeviceAllocationResult) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Results) > 0 {
+		for _, e := range m.Results {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.Config) > 0 {
+		for _, e := range m.Config {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *DeviceAttribute) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.IntValue != nil {
+		n += 1 + sovGenerated(uint64(*m.IntValue))
+	}
+	if m.BoolValue != nil {
+		n += 2
 	}
 	if m.StringValue != nil {
 		l = len(*m.StringValue)
@@ -3129,6 +3572,25 @@ func (m *DeviceCounterConsumption) Size() (n int) {
 			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
 		}
 	}
+	if len(m.CompatibilityGroups) > 0 {
+		for _, s := range m.CompatibilityGroups {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *DeviceDerivedAttribute) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Expression)
+	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
@@ -3201,6 +3663,12 @@ func (m *DeviceRequestAllocationResult) Size() (n int) {
 			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
 		}
 	}
+	if len(m.SkipNodeOperations) > 0 {
+		for _, s := range m.SkipNodeOperations {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -3246,6 +3714,12 @@ func (m *DeviceSubRequest) Size() (n int) {
 		l = m.Capacity.Size()
 		n += 1 + l + sovGenerated(uint64(l))
 	}
+	if len(m.DerivedAttributes) > 0 {
+		for _, e := range m.DerivedAttributes {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -3268,67 +3742,156 @@ func (m *DeviceTaint) Size() (n int) {
 	return n
 }
 
-func (m *DeviceToleration) Size() (n int) {
+func (m *DeviceTaintRule) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.Key)
-	n += 1 + l + sovGenerated(uint64(l))
-	l = len(m.Operator)
+	l = m.ObjectMeta.Size()
 	n += 1 + l + sovGenerated(uint64(l))
-	l = len(m.Value)
+	l = m.Spec.Size()
 	n += 1 + l + sovGenerated(uint64(l))
-	l = len(m.Effect)
+	l = m.Status.Size()
 	n += 1 + l + sovGenerated(uint64(l))
-	if m.TolerationSeconds != nil {
-		n += 1 + sovGenerated(uint64(*m.TolerationSeconds))
-	}
 	return n
 }
 
-func (m *ExactDeviceRequest) Size() (n int) {
+func (m *DeviceTaintRuleList) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.DeviceClassName)
+	l = m.ListMeta.Size()
 	n += 1 + l + sovGenerated(uint64(l))
-	if len(m.Selectors) > 0 {
-		for _, e := range m.Selectors {
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
 			l = e.Size()
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
-	l = len(m.AllocationMode)
-	n += 1 + l + sovGenerated(uint64(l))
-	n += 1 + sovGenerated(uint64(m.Count))
-	if m.AdminAccess != nil {
-		n += 2
-	}
-	if len(m.Tolerations) > 0 {
-		for _, e := range m.Tolerations {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
-		}
+	return n
+}
+
+func (m *DeviceTaintRuleSpec) Size() (n int) {
+	if m == nil {
+		return 0
 	}
-	if m.Capacity != nil {
-		l = m.Capacity.Size()
+	var l int
+	_ = l
+	if m.DeviceSelector != nil {
+		l = m.DeviceSelector.Size()
 		n += 1 + l + sovGenerated(uint64(l))
 	}
+	l = m.Taint.Size()
+	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
-func (m *NetworkDeviceData) Size() (n int) {
+func (m *DeviceTaintRuleStatus) Size() (n int) {
 	if m == nil {
 		return 0
 	}
 	var l int
 	_ = l
-	l = len(m.InterfaceName)
-	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Conditions) > 0 {
+		for _, e := range m.Conditions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *DeviceTaintSelector) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Driver != nil {
+		l = len(*m.Driver)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Pool != nil {
+		l = len(*m.Pool)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Device != nil {
+		l = len(*m.Device)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *DeviceToleration) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Key)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Operator)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Value)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Effect)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.TolerationSeconds != nil {
+		n += 1 + sovGenerated(uint64(*m.TolerationSeconds))
+	}
+	return n
+}
+
+func (m *ExactDeviceRequest) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.DeviceClassName)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Selectors) > 0 {
+		for _, e := range m.Selectors {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = len(m.AllocationMode)
+	n += 1 + l + sovGenerated(uint64(l))
+	n += 1 + sovGenerated(uint64(m.Count))
+	if m.AdminAccess != nil {
+		n += 2
+	}
+	if len(m.Tolerations) > 0 {
+		for _, e := range m.Tolerations {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if m.Capacity != nil {
+		l = m.Capacity.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.DerivedAttributes) > 0 {
+		for _, e := range m.DerivedAttributes {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *NetworkDeviceData) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.InterfaceName)
+	n += 1 + l + sovGenerated(uint64(l))
 	if len(m.IPs) > 0 {
 		for _, s := range m.IPs {
 			l = len(s)
@@ -3340,7 +3903,7 @@ func (m *NetworkDeviceData) Size() (n int) {
 	return n
 }
 
-func (m *NodeAllocatableResourceMapping) Size() (n int) {
+func (m *NodeAllocatableMapping) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -3350,8 +3913,46 @@ func (m *NodeAllocatableResourceMapping) Size() (n int) {
 		l = len(*m.CapacityKey)
 		n += 1 + l + sovGenerated(uint64(l))
 	}
-	if m.AllocationMultiplier != nil {
-		l = m.AllocationMultiplier.Size()
+	if m.CapacityMultiplier != nil {
+		l = m.CapacityMultiplier.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.DeviceMultiplier != nil {
+		l = m.DeviceMultiplier.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *NodeAllocatableOverhead) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.PerPod != nil {
+		l = m.PerPod.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.PerContainer != nil {
+		l = m.PerContainer.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *NodeAllocatableResource) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Mapping != nil {
+		l = m.Mapping.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Overhead != nil {
+		l = m.Overhead.Size()
 		n += 1 + l + sovGenerated(uint64(l))
 	}
 	return n
@@ -3577,6 +4178,16 @@ func (m *ResourceSliceSpec) Size() (n int) {
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
+	if m.PartitionTypeAttribute != nil {
+		l = len(*m.PartitionTypeAttribute)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.SkipNodeOperations) > 0 {
+		for _, s := range m.SkipNodeOperations {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -3743,16 +4354,16 @@ func (this *Device) String() string {
 		mapStringForCapacity += fmt.Sprintf("%v: %v,", k, this.Capacity[QualifiedName(k)])
 	}
 	mapStringForCapacity += "}"
-	keysForNodeAllocatableResourceMappings := make([]string, 0, len(this.NodeAllocatableResourceMappings))
-	for k := range this.NodeAllocatableResourceMappings {
-		keysForNodeAllocatableResourceMappings = append(keysForNodeAllocatableResourceMappings, string(k))
+	keysForNodeAllocatableResources := make([]string, 0, len(this.NodeAllocatableResources))
+	for k := range this.NodeAllocatableResources {
+		keysForNodeAllocatableResources = append(keysForNodeAllocatableResources, string(k))
 	}
-	sort.Strings(keysForNodeAllocatableResourceMappings)
-	mapStringForNodeAllocatableResourceMappings := "map[k8s_io_api_core_v1.ResourceName]NodeAllocatableResourceMapping{"
-	for _, k := range keysForNodeAllocatableResourceMappings {
-		mapStringForNodeAllocatableResourceMappings += fmt.Sprintf("%v: %v,", k, this.NodeAllocatableResourceMappings[k8s_io_api_core_v1.ResourceName(k)])
+	sort.Strings(keysForNodeAllocatableResources)
+	mapStringForNodeAllocatableResources := "map[k8s_io_api_core_v1.ResourceName]NodeAllocatableResource{"
+	for _, k := range keysForNodeAllocatableResources {
+		mapStringForNodeAllocatableResources += fmt.Sprintf("%v: %v,", k, this.NodeAllocatableResources[k8s_io_api_core_v1.ResourceName(k)])
 	}
-	mapStringForNodeAllocatableResourceMappings += "}"
+	mapStringForNodeAllocatableResources += "}"
 	s := strings.Join([]string{`&Device{`,
 		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
 		`Attributes:` + mapStringForAttributes + `,`,
@@ -3766,7 +4377,7 @@ func (this *Device) String() string {
 		`BindingConditions:` + fmt.Sprintf("%v", this.BindingConditions) + `,`,
 		`BindingFailureConditions:` + fmt.Sprintf("%v", this.BindingFailureConditions) + `,`,
 		`AllowMultipleAllocations:` + valueToStringGenerated(this.AllowMultipleAllocations) + `,`,
-		`NodeAllocatableResourceMappings:` + mapStringForNodeAllocatableResourceMappings + `,`,
+		`NodeAllocatableResources:` + mapStringForNodeAllocatableResources + `,`,
 		`}`,
 	}, "")
 	return s
@@ -3968,6 +4579,18 @@ func (this *DeviceCounterConsumption) String() string {
 	s := strings.Join([]string{`&DeviceCounterConsumption{`,
 		`CounterSet:` + fmt.Sprintf("%v", this.CounterSet) + `,`,
 		`Counters:` + mapStringForCounters + `,`,
+		`CompatibilityGroups:` + fmt.Sprintf("%v", this.CompatibilityGroups) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *DeviceDerivedAttribute) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&DeviceDerivedAttribute{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`Expression:` + fmt.Sprintf("%v", this.Expression) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4019,6 +4642,7 @@ func (this *DeviceRequestAllocationResult) String() string {
 		`BindingFailureConditions:` + fmt.Sprintf("%v", this.BindingFailureConditions) + `,`,
 		`ShareID:` + valueToStringGenerated(this.ShareID) + `,`,
 		`ConsumedCapacity:` + mapStringForConsumedCapacity + `,`,
+		`SkipNodeOperations:` + fmt.Sprintf("%v", this.SkipNodeOperations) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4047,6 +4671,11 @@ func (this *DeviceSubRequest) String() string {
 		repeatedStringForTolerations += strings.Replace(strings.Replace(f.String(), "DeviceToleration", "DeviceToleration", 1), `&`, ``, 1) + ","
 	}
 	repeatedStringForTolerations += "}"
+	repeatedStringForDerivedAttributes := "[]DeviceDerivedAttribute{"
+	for _, f := range this.DerivedAttributes {
+		repeatedStringForDerivedAttributes += strings.Replace(strings.Replace(f.String(), "DeviceDerivedAttribute", "DeviceDerivedAttribute", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForDerivedAttributes += "}"
 	s := strings.Join([]string{`&DeviceSubRequest{`,
 		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
 		`DeviceClassName:` + fmt.Sprintf("%v", this.DeviceClassName) + `,`,
@@ -4055,6 +4684,73 @@ func (this *DeviceSubRequest) String() string {
 		`Count:` + fmt.Sprintf("%v", this.Count) + `,`,
 		`Tolerations:` + repeatedStringForTolerations + `,`,
 		`Capacity:` + strings.Replace(this.Capacity.String(), "CapacityRequirements", "CapacityRequirements", 1) + `,`,
+		`DerivedAttributes:` + repeatedStringForDerivedAttributes + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *DeviceTaintRule) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&DeviceTaintRule{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "DeviceTaintRuleSpec", "DeviceTaintRuleSpec", 1), `&`, ``, 1) + `,`,
+		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "DeviceTaintRuleStatus", "DeviceTaintRuleStatus", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *DeviceTaintRuleList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]DeviceTaintRule{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "DeviceTaintRule", "DeviceTaintRule", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&DeviceTaintRuleList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *DeviceTaintRuleSpec) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&DeviceTaintRuleSpec{`,
+		`DeviceSelector:` + strings.Replace(this.DeviceSelector.String(), "DeviceTaintSelector", "DeviceTaintSelector", 1) + `,`,
+		`Taint:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.Taint), "DeviceTaint", "DeviceTaint", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *DeviceTaintRuleStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForConditions := "[]Condition{"
+	for _, f := range this.Conditions {
+		repeatedStringForConditions += fmt.Sprintf("%v", f) + ","
+	}
+	repeatedStringForConditions += "}"
+	s := strings.Join([]string{`&DeviceTaintRuleStatus{`,
+		`Conditions:` + repeatedStringForConditions + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *DeviceTaintSelector) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&DeviceTaintSelector{`,
+		`Driver:` + valueToStringGenerated(this.Driver) + `,`,
+		`Pool:` + valueToStringGenerated(this.Pool) + `,`,
+		`Device:` + valueToStringGenerated(this.Device) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4087,6 +4783,11 @@ func (this *ExactDeviceRequest) String() string {
 		repeatedStringForTolerations += strings.Replace(strings.Replace(f.String(), "DeviceToleration", "DeviceToleration", 1), `&`, ``, 1) + ","
 	}
 	repeatedStringForTolerations += "}"
+	repeatedStringForDerivedAttributes := "[]DeviceDerivedAttribute{"
+	for _, f := range this.DerivedAttributes {
+		repeatedStringForDerivedAttributes += strings.Replace(strings.Replace(f.String(), "DeviceDerivedAttribute", "DeviceDerivedAttribute", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForDerivedAttributes += "}"
 	s := strings.Join([]string{`&ExactDeviceRequest{`,
 		`DeviceClassName:` + fmt.Sprintf("%v", this.DeviceClassName) + `,`,
 		`Selectors:` + repeatedStringForSelectors + `,`,
@@ -4095,6 +4796,7 @@ func (this *ExactDeviceRequest) String() string {
 		`AdminAccess:` + valueToStringGenerated(this.AdminAccess) + `,`,
 		`Tolerations:` + repeatedStringForTolerations + `,`,
 		`Capacity:` + strings.Replace(this.Capacity.String(), "CapacityRequirements", "CapacityRequirements", 1) + `,`,
+		`DerivedAttributes:` + repeatedStringForDerivedAttributes + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4111,13 +4813,36 @@ func (this *NetworkDeviceData) String() string {
 	}, "")
 	return s
 }
-func (this *NodeAllocatableResourceMapping) String() string {
+func (this *NodeAllocatableMapping) String() string {
 	if this == nil {
 		return "nil"
 	}
-	s := strings.Join([]string{`&NodeAllocatableResourceMapping{`,
+	s := strings.Join([]string{`&NodeAllocatableMapping{`,
 		`CapacityKey:` + valueToStringGenerated(this.CapacityKey) + `,`,
-		`AllocationMultiplier:` + strings.Replace(fmt.Sprintf("%v", this.AllocationMultiplier), "Quantity", "resource.Quantity", 1) + `,`,
+		`CapacityMultiplier:` + strings.Replace(fmt.Sprintf("%v", this.CapacityMultiplier), "Quantity", "resource.Quantity", 1) + `,`,
+		`DeviceMultiplier:` + strings.Replace(fmt.Sprintf("%v", this.DeviceMultiplier), "Quantity", "resource.Quantity", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *NodeAllocatableOverhead) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&NodeAllocatableOverhead{`,
+		`PerPod:` + strings.Replace(fmt.Sprintf("%v", this.PerPod), "Quantity", "resource.Quantity", 1) + `,`,
+		`PerContainer:` + strings.Replace(fmt.Sprintf("%v", this.PerContainer), "Quantity", "resource.Quantity", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *NodeAllocatableResource) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&NodeAllocatableResource{`,
+		`Mapping:` + strings.Replace(this.Mapping.String(), "NodeAllocatableMapping", "NodeAllocatableMapping", 1) + `,`,
+		`Overhead:` + strings.Replace(this.Overhead.String(), "NodeAllocatableOverhead", "NodeAllocatableOverhead", 1) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4296,29 +5021,867 @@ func (this *ResourceSliceSpec) String() string {
 	for _, f := range this.SharedCounters {
 		repeatedStringForSharedCounters += strings.Replace(strings.Replace(f.String(), "CounterSet", "CounterSet", 1), `&`, ``, 1) + ","
 	}
-	repeatedStringForSharedCounters += "}"
-	s := strings.Join([]string{`&ResourceSliceSpec{`,
-		`Driver:` + fmt.Sprintf("%v", this.Driver) + `,`,
-		`Pool:` + strings.Replace(strings.Replace(this.Pool.String(), "ResourcePool", "ResourcePool", 1), `&`, ``, 1) + `,`,
-		`NodeName:` + valueToStringGenerated(this.NodeName) + `,`,
-		`NodeSelector:` + strings.Replace(fmt.Sprintf("%v", this.NodeSelector), "NodeSelector", "v11.NodeSelector", 1) + `,`,
-		`AllNodes:` + valueToStringGenerated(this.AllNodes) + `,`,
-		`Devices:` + repeatedStringForDevices + `,`,
-		`PerDeviceNodeSelection:` + valueToStringGenerated(this.PerDeviceNodeSelection) + `,`,
-		`SharedCounters:` + repeatedStringForSharedCounters + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func valueToStringGenerated(v interface{}) string {
-	rv := reflect.ValueOf(v)
-	if rv.IsNil() {
-		return "nil"
+	repeatedStringForSharedCounters += "}"
+	s := strings.Join([]string{`&ResourceSliceSpec{`,
+		`Driver:` + fmt.Sprintf("%v", this.Driver) + `,`,
+		`Pool:` + strings.Replace(strings.Replace(this.Pool.String(), "ResourcePool", "ResourcePool", 1), `&`, ``, 1) + `,`,
+		`NodeName:` + valueToStringGenerated(this.NodeName) + `,`,
+		`NodeSelector:` + strings.Replace(fmt.Sprintf("%v", this.NodeSelector), "NodeSelector", "v11.NodeSelector", 1) + `,`,
+		`AllNodes:` + valueToStringGenerated(this.AllNodes) + `,`,
+		`Devices:` + repeatedStringForDevices + `,`,
+		`PerDeviceNodeSelection:` + valueToStringGenerated(this.PerDeviceNodeSelection) + `,`,
+		`SharedCounters:` + repeatedStringForSharedCounters + `,`,
+		`PartitionTypeAttribute:` + valueToStringGenerated(this.PartitionTypeAttribute) + `,`,
+		`SkipNodeOperations:` + fmt.Sprintf("%v", this.SkipNodeOperations) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringGenerated(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *AllocatedDeviceStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AllocatedDeviceStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AllocatedDeviceStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Driver", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Driver = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Pool", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Pool = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Device", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Device = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Conditions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Conditions = append(m.Conditions, v1.Condition{})
+			if err := m.Conditions[len(m.Conditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Data == nil {
+				m.Data = &runtime.RawExtension{}
+			}
+			if err := m.Data.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NetworkData", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.NetworkData == nil {
+				m.NetworkData = &NetworkDeviceData{}
+			}
+			if err := m.NetworkData.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ShareID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ShareID = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AllocationResult) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AllocationResult: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AllocationResult: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Devices", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Devices.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeSelector", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.NodeSelector == nil {
+				m.NodeSelector = &v11.NodeSelector{}
+			}
+			if err := m.NodeSelector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AllocationTimestamp", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.AllocationTimestamp == nil {
+				m.AllocationTimestamp = &v1.Time{}
+			}
+			if err := m.AllocationTimestamp.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CELDeviceSelector) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CELDeviceSelector: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CELDeviceSelector: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Expression", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Expression = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CapacityRequestPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CapacityRequestPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CapacityRequestPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Default", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Default == nil {
+				m.Default = &resource.Quantity{}
+			}
+			if err := m.Default.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ValidValues", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ValidValues = append(m.ValidValues, resource.Quantity{})
+			if err := m.ValidValues[len(m.ValidValues)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ValidRange", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ValidRange == nil {
+				m.ValidRange = &CapacityRequestPolicyRange{}
+			}
+			if err := m.ValidRange.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CapacityRequestPolicyRange) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CapacityRequestPolicyRange: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CapacityRequestPolicyRange: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Min", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Min == nil {
+				m.Min = &resource.Quantity{}
+			}
+			if err := m.Min.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Max", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Max == nil {
+				m.Max = &resource.Quantity{}
+			}
+			if err := m.Max.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Step", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Step == nil {
+				m.Step = &resource.Quantity{}
+			}
+			if err := m.Step.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
 	}
-	pv := reflect.Indirect(rv).Interface()
-	return fmt.Sprintf("*%v", pv)
+	return nil
 }
-func (m *AllocatedDeviceStatus) Unmarshal(dAtA []byte) error {
+func (m *CapacityRequirements) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -4341,17 +5904,17 @@ func (m *AllocatedDeviceStatus) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AllocatedDeviceStatus: wiretype end group for non-group")
+			return fmt.Errorf("proto: CapacityRequirements: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AllocatedDeviceStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CapacityRequirements: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Driver", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Requests", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -4361,91 +5924,174 @@ func (m *AllocatedDeviceStatus) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Driver = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Pool", wireType)
+			if m.Requests == nil {
+				m.Requests = make(map[QualifiedName]resource.Quantity)
 			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
+			var mapkey QualifiedName
+			mapvalue := &resource.Quantity{}
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
 				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = QualifiedName(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var mapmsglen int
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapmsglen |= int(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					if mapmsglen < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postmsgIndex := iNdEx + mapmsglen
+					if postmsgIndex < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postmsgIndex > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = &resource.Quantity{}
+					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
+						return err
+					}
+					iNdEx = postmsgIndex
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipGenerated(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
+			m.Requests[QualifiedName(mapkey)] = *mapvalue
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			if postIndex > l {
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Pool = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Device", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Counter) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
 			}
-			if postIndex > l {
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Device = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 4:
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Counter: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Counter: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Conditions", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -4472,16 +6118,65 @@ func (m *AllocatedDeviceStatus) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Conditions = append(m.Conditions, v1.Condition{})
-			if err := m.Conditions[len(m.Conditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Value.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 5:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CounterSet) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CounterSet: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CounterSet: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -4491,31 +6186,27 @@ func (m *AllocatedDeviceStatus) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Data == nil {
-				m.Data = &runtime.RawExtension{}
-			}
-			if err := m.Data.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 6:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NetworkData", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Counters", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -4542,45 +6233,105 @@ func (m *AllocatedDeviceStatus) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.NetworkData == nil {
-				m.NetworkData = &NetworkDeviceData{}
-			}
-			if err := m.NetworkData.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 7:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ShareID", wireType)
+			if m.Counters == nil {
+				m.Counters = make(map[string]Counter)
 			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
+			var mapkey string
+			mapvalue := &Counter{}
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
 				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var mapmsglen int
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapmsglen |= int(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					if mapmsglen < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postmsgIndex := iNdEx + mapmsglen
+					if postmsgIndex < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postmsgIndex > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = &Counter{}
+					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
+						return err
+					}
+					iNdEx = postmsgIndex
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipGenerated(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			s := string(dAtA[iNdEx:postIndex])
-			m.ShareID = &s
+			m.Counters[mapkey] = *mapvalue
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -4603,7 +6354,7 @@ func (m *AllocatedDeviceStatus) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *AllocationResult) Unmarshal(dAtA []byte) error {
+func (m *Device) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -4626,50 +6377,17 @@ func (m *AllocationResult) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: AllocationResult: wiretype end group for non-group")
+			return fmt.Errorf("proto: Device: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: AllocationResult: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: Device: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Devices", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Devices.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NodeSelector", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -4679,31 +6397,27 @@ func (m *AllocationResult) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.NodeSelector == nil {
-				m.NodeSelector = &v11.NodeSelector{}
-			}
-			if err := m.NodeSelector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AllocationTimestamp", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Attributes", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -4730,148 +6444,109 @@ func (m *AllocationResult) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.AllocationTimestamp == nil {
-				m.AllocationTimestamp = &v1.Time{}
-			}
-			if err := m.AllocationTimestamp.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *CELDeviceSelector) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: CELDeviceSelector: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CELDeviceSelector: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Expression", wireType)
+			if m.Attributes == nil {
+				m.Attributes = make(map[QualifiedName]DeviceAttribute)
 			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
+			var mapkey QualifiedName
+			mapvalue := &DeviceAttribute{}
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
 				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = QualifiedName(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var mapmsglen int
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapmsglen |= int(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					if mapmsglen < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postmsgIndex := iNdEx + mapmsglen
+					if postmsgIndex < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postmsgIndex > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = &DeviceAttribute{}
+					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
+						return err
+					}
+					iNdEx = postmsgIndex
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipGenerated(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Expression = string(dAtA[iNdEx:postIndex])
+			m.Attributes[QualifiedName(mapkey)] = *mapvalue
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *CapacityRequestPolicy) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: CapacityRequestPolicy: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CapacityRequestPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Default", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Capacity", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -4898,16 +6573,109 @@ func (m *CapacityRequestPolicy) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Default == nil {
-				m.Default = &resource.Quantity{}
+			if m.Capacity == nil {
+				m.Capacity = make(map[QualifiedName]DeviceCapacity)
 			}
-			if err := m.Default.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			var mapkey QualifiedName
+			mapvalue := &DeviceCapacity{}
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = QualifiedName(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var mapmsglen int
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapmsglen |= int(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					if mapmsglen < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postmsgIndex := iNdEx + mapmsglen
+					if postmsgIndex < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postmsgIndex > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = &DeviceCapacity{}
+					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
+						return err
+					}
+					iNdEx = postmsgIndex
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipGenerated(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
 			}
+			m.Capacity[QualifiedName(mapkey)] = *mapvalue
 			iNdEx = postIndex
-		case 3:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ValidValues", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConsumesCounters", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -4934,16 +6702,16 @@ func (m *CapacityRequestPolicy) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ValidValues = append(m.ValidValues, resource.Quantity{})
-			if err := m.ValidValues[len(m.ValidValues)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.ConsumesCounters = append(m.ConsumesCounters, DeviceCounterConsumption{})
+			if err := m.ConsumesCounters[len(m.ConsumesCounters)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
+		case 5:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ValidRange", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -4953,81 +6721,28 @@ func (m *CapacityRequestPolicy) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.ValidRange == nil {
-				m.ValidRange = &CapacityRequestPolicyRange{}
-			}
-			if err := m.ValidRange.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.NodeName = &s
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *CapacityRequestPolicyRange) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: CapacityRequestPolicyRange: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CapacityRequestPolicyRange: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Min", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeSelector", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -5054,16 +6769,37 @@ func (m *CapacityRequestPolicyRange) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Min == nil {
-				m.Min = &resource.Quantity{}
+			if m.NodeSelector == nil {
+				m.NodeSelector = &v11.NodeSelector{}
 			}
-			if err := m.Min.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.NodeSelector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AllNodes", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.AllNodes = &b
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Max", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Taints", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -5090,18 +6826,37 @@ func (m *CapacityRequestPolicyRange) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Max == nil {
-				m.Max = &resource.Quantity{}
-			}
-			if err := m.Max.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Taints = append(m.Taints, DeviceTaint{})
+			if err := m.Taints[len(m.Taints)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 3:
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BindsToNode", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.BindsToNode = &b
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Step", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BindingConditions", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -5111,81 +6866,80 @@ func (m *CapacityRequestPolicyRange) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Step == nil {
-				m.Step = &resource.Quantity{}
+			m.BindingConditions = append(m.BindingConditions, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BindingFailureConditions", wireType)
 			}
-			if err := m.Step.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			if (iNdEx + skippy) > l {
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *CapacityRequirements) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
+			m.BindingFailureConditions = append(m.BindingFailureConditions, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 12:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AllowMultipleAllocations", wireType)
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: CapacityRequirements: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CapacityRequirements: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			b := bool(v != 0)
+			m.AllowMultipleAllocations = &b
+		case 14:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Requests", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeAllocatableResources", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -5212,11 +6966,11 @@ func (m *CapacityRequirements) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Requests == nil {
-				m.Requests = make(map[QualifiedName]resource.Quantity)
+			if m.NodeAllocatableResources == nil {
+				m.NodeAllocatableResources = make(map[k8s_io_api_core_v1.ResourceName]NodeAllocatableResource)
 			}
-			var mapkey QualifiedName
-			mapvalue := &resource.Quantity{}
+			var mapkey k8s_io_api_core_v1.ResourceName
+			mapvalue := &NodeAllocatableResource{}
 			for iNdEx < postIndex {
 				entryPreIndex := iNdEx
 				var wire uint64
@@ -5262,7 +7016,7 @@ func (m *CapacityRequirements) Unmarshal(dAtA []byte) error {
 					if postStringIndexmapkey > l {
 						return io.ErrUnexpectedEOF
 					}
-					mapkey = QualifiedName(dAtA[iNdEx:postStringIndexmapkey])
+					mapkey = k8s_io_api_core_v1.ResourceName(dAtA[iNdEx:postStringIndexmapkey])
 					iNdEx = postStringIndexmapkey
 				} else if fieldNum == 2 {
 					var mapmsglen int
@@ -5290,7 +7044,7 @@ func (m *CapacityRequirements) Unmarshal(dAtA []byte) error {
 					if postmsgIndex > l {
 						return io.ErrUnexpectedEOF
 					}
-					mapvalue = &resource.Quantity{}
+					mapvalue = &NodeAllocatableResource{}
 					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
 						return err
 					}
@@ -5310,7 +7064,7 @@ func (m *CapacityRequirements) Unmarshal(dAtA []byte) error {
 					iNdEx += skippy
 				}
 			}
-			m.Requests[QualifiedName(mapkey)] = *mapvalue
+			m.NodeAllocatableResources[k8s_io_api_core_v1.ResourceName(mapkey)] = *mapvalue
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -5333,7 +7087,7 @@ func (m *CapacityRequirements) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *Counter) Unmarshal(dAtA []byte) error {
+func (m *DeviceAllocationConfiguration) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -5356,17 +7110,17 @@ func (m *Counter) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: Counter: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceAllocationConfiguration: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Counter: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceAllocationConfiguration: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Source", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -5376,78 +7130,27 @@ func (m *Counter) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Value.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Source = AllocationConfigSource(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *CounterSet) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: CounterSet: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CounterSet: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Requests", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -5475,11 +7178,11 @@ func (m *CounterSet) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.Requests = append(m.Requests, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 2:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Counters", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceConfiguration", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -5506,105 +7209,9 @@ func (m *CounterSet) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Counters == nil {
-				m.Counters = make(map[string]Counter)
-			}
-			var mapkey string
-			mapvalue := &Counter{}
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowGenerated
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowGenerated
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var mapmsglen int
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowGenerated
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						mapmsglen |= int(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					if mapmsglen < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					postmsgIndex := iNdEx + mapmsglen
-					if postmsgIndex < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					if postmsgIndex > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = &Counter{}
-					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
-						return err
-					}
-					iNdEx = postmsgIndex
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipGenerated(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
-				}
+			if err := m.DeviceConfiguration.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.Counters[mapkey] = *mapvalue
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -5627,7 +7234,7 @@ func (m *CounterSet) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *Device) Unmarshal(dAtA []byte) error {
+func (m *DeviceAllocationResult) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -5650,17 +7257,17 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: Device: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceAllocationResult: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Device: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceAllocationResult: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Results", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -5670,27 +7277,29 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			m.Results = append(m.Results, DeviceRequestAllocationResult{})
+			if err := m.Results[len(m.Results)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Attributes", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Config", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -5717,111 +7326,107 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Attributes == nil {
-				m.Attributes = make(map[QualifiedName]DeviceAttribute)
+			m.Config = append(m.Config, DeviceAllocationConfiguration{})
+			if err := m.Config[len(m.Config)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			var mapkey QualifiedName
-			mapvalue := &DeviceAttribute{}
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowGenerated
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowGenerated
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = QualifiedName(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var mapmsglen int
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowGenerated
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						mapmsglen |= int(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					if mapmsglen < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					postmsgIndex := iNdEx + mapmsglen
-					if postmsgIndex < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					if postmsgIndex > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = &DeviceAttribute{}
-					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
-						return err
-					}
-					iNdEx = postmsgIndex
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipGenerated(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeviceAttribute) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeviceAttribute: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeviceAttribute: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IntValue", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
 				}
 			}
-			m.Attributes[QualifiedName(mapkey)] = *mapvalue
-			iNdEx = postIndex
+			m.IntValue = &v
 		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BoolValue", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.BoolValue = &b
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Capacity", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StringValue", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -5831,29 +7436,61 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Capacity == nil {
-				m.Capacity = make(map[QualifiedName]DeviceCapacity)
+			s := string(dAtA[iNdEx:postIndex])
+			m.StringValue = &s
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field VersionValue", wireType)
 			}
-			var mapkey QualifiedName
-			mapvalue := &DeviceCapacity{}
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.VersionValue = &s
+			iNdEx = postIndex
+		case 6:
+			if wireType == 0 {
+				var v int64
 				for shift := uint(0); ; shift += 7 {
 					if shift >= 64 {
 						return ErrIntOverflowGenerated
@@ -5863,43 +7500,51 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 					}
 					b := dAtA[iNdEx]
 					iNdEx++
-					wire |= uint64(b&0x7F) << shift
+					v |= int64(b&0x7F) << shift
 					if b < 0x80 {
 						break
 					}
 				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowGenerated
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
+				m.IntValues = append(m.IntValues, v)
+			} else if wireType == 2 {
+				var packedLen int
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
 					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthGenerated
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
 					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthGenerated
+					b := dAtA[iNdEx]
+					iNdEx++
+					packedLen |= int(b&0x7F) << shift
+					if b < 0x80 {
+						break
 					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
+				}
+				if packedLen < 0 {
+					return ErrInvalidLengthGenerated
+				}
+				postIndex := iNdEx + packedLen
+				if postIndex < 0 {
+					return ErrInvalidLengthGenerated
+				}
+				if postIndex > l {
+					return io.ErrUnexpectedEOF
+				}
+				var elementCount int
+				var count int
+				for _, integer := range dAtA[iNdEx:postIndex] {
+					if integer < 128 {
+						count++
 					}
-					mapkey = QualifiedName(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var mapmsglen int
+				}
+				elementCount = count
+				if elementCount != 0 && len(m.IntValues) == 0 {
+					m.IntValues = make([]int64, 0, elementCount)
+				}
+				for iNdEx < postIndex {
+					var v int64
 					for shift := uint(0); ; shift += 7 {
 						if shift >= 64 {
 							return ErrIntOverflowGenerated
@@ -5909,48 +7554,91 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 						}
 						b := dAtA[iNdEx]
 						iNdEx++
-						mapmsglen |= int(b&0x7F) << shift
+						v |= int64(b&0x7F) << shift
 						if b < 0x80 {
 							break
 						}
 					}
-					if mapmsglen < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					postmsgIndex := iNdEx + mapmsglen
-					if postmsgIndex < 0 {
-						return ErrInvalidLengthGenerated
+					m.IntValues = append(m.IntValues, v)
+				}
+			} else {
+				return fmt.Errorf("proto: wrong wireType = %d for field IntValues", wireType)
+			}
+		case 7:
+			if wireType == 0 {
+				var v int
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
 					}
-					if postmsgIndex > l {
+					if iNdEx >= l {
 						return io.ErrUnexpectedEOF
 					}
-					mapvalue = &DeviceCapacity{}
-					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
-						return err
-					}
-					iNdEx = postmsgIndex
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipGenerated(dAtA[iNdEx:])
-					if err != nil {
-						return err
+					b := dAtA[iNdEx]
+					iNdEx++
+					v |= int(b&0x7F) << shift
+					if b < 0x80 {
+						break
 					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthGenerated
+				}
+				m.BoolValues = append(m.BoolValues, bool(v != 0))
+			} else if wireType == 2 {
+				var packedLen int
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
 					}
-					if (iNdEx + skippy) > postIndex {
+					if iNdEx >= l {
 						return io.ErrUnexpectedEOF
 					}
-					iNdEx += skippy
+					b := dAtA[iNdEx]
+					iNdEx++
+					packedLen |= int(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				if packedLen < 0 {
+					return ErrInvalidLengthGenerated
+				}
+				postIndex := iNdEx + packedLen
+				if postIndex < 0 {
+					return ErrInvalidLengthGenerated
+				}
+				if postIndex > l {
+					return io.ErrUnexpectedEOF
+				}
+				var elementCount int
+				elementCount = packedLen
+				if elementCount != 0 && len(m.BoolValues) == 0 {
+					m.BoolValues = make([]bool, 0, elementCount)
+				}
+				for iNdEx < postIndex {
+					var v int
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						v |= int(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					m.BoolValues = append(m.BoolValues, bool(v != 0))
 				}
+			} else {
+				return fmt.Errorf("proto: wrong wireType = %d for field BoolValues", wireType)
 			}
-			m.Capacity[QualifiedName(mapkey)] = *mapvalue
-			iNdEx = postIndex
-		case 4:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConsumesCounters", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StringValues", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -5960,29 +7648,27 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.ConsumesCounters = append(m.ConsumesCounters, DeviceCounterConsumption{})
-			if err := m.ConsumesCounters[len(m.ConsumesCounters)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.StringValues = append(m.StringValues, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 5:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NodeName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field VersionValues", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -6010,12 +7696,61 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			s := string(dAtA[iNdEx:postIndex])
-			m.NodeName = &s
+			m.VersionValues = append(m.VersionValues, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 6:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeviceCapacity) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeviceCapacity: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeviceCapacity: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NodeSelector", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -6042,18 +7777,15 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.NodeSelector == nil {
-				m.NodeSelector = &v11.NodeSelector{}
-			}
-			if err := m.NodeSelector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Value.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 7:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AllNodes", wireType)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RequestPolicy", wireType)
 			}
-			var v int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -6063,16 +7795,81 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			b := bool(v != 0)
-			m.AllNodes = &b
-		case 8:
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.RequestPolicy == nil {
+				m.RequestPolicy = &CapacityRequestPolicy{}
+			}
+			if err := m.RequestPolicy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeviceClaim) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeviceClaim: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeviceClaim: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Taints", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Requests", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -6099,16 +7896,16 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Taints = append(m.Taints, DeviceTaint{})
-			if err := m.Taints[len(m.Taints)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Requests = append(m.Requests, DeviceRequest{})
+			if err := m.Requests[len(m.Requests)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 9:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BindsToNode", wireType)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Constraints", wireType)
 			}
-			var v int
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -6118,18 +7915,31 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			b := bool(v != 0)
-			m.BindsToNode = &b
-		case 10:
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Constraints = append(m.Constraints, DeviceConstraint{})
+			if err := m.Constraints[len(m.Constraints)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BindingConditions", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Config", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -6139,27 +7949,79 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			if postIndex > l {
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Config = append(m.Config, DeviceClaimConfiguration{})
+			if err := m.Config[len(m.Config)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeviceClaimConfiguration) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.BindingConditions = append(m.BindingConditions, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		case 11:
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeviceClaimConfiguration: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeviceClaimConfiguration: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BindingFailureConditions", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Requests", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -6187,32 +8049,11 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.BindingFailureConditions = append(m.BindingFailureConditions, string(dAtA[iNdEx:postIndex]))
+			m.Requests = append(m.Requests, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 12:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AllowMultipleAllocations", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			b := bool(v != 0)
-			m.AllowMultipleAllocations = &b
-		case 13:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NodeAllocatableResourceMappings", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceConfiguration", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -6239,105 +8080,9 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.NodeAllocatableResourceMappings == nil {
-				m.NodeAllocatableResourceMappings = make(map[k8s_io_api_core_v1.ResourceName]NodeAllocatableResourceMapping)
-			}
-			var mapkey k8s_io_api_core_v1.ResourceName
-			mapvalue := &NodeAllocatableResourceMapping{}
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowGenerated
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowGenerated
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = k8s_io_api_core_v1.ResourceName(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var mapmsglen int
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowGenerated
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						mapmsglen |= int(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					if mapmsglen < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					postmsgIndex := iNdEx + mapmsglen
-					if postmsgIndex < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					if postmsgIndex > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = &NodeAllocatableResourceMapping{}
-					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
-						return err
-					}
-					iNdEx = postmsgIndex
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipGenerated(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
-				}
+			if err := m.DeviceConfiguration.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.NodeAllocatableResourceMappings[k8s_io_api_core_v1.ResourceName(mapkey)] = *mapvalue
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -6360,7 +8105,7 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceAllocationConfiguration) Unmarshal(dAtA []byte) error {
+func (m *DeviceClass) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -6383,17 +8128,17 @@ func (m *DeviceAllocationConfiguration) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceAllocationConfiguration: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceClass: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceAllocationConfiguration: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceClass: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Source", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -6403,29 +8148,30 @@ func (m *DeviceAllocationConfiguration) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Source = AllocationConfigSource(dAtA[iNdEx:postIndex])
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Requests", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -6435,25 +8181,76 @@ func (m *DeviceAllocationConfiguration) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Requests = append(m.Requests, string(dAtA[iNdEx:postIndex]))
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 3:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeviceClassConfiguration) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeviceClassConfiguration: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeviceClassConfiguration: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field DeviceConfiguration", wireType)
 			}
@@ -6507,7 +8304,7 @@ func (m *DeviceAllocationConfiguration) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceAllocationResult) Unmarshal(dAtA []byte) error {
+func (m *DeviceClassList) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -6530,15 +8327,15 @@ func (m *DeviceAllocationResult) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceAllocationResult: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceClassList: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceAllocationResult: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceClassList: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Results", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -6565,14 +8362,13 @@ func (m *DeviceAllocationResult) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Results = append(m.Results, DeviceRequestAllocationResult{})
-			if err := m.Results[len(m.Results)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Config", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -6599,8 +8395,8 @@ func (m *DeviceAllocationResult) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Config = append(m.Config, DeviceAllocationConfiguration{})
-			if err := m.Config[len(m.Config)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Items = append(m.Items, DeviceClass{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -6625,7 +8421,7 @@ func (m *DeviceAllocationResult) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceAttribute) Unmarshal(dAtA []byte) error {
+func (m *DeviceClassSpec) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -6648,58 +8444,17 @@ func (m *DeviceAttribute) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceAttribute: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceClassSpec: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceAttribute: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceClassSpec: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
-		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IntValue", wireType)
-			}
-			var v int64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			m.IntValue = &v
-		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BoolValue", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			b := bool(v != 0)
-			m.BoolValue = &b
-		case 4:
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StringValue", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Selectors", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -6709,209 +8464,31 @@ func (m *DeviceAttribute) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			s := string(dAtA[iNdEx:postIndex])
-			m.StringValue = &s
-			iNdEx = postIndex
-		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field VersionValue", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			m.Selectors = append(m.Selectors, DeviceSelector{})
+			if err := m.Selectors[len(m.Selectors)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			s := string(dAtA[iNdEx:postIndex])
-			m.VersionValue = &s
 			iNdEx = postIndex
-		case 6:
-			if wireType == 0 {
-				var v int64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowGenerated
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					v |= int64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				m.IntValues = append(m.IntValues, v)
-			} else if wireType == 2 {
-				var packedLen int
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowGenerated
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					packedLen |= int(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				if packedLen < 0 {
-					return ErrInvalidLengthGenerated
-				}
-				postIndex := iNdEx + packedLen
-				if postIndex < 0 {
-					return ErrInvalidLengthGenerated
-				}
-				if postIndex > l {
-					return io.ErrUnexpectedEOF
-				}
-				var elementCount int
-				var count int
-				for _, integer := range dAtA[iNdEx:postIndex] {
-					if integer < 128 {
-						count++
-					}
-				}
-				elementCount = count
-				if elementCount != 0 && len(m.IntValues) == 0 {
-					m.IntValues = make([]int64, 0, elementCount)
-				}
-				for iNdEx < postIndex {
-					var v int64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowGenerated
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						v |= int64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					m.IntValues = append(m.IntValues, v)
-				}
-			} else {
-				return fmt.Errorf("proto: wrong wireType = %d for field IntValues", wireType)
-			}
-		case 7:
-			if wireType == 0 {
-				var v int
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowGenerated
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					v |= int(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				m.BoolValues = append(m.BoolValues, bool(v != 0))
-			} else if wireType == 2 {
-				var packedLen int
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowGenerated
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					packedLen |= int(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				if packedLen < 0 {
-					return ErrInvalidLengthGenerated
-				}
-				postIndex := iNdEx + packedLen
-				if postIndex < 0 {
-					return ErrInvalidLengthGenerated
-				}
-				if postIndex > l {
-					return io.ErrUnexpectedEOF
-				}
-				var elementCount int
-				elementCount = packedLen
-				if elementCount != 0 && len(m.BoolValues) == 0 {
-					m.BoolValues = make([]bool, 0, elementCount)
-				}
-				for iNdEx < postIndex {
-					var v int
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowGenerated
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						v |= int(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					m.BoolValues = append(m.BoolValues, bool(v != 0))
-				}
-			} else {
-				return fmt.Errorf("proto: wrong wireType = %d for field BoolValues", wireType)
-			}
-		case 8:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field StringValues", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Config", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -6921,27 +8498,29 @@ func (m *DeviceAttribute) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.StringValues = append(m.StringValues, string(dAtA[iNdEx:postIndex]))
+			m.Config = append(m.Config, DeviceClassConfiguration{})
+			if err := m.Config[len(m.Config)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 9:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field VersionValues", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ExtendedResourceName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -6969,7 +8548,8 @@ func (m *DeviceAttribute) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.VersionValues = append(m.VersionValues, string(dAtA[iNdEx:postIndex]))
+			s := string(dAtA[iNdEx:postIndex])
+			m.ExtendedResourceName = &s
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -6992,7 +8572,7 @@ func (m *DeviceAttribute) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceCapacity) Unmarshal(dAtA []byte) error {
+func (m *DeviceConfiguration) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -7015,48 +8595,15 @@ func (m *DeviceCapacity) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceCapacity: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceConfiguration: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceCapacity: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceConfiguration: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if err := m.Value.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RequestPolicy", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Opaque", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -7083,10 +8630,10 @@ func (m *DeviceCapacity) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.RequestPolicy == nil {
-				m.RequestPolicy = &CapacityRequestPolicy{}
+			if m.Opaque == nil {
+				m.Opaque = &OpaqueDeviceConfiguration{}
 			}
-			if err := m.RequestPolicy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Opaque.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -7111,7 +8658,7 @@ func (m *DeviceCapacity) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceClaim) Unmarshal(dAtA []byte) error {
+func (m *DeviceConstraint) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -7134,17 +8681,17 @@ func (m *DeviceClaim) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceClaim: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceConstraint: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceClaim: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceConstraint: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Requests", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -7154,31 +8701,29 @@ func (m *DeviceClaim) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Requests = append(m.Requests, DeviceRequest{})
-			if err := m.Requests[len(m.Requests)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Requests = append(m.Requests, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Constraints", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field MatchAttribute", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -7188,31 +8733,30 @@ func (m *DeviceClaim) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Constraints = append(m.Constraints, DeviceConstraint{})
-			if err := m.Constraints[len(m.Constraints)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			s := FullyQualifiedName(dAtA[iNdEx:postIndex])
+			m.MatchAttribute = &s
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Config", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DistinctAttribute", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -7222,25 +8766,24 @@ func (m *DeviceClaim) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Config = append(m.Config, DeviceClaimConfiguration{})
-			if err := m.Config[len(m.Config)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			s := FullyQualifiedName(dAtA[iNdEx:postIndex])
+			m.DistinctAttribute = &s
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -7263,7 +8806,7 @@ func (m *DeviceClaim) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceClaimConfiguration) Unmarshal(dAtA []byte) error {
+func (m *DeviceCounterConsumption) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -7286,15 +8829,15 @@ func (m *DeviceClaimConfiguration) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceClaimConfiguration: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceCounterConsumption: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceClaimConfiguration: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceCounterConsumption: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Requests", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CounterSet", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -7322,13 +8865,142 @@ func (m *DeviceClaimConfiguration) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Requests = append(m.Requests, string(dAtA[iNdEx:postIndex]))
+			m.CounterSet = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Counters", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Counters == nil {
+				m.Counters = make(map[string]Counter)
+			}
+			var mapkey string
+			mapvalue := &Counter{}
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowGenerated
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var mapmsglen int
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowGenerated
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapmsglen |= int(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					if mapmsglen < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					postmsgIndex := iNdEx + mapmsglen
+					if postmsgIndex < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if postmsgIndex > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = &Counter{}
+					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
+						return err
+					}
+					iNdEx = postmsgIndex
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipGenerated(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return ErrInvalidLengthGenerated
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.Counters[mapkey] = *mapvalue
 			iNdEx = postIndex
-		case 2:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceConfiguration", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CompatibilityGroups", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -7338,24 +9010,23 @@ func (m *DeviceClaimConfiguration) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DeviceConfiguration.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.CompatibilityGroups = append(m.CompatibilityGroups, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -7378,7 +9049,7 @@ func (m *DeviceClaimConfiguration) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceClass) Unmarshal(dAtA []byte) error {
+func (m *DeviceDerivedAttribute) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -7401,17 +9072,17 @@ func (m *DeviceClass) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceClass: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceDerivedAttribute: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceClass: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceDerivedAttribute: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -7421,30 +9092,29 @@ func (m *DeviceClass) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Name = FullyQualifiedName(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Expression", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -7454,24 +9124,23 @@ func (m *DeviceClass) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Expression = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -7494,7 +9163,7 @@ func (m *DeviceClass) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceClassConfiguration) Unmarshal(dAtA []byte) error {
+func (m *DeviceRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -7517,17 +9186,17 @@ func (m *DeviceClassConfiguration) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceClassConfiguration: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceClassConfiguration: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceConfiguration", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -7537,78 +9206,27 @@ func (m *DeviceClassConfiguration) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.DeviceConfiguration.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DeviceClassList) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceClassList: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceClassList: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Exactly", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -7635,13 +9253,16 @@ func (m *DeviceClassList) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.Exactly == nil {
+				m.Exactly = &ExactDeviceRequest{}
+			}
+			if err := m.Exactly.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field FirstAvailable", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -7668,8 +9289,8 @@ func (m *DeviceClassList) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Items = append(m.Items, DeviceClass{})
-			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.FirstAvailable = append(m.FirstAvailable, DeviceSubRequest{})
+			if err := m.FirstAvailable[len(m.FirstAvailable)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -7694,7 +9315,7 @@ func (m *DeviceClassList) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceClassSpec) Unmarshal(dAtA []byte) error {
+func (m *DeviceRequestAllocationResult) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -7717,17 +9338,17 @@ func (m *DeviceClassSpec) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceClassSpec: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceRequestAllocationResult: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceClassSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceRequestAllocationResult: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Selectors", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Request", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -7737,31 +9358,29 @@ func (m *DeviceClassSpec) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Selectors = append(m.Selectors, DeviceSelector{})
-			if err := m.Selectors[len(m.Selectors)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Request = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Config", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Driver", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -7771,29 +9390,27 @@ func (m *DeviceClassSpec) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Config = append(m.Config, DeviceClassConfiguration{})
-			if err := m.Config[len(m.Config)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Driver = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ExtendedResourceName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Pool", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -7821,64 +9438,45 @@ func (m *DeviceClassSpec) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			s := string(dAtA[iNdEx:postIndex])
-			m.ExtendedResourceName = &s
+			m.Pool = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Device", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
 			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DeviceConfiguration) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
 			}
-			if iNdEx >= l {
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceConfiguration: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceConfiguration: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Opaque", wireType)
+			m.Device = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AdminAccess", wireType)
 			}
-			var msglen int
+			var v int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -7888,83 +9486,18 @@ func (m *DeviceConfiguration) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				v |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if m.Opaque == nil {
-				m.Opaque = &OpaqueDeviceConfiguration{}
-			}
-			if err := m.Opaque.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DeviceConstraint) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceConstraint: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceConstraint: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			b := bool(v != 0)
+			m.AdminAccess = &b
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Requests", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Tolerations", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -7974,27 +9507,29 @@ func (m *DeviceConstraint) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Requests = append(m.Requests, string(dAtA[iNdEx:postIndex]))
+			m.Tolerations = append(m.Tolerations, DeviceToleration{})
+			if err := m.Tolerations[len(m.Tolerations)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 2:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field MatchAttribute", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BindingConditions", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -8022,12 +9557,11 @@ func (m *DeviceConstraint) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			s := FullyQualifiedName(dAtA[iNdEx:postIndex])
-			m.MatchAttribute = &s
+			m.BindingConditions = append(m.BindingConditions, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 3:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DistinctAttribute", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field BindingFailureConditions", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -8055,62 +9589,11 @@ func (m *DeviceConstraint) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			s := FullyQualifiedName(dAtA[iNdEx:postIndex])
-			m.DistinctAttribute = &s
+			m.BindingFailureConditions = append(m.BindingFailureConditions, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DeviceCounterConsumption) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceCounterConsumption: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceCounterConsumption: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+		case 9:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CounterSet", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ShareID", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -8138,11 +9621,12 @@ func (m *DeviceCounterConsumption) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.CounterSet = string(dAtA[iNdEx:postIndex])
+			s := k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
+			m.ShareID = &s
 			iNdEx = postIndex
-		case 2:
+		case 10:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Counters", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConsumedCapacity", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -8169,11 +9653,11 @@ func (m *DeviceCounterConsumption) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Counters == nil {
-				m.Counters = make(map[string]Counter)
+			if m.ConsumedCapacity == nil {
+				m.ConsumedCapacity = make(map[QualifiedName]resource.Quantity)
 			}
-			var mapkey string
-			mapvalue := &Counter{}
+			var mapkey QualifiedName
+			mapvalue := &resource.Quantity{}
 			for iNdEx < postIndex {
 				entryPreIndex := iNdEx
 				var wire uint64
@@ -8219,7 +9703,7 @@ func (m *DeviceCounterConsumption) Unmarshal(dAtA []byte) error {
 					if postStringIndexmapkey > l {
 						return io.ErrUnexpectedEOF
 					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					mapkey = QualifiedName(dAtA[iNdEx:postStringIndexmapkey])
 					iNdEx = postStringIndexmapkey
 				} else if fieldNum == 2 {
 					var mapmsglen int
@@ -8247,7 +9731,7 @@ func (m *DeviceCounterConsumption) Unmarshal(dAtA []byte) error {
 					if postmsgIndex > l {
 						return io.ErrUnexpectedEOF
 					}
-					mapvalue = &Counter{}
+					mapvalue = &resource.Quantity{}
 					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
 						return err
 					}
@@ -8267,7 +9751,125 @@ func (m *DeviceCounterConsumption) Unmarshal(dAtA []byte) error {
 					iNdEx += skippy
 				}
 			}
-			m.Counters[mapkey] = *mapvalue
+			m.ConsumedCapacity[QualifiedName(mapkey)] = *mapvalue
+			iNdEx = postIndex
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SkipNodeOperations", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SkipNodeOperations = append(m.SkipNodeOperations, SkipNodeOperation(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeviceSelector) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeviceSelector: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeviceSelector: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CEL", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.CEL == nil {
+				m.CEL = &CELDeviceSelector{}
+			}
+			if err := m.CEL.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -8290,7 +9892,7 @@ func (m *DeviceCounterConsumption) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceRequest) Unmarshal(dAtA []byte) error {
+func (m *DeviceSubRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -8313,10 +9915,10 @@ func (m *DeviceRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceSubRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceSubRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -8353,9 +9955,9 @@ func (m *DeviceRequest) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Exactly", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceClassName", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -8365,31 +9967,27 @@ func (m *DeviceRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Exactly == nil {
-				m.Exactly = &ExactDeviceRequest{}
-			}
-			if err := m.Exactly.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.DeviceClassName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field FirstAvailable", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Selectors", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -8416,66 +10014,67 @@ func (m *DeviceRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.FirstAvailable = append(m.FirstAvailable, DeviceSubRequest{})
-			if err := m.FirstAvailable[len(m.FirstAvailable)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Selectors = append(m.Selectors, DeviceSelector{})
+			if err := m.Selectors[len(m.Selectors)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AllocationMode", wireType)
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
 			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *DeviceRequestAllocationResult) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowGenerated
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
 			}
-			if iNdEx >= l {
+			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
+			m.AllocationMode = DeviceAllocationMode(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Count", wireType)
 			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceRequestAllocationResult: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceRequestAllocationResult: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
+			m.Count = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Count |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Request", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Tolerations", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -8485,29 +10084,31 @@ func (m *DeviceRequestAllocationResult) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Request = string(dAtA[iNdEx:postIndex])
+			m.Tolerations = append(m.Tolerations, DeviceToleration{})
+			if err := m.Tolerations[len(m.Tolerations)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 2:
+		case 7:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Driver", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Capacity", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -8517,29 +10118,33 @@ func (m *DeviceRequestAllocationResult) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Driver = string(dAtA[iNdEx:postIndex])
+			if m.Capacity == nil {
+				m.Capacity = &CapacityRequirements{}
+			}
+			if err := m.Capacity.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 3:
+		case 8:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Pool", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DerivedAttributes", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -8549,27 +10154,79 @@ func (m *DeviceRequestAllocationResult) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Pool = string(dAtA[iNdEx:postIndex])
+			m.DerivedAttributes = append(m.DerivedAttributes, DeviceDerivedAttribute{})
+			if err := m.DerivedAttributes[len(m.DerivedAttributes)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 4:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeviceTaint) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeviceTaint: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeviceTaint: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Device", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -8597,34 +10254,13 @@ func (m *DeviceRequestAllocationResult) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Device = string(dAtA[iNdEx:postIndex])
+			m.Key = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AdminAccess", wireType)
-			}
-			var v int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			b := bool(v != 0)
-			m.AdminAccess = &b
-		case 6:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Tolerations", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -8634,29 +10270,27 @@ func (m *DeviceRequestAllocationResult) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Tolerations = append(m.Tolerations, DeviceToleration{})
-			if err := m.Tolerations[len(m.Tolerations)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.Value = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 7:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BindingConditions", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Effect", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -8684,13 +10318,13 @@ func (m *DeviceRequestAllocationResult) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.BindingConditions = append(m.BindingConditions, string(dAtA[iNdEx:postIndex]))
+			m.Effect = DeviceTaintEffect(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 8:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field BindingFailureConditions", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TimeAdded", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -8700,29 +10334,83 @@ func (m *DeviceRequestAllocationResult) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.BindingFailureConditions = append(m.BindingFailureConditions, string(dAtA[iNdEx:postIndex]))
+			if m.TimeAdded == nil {
+				m.TimeAdded = &v1.Time{}
+			}
+			if err := m.TimeAdded.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 9:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeviceTaintRule) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeviceTaintRule: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeviceTaintRule: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ShareID", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -8732,28 +10420,28 @@ func (m *DeviceRequestAllocationResult) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			s := k8s_io_apimachinery_pkg_types.UID(dAtA[iNdEx:postIndex])
-			m.ShareID = &s
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 10:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ConsumedCapacity", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -8765,120 +10453,57 @@ func (m *DeviceRequestAllocationResult) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if m.ConsumedCapacity == nil {
-				m.ConsumedCapacity = make(map[QualifiedName]resource.Quantity)
-			}
-			var mapkey QualifiedName
-			mapvalue := &resource.Quantity{}
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowGenerated
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= uint64(b&0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowGenerated
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = QualifiedName(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var mapmsglen int
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowGenerated
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						mapmsglen |= int(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					if mapmsglen < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					postmsgIndex := iNdEx + mapmsglen
-					if postmsgIndex < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					if postmsgIndex > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = &resource.Quantity{}
-					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
-						return err
-					}
-					iNdEx = postmsgIndex
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipGenerated(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthGenerated
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
 				}
 			}
-			m.ConsumedCapacity[QualifiedName(mapkey)] = *mapvalue
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -8901,7 +10526,7 @@ func (m *DeviceRequestAllocationResult) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceSelector) Unmarshal(dAtA []byte) error {
+func (m *DeviceTaintRuleList) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -8924,15 +10549,15 @@ func (m *DeviceSelector) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceSelector: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceTaintRuleList: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceSelector: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceTaintRuleList: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CEL", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -8959,10 +10584,41 @@ func (m *DeviceSelector) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.CEL == nil {
-				m.CEL = &CELDeviceSelector{}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			if err := m.CEL.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, DeviceTaintRule{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -8987,7 +10643,7 @@ func (m *DeviceSelector) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceSubRequest) Unmarshal(dAtA []byte) error {
+func (m *DeviceTaintRuleSpec) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -9010,17 +10666,17 @@ func (m *DeviceSubRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceSubRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceTaintRuleSpec: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceSubRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceTaintRuleSpec: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceSelector", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9030,29 +10686,33 @@ func (m *DeviceSubRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Name = string(dAtA[iNdEx:postIndex])
+			if m.DeviceSelector == nil {
+				m.DeviceSelector = &DeviceTaintSelector{}
+			}
+			if err := m.DeviceSelector.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceClassName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Taint", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9062,27 +10722,78 @@ func (m *DeviceSubRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DeviceClassName = string(dAtA[iNdEx:postIndex])
+			if err := m.Taint.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 3:
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeviceTaintRuleStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeviceTaintRuleStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeviceTaintRuleStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Selectors", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Conditions", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -9109,48 +10820,66 @@ func (m *DeviceSubRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Selectors = append(m.Selectors, DeviceSelector{})
-			if err := m.Selectors[len(m.Selectors)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.Conditions = append(m.Conditions, v1.Condition{})
+			if err := m.Conditions[len(m.Conditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 4:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AllocationMode", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			if postIndex > l {
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeviceTaintSelector) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AllocationMode = DeviceAllocationMode(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Count", wireType)
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
 			}
-			m.Count = 0
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeviceTaintSelector: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeviceTaintSelector: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Driver", wireType)
+			}
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9160,16 +10889,30 @@ func (m *DeviceSubRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Count |= int64(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 6:
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.Driver = &s
+			iNdEx = postIndex
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Tolerations", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Pool", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9179,31 +10922,30 @@ func (m *DeviceSubRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Tolerations = append(m.Tolerations, DeviceToleration{})
-			if err := m.Tolerations[len(m.Tolerations)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.Pool = &s
 			iNdEx = postIndex
-		case 7:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Capacity", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Device", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9213,27 +10955,24 @@ func (m *DeviceSubRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Capacity == nil {
-				m.Capacity = &CapacityRequirements{}
-			}
-			if err := m.Capacity.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.Device = &s
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -9256,7 +10995,7 @@ func (m *DeviceSubRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceTaint) Unmarshal(dAtA []byte) error {
+func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -9279,10 +11018,10 @@ func (m *DeviceTaint) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceTaint: wiretype end group for non-group")
+			return fmt.Errorf("proto: DeviceToleration: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceTaint: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DeviceToleration: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -9319,7 +11058,7 @@ func (m *DeviceTaint) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Operator", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -9347,11 +11086,11 @@ func (m *DeviceTaint) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Value = string(dAtA[iNdEx:postIndex])
+			m.Operator = DeviceTolerationOperator(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Effect", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -9379,13 +11118,13 @@ func (m *DeviceTaint) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Effect = DeviceTaintEffect(dAtA[iNdEx:postIndex])
+			m.Value = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TimeAdded", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Effect", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9395,28 +11134,44 @@ func (m *DeviceTaint) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.TimeAdded == nil {
-				m.TimeAdded = &v1.Time{}
+			m.Effect = DeviceTaintEffect(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TolerationSeconds", wireType)
 			}
-			if err := m.TimeAdded.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			iNdEx = postIndex
+			m.TolerationSeconds = &v
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -9438,7 +11193,7 @@ func (m *DeviceTaint) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
+func (m *ExactDeviceRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -9461,15 +11216,15 @@ func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceToleration: wiretype end group for non-group")
+			return fmt.Errorf("proto: ExactDeviceRequest: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceToleration: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: ExactDeviceRequest: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceClassName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -9497,13 +11252,13 @@ func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Key = string(dAtA[iNdEx:postIndex])
+			m.DeviceClassName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Operator", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Selectors", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9513,27 +11268,29 @@ func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Operator = DeviceTolerationOperator(dAtA[iNdEx:postIndex])
+			m.Selectors = append(m.Selectors, DeviceSelector{})
+			if err := m.Selectors[len(m.Selectors)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field AllocationMode", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -9561,13 +11318,53 @@ func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Value = string(dAtA[iNdEx:postIndex])
+			m.AllocationMode = DeviceAllocationMode(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Count", wireType)
+			}
+			m.Count = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Count |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AdminAccess", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.AdminAccess = &b
+		case 6:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Effect", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Tolerations", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9577,29 +11374,31 @@ func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Effect = DeviceTaintEffect(dAtA[iNdEx:postIndex])
+			m.Tolerations = append(m.Tolerations, DeviceToleration{})
+			if err := m.Tolerations[len(m.Tolerations)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TolerationSeconds", wireType)
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Capacity", wireType)
 			}
-			var v int64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9609,12 +11408,62 @@ func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.TolerationSeconds = &v
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Capacity == nil {
+				m.Capacity = &CapacityRequirements{}
+			}
+			if err := m.Capacity.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DerivedAttributes", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DerivedAttributes = append(m.DerivedAttributes, DeviceDerivedAttribute{})
+			if err := m.DerivedAttributes[len(m.DerivedAttributes)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -9636,7 +11485,7 @@ func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *ExactDeviceRequest) Unmarshal(dAtA []byte) error {
+func (m *NetworkDeviceData) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -9659,15 +11508,15 @@ func (m *ExactDeviceRequest) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: ExactDeviceRequest: wiretype end group for non-group")
+			return fmt.Errorf("proto: NetworkDeviceData: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: ExactDeviceRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: NetworkDeviceData: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DeviceClassName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field InterfaceName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -9695,13 +11544,13 @@ func (m *ExactDeviceRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.DeviceClassName = string(dAtA[iNdEx:postIndex])
+			m.InterfaceName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Selectors", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field IPs", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9711,29 +11560,27 @@ func (m *ExactDeviceRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Selectors = append(m.Selectors, DeviceSelector{})
-			if err := m.Selectors[len(m.Selectors)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.IPs = append(m.IPs, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AllocationMode", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field HardwareAddress", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -9761,32 +11608,63 @@ func (m *ExactDeviceRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.AllocationMode = DeviceAllocationMode(dAtA[iNdEx:postIndex])
+			m.HardwareAddress = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Count", wireType)
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			m.Count = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Count |= int64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
 			}
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AdminAccess", wireType)
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
-			var v int
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *NodeAllocatableMapping) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NodeAllocatableMapping: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NodeAllocatableMapping: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CapacityKey", wireType)
+			}
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9796,16 +11674,28 @@ func (m *ExactDeviceRequest) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			b := bool(v != 0)
-			m.AdminAccess = &b
-		case 6:
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := QualifiedName(dAtA[iNdEx:postIndex])
+			m.CapacityKey = &s
+			iNdEx = postIndex
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Tolerations", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CapacityMultiplier", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -9832,14 +11722,16 @@ func (m *ExactDeviceRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Tolerations = append(m.Tolerations, DeviceToleration{})
-			if err := m.Tolerations[len(m.Tolerations)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.CapacityMultiplier == nil {
+				m.CapacityMultiplier = &resource.Quantity{}
+			}
+			if err := m.CapacityMultiplier.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 7:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Capacity", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceMultiplier", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -9866,10 +11758,10 @@ func (m *ExactDeviceRequest) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.Capacity == nil {
-				m.Capacity = &CapacityRequirements{}
+			if m.DeviceMultiplier == nil {
+				m.DeviceMultiplier = &resource.Quantity{}
 			}
-			if err := m.Capacity.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DeviceMultiplier.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -9894,7 +11786,7 @@ func (m *ExactDeviceRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *NetworkDeviceData) Unmarshal(dAtA []byte) error {
+func (m *NodeAllocatableOverhead) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -9917,17 +11809,17 @@ func (m *NetworkDeviceData) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: NetworkDeviceData: wiretype end group for non-group")
+			return fmt.Errorf("proto: NodeAllocatableOverhead: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: NetworkDeviceData: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: NodeAllocatableOverhead: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field InterfaceName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PerPod", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9937,29 +11829,33 @@ func (m *NetworkDeviceData) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.InterfaceName = string(dAtA[iNdEx:postIndex])
+			if m.PerPod == nil {
+				m.PerPod = &resource.Quantity{}
+			}
+			if err := m.PerPod.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IPs", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PerContainer", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9969,55 +11865,27 @@ func (m *NetworkDeviceData) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.IPs = append(m.IPs, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field HardwareAddress", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
+			if m.PerContainer == nil {
+				m.PerContainer = &resource.Quantity{}
 			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			if err := m.PerContainer.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.HardwareAddress = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -10040,7 +11908,7 @@ func (m *NetworkDeviceData) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *NodeAllocatableResourceMapping) Unmarshal(dAtA []byte) error {
+func (m *NodeAllocatableResource) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -10063,17 +11931,17 @@ func (m *NodeAllocatableResourceMapping) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: NodeAllocatableResourceMapping: wiretype end group for non-group")
+			return fmt.Errorf("proto: NodeAllocatableResource: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: NodeAllocatableResourceMapping: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: NodeAllocatableResource: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
-		case 1:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CapacityKey", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Mapping", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -10083,28 +11951,31 @@ func (m *NodeAllocatableResourceMapping) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			s := QualifiedName(dAtA[iNdEx:postIndex])
-			m.CapacityKey = &s
+			if m.Mapping == nil {
+				m.Mapping = &NodeAllocatableMapping{}
+			}
+			if err := m.Mapping.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 2:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AllocationMultiplier", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Overhead", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -10131,10 +12002,10 @@ func (m *NodeAllocatableResourceMapping) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.AllocationMultiplier == nil {
-				m.AllocationMultiplier = &resource.Quantity{}
+			if m.Overhead == nil {
+				m.Overhead = &NodeAllocatableOverhead{}
 			}
-			if err := m.AllocationMultiplier.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Overhead.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -11930,6 +13801,71 @@ func (m *ResourceSliceSpec) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PartitionTypeAttribute", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := FullyQualifiedName(dAtA[iNdEx:postIndex])
+			m.PartitionTypeAttribute = &s
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SkipNodeOperations", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SkipNodeOperations = append(m.SkipNodeOperations, SkipNodeOperation(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
diff --git a/vendor/k8s.io/api/resource/v1/generated.proto b/vendor/k8s.io/api/resource/v1/generated.proto
index 8bacfd846f..76559dc94b 100644
--- a/vendor/k8s.io/api/resource/v1/generated.proto
+++ b/vendor/k8s.io/api/resource/v1/generated.proto
@@ -65,8 +65,8 @@ message AllocatedDeviceStatus {
   //
   // +optional
   // +featureGate=DRAConsumableCapacity
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-uuid
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-uuid
   optional string shareID = 7;
 
   // Conditions contains the latest observation of the device's state.
@@ -78,6 +78,9 @@ message AllocatedDeviceStatus {
   // +optional
   // +listType=map
   // +listMapKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 4;
 
   // Data contains arbitrary driver-specific data.
@@ -90,7 +93,7 @@ message AllocatedDeviceStatus {
   // NetworkData contains network-related information specific to the device.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional NetworkDeviceData networkData = 6;
 }
 
@@ -130,7 +133,7 @@ message CELDeviceSelector {
   //  - driver (string): the name of the driver which defines this device.
   //  - attributes (map[string]object): the device's attributes, grouped by prefix
   //    (e.g. device.attributes["dra.example.com"] evaluates to an object with all
-  //    of the attributes which were prefixed by "dra.example.com".
+  //    of the attributes which were prefixed by "dra.example.com").
   //  - capacity (map[string]object): the device's capacities, grouped by prefix.
   //  - allowMultipleAllocations (bool): the allowMultipleAllocations property of the device
   //    (v1.34+ with the DRAConsumableCapacity feature enabled).
@@ -163,6 +166,15 @@ message CELDeviceSelector {
   // A robust expression should check for the existence of attributes
   // before referencing them.
   //
+  // Common errors:
+  // - "no such key": Use optional chaining (.? followed by orValue())
+  //   or guarding the check with has() for optional fields.
+  //   See CEL Optional Types for details:
+  //   https://pkg.go.dev/github.com/google/cel-go@v0.17.4/cel#OptionalTypes
+  //
+  // For more CEL expression syntax and examples, see:
+  // https://kubernetes.io/docs/reference/using-api/cel/
+  //
   // For ease of use, the cel.bind() function is enabled, and can be used
   // to simplify expressions that access multiple attributes with the
   // same domain. For example:
@@ -232,6 +244,13 @@ message CapacityRequestPolicy {
 
 // CapacityRequestPolicyRange defines a valid range for consumable capacity values.
 //
+// If the DRAFractionalCapacityRange feature gate is
+// enabled and at least one of Min, Max, or Step is a fractional quantity (i.e.
+// its value is not an integer), milli-unit arithmetic is used instead,
+// supporting values with up to 3 decimal places (e.g. 100m = 0.1).
+// The largest supported value then is 1000 times smaller compared to using 64-bit integers.
+// Otherwise, all comparisons use 64-bit integer arithmetic via resource.Quantity.Value().
+//
 //   - If the requested amount is less than Min, it is rounded up to the Min value.
 //   - If Step is set and the requested amount is between Min and Max but not aligned with Step,
 //     it will be rounded up to the next value equal to Min + (n * Step).
@@ -315,8 +334,8 @@ message CounterSet {
   // It must be a DNS label.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-short-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-short-name
   optional string name = 1;
 
   // Counters defines the set of counters for this CounterSet
@@ -325,8 +344,8 @@ message CounterSet {
   // The maximum number of counters is 32.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:eachKey=+k8s:format=k8s-short-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:eachKey=+k8s:format=k8s-short-name
   map<string, Counter> counters = 2;
 }
 
@@ -345,7 +364,7 @@ message Device {
   // The maximum number of attributes and capacities combined is 32.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   map<string, DeviceAttribute> attributes = 2;
 
   // Capacity defines the set of capacities for this device.
@@ -366,13 +385,13 @@ message Device {
   // device is 2.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +listType=atomic
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=counterSet
+  // +k8s:beta(since: "1.37")=+k8s:unique=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=counterSet
   // +featureGate=DRAPartitionableDevices
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=2
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=2
   repeated DeviceCounterConsumption consumesCounters = 4;
 
   // NodeName identifies the node where the device is available.
@@ -419,7 +438,7 @@ message Device {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceTaints
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated DeviceTaint taints = 8;
 
   // BindsToNode indicates if the usage of an allocation involving this device
@@ -449,8 +468,8 @@ message Device {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=4
   repeated string bindingConditions = 10;
 
   // BindingFailureConditions defines the conditions for binding failure.
@@ -467,8 +486,8 @@ message Device {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=4
   repeated string bindingFailureConditions = 11;
 
   // AllowMultipleAllocations marks whether the device is allowed to be allocated to multiple DeviceRequests.
@@ -480,7 +499,7 @@ message Device {
   // +featureGate=DRAConsumableCapacity
   optional bool allowMultipleAllocations = 12;
 
-  // NodeAllocatableResourceMappings defines the mapping of node resources
+  // NodeAllocatableResources defines the mapping of node resources
   // that are managed by the DRA driver exposing this device. This includes resources currently
   // reported in v1.Node `status.allocatable` that are not extended resources
   // (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources).
@@ -492,8 +511,9 @@ message Device {
   // The keys of this map are the node-allocatable resource names (e.g., "cpu", "memory").
   // Extended resource names are not permitted as keys.
   // +optional
+  // +k8s:optional
   // +featureGate=DRANodeAllocatableResources
-  map<string, NodeAllocatableResourceMapping> nodeAllocatableResourceMappings = 13;
+  map<string, NodeAllocatableResource> nodeAllocatableResources = 14;
 }
 
 // DeviceAllocationConfiguration gets embedded in an AllocationResult.
@@ -503,7 +523,7 @@ message DeviceAllocationConfiguration {
   // or from a claim.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string source = 1;
 
   // Requests lists the names of requests where the configuration applies.
@@ -515,10 +535,10 @@ message DeviceAllocationConfiguration {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=set
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:unique=set
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated string requests = 2;
 
   optional DeviceConfiguration deviceConfiguration = 3;
@@ -530,8 +550,8 @@ message DeviceAllocationResult {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceRequestAllocationResult results = 1;
 
   // This field is a combination of all the claim and class configuration parameters.
@@ -544,8 +564,8 @@ message DeviceAllocationResult {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=64
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=64
   repeated DeviceAllocationConfiguration config = 2;
 }
 
@@ -554,30 +574,30 @@ message DeviceAttribute {
   // IntValue is a number.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   optional int64 int = 2;
 
   // BoolValue is a true/false value.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   optional bool bool = 3;
 
   // StringValue is a string. Must not be longer than 64 characters.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   optional string string = 4;
 
   // VersionValue is a semantic version according to semver.org spec 2.0.0.
   // Must not be longer than 64 characters.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   optional string version = 5;
 
   // IntValues is a non-empty list of numbers.
@@ -587,8 +607,8 @@ message DeviceAttribute {
   // +optional
   // +listType=atomic
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   // +featureGate=DRAListTypeAttributes
   repeated int64 ints = 6;
 
@@ -597,8 +617,8 @@ message DeviceAttribute {
   // +optional
   // +listType=atomic
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   // +featureGate=DRAListTypeAttributes
   repeated bool bools = 7;
 
@@ -610,8 +630,9 @@ message DeviceAttribute {
   // +optional
   // +listType=atomic
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
+  // +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:maxBytes=64
   // +featureGate=DRAListTypeAttributes
   repeated string strings = 8;
 
@@ -623,8 +644,8 @@ message DeviceAttribute {
   // +optional
   // +listType=atomic
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   // +featureGate=DRAListTypeAttributes
   repeated string versions = 9;
 }
@@ -662,11 +683,11 @@ message DeviceClaim {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:unique=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=name
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceRequest requests = 1;
 
   // These constraints must be satisfied by the set of devices that get
@@ -674,8 +695,8 @@ message DeviceClaim {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceConstraint constraints = 2;
 
   // This field holds configuration for multiple potential drivers which
@@ -684,8 +705,8 @@ message DeviceClaim {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceClaimConfiguration config = 3;
 }
 
@@ -700,10 +721,10 @@ message DeviceClaimConfiguration {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=set
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:unique=set
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated string requests = 1;
 
   optional DeviceConfiguration deviceConfiguration = 2;
@@ -716,8 +737,8 @@ message DeviceClaimConfiguration {
 message DeviceClass {
   // Standard object metadata
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:format=k8s-long-name
+  // +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:format=k8s-long-name
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Spec defines what can be allocated and how to configure it.
@@ -728,6 +749,7 @@ message DeviceClass {
   // the time of allocation.
   //
   // Changing the spec automatically increments the metadata.generation number.
+  // +optional
   optional DeviceClassSpec spec = 2;
 }
 
@@ -753,8 +775,8 @@ message DeviceClassSpec {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceSelector selectors = 1;
 
   // Config defines configuration parameters that apply to each device that is claimed via this class.
@@ -765,8 +787,8 @@ message DeviceClassSpec {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceClassConfiguration config = 2;
 
   // ExtendedResourceName is the extended resource name for the devices of this class.
@@ -778,11 +800,10 @@ message DeviceClassSpec {
   // If two classes are created at the same time, then the name of the class
   // lexicographically sorted first is picked.
   //
-  // This is a beta field.
   // +optional
   // +featureGate=DRAExtendedResource
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-extended-resource-name
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-extended-resource-name
   optional string extendedResourceName = 4;
 }
 
@@ -794,7 +815,7 @@ message DeviceConfiguration {
   //
   // +optional
   // +oneOf=ConfigurationType
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional OpaqueDeviceConfiguration opaque = 1;
 }
 
@@ -812,10 +833,10 @@ message DeviceConstraint {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=set
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:unique=set
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated string requests = 1;
 
   // MatchAttribute requires that all devices in question have this
@@ -838,8 +859,8 @@ message DeviceConstraint {
   //
   // +optional
   // +oneOf=ConstraintType
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-resource-fully-qualified-name
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-fully-qualified-name
   optional string matchAttribute = 2;
 
   // DistinctAttribute requires that all devices in question have this
@@ -861,6 +882,8 @@ message DeviceConstraint {
   // +optional
   // +oneOf=ConstraintType
   // +featureGate=DRAConsumableCapacity
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-fully-qualified-name
   optional string distinctAttribute = 3;
 }
 
@@ -871,8 +894,8 @@ message DeviceCounterConsumption {
   // counters defined will be consumed.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-short-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-short-name
   optional string counterSet = 1;
 
   // Counters defines the counters that will be consumed by the device.
@@ -880,9 +903,94 @@ message DeviceCounterConsumption {
   // The maximum number of counters is 32.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:eachKey=+k8s:format=k8s-short-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:eachKey=+k8s:format=k8s-short-name
   map<string, Counter> counters = 2;
+
+  // CompatibilityGroups is a list of opaque group names for
+  // this counter set consumption.
+  //
+  // Devices that consume counters from the same counter set may only be
+  // allocated at the same time ("co-allocated") if they all share at least
+  // one common group: the intersection of the CompatibilityGroups of all
+  // co-allocated devices on that counter set must be non-empty. Devices
+  // that consume from different counter sets are never compared via this
+  // field.
+  //
+  // An unset field, an explicit nil, and an empty list are equivalent and
+  // mean "no groups": such a device is only co-allocatable with sibling
+  // devices on the same counter set that also have no groups, and is never
+  // co-allocatable with a device that declares one or more groups.
+  //
+  // Group names are opaque and meaningful only within the
+  // publishing driver's pool.
+  //
+  // The maximum number of groups is 2, and the names must be unique.
+  //
+  // +optional
+  // +listType=atomic
+  // +featureGate=DRADeviceCompatibilityGroups
+  // +k8s:listType=atomic
+  // +k8s:optional
+  // +k8s:maxItems=2
+  // +k8s:unique=set
+  // +k8s:eachVal=+k8s:format=k8s-short-name
+  repeated string compatibilityGroups = 3;
+}
+
+// DeviceDerivedAttribute defines a derived attribute computed via CEL.
+message DeviceDerivedAttribute {
+  // Name is the identifier for this derived attribute, used in constraints.
+  //
+  // It must be a DNS subdomain followed by a slash ("/") followed by a C identifier
+  // (e.g. "example.com/numaNode" or "derived/numaNode").
+  //
+  // If the chosen name matches an existing physical attribute from a driver,
+  // the derived attribute's expression will shadow the physical attribute,
+  // and its evaluated value will be used in constraints instead. When the goal
+  // is to define a derived attribute that is only used within the ResourceClaim
+  // and not meant to shadow an existing attribute, use a domain prefix that
+  // no DRA driver should be using (e.g. "derived/myAttribute").
+  //
+  // It is not valid to define a derived attribute that isn't used in at least
+  // one constraint.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-resource-fully-qualified-name
+  optional string name = 1;
+
+  // Expression is a CEL expression evaluated against each candidate device.
+  // The expression must evaluate to a primitive scalar (string, integer,
+  // boolean, or semver) or a list of these scalars ([]string, []int64,
+  // []bool, []semver) to act as a virtual grouping key. Any other return type
+  // is an error and causes CEL evaluation for the device to fail.
+  //
+  // The expression's input is an object named "device", which carries the
+  // same properties as in a CELDeviceSelector.
+  //
+  // When pod scheduling encounters CEL runtime errors (such as looking
+  // up an attribute that isn't defined) for some devices, it will abort
+  // allocation and fail scheduling for the Pod. Surfacing evaluation
+  // errors immediately prevents silent topology matching failures that are
+  // extremely hard to detect. A robust expression should, for example, check
+  // for the existence of attributes before referencing them to avoid
+  // runtime evaluation errors.
+  //
+  // The expression gets evaluated after a device has passed the other
+  // selector expressions for the request in which this expression is used.
+  // This allows writing expressions that are tailored towards the specific
+  // devices being requested (for example, by assuming the device is from a
+  // certain vendor and skipping those checks).
+  //
+  // The length of the expression must be smaller or equal to 10 Ki. The
+  // cost of evaluating it is also limited based on the estimated number
+  // of logical steps; the combined cost of all derived attributes in a
+  // claim is capped by a shared CEL cost budget.
+  //
+  // +required
+  // +k8s:required
+  optional string expression = 2;
 }
 
 // DeviceRequest is a request for devices required for a claim.
@@ -911,7 +1019,7 @@ message DeviceRequest {
   //
   // +optional
   // +oneOf=deviceRequestType
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional ExactDeviceRequest exactly = 2;
 
   // FirstAvailable contains subrequests, of which exactly one will be
@@ -932,11 +1040,11 @@ message DeviceRequest {
   // +oneOf=deviceRequestType
   // +listType=atomic
   // +featureGate=DRAPrioritizedList
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=8
+  // +k8s:beta(since: "1.37")=+k8s:unique=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=name
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=8
   repeated DeviceSubRequest firstAvailable = 3;
 }
 
@@ -961,9 +1069,9 @@ message DeviceRequestAllocationResult {
   // vendor of the driver. It should use only lower case characters.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name-caseless
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:maxLength=63
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name-caseless
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:maxLength=63
   optional string driver = 2;
 
   // This name together with the driver name and the device name field
@@ -973,8 +1081,8 @@ message DeviceRequestAllocationResult {
   // DNS sub-domains separated by slashes.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-resource-pool-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-pool-name
   optional string pool = 3;
 
   // Device references one device instance via its name in the driver's
@@ -1005,7 +1113,7 @@ message DeviceRequestAllocationResult {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceTaints
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated DeviceToleration tolerations = 6;
 
   // BindingConditions contains a copy of the BindingConditions
@@ -1017,8 +1125,8 @@ message DeviceRequestAllocationResult {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=4
   repeated string bindingConditions = 7;
 
   // BindingFailureConditions contains a copy of the BindingFailureConditions
@@ -1030,8 +1138,8 @@ message DeviceRequestAllocationResult {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=4
   repeated string bindingFailureConditions = 8;
 
   // ShareID uniquely identifies an individual allocation share of the device,
@@ -1041,8 +1149,8 @@ message DeviceRequestAllocationResult {
   //
   // +optional
   // +featureGate=DRAConsumableCapacity
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-uuid
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-uuid
   optional string shareID = 9;
 
   // ConsumedCapacity tracks the amount of capacity consumed per device as part of the claim request.
@@ -1057,6 +1165,19 @@ message DeviceRequestAllocationResult {
   // +optional
   // +featureGate=DRAConsumableCapacity
   map<string, .k8s.io.apimachinery.pkg.api.resource.Quantity> consumedCapacity = 10;
+
+  // SkipNodeOperations lists node-local resource operations (gRPC calls)
+  // that will be skipped for this allocated device when determining whether
+  // operations are necessary on the node. If all allocated devices for a driver in
+  // a claim skip an operation, that gRPC call will be skipped. It is a copy of
+  // the ResourceSlice.spec.skipNodeOperations value at the time when the device was allocated.
+  //
+  // +optional
+  // +listType=set
+  // +k8s:listType=set
+  // +featureGate=DRAOptionalNodeOperations
+  // +k8s:optional
+  repeated string skipNodeOperations = 11;
 }
 
 // DeviceSelector must have exactly one field set.
@@ -1099,8 +1220,8 @@ message DeviceSubRequest {
   // to reference.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name
   optional string deviceClassName = 2;
 
   // Selectors define criteria which must be satisfied by a specific
@@ -1110,8 +1231,8 @@ message DeviceSubRequest {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceSelector selectors = 3;
 
   // AllocationMode and its related fields define how devices are allocated
@@ -1133,7 +1254,7 @@ message DeviceSubRequest {
   // requests with unknown modes.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string allocationMode = 4;
 
   // Count is used only when the count mode is "ExactCount". Must be greater than zero.
@@ -1164,7 +1285,7 @@ message DeviceSubRequest {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceTaints
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated DeviceToleration tolerations = 6;
 
   // Capacity define resource requirements against each capacity.
@@ -1183,6 +1304,34 @@ message DeviceSubRequest {
   // +optional
   // +featureGate=DRAConsumableCapacity
   optional CapacityRequirements capacity = 7;
+
+  // DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+  // for each candidate device. These virtual attributes can be referenced in
+  // `.devices.constraints` to align and match different devices (e.g., co-allocating
+  // a GPU and a NIC on the same NUMA node) even if their drivers publish different
+  // attributes. Derived attributes are not available via `device.attributes`
+  // in the CEL environment when evaluating selector expressions.
+  //
+  // Derived attributes allow you to extract, transform, or normalize topology
+  // information (such as extracting a NUMA index from a complex topology string or
+  // renaming a vendor-specific attribute) into a common virtual attribute name at
+  // scheduling time. The scheduler then evaluates these virtual attributes exactly
+  // like static attributes when matching constraints.
+  //
+  // Every derived attribute defined in this list must be referenced by at least one
+  // MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+  //
+  // The maximum number of derived attributes is 32.
+  //
+  // This is an alpha field and requires enabling the DRADerivedAttributes
+  // feature gate.
+  //
+  // +optional
+  // +listType=atomic
+  // +featureGate=DRADerivedAttributes
+  // +k8s:optional
+  // +k8s:maxItems=32
+  repeated DeviceDerivedAttribute derivedAttributes = 8;
 }
 
 // The device this taint is attached to has the "effect" on
@@ -1211,7 +1360,7 @@ message DeviceTaint {
   // Consumers must treat unknown effects like None.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string effect = 3;
 
   // TimeAdded represents the time at which the taint was added or
@@ -1230,6 +1379,119 @@ message DeviceTaint {
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time timeAdded = 4;
 }
 
+// DeviceTaintRule adds one taint to all devices which match the selector.
+// This has the same effect as if the taint was specified directly
+// in the ResourceSlice by the DRA driver.
+// +k8s:supportsSubresource="/status"
+message DeviceTaintRule {
+  // Standard object metadata
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
+
+  // Spec specifies the selector and one taint.
+  //
+  // Changing the spec automatically increments the metadata.generation number.
+  // +required
+  optional DeviceTaintRuleSpec spec = 2;
+
+  // Status provides information about what was requested in the spec.
+  //
+  // +optional
+  optional DeviceTaintRuleStatus status = 3;
+}
+
+// DeviceTaintRuleList is a collection of DeviceTaintRules.
+message DeviceTaintRuleList {
+  // Standard list metadata
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
+
+  // Items is the list of DeviceTaintRules.
+  repeated DeviceTaintRule items = 2;
+}
+
+// DeviceTaintRuleSpec specifies the selector and one taint.
+message DeviceTaintRuleSpec {
+  // DeviceSelector defines which device(s) the taint is applied to.
+  // All selector criteria must be satisfied for a device to
+  // match. The empty selector matches all devices. Without
+  // a selector, no devices are matches.
+  //
+  // +optional
+  optional DeviceTaintSelector deviceSelector = 1;
+
+  // The taint that gets applied to matching devices.
+  //
+  // +required
+  optional DeviceTaint taint = 2;
+}
+
+// DeviceTaintRuleStatus provides information about an on-going pod eviction.
+message DeviceTaintRuleStatus {
+  // Conditions provide information about the state of the DeviceTaintRule
+  // and the cluster at some point in time,
+  // in a machine-readable and human-readable format.
+  //
+  // The following condition is currently defined as part of this API, more may
+  // get added:
+  // - Type: EvictionInProgress
+  // - Status: True if there are currently pods which need to be evicted, False otherwise
+  //   (includes the effects which don't cause eviction).
+  // - Reason: not specified, may change
+  // - Message: includes information about number of pending pods and already evicted pods
+  //   in a human-readable format, updated periodically, may change
+  //
+  // For `effect: None`, the condition above gets set once for each change to
+  // the spec, with the message containing information about what would happen
+  // if the effect was `NoExecute`. This feedback can be used to decide whether
+  // changing the effect to `NoExecute` will work as intended. It only gets
+  // set once to avoid having to constantly update the status.
+  //
+  // Must have 8 or fewer entries.
+  //
+  // +optional
+  // +listType=map
+  // +listMapKey=type
+  // +patchStrategy=merge
+  // +patchMergeKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+  repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 1;
+}
+
+// DeviceTaintSelector defines which device(s) a DeviceTaintRule applies to.
+// The empty selector matches all devices. Without a selector, no devices
+// are matched.
+message DeviceTaintSelector {
+  // If driver is set, only devices from that driver are selected.
+  // This fields corresponds to slice.spec.driver.
+  //
+  // +optional
+  optional string driver = 2;
+
+  // If pool is set, only devices in that pool are selected.
+  //
+  // Also setting the driver name may be useful to avoid
+  // ambiguity when different drivers use the same pool name,
+  // but this is not required because selecting pools from
+  // different drivers may also be useful, for example when
+  // drivers with node-local devices use the node name as
+  // their pool name.
+  //
+  // +optional
+  optional string pool = 3;
+
+  // If device is set, only devices with that name are selected.
+  // This field corresponds to slice.spec.devices[].name.
+  //
+  // Setting also driver and pool may be required to avoid ambiguity,
+  // but is not required.
+  //
+  // +optional
+  optional string device = 4;
+}
+
 // The ResourceClaim this DeviceToleration is attached to tolerates any taint that matches
 // the triple <key,value,effect> using the matching operator <operator>.
 message DeviceToleration {
@@ -1238,8 +1500,8 @@ message DeviceToleration {
   // Must be a label name.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-label-key
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-label-key
   optional string key = 1;
 
   // Operator represents a key's relationship to the value.
@@ -1249,7 +1511,7 @@ message DeviceToleration {
   //
   // +optional
   // +default="Equal"
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string operator = 2;
 
   // Value is the taint value the toleration matches to.
@@ -1263,7 +1525,7 @@ message DeviceToleration {
   // When specified, allowed values are NoSchedule and NoExecute.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string effect = 4;
 
   // TolerationSeconds represents the period of time the toleration (which must be
@@ -1301,8 +1563,8 @@ message ExactDeviceRequest {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceSelector selectors = 2;
 
   // AllocationMode and its related fields define how devices are allocated
@@ -1325,7 +1587,7 @@ message ExactDeviceRequest {
   // requests with unknown modes.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string allocationMode = 3;
 
   // Count is used only when the count mode is "ExactCount". Must be greater than zero.
@@ -1369,7 +1631,7 @@ message ExactDeviceRequest {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceTaints
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated DeviceToleration tolerations = 6;
 
   // Capacity define resource requirements against each capacity.
@@ -1388,6 +1650,34 @@ message ExactDeviceRequest {
   // +optional
   // +featureGate=DRAConsumableCapacity
   optional CapacityRequirements capacity = 7;
+
+  // DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+  // for each candidate device. These virtual attributes can be referenced in
+  // `.devices.constraints` to align and match different devices (e.g., co-allocating
+  // a GPU and a NIC on the same NUMA node) even if their drivers publish different
+  // attributes. Derived attributes are not available via `device.attributes`
+  // in the CEL environment when evaluating selector expressions.
+  //
+  // Derived attributes allow you to extract, transform, or normalize topology
+  // information (such as extracting a NUMA index from a complex topology string or
+  // renaming a vendor-specific attribute) into a common virtual attribute name at
+  // scheduling time. The scheduler then evaluates these virtual attributes exactly
+  // like static attributes when matching constraints.
+  //
+  // Every derived attribute defined in this list must be referenced by at least one
+  // MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+  //
+  // The maximum number of derived attributes is 32.
+  //
+  // This is an alpha field and requires enabling the DRADerivedAttributes
+  // feature gate.
+  //
+  // +optional
+  // +listType=atomic
+  // +featureGate=DRADerivedAttributes
+  // +k8s:optional
+  // +k8s:maxItems=32
+  repeated DeviceDerivedAttribute derivedAttributes = 8;
 }
 
 // NetworkDeviceData provides network-related details for the allocated device.
@@ -1401,8 +1691,8 @@ message NetworkDeviceData {
   // Must not be longer than 256 bytes.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxBytes=256
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxBytes=256
   optional string interfaceName = 1;
 
   // IPs lists the network addresses assigned to the device's network interface.
@@ -1413,10 +1703,10 @@ message NetworkDeviceData {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=set
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=16
+  // +k8s:beta(since: "1.37")=+k8s:unique=set
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=16
   repeated string ips = 2;
 
   // HardwareAddress represents the hardware address (e.g. MAC Address) of the device's network interface.
@@ -1424,47 +1714,104 @@ message NetworkDeviceData {
   // Must not be longer than 128 bytes.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxBytes=128
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxBytes=128
   optional string hardwareAddress = 3;
 }
 
-// NodeAllocatableResourceMapping defines the translation between the DRA device/capacity
-// units requested to the corresponding quantity of the node allocatable resource.
-message NodeAllocatableResourceMapping {
+// NodeAllocatableMapping defines how a DRA allocation directly translates into a node allocatable resource quantity.
+// The mapping can be derived from either the count of allocated devices (via deviceMultiplier) or the specific capacity consumed (via capacityKey and capacityMultiplier). These options are mutually exclusive.
+// Kubelet adds this mapped resource quantity from claim to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.
+message NodeAllocatableMapping {
   // CapacityKey references a capacity name defined as a key in the
   // `spec.devices[*].capacity` map. When this field is set, the value associated with
   // this key in the `status.allocation.devices.results[*].consumedCapacity` map
   // (for a specific claim allocation) determines the base quantity for
-  // the node allocatable resource. If `allocationMultiplier` is also set, it is
+  // the node allocatable resource. `capacityMultiplier` must also be set and is
   // multiplied with the base quantity.
   // For example, if `spec.devices[*].capacity` has an entry "dra.example.com/memory": "128Gi",
   // and this field is set to "dra.example.com/memory", then for a claim allocation
   // that consumes { "dra.example.com/memory": "4Gi" } the base quantity for the
-  // node allocatable resource mapping will be "4Gi", and `allocationMultiplier` should
-  // be omitted or set to "1".
+  // node allocatable resource mapping will be "4Gi".
+  // The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
   // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:alpha(since: "1.37")=+k8s:dependentRequired("capacityMultiplier")
   optional string capacityKey = 1;
 
-  // AllocationMultiplier is used as a multiplier for the allocated device count or the allocated capacity in the claim.
-  // It defaults to 1 if not specified. How the field is used also depends on whether `capacityKey` is set.
-  // 1.  If `capacityKey` is NOT set: `allocationMultiplier` multiplies the device count allocated to the claim.
-  // 	   a. A DRA driver representing each CPU core as a device would have
-  //        {ResourceName: "cpu", allocationMultiplier: "2"} in its
-  //        `nodeAllocatableResourceMappings`. If 4 devices are allocated to the claim,
-  // 		  4 * 2 CPUs would be considered as allocated and subtracted from the node's capacity.
-  //     b. A GPU device that needs additional node memory per GPU allocation would
-  //        have {ResourceName: "memory", allocationMultiplier: "2Gi"}.  Each allocated
-  // 		  GPU device instance of this type will account for 2Gi of memory.
-  //
-  // 2.  If `capacityKey` IS set: `allocationMultiplier` is multiplied by the amount of that capacity consumed.
-  // 	   The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `allocationMultiplier`.
-  //     For example, if a Device's capacity "dra.example.com/cores" is consumed,
-  //     and each "core" provides 2 "cpu"s, the mapping would be:
-  //     {ResourceName: "cpu", capacityKey: "dra.example.com/cores", allocationMultiplier: "2"}.
-  //     If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
-  // +optional
-  optional .k8s.io.apimachinery.pkg.api.resource.Quantity allocationMultiplier = 2;
+  // CapacityMultiplier is used as a multiplier for the allocated capacity consumed.
+  // It is only valid if `capacityKey` is set.
+  // The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
+  // For example, if a Device's capacity "dra.example.com/cores" is consumed,
+  // and each "core" provides 2 "cpu"s, the mapping would be:
+  // {ResourceName: "cpu", capacityKey: "dra.example.com/cores", capacityMultiplier: "2"}.
+  // If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
+  // +optional
+  // +k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:dependentRequired("capacityKey")
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity capacityMultiplier = 2;
+
+  // DeviceMultiplier is used as a multiplier for the allocated device count in the claim.
+  // The final node allocatable resource amount is `deviceCount` * `deviceMultiplier`.
+  // For example, a DRA driver representing each cache complex (CCX) as a device would have
+  // {ResourceName: "cpu", deviceMultiplier: "8"} in its `nodeAllocatableResources`.
+  // If 2 devices (CCX) are allocated to the claim, 2 * 8 = 16 CPUs would be considered as allocated.
+  // It is only valid when `capacityKey` and `capacityMultiplier` are not set.
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity deviceMultiplier = 3;
+}
+
+// NodeAllocatableOverhead defines auxiliary resource overheads incurred when allocating a device.
+// Overheads can be specified as a fixed cost per pod referencing the claim, a variable cost per container reference, or both.
+// Kubelet accounts for this overhead by adding it to both the pod-level and container-level cgroups of referencing containers.
+message NodeAllocatableOverhead {
+  // PerPod is overhead applied once per pod referencing the claim on this node.
+  // This is a flat overhead incurred for every pod referencing the claim.
+  // +optional
+  // +k8s:optional
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity perPod = 1;
+
+  // PerContainer is applied per container reference to the claim.
+  // This models overhead scaling linearly with the number of containers actively using the device.
+  // When both PerPod and PerContainer are specified, the total overhead allocated for each pod referencing
+  // the claim is computed as:
+  // Quantity = PerPod + (PerContainer * NumReferences)
+  // Kubelet accounts for this overhead in cgroups:
+  // - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences).
+  // - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container.
+  // This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once.
+  // +optional
+  // +k8s:optional
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity perContainer = 2;
+}
+
+// NodeAllocatableResource defines the translation between the DRA device/capacity
+// units requested to the corresponding quantity of the node allocatable resource.
+// At least one of Mapping or Overhead must be specified. Not specifying either is an invalid configuration.
+message NodeAllocatableResource {
+  // Mapping is used when the device directly models a node allocatable resource like standard CPU or memory
+  // (e.g., with a CPU DRA driver). The calculated quantity is accounted for exactly once per claim instance
+  // on the node. To prevent node cgroup isolation friction, the scheduler explicitly
+  // blocks sharing mapped device claims across multiple pods.
+  // +optional
+  // +k8s:optional
+  optional NodeAllocatableMapping mapping = 3;
+
+  // Overhead contains fields for modeling auxiliary overhead incurred on node allocatable resources
+  // when allocating devices that are not themselves modeling a node allocatable resource (e.g., host memory overhead for GPUs).
+  // Sharing overhead-mapped claims across multiple pods is allowed. The node allocatable overhead is accounted
+  // for individually for each pod referencing the claim.
+  // Overhead is always subtracted from the node's allocatable capacity for the resource, even when mapping
+  // is specified for the same resource.
+  // Eg: If a device models memory capacity per socket as a consumable capacity pool via Mapping (with CapacityKey),
+  // any overhead specified for the same resource will be subtracted from the node's general allocatable capacity
+  // and not from the per-socket capacity pool in Mapping.
+  // +optional
+  // +k8s:optional
+  optional NodeAllocatableOverhead overhead = 4;
 }
 
 // OpaqueDeviceConfiguration contains configuration parameters for a driver
@@ -1480,9 +1827,9 @@ message OpaqueDeviceConfiguration {
   // vendor of the driver. It should use only lower case characters.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name-caseless
-  // +k8s:alpha(since: "1.36")=+k8s:maxLength=63
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name-caseless
+  // +k8s:beta(since: "1.37")=+k8s:maxLength=63
   optional string driver = 1;
 
   // Parameters can contain arbitrary data. It is the responsibility of
@@ -1508,7 +1855,8 @@ message ResourceClaim {
 
   // Spec describes what is being requested and how to configure it.
   // The spec is immutable.
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:immutable
+  // +optional
   optional ResourceClaimSpec spec = 2;
 
   // Status describes whether the claim is ready to use and what has been allocated.
@@ -1563,8 +1911,8 @@ message ResourceClaimStatus {
   // Allocation is set once the claim has been allocated successfully.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:update=NoModify
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:update=NoModify
   optional AllocationResult allocation = 1;
 
   // ReservedFor indicates which entities are currently allowed to use
@@ -1592,10 +1940,10 @@ message ResourceClaimStatus {
   // +listMapKey=uid
   // +patchStrategy=merge
   // +patchMergeKey=uid
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:listType=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=uid
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=256
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:listType=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=uid
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=256
   repeated ResourceClaimConsumerReference reservedFor = 2;
 
   // Devices contains the status of each device allocated for this
@@ -1603,18 +1951,18 @@ message ResourceClaimStatus {
   // information. Entries are owned by their respective drivers.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +listType=map
   // +listMapKey=driver
   // +listMapKey=device
   // +listMapKey=pool
   // +listMapKey=shareID
   // +featureGate=DRAResourceClaimDeviceStatus
-  // +k8s:alpha(since: "1.36")=+k8s:listType=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=driver
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=device
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=pool
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=shareID
+  // +k8s:beta(since: "1.37")=+k8s:listType=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=driver
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=device
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=pool
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=shareID
   repeated AllocatedDeviceStatus devices = 4;
 }
 
@@ -1629,6 +1977,7 @@ message ResourceClaimTemplate {
   // This field is immutable. A ResourceClaim will get created by the
   // control plane for a Pod when needed and then not get updated
   // anymore.
+  // +optional
   optional ResourceClaimTemplateSpec spec = 2;
 }
 
@@ -1648,11 +1997,13 @@ message ResourceClaimTemplateSpec {
   // when creating it. No other fields are allowed and will be rejected during
   // validation.
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Spec for the ResourceClaim. The entire content is copied unchanged
   // into the ResourceClaim that gets created from this template. The
   // same fields as in a ResourceClaim are also valid here.
+  // +optional
   optional ResourceClaimSpec spec = 2;
 }
 
@@ -1660,6 +2011,8 @@ message ResourceClaimTemplateSpec {
 message ResourcePool {
   // Name is used to identify the pool. For node-local devices, this
   // is often the node name, but this is not required.
+  // A field selector can be used to list only ResourceSlice objects
+  // belonging to a certain pool.
   //
   // It must not be longer than 253 characters and must consist of one or more DNS sub-domains
   // separated by slashes. This field is immutable.
@@ -1797,7 +2150,7 @@ message ResourceSliceSpec {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +zeroOrOneOf=ResourceSliceType
   repeated Device devices = 6;
 
@@ -1823,14 +2176,50 @@ message ResourceSliceSpec {
   // The maximum number of counter sets is 8.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +listType=atomic
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
+  // +k8s:beta(since: "1.37")=+k8s:unique=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=name
   // +featureGate=DRAPartitionableDevices
   // +zeroOrOneOf=ResourceSliceType
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=8
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=8
   repeated CounterSet sharedCounters = 8;
+
+  // PartitionTypeAttribute names a string device attribute (by fully
+  // qualified name, e.g. "gpu.example.com/profile") whose value labels
+  // each device with its partition type, such as "Full" or "Half" for a
+  // MIG-style GPU.
+  //
+  // When set, every partitionable device in the slice must carry the attribute
+  // and devices sharing a value must share the same ConsumesCounters cost.
+  //
+  // +optional
+  // +featureGate=DRAPartitionableDevicesType
+  // +k8s:ifDisabled(DRAPartitionableDevicesType)=+k8s:forbidden
+  // +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:optional
+  // +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:format=k8s-resource-fully-qualified-name
+  optional string partitionTypeAttribute = 9;
+
+  // SkipNodeOperations lists node-local resource operations (gRPC calls)
+  // that will be skipped for the devices in this slice when determining whether
+  // operations are necessary on the node. If all allocated devices for a driver in
+  // a claim skip an operation, that gRPC call will be skipped. Valid values are:
+  //
+  // - "NodePrepareResources": NodePrepareResources gRPC calls are skipped. This
+  //   value cannot be specified unless "NodeUnprepareResources" is also listed
+  //   (or "*" is specified).
+  // - "NodeUnprepareResources": NodeUnprepareResources gRPC calls are skipped.
+  // - "*": All node-local resource operations are skipped.
+  //
+  // Other values may be added in the future. The kubelet must ignore unknown
+  // values.
+  //
+  // +optional
+  // +listType=set
+  // +k8s:listType=set
+  // +featureGate=DRAOptionalNodeOperations
+  // +k8s:optional
+  repeated string skipNodeOperations = 10;
 }
 
diff --git a/vendor/k8s.io/api/resource/v1/register.go b/vendor/k8s.io/api/resource/v1/register.go
index dca6492256..c634e4c9af 100644
--- a/vendor/k8s.io/api/resource/v1/register.go
+++ b/vendor/k8s.io/api/resource/v1/register.go
@@ -46,6 +46,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
 		&DeviceClass{},
 		&DeviceClassList{},
+		&DeviceTaintRule{},
+		&DeviceTaintRuleList{},
 		&ResourceClaim{},
 		&ResourceClaimList{},
 		&ResourceClaimTemplate{},
diff --git a/vendor/k8s.io/api/resource/v1/types.go b/vendor/k8s.io/api/resource/v1/types.go
index 27d5eff29c..580ffc3279 100644
--- a/vendor/k8s.io/api/resource/v1/types.go
+++ b/vendor/k8s.io/api/resource/v1/types.go
@@ -93,7 +93,7 @@ const (
 // For resources that are not local to a node, the node name is not set. Instead,
 // the driver may use a node selector to specify where the devices are available.
 type ResourceSlice struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -112,6 +112,9 @@ const (
 	// ResourceSliceSelectorDriver can be used in a [metav1.ListOptions]
 	// field selector to filter based on [ResourceSliceSpec.Driver].
 	ResourceSliceSelectorDriver = "spec.driver"
+	// ResourceSliceSelectorPoolName can be used in a [metav1.ListOptions]
+	// field selector to filter based on [ResourceSliceSpec.Pool.Name].
+	ResourceSliceSelectorPoolName = "spec.pool.name"
 )
 
 // ResourceSliceSpec contains the information published by the driver in one ResourceSlice.
@@ -175,7 +178,7 @@ type ResourceSliceSpec struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +zeroOrOneOf=ResourceSliceType
 	Devices []Device `json:"devices,omitempty" protobuf:"bytes,6,name=devices"`
 
@@ -201,17 +204,68 @@ type ResourceSliceSpec struct {
 	// The maximum number of counter sets is 8.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +listType=atomic
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
+	// +k8s:beta(since: "1.37")=+k8s:unique=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=name
 	// +featureGate=DRAPartitionableDevices
 	// +zeroOrOneOf=ResourceSliceType
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=8
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=8
 	SharedCounters []CounterSet `json:"sharedCounters,omitempty" protobuf:"bytes,8,name=sharedCounters"`
+
+	// PartitionTypeAttribute names a string device attribute (by fully
+	// qualified name, e.g. "gpu.example.com/profile") whose value labels
+	// each device with its partition type, such as "Full" or "Half" for a
+	// MIG-style GPU.
+	//
+	// When set, every partitionable device in the slice must carry the attribute
+	// and devices sharing a value must share the same ConsumesCounters cost.
+	//
+	// +optional
+	// +featureGate=DRAPartitionableDevicesType
+	// +k8s:ifDisabled(DRAPartitionableDevicesType)=+k8s:forbidden
+	// +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:optional
+	// +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:format=k8s-resource-fully-qualified-name
+	PartitionTypeAttribute *FullyQualifiedName `json:"partitionTypeAttribute,omitempty" protobuf:"bytes,9,opt,name=partitionTypeAttribute"`
+
+	// SkipNodeOperations lists node-local resource operations (gRPC calls)
+	// that will be skipped for the devices in this slice when determining whether
+	// operations are necessary on the node. If all allocated devices for a driver in
+	// a claim skip an operation, that gRPC call will be skipped. Valid values are:
+	//
+	// - "NodePrepareResources": NodePrepareResources gRPC calls are skipped. This
+	//   value cannot be specified unless "NodeUnprepareResources" is also listed
+	//   (or "*" is specified).
+	// - "NodeUnprepareResources": NodeUnprepareResources gRPC calls are skipped.
+	// - "*": All node-local resource operations are skipped.
+	//
+	// Other values may be added in the future. The kubelet must ignore unknown
+	// values.
+	//
+	// +optional
+	// +listType=set
+	// +k8s:listType=set
+	// +featureGate=DRAOptionalNodeOperations
+	// +k8s:optional
+	SkipNodeOperations []SkipNodeOperation `json:"skipNodeOperations,omitempty" protobuf:"bytes,10,rep,name=skipNodeOperations,casttype=SkipNodeOperation"`
 }
 
+// +enum
+// +k8s:enum
+type SkipNodeOperation string
+
+const (
+	// SkipNodeOperationNodePrepareResources indicates that NodePrepareResources gRPC calls are skipped.
+	SkipNodeOperationNodePrepareResources SkipNodeOperation = "NodePrepareResources"
+
+	// SkipNodeOperationNodeUnprepareResources indicates that NodeUnprepareResources gRPC calls are skipped.
+	SkipNodeOperationNodeUnprepareResources SkipNodeOperation = "NodeUnprepareResources"
+
+	// SkipNodeOperationAll indicates that all node-local resource operations are skipped.
+	SkipNodeOperationAll SkipNodeOperation = "*"
+)
+
 // CounterSet defines a named set of counters
 // that are available to be used by devices defined in the
 // ResourcePool.
@@ -225,8 +279,8 @@ type CounterSet struct {
 	// It must be a DNS label.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-short-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-short-name
 	Name string `json:"name" protobuf:"bytes,1,name=name"`
 
 	// Counters defines the set of counters for this CounterSet
@@ -235,8 +289,8 @@ type CounterSet struct {
 	// The maximum number of counters is 32.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:eachKey=+k8s:format=k8s-short-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:eachKey=+k8s:format=k8s-short-name
 	Counters map[string]Counter `json:"counters,omitempty" protobuf:"bytes,2,name=counters"`
 }
 
@@ -248,6 +302,8 @@ const DriverNameMaxLength = 63
 type ResourcePool struct {
 	// Name is used to identify the pool. For node-local devices, this
 	// is often the node name, but this is not required.
+	// A field selector can be used to list only ResourceSlice objects
+	// belonging to a certain pool.
 	//
 	// It must not be longer than 253 characters and must consist of one or more DNS sub-domains
 	// separated by slashes. This field is immutable.
@@ -312,6 +368,10 @@ const ResourceSliceMaxDeviceCounterConsumptionsPerDevice = 2
 // per device counter consumption.
 const ResourceSliceMaxCountersPerDeviceCounterConsumption = 32
 
+// Defines the maximum number of compatibility groups that can be
+// declared per device counter consumption.
+const DeviceCompatibilityGroupsMaxSize = 2
+
 // Device represents one individual hardware instance that can be selected based
 // on its attributes. Besides the name, exactly one field must be set.
 type Device struct {
@@ -327,7 +387,7 @@ type Device struct {
 	// The maximum number of attributes and capacities combined is 32.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Attributes map[QualifiedName]DeviceAttribute `json:"attributes,omitempty" protobuf:"bytes,2,rep,name=attributes"`
 
 	// Capacity defines the set of capacities for this device.
@@ -348,13 +408,13 @@ type Device struct {
 	// device is 2.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +listType=atomic
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=counterSet
+	// +k8s:beta(since: "1.37")=+k8s:unique=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=counterSet
 	// +featureGate=DRAPartitionableDevices
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=2
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=2
 	ConsumesCounters []DeviceCounterConsumption `json:"consumesCounters,omitempty" protobuf:"bytes,4,rep,name=consumesCounters"`
 
 	// NodeName identifies the node where the device is available.
@@ -401,7 +461,7 @@ type Device struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceTaints
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Taints []DeviceTaint `json:"taints,omitempty" protobuf:"bytes,8,rep,name=taints"`
 
 	// BindsToNode indicates if the usage of an allocation involving this device
@@ -431,8 +491,8 @@ type Device struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=4
 	BindingConditions []string `json:"bindingConditions,omitempty" protobuf:"bytes,10,rep,name=bindingConditions"`
 
 	// BindingFailureConditions defines the conditions for binding failure.
@@ -449,8 +509,8 @@ type Device struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=4
 	BindingFailureConditions []string `json:"bindingFailureConditions,omitempty" protobuf:"bytes,11,rep,name=bindingFailureConditions"`
 
 	// AllowMultipleAllocations marks whether the device is allowed to be allocated to multiple DeviceRequests.
@@ -462,7 +522,10 @@ type Device struct {
 	// +featureGate=DRAConsumableCapacity
 	AllowMultipleAllocations *bool `json:"allowMultipleAllocations,omitempty" protobuf:"bytes,12,opt,name=allowMultipleAllocations"`
 
-	// NodeAllocatableResourceMappings defines the mapping of node resources
+	// NodeAllocatableResourceMappings is tombstoned as it got replaced with NodeAllocatableResources.
+	// NodeAllocatableResourceMappings map[v1.ResourceName]NodeAllocatableResourceMapping `json:"nodeAllocatableResourceMappings,omitempty" protobuf:"bytes,13,opt,name=nodeAllocatableResourceMappings"`
+
+	// NodeAllocatableResources defines the mapping of node resources
 	// that are managed by the DRA driver exposing this device. This includes resources currently
 	// reported in v1.Node `status.allocatable` that are not extended resources
 	// (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources).
@@ -474,46 +537,104 @@ type Device struct {
 	// The keys of this map are the node-allocatable resource names (e.g., "cpu", "memory").
 	// Extended resource names are not permitted as keys.
 	// +optional
+	// +k8s:optional
 	// +featureGate=DRANodeAllocatableResources
-	NodeAllocatableResourceMappings map[v1.ResourceName]NodeAllocatableResourceMapping `json:"nodeAllocatableResourceMappings,omitempty" protobuf:"bytes,13,opt,name=nodeAllocatableResourceMappings"`
+	NodeAllocatableResources map[v1.ResourceName]NodeAllocatableResource `json:"nodeAllocatableResources,omitempty" protobuf:"bytes,14,opt,name=nodeAllocatableResources"`
 }
 
-// NodeAllocatableResourceMapping defines the translation between the DRA device/capacity
+// NodeAllocatableResource defines the translation between the DRA device/capacity
 // units requested to the corresponding quantity of the node allocatable resource.
-type NodeAllocatableResourceMapping struct {
+// At least one of Mapping or Overhead must be specified. Not specifying either is an invalid configuration.
+type NodeAllocatableResource struct {
+	// Mapping is used when the device directly models a node allocatable resource like standard CPU or memory
+	// (e.g., with a CPU DRA driver). The calculated quantity is accounted for exactly once per claim instance
+	// on the node. To prevent node cgroup isolation friction, the scheduler explicitly
+	// blocks sharing mapped device claims across multiple pods.
+	// +optional
+	// +k8s:optional
+	Mapping *NodeAllocatableMapping `json:"mapping,omitempty" protobuf:"bytes,3,opt,name=mapping"`
+
+	// Overhead contains fields for modeling auxiliary overhead incurred on node allocatable resources
+	// when allocating devices that are not themselves modeling a node allocatable resource (e.g., host memory overhead for GPUs).
+	// Sharing overhead-mapped claims across multiple pods is allowed. The node allocatable overhead is accounted
+	// for individually for each pod referencing the claim.
+	// Overhead is always subtracted from the node's allocatable capacity for the resource, even when mapping
+	// is specified for the same resource.
+	// Eg: If a device models memory capacity per socket as a consumable capacity pool via Mapping (with CapacityKey),
+	// any overhead specified for the same resource will be subtracted from the node's general allocatable capacity
+	// and not from the per-socket capacity pool in Mapping.
+	// +optional
+	// +k8s:optional
+	Overhead *NodeAllocatableOverhead `json:"overhead,omitempty" protobuf:"bytes,4,opt,name=overhead"`
+}
+
+// NodeAllocatableMapping defines how a DRA allocation directly translates into a node allocatable resource quantity.
+// The mapping can be derived from either the count of allocated devices (via deviceMultiplier) or the specific capacity consumed (via capacityKey and capacityMultiplier). These options are mutually exclusive.
+// Kubelet adds this mapped resource quantity from claim to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.
+type NodeAllocatableMapping struct {
 	// CapacityKey references a capacity name defined as a key in the
 	// `spec.devices[*].capacity` map. When this field is set, the value associated with
 	// this key in the `status.allocation.devices.results[*].consumedCapacity` map
 	// (for a specific claim allocation) determines the base quantity for
-	// the node allocatable resource. If `allocationMultiplier` is also set, it is
+	// the node allocatable resource. `capacityMultiplier` must also be set and is
 	// multiplied with the base quantity.
 	// For example, if `spec.devices[*].capacity` has an entry "dra.example.com/memory": "128Gi",
 	// and this field is set to "dra.example.com/memory", then for a claim allocation
 	// that consumes { "dra.example.com/memory": "4Gi" } the base quantity for the
-	// node allocatable resource mapping will be "4Gi", and `allocationMultiplier` should
-	// be omitted or set to "1".
+	// node allocatable resource mapping will be "4Gi".
+	// The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
 	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:alpha(since: "1.37")=+k8s:dependentRequired("capacityMultiplier")
 	CapacityKey *QualifiedName `json:"capacityKey,omitempty" protobuf:"bytes,1,opt,name=capacityKey"`
 
-	// AllocationMultiplier is used as a multiplier for the allocated device count or the allocated capacity in the claim.
-	// It defaults to 1 if not specified. How the field is used also depends on whether `capacityKey` is set.
-	// 1.  If `capacityKey` is NOT set: `allocationMultiplier` multiplies the device count allocated to the claim.
-	// 	   a. A DRA driver representing each CPU core as a device would have
-	//        {ResourceName: "cpu", allocationMultiplier: "2"} in its
-	//        `nodeAllocatableResourceMappings`. If 4 devices are allocated to the claim,
-	// 		  4 * 2 CPUs would be considered as allocated and subtracted from the node's capacity.
-	//     b. A GPU device that needs additional node memory per GPU allocation would
-	//        have {ResourceName: "memory", allocationMultiplier: "2Gi"}.  Each allocated
-	// 		  GPU device instance of this type will account for 2Gi of memory.
-	//
-	// 2.  If `capacityKey` IS set: `allocationMultiplier` is multiplied by the amount of that capacity consumed.
-	// 	   The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `allocationMultiplier`.
-	//     For example, if a Device's capacity "dra.example.com/cores" is consumed,
-	//     and each "core" provides 2 "cpu"s, the mapping would be:
-	//     {ResourceName: "cpu", capacityKey: "dra.example.com/cores", allocationMultiplier: "2"}.
-	//     If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
-	// +optional
-	AllocationMultiplier *resource.Quantity `json:"allocationMultiplier,omitempty" protobuf:"bytes,2,opt,name=allocationMultiplier"`
+	// CapacityMultiplier is used as a multiplier for the allocated capacity consumed.
+	// It is only valid if `capacityKey` is set.
+	// The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
+	// For example, if a Device's capacity "dra.example.com/cores" is consumed,
+	// and each "core" provides 2 "cpu"s, the mapping would be:
+	// {ResourceName: "cpu", capacityKey: "dra.example.com/cores", capacityMultiplier: "2"}.
+	// If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
+	// +optional
+	// +k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:dependentRequired("capacityKey")
+	CapacityMultiplier *resource.Quantity `json:"capacityMultiplier,omitempty" protobuf:"bytes,2,opt,name=capacityMultiplier"`
+
+	// DeviceMultiplier is used as a multiplier for the allocated device count in the claim.
+	// The final node allocatable resource amount is `deviceCount` * `deviceMultiplier`.
+	// For example, a DRA driver representing each cache complex (CCX) as a device would have
+	// {ResourceName: "cpu", deviceMultiplier: "8"} in its `nodeAllocatableResources`.
+	// If 2 devices (CCX) are allocated to the claim, 2 * 8 = 16 CPUs would be considered as allocated.
+	// It is only valid when `capacityKey` and `capacityMultiplier` are not set.
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	DeviceMultiplier *resource.Quantity `json:"deviceMultiplier,omitempty" protobuf:"bytes,3,opt,name=deviceMultiplier"`
+}
+
+// NodeAllocatableOverhead defines auxiliary resource overheads incurred when allocating a device.
+// Overheads can be specified as a fixed cost per pod referencing the claim, a variable cost per container reference, or both.
+// Kubelet accounts for this overhead by adding it to both the pod-level and container-level cgroups of referencing containers.
+type NodeAllocatableOverhead struct {
+	// PerPod is overhead applied once per pod referencing the claim on this node.
+	// This is a flat overhead incurred for every pod referencing the claim.
+	// +optional
+	// +k8s:optional
+	PerPod *resource.Quantity `json:"perPod,omitempty" protobuf:"bytes,1,opt,name=perPod"`
+
+	// PerContainer is applied per container reference to the claim.
+	// This models overhead scaling linearly with the number of containers actively using the device.
+	// When both PerPod and PerContainer are specified, the total overhead allocated for each pod referencing
+	// the claim is computed as:
+	// Quantity = PerPod + (PerContainer * NumReferences)
+	// Kubelet accounts for this overhead in cgroups:
+	// - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences).
+	// - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container.
+	// This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once.
+	// +optional
+	// +k8s:optional
+	PerContainer *resource.Quantity `json:"perContainer,omitempty" protobuf:"bytes,2,opt,name=perContainer"`
 }
 
 // DeviceCounterConsumption defines a set of counters that
@@ -523,8 +644,8 @@ type DeviceCounterConsumption struct {
 	// counters defined will be consumed.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-short-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-short-name
 	CounterSet string `json:"counterSet" protobuf:"bytes,1,opt,name=counterSet"`
 
 	// Counters defines the counters that will be consumed by the device.
@@ -532,9 +653,39 @@ type DeviceCounterConsumption struct {
 	// The maximum number of counters is 32.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:eachKey=+k8s:format=k8s-short-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:eachKey=+k8s:format=k8s-short-name
 	Counters map[string]Counter `json:"counters,omitempty" protobuf:"bytes,2,opt,name=counters"`
+
+	// CompatibilityGroups is a list of opaque group names for
+	// this counter set consumption.
+	//
+	// Devices that consume counters from the same counter set may only be
+	// allocated at the same time ("co-allocated") if they all share at least
+	// one common group: the intersection of the CompatibilityGroups of all
+	// co-allocated devices on that counter set must be non-empty. Devices
+	// that consume from different counter sets are never compared via this
+	// field.
+	//
+	// An unset field, an explicit nil, and an empty list are equivalent and
+	// mean "no groups": such a device is only co-allocatable with sibling
+	// devices on the same counter set that also have no groups, and is never
+	// co-allocatable with a device that declares one or more groups.
+	//
+	// Group names are opaque and meaningful only within the
+	// publishing driver's pool.
+	//
+	// The maximum number of groups is 2, and the names must be unique.
+	//
+	// +optional
+	// +listType=atomic
+	// +featureGate=DRADeviceCompatibilityGroups
+	// +k8s:listType=atomic
+	// +k8s:optional
+	// +k8s:maxItems=2
+	// +k8s:unique=set
+	// +k8s:eachVal=+k8s:format=k8s-short-name
+	CompatibilityGroups []string `json:"compatibilityGroups,omitempty" protobuf:"bytes,3,rep,name=compatibilityGroups"`
 }
 
 // DeviceCapacity describes a quantity associated with a device.
@@ -618,6 +769,13 @@ type CapacityRequestPolicy struct {
 
 // CapacityRequestPolicyRange defines a valid range for consumable capacity values.
 //
+// If the DRAFractionalCapacityRange feature gate is
+// enabled and at least one of Min, Max, or Step is a fractional quantity (i.e.
+// its value is not an integer), milli-unit arithmetic is used instead,
+// supporting values with up to 3 decimal places (e.g. 100m = 0.1).
+// The largest supported value then is 1000 times smaller compared to using 64-bit integers.
+// Otherwise, all comparisons use 64-bit integer arithmetic via resource.Quantity.Value().
+//
 //   - If the requested amount is less than Min, it is rounded up to the Min value.
 //   - If Step is set and the requested amount is between Min and Max but not aligned with Step,
 //     it will be rounded up to the next value equal to Min + (n * Step).
@@ -697,30 +855,30 @@ type DeviceAttribute struct {
 	// IntValue is a number.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	IntValue *int64 `json:"int,omitempty" protobuf:"varint,2,opt,name=int"`
 
 	// BoolValue is a true/false value.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	BoolValue *bool `json:"bool,omitempty" protobuf:"varint,3,opt,name=bool"`
 
 	// StringValue is a string. Must not be longer than 64 characters.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	StringValue *string `json:"string,omitempty" protobuf:"bytes,4,opt,name=string"`
 
 	// VersionValue is a semantic version according to semver.org spec 2.0.0.
 	// Must not be longer than 64 characters.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	VersionValue *string `json:"version,omitempty" protobuf:"bytes,5,opt,name=version"`
 
 	// IntValues is a non-empty list of numbers.
@@ -730,8 +888,8 @@ type DeviceAttribute struct {
 	// +optional
 	// +listType=atomic
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	// +featureGate=DRAListTypeAttributes
 	IntValues []int64 `json:"ints,omitempty" protobuf:"varint,6,opt,name=ints"`
 
@@ -740,8 +898,8 @@ type DeviceAttribute struct {
 	// +optional
 	// +listType=atomic
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	// +featureGate=DRAListTypeAttributes
 	BoolValues []bool `json:"bools,omitempty" protobuf:"varint,7,opt,name=bools"`
 
@@ -753,8 +911,9 @@ type DeviceAttribute struct {
 	// +optional
 	// +listType=atomic
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
+	// +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:maxBytes=64
 	// +featureGate=DRAListTypeAttributes
 	StringValues []string `json:"strings,omitempty" protobuf:"bytes,8,opt,name=strings"`
 
@@ -766,8 +925,8 @@ type DeviceAttribute struct {
 	// +optional
 	// +listType=atomic
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	// +featureGate=DRAListTypeAttributes
 	VersionValues []string `json:"versions,omitempty" protobuf:"bytes,9,opt,name=versions"`
 }
@@ -804,7 +963,7 @@ type DeviceTaint struct {
 	// Consumers must treat unknown effects like None.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Effect DeviceTaintEffect `json:"effect" protobuf:"bytes,3,name=effect,casttype=DeviceTaintEffect"`
 
 	// ^^^^
@@ -843,7 +1002,7 @@ type DeviceTaint struct {
 }
 
 // +enum
-// +k8s:alpha(since: "1.36")=+k8s:enum
+// +k8s:beta(since: "1.37")=+k8s:enum
 type DeviceTaintEffect string
 
 const (
@@ -859,12 +1018,166 @@ const (
 	DeviceTaintEffectNoExecute DeviceTaintEffect = "NoExecute"
 )
 
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+
+// DeviceTaintRule adds one taint to all devices which match the selector.
+// This has the same effect as if the taint was specified directly
+// in the ResourceSlice by the DRA driver.
+// +k8s:supportsSubresource="/status"
+type DeviceTaintRule struct {
+	metav1.TypeMeta `json:""`
+	// Standard object metadata
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// Spec specifies the selector and one taint.
+	//
+	// Changing the spec automatically increments the metadata.generation number.
+	// +required
+	Spec DeviceTaintRuleSpec `json:"spec" protobuf:"bytes,2,name=spec"`
+
+	// Status provides information about what was requested in the spec.
+	//
+	// +optional
+	Status DeviceTaintRuleStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
+}
+
+// DeviceTaintRuleSpec specifies the selector and one taint.
+type DeviceTaintRuleSpec struct {
+	// DeviceSelector defines which device(s) the taint is applied to.
+	// All selector criteria must be satisfied for a device to
+	// match. The empty selector matches all devices. Without
+	// a selector, no devices are matches.
+	//
+	// +optional
+	DeviceSelector *DeviceTaintSelector `json:"deviceSelector,omitempty" protobuf:"bytes,1,opt,name=deviceSelector"`
+
+	// The taint that gets applied to matching devices.
+	//
+	// +required
+	Taint DeviceTaint `json:"taint,omitempty" protobuf:"bytes,2,rep,name=taint"`
+}
+
+// DeviceTaintSelector defines which device(s) a DeviceTaintRule applies to.
+// The empty selector matches all devices. Without a selector, no devices
+// are matched.
+type DeviceTaintSelector struct {
+	// If DeviceClassName is set, the selectors defined there must be
+	// satisfied by a device to be selected. This field corresponds
+	// to class.metadata.name.
+	//
+	// +optional
+	//
+	// Tombstoned since 1.35 because it turned out that supporting this in all cases
+	// would depend on copying the device attributes into the ResourceClaim allocation
+	// result. Without that the eviction controller cannot evaluate these CEL expressions.
+	//
+	// DeviceClassName *string `json:"deviceClassName,omitempty" protobuf:"bytes,1,opt,name=deviceClassName"`
+
+	// If driver is set, only devices from that driver are selected.
+	// This fields corresponds to slice.spec.driver.
+	//
+	// +optional
+	Driver *string `json:"driver,omitempty" protobuf:"bytes,2,opt,name=driver"`
+
+	// If pool is set, only devices in that pool are selected.
+	//
+	// Also setting the driver name may be useful to avoid
+	// ambiguity when different drivers use the same pool name,
+	// but this is not required because selecting pools from
+	// different drivers may also be useful, for example when
+	// drivers with node-local devices use the node name as
+	// their pool name.
+	//
+	// +optional
+	Pool *string `json:"pool,omitempty" protobuf:"bytes,3,opt,name=pool"`
+
+	// If device is set, only devices with that name are selected.
+	// This field corresponds to slice.spec.devices[].name.
+	//
+	// Setting also driver and pool may be required to avoid ambiguity,
+	// but is not required.
+	//
+	// +optional
+	Device *string `json:"device,omitempty" protobuf:"bytes,4,opt,name=device"`
+
+	// Selectors contains the same selection criteria as a ResourceClaim.
+	// Currently, CEL expressions are supported. All of these selectors
+	// must be satisfied.
+	//
+	// +optional
+	// +listType=atomic
+	//
+	// Tombstoned since 1.35 because it turned out that supporting this in all cases
+	// would depend on copying the device attributes into the ResourceClaim allocation
+	// result. Without that the eviction controller cannot evaluate these CEL expressions.
+	//
+	// Selectors []DeviceSelector `json:"selectors,omitempty" protobuf:"bytes,5,rep,name=selectors"`
+}
+
+// DeviceTaintRuleStatus provides information about an on-going pod eviction.
+type DeviceTaintRuleStatus struct {
+	// Conditions provide information about the state of the DeviceTaintRule
+	// and the cluster at some point in time,
+	// in a machine-readable and human-readable format.
+	//
+	// The following condition is currently defined as part of this API, more may
+	// get added:
+	// - Type: EvictionInProgress
+	// - Status: True if there are currently pods which need to be evicted, False otherwise
+	//   (includes the effects which don't cause eviction).
+	// - Reason: not specified, may change
+	// - Message: includes information about number of pending pods and already evicted pods
+	//   in a human-readable format, updated periodically, may change
+	//
+	// For `effect: None`, the condition above gets set once for each change to
+	// the spec, with the message containing information about what would happen
+	// if the effect was `NoExecute`. This feedback can be used to decide whether
+	// changing the effect to `NoExecute` will work as intended. It only gets
+	// set once to avoid having to constantly update the status.
+	//
+	// Must have 8 or fewer entries.
+	//
+	// +optional
+	// +listType=map
+	// +listMapKey=type
+	// +patchStrategy=merge
+	// +patchMergeKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
+}
+
+// DeviceTaintRuleStatusMaxConditions is the maximum number of conditions in DeviceTaintRuleStatus.
+const DeviceTaintRuleStatusMaxConditions = 8
+
+// DeviceTaintConditionEvictionInProgress is the publicly documented condition type for the DeviceTaintRuleStatus.
+const DeviceTaintConditionEvictionInProgress = "EvictionInProgress"
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+
+// DeviceTaintRuleList is a collection of DeviceTaintRules.
+type DeviceTaintRuleList struct {
+	metav1.TypeMeta `json:""`
+	// Standard list metadata
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// Items is the list of DeviceTaintRules.
+	Items []DeviceTaintRule `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +k8s:prerelease-lifecycle-gen:introduced=1.34
 
 // ResourceSliceList is a collection of ResourceSlices.
 type ResourceSliceList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -884,14 +1197,15 @@ type ResourceSliceList struct {
 // stanza tracks whether this claim has been satisfied and what specific
 // resources have been allocated.
 type ResourceClaim struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec describes what is being requested and how to configure it.
 	// The spec is immutable.
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:immutable
+	// +optional
 	Spec ResourceClaimSpec `json:"spec" protobuf:"bytes,2,name=spec"`
 
 	// Status describes whether the claim is ready to use and what has been allocated.
@@ -919,11 +1233,11 @@ type DeviceClaim struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:unique=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=name
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Requests []DeviceRequest `json:"requests" protobuf:"bytes,1,name=requests"`
 
 	// These constraints must be satisfied by the set of devices that get
@@ -931,8 +1245,8 @@ type DeviceClaim struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Constraints []DeviceConstraint `json:"constraints,omitempty" protobuf:"bytes,2,opt,name=constraints"`
 
 	// This field holds configuration for multiple potential drivers which
@@ -941,8 +1255,8 @@ type DeviceClaim struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Config []DeviceClaimConfiguration `json:"config,omitempty" protobuf:"bytes,3,opt,name=config"`
 
 	// Potential future extension, ignored by older schedulers. This is
@@ -993,7 +1307,7 @@ type DeviceRequest struct {
 	//
 	// +optional
 	// +oneOf=deviceRequestType
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Exactly *ExactDeviceRequest `json:"exactly,omitempty" protobuf:"bytes,2,name=exactly"`
 
 	// FirstAvailable contains subrequests, of which exactly one will be
@@ -1014,11 +1328,11 @@ type DeviceRequest struct {
 	// +oneOf=deviceRequestType
 	// +listType=atomic
 	// +featureGate=DRAPrioritizedList
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=8
+	// +k8s:beta(since: "1.37")=+k8s:unique=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=name
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=8
 	FirstAvailable []DeviceSubRequest `json:"firstAvailable,omitempty" protobuf:"bytes,3,name=firstAvailable"`
 }
 
@@ -1046,8 +1360,8 @@ type ExactDeviceRequest struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Selectors []DeviceSelector `json:"selectors,omitempty" protobuf:"bytes,2,name=selectors"`
 
 	// AllocationMode and its related fields define how devices are allocated
@@ -1070,7 +1384,7 @@ type ExactDeviceRequest struct {
 	// requests with unknown modes.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	AllocationMode DeviceAllocationMode `json:"allocationMode,omitempty" protobuf:"bytes,3,opt,name=allocationMode"`
 
 	// Count is used only when the count mode is "ExactCount". Must be greater than zero.
@@ -1114,7 +1428,7 @@ type ExactDeviceRequest struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceTaints
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Tolerations []DeviceToleration `json:"tolerations,omitempty" protobuf:"bytes,6,opt,name=tolerations"`
 
 	// Capacity define resource requirements against each capacity.
@@ -1133,6 +1447,34 @@ type ExactDeviceRequest struct {
 	// +optional
 	// +featureGate=DRAConsumableCapacity
 	Capacity *CapacityRequirements `json:"capacity,omitempty" protobuf:"bytes,7,opt,name=capacity"`
+
+	// DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+	// for each candidate device. These virtual attributes can be referenced in
+	// `.devices.constraints` to align and match different devices (e.g., co-allocating
+	// a GPU and a NIC on the same NUMA node) even if their drivers publish different
+	// attributes. Derived attributes are not available via `device.attributes`
+	// in the CEL environment when evaluating selector expressions.
+	//
+	// Derived attributes allow you to extract, transform, or normalize topology
+	// information (such as extracting a NUMA index from a complex topology string or
+	// renaming a vendor-specific attribute) into a common virtual attribute name at
+	// scheduling time. The scheduler then evaluates these virtual attributes exactly
+	// like static attributes when matching constraints.
+	//
+	// Every derived attribute defined in this list must be referenced by at least one
+	// MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+	//
+	// The maximum number of derived attributes is 32.
+	//
+	// This is an alpha field and requires enabling the DRADerivedAttributes
+	// feature gate.
+	//
+	// +optional
+	// +listType=atomic
+	// +featureGate=DRADerivedAttributes
+	// +k8s:optional
+	// +k8s:maxItems=32
+	DerivedAttributes []DeviceDerivedAttribute `json:"derivedAttributes,omitempty" protobuf:"bytes,8,rep,name=derivedAttributes"`
 }
 
 // DeviceSubRequest describes a request for device provided in the
@@ -1166,8 +1508,8 @@ type DeviceSubRequest struct {
 	// to reference.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name
 	DeviceClassName string `json:"deviceClassName" protobuf:"bytes,2,name=deviceClassName"`
 
 	// Selectors define criteria which must be satisfied by a specific
@@ -1177,8 +1519,8 @@ type DeviceSubRequest struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Selectors []DeviceSelector `json:"selectors,omitempty" protobuf:"bytes,3,name=selectors"`
 
 	// AllocationMode and its related fields define how devices are allocated
@@ -1200,7 +1542,7 @@ type DeviceSubRequest struct {
 	// requests with unknown modes.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	AllocationMode DeviceAllocationMode `json:"allocationMode,omitempty" protobuf:"bytes,4,opt,name=allocationMode"`
 
 	// Count is used only when the count mode is "ExactCount". Must be greater than zero.
@@ -1231,7 +1573,7 @@ type DeviceSubRequest struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceTaints
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Tolerations []DeviceToleration `json:"tolerations,omitempty" protobuf:"bytes,6,opt,name=tolerations"`
 
 	// Capacity define resource requirements against each capacity.
@@ -1250,6 +1592,34 @@ type DeviceSubRequest struct {
 	// +optional
 	// +featureGate=DRAConsumableCapacity
 	Capacity *CapacityRequirements `json:"capacity,omitempty" protobuf:"bytes,7,opt,name=capacity"`
+
+	// DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+	// for each candidate device. These virtual attributes can be referenced in
+	// `.devices.constraints` to align and match different devices (e.g., co-allocating
+	// a GPU and a NIC on the same NUMA node) even if their drivers publish different
+	// attributes. Derived attributes are not available via `device.attributes`
+	// in the CEL environment when evaluating selector expressions.
+	//
+	// Derived attributes allow you to extract, transform, or normalize topology
+	// information (such as extracting a NUMA index from a complex topology string or
+	// renaming a vendor-specific attribute) into a common virtual attribute name at
+	// scheduling time. The scheduler then evaluates these virtual attributes exactly
+	// like static attributes when matching constraints.
+	//
+	// Every derived attribute defined in this list must be referenced by at least one
+	// MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+	//
+	// The maximum number of derived attributes is 32.
+	//
+	// This is an alpha field and requires enabling the DRADerivedAttributes
+	// feature gate.
+	//
+	// +optional
+	// +listType=atomic
+	// +featureGate=DRADerivedAttributes
+	// +k8s:optional
+	// +k8s:maxItems=32
+	DerivedAttributes []DeviceDerivedAttribute `json:"derivedAttributes,omitempty" protobuf:"bytes,8,rep,name=derivedAttributes"`
 }
 
 // CapacityRequirements defines the capacity requirements for a specific device request.
@@ -1285,10 +1655,11 @@ const (
 	DeviceSelectorsMaxSize             = 32
 	FirstAvailableDeviceRequestMaxSize = 8
 	DeviceTolerationsMaxLength         = 16
+	DeviceDerivedAttributesMaxSize     = 32
 )
 
 // +enum
-// +k8s:alpha(since: "1.36")=+k8s:enum
+// +k8s:beta(since: "1.37")=+k8s:enum
 type DeviceAllocationMode string
 
 // Valid [DeviceRequest.CountMode] values.
@@ -1318,7 +1689,7 @@ type CELDeviceSelector struct {
 	//  - driver (string): the name of the driver which defines this device.
 	//  - attributes (map[string]object): the device's attributes, grouped by prefix
 	//    (e.g. device.attributes["dra.example.com"] evaluates to an object with all
-	//    of the attributes which were prefixed by "dra.example.com".
+	//    of the attributes which were prefixed by "dra.example.com").
 	//  - capacity (map[string]object): the device's capacities, grouped by prefix.
 	//  - allowMultipleAllocations (bool): the allowMultipleAllocations property of the device
 	//    (v1.34+ with the DRAConsumableCapacity feature enabled).
@@ -1351,6 +1722,15 @@ type CELDeviceSelector struct {
 	// A robust expression should check for the existence of attributes
 	// before referencing them.
 	//
+	// Common errors:
+	// - "no such key": Use optional chaining (.? followed by orValue())
+	//   or guarding the check with has() for optional fields.
+	//   See CEL Optional Types for details:
+	//   https://pkg.go.dev/github.com/google/cel-go@v0.17.4/cel#OptionalTypes
+	//
+	// For more CEL expression syntax and examples, see:
+	// https://kubernetes.io/docs/reference/using-api/cel/
+	//
 	// For ease of use, the cel.bind() function is enabled, and can be used
 	// to simplify expressions that access multiple attributes with the
 	// same domain. For example:
@@ -1373,6 +1753,61 @@ type CELDeviceSelector struct {
 	Expression string `json:"expression" protobuf:"bytes,1,name=expression"`
 }
 
+// DeviceDerivedAttribute defines a derived attribute computed via CEL.
+type DeviceDerivedAttribute struct {
+	// Name is the identifier for this derived attribute, used in constraints.
+	//
+	// It must be a DNS subdomain followed by a slash ("/") followed by a C identifier
+	// (e.g. "example.com/numaNode" or "derived/numaNode").
+	//
+	// If the chosen name matches an existing physical attribute from a driver,
+	// the derived attribute's expression will shadow the physical attribute,
+	// and its evaluated value will be used in constraints instead. When the goal
+	// is to define a derived attribute that is only used within the ResourceClaim
+	// and not meant to shadow an existing attribute, use a domain prefix that
+	// no DRA driver should be using (e.g. "derived/myAttribute").
+	//
+	// It is not valid to define a derived attribute that isn't used in at least
+	// one constraint.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-resource-fully-qualified-name
+	Name FullyQualifiedName `json:"name" protobuf:"bytes,1,name=name"`
+
+	// Expression is a CEL expression evaluated against each candidate device.
+	// The expression must evaluate to a primitive scalar (string, integer,
+	// boolean, or semver) or a list of these scalars ([]string, []int64,
+	// []bool, []semver) to act as a virtual grouping key. Any other return type
+	// is an error and causes CEL evaluation for the device to fail.
+	//
+	// The expression's input is an object named "device", which carries the
+	// same properties as in a CELDeviceSelector.
+	//
+	// When pod scheduling encounters CEL runtime errors (such as looking
+	// up an attribute that isn't defined) for some devices, it will abort
+	// allocation and fail scheduling for the Pod. Surfacing evaluation
+	// errors immediately prevents silent topology matching failures that are
+	// extremely hard to detect. A robust expression should, for example, check
+	// for the existence of attributes before referencing them to avoid
+	// runtime evaluation errors.
+	//
+	// The expression gets evaluated after a device has passed the other
+	// selector expressions for the request in which this expression is used.
+	// This allows writing expressions that are tailored towards the specific
+	// devices being requested (for example, by assuming the device is from a
+	// certain vendor and skipping those checks).
+	//
+	// The length of the expression must be smaller or equal to 10 Ki. The
+	// cost of evaluating it is also limited based on the estimated number
+	// of logical steps; the combined cost of all derived attributes in a
+	// claim is capped by a shared CEL cost budget.
+	//
+	// +required
+	// +k8s:required
+	Expression string `json:"expression" protobuf:"bytes,2,name=expression"`
+}
+
 // CELSelectorExpressionMaxCost specifies the cost limit for a single CEL selector
 // evaluation.
 //
@@ -1398,6 +1833,25 @@ type CELDeviceSelector struct {
 // However, this depends on how fast the machine is.
 const CELSelectorExpressionMaxCost = 1000000
 
+// DeviceClaimDerivedAttributeCELMaxCost is the maximum combined execution cost
+// allowed for all derived attribute CEL expressions within a single DeviceClaim.
+//
+// During validation, the API server computes the estimated execution cost of each
+// derived attribute expression. The sum of these costs across all requests in the
+// claim must not exceed this budget. If it does, the claim is rejected.
+//
+// To stay within the budget, consumers should simplify their CEL expressions,
+// avoid computationally expensive operations like deep nesting or iterations
+// (such as `.all()` or `.exists()`), and minimize the total number of derived
+// attributes in a claim.
+//
+// This shared budget prevents excessively complex claims from degrading the
+// performance of the kube-scheduler. The limit is set to 1,000,000 instruction
+// executions (roughly 0.1 seconds of evaluation time), tying the collective
+// cost of all derived attributes to the maximum cost allowed for a single
+// CEL selector.
+const DeviceClaimDerivedAttributeCELMaxCost = 1000000
+
 // CELSelectorExpressionMaxLength is the maximum length of a CEL selector expression string.
 const CELSelectorExpressionMaxLength = 10 * 1024
 
@@ -1415,10 +1869,10 @@ type DeviceConstraint struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=set
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:unique=set
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Requests []string `json:"requests,omitempty" protobuf:"bytes,1,opt,name=requests"`
 
 	// MatchAttribute requires that all devices in question have this
@@ -1441,8 +1895,8 @@ type DeviceConstraint struct {
 	//
 	// +optional
 	// +oneOf=ConstraintType
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-resource-fully-qualified-name
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-fully-qualified-name
 	MatchAttribute *FullyQualifiedName `json:"matchAttribute,omitempty" protobuf:"bytes,2,opt,name=matchAttribute"`
 
 	// Potential future extension, not part of the current design:
@@ -1474,6 +1928,8 @@ type DeviceConstraint struct {
 	// +optional
 	// +oneOf=ConstraintType
 	// +featureGate=DRAConsumableCapacity
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-fully-qualified-name
 	DistinctAttribute *FullyQualifiedName `json:"distinctAttribute,omitempty" protobuf:"bytes,3,opt,name=distinctAttribute"`
 }
 
@@ -1488,13 +1944,13 @@ type DeviceClaimConfiguration struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=set
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:unique=set
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Requests []string `json:"requests,omitempty" protobuf:"bytes,1,opt,name=requests"`
 
-	DeviceConfiguration `json:",inline" protobuf:"bytes,2,name=deviceConfiguration"`
+	DeviceConfiguration `json:"" protobuf:"bytes,2,name=deviceConfiguration"`
 }
 
 // DeviceConfiguration must have exactly one field set. It gets embedded
@@ -1505,7 +1961,7 @@ type DeviceConfiguration struct {
 	//
 	// +optional
 	// +oneOf=ConfigurationType
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Opaque *OpaqueDeviceConfiguration `json:"opaque,omitempty" protobuf:"bytes,1,opt,name=opaque"`
 }
 
@@ -1522,9 +1978,9 @@ type OpaqueDeviceConfiguration struct {
 	// vendor of the driver. It should use only lower case characters.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name-caseless
-	// +k8s:alpha(since: "1.36")=+k8s:maxLength=63
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name-caseless
+	// +k8s:beta(since: "1.37")=+k8s:maxLength=63
 	Driver string `json:"driver" protobuf:"bytes,1,name=driver"`
 
 	// Parameters can contain arbitrary data. It is the responsibility of
@@ -1550,8 +2006,8 @@ type DeviceToleration struct {
 	// Must be a label name.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-label-key
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-label-key
 	Key string `json:"key,omitempty" protobuf:"bytes,1,opt,name=key"`
 
 	// Operator represents a key's relationship to the value.
@@ -1561,7 +2017,7 @@ type DeviceToleration struct {
 	//
 	// +optional
 	// +default="Equal"
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Operator DeviceTolerationOperator `json:"operator,omitempty" protobuf:"bytes,2,opt,name=operator,casttype=DeviceTolerationOperator"`
 
 	// Value is the taint value the toleration matches to.
@@ -1575,7 +2031,7 @@ type DeviceToleration struct {
 	// When specified, allowed values are NoSchedule and NoExecute.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Effect DeviceTaintEffect `json:"effect,omitempty" protobuf:"bytes,4,opt,name=effect,casttype=DeviceTaintEffect"`
 
 	// TolerationSeconds represents the period of time the toleration (which must be
@@ -1592,7 +2048,7 @@ type DeviceToleration struct {
 // A toleration operator is the set of operators that can be used in a toleration.
 //
 // +enum
-// +k8s:alpha(since: "1.36")=+k8s:enum
+// +k8s:beta(since: "1.37")=+k8s:enum
 type DeviceTolerationOperator string
 
 const (
@@ -1606,8 +2062,8 @@ type ResourceClaimStatus struct {
 	// Allocation is set once the claim has been allocated successfully.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:update=NoModify
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:update=NoModify
 	Allocation *AllocationResult `json:"allocation,omitempty" protobuf:"bytes,1,opt,name=allocation"`
 
 	// ReservedFor indicates which entities are currently allowed to use
@@ -1635,10 +2091,10 @@ type ResourceClaimStatus struct {
 	// +listMapKey=uid
 	// +patchStrategy=merge
 	// +patchMergeKey=uid
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:listType=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=uid
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=256
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:listType=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=uid
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=256
 	ReservedFor []ResourceClaimConsumerReference `json:"reservedFor,omitempty" protobuf:"bytes,2,opt,name=reservedFor" patchStrategy:"merge" patchMergeKey:"uid"`
 
 	// DeallocationRequested is tombstoned since Kubernetes 1.32 where
@@ -1651,18 +2107,18 @@ type ResourceClaimStatus struct {
 	// information. Entries are owned by their respective drivers.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +listType=map
 	// +listMapKey=driver
 	// +listMapKey=device
 	// +listMapKey=pool
 	// +listMapKey=shareID
 	// +featureGate=DRAResourceClaimDeviceStatus
-	// +k8s:alpha(since: "1.36")=+k8s:listType=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=driver
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=device
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=pool
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=shareID
+	// +k8s:beta(since: "1.37")=+k8s:listType=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=driver
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=device
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=pool
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=shareID
 	Devices []AllocatedDeviceStatus `json:"devices,omitempty" protobuf:"bytes,4,opt,name=devices"`
 }
 
@@ -1725,8 +2181,8 @@ type DeviceAllocationResult struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Results []DeviceRequestAllocationResult `json:"results,omitempty" protobuf:"bytes,1,opt,name=results"`
 
 	// This field is a combination of all the claim and class configuration parameters.
@@ -1739,8 +2195,8 @@ type DeviceAllocationResult struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=64
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=64
 	Config []DeviceAllocationConfiguration `json:"config,omitempty" protobuf:"bytes,2,opt,name=config"`
 }
 
@@ -1769,9 +2225,9 @@ type DeviceRequestAllocationResult struct {
 	// vendor of the driver. It should use only lower case characters.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name-caseless
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:maxLength=63
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name-caseless
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:maxLength=63
 	Driver string `json:"driver" protobuf:"bytes,2,name=driver"`
 
 	// This name together with the driver name and the device name field
@@ -1781,8 +2237,8 @@ type DeviceRequestAllocationResult struct {
 	// DNS sub-domains separated by slashes.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-resource-pool-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-pool-name
 	Pool string `json:"pool" protobuf:"bytes,3,name=pool"`
 
 	// Device references one device instance via its name in the driver's
@@ -1813,7 +2269,7 @@ type DeviceRequestAllocationResult struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceTaints
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Tolerations []DeviceToleration `json:"tolerations,omitempty" protobuf:"bytes,6,opt,name=tolerations"`
 
 	// BindingConditions contains a copy of the BindingConditions
@@ -1825,8 +2281,8 @@ type DeviceRequestAllocationResult struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=4
 	BindingConditions []string `json:"bindingConditions,omitempty" protobuf:"bytes,7,rep,name=bindingConditions"`
 
 	// BindingFailureConditions contains a copy of the BindingFailureConditions
@@ -1838,8 +2294,8 @@ type DeviceRequestAllocationResult struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=4
 	BindingFailureConditions []string `json:"bindingFailureConditions,omitempty" protobuf:"bytes,8,rep,name=bindingFailureConditions"`
 
 	// ShareID uniquely identifies an individual allocation share of the device,
@@ -1849,8 +2305,8 @@ type DeviceRequestAllocationResult struct {
 	//
 	// +optional
 	// +featureGate=DRAConsumableCapacity
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-uuid
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-uuid
 	ShareID *types.UID `json:"shareID,omitempty" protobuf:"bytes,9,opt,name=shareID"`
 
 	// ConsumedCapacity tracks the amount of capacity consumed per device as part of the claim request.
@@ -1865,6 +2321,19 @@ type DeviceRequestAllocationResult struct {
 	// +optional
 	// +featureGate=DRAConsumableCapacity
 	ConsumedCapacity map[QualifiedName]resource.Quantity `json:"consumedCapacity,omitempty" protobuf:"bytes,10,rep,name=consumedCapacity"`
+
+	// SkipNodeOperations lists node-local resource operations (gRPC calls)
+	// that will be skipped for this allocated device when determining whether
+	// operations are necessary on the node. If all allocated devices for a driver in
+	// a claim skip an operation, that gRPC call will be skipped. It is a copy of
+	// the ResourceSlice.spec.skipNodeOperations value at the time when the device was allocated.
+	//
+	// +optional
+	// +listType=set
+	// +k8s:listType=set
+	// +featureGate=DRAOptionalNodeOperations
+	// +k8s:optional
+	SkipNodeOperations []SkipNodeOperation `json:"skipNodeOperations,omitempty" protobuf:"bytes,11,rep,name=skipNodeOperations,casttype=SkipNodeOperation"`
 }
 
 // DeviceAllocationConfiguration gets embedded in an AllocationResult.
@@ -1874,7 +2343,7 @@ type DeviceAllocationConfiguration struct {
 	// or from a claim.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Source AllocationConfigSource `json:"source" protobuf:"bytes,1,name=source"`
 
 	// Requests lists the names of requests where the configuration applies.
@@ -1886,17 +2355,17 @@ type DeviceAllocationConfiguration struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=set
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:unique=set
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Requests []string `json:"requests,omitempty" protobuf:"bytes,2,opt,name=requests"`
 
-	DeviceConfiguration `json:",inline" protobuf:"bytes,3,name=deviceConfiguration"`
+	DeviceConfiguration `json:"" protobuf:"bytes,3,name=deviceConfiguration"`
 }
 
 // +enum
-// +k8s:alpha(since: "1.36")=+k8s:enum
+// +k8s:beta(since: "1.37")=+k8s:enum
 type AllocationConfigSource string
 
 // Valid [DeviceAllocationConfiguration.Source] values.
@@ -1910,7 +2379,7 @@ const (
 
 // ResourceClaimList is a collection of claims.
 type ResourceClaimList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -1929,11 +2398,11 @@ type ResourceClaimList struct {
 // the device requests of a claim to apply these presets.
 // Cluster scoped.
 type DeviceClass struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:format=k8s-long-name
+	// +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:format=k8s-long-name
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec defines what can be allocated and how to configure it.
@@ -1944,6 +2413,7 @@ type DeviceClass struct {
 	// the time of allocation.
 	//
 	// Changing the spec automatically increments the metadata.generation number.
+	// +optional
 	Spec DeviceClassSpec `json:"spec" protobuf:"bytes,2,name=spec"`
 }
 
@@ -1954,8 +2424,8 @@ type DeviceClassSpec struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Selectors []DeviceSelector `json:"selectors,omitempty" protobuf:"bytes,1,opt,name=selectors"`
 
 	// Config defines configuration parameters that apply to each device that is claimed via this class.
@@ -1966,8 +2436,8 @@ type DeviceClassSpec struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Config []DeviceClassConfiguration `json:"config,omitempty" protobuf:"bytes,2,opt,name=config"`
 
 	// SuitableNodes is tombstoned since Kubernetes 1.32 where
@@ -1984,17 +2454,16 @@ type DeviceClassSpec struct {
 	// If two classes are created at the same time, then the name of the class
 	// lexicographically sorted first is picked.
 	//
-	// This is a beta field.
 	// +optional
 	// +featureGate=DRAExtendedResource
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-extended-resource-name
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-extended-resource-name
 	ExtendedResourceName *string `json:"extendedResourceName,omitempty" protobuf:"bytes,4,opt,name=extendedResourceName"`
 }
 
 // DeviceClassConfiguration is used in DeviceClass.
 type DeviceClassConfiguration struct {
-	DeviceConfiguration `json:",inline" protobuf:"bytes,1,opt,name=deviceConfiguration"`
+	DeviceConfiguration `json:"" protobuf:"bytes,1,opt,name=deviceConfiguration"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
@@ -2002,7 +2471,7 @@ type DeviceClassConfiguration struct {
 
 // DeviceClassList is a collection of classes.
 type DeviceClassList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -2017,7 +2486,7 @@ type DeviceClassList struct {
 
 // ResourceClaimTemplate is used to produce ResourceClaim objects.
 type ResourceClaimTemplate struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -2027,6 +2496,7 @@ type ResourceClaimTemplate struct {
 	// This field is immutable. A ResourceClaim will get created by the
 	// control plane for a Pod when needed and then not get updated
 	// anymore.
+	// +optional
 	Spec ResourceClaimTemplateSpec `json:"spec" protobuf:"bytes,2,name=spec"`
 }
 
@@ -2036,11 +2506,13 @@ type ResourceClaimTemplateSpec struct {
 	// when creating it. No other fields are allowed and will be rejected during
 	// validation.
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec for the ResourceClaim. The entire content is copied unchanged
 	// into the ResourceClaim that gets created from this template. The
 	// same fields as in a ResourceClaim are also valid here.
+	// +optional
 	Spec ResourceClaimSpec `json:"spec" protobuf:"bytes,2,name=spec"`
 }
 
@@ -2049,7 +2521,7 @@ type ResourceClaimTemplateSpec struct {
 
 // ResourceClaimTemplateList is a collection of claim templates.
 type ResourceClaimTemplateList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -2111,8 +2583,8 @@ type AllocatedDeviceStatus struct {
 	//
 	// +optional
 	// +featureGate=DRAConsumableCapacity
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-uuid
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-uuid
 	ShareID *string `json:"shareID,omitempty" protobuf:"bytes,7,opt,name=shareID"`
 
 	// Conditions contains the latest observation of the device's state.
@@ -2124,6 +2596,9 @@ type AllocatedDeviceStatus struct {
 	// +optional
 	// +listType=map
 	// +listMapKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 	Conditions []metav1.Condition `json:"conditions" protobuf:"bytes,4,opt,name=conditions"`
 
 	// Data contains arbitrary driver-specific data.
@@ -2136,7 +2611,7 @@ type AllocatedDeviceStatus struct {
 	// NetworkData contains network-related information specific to the device.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	NetworkData *NetworkDeviceData `json:"networkData,omitempty" protobuf:"bytes,6,opt,name=networkData"`
 }
 
@@ -2151,8 +2626,8 @@ type NetworkDeviceData struct {
 	// Must not be longer than 256 bytes.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxBytes=256
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxBytes=256
 	InterfaceName string `json:"interfaceName,omitempty" protobuf:"bytes,1,opt,name=interfaceName"`
 
 	// IPs lists the network addresses assigned to the device's network interface.
@@ -2163,10 +2638,10 @@ type NetworkDeviceData struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=set
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=16
+	// +k8s:beta(since: "1.37")=+k8s:unique=set
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=16
 	IPs []string `json:"ips,omitempty" protobuf:"bytes,2,opt,name=ips"`
 
 	// HardwareAddress represents the hardware address (e.g. MAC Address) of the device's network interface.
@@ -2174,7 +2649,7 @@ type NetworkDeviceData struct {
 	// Must not be longer than 128 bytes.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxBytes=128
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxBytes=128
 	HardwareAddress string `json:"hardwareAddress,omitempty" protobuf:"bytes,3,opt,name=hardwareAddress"`
 }
diff --git a/vendor/k8s.io/api/resource/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/resource/v1/types_swagger_doc_generated.go
index 51915d3e20..2f7c1864d1 100644
--- a/vendor/k8s.io/api/resource/v1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/resource/v1/types_swagger_doc_generated.go
@@ -55,7 +55,7 @@ func (AllocationResult) SwaggerDoc() map[string]string {
 
 var map_CELDeviceSelector = map[string]string{
 	"":           "CELDeviceSelector contains a CEL expression for selecting a device.",
-	"expression": "Expression is a CEL expression which evaluates a single device. It must evaluate to true when the device under consideration satisfies the desired criteria, and false when it does not. Any other result is an error and causes allocation of devices to abort.\n\nThe expression's input is an object named \"device\", which carries the following properties:\n - driver (string): the name of the driver which defines this device.\n - attributes (map[string]object): the device's attributes, grouped by prefix\n   (e.g. device.attributes[\"dra.example.com\"] evaluates to an object with all\n   of the attributes which were prefixed by \"dra.example.com\".\n - capacity (map[string]object): the device's capacities, grouped by prefix.\n - allowMultipleAllocations (bool): the allowMultipleAllocations property of the device\n   (v1.34+ with the DRAConsumableCapacity feature enabled).\n\nExample: Consider a device with driver=\"dra.example.com\", which exposes two attributes named \"model\" and \"ext.example.com/family\" and which exposes one capacity named \"modules\". This input to this expression would have the following fields:\n\n    device.driver\n    device.attributes[\"dra.example.com\"].model\n    device.attributes[\"ext.example.com\"].family\n    device.capacity[\"dra.example.com\"].modules\n\nThe device.driver field can be used to check for a specific driver, either as a high-level precondition (i.e. you only want to consider devices from this driver) or as part of a multi-clause expression that is meant to consider devices from different drivers.\n\nThe value type of each attribute is defined by the device definition, and users who write these expressions must consult the documentation for their specific drivers. The value type of each capacity is Quantity.\n\nIf an unknown prefix is used as a lookup in either device.attributes or device.capacity, an empty map will be returned. Any reference to an unknown field will cause an evaluation error and allocation to abort.\n\nA robust expression should check for the existence of attributes before referencing them.\n\nFor ease of use, the cel.bind() function is enabled, and can be used to simplify expressions that access multiple attributes with the same domain. For example:\n\n    cel.bind(dra, device.attributes[\"dra.example.com\"], dra.someBool && dra.anotherBool)\n\nWhen the DRAListTypeAttributes feature gate is enabled, the includes() helper is available and it can work for both scalar and list-type attributes. It was introduced to support smooth migration from scalar attributes to list-type attributes while keeping CEL expressions simple. For example:\n\n    device.attributes[\"dra.example.com\"].models.includes(\"some-model\")\n\nThe length of the expression must be smaller or equal to 10 Ki. The cost of evaluating it is also limited based on the estimated number of logical steps.",
+	"expression": "Expression is a CEL expression which evaluates a single device. It must evaluate to true when the device under consideration satisfies the desired criteria, and false when it does not. Any other result is an error and causes allocation of devices to abort.\n\nThe expression's input is an object named \"device\", which carries the following properties:\n - driver (string): the name of the driver which defines this device.\n - attributes (map[string]object): the device's attributes, grouped by prefix\n   (e.g. device.attributes[\"dra.example.com\"] evaluates to an object with all\n   of the attributes which were prefixed by \"dra.example.com\").\n - capacity (map[string]object): the device's capacities, grouped by prefix.\n - allowMultipleAllocations (bool): the allowMultipleAllocations property of the device\n   (v1.34+ with the DRAConsumableCapacity feature enabled).\n\nExample: Consider a device with driver=\"dra.example.com\", which exposes two attributes named \"model\" and \"ext.example.com/family\" and which exposes one capacity named \"modules\". This input to this expression would have the following fields:\n\n    device.driver\n    device.attributes[\"dra.example.com\"].model\n    device.attributes[\"ext.example.com\"].family\n    device.capacity[\"dra.example.com\"].modules\n\nThe device.driver field can be used to check for a specific driver, either as a high-level precondition (i.e. you only want to consider devices from this driver) or as part of a multi-clause expression that is meant to consider devices from different drivers.\n\nThe value type of each attribute is defined by the device definition, and users who write these expressions must consult the documentation for their specific drivers. The value type of each capacity is Quantity.\n\nIf an unknown prefix is used as a lookup in either device.attributes or device.capacity, an empty map will be returned. Any reference to an unknown field will cause an evaluation error and allocation to abort.\n\nA robust expression should check for the existence of attributes before referencing them.\n\nCommon errors: - \"no such key\": Use optional chaining (.? followed by orValue())\n  or guarding the check with has() for optional fields.\n  See CEL Optional Types for details:\n  https://pkg.go.dev/github.com/google/cel-go@v0.17.4/cel#OptionalTypes\n\nFor more CEL expression syntax and examples, see: https://kubernetes.io/docs/reference/using-api/cel/\n\nFor ease of use, the cel.bind() function is enabled, and can be used to simplify expressions that access multiple attributes with the same domain. For example:\n\n    cel.bind(dra, device.attributes[\"dra.example.com\"], dra.someBool && dra.anotherBool)\n\nWhen the DRAListTypeAttributes feature gate is enabled, the includes() helper is available and it can work for both scalar and list-type attributes. It was introduced to support smooth migration from scalar attributes to list-type attributes while keeping CEL expressions simple. For example:\n\n    device.attributes[\"dra.example.com\"].models.includes(\"some-model\")\n\nThe length of the expression must be smaller or equal to 10 Ki. The cost of evaluating it is also limited based on the estimated number of logical steps.",
 }
 
 func (CELDeviceSelector) SwaggerDoc() map[string]string {
@@ -74,7 +74,7 @@ func (CapacityRequestPolicy) SwaggerDoc() map[string]string {
 }
 
 var map_CapacityRequestPolicyRange = map[string]string{
-	"":     "CapacityRequestPolicyRange defines a valid range for consumable capacity values.\n\n  - If the requested amount is less than Min, it is rounded up to the Min value.\n  - If Step is set and the requested amount is between Min and Max but not aligned with Step,\n    it will be rounded up to the next value equal to Min + (n * Step).\n  - If Step is not set, the requested amount is used as-is if it falls within the range Min to Max (if set).\n  - If the requested or rounded amount exceeds Max (if set), the request does not satisfy the policy,\n    and the device cannot be allocated.",
+	"":     "CapacityRequestPolicyRange defines a valid range for consumable capacity values.\n\nIf the DRAFractionalCapacityRange feature gate is enabled and at least one of Min, Max, or Step is a fractional quantity (i.e. its value is not an integer), milli-unit arithmetic is used instead, supporting values with up to 3 decimal places (e.g. 100m = 0.1). The largest supported value then is 1000 times smaller compared to using 64-bit integers. Otherwise, all comparisons use 64-bit integer arithmetic via resource.Quantity.Value().\n\n  - If the requested amount is less than Min, it is rounded up to the Min value.\n  - If Step is set and the requested amount is between Min and Max but not aligned with Step,\n    it will be rounded up to the next value equal to Min + (n * Step).\n  - If Step is not set, the requested amount is used as-is if it falls within the range Min to Max (if set).\n  - If the requested or rounded amount exceeds Max (if set), the request does not satisfy the policy,\n    and the device cannot be allocated.",
 	"min":  "Min specifies the minimum capacity allowed for a consumption request.\n\nMin must be greater than or equal to zero, and less than or equal to the capacity value. requestPolicy.default must be more than or equal to the minimum.",
 	"max":  "Max defines the upper limit for capacity that can be requested.\n\nMax must be less than or equal to the capacity value. Min and requestPolicy.default must be less than or equal to the maximum.",
 	"step": "Step defines the step size between valid capacity amounts within the range.\n\nMax (if set) and requestPolicy.default must be a multiple of Step. Min + Step must be less than or equal to the capacity value.",
@@ -113,20 +113,20 @@ func (CounterSet) SwaggerDoc() map[string]string {
 }
 
 var map_Device = map[string]string{
-	"":                                "Device represents one individual hardware instance that can be selected based on its attributes. Besides the name, exactly one field must be set.",
-	"name":                            "Name is unique identifier among all devices managed by the driver in the pool. It must be a DNS label.",
-	"attributes":                      "Attributes defines the set of attributes for this device. The name of each attribute must be unique in that set.\n\nThe maximum number of attributes and capacities combined is 32.",
-	"capacity":                        "Capacity defines the set of capacities for this device. The name of each capacity must be unique in that set.\n\nThe maximum number of attributes and capacities combined is 32.",
-	"consumesCounters":                "ConsumesCounters defines a list of references to sharedCounters and the set of counters that the device will consume from those counter sets.\n\nThere can only be a single entry per counterSet.\n\nThe maximum number of device counter consumptions per device is 2.",
-	"nodeName":                        "NodeName identifies the node where the device is available.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
-	"nodeSelector":                    "NodeSelector defines the nodes where the device is available.\n\nMust use exactly one term.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
-	"allNodes":                        "AllNodes indicates that all nodes have access to the device.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
-	"taints":                          "If specified, these are the driver-defined taints.\n\nThe maximum number of taints is 16. If taints are set for any device in a ResourceSlice, then the maximum number of allowed devices per ResourceSlice is 64 instead of 128.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
-	"bindsToNode":                     "BindsToNode indicates if the usage of an allocation involving this device has to be limited to exactly the node that was chosen when allocating the claim. If set to true, the scheduler will set the ResourceClaim.Status.Allocation.NodeSelector to match the node where the allocation was made.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
-	"bindingConditions":               "BindingConditions defines the conditions for proceeding with binding. All of these conditions must be set in the per-device status conditions with a value of True to proceed with binding the pod to the node while scheduling the pod.\n\nThe maximum number of binding conditions is 4.\n\nThe conditions must be a valid condition type string.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
-	"bindingFailureConditions":        "BindingFailureConditions defines the conditions for binding failure. They may be set in the per-device status conditions. If any is set to \"True\", a binding failure occurred.\n\nThe maximum number of binding failure conditions is 4.\n\nThe conditions must be a valid condition type string.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
-	"allowMultipleAllocations":        "AllowMultipleAllocations marks whether the device is allowed to be allocated to multiple DeviceRequests.\n\nIf AllowMultipleAllocations is set to true, the device can be allocated more than once, and all of its capacity is consumable, regardless of whether the requestPolicy is defined or not.",
-	"nodeAllocatableResourceMappings": "NodeAllocatableResourceMappings defines the mapping of node resources that are managed by the DRA driver exposing this device. This includes resources currently reported in v1.Node `status.allocatable` that are not extended resources (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources). Examples include \"cpu\", \"memory\", \"ephemeral-storage\", and hugepages. In addition to standard requests made through the Pod `spec`, these resources can also be requested through claims and allocated by the DRA driver. For example, a CPU DRA driver might allocate exclusive CPUs or auxiliary node memory dependencies of an accelerator device. The keys of this map are the node-allocatable resource names (e.g., \"cpu\", \"memory\"). Extended resource names are not permitted as keys.",
+	"":                         "Device represents one individual hardware instance that can be selected based on its attributes. Besides the name, exactly one field must be set.",
+	"name":                     "Name is unique identifier among all devices managed by the driver in the pool. It must be a DNS label.",
+	"attributes":               "Attributes defines the set of attributes for this device. The name of each attribute must be unique in that set.\n\nThe maximum number of attributes and capacities combined is 32.",
+	"capacity":                 "Capacity defines the set of capacities for this device. The name of each capacity must be unique in that set.\n\nThe maximum number of attributes and capacities combined is 32.",
+	"consumesCounters":         "ConsumesCounters defines a list of references to sharedCounters and the set of counters that the device will consume from those counter sets.\n\nThere can only be a single entry per counterSet.\n\nThe maximum number of device counter consumptions per device is 2.",
+	"nodeName":                 "NodeName identifies the node where the device is available.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
+	"nodeSelector":             "NodeSelector defines the nodes where the device is available.\n\nMust use exactly one term.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
+	"allNodes":                 "AllNodes indicates that all nodes have access to the device.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
+	"taints":                   "If specified, these are the driver-defined taints.\n\nThe maximum number of taints is 16. If taints are set for any device in a ResourceSlice, then the maximum number of allowed devices per ResourceSlice is 64 instead of 128.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
+	"bindsToNode":              "BindsToNode indicates if the usage of an allocation involving this device has to be limited to exactly the node that was chosen when allocating the claim. If set to true, the scheduler will set the ResourceClaim.Status.Allocation.NodeSelector to match the node where the allocation was made.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
+	"bindingConditions":        "BindingConditions defines the conditions for proceeding with binding. All of these conditions must be set in the per-device status conditions with a value of True to proceed with binding the pod to the node while scheduling the pod.\n\nThe maximum number of binding conditions is 4.\n\nThe conditions must be a valid condition type string.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
+	"bindingFailureConditions": "BindingFailureConditions defines the conditions for binding failure. They may be set in the per-device status conditions. If any is set to \"True\", a binding failure occurred.\n\nThe maximum number of binding failure conditions is 4.\n\nThe conditions must be a valid condition type string.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
+	"allowMultipleAllocations": "AllowMultipleAllocations marks whether the device is allowed to be allocated to multiple DeviceRequests.\n\nIf AllowMultipleAllocations is set to true, the device can be allocated more than once, and all of its capacity is consumable, regardless of whether the requestPolicy is defined or not.",
+	"nodeAllocatableResources": "NodeAllocatableResources defines the mapping of node resources that are managed by the DRA driver exposing this device. This includes resources currently reported in v1.Node `status.allocatable` that are not extended resources (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources). Examples include \"cpu\", \"memory\", \"ephemeral-storage\", and hugepages. In addition to standard requests made through the Pod `spec`, these resources can also be requested through claims and allocated by the DRA driver. For example, a CPU DRA driver might allocate exclusive CPUs or auxiliary node memory dependencies of an accelerator device. The keys of this map are the node-allocatable resource names (e.g., \"cpu\", \"memory\"). Extended resource names are not permitted as keys.",
 }
 
 func (Device) SwaggerDoc() map[string]string {
@@ -231,7 +231,7 @@ var map_DeviceClassSpec = map[string]string{
 	"":                     "DeviceClassSpec is used in a [DeviceClass] to define what can be allocated and how to configure it.",
 	"selectors":            "Each selector must be satisfied by a device which is claimed via this class.",
 	"config":               "Config defines configuration parameters that apply to each device that is claimed via this class. Some classses may potentially be satisfied by multiple drivers, so each instance of a vendor configuration applies to exactly one driver.\n\nThey are passed to the driver, but are not considered while allocating the claim.",
-	"extendedResourceName": "ExtendedResourceName is the extended resource name for the devices of this class. The devices of this class can be used to satisfy a pod's extended resource requests. It has the same format as the name of a pod's extended resource. It should be unique among all the device classes in a cluster. If two device classes have the same name, then the class created later is picked to satisfy a pod's extended resource requests. If two classes are created at the same time, then the name of the class lexicographically sorted first is picked.\n\nThis is a beta field.",
+	"extendedResourceName": "ExtendedResourceName is the extended resource name for the devices of this class. The devices of this class can be used to satisfy a pod's extended resource requests. It has the same format as the name of a pod's extended resource. It should be unique among all the device classes in a cluster. If two device classes have the same name, then the class created later is picked to satisfy a pod's extended resource requests. If two classes are created at the same time, then the name of the class lexicographically sorted first is picked.",
 }
 
 func (DeviceClassSpec) SwaggerDoc() map[string]string {
@@ -259,15 +259,26 @@ func (DeviceConstraint) SwaggerDoc() map[string]string {
 }
 
 var map_DeviceCounterConsumption = map[string]string{
-	"":           "DeviceCounterConsumption defines a set of counters that a device will consume from a CounterSet.",
-	"counterSet": "CounterSet is the name of the set from which the counters defined will be consumed.",
-	"counters":   "Counters defines the counters that will be consumed by the device.\n\nThe maximum number of counters is 32.",
+	"":                    "DeviceCounterConsumption defines a set of counters that a device will consume from a CounterSet.",
+	"counterSet":          "CounterSet is the name of the set from which the counters defined will be consumed.",
+	"counters":            "Counters defines the counters that will be consumed by the device.\n\nThe maximum number of counters is 32.",
+	"compatibilityGroups": "CompatibilityGroups is a list of opaque group names for this counter set consumption.\n\nDevices that consume counters from the same counter set may only be allocated at the same time (\"co-allocated\") if they all share at least one common group: the intersection of the CompatibilityGroups of all co-allocated devices on that counter set must be non-empty. Devices that consume from different counter sets are never compared via this field.\n\nAn unset field, an explicit nil, and an empty list are equivalent and mean \"no groups\": such a device is only co-allocatable with sibling devices on the same counter set that also have no groups, and is never co-allocatable with a device that declares one or more groups.\n\nGroup names are opaque and meaningful only within the publishing driver's pool.\n\nThe maximum number of groups is 2, and the names must be unique.",
 }
 
 func (DeviceCounterConsumption) SwaggerDoc() map[string]string {
 	return map_DeviceCounterConsumption
 }
 
+var map_DeviceDerivedAttribute = map[string]string{
+	"":           "DeviceDerivedAttribute defines a derived attribute computed via CEL.",
+	"name":       "Name is the identifier for this derived attribute, used in constraints.\n\nIt must be a DNS subdomain followed by a slash (\"/\") followed by a C identifier (e.g. \"example.com/numaNode\" or \"derived/numaNode\").\n\nIf the chosen name matches an existing physical attribute from a driver, the derived attribute's expression will shadow the physical attribute, and its evaluated value will be used in constraints instead. When the goal is to define a derived attribute that is only used within the ResourceClaim and not meant to shadow an existing attribute, use a domain prefix that no DRA driver should be using (e.g. \"derived/myAttribute\").\n\nIt is not valid to define a derived attribute that isn't used in at least one constraint.",
+	"expression": "Expression is a CEL expression evaluated against each candidate device. The expression must evaluate to a primitive scalar (string, integer, boolean, or semver) or a list of these scalars ([]string, []int64, []bool, []semver) to act as a virtual grouping key. Any other return type is an error and causes CEL evaluation for the device to fail.\n\nThe expression's input is an object named \"device\", which carries the same properties as in a CELDeviceSelector.\n\nWhen pod scheduling encounters CEL runtime errors (such as looking up an attribute that isn't defined) for some devices, it will abort allocation and fail scheduling for the Pod. Surfacing evaluation errors immediately prevents silent topology matching failures that are extremely hard to detect. A robust expression should, for example, check for the existence of attributes before referencing them to avoid runtime evaluation errors.\n\nThe expression gets evaluated after a device has passed the other selector expressions for the request in which this expression is used. This allows writing expressions that are tailored towards the specific devices being requested (for example, by assuming the device is from a certain vendor and skipping those checks).\n\nThe length of the expression must be smaller or equal to 10 Ki. The cost of evaluating it is also limited based on the estimated number of logical steps; the combined cost of all derived attributes in a claim is capped by a shared CEL cost budget.",
+}
+
+func (DeviceDerivedAttribute) SwaggerDoc() map[string]string {
+	return map_DeviceDerivedAttribute
+}
+
 var map_DeviceRequest = map[string]string{
 	"":               "DeviceRequest is a request for devices required for a claim. This is typically a request for a single resource like a device, but can also ask for several identical devices. With FirstAvailable it is also possible to provide a prioritized list of requests.",
 	"name":           "Name can be used to reference this request in a pod.spec.containers[].resources.claims entry and in a constraint of the claim.\n\nReferences using the name in the DeviceRequest will uniquely identify a request when the Exactly field is set. When the FirstAvailable field is set, a reference to the name of the DeviceRequest will match whatever subrequest is chosen by the scheduler.\n\nMust be a DNS label.",
@@ -291,6 +302,7 @@ var map_DeviceRequestAllocationResult = map[string]string{
 	"bindingFailureConditions": "BindingFailureConditions contains a copy of the BindingFailureConditions from the corresponding ResourceSlice at the time of allocation.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
 	"shareID":                  "ShareID uniquely identifies an individual allocation share of the device, used when the device supports multiple simultaneous allocations. It serves as an additional map key to differentiate concurrent shares of the same device.",
 	"consumedCapacity":         "ConsumedCapacity tracks the amount of capacity consumed per device as part of the claim request. The consumed amount may differ from the requested amount: it is rounded up to the nearest valid value based on the device’s requestPolicy if applicable (i.e., may not be less than the requested amount).\n\nThe total consumed capacity for each device must not exceed the DeviceCapacity's Value.\n\nThis field is populated only for devices that allow multiple allocations. All capacity entries are included, even if the consumed amount is zero.",
+	"skipNodeOperations":       "SkipNodeOperations lists node-local resource operations (gRPC calls) that will be skipped for this allocated device when determining whether operations are necessary on the node. If all allocated devices for a driver in a claim skip an operation, that gRPC call will be skipped. It is a copy of the ResourceSlice.spec.skipNodeOperations value at the time when the device was allocated.",
 }
 
 func (DeviceRequestAllocationResult) SwaggerDoc() map[string]string {
@@ -307,14 +319,15 @@ func (DeviceSelector) SwaggerDoc() map[string]string {
 }
 
 var map_DeviceSubRequest = map[string]string{
-	"":                "DeviceSubRequest describes a request for device provided in the claim.spec.devices.requests[].firstAvailable array. Each is typically a request for a single resource like a device, but can also ask for several identical devices.\n\nDeviceSubRequest is similar to ExactDeviceRequest, but doesn't expose the AdminAccess field as that one is only supported when requesting a specific device.",
-	"name":            "Name can be used to reference this subrequest in the list of constraints or the list of configurations for the claim. References must use the format <main request>/<subrequest>.\n\nMust be a DNS label.",
-	"deviceClassName": "DeviceClassName references a specific DeviceClass, which can define additional configuration and selectors to be inherited by this subrequest.\n\nA class is required. Which classes are available depends on the cluster.\n\nAdministrators may use this to restrict which devices may get requested by only installing classes with selectors for permitted devices. If users are free to request anything without restrictions, then administrators can create an empty DeviceClass for users to reference.",
-	"selectors":       "Selectors define criteria which must be satisfied by a specific device in order for that device to be considered for this subrequest. All selectors must be satisfied for a device to be considered.",
-	"allocationMode":  "AllocationMode and its related fields define how devices are allocated to satisfy this subrequest. Supported values are:\n\n- ExactCount: This request is for a specific number of devices.\n  This is the default. The exact number is provided in the\n  count field.\n\n- All: This subrequest is for all of the matching devices in a pool.\n  Allocation will fail if some devices are already allocated,\n  unless adminAccess is requested.\n\nIf AllocationMode is not specified, the default mode is ExactCount. If the mode is ExactCount and count is not specified, the default count is one. Any other subrequests must specify this field.\n\nMore modes may get added in the future. Clients must refuse to handle requests with unknown modes.",
-	"count":           "Count is used only when the count mode is \"ExactCount\". Must be greater than zero. If AllocationMode is ExactCount and this field is not specified, the default is one.",
-	"tolerations":     "If specified, the request's tolerations.\n\nTolerations for NoSchedule are required to allocate a device which has a taint with that effect. The same applies to NoExecute.\n\nIn addition, should any of the allocated devices get tainted with NoExecute after allocation and that effect is not tolerated, then all pods consuming the ResourceClaim get deleted to evict them. The scheduler will not let new pods reserve the claim while it has these tainted devices. Once all pods are evicted, the claim will get deallocated.\n\nThe maximum number of tolerations is 16.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
-	"capacity":        "Capacity define resource requirements against each capacity.\n\nIf this field is unset and the device supports multiple allocations, the default value will be applied to each capacity according to requestPolicy. For the capacity that has no requestPolicy, default is the full capacity value.\n\nApplies to each device allocation. If Count > 1, the request fails if there aren't enough devices that meet the requirements. If AllocationMode is set to All, the request fails if there are devices that otherwise match the request, and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.",
+	"":                  "DeviceSubRequest describes a request for device provided in the claim.spec.devices.requests[].firstAvailable array. Each is typically a request for a single resource like a device, but can also ask for several identical devices.\n\nDeviceSubRequest is similar to ExactDeviceRequest, but doesn't expose the AdminAccess field as that one is only supported when requesting a specific device.",
+	"name":              "Name can be used to reference this subrequest in the list of constraints or the list of configurations for the claim. References must use the format <main request>/<subrequest>.\n\nMust be a DNS label.",
+	"deviceClassName":   "DeviceClassName references a specific DeviceClass, which can define additional configuration and selectors to be inherited by this subrequest.\n\nA class is required. Which classes are available depends on the cluster.\n\nAdministrators may use this to restrict which devices may get requested by only installing classes with selectors for permitted devices. If users are free to request anything without restrictions, then administrators can create an empty DeviceClass for users to reference.",
+	"selectors":         "Selectors define criteria which must be satisfied by a specific device in order for that device to be considered for this subrequest. All selectors must be satisfied for a device to be considered.",
+	"allocationMode":    "AllocationMode and its related fields define how devices are allocated to satisfy this subrequest. Supported values are:\n\n- ExactCount: This request is for a specific number of devices.\n  This is the default. The exact number is provided in the\n  count field.\n\n- All: This subrequest is for all of the matching devices in a pool.\n  Allocation will fail if some devices are already allocated,\n  unless adminAccess is requested.\n\nIf AllocationMode is not specified, the default mode is ExactCount. If the mode is ExactCount and count is not specified, the default count is one. Any other subrequests must specify this field.\n\nMore modes may get added in the future. Clients must refuse to handle requests with unknown modes.",
+	"count":             "Count is used only when the count mode is \"ExactCount\". Must be greater than zero. If AllocationMode is ExactCount and this field is not specified, the default is one.",
+	"tolerations":       "If specified, the request's tolerations.\n\nTolerations for NoSchedule are required to allocate a device which has a taint with that effect. The same applies to NoExecute.\n\nIn addition, should any of the allocated devices get tainted with NoExecute after allocation and that effect is not tolerated, then all pods consuming the ResourceClaim get deleted to evict them. The scheduler will not let new pods reserve the claim while it has these tainted devices. Once all pods are evicted, the claim will get deallocated.\n\nThe maximum number of tolerations is 16.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
+	"capacity":          "Capacity define resource requirements against each capacity.\n\nIf this field is unset and the device supports multiple allocations, the default value will be applied to each capacity according to requestPolicy. For the capacity that has no requestPolicy, default is the full capacity value.\n\nApplies to each device allocation. If Count > 1, the request fails if there aren't enough devices that meet the requirements. If AllocationMode is set to All, the request fails if there are devices that otherwise match the request, and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.",
+	"derivedAttributes": "DerivedAttributes defines a set of virtual attributes computed via CEL expressions for each candidate device. These virtual attributes can be referenced in `.devices.constraints` to align and match different devices (e.g., co-allocating a GPU and a NIC on the same NUMA node) even if their drivers publish different attributes. Derived attributes are not available via `device.attributes` in the CEL environment when evaluating selector expressions.\n\nDerived attributes allow you to extract, transform, or normalize topology information (such as extracting a NUMA index from a complex topology string or renaming a vendor-specific attribute) into a common virtual attribute name at scheduling time. The scheduler then evaluates these virtual attributes exactly like static attributes when matching constraints.\n\nEvery derived attribute defined in this list must be referenced by at least one MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.\n\nThe maximum number of derived attributes is 32.\n\nThis is an alpha field and requires enabling the DRADerivedAttributes feature gate.",
 }
 
 func (DeviceSubRequest) SwaggerDoc() map[string]string {
@@ -333,6 +346,57 @@ func (DeviceTaint) SwaggerDoc() map[string]string {
 	return map_DeviceTaint
 }
 
+var map_DeviceTaintRule = map[string]string{
+	"":         "DeviceTaintRule adds one taint to all devices which match the selector. This has the same effect as if the taint was specified directly in the ResourceSlice by the DRA driver.",
+	"metadata": "Standard object metadata",
+	"spec":     "Spec specifies the selector and one taint.\n\nChanging the spec automatically increments the metadata.generation number.",
+	"status":   "Status provides information about what was requested in the spec.",
+}
+
+func (DeviceTaintRule) SwaggerDoc() map[string]string {
+	return map_DeviceTaintRule
+}
+
+var map_DeviceTaintRuleList = map[string]string{
+	"":         "DeviceTaintRuleList is a collection of DeviceTaintRules.",
+	"metadata": "Standard list metadata",
+	"items":    "Items is the list of DeviceTaintRules.",
+}
+
+func (DeviceTaintRuleList) SwaggerDoc() map[string]string {
+	return map_DeviceTaintRuleList
+}
+
+var map_DeviceTaintRuleSpec = map[string]string{
+	"":               "DeviceTaintRuleSpec specifies the selector and one taint.",
+	"deviceSelector": "DeviceSelector defines which device(s) the taint is applied to. All selector criteria must be satisfied for a device to match. The empty selector matches all devices. Without a selector, no devices are matches.",
+	"taint":          "The taint that gets applied to matching devices.",
+}
+
+func (DeviceTaintRuleSpec) SwaggerDoc() map[string]string {
+	return map_DeviceTaintRuleSpec
+}
+
+var map_DeviceTaintRuleStatus = map[string]string{
+	"":           "DeviceTaintRuleStatus provides information about an on-going pod eviction.",
+	"conditions": "Conditions provide information about the state of the DeviceTaintRule and the cluster at some point in time, in a machine-readable and human-readable format.\n\nThe following condition is currently defined as part of this API, more may get added: - Type: EvictionInProgress - Status: True if there are currently pods which need to be evicted, False otherwise\n  (includes the effects which don't cause eviction).\n- Reason: not specified, may change - Message: includes information about number of pending pods and already evicted pods\n  in a human-readable format, updated periodically, may change\n\nFor `effect: None`, the condition above gets set once for each change to the spec, with the message containing information about what would happen if the effect was `NoExecute`. This feedback can be used to decide whether changing the effect to `NoExecute` will work as intended. It only gets set once to avoid having to constantly update the status.\n\nMust have 8 or fewer entries.",
+}
+
+func (DeviceTaintRuleStatus) SwaggerDoc() map[string]string {
+	return map_DeviceTaintRuleStatus
+}
+
+var map_DeviceTaintSelector = map[string]string{
+	"":       "DeviceTaintSelector defines which device(s) a DeviceTaintRule applies to. The empty selector matches all devices. Without a selector, no devices are matched.",
+	"driver": "If driver is set, only devices from that driver are selected. This fields corresponds to slice.spec.driver.",
+	"pool":   "If pool is set, only devices in that pool are selected.\n\nAlso setting the driver name may be useful to avoid ambiguity when different drivers use the same pool name, but this is not required because selecting pools from different drivers may also be useful, for example when drivers with node-local devices use the node name as their pool name.",
+	"device": "If device is set, only devices with that name are selected. This field corresponds to slice.spec.devices[].name.\n\nSetting also driver and pool may be required to avoid ambiguity, but is not required.",
+}
+
+func (DeviceTaintSelector) SwaggerDoc() map[string]string {
+	return map_DeviceTaintSelector
+}
+
 var map_DeviceToleration = map[string]string{
 	"":                  "The ResourceClaim this DeviceToleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>.",
 	"key":               "Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. Must be a label name.",
@@ -347,14 +411,15 @@ func (DeviceToleration) SwaggerDoc() map[string]string {
 }
 
 var map_ExactDeviceRequest = map[string]string{
-	"":                "ExactDeviceRequest is a request for one or more identical devices.",
-	"deviceClassName": "DeviceClassName references a specific DeviceClass, which can define additional configuration and selectors to be inherited by this request.\n\nA DeviceClassName is required.\n\nAdministrators may use this to restrict which devices may get requested by only installing classes with selectors for permitted devices. If users are free to request anything without restrictions, then administrators can create an empty DeviceClass for users to reference.",
-	"selectors":       "Selectors define criteria which must be satisfied by a specific device in order for that device to be considered for this request. All selectors must be satisfied for a device to be considered.",
-	"allocationMode":  "AllocationMode and its related fields define how devices are allocated to satisfy this request. Supported values are:\n\n- ExactCount: This request is for a specific number of devices.\n  This is the default. The exact number is provided in the\n  count field.\n\n- All: This request is for all of the matching devices in a pool.\n  At least one device must exist on the node for the allocation to succeed.\n  Allocation will fail if some devices are already allocated,\n  unless adminAccess is requested.\n\nIf AllocationMode is not specified, the default mode is ExactCount. If the mode is ExactCount and count is not specified, the default count is one. Any other requests must specify this field.\n\nMore modes may get added in the future. Clients must refuse to handle requests with unknown modes.",
-	"count":           "Count is used only when the count mode is \"ExactCount\". Must be greater than zero. If AllocationMode is ExactCount and this field is not specified, the default is one.",
-	"adminAccess":     "AdminAccess indicates that this is a claim for administrative access to the device(s). Claims with AdminAccess are expected to be used for monitoring or other management services for a device.  They ignore all ordinary claims to the device with respect to access modes and any resource allocations.\n\nAdmin access is disabled if this field is unset or set to false, otherwise it is enabled.",
-	"tolerations":     "If specified, the request's tolerations.\n\nTolerations for NoSchedule are required to allocate a device which has a taint with that effect. The same applies to NoExecute.\n\nIn addition, should any of the allocated devices get tainted with NoExecute after allocation and that effect is not tolerated, then all pods consuming the ResourceClaim get deleted to evict them. The scheduler will not let new pods reserve the claim while it has these tainted devices. Once all pods are evicted, the claim will get deallocated.\n\nThe maximum number of tolerations is 16.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
-	"capacity":        "Capacity define resource requirements against each capacity.\n\nIf this field is unset and the device supports multiple allocations, the default value will be applied to each capacity according to requestPolicy. For the capacity that has no requestPolicy, default is the full capacity value.\n\nApplies to each device allocation. If Count > 1, the request fails if there aren't enough devices that meet the requirements. If AllocationMode is set to All, the request fails if there are devices that otherwise match the request, and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.",
+	"":                  "ExactDeviceRequest is a request for one or more identical devices.",
+	"deviceClassName":   "DeviceClassName references a specific DeviceClass, which can define additional configuration and selectors to be inherited by this request.\n\nA DeviceClassName is required.\n\nAdministrators may use this to restrict which devices may get requested by only installing classes with selectors for permitted devices. If users are free to request anything without restrictions, then administrators can create an empty DeviceClass for users to reference.",
+	"selectors":         "Selectors define criteria which must be satisfied by a specific device in order for that device to be considered for this request. All selectors must be satisfied for a device to be considered.",
+	"allocationMode":    "AllocationMode and its related fields define how devices are allocated to satisfy this request. Supported values are:\n\n- ExactCount: This request is for a specific number of devices.\n  This is the default. The exact number is provided in the\n  count field.\n\n- All: This request is for all of the matching devices in a pool.\n  At least one device must exist on the node for the allocation to succeed.\n  Allocation will fail if some devices are already allocated,\n  unless adminAccess is requested.\n\nIf AllocationMode is not specified, the default mode is ExactCount. If the mode is ExactCount and count is not specified, the default count is one. Any other requests must specify this field.\n\nMore modes may get added in the future. Clients must refuse to handle requests with unknown modes.",
+	"count":             "Count is used only when the count mode is \"ExactCount\". Must be greater than zero. If AllocationMode is ExactCount and this field is not specified, the default is one.",
+	"adminAccess":       "AdminAccess indicates that this is a claim for administrative access to the device(s). Claims with AdminAccess are expected to be used for monitoring or other management services for a device.  They ignore all ordinary claims to the device with respect to access modes and any resource allocations.\n\nAdmin access is disabled if this field is unset or set to false, otherwise it is enabled.",
+	"tolerations":       "If specified, the request's tolerations.\n\nTolerations for NoSchedule are required to allocate a device which has a taint with that effect. The same applies to NoExecute.\n\nIn addition, should any of the allocated devices get tainted with NoExecute after allocation and that effect is not tolerated, then all pods consuming the ResourceClaim get deleted to evict them. The scheduler will not let new pods reserve the claim while it has these tainted devices. Once all pods are evicted, the claim will get deallocated.\n\nThe maximum number of tolerations is 16.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
+	"capacity":          "Capacity define resource requirements against each capacity.\n\nIf this field is unset and the device supports multiple allocations, the default value will be applied to each capacity according to requestPolicy. For the capacity that has no requestPolicy, default is the full capacity value.\n\nApplies to each device allocation. If Count > 1, the request fails if there aren't enough devices that meet the requirements. If AllocationMode is set to All, the request fails if there are devices that otherwise match the request, and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.",
+	"derivedAttributes": "DerivedAttributes defines a set of virtual attributes computed via CEL expressions for each candidate device. These virtual attributes can be referenced in `.devices.constraints` to align and match different devices (e.g., co-allocating a GPU and a NIC on the same NUMA node) even if their drivers publish different attributes. Derived attributes are not available via `device.attributes` in the CEL environment when evaluating selector expressions.\n\nDerived attributes allow you to extract, transform, or normalize topology information (such as extracting a NUMA index from a complex topology string or renaming a vendor-specific attribute) into a common virtual attribute name at scheduling time. The scheduler then evaluates these virtual attributes exactly like static attributes when matching constraints.\n\nEvery derived attribute defined in this list must be referenced by at least one MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.\n\nThe maximum number of derived attributes is 32.\n\nThis is an alpha field and requires enabling the DRADerivedAttributes feature gate.",
 }
 
 func (ExactDeviceRequest) SwaggerDoc() map[string]string {
@@ -372,14 +437,35 @@ func (NetworkDeviceData) SwaggerDoc() map[string]string {
 	return map_NetworkDeviceData
 }
 
-var map_NodeAllocatableResourceMapping = map[string]string{
-	"":                     "NodeAllocatableResourceMapping defines the translation between the DRA device/capacity units requested to the corresponding quantity of the node allocatable resource.",
-	"capacityKey":          "CapacityKey references a capacity name defined as a key in the `spec.devices[*].capacity` map. When this field is set, the value associated with this key in the `status.allocation.devices.results[*].consumedCapacity` map (for a specific claim allocation) determines the base quantity for the node allocatable resource. If `allocationMultiplier` is also set, it is multiplied with the base quantity. For example, if `spec.devices[*].capacity` has an entry \"dra.example.com/memory\": \"128Gi\", and this field is set to \"dra.example.com/memory\", then for a claim allocation that consumes { \"dra.example.com/memory\": \"4Gi\" } the base quantity for the node allocatable resource mapping will be \"4Gi\", and `allocationMultiplier` should be omitted or set to \"1\".",
-	"allocationMultiplier": "AllocationMultiplier is used as a multiplier for the allocated device count or the allocated capacity in the claim. It defaults to 1 if not specified. How the field is used also depends on whether `capacityKey` is set. 1.  If `capacityKey` is NOT set: `allocationMultiplier` multiplies the device count allocated to the claim.\n\t   a. A DRA driver representing each CPU core as a device would have\n       {ResourceName: \"cpu\", allocationMultiplier: \"2\"} in its\n       `nodeAllocatableResourceMappings`. If 4 devices are allocated to the claim,\n\t\t  4 * 2 CPUs would be considered as allocated and subtracted from the node's capacity.\n    b. A GPU device that needs additional node memory per GPU allocation would\n       have {ResourceName: \"memory\", allocationMultiplier: \"2Gi\"}.  Each allocated\n\t\t  GPU device instance of this type will account for 2Gi of memory.\n\n2.  If `capacityKey` IS set: `allocationMultiplier` is multiplied by the amount of that capacity consumed.\n\t   The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `allocationMultiplier`.\n    For example, if a Device's capacity \"dra.example.com/cores\" is consumed,\n    and each \"core\" provides 2 \"cpu\"s, the mapping would be:\n    {ResourceName: \"cpu\", capacityKey: \"dra.example.com/cores\", allocationMultiplier: \"2\"}.\n    If a claim consumes 8 \"dra.example.com/cores\", the CPU footprint is 8 * 2 = 16.",
+var map_NodeAllocatableMapping = map[string]string{
+	"":                   "NodeAllocatableMapping defines how a DRA allocation directly translates into a node allocatable resource quantity. The mapping can be derived from either the count of allocated devices (via deviceMultiplier) or the specific capacity consumed (via capacityKey and capacityMultiplier). These options are mutually exclusive. Kubelet adds this mapped resource quantity from claim to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.",
+	"capacityKey":        "CapacityKey references a capacity name defined as a key in the `spec.devices[*].capacity` map. When this field is set, the value associated with this key in the `status.allocation.devices.results[*].consumedCapacity` map (for a specific claim allocation) determines the base quantity for the node allocatable resource. `capacityMultiplier` must also be set and is multiplied with the base quantity. For example, if `spec.devices[*].capacity` has an entry \"dra.example.com/memory\": \"128Gi\", and this field is set to \"dra.example.com/memory\", then for a claim allocation that consumes { \"dra.example.com/memory\": \"4Gi\" } the base quantity for the node allocatable resource mapping will be \"4Gi\". The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.",
+	"capacityMultiplier": "CapacityMultiplier is used as a multiplier for the allocated capacity consumed. It is only valid if `capacityKey` is set. The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`. For example, if a Device's capacity \"dra.example.com/cores\" is consumed, and each \"core\" provides 2 \"cpu\"s, the mapping would be: {ResourceName: \"cpu\", capacityKey: \"dra.example.com/cores\", capacityMultiplier: \"2\"}. If a claim consumes 8 \"dra.example.com/cores\", the CPU footprint is 8 * 2 = 16.",
+	"deviceMultiplier":   "DeviceMultiplier is used as a multiplier for the allocated device count in the claim. The final node allocatable resource amount is `deviceCount` * `deviceMultiplier`. For example, a DRA driver representing each cache complex (CCX) as a device would have {ResourceName: \"cpu\", deviceMultiplier: \"8\"} in its `nodeAllocatableResources`. If 2 devices (CCX) are allocated to the claim, 2 * 8 = 16 CPUs would be considered as allocated. It is only valid when `capacityKey` and `capacityMultiplier` are not set.",
+}
+
+func (NodeAllocatableMapping) SwaggerDoc() map[string]string {
+	return map_NodeAllocatableMapping
+}
+
+var map_NodeAllocatableOverhead = map[string]string{
+	"":             "NodeAllocatableOverhead defines auxiliary resource overheads incurred when allocating a device. Overheads can be specified as a fixed cost per pod referencing the claim, a variable cost per container reference, or both. Kubelet accounts for this overhead by adding it to both the pod-level and container-level cgroups of referencing containers.",
+	"perPod":       "PerPod is overhead applied once per pod referencing the claim on this node. This is a flat overhead incurred for every pod referencing the claim.",
+	"perContainer": "PerContainer is applied per container reference to the claim. This models overhead scaling linearly with the number of containers actively using the device. When both PerPod and PerContainer are specified, the total overhead allocated for each pod referencing the claim is computed as: Quantity = PerPod + (PerContainer * NumReferences) Kubelet accounts for this overhead in cgroups: - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences). - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container. This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once.",
+}
+
+func (NodeAllocatableOverhead) SwaggerDoc() map[string]string {
+	return map_NodeAllocatableOverhead
+}
+
+var map_NodeAllocatableResource = map[string]string{
+	"":         "NodeAllocatableResource defines the translation between the DRA device/capacity units requested to the corresponding quantity of the node allocatable resource. At least one of Mapping or Overhead must be specified. Not specifying either is an invalid configuration.",
+	"mapping":  "Mapping is used when the device directly models a node allocatable resource like standard CPU or memory (e.g., with a CPU DRA driver). The calculated quantity is accounted for exactly once per claim instance on the node. To prevent node cgroup isolation friction, the scheduler explicitly blocks sharing mapped device claims across multiple pods.",
+	"overhead": "Overhead contains fields for modeling auxiliary overhead incurred on node allocatable resources when allocating devices that are not themselves modeling a node allocatable resource (e.g., host memory overhead for GPUs). Sharing overhead-mapped claims across multiple pods is allowed. The node allocatable overhead is accounted for individually for each pod referencing the claim. Overhead is always subtracted from the node's allocatable capacity for the resource, even when mapping is specified for the same resource. Eg: If a device models memory capacity per socket as a consumable capacity pool via Mapping (with CapacityKey), any overhead specified for the same resource will be subtracted from the node's general allocatable capacity and not from the per-socket capacity pool in Mapping.",
 }
 
-func (NodeAllocatableResourceMapping) SwaggerDoc() map[string]string {
-	return map_NodeAllocatableResourceMapping
+func (NodeAllocatableResource) SwaggerDoc() map[string]string {
+	return map_NodeAllocatableResource
 }
 
 var map_OpaqueDeviceConfiguration = map[string]string{
@@ -477,7 +563,7 @@ func (ResourceClaimTemplateSpec) SwaggerDoc() map[string]string {
 
 var map_ResourcePool = map[string]string{
 	"":                   "ResourcePool describes the pool that ResourceSlices belong to.",
-	"name":               "Name is used to identify the pool. For node-local devices, this is often the node name, but this is not required.\n\nIt must not be longer than 253 characters and must consist of one or more DNS sub-domains separated by slashes. This field is immutable.",
+	"name":               "Name is used to identify the pool. For node-local devices, this is often the node name, but this is not required. A field selector can be used to list only ResourceSlice objects belonging to a certain pool.\n\nIt must not be longer than 253 characters and must consist of one or more DNS sub-domains separated by slashes. This field is immutable.",
 	"generation":         "Generation tracks the change in a pool over time. Whenever a driver changes something about one or more of the resources in a pool, it must change the generation in all ResourceSlices which are part of that pool. Consumers of ResourceSlices should only consider resources from the pool with the highest generation number. The generation may be reset by drivers, which should be fine for consumers, assuming that all ResourceSlices in a pool are updated to match or deleted.\n\nCombined with ResourceSliceCount, this mechanism enables consumers to detect pools which are comprised of multiple ResourceSlices and are in an incomplete state.",
 	"resourceSliceCount": "ResourceSliceCount is the total number of ResourceSlices in the pool at this generation number. Must be greater than zero.\n\nConsumers can use this to check whether they have seen all ResourceSlices belonging to the same pool.",
 }
@@ -516,6 +602,8 @@ var map_ResourceSliceSpec = map[string]string{
 	"devices":                "Devices lists some or all of the devices in this pool.\n\nMust not have more than 128 entries. If any device uses taints or consumes counters the limit is 64.\n\nOnly one of Devices and SharedCounters can be set in a ResourceSlice.",
 	"perDeviceNodeSelection": "PerDeviceNodeSelection defines whether the access from nodes to resources in the pool is set on the ResourceSlice level or on each device. If it is set to true, every device defined the ResourceSlice must specify this individually.\n\nExactly one of NodeName, NodeSelector, AllNodes, and PerDeviceNodeSelection must be set.",
 	"sharedCounters":         "SharedCounters defines a list of counter sets, each of which has a name and a list of counters available.\n\nThe names of the counter sets must be unique in the ResourcePool.\n\nOnly one of Devices and SharedCounters can be set in a ResourceSlice.\n\nThe maximum number of counter sets is 8.",
+	"partitionTypeAttribute": "PartitionTypeAttribute names a string device attribute (by fully qualified name, e.g. \"gpu.example.com/profile\") whose value labels each device with its partition type, such as \"Full\" or \"Half\" for a MIG-style GPU.\n\nWhen set, every partitionable device in the slice must carry the attribute and devices sharing a value must share the same ConsumesCounters cost.",
+	"skipNodeOperations":     "SkipNodeOperations lists node-local resource operations (gRPC calls) that will be skipped for the devices in this slice when determining whether operations are necessary on the node. If all allocated devices for a driver in a claim skip an operation, that gRPC call will be skipped. Valid values are:\n\n- \"NodePrepareResources\": NodePrepareResources gRPC calls are skipped. This\n  value cannot be specified unless \"NodeUnprepareResources\" is also listed\n  (or \"*\" is specified).\n- \"NodeUnprepareResources\": NodeUnprepareResources gRPC calls are skipped. - \"*\": All node-local resource operations are skipped.\n\nOther values may be added in the future. The kubelet must ignore unknown values.",
 }
 
 func (ResourceSliceSpec) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/resource/v1/zz_generated.deepcopy.go b/vendor/k8s.io/api/resource/v1/zz_generated.deepcopy.go
index 0c488a05ae..9231934844 100644
--- a/vendor/k8s.io/api/resource/v1/zz_generated.deepcopy.go
+++ b/vendor/k8s.io/api/resource/v1/zz_generated.deepcopy.go
@@ -302,9 +302,9 @@ func (in *Device) DeepCopyInto(out *Device) {
 		*out = new(bool)
 		**out = **in
 	}
-	if in.NodeAllocatableResourceMappings != nil {
-		in, out := &in.NodeAllocatableResourceMappings, &out.NodeAllocatableResourceMappings
-		*out = make(map[corev1.ResourceName]NodeAllocatableResourceMapping, len(*in))
+	if in.NodeAllocatableResources != nil {
+		in, out := &in.NodeAllocatableResources, &out.NodeAllocatableResources
+		*out = make(map[corev1.ResourceName]NodeAllocatableResource, len(*in))
 		for key, val := range *in {
 			(*out)[key] = *val.DeepCopy()
 		}
@@ -685,6 +685,11 @@ func (in *DeviceCounterConsumption) DeepCopyInto(out *DeviceCounterConsumption)
 			(*out)[key] = *val.DeepCopy()
 		}
 	}
+	if in.CompatibilityGroups != nil {
+		in, out := &in.CompatibilityGroups, &out.CompatibilityGroups
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
@@ -698,6 +703,22 @@ func (in *DeviceCounterConsumption) DeepCopy() *DeviceCounterConsumption {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DeviceDerivedAttribute) DeepCopyInto(out *DeviceDerivedAttribute) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeviceDerivedAttribute.
+func (in *DeviceDerivedAttribute) DeepCopy() *DeviceDerivedAttribute {
+	if in == nil {
+		return nil
+	}
+	out := new(DeviceDerivedAttribute)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *DeviceRequest) DeepCopyInto(out *DeviceRequest) {
 	*out = *in
@@ -763,6 +784,11 @@ func (in *DeviceRequestAllocationResult) DeepCopyInto(out *DeviceRequestAllocati
 			(*out)[key] = val.DeepCopy()
 		}
 	}
+	if in.SkipNodeOperations != nil {
+		in, out := &in.SkipNodeOperations, &out.SkipNodeOperations
+		*out = make([]SkipNodeOperation, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
@@ -819,6 +845,11 @@ func (in *DeviceSubRequest) DeepCopyInto(out *DeviceSubRequest) {
 		*out = new(CapacityRequirements)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.DerivedAttributes != nil {
+		in, out := &in.DerivedAttributes, &out.DerivedAttributes
+		*out = make([]DeviceDerivedAttribute, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
@@ -852,6 +883,143 @@ func (in *DeviceTaint) DeepCopy() *DeviceTaint {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DeviceTaintRule) DeepCopyInto(out *DeviceTaintRule) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeviceTaintRule.
+func (in *DeviceTaintRule) DeepCopy() *DeviceTaintRule {
+	if in == nil {
+		return nil
+	}
+	out := new(DeviceTaintRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *DeviceTaintRule) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DeviceTaintRuleList) DeepCopyInto(out *DeviceTaintRuleList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]DeviceTaintRule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeviceTaintRuleList.
+func (in *DeviceTaintRuleList) DeepCopy() *DeviceTaintRuleList {
+	if in == nil {
+		return nil
+	}
+	out := new(DeviceTaintRuleList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *DeviceTaintRuleList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DeviceTaintRuleSpec) DeepCopyInto(out *DeviceTaintRuleSpec) {
+	*out = *in
+	if in.DeviceSelector != nil {
+		in, out := &in.DeviceSelector, &out.DeviceSelector
+		*out = new(DeviceTaintSelector)
+		(*in).DeepCopyInto(*out)
+	}
+	in.Taint.DeepCopyInto(&out.Taint)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeviceTaintRuleSpec.
+func (in *DeviceTaintRuleSpec) DeepCopy() *DeviceTaintRuleSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(DeviceTaintRuleSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DeviceTaintRuleStatus) DeepCopyInto(out *DeviceTaintRuleStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]metav1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeviceTaintRuleStatus.
+func (in *DeviceTaintRuleStatus) DeepCopy() *DeviceTaintRuleStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(DeviceTaintRuleStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DeviceTaintSelector) DeepCopyInto(out *DeviceTaintSelector) {
+	*out = *in
+	if in.Driver != nil {
+		in, out := &in.Driver, &out.Driver
+		*out = new(string)
+		**out = **in
+	}
+	if in.Pool != nil {
+		in, out := &in.Pool, &out.Pool
+		*out = new(string)
+		**out = **in
+	}
+	if in.Device != nil {
+		in, out := &in.Device, &out.Device
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeviceTaintSelector.
+func (in *DeviceTaintSelector) DeepCopy() *DeviceTaintSelector {
+	if in == nil {
+		return nil
+	}
+	out := new(DeviceTaintSelector)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *DeviceToleration) DeepCopyInto(out *DeviceToleration) {
 	*out = *in
@@ -900,6 +1068,11 @@ func (in *ExactDeviceRequest) DeepCopyInto(out *ExactDeviceRequest) {
 		*out = new(CapacityRequirements)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.DerivedAttributes != nil {
+		in, out := &in.DerivedAttributes, &out.DerivedAttributes
+		*out = make([]DeviceDerivedAttribute, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
@@ -935,27 +1108,84 @@ func (in *NetworkDeviceData) DeepCopy() *NetworkDeviceData {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *NodeAllocatableResourceMapping) DeepCopyInto(out *NodeAllocatableResourceMapping) {
+func (in *NodeAllocatableMapping) DeepCopyInto(out *NodeAllocatableMapping) {
 	*out = *in
 	if in.CapacityKey != nil {
 		in, out := &in.CapacityKey, &out.CapacityKey
 		*out = new(QualifiedName)
 		**out = **in
 	}
-	if in.AllocationMultiplier != nil {
-		in, out := &in.AllocationMultiplier, &out.AllocationMultiplier
+	if in.CapacityMultiplier != nil {
+		in, out := &in.CapacityMultiplier, &out.CapacityMultiplier
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	if in.DeviceMultiplier != nil {
+		in, out := &in.DeviceMultiplier, &out.DeviceMultiplier
 		x := (*in).DeepCopy()
 		*out = &x
 	}
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeAllocatableResourceMapping.
-func (in *NodeAllocatableResourceMapping) DeepCopy() *NodeAllocatableResourceMapping {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeAllocatableMapping.
+func (in *NodeAllocatableMapping) DeepCopy() *NodeAllocatableMapping {
 	if in == nil {
 		return nil
 	}
-	out := new(NodeAllocatableResourceMapping)
+	out := new(NodeAllocatableMapping)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NodeAllocatableOverhead) DeepCopyInto(out *NodeAllocatableOverhead) {
+	*out = *in
+	if in.PerPod != nil {
+		in, out := &in.PerPod, &out.PerPod
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	if in.PerContainer != nil {
+		in, out := &in.PerContainer, &out.PerContainer
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeAllocatableOverhead.
+func (in *NodeAllocatableOverhead) DeepCopy() *NodeAllocatableOverhead {
+	if in == nil {
+		return nil
+	}
+	out := new(NodeAllocatableOverhead)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NodeAllocatableResource) DeepCopyInto(out *NodeAllocatableResource) {
+	*out = *in
+	if in.Mapping != nil {
+		in, out := &in.Mapping, &out.Mapping
+		*out = new(NodeAllocatableMapping)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Overhead != nil {
+		in, out := &in.Overhead, &out.Overhead
+		*out = new(NodeAllocatableOverhead)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeAllocatableResource.
+func (in *NodeAllocatableResource) DeepCopy() *NodeAllocatableResource {
+	if in == nil {
+		return nil
+	}
+	out := new(NodeAllocatableResource)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -1296,6 +1526,16 @@ func (in *ResourceSliceSpec) DeepCopyInto(out *ResourceSliceSpec) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.PartitionTypeAttribute != nil {
+		in, out := &in.PartitionTypeAttribute, &out.PartitionTypeAttribute
+		*out = new(FullyQualifiedName)
+		**out = **in
+	}
+	if in.SkipNodeOperations != nil {
+		in, out := &in.SkipNodeOperations, &out.SkipNodeOperations
+		*out = make([]SkipNodeOperation, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
diff --git a/vendor/k8s.io/api/resource/v1/zz_generated.model_name.go b/vendor/k8s.io/api/resource/v1/zz_generated.model_name.go
index f163c61ed1..aa13541c20 100644
--- a/vendor/k8s.io/api/resource/v1/zz_generated.model_name.go
+++ b/vendor/k8s.io/api/resource/v1/zz_generated.model_name.go
@@ -131,6 +131,11 @@ func (in DeviceCounterConsumption) OpenAPIModelName() string {
 	return "io.k8s.api.resource.v1.DeviceCounterConsumption"
 }
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeviceDerivedAttribute) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1.DeviceDerivedAttribute"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in DeviceRequest) OpenAPIModelName() string {
 	return "io.k8s.api.resource.v1.DeviceRequest"
@@ -156,6 +161,31 @@ func (in DeviceTaint) OpenAPIModelName() string {
 	return "io.k8s.api.resource.v1.DeviceTaint"
 }
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeviceTaintRule) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1.DeviceTaintRule"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeviceTaintRuleList) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1.DeviceTaintRuleList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeviceTaintRuleSpec) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1.DeviceTaintRuleSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeviceTaintRuleStatus) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1.DeviceTaintRuleStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeviceTaintSelector) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1.DeviceTaintSelector"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in DeviceToleration) OpenAPIModelName() string {
 	return "io.k8s.api.resource.v1.DeviceToleration"
@@ -172,8 +202,18 @@ func (in NetworkDeviceData) OpenAPIModelName() string {
 }
 
 // OpenAPIModelName returns the OpenAPI model name for this type.
-func (in NodeAllocatableResourceMapping) OpenAPIModelName() string {
-	return "io.k8s.api.resource.v1.NodeAllocatableResourceMapping"
+func (in NodeAllocatableMapping) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1.NodeAllocatableMapping"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NodeAllocatableOverhead) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1.NodeAllocatableOverhead"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NodeAllocatableResource) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1.NodeAllocatableResource"
 }
 
 // OpenAPIModelName returns the OpenAPI model name for this type.
diff --git a/vendor/k8s.io/api/resource/v1/zz_generated.prerelease-lifecycle.go b/vendor/k8s.io/api/resource/v1/zz_generated.prerelease-lifecycle.go
index dbf5b3ccde..4c36f2715c 100644
--- a/vendor/k8s.io/api/resource/v1/zz_generated.prerelease-lifecycle.go
+++ b/vendor/k8s.io/api/resource/v1/zz_generated.prerelease-lifecycle.go
@@ -33,6 +33,18 @@ func (in *DeviceClassList) APILifecycleIntroduced() (major, minor int) {
 	return 1, 34
 }
 
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *DeviceTaintRule) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *DeviceTaintRuleList) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
+
 // APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
 // It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
 func (in *ResourceClaim) APILifecycleIntroduced() (major, minor int) {
diff --git a/vendor/k8s.io/api/resource/v1/zz_generated.validations.go b/vendor/k8s.io/api/resource/v1/zz_generated.validations.go
new file mode 100644
index 0000000000..b771d5b92a
--- /dev/null
+++ b/vendor/k8s.io/api/resource/v1/zz_generated.validations.go
@@ -0,0 +1,3348 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	corev1 "k8s.io/api/core/v1"
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	resource "k8s.io/apimachinery/pkg/api/resource"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	validation "k8s.io/apimachinery/pkg/apis/meta/v1/validation"
+	types "k8s.io/apimachinery/pkg/types"
+	sets "k8s.io/apimachinery/pkg/util/sets"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Validate_AllocatedDeviceStatus validates an instance of AllocatedDeviceStatus according
+// to declarative validation rules in the API schema.
+func Validate_AllocatedDeviceStatus(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *AllocatedDeviceStatus) (errs field.ErrorList) {
+
+	// field AllocatedDeviceStatus.Driver has no validation
+	// field AllocatedDeviceStatus.Pool has no validation
+	// field AllocatedDeviceStatus.Device has no validation
+
+	{ // field AllocatedDeviceStatus.ShareID
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.UUID(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllocatedDeviceStatus) *string {
+				return oldObj.ShareID
+			})
+		errs = append(errs, fn(fldPath.Child("shareID"), obj.ShareID, oldVal, oldObj != nil)...)
+	}
+
+	{ // field AllocatedDeviceStatus.Conditions
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []metav1.Condition,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllocatedDeviceStatus) []metav1.Condition {
+				return oldObj.Conditions
+			})
+		errs = append(errs, fn(fldPath.Child("conditions"), obj.Conditions, oldVal, oldObj != nil)...)
+	}
+
+	// field AllocatedDeviceStatus.Data has no validation
+
+	{ // field AllocatedDeviceStatus.NetworkData
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *NetworkDeviceData,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_NetworkDeviceData(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllocatedDeviceStatus) *NetworkDeviceData {
+				return oldObj.NetworkData
+			})
+		errs = append(errs, fn(fldPath.Child("networkData"), obj.NetworkData, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var symbolsForAllocationConfigSource = sets.New(AllocationConfigSourceClaim, AllocationConfigSourceClass)
+
+// Validate_AllocationConfigSource validates an instance of AllocationConfigSource according
+// to declarative validation rules in the API schema.
+func Validate_AllocationConfigSource(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *AllocationConfigSource) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForAllocationConfigSource, nil).MarkBeta(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_AllocationResult validates an instance of AllocationResult according
+// to declarative validation rules in the API schema.
+func Validate_AllocationResult(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *AllocationResult) (errs field.ErrorList) {
+
+	{ // field AllocationResult.Devices
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DeviceAllocationResult,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DeviceAllocationResult(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *AllocationResult) *DeviceAllocationResult {
+				return &oldObj.Devices
+			})
+		errs = append(errs, fn(fldPath.Child("devices"), &obj.Devices, oldVal, oldObj != nil)...)
+	}
+
+	// field AllocationResult.NodeSelector has no validation
+	// field AllocationResult.AllocationTimestamp has no validation
+	return errs
+}
+
+// Validate_CounterSet validates an instance of CounterSet according
+// to declarative validation rules in the API schema.
+func Validate_CounterSet(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *CounterSet) (errs field.ErrorList) {
+
+	{ // field CounterSet.Name
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ShortName(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CounterSet) *string {
+				return &oldObj.Name
+			})
+		errs = append(errs, fn(fldPath.Child("name"), &obj.Name, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CounterSet.Counters
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]Counter,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredMap(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj, validate.ShortName).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CounterSet) map[string]Counter {
+				return oldObj.Counters
+			})
+		errs = append(errs, fn(fldPath.Child("counters"), obj.Counters, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_Device validates an instance of Device according
+// to declarative validation rules in the API schema.
+func Validate_Device(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Device) (errs field.ErrorList) {
+
+	// field Device.Name has no validation
+
+	{ // field Device.Attributes
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[QualifiedName]DeviceAttribute,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalMap(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_DeviceAttribute); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Device) map[QualifiedName]DeviceAttribute {
+				return oldObj.Attributes
+			})
+		errs = append(errs, fn(fldPath.Child("attributes"), obj.Attributes, oldVal, oldObj != nil)...)
+	}
+
+	// field Device.Capacity has no validation
+
+	{ // field Device.ConsumesCounters
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceCounterConsumption,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 2).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *DeviceCounterConsumption, b *DeviceCounterConsumption) bool {
+					return a.CounterSet == b.CounterSet
+				}).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *DeviceCounterConsumption, b *DeviceCounterConsumption) bool {
+					return a.CounterSet == b.CounterSet
+				}, validate.SemanticDeepEqual, Validate_DeviceCounterConsumption); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Device) []DeviceCounterConsumption {
+				return oldObj.ConsumesCounters
+			})
+		errs = append(errs, fn(fldPath.Child("consumesCounters"), obj.ConsumesCounters, oldVal, oldObj != nil)...)
+	}
+
+	// field Device.NodeName has no validation
+	// field Device.NodeSelector has no validation
+	// field Device.AllNodes has no validation
+
+	{ // field Device.Taints
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceTaint,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_DeviceTaint); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Device) []DeviceTaint {
+				return oldObj.Taints
+			})
+		errs = append(errs, fn(fldPath.Child("taints"), obj.Taints, oldVal, oldObj != nil)...)
+	}
+
+	// field Device.BindsToNode has no validation
+
+	{ // field Device.BindingConditions
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 4).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Device) []string {
+				return oldObj.BindingConditions
+			})
+		errs = append(errs, fn(fldPath.Child("bindingConditions"), obj.BindingConditions, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Device.BindingFailureConditions
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 4).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Device) []string {
+				return oldObj.BindingFailureConditions
+			})
+		errs = append(errs, fn(fldPath.Child("bindingFailureConditions"), obj.BindingFailureConditions, oldVal, oldObj != nil)...)
+	}
+
+	// field Device.AllowMultipleAllocations has no validation
+
+	{ // field Device.NodeAllocatableResources
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[corev1.ResourceName]NodeAllocatableResource,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalMap(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the map and call the value type's validation function
+			if e := validate.EachMapVal(ctx, op, fldPath, obj, oldObj, validate.SemanticDeepEqual, Validate_NodeAllocatableResource); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Device) map[corev1.ResourceName]NodeAllocatableResource {
+				return oldObj.NodeAllocatableResources
+			})
+		errs = append(errs, fn(fldPath.Child("nodeAllocatableResources"), obj.NodeAllocatableResources, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceAllocationConfiguration validates an instance of DeviceAllocationConfiguration according
+// to declarative validation rules in the API schema.
+func Validate_DeviceAllocationConfiguration(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceAllocationConfiguration) (errs field.ErrorList) {
+
+	{ // field DeviceAllocationConfiguration.Source
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *AllocationConfigSource,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_AllocationConfigSource(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceAllocationConfiguration) *AllocationConfigSource {
+				return &oldObj.Source
+			})
+		errs = append(errs, fn(fldPath.Child("source"), &obj.Source, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceAllocationConfiguration.Requests
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 32).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceAllocationConfiguration) []string {
+				return oldObj.Requests
+			})
+		errs = append(errs, fn(fldPath.Child("requests"), obj.Requests, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceAllocationConfiguration.DeviceConfiguration
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DeviceConfiguration,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DeviceConfiguration(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceAllocationConfiguration) *DeviceConfiguration {
+				return &oldObj.DeviceConfiguration
+			})
+		errs = append(errs, fn(safe.Value(fldPath, func() *field.Path { return fldPath.Child("DeviceConfiguration") }), &obj.DeviceConfiguration, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var symbolsForDeviceAllocationMode = sets.New(DeviceAllocationModeAll, DeviceAllocationModeExactCount)
+
+// Validate_DeviceAllocationMode validates an instance of DeviceAllocationMode according
+// to declarative validation rules in the API schema.
+func Validate_DeviceAllocationMode(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceAllocationMode) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForDeviceAllocationMode, nil).MarkBeta(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceAllocationResult validates an instance of DeviceAllocationResult according
+// to declarative validation rules in the API schema.
+func Validate_DeviceAllocationResult(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceAllocationResult) (errs field.ErrorList) {
+
+	{ // field DeviceAllocationResult.Results
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceRequestAllocationResult,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 32).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_DeviceRequestAllocationResult); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceAllocationResult) []DeviceRequestAllocationResult {
+				return oldObj.Results
+			})
+		errs = append(errs, fn(fldPath.Child("results"), obj.Results, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceAllocationResult.Config
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceAllocationConfiguration,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 64).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_DeviceAllocationConfiguration); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceAllocationResult) []DeviceAllocationConfiguration {
+				return oldObj.Config
+			})
+		errs = append(errs, fn(fldPath.Child("config"), obj.Config, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_api_resource_v1_DeviceAttribute_ = validate.NewUnionMembership(validate.NewUnionMember("int"), validate.NewUnionMember("bool"), validate.NewUnionMember("string"), validate.NewUnionMember("version"), validate.NewUnionMember("ints"), validate.NewUnionMember("bools"), validate.NewUnionMember("strings"), validate.NewUnionMember("versions"))
+
+// Validate_DeviceAttribute validates an instance of DeviceAttribute according
+// to declarative validation rules in the API schema.
+func Validate_DeviceAttribute(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceAttribute) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_api_resource_v1_DeviceAttribute_,
+		func(obj *DeviceAttribute) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.IntValue != nil
+		},
+		func(obj *DeviceAttribute) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.BoolValue != nil
+		},
+		func(obj *DeviceAttribute) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.StringValue != nil
+		},
+		func(obj *DeviceAttribute) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.VersionValue != nil
+		},
+		func(obj *DeviceAttribute) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.IntValues) != 0
+		},
+		func(obj *DeviceAttribute) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.BoolValues) != 0
+		},
+		func(obj *DeviceAttribute) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.StringValues) != 0
+		},
+		func(obj *DeviceAttribute) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.VersionValues) != 0
+		}).MarkBeta(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field DeviceAttribute.IntValue
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceAttribute) *int64 {
+				return oldObj.IntValue
+			})
+		errs = append(errs, fn(fldPath.Child("int"), obj.IntValue, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceAttribute.BoolValue
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceAttribute) *bool {
+				return oldObj.BoolValue
+			})
+		errs = append(errs, fn(fldPath.Child("bool"), obj.BoolValue, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceAttribute.StringValue
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceAttribute) *string {
+				return oldObj.StringValue
+			})
+		errs = append(errs, fn(fldPath.Child("string"), obj.StringValue, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceAttribute.VersionValue
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceAttribute) *string {
+				return oldObj.VersionValue
+			})
+		errs = append(errs, fn(fldPath.Child("version"), obj.VersionValue, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceAttribute.IntValues
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceAttribute) []int64 {
+				return oldObj.IntValues
+			})
+		errs = append(errs, fn(fldPath.Child("ints"), obj.IntValues, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceAttribute.BoolValues
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []bool,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceAttribute) []bool {
+				return oldObj.BoolValues
+			})
+		errs = append(errs, fn(fldPath.Child("bools"), obj.BoolValues, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceAttribute.StringValues
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil,
+				func(ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *string) field.ErrorList {
+					return validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 64)
+				}).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceAttribute) []string {
+				return oldObj.StringValues
+			})
+		errs = append(errs, fn(fldPath.Child("strings"), obj.StringValues, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceAttribute.VersionValues
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceAttribute) []string {
+				return oldObj.VersionValues
+			})
+		errs = append(errs, fn(fldPath.Child("versions"), obj.VersionValues, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceClaim validates an instance of DeviceClaim according
+// to declarative validation rules in the API schema.
+func Validate_DeviceClaim(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceClaim) (errs field.ErrorList) {
+
+	{ // field DeviceClaim.Requests
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceRequest,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 32).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *DeviceRequest, b *DeviceRequest) bool { return a.Name == b.Name }).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *DeviceRequest, b *DeviceRequest) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_DeviceRequest); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceClaim) []DeviceRequest {
+				return oldObj.Requests
+			})
+		errs = append(errs, fn(fldPath.Child("requests"), obj.Requests, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceClaim.Constraints
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceConstraint,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 32).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_DeviceConstraint); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceClaim) []DeviceConstraint {
+				return oldObj.Constraints
+			})
+		errs = append(errs, fn(fldPath.Child("constraints"), obj.Constraints, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceClaim.Config
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceClaimConfiguration,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 32).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_DeviceClaimConfiguration); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceClaim) []DeviceClaimConfiguration {
+				return oldObj.Config
+			})
+		errs = append(errs, fn(fldPath.Child("config"), obj.Config, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceClaimConfiguration validates an instance of DeviceClaimConfiguration according
+// to declarative validation rules in the API schema.
+func Validate_DeviceClaimConfiguration(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceClaimConfiguration) (errs field.ErrorList) {
+
+	{ // field DeviceClaimConfiguration.Requests
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 32).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceClaimConfiguration) []string {
+				return oldObj.Requests
+			})
+		errs = append(errs, fn(fldPath.Child("requests"), obj.Requests, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceClaimConfiguration.DeviceConfiguration
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DeviceConfiguration,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DeviceConfiguration(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceClaimConfiguration) *DeviceConfiguration {
+				return &oldObj.DeviceConfiguration
+			})
+		errs = append(errs, fn(safe.Value(fldPath, func() *field.Path { return fldPath.Child("DeviceConfiguration") }), &obj.DeviceConfiguration, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceClassConfiguration validates an instance of DeviceClassConfiguration according
+// to declarative validation rules in the API schema.
+func Validate_DeviceClassConfiguration(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceClassConfiguration) (errs field.ErrorList) {
+
+	{ // field DeviceClassConfiguration.DeviceConfiguration
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DeviceConfiguration,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DeviceConfiguration(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceClassConfiguration) *DeviceConfiguration {
+				return &oldObj.DeviceConfiguration
+			})
+		errs = append(errs, fn(safe.Value(fldPath, func() *field.Path { return fldPath.Child("DeviceConfiguration") }), &obj.DeviceConfiguration, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceClassSpec validates an instance of DeviceClassSpec according
+// to declarative validation rules in the API schema.
+func Validate_DeviceClassSpec(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceClassSpec) (errs field.ErrorList) {
+
+	{ // field DeviceClassSpec.Selectors
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceSelector,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 32).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceClassSpec) []DeviceSelector {
+				return oldObj.Selectors
+			})
+		errs = append(errs, fn(fldPath.Child("selectors"), obj.Selectors, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceClassSpec.Config
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceClassConfiguration,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 32).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_DeviceClassConfiguration); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceClassSpec) []DeviceClassConfiguration {
+				return oldObj.Config
+			})
+		errs = append(errs, fn(fldPath.Child("config"), obj.Config, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceClassSpec.ExtendedResourceName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ExtendedResourceName(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceClassSpec) *string {
+				return oldObj.ExtendedResourceName
+			})
+		errs = append(errs, fn(fldPath.Child("extendedResourceName"), obj.ExtendedResourceName, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceConfiguration validates an instance of DeviceConfiguration according
+// to declarative validation rules in the API schema.
+func Validate_DeviceConfiguration(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceConfiguration) (errs field.ErrorList) {
+
+	{ // field DeviceConfiguration.Opaque
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *OpaqueDeviceConfiguration,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_OpaqueDeviceConfiguration(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceConfiguration) *OpaqueDeviceConfiguration {
+				return oldObj.Opaque
+			})
+		errs = append(errs, fn(fldPath.Child("opaque"), obj.Opaque, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceConstraint validates an instance of DeviceConstraint according
+// to declarative validation rules in the API schema.
+func Validate_DeviceConstraint(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceConstraint) (errs field.ErrorList) {
+
+	{ // field DeviceConstraint.Requests
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 32).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceConstraint) []string {
+				return oldObj.Requests
+			})
+		errs = append(errs, fn(fldPath.Child("requests"), obj.Requests, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceConstraint.MatchAttribute
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *FullyQualifiedName,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ResourceFullyQualifiedName(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceConstraint) *FullyQualifiedName {
+				return oldObj.MatchAttribute
+			})
+		errs = append(errs, fn(fldPath.Child("matchAttribute"), obj.MatchAttribute, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceConstraint.DistinctAttribute
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *FullyQualifiedName,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ResourceFullyQualifiedName(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceConstraint) *FullyQualifiedName {
+				return oldObj.DistinctAttribute
+			})
+		errs = append(errs, fn(fldPath.Child("distinctAttribute"), obj.DistinctAttribute, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceCounterConsumption validates an instance of DeviceCounterConsumption according
+// to declarative validation rules in the API schema.
+func Validate_DeviceCounterConsumption(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceCounterConsumption) (errs field.ErrorList) {
+
+	{ // field DeviceCounterConsumption.CounterSet
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ShortName(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceCounterConsumption) *string {
+				return &oldObj.CounterSet
+			})
+		errs = append(errs, fn(fldPath.Child("counterSet"), &obj.CounterSet, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceCounterConsumption.Counters
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj map[string]Counter,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredMap(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.EachMapKey(ctx, op, fldPath, obj, oldObj, validate.ShortName).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceCounterConsumption) map[string]Counter {
+				return oldObj.Counters
+			})
+		errs = append(errs, fn(fldPath.Child("counters"), obj.Counters, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceCounterConsumption.CompatibilityGroups
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 2).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, nil, validate.ShortName); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceCounterConsumption) []string {
+				return oldObj.CompatibilityGroups
+			})
+		errs = append(errs, fn(fldPath.Child("compatibilityGroups"), obj.CompatibilityGroups, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceDerivedAttribute validates an instance of DeviceDerivedAttribute according
+// to declarative validation rules in the API schema.
+func Validate_DeviceDerivedAttribute(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceDerivedAttribute) (errs field.ErrorList) {
+
+	{ // field DeviceDerivedAttribute.Name
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *FullyQualifiedName,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ResourceFullyQualifiedName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceDerivedAttribute) *FullyQualifiedName {
+				return &oldObj.Name
+			})
+		errs = append(errs, fn(fldPath.Child("name"), &obj.Name, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceDerivedAttribute.Expression
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceDerivedAttribute) *string {
+				return &oldObj.Expression
+			})
+		errs = append(errs, fn(fldPath.Child("expression"), &obj.Expression, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceRequest validates an instance of DeviceRequest according
+// to declarative validation rules in the API schema.
+func Validate_DeviceRequest(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceRequest) (errs field.ErrorList) {
+
+	// field DeviceRequest.Name has no validation
+
+	{ // field DeviceRequest.Exactly
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ExactDeviceRequest,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ExactDeviceRequest(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceRequest) *ExactDeviceRequest {
+				return oldObj.Exactly
+			})
+		errs = append(errs, fn(fldPath.Child("exactly"), obj.Exactly, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceRequest.FirstAvailable
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceSubRequest,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 8).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *DeviceSubRequest, b *DeviceSubRequest) bool { return a.Name == b.Name }).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *DeviceSubRequest, b *DeviceSubRequest) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_DeviceSubRequest); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceRequest) []DeviceSubRequest {
+				return oldObj.FirstAvailable
+			})
+		errs = append(errs, fn(fldPath.Child("firstAvailable"), obj.FirstAvailable, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceRequestAllocationResult validates an instance of DeviceRequestAllocationResult according
+// to declarative validation rules in the API schema.
+func Validate_DeviceRequestAllocationResult(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceRequestAllocationResult) (errs field.ErrorList) {
+
+	// field DeviceRequestAllocationResult.Request has no validation
+
+	{ // field DeviceRequestAllocationResult.Driver
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongNameCaseless(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.MaxLength(ctx, op, fldPath, obj, oldObj, 63).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceRequestAllocationResult) *string {
+				return &oldObj.Driver
+			})
+		errs = append(errs, fn(fldPath.Child("driver"), &obj.Driver, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceRequestAllocationResult.Pool
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ResourcePoolName(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceRequestAllocationResult) *string {
+				return &oldObj.Pool
+			})
+		errs = append(errs, fn(fldPath.Child("pool"), &obj.Pool, oldVal, oldObj != nil)...)
+	}
+
+	// field DeviceRequestAllocationResult.Device has no validation
+	// field DeviceRequestAllocationResult.AdminAccess has no validation
+
+	{ // field DeviceRequestAllocationResult.Tolerations
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceToleration,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_DeviceToleration); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceRequestAllocationResult) []DeviceToleration {
+				return oldObj.Tolerations
+			})
+		errs = append(errs, fn(fldPath.Child("tolerations"), obj.Tolerations, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceRequestAllocationResult.BindingConditions
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 4).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceRequestAllocationResult) []string {
+				return oldObj.BindingConditions
+			})
+		errs = append(errs, fn(fldPath.Child("bindingConditions"), obj.BindingConditions, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceRequestAllocationResult.BindingFailureConditions
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 4).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceRequestAllocationResult) []string {
+				return oldObj.BindingFailureConditions
+			})
+		errs = append(errs, fn(fldPath.Child("bindingFailureConditions"), obj.BindingFailureConditions, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceRequestAllocationResult.ShareID
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *types.UID,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.UUID(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceRequestAllocationResult) *types.UID {
+				return oldObj.ShareID
+			})
+		errs = append(errs, fn(fldPath.Child("shareID"), obj.ShareID, oldVal, oldObj != nil)...)
+	}
+
+	// field DeviceRequestAllocationResult.ConsumedCapacity has no validation
+
+	{ // field DeviceRequestAllocationResult.SkipNodeOperations
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []SkipNodeOperation,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, nil, Validate_SkipNodeOperation); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceRequestAllocationResult) []SkipNodeOperation {
+				return oldObj.SkipNodeOperations
+			})
+		errs = append(errs, fn(fldPath.Child("skipNodeOperations"), obj.SkipNodeOperations, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceSubRequest validates an instance of DeviceSubRequest according
+// to declarative validation rules in the API schema.
+func Validate_DeviceSubRequest(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceSubRequest) (errs field.ErrorList) {
+
+	// field DeviceSubRequest.Name has no validation
+
+	{ // field DeviceSubRequest.DeviceClassName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceSubRequest) *string {
+				return &oldObj.DeviceClassName
+			})
+		errs = append(errs, fn(fldPath.Child("deviceClassName"), &obj.DeviceClassName, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceSubRequest.Selectors
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceSelector,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 32).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceSubRequest) []DeviceSelector {
+				return oldObj.Selectors
+			})
+		errs = append(errs, fn(fldPath.Child("selectors"), obj.Selectors, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceSubRequest.AllocationMode
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DeviceAllocationMode,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DeviceAllocationMode(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceSubRequest) *DeviceAllocationMode {
+				return &oldObj.AllocationMode
+			})
+		errs = append(errs, fn(fldPath.Child("allocationMode"), &obj.AllocationMode, oldVal, oldObj != nil)...)
+	}
+
+	// field DeviceSubRequest.Count has no validation
+
+	{ // field DeviceSubRequest.Tolerations
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceToleration,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_DeviceToleration); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceSubRequest) []DeviceToleration {
+				return oldObj.Tolerations
+			})
+		errs = append(errs, fn(fldPath.Child("tolerations"), obj.Tolerations, oldVal, oldObj != nil)...)
+	}
+
+	// field DeviceSubRequest.Capacity has no validation
+
+	{ // field DeviceSubRequest.DerivedAttributes
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceDerivedAttribute,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 32).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_DeviceDerivedAttribute); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceSubRequest) []DeviceDerivedAttribute {
+				return oldObj.DerivedAttributes
+			})
+		errs = append(errs, fn(fldPath.Child("derivedAttributes"), obj.DerivedAttributes, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceTaint validates an instance of DeviceTaint according
+// to declarative validation rules in the API schema.
+func Validate_DeviceTaint(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceTaint) (errs field.ErrorList) {
+
+	// field DeviceTaint.Key has no validation
+	// field DeviceTaint.Value has no validation
+
+	{ // field DeviceTaint.Effect
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DeviceTaintEffect,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DeviceTaintEffect(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceTaint) *DeviceTaintEffect {
+				return &oldObj.Effect
+			})
+		errs = append(errs, fn(fldPath.Child("effect"), &obj.Effect, oldVal, oldObj != nil)...)
+	}
+
+	// field DeviceTaint.TimeAdded has no validation
+	return errs
+}
+
+var symbolsForDeviceTaintEffect = sets.New(DeviceTaintEffectNoExecute, DeviceTaintEffectNoSchedule, DeviceTaintEffectNone)
+
+// Validate_DeviceTaintEffect validates an instance of DeviceTaintEffect according
+// to declarative validation rules in the API schema.
+func Validate_DeviceTaintEffect(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceTaintEffect) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForDeviceTaintEffect, nil).MarkBeta(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceTaintRuleSpec validates an instance of DeviceTaintRuleSpec according
+// to declarative validation rules in the API schema.
+func Validate_DeviceTaintRuleSpec(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceTaintRuleSpec) (errs field.ErrorList) {
+
+	// field DeviceTaintRuleSpec.DeviceSelector has no validation
+
+	{ // field DeviceTaintRuleSpec.Taint
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DeviceTaint,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DeviceTaint(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceTaintRuleSpec) *DeviceTaint {
+				return &oldObj.Taint
+			})
+		errs = append(errs, fn(fldPath.Child("taint"), &obj.Taint, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceTaintRuleStatus validates an instance of DeviceTaintRuleStatus according
+// to declarative validation rules in the API schema.
+func Validate_DeviceTaintRuleStatus(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceTaintRuleStatus) (errs field.ErrorList) {
+
+	{ // field DeviceTaintRuleStatus.Conditions
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []metav1.Condition,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *metav1.Condition, b *metav1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceTaintRuleStatus) []metav1.Condition {
+				return oldObj.Conditions
+			})
+		errs = append(errs, fn(fldPath.Child("conditions"), obj.Conditions, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_DeviceToleration validates an instance of DeviceToleration according
+// to declarative validation rules in the API schema.
+func Validate_DeviceToleration(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceToleration) (errs field.ErrorList) {
+
+	{ // field DeviceToleration.Key
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LabelKey(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceToleration) *string {
+				return &oldObj.Key
+			})
+		errs = append(errs, fn(fldPath.Child("key"), &obj.Key, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DeviceToleration.Operator
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DeviceTolerationOperator,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			// optional fields with default values are effectively required
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DeviceTolerationOperator(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceToleration) *DeviceTolerationOperator {
+				return &oldObj.Operator
+			})
+		errs = append(errs, fn(fldPath.Child("operator"), &obj.Operator, oldVal, oldObj != nil)...)
+	}
+
+	// field DeviceToleration.Value has no validation
+
+	{ // field DeviceToleration.Effect
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DeviceTaintEffect,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DeviceTaintEffect(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DeviceToleration) *DeviceTaintEffect {
+				return &oldObj.Effect
+			})
+		errs = append(errs, fn(fldPath.Child("effect"), &obj.Effect, oldVal, oldObj != nil)...)
+	}
+
+	// field DeviceToleration.TolerationSeconds has no validation
+	return errs
+}
+
+var symbolsForDeviceTolerationOperator = sets.New(DeviceTolerationOpEqual, DeviceTolerationOpExists)
+
+// Validate_DeviceTolerationOperator validates an instance of DeviceTolerationOperator according
+// to declarative validation rules in the API schema.
+func Validate_DeviceTolerationOperator(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DeviceTolerationOperator) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForDeviceTolerationOperator, nil).MarkBeta(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ExactDeviceRequest validates an instance of ExactDeviceRequest according
+// to declarative validation rules in the API schema.
+func Validate_ExactDeviceRequest(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ExactDeviceRequest) (errs field.ErrorList) {
+
+	// field ExactDeviceRequest.DeviceClassName has no validation
+
+	{ // field ExactDeviceRequest.Selectors
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceSelector,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 32).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ExactDeviceRequest) []DeviceSelector {
+				return oldObj.Selectors
+			})
+		errs = append(errs, fn(fldPath.Child("selectors"), obj.Selectors, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ExactDeviceRequest.AllocationMode
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DeviceAllocationMode,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DeviceAllocationMode(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ExactDeviceRequest) *DeviceAllocationMode {
+				return &oldObj.AllocationMode
+			})
+		errs = append(errs, fn(fldPath.Child("allocationMode"), &obj.AllocationMode, oldVal, oldObj != nil)...)
+	}
+
+	// field ExactDeviceRequest.Count has no validation
+	// field ExactDeviceRequest.AdminAccess has no validation
+
+	{ // field ExactDeviceRequest.Tolerations
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceToleration,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_DeviceToleration); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ExactDeviceRequest) []DeviceToleration {
+				return oldObj.Tolerations
+			})
+		errs = append(errs, fn(fldPath.Child("tolerations"), obj.Tolerations, oldVal, oldObj != nil)...)
+	}
+
+	// field ExactDeviceRequest.Capacity has no validation
+
+	{ // field ExactDeviceRequest.DerivedAttributes
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []DeviceDerivedAttribute,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 32).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_DeviceDerivedAttribute); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ExactDeviceRequest) []DeviceDerivedAttribute {
+				return oldObj.DerivedAttributes
+			})
+		errs = append(errs, fn(fldPath.Child("derivedAttributes"), obj.DerivedAttributes, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_NetworkDeviceData validates an instance of NetworkDeviceData according
+// to declarative validation rules in the API schema.
+func Validate_NetworkDeviceData(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *NetworkDeviceData) (errs field.ErrorList) {
+
+	{ // field NetworkDeviceData.InterfaceName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 256).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NetworkDeviceData) *string {
+				return &oldObj.InterfaceName
+			})
+		errs = append(errs, fn(fldPath.Child("interfaceName"), &obj.InterfaceName, oldVal, oldObj != nil)...)
+	}
+
+	{ // field NetworkDeviceData.IPs
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 16).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NetworkDeviceData) []string {
+				return oldObj.IPs
+			})
+		errs = append(errs, fn(fldPath.Child("ips"), obj.IPs, oldVal, oldObj != nil)...)
+	}
+
+	{ // field NetworkDeviceData.HardwareAddress
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 128).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NetworkDeviceData) *string {
+				return &oldObj.HardwareAddress
+			})
+		errs = append(errs, fn(fldPath.Child("hardwareAddress"), &obj.HardwareAddress, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_api_resource_v1_NodeAllocatableMapping_ = validate.NewUnionMembership(validate.NewUnionMember("capacityKey"), validate.NewUnionMember("deviceMultiplier"))
+
+// Validate_NodeAllocatableMapping validates an instance of NodeAllocatableMapping according
+// to declarative validation rules in the API schema.
+func Validate_NodeAllocatableMapping(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *NodeAllocatableMapping) (errs field.ErrorList) {
+
+	if e := validate.DependentRequired(ctx, op, fldPath, obj, oldObj, "capacityKey",
+		func(obj *NodeAllocatableMapping) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.CapacityKey != nil
+		}, "capacityMultiplier",
+		func(obj *NodeAllocatableMapping) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.CapacityMultiplier != nil
+		}).MarkAlpha(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_api_resource_v1_NodeAllocatableMapping_,
+		func(obj *NodeAllocatableMapping) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.CapacityKey != nil
+		},
+		func(obj *NodeAllocatableMapping) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.DeviceMultiplier != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+	if e := validate.DependentRequired(ctx, op, fldPath, obj, oldObj, "capacityMultiplier",
+		func(obj *NodeAllocatableMapping) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.CapacityMultiplier != nil
+		}, "capacityKey",
+		func(obj *NodeAllocatableMapping) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.CapacityKey != nil
+		}).MarkAlpha(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field NodeAllocatableMapping.CapacityKey
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *QualifiedName,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NodeAllocatableMapping) *QualifiedName {
+				return oldObj.CapacityKey
+			})
+		errs = append(errs, fn(fldPath.Child("capacityKey"), obj.CapacityKey, oldVal, oldObj != nil)...)
+	}
+
+	{ // field NodeAllocatableMapping.CapacityMultiplier
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *resource.Quantity,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NodeAllocatableMapping) *resource.Quantity {
+				return oldObj.CapacityMultiplier
+			})
+		errs = append(errs, fn(fldPath.Child("capacityMultiplier"), obj.CapacityMultiplier, oldVal, oldObj != nil)...)
+	}
+
+	{ // field NodeAllocatableMapping.DeviceMultiplier
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *resource.Quantity,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NodeAllocatableMapping) *resource.Quantity {
+				return oldObj.DeviceMultiplier
+			})
+		errs = append(errs, fn(fldPath.Child("deviceMultiplier"), obj.DeviceMultiplier, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_NodeAllocatableOverhead validates an instance of NodeAllocatableOverhead according
+// to declarative validation rules in the API schema.
+func Validate_NodeAllocatableOverhead(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *NodeAllocatableOverhead) (errs field.ErrorList) {
+
+	{ // field NodeAllocatableOverhead.PerPod
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *resource.Quantity,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NodeAllocatableOverhead) *resource.Quantity {
+				return oldObj.PerPod
+			})
+		errs = append(errs, fn(fldPath.Child("perPod"), obj.PerPod, oldVal, oldObj != nil)...)
+	}
+
+	{ // field NodeAllocatableOverhead.PerContainer
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *resource.Quantity,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NodeAllocatableOverhead) *resource.Quantity {
+				return oldObj.PerContainer
+			})
+		errs = append(errs, fn(fldPath.Child("perContainer"), obj.PerContainer, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_NodeAllocatableResource validates an instance of NodeAllocatableResource according
+// to declarative validation rules in the API schema.
+func Validate_NodeAllocatableResource(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *NodeAllocatableResource) (errs field.ErrorList) {
+
+	{ // field NodeAllocatableResource.Mapping
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *NodeAllocatableMapping,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_NodeAllocatableMapping(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NodeAllocatableResource) *NodeAllocatableMapping {
+				return oldObj.Mapping
+			})
+		errs = append(errs, fn(fldPath.Child("mapping"), obj.Mapping, oldVal, oldObj != nil)...)
+	}
+
+	{ // field NodeAllocatableResource.Overhead
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *NodeAllocatableOverhead,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_NodeAllocatableOverhead(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *NodeAllocatableResource) *NodeAllocatableOverhead {
+				return oldObj.Overhead
+			})
+		errs = append(errs, fn(fldPath.Child("overhead"), obj.Overhead, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_OpaqueDeviceConfiguration validates an instance of OpaqueDeviceConfiguration according
+// to declarative validation rules in the API schema.
+func Validate_OpaqueDeviceConfiguration(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *OpaqueDeviceConfiguration) (errs field.ErrorList) {
+
+	{ // field OpaqueDeviceConfiguration.Driver
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongNameCaseless(ctx, op, fldPath, obj, oldObj).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			if e := validate.MaxLength(ctx, op, fldPath, obj, oldObj, 63).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *OpaqueDeviceConfiguration) *string {
+				return &oldObj.Driver
+			})
+		errs = append(errs, fn(fldPath.Child("driver"), &obj.Driver, oldVal, oldObj != nil)...)
+	}
+
+	// field OpaqueDeviceConfiguration.Parameters has no validation
+	return errs
+}
+
+// Validate_ResourceClaimSpec validates an instance of ResourceClaimSpec according
+// to declarative validation rules in the API schema.
+func Validate_ResourceClaimSpec(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ResourceClaimSpec) (errs field.ErrorList) {
+
+	{ // field ResourceClaimSpec.Devices
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DeviceClaim,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DeviceClaim(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ResourceClaimSpec) *DeviceClaim {
+				return &oldObj.Devices
+			})
+		errs = append(errs, fn(fldPath.Child("devices"), &obj.Devices, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ResourceClaimStatus validates an instance of ResourceClaimStatus according
+// to declarative validation rules in the API schema.
+func Validate_ResourceClaimStatus(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ResourceClaimStatus) (errs field.ErrorList) {
+
+	{ // field ResourceClaimStatus.Allocation
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *AllocationResult,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.UpdatePointer(ctx, op, fldPath, obj, oldObj, validate.NoModify).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_AllocationResult(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ResourceClaimStatus) *AllocationResult {
+				return oldObj.Allocation
+			})
+		errs = append(errs, fn(fldPath.Child("allocation"), obj.Allocation, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ResourceClaimStatus.ReservedFor
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []ResourceClaimConsumerReference,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 256).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *ResourceClaimConsumerReference, b *ResourceClaimConsumerReference) bool { return a.UID == b.UID }).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ResourceClaimStatus) []ResourceClaimConsumerReference {
+				return oldObj.ReservedFor
+			})
+		errs = append(errs, fn(fldPath.Child("reservedFor"), obj.ReservedFor, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ResourceClaimStatus.Devices
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []AllocatedDeviceStatus,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *AllocatedDeviceStatus, b *AllocatedDeviceStatus) bool {
+					return a.Driver == b.Driver && a.Device == b.Device && a.Pool == b.Pool && ((a.ShareID == nil && b.ShareID == nil) || (a.ShareID != nil && b.ShareID != nil && *a.ShareID == *b.ShareID))
+				}).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *AllocatedDeviceStatus, b *AllocatedDeviceStatus) bool {
+					return a.Driver == b.Driver && a.Device == b.Device && a.Pool == b.Pool && ((a.ShareID == nil && b.ShareID == nil) || (a.ShareID != nil && b.ShareID != nil && *a.ShareID == *b.ShareID))
+				}, validate.SemanticDeepEqual, Validate_AllocatedDeviceStatus); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ResourceClaimStatus) []AllocatedDeviceStatus {
+				return oldObj.Devices
+			})
+		errs = append(errs, fn(fldPath.Child("devices"), obj.Devices, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ResourceClaimTemplateSpec validates an instance of ResourceClaimTemplateSpec according
+// to declarative validation rules in the API schema.
+func Validate_ResourceClaimTemplateSpec(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ResourceClaimTemplateSpec) (errs field.ErrorList) {
+
+	// field ResourceClaimTemplateSpec.ObjectMeta has no validation
+
+	{ // field ResourceClaimTemplateSpec.Spec
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *ResourceClaimSpec,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ResourceClaimSpec(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ResourceClaimTemplateSpec) *ResourceClaimSpec {
+				return &oldObj.Spec
+			})
+		errs = append(errs, fn(fldPath.Child("spec"), &obj.Spec, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_ResourceSliceSpec validates an instance of ResourceSliceSpec according
+// to declarative validation rules in the API schema.
+func Validate_ResourceSliceSpec(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *ResourceSliceSpec) (errs field.ErrorList) {
+
+	// field ResourceSliceSpec.Driver has no validation
+	// field ResourceSliceSpec.Pool has no validation
+	// field ResourceSliceSpec.NodeName has no validation
+	// field ResourceSliceSpec.NodeSelector has no validation
+	// field ResourceSliceSpec.AllNodes has no validation
+
+	{ // field ResourceSliceSpec.Devices
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []Device,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_Device); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ResourceSliceSpec) []Device {
+				return oldObj.Devices
+			})
+		errs = append(errs, fn(fldPath.Child("devices"), obj.Devices, oldVal, oldObj != nil)...)
+	}
+
+	// field ResourceSliceSpec.PerDeviceNodeSelection has no validation
+
+	{ // field ResourceSliceSpec.SharedCounters
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []CounterSet,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 8).MarkBeta().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *CounterSet, b *CounterSet) bool { return a.Name == b.Name }).MarkBeta(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *CounterSet, b *CounterSet) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_CounterSet); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ResourceSliceSpec) []CounterSet {
+				return oldObj.SharedCounters
+			})
+		errs = append(errs, fn(fldPath.Child("sharedCounters"), obj.SharedCounters, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ResourceSliceSpec.PartitionTypeAttribute
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *FullyQualifiedName,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "DRAPartitionableDevicesType", false, validate.ForbiddenPointer).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "DRAPartitionableDevicesType", false, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "DRAPartitionableDevicesType", true, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "DRAPartitionableDevicesType", true, validate.ResourceFullyQualifiedName); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ResourceSliceSpec) *FullyQualifiedName {
+				return oldObj.PartitionTypeAttribute
+			})
+		errs = append(errs, fn(fldPath.Child("partitionTypeAttribute"), obj.PartitionTypeAttribute, oldVal, oldObj != nil)...)
+	}
+
+	{ // field ResourceSliceSpec.SkipNodeOperations
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []SkipNodeOperation,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with set semantics require unique values
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj, validate.DirectEqual); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, validate.DirectEqual, nil, Validate_SkipNodeOperation); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *ResourceSliceSpec) []SkipNodeOperation {
+				return oldObj.SkipNodeOperations
+			})
+		errs = append(errs, fn(fldPath.Child("skipNodeOperations"), obj.SkipNodeOperations, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var symbolsForSkipNodeOperation = sets.New(SkipNodeOperationAll, SkipNodeOperationNodePrepareResources, SkipNodeOperationNodeUnprepareResources)
+
+// Validate_SkipNodeOperation validates an instance of SkipNodeOperation according
+// to declarative validation rules in the API schema.
+func Validate_SkipNodeOperation(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *SkipNodeOperation) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForSkipNodeOperation, nil); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
diff --git a/vendor/k8s.io/api/resource/v1alpha3/generated.pb.go b/vendor/k8s.io/api/resource/v1alpha3/generated.pb.go
index fa1f5f4710..77199b046d 100644
--- a/vendor/k8s.io/api/resource/v1alpha3/generated.pb.go
+++ b/vendor/k8s.io/api/resource/v1alpha3/generated.pb.go
@@ -24,6 +24,7 @@ import (
 
 	io "io"
 
+	resource "k8s.io/apimachinery/pkg/api/resource"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	math_bits "math/bits"
@@ -47,6 +48,8 @@ func (m *DeviceTaintRuleStatus) Reset() { *m = DeviceTaintRuleStatus{} }
 
 func (m *DeviceTaintSelector) Reset() { *m = DeviceTaintSelector{} }
 
+func (m *PartitionTypeStatus) Reset() { *m = PartitionTypeStatus{} }
+
 func (m *PoolStatus) Reset() { *m = PoolStatus{} }
 
 func (m *ResourcePoolStatusRequest) Reset() { *m = ResourcePoolStatusRequest{} }
@@ -57,6 +60,10 @@ func (m *ResourcePoolStatusRequestSpec) Reset() { *m = ResourcePoolStatusRequest
 
 func (m *ResourcePoolStatusRequestStatus) Reset() { *m = ResourcePoolStatusRequestStatus{} }
 
+func (m *ShareableCapacityStatus) Reset() { *m = ShareableCapacityStatus{} }
+
+func (m *ShareableSummaryStatus) Reset() { *m = ShareableSummaryStatus{} }
+
 func (m *CELDeviceSelector) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -396,6 +403,49 @@ func (m *DeviceTaintSelector) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *PartitionTypeStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PartitionTypeStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PartitionTypeStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Attribute)
+	copy(dAtA[i:], m.Attribute)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Attribute)))
+	i--
+	dAtA[i] = 0x22
+	if m.Allocatable != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.Allocatable))
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Total != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.Total))
+		i--
+		dAtA[i] = 0x10
+	}
+	i -= len(m.Type)
+	copy(dAtA[i:], m.Type)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Type)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
 func (m *PoolStatus) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -416,6 +466,32 @@ func (m *PoolStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.ShareableSummary != nil {
+		{
+			size, err := m.ShareableSummary.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x6a
+	}
+	if len(m.PartitionSummary) > 0 {
+		for iNdEx := len(m.PartitionSummary) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.PartitionSummary[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x5a
+		}
+	}
 	if m.ValidationError != nil {
 		i -= len(*m.ValidationError)
 		copy(dAtA[i:], *m.ValidationError)
@@ -593,6 +669,13 @@ func (m *ResourcePoolStatusRequestSpec) MarshalToSizedBuffer(dAtA []byte) (int,
 	_ = i
 	var l int
 	_ = l
+	if m.DefaultPartitionTypeAttribute != nil {
+		i -= len(*m.DefaultPartitionTypeAttribute)
+		copy(dAtA[i:], *m.DefaultPartitionTypeAttribute)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.DefaultPartitionTypeAttribute)))
+		i--
+		dAtA[i] = 0x22
+	}
 	if m.Limit != nil {
 		i = encodeVarintGenerated(dAtA, i, uint64(*m.Limit))
 		i--
@@ -669,6 +752,117 @@ func (m *ResourcePoolStatusRequestStatus) MarshalToSizedBuffer(dAtA []byte) (int
 	return len(dAtA) - i, nil
 }
 
+func (m *ShareableCapacityStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ShareableCapacityStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ShareableCapacityStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.Available != nil {
+		{
+			size, err := m.Available.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.Consumed != nil {
+		{
+			size, err := m.Consumed.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.Total != nil {
+		{
+			size, err := m.Total.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *ShareableSummaryStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ShareableSummaryStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ShareableSummaryStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Capacity) > 0 {
+		for iNdEx := len(m.Capacity) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Capacity[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if m.PartiallyAvailableDevices != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.PartiallyAvailableDevices))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.FullyAvailableDevices != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.FullyAvailableDevices))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
 func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
 	offset -= sovGenerated(v)
 	base := offset
@@ -806,6 +1000,25 @@ func (m *DeviceTaintSelector) Size() (n int) {
 	return n
 }
 
+func (m *PartitionTypeStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Type)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Total != nil {
+		n += 1 + sovGenerated(uint64(*m.Total))
+	}
+	if m.Allocatable != nil {
+		n += 1 + sovGenerated(uint64(*m.Allocatable))
+	}
+	l = len(m.Attribute)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
 func (m *PoolStatus) Size() (n int) {
 	if m == nil {
 		return 0
@@ -840,6 +1053,16 @@ func (m *PoolStatus) Size() (n int) {
 		l = len(*m.ValidationError)
 		n += 1 + l + sovGenerated(uint64(l))
 	}
+	if len(m.PartitionSummary) > 0 {
+		for _, e := range m.PartitionSummary {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if m.ShareableSummary != nil {
+		l = m.ShareableSummary.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
 	return n
 }
 
@@ -892,6 +1115,10 @@ func (m *ResourcePoolStatusRequestSpec) Size() (n int) {
 	if m.Limit != nil {
 		n += 1 + sovGenerated(uint64(*m.Limit))
 	}
+	if m.DefaultPartitionTypeAttribute != nil {
+		l = len(*m.DefaultPartitionTypeAttribute)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
 	return n
 }
 
@@ -919,6 +1146,50 @@ func (m *ResourcePoolStatusRequestStatus) Size() (n int) {
 	return n
 }
 
+func (m *ShareableCapacityStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Total != nil {
+		l = m.Total.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Consumed != nil {
+		l = m.Consumed.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Available != nil {
+		l = m.Available.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *ShareableSummaryStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.FullyAvailableDevices != nil {
+		n += 1 + sovGenerated(uint64(*m.FullyAvailableDevices))
+	}
+	if m.PartiallyAvailableDevices != nil {
+		n += 1 + sovGenerated(uint64(*m.PartiallyAvailableDevices))
+	}
+	if len(m.Capacity) > 0 {
+		for _, e := range m.Capacity {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
 func sovGenerated(x uint64) (n int) {
 	return (math_bits.Len64(x|1) + 6) / 7
 }
@@ -1011,10 +1282,28 @@ func (this *DeviceTaintSelector) String() string {
 	}, "")
 	return s
 }
+func (this *PartitionTypeStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&PartitionTypeStatus{`,
+		`Type:` + fmt.Sprintf("%v", this.Type) + `,`,
+		`Total:` + valueToStringGenerated(this.Total) + `,`,
+		`Allocatable:` + valueToStringGenerated(this.Allocatable) + `,`,
+		`Attribute:` + fmt.Sprintf("%v", this.Attribute) + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func (this *PoolStatus) String() string {
 	if this == nil {
 		return "nil"
 	}
+	repeatedStringForPartitionSummary := "[]PartitionTypeStatus{"
+	for _, f := range this.PartitionSummary {
+		repeatedStringForPartitionSummary += strings.Replace(strings.Replace(f.String(), "PartitionTypeStatus", "PartitionTypeStatus", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForPartitionSummary += "}"
 	s := strings.Join([]string{`&PoolStatus{`,
 		`Driver:` + fmt.Sprintf("%v", this.Driver) + `,`,
 		`PoolName:` + fmt.Sprintf("%v", this.PoolName) + `,`,
@@ -1026,6 +1315,8 @@ func (this *PoolStatus) String() string {
 		`ResourceSliceCount:` + valueToStringGenerated(this.ResourceSliceCount) + `,`,
 		`Generation:` + fmt.Sprintf("%v", this.Generation) + `,`,
 		`ValidationError:` + valueToStringGenerated(this.ValidationError) + `,`,
+		`PartitionSummary:` + repeatedStringForPartitionSummary + `,`,
+		`ShareableSummary:` + strings.Replace(this.ShareableSummary.String(), "ShareableSummaryStatus", "ShareableSummaryStatus", 1) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -1066,6 +1357,7 @@ func (this *ResourcePoolStatusRequestSpec) String() string {
 		`Driver:` + fmt.Sprintf("%v", this.Driver) + `,`,
 		`PoolName:` + valueToStringGenerated(this.PoolName) + `,`,
 		`Limit:` + valueToStringGenerated(this.Limit) + `,`,
+		`DefaultPartitionTypeAttribute:` + valueToStringGenerated(this.DefaultPartitionTypeAttribute) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -1092,6 +1384,36 @@ func (this *ResourcePoolStatusRequestStatus) String() string {
 	}, "")
 	return s
 }
+func (this *ShareableCapacityStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ShareableCapacityStatus{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`Total:` + strings.Replace(fmt.Sprintf("%v", this.Total), "Quantity", "resource.Quantity", 1) + `,`,
+		`Consumed:` + strings.Replace(fmt.Sprintf("%v", this.Consumed), "Quantity", "resource.Quantity", 1) + `,`,
+		`Available:` + strings.Replace(fmt.Sprintf("%v", this.Available), "Quantity", "resource.Quantity", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ShareableSummaryStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForCapacity := "[]ShareableCapacityStatus{"
+	for _, f := range this.Capacity {
+		repeatedStringForCapacity += strings.Replace(strings.Replace(f.String(), "ShareableCapacityStatus", "ShareableCapacityStatus", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForCapacity += "}"
+	s := strings.Join([]string{`&ShareableSummaryStatus{`,
+		`FullyAvailableDevices:` + valueToStringGenerated(this.FullyAvailableDevices) + `,`,
+		`PartiallyAvailableDevices:` + valueToStringGenerated(this.PartiallyAvailableDevices) + `,`,
+		`Capacity:` + repeatedStringForCapacity + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func valueToStringGenerated(v interface{}) string {
 	rv := reflect.ValueOf(v)
 	if rv.IsNil() {
@@ -2068,7 +2390,7 @@ func (m *DeviceTaintSelector) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PoolStatus) Unmarshal(dAtA []byte) error {
+func (m *PartitionTypeStatus) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -2091,15 +2413,15 @@ func (m *PoolStatus) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PoolStatus: wiretype end group for non-group")
+			return fmt.Errorf("proto: PartitionTypeStatus: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PoolStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: PartitionTypeStatus: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Driver", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -2127,13 +2449,13 @@ func (m *PoolStatus) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Driver = string(dAtA[iNdEx:postIndex])
+			m.Type = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PoolName", wireType)
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Total", wireType)
 			}
-			var stringLen uint64
+			var v int32
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -2143,27 +2465,35 @@ func (m *PoolStatus) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				v |= int32(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
+			m.Total = &v
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Allocatable", wireType)
 			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
 			}
-			m.PoolName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 3:
+			m.Allocatable = &v
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NodeName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Attribute", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -2191,8 +2521,154 @@ func (m *PoolStatus) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			s := string(dAtA[iNdEx:postIndex])
-			m.NodeName = &s
+			m.Attribute = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PoolStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PoolStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PoolStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Driver", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Driver = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PoolName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PoolName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.NodeName = &s
 			iNdEx = postIndex
 		case 4:
 			if wireType != 0 {
@@ -2346,6 +2822,76 @@ func (m *PoolStatus) Unmarshal(dAtA []byte) error {
 			s := string(dAtA[iNdEx:postIndex])
 			m.ValidationError = &s
 			iNdEx = postIndex
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PartitionSummary", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PartitionSummary = append(m.PartitionSummary, PartitionTypeStatus{})
+			if err := m.PartitionSummary[len(m.PartitionSummary)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 13:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ShareableSummary", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ShareableSummary == nil {
+				m.ShareableSummary = &ShareableSummaryStatus{}
+			}
+			if err := m.ShareableSummary.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -2750,6 +3296,39 @@ func (m *ResourcePoolStatusRequestSpec) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.Limit = &v
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DefaultPartitionTypeAttribute", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.DefaultPartitionTypeAttribute = &s
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -2909,6 +3488,320 @@ func (m *ResourcePoolStatusRequestStatus) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *ShareableCapacityStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ShareableCapacityStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ShareableCapacityStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Total", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Total == nil {
+				m.Total = &resource.Quantity{}
+			}
+			if err := m.Total.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Consumed", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Consumed == nil {
+				m.Consumed = &resource.Quantity{}
+			}
+			if err := m.Consumed.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Available", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Available == nil {
+				m.Available = &resource.Quantity{}
+			}
+			if err := m.Available.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ShareableSummaryStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ShareableSummaryStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ShareableSummaryStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FullyAvailableDevices", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.FullyAvailableDevices = &v
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PartiallyAvailableDevices", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.PartiallyAvailableDevices = &v
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Capacity", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Capacity = append(m.Capacity, ShareableCapacityStatus{})
+			if err := m.Capacity[len(m.Capacity)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func skipGenerated(dAtA []byte) (n int, err error) {
 	l := len(dAtA)
 	iNdEx := 0
diff --git a/vendor/k8s.io/api/resource/v1alpha3/generated.proto b/vendor/k8s.io/api/resource/v1alpha3/generated.proto
index d6ee310806..daa969018c 100644
--- a/vendor/k8s.io/api/resource/v1alpha3/generated.proto
+++ b/vendor/k8s.io/api/resource/v1alpha3/generated.proto
@@ -21,6 +21,7 @@ syntax = "proto2";
 
 package k8s.io.api.resource.v1alpha3;
 
+import "k8s.io/apimachinery/pkg/api/resource/generated.proto";
 import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
 import "k8s.io/apimachinery/pkg/runtime/generated.proto";
 import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
@@ -40,7 +41,7 @@ message CELDeviceSelector {
   //  - driver (string): the name of the driver which defines this device.
   //  - attributes (map[string]object): the device's attributes, grouped by prefix
   //    (e.g. device.attributes["dra.example.com"] evaluates to an object with all
-  //    of the attributes which were prefixed by "dra.example.com".
+  //    of the attributes which were prefixed by "dra.example.com").
   //  - capacity (map[string]object): the device's capacities, grouped by prefix.
   //
   // Example: Consider a device with driver="dra.example.com", which exposes
@@ -71,6 +72,15 @@ message CELDeviceSelector {
   // A robust expression should check for the existence of attributes
   // before referencing them.
   //
+  // Common errors:
+  // - "no such key": Use optional chaining (.? followed by orValue())
+  //   or guarding the check with has() for optional fields.
+  //   See CEL Optional Types for details:
+  //   https://pkg.go.dev/github.com/google/cel-go@v0.17.4/cel#OptionalTypes
+  //
+  // For more CEL expression syntax and examples, see:
+  // https://kubernetes.io/docs/reference/using-api/cel/
+  //
   // For ease of use, the cel.bind() function is enabled, and can be used
   // to simplify expressions that access multiple attributes with the
   // same domain. For example:
@@ -120,7 +130,7 @@ message DeviceTaint {
   // Consumers must treat unknown effects like None.
   //
   // +required
-  // +k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string effect = 3;
 
   // TimeAdded represents the time at which the taint was added or
@@ -142,6 +152,7 @@ message DeviceTaint {
 // DeviceTaintRule adds one taint to all devices which match the selector.
 // This has the same effect as if the taint was specified directly
 // in the ResourceSlice by the DRA driver.
+// +k8s:supportsSubresource="/status"
 message DeviceTaintRule {
   // Standard object metadata
   // +optional
@@ -213,6 +224,9 @@ message DeviceTaintRuleStatus {
   // +listMapKey=type
   // +patchStrategy=merge
   // +patchMergeKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 1;
 }
 
@@ -248,6 +262,40 @@ message DeviceTaintSelector {
   optional string device = 4;
 }
 
+// PartitionTypeStatus reports allocatability for a single partition type,
+// identified by the value of a grouping attribute.
+message PartitionTypeStatus {
+  // Attribute is the fully qualified name of the device attribute whose value
+  // groups this entry. It is the PartitionTypeAttribute declared by the
+  // devices' own slice, or the default named in the request when their slice
+  // declares none.
+  //
+  // +required
+  // +k8s:required
+  optional string attribute = 4;
+
+  // Type is the partition type value (e.g. "Full" or "Half").
+  //
+  // +required
+  // +k8s:required
+  optional string type = 1;
+
+  // Total is the number of devices of this partition type in the pool.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:minimum=0
+  optional int32 total = 2;
+
+  // Allocatable is the number of additional devices of this partition type
+  // that could still be allocated given current shared-counter consumption.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:minimum=0
+  optional int32 allocatable = 3;
+}
+
 // PoolStatus contains status information for a single resource pool.
 message PoolStatus {
   // Driver is the DRA driver name for this pool.
@@ -339,6 +387,33 @@ message PoolStatus {
   // +k8s:optional
   // +k8s:maxBytes=256
   optional string validationError = 10;
+
+  // PartitionSummary reports allocatability per (attribute, partition type)
+  // for a partitionable pool that publishes SharedCounters. Each entry names
+  // the grouping attribute it was resolved from: the PartitionTypeAttribute
+  // declared by a device's own slice, or for devices whose slice declares
+  // none, the default named in the request. A pool that mixes partitions
+  // declared under different attributes reports each independently. When no
+  // slice declares an attribute and the request names no default, the pool
+  // reports no partition summary.
+  //
+  // +optional
+  // +k8s:optional
+  // +listType=atomic
+  // +k8s:listType=atomic
+  // +k8s:unique=map
+  // +k8s:listMapKey=attribute
+  // +k8s:listMapKey=type
+  // +k8s:maxItems=32
+  repeated PartitionTypeStatus partitionSummary = 11;
+
+  // ShareableSummary reports aggregate capacity for a pool that contains
+  // devices with AllowMultipleAllocations. It is populated only when at
+  // least one device in the pool is shareable.
+  //
+  // +optional
+  // +k8s:optional
+  optional ShareableSummaryStatus shareableSummary = 13;
 }
 
 // ResourcePoolStatusRequest triggers a one-time calculation of resource pool status
@@ -410,6 +485,26 @@ message ResourcePoolStatusRequestSpec {
   // +k8s:minimum=1
   // +k8s:maximum=1000
   optional int32 limit = 3;
+
+  // DefaultPartitionTypeAttribute optionally names a device attribute (by its
+  // fully qualified name, e.g. "gpu.example.com/profile") to use as the default
+  // grouping attribute for partitionable devices whose slice has not declared
+  // one themselves.
+  //
+  // A slice's own PartitionTypeAttribute always takes precedence. This default
+  // applies only to devices whose slice does not declare one, so that a request
+  // can still get an accurate partitionSummary from a driver that has not
+  // been updated to declare it. When neither the slice nor this default names
+  // an attribute, a partitionable pool reports no partitionSummary.
+  //
+  // Must include the domain qualifier.
+  //
+  // +optional
+  // +featureGate=DRAPartitionableDevicesType
+  // +k8s:ifDisabled(DRAPartitionableDevicesType)=+k8s:forbidden
+  // +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:optional
+  // +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:format=k8s-resource-fully-qualified-name
+  optional string defaultPartitionTypeAttribute = 4;
 }
 
 // ResourcePoolStatusRequestStatus contains the calculated pool status information.
@@ -446,12 +541,69 @@ message ResourcePoolStatusRequestStatus {
   // +optional
   // +k8s:optional
   // +listType=map
-  // +k8s:listType=map
   // +listMapKey=type
-  // +k8s:listMapKey=type
   // +patchStrategy=merge
   // +patchMergeKey=type
   // +k8s:maxItems=10
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 3;
 }
 
+// ShareableCapacityStatus reports aggregate amounts for a single shareable
+// capacity key.
+message ShareableCapacityStatus {
+  // Name is the capacity name.
+  //
+  // +required
+  // +k8s:required
+  optional string name = 1;
+
+  // Total is the sum of this capacity across shareable devices in the pool.
+  //
+  // +required
+  // +k8s:required
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity total = 2;
+
+  // Consumed is the amount drawn by current allocations.
+  //
+  // +required
+  // +k8s:required
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity consumed = 3;
+
+  // Available is Total minus Consumed, never negative.
+  //
+  // +required
+  // +k8s:required
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity available = 4;
+}
+
+// ShareableSummaryStatus reports aggregate capacity for a pool that contains
+// devices with AllowMultipleAllocations.
+message ShareableSummaryStatus {
+  // FullyAvailableDevices is the number of shareable devices with no
+  // capacity consumed.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:minimum=0
+  optional int32 fullyAvailableDevices = 1;
+
+  // PartiallyAvailableDevices is the number of shareable devices with some
+  // but not all capacity consumed.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:minimum=0
+  optional int32 partiallyAvailableDevices = 2;
+
+  // Capacity reports aggregate total, consumed, and available amounts per
+  // shareable capacity key across the pool.
+  //
+  // +optional
+  // +k8s:optional
+  // +listType=atomic
+  // +k8s:maxItems=32
+  repeated ShareableCapacityStatus capacity = 3;
+}
+
diff --git a/vendor/k8s.io/api/resource/v1alpha3/types.go b/vendor/k8s.io/api/resource/v1alpha3/types.go
index 1757c86150..8e1e884504 100644
--- a/vendor/k8s.io/api/resource/v1alpha3/types.go
+++ b/vendor/k8s.io/api/resource/v1alpha3/types.go
@@ -17,6 +17,7 @@ limitations under the License.
 package v1alpha3
 
 import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -41,7 +42,7 @@ type CELDeviceSelector struct {
 	//  - driver (string): the name of the driver which defines this device.
 	//  - attributes (map[string]object): the device's attributes, grouped by prefix
 	//    (e.g. device.attributes["dra.example.com"] evaluates to an object with all
-	//    of the attributes which were prefixed by "dra.example.com".
+	//    of the attributes which were prefixed by "dra.example.com").
 	//  - capacity (map[string]object): the device's capacities, grouped by prefix.
 	//
 	// Example: Consider a device with driver="dra.example.com", which exposes
@@ -72,6 +73,15 @@ type CELDeviceSelector struct {
 	// A robust expression should check for the existence of attributes
 	// before referencing them.
 	//
+	// Common errors:
+	// - "no such key": Use optional chaining (.? followed by orValue())
+	//   or guarding the check with has() for optional fields.
+	//   See CEL Optional Types for details:
+	//   https://pkg.go.dev/github.com/google/cel-go@v0.17.4/cel#OptionalTypes
+	//
+	// For more CEL expression syntax and examples, see:
+	// https://kubernetes.io/docs/reference/using-api/cel/
+	//
 	// For ease of use, the cel.bind() function is enabled, and can be used
 	// to simplify expressions that access multiple attributes with the
 	// same domain. For example:
@@ -140,7 +150,7 @@ type DeviceTaint struct {
 	// Consumers must treat unknown effects like None.
 	//
 	// +required
-	// +k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Effect DeviceTaintEffect `json:"effect" protobuf:"bytes,3,name=effect,casttype=DeviceTaintEffect"`
 
 	// ^^^^
@@ -179,7 +189,7 @@ type DeviceTaint struct {
 }
 
 // +enum
-// +k8s:enum
+// +k8s:beta(since: "1.37")=+k8s:enum
 type DeviceTaintEffect string
 
 const (
@@ -203,8 +213,9 @@ const (
 // DeviceTaintRule adds one taint to all devices which match the selector.
 // This has the same effect as if the taint was specified directly
 // in the ResourceSlice by the DRA driver.
+// +k8s:supportsSubresource="/status"
 type DeviceTaintRule struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -322,6 +333,9 @@ type DeviceTaintRuleStatus struct {
 	// +listMapKey=type
 	// +patchStrategy=merge
 	// +patchMergeKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
 }
 
@@ -336,7 +350,7 @@ const DeviceTaintConditionEvictionInProgress = "EvictionInProgress"
 
 // DeviceTaintRuleList is a collection of DeviceTaintRules.
 type DeviceTaintRuleList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -355,7 +369,7 @@ type DeviceTaintRuleList struct {
 // based on the provided filters. Once status is set, the request is considered complete and will not be reprocessed.
 // Users should delete and recreate requests to get updated information.
 type ResourcePoolStatusRequest struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata
 	// +required
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -411,6 +425,26 @@ type ResourcePoolStatusRequestSpec struct {
 	// +k8s:minimum=1
 	// +k8s:maximum=1000
 	Limit *int32 `json:"limit,omitempty" protobuf:"varint,3,opt,name=limit"`
+
+	// DefaultPartitionTypeAttribute optionally names a device attribute (by its
+	// fully qualified name, e.g. "gpu.example.com/profile") to use as the default
+	// grouping attribute for partitionable devices whose slice has not declared
+	// one themselves.
+	//
+	// A slice's own PartitionTypeAttribute always takes precedence. This default
+	// applies only to devices whose slice does not declare one, so that a request
+	// can still get an accurate partitionSummary from a driver that has not
+	// been updated to declare it. When neither the slice nor this default names
+	// an attribute, a partitionable pool reports no partitionSummary.
+	//
+	// Must include the domain qualifier.
+	//
+	// +optional
+	// +featureGate=DRAPartitionableDevicesType
+	// +k8s:ifDisabled(DRAPartitionableDevicesType)=+k8s:forbidden
+	// +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:optional
+	// +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:format=k8s-resource-fully-qualified-name
+	DefaultPartitionTypeAttribute *string `json:"defaultPartitionTypeAttribute,omitempty" protobuf:"bytes,4,opt,name=defaultPartitionTypeAttribute"`
 }
 
 // ResourcePoolStatusRequestLimitDefault is the default value for spec.limit.
@@ -453,12 +487,12 @@ type ResourcePoolStatusRequestStatus struct {
 	// +optional
 	// +k8s:optional
 	// +listType=map
-	// +k8s:listType=map
 	// +listMapKey=type
-	// +k8s:listMapKey=type
 	// +patchStrategy=merge
 	// +patchMergeKey=type
 	// +k8s:maxItems=10
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,3,rep,name=conditions"`
 }
 
@@ -553,6 +587,124 @@ type PoolStatus struct {
 	// +k8s:optional
 	// +k8s:maxBytes=256
 	ValidationError *string `json:"validationError,omitempty" protobuf:"bytes,10,opt,name=validationError"`
+
+	// PartitionSummary reports allocatability per (attribute, partition type)
+	// for a partitionable pool that publishes SharedCounters. Each entry names
+	// the grouping attribute it was resolved from: the PartitionTypeAttribute
+	// declared by a device's own slice, or for devices whose slice declares
+	// none, the default named in the request. A pool that mixes partitions
+	// declared under different attributes reports each independently. When no
+	// slice declares an attribute and the request names no default, the pool
+	// reports no partition summary.
+	//
+	// +optional
+	// +k8s:optional
+	// +listType=atomic
+	// +k8s:listType=atomic
+	// +k8s:unique=map
+	// +k8s:listMapKey=attribute
+	// +k8s:listMapKey=type
+	// +k8s:maxItems=32
+	PartitionSummary []PartitionTypeStatus `json:"partitionSummary,omitempty" protobuf:"bytes,11,rep,name=partitionSummary"`
+
+	// ShareableSummary reports aggregate capacity for a pool that contains
+	// devices with AllowMultipleAllocations. It is populated only when at
+	// least one device in the pool is shareable.
+	//
+	// +optional
+	// +k8s:optional
+	ShareableSummary *ShareableSummaryStatus `json:"shareableSummary,omitempty" protobuf:"bytes,13,opt,name=shareableSummary"`
+}
+
+// PartitionTypeStatus reports allocatability for a single partition type,
+// identified by the value of a grouping attribute.
+type PartitionTypeStatus struct {
+	// Attribute is the fully qualified name of the device attribute whose value
+	// groups this entry. It is the PartitionTypeAttribute declared by the
+	// devices' own slice, or the default named in the request when their slice
+	// declares none.
+	//
+	// +required
+	// +k8s:required
+	Attribute string `json:"attribute,omitempty" protobuf:"bytes,4,name=attribute"`
+
+	// Type is the partition type value (e.g. "Full" or "Half").
+	//
+	// +required
+	// +k8s:required
+	Type string `json:"type,omitempty" protobuf:"bytes,1,name=type"`
+
+	// Total is the number of devices of this partition type in the pool.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:minimum=0
+	Total *int32 `json:"total,omitempty" protobuf:"varint,2,opt,name=total"`
+
+	// Allocatable is the number of additional devices of this partition type
+	// that could still be allocated given current shared-counter consumption.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:minimum=0
+	Allocatable *int32 `json:"allocatable,omitempty" protobuf:"varint,3,opt,name=allocatable"`
+}
+
+// ShareableSummaryStatus reports aggregate capacity for a pool that contains
+// devices with AllowMultipleAllocations.
+type ShareableSummaryStatus struct {
+	// FullyAvailableDevices is the number of shareable devices with no
+	// capacity consumed.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:minimum=0
+	FullyAvailableDevices *int32 `json:"fullyAvailableDevices,omitempty" protobuf:"varint,1,opt,name=fullyAvailableDevices"`
+
+	// PartiallyAvailableDevices is the number of shareable devices with some
+	// but not all capacity consumed.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:minimum=0
+	PartiallyAvailableDevices *int32 `json:"partiallyAvailableDevices,omitempty" protobuf:"varint,2,opt,name=partiallyAvailableDevices"`
+
+	// Capacity reports aggregate total, consumed, and available amounts per
+	// shareable capacity key across the pool.
+	//
+	// +optional
+	// +k8s:optional
+	// +listType=atomic
+	// +k8s:maxItems=32
+	Capacity []ShareableCapacityStatus `json:"capacity,omitempty" protobuf:"bytes,3,rep,name=capacity"`
+}
+
+// ShareableCapacityStatus reports aggregate amounts for a single shareable
+// capacity key.
+type ShareableCapacityStatus struct {
+	// Name is the capacity name.
+	//
+	// +required
+	// +k8s:required
+	Name string `json:"name,omitempty" protobuf:"bytes,1,name=name"`
+
+	// Total is the sum of this capacity across shareable devices in the pool.
+	//
+	// +required
+	// +k8s:required
+	Total *resource.Quantity `json:"total,omitempty" protobuf:"bytes,2,opt,name=total"`
+
+	// Consumed is the amount drawn by current allocations.
+	//
+	// +required
+	// +k8s:required
+	Consumed *resource.Quantity `json:"consumed,omitempty" protobuf:"bytes,3,opt,name=consumed"`
+
+	// Available is Total minus Consumed, never negative.
+	//
+	// +required
+	// +k8s:required
+	Available *resource.Quantity `json:"available,omitempty" protobuf:"bytes,4,opt,name=available"`
 }
 
 // ResourcePoolStatusRequestConditionComplete is the condition type for completed requests.
@@ -566,7 +718,7 @@ const ResourcePoolStatusRequestConditionFailed = "Failed"
 
 // ResourcePoolStatusRequestList is a collection of ResourcePoolStatusRequests.
 type ResourcePoolStatusRequestList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
diff --git a/vendor/k8s.io/api/resource/v1alpha3/types_swagger_doc_generated.go b/vendor/k8s.io/api/resource/v1alpha3/types_swagger_doc_generated.go
index 49ff642fea..4fddc16bc1 100644
--- a/vendor/k8s.io/api/resource/v1alpha3/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/resource/v1alpha3/types_swagger_doc_generated.go
@@ -29,7 +29,7 @@ package v1alpha3
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_CELDeviceSelector = map[string]string{
 	"":           "CELDeviceSelector contains a CEL expression for selecting a device.",
-	"expression": "Expression is a CEL expression which evaluates a single device. It must evaluate to true when the device under consideration satisfies the desired criteria, and false when it does not. Any other result is an error and causes allocation of devices to abort.\n\nThe expression's input is an object named \"device\", which carries the following properties:\n - driver (string): the name of the driver which defines this device.\n - attributes (map[string]object): the device's attributes, grouped by prefix\n   (e.g. device.attributes[\"dra.example.com\"] evaluates to an object with all\n   of the attributes which were prefixed by \"dra.example.com\".\n - capacity (map[string]object): the device's capacities, grouped by prefix.\n\nExample: Consider a device with driver=\"dra.example.com\", which exposes two attributes named \"model\" and \"ext.example.com/family\" and which exposes one capacity named \"modules\". This input to this expression would have the following fields:\n\n    device.driver\n    device.attributes[\"dra.example.com\"].model\n    device.attributes[\"ext.example.com\"].family\n    device.capacity[\"dra.example.com\"].modules\n\nThe device.driver field can be used to check for a specific driver, either as a high-level precondition (i.e. you only want to consider devices from this driver) or as part of a multi-clause expression that is meant to consider devices from different drivers.\n\nThe value type of each attribute is defined by the device definition, and users who write these expressions must consult the documentation for their specific drivers. The value type of each capacity is Quantity.\n\nIf an unknown prefix is used as a lookup in either device.attributes or device.capacity, an empty map will be returned. Any reference to an unknown field will cause an evaluation error and allocation to abort.\n\nA robust expression should check for the existence of attributes before referencing them.\n\nFor ease of use, the cel.bind() function is enabled, and can be used to simplify expressions that access multiple attributes with the same domain. For example:\n\n    cel.bind(dra, device.attributes[\"dra.example.com\"], dra.someBool && dra.anotherBool)\n\nThe length of the expression must be smaller or equal to 10 Ki. The cost of evaluating it is also limited based on the estimated number of logical steps.",
+	"expression": "Expression is a CEL expression which evaluates a single device. It must evaluate to true when the device under consideration satisfies the desired criteria, and false when it does not. Any other result is an error and causes allocation of devices to abort.\n\nThe expression's input is an object named \"device\", which carries the following properties:\n - driver (string): the name of the driver which defines this device.\n - attributes (map[string]object): the device's attributes, grouped by prefix\n   (e.g. device.attributes[\"dra.example.com\"] evaluates to an object with all\n   of the attributes which were prefixed by \"dra.example.com\").\n - capacity (map[string]object): the device's capacities, grouped by prefix.\n\nExample: Consider a device with driver=\"dra.example.com\", which exposes two attributes named \"model\" and \"ext.example.com/family\" and which exposes one capacity named \"modules\". This input to this expression would have the following fields:\n\n    device.driver\n    device.attributes[\"dra.example.com\"].model\n    device.attributes[\"ext.example.com\"].family\n    device.capacity[\"dra.example.com\"].modules\n\nThe device.driver field can be used to check for a specific driver, either as a high-level precondition (i.e. you only want to consider devices from this driver) or as part of a multi-clause expression that is meant to consider devices from different drivers.\n\nThe value type of each attribute is defined by the device definition, and users who write these expressions must consult the documentation for their specific drivers. The value type of each capacity is Quantity.\n\nIf an unknown prefix is used as a lookup in either device.attributes or device.capacity, an empty map will be returned. Any reference to an unknown field will cause an evaluation error and allocation to abort.\n\nA robust expression should check for the existence of attributes before referencing them.\n\nCommon errors: - \"no such key\": Use optional chaining (.? followed by orValue())\n  or guarding the check with has() for optional fields.\n  See CEL Optional Types for details:\n  https://pkg.go.dev/github.com/google/cel-go@v0.17.4/cel#OptionalTypes\n\nFor more CEL expression syntax and examples, see: https://kubernetes.io/docs/reference/using-api/cel/\n\nFor ease of use, the cel.bind() function is enabled, and can be used to simplify expressions that access multiple attributes with the same domain. For example:\n\n    cel.bind(dra, device.attributes[\"dra.example.com\"], dra.someBool && dra.anotherBool)\n\nThe length of the expression must be smaller or equal to 10 Ki. The cost of evaluating it is also limited based on the estimated number of logical steps.",
 }
 
 func (CELDeviceSelector) SwaggerDoc() map[string]string {
@@ -108,6 +108,18 @@ func (DeviceTaintSelector) SwaggerDoc() map[string]string {
 	return map_DeviceTaintSelector
 }
 
+var map_PartitionTypeStatus = map[string]string{
+	"":            "PartitionTypeStatus reports allocatability for a single partition type, identified by the value of a grouping attribute.",
+	"attribute":   "Attribute is the fully qualified name of the device attribute whose value groups this entry. It is the PartitionTypeAttribute declared by the devices' own slice, or the default named in the request when their slice declares none.",
+	"type":        "Type is the partition type value (e.g. \"Full\" or \"Half\").",
+	"total":       "Total is the number of devices of this partition type in the pool.",
+	"allocatable": "Allocatable is the number of additional devices of this partition type that could still be allocated given current shared-counter consumption.",
+}
+
+func (PartitionTypeStatus) SwaggerDoc() map[string]string {
+	return map_PartitionTypeStatus
+}
+
 var map_PoolStatus = map[string]string{
 	"":                   "PoolStatus contains status information for a single resource pool.",
 	"driver":             "Driver is the DRA driver name for this pool. Must be a DNS subdomain (e.g., \"gpu.example.com\").",
@@ -120,6 +132,8 @@ var map_PoolStatus = map[string]string{
 	"unavailableDevices": "UnavailableDevices is the number of devices that are not available due to taints or other conditions, but are not allocated. A value of 0 means all unallocated devices are available. May be unset when validationError is set.",
 	"nodeName":           "NodeName is the node this pool is associated with. When omitted, the pool is not associated with a specific node. Must be a valid DNS subdomain name (RFC1123).",
 	"validationError":    "ValidationError is set when the pool's data could not be fully validated (e.g., incomplete slice publication). When set, device count fields and ResourceSliceCount may be unset.",
+	"partitionSummary":   "PartitionSummary reports allocatability per (attribute, partition type) for a partitionable pool that publishes SharedCounters. Each entry names the grouping attribute it was resolved from: the PartitionTypeAttribute declared by a device's own slice, or for devices whose slice declares none, the default named in the request. A pool that mixes partitions declared under different attributes reports each independently. When no slice declares an attribute and the request names no default, the pool reports no partition summary.",
+	"shareableSummary":   "ShareableSummary reports aggregate capacity for a pool that contains devices with AllowMultipleAllocations. It is populated only when at least one device in the pool is shareable.",
 }
 
 func (PoolStatus) SwaggerDoc() map[string]string {
@@ -148,10 +162,11 @@ func (ResourcePoolStatusRequestList) SwaggerDoc() map[string]string {
 }
 
 var map_ResourcePoolStatusRequestSpec = map[string]string{
-	"":         "ResourcePoolStatusRequestSpec defines the filters for the pool status request.",
-	"driver":   "Driver specifies the DRA driver name to filter pools. Only pools from ResourceSlices with this driver will be included. Must be a DNS subdomain (e.g., \"gpu.example.com\").",
-	"poolName": "PoolName optionally filters to a specific pool name. If not specified, all pools from the specified driver are included. When specified, must be a non-empty valid resource pool name (DNS subdomains separated by \"/\").",
-	"limit":    "Limit optionally specifies the maximum number of pools to return in the status. If more pools match the filter criteria, the response will be truncated (i.e., len(status.pools) < status.poolCount).\n\nDefault: 100 Minimum: 1 Maximum: 1000",
+	"":                              "ResourcePoolStatusRequestSpec defines the filters for the pool status request.",
+	"driver":                        "Driver specifies the DRA driver name to filter pools. Only pools from ResourceSlices with this driver will be included. Must be a DNS subdomain (e.g., \"gpu.example.com\").",
+	"poolName":                      "PoolName optionally filters to a specific pool name. If not specified, all pools from the specified driver are included. When specified, must be a non-empty valid resource pool name (DNS subdomains separated by \"/\").",
+	"limit":                         "Limit optionally specifies the maximum number of pools to return in the status. If more pools match the filter criteria, the response will be truncated (i.e., len(status.pools) < status.poolCount).\n\nDefault: 100 Minimum: 1 Maximum: 1000",
+	"defaultPartitionTypeAttribute": "DefaultPartitionTypeAttribute optionally names a device attribute (by its fully qualified name, e.g. \"gpu.example.com/profile\") to use as the default grouping attribute for partitionable devices whose slice has not declared one themselves.\n\nA slice's own PartitionTypeAttribute always takes precedence. This default applies only to devices whose slice does not declare one, so that a request can still get an accurate partitionSummary from a driver that has not been updated to declare it. When neither the slice nor this default names an attribute, a partitionable pool reports no partitionSummary.\n\nMust include the domain qualifier.",
 }
 
 func (ResourcePoolStatusRequestSpec) SwaggerDoc() map[string]string {
@@ -169,4 +184,27 @@ func (ResourcePoolStatusRequestStatus) SwaggerDoc() map[string]string {
 	return map_ResourcePoolStatusRequestStatus
 }
 
+var map_ShareableCapacityStatus = map[string]string{
+	"":          "ShareableCapacityStatus reports aggregate amounts for a single shareable capacity key.",
+	"name":      "Name is the capacity name.",
+	"total":     "Total is the sum of this capacity across shareable devices in the pool.",
+	"consumed":  "Consumed is the amount drawn by current allocations.",
+	"available": "Available is Total minus Consumed, never negative.",
+}
+
+func (ShareableCapacityStatus) SwaggerDoc() map[string]string {
+	return map_ShareableCapacityStatus
+}
+
+var map_ShareableSummaryStatus = map[string]string{
+	"":                          "ShareableSummaryStatus reports aggregate capacity for a pool that contains devices with AllowMultipleAllocations.",
+	"fullyAvailableDevices":     "FullyAvailableDevices is the number of shareable devices with no capacity consumed.",
+	"partiallyAvailableDevices": "PartiallyAvailableDevices is the number of shareable devices with some but not all capacity consumed.",
+	"capacity":                  "Capacity reports aggregate total, consumed, and available amounts per shareable capacity key across the pool.",
+}
+
+func (ShareableSummaryStatus) SwaggerDoc() map[string]string {
+	return map_ShareableSummaryStatus
+}
+
 // AUTO-GENERATED FUNCTIONS END HERE
diff --git a/vendor/k8s.io/api/resource/v1alpha3/zz_generated.deepcopy.go b/vendor/k8s.io/api/resource/v1alpha3/zz_generated.deepcopy.go
index 32ec2ad8e2..b3ec2e6c78 100644
--- a/vendor/k8s.io/api/resource/v1alpha3/zz_generated.deepcopy.go
+++ b/vendor/k8s.io/api/resource/v1alpha3/zz_generated.deepcopy.go
@@ -220,6 +220,32 @@ func (in *DeviceTaintSelector) DeepCopy() *DeviceTaintSelector {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PartitionTypeStatus) DeepCopyInto(out *PartitionTypeStatus) {
+	*out = *in
+	if in.Total != nil {
+		in, out := &in.Total, &out.Total
+		*out = new(int32)
+		**out = **in
+	}
+	if in.Allocatable != nil {
+		in, out := &in.Allocatable, &out.Allocatable
+		*out = new(int32)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PartitionTypeStatus.
+func (in *PartitionTypeStatus) DeepCopy() *PartitionTypeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(PartitionTypeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *PoolStatus) DeepCopyInto(out *PoolStatus) {
 	*out = *in
@@ -258,6 +284,18 @@ func (in *PoolStatus) DeepCopyInto(out *PoolStatus) {
 		*out = new(string)
 		**out = **in
 	}
+	if in.PartitionSummary != nil {
+		in, out := &in.PartitionSummary, &out.PartitionSummary
+		*out = make([]PartitionTypeStatus, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.ShareableSummary != nil {
+		in, out := &in.ShareableSummary, &out.ShareableSummary
+		*out = new(ShareableSummaryStatus)
+		(*in).DeepCopyInto(*out)
+	}
 	return
 }
 
@@ -349,6 +387,11 @@ func (in *ResourcePoolStatusRequestSpec) DeepCopyInto(out *ResourcePoolStatusReq
 		*out = new(int32)
 		**out = **in
 	}
+	if in.DefaultPartitionTypeAttribute != nil {
+		in, out := &in.DefaultPartitionTypeAttribute, &out.DefaultPartitionTypeAttribute
+		*out = new(string)
+		**out = **in
+	}
 	return
 }
 
@@ -396,3 +439,67 @@ func (in *ResourcePoolStatusRequestStatus) DeepCopy() *ResourcePoolStatusRequest
 	in.DeepCopyInto(out)
 	return out
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ShareableCapacityStatus) DeepCopyInto(out *ShareableCapacityStatus) {
+	*out = *in
+	if in.Total != nil {
+		in, out := &in.Total, &out.Total
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	if in.Consumed != nil {
+		in, out := &in.Consumed, &out.Consumed
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	if in.Available != nil {
+		in, out := &in.Available, &out.Available
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ShareableCapacityStatus.
+func (in *ShareableCapacityStatus) DeepCopy() *ShareableCapacityStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ShareableCapacityStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ShareableSummaryStatus) DeepCopyInto(out *ShareableSummaryStatus) {
+	*out = *in
+	if in.FullyAvailableDevices != nil {
+		in, out := &in.FullyAvailableDevices, &out.FullyAvailableDevices
+		*out = new(int32)
+		**out = **in
+	}
+	if in.PartiallyAvailableDevices != nil {
+		in, out := &in.PartiallyAvailableDevices, &out.PartiallyAvailableDevices
+		*out = new(int32)
+		**out = **in
+	}
+	if in.Capacity != nil {
+		in, out := &in.Capacity, &out.Capacity
+		*out = make([]ShareableCapacityStatus, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ShareableSummaryStatus.
+func (in *ShareableSummaryStatus) DeepCopy() *ShareableSummaryStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ShareableSummaryStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/vendor/k8s.io/api/resource/v1alpha3/zz_generated.model_name.go b/vendor/k8s.io/api/resource/v1alpha3/zz_generated.model_name.go
index 3ef712c223..255ca1dda5 100644
--- a/vendor/k8s.io/api/resource/v1alpha3/zz_generated.model_name.go
+++ b/vendor/k8s.io/api/resource/v1alpha3/zz_generated.model_name.go
@@ -61,6 +61,11 @@ func (in DeviceTaintSelector) OpenAPIModelName() string {
 	return "io.k8s.api.resource.v1alpha3.DeviceTaintSelector"
 }
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PartitionTypeStatus) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1alpha3.PartitionTypeStatus"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in PoolStatus) OpenAPIModelName() string {
 	return "io.k8s.api.resource.v1alpha3.PoolStatus"
@@ -85,3 +90,13 @@ func (in ResourcePoolStatusRequestSpec) OpenAPIModelName() string {
 func (in ResourcePoolStatusRequestStatus) OpenAPIModelName() string {
 	return "io.k8s.api.resource.v1alpha3.ResourcePoolStatusRequestStatus"
 }
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ShareableCapacityStatus) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1alpha3.ShareableCapacityStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in ShareableSummaryStatus) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1alpha3.ShareableSummaryStatus"
+}
diff --git a/vendor/k8s.io/api/resource/v1beta1/generated.pb.go b/vendor/k8s.io/api/resource/v1beta1/generated.pb.go
index 4170f77802..c279e0cc16 100644
--- a/vendor/k8s.io/api/resource/v1beta1/generated.pb.go
+++ b/vendor/k8s.io/api/resource/v1beta1/generated.pb.go
@@ -84,6 +84,8 @@ func (m *DeviceConstraint) Reset() { *m = DeviceConstraint{} }
 
 func (m *DeviceCounterConsumption) Reset() { *m = DeviceCounterConsumption{} }
 
+func (m *DeviceDerivedAttribute) Reset() { *m = DeviceDerivedAttribute{} }
+
 func (m *DeviceRequest) Reset() { *m = DeviceRequest{} }
 
 func (m *DeviceRequestAllocationResult) Reset() { *m = DeviceRequestAllocationResult{} }
@@ -98,7 +100,11 @@ func (m *DeviceToleration) Reset() { *m = DeviceToleration{} }
 
 func (m *NetworkDeviceData) Reset() { *m = NetworkDeviceData{} }
 
-func (m *NodeAllocatableResourceMapping) Reset() { *m = NodeAllocatableResourceMapping{} }
+func (m *NodeAllocatableMapping) Reset() { *m = NodeAllocatableMapping{} }
+
+func (m *NodeAllocatableOverhead) Reset() { *m = NodeAllocatableOverhead{} }
+
+func (m *NodeAllocatableResource) Reset() { *m = NodeAllocatableResource{} }
 
 func (m *OpaqueDeviceConfiguration) Reset() { *m = OpaqueDeviceConfiguration{} }
 
@@ -286,14 +292,14 @@ func (m *BasicDevice) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
-	if len(m.NodeAllocatableResourceMappings) > 0 {
-		keysForNodeAllocatableResourceMappings := make([]string, 0, len(m.NodeAllocatableResourceMappings))
-		for k := range m.NodeAllocatableResourceMappings {
-			keysForNodeAllocatableResourceMappings = append(keysForNodeAllocatableResourceMappings, string(k))
-		}
-		sort.Strings(keysForNodeAllocatableResourceMappings)
-		for iNdEx := len(keysForNodeAllocatableResourceMappings) - 1; iNdEx >= 0; iNdEx-- {
-			v := m.NodeAllocatableResourceMappings[k8s_io_api_core_v1.ResourceName(keysForNodeAllocatableResourceMappings[iNdEx])]
+	if len(m.NodeAllocatableResources) > 0 {
+		keysForNodeAllocatableResources := make([]string, 0, len(m.NodeAllocatableResources))
+		for k := range m.NodeAllocatableResources {
+			keysForNodeAllocatableResources = append(keysForNodeAllocatableResources, string(k))
+		}
+		sort.Strings(keysForNodeAllocatableResources)
+		for iNdEx := len(keysForNodeAllocatableResources) - 1; iNdEx >= 0; iNdEx-- {
+			v := m.NodeAllocatableResources[k8s_io_api_core_v1.ResourceName(keysForNodeAllocatableResources[iNdEx])]
 			baseI := i
 			{
 				size, err := (&v).MarshalToSizedBuffer(dAtA[:i])
@@ -305,14 +311,14 @@ func (m *BasicDevice) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			}
 			i--
 			dAtA[i] = 0x12
-			i -= len(keysForNodeAllocatableResourceMappings[iNdEx])
-			copy(dAtA[i:], keysForNodeAllocatableResourceMappings[iNdEx])
-			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForNodeAllocatableResourceMappings[iNdEx])))
+			i -= len(keysForNodeAllocatableResources[iNdEx])
+			copy(dAtA[i:], keysForNodeAllocatableResources[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForNodeAllocatableResources[iNdEx])))
 			i--
 			dAtA[i] = 0xa
 			i = encodeVarintGenerated(dAtA, i, uint64(baseI-i))
 			i--
-			dAtA[i] = 0x62
+			dAtA[i] = 0x72
 		}
 	}
 	if m.AllowMultipleAllocations != nil {
@@ -1422,6 +1428,15 @@ func (m *DeviceCounterConsumption) MarshalToSizedBuffer(dAtA []byte) (int, error
 	_ = i
 	var l int
 	_ = l
+	if len(m.CompatibilityGroups) > 0 {
+		for iNdEx := len(m.CompatibilityGroups) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.CompatibilityGroups[iNdEx])
+			copy(dAtA[i:], m.CompatibilityGroups[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.CompatibilityGroups[iNdEx])))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
 	if len(m.Counters) > 0 {
 		keysForCounters := make([]string, 0, len(m.Counters))
 		for k := range m.Counters {
@@ -1459,6 +1474,39 @@ func (m *DeviceCounterConsumption) MarshalToSizedBuffer(dAtA []byte) (int, error
 	return len(dAtA) - i, nil
 }
 
+func (m *DeviceDerivedAttribute) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DeviceDerivedAttribute) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *DeviceDerivedAttribute) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Expression)
+	copy(dAtA[i:], m.Expression)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Expression)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
 func (m *DeviceRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -1479,6 +1527,20 @@ func (m *DeviceRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if len(m.DerivedAttributes) > 0 {
+		for iNdEx := len(m.DerivedAttributes) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.DerivedAttributes[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x52
+		}
+	}
 	if m.Capacity != nil {
 		{
 			size, err := m.Capacity.MarshalToSizedBuffer(dAtA[:i])
@@ -1584,6 +1646,15 @@ func (m *DeviceRequestAllocationResult) MarshalToSizedBuffer(dAtA []byte) (int,
 	_ = i
 	var l int
 	_ = l
+	if len(m.SkipNodeOperations) > 0 {
+		for iNdEx := len(m.SkipNodeOperations) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.SkipNodeOperations[iNdEx])
+			copy(dAtA[i:], m.SkipNodeOperations[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.SkipNodeOperations[iNdEx])))
+			i--
+			dAtA[i] = 0x5a
+		}
+	}
 	if len(m.ConsumedCapacity) > 0 {
 		keysForConsumedCapacity := make([]string, 0, len(m.ConsumedCapacity))
 		for k := range m.ConsumedCapacity {
@@ -1740,6 +1811,20 @@ func (m *DeviceSubRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if len(m.DerivedAttributes) > 0 {
+		for iNdEx := len(m.DerivedAttributes) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.DerivedAttributes[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x4a
+		}
+	}
 	if m.Capacity != nil {
 		{
 			size, err := m.Capacity.MarshalToSizedBuffer(dAtA[:i])
@@ -1941,7 +2026,7 @@ func (m *NetworkDeviceData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *NodeAllocatableResourceMapping) Marshal() (dAtA []byte, err error) {
+func (m *NodeAllocatableMapping) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -1951,19 +2036,31 @@ func (m *NodeAllocatableResourceMapping) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *NodeAllocatableResourceMapping) MarshalTo(dAtA []byte) (int, error) {
+func (m *NodeAllocatableMapping) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *NodeAllocatableResourceMapping) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *NodeAllocatableMapping) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if m.AllocationMultiplier != nil {
+	if m.DeviceMultiplier != nil {
+		{
+			size, err := m.DeviceMultiplier.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.CapacityMultiplier != nil {
 		{
-			size, err := m.AllocationMultiplier.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.CapacityMultiplier.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -1983,6 +2080,100 @@ func (m *NodeAllocatableResourceMapping) MarshalToSizedBuffer(dAtA []byte) (int,
 	return len(dAtA) - i, nil
 }
 
+func (m *NodeAllocatableOverhead) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *NodeAllocatableOverhead) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *NodeAllocatableOverhead) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.PerContainer != nil {
+		{
+			size, err := m.PerContainer.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.PerPod != nil {
+		{
+			size, err := m.PerPod.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *NodeAllocatableResource) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *NodeAllocatableResource) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *NodeAllocatableResource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.Overhead != nil {
+		{
+			size, err := m.Overhead.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.Mapping != nil {
+		{
+			size, err := m.Mapping.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *OpaqueDeviceConfiguration) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -2537,6 +2728,22 @@ func (m *ResourceSliceSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if len(m.SkipNodeOperations) > 0 {
+		for iNdEx := len(m.SkipNodeOperations) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.SkipNodeOperations[iNdEx])
+			copy(dAtA[i:], m.SkipNodeOperations[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.SkipNodeOperations[iNdEx])))
+			i--
+			dAtA[i] = 0x52
+		}
+	}
+	if m.PartitionTypeAttribute != nil {
+		i -= len(*m.PartitionTypeAttribute)
+		copy(dAtA[i:], *m.PartitionTypeAttribute)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.PartitionTypeAttribute)))
+		i--
+		dAtA[i] = 0x4a
+	}
 	if len(m.SharedCounters) > 0 {
 		for iNdEx := len(m.SharedCounters) - 1; iNdEx >= 0; iNdEx-- {
 			{
@@ -2746,8 +2953,8 @@ func (m *BasicDevice) Size() (n int) {
 	if m.AllowMultipleAllocations != nil {
 		n += 2
 	}
-	if len(m.NodeAllocatableResourceMappings) > 0 {
-		for k, v := range m.NodeAllocatableResourceMappings {
+	if len(m.NodeAllocatableResources) > 0 {
+		for k, v := range m.NodeAllocatableResources {
 			_ = k
 			_ = v
 			l = v.Size()
@@ -3138,6 +3345,25 @@ func (m *DeviceCounterConsumption) Size() (n int) {
 			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
 		}
 	}
+	if len(m.CompatibilityGroups) > 0 {
+		for _, s := range m.CompatibilityGroups {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *DeviceDerivedAttribute) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Expression)
+	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
@@ -3179,6 +3405,12 @@ func (m *DeviceRequest) Size() (n int) {
 		l = m.Capacity.Size()
 		n += 1 + l + sovGenerated(uint64(l))
 	}
+	if len(m.DerivedAttributes) > 0 {
+		for _, e := range m.DerivedAttributes {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -3230,6 +3462,12 @@ func (m *DeviceRequestAllocationResult) Size() (n int) {
 			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
 		}
 	}
+	if len(m.SkipNodeOperations) > 0 {
+		for _, s := range m.SkipNodeOperations {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -3275,6 +3513,12 @@ func (m *DeviceSubRequest) Size() (n int) {
 		l = m.Capacity.Size()
 		n += 1 + l + sovGenerated(uint64(l))
 	}
+	if len(m.DerivedAttributes) > 0 {
+		for _, e := range m.DerivedAttributes {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -3336,7 +3580,7 @@ func (m *NetworkDeviceData) Size() (n int) {
 	return n
 }
 
-func (m *NodeAllocatableResourceMapping) Size() (n int) {
+func (m *NodeAllocatableMapping) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -3346,8 +3590,46 @@ func (m *NodeAllocatableResourceMapping) Size() (n int) {
 		l = len(*m.CapacityKey)
 		n += 1 + l + sovGenerated(uint64(l))
 	}
-	if m.AllocationMultiplier != nil {
-		l = m.AllocationMultiplier.Size()
+	if m.CapacityMultiplier != nil {
+		l = m.CapacityMultiplier.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.DeviceMultiplier != nil {
+		l = m.DeviceMultiplier.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *NodeAllocatableOverhead) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.PerPod != nil {
+		l = m.PerPod.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.PerContainer != nil {
+		l = m.PerContainer.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *NodeAllocatableResource) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Mapping != nil {
+		l = m.Mapping.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Overhead != nil {
+		l = m.Overhead.Size()
 		n += 1 + l + sovGenerated(uint64(l))
 	}
 	return n
@@ -3569,6 +3851,16 @@ func (m *ResourceSliceSpec) Size() (n int) {
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
+	if m.PartitionTypeAttribute != nil {
+		l = len(*m.PartitionTypeAttribute)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.SkipNodeOperations) > 0 {
+		for _, s := range m.SkipNodeOperations {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -3645,16 +3937,16 @@ func (this *BasicDevice) String() string {
 		mapStringForCapacity += fmt.Sprintf("%v: %v,", k, this.Capacity[QualifiedName(k)])
 	}
 	mapStringForCapacity += "}"
-	keysForNodeAllocatableResourceMappings := make([]string, 0, len(this.NodeAllocatableResourceMappings))
-	for k := range this.NodeAllocatableResourceMappings {
-		keysForNodeAllocatableResourceMappings = append(keysForNodeAllocatableResourceMappings, string(k))
+	keysForNodeAllocatableResources := make([]string, 0, len(this.NodeAllocatableResources))
+	for k := range this.NodeAllocatableResources {
+		keysForNodeAllocatableResources = append(keysForNodeAllocatableResources, string(k))
 	}
-	sort.Strings(keysForNodeAllocatableResourceMappings)
-	mapStringForNodeAllocatableResourceMappings := "map[k8s_io_api_core_v1.ResourceName]NodeAllocatableResourceMapping{"
-	for _, k := range keysForNodeAllocatableResourceMappings {
-		mapStringForNodeAllocatableResourceMappings += fmt.Sprintf("%v: %v,", k, this.NodeAllocatableResourceMappings[k8s_io_api_core_v1.ResourceName(k)])
+	sort.Strings(keysForNodeAllocatableResources)
+	mapStringForNodeAllocatableResources := "map[k8s_io_api_core_v1.ResourceName]NodeAllocatableResource{"
+	for _, k := range keysForNodeAllocatableResources {
+		mapStringForNodeAllocatableResources += fmt.Sprintf("%v: %v,", k, this.NodeAllocatableResources[k8s_io_api_core_v1.ResourceName(k)])
 	}
-	mapStringForNodeAllocatableResourceMappings += "}"
+	mapStringForNodeAllocatableResources += "}"
 	s := strings.Join([]string{`&BasicDevice{`,
 		`Attributes:` + mapStringForAttributes + `,`,
 		`Capacity:` + mapStringForCapacity + `,`,
@@ -3667,7 +3959,7 @@ func (this *BasicDevice) String() string {
 		`BindingConditions:` + fmt.Sprintf("%v", this.BindingConditions) + `,`,
 		`BindingFailureConditions:` + fmt.Sprintf("%v", this.BindingFailureConditions) + `,`,
 		`AllowMultipleAllocations:` + valueToStringGenerated(this.AllowMultipleAllocations) + `,`,
-		`NodeAllocatableResourceMappings:` + mapStringForNodeAllocatableResourceMappings + `,`,
+		`NodeAllocatableResources:` + mapStringForNodeAllocatableResources + `,`,
 		`}`,
 	}, "")
 	return s
@@ -3970,6 +4262,18 @@ func (this *DeviceCounterConsumption) String() string {
 	s := strings.Join([]string{`&DeviceCounterConsumption{`,
 		`CounterSet:` + fmt.Sprintf("%v", this.CounterSet) + `,`,
 		`Counters:` + mapStringForCounters + `,`,
+		`CompatibilityGroups:` + fmt.Sprintf("%v", this.CompatibilityGroups) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *DeviceDerivedAttribute) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&DeviceDerivedAttribute{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`Expression:` + fmt.Sprintf("%v", this.Expression) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -3993,6 +4297,11 @@ func (this *DeviceRequest) String() string {
 		repeatedStringForTolerations += strings.Replace(strings.Replace(f.String(), "DeviceToleration", "DeviceToleration", 1), `&`, ``, 1) + ","
 	}
 	repeatedStringForTolerations += "}"
+	repeatedStringForDerivedAttributes := "[]DeviceDerivedAttribute{"
+	for _, f := range this.DerivedAttributes {
+		repeatedStringForDerivedAttributes += strings.Replace(strings.Replace(f.String(), "DeviceDerivedAttribute", "DeviceDerivedAttribute", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForDerivedAttributes += "}"
 	s := strings.Join([]string{`&DeviceRequest{`,
 		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
 		`DeviceClassName:` + fmt.Sprintf("%v", this.DeviceClassName) + `,`,
@@ -4003,6 +4312,7 @@ func (this *DeviceRequest) String() string {
 		`FirstAvailable:` + repeatedStringForFirstAvailable + `,`,
 		`Tolerations:` + repeatedStringForTolerations + `,`,
 		`Capacity:` + strings.Replace(this.Capacity.String(), "CapacityRequirements", "CapacityRequirements", 1) + `,`,
+		`DerivedAttributes:` + repeatedStringForDerivedAttributes + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4037,6 +4347,7 @@ func (this *DeviceRequestAllocationResult) String() string {
 		`BindingFailureConditions:` + fmt.Sprintf("%v", this.BindingFailureConditions) + `,`,
 		`ShareID:` + valueToStringGenerated(this.ShareID) + `,`,
 		`ConsumedCapacity:` + mapStringForConsumedCapacity + `,`,
+		`SkipNodeOperations:` + fmt.Sprintf("%v", this.SkipNodeOperations) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4065,6 +4376,11 @@ func (this *DeviceSubRequest) String() string {
 		repeatedStringForTolerations += strings.Replace(strings.Replace(f.String(), "DeviceToleration", "DeviceToleration", 1), `&`, ``, 1) + ","
 	}
 	repeatedStringForTolerations += "}"
+	repeatedStringForDerivedAttributes := "[]DeviceDerivedAttribute{"
+	for _, f := range this.DerivedAttributes {
+		repeatedStringForDerivedAttributes += strings.Replace(strings.Replace(f.String(), "DeviceDerivedAttribute", "DeviceDerivedAttribute", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForDerivedAttributes += "}"
 	s := strings.Join([]string{`&DeviceSubRequest{`,
 		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
 		`DeviceClassName:` + fmt.Sprintf("%v", this.DeviceClassName) + `,`,
@@ -4073,6 +4389,7 @@ func (this *DeviceSubRequest) String() string {
 		`Count:` + fmt.Sprintf("%v", this.Count) + `,`,
 		`Tolerations:` + repeatedStringForTolerations + `,`,
 		`Capacity:` + strings.Replace(this.Capacity.String(), "CapacityRequirements", "CapacityRequirements", 1) + `,`,
+		`DerivedAttributes:` + repeatedStringForDerivedAttributes + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4103,13 +4420,36 @@ func (this *NetworkDeviceData) String() string {
 	}, "")
 	return s
 }
-func (this *NodeAllocatableResourceMapping) String() string {
+func (this *NodeAllocatableMapping) String() string {
 	if this == nil {
 		return "nil"
 	}
-	s := strings.Join([]string{`&NodeAllocatableResourceMapping{`,
+	s := strings.Join([]string{`&NodeAllocatableMapping{`,
 		`CapacityKey:` + valueToStringGenerated(this.CapacityKey) + `,`,
-		`AllocationMultiplier:` + strings.Replace(fmt.Sprintf("%v", this.AllocationMultiplier), "Quantity", "resource.Quantity", 1) + `,`,
+		`CapacityMultiplier:` + strings.Replace(fmt.Sprintf("%v", this.CapacityMultiplier), "Quantity", "resource.Quantity", 1) + `,`,
+		`DeviceMultiplier:` + strings.Replace(fmt.Sprintf("%v", this.DeviceMultiplier), "Quantity", "resource.Quantity", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *NodeAllocatableOverhead) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&NodeAllocatableOverhead{`,
+		`PerPod:` + strings.Replace(fmt.Sprintf("%v", this.PerPod), "Quantity", "resource.Quantity", 1) + `,`,
+		`PerContainer:` + strings.Replace(fmt.Sprintf("%v", this.PerContainer), "Quantity", "resource.Quantity", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *NodeAllocatableResource) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&NodeAllocatableResource{`,
+		`Mapping:` + strings.Replace(this.Mapping.String(), "NodeAllocatableMapping", "NodeAllocatableMapping", 1) + `,`,
+		`Overhead:` + strings.Replace(this.Overhead.String(), "NodeAllocatableOverhead", "NodeAllocatableOverhead", 1) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4298,6 +4638,8 @@ func (this *ResourceSliceSpec) String() string {
 		`Devices:` + repeatedStringForDevices + `,`,
 		`PerDeviceNodeSelection:` + valueToStringGenerated(this.PerDeviceNodeSelection) + `,`,
 		`SharedCounters:` + repeatedStringForSharedCounters + `,`,
+		`PartitionTypeAttribute:` + valueToStringGenerated(this.PartitionTypeAttribute) + `,`,
+		`SkipNodeOperations:` + fmt.Sprintf("%v", this.SkipNodeOperations) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -5301,9 +5643,9 @@ func (m *BasicDevice) Unmarshal(dAtA []byte) error {
 			}
 			b := bool(v != 0)
 			m.AllowMultipleAllocations = &b
-		case 12:
+		case 14:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NodeAllocatableResourceMappings", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeAllocatableResources", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -5330,11 +5672,11 @@ func (m *BasicDevice) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.NodeAllocatableResourceMappings == nil {
-				m.NodeAllocatableResourceMappings = make(map[k8s_io_api_core_v1.ResourceName]NodeAllocatableResourceMapping)
+			if m.NodeAllocatableResources == nil {
+				m.NodeAllocatableResources = make(map[k8s_io_api_core_v1.ResourceName]NodeAllocatableResource)
 			}
 			var mapkey k8s_io_api_core_v1.ResourceName
-			mapvalue := &NodeAllocatableResourceMapping{}
+			mapvalue := &NodeAllocatableResource{}
 			for iNdEx < postIndex {
 				entryPreIndex := iNdEx
 				var wire uint64
@@ -5408,7 +5750,7 @@ func (m *BasicDevice) Unmarshal(dAtA []byte) error {
 					if postmsgIndex > l {
 						return io.ErrUnexpectedEOF
 					}
-					mapvalue = &NodeAllocatableResourceMapping{}
+					mapvalue = &NodeAllocatableResource{}
 					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
 						return err
 					}
@@ -5428,7 +5770,7 @@ func (m *BasicDevice) Unmarshal(dAtA []byte) error {
 					iNdEx += skippy
 				}
 			}
-			m.NodeAllocatableResourceMappings[k8s_io_api_core_v1.ResourceName(mapkey)] = *mapvalue
+			m.NodeAllocatableResources[k8s_io_api_core_v1.ResourceName(mapkey)] = *mapvalue
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -8347,17 +8689,163 @@ func (m *DeviceCounterConsumption) Unmarshal(dAtA []byte) error {
 			}
 			m.Counters[mapkey] = *mapvalue
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CompatibilityGroups", wireType)
 			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CompatibilityGroups = append(m.CompatibilityGroups, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeviceDerivedAttribute) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeviceDerivedAttribute: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeviceDerivedAttribute: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = FullyQualifiedName(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Expression", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Expression = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
 			}
 			iNdEx += skippy
 		}
@@ -8671,6 +9159,40 @@ func (m *DeviceRequest) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DerivedAttributes", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DerivedAttributes = append(m.DerivedAttributes, DeviceDerivedAttribute{})
+			if err := m.DerivedAttributes[len(m.DerivedAttributes)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -9130,6 +9652,38 @@ func (m *DeviceRequestAllocationResult) Unmarshal(dAtA []byte) error {
 			}
 			m.ConsumedCapacity[QualifiedName(mapkey)] = *mapvalue
 			iNdEx = postIndex
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SkipNodeOperations", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SkipNodeOperations = append(m.SkipNodeOperations, SkipNodeOperation(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -9485,6 +10039,40 @@ func (m *DeviceSubRequest) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DerivedAttributes", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DerivedAttributes = append(m.DerivedAttributes, DeviceDerivedAttribute{})
+			if err := m.DerivedAttributes[len(m.DerivedAttributes)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -9569,7 +10157,355 @@ func (m *DeviceTaint) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Value = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Effect", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Effect = DeviceTaintEffect(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TimeAdded", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.TimeAdded == nil {
+				m.TimeAdded = &v1.Time{}
+			}
+			if err := m.TimeAdded.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeviceToleration: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeviceToleration: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Key = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Operator", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Operator = DeviceTolerationOperator(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Value = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Effect", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Effect = DeviceTaintEffect(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TolerationSeconds", wireType)
+			}
+			var v int64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.TolerationSeconds = &v
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *NetworkDeviceData) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NetworkDeviceData: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NetworkDeviceData: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InterfaceName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -9597,11 +10533,11 @@ func (m *DeviceTaint) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Value = string(dAtA[iNdEx:postIndex])
+			m.InterfaceName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Effect", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field IPs", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -9629,13 +10565,13 @@ func (m *DeviceTaint) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Effect = DeviceTaintEffect(dAtA[iNdEx:postIndex])
+			m.IPs = append(m.IPs, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
-		case 4:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TimeAdded", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field HardwareAddress", wireType)
 			}
-			var msglen int
+			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9645,27 +10581,23 @@ func (m *DeviceTaint) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				msglen |= int(b&0x7F) << shift
+				stringLen |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			if msglen < 0 {
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + msglen
+			postIndex := iNdEx + intStringLen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.TimeAdded == nil {
-				m.TimeAdded = &v1.Time{}
-			}
-			if err := m.TimeAdded.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
+			m.HardwareAddress = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -9688,7 +10620,7 @@ func (m *DeviceTaint) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
+func (m *NodeAllocatableMapping) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -9711,15 +10643,15 @@ func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: DeviceToleration: wiretype end group for non-group")
+			return fmt.Errorf("proto: NodeAllocatableMapping: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: DeviceToleration: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: NodeAllocatableMapping: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CapacityKey", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -9747,13 +10679,14 @@ func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Key = string(dAtA[iNdEx:postIndex])
+			s := QualifiedName(dAtA[iNdEx:postIndex])
+			m.CapacityKey = &s
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Operator", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CapacityMultiplier", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9763,61 +10696,33 @@ func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Operator = DeviceTolerationOperator(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
+			if m.CapacityMultiplier == nil {
+				m.CapacityMultiplier = &resource.Quantity{}
 			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			if err := m.CapacityMultiplier.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.Value = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 4:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Effect", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceMultiplier", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9827,44 +10732,28 @@ func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Effect = DeviceTaintEffect(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 5:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TolerationSeconds", wireType)
+			if m.DeviceMultiplier == nil {
+				m.DeviceMultiplier = &resource.Quantity{}
 			}
-			var v int64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				v |= int64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+			if err := m.DeviceMultiplier.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.TolerationSeconds = &v
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -9886,7 +10775,7 @@ func (m *DeviceToleration) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *NetworkDeviceData) Unmarshal(dAtA []byte) error {
+func (m *NodeAllocatableOverhead) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -9909,17 +10798,17 @@ func (m *NetworkDeviceData) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: NetworkDeviceData: wiretype end group for non-group")
+			return fmt.Errorf("proto: NodeAllocatableOverhead: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: NetworkDeviceData: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: NodeAllocatableOverhead: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field InterfaceName", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PerPod", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9929,29 +10818,33 @@ func (m *NetworkDeviceData) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.InterfaceName = string(dAtA[iNdEx:postIndex])
+			if m.PerPod == nil {
+				m.PerPod = &resource.Quantity{}
+			}
+			if err := m.PerPod.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field IPs", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PerContainer", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -9961,55 +10854,27 @@ func (m *NetworkDeviceData) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.IPs = append(m.IPs, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field HardwareAddress", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthGenerated
+			if m.PerContainer == nil {
+				m.PerContainer = &resource.Quantity{}
 			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
+			if err := m.PerContainer.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
 			}
-			m.HardwareAddress = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -10032,7 +10897,7 @@ func (m *NetworkDeviceData) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *NodeAllocatableResourceMapping) Unmarshal(dAtA []byte) error {
+func (m *NodeAllocatableResource) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -10055,17 +10920,17 @@ func (m *NodeAllocatableResourceMapping) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: NodeAllocatableResourceMapping: wiretype end group for non-group")
+			return fmt.Errorf("proto: NodeAllocatableResource: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: NodeAllocatableResourceMapping: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: NodeAllocatableResource: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
-		case 1:
+		case 3:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field CapacityKey", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Mapping", wireType)
 			}
-			var stringLen uint64
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -10075,28 +10940,31 @@ func (m *NodeAllocatableResourceMapping) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
-			postIndex := iNdEx + intStringLen
+			postIndex := iNdEx + msglen
 			if postIndex < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			s := QualifiedName(dAtA[iNdEx:postIndex])
-			m.CapacityKey = &s
+			if m.Mapping == nil {
+				m.Mapping = &NodeAllocatableMapping{}
+			}
+			if err := m.Mapping.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
 			iNdEx = postIndex
-		case 2:
+		case 4:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AllocationMultiplier", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Overhead", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -10123,10 +10991,10 @@ func (m *NodeAllocatableResourceMapping) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.AllocationMultiplier == nil {
-				m.AllocationMultiplier = &resource.Quantity{}
+			if m.Overhead == nil {
+				m.Overhead = &NodeAllocatableOverhead{}
 			}
-			if err := m.AllocationMultiplier.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.Overhead.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -11920,6 +12788,71 @@ func (m *ResourceSliceSpec) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PartitionTypeAttribute", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := FullyQualifiedName(dAtA[iNdEx:postIndex])
+			m.PartitionTypeAttribute = &s
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SkipNodeOperations", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SkipNodeOperations = append(m.SkipNodeOperations, SkipNodeOperation(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
diff --git a/vendor/k8s.io/api/resource/v1beta1/generated.proto b/vendor/k8s.io/api/resource/v1beta1/generated.proto
index 79a51ee2c8..874a34db39 100644
--- a/vendor/k8s.io/api/resource/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/resource/v1beta1/generated.proto
@@ -65,8 +65,8 @@ message AllocatedDeviceStatus {
   //
   // +optional
   // +featureGate=DRAConsumableCapacity
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-uuid
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-uuid
   optional string shareID = 7;
 
   // Conditions contains the latest observation of the device's state.
@@ -78,6 +78,9 @@ message AllocatedDeviceStatus {
   // +optional
   // +listType=map
   // +listMapKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 4;
 
   // Data contains arbitrary driver-specific data.
@@ -90,7 +93,7 @@ message AllocatedDeviceStatus {
   // NetworkData contains network-related information specific to the device.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional NetworkDeviceData networkData = 6;
 }
 
@@ -126,7 +129,7 @@ message BasicDevice {
   // The maximum number of attributes and capacities combined is 32.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   map<string, DeviceAttribute> attributes = 1;
 
   // Capacity defines the set of capacities for this device.
@@ -147,13 +150,13 @@ message BasicDevice {
   // device is 2.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +listType=atomic
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=counterSet
+  // +k8s:beta(since: "1.37")=+k8s:unique=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=counterSet
   // +featureGate=DRAPartitionableDevices
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=2
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=2
   repeated DeviceCounterConsumption consumesCounters = 3;
 
   // NodeName identifies the node where the device is available.
@@ -199,7 +202,7 @@ message BasicDevice {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceTaints
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated DeviceTaint taints = 7;
 
   // BindsToNode indicates if the usage of an allocation involving this device
@@ -229,8 +232,8 @@ message BasicDevice {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=4
   repeated string bindingConditions = 9;
 
   // BindingFailureConditions defines the conditions for binding failure.
@@ -247,8 +250,8 @@ message BasicDevice {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=4
   repeated string bindingFailureConditions = 10;
 
   // AllowMultipleAllocations marks whether the device is allowed to be allocated to multiple DeviceRequests.
@@ -260,7 +263,7 @@ message BasicDevice {
   // +featureGate=DRAConsumableCapacity
   optional bool allowMultipleAllocations = 11;
 
-  // NodeAllocatableResourceMappings defines the mapping of node resources
+  // NodeAllocatableResources defines the mapping of node resources
   // that are managed by the DRA driver exposing this device. This includes resources currently
   // reported in v1.Node `status.allocatable` that are not extended resources
   // (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources).
@@ -272,8 +275,9 @@ message BasicDevice {
   // The keys of this map are the node-allocatable resource names (e.g., "cpu", "memory").
   // Extended resource names are not permitted as keys.
   // +optional
+  // +k8s:optional
   // +featureGate=DRANodeAllocatableResources
-  map<string, NodeAllocatableResourceMapping> nodeAllocatableResourceMappings = 12;
+  map<string, NodeAllocatableResource> nodeAllocatableResources = 14;
 }
 
 // CELDeviceSelector contains a CEL expression for selecting a device.
@@ -288,7 +292,7 @@ message CELDeviceSelector {
   //  - driver (string): the name of the driver which defines this device.
   //  - attributes (map[string]object): the device's attributes, grouped by prefix
   //    (e.g. device.attributes["dra.example.com"] evaluates to an object with all
-  //    of the attributes which were prefixed by "dra.example.com".
+  //    of the attributes which were prefixed by "dra.example.com").
   //  - capacity (map[string]object): the device's capacities, grouped by prefix.
   //  - allowMultipleAllocations (bool): the allowMultipleAllocations property of the device
   //    (v1.34+ with the DRAConsumableCapacity feature enabled).
@@ -321,6 +325,15 @@ message CELDeviceSelector {
   // A robust expression should check for the existence of attributes
   // before referencing them.
   //
+  // Common errors:
+  // - "no such key": Use optional chaining (.? followed by orValue())
+  //   or guarding the check with has() for optional fields.
+  //   See CEL Optional Types for details:
+  //   https://pkg.go.dev/github.com/google/cel-go@v0.17.4/cel#OptionalTypes
+  //
+  // For more CEL expression syntax and examples, see:
+  // https://kubernetes.io/docs/reference/using-api/cel/
+  //
   // For ease of use, the cel.bind() function is enabled, and can be used
   // to simplify expressions that access multiple attributes with the
   // same domain. For example:
@@ -390,6 +403,13 @@ message CapacityRequestPolicy {
 
 // CapacityRequestPolicyRange defines a valid range for consumable capacity values.
 //
+// If the DRAFractionalCapacityRange feature gate is
+// enabled and at least one of Min, Max, or Step is a fractional quantity (i.e.
+// its value is not an integer), milli-unit arithmetic is used instead,
+// supporting values with up to 3 decimal places (e.g. 100m = 0.1).
+// The largest supported value then is 1000 times smaller compared to using 64-bit integers.
+// Otherwise, all comparisons use 64-bit integer arithmetic via resource.Quantity.Value().
+//
 //   - If the requested amount is less than Min, it is rounded up to the Min value.
 //   - If Step is set and the requested amount is between Min and Max but not aligned with Step,
 //     it will be rounded up to the next value equal to Min + (n * Step).
@@ -473,8 +493,8 @@ message CounterSet {
   // It must be a DNS label.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-short-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-short-name
   optional string name = 1;
 
   // Counters defines the set of counters for this CounterSet
@@ -483,8 +503,8 @@ message CounterSet {
   // The maximum number of counters is 32.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:eachKey=+k8s:format=k8s-short-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:eachKey=+k8s:format=k8s-short-name
   map<string, Counter> counters = 2;
 }
 
@@ -501,7 +521,7 @@ message Device {
   //
   // +optional
   // +oneOf=deviceType
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional BasicDevice basic = 2;
 }
 
@@ -512,7 +532,7 @@ message DeviceAllocationConfiguration {
   // or from a claim.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string source = 1;
 
   // Requests lists the names of requests where the configuration applies.
@@ -524,10 +544,10 @@ message DeviceAllocationConfiguration {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=set
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:unique=set
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated string requests = 2;
 
   optional DeviceConfiguration deviceConfiguration = 3;
@@ -539,8 +559,8 @@ message DeviceAllocationResult {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceRequestAllocationResult results = 1;
 
   // This field is a combination of all the claim and class configuration parameters.
@@ -553,8 +573,8 @@ message DeviceAllocationResult {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=64
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=64
   repeated DeviceAllocationConfiguration config = 2;
 }
 
@@ -563,30 +583,30 @@ message DeviceAttribute {
   // IntValue is a number.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   optional int64 int = 2;
 
   // BoolValue is a true/false value.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   optional bool bool = 3;
 
   // StringValue is a string. Must not be longer than 64 characters.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   optional string string = 4;
 
   // VersionValue is a semantic version according to semver.org spec 2.0.0.
   // Must not be longer than 64 characters.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   optional string version = 5;
 
   // IntValues is a non-empty list of numbers.
@@ -595,8 +615,8 @@ message DeviceAttribute {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   // +featureGate=DRAListTypeAttributes
   repeated int64 ints = 6;
 
@@ -604,8 +624,8 @@ message DeviceAttribute {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   // +featureGate=DRAListTypeAttributes
   repeated bool bools = 7;
 
@@ -616,8 +636,9 @@ message DeviceAttribute {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
+  // +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:maxBytes=64
   // +featureGate=DRAListTypeAttributes
   repeated string strings = 8;
 
@@ -628,8 +649,8 @@ message DeviceAttribute {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   // +featureGate=DRAListTypeAttributes
   repeated string versions = 9;
 }
@@ -667,11 +688,11 @@ message DeviceClaim {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:unique=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=name
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceRequest requests = 1;
 
   // These constraints must be satisfied by the set of devices that get
@@ -679,8 +700,8 @@ message DeviceClaim {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceConstraint constraints = 2;
 
   // This field holds configuration for multiple potential drivers which
@@ -689,8 +710,8 @@ message DeviceClaim {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceClaimConfiguration config = 3;
 }
 
@@ -705,10 +726,10 @@ message DeviceClaimConfiguration {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=set
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:unique=set
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated string requests = 1;
 
   optional DeviceConfiguration deviceConfiguration = 2;
@@ -724,8 +745,8 @@ message DeviceClaimConfiguration {
 message DeviceClass {
   // Standard object metadata
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:format=k8s-long-name
+  // +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:format=k8s-long-name
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Spec defines what can be allocated and how to configure it.
@@ -736,6 +757,7 @@ message DeviceClass {
   // the time of allocation.
   //
   // Changing the spec automatically increments the metadata.generation number.
+  // +optional
   optional DeviceClassSpec spec = 2;
 }
 
@@ -761,8 +783,8 @@ message DeviceClassSpec {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceSelector selectors = 1;
 
   // Config defines configuration parameters that apply to each device that is claimed via this class.
@@ -773,8 +795,8 @@ message DeviceClassSpec {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceClassConfiguration config = 2;
 
   // ExtendedResourceName is the extended resource name for the devices of this class.
@@ -786,11 +808,10 @@ message DeviceClassSpec {
   // If two classes are created at the same time, then the name of the class
   // lexicographically sorted first is picked.
   //
-  // This is a beta field.
   // +optional
   // +featureGate=DRAExtendedResource
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-extended-resource-name
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-extended-resource-name
   optional string extendedResourceName = 4;
 }
 
@@ -802,7 +823,7 @@ message DeviceConfiguration {
   //
   // +optional
   // +oneOf=ConfigurationType
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional OpaqueDeviceConfiguration opaque = 1;
 }
 
@@ -820,10 +841,10 @@ message DeviceConstraint {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=set
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:unique=set
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated string requests = 1;
 
   // MatchAttribute requires that all devices in question have this
@@ -846,8 +867,8 @@ message DeviceConstraint {
   //
   // +optional
   // +oneOf=ConstraintType
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-resource-fully-qualified-name
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-fully-qualified-name
   optional string matchAttribute = 2;
 
   // DistinctAttribute requires that all devices in question have this
@@ -869,6 +890,8 @@ message DeviceConstraint {
   // +optional
   // +oneOf=ConstraintType
   // +featureGate=DRAConsumableCapacity
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-fully-qualified-name
   optional string distinctAttribute = 3;
 }
 
@@ -879,8 +902,8 @@ message DeviceCounterConsumption {
   // counters defined will be consumed.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-short-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-short-name
   optional string counterSet = 1;
 
   // Counters defines the counters that will be consumed by the device.
@@ -888,9 +911,94 @@ message DeviceCounterConsumption {
   // The maximum number of counters is 32.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:eachKey=+k8s:format=k8s-short-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:eachKey=+k8s:format=k8s-short-name
   map<string, Counter> counters = 2;
+
+  // CompatibilityGroups is a list of opaque group names for
+  // this counter set consumption.
+  //
+  // Devices that consume counters from the same counter set may only be
+  // allocated at the same time ("co-allocated") if they all share at least
+  // one common group: the intersection of the CompatibilityGroups of all
+  // co-allocated devices on that counter set must be non-empty. Devices
+  // that consume from different counter sets are never compared via this
+  // field.
+  //
+  // An unset field, an explicit nil, and an empty list are equivalent and
+  // mean "no groups": such a device is only co-allocatable with sibling
+  // devices on the same counter set that also have no groups, and is never
+  // co-allocatable with a device that declares one or more groups.
+  //
+  // Group names are opaque and meaningful only within the
+  // publishing driver's pool.
+  //
+  // The maximum number of groups is 2, and the names must be unique.
+  //
+  // +optional
+  // +listType=atomic
+  // +featureGate=DRADeviceCompatibilityGroups
+  // +k8s:listType=atomic
+  // +k8s:optional
+  // +k8s:maxItems=2
+  // +k8s:unique=set
+  // +k8s:eachVal=+k8s:format=k8s-short-name
+  repeated string compatibilityGroups = 3;
+}
+
+// DeviceDerivedAttribute defines a derived attribute computed via CEL.
+message DeviceDerivedAttribute {
+  // Name is the identifier for this derived attribute, used in constraints.
+  //
+  // It must be a DNS subdomain followed by a slash ("/") followed by a C identifier
+  // (e.g. "example.com/numaNode" or "derived/numaNode").
+  //
+  // If the chosen name matches an existing physical attribute from a driver,
+  // the derived attribute's expression will shadow the physical attribute,
+  // and its evaluated value will be used in constraints instead. When the goal
+  // is to define a derived attribute that is only used within the ResourceClaim
+  // and not meant to shadow an existing attribute, use a domain prefix that
+  // no DRA driver should be using (e.g. "derived/myAttribute").
+  //
+  // It is not valid to define a derived attribute that isn't used in at least
+  // one constraint.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-resource-fully-qualified-name
+  optional string name = 1;
+
+  // Expression is a CEL expression evaluated against each candidate device.
+  // The expression must evaluate to a primitive scalar (string, integer,
+  // boolean, or semver) or a list of these scalars ([]string, []int64,
+  // []bool, []semver) to act as a virtual grouping key. Any other return type
+  // is an error and causes CEL evaluation for the device to fail.
+  //
+  // The expression's input is an object named "device", which carries the
+  // same properties as in a CELDeviceSelector.
+  //
+  // When pod scheduling encounters CEL runtime errors (such as looking
+  // up an attribute that isn't defined) for some devices, it will abort
+  // allocation and fail scheduling for the Pod. Surfacing evaluation
+  // errors immediately prevents silent topology matching failures that are
+  // extremely hard to detect. A robust expression should, for example, check
+  // for the existence of attributes before referencing them to avoid
+  // runtime evaluation errors.
+  //
+  // The expression gets evaluated after a device has passed the other
+  // selector expressions for the request in which this expression is used.
+  // This allows writing expressions that are tailored towards the specific
+  // devices being requested (for example, by assuming the device is from a
+  // certain vendor and skipping those checks).
+  //
+  // The length of the expression must be smaller or equal to 10 Ki. The
+  // cost of evaluating it is also limited based on the estimated number
+  // of logical steps; the combined cost of all derived attributes in a
+  // claim is capped by a shared CEL cost budget.
+  //
+  // +required
+  // +k8s:required
+  optional string expression = 2;
 }
 
 // DeviceRequest is a request for devices required for a claim.
@@ -935,8 +1043,8 @@ message DeviceRequest {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceSelector selectors = 3;
 
   // AllocationMode and its related fields define how devices are allocated
@@ -962,7 +1070,7 @@ message DeviceRequest {
   // requests with unknown modes.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string allocationMode = 4;
 
   // Count is used only when the count mode is "ExactCount". Must be greater than zero.
@@ -1012,11 +1120,11 @@ message DeviceRequest {
   // +oneOf=deviceRequestType
   // +listType=atomic
   // +featureGate=DRAPrioritizedList
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=8
+  // +k8s:beta(since: "1.37")=+k8s:unique=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=name
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=8
   repeated DeviceSubRequest firstAvailable = 7;
 
   // If specified, the request's tolerations.
@@ -1043,7 +1151,7 @@ message DeviceRequest {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceTaints
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated DeviceToleration tolerations = 8;
 
   // Capacity define resource requirements against each capacity.
@@ -1062,6 +1170,34 @@ message DeviceRequest {
   // +optional
   // +featureGate=DRAConsumableCapacity
   optional CapacityRequirements capacity = 9;
+
+  // DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+  // for each candidate device. These virtual attributes can be referenced in
+  // `.devices.constraints` to align and match different devices (e.g., co-allocating
+  // a GPU and a NIC on the same NUMA node) even if their drivers publish different
+  // attributes. Derived attributes are not available via `device.attributes`
+  // in the CEL environment when evaluating selector expressions.
+  //
+  // Derived attributes allow you to extract, transform, or normalize topology
+  // information (such as extracting a NUMA index from a complex topology string or
+  // renaming a vendor-specific attribute) into a common virtual attribute name at
+  // scheduling time. The scheduler then evaluates these virtual attributes exactly
+  // like static attributes when matching constraints.
+  //
+  // Every derived attribute defined in this list must be referenced by at least one
+  // MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+  //
+  // The maximum number of derived attributes is 32.
+  //
+  // This is an alpha field and requires enabling the DRADerivedAttributes
+  // feature gate.
+  //
+  // +optional
+  // +listType=atomic
+  // +featureGate=DRADerivedAttributes
+  // +k8s:optional
+  // +k8s:maxItems=32
+  repeated DeviceDerivedAttribute derivedAttributes = 10;
 }
 
 // DeviceRequestAllocationResult contains the allocation result for one request.
@@ -1085,9 +1221,9 @@ message DeviceRequestAllocationResult {
   // vendor of the driver. It should use only lower case characters.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name-caseless
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:maxLength=63
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name-caseless
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:maxLength=63
   optional string driver = 2;
 
   // This name together with the driver name and the device name field
@@ -1097,8 +1233,8 @@ message DeviceRequestAllocationResult {
   // DNS sub-domains separated by slashes.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-resource-pool-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-pool-name
   optional string pool = 3;
 
   // Device references one device instance via its name in the driver's
@@ -1130,8 +1266,7 @@ message DeviceRequestAllocationResult {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceTaints
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=16
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated DeviceToleration tolerations = 6;
 
   // BindingConditions contains a copy of the BindingConditions
@@ -1143,8 +1278,8 @@ message DeviceRequestAllocationResult {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=4
   repeated string bindingConditions = 7;
 
   // BindingFailureConditions contains a copy of the BindingFailureConditions
@@ -1156,8 +1291,8 @@ message DeviceRequestAllocationResult {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=4
   repeated string bindingFailureConditions = 8;
 
   // ShareID uniquely identifies an individual allocation share of the device,
@@ -1167,8 +1302,8 @@ message DeviceRequestAllocationResult {
   //
   // +optional
   // +featureGate=DRAConsumableCapacity
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-uuid
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-uuid
   optional string shareID = 9;
 
   // ConsumedCapacity tracks the amount of capacity consumed per device as part of the claim request.
@@ -1183,6 +1318,19 @@ message DeviceRequestAllocationResult {
   // +optional
   // +featureGate=DRAConsumableCapacity
   map<string, .k8s.io.apimachinery.pkg.api.resource.Quantity> consumedCapacity = 10;
+
+  // SkipNodeOperations lists node-local resource operations (gRPC calls)
+  // that will be skipped for this allocated device when determining whether
+  // operations are necessary on the node. If all allocated devices for a driver in
+  // a claim skip an operation, that gRPC call will be skipped. It is a copy of
+  // the ResourceSlice.spec.skipNodeOperations value at the time when the device was allocated.
+  //
+  // +optional
+  // +listType=set
+  // +k8s:listType=set
+  // +featureGate=DRAOptionalNodeOperations
+  // +k8s:optional
+  repeated string skipNodeOperations = 11;
 }
 
 // DeviceSelector must have exactly one field set.
@@ -1226,8 +1374,8 @@ message DeviceSubRequest {
   // to reference.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name
   optional string deviceClassName = 2;
 
   // Selectors define criteria which must be satisfied by a specific
@@ -1237,8 +1385,8 @@ message DeviceSubRequest {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated DeviceSelector selectors = 3;
 
   // AllocationMode and its related fields define how devices are allocated
@@ -1260,7 +1408,7 @@ message DeviceSubRequest {
   // requests with unknown modes.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string allocationMode = 4;
 
   // Count is used only when the count mode is "ExactCount". Must be greater than zero.
@@ -1291,7 +1439,7 @@ message DeviceSubRequest {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceTaints
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated DeviceToleration tolerations = 7;
 
   // Capacity define resource requirements against each capacity.
@@ -1310,6 +1458,34 @@ message DeviceSubRequest {
   // +optional
   // +featureGate=DRAConsumableCapacity
   optional CapacityRequirements capacity = 8;
+
+  // DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+  // for each candidate device. These virtual attributes can be referenced in
+  // `.devices.constraints` to align and match different devices (e.g., co-allocating
+  // a GPU and a NIC on the same NUMA node) even if their drivers publish different
+  // attributes. Derived attributes are not available via `device.attributes`
+  // in the CEL environment when evaluating selector expressions.
+  //
+  // Derived attributes allow you to extract, transform, or normalize topology
+  // information (such as extracting a NUMA index from a complex topology string or
+  // renaming a vendor-specific attribute) into a common virtual attribute name at
+  // scheduling time. The scheduler then evaluates these virtual attributes exactly
+  // like static attributes when matching constraints.
+  //
+  // Every derived attribute defined in this list must be referenced by at least one
+  // MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+  //
+  // The maximum number of derived attributes is 32.
+  //
+  // This is an alpha field and requires enabling the DRADerivedAttributes
+  // feature gate.
+  //
+  // +optional
+  // +listType=atomic
+  // +featureGate=DRADerivedAttributes
+  // +k8s:optional
+  // +k8s:maxItems=32
+  repeated DeviceDerivedAttribute derivedAttributes = 9;
 }
 
 // The device this taint is attached to has the "effect" on
@@ -1338,7 +1514,7 @@ message DeviceTaint {
   // Consumers must treat unknown effects like None.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string effect = 3;
 
   // TimeAdded represents the time at which the taint was added or
@@ -1365,8 +1541,8 @@ message DeviceToleration {
   // Must be a label name.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-label-key
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-label-key
   optional string key = 1;
 
   // Operator represents a key's relationship to the value.
@@ -1376,7 +1552,7 @@ message DeviceToleration {
   //
   // +optional
   // +default="Equal"
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string operator = 2;
 
   // Value is the taint value the toleration matches to.
@@ -1390,7 +1566,7 @@ message DeviceToleration {
   // When specified, allowed values are NoSchedule and NoExecute.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string effect = 4;
 
   // TolerationSeconds represents the period of time the toleration (which must be
@@ -1415,8 +1591,8 @@ message NetworkDeviceData {
   // Must not be longer than 256 bytes.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxBytes=256
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxBytes=256
   optional string interfaceName = 1;
 
   // IPs lists the network addresses assigned to the device's network interface.
@@ -1429,10 +1605,10 @@ message NetworkDeviceData {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=set
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=16
+  // +k8s:beta(since: "1.37")=+k8s:unique=set
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=16
   repeated string ips = 2;
 
   // HardwareAddress represents the hardware address (e.g. MAC Address) of the device's network interface.
@@ -1440,47 +1616,104 @@ message NetworkDeviceData {
   // Must not be longer than 128 bytes.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxBytes=128
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxBytes=128
   optional string hardwareAddress = 3;
 }
 
-// NodeAllocatableResourceMapping defines the translation between the DRA device/capacity
-// units requested to the corresponding quantity of the node allocatable resource.
-message NodeAllocatableResourceMapping {
+// NodeAllocatableMapping defines how a DRA allocation directly translates into a node allocatable resource quantity.
+// The mapping can be derived from either the count of allocated devices or the specific capacity consumed. These options are mutually exclusive.
+// Kubelet adds this mapped resource quantity from claim to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.
+message NodeAllocatableMapping {
   // CapacityKey references a capacity name defined as a key in the
   // `spec.devices[*].capacity` map. When this field is set, the value associated with
   // this key in the `status.allocation.devices.results[*].consumedCapacity` map
   // (for a specific claim allocation) determines the base quantity for
-  // the node allocatable resource. If `allocationMultiplier` is also set, it is
+  // the node allocatable resource. `capacityMultiplier` must also be set and is
   // multiplied with the base quantity.
   // For example, if `spec.devices[*].capacity` has an entry "dra.example.com/memory": "128Gi",
   // and this field is set to "dra.example.com/memory", then for a claim allocation
   // that consumes { "dra.example.com/memory": "4Gi" } the base quantity for the
-  // node allocatable resource mapping will be "4Gi", and `allocationMultiplier` should
-  // be omitted or set to "1".
+  // node allocatable resource mapping will be "4Gi".
+  // The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
   // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:alpha(since: "1.37")=+k8s:dependentRequired("capacityMultiplier")
   optional string capacityKey = 1;
 
-  // AllocationMultiplier is used as a multiplier for the allocated device count or the allocated capacity in the claim.
-  // It defaults to 1 if not specified. How the field is used also depends on whether `capacityKey` is set.
-  // 1.  If `capacityKey` is NOT set: `allocationMultiplier` multiplies the device count allocated to the claim.
-  // 	   a. A DRA driver representing each CPU core as a device would have
-  //        {ResourceName: "cpu", allocationMultiplier: "2"} in its
-  //        `nodeAllocatableResourceMappings`. If 4 devices are allocated to the claim,
-  // 		  4 * 2 CPUs would be considered as allocated and subtracted from the node's capacity.
-  //     b. A GPU device that needs additional node memory per GPU allocation would
-  //        have {ResourceName: "memory", allocationMultiplier: "2Gi"}.  Each allocated
-  // 		  GPU device instance of this type will account for 2Gi of memory.
-  //
-  // 2.  If `capacityKey` IS set: `allocationMultiplier` is multiplied by the amount of that capacity consumed.
-  // 	   The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `allocationMultiplier`.
-  //     For example, if a Device's capacity "dra.example.com/cores" is consumed,
-  //     and each "core" provides 2 "cpu"s, the mapping would be:
-  //     {ResourceName: "cpu", capacityKey: "dra.example.com/cores", allocationMultiplier: "2"}.
-  //     If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
-  // +optional
-  optional .k8s.io.apimachinery.pkg.api.resource.Quantity allocationMultiplier = 2;
+  // CapacityMultiplier is used as a multiplier for the allocated capacity consumed.
+  // It is only valid if `capacityKey` is set.
+  // The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
+  // For example, if a Device's capacity "dra.example.com/cores" is consumed,
+  // and each "core" provides 2 "cpu"s, the mapping would be:
+  // {ResourceName: "cpu", capacityKey: "dra.example.com/cores", capacityMultiplier: "2"}.
+  // If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
+  // +optional
+  // +k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:dependentRequired("capacityKey")
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity capacityMultiplier = 2;
+
+  // DeviceMultiplier is used as a multiplier for the allocated device count in the claim.
+  // The final node allocatable resource amount is `deviceCount` * `deviceMultiplier`.
+  // For example, a DRA driver representing each cache complex (CCX) as a device would have
+  // {ResourceName: "cpu", deviceMultiplier: "8"} in its `nodeAllocatableResources`.
+  // If 2 devices (CCX) are allocated to the claim, 2 * 8 = 16 CPUs would be considered as allocated.
+  // It is only valid when `capacityKey` and `capacityMultiplier` are not set.
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity deviceMultiplier = 3;
+}
+
+// NodeAllocatableOverhead defines auxiliary resource overheads incurred when allocating a device.
+// Overheads can be specified as a fixed cost per pod referencing the claim, a variable cost per container reference, or both.
+// Kubelet accounts for this overhead by adding it to both the pod-level and container-level cgroups of referencing containers.
+message NodeAllocatableOverhead {
+  // PerPod is overhead applied once per pod referencing the claim on this node.
+  // This is a flat overhead incurred for every pod referencing the claim.
+  // +optional
+  // +k8s:optional
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity perPod = 1;
+
+  // PerContainer is applied per container reference to the claim.
+  // This models overhead scaling linearly with the number of containers actively using the device.
+  // When both PerPod and PerContainer are specified, the total overhead allocated for each pod referencing
+  // the claim is computed as:
+  // Quantity = PerPod + (PerContainer * NumReferences)
+  // Kubelet accounts for this overhead in cgroups:
+  // - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences).
+  // - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container.
+  // This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once.
+  // +optional
+  // +k8s:optional
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity perContainer = 2;
+}
+
+// NodeAllocatableResource defines the translation between the DRA device/capacity
+// units requested to the corresponding quantity of the node allocatable resource.
+// At least one of Mapping or Overhead must be specified. Not specifying either is an invalid configuration.
+message NodeAllocatableResource {
+  // Mapping is used when the device directly models a node allocatable resource like standard CPU or memory
+  // (e.g., with a CPU DRA driver). The calculated quantity is accounted for exactly once per claim instance
+  // on the node. To prevent node cgroup isolation friction, the scheduler explicitly
+  // blocks sharing mapped device claims across multiple pods.
+  // +optional
+  // +k8s:optional
+  optional NodeAllocatableMapping mapping = 3;
+
+  // Overhead contains fields for modeling auxiliary overhead incurred on node allocatable resources
+  // when allocating devices that are not themselves modeling a node allocatable resource (e.g., host memory overhead for GPUs).
+  // Sharing overhead-mapped claims across multiple pods is allowed. The node allocatable overhead is accounted
+  // for individually for each pod referencing the claim.
+  // Overhead is always subtracted from the node's allocatable capacity for the resource, even when mapping
+  // is specified for the same resource.
+  // Eg: If a device models memory capacity per socket as a consumable capacity pool via Mapping (with CapacityKey),
+  // any overhead specified for the same resource will be subtracted from the node's general allocatable capacity
+  // and not from the per-socket capacity pool in Mapping.
+  // +optional
+  // +k8s:optional
+  optional NodeAllocatableOverhead overhead = 4;
 }
 
 // OpaqueDeviceConfiguration contains configuration parameters for a driver
@@ -1496,9 +1729,9 @@ message OpaqueDeviceConfiguration {
   // vendor of the driver. It should use only lower case characters.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:maxLength=63
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name-caseless
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:maxLength=63
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name-caseless
   optional string driver = 1;
 
   // Parameters can contain arbitrary data. It is the responsibility of
@@ -1527,7 +1760,8 @@ message ResourceClaim {
 
   // Spec describes what is being requested and how to configure it.
   // The spec is immutable.
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:immutable
+  // +optional
   optional ResourceClaimSpec spec = 2;
 
   // Status describes whether the claim is ready to use and what has been allocated.
@@ -1582,8 +1816,8 @@ message ResourceClaimStatus {
   // Allocation is set once the claim has been allocated successfully.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:update=NoModify
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:update=NoModify
   optional AllocationResult allocation = 1;
 
   // ReservedFor indicates which entities are currently allowed to use
@@ -1611,10 +1845,10 @@ message ResourceClaimStatus {
   // +listMapKey=uid
   // +patchStrategy=merge
   // +patchMergeKey=uid
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:listType=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=uid
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=256
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:listType=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=uid
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=256
   repeated ResourceClaimConsumerReference reservedFor = 2;
 
   // Devices contains the status of each device allocated for this
@@ -1622,18 +1856,18 @@ message ResourceClaimStatus {
   // information. Entries are owned by their respective drivers.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +listType=map
   // +listMapKey=driver
   // +listMapKey=device
   // +listMapKey=pool
   // +listMapKey=shareID
   // +featureGate=DRAResourceClaimDeviceStatus
-  // +k8s:alpha(since: "1.36")=+k8s:listType=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=driver
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=device
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=pool
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=shareID
+  // +k8s:beta(since: "1.37")=+k8s:listType=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=driver
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=device
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=pool
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=shareID
   repeated AllocatedDeviceStatus devices = 4;
 }
 
@@ -1651,6 +1885,7 @@ message ResourceClaimTemplate {
   // This field is immutable. A ResourceClaim will get created by the
   // control plane for a Pod when needed and then not get updated
   // anymore.
+  // +optional
   optional ResourceClaimTemplateSpec spec = 2;
 }
 
@@ -1670,11 +1905,13 @@ message ResourceClaimTemplateSpec {
   // when creating it. No other fields are allowed and will be rejected during
   // validation.
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Spec for the ResourceClaim. The entire content is copied unchanged
   // into the ResourceClaim that gets created from this template. The
   // same fields as in a ResourceClaim are also valid here.
+  // +optional
   optional ResourceClaimSpec spec = 2;
 }
 
@@ -1682,6 +1919,8 @@ message ResourceClaimTemplateSpec {
 message ResourcePool {
   // Name is used to identify the pool. For node-local devices, this
   // is often the node name, but this is not required.
+  // A field selector can be used to list only ResourceSlice objects
+  // belonging to a certain pool.
   //
   // It must not be longer than 253 characters and must consist of one or more DNS sub-domains
   // separated by slashes. This field is immutable.
@@ -1822,7 +2061,7 @@ message ResourceSliceSpec {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +zeroOrOneOf=ResourceSliceType
   repeated Device devices = 6;
 
@@ -1848,14 +2087,50 @@ message ResourceSliceSpec {
   // The maximum number of counter sets is 8.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +listType=atomic
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
+  // +k8s:beta(since: "1.37")=+k8s:unique=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=name
   // +featureGate=DRAPartitionableDevices
   // +zeroOrOneOf=ResourceSliceType
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=8
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=8
   repeated CounterSet sharedCounters = 8;
+
+  // PartitionTypeAttribute names a string device attribute (by fully
+  // qualified name, e.g. "gpu.example.com/profile") whose value labels
+  // each device with its partition type, such as "Full" or "Half" for a
+  // MIG-style GPU.
+  //
+  // When set, every partitionable device in the slice must carry the attribute
+  // and devices sharing a value must share the same ConsumesCounters cost.
+  //
+  // +optional
+  // +featureGate=DRAPartitionableDevicesType
+  // +k8s:ifDisabled(DRAPartitionableDevicesType)=+k8s:forbidden
+  // +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:optional
+  // +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:format=k8s-resource-fully-qualified-name
+  optional string partitionTypeAttribute = 9;
+
+  // SkipNodeOperations lists node-local resource operations (gRPC calls)
+  // that will be skipped for the devices in this slice when determining whether
+  // operations are necessary on the node. If all allocated devices for a driver in
+  // a claim skip an operation, that gRPC call will be skipped. Valid values are:
+  //
+  // - "NodePrepareResources": NodePrepareResources gRPC calls are skipped. This
+  //   value cannot be specified unless "NodeUnprepareResources" is also listed
+  //   (or "*" is specified).
+  // - "NodeUnprepareResources": NodeUnprepareResources gRPC calls are skipped.
+  // - "*": All node-local resource operations are skipped.
+  //
+  // Other values may be added in the future. The kubelet must ignore unknown
+  // values.
+  //
+  // +optional
+  // +listType=set
+  // +k8s:listType=set
+  // +featureGate=DRAOptionalNodeOperations
+  // +k8s:optional
+  repeated string skipNodeOperations = 10;
 }
 
diff --git a/vendor/k8s.io/api/resource/v1beta1/types.go b/vendor/k8s.io/api/resource/v1beta1/types.go
index 0d35ac9895..f35e230ceb 100644
--- a/vendor/k8s.io/api/resource/v1beta1/types.go
+++ b/vendor/k8s.io/api/resource/v1beta1/types.go
@@ -78,7 +78,7 @@ const (
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type ResourceSlice struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -97,6 +97,9 @@ const (
 	// ResourceSliceSelectorDriver can be used in a [metav1.ListOptions]
 	// field selector to filter based on [ResourceSliceSpec.Driver].
 	ResourceSliceSelectorDriver = "spec.driver"
+	// ResourceSliceSelectorPoolName can be used in a [metav1.ListOptions]
+	// field selector to filter based on [ResourceSliceSpec.Pool.Name].
+	ResourceSliceSelectorPoolName = "spec.pool.name"
 )
 
 // ResourceSliceSpec contains the information published by the driver in one ResourceSlice.
@@ -160,7 +163,7 @@ type ResourceSliceSpec struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +zeroOrOneOf=ResourceSliceType
 	Devices []Device `json:"devices,omitempty" protobuf:"bytes,6,name=devices"`
 
@@ -186,17 +189,68 @@ type ResourceSliceSpec struct {
 	// The maximum number of counter sets is 8.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +listType=atomic
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
+	// +k8s:beta(since: "1.37")=+k8s:unique=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=name
 	// +featureGate=DRAPartitionableDevices
 	// +zeroOrOneOf=ResourceSliceType
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=8
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=8
 	SharedCounters []CounterSet `json:"sharedCounters,omitempty" protobuf:"bytes,8,name=sharedCounters"`
+
+	// PartitionTypeAttribute names a string device attribute (by fully
+	// qualified name, e.g. "gpu.example.com/profile") whose value labels
+	// each device with its partition type, such as "Full" or "Half" for a
+	// MIG-style GPU.
+	//
+	// When set, every partitionable device in the slice must carry the attribute
+	// and devices sharing a value must share the same ConsumesCounters cost.
+	//
+	// +optional
+	// +featureGate=DRAPartitionableDevicesType
+	// +k8s:ifDisabled(DRAPartitionableDevicesType)=+k8s:forbidden
+	// +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:optional
+	// +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:format=k8s-resource-fully-qualified-name
+	PartitionTypeAttribute *FullyQualifiedName `json:"partitionTypeAttribute,omitempty" protobuf:"bytes,9,opt,name=partitionTypeAttribute"`
+
+	// SkipNodeOperations lists node-local resource operations (gRPC calls)
+	// that will be skipped for the devices in this slice when determining whether
+	// operations are necessary on the node. If all allocated devices for a driver in
+	// a claim skip an operation, that gRPC call will be skipped. Valid values are:
+	//
+	// - "NodePrepareResources": NodePrepareResources gRPC calls are skipped. This
+	//   value cannot be specified unless "NodeUnprepareResources" is also listed
+	//   (or "*" is specified).
+	// - "NodeUnprepareResources": NodeUnprepareResources gRPC calls are skipped.
+	// - "*": All node-local resource operations are skipped.
+	//
+	// Other values may be added in the future. The kubelet must ignore unknown
+	// values.
+	//
+	// +optional
+	// +listType=set
+	// +k8s:listType=set
+	// +featureGate=DRAOptionalNodeOperations
+	// +k8s:optional
+	SkipNodeOperations []SkipNodeOperation `json:"skipNodeOperations,omitempty" protobuf:"bytes,10,rep,name=skipNodeOperations,casttype=SkipNodeOperation"`
 }
 
+// +enum
+// +k8s:enum
+type SkipNodeOperation string
+
+const (
+	// SkipNodeOperationNodePrepareResources indicates that NodePrepareResources gRPC calls are skipped.
+	SkipNodeOperationNodePrepareResources SkipNodeOperation = "NodePrepareResources"
+
+	// SkipNodeOperationNodeUnprepareResources indicates that NodeUnprepareResources gRPC calls are skipped.
+	SkipNodeOperationNodeUnprepareResources SkipNodeOperation = "NodeUnprepareResources"
+
+	// SkipNodeOperationAll indicates that all node-local resource operations are skipped.
+	SkipNodeOperationAll SkipNodeOperation = "*"
+)
+
 // CounterSet defines a named set of counters
 // that are available to be used by devices defined in the
 // ResourcePool.
@@ -210,8 +264,8 @@ type CounterSet struct {
 	// It must be a DNS label.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-short-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-short-name
 	Name string `json:"name" protobuf:"bytes,1,name=name"`
 
 	// Counters defines the set of counters for this CounterSet
@@ -220,8 +274,8 @@ type CounterSet struct {
 	// The maximum number of counters is 32.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:eachKey=+k8s:format=k8s-short-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:eachKey=+k8s:format=k8s-short-name
 	Counters map[string]Counter `json:"counters,omitempty" protobuf:"bytes,2,name=counters"`
 }
 
@@ -241,6 +295,8 @@ const DriverNameMaxLength = 63
 type ResourcePool struct {
 	// Name is used to identify the pool. For node-local devices, this
 	// is often the node name, but this is not required.
+	// A field selector can be used to list only ResourceSlice objects
+	// belonging to a certain pool.
 	//
 	// It must not be longer than 253 characters and must consist of one or more DNS sub-domains
 	// separated by slashes. This field is immutable.
@@ -305,6 +361,10 @@ const ResourceSliceMaxDeviceCounterConsumptionsPerDevice = 2
 // per device counter consumption.
 const ResourceSliceMaxCountersPerDeviceCounterConsumption = 32
 
+// Defines the maximum number of compatibility groups that can be
+// declared per device counter consumption.
+const DeviceCompatibilityGroupsMaxSize = 2
+
 // Device represents one individual hardware instance that can be selected based
 // on its attributes. Besides the name, exactly one field must be set.
 type Device struct {
@@ -318,7 +378,7 @@ type Device struct {
 	//
 	// +optional
 	// +oneOf=deviceType
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Basic *BasicDevice `json:"basic,omitempty" protobuf:"bytes,2,opt,name=basic"`
 }
 
@@ -330,7 +390,7 @@ type BasicDevice struct {
 	// The maximum number of attributes and capacities combined is 32.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Attributes map[QualifiedName]DeviceAttribute `json:"attributes,omitempty" protobuf:"bytes,1,rep,name=attributes"`
 
 	// Capacity defines the set of capacities for this device.
@@ -351,13 +411,13 @@ type BasicDevice struct {
 	// device is 2.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +listType=atomic
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=counterSet
+	// +k8s:beta(since: "1.37")=+k8s:unique=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=counterSet
 	// +featureGate=DRAPartitionableDevices
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=2
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=2
 	ConsumesCounters []DeviceCounterConsumption `json:"consumesCounters,omitempty" protobuf:"bytes,3,rep,name=consumesCounters"`
 
 	// NodeName identifies the node where the device is available.
@@ -403,7 +463,7 @@ type BasicDevice struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceTaints
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Taints []DeviceTaint `json:"taints,omitempty" protobuf:"bytes,7,rep,name=taints"`
 
 	// BindsToNode indicates if the usage of an allocation involving this device
@@ -433,8 +493,8 @@ type BasicDevice struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=4
 	BindingConditions []string `json:"bindingConditions,omitempty" protobuf:"bytes,9,rep,name=bindingConditions"`
 
 	// BindingFailureConditions defines the conditions for binding failure.
@@ -451,8 +511,8 @@ type BasicDevice struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=4
 	BindingFailureConditions []string `json:"bindingFailureConditions,omitempty" protobuf:"bytes,10,rep,name=bindingFailureConditions"`
 
 	// AllowMultipleAllocations marks whether the device is allowed to be allocated to multiple DeviceRequests.
@@ -464,7 +524,10 @@ type BasicDevice struct {
 	// +featureGate=DRAConsumableCapacity
 	AllowMultipleAllocations *bool `json:"allowMultipleAllocations,omitempty" protobuf:"bytes,11,opt,name=allowMultipleAllocations"`
 
-	// NodeAllocatableResourceMappings defines the mapping of node resources
+	// NodeAllocatableResourceMappings is tombstoned as it got replaced with NodeAllocatableResources.
+	// NodeAllocatableResourceMappings map[v1.ResourceName]NodeAllocatableResourceMapping `json:"nodeAllocatableResourceMappings,omitempty" protobuf:"bytes,12,opt,name=nodeAllocatableResourceMappings"`
+
+	// NodeAllocatableResources defines the mapping of node resources
 	// that are managed by the DRA driver exposing this device. This includes resources currently
 	// reported in v1.Node `status.allocatable` that are not extended resources
 	// (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources).
@@ -476,46 +539,104 @@ type BasicDevice struct {
 	// The keys of this map are the node-allocatable resource names (e.g., "cpu", "memory").
 	// Extended resource names are not permitted as keys.
 	// +optional
+	// +k8s:optional
 	// +featureGate=DRANodeAllocatableResources
-	NodeAllocatableResourceMappings map[v1.ResourceName]NodeAllocatableResourceMapping `json:"nodeAllocatableResourceMappings,omitempty" protobuf:"bytes,12,opt,name=nodeAllocatableResourceMappings"`
+	NodeAllocatableResources map[v1.ResourceName]NodeAllocatableResource `json:"nodeAllocatableResources,omitempty" protobuf:"bytes,14,opt,name=nodeAllocatableResources"`
 }
 
-// NodeAllocatableResourceMapping defines the translation between the DRA device/capacity
+// NodeAllocatableResource defines the translation between the DRA device/capacity
 // units requested to the corresponding quantity of the node allocatable resource.
-type NodeAllocatableResourceMapping struct {
+// At least one of Mapping or Overhead must be specified. Not specifying either is an invalid configuration.
+type NodeAllocatableResource struct {
+	// Mapping is used when the device directly models a node allocatable resource like standard CPU or memory
+	// (e.g., with a CPU DRA driver). The calculated quantity is accounted for exactly once per claim instance
+	// on the node. To prevent node cgroup isolation friction, the scheduler explicitly
+	// blocks sharing mapped device claims across multiple pods.
+	// +optional
+	// +k8s:optional
+	Mapping *NodeAllocatableMapping `json:"mapping,omitempty" protobuf:"bytes,3,opt,name=mapping"`
+
+	// Overhead contains fields for modeling auxiliary overhead incurred on node allocatable resources
+	// when allocating devices that are not themselves modeling a node allocatable resource (e.g., host memory overhead for GPUs).
+	// Sharing overhead-mapped claims across multiple pods is allowed. The node allocatable overhead is accounted
+	// for individually for each pod referencing the claim.
+	// Overhead is always subtracted from the node's allocatable capacity for the resource, even when mapping
+	// is specified for the same resource.
+	// Eg: If a device models memory capacity per socket as a consumable capacity pool via Mapping (with CapacityKey),
+	// any overhead specified for the same resource will be subtracted from the node's general allocatable capacity
+	// and not from the per-socket capacity pool in Mapping.
+	// +optional
+	// +k8s:optional
+	Overhead *NodeAllocatableOverhead `json:"overhead,omitempty" protobuf:"bytes,4,opt,name=overhead"`
+}
+
+// NodeAllocatableMapping defines how a DRA allocation directly translates into a node allocatable resource quantity.
+// The mapping can be derived from either the count of allocated devices or the specific capacity consumed. These options are mutually exclusive.
+// Kubelet adds this mapped resource quantity from claim to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.
+type NodeAllocatableMapping struct {
 	// CapacityKey references a capacity name defined as a key in the
 	// `spec.devices[*].capacity` map. When this field is set, the value associated with
 	// this key in the `status.allocation.devices.results[*].consumedCapacity` map
 	// (for a specific claim allocation) determines the base quantity for
-	// the node allocatable resource. If `allocationMultiplier` is also set, it is
+	// the node allocatable resource. `capacityMultiplier` must also be set and is
 	// multiplied with the base quantity.
 	// For example, if `spec.devices[*].capacity` has an entry "dra.example.com/memory": "128Gi",
 	// and this field is set to "dra.example.com/memory", then for a claim allocation
 	// that consumes { "dra.example.com/memory": "4Gi" } the base quantity for the
-	// node allocatable resource mapping will be "4Gi", and `allocationMultiplier` should
-	// be omitted or set to "1".
+	// node allocatable resource mapping will be "4Gi".
+	// The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
 	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:alpha(since: "1.37")=+k8s:dependentRequired("capacityMultiplier")
 	CapacityKey *QualifiedName `json:"capacityKey,omitempty" protobuf:"bytes,1,opt,name=capacityKey"`
 
-	// AllocationMultiplier is used as a multiplier for the allocated device count or the allocated capacity in the claim.
-	// It defaults to 1 if not specified. How the field is used also depends on whether `capacityKey` is set.
-	// 1.  If `capacityKey` is NOT set: `allocationMultiplier` multiplies the device count allocated to the claim.
-	// 	   a. A DRA driver representing each CPU core as a device would have
-	//        {ResourceName: "cpu", allocationMultiplier: "2"} in its
-	//        `nodeAllocatableResourceMappings`. If 4 devices are allocated to the claim,
-	// 		  4 * 2 CPUs would be considered as allocated and subtracted from the node's capacity.
-	//     b. A GPU device that needs additional node memory per GPU allocation would
-	//        have {ResourceName: "memory", allocationMultiplier: "2Gi"}.  Each allocated
-	// 		  GPU device instance of this type will account for 2Gi of memory.
-	//
-	// 2.  If `capacityKey` IS set: `allocationMultiplier` is multiplied by the amount of that capacity consumed.
-	// 	   The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `allocationMultiplier`.
-	//     For example, if a Device's capacity "dra.example.com/cores" is consumed,
-	//     and each "core" provides 2 "cpu"s, the mapping would be:
-	//     {ResourceName: "cpu", capacityKey: "dra.example.com/cores", allocationMultiplier: "2"}.
-	//     If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
-	// +optional
-	AllocationMultiplier *resource.Quantity `json:"allocationMultiplier,omitempty" protobuf:"bytes,2,opt,name=allocationMultiplier"`
+	// CapacityMultiplier is used as a multiplier for the allocated capacity consumed.
+	// It is only valid if `capacityKey` is set.
+	// The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
+	// For example, if a Device's capacity "dra.example.com/cores" is consumed,
+	// and each "core" provides 2 "cpu"s, the mapping would be:
+	// {ResourceName: "cpu", capacityKey: "dra.example.com/cores", capacityMultiplier: "2"}.
+	// If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
+	// +optional
+	// +k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:dependentRequired("capacityKey")
+	CapacityMultiplier *resource.Quantity `json:"capacityMultiplier,omitempty" protobuf:"bytes,2,opt,name=capacityMultiplier"`
+
+	// DeviceMultiplier is used as a multiplier for the allocated device count in the claim.
+	// The final node allocatable resource amount is `deviceCount` * `deviceMultiplier`.
+	// For example, a DRA driver representing each cache complex (CCX) as a device would have
+	// {ResourceName: "cpu", deviceMultiplier: "8"} in its `nodeAllocatableResources`.
+	// If 2 devices (CCX) are allocated to the claim, 2 * 8 = 16 CPUs would be considered as allocated.
+	// It is only valid when `capacityKey` and `capacityMultiplier` are not set.
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	DeviceMultiplier *resource.Quantity `json:"deviceMultiplier,omitempty" protobuf:"bytes,3,opt,name=deviceMultiplier"`
+}
+
+// NodeAllocatableOverhead defines auxiliary resource overheads incurred when allocating a device.
+// Overheads can be specified as a fixed cost per pod referencing the claim, a variable cost per container reference, or both.
+// Kubelet accounts for this overhead by adding it to both the pod-level and container-level cgroups of referencing containers.
+type NodeAllocatableOverhead struct {
+	// PerPod is overhead applied once per pod referencing the claim on this node.
+	// This is a flat overhead incurred for every pod referencing the claim.
+	// +optional
+	// +k8s:optional
+	PerPod *resource.Quantity `json:"perPod,omitempty" protobuf:"bytes,1,opt,name=perPod"`
+
+	// PerContainer is applied per container reference to the claim.
+	// This models overhead scaling linearly with the number of containers actively using the device.
+	// When both PerPod and PerContainer are specified, the total overhead allocated for each pod referencing
+	// the claim is computed as:
+	// Quantity = PerPod + (PerContainer * NumReferences)
+	// Kubelet accounts for this overhead in cgroups:
+	// - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences).
+	// - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container.
+	// This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once.
+	// +optional
+	// +k8s:optional
+	PerContainer *resource.Quantity `json:"perContainer,omitempty" protobuf:"bytes,2,opt,name=perContainer"`
 }
 
 // DeviceCounterConsumption defines a set of counters that
@@ -525,8 +646,8 @@ type DeviceCounterConsumption struct {
 	// counters defined will be consumed.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-short-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-short-name
 	CounterSet string `json:"counterSet" protobuf:"bytes,1,opt,name=counterSet"`
 
 	// Counters defines the counters that will be consumed by the device.
@@ -534,9 +655,39 @@ type DeviceCounterConsumption struct {
 	// The maximum number of counters is 32.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:eachKey=+k8s:format=k8s-short-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:eachKey=+k8s:format=k8s-short-name
 	Counters map[string]Counter `json:"counters,omitempty" protobuf:"bytes,2,opt,name=counters"`
+
+	// CompatibilityGroups is a list of opaque group names for
+	// this counter set consumption.
+	//
+	// Devices that consume counters from the same counter set may only be
+	// allocated at the same time ("co-allocated") if they all share at least
+	// one common group: the intersection of the CompatibilityGroups of all
+	// co-allocated devices on that counter set must be non-empty. Devices
+	// that consume from different counter sets are never compared via this
+	// field.
+	//
+	// An unset field, an explicit nil, and an empty list are equivalent and
+	// mean "no groups": such a device is only co-allocatable with sibling
+	// devices on the same counter set that also have no groups, and is never
+	// co-allocatable with a device that declares one or more groups.
+	//
+	// Group names are opaque and meaningful only within the
+	// publishing driver's pool.
+	//
+	// The maximum number of groups is 2, and the names must be unique.
+	//
+	// +optional
+	// +listType=atomic
+	// +featureGate=DRADeviceCompatibilityGroups
+	// +k8s:listType=atomic
+	// +k8s:optional
+	// +k8s:maxItems=2
+	// +k8s:unique=set
+	// +k8s:eachVal=+k8s:format=k8s-short-name
+	CompatibilityGroups []string `json:"compatibilityGroups,omitempty" protobuf:"bytes,3,rep,name=compatibilityGroups"`
 }
 
 // DeviceCapacity describes a quantity associated with a device.
@@ -612,6 +763,13 @@ type CapacityRequestPolicy struct {
 
 // CapacityRequestPolicyRange defines a valid range for consumable capacity values.
 //
+// If the DRAFractionalCapacityRange feature gate is
+// enabled and at least one of Min, Max, or Step is a fractional quantity (i.e.
+// its value is not an integer), milli-unit arithmetic is used instead,
+// supporting values with up to 3 decimal places (e.g. 100m = 0.1).
+// The largest supported value then is 1000 times smaller compared to using 64-bit integers.
+// Otherwise, all comparisons use 64-bit integer arithmetic via resource.Quantity.Value().
+//
 //   - If the requested amount is less than Min, it is rounded up to the Min value.
 //   - If Step is set and the requested amount is between Min and Max but not aligned with Step,
 //     it will be rounded up to the next value equal to Min + (n * Step).
@@ -691,30 +849,30 @@ type DeviceAttribute struct {
 	// IntValue is a number.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	IntValue *int64 `json:"int,omitempty" protobuf:"varint,2,opt,name=int"`
 
 	// BoolValue is a true/false value.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	BoolValue *bool `json:"bool,omitempty" protobuf:"varint,3,opt,name=bool"`
 
 	// StringValue is a string. Must not be longer than 64 characters.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	StringValue *string `json:"string,omitempty" protobuf:"bytes,4,opt,name=string"`
 
 	// VersionValue is a semantic version according to semver.org spec 2.0.0.
 	// Must not be longer than 64 characters.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	VersionValue *string `json:"version,omitempty" protobuf:"bytes,5,opt,name=version"`
 
 	// IntValues is a non-empty list of numbers.
@@ -723,8 +881,8 @@ type DeviceAttribute struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	// +featureGate=DRAListTypeAttributes
 	IntValues []int64 `json:"ints,omitempty" protobuf:"varint,6,opt,name=ints"`
 
@@ -732,8 +890,8 @@ type DeviceAttribute struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	// +featureGate=DRAListTypeAttributes
 	BoolValues []bool `json:"bools,omitempty" protobuf:"varint,7,opt,name=bools"`
 
@@ -744,8 +902,9 @@ type DeviceAttribute struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
+	// +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:maxBytes=64
 	// +featureGate=DRAListTypeAttributes
 	StringValues []string `json:"strings,omitempty" protobuf:"bytes,8,opt,name=strings"`
 
@@ -756,8 +915,8 @@ type DeviceAttribute struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	// +featureGate=DRAListTypeAttributes
 	VersionValues []string `json:"versions,omitempty" protobuf:"bytes,9,opt,name=versions"`
 }
@@ -794,7 +953,7 @@ type DeviceTaint struct {
 	// Consumers must treat unknown effects like None.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Effect DeviceTaintEffect `json:"effect" protobuf:"bytes,3,name=effect,casttype=DeviceTaintEffect"`
 
 	// ^^^^
@@ -833,7 +992,7 @@ type DeviceTaint struct {
 }
 
 // +enum
-// +k8s:alpha(since: "1.36")=+k8s:enum
+// +k8s:beta(since: "1.37")=+k8s:enum
 type DeviceTaintEffect string
 
 const (
@@ -854,7 +1013,7 @@ const (
 
 // ResourceSliceList is a collection of ResourceSlices.
 type ResourceSliceList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -877,14 +1036,15 @@ type ResourceSliceList struct {
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type ResourceClaim struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec describes what is being requested and how to configure it.
 	// The spec is immutable.
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:immutable
+	// +optional
 	Spec ResourceClaimSpec `json:"spec" protobuf:"bytes,2,name=spec"`
 
 	// Status describes whether the claim is ready to use and what has been allocated.
@@ -912,11 +1072,11 @@ type DeviceClaim struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:unique=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=name
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Requests []DeviceRequest `json:"requests" protobuf:"bytes,1,name=requests"`
 
 	// These constraints must be satisfied by the set of devices that get
@@ -924,8 +1084,8 @@ type DeviceClaim struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Constraints []DeviceConstraint `json:"constraints,omitempty" protobuf:"bytes,2,opt,name=constraints"`
 
 	// This field holds configuration for multiple potential drivers which
@@ -934,8 +1094,8 @@ type DeviceClaim struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Config []DeviceClaimConfiguration `json:"config,omitempty" protobuf:"bytes,3,opt,name=config"`
 
 	// Potential future extension, ignored by older schedulers. This is
@@ -1002,8 +1162,8 @@ type DeviceRequest struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Selectors []DeviceSelector `json:"selectors,omitempty" protobuf:"bytes,3,name=selectors"`
 
 	// AllocationMode and its related fields define how devices are allocated
@@ -1029,7 +1189,7 @@ type DeviceRequest struct {
 	// requests with unknown modes.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	AllocationMode DeviceAllocationMode `json:"allocationMode,omitempty" protobuf:"bytes,4,opt,name=allocationMode"`
 
 	// Count is used only when the count mode is "ExactCount". Must be greater than zero.
@@ -1079,11 +1239,11 @@ type DeviceRequest struct {
 	// +oneOf=deviceRequestType
 	// +listType=atomic
 	// +featureGate=DRAPrioritizedList
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=8
+	// +k8s:beta(since: "1.37")=+k8s:unique=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=name
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=8
 	FirstAvailable []DeviceSubRequest `json:"firstAvailable,omitempty" protobuf:"bytes,7,name=firstAvailable"`
 
 	// If specified, the request's tolerations.
@@ -1110,7 +1270,7 @@ type DeviceRequest struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceTaints
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Tolerations []DeviceToleration `json:"tolerations,omitempty" protobuf:"bytes,8,opt,name=tolerations"`
 
 	// Capacity define resource requirements against each capacity.
@@ -1129,6 +1289,34 @@ type DeviceRequest struct {
 	// +optional
 	// +featureGate=DRAConsumableCapacity
 	Capacity *CapacityRequirements `json:"capacity,omitempty" protobuf:"bytes,9,opt,name=capacity"`
+
+	// DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+	// for each candidate device. These virtual attributes can be referenced in
+	// `.devices.constraints` to align and match different devices (e.g., co-allocating
+	// a GPU and a NIC on the same NUMA node) even if their drivers publish different
+	// attributes. Derived attributes are not available via `device.attributes`
+	// in the CEL environment when evaluating selector expressions.
+	//
+	// Derived attributes allow you to extract, transform, or normalize topology
+	// information (such as extracting a NUMA index from a complex topology string or
+	// renaming a vendor-specific attribute) into a common virtual attribute name at
+	// scheduling time. The scheduler then evaluates these virtual attributes exactly
+	// like static attributes when matching constraints.
+	//
+	// Every derived attribute defined in this list must be referenced by at least one
+	// MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+	//
+	// The maximum number of derived attributes is 32.
+	//
+	// This is an alpha field and requires enabling the DRADerivedAttributes
+	// feature gate.
+	//
+	// +optional
+	// +listType=atomic
+	// +featureGate=DRADerivedAttributes
+	// +k8s:optional
+	// +k8s:maxItems=32
+	DerivedAttributes []DeviceDerivedAttribute `json:"derivedAttributes,omitempty" protobuf:"bytes,10,rep,name=derivedAttributes"`
 }
 
 // DeviceSubRequest describes a request for device provided in the
@@ -1163,8 +1351,8 @@ type DeviceSubRequest struct {
 	// to reference.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name
 	DeviceClassName string `json:"deviceClassName" protobuf:"bytes,2,name=deviceClassName"`
 
 	// Selectors define criteria which must be satisfied by a specific
@@ -1174,8 +1362,8 @@ type DeviceSubRequest struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Selectors []DeviceSelector `json:"selectors,omitempty" protobuf:"bytes,3,name=selectors"`
 
 	// AllocationMode and its related fields define how devices are allocated
@@ -1197,7 +1385,7 @@ type DeviceSubRequest struct {
 	// requests with unknown modes.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	AllocationMode DeviceAllocationMode `json:"allocationMode,omitempty" protobuf:"bytes,4,opt,name=allocationMode"`
 
 	// Count is used only when the count mode is "ExactCount". Must be greater than zero.
@@ -1228,7 +1416,7 @@ type DeviceSubRequest struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceTaints
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Tolerations []DeviceToleration `json:"tolerations,omitempty" protobuf:"bytes,7,opt,name=tolerations"`
 
 	// Capacity define resource requirements against each capacity.
@@ -1247,6 +1435,34 @@ type DeviceSubRequest struct {
 	// +optional
 	// +featureGate=DRAConsumableCapacity
 	Capacity *CapacityRequirements `json:"capacity,omitempty" protobuf:"bytes,8,opt,name=capacity"`
+
+	// DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+	// for each candidate device. These virtual attributes can be referenced in
+	// `.devices.constraints` to align and match different devices (e.g., co-allocating
+	// a GPU and a NIC on the same NUMA node) even if their drivers publish different
+	// attributes. Derived attributes are not available via `device.attributes`
+	// in the CEL environment when evaluating selector expressions.
+	//
+	// Derived attributes allow you to extract, transform, or normalize topology
+	// information (such as extracting a NUMA index from a complex topology string or
+	// renaming a vendor-specific attribute) into a common virtual attribute name at
+	// scheduling time. The scheduler then evaluates these virtual attributes exactly
+	// like static attributes when matching constraints.
+	//
+	// Every derived attribute defined in this list must be referenced by at least one
+	// MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+	//
+	// The maximum number of derived attributes is 32.
+	//
+	// This is an alpha field and requires enabling the DRADerivedAttributes
+	// feature gate.
+	//
+	// +optional
+	// +listType=atomic
+	// +featureGate=DRADerivedAttributes
+	// +k8s:optional
+	// +k8s:maxItems=32
+	DerivedAttributes []DeviceDerivedAttribute `json:"derivedAttributes,omitempty" protobuf:"bytes,9,rep,name=derivedAttributes"`
 }
 
 // CapacityRequirements defines the capacity requirements for a specific device request.
@@ -1278,14 +1494,70 @@ type CapacityRequirements struct {
 	Requests map[QualifiedName]resource.Quantity `json:"requests,omitempty" protobuf:"bytes,1,rep,name=requests,castkey=QualifiedName"`
 }
 
+// DeviceDerivedAttribute defines a derived attribute computed via CEL.
+type DeviceDerivedAttribute struct {
+	// Name is the identifier for this derived attribute, used in constraints.
+	//
+	// It must be a DNS subdomain followed by a slash ("/") followed by a C identifier
+	// (e.g. "example.com/numaNode" or "derived/numaNode").
+	//
+	// If the chosen name matches an existing physical attribute from a driver,
+	// the derived attribute's expression will shadow the physical attribute,
+	// and its evaluated value will be used in constraints instead. When the goal
+	// is to define a derived attribute that is only used within the ResourceClaim
+	// and not meant to shadow an existing attribute, use a domain prefix that
+	// no DRA driver should be using (e.g. "derived/myAttribute").
+	//
+	// It is not valid to define a derived attribute that isn't used in at least
+	// one constraint.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-resource-fully-qualified-name
+	Name FullyQualifiedName `json:"name" protobuf:"bytes,1,name=name"`
+
+	// Expression is a CEL expression evaluated against each candidate device.
+	// The expression must evaluate to a primitive scalar (string, integer,
+	// boolean, or semver) or a list of these scalars ([]string, []int64,
+	// []bool, []semver) to act as a virtual grouping key. Any other return type
+	// is an error and causes CEL evaluation for the device to fail.
+	//
+	// The expression's input is an object named "device", which carries the
+	// same properties as in a CELDeviceSelector.
+	//
+	// When pod scheduling encounters CEL runtime errors (such as looking
+	// up an attribute that isn't defined) for some devices, it will abort
+	// allocation and fail scheduling for the Pod. Surfacing evaluation
+	// errors immediately prevents silent topology matching failures that are
+	// extremely hard to detect. A robust expression should, for example, check
+	// for the existence of attributes before referencing them to avoid
+	// runtime evaluation errors.
+	//
+	// The expression gets evaluated after a device has passed the other
+	// selector expressions for the request in which this expression is used.
+	// This allows writing expressions that are tailored towards the specific
+	// devices being requested (for example, by assuming the device is from a
+	// certain vendor and skipping those checks).
+	//
+	// The length of the expression must be smaller or equal to 10 Ki. The
+	// cost of evaluating it is also limited based on the estimated number
+	// of logical steps; the combined cost of all derived attributes in a
+	// claim is capped by a shared CEL cost budget.
+	//
+	// +required
+	// +k8s:required
+	Expression string `json:"expression" protobuf:"bytes,2,name=expression"`
+}
+
 const (
 	DeviceSelectorsMaxSize             = 32
 	FirstAvailableDeviceRequestMaxSize = 8
 	DeviceTolerationsMaxLength         = 16
+	DeviceDerivedAttributesMaxSize     = 32
 )
 
 // +enum
-// +k8s:alpha(since: "1.36")=+k8s:enum
+// +k8s:beta(since: "1.37")=+k8s:enum
 type DeviceAllocationMode string
 
 // Valid [DeviceRequest.CountMode] values.
@@ -1315,7 +1587,7 @@ type CELDeviceSelector struct {
 	//  - driver (string): the name of the driver which defines this device.
 	//  - attributes (map[string]object): the device's attributes, grouped by prefix
 	//    (e.g. device.attributes["dra.example.com"] evaluates to an object with all
-	//    of the attributes which were prefixed by "dra.example.com".
+	//    of the attributes which were prefixed by "dra.example.com").
 	//  - capacity (map[string]object): the device's capacities, grouped by prefix.
 	//  - allowMultipleAllocations (bool): the allowMultipleAllocations property of the device
 	//    (v1.34+ with the DRAConsumableCapacity feature enabled).
@@ -1348,6 +1620,15 @@ type CELDeviceSelector struct {
 	// A robust expression should check for the existence of attributes
 	// before referencing them.
 	//
+	// Common errors:
+	// - "no such key": Use optional chaining (.? followed by orValue())
+	//   or guarding the check with has() for optional fields.
+	//   See CEL Optional Types for details:
+	//   https://pkg.go.dev/github.com/google/cel-go@v0.17.4/cel#OptionalTypes
+	//
+	// For more CEL expression syntax and examples, see:
+	// https://kubernetes.io/docs/reference/using-api/cel/
+	//
 	// For ease of use, the cel.bind() function is enabled, and can be used
 	// to simplify expressions that access multiple attributes with the
 	// same domain. For example:
@@ -1395,6 +1676,25 @@ type CELDeviceSelector struct {
 // However, this depends on how fast the machine is.
 const CELSelectorExpressionMaxCost = 1000000
 
+// DeviceClaimDerivedAttributeCELMaxCost is the maximum combined execution cost
+// allowed for all derived attribute CEL expressions within a single DeviceClaim.
+//
+// During validation, the API server computes the estimated execution cost of each
+// derived attribute expression. The sum of these costs across all requests in the
+// claim must not exceed this budget. If it does, the claim is rejected.
+//
+// To stay within the budget, consumers should simplify their CEL expressions,
+// avoid computationally expensive operations like deep nesting or iterations
+// (such as `.all()` or `.exists()`), and minimize the total number of derived
+// attributes in a claim.
+//
+// This shared budget prevents excessively complex claims from degrading the
+// performance of the kube-scheduler. The limit is set to 1,000,000 instruction
+// executions (roughly 0.1 seconds of evaluation time), tying the collective
+// cost of all derived attributes to the maximum cost allowed for a single
+// CEL selector.
+const DeviceClaimDerivedAttributeCELMaxCost = 1000000
+
 // CELSelectorExpressionMaxLength is the maximum length of a CEL selector expression string.
 const CELSelectorExpressionMaxLength = 10 * 1024
 
@@ -1412,10 +1712,10 @@ type DeviceConstraint struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=set
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:unique=set
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Requests []string `json:"requests,omitempty" protobuf:"bytes,1,opt,name=requests"`
 
 	// MatchAttribute requires that all devices in question have this
@@ -1438,8 +1738,8 @@ type DeviceConstraint struct {
 	//
 	// +optional
 	// +oneOf=ConstraintType
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-resource-fully-qualified-name
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-fully-qualified-name
 	MatchAttribute *FullyQualifiedName `json:"matchAttribute,omitempty" protobuf:"bytes,2,opt,name=matchAttribute"`
 
 	// Potential future extension, not part of the current design:
@@ -1471,6 +1771,8 @@ type DeviceConstraint struct {
 	// +optional
 	// +oneOf=ConstraintType
 	// +featureGate=DRAConsumableCapacity
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-fully-qualified-name
 	DistinctAttribute *FullyQualifiedName `json:"distinctAttribute,omitempty" protobuf:"bytes,3,opt,name=distinctAttribute"`
 }
 
@@ -1485,13 +1787,13 @@ type DeviceClaimConfiguration struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=set
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:unique=set
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Requests []string `json:"requests,omitempty" protobuf:"bytes,1,opt,name=requests"`
 
-	DeviceConfiguration `json:",inline" protobuf:"bytes,2,name=deviceConfiguration"`
+	DeviceConfiguration `json:"" protobuf:"bytes,2,name=deviceConfiguration"`
 }
 
 // DeviceConfiguration must have exactly one field set. It gets embedded
@@ -1502,7 +1804,7 @@ type DeviceConfiguration struct {
 	//
 	// +optional
 	// +oneOf=ConfigurationType
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Opaque *OpaqueDeviceConfiguration `json:"opaque,omitempty" protobuf:"bytes,1,opt,name=opaque"`
 }
 
@@ -1519,9 +1821,9 @@ type OpaqueDeviceConfiguration struct {
 	// vendor of the driver. It should use only lower case characters.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:maxLength=63
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name-caseless
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:maxLength=63
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name-caseless
 	Driver string `json:"driver" protobuf:"bytes,1,name=driver"`
 
 	// Parameters can contain arbitrary data. It is the responsibility of
@@ -1547,8 +1849,8 @@ type DeviceToleration struct {
 	// Must be a label name.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-label-key
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-label-key
 	Key string `json:"key,omitempty" protobuf:"bytes,1,opt,name=key"`
 
 	// Operator represents a key's relationship to the value.
@@ -1558,7 +1860,7 @@ type DeviceToleration struct {
 	//
 	// +optional
 	// +default="Equal"
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Operator DeviceTolerationOperator `json:"operator,omitempty" protobuf:"bytes,2,opt,name=operator,casttype=DeviceTolerationOperator"`
 
 	// Value is the taint value the toleration matches to.
@@ -1572,7 +1874,7 @@ type DeviceToleration struct {
 	// When specified, allowed values are NoSchedule and NoExecute.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Effect DeviceTaintEffect `json:"effect,omitempty" protobuf:"bytes,4,opt,name=effect,casttype=DeviceTaintEffect"`
 
 	// TolerationSeconds represents the period of time the toleration (which must be
@@ -1589,7 +1891,7 @@ type DeviceToleration struct {
 // A toleration operator is the set of operators that can be used in a toleration.
 //
 // +enum
-// +k8s:alpha(since: "1.36")=+k8s:enum
+// +k8s:beta(since: "1.37")=+k8s:enum
 type DeviceTolerationOperator string
 
 const (
@@ -1603,8 +1905,8 @@ type ResourceClaimStatus struct {
 	// Allocation is set once the claim has been allocated successfully.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:update=NoModify
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:update=NoModify
 	Allocation *AllocationResult `json:"allocation,omitempty" protobuf:"bytes,1,opt,name=allocation"`
 
 	// ReservedFor indicates which entities are currently allowed to use
@@ -1632,10 +1934,10 @@ type ResourceClaimStatus struct {
 	// +listMapKey=uid
 	// +patchStrategy=merge
 	// +patchMergeKey=uid
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:listType=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=uid
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=256
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:listType=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=uid
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=256
 	ReservedFor []ResourceClaimConsumerReference `json:"reservedFor,omitempty" protobuf:"bytes,2,opt,name=reservedFor" patchStrategy:"merge" patchMergeKey:"uid"`
 
 	// DeallocationRequested is tombstoned since Kubernetes 1.32 where
@@ -1648,18 +1950,18 @@ type ResourceClaimStatus struct {
 	// information. Entries are owned by their respective drivers.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +listType=map
 	// +listMapKey=driver
 	// +listMapKey=device
 	// +listMapKey=pool
 	// +listMapKey=shareID
 	// +featureGate=DRAResourceClaimDeviceStatus
-	// +k8s:alpha(since: "1.36")=+k8s:listType=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=driver
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=device
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=pool
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=shareID
+	// +k8s:beta(since: "1.37")=+k8s:listType=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=driver
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=device
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=pool
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=shareID
 	Devices []AllocatedDeviceStatus `json:"devices,omitempty" protobuf:"bytes,4,opt,name=devices"`
 }
 
@@ -1722,8 +2024,8 @@ type DeviceAllocationResult struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Results []DeviceRequestAllocationResult `json:"results,omitempty" protobuf:"bytes,1,opt,name=results"`
 
 	// This field is a combination of all the claim and class configuration parameters.
@@ -1736,8 +2038,8 @@ type DeviceAllocationResult struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=64
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=64
 	Config []DeviceAllocationConfiguration `json:"config,omitempty" protobuf:"bytes,2,opt,name=config"`
 }
 
@@ -1766,9 +2068,9 @@ type DeviceRequestAllocationResult struct {
 	// vendor of the driver. It should use only lower case characters.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name-caseless
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:maxLength=63
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name-caseless
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:maxLength=63
 	Driver string `json:"driver" protobuf:"bytes,2,name=driver"`
 
 	// This name together with the driver name and the device name field
@@ -1778,8 +2080,8 @@ type DeviceRequestAllocationResult struct {
 	// DNS sub-domains separated by slashes.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-resource-pool-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-pool-name
 	Pool string `json:"pool" protobuf:"bytes,3,name=pool"`
 
 	// Device references one device instance via its name in the driver's
@@ -1811,8 +2113,7 @@ type DeviceRequestAllocationResult struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceTaints
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=16
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Tolerations []DeviceToleration `json:"tolerations,omitempty" protobuf:"bytes,6,opt,name=tolerations"`
 
 	// BindingConditions contains a copy of the BindingConditions
@@ -1824,8 +2125,8 @@ type DeviceRequestAllocationResult struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=4
 	BindingConditions []string `json:"bindingConditions,omitempty" protobuf:"bytes,7,rep,name=bindingConditions"`
 
 	// BindingFailureConditions contains a copy of the BindingFailureConditions
@@ -1837,8 +2138,8 @@ type DeviceRequestAllocationResult struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=4
 	BindingFailureConditions []string `json:"bindingFailureConditions,omitempty" protobuf:"bytes,8,rep,name=bindingFailureConditions"`
 
 	// ShareID uniquely identifies an individual allocation share of the device,
@@ -1848,8 +2149,8 @@ type DeviceRequestAllocationResult struct {
 	//
 	// +optional
 	// +featureGate=DRAConsumableCapacity
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-uuid
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-uuid
 	ShareID *types.UID `json:"shareID,omitempty" protobuf:"bytes,9,opt,name=shareID"`
 
 	// ConsumedCapacity tracks the amount of capacity consumed per device as part of the claim request.
@@ -1864,6 +2165,19 @@ type DeviceRequestAllocationResult struct {
 	// +optional
 	// +featureGate=DRAConsumableCapacity
 	ConsumedCapacity map[QualifiedName]resource.Quantity `json:"consumedCapacity,omitempty" protobuf:"bytes,10,rep,name=consumedCapacity"`
+
+	// SkipNodeOperations lists node-local resource operations (gRPC calls)
+	// that will be skipped for this allocated device when determining whether
+	// operations are necessary on the node. If all allocated devices for a driver in
+	// a claim skip an operation, that gRPC call will be skipped. It is a copy of
+	// the ResourceSlice.spec.skipNodeOperations value at the time when the device was allocated.
+	//
+	// +optional
+	// +listType=set
+	// +k8s:listType=set
+	// +featureGate=DRAOptionalNodeOperations
+	// +k8s:optional
+	SkipNodeOperations []SkipNodeOperation `json:"skipNodeOperations,omitempty" protobuf:"bytes,11,rep,name=skipNodeOperations,casttype=SkipNodeOperation"`
 }
 
 // DeviceAllocationConfiguration gets embedded in an AllocationResult.
@@ -1873,7 +2187,7 @@ type DeviceAllocationConfiguration struct {
 	// or from a claim.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Source AllocationConfigSource `json:"source" protobuf:"bytes,1,name=source"`
 
 	// Requests lists the names of requests where the configuration applies.
@@ -1885,17 +2199,17 @@ type DeviceAllocationConfiguration struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=set
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:unique=set
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Requests []string `json:"requests,omitempty" protobuf:"bytes,2,opt,name=requests"`
 
-	DeviceConfiguration `json:",inline" protobuf:"bytes,3,name=deviceConfiguration"`
+	DeviceConfiguration `json:"" protobuf:"bytes,3,name=deviceConfiguration"`
 }
 
 // +enum
-// +k8s:alpha(since: "1.36")=+k8s:enum
+// +k8s:beta(since: "1.37")=+k8s:enum
 type AllocationConfigSource string
 
 // Valid [DeviceAllocationConfiguration.Source] values.
@@ -1909,7 +2223,7 @@ const (
 
 // ResourceClaimList is a collection of claims.
 type ResourceClaimList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -1931,11 +2245,11 @@ type ResourceClaimList struct {
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type DeviceClass struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:format=k8s-long-name
+	// +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:format=k8s-long-name
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec defines what can be allocated and how to configure it.
@@ -1946,6 +2260,7 @@ type DeviceClass struct {
 	// the time of allocation.
 	//
 	// Changing the spec automatically increments the metadata.generation number.
+	// +optional
 	Spec DeviceClassSpec `json:"spec" protobuf:"bytes,2,name=spec"`
 }
 
@@ -1956,8 +2271,8 @@ type DeviceClassSpec struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Selectors []DeviceSelector `json:"selectors,omitempty" protobuf:"bytes,1,opt,name=selectors"`
 
 	// Config defines configuration parameters that apply to each device that is claimed via this class.
@@ -1968,8 +2283,8 @@ type DeviceClassSpec struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Config []DeviceClassConfiguration `json:"config,omitempty" protobuf:"bytes,2,opt,name=config"`
 
 	// SuitableNodes is tombstoned since Kubernetes 1.32 where
@@ -1986,17 +2301,16 @@ type DeviceClassSpec struct {
 	// If two classes are created at the same time, then the name of the class
 	// lexicographically sorted first is picked.
 	//
-	// This is a beta field.
 	// +optional
 	// +featureGate=DRAExtendedResource
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-extended-resource-name
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-extended-resource-name
 	ExtendedResourceName *string `json:"extendedResourceName,omitempty" protobuf:"bytes,4,opt,name=extendedResourceName"`
 }
 
 // DeviceClassConfiguration is used in DeviceClass.
 type DeviceClassConfiguration struct {
-	DeviceConfiguration `json:",inline" protobuf:"bytes,1,opt,name=deviceConfiguration"`
+	DeviceConfiguration `json:"" protobuf:"bytes,1,opt,name=deviceConfiguration"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
@@ -2004,7 +2318,7 @@ type DeviceClassConfiguration struct {
 
 // DeviceClassList is a collection of classes.
 type DeviceClassList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -2022,7 +2336,7 @@ type DeviceClassList struct {
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type ResourceClaimTemplate struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -2032,6 +2346,7 @@ type ResourceClaimTemplate struct {
 	// This field is immutable. A ResourceClaim will get created by the
 	// control plane for a Pod when needed and then not get updated
 	// anymore.
+	// +optional
 	Spec ResourceClaimTemplateSpec `json:"spec" protobuf:"bytes,2,name=spec"`
 }
 
@@ -2041,11 +2356,13 @@ type ResourceClaimTemplateSpec struct {
 	// when creating it. No other fields are allowed and will be rejected during
 	// validation.
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec for the ResourceClaim. The entire content is copied unchanged
 	// into the ResourceClaim that gets created from this template. The
 	// same fields as in a ResourceClaim are also valid here.
+	// +optional
 	Spec ResourceClaimSpec `json:"spec" protobuf:"bytes,2,name=spec"`
 }
 
@@ -2054,7 +2371,7 @@ type ResourceClaimTemplateSpec struct {
 
 // ResourceClaimTemplateList is a collection of claim templates.
 type ResourceClaimTemplateList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -2116,8 +2433,8 @@ type AllocatedDeviceStatus struct {
 	//
 	// +optional
 	// +featureGate=DRAConsumableCapacity
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-uuid
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-uuid
 	ShareID *string `json:"shareID,omitempty" protobuf:"bytes,7,opt,name=shareID"`
 
 	// Conditions contains the latest observation of the device's state.
@@ -2129,6 +2446,9 @@ type AllocatedDeviceStatus struct {
 	// +optional
 	// +listType=map
 	// +listMapKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 	Conditions []metav1.Condition `json:"conditions" protobuf:"bytes,4,opt,name=conditions"`
 
 	// Data contains arbitrary driver-specific data.
@@ -2141,7 +2461,7 @@ type AllocatedDeviceStatus struct {
 	// NetworkData contains network-related information specific to the device.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	NetworkData *NetworkDeviceData `json:"networkData,omitempty" protobuf:"bytes,6,opt,name=networkData"`
 }
 
@@ -2156,8 +2476,8 @@ type NetworkDeviceData struct {
 	// Must not be longer than 256 bytes.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxBytes=256
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxBytes=256
 	InterfaceName string `json:"interfaceName,omitempty" protobuf:"bytes,1,opt,name=interfaceName"`
 
 	// IPs lists the network addresses assigned to the device's network interface.
@@ -2170,10 +2490,10 @@ type NetworkDeviceData struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=set
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=16
+	// +k8s:beta(since: "1.37")=+k8s:unique=set
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=16
 	IPs []string `json:"ips,omitempty" protobuf:"bytes,2,opt,name=ips"`
 
 	// HardwareAddress represents the hardware address (e.g. MAC Address) of the device's network interface.
@@ -2181,7 +2501,7 @@ type NetworkDeviceData struct {
 	// Must not be longer than 128 bytes.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxBytes=128
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxBytes=128
 	HardwareAddress string `json:"hardwareAddress,omitempty" protobuf:"bytes,3,opt,name=hardwareAddress"`
 }
diff --git a/vendor/k8s.io/api/resource/v1beta1/types_swagger_doc_generated.go b/vendor/k8s.io/api/resource/v1beta1/types_swagger_doc_generated.go
index 4b147a3f3e..d1485ad84a 100644
--- a/vendor/k8s.io/api/resource/v1beta1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/resource/v1beta1/types_swagger_doc_generated.go
@@ -54,19 +54,19 @@ func (AllocationResult) SwaggerDoc() map[string]string {
 }
 
 var map_BasicDevice = map[string]string{
-	"":                                "BasicDevice defines one device instance.",
-	"attributes":                      "Attributes defines the set of attributes for this device. The name of each attribute must be unique in that set.\n\nThe maximum number of attributes and capacities combined is 32.",
-	"capacity":                        "Capacity defines the set of capacities for this device. The name of each capacity must be unique in that set.\n\nThe maximum number of attributes and capacities combined is 32.",
-	"consumesCounters":                "ConsumesCounters defines a list of references to sharedCounters and the set of counters that the device will consume from those counter sets.\n\nThere can only be a single entry per counterSet.\n\nThe maximum number of device counter consumptions per device is 2.",
-	"nodeName":                        "NodeName identifies the node where the device is available.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
-	"nodeSelector":                    "NodeSelector defines the nodes where the device is available.\n\nMust use exactly one term.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
-	"allNodes":                        "AllNodes indicates that all nodes have access to the device.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
-	"taints":                          "If specified, these are the driver-defined taints.\n\nThe maximum number of taints is 16. If taints are set for any device in a ResourceSlice, then the maximum number of allowed devices per ResourceSlice is 64 instead of 128.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
-	"bindsToNode":                     "BindsToNode indicates if the usage of an allocation involving this device has to be limited to exactly the node that was chosen when allocating the claim. If set to true, the scheduler will set the ResourceClaim.Status.Allocation.NodeSelector to match the node where the allocation was made.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
-	"bindingConditions":               "BindingConditions defines the conditions for proceeding with binding. All of these conditions must be set in the per-device status conditions with a value of True to proceed with binding the pod to the node while scheduling the pod.\n\nThe maximum number of binding conditions is 4.\n\nThe conditions must be a valid condition type string.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
-	"bindingFailureConditions":        "BindingFailureConditions defines the conditions for binding failure. They may be set in the per-device status conditions. If any is true, a binding failure occurred.\n\nThe maximum number of binding failure conditions is 4.\n\nThe conditions must be a valid condition type string.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
-	"allowMultipleAllocations":        "AllowMultipleAllocations marks whether the device is allowed to be allocated to multiple DeviceRequests.\n\nIf AllowMultipleAllocations is set to true, the device can be allocated more than once, and all of its capacity is consumable, regardless of whether the requestPolicy is defined or not.",
-	"nodeAllocatableResourceMappings": "NodeAllocatableResourceMappings defines the mapping of node resources that are managed by the DRA driver exposing this device. This includes resources currently reported in v1.Node `status.allocatable` that are not extended resources (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources). Examples include \"cpu\", \"memory\", \"ephemeral-storage\", and hugepages. In addition to standard requests made through the Pod `spec`, these resources can also be requested through claims and allocated by the DRA driver. For example, a CPU DRA driver might allocate exclusive CPUs or auxiliary node memory dependencies of an accelerator device. The keys of this map are the node-allocatable resource names (e.g., \"cpu\", \"memory\"). Extended resource names are not permitted as keys.",
+	"":                         "BasicDevice defines one device instance.",
+	"attributes":               "Attributes defines the set of attributes for this device. The name of each attribute must be unique in that set.\n\nThe maximum number of attributes and capacities combined is 32.",
+	"capacity":                 "Capacity defines the set of capacities for this device. The name of each capacity must be unique in that set.\n\nThe maximum number of attributes and capacities combined is 32.",
+	"consumesCounters":         "ConsumesCounters defines a list of references to sharedCounters and the set of counters that the device will consume from those counter sets.\n\nThere can only be a single entry per counterSet.\n\nThe maximum number of device counter consumptions per device is 2.",
+	"nodeName":                 "NodeName identifies the node where the device is available.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
+	"nodeSelector":             "NodeSelector defines the nodes where the device is available.\n\nMust use exactly one term.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
+	"allNodes":                 "AllNodes indicates that all nodes have access to the device.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
+	"taints":                   "If specified, these are the driver-defined taints.\n\nThe maximum number of taints is 16. If taints are set for any device in a ResourceSlice, then the maximum number of allowed devices per ResourceSlice is 64 instead of 128.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
+	"bindsToNode":              "BindsToNode indicates if the usage of an allocation involving this device has to be limited to exactly the node that was chosen when allocating the claim. If set to true, the scheduler will set the ResourceClaim.Status.Allocation.NodeSelector to match the node where the allocation was made.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
+	"bindingConditions":        "BindingConditions defines the conditions for proceeding with binding. All of these conditions must be set in the per-device status conditions with a value of True to proceed with binding the pod to the node while scheduling the pod.\n\nThe maximum number of binding conditions is 4.\n\nThe conditions must be a valid condition type string.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
+	"bindingFailureConditions": "BindingFailureConditions defines the conditions for binding failure. They may be set in the per-device status conditions. If any is true, a binding failure occurred.\n\nThe maximum number of binding failure conditions is 4.\n\nThe conditions must be a valid condition type string.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
+	"allowMultipleAllocations": "AllowMultipleAllocations marks whether the device is allowed to be allocated to multiple DeviceRequests.\n\nIf AllowMultipleAllocations is set to true, the device can be allocated more than once, and all of its capacity is consumable, regardless of whether the requestPolicy is defined or not.",
+	"nodeAllocatableResources": "NodeAllocatableResources defines the mapping of node resources that are managed by the DRA driver exposing this device. This includes resources currently reported in v1.Node `status.allocatable` that are not extended resources (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources). Examples include \"cpu\", \"memory\", \"ephemeral-storage\", and hugepages. In addition to standard requests made through the Pod `spec`, these resources can also be requested through claims and allocated by the DRA driver. For example, a CPU DRA driver might allocate exclusive CPUs or auxiliary node memory dependencies of an accelerator device. The keys of this map are the node-allocatable resource names (e.g., \"cpu\", \"memory\"). Extended resource names are not permitted as keys.",
 }
 
 func (BasicDevice) SwaggerDoc() map[string]string {
@@ -75,7 +75,7 @@ func (BasicDevice) SwaggerDoc() map[string]string {
 
 var map_CELDeviceSelector = map[string]string{
 	"":           "CELDeviceSelector contains a CEL expression for selecting a device.",
-	"expression": "Expression is a CEL expression which evaluates a single device. It must evaluate to true when the device under consideration satisfies the desired criteria, and false when it does not. Any other result is an error and causes allocation of devices to abort.\n\nThe expression's input is an object named \"device\", which carries the following properties:\n - driver (string): the name of the driver which defines this device.\n - attributes (map[string]object): the device's attributes, grouped by prefix\n   (e.g. device.attributes[\"dra.example.com\"] evaluates to an object with all\n   of the attributes which were prefixed by \"dra.example.com\".\n - capacity (map[string]object): the device's capacities, grouped by prefix.\n - allowMultipleAllocations (bool): the allowMultipleAllocations property of the device\n   (v1.34+ with the DRAConsumableCapacity feature enabled).\n\nExample: Consider a device with driver=\"dra.example.com\", which exposes two attributes named \"model\" and \"ext.example.com/family\" and which exposes one capacity named \"modules\". This input to this expression would have the following fields:\n\n    device.driver\n    device.attributes[\"dra.example.com\"].model\n    device.attributes[\"ext.example.com\"].family\n    device.capacity[\"dra.example.com\"].modules\n\nThe device.driver field can be used to check for a specific driver, either as a high-level precondition (i.e. you only want to consider devices from this driver) or as part of a multi-clause expression that is meant to consider devices from different drivers.\n\nThe value type of each attribute is defined by the device definition, and users who write these expressions must consult the documentation for their specific drivers. The value type of each capacity is Quantity.\n\nIf an unknown prefix is used as a lookup in either device.attributes or device.capacity, an empty map will be returned. Any reference to an unknown field will cause an evaluation error and allocation to abort.\n\nA robust expression should check for the existence of attributes before referencing them.\n\nFor ease of use, the cel.bind() function is enabled, and can be used to simplify expressions that access multiple attributes with the same domain. For example:\n\n    cel.bind(dra, device.attributes[\"dra.example.com\"], dra.someBool && dra.anotherBool)\n\nWhen the DRAListTypeAttributes feature gate is enabled, the includes() helper is available and it can work for both scalar and list-type attributes. It was introduced to support smooth migration from scalar attributes to list-type attributes while keeping CEL expressions simple. For example:\n\n    device.attributes[\"dra.example.com\"].models.includes(\"some-model\")\n\nThe length of the expression must be smaller or equal to 10 Ki. The cost of evaluating it is also limited based on the estimated number of logical steps.",
+	"expression": "Expression is a CEL expression which evaluates a single device. It must evaluate to true when the device under consideration satisfies the desired criteria, and false when it does not. Any other result is an error and causes allocation of devices to abort.\n\nThe expression's input is an object named \"device\", which carries the following properties:\n - driver (string): the name of the driver which defines this device.\n - attributes (map[string]object): the device's attributes, grouped by prefix\n   (e.g. device.attributes[\"dra.example.com\"] evaluates to an object with all\n   of the attributes which were prefixed by \"dra.example.com\").\n - capacity (map[string]object): the device's capacities, grouped by prefix.\n - allowMultipleAllocations (bool): the allowMultipleAllocations property of the device\n   (v1.34+ with the DRAConsumableCapacity feature enabled).\n\nExample: Consider a device with driver=\"dra.example.com\", which exposes two attributes named \"model\" and \"ext.example.com/family\" and which exposes one capacity named \"modules\". This input to this expression would have the following fields:\n\n    device.driver\n    device.attributes[\"dra.example.com\"].model\n    device.attributes[\"ext.example.com\"].family\n    device.capacity[\"dra.example.com\"].modules\n\nThe device.driver field can be used to check for a specific driver, either as a high-level precondition (i.e. you only want to consider devices from this driver) or as part of a multi-clause expression that is meant to consider devices from different drivers.\n\nThe value type of each attribute is defined by the device definition, and users who write these expressions must consult the documentation for their specific drivers. The value type of each capacity is Quantity.\n\nIf an unknown prefix is used as a lookup in either device.attributes or device.capacity, an empty map will be returned. Any reference to an unknown field will cause an evaluation error and allocation to abort.\n\nA robust expression should check for the existence of attributes before referencing them.\n\nCommon errors: - \"no such key\": Use optional chaining (.? followed by orValue())\n  or guarding the check with has() for optional fields.\n  See CEL Optional Types for details:\n  https://pkg.go.dev/github.com/google/cel-go@v0.17.4/cel#OptionalTypes\n\nFor more CEL expression syntax and examples, see: https://kubernetes.io/docs/reference/using-api/cel/\n\nFor ease of use, the cel.bind() function is enabled, and can be used to simplify expressions that access multiple attributes with the same domain. For example:\n\n    cel.bind(dra, device.attributes[\"dra.example.com\"], dra.someBool && dra.anotherBool)\n\nWhen the DRAListTypeAttributes feature gate is enabled, the includes() helper is available and it can work for both scalar and list-type attributes. It was introduced to support smooth migration from scalar attributes to list-type attributes while keeping CEL expressions simple. For example:\n\n    device.attributes[\"dra.example.com\"].models.includes(\"some-model\")\n\nThe length of the expression must be smaller or equal to 10 Ki. The cost of evaluating it is also limited based on the estimated number of logical steps.",
 }
 
 func (CELDeviceSelector) SwaggerDoc() map[string]string {
@@ -94,7 +94,7 @@ func (CapacityRequestPolicy) SwaggerDoc() map[string]string {
 }
 
 var map_CapacityRequestPolicyRange = map[string]string{
-	"":     "CapacityRequestPolicyRange defines a valid range for consumable capacity values.\n\n  - If the requested amount is less than Min, it is rounded up to the Min value.\n  - If Step is set and the requested amount is between Min and Max but not aligned with Step,\n    it will be rounded up to the next value equal to Min + (n * Step).\n  - If Step is not set, the requested amount is used as-is if it falls within the range Min to Max (if set).\n  - If the requested or rounded amount exceeds Max (if set), the request does not satisfy the policy,\n    and the device cannot be allocated.",
+	"":     "CapacityRequestPolicyRange defines a valid range for consumable capacity values.\n\nIf the DRAFractionalCapacityRange feature gate is enabled and at least one of Min, Max, or Step is a fractional quantity (i.e. its value is not an integer), milli-unit arithmetic is used instead, supporting values with up to 3 decimal places (e.g. 100m = 0.1). The largest supported value then is 1000 times smaller compared to using 64-bit integers. Otherwise, all comparisons use 64-bit integer arithmetic via resource.Quantity.Value().\n\n  - If the requested amount is less than Min, it is rounded up to the Min value.\n  - If Step is set and the requested amount is between Min and Max but not aligned with Step,\n    it will be rounded up to the next value equal to Min + (n * Step).\n  - If Step is not set, the requested amount is used as-is if it falls within the range Min to Max (if set).\n  - If the requested or rounded amount exceeds Max (if set), the request does not satisfy the policy,\n    and the device cannot be allocated.",
 	"min":  "Min specifies the minimum capacity allowed for a consumption request.\n\nMin must be greater than or equal to zero, and less than or equal to the capacity value. requestPolicy.default must be more than or equal to the minimum.",
 	"max":  "Max defines the upper limit for capacity that can be requested.\n\nMax must be less than or equal to the capacity value. Min and requestPolicy.default must be less than or equal to the maximum.",
 	"step": "Step defines the step size between valid capacity amounts within the range.\n\nMax (if set) and requestPolicy.default must be a multiple of Step. Min + Step must be less than or equal to the capacity value.",
@@ -240,7 +240,7 @@ var map_DeviceClassSpec = map[string]string{
 	"":                     "DeviceClassSpec is used in a [DeviceClass] to define what can be allocated and how to configure it.",
 	"selectors":            "Each selector must be satisfied by a device which is claimed via this class.",
 	"config":               "Config defines configuration parameters that apply to each device that is claimed via this class. Some classses may potentially be satisfied by multiple drivers, so each instance of a vendor configuration applies to exactly one driver.\n\nThey are passed to the driver, but are not considered while allocating the claim.",
-	"extendedResourceName": "ExtendedResourceName is the extended resource name for the devices of this class. The devices of this class can be used to satisfy a pod's extended resource requests. It has the same format as the name of a pod's extended resource. It should be unique among all the device classes in a cluster. If two device classes have the same name, then the class created later is picked to satisfy a pod's extended resource requests. If two classes are created at the same time, then the name of the class lexicographically sorted first is picked.\n\nThis is a beta field.",
+	"extendedResourceName": "ExtendedResourceName is the extended resource name for the devices of this class. The devices of this class can be used to satisfy a pod's extended resource requests. It has the same format as the name of a pod's extended resource. It should be unique among all the device classes in a cluster. If two device classes have the same name, then the class created later is picked to satisfy a pod's extended resource requests. If two classes are created at the same time, then the name of the class lexicographically sorted first is picked.",
 }
 
 func (DeviceClassSpec) SwaggerDoc() map[string]string {
@@ -268,26 +268,38 @@ func (DeviceConstraint) SwaggerDoc() map[string]string {
 }
 
 var map_DeviceCounterConsumption = map[string]string{
-	"":           "DeviceCounterConsumption defines a set of counters that a device will consume from a CounterSet.",
-	"counterSet": "CounterSet is the name of the set from which the counters defined will be consumed.",
-	"counters":   "Counters defines the counters that will be consumed by the device.\n\nThe maximum number of counters is 32.",
+	"":                    "DeviceCounterConsumption defines a set of counters that a device will consume from a CounterSet.",
+	"counterSet":          "CounterSet is the name of the set from which the counters defined will be consumed.",
+	"counters":            "Counters defines the counters that will be consumed by the device.\n\nThe maximum number of counters is 32.",
+	"compatibilityGroups": "CompatibilityGroups is a list of opaque group names for this counter set consumption.\n\nDevices that consume counters from the same counter set may only be allocated at the same time (\"co-allocated\") if they all share at least one common group: the intersection of the CompatibilityGroups of all co-allocated devices on that counter set must be non-empty. Devices that consume from different counter sets are never compared via this field.\n\nAn unset field, an explicit nil, and an empty list are equivalent and mean \"no groups\": such a device is only co-allocatable with sibling devices on the same counter set that also have no groups, and is never co-allocatable with a device that declares one or more groups.\n\nGroup names are opaque and meaningful only within the publishing driver's pool.\n\nThe maximum number of groups is 2, and the names must be unique.",
 }
 
 func (DeviceCounterConsumption) SwaggerDoc() map[string]string {
 	return map_DeviceCounterConsumption
 }
 
+var map_DeviceDerivedAttribute = map[string]string{
+	"":           "DeviceDerivedAttribute defines a derived attribute computed via CEL.",
+	"name":       "Name is the identifier for this derived attribute, used in constraints.\n\nIt must be a DNS subdomain followed by a slash (\"/\") followed by a C identifier (e.g. \"example.com/numaNode\" or \"derived/numaNode\").\n\nIf the chosen name matches an existing physical attribute from a driver, the derived attribute's expression will shadow the physical attribute, and its evaluated value will be used in constraints instead. When the goal is to define a derived attribute that is only used within the ResourceClaim and not meant to shadow an existing attribute, use a domain prefix that no DRA driver should be using (e.g. \"derived/myAttribute\").\n\nIt is not valid to define a derived attribute that isn't used in at least one constraint.",
+	"expression": "Expression is a CEL expression evaluated against each candidate device. The expression must evaluate to a primitive scalar (string, integer, boolean, or semver) or a list of these scalars ([]string, []int64, []bool, []semver) to act as a virtual grouping key. Any other return type is an error and causes CEL evaluation for the device to fail.\n\nThe expression's input is an object named \"device\", which carries the same properties as in a CELDeviceSelector.\n\nWhen pod scheduling encounters CEL runtime errors (such as looking up an attribute that isn't defined) for some devices, it will abort allocation and fail scheduling for the Pod. Surfacing evaluation errors immediately prevents silent topology matching failures that are extremely hard to detect. A robust expression should, for example, check for the existence of attributes before referencing them to avoid runtime evaluation errors.\n\nThe expression gets evaluated after a device has passed the other selector expressions for the request in which this expression is used. This allows writing expressions that are tailored towards the specific devices being requested (for example, by assuming the device is from a certain vendor and skipping those checks).\n\nThe length of the expression must be smaller or equal to 10 Ki. The cost of evaluating it is also limited based on the estimated number of logical steps; the combined cost of all derived attributes in a claim is capped by a shared CEL cost budget.",
+}
+
+func (DeviceDerivedAttribute) SwaggerDoc() map[string]string {
+	return map_DeviceDerivedAttribute
+}
+
 var map_DeviceRequest = map[string]string{
-	"":                "DeviceRequest is a request for devices required for a claim. This is typically a request for a single resource like a device, but can also ask for several identical devices.",
-	"name":            "Name can be used to reference this request in a pod.spec.containers[].resources.claims entry and in a constraint of the claim.\n\nMust be a DNS label and unique among all DeviceRequests in a ResourceClaim.",
-	"deviceClassName": "DeviceClassName references a specific DeviceClass, which can define additional configuration and selectors to be inherited by this request.\n\nA class is required if no subrequests are specified in the firstAvailable list and no class can be set if subrequests are specified in the firstAvailable list. Which classes are available depends on the cluster.\n\nAdministrators may use this to restrict which devices may get requested by only installing classes with selectors for permitted devices. If users are free to request anything without restrictions, then administrators can create an empty DeviceClass for users to reference.",
-	"selectors":       "Selectors define criteria which must be satisfied by a specific device in order for that device to be considered for this request. All selectors must be satisfied for a device to be considered.\n\nThis field can only be set when deviceClassName is set and no subrequests are specified in the firstAvailable list.",
-	"allocationMode":  "AllocationMode and its related fields define how devices are allocated to satisfy this request. Supported values are:\n\n- ExactCount: This request is for a specific number of devices.\n  This is the default. The exact number is provided in the\n  count field.\n\n- All: This request is for all of the matching devices in a pool.\n  At least one device must exist on the node for the allocation to succeed.\n  Allocation will fail if some devices are already allocated,\n  unless adminAccess is requested.\n\nIf AllocationMode is not specified, the default mode is ExactCount. If the mode is ExactCount and count is not specified, the default count is one. Any other requests must specify this field.\n\nThis field can only be set when deviceClassName is set and no subrequests are specified in the firstAvailable list.\n\nMore modes may get added in the future. Clients must refuse to handle requests with unknown modes.",
-	"count":           "Count is used only when the count mode is \"ExactCount\". Must be greater than zero. If AllocationMode is ExactCount and this field is not specified, the default is one.\n\nThis field can only be set when deviceClassName is set and no subrequests are specified in the firstAvailable list.",
-	"adminAccess":     "AdminAccess indicates that this is a claim for administrative access to the device(s). Claims with AdminAccess are expected to be used for monitoring or other management services for a device.  They ignore all ordinary claims to the device with respect to access modes and any resource allocations.\n\nThis field can only be set when deviceClassName is set and no subrequests are specified in the firstAvailable list.\n\nThis is an alpha field and requires enabling the DRAAdminAccess feature gate. Admin access is disabled if this field is unset or set to false, otherwise it is enabled.",
-	"firstAvailable":  "FirstAvailable contains subrequests, of which exactly one will be satisfied by the scheduler to satisfy this request. It tries to satisfy them in the order in which they are listed here. So if there are two entries in the list, the scheduler will only check the second one if it determines that the first one cannot be used.\n\nThis field may only be set in the entries of DeviceClaim.Requests.\n\nDRA does not yet implement scoring, so the scheduler will select the first set of devices that satisfies all the requests in the claim. And if the requirements can be satisfied on more than one node, other scheduling features will determine which node is chosen. This means that the set of devices allocated to a claim might not be the optimal set available to the cluster. Scoring will be implemented later.",
-	"tolerations":     "If specified, the request's tolerations.\n\nTolerations for NoSchedule are required to allocate a device which has a taint with that effect. The same applies to NoExecute.\n\nIn addition, should any of the allocated devices get tainted with NoExecute after allocation and that effect is not tolerated, then all pods consuming the ResourceClaim get deleted to evict them. The scheduler will not let new pods reserve the claim while it has these tainted devices. Once all pods are evicted, the claim will get deallocated.\n\nThe maximum number of tolerations is 16.\n\nThis field can only be set when deviceClassName is set and no subrequests are specified in the firstAvailable list.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
-	"capacity":        "Capacity define resource requirements against each capacity.\n\nIf this field is unset and the device supports multiple allocations, the default value will be applied to each capacity according to requestPolicy. For the capacity that has no requestPolicy, default is the full capacity value.\n\nApplies to each device allocation. If Count > 1, the request fails if there aren't enough devices that meet the requirements. If AllocationMode is set to All, the request fails if there are devices that otherwise match the request, and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.",
+	"":                  "DeviceRequest is a request for devices required for a claim. This is typically a request for a single resource like a device, but can also ask for several identical devices.",
+	"name":              "Name can be used to reference this request in a pod.spec.containers[].resources.claims entry and in a constraint of the claim.\n\nMust be a DNS label and unique among all DeviceRequests in a ResourceClaim.",
+	"deviceClassName":   "DeviceClassName references a specific DeviceClass, which can define additional configuration and selectors to be inherited by this request.\n\nA class is required if no subrequests are specified in the firstAvailable list and no class can be set if subrequests are specified in the firstAvailable list. Which classes are available depends on the cluster.\n\nAdministrators may use this to restrict which devices may get requested by only installing classes with selectors for permitted devices. If users are free to request anything without restrictions, then administrators can create an empty DeviceClass for users to reference.",
+	"selectors":         "Selectors define criteria which must be satisfied by a specific device in order for that device to be considered for this request. All selectors must be satisfied for a device to be considered.\n\nThis field can only be set when deviceClassName is set and no subrequests are specified in the firstAvailable list.",
+	"allocationMode":    "AllocationMode and its related fields define how devices are allocated to satisfy this request. Supported values are:\n\n- ExactCount: This request is for a specific number of devices.\n  This is the default. The exact number is provided in the\n  count field.\n\n- All: This request is for all of the matching devices in a pool.\n  At least one device must exist on the node for the allocation to succeed.\n  Allocation will fail if some devices are already allocated,\n  unless adminAccess is requested.\n\nIf AllocationMode is not specified, the default mode is ExactCount. If the mode is ExactCount and count is not specified, the default count is one. Any other requests must specify this field.\n\nThis field can only be set when deviceClassName is set and no subrequests are specified in the firstAvailable list.\n\nMore modes may get added in the future. Clients must refuse to handle requests with unknown modes.",
+	"count":             "Count is used only when the count mode is \"ExactCount\". Must be greater than zero. If AllocationMode is ExactCount and this field is not specified, the default is one.\n\nThis field can only be set when deviceClassName is set and no subrequests are specified in the firstAvailable list.",
+	"adminAccess":       "AdminAccess indicates that this is a claim for administrative access to the device(s). Claims with AdminAccess are expected to be used for monitoring or other management services for a device.  They ignore all ordinary claims to the device with respect to access modes and any resource allocations.\n\nThis field can only be set when deviceClassName is set and no subrequests are specified in the firstAvailable list.\n\nThis is an alpha field and requires enabling the DRAAdminAccess feature gate. Admin access is disabled if this field is unset or set to false, otherwise it is enabled.",
+	"firstAvailable":    "FirstAvailable contains subrequests, of which exactly one will be satisfied by the scheduler to satisfy this request. It tries to satisfy them in the order in which they are listed here. So if there are two entries in the list, the scheduler will only check the second one if it determines that the first one cannot be used.\n\nThis field may only be set in the entries of DeviceClaim.Requests.\n\nDRA does not yet implement scoring, so the scheduler will select the first set of devices that satisfies all the requests in the claim. And if the requirements can be satisfied on more than one node, other scheduling features will determine which node is chosen. This means that the set of devices allocated to a claim might not be the optimal set available to the cluster. Scoring will be implemented later.",
+	"tolerations":       "If specified, the request's tolerations.\n\nTolerations for NoSchedule are required to allocate a device which has a taint with that effect. The same applies to NoExecute.\n\nIn addition, should any of the allocated devices get tainted with NoExecute after allocation and that effect is not tolerated, then all pods consuming the ResourceClaim get deleted to evict them. The scheduler will not let new pods reserve the claim while it has these tainted devices. Once all pods are evicted, the claim will get deallocated.\n\nThe maximum number of tolerations is 16.\n\nThis field can only be set when deviceClassName is set and no subrequests are specified in the firstAvailable list.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
+	"capacity":          "Capacity define resource requirements against each capacity.\n\nIf this field is unset and the device supports multiple allocations, the default value will be applied to each capacity according to requestPolicy. For the capacity that has no requestPolicy, default is the full capacity value.\n\nApplies to each device allocation. If Count > 1, the request fails if there aren't enough devices that meet the requirements. If AllocationMode is set to All, the request fails if there are devices that otherwise match the request, and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.",
+	"derivedAttributes": "DerivedAttributes defines a set of virtual attributes computed via CEL expressions for each candidate device. These virtual attributes can be referenced in `.devices.constraints` to align and match different devices (e.g., co-allocating a GPU and a NIC on the same NUMA node) even if their drivers publish different attributes. Derived attributes are not available via `device.attributes` in the CEL environment when evaluating selector expressions.\n\nDerived attributes allow you to extract, transform, or normalize topology information (such as extracting a NUMA index from a complex topology string or renaming a vendor-specific attribute) into a common virtual attribute name at scheduling time. The scheduler then evaluates these virtual attributes exactly like static attributes when matching constraints.\n\nEvery derived attribute defined in this list must be referenced by at least one MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.\n\nThe maximum number of derived attributes is 32.\n\nThis is an alpha field and requires enabling the DRADerivedAttributes feature gate.",
 }
 
 func (DeviceRequest) SwaggerDoc() map[string]string {
@@ -306,6 +318,7 @@ var map_DeviceRequestAllocationResult = map[string]string{
 	"bindingFailureConditions": "BindingFailureConditions contains a copy of the BindingFailureConditions from the corresponding ResourceSlice at the time of allocation.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
 	"shareID":                  "ShareID uniquely identifies an individual allocation share of the device, used when the device supports multiple simultaneous allocations. It serves as an additional map key to differentiate concurrent shares of the same device.",
 	"consumedCapacity":         "ConsumedCapacity tracks the amount of capacity consumed per device as part of the claim request. The consumed amount may differ from the requested amount: it is rounded up to the nearest valid value based on the device’s requestPolicy if applicable (i.e., may not be less than the requested amount).\n\nThe total consumed capacity for each device must not exceed the DeviceCapacity's Value.\n\nThis field is populated only for devices that allow multiple allocations. All capacity entries are included, even if the consumed amount is zero.",
+	"skipNodeOperations":       "SkipNodeOperations lists node-local resource operations (gRPC calls) that will be skipped for this allocated device when determining whether operations are necessary on the node. If all allocated devices for a driver in a claim skip an operation, that gRPC call will be skipped. It is a copy of the ResourceSlice.spec.skipNodeOperations value at the time when the device was allocated.",
 }
 
 func (DeviceRequestAllocationResult) SwaggerDoc() map[string]string {
@@ -322,14 +335,15 @@ func (DeviceSelector) SwaggerDoc() map[string]string {
 }
 
 var map_DeviceSubRequest = map[string]string{
-	"":                "DeviceSubRequest describes a request for device provided in the claim.spec.devices.requests[].firstAvailable array. Each is typically a request for a single resource like a device, but can also ask for several identical devices.\n\nDeviceSubRequest is similar to Request, but doesn't expose the AdminAccess or FirstAvailable fields, as those can only be set on the top-level request. AdminAccess is not supported for requests with a prioritized list, and recursive FirstAvailable fields are not supported.",
-	"name":            "Name can be used to reference this subrequest in the list of constraints or the list of configurations for the claim. References must use the format <main request>/<subrequest>.\n\nMust be a DNS label.",
-	"deviceClassName": "DeviceClassName references a specific DeviceClass, which can define additional configuration and selectors to be inherited by this subrequest.\n\nA class is required. Which classes are available depends on the cluster.\n\nAdministrators may use this to restrict which devices may get requested by only installing classes with selectors for permitted devices. If users are free to request anything without restrictions, then administrators can create an empty DeviceClass for users to reference.",
-	"selectors":       "Selectors define criteria which must be satisfied by a specific device in order for that device to be considered for this subrequest. All selectors must be satisfied for a device to be considered.",
-	"allocationMode":  "AllocationMode and its related fields define how devices are allocated to satisfy this subrequest. Supported values are:\n\n- ExactCount: This request is for a specific number of devices.\n  This is the default. The exact number is provided in the\n  count field.\n\n- All: This subrequest is for all of the matching devices in a pool.\n  Allocation will fail if some devices are already allocated,\n  unless adminAccess is requested.\n\nIf AllocationMode is not specified, the default mode is ExactCount. If the mode is ExactCount and count is not specified, the default count is one. Any other subrequests must specify this field.\n\nMore modes may get added in the future. Clients must refuse to handle requests with unknown modes.",
-	"count":           "Count is used only when the count mode is \"ExactCount\". Must be greater than zero. If AllocationMode is ExactCount and this field is not specified, the default is one.",
-	"tolerations":     "If specified, the request's tolerations.\n\nTolerations for NoSchedule are required to allocate a device which has a taint with that effect. The same applies to NoExecute.\n\nIn addition, should any of the allocated devices get tainted with NoExecute after allocation and that effect is not tolerated, then all pods consuming the ResourceClaim get deleted to evict them. The scheduler will not let new pods reserve the claim while it has these tainted devices. Once all pods are evicted, the claim will get deallocated.\n\nThe maximum number of tolerations is 16.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
-	"capacity":        "Capacity define resource requirements against each capacity.\n\nIf this field is unset and the device supports multiple allocations, the default value will be applied to each capacity according to requestPolicy. For the capacity that has no requestPolicy, default is the full capacity value.\n\nApplies to each device allocation. If Count > 1, the request fails if there aren't enough devices that meet the requirements. If AllocationMode is set to All, the request fails if there are devices that otherwise match the request, and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.",
+	"":                  "DeviceSubRequest describes a request for device provided in the claim.spec.devices.requests[].firstAvailable array. Each is typically a request for a single resource like a device, but can also ask for several identical devices.\n\nDeviceSubRequest is similar to Request, but doesn't expose the AdminAccess or FirstAvailable fields, as those can only be set on the top-level request. AdminAccess is not supported for requests with a prioritized list, and recursive FirstAvailable fields are not supported.",
+	"name":              "Name can be used to reference this subrequest in the list of constraints or the list of configurations for the claim. References must use the format <main request>/<subrequest>.\n\nMust be a DNS label.",
+	"deviceClassName":   "DeviceClassName references a specific DeviceClass, which can define additional configuration and selectors to be inherited by this subrequest.\n\nA class is required. Which classes are available depends on the cluster.\n\nAdministrators may use this to restrict which devices may get requested by only installing classes with selectors for permitted devices. If users are free to request anything without restrictions, then administrators can create an empty DeviceClass for users to reference.",
+	"selectors":         "Selectors define criteria which must be satisfied by a specific device in order for that device to be considered for this subrequest. All selectors must be satisfied for a device to be considered.",
+	"allocationMode":    "AllocationMode and its related fields define how devices are allocated to satisfy this subrequest. Supported values are:\n\n- ExactCount: This request is for a specific number of devices.\n  This is the default. The exact number is provided in the\n  count field.\n\n- All: This subrequest is for all of the matching devices in a pool.\n  Allocation will fail if some devices are already allocated,\n  unless adminAccess is requested.\n\nIf AllocationMode is not specified, the default mode is ExactCount. If the mode is ExactCount and count is not specified, the default count is one. Any other subrequests must specify this field.\n\nMore modes may get added in the future. Clients must refuse to handle requests with unknown modes.",
+	"count":             "Count is used only when the count mode is \"ExactCount\". Must be greater than zero. If AllocationMode is ExactCount and this field is not specified, the default is one.",
+	"tolerations":       "If specified, the request's tolerations.\n\nTolerations for NoSchedule are required to allocate a device which has a taint with that effect. The same applies to NoExecute.\n\nIn addition, should any of the allocated devices get tainted with NoExecute after allocation and that effect is not tolerated, then all pods consuming the ResourceClaim get deleted to evict them. The scheduler will not let new pods reserve the claim while it has these tainted devices. Once all pods are evicted, the claim will get deallocated.\n\nThe maximum number of tolerations is 16.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
+	"capacity":          "Capacity define resource requirements against each capacity.\n\nIf this field is unset and the device supports multiple allocations, the default value will be applied to each capacity according to requestPolicy. For the capacity that has no requestPolicy, default is the full capacity value.\n\nApplies to each device allocation. If Count > 1, the request fails if there aren't enough devices that meet the requirements. If AllocationMode is set to All, the request fails if there are devices that otherwise match the request, and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.",
+	"derivedAttributes": "DerivedAttributes defines a set of virtual attributes computed via CEL expressions for each candidate device. These virtual attributes can be referenced in `.devices.constraints` to align and match different devices (e.g., co-allocating a GPU and a NIC on the same NUMA node) even if their drivers publish different attributes. Derived attributes are not available via `device.attributes` in the CEL environment when evaluating selector expressions.\n\nDerived attributes allow you to extract, transform, or normalize topology information (such as extracting a NUMA index from a complex topology string or renaming a vendor-specific attribute) into a common virtual attribute name at scheduling time. The scheduler then evaluates these virtual attributes exactly like static attributes when matching constraints.\n\nEvery derived attribute defined in this list must be referenced by at least one MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.\n\nThe maximum number of derived attributes is 32.\n\nThis is an alpha field and requires enabling the DRADerivedAttributes feature gate.",
 }
 
 func (DeviceSubRequest) SwaggerDoc() map[string]string {
@@ -372,14 +386,35 @@ func (NetworkDeviceData) SwaggerDoc() map[string]string {
 	return map_NetworkDeviceData
 }
 
-var map_NodeAllocatableResourceMapping = map[string]string{
-	"":                     "NodeAllocatableResourceMapping defines the translation between the DRA device/capacity units requested to the corresponding quantity of the node allocatable resource.",
-	"capacityKey":          "CapacityKey references a capacity name defined as a key in the `spec.devices[*].capacity` map. When this field is set, the value associated with this key in the `status.allocation.devices.results[*].consumedCapacity` map (for a specific claim allocation) determines the base quantity for the node allocatable resource. If `allocationMultiplier` is also set, it is multiplied with the base quantity. For example, if `spec.devices[*].capacity` has an entry \"dra.example.com/memory\": \"128Gi\", and this field is set to \"dra.example.com/memory\", then for a claim allocation that consumes { \"dra.example.com/memory\": \"4Gi\" } the base quantity for the node allocatable resource mapping will be \"4Gi\", and `allocationMultiplier` should be omitted or set to \"1\".",
-	"allocationMultiplier": "AllocationMultiplier is used as a multiplier for the allocated device count or the allocated capacity in the claim. It defaults to 1 if not specified. How the field is used also depends on whether `capacityKey` is set. 1.  If `capacityKey` is NOT set: `allocationMultiplier` multiplies the device count allocated to the claim.\n\t   a. A DRA driver representing each CPU core as a device would have\n       {ResourceName: \"cpu\", allocationMultiplier: \"2\"} in its\n       `nodeAllocatableResourceMappings`. If 4 devices are allocated to the claim,\n\t\t  4 * 2 CPUs would be considered as allocated and subtracted from the node's capacity.\n    b. A GPU device that needs additional node memory per GPU allocation would\n       have {ResourceName: \"memory\", allocationMultiplier: \"2Gi\"}.  Each allocated\n\t\t  GPU device instance of this type will account for 2Gi of memory.\n\n2.  If `capacityKey` IS set: `allocationMultiplier` is multiplied by the amount of that capacity consumed.\n\t   The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `allocationMultiplier`.\n    For example, if a Device's capacity \"dra.example.com/cores\" is consumed,\n    and each \"core\" provides 2 \"cpu\"s, the mapping would be:\n    {ResourceName: \"cpu\", capacityKey: \"dra.example.com/cores\", allocationMultiplier: \"2\"}.\n    If a claim consumes 8 \"dra.example.com/cores\", the CPU footprint is 8 * 2 = 16.",
+var map_NodeAllocatableMapping = map[string]string{
+	"":                   "NodeAllocatableMapping defines how a DRA allocation directly translates into a node allocatable resource quantity. The mapping can be derived from either the count of allocated devices or the specific capacity consumed. These options are mutually exclusive. Kubelet adds this mapped resource quantity from claim to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.",
+	"capacityKey":        "CapacityKey references a capacity name defined as a key in the `spec.devices[*].capacity` map. When this field is set, the value associated with this key in the `status.allocation.devices.results[*].consumedCapacity` map (for a specific claim allocation) determines the base quantity for the node allocatable resource. `capacityMultiplier` must also be set and is multiplied with the base quantity. For example, if `spec.devices[*].capacity` has an entry \"dra.example.com/memory\": \"128Gi\", and this field is set to \"dra.example.com/memory\", then for a claim allocation that consumes { \"dra.example.com/memory\": \"4Gi\" } the base quantity for the node allocatable resource mapping will be \"4Gi\". The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.",
+	"capacityMultiplier": "CapacityMultiplier is used as a multiplier for the allocated capacity consumed. It is only valid if `capacityKey` is set. The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`. For example, if a Device's capacity \"dra.example.com/cores\" is consumed, and each \"core\" provides 2 \"cpu\"s, the mapping would be: {ResourceName: \"cpu\", capacityKey: \"dra.example.com/cores\", capacityMultiplier: \"2\"}. If a claim consumes 8 \"dra.example.com/cores\", the CPU footprint is 8 * 2 = 16.",
+	"deviceMultiplier":   "DeviceMultiplier is used as a multiplier for the allocated device count in the claim. The final node allocatable resource amount is `deviceCount` * `deviceMultiplier`. For example, a DRA driver representing each cache complex (CCX) as a device would have {ResourceName: \"cpu\", deviceMultiplier: \"8\"} in its `nodeAllocatableResources`. If 2 devices (CCX) are allocated to the claim, 2 * 8 = 16 CPUs would be considered as allocated. It is only valid when `capacityKey` and `capacityMultiplier` are not set.",
+}
+
+func (NodeAllocatableMapping) SwaggerDoc() map[string]string {
+	return map_NodeAllocatableMapping
+}
+
+var map_NodeAllocatableOverhead = map[string]string{
+	"":             "NodeAllocatableOverhead defines auxiliary resource overheads incurred when allocating a device. Overheads can be specified as a fixed cost per pod referencing the claim, a variable cost per container reference, or both. Kubelet accounts for this overhead by adding it to both the pod-level and container-level cgroups of referencing containers.",
+	"perPod":       "PerPod is overhead applied once per pod referencing the claim on this node. This is a flat overhead incurred for every pod referencing the claim.",
+	"perContainer": "PerContainer is applied per container reference to the claim. This models overhead scaling linearly with the number of containers actively using the device. When both PerPod and PerContainer are specified, the total overhead allocated for each pod referencing the claim is computed as: Quantity = PerPod + (PerContainer * NumReferences) Kubelet accounts for this overhead in cgroups: - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences). - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container. This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once.",
+}
+
+func (NodeAllocatableOverhead) SwaggerDoc() map[string]string {
+	return map_NodeAllocatableOverhead
+}
+
+var map_NodeAllocatableResource = map[string]string{
+	"":         "NodeAllocatableResource defines the translation between the DRA device/capacity units requested to the corresponding quantity of the node allocatable resource. At least one of Mapping or Overhead must be specified. Not specifying either is an invalid configuration.",
+	"mapping":  "Mapping is used when the device directly models a node allocatable resource like standard CPU or memory (e.g., with a CPU DRA driver). The calculated quantity is accounted for exactly once per claim instance on the node. To prevent node cgroup isolation friction, the scheduler explicitly blocks sharing mapped device claims across multiple pods.",
+	"overhead": "Overhead contains fields for modeling auxiliary overhead incurred on node allocatable resources when allocating devices that are not themselves modeling a node allocatable resource (e.g., host memory overhead for GPUs). Sharing overhead-mapped claims across multiple pods is allowed. The node allocatable overhead is accounted for individually for each pod referencing the claim. Overhead is always subtracted from the node's allocatable capacity for the resource, even when mapping is specified for the same resource. Eg: If a device models memory capacity per socket as a consumable capacity pool via Mapping (with CapacityKey), any overhead specified for the same resource will be subtracted from the node's general allocatable capacity and not from the per-socket capacity pool in Mapping.",
 }
 
-func (NodeAllocatableResourceMapping) SwaggerDoc() map[string]string {
-	return map_NodeAllocatableResourceMapping
+func (NodeAllocatableResource) SwaggerDoc() map[string]string {
+	return map_NodeAllocatableResource
 }
 
 var map_OpaqueDeviceConfiguration = map[string]string{
@@ -477,7 +512,7 @@ func (ResourceClaimTemplateSpec) SwaggerDoc() map[string]string {
 
 var map_ResourcePool = map[string]string{
 	"":                   "ResourcePool describes the pool that ResourceSlices belong to.",
-	"name":               "Name is used to identify the pool. For node-local devices, this is often the node name, but this is not required.\n\nIt must not be longer than 253 characters and must consist of one or more DNS sub-domains separated by slashes. This field is immutable.",
+	"name":               "Name is used to identify the pool. For node-local devices, this is often the node name, but this is not required. A field selector can be used to list only ResourceSlice objects belonging to a certain pool.\n\nIt must not be longer than 253 characters and must consist of one or more DNS sub-domains separated by slashes. This field is immutable.",
 	"generation":         "Generation tracks the change in a pool over time. Whenever a driver changes something about one or more of the resources in a pool, it must change the generation in all ResourceSlices which are part of that pool. Consumers of ResourceSlices should only consider resources from the pool with the highest generation number. The generation may be reset by drivers, which should be fine for consumers, assuming that all ResourceSlices in a pool are updated to match or deleted.\n\nCombined with ResourceSliceCount, this mechanism enables consumers to detect pools which are comprised of multiple ResourceSlices and are in an incomplete state.",
 	"resourceSliceCount": "ResourceSliceCount is the total number of ResourceSlices in the pool at this generation number. Must be greater than zero.\n\nConsumers can use this to check whether they have seen all ResourceSlices belonging to the same pool.",
 }
@@ -516,6 +551,8 @@ var map_ResourceSliceSpec = map[string]string{
 	"devices":                "Devices lists some or all of the devices in this pool.\n\nMust not have more than 128 entries. If any device uses taints or consumes counters the limit is 64.\n\nOnly one of Devices and SharedCounters can be set in a ResourceSlice.",
 	"perDeviceNodeSelection": "PerDeviceNodeSelection defines whether the access from nodes to resources in the pool is set on the ResourceSlice level or on each device. If it is set to true, every device defined the ResourceSlice must specify this individually.\n\nExactly one of NodeName, NodeSelector, AllNodes, and PerDeviceNodeSelection must be set.",
 	"sharedCounters":         "SharedCounters defines a list of counter sets, each of which has a name and a list of counters available.\n\nThe names of the counter sets must be unique in the ResourcePool.\n\nOnly one of Devices and SharedCounters can be set in a ResourceSlice.\n\nThe maximum number of counter sets is 8.",
+	"partitionTypeAttribute": "PartitionTypeAttribute names a string device attribute (by fully qualified name, e.g. \"gpu.example.com/profile\") whose value labels each device with its partition type, such as \"Full\" or \"Half\" for a MIG-style GPU.\n\nWhen set, every partitionable device in the slice must carry the attribute and devices sharing a value must share the same ConsumesCounters cost.",
+	"skipNodeOperations":     "SkipNodeOperations lists node-local resource operations (gRPC calls) that will be skipped for the devices in this slice when determining whether operations are necessary on the node. If all allocated devices for a driver in a claim skip an operation, that gRPC call will be skipped. Valid values are:\n\n- \"NodePrepareResources\": NodePrepareResources gRPC calls are skipped. This\n  value cannot be specified unless \"NodeUnprepareResources\" is also listed\n  (or \"*\" is specified).\n- \"NodeUnprepareResources\": NodeUnprepareResources gRPC calls are skipped. - \"*\": All node-local resource operations are skipped.\n\nOther values may be added in the future. The kubelet must ignore unknown values.",
 }
 
 func (ResourceSliceSpec) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/resource/v1beta1/zz_generated.deepcopy.go b/vendor/k8s.io/api/resource/v1beta1/zz_generated.deepcopy.go
index 78ec7b0d58..85ec2bdf68 100644
--- a/vendor/k8s.io/api/resource/v1beta1/zz_generated.deepcopy.go
+++ b/vendor/k8s.io/api/resource/v1beta1/zz_generated.deepcopy.go
@@ -159,9 +159,9 @@ func (in *BasicDevice) DeepCopyInto(out *BasicDevice) {
 		*out = new(bool)
 		**out = **in
 	}
-	if in.NodeAllocatableResourceMappings != nil {
-		in, out := &in.NodeAllocatableResourceMappings, &out.NodeAllocatableResourceMappings
-		*out = make(map[corev1.ResourceName]NodeAllocatableResourceMapping, len(*in))
+	if in.NodeAllocatableResources != nil {
+		in, out := &in.NodeAllocatableResources, &out.NodeAllocatableResources
+		*out = make(map[corev1.ResourceName]NodeAllocatableResource, len(*in))
 		for key, val := range *in {
 			(*out)[key] = *val.DeepCopy()
 		}
@@ -706,6 +706,11 @@ func (in *DeviceCounterConsumption) DeepCopyInto(out *DeviceCounterConsumption)
 			(*out)[key] = *val.DeepCopy()
 		}
 	}
+	if in.CompatibilityGroups != nil {
+		in, out := &in.CompatibilityGroups, &out.CompatibilityGroups
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
@@ -719,6 +724,22 @@ func (in *DeviceCounterConsumption) DeepCopy() *DeviceCounterConsumption {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DeviceDerivedAttribute) DeepCopyInto(out *DeviceDerivedAttribute) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeviceDerivedAttribute.
+func (in *DeviceDerivedAttribute) DeepCopy() *DeviceDerivedAttribute {
+	if in == nil {
+		return nil
+	}
+	out := new(DeviceDerivedAttribute)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *DeviceRequest) DeepCopyInto(out *DeviceRequest) {
 	*out = *in
@@ -753,6 +774,11 @@ func (in *DeviceRequest) DeepCopyInto(out *DeviceRequest) {
 		*out = new(CapacityRequirements)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.DerivedAttributes != nil {
+		in, out := &in.DerivedAttributes, &out.DerivedAttributes
+		*out = make([]DeviceDerivedAttribute, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
@@ -803,6 +829,11 @@ func (in *DeviceRequestAllocationResult) DeepCopyInto(out *DeviceRequestAllocati
 			(*out)[key] = val.DeepCopy()
 		}
 	}
+	if in.SkipNodeOperations != nil {
+		in, out := &in.SkipNodeOperations, &out.SkipNodeOperations
+		*out = make([]SkipNodeOperation, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
@@ -859,6 +890,11 @@ func (in *DeviceSubRequest) DeepCopyInto(out *DeviceSubRequest) {
 		*out = new(CapacityRequirements)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.DerivedAttributes != nil {
+		in, out := &in.DerivedAttributes, &out.DerivedAttributes
+		*out = make([]DeviceDerivedAttribute, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
@@ -935,27 +971,84 @@ func (in *NetworkDeviceData) DeepCopy() *NetworkDeviceData {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *NodeAllocatableResourceMapping) DeepCopyInto(out *NodeAllocatableResourceMapping) {
+func (in *NodeAllocatableMapping) DeepCopyInto(out *NodeAllocatableMapping) {
 	*out = *in
 	if in.CapacityKey != nil {
 		in, out := &in.CapacityKey, &out.CapacityKey
 		*out = new(QualifiedName)
 		**out = **in
 	}
-	if in.AllocationMultiplier != nil {
-		in, out := &in.AllocationMultiplier, &out.AllocationMultiplier
+	if in.CapacityMultiplier != nil {
+		in, out := &in.CapacityMultiplier, &out.CapacityMultiplier
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	if in.DeviceMultiplier != nil {
+		in, out := &in.DeviceMultiplier, &out.DeviceMultiplier
 		x := (*in).DeepCopy()
 		*out = &x
 	}
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeAllocatableResourceMapping.
-func (in *NodeAllocatableResourceMapping) DeepCopy() *NodeAllocatableResourceMapping {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeAllocatableMapping.
+func (in *NodeAllocatableMapping) DeepCopy() *NodeAllocatableMapping {
 	if in == nil {
 		return nil
 	}
-	out := new(NodeAllocatableResourceMapping)
+	out := new(NodeAllocatableMapping)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NodeAllocatableOverhead) DeepCopyInto(out *NodeAllocatableOverhead) {
+	*out = *in
+	if in.PerPod != nil {
+		in, out := &in.PerPod, &out.PerPod
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	if in.PerContainer != nil {
+		in, out := &in.PerContainer, &out.PerContainer
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeAllocatableOverhead.
+func (in *NodeAllocatableOverhead) DeepCopy() *NodeAllocatableOverhead {
+	if in == nil {
+		return nil
+	}
+	out := new(NodeAllocatableOverhead)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NodeAllocatableResource) DeepCopyInto(out *NodeAllocatableResource) {
+	*out = *in
+	if in.Mapping != nil {
+		in, out := &in.Mapping, &out.Mapping
+		*out = new(NodeAllocatableMapping)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Overhead != nil {
+		in, out := &in.Overhead, &out.Overhead
+		*out = new(NodeAllocatableOverhead)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeAllocatableResource.
+func (in *NodeAllocatableResource) DeepCopy() *NodeAllocatableResource {
+	if in == nil {
+		return nil
+	}
+	out := new(NodeAllocatableResource)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -1286,6 +1379,16 @@ func (in *ResourceSliceSpec) DeepCopyInto(out *ResourceSliceSpec) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.PartitionTypeAttribute != nil {
+		in, out := &in.PartitionTypeAttribute, &out.PartitionTypeAttribute
+		*out = new(FullyQualifiedName)
+		**out = **in
+	}
+	if in.SkipNodeOperations != nil {
+		in, out := &in.SkipNodeOperations, &out.SkipNodeOperations
+		*out = make([]SkipNodeOperation, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
diff --git a/vendor/k8s.io/api/resource/v1beta1/zz_generated.model_name.go b/vendor/k8s.io/api/resource/v1beta1/zz_generated.model_name.go
index a2887e7534..783ec0312d 100644
--- a/vendor/k8s.io/api/resource/v1beta1/zz_generated.model_name.go
+++ b/vendor/k8s.io/api/resource/v1beta1/zz_generated.model_name.go
@@ -136,6 +136,11 @@ func (in DeviceCounterConsumption) OpenAPIModelName() string {
 	return "io.k8s.api.resource.v1beta1.DeviceCounterConsumption"
 }
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeviceDerivedAttribute) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1beta1.DeviceDerivedAttribute"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in DeviceRequest) OpenAPIModelName() string {
 	return "io.k8s.api.resource.v1beta1.DeviceRequest"
@@ -172,8 +177,18 @@ func (in NetworkDeviceData) OpenAPIModelName() string {
 }
 
 // OpenAPIModelName returns the OpenAPI model name for this type.
-func (in NodeAllocatableResourceMapping) OpenAPIModelName() string {
-	return "io.k8s.api.resource.v1beta1.NodeAllocatableResourceMapping"
+func (in NodeAllocatableMapping) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1beta1.NodeAllocatableMapping"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NodeAllocatableOverhead) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1beta1.NodeAllocatableOverhead"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NodeAllocatableResource) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1beta1.NodeAllocatableResource"
 }
 
 // OpenAPIModelName returns the OpenAPI model name for this type.
diff --git a/vendor/k8s.io/api/resource/v1beta2/generated.pb.go b/vendor/k8s.io/api/resource/v1beta2/generated.pb.go
index 6b59098807..d1aae258ea 100644
--- a/vendor/k8s.io/api/resource/v1beta2/generated.pb.go
+++ b/vendor/k8s.io/api/resource/v1beta2/generated.pb.go
@@ -82,6 +82,8 @@ func (m *DeviceConstraint) Reset() { *m = DeviceConstraint{} }
 
 func (m *DeviceCounterConsumption) Reset() { *m = DeviceCounterConsumption{} }
 
+func (m *DeviceDerivedAttribute) Reset() { *m = DeviceDerivedAttribute{} }
+
 func (m *DeviceRequest) Reset() { *m = DeviceRequest{} }
 
 func (m *DeviceRequestAllocationResult) Reset() { *m = DeviceRequestAllocationResult{} }
@@ -108,7 +110,11 @@ func (m *ExactDeviceRequest) Reset() { *m = ExactDeviceRequest{} }
 
 func (m *NetworkDeviceData) Reset() { *m = NetworkDeviceData{} }
 
-func (m *NodeAllocatableResourceMapping) Reset() { *m = NodeAllocatableResourceMapping{} }
+func (m *NodeAllocatableMapping) Reset() { *m = NodeAllocatableMapping{} }
+
+func (m *NodeAllocatableOverhead) Reset() { *m = NodeAllocatableOverhead{} }
+
+func (m *NodeAllocatableResource) Reset() { *m = NodeAllocatableResource{} }
 
 func (m *OpaqueDeviceConfiguration) Reset() { *m = OpaqueDeviceConfiguration{} }
 
@@ -586,14 +592,14 @@ func (m *Device) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
-	if len(m.NodeAllocatableResourceMappings) > 0 {
-		keysForNodeAllocatableResourceMappings := make([]string, 0, len(m.NodeAllocatableResourceMappings))
-		for k := range m.NodeAllocatableResourceMappings {
-			keysForNodeAllocatableResourceMappings = append(keysForNodeAllocatableResourceMappings, string(k))
-		}
-		sort.Strings(keysForNodeAllocatableResourceMappings)
-		for iNdEx := len(keysForNodeAllocatableResourceMappings) - 1; iNdEx >= 0; iNdEx-- {
-			v := m.NodeAllocatableResourceMappings[k8s_io_api_core_v1.ResourceName(keysForNodeAllocatableResourceMappings[iNdEx])]
+	if len(m.NodeAllocatableResources) > 0 {
+		keysForNodeAllocatableResources := make([]string, 0, len(m.NodeAllocatableResources))
+		for k := range m.NodeAllocatableResources {
+			keysForNodeAllocatableResources = append(keysForNodeAllocatableResources, string(k))
+		}
+		sort.Strings(keysForNodeAllocatableResources)
+		for iNdEx := len(keysForNodeAllocatableResources) - 1; iNdEx >= 0; iNdEx-- {
+			v := m.NodeAllocatableResources[k8s_io_api_core_v1.ResourceName(keysForNodeAllocatableResources[iNdEx])]
 			baseI := i
 			{
 				size, err := (&v).MarshalToSizedBuffer(dAtA[:i])
@@ -605,14 +611,14 @@ func (m *Device) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			}
 			i--
 			dAtA[i] = 0x12
-			i -= len(keysForNodeAllocatableResourceMappings[iNdEx])
-			copy(dAtA[i:], keysForNodeAllocatableResourceMappings[iNdEx])
-			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForNodeAllocatableResourceMappings[iNdEx])))
+			i -= len(keysForNodeAllocatableResources[iNdEx])
+			copy(dAtA[i:], keysForNodeAllocatableResources[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(keysForNodeAllocatableResources[iNdEx])))
 			i--
 			dAtA[i] = 0xa
 			i = encodeVarintGenerated(dAtA, i, uint64(baseI-i))
 			i--
-			dAtA[i] = 0x6a
+			dAtA[i] = 0x72
 		}
 	}
 	if m.AllowMultipleAllocations != nil {
@@ -1397,6 +1403,15 @@ func (m *DeviceCounterConsumption) MarshalToSizedBuffer(dAtA []byte) (int, error
 	_ = i
 	var l int
 	_ = l
+	if len(m.CompatibilityGroups) > 0 {
+		for iNdEx := len(m.CompatibilityGroups) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.CompatibilityGroups[iNdEx])
+			copy(dAtA[i:], m.CompatibilityGroups[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.CompatibilityGroups[iNdEx])))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
 	if len(m.Counters) > 0 {
 		keysForCounters := make([]string, 0, len(m.Counters))
 		for k := range m.Counters {
@@ -1434,6 +1449,39 @@ func (m *DeviceCounterConsumption) MarshalToSizedBuffer(dAtA []byte) (int, error
 	return len(dAtA) - i, nil
 }
 
+func (m *DeviceDerivedAttribute) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DeviceDerivedAttribute) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *DeviceDerivedAttribute) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Expression)
+	copy(dAtA[i:], m.Expression)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Expression)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
 func (m *DeviceRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -1508,6 +1556,15 @@ func (m *DeviceRequestAllocationResult) MarshalToSizedBuffer(dAtA []byte) (int,
 	_ = i
 	var l int
 	_ = l
+	if len(m.SkipNodeOperations) > 0 {
+		for iNdEx := len(m.SkipNodeOperations) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.SkipNodeOperations[iNdEx])
+			copy(dAtA[i:], m.SkipNodeOperations[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.SkipNodeOperations[iNdEx])))
+			i--
+			dAtA[i] = 0x5a
+		}
+	}
 	if len(m.ConsumedCapacity) > 0 {
 		keysForConsumedCapacity := make([]string, 0, len(m.ConsumedCapacity))
 		for k := range m.ConsumedCapacity {
@@ -1664,6 +1721,20 @@ func (m *DeviceSubRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if len(m.DerivedAttributes) > 0 {
+		for iNdEx := len(m.DerivedAttributes) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.DerivedAttributes[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x42
+		}
+	}
 	if m.Capacity != nil {
 		{
 			size, err := m.Capacity.MarshalToSizedBuffer(dAtA[:i])
@@ -2069,6 +2140,20 @@ func (m *ExactDeviceRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if len(m.DerivedAttributes) > 0 {
+		for iNdEx := len(m.DerivedAttributes) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.DerivedAttributes[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x42
+		}
+	}
 	if m.Capacity != nil {
 		{
 			size, err := m.Capacity.MarshalToSizedBuffer(dAtA[:i])
@@ -2177,7 +2262,7 @@ func (m *NetworkDeviceData) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
-func (m *NodeAllocatableResourceMapping) Marshal() (dAtA []byte, err error) {
+func (m *NodeAllocatableMapping) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -2187,19 +2272,31 @@ func (m *NodeAllocatableResourceMapping) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *NodeAllocatableResourceMapping) MarshalTo(dAtA []byte) (int, error) {
+func (m *NodeAllocatableMapping) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *NodeAllocatableResourceMapping) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *NodeAllocatableMapping) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if m.AllocationMultiplier != nil {
+	if m.DeviceMultiplier != nil {
+		{
+			size, err := m.DeviceMultiplier.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.CapacityMultiplier != nil {
 		{
-			size, err := m.AllocationMultiplier.MarshalToSizedBuffer(dAtA[:i])
+			size, err := m.CapacityMultiplier.MarshalToSizedBuffer(dAtA[:i])
 			if err != nil {
 				return 0, err
 			}
@@ -2219,6 +2316,100 @@ func (m *NodeAllocatableResourceMapping) MarshalToSizedBuffer(dAtA []byte) (int,
 	return len(dAtA) - i, nil
 }
 
+func (m *NodeAllocatableOverhead) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *NodeAllocatableOverhead) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *NodeAllocatableOverhead) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.PerContainer != nil {
+		{
+			size, err := m.PerContainer.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.PerPod != nil {
+		{
+			size, err := m.PerPod.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *NodeAllocatableResource) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *NodeAllocatableResource) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *NodeAllocatableResource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.Overhead != nil {
+		{
+			size, err := m.Overhead.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.Mapping != nil {
+		{
+			size, err := m.Mapping.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *OpaqueDeviceConfiguration) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -2773,6 +2964,22 @@ func (m *ResourceSliceSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if len(m.SkipNodeOperations) > 0 {
+		for iNdEx := len(m.SkipNodeOperations) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.SkipNodeOperations[iNdEx])
+			copy(dAtA[i:], m.SkipNodeOperations[iNdEx])
+			i = encodeVarintGenerated(dAtA, i, uint64(len(m.SkipNodeOperations[iNdEx])))
+			i--
+			dAtA[i] = 0x52
+		}
+	}
+	if m.PartitionTypeAttribute != nil {
+		i -= len(*m.PartitionTypeAttribute)
+		copy(dAtA[i:], *m.PartitionTypeAttribute)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.PartitionTypeAttribute)))
+		i--
+		dAtA[i] = 0x4a
+	}
 	if len(m.SharedCounters) > 0 {
 		for iNdEx := len(m.SharedCounters) - 1; iNdEx >= 0; iNdEx-- {
 			{
@@ -3092,8 +3299,8 @@ func (m *Device) Size() (n int) {
 	if m.AllowMultipleAllocations != nil {
 		n += 2
 	}
-	if len(m.NodeAllocatableResourceMappings) > 0 {
-		for k, v := range m.NodeAllocatableResourceMappings {
+	if len(m.NodeAllocatableResources) > 0 {
+		for k, v := range m.NodeAllocatableResources {
 			_ = k
 			_ = v
 			l = v.Size()
@@ -3365,6 +3572,25 @@ func (m *DeviceCounterConsumption) Size() (n int) {
 			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
 		}
 	}
+	if len(m.CompatibilityGroups) > 0 {
+		for _, s := range m.CompatibilityGroups {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *DeviceDerivedAttribute) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Expression)
+	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
@@ -3437,6 +3663,12 @@ func (m *DeviceRequestAllocationResult) Size() (n int) {
 			n += mapEntrySize + 1 + sovGenerated(uint64(mapEntrySize))
 		}
 	}
+	if len(m.SkipNodeOperations) > 0 {
+		for _, s := range m.SkipNodeOperations {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -3482,6 +3714,12 @@ func (m *DeviceSubRequest) Size() (n int) {
 		l = m.Capacity.Size()
 		n += 1 + l + sovGenerated(uint64(l))
 	}
+	if len(m.DerivedAttributes) > 0 {
+		for _, e := range m.DerivedAttributes {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -3637,6 +3875,12 @@ func (m *ExactDeviceRequest) Size() (n int) {
 		l = m.Capacity.Size()
 		n += 1 + l + sovGenerated(uint64(l))
 	}
+	if len(m.DerivedAttributes) > 0 {
+		for _, e := range m.DerivedAttributes {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -3659,7 +3903,7 @@ func (m *NetworkDeviceData) Size() (n int) {
 	return n
 }
 
-func (m *NodeAllocatableResourceMapping) Size() (n int) {
+func (m *NodeAllocatableMapping) Size() (n int) {
 	if m == nil {
 		return 0
 	}
@@ -3669,8 +3913,46 @@ func (m *NodeAllocatableResourceMapping) Size() (n int) {
 		l = len(*m.CapacityKey)
 		n += 1 + l + sovGenerated(uint64(l))
 	}
-	if m.AllocationMultiplier != nil {
-		l = m.AllocationMultiplier.Size()
+	if m.CapacityMultiplier != nil {
+		l = m.CapacityMultiplier.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.DeviceMultiplier != nil {
+		l = m.DeviceMultiplier.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *NodeAllocatableOverhead) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.PerPod != nil {
+		l = m.PerPod.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.PerContainer != nil {
+		l = m.PerContainer.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *NodeAllocatableResource) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Mapping != nil {
+		l = m.Mapping.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Overhead != nil {
+		l = m.Overhead.Size()
 		n += 1 + l + sovGenerated(uint64(l))
 	}
 	return n
@@ -3896,6 +4178,16 @@ func (m *ResourceSliceSpec) Size() (n int) {
 			n += 1 + l + sovGenerated(uint64(l))
 		}
 	}
+	if m.PartitionTypeAttribute != nil {
+		l = len(*m.PartitionTypeAttribute)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.SkipNodeOperations) > 0 {
+		for _, s := range m.SkipNodeOperations {
+			l = len(s)
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -4062,16 +4354,16 @@ func (this *Device) String() string {
 		mapStringForCapacity += fmt.Sprintf("%v: %v,", k, this.Capacity[QualifiedName(k)])
 	}
 	mapStringForCapacity += "}"
-	keysForNodeAllocatableResourceMappings := make([]string, 0, len(this.NodeAllocatableResourceMappings))
-	for k := range this.NodeAllocatableResourceMappings {
-		keysForNodeAllocatableResourceMappings = append(keysForNodeAllocatableResourceMappings, string(k))
+	keysForNodeAllocatableResources := make([]string, 0, len(this.NodeAllocatableResources))
+	for k := range this.NodeAllocatableResources {
+		keysForNodeAllocatableResources = append(keysForNodeAllocatableResources, string(k))
 	}
-	sort.Strings(keysForNodeAllocatableResourceMappings)
-	mapStringForNodeAllocatableResourceMappings := "map[k8s_io_api_core_v1.ResourceName]NodeAllocatableResourceMapping{"
-	for _, k := range keysForNodeAllocatableResourceMappings {
-		mapStringForNodeAllocatableResourceMappings += fmt.Sprintf("%v: %v,", k, this.NodeAllocatableResourceMappings[k8s_io_api_core_v1.ResourceName(k)])
+	sort.Strings(keysForNodeAllocatableResources)
+	mapStringForNodeAllocatableResources := "map[k8s_io_api_core_v1.ResourceName]NodeAllocatableResource{"
+	for _, k := range keysForNodeAllocatableResources {
+		mapStringForNodeAllocatableResources += fmt.Sprintf("%v: %v,", k, this.NodeAllocatableResources[k8s_io_api_core_v1.ResourceName(k)])
 	}
-	mapStringForNodeAllocatableResourceMappings += "}"
+	mapStringForNodeAllocatableResources += "}"
 	s := strings.Join([]string{`&Device{`,
 		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
 		`Attributes:` + mapStringForAttributes + `,`,
@@ -4085,7 +4377,7 @@ func (this *Device) String() string {
 		`BindingConditions:` + fmt.Sprintf("%v", this.BindingConditions) + `,`,
 		`BindingFailureConditions:` + fmt.Sprintf("%v", this.BindingFailureConditions) + `,`,
 		`AllowMultipleAllocations:` + valueToStringGenerated(this.AllowMultipleAllocations) + `,`,
-		`NodeAllocatableResourceMappings:` + mapStringForNodeAllocatableResourceMappings + `,`,
+		`NodeAllocatableResources:` + mapStringForNodeAllocatableResources + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4287,6 +4579,18 @@ func (this *DeviceCounterConsumption) String() string {
 	s := strings.Join([]string{`&DeviceCounterConsumption{`,
 		`CounterSet:` + fmt.Sprintf("%v", this.CounterSet) + `,`,
 		`Counters:` + mapStringForCounters + `,`,
+		`CompatibilityGroups:` + fmt.Sprintf("%v", this.CompatibilityGroups) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *DeviceDerivedAttribute) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&DeviceDerivedAttribute{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`Expression:` + fmt.Sprintf("%v", this.Expression) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4338,6 +4642,7 @@ func (this *DeviceRequestAllocationResult) String() string {
 		`BindingFailureConditions:` + fmt.Sprintf("%v", this.BindingFailureConditions) + `,`,
 		`ShareID:` + valueToStringGenerated(this.ShareID) + `,`,
 		`ConsumedCapacity:` + mapStringForConsumedCapacity + `,`,
+		`SkipNodeOperations:` + fmt.Sprintf("%v", this.SkipNodeOperations) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4366,6 +4671,11 @@ func (this *DeviceSubRequest) String() string {
 		repeatedStringForTolerations += strings.Replace(strings.Replace(f.String(), "DeviceToleration", "DeviceToleration", 1), `&`, ``, 1) + ","
 	}
 	repeatedStringForTolerations += "}"
+	repeatedStringForDerivedAttributes := "[]DeviceDerivedAttribute{"
+	for _, f := range this.DerivedAttributes {
+		repeatedStringForDerivedAttributes += strings.Replace(strings.Replace(f.String(), "DeviceDerivedAttribute", "DeviceDerivedAttribute", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForDerivedAttributes += "}"
 	s := strings.Join([]string{`&DeviceSubRequest{`,
 		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
 		`DeviceClassName:` + fmt.Sprintf("%v", this.DeviceClassName) + `,`,
@@ -4374,6 +4684,7 @@ func (this *DeviceSubRequest) String() string {
 		`Count:` + fmt.Sprintf("%v", this.Count) + `,`,
 		`Tolerations:` + repeatedStringForTolerations + `,`,
 		`Capacity:` + strings.Replace(this.Capacity.String(), "CapacityRequirements", "CapacityRequirements", 1) + `,`,
+		`DerivedAttributes:` + repeatedStringForDerivedAttributes + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4472,6 +4783,11 @@ func (this *ExactDeviceRequest) String() string {
 		repeatedStringForTolerations += strings.Replace(strings.Replace(f.String(), "DeviceToleration", "DeviceToleration", 1), `&`, ``, 1) + ","
 	}
 	repeatedStringForTolerations += "}"
+	repeatedStringForDerivedAttributes := "[]DeviceDerivedAttribute{"
+	for _, f := range this.DerivedAttributes {
+		repeatedStringForDerivedAttributes += strings.Replace(strings.Replace(f.String(), "DeviceDerivedAttribute", "DeviceDerivedAttribute", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForDerivedAttributes += "}"
 	s := strings.Join([]string{`&ExactDeviceRequest{`,
 		`DeviceClassName:` + fmt.Sprintf("%v", this.DeviceClassName) + `,`,
 		`Selectors:` + repeatedStringForSelectors + `,`,
@@ -4480,6 +4796,7 @@ func (this *ExactDeviceRequest) String() string {
 		`AdminAccess:` + valueToStringGenerated(this.AdminAccess) + `,`,
 		`Tolerations:` + repeatedStringForTolerations + `,`,
 		`Capacity:` + strings.Replace(this.Capacity.String(), "CapacityRequirements", "CapacityRequirements", 1) + `,`,
+		`DerivedAttributes:` + repeatedStringForDerivedAttributes + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4496,13 +4813,36 @@ func (this *NetworkDeviceData) String() string {
 	}, "")
 	return s
 }
-func (this *NodeAllocatableResourceMapping) String() string {
+func (this *NodeAllocatableMapping) String() string {
 	if this == nil {
 		return "nil"
 	}
-	s := strings.Join([]string{`&NodeAllocatableResourceMapping{`,
+	s := strings.Join([]string{`&NodeAllocatableMapping{`,
 		`CapacityKey:` + valueToStringGenerated(this.CapacityKey) + `,`,
-		`AllocationMultiplier:` + strings.Replace(fmt.Sprintf("%v", this.AllocationMultiplier), "Quantity", "resource.Quantity", 1) + `,`,
+		`CapacityMultiplier:` + strings.Replace(fmt.Sprintf("%v", this.CapacityMultiplier), "Quantity", "resource.Quantity", 1) + `,`,
+		`DeviceMultiplier:` + strings.Replace(fmt.Sprintf("%v", this.DeviceMultiplier), "Quantity", "resource.Quantity", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *NodeAllocatableOverhead) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&NodeAllocatableOverhead{`,
+		`PerPod:` + strings.Replace(fmt.Sprintf("%v", this.PerPod), "Quantity", "resource.Quantity", 1) + `,`,
+		`PerContainer:` + strings.Replace(fmt.Sprintf("%v", this.PerContainer), "Quantity", "resource.Quantity", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *NodeAllocatableResource) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&NodeAllocatableResource{`,
+		`Mapping:` + strings.Replace(this.Mapping.String(), "NodeAllocatableMapping", "NodeAllocatableMapping", 1) + `,`,
+		`Overhead:` + strings.Replace(this.Overhead.String(), "NodeAllocatableOverhead", "NodeAllocatableOverhead", 1) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -4691,6 +5031,8 @@ func (this *ResourceSliceSpec) String() string {
 		`Devices:` + repeatedStringForDevices + `,`,
 		`PerDeviceNodeSelection:` + valueToStringGenerated(this.PerDeviceNodeSelection) + `,`,
 		`SharedCounters:` + repeatedStringForSharedCounters + `,`,
+		`PartitionTypeAttribute:` + valueToStringGenerated(this.PartitionTypeAttribute) + `,`,
+		`SkipNodeOperations:` + fmt.Sprintf("%v", this.SkipNodeOperations) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -6595,9 +6937,9 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 			}
 			b := bool(v != 0)
 			m.AllowMultipleAllocations = &b
-		case 13:
+		case 14:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NodeAllocatableResourceMappings", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeAllocatableResources", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -6624,11 +6966,11 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.NodeAllocatableResourceMappings == nil {
-				m.NodeAllocatableResourceMappings = make(map[k8s_io_api_core_v1.ResourceName]NodeAllocatableResourceMapping)
+			if m.NodeAllocatableResources == nil {
+				m.NodeAllocatableResources = make(map[k8s_io_api_core_v1.ResourceName]NodeAllocatableResource)
 			}
 			var mapkey k8s_io_api_core_v1.ResourceName
-			mapvalue := &NodeAllocatableResourceMapping{}
+			mapvalue := &NodeAllocatableResource{}
 			for iNdEx < postIndex {
 				entryPreIndex := iNdEx
 				var wire uint64
@@ -6702,7 +7044,7 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 					if postmsgIndex > l {
 						return io.ErrUnexpectedEOF
 					}
-					mapvalue = &NodeAllocatableResourceMapping{}
+					mapvalue = &NodeAllocatableResource{}
 					if err := mapvalue.Unmarshal(dAtA[iNdEx:postmsgIndex]); err != nil {
 						return err
 					}
@@ -6722,7 +7064,7 @@ func (m *Device) Unmarshal(dAtA []byte) error {
 					iNdEx += skippy
 				}
 			}
-			m.NodeAllocatableResourceMappings[k8s_io_api_core_v1.ResourceName(mapkey)] = *mapvalue
+			m.NodeAllocatableResources[k8s_io_api_core_v1.ResourceName(mapkey)] = *mapvalue
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -8654,16 +8996,162 @@ func (m *DeviceCounterConsumption) Unmarshal(dAtA []byte) error {
 			}
 			m.Counters[mapkey] = *mapvalue
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CompatibilityGroups", wireType)
 			}
-			if (iNdEx + skippy) > l {
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CompatibilityGroups = append(m.CompatibilityGroups, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeviceDerivedAttribute) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeviceDerivedAttribute: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeviceDerivedAttribute: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = FullyQualifiedName(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Expression", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Expression = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
 			}
 			iNdEx += skippy
@@ -9265,6 +9753,38 @@ func (m *DeviceRequestAllocationResult) Unmarshal(dAtA []byte) error {
 			}
 			m.ConsumedCapacity[QualifiedName(mapkey)] = *mapvalue
 			iNdEx = postIndex
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SkipNodeOperations", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SkipNodeOperations = append(m.SkipNodeOperations, SkipNodeOperation(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -9620,6 +10140,40 @@ func (m *DeviceSubRequest) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DerivedAttributes", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DerivedAttributes = append(m.DerivedAttributes, DeviceDerivedAttribute{})
+			if err := m.DerivedAttributes[len(m.DerivedAttributes)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -10876,6 +11430,40 @@ func (m *ExactDeviceRequest) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DerivedAttributes", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DerivedAttributes = append(m.DerivedAttributes, DeviceDerivedAttribute{})
+			if err := m.DerivedAttributes[len(m.DerivedAttributes)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -11043,7 +11631,7 @@ func (m *NetworkDeviceData) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *NodeAllocatableResourceMapping) Unmarshal(dAtA []byte) error {
+func (m *NodeAllocatableMapping) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -11066,10 +11654,10 @@ func (m *NodeAllocatableResourceMapping) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: NodeAllocatableResourceMapping: wiretype end group for non-group")
+			return fmt.Errorf("proto: NodeAllocatableMapping: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: NodeAllocatableResourceMapping: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: NodeAllocatableMapping: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -11107,7 +11695,7 @@ func (m *NodeAllocatableResourceMapping) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field AllocationMultiplier", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field CapacityMultiplier", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -11134,29 +11722,309 @@ func (m *NodeAllocatableResourceMapping) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.AllocationMultiplier == nil {
-				m.AllocationMultiplier = &resource.Quantity{}
+			if m.CapacityMultiplier == nil {
+				m.CapacityMultiplier = &resource.Quantity{}
 			}
-			if err := m.AllocationMultiplier.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.CapacityMultiplier.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipGenerated(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthGenerated
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeviceMultiplier", wireType)
 			}
-			iNdEx += skippy
-		}
-	}
-
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.DeviceMultiplier == nil {
+				m.DeviceMultiplier = &resource.Quantity{}
+			}
+			if err := m.DeviceMultiplier.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *NodeAllocatableOverhead) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NodeAllocatableOverhead: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NodeAllocatableOverhead: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PerPod", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.PerPod == nil {
+				m.PerPod = &resource.Quantity{}
+			}
+			if err := m.PerPod.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PerContainer", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.PerContainer == nil {
+				m.PerContainer = &resource.Quantity{}
+			}
+			if err := m.PerContainer.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *NodeAllocatableResource) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NodeAllocatableResource: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NodeAllocatableResource: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Mapping", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Mapping == nil {
+				m.Mapping = &NodeAllocatableMapping{}
+			}
+			if err := m.Mapping.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Overhead", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Overhead == nil {
+				m.Overhead = &NodeAllocatableOverhead{}
+			}
+			if err := m.Overhead.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
 	if iNdEx > l {
 		return io.ErrUnexpectedEOF
 	}
@@ -12933,6 +13801,71 @@ func (m *ResourceSliceSpec) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PartitionTypeAttribute", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := FullyQualifiedName(dAtA[iNdEx:postIndex])
+			m.PartitionTypeAttribute = &s
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SkipNodeOperations", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SkipNodeOperations = append(m.SkipNodeOperations, SkipNodeOperation(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
diff --git a/vendor/k8s.io/api/resource/v1beta2/generated.proto b/vendor/k8s.io/api/resource/v1beta2/generated.proto
index 82bb033b3e..3268169cee 100644
--- a/vendor/k8s.io/api/resource/v1beta2/generated.proto
+++ b/vendor/k8s.io/api/resource/v1beta2/generated.proto
@@ -65,8 +65,8 @@ message AllocatedDeviceStatus {
   //
   // +optional
   // +featureGate=DRAConsumableCapacity
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-uuid
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-uuid
   optional string shareID = 7;
 
   // Conditions contains the latest observation of the device's state.
@@ -78,6 +78,9 @@ message AllocatedDeviceStatus {
   // +optional
   // +listType=map
   // +listMapKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 4;
 
   // Data contains arbitrary driver-specific data.
@@ -90,7 +93,7 @@ message AllocatedDeviceStatus {
   // NetworkData contains network-related information specific to the device.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional NetworkDeviceData networkData = 6;
 }
 
@@ -130,7 +133,7 @@ message CELDeviceSelector {
   //  - driver (string): the name of the driver which defines this device.
   //  - attributes (map[string]object): the device's attributes, grouped by prefix
   //    (e.g. device.attributes["dra.example.com"] evaluates to an object with all
-  //    of the attributes which were prefixed by "dra.example.com".
+  //    of the attributes which were prefixed by "dra.example.com").
   //  - capacity (map[string]object): the device's capacities, grouped by prefix.
   //  - allowMultipleAllocations (bool): the allowMultipleAllocations property of the device
   //    (v1.34+ with the DRAConsumableCapacity feature enabled).
@@ -163,6 +166,15 @@ message CELDeviceSelector {
   // A robust expression should check for the existence of attributes
   // before referencing them.
   //
+  // Common errors:
+  // - "no such key": Use optional chaining (.? followed by orValue())
+  //   or guarding the check with has() for optional fields.
+  //   See CEL Optional Types for details:
+  //   https://pkg.go.dev/github.com/google/cel-go@v0.17.4/cel#OptionalTypes
+  //
+  // For more CEL expression syntax and examples, see:
+  // https://kubernetes.io/docs/reference/using-api/cel/
+  //
   // For ease of use, the cel.bind() function is enabled, and can be used
   // to simplify expressions that access multiple attributes with the
   // same domain. For example:
@@ -232,6 +244,13 @@ message CapacityRequestPolicy {
 
 // CapacityRequestPolicyRange defines a valid range for consumable capacity values.
 //
+// If the DRAFractionalCapacityRange feature gate is
+// enabled and at least one of Min, Max, or Step is a fractional quantity (i.e.
+// its value is not an integer), milli-unit arithmetic is used instead,
+// supporting values with up to 3 decimal places (e.g. 100m = 0.1).
+// The largest supported value then is 1000 times smaller compared to using 64-bit integers.
+// Otherwise, all comparisons use 64-bit integer arithmetic via resource.Quantity.Value().
+//
 //   - If the requested amount is less than Min, it is rounded up to the Min value.
 //   - If Step is set and the requested amount is between Min and Max but not aligned with Step,
 //     it will be rounded up to the next value equal to Min + (n * Step).
@@ -315,8 +334,8 @@ message CounterSet {
   // It must be a DNS label.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-short-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-short-name
   optional string name = 1;
 
   // Counters defines the set of counters for this CounterSet
@@ -325,8 +344,8 @@ message CounterSet {
   // The maximum number of counters is 32.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:eachKey=+k8s:format=k8s-short-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:eachKey=+k8s:format=k8s-short-name
   map<string, Counter> counters = 2;
 }
 
@@ -345,7 +364,7 @@ message Device {
   // The maximum number of attributes and capacities combined is 32.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   map<string, DeviceAttribute> attributes = 2;
 
   // Capacity defines the set of capacities for this device.
@@ -366,13 +385,13 @@ message Device {
   // device is 2.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +listType=atomic
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=counterSet
+  // +k8s:beta(since: "1.37")=+k8s:unique=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=counterSet
   // +featureGate=DRAPartitionableDevices
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=2
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=2
   repeated DeviceCounterConsumption consumesCounters = 4;
 
   // NodeName identifies the node where the device is available.
@@ -419,7 +438,7 @@ message Device {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceTaints
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated DeviceTaint taints = 8;
 
   // BindsToNode indicates if the usage of an allocation involving this device
@@ -449,8 +468,8 @@ message Device {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=4
   repeated string bindingConditions = 10;
 
   // BindingFailureConditions defines the conditions for binding failure.
@@ -467,8 +486,8 @@ message Device {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=4
   repeated string bindingFailureConditions = 11;
 
   // AllowMultipleAllocations marks whether the device is allowed to be allocated to multiple DeviceRequests.
@@ -480,7 +499,7 @@ message Device {
   // +featureGate=DRAConsumableCapacity
   optional bool allowMultipleAllocations = 12;
 
-  // NodeAllocatableResourceMappings defines the mapping of node resources
+  // NodeAllocatableResources defines the mapping of node resources
   // that are managed by the DRA driver exposing this device. This includes resources currently
   // reported in v1.Node `status.allocatable` that are not extended resources
   // (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources).
@@ -492,8 +511,9 @@ message Device {
   // The keys of this map are the node-allocatable resource names (e.g., "cpu", "memory").
   // Extended resource names are not permitted as keys.
   // +optional
+  // +k8s:optional
   // +featureGate=DRANodeAllocatableResources
-  map<string, NodeAllocatableResourceMapping> nodeAllocatableResourceMappings = 13;
+  map<string, NodeAllocatableResource> nodeAllocatableResources = 14;
 }
 
 // DeviceAllocationConfiguration gets embedded in an AllocationResult.
@@ -503,7 +523,7 @@ message DeviceAllocationConfiguration {
   // or from a claim.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string source = 1;
 
   // Requests lists the names of requests where the configuration applies.
@@ -515,10 +535,10 @@ message DeviceAllocationConfiguration {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=set
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:unique=set
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated string requests = 2;
 
   optional DeviceConfiguration deviceConfiguration = 3;
@@ -530,8 +550,8 @@ message DeviceAllocationResult {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceRequestAllocationResult results = 1;
 
   // This field is a combination of all the claim and class configuration parameters.
@@ -544,8 +564,8 @@ message DeviceAllocationResult {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=64
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=64
   repeated DeviceAllocationConfiguration config = 2;
 }
 
@@ -554,30 +574,30 @@ message DeviceAttribute {
   // IntValue is a number.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   optional int64 int = 2;
 
   // BoolValue is a true/false value.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   optional bool bool = 3;
 
   // StringValue is a string. Must not be longer than 64 characters.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   optional string string = 4;
 
   // VersionValue is a semantic version according to semver.org spec 2.0.0.
   // Must not be longer than 64 characters.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   optional string version = 5;
 
   // IntValues is a non-empty list of numbers.
@@ -587,8 +607,8 @@ message DeviceAttribute {
   // +optional
   // +listType=atomic
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   // +featureGate=DRAListTypeAttributes
   repeated int64 ints = 6;
 
@@ -597,8 +617,8 @@ message DeviceAttribute {
   // +optional
   // +listType=atomic
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   // +featureGate=DRAListTypeAttributes
   repeated bool bools = 7;
 
@@ -610,8 +630,9 @@ message DeviceAttribute {
   // +optional
   // +listType=atomic
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
+  // +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:maxBytes=64
   // +featureGate=DRAListTypeAttributes
   repeated string strings = 8;
 
@@ -623,8 +644,8 @@ message DeviceAttribute {
   // +optional
   // +listType=atomic
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:unionMember
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:unionMember
   // +featureGate=DRAListTypeAttributes
   repeated string versions = 9;
 }
@@ -662,11 +683,11 @@ message DeviceClaim {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:unique=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=name
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceRequest requests = 1;
 
   // These constraints must be satisfied by the set of devices that get
@@ -674,8 +695,8 @@ message DeviceClaim {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceConstraint constraints = 2;
 
   // This field holds configuration for multiple potential drivers which
@@ -684,8 +705,8 @@ message DeviceClaim {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceClaimConfiguration config = 3;
 }
 
@@ -700,10 +721,10 @@ message DeviceClaimConfiguration {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=set
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:unique=set
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated string requests = 1;
 
   optional DeviceConfiguration deviceConfiguration = 2;
@@ -719,8 +740,8 @@ message DeviceClaimConfiguration {
 message DeviceClass {
   // Standard object metadata
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:format=k8s-long-name
+  // +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:format=k8s-long-name
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Spec defines what can be allocated and how to configure it.
@@ -731,6 +752,7 @@ message DeviceClass {
   // the time of allocation.
   //
   // Changing the spec automatically increments the metadata.generation number.
+  // +optional
   optional DeviceClassSpec spec = 2;
 }
 
@@ -756,8 +778,8 @@ message DeviceClassSpec {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceSelector selectors = 1;
 
   // Config defines configuration parameters that apply to each device that is claimed via this class.
@@ -768,8 +790,8 @@ message DeviceClassSpec {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceClassConfiguration config = 2;
 
   // ExtendedResourceName is the extended resource name for the devices of this class.
@@ -781,11 +803,10 @@ message DeviceClassSpec {
   // If two classes are created at the same time, then the name of the class
   // lexicographically sorted first is picked.
   //
-  // This is a beta field.
   // +optional
   // +featureGate=DRAExtendedResource
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-extended-resource-name
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-extended-resource-name
   optional string extendedResourceName = 4;
 }
 
@@ -797,7 +818,7 @@ message DeviceConfiguration {
   //
   // +optional
   // +oneOf=ConfigurationType
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional OpaqueDeviceConfiguration opaque = 1;
 }
 
@@ -815,10 +836,10 @@ message DeviceConstraint {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=set
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:unique=set
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated string requests = 1;
 
   // MatchAttribute requires that all devices in question have this
@@ -841,8 +862,8 @@ message DeviceConstraint {
   //
   // +optional
   // +oneOf=ConstraintType
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-resource-fully-qualified-name
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-fully-qualified-name
   optional string matchAttribute = 2;
 
   // DistinctAttribute requires that all devices in question have this
@@ -864,6 +885,8 @@ message DeviceConstraint {
   // +optional
   // +oneOf=ConstraintType
   // +featureGate=DRAConsumableCapacity
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-fully-qualified-name
   optional string distinctAttribute = 3;
 }
 
@@ -874,8 +897,8 @@ message DeviceCounterConsumption {
   // counters defined will be consumed.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-short-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-short-name
   optional string counterSet = 1;
 
   // Counters defines the counters that will be consumed by the device.
@@ -883,9 +906,94 @@ message DeviceCounterConsumption {
   // The maximum number of counters is 32.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:eachKey=+k8s:format=k8s-short-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:eachKey=+k8s:format=k8s-short-name
   map<string, Counter> counters = 2;
+
+  // CompatibilityGroups is a list of opaque group names for
+  // this counter set consumption.
+  //
+  // Devices that consume counters from the same counter set may only be
+  // allocated at the same time ("co-allocated") if they all share at least
+  // one common group: the intersection of the CompatibilityGroups of all
+  // co-allocated devices on that counter set must be non-empty. Devices
+  // that consume from different counter sets are never compared via this
+  // field.
+  //
+  // An unset field, an explicit nil, and an empty list are equivalent and
+  // mean "no groups": such a device is only co-allocatable with sibling
+  // devices on the same counter set that also have no groups, and is never
+  // co-allocatable with a device that declares one or more groups.
+  //
+  // Group names are opaque and meaningful only within the
+  // publishing driver's pool.
+  //
+  // The maximum number of groups is 2, and the names must be unique.
+  //
+  // +optional
+  // +listType=atomic
+  // +featureGate=DRADeviceCompatibilityGroups
+  // +k8s:listType=atomic
+  // +k8s:optional
+  // +k8s:maxItems=2
+  // +k8s:unique=set
+  // +k8s:eachVal=+k8s:format=k8s-short-name
+  repeated string compatibilityGroups = 3;
+}
+
+// DeviceDerivedAttribute defines a derived attribute computed via CEL.
+message DeviceDerivedAttribute {
+  // Name is the identifier for this derived attribute, used in constraints.
+  //
+  // It must be a DNS subdomain followed by a slash ("/") followed by a C identifier
+  // (e.g. "example.com/numaNode" or "derived/numaNode").
+  //
+  // If the chosen name matches an existing physical attribute from a driver,
+  // the derived attribute's expression will shadow the physical attribute,
+  // and its evaluated value will be used in constraints instead. When the goal
+  // is to define a derived attribute that is only used within the ResourceClaim
+  // and not meant to shadow an existing attribute, use a domain prefix that
+  // no DRA driver should be using (e.g. "derived/myAttribute").
+  //
+  // It is not valid to define a derived attribute that isn't used in at least
+  // one constraint.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-resource-fully-qualified-name
+  optional string name = 1;
+
+  // Expression is a CEL expression evaluated against each candidate device.
+  // The expression must evaluate to a primitive scalar (string, integer,
+  // boolean, or semver) or a list of these scalars ([]string, []int64,
+  // []bool, []semver) to act as a virtual grouping key. Any other return type
+  // is an error and causes CEL evaluation for the device to fail.
+  //
+  // The expression's input is an object named "device", which carries the
+  // same properties as in a CELDeviceSelector.
+  //
+  // When pod scheduling encounters CEL runtime errors (such as looking
+  // up an attribute that isn't defined) for some devices, it will abort
+  // allocation and fail scheduling for the Pod. Surfacing evaluation
+  // errors immediately prevents silent topology matching failures that are
+  // extremely hard to detect. A robust expression should, for example, check
+  // for the existence of attributes before referencing them to avoid
+  // runtime evaluation errors.
+  //
+  // The expression gets evaluated after a device has passed the other
+  // selector expressions for the request in which this expression is used.
+  // This allows writing expressions that are tailored towards the specific
+  // devices being requested (for example, by assuming the device is from a
+  // certain vendor and skipping those checks).
+  //
+  // The length of the expression must be smaller or equal to 10 Ki. The
+  // cost of evaluating it is also limited based on the estimated number
+  // of logical steps; the combined cost of all derived attributes in a
+  // claim is capped by a shared CEL cost budget.
+  //
+  // +required
+  // +k8s:required
+  optional string expression = 2;
 }
 
 // DeviceRequest is a request for devices required for a claim.
@@ -914,7 +1022,7 @@ message DeviceRequest {
   //
   // +optional
   // +oneOf=deviceRequestType
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional ExactDeviceRequest exactly = 2;
 
   // FirstAvailable contains subrequests, of which exactly one will be
@@ -935,11 +1043,11 @@ message DeviceRequest {
   // +oneOf=deviceRequestType
   // +listType=atomic
   // +featureGate=DRAPrioritizedList
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=8
+  // +k8s:beta(since: "1.37")=+k8s:unique=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=name
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=8
   repeated DeviceSubRequest firstAvailable = 3;
 }
 
@@ -964,9 +1072,9 @@ message DeviceRequestAllocationResult {
   // vendor of the driver. It should use only lower case characters.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name-caseless
-  // +k8s:alpha(since: "1.36")=+k8s:maxLength=63
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name-caseless
+  // +k8s:beta(since: "1.37")=+k8s:maxLength=63
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string driver = 2;
 
   // This name together with the driver name and the device name field
@@ -976,8 +1084,8 @@ message DeviceRequestAllocationResult {
   // DNS sub-domains separated by slashes.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-resource-pool-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-pool-name
   optional string pool = 3;
 
   // Device references one device instance via its name in the driver's
@@ -1009,7 +1117,7 @@ message DeviceRequestAllocationResult {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceTaints
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated DeviceToleration tolerations = 6;
 
   // BindingConditions contains a copy of the BindingConditions
@@ -1021,8 +1129,8 @@ message DeviceRequestAllocationResult {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=4
   repeated string bindingConditions = 7;
 
   // BindingFailureConditions contains a copy of the BindingFailureConditions
@@ -1034,8 +1142,8 @@ message DeviceRequestAllocationResult {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=4
   repeated string bindingFailureConditions = 8;
 
   // ShareID uniquely identifies an individual allocation share of the device,
@@ -1045,8 +1153,8 @@ message DeviceRequestAllocationResult {
   //
   // +optional
   // +featureGate=DRAConsumableCapacity
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-uuid
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-uuid
   optional string shareID = 9;
 
   // ConsumedCapacity tracks the amount of capacity consumed per device as part of the claim request.
@@ -1061,6 +1169,19 @@ message DeviceRequestAllocationResult {
   // +optional
   // +featureGate=DRAConsumableCapacity
   map<string, .k8s.io.apimachinery.pkg.api.resource.Quantity> consumedCapacity = 10;
+
+  // SkipNodeOperations lists node-local resource operations (gRPC calls)
+  // that will be skipped for this allocated device when determining whether
+  // operations are necessary on the node. If all allocated devices for a driver in
+  // a claim skip an operation, that gRPC call will be skipped. It is a copy of
+  // the ResourceSlice.spec.skipNodeOperations value at the time when the device was allocated.
+  //
+  // +optional
+  // +listType=set
+  // +k8s:listType=set
+  // +featureGate=DRAOptionalNodeOperations
+  // +k8s:optional
+  repeated string skipNodeOperations = 11;
 }
 
 // DeviceSelector must have exactly one field set.
@@ -1103,8 +1224,8 @@ message DeviceSubRequest {
   // to reference.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name
   optional string deviceClassName = 2;
 
   // Selectors define criteria which must be satisfied by a specific
@@ -1114,8 +1235,8 @@ message DeviceSubRequest {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceSelector selectors = 3;
 
   // AllocationMode and its related fields define how devices are allocated
@@ -1137,7 +1258,7 @@ message DeviceSubRequest {
   // requests with unknown modes.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string allocationMode = 4;
 
   // Count is used only when the count mode is "ExactCount". Must be greater than zero.
@@ -1168,7 +1289,7 @@ message DeviceSubRequest {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceTaints
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated DeviceToleration tolerations = 6;
 
   // Capacity define resource requirements against each capacity.
@@ -1187,6 +1308,34 @@ message DeviceSubRequest {
   // +optional
   // +featureGate=DRAConsumableCapacity
   optional CapacityRequirements capacity = 7;
+
+  // DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+  // for each candidate device. These virtual attributes can be referenced in
+  // `.devices.constraints` to align and match different devices (e.g., co-allocating
+  // a GPU and a NIC on the same NUMA node) even if their drivers publish different
+  // attributes. Derived attributes are not available via `device.attributes`
+  // in the CEL environment when evaluating selector expressions.
+  //
+  // Derived attributes allow you to extract, transform, or normalize topology
+  // information (such as extracting a NUMA index from a complex topology string or
+  // renaming a vendor-specific attribute) into a common virtual attribute name at
+  // scheduling time. The scheduler then evaluates these virtual attributes exactly
+  // like static attributes when matching constraints.
+  //
+  // Every derived attribute defined in this list must be referenced by at least one
+  // MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+  //
+  // The maximum number of derived attributes is 32.
+  //
+  // This is an alpha field and requires enabling the DRADerivedAttributes
+  // feature gate.
+  //
+  // +optional
+  // +listType=atomic
+  // +featureGate=DRADerivedAttributes
+  // +k8s:optional
+  // +k8s:maxItems=32
+  repeated DeviceDerivedAttribute derivedAttributes = 8;
 }
 
 // The device this taint is attached to has the "effect" on
@@ -1215,7 +1364,7 @@ message DeviceTaint {
   // Consumers must treat unknown effects like None.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:required
   optional string effect = 3;
 
   // TimeAdded represents the time at which the taint was added or
@@ -1237,6 +1386,7 @@ message DeviceTaint {
 // DeviceTaintRule adds one taint to all devices which match the selector.
 // This has the same effect as if the taint was specified directly
 // in the ResourceSlice by the DRA driver.
+// +k8s:supportsSubresource="/status"
 message DeviceTaintRule {
   // Standard object metadata
   // +optional
@@ -1308,6 +1458,9 @@ message DeviceTaintRuleStatus {
   // +listMapKey=type
   // +patchStrategy=merge
   // +patchMergeKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 1;
 }
 
@@ -1351,8 +1504,8 @@ message DeviceToleration {
   // Must be a label name.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-label-key
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-label-key
   optional string key = 1;
 
   // Operator represents a key's relationship to the value.
@@ -1362,7 +1515,7 @@ message DeviceToleration {
   //
   // +optional
   // +default="Equal"
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string operator = 2;
 
   // Value is the taint value the toleration matches to.
@@ -1376,7 +1529,7 @@ message DeviceToleration {
   // When specified, allowed values are NoSchedule and NoExecute.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string effect = 4;
 
   // TolerationSeconds represents the period of time the toleration (which must be
@@ -1414,8 +1567,8 @@ message ExactDeviceRequest {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=32
   repeated DeviceSelector selectors = 2;
 
   // AllocationMode and its related fields define how devices are allocated
@@ -1438,7 +1591,7 @@ message ExactDeviceRequest {
   // requests with unknown modes.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string allocationMode = 3;
 
   // Count is used only when the count mode is "ExactCount". Must be greater than zero.
@@ -1483,7 +1636,7 @@ message ExactDeviceRequest {
   // +optional
   // +listType=atomic
   // +featureGate=DRADeviceTaints
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   repeated DeviceToleration tolerations = 6;
 
   // Capacity define resource requirements against each capacity.
@@ -1502,6 +1655,34 @@ message ExactDeviceRequest {
   // +optional
   // +featureGate=DRAConsumableCapacity
   optional CapacityRequirements capacity = 7;
+
+  // DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+  // for each candidate device. These virtual attributes can be referenced in
+  // `.devices.constraints` to align and match different devices (e.g., co-allocating
+  // a GPU and a NIC on the same NUMA node) even if their drivers publish different
+  // attributes. Derived attributes are not available via `device.attributes`
+  // in the CEL environment when evaluating selector expressions.
+  //
+  // Derived attributes allow you to extract, transform, or normalize topology
+  // information (such as extracting a NUMA index from a complex topology string or
+  // renaming a vendor-specific attribute) into a common virtual attribute name at
+  // scheduling time. The scheduler then evaluates these virtual attributes exactly
+  // like static attributes when matching constraints.
+  //
+  // Every derived attribute defined in this list must be referenced by at least one
+  // MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+  //
+  // The maximum number of derived attributes is 32.
+  //
+  // This is an alpha field and requires enabling the DRADerivedAttributes
+  // feature gate.
+  //
+  // +optional
+  // +listType=atomic
+  // +featureGate=DRADerivedAttributes
+  // +k8s:optional
+  // +k8s:maxItems=32
+  repeated DeviceDerivedAttribute derivedAttributes = 8;
 }
 
 // NetworkDeviceData provides network-related details for the allocated device.
@@ -1515,8 +1696,8 @@ message NetworkDeviceData {
   // Must not be longer than 256 bytes.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxBytes=256
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxBytes=256
   optional string interfaceName = 1;
 
   // IPs lists the network addresses assigned to the device's network interface.
@@ -1527,10 +1708,10 @@ message NetworkDeviceData {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=set
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=16
+  // +k8s:beta(since: "1.37")=+k8s:unique=set
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=16
   repeated string ips = 2;
 
   // HardwareAddress represents the hardware address (e.g. MAC Address) of the device's network interface.
@@ -1538,47 +1719,104 @@ message NetworkDeviceData {
   // Must not be longer than 128 bytes.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:maxBytes=128
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:maxBytes=128
   optional string hardwareAddress = 3;
 }
 
-// NodeAllocatableResourceMapping defines the translation between the DRA device/capacity
-// units requested to the corresponding quantity of the node allocatable resource.
-message NodeAllocatableResourceMapping {
+// NodeAllocatableMapping defines how a DRA allocation directly translates into a node allocatable resource quantity.
+// The mapping can be derived from either the count of allocated devices (via deviceMultiplier) or the specific capacity consumed (via capacityKey and capacityMultiplier). These options are mutually exclusive.
+// Kubelet adds this mapped resource quantity from claim to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.
+message NodeAllocatableMapping {
   // CapacityKey references a capacity name defined as a key in the
   // `spec.devices[*].capacity` map. When this field is set, the value associated with
   // this key in the `status.allocation.devices.results[*].consumedCapacity` map
   // (for a specific claim allocation) determines the base quantity for
-  // the node allocatable resource. If `allocationMultiplier` is also set, it is
+  // the node allocatable resource. `capacityMultiplier` must also be set and is
   // multiplied with the base quantity.
   // For example, if `spec.devices[*].capacity` has an entry "dra.example.com/memory": "128Gi",
   // and this field is set to "dra.example.com/memory", then for a claim allocation
   // that consumes { "dra.example.com/memory": "4Gi" } the base quantity for the
-  // node allocatable resource mapping will be "4Gi", and `allocationMultiplier` should
-  // be omitted or set to "1".
+  // node allocatable resource mapping will be "4Gi".
+  // The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
   // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:alpha(since: "1.37")=+k8s:dependentRequired("capacityMultiplier")
   optional string capacityKey = 1;
 
-  // AllocationMultiplier is used as a multiplier for the allocated device count or the allocated capacity in the claim.
-  // It defaults to 1 if not specified. How the field is used also depends on whether `capacityKey` is set.
-  // 1.  If `capacityKey` is NOT set: `allocationMultiplier` multiplies the device count allocated to the claim.
-  // 	   a. A DRA driver representing each CPU core as a device would have
-  //        {ResourceName: "cpu", allocationMultiplier: "2"} in its
-  //        `nodeAllocatableResourceMappings`. If 4 devices are allocated to the claim,
-  // 		  4 * 2 CPUs would be considered as allocated and subtracted from the node's capacity.
-  //     b. A GPU device that needs additional node memory per GPU allocation would
-  //        have {ResourceName: "memory", allocationMultiplier: "2Gi"}.  Each allocated
-  // 		  GPU device instance of this type will account for 2Gi of memory.
-  //
-  // 2.  If `capacityKey` IS set: `allocationMultiplier` is multiplied by the amount of that capacity consumed.
-  // 	   The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `allocationMultiplier`.
-  //     For example, if a Device's capacity "dra.example.com/cores" is consumed,
-  //     and each "core" provides 2 "cpu"s, the mapping would be:
-  //     {ResourceName: "cpu", capacityKey: "dra.example.com/cores", allocationMultiplier: "2"}.
-  //     If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
-  // +optional
-  optional .k8s.io.apimachinery.pkg.api.resource.Quantity allocationMultiplier = 2;
+  // CapacityMultiplier is used as a multiplier for the allocated capacity consumed.
+  // It is only valid if `capacityKey` is set.
+  // The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
+  // For example, if a Device's capacity "dra.example.com/cores" is consumed,
+  // and each "core" provides 2 "cpu"s, the mapping would be:
+  // {ResourceName: "cpu", capacityKey: "dra.example.com/cores", capacityMultiplier: "2"}.
+  // If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
+  // +optional
+  // +k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:dependentRequired("capacityKey")
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity capacityMultiplier = 2;
+
+  // DeviceMultiplier is used as a multiplier for the allocated device count in the claim.
+  // The final node allocatable resource amount is `deviceCount` * `deviceMultiplier`.
+  // For example, a DRA driver representing each cache complex (CCX) as a device would have
+  // {ResourceName: "cpu", deviceMultiplier: "8"} in its `nodeAllocatableResources`.
+  // If 2 devices (CCX) are allocated to the claim, 2 * 8 = 16 CPUs would be considered as allocated.
+  // It is only valid when `capacityKey` and `capacityMultiplier` are not set.
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity deviceMultiplier = 3;
+}
+
+// NodeAllocatableOverhead defines auxiliary resource overheads incurred when allocating a device.
+// Overheads can be specified as a fixed cost per pod referencing the claim, a variable cost per container reference, or both.
+// Kubelet accounts for this overhead by adding it to both the pod-level and container-level cgroups of referencing containers.
+message NodeAllocatableOverhead {
+  // PerPod is overhead applied once per pod referencing the claim on this node.
+  // This is a flat overhead incurred for every pod referencing the claim.
+  // +optional
+  // +k8s:optional
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity perPod = 1;
+
+  // PerContainer is applied per container reference to the claim.
+  // This models overhead scaling linearly with the number of containers actively using the device.
+  // When both PerPod and PerContainer are specified, the total overhead allocated for each pod referencing
+  // the claim is computed as:
+  // Quantity = PerPod + (PerContainer * NumReferences)
+  // Kubelet accounts for this overhead in cgroups:
+  // - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences).
+  // - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container.
+  // This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once.
+  // +optional
+  // +k8s:optional
+  optional .k8s.io.apimachinery.pkg.api.resource.Quantity perContainer = 2;
+}
+
+// NodeAllocatableResource defines the translation between the DRA device/capacity
+// units requested to the corresponding quantity of the node allocatable resource.
+// At least one of Mapping or Overhead must be specified. Not specifying either is an invalid configuration.
+message NodeAllocatableResource {
+  // Mapping is used when the device directly models a node allocatable resource like standard CPU or memory
+  // (e.g., with a CPU DRA driver). The calculated quantity is accounted for exactly once per claim instance
+  // on the node. To prevent node cgroup isolation friction, the scheduler explicitly
+  // blocks sharing mapped device claims across multiple pods.
+  // +optional
+  // +k8s:optional
+  optional NodeAllocatableMapping mapping = 3;
+
+  // Overhead contains fields for modeling auxiliary overhead incurred on node allocatable resources
+  // when allocating devices that are not themselves modeling a node allocatable resource (e.g., host memory overhead for GPUs).
+  // Sharing overhead-mapped claims across multiple pods is allowed. The node allocatable overhead is accounted
+  // for individually for each pod referencing the claim.
+  // Overhead is always subtracted from the node's allocatable capacity for the resource, even when mapping
+  // is specified for the same resource.
+  // Eg: If a device models memory capacity per socket as a consumable capacity pool via Mapping (with CapacityKey),
+  // any overhead specified for the same resource will be subtracted from the node's general allocatable capacity
+  // and not from the per-socket capacity pool in Mapping.
+  // +optional
+  // +k8s:optional
+  optional NodeAllocatableOverhead overhead = 4;
 }
 
 // OpaqueDeviceConfiguration contains configuration parameters for a driver
@@ -1594,9 +1832,9 @@ message OpaqueDeviceConfiguration {
   // vendor of the driver. It should use only lower case characters.
   //
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:maxLength=63
-  // +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name-caseless
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:maxLength=63
+  // +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name-caseless
   optional string driver = 1;
 
   // Parameters can contain arbitrary data. It is the responsibility of
@@ -1625,7 +1863,8 @@ message ResourceClaim {
 
   // Spec describes what is being requested and how to configure it.
   // The spec is immutable.
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:immutable
+  // +optional
   optional ResourceClaimSpec spec = 2;
 
   // Status describes whether the claim is ready to use and what has been allocated.
@@ -1680,8 +1919,8 @@ message ResourceClaimStatus {
   // Allocation is set once the claim has been allocated successfully.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:update=NoModify
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:update=NoModify
   optional AllocationResult allocation = 1;
 
   // ReservedFor indicates which entities are currently allowed to use
@@ -1709,10 +1948,10 @@ message ResourceClaimStatus {
   // +listMapKey=uid
   // +patchStrategy=merge
   // +patchMergeKey=uid
-  // +k8s:alpha(since: "1.36")=+k8s:optional
-  // +k8s:alpha(since: "1.36")=+k8s:listType=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=uid
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=256
+  // +k8s:beta(since: "1.37")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:listType=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=uid
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=256
   repeated ResourceClaimConsumerReference reservedFor = 2;
 
   // Devices contains the status of each device allocated for this
@@ -1720,18 +1959,18 @@ message ResourceClaimStatus {
   // information. Entries are owned by their respective drivers.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +listType=map
   // +listMapKey=driver
   // +listMapKey=device
   // +listMapKey=pool
   // +listMapKey=shareID
   // +featureGate=DRAResourceClaimDeviceStatus
-  // +k8s:alpha(since: "1.36")=+k8s:listType=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=driver
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=device
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=pool
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=shareID
+  // +k8s:beta(since: "1.37")=+k8s:listType=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=driver
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=device
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=pool
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=shareID
   repeated AllocatedDeviceStatus devices = 4;
 }
 
@@ -1749,6 +1988,7 @@ message ResourceClaimTemplate {
   // This field is immutable. A ResourceClaim will get created by the
   // control plane for a Pod when needed and then not get updated
   // anymore.
+  // +optional
   optional ResourceClaimTemplateSpec spec = 2;
 }
 
@@ -1768,11 +2008,13 @@ message ResourceClaimTemplateSpec {
   // when creating it. No other fields are allowed and will be rejected during
   // validation.
   // +optional
+  // +k8s:opaqueType
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // Spec for the ResourceClaim. The entire content is copied unchanged
   // into the ResourceClaim that gets created from this template. The
   // same fields as in a ResourceClaim are also valid here.
+  // +optional
   optional ResourceClaimSpec spec = 2;
 }
 
@@ -1780,6 +2022,8 @@ message ResourceClaimTemplateSpec {
 message ResourcePool {
   // Name is used to identify the pool. For node-local devices, this
   // is often the node name, but this is not required.
+  // A field selector can be used to list only ResourceSlice objects
+  // belonging to a certain pool.
   //
   // It must not be longer than 253 characters and must consist of one or more DNS sub-domains
   // separated by slashes. This field is immutable.
@@ -1920,7 +2164,7 @@ message ResourceSliceSpec {
   //
   // +optional
   // +listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +zeroOrOneOf=ResourceSliceType
   repeated Device devices = 6;
 
@@ -1946,14 +2190,50 @@ message ResourceSliceSpec {
   // The maximum number of counter sets is 8.
   //
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:optional
   // +listType=atomic
   // +k8s:listType=atomic
-  // +k8s:alpha(since: "1.36")=+k8s:unique=map
-  // +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
+  // +k8s:beta(since: "1.37")=+k8s:unique=map
+  // +k8s:beta(since: "1.37")=+k8s:listMapKey=name
   // +featureGate=DRAPartitionableDevices
   // +zeroOrOneOf=ResourceSliceType
-  // +k8s:alpha(since: "1.36")=+k8s:maxItems=8
+  // +k8s:beta(since: "1.37")=+k8s:maxItems=8
   repeated CounterSet sharedCounters = 8;
+
+  // PartitionTypeAttribute names a string device attribute (by fully
+  // qualified name, e.g. "gpu.example.com/profile") whose value labels
+  // each device with its partition type, such as "Full" or "Half" for a
+  // MIG-style GPU.
+  //
+  // When set, every partitionable device in the slice must carry the attribute
+  // and devices sharing a value must share the same ConsumesCounters cost.
+  //
+  // +optional
+  // +featureGate=DRAPartitionableDevicesType
+  // +k8s:ifDisabled(DRAPartitionableDevicesType)=+k8s:forbidden
+  // +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:optional
+  // +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:format=k8s-resource-fully-qualified-name
+  optional string partitionTypeAttribute = 9;
+
+  // SkipNodeOperations lists node-local resource operations (gRPC calls)
+  // that will be skipped for the devices in this slice when determining whether
+  // operations are necessary on the node. If all allocated devices for a driver in
+  // a claim skip an operation, that gRPC call will be skipped. Valid values are:
+  //
+  // - "NodePrepareResources": NodePrepareResources gRPC calls are skipped. This
+  //   value cannot be specified unless "NodeUnprepareResources" is also listed
+  //   (or "*" is specified).
+  // - "NodeUnprepareResources": NodeUnprepareResources gRPC calls are skipped.
+  // - "*": All node-local resource operations are skipped.
+  //
+  // Other values may be added in the future. The kubelet must ignore unknown
+  // values.
+  //
+  // +optional
+  // +listType=set
+  // +k8s:listType=set
+  // +featureGate=DRAOptionalNodeOperations
+  // +k8s:optional
+  repeated string skipNodeOperations = 10;
 }
 
diff --git a/vendor/k8s.io/api/resource/v1beta2/types.go b/vendor/k8s.io/api/resource/v1beta2/types.go
index 47a46355f0..04b5e9fbc5 100644
--- a/vendor/k8s.io/api/resource/v1beta2/types.go
+++ b/vendor/k8s.io/api/resource/v1beta2/types.go
@@ -78,7 +78,7 @@ const (
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type ResourceSlice struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -97,6 +97,9 @@ const (
 	// ResourceSliceSelectorDriver can be used in a [metav1.ListOptions]
 	// field selector to filter based on [ResourceSliceSpec.Driver].
 	ResourceSliceSelectorDriver = "spec.driver"
+	// ResourceSliceSelectorPoolName can be used in a [metav1.ListOptions]
+	// field selector to filter based on [ResourceSliceSpec.Pool.Name].
+	ResourceSliceSelectorPoolName = "spec.pool.name"
 )
 
 // ResourceSliceSpec contains the information published by the driver in one ResourceSlice.
@@ -160,7 +163,7 @@ type ResourceSliceSpec struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +zeroOrOneOf=ResourceSliceType
 	Devices []Device `json:"devices,omitempty" protobuf:"bytes,6,name=devices"`
 
@@ -186,17 +189,68 @@ type ResourceSliceSpec struct {
 	// The maximum number of counter sets is 8.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +listType=atomic
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
+	// +k8s:beta(since: "1.37")=+k8s:unique=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=name
 	// +featureGate=DRAPartitionableDevices
 	// +zeroOrOneOf=ResourceSliceType
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=8
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=8
 	SharedCounters []CounterSet `json:"sharedCounters,omitempty" protobuf:"bytes,8,name=sharedCounters"`
+
+	// PartitionTypeAttribute names a string device attribute (by fully
+	// qualified name, e.g. "gpu.example.com/profile") whose value labels
+	// each device with its partition type, such as "Full" or "Half" for a
+	// MIG-style GPU.
+	//
+	// When set, every partitionable device in the slice must carry the attribute
+	// and devices sharing a value must share the same ConsumesCounters cost.
+	//
+	// +optional
+	// +featureGate=DRAPartitionableDevicesType
+	// +k8s:ifDisabled(DRAPartitionableDevicesType)=+k8s:forbidden
+	// +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:optional
+	// +k8s:ifEnabled(DRAPartitionableDevicesType)=+k8s:format=k8s-resource-fully-qualified-name
+	PartitionTypeAttribute *FullyQualifiedName `json:"partitionTypeAttribute,omitempty" protobuf:"bytes,9,opt,name=partitionTypeAttribute"`
+
+	// SkipNodeOperations lists node-local resource operations (gRPC calls)
+	// that will be skipped for the devices in this slice when determining whether
+	// operations are necessary on the node. If all allocated devices for a driver in
+	// a claim skip an operation, that gRPC call will be skipped. Valid values are:
+	//
+	// - "NodePrepareResources": NodePrepareResources gRPC calls are skipped. This
+	//   value cannot be specified unless "NodeUnprepareResources" is also listed
+	//   (or "*" is specified).
+	// - "NodeUnprepareResources": NodeUnprepareResources gRPC calls are skipped.
+	// - "*": All node-local resource operations are skipped.
+	//
+	// Other values may be added in the future. The kubelet must ignore unknown
+	// values.
+	//
+	// +optional
+	// +listType=set
+	// +k8s:listType=set
+	// +featureGate=DRAOptionalNodeOperations
+	// +k8s:optional
+	SkipNodeOperations []SkipNodeOperation `json:"skipNodeOperations,omitempty" protobuf:"bytes,10,rep,name=skipNodeOperations,casttype=SkipNodeOperation"`
 }
 
+// +enum
+// +k8s:enum
+type SkipNodeOperation string
+
+const (
+	// SkipNodeOperationNodePrepareResources indicates that NodePrepareResources gRPC calls are skipped.
+	SkipNodeOperationNodePrepareResources SkipNodeOperation = "NodePrepareResources"
+
+	// SkipNodeOperationNodeUnprepareResources indicates that NodeUnprepareResources gRPC calls are skipped.
+	SkipNodeOperationNodeUnprepareResources SkipNodeOperation = "NodeUnprepareResources"
+
+	// SkipNodeOperationAll indicates that all node-local resource operations are skipped.
+	SkipNodeOperationAll SkipNodeOperation = "*"
+)
+
 // CounterSet defines a named set of counters
 // that are available to be used by devices defined in the
 // ResourcePool.
@@ -210,8 +264,8 @@ type CounterSet struct {
 	// It must be a DNS label.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-short-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-short-name
 	Name string `json:"name" protobuf:"bytes,1,name=name"`
 
 	// Counters defines the set of counters for this CounterSet
@@ -220,8 +274,8 @@ type CounterSet struct {
 	// The maximum number of counters is 32.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:eachKey=+k8s:format=k8s-short-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:eachKey=+k8s:format=k8s-short-name
 	Counters map[string]Counter `json:"counters,omitempty" protobuf:"bytes,2,name=counters"`
 }
 
@@ -233,6 +287,8 @@ const DriverNameMaxLength = 63
 type ResourcePool struct {
 	// Name is used to identify the pool. For node-local devices, this
 	// is often the node name, but this is not required.
+	// A field selector can be used to list only ResourceSlice objects
+	// belonging to a certain pool.
 	//
 	// It must not be longer than 253 characters and must consist of one or more DNS sub-domains
 	// separated by slashes. This field is immutable.
@@ -297,6 +353,10 @@ const ResourceSliceMaxDeviceCounterConsumptionsPerDevice = 2
 // per device counter consumption.
 const ResourceSliceMaxCountersPerDeviceCounterConsumption = 32
 
+// Defines the maximum number of compatibility groups that can be
+// declared per device counter consumption.
+const DeviceCompatibilityGroupsMaxSize = 2
+
 // Device represents one individual hardware instance that can be selected based
 // on its attributes. Besides the name, exactly one field must be set.
 type Device struct {
@@ -312,7 +372,7 @@ type Device struct {
 	// The maximum number of attributes and capacities combined is 32.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Attributes map[QualifiedName]DeviceAttribute `json:"attributes,omitempty" protobuf:"bytes,2,rep,name=attributes"`
 
 	// Capacity defines the set of capacities for this device.
@@ -333,13 +393,13 @@ type Device struct {
 	// device is 2.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +listType=atomic
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=counterSet
+	// +k8s:beta(since: "1.37")=+k8s:unique=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=counterSet
 	// +featureGate=DRAPartitionableDevices
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=2
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=2
 	ConsumesCounters []DeviceCounterConsumption `json:"consumesCounters,omitempty" protobuf:"bytes,4,rep,name=consumesCounters"`
 
 	// NodeName identifies the node where the device is available.
@@ -386,7 +446,7 @@ type Device struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceTaints
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Taints []DeviceTaint `json:"taints,omitempty" protobuf:"bytes,8,rep,name=taints"`
 
 	// BindsToNode indicates if the usage of an allocation involving this device
@@ -416,8 +476,8 @@ type Device struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=4
 	BindingConditions []string `json:"bindingConditions,omitempty" protobuf:"bytes,10,rep,name=bindingConditions"`
 
 	// BindingFailureConditions defines the conditions for binding failure.
@@ -434,8 +494,8 @@ type Device struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=4
 	BindingFailureConditions []string `json:"bindingFailureConditions,omitempty" protobuf:"bytes,11,rep,name=bindingFailureConditions"`
 
 	// AllowMultipleAllocations marks whether the device is allowed to be allocated to multiple DeviceRequests.
@@ -447,7 +507,10 @@ type Device struct {
 	// +featureGate=DRAConsumableCapacity
 	AllowMultipleAllocations *bool `json:"allowMultipleAllocations,omitempty" protobuf:"bytes,12,opt,name=allowMultipleAllocations"`
 
-	// NodeAllocatableResourceMappings defines the mapping of node resources
+	// NodeAllocatableResourceMappings is tombstoned as it got replaced with NodeAllocatableResources.
+	// NodeAllocatableResourceMappings map[v1.ResourceName]NodeAllocatableResourceMapping `json:"nodeAllocatableResourceMappings,omitempty" protobuf:"bytes,13,opt,name=nodeAllocatableResourceMappings"`
+
+	// NodeAllocatableResources defines the mapping of node resources
 	// that are managed by the DRA driver exposing this device. This includes resources currently
 	// reported in v1.Node `status.allocatable` that are not extended resources
 	// (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources).
@@ -459,46 +522,104 @@ type Device struct {
 	// The keys of this map are the node-allocatable resource names (e.g., "cpu", "memory").
 	// Extended resource names are not permitted as keys.
 	// +optional
+	// +k8s:optional
 	// +featureGate=DRANodeAllocatableResources
-	NodeAllocatableResourceMappings map[v1.ResourceName]NodeAllocatableResourceMapping `json:"nodeAllocatableResourceMappings,omitempty" protobuf:"bytes,13,opt,name=nodeAllocatableResourceMappings"`
+	NodeAllocatableResources map[v1.ResourceName]NodeAllocatableResource `json:"nodeAllocatableResources,omitempty" protobuf:"bytes,14,opt,name=nodeAllocatableResources"`
 }
 
-// NodeAllocatableResourceMapping defines the translation between the DRA device/capacity
+// NodeAllocatableResource defines the translation between the DRA device/capacity
 // units requested to the corresponding quantity of the node allocatable resource.
-type NodeAllocatableResourceMapping struct {
+// At least one of Mapping or Overhead must be specified. Not specifying either is an invalid configuration.
+type NodeAllocatableResource struct {
+	// Mapping is used when the device directly models a node allocatable resource like standard CPU or memory
+	// (e.g., with a CPU DRA driver). The calculated quantity is accounted for exactly once per claim instance
+	// on the node. To prevent node cgroup isolation friction, the scheduler explicitly
+	// blocks sharing mapped device claims across multiple pods.
+	// +optional
+	// +k8s:optional
+	Mapping *NodeAllocatableMapping `json:"mapping,omitempty" protobuf:"bytes,3,opt,name=mapping"`
+
+	// Overhead contains fields for modeling auxiliary overhead incurred on node allocatable resources
+	// when allocating devices that are not themselves modeling a node allocatable resource (e.g., host memory overhead for GPUs).
+	// Sharing overhead-mapped claims across multiple pods is allowed. The node allocatable overhead is accounted
+	// for individually for each pod referencing the claim.
+	// Overhead is always subtracted from the node's allocatable capacity for the resource, even when mapping
+	// is specified for the same resource.
+	// Eg: If a device models memory capacity per socket as a consumable capacity pool via Mapping (with CapacityKey),
+	// any overhead specified for the same resource will be subtracted from the node's general allocatable capacity
+	// and not from the per-socket capacity pool in Mapping.
+	// +optional
+	// +k8s:optional
+	Overhead *NodeAllocatableOverhead `json:"overhead,omitempty" protobuf:"bytes,4,opt,name=overhead"`
+}
+
+// NodeAllocatableMapping defines how a DRA allocation directly translates into a node allocatable resource quantity.
+// The mapping can be derived from either the count of allocated devices (via deviceMultiplier) or the specific capacity consumed (via capacityKey and capacityMultiplier). These options are mutually exclusive.
+// Kubelet adds this mapped resource quantity from claim to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.
+type NodeAllocatableMapping struct {
 	// CapacityKey references a capacity name defined as a key in the
 	// `spec.devices[*].capacity` map. When this field is set, the value associated with
 	// this key in the `status.allocation.devices.results[*].consumedCapacity` map
 	// (for a specific claim allocation) determines the base quantity for
-	// the node allocatable resource. If `allocationMultiplier` is also set, it is
+	// the node allocatable resource. `capacityMultiplier` must also be set and is
 	// multiplied with the base quantity.
 	// For example, if `spec.devices[*].capacity` has an entry "dra.example.com/memory": "128Gi",
 	// and this field is set to "dra.example.com/memory", then for a claim allocation
 	// that consumes { "dra.example.com/memory": "4Gi" } the base quantity for the
-	// node allocatable resource mapping will be "4Gi", and `allocationMultiplier` should
-	// be omitted or set to "1".
+	// node allocatable resource mapping will be "4Gi".
+	// The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
 	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:alpha(since: "1.37")=+k8s:dependentRequired("capacityMultiplier")
 	CapacityKey *QualifiedName `json:"capacityKey,omitempty" protobuf:"bytes,1,opt,name=capacityKey"`
 
-	// AllocationMultiplier is used as a multiplier for the allocated device count or the allocated capacity in the claim.
-	// It defaults to 1 if not specified. How the field is used also depends on whether `capacityKey` is set.
-	// 1.  If `capacityKey` is NOT set: `allocationMultiplier` multiplies the device count allocated to the claim.
-	// 	   a. A DRA driver representing each CPU core as a device would have
-	//        {ResourceName: "cpu", allocationMultiplier: "2"} in its
-	//        `nodeAllocatableResourceMappings`. If 4 devices are allocated to the claim,
-	// 		  4 * 2 CPUs would be considered as allocated and subtracted from the node's capacity.
-	//     b. A GPU device that needs additional node memory per GPU allocation would
-	//        have {ResourceName: "memory", allocationMultiplier: "2Gi"}.  Each allocated
-	// 		  GPU device instance of this type will account for 2Gi of memory.
-	//
-	// 2.  If `capacityKey` IS set: `allocationMultiplier` is multiplied by the amount of that capacity consumed.
-	// 	   The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `allocationMultiplier`.
-	//     For example, if a Device's capacity "dra.example.com/cores" is consumed,
-	//     and each "core" provides 2 "cpu"s, the mapping would be:
-	//     {ResourceName: "cpu", capacityKey: "dra.example.com/cores", allocationMultiplier: "2"}.
-	//     If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
-	// +optional
-	AllocationMultiplier *resource.Quantity `json:"allocationMultiplier,omitempty" protobuf:"bytes,2,opt,name=allocationMultiplier"`
+	// CapacityMultiplier is used as a multiplier for the allocated capacity consumed.
+	// It is only valid if `capacityKey` is set.
+	// The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
+	// For example, if a Device's capacity "dra.example.com/cores" is consumed,
+	// and each "core" provides 2 "cpu"s, the mapping would be:
+	// {ResourceName: "cpu", capacityKey: "dra.example.com/cores", capacityMultiplier: "2"}.
+	// If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
+	// +optional
+	// +k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:dependentRequired("capacityKey")
+	CapacityMultiplier *resource.Quantity `json:"capacityMultiplier,omitempty" protobuf:"bytes,2,opt,name=capacityMultiplier"`
+
+	// DeviceMultiplier is used as a multiplier for the allocated device count in the claim.
+	// The final node allocatable resource amount is `deviceCount` * `deviceMultiplier`.
+	// For example, a DRA driver representing each cache complex (CCX) as a device would have
+	// {ResourceName: "cpu", deviceMultiplier: "8"} in its `nodeAllocatableResources`.
+	// If 2 devices (CCX) are allocated to the claim, 2 * 8 = 16 CPUs would be considered as allocated.
+	// It is only valid when `capacityKey` and `capacityMultiplier` are not set.
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	DeviceMultiplier *resource.Quantity `json:"deviceMultiplier,omitempty" protobuf:"bytes,3,opt,name=deviceMultiplier"`
+}
+
+// NodeAllocatableOverhead defines auxiliary resource overheads incurred when allocating a device.
+// Overheads can be specified as a fixed cost per pod referencing the claim, a variable cost per container reference, or both.
+// Kubelet accounts for this overhead by adding it to both the pod-level and container-level cgroups of referencing containers.
+type NodeAllocatableOverhead struct {
+	// PerPod is overhead applied once per pod referencing the claim on this node.
+	// This is a flat overhead incurred for every pod referencing the claim.
+	// +optional
+	// +k8s:optional
+	PerPod *resource.Quantity `json:"perPod,omitempty" protobuf:"bytes,1,opt,name=perPod"`
+
+	// PerContainer is applied per container reference to the claim.
+	// This models overhead scaling linearly with the number of containers actively using the device.
+	// When both PerPod and PerContainer are specified, the total overhead allocated for each pod referencing
+	// the claim is computed as:
+	// Quantity = PerPod + (PerContainer * NumReferences)
+	// Kubelet accounts for this overhead in cgroups:
+	// - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences).
+	// - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container.
+	// This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once.
+	// +optional
+	// +k8s:optional
+	PerContainer *resource.Quantity `json:"perContainer,omitempty" protobuf:"bytes,2,opt,name=perContainer"`
 }
 
 // DeviceCounterConsumption defines a set of counters that
@@ -508,8 +629,8 @@ type DeviceCounterConsumption struct {
 	// counters defined will be consumed.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-short-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-short-name
 	CounterSet string `json:"counterSet" protobuf:"bytes,1,opt,name=counterSet"`
 
 	// Counters defines the counters that will be consumed by the device.
@@ -517,9 +638,39 @@ type DeviceCounterConsumption struct {
 	// The maximum number of counters is 32.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:eachKey=+k8s:format=k8s-short-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:eachKey=+k8s:format=k8s-short-name
 	Counters map[string]Counter `json:"counters,omitempty" protobuf:"bytes,2,opt,name=counters"`
+
+	// CompatibilityGroups is a list of opaque group names for
+	// this counter set consumption.
+	//
+	// Devices that consume counters from the same counter set may only be
+	// allocated at the same time ("co-allocated") if they all share at least
+	// one common group: the intersection of the CompatibilityGroups of all
+	// co-allocated devices on that counter set must be non-empty. Devices
+	// that consume from different counter sets are never compared via this
+	// field.
+	//
+	// An unset field, an explicit nil, and an empty list are equivalent and
+	// mean "no groups": such a device is only co-allocatable with sibling
+	// devices on the same counter set that also have no groups, and is never
+	// co-allocatable with a device that declares one or more groups.
+	//
+	// Group names are opaque and meaningful only within the
+	// publishing driver's pool.
+	//
+	// The maximum number of groups is 2, and the names must be unique.
+	//
+	// +optional
+	// +listType=atomic
+	// +featureGate=DRADeviceCompatibilityGroups
+	// +k8s:listType=atomic
+	// +k8s:optional
+	// +k8s:maxItems=2
+	// +k8s:unique=set
+	// +k8s:eachVal=+k8s:format=k8s-short-name
+	CompatibilityGroups []string `json:"compatibilityGroups,omitempty" protobuf:"bytes,3,rep,name=compatibilityGroups"`
 }
 
 // DeviceCapacity describes a quantity associated with a device.
@@ -603,6 +754,13 @@ type CapacityRequestPolicy struct {
 
 // CapacityRequestPolicyRange defines a valid range for consumable capacity values.
 //
+// If the DRAFractionalCapacityRange feature gate is
+// enabled and at least one of Min, Max, or Step is a fractional quantity (i.e.
+// its value is not an integer), milli-unit arithmetic is used instead,
+// supporting values with up to 3 decimal places (e.g. 100m = 0.1).
+// The largest supported value then is 1000 times smaller compared to using 64-bit integers.
+// Otherwise, all comparisons use 64-bit integer arithmetic via resource.Quantity.Value().
+//
 //   - If the requested amount is less than Min, it is rounded up to the Min value.
 //   - If Step is set and the requested amount is between Min and Max but not aligned with Step,
 //     it will be rounded up to the next value equal to Min + (n * Step).
@@ -682,30 +840,30 @@ type DeviceAttribute struct {
 	// IntValue is a number.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	IntValue *int64 `json:"int,omitempty" protobuf:"varint,2,opt,name=int"`
 
 	// BoolValue is a true/false value.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	BoolValue *bool `json:"bool,omitempty" protobuf:"varint,3,opt,name=bool"`
 
 	// StringValue is a string. Must not be longer than 64 characters.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	StringValue *string `json:"string,omitempty" protobuf:"bytes,4,opt,name=string"`
 
 	// VersionValue is a semantic version according to semver.org spec 2.0.0.
 	// Must not be longer than 64 characters.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	VersionValue *string `json:"version,omitempty" protobuf:"bytes,5,opt,name=version"`
 
 	// IntValues is a non-empty list of numbers.
@@ -715,8 +873,8 @@ type DeviceAttribute struct {
 	// +optional
 	// +listType=atomic
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	// +featureGate=DRAListTypeAttributes
 	IntValues []int64 `json:"ints,omitempty" protobuf:"varint,6,opt,name=ints"`
 
@@ -725,8 +883,8 @@ type DeviceAttribute struct {
 	// +optional
 	// +listType=atomic
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	// +featureGate=DRAListTypeAttributes
 	BoolValues []bool `json:"bools,omitempty" protobuf:"varint,7,opt,name=bools"`
 
@@ -738,8 +896,9 @@ type DeviceAttribute struct {
 	// +optional
 	// +listType=atomic
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
+	// +k8s:alpha(since: "1.37")=+k8s:eachVal=+k8s:maxBytes=64
 	// +featureGate=DRAListTypeAttributes
 	StringValues []string `json:"strings,omitempty" protobuf:"bytes,8,opt,name=strings"`
 
@@ -751,8 +910,8 @@ type DeviceAttribute struct {
 	// +optional
 	// +listType=atomic
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:unionMember
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:unionMember
 	// +featureGate=DRAListTypeAttributes
 	VersionValues []string `json:"versions,omitempty" protobuf:"bytes,9,opt,name=versions"`
 }
@@ -789,7 +948,7 @@ type DeviceTaint struct {
 	// Consumers must treat unknown effects like None.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Effect DeviceTaintEffect `json:"effect" protobuf:"bytes,3,name=effect,casttype=DeviceTaintEffect"`
 
 	// ^^^^
@@ -828,7 +987,7 @@ type DeviceTaint struct {
 }
 
 // +enum
-// +k8s:alpha(since: "1.36")=+k8s:enum
+// +k8s:beta(since: "1.37")=+k8s:enum
 type DeviceTaintEffect string
 
 const (
@@ -852,8 +1011,9 @@ const (
 // DeviceTaintRule adds one taint to all devices which match the selector.
 // This has the same effect as if the taint was specified directly
 // in the ResourceSlice by the DRA driver.
+// +k8s:supportsSubresource="/status"
 type DeviceTaintRule struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -971,6 +1131,9 @@ type DeviceTaintRuleStatus struct {
 	// +listMapKey=type
 	// +patchStrategy=merge
 	// +patchMergeKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
 }
 
@@ -985,7 +1148,7 @@ const DeviceTaintConditionEvictionInProgress = "EvictionInProgress"
 
 // DeviceTaintRuleList is a collection of DeviceTaintRules.
 type DeviceTaintRuleList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -999,7 +1162,7 @@ type DeviceTaintRuleList struct {
 
 // ResourceSliceList is a collection of ResourceSlices.
 type ResourceSliceList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -1022,14 +1185,15 @@ type ResourceSliceList struct {
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type ResourceClaim struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec describes what is being requested and how to configure it.
 	// The spec is immutable.
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:immutable
+	// +optional
 	Spec ResourceClaimSpec `json:"spec" protobuf:"bytes,2,name=spec"`
 
 	// Status describes whether the claim is ready to use and what has been allocated.
@@ -1057,11 +1221,11 @@ type DeviceClaim struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:unique=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=name
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Requests []DeviceRequest `json:"requests" protobuf:"bytes,1,name=requests"`
 
 	// These constraints must be satisfied by the set of devices that get
@@ -1069,8 +1233,8 @@ type DeviceClaim struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Constraints []DeviceConstraint `json:"constraints,omitempty" protobuf:"bytes,2,opt,name=constraints"`
 
 	// This field holds configuration for multiple potential drivers which
@@ -1079,8 +1243,8 @@ type DeviceClaim struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Config []DeviceClaimConfiguration `json:"config,omitempty" protobuf:"bytes,3,opt,name=config"`
 
 	// Potential future extension, ignored by older schedulers. This is
@@ -1131,7 +1295,7 @@ type DeviceRequest struct {
 	//
 	// +optional
 	// +oneOf=deviceRequestType
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Exactly *ExactDeviceRequest `json:"exactly,omitempty" protobuf:"bytes,2,name=exactly"`
 
 	// FirstAvailable contains subrequests, of which exactly one will be
@@ -1152,11 +1316,11 @@ type DeviceRequest struct {
 	// +oneOf=deviceRequestType
 	// +listType=atomic
 	// +featureGate=DRAPrioritizedList
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=name
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=8
+	// +k8s:beta(since: "1.37")=+k8s:unique=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=name
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=8
 	FirstAvailable []DeviceSubRequest `json:"firstAvailable,omitempty" protobuf:"bytes,3,name=firstAvailable"`
 }
 
@@ -1184,8 +1348,8 @@ type ExactDeviceRequest struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Selectors []DeviceSelector `json:"selectors,omitempty" protobuf:"bytes,2,name=selectors"`
 
 	// AllocationMode and its related fields define how devices are allocated
@@ -1208,7 +1372,7 @@ type ExactDeviceRequest struct {
 	// requests with unknown modes.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	AllocationMode DeviceAllocationMode `json:"allocationMode,omitempty" protobuf:"bytes,3,opt,name=allocationMode"`
 
 	// Count is used only when the count mode is "ExactCount". Must be greater than zero.
@@ -1253,7 +1417,7 @@ type ExactDeviceRequest struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceTaints
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Tolerations []DeviceToleration `json:"tolerations,omitempty" protobuf:"bytes,6,opt,name=tolerations"`
 
 	// Capacity define resource requirements against each capacity.
@@ -1272,6 +1436,34 @@ type ExactDeviceRequest struct {
 	// +optional
 	// +featureGate=DRAConsumableCapacity
 	Capacity *CapacityRequirements `json:"capacity,omitempty" protobuf:"bytes,7,opt,name=capacity"`
+
+	// DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+	// for each candidate device. These virtual attributes can be referenced in
+	// `.devices.constraints` to align and match different devices (e.g., co-allocating
+	// a GPU and a NIC on the same NUMA node) even if their drivers publish different
+	// attributes. Derived attributes are not available via `device.attributes`
+	// in the CEL environment when evaluating selector expressions.
+	//
+	// Derived attributes allow you to extract, transform, or normalize topology
+	// information (such as extracting a NUMA index from a complex topology string or
+	// renaming a vendor-specific attribute) into a common virtual attribute name at
+	// scheduling time. The scheduler then evaluates these virtual attributes exactly
+	// like static attributes when matching constraints.
+	//
+	// Every derived attribute defined in this list must be referenced by at least one
+	// MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+	//
+	// The maximum number of derived attributes is 32.
+	//
+	// This is an alpha field and requires enabling the DRADerivedAttributes
+	// feature gate.
+	//
+	// +optional
+	// +listType=atomic
+	// +featureGate=DRADerivedAttributes
+	// +k8s:optional
+	// +k8s:maxItems=32
+	DerivedAttributes []DeviceDerivedAttribute `json:"derivedAttributes,omitempty" protobuf:"bytes,8,rep,name=derivedAttributes"`
 }
 
 // DeviceSubRequest describes a request for device provided in the
@@ -1305,8 +1497,8 @@ type DeviceSubRequest struct {
 	// to reference.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name
 	DeviceClassName string `json:"deviceClassName" protobuf:"bytes,2,name=deviceClassName"`
 
 	// Selectors define criteria which must be satisfied by a specific
@@ -1316,8 +1508,8 @@ type DeviceSubRequest struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Selectors []DeviceSelector `json:"selectors,omitempty" protobuf:"bytes,3,name=selectors"`
 
 	// AllocationMode and its related fields define how devices are allocated
@@ -1339,7 +1531,7 @@ type DeviceSubRequest struct {
 	// requests with unknown modes.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	AllocationMode DeviceAllocationMode `json:"allocationMode,omitempty" protobuf:"bytes,4,opt,name=allocationMode"`
 
 	// Count is used only when the count mode is "ExactCount". Must be greater than zero.
@@ -1370,7 +1562,7 @@ type DeviceSubRequest struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceTaints
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Tolerations []DeviceToleration `json:"tolerations,omitempty" protobuf:"bytes,6,opt,name=tolerations"`
 
 	// Capacity define resource requirements against each capacity.
@@ -1389,6 +1581,34 @@ type DeviceSubRequest struct {
 	// +optional
 	// +featureGate=DRAConsumableCapacity
 	Capacity *CapacityRequirements `json:"capacity,omitempty" protobuf:"bytes,7,opt,name=capacity"`
+
+	// DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+	// for each candidate device. These virtual attributes can be referenced in
+	// `.devices.constraints` to align and match different devices (e.g., co-allocating
+	// a GPU and a NIC on the same NUMA node) even if their drivers publish different
+	// attributes. Derived attributes are not available via `device.attributes`
+	// in the CEL environment when evaluating selector expressions.
+	//
+	// Derived attributes allow you to extract, transform, or normalize topology
+	// information (such as extracting a NUMA index from a complex topology string or
+	// renaming a vendor-specific attribute) into a common virtual attribute name at
+	// scheduling time. The scheduler then evaluates these virtual attributes exactly
+	// like static attributes when matching constraints.
+	//
+	// Every derived attribute defined in this list must be referenced by at least one
+	// MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+	//
+	// The maximum number of derived attributes is 32.
+	//
+	// This is an alpha field and requires enabling the DRADerivedAttributes
+	// feature gate.
+	//
+	// +optional
+	// +listType=atomic
+	// +featureGate=DRADerivedAttributes
+	// +k8s:optional
+	// +k8s:maxItems=32
+	DerivedAttributes []DeviceDerivedAttribute `json:"derivedAttributes,omitempty" protobuf:"bytes,8,rep,name=derivedAttributes"`
 }
 
 // CapacityRequirements defines the capacity requirements for a specific device request.
@@ -1420,14 +1640,70 @@ type CapacityRequirements struct {
 	Requests map[QualifiedName]resource.Quantity `json:"requests,omitempty" protobuf:"bytes,1,rep,name=requests,castkey=QualifiedName"`
 }
 
+// DeviceDerivedAttribute defines a derived attribute computed via CEL.
+type DeviceDerivedAttribute struct {
+	// Name is the identifier for this derived attribute, used in constraints.
+	//
+	// It must be a DNS subdomain followed by a slash ("/") followed by a C identifier
+	// (e.g. "example.com/numaNode" or "derived/numaNode").
+	//
+	// If the chosen name matches an existing physical attribute from a driver,
+	// the derived attribute's expression will shadow the physical attribute,
+	// and its evaluated value will be used in constraints instead. When the goal
+	// is to define a derived attribute that is only used within the ResourceClaim
+	// and not meant to shadow an existing attribute, use a domain prefix that
+	// no DRA driver should be using (e.g. "derived/myAttribute").
+	//
+	// It is not valid to define a derived attribute that isn't used in at least
+	// one constraint.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-resource-fully-qualified-name
+	Name FullyQualifiedName `json:"name" protobuf:"bytes,1,name=name"`
+
+	// Expression is a CEL expression evaluated against each candidate device.
+	// The expression must evaluate to a primitive scalar (string, integer,
+	// boolean, or semver) or a list of these scalars ([]string, []int64,
+	// []bool, []semver) to act as a virtual grouping key. Any other return type
+	// is an error and causes CEL evaluation for the device to fail.
+	//
+	// The expression's input is an object named "device", which carries the
+	// same properties as in a CELDeviceSelector.
+	//
+	// When pod scheduling encounters CEL runtime errors (such as looking
+	// up an attribute that isn't defined) for some devices, it will abort
+	// allocation and fail scheduling for the Pod. Surfacing evaluation
+	// errors immediately prevents silent topology matching failures that are
+	// extremely hard to detect. A robust expression should, for example, check
+	// for the existence of attributes before referencing them to avoid
+	// runtime evaluation errors.
+	//
+	// The expression gets evaluated after a device has passed the other
+	// selector expressions for the request in which this expression is used.
+	// This allows writing expressions that are tailored towards the specific
+	// devices being requested (for example, by assuming the device is from a
+	// certain vendor and skipping those checks).
+	//
+	// The length of the expression must be smaller or equal to 10 Ki. The
+	// cost of evaluating it is also limited based on the estimated number
+	// of logical steps; the combined cost of all derived attributes in a
+	// claim is capped by a shared CEL cost budget.
+	//
+	// +required
+	// +k8s:required
+	Expression string `json:"expression" protobuf:"bytes,2,name=expression"`
+}
+
 const (
 	DeviceSelectorsMaxSize             = 32
 	FirstAvailableDeviceRequestMaxSize = 8
 	DeviceTolerationsMaxLength         = 16
+	DeviceDerivedAttributesMaxSize     = 32
 )
 
 // +enum
-// +k8s:alpha(since: "1.36")=+k8s:enum
+// +k8s:beta(since: "1.37")=+k8s:enum
 type DeviceAllocationMode string
 
 // Valid [DeviceRequest.CountMode] values.
@@ -1457,7 +1733,7 @@ type CELDeviceSelector struct {
 	//  - driver (string): the name of the driver which defines this device.
 	//  - attributes (map[string]object): the device's attributes, grouped by prefix
 	//    (e.g. device.attributes["dra.example.com"] evaluates to an object with all
-	//    of the attributes which were prefixed by "dra.example.com".
+	//    of the attributes which were prefixed by "dra.example.com").
 	//  - capacity (map[string]object): the device's capacities, grouped by prefix.
 	//  - allowMultipleAllocations (bool): the allowMultipleAllocations property of the device
 	//    (v1.34+ with the DRAConsumableCapacity feature enabled).
@@ -1490,6 +1766,15 @@ type CELDeviceSelector struct {
 	// A robust expression should check for the existence of attributes
 	// before referencing them.
 	//
+	// Common errors:
+	// - "no such key": Use optional chaining (.? followed by orValue())
+	//   or guarding the check with has() for optional fields.
+	//   See CEL Optional Types for details:
+	//   https://pkg.go.dev/github.com/google/cel-go@v0.17.4/cel#OptionalTypes
+	//
+	// For more CEL expression syntax and examples, see:
+	// https://kubernetes.io/docs/reference/using-api/cel/
+	//
 	// For ease of use, the cel.bind() function is enabled, and can be used
 	// to simplify expressions that access multiple attributes with the
 	// same domain. For example:
@@ -1537,6 +1822,25 @@ type CELDeviceSelector struct {
 // However, this depends on how fast the machine is.
 const CELSelectorExpressionMaxCost = 1000000
 
+// DeviceClaimDerivedAttributeCELMaxCost is the maximum combined execution cost
+// allowed for all derived attribute CEL expressions within a single DeviceClaim.
+//
+// During validation, the API server computes the estimated execution cost of each
+// derived attribute expression. The sum of these costs across all requests in the
+// claim must not exceed this budget. If it does, the claim is rejected.
+//
+// To stay within the budget, consumers should simplify their CEL expressions,
+// avoid computationally expensive operations like deep nesting or iterations
+// (such as `.all()` or `.exists()`), and minimize the total number of derived
+// attributes in a claim.
+//
+// This shared budget prevents excessively complex claims from degrading the
+// performance of the kube-scheduler. The limit is set to 1,000,000 instruction
+// executions (roughly 0.1 seconds of evaluation time), tying the collective
+// cost of all derived attributes to the maximum cost allowed for a single
+// CEL selector.
+const DeviceClaimDerivedAttributeCELMaxCost = 1000000
+
 // CELSelectorExpressionMaxLength is the maximum length of a CEL selector expression string.
 const CELSelectorExpressionMaxLength = 10 * 1024
 
@@ -1554,10 +1858,10 @@ type DeviceConstraint struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=set
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:unique=set
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Requests []string `json:"requests,omitempty" protobuf:"bytes,1,opt,name=requests"`
 
 	// MatchAttribute requires that all devices in question have this
@@ -1580,8 +1884,8 @@ type DeviceConstraint struct {
 	//
 	// +optional
 	// +oneOf=ConstraintType
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-resource-fully-qualified-name
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-fully-qualified-name
 	MatchAttribute *FullyQualifiedName `json:"matchAttribute,omitempty" protobuf:"bytes,2,opt,name=matchAttribute"`
 
 	// Potential future extension, not part of the current design:
@@ -1613,6 +1917,8 @@ type DeviceConstraint struct {
 	// +optional
 	// +oneOf=ConstraintType
 	// +featureGate=DRAConsumableCapacity
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-fully-qualified-name
 	DistinctAttribute *FullyQualifiedName `json:"distinctAttribute,omitempty" protobuf:"bytes,3,opt,name=distinctAttribute"`
 }
 
@@ -1627,13 +1933,13 @@ type DeviceClaimConfiguration struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=set
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:unique=set
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Requests []string `json:"requests,omitempty" protobuf:"bytes,1,opt,name=requests"`
 
-	DeviceConfiguration `json:",inline" protobuf:"bytes,2,name=deviceConfiguration"`
+	DeviceConfiguration `json:"" protobuf:"bytes,2,name=deviceConfiguration"`
 }
 
 // DeviceConfiguration must have exactly one field set. It gets embedded
@@ -1644,7 +1950,7 @@ type DeviceConfiguration struct {
 	//
 	// +optional
 	// +oneOf=ConfigurationType
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Opaque *OpaqueDeviceConfiguration `json:"opaque,omitempty" protobuf:"bytes,1,opt,name=opaque"`
 }
 
@@ -1661,9 +1967,9 @@ type OpaqueDeviceConfiguration struct {
 	// vendor of the driver. It should use only lower case characters.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:maxLength=63
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name-caseless
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:maxLength=63
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name-caseless
 	Driver string `json:"driver" protobuf:"bytes,1,name=driver"`
 
 	// Parameters can contain arbitrary data. It is the responsibility of
@@ -1689,8 +1995,8 @@ type DeviceToleration struct {
 	// Must be a label name.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-label-key
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-label-key
 	Key string `json:"key,omitempty" protobuf:"bytes,1,opt,name=key"`
 
 	// Operator represents a key's relationship to the value.
@@ -1700,7 +2006,7 @@ type DeviceToleration struct {
 	//
 	// +optional
 	// +default="Equal"
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Operator DeviceTolerationOperator `json:"operator,omitempty" protobuf:"bytes,2,opt,name=operator,casttype=DeviceTolerationOperator"`
 
 	// Value is the taint value the toleration matches to.
@@ -1714,7 +2020,7 @@ type DeviceToleration struct {
 	// When specified, allowed values are NoSchedule and NoExecute.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Effect DeviceTaintEffect `json:"effect,omitempty" protobuf:"bytes,4,opt,name=effect,casttype=DeviceTaintEffect"`
 
 	// TolerationSeconds represents the period of time the toleration (which must be
@@ -1731,7 +2037,7 @@ type DeviceToleration struct {
 // A toleration operator is the set of operators that can be used in a toleration.
 //
 // +enum
-// +k8s:alpha(since: "1.36")=+k8s:enum
+// +k8s:beta(since: "1.37")=+k8s:enum
 type DeviceTolerationOperator string
 
 const (
@@ -1745,8 +2051,8 @@ type ResourceClaimStatus struct {
 	// Allocation is set once the claim has been allocated successfully.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:update=NoModify
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:update=NoModify
 	Allocation *AllocationResult `json:"allocation,omitempty" protobuf:"bytes,1,opt,name=allocation"`
 
 	// ReservedFor indicates which entities are currently allowed to use
@@ -1774,10 +2080,10 @@ type ResourceClaimStatus struct {
 	// +listMapKey=uid
 	// +patchStrategy=merge
 	// +patchMergeKey=uid
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:listType=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=uid
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=256
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:listType=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=uid
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=256
 	ReservedFor []ResourceClaimConsumerReference `json:"reservedFor,omitempty" protobuf:"bytes,2,opt,name=reservedFor" patchStrategy:"merge" patchMergeKey:"uid"`
 
 	// DeallocationRequested is tombstoned since Kubernetes 1.32 where
@@ -1790,18 +2096,18 @@ type ResourceClaimStatus struct {
 	// information. Entries are owned by their respective drivers.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +listType=map
 	// +listMapKey=driver
 	// +listMapKey=device
 	// +listMapKey=pool
 	// +listMapKey=shareID
 	// +featureGate=DRAResourceClaimDeviceStatus
-	// +k8s:alpha(since: "1.36")=+k8s:listType=map
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=driver
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=device
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=pool
-	// +k8s:alpha(since: "1.36")=+k8s:listMapKey=shareID
+	// +k8s:beta(since: "1.37")=+k8s:listType=map
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=driver
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=device
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=pool
+	// +k8s:beta(since: "1.37")=+k8s:listMapKey=shareID
 	Devices []AllocatedDeviceStatus `json:"devices,omitempty" protobuf:"bytes,4,opt,name=devices"`
 }
 
@@ -1864,8 +2170,8 @@ type DeviceAllocationResult struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Results []DeviceRequestAllocationResult `json:"results,omitempty" protobuf:"bytes,1,opt,name=results"`
 
 	// This field is a combination of all the claim and class configuration parameters.
@@ -1878,8 +2184,8 @@ type DeviceAllocationResult struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=64
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=64
 	Config []DeviceAllocationConfiguration `json:"config,omitempty" protobuf:"bytes,2,opt,name=config"`
 }
 
@@ -1908,9 +2214,9 @@ type DeviceRequestAllocationResult struct {
 	// vendor of the driver. It should use only lower case characters.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-long-name-caseless
-	// +k8s:alpha(since: "1.36")=+k8s:maxLength=63
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-long-name-caseless
+	// +k8s:beta(since: "1.37")=+k8s:maxLength=63
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Driver string `json:"driver" protobuf:"bytes,2,name=driver"`
 
 	// This name together with the driver name and the device name field
@@ -1920,8 +2226,8 @@ type DeviceRequestAllocationResult struct {
 	// DNS sub-domains separated by slashes.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-resource-pool-name
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-resource-pool-name
 	Pool string `json:"pool" protobuf:"bytes,3,name=pool"`
 
 	// Device references one device instance via its name in the driver's
@@ -1953,7 +2259,7 @@ type DeviceRequestAllocationResult struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceTaints
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Tolerations []DeviceToleration `json:"tolerations,omitempty" protobuf:"bytes,6,opt,name=tolerations"`
 
 	// BindingConditions contains a copy of the BindingConditions
@@ -1965,8 +2271,8 @@ type DeviceRequestAllocationResult struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=4
 	BindingConditions []string `json:"bindingConditions,omitempty" protobuf:"bytes,7,rep,name=bindingConditions"`
 
 	// BindingFailureConditions contains a copy of the BindingFailureConditions
@@ -1978,8 +2284,8 @@ type DeviceRequestAllocationResult struct {
 	// +optional
 	// +listType=atomic
 	// +featureGate=DRADeviceBindingConditions,DRAResourceClaimDeviceStatus
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=4
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=4
 	BindingFailureConditions []string `json:"bindingFailureConditions,omitempty" protobuf:"bytes,8,rep,name=bindingFailureConditions"`
 
 	// ShareID uniquely identifies an individual allocation share of the device,
@@ -1989,8 +2295,8 @@ type DeviceRequestAllocationResult struct {
 	//
 	// +optional
 	// +featureGate=DRAConsumableCapacity
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-uuid
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-uuid
 	ShareID *types.UID `json:"shareID,omitempty" protobuf:"bytes,9,opt,name=shareID"`
 
 	// ConsumedCapacity tracks the amount of capacity consumed per device as part of the claim request.
@@ -2005,6 +2311,19 @@ type DeviceRequestAllocationResult struct {
 	// +optional
 	// +featureGate=DRAConsumableCapacity
 	ConsumedCapacity map[QualifiedName]resource.Quantity `json:"consumedCapacity,omitempty" protobuf:"bytes,10,rep,name=consumedCapacity"`
+
+	// SkipNodeOperations lists node-local resource operations (gRPC calls)
+	// that will be skipped for this allocated device when determining whether
+	// operations are necessary on the node. If all allocated devices for a driver in
+	// a claim skip an operation, that gRPC call will be skipped. It is a copy of
+	// the ResourceSlice.spec.skipNodeOperations value at the time when the device was allocated.
+	//
+	// +optional
+	// +listType=set
+	// +k8s:listType=set
+	// +featureGate=DRAOptionalNodeOperations
+	// +k8s:optional
+	SkipNodeOperations []SkipNodeOperation `json:"skipNodeOperations,omitempty" protobuf:"bytes,11,rep,name=skipNodeOperations,casttype=SkipNodeOperation"`
 }
 
 // DeviceAllocationConfiguration gets embedded in an AllocationResult.
@@ -2014,7 +2333,7 @@ type DeviceAllocationConfiguration struct {
 	// or from a claim.
 	//
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:required
 	Source AllocationConfigSource `json:"source" protobuf:"bytes,1,name=source"`
 
 	// Requests lists the names of requests where the configuration applies.
@@ -2026,17 +2345,17 @@ type DeviceAllocationConfiguration struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=set
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:unique=set
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Requests []string `json:"requests,omitempty" protobuf:"bytes,2,opt,name=requests"`
 
-	DeviceConfiguration `json:",inline" protobuf:"bytes,3,name=deviceConfiguration"`
+	DeviceConfiguration `json:"" protobuf:"bytes,3,name=deviceConfiguration"`
 }
 
 // +enum
-// +k8s:alpha(since: "1.36")=+k8s:enum
+// +k8s:beta(since: "1.37")=+k8s:enum
 type AllocationConfigSource string
 
 // Valid [DeviceAllocationConfiguration.Source] values.
@@ -2050,7 +2369,7 @@ const (
 
 // ResourceClaimList is a collection of claims.
 type ResourceClaimList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -2072,11 +2391,11 @@ type ResourceClaimList struct {
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type DeviceClass struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:subfield(name)=+k8s:format=k8s-long-name
+	// +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:subfield(name)=+k8s:format=k8s-long-name
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec defines what can be allocated and how to configure it.
@@ -2087,6 +2406,7 @@ type DeviceClass struct {
 	// the time of allocation.
 	//
 	// Changing the spec automatically increments the metadata.generation number.
+	// +optional
 	Spec DeviceClassSpec `json:"spec" protobuf:"bytes,2,name=spec"`
 }
 
@@ -2097,8 +2417,8 @@ type DeviceClassSpec struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Selectors []DeviceSelector `json:"selectors,omitempty" protobuf:"bytes,1,opt,name=selectors"`
 
 	// Config defines configuration parameters that apply to each device that is claimed via this class.
@@ -2109,8 +2429,8 @@ type DeviceClassSpec struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=32
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=32
 	Config []DeviceClassConfiguration `json:"config,omitempty" protobuf:"bytes,2,opt,name=config"`
 
 	// SuitableNodes is tombstoned since Kubernetes 1.32 where
@@ -2127,17 +2447,16 @@ type DeviceClassSpec struct {
 	// If two classes are created at the same time, then the name of the class
 	// lexicographically sorted first is picked.
 	//
-	// This is a beta field.
 	// +optional
 	// +featureGate=DRAExtendedResource
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-extended-resource-name
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-extended-resource-name
 	ExtendedResourceName *string `json:"extendedResourceName,omitempty" protobuf:"bytes,4,opt,name=extendedResourceName"`
 }
 
 // DeviceClassConfiguration is used in DeviceClass.
 type DeviceClassConfiguration struct {
-	DeviceConfiguration `json:",inline" protobuf:"bytes,1,opt,name=deviceConfiguration"`
+	DeviceConfiguration `json:"" protobuf:"bytes,1,opt,name=deviceConfiguration"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
@@ -2145,7 +2464,7 @@ type DeviceClassConfiguration struct {
 
 // DeviceClassList is a collection of classes.
 type DeviceClassList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -2163,7 +2482,7 @@ type DeviceClassList struct {
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type ResourceClaimTemplate struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -2173,6 +2492,7 @@ type ResourceClaimTemplate struct {
 	// This field is immutable. A ResourceClaim will get created by the
 	// control plane for a Pod when needed and then not get updated
 	// anymore.
+	// +optional
 	Spec ResourceClaimTemplateSpec `json:"spec" protobuf:"bytes,2,name=spec"`
 }
 
@@ -2182,11 +2502,13 @@ type ResourceClaimTemplateSpec struct {
 	// when creating it. No other fields are allowed and will be rejected during
 	// validation.
 	// +optional
+	// +k8s:opaqueType
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// Spec for the ResourceClaim. The entire content is copied unchanged
 	// into the ResourceClaim that gets created from this template. The
 	// same fields as in a ResourceClaim are also valid here.
+	// +optional
 	Spec ResourceClaimSpec `json:"spec" protobuf:"bytes,2,name=spec"`
 }
 
@@ -2195,7 +2517,7 @@ type ResourceClaimTemplateSpec struct {
 
 // ResourceClaimTemplateList is a collection of claim templates.
 type ResourceClaimTemplateList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -2257,8 +2579,8 @@ type AllocatedDeviceStatus struct {
 	//
 	// +optional
 	// +featureGate=DRAConsumableCapacity
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:format=k8s-uuid
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:format=k8s-uuid
 	ShareID *string `json:"shareID,omitempty" protobuf:"bytes,7,opt,name=shareID"`
 
 	// Conditions contains the latest observation of the device's state.
@@ -2270,6 +2592,9 @@ type AllocatedDeviceStatus struct {
 	// +optional
 	// +listType=map
 	// +listMapKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 	Conditions []metav1.Condition `json:"conditions" protobuf:"bytes,4,opt,name=conditions"`
 
 	// Data contains arbitrary driver-specific data.
@@ -2282,7 +2607,7 @@ type AllocatedDeviceStatus struct {
 	// NetworkData contains network-related information specific to the device.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	NetworkData *NetworkDeviceData `json:"networkData,omitempty" protobuf:"bytes,6,opt,name=networkData"`
 }
 
@@ -2297,8 +2622,8 @@ type NetworkDeviceData struct {
 	// Must not be longer than 256 bytes.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxBytes=256
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxBytes=256
 	InterfaceName string `json:"interfaceName,omitempty" protobuf:"bytes,1,opt,name=interfaceName"`
 
 	// IPs lists the network addresses assigned to the device's network interface.
@@ -2309,10 +2634,10 @@ type NetworkDeviceData struct {
 	//
 	// +optional
 	// +listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	// +k8s:listType=atomic
-	// +k8s:alpha(since: "1.36")=+k8s:unique=set
-	// +k8s:alpha(since: "1.36")=+k8s:maxItems=16
+	// +k8s:beta(since: "1.37")=+k8s:unique=set
+	// +k8s:beta(since: "1.37")=+k8s:maxItems=16
 	IPs []string `json:"ips,omitempty" protobuf:"bytes,2,opt,name=ips"`
 
 	// HardwareAddress represents the hardware address (e.g. MAC Address) of the device's network interface.
@@ -2320,7 +2645,7 @@ type NetworkDeviceData struct {
 	// Must not be longer than 128 bytes.
 	//
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:optional
-	// +k8s:alpha(since: "1.36")=+k8s:maxBytes=128
+	// +k8s:beta(since: "1.37")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:maxBytes=128
 	HardwareAddress string `json:"hardwareAddress,omitempty" protobuf:"bytes,3,opt,name=hardwareAddress"`
 }
diff --git a/vendor/k8s.io/api/resource/v1beta2/types_swagger_doc_generated.go b/vendor/k8s.io/api/resource/v1beta2/types_swagger_doc_generated.go
index 122170ec25..3f0c9176b4 100644
--- a/vendor/k8s.io/api/resource/v1beta2/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/resource/v1beta2/types_swagger_doc_generated.go
@@ -55,7 +55,7 @@ func (AllocationResult) SwaggerDoc() map[string]string {
 
 var map_CELDeviceSelector = map[string]string{
 	"":           "CELDeviceSelector contains a CEL expression for selecting a device.",
-	"expression": "Expression is a CEL expression which evaluates a single device. It must evaluate to true when the device under consideration satisfies the desired criteria, and false when it does not. Any other result is an error and causes allocation of devices to abort.\n\nThe expression's input is an object named \"device\", which carries the following properties:\n - driver (string): the name of the driver which defines this device.\n - attributes (map[string]object): the device's attributes, grouped by prefix\n   (e.g. device.attributes[\"dra.example.com\"] evaluates to an object with all\n   of the attributes which were prefixed by \"dra.example.com\".\n - capacity (map[string]object): the device's capacities, grouped by prefix.\n - allowMultipleAllocations (bool): the allowMultipleAllocations property of the device\n   (v1.34+ with the DRAConsumableCapacity feature enabled).\n\nExample: Consider a device with driver=\"dra.example.com\", which exposes two attributes named \"model\" and \"ext.example.com/family\" and which exposes one capacity named \"modules\". This input to this expression would have the following fields:\n\n    device.driver\n    device.attributes[\"dra.example.com\"].model\n    device.attributes[\"ext.example.com\"].family\n    device.capacity[\"dra.example.com\"].modules\n\nThe device.driver field can be used to check for a specific driver, either as a high-level precondition (i.e. you only want to consider devices from this driver) or as part of a multi-clause expression that is meant to consider devices from different drivers.\n\nThe value type of each attribute is defined by the device definition, and users who write these expressions must consult the documentation for their specific drivers. The value type of each capacity is Quantity.\n\nIf an unknown prefix is used as a lookup in either device.attributes or device.capacity, an empty map will be returned. Any reference to an unknown field will cause an evaluation error and allocation to abort.\n\nA robust expression should check for the existence of attributes before referencing them.\n\nFor ease of use, the cel.bind() function is enabled, and can be used to simplify expressions that access multiple attributes with the same domain. For example:\n\n    cel.bind(dra, device.attributes[\"dra.example.com\"], dra.someBool && dra.anotherBool)\n\nWhen the DRAListTypeAttributes feature gate is enabled, the includes() helper is available and it can work for both scalar and list-type attributes. It was introduced to support smooth migration from scalar attributes to list-type attributes while keeping CEL expressions simple. For example:\n\n    device.attributes[\"dra.example.com\"].models.includes(\"some-model\")\n\nThe length of the expression must be smaller or equal to 10 Ki. The cost of evaluating it is also limited based on the estimated number of logical steps.",
+	"expression": "Expression is a CEL expression which evaluates a single device. It must evaluate to true when the device under consideration satisfies the desired criteria, and false when it does not. Any other result is an error and causes allocation of devices to abort.\n\nThe expression's input is an object named \"device\", which carries the following properties:\n - driver (string): the name of the driver which defines this device.\n - attributes (map[string]object): the device's attributes, grouped by prefix\n   (e.g. device.attributes[\"dra.example.com\"] evaluates to an object with all\n   of the attributes which were prefixed by \"dra.example.com\").\n - capacity (map[string]object): the device's capacities, grouped by prefix.\n - allowMultipleAllocations (bool): the allowMultipleAllocations property of the device\n   (v1.34+ with the DRAConsumableCapacity feature enabled).\n\nExample: Consider a device with driver=\"dra.example.com\", which exposes two attributes named \"model\" and \"ext.example.com/family\" and which exposes one capacity named \"modules\". This input to this expression would have the following fields:\n\n    device.driver\n    device.attributes[\"dra.example.com\"].model\n    device.attributes[\"ext.example.com\"].family\n    device.capacity[\"dra.example.com\"].modules\n\nThe device.driver field can be used to check for a specific driver, either as a high-level precondition (i.e. you only want to consider devices from this driver) or as part of a multi-clause expression that is meant to consider devices from different drivers.\n\nThe value type of each attribute is defined by the device definition, and users who write these expressions must consult the documentation for their specific drivers. The value type of each capacity is Quantity.\n\nIf an unknown prefix is used as a lookup in either device.attributes or device.capacity, an empty map will be returned. Any reference to an unknown field will cause an evaluation error and allocation to abort.\n\nA robust expression should check for the existence of attributes before referencing them.\n\nCommon errors: - \"no such key\": Use optional chaining (.? followed by orValue())\n  or guarding the check with has() for optional fields.\n  See CEL Optional Types for details:\n  https://pkg.go.dev/github.com/google/cel-go@v0.17.4/cel#OptionalTypes\n\nFor more CEL expression syntax and examples, see: https://kubernetes.io/docs/reference/using-api/cel/\n\nFor ease of use, the cel.bind() function is enabled, and can be used to simplify expressions that access multiple attributes with the same domain. For example:\n\n    cel.bind(dra, device.attributes[\"dra.example.com\"], dra.someBool && dra.anotherBool)\n\nWhen the DRAListTypeAttributes feature gate is enabled, the includes() helper is available and it can work for both scalar and list-type attributes. It was introduced to support smooth migration from scalar attributes to list-type attributes while keeping CEL expressions simple. For example:\n\n    device.attributes[\"dra.example.com\"].models.includes(\"some-model\")\n\nThe length of the expression must be smaller or equal to 10 Ki. The cost of evaluating it is also limited based on the estimated number of logical steps.",
 }
 
 func (CELDeviceSelector) SwaggerDoc() map[string]string {
@@ -74,7 +74,7 @@ func (CapacityRequestPolicy) SwaggerDoc() map[string]string {
 }
 
 var map_CapacityRequestPolicyRange = map[string]string{
-	"":     "CapacityRequestPolicyRange defines a valid range for consumable capacity values.\n\n  - If the requested amount is less than Min, it is rounded up to the Min value.\n  - If Step is set and the requested amount is between Min and Max but not aligned with Step,\n    it will be rounded up to the next value equal to Min + (n * Step).\n  - If Step is not set, the requested amount is used as-is if it falls within the range Min to Max (if set).\n  - If the requested or rounded amount exceeds Max (if set), the request does not satisfy the policy,\n    and the device cannot be allocated.",
+	"":     "CapacityRequestPolicyRange defines a valid range for consumable capacity values.\n\nIf the DRAFractionalCapacityRange feature gate is enabled and at least one of Min, Max, or Step is a fractional quantity (i.e. its value is not an integer), milli-unit arithmetic is used instead, supporting values with up to 3 decimal places (e.g. 100m = 0.1). The largest supported value then is 1000 times smaller compared to using 64-bit integers. Otherwise, all comparisons use 64-bit integer arithmetic via resource.Quantity.Value().\n\n  - If the requested amount is less than Min, it is rounded up to the Min value.\n  - If Step is set and the requested amount is between Min and Max but not aligned with Step,\n    it will be rounded up to the next value equal to Min + (n * Step).\n  - If Step is not set, the requested amount is used as-is if it falls within the range Min to Max (if set).\n  - If the requested or rounded amount exceeds Max (if set), the request does not satisfy the policy,\n    and the device cannot be allocated.",
 	"min":  "Min specifies the minimum capacity allowed for a consumption request.\n\nMin must be greater than or equal to zero, and less than or equal to the capacity value. requestPolicy.default must be more than or equal to the minimum.",
 	"max":  "Max defines the upper limit for capacity that can be requested.\n\nMax must be less than or equal to the capacity value. Min and requestPolicy.default must be less than or equal to the maximum.",
 	"step": "Step defines the step size between valid capacity amounts within the range.\n\nMax (if set) and requestPolicy.default must be a multiple of Step. Min + Step must be less than or equal to the capacity value.",
@@ -113,20 +113,20 @@ func (CounterSet) SwaggerDoc() map[string]string {
 }
 
 var map_Device = map[string]string{
-	"":                                "Device represents one individual hardware instance that can be selected based on its attributes. Besides the name, exactly one field must be set.",
-	"name":                            "Name is unique identifier among all devices managed by the driver in the pool. It must be a DNS label.",
-	"attributes":                      "Attributes defines the set of attributes for this device. The name of each attribute must be unique in that set.\n\nThe maximum number of attributes and capacities combined is 32.",
-	"capacity":                        "Capacity defines the set of capacities for this device. The name of each capacity must be unique in that set.\n\nThe maximum number of attributes and capacities combined is 32.",
-	"consumesCounters":                "ConsumesCounters defines a list of references to sharedCounters and the set of counters that the device will consume from those counter sets.\n\nThere can only be a single entry per counterSet.\n\nThe maximum number of device counter consumptions per device is 2.",
-	"nodeName":                        "NodeName identifies the node where the device is available.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
-	"nodeSelector":                    "NodeSelector defines the nodes where the device is available.\n\nMust use exactly one term.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
-	"allNodes":                        "AllNodes indicates that all nodes have access to the device.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
-	"taints":                          "If specified, these are the driver-defined taints.\n\nThe maximum number of taints is 16. If taints are set for any device in a ResourceSlice, then the maximum number of allowed devices per ResourceSlice is 64 instead of 128.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
-	"bindsToNode":                     "BindsToNode indicates if the usage of an allocation involving this device has to be limited to exactly the node that was chosen when allocating the claim. If set to true, the scheduler will set the ResourceClaim.Status.Allocation.NodeSelector to match the node where the allocation was made.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
-	"bindingConditions":               "BindingConditions defines the conditions for proceeding with binding. All of these conditions must be set in the per-device status conditions with a value of True to proceed with binding the pod to the node while scheduling the pod.\n\nThe maximum number of binding conditions is 4.\n\nThe conditions must be a valid condition type string.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
-	"bindingFailureConditions":        "BindingFailureConditions defines the conditions for binding failure. They may be set in the per-device status conditions. If any is set to \"True\", a binding failure occurred.\n\nThe maximum number of binding failure conditions is 4.\n\nThe conditions must be a valid condition type string.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
-	"allowMultipleAllocations":        "AllowMultipleAllocations marks whether the device is allowed to be allocated to multiple DeviceRequests.\n\nIf AllowMultipleAllocations is set to true, the device can be allocated more than once, and all of its capacity is consumable, regardless of whether the requestPolicy is defined or not.",
-	"nodeAllocatableResourceMappings": "NodeAllocatableResourceMappings defines the mapping of node resources that are managed by the DRA driver exposing this device. This includes resources currently reported in v1.Node `status.allocatable` that are not extended resources (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources). Examples include \"cpu\", \"memory\", \"ephemeral-storage\", and hugepages. In addition to standard requests made through the Pod `spec`, these resources can also be requested through claims and allocated by the DRA driver. For example, a CPU DRA driver might allocate exclusive CPUs or auxiliary node memory dependencies of an accelerator device. The keys of this map are the node-allocatable resource names (e.g., \"cpu\", \"memory\"). Extended resource names are not permitted as keys.",
+	"":                         "Device represents one individual hardware instance that can be selected based on its attributes. Besides the name, exactly one field must be set.",
+	"name":                     "Name is unique identifier among all devices managed by the driver in the pool. It must be a DNS label.",
+	"attributes":               "Attributes defines the set of attributes for this device. The name of each attribute must be unique in that set.\n\nThe maximum number of attributes and capacities combined is 32.",
+	"capacity":                 "Capacity defines the set of capacities for this device. The name of each capacity must be unique in that set.\n\nThe maximum number of attributes and capacities combined is 32.",
+	"consumesCounters":         "ConsumesCounters defines a list of references to sharedCounters and the set of counters that the device will consume from those counter sets.\n\nThere can only be a single entry per counterSet.\n\nThe maximum number of device counter consumptions per device is 2.",
+	"nodeName":                 "NodeName identifies the node where the device is available.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
+	"nodeSelector":             "NodeSelector defines the nodes where the device is available.\n\nMust use exactly one term.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
+	"allNodes":                 "AllNodes indicates that all nodes have access to the device.\n\nMust only be set if Spec.PerDeviceNodeSelection is set to true. At most one of NodeName, NodeSelector and AllNodes can be set.",
+	"taints":                   "If specified, these are the driver-defined taints.\n\nThe maximum number of taints is 16. If taints are set for any device in a ResourceSlice, then the maximum number of allowed devices per ResourceSlice is 64 instead of 128.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
+	"bindsToNode":              "BindsToNode indicates if the usage of an allocation involving this device has to be limited to exactly the node that was chosen when allocating the claim. If set to true, the scheduler will set the ResourceClaim.Status.Allocation.NodeSelector to match the node where the allocation was made.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
+	"bindingConditions":        "BindingConditions defines the conditions for proceeding with binding. All of these conditions must be set in the per-device status conditions with a value of True to proceed with binding the pod to the node while scheduling the pod.\n\nThe maximum number of binding conditions is 4.\n\nThe conditions must be a valid condition type string.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
+	"bindingFailureConditions": "BindingFailureConditions defines the conditions for binding failure. They may be set in the per-device status conditions. If any is set to \"True\", a binding failure occurred.\n\nThe maximum number of binding failure conditions is 4.\n\nThe conditions must be a valid condition type string.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
+	"allowMultipleAllocations": "AllowMultipleAllocations marks whether the device is allowed to be allocated to multiple DeviceRequests.\n\nIf AllowMultipleAllocations is set to true, the device can be allocated more than once, and all of its capacity is consumable, regardless of whether the requestPolicy is defined or not.",
+	"nodeAllocatableResources": "NodeAllocatableResources defines the mapping of node resources that are managed by the DRA driver exposing this device. This includes resources currently reported in v1.Node `status.allocatable` that are not extended resources (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources). Examples include \"cpu\", \"memory\", \"ephemeral-storage\", and hugepages. In addition to standard requests made through the Pod `spec`, these resources can also be requested through claims and allocated by the DRA driver. For example, a CPU DRA driver might allocate exclusive CPUs or auxiliary node memory dependencies of an accelerator device. The keys of this map are the node-allocatable resource names (e.g., \"cpu\", \"memory\"). Extended resource names are not permitted as keys.",
 }
 
 func (Device) SwaggerDoc() map[string]string {
@@ -231,7 +231,7 @@ var map_DeviceClassSpec = map[string]string{
 	"":                     "DeviceClassSpec is used in a [DeviceClass] to define what can be allocated and how to configure it.",
 	"selectors":            "Each selector must be satisfied by a device which is claimed via this class.",
 	"config":               "Config defines configuration parameters that apply to each device that is claimed via this class. Some classses may potentially be satisfied by multiple drivers, so each instance of a vendor configuration applies to exactly one driver.\n\nThey are passed to the driver, but are not considered while allocating the claim.",
-	"extendedResourceName": "ExtendedResourceName is the extended resource name for the devices of this class. The devices of this class can be used to satisfy a pod's extended resource requests. It has the same format as the name of a pod's extended resource. It should be unique among all the device classes in a cluster. If two device classes have the same name, then the class created later is picked to satisfy a pod's extended resource requests. If two classes are created at the same time, then the name of the class lexicographically sorted first is picked.\n\nThis is a beta field.",
+	"extendedResourceName": "ExtendedResourceName is the extended resource name for the devices of this class. The devices of this class can be used to satisfy a pod's extended resource requests. It has the same format as the name of a pod's extended resource. It should be unique among all the device classes in a cluster. If two device classes have the same name, then the class created later is picked to satisfy a pod's extended resource requests. If two classes are created at the same time, then the name of the class lexicographically sorted first is picked.",
 }
 
 func (DeviceClassSpec) SwaggerDoc() map[string]string {
@@ -259,15 +259,26 @@ func (DeviceConstraint) SwaggerDoc() map[string]string {
 }
 
 var map_DeviceCounterConsumption = map[string]string{
-	"":           "DeviceCounterConsumption defines a set of counters that a device will consume from a CounterSet.",
-	"counterSet": "CounterSet is the name of the set from which the counters defined will be consumed.",
-	"counters":   "Counters defines the counters that will be consumed by the device.\n\nThe maximum number of counters is 32.",
+	"":                    "DeviceCounterConsumption defines a set of counters that a device will consume from a CounterSet.",
+	"counterSet":          "CounterSet is the name of the set from which the counters defined will be consumed.",
+	"counters":            "Counters defines the counters that will be consumed by the device.\n\nThe maximum number of counters is 32.",
+	"compatibilityGroups": "CompatibilityGroups is a list of opaque group names for this counter set consumption.\n\nDevices that consume counters from the same counter set may only be allocated at the same time (\"co-allocated\") if they all share at least one common group: the intersection of the CompatibilityGroups of all co-allocated devices on that counter set must be non-empty. Devices that consume from different counter sets are never compared via this field.\n\nAn unset field, an explicit nil, and an empty list are equivalent and mean \"no groups\": such a device is only co-allocatable with sibling devices on the same counter set that also have no groups, and is never co-allocatable with a device that declares one or more groups.\n\nGroup names are opaque and meaningful only within the publishing driver's pool.\n\nThe maximum number of groups is 2, and the names must be unique.",
 }
 
 func (DeviceCounterConsumption) SwaggerDoc() map[string]string {
 	return map_DeviceCounterConsumption
 }
 
+var map_DeviceDerivedAttribute = map[string]string{
+	"":           "DeviceDerivedAttribute defines a derived attribute computed via CEL.",
+	"name":       "Name is the identifier for this derived attribute, used in constraints.\n\nIt must be a DNS subdomain followed by a slash (\"/\") followed by a C identifier (e.g. \"example.com/numaNode\" or \"derived/numaNode\").\n\nIf the chosen name matches an existing physical attribute from a driver, the derived attribute's expression will shadow the physical attribute, and its evaluated value will be used in constraints instead. When the goal is to define a derived attribute that is only used within the ResourceClaim and not meant to shadow an existing attribute, use a domain prefix that no DRA driver should be using (e.g. \"derived/myAttribute\").\n\nIt is not valid to define a derived attribute that isn't used in at least one constraint.",
+	"expression": "Expression is a CEL expression evaluated against each candidate device. The expression must evaluate to a primitive scalar (string, integer, boolean, or semver) or a list of these scalars ([]string, []int64, []bool, []semver) to act as a virtual grouping key. Any other return type is an error and causes CEL evaluation for the device to fail.\n\nThe expression's input is an object named \"device\", which carries the same properties as in a CELDeviceSelector.\n\nWhen pod scheduling encounters CEL runtime errors (such as looking up an attribute that isn't defined) for some devices, it will abort allocation and fail scheduling for the Pod. Surfacing evaluation errors immediately prevents silent topology matching failures that are extremely hard to detect. A robust expression should, for example, check for the existence of attributes before referencing them to avoid runtime evaluation errors.\n\nThe expression gets evaluated after a device has passed the other selector expressions for the request in which this expression is used. This allows writing expressions that are tailored towards the specific devices being requested (for example, by assuming the device is from a certain vendor and skipping those checks).\n\nThe length of the expression must be smaller or equal to 10 Ki. The cost of evaluating it is also limited based on the estimated number of logical steps; the combined cost of all derived attributes in a claim is capped by a shared CEL cost budget.",
+}
+
+func (DeviceDerivedAttribute) SwaggerDoc() map[string]string {
+	return map_DeviceDerivedAttribute
+}
+
 var map_DeviceRequest = map[string]string{
 	"":               "DeviceRequest is a request for devices required for a claim. This is typically a request for a single resource like a device, but can also ask for several identical devices. With FirstAvailable it is also possible to provide a prioritized list of requests.",
 	"name":           "Name can be used to reference this request in a pod.spec.containers[].resources.claims entry and in a constraint of the claim.\n\nReferences using the name in the DeviceRequest will uniquely identify a request when the Exactly field is set. When the FirstAvailable field is set, a reference to the name of the DeviceRequest will match whatever subrequest is chosen by the scheduler.\n\nMust be a DNS label.",
@@ -291,6 +302,7 @@ var map_DeviceRequestAllocationResult = map[string]string{
 	"bindingFailureConditions": "BindingFailureConditions contains a copy of the BindingFailureConditions from the corresponding ResourceSlice at the time of allocation.\n\nThis is a beta field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus feature gates.",
 	"shareID":                  "ShareID uniquely identifies an individual allocation share of the device, used when the device supports multiple simultaneous allocations. It serves as an additional map key to differentiate concurrent shares of the same device.",
 	"consumedCapacity":         "ConsumedCapacity tracks the amount of capacity consumed per device as part of the claim request. The consumed amount may differ from the requested amount: it is rounded up to the nearest valid value based on the device’s requestPolicy if applicable (i.e., may not be less than the requested amount).\n\nThe total consumed capacity for each device must not exceed the DeviceCapacity's Value.\n\nThis field is populated only for devices that allow multiple allocations. All capacity entries are included, even if the consumed amount is zero.",
+	"skipNodeOperations":       "SkipNodeOperations lists node-local resource operations (gRPC calls) that will be skipped for this allocated device when determining whether operations are necessary on the node. If all allocated devices for a driver in a claim skip an operation, that gRPC call will be skipped. It is a copy of the ResourceSlice.spec.skipNodeOperations value at the time when the device was allocated.",
 }
 
 func (DeviceRequestAllocationResult) SwaggerDoc() map[string]string {
@@ -307,14 +319,15 @@ func (DeviceSelector) SwaggerDoc() map[string]string {
 }
 
 var map_DeviceSubRequest = map[string]string{
-	"":                "DeviceSubRequest describes a request for device provided in the claim.spec.devices.requests[].firstAvailable array. Each is typically a request for a single resource like a device, but can also ask for several identical devices.\n\nDeviceSubRequest is similar to ExactDeviceRequest, but doesn't expose the AdminAccess field as that one is only supported when requesting a specific device.",
-	"name":            "Name can be used to reference this subrequest in the list of constraints or the list of configurations for the claim. References must use the format <main request>/<subrequest>.\n\nMust be a DNS label.",
-	"deviceClassName": "DeviceClassName references a specific DeviceClass, which can define additional configuration and selectors to be inherited by this subrequest.\n\nA class is required. Which classes are available depends on the cluster.\n\nAdministrators may use this to restrict which devices may get requested by only installing classes with selectors for permitted devices. If users are free to request anything without restrictions, then administrators can create an empty DeviceClass for users to reference.",
-	"selectors":       "Selectors define criteria which must be satisfied by a specific device in order for that device to be considered for this subrequest. All selectors must be satisfied for a device to be considered.",
-	"allocationMode":  "AllocationMode and its related fields define how devices are allocated to satisfy this subrequest. Supported values are:\n\n- ExactCount: This request is for a specific number of devices.\n  This is the default. The exact number is provided in the\n  count field.\n\n- All: This subrequest is for all of the matching devices in a pool.\n  Allocation will fail if some devices are already allocated,\n  unless adminAccess is requested.\n\nIf AllocationMode is not specified, the default mode is ExactCount. If the mode is ExactCount and count is not specified, the default count is one. Any other subrequests must specify this field.\n\nMore modes may get added in the future. Clients must refuse to handle requests with unknown modes.",
-	"count":           "Count is used only when the count mode is \"ExactCount\". Must be greater than zero. If AllocationMode is ExactCount and this field is not specified, the default is one.",
-	"tolerations":     "If specified, the request's tolerations.\n\nTolerations for NoSchedule are required to allocate a device which has a taint with that effect. The same applies to NoExecute.\n\nIn addition, should any of the allocated devices get tainted with NoExecute after allocation and that effect is not tolerated, then all pods consuming the ResourceClaim get deleted to evict them. The scheduler will not let new pods reserve the claim while it has these tainted devices. Once all pods are evicted, the claim will get deallocated.\n\nThe maximum number of tolerations is 16.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
-	"capacity":        "Capacity define resource requirements against each capacity.\n\nIf this field is unset and the device supports multiple allocations, the default value will be applied to each capacity according to requestPolicy. For the capacity that has no requestPolicy, default is the full capacity value.\n\nApplies to each device allocation. If Count > 1, the request fails if there aren't enough devices that meet the requirements. If AllocationMode is set to All, the request fails if there are devices that otherwise match the request, and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.",
+	"":                  "DeviceSubRequest describes a request for device provided in the claim.spec.devices.requests[].firstAvailable array. Each is typically a request for a single resource like a device, but can also ask for several identical devices.\n\nDeviceSubRequest is similar to ExactDeviceRequest, but doesn't expose the AdminAccess field as that one is only supported when requesting a specific device.",
+	"name":              "Name can be used to reference this subrequest in the list of constraints or the list of configurations for the claim. References must use the format <main request>/<subrequest>.\n\nMust be a DNS label.",
+	"deviceClassName":   "DeviceClassName references a specific DeviceClass, which can define additional configuration and selectors to be inherited by this subrequest.\n\nA class is required. Which classes are available depends on the cluster.\n\nAdministrators may use this to restrict which devices may get requested by only installing classes with selectors for permitted devices. If users are free to request anything without restrictions, then administrators can create an empty DeviceClass for users to reference.",
+	"selectors":         "Selectors define criteria which must be satisfied by a specific device in order for that device to be considered for this subrequest. All selectors must be satisfied for a device to be considered.",
+	"allocationMode":    "AllocationMode and its related fields define how devices are allocated to satisfy this subrequest. Supported values are:\n\n- ExactCount: This request is for a specific number of devices.\n  This is the default. The exact number is provided in the\n  count field.\n\n- All: This subrequest is for all of the matching devices in a pool.\n  Allocation will fail if some devices are already allocated,\n  unless adminAccess is requested.\n\nIf AllocationMode is not specified, the default mode is ExactCount. If the mode is ExactCount and count is not specified, the default count is one. Any other subrequests must specify this field.\n\nMore modes may get added in the future. Clients must refuse to handle requests with unknown modes.",
+	"count":             "Count is used only when the count mode is \"ExactCount\". Must be greater than zero. If AllocationMode is ExactCount and this field is not specified, the default is one.",
+	"tolerations":       "If specified, the request's tolerations.\n\nTolerations for NoSchedule are required to allocate a device which has a taint with that effect. The same applies to NoExecute.\n\nIn addition, should any of the allocated devices get tainted with NoExecute after allocation and that effect is not tolerated, then all pods consuming the ResourceClaim get deleted to evict them. The scheduler will not let new pods reserve the claim while it has these tainted devices. Once all pods are evicted, the claim will get deallocated.\n\nThe maximum number of tolerations is 16.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
+	"capacity":          "Capacity define resource requirements against each capacity.\n\nIf this field is unset and the device supports multiple allocations, the default value will be applied to each capacity according to requestPolicy. For the capacity that has no requestPolicy, default is the full capacity value.\n\nApplies to each device allocation. If Count > 1, the request fails if there aren't enough devices that meet the requirements. If AllocationMode is set to All, the request fails if there are devices that otherwise match the request, and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.",
+	"derivedAttributes": "DerivedAttributes defines a set of virtual attributes computed via CEL expressions for each candidate device. These virtual attributes can be referenced in `.devices.constraints` to align and match different devices (e.g., co-allocating a GPU and a NIC on the same NUMA node) even if their drivers publish different attributes. Derived attributes are not available via `device.attributes` in the CEL environment when evaluating selector expressions.\n\nDerived attributes allow you to extract, transform, or normalize topology information (such as extracting a NUMA index from a complex topology string or renaming a vendor-specific attribute) into a common virtual attribute name at scheduling time. The scheduler then evaluates these virtual attributes exactly like static attributes when matching constraints.\n\nEvery derived attribute defined in this list must be referenced by at least one MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.\n\nThe maximum number of derived attributes is 32.\n\nThis is an alpha field and requires enabling the DRADerivedAttributes feature gate.",
 }
 
 func (DeviceSubRequest) SwaggerDoc() map[string]string {
@@ -398,14 +411,15 @@ func (DeviceToleration) SwaggerDoc() map[string]string {
 }
 
 var map_ExactDeviceRequest = map[string]string{
-	"":                "ExactDeviceRequest is a request for one or more identical devices.",
-	"deviceClassName": "DeviceClassName references a specific DeviceClass, which can define additional configuration and selectors to be inherited by this request.\n\nA DeviceClassName is required.\n\nAdministrators may use this to restrict which devices may get requested by only installing classes with selectors for permitted devices. If users are free to request anything without restrictions, then administrators can create an empty DeviceClass for users to reference.",
-	"selectors":       "Selectors define criteria which must be satisfied by a specific device in order for that device to be considered for this request. All selectors must be satisfied for a device to be considered.",
-	"allocationMode":  "AllocationMode and its related fields define how devices are allocated to satisfy this request. Supported values are:\n\n- ExactCount: This request is for a specific number of devices.\n  This is the default. The exact number is provided in the\n  count field.\n\n- All: This request is for all of the matching devices in a pool.\n  At least one device must exist on the node for the allocation to succeed.\n  Allocation will fail if some devices are already allocated,\n  unless adminAccess is requested.\n\nIf AllocationMode is not specified, the default mode is ExactCount. If the mode is ExactCount and count is not specified, the default count is one. Any other requests must specify this field.\n\nMore modes may get added in the future. Clients must refuse to handle requests with unknown modes.",
-	"count":           "Count is used only when the count mode is \"ExactCount\". Must be greater than zero. If AllocationMode is ExactCount and this field is not specified, the default is one.",
-	"adminAccess":     "AdminAccess indicates that this is a claim for administrative access to the device(s). Claims with AdminAccess are expected to be used for monitoring or other management services for a device.  They ignore all ordinary claims to the device with respect to access modes and any resource allocations.\n\nThis is an alpha field and requires enabling the DRAAdminAccess feature gate. Admin access is disabled if this field is unset or set to false, otherwise it is enabled.",
-	"tolerations":     "If specified, the request's tolerations.\n\nTolerations for NoSchedule are required to allocate a device which has a taint with that effect. The same applies to NoExecute.\n\nIn addition, should any of the allocated devices get tainted with NoExecute after allocation and that effect is not tolerated, then all pods consuming the ResourceClaim get deleted to evict them. The scheduler will not let new pods reserve the claim while it has these tainted devices. Once all pods are evicted, the claim will get deallocated.\n\nThe maximum number of tolerations is 16.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
-	"capacity":        "Capacity define resource requirements against each capacity.\n\nIf this field is unset and the device supports multiple allocations, the default value will be applied to each capacity according to requestPolicy. For the capacity that has no requestPolicy, default is the full capacity value.\n\nApplies to each device allocation. If Count > 1, the request fails if there aren't enough devices that meet the requirements. If AllocationMode is set to All, the request fails if there are devices that otherwise match the request, and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.",
+	"":                  "ExactDeviceRequest is a request for one or more identical devices.",
+	"deviceClassName":   "DeviceClassName references a specific DeviceClass, which can define additional configuration and selectors to be inherited by this request.\n\nA DeviceClassName is required.\n\nAdministrators may use this to restrict which devices may get requested by only installing classes with selectors for permitted devices. If users are free to request anything without restrictions, then administrators can create an empty DeviceClass for users to reference.",
+	"selectors":         "Selectors define criteria which must be satisfied by a specific device in order for that device to be considered for this request. All selectors must be satisfied for a device to be considered.",
+	"allocationMode":    "AllocationMode and its related fields define how devices are allocated to satisfy this request. Supported values are:\n\n- ExactCount: This request is for a specific number of devices.\n  This is the default. The exact number is provided in the\n  count field.\n\n- All: This request is for all of the matching devices in a pool.\n  At least one device must exist on the node for the allocation to succeed.\n  Allocation will fail if some devices are already allocated,\n  unless adminAccess is requested.\n\nIf AllocationMode is not specified, the default mode is ExactCount. If the mode is ExactCount and count is not specified, the default count is one. Any other requests must specify this field.\n\nMore modes may get added in the future. Clients must refuse to handle requests with unknown modes.",
+	"count":             "Count is used only when the count mode is \"ExactCount\". Must be greater than zero. If AllocationMode is ExactCount and this field is not specified, the default is one.",
+	"adminAccess":       "AdminAccess indicates that this is a claim for administrative access to the device(s). Claims with AdminAccess are expected to be used for monitoring or other management services for a device.  They ignore all ordinary claims to the device with respect to access modes and any resource allocations.\n\nThis is an alpha field and requires enabling the DRAAdminAccess feature gate. Admin access is disabled if this field is unset or set to false, otherwise it is enabled.",
+	"tolerations":       "If specified, the request's tolerations.\n\nTolerations for NoSchedule are required to allocate a device which has a taint with that effect. The same applies to NoExecute.\n\nIn addition, should any of the allocated devices get tainted with NoExecute after allocation and that effect is not tolerated, then all pods consuming the ResourceClaim get deleted to evict them. The scheduler will not let new pods reserve the claim while it has these tainted devices. Once all pods are evicted, the claim will get deallocated.\n\nThe maximum number of tolerations is 16.\n\nThis is a beta field and requires enabling the DRADeviceTaints feature gate.",
+	"capacity":          "Capacity define resource requirements against each capacity.\n\nIf this field is unset and the device supports multiple allocations, the default value will be applied to each capacity according to requestPolicy. For the capacity that has no requestPolicy, default is the full capacity value.\n\nApplies to each device allocation. If Count > 1, the request fails if there aren't enough devices that meet the requirements. If AllocationMode is set to All, the request fails if there are devices that otherwise match the request, and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.",
+	"derivedAttributes": "DerivedAttributes defines a set of virtual attributes computed via CEL expressions for each candidate device. These virtual attributes can be referenced in `.devices.constraints` to align and match different devices (e.g., co-allocating a GPU and a NIC on the same NUMA node) even if their drivers publish different attributes. Derived attributes are not available via `device.attributes` in the CEL environment when evaluating selector expressions.\n\nDerived attributes allow you to extract, transform, or normalize topology information (such as extracting a NUMA index from a complex topology string or renaming a vendor-specific attribute) into a common virtual attribute name at scheduling time. The scheduler then evaluates these virtual attributes exactly like static attributes when matching constraints.\n\nEvery derived attribute defined in this list must be referenced by at least one MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.\n\nThe maximum number of derived attributes is 32.\n\nThis is an alpha field and requires enabling the DRADerivedAttributes feature gate.",
 }
 
 func (ExactDeviceRequest) SwaggerDoc() map[string]string {
@@ -423,14 +437,35 @@ func (NetworkDeviceData) SwaggerDoc() map[string]string {
 	return map_NetworkDeviceData
 }
 
-var map_NodeAllocatableResourceMapping = map[string]string{
-	"":                     "NodeAllocatableResourceMapping defines the translation between the DRA device/capacity units requested to the corresponding quantity of the node allocatable resource.",
-	"capacityKey":          "CapacityKey references a capacity name defined as a key in the `spec.devices[*].capacity` map. When this field is set, the value associated with this key in the `status.allocation.devices.results[*].consumedCapacity` map (for a specific claim allocation) determines the base quantity for the node allocatable resource. If `allocationMultiplier` is also set, it is multiplied with the base quantity. For example, if `spec.devices[*].capacity` has an entry \"dra.example.com/memory\": \"128Gi\", and this field is set to \"dra.example.com/memory\", then for a claim allocation that consumes { \"dra.example.com/memory\": \"4Gi\" } the base quantity for the node allocatable resource mapping will be \"4Gi\", and `allocationMultiplier` should be omitted or set to \"1\".",
-	"allocationMultiplier": "AllocationMultiplier is used as a multiplier for the allocated device count or the allocated capacity in the claim. It defaults to 1 if not specified. How the field is used also depends on whether `capacityKey` is set. 1.  If `capacityKey` is NOT set: `allocationMultiplier` multiplies the device count allocated to the claim.\n\t   a. A DRA driver representing each CPU core as a device would have\n       {ResourceName: \"cpu\", allocationMultiplier: \"2\"} in its\n       `nodeAllocatableResourceMappings`. If 4 devices are allocated to the claim,\n\t\t  4 * 2 CPUs would be considered as allocated and subtracted from the node's capacity.\n    b. A GPU device that needs additional node memory per GPU allocation would\n       have {ResourceName: \"memory\", allocationMultiplier: \"2Gi\"}.  Each allocated\n\t\t  GPU device instance of this type will account for 2Gi of memory.\n\n2.  If `capacityKey` IS set: `allocationMultiplier` is multiplied by the amount of that capacity consumed.\n\t   The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `allocationMultiplier`.\n    For example, if a Device's capacity \"dra.example.com/cores\" is consumed,\n    and each \"core\" provides 2 \"cpu\"s, the mapping would be:\n    {ResourceName: \"cpu\", capacityKey: \"dra.example.com/cores\", allocationMultiplier: \"2\"}.\n    If a claim consumes 8 \"dra.example.com/cores\", the CPU footprint is 8 * 2 = 16.",
+var map_NodeAllocatableMapping = map[string]string{
+	"":                   "NodeAllocatableMapping defines how a DRA allocation directly translates into a node allocatable resource quantity. The mapping can be derived from either the count of allocated devices (via deviceMultiplier) or the specific capacity consumed (via capacityKey and capacityMultiplier). These options are mutually exclusive. Kubelet adds this mapped resource quantity from claim to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.",
+	"capacityKey":        "CapacityKey references a capacity name defined as a key in the `spec.devices[*].capacity` map. When this field is set, the value associated with this key in the `status.allocation.devices.results[*].consumedCapacity` map (for a specific claim allocation) determines the base quantity for the node allocatable resource. `capacityMultiplier` must also be set and is multiplied with the base quantity. For example, if `spec.devices[*].capacity` has an entry \"dra.example.com/memory\": \"128Gi\", and this field is set to \"dra.example.com/memory\", then for a claim allocation that consumes { \"dra.example.com/memory\": \"4Gi\" } the base quantity for the node allocatable resource mapping will be \"4Gi\". The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.",
+	"capacityMultiplier": "CapacityMultiplier is used as a multiplier for the allocated capacity consumed. It is only valid if `capacityKey` is set. The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`. For example, if a Device's capacity \"dra.example.com/cores\" is consumed, and each \"core\" provides 2 \"cpu\"s, the mapping would be: {ResourceName: \"cpu\", capacityKey: \"dra.example.com/cores\", capacityMultiplier: \"2\"}. If a claim consumes 8 \"dra.example.com/cores\", the CPU footprint is 8 * 2 = 16.",
+	"deviceMultiplier":   "DeviceMultiplier is used as a multiplier for the allocated device count in the claim. The final node allocatable resource amount is `deviceCount` * `deviceMultiplier`. For example, a DRA driver representing each cache complex (CCX) as a device would have {ResourceName: \"cpu\", deviceMultiplier: \"8\"} in its `nodeAllocatableResources`. If 2 devices (CCX) are allocated to the claim, 2 * 8 = 16 CPUs would be considered as allocated. It is only valid when `capacityKey` and `capacityMultiplier` are not set.",
+}
+
+func (NodeAllocatableMapping) SwaggerDoc() map[string]string {
+	return map_NodeAllocatableMapping
+}
+
+var map_NodeAllocatableOverhead = map[string]string{
+	"":             "NodeAllocatableOverhead defines auxiliary resource overheads incurred when allocating a device. Overheads can be specified as a fixed cost per pod referencing the claim, a variable cost per container reference, or both. Kubelet accounts for this overhead by adding it to both the pod-level and container-level cgroups of referencing containers.",
+	"perPod":       "PerPod is overhead applied once per pod referencing the claim on this node. This is a flat overhead incurred for every pod referencing the claim.",
+	"perContainer": "PerContainer is applied per container reference to the claim. This models overhead scaling linearly with the number of containers actively using the device. When both PerPod and PerContainer are specified, the total overhead allocated for each pod referencing the claim is computed as: Quantity = PerPod + (PerContainer * NumReferences) Kubelet accounts for this overhead in cgroups: - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences). - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container. This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once.",
+}
+
+func (NodeAllocatableOverhead) SwaggerDoc() map[string]string {
+	return map_NodeAllocatableOverhead
+}
+
+var map_NodeAllocatableResource = map[string]string{
+	"":         "NodeAllocatableResource defines the translation between the DRA device/capacity units requested to the corresponding quantity of the node allocatable resource. At least one of Mapping or Overhead must be specified. Not specifying either is an invalid configuration.",
+	"mapping":  "Mapping is used when the device directly models a node allocatable resource like standard CPU or memory (e.g., with a CPU DRA driver). The calculated quantity is accounted for exactly once per claim instance on the node. To prevent node cgroup isolation friction, the scheduler explicitly blocks sharing mapped device claims across multiple pods.",
+	"overhead": "Overhead contains fields for modeling auxiliary overhead incurred on node allocatable resources when allocating devices that are not themselves modeling a node allocatable resource (e.g., host memory overhead for GPUs). Sharing overhead-mapped claims across multiple pods is allowed. The node allocatable overhead is accounted for individually for each pod referencing the claim. Overhead is always subtracted from the node's allocatable capacity for the resource, even when mapping is specified for the same resource. Eg: If a device models memory capacity per socket as a consumable capacity pool via Mapping (with CapacityKey), any overhead specified for the same resource will be subtracted from the node's general allocatable capacity and not from the per-socket capacity pool in Mapping.",
 }
 
-func (NodeAllocatableResourceMapping) SwaggerDoc() map[string]string {
-	return map_NodeAllocatableResourceMapping
+func (NodeAllocatableResource) SwaggerDoc() map[string]string {
+	return map_NodeAllocatableResource
 }
 
 var map_OpaqueDeviceConfiguration = map[string]string{
@@ -528,7 +563,7 @@ func (ResourceClaimTemplateSpec) SwaggerDoc() map[string]string {
 
 var map_ResourcePool = map[string]string{
 	"":                   "ResourcePool describes the pool that ResourceSlices belong to.",
-	"name":               "Name is used to identify the pool. For node-local devices, this is often the node name, but this is not required.\n\nIt must not be longer than 253 characters and must consist of one or more DNS sub-domains separated by slashes. This field is immutable.",
+	"name":               "Name is used to identify the pool. For node-local devices, this is often the node name, but this is not required. A field selector can be used to list only ResourceSlice objects belonging to a certain pool.\n\nIt must not be longer than 253 characters and must consist of one or more DNS sub-domains separated by slashes. This field is immutable.",
 	"generation":         "Generation tracks the change in a pool over time. Whenever a driver changes something about one or more of the resources in a pool, it must change the generation in all ResourceSlices which are part of that pool. Consumers of ResourceSlices should only consider resources from the pool with the highest generation number. The generation may be reset by drivers, which should be fine for consumers, assuming that all ResourceSlices in a pool are updated to match or deleted.\n\nCombined with ResourceSliceCount, this mechanism enables consumers to detect pools which are comprised of multiple ResourceSlices and are in an incomplete state.",
 	"resourceSliceCount": "ResourceSliceCount is the total number of ResourceSlices in the pool at this generation number. Must be greater than zero.\n\nConsumers can use this to check whether they have seen all ResourceSlices belonging to the same pool.",
 }
@@ -567,6 +602,8 @@ var map_ResourceSliceSpec = map[string]string{
 	"devices":                "Devices lists some or all of the devices in this pool.\n\nMust not have more than 128 entries. If any device uses taints or consumes counters the limit is 64.\n\nOnly one of Devices and SharedCounters can be set in a ResourceSlice.",
 	"perDeviceNodeSelection": "PerDeviceNodeSelection defines whether the access from nodes to resources in the pool is set on the ResourceSlice level or on each device. If it is set to true, every device defined the ResourceSlice must specify this individually.\n\nExactly one of NodeName, NodeSelector, AllNodes, and PerDeviceNodeSelection must be set.",
 	"sharedCounters":         "SharedCounters defines a list of counter sets, each of which has a name and a list of counters available.\n\nThe names of the counter sets must be unique in the ResourcePool.\n\nOnly one of Devices and SharedCounters can be set in a ResourceSlice.\n\nThe maximum number of counter sets is 8.",
+	"partitionTypeAttribute": "PartitionTypeAttribute names a string device attribute (by fully qualified name, e.g. \"gpu.example.com/profile\") whose value labels each device with its partition type, such as \"Full\" or \"Half\" for a MIG-style GPU.\n\nWhen set, every partitionable device in the slice must carry the attribute and devices sharing a value must share the same ConsumesCounters cost.",
+	"skipNodeOperations":     "SkipNodeOperations lists node-local resource operations (gRPC calls) that will be skipped for the devices in this slice when determining whether operations are necessary on the node. If all allocated devices for a driver in a claim skip an operation, that gRPC call will be skipped. Valid values are:\n\n- \"NodePrepareResources\": NodePrepareResources gRPC calls are skipped. This\n  value cannot be specified unless \"NodeUnprepareResources\" is also listed\n  (or \"*\" is specified).\n- \"NodeUnprepareResources\": NodeUnprepareResources gRPC calls are skipped. - \"*\": All node-local resource operations are skipped.\n\nOther values may be added in the future. The kubelet must ignore unknown values.",
 }
 
 func (ResourceSliceSpec) SwaggerDoc() map[string]string {
diff --git a/vendor/k8s.io/api/resource/v1beta2/zz_generated.deepcopy.go b/vendor/k8s.io/api/resource/v1beta2/zz_generated.deepcopy.go
index 820ad2af61..5e87f13ca1 100644
--- a/vendor/k8s.io/api/resource/v1beta2/zz_generated.deepcopy.go
+++ b/vendor/k8s.io/api/resource/v1beta2/zz_generated.deepcopy.go
@@ -302,9 +302,9 @@ func (in *Device) DeepCopyInto(out *Device) {
 		*out = new(bool)
 		**out = **in
 	}
-	if in.NodeAllocatableResourceMappings != nil {
-		in, out := &in.NodeAllocatableResourceMappings, &out.NodeAllocatableResourceMappings
-		*out = make(map[corev1.ResourceName]NodeAllocatableResourceMapping, len(*in))
+	if in.NodeAllocatableResources != nil {
+		in, out := &in.NodeAllocatableResources, &out.NodeAllocatableResources
+		*out = make(map[corev1.ResourceName]NodeAllocatableResource, len(*in))
 		for key, val := range *in {
 			(*out)[key] = *val.DeepCopy()
 		}
@@ -685,6 +685,11 @@ func (in *DeviceCounterConsumption) DeepCopyInto(out *DeviceCounterConsumption)
 			(*out)[key] = *val.DeepCopy()
 		}
 	}
+	if in.CompatibilityGroups != nil {
+		in, out := &in.CompatibilityGroups, &out.CompatibilityGroups
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
@@ -698,6 +703,22 @@ func (in *DeviceCounterConsumption) DeepCopy() *DeviceCounterConsumption {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DeviceDerivedAttribute) DeepCopyInto(out *DeviceDerivedAttribute) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeviceDerivedAttribute.
+func (in *DeviceDerivedAttribute) DeepCopy() *DeviceDerivedAttribute {
+	if in == nil {
+		return nil
+	}
+	out := new(DeviceDerivedAttribute)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *DeviceRequest) DeepCopyInto(out *DeviceRequest) {
 	*out = *in
@@ -763,6 +784,11 @@ func (in *DeviceRequestAllocationResult) DeepCopyInto(out *DeviceRequestAllocati
 			(*out)[key] = val.DeepCopy()
 		}
 	}
+	if in.SkipNodeOperations != nil {
+		in, out := &in.SkipNodeOperations, &out.SkipNodeOperations
+		*out = make([]SkipNodeOperation, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
@@ -819,6 +845,11 @@ func (in *DeviceSubRequest) DeepCopyInto(out *DeviceSubRequest) {
 		*out = new(CapacityRequirements)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.DerivedAttributes != nil {
+		in, out := &in.DerivedAttributes, &out.DerivedAttributes
+		*out = make([]DeviceDerivedAttribute, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
@@ -1037,6 +1068,11 @@ func (in *ExactDeviceRequest) DeepCopyInto(out *ExactDeviceRequest) {
 		*out = new(CapacityRequirements)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.DerivedAttributes != nil {
+		in, out := &in.DerivedAttributes, &out.DerivedAttributes
+		*out = make([]DeviceDerivedAttribute, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
@@ -1072,27 +1108,84 @@ func (in *NetworkDeviceData) DeepCopy() *NetworkDeviceData {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *NodeAllocatableResourceMapping) DeepCopyInto(out *NodeAllocatableResourceMapping) {
+func (in *NodeAllocatableMapping) DeepCopyInto(out *NodeAllocatableMapping) {
 	*out = *in
 	if in.CapacityKey != nil {
 		in, out := &in.CapacityKey, &out.CapacityKey
 		*out = new(QualifiedName)
 		**out = **in
 	}
-	if in.AllocationMultiplier != nil {
-		in, out := &in.AllocationMultiplier, &out.AllocationMultiplier
+	if in.CapacityMultiplier != nil {
+		in, out := &in.CapacityMultiplier, &out.CapacityMultiplier
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	if in.DeviceMultiplier != nil {
+		in, out := &in.DeviceMultiplier, &out.DeviceMultiplier
 		x := (*in).DeepCopy()
 		*out = &x
 	}
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeAllocatableResourceMapping.
-func (in *NodeAllocatableResourceMapping) DeepCopy() *NodeAllocatableResourceMapping {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeAllocatableMapping.
+func (in *NodeAllocatableMapping) DeepCopy() *NodeAllocatableMapping {
 	if in == nil {
 		return nil
 	}
-	out := new(NodeAllocatableResourceMapping)
+	out := new(NodeAllocatableMapping)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NodeAllocatableOverhead) DeepCopyInto(out *NodeAllocatableOverhead) {
+	*out = *in
+	if in.PerPod != nil {
+		in, out := &in.PerPod, &out.PerPod
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	if in.PerContainer != nil {
+		in, out := &in.PerContainer, &out.PerContainer
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeAllocatableOverhead.
+func (in *NodeAllocatableOverhead) DeepCopy() *NodeAllocatableOverhead {
+	if in == nil {
+		return nil
+	}
+	out := new(NodeAllocatableOverhead)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NodeAllocatableResource) DeepCopyInto(out *NodeAllocatableResource) {
+	*out = *in
+	if in.Mapping != nil {
+		in, out := &in.Mapping, &out.Mapping
+		*out = new(NodeAllocatableMapping)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Overhead != nil {
+		in, out := &in.Overhead, &out.Overhead
+		*out = new(NodeAllocatableOverhead)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeAllocatableResource.
+func (in *NodeAllocatableResource) DeepCopy() *NodeAllocatableResource {
+	if in == nil {
+		return nil
+	}
+	out := new(NodeAllocatableResource)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -1433,6 +1526,16 @@ func (in *ResourceSliceSpec) DeepCopyInto(out *ResourceSliceSpec) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.PartitionTypeAttribute != nil {
+		in, out := &in.PartitionTypeAttribute, &out.PartitionTypeAttribute
+		*out = new(FullyQualifiedName)
+		**out = **in
+	}
+	if in.SkipNodeOperations != nil {
+		in, out := &in.SkipNodeOperations, &out.SkipNodeOperations
+		*out = make([]SkipNodeOperation, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
diff --git a/vendor/k8s.io/api/resource/v1beta2/zz_generated.model_name.go b/vendor/k8s.io/api/resource/v1beta2/zz_generated.model_name.go
index ce388ffd2e..7135589ce4 100644
--- a/vendor/k8s.io/api/resource/v1beta2/zz_generated.model_name.go
+++ b/vendor/k8s.io/api/resource/v1beta2/zz_generated.model_name.go
@@ -131,6 +131,11 @@ func (in DeviceCounterConsumption) OpenAPIModelName() string {
 	return "io.k8s.api.resource.v1beta2.DeviceCounterConsumption"
 }
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DeviceDerivedAttribute) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1beta2.DeviceDerivedAttribute"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in DeviceRequest) OpenAPIModelName() string {
 	return "io.k8s.api.resource.v1beta2.DeviceRequest"
@@ -197,8 +202,18 @@ func (in NetworkDeviceData) OpenAPIModelName() string {
 }
 
 // OpenAPIModelName returns the OpenAPI model name for this type.
-func (in NodeAllocatableResourceMapping) OpenAPIModelName() string {
-	return "io.k8s.api.resource.v1beta2.NodeAllocatableResourceMapping"
+func (in NodeAllocatableMapping) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1beta2.NodeAllocatableMapping"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NodeAllocatableOverhead) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1beta2.NodeAllocatableOverhead"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in NodeAllocatableResource) OpenAPIModelName() string {
+	return "io.k8s.api.resource.v1beta2.NodeAllocatableResource"
 }
 
 // OpenAPIModelName returns the OpenAPI model name for this type.
diff --git a/vendor/k8s.io/api/scheduling/v1/generated.proto b/vendor/k8s.io/api/scheduling/v1/generated.proto
index 6be7204de1..20eb5907d4 100644
--- a/vendor/k8s.io/api/scheduling/v1/generated.proto
+++ b/vendor/k8s.io/api/scheduling/v1/generated.proto
@@ -32,7 +32,7 @@ option go_package = "k8s.io/api/scheduling/v1";
 // PriorityClass defines mapping from a priority class name to the priority
 // integer value. The value can be any valid integer.
 message PriorityClass {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
diff --git a/vendor/k8s.io/api/scheduling/v1/types.go b/vendor/k8s.io/api/scheduling/v1/types.go
index 655b5eb159..f1f259fee0 100644
--- a/vendor/k8s.io/api/scheduling/v1/types.go
+++ b/vendor/k8s.io/api/scheduling/v1/types.go
@@ -29,8 +29,8 @@ import (
 // PriorityClass defines mapping from a priority class name to the priority
 // integer value. The value can be any valid integer.
 type PriorityClass struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -65,7 +65,7 @@ type PriorityClass struct {
 
 // PriorityClassList is a collection of priority classes.
 type PriorityClassList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
diff --git a/vendor/k8s.io/api/scheduling/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/scheduling/v1/types_swagger_doc_generated.go
index f167e19707..8913d60025 100644
--- a/vendor/k8s.io/api/scheduling/v1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/scheduling/v1/types_swagger_doc_generated.go
@@ -29,7 +29,7 @@ package v1
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_PriorityClass = map[string]string{
 	"":                 "PriorityClass defines mapping from a priority class name to the priority integer value. The value can be any valid integer.",
-	"metadata":         "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata":         "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"value":            "value represents the integer value of this priority class. This is the actual priority that pods receive when they have the name of this class in their pod spec.",
 	"globalDefault":    "globalDefault specifies whether this PriorityClass should be considered as the default priority for pods that do not have any priority class. Only one PriorityClass can be marked as `globalDefault`. However, if more than one PriorityClasses exists with their `globalDefault` field set to true, the smallest value of such global default PriorityClasses will be used as the default priority.",
 	"description":      "description is an arbitrary string that usually provides guidelines on when this priority class should be used.",
diff --git a/vendor/k8s.io/api/scheduling/v1alpha2/generated.proto b/vendor/k8s.io/api/scheduling/v1alpha2/generated.proto
deleted file mode 100644
index 73b3308e38..0000000000
--- a/vendor/k8s.io/api/scheduling/v1alpha2/generated.proto
+++ /dev/null
@@ -1,550 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-
-// This file was autogenerated by go-to-protobuf. Do not edit it manually!
-
-syntax = "proto2";
-
-package k8s.io.api.scheduling.v1alpha2;
-
-import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
-import "k8s.io/apimachinery/pkg/runtime/generated.proto";
-import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
-
-// Package-wide variables from generator "generated".
-option go_package = "k8s.io/api/scheduling/v1alpha2";
-
-// BasicSchedulingPolicy indicates that standard Kubernetes
-// scheduling behavior should be used.
-message BasicSchedulingPolicy {
-}
-
-// GangSchedulingPolicy defines the parameters for gang scheduling.
-message GangSchedulingPolicy {
-  // MinCount is the minimum number of pods that must be schedulable or scheduled
-  // at the same time for the scheduler to admit the entire group.
-  // It must be a positive integer.
-  //
-  // +required
-  // +k8s:required
-  // +k8s:minimum=1
-  optional int32 minCount = 1;
-}
-
-// PodGroup represents a runtime instance of pods grouped together.
-// PodGroups are created by workload controllers (Job, LWS, JobSet, etc...) from
-// Workload.podGroupTemplates.
-// PodGroup API enablement is toggled by the GenericWorkload feature gate.
-message PodGroup {
-  // Standard object's metadata.
-  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-  //
-  // +optional
-  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
-
-  // Spec defines the desired state of the PodGroup.
-  //
-  // +required
-  optional PodGroupSpec spec = 2;
-
-  // Status represents the current observed state of the PodGroup.
-  //
-  // +optional
-  optional PodGroupStatus status = 3;
-}
-
-// PodGroupList contains a list of PodGroup resources.
-message PodGroupList {
-  // Standard list metadata.
-  //
-  // +optional
-  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
-
-  // Items is the list of PodGroups.
-  repeated PodGroup items = 2;
-}
-
-// PodGroupResourceClaim references exactly one ResourceClaim, either directly
-// or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim
-// for the PodGroup.
-//
-// It adds a name to it that uniquely identifies the ResourceClaim inside the PodGroup.
-// Pods that need access to the ResourceClaim define a matching reference in its
-// own Spec.ResourceClaims. The Pod's claim must match all fields of the
-// PodGroup's claim exactly.
-message PodGroupResourceClaim {
-  // Name uniquely identifies this resource claim inside the PodGroup.
-  // This must be a DNS_LABEL.
-  //
-  // +required
-  // +k8s:required
-  // +k8s:format=k8s-short-name
-  optional string name = 1;
-
-  // ResourceClaimName is the name of a ResourceClaim object in the same
-  // namespace as this PodGroup. The ResourceClaim will be reserved for the
-  // PodGroup instead of its individual pods.
-  //
-  // Exactly one of ResourceClaimName and ResourceClaimTemplateName must
-  // be set.
-  //
-  // +optional
-  // +k8s:optional
-  // +k8s:unionMember
-  // +k8s:format=k8s-long-name
-  optional string resourceClaimName = 2;
-
-  // ResourceClaimTemplateName is the name of a ResourceClaimTemplate
-  // object in the same namespace as this PodGroup.
-  //
-  // The template will be used to create a new ResourceClaim, which will
-  // be bound to this PodGroup. When this PodGroup is deleted, the ResourceClaim
-  // will also be deleted. The PodGroup name and resource name, along with a
-  // generated component, will be used to form a unique name for the
-  // ResourceClaim, which will be recorded in podgroup.status.resourceClaimStatuses.
-  //
-  // This field is immutable and no changes will be made to the
-  // corresponding ResourceClaim by the control plane after creating the
-  // ResourceClaim.
-  //
-  // Exactly one of ResourceClaimName and ResourceClaimTemplateName must
-  // be set.
-  //
-  // +optional
-  // +k8s:optional
-  // +k8s:unionMember
-  // +k8s:format=k8s-long-name
-  optional string resourceClaimTemplateName = 3;
-}
-
-// PodGroupResourceClaimStatus is stored in the PodGroupStatus for each
-// PodGroupResourceClaim which references a ResourceClaimTemplate. It stores the
-// generated name for the corresponding ResourceClaim.
-message PodGroupResourceClaimStatus {
-  // Name uniquely identifies this resource claim inside the PodGroup. This
-  // must match the name of an entry in podgroup.spec.resourceClaims, which
-  // implies that the string must be a DNS_LABEL.
-  //
-  // +required
-  optional string name = 1;
-
-  // ResourceClaimName is the name of the ResourceClaim that was generated for
-  // the PodGroup in the namespace of the PodGroup. If this is unset, then
-  // generating a ResourceClaim was not necessary. The
-  // podgroup.spec.resourceClaims entry can be ignored in this case.
-  //
-  // +optional
-  // +k8s:optional
-  // +k8s:format=k8s-long-name
-  optional string resourceClaimName = 2;
-}
-
-// PodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a PodGroup.
-message PodGroupSchedulingConstraints {
-  // Topology defines the topology constraints for the pod group.
-  // Currently only a single topology constraint can be specified. This may change in the future.
-  //
-  // +optional
-  // +k8s:optional
-  // +k8s:maxItems=1
-  // +listType=atomic
-  // +k8s:listType=atomic
-  repeated TopologyConstraint topology = 1;
-}
-
-// PodGroupSchedulingPolicy defines the scheduling configuration for a PodGroup.
-// Exactly one policy must be set.
-// +union
-message PodGroupSchedulingPolicy {
-  // Basic specifies that the pods in this group should be scheduled using
-  // standard Kubernetes scheduling behavior.
-  //
-  // +optional
-  // +k8s:optional
-  // +k8s:unionMember
-  optional BasicSchedulingPolicy basic = 1;
-
-  // Gang specifies that the pods in this group should be scheduled using
-  // all-or-nothing semantics.
-  //
-  // +optional
-  // +k8s:optional
-  // +k8s:unionMember
-  optional GangSchedulingPolicy gang = 2;
-}
-
-// PodGroupSpec defines the desired state of a PodGroup.
-message PodGroupSpec {
-  // PodGroupTemplateRef references an optional PodGroup template within other object
-  // (e.g. Workload) that was used to create the PodGroup. This field is immutable.
-  //
-  // +optional
-  // +k8s:optional
-  // +k8s:immutable
-  optional PodGroupTemplateReference podGroupTemplateRef = 1;
-
-  // SchedulingPolicy defines the scheduling policy for this instance of the PodGroup.
-  // Controllers are expected to fill this field by copying it from a PodGroupTemplate.
-  // This field is immutable.
-  //
-  // +required
-  // +k8s:immutable
-  optional PodGroupSchedulingPolicy schedulingPolicy = 2;
-
-  // SchedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroup.
-  // Controllers are expected to fill this field by copying it from a PodGroupTemplate.
-  // This field is immutable.
-  // This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
-  //
-  // +featureGate=TopologyAwareWorkloadScheduling
-  // +optional
-  // +k8s:ifDisabled(TopologyAwareWorkloadScheduling)=+k8s:forbidden
-  // +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:optional
-  // +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:immutable
-  optional PodGroupSchedulingConstraints schedulingConstraints = 3;
-
-  // ResourceClaims defines which ResourceClaims may be shared among Pods in
-  // the group. Pods consume the devices allocated to a PodGroup's claim by
-  // defining a claim in its own Spec.ResourceClaims that matches the
-  // PodGroup's claim exactly. The claim must have the same name and refer to
-  // the same ResourceClaim or ResourceClaimTemplate.
-  //
-  // This is an alpha-level field and requires that the
-  // DRAWorkloadResourceClaims feature gate is enabled.
-  //
-  // This field is immutable.
-  //
-  // +optional
-  // +patchMergeKey=name
-  // +patchStrategy=merge,retainKeys
-  // +listType=map
-  // +listMapKey=name
-  // +k8s:optional
-  // +k8s:listType=map
-  // +k8s:listMapKey=name
-  // +k8s:maxItems=4
-  // +k8s:immutable
-  // +featureGate=DRAWorkloadResourceClaims
-  repeated PodGroupResourceClaim resourceClaims = 4;
-
-  // DisruptionMode defines the mode in which a given PodGroup can be disrupted.
-  // Controllers are expected to fill this field by copying it from a PodGroupTemplate.
-  // One of Pod, PodGroup. Defaults to Pod if unset.
-  // This field is immutable.
-  // This field is available only when the WorkloadAwarePreemption feature gate
-  // is enabled.
-  //
-  // +featureGate=WorkloadAwarePreemption
-  // +optional
-  // +k8s:ifDisabled("WorkloadAwarePreemption")=+k8s:forbidden
-  // +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:optional
-  // +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:immutable
-  // +default="Pod"
-  optional string disruptionMode = 5;
-
-  // PriorityClassName defines the priority that should be considered when scheduling this pod group.
-  // Controllers are expected to fill this field by copying it from a PodGroupTemplate.
-  // Otherwise, it is validated and resolved similarly to the PriorityClassName on PodGroupTemplate
-  // (i.e. if no priority class is specified, admission control can set this to the global default
-  // priority class if it exists. Otherwise, the pod group's priority will be zero).
-  // This field is immutable.
-  // This field is available only when the WorkloadAwarePreemption feature gate
-  // is enabled.
-  //
-  // +featureGate=WorkloadAwarePreemption
-  // +optional
-  // +k8s:ifDisabled("WorkloadAwarePreemption")=+k8s:forbidden
-  // +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:optional
-  // +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:format=k8s-long-name
-  // +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:immutable
-  optional string priorityClassName = 6;
-
-  // Priority is the value of priority of this pod group. Various system components
-  // use this field to find the priority of the pod group. When Priority Admission
-  // Controller is enabled, it prevents users from setting this field. The admission
-  // controller populates this field from PriorityClassName.
-  // The higher the value, the higher the priority.
-  // This field is immutable.
-  // This field is available only when the WorkloadAwarePreemption feature gate
-  // is enabled.
-  //
-  // +featureGate=WorkloadAwarePreemption
-  // +optional
-  // +k8s:ifDisabled("WorkloadAwarePreemption")=+k8s:forbidden
-  // +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:optional
-  // +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:immutable
-  // +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:maximum=1000000000 # HighestUserDefinablePriority
-  // +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:minimum=-2147483648
-  optional int32 priority = 7;
-}
-
-// PodGroupStatus represents information about the status of a pod group.
-message PodGroupStatus {
-  // Conditions represent the latest observations of the PodGroup's state.
-  //
-  // Known condition types:
-  // - "PodGroupScheduled": Indicates whether the scheduling requirement has been satisfied.
-  // - "DisruptionTarget": Indicates whether the PodGroup is about to be terminated
-  //   due to disruption such as preemption.
-  //
-  // Known reasons for the PodGroupScheduled condition:
-  // - "Unschedulable": The PodGroup cannot be scheduled due to resource constraints,
-  //   affinity/anti-affinity rules, or insufficient capacity for the gang.
-  // - "SchedulerError": The PodGroup cannot be scheduled due to some internal error
-  //   that happened during scheduling, for example due to nodeAffinity parsing errors.
-  //
-  // Known reasons for the DisruptionTarget condition:
-  // - "PreemptionByScheduler": The PodGroup was preempted by the scheduler to make room for
-  //   higher-priority PodGroups or Pods.
-  //
-  // +optional
-  // +patchMergeKey=type
-  // +patchStrategy=merge
-  // +listType=map
-  // +listMapKey=type
-  repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 1;
-
-  // Status of resource claims.
-  // +optional
-  // +patchMergeKey=name
-  // +patchStrategy=merge,retainKeys
-  // +listType=map
-  // +listMapKey=name
-  // +k8s:optional
-  // +k8s:listType=map
-  // +k8s:listMapKey=name
-  // +k8s:maxItems=4
-  // +featureGate=DRAWorkloadResourceClaims
-  repeated PodGroupResourceClaimStatus resourceClaimStatuses = 2;
-}
-
-// PodGroupTemplate represents a template for a set of pods with a scheduling policy.
-message PodGroupTemplate {
-  // Name is a unique identifier for the PodGroupTemplate within the Workload.
-  // It must be a DNS label. This field is immutable.
-  //
-  // +required
-  // +k8s:required
-  // +k8s:format=k8s-short-name
-  optional string name = 1;
-
-  // SchedulingPolicy defines the scheduling policy for this PodGroupTemplate.
-  //
-  // +required
-  optional PodGroupSchedulingPolicy schedulingPolicy = 2;
-
-  // SchedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroupTemplate.
-  // This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
-  //
-  // +featureGate=TopologyAwareWorkloadScheduling
-  // +optional
-  // +k8s:ifDisabled(TopologyAwareWorkloadScheduling)=+k8s:forbidden
-  // +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:optional
-  optional PodGroupSchedulingConstraints schedulingConstraints = 3;
-
-  // ResourceClaims defines which ResourceClaims may be shared among Pods in
-  // the group. Pods consume the devices allocated to a PodGroup's claim by
-  // defining a claim in its own Spec.ResourceClaims that matches the
-  // PodGroup's claim exactly. The claim must have the same name and refer to
-  // the same ResourceClaim or ResourceClaimTemplate.
-  //
-  // This is an alpha-level field and requires that the
-  // DRAWorkloadResourceClaims feature gate is enabled.
-  //
-  // This field is immutable.
-  //
-  // +optional
-  // +patchMergeKey=name
-  // +patchStrategy=merge,retainKeys
-  // +listType=map
-  // +listMapKey=name
-  // +k8s:optional
-  // +k8s:listType=map
-  // +k8s:listMapKey=name
-  // +k8s:maxItems=4
-  // +k8s:immutable
-  // +featureGate=DRAWorkloadResourceClaims
-  repeated PodGroupResourceClaim resourceClaims = 4;
-
-  // DisruptionMode defines the mode in which a given PodGroup can be disrupted.
-  // One of Pod, PodGroup.
-  // This field is available only when the WorkloadAwarePreemption feature gate
-  // is enabled.
-  //
-  // +featureGate=WorkloadAwarePreemption
-  // +optional
-  // +k8s:ifDisabled("WorkloadAwarePreemption")=+k8s:forbidden
-  // +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:optional
-  optional string disruptionMode = 5;
-
-  // PriorityClassName indicates the priority that should be considered when scheduling
-  // a pod group created from this template. If no priority class is specified, admission
-  // control can set this to the global default priority class if it exists. Otherwise,
-  // pod groups created from this template will have the priority set to zero.
-  // This field is available only when the WorkloadAwarePreemption feature gate
-  // is enabled.
-  //
-  // +featureGate=WorkloadAwarePreemption
-  // +optional
-  // +k8s:ifDisabled("WorkloadAwarePreemption")=+k8s:forbidden
-  // +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:optional
-  // +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:format=k8s-long-name
-  optional string priorityClassName = 6;
-
-  // Priority is the value of priority of pod groups created from this template. Various
-  // system components use this field to find the priority of the pod group. When
-  // Priority Admission Controller is enabled, it prevents users from setting this field.
-  // The admission controller populates this field from PriorityClassName.
-  // The higher the value, the higher the priority.
-  // This field is available only when the WorkloadAwarePreemption feature gate
-  // is enabled.
-  //
-  // +featureGate=WorkloadAwarePreemption
-  // +optional
-  // +k8s:ifDisabled("WorkloadAwarePreemption")=+k8s:forbidden
-  // +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:optional
-  // +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:maximum=1000000000 # HighestUserDefinablePriority
-  // +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:minimum=-2147483648
-  optional int32 priority = 7;
-}
-
-// PodGroupTemplateReference references a PodGroup template defined in some object (e.g. Workload).
-// Exactly one reference must be set.
-// +union
-message PodGroupTemplateReference {
-  // Workload references the PodGroupTemplate within the Workload object that was used to create
-  // the PodGroup.
-  //
-  // +optional
-  // +k8s:optional
-  // +k8s:unionMember
-  optional WorkloadPodGroupTemplateReference workload = 1;
-}
-
-// TopologyConstraint defines a topology constraint for a PodGroup.
-message TopologyConstraint {
-  // Key specifies the key of the node label representing the topology domain.
-  // All pods within the PodGroup must be colocated within the same domain instance.
-  // Different PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.
-  // Examples: "topology.kubernetes.io/rack"
-  //
-  // +required
-  // +k8s:required
-  // +k8s:format=k8s-label-key
-  optional string key = 1;
-}
-
-// TypedLocalObjectReference allows to reference typed object inside the same namespace.
-message TypedLocalObjectReference {
-  // APIGroup is the group for the resource being referenced.
-  // If APIGroup is empty, the specified Kind must be in the core API group.
-  // For any other third-party types, setting APIGroup is required.
-  // It must be a DNS subdomain.
-  //
-  // +optional
-  // +k8s:optional
-  // +k8s:format=k8s-long-name
-  optional string apiGroup = 1;
-
-  // Kind is the type of resource being referenced.
-  // It must be a path segment name.
-  //
-  // +required
-  // +k8s:required
-  // +k8s:format=k8s-path-segment-name
-  optional string kind = 2;
-
-  // Name is the name of resource being referenced.
-  // It must be a path segment name.
-  //
-  // +required
-  // +k8s:required
-  // +k8s:format=k8s-path-segment-name
-  optional string name = 3;
-}
-
-// Workload allows for expressing scheduling constraints that should be used
-// when managing the lifecycle of workloads from the scheduling perspective,
-// including scheduling, preemption, eviction and other phases.
-// Workload API enablement is toggled by the GenericWorkload feature gate.
-message Workload {
-  // Standard object's metadata.
-  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-  //
-  // +optional
-  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
-
-  // Spec defines the desired behavior of a Workload.
-  //
-  // +required
-  optional WorkloadSpec spec = 2;
-}
-
-// WorkloadList contains a list of Workload resources.
-message WorkloadList {
-  // Standard list metadata.
-  //
-  // +optional
-  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
-
-  // Items is the list of Workloads.
-  repeated Workload items = 2;
-}
-
-// WorkloadPodGroupTemplateReference references the PodGroupTemplate within the Workload object.
-message WorkloadPodGroupTemplateReference {
-  // WorkloadName defines the name of the Workload object.
-  //
-  // +required
-  // +k8s:required
-  // +k8s:format=k8s-long-name
-  optional string workloadName = 1;
-
-  // PodGroupTemplateName defines the PodGroupTemplate name within the Workload object.
-  //
-  // +required
-  // +k8s:required
-  // +k8s:format=k8s-short-name
-  optional string podGroupTemplateName = 2;
-}
-
-// WorkloadSpec defines the desired state of a Workload.
-message WorkloadSpec {
-  // ControllerRef is an optional reference to the controlling object, such as a
-  // Deployment or Job. This field is intended for use by tools like CLIs
-  // to provide a link back to the original workload definition.
-  // This field is immutable.
-  //
-  // +optional
-  // +k8s:optional
-  // +k8s:immutable
-  optional TypedLocalObjectReference controllerRef = 1;
-
-  // PodGroupTemplates is the list of templates that make up the Workload.
-  // The maximum number of templates is 8. This field is immutable.
-  //
-  // +required
-  // +listType=map
-  // +listMapKey=name
-  // +k8s:required
-  // +k8s:listType=map
-  // +k8s:listMapKey=name
-  // +k8s:maxItems=8
-  // +k8s:immutable
-  repeated PodGroupTemplate podGroupTemplates = 2;
-}
-
diff --git a/vendor/k8s.io/api/scheduling/v1alpha2/types.go b/vendor/k8s.io/api/scheduling/v1alpha2/types.go
deleted file mode 100644
index 1f84f2c43d..0000000000
--- a/vendor/k8s.io/api/scheduling/v1alpha2/types.go
+++ /dev/null
@@ -1,601 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1alpha2
-
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +genclient
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-
-// Workload allows for expressing scheduling constraints that should be used
-// when managing the lifecycle of workloads from the scheduling perspective,
-// including scheduling, preemption, eviction and other phases.
-// Workload API enablement is toggled by the GenericWorkload feature gate.
-type Workload struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
-	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-	//
-	// +optional
-	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-
-	// Spec defines the desired behavior of a Workload.
-	//
-	// +required
-	Spec WorkloadSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
-}
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-
-// WorkloadList contains a list of Workload resources.
-type WorkloadList struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard list metadata.
-	//
-	// +optional
-	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-
-	// Items is the list of Workloads.
-	Items []Workload `json:"items" protobuf:"bytes,2,rep,name=items"`
-}
-
-// WorkloadMaxPodGroupTemplates is the maximum number of pod group templates per Workload.
-const WorkloadMaxPodGroupTemplates = 8
-
-// WorkloadSpec defines the desired state of a Workload.
-type WorkloadSpec struct {
-	// ControllerRef is an optional reference to the controlling object, such as a
-	// Deployment or Job. This field is intended for use by tools like CLIs
-	// to provide a link back to the original workload definition.
-	// This field is immutable.
-	//
-	// +optional
-	// +k8s:optional
-	// +k8s:immutable
-	ControllerRef *TypedLocalObjectReference `json:"controllerRef,omitempty" protobuf:"bytes,1,opt,name=controllerRef"`
-
-	// PodGroupTemplates is the list of templates that make up the Workload.
-	// The maximum number of templates is 8. This field is immutable.
-	//
-	// +required
-	// +listType=map
-	// +listMapKey=name
-	// +k8s:required
-	// +k8s:listType=map
-	// +k8s:listMapKey=name
-	// +k8s:maxItems=8
-	// +k8s:immutable
-	PodGroupTemplates []PodGroupTemplate `json:"podGroupTemplates" protobuf:"bytes,2,rep,name=podGroupTemplates"`
-}
-
-// TypedLocalObjectReference allows to reference typed object inside the same namespace.
-type TypedLocalObjectReference struct {
-	// APIGroup is the group for the resource being referenced.
-	// If APIGroup is empty, the specified Kind must be in the core API group.
-	// For any other third-party types, setting APIGroup is required.
-	// It must be a DNS subdomain.
-	//
-	// +optional
-	// +k8s:optional
-	// +k8s:format=k8s-long-name
-	APIGroup string `json:"apiGroup,omitempty" protobuf:"bytes,1,opt,name=apiGroup"`
-	// Kind is the type of resource being referenced.
-	// It must be a path segment name.
-	//
-	// +required
-	// +k8s:required
-	// +k8s:format=k8s-path-segment-name
-	Kind string `json:"kind" protobuf:"bytes,2,opt,name=kind"`
-	// Name is the name of resource being referenced.
-	// It must be a path segment name.
-	//
-	// +required
-	// +k8s:required
-	// +k8s:format=k8s-path-segment-name
-	Name string `json:"name" protobuf:"bytes,3,opt,name=name"`
-}
-
-// MaxPodGroupResourceClaims is the maximum number of resource claims for a
-// PodGroup or a Workload's PodGroupTemplate.
-const MaxPodGroupResourceClaims = 4
-
-// PodGroupTemplate represents a template for a set of pods with a scheduling policy.
-type PodGroupTemplate struct {
-	// Name is a unique identifier for the PodGroupTemplate within the Workload.
-	// It must be a DNS label. This field is immutable.
-	//
-	// +required
-	// +k8s:required
-	// +k8s:format=k8s-short-name
-	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
-
-	// SchedulingPolicy defines the scheduling policy for this PodGroupTemplate.
-	//
-	// +required
-	SchedulingPolicy PodGroupSchedulingPolicy `json:"schedulingPolicy" protobuf:"bytes,2,opt,name=schedulingPolicy"`
-
-	// SchedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroupTemplate.
-	// This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
-	//
-	// +featureGate=TopologyAwareWorkloadScheduling
-	// +optional
-	// +k8s:ifDisabled(TopologyAwareWorkloadScheduling)=+k8s:forbidden
-	// +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:optional
-	SchedulingConstraints *PodGroupSchedulingConstraints `json:"schedulingConstraints" protobuf:"bytes,3,opt,name=schedulingConstraints"`
-
-	// ResourceClaims defines which ResourceClaims may be shared among Pods in
-	// the group. Pods consume the devices allocated to a PodGroup's claim by
-	// defining a claim in its own Spec.ResourceClaims that matches the
-	// PodGroup's claim exactly. The claim must have the same name and refer to
-	// the same ResourceClaim or ResourceClaimTemplate.
-	//
-	// This is an alpha-level field and requires that the
-	// DRAWorkloadResourceClaims feature gate is enabled.
-	//
-	// This field is immutable.
-	//
-	// +optional
-	// +patchMergeKey=name
-	// +patchStrategy=merge,retainKeys
-	// +listType=map
-	// +listMapKey=name
-	// +k8s:optional
-	// +k8s:listType=map
-	// +k8s:listMapKey=name
-	// +k8s:maxItems=4
-	// +k8s:immutable
-	// +featureGate=DRAWorkloadResourceClaims
-	ResourceClaims []PodGroupResourceClaim `json:"resourceClaims,omitempty" patchStrategy:"merge,retainKeys" patchMergeKey:"name" protobuf:"bytes,4,rep,name=resourceClaims"`
-
-	// DisruptionMode defines the mode in which a given PodGroup can be disrupted.
-	// One of Pod, PodGroup.
-	// This field is available only when the WorkloadAwarePreemption feature gate
-	// is enabled.
-	//
-	// +featureGate=WorkloadAwarePreemption
-	// +optional
-	// +k8s:ifDisabled("WorkloadAwarePreemption")=+k8s:forbidden
-	// +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:optional
-	DisruptionMode *DisruptionMode `json:"disruptionMode,omitempty" protobuf:"bytes,5,opt,name=disruptionMode,casttype=DisruptionMode"`
-
-	// PriorityClassName indicates the priority that should be considered when scheduling
-	// a pod group created from this template. If no priority class is specified, admission
-	// control can set this to the global default priority class if it exists. Otherwise,
-	// pod groups created from this template will have the priority set to zero.
-	// This field is available only when the WorkloadAwarePreemption feature gate
-	// is enabled.
-	//
-	// +featureGate=WorkloadAwarePreemption
-	// +optional
-	// +k8s:ifDisabled("WorkloadAwarePreemption")=+k8s:forbidden
-	// +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:optional
-	// +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:format=k8s-long-name
-	PriorityClassName string `json:"priorityClassName,omitempty" protobuf:"bytes,6,opt,name=priorityClassName"`
-
-	// Priority is the value of priority of pod groups created from this template. Various
-	// system components use this field to find the priority of the pod group. When
-	// Priority Admission Controller is enabled, it prevents users from setting this field.
-	// The admission controller populates this field from PriorityClassName.
-	// The higher the value, the higher the priority.
-	// This field is available only when the WorkloadAwarePreemption feature gate
-	// is enabled.
-	//
-	// +featureGate=WorkloadAwarePreemption
-	// +optional
-	// +k8s:ifDisabled("WorkloadAwarePreemption")=+k8s:forbidden
-	// +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:optional
-	// +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:maximum=1000000000 # HighestUserDefinablePriority
-	// +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:minimum=-2147483648
-	Priority *int32 `json:"priority,omitempty" protobuf:"varint,7,opt,name=priority"`
-}
-
-// PodGroupSchedulingPolicy defines the scheduling configuration for a PodGroup.
-// Exactly one policy must be set.
-// +union
-type PodGroupSchedulingPolicy struct {
-	// Basic specifies that the pods in this group should be scheduled using
-	// standard Kubernetes scheduling behavior.
-	//
-	// +optional
-	// +k8s:optional
-	// +k8s:unionMember
-	Basic *BasicSchedulingPolicy `json:"basic,omitempty" protobuf:"bytes,1,opt,name=basic"`
-
-	// Gang specifies that the pods in this group should be scheduled using
-	// all-or-nothing semantics.
-	//
-	// +optional
-	// +k8s:optional
-	// +k8s:unionMember
-	Gang *GangSchedulingPolicy `json:"gang,omitempty" protobuf:"bytes,2,opt,name=gang"`
-}
-
-// BasicSchedulingPolicy indicates that standard Kubernetes
-// scheduling behavior should be used.
-type BasicSchedulingPolicy struct {
-	// This is intentionally empty. Its presence indicates that the basic
-	// scheduling policy should be applied. In the future, new fields may appear,
-	// describing such constraints on a pod group level without "all or nothing"
-	// (gang) scheduling.
-}
-
-// GangSchedulingPolicy defines the parameters for gang scheduling.
-type GangSchedulingPolicy struct {
-	// MinCount is the minimum number of pods that must be schedulable or scheduled
-	// at the same time for the scheduler to admit the entire group.
-	// It must be a positive integer.
-	//
-	// +required
-	// +k8s:required
-	// +k8s:minimum=1
-	MinCount int32 `json:"minCount" protobuf:"varint,1,opt,name=minCount"`
-}
-
-// PodGroupResourceClaim references exactly one ResourceClaim, either directly
-// or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim
-// for the PodGroup.
-//
-// It adds a name to it that uniquely identifies the ResourceClaim inside the PodGroup.
-// Pods that need access to the ResourceClaim define a matching reference in its
-// own Spec.ResourceClaims. The Pod's claim must match all fields of the
-// PodGroup's claim exactly.
-type PodGroupResourceClaim struct {
-	// Name uniquely identifies this resource claim inside the PodGroup.
-	// This must be a DNS_LABEL.
-	//
-	// +required
-	// +k8s:required
-	// +k8s:format=k8s-short-name
-	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
-
-	// ResourceClaimName is the name of a ResourceClaim object in the same
-	// namespace as this PodGroup. The ResourceClaim will be reserved for the
-	// PodGroup instead of its individual pods.
-	//
-	// Exactly one of ResourceClaimName and ResourceClaimTemplateName must
-	// be set.
-	//
-	// +optional
-	// +k8s:optional
-	// +k8s:unionMember
-	// +k8s:format=k8s-long-name
-	ResourceClaimName *string `json:"resourceClaimName,omitempty" protobuf:"bytes,2,opt,name=resourceClaimName"`
-
-	// ResourceClaimTemplateName is the name of a ResourceClaimTemplate
-	// object in the same namespace as this PodGroup.
-	//
-	// The template will be used to create a new ResourceClaim, which will
-	// be bound to this PodGroup. When this PodGroup is deleted, the ResourceClaim
-	// will also be deleted. The PodGroup name and resource name, along with a
-	// generated component, will be used to form a unique name for the
-	// ResourceClaim, which will be recorded in podgroup.status.resourceClaimStatuses.
-	//
-	// This field is immutable and no changes will be made to the
-	// corresponding ResourceClaim by the control plane after creating the
-	// ResourceClaim.
-	//
-	// Exactly one of ResourceClaimName and ResourceClaimTemplateName must
-	// be set.
-	//
-	// +optional
-	// +k8s:optional
-	// +k8s:unionMember
-	// +k8s:format=k8s-long-name
-	ResourceClaimTemplateName *string `json:"resourceClaimTemplateName,omitempty" protobuf:"bytes,3,opt,name=resourceClaimTemplateName"`
-}
-
-// DisruptionMode describes the mode in which a PodGroup can be disrupted (e.g. preempted).
-// +enum
-// +k8s:enum
-type DisruptionMode string
-
-const (
-	// DisruptionModePod means that individual pods can be disrupted or preempted independently.
-	// It doesn't depend on exact set of pods currently running in this PodGroup.
-	DisruptionModePod DisruptionMode = "Pod"
-	// DisruptionModePodGroup means that the whole PodGroup needs to be disrupted
-	// or preempted together.
-	DisruptionModePodGroup DisruptionMode = "PodGroup"
-)
-
-// +genclient
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +k8s:supportsSubresource="/status"
-
-// PodGroup represents a runtime instance of pods grouped together.
-// PodGroups are created by workload controllers (Job, LWS, JobSet, etc...) from
-// Workload.podGroupTemplates.
-// PodGroup API enablement is toggled by the GenericWorkload feature gate.
-type PodGroup struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
-	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-	//
-	// +optional
-	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-
-	// Spec defines the desired state of the PodGroup.
-	//
-	// +required
-	Spec PodGroupSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
-
-	// Status represents the current observed state of the PodGroup.
-	//
-	// +optional
-	Status PodGroupStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
-}
-
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-
-// PodGroupList contains a list of PodGroup resources.
-type PodGroupList struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard list metadata.
-	//
-	// +optional
-	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-
-	// Items is the list of PodGroups.
-	Items []PodGroup `json:"items" protobuf:"bytes,2,rep,name=items"`
-}
-
-// PodGroupSpec defines the desired state of a PodGroup.
-type PodGroupSpec struct {
-	// PodGroupTemplateRef references an optional PodGroup template within other object
-	// (e.g. Workload) that was used to create the PodGroup. This field is immutable.
-	//
-	// +optional
-	// +k8s:optional
-	// +k8s:immutable
-	PodGroupTemplateRef *PodGroupTemplateReference `json:"podGroupTemplateRef" protobuf:"bytes,1,opt,name=podGroupTemplateRef"`
-
-	// SchedulingPolicy defines the scheduling policy for this instance of the PodGroup.
-	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
-	// This field is immutable.
-	//
-	// +required
-	// +k8s:immutable
-	SchedulingPolicy PodGroupSchedulingPolicy `json:"schedulingPolicy" protobuf:"bytes,2,opt,name=schedulingPolicy"`
-
-	// SchedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroup.
-	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
-	// This field is immutable.
-	// This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
-	//
-	// +featureGate=TopologyAwareWorkloadScheduling
-	// +optional
-	// +k8s:ifDisabled(TopologyAwareWorkloadScheduling)=+k8s:forbidden
-	// +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:optional
-	// +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:immutable
-	SchedulingConstraints *PodGroupSchedulingConstraints `json:"schedulingConstraints,omitempty" protobuf:"bytes,3,opt,name=schedulingConstraints"`
-
-	// ResourceClaims defines which ResourceClaims may be shared among Pods in
-	// the group. Pods consume the devices allocated to a PodGroup's claim by
-	// defining a claim in its own Spec.ResourceClaims that matches the
-	// PodGroup's claim exactly. The claim must have the same name and refer to
-	// the same ResourceClaim or ResourceClaimTemplate.
-	//
-	// This is an alpha-level field and requires that the
-	// DRAWorkloadResourceClaims feature gate is enabled.
-	//
-	// This field is immutable.
-	//
-	// +optional
-	// +patchMergeKey=name
-	// +patchStrategy=merge,retainKeys
-	// +listType=map
-	// +listMapKey=name
-	// +k8s:optional
-	// +k8s:listType=map
-	// +k8s:listMapKey=name
-	// +k8s:maxItems=4
-	// +k8s:immutable
-	// +featureGate=DRAWorkloadResourceClaims
-	ResourceClaims []PodGroupResourceClaim `json:"resourceClaims,omitempty" patchStrategy:"merge,retainKeys" patchMergeKey:"name" protobuf:"bytes,4,rep,name=resourceClaims"`
-
-	// DisruptionMode defines the mode in which a given PodGroup can be disrupted.
-	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
-	// One of Pod, PodGroup. Defaults to Pod if unset.
-	// This field is immutable.
-	// This field is available only when the WorkloadAwarePreemption feature gate
-	// is enabled.
-	//
-	// +featureGate=WorkloadAwarePreemption
-	// +optional
-	// +k8s:ifDisabled("WorkloadAwarePreemption")=+k8s:forbidden
-	// +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:optional
-	// +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:immutable
-	// +default="Pod"
-	DisruptionMode *DisruptionMode `json:"disruptionMode,omitempty" protobuf:"bytes,5,opt,name=disruptionMode,casttype=DisruptionMode"`
-
-	// PriorityClassName defines the priority that should be considered when scheduling this pod group.
-	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
-	// Otherwise, it is validated and resolved similarly to the PriorityClassName on PodGroupTemplate
-	// (i.e. if no priority class is specified, admission control can set this to the global default
-	// priority class if it exists. Otherwise, the pod group's priority will be zero).
-	// This field is immutable.
-	// This field is available only when the WorkloadAwarePreemption feature gate
-	// is enabled.
-	//
-	// +featureGate=WorkloadAwarePreemption
-	// +optional
-	// +k8s:ifDisabled("WorkloadAwarePreemption")=+k8s:forbidden
-	// +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:optional
-	// +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:format=k8s-long-name
-	// +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:immutable
-	PriorityClassName string `json:"priorityClassName,omitempty" protobuf:"bytes,6,opt,name=priorityClassName"`
-
-	// Priority is the value of priority of this pod group. Various system components
-	// use this field to find the priority of the pod group. When Priority Admission
-	// Controller is enabled, it prevents users from setting this field. The admission
-	// controller populates this field from PriorityClassName.
-	// The higher the value, the higher the priority.
-	// This field is immutable.
-	// This field is available only when the WorkloadAwarePreemption feature gate
-	// is enabled.
-	//
-	// +featureGate=WorkloadAwarePreemption
-	// +optional
-	// +k8s:ifDisabled("WorkloadAwarePreemption")=+k8s:forbidden
-	// +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:optional
-	// +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:immutable
-	// +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:maximum=1000000000 # HighestUserDefinablePriority
-	// +k8s:ifEnabled("WorkloadAwarePreemption")=+k8s:minimum=-2147483648
-	Priority *int32 `json:"priority,omitempty" protobuf:"varint,7,opt,name=priority"`
-}
-
-// PodGroupStatus represents information about the status of a pod group.
-type PodGroupStatus struct {
-	// Conditions represent the latest observations of the PodGroup's state.
-	//
-	// Known condition types:
-	// - "PodGroupScheduled": Indicates whether the scheduling requirement has been satisfied.
-	// - "DisruptionTarget": Indicates whether the PodGroup is about to be terminated
-	//   due to disruption such as preemption.
-	//
-	// Known reasons for the PodGroupScheduled condition:
-	// - "Unschedulable": The PodGroup cannot be scheduled due to resource constraints,
-	//   affinity/anti-affinity rules, or insufficient capacity for the gang.
-	// - "SchedulerError": The PodGroup cannot be scheduled due to some internal error
-	//   that happened during scheduling, for example due to nodeAffinity parsing errors.
-	//
-	// Known reasons for the DisruptionTarget condition:
-	// - "PreemptionByScheduler": The PodGroup was preempted by the scheduler to make room for
-	//   higher-priority PodGroups or Pods.
-	//
-	// +optional
-	// +patchMergeKey=type
-	// +patchStrategy=merge
-	// +listType=map
-	// +listMapKey=type
-	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
-
-	// Status of resource claims.
-	// +optional
-	// +patchMergeKey=name
-	// +patchStrategy=merge,retainKeys
-	// +listType=map
-	// +listMapKey=name
-	// +k8s:optional
-	// +k8s:listType=map
-	// +k8s:listMapKey=name
-	// +k8s:maxItems=4
-	// +featureGate=DRAWorkloadResourceClaims
-	ResourceClaimStatuses []PodGroupResourceClaimStatus `json:"resourceClaimStatuses,omitempty" patchStrategy:"merge,retainKeys" patchMergeKey:"name" protobuf:"bytes,2,rep,name=resourceClaimStatuses"`
-}
-
-// Well-known condition types for PodGroups.
-const (
-	// PodGroupScheduled represents status of the scheduling process for this PodGroup.
-	PodGroupScheduled string = "PodGroupScheduled"
-	// DisruptionTarget indicates the PodGroup is about to be terminated due to disruption
-	// such as preemption.
-	DisruptionTarget string = "DisruptionTarget"
-)
-
-// Well-known condition reasons for PodGroups.
-const (
-	// Unschedulable reason in the PodGroupScheduled condition indicates that the PodGroup cannot be scheduled
-	// due to resource constraints, affinity/anti-affinity rules, or insufficient capacity for the PodGroup.
-	PodGroupReasonUnschedulable string = "Unschedulable"
-	// SchedulerError reason in the PodGroupScheduled condition means that some internal error happens
-	// during scheduling, for example due to nodeAffinity parsing errors.
-	PodGroupReasonSchedulerError string = "SchedulerError"
-	// PreemptionByScheduler reason in the DisruptionTarget condition indicates the PodGroup was preempted
-	// to make room for higher-priority PodGroups or Pods.
-	PodGroupReasonPreemptionByScheduler string = "PreemptionByScheduler"
-)
-
-// PodGroupResourceClaimStatus is stored in the PodGroupStatus for each
-// PodGroupResourceClaim which references a ResourceClaimTemplate. It stores the
-// generated name for the corresponding ResourceClaim.
-type PodGroupResourceClaimStatus struct {
-	// Name uniquely identifies this resource claim inside the PodGroup. This
-	// must match the name of an entry in podgroup.spec.resourceClaims, which
-	// implies that the string must be a DNS_LABEL.
-	//
-	// +required
-	Name string `json:"name" protobuf:"bytes,1,name=name"`
-
-	// ResourceClaimName is the name of the ResourceClaim that was generated for
-	// the PodGroup in the namespace of the PodGroup. If this is unset, then
-	// generating a ResourceClaim was not necessary. The
-	// podgroup.spec.resourceClaims entry can be ignored in this case.
-	//
-	// +optional
-	// +k8s:optional
-	// +k8s:format=k8s-long-name
-	ResourceClaimName *string `json:"resourceClaimName,omitempty" protobuf:"bytes,2,opt,name=resourceClaimName"`
-}
-
-// PodGroupTemplateReference references a PodGroup template defined in some object (e.g. Workload).
-// Exactly one reference must be set.
-// +union
-type PodGroupTemplateReference struct {
-	// Workload references the PodGroupTemplate within the Workload object that was used to create
-	// the PodGroup.
-	//
-	// +optional
-	// +k8s:optional
-	// +k8s:unionMember
-	Workload *WorkloadPodGroupTemplateReference `json:"workload" protobuf:"bytes,1,opt,name=workload"`
-}
-
-// WorkloadPodGroupTemplateReference references the PodGroupTemplate within the Workload object.
-type WorkloadPodGroupTemplateReference struct {
-	// WorkloadName defines the name of the Workload object.
-	//
-	// +required
-	// +k8s:required
-	// +k8s:format=k8s-long-name
-	WorkloadName string `json:"workloadName" protobuf:"bytes,1,opt,name=workloadName"`
-
-	// PodGroupTemplateName defines the PodGroupTemplate name within the Workload object.
-	//
-	// +required
-	// +k8s:required
-	// +k8s:format=k8s-short-name
-	PodGroupTemplateName string `json:"podGroupTemplateName" protobuf:"bytes,2,opt,name=podGroupTemplateName"`
-}
-
-// PodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a PodGroup.
-type PodGroupSchedulingConstraints struct {
-	// Topology defines the topology constraints for the pod group.
-	// Currently only a single topology constraint can be specified. This may change in the future.
-	//
-	// +optional
-	// +k8s:optional
-	// +k8s:maxItems=1
-	// +listType=atomic
-	// +k8s:listType=atomic
-	Topology []TopologyConstraint `json:"topology,omitempty" protobuf:"bytes,1,rep,name=topology"`
-}
-
-// TopologyConstraint defines a topology constraint for a PodGroup.
-type TopologyConstraint struct {
-	// Key specifies the key of the node label representing the topology domain.
-	// All pods within the PodGroup must be colocated within the same domain instance.
-	// Different PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.
-	// Examples: "topology.kubernetes.io/rack"
-	//
-	// +required
-	// +k8s:required
-	// +k8s:format=k8s-label-key
-	Key string `json:"key" protobuf:"bytes,1,opt,name=key"`
-}
diff --git a/vendor/k8s.io/api/scheduling/v1alpha2/types_swagger_doc_generated.go b/vendor/k8s.io/api/scheduling/v1alpha2/types_swagger_doc_generated.go
deleted file mode 100644
index 2dc06b1c6f..0000000000
--- a/vendor/k8s.io/api/scheduling/v1alpha2/types_swagger_doc_generated.go
+++ /dev/null
@@ -1,217 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package v1alpha2
-
-// This file contains a collection of methods that can be used from go-restful to
-// generate Swagger API documentation for its models. Please read this PR for more
-// information on the implementation: https://github.com/emicklei/go-restful/pull/215
-//
-// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if
-// they are on one line! For multiple line or blocks that you want to ignore use ---.
-// Any context after a --- is ignored.
-//
-// Those methods can be generated by using hack/update-codegen.sh
-
-// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
-var map_BasicSchedulingPolicy = map[string]string{
-	"": "BasicSchedulingPolicy indicates that standard Kubernetes scheduling behavior should be used.",
-}
-
-func (BasicSchedulingPolicy) SwaggerDoc() map[string]string {
-	return map_BasicSchedulingPolicy
-}
-
-var map_GangSchedulingPolicy = map[string]string{
-	"":         "GangSchedulingPolicy defines the parameters for gang scheduling.",
-	"minCount": "MinCount is the minimum number of pods that must be schedulable or scheduled at the same time for the scheduler to admit the entire group. It must be a positive integer.",
-}
-
-func (GangSchedulingPolicy) SwaggerDoc() map[string]string {
-	return map_GangSchedulingPolicy
-}
-
-var map_PodGroup = map[string]string{
-	"":         "PodGroup represents a runtime instance of pods grouped together. PodGroups are created by workload controllers (Job, LWS, JobSet, etc...) from Workload.podGroupTemplates. PodGroup API enablement is toggled by the GenericWorkload feature gate.",
-	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
-	"spec":     "Spec defines the desired state of the PodGroup.",
-	"status":   "Status represents the current observed state of the PodGroup.",
-}
-
-func (PodGroup) SwaggerDoc() map[string]string {
-	return map_PodGroup
-}
-
-var map_PodGroupList = map[string]string{
-	"":         "PodGroupList contains a list of PodGroup resources.",
-	"metadata": "Standard list metadata.",
-	"items":    "Items is the list of PodGroups.",
-}
-
-func (PodGroupList) SwaggerDoc() map[string]string {
-	return map_PodGroupList
-}
-
-var map_PodGroupResourceClaim = map[string]string{
-	"":                          "PodGroupResourceClaim references exactly one ResourceClaim, either directly or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim for the PodGroup.\n\nIt adds a name to it that uniquely identifies the ResourceClaim inside the PodGroup. Pods that need access to the ResourceClaim define a matching reference in its own Spec.ResourceClaims. The Pod's claim must match all fields of the PodGroup's claim exactly.",
-	"name":                      "Name uniquely identifies this resource claim inside the PodGroup. This must be a DNS_LABEL.",
-	"resourceClaimName":         "ResourceClaimName is the name of a ResourceClaim object in the same namespace as this PodGroup. The ResourceClaim will be reserved for the PodGroup instead of its individual pods.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must be set.",
-	"resourceClaimTemplateName": "ResourceClaimTemplateName is the name of a ResourceClaimTemplate object in the same namespace as this PodGroup.\n\nThe template will be used to create a new ResourceClaim, which will be bound to this PodGroup. When this PodGroup is deleted, the ResourceClaim will also be deleted. The PodGroup name and resource name, along with a generated component, will be used to form a unique name for the ResourceClaim, which will be recorded in podgroup.status.resourceClaimStatuses.\n\nThis field is immutable and no changes will be made to the corresponding ResourceClaim by the control plane after creating the ResourceClaim.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must be set.",
-}
-
-func (PodGroupResourceClaim) SwaggerDoc() map[string]string {
-	return map_PodGroupResourceClaim
-}
-
-var map_PodGroupResourceClaimStatus = map[string]string{
-	"":                  "PodGroupResourceClaimStatus is stored in the PodGroupStatus for each PodGroupResourceClaim which references a ResourceClaimTemplate. It stores the generated name for the corresponding ResourceClaim.",
-	"name":              "Name uniquely identifies this resource claim inside the PodGroup. This must match the name of an entry in podgroup.spec.resourceClaims, which implies that the string must be a DNS_LABEL.",
-	"resourceClaimName": "ResourceClaimName is the name of the ResourceClaim that was generated for the PodGroup in the namespace of the PodGroup. If this is unset, then generating a ResourceClaim was not necessary. The podgroup.spec.resourceClaims entry can be ignored in this case.",
-}
-
-func (PodGroupResourceClaimStatus) SwaggerDoc() map[string]string {
-	return map_PodGroupResourceClaimStatus
-}
-
-var map_PodGroupSchedulingConstraints = map[string]string{
-	"":         "PodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a PodGroup.",
-	"topology": "Topology defines the topology constraints for the pod group. Currently only a single topology constraint can be specified. This may change in the future.",
-}
-
-func (PodGroupSchedulingConstraints) SwaggerDoc() map[string]string {
-	return map_PodGroupSchedulingConstraints
-}
-
-var map_PodGroupSchedulingPolicy = map[string]string{
-	"":      "PodGroupSchedulingPolicy defines the scheduling configuration for a PodGroup. Exactly one policy must be set.",
-	"basic": "Basic specifies that the pods in this group should be scheduled using standard Kubernetes scheduling behavior.",
-	"gang":  "Gang specifies that the pods in this group should be scheduled using all-or-nothing semantics.",
-}
-
-func (PodGroupSchedulingPolicy) SwaggerDoc() map[string]string {
-	return map_PodGroupSchedulingPolicy
-}
-
-var map_PodGroupSpec = map[string]string{
-	"":                      "PodGroupSpec defines the desired state of a PodGroup.",
-	"podGroupTemplateRef":   "PodGroupTemplateRef references an optional PodGroup template within other object (e.g. Workload) that was used to create the PodGroup. This field is immutable.",
-	"schedulingPolicy":      "SchedulingPolicy defines the scheduling policy for this instance of the PodGroup. Controllers are expected to fill this field by copying it from a PodGroupTemplate. This field is immutable.",
-	"schedulingConstraints": "SchedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroup. Controllers are expected to fill this field by copying it from a PodGroupTemplate. This field is immutable. This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.",
-	"resourceClaims":        "ResourceClaims defines which ResourceClaims may be shared among Pods in the group. Pods consume the devices allocated to a PodGroup's claim by defining a claim in its own Spec.ResourceClaims that matches the PodGroup's claim exactly. The claim must have the same name and refer to the same ResourceClaim or ResourceClaimTemplate.\n\nThis is an alpha-level field and requires that the DRAWorkloadResourceClaims feature gate is enabled.\n\nThis field is immutable.",
-	"disruptionMode":        "DisruptionMode defines the mode in which a given PodGroup can be disrupted. Controllers are expected to fill this field by copying it from a PodGroupTemplate. One of Pod, PodGroup. Defaults to Pod if unset. This field is immutable. This field is available only when the WorkloadAwarePreemption feature gate is enabled.",
-	"priorityClassName":     "PriorityClassName defines the priority that should be considered when scheduling this pod group. Controllers are expected to fill this field by copying it from a PodGroupTemplate. Otherwise, it is validated and resolved similarly to the PriorityClassName on PodGroupTemplate (i.e. if no priority class is specified, admission control can set this to the global default priority class if it exists. Otherwise, the pod group's priority will be zero). This field is immutable. This field is available only when the WorkloadAwarePreemption feature gate is enabled.",
-	"priority":              "Priority is the value of priority of this pod group. Various system components use this field to find the priority of the pod group. When Priority Admission Controller is enabled, it prevents users from setting this field. The admission controller populates this field from PriorityClassName. The higher the value, the higher the priority. This field is immutable. This field is available only when the WorkloadAwarePreemption feature gate is enabled.",
-}
-
-func (PodGroupSpec) SwaggerDoc() map[string]string {
-	return map_PodGroupSpec
-}
-
-var map_PodGroupStatus = map[string]string{
-	"":                      "PodGroupStatus represents information about the status of a pod group.",
-	"conditions":            "Conditions represent the latest observations of the PodGroup's state.\n\nKnown condition types: - \"PodGroupScheduled\": Indicates whether the scheduling requirement has been satisfied. - \"DisruptionTarget\": Indicates whether the PodGroup is about to be terminated\n  due to disruption such as preemption.\n\nKnown reasons for the PodGroupScheduled condition: - \"Unschedulable\": The PodGroup cannot be scheduled due to resource constraints,\n  affinity/anti-affinity rules, or insufficient capacity for the gang.\n- \"SchedulerError\": The PodGroup cannot be scheduled due to some internal error\n  that happened during scheduling, for example due to nodeAffinity parsing errors.\n\nKnown reasons for the DisruptionTarget condition: - \"PreemptionByScheduler\": The PodGroup was preempted by the scheduler to make room for\n  higher-priority PodGroups or Pods.",
-	"resourceClaimStatuses": "Status of resource claims.",
-}
-
-func (PodGroupStatus) SwaggerDoc() map[string]string {
-	return map_PodGroupStatus
-}
-
-var map_PodGroupTemplate = map[string]string{
-	"":                      "PodGroupTemplate represents a template for a set of pods with a scheduling policy.",
-	"name":                  "Name is a unique identifier for the PodGroupTemplate within the Workload. It must be a DNS label. This field is immutable.",
-	"schedulingPolicy":      "SchedulingPolicy defines the scheduling policy for this PodGroupTemplate.",
-	"schedulingConstraints": "SchedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroupTemplate. This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.",
-	"resourceClaims":        "ResourceClaims defines which ResourceClaims may be shared among Pods in the group. Pods consume the devices allocated to a PodGroup's claim by defining a claim in its own Spec.ResourceClaims that matches the PodGroup's claim exactly. The claim must have the same name and refer to the same ResourceClaim or ResourceClaimTemplate.\n\nThis is an alpha-level field and requires that the DRAWorkloadResourceClaims feature gate is enabled.\n\nThis field is immutable.",
-	"disruptionMode":        "DisruptionMode defines the mode in which a given PodGroup can be disrupted. One of Pod, PodGroup. This field is available only when the WorkloadAwarePreemption feature gate is enabled.",
-	"priorityClassName":     "PriorityClassName indicates the priority that should be considered when scheduling a pod group created from this template. If no priority class is specified, admission control can set this to the global default priority class if it exists. Otherwise, pod groups created from this template will have the priority set to zero. This field is available only when the WorkloadAwarePreemption feature gate is enabled.",
-	"priority":              "Priority is the value of priority of pod groups created from this template. Various system components use this field to find the priority of the pod group. When Priority Admission Controller is enabled, it prevents users from setting this field. The admission controller populates this field from PriorityClassName. The higher the value, the higher the priority. This field is available only when the WorkloadAwarePreemption feature gate is enabled.",
-}
-
-func (PodGroupTemplate) SwaggerDoc() map[string]string {
-	return map_PodGroupTemplate
-}
-
-var map_PodGroupTemplateReference = map[string]string{
-	"":         "PodGroupTemplateReference references a PodGroup template defined in some object (e.g. Workload). Exactly one reference must be set.",
-	"workload": "Workload references the PodGroupTemplate within the Workload object that was used to create the PodGroup.",
-}
-
-func (PodGroupTemplateReference) SwaggerDoc() map[string]string {
-	return map_PodGroupTemplateReference
-}
-
-var map_TopologyConstraint = map[string]string{
-	"":    "TopologyConstraint defines a topology constraint for a PodGroup.",
-	"key": "Key specifies the key of the node label representing the topology domain. All pods within the PodGroup must be colocated within the same domain instance. Different PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate. Examples: \"topology.kubernetes.io/rack\"",
-}
-
-func (TopologyConstraint) SwaggerDoc() map[string]string {
-	return map_TopologyConstraint
-}
-
-var map_TypedLocalObjectReference = map[string]string{
-	"":         "TypedLocalObjectReference allows to reference typed object inside the same namespace.",
-	"apiGroup": "APIGroup is the group for the resource being referenced. If APIGroup is empty, the specified Kind must be in the core API group. For any other third-party types, setting APIGroup is required. It must be a DNS subdomain.",
-	"kind":     "Kind is the type of resource being referenced. It must be a path segment name.",
-	"name":     "Name is the name of resource being referenced. It must be a path segment name.",
-}
-
-func (TypedLocalObjectReference) SwaggerDoc() map[string]string {
-	return map_TypedLocalObjectReference
-}
-
-var map_Workload = map[string]string{
-	"":         "Workload allows for expressing scheduling constraints that should be used when managing the lifecycle of workloads from the scheduling perspective, including scheduling, preemption, eviction and other phases. Workload API enablement is toggled by the GenericWorkload feature gate.",
-	"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
-	"spec":     "Spec defines the desired behavior of a Workload.",
-}
-
-func (Workload) SwaggerDoc() map[string]string {
-	return map_Workload
-}
-
-var map_WorkloadList = map[string]string{
-	"":         "WorkloadList contains a list of Workload resources.",
-	"metadata": "Standard list metadata.",
-	"items":    "Items is the list of Workloads.",
-}
-
-func (WorkloadList) SwaggerDoc() map[string]string {
-	return map_WorkloadList
-}
-
-var map_WorkloadPodGroupTemplateReference = map[string]string{
-	"":                     "WorkloadPodGroupTemplateReference references the PodGroupTemplate within the Workload object.",
-	"workloadName":         "WorkloadName defines the name of the Workload object.",
-	"podGroupTemplateName": "PodGroupTemplateName defines the PodGroupTemplate name within the Workload object.",
-}
-
-func (WorkloadPodGroupTemplateReference) SwaggerDoc() map[string]string {
-	return map_WorkloadPodGroupTemplateReference
-}
-
-var map_WorkloadSpec = map[string]string{
-	"":                  "WorkloadSpec defines the desired state of a Workload.",
-	"controllerRef":     "ControllerRef is an optional reference to the controlling object, such as a Deployment or Job. This field is intended for use by tools like CLIs to provide a link back to the original workload definition. This field is immutable.",
-	"podGroupTemplates": "PodGroupTemplates is the list of templates that make up the Workload. The maximum number of templates is 8. This field is immutable.",
-}
-
-func (WorkloadSpec) SwaggerDoc() map[string]string {
-	return map_WorkloadSpec
-}
-
-// AUTO-GENERATED FUNCTIONS END HERE
diff --git a/vendor/k8s.io/api/scheduling/v1alpha2/zz_generated.deepcopy.go b/vendor/k8s.io/api/scheduling/v1alpha2/zz_generated.deepcopy.go
deleted file mode 100644
index 901bb0a3ad..0000000000
--- a/vendor/k8s.io/api/scheduling/v1alpha2/zz_generated.deepcopy.go
+++ /dev/null
@@ -1,484 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by deepcopy-gen. DO NOT EDIT.
-
-package v1alpha2
-
-import (
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BasicSchedulingPolicy) DeepCopyInto(out *BasicSchedulingPolicy) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BasicSchedulingPolicy.
-func (in *BasicSchedulingPolicy) DeepCopy() *BasicSchedulingPolicy {
-	if in == nil {
-		return nil
-	}
-	out := new(BasicSchedulingPolicy)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *GangSchedulingPolicy) DeepCopyInto(out *GangSchedulingPolicy) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GangSchedulingPolicy.
-func (in *GangSchedulingPolicy) DeepCopy() *GangSchedulingPolicy {
-	if in == nil {
-		return nil
-	}
-	out := new(GangSchedulingPolicy)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PodGroup) DeepCopyInto(out *PodGroup) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroup.
-func (in *PodGroup) DeepCopy() *PodGroup {
-	if in == nil {
-		return nil
-	}
-	out := new(PodGroup)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PodGroup) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PodGroupList) DeepCopyInto(out *PodGroupList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]PodGroup, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupList.
-func (in *PodGroupList) DeepCopy() *PodGroupList {
-	if in == nil {
-		return nil
-	}
-	out := new(PodGroupList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PodGroupList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PodGroupResourceClaim) DeepCopyInto(out *PodGroupResourceClaim) {
-	*out = *in
-	if in.ResourceClaimName != nil {
-		in, out := &in.ResourceClaimName, &out.ResourceClaimName
-		*out = new(string)
-		**out = **in
-	}
-	if in.ResourceClaimTemplateName != nil {
-		in, out := &in.ResourceClaimTemplateName, &out.ResourceClaimTemplateName
-		*out = new(string)
-		**out = **in
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupResourceClaim.
-func (in *PodGroupResourceClaim) DeepCopy() *PodGroupResourceClaim {
-	if in == nil {
-		return nil
-	}
-	out := new(PodGroupResourceClaim)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PodGroupResourceClaimStatus) DeepCopyInto(out *PodGroupResourceClaimStatus) {
-	*out = *in
-	if in.ResourceClaimName != nil {
-		in, out := &in.ResourceClaimName, &out.ResourceClaimName
-		*out = new(string)
-		**out = **in
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupResourceClaimStatus.
-func (in *PodGroupResourceClaimStatus) DeepCopy() *PodGroupResourceClaimStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(PodGroupResourceClaimStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PodGroupSchedulingConstraints) DeepCopyInto(out *PodGroupSchedulingConstraints) {
-	*out = *in
-	if in.Topology != nil {
-		in, out := &in.Topology, &out.Topology
-		*out = make([]TopologyConstraint, len(*in))
-		copy(*out, *in)
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupSchedulingConstraints.
-func (in *PodGroupSchedulingConstraints) DeepCopy() *PodGroupSchedulingConstraints {
-	if in == nil {
-		return nil
-	}
-	out := new(PodGroupSchedulingConstraints)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PodGroupSchedulingPolicy) DeepCopyInto(out *PodGroupSchedulingPolicy) {
-	*out = *in
-	if in.Basic != nil {
-		in, out := &in.Basic, &out.Basic
-		*out = new(BasicSchedulingPolicy)
-		**out = **in
-	}
-	if in.Gang != nil {
-		in, out := &in.Gang, &out.Gang
-		*out = new(GangSchedulingPolicy)
-		**out = **in
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupSchedulingPolicy.
-func (in *PodGroupSchedulingPolicy) DeepCopy() *PodGroupSchedulingPolicy {
-	if in == nil {
-		return nil
-	}
-	out := new(PodGroupSchedulingPolicy)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PodGroupSpec) DeepCopyInto(out *PodGroupSpec) {
-	*out = *in
-	if in.PodGroupTemplateRef != nil {
-		in, out := &in.PodGroupTemplateRef, &out.PodGroupTemplateRef
-		*out = new(PodGroupTemplateReference)
-		(*in).DeepCopyInto(*out)
-	}
-	in.SchedulingPolicy.DeepCopyInto(&out.SchedulingPolicy)
-	if in.SchedulingConstraints != nil {
-		in, out := &in.SchedulingConstraints, &out.SchedulingConstraints
-		*out = new(PodGroupSchedulingConstraints)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ResourceClaims != nil {
-		in, out := &in.ResourceClaims, &out.ResourceClaims
-		*out = make([]PodGroupResourceClaim, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.DisruptionMode != nil {
-		in, out := &in.DisruptionMode, &out.DisruptionMode
-		*out = new(DisruptionMode)
-		**out = **in
-	}
-	if in.Priority != nil {
-		in, out := &in.Priority, &out.Priority
-		*out = new(int32)
-		**out = **in
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupSpec.
-func (in *PodGroupSpec) DeepCopy() *PodGroupSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(PodGroupSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PodGroupStatus) DeepCopyInto(out *PodGroupStatus) {
-	*out = *in
-	if in.Conditions != nil {
-		in, out := &in.Conditions, &out.Conditions
-		*out = make([]v1.Condition, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.ResourceClaimStatuses != nil {
-		in, out := &in.ResourceClaimStatuses, &out.ResourceClaimStatuses
-		*out = make([]PodGroupResourceClaimStatus, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupStatus.
-func (in *PodGroupStatus) DeepCopy() *PodGroupStatus {
-	if in == nil {
-		return nil
-	}
-	out := new(PodGroupStatus)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PodGroupTemplate) DeepCopyInto(out *PodGroupTemplate) {
-	*out = *in
-	in.SchedulingPolicy.DeepCopyInto(&out.SchedulingPolicy)
-	if in.SchedulingConstraints != nil {
-		in, out := &in.SchedulingConstraints, &out.SchedulingConstraints
-		*out = new(PodGroupSchedulingConstraints)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ResourceClaims != nil {
-		in, out := &in.ResourceClaims, &out.ResourceClaims
-		*out = make([]PodGroupResourceClaim, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	if in.DisruptionMode != nil {
-		in, out := &in.DisruptionMode, &out.DisruptionMode
-		*out = new(DisruptionMode)
-		**out = **in
-	}
-	if in.Priority != nil {
-		in, out := &in.Priority, &out.Priority
-		*out = new(int32)
-		**out = **in
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupTemplate.
-func (in *PodGroupTemplate) DeepCopy() *PodGroupTemplate {
-	if in == nil {
-		return nil
-	}
-	out := new(PodGroupTemplate)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PodGroupTemplateReference) DeepCopyInto(out *PodGroupTemplateReference) {
-	*out = *in
-	if in.Workload != nil {
-		in, out := &in.Workload, &out.Workload
-		*out = new(WorkloadPodGroupTemplateReference)
-		**out = **in
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupTemplateReference.
-func (in *PodGroupTemplateReference) DeepCopy() *PodGroupTemplateReference {
-	if in == nil {
-		return nil
-	}
-	out := new(PodGroupTemplateReference)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TopologyConstraint) DeepCopyInto(out *TopologyConstraint) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TopologyConstraint.
-func (in *TopologyConstraint) DeepCopy() *TopologyConstraint {
-	if in == nil {
-		return nil
-	}
-	out := new(TopologyConstraint)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TypedLocalObjectReference) DeepCopyInto(out *TypedLocalObjectReference) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TypedLocalObjectReference.
-func (in *TypedLocalObjectReference) DeepCopy() *TypedLocalObjectReference {
-	if in == nil {
-		return nil
-	}
-	out := new(TypedLocalObjectReference)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Workload) DeepCopyInto(out *Workload) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Workload.
-func (in *Workload) DeepCopy() *Workload {
-	if in == nil {
-		return nil
-	}
-	out := new(Workload)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Workload) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WorkloadList) DeepCopyInto(out *WorkloadList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		in, out := &in.Items, &out.Items
-		*out = make([]Workload, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadList.
-func (in *WorkloadList) DeepCopy() *WorkloadList {
-	if in == nil {
-		return nil
-	}
-	out := new(WorkloadList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *WorkloadList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WorkloadPodGroupTemplateReference) DeepCopyInto(out *WorkloadPodGroupTemplateReference) {
-	*out = *in
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadPodGroupTemplateReference.
-func (in *WorkloadPodGroupTemplateReference) DeepCopy() *WorkloadPodGroupTemplateReference {
-	if in == nil {
-		return nil
-	}
-	out := new(WorkloadPodGroupTemplateReference)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *WorkloadSpec) DeepCopyInto(out *WorkloadSpec) {
-	*out = *in
-	if in.ControllerRef != nil {
-		in, out := &in.ControllerRef, &out.ControllerRef
-		*out = new(TypedLocalObjectReference)
-		**out = **in
-	}
-	if in.PodGroupTemplates != nil {
-		in, out := &in.PodGroupTemplates, &out.PodGroupTemplates
-		*out = make([]PodGroupTemplate, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadSpec.
-func (in *WorkloadSpec) DeepCopy() *WorkloadSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(WorkloadSpec)
-	in.DeepCopyInto(out)
-	return out
-}
diff --git a/vendor/k8s.io/api/scheduling/v1alpha2/zz_generated.model_name.go b/vendor/k8s.io/api/scheduling/v1alpha2/zz_generated.model_name.go
deleted file mode 100644
index 1b7effea96..0000000000
--- a/vendor/k8s.io/api/scheduling/v1alpha2/zz_generated.model_name.go
+++ /dev/null
@@ -1,112 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by openapi-gen. DO NOT EDIT.
-
-package v1alpha2
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in BasicSchedulingPolicy) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.BasicSchedulingPolicy"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in GangSchedulingPolicy) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.GangSchedulingPolicy"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in PodGroup) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.PodGroup"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in PodGroupList) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.PodGroupList"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in PodGroupResourceClaim) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.PodGroupResourceClaim"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in PodGroupResourceClaimStatus) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.PodGroupResourceClaimStatus"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in PodGroupSchedulingConstraints) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.PodGroupSchedulingConstraints"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in PodGroupSchedulingPolicy) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.PodGroupSchedulingPolicy"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in PodGroupSpec) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.PodGroupSpec"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in PodGroupStatus) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.PodGroupStatus"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in PodGroupTemplate) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.PodGroupTemplate"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in PodGroupTemplateReference) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.PodGroupTemplateReference"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in TopologyConstraint) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.TopologyConstraint"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in TypedLocalObjectReference) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.TypedLocalObjectReference"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in Workload) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.Workload"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in WorkloadList) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.WorkloadList"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in WorkloadPodGroupTemplateReference) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.WorkloadPodGroupTemplateReference"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in WorkloadSpec) OpenAPIModelName() string {
-	return "io.k8s.api.scheduling.v1alpha2.WorkloadSpec"
-}
diff --git a/vendor/k8s.io/api/scheduling/v1alpha3/doc.go b/vendor/k8s.io/api/scheduling/v1alpha3/doc.go
new file mode 100644
index 0000000000..d2e7419d68
--- /dev/null
+++ b/vendor/k8s.io/api/scheduling/v1alpha3/doc.go
@@ -0,0 +1,37 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:deepcopy-gen=package
+// +k8s:protobuf-gen=package
+// +k8s:openapi-gen=true
+// +k8s:openapi-model-package=io.k8s.api.scheduling.v1alpha3
+
+// +groupName=scheduling.k8s.io
+
+// +k8s:validation-gen=*
+// +k8s:validation-gen-input=k8s.io/api/scheduling/v1alpha3
+// +k8s:validation-gen-scheme-registry=nil
+
+// A non-registering copy of the declarative validation is generated in this
+// package so out-of-tree consumers can run the same validation the
+// kube-apiserver enforces without importing k8s.io/kubernetes/pkg or mutating
+// a shared scheme on import. The registered copy lives in
+// k8s.io/kubernetes/pkg/apis/scheduling/v1alpha3.
+// The `*` selector generates validators for all types, including the
+// WorkloadPodGroup* building blocks that are not reachable from a TypeMeta
+// root.
+
+package v1alpha3
diff --git a/vendor/k8s.io/api/scheduling/v1alpha3/generated.pb.go b/vendor/k8s.io/api/scheduling/v1alpha3/generated.pb.go
new file mode 100644
index 0000000000..5c56e7bc94
--- /dev/null
+++ b/vendor/k8s.io/api/scheduling/v1alpha3/generated.pb.go
@@ -0,0 +1,8927 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/api/scheduling/v1alpha3/generated.proto
+
+package v1alpha3
+
+import (
+	fmt "fmt"
+
+	io "io"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	math_bits "math/bits"
+	reflect "reflect"
+	strings "strings"
+)
+
+func (m *AllCompositeDisruptionMode) Reset() { *m = AllCompositeDisruptionMode{} }
+
+func (m *AllDisruptionMode) Reset() { *m = AllDisruptionMode{} }
+
+func (m *BasicSchedulingPolicy) Reset() { *m = BasicSchedulingPolicy{} }
+
+func (m *CompositeBasicSchedulingPolicy) Reset() { *m = CompositeBasicSchedulingPolicy{} }
+
+func (m *CompositeDisruptionMode) Reset() { *m = CompositeDisruptionMode{} }
+
+func (m *CompositeGangSchedulingPolicy) Reset() { *m = CompositeGangSchedulingPolicy{} }
+
+func (m *CompositePodGroup) Reset() { *m = CompositePodGroup{} }
+
+func (m *CompositePodGroupList) Reset() { *m = CompositePodGroupList{} }
+
+func (m *CompositePodGroupSchedulingConstraints) Reset() {
+	*m = CompositePodGroupSchedulingConstraints{}
+}
+
+func (m *CompositePodGroupSchedulingPolicy) Reset() { *m = CompositePodGroupSchedulingPolicy{} }
+
+func (m *CompositePodGroupSpec) Reset() { *m = CompositePodGroupSpec{} }
+
+func (m *CompositePodGroupStatus) Reset() { *m = CompositePodGroupStatus{} }
+
+func (m *CompositePodGroupTemplate) Reset() { *m = CompositePodGroupTemplate{} }
+
+func (m *DisruptionMode) Reset() { *m = DisruptionMode{} }
+
+func (m *GangSchedulingPolicy) Reset() { *m = GangSchedulingPolicy{} }
+
+func (m *PodGroup) Reset() { *m = PodGroup{} }
+
+func (m *PodGroupList) Reset() { *m = PodGroupList{} }
+
+func (m *PodGroupResourceClaim) Reset() { *m = PodGroupResourceClaim{} }
+
+func (m *PodGroupResourceClaimStatus) Reset() { *m = PodGroupResourceClaimStatus{} }
+
+func (m *PodGroupSchedulingConstraints) Reset() { *m = PodGroupSchedulingConstraints{} }
+
+func (m *PodGroupSchedulingPolicy) Reset() { *m = PodGroupSchedulingPolicy{} }
+
+func (m *PodGroupSpec) Reset() { *m = PodGroupSpec{} }
+
+func (m *PodGroupStatus) Reset() { *m = PodGroupStatus{} }
+
+func (m *PodGroupTemplate) Reset() { *m = PodGroupTemplate{} }
+
+func (m *SingleCompositeDisruptionMode) Reset() { *m = SingleCompositeDisruptionMode{} }
+
+func (m *SingleDisruptionMode) Reset() { *m = SingleDisruptionMode{} }
+
+func (m *TopologyConstraint) Reset() { *m = TopologyConstraint{} }
+
+func (m *TypedLocalObjectReference) Reset() { *m = TypedLocalObjectReference{} }
+
+func (m *Workload) Reset() { *m = Workload{} }
+
+func (m *WorkloadCompositePodGroupAllDisruptionMode) Reset() {
+	*m = WorkloadCompositePodGroupAllDisruptionMode{}
+}
+
+func (m *WorkloadCompositePodGroupBasicSchedulingPolicy) Reset() {
+	*m = WorkloadCompositePodGroupBasicSchedulingPolicy{}
+}
+
+func (m *WorkloadCompositePodGroupDisruptionMode) Reset() {
+	*m = WorkloadCompositePodGroupDisruptionMode{}
+}
+
+func (m *WorkloadCompositePodGroupGangSchedulingPolicy) Reset() {
+	*m = WorkloadCompositePodGroupGangSchedulingPolicy{}
+}
+
+func (m *WorkloadCompositePodGroupSchedulingConstraints) Reset() {
+	*m = WorkloadCompositePodGroupSchedulingConstraints{}
+}
+
+func (m *WorkloadCompositePodGroupSchedulingPolicy) Reset() {
+	*m = WorkloadCompositePodGroupSchedulingPolicy{}
+}
+
+func (m *WorkloadCompositePodGroupSingleDisruptionMode) Reset() {
+	*m = WorkloadCompositePodGroupSingleDisruptionMode{}
+}
+
+func (m *WorkloadList) Reset() { *m = WorkloadList{} }
+
+func (m *WorkloadPodGroupAllDisruptionMode) Reset() { *m = WorkloadPodGroupAllDisruptionMode{} }
+
+func (m *WorkloadPodGroupBasicSchedulingPolicy) Reset() { *m = WorkloadPodGroupBasicSchedulingPolicy{} }
+
+func (m *WorkloadPodGroupDisruptionMode) Reset() { *m = WorkloadPodGroupDisruptionMode{} }
+
+func (m *WorkloadPodGroupGangSchedulingPolicy) Reset() { *m = WorkloadPodGroupGangSchedulingPolicy{} }
+
+func (m *WorkloadPodGroupResourceClaim) Reset() { *m = WorkloadPodGroupResourceClaim{} }
+
+func (m *WorkloadPodGroupSchedulingConstraints) Reset() { *m = WorkloadPodGroupSchedulingConstraints{} }
+
+func (m *WorkloadPodGroupSchedulingPolicy) Reset() { *m = WorkloadPodGroupSchedulingPolicy{} }
+
+func (m *WorkloadPodGroupSingleDisruptionMode) Reset() { *m = WorkloadPodGroupSingleDisruptionMode{} }
+
+func (m *WorkloadReference) Reset() { *m = WorkloadReference{} }
+
+func (m *WorkloadSpec) Reset() { *m = WorkloadSpec{} }
+
+func (m *AllCompositeDisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AllCompositeDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AllCompositeDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *AllDisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AllDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AllDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *BasicSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *BasicSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *BasicSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *CompositeBasicSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CompositeBasicSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CompositeBasicSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *CompositeDisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CompositeDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CompositeDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.All != nil {
+		{
+			size, err := m.All.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Single != nil {
+		{
+			size, err := m.Single.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CompositeGangSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CompositeGangSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CompositeGangSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i = encodeVarintGenerated(dAtA, i, uint64(m.MinGroupCount))
+	i--
+	dAtA[i] = 0x8
+	return len(dAtA) - i, nil
+}
+
+func (m *CompositePodGroup) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CompositePodGroup) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CompositePodGroup) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *CompositePodGroupList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CompositePodGroupList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CompositePodGroupList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *CompositePodGroupSchedulingConstraints) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CompositePodGroupSchedulingConstraints) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CompositePodGroupSchedulingConstraints) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Topology) > 0 {
+		for iNdEx := len(m.Topology) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Topology[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CompositePodGroupSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CompositePodGroupSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CompositePodGroupSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.Gang != nil {
+		{
+			size, err := m.Gang.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Basic != nil {
+		{
+			size, err := m.Basic.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CompositePodGroupSpec) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CompositePodGroupSpec) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CompositePodGroupSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.PreemptionPolicy != nil {
+		i -= len(*m.PreemptionPolicy)
+		copy(dAtA[i:], *m.PreemptionPolicy)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.PreemptionPolicy)))
+		i--
+		dAtA[i] = 0x42
+	}
+	if m.Priority != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.Priority))
+		i--
+		dAtA[i] = 0x38
+	}
+	i -= len(m.PriorityClassName)
+	copy(dAtA[i:], m.PriorityClassName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.PriorityClassName)))
+	i--
+	dAtA[i] = 0x32
+	if m.DisruptionMode != nil {
+		{
+			size, err := m.DisruptionMode.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.SchedulingConstraints != nil {
+		{
+			size, err := m.SchedulingConstraints.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	{
+		size, err := m.SchedulingPolicy.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	if m.WorkloadRef != nil {
+		{
+			size, err := m.WorkloadRef.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.ParentCompositePodGroupName != nil {
+		i -= len(*m.ParentCompositePodGroupName)
+		copy(dAtA[i:], *m.ParentCompositePodGroupName)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ParentCompositePodGroupName)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CompositePodGroupStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CompositePodGroupStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CompositePodGroupStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Conditions) > 0 {
+		for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CompositePodGroupTemplate) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CompositePodGroupTemplate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CompositePodGroupTemplate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.CompositePodGroupTemplates) > 0 {
+		for iNdEx := len(m.CompositePodGroupTemplates) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.CompositePodGroupTemplates[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x4a
+		}
+	}
+	if len(m.PodGroupTemplates) > 0 {
+		for iNdEx := len(m.PodGroupTemplates) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.PodGroupTemplates[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x42
+		}
+	}
+	if m.PreemptionPolicy != nil {
+		i -= len(*m.PreemptionPolicy)
+		copy(dAtA[i:], *m.PreemptionPolicy)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.PreemptionPolicy)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if m.Priority != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.Priority))
+		i--
+		dAtA[i] = 0x30
+	}
+	i -= len(m.PriorityClassName)
+	copy(dAtA[i:], m.PriorityClassName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.PriorityClassName)))
+	i--
+	dAtA[i] = 0x2a
+	if m.DisruptionMode != nil {
+		{
+			size, err := m.DisruptionMode.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.SchedulingConstraints != nil {
+		{
+			size, err := m.SchedulingConstraints.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	{
+		size, err := m.SchedulingPolicy.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *DisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *DisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.All != nil {
+		{
+			size, err := m.All.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Single != nil {
+		{
+			size, err := m.Single.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *GangSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GangSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GangSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i = encodeVarintGenerated(dAtA, i, uint64(m.MinCount))
+	i--
+	dAtA[i] = 0x8
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroup) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroup) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroup) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupResourceClaim) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupResourceClaim) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupResourceClaim) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.ResourceClaimTemplateName != nil {
+		i -= len(*m.ResourceClaimTemplateName)
+		copy(dAtA[i:], *m.ResourceClaimTemplateName)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ResourceClaimTemplateName)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.ResourceClaimName != nil {
+		i -= len(*m.ResourceClaimName)
+		copy(dAtA[i:], *m.ResourceClaimName)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ResourceClaimName)))
+		i--
+		dAtA[i] = 0x12
+	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupResourceClaimStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupResourceClaimStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupResourceClaimStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.ResourceClaimName != nil {
+		i -= len(*m.ResourceClaimName)
+		copy(dAtA[i:], *m.ResourceClaimName)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ResourceClaimName)))
+		i--
+		dAtA[i] = 0x12
+	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupSchedulingConstraints) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupSchedulingConstraints) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupSchedulingConstraints) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Topology) > 0 {
+		for iNdEx := len(m.Topology) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Topology[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.Gang != nil {
+		{
+			size, err := m.Gang.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Basic != nil {
+		{
+			size, err := m.Basic.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupSpec) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupSpec) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.PreemptionPolicy != nil {
+		i -= len(*m.PreemptionPolicy)
+		copy(dAtA[i:], *m.PreemptionPolicy)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.PreemptionPolicy)))
+		i--
+		dAtA[i] = 0x4a
+	}
+	if m.Priority != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.Priority))
+		i--
+		dAtA[i] = 0x40
+	}
+	i -= len(m.PriorityClassName)
+	copy(dAtA[i:], m.PriorityClassName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.PriorityClassName)))
+	i--
+	dAtA[i] = 0x3a
+	if m.DisruptionMode != nil {
+		{
+			size, err := m.DisruptionMode.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.ResourceClaims) > 0 {
+		for iNdEx := len(m.ResourceClaims) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ResourceClaims[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x2a
+		}
+	}
+	if m.SchedulingConstraints != nil {
+		{
+			size, err := m.SchedulingConstraints.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	{
+		size, err := m.SchedulingPolicy.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	if m.WorkloadRef != nil {
+		{
+			size, err := m.WorkloadRef.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.ParentCompositePodGroupName != nil {
+		i -= len(*m.ParentCompositePodGroupName)
+		copy(dAtA[i:], *m.ParentCompositePodGroupName)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ParentCompositePodGroupName)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.ResourceClaimStatuses) > 0 {
+		for iNdEx := len(m.ResourceClaimStatuses) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ResourceClaimStatuses[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Conditions) > 0 {
+		for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupTemplate) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupTemplate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupTemplate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.PreemptionPolicy != nil {
+		i -= len(*m.PreemptionPolicy)
+		copy(dAtA[i:], *m.PreemptionPolicy)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.PreemptionPolicy)))
+		i--
+		dAtA[i] = 0x42
+	}
+	if m.Priority != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.Priority))
+		i--
+		dAtA[i] = 0x38
+	}
+	i -= len(m.PriorityClassName)
+	copy(dAtA[i:], m.PriorityClassName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.PriorityClassName)))
+	i--
+	dAtA[i] = 0x32
+	if m.DisruptionMode != nil {
+		{
+			size, err := m.DisruptionMode.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.ResourceClaims) > 0 {
+		for iNdEx := len(m.ResourceClaims) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ResourceClaims[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x22
+		}
+	}
+	if m.SchedulingConstraints != nil {
+		{
+			size, err := m.SchedulingConstraints.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	{
+		size, err := m.SchedulingPolicy.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *SingleCompositeDisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SingleCompositeDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *SingleCompositeDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *SingleDisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SingleDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *SingleDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *TopologyConstraint) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TopologyConstraint) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *TopologyConstraint) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Key)
+	copy(dAtA[i:], m.Key)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Key)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *TypedLocalObjectReference) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TypedLocalObjectReference) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *TypedLocalObjectReference) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.APIGroup)
+	copy(dAtA[i:], m.APIGroup)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.APIGroup)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *Workload) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Workload) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Workload) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadCompositePodGroupAllDisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadCompositePodGroupAllDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadCompositePodGroupAllDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadCompositePodGroupBasicSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadCompositePodGroupBasicSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadCompositePodGroupBasicSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadCompositePodGroupDisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadCompositePodGroupDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadCompositePodGroupDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.All != nil {
+		{
+			size, err := m.All.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Single != nil {
+		{
+			size, err := m.Single.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadCompositePodGroupGangSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadCompositePodGroupGangSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadCompositePodGroupGangSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.MinGroupCount != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.MinGroupCount))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadCompositePodGroupSchedulingConstraints) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadCompositePodGroupSchedulingConstraints) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadCompositePodGroupSchedulingConstraints) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Topology) > 0 {
+		for iNdEx := len(m.Topology) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Topology[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadCompositePodGroupSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadCompositePodGroupSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadCompositePodGroupSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.Gang != nil {
+		{
+			size, err := m.Gang.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Basic != nil {
+		{
+			size, err := m.Basic.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadCompositePodGroupSingleDisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadCompositePodGroupSingleDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadCompositePodGroupSingleDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadPodGroupAllDisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadPodGroupAllDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadPodGroupAllDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadPodGroupBasicSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadPodGroupBasicSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadPodGroupBasicSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadPodGroupDisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadPodGroupDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadPodGroupDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.All != nil {
+		{
+			size, err := m.All.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Single != nil {
+		{
+			size, err := m.Single.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadPodGroupGangSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadPodGroupGangSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadPodGroupGangSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.MinCount != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.MinCount))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadPodGroupResourceClaim) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadPodGroupResourceClaim) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadPodGroupResourceClaim) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.ResourceClaimTemplateName != nil {
+		i -= len(*m.ResourceClaimTemplateName)
+		copy(dAtA[i:], *m.ResourceClaimTemplateName)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ResourceClaimTemplateName)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.ResourceClaimName != nil {
+		i -= len(*m.ResourceClaimName)
+		copy(dAtA[i:], *m.ResourceClaimName)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ResourceClaimName)))
+		i--
+		dAtA[i] = 0x12
+	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadPodGroupSchedulingConstraints) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadPodGroupSchedulingConstraints) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadPodGroupSchedulingConstraints) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Topology) > 0 {
+		for iNdEx := len(m.Topology) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Topology[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadPodGroupSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadPodGroupSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadPodGroupSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.Gang != nil {
+		{
+			size, err := m.Gang.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Basic != nil {
+		{
+			size, err := m.Basic.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadPodGroupSingleDisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadPodGroupSingleDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadPodGroupSingleDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadReference) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadReference) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadReference) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.TemplateName)
+	copy(dAtA[i:], m.TemplateName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.TemplateName)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.WorkloadName)
+	copy(dAtA[i:], m.WorkloadName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.WorkloadName)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadSpec) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadSpec) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.CompositePodGroupTemplates) > 0 {
+		for iNdEx := len(m.CompositePodGroupTemplates) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.CompositePodGroupTemplates[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if len(m.PodGroupTemplates) > 0 {
+		for iNdEx := len(m.PodGroupTemplates) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.PodGroupTemplates[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if m.ControllerRef != nil {
+		{
+			size, err := m.ControllerRef.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *AllCompositeDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *AllDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *BasicSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *CompositeBasicSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *CompositeDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Single != nil {
+		l = m.Single.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.All != nil {
+		l = m.All.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *CompositeGangSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 1 + sovGenerated(uint64(m.MinGroupCount))
+	return n
+}
+
+func (m *CompositePodGroup) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ObjectMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Spec.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *CompositePodGroupList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *CompositePodGroupSchedulingConstraints) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Topology) > 0 {
+		for _, e := range m.Topology {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *CompositePodGroupSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Basic != nil {
+		l = m.Basic.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Gang != nil {
+		l = m.Gang.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *CompositePodGroupSpec) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.ParentCompositePodGroupName != nil {
+		l = len(*m.ParentCompositePodGroupName)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.WorkloadRef != nil {
+		l = m.WorkloadRef.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = m.SchedulingPolicy.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.SchedulingConstraints != nil {
+		l = m.SchedulingConstraints.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.DisruptionMode != nil {
+		l = m.DisruptionMode.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = len(m.PriorityClassName)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Priority != nil {
+		n += 1 + sovGenerated(uint64(*m.Priority))
+	}
+	if m.PreemptionPolicy != nil {
+		l = len(*m.PreemptionPolicy)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *CompositePodGroupStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Conditions) > 0 {
+		for _, e := range m.Conditions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *CompositePodGroupTemplate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.SchedulingPolicy.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.SchedulingConstraints != nil {
+		l = m.SchedulingConstraints.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.DisruptionMode != nil {
+		l = m.DisruptionMode.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = len(m.PriorityClassName)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Priority != nil {
+		n += 1 + sovGenerated(uint64(*m.Priority))
+	}
+	if m.PreemptionPolicy != nil {
+		l = len(*m.PreemptionPolicy)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.PodGroupTemplates) > 0 {
+		for _, e := range m.PodGroupTemplates {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.CompositePodGroupTemplates) > 0 {
+		for _, e := range m.CompositePodGroupTemplates {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *DisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Single != nil {
+		l = m.Single.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.All != nil {
+		l = m.All.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *GangSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 1 + sovGenerated(uint64(m.MinCount))
+	return n
+}
+
+func (m *PodGroup) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ObjectMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Spec.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *PodGroupList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *PodGroupResourceClaim) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.ResourceClaimName != nil {
+		l = len(*m.ResourceClaimName)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.ResourceClaimTemplateName != nil {
+		l = len(*m.ResourceClaimTemplateName)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *PodGroupResourceClaimStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.ResourceClaimName != nil {
+		l = len(*m.ResourceClaimName)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *PodGroupSchedulingConstraints) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Topology) > 0 {
+		for _, e := range m.Topology {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *PodGroupSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Basic != nil {
+		l = m.Basic.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Gang != nil {
+		l = m.Gang.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *PodGroupSpec) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.ParentCompositePodGroupName != nil {
+		l = len(*m.ParentCompositePodGroupName)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.WorkloadRef != nil {
+		l = m.WorkloadRef.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = m.SchedulingPolicy.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.SchedulingConstraints != nil {
+		l = m.SchedulingConstraints.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.ResourceClaims) > 0 {
+		for _, e := range m.ResourceClaims {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if m.DisruptionMode != nil {
+		l = m.DisruptionMode.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = len(m.PriorityClassName)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Priority != nil {
+		n += 1 + sovGenerated(uint64(*m.Priority))
+	}
+	if m.PreemptionPolicy != nil {
+		l = len(*m.PreemptionPolicy)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *PodGroupStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Conditions) > 0 {
+		for _, e := range m.Conditions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.ResourceClaimStatuses) > 0 {
+		for _, e := range m.ResourceClaimStatuses {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *PodGroupTemplate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.SchedulingPolicy.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.SchedulingConstraints != nil {
+		l = m.SchedulingConstraints.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.ResourceClaims) > 0 {
+		for _, e := range m.ResourceClaims {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if m.DisruptionMode != nil {
+		l = m.DisruptionMode.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = len(m.PriorityClassName)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Priority != nil {
+		n += 1 + sovGenerated(uint64(*m.Priority))
+	}
+	if m.PreemptionPolicy != nil {
+		l = len(*m.PreemptionPolicy)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *SingleCompositeDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *SingleDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *TopologyConstraint) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Key)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *TypedLocalObjectReference) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.APIGroup)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *Workload) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ObjectMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Spec.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *WorkloadCompositePodGroupAllDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *WorkloadCompositePodGroupBasicSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *WorkloadCompositePodGroupDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Single != nil {
+		l = m.Single.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.All != nil {
+		l = m.All.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *WorkloadCompositePodGroupGangSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.MinGroupCount != nil {
+		n += 1 + sovGenerated(uint64(*m.MinGroupCount))
+	}
+	return n
+}
+
+func (m *WorkloadCompositePodGroupSchedulingConstraints) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Topology) > 0 {
+		for _, e := range m.Topology {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *WorkloadCompositePodGroupSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Basic != nil {
+		l = m.Basic.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Gang != nil {
+		l = m.Gang.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *WorkloadCompositePodGroupSingleDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *WorkloadList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *WorkloadPodGroupAllDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *WorkloadPodGroupBasicSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *WorkloadPodGroupDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Single != nil {
+		l = m.Single.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.All != nil {
+		l = m.All.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *WorkloadPodGroupGangSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.MinCount != nil {
+		n += 1 + sovGenerated(uint64(*m.MinCount))
+	}
+	return n
+}
+
+func (m *WorkloadPodGroupResourceClaim) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.ResourceClaimName != nil {
+		l = len(*m.ResourceClaimName)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.ResourceClaimTemplateName != nil {
+		l = len(*m.ResourceClaimTemplateName)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *WorkloadPodGroupSchedulingConstraints) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Topology) > 0 {
+		for _, e := range m.Topology {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *WorkloadPodGroupSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Basic != nil {
+		l = m.Basic.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Gang != nil {
+		l = m.Gang.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *WorkloadPodGroupSingleDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *WorkloadReference) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.WorkloadName)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.TemplateName)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *WorkloadSpec) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.ControllerRef != nil {
+		l = m.ControllerRef.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.PodGroupTemplates) > 0 {
+		for _, e := range m.PodGroupTemplates {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.CompositePodGroupTemplates) > 0 {
+		for _, e := range m.CompositePodGroupTemplates {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozGenerated(x uint64) (n int) {
+	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *AllCompositeDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&AllCompositeDisruptionMode{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *AllDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&AllDisruptionMode{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *BasicSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&BasicSchedulingPolicy{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositeBasicSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CompositeBasicSchedulingPolicy{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositeDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CompositeDisruptionMode{`,
+		`Single:` + strings.Replace(this.Single.String(), "SingleCompositeDisruptionMode", "SingleCompositeDisruptionMode", 1) + `,`,
+		`All:` + strings.Replace(this.All.String(), "AllCompositeDisruptionMode", "AllCompositeDisruptionMode", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositeGangSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CompositeGangSchedulingPolicy{`,
+		`MinGroupCount:` + fmt.Sprintf("%v", this.MinGroupCount) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositePodGroup) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CompositePodGroup{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "CompositePodGroupSpec", "CompositePodGroupSpec", 1), `&`, ``, 1) + `,`,
+		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "CompositePodGroupStatus", "CompositePodGroupStatus", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositePodGroupList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]CompositePodGroup{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "CompositePodGroup", "CompositePodGroup", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&CompositePodGroupList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositePodGroupSchedulingConstraints) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForTopology := "[]TopologyConstraint{"
+	for _, f := range this.Topology {
+		repeatedStringForTopology += strings.Replace(strings.Replace(f.String(), "TopologyConstraint", "TopologyConstraint", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForTopology += "}"
+	s := strings.Join([]string{`&CompositePodGroupSchedulingConstraints{`,
+		`Topology:` + repeatedStringForTopology + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositePodGroupSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CompositePodGroupSchedulingPolicy{`,
+		`Basic:` + strings.Replace(this.Basic.String(), "CompositeBasicSchedulingPolicy", "CompositeBasicSchedulingPolicy", 1) + `,`,
+		`Gang:` + strings.Replace(this.Gang.String(), "CompositeGangSchedulingPolicy", "CompositeGangSchedulingPolicy", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositePodGroupSpec) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CompositePodGroupSpec{`,
+		`ParentCompositePodGroupName:` + valueToStringGenerated(this.ParentCompositePodGroupName) + `,`,
+		`WorkloadRef:` + strings.Replace(this.WorkloadRef.String(), "WorkloadReference", "WorkloadReference", 1) + `,`,
+		`SchedulingPolicy:` + strings.Replace(strings.Replace(this.SchedulingPolicy.String(), "CompositePodGroupSchedulingPolicy", "CompositePodGroupSchedulingPolicy", 1), `&`, ``, 1) + `,`,
+		`SchedulingConstraints:` + strings.Replace(this.SchedulingConstraints.String(), "CompositePodGroupSchedulingConstraints", "CompositePodGroupSchedulingConstraints", 1) + `,`,
+		`DisruptionMode:` + strings.Replace(this.DisruptionMode.String(), "CompositeDisruptionMode", "CompositeDisruptionMode", 1) + `,`,
+		`PriorityClassName:` + fmt.Sprintf("%v", this.PriorityClassName) + `,`,
+		`Priority:` + valueToStringGenerated(this.Priority) + `,`,
+		`PreemptionPolicy:` + valueToStringGenerated(this.PreemptionPolicy) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositePodGroupStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForConditions := "[]Condition{"
+	for _, f := range this.Conditions {
+		repeatedStringForConditions += fmt.Sprintf("%v", f) + ","
+	}
+	repeatedStringForConditions += "}"
+	s := strings.Join([]string{`&CompositePodGroupStatus{`,
+		`Conditions:` + repeatedStringForConditions + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositePodGroupTemplate) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForPodGroupTemplates := "[]PodGroupTemplate{"
+	for _, f := range this.PodGroupTemplates {
+		repeatedStringForPodGroupTemplates += strings.Replace(strings.Replace(f.String(), "PodGroupTemplate", "PodGroupTemplate", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForPodGroupTemplates += "}"
+	repeatedStringForCompositePodGroupTemplates := "[]CompositePodGroupTemplate{"
+	for _, f := range this.CompositePodGroupTemplates {
+		repeatedStringForCompositePodGroupTemplates += strings.Replace(strings.Replace(f.String(), "CompositePodGroupTemplate", "CompositePodGroupTemplate", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForCompositePodGroupTemplates += "}"
+	s := strings.Join([]string{`&CompositePodGroupTemplate{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`SchedulingPolicy:` + strings.Replace(strings.Replace(this.SchedulingPolicy.String(), "CompositePodGroupSchedulingPolicy", "CompositePodGroupSchedulingPolicy", 1), `&`, ``, 1) + `,`,
+		`SchedulingConstraints:` + strings.Replace(this.SchedulingConstraints.String(), "CompositePodGroupSchedulingConstraints", "CompositePodGroupSchedulingConstraints", 1) + `,`,
+		`DisruptionMode:` + strings.Replace(this.DisruptionMode.String(), "CompositeDisruptionMode", "CompositeDisruptionMode", 1) + `,`,
+		`PriorityClassName:` + fmt.Sprintf("%v", this.PriorityClassName) + `,`,
+		`Priority:` + valueToStringGenerated(this.Priority) + `,`,
+		`PreemptionPolicy:` + valueToStringGenerated(this.PreemptionPolicy) + `,`,
+		`PodGroupTemplates:` + repeatedStringForPodGroupTemplates + `,`,
+		`CompositePodGroupTemplates:` + repeatedStringForCompositePodGroupTemplates + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *DisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&DisruptionMode{`,
+		`Single:` + strings.Replace(this.Single.String(), "SingleDisruptionMode", "SingleDisruptionMode", 1) + `,`,
+		`All:` + strings.Replace(this.All.String(), "AllDisruptionMode", "AllDisruptionMode", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *GangSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&GangSchedulingPolicy{`,
+		`MinCount:` + fmt.Sprintf("%v", this.MinCount) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroup) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&PodGroup{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "PodGroupSpec", "PodGroupSpec", 1), `&`, ``, 1) + `,`,
+		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "PodGroupStatus", "PodGroupStatus", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]PodGroup{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "PodGroup", "PodGroup", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&PodGroupList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupResourceClaim) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&PodGroupResourceClaim{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`ResourceClaimName:` + valueToStringGenerated(this.ResourceClaimName) + `,`,
+		`ResourceClaimTemplateName:` + valueToStringGenerated(this.ResourceClaimTemplateName) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupResourceClaimStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&PodGroupResourceClaimStatus{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`ResourceClaimName:` + valueToStringGenerated(this.ResourceClaimName) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupSchedulingConstraints) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForTopology := "[]TopologyConstraint{"
+	for _, f := range this.Topology {
+		repeatedStringForTopology += strings.Replace(strings.Replace(f.String(), "TopologyConstraint", "TopologyConstraint", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForTopology += "}"
+	s := strings.Join([]string{`&PodGroupSchedulingConstraints{`,
+		`Topology:` + repeatedStringForTopology + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&PodGroupSchedulingPolicy{`,
+		`Basic:` + strings.Replace(this.Basic.String(), "BasicSchedulingPolicy", "BasicSchedulingPolicy", 1) + `,`,
+		`Gang:` + strings.Replace(this.Gang.String(), "GangSchedulingPolicy", "GangSchedulingPolicy", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupSpec) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForResourceClaims := "[]PodGroupResourceClaim{"
+	for _, f := range this.ResourceClaims {
+		repeatedStringForResourceClaims += strings.Replace(strings.Replace(f.String(), "PodGroupResourceClaim", "PodGroupResourceClaim", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForResourceClaims += "}"
+	s := strings.Join([]string{`&PodGroupSpec{`,
+		`ParentCompositePodGroupName:` + valueToStringGenerated(this.ParentCompositePodGroupName) + `,`,
+		`WorkloadRef:` + strings.Replace(this.WorkloadRef.String(), "WorkloadReference", "WorkloadReference", 1) + `,`,
+		`SchedulingPolicy:` + strings.Replace(strings.Replace(this.SchedulingPolicy.String(), "PodGroupSchedulingPolicy", "PodGroupSchedulingPolicy", 1), `&`, ``, 1) + `,`,
+		`SchedulingConstraints:` + strings.Replace(this.SchedulingConstraints.String(), "PodGroupSchedulingConstraints", "PodGroupSchedulingConstraints", 1) + `,`,
+		`ResourceClaims:` + repeatedStringForResourceClaims + `,`,
+		`DisruptionMode:` + strings.Replace(this.DisruptionMode.String(), "DisruptionMode", "DisruptionMode", 1) + `,`,
+		`PriorityClassName:` + fmt.Sprintf("%v", this.PriorityClassName) + `,`,
+		`Priority:` + valueToStringGenerated(this.Priority) + `,`,
+		`PreemptionPolicy:` + valueToStringGenerated(this.PreemptionPolicy) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForConditions := "[]Condition{"
+	for _, f := range this.Conditions {
+		repeatedStringForConditions += fmt.Sprintf("%v", f) + ","
+	}
+	repeatedStringForConditions += "}"
+	repeatedStringForResourceClaimStatuses := "[]PodGroupResourceClaimStatus{"
+	for _, f := range this.ResourceClaimStatuses {
+		repeatedStringForResourceClaimStatuses += strings.Replace(strings.Replace(f.String(), "PodGroupResourceClaimStatus", "PodGroupResourceClaimStatus", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForResourceClaimStatuses += "}"
+	s := strings.Join([]string{`&PodGroupStatus{`,
+		`Conditions:` + repeatedStringForConditions + `,`,
+		`ResourceClaimStatuses:` + repeatedStringForResourceClaimStatuses + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupTemplate) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForResourceClaims := "[]PodGroupResourceClaim{"
+	for _, f := range this.ResourceClaims {
+		repeatedStringForResourceClaims += strings.Replace(strings.Replace(f.String(), "PodGroupResourceClaim", "PodGroupResourceClaim", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForResourceClaims += "}"
+	s := strings.Join([]string{`&PodGroupTemplate{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`SchedulingPolicy:` + strings.Replace(strings.Replace(this.SchedulingPolicy.String(), "PodGroupSchedulingPolicy", "PodGroupSchedulingPolicy", 1), `&`, ``, 1) + `,`,
+		`SchedulingConstraints:` + strings.Replace(this.SchedulingConstraints.String(), "PodGroupSchedulingConstraints", "PodGroupSchedulingConstraints", 1) + `,`,
+		`ResourceClaims:` + repeatedStringForResourceClaims + `,`,
+		`DisruptionMode:` + strings.Replace(this.DisruptionMode.String(), "DisruptionMode", "DisruptionMode", 1) + `,`,
+		`PriorityClassName:` + fmt.Sprintf("%v", this.PriorityClassName) + `,`,
+		`Priority:` + valueToStringGenerated(this.Priority) + `,`,
+		`PreemptionPolicy:` + valueToStringGenerated(this.PreemptionPolicy) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SingleCompositeDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SingleCompositeDisruptionMode{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SingleDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SingleDisruptionMode{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *TopologyConstraint) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&TopologyConstraint{`,
+		`Key:` + fmt.Sprintf("%v", this.Key) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *TypedLocalObjectReference) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&TypedLocalObjectReference{`,
+		`APIGroup:` + fmt.Sprintf("%v", this.APIGroup) + `,`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Workload) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Workload{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "WorkloadSpec", "WorkloadSpec", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadCompositePodGroupAllDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WorkloadCompositePodGroupAllDisruptionMode{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadCompositePodGroupBasicSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WorkloadCompositePodGroupBasicSchedulingPolicy{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadCompositePodGroupDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WorkloadCompositePodGroupDisruptionMode{`,
+		`Single:` + strings.Replace(this.Single.String(), "WorkloadCompositePodGroupSingleDisruptionMode", "WorkloadCompositePodGroupSingleDisruptionMode", 1) + `,`,
+		`All:` + strings.Replace(this.All.String(), "WorkloadCompositePodGroupAllDisruptionMode", "WorkloadCompositePodGroupAllDisruptionMode", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadCompositePodGroupGangSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WorkloadCompositePodGroupGangSchedulingPolicy{`,
+		`MinGroupCount:` + valueToStringGenerated(this.MinGroupCount) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadCompositePodGroupSchedulingConstraints) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForTopology := "[]TopologyConstraint{"
+	for _, f := range this.Topology {
+		repeatedStringForTopology += strings.Replace(strings.Replace(f.String(), "TopologyConstraint", "TopologyConstraint", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForTopology += "}"
+	s := strings.Join([]string{`&WorkloadCompositePodGroupSchedulingConstraints{`,
+		`Topology:` + repeatedStringForTopology + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadCompositePodGroupSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WorkloadCompositePodGroupSchedulingPolicy{`,
+		`Basic:` + strings.Replace(this.Basic.String(), "WorkloadCompositePodGroupBasicSchedulingPolicy", "WorkloadCompositePodGroupBasicSchedulingPolicy", 1) + `,`,
+		`Gang:` + strings.Replace(this.Gang.String(), "WorkloadCompositePodGroupGangSchedulingPolicy", "WorkloadCompositePodGroupGangSchedulingPolicy", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadCompositePodGroupSingleDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WorkloadCompositePodGroupSingleDisruptionMode{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]Workload{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "Workload", "Workload", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&WorkloadList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadPodGroupAllDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WorkloadPodGroupAllDisruptionMode{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadPodGroupBasicSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WorkloadPodGroupBasicSchedulingPolicy{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadPodGroupDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WorkloadPodGroupDisruptionMode{`,
+		`Single:` + strings.Replace(this.Single.String(), "WorkloadPodGroupSingleDisruptionMode", "WorkloadPodGroupSingleDisruptionMode", 1) + `,`,
+		`All:` + strings.Replace(this.All.String(), "WorkloadPodGroupAllDisruptionMode", "WorkloadPodGroupAllDisruptionMode", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadPodGroupGangSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WorkloadPodGroupGangSchedulingPolicy{`,
+		`MinCount:` + valueToStringGenerated(this.MinCount) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadPodGroupResourceClaim) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WorkloadPodGroupResourceClaim{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`ResourceClaimName:` + valueToStringGenerated(this.ResourceClaimName) + `,`,
+		`ResourceClaimTemplateName:` + valueToStringGenerated(this.ResourceClaimTemplateName) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadPodGroupSchedulingConstraints) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForTopology := "[]TopologyConstraint{"
+	for _, f := range this.Topology {
+		repeatedStringForTopology += strings.Replace(strings.Replace(f.String(), "TopologyConstraint", "TopologyConstraint", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForTopology += "}"
+	s := strings.Join([]string{`&WorkloadPodGroupSchedulingConstraints{`,
+		`Topology:` + repeatedStringForTopology + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadPodGroupSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WorkloadPodGroupSchedulingPolicy{`,
+		`Basic:` + strings.Replace(this.Basic.String(), "WorkloadPodGroupBasicSchedulingPolicy", "WorkloadPodGroupBasicSchedulingPolicy", 1) + `,`,
+		`Gang:` + strings.Replace(this.Gang.String(), "WorkloadPodGroupGangSchedulingPolicy", "WorkloadPodGroupGangSchedulingPolicy", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadPodGroupSingleDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WorkloadPodGroupSingleDisruptionMode{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadReference) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WorkloadReference{`,
+		`WorkloadName:` + fmt.Sprintf("%v", this.WorkloadName) + `,`,
+		`TemplateName:` + fmt.Sprintf("%v", this.TemplateName) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadSpec) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForPodGroupTemplates := "[]PodGroupTemplate{"
+	for _, f := range this.PodGroupTemplates {
+		repeatedStringForPodGroupTemplates += strings.Replace(strings.Replace(f.String(), "PodGroupTemplate", "PodGroupTemplate", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForPodGroupTemplates += "}"
+	repeatedStringForCompositePodGroupTemplates := "[]CompositePodGroupTemplate{"
+	for _, f := range this.CompositePodGroupTemplates {
+		repeatedStringForCompositePodGroupTemplates += strings.Replace(strings.Replace(f.String(), "CompositePodGroupTemplate", "CompositePodGroupTemplate", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForCompositePodGroupTemplates += "}"
+	s := strings.Join([]string{`&WorkloadSpec{`,
+		`ControllerRef:` + strings.Replace(this.ControllerRef.String(), "TypedLocalObjectReference", "TypedLocalObjectReference", 1) + `,`,
+		`PodGroupTemplates:` + repeatedStringForPodGroupTemplates + `,`,
+		`CompositePodGroupTemplates:` + repeatedStringForCompositePodGroupTemplates + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringGenerated(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *AllCompositeDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AllCompositeDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AllCompositeDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AllDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AllDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AllDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *BasicSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: BasicSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: BasicSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositeBasicSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositeBasicSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositeBasicSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositeDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositeDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositeDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Single", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Single == nil {
+				m.Single = &SingleCompositeDisruptionMode{}
+			}
+			if err := m.Single.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field All", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.All == nil {
+				m.All = &AllCompositeDisruptionMode{}
+			}
+			if err := m.All.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositeGangSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositeGangSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositeGangSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MinGroupCount", wireType)
+			}
+			m.MinGroupCount = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.MinGroupCount |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositePodGroup) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositePodGroup: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositePodGroup: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositePodGroupList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositePodGroupList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositePodGroupList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, CompositePodGroup{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositePodGroupSchedulingConstraints) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositePodGroupSchedulingConstraints: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositePodGroupSchedulingConstraints: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Topology", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Topology = append(m.Topology, TopologyConstraint{})
+			if err := m.Topology[len(m.Topology)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositePodGroupSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositePodGroupSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositePodGroupSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Basic", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Basic == nil {
+				m.Basic = &CompositeBasicSchedulingPolicy{}
+			}
+			if err := m.Basic.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Gang", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Gang == nil {
+				m.Gang = &CompositeGangSchedulingPolicy{}
+			}
+			if err := m.Gang.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositePodGroupSpec) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositePodGroupSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositePodGroupSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ParentCompositePodGroupName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ParentCompositePodGroupName = &s
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadRef", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.WorkloadRef == nil {
+				m.WorkloadRef = &WorkloadReference{}
+			}
+			if err := m.WorkloadRef.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingPolicy", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SchedulingPolicy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingConstraints", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SchedulingConstraints == nil {
+				m.SchedulingConstraints = &CompositePodGroupSchedulingConstraints{}
+			}
+			if err := m.SchedulingConstraints.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DisruptionMode", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.DisruptionMode == nil {
+				m.DisruptionMode = &CompositeDisruptionMode{}
+			}
+			if err := m.DisruptionMode.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PriorityClassName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PriorityClassName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Priority", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Priority = &v
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PreemptionPolicy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := PreemptionPolicy(dAtA[iNdEx:postIndex])
+			m.PreemptionPolicy = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositePodGroupStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositePodGroupStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositePodGroupStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Conditions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Conditions = append(m.Conditions, v1.Condition{})
+			if err := m.Conditions[len(m.Conditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositePodGroupTemplate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositePodGroupTemplate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositePodGroupTemplate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingPolicy", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SchedulingPolicy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingConstraints", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SchedulingConstraints == nil {
+				m.SchedulingConstraints = &CompositePodGroupSchedulingConstraints{}
+			}
+			if err := m.SchedulingConstraints.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DisruptionMode", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.DisruptionMode == nil {
+				m.DisruptionMode = &CompositeDisruptionMode{}
+			}
+			if err := m.DisruptionMode.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PriorityClassName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PriorityClassName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Priority", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Priority = &v
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PreemptionPolicy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := PreemptionPolicy(dAtA[iNdEx:postIndex])
+			m.PreemptionPolicy = &s
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PodGroupTemplates", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PodGroupTemplates = append(m.PodGroupTemplates, PodGroupTemplate{})
+			if err := m.PodGroupTemplates[len(m.PodGroupTemplates)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CompositePodGroupTemplates", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CompositePodGroupTemplates = append(m.CompositePodGroupTemplates, CompositePodGroupTemplate{})
+			if err := m.CompositePodGroupTemplates[len(m.CompositePodGroupTemplates)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Single", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Single == nil {
+				m.Single = &SingleDisruptionMode{}
+			}
+			if err := m.Single.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field All", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.All == nil {
+				m.All = &AllDisruptionMode{}
+			}
+			if err := m.All.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GangSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GangSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GangSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MinCount", wireType)
+			}
+			m.MinCount = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.MinCount |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroup) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroup: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroup: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, PodGroup{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupResourceClaim) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupResourceClaim: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupResourceClaim: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaimName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ResourceClaimName = &s
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaimTemplateName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ResourceClaimTemplateName = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupResourceClaimStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupResourceClaimStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupResourceClaimStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaimName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ResourceClaimName = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupSchedulingConstraints) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupSchedulingConstraints: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupSchedulingConstraints: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Topology", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Topology = append(m.Topology, TopologyConstraint{})
+			if err := m.Topology[len(m.Topology)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Basic", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Basic == nil {
+				m.Basic = &BasicSchedulingPolicy{}
+			}
+			if err := m.Basic.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Gang", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Gang == nil {
+				m.Gang = &GangSchedulingPolicy{}
+			}
+			if err := m.Gang.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupSpec) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ParentCompositePodGroupName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ParentCompositePodGroupName = &s
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadRef", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.WorkloadRef == nil {
+				m.WorkloadRef = &WorkloadReference{}
+			}
+			if err := m.WorkloadRef.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingPolicy", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SchedulingPolicy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingConstraints", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SchedulingConstraints == nil {
+				m.SchedulingConstraints = &PodGroupSchedulingConstraints{}
+			}
+			if err := m.SchedulingConstraints.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaims", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceClaims = append(m.ResourceClaims, PodGroupResourceClaim{})
+			if err := m.ResourceClaims[len(m.ResourceClaims)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DisruptionMode", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.DisruptionMode == nil {
+				m.DisruptionMode = &DisruptionMode{}
+			}
+			if err := m.DisruptionMode.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PriorityClassName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PriorityClassName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Priority", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Priority = &v
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PreemptionPolicy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := PreemptionPolicy(dAtA[iNdEx:postIndex])
+			m.PreemptionPolicy = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Conditions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Conditions = append(m.Conditions, v1.Condition{})
+			if err := m.Conditions[len(m.Conditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaimStatuses", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceClaimStatuses = append(m.ResourceClaimStatuses, PodGroupResourceClaimStatus{})
+			if err := m.ResourceClaimStatuses[len(m.ResourceClaimStatuses)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupTemplate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupTemplate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupTemplate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingPolicy", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SchedulingPolicy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingConstraints", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SchedulingConstraints == nil {
+				m.SchedulingConstraints = &PodGroupSchedulingConstraints{}
+			}
+			if err := m.SchedulingConstraints.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaims", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceClaims = append(m.ResourceClaims, PodGroupResourceClaim{})
+			if err := m.ResourceClaims[len(m.ResourceClaims)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DisruptionMode", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.DisruptionMode == nil {
+				m.DisruptionMode = &DisruptionMode{}
+			}
+			if err := m.DisruptionMode.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PriorityClassName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PriorityClassName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Priority", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Priority = &v
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PreemptionPolicy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := PreemptionPolicy(dAtA[iNdEx:postIndex])
+			m.PreemptionPolicy = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SingleCompositeDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SingleCompositeDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SingleCompositeDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SingleDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SingleDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SingleDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TopologyConstraint) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TopologyConstraint: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TopologyConstraint: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Key = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TypedLocalObjectReference) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TypedLocalObjectReference: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TypedLocalObjectReference: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field APIGroup", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.APIGroup = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Workload) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Workload: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Workload: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadCompositePodGroupAllDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadCompositePodGroupAllDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadCompositePodGroupAllDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadCompositePodGroupBasicSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadCompositePodGroupBasicSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadCompositePodGroupBasicSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadCompositePodGroupDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadCompositePodGroupDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadCompositePodGroupDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Single", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Single == nil {
+				m.Single = &WorkloadCompositePodGroupSingleDisruptionMode{}
+			}
+			if err := m.Single.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field All", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.All == nil {
+				m.All = &WorkloadCompositePodGroupAllDisruptionMode{}
+			}
+			if err := m.All.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadCompositePodGroupGangSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadCompositePodGroupGangSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadCompositePodGroupGangSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MinGroupCount", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.MinGroupCount = &v
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadCompositePodGroupSchedulingConstraints) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadCompositePodGroupSchedulingConstraints: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadCompositePodGroupSchedulingConstraints: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Topology", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Topology = append(m.Topology, TopologyConstraint{})
+			if err := m.Topology[len(m.Topology)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadCompositePodGroupSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadCompositePodGroupSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadCompositePodGroupSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Basic", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Basic == nil {
+				m.Basic = &WorkloadCompositePodGroupBasicSchedulingPolicy{}
+			}
+			if err := m.Basic.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Gang", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Gang == nil {
+				m.Gang = &WorkloadCompositePodGroupGangSchedulingPolicy{}
+			}
+			if err := m.Gang.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadCompositePodGroupSingleDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadCompositePodGroupSingleDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadCompositePodGroupSingleDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, Workload{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadPodGroupAllDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadPodGroupAllDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadPodGroupAllDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadPodGroupBasicSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadPodGroupBasicSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadPodGroupBasicSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadPodGroupDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadPodGroupDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadPodGroupDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Single", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Single == nil {
+				m.Single = &WorkloadPodGroupSingleDisruptionMode{}
+			}
+			if err := m.Single.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field All", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.All == nil {
+				m.All = &WorkloadPodGroupAllDisruptionMode{}
+			}
+			if err := m.All.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadPodGroupGangSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadPodGroupGangSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadPodGroupGangSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MinCount", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.MinCount = &v
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadPodGroupResourceClaim) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadPodGroupResourceClaim: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadPodGroupResourceClaim: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaimName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ResourceClaimName = &s
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaimTemplateName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ResourceClaimTemplateName = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadPodGroupSchedulingConstraints) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadPodGroupSchedulingConstraints: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadPodGroupSchedulingConstraints: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Topology", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Topology = append(m.Topology, TopologyConstraint{})
+			if err := m.Topology[len(m.Topology)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadPodGroupSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadPodGroupSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadPodGroupSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Basic", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Basic == nil {
+				m.Basic = &WorkloadPodGroupBasicSchedulingPolicy{}
+			}
+			if err := m.Basic.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Gang", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Gang == nil {
+				m.Gang = &WorkloadPodGroupGangSchedulingPolicy{}
+			}
+			if err := m.Gang.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadPodGroupSingleDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadPodGroupSingleDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadPodGroupSingleDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadReference) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadReference: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadReference: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.WorkloadName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TemplateName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TemplateName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadSpec) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ControllerRef", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ControllerRef == nil {
+				m.ControllerRef = &TypedLocalObjectReference{}
+			}
+			if err := m.ControllerRef.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PodGroupTemplates", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PodGroupTemplates = append(m.PodGroupTemplates, PodGroupTemplate{})
+			if err := m.PodGroupTemplates[len(m.PodGroupTemplates)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CompositePodGroupTemplates", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CompositePodGroupTemplates = append(m.CompositePodGroupTemplates, CompositePodGroupTemplate{})
+			if err := m.CompositePodGroupTemplates[len(m.CompositePodGroupTemplates)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipGenerated(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLengthGenerated
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupGenerated
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthGenerated
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+var (
+	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
+)
diff --git a/vendor/k8s.io/api/scheduling/v1alpha3/generated.proto b/vendor/k8s.io/api/scheduling/v1alpha3/generated.proto
new file mode 100644
index 0000000000..662b27b43e
--- /dev/null
+++ b/vendor/k8s.io/api/scheduling/v1alpha3/generated.proto
@@ -0,0 +1,1353 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.api.scheduling.v1alpha3;
+
+import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
+import "k8s.io/apimachinery/pkg/runtime/generated.proto";
+import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/api/scheduling/v1alpha3";
+
+// AllCompositeDisruptionMode means that children of a CompositePodGroup can only be
+// disrupted or preempted together.
+message AllCompositeDisruptionMode {
+}
+
+// AllDisruptionMode specifies that children can only be disrupted together.
+message AllDisruptionMode {
+}
+
+// BasicSchedulingPolicy indicates that standard Kubernetes
+// scheduling behavior should be used.
+message BasicSchedulingPolicy {
+}
+
+// CompositeBasicSchedulingPolicy indicates that the groups belonging to the composite group
+// should be scheduled independently.
+message CompositeBasicSchedulingPolicy {
+}
+
+// CompositeDisruptionMode defines how individual entities within a composite pod group can be disrupted.
+// Exactly one mode must be set.
+//
+// +union
+message CompositeDisruptionMode {
+  // single specifies that children groups can be disrupted independently from each other.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional SingleCompositeDisruptionMode single = 1;
+
+  // all specifies that all children groups can only be disrupted together.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional AllCompositeDisruptionMode all = 2;
+}
+
+// CompositeGangSchedulingPolicy indicates that the groups belonging to the composite group
+// should be scheduled using all-or-nothing semantics.
+message CompositeGangSchedulingPolicy {
+  // minGroupCount is the minimum number of child groups that must be schedulable
+  // or scheduled at the same time for the scheduler to admit the entire group.
+  // It must be a positive integer.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:minimum=1
+  optional int32 minGroupCount = 1;
+}
+
+// CompositePodGroup represents a runtime instance of pod groups grouped together.
+// CompositePodGroups are created by workload controllers (LWS, JobSet, etc...) from
+// Workload.compositePodGroupTemplates.
+// CompositePodGroup API enablement is toggled by the CompositePodGroup feature gate.
+message CompositePodGroup {
+  // metadata is the standard object metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
+
+  // spec defines the desired state of the CompositePodGroup.
+  //
+  // +required
+  optional CompositePodGroupSpec spec = 2;
+
+  // status represents the current observed state of the CompositePodGroup.
+  //
+  // +optional
+  optional CompositePodGroupStatus status = 3;
+}
+
+// CompositePodGroupList contains a list of CompositePodGroup resources.
+message CompositePodGroupList {
+  // Standard list metadata.
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
+
+  // Items is the list of CompositePodGroups.
+  repeated CompositePodGroup items = 2;
+}
+
+// CompositePodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a CompositePodGroup.
+message CompositePodGroupSchedulingConstraints {
+  // topology defines the topology constraints for the composite pod group.
+  // Currently only a single topology constraint can be specified. This may change in the future.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:maxItems=1
+  // +listType=atomic
+  // +k8s:listType=atomic
+  repeated TopologyConstraint topology = 1;
+}
+
+// CompositePodGroupSchedulingPolicy defines the scheduling configuration for a CompositePodGroup.
+// Exactly one policy must be set.
+//
+// +union
+message CompositePodGroupSchedulingPolicy {
+  // basic specifies that the groups of this composite group should be scheduled independently.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  // +k8s:unionMember
+  optional CompositeBasicSchedulingPolicy basic = 1;
+
+  // gang specifies that the groups of this composite group should be scheduled using
+  // all-or-nothing semantics.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:update=NoSet
+  // +k8s:update=NoUnset
+  optional CompositeGangSchedulingPolicy gang = 2;
+}
+
+// CompositePodGroupSpec defines the desired state of CompositePodGroup.
+message CompositePodGroupSpec {
+  // parentCompositePodGroupName contains the name of the parent composite pod group
+  // within the same namespace as this composite pod group. It must be a DNS name.
+  // If it's nil, then this composite pod group is a root of a workload's hierarchy.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  // +k8s:format=k8s-long-name
+  optional string parentCompositePodGroupName = 1;
+
+  // workloadRef references an optional CompositePodGroup template within the
+  // Workload object that was used to create the CompositePodGroup.
+  // This field is required.
+  // This field is immutable.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:immutable
+  optional WorkloadReference workloadRef = 2;
+
+  // schedulingPolicy defines the scheduling policy for this instance of the CompositePodGroup.
+  // Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate.
+  // This field is immutable.
+  //
+  // +required
+  // +k8s:immutable
+  optional CompositePodGroupSchedulingPolicy schedulingPolicy = 3;
+
+  // schedulingConstraints defines optional scheduling constraints (e.g. topology) for this CompositePodGroup.
+  // Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional CompositePodGroupSchedulingConstraints schedulingConstraints = 4;
+
+  // disruptionMode defines the mode in which a given CompositePodGroup can be disrupted.
+  // Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate.
+  // One of Single, All. Defaults to Single if unset.
+  // This field is immutable.
+  //
+  // +default={"single": {}}
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional CompositeDisruptionMode disruptionMode = 5;
+
+  // priorityClassName defines the priority that should be considered when scheduling this CompositePodGroup.
+  // Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate.
+  // If left unspecified, it is validated and resolved similarly to the PriorityClassName field in Pods
+  // (i.e. if no priority class is specified, admission control can set this to the global default
+  // priority class if it exists. Otherwise, the composite pod group's priority will be zero).
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:format=k8s-long-name
+  // +k8s:immutable
+  optional string priorityClassName = 6;
+
+  // priority is the value of priority of this composite pod group. Various system components
+  // use this field to find the priority of the composite pod group. When Priority Admission
+  // Controller is enabled, it prevents users from setting this field. The admission
+  // controller populates this field from PriorityClassName.
+  // The higher the value, the higher the priority.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  // +k8s:maximum=1000000000 # HighestUserDefinablePriority
+  optional int32 priority = 7;
+
+  // preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+  // One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset.
+  // When Priority Admission Controller is enabled, it populates this field from PriorityClassName,
+  // and defaults to PreemptLowerPriority if value is unset in PriorityClass.
+  // This field is immutable.
+  // This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+  //
+  // +featureGate=PodGroupPreemptionPolicy
+  // +optional
+  // +k8s:immutable
+  // +k8s:ifDisabled("PodGroupPreemptionPolicy")=+k8s:forbidden
+  // +k8s:ifEnabled("PodGroupPreemptionPolicy")=+k8s:optional
+  optional string preemptionPolicy = 8;
+}
+
+// CompositePodGroupStatus represents information about the status of a composite pod group.
+message CompositePodGroupStatus {
+  // conditions represent the latest observations of the CompositePodGroup's state.
+  //
+  // Known condition types:
+  // - "CompositePodGroupInitiallyScheduled": Indicates whether the overall scheduling requirement
+  //   for the subtree under this CompositePodGroup has been satisfied. Once this condition
+  //   transitions to True, it serves as a terminal state and will never revert to False,
+  //   even if pods are subsequently deleted and group constraints are no longer met.
+  // - "DisruptionTarget": Indicates whether the CompositePodGroup is about to be terminated
+  //   due to disruption such as preemption.
+  //
+  // Known reasons for the CompositePodGroupInitiallyScheduled condition:
+  // - "Unschedulable": The CompositePodGroup's subtree could not be placed due to resource constraints,
+  //   affinity/anti-affinity, or topological constraints.
+  // - "SchedulerError": The CompositePodGroup cannot be scheduled due to some internal error
+  //   that occurred during scheduling.
+  // - "Invalid": Set to True when kube-scheduler detects an invalid group layout during
+  //   runtime validation. The `message` field details the specific layout violation (such as
+  //   a detected cycle, exceeding the maximum depth of 4, or referencing multiple distinct Workloads).
+  //
+  // Known reasons for the DisruptionTarget condition:
+  // - "PreemptionByScheduler": The CompositePodGroup was targeted by the scheduler's preemption loop
+  //   to free up capacity for higher-priority preemptors.
+  //
+  // +optional
+  // +patchMergeKey=type
+  // +patchStrategy=merge
+  // +listType=map
+  // +listMapKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+  repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 1;
+}
+
+// CompositePodGroupTemplate represents a template for a CompositePodGroup with a scheduling policy.
+message CompositePodGroupTemplate {
+  // name is a unique identifier for the CompositePodGroupTemplate within the Workload.
+  // It must be a DNS label. This field is required.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-short-name
+  optional string name = 1;
+
+  // schedulingPolicy defines the scheduling policy for this template.
+  //
+  // +required
+  optional CompositePodGroupSchedulingPolicy schedulingPolicy = 2;
+
+  // schedulingConstraints defines optional scheduling constraints (e.g. topology) for this CompositePodGroupTemplate.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional CompositePodGroupSchedulingConstraints schedulingConstraints = 3;
+
+  // disruptionMode defines the mode in which a given CompositePodGroup can be disrupted.
+  // One of Single, All.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional CompositeDisruptionMode disruptionMode = 4;
+
+  // priorityClassName indicates the priority that should be considered when scheduling
+  // a composite pod group created from this template. If no priority class is specified,
+  // admission control can set this to the global default priority class if it exists.
+  // Otherwise, composite pod groups created from this template will have the priority set
+  // to zero.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:format=k8s-long-name
+  // +k8s:immutable
+  optional string priorityClassName = 5;
+
+  // priority is the value of priority of composite pod groups created from this template.
+  // Various system components use this field to find the priority of the composite pod group.
+  // When Priority Admission Controller is enabled, it prevents users from setting this field.
+  // The admission controller populates this field from PriorityClassName.
+  // The higher the value, the higher the priority.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:maximum=1000000000 # HighestUserDefinablePriority
+  // +k8s:immutable
+  optional int32 priority = 6;
+
+  // preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+  // One of Never, PreemptLowerPriority.
+  // This field is immutable.
+  // This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+  //
+  // +featureGate=PodGroupPreemptionPolicy
+  // +optional
+  // +k8s:immutable
+  // +k8s:ifDisabled("PodGroupPreemptionPolicy")=+k8s:forbidden
+  // +k8s:ifEnabled("PodGroupPreemptionPolicy")=+k8s:optional
+  optional string preemptionPolicy = 7;
+
+  // podGroupTemplates is the list of templates for children PodGroups.
+  // The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates
+  // or PodGroupTemplates must be set.
+  //
+  // +optional
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=8
+  // +k8s:update=NoAddItem
+  // +k8s:update=NoRemoveItem
+  repeated PodGroupTemplate podGroupTemplates = 8;
+
+  // compositePodGroupTemplates is the list of templates for children CompositePodGroups.
+  // The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates
+  // or PodGroupTemplates must be set.
+  //
+  // +optional
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=8
+  // +k8s:update=NoAddItem
+  // +k8s:update=NoRemoveItem
+  repeated CompositePodGroupTemplate compositePodGroupTemplates = 9;
+}
+
+// DisruptionMode defines how individual entities within a group can be disrupted.
+// Exactly one mode can be set.
+//
+// +union
+message DisruptionMode {
+  // single specifies that children can be disrupted independently from each other.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional SingleDisruptionMode single = 1;
+
+  // all specifies that all children can only be disrupted together.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional AllDisruptionMode all = 2;
+}
+
+// GangSchedulingPolicy defines the parameters for gang scheduling.
+message GangSchedulingPolicy {
+  // minCount is the minimum number of pods that must be schedulable or scheduled
+  // at the same time for the scheduler to admit the entire group.
+  // It must be a positive integer. This field is mutable to support workload scaling.
+  //
+  // Note that the scheduler operates on an eventually consistent model. Updates
+  // to minCount may not be immediately reflected in scheduling decisions due to
+  // propagation delays. If minCount is updated while a scheduling cycle is in
+  // progress for that group, the new value may not take effect until the next
+  // cycle. Moreover, minCount is only enforced during scheduling, meaning that
+  // modifications to this field do not affect already-scheduled pods, applying
+  // only to those evaluated in future cycles.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:minimum=1
+  optional int32 minCount = 1;
+}
+
+// PodGroup represents a runtime instance of pods grouped together.
+// PodGroups are created by workload controllers (Job, LWS, JobSet, etc...) from
+// Workload.podGroupTemplates.
+// PodGroup API enablement is toggled by the GenericWorkload feature gate.
+message PodGroup {
+  // metadata is the standard object metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
+
+  // spec defines the desired state of the PodGroup.
+  //
+  // +required
+  optional PodGroupSpec spec = 2;
+
+  // status represents the current observed state of the PodGroup.
+  //
+  // +optional
+  optional PodGroupStatus status = 3;
+}
+
+// PodGroupList contains a list of PodGroup resources.
+message PodGroupList {
+  // Standard list metadata.
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
+
+  // Items is the list of PodGroups.
+  repeated PodGroup items = 2;
+}
+
+// PodGroupResourceClaim references exactly one ResourceClaim, either directly
+// or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim
+// for the PodGroup.
+//
+// It adds a name to it that uniquely identifies the ResourceClaim inside the PodGroup.
+// Pods that need access to the ResourceClaim define a matching reference in its
+// own Spec.ResourceClaims. The Pod's claim must match all fields of the
+// PodGroup's claim exactly.
+message PodGroupResourceClaim {
+  // name uniquely identifies this resource claim inside the PodGroup.
+  // This must be a DNS_LABEL.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-short-name
+  optional string name = 1;
+
+  // resourceClaimName is the name of a ResourceClaim object in the same
+  // namespace as this PodGroup. The ResourceClaim will be reserved for the
+  // PodGroup instead of its individual pods.
+  //
+  // Exactly one of ResourceClaimName and ResourceClaimTemplateName must
+  // be set.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:format=k8s-long-name
+  optional string resourceClaimName = 2;
+
+  // resourceClaimTemplateName is the name of a ResourceClaimTemplate
+  // object in the same namespace as this PodGroup.
+  //
+  // The template will be used to create a new ResourceClaim, which will
+  // be bound to this PodGroup. When this PodGroup is deleted, the ResourceClaim
+  // will also be deleted. The PodGroup name and resource name, along with a
+  // generated component, will be used to form a unique name for the
+  // ResourceClaim, which will be recorded in podgroup.status.resourceClaimStatuses.
+  //
+  // This field is immutable and no changes will be made to the
+  // corresponding ResourceClaim by the control plane after creating the
+  // ResourceClaim.
+  //
+  // Exactly one of ResourceClaimName and ResourceClaimTemplateName must
+  // be set.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:format=k8s-long-name
+  optional string resourceClaimTemplateName = 3;
+}
+
+// PodGroupResourceClaimStatus is stored in the PodGroupStatus for each
+// PodGroupResourceClaim which references a ResourceClaimTemplate. It stores the
+// generated name for the corresponding ResourceClaim.
+message PodGroupResourceClaimStatus {
+  // name uniquely identifies this resource claim inside the PodGroup. This
+  // must match the name of an entry in podgroup.spec.resourceClaims, which
+  // implies that the string must be a DNS_LABEL.
+  //
+  // +required
+  optional string name = 1;
+
+  // resourceClaimName is the name of the ResourceClaim that was generated for
+  // the PodGroup in the namespace of the PodGroup. If this is unset, then
+  // generating a ResourceClaim was not necessary. The
+  // podgroup.spec.resourceClaims entry can be ignored in this case.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:format=k8s-long-name
+  optional string resourceClaimName = 2;
+}
+
+// PodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a PodGroup.
+message PodGroupSchedulingConstraints {
+  // topology defines the topology constraints for the pod group.
+  // Currently only a single topology constraint can be specified. This may change in the future.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:maxItems=1
+  // +listType=atomic
+  // +k8s:listType=atomic
+  repeated TopologyConstraint topology = 1;
+}
+
+// PodGroupSchedulingPolicy defines the scheduling configuration for a PodGroup.
+// Exactly one policy must be set. The policy is chosen at creation time by setting either the
+// Basic or Gang field. The PodGroup may not change policy after creation.
+// Fields within chosen policy may be updated after creation when their individual fields allow it.
+//
+// +union
+message PodGroupSchedulingPolicy {
+  // basic specifies that the pods in this group should be scheduled using
+  // standard Kubernetes scheduling behavior. Setting this field at group creation time
+  // opts this group to basic scheduling; this field cannot be changed afterward.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:immutable
+  optional BasicSchedulingPolicy basic = 1;
+
+  // gang specifies that the pods in this group should be scheduled using
+  // all-or-nothing semantics. Setting this field at group creation time
+  // opts this group to gang scheduling; this field cannot be set or unset afterward.
+  // The minCount field within Gang scheduling policy remains mutable after group creation.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:update=NoSet
+  // +k8s:update=NoUnset
+  optional GangSchedulingPolicy gang = 2;
+}
+
+// PodGroupSpec defines the desired state of a PodGroup.
+message PodGroupSpec {
+  // parentCompositePodGroupName contains the name of the parent composite pod group
+  // within the same namespace as this pod group.
+  // If it's nil, then this pod group is a root of a workload's hierarchy.
+  // This field is used only when the CompositePodGroup feature gate is enabled.
+  // This field is immutable.
+  //
+  // +featureGate=CompositePodGroup
+  // +optional
+  // +k8s:ifDisabled(CompositePodGroup)=+k8s:forbidden
+  // +k8s:ifEnabled(CompositePodGroup)=+k8s:optional
+  // +k8s:immutable
+  // +k8s:format=k8s-long-name
+  // +k8s:alpha(since: "1.37")=+k8s:dependentRequired("workloadRef")
+  optional string parentCompositePodGroupName = 1;
+
+  // workloadRef references an optional PodGroup template within the Workload
+  // object that was used to create the PodGroup.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional WorkloadReference workloadRef = 2;
+
+  // schedulingPolicy defines the scheduling policy for this instance of the PodGroup.
+  // Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+  //
+  // +required
+  optional PodGroupSchedulingPolicy schedulingPolicy = 3;
+
+  // schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroup.
+  // Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+  // This field is immutable.
+  // This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
+  //
+  // +featureGate=TopologyAwareWorkloadScheduling
+  // +optional
+  // +k8s:ifDisabled(TopologyAwareWorkloadScheduling)=+k8s:forbidden
+  // +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:optional
+  // +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:immutable
+  optional PodGroupSchedulingConstraints schedulingConstraints = 4;
+
+  // resourceClaims defines which ResourceClaims may be shared among Pods in
+  // the group. Pods consume the devices allocated to a PodGroup's claim by
+  // defining a claim in its own Spec.ResourceClaims that matches the
+  // PodGroup's claim exactly. The claim must have the same name and refer to
+  // the same ResourceClaim or ResourceClaimTemplate.
+  //
+  // This is a beta-level field and requires that the
+  // DRAWorkloadResourceClaims feature gate is enabled.
+  //
+  // This field is immutable.
+  //
+  // +optional
+  // +patchMergeKey=name
+  // +patchStrategy=merge,retainKeys
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=4
+  // +k8s:immutable
+  // +featureGate=DRAWorkloadResourceClaims
+  repeated PodGroupResourceClaim resourceClaims = 5;
+
+  // disruptionMode defines the mode in which a given PodGroup can be disrupted.
+  // Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+  // One of Single, All. Defaults to Single if unset.
+  // This field is immutable.
+  //
+  // +default={"single": {}}
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional DisruptionMode disruptionMode = 6;
+
+  // priorityClassName defines the priority that should be considered when scheduling this pod group.
+  // Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+  // Otherwise, it is validated and resolved similarly to the PriorityClassName on PodGroupTemplate
+  // (i.e. if no priority class is specified, admission control can set this to the global default
+  // priority class if it exists. Otherwise, the pod group's priority will be zero).
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  // +k8s:format=k8s-long-name
+  optional string priorityClassName = 7;
+
+  // priority is the value of priority of this pod group. Various system components
+  // use this field to find the priority of the pod group. When Priority Admission
+  // Controller is enabled, it prevents users from setting this field. The admission
+  // controller populates this field from PriorityClassName.
+  // The higher the value, the higher the priority.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  // +k8s:maximum=1000000000 # HighestUserDefinablePriority
+  optional int32 priority = 8;
+
+  // preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+  // One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset.
+  // When Priority Admission Controller is enabled, it populates this field from PriorityClassName,
+  // and defaults to PreemptLowerPriority if value is unset in PriorityClass.
+  // This field is immutable.
+  // This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+  //
+  // +featureGate=PodGroupPreemptionPolicy
+  // +optional
+  // +k8s:immutable
+  // +k8s:ifDisabled("PodGroupPreemptionPolicy")=+k8s:forbidden
+  // +k8s:ifEnabled("PodGroupPreemptionPolicy")=+k8s:optional
+  optional string preemptionPolicy = 9;
+}
+
+// PodGroupStatus represents information about the status of a pod group.
+message PodGroupStatus {
+  // conditions represent the latest observations of the PodGroup's state.
+  //
+  // Known condition types:
+  // - "PodGroupInitiallyScheduled": Indicates whether the scheduling requirement has been satisfied.
+  // Once this condition transitions to True, it serves as a terminal state and will never revert to False,
+  // even if pods are subsequently evicted and group constraints are no longer met.
+  // - "DisruptionTarget": Indicates whether the PodGroup is about to be terminated
+  //   due to disruption such as preemption.
+  //
+  // Known reasons for the PodGroupInitiallyScheduled condition:
+  // - "Unschedulable": The PodGroup cannot be scheduled due to resource constraints,
+  //   affinity/anti-affinity rules, or insufficient capacity for the gang.
+  // - "SchedulerError": The PodGroup cannot be scheduled due to some internal error
+  //   that happened during scheduling, for example due to nodeAffinity parsing errors.
+  //
+  // Known reasons for the DisruptionTarget condition:
+  // - "PreemptionByScheduler": The PodGroup was preempted by the scheduler to make room for
+  //   higher-priority PodGroups or Pods.
+  //
+  // +optional
+  // +patchMergeKey=type
+  // +patchStrategy=merge
+  // +listType=map
+  // +listMapKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+  repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 1;
+
+  // resourceClaimStatuses is status of resource claims.
+  // +optional
+  // +patchMergeKey=name
+  // +patchStrategy=merge,retainKeys
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=4
+  // +featureGate=DRAWorkloadResourceClaims
+  repeated PodGroupResourceClaimStatus resourceClaimStatuses = 2;
+}
+
+// PodGroupTemplate represents a template for a set of pods with a scheduling policy.
+message PodGroupTemplate {
+  // name is a unique identifier for the PodGroupTemplate within the Workload.
+  // It must be a DNS label. This field is immutable.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-short-name
+  optional string name = 1;
+
+  // schedulingPolicy defines the scheduling policy for this PodGroupTemplate.
+  //
+  // +required
+  optional PodGroupSchedulingPolicy schedulingPolicy = 2;
+
+  // schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroupTemplate.
+  // This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
+  // This field is immutable.
+  //
+  // +featureGate=TopologyAwareWorkloadScheduling
+  // +optional
+  // +k8s:ifDisabled(TopologyAwareWorkloadScheduling)=+k8s:forbidden
+  // +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:optional
+  // +k8s:immutable
+  optional PodGroupSchedulingConstraints schedulingConstraints = 3;
+
+  // resourceClaims defines which ResourceClaims may be shared among Pods in
+  // the group. Pods consume the devices allocated to a PodGroup's claim by
+  // defining a claim in its own Spec.ResourceClaims that matches the
+  // PodGroup's claim exactly. The claim must have the same name and refer to
+  // the same ResourceClaim or ResourceClaimTemplate.
+  //
+  // This is a beta-level field and requires that the
+  // DRAWorkloadResourceClaims feature gate is enabled.
+  //
+  // This field is immutable.
+  //
+  // +optional
+  // +patchMergeKey=name
+  // +patchStrategy=merge,retainKeys
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=4
+  // +featureGate=DRAWorkloadResourceClaims
+  // +k8s:immutable
+  repeated PodGroupResourceClaim resourceClaims = 4;
+
+  // disruptionMode defines the mode in which a given PodGroup can be disrupted.
+  // One of Single, All.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional DisruptionMode disruptionMode = 5;
+
+  // priorityClassName indicates the priority that should be considered when scheduling
+  // a pod group created from this template.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:format=k8s-long-name
+  // +k8s:immutable
+  optional string priorityClassName = 6;
+
+  // priority is the value of priority of pod groups created from this template. Various
+  // system components use this field to find the priority of the pod group.
+  // The higher the value, the higher the priority.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:maximum=1000000000 # HighestUserDefinablePriority
+  // +k8s:immutable
+  optional int32 priority = 7;
+
+  // preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+  // One of Never, PreemptLowerPriority.
+  // This field is immutable.
+  // This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+  //
+  // +featureGate=PodGroupPreemptionPolicy
+  // +optional
+  // +k8s:immutable
+  // +k8s:ifDisabled("PodGroupPreemptionPolicy")=+k8s:forbidden
+  // +k8s:ifEnabled("PodGroupPreemptionPolicy")=+k8s:optional
+  optional string preemptionPolicy = 8;
+}
+
+// SingleCompositeDisruptionMode means that individual children of a CompositePodGroup
+// can be disrupted or preempted independently.
+message SingleCompositeDisruptionMode {
+}
+
+// SingleDisruptionMode specifies that children can be disrupted independently.
+message SingleDisruptionMode {
+}
+
+// TopologyConstraint defines a topology constraint for a PodGroup.
+message TopologyConstraint {
+  // key specifies the key of the node label representing the topology domain.
+  // All pods within the PodGroup must be colocated within the same domain instance.
+  // Different PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.
+  // Examples: "topology.kubernetes.io/rack"
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-label-key
+  optional string key = 1;
+}
+
+// TypedLocalObjectReference allows to reference typed object inside the same namespace.
+message TypedLocalObjectReference {
+  // apiGroup is the group for the resource being referenced.
+  // If APIGroup is empty, the specified Kind must be in the core API group.
+  // For any other third-party types, setting APIGroup is required.
+  // It must be a DNS subdomain.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:format=k8s-long-name
+  optional string apiGroup = 1;
+
+  // kind is the type of resource being referenced.
+  // It must be a path segment name.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-path-segment-name
+  optional string kind = 2;
+
+  // name is the name of resource being referenced.
+  // It must be a path segment name.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-path-segment-name
+  optional string name = 3;
+}
+
+// Workload allows for expressing scheduling constraints that should be used
+// when managing the lifecycle of workloads from the scheduling perspective,
+// including scheduling, preemption, eviction and other phases.
+// Workload API enablement is toggled by the GenericWorkload feature gate.
+message Workload {
+  // metadata is the standard object metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
+
+  // spec defines the desired behavior of a Workload.
+  //
+  // +required
+  optional WorkloadSpec spec = 2;
+}
+
+// WorkloadCompositePodGroupAllDisruptionMode indicates that all child groups
+// must be disrupted together.
+message WorkloadCompositePodGroupAllDisruptionMode {
+}
+
+// WorkloadCompositePodGroupBasicSchedulingPolicy indicates that the child groups
+// of a composite group should be scheduled independently.
+message WorkloadCompositePodGroupBasicSchedulingPolicy {
+}
+
+// WorkloadCompositePodGroupDisruptionMode defines how the child groups of a
+// composite group can be disrupted. Exactly one mode must be set.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a composite
+// controller's own API, next to its other scheduling fields. It is the
+// group-of-groups analogue of WorkloadPodGroupDisruptionMode. It's recommended
+// to freeze the field after creation (+k8s:immutable), since the selected mode
+// is immutable in the compiled Workload. For example,
+//
+// 	type JobSetSchedulingConfiguration struct {
+// 		// DisruptionMode defines the mode in which this JobSet's child groups
+// 		// can be disrupted.
+// 		// One of Single, All.
+// 		// This field is immutable after creation: it may not be added or removed,
+// 		// and the selected mode may not be changed.
+// 		// +optional
+// 		// +k8s:optional
+// 		// +k8s:immutable
+// 		DisruptionMode *schedulingv1alpha3.WorkloadCompositePodGroupDisruptionMode `json:"disruptionMode,omitempty" protobuf:"bytes,N,opt,name=disruptionMode"`
+//
+// 		// other scheduling fields
+// 	}
+//
+// +union
+message WorkloadCompositePodGroupDisruptionMode {
+  // single specifies that child groups can be disrupted independently from
+  // each other.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional WorkloadCompositePodGroupSingleDisruptionMode single = 1;
+
+  // all specifies that all child groups must be disrupted together.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional WorkloadCompositePodGroupAllDisruptionMode all = 2;
+}
+
+// WorkloadCompositePodGroupGangSchedulingPolicy defines the parameters for gang
+// scheduling of a composite group's child groups.
+message WorkloadCompositePodGroupGangSchedulingPolicy {
+  // minGroupCount is the minimum number of child groups that must be
+  // schedulable at the same time for the scheduler to admit the entire
+  // composite group.
+  // This field is optional. If it is not specified, the controller
+  // should inject a context-specific sane default (e.g., the number of
+  // child groups).
+  // If set, it must be a positive integer.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:minimum=1
+  optional int32 minGroupCount = 1;
+}
+
+// WorkloadCompositePodGroupSchedulingConstraints defines composite-level
+// scheduling constraints, such as topology, for a CompositePodGroup (a group of
+// groups) managed by a workload controller.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a composite
+// controller's own API, next to its other scheduling fields. It is the
+// group-of-groups analogue of WorkloadPodGroupSchedulingConstraints. It's
+// recommended to freeze the field after creation (+k8s:immutable), since
+// constraints are immutable in the compiled Workload. For example,
+//
+// 	type JobSetSchedulingConfiguration struct {
+// 		// SchedulingConstraints defines scheduling constraints (e.g. topology)
+// 		// for this JobSet.
+// 		// This field is immutable after creation.
+// 		// +optional
+// 		// +k8s:optional
+// 		// +k8s:immutable
+// 		SchedulingConstraints *schedulingv1alpha3.WorkloadCompositePodGroupSchedulingConstraints `json:"schedulingConstraints,omitempty" protobuf:"bytes,N,opt,name=schedulingConstraints"`
+//
+// 		// other scheduling fields
+// 	}
+message WorkloadCompositePodGroupSchedulingConstraints {
+  // topology specifies desired topological placements for all child groups
+  // within the composite group.
+  // If unset, no topology placement is requested.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:maxItems=1
+  // +listType=atomic
+  // +k8s:listType=atomic
+  repeated TopologyConstraint topology = 1;
+}
+
+// WorkloadCompositePodGroupSchedulingPolicy defines the scheduling policy for a
+// CompositePodGroup (a group of groups) managed by a workload controller.
+// Exactly one policy must be set.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a composite
+// controller's own API, next to its other scheduling fields. It is the
+// group-of-groups analogue of WorkloadPodGroupSchedulingPolicy. The composite
+// scheduling policy is immutable, so it's recommended to freeze the whole
+// field after creation (+k8s:immutable). For example,
+//
+// 	type JobSetSchedulingConfiguration struct {
+// 		// SchedulingPolicy defines the scheduling policy for this JobSet.
+// 		// Exactly one of Basic or Gang must be set.
+// 		// This field is immutable after creation.
+// 		// +optional
+// 		// +k8s:optional
+// 		// +k8s:immutable
+// 		SchedulingPolicy *schedulingv1alpha3.WorkloadCompositePodGroupSchedulingPolicy `json:"schedulingPolicy,omitempty" protobuf:"bytes,N,opt,name=schedulingPolicy"`
+//
+// 		// other scheduling fields
+// 	}
+//
+// +union
+message WorkloadCompositePodGroupSchedulingPolicy {
+  // basic specifies that the child groups of this composite group should be
+  // scheduled independently.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional WorkloadCompositePodGroupBasicSchedulingPolicy basic = 1;
+
+  // gang specifies that the child groups of this composite group should be
+  // scheduled using all-or-nothing semantics.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional WorkloadCompositePodGroupGangSchedulingPolicy gang = 2;
+}
+
+// WorkloadCompositePodGroupSingleDisruptionMode indicates that child groups
+// can be disrupted independently.
+message WorkloadCompositePodGroupSingleDisruptionMode {
+}
+
+// WorkloadList contains a list of Workload resources.
+message WorkloadList {
+  // Standard list metadata.
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
+
+  // Items is the list of Workloads.
+  repeated Workload items = 2;
+}
+
+// WorkloadPodGroupAllDisruptionMode indicates that all pods in the
+// group must be disrupted together.
+message WorkloadPodGroupAllDisruptionMode {
+}
+
+// WorkloadPodGroupBasicSchedulingPolicy indicates standard Kubernetes
+// scheduling behavior.
+message WorkloadPodGroupBasicSchedulingPolicy {
+}
+
+// WorkloadPodGroupDisruptionMode defines how individual pods within a
+// group can be disrupted. Exactly one mode must be set.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a controller's own
+// API, next to its other scheduling fields (for example, in a Job's
+// spec.scheduling). It's recommended to freeze the field after creation
+// (+k8s:immutable), since the selected mode is immutable in the compiled
+// Workload. For example,
+//
+// 	type JobSchedulingConfiguration struct {
+// 		// DisruptionMode defines the mode in which the Job's pods can be disrupted.
+// 		// One of Single, All.
+// 		// This field is immutable after creation: it may not be added or removed,
+// 		// and the selected mode may not be changed.
+// 		// +optional
+// 		// +k8s:optional
+// 		// +k8s:immutable
+// 		DisruptionMode *schedulingv1alpha3.WorkloadPodGroupDisruptionMode `json:"disruptionMode,omitempty" protobuf:"bytes,N,opt,name=disruptionMode"`
+//
+// 		// other scheduling fields
+// 	}
+//
+// +union
+message WorkloadPodGroupDisruptionMode {
+  // single specifies that pods can be disrupted independently from each other.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional WorkloadPodGroupSingleDisruptionMode single = 1;
+
+  // all specifies that all pods in the group must be disrupted together.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional WorkloadPodGroupAllDisruptionMode all = 2;
+}
+
+// WorkloadPodGroupGangSchedulingPolicy defines the parameters for gang
+// (all-or-nothing) scheduling.
+message WorkloadPodGroupGangSchedulingPolicy {
+  // minCount is the minimum number of pods that must be scheduled
+  // at the same time for the scheduler to admit the entire group.
+  // This field is optional. If it is not specified, the controller
+  // should inject a context-specific sane default (e.g.,
+  // parallelism for a Job).
+  // If set, it must be a positive integer.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:minimum=1
+  optional int32 minCount = 1;
+}
+
+// WorkloadPodGroupResourceClaim references a dynamic resource claim
+// that is shared across pods in the group.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a controller's own
+// API as a list, next to its other scheduling fields (for example, in a Job's
+// spec.scheduling). It's recommended to freeze the whole list after creation
+// (+k8s:immutable), since the list is immutable in the compiled Workload. For
+// example,
+//
+// 	type JobSchedulingConfiguration struct {
+// 		// ResourceClaims lists the ResourceClaims shared among the group's pods.
+// 		// At most 4 claims may be set, matching the limit on the resulting PodGroup.
+// 		// This list is immutable after creation: entries may neither be added,
+// 		// removed, nor modified.
+// 		// +optional
+// 		// +patchMergeKey=name
+// 		// +patchStrategy=merge
+// 		// +listType=map
+// 		// +listMapKey=name
+// 		// +k8s:optional
+// 		// +k8s:listType=map
+// 		// +k8s:listMapKey=name
+// 		// +k8s:maxItems=4
+// 		// +k8s:immutable
+// 		ResourceClaims []schedulingv1alpha3.WorkloadPodGroupResourceClaim `json:"resourceClaims,omitempty" protobuf:"bytes,N,rep,name=resourceClaims"`
+//
+// 		// other scheduling fields
+// 	}
+message WorkloadPodGroupResourceClaim {
+  // name uniquely identifies this resource claim inside the group.
+  // This field is required. It must be a DNS_LABEL.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-short-name
+  optional string name = 1;
+
+  // resourceClaimName is the name of a ResourceClaim object in the same
+  // namespace.
+  // This field is optional. If it is not specified, no resource claim
+  // is used. If set, it must be a DNS subdomain.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:format=k8s-long-name
+  optional string resourceClaimName = 2;
+
+  // resourceClaimTemplateName is the name of a ResourceClaimTemplate
+  // object in the same namespace.
+  // This field is optional. If it is not specified, no resource claim
+  // template is used. If set, it must be a DNS subdomain.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:format=k8s-long-name
+  optional string resourceClaimTemplateName = 3;
+}
+
+// WorkloadPodGroupSchedulingConstraints defines leaf-level scheduling
+// constraints, such as topology.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a controller's own
+// API, next to its other scheduling fields (for example, in a Job's
+// spec.scheduling). It's recommended to freeze the field after creation
+// (+k8s:immutable), since constraints are immutable in the compiled Workload.
+// For example,
+//
+// 	type JobSchedulingConfiguration struct {
+// 		// SchedulingConstraints defines scheduling constraints (e.g. topology)
+// 		// for the Job's pods.
+// 		// This field is immutable after creation.
+// 		// +optional
+// 		// +k8s:optional
+// 		// +k8s:immutable
+// 		SchedulingConstraints *schedulingv1alpha3.WorkloadPodGroupSchedulingConstraints `json:"schedulingConstraints,omitempty" protobuf:"bytes,N,opt,name=schedulingConstraints"`
+//
+// 		// other scheduling fields
+// 	}
+message WorkloadPodGroupSchedulingConstraints {
+  // topology specifies desired topological placements for all pods
+  // within the pod group.
+  // If unset, no topology placement is requested.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:maxItems=1
+  // +listType=atomic
+  // +k8s:listType=atomic
+  repeated TopologyConstraint topology = 1;
+}
+
+// WorkloadPodGroupSchedulingPolicy defines the scheduling policy for a
+// group of pods managed by a workload controller.
+// Exactly one policy must be set.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a controller's own
+// API, next to its other scheduling fields (for example, in a Job's
+// spec.scheduling). It's recommended to block changing the policy
+// after creation, while still allowing gang.minCount to change. DV cannot
+// express that only gang.minCount is mutable while the basic/gang variant is
+// frozen, so the embedder must enforce variant immutability with hand-written
+// validation. For example,
+//
+// 	type JobSchedulingConfiguration struct {
+// 		// SchedulingPolicy defines the scheduling policy for this Job.
+// 		// Exactly one of Basic or Gang must be set.
+// 		// This field is immutable after creation: the policy may not be added or
+// 		// removed. The policy variant (basic/gang) is frozen by the controller's
+// 		// hand-written validation; only schedulingPolicy.gang.minCount may be changed.
+// 		// +optional
+// 		// +k8s:optional
+// 		// +k8s:update=NoSet
+// 		// +k8s:update=NoUnset
+// 		SchedulingPolicy *schedulingv1alpha3.WorkloadPodGroupSchedulingPolicy `json:"schedulingPolicy,omitempty" protobuf:"bytes,N,opt,name=schedulingPolicy"`
+//
+// 		// other scheduling fields
+// 	}
+//
+// +union
+message WorkloadPodGroupSchedulingPolicy {
+  // basic specifies that standard, pod-by-pod Kubernetes scheduling
+  // behavior should be used.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional WorkloadPodGroupBasicSchedulingPolicy basic = 1;
+
+  // gang specifies all-or-nothing scheduling semantics.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional WorkloadPodGroupGangSchedulingPolicy gang = 2;
+}
+
+// WorkloadPodGroupSingleDisruptionMode indicates that individual pods
+// can be disrupted independently.
+message WorkloadPodGroupSingleDisruptionMode {
+}
+
+// WorkloadReference references the Workload object together with the template
+// that was used to create a particular PodGroup.
+message WorkloadReference {
+  // workloadName is the name of the Workload object that contains a template
+  // that was used when creating a pod group. It must
+  // be a DNS name.
+  // This field is required.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-long-name
+  optional string workloadName = 1;
+
+  // templateName is the name of a template within the Workload object that
+  // was used to create a pod group. It must be a DNS label.
+  // This field is required.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-short-name
+  optional string templateName = 2;
+}
+
+// WorkloadSpec defines the desired state of a Workload.
+message WorkloadSpec {
+  // controllerRef is an optional reference to the controlling object, such as a
+  // Deployment or Job. This field is intended for use by tools like CLIs
+  // to provide a link back to the original workload definition.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional TypedLocalObjectReference controllerRef = 1;
+
+  // podGroupTemplates is the list of templates that make up the Workload.
+  // The maximum number of templates is 8. Templates cannot be added or removed after the workload is created.
+  // Existing templates may still be updated where their individual fields allow it.
+  // Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.
+  //
+  // +optional
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=8
+  // +k8s:update=NoAddItem
+  // +k8s:update=NoRemoveItem
+  repeated PodGroupTemplate podGroupTemplates = 2;
+
+  // compositePodGroupTemplates is the list of CompositePodGroup templates that make up the Workload.
+  // The maximum number of templates is 8. This field is immutable.
+  // Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.
+  //
+  // This field is used only when the CompositePodGroup feature gate is enabled.
+  //
+  // +featureGate=CompositePodGroup
+  // +optional
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:ifDisabled("CompositePodGroup")=+k8s:forbidden
+  // +k8s:ifEnabled("CompositePodGroup")=+k8s:optional
+  // +k8s:unionMember
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=8
+  // +k8s:update=NoAddItem
+  // +k8s:update=NoRemoveItem
+  repeated CompositePodGroupTemplate compositePodGroupTemplates = 3;
+}
+
diff --git a/vendor/k8s.io/api/scheduling/v1alpha2/register.go b/vendor/k8s.io/api/scheduling/v1alpha3/register.go
similarity index 95%
rename from vendor/k8s.io/api/scheduling/v1alpha2/register.go
rename to vendor/k8s.io/api/scheduling/v1alpha3/register.go
index fc03ae5ec9..fe3bac60e5 100644
--- a/vendor/k8s.io/api/scheduling/v1alpha2/register.go
+++ b/vendor/k8s.io/api/scheduling/v1alpha3/register.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package v1alpha2
+package v1alpha3
 
 import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -26,7 +26,7 @@ import (
 const GroupName = "scheduling.k8s.io"
 
 // SchemeGroupVersion is group version used to register these objects
-var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha2"}
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha3"}
 
 // Resource takes an unqualified resource and returns a Group qualified GroupResource
 func Resource(resource string) schema.GroupResource {
@@ -49,6 +49,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 		&WorkloadList{},
 		&PodGroup{},
 		&PodGroupList{},
+		&CompositePodGroup{},
+		&CompositePodGroupList{},
 	)
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil
diff --git a/vendor/k8s.io/api/scheduling/v1alpha3/types.go b/vendor/k8s.io/api/scheduling/v1alpha3/types.go
new file mode 100644
index 0000000000..138659ae41
--- /dev/null
+++ b/vendor/k8s.io/api/scheduling/v1alpha3/types.go
@@ -0,0 +1,1429 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// Workload allows for expressing scheduling constraints that should be used
+// when managing the lifecycle of workloads from the scheduling perspective,
+// including scheduling, preemption, eviction and other phases.
+// Workload API enablement is toggled by the GenericWorkload feature gate.
+type Workload struct {
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	//
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// spec defines the desired behavior of a Workload.
+	//
+	// +required
+	Spec WorkloadSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// WorkloadList contains a list of Workload resources.
+type WorkloadList struct {
+	metav1.TypeMeta `json:""`
+	// Standard list metadata.
+	//
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// Items is the list of Workloads.
+	Items []Workload `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+const (
+	// WorkloadMaxPodGroupTemplates is the maximum number of pod group templates per Workload.
+	WorkloadMaxPodGroupTemplates = 8
+	// WorkloadMaxTreeDepth is the maximum allowed depth for a tree of (composite) pod group templates in a Workload.
+	WorkloadMaxTreeDepth = 4
+)
+
+// WorkloadSpec defines the desired state of a Workload.
+type WorkloadSpec struct {
+	// controllerRef is an optional reference to the controlling object, such as a
+	// Deployment or Job. This field is intended for use by tools like CLIs
+	// to provide a link back to the original workload definition.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	ControllerRef *TypedLocalObjectReference `json:"controllerRef,omitempty" protobuf:"bytes,1,opt,name=controllerRef"`
+
+	// podGroupTemplates is the list of templates that make up the Workload.
+	// The maximum number of templates is 8. Templates cannot be added or removed after the workload is created.
+	// Existing templates may still be updated where their individual fields allow it.
+	// Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.
+	//
+	// +optional
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=8
+	// +k8s:update=NoAddItem
+	// +k8s:update=NoRemoveItem
+	PodGroupTemplates []PodGroupTemplate `json:"podGroupTemplates" protobuf:"bytes,2,rep,name=podGroupTemplates"`
+
+	// compositePodGroupTemplates is the list of CompositePodGroup templates that make up the Workload.
+	// The maximum number of templates is 8. This field is immutable.
+	// Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.
+	//
+	// This field is used only when the CompositePodGroup feature gate is enabled.
+	//
+	// +featureGate=CompositePodGroup
+	// +optional
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:ifDisabled("CompositePodGroup")=+k8s:forbidden
+	// +k8s:ifEnabled("CompositePodGroup")=+k8s:optional
+	// +k8s:unionMember
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=8
+	// +k8s:update=NoAddItem
+	// +k8s:update=NoRemoveItem
+	CompositePodGroupTemplates []CompositePodGroupTemplate `json:"compositePodGroupTemplates,omitempty" protobuf:"bytes,3,rep,name=compositePodGroupTemplates"`
+}
+
+// TypedLocalObjectReference allows to reference typed object inside the same namespace.
+type TypedLocalObjectReference struct {
+	// apiGroup is the group for the resource being referenced.
+	// If APIGroup is empty, the specified Kind must be in the core API group.
+	// For any other third-party types, setting APIGroup is required.
+	// It must be a DNS subdomain.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:format=k8s-long-name
+	APIGroup string `json:"apiGroup,omitempty" protobuf:"bytes,1,opt,name=apiGroup"`
+	// kind is the type of resource being referenced.
+	// It must be a path segment name.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-path-segment-name
+	Kind string `json:"kind" protobuf:"bytes,2,opt,name=kind"`
+	// name is the name of resource being referenced.
+	// It must be a path segment name.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-path-segment-name
+	Name string `json:"name" protobuf:"bytes,3,opt,name=name"`
+}
+
+// MaxPodGroupResourceClaims is the maximum number of resource claims for a
+// PodGroup or a Workload's PodGroupTemplate.
+const MaxPodGroupResourceClaims = 4
+
+// PodGroupTemplate represents a template for a set of pods with a scheduling policy.
+type PodGroupTemplate struct {
+	// name is a unique identifier for the PodGroupTemplate within the Workload.
+	// It must be a DNS label. This field is immutable.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-short-name
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+
+	// schedulingPolicy defines the scheduling policy for this PodGroupTemplate.
+	//
+	// +required
+	SchedulingPolicy PodGroupSchedulingPolicy `json:"schedulingPolicy" protobuf:"bytes,2,opt,name=schedulingPolicy"`
+
+	// schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroupTemplate.
+	// This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
+	// This field is immutable.
+	//
+	// +featureGate=TopologyAwareWorkloadScheduling
+	// +optional
+	// +k8s:ifDisabled(TopologyAwareWorkloadScheduling)=+k8s:forbidden
+	// +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:optional
+	// +k8s:immutable
+	SchedulingConstraints *PodGroupSchedulingConstraints `json:"schedulingConstraints" protobuf:"bytes,3,opt,name=schedulingConstraints"`
+
+	// resourceClaims defines which ResourceClaims may be shared among Pods in
+	// the group. Pods consume the devices allocated to a PodGroup's claim by
+	// defining a claim in its own Spec.ResourceClaims that matches the
+	// PodGroup's claim exactly. The claim must have the same name and refer to
+	// the same ResourceClaim or ResourceClaimTemplate.
+	//
+	// This is a beta-level field and requires that the
+	// DRAWorkloadResourceClaims feature gate is enabled.
+	//
+	// This field is immutable.
+	//
+	// +optional
+	// +patchMergeKey=name
+	// +patchStrategy=merge,retainKeys
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=4
+	// +featureGate=DRAWorkloadResourceClaims
+	// +k8s:immutable
+	ResourceClaims []PodGroupResourceClaim `json:"resourceClaims,omitempty" patchStrategy:"merge,retainKeys" patchMergeKey:"name" protobuf:"bytes,4,rep,name=resourceClaims"`
+
+	// disruptionMode defines the mode in which a given PodGroup can be disrupted.
+	// One of Single, All.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	DisruptionMode *DisruptionMode `json:"disruptionMode,omitempty" protobuf:"bytes,5,opt,name=disruptionMode"`
+
+	// priorityClassName indicates the priority that should be considered when scheduling
+	// a pod group created from this template.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:format=k8s-long-name
+	// +k8s:immutable
+	PriorityClassName string `json:"priorityClassName,omitempty" protobuf:"bytes,6,opt,name=priorityClassName"`
+
+	// priority is the value of priority of pod groups created from this template. Various
+	// system components use this field to find the priority of the pod group.
+	// The higher the value, the higher the priority.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:maximum=1000000000 # HighestUserDefinablePriority
+	// +k8s:immutable
+	Priority *int32 `json:"priority,omitempty" protobuf:"varint,7,opt,name=priority"`
+
+	// preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+	// One of Never, PreemptLowerPriority.
+	// This field is immutable.
+	// This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+	//
+	// +featureGate=PodGroupPreemptionPolicy
+	// +optional
+	// +k8s:immutable
+	// +k8s:ifDisabled("PodGroupPreemptionPolicy")=+k8s:forbidden
+	// +k8s:ifEnabled("PodGroupPreemptionPolicy")=+k8s:optional
+	PreemptionPolicy *PreemptionPolicy `json:"preemptionPolicy,omitempty" protobuf:"bytes,8,opt,name=preemptionPolicy"`
+}
+
+// CompositePodGroupTemplate represents a template for a CompositePodGroup with a scheduling policy.
+type CompositePodGroupTemplate struct {
+	// name is a unique identifier for the CompositePodGroupTemplate within the Workload.
+	// It must be a DNS label. This field is required.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-short-name
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+
+	// schedulingPolicy defines the scheduling policy for this template.
+	//
+	// +required
+	SchedulingPolicy CompositePodGroupSchedulingPolicy `json:"schedulingPolicy" protobuf:"bytes,2,opt,name=schedulingPolicy"`
+
+	// schedulingConstraints defines optional scheduling constraints (e.g. topology) for this CompositePodGroupTemplate.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	SchedulingConstraints *CompositePodGroupSchedulingConstraints `json:"schedulingConstraints,omitempty" protobuf:"bytes,3,opt,name=schedulingConstraints"`
+
+	// disruptionMode defines the mode in which a given CompositePodGroup can be disrupted.
+	// One of Single, All.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	DisruptionMode *CompositeDisruptionMode `json:"disruptionMode,omitempty" protobuf:"bytes,4,opt,name=disruptionMode"`
+
+	// priorityClassName indicates the priority that should be considered when scheduling
+	// a composite pod group created from this template. If no priority class is specified,
+	// admission control can set this to the global default priority class if it exists.
+	// Otherwise, composite pod groups created from this template will have the priority set
+	// to zero.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:format=k8s-long-name
+	// +k8s:immutable
+	PriorityClassName string `json:"priorityClassName,omitempty" protobuf:"bytes,5,opt,name=priorityClassName"`
+
+	// priority is the value of priority of composite pod groups created from this template.
+	// Various system components use this field to find the priority of the composite pod group.
+	// When Priority Admission Controller is enabled, it prevents users from setting this field.
+	// The admission controller populates this field from PriorityClassName.
+	// The higher the value, the higher the priority.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:maximum=1000000000 # HighestUserDefinablePriority
+	// +k8s:immutable
+	Priority *int32 `json:"priority,omitempty" protobuf:"varint,6,opt,name=priority"`
+
+	// preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+	// One of Never, PreemptLowerPriority.
+	// This field is immutable.
+	// This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+	//
+	// +featureGate=PodGroupPreemptionPolicy
+	// +optional
+	// +k8s:immutable
+	// +k8s:ifDisabled("PodGroupPreemptionPolicy")=+k8s:forbidden
+	// +k8s:ifEnabled("PodGroupPreemptionPolicy")=+k8s:optional
+	PreemptionPolicy *PreemptionPolicy `json:"preemptionPolicy,omitempty" protobuf:"bytes,7,opt,name=preemptionPolicy"`
+
+	// podGroupTemplates is the list of templates for children PodGroups.
+	// The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates
+	// or PodGroupTemplates must be set.
+	//
+	// +optional
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=8
+	// +k8s:update=NoAddItem
+	// +k8s:update=NoRemoveItem
+	PodGroupTemplates []PodGroupTemplate `json:"podGroupTemplates,omitempty" protobuf:"bytes,8,rep,name=podGroupTemplates"`
+
+	// compositePodGroupTemplates is the list of templates for children CompositePodGroups.
+	// The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates
+	// or PodGroupTemplates must be set.
+	//
+	// +optional
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=8
+	// +k8s:update=NoAddItem
+	// +k8s:update=NoRemoveItem
+	CompositePodGroupTemplates []CompositePodGroupTemplate `json:"compositePodGroupTemplates,omitempty" protobuf:"bytes,9,rep,name=compositePodGroupTemplates"`
+}
+
+// PodGroupSchedulingPolicy defines the scheduling configuration for a PodGroup.
+// Exactly one policy must be set. The policy is chosen at creation time by setting either the
+// Basic or Gang field. The PodGroup may not change policy after creation.
+// Fields within chosen policy may be updated after creation when their individual fields allow it.
+//
+// +union
+type PodGroupSchedulingPolicy struct {
+	// basic specifies that the pods in this group should be scheduled using
+	// standard Kubernetes scheduling behavior. Setting this field at group creation time
+	// opts this group to basic scheduling; this field cannot be changed afterward.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:immutable
+	Basic *BasicSchedulingPolicy `json:"basic,omitempty" protobuf:"bytes,1,opt,name=basic"`
+
+	// gang specifies that the pods in this group should be scheduled using
+	// all-or-nothing semantics. Setting this field at group creation time
+	// opts this group to gang scheduling; this field cannot be set or unset afterward.
+	// The minCount field within Gang scheduling policy remains mutable after group creation.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:update=NoSet
+	// +k8s:update=NoUnset
+	Gang *GangSchedulingPolicy `json:"gang,omitempty" protobuf:"bytes,2,opt,name=gang"`
+}
+
+// BasicSchedulingPolicy indicates that standard Kubernetes
+// scheduling behavior should be used.
+type BasicSchedulingPolicy struct {
+	// This is intentionally empty. Its presence indicates that the basic
+	// scheduling policy should be applied. In the future, new fields may appear,
+	// describing such constraints on a pod group level without "all or nothing"
+	// (gang) scheduling.
+}
+
+// GangSchedulingPolicy defines the parameters for gang scheduling.
+type GangSchedulingPolicy struct {
+	// minCount is the minimum number of pods that must be schedulable or scheduled
+	// at the same time for the scheduler to admit the entire group.
+	// It must be a positive integer. This field is mutable to support workload scaling.
+	//
+	// Note that the scheduler operates on an eventually consistent model. Updates
+	// to minCount may not be immediately reflected in scheduling decisions due to
+	// propagation delays. If minCount is updated while a scheduling cycle is in
+	// progress for that group, the new value may not take effect until the next
+	// cycle. Moreover, minCount is only enforced during scheduling, meaning that
+	// modifications to this field do not affect already-scheduled pods, applying
+	// only to those evaluated in future cycles.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:minimum=1
+	MinCount int32 `json:"minCount" protobuf:"varint,1,opt,name=minCount"`
+}
+
+// PodGroupResourceClaim references exactly one ResourceClaim, either directly
+// or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim
+// for the PodGroup.
+//
+// It adds a name to it that uniquely identifies the ResourceClaim inside the PodGroup.
+// Pods that need access to the ResourceClaim define a matching reference in its
+// own Spec.ResourceClaims. The Pod's claim must match all fields of the
+// PodGroup's claim exactly.
+type PodGroupResourceClaim struct {
+	// name uniquely identifies this resource claim inside the PodGroup.
+	// This must be a DNS_LABEL.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-short-name
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+
+	// resourceClaimName is the name of a ResourceClaim object in the same
+	// namespace as this PodGroup. The ResourceClaim will be reserved for the
+	// PodGroup instead of its individual pods.
+	//
+	// Exactly one of ResourceClaimName and ResourceClaimTemplateName must
+	// be set.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:format=k8s-long-name
+	ResourceClaimName *string `json:"resourceClaimName,omitempty" protobuf:"bytes,2,opt,name=resourceClaimName"`
+
+	// resourceClaimTemplateName is the name of a ResourceClaimTemplate
+	// object in the same namespace as this PodGroup.
+	//
+	// The template will be used to create a new ResourceClaim, which will
+	// be bound to this PodGroup. When this PodGroup is deleted, the ResourceClaim
+	// will also be deleted. The PodGroup name and resource name, along with a
+	// generated component, will be used to form a unique name for the
+	// ResourceClaim, which will be recorded in podgroup.status.resourceClaimStatuses.
+	//
+	// This field is immutable and no changes will be made to the
+	// corresponding ResourceClaim by the control plane after creating the
+	// ResourceClaim.
+	//
+	// Exactly one of ResourceClaimName and ResourceClaimTemplateName must
+	// be set.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:format=k8s-long-name
+	ResourceClaimTemplateName *string `json:"resourceClaimTemplateName,omitempty" protobuf:"bytes,3,opt,name=resourceClaimTemplateName"`
+}
+
+// DisruptionMode defines how individual entities within a group can be disrupted.
+// Exactly one mode can be set.
+//
+// +union
+type DisruptionMode struct {
+	// single specifies that children can be disrupted independently from each other.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	Single *SingleDisruptionMode `json:"single,omitempty" protobuf:"bytes,1,opt,name=single"`
+
+	// all specifies that all children can only be disrupted together.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	All *AllDisruptionMode `json:"all,omitempty" protobuf:"bytes,2,opt,name=all"`
+}
+
+// SingleDisruptionMode specifies that children can be disrupted independently.
+type SingleDisruptionMode struct {
+	// Intentionally empty now.
+}
+
+// AllDisruptionMode specifies that children can only be disrupted together.
+type AllDisruptionMode struct {
+	// Intentionally empty now.
+}
+
+// PreemptionPolicy describes a policy for if/when to preempt a pod.
+// +enum
+// +k8s:enum
+type PreemptionPolicy string
+
+const (
+	// PreemptLowerPriority means that pod can preempt other pods with lower priority.
+	PreemptLowerPriority PreemptionPolicy = "PreemptLowerPriority"
+	// PreemptNever means that pod never preempts other pods with lower priority.
+	PreemptNever PreemptionPolicy = "Never"
+)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:supportsSubresource="/status"
+
+// PodGroup represents a runtime instance of pods grouped together.
+// PodGroups are created by workload controllers (Job, LWS, JobSet, etc...) from
+// Workload.podGroupTemplates.
+// PodGroup API enablement is toggled by the GenericWorkload feature gate.
+type PodGroup struct {
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	//
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// spec defines the desired state of the PodGroup.
+	//
+	// +required
+	Spec PodGroupSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
+
+	// status represents the current observed state of the PodGroup.
+	//
+	// +optional
+	Status PodGroupStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// PodGroupList contains a list of PodGroup resources.
+type PodGroupList struct {
+	metav1.TypeMeta `json:""`
+	// Standard list metadata.
+	//
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// Items is the list of PodGroups.
+	Items []PodGroup `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+// PodGroupSpec defines the desired state of a PodGroup.
+type PodGroupSpec struct {
+	// parentCompositePodGroupName contains the name of the parent composite pod group
+	// within the same namespace as this pod group.
+	// If it's nil, then this pod group is a root of a workload's hierarchy.
+	// This field is used only when the CompositePodGroup feature gate is enabled.
+	// This field is immutable.
+	//
+	// +featureGate=CompositePodGroup
+	// +optional
+	// +k8s:ifDisabled(CompositePodGroup)=+k8s:forbidden
+	// +k8s:ifEnabled(CompositePodGroup)=+k8s:optional
+	// +k8s:immutable
+	// +k8s:format=k8s-long-name
+	// +k8s:alpha(since: "1.37")=+k8s:dependentRequired("workloadRef")
+	ParentCompositePodGroupName *string `json:"parentCompositePodGroupName,omitempty" protobuf:"bytes,1,opt,name=parentCompositePodGroupName"`
+
+	// workloadRef references an optional PodGroup template within the Workload
+	// object that was used to create the PodGroup.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	WorkloadRef *WorkloadReference `json:"workloadRef,omitempty" protobuf:"bytes,2,opt,name=workloadRef"`
+
+	// schedulingPolicy defines the scheduling policy for this instance of the PodGroup.
+	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+	//
+	// +required
+	SchedulingPolicy PodGroupSchedulingPolicy `json:"schedulingPolicy" protobuf:"bytes,3,opt,name=schedulingPolicy"`
+
+	// schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroup.
+	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+	// This field is immutable.
+	// This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
+	//
+	// +featureGate=TopologyAwareWorkloadScheduling
+	// +optional
+	// +k8s:ifDisabled(TopologyAwareWorkloadScheduling)=+k8s:forbidden
+	// +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:optional
+	// +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:immutable
+	SchedulingConstraints *PodGroupSchedulingConstraints `json:"schedulingConstraints,omitempty" protobuf:"bytes,4,opt,name=schedulingConstraints"`
+
+	// resourceClaims defines which ResourceClaims may be shared among Pods in
+	// the group. Pods consume the devices allocated to a PodGroup's claim by
+	// defining a claim in its own Spec.ResourceClaims that matches the
+	// PodGroup's claim exactly. The claim must have the same name and refer to
+	// the same ResourceClaim or ResourceClaimTemplate.
+	//
+	// This is a beta-level field and requires that the
+	// DRAWorkloadResourceClaims feature gate is enabled.
+	//
+	// This field is immutable.
+	//
+	// +optional
+	// +patchMergeKey=name
+	// +patchStrategy=merge,retainKeys
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=4
+	// +k8s:immutable
+	// +featureGate=DRAWorkloadResourceClaims
+	ResourceClaims []PodGroupResourceClaim `json:"resourceClaims,omitempty" patchStrategy:"merge,retainKeys" patchMergeKey:"name" protobuf:"bytes,5,rep,name=resourceClaims"`
+
+	// disruptionMode defines the mode in which a given PodGroup can be disrupted.
+	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+	// One of Single, All. Defaults to Single if unset.
+	// This field is immutable.
+	//
+	// +default={"single": {}}
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	DisruptionMode *DisruptionMode `json:"disruptionMode,omitempty" protobuf:"bytes,6,opt,name=disruptionMode"`
+
+	// priorityClassName defines the priority that should be considered when scheduling this pod group.
+	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+	// Otherwise, it is validated and resolved similarly to the PriorityClassName on PodGroupTemplate
+	// (i.e. if no priority class is specified, admission control can set this to the global default
+	// priority class if it exists. Otherwise, the pod group's priority will be zero).
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	// +k8s:format=k8s-long-name
+	PriorityClassName string `json:"priorityClassName,omitempty" protobuf:"bytes,7,opt,name=priorityClassName"`
+
+	// priority is the value of priority of this pod group. Various system components
+	// use this field to find the priority of the pod group. When Priority Admission
+	// Controller is enabled, it prevents users from setting this field. The admission
+	// controller populates this field from PriorityClassName.
+	// The higher the value, the higher the priority.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	// +k8s:maximum=1000000000 # HighestUserDefinablePriority
+	Priority *int32 `json:"priority,omitempty" protobuf:"varint,8,opt,name=priority"`
+
+	// preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+	// One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset.
+	// When Priority Admission Controller is enabled, it populates this field from PriorityClassName,
+	// and defaults to PreemptLowerPriority if value is unset in PriorityClass.
+	// This field is immutable.
+	// This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+	//
+	// +featureGate=PodGroupPreemptionPolicy
+	// +optional
+	// +k8s:immutable
+	// +k8s:ifDisabled("PodGroupPreemptionPolicy")=+k8s:forbidden
+	// +k8s:ifEnabled("PodGroupPreemptionPolicy")=+k8s:optional
+	PreemptionPolicy *PreemptionPolicy `json:"preemptionPolicy,omitempty" protobuf:"bytes,9,opt,name=preemptionPolicy"`
+}
+
+// PodGroupStatus represents information about the status of a pod group.
+type PodGroupStatus struct {
+	// conditions represent the latest observations of the PodGroup's state.
+	//
+	// Known condition types:
+	// - "PodGroupInitiallyScheduled": Indicates whether the scheduling requirement has been satisfied.
+	// Once this condition transitions to True, it serves as a terminal state and will never revert to False,
+	// even if pods are subsequently evicted and group constraints are no longer met.
+	// - "DisruptionTarget": Indicates whether the PodGroup is about to be terminated
+	//   due to disruption such as preemption.
+	//
+	// Known reasons for the PodGroupInitiallyScheduled condition:
+	// - "Unschedulable": The PodGroup cannot be scheduled due to resource constraints,
+	//   affinity/anti-affinity rules, or insufficient capacity for the gang.
+	// - "SchedulerError": The PodGroup cannot be scheduled due to some internal error
+	//   that happened during scheduling, for example due to nodeAffinity parsing errors.
+	//
+	// Known reasons for the DisruptionTarget condition:
+	// - "PreemptionByScheduler": The PodGroup was preempted by the scheduler to make room for
+	//   higher-priority PodGroups or Pods.
+	//
+	// +optional
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
+
+	// resourceClaimStatuses is status of resource claims.
+	// +optional
+	// +patchMergeKey=name
+	// +patchStrategy=merge,retainKeys
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=4
+	// +featureGate=DRAWorkloadResourceClaims
+	ResourceClaimStatuses []PodGroupResourceClaimStatus `json:"resourceClaimStatuses,omitempty" patchStrategy:"merge,retainKeys" patchMergeKey:"name" protobuf:"bytes,2,rep,name=resourceClaimStatuses"`
+}
+
+// Well-known condition types for PodGroups.
+const (
+	// PodGroupInitiallyScheduled represents status of the scheduling process for this PodGroup till first success.
+	PodGroupInitiallyScheduled string = "PodGroupInitiallyScheduled"
+	// DisruptionTarget indicates the PodGroup is about to be terminated due to disruption
+	// such as preemption.
+	DisruptionTarget string = "DisruptionTarget"
+)
+
+// Well-known condition reasons for PodGroups.
+const (
+	// Unschedulable reason in the PodGroupInitiallyScheduled condition indicates that the PodGroup cannot be scheduled
+	// due to resource constraints, affinity/anti-affinity rules, or insufficient capacity for the PodGroup.
+	PodGroupReasonUnschedulable string = "Unschedulable"
+	// SchedulerError reason in the PodGroupInitiallyScheduled condition means that some internal error happens
+	// during scheduling, for example due to nodeAffinity parsing errors.
+	PodGroupReasonSchedulerError string = "SchedulerError"
+	// PreemptionByScheduler reason in the DisruptionTarget condition indicates the PodGroup was preempted
+	// to make room for higher-priority PodGroups or Pods.
+	PodGroupReasonPreemptionByScheduler string = "PreemptionByScheduler"
+)
+
+// PodGroupResourceClaimStatus is stored in the PodGroupStatus for each
+// PodGroupResourceClaim which references a ResourceClaimTemplate. It stores the
+// generated name for the corresponding ResourceClaim.
+type PodGroupResourceClaimStatus struct {
+	// name uniquely identifies this resource claim inside the PodGroup. This
+	// must match the name of an entry in podgroup.spec.resourceClaims, which
+	// implies that the string must be a DNS_LABEL.
+	//
+	// +required
+	Name string `json:"name" protobuf:"bytes,1,name=name"`
+
+	// resourceClaimName is the name of the ResourceClaim that was generated for
+	// the PodGroup in the namespace of the PodGroup. If this is unset, then
+	// generating a ResourceClaim was not necessary. The
+	// podgroup.spec.resourceClaims entry can be ignored in this case.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:format=k8s-long-name
+	ResourceClaimName *string `json:"resourceClaimName,omitempty" protobuf:"bytes,2,opt,name=resourceClaimName"`
+}
+
+// WorkloadReference references the Workload object together with the template
+// that was used to create a particular PodGroup.
+type WorkloadReference struct {
+	// workloadName is the name of the Workload object that contains a template
+	// that was used when creating a pod group. It must
+	// be a DNS name.
+	// This field is required.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-long-name
+	WorkloadName string `json:"workloadName" protobuf:"bytes,1,opt,name=workloadName"`
+
+	// templateName is the name of a template within the Workload object that
+	// was used to create a pod group. It must be a DNS label.
+	// This field is required.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-short-name
+	TemplateName string `json:"templateName" protobuf:"bytes,2,opt,name=templateName"`
+}
+
+// PodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a PodGroup.
+type PodGroupSchedulingConstraints struct {
+	// topology defines the topology constraints for the pod group.
+	// Currently only a single topology constraint can be specified. This may change in the future.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:maxItems=1
+	// +listType=atomic
+	// +k8s:listType=atomic
+	Topology []TopologyConstraint `json:"topology,omitempty" protobuf:"bytes,1,rep,name=topology"`
+}
+
+// TopologyConstraint defines a topology constraint for a PodGroup.
+type TopologyConstraint struct {
+	// key specifies the key of the node label representing the topology domain.
+	// All pods within the PodGroup must be colocated within the same domain instance.
+	// Different PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.
+	// Examples: "topology.kubernetes.io/rack"
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-label-key
+	Key string `json:"key" protobuf:"bytes,1,opt,name=key"`
+}
+
+// WorkloadPodGroupSchedulingPolicy defines the scheduling policy for a
+// group of pods managed by a workload controller.
+// Exactly one policy must be set.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a controller's own
+// API, next to its other scheduling fields (for example, in a Job's
+// spec.scheduling). It's recommended to block changing the policy
+// after creation, while still allowing gang.minCount to change. DV cannot
+// express that only gang.minCount is mutable while the basic/gang variant is
+// frozen, so the embedder must enforce variant immutability with hand-written
+// validation. For example,
+//
+//	type JobSchedulingConfiguration struct {
+//		// SchedulingPolicy defines the scheduling policy for this Job.
+//		// Exactly one of Basic or Gang must be set.
+//		// This field is immutable after creation: the policy may not be added or
+//		// removed. The policy variant (basic/gang) is frozen by the controller's
+//		// hand-written validation; only schedulingPolicy.gang.minCount may be changed.
+//		// +optional
+//		// +k8s:optional
+//		// +k8s:update=NoSet
+//		// +k8s:update=NoUnset
+//		SchedulingPolicy *schedulingv1alpha3.WorkloadPodGroupSchedulingPolicy `json:"schedulingPolicy,omitempty" protobuf:"bytes,N,opt,name=schedulingPolicy"`
+//
+//		// other scheduling fields
+//	}
+//
+// +union
+type WorkloadPodGroupSchedulingPolicy struct {
+	// basic specifies that standard, pod-by-pod Kubernetes scheduling
+	// behavior should be used.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	Basic *WorkloadPodGroupBasicSchedulingPolicy `json:"basic,omitempty" protobuf:"bytes,1,opt,name=basic"`
+
+	// gang specifies all-or-nothing scheduling semantics.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	Gang *WorkloadPodGroupGangSchedulingPolicy `json:"gang,omitempty" protobuf:"bytes,2,opt,name=gang"`
+}
+
+// WorkloadPodGroupBasicSchedulingPolicy indicates standard Kubernetes
+// scheduling behavior.
+type WorkloadPodGroupBasicSchedulingPolicy struct {
+	// Intentionally empty for now.
+}
+
+// WorkloadPodGroupGangSchedulingPolicy defines the parameters for gang
+// (all-or-nothing) scheduling.
+type WorkloadPodGroupGangSchedulingPolicy struct {
+	// minCount is the minimum number of pods that must be scheduled
+	// at the same time for the scheduler to admit the entire group.
+	// This field is optional. If it is not specified, the controller
+	// should inject a context-specific sane default (e.g.,
+	// parallelism for a Job).
+	// If set, it must be a positive integer.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:minimum=1
+	MinCount *int32 `json:"minCount,omitempty" protobuf:"varint,1,opt,name=minCount"`
+}
+
+// WorkloadPodGroupSchedulingConstraints defines leaf-level scheduling
+// constraints, such as topology.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a controller's own
+// API, next to its other scheduling fields (for example, in a Job's
+// spec.scheduling). It's recommended to freeze the field after creation
+// (+k8s:immutable), since constraints are immutable in the compiled Workload.
+// For example,
+//
+//	type JobSchedulingConfiguration struct {
+//		// SchedulingConstraints defines scheduling constraints (e.g. topology)
+//		// for the Job's pods.
+//		// This field is immutable after creation.
+//		// +optional
+//		// +k8s:optional
+//		// +k8s:immutable
+//		SchedulingConstraints *schedulingv1alpha3.WorkloadPodGroupSchedulingConstraints `json:"schedulingConstraints,omitempty" protobuf:"bytes,N,opt,name=schedulingConstraints"`
+//
+//		// other scheduling fields
+//	}
+type WorkloadPodGroupSchedulingConstraints struct {
+	// topology specifies desired topological placements for all pods
+	// within the pod group.
+	// If unset, no topology placement is requested.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:maxItems=1
+	// +listType=atomic
+	// +k8s:listType=atomic
+	Topology []TopologyConstraint `json:"topology,omitempty" protobuf:"bytes,1,rep,name=topology"`
+}
+
+// WorkloadPodGroupResourceClaim references a dynamic resource claim
+// that is shared across pods in the group.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a controller's own
+// API as a list, next to its other scheduling fields (for example, in a Job's
+// spec.scheduling). It's recommended to freeze the whole list after creation
+// (+k8s:immutable), since the list is immutable in the compiled Workload. For
+// example,
+//
+//	type JobSchedulingConfiguration struct {
+//		// ResourceClaims lists the ResourceClaims shared among the group's pods.
+//		// At most 4 claims may be set, matching the limit on the resulting PodGroup.
+//		// This list is immutable after creation: entries may neither be added,
+//		// removed, nor modified.
+//		// +optional
+//		// +patchMergeKey=name
+//		// +patchStrategy=merge
+//		// +listType=map
+//		// +listMapKey=name
+//		// +k8s:optional
+//		// +k8s:listType=map
+//		// +k8s:listMapKey=name
+//		// +k8s:maxItems=4
+//		// +k8s:immutable
+//		ResourceClaims []schedulingv1alpha3.WorkloadPodGroupResourceClaim `json:"resourceClaims,omitempty" protobuf:"bytes,N,rep,name=resourceClaims"`
+//
+//		// other scheduling fields
+//	}
+type WorkloadPodGroupResourceClaim struct {
+	// name uniquely identifies this resource claim inside the group.
+	// This field is required. It must be a DNS_LABEL.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-short-name
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+
+	// resourceClaimName is the name of a ResourceClaim object in the same
+	// namespace.
+	// This field is optional. If it is not specified, no resource claim
+	// is used. If set, it must be a DNS subdomain.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:format=k8s-long-name
+	ResourceClaimName *string `json:"resourceClaimName,omitempty" protobuf:"bytes,2,opt,name=resourceClaimName"`
+
+	// resourceClaimTemplateName is the name of a ResourceClaimTemplate
+	// object in the same namespace.
+	// This field is optional. If it is not specified, no resource claim
+	// template is used. If set, it must be a DNS subdomain.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:format=k8s-long-name
+	ResourceClaimTemplateName *string `json:"resourceClaimTemplateName,omitempty" protobuf:"bytes,3,opt,name=resourceClaimTemplateName"`
+}
+
+// WorkloadPodGroupDisruptionMode defines how individual pods within a
+// group can be disrupted. Exactly one mode must be set.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a controller's own
+// API, next to its other scheduling fields (for example, in a Job's
+// spec.scheduling). It's recommended to freeze the field after creation
+// (+k8s:immutable), since the selected mode is immutable in the compiled
+// Workload. For example,
+//
+//	type JobSchedulingConfiguration struct {
+//		// DisruptionMode defines the mode in which the Job's pods can be disrupted.
+//		// One of Single, All.
+//		// This field is immutable after creation: it may not be added or removed,
+//		// and the selected mode may not be changed.
+//		// +optional
+//		// +k8s:optional
+//		// +k8s:immutable
+//		DisruptionMode *schedulingv1alpha3.WorkloadPodGroupDisruptionMode `json:"disruptionMode,omitempty" protobuf:"bytes,N,opt,name=disruptionMode"`
+//
+//		// other scheduling fields
+//	}
+//
+// +union
+type WorkloadPodGroupDisruptionMode struct {
+	// single specifies that pods can be disrupted independently from each other.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	Single *WorkloadPodGroupSingleDisruptionMode `json:"single,omitempty" protobuf:"bytes,1,opt,name=single"`
+
+	// all specifies that all pods in the group must be disrupted together.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	All *WorkloadPodGroupAllDisruptionMode `json:"all,omitempty" protobuf:"bytes,2,opt,name=all"`
+}
+
+// WorkloadPodGroupSingleDisruptionMode indicates that individual pods
+// can be disrupted independently.
+type WorkloadPodGroupSingleDisruptionMode struct {
+	// Intentionally empty for now.
+}
+
+// WorkloadPodGroupAllDisruptionMode indicates that all pods in the
+// group must be disrupted together.
+type WorkloadPodGroupAllDisruptionMode struct {
+	// Intentionally empty for now.
+}
+
+// WorkloadCompositePodGroupSchedulingPolicy defines the scheduling policy for a
+// CompositePodGroup (a group of groups) managed by a workload controller.
+// Exactly one policy must be set.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a composite
+// controller's own API, next to its other scheduling fields. It is the
+// group-of-groups analogue of WorkloadPodGroupSchedulingPolicy. The composite
+// scheduling policy is immutable, so it's recommended to freeze the whole
+// field after creation (+k8s:immutable). For example,
+//
+//	type JobSetSchedulingConfiguration struct {
+//		// SchedulingPolicy defines the scheduling policy for this JobSet.
+//		// Exactly one of Basic or Gang must be set.
+//		// This field is immutable after creation.
+//		// +optional
+//		// +k8s:optional
+//		// +k8s:immutable
+//		SchedulingPolicy *schedulingv1alpha3.WorkloadCompositePodGroupSchedulingPolicy `json:"schedulingPolicy,omitempty" protobuf:"bytes,N,opt,name=schedulingPolicy"`
+//
+//		// other scheduling fields
+//	}
+//
+// +union
+type WorkloadCompositePodGroupSchedulingPolicy struct {
+	// basic specifies that the child groups of this composite group should be
+	// scheduled independently.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	Basic *WorkloadCompositePodGroupBasicSchedulingPolicy `json:"basic,omitempty" protobuf:"bytes,1,opt,name=basic"`
+
+	// gang specifies that the child groups of this composite group should be
+	// scheduled using all-or-nothing semantics.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	Gang *WorkloadCompositePodGroupGangSchedulingPolicy `json:"gang,omitempty" protobuf:"bytes,2,opt,name=gang"`
+}
+
+// WorkloadCompositePodGroupBasicSchedulingPolicy indicates that the child groups
+// of a composite group should be scheduled independently.
+type WorkloadCompositePodGroupBasicSchedulingPolicy struct {
+	// Intentionally empty for now.
+}
+
+// WorkloadCompositePodGroupGangSchedulingPolicy defines the parameters for gang
+// scheduling of a composite group's child groups.
+type WorkloadCompositePodGroupGangSchedulingPolicy struct {
+	// minGroupCount is the minimum number of child groups that must be
+	// schedulable at the same time for the scheduler to admit the entire
+	// composite group.
+	// This field is optional. If it is not specified, the controller
+	// should inject a context-specific sane default (e.g., the number of
+	// child groups).
+	// If set, it must be a positive integer.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:minimum=1
+	MinGroupCount *int32 `json:"minGroupCount,omitempty" protobuf:"varint,1,opt,name=minGroupCount"`
+}
+
+// WorkloadCompositePodGroupSchedulingConstraints defines composite-level
+// scheduling constraints, such as topology, for a CompositePodGroup (a group of
+// groups) managed by a workload controller.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a composite
+// controller's own API, next to its other scheduling fields. It is the
+// group-of-groups analogue of WorkloadPodGroupSchedulingConstraints. It's
+// recommended to freeze the field after creation (+k8s:immutable), since
+// constraints are immutable in the compiled Workload. For example,
+//
+//	type JobSetSchedulingConfiguration struct {
+//		// SchedulingConstraints defines scheduling constraints (e.g. topology)
+//		// for this JobSet.
+//		// This field is immutable after creation.
+//		// +optional
+//		// +k8s:optional
+//		// +k8s:immutable
+//		SchedulingConstraints *schedulingv1alpha3.WorkloadCompositePodGroupSchedulingConstraints `json:"schedulingConstraints,omitempty" protobuf:"bytes,N,opt,name=schedulingConstraints"`
+//
+//		// other scheduling fields
+//	}
+type WorkloadCompositePodGroupSchedulingConstraints struct {
+	// topology specifies desired topological placements for all child groups
+	// within the composite group.
+	// If unset, no topology placement is requested.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:maxItems=1
+	// +listType=atomic
+	// +k8s:listType=atomic
+	Topology []TopologyConstraint `json:"topology,omitempty" protobuf:"bytes,1,rep,name=topology"`
+}
+
+// WorkloadCompositePodGroupDisruptionMode defines how the child groups of a
+// composite group can be disrupted. Exactly one mode must be set.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a composite
+// controller's own API, next to its other scheduling fields. It is the
+// group-of-groups analogue of WorkloadPodGroupDisruptionMode. It's recommended
+// to freeze the field after creation (+k8s:immutable), since the selected mode
+// is immutable in the compiled Workload. For example,
+//
+//	type JobSetSchedulingConfiguration struct {
+//		// DisruptionMode defines the mode in which this JobSet's child groups
+//		// can be disrupted.
+//		// One of Single, All.
+//		// This field is immutable after creation: it may not be added or removed,
+//		// and the selected mode may not be changed.
+//		// +optional
+//		// +k8s:optional
+//		// +k8s:immutable
+//		DisruptionMode *schedulingv1alpha3.WorkloadCompositePodGroupDisruptionMode `json:"disruptionMode,omitempty" protobuf:"bytes,N,opt,name=disruptionMode"`
+//
+//		// other scheduling fields
+//	}
+//
+// +union
+type WorkloadCompositePodGroupDisruptionMode struct {
+	// single specifies that child groups can be disrupted independently from
+	// each other.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	Single *WorkloadCompositePodGroupSingleDisruptionMode `json:"single,omitempty" protobuf:"bytes,1,opt,name=single"`
+
+	// all specifies that all child groups must be disrupted together.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	All *WorkloadCompositePodGroupAllDisruptionMode `json:"all,omitempty" protobuf:"bytes,2,opt,name=all"`
+}
+
+// WorkloadCompositePodGroupSingleDisruptionMode indicates that child groups
+// can be disrupted independently.
+type WorkloadCompositePodGroupSingleDisruptionMode struct {
+	// Intentionally empty for now.
+}
+
+// WorkloadCompositePodGroupAllDisruptionMode indicates that all child groups
+// must be disrupted together.
+type WorkloadCompositePodGroupAllDisruptionMode struct {
+	// Intentionally empty for now.
+}
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:supportsSubresource="/status"
+
+// CompositePodGroup represents a runtime instance of pod groups grouped together.
+// CompositePodGroups are created by workload controllers (LWS, JobSet, etc...) from
+// Workload.compositePodGroupTemplates.
+// CompositePodGroup API enablement is toggled by the CompositePodGroup feature gate.
+type CompositePodGroup struct {
+	metav1.TypeMeta `json:""`
+
+	// metadata is the standard object metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	//
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// spec defines the desired state of the CompositePodGroup.
+	//
+	// +required
+	Spec CompositePodGroupSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
+
+	// status represents the current observed state of the CompositePodGroup.
+	//
+	// +optional
+	Status CompositePodGroupStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// CompositePodGroupList contains a list of CompositePodGroup resources.
+type CompositePodGroupList struct {
+	metav1.TypeMeta `json:""`
+	// Standard list metadata.
+	//
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// Items is the list of CompositePodGroups.
+	Items []CompositePodGroup `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+// CompositePodGroupSpec defines the desired state of CompositePodGroup.
+type CompositePodGroupSpec struct {
+	// parentCompositePodGroupName contains the name of the parent composite pod group
+	// within the same namespace as this composite pod group. It must be a DNS name.
+	// If it's nil, then this composite pod group is a root of a workload's hierarchy.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	// +k8s:format=k8s-long-name
+	ParentCompositePodGroupName *string `json:"parentCompositePodGroupName,omitempty" protobuf:"bytes,1,opt,name=parentCompositePodGroupName"`
+
+	// workloadRef references an optional CompositePodGroup template within the
+	// Workload object that was used to create the CompositePodGroup.
+	// This field is required.
+	// This field is immutable.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:immutable
+	WorkloadRef *WorkloadReference `json:"workloadRef" protobuf:"bytes,2,opt,name=workloadRef"`
+
+	// schedulingPolicy defines the scheduling policy for this instance of the CompositePodGroup.
+	// Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate.
+	// This field is immutable.
+	//
+	// +required
+	// +k8s:immutable
+	SchedulingPolicy CompositePodGroupSchedulingPolicy `json:"schedulingPolicy" protobuf:"bytes,3,opt,name=schedulingPolicy"`
+
+	// schedulingConstraints defines optional scheduling constraints (e.g. topology) for this CompositePodGroup.
+	// Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	SchedulingConstraints *CompositePodGroupSchedulingConstraints `json:"schedulingConstraints,omitempty" protobuf:"bytes,4,opt,name=schedulingConstraints"`
+
+	// disruptionMode defines the mode in which a given CompositePodGroup can be disrupted.
+	// Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate.
+	// One of Single, All. Defaults to Single if unset.
+	// This field is immutable.
+	//
+	// +default={"single": {}}
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	DisruptionMode *CompositeDisruptionMode `json:"disruptionMode,omitempty" protobuf:"bytes,5,opt,name=disruptionMode"`
+
+	// priorityClassName defines the priority that should be considered when scheduling this CompositePodGroup.
+	// Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate.
+	// If left unspecified, it is validated and resolved similarly to the PriorityClassName field in Pods
+	// (i.e. if no priority class is specified, admission control can set this to the global default
+	// priority class if it exists. Otherwise, the composite pod group's priority will be zero).
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:format=k8s-long-name
+	// +k8s:immutable
+	PriorityClassName string `json:"priorityClassName,omitempty" protobuf:"bytes,6,opt,name=priorityClassName"`
+
+	// priority is the value of priority of this composite pod group. Various system components
+	// use this field to find the priority of the composite pod group. When Priority Admission
+	// Controller is enabled, it prevents users from setting this field. The admission
+	// controller populates this field from PriorityClassName.
+	// The higher the value, the higher the priority.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	// +k8s:maximum=1000000000 # HighestUserDefinablePriority
+	Priority *int32 `json:"priority,omitempty" protobuf:"varint,7,opt,name=priority"`
+
+	// preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+	// One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset.
+	// When Priority Admission Controller is enabled, it populates this field from PriorityClassName,
+	// and defaults to PreemptLowerPriority if value is unset in PriorityClass.
+	// This field is immutable.
+	// This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+	//
+	// +featureGate=PodGroupPreemptionPolicy
+	// +optional
+	// +k8s:immutable
+	// +k8s:ifDisabled("PodGroupPreemptionPolicy")=+k8s:forbidden
+	// +k8s:ifEnabled("PodGroupPreemptionPolicy")=+k8s:optional
+	PreemptionPolicy *PreemptionPolicy `json:"preemptionPolicy,omitempty" protobuf:"bytes,8,opt,name=preemptionPolicy"`
+}
+
+// CompositePodGroupSchedulingPolicy defines the scheduling configuration for a CompositePodGroup.
+// Exactly one policy must be set.
+//
+// +union
+type CompositePodGroupSchedulingPolicy struct {
+	// basic specifies that the groups of this composite group should be scheduled independently.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	// +k8s:unionMember
+	Basic *CompositeBasicSchedulingPolicy `json:"basic,omitempty" protobuf:"bytes,1,opt,name=basic"`
+
+	// gang specifies that the groups of this composite group should be scheduled using
+	// all-or-nothing semantics.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:update=NoSet
+	// +k8s:update=NoUnset
+	Gang *CompositeGangSchedulingPolicy `json:"gang,omitempty" protobuf:"bytes,2,opt,name=gang"`
+}
+
+// CompositeBasicSchedulingPolicy indicates that the groups belonging to the composite group
+// should be scheduled independently.
+type CompositeBasicSchedulingPolicy struct {
+	// This is intentionally empty. Its presence indicates that the basic group
+	// scheduling policy should be applied. In the future, new fields may appear,
+	// describing such constraints on a composite pod group level without "all or
+	// nothing" (gang) scheduling.
+}
+
+// CompositeGangSchedulingPolicy indicates that the groups belonging to the composite group
+// should be scheduled using all-or-nothing semantics.
+type CompositeGangSchedulingPolicy struct {
+	// minGroupCount is the minimum number of child groups that must be schedulable
+	// or scheduled at the same time for the scheduler to admit the entire group.
+	// It must be a positive integer.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:minimum=1
+	MinGroupCount int32 `json:"minGroupCount" protobuf:"varint,1,req,name=minGroupCount"`
+}
+
+// CompositeDisruptionMode defines how individual entities within a composite pod group can be disrupted.
+// Exactly one mode must be set.
+//
+// +union
+type CompositeDisruptionMode struct {
+	// single specifies that children groups can be disrupted independently from each other.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	Single *SingleCompositeDisruptionMode `json:"single,omitempty" protobuf:"bytes,1,opt,name=single"`
+
+	// all specifies that all children groups can only be disrupted together.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	All *AllCompositeDisruptionMode `json:"all,omitempty" protobuf:"bytes,2,opt,name=all"`
+}
+
+// SingleCompositeDisruptionMode means that individual children of a CompositePodGroup
+// can be disrupted or preempted independently.
+type SingleCompositeDisruptionMode struct {
+	// This is intentionally empty.
+}
+
+// AllCompositeDisruptionMode means that children of a CompositePodGroup can only be
+// disrupted or preempted together.
+type AllCompositeDisruptionMode struct {
+	// This is intentionally empty.
+}
+
+// CompositePodGroupStatus represents information about the status of a composite pod group.
+type CompositePodGroupStatus struct {
+	// conditions represent the latest observations of the CompositePodGroup's state.
+	//
+	// Known condition types:
+	// - "CompositePodGroupInitiallyScheduled": Indicates whether the overall scheduling requirement
+	//   for the subtree under this CompositePodGroup has been satisfied. Once this condition
+	//   transitions to True, it serves as a terminal state and will never revert to False,
+	//   even if pods are subsequently deleted and group constraints are no longer met.
+	// - "DisruptionTarget": Indicates whether the CompositePodGroup is about to be terminated
+	//   due to disruption such as preemption.
+	//
+	// Known reasons for the CompositePodGroupInitiallyScheduled condition:
+	// - "Unschedulable": The CompositePodGroup's subtree could not be placed due to resource constraints,
+	//   affinity/anti-affinity, or topological constraints.
+	// - "SchedulerError": The CompositePodGroup cannot be scheduled due to some internal error
+	//   that occurred during scheduling.
+	// - "Invalid": Set to True when kube-scheduler detects an invalid group layout during
+	//   runtime validation. The `message` field details the specific layout violation (such as
+	//   a detected cycle, exceeding the maximum depth of 4, or referencing multiple distinct Workloads).
+	//
+	// Known reasons for the DisruptionTarget condition:
+	// - "PreemptionByScheduler": The CompositePodGroup was targeted by the scheduler's preemption loop
+	//   to free up capacity for higher-priority preemptors.
+	//
+	// +optional
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
+}
+
+// CompositePodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a CompositePodGroup.
+type CompositePodGroupSchedulingConstraints struct {
+	// topology defines the topology constraints for the composite pod group.
+	// Currently only a single topology constraint can be specified. This may change in the future.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:maxItems=1
+	// +listType=atomic
+	// +k8s:listType=atomic
+	Topology []TopologyConstraint `json:"topology,omitempty" protobuf:"bytes,1,rep,name=topology"`
+}
diff --git a/vendor/k8s.io/api/scheduling/v1alpha3/types_swagger_doc_generated.go b/vendor/k8s.io/api/scheduling/v1alpha3/types_swagger_doc_generated.go
new file mode 100644
index 0000000000..953a72fcd2
--- /dev/null
+++ b/vendor/k8s.io/api/scheduling/v1alpha3/types_swagger_doc_generated.go
@@ -0,0 +1,498 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha3
+
+// This file contains a collection of methods that can be used from go-restful to
+// generate Swagger API documentation for its models. Please read this PR for more
+// information on the implementation: https://github.com/emicklei/go-restful/pull/215
+//
+// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if
+// they are on one line! For multiple line or blocks that you want to ignore use ---.
+// Any context after a --- is ignored.
+//
+// Those methods can be generated by using hack/update-codegen.sh
+
+// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
+var map_AllCompositeDisruptionMode = map[string]string{
+	"": "AllCompositeDisruptionMode means that children of a CompositePodGroup can only be disrupted or preempted together.",
+}
+
+func (AllCompositeDisruptionMode) SwaggerDoc() map[string]string {
+	return map_AllCompositeDisruptionMode
+}
+
+var map_AllDisruptionMode = map[string]string{
+	"": "AllDisruptionMode specifies that children can only be disrupted together.",
+}
+
+func (AllDisruptionMode) SwaggerDoc() map[string]string {
+	return map_AllDisruptionMode
+}
+
+var map_BasicSchedulingPolicy = map[string]string{
+	"": "BasicSchedulingPolicy indicates that standard Kubernetes scheduling behavior should be used.",
+}
+
+func (BasicSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_BasicSchedulingPolicy
+}
+
+var map_CompositeBasicSchedulingPolicy = map[string]string{
+	"": "CompositeBasicSchedulingPolicy indicates that the groups belonging to the composite group should be scheduled independently.",
+}
+
+func (CompositeBasicSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_CompositeBasicSchedulingPolicy
+}
+
+var map_CompositeDisruptionMode = map[string]string{
+	"":       "CompositeDisruptionMode defines how individual entities within a composite pod group can be disrupted. Exactly one mode must be set.",
+	"single": "single specifies that children groups can be disrupted independently from each other.",
+	"all":    "all specifies that all children groups can only be disrupted together.",
+}
+
+func (CompositeDisruptionMode) SwaggerDoc() map[string]string {
+	return map_CompositeDisruptionMode
+}
+
+var map_CompositeGangSchedulingPolicy = map[string]string{
+	"":              "CompositeGangSchedulingPolicy indicates that the groups belonging to the composite group should be scheduled using all-or-nothing semantics.",
+	"minGroupCount": "minGroupCount is the minimum number of child groups that must be schedulable or scheduled at the same time for the scheduler to admit the entire group. It must be a positive integer.",
+}
+
+func (CompositeGangSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_CompositeGangSchedulingPolicy
+}
+
+var map_CompositePodGroup = map[string]string{
+	"":         "CompositePodGroup represents a runtime instance of pod groups grouped together. CompositePodGroups are created by workload controllers (LWS, JobSet, etc...) from Workload.compositePodGroupTemplates. CompositePodGroup API enablement is toggled by the CompositePodGroup feature gate.",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"spec":     "spec defines the desired state of the CompositePodGroup.",
+	"status":   "status represents the current observed state of the CompositePodGroup.",
+}
+
+func (CompositePodGroup) SwaggerDoc() map[string]string {
+	return map_CompositePodGroup
+}
+
+var map_CompositePodGroupList = map[string]string{
+	"":         "CompositePodGroupList contains a list of CompositePodGroup resources.",
+	"metadata": "Standard list metadata.",
+	"items":    "Items is the list of CompositePodGroups.",
+}
+
+func (CompositePodGroupList) SwaggerDoc() map[string]string {
+	return map_CompositePodGroupList
+}
+
+var map_CompositePodGroupSchedulingConstraints = map[string]string{
+	"":         "CompositePodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a CompositePodGroup.",
+	"topology": "topology defines the topology constraints for the composite pod group. Currently only a single topology constraint can be specified. This may change in the future.",
+}
+
+func (CompositePodGroupSchedulingConstraints) SwaggerDoc() map[string]string {
+	return map_CompositePodGroupSchedulingConstraints
+}
+
+var map_CompositePodGroupSchedulingPolicy = map[string]string{
+	"":      "CompositePodGroupSchedulingPolicy defines the scheduling configuration for a CompositePodGroup. Exactly one policy must be set.",
+	"basic": "basic specifies that the groups of this composite group should be scheduled independently. This field is immutable.",
+	"gang":  "gang specifies that the groups of this composite group should be scheduled using all-or-nothing semantics.",
+}
+
+func (CompositePodGroupSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_CompositePodGroupSchedulingPolicy
+}
+
+var map_CompositePodGroupSpec = map[string]string{
+	"":                            "CompositePodGroupSpec defines the desired state of CompositePodGroup.",
+	"parentCompositePodGroupName": "parentCompositePodGroupName contains the name of the parent composite pod group within the same namespace as this composite pod group. It must be a DNS name. If it's nil, then this composite pod group is a root of a workload's hierarchy. This field is immutable.",
+	"workloadRef":                 "workloadRef references an optional CompositePodGroup template within the Workload object that was used to create the CompositePodGroup. This field is required. This field is immutable.",
+	"schedulingPolicy":            "schedulingPolicy defines the scheduling policy for this instance of the CompositePodGroup. Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate. This field is immutable.",
+	"schedulingConstraints":       "schedulingConstraints defines optional scheduling constraints (e.g. topology) for this CompositePodGroup. Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate. This field is immutable.",
+	"disruptionMode":              "disruptionMode defines the mode in which a given CompositePodGroup can be disrupted. Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate. One of Single, All. Defaults to Single if unset. This field is immutable.",
+	"priorityClassName":           "priorityClassName defines the priority that should be considered when scheduling this CompositePodGroup. Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate. If left unspecified, it is validated and resolved similarly to the PriorityClassName field in Pods (i.e. if no priority class is specified, admission control can set this to the global default priority class if it exists. Otherwise, the composite pod group's priority will be zero). This field is immutable.",
+	"priority":                    "priority is the value of priority of this composite pod group. Various system components use this field to find the priority of the composite pod group. When Priority Admission Controller is enabled, it prevents users from setting this field. The admission controller populates this field from PriorityClassName. The higher the value, the higher the priority. This field is immutable.",
+	"preemptionPolicy":            "preemptionPolicy is the Policy for preempting pods/podgroups with lower priority. One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset. When Priority Admission Controller is enabled, it populates this field from PriorityClassName, and defaults to PreemptLowerPriority if value is unset in PriorityClass. This field is immutable. This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.",
+}
+
+func (CompositePodGroupSpec) SwaggerDoc() map[string]string {
+	return map_CompositePodGroupSpec
+}
+
+var map_CompositePodGroupStatus = map[string]string{
+	"":           "CompositePodGroupStatus represents information about the status of a composite pod group.",
+	"conditions": "conditions represent the latest observations of the CompositePodGroup's state.\n\nKnown condition types: - \"CompositePodGroupInitiallyScheduled\": Indicates whether the overall scheduling requirement\n  for the subtree under this CompositePodGroup has been satisfied. Once this condition\n  transitions to True, it serves as a terminal state and will never revert to False,\n  even if pods are subsequently deleted and group constraints are no longer met.\n- \"DisruptionTarget\": Indicates whether the CompositePodGroup is about to be terminated\n  due to disruption such as preemption.\n\nKnown reasons for the CompositePodGroupInitiallyScheduled condition: - \"Unschedulable\": The CompositePodGroup's subtree could not be placed due to resource constraints,\n  affinity/anti-affinity, or topological constraints.\n- \"SchedulerError\": The CompositePodGroup cannot be scheduled due to some internal error\n  that occurred during scheduling.\n- \"Invalid\": Set to True when kube-scheduler detects an invalid group layout during\n  runtime validation. The `message` field details the specific layout violation (such as\n  a detected cycle, exceeding the maximum depth of 4, or referencing multiple distinct Workloads).\n\nKnown reasons for the DisruptionTarget condition: - \"PreemptionByScheduler\": The CompositePodGroup was targeted by the scheduler's preemption loop\n  to free up capacity for higher-priority preemptors.",
+}
+
+func (CompositePodGroupStatus) SwaggerDoc() map[string]string {
+	return map_CompositePodGroupStatus
+}
+
+var map_CompositePodGroupTemplate = map[string]string{
+	"":                           "CompositePodGroupTemplate represents a template for a CompositePodGroup with a scheduling policy.",
+	"name":                       "name is a unique identifier for the CompositePodGroupTemplate within the Workload. It must be a DNS label. This field is required.",
+	"schedulingPolicy":           "schedulingPolicy defines the scheduling policy for this template.",
+	"schedulingConstraints":      "schedulingConstraints defines optional scheduling constraints (e.g. topology) for this CompositePodGroupTemplate. This field is immutable.",
+	"disruptionMode":             "disruptionMode defines the mode in which a given CompositePodGroup can be disrupted. One of Single, All. This field is immutable.",
+	"priorityClassName":          "priorityClassName indicates the priority that should be considered when scheduling a composite pod group created from this template. If no priority class is specified, admission control can set this to the global default priority class if it exists. Otherwise, composite pod groups created from this template will have the priority set to zero. This field is immutable.",
+	"priority":                   "priority is the value of priority of composite pod groups created from this template. Various system components use this field to find the priority of the composite pod group. When Priority Admission Controller is enabled, it prevents users from setting this field. The admission controller populates this field from PriorityClassName. The higher the value, the higher the priority. This field is immutable.",
+	"preemptionPolicy":           "preemptionPolicy is the Policy for preempting pods/podgroups with lower priority. One of Never, PreemptLowerPriority. This field is immutable. This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.",
+	"podGroupTemplates":          "podGroupTemplates is the list of templates for children PodGroups. The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates or PodGroupTemplates must be set.",
+	"compositePodGroupTemplates": "compositePodGroupTemplates is the list of templates for children CompositePodGroups. The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates or PodGroupTemplates must be set.",
+}
+
+func (CompositePodGroupTemplate) SwaggerDoc() map[string]string {
+	return map_CompositePodGroupTemplate
+}
+
+var map_DisruptionMode = map[string]string{
+	"":       "DisruptionMode defines how individual entities within a group can be disrupted. Exactly one mode can be set.",
+	"single": "single specifies that children can be disrupted independently from each other.",
+	"all":    "all specifies that all children can only be disrupted together.",
+}
+
+func (DisruptionMode) SwaggerDoc() map[string]string {
+	return map_DisruptionMode
+}
+
+var map_GangSchedulingPolicy = map[string]string{
+	"":         "GangSchedulingPolicy defines the parameters for gang scheduling.",
+	"minCount": "minCount is the minimum number of pods that must be schedulable or scheduled at the same time for the scheduler to admit the entire group. It must be a positive integer. This field is mutable to support workload scaling.\n\nNote that the scheduler operates on an eventually consistent model. Updates to minCount may not be immediately reflected in scheduling decisions due to propagation delays. If minCount is updated while a scheduling cycle is in progress for that group, the new value may not take effect until the next cycle. Moreover, minCount is only enforced during scheduling, meaning that modifications to this field do not affect already-scheduled pods, applying only to those evaluated in future cycles.",
+}
+
+func (GangSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_GangSchedulingPolicy
+}
+
+var map_PodGroup = map[string]string{
+	"":         "PodGroup represents a runtime instance of pods grouped together. PodGroups are created by workload controllers (Job, LWS, JobSet, etc...) from Workload.podGroupTemplates. PodGroup API enablement is toggled by the GenericWorkload feature gate.",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"spec":     "spec defines the desired state of the PodGroup.",
+	"status":   "status represents the current observed state of the PodGroup.",
+}
+
+func (PodGroup) SwaggerDoc() map[string]string {
+	return map_PodGroup
+}
+
+var map_PodGroupList = map[string]string{
+	"":         "PodGroupList contains a list of PodGroup resources.",
+	"metadata": "Standard list metadata.",
+	"items":    "Items is the list of PodGroups.",
+}
+
+func (PodGroupList) SwaggerDoc() map[string]string {
+	return map_PodGroupList
+}
+
+var map_PodGroupResourceClaim = map[string]string{
+	"":                          "PodGroupResourceClaim references exactly one ResourceClaim, either directly or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim for the PodGroup.\n\nIt adds a name to it that uniquely identifies the ResourceClaim inside the PodGroup. Pods that need access to the ResourceClaim define a matching reference in its own Spec.ResourceClaims. The Pod's claim must match all fields of the PodGroup's claim exactly.",
+	"name":                      "name uniquely identifies this resource claim inside the PodGroup. This must be a DNS_LABEL.",
+	"resourceClaimName":         "resourceClaimName is the name of a ResourceClaim object in the same namespace as this PodGroup. The ResourceClaim will be reserved for the PodGroup instead of its individual pods.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must be set.",
+	"resourceClaimTemplateName": "resourceClaimTemplateName is the name of a ResourceClaimTemplate object in the same namespace as this PodGroup.\n\nThe template will be used to create a new ResourceClaim, which will be bound to this PodGroup. When this PodGroup is deleted, the ResourceClaim will also be deleted. The PodGroup name and resource name, along with a generated component, will be used to form a unique name for the ResourceClaim, which will be recorded in podgroup.status.resourceClaimStatuses.\n\nThis field is immutable and no changes will be made to the corresponding ResourceClaim by the control plane after creating the ResourceClaim.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must be set.",
+}
+
+func (PodGroupResourceClaim) SwaggerDoc() map[string]string {
+	return map_PodGroupResourceClaim
+}
+
+var map_PodGroupResourceClaimStatus = map[string]string{
+	"":                  "PodGroupResourceClaimStatus is stored in the PodGroupStatus for each PodGroupResourceClaim which references a ResourceClaimTemplate. It stores the generated name for the corresponding ResourceClaim.",
+	"name":              "name uniquely identifies this resource claim inside the PodGroup. This must match the name of an entry in podgroup.spec.resourceClaims, which implies that the string must be a DNS_LABEL.",
+	"resourceClaimName": "resourceClaimName is the name of the ResourceClaim that was generated for the PodGroup in the namespace of the PodGroup. If this is unset, then generating a ResourceClaim was not necessary. The podgroup.spec.resourceClaims entry can be ignored in this case.",
+}
+
+func (PodGroupResourceClaimStatus) SwaggerDoc() map[string]string {
+	return map_PodGroupResourceClaimStatus
+}
+
+var map_PodGroupSchedulingConstraints = map[string]string{
+	"":         "PodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a PodGroup.",
+	"topology": "topology defines the topology constraints for the pod group. Currently only a single topology constraint can be specified. This may change in the future.",
+}
+
+func (PodGroupSchedulingConstraints) SwaggerDoc() map[string]string {
+	return map_PodGroupSchedulingConstraints
+}
+
+var map_PodGroupSchedulingPolicy = map[string]string{
+	"":      "PodGroupSchedulingPolicy defines the scheduling configuration for a PodGroup. Exactly one policy must be set. The policy is chosen at creation time by setting either the Basic or Gang field. The PodGroup may not change policy after creation. Fields within chosen policy may be updated after creation when their individual fields allow it.",
+	"basic": "basic specifies that the pods in this group should be scheduled using standard Kubernetes scheduling behavior. Setting this field at group creation time opts this group to basic scheduling; this field cannot be changed afterward.",
+	"gang":  "gang specifies that the pods in this group should be scheduled using all-or-nothing semantics. Setting this field at group creation time opts this group to gang scheduling; this field cannot be set or unset afterward. The minCount field within Gang scheduling policy remains mutable after group creation.",
+}
+
+func (PodGroupSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_PodGroupSchedulingPolicy
+}
+
+var map_PodGroupSpec = map[string]string{
+	"":                            "PodGroupSpec defines the desired state of a PodGroup.",
+	"parentCompositePodGroupName": "parentCompositePodGroupName contains the name of the parent composite pod group within the same namespace as this pod group. If it's nil, then this pod group is a root of a workload's hierarchy. This field is used only when the CompositePodGroup feature gate is enabled. This field is immutable.",
+	"workloadRef":                 "workloadRef references an optional PodGroup template within the Workload object that was used to create the PodGroup. This field is immutable.",
+	"schedulingPolicy":            "schedulingPolicy defines the scheduling policy for this instance of the PodGroup. Controllers are expected to fill this field by copying it from a PodGroupTemplate.",
+	"schedulingConstraints":       "schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroup. Controllers are expected to fill this field by copying it from a PodGroupTemplate. This field is immutable. This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.",
+	"resourceClaims":              "resourceClaims defines which ResourceClaims may be shared among Pods in the group. Pods consume the devices allocated to a PodGroup's claim by defining a claim in its own Spec.ResourceClaims that matches the PodGroup's claim exactly. The claim must have the same name and refer to the same ResourceClaim or ResourceClaimTemplate.\n\nThis is a beta-level field and requires that the DRAWorkloadResourceClaims feature gate is enabled.\n\nThis field is immutable.",
+	"disruptionMode":              "disruptionMode defines the mode in which a given PodGroup can be disrupted. Controllers are expected to fill this field by copying it from a PodGroupTemplate. One of Single, All. Defaults to Single if unset. This field is immutable.",
+	"priorityClassName":           "priorityClassName defines the priority that should be considered when scheduling this pod group. Controllers are expected to fill this field by copying it from a PodGroupTemplate. Otherwise, it is validated and resolved similarly to the PriorityClassName on PodGroupTemplate (i.e. if no priority class is specified, admission control can set this to the global default priority class if it exists. Otherwise, the pod group's priority will be zero). This field is immutable.",
+	"priority":                    "priority is the value of priority of this pod group. Various system components use this field to find the priority of the pod group. When Priority Admission Controller is enabled, it prevents users from setting this field. The admission controller populates this field from PriorityClassName. The higher the value, the higher the priority. This field is immutable.",
+	"preemptionPolicy":            "preemptionPolicy is the Policy for preempting pods/podgroups with lower priority. One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset. When Priority Admission Controller is enabled, it populates this field from PriorityClassName, and defaults to PreemptLowerPriority if value is unset in PriorityClass. This field is immutable. This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.",
+}
+
+func (PodGroupSpec) SwaggerDoc() map[string]string {
+	return map_PodGroupSpec
+}
+
+var map_PodGroupStatus = map[string]string{
+	"":                      "PodGroupStatus represents information about the status of a pod group.",
+	"conditions":            "conditions represent the latest observations of the PodGroup's state.\n\nKnown condition types: - \"PodGroupInitiallyScheduled\": Indicates whether the scheduling requirement has been satisfied. Once this condition transitions to True, it serves as a terminal state and will never revert to False, even if pods are subsequently evicted and group constraints are no longer met. - \"DisruptionTarget\": Indicates whether the PodGroup is about to be terminated\n  due to disruption such as preemption.\n\nKnown reasons for the PodGroupInitiallyScheduled condition: - \"Unschedulable\": The PodGroup cannot be scheduled due to resource constraints,\n  affinity/anti-affinity rules, or insufficient capacity for the gang.\n- \"SchedulerError\": The PodGroup cannot be scheduled due to some internal error\n  that happened during scheduling, for example due to nodeAffinity parsing errors.\n\nKnown reasons for the DisruptionTarget condition: - \"PreemptionByScheduler\": The PodGroup was preempted by the scheduler to make room for\n  higher-priority PodGroups or Pods.",
+	"resourceClaimStatuses": "resourceClaimStatuses is status of resource claims.",
+}
+
+func (PodGroupStatus) SwaggerDoc() map[string]string {
+	return map_PodGroupStatus
+}
+
+var map_PodGroupTemplate = map[string]string{
+	"":                      "PodGroupTemplate represents a template for a set of pods with a scheduling policy.",
+	"name":                  "name is a unique identifier for the PodGroupTemplate within the Workload. It must be a DNS label. This field is immutable.",
+	"schedulingPolicy":      "schedulingPolicy defines the scheduling policy for this PodGroupTemplate.",
+	"schedulingConstraints": "schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroupTemplate. This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled. This field is immutable.",
+	"resourceClaims":        "resourceClaims defines which ResourceClaims may be shared among Pods in the group. Pods consume the devices allocated to a PodGroup's claim by defining a claim in its own Spec.ResourceClaims that matches the PodGroup's claim exactly. The claim must have the same name and refer to the same ResourceClaim or ResourceClaimTemplate.\n\nThis is a beta-level field and requires that the DRAWorkloadResourceClaims feature gate is enabled.\n\nThis field is immutable.",
+	"disruptionMode":        "disruptionMode defines the mode in which a given PodGroup can be disrupted. One of Single, All. This field is immutable.",
+	"priorityClassName":     "priorityClassName indicates the priority that should be considered when scheduling a pod group created from this template. This field is immutable.",
+	"priority":              "priority is the value of priority of pod groups created from this template. Various system components use this field to find the priority of the pod group. The higher the value, the higher the priority. This field is immutable.",
+	"preemptionPolicy":      "preemptionPolicy is the Policy for preempting pods/podgroups with lower priority. One of Never, PreemptLowerPriority. This field is immutable. This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.",
+}
+
+func (PodGroupTemplate) SwaggerDoc() map[string]string {
+	return map_PodGroupTemplate
+}
+
+var map_SingleCompositeDisruptionMode = map[string]string{
+	"": "SingleCompositeDisruptionMode means that individual children of a CompositePodGroup can be disrupted or preempted independently.",
+}
+
+func (SingleCompositeDisruptionMode) SwaggerDoc() map[string]string {
+	return map_SingleCompositeDisruptionMode
+}
+
+var map_SingleDisruptionMode = map[string]string{
+	"": "SingleDisruptionMode specifies that children can be disrupted independently.",
+}
+
+func (SingleDisruptionMode) SwaggerDoc() map[string]string {
+	return map_SingleDisruptionMode
+}
+
+var map_TopologyConstraint = map[string]string{
+	"":    "TopologyConstraint defines a topology constraint for a PodGroup.",
+	"key": "key specifies the key of the node label representing the topology domain. All pods within the PodGroup must be colocated within the same domain instance. Different PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate. Examples: \"topology.kubernetes.io/rack\"",
+}
+
+func (TopologyConstraint) SwaggerDoc() map[string]string {
+	return map_TopologyConstraint
+}
+
+var map_TypedLocalObjectReference = map[string]string{
+	"":         "TypedLocalObjectReference allows to reference typed object inside the same namespace.",
+	"apiGroup": "apiGroup is the group for the resource being referenced. If APIGroup is empty, the specified Kind must be in the core API group. For any other third-party types, setting APIGroup is required. It must be a DNS subdomain.",
+	"kind":     "kind is the type of resource being referenced. It must be a path segment name.",
+	"name":     "name is the name of resource being referenced. It must be a path segment name.",
+}
+
+func (TypedLocalObjectReference) SwaggerDoc() map[string]string {
+	return map_TypedLocalObjectReference
+}
+
+var map_Workload = map[string]string{
+	"":         "Workload allows for expressing scheduling constraints that should be used when managing the lifecycle of workloads from the scheduling perspective, including scheduling, preemption, eviction and other phases. Workload API enablement is toggled by the GenericWorkload feature gate.",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"spec":     "spec defines the desired behavior of a Workload.",
+}
+
+func (Workload) SwaggerDoc() map[string]string {
+	return map_Workload
+}
+
+var map_WorkloadCompositePodGroupAllDisruptionMode = map[string]string{
+	"": "WorkloadCompositePodGroupAllDisruptionMode indicates that all child groups must be disrupted together.",
+}
+
+func (WorkloadCompositePodGroupAllDisruptionMode) SwaggerDoc() map[string]string {
+	return map_WorkloadCompositePodGroupAllDisruptionMode
+}
+
+var map_WorkloadCompositePodGroupBasicSchedulingPolicy = map[string]string{
+	"": "WorkloadCompositePodGroupBasicSchedulingPolicy indicates that the child groups of a composite group should be scheduled independently.",
+}
+
+func (WorkloadCompositePodGroupBasicSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_WorkloadCompositePodGroupBasicSchedulingPolicy
+}
+
+var map_WorkloadCompositePodGroupDisruptionMode = map[string]string{
+	"":       "WorkloadCompositePodGroupDisruptionMode defines how the child groups of a composite group can be disrupted. Exactly one mode must be set.",
+	"single": "single specifies that child groups can be disrupted independently from each other.",
+	"all":    "all specifies that all child groups must be disrupted together.",
+}
+
+func (WorkloadCompositePodGroupDisruptionMode) SwaggerDoc() map[string]string {
+	return map_WorkloadCompositePodGroupDisruptionMode
+}
+
+var map_WorkloadCompositePodGroupGangSchedulingPolicy = map[string]string{
+	"":              "WorkloadCompositePodGroupGangSchedulingPolicy defines the parameters for gang scheduling of a composite group's child groups.",
+	"minGroupCount": "minGroupCount is the minimum number of child groups that must be schedulable at the same time for the scheduler to admit the entire composite group. This field is optional. If it is not specified, the controller should inject a context-specific sane default (e.g., the number of child groups). If set, it must be a positive integer.",
+}
+
+func (WorkloadCompositePodGroupGangSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_WorkloadCompositePodGroupGangSchedulingPolicy
+}
+
+var map_WorkloadCompositePodGroupSchedulingConstraints = map[string]string{
+	"":         "WorkloadCompositePodGroupSchedulingConstraints defines composite-level scheduling constraints, such as topology, for a CompositePodGroup (a group of groups) managed by a workload controller.",
+	"topology": "topology specifies desired topological placements for all child groups within the composite group. If unset, no topology placement is requested.",
+}
+
+func (WorkloadCompositePodGroupSchedulingConstraints) SwaggerDoc() map[string]string {
+	return map_WorkloadCompositePodGroupSchedulingConstraints
+}
+
+var map_WorkloadCompositePodGroupSchedulingPolicy = map[string]string{
+	"":      "WorkloadCompositePodGroupSchedulingPolicy defines the scheduling policy for a CompositePodGroup (a group of groups) managed by a workload controller. Exactly one policy must be set.",
+	"basic": "basic specifies that the child groups of this composite group should be scheduled independently.",
+	"gang":  "gang specifies that the child groups of this composite group should be scheduled using all-or-nothing semantics.",
+}
+
+func (WorkloadCompositePodGroupSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_WorkloadCompositePodGroupSchedulingPolicy
+}
+
+var map_WorkloadCompositePodGroupSingleDisruptionMode = map[string]string{
+	"": "WorkloadCompositePodGroupSingleDisruptionMode indicates that child groups can be disrupted independently.",
+}
+
+func (WorkloadCompositePodGroupSingleDisruptionMode) SwaggerDoc() map[string]string {
+	return map_WorkloadCompositePodGroupSingleDisruptionMode
+}
+
+var map_WorkloadList = map[string]string{
+	"":         "WorkloadList contains a list of Workload resources.",
+	"metadata": "Standard list metadata.",
+	"items":    "Items is the list of Workloads.",
+}
+
+func (WorkloadList) SwaggerDoc() map[string]string {
+	return map_WorkloadList
+}
+
+var map_WorkloadPodGroupAllDisruptionMode = map[string]string{
+	"": "WorkloadPodGroupAllDisruptionMode indicates that all pods in the group must be disrupted together.",
+}
+
+func (WorkloadPodGroupAllDisruptionMode) SwaggerDoc() map[string]string {
+	return map_WorkloadPodGroupAllDisruptionMode
+}
+
+var map_WorkloadPodGroupBasicSchedulingPolicy = map[string]string{
+	"": "WorkloadPodGroupBasicSchedulingPolicy indicates standard Kubernetes scheduling behavior.",
+}
+
+func (WorkloadPodGroupBasicSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_WorkloadPodGroupBasicSchedulingPolicy
+}
+
+var map_WorkloadPodGroupDisruptionMode = map[string]string{
+	"":       "WorkloadPodGroupDisruptionMode defines how individual pods within a group can be disrupted. Exactly one mode must be set.",
+	"single": "single specifies that pods can be disrupted independently from each other.",
+	"all":    "all specifies that all pods in the group must be disrupted together.",
+}
+
+func (WorkloadPodGroupDisruptionMode) SwaggerDoc() map[string]string {
+	return map_WorkloadPodGroupDisruptionMode
+}
+
+var map_WorkloadPodGroupGangSchedulingPolicy = map[string]string{
+	"":         "WorkloadPodGroupGangSchedulingPolicy defines the parameters for gang (all-or-nothing) scheduling.",
+	"minCount": "minCount is the minimum number of pods that must be scheduled at the same time for the scheduler to admit the entire group. This field is optional. If it is not specified, the controller should inject a context-specific sane default (e.g., parallelism for a Job). If set, it must be a positive integer.",
+}
+
+func (WorkloadPodGroupGangSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_WorkloadPodGroupGangSchedulingPolicy
+}
+
+var map_WorkloadPodGroupResourceClaim = map[string]string{
+	"":                          "WorkloadPodGroupResourceClaim references a dynamic resource claim that is shared across pods in the group.",
+	"name":                      "name uniquely identifies this resource claim inside the group. This field is required. It must be a DNS_LABEL.",
+	"resourceClaimName":         "resourceClaimName is the name of a ResourceClaim object in the same namespace. This field is optional. If it is not specified, no resource claim is used. If set, it must be a DNS subdomain.",
+	"resourceClaimTemplateName": "resourceClaimTemplateName is the name of a ResourceClaimTemplate object in the same namespace. This field is optional. If it is not specified, no resource claim template is used. If set, it must be a DNS subdomain.",
+}
+
+func (WorkloadPodGroupResourceClaim) SwaggerDoc() map[string]string {
+	return map_WorkloadPodGroupResourceClaim
+}
+
+var map_WorkloadPodGroupSchedulingConstraints = map[string]string{
+	"":         "WorkloadPodGroupSchedulingConstraints defines leaf-level scheduling constraints, such as topology.",
+	"topology": "topology specifies desired topological placements for all pods within the pod group. If unset, no topology placement is requested.",
+}
+
+func (WorkloadPodGroupSchedulingConstraints) SwaggerDoc() map[string]string {
+	return map_WorkloadPodGroupSchedulingConstraints
+}
+
+var map_WorkloadPodGroupSchedulingPolicy = map[string]string{
+	"":      "WorkloadPodGroupSchedulingPolicy defines the scheduling policy for a group of pods managed by a workload controller. Exactly one policy must be set.",
+	"basic": "basic specifies that standard, pod-by-pod Kubernetes scheduling behavior should be used.",
+	"gang":  "gang specifies all-or-nothing scheduling semantics.",
+}
+
+func (WorkloadPodGroupSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_WorkloadPodGroupSchedulingPolicy
+}
+
+var map_WorkloadPodGroupSingleDisruptionMode = map[string]string{
+	"": "WorkloadPodGroupSingleDisruptionMode indicates that individual pods can be disrupted independently.",
+}
+
+func (WorkloadPodGroupSingleDisruptionMode) SwaggerDoc() map[string]string {
+	return map_WorkloadPodGroupSingleDisruptionMode
+}
+
+var map_WorkloadReference = map[string]string{
+	"":             "WorkloadReference references the Workload object together with the template that was used to create a particular PodGroup.",
+	"workloadName": "workloadName is the name of the Workload object that contains a template that was used when creating a pod group. It must be a DNS name. This field is required.",
+	"templateName": "templateName is the name of a template within the Workload object that was used to create a pod group. It must be a DNS label. This field is required.",
+}
+
+func (WorkloadReference) SwaggerDoc() map[string]string {
+	return map_WorkloadReference
+}
+
+var map_WorkloadSpec = map[string]string{
+	"":                           "WorkloadSpec defines the desired state of a Workload.",
+	"controllerRef":              "controllerRef is an optional reference to the controlling object, such as a Deployment or Job. This field is intended for use by tools like CLIs to provide a link back to the original workload definition. This field is immutable.",
+	"podGroupTemplates":          "podGroupTemplates is the list of templates that make up the Workload. The maximum number of templates is 8. Templates cannot be added or removed after the workload is created. Existing templates may still be updated where their individual fields allow it. Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.",
+	"compositePodGroupTemplates": "compositePodGroupTemplates is the list of CompositePodGroup templates that make up the Workload. The maximum number of templates is 8. This field is immutable. Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.\n\nThis field is used only when the CompositePodGroup feature gate is enabled.",
+}
+
+func (WorkloadSpec) SwaggerDoc() map[string]string {
+	return map_WorkloadSpec
+}
+
+// AUTO-GENERATED FUNCTIONS END HERE
diff --git a/vendor/k8s.io/api/scheduling/v1alpha3/zz_generated.deepcopy.go b/vendor/k8s.io/api/scheduling/v1alpha3/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..ae0a82088b
--- /dev/null
+++ b/vendor/k8s.io/api/scheduling/v1alpha3/zz_generated.deepcopy.go
@@ -0,0 +1,1172 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AllCompositeDisruptionMode) DeepCopyInto(out *AllCompositeDisruptionMode) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AllCompositeDisruptionMode.
+func (in *AllCompositeDisruptionMode) DeepCopy() *AllCompositeDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(AllCompositeDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AllDisruptionMode) DeepCopyInto(out *AllDisruptionMode) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AllDisruptionMode.
+func (in *AllDisruptionMode) DeepCopy() *AllDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(AllDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BasicSchedulingPolicy) DeepCopyInto(out *BasicSchedulingPolicy) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BasicSchedulingPolicy.
+func (in *BasicSchedulingPolicy) DeepCopy() *BasicSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(BasicSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositeBasicSchedulingPolicy) DeepCopyInto(out *CompositeBasicSchedulingPolicy) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositeBasicSchedulingPolicy.
+func (in *CompositeBasicSchedulingPolicy) DeepCopy() *CompositeBasicSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositeBasicSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositeDisruptionMode) DeepCopyInto(out *CompositeDisruptionMode) {
+	*out = *in
+	if in.Single != nil {
+		in, out := &in.Single, &out.Single
+		*out = new(SingleCompositeDisruptionMode)
+		**out = **in
+	}
+	if in.All != nil {
+		in, out := &in.All, &out.All
+		*out = new(AllCompositeDisruptionMode)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositeDisruptionMode.
+func (in *CompositeDisruptionMode) DeepCopy() *CompositeDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositeDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositeGangSchedulingPolicy) DeepCopyInto(out *CompositeGangSchedulingPolicy) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositeGangSchedulingPolicy.
+func (in *CompositeGangSchedulingPolicy) DeepCopy() *CompositeGangSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositeGangSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositePodGroup) DeepCopyInto(out *CompositePodGroup) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositePodGroup.
+func (in *CompositePodGroup) DeepCopy() *CompositePodGroup {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositePodGroup)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CompositePodGroup) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositePodGroupList) DeepCopyInto(out *CompositePodGroupList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]CompositePodGroup, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositePodGroupList.
+func (in *CompositePodGroupList) DeepCopy() *CompositePodGroupList {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositePodGroupList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *CompositePodGroupList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositePodGroupSchedulingConstraints) DeepCopyInto(out *CompositePodGroupSchedulingConstraints) {
+	*out = *in
+	if in.Topology != nil {
+		in, out := &in.Topology, &out.Topology
+		*out = make([]TopologyConstraint, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositePodGroupSchedulingConstraints.
+func (in *CompositePodGroupSchedulingConstraints) DeepCopy() *CompositePodGroupSchedulingConstraints {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositePodGroupSchedulingConstraints)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositePodGroupSchedulingPolicy) DeepCopyInto(out *CompositePodGroupSchedulingPolicy) {
+	*out = *in
+	if in.Basic != nil {
+		in, out := &in.Basic, &out.Basic
+		*out = new(CompositeBasicSchedulingPolicy)
+		**out = **in
+	}
+	if in.Gang != nil {
+		in, out := &in.Gang, &out.Gang
+		*out = new(CompositeGangSchedulingPolicy)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositePodGroupSchedulingPolicy.
+func (in *CompositePodGroupSchedulingPolicy) DeepCopy() *CompositePodGroupSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositePodGroupSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositePodGroupSpec) DeepCopyInto(out *CompositePodGroupSpec) {
+	*out = *in
+	if in.ParentCompositePodGroupName != nil {
+		in, out := &in.ParentCompositePodGroupName, &out.ParentCompositePodGroupName
+		*out = new(string)
+		**out = **in
+	}
+	if in.WorkloadRef != nil {
+		in, out := &in.WorkloadRef, &out.WorkloadRef
+		*out = new(WorkloadReference)
+		**out = **in
+	}
+	in.SchedulingPolicy.DeepCopyInto(&out.SchedulingPolicy)
+	if in.SchedulingConstraints != nil {
+		in, out := &in.SchedulingConstraints, &out.SchedulingConstraints
+		*out = new(CompositePodGroupSchedulingConstraints)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.DisruptionMode != nil {
+		in, out := &in.DisruptionMode, &out.DisruptionMode
+		*out = new(CompositeDisruptionMode)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Priority != nil {
+		in, out := &in.Priority, &out.Priority
+		*out = new(int32)
+		**out = **in
+	}
+	if in.PreemptionPolicy != nil {
+		in, out := &in.PreemptionPolicy, &out.PreemptionPolicy
+		*out = new(PreemptionPolicy)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositePodGroupSpec.
+func (in *CompositePodGroupSpec) DeepCopy() *CompositePodGroupSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositePodGroupSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositePodGroupStatus) DeepCopyInto(out *CompositePodGroupStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositePodGroupStatus.
+func (in *CompositePodGroupStatus) DeepCopy() *CompositePodGroupStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositePodGroupStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositePodGroupTemplate) DeepCopyInto(out *CompositePodGroupTemplate) {
+	*out = *in
+	in.SchedulingPolicy.DeepCopyInto(&out.SchedulingPolicy)
+	if in.SchedulingConstraints != nil {
+		in, out := &in.SchedulingConstraints, &out.SchedulingConstraints
+		*out = new(CompositePodGroupSchedulingConstraints)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.DisruptionMode != nil {
+		in, out := &in.DisruptionMode, &out.DisruptionMode
+		*out = new(CompositeDisruptionMode)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Priority != nil {
+		in, out := &in.Priority, &out.Priority
+		*out = new(int32)
+		**out = **in
+	}
+	if in.PreemptionPolicy != nil {
+		in, out := &in.PreemptionPolicy, &out.PreemptionPolicy
+		*out = new(PreemptionPolicy)
+		**out = **in
+	}
+	if in.PodGroupTemplates != nil {
+		in, out := &in.PodGroupTemplates, &out.PodGroupTemplates
+		*out = make([]PodGroupTemplate, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.CompositePodGroupTemplates != nil {
+		in, out := &in.CompositePodGroupTemplates, &out.CompositePodGroupTemplates
+		*out = make([]CompositePodGroupTemplate, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositePodGroupTemplate.
+func (in *CompositePodGroupTemplate) DeepCopy() *CompositePodGroupTemplate {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositePodGroupTemplate)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DisruptionMode) DeepCopyInto(out *DisruptionMode) {
+	*out = *in
+	if in.Single != nil {
+		in, out := &in.Single, &out.Single
+		*out = new(SingleDisruptionMode)
+		**out = **in
+	}
+	if in.All != nil {
+		in, out := &in.All, &out.All
+		*out = new(AllDisruptionMode)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DisruptionMode.
+func (in *DisruptionMode) DeepCopy() *DisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(DisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GangSchedulingPolicy) DeepCopyInto(out *GangSchedulingPolicy) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GangSchedulingPolicy.
+func (in *GangSchedulingPolicy) DeepCopy() *GangSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(GangSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroup) DeepCopyInto(out *PodGroup) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroup.
+func (in *PodGroup) DeepCopy() *PodGroup {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroup)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PodGroup) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupList) DeepCopyInto(out *PodGroupList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]PodGroup, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupList.
+func (in *PodGroupList) DeepCopy() *PodGroupList {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PodGroupList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupResourceClaim) DeepCopyInto(out *PodGroupResourceClaim) {
+	*out = *in
+	if in.ResourceClaimName != nil {
+		in, out := &in.ResourceClaimName, &out.ResourceClaimName
+		*out = new(string)
+		**out = **in
+	}
+	if in.ResourceClaimTemplateName != nil {
+		in, out := &in.ResourceClaimTemplateName, &out.ResourceClaimTemplateName
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupResourceClaim.
+func (in *PodGroupResourceClaim) DeepCopy() *PodGroupResourceClaim {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupResourceClaim)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupResourceClaimStatus) DeepCopyInto(out *PodGroupResourceClaimStatus) {
+	*out = *in
+	if in.ResourceClaimName != nil {
+		in, out := &in.ResourceClaimName, &out.ResourceClaimName
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupResourceClaimStatus.
+func (in *PodGroupResourceClaimStatus) DeepCopy() *PodGroupResourceClaimStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupResourceClaimStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupSchedulingConstraints) DeepCopyInto(out *PodGroupSchedulingConstraints) {
+	*out = *in
+	if in.Topology != nil {
+		in, out := &in.Topology, &out.Topology
+		*out = make([]TopologyConstraint, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupSchedulingConstraints.
+func (in *PodGroupSchedulingConstraints) DeepCopy() *PodGroupSchedulingConstraints {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupSchedulingConstraints)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupSchedulingPolicy) DeepCopyInto(out *PodGroupSchedulingPolicy) {
+	*out = *in
+	if in.Basic != nil {
+		in, out := &in.Basic, &out.Basic
+		*out = new(BasicSchedulingPolicy)
+		**out = **in
+	}
+	if in.Gang != nil {
+		in, out := &in.Gang, &out.Gang
+		*out = new(GangSchedulingPolicy)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupSchedulingPolicy.
+func (in *PodGroupSchedulingPolicy) DeepCopy() *PodGroupSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupSpec) DeepCopyInto(out *PodGroupSpec) {
+	*out = *in
+	if in.ParentCompositePodGroupName != nil {
+		in, out := &in.ParentCompositePodGroupName, &out.ParentCompositePodGroupName
+		*out = new(string)
+		**out = **in
+	}
+	if in.WorkloadRef != nil {
+		in, out := &in.WorkloadRef, &out.WorkloadRef
+		*out = new(WorkloadReference)
+		**out = **in
+	}
+	in.SchedulingPolicy.DeepCopyInto(&out.SchedulingPolicy)
+	if in.SchedulingConstraints != nil {
+		in, out := &in.SchedulingConstraints, &out.SchedulingConstraints
+		*out = new(PodGroupSchedulingConstraints)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ResourceClaims != nil {
+		in, out := &in.ResourceClaims, &out.ResourceClaims
+		*out = make([]PodGroupResourceClaim, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.DisruptionMode != nil {
+		in, out := &in.DisruptionMode, &out.DisruptionMode
+		*out = new(DisruptionMode)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Priority != nil {
+		in, out := &in.Priority, &out.Priority
+		*out = new(int32)
+		**out = **in
+	}
+	if in.PreemptionPolicy != nil {
+		in, out := &in.PreemptionPolicy, &out.PreemptionPolicy
+		*out = new(PreemptionPolicy)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupSpec.
+func (in *PodGroupSpec) DeepCopy() *PodGroupSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupStatus) DeepCopyInto(out *PodGroupStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.ResourceClaimStatuses != nil {
+		in, out := &in.ResourceClaimStatuses, &out.ResourceClaimStatuses
+		*out = make([]PodGroupResourceClaimStatus, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupStatus.
+func (in *PodGroupStatus) DeepCopy() *PodGroupStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupTemplate) DeepCopyInto(out *PodGroupTemplate) {
+	*out = *in
+	in.SchedulingPolicy.DeepCopyInto(&out.SchedulingPolicy)
+	if in.SchedulingConstraints != nil {
+		in, out := &in.SchedulingConstraints, &out.SchedulingConstraints
+		*out = new(PodGroupSchedulingConstraints)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ResourceClaims != nil {
+		in, out := &in.ResourceClaims, &out.ResourceClaims
+		*out = make([]PodGroupResourceClaim, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.DisruptionMode != nil {
+		in, out := &in.DisruptionMode, &out.DisruptionMode
+		*out = new(DisruptionMode)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Priority != nil {
+		in, out := &in.Priority, &out.Priority
+		*out = new(int32)
+		**out = **in
+	}
+	if in.PreemptionPolicy != nil {
+		in, out := &in.PreemptionPolicy, &out.PreemptionPolicy
+		*out = new(PreemptionPolicy)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupTemplate.
+func (in *PodGroupTemplate) DeepCopy() *PodGroupTemplate {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupTemplate)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SingleCompositeDisruptionMode) DeepCopyInto(out *SingleCompositeDisruptionMode) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SingleCompositeDisruptionMode.
+func (in *SingleCompositeDisruptionMode) DeepCopy() *SingleCompositeDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(SingleCompositeDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SingleDisruptionMode) DeepCopyInto(out *SingleDisruptionMode) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SingleDisruptionMode.
+func (in *SingleDisruptionMode) DeepCopy() *SingleDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(SingleDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TopologyConstraint) DeepCopyInto(out *TopologyConstraint) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TopologyConstraint.
+func (in *TopologyConstraint) DeepCopy() *TopologyConstraint {
+	if in == nil {
+		return nil
+	}
+	out := new(TopologyConstraint)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TypedLocalObjectReference) DeepCopyInto(out *TypedLocalObjectReference) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TypedLocalObjectReference.
+func (in *TypedLocalObjectReference) DeepCopy() *TypedLocalObjectReference {
+	if in == nil {
+		return nil
+	}
+	out := new(TypedLocalObjectReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Workload) DeepCopyInto(out *Workload) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Workload.
+func (in *Workload) DeepCopy() *Workload {
+	if in == nil {
+		return nil
+	}
+	out := new(Workload)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Workload) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadCompositePodGroupAllDisruptionMode) DeepCopyInto(out *WorkloadCompositePodGroupAllDisruptionMode) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadCompositePodGroupAllDisruptionMode.
+func (in *WorkloadCompositePodGroupAllDisruptionMode) DeepCopy() *WorkloadCompositePodGroupAllDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadCompositePodGroupAllDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadCompositePodGroupBasicSchedulingPolicy) DeepCopyInto(out *WorkloadCompositePodGroupBasicSchedulingPolicy) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadCompositePodGroupBasicSchedulingPolicy.
+func (in *WorkloadCompositePodGroupBasicSchedulingPolicy) DeepCopy() *WorkloadCompositePodGroupBasicSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadCompositePodGroupBasicSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadCompositePodGroupDisruptionMode) DeepCopyInto(out *WorkloadCompositePodGroupDisruptionMode) {
+	*out = *in
+	if in.Single != nil {
+		in, out := &in.Single, &out.Single
+		*out = new(WorkloadCompositePodGroupSingleDisruptionMode)
+		**out = **in
+	}
+	if in.All != nil {
+		in, out := &in.All, &out.All
+		*out = new(WorkloadCompositePodGroupAllDisruptionMode)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadCompositePodGroupDisruptionMode.
+func (in *WorkloadCompositePodGroupDisruptionMode) DeepCopy() *WorkloadCompositePodGroupDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadCompositePodGroupDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadCompositePodGroupGangSchedulingPolicy) DeepCopyInto(out *WorkloadCompositePodGroupGangSchedulingPolicy) {
+	*out = *in
+	if in.MinGroupCount != nil {
+		in, out := &in.MinGroupCount, &out.MinGroupCount
+		*out = new(int32)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadCompositePodGroupGangSchedulingPolicy.
+func (in *WorkloadCompositePodGroupGangSchedulingPolicy) DeepCopy() *WorkloadCompositePodGroupGangSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadCompositePodGroupGangSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadCompositePodGroupSchedulingConstraints) DeepCopyInto(out *WorkloadCompositePodGroupSchedulingConstraints) {
+	*out = *in
+	if in.Topology != nil {
+		in, out := &in.Topology, &out.Topology
+		*out = make([]TopologyConstraint, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadCompositePodGroupSchedulingConstraints.
+func (in *WorkloadCompositePodGroupSchedulingConstraints) DeepCopy() *WorkloadCompositePodGroupSchedulingConstraints {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadCompositePodGroupSchedulingConstraints)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadCompositePodGroupSchedulingPolicy) DeepCopyInto(out *WorkloadCompositePodGroupSchedulingPolicy) {
+	*out = *in
+	if in.Basic != nil {
+		in, out := &in.Basic, &out.Basic
+		*out = new(WorkloadCompositePodGroupBasicSchedulingPolicy)
+		**out = **in
+	}
+	if in.Gang != nil {
+		in, out := &in.Gang, &out.Gang
+		*out = new(WorkloadCompositePodGroupGangSchedulingPolicy)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadCompositePodGroupSchedulingPolicy.
+func (in *WorkloadCompositePodGroupSchedulingPolicy) DeepCopy() *WorkloadCompositePodGroupSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadCompositePodGroupSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadCompositePodGroupSingleDisruptionMode) DeepCopyInto(out *WorkloadCompositePodGroupSingleDisruptionMode) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadCompositePodGroupSingleDisruptionMode.
+func (in *WorkloadCompositePodGroupSingleDisruptionMode) DeepCopy() *WorkloadCompositePodGroupSingleDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadCompositePodGroupSingleDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadList) DeepCopyInto(out *WorkloadList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Workload, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadList.
+func (in *WorkloadList) DeepCopy() *WorkloadList {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *WorkloadList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadPodGroupAllDisruptionMode) DeepCopyInto(out *WorkloadPodGroupAllDisruptionMode) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadPodGroupAllDisruptionMode.
+func (in *WorkloadPodGroupAllDisruptionMode) DeepCopy() *WorkloadPodGroupAllDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadPodGroupAllDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadPodGroupBasicSchedulingPolicy) DeepCopyInto(out *WorkloadPodGroupBasicSchedulingPolicy) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadPodGroupBasicSchedulingPolicy.
+func (in *WorkloadPodGroupBasicSchedulingPolicy) DeepCopy() *WorkloadPodGroupBasicSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadPodGroupBasicSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadPodGroupDisruptionMode) DeepCopyInto(out *WorkloadPodGroupDisruptionMode) {
+	*out = *in
+	if in.Single != nil {
+		in, out := &in.Single, &out.Single
+		*out = new(WorkloadPodGroupSingleDisruptionMode)
+		**out = **in
+	}
+	if in.All != nil {
+		in, out := &in.All, &out.All
+		*out = new(WorkloadPodGroupAllDisruptionMode)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadPodGroupDisruptionMode.
+func (in *WorkloadPodGroupDisruptionMode) DeepCopy() *WorkloadPodGroupDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadPodGroupDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadPodGroupGangSchedulingPolicy) DeepCopyInto(out *WorkloadPodGroupGangSchedulingPolicy) {
+	*out = *in
+	if in.MinCount != nil {
+		in, out := &in.MinCount, &out.MinCount
+		*out = new(int32)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadPodGroupGangSchedulingPolicy.
+func (in *WorkloadPodGroupGangSchedulingPolicy) DeepCopy() *WorkloadPodGroupGangSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadPodGroupGangSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadPodGroupResourceClaim) DeepCopyInto(out *WorkloadPodGroupResourceClaim) {
+	*out = *in
+	if in.ResourceClaimName != nil {
+		in, out := &in.ResourceClaimName, &out.ResourceClaimName
+		*out = new(string)
+		**out = **in
+	}
+	if in.ResourceClaimTemplateName != nil {
+		in, out := &in.ResourceClaimTemplateName, &out.ResourceClaimTemplateName
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadPodGroupResourceClaim.
+func (in *WorkloadPodGroupResourceClaim) DeepCopy() *WorkloadPodGroupResourceClaim {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadPodGroupResourceClaim)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadPodGroupSchedulingConstraints) DeepCopyInto(out *WorkloadPodGroupSchedulingConstraints) {
+	*out = *in
+	if in.Topology != nil {
+		in, out := &in.Topology, &out.Topology
+		*out = make([]TopologyConstraint, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadPodGroupSchedulingConstraints.
+func (in *WorkloadPodGroupSchedulingConstraints) DeepCopy() *WorkloadPodGroupSchedulingConstraints {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadPodGroupSchedulingConstraints)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadPodGroupSchedulingPolicy) DeepCopyInto(out *WorkloadPodGroupSchedulingPolicy) {
+	*out = *in
+	if in.Basic != nil {
+		in, out := &in.Basic, &out.Basic
+		*out = new(WorkloadPodGroupBasicSchedulingPolicy)
+		**out = **in
+	}
+	if in.Gang != nil {
+		in, out := &in.Gang, &out.Gang
+		*out = new(WorkloadPodGroupGangSchedulingPolicy)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadPodGroupSchedulingPolicy.
+func (in *WorkloadPodGroupSchedulingPolicy) DeepCopy() *WorkloadPodGroupSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadPodGroupSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadPodGroupSingleDisruptionMode) DeepCopyInto(out *WorkloadPodGroupSingleDisruptionMode) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadPodGroupSingleDisruptionMode.
+func (in *WorkloadPodGroupSingleDisruptionMode) DeepCopy() *WorkloadPodGroupSingleDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadPodGroupSingleDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadReference) DeepCopyInto(out *WorkloadReference) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadReference.
+func (in *WorkloadReference) DeepCopy() *WorkloadReference {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadSpec) DeepCopyInto(out *WorkloadSpec) {
+	*out = *in
+	if in.ControllerRef != nil {
+		in, out := &in.ControllerRef, &out.ControllerRef
+		*out = new(TypedLocalObjectReference)
+		**out = **in
+	}
+	if in.PodGroupTemplates != nil {
+		in, out := &in.PodGroupTemplates, &out.PodGroupTemplates
+		*out = make([]PodGroupTemplate, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.CompositePodGroupTemplates != nil {
+		in, out := &in.CompositePodGroupTemplates, &out.CompositePodGroupTemplates
+		*out = make([]CompositePodGroupTemplate, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadSpec.
+func (in *WorkloadSpec) DeepCopy() *WorkloadSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadSpec)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/vendor/k8s.io/api/scheduling/v1alpha3/zz_generated.model_name.go b/vendor/k8s.io/api/scheduling/v1alpha3/zz_generated.model_name.go
new file mode 100644
index 0000000000..acd9818f25
--- /dev/null
+++ b/vendor/k8s.io/api/scheduling/v1alpha3/zz_generated.model_name.go
@@ -0,0 +1,257 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by openapi-gen. DO NOT EDIT.
+
+package v1alpha3
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in AllCompositeDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.AllCompositeDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in AllDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.AllDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BasicSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.BasicSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositeBasicSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.CompositeBasicSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositeDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.CompositeDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositeGangSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.CompositeGangSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositePodGroup) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.CompositePodGroup"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositePodGroupList) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.CompositePodGroupList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositePodGroupSchedulingConstraints) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.CompositePodGroupSchedulingConstraints"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositePodGroupSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.CompositePodGroupSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositePodGroupSpec) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.CompositePodGroupSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositePodGroupStatus) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.CompositePodGroupStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositePodGroupTemplate) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.CompositePodGroupTemplate"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.DisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GangSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.GangSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroup) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.PodGroup"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupList) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.PodGroupList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupResourceClaim) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.PodGroupResourceClaim"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupResourceClaimStatus) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.PodGroupResourceClaimStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupSchedulingConstraints) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.PodGroupSchedulingConstraints"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.PodGroupSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupSpec) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.PodGroupSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupStatus) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.PodGroupStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupTemplate) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.PodGroupTemplate"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SingleCompositeDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.SingleCompositeDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SingleDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.SingleDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TopologyConstraint) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.TopologyConstraint"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TypedLocalObjectReference) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.TypedLocalObjectReference"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Workload) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.Workload"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadCompositePodGroupAllDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadCompositePodGroupAllDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadCompositePodGroupBasicSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadCompositePodGroupBasicSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadCompositePodGroupDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadCompositePodGroupDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadCompositePodGroupGangSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadCompositePodGroupGangSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadCompositePodGroupSchedulingConstraints) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadCompositePodGroupSchedulingConstraints"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadCompositePodGroupSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadCompositePodGroupSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadCompositePodGroupSingleDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadCompositePodGroupSingleDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadList) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadPodGroupAllDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupAllDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadPodGroupBasicSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupBasicSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadPodGroupDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadPodGroupGangSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupGangSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadPodGroupResourceClaim) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupResourceClaim"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadPodGroupSchedulingConstraints) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupSchedulingConstraints"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadPodGroupSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadPodGroupSingleDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupSingleDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadReference) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadReference"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadSpec) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1alpha3.WorkloadSpec"
+}
diff --git a/vendor/k8s.io/api/scheduling/v1alpha3/zz_generated.validations.go b/vendor/k8s.io/api/scheduling/v1alpha3/zz_generated.validations.go
new file mode 100644
index 0000000000..3202dbe2be
--- /dev/null
+++ b/vendor/k8s.io/api/scheduling/v1alpha3/zz_generated.validations.go
@@ -0,0 +1,3368 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	context "context"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	validation "k8s.io/apimachinery/pkg/apis/meta/v1/validation"
+	sets "k8s.io/apimachinery/pkg/util/sets"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+var unionMembershipFor_k8s_io_api_scheduling_v1alpha3_CompositeDisruptionMode_ = validate.NewUnionMembership(validate.NewUnionMember("single"), validate.NewUnionMember("all"))
+
+// Validate_CompositeDisruptionMode validates an instance of CompositeDisruptionMode according
+// to declarative validation rules in the API schema.
+func Validate_CompositeDisruptionMode(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *CompositeDisruptionMode) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_api_scheduling_v1alpha3_CompositeDisruptionMode_,
+		func(obj *CompositeDisruptionMode) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Single != nil
+		},
+		func(obj *CompositeDisruptionMode) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.All != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field CompositeDisruptionMode.Single
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *SingleCompositeDisruptionMode,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositeDisruptionMode) *SingleCompositeDisruptionMode {
+				return oldObj.Single
+			})
+		errs = append(errs, fn(fldPath.Child("single"), obj.Single, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositeDisruptionMode.All
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *AllCompositeDisruptionMode,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositeDisruptionMode) *AllCompositeDisruptionMode {
+				return oldObj.All
+			})
+		errs = append(errs, fn(fldPath.Child("all"), obj.All, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_CompositeGangSchedulingPolicy validates an instance of CompositeGangSchedulingPolicy according
+// to declarative validation rules in the API schema.
+func Validate_CompositeGangSchedulingPolicy(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *CompositeGangSchedulingPolicy) (errs field.ErrorList) {
+
+	{ // field CompositeGangSchedulingPolicy.MinGroupCount
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int32,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositeGangSchedulingPolicy) *int32 {
+				return &oldObj.MinGroupCount
+			})
+		errs = append(errs, fn(fldPath.Child("minGroupCount"), &obj.MinGroupCount, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_CompositePodGroup validates an instance of CompositePodGroup according
+// to declarative validation rules in the API schema.
+func Validate_CompositePodGroup(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *CompositePodGroup) (errs field.ErrorList) {
+
+	// field CompositePodGroup.TypeMeta has no validation
+
+	{ // field CompositePodGroup.ObjectMeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.ObjectMeta,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, validation.Validate_ObjectMeta(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroup) *v1.ObjectMeta {
+				return &oldObj.ObjectMeta
+			})
+		errs = append(errs, fn(fldPath.Child("metadata"), &obj.ObjectMeta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroup.Spec
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *CompositePodGroupSpec,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_CompositePodGroupSpec(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroup) *CompositePodGroupSpec {
+				return &oldObj.Spec
+			})
+		errs = append(errs, fn(fldPath.Child("spec"), &obj.Spec, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroup.Status
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *CompositePodGroupStatus,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_CompositePodGroupStatus(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroup) *CompositePodGroupStatus {
+				return &oldObj.Status
+			})
+		errs = append(errs, fn(fldPath.Child("status"), &obj.Status, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_CompositePodGroupSchedulingConstraints validates an instance of CompositePodGroupSchedulingConstraints according
+// to declarative validation rules in the API schema.
+func Validate_CompositePodGroupSchedulingConstraints(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *CompositePodGroupSchedulingConstraints) (errs field.ErrorList) {
+
+	{ // field CompositePodGroupSchedulingConstraints.Topology
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []TopologyConstraint,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 1).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_TopologyConstraint); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupSchedulingConstraints) []TopologyConstraint {
+				return oldObj.Topology
+			})
+		errs = append(errs, fn(fldPath.Child("topology"), obj.Topology, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_api_scheduling_v1alpha3_CompositePodGroupSchedulingPolicy_ = validate.NewUnionMembership(validate.NewUnionMember("basic"), validate.NewUnionMember("gang"))
+
+// Validate_CompositePodGroupSchedulingPolicy validates an instance of CompositePodGroupSchedulingPolicy according
+// to declarative validation rules in the API schema.
+func Validate_CompositePodGroupSchedulingPolicy(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *CompositePodGroupSchedulingPolicy) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_api_scheduling_v1alpha3_CompositePodGroupSchedulingPolicy_,
+		func(obj *CompositePodGroupSchedulingPolicy) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Basic != nil
+		},
+		func(obj *CompositePodGroupSchedulingPolicy) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Gang != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field CompositePodGroupSchedulingPolicy.Basic
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *CompositeBasicSchedulingPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupSchedulingPolicy) *CompositeBasicSchedulingPolicy {
+				return oldObj.Basic
+			})
+		errs = append(errs, fn(fldPath.Child("basic"), obj.Basic, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupSchedulingPolicy.Gang
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *CompositeGangSchedulingPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.UpdatePointer(ctx, op, fldPath, obj, oldObj, validate.NoSet, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_CompositeGangSchedulingPolicy(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupSchedulingPolicy) *CompositeGangSchedulingPolicy {
+				return oldObj.Gang
+			})
+		errs = append(errs, fn(fldPath.Child("gang"), obj.Gang, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_CompositePodGroupSpec validates an instance of CompositePodGroupSpec according
+// to declarative validation rules in the API schema.
+func Validate_CompositePodGroupSpec(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *CompositePodGroupSpec) (errs field.ErrorList) {
+
+	{ // field CompositePodGroupSpec.ParentCompositePodGroupName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupSpec) *string {
+				return oldObj.ParentCompositePodGroupName
+			})
+		errs = append(errs, fn(fldPath.Child("parentCompositePodGroupName"), obj.ParentCompositePodGroupName, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupSpec.WorkloadRef
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *WorkloadReference,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_WorkloadReference(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupSpec) *WorkloadReference {
+				return oldObj.WorkloadRef
+			})
+		errs = append(errs, fn(fldPath.Child("workloadRef"), obj.WorkloadRef, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupSpec.SchedulingPolicy
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *CompositePodGroupSchedulingPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_CompositePodGroupSchedulingPolicy(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupSpec) *CompositePodGroupSchedulingPolicy {
+				return &oldObj.SchedulingPolicy
+			})
+		errs = append(errs, fn(fldPath.Child("schedulingPolicy"), &obj.SchedulingPolicy, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupSpec.SchedulingConstraints
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *CompositePodGroupSchedulingConstraints,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_CompositePodGroupSchedulingConstraints(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupSpec) *CompositePodGroupSchedulingConstraints {
+				return oldObj.SchedulingConstraints
+			})
+		errs = append(errs, fn(fldPath.Child("schedulingConstraints"), obj.SchedulingConstraints, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupSpec.DisruptionMode
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *CompositeDisruptionMode,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			// optional fields with default values are effectively required
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_CompositeDisruptionMode(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupSpec) *CompositeDisruptionMode {
+				return oldObj.DisruptionMode
+			})
+		errs = append(errs, fn(fldPath.Child("disruptionMode"), obj.DisruptionMode, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupSpec.PriorityClassName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupSpec) *string {
+				return &oldObj.PriorityClassName
+			})
+		errs = append(errs, fn(fldPath.Child("priorityClassName"), &obj.PriorityClassName, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupSpec.Priority
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int32,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1000000000); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupSpec) *int32 {
+				return oldObj.Priority
+			})
+		errs = append(errs, fn(fldPath.Child("priority"), obj.Priority, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupSpec.PreemptionPolicy
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *PreemptionPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "PodGroupPreemptionPolicy", false, validate.ForbiddenPointer).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "PodGroupPreemptionPolicy", false, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "PodGroupPreemptionPolicy", true, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_PreemptionPolicy(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupSpec) *PreemptionPolicy {
+				return oldObj.PreemptionPolicy
+			})
+		errs = append(errs, fn(fldPath.Child("preemptionPolicy"), obj.PreemptionPolicy, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_CompositePodGroupStatus validates an instance of CompositePodGroupStatus according
+// to declarative validation rules in the API schema.
+func Validate_CompositePodGroupStatus(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *CompositePodGroupStatus) (errs field.ErrorList) {
+
+	{ // field CompositePodGroupStatus.Conditions
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []v1.Condition,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupStatus) []v1.Condition {
+				return oldObj.Conditions
+			})
+		errs = append(errs, fn(fldPath.Child("conditions"), obj.Conditions, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_CompositePodGroupTemplate validates an instance of CompositePodGroupTemplate according
+// to declarative validation rules in the API schema.
+func Validate_CompositePodGroupTemplate(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *CompositePodGroupTemplate) (errs field.ErrorList) {
+
+	{ // field CompositePodGroupTemplate.Name
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ShortName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupTemplate) *string {
+				return &oldObj.Name
+			})
+		errs = append(errs, fn(fldPath.Child("name"), &obj.Name, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupTemplate.SchedulingPolicy
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *CompositePodGroupSchedulingPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_CompositePodGroupSchedulingPolicy(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupTemplate) *CompositePodGroupSchedulingPolicy {
+				return &oldObj.SchedulingPolicy
+			})
+		errs = append(errs, fn(fldPath.Child("schedulingPolicy"), &obj.SchedulingPolicy, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupTemplate.SchedulingConstraints
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *CompositePodGroupSchedulingConstraints,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_CompositePodGroupSchedulingConstraints(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupTemplate) *CompositePodGroupSchedulingConstraints {
+				return oldObj.SchedulingConstraints
+			})
+		errs = append(errs, fn(fldPath.Child("schedulingConstraints"), obj.SchedulingConstraints, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupTemplate.DisruptionMode
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *CompositeDisruptionMode,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_CompositeDisruptionMode(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupTemplate) *CompositeDisruptionMode {
+				return oldObj.DisruptionMode
+			})
+		errs = append(errs, fn(fldPath.Child("disruptionMode"), obj.DisruptionMode, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupTemplate.PriorityClassName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupTemplate) *string {
+				return &oldObj.PriorityClassName
+			})
+		errs = append(errs, fn(fldPath.Child("priorityClassName"), &obj.PriorityClassName, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupTemplate.Priority
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int32,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1000000000); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupTemplate) *int32 {
+				return oldObj.Priority
+			})
+		errs = append(errs, fn(fldPath.Child("priority"), obj.Priority, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupTemplate.PreemptionPolicy
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *PreemptionPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "PodGroupPreemptionPolicy", false, validate.ForbiddenPointer).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "PodGroupPreemptionPolicy", false, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "PodGroupPreemptionPolicy", true, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_PreemptionPolicy(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupTemplate) *PreemptionPolicy {
+				return oldObj.PreemptionPolicy
+			})
+		errs = append(errs, fn(fldPath.Child("preemptionPolicy"), obj.PreemptionPolicy, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupTemplate.PodGroupTemplates
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []PodGroupTemplate,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 8).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj,
+				func(a *PodGroupTemplate, b *PodGroupTemplate) bool { return a.Name == b.Name }, validate.NoAddItem, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *PodGroupTemplate, b *PodGroupTemplate) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *PodGroupTemplate, b *PodGroupTemplate) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodGroupTemplate); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupTemplate) []PodGroupTemplate {
+				return oldObj.PodGroupTemplates
+			})
+		errs = append(errs, fn(fldPath.Child("podGroupTemplates"), obj.PodGroupTemplates, oldVal, oldObj != nil)...)
+	}
+
+	{ // field CompositePodGroupTemplate.CompositePodGroupTemplates
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []CompositePodGroupTemplate,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 8).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj,
+				func(a *CompositePodGroupTemplate, b *CompositePodGroupTemplate) bool { return a.Name == b.Name }, validate.NoAddItem, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *CompositePodGroupTemplate, b *CompositePodGroupTemplate) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *CompositePodGroupTemplate, b *CompositePodGroupTemplate) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_CompositePodGroupTemplate); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *CompositePodGroupTemplate) []CompositePodGroupTemplate {
+				return oldObj.CompositePodGroupTemplates
+			})
+		errs = append(errs, fn(fldPath.Child("compositePodGroupTemplates"), obj.CompositePodGroupTemplates, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_api_scheduling_v1alpha3_DisruptionMode_ = validate.NewUnionMembership(validate.NewUnionMember("single"), validate.NewUnionMember("all"))
+
+// Validate_DisruptionMode validates an instance of DisruptionMode according
+// to declarative validation rules in the API schema.
+func Validate_DisruptionMode(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *DisruptionMode) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_api_scheduling_v1alpha3_DisruptionMode_,
+		func(obj *DisruptionMode) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Single != nil
+		},
+		func(obj *DisruptionMode) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.All != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field DisruptionMode.Single
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *SingleDisruptionMode,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DisruptionMode) *SingleDisruptionMode {
+				return oldObj.Single
+			})
+		errs = append(errs, fn(fldPath.Child("single"), obj.Single, oldVal, oldObj != nil)...)
+	}
+
+	{ // field DisruptionMode.All
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *AllDisruptionMode,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *DisruptionMode) *AllDisruptionMode {
+				return oldObj.All
+			})
+		errs = append(errs, fn(fldPath.Child("all"), obj.All, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_GangSchedulingPolicy validates an instance of GangSchedulingPolicy according
+// to declarative validation rules in the API schema.
+func Validate_GangSchedulingPolicy(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *GangSchedulingPolicy) (errs field.ErrorList) {
+
+	{ // field GangSchedulingPolicy.MinCount
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int32,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *GangSchedulingPolicy) *int32 {
+				return &oldObj.MinCount
+			})
+		errs = append(errs, fn(fldPath.Child("minCount"), &obj.MinCount, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_PodGroup validates an instance of PodGroup according
+// to declarative validation rules in the API schema.
+func Validate_PodGroup(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *PodGroup) (errs field.ErrorList) {
+
+	// field PodGroup.TypeMeta has no validation
+
+	{ // field PodGroup.ObjectMeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.ObjectMeta,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, validation.Validate_ObjectMeta(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroup) *v1.ObjectMeta {
+				return &oldObj.ObjectMeta
+			})
+		errs = append(errs, fn(fldPath.Child("metadata"), &obj.ObjectMeta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroup.Spec
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *PodGroupSpec,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_PodGroupSpec(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroup) *PodGroupSpec {
+				return &oldObj.Spec
+			})
+		errs = append(errs, fn(fldPath.Child("spec"), &obj.Spec, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroup.Status
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *PodGroupStatus,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_PodGroupStatus(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroup) *PodGroupStatus {
+				return &oldObj.Status
+			})
+		errs = append(errs, fn(fldPath.Child("status"), &obj.Status, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_api_scheduling_v1alpha3_PodGroupResourceClaim_ = validate.NewUnionMembership(validate.NewUnionMember("resourceClaimName"), validate.NewUnionMember("resourceClaimTemplateName"))
+
+// Validate_PodGroupResourceClaim validates an instance of PodGroupResourceClaim according
+// to declarative validation rules in the API schema.
+func Validate_PodGroupResourceClaim(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *PodGroupResourceClaim) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_api_scheduling_v1alpha3_PodGroupResourceClaim_,
+		func(obj *PodGroupResourceClaim) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.ResourceClaimName != nil
+		},
+		func(obj *PodGroupResourceClaim) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.ResourceClaimTemplateName != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field PodGroupResourceClaim.Name
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ShortName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupResourceClaim) *string {
+				return &oldObj.Name
+			})
+		errs = append(errs, fn(fldPath.Child("name"), &obj.Name, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupResourceClaim.ResourceClaimName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupResourceClaim) *string {
+				return oldObj.ResourceClaimName
+			})
+		errs = append(errs, fn(fldPath.Child("resourceClaimName"), obj.ResourceClaimName, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupResourceClaim.ResourceClaimTemplateName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupResourceClaim) *string {
+				return oldObj.ResourceClaimTemplateName
+			})
+		errs = append(errs, fn(fldPath.Child("resourceClaimTemplateName"), obj.ResourceClaimTemplateName, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_PodGroupResourceClaimStatus validates an instance of PodGroupResourceClaimStatus according
+// to declarative validation rules in the API schema.
+func Validate_PodGroupResourceClaimStatus(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *PodGroupResourceClaimStatus) (errs field.ErrorList) {
+
+	// field PodGroupResourceClaimStatus.Name has no validation
+
+	{ // field PodGroupResourceClaimStatus.ResourceClaimName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupResourceClaimStatus) *string {
+				return oldObj.ResourceClaimName
+			})
+		errs = append(errs, fn(fldPath.Child("resourceClaimName"), obj.ResourceClaimName, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_PodGroupSchedulingConstraints validates an instance of PodGroupSchedulingConstraints according
+// to declarative validation rules in the API schema.
+func Validate_PodGroupSchedulingConstraints(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *PodGroupSchedulingConstraints) (errs field.ErrorList) {
+
+	{ // field PodGroupSchedulingConstraints.Topology
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []TopologyConstraint,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 1).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_TopologyConstraint); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupSchedulingConstraints) []TopologyConstraint {
+				return oldObj.Topology
+			})
+		errs = append(errs, fn(fldPath.Child("topology"), obj.Topology, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_api_scheduling_v1alpha3_PodGroupSchedulingPolicy_ = validate.NewUnionMembership(validate.NewUnionMember("basic"), validate.NewUnionMember("gang"))
+
+// Validate_PodGroupSchedulingPolicy validates an instance of PodGroupSchedulingPolicy according
+// to declarative validation rules in the API schema.
+func Validate_PodGroupSchedulingPolicy(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *PodGroupSchedulingPolicy) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_api_scheduling_v1alpha3_PodGroupSchedulingPolicy_,
+		func(obj *PodGroupSchedulingPolicy) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Basic != nil
+		},
+		func(obj *PodGroupSchedulingPolicy) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Gang != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field PodGroupSchedulingPolicy.Basic
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *BasicSchedulingPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupSchedulingPolicy) *BasicSchedulingPolicy {
+				return oldObj.Basic
+			})
+		errs = append(errs, fn(fldPath.Child("basic"), obj.Basic, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupSchedulingPolicy.Gang
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *GangSchedulingPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.UpdatePointer(ctx, op, fldPath, obj, oldObj, validate.NoSet, validate.NoUnset).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_GangSchedulingPolicy(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupSchedulingPolicy) *GangSchedulingPolicy {
+				return oldObj.Gang
+			})
+		errs = append(errs, fn(fldPath.Child("gang"), obj.Gang, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_PodGroupSpec validates an instance of PodGroupSpec according
+// to declarative validation rules in the API schema.
+func Validate_PodGroupSpec(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *PodGroupSpec) (errs field.ErrorList) {
+
+	if e := validate.DependentRequired(ctx, op, fldPath, obj, oldObj, "parentCompositePodGroupName",
+		func(obj *PodGroupSpec) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.ParentCompositePodGroupName != nil
+		}, "workloadRef",
+		func(obj *PodGroupSpec) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.WorkloadRef != nil
+		}).MarkAlpha(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field PodGroupSpec.ParentCompositePodGroupName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "CompositePodGroup", false, validate.ForbiddenPointer).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "CompositePodGroup", false, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "CompositePodGroup", true, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupSpec) *string {
+				return oldObj.ParentCompositePodGroupName
+			})
+		errs = append(errs, fn(fldPath.Child("parentCompositePodGroupName"), obj.ParentCompositePodGroupName, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupSpec.WorkloadRef
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *WorkloadReference,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_WorkloadReference(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupSpec) *WorkloadReference {
+				return oldObj.WorkloadRef
+			})
+		errs = append(errs, fn(fldPath.Child("workloadRef"), obj.WorkloadRef, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupSpec.SchedulingPolicy
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *PodGroupSchedulingPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_PodGroupSchedulingPolicy(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupSpec) *PodGroupSchedulingPolicy {
+				return &oldObj.SchedulingPolicy
+			})
+		errs = append(errs, fn(fldPath.Child("schedulingPolicy"), &obj.SchedulingPolicy, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupSpec.SchedulingConstraints
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *PodGroupSchedulingConstraints,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "TopologyAwareWorkloadScheduling", false, validate.ForbiddenPointer).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "TopologyAwareWorkloadScheduling", false, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "TopologyAwareWorkloadScheduling", true, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "TopologyAwareWorkloadScheduling", true, validate.Immutable).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_PodGroupSchedulingConstraints(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupSpec) *PodGroupSchedulingConstraints {
+				return oldObj.SchedulingConstraints
+			})
+		errs = append(errs, fn(fldPath.Child("schedulingConstraints"), obj.SchedulingConstraints, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupSpec.ResourceClaims
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []PodGroupResourceClaim,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 4).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *PodGroupResourceClaim, b *PodGroupResourceClaim) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *PodGroupResourceClaim, b *PodGroupResourceClaim) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodGroupResourceClaim); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupSpec) []PodGroupResourceClaim {
+				return oldObj.ResourceClaims
+			})
+		errs = append(errs, fn(fldPath.Child("resourceClaims"), obj.ResourceClaims, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupSpec.DisruptionMode
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DisruptionMode,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			// optional fields with default values are effectively required
+			if e := validate.RequiredPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DisruptionMode(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupSpec) *DisruptionMode {
+				return oldObj.DisruptionMode
+			})
+		errs = append(errs, fn(fldPath.Child("disruptionMode"), obj.DisruptionMode, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupSpec.PriorityClassName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupSpec) *string {
+				return &oldObj.PriorityClassName
+			})
+		errs = append(errs, fn(fldPath.Child("priorityClassName"), &obj.PriorityClassName, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupSpec.Priority
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int32,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1000000000); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupSpec) *int32 {
+				return oldObj.Priority
+			})
+		errs = append(errs, fn(fldPath.Child("priority"), obj.Priority, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupSpec.PreemptionPolicy
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *PreemptionPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "PodGroupPreemptionPolicy", false, validate.ForbiddenPointer).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "PodGroupPreemptionPolicy", false, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "PodGroupPreemptionPolicy", true, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_PreemptionPolicy(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupSpec) *PreemptionPolicy {
+				return oldObj.PreemptionPolicy
+			})
+		errs = append(errs, fn(fldPath.Child("preemptionPolicy"), obj.PreemptionPolicy, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_PodGroupStatus validates an instance of PodGroupStatus according
+// to declarative validation rules in the API schema.
+func Validate_PodGroupStatus(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *PodGroupStatus) (errs field.ErrorList) {
+
+	{ // field PodGroupStatus.Conditions
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []v1.Condition,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *v1.Condition, b *v1.Condition) bool { return a.Type == b.Type }, validate.SemanticDeepEqual, validation.Validate_Condition); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupStatus) []v1.Condition {
+				return oldObj.Conditions
+			})
+		errs = append(errs, fn(fldPath.Child("conditions"), obj.Conditions, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupStatus.ResourceClaimStatuses
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []PodGroupResourceClaimStatus,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 4).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *PodGroupResourceClaimStatus, b *PodGroupResourceClaimStatus) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *PodGroupResourceClaimStatus, b *PodGroupResourceClaimStatus) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodGroupResourceClaimStatus); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupStatus) []PodGroupResourceClaimStatus {
+				return oldObj.ResourceClaimStatuses
+			})
+		errs = append(errs, fn(fldPath.Child("resourceClaimStatuses"), obj.ResourceClaimStatuses, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_PodGroupTemplate validates an instance of PodGroupTemplate according
+// to declarative validation rules in the API schema.
+func Validate_PodGroupTemplate(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *PodGroupTemplate) (errs field.ErrorList) {
+
+	{ // field PodGroupTemplate.Name
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ShortName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupTemplate) *string {
+				return &oldObj.Name
+			})
+		errs = append(errs, fn(fldPath.Child("name"), &obj.Name, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupTemplate.SchedulingPolicy
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *PodGroupSchedulingPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_PodGroupSchedulingPolicy(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupTemplate) *PodGroupSchedulingPolicy {
+				return &oldObj.SchedulingPolicy
+			})
+		errs = append(errs, fn(fldPath.Child("schedulingPolicy"), &obj.SchedulingPolicy, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupTemplate.SchedulingConstraints
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *PodGroupSchedulingConstraints,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "TopologyAwareWorkloadScheduling", false, validate.ForbiddenPointer).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "TopologyAwareWorkloadScheduling", false, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "TopologyAwareWorkloadScheduling", true, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_PodGroupSchedulingConstraints(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupTemplate) *PodGroupSchedulingConstraints {
+				return oldObj.SchedulingConstraints
+			})
+		errs = append(errs, fn(fldPath.Child("schedulingConstraints"), obj.SchedulingConstraints, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupTemplate.ResourceClaims
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []PodGroupResourceClaim,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 4).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *PodGroupResourceClaim, b *PodGroupResourceClaim) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *PodGroupResourceClaim, b *PodGroupResourceClaim) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodGroupResourceClaim); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupTemplate) []PodGroupResourceClaim {
+				return oldObj.ResourceClaims
+			})
+		errs = append(errs, fn(fldPath.Child("resourceClaims"), obj.ResourceClaims, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupTemplate.DisruptionMode
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *DisruptionMode,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_DisruptionMode(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupTemplate) *DisruptionMode {
+				return oldObj.DisruptionMode
+			})
+		errs = append(errs, fn(fldPath.Child("disruptionMode"), obj.DisruptionMode, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupTemplate.PriorityClassName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupTemplate) *string {
+				return &oldObj.PriorityClassName
+			})
+		errs = append(errs, fn(fldPath.Child("priorityClassName"), &obj.PriorityClassName, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupTemplate.Priority
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int32,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 1000000000); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupTemplate) *int32 {
+				return oldObj.Priority
+			})
+		errs = append(errs, fn(fldPath.Child("priority"), obj.Priority, oldVal, oldObj != nil)...)
+	}
+
+	{ // field PodGroupTemplate.PreemptionPolicy
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *PreemptionPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "PodGroupPreemptionPolicy", false, validate.ForbiddenPointer).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "PodGroupPreemptionPolicy", false, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "PodGroupPreemptionPolicy", true, validate.OptionalPointer).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_PreemptionPolicy(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *PodGroupTemplate) *PreemptionPolicy {
+				return oldObj.PreemptionPolicy
+			})
+		errs = append(errs, fn(fldPath.Child("preemptionPolicy"), obj.PreemptionPolicy, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var symbolsForPreemptionPolicy = sets.New(PreemptLowerPriority, PreemptNever)
+
+// Validate_PreemptionPolicy validates an instance of PreemptionPolicy according
+// to declarative validation rules in the API schema.
+func Validate_PreemptionPolicy(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *PreemptionPolicy) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForPreemptionPolicy, nil); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_TopologyConstraint validates an instance of TopologyConstraint according
+// to declarative validation rules in the API schema.
+func Validate_TopologyConstraint(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *TopologyConstraint) (errs field.ErrorList) {
+
+	{ // field TopologyConstraint.Key
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LabelKey(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *TopologyConstraint) *string {
+				return &oldObj.Key
+			})
+		errs = append(errs, fn(fldPath.Child("key"), &obj.Key, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_TypedLocalObjectReference validates an instance of TypedLocalObjectReference according
+// to declarative validation rules in the API schema.
+func Validate_TypedLocalObjectReference(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *TypedLocalObjectReference) (errs field.ErrorList) {
+
+	{ // field TypedLocalObjectReference.APIGroup
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *TypedLocalObjectReference) *string {
+				return &oldObj.APIGroup
+			})
+		errs = append(errs, fn(fldPath.Child("apiGroup"), &obj.APIGroup, oldVal, oldObj != nil)...)
+	}
+
+	{ // field TypedLocalObjectReference.Kind
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.PathSegmentName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *TypedLocalObjectReference) *string {
+				return &oldObj.Kind
+			})
+		errs = append(errs, fn(fldPath.Child("kind"), &obj.Kind, oldVal, oldObj != nil)...)
+	}
+
+	{ // field TypedLocalObjectReference.Name
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.PathSegmentName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *TypedLocalObjectReference) *string {
+				return &oldObj.Name
+			})
+		errs = append(errs, fn(fldPath.Child("name"), &obj.Name, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_Workload validates an instance of Workload according
+// to declarative validation rules in the API schema.
+func Validate_Workload(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *Workload) (errs field.ErrorList) {
+
+	// field Workload.TypeMeta has no validation
+
+	{ // field Workload.ObjectMeta
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.ObjectMeta,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, validation.Validate_ObjectMeta(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Workload) *v1.ObjectMeta {
+				return &oldObj.ObjectMeta
+			})
+		errs = append(errs, fn(fldPath.Child("metadata"), &obj.ObjectMeta, oldVal, oldObj != nil)...)
+	}
+
+	{ // field Workload.Spec
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *WorkloadSpec,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_WorkloadSpec(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *Workload) *WorkloadSpec {
+				return &oldObj.Spec
+			})
+		errs = append(errs, fn(fldPath.Child("spec"), &obj.Spec, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_api_scheduling_v1alpha3_WorkloadCompositePodGroupDisruptionMode_ = validate.NewUnionMembership(validate.NewUnionMember("single"), validate.NewUnionMember("all"))
+
+// Validate_WorkloadCompositePodGroupDisruptionMode validates an instance of WorkloadCompositePodGroupDisruptionMode according
+// to declarative validation rules in the API schema.
+func Validate_WorkloadCompositePodGroupDisruptionMode(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *WorkloadCompositePodGroupDisruptionMode) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_api_scheduling_v1alpha3_WorkloadCompositePodGroupDisruptionMode_,
+		func(obj *WorkloadCompositePodGroupDisruptionMode) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Single != nil
+		},
+		func(obj *WorkloadCompositePodGroupDisruptionMode) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.All != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field WorkloadCompositePodGroupDisruptionMode.Single
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *WorkloadCompositePodGroupSingleDisruptionMode,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadCompositePodGroupDisruptionMode) *WorkloadCompositePodGroupSingleDisruptionMode {
+				return oldObj.Single
+			})
+		errs = append(errs, fn(fldPath.Child("single"), obj.Single, oldVal, oldObj != nil)...)
+	}
+
+	{ // field WorkloadCompositePodGroupDisruptionMode.All
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *WorkloadCompositePodGroupAllDisruptionMode,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadCompositePodGroupDisruptionMode) *WorkloadCompositePodGroupAllDisruptionMode {
+				return oldObj.All
+			})
+		errs = append(errs, fn(fldPath.Child("all"), obj.All, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_WorkloadCompositePodGroupGangSchedulingPolicy validates an instance of WorkloadCompositePodGroupGangSchedulingPolicy according
+// to declarative validation rules in the API schema.
+func Validate_WorkloadCompositePodGroupGangSchedulingPolicy(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *WorkloadCompositePodGroupGangSchedulingPolicy) (errs field.ErrorList) {
+
+	{ // field WorkloadCompositePodGroupGangSchedulingPolicy.MinGroupCount
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int32,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadCompositePodGroupGangSchedulingPolicy) *int32 {
+				return oldObj.MinGroupCount
+			})
+		errs = append(errs, fn(fldPath.Child("minGroupCount"), obj.MinGroupCount, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_WorkloadCompositePodGroupSchedulingConstraints validates an instance of WorkloadCompositePodGroupSchedulingConstraints according
+// to declarative validation rules in the API schema.
+func Validate_WorkloadCompositePodGroupSchedulingConstraints(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *WorkloadCompositePodGroupSchedulingConstraints) (errs field.ErrorList) {
+
+	{ // field WorkloadCompositePodGroupSchedulingConstraints.Topology
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []TopologyConstraint,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 1).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_TopologyConstraint); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadCompositePodGroupSchedulingConstraints) []TopologyConstraint {
+				return oldObj.Topology
+			})
+		errs = append(errs, fn(fldPath.Child("topology"), obj.Topology, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_api_scheduling_v1alpha3_WorkloadCompositePodGroupSchedulingPolicy_ = validate.NewUnionMembership(validate.NewUnionMember("basic"), validate.NewUnionMember("gang"))
+
+// Validate_WorkloadCompositePodGroupSchedulingPolicy validates an instance of WorkloadCompositePodGroupSchedulingPolicy according
+// to declarative validation rules in the API schema.
+func Validate_WorkloadCompositePodGroupSchedulingPolicy(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *WorkloadCompositePodGroupSchedulingPolicy) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_api_scheduling_v1alpha3_WorkloadCompositePodGroupSchedulingPolicy_,
+		func(obj *WorkloadCompositePodGroupSchedulingPolicy) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Basic != nil
+		},
+		func(obj *WorkloadCompositePodGroupSchedulingPolicy) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Gang != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field WorkloadCompositePodGroupSchedulingPolicy.Basic
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *WorkloadCompositePodGroupBasicSchedulingPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadCompositePodGroupSchedulingPolicy) *WorkloadCompositePodGroupBasicSchedulingPolicy {
+				return oldObj.Basic
+			})
+		errs = append(errs, fn(fldPath.Child("basic"), obj.Basic, oldVal, oldObj != nil)...)
+	}
+
+	{ // field WorkloadCompositePodGroupSchedulingPolicy.Gang
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *WorkloadCompositePodGroupGangSchedulingPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_WorkloadCompositePodGroupGangSchedulingPolicy(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadCompositePodGroupSchedulingPolicy) *WorkloadCompositePodGroupGangSchedulingPolicy {
+				return oldObj.Gang
+			})
+		errs = append(errs, fn(fldPath.Child("gang"), obj.Gang, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_api_scheduling_v1alpha3_WorkloadPodGroupDisruptionMode_ = validate.NewUnionMembership(validate.NewUnionMember("single"), validate.NewUnionMember("all"))
+
+// Validate_WorkloadPodGroupDisruptionMode validates an instance of WorkloadPodGroupDisruptionMode according
+// to declarative validation rules in the API schema.
+func Validate_WorkloadPodGroupDisruptionMode(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *WorkloadPodGroupDisruptionMode) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_api_scheduling_v1alpha3_WorkloadPodGroupDisruptionMode_,
+		func(obj *WorkloadPodGroupDisruptionMode) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Single != nil
+		},
+		func(obj *WorkloadPodGroupDisruptionMode) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.All != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field WorkloadPodGroupDisruptionMode.Single
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *WorkloadPodGroupSingleDisruptionMode,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadPodGroupDisruptionMode) *WorkloadPodGroupSingleDisruptionMode {
+				return oldObj.Single
+			})
+		errs = append(errs, fn(fldPath.Child("single"), obj.Single, oldVal, oldObj != nil)...)
+	}
+
+	{ // field WorkloadPodGroupDisruptionMode.All
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *WorkloadPodGroupAllDisruptionMode,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadPodGroupDisruptionMode) *WorkloadPodGroupAllDisruptionMode {
+				return oldObj.All
+			})
+		errs = append(errs, fn(fldPath.Child("all"), obj.All, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_WorkloadPodGroupGangSchedulingPolicy validates an instance of WorkloadPodGroupGangSchedulingPolicy according
+// to declarative validation rules in the API schema.
+func Validate_WorkloadPodGroupGangSchedulingPolicy(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *WorkloadPodGroupGangSchedulingPolicy) (errs field.ErrorList) {
+
+	{ // field WorkloadPodGroupGangSchedulingPolicy.MinCount
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int32,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadPodGroupGangSchedulingPolicy) *int32 {
+				return oldObj.MinCount
+			})
+		errs = append(errs, fn(fldPath.Child("minCount"), obj.MinCount, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_api_scheduling_v1alpha3_WorkloadPodGroupResourceClaim_ = validate.NewUnionMembership(validate.NewUnionMember("resourceClaimName"), validate.NewUnionMember("resourceClaimTemplateName"))
+
+// Validate_WorkloadPodGroupResourceClaim validates an instance of WorkloadPodGroupResourceClaim according
+// to declarative validation rules in the API schema.
+func Validate_WorkloadPodGroupResourceClaim(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *WorkloadPodGroupResourceClaim) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_api_scheduling_v1alpha3_WorkloadPodGroupResourceClaim_,
+		func(obj *WorkloadPodGroupResourceClaim) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.ResourceClaimName != nil
+		},
+		func(obj *WorkloadPodGroupResourceClaim) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.ResourceClaimTemplateName != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field WorkloadPodGroupResourceClaim.Name
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ShortName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadPodGroupResourceClaim) *string {
+				return &oldObj.Name
+			})
+		errs = append(errs, fn(fldPath.Child("name"), &obj.Name, oldVal, oldObj != nil)...)
+	}
+
+	{ // field WorkloadPodGroupResourceClaim.ResourceClaimName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadPodGroupResourceClaim) *string {
+				return oldObj.ResourceClaimName
+			})
+		errs = append(errs, fn(fldPath.Child("resourceClaimName"), obj.ResourceClaimName, oldVal, oldObj != nil)...)
+	}
+
+	{ // field WorkloadPodGroupResourceClaim.ResourceClaimTemplateName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadPodGroupResourceClaim) *string {
+				return oldObj.ResourceClaimTemplateName
+			})
+		errs = append(errs, fn(fldPath.Child("resourceClaimTemplateName"), obj.ResourceClaimTemplateName, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_WorkloadPodGroupSchedulingConstraints validates an instance of WorkloadPodGroupSchedulingConstraints according
+// to declarative validation rules in the API schema.
+func Validate_WorkloadPodGroupSchedulingConstraints(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *WorkloadPodGroupSchedulingConstraints) (errs field.ErrorList) {
+
+	{ // field WorkloadPodGroupSchedulingConstraints.Topology
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []TopologyConstraint,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 1).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_TopologyConstraint); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadPodGroupSchedulingConstraints) []TopologyConstraint {
+				return oldObj.Topology
+			})
+		errs = append(errs, fn(fldPath.Child("topology"), obj.Topology, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_api_scheduling_v1alpha3_WorkloadPodGroupSchedulingPolicy_ = validate.NewUnionMembership(validate.NewUnionMember("basic"), validate.NewUnionMember("gang"))
+
+// Validate_WorkloadPodGroupSchedulingPolicy validates an instance of WorkloadPodGroupSchedulingPolicy according
+// to declarative validation rules in the API schema.
+func Validate_WorkloadPodGroupSchedulingPolicy(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *WorkloadPodGroupSchedulingPolicy) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_api_scheduling_v1alpha3_WorkloadPodGroupSchedulingPolicy_,
+		func(obj *WorkloadPodGroupSchedulingPolicy) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Basic != nil
+		},
+		func(obj *WorkloadPodGroupSchedulingPolicy) bool {
+			if obj == nil {
+				return false
+			}
+			return obj.Gang != nil
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field WorkloadPodGroupSchedulingPolicy.Basic
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *WorkloadPodGroupBasicSchedulingPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadPodGroupSchedulingPolicy) *WorkloadPodGroupBasicSchedulingPolicy {
+				return oldObj.Basic
+			})
+		errs = append(errs, fn(fldPath.Child("basic"), obj.Basic, oldVal, oldObj != nil)...)
+	}
+
+	{ // field WorkloadPodGroupSchedulingPolicy.Gang
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *WorkloadPodGroupGangSchedulingPolicy,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_WorkloadPodGroupGangSchedulingPolicy(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadPodGroupSchedulingPolicy) *WorkloadPodGroupGangSchedulingPolicy {
+				return oldObj.Gang
+			})
+		errs = append(errs, fn(fldPath.Child("gang"), obj.Gang, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_WorkloadReference validates an instance of WorkloadReference according
+// to declarative validation rules in the API schema.
+func Validate_WorkloadReference(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *WorkloadReference) (errs field.ErrorList) {
+
+	{ // field WorkloadReference.WorkloadName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.LongName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadReference) *string {
+				return &oldObj.WorkloadName
+			})
+		errs = append(errs, fn(fldPath.Child("workloadName"), &obj.WorkloadName, oldVal, oldObj != nil)...)
+	}
+
+	{ // field WorkloadReference.TemplateName
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.ShortName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadReference) *string {
+				return &oldObj.TemplateName
+			})
+		errs = append(errs, fn(fldPath.Child("templateName"), &obj.TemplateName, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+var unionMembershipFor_k8s_io_api_scheduling_v1alpha3_WorkloadSpec_ = validate.NewUnionMembership(validate.NewUnionMember("podGroupTemplates"), validate.NewUnionMember("compositePodGroupTemplates"))
+
+// Validate_WorkloadSpec validates an instance of WorkloadSpec according
+// to declarative validation rules in the API schema.
+func Validate_WorkloadSpec(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *WorkloadSpec) (errs field.ErrorList) {
+
+	if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_k8s_io_api_scheduling_v1alpha3_WorkloadSpec_,
+		func(obj *WorkloadSpec) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.PodGroupTemplates) != 0
+		},
+		func(obj *WorkloadSpec) bool {
+			if obj == nil {
+				return false
+			}
+			return len(obj.CompositePodGroupTemplates) != 0
+		}); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	{ // field WorkloadSpec.ControllerRef
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *TypedLocalObjectReference,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_TypedLocalObjectReference(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadSpec) *TypedLocalObjectReference {
+				return oldObj.ControllerRef
+			})
+		errs = append(errs, fn(fldPath.Child("controllerRef"), obj.ControllerRef, oldVal, oldObj != nil)...)
+	}
+
+	{ // field WorkloadSpec.PodGroupTemplates
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []PodGroupTemplate,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 8).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj,
+				func(a *PodGroupTemplate, b *PodGroupTemplate) bool { return a.Name == b.Name }, validate.NoAddItem, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *PodGroupTemplate, b *PodGroupTemplate) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *PodGroupTemplate, b *PodGroupTemplate) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_PodGroupTemplate); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadSpec) []PodGroupTemplate {
+				return oldObj.PodGroupTemplates
+			})
+		errs = append(errs, fn(fldPath.Child("podGroupTemplates"), obj.PodGroupTemplates, oldVal, oldObj != nil)...)
+	}
+
+	{ // field WorkloadSpec.CompositePodGroupTemplates
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []CompositePodGroupTemplate,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "CompositePodGroup", false, validate.ForbiddenSlice).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "CompositePodGroup", false, validate.OptionalSlice).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.IfOption(ctx, op, fldPath, obj, oldObj, "CompositePodGroup", true, validate.OptionalSlice).MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 8).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if e := validate.ValSliceUpdate(ctx, op, fldPath, obj, oldObj,
+				func(a *CompositePodGroupTemplate, b *CompositePodGroupTemplate) bool { return a.Name == b.Name }, validate.NoAddItem, validate.NoRemoveItem).MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// lists with map semantics require unique keys
+			if e := validate.ValSliceUnique(ctx, op, fldPath, obj, oldObj,
+				func(a *CompositePodGroupTemplate, b *CompositePodGroupTemplate) bool { return a.Name == b.Name }); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj,
+				func(a *CompositePodGroupTemplate, b *CompositePodGroupTemplate) bool { return a.Name == b.Name }, validate.SemanticDeepEqual, Validate_CompositePodGroupTemplate); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *WorkloadSpec) []CompositePodGroupTemplate {
+				return oldObj.CompositePodGroupTemplates
+			})
+		errs = append(errs, fn(fldPath.Child("compositePodGroupTemplates"), obj.CompositePodGroupTemplates, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
diff --git a/vendor/k8s.io/api/scheduling/v1beta1/generated.pb.go b/vendor/k8s.io/api/scheduling/v1beta1/generated.pb.go
index cd25ded408..d8572d3c01 100644
--- a/vendor/k8s.io/api/scheduling/v1beta1/generated.pb.go
+++ b/vendor/k8s.io/api/scheduling/v1beta1/generated.pb.go
@@ -25,17 +25,76 @@ import (
 	io "io"
 
 	k8s_io_api_core_v1 "k8s.io/api/core/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	math_bits "math/bits"
 	reflect "reflect"
 	strings "strings"
 )
 
+func (m *AllCompositeDisruptionMode) Reset() { *m = AllCompositeDisruptionMode{} }
+
+func (m *AllDisruptionMode) Reset() { *m = AllDisruptionMode{} }
+
+func (m *BasicSchedulingPolicy) Reset() { *m = BasicSchedulingPolicy{} }
+
+func (m *CompositeBasicSchedulingPolicy) Reset() { *m = CompositeBasicSchedulingPolicy{} }
+
+func (m *CompositeDisruptionMode) Reset() { *m = CompositeDisruptionMode{} }
+
+func (m *CompositeGangSchedulingPolicy) Reset() { *m = CompositeGangSchedulingPolicy{} }
+
+func (m *CompositePodGroupSchedulingConstraints) Reset() {
+	*m = CompositePodGroupSchedulingConstraints{}
+}
+
+func (m *CompositePodGroupSchedulingPolicy) Reset() { *m = CompositePodGroupSchedulingPolicy{} }
+
+func (m *CompositePodGroupTemplate) Reset() { *m = CompositePodGroupTemplate{} }
+
+func (m *DisruptionMode) Reset() { *m = DisruptionMode{} }
+
+func (m *GangSchedulingPolicy) Reset() { *m = GangSchedulingPolicy{} }
+
+func (m *PodGroup) Reset() { *m = PodGroup{} }
+
+func (m *PodGroupList) Reset() { *m = PodGroupList{} }
+
+func (m *PodGroupResourceClaim) Reset() { *m = PodGroupResourceClaim{} }
+
+func (m *PodGroupResourceClaimStatus) Reset() { *m = PodGroupResourceClaimStatus{} }
+
+func (m *PodGroupSchedulingConstraints) Reset() { *m = PodGroupSchedulingConstraints{} }
+
+func (m *PodGroupSchedulingPolicy) Reset() { *m = PodGroupSchedulingPolicy{} }
+
+func (m *PodGroupSpec) Reset() { *m = PodGroupSpec{} }
+
+func (m *PodGroupStatus) Reset() { *m = PodGroupStatus{} }
+
+func (m *PodGroupTemplate) Reset() { *m = PodGroupTemplate{} }
+
 func (m *PriorityClass) Reset() { *m = PriorityClass{} }
 
 func (m *PriorityClassList) Reset() { *m = PriorityClassList{} }
 
-func (m *PriorityClass) Marshal() (dAtA []byte, err error) {
+func (m *SingleCompositeDisruptionMode) Reset() { *m = SingleCompositeDisruptionMode{} }
+
+func (m *SingleDisruptionMode) Reset() { *m = SingleDisruptionMode{} }
+
+func (m *TopologyConstraint) Reset() { *m = TopologyConstraint{} }
+
+func (m *TypedLocalObjectReference) Reset() { *m = TypedLocalObjectReference{} }
+
+func (m *Workload) Reset() { *m = Workload{} }
+
+func (m *WorkloadList) Reset() { *m = WorkloadList{} }
+
+func (m *WorkloadReference) Reset() { *m = WorkloadReference{} }
+
+func (m *WorkloadSpec) Reset() { *m = WorkloadSpec{} }
+
+func (m *AllCompositeDisruptionMode) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -45,53 +104,162 @@ func (m *PriorityClass) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PriorityClass) MarshalTo(dAtA []byte) (int, error) {
+func (m *AllCompositeDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PriorityClass) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *AllCompositeDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if m.PreemptionPolicy != nil {
-		i -= len(*m.PreemptionPolicy)
-		copy(dAtA[i:], *m.PreemptionPolicy)
-		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.PreemptionPolicy)))
-		i--
-		dAtA[i] = 0x2a
+	return len(dAtA) - i, nil
+}
+
+func (m *AllDisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	i -= len(m.Description)
-	copy(dAtA[i:], m.Description)
-	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Description)))
-	i--
-	dAtA[i] = 0x22
-	i--
-	if m.GlobalDefault {
-		dAtA[i] = 1
-	} else {
-		dAtA[i] = 0
+	return dAtA[:n], nil
+}
+
+func (m *AllDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *AllDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *BasicSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	i--
-	dAtA[i] = 0x18
-	i = encodeVarintGenerated(dAtA, i, uint64(m.Value))
-	i--
-	dAtA[i] = 0x10
-	{
-		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+	return dAtA[:n], nil
+}
+
+func (m *BasicSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *BasicSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *CompositeBasicSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CompositeBasicSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CompositeBasicSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *CompositeDisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CompositeDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CompositeDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.All != nil {
+		{
+			size, err := m.All.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
 		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Single != nil {
+		{
+			size, err := m.Single.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CompositeGangSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
+	return dAtA[:n], nil
+}
+
+func (m *CompositeGangSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CompositeGangSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i = encodeVarintGenerated(dAtA, i, uint64(m.MinGroupCount))
 	i--
-	dAtA[i] = 0xa
+	dAtA[i] = 0x8
 	return len(dAtA) - i, nil
 }
 
-func (m *PriorityClassList) Marshal() (dAtA []byte, err error) {
+func (m *CompositePodGroupSchedulingConstraints) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalToSizedBuffer(dAtA[:size])
@@ -101,20 +269,20 @@ func (m *PriorityClassList) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *PriorityClassList) MarshalTo(dAtA []byte) (int, error) {
+func (m *CompositePodGroupSchedulingConstraints) MarshalTo(dAtA []byte) (int, error) {
 	size := m.Size()
 	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PriorityClassList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+func (m *CompositePodGroupSchedulingConstraints) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	i := len(dAtA)
 	_ = i
 	var l int
 	_ = l
-	if len(m.Items) > 0 {
-		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+	if len(m.Topology) > 0 {
+		for iNdEx := len(m.Topology) - 1; iNdEx >= 0; iNdEx-- {
 			{
-				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				size, err := m.Topology[iNdEx].MarshalToSizedBuffer(dAtA[:i])
 				if err != nil {
 					return 0, err
 				}
@@ -122,114 +290,5354 @@ func (m *PriorityClassList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 				i = encodeVarintGenerated(dAtA, i, uint64(size))
 			}
 			i--
-			dAtA[i] = 0x12
-		}
-	}
-	{
-		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
-		if err != nil {
-			return 0, err
+			dAtA[i] = 0xa
 		}
-		i -= size
-		i = encodeVarintGenerated(dAtA, i, uint64(size))
 	}
-	i--
-	dAtA[i] = 0xa
 	return len(dAtA) - i, nil
 }
 
-func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
-	offset -= sovGenerated(v)
-	base := offset
-	for v >= 1<<7 {
-		dAtA[offset] = uint8(v&0x7f | 0x80)
-		v >>= 7
-		offset++
+func (m *CompositePodGroupSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
 	}
-	dAtA[offset] = uint8(v)
-	return base
+	return dAtA[:n], nil
 }
-func (m *PriorityClass) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = m.ObjectMeta.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	n += 1 + sovGenerated(uint64(m.Value))
-	n += 2
-	l = len(m.Description)
-	n += 1 + l + sovGenerated(uint64(l))
-	if m.PreemptionPolicy != nil {
-		l = len(*m.PreemptionPolicy)
-		n += 1 + l + sovGenerated(uint64(l))
-	}
-	return n
+
+func (m *CompositePodGroupSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
 }
 
-func (m *PriorityClassList) Size() (n int) {
-	if m == nil {
-		return 0
-	}
+func (m *CompositePodGroupSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
 	var l int
 	_ = l
-	l = m.ListMeta.Size()
-	n += 1 + l + sovGenerated(uint64(l))
-	if len(m.Items) > 0 {
-		for _, e := range m.Items {
-			l = e.Size()
-			n += 1 + l + sovGenerated(uint64(l))
+	if m.Gang != nil {
+		{
+			size, err := m.Gang.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
 		}
+		i--
+		dAtA[i] = 0x12
 	}
-	return n
+	if m.Basic != nil {
+		{
+			size, err := m.Basic.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
 }
 
-func sovGenerated(x uint64) (n int) {
-	return (math_bits.Len64(x|1) + 6) / 7
+func (m *CompositePodGroupTemplate) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
 }
-func sozGenerated(x uint64) (n int) {
-	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+
+func (m *CompositePodGroupTemplate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
 }
-func (this *PriorityClass) String() string {
-	if this == nil {
+
+func (m *CompositePodGroupTemplate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.CompositePodGroupTemplates) > 0 {
+		for iNdEx := len(m.CompositePodGroupTemplates) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.CompositePodGroupTemplates[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x4a
+		}
+	}
+	if len(m.PodGroupTemplates) > 0 {
+		for iNdEx := len(m.PodGroupTemplates) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.PodGroupTemplates[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x42
+		}
+	}
+	if m.PreemptionPolicy != nil {
+		i -= len(*m.PreemptionPolicy)
+		copy(dAtA[i:], *m.PreemptionPolicy)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.PreemptionPolicy)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if m.Priority != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.Priority))
+		i--
+		dAtA[i] = 0x30
+	}
+	i -= len(m.PriorityClassName)
+	copy(dAtA[i:], m.PriorityClassName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.PriorityClassName)))
+	i--
+	dAtA[i] = 0x2a
+	if m.DisruptionMode != nil {
+		{
+			size, err := m.DisruptionMode.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.SchedulingConstraints != nil {
+		{
+			size, err := m.SchedulingConstraints.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	{
+		size, err := m.SchedulingPolicy.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *DisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *DisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.All != nil {
+		{
+			size, err := m.All.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Single != nil {
+		{
+			size, err := m.Single.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *GangSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GangSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *GangSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i = encodeVarintGenerated(dAtA, i, uint64(m.MinCount))
+	i--
+	dAtA[i] = 0x8
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroup) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroup) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroup) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupResourceClaim) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupResourceClaim) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupResourceClaim) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.ResourceClaimTemplateName != nil {
+		i -= len(*m.ResourceClaimTemplateName)
+		copy(dAtA[i:], *m.ResourceClaimTemplateName)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ResourceClaimTemplateName)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.ResourceClaimName != nil {
+		i -= len(*m.ResourceClaimName)
+		copy(dAtA[i:], *m.ResourceClaimName)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ResourceClaimName)))
+		i--
+		dAtA[i] = 0x12
+	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupResourceClaimStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupResourceClaimStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupResourceClaimStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.ResourceClaimName != nil {
+		i -= len(*m.ResourceClaimName)
+		copy(dAtA[i:], *m.ResourceClaimName)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ResourceClaimName)))
+		i--
+		dAtA[i] = 0x12
+	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupSchedulingConstraints) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupSchedulingConstraints) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupSchedulingConstraints) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Topology) > 0 {
+		for iNdEx := len(m.Topology) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Topology[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupSchedulingPolicy) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupSchedulingPolicy) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupSchedulingPolicy) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.Gang != nil {
+		{
+			size, err := m.Gang.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Basic != nil {
+		{
+			size, err := m.Basic.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupSpec) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupSpec) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.PreemptionPolicy != nil {
+		i -= len(*m.PreemptionPolicy)
+		copy(dAtA[i:], *m.PreemptionPolicy)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.PreemptionPolicy)))
+		i--
+		dAtA[i] = 0x4a
+	}
+	if m.Priority != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.Priority))
+		i--
+		dAtA[i] = 0x40
+	}
+	i -= len(m.PriorityClassName)
+	copy(dAtA[i:], m.PriorityClassName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.PriorityClassName)))
+	i--
+	dAtA[i] = 0x3a
+	if m.DisruptionMode != nil {
+		{
+			size, err := m.DisruptionMode.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.ResourceClaims) > 0 {
+		for iNdEx := len(m.ResourceClaims) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ResourceClaims[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x2a
+		}
+	}
+	if m.SchedulingConstraints != nil {
+		{
+			size, err := m.SchedulingConstraints.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	{
+		size, err := m.SchedulingPolicy.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	if m.WorkloadRef != nil {
+		{
+			size, err := m.WorkloadRef.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.ParentCompositePodGroupName != nil {
+		i -= len(*m.ParentCompositePodGroupName)
+		copy(dAtA[i:], *m.ParentCompositePodGroupName)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.ParentCompositePodGroupName)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.ResourceClaimStatuses) > 0 {
+		for iNdEx := len(m.ResourceClaimStatuses) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ResourceClaimStatuses[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Conditions) > 0 {
+		for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *PodGroupTemplate) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PodGroupTemplate) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PodGroupTemplate) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.PreemptionPolicy != nil {
+		i -= len(*m.PreemptionPolicy)
+		copy(dAtA[i:], *m.PreemptionPolicy)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.PreemptionPolicy)))
+		i--
+		dAtA[i] = 0x42
+	}
+	if m.Priority != nil {
+		i = encodeVarintGenerated(dAtA, i, uint64(*m.Priority))
+		i--
+		dAtA[i] = 0x38
+	}
+	i -= len(m.PriorityClassName)
+	copy(dAtA[i:], m.PriorityClassName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.PriorityClassName)))
+	i--
+	dAtA[i] = 0x32
+	if m.DisruptionMode != nil {
+		{
+			size, err := m.DisruptionMode.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.ResourceClaims) > 0 {
+		for iNdEx := len(m.ResourceClaims) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.ResourceClaims[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x22
+		}
+	}
+	if m.SchedulingConstraints != nil {
+		{
+			size, err := m.SchedulingConstraints.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	{
+		size, err := m.SchedulingPolicy.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *PriorityClass) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PriorityClass) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PriorityClass) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.PreemptionPolicy != nil {
+		i -= len(*m.PreemptionPolicy)
+		copy(dAtA[i:], *m.PreemptionPolicy)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.PreemptionPolicy)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	i -= len(m.Description)
+	copy(dAtA[i:], m.Description)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Description)))
+	i--
+	dAtA[i] = 0x22
+	i--
+	if m.GlobalDefault {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x18
+	i = encodeVarintGenerated(dAtA, i, uint64(m.Value))
+	i--
+	dAtA[i] = 0x10
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *PriorityClassList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PriorityClassList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *PriorityClassList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *SingleCompositeDisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SingleCompositeDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *SingleCompositeDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *SingleDisruptionMode) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SingleDisruptionMode) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *SingleDisruptionMode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	return len(dAtA) - i, nil
+}
+
+func (m *TopologyConstraint) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TopologyConstraint) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *TopologyConstraint) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Key)
+	copy(dAtA[i:], m.Key)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Key)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *TypedLocalObjectReference) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TypedLocalObjectReference) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *TypedLocalObjectReference) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Kind)
+	copy(dAtA[i:], m.Kind)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Kind)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.APIGroup)
+	copy(dAtA[i:], m.APIGroup)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.APIGroup)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *Workload) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Workload) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *Workload) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadReference) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadReference) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadReference) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.TemplateName)
+	copy(dAtA[i:], m.TemplateName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.TemplateName)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.WorkloadName)
+	copy(dAtA[i:], m.WorkloadName)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.WorkloadName)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *WorkloadSpec) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WorkloadSpec) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *WorkloadSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.CompositePodGroupTemplates) > 0 {
+		for iNdEx := len(m.CompositePodGroupTemplates) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.CompositePodGroupTemplates[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if len(m.PodGroupTemplates) > 0 {
+		for iNdEx := len(m.PodGroupTemplates) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.PodGroupTemplates[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if m.ControllerRef != nil {
+		{
+			size, err := m.ControllerRef.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintGenerated(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *AllCompositeDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *AllDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *BasicSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *CompositeBasicSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *CompositeDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Single != nil {
+		l = m.Single.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.All != nil {
+		l = m.All.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *CompositeGangSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 1 + sovGenerated(uint64(m.MinGroupCount))
+	return n
+}
+
+func (m *CompositePodGroupSchedulingConstraints) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Topology) > 0 {
+		for _, e := range m.Topology {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *CompositePodGroupSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Basic != nil {
+		l = m.Basic.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Gang != nil {
+		l = m.Gang.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *CompositePodGroupTemplate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.SchedulingPolicy.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.SchedulingConstraints != nil {
+		l = m.SchedulingConstraints.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.DisruptionMode != nil {
+		l = m.DisruptionMode.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = len(m.PriorityClassName)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Priority != nil {
+		n += 1 + sovGenerated(uint64(*m.Priority))
+	}
+	if m.PreemptionPolicy != nil {
+		l = len(*m.PreemptionPolicy)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.PodGroupTemplates) > 0 {
+		for _, e := range m.PodGroupTemplates {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.CompositePodGroupTemplates) > 0 {
+		for _, e := range m.CompositePodGroupTemplates {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *DisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Single != nil {
+		l = m.Single.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.All != nil {
+		l = m.All.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *GangSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 1 + sovGenerated(uint64(m.MinCount))
+	return n
+}
+
+func (m *PodGroup) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ObjectMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Spec.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *PodGroupList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *PodGroupResourceClaim) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.ResourceClaimName != nil {
+		l = len(*m.ResourceClaimName)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.ResourceClaimTemplateName != nil {
+		l = len(*m.ResourceClaimTemplateName)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *PodGroupResourceClaimStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.ResourceClaimName != nil {
+		l = len(*m.ResourceClaimName)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *PodGroupSchedulingConstraints) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Topology) > 0 {
+		for _, e := range m.Topology {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *PodGroupSchedulingPolicy) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Basic != nil {
+		l = m.Basic.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.Gang != nil {
+		l = m.Gang.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *PodGroupSpec) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.ParentCompositePodGroupName != nil {
+		l = len(*m.ParentCompositePodGroupName)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.WorkloadRef != nil {
+		l = m.WorkloadRef.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = m.SchedulingPolicy.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.SchedulingConstraints != nil {
+		l = m.SchedulingConstraints.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.ResourceClaims) > 0 {
+		for _, e := range m.ResourceClaims {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if m.DisruptionMode != nil {
+		l = m.DisruptionMode.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = len(m.PriorityClassName)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Priority != nil {
+		n += 1 + sovGenerated(uint64(*m.Priority))
+	}
+	if m.PreemptionPolicy != nil {
+		l = len(*m.PreemptionPolicy)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *PodGroupStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Conditions) > 0 {
+		for _, e := range m.Conditions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.ResourceClaimStatuses) > 0 {
+		for _, e := range m.ResourceClaimStatuses {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *PodGroupTemplate) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.SchedulingPolicy.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.SchedulingConstraints != nil {
+		l = m.SchedulingConstraints.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.ResourceClaims) > 0 {
+		for _, e := range m.ResourceClaims {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if m.DisruptionMode != nil {
+		l = m.DisruptionMode.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = len(m.PriorityClassName)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.Priority != nil {
+		n += 1 + sovGenerated(uint64(*m.Priority))
+	}
+	if m.PreemptionPolicy != nil {
+		l = len(*m.PreemptionPolicy)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *PriorityClass) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ObjectMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	n += 1 + sovGenerated(uint64(m.Value))
+	n += 2
+	l = len(m.Description)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.PreemptionPolicy != nil {
+		l = len(*m.PreemptionPolicy)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
+func (m *PriorityClassList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *SingleCompositeDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *SingleDisruptionMode) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	return n
+}
+
+func (m *TopologyConstraint) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Key)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *TypedLocalObjectReference) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.APIGroup)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Kind)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *Workload) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ObjectMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Spec.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *WorkloadList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *WorkloadReference) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.WorkloadName)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.TemplateName)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *WorkloadSpec) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.ControllerRef != nil {
+		l = m.ControllerRef.Size()
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if len(m.PodGroupTemplates) > 0 {
+		for _, e := range m.PodGroupTemplates {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	if len(m.CompositePodGroupTemplates) > 0 {
+		for _, e := range m.CompositePodGroupTemplates {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozGenerated(x uint64) (n int) {
+	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *AllCompositeDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&AllCompositeDisruptionMode{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *AllDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&AllDisruptionMode{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *BasicSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&BasicSchedulingPolicy{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositeBasicSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CompositeBasicSchedulingPolicy{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositeDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CompositeDisruptionMode{`,
+		`Single:` + strings.Replace(this.Single.String(), "SingleCompositeDisruptionMode", "SingleCompositeDisruptionMode", 1) + `,`,
+		`All:` + strings.Replace(this.All.String(), "AllCompositeDisruptionMode", "AllCompositeDisruptionMode", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositeGangSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CompositeGangSchedulingPolicy{`,
+		`MinGroupCount:` + fmt.Sprintf("%v", this.MinGroupCount) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositePodGroupSchedulingConstraints) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForTopology := "[]TopologyConstraint{"
+	for _, f := range this.Topology {
+		repeatedStringForTopology += strings.Replace(strings.Replace(f.String(), "TopologyConstraint", "TopologyConstraint", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForTopology += "}"
+	s := strings.Join([]string{`&CompositePodGroupSchedulingConstraints{`,
+		`Topology:` + repeatedStringForTopology + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositePodGroupSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CompositePodGroupSchedulingPolicy{`,
+		`Basic:` + strings.Replace(this.Basic.String(), "CompositeBasicSchedulingPolicy", "CompositeBasicSchedulingPolicy", 1) + `,`,
+		`Gang:` + strings.Replace(this.Gang.String(), "CompositeGangSchedulingPolicy", "CompositeGangSchedulingPolicy", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *CompositePodGroupTemplate) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForPodGroupTemplates := "[]PodGroupTemplate{"
+	for _, f := range this.PodGroupTemplates {
+		repeatedStringForPodGroupTemplates += strings.Replace(strings.Replace(f.String(), "PodGroupTemplate", "PodGroupTemplate", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForPodGroupTemplates += "}"
+	repeatedStringForCompositePodGroupTemplates := "[]CompositePodGroupTemplate{"
+	for _, f := range this.CompositePodGroupTemplates {
+		repeatedStringForCompositePodGroupTemplates += strings.Replace(strings.Replace(f.String(), "CompositePodGroupTemplate", "CompositePodGroupTemplate", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForCompositePodGroupTemplates += "}"
+	s := strings.Join([]string{`&CompositePodGroupTemplate{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`SchedulingPolicy:` + strings.Replace(strings.Replace(this.SchedulingPolicy.String(), "CompositePodGroupSchedulingPolicy", "CompositePodGroupSchedulingPolicy", 1), `&`, ``, 1) + `,`,
+		`SchedulingConstraints:` + strings.Replace(this.SchedulingConstraints.String(), "CompositePodGroupSchedulingConstraints", "CompositePodGroupSchedulingConstraints", 1) + `,`,
+		`DisruptionMode:` + strings.Replace(this.DisruptionMode.String(), "CompositeDisruptionMode", "CompositeDisruptionMode", 1) + `,`,
+		`PriorityClassName:` + fmt.Sprintf("%v", this.PriorityClassName) + `,`,
+		`Priority:` + valueToStringGenerated(this.Priority) + `,`,
+		`PreemptionPolicy:` + valueToStringGenerated(this.PreemptionPolicy) + `,`,
+		`PodGroupTemplates:` + repeatedStringForPodGroupTemplates + `,`,
+		`CompositePodGroupTemplates:` + repeatedStringForCompositePodGroupTemplates + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *DisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&DisruptionMode{`,
+		`Single:` + strings.Replace(this.Single.String(), "SingleDisruptionMode", "SingleDisruptionMode", 1) + `,`,
+		`All:` + strings.Replace(this.All.String(), "AllDisruptionMode", "AllDisruptionMode", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *GangSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&GangSchedulingPolicy{`,
+		`MinCount:` + fmt.Sprintf("%v", this.MinCount) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroup) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&PodGroup{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "PodGroupSpec", "PodGroupSpec", 1), `&`, ``, 1) + `,`,
+		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "PodGroupStatus", "PodGroupStatus", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]PodGroup{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "PodGroup", "PodGroup", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&PodGroupList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupResourceClaim) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&PodGroupResourceClaim{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`ResourceClaimName:` + valueToStringGenerated(this.ResourceClaimName) + `,`,
+		`ResourceClaimTemplateName:` + valueToStringGenerated(this.ResourceClaimTemplateName) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupResourceClaimStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&PodGroupResourceClaimStatus{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`ResourceClaimName:` + valueToStringGenerated(this.ResourceClaimName) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupSchedulingConstraints) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForTopology := "[]TopologyConstraint{"
+	for _, f := range this.Topology {
+		repeatedStringForTopology += strings.Replace(strings.Replace(f.String(), "TopologyConstraint", "TopologyConstraint", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForTopology += "}"
+	s := strings.Join([]string{`&PodGroupSchedulingConstraints{`,
+		`Topology:` + repeatedStringForTopology + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupSchedulingPolicy) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&PodGroupSchedulingPolicy{`,
+		`Basic:` + strings.Replace(this.Basic.String(), "BasicSchedulingPolicy", "BasicSchedulingPolicy", 1) + `,`,
+		`Gang:` + strings.Replace(this.Gang.String(), "GangSchedulingPolicy", "GangSchedulingPolicy", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupSpec) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForResourceClaims := "[]PodGroupResourceClaim{"
+	for _, f := range this.ResourceClaims {
+		repeatedStringForResourceClaims += strings.Replace(strings.Replace(f.String(), "PodGroupResourceClaim", "PodGroupResourceClaim", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForResourceClaims += "}"
+	s := strings.Join([]string{`&PodGroupSpec{`,
+		`ParentCompositePodGroupName:` + valueToStringGenerated(this.ParentCompositePodGroupName) + `,`,
+		`WorkloadRef:` + strings.Replace(this.WorkloadRef.String(), "WorkloadReference", "WorkloadReference", 1) + `,`,
+		`SchedulingPolicy:` + strings.Replace(strings.Replace(this.SchedulingPolicy.String(), "PodGroupSchedulingPolicy", "PodGroupSchedulingPolicy", 1), `&`, ``, 1) + `,`,
+		`SchedulingConstraints:` + strings.Replace(this.SchedulingConstraints.String(), "PodGroupSchedulingConstraints", "PodGroupSchedulingConstraints", 1) + `,`,
+		`ResourceClaims:` + repeatedStringForResourceClaims + `,`,
+		`DisruptionMode:` + strings.Replace(this.DisruptionMode.String(), "DisruptionMode", "DisruptionMode", 1) + `,`,
+		`PriorityClassName:` + fmt.Sprintf("%v", this.PriorityClassName) + `,`,
+		`Priority:` + valueToStringGenerated(this.Priority) + `,`,
+		`PreemptionPolicy:` + valueToStringGenerated(this.PreemptionPolicy) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForConditions := "[]Condition{"
+	for _, f := range this.Conditions {
+		repeatedStringForConditions += fmt.Sprintf("%v", f) + ","
+	}
+	repeatedStringForConditions += "}"
+	repeatedStringForResourceClaimStatuses := "[]PodGroupResourceClaimStatus{"
+	for _, f := range this.ResourceClaimStatuses {
+		repeatedStringForResourceClaimStatuses += strings.Replace(strings.Replace(f.String(), "PodGroupResourceClaimStatus", "PodGroupResourceClaimStatus", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForResourceClaimStatuses += "}"
+	s := strings.Join([]string{`&PodGroupStatus{`,
+		`Conditions:` + repeatedStringForConditions + `,`,
+		`ResourceClaimStatuses:` + repeatedStringForResourceClaimStatuses + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PodGroupTemplate) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForResourceClaims := "[]PodGroupResourceClaim{"
+	for _, f := range this.ResourceClaims {
+		repeatedStringForResourceClaims += strings.Replace(strings.Replace(f.String(), "PodGroupResourceClaim", "PodGroupResourceClaim", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForResourceClaims += "}"
+	s := strings.Join([]string{`&PodGroupTemplate{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`SchedulingPolicy:` + strings.Replace(strings.Replace(this.SchedulingPolicy.String(), "PodGroupSchedulingPolicy", "PodGroupSchedulingPolicy", 1), `&`, ``, 1) + `,`,
+		`SchedulingConstraints:` + strings.Replace(this.SchedulingConstraints.String(), "PodGroupSchedulingConstraints", "PodGroupSchedulingConstraints", 1) + `,`,
+		`ResourceClaims:` + repeatedStringForResourceClaims + `,`,
+		`DisruptionMode:` + strings.Replace(this.DisruptionMode.String(), "DisruptionMode", "DisruptionMode", 1) + `,`,
+		`PriorityClassName:` + fmt.Sprintf("%v", this.PriorityClassName) + `,`,
+		`Priority:` + valueToStringGenerated(this.Priority) + `,`,
+		`PreemptionPolicy:` + valueToStringGenerated(this.PreemptionPolicy) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PriorityClass) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&PriorityClass{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`Value:` + fmt.Sprintf("%v", this.Value) + `,`,
+		`GlobalDefault:` + fmt.Sprintf("%v", this.GlobalDefault) + `,`,
+		`Description:` + fmt.Sprintf("%v", this.Description) + `,`,
+		`PreemptionPolicy:` + valueToStringGenerated(this.PreemptionPolicy) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *PriorityClassList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]PriorityClass{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "PriorityClass", "PriorityClass", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&PriorityClassList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SingleCompositeDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SingleCompositeDisruptionMode{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *SingleDisruptionMode) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&SingleDisruptionMode{`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *TopologyConstraint) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&TopologyConstraint{`,
+		`Key:` + fmt.Sprintf("%v", this.Key) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *TypedLocalObjectReference) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&TypedLocalObjectReference{`,
+		`APIGroup:` + fmt.Sprintf("%v", this.APIGroup) + `,`,
+		`Kind:` + fmt.Sprintf("%v", this.Kind) + `,`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *Workload) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&Workload{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "WorkloadSpec", "WorkloadSpec", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]Workload{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "Workload", "Workload", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&WorkloadList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadReference) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&WorkloadReference{`,
+		`WorkloadName:` + fmt.Sprintf("%v", this.WorkloadName) + `,`,
+		`TemplateName:` + fmt.Sprintf("%v", this.TemplateName) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *WorkloadSpec) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForPodGroupTemplates := "[]PodGroupTemplate{"
+	for _, f := range this.PodGroupTemplates {
+		repeatedStringForPodGroupTemplates += strings.Replace(strings.Replace(f.String(), "PodGroupTemplate", "PodGroupTemplate", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForPodGroupTemplates += "}"
+	repeatedStringForCompositePodGroupTemplates := "[]CompositePodGroupTemplate{"
+	for _, f := range this.CompositePodGroupTemplates {
+		repeatedStringForCompositePodGroupTemplates += strings.Replace(strings.Replace(f.String(), "CompositePodGroupTemplate", "CompositePodGroupTemplate", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForCompositePodGroupTemplates += "}"
+	s := strings.Join([]string{`&WorkloadSpec{`,
+		`ControllerRef:` + strings.Replace(this.ControllerRef.String(), "TypedLocalObjectReference", "TypedLocalObjectReference", 1) + `,`,
+		`PodGroupTemplates:` + repeatedStringForPodGroupTemplates + `,`,
+		`CompositePodGroupTemplates:` + repeatedStringForCompositePodGroupTemplates + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringGenerated(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
 		return "nil"
 	}
-	s := strings.Join([]string{`&PriorityClass{`,
-		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
-		`Value:` + fmt.Sprintf("%v", this.Value) + `,`,
-		`GlobalDefault:` + fmt.Sprintf("%v", this.GlobalDefault) + `,`,
-		`Description:` + fmt.Sprintf("%v", this.Description) + `,`,
-		`PreemptionPolicy:` + valueToStringGenerated(this.PreemptionPolicy) + `,`,
-		`}`,
-	}, "")
-	return s
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *AllCompositeDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AllCompositeDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AllCompositeDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AllDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AllDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AllDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *BasicSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: BasicSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: BasicSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositeBasicSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositeBasicSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositeBasicSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositeDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositeDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositeDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Single", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Single == nil {
+				m.Single = &SingleCompositeDisruptionMode{}
+			}
+			if err := m.Single.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field All", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.All == nil {
+				m.All = &AllCompositeDisruptionMode{}
+			}
+			if err := m.All.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositeGangSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositeGangSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositeGangSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MinGroupCount", wireType)
+			}
+			m.MinGroupCount = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.MinGroupCount |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositePodGroupSchedulingConstraints) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositePodGroupSchedulingConstraints: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositePodGroupSchedulingConstraints: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Topology", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Topology = append(m.Topology, TopologyConstraint{})
+			if err := m.Topology[len(m.Topology)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositePodGroupSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositePodGroupSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositePodGroupSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Basic", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Basic == nil {
+				m.Basic = &CompositeBasicSchedulingPolicy{}
+			}
+			if err := m.Basic.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Gang", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Gang == nil {
+				m.Gang = &CompositeGangSchedulingPolicy{}
+			}
+			if err := m.Gang.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CompositePodGroupTemplate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CompositePodGroupTemplate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CompositePodGroupTemplate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingPolicy", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SchedulingPolicy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingConstraints", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SchedulingConstraints == nil {
+				m.SchedulingConstraints = &CompositePodGroupSchedulingConstraints{}
+			}
+			if err := m.SchedulingConstraints.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DisruptionMode", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.DisruptionMode == nil {
+				m.DisruptionMode = &CompositeDisruptionMode{}
+			}
+			if err := m.DisruptionMode.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PriorityClassName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PriorityClassName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Priority", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Priority = &v
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PreemptionPolicy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := PreemptionPolicy(dAtA[iNdEx:postIndex])
+			m.PreemptionPolicy = &s
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PodGroupTemplates", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PodGroupTemplates = append(m.PodGroupTemplates, PodGroupTemplate{})
+			if err := m.PodGroupTemplates[len(m.PodGroupTemplates)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CompositePodGroupTemplates", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CompositePodGroupTemplates = append(m.CompositePodGroupTemplates, CompositePodGroupTemplate{})
+			if err := m.CompositePodGroupTemplates[len(m.CompositePodGroupTemplates)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Single", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Single == nil {
+				m.Single = &SingleDisruptionMode{}
+			}
+			if err := m.Single.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field All", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.All == nil {
+				m.All = &AllDisruptionMode{}
+			}
+			if err := m.All.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GangSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GangSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GangSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MinCount", wireType)
+			}
+			m.MinCount = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.MinCount |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroup) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroup: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroup: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, PodGroup{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupResourceClaim) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupResourceClaim: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupResourceClaim: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaimName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ResourceClaimName = &s
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaimTemplateName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ResourceClaimTemplateName = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupResourceClaimStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupResourceClaimStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupResourceClaimStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaimName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ResourceClaimName = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupSchedulingConstraints) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupSchedulingConstraints: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupSchedulingConstraints: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Topology", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Topology = append(m.Topology, TopologyConstraint{})
+			if err := m.Topology[len(m.Topology)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupSchedulingPolicy) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupSchedulingPolicy: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupSchedulingPolicy: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Basic", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Basic == nil {
+				m.Basic = &BasicSchedulingPolicy{}
+			}
+			if err := m.Basic.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Gang", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Gang == nil {
+				m.Gang = &GangSchedulingPolicy{}
+			}
+			if err := m.Gang.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupSpec) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ParentCompositePodGroupName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.ParentCompositePodGroupName = &s
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadRef", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.WorkloadRef == nil {
+				m.WorkloadRef = &WorkloadReference{}
+			}
+			if err := m.WorkloadRef.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingPolicy", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SchedulingPolicy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingConstraints", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SchedulingConstraints == nil {
+				m.SchedulingConstraints = &PodGroupSchedulingConstraints{}
+			}
+			if err := m.SchedulingConstraints.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaims", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceClaims = append(m.ResourceClaims, PodGroupResourceClaim{})
+			if err := m.ResourceClaims[len(m.ResourceClaims)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DisruptionMode", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.DisruptionMode == nil {
+				m.DisruptionMode = &DisruptionMode{}
+			}
+			if err := m.DisruptionMode.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PriorityClassName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PriorityClassName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Priority", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Priority = &v
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PreemptionPolicy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := PreemptionPolicy(dAtA[iNdEx:postIndex])
+			m.PreemptionPolicy = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Conditions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Conditions = append(m.Conditions, v1.Condition{})
+			if err := m.Conditions[len(m.Conditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaimStatuses", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceClaimStatuses = append(m.ResourceClaimStatuses, PodGroupResourceClaimStatus{})
+			if err := m.ResourceClaimStatuses[len(m.ResourceClaimStatuses)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PodGroupTemplate) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PodGroupTemplate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PodGroupTemplate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingPolicy", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.SchedulingPolicy.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchedulingConstraints", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SchedulingConstraints == nil {
+				m.SchedulingConstraints = &PodGroupSchedulingConstraints{}
+			}
+			if err := m.SchedulingConstraints.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceClaims", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceClaims = append(m.ResourceClaims, PodGroupResourceClaim{})
+			if err := m.ResourceClaims[len(m.ResourceClaims)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DisruptionMode", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.DisruptionMode == nil {
+				m.DisruptionMode = &DisruptionMode{}
+			}
+			if err := m.DisruptionMode.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PriorityClassName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PriorityClassName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Priority", wireType)
+			}
+			var v int32
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Priority = &v
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PreemptionPolicy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := PreemptionPolicy(dAtA[iNdEx:postIndex])
+			m.PreemptionPolicy = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PriorityClass) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PriorityClass: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PriorityClass: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+			}
+			m.Value = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Value |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GlobalDefault", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.GlobalDefault = bool(v != 0)
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Description", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Description = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PreemptionPolicy", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := k8s_io_api_core_v1.PreemptionPolicy(dAtA[iNdEx:postIndex])
+			m.PreemptionPolicy = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PriorityClassList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PriorityClassList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PriorityClassList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, PriorityClass{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SingleCompositeDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SingleCompositeDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SingleCompositeDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
 }
-func (this *PriorityClassList) String() string {
-	if this == nil {
-		return "nil"
+func (m *SingleDisruptionMode) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SingleDisruptionMode: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SingleDisruptionMode: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
 	}
-	repeatedStringForItems := "[]PriorityClass{"
-	for _, f := range this.Items {
-		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "PriorityClass", "PriorityClass", 1), `&`, ``, 1) + ","
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TopologyConstraint) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TopologyConstraint: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TopologyConstraint: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Key = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TypedLocalObjectReference) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TypedLocalObjectReference: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TypedLocalObjectReference: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field APIGroup", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.APIGroup = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
 	}
-	repeatedStringForItems += "}"
-	s := strings.Join([]string{`&PriorityClassList{`,
-		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
-		`Items:` + repeatedStringForItems + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func valueToStringGenerated(v interface{}) string {
-	rv := reflect.ValueOf(v)
-	if rv.IsNil() {
-		return "nil"
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
 	}
-	pv := reflect.Indirect(rv).Interface()
-	return fmt.Sprintf("*%v", pv)
+	return nil
 }
-func (m *PriorityClass) Unmarshal(dAtA []byte) error {
+func (m *Workload) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -252,10 +5660,10 @@ func (m *PriorityClass) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PriorityClass: wiretype end group for non-group")
+			return fmt.Errorf("proto: Workload: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PriorityClass: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: Workload: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -292,10 +5700,10 @@ func (m *PriorityClass) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
 			}
-			m.Value = 0
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -305,16 +5713,80 @@ func (m *PriorityClass) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Value |= int32(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-		case 3:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field GlobalDefault", wireType)
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
 			}
-			var v int
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowGenerated
@@ -324,15 +5796,112 @@ func (m *PriorityClass) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				v |= int(b&0x7F) << shift
+				msglen |= int(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
-			m.GlobalDefault = bool(v != 0)
-		case 4:
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Description", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, Workload{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WorkloadReference) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WorkloadReference: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WorkloadReference: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WorkloadName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -360,11 +5929,11 @@ func (m *PriorityClass) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Description = string(dAtA[iNdEx:postIndex])
+			m.WorkloadName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 5:
+		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field PreemptionPolicy", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field TemplateName", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -392,8 +5961,7 @@ func (m *PriorityClass) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			s := k8s_io_api_core_v1.PreemptionPolicy(dAtA[iNdEx:postIndex])
-			m.PreemptionPolicy = &s
+			m.TemplateName = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -416,7 +5984,7 @@ func (m *PriorityClass) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *PriorityClassList) Unmarshal(dAtA []byte) error {
+func (m *WorkloadSpec) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -439,15 +6007,15 @@ func (m *PriorityClassList) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: PriorityClassList: wiretype end group for non-group")
+			return fmt.Errorf("proto: WorkloadSpec: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: PriorityClassList: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: WorkloadSpec: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ControllerRef", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -474,13 +6042,16 @@ func (m *PriorityClassList) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if m.ControllerRef == nil {
+				m.ControllerRef = &TypedLocalObjectReference{}
+			}
+			if err := m.ControllerRef.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field PodGroupTemplates", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -507,8 +6078,42 @@ func (m *PriorityClassList) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Items = append(m.Items, PriorityClass{})
-			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.PodGroupTemplates = append(m.PodGroupTemplates, PodGroupTemplate{})
+			if err := m.PodGroupTemplates[len(m.PodGroupTemplates)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CompositePodGroupTemplates", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CompositePodGroupTemplates = append(m.CompositePodGroupTemplates, CompositePodGroupTemplate{})
+			if err := m.CompositePodGroupTemplates[len(m.CompositePodGroupTemplates)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
diff --git a/vendor/k8s.io/api/scheduling/v1beta1/generated.proto b/vendor/k8s.io/api/scheduling/v1beta1/generated.proto
index 0e701be549..656841e41d 100644
--- a/vendor/k8s.io/api/scheduling/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/scheduling/v1beta1/generated.proto
@@ -29,11 +29,651 @@ import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
 // Package-wide variables from generator "generated".
 option go_package = "k8s.io/api/scheduling/v1beta1";
 
+// AllCompositeDisruptionMode means that children of a CompositePodGroup can only be
+// disrupted or preempted together.
+message AllCompositeDisruptionMode {
+}
+
+// AllDisruptionMode specifies that children can only be disrupted together.
+message AllDisruptionMode {
+}
+
+// BasicSchedulingPolicy indicates that standard Kubernetes
+// scheduling behavior should be used.
+message BasicSchedulingPolicy {
+}
+
+// CompositeBasicSchedulingPolicy indicates that the groups belonging to the composite group
+// should be scheduled independently.
+message CompositeBasicSchedulingPolicy {
+}
+
+// CompositeDisruptionMode defines how individual entities within a composite pod group can be disrupted.
+// Exactly one mode must be set.
+//
+// +union
+message CompositeDisruptionMode {
+  // single specifies that children groups can be disrupted independently from each other.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional SingleCompositeDisruptionMode single = 1;
+
+  // all specifies that all children groups can only be disrupted together.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional AllCompositeDisruptionMode all = 2;
+}
+
+// CompositeGangSchedulingPolicy indicates that the groups belonging to the composite group
+// should be scheduled using all-or-nothing semantics.
+message CompositeGangSchedulingPolicy {
+  // minGroupCount is the minimum number of child groups that must be schedulable
+  // or scheduled at the same time for the scheduler to admit the entire group.
+  // It must be a positive integer.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:minimum=1
+  optional int32 minGroupCount = 1;
+}
+
+// CompositePodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a CompositePodGroup.
+message CompositePodGroupSchedulingConstraints {
+  // topology defines the topology constraints for the composite pod group.
+  // Currently only a single topology constraint can be specified. This may change in the future.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:maxItems=1
+  // +listType=atomic
+  // +k8s:listType=atomic
+  repeated TopologyConstraint topology = 1;
+}
+
+// CompositePodGroupSchedulingPolicy defines the scheduling configuration for a CompositePodGroup.
+// Exactly one policy must be set.
+//
+// +union
+message CompositePodGroupSchedulingPolicy {
+  // basic specifies that the groups of this composite group should be scheduled independently.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  // +k8s:unionMember
+  optional CompositeBasicSchedulingPolicy basic = 1;
+
+  // gang specifies that the groups of this composite group should be scheduled using
+  // all-or-nothing semantics.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:update=NoSet
+  // +k8s:update=NoUnset
+  optional CompositeGangSchedulingPolicy gang = 2;
+}
+
+// CompositePodGroupTemplate represents a template for a CompositePodGroup with a scheduling policy.
+message CompositePodGroupTemplate {
+  // name is a unique identifier for the CompositePodGroupTemplate within the Workload.
+  // It must be a DNS label. This field is required.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-short-name
+  optional string name = 1;
+
+  // schedulingPolicy defines the scheduling policy for this template.
+  //
+  // +required
+  optional CompositePodGroupSchedulingPolicy schedulingPolicy = 2;
+
+  // schedulingConstraints defines optional scheduling constraints (e.g. topology) for this CompositePodGroupTemplate.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional CompositePodGroupSchedulingConstraints schedulingConstraints = 3;
+
+  // disruptionMode defines the mode in which a given CompositePodGroup can be disrupted.
+  // One of Single, All.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional CompositeDisruptionMode disruptionMode = 4;
+
+  // priorityClassName indicates the priority that should be considered when scheduling
+  // a composite pod group created from this template. If no priority class is specified,
+  // admission control can set this to the global default priority class if it exists.
+  // Otherwise, composite pod groups created from this template will have the priority set
+  // to zero.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:format=k8s-long-name
+  // +k8s:immutable
+  optional string priorityClassName = 5;
+
+  // priority is the value of priority of composite pod groups created from this template.
+  // Various system components use this field to find the priority of the composite pod group.
+  // When Priority Admission Controller is enabled, it prevents users from setting this field.
+  // The admission controller populates this field from PriorityClassName.
+  // The higher the value, the higher the priority.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:maximum=1000000000 # HighestUserDefinablePriority
+  // +k8s:immutable
+  optional int32 priority = 6;
+
+  // preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+  // One of Never, PreemptLowerPriority.
+  // This field is immutable.
+  // This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+  //
+  // +featureGate=PodGroupPreemptionPolicy
+  // +optional
+  // +k8s:immutable
+  // +k8s:ifDisabled("PodGroupPreemptionPolicy")=+k8s:forbidden
+  // +k8s:ifEnabled("PodGroupPreemptionPolicy")=+k8s:optional
+  optional string preemptionPolicy = 7;
+
+  // podGroupTemplates is the list of templates for children PodGroups.
+  // The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates
+  // or PodGroupTemplates must be set.
+  //
+  // +optional
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=8
+  // +k8s:update=NoAddItem
+  // +k8s:update=NoRemoveItem
+  repeated PodGroupTemplate podGroupTemplates = 8;
+
+  // compositePodGroupTemplates is the list of templates for children CompositePodGroups.
+  // The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates
+  // or PodGroupTemplates must be set.
+  //
+  // +optional
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=8
+  // +k8s:update=NoAddItem
+  // +k8s:update=NoRemoveItem
+  repeated CompositePodGroupTemplate compositePodGroupTemplates = 9;
+}
+
+// DisruptionMode defines how individual entities within a group can be disrupted.
+// Exactly one mode can be set.
+//
+// +union
+message DisruptionMode {
+  // single specifies that children can be disrupted independently from each other.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional SingleDisruptionMode single = 1;
+
+  // all specifies that all children can only be disrupted together.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  optional AllDisruptionMode all = 2;
+}
+
+// GangSchedulingPolicy defines the parameters for gang scheduling.
+message GangSchedulingPolicy {
+  // minCount is the minimum number of pods that must be schedulable or scheduled
+  // at the same time for the scheduler to admit the entire group.
+  // It must be a positive integer. This field is mutable to support workload scaling.
+  //
+  // Note that the scheduler operates on an eventually consistent model. Updates
+  // to minCount may not be immediately reflected in scheduling decisions due to
+  // propagation delays. If minCount is updated while a scheduling cycle is in
+  // progress for that group, the new value may not take effect until the next
+  // cycle. Moreover, minCount is only enforced during scheduling, meaning that
+  // modifications to this field do not affect already-scheduled pods, applying
+  // only to those evaluated in future cycles.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:minimum=1
+  optional int32 minCount = 1;
+}
+
+// PodGroup represents a runtime instance of pods grouped together.
+// PodGroups are created by workload controllers (Job, LWS, JobSet, etc...) from
+// Workload.podGroupTemplates.
+// PodGroup API enablement is toggled by the GenericWorkload feature gate.
+message PodGroup {
+  // metadata is the standard object metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
+
+  // spec defines the desired state of the PodGroup.
+  //
+  // +required
+  optional PodGroupSpec spec = 2;
+
+  // status represents the current observed state of the PodGroup.
+  //
+  // +optional
+  optional PodGroupStatus status = 3;
+}
+
+// PodGroupList contains a list of PodGroup resources.
+message PodGroupList {
+  // Standard list metadata.
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
+
+  // Items is the list of PodGroups.
+  repeated PodGroup items = 2;
+}
+
+// PodGroupResourceClaim references exactly one ResourceClaim, either directly
+// or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim
+// for the PodGroup.
+//
+// It adds a name to it that uniquely identifies the ResourceClaim inside the PodGroup.
+// Pods that need access to the ResourceClaim define a matching reference in its
+// own Spec.ResourceClaims. The Pod's claim must match all fields of the
+// PodGroup's claim exactly.
+message PodGroupResourceClaim {
+  // name uniquely identifies this resource claim inside the PodGroup.
+  // This must be a DNS_LABEL.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-short-name
+  optional string name = 1;
+
+  // resourceClaimName is the name of a ResourceClaim object in the same
+  // namespace as this PodGroup. The ResourceClaim will be reserved for the
+  // PodGroup instead of its individual pods.
+  //
+  // Exactly one of ResourceClaimName and ResourceClaimTemplateName must
+  // be set.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:format=k8s-long-name
+  optional string resourceClaimName = 2;
+
+  // resourceClaimTemplateName is the name of a ResourceClaimTemplate
+  // object in the same namespace as this PodGroup.
+  //
+  // The template will be used to create a new ResourceClaim, which will
+  // be bound to this PodGroup. When this PodGroup is deleted, the ResourceClaim
+  // will also be deleted. The PodGroup name and resource name, along with a
+  // generated component, will be used to form a unique name for the
+  // ResourceClaim, which will be recorded in podgroup.status.resourceClaimStatuses.
+  //
+  // This field is immutable and no changes will be made to the
+  // corresponding ResourceClaim by the control plane after creating the
+  // ResourceClaim.
+  //
+  // Exactly one of ResourceClaimName and ResourceClaimTemplateName must
+  // be set.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:format=k8s-long-name
+  optional string resourceClaimTemplateName = 3;
+}
+
+// PodGroupResourceClaimStatus is stored in the PodGroupStatus for each
+// PodGroupResourceClaim which references a ResourceClaimTemplate. It stores the
+// generated name for the corresponding ResourceClaim.
+message PodGroupResourceClaimStatus {
+  // name uniquely identifies this resource claim inside the PodGroup. This
+  // must match the name of an entry in podgroup.spec.resourceClaims, which
+  // implies that the string must be a DNS_LABEL.
+  //
+  // +required
+  optional string name = 1;
+
+  // resourceClaimName is the name of the ResourceClaim that was generated for
+  // the PodGroup in the namespace of the PodGroup. If this is unset, then
+  // generating a ResourceClaim was not necessary. The
+  // podgroup.spec.resourceClaims entry can be ignored in this case.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:format=k8s-long-name
+  optional string resourceClaimName = 2;
+}
+
+// PodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a PodGroup.
+message PodGroupSchedulingConstraints {
+  // topology defines the topology constraints for the pod group.
+  // Currently only a single topology constraint can be specified. This may change in the future.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:maxItems=1
+  // +listType=atomic
+  // +k8s:listType=atomic
+  repeated TopologyConstraint topology = 1;
+}
+
+// PodGroupSchedulingPolicy defines the scheduling configuration for a PodGroup.
+// Exactly one policy must be set. The policy is chosen at creation time by setting either the
+// Basic or Gang field. The PodGroup may not change policy after creation.
+// Fields within chosen policy may be updated after creation when their individual fields allow it.
+//
+// +union
+message PodGroupSchedulingPolicy {
+  // basic specifies that the pods in this group should be scheduled using
+  // standard Kubernetes scheduling behavior. Setting this field at group creation time
+  // opts this group to basic scheduling; this field cannot be changed afterward.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:immutable
+  optional BasicSchedulingPolicy basic = 1;
+
+  // gang specifies that the pods in this group should be scheduled using
+  // all-or-nothing semantics. Setting this field at group creation time
+  // opts this group to gang scheduling; this field cannot be set or unset afterward.
+  // The minCount field within Gang scheduling policy remains mutable after group creation.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:update=NoSet
+  // +k8s:update=NoUnset
+  optional GangSchedulingPolicy gang = 2;
+}
+
+// PodGroupSpec defines the desired state of a PodGroup.
+message PodGroupSpec {
+  // parentCompositePodGroupName contains the name of the parent composite pod group
+  // within the same namespace as this pod group.
+  // If it's nil, then this pod group is a root of a workload's hierarchy.
+  // This field is used only when the CompositePodGroup feature gate is enabled.
+  // This field is immutable.
+  //
+  // +featureGate=CompositePodGroup
+  // +optional
+  // +k8s:ifDisabled(CompositePodGroup)=+k8s:forbidden
+  // +k8s:ifEnabled(CompositePodGroup)=+k8s:optional
+  // +k8s:immutable
+  // +k8s:format=k8s-long-name
+  // +k8s:alpha(since: "1.37")=+k8s:dependentRequired("workloadRef")
+  optional string parentCompositePodGroupName = 1;
+
+  // workloadRef references an optional PodGroup template within the Workload
+  // object that was used to create the PodGroup.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional WorkloadReference workloadRef = 2;
+
+  // schedulingPolicy defines the scheduling policy for this instance of the PodGroup.
+  // Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+  //
+  // +required
+  optional PodGroupSchedulingPolicy schedulingPolicy = 3;
+
+  // schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroup.
+  // Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+  // This field is immutable.
+  // This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
+  //
+  // +featureGate=TopologyAwareWorkloadScheduling
+  // +optional
+  // +k8s:ifDisabled(TopologyAwareWorkloadScheduling)=+k8s:forbidden
+  // +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:optional
+  // +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:immutable
+  optional PodGroupSchedulingConstraints schedulingConstraints = 4;
+
+  // resourceClaims defines which ResourceClaims may be shared among Pods in
+  // the group. Pods consume the devices allocated to a PodGroup's claim by
+  // defining a claim in its own Spec.ResourceClaims that matches the
+  // PodGroup's claim exactly. The claim must have the same name and refer to
+  // the same ResourceClaim or ResourceClaimTemplate.
+  //
+  // This is a beta-level field and requires that the
+  // DRAWorkloadResourceClaims feature gate is enabled.
+  //
+  // This field is immutable.
+  //
+  // +optional
+  // +patchMergeKey=name
+  // +patchStrategy=merge,retainKeys
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=4
+  // +k8s:immutable
+  // +featureGate=DRAWorkloadResourceClaims
+  repeated PodGroupResourceClaim resourceClaims = 5;
+
+  // disruptionMode defines the mode in which a given PodGroup can be disrupted.
+  // Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+  // One of Single, All. Defaults to Single if unset.
+  // This field is immutable.
+  //
+  // +default={"single": {}}
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional DisruptionMode disruptionMode = 6;
+
+  // priorityClassName defines the priority that should be considered when scheduling this pod group.
+  // Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+  // Otherwise, it is validated and resolved similarly to the PriorityClassName on PodGroupTemplate
+  // (i.e. if no priority class is specified, admission control can set this to the global default
+  // priority class if it exists. Otherwise, the pod group's priority will be zero).
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  // +k8s:format=k8s-long-name
+  optional string priorityClassName = 7;
+
+  // priority is the value of priority of this pod group. Various system components
+  // use this field to find the priority of the pod group. When Priority Admission
+  // Controller is enabled, it prevents users from setting this field. The admission
+  // controller populates this field from PriorityClassName.
+  // The higher the value, the higher the priority.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  // +k8s:maximum=1000000000 # HighestUserDefinablePriority
+  optional int32 priority = 8;
+
+  // preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+  // One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset.
+  // When Priority Admission Controller is enabled, it populates this field from PriorityClassName,
+  // and defaults to PreemptLowerPriority if value is unset in PriorityClass.
+  // This field is immutable.
+  // This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+  //
+  // +featureGate=PodGroupPreemptionPolicy
+  // +optional
+  // +k8s:immutable
+  // +k8s:ifDisabled("PodGroupPreemptionPolicy")=+k8s:forbidden
+  // +k8s:ifEnabled("PodGroupPreemptionPolicy")=+k8s:optional
+  optional string preemptionPolicy = 9;
+}
+
+// PodGroupStatus represents information about the status of a pod group.
+message PodGroupStatus {
+  // conditions represent the latest observations of the PodGroup's state.
+  //
+  // Known condition types:
+  // - "PodGroupInitiallyScheduled": Indicates whether the scheduling requirement has been satisfied.
+  // Once this condition transitions to True, it serves as a terminal state and will never revert to False,
+  // even if pods are subsequently evicted and group constraints are no longer met.
+  // - "DisruptionTarget": Indicates whether the PodGroup is about to be terminated
+  //   due to disruption such as preemption.
+  //
+  // Known reasons for the PodGroupInitiallyScheduled condition:
+  // - "Unschedulable": The PodGroup cannot be scheduled due to resource constraints,
+  //   affinity/anti-affinity rules, or insufficient capacity for the gang.
+  // - "SchedulerError": The PodGroup cannot be scheduled due to some internal error
+  //   that happened during scheduling, for example due to nodeAffinity parsing errors.
+  //
+  // Known reasons for the DisruptionTarget condition:
+  // - "PreemptionByScheduler": The PodGroup was preempted by the scheduler to make room for
+  //   higher-priority PodGroups or Pods.
+  //
+  // +optional
+  // +patchMergeKey=type
+  // +patchStrategy=merge
+  // +listType=map
+  // +listMapKey=type
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+  repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 1;
+
+  // resourceClaimStatuses is status of resource claims.
+  // +optional
+  // +patchMergeKey=name
+  // +patchStrategy=merge,retainKeys
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=4
+  // +featureGate=DRAWorkloadResourceClaims
+  repeated PodGroupResourceClaimStatus resourceClaimStatuses = 2;
+}
+
+// PodGroupTemplate represents a template for a set of pods with a scheduling policy.
+message PodGroupTemplate {
+  // name is a unique identifier for the PodGroupTemplate within the Workload.
+  // It must be a DNS label. This field is immutable.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-short-name
+  optional string name = 1;
+
+  // schedulingPolicy defines the scheduling policy for this PodGroupTemplate.
+  //
+  // +required
+  optional PodGroupSchedulingPolicy schedulingPolicy = 2;
+
+  // schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroupTemplate.
+  // This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
+  // This field is immutable.
+  //
+  // +featureGate=TopologyAwareWorkloadScheduling
+  // +optional
+  // +k8s:ifDisabled(TopologyAwareWorkloadScheduling)=+k8s:forbidden
+  // +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:optional
+  // +k8s:immutable
+  optional PodGroupSchedulingConstraints schedulingConstraints = 3;
+
+  // resourceClaims defines which ResourceClaims may be shared among Pods in
+  // the group. Pods consume the devices allocated to a PodGroup's claim by
+  // defining a claim in its own Spec.ResourceClaims that matches the
+  // PodGroup's claim exactly. The claim must have the same name and refer to
+  // the same ResourceClaim or ResourceClaimTemplate.
+  //
+  // This is a beta-level field and requires that the
+  // DRAWorkloadResourceClaims feature gate is enabled.
+  //
+  // This field is immutable.
+  //
+  // +optional
+  // +patchMergeKey=name
+  // +patchStrategy=merge,retainKeys
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=4
+  // +featureGate=DRAWorkloadResourceClaims
+  // +k8s:immutable
+  repeated PodGroupResourceClaim resourceClaims = 4;
+
+  // disruptionMode defines the mode in which a given PodGroup can be disrupted.
+  // One of Single, All.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional DisruptionMode disruptionMode = 5;
+
+  // priorityClassName indicates the priority that should be considered when scheduling
+  // a pod group created from this template.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:format=k8s-long-name
+  // +k8s:immutable
+  optional string priorityClassName = 6;
+
+  // priority is the value of priority of pod groups created from this template. Various
+  // system components use this field to find the priority of the pod group.
+  // The higher the value, the higher the priority.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:maximum=1000000000 # HighestUserDefinablePriority
+  // +k8s:immutable
+  optional int32 priority = 7;
+
+  // preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+  // One of Never, PreemptLowerPriority.
+  // This field is immutable.
+  // This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+  //
+  // +featureGate=PodGroupPreemptionPolicy
+  // +optional
+  // +k8s:immutable
+  // +k8s:ifDisabled("PodGroupPreemptionPolicy")=+k8s:forbidden
+  // +k8s:ifEnabled("PodGroupPreemptionPolicy")=+k8s:optional
+  optional string preemptionPolicy = 8;
+}
+
 // DEPRECATED - This group version of PriorityClass is deprecated by scheduling.k8s.io/v1/PriorityClass.
 // PriorityClass defines mapping from a priority class name to the priority
 // integer value. The value can be any valid integer.
 message PriorityClass {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
@@ -74,3 +714,155 @@ message PriorityClassList {
   repeated PriorityClass items = 2;
 }
 
+// SingleCompositeDisruptionMode means that individual children of a CompositePodGroup
+// can be disrupted or preempted independently.
+message SingleCompositeDisruptionMode {
+}
+
+// SingleDisruptionMode specifies that children can be disrupted independently.
+message SingleDisruptionMode {
+}
+
+// TopologyConstraint defines a topology constraint for a PodGroup.
+message TopologyConstraint {
+  // key specifies the key of the node label representing the topology domain.
+  // All pods within the PodGroup must be colocated within the same domain instance.
+  // Different PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.
+  // Examples: "topology.kubernetes.io/rack"
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-label-key
+  optional string key = 1;
+}
+
+// TypedLocalObjectReference allows to reference typed object inside the same namespace.
+message TypedLocalObjectReference {
+  // apiGroup is the group for the resource being referenced.
+  // If apiGroup is empty, the specified Kind must be in the core API group.
+  // For any other third-party types, setting apiGroup is required.
+  // It must be a DNS subdomain.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:format=k8s-long-name
+  optional string apiGroup = 1;
+
+  // kind is the type of resource being referenced.
+  // It must be a path segment name.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-path-segment-name
+  optional string kind = 2;
+
+  // name is the name of resource being referenced.
+  // It must be a path segment name.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-path-segment-name
+  optional string name = 3;
+}
+
+// Workload allows for expressing scheduling constraints that should be used
+// when managing the lifecycle of workloads from the scheduling perspective,
+// including scheduling, preemption, eviction and other phases.
+// Workload API enablement is toggled by the GenericWorkload feature gate.
+message Workload {
+  // metadata is the standard object metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
+
+  // spec defines the desired behavior of a Workload.
+  //
+  // +required
+  optional WorkloadSpec spec = 2;
+}
+
+// WorkloadList contains a list of Workload resources.
+message WorkloadList {
+  // metadata is the standard list metadata.
+  //
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
+
+  // items is the list of Workloads.
+  repeated Workload items = 2;
+}
+
+// WorkloadReference references the Workload object together with the template
+// that was used to create a particular PodGroup.
+message WorkloadReference {
+  // workloadName is the name of the Workload object that contains a template
+  // that was used when creating a pod group. It must
+  // be a DNS name.
+  // This field is required.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-long-name
+  optional string workloadName = 1;
+
+  // templateName is the name of a template within the Workload object that
+  // was used to create a pod group. It must be a DNS label.
+  // This field is required.
+  //
+  // +required
+  // +k8s:required
+  // +k8s:format=k8s-short-name
+  optional string templateName = 2;
+}
+
+// WorkloadSpec defines the desired state of a Workload.
+message WorkloadSpec {
+  // controllerRef is an optional reference to the controlling object, such as a
+  // Deployment or Job. This field is intended for use by tools like CLIs
+  // to provide a link back to the original workload definition.
+  // This field is immutable.
+  //
+  // +optional
+  // +k8s:optional
+  // +k8s:immutable
+  optional TypedLocalObjectReference controllerRef = 1;
+
+  // podGroupTemplates is the list of templates that make up the Workload.
+  // The maximum number of templates is 8. Templates cannot be added or removed after the workload is created.
+  // Existing templates may still be updated where their individual fields allow it.
+  // Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.
+  //
+  // +optional
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:optional
+  // +k8s:unionMember
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=8
+  // +k8s:update=NoAddItem
+  // +k8s:update=NoRemoveItem
+  repeated PodGroupTemplate podGroupTemplates = 2;
+
+  // compositePodGroupTemplates is the list of CompositePodGroup templates that make up the Workload.
+  // The maximum number of templates is 8. This field is immutable.
+  // Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.
+  //
+  // This field is used only when the CompositePodGroup feature gate is enabled.
+  //
+  // +featureGate=CompositePodGroup
+  // +optional
+  // +listType=map
+  // +listMapKey=name
+  // +k8s:ifDisabled("CompositePodGroup")=+k8s:forbidden
+  // +k8s:ifEnabled("CompositePodGroup")=+k8s:optional
+  // +k8s:unionMember
+  // +k8s:listType=map
+  // +k8s:listMapKey=name
+  // +k8s:maxItems=8
+  // +k8s:update=NoAddItem
+  // +k8s:update=NoRemoveItem
+  repeated CompositePodGroupTemplate compositePodGroupTemplates = 3;
+}
+
diff --git a/vendor/k8s.io/api/scheduling/v1beta1/register.go b/vendor/k8s.io/api/scheduling/v1beta1/register.go
index fb26557bbb..c2e75d9071 100644
--- a/vendor/k8s.io/api/scheduling/v1beta1/register.go
+++ b/vendor/k8s.io/api/scheduling/v1beta1/register.go
@@ -46,6 +46,10 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
 		&PriorityClass{},
 		&PriorityClassList{},
+		&Workload{},
+		&WorkloadList{},
+		&PodGroup{},
+		&PodGroupList{},
 	)
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil
diff --git a/vendor/k8s.io/api/scheduling/v1beta1/types.go b/vendor/k8s.io/api/scheduling/v1beta1/types.go
index 8a7a2058f0..57eeac9486 100644
--- a/vendor/k8s.io/api/scheduling/v1beta1/types.go
+++ b/vendor/k8s.io/api/scheduling/v1beta1/types.go
@@ -33,8 +33,8 @@ import (
 // PriorityClass defines mapping from a priority class name to the priority
 // integer value. The value can be any valid integer.
 type PriorityClass struct {
-	metav1.TypeMeta `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
@@ -72,7 +72,7 @@ type PriorityClass struct {
 
 // PriorityClassList is a collection of priority classes.
 type PriorityClassList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -81,3 +81,869 @@ type PriorityClassList struct {
 	// items is the list of PriorityClasses
 	Items []PriorityClass `json:"items" protobuf:"bytes,2,rep,name=items"`
 }
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+
+// Workload allows for expressing scheduling constraints that should be used
+// when managing the lifecycle of workloads from the scheduling perspective,
+// including scheduling, preemption, eviction and other phases.
+// Workload API enablement is toggled by the GenericWorkload feature gate.
+type Workload struct {
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	//
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// spec defines the desired behavior of a Workload.
+	//
+	// +required
+	Spec WorkloadSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+
+// WorkloadList contains a list of Workload resources.
+type WorkloadList struct {
+	metav1.TypeMeta `json:""`
+	// metadata is the standard list metadata.
+	//
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// items is the list of Workloads.
+	Items []Workload `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+const (
+	// WorkloadMaxPodGroupTemplates is the maximum number of pod group templates per Workload.
+	WorkloadMaxPodGroupTemplates = 8
+	// WorkloadMaxTreeDepth is the maximum allowed depth for a tree of (composite) pod group templates in a Workload.
+	WorkloadMaxTreeDepth = 4
+)
+
+// WorkloadSpec defines the desired state of a Workload.
+type WorkloadSpec struct {
+	// controllerRef is an optional reference to the controlling object, such as a
+	// Deployment or Job. This field is intended for use by tools like CLIs
+	// to provide a link back to the original workload definition.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	ControllerRef *TypedLocalObjectReference `json:"controllerRef,omitempty" protobuf:"bytes,1,opt,name=controllerRef"`
+
+	// podGroupTemplates is the list of templates that make up the Workload.
+	// The maximum number of templates is 8. Templates cannot be added or removed after the workload is created.
+	// Existing templates may still be updated where their individual fields allow it.
+	// Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.
+	//
+	// +optional
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=8
+	// +k8s:update=NoAddItem
+	// +k8s:update=NoRemoveItem
+	PodGroupTemplates []PodGroupTemplate `json:"podGroupTemplates" protobuf:"bytes,2,rep,name=podGroupTemplates"`
+
+	// compositePodGroupTemplates is the list of CompositePodGroup templates that make up the Workload.
+	// The maximum number of templates is 8. This field is immutable.
+	// Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.
+	//
+	// This field is used only when the CompositePodGroup feature gate is enabled.
+	//
+	// +featureGate=CompositePodGroup
+	// +optional
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:ifDisabled("CompositePodGroup")=+k8s:forbidden
+	// +k8s:ifEnabled("CompositePodGroup")=+k8s:optional
+	// +k8s:unionMember
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=8
+	// +k8s:update=NoAddItem
+	// +k8s:update=NoRemoveItem
+	CompositePodGroupTemplates []CompositePodGroupTemplate `json:"compositePodGroupTemplates,omitempty" protobuf:"bytes,3,rep,name=compositePodGroupTemplates"`
+}
+
+// TypedLocalObjectReference allows to reference typed object inside the same namespace.
+type TypedLocalObjectReference struct {
+	// apiGroup is the group for the resource being referenced.
+	// If apiGroup is empty, the specified Kind must be in the core API group.
+	// For any other third-party types, setting apiGroup is required.
+	// It must be a DNS subdomain.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:format=k8s-long-name
+	APIGroup string `json:"apiGroup,omitempty" protobuf:"bytes,1,opt,name=apiGroup"`
+	// kind is the type of resource being referenced.
+	// It must be a path segment name.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-path-segment-name
+	Kind string `json:"kind" protobuf:"bytes,2,opt,name=kind"`
+	// name is the name of resource being referenced.
+	// It must be a path segment name.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-path-segment-name
+	Name string `json:"name" protobuf:"bytes,3,opt,name=name"`
+}
+
+// MaxPodGroupResourceClaims is the maximum number of resource claims for a
+// PodGroup or a Workload's PodGroupTemplate.
+const MaxPodGroupResourceClaims = 4
+
+// PodGroupTemplate represents a template for a set of pods with a scheduling policy.
+type PodGroupTemplate struct {
+	// name is a unique identifier for the PodGroupTemplate within the Workload.
+	// It must be a DNS label. This field is immutable.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-short-name
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+
+	// schedulingPolicy defines the scheduling policy for this PodGroupTemplate.
+	//
+	// +required
+	SchedulingPolicy PodGroupSchedulingPolicy `json:"schedulingPolicy" protobuf:"bytes,2,opt,name=schedulingPolicy"`
+
+	// schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroupTemplate.
+	// This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
+	// This field is immutable.
+	//
+	// +featureGate=TopologyAwareWorkloadScheduling
+	// +optional
+	// +k8s:ifDisabled(TopologyAwareWorkloadScheduling)=+k8s:forbidden
+	// +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:optional
+	// +k8s:immutable
+	SchedulingConstraints *PodGroupSchedulingConstraints `json:"schedulingConstraints" protobuf:"bytes,3,opt,name=schedulingConstraints"`
+
+	// resourceClaims defines which ResourceClaims may be shared among Pods in
+	// the group. Pods consume the devices allocated to a PodGroup's claim by
+	// defining a claim in its own Spec.ResourceClaims that matches the
+	// PodGroup's claim exactly. The claim must have the same name and refer to
+	// the same ResourceClaim or ResourceClaimTemplate.
+	//
+	// This is a beta-level field and requires that the
+	// DRAWorkloadResourceClaims feature gate is enabled.
+	//
+	// This field is immutable.
+	//
+	// +optional
+	// +patchMergeKey=name
+	// +patchStrategy=merge,retainKeys
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=4
+	// +featureGate=DRAWorkloadResourceClaims
+	// +k8s:immutable
+	ResourceClaims []PodGroupResourceClaim `json:"resourceClaims,omitempty" patchStrategy:"merge,retainKeys" patchMergeKey:"name" protobuf:"bytes,4,rep,name=resourceClaims"`
+
+	// disruptionMode defines the mode in which a given PodGroup can be disrupted.
+	// One of Single, All.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	DisruptionMode *DisruptionMode `json:"disruptionMode,omitempty" protobuf:"bytes,5,opt,name=disruptionMode"`
+
+	// priorityClassName indicates the priority that should be considered when scheduling
+	// a pod group created from this template.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:format=k8s-long-name
+	// +k8s:immutable
+	PriorityClassName string `json:"priorityClassName,omitempty" protobuf:"bytes,6,opt,name=priorityClassName"`
+
+	// priority is the value of priority of pod groups created from this template. Various
+	// system components use this field to find the priority of the pod group.
+	// The higher the value, the higher the priority.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:maximum=1000000000 # HighestUserDefinablePriority
+	// +k8s:immutable
+	Priority *int32 `json:"priority,omitempty" protobuf:"varint,7,opt,name=priority"`
+
+	// preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+	// One of Never, PreemptLowerPriority.
+	// This field is immutable.
+	// This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+	//
+	// +featureGate=PodGroupPreemptionPolicy
+	// +optional
+	// +k8s:immutable
+	// +k8s:ifDisabled("PodGroupPreemptionPolicy")=+k8s:forbidden
+	// +k8s:ifEnabled("PodGroupPreemptionPolicy")=+k8s:optional
+	PreemptionPolicy *PreemptionPolicy `json:"preemptionPolicy,omitempty" protobuf:"bytes,8,opt,name=preemptionPolicy"`
+}
+
+// CompositePodGroupTemplate represents a template for a CompositePodGroup with a scheduling policy.
+type CompositePodGroupTemplate struct {
+	// name is a unique identifier for the CompositePodGroupTemplate within the Workload.
+	// It must be a DNS label. This field is required.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-short-name
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+
+	// schedulingPolicy defines the scheduling policy for this template.
+	//
+	// +required
+	SchedulingPolicy CompositePodGroupSchedulingPolicy `json:"schedulingPolicy" protobuf:"bytes,2,opt,name=schedulingPolicy"`
+
+	// schedulingConstraints defines optional scheduling constraints (e.g. topology) for this CompositePodGroupTemplate.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	SchedulingConstraints *CompositePodGroupSchedulingConstraints `json:"schedulingConstraints,omitempty" protobuf:"bytes,3,opt,name=schedulingConstraints"`
+
+	// disruptionMode defines the mode in which a given CompositePodGroup can be disrupted.
+	// One of Single, All.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	DisruptionMode *CompositeDisruptionMode `json:"disruptionMode,omitempty" protobuf:"bytes,4,opt,name=disruptionMode"`
+
+	// priorityClassName indicates the priority that should be considered when scheduling
+	// a composite pod group created from this template. If no priority class is specified,
+	// admission control can set this to the global default priority class if it exists.
+	// Otherwise, composite pod groups created from this template will have the priority set
+	// to zero.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:format=k8s-long-name
+	// +k8s:immutable
+	PriorityClassName string `json:"priorityClassName,omitempty" protobuf:"bytes,5,opt,name=priorityClassName"`
+
+	// priority is the value of priority of composite pod groups created from this template.
+	// Various system components use this field to find the priority of the composite pod group.
+	// When Priority Admission Controller is enabled, it prevents users from setting this field.
+	// The admission controller populates this field from PriorityClassName.
+	// The higher the value, the higher the priority.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:maximum=1000000000 # HighestUserDefinablePriority
+	// +k8s:immutable
+	Priority *int32 `json:"priority,omitempty" protobuf:"varint,6,opt,name=priority"`
+
+	// preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+	// One of Never, PreemptLowerPriority.
+	// This field is immutable.
+	// This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+	//
+	// +featureGate=PodGroupPreemptionPolicy
+	// +optional
+	// +k8s:immutable
+	// +k8s:ifDisabled("PodGroupPreemptionPolicy")=+k8s:forbidden
+	// +k8s:ifEnabled("PodGroupPreemptionPolicy")=+k8s:optional
+	PreemptionPolicy *PreemptionPolicy `json:"preemptionPolicy,omitempty" protobuf:"bytes,7,opt,name=preemptionPolicy"`
+
+	// podGroupTemplates is the list of templates for children PodGroups.
+	// The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates
+	// or PodGroupTemplates must be set.
+	//
+	// +optional
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=8
+	// +k8s:update=NoAddItem
+	// +k8s:update=NoRemoveItem
+	PodGroupTemplates []PodGroupTemplate `json:"podGroupTemplates,omitempty" protobuf:"bytes,8,rep,name=podGroupTemplates"`
+
+	// compositePodGroupTemplates is the list of templates for children CompositePodGroups.
+	// The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates
+	// or PodGroupTemplates must be set.
+	//
+	// +optional
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=8
+	// +k8s:update=NoAddItem
+	// +k8s:update=NoRemoveItem
+	CompositePodGroupTemplates []CompositePodGroupTemplate `json:"compositePodGroupTemplates,omitempty" protobuf:"bytes,9,rep,name=compositePodGroupTemplates"`
+}
+
+// PodGroupSchedulingPolicy defines the scheduling configuration for a PodGroup.
+// Exactly one policy must be set. The policy is chosen at creation time by setting either the
+// Basic or Gang field. The PodGroup may not change policy after creation.
+// Fields within chosen policy may be updated after creation when their individual fields allow it.
+//
+// +union
+type PodGroupSchedulingPolicy struct {
+	// basic specifies that the pods in this group should be scheduled using
+	// standard Kubernetes scheduling behavior. Setting this field at group creation time
+	// opts this group to basic scheduling; this field cannot be changed afterward.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:immutable
+	Basic *BasicSchedulingPolicy `json:"basic,omitempty" protobuf:"bytes,1,opt,name=basic"`
+
+	// gang specifies that the pods in this group should be scheduled using
+	// all-or-nothing semantics. Setting this field at group creation time
+	// opts this group to gang scheduling; this field cannot be set or unset afterward.
+	// The minCount field within Gang scheduling policy remains mutable after group creation.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:update=NoSet
+	// +k8s:update=NoUnset
+	Gang *GangSchedulingPolicy `json:"gang,omitempty" protobuf:"bytes,2,opt,name=gang"`
+}
+
+// BasicSchedulingPolicy indicates that standard Kubernetes
+// scheduling behavior should be used.
+type BasicSchedulingPolicy struct {
+	// This is intentionally empty. Its presence indicates that the basic
+	// scheduling policy should be applied. In the future, new fields may appear,
+	// describing such constraints on a pod group level without "all or nothing"
+	// (gang) scheduling.
+}
+
+// GangSchedulingPolicy defines the parameters for gang scheduling.
+type GangSchedulingPolicy struct {
+	// minCount is the minimum number of pods that must be schedulable or scheduled
+	// at the same time for the scheduler to admit the entire group.
+	// It must be a positive integer. This field is mutable to support workload scaling.
+	//
+	// Note that the scheduler operates on an eventually consistent model. Updates
+	// to minCount may not be immediately reflected in scheduling decisions due to
+	// propagation delays. If minCount is updated while a scheduling cycle is in
+	// progress for that group, the new value may not take effect until the next
+	// cycle. Moreover, minCount is only enforced during scheduling, meaning that
+	// modifications to this field do not affect already-scheduled pods, applying
+	// only to those evaluated in future cycles.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:minimum=1
+	MinCount int32 `json:"minCount" protobuf:"varint,1,opt,name=minCount"`
+}
+
+// PodGroupResourceClaim references exactly one ResourceClaim, either directly
+// or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim
+// for the PodGroup.
+//
+// It adds a name to it that uniquely identifies the ResourceClaim inside the PodGroup.
+// Pods that need access to the ResourceClaim define a matching reference in its
+// own Spec.ResourceClaims. The Pod's claim must match all fields of the
+// PodGroup's claim exactly.
+type PodGroupResourceClaim struct {
+	// name uniquely identifies this resource claim inside the PodGroup.
+	// This must be a DNS_LABEL.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-short-name
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+
+	// resourceClaimName is the name of a ResourceClaim object in the same
+	// namespace as this PodGroup. The ResourceClaim will be reserved for the
+	// PodGroup instead of its individual pods.
+	//
+	// Exactly one of ResourceClaimName and ResourceClaimTemplateName must
+	// be set.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:format=k8s-long-name
+	ResourceClaimName *string `json:"resourceClaimName,omitempty" protobuf:"bytes,2,opt,name=resourceClaimName"`
+
+	// resourceClaimTemplateName is the name of a ResourceClaimTemplate
+	// object in the same namespace as this PodGroup.
+	//
+	// The template will be used to create a new ResourceClaim, which will
+	// be bound to this PodGroup. When this PodGroup is deleted, the ResourceClaim
+	// will also be deleted. The PodGroup name and resource name, along with a
+	// generated component, will be used to form a unique name for the
+	// ResourceClaim, which will be recorded in podgroup.status.resourceClaimStatuses.
+	//
+	// This field is immutable and no changes will be made to the
+	// corresponding ResourceClaim by the control plane after creating the
+	// ResourceClaim.
+	//
+	// Exactly one of ResourceClaimName and ResourceClaimTemplateName must
+	// be set.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:format=k8s-long-name
+	ResourceClaimTemplateName *string `json:"resourceClaimTemplateName,omitempty" protobuf:"bytes,3,opt,name=resourceClaimTemplateName"`
+}
+
+// DisruptionMode defines how individual entities within a group can be disrupted.
+// Exactly one mode can be set.
+//
+// +union
+type DisruptionMode struct {
+	// single specifies that children can be disrupted independently from each other.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	Single *SingleDisruptionMode `json:"single,omitempty" protobuf:"bytes,1,opt,name=single"`
+
+	// all specifies that all children can only be disrupted together.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	All *AllDisruptionMode `json:"all,omitempty" protobuf:"bytes,2,opt,name=all"`
+}
+
+// SingleDisruptionMode specifies that children can be disrupted independently.
+type SingleDisruptionMode struct {
+	// Intentionally empty now.
+}
+
+// AllDisruptionMode specifies that children can only be disrupted together.
+type AllDisruptionMode struct {
+	// Intentionally empty now.
+}
+
+// PreemptionPolicy describes a policy for if/when to preempt a pod.
+// +enum
+// +k8s:enum
+type PreemptionPolicy string
+
+const (
+	// PreemptLowerPriority means that pod can preempt other pods with lower priority.
+	PreemptLowerPriority PreemptionPolicy = "PreemptLowerPriority"
+	// PreemptNever means that pod never preempts other pods with lower priority.
+	PreemptNever PreemptionPolicy = "Never"
+)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+// +k8s:supportsSubresource="/status"
+
+// PodGroup represents a runtime instance of pods grouped together.
+// PodGroups are created by workload controllers (Job, LWS, JobSet, etc...) from
+// Workload.podGroupTemplates.
+// PodGroup API enablement is toggled by the GenericWorkload feature gate.
+type PodGroup struct {
+	metav1.TypeMeta `json:""`
+	// metadata is the standard object metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	//
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// spec defines the desired state of the PodGroup.
+	//
+	// +required
+	Spec PodGroupSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
+
+	// status represents the current observed state of the PodGroup.
+	//
+	// +optional
+	Status PodGroupStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+
+// PodGroupList contains a list of PodGroup resources.
+type PodGroupList struct {
+	metav1.TypeMeta `json:""`
+	// Standard list metadata.
+	//
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// Items is the list of PodGroups.
+	Items []PodGroup `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+// PodGroupSpec defines the desired state of a PodGroup.
+type PodGroupSpec struct {
+	// parentCompositePodGroupName contains the name of the parent composite pod group
+	// within the same namespace as this pod group.
+	// If it's nil, then this pod group is a root of a workload's hierarchy.
+	// This field is used only when the CompositePodGroup feature gate is enabled.
+	// This field is immutable.
+	//
+	// +featureGate=CompositePodGroup
+	// +optional
+	// +k8s:ifDisabled(CompositePodGroup)=+k8s:forbidden
+	// +k8s:ifEnabled(CompositePodGroup)=+k8s:optional
+	// +k8s:immutable
+	// +k8s:format=k8s-long-name
+	// +k8s:alpha(since: "1.37")=+k8s:dependentRequired("workloadRef")
+	ParentCompositePodGroupName *string `json:"parentCompositePodGroupName,omitempty" protobuf:"bytes,1,opt,name=parentCompositePodGroupName"`
+
+	// workloadRef references an optional PodGroup template within the Workload
+	// object that was used to create the PodGroup.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	WorkloadRef *WorkloadReference `json:"workloadRef,omitempty" protobuf:"bytes,2,opt,name=workloadRef"`
+
+	// schedulingPolicy defines the scheduling policy for this instance of the PodGroup.
+	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+	//
+	// +required
+	SchedulingPolicy PodGroupSchedulingPolicy `json:"schedulingPolicy" protobuf:"bytes,3,opt,name=schedulingPolicy"`
+
+	// schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroup.
+	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+	// This field is immutable.
+	// This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
+	//
+	// +featureGate=TopologyAwareWorkloadScheduling
+	// +optional
+	// +k8s:ifDisabled(TopologyAwareWorkloadScheduling)=+k8s:forbidden
+	// +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:optional
+	// +k8s:ifEnabled(TopologyAwareWorkloadScheduling)=+k8s:immutable
+	SchedulingConstraints *PodGroupSchedulingConstraints `json:"schedulingConstraints,omitempty" protobuf:"bytes,4,opt,name=schedulingConstraints"`
+
+	// resourceClaims defines which ResourceClaims may be shared among Pods in
+	// the group. Pods consume the devices allocated to a PodGroup's claim by
+	// defining a claim in its own Spec.ResourceClaims that matches the
+	// PodGroup's claim exactly. The claim must have the same name and refer to
+	// the same ResourceClaim or ResourceClaimTemplate.
+	//
+	// This is a beta-level field and requires that the
+	// DRAWorkloadResourceClaims feature gate is enabled.
+	//
+	// This field is immutable.
+	//
+	// +optional
+	// +patchMergeKey=name
+	// +patchStrategy=merge,retainKeys
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=4
+	// +k8s:immutable
+	// +featureGate=DRAWorkloadResourceClaims
+	ResourceClaims []PodGroupResourceClaim `json:"resourceClaims,omitempty" patchStrategy:"merge,retainKeys" patchMergeKey:"name" protobuf:"bytes,5,rep,name=resourceClaims"`
+
+	// disruptionMode defines the mode in which a given PodGroup can be disrupted.
+	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+	// One of Single, All. Defaults to Single if unset.
+	// This field is immutable.
+	//
+	// +default={"single": {}}
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	DisruptionMode *DisruptionMode `json:"disruptionMode,omitempty" protobuf:"bytes,6,opt,name=disruptionMode"`
+
+	// priorityClassName defines the priority that should be considered when scheduling this pod group.
+	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+	// Otherwise, it is validated and resolved similarly to the PriorityClassName on PodGroupTemplate
+	// (i.e. if no priority class is specified, admission control can set this to the global default
+	// priority class if it exists. Otherwise, the pod group's priority will be zero).
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	// +k8s:format=k8s-long-name
+	PriorityClassName string `json:"priorityClassName,omitempty" protobuf:"bytes,7,opt,name=priorityClassName"`
+
+	// priority is the value of priority of this pod group. Various system components
+	// use this field to find the priority of the pod group. When Priority Admission
+	// Controller is enabled, it prevents users from setting this field. The admission
+	// controller populates this field from PriorityClassName.
+	// The higher the value, the higher the priority.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	// +k8s:maximum=1000000000 # HighestUserDefinablePriority
+	Priority *int32 `json:"priority,omitempty" protobuf:"varint,8,opt,name=priority"`
+
+	// preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+	// One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset.
+	// When Priority Admission Controller is enabled, it populates this field from PriorityClassName,
+	// and defaults to PreemptLowerPriority if value is unset in PriorityClass.
+	// This field is immutable.
+	// This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+	//
+	// +featureGate=PodGroupPreemptionPolicy
+	// +optional
+	// +k8s:immutable
+	// +k8s:ifDisabled("PodGroupPreemptionPolicy")=+k8s:forbidden
+	// +k8s:ifEnabled("PodGroupPreemptionPolicy")=+k8s:optional
+	PreemptionPolicy *PreemptionPolicy `json:"preemptionPolicy,omitempty" protobuf:"bytes,9,opt,name=preemptionPolicy"`
+}
+
+// PodGroupStatus represents information about the status of a pod group.
+type PodGroupStatus struct {
+	// conditions represent the latest observations of the PodGroup's state.
+	//
+	// Known condition types:
+	// - "PodGroupInitiallyScheduled": Indicates whether the scheduling requirement has been satisfied.
+	// Once this condition transitions to True, it serves as a terminal state and will never revert to False,
+	// even if pods are subsequently evicted and group constraints are no longer met.
+	// - "DisruptionTarget": Indicates whether the PodGroup is about to be terminated
+	//   due to disruption such as preemption.
+	//
+	// Known reasons for the PodGroupInitiallyScheduled condition:
+	// - "Unschedulable": The PodGroup cannot be scheduled due to resource constraints,
+	//   affinity/anti-affinity rules, or insufficient capacity for the gang.
+	// - "SchedulerError": The PodGroup cannot be scheduled due to some internal error
+	//   that happened during scheduling, for example due to nodeAffinity parsing errors.
+	//
+	// Known reasons for the DisruptionTarget condition:
+	// - "PreemptionByScheduler": The PodGroup was preempted by the scheduler to make room for
+	//   higher-priority PodGroups or Pods.
+	//
+	// +optional
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
+
+	// resourceClaimStatuses is status of resource claims.
+	// +optional
+	// +patchMergeKey=name
+	// +patchStrategy=merge,retainKeys
+	// +listType=map
+	// +listMapKey=name
+	// +k8s:optional
+	// +k8s:listType=map
+	// +k8s:listMapKey=name
+	// +k8s:maxItems=4
+	// +featureGate=DRAWorkloadResourceClaims
+	ResourceClaimStatuses []PodGroupResourceClaimStatus `json:"resourceClaimStatuses,omitempty" patchStrategy:"merge,retainKeys" patchMergeKey:"name" protobuf:"bytes,2,rep,name=resourceClaimStatuses"`
+}
+
+// Well-known condition types for PodGroups.
+const (
+	// PodGroupInitiallyScheduled represents status of the scheduling process for this PodGroup till first success.
+	PodGroupInitiallyScheduled string = "PodGroupInitiallyScheduled"
+	// DisruptionTarget indicates the PodGroup is about to be terminated due to disruption
+	// such as preemption.
+	DisruptionTarget string = "DisruptionTarget"
+)
+
+// Well-known condition reasons for PodGroups.
+const (
+	// Unschedulable reason in the PodGroupInitiallyScheduled condition indicates that the PodGroup cannot be scheduled
+	// due to resource constraints, affinity/anti-affinity rules, or insufficient capacity for the PodGroup.
+	PodGroupReasonUnschedulable string = "Unschedulable"
+	// SchedulerError reason in the PodGroupInitiallyScheduled condition means that some internal error happens
+	// during scheduling, for example due to nodeAffinity parsing errors.
+	PodGroupReasonSchedulerError string = "SchedulerError"
+	// PreemptionByScheduler reason in the DisruptionTarget condition indicates the PodGroup was preempted
+	// to make room for higher-priority PodGroups or Pods.
+	PodGroupReasonPreemptionByScheduler string = "PreemptionByScheduler"
+)
+
+// PodGroupResourceClaimStatus is stored in the PodGroupStatus for each
+// PodGroupResourceClaim which references a ResourceClaimTemplate. It stores the
+// generated name for the corresponding ResourceClaim.
+type PodGroupResourceClaimStatus struct {
+	// name uniquely identifies this resource claim inside the PodGroup. This
+	// must match the name of an entry in podgroup.spec.resourceClaims, which
+	// implies that the string must be a DNS_LABEL.
+	//
+	// +required
+	Name string `json:"name" protobuf:"bytes,1,name=name"`
+
+	// resourceClaimName is the name of the ResourceClaim that was generated for
+	// the PodGroup in the namespace of the PodGroup. If this is unset, then
+	// generating a ResourceClaim was not necessary. The
+	// podgroup.spec.resourceClaims entry can be ignored in this case.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:format=k8s-long-name
+	ResourceClaimName *string `json:"resourceClaimName,omitempty" protobuf:"bytes,2,opt,name=resourceClaimName"`
+}
+
+// WorkloadReference references the Workload object together with the template
+// that was used to create a particular PodGroup.
+type WorkloadReference struct {
+	// workloadName is the name of the Workload object that contains a template
+	// that was used when creating a pod group. It must
+	// be a DNS name.
+	// This field is required.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-long-name
+	WorkloadName string `json:"workloadName" protobuf:"bytes,1,opt,name=workloadName"`
+
+	// templateName is the name of a template within the Workload object that
+	// was used to create a pod group. It must be a DNS label.
+	// This field is required.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-short-name
+	TemplateName string `json:"templateName" protobuf:"bytes,2,opt,name=templateName"`
+}
+
+// PodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a PodGroup.
+type PodGroupSchedulingConstraints struct {
+	// topology defines the topology constraints for the pod group.
+	// Currently only a single topology constraint can be specified. This may change in the future.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:maxItems=1
+	// +listType=atomic
+	// +k8s:listType=atomic
+	Topology []TopologyConstraint `json:"topology,omitempty" protobuf:"bytes,1,rep,name=topology"`
+}
+
+// TopologyConstraint defines a topology constraint for a PodGroup.
+type TopologyConstraint struct {
+	// key specifies the key of the node label representing the topology domain.
+	// All pods within the PodGroup must be colocated within the same domain instance.
+	// Different PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.
+	// Examples: "topology.kubernetes.io/rack"
+	//
+	// +required
+	// +k8s:required
+	// +k8s:format=k8s-label-key
+	Key string `json:"key" protobuf:"bytes,1,opt,name=key"`
+}
+
+// CompositePodGroupSchedulingPolicy defines the scheduling configuration for a CompositePodGroup.
+// Exactly one policy must be set.
+//
+// +union
+type CompositePodGroupSchedulingPolicy struct {
+	// basic specifies that the groups of this composite group should be scheduled independently.
+	// This field is immutable.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:immutable
+	// +k8s:unionMember
+	Basic *CompositeBasicSchedulingPolicy `json:"basic,omitempty" protobuf:"bytes,1,opt,name=basic"`
+
+	// gang specifies that the groups of this composite group should be scheduled using
+	// all-or-nothing semantics.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	// +k8s:update=NoSet
+	// +k8s:update=NoUnset
+	Gang *CompositeGangSchedulingPolicy `json:"gang,omitempty" protobuf:"bytes,2,opt,name=gang"`
+}
+
+// CompositeBasicSchedulingPolicy indicates that the groups belonging to the composite group
+// should be scheduled independently.
+type CompositeBasicSchedulingPolicy struct {
+	// This is intentionally empty. Its presence indicates that the basic group
+	// scheduling policy should be applied. In the future, new fields may appear,
+	// describing such constraints on a composite pod group level without "all or
+	// nothing" (gang) scheduling.
+}
+
+// CompositeGangSchedulingPolicy indicates that the groups belonging to the composite group
+// should be scheduled using all-or-nothing semantics.
+type CompositeGangSchedulingPolicy struct {
+	// minGroupCount is the minimum number of child groups that must be schedulable
+	// or scheduled at the same time for the scheduler to admit the entire group.
+	// It must be a positive integer.
+	//
+	// +required
+	// +k8s:required
+	// +k8s:minimum=1
+	MinGroupCount int32 `json:"minGroupCount" protobuf:"varint,1,req,name=minGroupCount"`
+}
+
+// CompositeDisruptionMode defines how individual entities within a composite pod group can be disrupted.
+// Exactly one mode must be set.
+//
+// +union
+type CompositeDisruptionMode struct {
+	// single specifies that children groups can be disrupted independently from each other.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	Single *SingleCompositeDisruptionMode `json:"single,omitempty" protobuf:"bytes,1,opt,name=single"`
+
+	// all specifies that all children groups can only be disrupted together.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:unionMember
+	All *AllCompositeDisruptionMode `json:"all,omitempty" protobuf:"bytes,2,opt,name=all"`
+}
+
+// SingleCompositeDisruptionMode means that individual children of a CompositePodGroup
+// can be disrupted or preempted independently.
+type SingleCompositeDisruptionMode struct {
+	// This is intentionally empty.
+}
+
+// AllCompositeDisruptionMode means that children of a CompositePodGroup can only be
+// disrupted or preempted together.
+type AllCompositeDisruptionMode struct {
+	// This is intentionally empty.
+}
+
+// CompositePodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a CompositePodGroup.
+type CompositePodGroupSchedulingConstraints struct {
+	// topology defines the topology constraints for the composite pod group.
+	// Currently only a single topology constraint can be specified. This may change in the future.
+	//
+	// +optional
+	// +k8s:optional
+	// +k8s:maxItems=1
+	// +listType=atomic
+	// +k8s:listType=atomic
+	Topology []TopologyConstraint `json:"topology,omitempty" protobuf:"bytes,1,rep,name=topology"`
+}
diff --git a/vendor/k8s.io/api/scheduling/v1beta1/types_swagger_doc_generated.go b/vendor/k8s.io/api/scheduling/v1beta1/types_swagger_doc_generated.go
index f42008eb91..e514c6950a 100644
--- a/vendor/k8s.io/api/scheduling/v1beta1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/scheduling/v1beta1/types_swagger_doc_generated.go
@@ -27,9 +27,219 @@ package v1beta1
 // Those methods can be generated by using hack/update-codegen.sh
 
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
+var map_AllCompositeDisruptionMode = map[string]string{
+	"": "AllCompositeDisruptionMode means that children of a CompositePodGroup can only be disrupted or preempted together.",
+}
+
+func (AllCompositeDisruptionMode) SwaggerDoc() map[string]string {
+	return map_AllCompositeDisruptionMode
+}
+
+var map_AllDisruptionMode = map[string]string{
+	"": "AllDisruptionMode specifies that children can only be disrupted together.",
+}
+
+func (AllDisruptionMode) SwaggerDoc() map[string]string {
+	return map_AllDisruptionMode
+}
+
+var map_BasicSchedulingPolicy = map[string]string{
+	"": "BasicSchedulingPolicy indicates that standard Kubernetes scheduling behavior should be used.",
+}
+
+func (BasicSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_BasicSchedulingPolicy
+}
+
+var map_CompositeBasicSchedulingPolicy = map[string]string{
+	"": "CompositeBasicSchedulingPolicy indicates that the groups belonging to the composite group should be scheduled independently.",
+}
+
+func (CompositeBasicSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_CompositeBasicSchedulingPolicy
+}
+
+var map_CompositeDisruptionMode = map[string]string{
+	"":       "CompositeDisruptionMode defines how individual entities within a composite pod group can be disrupted. Exactly one mode must be set.",
+	"single": "single specifies that children groups can be disrupted independently from each other.",
+	"all":    "all specifies that all children groups can only be disrupted together.",
+}
+
+func (CompositeDisruptionMode) SwaggerDoc() map[string]string {
+	return map_CompositeDisruptionMode
+}
+
+var map_CompositeGangSchedulingPolicy = map[string]string{
+	"":              "CompositeGangSchedulingPolicy indicates that the groups belonging to the composite group should be scheduled using all-or-nothing semantics.",
+	"minGroupCount": "minGroupCount is the minimum number of child groups that must be schedulable or scheduled at the same time for the scheduler to admit the entire group. It must be a positive integer.",
+}
+
+func (CompositeGangSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_CompositeGangSchedulingPolicy
+}
+
+var map_CompositePodGroupSchedulingConstraints = map[string]string{
+	"":         "CompositePodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a CompositePodGroup.",
+	"topology": "topology defines the topology constraints for the composite pod group. Currently only a single topology constraint can be specified. This may change in the future.",
+}
+
+func (CompositePodGroupSchedulingConstraints) SwaggerDoc() map[string]string {
+	return map_CompositePodGroupSchedulingConstraints
+}
+
+var map_CompositePodGroupSchedulingPolicy = map[string]string{
+	"":      "CompositePodGroupSchedulingPolicy defines the scheduling configuration for a CompositePodGroup. Exactly one policy must be set.",
+	"basic": "basic specifies that the groups of this composite group should be scheduled independently. This field is immutable.",
+	"gang":  "gang specifies that the groups of this composite group should be scheduled using all-or-nothing semantics.",
+}
+
+func (CompositePodGroupSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_CompositePodGroupSchedulingPolicy
+}
+
+var map_CompositePodGroupTemplate = map[string]string{
+	"":                           "CompositePodGroupTemplate represents a template for a CompositePodGroup with a scheduling policy.",
+	"name":                       "name is a unique identifier for the CompositePodGroupTemplate within the Workload. It must be a DNS label. This field is required.",
+	"schedulingPolicy":           "schedulingPolicy defines the scheduling policy for this template.",
+	"schedulingConstraints":      "schedulingConstraints defines optional scheduling constraints (e.g. topology) for this CompositePodGroupTemplate. This field is immutable.",
+	"disruptionMode":             "disruptionMode defines the mode in which a given CompositePodGroup can be disrupted. One of Single, All. This field is immutable.",
+	"priorityClassName":          "priorityClassName indicates the priority that should be considered when scheduling a composite pod group created from this template. If no priority class is specified, admission control can set this to the global default priority class if it exists. Otherwise, composite pod groups created from this template will have the priority set to zero. This field is immutable.",
+	"priority":                   "priority is the value of priority of composite pod groups created from this template. Various system components use this field to find the priority of the composite pod group. When Priority Admission Controller is enabled, it prevents users from setting this field. The admission controller populates this field from PriorityClassName. The higher the value, the higher the priority. This field is immutable.",
+	"preemptionPolicy":           "preemptionPolicy is the Policy for preempting pods/podgroups with lower priority. One of Never, PreemptLowerPriority. This field is immutable. This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.",
+	"podGroupTemplates":          "podGroupTemplates is the list of templates for children PodGroups. The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates or PodGroupTemplates must be set.",
+	"compositePodGroupTemplates": "compositePodGroupTemplates is the list of templates for children CompositePodGroups. The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates or PodGroupTemplates must be set.",
+}
+
+func (CompositePodGroupTemplate) SwaggerDoc() map[string]string {
+	return map_CompositePodGroupTemplate
+}
+
+var map_DisruptionMode = map[string]string{
+	"":       "DisruptionMode defines how individual entities within a group can be disrupted. Exactly one mode can be set.",
+	"single": "single specifies that children can be disrupted independently from each other.",
+	"all":    "all specifies that all children can only be disrupted together.",
+}
+
+func (DisruptionMode) SwaggerDoc() map[string]string {
+	return map_DisruptionMode
+}
+
+var map_GangSchedulingPolicy = map[string]string{
+	"":         "GangSchedulingPolicy defines the parameters for gang scheduling.",
+	"minCount": "minCount is the minimum number of pods that must be schedulable or scheduled at the same time for the scheduler to admit the entire group. It must be a positive integer. This field is mutable to support workload scaling.\n\nNote that the scheduler operates on an eventually consistent model. Updates to minCount may not be immediately reflected in scheduling decisions due to propagation delays. If minCount is updated while a scheduling cycle is in progress for that group, the new value may not take effect until the next cycle. Moreover, minCount is only enforced during scheduling, meaning that modifications to this field do not affect already-scheduled pods, applying only to those evaluated in future cycles.",
+}
+
+func (GangSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_GangSchedulingPolicy
+}
+
+var map_PodGroup = map[string]string{
+	"":         "PodGroup represents a runtime instance of pods grouped together. PodGroups are created by workload controllers (Job, LWS, JobSet, etc...) from Workload.podGroupTemplates. PodGroup API enablement is toggled by the GenericWorkload feature gate.",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"spec":     "spec defines the desired state of the PodGroup.",
+	"status":   "status represents the current observed state of the PodGroup.",
+}
+
+func (PodGroup) SwaggerDoc() map[string]string {
+	return map_PodGroup
+}
+
+var map_PodGroupList = map[string]string{
+	"":         "PodGroupList contains a list of PodGroup resources.",
+	"metadata": "Standard list metadata.",
+	"items":    "Items is the list of PodGroups.",
+}
+
+func (PodGroupList) SwaggerDoc() map[string]string {
+	return map_PodGroupList
+}
+
+var map_PodGroupResourceClaim = map[string]string{
+	"":                          "PodGroupResourceClaim references exactly one ResourceClaim, either directly or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim for the PodGroup.\n\nIt adds a name to it that uniquely identifies the ResourceClaim inside the PodGroup. Pods that need access to the ResourceClaim define a matching reference in its own Spec.ResourceClaims. The Pod's claim must match all fields of the PodGroup's claim exactly.",
+	"name":                      "name uniquely identifies this resource claim inside the PodGroup. This must be a DNS_LABEL.",
+	"resourceClaimName":         "resourceClaimName is the name of a ResourceClaim object in the same namespace as this PodGroup. The ResourceClaim will be reserved for the PodGroup instead of its individual pods.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must be set.",
+	"resourceClaimTemplateName": "resourceClaimTemplateName is the name of a ResourceClaimTemplate object in the same namespace as this PodGroup.\n\nThe template will be used to create a new ResourceClaim, which will be bound to this PodGroup. When this PodGroup is deleted, the ResourceClaim will also be deleted. The PodGroup name and resource name, along with a generated component, will be used to form a unique name for the ResourceClaim, which will be recorded in podgroup.status.resourceClaimStatuses.\n\nThis field is immutable and no changes will be made to the corresponding ResourceClaim by the control plane after creating the ResourceClaim.\n\nExactly one of ResourceClaimName and ResourceClaimTemplateName must be set.",
+}
+
+func (PodGroupResourceClaim) SwaggerDoc() map[string]string {
+	return map_PodGroupResourceClaim
+}
+
+var map_PodGroupResourceClaimStatus = map[string]string{
+	"":                  "PodGroupResourceClaimStatus is stored in the PodGroupStatus for each PodGroupResourceClaim which references a ResourceClaimTemplate. It stores the generated name for the corresponding ResourceClaim.",
+	"name":              "name uniquely identifies this resource claim inside the PodGroup. This must match the name of an entry in podgroup.spec.resourceClaims, which implies that the string must be a DNS_LABEL.",
+	"resourceClaimName": "resourceClaimName is the name of the ResourceClaim that was generated for the PodGroup in the namespace of the PodGroup. If this is unset, then generating a ResourceClaim was not necessary. The podgroup.spec.resourceClaims entry can be ignored in this case.",
+}
+
+func (PodGroupResourceClaimStatus) SwaggerDoc() map[string]string {
+	return map_PodGroupResourceClaimStatus
+}
+
+var map_PodGroupSchedulingConstraints = map[string]string{
+	"":         "PodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a PodGroup.",
+	"topology": "topology defines the topology constraints for the pod group. Currently only a single topology constraint can be specified. This may change in the future.",
+}
+
+func (PodGroupSchedulingConstraints) SwaggerDoc() map[string]string {
+	return map_PodGroupSchedulingConstraints
+}
+
+var map_PodGroupSchedulingPolicy = map[string]string{
+	"":      "PodGroupSchedulingPolicy defines the scheduling configuration for a PodGroup. Exactly one policy must be set. The policy is chosen at creation time by setting either the Basic or Gang field. The PodGroup may not change policy after creation. Fields within chosen policy may be updated after creation when their individual fields allow it.",
+	"basic": "basic specifies that the pods in this group should be scheduled using standard Kubernetes scheduling behavior. Setting this field at group creation time opts this group to basic scheduling; this field cannot be changed afterward.",
+	"gang":  "gang specifies that the pods in this group should be scheduled using all-or-nothing semantics. Setting this field at group creation time opts this group to gang scheduling; this field cannot be set or unset afterward. The minCount field within Gang scheduling policy remains mutable after group creation.",
+}
+
+func (PodGroupSchedulingPolicy) SwaggerDoc() map[string]string {
+	return map_PodGroupSchedulingPolicy
+}
+
+var map_PodGroupSpec = map[string]string{
+	"":                            "PodGroupSpec defines the desired state of a PodGroup.",
+	"parentCompositePodGroupName": "parentCompositePodGroupName contains the name of the parent composite pod group within the same namespace as this pod group. If it's nil, then this pod group is a root of a workload's hierarchy. This field is used only when the CompositePodGroup feature gate is enabled. This field is immutable.",
+	"workloadRef":                 "workloadRef references an optional PodGroup template within the Workload object that was used to create the PodGroup. This field is immutable.",
+	"schedulingPolicy":            "schedulingPolicy defines the scheduling policy for this instance of the PodGroup. Controllers are expected to fill this field by copying it from a PodGroupTemplate.",
+	"schedulingConstraints":       "schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroup. Controllers are expected to fill this field by copying it from a PodGroupTemplate. This field is immutable. This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.",
+	"resourceClaims":              "resourceClaims defines which ResourceClaims may be shared among Pods in the group. Pods consume the devices allocated to a PodGroup's claim by defining a claim in its own Spec.ResourceClaims that matches the PodGroup's claim exactly. The claim must have the same name and refer to the same ResourceClaim or ResourceClaimTemplate.\n\nThis is a beta-level field and requires that the DRAWorkloadResourceClaims feature gate is enabled.\n\nThis field is immutable.",
+	"disruptionMode":              "disruptionMode defines the mode in which a given PodGroup can be disrupted. Controllers are expected to fill this field by copying it from a PodGroupTemplate. One of Single, All. Defaults to Single if unset. This field is immutable.",
+	"priorityClassName":           "priorityClassName defines the priority that should be considered when scheduling this pod group. Controllers are expected to fill this field by copying it from a PodGroupTemplate. Otherwise, it is validated and resolved similarly to the PriorityClassName on PodGroupTemplate (i.e. if no priority class is specified, admission control can set this to the global default priority class if it exists. Otherwise, the pod group's priority will be zero). This field is immutable.",
+	"priority":                    "priority is the value of priority of this pod group. Various system components use this field to find the priority of the pod group. When Priority Admission Controller is enabled, it prevents users from setting this field. The admission controller populates this field from PriorityClassName. The higher the value, the higher the priority. This field is immutable.",
+	"preemptionPolicy":            "preemptionPolicy is the Policy for preempting pods/podgroups with lower priority. One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset. When Priority Admission Controller is enabled, it populates this field from PriorityClassName, and defaults to PreemptLowerPriority if value is unset in PriorityClass. This field is immutable. This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.",
+}
+
+func (PodGroupSpec) SwaggerDoc() map[string]string {
+	return map_PodGroupSpec
+}
+
+var map_PodGroupStatus = map[string]string{
+	"":                      "PodGroupStatus represents information about the status of a pod group.",
+	"conditions":            "conditions represent the latest observations of the PodGroup's state.\n\nKnown condition types: - \"PodGroupInitiallyScheduled\": Indicates whether the scheduling requirement has been satisfied. Once this condition transitions to True, it serves as a terminal state and will never revert to False, even if pods are subsequently evicted and group constraints are no longer met. - \"DisruptionTarget\": Indicates whether the PodGroup is about to be terminated\n  due to disruption such as preemption.\n\nKnown reasons for the PodGroupInitiallyScheduled condition: - \"Unschedulable\": The PodGroup cannot be scheduled due to resource constraints,\n  affinity/anti-affinity rules, or insufficient capacity for the gang.\n- \"SchedulerError\": The PodGroup cannot be scheduled due to some internal error\n  that happened during scheduling, for example due to nodeAffinity parsing errors.\n\nKnown reasons for the DisruptionTarget condition: - \"PreemptionByScheduler\": The PodGroup was preempted by the scheduler to make room for\n  higher-priority PodGroups or Pods.",
+	"resourceClaimStatuses": "resourceClaimStatuses is status of resource claims.",
+}
+
+func (PodGroupStatus) SwaggerDoc() map[string]string {
+	return map_PodGroupStatus
+}
+
+var map_PodGroupTemplate = map[string]string{
+	"":                      "PodGroupTemplate represents a template for a set of pods with a scheduling policy.",
+	"name":                  "name is a unique identifier for the PodGroupTemplate within the Workload. It must be a DNS label. This field is immutable.",
+	"schedulingPolicy":      "schedulingPolicy defines the scheduling policy for this PodGroupTemplate.",
+	"schedulingConstraints": "schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroupTemplate. This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled. This field is immutable.",
+	"resourceClaims":        "resourceClaims defines which ResourceClaims may be shared among Pods in the group. Pods consume the devices allocated to a PodGroup's claim by defining a claim in its own Spec.ResourceClaims that matches the PodGroup's claim exactly. The claim must have the same name and refer to the same ResourceClaim or ResourceClaimTemplate.\n\nThis is a beta-level field and requires that the DRAWorkloadResourceClaims feature gate is enabled.\n\nThis field is immutable.",
+	"disruptionMode":        "disruptionMode defines the mode in which a given PodGroup can be disrupted. One of Single, All. This field is immutable.",
+	"priorityClassName":     "priorityClassName indicates the priority that should be considered when scheduling a pod group created from this template. This field is immutable.",
+	"priority":              "priority is the value of priority of pod groups created from this template. Various system components use this field to find the priority of the pod group. The higher the value, the higher the priority. This field is immutable.",
+	"preemptionPolicy":      "preemptionPolicy is the Policy for preempting pods/podgroups with lower priority. One of Never, PreemptLowerPriority. This field is immutable. This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.",
+}
+
+func (PodGroupTemplate) SwaggerDoc() map[string]string {
+	return map_PodGroupTemplate
+}
+
 var map_PriorityClass = map[string]string{
 	"":                 "DEPRECATED - This group version of PriorityClass is deprecated by scheduling.k8s.io/v1/PriorityClass. PriorityClass defines mapping from a priority class name to the priority integer value. The value can be any valid integer.",
-	"metadata":         "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata":         "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"value":            "value represents the integer value of this priority class. This is the actual priority that pods receive when they have the name of this class in their pod spec.",
 	"globalDefault":    "globalDefault specifies whether this PriorityClass should be considered as the default priority for pods that do not have any priority class. Only one PriorityClass can be marked as `globalDefault`. However, if more than one PriorityClasses exists with their `globalDefault` field set to true, the smallest value of such global default PriorityClasses will be used as the default priority.",
 	"description":      "description is an arbitrary string that usually provides guidelines on when this priority class should be used.",
@@ -50,4 +260,81 @@ func (PriorityClassList) SwaggerDoc() map[string]string {
 	return map_PriorityClassList
 }
 
+var map_SingleCompositeDisruptionMode = map[string]string{
+	"": "SingleCompositeDisruptionMode means that individual children of a CompositePodGroup can be disrupted or preempted independently.",
+}
+
+func (SingleCompositeDisruptionMode) SwaggerDoc() map[string]string {
+	return map_SingleCompositeDisruptionMode
+}
+
+var map_SingleDisruptionMode = map[string]string{
+	"": "SingleDisruptionMode specifies that children can be disrupted independently.",
+}
+
+func (SingleDisruptionMode) SwaggerDoc() map[string]string {
+	return map_SingleDisruptionMode
+}
+
+var map_TopologyConstraint = map[string]string{
+	"":    "TopologyConstraint defines a topology constraint for a PodGroup.",
+	"key": "key specifies the key of the node label representing the topology domain. All pods within the PodGroup must be colocated within the same domain instance. Different PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate. Examples: \"topology.kubernetes.io/rack\"",
+}
+
+func (TopologyConstraint) SwaggerDoc() map[string]string {
+	return map_TopologyConstraint
+}
+
+var map_TypedLocalObjectReference = map[string]string{
+	"":         "TypedLocalObjectReference allows to reference typed object inside the same namespace.",
+	"apiGroup": "apiGroup is the group for the resource being referenced. If apiGroup is empty, the specified Kind must be in the core API group. For any other third-party types, setting apiGroup is required. It must be a DNS subdomain.",
+	"kind":     "kind is the type of resource being referenced. It must be a path segment name.",
+	"name":     "name is the name of resource being referenced. It must be a path segment name.",
+}
+
+func (TypedLocalObjectReference) SwaggerDoc() map[string]string {
+	return map_TypedLocalObjectReference
+}
+
+var map_Workload = map[string]string{
+	"":         "Workload allows for expressing scheduling constraints that should be used when managing the lifecycle of workloads from the scheduling perspective, including scheduling, preemption, eviction and other phases. Workload API enablement is toggled by the GenericWorkload feature gate.",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"spec":     "spec defines the desired behavior of a Workload.",
+}
+
+func (Workload) SwaggerDoc() map[string]string {
+	return map_Workload
+}
+
+var map_WorkloadList = map[string]string{
+	"":         "WorkloadList contains a list of Workload resources.",
+	"metadata": "metadata is the standard list metadata.",
+	"items":    "items is the list of Workloads.",
+}
+
+func (WorkloadList) SwaggerDoc() map[string]string {
+	return map_WorkloadList
+}
+
+var map_WorkloadReference = map[string]string{
+	"":             "WorkloadReference references the Workload object together with the template that was used to create a particular PodGroup.",
+	"workloadName": "workloadName is the name of the Workload object that contains a template that was used when creating a pod group. It must be a DNS name. This field is required.",
+	"templateName": "templateName is the name of a template within the Workload object that was used to create a pod group. It must be a DNS label. This field is required.",
+}
+
+func (WorkloadReference) SwaggerDoc() map[string]string {
+	return map_WorkloadReference
+}
+
+var map_WorkloadSpec = map[string]string{
+	"":                           "WorkloadSpec defines the desired state of a Workload.",
+	"controllerRef":              "controllerRef is an optional reference to the controlling object, such as a Deployment or Job. This field is intended for use by tools like CLIs to provide a link back to the original workload definition. This field is immutable.",
+	"podGroupTemplates":          "podGroupTemplates is the list of templates that make up the Workload. The maximum number of templates is 8. Templates cannot be added or removed after the workload is created. Existing templates may still be updated where their individual fields allow it. Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.",
+	"compositePodGroupTemplates": "compositePodGroupTemplates is the list of CompositePodGroup templates that make up the Workload. The maximum number of templates is 8. This field is immutable. Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.\n\nThis field is used only when the CompositePodGroup feature gate is enabled.",
+}
+
+func (WorkloadSpec) SwaggerDoc() map[string]string {
+	return map_WorkloadSpec
+}
+
 // AUTO-GENERATED FUNCTIONS END HERE
diff --git a/vendor/k8s.io/api/scheduling/v1beta1/zz_generated.deepcopy.go b/vendor/k8s.io/api/scheduling/v1beta1/zz_generated.deepcopy.go
index ff38c9854f..aacc643ad0 100644
--- a/vendor/k8s.io/api/scheduling/v1beta1/zz_generated.deepcopy.go
+++ b/vendor/k8s.io/api/scheduling/v1beta1/zz_generated.deepcopy.go
@@ -22,10 +22,540 @@ limitations under the License.
 package v1beta1
 
 import (
-	v1 "k8s.io/api/core/v1"
+	corev1 "k8s.io/api/core/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AllCompositeDisruptionMode) DeepCopyInto(out *AllCompositeDisruptionMode) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AllCompositeDisruptionMode.
+func (in *AllCompositeDisruptionMode) DeepCopy() *AllCompositeDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(AllCompositeDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AllDisruptionMode) DeepCopyInto(out *AllDisruptionMode) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AllDisruptionMode.
+func (in *AllDisruptionMode) DeepCopy() *AllDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(AllDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BasicSchedulingPolicy) DeepCopyInto(out *BasicSchedulingPolicy) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BasicSchedulingPolicy.
+func (in *BasicSchedulingPolicy) DeepCopy() *BasicSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(BasicSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositeBasicSchedulingPolicy) DeepCopyInto(out *CompositeBasicSchedulingPolicy) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositeBasicSchedulingPolicy.
+func (in *CompositeBasicSchedulingPolicy) DeepCopy() *CompositeBasicSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositeBasicSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositeDisruptionMode) DeepCopyInto(out *CompositeDisruptionMode) {
+	*out = *in
+	if in.Single != nil {
+		in, out := &in.Single, &out.Single
+		*out = new(SingleCompositeDisruptionMode)
+		**out = **in
+	}
+	if in.All != nil {
+		in, out := &in.All, &out.All
+		*out = new(AllCompositeDisruptionMode)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositeDisruptionMode.
+func (in *CompositeDisruptionMode) DeepCopy() *CompositeDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositeDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositeGangSchedulingPolicy) DeepCopyInto(out *CompositeGangSchedulingPolicy) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositeGangSchedulingPolicy.
+func (in *CompositeGangSchedulingPolicy) DeepCopy() *CompositeGangSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositeGangSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositePodGroupSchedulingConstraints) DeepCopyInto(out *CompositePodGroupSchedulingConstraints) {
+	*out = *in
+	if in.Topology != nil {
+		in, out := &in.Topology, &out.Topology
+		*out = make([]TopologyConstraint, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositePodGroupSchedulingConstraints.
+func (in *CompositePodGroupSchedulingConstraints) DeepCopy() *CompositePodGroupSchedulingConstraints {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositePodGroupSchedulingConstraints)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositePodGroupSchedulingPolicy) DeepCopyInto(out *CompositePodGroupSchedulingPolicy) {
+	*out = *in
+	if in.Basic != nil {
+		in, out := &in.Basic, &out.Basic
+		*out = new(CompositeBasicSchedulingPolicy)
+		**out = **in
+	}
+	if in.Gang != nil {
+		in, out := &in.Gang, &out.Gang
+		*out = new(CompositeGangSchedulingPolicy)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositePodGroupSchedulingPolicy.
+func (in *CompositePodGroupSchedulingPolicy) DeepCopy() *CompositePodGroupSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositePodGroupSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CompositePodGroupTemplate) DeepCopyInto(out *CompositePodGroupTemplate) {
+	*out = *in
+	in.SchedulingPolicy.DeepCopyInto(&out.SchedulingPolicy)
+	if in.SchedulingConstraints != nil {
+		in, out := &in.SchedulingConstraints, &out.SchedulingConstraints
+		*out = new(CompositePodGroupSchedulingConstraints)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.DisruptionMode != nil {
+		in, out := &in.DisruptionMode, &out.DisruptionMode
+		*out = new(CompositeDisruptionMode)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Priority != nil {
+		in, out := &in.Priority, &out.Priority
+		*out = new(int32)
+		**out = **in
+	}
+	if in.PreemptionPolicy != nil {
+		in, out := &in.PreemptionPolicy, &out.PreemptionPolicy
+		*out = new(PreemptionPolicy)
+		**out = **in
+	}
+	if in.PodGroupTemplates != nil {
+		in, out := &in.PodGroupTemplates, &out.PodGroupTemplates
+		*out = make([]PodGroupTemplate, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.CompositePodGroupTemplates != nil {
+		in, out := &in.CompositePodGroupTemplates, &out.CompositePodGroupTemplates
+		*out = make([]CompositePodGroupTemplate, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompositePodGroupTemplate.
+func (in *CompositePodGroupTemplate) DeepCopy() *CompositePodGroupTemplate {
+	if in == nil {
+		return nil
+	}
+	out := new(CompositePodGroupTemplate)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DisruptionMode) DeepCopyInto(out *DisruptionMode) {
+	*out = *in
+	if in.Single != nil {
+		in, out := &in.Single, &out.Single
+		*out = new(SingleDisruptionMode)
+		**out = **in
+	}
+	if in.All != nil {
+		in, out := &in.All, &out.All
+		*out = new(AllDisruptionMode)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DisruptionMode.
+func (in *DisruptionMode) DeepCopy() *DisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(DisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GangSchedulingPolicy) DeepCopyInto(out *GangSchedulingPolicy) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GangSchedulingPolicy.
+func (in *GangSchedulingPolicy) DeepCopy() *GangSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(GangSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroup) DeepCopyInto(out *PodGroup) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroup.
+func (in *PodGroup) DeepCopy() *PodGroup {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroup)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PodGroup) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupList) DeepCopyInto(out *PodGroupList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]PodGroup, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupList.
+func (in *PodGroupList) DeepCopy() *PodGroupList {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PodGroupList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupResourceClaim) DeepCopyInto(out *PodGroupResourceClaim) {
+	*out = *in
+	if in.ResourceClaimName != nil {
+		in, out := &in.ResourceClaimName, &out.ResourceClaimName
+		*out = new(string)
+		**out = **in
+	}
+	if in.ResourceClaimTemplateName != nil {
+		in, out := &in.ResourceClaimTemplateName, &out.ResourceClaimTemplateName
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupResourceClaim.
+func (in *PodGroupResourceClaim) DeepCopy() *PodGroupResourceClaim {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupResourceClaim)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupResourceClaimStatus) DeepCopyInto(out *PodGroupResourceClaimStatus) {
+	*out = *in
+	if in.ResourceClaimName != nil {
+		in, out := &in.ResourceClaimName, &out.ResourceClaimName
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupResourceClaimStatus.
+func (in *PodGroupResourceClaimStatus) DeepCopy() *PodGroupResourceClaimStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupResourceClaimStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupSchedulingConstraints) DeepCopyInto(out *PodGroupSchedulingConstraints) {
+	*out = *in
+	if in.Topology != nil {
+		in, out := &in.Topology, &out.Topology
+		*out = make([]TopologyConstraint, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupSchedulingConstraints.
+func (in *PodGroupSchedulingConstraints) DeepCopy() *PodGroupSchedulingConstraints {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupSchedulingConstraints)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupSchedulingPolicy) DeepCopyInto(out *PodGroupSchedulingPolicy) {
+	*out = *in
+	if in.Basic != nil {
+		in, out := &in.Basic, &out.Basic
+		*out = new(BasicSchedulingPolicy)
+		**out = **in
+	}
+	if in.Gang != nil {
+		in, out := &in.Gang, &out.Gang
+		*out = new(GangSchedulingPolicy)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupSchedulingPolicy.
+func (in *PodGroupSchedulingPolicy) DeepCopy() *PodGroupSchedulingPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupSchedulingPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupSpec) DeepCopyInto(out *PodGroupSpec) {
+	*out = *in
+	if in.ParentCompositePodGroupName != nil {
+		in, out := &in.ParentCompositePodGroupName, &out.ParentCompositePodGroupName
+		*out = new(string)
+		**out = **in
+	}
+	if in.WorkloadRef != nil {
+		in, out := &in.WorkloadRef, &out.WorkloadRef
+		*out = new(WorkloadReference)
+		**out = **in
+	}
+	in.SchedulingPolicy.DeepCopyInto(&out.SchedulingPolicy)
+	if in.SchedulingConstraints != nil {
+		in, out := &in.SchedulingConstraints, &out.SchedulingConstraints
+		*out = new(PodGroupSchedulingConstraints)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ResourceClaims != nil {
+		in, out := &in.ResourceClaims, &out.ResourceClaims
+		*out = make([]PodGroupResourceClaim, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.DisruptionMode != nil {
+		in, out := &in.DisruptionMode, &out.DisruptionMode
+		*out = new(DisruptionMode)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Priority != nil {
+		in, out := &in.Priority, &out.Priority
+		*out = new(int32)
+		**out = **in
+	}
+	if in.PreemptionPolicy != nil {
+		in, out := &in.PreemptionPolicy, &out.PreemptionPolicy
+		*out = new(PreemptionPolicy)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupSpec.
+func (in *PodGroupSpec) DeepCopy() *PodGroupSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupStatus) DeepCopyInto(out *PodGroupStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.ResourceClaimStatuses != nil {
+		in, out := &in.ResourceClaimStatuses, &out.ResourceClaimStatuses
+		*out = make([]PodGroupResourceClaimStatus, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupStatus.
+func (in *PodGroupStatus) DeepCopy() *PodGroupStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PodGroupTemplate) DeepCopyInto(out *PodGroupTemplate) {
+	*out = *in
+	in.SchedulingPolicy.DeepCopyInto(&out.SchedulingPolicy)
+	if in.SchedulingConstraints != nil {
+		in, out := &in.SchedulingConstraints, &out.SchedulingConstraints
+		*out = new(PodGroupSchedulingConstraints)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ResourceClaims != nil {
+		in, out := &in.ResourceClaims, &out.ResourceClaims
+		*out = make([]PodGroupResourceClaim, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.DisruptionMode != nil {
+		in, out := &in.DisruptionMode, &out.DisruptionMode
+		*out = new(DisruptionMode)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Priority != nil {
+		in, out := &in.Priority, &out.Priority
+		*out = new(int32)
+		**out = **in
+	}
+	if in.PreemptionPolicy != nil {
+		in, out := &in.PreemptionPolicy, &out.PreemptionPolicy
+		*out = new(PreemptionPolicy)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PodGroupTemplate.
+func (in *PodGroupTemplate) DeepCopy() *PodGroupTemplate {
+	if in == nil {
+		return nil
+	}
+	out := new(PodGroupTemplate)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *PriorityClass) DeepCopyInto(out *PriorityClass) {
 	*out = *in
@@ -33,7 +563,7 @@ func (in *PriorityClass) DeepCopyInto(out *PriorityClass) {
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
 	if in.PreemptionPolicy != nil {
 		in, out := &in.PreemptionPolicy, &out.PreemptionPolicy
-		*out = new(v1.PreemptionPolicy)
+		*out = new(corev1.PreemptionPolicy)
 		**out = **in
 	}
 	return
@@ -89,3 +619,178 @@ func (in *PriorityClassList) DeepCopyObject() runtime.Object {
 	}
 	return nil
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SingleCompositeDisruptionMode) DeepCopyInto(out *SingleCompositeDisruptionMode) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SingleCompositeDisruptionMode.
+func (in *SingleCompositeDisruptionMode) DeepCopy() *SingleCompositeDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(SingleCompositeDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SingleDisruptionMode) DeepCopyInto(out *SingleDisruptionMode) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SingleDisruptionMode.
+func (in *SingleDisruptionMode) DeepCopy() *SingleDisruptionMode {
+	if in == nil {
+		return nil
+	}
+	out := new(SingleDisruptionMode)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TopologyConstraint) DeepCopyInto(out *TopologyConstraint) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TopologyConstraint.
+func (in *TopologyConstraint) DeepCopy() *TopologyConstraint {
+	if in == nil {
+		return nil
+	}
+	out := new(TopologyConstraint)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TypedLocalObjectReference) DeepCopyInto(out *TypedLocalObjectReference) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TypedLocalObjectReference.
+func (in *TypedLocalObjectReference) DeepCopy() *TypedLocalObjectReference {
+	if in == nil {
+		return nil
+	}
+	out := new(TypedLocalObjectReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Workload) DeepCopyInto(out *Workload) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Workload.
+func (in *Workload) DeepCopy() *Workload {
+	if in == nil {
+		return nil
+	}
+	out := new(Workload)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Workload) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadList) DeepCopyInto(out *WorkloadList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Workload, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadList.
+func (in *WorkloadList) DeepCopy() *WorkloadList {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *WorkloadList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadReference) DeepCopyInto(out *WorkloadReference) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadReference.
+func (in *WorkloadReference) DeepCopy() *WorkloadReference {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadSpec) DeepCopyInto(out *WorkloadSpec) {
+	*out = *in
+	if in.ControllerRef != nil {
+		in, out := &in.ControllerRef, &out.ControllerRef
+		*out = new(TypedLocalObjectReference)
+		**out = **in
+	}
+	if in.PodGroupTemplates != nil {
+		in, out := &in.PodGroupTemplates, &out.PodGroupTemplates
+		*out = make([]PodGroupTemplate, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.CompositePodGroupTemplates != nil {
+		in, out := &in.CompositePodGroupTemplates, &out.CompositePodGroupTemplates
+		*out = make([]CompositePodGroupTemplate, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadSpec.
+func (in *WorkloadSpec) DeepCopy() *WorkloadSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadSpec)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/vendor/k8s.io/api/scheduling/v1beta1/zz_generated.model_name.go b/vendor/k8s.io/api/scheduling/v1beta1/zz_generated.model_name.go
index 16f40100cc..be01a4c3eb 100644
--- a/vendor/k8s.io/api/scheduling/v1beta1/zz_generated.model_name.go
+++ b/vendor/k8s.io/api/scheduling/v1beta1/zz_generated.model_name.go
@@ -21,6 +21,106 @@ limitations under the License.
 
 package v1beta1
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in AllCompositeDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.AllCompositeDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in AllDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.AllDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in BasicSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.BasicSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositeBasicSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.CompositeBasicSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositeDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.CompositeDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositeGangSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.CompositeGangSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositePodGroupSchedulingConstraints) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.CompositePodGroupSchedulingConstraints"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositePodGroupSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.CompositePodGroupSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CompositePodGroupTemplate) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.CompositePodGroupTemplate"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in DisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.DisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in GangSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.GangSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroup) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.PodGroup"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupList) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.PodGroupList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupResourceClaim) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.PodGroupResourceClaim"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupResourceClaimStatus) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.PodGroupResourceClaimStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupSchedulingConstraints) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.PodGroupSchedulingConstraints"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupSchedulingPolicy) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.PodGroupSchedulingPolicy"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupSpec) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.PodGroupSpec"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupStatus) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.PodGroupStatus"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in PodGroupTemplate) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.PodGroupTemplate"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in PriorityClass) OpenAPIModelName() string {
 	return "io.k8s.api.scheduling.v1beta1.PriorityClass"
@@ -30,3 +130,43 @@ func (in PriorityClass) OpenAPIModelName() string {
 func (in PriorityClassList) OpenAPIModelName() string {
 	return "io.k8s.api.scheduling.v1beta1.PriorityClassList"
 }
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SingleCompositeDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.SingleCompositeDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in SingleDisruptionMode) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.SingleDisruptionMode"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TopologyConstraint) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.TopologyConstraint"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in TypedLocalObjectReference) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.TypedLocalObjectReference"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in Workload) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.Workload"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadList) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.WorkloadList"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadReference) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.WorkloadReference"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in WorkloadSpec) OpenAPIModelName() string {
+	return "io.k8s.api.scheduling.v1beta1.WorkloadSpec"
+}
diff --git a/vendor/k8s.io/api/scheduling/v1beta1/zz_generated.prerelease-lifecycle.go b/vendor/k8s.io/api/scheduling/v1beta1/zz_generated.prerelease-lifecycle.go
index 15aefb1085..25f1136129 100644
--- a/vendor/k8s.io/api/scheduling/v1beta1/zz_generated.prerelease-lifecycle.go
+++ b/vendor/k8s.io/api/scheduling/v1beta1/zz_generated.prerelease-lifecycle.go
@@ -25,6 +25,42 @@ import (
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
 )
 
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *PodGroup) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
+
+// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or  "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
+func (in *PodGroup) APILifecycleDeprecated() (major, minor int) {
+	return 1, 40
+}
+
+// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
+func (in *PodGroup) APILifecycleRemoved() (major, minor int) {
+	return 1, 43
+}
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *PodGroupList) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
+
+// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or  "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
+func (in *PodGroupList) APILifecycleDeprecated() (major, minor int) {
+	return 1, 40
+}
+
+// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
+func (in *PodGroupList) APILifecycleRemoved() (major, minor int) {
+	return 1, 43
+}
+
 // APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
 // It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
 func (in *PriorityClass) APILifecycleIntroduced() (major, minor int) {
@@ -72,3 +108,39 @@ func (in *PriorityClassList) APILifecycleReplacement() schema.GroupVersionKind {
 func (in *PriorityClassList) APILifecycleRemoved() (major, minor int) {
 	return 1, 22
 }
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *Workload) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
+
+// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or  "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
+func (in *Workload) APILifecycleDeprecated() (major, minor int) {
+	return 1, 40
+}
+
+// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
+func (in *Workload) APILifecycleRemoved() (major, minor int) {
+	return 1, 43
+}
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *WorkloadList) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
+
+// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or  "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
+func (in *WorkloadList) APILifecycleDeprecated() (major, minor int) {
+	return 1, 40
+}
+
+// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
+func (in *WorkloadList) APILifecycleRemoved() (major, minor int) {
+	return 1, 43
+}
diff --git a/vendor/k8s.io/api/storage/v1/generated.pb.go b/vendor/k8s.io/api/storage/v1/generated.pb.go
index 5fc7d55a5b..4a6e5222f2 100644
--- a/vendor/k8s.io/api/storage/v1/generated.pb.go
+++ b/vendor/k8s.io/api/storage/v1/generated.pb.go
@@ -49,6 +49,8 @@ func (m *CSINodeList) Reset() { *m = CSINodeList{} }
 
 func (m *CSINodeSpec) Reset() { *m = CSINodeSpec{} }
 
+func (m *CSINodeStatus) Reset() { *m = CSINodeStatus{} }
+
 func (m *CSIStorageCapacity) Reset() { *m = CSIStorageCapacity{} }
 
 func (m *CSIStorageCapacityList) Reset() { *m = CSIStorageCapacityList{} }
@@ -57,6 +59,10 @@ func (m *StorageClass) Reset() { *m = StorageClass{} }
 
 func (m *StorageClassList) Reset() { *m = StorageClassList{} }
 
+func (m *StorageHealth) Reset() { *m = StorageHealth{} }
+
+func (m *StorageHealthCondition) Reset() { *m = StorageHealthCondition{} }
+
 func (m *TokenRequest) Reset() { *m = TokenRequest{} }
 
 func (m *VolumeAttachment) Reset() { *m = VolumeAttachment{} }
@@ -315,6 +321,16 @@ func (m *CSINode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
 	{
 		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -476,6 +492,43 @@ func (m *CSINodeSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *CSINodeStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CSINodeStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CSINodeStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.StorageHealth) > 0 {
+		for iNdEx := len(m.StorageHealth) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.StorageHealth[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *CSIStorageCapacity) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -753,6 +806,110 @@ func (m *StorageClassList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *StorageHealth) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *StorageHealth) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *StorageHealth) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.HealthConditions) > 0 {
+		for iNdEx := len(m.HealthConditions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.HealthConditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *StorageHealthCondition) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *StorageHealthCondition) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *StorageHealthCondition) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.LastTransitionTime.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x32
+	if m.VolumeMode != nil {
+		i -= len(*m.VolumeMode)
+		copy(dAtA[i:], *m.VolumeMode)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.VolumeMode)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.AccessMode != nil {
+		i -= len(*m.AccessMode)
+		copy(dAtA[i:], *m.AccessMode)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.AccessMode)))
+		i--
+		dAtA[i] = 0x22
+	}
+	i -= len(m.Message)
+	copy(dAtA[i:], m.Message)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Reason)
+	copy(dAtA[i:], m.Reason)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Reason)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Status)
+	copy(dAtA[i:], m.Status)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
 func (m *TokenRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -1330,6 +1487,8 @@ func (m *CSINode) Size() (n int) {
 	n += 1 + l + sovGenerated(uint64(l))
 	l = m.Spec.Size()
 	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
@@ -1388,6 +1547,21 @@ func (m *CSINodeSpec) Size() (n int) {
 	return n
 }
 
+func (m *CSINodeStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.StorageHealth) > 0 {
+		for _, e := range m.StorageHealth {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
 func (m *CSIStorageCapacity) Size() (n int) {
 	if m == nil {
 		return 0
@@ -1491,6 +1665,48 @@ func (m *StorageClassList) Size() (n int) {
 	return n
 }
 
+func (m *StorageHealth) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.HealthConditions) > 0 {
+		for _, e := range m.HealthConditions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *StorageHealthCondition) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Status)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Reason)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Message)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.AccessMode != nil {
+		l = len(*m.AccessMode)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.VolumeMode != nil {
+		l = len(*m.VolumeMode)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = m.LastTransitionTime.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
 func (m *TokenRequest) Size() (n int) {
 	if m == nil {
 		return 0
@@ -1726,6 +1942,7 @@ func (this *CSINode) String() string {
 	s := strings.Join([]string{`&CSINode{`,
 		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
 		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "CSINodeSpec", "CSINodeSpec", 1), `&`, ``, 1) + `,`,
+		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "CSINodeStatus", "CSINodeStatus", 1), `&`, ``, 1) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -1774,6 +1991,21 @@ func (this *CSINodeSpec) String() string {
 	}, "")
 	return s
 }
+func (this *CSINodeStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForStorageHealth := "[]StorageHealth{"
+	for _, f := range this.StorageHealth {
+		repeatedStringForStorageHealth += strings.Replace(strings.Replace(f.String(), "StorageHealth", "StorageHealth", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForStorageHealth += "}"
+	s := strings.Join([]string{`&CSINodeStatus{`,
+		`StorageHealth:` + repeatedStringForStorageHealth + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func (this *CSIStorageCapacity) String() string {
 	if this == nil {
 		return "nil"
@@ -1852,6 +2084,37 @@ func (this *StorageClassList) String() string {
 	}, "")
 	return s
 }
+func (this *StorageHealth) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForHealthConditions := "[]StorageHealthCondition{"
+	for _, f := range this.HealthConditions {
+		repeatedStringForHealthConditions += strings.Replace(strings.Replace(f.String(), "StorageHealthCondition", "StorageHealthCondition", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForHealthConditions += "}"
+	s := strings.Join([]string{`&StorageHealth{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`HealthConditions:` + repeatedStringForHealthConditions + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *StorageHealthCondition) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&StorageHealthCondition{`,
+		`Status:` + fmt.Sprintf("%v", this.Status) + `,`,
+		`Reason:` + fmt.Sprintf("%v", this.Reason) + `,`,
+		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`AccessMode:` + valueToStringGenerated(this.AccessMode) + `,`,
+		`VolumeMode:` + valueToStringGenerated(this.VolumeMode) + `,`,
+		`LastTransitionTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastTransitionTime), "Time", "v1.Time", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func (this *TokenRequest) String() string {
 	if this == nil {
 		return "nil"
@@ -2649,6 +2912,39 @@ func (m *CSINode) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -3053,7 +3349,7 @@ func (m *CSINodeSpec) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CSIStorageCapacity) Unmarshal(dAtA []byte) error {
+func (m *CSINodeStatus) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -3076,15 +3372,15 @@ func (m *CSIStorageCapacity) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CSIStorageCapacity: wiretype end group for non-group")
+			return fmt.Errorf("proto: CSINodeStatus: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CSIStorageCapacity: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CSINodeStatus: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StorageHealth", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -3111,30 +3407,114 @@ func (m *CSIStorageCapacity) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.StorageHealth = append(m.StorageHealth, StorageHealth{})
+			if err := m.StorageHealth[len(m.StorageHealth)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NodeTopology", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			if msglen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CSIStorageCapacity) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CSIStorageCapacity: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CSIStorageCapacity: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeTopology", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			postIndex := iNdEx + msglen
@@ -3905,6 +4285,367 @@ func (m *StorageClassList) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *StorageHealth) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: StorageHealth: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: StorageHealth: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HealthConditions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.HealthConditions = append(m.HealthConditions, StorageHealthCondition{})
+			if err := m.HealthConditions[len(m.HealthConditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *StorageHealthCondition) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: StorageHealthCondition: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: StorageHealthCondition: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Status = StorageHealthStatusType(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessMode", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := k8s_io_api_core_v1.PersistentVolumeAccessMode(dAtA[iNdEx:postIndex])
+			m.AccessMode = &s
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field VolumeMode", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := k8s_io_api_core_v1.PersistentVolumeMode(dAtA[iNdEx:postIndex])
+			m.VolumeMode = &s
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastTransitionTime", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.LastTransitionTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *TokenRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
diff --git a/vendor/k8s.io/api/storage/v1/generated.proto b/vendor/k8s.io/api/storage/v1/generated.proto
index d6bc969bb3..dc3855e235 100644
--- a/vendor/k8s.io/api/storage/v1/generated.proto
+++ b/vendor/k8s.io/api/storage/v1/generated.proto
@@ -36,7 +36,7 @@ option go_package = "k8s.io/api/storage/v1";
 // Kubelet uses this object to determine whether pod information needs to be passed on mount.
 // CSIDriver objects are non-namespaced.
 message CSIDriver {
-  // Standard object metadata.
+  // metadata is the standard object metadata.
   // metadata.Name indicates the name of the CSI driver that this object
   // refers to; it MUST be the same name returned by the CSI GetPluginName()
   // call for that driver.
@@ -124,6 +124,8 @@ message CSIDriverSpec {
   //
   // +optional
   // +listType=set
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
   repeated string volumeLifecycleModes = 3;
 
   // storageCapacity indicates that the CSI volume driver wants pod scheduling to consider the storage
@@ -250,7 +252,7 @@ message CSIDriverSpec {
   // +optional
   optional bool serviceAccountTokenInSecrets = 10;
 
-  // PreventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod
+  // preventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod
   // scheduling if the CSI driver on the node is missing.
   //
   // Enabling this option will prevent the scheduler (or any other
@@ -265,7 +267,7 @@ message CSIDriverSpec {
   // newly created node may be rejected by the scheduler because of missing CSI driver
   // information from the node.
   //
-  // This is an alpha feature and requires the VolumeLimitScaling feature gate to be enabled.
+  // This is a beta feature and requires the VolumeLimitScaling feature gate to be enabled.
   // Default is "false".
   // +featureGate=VolumeLimitScaling
   // +optional
@@ -282,12 +284,16 @@ message CSIDriverSpec {
 // enough that it doesn't create this object.
 // CSINode has an OwnerReference that points to the corresponding node object.
 message CSINode {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // metadata.name must be the Kubernetes node name.
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec is the specification of CSINode
   optional CSINodeSpec spec = 2;
+
+  // status contains health and status information for the node's storage.
+  // +optional
+  optional CSINodeStatus status = 3;
 }
 
 // CSINodeDriver holds information about the specification of one CSI driver installed on a node
@@ -350,6 +356,18 @@ message CSINodeSpec {
   repeated CSINodeDriver drivers = 1;
 }
 
+// CSINodeStatus contains health and status information for storage on a node.
+message CSINodeStatus {
+  // storageHealth contains backend health reports for CSI drivers registered on the node.
+  // +optional
+  // +listType=map
+  // +listMapKey=name
+  // +patchMergeKey=name
+  // +patchStrategy=merge
+  // +featureGate=CSIVolumeHealth
+  repeated StorageHealth storageHealth = 1;
+}
+
 // CSIStorageCapacity stores the result of one CSI GetCapacity call.
 // For a given StorageClass, this describes the available capacity in a
 // particular topology segment.  This can be used when considering where to
@@ -375,7 +393,7 @@ message CSINodeSpec {
 // the scheduler assumes that capacity is insufficient and tries some other
 // node.
 message CSIStorageCapacity {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // The name has no particular meaning. It must be a DNS subdomain (dots allowed, 253 characters).
   // To ensure that there are no conflicts with other CSI drivers on the cluster,
   // the recommendation is to use csisc-<uuid>, a generated name, or a reverse-domain name
@@ -448,29 +466,29 @@ message CSIStorageCapacityList {
 // StorageClasses are non-namespaced; the name of the storage class
 // according to etcd is in ObjectMeta.Name.
 message StorageClass {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // provisioner indicates the type of the provisioner.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:immutable
   optional string provisioner = 2;
 
   // parameters holds the parameters for the provisioner that should
   // create volumes of this storage class.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:optional
   map<string, string> parameters = 3;
 
   // reclaimPolicy controls the reclaimPolicy for dynamically provisioned PersistentVolumes of this storage class.
   // Defaults to Delete.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string reclaimPolicy = 4;
 
   // mountOptions controls the mountOptions for dynamically provisioned PersistentVolumes of this storage class.
@@ -488,8 +506,8 @@ message StorageClass {
   // provisioned and bound.  When unset, VolumeBindingImmediate is used.
   // This field is only honored by servers that enable the VolumeScheduling feature.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string volumeBindingMode = 7;
 
   // allowedTopologies restrict the node topologies where volumes can be dynamically provisioned.
@@ -512,6 +530,50 @@ message StorageClassList {
   repeated StorageClass items = 2;
 }
 
+// StorageHealth contains storage backend health reported by a CSI driver on a node.
+message StorageHealth {
+  // name is the CSI driver name, matching CSINodeDriver.name.
+  // +required
+  optional string name = 1;
+
+  // healthConditions are the adverse storage backend conditions reported by the CSI driver.
+  // At most 16 conditions may be reported.
+  // +optional
+  // +listType=atomic
+  repeated StorageHealthCondition healthConditions = 2;
+}
+
+// StorageHealthCondition represents an adverse health condition reported
+// by a CSI driver for its storage backend on a node.
+message StorageHealthCondition {
+  // status is the health status category.
+  // One of "StorageUnreachable", "StorageDegraded".
+  // +required
+  optional string status = 1;
+
+  // reason is a brief CamelCase machine-parseable reason.
+  // Maximum permitted length of a reason is 256 characters.
+  // +required
+  optional string reason = 2;
+
+  // message is a human-readable description.
+  // +optional
+  // Maximum permitted length of a message is 1024 characters.
+  optional string message = 3;
+
+  // accessMode is the access mode affected. Nil means all access modes are affected.
+  // +optional
+  optional string accessMode = 4;
+
+  // volumeMode is the volume mode affected. Nil means both are affected.
+  // +optional
+  optional string volumeMode = 5;
+
+  // lastTransitionTime is when this condition first appeared at its current state.
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 6;
+}
+
 // TokenRequest contains parameters of a service account token.
 message TokenRequest {
   // audience is the intended audience of the token in "TokenRequestSpec".
@@ -530,14 +592,14 @@ message TokenRequest {
 //
 // VolumeAttachment objects are non-namespaced.
 message VolumeAttachment {
-  // Standard object metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec represents specification of the desired attach/detach volume behavior.
   // Populated by the Kubernetes system.
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:immutable
   // +required
   optional VolumeAttachmentSpec spec = 2;
 
@@ -583,9 +645,9 @@ message VolumeAttachmentSpec {
   // attacher indicates the name of the volume driver that MUST handle this
   // request. This is the name returned by GetPluginName().
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format="k8s-long-name-caseless"
-  // +k8s:alpha(since: "1.36")=+k8s:maxLength=63
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format="k8s-long-name-caseless"
+  // +k8s:beta(since: "1.37")=+k8s:maxLength=63
   optional string attacher = 1;
 
   // source represents the volume that should be attached.
@@ -627,12 +689,12 @@ message VolumeAttachmentStatus {
 // defined by the CSI driver. The class can be specified during dynamic provisioning
 // of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.
 message VolumeAttributesClass {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Name of the CSI driver
+  // driverName is the name of the CSI driver
   // This field is immutable.
   optional string driverName = 2;
 
diff --git a/vendor/k8s.io/api/storage/v1/types.go b/vendor/k8s.io/api/storage/v1/types.go
index c65ebed4ec..f5499b8106 100644
--- a/vendor/k8s.io/api/storage/v1/types.go
+++ b/vendor/k8s.io/api/storage/v1/types.go
@@ -33,31 +33,31 @@ import (
 // StorageClasses are non-namespaced; the name of the storage class
 // according to etcd is in ObjectMeta.Name.
 type StorageClass struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata.
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// provisioner indicates the type of the provisioner.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:immutable
 	Provisioner string `json:"provisioner" protobuf:"bytes,2,opt,name=provisioner"`
 
 	// parameters holds the parameters for the provisioner that should
 	// create volumes of this storage class.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Parameters map[string]string `json:"parameters,omitempty" protobuf:"bytes,3,rep,name=parameters"`
 
 	// reclaimPolicy controls the reclaimPolicy for dynamically provisioned PersistentVolumes of this storage class.
 	// Defaults to Delete.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	ReclaimPolicy *v1.PersistentVolumeReclaimPolicy `json:"reclaimPolicy,omitempty" protobuf:"bytes,4,opt,name=reclaimPolicy,casttype=k8s.io/api/core/v1.PersistentVolumeReclaimPolicy"`
 
 	// mountOptions controls the mountOptions for dynamically provisioned PersistentVolumes of this storage class.
@@ -75,8 +75,8 @@ type StorageClass struct {
 	// provisioned and bound.  When unset, VolumeBindingImmediate is used.
 	// This field is only honored by servers that enable the VolumeScheduling feature.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	VolumeBindingMode *VolumeBindingMode `json:"volumeBindingMode,omitempty" protobuf:"bytes,7,opt,name=volumeBindingMode"`
 
 	// allowedTopologies restrict the node topologies where volumes can be dynamically provisioned.
@@ -93,7 +93,7 @@ type StorageClass struct {
 
 // StorageClassList is a collection of storage classes.
 type StorageClassList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -131,16 +131,16 @@ const (
 //
 // VolumeAttachment objects are non-namespaced.
 type VolumeAttachment struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object metadata.
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec represents specification of the desired attach/detach volume behavior.
 	// Populated by the Kubernetes system.
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:immutable
 	// +required
 	Spec VolumeAttachmentSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
 
@@ -156,7 +156,7 @@ type VolumeAttachment struct {
 
 // VolumeAttachmentList is a collection of VolumeAttachment objects.
 type VolumeAttachmentList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -172,9 +172,9 @@ type VolumeAttachmentSpec struct {
 	// attacher indicates the name of the volume driver that MUST handle this
 	// request. This is the name returned by GetPluginName().
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format="k8s-long-name-caseless"
-	// +k8s:alpha(since: "1.36")=+k8s:maxLength=63
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format="k8s-long-name-caseless"
+	// +k8s:beta(since: "1.37")=+k8s:maxLength=63
 	Attacher string `json:"attacher" protobuf:"bytes,1,opt,name=attacher"`
 
 	// source represents the volume that should be attached.
@@ -263,9 +263,9 @@ type VolumeError struct {
 // Kubelet uses this object to determine whether pod information needs to be passed on mount.
 // CSIDriver objects are non-namespaced.
 type CSIDriver struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object metadata.
+	// metadata is the standard object metadata.
 	// metadata.Name indicates the name of the CSI driver that this object
 	// refers to; it MUST be the same name returned by the CSI GetPluginName()
 	// call for that driver.
@@ -284,7 +284,7 @@ type CSIDriver struct {
 
 // CSIDriverList is a collection of CSIDriver objects.
 type CSIDriverList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -358,6 +358,8 @@ type CSIDriverSpec struct {
 	//
 	// +optional
 	// +listType=set
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
 	VolumeLifecycleModes []VolumeLifecycleMode `json:"volumeLifecycleModes,omitempty" protobuf:"bytes,3,opt,name=volumeLifecycleModes"`
 
 	// storageCapacity indicates that the CSI volume driver wants pod scheduling to consider the storage
@@ -484,7 +486,7 @@ type CSIDriverSpec struct {
 	// +optional
 	ServiceAccountTokenInSecrets *bool `json:"serviceAccountTokenInSecrets,omitempty" protobuf:"varint,10,opt,name=serviceAccountTokenInSecrets"`
 
-	// PreventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod
+	// preventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod
 	// scheduling if the CSI driver on the node is missing.
 	//
 	// Enabling this option will prevent the scheduler (or any other
@@ -499,7 +501,7 @@ type CSIDriverSpec struct {
 	// newly created node may be rejected by the scheduler because of missing CSI driver
 	// information from the node.
 	//
-	// This is an alpha feature and requires the VolumeLimitScaling feature gate to be enabled.
+	// This is a beta feature and requires the VolumeLimitScaling feature gate to be enabled.
 	// Default is "false".
 	// +featureGate=VolumeLimitScaling
 	// +optional
@@ -580,6 +582,7 @@ const (
 // +genclient:nonNamespaced
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +k8s:prerelease-lifecycle-gen:introduced=1.17
+// +k8s:supportsSubresource="/status"
 
 // CSINode holds information about all CSI drivers installed on a node.
 // CSI drivers do not need to create the CSINode object directly. As long as
@@ -591,14 +594,18 @@ const (
 // enough that it doesn't create this object.
 // CSINode has an OwnerReference that points to the corresponding node object.
 type CSINode struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata.
+	// metadata is the standard object metadata.
 	// metadata.name must be the Kubernetes node name.
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec is the specification of CSINode
 	Spec CSINodeSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
+
+	// status contains health and status information for the node's storage.
+	// +optional
+	Status CSINodeStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
 }
 
 // CSINodeSpec holds information about the specification of all CSI drivers installed on a node
@@ -660,12 +667,73 @@ type VolumeNodeResources struct {
 	Count *int32 `json:"count,omitempty" protobuf:"varint,1,opt,name=count"`
 }
 
+// StorageHealthStatusType describes the health status category of a storage backend.
+// +enum
+type StorageHealthStatusType string
+
+const (
+	// StorageUnreachable indicates the storage backend is unreachable.
+	StorageUnreachable StorageHealthStatusType = "StorageUnreachable"
+	// StorageDegraded indicates the storage backend is functioning with reduced capability.
+	StorageDegraded StorageHealthStatusType = "StorageDegraded"
+)
+
+// StorageHealthCondition represents an adverse health condition reported
+// by a CSI driver for its storage backend on a node.
+type StorageHealthCondition struct {
+	// status is the health status category.
+	// One of "StorageUnreachable", "StorageDegraded".
+	// +required
+	Status StorageHealthStatusType `json:"status" protobuf:"bytes,1,opt,name=status,casttype=StorageHealthStatusType"`
+	// reason is a brief CamelCase machine-parseable reason.
+	// Maximum permitted length of a reason is 256 characters.
+	// +required
+	Reason string `json:"reason" protobuf:"bytes,2,opt,name=reason"`
+	// message is a human-readable description.
+	// +optional
+	// Maximum permitted length of a message is 1024 characters.
+	Message string `json:"message,omitempty" protobuf:"bytes,3,opt,name=message"`
+	// accessMode is the access mode affected. Nil means all access modes are affected.
+	// +optional
+	AccessMode *v1.PersistentVolumeAccessMode `json:"accessMode,omitempty" protobuf:"bytes,4,opt,name=accessMode,casttype=k8s.io/api/core/v1.PersistentVolumeAccessMode"`
+	// volumeMode is the volume mode affected. Nil means both are affected.
+	// +optional
+	VolumeMode *v1.PersistentVolumeMode `json:"volumeMode,omitempty" protobuf:"bytes,5,opt,name=volumeMode,casttype=k8s.io/api/core/v1.PersistentVolumeMode"`
+	// lastTransitionTime is when this condition first appeared at its current state.
+	// +optional
+	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,6,opt,name=lastTransitionTime"`
+}
+
+// StorageHealth contains storage backend health reported by a CSI driver on a node.
+type StorageHealth struct {
+	// name is the CSI driver name, matching CSINodeDriver.name.
+	// +required
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+	// healthConditions are the adverse storage backend conditions reported by the CSI driver.
+	// At most 16 conditions may be reported.
+	// +optional
+	// +listType=atomic
+	HealthConditions []StorageHealthCondition `json:"healthConditions,omitempty" protobuf:"bytes,2,rep,name=healthConditions"`
+}
+
+// CSINodeStatus contains health and status information for storage on a node.
+type CSINodeStatus struct {
+	// storageHealth contains backend health reports for CSI drivers registered on the node.
+	// +optional
+	// +listType=map
+	// +listMapKey=name
+	// +patchMergeKey=name
+	// +patchStrategy=merge
+	// +featureGate=CSIVolumeHealth
+	StorageHealth []StorageHealth `json:"storageHealth,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,1,rep,name=storageHealth"`
+}
+
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +k8s:prerelease-lifecycle-gen:introduced=1.17
 
 // CSINodeList is a collection of CSINode objects.
 type CSINodeList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -705,9 +773,9 @@ type CSINodeList struct {
 // the scheduler assumes that capacity is insufficient and tries some other
 // node.
 type CSIStorageCapacity struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata.
+	// metadata is the standard object metadata.
 	// The name has no particular meaning. It must be a DNS subdomain (dots allowed, 253 characters).
 	// To ensure that there are no conflicts with other CSI drivers on the cluster,
 	// the recommendation is to use csisc-<uuid>, a generated name, or a reverse-domain name
@@ -768,7 +836,7 @@ type CSIStorageCapacity struct {
 
 // CSIStorageCapacityList is a collection of CSIStorageCapacity objects.
 type CSIStorageCapacityList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -788,14 +856,14 @@ type CSIStorageCapacityList struct {
 // defined by the CSI driver. The class can be specified during dynamic provisioning
 // of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.
 type VolumeAttributesClass struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata.
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Name of the CSI driver
+	// driverName is the name of the CSI driver
 	// This field is immutable.
 	DriverName string `json:"driverName" protobuf:"bytes,2,opt,name=driverName"`
 
@@ -820,7 +888,7 @@ type VolumeAttributesClass struct {
 
 // VolumeAttributesClassList is a collection of VolumeAttributesClass objects.
 type VolumeAttributesClassList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
diff --git a/vendor/k8s.io/api/storage/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/storage/v1/types_swagger_doc_generated.go
index 47a7e92492..62a910422f 100644
--- a/vendor/k8s.io/api/storage/v1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/storage/v1/types_swagger_doc_generated.go
@@ -29,7 +29,7 @@ package v1
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_CSIDriver = map[string]string{
 	"":         "CSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster. Kubernetes attach detach controller uses this object to determine whether attach is required. Kubelet uses this object to determine whether pod information needs to be passed on mount. CSIDriver objects are non-namespaced.",
-	"metadata": "Standard object metadata. metadata.Name indicates the name of the CSI driver that this object refers to; it MUST be the same name returned by the CSI GetPluginName() call for that driver. The driver name must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. metadata.Name indicates the name of the CSI driver that this object refers to; it MUST be the same name returned by the CSI GetPluginName() call for that driver. The driver name must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec represents the specification of the CSI Driver.",
 }
 
@@ -59,7 +59,7 @@ var map_CSIDriverSpec = map[string]string{
 	"seLinuxMount":                       "seLinuxMount specifies if the CSI driver supports \"-o context\" mount option.\n\nWhen \"true\", the CSI driver must ensure that all volumes provided by this CSI driver can be mounted separately with different `-o context` options. This is typical for storage backends that provide volumes as filesystems on block devices or as independent shared volumes. Kubernetes will call NodeStage / NodePublish with \"-o context=xyz\" mount option when mounting a ReadWriteOncePod volume used in Pod that has explicitly set SELinux context. In the future, it may be expanded to other volume AccessModes. In any case, Kubernetes will ensure that the volume is mounted only with a single SELinux context.\n\nWhen \"false\", Kubernetes won't pass any special SELinux mount options to the driver. This is typical for volumes that represent subdirectories of a bigger shared filesystem.\n\nDefault is \"false\".",
 	"nodeAllocatableUpdatePeriodSeconds": "nodeAllocatableUpdatePeriodSeconds specifies the interval between periodic updates of the CSINode allocatable capacity for this driver. When set, both periodic updates and updates triggered by capacity-related failures are enabled. If not set, no updates occur (neither periodic nor upon detecting capacity-related failures), and the allocatable.count remains static. The minimum allowed value for this field is 10 seconds.\n\nThis feature requires the MutableCSINodeAllocatableCount feature gate to be enabled.\n\nThis field is mutable.",
 	"serviceAccountTokenInSecrets":       "serviceAccountTokenInSecrets is an opt-in for CSI drivers to indicate that service account tokens should be passed via the Secrets field in NodePublishVolumeRequest instead of the VolumeContext field. The CSI specification provides a dedicated Secrets field for sensitive information like tokens, which is the appropriate mechanism for handling credentials. This addresses security concerns where sensitive tokens were being logged as part of volume context.\n\nWhen \"true\", kubelet will pass the tokens only in the Secrets field with the key \"csi.storage.k8s.io/serviceAccount.tokens\". The CSI driver must be updated to read tokens from the Secrets field instead of VolumeContext.\n\nWhen \"false\" or not set, kubelet will pass the tokens in VolumeContext with the key \"csi.storage.k8s.io/serviceAccount.tokens\" (existing behavior). This maintains backward compatibility with existing CSI drivers.\n\nThis field can only be set when TokenRequests is configured. The API server will reject CSIDriver specs that set this field without TokenRequests.\n\nDefault behavior if unset is to pass tokens in the VolumeContext field.",
-	"preventPodSchedulingIfMissing":      "PreventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod scheduling if the CSI driver on the node is missing.\n\nEnabling this option will prevent the scheduler (or any other component which embeds default scheduler such as cluster-autoscaler) from scheduling pods to nodes where CSI driver is not installed.\n\nFor components(such as cluster-autoscaler) that embed the scheduler and run pod placement simulations using scheduler plugins, they MUST be aware of CSI driver registration information via CSINode object. They must create simulated CSINode objects in addition to Node objects during scheduling simulation, otherwise if PreventPodSchedulingIfMissing is enabled globally for CSIDriver object, any newly created node may be rejected by the scheduler because of missing CSI driver information from the node.\n\nThis is an alpha feature and requires the VolumeLimitScaling feature gate to be enabled. Default is \"false\".",
+	"preventPodSchedulingIfMissing":      "preventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod scheduling if the CSI driver on the node is missing.\n\nEnabling this option will prevent the scheduler (or any other component which embeds default scheduler such as cluster-autoscaler) from scheduling pods to nodes where CSI driver is not installed.\n\nFor components(such as cluster-autoscaler) that embed the scheduler and run pod placement simulations using scheduler plugins, they MUST be aware of CSI driver registration information via CSINode object. They must create simulated CSINode objects in addition to Node objects during scheduling simulation, otherwise if PreventPodSchedulingIfMissing is enabled globally for CSIDriver object, any newly created node may be rejected by the scheduler because of missing CSI driver information from the node.\n\nThis is a beta feature and requires the VolumeLimitScaling feature gate to be enabled. Default is \"false\".",
 }
 
 func (CSIDriverSpec) SwaggerDoc() map[string]string {
@@ -68,8 +68,9 @@ func (CSIDriverSpec) SwaggerDoc() map[string]string {
 
 var map_CSINode = map[string]string{
 	"":         "CSINode holds information about all CSI drivers installed on a node. CSI drivers do not need to create the CSINode object directly. As long as they use the node-driver-registrar sidecar container, the kubelet will automatically populate the CSINode object for the CSI driver as part of kubelet plugin registration. CSINode has the same name as a node. If the object is missing, it means either there are no CSI Drivers available on the node, or the Kubelet version is low enough that it doesn't create this object. CSINode has an OwnerReference that points to the corresponding node object.",
-	"metadata": "Standard object's metadata. metadata.name must be the Kubernetes node name.",
+	"metadata": "metadata is the standard object metadata. metadata.name must be the Kubernetes node name.",
 	"spec":     "spec is the specification of CSINode",
+	"status":   "status contains health and status information for the node's storage.",
 }
 
 func (CSINode) SwaggerDoc() map[string]string {
@@ -107,9 +108,18 @@ func (CSINodeSpec) SwaggerDoc() map[string]string {
 	return map_CSINodeSpec
 }
 
+var map_CSINodeStatus = map[string]string{
+	"":              "CSINodeStatus contains health and status information for storage on a node.",
+	"storageHealth": "storageHealth contains backend health reports for CSI drivers registered on the node.",
+}
+
+func (CSINodeStatus) SwaggerDoc() map[string]string {
+	return map_CSINodeStatus
+}
+
 var map_CSIStorageCapacity = map[string]string{
 	"":                  "CSIStorageCapacity stores the result of one CSI GetCapacity call. For a given StorageClass, this describes the available capacity in a particular topology segment.  This can be used when considering where to instantiate new PersistentVolumes.\n\nFor example this can express things like: - StorageClass \"standard\" has \"1234 GiB\" available in \"topology.kubernetes.io/zone=us-east1\" - StorageClass \"localssd\" has \"10 GiB\" available in \"kubernetes.io/hostname=knode-abc123\"\n\nThe following three cases all imply that no capacity is available for a certain combination: - no object exists with suitable topology and storage class name - such an object exists, but the capacity is unset - such an object exists, but the capacity is zero\n\nThe producer of these objects can decide which approach is more suitable.\n\nThey are consumed by the kube-scheduler when a CSI driver opts into capacity-aware scheduling with CSIDriverSpec.StorageCapacity. The scheduler compares the MaximumVolumeSize against the requested size of pending volumes to filter out unsuitable nodes. If MaximumVolumeSize is unset, it falls back to a comparison against the less precise Capacity. If that is also unset, the scheduler assumes that capacity is insufficient and tries some other node.",
-	"metadata":          "Standard object's metadata. The name has no particular meaning. It must be a DNS subdomain (dots allowed, 253 characters). To ensure that there are no conflicts with other CSI drivers on the cluster, the recommendation is to use csisc-<uuid>, a generated name, or a reverse-domain name which ends with the unique CSI driver name.\n\nObjects are namespaced.\n\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata":          "metadata is the standard object metadata. The name has no particular meaning. It must be a DNS subdomain (dots allowed, 253 characters). To ensure that there are no conflicts with other CSI drivers on the cluster, the recommendation is to use csisc-<uuid>, a generated name, or a reverse-domain name which ends with the unique CSI driver name.\n\nObjects are namespaced.\n\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"nodeTopology":      "nodeTopology defines which nodes have access to the storage for which capacity was reported. If not set, the storage is not accessible from any node in the cluster. If empty, the storage is accessible from all nodes. This field is immutable.",
 	"storageClassName":  "storageClassName represents the name of the StorageClass that the reported capacity applies to. It must meet the same requirements as the name of a StorageClass object (non-empty, DNS subdomain). If that object no longer exists, the CSIStorageCapacity object is obsolete and should be removed by its creator. This field is immutable.",
 	"capacity":          "capacity is the value reported by the CSI driver in its GetCapacityResponse for a GetCapacityRequest with topology and parameters that match the previous fields.\n\nThe semantic is currently (CSI spec 1.2) defined as: The available capacity, in bytes, of the storage that can be used to provision volumes. If not set, that information is currently unavailable.",
@@ -132,7 +142,7 @@ func (CSIStorageCapacityList) SwaggerDoc() map[string]string {
 
 var map_StorageClass = map[string]string{
 	"":                     "StorageClass describes the parameters for a class of storage for which PersistentVolumes can be dynamically provisioned.\n\nStorageClasses are non-namespaced; the name of the storage class according to etcd is in ObjectMeta.Name.",
-	"metadata":             "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata":             "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"provisioner":          "provisioner indicates the type of the provisioner.",
 	"parameters":           "parameters holds the parameters for the provisioner that should create volumes of this storage class.",
 	"reclaimPolicy":        "reclaimPolicy controls the reclaimPolicy for dynamically provisioned PersistentVolumes of this storage class. Defaults to Delete.",
@@ -156,6 +166,30 @@ func (StorageClassList) SwaggerDoc() map[string]string {
 	return map_StorageClassList
 }
 
+var map_StorageHealth = map[string]string{
+	"":                 "StorageHealth contains storage backend health reported by a CSI driver on a node.",
+	"name":             "name is the CSI driver name, matching CSINodeDriver.name.",
+	"healthConditions": "healthConditions are the adverse storage backend conditions reported by the CSI driver. At most 16 conditions may be reported.",
+}
+
+func (StorageHealth) SwaggerDoc() map[string]string {
+	return map_StorageHealth
+}
+
+var map_StorageHealthCondition = map[string]string{
+	"":                   "StorageHealthCondition represents an adverse health condition reported by a CSI driver for its storage backend on a node.",
+	"status":             "status is the health status category. One of \"StorageUnreachable\", \"StorageDegraded\".",
+	"reason":             "reason is a brief CamelCase machine-parseable reason. Maximum permitted length of a reason is 256 characters.",
+	"message":            "message is a human-readable description. Maximum permitted length of a message is 1024 characters.",
+	"accessMode":         "accessMode is the access mode affected. Nil means all access modes are affected.",
+	"volumeMode":         "volumeMode is the volume mode affected. Nil means both are affected.",
+	"lastTransitionTime": "lastTransitionTime is when this condition first appeared at its current state.",
+}
+
+func (StorageHealthCondition) SwaggerDoc() map[string]string {
+	return map_StorageHealthCondition
+}
+
 var map_TokenRequest = map[string]string{
 	"":                  "TokenRequest contains parameters of a service account token.",
 	"audience":          "audience is the intended audience of the token in \"TokenRequestSpec\". It will default to the audiences of kube apiserver.",
@@ -168,7 +202,7 @@ func (TokenRequest) SwaggerDoc() map[string]string {
 
 var map_VolumeAttachment = map[string]string{
 	"":         "VolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.\n\nVolumeAttachment objects are non-namespaced.",
-	"metadata": "Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec represents specification of the desired attach/detach volume behavior. Populated by the Kubernetes system.",
 	"status":   "status represents status of the VolumeAttachment request. Populated by the entity completing the attach or detach operation, i.e. the external-attacher.",
 }
@@ -190,6 +224,7 @@ func (VolumeAttachmentList) SwaggerDoc() map[string]string {
 var map_VolumeAttachmentSource = map[string]string{
 	"":                     "VolumeAttachmentSource represents a volume that should be attached. Right now only PersistentVolumes can be attached via external attacher, in the future we may allow also inline volumes in pods. Exactly one member can be set.",
 	"persistentVolumeName": "persistentVolumeName represents the name of the persistent volume to attach.",
+	"inlineVolumeSpec":     "inlineVolumeSpec contains all the information necessary to attach a persistent volume defined by a pod's inline VolumeSource. This field is populated only for the CSIMigration feature. It contains translated fields from a pod's inline VolumeSource to a PersistentVolumeSpec. This field is beta-level and is only honored by servers that enabled the CSIMigration feature.",
 }
 
 func (VolumeAttachmentSource) SwaggerDoc() map[string]string {
@@ -221,8 +256,8 @@ func (VolumeAttachmentStatus) SwaggerDoc() map[string]string {
 
 var map_VolumeAttributesClass = map[string]string{
 	"":           "VolumeAttributesClass represents a specification of mutable volume attributes defined by the CSI driver. The class can be specified during dynamic provisioning of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.",
-	"metadata":   "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
-	"driverName": "Name of the CSI driver This field is immutable.",
+	"metadata":   "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"driverName": "driverName is the name of the CSI driver This field is immutable.",
 	"parameters": "parameters hold volume attributes defined by the CSI driver. These values are opaque to the Kubernetes and are passed directly to the CSI driver. The underlying storage provider supports changing these attributes on an existing volume, however the parameters field itself is immutable. To invoke a volume update, a new VolumeAttributesClass should be created with new parameters, and the PersistentVolumeClaim should be updated to reference the new VolumeAttributesClass.\n\nThis field is required and must contain at least one key/value pair. The keys cannot be empty, and the maximum number of parameters is 512, with a cumulative max size of 256K. If the CSI driver rejects invalid parameters, the target PersistentVolumeClaim will be set to an \"Infeasible\" state in the modifyVolumeStatus field.",
 }
 
diff --git a/vendor/k8s.io/api/storage/v1/zz_generated.deepcopy.go b/vendor/k8s.io/api/storage/v1/zz_generated.deepcopy.go
index aa3ffd0686..1df3b47555 100644
--- a/vendor/k8s.io/api/storage/v1/zz_generated.deepcopy.go
+++ b/vendor/k8s.io/api/storage/v1/zz_generated.deepcopy.go
@@ -166,6 +166,7 @@ func (in *CSINode) DeepCopyInto(out *CSINode) {
 	out.TypeMeta = in.TypeMeta
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
 	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
 	return
 }
 
@@ -269,6 +270,29 @@ func (in *CSINodeSpec) DeepCopy() *CSINodeSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CSINodeStatus) DeepCopyInto(out *CSINodeStatus) {
+	*out = *in
+	if in.StorageHealth != nil {
+		in, out := &in.StorageHealth, &out.StorageHealth
+		*out = make([]StorageHealth, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CSINodeStatus.
+func (in *CSINodeStatus) DeepCopy() *CSINodeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(CSINodeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CSIStorageCapacity) DeepCopyInto(out *CSIStorageCapacity) {
 	*out = *in
@@ -436,6 +460,56 @@ func (in *StorageClassList) DeepCopyObject() runtime.Object {
 	return nil
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StorageHealth) DeepCopyInto(out *StorageHealth) {
+	*out = *in
+	if in.HealthConditions != nil {
+		in, out := &in.HealthConditions, &out.HealthConditions
+		*out = make([]StorageHealthCondition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StorageHealth.
+func (in *StorageHealth) DeepCopy() *StorageHealth {
+	if in == nil {
+		return nil
+	}
+	out := new(StorageHealth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StorageHealthCondition) DeepCopyInto(out *StorageHealthCondition) {
+	*out = *in
+	if in.AccessMode != nil {
+		in, out := &in.AccessMode, &out.AccessMode
+		*out = new(corev1.PersistentVolumeAccessMode)
+		**out = **in
+	}
+	if in.VolumeMode != nil {
+		in, out := &in.VolumeMode, &out.VolumeMode
+		*out = new(corev1.PersistentVolumeMode)
+		**out = **in
+	}
+	in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StorageHealthCondition.
+func (in *StorageHealthCondition) DeepCopy() *StorageHealthCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(StorageHealthCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TokenRequest) DeepCopyInto(out *TokenRequest) {
 	*out = *in
diff --git a/vendor/k8s.io/api/storage/v1/zz_generated.model_name.go b/vendor/k8s.io/api/storage/v1/zz_generated.model_name.go
index 6ef6371006..4eaabcbc31 100644
--- a/vendor/k8s.io/api/storage/v1/zz_generated.model_name.go
+++ b/vendor/k8s.io/api/storage/v1/zz_generated.model_name.go
@@ -56,6 +56,11 @@ func (in CSINodeSpec) OpenAPIModelName() string {
 	return "io.k8s.api.storage.v1.CSINodeSpec"
 }
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CSINodeStatus) OpenAPIModelName() string {
+	return "io.k8s.api.storage.v1.CSINodeStatus"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in CSIStorageCapacity) OpenAPIModelName() string {
 	return "io.k8s.api.storage.v1.CSIStorageCapacity"
@@ -76,6 +81,16 @@ func (in StorageClassList) OpenAPIModelName() string {
 	return "io.k8s.api.storage.v1.StorageClassList"
 }
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in StorageHealth) OpenAPIModelName() string {
+	return "io.k8s.api.storage.v1.StorageHealth"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in StorageHealthCondition) OpenAPIModelName() string {
+	return "io.k8s.api.storage.v1.StorageHealthCondition"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in TokenRequest) OpenAPIModelName() string {
 	return "io.k8s.api.storage.v1.TokenRequest"
diff --git a/vendor/k8s.io/api/storage/v1alpha1/generated.proto b/vendor/k8s.io/api/storage/v1alpha1/generated.proto
index 837d011640..dae07a7010 100644
--- a/vendor/k8s.io/api/storage/v1alpha1/generated.proto
+++ b/vendor/k8s.io/api/storage/v1alpha1/generated.proto
@@ -55,7 +55,7 @@ option go_package = "k8s.io/api/storage/v1alpha1";
 // the scheduler assumes that capacity is insufficient and tries some other
 // node.
 message CSIStorageCapacity {
-  // Standard object's metadata. The name has no particular meaning. It must be
+  // metadata is the standard object metadata. The name has no particular meaning. It must be
   // be a DNS subdomain (dots allowed, 253 characters). To ensure that
   // there are no conflicts with other CSI drivers on the cluster, the recommendation
   // is to use csisc-<uuid>, a generated name, or a reverse-domain name which ends
@@ -127,14 +127,14 @@ message CSIStorageCapacityList {
 //
 // VolumeAttachment objects are non-namespaced.
 message VolumeAttachment {
-  // Standard object metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec represents specification of the desired attach/detach volume behavior.
   // Populated by the Kubernetes system.
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:immutable
   // +required
   optional VolumeAttachmentSpec spec = 2;
 
@@ -180,9 +180,9 @@ message VolumeAttachmentSpec {
   // attacher indicates the name of the volume driver that MUST handle this
   // request. This is the name returned by GetPluginName().
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format="k8s-long-name-caseless"
-  // +k8s:alpha(since: "1.36")=+k8s:maxLength=63
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format="k8s-long-name-caseless"
+  // +k8s:beta(since: "1.37")=+k8s:maxLength=63
   optional string attacher = 1;
 
   // source represents the volume that should be attached.
@@ -224,12 +224,12 @@ message VolumeAttachmentStatus {
 // defined by the CSI driver. The class can be specified during dynamic provisioning
 // of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.
 message VolumeAttributesClass {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Name of the CSI driver
+  // driverName is the name of the CSI driver
   // This field is immutable.
   optional string driverName = 2;
 
diff --git a/vendor/k8s.io/api/storage/v1alpha1/types.go b/vendor/k8s.io/api/storage/v1alpha1/types.go
index 286ac42aaa..655dea1984 100644
--- a/vendor/k8s.io/api/storage/v1alpha1/types.go
+++ b/vendor/k8s.io/api/storage/v1alpha1/types.go
@@ -35,16 +35,16 @@ import (
 //
 // VolumeAttachment objects are non-namespaced.
 type VolumeAttachment struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object metadata.
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec represents specification of the desired attach/detach volume behavior.
 	// Populated by the Kubernetes system.
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:immutable
 	// +required
 	Spec VolumeAttachmentSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
 
@@ -62,7 +62,7 @@ type VolumeAttachment struct {
 
 // VolumeAttachmentList is a collection of VolumeAttachment objects.
 type VolumeAttachmentList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -78,9 +78,9 @@ type VolumeAttachmentSpec struct {
 	// attacher indicates the name of the volume driver that MUST handle this
 	// request. This is the name returned by GetPluginName().
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format="k8s-long-name-caseless"
-	// +k8s:alpha(since: "1.36")=+k8s:maxLength=63
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format="k8s-long-name-caseless"
+	// +k8s:beta(since: "1.37")=+k8s:maxLength=63
 	Attacher string `json:"attacher" protobuf:"bytes,1,opt,name=attacher"`
 
 	// source represents the volume that should be attached.
@@ -189,9 +189,9 @@ type VolumeError struct {
 // the scheduler assumes that capacity is insufficient and tries some other
 // node.
 type CSIStorageCapacity struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata. The name has no particular meaning. It must be
+	// metadata is the standard object metadata. The name has no particular meaning. It must be
 	// be a DNS subdomain (dots allowed, 253 characters). To ensure that
 	// there are no conflicts with other CSI drivers on the cluster, the recommendation
 	// is to use csisc-<uuid>, a generated name, or a reverse-domain name which ends
@@ -254,7 +254,7 @@ type CSIStorageCapacity struct {
 
 // CSIStorageCapacityList is a collection of CSIStorageCapacity objects.
 type CSIStorageCapacityList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -276,14 +276,14 @@ type CSIStorageCapacityList struct {
 // defined by the CSI driver. The class can be specified during dynamic provisioning
 // of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.
 type VolumeAttributesClass struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata.
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Name of the CSI driver
+	// driverName is the name of the CSI driver
 	// This field is immutable.
 	DriverName string `json:"driverName" protobuf:"bytes,2,opt,name=driverName"`
 
@@ -310,7 +310,7 @@ type VolumeAttributesClass struct {
 
 // VolumeAttributesClassList is a collection of VolumeAttributesClass objects.
 type VolumeAttributesClassList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
diff --git a/vendor/k8s.io/api/storage/v1alpha1/types_swagger_doc_generated.go b/vendor/k8s.io/api/storage/v1alpha1/types_swagger_doc_generated.go
index 713498b372..ff86ad26e8 100644
--- a/vendor/k8s.io/api/storage/v1alpha1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/storage/v1alpha1/types_swagger_doc_generated.go
@@ -29,7 +29,7 @@ package v1alpha1
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_CSIStorageCapacity = map[string]string{
 	"":                  "CSIStorageCapacity stores the result of one CSI GetCapacity call. For a given StorageClass, this describes the available capacity in a particular topology segment.  This can be used when considering where to instantiate new PersistentVolumes.\n\nFor example this can express things like: - StorageClass \"standard\" has \"1234 GiB\" available in \"topology.kubernetes.io/zone=us-east1\" - StorageClass \"localssd\" has \"10 GiB\" available in \"kubernetes.io/hostname=knode-abc123\"\n\nThe following three cases all imply that no capacity is available for a certain combination: - no object exists with suitable topology and storage class name - such an object exists, but the capacity is unset - such an object exists, but the capacity is zero\n\nThe producer of these objects can decide which approach is more suitable.\n\nThey are consumed by the kube-scheduler when a CSI driver opts into capacity-aware scheduling with CSIDriverSpec.StorageCapacity. The scheduler compares the MaximumVolumeSize against the requested size of pending volumes to filter out unsuitable nodes. If MaximumVolumeSize is unset, it falls back to a comparison against the less precise Capacity. If that is also unset, the scheduler assumes that capacity is insufficient and tries some other node.",
-	"metadata":          "Standard object's metadata. The name has no particular meaning. It must be be a DNS subdomain (dots allowed, 253 characters). To ensure that there are no conflicts with other CSI drivers on the cluster, the recommendation is to use csisc-<uuid>, a generated name, or a reverse-domain name which ends with the unique CSI driver name.\n\nObjects are namespaced.\n\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata":          "metadata is the standard object metadata. The name has no particular meaning. It must be be a DNS subdomain (dots allowed, 253 characters). To ensure that there are no conflicts with other CSI drivers on the cluster, the recommendation is to use csisc-<uuid>, a generated name, or a reverse-domain name which ends with the unique CSI driver name.\n\nObjects are namespaced.\n\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"nodeTopology":      "nodeTopology defines which nodes have access to the storage for which capacity was reported. If not set, the storage is not accessible from any node in the cluster. If empty, the storage is accessible from all nodes. This field is immutable.",
 	"storageClassName":  "storageClassName represents the name of the StorageClass that the reported capacity applies to. It must meet the same requirements as the name of a StorageClass object (non-empty, DNS subdomain). If that object no longer exists, the CSIStorageCapacity object is obsolete and should be removed by its creator. This field is immutable.",
 	"capacity":          "capacity is the value reported by the CSI driver in its GetCapacityResponse for a GetCapacityRequest with topology and parameters that match the previous fields.\n\nThe semantic is currently (CSI spec 1.2) defined as: The available capacity, in bytes, of the storage that can be used to provision volumes. If not set, that information is currently unavailable.",
@@ -52,7 +52,7 @@ func (CSIStorageCapacityList) SwaggerDoc() map[string]string {
 
 var map_VolumeAttachment = map[string]string{
 	"":         "VolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.\n\nVolumeAttachment objects are non-namespaced.",
-	"metadata": "Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec represents specification of the desired attach/detach volume behavior. Populated by the Kubernetes system.",
 	"status":   "status represents status of the VolumeAttachment request. Populated by the entity completing the attach or detach operation, i.e. the external-attacher.",
 }
@@ -74,6 +74,7 @@ func (VolumeAttachmentList) SwaggerDoc() map[string]string {
 var map_VolumeAttachmentSource = map[string]string{
 	"":                     "VolumeAttachmentSource represents a volume that should be attached. Right now only PersistentVolumes can be attached via external attacher, in the future we may allow also inline volumes in pods. Exactly one member can be set.",
 	"persistentVolumeName": "persistentVolumeName represents the name of the persistent volume to attach.",
+	"inlineVolumeSpec":     "inlineVolumeSpec contains all the information necessary to attach a persistent volume defined by a pod's inline VolumeSource. This field is populated only for the CSIMigration feature. It contains translated fields from a pod's inline VolumeSource to a PersistentVolumeSpec. This field is alpha-level and is only honored by servers that enabled the CSIMigration feature.",
 }
 
 func (VolumeAttachmentSource) SwaggerDoc() map[string]string {
@@ -105,8 +106,8 @@ func (VolumeAttachmentStatus) SwaggerDoc() map[string]string {
 
 var map_VolumeAttributesClass = map[string]string{
 	"":           "VolumeAttributesClass represents a specification of mutable volume attributes defined by the CSI driver. The class can be specified during dynamic provisioning of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.",
-	"metadata":   "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
-	"driverName": "Name of the CSI driver This field is immutable.",
+	"metadata":   "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"driverName": "driverName is the name of the CSI driver This field is immutable.",
 	"parameters": "parameters hold volume attributes defined by the CSI driver. These values are opaque to the Kubernetes and are passed directly to the CSI driver. The underlying storage provider supports changing these attributes on an existing volume, however the parameters field itself is immutable. To invoke a volume update, a new VolumeAttributesClass should be created with new parameters, and the PersistentVolumeClaim should be updated to reference the new VolumeAttributesClass.\n\nThis field is required and must contain at least one key/value pair. The keys cannot be empty, and the maximum number of parameters is 512, with a cumulative max size of 256K. If the CSI driver rejects invalid parameters, the target PersistentVolumeClaim will be set to an \"Infeasible\" state in the modifyVolumeStatus field.",
 }
 
diff --git a/vendor/k8s.io/api/storage/v1beta1/generated.pb.go b/vendor/k8s.io/api/storage/v1beta1/generated.pb.go
index 7fd08783aa..dff4bae5e3 100644
--- a/vendor/k8s.io/api/storage/v1beta1/generated.pb.go
+++ b/vendor/k8s.io/api/storage/v1beta1/generated.pb.go
@@ -49,6 +49,8 @@ func (m *CSINodeList) Reset() { *m = CSINodeList{} }
 
 func (m *CSINodeSpec) Reset() { *m = CSINodeSpec{} }
 
+func (m *CSINodeStatus) Reset() { *m = CSINodeStatus{} }
+
 func (m *CSIStorageCapacity) Reset() { *m = CSIStorageCapacity{} }
 
 func (m *CSIStorageCapacityList) Reset() { *m = CSIStorageCapacityList{} }
@@ -57,6 +59,10 @@ func (m *StorageClass) Reset() { *m = StorageClass{} }
 
 func (m *StorageClassList) Reset() { *m = StorageClassList{} }
 
+func (m *StorageHealth) Reset() { *m = StorageHealth{} }
+
+func (m *StorageHealthCondition) Reset() { *m = StorageHealthCondition{} }
+
 func (m *TokenRequest) Reset() { *m = TokenRequest{} }
 
 func (m *VolumeAttachment) Reset() { *m = VolumeAttachment{} }
@@ -315,6 +321,16 @@ func (m *CSINode) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
 	{
 		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
 		if err != nil {
@@ -476,6 +492,43 @@ func (m *CSINodeSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *CSINodeStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CSINodeStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CSINodeStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.StorageHealth) > 0 {
+		for iNdEx := len(m.StorageHealth) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.StorageHealth[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *CSIStorageCapacity) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -753,6 +806,110 @@ func (m *StorageClassList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *StorageHealth) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *StorageHealth) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *StorageHealth) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.HealthConditions) > 0 {
+		for iNdEx := len(m.HealthConditions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.HealthConditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	i -= len(m.Name)
+	copy(dAtA[i:], m.Name)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *StorageHealthCondition) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *StorageHealthCondition) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *StorageHealthCondition) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.LastTransitionTime.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x32
+	if m.VolumeMode != nil {
+		i -= len(*m.VolumeMode)
+		copy(dAtA[i:], *m.VolumeMode)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.VolumeMode)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.AccessMode != nil {
+		i -= len(*m.AccessMode)
+		copy(dAtA[i:], *m.AccessMode)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.AccessMode)))
+		i--
+		dAtA[i] = 0x22
+	}
+	i -= len(m.Message)
+	copy(dAtA[i:], m.Message)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Message)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.Reason)
+	copy(dAtA[i:], m.Reason)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Reason)))
+	i--
+	dAtA[i] = 0x12
+	i -= len(m.Status)
+	copy(dAtA[i:], m.Status)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Status)))
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
 func (m *TokenRequest) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -1330,6 +1487,8 @@ func (m *CSINode) Size() (n int) {
 	n += 1 + l + sovGenerated(uint64(l))
 	l = m.Spec.Size()
 	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovGenerated(uint64(l))
 	return n
 }
 
@@ -1388,6 +1547,21 @@ func (m *CSINodeSpec) Size() (n int) {
 	return n
 }
 
+func (m *CSINodeStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.StorageHealth) > 0 {
+		for _, e := range m.StorageHealth {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
 func (m *CSIStorageCapacity) Size() (n int) {
 	if m == nil {
 		return 0
@@ -1491,6 +1665,48 @@ func (m *StorageClassList) Size() (n int) {
 	return n
 }
 
+func (m *StorageHealth) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.HealthConditions) > 0 {
+		for _, e := range m.HealthConditions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *StorageHealthCondition) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Status)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Reason)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Message)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.AccessMode != nil {
+		l = len(*m.AccessMode)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	if m.VolumeMode != nil {
+		l = len(*m.VolumeMode)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	l = m.LastTransitionTime.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
 func (m *TokenRequest) Size() (n int) {
 	if m == nil {
 		return 0
@@ -1726,6 +1942,7 @@ func (this *CSINode) String() string {
 	s := strings.Join([]string{`&CSINode{`,
 		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
 		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "CSINodeSpec", "CSINodeSpec", 1), `&`, ``, 1) + `,`,
+		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "CSINodeStatus", "CSINodeStatus", 1), `&`, ``, 1) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -1774,6 +1991,21 @@ func (this *CSINodeSpec) String() string {
 	}, "")
 	return s
 }
+func (this *CSINodeStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForStorageHealth := "[]StorageHealth{"
+	for _, f := range this.StorageHealth {
+		repeatedStringForStorageHealth += strings.Replace(strings.Replace(f.String(), "StorageHealth", "StorageHealth", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForStorageHealth += "}"
+	s := strings.Join([]string{`&CSINodeStatus{`,
+		`StorageHealth:` + repeatedStringForStorageHealth + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func (this *CSIStorageCapacity) String() string {
 	if this == nil {
 		return "nil"
@@ -1852,6 +2084,37 @@ func (this *StorageClassList) String() string {
 	}, "")
 	return s
 }
+func (this *StorageHealth) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForHealthConditions := "[]StorageHealthCondition{"
+	for _, f := range this.HealthConditions {
+		repeatedStringForHealthConditions += strings.Replace(strings.Replace(f.String(), "StorageHealthCondition", "StorageHealthCondition", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForHealthConditions += "}"
+	s := strings.Join([]string{`&StorageHealth{`,
+		`Name:` + fmt.Sprintf("%v", this.Name) + `,`,
+		`HealthConditions:` + repeatedStringForHealthConditions + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *StorageHealthCondition) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&StorageHealthCondition{`,
+		`Status:` + fmt.Sprintf("%v", this.Status) + `,`,
+		`Reason:` + fmt.Sprintf("%v", this.Reason) + `,`,
+		`Message:` + fmt.Sprintf("%v", this.Message) + `,`,
+		`AccessMode:` + valueToStringGenerated(this.AccessMode) + `,`,
+		`VolumeMode:` + valueToStringGenerated(this.VolumeMode) + `,`,
+		`LastTransitionTime:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.LastTransitionTime), "Time", "v1.Time", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func (this *TokenRequest) String() string {
 	if this == nil {
 		return "nil"
@@ -2649,6 +2912,39 @@ func (m *CSINode) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])
@@ -3053,7 +3349,7 @@ func (m *CSINodeSpec) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *CSIStorageCapacity) Unmarshal(dAtA []byte) error {
+func (m *CSINodeStatus) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -3076,15 +3372,15 @@ func (m *CSIStorageCapacity) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: CSIStorageCapacity: wiretype end group for non-group")
+			return fmt.Errorf("proto: CSINodeStatus: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: CSIStorageCapacity: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: CSINodeStatus: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field StorageHealth", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -3111,30 +3407,114 @@ func (m *CSIStorageCapacity) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			m.StorageHealth = append(m.StorageHealth, StorageHealth{})
+			if err := m.StorageHealth[len(m.StorageHealth)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NodeTopology", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowGenerated
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
 			}
-			if msglen < 0 {
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CSIStorageCapacity) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CSIStorageCapacity: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CSIStorageCapacity: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeTopology", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
 				return ErrInvalidLengthGenerated
 			}
 			postIndex := iNdEx + msglen
@@ -3905,6 +4285,367 @@ func (m *StorageClassList) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *StorageHealth) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: StorageHealth: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: StorageHealth: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HealthConditions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.HealthConditions = append(m.HealthConditions, StorageHealthCondition{})
+			if err := m.HealthConditions[len(m.HealthConditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *StorageHealthCondition) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: StorageHealthCondition: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: StorageHealthCondition: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Status = StorageHealthStatusType(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Message", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Message = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessMode", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := k8s_io_api_core_v1.PersistentVolumeAccessMode(dAtA[iNdEx:postIndex])
+			m.AccessMode = &s
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field VolumeMode", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := k8s_io_api_core_v1.PersistentVolumeMode(dAtA[iNdEx:postIndex])
+			m.VolumeMode = &s
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastTransitionTime", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.LastTransitionTime.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *TokenRequest) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
diff --git a/vendor/k8s.io/api/storage/v1beta1/generated.proto b/vendor/k8s.io/api/storage/v1beta1/generated.proto
index 3cae755fb4..6c85957063 100644
--- a/vendor/k8s.io/api/storage/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/storage/v1beta1/generated.proto
@@ -39,7 +39,7 @@ option go_package = "k8s.io/api/storage/v1beta1";
 // Kubelet uses this object to determine whether pod information needs to be passed on mount.
 // CSIDriver objects are non-namespaced.
 message CSIDriver {
-  // Standard object metadata.
+  // metadata is the standard object metadata.
   // metadata.Name indicates the name of the CSI driver that this object
   // refers to; it MUST be the same name returned by the CSI GetPluginName()
   // call for that driver.
@@ -127,6 +127,8 @@ message CSIDriverSpec {
   //
   // +optional
   // +listType=atomic
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
   repeated string volumeLifecycleModes = 3;
 
   // storageCapacity indicates that the CSI volume driver wants pod scheduling to consider the storage
@@ -252,7 +254,7 @@ message CSIDriverSpec {
   // +optional
   optional bool serviceAccountTokenInSecrets = 10;
 
-  // PreventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod
+  // preventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod
   // scheduling if the CSI driver on the node is missing.
   //
   // Enabling this option will prevent the scheduler (or any other
@@ -267,7 +269,7 @@ message CSIDriverSpec {
   // newly created node may be rejected by the scheduler because of missing CSI driver
   // information from the node.
   //
-  // This is an alpha feature and requires the VolumeLimitScaling feature gate to be enabled.
+  // This is a beta feature and requires the VolumeLimitScaling feature gate to be enabled.
   // Default is "false".
   // +featureGate=VolumeLimitScaling
   // +optional
@@ -286,11 +288,16 @@ message CSIDriverSpec {
 // enough that it doesn't create this object.
 // CSINode has an OwnerReference that points to the corresponding node object.
 message CSINode {
+  // metadata is the standard object metadata.
   // metadata.name must be the Kubernetes node name.
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec is the specification of CSINode
   optional CSINodeSpec spec = 2;
+
+  // status contains health and status information for the node's storage.
+  // +optional
+  optional CSINodeStatus status = 3;
 }
 
 // CSINodeDriver holds information about the specification of one CSI driver installed on a node
@@ -352,6 +359,18 @@ message CSINodeSpec {
   repeated CSINodeDriver drivers = 1;
 }
 
+// CSINodeStatus contains health and status information for storage on a node.
+message CSINodeStatus {
+  // storageHealth contains backend health reports for CSI drivers registered on the node.
+  // +optional
+  // +listType=map
+  // +listMapKey=name
+  // +patchMergeKey=name
+  // +patchStrategy=merge
+  // +featureGate=CSIVolumeHealth
+  repeated StorageHealth storageHealth = 1;
+}
+
 // CSIStorageCapacity stores the result of one CSI GetCapacity call.
 // For a given StorageClass, this describes the available capacity in a
 // particular topology segment.  This can be used when considering where to
@@ -377,7 +396,7 @@ message CSINodeSpec {
 // the scheduler assumes that capacity is insufficient and tries some other
 // node.
 message CSIStorageCapacity {
-  // Standard object's metadata. The name has no particular meaning. It must be
+  // metadata is the standard object metadata. The name has no particular meaning. It must be
   // be a DNS subdomain (dots allowed, 253 characters). To ensure that
   // there are no conflicts with other CSI drivers on the cluster, the recommendation
   // is to use csisc-<uuid>, a generated name, or a reverse-domain name which ends
@@ -450,29 +469,29 @@ message CSIStorageCapacityList {
 // StorageClasses are non-namespaced; the name of the storage class
 // according to etcd is in ObjectMeta.Name.
 message StorageClass {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // provisioner indicates the type of the provisioner.
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:immutable
   optional string provisioner = 2;
 
   // parameters holds the parameters for the provisioner that should
   // create volumes of this storage class.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:optional
   map<string, string> parameters = 3;
 
   // reclaimPolicy controls the reclaimPolicy for dynamically provisioned PersistentVolumes of this storage class.
   // Defaults to Delete.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string reclaimPolicy = 4;
 
   // mountOptions controls the mountOptions for dynamically provisioned PersistentVolumes of this storage class.
@@ -490,8 +509,8 @@ message StorageClass {
   // provisioned and bound.  When unset, VolumeBindingImmediate is used.
   // This field is only honored by servers that enable the VolumeScheduling feature.
   // +optional
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
-  // +k8s:alpha(since: "1.36")=+k8s:optional
+  // +k8s:beta(since: "1.37")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:optional
   optional string volumeBindingMode = 7;
 
   // allowedTopologies restrict the node topologies where volumes can be dynamically provisioned.
@@ -514,6 +533,50 @@ message StorageClassList {
   repeated StorageClass items = 2;
 }
 
+// StorageHealth contains storage backend health reported by a CSI driver on a node.
+message StorageHealth {
+  // name is the CSI driver name, matching CSINodeDriver.name.
+  // +required
+  optional string name = 1;
+
+  // healthConditions are the adverse storage backend conditions reported by the CSI driver.
+  // At most 16 conditions may be reported.
+  // +optional
+  // +listType=atomic
+  repeated StorageHealthCondition healthConditions = 2;
+}
+
+// StorageHealthCondition represents an adverse health condition reported
+// by a CSI driver for its storage backend on a node.
+message StorageHealthCondition {
+  // status is the health status category.
+  // One of "StorageUnreachable", "StorageDegraded".
+  // +required
+  optional string status = 1;
+
+  // reason is a brief CamelCase machine-parseable reason.
+  // +required
+  // Maximum permitted length of a reason is 256 characters.
+  optional string reason = 2;
+
+  // message is a human-readable description.
+  // +optional
+  // Maximum permitted length of a message is 1024 characters.
+  optional string message = 3;
+
+  // accessMode is the access mode affected. Nil means all access modes are affected.
+  // +optional
+  optional string accessMode = 4;
+
+  // volumeMode is the volume mode affected. Nil means both are affected.
+  // +optional
+  optional string volumeMode = 5;
+
+  // lastTransitionTime is when this condition first appeared at its current state.
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 6;
+}
+
 // TokenRequest contains parameters of a service account token.
 message TokenRequest {
   // audience is the intended audience of the token in "TokenRequestSpec".
@@ -532,14 +595,14 @@ message TokenRequest {
 //
 // VolumeAttachment objects are non-namespaced.
 message VolumeAttachment {
-  // Standard object metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // spec represents specification of the desired attach/detach volume behavior.
   // Populated by the Kubernetes system.
-  // +k8s:alpha(since: "1.36")=+k8s:immutable
+  // +k8s:beta(since: "1.37")=+k8s:immutable
   // +required
   optional VolumeAttachmentSpec spec = 2;
 
@@ -585,9 +648,9 @@ message VolumeAttachmentSpec {
   // attacher indicates the name of the volume driver that MUST handle this
   // request. This is the name returned by GetPluginName().
   // +required
-  // +k8s:alpha(since: "1.36")=+k8s:required
-  // +k8s:alpha(since: "1.36")=+k8s:format="k8s-long-name-caseless"
-  // +k8s:alpha(since: "1.36")=+k8s:maxLength=63
+  // +k8s:beta(since: "1.37")=+k8s:required
+  // +k8s:beta(since: "1.37")=+k8s:format="k8s-long-name-caseless"
+  // +k8s:beta(since: "1.37")=+k8s:maxLength=63
   optional string attacher = 1;
 
   // source represents the volume that should be attached.
@@ -629,12 +692,12 @@ message VolumeAttachmentStatus {
 // defined by the CSI driver. The class can be specified during dynamic provisioning
 // of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.
 message VolumeAttributesClass {
-  // Standard object's metadata.
+  // metadata is the standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
-  // Name of the CSI driver
+  // driverName is the name of the CSI driver
   // This field is immutable.
   optional string driverName = 2;
 
diff --git a/vendor/k8s.io/api/storage/v1beta1/types.go b/vendor/k8s.io/api/storage/v1beta1/types.go
index 0c33e218e7..3a05ad4b36 100644
--- a/vendor/k8s.io/api/storage/v1beta1/types.go
+++ b/vendor/k8s.io/api/storage/v1beta1/types.go
@@ -35,31 +35,31 @@ import (
 // StorageClasses are non-namespaced; the name of the storage class
 // according to etcd is in ObjectMeta.Name.
 type StorageClass struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata.
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// provisioner indicates the type of the provisioner.
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:immutable
 	Provisioner string `json:"provisioner" protobuf:"bytes,2,opt,name=provisioner"`
 
 	// parameters holds the parameters for the provisioner that should
 	// create volumes of this storage class.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	Parameters map[string]string `json:"parameters,omitempty" protobuf:"bytes,3,rep,name=parameters"`
 
 	// reclaimPolicy controls the reclaimPolicy for dynamically provisioned PersistentVolumes of this storage class.
 	// Defaults to Delete.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	ReclaimPolicy *v1.PersistentVolumeReclaimPolicy `json:"reclaimPolicy,omitempty" protobuf:"bytes,4,opt,name=reclaimPolicy,casttype=k8s.io/api/core/v1.PersistentVolumeReclaimPolicy"`
 
 	// mountOptions controls the mountOptions for dynamically provisioned PersistentVolumes of this storage class.
@@ -77,8 +77,8 @@ type StorageClass struct {
 	// provisioned and bound.  When unset, VolumeBindingImmediate is used.
 	// This field is only honored by servers that enable the VolumeScheduling feature.
 	// +optional
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
-	// +k8s:alpha(since: "1.36")=+k8s:optional
+	// +k8s:beta(since: "1.37")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:optional
 	VolumeBindingMode *VolumeBindingMode `json:"volumeBindingMode,omitempty" protobuf:"bytes,7,opt,name=volumeBindingMode"`
 
 	// allowedTopologies restrict the node topologies where volumes can be dynamically provisioned.
@@ -97,7 +97,7 @@ type StorageClass struct {
 
 // StorageClassList is a collection of storage classes.
 type StorageClassList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -136,16 +136,16 @@ const (
 //
 // VolumeAttachment objects are non-namespaced.
 type VolumeAttachment struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object metadata.
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec represents specification of the desired attach/detach volume behavior.
 	// Populated by the Kubernetes system.
-	// +k8s:alpha(since: "1.36")=+k8s:immutable
+	// +k8s:beta(since: "1.37")=+k8s:immutable
 	// +required
 	Spec VolumeAttachmentSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
 
@@ -163,7 +163,7 @@ type VolumeAttachment struct {
 
 // VolumeAttachmentList is a collection of VolumeAttachment objects.
 type VolumeAttachmentList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -179,9 +179,9 @@ type VolumeAttachmentSpec struct {
 	// attacher indicates the name of the volume driver that MUST handle this
 	// request. This is the name returned by GetPluginName().
 	// +required
-	// +k8s:alpha(since: "1.36")=+k8s:required
-	// +k8s:alpha(since: "1.36")=+k8s:format="k8s-long-name-caseless"
-	// +k8s:alpha(since: "1.36")=+k8s:maxLength=63
+	// +k8s:beta(since: "1.37")=+k8s:required
+	// +k8s:beta(since: "1.37")=+k8s:format="k8s-long-name-caseless"
+	// +k8s:beta(since: "1.37")=+k8s:maxLength=63
 	Attacher string `json:"attacher" protobuf:"bytes,1,opt,name=attacher"`
 
 	// source represents the volume that should be attached.
@@ -275,9 +275,9 @@ type VolumeError struct {
 // Kubelet uses this object to determine whether pod information needs to be passed on mount.
 // CSIDriver objects are non-namespaced.
 type CSIDriver struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object metadata.
+	// metadata is the standard object metadata.
 	// metadata.Name indicates the name of the CSI driver that this object
 	// refers to; it MUST be the same name returned by the CSI GetPluginName()
 	// call for that driver.
@@ -298,7 +298,7 @@ type CSIDriver struct {
 
 // CSIDriverList is a collection of CSIDriver objects.
 type CSIDriverList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -372,6 +372,8 @@ type CSIDriverSpec struct {
 	//
 	// +optional
 	// +listType=atomic
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
 	VolumeLifecycleModes []VolumeLifecycleMode `json:"volumeLifecycleModes,omitempty" protobuf:"bytes,3,opt,name=volumeLifecycleModes"`
 
 	// storageCapacity indicates that the CSI volume driver wants pod scheduling to consider the storage
@@ -497,7 +499,7 @@ type CSIDriverSpec struct {
 	// +optional
 	ServiceAccountTokenInSecrets *bool `json:"serviceAccountTokenInSecrets,omitempty" protobuf:"varint,10,opt,name=serviceAccountTokenInSecrets"`
 
-	// PreventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod
+	// preventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod
 	// scheduling if the CSI driver on the node is missing.
 	//
 	// Enabling this option will prevent the scheduler (or any other
@@ -512,7 +514,7 @@ type CSIDriverSpec struct {
 	// newly created node may be rejected by the scheduler because of missing CSI driver
 	// information from the node.
 	//
-	// This is an alpha feature and requires the VolumeLimitScaling feature gate to be enabled.
+	// This is a beta feature and requires the VolumeLimitScaling feature gate to be enabled.
 	// Default is "false".
 	// +featureGate=VolumeLimitScaling
 	// +optional
@@ -591,6 +593,7 @@ const (
 // +k8s:prerelease-lifecycle-gen:deprecated=1.17
 // +k8s:prerelease-lifecycle-gen:removed=1.22
 // +k8s:prerelease-lifecycle-gen:replacement=storage.k8s.io,v1,CSINode
+// +k8s:supportsSubresource="/status"
 
 // DEPRECATED - This group version of CSINode is deprecated by storage/v1/CSINode.
 // See the release notes for more information.
@@ -604,13 +607,18 @@ const (
 // enough that it doesn't create this object.
 // CSINode has an OwnerReference that points to the corresponding node object.
 type CSINode struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
+	// metadata is the standard object metadata.
 	// metadata.name must be the Kubernetes node name.
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// spec is the specification of CSINode
 	Spec CSINodeSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
+
+	// status contains health and status information for the node's storage.
+	// +optional
+	Status CSINodeStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
 }
 
 // CSINodeSpec holds information about the specification of all CSI drivers installed on a node
@@ -671,6 +679,67 @@ type VolumeNodeResources struct {
 	Count *int32 `json:"count,omitempty" protobuf:"varint,1,opt,name=count"`
 }
 
+// StorageHealthStatusType describes the health status category of a storage backend.
+// +enum
+type StorageHealthStatusType string
+
+const (
+	// StorageUnreachable indicates the storage backend is unreachable.
+	StorageUnreachable StorageHealthStatusType = "StorageUnreachable"
+	// StorageDegraded indicates the storage backend is functioning with reduced capability.
+	StorageDegraded StorageHealthStatusType = "StorageDegraded"
+)
+
+// StorageHealthCondition represents an adverse health condition reported
+// by a CSI driver for its storage backend on a node.
+type StorageHealthCondition struct {
+	// status is the health status category.
+	// One of "StorageUnreachable", "StorageDegraded".
+	// +required
+	Status StorageHealthStatusType `json:"status" protobuf:"bytes,1,opt,name=status,casttype=StorageHealthStatusType"`
+	// reason is a brief CamelCase machine-parseable reason.
+	// +required
+	// Maximum permitted length of a reason is 256 characters.
+	Reason string `json:"reason" protobuf:"bytes,2,opt,name=reason"`
+	// message is a human-readable description.
+	// +optional
+	// Maximum permitted length of a message is 1024 characters.
+	Message string `json:"message,omitempty" protobuf:"bytes,3,opt,name=message"`
+	// accessMode is the access mode affected. Nil means all access modes are affected.
+	// +optional
+	AccessMode *v1.PersistentVolumeAccessMode `json:"accessMode,omitempty" protobuf:"bytes,4,opt,name=accessMode,casttype=k8s.io/api/core/v1.PersistentVolumeAccessMode"`
+	// volumeMode is the volume mode affected. Nil means both are affected.
+	// +optional
+	VolumeMode *v1.PersistentVolumeMode `json:"volumeMode,omitempty" protobuf:"bytes,5,opt,name=volumeMode,casttype=k8s.io/api/core/v1.PersistentVolumeMode"`
+	// lastTransitionTime is when this condition first appeared at its current state.
+	// +optional
+	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,6,opt,name=lastTransitionTime"`
+}
+
+// StorageHealth contains storage backend health reported by a CSI driver on a node.
+type StorageHealth struct {
+	// name is the CSI driver name, matching CSINodeDriver.name.
+	// +required
+	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
+	// healthConditions are the adverse storage backend conditions reported by the CSI driver.
+	// At most 16 conditions may be reported.
+	// +optional
+	// +listType=atomic
+	HealthConditions []StorageHealthCondition `json:"healthConditions,omitempty" protobuf:"bytes,2,rep,name=healthConditions"`
+}
+
+// CSINodeStatus contains health and status information for storage on a node.
+type CSINodeStatus struct {
+	// storageHealth contains backend health reports for CSI drivers registered on the node.
+	// +optional
+	// +listType=map
+	// +listMapKey=name
+	// +patchMergeKey=name
+	// +patchStrategy=merge
+	// +featureGate=CSIVolumeHealth
+	StorageHealth []StorageHealth `json:"storageHealth,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,1,rep,name=storageHealth"`
+}
+
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +k8s:prerelease-lifecycle-gen:introduced=1.14
 // +k8s:prerelease-lifecycle-gen:deprecated=1.17
@@ -679,7 +748,7 @@ type VolumeNodeResources struct {
 
 // CSINodeList is a collection of CSINode objects.
 type CSINodeList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -721,9 +790,9 @@ type CSINodeList struct {
 // the scheduler assumes that capacity is insufficient and tries some other
 // node.
 type CSIStorageCapacity struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata. The name has no particular meaning. It must be
+	// metadata is the standard object metadata. The name has no particular meaning. It must be
 	// be a DNS subdomain (dots allowed, 253 characters). To ensure that
 	// there are no conflicts with other CSI drivers on the cluster, the recommendation
 	// is to use csisc-<uuid>, a generated name, or a reverse-domain name which ends
@@ -786,7 +855,7 @@ type CSIStorageCapacity struct {
 
 // CSIStorageCapacityList is a collection of CSIStorageCapacity objects.
 type CSIStorageCapacityList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -808,14 +877,14 @@ type CSIStorageCapacityList struct {
 // defined by the CSI driver. The class can be specified during dynamic provisioning
 // of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.
 type VolumeAttributesClass struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
-	// Standard object's metadata.
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
-	// Name of the CSI driver
+	// driverName is the name of the CSI driver
 	// This field is immutable.
 	DriverName string `json:"driverName" protobuf:"bytes,2,opt,name=driverName"`
 
@@ -842,7 +911,7 @@ type VolumeAttributesClass struct {
 
 // VolumeAttributesClassList is a collection of VolumeAttributesClass objects.
 type VolumeAttributesClassList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
diff --git a/vendor/k8s.io/api/storage/v1beta1/types_swagger_doc_generated.go b/vendor/k8s.io/api/storage/v1beta1/types_swagger_doc_generated.go
index 80b68839b4..8a12d1f8c0 100644
--- a/vendor/k8s.io/api/storage/v1beta1/types_swagger_doc_generated.go
+++ b/vendor/k8s.io/api/storage/v1beta1/types_swagger_doc_generated.go
@@ -29,7 +29,7 @@ package v1beta1
 // AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
 var map_CSIDriver = map[string]string{
 	"":         "CSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster. CSI drivers do not need to create the CSIDriver object directly. Instead they may use the cluster-driver-registrar sidecar container. When deployed with a CSI driver it automatically creates a CSIDriver object representing the driver. Kubernetes attach detach controller uses this object to determine whether attach is required. Kubelet uses this object to determine whether pod information needs to be passed on mount. CSIDriver objects are non-namespaced.",
-	"metadata": "Standard object metadata. metadata.Name indicates the name of the CSI driver that this object refers to; it MUST be the same name returned by the CSI GetPluginName() call for that driver. The driver name must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. metadata.Name indicates the name of the CSI driver that this object refers to; it MUST be the same name returned by the CSI GetPluginName() call for that driver. The driver name must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec represents the specification of the CSI Driver.",
 }
 
@@ -59,7 +59,7 @@ var map_CSIDriverSpec = map[string]string{
 	"seLinuxMount":                       "seLinuxMount specifies if the CSI driver supports \"-o context\" mount option.\n\nWhen \"true\", the CSI driver must ensure that all volumes provided by this CSI driver can be mounted separately with different `-o context` options. This is typical for storage backends that provide volumes as filesystems on block devices or as independent shared volumes. Kubernetes will call NodeStage / NodePublish with \"-o context=xyz\" mount option when mounting a ReadWriteOncePod volume used in Pod that has explicitly set SELinux context. In the future, it may be expanded to other volume AccessModes. In any case, Kubernetes will ensure that the volume is mounted only with a single SELinux context.\n\nWhen \"false\", Kubernetes won't pass any special SELinux mount options to the driver. This is typical for volumes that represent subdirectories of a bigger shared filesystem.\n\nDefault is \"false\".",
 	"nodeAllocatableUpdatePeriodSeconds": "nodeAllocatableUpdatePeriodSeconds specifies the interval between periodic updates of the CSINode allocatable capacity for this driver. When set, both periodic updates and updates triggered by capacity-related failures are enabled. If not set, no updates occur (neither periodic nor upon detecting capacity-related failures), and the allocatable.count remains static. The minimum allowed value for this field is 10 seconds.\n\nThis is a beta feature and requires the MutableCSINodeAllocatableCount feature gate to be enabled.\n\nThis field is mutable.",
 	"serviceAccountTokenInSecrets":       "serviceAccountTokenInSecrets is an opt-in for CSI drivers to indicate that service account tokens should be passed via the Secrets field in NodePublishVolumeRequest instead of the VolumeContext field. The CSI specification provides a dedicated Secrets field for sensitive information like tokens, which is the appropriate mechanism for handling credentials. This addresses security concerns where sensitive tokens were being logged as part of volume context.\n\nWhen \"true\", kubelet will pass the tokens only in the Secrets field with the key \"csi.storage.k8s.io/serviceAccount.tokens\". The CSI driver must be updated to read tokens from the Secrets field instead of VolumeContext.\n\nWhen \"false\" or not set, kubelet will pass the tokens in VolumeContext with the key \"csi.storage.k8s.io/serviceAccount.tokens\" (existing behavior). This maintains backward compatibility with existing CSI drivers.\n\nThis field can only be set when TokenRequests is configured. The API server will reject CSIDriver specs that set this field without TokenRequests.\n\nDefault behavior if unset is to pass tokens in the VolumeContext field.",
-	"preventPodSchedulingIfMissing":      "PreventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod scheduling if the CSI driver on the node is missing.\n\nEnabling this option will prevent the scheduler (or any other component which embeds default scheduler such as cluster-autoscaler) from scheduling pods to nodes where CSI driver is not installed.\n\nFor components(such as cluster-autoscaler) that embed the scheduler and run pod placement simulations using scheduler plugins, they MUST be aware of CSI driver registration information via CSINode object. They must create simulated CSINode objects in addition to Node objects during scheduling simulation, otherwise if PreventPodSchedulingIfMissing is enabled globally for CSIDriver object, any newly created node may be rejected by the scheduler because of missing CSI driver information from the node.\n\nThis is an alpha feature and requires the VolumeLimitScaling feature gate to be enabled. Default is \"false\".",
+	"preventPodSchedulingIfMissing":      "preventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod scheduling if the CSI driver on the node is missing.\n\nEnabling this option will prevent the scheduler (or any other component which embeds default scheduler such as cluster-autoscaler) from scheduling pods to nodes where CSI driver is not installed.\n\nFor components(such as cluster-autoscaler) that embed the scheduler and run pod placement simulations using scheduler plugins, they MUST be aware of CSI driver registration information via CSINode object. They must create simulated CSINode objects in addition to Node objects during scheduling simulation, otherwise if PreventPodSchedulingIfMissing is enabled globally for CSIDriver object, any newly created node may be rejected by the scheduler because of missing CSI driver information from the node.\n\nThis is a beta feature and requires the VolumeLimitScaling feature gate to be enabled. Default is \"false\".",
 }
 
 func (CSIDriverSpec) SwaggerDoc() map[string]string {
@@ -68,8 +68,9 @@ func (CSIDriverSpec) SwaggerDoc() map[string]string {
 
 var map_CSINode = map[string]string{
 	"":         "DEPRECATED - This group version of CSINode is deprecated by storage/v1/CSINode. See the release notes for more information. CSINode holds information about all CSI drivers installed on a node. CSI drivers do not need to create the CSINode object directly. As long as they use the node-driver-registrar sidecar container, the kubelet will automatically populate the CSINode object for the CSI driver as part of kubelet plugin registration. CSINode has the same name as a node. If the object is missing, it means either there are no CSI Drivers available on the node, or the Kubelet version is low enough that it doesn't create this object. CSINode has an OwnerReference that points to the corresponding node object.",
-	"metadata": "metadata.name must be the Kubernetes node name.",
+	"metadata": "metadata is the standard object metadata. metadata.name must be the Kubernetes node name.",
 	"spec":     "spec is the specification of CSINode",
+	"status":   "status contains health and status information for the node's storage.",
 }
 
 func (CSINode) SwaggerDoc() map[string]string {
@@ -107,9 +108,18 @@ func (CSINodeSpec) SwaggerDoc() map[string]string {
 	return map_CSINodeSpec
 }
 
+var map_CSINodeStatus = map[string]string{
+	"":              "CSINodeStatus contains health and status information for storage on a node.",
+	"storageHealth": "storageHealth contains backend health reports for CSI drivers registered on the node.",
+}
+
+func (CSINodeStatus) SwaggerDoc() map[string]string {
+	return map_CSINodeStatus
+}
+
 var map_CSIStorageCapacity = map[string]string{
 	"":                  "CSIStorageCapacity stores the result of one CSI GetCapacity call. For a given StorageClass, this describes the available capacity in a particular topology segment.  This can be used when considering where to instantiate new PersistentVolumes.\n\nFor example this can express things like: - StorageClass \"standard\" has \"1234 GiB\" available in \"topology.kubernetes.io/zone=us-east1\" - StorageClass \"localssd\" has \"10 GiB\" available in \"kubernetes.io/hostname=knode-abc123\"\n\nThe following three cases all imply that no capacity is available for a certain combination: - no object exists with suitable topology and storage class name - such an object exists, but the capacity is unset - such an object exists, but the capacity is zero\n\nThe producer of these objects can decide which approach is more suitable.\n\nThey are consumed by the kube-scheduler when a CSI driver opts into capacity-aware scheduling with CSIDriverSpec.StorageCapacity. The scheduler compares the MaximumVolumeSize against the requested size of pending volumes to filter out unsuitable nodes. If MaximumVolumeSize is unset, it falls back to a comparison against the less precise Capacity. If that is also unset, the scheduler assumes that capacity is insufficient and tries some other node.",
-	"metadata":          "Standard object's metadata. The name has no particular meaning. It must be be a DNS subdomain (dots allowed, 253 characters). To ensure that there are no conflicts with other CSI drivers on the cluster, the recommendation is to use csisc-<uuid>, a generated name, or a reverse-domain name which ends with the unique CSI driver name.\n\nObjects are namespaced.\n\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata":          "metadata is the standard object metadata. The name has no particular meaning. It must be be a DNS subdomain (dots allowed, 253 characters). To ensure that there are no conflicts with other CSI drivers on the cluster, the recommendation is to use csisc-<uuid>, a generated name, or a reverse-domain name which ends with the unique CSI driver name.\n\nObjects are namespaced.\n\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"nodeTopology":      "nodeTopology defines which nodes have access to the storage for which capacity was reported. If not set, the storage is not accessible from any node in the cluster. If empty, the storage is accessible from all nodes. This field is immutable.",
 	"storageClassName":  "storageClassName represents the name of the StorageClass that the reported capacity applies to. It must meet the same requirements as the name of a StorageClass object (non-empty, DNS subdomain). If that object no longer exists, the CSIStorageCapacity object is obsolete and should be removed by its creator. This field is immutable.",
 	"capacity":          "capacity is the value reported by the CSI driver in its GetCapacityResponse for a GetCapacityRequest with topology and parameters that match the previous fields.\n\nThe semantic is currently (CSI spec 1.2) defined as: The available capacity, in bytes, of the storage that can be used to provision volumes. If not set, that information is currently unavailable.",
@@ -132,7 +142,7 @@ func (CSIStorageCapacityList) SwaggerDoc() map[string]string {
 
 var map_StorageClass = map[string]string{
 	"":                     "StorageClass describes the parameters for a class of storage for which PersistentVolumes can be dynamically provisioned.\n\nStorageClasses are non-namespaced; the name of the storage class according to etcd is in ObjectMeta.Name.",
-	"metadata":             "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata":             "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"provisioner":          "provisioner indicates the type of the provisioner.",
 	"parameters":           "parameters holds the parameters for the provisioner that should create volumes of this storage class.",
 	"reclaimPolicy":        "reclaimPolicy controls the reclaimPolicy for dynamically provisioned PersistentVolumes of this storage class. Defaults to Delete.",
@@ -156,6 +166,30 @@ func (StorageClassList) SwaggerDoc() map[string]string {
 	return map_StorageClassList
 }
 
+var map_StorageHealth = map[string]string{
+	"":                 "StorageHealth contains storage backend health reported by a CSI driver on a node.",
+	"name":             "name is the CSI driver name, matching CSINodeDriver.name.",
+	"healthConditions": "healthConditions are the adverse storage backend conditions reported by the CSI driver. At most 16 conditions may be reported.",
+}
+
+func (StorageHealth) SwaggerDoc() map[string]string {
+	return map_StorageHealth
+}
+
+var map_StorageHealthCondition = map[string]string{
+	"":                   "StorageHealthCondition represents an adverse health condition reported by a CSI driver for its storage backend on a node.",
+	"status":             "status is the health status category. One of \"StorageUnreachable\", \"StorageDegraded\".",
+	"reason":             "reason is a brief CamelCase machine-parseable reason. Maximum permitted length of a reason is 256 characters.",
+	"message":            "message is a human-readable description. Maximum permitted length of a message is 1024 characters.",
+	"accessMode":         "accessMode is the access mode affected. Nil means all access modes are affected.",
+	"volumeMode":         "volumeMode is the volume mode affected. Nil means both are affected.",
+	"lastTransitionTime": "lastTransitionTime is when this condition first appeared at its current state.",
+}
+
+func (StorageHealthCondition) SwaggerDoc() map[string]string {
+	return map_StorageHealthCondition
+}
+
 var map_TokenRequest = map[string]string{
 	"":                  "TokenRequest contains parameters of a service account token.",
 	"audience":          "audience is the intended audience of the token in \"TokenRequestSpec\". It will default to the audiences of kube apiserver.",
@@ -168,7 +202,7 @@ func (TokenRequest) SwaggerDoc() map[string]string {
 
 var map_VolumeAttachment = map[string]string{
 	"":         "VolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.\n\nVolumeAttachment objects are non-namespaced.",
-	"metadata": "Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"metadata": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
 	"spec":     "spec represents specification of the desired attach/detach volume behavior. Populated by the Kubernetes system.",
 	"status":   "status represents status of the VolumeAttachment request. Populated by the entity completing the attach or detach operation, i.e. the external-attacher.",
 }
@@ -190,6 +224,7 @@ func (VolumeAttachmentList) SwaggerDoc() map[string]string {
 var map_VolumeAttachmentSource = map[string]string{
 	"":                     "VolumeAttachmentSource represents a volume that should be attached. Right now only PersistentVolumes can be attached via external attacher, in the future we may allow also inline volumes in pods. Exactly one member can be set.",
 	"persistentVolumeName": "persistentVolumeName represents the name of the persistent volume to attach.",
+	"inlineVolumeSpec":     "inlineVolumeSpec contains all the information necessary to attach a persistent volume defined by a pod's inline VolumeSource. This field is populated only for the CSIMigration feature. It contains translated fields from a pod's inline VolumeSource to a PersistentVolumeSpec. This field is beta-level and is only honored by servers that enabled the CSIMigration feature.",
 }
 
 func (VolumeAttachmentSource) SwaggerDoc() map[string]string {
@@ -221,8 +256,8 @@ func (VolumeAttachmentStatus) SwaggerDoc() map[string]string {
 
 var map_VolumeAttributesClass = map[string]string{
 	"":           "VolumeAttributesClass represents a specification of mutable volume attributes defined by the CSI driver. The class can be specified during dynamic provisioning of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.",
-	"metadata":   "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
-	"driverName": "Name of the CSI driver This field is immutable.",
+	"metadata":   "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"driverName": "driverName is the name of the CSI driver This field is immutable.",
 	"parameters": "parameters hold volume attributes defined by the CSI driver. These values are opaque to the Kubernetes and are passed directly to the CSI driver. The underlying storage provider supports changing these attributes on an existing volume, however the parameters field itself is immutable. To invoke a volume update, a new VolumeAttributesClass should be created with new parameters, and the PersistentVolumeClaim should be updated to reference the new VolumeAttributesClass.\n\nThis field is required and must contain at least one key/value pair. The keys cannot be empty, and the maximum number of parameters is 512, with a cumulative max size of 256K. If the CSI driver rejects invalid parameters, the target PersistentVolumeClaim will be set to an \"Infeasible\" state in the modifyVolumeStatus field.",
 }
 
diff --git a/vendor/k8s.io/api/storage/v1beta1/zz_generated.deepcopy.go b/vendor/k8s.io/api/storage/v1beta1/zz_generated.deepcopy.go
index ca28e0340c..88b0581780 100644
--- a/vendor/k8s.io/api/storage/v1beta1/zz_generated.deepcopy.go
+++ b/vendor/k8s.io/api/storage/v1beta1/zz_generated.deepcopy.go
@@ -166,6 +166,7 @@ func (in *CSINode) DeepCopyInto(out *CSINode) {
 	out.TypeMeta = in.TypeMeta
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
 	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
 	return
 }
 
@@ -269,6 +270,29 @@ func (in *CSINodeSpec) DeepCopy() *CSINodeSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CSINodeStatus) DeepCopyInto(out *CSINodeStatus) {
+	*out = *in
+	if in.StorageHealth != nil {
+		in, out := &in.StorageHealth, &out.StorageHealth
+		*out = make([]StorageHealth, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CSINodeStatus.
+func (in *CSINodeStatus) DeepCopy() *CSINodeStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(CSINodeStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CSIStorageCapacity) DeepCopyInto(out *CSIStorageCapacity) {
 	*out = *in
@@ -436,6 +460,56 @@ func (in *StorageClassList) DeepCopyObject() runtime.Object {
 	return nil
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StorageHealth) DeepCopyInto(out *StorageHealth) {
+	*out = *in
+	if in.HealthConditions != nil {
+		in, out := &in.HealthConditions, &out.HealthConditions
+		*out = make([]StorageHealthCondition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StorageHealth.
+func (in *StorageHealth) DeepCopy() *StorageHealth {
+	if in == nil {
+		return nil
+	}
+	out := new(StorageHealth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StorageHealthCondition) DeepCopyInto(out *StorageHealthCondition) {
+	*out = *in
+	if in.AccessMode != nil {
+		in, out := &in.AccessMode, &out.AccessMode
+		*out = new(corev1.PersistentVolumeAccessMode)
+		**out = **in
+	}
+	if in.VolumeMode != nil {
+		in, out := &in.VolumeMode, &out.VolumeMode
+		*out = new(corev1.PersistentVolumeMode)
+		**out = **in
+	}
+	in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StorageHealthCondition.
+func (in *StorageHealthCondition) DeepCopy() *StorageHealthCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(StorageHealthCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TokenRequest) DeepCopyInto(out *TokenRequest) {
 	*out = *in
diff --git a/vendor/k8s.io/api/storage/v1beta1/zz_generated.model_name.go b/vendor/k8s.io/api/storage/v1beta1/zz_generated.model_name.go
index 8453d86b22..fe654676ba 100644
--- a/vendor/k8s.io/api/storage/v1beta1/zz_generated.model_name.go
+++ b/vendor/k8s.io/api/storage/v1beta1/zz_generated.model_name.go
@@ -56,6 +56,11 @@ func (in CSINodeSpec) OpenAPIModelName() string {
 	return "io.k8s.api.storage.v1beta1.CSINodeSpec"
 }
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in CSINodeStatus) OpenAPIModelName() string {
+	return "io.k8s.api.storage.v1beta1.CSINodeStatus"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in CSIStorageCapacity) OpenAPIModelName() string {
 	return "io.k8s.api.storage.v1beta1.CSIStorageCapacity"
@@ -76,6 +81,16 @@ func (in StorageClassList) OpenAPIModelName() string {
 	return "io.k8s.api.storage.v1beta1.StorageClassList"
 }
 
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in StorageHealth) OpenAPIModelName() string {
+	return "io.k8s.api.storage.v1beta1.StorageHealth"
+}
+
+// OpenAPIModelName returns the OpenAPI model name for this type.
+func (in StorageHealthCondition) OpenAPIModelName() string {
+	return "io.k8s.api.storage.v1beta1.StorageHealthCondition"
+}
+
 // OpenAPIModelName returns the OpenAPI model name for this type.
 func (in TokenRequest) OpenAPIModelName() string {
 	return "io.k8s.api.storage.v1beta1.TokenRequest"
diff --git a/vendor/k8s.io/api/apidiscovery/v2beta1/doc.go b/vendor/k8s.io/api/storagemigration/v1/doc.go
similarity index 81%
rename from vendor/k8s.io/api/apidiscovery/v2beta1/doc.go
rename to vendor/k8s.io/api/storagemigration/v1/doc.go
index 244986bb41..4c122fa5ca 100644
--- a/vendor/k8s.io/api/apidiscovery/v2beta1/doc.go
+++ b/vendor/k8s.io/api/storagemigration/v1/doc.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2022 The Kubernetes Authors.
+Copyright The Kubernetes Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -18,8 +18,8 @@ limitations under the License.
 // +k8s:protobuf-gen=package
 // +k8s:openapi-gen=true
 // +k8s:prerelease-lifecycle-gen=true
-// +k8s:openapi-model-package=io.k8s.api.apidiscovery.v2beta1
+// +k8s:openapi-model-package=io.k8s.api.storagemigration.v1
 
-// +groupName=apidiscovery.k8s.io
+// +groupName=storagemigration.k8s.io
 
-package v2beta1
+package v1
diff --git a/vendor/k8s.io/api/storagemigration/v1/generated.pb.go b/vendor/k8s.io/api/storagemigration/v1/generated.pb.go
new file mode 100644
index 0000000000..9f4e58652b
--- /dev/null
+++ b/vendor/k8s.io/api/storagemigration/v1/generated.pb.go
@@ -0,0 +1,904 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: k8s.io/api/storagemigration/v1/generated.proto
+
+package v1
+
+import (
+	fmt "fmt"
+
+	io "io"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	math_bits "math/bits"
+	reflect "reflect"
+	strings "strings"
+)
+
+func (m *StorageVersionMigration) Reset() { *m = StorageVersionMigration{} }
+
+func (m *StorageVersionMigrationList) Reset() { *m = StorageVersionMigrationList{} }
+
+func (m *StorageVersionMigrationSpec) Reset() { *m = StorageVersionMigrationSpec{} }
+
+func (m *StorageVersionMigrationStatus) Reset() { *m = StorageVersionMigrationStatus{} }
+
+func (m *StorageVersionMigration) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *StorageVersionMigration) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *StorageVersionMigration) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.Status.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x1a
+	{
+		size, err := m.Spec.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0x12
+	{
+		size, err := m.ObjectMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *StorageVersionMigrationList) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *StorageVersionMigrationList) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *StorageVersionMigrationList) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Items[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	{
+		size, err := m.ListMeta.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *StorageVersionMigrationSpec) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *StorageVersionMigrationSpec) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *StorageVersionMigrationSpec) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	{
+		size, err := m.Resource.MarshalToSizedBuffer(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = encodeVarintGenerated(dAtA, i, uint64(size))
+	}
+	i--
+	dAtA[i] = 0xa
+	return len(dAtA) - i, nil
+}
+
+func (m *StorageVersionMigrationStatus) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *StorageVersionMigrationStatus) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *StorageVersionMigrationStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	i -= len(m.ResourceVersion)
+	copy(dAtA[i:], m.ResourceVersion)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.ResourceVersion)))
+	i--
+	dAtA[i] = 0x12
+	if len(m.Conditions) > 0 {
+		for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *StorageVersionMigration) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ObjectMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Spec.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	l = m.Status.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *StorageVersionMigrationList) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.ListMeta.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *StorageVersionMigrationSpec) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = m.Resource.Size()
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func (m *StorageVersionMigrationStatus) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Conditions) > 0 {
+		for _, e := range m.Conditions {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
+	l = len(m.ResourceVersion)
+	n += 1 + l + sovGenerated(uint64(l))
+	return n
+}
+
+func sovGenerated(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozGenerated(x uint64) (n int) {
+	return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (this *StorageVersionMigration) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&StorageVersionMigration{`,
+		`ObjectMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ObjectMeta), "ObjectMeta", "v1.ObjectMeta", 1), `&`, ``, 1) + `,`,
+		`Spec:` + strings.Replace(strings.Replace(this.Spec.String(), "StorageVersionMigrationSpec", "StorageVersionMigrationSpec", 1), `&`, ``, 1) + `,`,
+		`Status:` + strings.Replace(strings.Replace(this.Status.String(), "StorageVersionMigrationStatus", "StorageVersionMigrationStatus", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *StorageVersionMigrationList) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForItems := "[]StorageVersionMigration{"
+	for _, f := range this.Items {
+		repeatedStringForItems += strings.Replace(strings.Replace(f.String(), "StorageVersionMigration", "StorageVersionMigration", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForItems += "}"
+	s := strings.Join([]string{`&StorageVersionMigrationList{`,
+		`ListMeta:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.ListMeta), "ListMeta", "v1.ListMeta", 1), `&`, ``, 1) + `,`,
+		`Items:` + repeatedStringForItems + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *StorageVersionMigrationSpec) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&StorageVersionMigrationSpec{`,
+		`Resource:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.Resource), "GroupResource", "v1.GroupResource", 1), `&`, ``, 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *StorageVersionMigrationStatus) String() string {
+	if this == nil {
+		return "nil"
+	}
+	repeatedStringForConditions := "[]Condition{"
+	for _, f := range this.Conditions {
+		repeatedStringForConditions += fmt.Sprintf("%v", f) + ","
+	}
+	repeatedStringForConditions += "}"
+	s := strings.Join([]string{`&StorageVersionMigrationStatus{`,
+		`Conditions:` + repeatedStringForConditions + `,`,
+		`ResourceVersion:` + fmt.Sprintf("%v", this.ResourceVersion) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func valueToStringGenerated(v interface{}) string {
+	rv := reflect.ValueOf(v)
+	if rv.IsNil() {
+		return "nil"
+	}
+	pv := reflect.Indirect(rv).Interface()
+	return fmt.Sprintf("*%v", pv)
+}
+func (m *StorageVersionMigration) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: StorageVersionMigration: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: StorageVersionMigration: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ObjectMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ObjectMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Status.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *StorageVersionMigrationList) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: StorageVersionMigrationList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: StorageVersionMigrationList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ListMeta", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.ListMeta.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, StorageVersionMigration{})
+			if err := m.Items[len(m.Items)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *StorageVersionMigrationSpec) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: StorageVersionMigrationSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: StorageVersionMigrationSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Resource", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if err := m.Resource.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *StorageVersionMigrationStatus) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: StorageVersionMigrationStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: StorageVersionMigrationStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Conditions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Conditions = append(m.Conditions, v1.Condition{})
+			if err := m.Conditions[len(m.Conditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResourceVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ResourceVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipGenerated(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLengthGenerated
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupGenerated
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthGenerated
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+var (
+	ErrInvalidLengthGenerated        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowGenerated          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupGenerated = fmt.Errorf("proto: unexpected end of group")
+)
diff --git a/vendor/k8s.io/api/storagemigration/v1/generated.proto b/vendor/k8s.io/api/storagemigration/v1/generated.proto
new file mode 100644
index 0000000000..ada3c15113
--- /dev/null
+++ b/vendor/k8s.io/api/storagemigration/v1/generated.proto
@@ -0,0 +1,86 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+
+// This file was autogenerated by go-to-protobuf. Do not edit it manually!
+
+syntax = "proto2";
+
+package k8s.io.api.storagemigration.v1;
+
+import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
+import "k8s.io/apimachinery/pkg/runtime/generated.proto";
+import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
+
+// Package-wide variables from generator "generated".
+option go_package = "k8s.io/api/storagemigration/v1";
+
+// StorageVersionMigration represents a migration of stored data to the latest
+// storage version.
+// +k8s:supportsSubresource="/status"
+message StorageVersionMigration {
+  // Standard object metadata.
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
+
+  // Specification of the migration.
+  // +optional
+  optional StorageVersionMigrationSpec spec = 2;
+
+  // Status of the migration.
+  // +optional
+  optional StorageVersionMigrationStatus status = 3;
+}
+
+// StorageVersionMigrationList is a collection of storage version migrations.
+message StorageVersionMigrationList {
+  // Standard list metadata
+  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+  // +optional
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
+
+  // Items is the list of StorageVersionMigration
+  repeated StorageVersionMigration items = 2;
+}
+
+// Spec of the storage version migration.
+message StorageVersionMigrationSpec {
+  // The resource that is being migrated. The migrator sends requests to
+  // the endpoint serving the resource.
+  // Immutable.
+  optional .k8s.io.apimachinery.pkg.apis.meta.v1.GroupResource resource = 1;
+}
+
+// Status of the storage version migration.
+message StorageVersionMigrationStatus {
+  // The latest available observations of the migration's current state.
+  // +patchMergeKey=type
+  // +patchStrategy=merge
+  // +listType=map
+  // +listMapKey=type
+  // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+  repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 1;
+
+  // ResourceVersion to compare with the GC cache for performing the migration.
+  // This is the current resource version of given group, version and resource when
+  // kube-controller-manager first observes this StorageVersionMigration resource.
+  optional string resourceVersion = 2;
+}
+
diff --git a/vendor/k8s.io/api/apidiscovery/v2beta1/register.go b/vendor/k8s.io/api/storagemigration/v1/register.go
similarity index 77%
rename from vendor/k8s.io/api/apidiscovery/v2beta1/register.go
rename to vendor/k8s.io/api/storagemigration/v1/register.go
index f7cef10812..d03db0c4db 100644
--- a/vendor/k8s.io/api/apidiscovery/v2beta1/register.go
+++ b/vendor/k8s.io/api/storagemigration/v1/register.go
@@ -1,5 +1,5 @@
 /*
-Copyright 2022 The Kubernetes Authors.
+Copyright The Kubernetes Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,19 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package v2beta1
+package v1
 
 import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-// GroupName is the group name for this API.
-const GroupName = "apidiscovery.k8s.io"
+// GroupName is the group name use in this package
+const GroupName = "storagemigration.k8s.io"
 
 // SchemeGroupVersion is group version used to register these objects
-var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v2beta1"}
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
 
 // Kind takes an unqualified kind and returns a Group qualified GroupKind
 func Kind(kind string) schema.GroupKind {
@@ -39,18 +40,19 @@ func Resource(resource string) schema.GroupResource {
 }
 
 var (
-	// SchemeBuilder installs the api group to a scheme
-	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
-	// AddToScheme adds api to a scheme
-	AddToScheme = SchemeBuilder.AddToScheme
+	SchemeBuilder      = runtime.NewSchemeBuilder(addKnownTypes)
+	localSchemeBuilder = &SchemeBuilder
+	AddToScheme        = localSchemeBuilder.AddToScheme
 )
 
 // Adds the list of known types to the given scheme.
 func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
-		&APIGroupDiscoveryList{},
-		&APIGroupDiscovery{},
+		&StorageVersionMigration{},
+		&StorageVersionMigrationList{},
 	)
+
+	// Add the watch version that applies
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil
 }
diff --git a/vendor/k8s.io/api/storagemigration/v1/types.go b/vendor/k8s.io/api/storagemigration/v1/types.go
new file mode 100644
index 0000000000..cead674391
--- /dev/null
+++ b/vendor/k8s.io/api/storagemigration/v1/types.go
@@ -0,0 +1,95 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+
+// StorageVersionMigration represents a migration of stored data to the latest
+// storage version.
+// +k8s:supportsSubresource="/status"
+type StorageVersionMigration struct {
+	metav1.TypeMeta `json:""`
+	// Standard object metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	// Specification of the migration.
+	// +optional
+	Spec StorageVersionMigrationSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
+	// Status of the migration.
+	// +optional
+	Status StorageVersionMigrationStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
+}
+
+// Spec of the storage version migration.
+type StorageVersionMigrationSpec struct {
+	// The resource that is being migrated. The migrator sends requests to
+	// the endpoint serving the resource.
+	// Immutable.
+	Resource metav1.GroupResource `json:"resource" protobuf:"bytes,1,opt,name=resource"`
+}
+
+type MigrationConditionType string
+
+const (
+	// Indicates that the migration is running.
+	MigrationRunning MigrationConditionType = "Running"
+	// Indicates that the migration has completed successfully.
+	MigrationSucceeded MigrationConditionType = "Succeeded"
+	// Indicates that the migration has failed.
+	MigrationFailed MigrationConditionType = "Failed"
+)
+
+// Status of the storage version migration.
+type StorageVersionMigrationStatus struct {
+	// The latest available observations of the migration's current state.
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
+	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
+	// ResourceVersion to compare with the GC cache for performing the migration.
+	// This is the current resource version of given group, version and resource when
+	// kube-controller-manager first observes this StorageVersionMigration resource.
+	ResourceVersion string `json:"resourceVersion,omitempty" protobuf:"bytes,2,opt,name=resourceVersion"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.37
+
+// StorageVersionMigrationList is a collection of storage version migrations.
+type StorageVersionMigrationList struct {
+	metav1.TypeMeta `json:""`
+
+	// Standard list metadata
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	// Items is the list of StorageVersionMigration
+	Items []StorageVersionMigration `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
diff --git a/vendor/k8s.io/api/storagemigration/v1/types_swagger_doc_generated.go b/vendor/k8s.io/api/storagemigration/v1/types_swagger_doc_generated.go
new file mode 100644
index 0000000000..a9ff380d84
--- /dev/null
+++ b/vendor/k8s.io/api/storagemigration/v1/types_swagger_doc_generated.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+// This file contains a collection of methods that can be used from go-restful to
+// generate Swagger API documentation for its models. Please read this PR for more
+// information on the implementation: https://github.com/emicklei/go-restful/pull/215
+//
+// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if
+// they are on one line! For multiple line or blocks that you want to ignore use ---.
+// Any context after a --- is ignored.
+//
+// Those methods can be generated by using hack/update-codegen.sh
+
+// AUTO-GENERATED FUNCTIONS START HERE. DO NOT EDIT.
+var map_StorageVersionMigration = map[string]string{
+	"":         "StorageVersionMigration represents a migration of stored data to the latest storage version.",
+	"metadata": "Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"spec":     "Specification of the migration.",
+	"status":   "Status of the migration.",
+}
+
+func (StorageVersionMigration) SwaggerDoc() map[string]string {
+	return map_StorageVersionMigration
+}
+
+var map_StorageVersionMigrationList = map[string]string{
+	"":         "StorageVersionMigrationList is a collection of storage version migrations.",
+	"metadata": "Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata",
+	"items":    "Items is the list of StorageVersionMigration",
+}
+
+func (StorageVersionMigrationList) SwaggerDoc() map[string]string {
+	return map_StorageVersionMigrationList
+}
+
+var map_StorageVersionMigrationSpec = map[string]string{
+	"":         "Spec of the storage version migration.",
+	"resource": "The resource that is being migrated. The migrator sends requests to the endpoint serving the resource. Immutable.",
+}
+
+func (StorageVersionMigrationSpec) SwaggerDoc() map[string]string {
+	return map_StorageVersionMigrationSpec
+}
+
+var map_StorageVersionMigrationStatus = map[string]string{
+	"":                "Status of the storage version migration.",
+	"conditions":      "The latest available observations of the migration's current state.",
+	"resourceVersion": "ResourceVersion to compare with the GC cache for performing the migration. This is the current resource version of given group, version and resource when kube-controller-manager first observes this StorageVersionMigration resource.",
+}
+
+func (StorageVersionMigrationStatus) SwaggerDoc() map[string]string {
+	return map_StorageVersionMigrationStatus
+}
+
+// AUTO-GENERATED FUNCTIONS END HERE
diff --git a/vendor/k8s.io/api/storagemigration/v1/zz_generated.deepcopy.go b/vendor/k8s.io/api/storagemigration/v1/zz_generated.deepcopy.go
new file mode 100644
index 0000000000..10ef04a084
--- /dev/null
+++ b/vendor/k8s.io/api/storagemigration/v1/zz_generated.deepcopy.go
@@ -0,0 +1,128 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StorageVersionMigration) DeepCopyInto(out *StorageVersionMigration) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Spec = in.Spec
+	in.Status.DeepCopyInto(&out.Status)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StorageVersionMigration.
+func (in *StorageVersionMigration) DeepCopy() *StorageVersionMigration {
+	if in == nil {
+		return nil
+	}
+	out := new(StorageVersionMigration)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *StorageVersionMigration) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StorageVersionMigrationList) DeepCopyInto(out *StorageVersionMigrationList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]StorageVersionMigration, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StorageVersionMigrationList.
+func (in *StorageVersionMigrationList) DeepCopy() *StorageVersionMigrationList {
+	if in == nil {
+		return nil
+	}
+	out := new(StorageVersionMigrationList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *StorageVersionMigrationList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StorageVersionMigrationSpec) DeepCopyInto(out *StorageVersionMigrationSpec) {
+	*out = *in
+	out.Resource = in.Resource
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StorageVersionMigrationSpec.
+func (in *StorageVersionMigrationSpec) DeepCopy() *StorageVersionMigrationSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(StorageVersionMigrationSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StorageVersionMigrationStatus) DeepCopyInto(out *StorageVersionMigrationStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]metav1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StorageVersionMigrationStatus.
+func (in *StorageVersionMigrationStatus) DeepCopy() *StorageVersionMigrationStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(StorageVersionMigrationStatus)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/vendor/k8s.io/api/apidiscovery/v2beta1/zz_generated.model_name.go b/vendor/k8s.io/api/storagemigration/v1/zz_generated.model_name.go
similarity index 57%
rename from vendor/k8s.io/api/apidiscovery/v2beta1/zz_generated.model_name.go
rename to vendor/k8s.io/api/storagemigration/v1/zz_generated.model_name.go
index 8054db78a2..3c5ff9ded5 100644
--- a/vendor/k8s.io/api/apidiscovery/v2beta1/zz_generated.model_name.go
+++ b/vendor/k8s.io/api/storagemigration/v1/zz_generated.model_name.go
@@ -19,29 +19,24 @@ limitations under the License.
 
 // Code generated by openapi-gen. DO NOT EDIT.
 
-package v2beta1
+package v1
 
 // OpenAPIModelName returns the OpenAPI model name for this type.
-func (in APIGroupDiscovery) OpenAPIModelName() string {
-	return "io.k8s.api.apidiscovery.v2beta1.APIGroupDiscovery"
+func (in StorageVersionMigration) OpenAPIModelName() string {
+	return "io.k8s.api.storagemigration.v1.StorageVersionMigration"
 }
 
 // OpenAPIModelName returns the OpenAPI model name for this type.
-func (in APIGroupDiscoveryList) OpenAPIModelName() string {
-	return "io.k8s.api.apidiscovery.v2beta1.APIGroupDiscoveryList"
+func (in StorageVersionMigrationList) OpenAPIModelName() string {
+	return "io.k8s.api.storagemigration.v1.StorageVersionMigrationList"
 }
 
 // OpenAPIModelName returns the OpenAPI model name for this type.
-func (in APIResourceDiscovery) OpenAPIModelName() string {
-	return "io.k8s.api.apidiscovery.v2beta1.APIResourceDiscovery"
+func (in StorageVersionMigrationSpec) OpenAPIModelName() string {
+	return "io.k8s.api.storagemigration.v1.StorageVersionMigrationSpec"
 }
 
 // OpenAPIModelName returns the OpenAPI model name for this type.
-func (in APISubresourceDiscovery) OpenAPIModelName() string {
-	return "io.k8s.api.apidiscovery.v2beta1.APISubresourceDiscovery"
-}
-
-// OpenAPIModelName returns the OpenAPI model name for this type.
-func (in APIVersionDiscovery) OpenAPIModelName() string {
-	return "io.k8s.api.apidiscovery.v2beta1.APIVersionDiscovery"
+func (in StorageVersionMigrationStatus) OpenAPIModelName() string {
+	return "io.k8s.api.storagemigration.v1.StorageVersionMigrationStatus"
 }
diff --git a/vendor/k8s.io/api/storagemigration/v1/zz_generated.prerelease-lifecycle.go b/vendor/k8s.io/api/storagemigration/v1/zz_generated.prerelease-lifecycle.go
new file mode 100644
index 0000000000..64eaaeddee
--- /dev/null
+++ b/vendor/k8s.io/api/storagemigration/v1/zz_generated.prerelease-lifecycle.go
@@ -0,0 +1,34 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by prerelease-lifecycle-gen. DO NOT EDIT.
+
+package v1
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *StorageVersionMigration) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *StorageVersionMigrationList) APILifecycleIntroduced() (major, minor int) {
+	return 1, 37
+}
diff --git a/vendor/k8s.io/api/storagemigration/v1beta1/generated.proto b/vendor/k8s.io/api/storagemigration/v1beta1/generated.proto
index d7d08d88c7..21fc7eab6c 100644
--- a/vendor/k8s.io/api/storagemigration/v1beta1/generated.proto
+++ b/vendor/k8s.io/api/storagemigration/v1beta1/generated.proto
@@ -30,6 +30,7 @@ option go_package = "k8s.io/api/storagemigration/v1beta1";
 
 // StorageVersionMigration represents a migration of stored data to the latest
 // storage version.
+// +k8s:supportsSubresource="/status"
 message StorageVersionMigration {
   // Standard object metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -72,6 +73,9 @@ message StorageVersionMigrationStatus {
   // +listType=map
   // +listMapKey=type
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:listType=map
+  // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
   repeated .k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 1;
 
   // ResourceVersion to compare with the GC cache for performing the migration.
diff --git a/vendor/k8s.io/api/storagemigration/v1beta1/types.go b/vendor/k8s.io/api/storagemigration/v1beta1/types.go
index 9655f737ae..bbbbe9f54d 100644
--- a/vendor/k8s.io/api/storagemigration/v1beta1/types.go
+++ b/vendor/k8s.io/api/storagemigration/v1beta1/types.go
@@ -24,11 +24,14 @@ import (
 // +genclient:nonNamespaced
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +k8s:prerelease-lifecycle-gen:introduced=1.35
+// +k8s:prerelease-lifecycle-gen:deprecated=1.37
+// +k8s:prerelease-lifecycle-gen:replacement=storagemigration.k8s.io,v1,StorageVersionMigration
 
 // StorageVersionMigration represents a migration of stored data to the latest
 // storage version.
+// +k8s:supportsSubresource="/status"
 type StorageVersionMigration struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 	// Standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -68,6 +71,9 @@ type StorageVersionMigrationStatus struct {
 	// +listType=map
 	// +listMapKey=type
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:listType=map
+	// +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
 	// ResourceVersion to compare with the GC cache for performing the migration.
 	// This is the current resource version of given group, version and resource when
@@ -77,10 +83,12 @@ type StorageVersionMigrationStatus struct {
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +k8s:prerelease-lifecycle-gen:introduced=1.35
+// +k8s:prerelease-lifecycle-gen:deprecated=1.37
+// +k8s:prerelease-lifecycle-gen:replacement=storagemigration.k8s.io,v1,StorageVersionMigrationList
 
 // StorageVersionMigrationList is a collection of storage version migrations.
 type StorageVersionMigrationList struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Standard list metadata
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
diff --git a/vendor/k8s.io/api/storagemigration/v1beta1/zz_generated.prerelease-lifecycle.go b/vendor/k8s.io/api/storagemigration/v1beta1/zz_generated.prerelease-lifecycle.go
index f52614f7d3..5962412fbb 100644
--- a/vendor/k8s.io/api/storagemigration/v1beta1/zz_generated.prerelease-lifecycle.go
+++ b/vendor/k8s.io/api/storagemigration/v1beta1/zz_generated.prerelease-lifecycle.go
@@ -21,6 +21,10 @@ limitations under the License.
 
 package v1beta1
 
+import (
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
 // APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
 // It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
 func (in *StorageVersionMigration) APILifecycleIntroduced() (major, minor int) {
@@ -30,13 +34,19 @@ func (in *StorageVersionMigration) APILifecycleIntroduced() (major, minor int) {
 // APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
 // It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or  "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
 func (in *StorageVersionMigration) APILifecycleDeprecated() (major, minor int) {
-	return 1, 38
+	return 1, 37
+}
+
+// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
+// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
+func (in *StorageVersionMigration) APILifecycleReplacement() schema.GroupVersionKind {
+	return schema.GroupVersionKind{Group: "storagemigration.k8s.io", Version: "v1", Kind: "StorageVersionMigration"}
 }
 
 // APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
 // It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
 func (in *StorageVersionMigration) APILifecycleRemoved() (major, minor int) {
-	return 1, 41
+	return 1, 40
 }
 
 // APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
@@ -48,11 +58,17 @@ func (in *StorageVersionMigrationList) APILifecycleIntroduced() (major, minor in
 // APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
 // It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or  "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
 func (in *StorageVersionMigrationList) APILifecycleDeprecated() (major, minor int) {
-	return 1, 38
+	return 1, 37
+}
+
+// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
+// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
+func (in *StorageVersionMigrationList) APILifecycleReplacement() schema.GroupVersionKind {
+	return schema.GroupVersionKind{Group: "storagemigration.k8s.io", Version: "v1", Kind: "StorageVersionMigrationList"}
 }
 
 // APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
 // It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or  "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
 func (in *StorageVersionMigrationList) APILifecycleRemoved() (major, minor int) {
-	return 1, 41
+	return 1, 40
 }
diff --git a/vendor/k8s.io/apimachinery/pkg/api/meta/interfaces.go b/vendor/k8s.io/apimachinery/pkg/api/meta/interfaces.go
index a35ce3bd0a..628187eeeb 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/meta/interfaces.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/meta/interfaces.go
@@ -17,6 +17,8 @@ limitations under the License.
 package meta
 
 import (
+	"context"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -109,7 +111,9 @@ type RESTMapping struct {
 // to API groups. In other words, kinds and resources should not be assumed to be
 // unique across groups.
 //
-// TODO: split into sub-interfaces
+// RESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use RESTMapperWithContext instead.
 type RESTMapper interface {
 	// KindFor takes a partial resource and returns the single match.  Returns an error if there are multiple matches
 	KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error)
@@ -133,11 +137,114 @@ type RESTMapper interface {
 	ResourceSingularizer(resource string) (singular string, err error)
 }
 
+// RESTMapperWithContext allows clients to map resources to kind, and map kind and version
+// to interfaces for manipulating those objects. It is primarily intended for
+// consumers of Kubernetes compatible REST APIs as defined in docs/devel/api-conventions.md.
+//
+// The Kubernetes API provides versioned resources and object kinds which are scoped
+// to API groups. In other words, kinds and resources should not be assumed to be
+// unique across groups.
+type RESTMapperWithContext interface {
+	// KindFor takes a partial resource and returns the single match.  Returns an error if there are multiple matches
+	KindForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error)
+
+	// KindsFor takes a partial resource and returns the list of potential kinds in priority order
+	KindsForWithContext(ctx context.Context, resource schema.GroupVersionResource) ([]schema.GroupVersionKind, error)
+
+	// ResourceFor takes a partial resource and returns the single match.  Returns an error if there are multiple matches
+	ResourceForWithContext(ctx context.Context, input schema.GroupVersionResource) (schema.GroupVersionResource, error)
+
+	// ResourcesFor takes a partial resource and returns the list of potential resource in priority order
+	ResourcesForWithContext(ctx context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionResource, error)
+
+	// RESTMapping identifies a preferred resource mapping for the provided group kind.
+	RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error)
+	// RESTMappings returns all resource mappings for the provided group kind if no
+	// version search is provided. Otherwise identifies a preferred resource mapping for
+	// the provided version(s).
+	RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error)
+
+	ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error)
+}
+
+func ToRESTMapperWithContext(m RESTMapper) RESTMapperWithContext {
+	if m == nil {
+		return nil
+	}
+	if m, ok := m.(RESTMapperWithContext); ok {
+		return m
+	}
+	return &restMapperWrapper{
+		delegate: m,
+	}
+}
+
+type restMapperWrapper struct {
+	delegate RESTMapper
+}
+
+func (m *restMapperWrapper) KindForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return m.delegate.KindFor(resource)
+}
+func (m *restMapperWrapper) KindsForWithContext(ctx context.Context, resource schema.GroupVersionResource) ([]schema.GroupVersionKind, error) {
+	return m.delegate.KindsFor(resource)
+}
+func (m *restMapperWrapper) ResourceForWithContext(ctx context.Context, input schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	return m.delegate.ResourceFor(input)
+}
+func (m *restMapperWrapper) ResourcesForWithContext(ctx context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return m.delegate.ResourcesFor(input)
+}
+func (m *restMapperWrapper) RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	return m.delegate.RESTMapping(gk, versions...)
+}
+func (m *restMapperWrapper) RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	return m.delegate.RESTMappings(gk, versions...)
+}
+func (m *restMapperWrapper) ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error) {
+	return m.delegate.ResourceSingularizer(resource)
+}
+
 // ResettableRESTMapper is a RESTMapper which is capable of resetting itself
 // from discovery.
 // All rest mappers that delegate to other rest mappers must implement this interface and dynamically
 // check if the delegate mapper supports the Reset() operation.
+//
+// ResettableRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ResettableRESTMapperWithContext instead.
 type ResettableRESTMapper interface {
 	RESTMapper
 	Reset()
 }
+
+// ResettableRESTMapperWithContext is a RESTMapper which is capable of resetting itself
+// from discovery.
+// All rest mappers that delegate to other rest mappers must implement this interface and dynamically
+// check if the delegate mapper supports the ResetWithContext() operation.
+type ResettableRESTMapperWithContext interface {
+	RESTMapperWithContext
+	ResetWithContext(ctx context.Context)
+}
+
+func ToResettableRESTMapperWithContext(m ResettableRESTMapper) ResettableRESTMapperWithContext {
+	if m == nil {
+		return nil
+	}
+	if m, ok := m.(ResettableRESTMapperWithContext); ok {
+		return m
+	}
+	return &resettableRESTMapperWrapper{
+		RESTMapperWithContext: ToRESTMapperWithContext(m),
+		delegate:              m,
+	}
+}
+
+type resettableRESTMapperWrapper struct {
+	RESTMapperWithContext
+	delegate ResettableRESTMapper
+}
+
+func (m *resettableRESTMapperWrapper) ResetWithContext(ctx context.Context) {
+	m.delegate.Reset()
+}
diff --git a/vendor/k8s.io/apimachinery/pkg/api/meta/meta.go b/vendor/k8s.io/apimachinery/pkg/api/meta/meta.go
index 2551f07f5c..4bf24da522 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/meta/meta.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/meta/meta.go
@@ -600,6 +600,7 @@ func (a genericAccessor) GetOwnerReferences() []metav1.OwnerReference {
 	var ret []metav1.OwnerReference
 	s := a.ownerReferences
 	if s.Kind() != reflect.Pointer || s.Elem().Kind() != reflect.Slice {
+		//nolint:logcheck // Should not happen.
 		klog.Errorf("expect %v to be a pointer to slice", s)
 		return ret
 	}
@@ -608,6 +609,7 @@ func (a genericAccessor) GetOwnerReferences() []metav1.OwnerReference {
 	ret = make([]metav1.OwnerReference, s.Len(), s.Len()+1)
 	for i := 0; i < s.Len(); i++ {
 		if err := extractFromOwnerReference(s.Index(i), &ret[i]); err != nil {
+			//nolint:logcheck // Should not happen.
 			klog.Errorf("extractFromOwnerReference failed: %v", err)
 			return ret
 		}
@@ -618,12 +620,14 @@ func (a genericAccessor) GetOwnerReferences() []metav1.OwnerReference {
 func (a genericAccessor) SetOwnerReferences(references []metav1.OwnerReference) {
 	s := a.ownerReferences
 	if s.Kind() != reflect.Pointer || s.Elem().Kind() != reflect.Slice {
+		//nolint:logcheck // Should not happen.
 		klog.Errorf("expect %v to be a pointer to slice", s)
 	}
 	s = s.Elem()
 	newReferences := reflect.MakeSlice(s.Type(), len(references), len(references))
 	for i := 0; i < len(references); i++ {
 		if err := setOwnerReference(newReferences.Index(i), &references[i]); err != nil {
+			//nolint:logcheck // Should not happen.
 			klog.Errorf("setOwnerReference failed: %v", err)
 			return
 		}
diff --git a/vendor/k8s.io/apimachinery/pkg/api/meta/multirestmapper.go b/vendor/k8s.io/apimachinery/pkg/api/meta/multirestmapper.go
index b7e9712505..2b2c143ce7 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/meta/multirestmapper.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/meta/multirestmapper.go
@@ -17,6 +17,7 @@ limitations under the License.
 package meta
 
 import (
+	"context"
 	"fmt"
 	"strings"
 
@@ -25,13 +26,31 @@ import (
 )
 
 var (
-	_ ResettableRESTMapper = MultiRESTMapper{}
+	_ ResettableRESTMapper            = MultiRESTMapper{}
+	_ fmt.Stringer                    = MultiRESTMapper{}
+	_ ResettableRESTMapperWithContext = MultiRESTMapperWithContext{}
+	_ fmt.Stringer                    = MultiRESTMapperWithContext{}
 )
 
 // MultiRESTMapper is a wrapper for multiple RESTMappers.
+//
+// MultiRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext instead.
 type MultiRESTMapper []RESTMapper
 
+// MultiRESTMapperWithContext is a wrapper for multiple RESTMapperWithContext instances.
+type MultiRESTMapperWithContext []RESTMapperWithContext
+
 func (m MultiRESTMapper) String() string {
+	return stringifyMapper("MultiRESTMapper", m)
+}
+
+func (m MultiRESTMapperWithContext) String() string {
+	return stringifyMapper("MultiRESTMapperWithContext", m)
+}
+
+func stringifyMapper[T any](typeName string, m []T) string {
 	nested := make([]string, 0, len(m))
 	for _, t := range m {
 		currString := fmt.Sprintf("%v", t)
@@ -39,14 +58,93 @@ func (m MultiRESTMapper) String() string {
 		nested = append(nested, strings.Join(splitStrings, "\n\t"))
 	}
 
-	return fmt.Sprintf("MultiRESTMapper{\n\t%s\n}", strings.Join(nested, "\n\t"))
+	return fmt.Sprintf("%s{\n\t%s\n}", typeName, strings.Join(nested, "\n\t"))
+}
+
+func ToMultiRESTMapperWithContext(m MultiRESTMapper) MultiRESTMapperWithContext {
+	if m == nil {
+		return nil
+	}
+	mc := make(MultiRESTMapperWithContext, len(m))
+	for i, m := range m {
+		mc[i] = ToRESTMapperWithContext(m)
+	}
+	return mc
 }
 
 // ResourceSingularizer converts a REST resource name from plural to singular (e.g., from pods to pod)
 // This implementation supports multiple REST schemas and return the first match.
+//
+// MultiRESTMapperWithContext.ResourceSingularizerWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.ResourceSingularizerWithContext instead.
 func (m MultiRESTMapper) ResourceSingularizer(resource string) (singular string, err error) {
+	return ToMultiRESTMapperWithContext(m).ResourceSingularizerWithContext(context.Background(), resource)
+}
+
+// MultiRESTMapperWithContext.ResourcesForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.ResourcesForWithContext instead.
+func (m MultiRESTMapper) ResourcesFor(resource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return ToMultiRESTMapperWithContext(m).ResourcesForWithContext(context.Background(), resource)
+}
+
+// MultiRESTMapperWithContext.KindsForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.KindsForWithContext instead.
+func (m MultiRESTMapper) KindsFor(resource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
+	return ToMultiRESTMapperWithContext(m).KindsForWithContext(context.Background(), resource)
+}
+
+// MultiRESTMapperWithContext.ResourceForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.ResourceForWithContext instead.
+func (m MultiRESTMapper) ResourceFor(resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	return ToMultiRESTMapperWithContext(m).ResourceForWithContext(context.Background(), resource)
+}
+
+// MultiRESTMapperWithContext.KindForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.KindForWithContext instead.
+func (m MultiRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return ToMultiRESTMapperWithContext(m).KindForWithContext(context.Background(), resource)
+}
+
+// RESTMapping provides the REST mapping for the resource based on the
+// kind and version. This implementation supports multiple REST schemas and
+// return the first match.
+//
+// MultiRESTMapperWithContext.RESTMappingWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.RESTMappingWithContext instead.
+func (m MultiRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	return ToMultiRESTMapperWithContext(m).RESTMappingWithContext(context.Background(), gk, versions...)
+}
+
+// RESTMappings returns all possible RESTMappings for the provided group kind, or an error
+// if the type is not recognized.
+//
+// MultiRESTMapperWithContext.RESTMappingsWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.RESTMappingsWithContext instead.
+func (m MultiRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	return ToMultiRESTMapperWithContext(m).RESTMappingsWithContext(context.Background(), gk, versions...)
+}
+
+// MultiRESTMapperWithContext.Reset is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MultiRESTMapperWithContext.Reset instead.
+func (m MultiRESTMapper) Reset() {
 	for _, t := range m {
-		singular, err = t.ResourceSingularizer(resource)
+		MaybeResetRESTMapper(t)
+	}
+}
+
+// ResourceSingularizer converts a REST resource name from plural to singular (e.g., from pods to pod)
+// This implementation supports multiple REST schemas and return the first match.
+func (m MultiRESTMapperWithContext) ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error) {
+	for _, t := range m {
+		singular, err = t.ResourceSingularizerWithContext(ctx, resource)
 		if err == nil {
 			return
 		}
@@ -54,10 +152,10 @@ func (m MultiRESTMapper) ResourceSingularizer(resource string) (singular string,
 	return
 }
 
-func (m MultiRESTMapper) ResourcesFor(resource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+func (m MultiRESTMapperWithContext) ResourcesForWithContext(ctx context.Context, resource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
 	allGVRs := []schema.GroupVersionResource{}
 	for _, t := range m {
-		gvrs, err := t.ResourcesFor(resource)
+		gvrs, err := t.ResourcesForWithContext(ctx, resource)
 		// ignore "no match" errors, but any other error percolates back up
 		if IsNoMatchError(err) {
 			continue
@@ -89,10 +187,10 @@ func (m MultiRESTMapper) ResourcesFor(resource schema.GroupVersionResource) ([]s
 	return allGVRs, nil
 }
 
-func (m MultiRESTMapper) KindsFor(resource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
+func (m MultiRESTMapperWithContext) KindsForWithContext(ctx context.Context, resource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
 	allGVKs := []schema.GroupVersionKind{}
 	for _, t := range m {
-		gvks, err := t.KindsFor(resource)
+		gvks, err := t.KindsForWithContext(ctx, resource)
 		// ignore "no match" errors, but any other error percolates back up
 		if IsNoMatchError(err) {
 			continue
@@ -124,8 +222,8 @@ func (m MultiRESTMapper) KindsFor(resource schema.GroupVersionResource) (gvk []s
 	return allGVKs, nil
 }
 
-func (m MultiRESTMapper) ResourceFor(resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
-	resources, err := m.ResourcesFor(resource)
+func (m MultiRESTMapperWithContext) ResourceForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	resources, err := m.ResourcesForWithContext(ctx, resource)
 	if err != nil {
 		return schema.GroupVersionResource{}, err
 	}
@@ -136,8 +234,8 @@ func (m MultiRESTMapper) ResourceFor(resource schema.GroupVersionResource) (sche
 	return schema.GroupVersionResource{}, &AmbiguousResourceError{PartialResource: resource, MatchingResources: resources}
 }
 
-func (m MultiRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
-	kinds, err := m.KindsFor(resource)
+func (m MultiRESTMapperWithContext) KindForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	kinds, err := m.KindsForWithContext(ctx, resource)
 	if err != nil {
 		return schema.GroupVersionKind{}, err
 	}
@@ -151,12 +249,12 @@ func (m MultiRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.G
 // RESTMapping provides the REST mapping for the resource based on the
 // kind and version. This implementation supports multiple REST schemas and
 // return the first match.
-func (m MultiRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+func (m MultiRESTMapperWithContext) RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
 	allMappings := []*RESTMapping{}
 	errors := []error{}
 
 	for _, t := range m {
-		currMapping, err := t.RESTMapping(gk, versions...)
+		currMapping, err := t.RESTMappingWithContext(ctx, gk, versions...)
 		// ignore "no match" errors, but any other error percolates back up
 		if IsNoMatchError(err) {
 			continue
@@ -188,12 +286,12 @@ func (m MultiRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (*
 
 // RESTMappings returns all possible RESTMappings for the provided group kind, or an error
 // if the type is not recognized.
-func (m MultiRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+func (m MultiRESTMapperWithContext) RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
 	var allMappings []*RESTMapping
 	var errors []error
 
 	for _, t := range m {
-		currMappings, err := t.RESTMappings(gk, versions...)
+		currMappings, err := t.RESTMappingsWithContext(ctx, gk, versions...)
 		// ignore "no match" errors, but any other error percolates back up
 		if IsNoMatchError(err) {
 			continue
@@ -213,8 +311,8 @@ func (m MultiRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) (
 	return allMappings, nil
 }
 
-func (m MultiRESTMapper) Reset() {
+func (m MultiRESTMapperWithContext) ResetWithContext(ctx context.Context) {
 	for _, t := range m {
-		MaybeResetRESTMapper(t)
+		MaybeResetRESTMapperWithContext(ctx, t)
 	}
 }
diff --git a/vendor/k8s.io/apimachinery/pkg/api/meta/priority.go b/vendor/k8s.io/apimachinery/pkg/api/meta/priority.go
index 4f097c9c90..d152e7e322 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/meta/priority.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/meta/priority.go
@@ -17,6 +17,7 @@ limitations under the License.
 package meta
 
 import (
+	"context"
 	"fmt"
 
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -30,11 +31,17 @@ const (
 )
 
 var (
-	_ ResettableRESTMapper = PriorityRESTMapper{}
+	_ ResettableRESTMapper            = PriorityRESTMapper{}
+	_ ResettableRESTMapperWithContext = PriorityRESTMapperWithContext{}
+	_ fmt.Stringer                    = PriorityRESTMapperWithContext{}
 )
 
 // PriorityRESTMapper is a wrapper for automatically choosing a particular Resource or Kind
 // when multiple matches are possible
+//
+// PriorityRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext instead.
 type PriorityRESTMapper struct {
 	// Delegate is the RESTMapper to use to locate all the Kind and Resource matches
 	Delegate RESTMapper
@@ -56,9 +63,100 @@ func (m PriorityRESTMapper) String() string {
 	return fmt.Sprintf("PriorityRESTMapper{\n\t%v\n\t%v\n\t%v\n}", m.ResourcePriority, m.KindPriority, m.Delegate)
 }
 
+// PriorityRESTMapperWithContext is a wrapper for automatically choosing a particular Resource or Kind
+// when multiple matches are possible
+type PriorityRESTMapperWithContext struct {
+	// Delegate is the RESTMapperWithContext to use to locate all the Kind and Resource matches
+	Delegate RESTMapperWithContext
+
+	// ResourcePriority is a list of priority patterns to apply to matching resources.
+	// The list of all matching resources is narrowed based on the patterns until only one remains.
+	// A pattern with no matches is skipped.  A pattern with more than one match uses its
+	// matches as the list to continue matching against.
+	ResourcePriority []schema.GroupVersionResource
+
+	// KindPriority is a list of priority patterns to apply to matching kinds.
+	// The list of all matching kinds is narrowed based on the patterns until only one remains.
+	// A pattern with no matches is skipped.  A pattern with more than one match uses its
+	// matches as the list to continue matching against.
+	KindPriority []schema.GroupVersionKind
+}
+
+func (m PriorityRESTMapperWithContext) String() string {
+	return fmt.Sprintf("PriorityRESTMapperWithContext{\n\t%v\n\t%v\n\t%v\n}", m.ResourcePriority, m.KindPriority, m.Delegate)
+}
+
+func ToPriorityRESTMapperWithContext(m PriorityRESTMapper) PriorityRESTMapperWithContext {
+	return PriorityRESTMapperWithContext{
+		Delegate:         ToRESTMapperWithContext(m.Delegate),
+		ResourcePriority: m.ResourcePriority,
+		KindPriority:     m.KindPriority,
+	}
+}
+
 // ResourceFor finds all resources, then passes them through the ResourcePriority patterns to find a single matching hit.
+//
+// PriorityRESTMapperWithContext.ResourceForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.ResourceForWithContext instead.
 func (m PriorityRESTMapper) ResourceFor(partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
-	originalGVRs, originalErr := m.Delegate.ResourcesFor(partiallySpecifiedResource)
+	return ToPriorityRESTMapperWithContext(m).ResourceForWithContext(context.Background(), partiallySpecifiedResource)
+}
+
+// KindFor finds all kinds, then passes them through the KindPriority patterns to find a single matching hit.
+//
+// PriorityRESTMapperWithContext.KindForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.KindForWithContext instead.
+func (m PriorityRESTMapper) KindFor(partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return ToPriorityRESTMapperWithContext(m).KindForWithContext(context.Background(), partiallySpecifiedResource)
+}
+
+// PriorityRESTMapperWithContext.RESTMappingWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.RESTMappingWithContext instead.
+func (m PriorityRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (mapping *RESTMapping, err error) {
+	return ToPriorityRESTMapperWithContext(m).RESTMappingWithContext(context.Background(), gk, versions...)
+}
+
+// PriorityRESTMapperWithContext.RESTMappingsWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.RESTMappingsWithContext instead.
+func (m PriorityRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	return m.Delegate.RESTMappings(gk, versions...)
+}
+
+// PriorityRESTMapperWithContext.ResourceSingularizerWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.ResourceSingularizerWithContext instead.
+func (m PriorityRESTMapper) ResourceSingularizer(resource string) (singular string, err error) {
+	return m.Delegate.ResourceSingularizer(resource)
+}
+
+// PriorityRESTMapperWithContext.ResourcesForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.ResourcesForWithContext instead.
+func (m PriorityRESTMapper) ResourcesFor(partiallySpecifiedResource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return m.Delegate.ResourcesFor(partiallySpecifiedResource)
+}
+
+// PriorityRESTMapperWithContext.KindsForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.KindsForWithContext instead.
+func (m PriorityRESTMapper) KindsFor(partiallySpecifiedResource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
+	return m.Delegate.KindsFor(partiallySpecifiedResource)
+}
+
+// PriorityRESTMapperWithContext.ResetWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PriorityRESTMapperWithContext.ResetWithContext instead.
+func (m PriorityRESTMapper) Reset() {
+	MaybeResetRESTMapper(m.Delegate)
+}
+
+// ResourceFor finds all resources, then passes them through the ResourcePriority patterns to find a single matching hit.
+func (m PriorityRESTMapperWithContext) ResourceForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	originalGVRs, originalErr := m.Delegate.ResourcesForWithContext(ctx, partiallySpecifiedResource)
 	if originalErr != nil && len(originalGVRs) == 0 {
 		return schema.GroupVersionResource{}, originalErr
 	}
@@ -93,8 +191,8 @@ func (m PriorityRESTMapper) ResourceFor(partiallySpecifiedResource schema.GroupV
 }
 
 // KindFor finds all kinds, then passes them through the KindPriority patterns to find a single matching hit.
-func (m PriorityRESTMapper) KindFor(partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
-	originalGVKs, originalErr := m.Delegate.KindsFor(partiallySpecifiedResource)
+func (m PriorityRESTMapperWithContext) KindForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	originalGVKs, originalErr := m.Delegate.KindsForWithContext(ctx, partiallySpecifiedResource)
 	if originalErr != nil && len(originalGVKs) == 0 {
 		return schema.GroupVersionKind{}, originalErr
 	}
@@ -156,8 +254,8 @@ func kindMatches(pattern schema.GroupVersionKind, kind schema.GroupVersionKind)
 	return true
 }
 
-func (m PriorityRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (mapping *RESTMapping, err error) {
-	mappings, originalErr := m.Delegate.RESTMappings(gk, versions...)
+func (m PriorityRESTMapperWithContext) RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (mapping *RESTMapping, err error) {
+	mappings, originalErr := m.Delegate.RESTMappingsWithContext(ctx, gk, versions...)
 	if originalErr != nil && len(mappings) == 0 {
 		return nil, originalErr
 	}
@@ -209,22 +307,22 @@ func (m PriorityRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string)
 	return nil, &AmbiguousKindError{PartialKind: gk.WithVersion(""), MatchingKinds: kinds}
 }
 
-func (m PriorityRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
-	return m.Delegate.RESTMappings(gk, versions...)
+func (m PriorityRESTMapperWithContext) RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	return m.Delegate.RESTMappingsWithContext(ctx, gk, versions...)
 }
 
-func (m PriorityRESTMapper) ResourceSingularizer(resource string) (singular string, err error) {
-	return m.Delegate.ResourceSingularizer(resource)
+func (m PriorityRESTMapperWithContext) ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error) {
+	return m.Delegate.ResourceSingularizerWithContext(ctx, resource)
 }
 
-func (m PriorityRESTMapper) ResourcesFor(partiallySpecifiedResource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
-	return m.Delegate.ResourcesFor(partiallySpecifiedResource)
+func (m PriorityRESTMapperWithContext) ResourcesForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return m.Delegate.ResourcesForWithContext(ctx, partiallySpecifiedResource)
 }
 
-func (m PriorityRESTMapper) KindsFor(partiallySpecifiedResource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
-	return m.Delegate.KindsFor(partiallySpecifiedResource)
+func (m PriorityRESTMapperWithContext) KindsForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) {
+	return m.Delegate.KindsForWithContext(ctx, partiallySpecifiedResource)
 }
 
-func (m PriorityRESTMapper) Reset() {
-	MaybeResetRESTMapper(m.Delegate)
+func (m PriorityRESTMapperWithContext) ResetWithContext(ctx context.Context) {
+	MaybeResetRESTMapperWithContext(ctx, m.Delegate)
 }
diff --git a/vendor/k8s.io/apimachinery/pkg/api/meta/restmapper.go b/vendor/k8s.io/apimachinery/pkg/api/meta/restmapper.go
index 91cb98cae4..d64db33d41 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/meta/restmapper.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/meta/restmapper.go
@@ -18,6 +18,7 @@ limitations under the License.
 package meta
 
 import (
+	"context"
 	"fmt"
 	"sort"
 	"strings"
@@ -72,6 +73,8 @@ func (m *DefaultRESTMapper) String() string {
 }
 
 var _ RESTMapper = &DefaultRESTMapper{}
+var _ RESTMapperWithContext = &DefaultRESTMapper{}
+var _ fmt.Stringer = &DefaultRESTMapper{}
 
 // NewDefaultRESTMapper initializes a mapping between Kind and APIVersion
 // to a resource name and back based on the objects in a runtime.Scheme
@@ -179,6 +182,10 @@ func (m *DefaultRESTMapper) ResourceSingularizer(resourceType string) (string, e
 	return singular.Resource, nil
 }
 
+func (m *DefaultRESTMapper) ResourceSingularizerWithContext(_ context.Context, resourceType string) (string, error) {
+	return m.ResourceSingularizer(resourceType)
+}
+
 // coerceResourceForMatching makes the resource lower case and converts internal versions to unspecified (legacy behavior)
 func coerceResourceForMatching(resource schema.GroupVersionResource) schema.GroupVersionResource {
 	resource.Resource = strings.ToLower(resource.Resource)
@@ -276,6 +283,10 @@ func (m *DefaultRESTMapper) ResourcesFor(input schema.GroupVersionResource) ([]s
 	return ret, nil
 }
 
+func (m *DefaultRESTMapper) ResourcesForWithContext(_ context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return m.ResourcesFor(input)
+}
+
 func (m *DefaultRESTMapper) ResourceFor(resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
 	resources, err := m.ResourcesFor(resource)
 	if err != nil {
@@ -288,6 +299,10 @@ func (m *DefaultRESTMapper) ResourceFor(resource schema.GroupVersionResource) (s
 	return schema.GroupVersionResource{}, &AmbiguousResourceError{PartialResource: resource, MatchingResources: resources}
 }
 
+func (m *DefaultRESTMapper) ResourceForWithContext(_ context.Context, resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	return m.ResourceFor(resource)
+}
+
 func (m *DefaultRESTMapper) KindsFor(input schema.GroupVersionResource) ([]schema.GroupVersionKind, error) {
 	resource := coerceResourceForMatching(input)
 
@@ -355,6 +370,10 @@ func (m *DefaultRESTMapper) KindsFor(input schema.GroupVersionResource) ([]schem
 	return ret, nil
 }
 
+func (m *DefaultRESTMapper) KindsForWithContext(_ context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionKind, error) {
+	return m.KindsFor(input)
+}
+
 func (m *DefaultRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
 	kinds, err := m.KindsFor(resource)
 	if err != nil {
@@ -367,6 +386,10 @@ func (m *DefaultRESTMapper) KindFor(resource schema.GroupVersionResource) (schem
 	return schema.GroupVersionKind{}, &AmbiguousResourceError{PartialResource: resource, MatchingKinds: kinds}
 }
 
+func (m *DefaultRESTMapper) KindForWithContext(_ context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return m.KindFor(resource)
+}
+
 type kindByPreferredGroupVersion struct {
 	list      []schema.GroupVersionKind
 	sortOrder []schema.GroupVersion
@@ -461,6 +484,10 @@ func (m *DefaultRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string)
 	return mappings[0], nil
 }
 
+func (m *DefaultRESTMapper) RESTMappingWithContext(_ context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error) {
+	return m.RESTMapping(gk, versions...)
+}
+
 // RESTMappings returns the RESTMappings for the provided group kind. If a version search order
 // is not provided, the search order provided to DefaultRESTMapper will be used.
 func (m *DefaultRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
@@ -520,10 +547,33 @@ func (m *DefaultRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string
 	return mappings, nil
 }
 
-// MaybeResetRESTMapper calls Reset() on the mapper if it is a ResettableRESTMapper.
+func (m *DefaultRESTMapper) RESTMappingsWithContext(_ context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) {
+	return m.RESTMappings(gk, versions...)
+}
+
+// MaybeResetRESTMapper calls Reset() on the mapper if it is a ResettableRESTMapper or
+// ResetWithContext() if it is a ResettableRESTMapperWithContext.
+//
+// MaybeResetRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use MaybeResetRESTMapperWithContext instead.
 func MaybeResetRESTMapper(mapper RESTMapper) {
-	m, ok := mapper.(ResettableRESTMapper)
-	if ok {
+	maybeReset(context.Background(), mapper)
+}
+
+// MaybeResetRESTMapperWithContext calls Reset() on the mapper if it is a ResettableRESTMapper or
+// ResetWithContext() if it is a ResettableRESTMapperWithContext.
+func MaybeResetRESTMapperWithContext(ctx context.Context, mapper RESTMapperWithContext) {
+	maybeReset(ctx, mapper)
+}
+
+func maybeReset(ctx context.Context, mapper any) {
+	if m, ok := mapper.(ResettableRESTMapperWithContext); ok {
+		m.ResetWithContext(ctx)
+		return
+	}
+	if m, ok := mapper.(ResettableRESTMapper); ok {
 		m.Reset()
+		return
 	}
 }
diff --git a/vendor/k8s.io/apimachinery/pkg/api/operation/operation.go b/vendor/k8s.io/apimachinery/pkg/api/operation/operation.go
index 86b6ddf37c..cccc7e60c2 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/operation/operation.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/operation/operation.go
@@ -17,7 +17,6 @@ limitations under the License.
 package operation
 
 import (
-	"slices"
 	"strings"
 )
 
@@ -31,28 +30,27 @@ type Operation struct {
 	// those into a single "Update" category.
 	Type Type
 
-	// Options declare the options enabled for validation.
+	// Options are the validation options in effect for this operation, mapping option
+	// name to whether it is enabled. Option names typically match feature gates, but an
+	// option may be enabled even when its feature gate is off — e.g. when the feature is
+	// already in use by the object being updated. Set by the resource strategy and
+	// read-only during validation.
 	//
-	// Options should be set according to a resource validation strategy before validation
-	// is performed, and must be treated as read-only during validation.
-	//
-	// Options are identified by string names. Option string names may match the name of a feature
-	// gate, in which case the presence of the name in the set indicates that the feature is
-	// considered enabled for the resource being validated.  Note that a resource may have a
-	// feature enabled even when the feature gate is disabled. This can happen when feature is
-	// already in-use by a resource, often because the feature gate was enabled when the
-	// resource first began using the feature.
-	//
-	// Unset options are disabled/false.
-	Options []string
+	// Every option a validation tag references must be defined here by the strategy; an
+	// option that is not defined is a programming error (see HasOption).
+	Options map[string]bool
 
 	// Request provides information about the request being validated.
 	Request Request
 }
 
-// HasOption returns true if the given string is in the Options slice.
-func (o Operation) HasOption(option string) bool {
-	return slices.Contains(o.Options, option)
+// HasOption returns whether the named option is enabled and whether it was defined by
+// the strategy. Every option a validation tag references must be defined; callers treat
+// an undefined option as an internal error (see validate.IfOption) rather than silently
+// as disabled.
+func (o Operation) HasOption(option string) (enabled, defined bool) {
+	enabled, defined = o.Options[option]
+	return
 }
 
 // Request provides information about the request being validated.
diff --git a/vendor/k8s.io/apimachinery/pkg/api/resource/quantity.go b/vendor/k8s.io/apimachinery/pkg/api/resource/quantity.go
index f3cd600604..e6b1f1b535 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/resource/quantity.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/resource/quantity.go
@@ -878,3 +878,14 @@ func (q *QuantityValue) Set(s string) error {
 func (q QuantityValue) Type() string {
 	return "quantity"
 }
+
+// QuantityPtrEqual compares two Quantity pointers and returns true if they are both nil or point to equal quantities.
+func QuantityPtrEqual(a, b *Quantity) bool {
+	if a == nil && b == nil {
+		return true
+	}
+	if a == nil || b == nil {
+		return false
+	}
+	return a.Equal(*b)
+}
diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/content/kube.go b/vendor/k8s.io/apimachinery/pkg/api/validate/content/kube.go
index 44e82eefd3..608073f708 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/validate/content/kube.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/validate/content/kube.go
@@ -99,3 +99,19 @@ func prefixEach(msgs []string, prefix string) []string {
 	}
 	return msgs
 }
+
+// IsPrefixedLabelKey tests whether the value passed is a valid label key with
+// a domain prefix. This allows "example.com/key" but not "key".
+// If the value is not valid, a list of error strings is returned. Otherwise,
+// an empty list (or nil) is returned.
+func IsPrefixedLabelKey(value string) []string {
+	if errs := IsLabelKey(value); len(errs) > 0 {
+		return errs
+	}
+
+	segments := strings.Split(value, "/")
+	if len(segments) != 2 {
+		return []string{"must include a prefix (e.g. 'example.com/key')"}
+	}
+	return nil
+}
diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/dependentrequired.go b/vendor/k8s.io/apimachinery/pkg/api/validate/dependentrequired.go
new file mode 100644
index 0000000000..69222c9752
--- /dev/null
+++ b/vendor/k8s.io/apimachinery/pkg/api/validate/dependentrequired.go
@@ -0,0 +1,83 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// DependentRequired verifies that when triggerIsSet(obj) is true, dependentIsSet(obj)
+// is also true; otherwise reports an error at fldPath.Child(dependentName).
+// On Update, the check is skipped if neither side's set-ness changed from oldObj,
+// so unrelated updates can proceed past a pre-existing violation.
+func DependentRequired[T any](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *T,
+	triggerName string, triggerIsSet ExtractorFn[*T, bool],
+	dependentName string, dependentIsSet ExtractorFn[*T, bool],
+) field.ErrorList {
+	if obj == nil {
+		return nil
+	}
+	if op.Type == operation.Update && oldObj != nil {
+		if triggerIsSet(obj) == triggerIsSet(oldObj) && dependentIsSet(obj) == dependentIsSet(oldObj) {
+			return nil
+		}
+	}
+	if !triggerIsSet(obj) {
+		return nil
+	}
+	if dependentIsSet(obj) {
+		return nil
+	}
+	return field.ErrorList{
+		field.Required(fldPath.Child(dependentName),
+			fmt.Sprintf("must be set when %s is set", triggerName)).
+			WithOrigin("dependentRequired"),
+	}
+}
+
+// DependentForbidden verifies that when triggerIsSet(obj) is true, dependentIsSet(obj)
+// is false; otherwise reports an error at fldPath.Child(dependentName).
+// On Update, the check is skipped if neither side's set-ness changed from oldObj,
+// so unrelated updates can proceed past a pre-existing violation.
+func DependentForbidden[T any](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *T,
+	triggerName string, triggerIsSet ExtractorFn[*T, bool],
+	dependentName string, dependentIsSet ExtractorFn[*T, bool],
+) field.ErrorList {
+	if obj == nil {
+		return nil
+	}
+	if op.Type == operation.Update && oldObj != nil {
+		if triggerIsSet(obj) == triggerIsSet(oldObj) && dependentIsSet(obj) == dependentIsSet(oldObj) {
+			return nil
+		}
+	}
+	if !triggerIsSet(obj) {
+		return nil
+	}
+	if !dependentIsSet(obj) {
+		return nil
+	}
+	return field.ErrorList{
+		field.Forbidden(fldPath.Child(dependentName),
+			fmt.Sprintf("may not be set when %s is set", triggerName)).
+			WithOrigin("dependentForbidden"),
+	}
+}
diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/discriminator.go b/vendor/k8s.io/apimachinery/pkg/api/validate/discriminator.go
index 787ae6b0b7..6f4b3cddda 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/validate/discriminator.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/validate/discriminator.go
@@ -35,6 +35,9 @@ type DiscriminatedRule[Tfield any, Tdisc comparable] struct {
 //
 // It performs ratcheting: if the operation is an Update, and neither the discriminator
 // nor the value (checked via equiv) have changed, validation is skipped.
+//
+// The equiv function can be called with nil arguments in the case of nilable
+// fields.
 func Discriminated[Tfield any, Tdisc comparable, Tstruct any](ctx context.Context, op operation.Operation, structPath *field.Path,
 	obj, oldObj *Tstruct, fieldName string, getMemberValue func(*Tstruct) Tfield, getDiscriminator func(*Tstruct) Tdisc,
 	equiv MatchFunc[Tfield], defaultValidation ValidateFunc[Tfield], rules []DiscriminatedRule[Tfield, Tdisc],
diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/each.go b/vendor/k8s.io/apimachinery/pkg/api/validate/each.go
index c815d6d913..affc44576b 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/validate/each.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/validate/each.go
@@ -18,6 +18,8 @@ package validate
 
 import (
 	"context"
+	"reflect"
+	"slices"
 	"sort"
 
 	"k8s.io/apimachinery/pkg/api/equality"
@@ -29,22 +31,29 @@ import (
 // according to some criteria, and returns true if they match.
 type MatchFunc[T any] func(T, T) bool
 
-// EachSliceVal performs validation on each element of newSlice using the provided validation function.
+// EachValSliceVal performs validation on each element of a slice of values
+// using the provided validation function.
 //
-// For update operations, the match function finds corresponding values in oldSlice for each
-// value in newSlice. This comparison can be either full or partial (e.g., matching only
-// specific struct fields that serve as a unique identifier). If match is nil, validation
-// proceeds without considering old values, and the equiv function is not used.
+// For update operations, the match function finds corresponding values in
+// oldSlice for each value in newSlice. This comparison can be either full or
+// partial (e.g., matching only specific struct fields that serve as a unique
+// identifier). If match is nil, validation proceeds without considering old
+// values, and the equiv function is not used.
 //
-// For update operations, the equiv function checks if a new value is equivalent to its
-// corresponding old value, enabling validation ratcheting. If equiv is nil but match is
-// provided, the match function is assumed to perform full value comparison.
+// For update operations, the equiv function checks if a new value is
+// equivalent to its corresponding old value, enabling validation ratcheting.
+// If equiv is nil but match is provided, the match function is assumed to
+// perform full value comparison.
+//
+// The match and equiv functions will never be called with nil arguments.
 //
 // Note: The slice element type must be non-nilable.
-func EachSliceVal[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newSlice, oldSlice []T,
-	match, equiv MatchFunc[T], validator ValidateFunc[*T]) field.ErrorList {
+func EachValSliceVal[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newSlice, oldSlice []T,
+	match, equiv MatchFunc[*T], validator ValidateFunc[*T]) field.ErrorList {
 	var errs field.ErrorList
-	for i, val := range newSlice {
+	for i := range newSlice {
+		val := &newSlice[i]
+
 		var old *T
 		if match != nil && len(oldSlice) > 0 {
 			old = lookup(oldSlice, val, match)
@@ -55,33 +64,90 @@ func EachSliceVal[T any](ctx context.Context, op operation.Operation, fldPath *f
 		// 2. The equiv function confirms the values are equivalent (either directly or semantically)
 		//
 		// The equiv function provides equality comparison when match uses partial comparison.
-		if op.Type == operation.Update && old != nil && (equiv == nil || equiv(val, *old)) {
+		if op.Type == operation.Update && old != nil && (equiv == nil || equiv(val, old)) {
 			continue
 		}
-		errs = append(errs, validator(ctx, op, fldPath.Index(i), &val, old)...)
+		errs = append(errs, validator(ctx, op, fldPath.Index(i), val, old)...)
+	}
+	return errs
+}
+
+// EachPtrSliceVal performs validation on each element of a slice of pointers
+// using the provided validation function.
+//
+// For update operations, the match function finds corresponding values in
+// oldSlice for each value in newSlice. This comparison can be either full or
+// partial (e.g., matching only specific struct fields that serve as a unique
+// identifier). If match is nil, validation proceeds without considering old
+// values, and the equiv function is not used.
+//
+// For update operations, the equiv function checks if a new value is
+// equivalent to its corresponding old value, enabling validation ratcheting.
+// If equiv is nil but match is provided, the match function is assumed to
+// perform full value comparison.
+//
+// The match and equiv functions will never be called with nil arguments.
+func EachPtrSliceVal[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newSlice, oldSlice []*T,
+	match, equiv MatchFunc[*T], validator ValidateFunc[*T]) field.ErrorList {
+	var errs field.ErrorList
+	for i := range newSlice {
+		val := newSlice[i]
+		if val == nil {
+			// Ignore nil items; they are supposed to have been checked by PtrSliceNoNils.
+			continue
+		}
+
+		var old *T
+		if match != nil && len(oldSlice) > 0 {
+			old = lookupPointer(oldSlice, val, match)
+		}
+		if op.Type == operation.Update && old != nil && (equiv == nil || equiv(val, old)) {
+			continue
+		}
+		errs = append(errs, validator(ctx, op, fldPath.Index(i), val, old)...)
 	}
 	return errs
 }
 
 // lookup returns a pointer to the first element in the list that matches the
 // target, according to the provided comparison function, or else nil.
-func lookup[T any](list []T, target T, match MatchFunc[T]) *T {
+func lookup[T any](list []T, target *T, match MatchFunc[*T]) *T {
 	for i := range list {
-		if match(list[i], target) {
+		if match(&list[i], target) {
 			return &list[i]
 		}
 	}
 	return nil
 }
 
+// lookupPointer returns the first non-nil element in the list that matches the
+// target, according to the provided comparison function, or else nil.
+// Nil elements in the list are skipped.
+func lookupPointer[T any](list []*T, target *T, match MatchFunc[*T]) *T {
+	for i := range list {
+		if list[i] == nil {
+			// We can't really do anything about nil entries in the old list,
+			// just skip them.
+			continue
+		}
+		if match(list[i], target) {
+			return list[i]
+		}
+	}
+	return nil
+}
+
 // EachMapVal validates each value in newMap using the specified validation
 // function, passing the corresponding old value from oldMap if the key exists in oldMap.
 // For update operations, it implements validation ratcheting by skipping validation
 // when the old value exists and the equiv function confirms the values are equivalent.
 // The value-type of the map is assumed to not be nilable.
+//
+// The equiv function will never be called with nil arguments.
+//
 // If equiv is nil, value-based ratcheting is disabled and all values will be validated.
 func EachMapVal[K ~string, V any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]V,
-	equiv MatchFunc[V], validator ValidateFunc[*V]) field.ErrorList {
+	equiv MatchFunc[*V], validator ValidateFunc[*V]) field.ErrorList {
 	var errs field.ErrorList
 	for key, val := range newMap {
 		var old *V
@@ -90,7 +156,7 @@ func EachMapVal[K ~string, V any](ctx context.Context, op operation.Operation, f
 		}
 		// If the operation is an update, for validation ratcheting, skip re-validating if the old
 		// value is found and the equiv function confirms the values are equivalent.
-		if op.Type == operation.Update && old != nil && equiv != nil && equiv(val, *old) {
+		if op.Type == operation.Update && old != nil && equiv != nil && equiv(&val, old) {
 			continue
 		}
 		errs = append(errs, validator(ctx, op, fldPath.Key(string(key)), &val, old)...)
@@ -98,6 +164,38 @@ func EachMapVal[K ~string, V any](ctx context.Context, op operation.Operation, f
 	return errs
 }
 
+// EachPtrMapVal validates each value in newMap (which is a map of pointers)
+// using the specified validation function, passing the corresponding old value
+// from oldMap if the key exists in oldMap.
+// For update operations, it implements validation ratcheting by skipping validation
+// when the old value exists and the equiv function confirms the values are equivalent.
+//
+// The equiv function will never be called with nil arguments.
+//
+// If equiv is nil, value-based ratcheting is disabled and all values will be validated.
+func EachPtrMapVal[K ~string, V any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]*V,
+	equiv MatchFunc[*V], validator ValidateFunc[*V]) field.ErrorList {
+	var errs field.ErrorList
+	for key, val := range newMap {
+		if val == nil {
+			// Ignore nil items; they are supposed to have been checked by PtrMapNoNils.
+			continue
+		}
+
+		var old *V
+		if o, found := oldMap[key]; found {
+			old = o
+		}
+		// If the operation is an update, for validation ratcheting, skip re-validating if the old
+		// value is found and the equiv function confirms the values are equivalent.
+		if op.Type == operation.Update && old != nil && equiv != nil && equiv(val, old) {
+			continue
+		}
+		errs = append(errs, validator(ctx, op, fldPath.Key(string(key)), val, old)...)
+	}
+	return errs
+}
+
 // EachMapKey validates each element of newMap with the specified
 // validation function.
 func EachMapKey[K ~string, T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]T,
@@ -119,19 +217,20 @@ func EachMapKey[K ~string, T any](ctx context.Context, op operation.Operation, f
 	return errs
 }
 
-// Unique verifies that each element of newSlice is unique, according to the
-// match function. It compares every element of the slice with every other
-// element and returns errors for non-unique items.
-func Unique[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, newSlice, _ []T, match MatchFunc[T]) field.ErrorList {
+// ValSliceUnique verifies that each element of a slice of values is unique,
+// according to the match function. It compares every element of the slice with
+// every other element and returns errors for non-unique items.
+//
+// The match function will never be called with nil arguments.
+func ValSliceUnique[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, newSlice, _ []T, match MatchFunc[*T]) field.ErrorList {
 	var dups []int
-	for i, val := range newSlice {
+	for i := range newSlice {
 		for j := i + 1; j < len(newSlice); j++ {
-			other := newSlice[j]
-			if match(val, other) {
+			if match(&newSlice[i], &newSlice[j]) {
 				if dups == nil {
 					dups = make([]int, 0, len(newSlice))
 				}
-				if lookup(dups, j, func(a, b int) bool { return a == b }) == nil {
+				if !slices.Contains(dups, j) {
 					dups = append(dups, j)
 				}
 			}
@@ -152,6 +251,42 @@ func Unique[T any](_ context.Context, _ operation.Operation, fldPath *field.Path
 	return errs
 }
 
+// PtrSliceUnique verifies that each element of a slice of pointers is unique,
+// according to the match function. It compares every element of the slice with
+// every other element and returns errors for non-unique items.
+//
+// The match function will never be called with nil arguments.
+func PtrSliceUnique[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, newSlice, _ []*T, match MatchFunc[*T]) field.ErrorList {
+	var errs field.ErrorList
+	var dups []int
+	for i := range newSlice {
+		if newSlice[i] == nil {
+			// Ignore nil items; they are supposed to have been checked by PtrSliceNoNils.
+			continue
+		}
+		for j := i + 1; j < len(newSlice); j++ {
+			if newSlice[j] == nil {
+				continue
+			}
+			if match(newSlice[i], newSlice[j]) {
+				if dups == nil {
+					dups = make([]int, 0, len(newSlice))
+				}
+				if !slices.Contains(dups, j) {
+					dups = append(dups, j)
+				}
+			}
+		}
+	}
+
+	sort.Ints(dups)
+	for _, i := range dups {
+		var val any = newSlice[i]
+		errs = append(errs, field.Duplicate(fldPath.Index(i), val))
+	}
+	return errs
+}
+
 // SemanticDeepEqual is a MatchFunc that uses equality.Semantic.DeepEqual to
 // compare two values.
 // This wrapper is needed because MatchFunc requires a function that takes two
@@ -159,23 +294,28 @@ func Unique[T any](_ context.Context, _ operation.Operation, fldPath *field.Path
 // arguments of type interface{}/any. The wrapper satisfies the type
 // constraints of MatchFunc while leveraging the underlying semantic equality
 // logic. It can be used by any other function that needs to call DeepEqual.
+//
+// Deprecated: Callers should use equality.Semantic.DeepEqual directly.
 func SemanticDeepEqual[T any](a, b T) bool {
 	return equality.Semantic.DeepEqual(a, b)
 }
 
-// DirectEqual is a MatchFunc that uses the == operator to compare two values.
-// It can be used by any other function that needs to compare two values
-// directly.
-func DirectEqual[T comparable](a, b T) bool {
-	return a == b
+// ReflectDeepEqual is a MatchFunc that uses reflect.DeepEqual to compare two
+// values.
+// This wrapper is needed because MatchFunc requires a function that takes two
+// arguments of specific type T, while reflect.DeepEqual takes arguments of
+// type interface{}/any. It can be used by any other function that needs to
+// call DeepEqual.
+func ReflectDeepEqual[T any](a, b T) bool {
+	return reflect.DeepEqual(a, b)
 }
 
-// DirectEqualPtr is a MatchFunc that dereferences two pointers and uses the ==
+// DirectEqual is a MatchFunc that dereferences two pointers and uses the ==
 // operator to compare the values. If both pointers are nil, it returns true.
 // If one pointer is nil and the other is not, it returns false.
 // It can be used by any other function that needs to compare two pointees
 // directly.
-func DirectEqualPtr[T comparable](a, b *T) bool {
+func DirectEqual[T comparable](a, b *T) bool {
 	if a == b {
 		return true
 	}
@@ -184,3 +324,25 @@ func DirectEqualPtr[T comparable](a, b *T) bool {
 	}
 	return *a == *b
 }
+
+// PtrSliceNoNils returns a Required error for each nil element in a slice of
+// pointers.
+func PtrSliceNoNils[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, newSlice, _ []*T) (errs field.ErrorList) {
+	for i := range newSlice {
+		if newSlice[i] == nil {
+			errs = append(errs, field.Required(fldPath.Index(i), ""))
+		}
+	}
+	return
+}
+
+// PtrMapNoNils returns a Required error for each nil element in a map of
+// pointers.
+func PtrMapNoNils[K ~string, V any](_ context.Context, _ operation.Operation, fldPath *field.Path, newMap, _ map[K]*V) (errs field.ErrorList) {
+	for key, val := range newMap {
+		if val == nil {
+			errs = append(errs, field.Required(fldPath.Key(string(key)), ""))
+		}
+	}
+	return
+}
diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/enum.go b/vendor/k8s.io/apimachinery/pkg/api/validate/enum.go
index 6e5bcf373b..4d8e2c0aa8 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/validate/enum.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/validate/enum.go
@@ -18,6 +18,7 @@ package validate
 
 import (
 	"context"
+	"fmt"
 	"slices"
 
 	"k8s.io/apimachinery/pkg/api/operation"
@@ -32,24 +33,36 @@ func Enum[T ~string](_ context.Context, op operation.Operation, fldPath *field.P
 	if value == nil {
 		return nil
 	}
-	if !validValues.Has(*value) || isExcluded(op, exclusions, *value) {
-		return field.ErrorList{field.NotSupported[T](fldPath, *value, supportedValues(op, validValues, exclusions))}
+	excluded, err := isExcluded(op, exclusions, *value)
+	if err != nil {
+		return field.ErrorList{field.InternalError(fldPath, err)}
+	}
+	if !validValues.Has(*value) || excluded {
+		supported, err := supportedValues(op, validValues, exclusions)
+		if err != nil {
+			return field.ErrorList{field.InternalError(fldPath, err)}
+		}
+		return field.ErrorList{field.NotSupported[T](fldPath, *value, supported)}
 	}
 	return nil
 }
 
 // supportedValues returns a sorted list of supported values.
 // Excluded enum values are not included in the list.
-func supportedValues[T ~string](op operation.Operation, values sets.Set[T], exclusions []EnumExclusion[T]) []T {
+func supportedValues[T ~string](op operation.Operation, values sets.Set[T], exclusions []EnumExclusion[T]) ([]T, error) {
 	res := make([]T, 0, len(values))
 	for key := range values {
-		if isExcluded(op, exclusions, key) {
+		excluded, err := isExcluded(op, exclusions, key)
+		if err != nil {
+			return nil, err
+		}
+		if excluded {
 			continue
 		}
 		res = append(res, key)
 	}
 	slices.Sort(res)
-	return res
+	return res, nil
 }
 
 // EnumExclusion represents a single enum exclusion rule.
@@ -64,11 +77,15 @@ type EnumExclusion[T ~string] struct {
 	Option string
 }
 
-func isExcluded[T ~string](op operation.Operation, exclusions []EnumExclusion[T], value T) bool {
+func isExcluded[T ~string](op operation.Operation, exclusions []EnumExclusion[T], value T) (bool, error) {
 	for _, rule := range exclusions {
-		if rule.Value == value && rule.ExcludeWhen == op.HasOption(rule.Option) {
-			return true
+		on, defined := op.HasOption(rule.Option)
+		if !defined {
+			return false, fmt.Errorf("undefined validation option %q", rule.Option)
+		}
+		if rule.Value == value && rule.ExcludeWhen == on {
+			return true, nil
 		}
 	}
-	return false
+	return false, nil
 }
diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/errors.go b/vendor/k8s.io/apimachinery/pkg/api/validate/errors.go
new file mode 100644
index 0000000000..a9dc4b01c0
--- /dev/null
+++ b/vendor/k8s.io/apimachinery/pkg/api/validate/errors.go
@@ -0,0 +1,96 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"errors"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+type allDeclarativeEnforcedKeyType struct{}
+
+var allDeclarativeEnforcedKey = allDeclarativeEnforcedKeyType{}
+
+// WithAllDeclarativeEnforcedForTest returns a copy of parent context with allDeclarativeEnforcedKey set to true.
+// This is used for testing to expose all declarative validation errors and filter all handwritten validation errors
+// that are covered by declarative validation, regardless of the feature gate or maturity level.
+//
+// NOTE: This function is intended for testing purposes only and should not be used in production code.
+func WithAllDeclarativeEnforcedForTest(ctx context.Context) context.Context {
+	return context.WithValue(ctx, allDeclarativeEnforcedKey, true)
+}
+
+// AllDeclarativeEnforced returns true if the context contains allDeclarativeEnforcedKey set to true.
+func AllDeclarativeEnforced(ctx context.Context) bool {
+	if ctx == nil {
+		return false
+	}
+	return ctx.Value(allDeclarativeEnforcedKey) == true
+}
+
+// FilterCoveredHandwrittenErrors removes a CoveredByDeclarative handwritten error when a matching enforced
+// beta declarative error exists (matched by type, field, and origin). In AllDeclarativeEnforced
+// (testing-only) mode every covered handwritten error is removed.
+func FilterCoveredHandwrittenErrors(ctx context.Context, imperativeErrs, enforcedDeclarativeErrs field.ErrorList, betaEnabled bool, rules ...field.NormalizationRule) field.ErrorList {
+	matcher := field.ErrorMatcher{}.ByType().ByOrigin().RequireOriginWhenInvalid().ByFieldNormalized(rules)
+	allDeclarativeEnforced := AllDeclarativeEnforced(ctx)
+	return imperativeErrs.Filter(func(e error) bool {
+		var fe *field.Error
+		if !errors.As(e, &fe) || !fe.CoveredByDeclarative {
+			return false
+		}
+		if allDeclarativeEnforced {
+			return true
+		}
+		for _, dErr := range enforcedDeclarativeErrs {
+			if dErr.IsBeta() && matcher.Matches(fe, dErr) {
+				return true
+			}
+		}
+		return false
+	})
+}
+
+// FilterEnforcedDeclarativeErrors collects the declarative errors that are enforced (i.e. surfaced to the user) in the
+// current mode. A declarative error is enforced when any of the following holds:
+//   - AllDeclarativeEnforced is set (testing): every declarative error is enforced.
+//   - It is an internal error: always enforced, regardless of lifecycle.
+//   - It is a beta error and BetaEnabled is true.
+//   - It is a standard (unprefixed) error: always enforced.
+//
+// Alpha errors are never enforced; they remain shadowed by handwritten validation.
+func FilterEnforcedDeclarativeErrors(ctx context.Context, declarativeErrs field.ErrorList, betaEnabled bool) field.ErrorList {
+	enforcedDeclarativeErrs := make(field.ErrorList, 0, len(declarativeErrs))
+	allDeclarativeEnforced := AllDeclarativeEnforced(ctx)
+	for _, dvErr := range declarativeErrs {
+		switch {
+		case allDeclarativeEnforced:
+			enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr)
+		case dvErr.Type == field.ErrorTypeInternal:
+			enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr)
+		case dvErr.IsBeta():
+			if betaEnabled {
+				enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr)
+			}
+		case !dvErr.IsAlpha():
+			enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr) // Standard
+		}
+	}
+	return enforcedDeclarativeErrs
+}
diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/item.go b/vendor/k8s.io/apimachinery/pkg/api/validate/item.go
index aba417fa1d..4ddb2860c5 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/validate/item.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/validate/item.go
@@ -23,36 +23,39 @@ import (
 	"k8s.io/apimachinery/pkg/util/validation/field"
 )
 
-// MatchItemFn takes a pointer to an item and returns true if it matches the criteria.
-type MatchItemFn[T any] func(*T) bool
+// MatchItemFunc takes an item and returns true if it matches the criteria.
+type MatchItemFunc[T any] func(T) bool
 
-// SliceItem finds the first item in newList that satisfies the match function,
-// and if found, also looks for a matching item in oldList. If the value of the
-// item is the same as the previous value, as per the equiv function, then no
-// validation is performed. Otherwise, it invokes 'itemValidator' on these items.
+// ValSliceItem finds the first item in a list of values which satisfies the
+// match function, and if found, also looks for a matching item in oldList. If
+// the value of the item is the same as the previous value, as per the equiv
+// function, then no validation is performed. Otherwise, it invokes
+// 'itemValidator' on these items.
 //
 // This function processes only the *first* matching item found in newList. It
 // assumes that the match functions targets a unique identifier (primary key)
 // and will match at most one element per list. If this assumption is violated,
 // changes in list order can lead this function to have inconsistent behavior.
 //
+// The match and equiv functions will never be called with nil arguments.
+//
 // The fldPath passed to itemValidator is indexed to the matched item's
 // position in newList.
 //
 // This function does not validate items that were removed (present in oldList
 // but not in newList).
-func SliceItem[TList ~[]TItem, TItem any](
+func ValSliceItem[TList ~[]TItem, TItem any](
 	ctx context.Context, op operation.Operation, fldPath *field.Path,
 	newList, oldList TList,
-	matches MatchItemFn[TItem],
-	equiv MatchFunc[TItem],
+	match MatchItemFunc[*TItem],
+	equiv MatchFunc[*TItem],
 	itemValidator func(ctx context.Context, op operation.Operation, fldPath *field.Path, newObj, oldObj *TItem) field.ErrorList,
 ) field.ErrorList {
 	var matchedNew, matchedOld *TItem
 	var newIndex int
 
 	for i := range newList {
-		if matches(&newList[i]) {
+		if match(&newList[i]) {
 			matchedNew = &newList[i]
 			newIndex = i
 			break
@@ -63,13 +66,73 @@ func SliceItem[TList ~[]TItem, TItem any](
 	}
 
 	for i := range oldList {
-		if matches(&oldList[i]) {
+		if match(&oldList[i]) {
 			matchedOld = &oldList[i]
 			break
 		}
 	}
 
-	if op.Type == operation.Update && matchedOld != nil && equiv(*matchedNew, *matchedOld) {
+	if op.Type == operation.Update && matchedOld != nil && equiv(matchedNew, matchedOld) {
+		return nil
+	}
+
+	return itemValidator(ctx, op, fldPath.Index(newIndex), matchedNew, matchedOld)
+}
+
+// PtrSliceItem finds the first item in a list of pointers which satisfies the
+// match function, and if found, also looks for a matching item in oldList. If
+// the value of the item is the same as the previous value, as per the equiv
+// function, then no validation is performed. Otherwise, it invokes
+// 'itemValidator' on these items.
+//
+// This function processes only the *first* matching item found in newList. It
+// assumes that the match functions targets a unique identifier (primary key)
+// and will match at most one element per list. If this assumption is violated,
+// changes in list order can lead this function to have inconsistent behavior.
+//
+// The match and equiv functions will never be called with nil arguments.
+//
+// The fldPath passed to itemValidator is indexed to the matched item's
+// position in newList.
+//
+// This function does not validate items that were removed (present in oldList
+// but not in newList).
+func PtrSliceItem[TList ~[]*TItem, TItem any](
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	newList, oldList TList,
+	match MatchItemFunc[*TItem],
+	equiv MatchFunc[*TItem],
+	itemValidator func(ctx context.Context, op operation.Operation, fldPath *field.Path, newObj, oldObj *TItem) field.ErrorList,
+) field.ErrorList {
+	var matchedNew, matchedOld *TItem
+	var newIndex int
+
+	for i := range newList {
+		if newList[i] == nil {
+			// Ignore nil items; they are supposed to have been checked by PtrSliceNoNils.
+			continue
+		}
+		if match(newList[i]) {
+			matchedNew = newList[i]
+			newIndex = i
+			break
+		}
+	}
+	if matchedNew == nil {
+		return nil
+	}
+
+	for i := range oldList {
+		if oldList[i] == nil {
+			continue
+		}
+		if match(oldList[i]) {
+			matchedOld = oldList[i]
+			break
+		}
+	}
+
+	if op.Type == operation.Update && matchedOld != nil && equiv(matchedNew, matchedOld) {
 		return nil
 	}
 
diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/limits.go b/vendor/k8s.io/apimachinery/pkg/api/validate/limits.go
index dcc7f518d8..768546f6bc 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/validate/limits.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/validate/limits.go
@@ -78,6 +78,18 @@ func MaxItems[T any](_ context.Context, _ operation.Operation, fldPath *field.Pa
 	return nil
 }
 
+// MaxProperties verifies that the specified map has no more than max keys.
+func MaxProperties[K comparable, V any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]V, max int) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+
+	if len(value) > max {
+		return field.ErrorList{field.TooMany(fldPath, len(value), max).WithOrigin("maxProperties")}
+	}
+	return nil
+}
+
 // MinItems verifies that the specified slice is not shorter than min items.
 func MinItems[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ []T, min int) field.ErrorList {
 	if len(value) < min {
@@ -86,6 +98,14 @@ func MinItems[T any](_ context.Context, _ operation.Operation, fldPath *field.Pa
 	return nil
 }
 
+// MinProperties verifies that the specified map is not shorter than min properties.
+func MinProperties[K comparable, V any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]V, min int) field.ErrorList {
+	if len(value) < min {
+		return field.ErrorList{field.TooFew(fldPath, len(value), min).WithOrigin("minProperties")}
+	}
+	return nil
+}
+
 // Minimum verifies that the specified value is greater than or equal to min.
 func Minimum[T constraints.Integer](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, min T) field.ErrorList {
 	if value == nil {
diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/monotonic.go b/vendor/k8s.io/apimachinery/pkg/api/validate/monotonic.go
new file mode 100644
index 0000000000..f0526c9ffe
--- /dev/null
+++ b/vendor/k8s.io/apimachinery/pkg/api/validate/monotonic.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/constraints"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Monotonic validates that an integer value has not decreased on update.
+func Monotonic[T constraints.Integer](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+
+	if value == nil || oldValue == nil {
+		return nil
+	}
+
+	if *value < *oldValue {
+		return field.ErrorList{field.Invalid(fldPath, *value, fmt.Sprintf("may not be decreased from %v", *oldValue)).WithOrigin("monotonic")}
+	}
+
+	return nil
+}
diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/options.go b/vendor/k8s.io/apimachinery/pkg/api/validate/options.go
index 44236550b7..143be3b64a 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/validate/options.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/validate/options.go
@@ -18,6 +18,7 @@ package validate
 
 import (
 	"context"
+	"fmt"
 
 	"k8s.io/apimachinery/pkg/api/operation"
 	"k8s.io/apimachinery/pkg/util/validation/field"
@@ -25,10 +26,14 @@ import (
 
 // IfOption conditionally evaluates a validation function. If the option and enabled are both true the validator
 // is called. If the option and enabled are both false the validator is called. Otherwise, the validator is not called.
-func IfOption[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T,
-	optionName string, enabled bool, validator func(context.Context, operation.Operation, *field.Path, *T, *T) field.ErrorList,
+func IfOption[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue T,
+	optionName string, enabled bool, validator func(context.Context, operation.Operation, *field.Path, T, T) field.ErrorList,
 ) field.ErrorList {
-	if op.HasOption(optionName) == enabled {
+	on, defined := op.HasOption(optionName)
+	if !defined {
+		return field.ErrorList{field.InternalError(fldPath, fmt.Errorf("undefined validation option %q", optionName))}
+	}
+	if on == enabled {
 		return validator(ctx, op, fldPath, value, oldValue)
 	}
 	return nil
diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/strfmt.go b/vendor/k8s.io/apimachinery/pkg/api/validate/strfmt.go
index 190fa8dbe9..893f55d777 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/validate/strfmt.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/validate/strfmt.go
@@ -97,6 +97,28 @@ func LabelKey[T ~string](_ context.Context, op operation.Operation, fldPath *fie
 	return allErrs
 }
 
+// PrefixedLabelKey verifies that the specified value is a valid label key with
+// a domain prefix.
+// A prefixed label key is composed of a prefix and a name, separated by a '/'.
+// The name part is required and must:
+//   - be 63 characters or less
+//   - begin and end with an alphanumeric character ([a-z0-9A-Z])
+//   - contain only alphanumeric characters, dashes (-), underscores (_), or dots (.)
+//
+// The prefix must:
+//   - be a DNS subdomain
+//   - be no more than 253 characters
+func PrefixedLabelKey[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	var allErrs field.ErrorList
+	for _, msg := range content.IsPrefixedLabelKey((string)(*value)) {
+		allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-prefixed-label-key"))
+	}
+	return allErrs
+}
+
 // LongNameCaseless verifies that the specified value is a valid "long name"
 // (sometimes known as a "DNS subdomain"), but is case-insensitive.
 //   - must not be empty
diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/subfield.go b/vendor/k8s.io/apimachinery/pkg/api/validate/subfield.go
index 896f3c3f36..7aa48d3304 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/validate/subfield.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/validate/subfield.go
@@ -31,6 +31,9 @@ type GetFieldFunc[Tstruct any, Tfield any] func(*Tstruct) Tfield
 // the value of the subfield is the same as the previous value, as per the
 // equiv function, then no validation is performed.
 //
+// The equiv function can be called with nil arguments in the case of nilable
+// fields.
+//
 // The fldPath passed to the validator includes the subfield name.
 func Subfield[Tstruct any, Tfield any](
 	ctx context.Context, op operation.Operation, fldPath *field.Path,
diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/update.go b/vendor/k8s.io/apimachinery/pkg/api/validate/update.go
index e67ee28ded..cf4db5b529 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/validate/update.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/validate/update.go
@@ -18,6 +18,8 @@ package validate
 
 import (
 	"context"
+	"fmt"
+	"slices"
 
 	"k8s.io/apimachinery/pkg/api/equality"
 	"k8s.io/apimachinery/pkg/api/operation"
@@ -34,32 +36,39 @@ const (
 	NoUnset
 	// NoModify prevents value changes but allows set/unset transitions
 	NoModify
+	// NoAddItem prevents adding items to a slice or map
+	NoAddItem
+	// NoRemoveItem prevents removing items from a slice or map
+	NoRemoveItem
 )
 
-// UpdateValueByCompare verifies update constraints for comparable value types.
-func UpdateValueByCompare[T comparable](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
-	if op.Type != operation.Update {
+// UpdateValue verifies update constraints for value types.
+func UpdateValue[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, equiv MatchFunc[T], constraints ...UpdateConstraint) field.ErrorList {
+	// nil oldValue means no prior value to compare against (eg: a new item at +k8s:eachVal scope) -> no transition to check.
+	if op.Type != operation.Update || oldValue == nil {
 		return nil
 	}
 
 	var errs field.ErrorList
 	var zero T
+	valueIsZero := equiv(*value, zero)
+	oldValueIsZero := equiv(*oldValue, zero)
 
 	for _, constraint := range constraints {
 		switch constraint {
 		case NoSet:
-			if *oldValue == zero && *value != zero {
+			if oldValueIsZero && !valueIsZero {
 				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
 			}
 		case NoUnset:
-			if *oldValue != zero && *value == zero {
+			if !oldValueIsZero && valueIsZero {
 				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
 			}
 		case NoModify:
 			// Rely on validation ratcheting to detect that the value has changed.
 			// This check only verifies that the field was set in both the old and
 			// new objects, confirming it was a modification, not a set/unset.
-			if *oldValue != zero && *value != zero {
+			if !oldValueIsZero && !valueIsZero {
 				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be modified once set").WithOrigin("update"))
 			}
 		}
@@ -68,6 +77,13 @@ func UpdateValueByCompare[T comparable](_ context.Context, op operation.Operatio
 	return errs
 }
 
+// UpdateValueByCompare verifies update constraints for comparable value types.
+//
+// Deprecated: Use UpdateValue instead.
+func UpdateValueByCompare[T comparable](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+	return UpdateValue(ctx, op, fldPath, value, oldValue, func(a, b T) bool { return a == b }, constraints...)
+}
+
 // UpdatePointer verifies update constraints for pointer types.
 func UpdatePointer[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
 	if op.Type != operation.Update {
@@ -100,32 +116,79 @@ func UpdatePointer[T any](_ context.Context, op operation.Operation, fldPath *fi
 }
 
 // UpdateValueByReflect verifies update constraints for non-comparable value types using reflection.
-func UpdateValueByReflect[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+//
+// Deprecated: Use UpdateValue instead.
+func UpdateValueByReflect[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+	return UpdateValue(ctx, op, fldPath, value, oldValue, func(a, b T) bool { return equality.Semantic.DeepEqual(a, b) }, constraints...)
+}
+
+// UpdateStruct verifies update constraints for non-pointer struct types.
+// Non-pointer structs are always considered "set" and never "unset".
+func UpdateStruct[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+	// nil oldValue means no prior value to compare against (eg: a new item at +k8s:eachVal scope) -> no transition to check.
+	if op.Type != operation.Update || oldValue == nil {
+		return nil
+	}
+
+	var errs field.ErrorList
+
+	for _, constraint := range constraints {
+		switch constraint {
+		case NoSet, NoUnset:
+			// These constraints don't apply to non-pointer structs
+			// as they can't be unset. This should be caught at generation time.
+			continue
+		case NoModify:
+			// Non-pointer structs are always considered "set". Therefore, any
+			// change detected by validation ratcheting is a modification.
+			// The deep equality check is redundant and has been removed.
+			errs = append(errs, field.Invalid(fldPath, nil, "field cannot be modified once set").WithOrigin("update"))
+		}
+	}
+
+	return errs
+}
+
+// ValSliceUpdate verifies update constraints for slices of values.
+// NoAddItem and NoRemoveItem use the match function to find corresponding
+// elements between value and oldValue. NoSet and NoUnset treat len == 0 as
+// "unset".
+//
+// The match function will never be called with nil arguments.
+func ValSliceUpdate[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue []T, match MatchFunc[*T], constraints ...UpdateConstraint) field.ErrorList {
 	if op.Type != operation.Update {
 		return nil
 	}
 
+	if match == nil && (slices.Contains(constraints, NoAddItem) || slices.Contains(constraints, NoRemoveItem)) {
+		return field.ErrorList{field.InternalError(fldPath, fmt.Errorf("ValSliceUpdate: NoAddItem/NoRemoveItem require a non-nil match function"))}
+	}
+
 	var errs field.ErrorList
-	var zero T
-	valueIsZero := equality.Semantic.DeepEqual(*value, zero)
-	oldValueIsZero := equality.Semantic.DeepEqual(*oldValue, zero)
 
 	for _, constraint := range constraints {
 		switch constraint {
 		case NoSet:
-			if oldValueIsZero && !valueIsZero {
+			if len(oldValue) == 0 && len(value) > 0 {
 				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
 			}
 		case NoUnset:
-			if !oldValueIsZero && valueIsZero {
+			if len(oldValue) > 0 && len(value) == 0 {
 				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
 			}
-		case NoModify:
-			// Rely on validation ratcheting to detect that the value has changed.
-			// This check only verifies that the field was set in both the old and
-			// new objects, confirming it was a modification, not a set/unset.
-			if !oldValueIsZero && !valueIsZero {
-				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be modified once set").WithOrigin("update"))
+		case NoAddItem:
+			for i := range value {
+				newItem := &value[i]
+				if lookup(oldValue, newItem, match) == nil {
+					errs = append(errs, field.Forbidden(fldPath.Index(i), "item may not be added").WithOrigin("update"))
+				}
+			}
+		case NoRemoveItem:
+			for i := range oldValue {
+				oldItem := &oldValue[i]
+				if lookup(value, oldItem, match) == nil {
+					errs = append(errs, field.Forbidden(fldPath, "item may not be removed").WithOrigin("update"))
+				}
 			}
 		}
 	}
@@ -133,26 +196,92 @@ func UpdateValueByReflect[T any](_ context.Context, op operation.Operation, fldP
 	return errs
 }
 
-// UpdateStruct verifies update constraints for non-pointer struct types.
-// Non-pointer structs are always considered "set" and never "unset".
-func UpdateStruct[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList {
+// PtrSliceUpdate verifies update constraints for slices of pointers.
+// NoAddItem and NoRemoveItem use the match function to find corresponding
+// elements between value and oldValue. NoSet and NoUnset treat len == 0 as
+// "unset".
+//
+// The match function will never be called with nil arguments.
+func PtrSliceUpdate[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue []*T, match MatchFunc[*T], constraints ...UpdateConstraint) field.ErrorList {
 	if op.Type != operation.Update {
 		return nil
 	}
 
+	if match == nil && (slices.Contains(constraints, NoAddItem) || slices.Contains(constraints, NoRemoveItem)) {
+		return field.ErrorList{field.InternalError(fldPath, fmt.Errorf("PtrSliceUpdate: NoAddItem/NoRemoveItem require a non-nil match function"))}
+	}
+
 	var errs field.ErrorList
 
 	for _, constraint := range constraints {
 		switch constraint {
-		case NoSet, NoUnset:
-			// These constraints don't apply to non-pointer structs
-			// as they can't be unset. This should be caught at generation time.
-			continue
-		case NoModify:
-			// Non-pointer structs are always considered "set". Therefore, any
-			// change detected by validation ratcheting is a modification.
-			// The deep equality check is redundant and has been removed.
-			errs = append(errs, field.Invalid(fldPath, nil, "field cannot be modified once set").WithOrigin("update"))
+		case NoSet:
+			if len(oldValue) == 0 && len(value) > 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+			}
+		case NoUnset:
+			if len(oldValue) > 0 && len(value) == 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+			}
+		case NoAddItem:
+			for i := range value {
+				newItem := value[i]
+				if newItem == nil {
+					// Ignore nil items; they are supposed to have been checked by PtrSliceNoNils.
+					continue
+				}
+				if lookupPointer(oldValue, newItem, match) == nil {
+					errs = append(errs, field.Forbidden(fldPath.Index(i), "item may not be added").WithOrigin("update"))
+				}
+			}
+		case NoRemoveItem:
+			for i := range oldValue {
+				oldItem := oldValue[i]
+				if oldItem == nil {
+					continue
+				}
+				if lookupPointer(value, oldItem, match) == nil {
+					errs = append(errs, field.Forbidden(fldPath, "item may not be removed").WithOrigin("update"))
+				}
+			}
+		}
+	}
+
+	return errs
+}
+
+// UpdateMap verifies update constraints for map types.
+// NoAddItem and NoRemoveItem compare keys between value and oldValue. NoSet
+// and NoUnset treat len == 0 as "unset".
+func UpdateMap[K comparable, V any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue map[K]V, constraints ...UpdateConstraint) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+
+	var errs field.ErrorList
+
+	for _, constraint := range constraints {
+		switch constraint {
+		case NoSet:
+			if len(oldValue) == 0 && len(value) > 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update"))
+			}
+		case NoUnset:
+			if len(oldValue) > 0 && len(value) == 0 {
+				errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update"))
+			}
+		case NoAddItem:
+			for k := range value {
+				if _, ok := oldValue[k]; !ok {
+					errs = append(errs, field.Forbidden(fldPath.Key(fmt.Sprintf("%v", k)), "item may not be added").WithOrigin("update"))
+				}
+			}
+		case NoRemoveItem:
+			for k := range oldValue {
+				if _, ok := value[k]; !ok {
+					errs = append(errs, field.Forbidden(fldPath.Key(fmt.Sprintf("%v", k)), "item may not be removed").WithOrigin("update"))
+				}
+			}
 		}
 	}
 
diff --git a/vendor/k8s.io/apimachinery/pkg/api/validation/objectmeta.go b/vendor/k8s.io/apimachinery/pkg/api/validation/objectmeta.go
index 839fcbc2c1..ff86973fbd 100644
--- a/vendor/k8s.io/apimachinery/pkg/api/validation/objectmeta.go
+++ b/vendor/k8s.io/apimachinery/pkg/api/validation/objectmeta.go
@@ -17,11 +17,14 @@ limitations under the License.
 package validation
 
 import (
+	"context"
 	"fmt"
 	"strings"
 
 	apiequality "k8s.io/apimachinery/pkg/api/equality"
 	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	v1validation "k8s.io/apimachinery/pkg/apis/meta/v1/validation"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -46,7 +49,7 @@ func ValidateAnnotations(annotations map[string]string, fldPath *field.Path) fie
 	for k := range annotations {
 		// The rule is QualifiedName except that case doesn't matter, so convert to lowercase before checking.
 		for _, msg := range validation.IsQualifiedName(strings.ToLower(k)) {
-			allErrs = append(allErrs, field.Invalid(fldPath, k, msg)).WithOrigin("format=k8s-label-key")
+			allErrs = append(allErrs, field.Invalid(fldPath, k, msg).WithOrigin("format=k8s-label-key"))
 		}
 	}
 	if err := ValidateAnnotationsSize(annotations); err != nil {
@@ -68,20 +71,23 @@ func ValidateAnnotationsSize(annotations map[string]string) error {
 
 func validateOwnerReference(ownerReference metav1.OwnerReference, fldPath *field.Path) field.ErrorList {
 	allErrs := field.ErrorList{}
-	gvk := schema.FromAPIVersionAndKind(ownerReference.APIVersion, ownerReference.Kind)
+	gv, err := schema.ParseGroupVersion(ownerReference.APIVersion)
 	// gvk.Group is empty for the legacy group.
-	if len(gvk.Version) == 0 {
-		allErrs = append(allErrs, field.Invalid(fldPath.Child("apiVersion"), ownerReference.APIVersion, "version must not be empty"))
+	if len(ownerReference.APIVersion) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("apiVersion"), "must not be empty").MarkCoveredByDeclarative())
+	} else if err != nil || len(gv.Version) == 0 {
+		allErrs = append(allErrs, field.Invalid(fldPath.Child("apiVersion"), ownerReference.APIVersion, "must be <group>/<version> or <version>"))
 	}
-	if len(gvk.Kind) == 0 {
-		allErrs = append(allErrs, field.Invalid(fldPath.Child("kind"), ownerReference.Kind, "must not be empty"))
+	if len(ownerReference.Kind) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("kind"), "must not be empty").MarkCoveredByDeclarative())
 	}
 	if len(ownerReference.Name) == 0 {
-		allErrs = append(allErrs, field.Invalid(fldPath.Child("name"), ownerReference.Name, "must not be empty"))
+		allErrs = append(allErrs, field.Required(fldPath.Child("name"), "must not be empty").MarkCoveredByDeclarative())
 	}
 	if len(ownerReference.UID) == 0 {
-		allErrs = append(allErrs, field.Invalid(fldPath.Child("uid"), ownerReference.UID, "must not be empty"))
+		allErrs = append(allErrs, field.Required(fldPath.Child("uid"), "must not be empty").MarkCoveredByDeclarative())
 	}
+	gvk := gv.WithKind(ownerReference.Kind)
 	if _, ok := BannedOwners[gvk]; ok {
 		allErrs = append(allErrs, field.Invalid(fldPath, ownerReference, fmt.Sprintf("%s is disallowed from being an owner", gvk)))
 	}
@@ -92,8 +98,8 @@ func validateOwnerReference(ownerReference metav1.OwnerReference, fldPath *field
 func ValidateOwnerReferences(ownerReferences []metav1.OwnerReference, fldPath *field.Path) field.ErrorList {
 	allErrs := field.ErrorList{}
 	firstControllerName := ""
-	for _, ref := range ownerReferences {
-		allErrs = append(allErrs, validateOwnerReference(ref, fldPath)...)
+	for idx, ref := range ownerReferences {
+		allErrs = append(allErrs, validateOwnerReference(ref, fldPath.Index(idx))...)
 		if ref.Controller != nil && *ref.Controller {
 			curControllerName := ref.Kind + "/" + ref.Name
 			if firstControllerName != "" {
@@ -136,6 +142,25 @@ func ValidateImmutableField(newVal, oldVal interface{}, fldPath *field.Path) fie
 	return allErrs
 }
 
+// ValidateObjectMetaDeclaratively validates an ObjectMeta instance declaratively and deduplicates handwritten errors.
+// betaEnabled controls whether declarative validation rules at the Beta stability level are enforced.
+// NOTE: This method should be used in the types for which declarative validation is not enabled yet or cannot be enabled. The types
+// for which declarative validation is enabled and valdiation code is generated must use ValidateObjectMeta and ValidateObjectMetaUpdate.
+func ValidateObjectMetaDeclaratively(ctx context.Context, op operation.Type, obj, oldObj *metav1.ObjectMeta, requiresNamespace bool, nameFn ValidateNameFunc, fldPath *field.Path, betaEnabled bool) field.ErrorList {
+	var errs field.ErrorList
+	switch op {
+	case operation.Create:
+		errs = ValidateObjectMeta(obj, requiresNamespace, nameFn, fldPath)
+	case operation.Update:
+		errs = ValidateObjectMetaUpdate(obj, oldObj, fldPath)
+	}
+	dvErrs := v1validation.Validate_ObjectMeta(ctx, operation.Operation{Type: op}, fldPath, obj, oldObj)
+	enforcedDVErrs := validate.FilterEnforcedDeclarativeErrors(ctx, dvErrs, betaEnabled)
+	errs = errs.MarkFromImperative()
+	errs = validate.FilterCoveredHandwrittenErrors(ctx, errs, enforcedDVErrs, betaEnabled)
+	return append(errs, enforcedDVErrs...)
+}
+
 // ValidateObjectMeta validates an object's metadata on creation. It expects that name generation has already
 // been performed.
 func ValidateObjectMeta(objMeta *metav1.ObjectMeta, requiresNamespace bool, nameFn ValidateNameFunc, fldPath *field.Path) field.ErrorList {
@@ -262,12 +287,12 @@ func validateObjectMetaAccessorWithOptsCommon(meta metav1.Object, isNamespaced b
 		}
 	}
 
-	allErrs = append(allErrs, ValidateNonnegativeField(meta.GetGeneration(), fldPath.Child("generation"))...)
+	allErrs = append(allErrs, ValidateNonnegativeField(meta.GetGeneration(), fldPath.Child("generation")).MarkCoveredByDeclarative()...)
 	allErrs = append(allErrs, v1validation.ValidateLabels(meta.GetLabels(), fldPath.Child("labels"))...)
 	allErrs = append(allErrs, ValidateAnnotations(meta.GetAnnotations(), fldPath.Child("annotations"))...)
 	allErrs = append(allErrs, ValidateOwnerReferences(meta.GetOwnerReferences(), fldPath.Child("ownerReferences"))...)
 	allErrs = append(allErrs, ValidateFinalizers(meta.GetFinalizers(), fldPath.Child("finalizers"))...)
-	allErrs = append(allErrs, v1validation.ValidateManagedFields(meta.GetManagedFields(), fldPath.Child("managedFields"))...)
+	allErrs = append(allErrs, v1validation.ValidateManagedFields(meta.GetManagedFields(), fldPath.Child("managedFields"), v1validation.CoveredByDeclarative)...)
 	return allErrs
 }
 
@@ -323,21 +348,22 @@ func ValidateObjectMetaAccessorUpdate(newMeta, oldMeta metav1.Object, fldPath *f
 	}
 
 	// Generation shouldn't be decremented
+	allErrs = append(allErrs, ValidateNonnegativeField(newMeta.GetGeneration(), fldPath.Child("generation")).MarkCoveredByDeclarative()...)
 	if newMeta.GetGeneration() < oldMeta.GetGeneration() {
 		allErrs = append(allErrs, field.Invalid(fldPath.Child("generation"), newMeta.GetGeneration(), "must not be decremented"))
 	}
 
 	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetName(), oldMeta.GetName(), fldPath.Child("name"))...)
 	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetNamespace(), oldMeta.GetNamespace(), fldPath.Child("namespace"))...)
-	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetUID(), oldMeta.GetUID(), fldPath.Child("uid"))...)
-	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetCreationTimestamp(), oldMeta.GetCreationTimestamp(), fldPath.Child("creationTimestamp"))...)
-	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetDeletionTimestamp(), oldMeta.GetDeletionTimestamp(), fldPath.Child("deletionTimestamp"))...)
-	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetDeletionGracePeriodSeconds(), oldMeta.GetDeletionGracePeriodSeconds(), fldPath.Child("deletionGracePeriodSeconds"))...)
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetUID(), oldMeta.GetUID(), fldPath.Child("uid")).WithOrigin("immutable").MarkCoveredByDeclarative()...)
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetCreationTimestamp(), oldMeta.GetCreationTimestamp(), fldPath.Child("creationTimestamp")).WithOrigin("immutable").MarkCoveredByDeclarative()...)
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetDeletionTimestamp(), oldMeta.GetDeletionTimestamp(), fldPath.Child("deletionTimestamp")).WithOrigin("immutable").MarkCoveredByDeclarative()...)
+	allErrs = append(allErrs, ValidateImmutableField(newMeta.GetDeletionGracePeriodSeconds(), oldMeta.GetDeletionGracePeriodSeconds(), fldPath.Child("deletionGracePeriodSeconds")).WithOrigin("immutable").MarkCoveredByDeclarative()...)
 
 	allErrs = append(allErrs, v1validation.ValidateLabels(newMeta.GetLabels(), fldPath.Child("labels"))...)
 	allErrs = append(allErrs, ValidateAnnotations(newMeta.GetAnnotations(), fldPath.Child("annotations"))...)
 	allErrs = append(allErrs, ValidateOwnerReferences(newMeta.GetOwnerReferences(), fldPath.Child("ownerReferences"))...)
-	allErrs = append(allErrs, v1validation.ValidateManagedFields(newMeta.GetManagedFields(), fldPath.Child("managedFields"))...)
+	allErrs = append(allErrs, v1validation.ValidateManagedFields(newMeta.GetManagedFields(), fldPath.Child("managedFields"), v1validation.CoveredByDeclarative)...)
 
 	return allErrs
 }
diff --git a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto
index d03a733141..afc9b250fa 100644
--- a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto
+++ b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto
@@ -179,6 +179,9 @@ message ApplyOptions {
 // 	    // +patchStrategy=merge
 // 	    // +listType=map
 // 	    // +listMapKey=type
+// 	    // +k8s:alpha(since: "1.37")=+k8s:optional
+// 	    // +k8s:alpha(since: "1.37")=+k8s:listType=map
+// 	    // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 // 	    Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
 //
 // 	    // other fields
@@ -193,12 +196,14 @@ message Condition {
   // +kubebuilder:validation:Required
   // +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$`
   // +kubebuilder:validation:MaxLength=316
+  // +k8s:alpha(since: "1.37")=+k8s:required
   optional string type = 1;
 
   // status of the condition, one of True, False, Unknown.
   // +required
   // +kubebuilder:validation:Required
   // +kubebuilder:validation:Enum=True;False;Unknown
+  // +k8s:alpha(since: "1.37")=+k8s:required
   optional string status = 2;
 
   // observedGeneration represents the .metadata.generation that the condition was set based upon.
@@ -206,6 +211,8 @@ message Condition {
   // with respect to the current state of the instance.
   // +optional
   // +kubebuilder:validation:Minimum=0
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:minimum=0
   optional int64 observedGeneration = 3;
 
   // lastTransitionTime is the last time the condition transitioned from one status to another.
@@ -214,6 +221,7 @@ message Condition {
   // +kubebuilder:validation:Required
   // +kubebuilder:validation:Type=string
   // +kubebuilder:validation:Format=date-time
+  // +k8s:alpha(since: "1.37")=+k8s:customValidation
   optional Time lastTransitionTime = 4;
 
   // reason contains a programmatic identifier indicating the reason for the condition's last transition.
@@ -226,6 +234,8 @@ message Condition {
   // +kubebuilder:validation:MaxLength=1024
   // +kubebuilder:validation:MinLength=1
   // +kubebuilder:validation:Pattern=`^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$`
+  // +k8s:alpha(since: "1.37")=+k8s:required
+  // +k8s:alpha(since: "1.37")=+k8s:maxBytes=1024
   optional string reason = 5;
 
   // message is a human readable message indicating details about the transition.
@@ -700,6 +710,7 @@ message ManagedFieldsEntry {
 
   // Operation is the type of operation which lead to this ManagedFieldsEntry being created.
   // The only valid values for this field are 'Apply' and 'Update'.
+  // +k8s:alpha(since: "1.37")=+k8s:required
   optional string operation = 2;
 
   // APIVersion defines the version of this resource that this field set
@@ -802,6 +813,8 @@ message ObjectMeta {
   // Read-only.
   // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
   optional string uid = 5;
 
   // An opaque value that represents the internal version of this object that can
@@ -820,6 +833,8 @@ message ObjectMeta {
   // A sequence number representing a specific generation of the desired state.
   // Populated by the system. Read-only.
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:minimum=0
   optional int64 generation = 7;
 
   // CreationTimestamp is a timestamp representing the server time when this object was
@@ -831,6 +846,7 @@ message ObjectMeta {
   // Null for lists.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
   optional Time creationTimestamp = 8;
 
   // DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This
@@ -852,6 +868,8 @@ message ObjectMeta {
   // Read-only.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
   optional Time deletionTimestamp = 9;
 
   // Number of seconds allowed for this object to gracefully terminate before
@@ -859,6 +877,8 @@ message ObjectMeta {
   // May only be shortened.
   // Read-only.
   // +optional
+  // +k8s:alpha(since: "1.37")=+k8s:optional
+  // +k8s:alpha(since: "1.37")=+k8s:immutable
   optional int64 deletionGracePeriodSeconds = 10;
 
   // Map of string keys and values that can be used to organize and categorize
@@ -884,6 +904,7 @@ message ObjectMeta {
   // +patchStrategy=merge
   // +listType=map
   // +listMapKey=uid
+  // +k8s:alpha(since:"1.37")=+k8s:optional
   repeated OwnerReference ownerReferences = 13;
 
   // Must be empty before the object is deleted from the registry. Each entry
@@ -914,6 +935,7 @@ message ObjectMeta {
   //
   // +optional
   // +listType=atomic
+  // +k8s:alpha(since: "1.37")=+k8s:optional
   repeated ManagedFieldsEntry managedFields = 17;
 }
 
@@ -923,18 +945,22 @@ message ObjectMeta {
 // +structType=atomic
 message OwnerReference {
   // API version of the referent.
+  // +k8s:alpha(since:"1.37")=+k8s:required
   optional string apiVersion = 5;
 
   // Kind of the referent.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+  // +k8s:alpha(since:"1.37")=+k8s:required
   optional string kind = 1;
 
   // Name of the referent.
   // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+  // +k8s:alpha(since:"1.37")=+k8s:required
   optional string name = 3;
 
   // UID of the referent.
   // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+  // +k8s:alpha(since:"1.37")=+k8s:required
   optional string uid = 4;
 
   // If true, this reference points to the managing controller.
@@ -960,6 +986,7 @@ message PartialObjectMetadata {
   // Standard object's metadata.
   // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
   // +optional
+  // +k8s:opaqueType
   optional ObjectMeta metadata = 1;
 }
 
diff --git a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/types.go b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/types.go
index c8b87f20c8..f88212e15e 100644
--- a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/types.go
+++ b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/types.go
@@ -176,6 +176,8 @@ type ObjectMeta struct {
 	// Read-only.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
 	UID types.UID `json:"uid,omitempty" protobuf:"bytes,5,opt,name=uid,casttype=k8s.io/kubernetes/pkg/types.UID"`
 
 	// An opaque value that represents the internal version of this object that can
@@ -194,6 +196,8 @@ type ObjectMeta struct {
 	// A sequence number representing a specific generation of the desired state.
 	// Populated by the system. Read-only.
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:minimum=0
 	Generation int64 `json:"generation,omitempty" protobuf:"varint,7,opt,name=generation"`
 
 	// CreationTimestamp is a timestamp representing the server time when this object was
@@ -205,6 +209,7 @@ type ObjectMeta struct {
 	// Null for lists.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
 	CreationTimestamp Time `json:"creationTimestamp,omitempty,omitzero" protobuf:"bytes,8,opt,name=creationTimestamp"`
 
 	// DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This
@@ -226,6 +231,8 @@ type ObjectMeta struct {
 	// Read-only.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
 	DeletionTimestamp *Time `json:"deletionTimestamp,omitempty" protobuf:"bytes,9,opt,name=deletionTimestamp"`
 
 	// Number of seconds allowed for this object to gracefully terminate before
@@ -233,6 +240,8 @@ type ObjectMeta struct {
 	// May only be shortened.
 	// Read-only.
 	// +optional
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:immutable
 	DeletionGracePeriodSeconds *int64 `json:"deletionGracePeriodSeconds,omitempty" protobuf:"varint,10,opt,name=deletionGracePeriodSeconds"`
 
 	// Map of string keys and values that can be used to organize and categorize
@@ -258,6 +267,7 @@ type ObjectMeta struct {
 	// +patchStrategy=merge
 	// +listType=map
 	// +listMapKey=uid
+	// +k8s:alpha(since:"1.37")=+k8s:optional
 	OwnerReferences []OwnerReference `json:"ownerReferences,omitempty" patchStrategy:"merge" patchMergeKey:"uid" protobuf:"bytes,13,rep,name=ownerReferences"`
 
 	// Must be empty before the object is deleted from the registry. Each entry
@@ -292,6 +302,7 @@ type ObjectMeta struct {
 	//
 	// +optional
 	// +listType=atomic
+	// +k8s:alpha(since: "1.37")=+k8s:optional
 	ManagedFields []ManagedFieldsEntry `json:"managedFields,omitempty" protobuf:"bytes,17,rep,name=managedFields"`
 }
 
@@ -314,15 +325,19 @@ const (
 // +structType=atomic
 type OwnerReference struct {
 	// API version of the referent.
+	// +k8s:alpha(since:"1.37")=+k8s:required
 	APIVersion string `json:"apiVersion" protobuf:"bytes,5,opt,name=apiVersion"`
 	// Kind of the referent.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +k8s:alpha(since:"1.37")=+k8s:required
 	Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"`
 	// Name of the referent.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
+	// +k8s:alpha(since:"1.37")=+k8s:required
 	Name string `json:"name" protobuf:"bytes,3,opt,name=name"`
 	// UID of the referent.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
+	// +k8s:alpha(since:"1.37")=+k8s:required
 	UID types.UID `json:"uid" protobuf:"bytes,4,opt,name=uid,casttype=k8s.io/apimachinery/pkg/types.UID"`
 	// If true, this reference points to the managing controller.
 	// +optional
@@ -344,7 +359,7 @@ type OwnerReference struct {
 
 // ListOptions is the query options to a standard REST list call.
 type ListOptions struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 
 	// A selector to restrict the list of returned objects by their labels.
 	// Defaults to everything.
@@ -517,7 +532,7 @@ const (
 
 // GetOptions is the standard query options to the standard REST get call.
 type GetOptions struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 	// resourceVersion sets a constraint on what resource versions a request may be served from.
 	// See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
 	// details.
@@ -557,7 +572,7 @@ const (
 
 // DeleteOptions may be provided when deleting an API object.
 type DeleteOptions struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 
 	// The duration in seconds before the object should be deleted. Value must be non-negative integer.
 	// The value zero indicates delete immediately. If this value is nil, the default grace period for the
@@ -629,7 +644,7 @@ const (
 
 // CreateOptions may be provided when creating an API object.
 type CreateOptions struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 
 	// When present, indicates that modifications should not be
 	// persisted. An invalid or unrecognized dryRun directive will
@@ -674,7 +689,7 @@ type CreateOptions struct {
 // PatchOptions may be provided when patching an API object.
 // PatchOptions is meant to be a superset of UpdateOptions.
 type PatchOptions struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 
 	// When present, indicates that modifications should not be
 	// persisted. An invalid or unrecognized dryRun directive will
@@ -726,7 +741,7 @@ type PatchOptions struct {
 // ApplyOptions is equivalent to PatchOptions. It is provided as a convenience with documentation
 // that speaks specifically to how the options fields relate to apply.
 type ApplyOptions struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 
 	// When present, indicates that modifications should not be
 	// persisted. An invalid or unrecognized dryRun directive will
@@ -759,7 +774,7 @@ func (o ApplyOptions) ToPatchOptions() PatchOptions {
 // UpdateOptions may be provided when updating an API object.
 // All fields in UpdateOptions should also be present in PatchOptions.
 type UpdateOptions struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 
 	// When present, indicates that modifications should not be
 	// persisted. An invalid or unrecognized dryRun directive will
@@ -811,7 +826,7 @@ type Preconditions struct {
 
 // Status is a return value for calls that don't return other objects.
 type Status struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -1131,7 +1146,7 @@ const (
 
 // List holds a list of objects, which may not be known by the server.
 type List struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -1147,7 +1162,7 @@ type List struct {
 // +protobuf.options.(gogoproto.goproto_stringer)=false
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 type APIVersions struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 	// versions are the api versions that are available.
 	// +listType=atomic
 	Versions []string `json:"versions" protobuf:"bytes,1,rep,name=versions"`
@@ -1167,7 +1182,7 @@ type APIVersions struct {
 // APIGroupList is a list of APIGroup, to allow clients to discover the API at
 // /apis.
 type APIGroupList struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 	// groups is a list of APIGroup.
 	// +listType=atomic
 	Groups []APIGroup `json:"groups" protobuf:"bytes,1,rep,name=groups"`
@@ -1178,7 +1193,7 @@ type APIGroupList struct {
 // APIGroup contains the name, the supported versions, and the preferred version
 // of a group.
 type APIGroup struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 	// name is the name of the group.
 	Name string `json:"name" protobuf:"bytes,1,opt,name=name"`
 	// versions are the versions supported in this group.
@@ -1273,7 +1288,7 @@ func (vs Verbs) String() string {
 // resources supported in a specific group and version, and if the resource
 // is namespaced.
 type APIResourceList struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 	// groupVersion is the group and version this APIResourceList is for.
 	GroupVersion string `json:"groupVersion" protobuf:"bytes,1,opt,name=groupVersion"`
 	// resources contains the name of the resources and if they are namespaced.
@@ -1394,6 +1409,7 @@ type ManagedFieldsEntry struct {
 	Manager string `json:"manager,omitempty" protobuf:"bytes,1,opt,name=manager"`
 	// Operation is the type of operation which lead to this ManagedFieldsEntry being created.
 	// The only valid values for this field are 'Apply' and 'Update'.
+	// +k8s:alpha(since: "1.37")=+k8s:required
 	Operation ManagedFieldsOperationType `json:"operation,omitempty" protobuf:"bytes,2,opt,name=operation,casttype=ManagedFieldsOperationType"`
 	// APIVersion defines the version of this resource that this field set
 	// applies to. The format is "group/version" just like the top-level
@@ -1429,6 +1445,7 @@ type ManagedFieldsEntry struct {
 }
 
 // ManagedFieldsOperationType is the type of operation which lead to a ManagedFieldsEntry being created.
+// +k8s:alpha(since: "1.37")=+k8s:enum
 type ManagedFieldsOperationType string
 
 const (
@@ -1446,7 +1463,7 @@ const (
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +protobuf=false
 type Table struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -1537,6 +1554,7 @@ const (
 	RowCompleted RowConditionType = "Completed"
 )
 
+// +k8s:alpha(since: "1.37")=+k8s:enum
 type ConditionStatus string
 
 // These are valid condition statuses. "ConditionTrue" means a resource is in the condition.
@@ -1565,7 +1583,7 @@ const (
 // +k8s:conversion-gen:explicit-from=net/url.Values
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 type TableOptions struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 
 	// NoHeaders is only exposed for internal callers. It is not included in our OpenAPI definitions
 	// and may be removed as a field in a future release.
@@ -1582,17 +1600,18 @@ type TableOptions struct {
 // to get access to a particular ObjectMeta schema without knowing the details of the version.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 type PartialObjectMetadata struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
+	// +k8s:opaqueType
 	ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 }
 
 // PartialObjectMetadataList contains a list of objects containing only their metadata
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 type PartialObjectMetadataList struct {
-	TypeMeta `json:",inline"`
+	TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -1613,6 +1632,9 @@ type PartialObjectMetadataList struct {
 //	    // +patchStrategy=merge
 //	    // +listType=map
 //	    // +listMapKey=type
+//	    // +k8s:alpha(since: "1.37")=+k8s:optional
+//	    // +k8s:alpha(since: "1.37")=+k8s:listType=map
+//	    // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 //	    Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
 //
 //	    // other fields
@@ -1627,17 +1649,21 @@ type Condition struct {
 	// +kubebuilder:validation:Required
 	// +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$`
 	// +kubebuilder:validation:MaxLength=316
+	// +k8s:alpha(since: "1.37")=+k8s:required
 	Type string `json:"type" protobuf:"bytes,1,opt,name=type"`
 	// status of the condition, one of True, False, Unknown.
 	// +required
 	// +kubebuilder:validation:Required
 	// +kubebuilder:validation:Enum=True;False;Unknown
+	// +k8s:alpha(since: "1.37")=+k8s:required
 	Status ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status"`
 	// observedGeneration represents the .metadata.generation that the condition was set based upon.
 	// For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
 	// with respect to the current state of the instance.
 	// +optional
 	// +kubebuilder:validation:Minimum=0
+	// +k8s:alpha(since: "1.37")=+k8s:optional
+	// +k8s:alpha(since: "1.37")=+k8s:minimum=0
 	ObservedGeneration int64 `json:"observedGeneration,omitempty" protobuf:"varint,3,opt,name=observedGeneration"`
 	// lastTransitionTime is the last time the condition transitioned from one status to another.
 	// This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
@@ -1645,6 +1671,7 @@ type Condition struct {
 	// +kubebuilder:validation:Required
 	// +kubebuilder:validation:Type=string
 	// +kubebuilder:validation:Format=date-time
+	// +k8s:alpha(since: "1.37")=+k8s:customValidation
 	LastTransitionTime Time `json:"lastTransitionTime" protobuf:"bytes,4,opt,name=lastTransitionTime"`
 	// reason contains a programmatic identifier indicating the reason for the condition's last transition.
 	// Producers of specific condition types may define expected values and meanings for this field,
@@ -1656,6 +1683,8 @@ type Condition struct {
 	// +kubebuilder:validation:MaxLength=1024
 	// +kubebuilder:validation:MinLength=1
 	// +kubebuilder:validation:Pattern=`^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$`
+	// +k8s:alpha(since: "1.37")=+k8s:required
+	// +k8s:alpha(since: "1.37")=+k8s:maxBytes=1024
 	Reason string `json:"reason" protobuf:"bytes,5,opt,name=reason"`
 	// message is a human readable message indicating details about the transition.
 	// This may be an empty string.
diff --git a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers.go b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers.go
index 59f43b7bff..592445d9c8 100644
--- a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers.go
+++ b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers.go
@@ -523,6 +523,7 @@ func NewJSONFallbackEncoder(encoder runtime.Encoder) runtime.Encoder {
 	}
 	identifier, err := gojson.Marshal(result)
 	if err != nil {
+		//nolint:logcheck // Should not be reached.
 		klog.Fatalf("Failed marshaling identifier for jsonFallbackEncoder: %v", err)
 	}
 	return &jsonFallbackEncoder{
diff --git a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/doc.go b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/doc.go
new file mode 100644
index 0000000000..3b9cb30f2a
--- /dev/null
+++ b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/doc.go
@@ -0,0 +1,21 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// +k8s:validation-gen=TypesWithField=TypeMeta
+// +k8s:validation-gen-input=k8s.io/apimachinery/pkg/apis/meta/v1
+
+// Package validation holds generated validations for meta/v1 types.
+package validation
diff --git a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation.go b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation.go
index d0ca20013a..b9ec344270 100644
--- a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation.go
+++ b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation.go
@@ -17,10 +17,12 @@ limitations under the License.
 package validation
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"unicode"
 
+	"k8s.io/apimachinery/pkg/api/operation"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/sets"
@@ -266,14 +268,39 @@ func ValidateTableOptions(opts *metav1.TableOptions) field.ErrorList {
 
 const MaxSubresourceNameLength = 256
 
-func ValidateManagedFields(fieldsList []metav1.ManagedFieldsEntry, fldPath *field.Path) field.ErrorList {
+// ManagedFieldsValidationOption specifies options for validating managed fields.
+type ManagedFieldsValidationOption int
+
+const (
+	// CoveredByDeclarative indicates whether errors should be marked as covered by declarative validation.
+	CoveredByDeclarative ManagedFieldsValidationOption = iota + 1
+)
+
+// ValidateManagedFields validates a list of managed fields.
+func ValidateManagedFields(fieldsList []metav1.ManagedFieldsEntry, fldPath *field.Path, opts ...ManagedFieldsValidationOption) field.ErrorList {
+	coveredByDeclarative := false
+	for _, opt := range opts {
+		if opt == CoveredByDeclarative {
+			coveredByDeclarative = true
+		}
+	}
 	var allErrs field.ErrorList
 	for i, fields := range fieldsList {
 		fldPath := fldPath.Index(i)
 		switch fields.Operation {
+		case "":
+			err := field.Required(fldPath.Child("operation"), "must not be empty")
+			if coveredByDeclarative {
+				err = err.MarkCoveredByDeclarative()
+			}
+			allErrs = append(allErrs, err)
 		case metav1.ManagedFieldsOperationApply, metav1.ManagedFieldsOperationUpdate:
 		default:
-			allErrs = append(allErrs, field.Invalid(fldPath.Child("operation"), fields.Operation, "must be `Apply` or `Update`"))
+			err := field.NotSupported(fldPath.Child("operation"), fields.Operation, []metav1.ManagedFieldsOperationType{metav1.ManagedFieldsOperationApply, metav1.ManagedFieldsOperationUpdate})
+			if coveredByDeclarative {
+				err = err.MarkCoveredByDeclarative()
+			}
+			allErrs = append(allErrs, err)
 		}
 		if len(fields.FieldsType) > 0 && fields.FieldsType != "FieldsV1" {
 			allErrs = append(allErrs, field.Invalid(fldPath.Child("fieldsType"), fields.FieldsType, "must be `FieldsV1`"))
@@ -293,7 +320,7 @@ func ValidateConditions(conditions []metav1.Condition, fldPath *field.Path) fiel
 	conditionTypeToFirstIndex := map[string]int{}
 	for i, condition := range conditions {
 		if _, ok := conditionTypeToFirstIndex[condition.Type]; ok {
-			allErrs = append(allErrs, field.Duplicate(fldPath.Index(i).Child("type"), condition.Type))
+			allErrs = append(allErrs, field.Duplicate(fldPath.Index(i), condition.Type).MarkCoveredByDeclarative())
 		} else {
 			conditionTypeToFirstIndex[condition.Type] = i
 		}
@@ -316,29 +343,35 @@ func ValidateCondition(condition metav1.Condition, fldPath *field.Path) field.Er
 	var allErrs field.ErrorList
 
 	// type is set and is a valid format
-	allErrs = append(allErrs, ValidateLabelName(condition.Type, fldPath.Child("type"))...)
+	if len(condition.Type) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("type"), "is required").MarkCoveredByDeclarative())
+	} else {
+		allErrs = append(allErrs, ValidateLabelName(condition.Type, fldPath.Child("type"))...)
+	}
 
 	// status is set and is an accepted value
-	if !validConditionStatuses.Has(string(condition.Status)) {
-		allErrs = append(allErrs, field.NotSupported(fldPath.Child("status"), condition.Status, validConditionStatuses.List()))
+	if len(condition.Status) == 0 {
+		allErrs = append(allErrs, field.Required(fldPath.Child("status"), "").MarkCoveredByDeclarative())
+	} else if !validConditionStatuses.Has(string(condition.Status)) {
+		allErrs = append(allErrs, field.NotSupported(fldPath.Child("status"), condition.Status, validConditionStatuses.List()).MarkCoveredByDeclarative())
 	}
 
 	if condition.ObservedGeneration < 0 {
-		allErrs = append(allErrs, field.Invalid(fldPath.Child("observedGeneration"), condition.ObservedGeneration, "must be greater than or equal to zero"))
+		allErrs = append(allErrs, field.Invalid(fldPath.Child("observedGeneration"), condition.ObservedGeneration, "must be greater than or equal to zero").WithOrigin("minimum").MarkCoveredByDeclarative())
 	}
 
 	if condition.LastTransitionTime.IsZero() {
-		allErrs = append(allErrs, field.Required(fldPath.Child("lastTransitionTime"), ""))
+		allErrs = append(allErrs, field.Required(fldPath.Child("lastTransitionTime"), "").MarkCoveredByDeclarative())
 	}
 
 	if len(condition.Reason) == 0 {
-		allErrs = append(allErrs, field.Required(fldPath.Child("reason"), ""))
+		allErrs = append(allErrs, field.Required(fldPath.Child("reason"), "").MarkCoveredByDeclarative())
 	} else {
-		for _, currErr := range isValidConditionReason(condition.Reason) {
+		for _, currErr := range IsValidConditionReason(condition.Reason) {
 			allErrs = append(allErrs, field.Invalid(fldPath.Child("reason"), condition.Reason, currErr))
 		}
 		if len(condition.Reason) > maxReasonLen {
-			allErrs = append(allErrs, field.TooLong(fldPath.Child("reason"), "" /*unused*/, maxReasonLen))
+			allErrs = append(allErrs, field.TooLong(fldPath.Child("reason"), "" /*unused*/, maxReasonLen).WithOrigin("maxBytes").MarkCoveredByDeclarative())
 		}
 	}
 
@@ -354,8 +387,9 @@ const conditionReasonErrMsg string = "a condition reason must start with alphabe
 
 var conditionReasonRegexp = regexp.MustCompile("^" + conditionReasonFmt + "$")
 
-// isValidConditionReason tests for a string that conforms to rules for condition reasons. This checks the format, but not the length.
-func isValidConditionReason(value string) []string {
+// IsValidConditionReason tests for a string that conforms to rules for condition
+// reasons. This checks the format, but not the length.
+func IsValidConditionReason(value string) []string {
 	if !conditionReasonRegexp.MatchString(value) {
 		return []string{validation.RegexError(conditionReasonErrMsg, conditionReasonFmt, "my_name", "MY_NAME", "MyName", "ReasonA,ReasonB", "ReasonA:ReasonB")}
 	}
@@ -370,9 +404,6 @@ func ValidateIgnoreStoreReadError(fldPath *field.Path, options *metav1.DeleteOpt
 		return allErrs
 	}
 
-	if len(options.DryRun) > 0 {
-		allErrs = append(allErrs, field.Invalid(fldPath, true, "cannot be set together with .dryRun"))
-	}
 	if options.PropagationPolicy != nil {
 		allErrs = append(allErrs, field.Invalid(fldPath, true, "cannot be set together with .propagationPolicy"))
 	}
@@ -389,3 +420,14 @@ func ValidateIgnoreStoreReadError(fldPath *field.Path, options *metav1.DeleteOpt
 
 	return allErrs
 }
+
+// ValidateCustom_Condition_LastTransitionTime is wired into the generated
+// declarative validation by +k8s:customValidation on Condition.LastTransitionTime.
+// It enforces that the field is set, mirroring the handwritten check in
+// ValidateCondition.
+func ValidateCustom_Condition_LastTransitionTime(ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *metav1.Time) field.ErrorList {
+	if value.IsZero() {
+		return field.ErrorList{field.Required(fldPath, "")}
+	}
+	return nil
+}
diff --git a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/zz_generated.validations.go b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/zz_generated.validations.go
new file mode 100644
index 0000000000..f79373a26d
--- /dev/null
+++ b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/zz_generated.validations.go
@@ -0,0 +1,638 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by validation-gen. DO NOT EDIT.
+
+package validation
+
+import (
+	context "context"
+
+	equality "k8s.io/apimachinery/pkg/api/equality"
+	operation "k8s.io/apimachinery/pkg/api/operation"
+	safe "k8s.io/apimachinery/pkg/api/safe"
+	validate "k8s.io/apimachinery/pkg/api/validate"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	sets "k8s.io/apimachinery/pkg/util/sets"
+	field "k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Validate_Condition validates an instance of Condition according
+// to declarative validation rules in the API schema.
+func Validate_Condition(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.Condition) (errs field.ErrorList) {
+
+	{ // field v1.Condition.Type
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.Condition) *string {
+				return &oldObj.Type
+			})
+		errs = append(errs, fn(fldPath.Child("type"), &obj.Type, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.Condition.Status
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.ConditionStatus,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ConditionStatus(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.Condition) *v1.ConditionStatus {
+				return &oldObj.Status
+			})
+		errs = append(errs, fn(fldPath.Child("status"), &obj.Status, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.Condition.ObservedGeneration
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.Condition) *int64 {
+				return &oldObj.ObservedGeneration
+			})
+		errs = append(errs, fn(fldPath.Child("observedGeneration"), &obj.ObservedGeneration, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.Condition.LastTransitionTime
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.Time,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			// custom validation
+			if e := ValidateCustom_Condition_LastTransitionTime(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.Condition) *v1.Time {
+				return &oldObj.LastTransitionTime
+			})
+		errs = append(errs, fn(fldPath.Child("lastTransitionTime"), &obj.LastTransitionTime, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.Condition.Reason
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 1024).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.Condition) *string {
+				return &oldObj.Reason
+			})
+		errs = append(errs, fn(fldPath.Child("reason"), &obj.Reason, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.Condition.Message has no validation
+	return errs
+}
+
+var symbolsForConditionStatus = sets.New(v1.ConditionFalse, v1.ConditionTrue, v1.ConditionUnknown)
+
+// Validate_ConditionStatus validates an instance of ConditionStatus according
+// to declarative validation rules in the API schema.
+func Validate_ConditionStatus(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.ConditionStatus) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForConditionStatus, nil).MarkAlpha(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ManagedFieldsEntry validates an instance of ManagedFieldsEntry according
+// to declarative validation rules in the API schema.
+func Validate_ManagedFieldsEntry(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.ManagedFieldsEntry) (errs field.ErrorList) {
+
+	// field v1.ManagedFieldsEntry.Manager has no validation
+
+	{ // field v1.ManagedFieldsEntry.Operation
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.ManagedFieldsOperationType,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// call the type's validation function
+			errs = append(errs, Validate_ManagedFieldsOperationType(ctx, op, fldPath, obj, oldObj)...)
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ManagedFieldsEntry) *v1.ManagedFieldsOperationType {
+				return &oldObj.Operation
+			})
+		errs = append(errs, fn(fldPath.Child("operation"), &obj.Operation, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.ManagedFieldsEntry.APIVersion has no validation
+	// field v1.ManagedFieldsEntry.Time has no validation
+	// field v1.ManagedFieldsEntry.FieldsType has no validation
+	// field v1.ManagedFieldsEntry.FieldsV1 has no validation
+	// field v1.ManagedFieldsEntry.Subresource has no validation
+	return errs
+}
+
+var symbolsForManagedFieldsOperationType = sets.New(v1.ManagedFieldsOperationApply, v1.ManagedFieldsOperationUpdate)
+
+// Validate_ManagedFieldsOperationType validates an instance of ManagedFieldsOperationType according
+// to declarative validation rules in the API schema.
+func Validate_ManagedFieldsOperationType(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.ManagedFieldsOperationType) (errs field.ErrorList) {
+
+	if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForManagedFieldsOperationType, nil).MarkAlpha(); len(e) != 0 {
+		errs = append(errs, e...)
+	}
+
+	return errs
+}
+
+// Validate_ObjectMeta validates an instance of ObjectMeta according
+// to declarative validation rules in the API schema.
+func Validate_ObjectMeta(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.ObjectMeta) (errs field.ErrorList) {
+
+	// field v1.ObjectMeta.Name has no validation
+	// field v1.ObjectMeta.GenerateName has no validation
+	// field v1.ObjectMeta.Namespace has no validation
+	// field v1.ObjectMeta.SelfLink has no validation
+
+	{ // field v1.ObjectMeta.UID
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *types.UID,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) *types.UID {
+				return &oldObj.UID
+			})
+		errs = append(errs, fn(fldPath.Child("uid"), &obj.UID, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.ObjectMeta.ResourceVersion has no validation
+
+	{ // field v1.ObjectMeta.Generation
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0).MarkAlpha(); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) *int64 {
+				return &oldObj.Generation
+			})
+		errs = append(errs, fn(fldPath.Child("generation"), &obj.Generation, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.ObjectMeta.CreationTimestamp
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.Time,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) *v1.Time {
+				return &oldObj.CreationTimestamp
+			})
+		errs = append(errs, fn(fldPath.Child("creationTimestamp"), &obj.CreationTimestamp, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.ObjectMeta.DeletionTimestamp
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *v1.Time,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) *v1.Time {
+				return oldObj.DeletionTimestamp
+			})
+		errs = append(errs, fn(fldPath.Child("deletionTimestamp"), obj.DeletionTimestamp, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.ObjectMeta.DeletionGracePeriodSeconds
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *int64,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) *int64 {
+				return oldObj.DeletionGracePeriodSeconds
+			})
+		errs = append(errs, fn(fldPath.Child("deletionGracePeriodSeconds"), obj.DeletionGracePeriodSeconds, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.ObjectMeta.Labels has no validation
+	// field v1.ObjectMeta.Annotations has no validation
+
+	{ // field v1.ObjectMeta.OwnerReferences
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []v1.OwnerReference,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_OwnerReference); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) []v1.OwnerReference {
+				return oldObj.OwnerReferences
+			})
+		errs = append(errs, fn(fldPath.Child("ownerReferences"), obj.OwnerReferences, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.ObjectMeta.Finalizers has no validation
+
+	{ // field v1.ObjectMeta.ManagedFields
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj []v1.ManagedFieldsEntry,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if equality.Semantic.DeepEqual(obj, oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			// iterate the list and call the type's validation function
+			if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_ManagedFieldsEntry); len(e) != 0 {
+				errs = append(errs, e...)
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.ObjectMeta) []v1.ManagedFieldsEntry {
+				return oldObj.ManagedFields
+			})
+		errs = append(errs, fn(fldPath.Child("managedFields"), obj.ManagedFields, oldVal, oldObj != nil)...)
+	}
+
+	return errs
+}
+
+// Validate_OwnerReference validates an instance of OwnerReference according
+// to declarative validation rules in the API schema.
+func Validate_OwnerReference(
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	obj, oldObj *v1.OwnerReference) (errs field.ErrorList) {
+
+	{ // field v1.OwnerReference.APIVersion
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.OwnerReference) *string {
+				return &oldObj.APIVersion
+			})
+		errs = append(errs, fn(fldPath.Child("apiVersion"), &obj.APIVersion, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.OwnerReference.Kind
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.OwnerReference) *string {
+				return &oldObj.Kind
+			})
+		errs = append(errs, fn(fldPath.Child("kind"), &obj.Kind, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.OwnerReference.Name
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *string,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.OwnerReference) *string {
+				return &oldObj.Name
+			})
+		errs = append(errs, fn(fldPath.Child("name"), &obj.Name, oldVal, oldObj != nil)...)
+	}
+
+	{ // field v1.OwnerReference.UID
+		fn := func(
+			fldPath *field.Path,
+			obj, oldObj *types.UID,
+			oldValueCorrelated bool) (errs field.ErrorList) {
+			// don't revalidate unchanged data
+			if oldValueCorrelated && op.Type == operation.Update {
+				if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) {
+					return nil
+				}
+			}
+			// call field-attached validations
+			earlyReturn := false
+			if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 {
+				errs = append(errs, e...)
+				earlyReturn = true
+			}
+			if earlyReturn {
+				return // do not proceed
+			}
+			return
+		}
+		oldVal := safe.Field(oldObj,
+			func(oldObj *v1.OwnerReference) *types.UID {
+				return &oldObj.UID
+			})
+		errs = append(errs, fn(fldPath.Child("uid"), &obj.UID, oldVal, oldObj != nil)...)
+	}
+
+	// field v1.OwnerReference.Controller has no validation
+	// field v1.OwnerReference.BlockOwnerDeletion has no validation
+	return errs
+}
diff --git a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types.go b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types.go
index 68f261cc14..1cda0840ac 100644
--- a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types.go
+++ b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1beta1/types.go
@@ -62,7 +62,7 @@ type PartialObjectMetadata = v1.PartialObjectMetadata
 // PartialObjectMetadataList contains a list of objects containing only their metadata.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 type PartialObjectMetadataList struct {
-	v1.TypeMeta `json:",inline"`
+	v1.TypeMeta `json:""`
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
diff --git a/vendor/k8s.io/apimachinery/pkg/conversion/queryparams/convert.go b/vendor/k8s.io/apimachinery/pkg/conversion/queryparams/convert.go
index b0a9246d97..5eb25e2e80 100644
--- a/vendor/k8s.io/apimachinery/pkg/conversion/queryparams/convert.go
+++ b/vendor/k8s.io/apimachinery/pkg/conversion/queryparams/convert.go
@@ -34,8 +34,8 @@ type Unmarshaler interface {
 }
 
 func jsonTag(field reflect.StructField) (string, bool) {
-	structTag := field.Tag.Get("json")
-	if len(structTag) == 0 {
+	structTag, exists := field.Tag.Lookup("json")
+	if !exists || len(structTag) == 0 {
 		return "", false
 	}
 	parts := strings.Split(structTag, ",")
diff --git a/vendor/k8s.io/apimachinery/pkg/labels/selector.go b/vendor/k8s.io/apimachinery/pkg/labels/selector.go
index 031dcd21be..f31a890f2b 100644
--- a/vendor/k8s.io/apimachinery/pkg/labels/selector.go
+++ b/vendor/k8s.io/apimachinery/pkg/labels/selector.go
@@ -269,13 +269,15 @@ func (r *Requirement) Matches(ls Labels) bool {
 		}
 		lsValue, err := strconv.ParseInt(val, 10, 64)
 		if err != nil {
-			klog.V(10).Infof("ParseInt failed for value %+v in label %+v, %+v", val, ls, err)
+			//nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this.
+			klog.V(10).InfoS("ParseInt failed", "value", val, "label", ls, "err", err)
 			return false
 		}
 
 		// There should be only one strValue in r.strValues, and can be converted to an integer.
 		if len(r.strValues) != 1 {
-			klog.V(10).Infof("Invalid values count %+v of requirement %#v, for 'Gt', 'Lt' operators, exactly one value is required", len(r.strValues), r)
+			//nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this.
+			klog.V(10).InfoS("Invalid values count: for 'Gt', 'Lt' operators, exactly one value is required", "count", len(r.strValues), "requirement", r)
 			return false
 		}
 
@@ -283,7 +285,8 @@ func (r *Requirement) Matches(ls Labels) bool {
 		for i := range r.strValues {
 			rValue, err = strconv.ParseInt(r.strValues[i], 10, 64)
 			if err != nil {
-				klog.V(10).Infof("ParseInt failed for value %+v in requirement %#v, for 'Gt', 'Lt' operators, the value must be an integer", r.strValues[i], r)
+				//nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this.
+				klog.V(10).InfoS("ParseInt failed: for 'Gt', 'Lt' operators, the value must be an integer", "value", r.strValues[i], "requirement", r, "err", err)
 				return false
 			}
 		}
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/codec.go b/vendor/k8s.io/apimachinery/pkg/runtime/codec.go
index 73f85286c2..654835b3ed 100644
--- a/vendor/k8s.io/apimachinery/pkg/runtime/codec.go
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/codec.go
@@ -226,6 +226,7 @@ func identifier(e Encoder) Identifier {
 	}
 	identifier, err := json.Marshal(result)
 	if err != nil {
+		//nolint:logcheck // Should not be reached.
 		klog.Fatalf("Failed marshaling identifier for base64Serializer: %v", err)
 	}
 	return Identifier(identifier)
@@ -390,6 +391,7 @@ func (v multiGroupVersioner) Identifier() string {
 	}
 	identifier, err := json.Marshal(result)
 	if err != nil {
+		//nolint:logcheck // Should not be reached.
 		klog.Fatalf("Failed marshaling Identifier for %#v: %v", v, err)
 	}
 	return string(identifier)
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/conversion.go b/vendor/k8s.io/apimachinery/pkg/runtime/conversion.go
index d04d701f37..7cef382de2 100644
--- a/vendor/k8s.io/apimachinery/pkg/runtime/conversion.go
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/conversion.go
@@ -20,7 +20,6 @@ package runtime
 
 import (
 	"fmt"
-	"reflect"
 	"strconv"
 	"strings"
 
@@ -41,18 +40,6 @@ func DefaultMetaV1FieldSelectorConversion(label, value string) (string, string,
 	}
 }
 
-// JSONKeyMapper uses the struct tags on a conversion to determine the key value for
-// the other side. Use when mapping from a map[string]* to a struct or vice versa.
-func JSONKeyMapper(key string, sourceTag, destTag reflect.StructTag) (string, string) {
-	if s := destTag.Get("json"); len(s) > 0 {
-		return strings.SplitN(s, ",", 2)[0], key
-	}
-	if s := sourceTag.Get("json"); len(s) > 0 {
-		return key, strings.SplitN(s, ",", 2)[0]
-	}
-	return key, key
-}
-
 func Convert_Slice_string_To_string(in *[]string, out *string, s conversion.Scope) error {
 	if len(*in) == 0 {
 		*out = ""
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/converter.go b/vendor/k8s.io/apimachinery/pkg/runtime/converter.go
index b1a300959b..5aa118f58f 100644
--- a/vendor/k8s.io/apimachinery/pkg/runtime/converter.go
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/converter.go
@@ -251,9 +251,11 @@ func (c *unstructuredConverter) FromUnstructuredWithValidation(u map[string]inte
 		newObj := reflect.New(t.Elem()).Interface()
 		newErr := fromUnstructuredViaJSON(u, newObj)
 		if (err != nil) != (newErr != nil) {
+			//nolint:logcheck // Should not be reached.
 			klog.Fatalf("FromUnstructured unexpected error for %v: error: %v", u, err)
 		}
 		if err == nil && !c.comparison.DeepEqual(obj, newObj) {
+			//nolint:logcheck // Should not be reached.
 			klog.Fatalf("FromUnstructured mismatch\nobj1: %#v\nobj2: %#v", obj, newObj)
 		}
 	}
@@ -376,8 +378,8 @@ func fieldInfoFromField(structType reflect.Type, field int) *fieldInfo {
 	// Cache miss - we need to compute the field name.
 	info := &fieldInfo{}
 	typeField := structType.Field(field)
-	jsonTag := typeField.Tag.Get("json")
-	if len(jsonTag) == 0 {
+	jsonTag, exists := typeField.Tag.Lookup("json")
+	if !exists || len(jsonTag) == 0 {
 		if !typeField.Anonymous {
 			// match stdlib behavior for naming fields that don't specify a json tag name
 			info.name = typeField.Name
@@ -385,7 +387,10 @@ func fieldInfoFromField(structType reflect.Type, field int) *fieldInfo {
 	} else {
 		items := strings.Split(jsonTag, ",")
 		info.name = items[0]
-		if len(info.name) == 0 && !typeField.Anonymous {
+		if isInlinedFromTag(typeField, items[0], items[1:]) {
+			// match stdlib behavior when controlled by tag
+			info.name = ""
+		} else if len(info.name) == 0 && !typeField.Anonymous {
 			// match stdlib behavior for naming fields that don't specify a json tag name
 			info.name = typeField.Name
 		}
@@ -596,9 +601,11 @@ func (c *unstructuredConverter) ToUnstructured(obj interface{}) (map[string]inte
 		newUnstr := map[string]interface{}{}
 		newErr := toUnstructuredViaJSON(obj, &newUnstr)
 		if (err != nil) != (newErr != nil) {
+			//nolint:logcheck // Should not be reached.
 			klog.Fatalf("ToUnstructured unexpected error for %v: error: %v; newErr: %v", obj, err, newErr)
 		}
 		if err == nil && !c.comparison.DeepEqual(u, newUnstr) {
+			//nolint:logcheck // Should not be reached.
 			klog.Fatalf("ToUnstructured mismatch\nobj1: %#v\nobj2: %#v", u, newUnstr)
 		}
 	}
@@ -680,11 +687,11 @@ func toUnstructured(sv, dv reflect.Value) error {
 		dv.Set(reflect.ValueOf(sv.Int()))
 		return nil
 	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		uVal := sv.Uint()
-		if uVal > math.MaxInt64 {
-			return fmt.Errorf("unsigned value %d does not fit into int64 (overflow)", uVal)
+		val, err := uintToUnstructuredHelper(sv.Uint())
+		if err != nil {
+			return err
 		}
-		dv.Set(reflect.ValueOf(int64(uVal)))
+		dv.Set(reflect.ValueOf(val))
 		return nil
 	case reflect.Float32, reflect.Float64:
 		dv.Set(reflect.ValueOf(sv.Float()))
@@ -846,7 +853,11 @@ func structToUnstructured(sv, dv reflect.Value) error {
 		case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
 			realMap[fieldInfo.name] = fv.Int()
 		case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-			realMap[fieldInfo.name] = fv.Uint()
+			val, err := uintToUnstructuredHelper(fv.Uint())
+			if err != nil {
+				return err
+			}
+			realMap[fieldInfo.name] = val
 		case reflect.Float32, reflect.Float64:
 			realMap[fieldInfo.name] = fv.Float()
 		default:
@@ -867,3 +878,10 @@ func interfaceToUnstructured(sv, dv reflect.Value) error {
 	}
 	return toUnstructured(sv.Elem(), dv)
 }
+
+func uintToUnstructuredHelper(uVal uint64) (int64, error) {
+	if uVal > math.MaxInt64 {
+		return 0, fmt.Errorf("unsigned value %d does not fit into int64 (overflow)", uVal)
+	}
+	return int64(uVal), nil
+}
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/fieldinfo_126.go b/vendor/k8s.io/apimachinery/pkg/runtime/fieldinfo_126.go
new file mode 100644
index 0000000000..686ff6abb3
--- /dev/null
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/fieldinfo_126.go
@@ -0,0 +1,26 @@
+//go:build !go1.27
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import "reflect"
+
+func isInlinedFromTag(fieldType reflect.StructField, tagName string, tagDirectives []string) bool {
+	// go <1.27 doesn't honor ",inline"
+	return false
+}
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/fieldinfo_127.go b/vendor/k8s.io/apimachinery/pkg/runtime/fieldinfo_127.go
new file mode 100644
index 0000000000..abaa79a2db
--- /dev/null
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/fieldinfo_127.go
@@ -0,0 +1,33 @@
+//go:build go1.27
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package runtime
+
+import (
+	"reflect"
+)
+
+func isInlinedFromTag(field reflect.StructField, tagName string, tagDirectives []string) bool {
+	fieldType := field.Type
+	if fieldType.Kind() == reflect.Pointer && fieldType.Name() == "" {
+		// optionally unwrap a single level
+		fieldType = fieldType.Elem()
+	}
+	// TODO: when switching to direct use of json/v2, error on non-struct embedding and use of embed with other directives
+	return fieldType.Kind() == reflect.Struct && tagName == "" && len(tagDirectives) == 1 && tagDirectives[0] == "embed"
+}
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/generated.proto b/vendor/k8s.io/apimachinery/pkg/runtime/generated.proto
index 5f06cc5743..93d187d94a 100644
--- a/vendor/k8s.io/apimachinery/pkg/runtime/generated.proto
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/generated.proto
@@ -33,7 +33,7 @@ option go_package = "k8s.io/apimachinery/pkg/runtime";
 // // Internal package:
 //
 // 	type MyAPIObject struct {
-// 		runtime.TypeMeta `json:",inline"`
+// 		runtime.TypeMeta `json:""`
 // 		MyPlugin runtime.Object `json:"myPlugin"`
 // 	}
 //
@@ -44,7 +44,7 @@ option go_package = "k8s.io/apimachinery/pkg/runtime";
 // // External package:
 //
 // 	type MyAPIObject struct {
-// 		runtime.TypeMeta `json:",inline"`
+// 		runtime.TypeMeta `json:""`
 // 		MyPlugin runtime.RawExtension `json:"myPlugin"`
 // 	}
 //
@@ -85,7 +85,7 @@ message RawExtension {
 // like this:
 //
 // 	type MyAwesomeAPIObject struct {
-// 	     runtime.TypeMeta    `json:",inline"`
+// 	     runtime.TypeMeta    `json:""`
 // 	     ... // other fields
 // 	}
 //
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/helper.go b/vendor/k8s.io/apimachinery/pkg/runtime/helper.go
index 395dfdbd02..242a349865 100644
--- a/vendor/k8s.io/apimachinery/pkg/runtime/helper.go
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/helper.go
@@ -285,20 +285,26 @@ func (e *encoderWithAllocator) Identifier() Identifier {
 	return e.encoder.Identifier()
 }
 
+// The legacy discovery endpoint requires that its response Encoder implement Serializer.
+// https://github.com/kubernetes/kubernetes/blob/4a1340bfd58fdb3846d4342c101e0bcb574fbfb1/staging/src/k8s.io/apiserver/pkg/endpoints/discovery/util.go#L101-L107
+var _ Serializer = nondeterministicEncoderToEncoderAdapter{}
+
 type nondeterministicEncoderToEncoderAdapter struct {
 	NondeterministicEncoder
+
+	Decoder
 }
 
 func (e nondeterministicEncoderToEncoderAdapter) Encode(obj Object, w io.Writer) error {
 	return e.EncodeNondeterministic(obj, w)
 }
 
-// UseNondeterministicEncoding returns an Encoder that encodes objects using the provided Encoder's
-// EncodeNondeterministic method if it implements NondeterministicEncoder, otherwise it returns the
-// provided Encoder as-is.
-func UseNondeterministicEncoding(encoder Encoder) Encoder {
-	if nondeterministic, ok := encoder.(NondeterministicEncoder); ok {
-		return nondeterministicEncoderToEncoderAdapter{nondeterministic}
+// UseNondeterministicEncoding returns an Encoder that encodes objects using the provided
+// Serializer's EncodeNondeterministic method if it implements NondeterministicEncoder, otherwise it
+// returns the provided Serializer as-is.
+func UseNondeterministicEncoding(serializer Serializer) Encoder {
+	if nondeterministic, ok := serializer.(NondeterministicEncoder); ok {
+		return nondeterministicEncoderToEncoderAdapter{NondeterministicEncoder: nondeterministic, Decoder: serializer}
 	}
-	return encoder
+	return serializer
 }
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/scheme.go b/vendor/k8s.io/apimachinery/pkg/runtime/scheme.go
index e2fbeabdd0..80662e55c4 100644
--- a/vendor/k8s.io/apimachinery/pkg/runtime/scheme.go
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/scheme.go
@@ -370,7 +370,7 @@ func (s *Scheme) AddValidationFunc(srcType Object, fn func(ctx context.Context,
 // Validate validates the provided Object according to the generated declarative validation code.
 // WARNING: This does not validate all objects!  The handwritten validation code in validation.go
 // is not run when this is called.  Only the generated zz_generated.validations.go validation code is run.
-func (s *Scheme) Validate(ctx context.Context, options []string, object Object, subresources ...string) field.ErrorList {
+func (s *Scheme) Validate(ctx context.Context, options map[string]bool, object Object, subresources ...string) field.ErrorList {
 	if fn, ok := s.validationFuncs[reflect.TypeOf(object)]; ok {
 		return fn(ctx, operation.Operation{Type: operation.Create, Request: operation.Request{Subresources: subresources}, Options: options}, object, nil)
 	}
@@ -380,13 +380,21 @@ func (s *Scheme) Validate(ctx context.Context, options []string, object Object,
 // ValidateUpdate validates the provided object and oldObject according to the generated declarative validation code.
 // WARNING: This does not validate all objects!  The handwritten validation code in validation.go
 // is not run when this is called.  Only the generated zz_generated.validations.go validation code is run.
-func (s *Scheme) ValidateUpdate(ctx context.Context, options []string, object, oldObject Object, subresources ...string) field.ErrorList {
+func (s *Scheme) ValidateUpdate(ctx context.Context, options map[string]bool, object, oldObject Object, subresources ...string) field.ErrorList {
 	if fn, ok := s.validationFuncs[reflect.TypeOf(object)]; ok {
 		return fn(ctx, operation.Operation{Type: operation.Update, Request: operation.Request{Subresources: subresources}, Options: options}, object, oldObject)
 	}
 	return nil
 }
 
+// HasValidationFunc reports whether a validation function is registered for the
+// object's type. Unlike Validate, it distinguishes "no function registered" from
+// "function ran and found no errors", which both yield a nil error list.
+func (s *Scheme) HasValidationFunc(obj Object) bool {
+	_, ok := s.validationFuncs[reflect.TypeOf(obj)]
+	return ok
+}
+
 // Convert will attempt to convert in into out. Both must be pointers. For easy
 // testing of conversion functions. Returns an error if the conversion isn't
 // possible. You can call this with types that haven't been registered (for example,
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor.go
index 118579ec35..e5730e3c50 100644
--- a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor.go
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor.go
@@ -68,8 +68,9 @@ type Serializer interface {
 var _ Serializer = &serializer{}
 
 type options struct {
-	strict    bool
-	transcode bool
+	strict                       bool
+	transcode                    bool
+	streamingCollectionsEncoding bool
 }
 
 type Option func(*options)
@@ -92,6 +93,13 @@ func Transcode(s bool) Option {
 	}
 }
 
+// StreamingCollectionsEncoding is used for testing purposes only.
+func StreamingCollectionsEncoding(s bool) Option {
+	return func(opts *options) {
+		opts.streamingCollectionsEncoding = s
+	}
+}
+
 type serializer struct {
 	metaFactory metaFactory
 	creater     runtime.ObjectCreater
@@ -114,6 +122,7 @@ func newSerializer(metaFactory metaFactory, creater runtime.ObjectCreater, typer
 		typer:       typer,
 	}
 	s.options.transcode = true
+	s.options.streamingCollectionsEncoding = true
 	for _, o := range options {
 		o(&s.options)
 	}
@@ -147,15 +156,25 @@ func (s *serializer) EncodeNondeterministic(obj runtime.Object, w io.Writer) err
 }
 
 func (s *serializer) encode(mode modes.EncMode, obj runtime.Object, w io.Writer) error {
+	if _, err := w.Write(selfDescribedCBOR); err != nil {
+		return err
+	}
+
+	if s.options.streamingCollectionsEncoding {
+		ok, err := streamEncodeCollections(obj, w, mode)
+		if err != nil {
+			return err
+		}
+		if ok {
+			return nil
+		}
+	}
+
 	var v interface{} = obj
 	if u, ok := obj.(runtime.Unstructured); ok {
 		v = u.UnstructuredContent()
 	}
 
-	if _, err := w.Write(selfDescribedCBOR); err != nil {
-		return err
-	}
-
 	return mode.MarshalTo(v, w)
 }
 
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections.go
new file mode 100644
index 0000000000..5aa0fb7ca4
--- /dev/null
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections.go
@@ -0,0 +1,328 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cbor
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"maps"
+	"math/rand"
+	"reflect"
+	"slices"
+	"sort"
+
+	"k8s.io/apimachinery/pkg/conversion"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes"
+
+	"github.com/fxamacker/cbor/v2"
+)
+
+func streamEncodeCollections(obj runtime.Object, w io.Writer, mode modes.EncMode) (bool, error) {
+	list, ok := obj.(*unstructured.UnstructuredList)
+	if ok {
+		return true, streamingEncodeUnstructuredList(w, list, mode)
+	}
+	if _, ok := obj.(cbor.Marshaler); ok {
+		return false, nil
+	}
+	if _, ok := obj.(json.Marshaler); ok {
+		return false, nil
+	}
+	typeMeta, listMeta, items, err := getListMeta(obj)
+	if err == nil {
+		return true, streamingEncodeList(w, typeMeta, listMeta, items, mode)
+	}
+	return false, nil
+}
+
+// getListMeta implements list extraction logic for cbor stream serialization.
+func getListMeta(list runtime.Object) (metav1.TypeMeta, metav1.ListMeta, []interface{}, error) {
+	listValue, err := conversion.EnforcePtr(list)
+	if err != nil {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, err
+	}
+	listType := listValue.Type()
+	if listType.NumField() != 3 {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected ListType to have 3 fields")
+	}
+	// The streaming encoder reproduces the field names and layout implied by the
+	// json struct tags (kind, apiVersion, metadata, items). The CBOR encoder,
+	// however, gives a "cbor" struct tag precedence over "json", so a cbor tag on
+	// any of these fields could rename a key, change its options (e.g. keyasint),
+	// or un-inline the embedded TypeMeta -- diverging from the streamed output.
+	// Refuse to stream such a type and fall back to the general encoder, which
+	// honors the cbor tag correctly.
+	for i := 0; i < listType.NumField(); i++ {
+		if _, ok := listType.Field(i).Tag.Lookup("cbor"); ok {
+			return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected list field %d to have no cbor tag", i)
+		}
+	}
+	// TypeMeta
+	typeMeta, ok := listValue.Field(0).Interface().(metav1.TypeMeta)
+	if !ok {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected TypeMeta field to have TypeMeta type")
+	}
+	if !listType.Field(0).Anonymous {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be embedded`)
+	}
+	if jsonTag, jsonTagExists := listType.Field(0).Tag.Lookup("json"); !jsonTagExists {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag`)
+	} else if jsonTag != "" && jsonTag != ",inline" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be "" or ",inline"`)
+	}
+	// ListMeta
+	listMeta, ok := listValue.Field(1).Interface().(metav1.ListMeta)
+	if !ok {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected ListMeta field to have ListMeta type")
+	}
+	if listType.Field(1).Tag.Get("json") != "metadata,omitempty" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected ListMeta json field tag to be "metadata,omitempty"`)
+	}
+	// Items
+	if listType.Field(2).Tag.Get("json") != "items" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected Items json field tag to be "items"`)
+	}
+	items, err := getListItems(listValue.Field(2))
+	if err != nil {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, err
+	}
+	return typeMeta, listMeta, items, nil
+}
+
+// getListItems returns the elements of a list's Items field as addressable
+// values. Marshaling each element directly (rather than routing through
+// meta.ExtractList) preserves the element's own type and custom marshaler, so
+// that e.g. a metav1.List whose Items are runtime.RawExtension holding CBOR
+// bytes are encoded verbatim by runtime.RawExtension.MarshalCBOR instead of
+// being flattened into a runtime.Unknown (which has no MarshalCBOR and would be
+// misencoded as a struct or fail JSON transcoding).
+//
+// A nil Items slice returns a nil result, distinct from an empty non-nil slice,
+// so the encoder can emit CBOR null rather than an empty array.
+func getListItems(itemsValue reflect.Value) ([]interface{}, error) {
+	if itemsValue.Kind() != reflect.Slice {
+		return nil, fmt.Errorf("expected Items field to be a slice, got %s", itemsValue.Kind())
+	}
+	if itemsValue.IsNil() {
+		return nil, nil
+	}
+	items := make([]interface{}, itemsValue.Len())
+	for i := range items {
+		items[i] = itemsValue.Index(i).Addr().Interface()
+	}
+	return items, nil
+}
+
+type cborMapEntry struct {
+	key   string
+	write func() error
+}
+
+func streamingEncodeList(w io.Writer, typeMeta metav1.TypeMeta, listMeta metav1.ListMeta, items []interface{}, mode modes.EncMode) error {
+	var entries []cborMapEntry
+
+	if typeMeta.Kind != "" {
+		entries = append(entries, cborMapEntry{
+			key: "kind",
+			write: func() error {
+				return encodeKeyValuePair(w, "kind", typeMeta.Kind, mode)
+			},
+		})
+	}
+	entries = append(entries, cborMapEntry{
+		key: "items",
+		write: func() error {
+			if err := mode.MarshalTo("items", w); err != nil {
+				return err
+			}
+			if items == nil {
+				_, err := w.Write([]byte{0xf6}) // CBOR null
+				return err
+			}
+			if err := writeArrayHead(w, len(items)); err != nil {
+				return err
+			}
+			for _, item := range items {
+				if err := mode.MarshalTo(item, w); err != nil {
+					return err
+				}
+			}
+			return nil
+		},
+	})
+	entries = append(entries, cborMapEntry{
+		key: "metadata",
+		write: func() error {
+			return encodeKeyValuePair(w, "metadata", listMeta, mode)
+		},
+	})
+	if typeMeta.APIVersion != "" {
+		entries = append(entries, cborMapEntry{
+			key: "apiVersion",
+			write: func() error {
+				return encodeKeyValuePair(w, "apiVersion", typeMeta.APIVersion, mode)
+			},
+		})
+	}
+
+	// entries is built in a fixed order (kind, items, metadata, apiVersion).
+	// Unlike streamingEncodeUnstructuredList, whose keys come in Go's randomized
+	// map-iteration order, there is no inherent randomness here, so for
+	// nondeterministic modes (SortFastShuffle) we rotate the encoding for-loop
+	// by a random initial offset.
+	start := 0
+	if !mode.IsDeterministic() && len(entries) > 0 {
+		start = rand.Intn(len(entries))
+	}
+
+	if err := writeMapHead(w, len(entries)); err != nil {
+		return err
+	}
+
+	for i := 0; i < len(entries); i++ {
+		entry := entries[(start+i)%len(entries)]
+		if err := entry.write(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func streamingEncodeUnstructuredList(w io.Writer, list *unstructured.UnstructuredList, mode modes.EncMode) error {
+	keys := slices.Collect(maps.Keys(list.Object))
+	if _, exists := list.Object["items"]; !exists {
+		keys = append(keys, "items")
+	}
+	// keys starts in Go's randomized map-iteration order. For deterministic
+	// modes (SortBytewiseLexical) we sort it: shorter lengths come first, then
+	// lexicographic by content. For nondeterministic modes (SortFastShuffle) we
+	// leave the map-iteration order as-is, which already varies from call to
+	// call (analogous to what SortFastShuffle does for structs), so no explicit
+	// shuffling is needed.
+	if mode.IsDeterministic() {
+		sort.Slice(keys, func(i, j int) bool {
+			if len(keys[i]) != len(keys[j]) {
+				return len(keys[i]) < len(keys[j])
+			}
+			return keys[i] < keys[j]
+		})
+	}
+
+	if err := writeMapHead(w, len(keys)); err != nil {
+		return err
+	}
+
+	for _, key := range keys {
+		if err := mode.MarshalTo(key, w); err != nil {
+			return err
+		}
+		if key == "items" {
+			if err := writeArrayHead(w, len(list.Items)); err != nil {
+				return err
+			}
+			for _, item := range list.Items {
+				if err := mode.MarshalTo(item.Object, w); err != nil {
+					return err
+				}
+			}
+		} else {
+			if err := mode.MarshalTo(list.Object[key], w); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func encodeKeyValuePair(w io.Writer, key string, value interface{}, mode modes.EncMode) error {
+	if err := mode.MarshalTo(key, w); err != nil {
+		return err
+	}
+	if err := mode.MarshalTo(value, w); err != nil {
+		return err
+	}
+	return nil
+}
+
+// CBOR major type prefix bytes (the type in the high 3 bits, additional info
+// zeroed), following RFC 8949 Section 3.1.
+const (
+	cborTypeArray byte = 0x80 // major type 4
+	cborTypeMap   byte = 0xa0 // major type 5
+)
+
+// writeMapHead writes a CBOR map header for a map with n entries.
+func writeMapHead(w io.Writer, n int) error {
+	return writeCollectionHead(w, cborTypeMap, int64(n))
+}
+
+// writeArrayHead writes a CBOR array header for an array with n elements.
+func writeArrayHead(w io.Writer, n int) error {
+	return writeCollectionHead(w, cborTypeArray, int64(n))
+}
+
+// writeCollectionHead writes a CBOR collection (array or map) header encoding
+// the number of elements n, following RFC 8949 Section 3 additional info rules:
+//
+//   - base: the prefix byte for the collection type.
+//     For maps: cborTypeMap (0xa0), for arrays: cborTypeArray (0x80).
+//
+// The extended form prefixes are derived from base using bitwise OR:
+//   - base|24: 1-byte length follows (additional info 24)
+//   - base|25: 2-byte length follows (additional info 25)
+//   - base|26: 4-byte length follows (additional info 26)
+//   - base|27: 8-byte length follows (additional info 27)
+//
+// Encoding table (map example, base=0xa0):
+//
+//	n <= 23:         1 byte  — 0xa0|n
+//	n <= 0xFF:        2 bytes — 0xb8 (0xa0|24), n
+//	n <= 0xFFFF:      3 bytes — 0xb9 (0xa0|25), n>>8, n
+//	n <= 0xFFFFFFFF:  5 bytes — 0xba (0xa0|26), n>>24..n
+//	n > 0xFFFFFFFF:   9 bytes — 0xbb (0xa0|27), n>>56..n
+func writeCollectionHead(w io.Writer, base byte, n int64) error {
+	switch {
+	case n <= 23:
+		// Additional info 0–23: length is encoded directly in the low 5 bits.
+		_, err := w.Write([]byte{base + byte(n)})
+		return err
+	case n <= 0xFF:
+		// Additional info 24: one additional byte carries the length.
+		_, err := w.Write([]byte{base | 24, byte(n)})
+		return err
+	case n <= 0xFFFF:
+		// Additional info 25: two additional bytes carry the length (big-endian).
+		_, err := w.Write([]byte{base | 25, byte(n >> 8), byte(n)})
+		return err
+	case n <= 0xFFFFFFFF:
+		// Additional info 26: four additional bytes carry the length (big-endian).
+		_, err := w.Write([]byte{base | 26, byte(n >> 24), byte(n >> 16), byte(n >> 8), byte(n)})
+		return err
+	default:
+		// Additional info 27: eight additional bytes carry the length (big-endian).
+		_, err := w.Write([]byte{
+			base | 27, byte(n >> 56), byte(n >> 48), byte(n >> 40), byte(n >> 32), byte(n >> 24), byte(n >> 16),
+			byte(n >> 8), byte(n),
+		})
+		return err
+	}
+}
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode.go
index 815dbe6660..3287dfd31c 100644
--- a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode.go
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode.go
@@ -107,6 +107,7 @@ var encode = EncMode{
 		}
 		return encode
 	}(),
+	deterministic: true,
 }
 
 var Encode = EncMode{
@@ -122,6 +123,7 @@ var Encode = EncMode{
 		}
 		return em
 	}(),
+	deterministic: true,
 }
 
 var EncodeNondeterministic = EncMode{
@@ -134,16 +136,22 @@ var EncodeNondeterministic = EncMode{
 		}
 		return em
 	}(),
+	deterministic: false,
 }
 
 type EncMode struct {
-	delegate cbor.UserBufferEncMode
+	delegate      cbor.UserBufferEncMode
+	deterministic bool
 }
 
 func (em EncMode) options() cbor.EncOptions {
 	return em.delegate.EncOptions()
 }
 
+func (em EncMode) IsDeterministic() bool {
+	return em.deterministic
+}
+
 func (em EncMode) MarshalTo(v interface{}, w io.Writer) error {
 	if buf, ok := w.(*buffer); ok {
 		return em.delegate.MarshalToBuffer(v, &buf.Buffer)
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/collections.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/collections.go
index 075163ddd8..3fa6012dde 100644
--- a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/collections.go
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/collections.go
@@ -17,11 +17,10 @@ limitations under the License.
 package json
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
-	"maps"
-	"slices"
 	"sort"
 
 	"k8s.io/apimachinery/pkg/api/meta"
@@ -35,14 +34,14 @@ import (
 func streamEncodeCollections(obj runtime.Object, w io.Writer) (bool, error) {
 	list, ok := obj.(*unstructured.UnstructuredList)
 	if ok {
-		return true, streamingEncodeUnstructuredList(w, list)
+		return true, newStreamEncoder(w).encodeUnstructuredList(list)
 	}
 	if _, ok := obj.(json.Marshaler); ok {
 		return false, nil
 	}
 	typeMeta, listMeta, items, err := getListMeta(obj)
 	if err == nil {
-		return true, streamingEncodeList(w, typeMeta, listMeta, items)
+		return true, newStreamEncoder(w).encodeList(typeMeta, listMeta, items)
 	}
 	return false, nil
 }
@@ -67,8 +66,13 @@ func getListMeta(list runtime.Object) (metav1.TypeMeta, metav1.ListMeta, []runti
 	if !ok {
 		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected TypeMeta field to have TypeMeta type")
 	}
-	if listType.Field(0).Tag.Get("json") != ",inline" {
-		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be ",inline"`)
+	if !listType.Field(0).Anonymous {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be embedded`)
+	}
+	if jsonTag, jsonTagExists := listType.Field(0).Tag.Lookup("json"); !jsonTagExists {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag`)
+	} else if jsonTag != "" && jsonTag != ",inline" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be "" or ",inline"`)
 	}
 	// ListMeta
 	listMeta, ok := listValue.Field(1).Interface().(metav1.ListMeta)
@@ -89,45 +93,59 @@ func getListMeta(list runtime.Object) (metav1.TypeMeta, metav1.ListMeta, []runti
 	return typeMeta, listMeta, items, nil
 }
 
-func streamingEncodeList(w io.Writer, typeMeta metav1.TypeMeta, listMeta metav1.ListMeta, items []runtime.Object) error {
+// streamEncoder encodes JSON values to w, reusing an internal buffer across
+// values to avoid the fresh output allocation json.Marshal makes per call.
+type streamEncoder struct {
+	w    io.Writer
+	buf  bytes.Buffer
+	json *json.Encoder
+}
+
+func newStreamEncoder(w io.Writer) *streamEncoder {
+	e := &streamEncoder{w: w}
+	e.json = json.NewEncoder(&e.buf)
+	return e
+}
+
+func (e *streamEncoder) encodeList(typeMeta metav1.TypeMeta, listMeta metav1.ListMeta, items []runtime.Object) error {
 	// Start
-	if _, err := w.Write([]byte(`{`)); err != nil {
+	if _, err := e.w.Write([]byte(`{`)); err != nil {
 		return err
 	}
 
 	// TypeMeta
 	if typeMeta.Kind != "" {
-		if err := encodeKeyValuePair(w, "kind", typeMeta.Kind, []byte(",")); err != nil {
+		if err := e.encodeKeyValuePair("kind", typeMeta.Kind, []byte(",")); err != nil {
 			return err
 		}
 	}
 	if typeMeta.APIVersion != "" {
-		if err := encodeKeyValuePair(w, "apiVersion", typeMeta.APIVersion, []byte(",")); err != nil {
+		if err := e.encodeKeyValuePair("apiVersion", typeMeta.APIVersion, []byte(",")); err != nil {
 			return err
 		}
 	}
 
 	// ListMeta
-	if err := encodeKeyValuePair(w, "metadata", listMeta, []byte(",")); err != nil {
+	if err := e.encodeKeyValuePair("metadata", listMeta, []byte(",")); err != nil {
 		return err
 	}
 
 	// Items
-	if err := encodeItemsObjectSlice(w, items); err != nil {
+	if err := e.encodeItemsObjectSlice(items); err != nil {
 		return err
 	}
 
 	// End
-	_, err := w.Write([]byte("}\n"))
+	_, err := e.w.Write([]byte("}\n"))
 	return err
 }
 
-func encodeItemsObjectSlice(w io.Writer, items []runtime.Object) (err error) {
+func (e *streamEncoder) encodeItemsObjectSlice(items []runtime.Object) (err error) {
 	if items == nil {
-		err := encodeKeyValuePair(w, "items", nil, nil)
+		err := e.encodeKeyValuePair("items", nil, nil)
 		return err
 	}
-	_, err = w.Write([]byte(`"items":[`))
+	_, err = e.w.Write([]byte(`"items":[`))
 	if err != nil {
 		return err
 	}
@@ -136,24 +154,27 @@ func encodeItemsObjectSlice(w io.Writer, items []runtime.Object) (err error) {
 		if i == len(items)-1 {
 			suffix = nil
 		}
-		err := encodeValue(w, item, suffix)
+		err := e.encodeValue(item, suffix)
 		if err != nil {
 			return err
 		}
 	}
-	_, err = w.Write([]byte("]"))
+	_, err = e.w.Write([]byte("]"))
 	if err != nil {
 		return err
 	}
 	return err
 }
 
-func streamingEncodeUnstructuredList(w io.Writer, list *unstructured.UnstructuredList) error {
-	_, err := w.Write([]byte(`{`))
+func (e *streamEncoder) encodeUnstructuredList(list *unstructured.UnstructuredList) error {
+	_, err := e.w.Write([]byte(`{`))
 	if err != nil {
 		return err
 	}
-	keys := slices.Collect(maps.Keys(list.Object))
+	keys := make([]string, 0, len(list.Object)+1)
+	for key := range list.Object {
+		keys = append(keys, key)
+	}
 	if _, exists := list.Object["items"]; !exists {
 		keys = append(keys, "items")
 	}
@@ -165,20 +186,20 @@ func streamingEncodeUnstructuredList(w io.Writer, list *unstructured.Unstructure
 			suffix = nil
 		}
 		if key == "items" {
-			err = encodeItemsUnstructuredSlice(w, list.Items, suffix)
+			err = e.encodeItemsUnstructuredSlice(list.Items, suffix)
 		} else {
-			err = encodeKeyValuePair(w, key, list.Object[key], suffix)
+			err = e.encodeKeyValuePair(key, list.Object[key], suffix)
 		}
 		if err != nil {
 			return err
 		}
 	}
-	_, err = w.Write([]byte("}\n"))
+	_, err = e.w.Write([]byte("}\n"))
 	return err
 }
 
-func encodeItemsUnstructuredSlice(w io.Writer, items []unstructured.Unstructured, suffix []byte) (err error) {
-	_, err = w.Write([]byte(`"items":[`))
+func (e *streamEncoder) encodeItemsUnstructuredSlice(items []unstructured.Unstructured, suffix []byte) (err error) {
+	_, err = e.w.Write([]byte(`"items":[`))
 	if err != nil {
 		return err
 	}
@@ -187,44 +208,42 @@ func encodeItemsUnstructuredSlice(w io.Writer, items []unstructured.Unstructured
 		if i == len(items)-1 {
 			comma = nil
 		}
-		err := encodeValue(w, item.Object, comma)
+		err := e.encodeValue(item.Object, comma)
 		if err != nil {
 			return err
 		}
 	}
-	_, err = w.Write([]byte("]"))
+	_, err = e.w.Write([]byte("]"))
 	if err != nil {
 		return err
 	}
 	if len(suffix) > 0 {
-		_, err = w.Write(suffix)
+		_, err = e.w.Write(suffix)
 	}
 	return err
 }
 
-func encodeKeyValuePair(w io.Writer, key string, value any, suffix []byte) (err error) {
-	err = encodeValue(w, key, []byte(":"))
+func (e *streamEncoder) encodeKeyValuePair(key string, value any, suffix []byte) (err error) {
+	err = e.encodeValue(key, []byte(":"))
 	if err != nil {
 		return err
 	}
-	err = encodeValue(w, value, suffix)
+	err = e.encodeValue(value, suffix)
 	if err != nil {
 		return err
 	}
 	return err
 }
 
-func encodeValue(w io.Writer, value any, suffix []byte) error {
-	data, err := json.Marshal(value)
-	if err != nil {
-		return err
-	}
-	_, err = w.Write(data)
-	if err != nil {
+func (e *streamEncoder) encodeValue(value any, suffix []byte) error {
+	e.buf.Reset()
+	if err := e.json.Encode(value); err != nil {
 		return err
 	}
-	if len(suffix) > 0 {
-		_, err = w.Write(suffix)
-	}
+	// Encode appends a newline after the value; replace it with the suffix to
+	// keep the output identical to json.Marshal's.
+	e.buf.Truncate(e.buf.Len() - 1)
+	e.buf.Write(suffix)
+	_, err := e.w.Write(e.buf.Bytes())
 	return err
 }
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go
index 24f66a1017..52c814172f 100644
--- a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go
@@ -70,6 +70,7 @@ func identifier(options SerializerOptions) runtime.Identifier {
 	}
 	identifier, err := json.Marshal(result)
 	if err != nil {
+		//nolint:logcheck // Should not be reached.
 		klog.Fatalf("Failed marshaling identifier for json Serializer: %v", err)
 	}
 	return runtime.Identifier(identifier)
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections.go
index afac03e9da..8db8932fbb 100644
--- a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections.go
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections.go
@@ -17,6 +17,7 @@ limitations under the License.
 package protobuf
 
 import (
+	"encoding/binary"
 	"errors"
 	"io"
 	"math/bits"
@@ -134,15 +135,17 @@ func streamingEncodeUnknownList(w io.Writer, unk runtime.Unknown, listData strea
 }
 
 func streamingEncodeList(w io.Writer, listData streamingListData, memAlloc runtime.MemoryAllocator) (size int, err error) {
+	// headerScratch escapes via w.Write, so allocate it once per call instead of once per item.
+	headerScratch := make([]byte, 1+binary.MaxVarintLen64)
 	// ListMeta; 0xa = (1 << 3) | 2; field number: 1, type: 2 (LEN). https://protobuf.dev/programming-guides/encoding/#structure
-	n, err := doEncodeWithHeader(&listData.listMeta, w, 0xa, listData.listMetaSize, memAlloc)
+	n, err := doEncodeWithHeader(&listData.listMeta, w, 0xa, listData.listMetaSize, headerScratch, memAlloc)
 	size += n
 	if err != nil {
 		return size, err
 	}
 	// Items; 0x12 = (2 << 3) | 2; field number: 2, type: 2 (LEN). https://protobuf.dev/programming-guides/encoding/#structure
 	for i, item := range listData.items {
-		n, err := doEncodeWithHeader(item, w, 0x12, listData.itemsSizes[i], memAlloc)
+		n, err := doEncodeWithHeader(item, w, 0x12, listData.itemsSizes[i], headerScratch, memAlloc)
 		size += n
 		if err != nil {
 			return size, err
@@ -151,12 +154,6 @@ func streamingEncodeList(w io.Writer, listData streamingListData, memAlloc runti
 	return size, nil
 }
 
-func writeVarintGenerated(w io.Writer, v int) (int, error) {
-	buf := make([]byte, sovGenerated(uint64(v)))
-	encodeVarintGenerated(buf, len(buf), uint64(v))
-	return w.Write(buf)
-}
-
 // sovGenerated is copied from `generated.pb.go` returns size of varint.
 func sovGenerated(v uint64) int {
 	return (bits.Len64(v|1) + 6) / 7
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf.go
index 67a2d12474..93ad95cef3 100644
--- a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf.go
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf.go
@@ -199,6 +199,7 @@ func (s *Serializer) encode(obj runtime.Object, w io.Writer, memAlloc runtime.Me
 
 func (s *Serializer) doEncode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
 	if memAlloc == nil {
+		//nolint:logcheck // Should not be reached in normal operations.
 		klog.Error("a mandatory memory allocator wasn't provided, this might have a negative impact on performance, check invocations of EncodeWithAllocator method, falling back on runtime.SimpleAllocator")
 		memAlloc = &runtime.SimpleAllocator{}
 	}
@@ -470,15 +471,12 @@ func (s *RawSerializer) doEncode(obj runtime.Object, w io.Writer, memAlloc runti
 	return err
 }
 
-func doEncodeWithHeader(obj any, w io.Writer, field byte, precomputedSize int, memAlloc runtime.MemoryAllocator) (size int, err error) {
-	// Field identifier
-	n, err := w.Write([]byte{field})
-	size += n
-	if err != nil {
-		return size, err
-	}
-	// Size
-	n, err = writeVarintGenerated(w, precomputedSize)
+func doEncodeWithHeader(obj any, w io.Writer, field byte, precomputedSize int, headerScratch []byte, memAlloc runtime.MemoryAllocator) (size int, err error) {
+	// Field identifier and size
+	header := headerScratch[:1+sovGenerated(uint64(precomputedSize))]
+	header[0] = field
+	encodeVarintGenerated(header, len(header), uint64(precomputedSize))
+	n, err := w.Write(header)
 	size += n
 	if err != nil {
 		return size, err
@@ -500,6 +498,7 @@ func doEncodeWithHeader(obj any, w io.Writer, field byte, precomputedSize int, m
 // precomputedObjSize should not include header bytes (field identifier, size).
 func doEncode(obj any, w io.Writer, precomputedObjSize *int, memAlloc runtime.MemoryAllocator) (int, error) {
 	if memAlloc == nil {
+		//nolint:logcheck // Should not be reached in normal operations.
 		klog.Error("a mandatory memory allocator wasn't provided, this might have a negative impact on performance, check invocations of EncodeWithAllocator method, falling back on runtime.SimpleAllocator")
 		memAlloc = &runtime.SimpleAllocator{}
 	}
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go
index 25f955ed75..6c86d5e15c 100644
--- a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go
@@ -116,6 +116,7 @@ func identifier(encodeGV runtime.GroupVersioner, encoder runtime.Encoder) runtim
 	}
 	identifier, err := json.Marshal(result)
 	if err != nil {
+		//nolint:logcheck // Should not be reached.
 		klog.Fatalf("Failed marshaling identifier for codec: %v", err)
 	}
 	identifiersMap.Store(result, runtime.Identifier(identifier))
@@ -222,6 +223,7 @@ func (c *codec) doEncode(obj runtime.Object, w io.Writer, memAlloc runtime.Memor
 				return encoder.EncodeWithAllocator(obj, w, memAlloc)
 			}
 		} else {
+			//nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this.
 			klog.V(6).Infof("a memory allocator was provided but the encoder %s doesn't implement the runtime.EncoderWithAllocator, using regular encoder.Encode method", c.encoder.Identifier())
 		}
 	}
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator.go b/vendor/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator.go
index 5bc642bc8e..0d5a3e709d 100644
--- a/vendor/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator.go
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator.go
@@ -25,7 +25,10 @@ import (
 	"go/token"
 	"io"
 	"reflect"
+	"strconv"
 	"strings"
+
+	"k8s.io/apimachinery/pkg/util/errors"
 )
 
 // Pair of strings. We keed the name of fields and the doc
@@ -94,23 +97,29 @@ func fmtRawDoc(rawDoc string) string {
 
 // fieldName returns the name of the field as it should appear in JSON format
 // "-" indicates that this field is not part of the JSON representation
-func fieldName(field *ast.Field) string {
+func fieldName(field *ast.Field) (string, error) {
 	jsonTag := ""
 	if field.Tag != nil {
-		jsonTag = reflect.StructTag(field.Tag.Value[1 : len(field.Tag.Value)-1]).Get("json") // Delete first and last quotation
-		if strings.Contains(jsonTag, "inline") {
-			return "-"
+		var jsonTagExists bool
+		tagValue, err := strconv.Unquote(field.Tag.Value)
+		if err != nil {
+			return "", err
+		}
+		jsonTag, jsonTagExists = reflect.StructTag(tagValue).Lookup("json") // Delete first and last quotation
+		// field is embedded, json tag is declared and has an empty name
+		if field.Names == nil && jsonTagExists && (jsonTag == "" || strings.HasPrefix(jsonTag, ",")) {
+			return "-", nil
 		}
 	}
 
 	jsonTag = strings.Split(jsonTag, ",")[0] // This can return "-"
 	if jsonTag == "" {
 		if field.Names != nil {
-			return field.Names[0].Name
+			return field.Names[0].Name, nil
 		}
-		return field.Type.(*ast.Ident).Name
+		return field.Type.(*ast.Ident).Name, nil
 	}
-	return jsonTag
+	return jsonTag, nil
 }
 
 // A buffer of lines that will be written.
@@ -171,8 +180,9 @@ func writeMapBody(b *buffer, kubeType []Pair, indent int) {
 // array. Each type is again represented as an array (we have to use arrays as we
 // need to be sure for the order of the fields). This function returns fields and
 // struct definitions that have no documentation as {name, ""}.
-func ParseDocumentationFrom(src string) []KubeTypes {
+func ParseDocumentationFrom(src string) ([]KubeTypes, error) {
 	var docForTypes []KubeTypes
+	var errs []error
 
 	pkg := astFrom(src)
 
@@ -182,7 +192,9 @@ func ParseDocumentationFrom(src string) []KubeTypes {
 			ks = append(ks, Pair{kubType.Name, fmtRawDoc(kubType.Doc)})
 
 			for _, field := range structType.Fields.List {
-				if n := fieldName(field); n != "-" {
+				if n, err := fieldName(field); err != nil {
+					errs = append(errs, err)
+				} else if n != "-" {
 					fieldDoc := fmtRawDoc(field.Doc.Text())
 					ks = append(ks, Pair{n, fieldDoc})
 				}
@@ -191,7 +203,7 @@ func ParseDocumentationFrom(src string) []KubeTypes {
 		}
 	}
 
-	return docForTypes
+	return docForTypes, errors.NewAggregate(errs)
 }
 
 // WriteSwaggerDocFunc writes a declaration of a function as a string. This function is used in
diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/types.go b/vendor/k8s.io/apimachinery/pkg/runtime/types.go
index ca7b7cc2d4..6cded88997 100644
--- a/vendor/k8s.io/apimachinery/pkg/runtime/types.go
+++ b/vendor/k8s.io/apimachinery/pkg/runtime/types.go
@@ -23,7 +23,7 @@ package runtime
 // like this:
 //
 //	type MyAwesomeAPIObject struct {
-//	     runtime.TypeMeta    `json:",inline"`
+//	     runtime.TypeMeta    `json:""`
 //	     ... // other fields
 //	}
 //
@@ -59,7 +59,7 @@ const (
 // // Internal package:
 //
 //	type MyAPIObject struct {
-//		runtime.TypeMeta `json:",inline"`
+//		runtime.TypeMeta `json:""`
 //		MyPlugin runtime.Object `json:"myPlugin"`
 //	}
 //
@@ -70,7 +70,7 @@ const (
 // // External package:
 //
 //	type MyAPIObject struct {
-//		runtime.TypeMeta `json:",inline"`
+//		runtime.TypeMeta `json:""`
 //		MyPlugin runtime.RawExtension `json:"myPlugin"`
 //	}
 //
@@ -121,7 +121,7 @@ type RawExtension struct {
 // +protobuf=true
 // +k8s:openapi-gen=true
 type Unknown struct {
-	TypeMeta `json:",inline" protobuf:"bytes,1,opt,name=typeMeta"`
+	TypeMeta `json:"" protobuf:"bytes,1,opt,name=typeMeta"`
 	// Raw will hold the complete serialized object which couldn't be matched
 	// with a registered type. Most likely, nothing should be done with this
 	// except for passing it through the system.
diff --git a/vendor/k8s.io/apimachinery/pkg/util/intstr/intstr.go b/vendor/k8s.io/apimachinery/pkg/util/intstr/intstr.go
index f372ae589c..b0ca3803e4 100644
--- a/vendor/k8s.io/apimachinery/pkg/util/intstr/intstr.go
+++ b/vendor/k8s.io/apimachinery/pkg/util/intstr/intstr.go
@@ -59,6 +59,7 @@ const (
 // Deprecated: use FromInt32 instead.
 func FromInt(val int) IntOrString {
 	if val > math.MaxInt32 || val < math.MinInt32 {
+		//nolint:logcheck // Should not be reached.
 		klog.Errorf("value: %d overflows int32\n%s\n", val, debug.Stack())
 	}
 	return IntOrString{Type: Int, IntVal: int32(val)}
diff --git a/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager.go b/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager.go
index ac8d4279d6..2e2db65561 100644
--- a/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager.go
+++ b/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager.go
@@ -140,24 +140,28 @@ func (f *FieldManager) Update(liveObj, newObj runtime.Object, manager string) (o
 }
 
 // UpdateNoErrors is the same as Update, but it will not return
-// errors. If an error happens, the object is returned with
-// managedFields cleared.
+// errors. If an error happens, we preserve the managedFields from
+// liveObj.
 func (f *FieldManager) UpdateNoErrors(liveObj, newObj runtime.Object, manager string) runtime.Object {
 	obj, err := f.Update(liveObj, newObj, manager)
 	if err != nil {
-		atMostEverySecond.Do(func() {
-			ns, name := "unknown", "unknown"
-			if accessor, err := meta.Accessor(newObj); err == nil {
-				ns = accessor.GetNamespace()
-				name = accessor.GetName()
+		// Preserve the managedFields from the live object rather than
+		// stripping them entirely, to avoid silent data loss when the
+		// managedFields update fails (e.g. due to an unavailable
+		// conversion webhook).
+		// Note: meta.Accessor for liveObj and newObj below never return an error in this code branch,
+		// because if they would f.Update above would return "newObj, nil". Accordingly, the case
+		// where one of the accessors returns an error is not handled here.
+		if liveAccessor, aErr := meta.Accessor(liveObj); aErr == nil {
+			if newAccessor, aErr := meta.Accessor(newObj); aErr == nil {
+				atMostEverySecond.Do(func() {
+					//nolint:logcheck // Should not be reached.
+					klog.ErrorS(err, "[SHOULD NOT HAPPEN] failed to update managedFields (restored previous managedFields from live object)", "versionKind",
+						newObj.GetObjectKind().GroupVersionKind(), "namespace", newAccessor.GetNamespace(), "name", newAccessor.GetName())
+				})
+				newAccessor.SetManagedFields(liveAccessor.GetManagedFields())
 			}
-
-			klog.ErrorS(err, "[SHOULD NOT HAPPEN] failed to update managedFields", "versionKind",
-				newObj.GetObjectKind().GroupVersionKind(), "namespace", ns, "name", name)
-		})
-		// Explicitly remove managedFields on failure, so that
-		// we can't have garbage in it.
-		RemoveObjectManagedFields(newObj)
+		}
 		return newObj
 	}
 	return obj
diff --git a/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter.go b/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter.go
index cbefc2eba0..40cc90da78 100644
--- a/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter.go
+++ b/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter.go
@@ -109,6 +109,24 @@ func valueToObject(val value.Value) (runtime.Object, error) {
 	}
 }
 
+// GroupVersionOfTypedValue returns the extracted GroupVersion from the TypeMeta
+// fields of a TypedValue, or return false if no TypeMeta fields are found.
+func GroupVersionOfTypedValue(object *typed.TypedValue) (schema.GroupVersion, bool) {
+	val := object.AsValue()
+	if val == nil || !val.IsMap() {
+		return schema.GroupVersion{}, false
+	}
+	apiVersion, ok := val.AsMap().Get("apiVersion")
+	if !ok || !apiVersion.IsString() {
+		return schema.GroupVersion{}, false
+	}
+	groupVersion, err := schema.ParseGroupVersion(apiVersion.AsString())
+	if err != nil {
+		return schema.GroupVersion{}, false
+	}
+	return groupVersion, true
+}
+
 func indexModels(
 	typeParser *typed.Parser,
 	openAPISchemas map[string]*spec.Schema,
diff --git a/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter.go b/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter.go
index 86695e0c0b..917bdcd75f 100644
--- a/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter.go
+++ b/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter.go
@@ -63,24 +63,23 @@ func newCRDVersionConverter(t TypeConverter, o runtime.ObjectConvertor, h schema
 
 // Convert implements sigs.k8s.io/structured-merge-diff/merge.Converter
 func (v *versionConverter) Convert(object *typed.TypedValue, version fieldpath.APIVersion) (*typed.TypedValue, error) {
-	// Convert the smd typed value to a kubernetes object.
-	objectToConvert, err := v.typeConverter.TypedToObject(object)
-	if err != nil {
-		return object, err
-	}
-
-	// Parse the target groupVersion.
 	groupVersion, err := schema.ParseGroupVersion(string(version))
 	if err != nil {
 		return object, err
 	}
 
 	// If attempting to convert to the same version as we already have, just return it.
-	fromVersion := objectToConvert.GetObjectKind().GroupVersionKind().GroupVersion()
-	if fromVersion == groupVersion {
+	if typedVersion, ok := GroupVersionOfTypedValue(object); ok && typedVersion == groupVersion {
 		return object, nil
 	}
 
+	// Convert the smd typed value to a kubernetes object.
+	objectToConvert, err := v.typeConverter.TypedToObject(object)
+	if err != nil {
+		return object, err
+	}
+	fromVersion := objectToConvert.GetObjectKind().GroupVersionKind().GroupVersion()
+
 	// Convert to internal
 	internalObject, err := v.objectConvertor.ConvertToVersion(objectToConvert, v.hubGetter(fromVersion))
 	if err != nil {
diff --git a/vendor/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go b/vendor/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go
index 1eeb71ff53..1a18b27666 100644
--- a/vendor/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go
+++ b/vendor/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go
@@ -46,35 +46,57 @@ type ErrorMatcher struct {
 	requireOriginWhenInvalid      bool
 	matchValidationStabilityLevel bool
 	matchSource                   bool
+	matchAncestorShortCircuit     bool
+	matchShortCircuit             bool
 	// normalizationRules holds the pre-compiled regex patterns for path normalization.
 	normalizationRules []NormalizationRule
 }
 
+// isChildPath returns true if child is a descendant path of parent.
+// It avoids false positives like "spec.containers" being a child of "spec.container"
+// by explicitly checking for '.' or '[' path separators.
+func isChildPath(parent, child string) bool {
+	// "" as parent path not supported. It can un-intentionally match with any path.
+	// theoretically system errors can be matched with any path errors.
+	if len(parent) == 0 {
+		return false
+	}
+	if len(child) <= len(parent) {
+		return false
+	}
+	if child[:len(parent)] != parent {
+		return false
+	}
+	sep := child[len(parent)]
+	return sep == '.' || sep == '['
+}
+
 // Matches returns true if the two Error objects match according to the
 // configured criteria. When field normalization is configured, only the
 // "got" error's field path is normalized (to bring older API versions up
 // to the internal/latest format), while "want" is assumed to already be
 // in the canonical internal API format.
 func (m ErrorMatcher) Matches(want, got *Error) bool {
-	if m.matchType && want.Type != got.Type {
-		return false
+	gotField := got.Field
+	if want.Field != gotField {
+		gotField = m.normalizePath(gotField)
 	}
-	if m.matchField {
-		// Try direct match first (common case)
-		if want.Field != got.Field {
-			// Fields don't match, try normalization if rules are configured.
-			// Only normalize "got" - it may be from an older API version that
-			// needs to be brought up to the internal/latest format that "want"
-			// is already in.
-			if want.Field != m.normalizePath(got.Field) {
-				return false
-			}
+	if m.matchAncestorShortCircuit {
+		if got.ShortCircuit && (isChildPath(gotField, want.Field) || isChildPath(got.Field, want.Field)) {
+			return true
 		}
 	}
 
+	if m.matchType && want.Type != got.Type {
+		return false
+	}
+	if m.matchField && want.Field != gotField {
+		return false
+	}
 	if m.matchValue && !reflect.DeepEqual(want.BadValue, got.BadValue) {
 		return false
 	}
+
 	if m.matchOrigin {
 		if want.Origin != got.Origin {
 			return false
@@ -91,10 +113,12 @@ func (m ErrorMatcher) Matches(want, got *Error) bool {
 	if m.matchValidationStabilityLevel && want.ValidationStabilityLevel != got.ValidationStabilityLevel {
 		return false
 	}
-
 	if m.matchSource && want.FromImperative != got.FromImperative {
 		return false
 	}
+	if m.matchShortCircuit && want.ShortCircuit != got.ShortCircuit {
+		return false
+	}
 
 	return true
 }
@@ -124,47 +148,51 @@ func (m ErrorMatcher) Render(e *Error) string {
 
 	if m.matchType {
 		comma()
-		buf.WriteString(fmt.Sprintf("Type=%q", e.Type))
+		fmt.Fprintf(&buf, "Type=%q", e.Type)
 	}
 	if m.matchField {
 		comma()
 		if normalized := m.normalizePath(e.Field); normalized != e.Field {
-			buf.WriteString(fmt.Sprintf("Field=%q (aka %q)", normalized, e.Field))
+			fmt.Fprintf(&buf, "Field=%q (aka %q)", normalized, e.Field)
 		} else {
-			buf.WriteString(fmt.Sprintf("Field=%q", e.Field))
+			fmt.Fprintf(&buf, "Field=%q", e.Field)
 		}
 	}
 	if m.matchValue {
 		comma()
 		if s, ok := e.BadValue.(string); ok {
-			buf.WriteString(fmt.Sprintf("Value=%q", s))
+			fmt.Fprintf(&buf, "Value=%q", s)
 		} else {
 			rv := reflect.ValueOf(e.BadValue)
 			if rv.Kind() == reflect.Pointer && !rv.IsNil() {
 				rv = rv.Elem()
 			}
 			if rv.IsValid() && rv.CanInterface() {
-				buf.WriteString(fmt.Sprintf("Value=%v", rv.Interface()))
+				fmt.Fprintf(&buf, "Value=%v", rv.Interface())
 			} else {
-				buf.WriteString(fmt.Sprintf("Value=%v", e.BadValue))
+				fmt.Fprintf(&buf, "Value=%v", e.BadValue)
 			}
 		}
 	}
 	if m.matchOrigin || m.requireOriginWhenInvalid && e.Type == ErrorTypeInvalid {
 		comma()
-		buf.WriteString(fmt.Sprintf("Origin=%q", e.Origin))
+		fmt.Fprintf(&buf, "Origin=%q", e.Origin)
 	}
 	if m.matchDetail != nil {
 		comma()
-		buf.WriteString(fmt.Sprintf("Detail=%q", e.Detail))
+		fmt.Fprintf(&buf, "Detail=%q", e.Detail)
 	}
 	if m.matchValidationStabilityLevel {
 		comma()
-		buf.WriteString(fmt.Sprintf("ValidationStabilityLevel=%s", e.ValidationStabilityLevel))
+		fmt.Fprintf(&buf, "ValidationStabilityLevel=%s", e.ValidationStabilityLevel)
 	}
 	if m.matchSource {
 		comma()
-		buf.WriteString(fmt.Sprintf("FromImperative=%t", e.FromImperative))
+		fmt.Fprintf(&buf, "FromImperative=%t", e.FromImperative)
+	}
+	if m.matchShortCircuit {
+		comma()
+		fmt.Fprintf(&buf, "ShortCircuit=%t", e.ShortCircuit)
 	}
 	return "{" + buf.String() + "}"
 }
@@ -249,6 +277,18 @@ func (m ErrorMatcher) BySource() ErrorMatcher {
 	return m
 }
 
+// MatchAncestorShortCircuit returns a derived ErrorMatcher which also matches when the "got" error short-circuited at an ancestor of the "want" error's field path.
+func (m ErrorMatcher) MatchAncestorShortCircuit() ErrorMatcher {
+	m.matchAncestorShortCircuit = true
+	return m
+}
+
+// MatchShortCircuit returns a derived ErrorMatcher which also matches by the ShortCircuit value.
+func (m ErrorMatcher) MatchShortCircuit() ErrorMatcher {
+	m.matchShortCircuit = true
+	return m
+}
+
 // ByValidationStabilityLevel returns a derived ErrorMatcher which also matches by the validation stability level
 // value of field errors.
 func (m ErrorMatcher) ByValidationStabilityLevel() ErrorMatcher {
@@ -300,9 +340,13 @@ type TestIntf interface {
 // "want" error can match multiple "got" errors, and they will all be consumed.
 // The only exception to this is if the matcher got multiple identical (in every way,
 // even those not being matched on) errors, which is likely to indicate a bug.
+// This doesn't support matchAncestorShortCircuit as it it not needed to be used in the tests.
 func (m ErrorMatcher) Test(tb TestIntf, want, got ErrorList) {
 	tb.Helper()
 
+	if m.matchAncestorShortCircuit {
+		tb.Errorf("matchAncestorShortCircuit is not supported for test")
+	}
 	exactly := m.Exactly() // makes a copy
 
 	// If we ever find an EXACT duplicate error, it's almost certainly a bug
diff --git a/vendor/k8s.io/apimachinery/pkg/util/validation/field/errors.go b/vendor/k8s.io/apimachinery/pkg/util/validation/field/errors.go
index 9357fb306c..0d00acb42d 100644
--- a/vendor/k8s.io/apimachinery/pkg/util/validation/field/errors.go
+++ b/vendor/k8s.io/apimachinery/pkg/util/validation/field/errors.go
@@ -59,6 +59,12 @@ type Error struct {
 	// FromImperative denotes these errors are originating from  the hand written validations.
 	FromImperative bool
 
+	// ShortCircuit denotes that this error prevents further validation of the current field's children.
+	ShortCircuit bool
+
+	// ShortCircuitedInDeclarative denotes this error is covered by declarative validation. But not returned by declarative validation due to a short circuiting behavior for the current input.
+	ShortCircuitedInDeclarative bool
+
 	// ValidationStabilityLevel denotes the validation stability level of the declarative validation from this error is returned. This should be used in the declarative validations only.
 	ValidationStabilityLevel ValidationStabilityLevel
 }
@@ -545,6 +551,12 @@ func (e *Error) MarkAlpha() *Error {
 	return e
 }
 
+// MarkShortCircuitedInDV marks that this error is not returned by declarative validations, because DV returns before running the current validation. Handwritten validations still return it.
+func (e *Error) MarkShortCircuitedInDV() *Error {
+	e.ShortCircuitedInDeclarative = true
+	return e
+}
+
 // MarkAlpha marks the errors as alpha validation errors.
 func (list ErrorList) MarkAlpha() ErrorList {
 	for _, err := range list {
@@ -579,6 +591,14 @@ func (list ErrorList) MarkFromImperative() ErrorList {
 	return list
 }
 
+// MarkShortCircuit marks the errors as short-circuit errors.
+func (list ErrorList) MarkShortCircuit() ErrorList {
+	for _, err := range list {
+		err.ShortCircuit = true
+	}
+	return list
+}
+
 // RemoveCoveredByDeclarative returns a new ErrorList containing only the errors that should not be covered by declarative validation.
 func (list ErrorList) RemoveCoveredByDeclarative() ErrorList {
 	newList := ErrorList{}
diff --git a/vendor/k8s.io/apimachinery/pkg/util/validation/ip.go b/vendor/k8s.io/apimachinery/pkg/util/validation/ip.go
index 869fb0aad0..95f4e6218f 100644
--- a/vendor/k8s.io/apimachinery/pkg/util/validation/ip.go
+++ b/vendor/k8s.io/apimachinery/pkg/util/validation/ip.go
@@ -105,6 +105,7 @@ func IsValidIP(fldPath *field.Path, value string) field.ErrorList {
 func GetWarningsForIP(fldPath *field.Path, value string) []string {
 	ip := netutils.ParseIPSloppy(value)
 	if ip == nil {
+		//nolint:logcheck // Should not be reached.
 		klog.ErrorS(nil, "GetWarningsForIP called on value that was not validated with IsValidIPForLegacyField", "field", fldPath, "value", value)
 		return nil
 	}
@@ -211,6 +212,7 @@ func IsValidCIDR(fldPath *field.Path, value string) field.ErrorList {
 func GetWarningsForCIDR(fldPath *field.Path, value string) []string {
 	ip, ipnet, err := netutils.ParseCIDRSloppy(value)
 	if err != nil {
+		//nolint:logcheck // Should not be reached.
 		klog.ErrorS(err, "GetWarningsForCIDR called on value that was not validated with IsValidCIDRForLegacyField", "field", fldPath, "value", value)
 		return nil
 	}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/OWNERS b/vendor/k8s.io/client-go/applyconfigurations/OWNERS
index de4067fd35..8bea129e9a 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/OWNERS
+++ b/vendor/k8s.io/client-go/applyconfigurations/OWNERS
@@ -1,6 +1,7 @@
 # See the OWNERS docs at https://go.k8s.io/owners
 
 approvers:
-  - apelisse
   - jpbetz
   - api-approvers
+emeritus_approvers:
+  - apelisse
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/mutatingadmissionpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/mutatingadmissionpolicy.go
index f99f055b3c..ae3d2f1fc2 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/mutatingadmissionpolicy.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/mutatingadmissionpolicy.go
@@ -32,7 +32,7 @@ import (
 //
 // MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
 type MutatingAdmissionPolicyApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec defines the desired behavior of the MutatingAdmissionPolicy.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/mutatingadmissionpolicybinding.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/mutatingadmissionpolicybinding.go
index 4bb30baa6f..bea8a4a0f6 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/mutatingadmissionpolicybinding.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/mutatingadmissionpolicybinding.go
@@ -42,7 +42,7 @@ import (
 // Adding/removing policies, bindings, or params can not affect whether a
 // given (policy, binding, param) combination is within its own CEL budget.
 type MutatingAdmissionPolicyBindingApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec defines the desired behavior of the MutatingAdmissionPolicyBinding.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/mutatingwebhookconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/mutatingwebhookconfiguration.go
index dcb0b81cca..926f15936f 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/mutatingwebhookconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/mutatingwebhookconfiguration.go
@@ -32,7 +32,7 @@ import (
 //
 // MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.
 type MutatingWebhookConfigurationApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// webhooks is a list of webhooks and the affected resources and operations.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/namedrulewithoperations.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/namedrulewithoperations.go
index 326337c8cc..aaffe6cc1d 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/namedrulewithoperations.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/namedrulewithoperations.go
@@ -30,7 +30,7 @@ type NamedRuleWithOperationsApplyConfiguration struct {
 	// resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
 	ResourceNames []string `json:"resourceNames,omitempty"`
 	// RuleWithOperations is a tuple of Operations and Resources.
-	RuleWithOperationsApplyConfiguration `json:",inline"`
+	RuleWithOperationsApplyConfiguration `json:""`
 }
 
 // NamedRuleWithOperationsApplyConfiguration constructs a declarative configuration of the NamedRuleWithOperations type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/rulewithoperations.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/rulewithoperations.go
index 575e1ab35c..6692ef9393 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/rulewithoperations.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/rulewithoperations.go
@@ -35,7 +35,7 @@ type RuleWithOperationsApplyConfiguration struct {
 	Operations []admissionregistrationv1.OperationType `json:"operations,omitempty"`
 	// Rule is embedded, it describes other criteria of the rule, like
 	// APIGroups, APIVersions, Resources, etc.
-	RuleApplyConfiguration `json:",inline"`
+	RuleApplyConfiguration `json:""`
 }
 
 // RuleWithOperationsApplyConfiguration constructs a declarative configuration of the RuleWithOperations type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/validatingadmissionpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/validatingadmissionpolicy.go
index 6e06ed3e5f..a007d50570 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/validatingadmissionpolicy.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/validatingadmissionpolicy.go
@@ -32,7 +32,7 @@ import (
 //
 // ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
 type ValidatingAdmissionPolicyApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec defines the desired behavior of the ValidatingAdmissionPolicy.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/validatingadmissionpolicybinding.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/validatingadmissionpolicybinding.go
index 590aabda81..8fcc72c6db 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/validatingadmissionpolicybinding.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/validatingadmissionpolicybinding.go
@@ -42,7 +42,7 @@ import (
 // Adding/removing policies, bindings, or params can not affect whether a
 // given (policy, binding, param) combination is within its own CEL budget.
 type ValidatingAdmissionPolicyBindingApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec defines the desired behavior of the ValidatingAdmissionPolicyBinding.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/validatingwebhookconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/validatingwebhookconfiguration.go
index c3ac1fafdd..d668f26def 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/validatingwebhookconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1/validatingwebhookconfiguration.go
@@ -32,7 +32,7 @@ import (
 //
 // ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.
 type ValidatingWebhookConfigurationApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// webhooks is a list of webhooks and the affected resources and operations.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/mutatingadmissionpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/mutatingadmissionpolicy.go
index 678e4d612a..4c0ceff12f 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/mutatingadmissionpolicy.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/mutatingadmissionpolicy.go
@@ -32,7 +32,7 @@ import (
 //
 // MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
 type MutatingAdmissionPolicyApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec defines the desired behavior of the MutatingAdmissionPolicy.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go
index 5286ce24c5..1242180907 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go
@@ -42,7 +42,7 @@ import (
 // Adding/removing policies, bindings, or params can not affect whether a
 // given (policy, binding, param) combination is within its own CEL budget.
 type MutatingAdmissionPolicyBindingApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec defines the desired behavior of the MutatingAdmissionPolicyBinding.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/namedrulewithoperations.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/namedrulewithoperations.go
index 45c12f191d..5caf9c5717 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/namedrulewithoperations.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/namedrulewithoperations.go
@@ -31,7 +31,7 @@ type NamedRuleWithOperationsApplyConfiguration struct {
 	// resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
 	ResourceNames []string `json:"resourceNames,omitempty"`
 	// RuleWithOperations is a tuple of Operations and Resources.
-	v1.RuleWithOperationsApplyConfiguration `json:",inline"`
+	v1.RuleWithOperationsApplyConfiguration `json:""`
 }
 
 // NamedRuleWithOperationsApplyConfiguration constructs a declarative configuration of the NamedRuleWithOperations type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/validatingadmissionpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/validatingadmissionpolicy.go
index 9191eaab20..6a591f4d5d 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/validatingadmissionpolicy.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/validatingadmissionpolicy.go
@@ -32,7 +32,7 @@ import (
 //
 // ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
 type ValidatingAdmissionPolicyApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec defines the desired behavior of the ValidatingAdmissionPolicy.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go
index ad61dad084..0db11e2b07 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go
@@ -42,7 +42,7 @@ import (
 // Adding/removing policies, bindings, or params can not affect whether a
 // given (policy, binding, param) combination is within its own CEL budget.
 type ValidatingAdmissionPolicyBindingApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec defines the desired behavior of the ValidatingAdmissionPolicyBinding.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/mutatingadmissionpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/mutatingadmissionpolicy.go
index 9dbdd7dbd9..64ac2a936c 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/mutatingadmissionpolicy.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/mutatingadmissionpolicy.go
@@ -32,7 +32,7 @@ import (
 //
 // MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
 type MutatingAdmissionPolicyApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec defines the desired behavior of the MutatingAdmissionPolicy.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/mutatingadmissionpolicybinding.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/mutatingadmissionpolicybinding.go
index 560d1b1469..7aeacf4f42 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/mutatingadmissionpolicybinding.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/mutatingadmissionpolicybinding.go
@@ -42,7 +42,7 @@ import (
 // Adding/removing policies, bindings, or params can not affect whether a
 // given (policy, binding, param) combination is within its own CEL budget.
 type MutatingAdmissionPolicyBindingApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec defines the desired behavior of the MutatingAdmissionPolicyBinding.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/mutatingwebhookconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/mutatingwebhookconfiguration.go
index 63bce15404..5668e07c89 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/mutatingwebhookconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/mutatingwebhookconfiguration.go
@@ -33,7 +33,7 @@ import (
 // MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.
 // Deprecated in v1.16, planned for removal in v1.19. Use admissionregistration.k8s.io/v1 MutatingWebhookConfiguration instead.
 type MutatingWebhookConfigurationApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// webhooks is a list of webhooks and the affected resources and operations.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/namedrulewithoperations.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/namedrulewithoperations.go
index 0da66790cc..20a327cccd 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/namedrulewithoperations.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/namedrulewithoperations.go
@@ -31,7 +31,7 @@ type NamedRuleWithOperationsApplyConfiguration struct {
 	// resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
 	ResourceNames []string `json:"resourceNames,omitempty"`
 	// RuleWithOperations is a tuple of Operations and Resources.
-	v1.RuleWithOperationsApplyConfiguration `json:",inline"`
+	v1.RuleWithOperationsApplyConfiguration `json:""`
 }
 
 // NamedRuleWithOperationsApplyConfiguration constructs a declarative configuration of the NamedRuleWithOperations type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/validatingadmissionpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/validatingadmissionpolicy.go
index bc1ad6473a..e727943350 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/validatingadmissionpolicy.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/validatingadmissionpolicy.go
@@ -32,7 +32,7 @@ import (
 //
 // ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
 type ValidatingAdmissionPolicyApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec defines the desired behavior of the ValidatingAdmissionPolicy.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/validatingadmissionpolicybinding.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/validatingadmissionpolicybinding.go
index fd658f9a45..d202ccb73c 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/validatingadmissionpolicybinding.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/validatingadmissionpolicybinding.go
@@ -42,7 +42,7 @@ import (
 // Adding/removing policies, bindings, or params can not affect whether a
 // given (policy, binding, param) combination is within its own CEL budget.
 type ValidatingAdmissionPolicyBindingApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec defines the desired behavior of the ValidatingAdmissionPolicyBinding.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/validatingwebhookconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/validatingwebhookconfiguration.go
index dd53f3b334..cf4440d8ca 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/validatingwebhookconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1/validatingwebhookconfiguration.go
@@ -33,7 +33,7 @@ import (
 // ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.
 // Deprecated in v1.16, planned for removal in v1.19. Use admissionregistration.k8s.io/v1 ValidatingWebhookConfiguration instead.
 type ValidatingWebhookConfigurationApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// webhooks is a list of webhooks and the affected resources and operations.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apiserverinternal/v1alpha1/storageversion.go b/vendor/k8s.io/client-go/applyconfigurations/apiserverinternal/v1alpha1/storageversion.go
index 46b2349b1d..236f0d6652 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apiserverinternal/v1alpha1/storageversion.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apiserverinternal/v1alpha1/storageversion.go
@@ -32,7 +32,7 @@ import (
 //
 // Storage version of a specific resource.
 type StorageVersionApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata.
 	// The name is <group>.<resource>.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apps/v1/controllerrevision.go b/vendor/k8s.io/client-go/applyconfigurations/apps/v1/controllerrevision.go
index 8a01c0d754..1e4b09060e 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apps/v1/controllerrevision.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apps/v1/controllerrevision.go
@@ -41,7 +41,7 @@ import (
 // it may be subject to name and representation changes in future releases, and clients should not
 // depend on its stability. It is primarily for internal use by controllers.
 type ControllerRevisionApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apps/v1/daemonset.go b/vendor/k8s.io/client-go/applyconfigurations/apps/v1/daemonset.go
index cc8f33f290..c2c0ded3e4 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apps/v1/daemonset.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apps/v1/daemonset.go
@@ -32,7 +32,7 @@ import (
 //
 // DaemonSet represents the configuration of a daemon set.
 type DaemonSetApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apps/v1/deployment.go b/vendor/k8s.io/client-go/applyconfigurations/apps/v1/deployment.go
index 771ca0a75b..0fa84e16ef 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apps/v1/deployment.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apps/v1/deployment.go
@@ -32,7 +32,7 @@ import (
 //
 // Deployment enables declarative updates for Pods and ReplicaSets.
 type DeploymentApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apps/v1/replicaset.go b/vendor/k8s.io/client-go/applyconfigurations/apps/v1/replicaset.go
index 63f11a2183..689ee1e39c 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apps/v1/replicaset.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apps/v1/replicaset.go
@@ -32,7 +32,7 @@ import (
 //
 // ReplicaSet ensures that a specified number of pod replicas are running at any given time.
 type ReplicaSetApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// If the Labels of a ReplicaSet are empty, they are defaulted to
 	// be the same as the Pod(s) that the ReplicaSet manages.
 	// Standard object's metadata.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apps/v1/statefulset.go b/vendor/k8s.io/client-go/applyconfigurations/apps/v1/statefulset.go
index e3dc204637..b07c565144 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apps/v1/statefulset.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apps/v1/statefulset.go
@@ -38,7 +38,7 @@ import (
 // The StatefulSet guarantees that a given network identity will always
 // map to the same storage identity.
 type StatefulSetApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/controllerrevision.go b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/controllerrevision.go
index 6d2fdbefc8..4b3eb6d25a 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/controllerrevision.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/controllerrevision.go
@@ -43,7 +43,7 @@ import (
 // it may be subject to name and representation changes in future releases, and clients should not
 // depend on its stability. It is primarily for internal use by controllers.
 type ControllerRevisionApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/deployment.go b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/deployment.go
index e8195218ce..66cfa1fe4c 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/deployment.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/deployment.go
@@ -34,7 +34,7 @@ import (
 // more information.
 // Deployment enables declarative updates for Pods and ReplicaSets.
 type DeploymentApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Specification of the desired behavior of the Deployment.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/statefulset.go b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/statefulset.go
index 361ed68a90..392336c037 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/statefulset.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/statefulset.go
@@ -40,7 +40,7 @@ import (
 // The StatefulSet guarantees that a given network identity will always
 // map to the same storage identity.
 type StatefulSetApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	v1.TypeMetaApplyConfiguration    `json:""`
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Spec defines the desired identities of pods in this set.
 	Spec *StatefulSetSpecApplyConfiguration `json:"spec,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/statefulsetspec.go b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/statefulsetspec.go
index 3047440cac..250d4ab5d0 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/statefulsetspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta1/statefulsetspec.go
@@ -36,7 +36,7 @@ type StatefulSetSpecApplyConfiguration struct {
 	// TODO: Consider a rename of this field.
 	Replicas *int32 `json:"replicas,omitempty"`
 	// selector is a label query over pods that should match the replica count.
-	// If empty, defaulted to labels on the pod template.
+	// It must match the pod template's labels.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
 	Selector *v1.LabelSelectorApplyConfiguration `json:"selector,omitempty"`
 	// template is the object that describes the pod that will be created if
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/controllerrevision.go b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/controllerrevision.go
index 8ffacf61c2..120ebff872 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/controllerrevision.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/controllerrevision.go
@@ -43,7 +43,7 @@ import (
 // it may be subject to name and representation changes in future releases, and clients should not
 // depend on its stability. It is primarily for internal use by controllers.
 type ControllerRevisionApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/daemonset.go b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/daemonset.go
index 12b6150a3a..f7cdd6e743 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/daemonset.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/daemonset.go
@@ -34,7 +34,7 @@ import (
 // more information.
 // DaemonSet represents the configuration of a daemon set.
 type DaemonSetApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/deployment.go b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/deployment.go
index 4add5ae257..6d714e1942 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/deployment.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/deployment.go
@@ -34,7 +34,7 @@ import (
 // more information.
 // Deployment enables declarative updates for Pods and ReplicaSets.
 type DeploymentApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Specification of the desired behavior of the Deployment.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/replicaset.go b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/replicaset.go
index ea35da04ce..d34d5db25b 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/replicaset.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/replicaset.go
@@ -34,7 +34,7 @@ import (
 // more information.
 // ReplicaSet ensures that a specified number of pod replicas are running at any given time.
 type ReplicaSetApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// If the Labels of a ReplicaSet are empty, they are defaulted to
 	// be the same as the Pod(s) that the ReplicaSet manages.
 	// Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/scale.go b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/scale.go
index ca62809fcd..42f5cc553e 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/scale.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/scale.go
@@ -30,7 +30,7 @@ import (
 //
 // Scale represents a scaling request for a resource.
 type ScaleApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// defines the behavior of the scale. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/statefulset.go b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/statefulset.go
index 5649c11849..fc52c9ccf0 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/statefulset.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/apps/v1beta2/statefulset.go
@@ -40,7 +40,7 @@ import (
 // The StatefulSet guarantees that a given network identity will always
 // map to the same storage identity.
 type StatefulSetApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	v1.TypeMetaApplyConfiguration    `json:""`
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Spec defines the desired identities of pods in this set.
 	Spec *StatefulSetSpecApplyConfiguration `json:"spec,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v1/horizontalpodautoscaler.go b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v1/horizontalpodautoscaler.go
index f3bd143807..ad35e28842 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v1/horizontalpodautoscaler.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v1/horizontalpodautoscaler.go
@@ -32,8 +32,8 @@ import (
 //
 // configuration of a horizontal pod autoscaler.
 type HorizontalPodAutoscalerApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec defines the behaviour of autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
 	Spec *HorizontalPodAutoscalerSpecApplyConfiguration `json:"spec,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v1/horizontalpodautoscalerspec.go b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v1/horizontalpodautoscalerspec.go
index bf58371a9f..e4f0c72e17 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v1/horizontalpodautoscalerspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v1/horizontalpodautoscalerspec.go
@@ -23,7 +23,7 @@ package v1
 //
 // specification of a horizontal pod autoscaler.
 type HorizontalPodAutoscalerSpecApplyConfiguration struct {
-	// reference to scaled resource; horizontal pod autoscaler will learn the current resource consumption
+	// scaleTargetRef is the reference to scaled resource; horizontal pod autoscaler will learn the current resource consumption
 	// and will set the desired number of pods by using its Scale subresource.
 	ScaleTargetRef *CrossVersionObjectReferenceApplyConfiguration `json:"scaleTargetRef,omitempty"`
 	// minReplicas is the lower limit for the number of replicas to which the autoscaler
diff --git a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v1/scale.go b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v1/scale.go
index a491c5ac84..ea605a98b5 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v1/scale.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v1/scale.go
@@ -29,8 +29,8 @@ import (
 //
 // Scale represents a scaling request for a resource.
 type ScaleApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec defines the behavior of the scale. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
 	Spec *ScaleSpecApplyConfiguration `json:"spec,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/horizontalpodautoscaler.go b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/horizontalpodautoscaler.go
index e001653fc2..13de61084a 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/horizontalpodautoscaler.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/horizontalpodautoscaler.go
@@ -34,7 +34,7 @@ import (
 // autoscaler, which automatically manages the replica count of any resource
 // implementing the scale subresource based on the metrics specified.
 type HorizontalPodAutoscalerApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/horizontalpodautoscalercondition.go b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/horizontalpodautoscalercondition.go
index 75bb498524..9d43ddc1bd 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/horizontalpodautoscalercondition.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/horizontalpodautoscalercondition.go
@@ -42,6 +42,10 @@ type HorizontalPodAutoscalerConditionApplyConfiguration struct {
 	// message is a human-readable explanation containing details about
 	// the transition
 	Message *string `json:"message,omitempty"`
+	// observedGeneration represents the .metadata.generation that the condition was set based upon.
+	// For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+	// with respect to the current state of the instance.
+	ObservedGeneration *int64 `json:"observedGeneration,omitempty"`
 }
 
 // HorizontalPodAutoscalerConditionApplyConfiguration constructs a declarative configuration of the HorizontalPodAutoscalerCondition type for use with
@@ -89,3 +93,11 @@ func (b *HorizontalPodAutoscalerConditionApplyConfiguration) WithMessage(value s
 	b.Message = &value
 	return b
 }
+
+// WithObservedGeneration sets the ObservedGeneration field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ObservedGeneration field is set to the value of the last call.
+func (b *HorizontalPodAutoscalerConditionApplyConfiguration) WithObservedGeneration(value int64) *HorizontalPodAutoscalerConditionApplyConfiguration {
+	b.ObservedGeneration = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/hpascalingrules.go b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/hpascalingrules.go
index cebb11aa6a..ad0556b0a6 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/hpascalingrules.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/hpascalingrules.go
@@ -36,8 +36,7 @@ import (
 // window is chosen.
 //
 // The tolerance is applied to the metric values and prevents scaling too
-// eagerly for small metric variations. (Note that setting a tolerance requires
-// the beta HPAConfigurableTolerance feature gate to be enabled.)
+// eagerly for small metric variations.
 type HPAScalingRulesApplyConfiguration struct {
 	// stabilizationWindowSeconds is the number of seconds for which past recommendations should be
 	// considered while scaling up or scaling down.
@@ -62,9 +61,6 @@ type HPAScalingRulesApplyConfiguration struct {
 	// For example, if autoscaling is configured with a memory consumption target of 100Mi,
 	// and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be
 	// triggered when the actual consumption falls below 95Mi or exceeds 101Mi.
-	//
-	// This is an beta field and requires the HPAConfigurableTolerance feature
-	// gate to be enabled.
 	Tolerance *resource.Quantity `json:"tolerance,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/metricstatus.go b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/metricstatus.go
index 7c1a2cb0d6..0092a3135f 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/metricstatus.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/metricstatus.go
@@ -43,7 +43,7 @@ type MetricStatusApplyConfiguration struct {
 	// Kubernetes, and have special scaling options on top of those available
 	// to normal per-pod metrics using the "pods" source.
 	Resource *ResourceMetricStatusApplyConfiguration `json:"resource,omitempty"`
-	// container resource refers to a resource metric (such as those specified in
+	// containerResource refers to a resource metric (such as those specified in
 	// requests and limits) known to Kubernetes describing a single container in each pod in the
 	// current scale target (e.g. CPU or memory). Such metrics are built in to
 	// Kubernetes, and have special scaling options on top of those available
diff --git a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/metricvaluestatus.go b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/metricvaluestatus.go
index 9cd743d3e8..609c6e0248 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/metricvaluestatus.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/metricvaluestatus.go
@@ -32,7 +32,7 @@ type MetricValueStatusApplyConfiguration struct {
 	// averageValue is the current value of the average of the
 	// metric across all relevant pods (as a quantity)
 	AverageValue *resource.Quantity `json:"averageValue,omitempty"`
-	// currentAverageUtilization is the current value of the average of the
+	// averageUtilization is the current value of the average of the
 	// resource metric across all relevant pods, represented as a percentage of
 	// the requested value of the resource for the pods.
 	AverageUtilization *int32 `json:"averageUtilization,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/objectmetricstatus.go b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/objectmetricstatus.go
index ec5da782a4..dc43e05d9d 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/objectmetricstatus.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/autoscaling/v2/objectmetricstatus.go
@@ -28,7 +28,7 @@ type ObjectMetricStatusApplyConfiguration struct {
 	Metric *MetricIdentifierApplyConfiguration `json:"metric,omitempty"`
 	// current contains the current value for the given metric
 	Current *MetricValueStatusApplyConfiguration `json:"current,omitempty"`
-	// DescribedObject specifies the descriptions of a object,such as kind,name apiVersion
+	// describedObject specifies the descriptions of a object,such as kind,name apiVersion
 	DescribedObject *CrossVersionObjectReferenceApplyConfiguration `json:"describedObject,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/batch/v1/cronjob.go b/vendor/k8s.io/client-go/applyconfigurations/batch/v1/cronjob.go
index 2fbd489633..d6d8f0a8b6 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/batch/v1/cronjob.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/batch/v1/cronjob.go
@@ -32,7 +32,7 @@ import (
 //
 // CronJob represents the configuration of a single cron job.
 type CronJobApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/batch/v1/job.go b/vendor/k8s.io/client-go/applyconfigurations/batch/v1/job.go
index 02d59f0ec4..42da14b3eb 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/batch/v1/job.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/batch/v1/job.go
@@ -32,7 +32,7 @@ import (
 //
 // Job represents the configuration of a single job.
 type JobApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/batch/v1/jobschedulingconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/batch/v1/jobschedulingconfiguration.go
new file mode 100644
index 0000000000..21845d8012
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/batch/v1/jobschedulingconfiguration.go
@@ -0,0 +1,98 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	v1alpha3 "k8s.io/client-go/applyconfigurations/scheduling/v1alpha3"
+)
+
+// JobSchedulingConfigurationApplyConfiguration represents a declarative configuration of the JobSchedulingConfiguration type for use
+// with apply.
+//
+// JobSchedulingConfiguration composes the reusable workload-aware
+// scheduling building blocks.
+type JobSchedulingConfigurationApplyConfiguration struct {
+	// SchedulingPolicy defines the scheduling policy for this Job.
+	// Exactly one of Basic or Gang must be set.
+	// This field is immutable after creation: the policy may not be added or
+	// removed. The policy variant (basic/gang) is frozen by hand-written
+	// validation; only schedulingPolicy.gang.minCount may be changed.
+	SchedulingPolicy *v1alpha3.WorkloadPodGroupSchedulingPolicyApplyConfiguration `json:"schedulingPolicy,omitempty"`
+	// SchedulingConstraints defines scheduling constraints (e.g. topology)
+	// for the Job's pods.
+	// This field is immutable after creation.
+	SchedulingConstraints *v1alpha3.WorkloadPodGroupSchedulingConstraintsApplyConfiguration `json:"schedulingConstraints,omitempty"`
+	// DisruptionMode defines the mode in which the Job's pods can be disrupted.
+	// One of Single, All.
+	// This field is immutable after creation: it may not be added or removed,
+	// and the selected mode may not be changed.
+	DisruptionMode *v1alpha3.WorkloadPodGroupDisruptionModeApplyConfiguration `json:"disruptionMode,omitempty"`
+	// ResourceClaims defines which ResourceClaims may be shared among Pods in
+	// the Job. Pods consume the devices allocated to a PodGroup's claim by
+	// defining a claim in its own Spec.ResourceClaims that matches the
+	// PodGroup's claim exactly. The claim must have the same name and refer to
+	// the same ResourceClaim or ResourceClaimTemplate.
+	// At most 4 claims may be set, matching the limit on the resulting PodGroup.
+	// This list is immutable after creation: entries may neither be added,
+	// removed, nor modified.
+	ResourceClaims []v1alpha3.WorkloadPodGroupResourceClaimApplyConfiguration `json:"resourceClaims,omitempty"`
+}
+
+// JobSchedulingConfigurationApplyConfiguration constructs a declarative configuration of the JobSchedulingConfiguration type for use with
+// apply.
+func JobSchedulingConfiguration() *JobSchedulingConfigurationApplyConfiguration {
+	return &JobSchedulingConfigurationApplyConfiguration{}
+}
+
+// WithSchedulingPolicy sets the SchedulingPolicy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SchedulingPolicy field is set to the value of the last call.
+func (b *JobSchedulingConfigurationApplyConfiguration) WithSchedulingPolicy(value *v1alpha3.WorkloadPodGroupSchedulingPolicyApplyConfiguration) *JobSchedulingConfigurationApplyConfiguration {
+	b.SchedulingPolicy = value
+	return b
+}
+
+// WithSchedulingConstraints sets the SchedulingConstraints field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SchedulingConstraints field is set to the value of the last call.
+func (b *JobSchedulingConfigurationApplyConfiguration) WithSchedulingConstraints(value *v1alpha3.WorkloadPodGroupSchedulingConstraintsApplyConfiguration) *JobSchedulingConfigurationApplyConfiguration {
+	b.SchedulingConstraints = value
+	return b
+}
+
+// WithDisruptionMode sets the DisruptionMode field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DisruptionMode field is set to the value of the last call.
+func (b *JobSchedulingConfigurationApplyConfiguration) WithDisruptionMode(value *v1alpha3.WorkloadPodGroupDisruptionModeApplyConfiguration) *JobSchedulingConfigurationApplyConfiguration {
+	b.DisruptionMode = value
+	return b
+}
+
+// WithResourceClaims adds the given value to the ResourceClaims field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the ResourceClaims field.
+func (b *JobSchedulingConfigurationApplyConfiguration) WithResourceClaims(values ...*v1alpha3.WorkloadPodGroupResourceClaimApplyConfiguration) *JobSchedulingConfigurationApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithResourceClaims")
+		}
+		b.ResourceClaims = append(b.ResourceClaims, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/batch/v1/jobspec.go b/vendor/k8s.io/client-go/applyconfigurations/batch/v1/jobspec.go
index 81064df751..ea3d54b062 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/batch/v1/jobspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/batch/v1/jobspec.go
@@ -160,6 +160,15 @@ type JobSpecApplyConfiguration struct {
 	// characters as defined by RFC 3986. The value cannot exceed 63 characters.
 	// This field is immutable.
 	ManagedBy *string `json:"managedBy,omitempty"`
+	// scheduling defines the Workload-aware Scheduling configuration for this Job.
+	// When set, it specifies the scheduling policy (basic or gang), topology
+	// constraints, disruption mode, and shared resource claims.
+	// When omitted, the Job defaults to the basic scheduling policy, which behaves
+	// as standard pod-by-pod scheduling.
+	// This field is alpha-level and requires the WorkloadWithJob feature gate.
+	// This field is immutable, including whether it is set at all, only
+	// policy.gang.minCount may be changed after creation.
+	Scheduling *JobSchedulingConfigurationApplyConfiguration `json:"scheduling,omitempty"`
 }
 
 // JobSpecApplyConfiguration constructs a declarative configuration of the JobSpec type for use with
@@ -295,3 +304,11 @@ func (b *JobSpecApplyConfiguration) WithManagedBy(value string) *JobSpecApplyCon
 	b.ManagedBy = &value
 	return b
 }
+
+// WithScheduling sets the Scheduling field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Scheduling field is set to the value of the last call.
+func (b *JobSpecApplyConfiguration) WithScheduling(value *JobSchedulingConfigurationApplyConfiguration) *JobSpecApplyConfiguration {
+	b.Scheduling = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/batch/v1/jobstatus.go b/vendor/k8s.io/client-go/applyconfigurations/batch/v1/jobstatus.go
index 0e11fd9beb..8260f4b6dd 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/batch/v1/jobstatus.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/batch/v1/jobstatus.go
@@ -69,9 +69,6 @@ type JobStatusApplyConfiguration struct {
 	Failed *int32 `json:"failed,omitempty"`
 	// The number of pods which are terminating (in phase Pending or Running
 	// and have a deletionTimestamp).
-	//
-	// This field is beta-level. The job controller populates the field when
-	// the feature gate JobPodReplacementPolicy is enabled (enabled by default).
 	Terminating *int32 `json:"terminating,omitempty"`
 	// completedIndexes holds the completed indexes when .spec.completionMode =
 	// "Indexed" in a text format. The indexes are represented as decimal integers
diff --git a/vendor/k8s.io/client-go/applyconfigurations/batch/v1beta1/cronjob.go b/vendor/k8s.io/client-go/applyconfigurations/batch/v1beta1/cronjob.go
index f0ab32de4d..6b3a33f374 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/batch/v1beta1/cronjob.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/batch/v1beta1/cronjob.go
@@ -32,7 +32,7 @@ import (
 //
 // CronJob represents the configuration of a single cron job.
 type CronJobApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/certificatesigningrequest.go b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/certificatesigningrequest.go
index 0769c9f2c7..58bfd595c1 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/certificatesigningrequest.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/certificatesigningrequest.go
@@ -41,7 +41,7 @@ import (
 // (with the "kubernetes.io/kube-apiserver-client" signerName),
 // or to obtain certificates from custom non-Kubernetes signers.
 type CertificateSigningRequestApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration    `json:",inline"`
+	metav1.TypeMetaApplyConfiguration    `json:""`
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec contains the certificate request, and is immutable after creation.
 	// Only the request, signerName, expirationSeconds, and usages fields can be set on creation.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/clustertrustbundle.go b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/clustertrustbundle.go
new file mode 100644
index 0000000000..3879548644
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/clustertrustbundle.go
@@ -0,0 +1,288 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	certificatesv1 "k8s.io/api/certificates/v1"
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	internal "k8s.io/client-go/applyconfigurations/internal"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// ClusterTrustBundleApplyConfiguration represents a declarative configuration of the ClusterTrustBundle type for use
+// with apply.
+//
+// ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors
+// (root certificates).
+//
+// ClusterTrustBundle objects are considered to be readable by any authenticated
+// user in the cluster, because they can be mounted by pods using the
+// `clusterTrustBundle` projection.  All service accounts have read access to
+// ClusterTrustBundles by default.  Users who only have namespace-level access
+// to a cluster can read ClusterTrustBundles by impersonating a serviceaccount
+// that they have access to.
+//
+// It can be optionally associated with a particular signer, in which case it
+// contains one valid set of trust anchors for that signer. Signers may have
+// multiple associated ClusterTrustBundles; each is an independent set of trust
+// anchors for that signer. Admission control is used to enforce that only users
+// with permissions on the signer can create or modify the corresponding bundle.
+type ClusterTrustBundleApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata contains the object metadata.
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	// spec contains the signer (if any) and trust anchors.
+	Spec *ClusterTrustBundleSpecApplyConfiguration `json:"spec,omitempty"`
+}
+
+// ClusterTrustBundle constructs a declarative configuration of the ClusterTrustBundle type for use with
+// apply.
+func ClusterTrustBundle(name string) *ClusterTrustBundleApplyConfiguration {
+	b := &ClusterTrustBundleApplyConfiguration{}
+	b.WithName(name)
+	b.WithKind("ClusterTrustBundle")
+	b.WithAPIVersion("certificates.k8s.io/v1")
+	return b
+}
+
+// ExtractClusterTrustBundleFrom extracts the applied configuration owned by fieldManager from
+// clusterTrustBundle for the specified subresource. Pass an empty string for subresource to extract
+// the main resource. Common subresources include "status", "scale", etc.
+// clusterTrustBundle must be a unmodified ClusterTrustBundle API object that was retrieved from the Kubernetes API.
+// ExtractClusterTrustBundleFrom provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractClusterTrustBundleFrom(clusterTrustBundle *certificatesv1.ClusterTrustBundle, fieldManager string, subresource string) (*ClusterTrustBundleApplyConfiguration, error) {
+	b := &ClusterTrustBundleApplyConfiguration{}
+	err := managedfields.ExtractInto(clusterTrustBundle, internal.Parser().Type("io.k8s.api.certificates.v1.ClusterTrustBundle"), fieldManager, b, subresource)
+	if err != nil {
+		return nil, err
+	}
+	b.WithName(clusterTrustBundle.Name)
+
+	b.WithKind("ClusterTrustBundle")
+	b.WithAPIVersion("certificates.k8s.io/v1")
+	return b, nil
+}
+
+// ExtractClusterTrustBundle extracts the applied configuration owned by fieldManager from
+// clusterTrustBundle. If no managedFields are found in clusterTrustBundle for fieldManager, a
+// ClusterTrustBundleApplyConfiguration is returned with only the Name, Namespace (if applicable),
+// APIVersion and Kind populated. It is possible that no managed fields were found for because other
+// field managers have taken ownership of all the fields previously owned by fieldManager, or because
+// the fieldManager never owned fields any fields.
+// clusterTrustBundle must be a unmodified ClusterTrustBundle API object that was retrieved from the Kubernetes API.
+// ExtractClusterTrustBundle provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractClusterTrustBundle(clusterTrustBundle *certificatesv1.ClusterTrustBundle, fieldManager string) (*ClusterTrustBundleApplyConfiguration, error) {
+	return ExtractClusterTrustBundleFrom(clusterTrustBundle, fieldManager, "")
+}
+
+func (b ClusterTrustBundleApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *ClusterTrustBundleApplyConfiguration) WithKind(value string) *ClusterTrustBundleApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *ClusterTrustBundleApplyConfiguration) WithAPIVersion(value string) *ClusterTrustBundleApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ClusterTrustBundleApplyConfiguration) WithName(value string) *ClusterTrustBundleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *ClusterTrustBundleApplyConfiguration) WithGenerateName(value string) *ClusterTrustBundleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ClusterTrustBundleApplyConfiguration) WithNamespace(value string) *ClusterTrustBundleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *ClusterTrustBundleApplyConfiguration) WithUID(value types.UID) *ClusterTrustBundleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *ClusterTrustBundleApplyConfiguration) WithResourceVersion(value string) *ClusterTrustBundleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *ClusterTrustBundleApplyConfiguration) WithGeneration(value int64) *ClusterTrustBundleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *ClusterTrustBundleApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *ClusterTrustBundleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *ClusterTrustBundleApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *ClusterTrustBundleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *ClusterTrustBundleApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ClusterTrustBundleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *ClusterTrustBundleApplyConfiguration) WithLabels(entries map[string]string) *ClusterTrustBundleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *ClusterTrustBundleApplyConfiguration) WithAnnotations(entries map[string]string) *ClusterTrustBundleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *ClusterTrustBundleApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *ClusterTrustBundleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *ClusterTrustBundleApplyConfiguration) WithFinalizers(values ...string) *ClusterTrustBundleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *ClusterTrustBundleApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *ClusterTrustBundleApplyConfiguration) WithSpec(value *ClusterTrustBundleSpecApplyConfiguration) *ClusterTrustBundleApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *ClusterTrustBundleApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *ClusterTrustBundleApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *ClusterTrustBundleApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *ClusterTrustBundleApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/clustertrustbundlespec.go b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/clustertrustbundlespec.go
new file mode 100644
index 0000000000..5b7bb10384
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/clustertrustbundlespec.go
@@ -0,0 +1,79 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// ClusterTrustBundleSpecApplyConfiguration represents a declarative configuration of the ClusterTrustBundleSpec type for use
+// with apply.
+//
+// ClusterTrustBundleSpec contains the signer and trust anchors.
+type ClusterTrustBundleSpecApplyConfiguration struct {
+	// signerName indicates the associated signer, if any.
+	//
+	// In order to create or update a ClusterTrustBundle that sets signerName,
+	// you must have the following cluster-scoped permission:
+	// group=certificates.k8s.io resource=signers resourceName=<the signer name>
+	// verb=attest.
+	//
+	// If signerName is not empty, then the ClusterTrustBundle object must be
+	// named with the signer name as a prefix (translating slashes to colons).
+	// For example, for the signer name `example.com/foo`, valid
+	// ClusterTrustBundle object names include `example.com:foo:abc` and
+	// `example.com:foo:v1`.
+	//
+	// If signerName is empty, then the ClusterTrustBundle object's name must
+	// not have such a prefix.
+	//
+	// List/watch requests for ClusterTrustBundles can filter on this field
+	// using a `spec.signerName=NAME` field selector.
+	SignerName *string `json:"signerName,omitempty"`
+	// trustBundle contains the individual X.509 trust anchors for this
+	// bundle, as PEM bundle of PEM-wrapped, DER-formatted X.509 certificates.
+	//
+	// The data must consist only of PEM certificate blocks that parse as valid
+	// X.509 certificates.  Each certificate must include a basic constraints
+	// extension with the CA bit set.  The API server will reject objects that
+	// contain duplicate certificates, or that use PEM block headers.
+	//
+	// Users of ClusterTrustBundles, including Kubelet, are free to reorder and
+	// deduplicate certificate blocks in this file according to their own logic,
+	// as well as to drop PEM block headers and inter-block data.
+	TrustBundle *string `json:"trustBundle,omitempty"`
+}
+
+// ClusterTrustBundleSpecApplyConfiguration constructs a declarative configuration of the ClusterTrustBundleSpec type for use with
+// apply.
+func ClusterTrustBundleSpec() *ClusterTrustBundleSpecApplyConfiguration {
+	return &ClusterTrustBundleSpecApplyConfiguration{}
+}
+
+// WithSignerName sets the SignerName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SignerName field is set to the value of the last call.
+func (b *ClusterTrustBundleSpecApplyConfiguration) WithSignerName(value string) *ClusterTrustBundleSpecApplyConfiguration {
+	b.SignerName = &value
+	return b
+}
+
+// WithTrustBundle sets the TrustBundle field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the TrustBundle field is set to the value of the last call.
+func (b *ClusterTrustBundleSpecApplyConfiguration) WithTrustBundle(value string) *ClusterTrustBundleSpecApplyConfiguration {
+	b.TrustBundle = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/podcertificaterequest.go b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/podcertificaterequest.go
new file mode 100644
index 0000000000..41ecc78d80
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/podcertificaterequest.go
@@ -0,0 +1,295 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	certificatesv1 "k8s.io/api/certificates/v1"
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	internal "k8s.io/client-go/applyconfigurations/internal"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// PodCertificateRequestApplyConfiguration represents a declarative configuration of the PodCertificateRequest type for use
+// with apply.
+//
+// PodCertificateRequest encodes a pod requesting a certificate from a given
+// signer.
+//
+// Kubelets use this API to implement podCertificate projected volumes
+type PodCertificateRequestApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata contains the object metadata.
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	// spec contains the details about the certificate being requested.
+	Spec *PodCertificateRequestSpecApplyConfiguration `json:"spec,omitempty"`
+	// status contains the issued certificate, and a standard set of conditions.
+	Status *PodCertificateRequestStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// PodCertificateRequest constructs a declarative configuration of the PodCertificateRequest type for use with
+// apply.
+func PodCertificateRequest(name, namespace string) *PodCertificateRequestApplyConfiguration {
+	b := &PodCertificateRequestApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("PodCertificateRequest")
+	b.WithAPIVersion("certificates.k8s.io/v1")
+	return b
+}
+
+// ExtractPodCertificateRequestFrom extracts the applied configuration owned by fieldManager from
+// podCertificateRequest for the specified subresource. Pass an empty string for subresource to extract
+// the main resource. Common subresources include "status", "scale", etc.
+// podCertificateRequest must be a unmodified PodCertificateRequest API object that was retrieved from the Kubernetes API.
+// ExtractPodCertificateRequestFrom provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractPodCertificateRequestFrom(podCertificateRequest *certificatesv1.PodCertificateRequest, fieldManager string, subresource string) (*PodCertificateRequestApplyConfiguration, error) {
+	b := &PodCertificateRequestApplyConfiguration{}
+	err := managedfields.ExtractInto(podCertificateRequest, internal.Parser().Type("io.k8s.api.certificates.v1.PodCertificateRequest"), fieldManager, b, subresource)
+	if err != nil {
+		return nil, err
+	}
+	b.WithName(podCertificateRequest.Name)
+	b.WithNamespace(podCertificateRequest.Namespace)
+
+	b.WithKind("PodCertificateRequest")
+	b.WithAPIVersion("certificates.k8s.io/v1")
+	return b, nil
+}
+
+// ExtractPodCertificateRequest extracts the applied configuration owned by fieldManager from
+// podCertificateRequest. If no managedFields are found in podCertificateRequest for fieldManager, a
+// PodCertificateRequestApplyConfiguration is returned with only the Name, Namespace (if applicable),
+// APIVersion and Kind populated. It is possible that no managed fields were found for because other
+// field managers have taken ownership of all the fields previously owned by fieldManager, or because
+// the fieldManager never owned fields any fields.
+// podCertificateRequest must be a unmodified PodCertificateRequest API object that was retrieved from the Kubernetes API.
+// ExtractPodCertificateRequest provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractPodCertificateRequest(podCertificateRequest *certificatesv1.PodCertificateRequest, fieldManager string) (*PodCertificateRequestApplyConfiguration, error) {
+	return ExtractPodCertificateRequestFrom(podCertificateRequest, fieldManager, "")
+}
+
+// ExtractPodCertificateRequestStatus extracts the applied configuration owned by fieldManager from
+// podCertificateRequest for the status subresource.
+func ExtractPodCertificateRequestStatus(podCertificateRequest *certificatesv1.PodCertificateRequest, fieldManager string) (*PodCertificateRequestApplyConfiguration, error) {
+	return ExtractPodCertificateRequestFrom(podCertificateRequest, fieldManager, "status")
+}
+
+func (b PodCertificateRequestApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *PodCertificateRequestApplyConfiguration) WithKind(value string) *PodCertificateRequestApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *PodCertificateRequestApplyConfiguration) WithAPIVersion(value string) *PodCertificateRequestApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *PodCertificateRequestApplyConfiguration) WithName(value string) *PodCertificateRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *PodCertificateRequestApplyConfiguration) WithGenerateName(value string) *PodCertificateRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *PodCertificateRequestApplyConfiguration) WithNamespace(value string) *PodCertificateRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *PodCertificateRequestApplyConfiguration) WithUID(value types.UID) *PodCertificateRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *PodCertificateRequestApplyConfiguration) WithResourceVersion(value string) *PodCertificateRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *PodCertificateRequestApplyConfiguration) WithGeneration(value int64) *PodCertificateRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *PodCertificateRequestApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *PodCertificateRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *PodCertificateRequestApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *PodCertificateRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *PodCertificateRequestApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *PodCertificateRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *PodCertificateRequestApplyConfiguration) WithLabels(entries map[string]string) *PodCertificateRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *PodCertificateRequestApplyConfiguration) WithAnnotations(entries map[string]string) *PodCertificateRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *PodCertificateRequestApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *PodCertificateRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *PodCertificateRequestApplyConfiguration) WithFinalizers(values ...string) *PodCertificateRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *PodCertificateRequestApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *PodCertificateRequestApplyConfiguration) WithSpec(value *PodCertificateRequestSpecApplyConfiguration) *PodCertificateRequestApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *PodCertificateRequestApplyConfiguration) WithStatus(value *PodCertificateRequestStatusApplyConfiguration) *PodCertificateRequestApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *PodCertificateRequestApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *PodCertificateRequestApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *PodCertificateRequestApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *PodCertificateRequestApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/podcertificaterequestspec.go b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/podcertificaterequestspec.go
new file mode 100644
index 0000000000..a952f16523
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/podcertificaterequestspec.go
@@ -0,0 +1,189 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	types "k8s.io/apimachinery/pkg/types"
+)
+
+// PodCertificateRequestSpecApplyConfiguration represents a declarative configuration of the PodCertificateRequestSpec type for use
+// with apply.
+//
+// PodCertificateRequestSpec describes the certificate request.  All fields are
+// immutable after creation.
+type PodCertificateRequestSpecApplyConfiguration struct {
+	// signerName indicates the requested signer.
+	//
+	// All signer names beginning with `kubernetes.io` are reserved for use by
+	// the Kubernetes project.  There is currently one well-known signer
+	// documented by the Kubernetes project,
+	// `kubernetes.io/kube-apiserver-client-pod`, which will issue client
+	// certificates understood by kube-apiserver.  It is currently
+	// unimplemented.
+	SignerName *string `json:"signerName,omitempty"`
+	// podName is the name of the pod into which the certificate will be mounted.
+	PodName *string `json:"podName,omitempty"`
+	// podUID is the UID of the pod into which the certificate will be mounted.
+	PodUID *types.UID `json:"podUID,omitempty"`
+	// serviceAccountName is the name of the service account the pod is running as.
+	ServiceAccountName *string `json:"serviceAccountName,omitempty"`
+	// serviceAccountUID is the UID of the service account the pod is running as.
+	ServiceAccountUID *types.UID `json:"serviceAccountUID,omitempty"`
+	// nodeName is the name of the node the pod is assigned to.
+	NodeName *types.NodeName `json:"nodeName,omitempty"`
+	// nodeUID is the UID of the node the pod is assigned to.
+	NodeUID *types.UID `json:"nodeUID,omitempty"`
+	// maxExpirationSeconds is the maximum lifetime permitted for the
+	// certificate.
+	//
+	// If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+	// will reject values shorter than 3600 (1 hour).  The maximum allowable
+	// value is 7862400 (91 days).
+	//
+	// The signer implementation is then free to issue a certificate with any
+	// lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+	// seconds (1 hour).  This constraint is enforced by kube-apiserver.
+	// `kubernetes.io` signers will never issue certificates with a lifetime
+	// longer than 24 hours.
+	MaxExpirationSeconds *int32 `json:"maxExpirationSeconds,omitempty"`
+	// A PKCS#10 certificate signing request (DER-serialized) generated by
+	// Kubelet using the subject private key.
+	//
+	// Most signer implementations will ignore the contents of the CSR except to
+	// extract the subject public key. The API server automatically verifies the
+	// CSR signature during admission, so the signer does not need to repeat the
+	// verification.  CSRs generated by kubelet are completely empty.
+	//
+	// The subject public key must be one of RSA3072, RSA4096, ECDSAP256,
+	// ECDSAP384, ECDSAP521, or ED25519. Note that this list may be expanded in
+	// the future.
+	//
+	// Signer implementations do not need to support all key types supported by
+	// kube-apiserver and kubelet.  If a signer does not support the key type
+	// used for a given PodCertificateRequest, it must deny the request by
+	// setting a status.conditions entry with a type of "Denied" and a reason of
+	// "UnsupportedKeyType". It may also suggest a key type that it does support
+	// in the message field.
+	StubPKCS10Request []byte `json:"stubPKCS10Request,omitempty"`
+	// unverifiedUserAnnotations allow pod authors to pass additional information to
+	// the signer implementation.  Kubernetes does not restrict or validate this
+	// metadata in any way.
+	//
+	// Entries are subject to the same validation as object metadata annotations,
+	// with the addition that all keys must be domain-prefixed. No restrictions
+	// are placed on values, except an overall size limitation on the entire field.
+	//
+	// Signers should document the keys and values they support.  Signers should
+	// deny requests that contain keys they do not recognize.
+	UnverifiedUserAnnotations map[string]string `json:"unverifiedUserAnnotations,omitempty"`
+}
+
+// PodCertificateRequestSpecApplyConfiguration constructs a declarative configuration of the PodCertificateRequestSpec type for use with
+// apply.
+func PodCertificateRequestSpec() *PodCertificateRequestSpecApplyConfiguration {
+	return &PodCertificateRequestSpecApplyConfiguration{}
+}
+
+// WithSignerName sets the SignerName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SignerName field is set to the value of the last call.
+func (b *PodCertificateRequestSpecApplyConfiguration) WithSignerName(value string) *PodCertificateRequestSpecApplyConfiguration {
+	b.SignerName = &value
+	return b
+}
+
+// WithPodName sets the PodName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PodName field is set to the value of the last call.
+func (b *PodCertificateRequestSpecApplyConfiguration) WithPodName(value string) *PodCertificateRequestSpecApplyConfiguration {
+	b.PodName = &value
+	return b
+}
+
+// WithPodUID sets the PodUID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PodUID field is set to the value of the last call.
+func (b *PodCertificateRequestSpecApplyConfiguration) WithPodUID(value types.UID) *PodCertificateRequestSpecApplyConfiguration {
+	b.PodUID = &value
+	return b
+}
+
+// WithServiceAccountName sets the ServiceAccountName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ServiceAccountName field is set to the value of the last call.
+func (b *PodCertificateRequestSpecApplyConfiguration) WithServiceAccountName(value string) *PodCertificateRequestSpecApplyConfiguration {
+	b.ServiceAccountName = &value
+	return b
+}
+
+// WithServiceAccountUID sets the ServiceAccountUID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ServiceAccountUID field is set to the value of the last call.
+func (b *PodCertificateRequestSpecApplyConfiguration) WithServiceAccountUID(value types.UID) *PodCertificateRequestSpecApplyConfiguration {
+	b.ServiceAccountUID = &value
+	return b
+}
+
+// WithNodeName sets the NodeName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NodeName field is set to the value of the last call.
+func (b *PodCertificateRequestSpecApplyConfiguration) WithNodeName(value types.NodeName) *PodCertificateRequestSpecApplyConfiguration {
+	b.NodeName = &value
+	return b
+}
+
+// WithNodeUID sets the NodeUID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NodeUID field is set to the value of the last call.
+func (b *PodCertificateRequestSpecApplyConfiguration) WithNodeUID(value types.UID) *PodCertificateRequestSpecApplyConfiguration {
+	b.NodeUID = &value
+	return b
+}
+
+// WithMaxExpirationSeconds sets the MaxExpirationSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MaxExpirationSeconds field is set to the value of the last call.
+func (b *PodCertificateRequestSpecApplyConfiguration) WithMaxExpirationSeconds(value int32) *PodCertificateRequestSpecApplyConfiguration {
+	b.MaxExpirationSeconds = &value
+	return b
+}
+
+// WithStubPKCS10Request adds the given value to the StubPKCS10Request field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the StubPKCS10Request field.
+func (b *PodCertificateRequestSpecApplyConfiguration) WithStubPKCS10Request(values ...byte) *PodCertificateRequestSpecApplyConfiguration {
+	for i := range values {
+		b.StubPKCS10Request = append(b.StubPKCS10Request, values[i])
+	}
+	return b
+}
+
+// WithUnverifiedUserAnnotations puts the entries into the UnverifiedUserAnnotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the UnverifiedUserAnnotations field,
+// overwriting an existing map entries in UnverifiedUserAnnotations field with the same key.
+func (b *PodCertificateRequestSpecApplyConfiguration) WithUnverifiedUserAnnotations(entries map[string]string) *PodCertificateRequestSpecApplyConfiguration {
+	if b.UnverifiedUserAnnotations == nil && len(entries) > 0 {
+		b.UnverifiedUserAnnotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.UnverifiedUserAnnotations[k] = v
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/podcertificaterequeststatus.go b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/podcertificaterequeststatus.go
new file mode 100644
index 0000000000..e10dd930a0
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1/podcertificaterequeststatus.go
@@ -0,0 +1,133 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// PodCertificateRequestStatusApplyConfiguration represents a declarative configuration of the PodCertificateRequestStatus type for use
+// with apply.
+//
+// PodCertificateRequestStatus describes the status of the request, and holds
+// the certificate data if the request is issued.
+type PodCertificateRequestStatusApplyConfiguration struct {
+	// conditions applied to the request.
+	//
+	// The types "Issued", "Denied", and "Failed" have special handling.  At
+	// most one of these conditions may be present, and they must have status
+	// "True".
+	//
+	// If the request is denied with `Reason=UnsupportedKeyType`, the signer may
+	// suggest a key type that will work in the message field.
+	Conditions []metav1.ConditionApplyConfiguration `json:"conditions,omitempty"`
+	// certificateChain is populated with an issued certificate by the signer.
+	// This field is set via the /status subresource. Once populated, this field
+	// is immutable.
+	//
+	// If the certificate signing request is denied, a condition of type
+	// "Denied" is added and this field remains empty. If the signer cannot
+	// issue the certificate, a condition of type "Failed" is added and this
+	// field remains empty.
+	//
+	// Validation requirements:
+	// 1. certificateChain must consist of one or more PEM-formatted certificates.
+	// 2. Each entry must be a valid PEM-wrapped, DER-encoded ASN.1 Certificate as
+	// described in section 4 of RFC5280.
+	//
+	// If more than one block is present, and the definition of the requested
+	// spec.signerName does not indicate otherwise, the first block is the
+	// issued certificate, and subsequent blocks should be treated as
+	// intermediate certificates and presented in TLS handshakes.  When
+	// projecting the chain into a pod volume, kubelet will drop any data
+	// in-between the PEM blocks, as well as any PEM block headers.
+	CertificateChain *string `json:"certificateChain,omitempty"`
+	// notBefore is the time at which the certificate becomes valid.  The value
+	// must be the same as the notBefore value in the leaf certificate in
+	// certificateChain.  This field is set via the /status subresource.  Once
+	// populated, it is immutable. The signer must set this field at the same
+	// time it sets certificateChain.
+	NotBefore *apismetav1.Time `json:"notBefore,omitempty"`
+	// beginRefreshAt is the time at which the kubelet should begin trying to
+	// refresh the certificate.  This field is set via the /status subresource,
+	// and must be set at the same time as certificateChain.  Once populated,
+	// this field is immutable.
+	//
+	// This field is only a hint.  Kubelet may start refreshing before or after
+	// this time if necessary.
+	BeginRefreshAt *apismetav1.Time `json:"beginRefreshAt,omitempty"`
+	// notAfter is the time at which the certificate expires.  The value must be
+	// the same as the notAfter value in the leaf certificate in
+	// certificateChain.  This field is set via the /status subresource.  Once
+	// populated, it is immutable.  The signer must set this field at the same
+	// time it sets certificateChain.
+	NotAfter *apismetav1.Time `json:"notAfter,omitempty"`
+}
+
+// PodCertificateRequestStatusApplyConfiguration constructs a declarative configuration of the PodCertificateRequestStatus type for use with
+// apply.
+func PodCertificateRequestStatus() *PodCertificateRequestStatusApplyConfiguration {
+	return &PodCertificateRequestStatusApplyConfiguration{}
+}
+
+// WithConditions adds the given value to the Conditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Conditions field.
+func (b *PodCertificateRequestStatusApplyConfiguration) WithConditions(values ...*metav1.ConditionApplyConfiguration) *PodCertificateRequestStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithConditions")
+		}
+		b.Conditions = append(b.Conditions, *values[i])
+	}
+	return b
+}
+
+// WithCertificateChain sets the CertificateChain field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CertificateChain field is set to the value of the last call.
+func (b *PodCertificateRequestStatusApplyConfiguration) WithCertificateChain(value string) *PodCertificateRequestStatusApplyConfiguration {
+	b.CertificateChain = &value
+	return b
+}
+
+// WithNotBefore sets the NotBefore field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NotBefore field is set to the value of the last call.
+func (b *PodCertificateRequestStatusApplyConfiguration) WithNotBefore(value apismetav1.Time) *PodCertificateRequestStatusApplyConfiguration {
+	b.NotBefore = &value
+	return b
+}
+
+// WithBeginRefreshAt sets the BeginRefreshAt field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the BeginRefreshAt field is set to the value of the last call.
+func (b *PodCertificateRequestStatusApplyConfiguration) WithBeginRefreshAt(value apismetav1.Time) *PodCertificateRequestStatusApplyConfiguration {
+	b.BeginRefreshAt = &value
+	return b
+}
+
+// WithNotAfter sets the NotAfter field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the NotAfter field is set to the value of the last call.
+func (b *PodCertificateRequestStatusApplyConfiguration) WithNotAfter(value apismetav1.Time) *PodCertificateRequestStatusApplyConfiguration {
+	b.NotAfter = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/certificates/v1alpha1/clustertrustbundle.go b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1alpha1/clustertrustbundle.go
index 9c26cdb915..7fdaae5b01 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/certificates/v1alpha1/clustertrustbundle.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1alpha1/clustertrustbundle.go
@@ -40,13 +40,13 @@ import (
 // to a cluster can read ClusterTrustBundles by impersonating a serviceaccount
 // that they have access to.
 //
-// It can be optionally associated with a particular assigner, in which case it
+// It can be optionally associated with a particular signer, in which case it
 // contains one valid set of trust anchors for that signer. Signers may have
 // multiple associated ClusterTrustBundles; each is an independent set of trust
 // anchors for that signer. Admission control is used to enforce that only users
 // with permissions on the signer can create or modify the corresponding bundle.
 type ClusterTrustBundleApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// metadata contains the object metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec contains the signer (if any) and trust anchors.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/certificates/v1beta1/certificatesigningrequest.go b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1beta1/certificatesigningrequest.go
index 05e16d2054..256e0f5045 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/certificates/v1beta1/certificatesigningrequest.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1beta1/certificatesigningrequest.go
@@ -32,7 +32,7 @@ import (
 //
 // Describes a certificate signing request
 type CertificateSigningRequestApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	v1.TypeMetaApplyConfiguration    `json:""`
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec contains the certificate request, and is immutable after creation.
 	// Only the request, signerName, expirationSeconds, and usages fields can be set on creation.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/certificates/v1beta1/clustertrustbundle.go b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1beta1/clustertrustbundle.go
index 7f8be00ce4..5c70207c6a 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/certificates/v1beta1/clustertrustbundle.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1beta1/clustertrustbundle.go
@@ -40,13 +40,13 @@ import (
 // to a cluster can read ClusterTrustBundles by impersonating a serviceaccount
 // that they have access to.
 //
-// It can be optionally associated with a particular assigner, in which case it
+// It can be optionally associated with a particular signer, in which case it
 // contains one valid set of trust anchors for that signer. Signers may have
 // multiple associated ClusterTrustBundles; each is an independent set of trust
 // anchors for that signer. Admission control is used to enforce that only users
 // with permissions on the signer can create or modify the corresponding bundle.
 type ClusterTrustBundleApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// metadata contains the object metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec contains the signer (if any) and trust anchors.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/certificates/v1beta1/podcertificaterequest.go b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1beta1/podcertificaterequest.go
index 447172552c..bf12e23c0f 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/certificates/v1beta1/podcertificaterequest.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/certificates/v1beta1/podcertificaterequest.go
@@ -35,7 +35,7 @@ import (
 //
 // Kubelets use this API to implement podCertificate projected volumes
 type PodCertificateRequestApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// metadata contains the object metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec contains the details about the certificate being requested.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1/lease.go b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1/lease.go
index de18339754..4dce4ca8a7 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1/lease.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1/lease.go
@@ -32,7 +32,8 @@ import (
 //
 // Lease defines a lease concept.
 type LeaseApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec contains the specification of the Lease.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1/leasespec.go b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1/leasespec.go
index 4dca58e2e5..05470ca61a 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1/leasespec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1/leasespec.go
@@ -44,11 +44,11 @@ type LeaseSpecApplyConfiguration struct {
 	// leaseTransitions is the number of transitions of a lease between
 	// holders.
 	LeaseTransitions *int32 `json:"leaseTransitions,omitempty"`
-	// Strategy indicates the strategy for picking the leader for coordinated leader election.
+	// strategy indicates the strategy for picking the leader for coordinated leader election.
 	// If the field is not specified, there is no active coordination for this lease.
 	// (Alpha) Using this field requires the CoordinatedLeaderElection feature gate to be enabled.
 	Strategy *coordinationv1.CoordinatedLeaseStrategy `json:"strategy,omitempty"`
-	// PreferredHolder signals to a lease holder that the lease has a
+	// preferredHolder signals to a lease holder that the lease has a
 	// more optimal holder and should be given up.
 	// This field can only be set if Strategy is also set.
 	PreferredHolder *string `json:"preferredHolder,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1alpha2/leasecandidate.go b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1alpha2/leasecandidate.go
index 73150cb43a..25a2a000d4 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1alpha2/leasecandidate.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1alpha2/leasecandidate.go
@@ -33,7 +33,8 @@ import (
 // LeaseCandidate defines a candidate for a Lease object.
 // Candidates are created such that coordinated leader election will pick the best leader from the list of candidates.
 type LeaseCandidateApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec contains the specification of the Lease.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1alpha2/leasecandidatespec.go b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1alpha2/leasecandidatespec.go
index 44a2db06ff..e6ab4897dd 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1alpha2/leasecandidatespec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1alpha2/leasecandidatespec.go
@@ -28,15 +28,15 @@ import (
 //
 // LeaseCandidateSpec is a specification of a Lease.
 type LeaseCandidateSpecApplyConfiguration struct {
-	// LeaseName is the name of the lease for which this candidate is contending.
+	// leaseName is the name of the lease for which this candidate is contending.
 	// This field is immutable.
 	LeaseName *string `json:"leaseName,omitempty"`
-	// PingTime is the last time that the server has requested the LeaseCandidate
+	// pingTime is the last time that the server has requested the LeaseCandidate
 	// to renew. It is only done during leader election to check if any
 	// LeaseCandidates have become ineligible. When PingTime is updated, the
 	// LeaseCandidate will respond by updating RenewTime.
 	PingTime *v1.MicroTime `json:"pingTime,omitempty"`
-	// RenewTime is the time that the LeaseCandidate was last updated.
+	// renewTime is the time that the LeaseCandidate was last updated.
 	// Any time a Lease needs to do leader election, the PingTime field
 	// is updated to signal to the LeaseCandidate that they should update
 	// the RenewTime.
@@ -44,14 +44,14 @@ type LeaseCandidateSpecApplyConfiguration struct {
 	// since the last renew. The PingTime field is updated regularly to prevent
 	// garbage collection for still active LeaseCandidates.
 	RenewTime *v1.MicroTime `json:"renewTime,omitempty"`
-	// BinaryVersion is the binary version. It must be in a semver format without leading `v`.
+	// binaryVersion is the binary version. It must be in a semver format without leading `v`.
 	// This field is required.
 	BinaryVersion *string `json:"binaryVersion,omitempty"`
-	// EmulationVersion is the emulation version. It must be in a semver format without leading `v`.
+	// emulationVersion is the emulation version. It must be in a semver format without leading `v`.
 	// EmulationVersion must be less than or equal to BinaryVersion.
 	// This field is required when strategy is "OldestEmulationVersion"
 	EmulationVersion *string `json:"emulationVersion,omitempty"`
-	// Strategy is the strategy that coordinated leader election will use for picking the leader.
+	// strategy is the strategy that coordinated leader election will use for picking the leader.
 	// If multiple candidates for the same Lease return different strategies, the strategy provided
 	// by the candidate with the latest BinaryVersion will be used. If there is still conflict,
 	// this is a user error and coordinated leader election will not operate the Lease until resolved.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/lease.go b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/lease.go
index 38263059a8..dccfdca8a4 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/lease.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/lease.go
@@ -32,7 +32,8 @@ import (
 //
 // Lease defines a lease concept.
 type LeaseApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec contains the specification of the Lease.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/leasecandidate.go b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/leasecandidate.go
index 4670d9d2b9..bfd45d103f 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/leasecandidate.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/leasecandidate.go
@@ -33,7 +33,8 @@ import (
 // LeaseCandidate defines a candidate for a Lease object.
 // Candidates are created such that coordinated leader election will pick the best leader from the list of candidates.
 type LeaseCandidateApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec contains the specification of the Lease.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/leasecandidatespec.go b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/leasecandidatespec.go
index 6b146dc494..3aed4ccc21 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/leasecandidatespec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/leasecandidatespec.go
@@ -28,17 +28,17 @@ import (
 //
 // LeaseCandidateSpec is a specification of a Lease.
 type LeaseCandidateSpecApplyConfiguration struct {
-	// LeaseName is the name of the lease for which this candidate is contending.
+	// leaseName is the name of the lease for which this candidate is contending.
 	// The limits on this field are the same as on Lease.name. Multiple lease candidates
 	// may reference the same Lease.name.
 	// This field is immutable.
 	LeaseName *string `json:"leaseName,omitempty"`
-	// PingTime is the last time that the server has requested the LeaseCandidate
+	// pingTime is the last time that the server has requested the LeaseCandidate
 	// to renew. It is only done during leader election to check if any
 	// LeaseCandidates have become ineligible. When PingTime is updated, the
 	// LeaseCandidate will respond by updating RenewTime.
 	PingTime *v1.MicroTime `json:"pingTime,omitempty"`
-	// RenewTime is the time that the LeaseCandidate was last updated.
+	// renewTime is the time that the LeaseCandidate was last updated.
 	// Any time a Lease needs to do leader election, the PingTime field
 	// is updated to signal to the LeaseCandidate that they should update
 	// the RenewTime.
@@ -46,14 +46,14 @@ type LeaseCandidateSpecApplyConfiguration struct {
 	// since the last renew. The PingTime field is updated regularly to prevent
 	// garbage collection for still active LeaseCandidates.
 	RenewTime *v1.MicroTime `json:"renewTime,omitempty"`
-	// BinaryVersion is the binary version. It must be in a semver format without leading `v`.
+	// binaryVersion is the binary version. It must be in a semver format without leading `v`.
 	// This field is required.
 	BinaryVersion *string `json:"binaryVersion,omitempty"`
-	// EmulationVersion is the emulation version. It must be in a semver format without leading `v`.
+	// emulationVersion is the emulation version. It must be in a semver format without leading `v`.
 	// EmulationVersion must be less than or equal to BinaryVersion.
 	// This field is required when strategy is "OldestEmulationVersion"
 	EmulationVersion *string `json:"emulationVersion,omitempty"`
-	// Strategy is the strategy that coordinated leader election will use for picking the leader.
+	// strategy is the strategy that coordinated leader election will use for picking the leader.
 	// If multiple candidates for the same Lease return different strategies, the strategy provided
 	// by the candidate with the latest BinaryVersion will be used. If there is still conflict,
 	// this is a user error and coordinated leader election will not operate the Lease until resolved.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/leasespec.go b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/leasespec.go
index db40b83592..ec4ee1190f 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/leasespec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/coordination/v1beta1/leasespec.go
@@ -44,10 +44,10 @@ type LeaseSpecApplyConfiguration struct {
 	// leaseTransitions is the number of transitions of a lease between
 	// holders.
 	LeaseTransitions *int32 `json:"leaseTransitions,omitempty"`
-	// Strategy indicates the strategy for picking the leader for coordinated leader election
+	// strategy indicates the strategy for picking the leader for coordinated leader election.
 	// (Alpha) Using this field requires the CoordinatedLeaderElection feature gate to be enabled.
 	Strategy *coordinationv1.CoordinatedLeaseStrategy `json:"strategy,omitempty"`
-	// PreferredHolder signals to a lease holder that the lease has a
+	// preferredHolder signals to a lease holder that the lease has a
 	// more optimal holder and should be given up.
 	PreferredHolder *string `json:"preferredHolder,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/clustertrustbundleprojection.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/clustertrustbundleprojection.go
index 00eec6b377..8964d84f26 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/clustertrustbundleprojection.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/clustertrustbundleprojection.go
@@ -49,6 +49,10 @@ type ClusterTrustBundleProjectionApplyConfiguration struct {
 	Optional *bool `json:"optional,omitempty"`
 	// Relative path from the volume root to write the bundle.
 	Path *string `json:"path,omitempty"`
+	// user is Optional: The owner UID of the created file.
+	// If specified, the item-level user field takes precedence over defaultUser.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	User *int64 `json:"user,omitempty"`
 }
 
 // ClusterTrustBundleProjectionApplyConfiguration constructs a declarative configuration of the ClusterTrustBundleProjection type for use with
@@ -96,3 +100,11 @@ func (b *ClusterTrustBundleProjectionApplyConfiguration) WithPath(value string)
 	b.Path = &value
 	return b
 }
+
+// WithUser sets the User field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the User field is set to the value of the last call.
+func (b *ClusterTrustBundleProjectionApplyConfiguration) WithUser(value int64) *ClusterTrustBundleProjectionApplyConfiguration {
+	b.User = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/componentstatus.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/componentstatus.go
index 5b9b7f32ce..b356d1ee37 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/componentstatus.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/componentstatus.go
@@ -33,7 +33,7 @@ import (
 // ComponentStatus (and ComponentStatusList) holds the cluster validation info.
 // Deprecated: This API is deprecated in v1.19+
 type ComponentStatusApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmap.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmap.go
index d638482048..6a181e3256 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmap.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmap.go
@@ -32,7 +32,7 @@ import (
 //
 // ConfigMap holds configuration data for pods to consume.
 type ConfigMapApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
@@ -54,6 +54,8 @@ type ConfigMapApplyConfiguration struct {
 	// the Data field, this is enforced during validation process.
 	// Using this field will require 1.10+ apiserver and
 	// kubelet.
+	// Note: BinaryData keys are not currently propagated to container env vars
+	// via ConfigMapKeyRef or ConfigMapRef env sources; only Data keys are used.
 	BinaryData map[string][]byte `json:"binaryData,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapenvsource.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapenvsource.go
index c2c067b2c4..b50b3f11de 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapenvsource.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapenvsource.go
@@ -26,9 +26,10 @@ package v1
 //
 // The contents of the target ConfigMap's Data field will represent the
 // key-value pairs as environment variables.
+// Keys in the BinaryData field are not currently propagated to container env vars.
 type ConfigMapEnvSourceApplyConfiguration struct {
 	// The ConfigMap to select from.
-	LocalObjectReferenceApplyConfiguration `json:",inline"`
+	LocalObjectReferenceApplyConfiguration `json:""`
 	// Specify whether the ConfigMap must be defined
 	Optional *bool `json:"optional,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapkeyselector.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapkeyselector.go
index 415edded52..384db766aa 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapkeyselector.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapkeyselector.go
@@ -24,8 +24,9 @@ package v1
 // Selects a key from a ConfigMap.
 type ConfigMapKeySelectorApplyConfiguration struct {
 	// The ConfigMap to select from.
-	LocalObjectReferenceApplyConfiguration `json:",inline"`
-	// The key to select.
+	LocalObjectReferenceApplyConfiguration `json:""`
+	// The key to select from the ConfigMap's Data field.
+	// Keys in the BinaryData field are not currently propagated to container env vars.
 	Key *string `json:"key,omitempty"`
 	// Specify whether the ConfigMap or its key must be defined
 	Optional *bool `json:"optional,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapprojection.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapprojection.go
index 0357ca9983..9af0ca301f 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapprojection.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapprojection.go
@@ -29,7 +29,7 @@ package v1
 // Note that this is identical to a configmap volume source without the default
 // mode.
 type ConfigMapProjectionApplyConfiguration struct {
-	LocalObjectReferenceApplyConfiguration `json:",inline"`
+	LocalObjectReferenceApplyConfiguration `json:""`
 	// items if unspecified, each key-value pair in the Data field of the referenced
 	// ConfigMap will be projected into the volume as a file whose name is the
 	// key and content is the value. If specified, the listed keys will be
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapvolumesource.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapvolumesource.go
index b8a6a333f6..158857b8b2 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapvolumesource.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/configmapvolumesource.go
@@ -28,7 +28,7 @@ package v1
 // the items element is populated with specific mappings of keys to paths.
 // ConfigMap volumes support ownership management and SELinux relabeling.
 type ConfigMapVolumeSourceApplyConfiguration struct {
-	LocalObjectReferenceApplyConfiguration `json:",inline"`
+	LocalObjectReferenceApplyConfiguration `json:""`
 	// items if unspecified, each key-value pair in the Data field of the referenced
 	// ConfigMap will be projected into the volume as a file whose name is the
 	// key and content is the value. If specified, the listed keys will be
@@ -47,6 +47,10 @@ type ConfigMapVolumeSourceApplyConfiguration struct {
 	DefaultMode *int32 `json:"defaultMode,omitempty"`
 	// optional specify whether the ConfigMap or its keys must be defined
 	Optional *bool `json:"optional,omitempty"`
+	// defaultUser is Optional: The owner UID of the created files by default.
+	// The defaultUser field is only used as a fallback when the item-level user field is unset.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	DefaultUser *int64 `json:"defaultUser,omitempty"`
 }
 
 // ConfigMapVolumeSourceApplyConfiguration constructs a declarative configuration of the ConfigMapVolumeSource type for use with
@@ -91,3 +95,11 @@ func (b *ConfigMapVolumeSourceApplyConfiguration) WithOptional(value bool) *Conf
 	b.Optional = &value
 	return b
 }
+
+// WithDefaultUser sets the DefaultUser field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DefaultUser field is set to the value of the last call.
+func (b *ConfigMapVolumeSourceApplyConfiguration) WithDefaultUser(value int64) *ConfigMapVolumeSourceApplyConfiguration {
+	b.DefaultUser = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/downwardapivolumefile.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/downwardapivolumefile.go
index 9028f3133c..99eb736fa1 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/downwardapivolumefile.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/downwardapivolumefile.go
@@ -37,6 +37,10 @@ type DownwardAPIVolumeFileApplyConfiguration struct {
 	// This might be in conflict with other options that affect the file
 	// mode, like fsGroup, and the result can be other mode bits set.
 	Mode *int32 `json:"mode,omitempty"`
+	// user is Optional: The owner UID of the created file.
+	// If specified, the item-level user field takes precedence over defaultUser.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	User *int64 `json:"user,omitempty"`
 }
 
 // DownwardAPIVolumeFileApplyConfiguration constructs a declarative configuration of the DownwardAPIVolumeFile type for use with
@@ -76,3 +80,11 @@ func (b *DownwardAPIVolumeFileApplyConfiguration) WithMode(value int32) *Downwar
 	b.Mode = &value
 	return b
 }
+
+// WithUser sets the User field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the User field is set to the value of the last call.
+func (b *DownwardAPIVolumeFileApplyConfiguration) WithUser(value int64) *DownwardAPIVolumeFileApplyConfiguration {
+	b.User = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/downwardapivolumesource.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/downwardapivolumesource.go
index 42e726689d..308b05780b 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/downwardapivolumesource.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/downwardapivolumesource.go
@@ -35,6 +35,10 @@ type DownwardAPIVolumeSourceApplyConfiguration struct {
 	// This might be in conflict with other options that affect the file
 	// mode, like fsGroup, and the result can be other mode bits set.
 	DefaultMode *int32 `json:"defaultMode,omitempty"`
+	// defaultUser is Optional: The owner UID of the created files by default.
+	// The defaultUser field is only used as a fallback when the item-level user field is unset.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	DefaultUser *int64 `json:"defaultUser,omitempty"`
 }
 
 // DownwardAPIVolumeSourceApplyConfiguration constructs a declarative configuration of the DownwardAPIVolumeSource type for use with
@@ -63,3 +67,11 @@ func (b *DownwardAPIVolumeSourceApplyConfiguration) WithDefaultMode(value int32)
 	b.DefaultMode = &value
 	return b
 }
+
+// WithDefaultUser sets the DefaultUser field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DefaultUser field is set to the value of the last call.
+func (b *DownwardAPIVolumeSourceApplyConfiguration) WithDefaultUser(value int64) *DownwardAPIVolumeSourceApplyConfiguration {
+	b.DefaultUser = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/emptydirvolumesource.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/emptydirvolumesource.go
index 97f71e8d21..b79a874d65 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/emptydirvolumesource.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/emptydirvolumesource.go
@@ -41,6 +41,15 @@ type EmptyDirVolumeSourceApplyConfiguration struct {
 	// The default is nil which means that the limit is undefined.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
 	SizeLimit *resource.Quantity `json:"sizeLimit,omitempty"`
+	// mode specifies the permission bits for the emptyDir directory, in numeric
+	// notation (e.g., 0755, 01777). Must be a value between 0000 and 01777.
+	// If not specified, defaults to 0777.
+	// This might be in conflict with other options that affect the file
+	// mode, like fsGroup. If fsGroup is specified, the fsGroup permissions
+	// will override the mode specified here.
+	// This field has no effect on Windows.
+	// This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled.
+	Mode *int32 `json:"mode,omitempty"`
 }
 
 // EmptyDirVolumeSourceApplyConfiguration constructs a declarative configuration of the EmptyDirVolumeSource type for use with
@@ -64,3 +73,11 @@ func (b *EmptyDirVolumeSourceApplyConfiguration) WithSizeLimit(value resource.Qu
 	b.SizeLimit = &value
 	return b
 }
+
+// WithMode sets the Mode field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Mode field is set to the value of the last call.
+func (b *EmptyDirVolumeSourceApplyConfiguration) WithMode(value int32) *EmptyDirVolumeSourceApplyConfiguration {
+	b.Mode = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/endpoints.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/endpoints.go
index a13cd30e89..45861f369e 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/endpoints.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/endpoints.go
@@ -49,7 +49,7 @@ import (
 //
 // Deprecated: This API is deprecated in v1.33+. Use discoveryv1.EndpointSlice.
 type EndpointsApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/ephemeralcontainer.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/ephemeralcontainer.go
index 43d97a6eff..3b3d1698c4 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/ephemeralcontainer.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/ephemeralcontainer.go
@@ -38,7 +38,7 @@ type EphemeralContainerApplyConfiguration struct {
 	// specific to ephemeral containers. Fields in common with Container are in the
 	// following inlined struct so than an EphemeralContainer may easily be converted
 	// to a Container.
-	EphemeralContainerCommonApplyConfiguration `json:",inline"`
+	EphemeralContainerCommonApplyConfiguration `json:""`
 	// If set, the name of the container from PodSpec that this ephemeral container targets.
 	// The ephemeral container will be run in the namespaces (IPC, PID, etc) of this container.
 	// If not set then the ephemeral container uses the namespaces configured in the Pod spec.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/event.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/event.go
index 676a719b2f..80f48d4eef 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/event.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/event.go
@@ -37,7 +37,7 @@ import (
 // continued existence of events with that Reason.  Events should be
 // treated as informative, best-effort, supplemental data.
 type EventApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/evictionresponder.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/evictionresponder.go
new file mode 100644
index 0000000000..9decf94dd1
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/evictionresponder.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// EvictionResponderApplyConfiguration represents a declarative configuration of the EvictionResponder type for use
+// with apply.
+//
+// EvictionResponder allows you to specify the responder reacting to an Eviction.
+// Responders should observe and communicate through the Eviction Resource API to help with
+// the graceful eviction of a target (e.g. termination of a pod).
+type EvictionResponderApplyConfiguration struct {
+	// name allows you to identify the responder responding to the Eviction.
+	//
+	// It must be a valid domain-prefixed key (such as "acme.io/foo").
+	// Domain names *.k8s.io and *.kubernetes.io are reserved.
+	// This field must be unique for each responder.
+	// This field is required.
+	Name *string `json:"name,omitempty"`
+	// priority for this responder. Higher priorities are selected first by the evictionrequest-controller.
+	// If there are responders with the same priority, the responder whose domain name comes first in the
+	// alphabetical higher domain order, will be picked. This means that the top domain labels are compared
+	// alphabetically first, followed by the lower domain labels. The key is compared last.
+	//
+	// The responder that is the managing controller of the pod should set the value of
+	// this field to 10000 to allow both for preemption or fallback registration by other
+	// responders.
+	//
+	// The minimum value is 0 and the maximum value is 100000.
+	// The interval 0-999 is reserved for responders with *.k8s.io suffix.
+	// This field is required.
+	Priority *int32 `json:"priority,omitempty"`
+}
+
+// EvictionResponderApplyConfiguration constructs a declarative configuration of the EvictionResponder type for use with
+// apply.
+func EvictionResponder() *EvictionResponderApplyConfiguration {
+	return &EvictionResponderApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *EvictionResponderApplyConfiguration) WithName(value string) *EvictionResponderApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithPriority sets the Priority field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Priority field is set to the value of the last call.
+func (b *EvictionResponderApplyConfiguration) WithPriority(value int32) *EvictionResponderApplyConfiguration {
+	b.Priority = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/grpcaction.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/grpcaction.go
index 40f5f9ecfd..05534f6bc8 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/grpcaction.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/grpcaction.go
@@ -18,6 +18,10 @@ limitations under the License.
 
 package v1
 
+import (
+	corev1 "k8s.io/api/core/v1"
+)
+
 // GRPCActionApplyConfiguration represents a declarative configuration of the GRPCAction type for use
 // with apply.
 //
@@ -30,6 +34,11 @@ type GRPCActionApplyConfiguration struct {
 	//
 	// If this is not specified, the default behavior is defined by gRPC.
 	Service *string `json:"service,omitempty"`
+	// mode specifies the connection mode for the gRPC health probe.
+	// Set to "TLS" to use TLS without certificate verification.
+	// Set to "Plaintext" to use a plaintext (insecure) connection explicitly.
+	// If not specified, the probe uses a plaintext (insecure) connection.
+	Mode *corev1.GRPCProbeMode `json:"mode,omitempty"`
 }
 
 // GRPCActionApplyConfiguration constructs a declarative configuration of the GRPCAction type for use with
@@ -53,3 +62,11 @@ func (b *GRPCActionApplyConfiguration) WithService(value string) *GRPCActionAppl
 	b.Service = &value
 	return b
 }
+
+// WithMode sets the Mode field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Mode field is set to the value of the last call.
+func (b *GRPCActionApplyConfiguration) WithMode(value corev1.GRPCProbeMode) *GRPCActionApplyConfiguration {
+	b.Mode = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/httpgetaction.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/httpgetaction.go
index 3f892c752d..ec4ac6ee61 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/httpgetaction.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/httpgetaction.go
@@ -42,6 +42,9 @@ type HTTPGetActionApplyConfiguration struct {
 	Scheme *corev1.URIScheme `json:"scheme,omitempty"`
 	// Custom headers to set in the request. HTTP allows repeated headers.
 	HTTPHeaders []HTTPHeaderApplyConfiguration `json:"httpHeaders,omitempty"`
+	// Protocol selects the wire protocol for the probe connection.
+	// Nil defaults to HTTP/1.1.
+	Protocol *corev1.HTTPProtocol `json:"protocol,omitempty"`
 }
 
 // HTTPGetActionApplyConfiguration constructs a declarative configuration of the HTTPGetAction type for use with
@@ -94,3 +97,11 @@ func (b *HTTPGetActionApplyConfiguration) WithHTTPHeaders(values ...*HTTPHeaderA
 	}
 	return b
 }
+
+// WithProtocol sets the Protocol field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Protocol field is set to the value of the last call.
+func (b *HTTPGetActionApplyConfiguration) WithProtocol(value corev1.HTTPProtocol) *HTTPGetActionApplyConfiguration {
+	b.Protocol = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/keytopath.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/keytopath.go
index 75ce1130a6..317554c74e 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/keytopath.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/keytopath.go
@@ -37,6 +37,10 @@ type KeyToPathApplyConfiguration struct {
 	// This might be in conflict with other options that affect the file
 	// mode, like fsGroup, and the result can be other mode bits set.
 	Mode *int32 `json:"mode,omitempty"`
+	// user is Optional: The owner UID of the created file.
+	// If specified, the item-level user field takes precedence over defaultUser.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	User *int64 `json:"user,omitempty"`
 }
 
 // KeyToPathApplyConfiguration constructs a declarative configuration of the KeyToPath type for use with
@@ -68,3 +72,11 @@ func (b *KeyToPathApplyConfiguration) WithMode(value int32) *KeyToPathApplyConfi
 	b.Mode = &value
 	return b
 }
+
+// WithUser sets the User field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the User field is set to the value of the last call.
+func (b *KeyToPathApplyConfiguration) WithUser(value int64) *KeyToPathApplyConfiguration {
+	b.User = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/limitrange.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/limitrange.go
index 84a9fca312..e4da20c659 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/limitrange.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/limitrange.go
@@ -32,7 +32,7 @@ import (
 //
 // LimitRange sets resource usage limits for each kind of resource in a Namespace.
 type LimitRangeApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/namespace.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/namespace.go
index a5bf0f9468..ab5c1b00d1 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/namespace.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/namespace.go
@@ -33,7 +33,7 @@ import (
 // Namespace provides a scope for Names.
 // Use of multiple namespaces is optional.
 type NamespaceApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/node.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/node.go
index ff45b89945..511f02053d 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/node.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/node.go
@@ -33,7 +33,7 @@ import (
 // Node is a worker node in Kubernetes.
 // Each node will have a unique identifier in the cache (i.e. in etcd).
 type NodeApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodeallocatablemappedresources.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodeallocatablemappedresources.go
new file mode 100644
index 0000000000..aab1093bdb
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodeallocatablemappedresources.go
@@ -0,0 +1,59 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	resource "k8s.io/apimachinery/pkg/api/resource"
+)
+
+// NodeAllocatableMappedResourcesApplyConfiguration represents a declarative configuration of the NodeAllocatableMappedResources type for use
+// with apply.
+//
+// NodeAllocatableMappedResources describes mapped node allocatable resource allocations.
+type NodeAllocatableMappedResourcesApplyConfiguration struct {
+	// Name is the name of the resource (e.g., cpu, memory).
+	Name *corev1.ResourceName `json:"name,omitempty"`
+	// Quantity is the total node allocatable resource capacity allocated for the claim.
+	// This claim's allocated devices is shared by all the containers referencing the claim.
+	// Kubelet adds this value to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.
+	Quantity *resource.Quantity `json:"quantity,omitempty"`
+}
+
+// NodeAllocatableMappedResourcesApplyConfiguration constructs a declarative configuration of the NodeAllocatableMappedResources type for use with
+// apply.
+func NodeAllocatableMappedResources() *NodeAllocatableMappedResourcesApplyConfiguration {
+	return &NodeAllocatableMappedResourcesApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *NodeAllocatableMappedResourcesApplyConfiguration) WithName(value corev1.ResourceName) *NodeAllocatableMappedResourcesApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithQuantity sets the Quantity field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Quantity field is set to the value of the last call.
+func (b *NodeAllocatableMappedResourcesApplyConfiguration) WithQuantity(value resource.Quantity) *NodeAllocatableMappedResourcesApplyConfiguration {
+	b.Quantity = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodeallocatableoverheadresources.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodeallocatableoverheadresources.go
new file mode 100644
index 0000000000..fa7ca9442a
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodeallocatableoverheadresources.go
@@ -0,0 +1,77 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	resource "k8s.io/apimachinery/pkg/api/resource"
+)
+
+// NodeAllocatableOverheadResourcesApplyConfiguration represents a declarative configuration of the NodeAllocatableOverheadResources type for use
+// with apply.
+//
+// NodeAllocatableOverheadResources describes auxiliary overhead resource allocations.
+type NodeAllocatableOverheadResourcesApplyConfiguration struct {
+	// Name is the name of the resource (e.g., cpu, memory).
+	Name *corev1.ResourceName `json:"name,omitempty"`
+	// PerPod is the flat overhead quantity allocated per pod.
+	// Adding to each container limit allows individual containers to utilize the overhead, while the parent pod-level cgroup limit caps the total usage at the pod boundary where the overhead is accounted for exactly once.
+	// At least one of PerPod or PerContainer must be specified. Specifying neither is an invalid configuration.
+	PerPod *resource.Quantity `json:"perPod,omitempty"`
+	// PerContainer is the variable overhead quantity applied for each container referencing the claim.
+	// The container references are recorded in `nodeAllocatableResourceClaimStatuses.containers`.
+	// The total overhead quantity allocated for the claim is computed as:
+	// Quantity = PerPod + (PerContainer * NumReferences)
+	// Kubelet accounts for this overhead in cgroups:
+	// - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences).
+	// - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container.
+	// This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once.
+	// At least one of PerPod or PerContainer must be specified. Specifying neither is an invalid configuration.
+	PerContainer *resource.Quantity `json:"perContainer,omitempty"`
+}
+
+// NodeAllocatableOverheadResourcesApplyConfiguration constructs a declarative configuration of the NodeAllocatableOverheadResources type for use with
+// apply.
+func NodeAllocatableOverheadResources() *NodeAllocatableOverheadResourcesApplyConfiguration {
+	return &NodeAllocatableOverheadResourcesApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *NodeAllocatableOverheadResourcesApplyConfiguration) WithName(value corev1.ResourceName) *NodeAllocatableOverheadResourcesApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithPerPod sets the PerPod field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PerPod field is set to the value of the last call.
+func (b *NodeAllocatableOverheadResourcesApplyConfiguration) WithPerPod(value resource.Quantity) *NodeAllocatableOverheadResourcesApplyConfiguration {
+	b.PerPod = &value
+	return b
+}
+
+// WithPerContainer sets the PerContainer field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PerContainer field is set to the value of the last call.
+func (b *NodeAllocatableOverheadResourcesApplyConfiguration) WithPerContainer(value resource.Quantity) *NodeAllocatableOverheadResourcesApplyConfiguration {
+	b.PerContainer = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodeallocatableresourceclaimstatus.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodeallocatableresourceclaimstatus.go
index 6e384b0028..9c67c7f9b4 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodeallocatableresourceclaimstatus.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodeallocatableresourceclaimstatus.go
@@ -18,11 +18,6 @@ limitations under the License.
 
 package v1
 
-import (
-	corev1 "k8s.io/api/core/v1"
-	resource "k8s.io/apimachinery/pkg/api/resource"
-)
-
 // NodeAllocatableResourceClaimStatusApplyConfiguration represents a declarative configuration of the NodeAllocatableResourceClaimStatus type for use
 // with apply.
 //
@@ -32,8 +27,12 @@ type NodeAllocatableResourceClaimStatusApplyConfiguration struct {
 	ResourceClaimName *string `json:"resourceClaimName,omitempty"`
 	// Containers lists the names of all containers in this pod that reference the claim.
 	Containers []string `json:"containers,omitempty"`
-	// Resources is a map of the node-allocatable resource name to the aggregate quantity allocated to the claim.
-	Resources map[corev1.ResourceName]resource.Quantity `json:"resources,omitempty"`
+	// Mapping contains allocations through devices mapped in the device spec's `nodeAllocatableResources[...].mapping` field.
+	// This is used by kubelet for pod level and container-level cgroup enforcement.
+	Mapping []NodeAllocatableMappedResourcesApplyConfiguration `json:"mapping,omitempty"`
+	// Overhead contains allocations through devices mapped in the device spec's `nodeAllocatableResources[...].overhead` field.
+	// This is used by kubelet for pod level and container-level cgroup enforcement.
+	Overhead []NodeAllocatableOverheadResourcesApplyConfiguration `json:"overhead,omitempty"`
 }
 
 // NodeAllocatableResourceClaimStatusApplyConfiguration constructs a declarative configuration of the NodeAllocatableResourceClaimStatus type for use with
@@ -60,16 +59,28 @@ func (b *NodeAllocatableResourceClaimStatusApplyConfiguration) WithContainers(va
 	return b
 }
 
-// WithResources puts the entries into the Resources field in the declarative configuration
+// WithMapping adds the given value to the Mapping field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
-// If called multiple times, the entries provided by each call will be put on the Resources field,
-// overwriting an existing map entries in Resources field with the same key.
-func (b *NodeAllocatableResourceClaimStatusApplyConfiguration) WithResources(entries map[corev1.ResourceName]resource.Quantity) *NodeAllocatableResourceClaimStatusApplyConfiguration {
-	if b.Resources == nil && len(entries) > 0 {
-		b.Resources = make(map[corev1.ResourceName]resource.Quantity, len(entries))
+// If called multiple times, values provided by each call will be appended to the Mapping field.
+func (b *NodeAllocatableResourceClaimStatusApplyConfiguration) WithMapping(values ...*NodeAllocatableMappedResourcesApplyConfiguration) *NodeAllocatableResourceClaimStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithMapping")
+		}
+		b.Mapping = append(b.Mapping, *values[i])
 	}
-	for k, v := range entries {
-		b.Resources[k] = v
+	return b
+}
+
+// WithOverhead adds the given value to the Overhead field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Overhead field.
+func (b *NodeAllocatableResourceClaimStatusApplyConfiguration) WithOverhead(values ...*NodeAllocatableOverheadResourcesApplyConfiguration) *NodeAllocatableResourceClaimStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOverhead")
+		}
+		b.Overhead = append(b.Overhead, *values[i])
 	}
 	return b
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodepodpreemptionpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodepodpreemptionpolicy.go
new file mode 100644
index 0000000000..62c0a00aec
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodepodpreemptionpolicy.go
@@ -0,0 +1,47 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// NodePodPreemptionPolicyApplyConfiguration represents a declarative configuration of the NodePodPreemptionPolicy type for use
+// with apply.
+//
+// NodePodPreemptionPolicy defines the node-level policies governing preemption for pods on this node.
+type NodePodPreemptionPolicyApplyConfiguration struct {
+	// DisableResizePreemption lists the owners (e.g., autoscalers, operators, administrators)
+	// that have requested to disable scheduler and Kubelet preemption for in-place pod resize on this node.
+	// If this list is non-empty, resize-induced preemption is disabled on this node.
+	// This is an alpha field and requires enabling the InPlacePodVerticalScalingSchedulerPreemption feature gate.
+	DisableResizePreemption []string `json:"disableResizePreemption,omitempty"`
+}
+
+// NodePodPreemptionPolicyApplyConfiguration constructs a declarative configuration of the NodePodPreemptionPolicy type for use with
+// apply.
+func NodePodPreemptionPolicy() *NodePodPreemptionPolicyApplyConfiguration {
+	return &NodePodPreemptionPolicyApplyConfiguration{}
+}
+
+// WithDisableResizePreemption adds the given value to the DisableResizePreemption field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the DisableResizePreemption field.
+func (b *NodePodPreemptionPolicyApplyConfiguration) WithDisableResizePreemption(values ...string) *NodePodPreemptionPolicyApplyConfiguration {
+	for i := range values {
+		b.DisableResizePreemption = append(b.DisableResizePreemption, values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodespec.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodespec.go
index b53ed21d79..2839ed7679 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodespec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodespec.go
@@ -41,6 +41,9 @@ type NodeSpecApplyConfiguration struct {
 	// Deprecated. Not all kubelets will set this field. Remove field after 1.13.
 	// see: https://issues.k8s.io/61966
 	DoNotUseExternalID *string `json:"externalID,omitempty"`
+	// PodPreemptionPolicy controls the node-level preemption behaviors for pods on this node.
+	// This is an alpha field and requires enabling the InPlacePodVerticalScalingSchedulerPreemption feature gate.
+	PodPreemptionPolicy *NodePodPreemptionPolicyApplyConfiguration `json:"podPreemptionPolicy,omitempty"`
 }
 
 // NodeSpecApplyConfiguration constructs a declarative configuration of the NodeSpec type for use with
@@ -111,3 +114,11 @@ func (b *NodeSpecApplyConfiguration) WithDoNotUseExternalID(value string) *NodeS
 	b.DoNotUseExternalID = &value
 	return b
 }
+
+// WithPodPreemptionPolicy sets the PodPreemptionPolicy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PodPreemptionPolicy field is set to the value of the last call.
+func (b *NodeSpecApplyConfiguration) WithPodPreemptionPolicy(value *NodePodPreemptionPolicyApplyConfiguration) *NodeSpecApplyConfiguration {
+	b.PodPreemptionPolicy = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodesysteminfo.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodesysteminfo.go
index 70b8a7819d..14a4680b2a 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodesysteminfo.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/nodesysteminfo.go
@@ -49,6 +49,8 @@ type NodeSystemInfoApplyConfiguration struct {
 	Architecture *string `json:"architecture,omitempty"`
 	// Swap Info reported by the node.
 	Swap *NodeSwapStatusApplyConfiguration `json:"swap,omitempty"`
+	// Whether the node is running in a user namespace.
+	RunningInUserNamespace *bool `json:"runningInUserNamespace,omitempty"`
 }
 
 // NodeSystemInfoApplyConfiguration constructs a declarative configuration of the NodeSystemInfo type for use with
@@ -144,3 +146,11 @@ func (b *NodeSystemInfoApplyConfiguration) WithSwap(value *NodeSwapStatusApplyCo
 	b.Swap = value
 	return b
 }
+
+// WithRunningInUserNamespace sets the RunningInUserNamespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the RunningInUserNamespace field is set to the value of the last call.
+func (b *NodeSystemInfoApplyConfiguration) WithRunningInUserNamespace(value bool) *NodeSystemInfoApplyConfiguration {
+	b.RunningInUserNamespace = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolume.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolume.go
index 4ef8ed4b5f..34da80ab9f 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolume.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolume.go
@@ -34,7 +34,7 @@ import (
 // It is analogous to a node.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes
 type PersistentVolumeApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumeclaim.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumeclaim.go
index d77417f359..1f86f61f7b 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumeclaim.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumeclaim.go
@@ -32,7 +32,7 @@ import (
 //
 // PersistentVolumeClaim is a user's request for and claim to a persistent volume
 type PersistentVolumeClaimApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumeclaimspec.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumeclaimspec.go
index 8710769b77..1761f7bf30 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumeclaimspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumeclaimspec.go
@@ -53,8 +53,8 @@ type PersistentVolumeClaimSpecApplyConfiguration struct {
 	// * An existing PVC (PersistentVolumeClaim)
 	// If the provisioner or an external controller can support the specified data source,
 	// it will create a new volume based on the contents of the specified data source.
-	// When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-	// and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
+	// dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be
+	// copied to dataSource when dataSourceRef.namespace is not specified.
 	// If the namespace is specified, then dataSourceRef will not be copied to dataSource.
 	DataSource *TypedLocalObjectReferenceApplyConfiguration `json:"dataSource,omitempty"`
 	// dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
@@ -78,7 +78,6 @@ type PersistentVolumeClaimSpecApplyConfiguration struct {
 	// specified.
 	// * While dataSource only allows local objects, dataSourceRef allows objects
 	// in any namespaces.
-	// (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
 	// (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
 	DataSourceRef *TypedObjectReferenceApplyConfiguration `json:"dataSourceRef,omitempty"`
 	// volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumeclaimstatus.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumeclaimstatus.go
index ee2d5adbd3..c910005eb4 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumeclaimstatus.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumeclaimstatus.go
@@ -98,6 +98,9 @@ type PersistentVolumeClaimStatusApplyConfiguration struct {
 	// ModifyVolumeStatus represents the status object of ControllerModifyVolume operation.
 	// When this is unset, there is no ModifyVolume operation being attempted.
 	ModifyVolumeStatus *ModifyVolumeStatusApplyConfiguration `json:"modifyVolumeStatus,omitempty"`
+	// healthStatus contains the latest controller-reported health information
+	// for the volume bound to this claim.
+	HealthStatus *VolumeHealthStatusApplyConfiguration `json:"healthStatus,omitempty"`
 }
 
 // PersistentVolumeClaimStatusApplyConfiguration constructs a declarative configuration of the PersistentVolumeClaimStatus type for use with
@@ -182,3 +185,11 @@ func (b *PersistentVolumeClaimStatusApplyConfiguration) WithModifyVolumeStatus(v
 	b.ModifyVolumeStatus = value
 	return b
 }
+
+// WithHealthStatus sets the HealthStatus field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the HealthStatus field is set to the value of the last call.
+func (b *PersistentVolumeClaimStatusApplyConfiguration) WithHealthStatus(value *VolumeHealthStatusApplyConfiguration) *PersistentVolumeClaimStatusApplyConfiguration {
+	b.HealthStatus = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumespec.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumespec.go
index 8c16610222..72fb8f540c 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumespec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/persistentvolumespec.go
@@ -31,7 +31,7 @@ type PersistentVolumeSpecApplyConfiguration struct {
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#capacity
 	Capacity *corev1.ResourceList `json:"capacity,omitempty"`
 	// persistentVolumeSource is the actual volume backing the persistent volume.
-	PersistentVolumeSourceApplyConfiguration `json:",inline"`
+	PersistentVolumeSourceApplyConfiguration `json:""`
 	// accessModes contains all ways the volume can be mounted.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes
 	AccessModes []corev1.PersistentVolumeAccessMode `json:"accessModes,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/pod.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/pod.go
index d10d38de19..815c0b4b63 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/pod.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/pod.go
@@ -33,7 +33,7 @@ import (
 // Pod is a collection of containers that can run on a host. This resource is created
 // by clients and scheduled onto hosts.
 type PodApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/podcertificateprojection.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/podcertificateprojection.go
index 0d951a8948..3c10f37e0d 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/podcertificateprojection.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/podcertificateprojection.go
@@ -89,6 +89,10 @@ type PodCertificateProjectionApplyConfiguration struct {
 	// Signers should document the keys and values they support. Signers should
 	// deny requests that contain keys they do not recognize.
 	UserAnnotations map[string]string `json:"userAnnotations,omitempty"`
+	// user is Optional: The owner UID of the created file.
+	// If specified, the item-level user field takes precedence over defaultUser.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	User *int64 `json:"user,omitempty"`
 }
 
 // PodCertificateProjectionApplyConfiguration constructs a declarative configuration of the PodCertificateProjection type for use with
@@ -158,3 +162,11 @@ func (b *PodCertificateProjectionApplyConfiguration) WithUserAnnotations(entries
 	}
 	return b
 }
+
+// WithUser sets the User field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the User field is set to the value of the last call.
+func (b *PodCertificateProjectionApplyConfiguration) WithUser(value int64) *PodCertificateProjectionApplyConfiguration {
+	b.User = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/podsecuritycontext.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/podsecuritycontext.go
index a6f1629ed7..951ced04b4 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/podsecuritycontext.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/podsecuritycontext.go
@@ -121,11 +121,8 @@ type PodSecurityContextApplyConfiguration struct {
 	// Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
 	// whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
 	// CSIDriver instance. Other volumes are always re-labelled recursively.
-	// "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
 	//
-	// If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
-	// If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
-	// and "Recursive" for all other volumes.
+	// If not specified, "MountOption" is used.
 	//
 	// This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
 	//
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/podspec.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/podspec.go
index e67c18c41b..f46481dabc 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/podspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/podspec.go
@@ -172,6 +172,8 @@ type PodSpecApplyConfiguration struct {
 	EnableServiceLinks *bool `json:"enableServiceLinks,omitempty"`
 	// PreemptionPolicy is the Policy for preempting pods with lower priority.
 	// One of Never, PreemptLowerPriority.
+	// When Priority Admission Controller is enabled, it prevents users from setting
+	// this field. The admission controller populates this field from PriorityClassName.
 	// Defaults to PreemptLowerPriority if unset.
 	PreemptionPolicy *corev1.PreemptionPolicy `json:"preemptionPolicy,omitempty"`
 	// Overhead represents the resource overhead associated with running a pod for a given RuntimeClass.
@@ -270,7 +272,6 @@ type PodSpecApplyConfiguration struct {
 	// - `hostNetwork` must be set to false.
 	//
 	// This field must be a valid DNS subdomain as defined in RFC 1123 and contain at most 64 characters.
-	// Requires the HostnameOverride feature gate to be enabled.
 	HostnameOverride *string `json:"hostnameOverride,omitempty"`
 	// SchedulingGroup provides a reference to the immediate scheduling runtime
 	// grouping object that this Pod belongs to.
@@ -285,6 +286,22 @@ type PodSpecApplyConfiguration struct {
 	// recreated with different policies. Doing this during pod scheduling
 	// may result in the placement not conforming to the expected policies.
 	SchedulingGroup *PodSchedulingGroupApplyConfiguration `json:"schedulingGroup,omitempty"`
+	// evictionResponders reference responders that react to Evictions based on EvictionRequests.
+	// Responders should observe and communicate through the Eviction Resource API to help with
+	// the graceful termination of a pod. The responders are selected sequentially, according to
+	// their specified priority.
+	//
+	// Responders should periodically report on an eviction progress by updating the
+	// .status.responders[].heartbeatTime field of the Eviction object. If this field is not updated
+	// within the heartbeat deadline defined by the Eviction API (currently 20 minutes), the eviction
+	// is passed over to the next responder with a lower priority. If there is no other responder,
+	// the last default imperative-eviction.k8s.io/evictor responder with a priority of 100 will
+	// evict the pod using the imperative Eviction API (pods/<name>/eviction subresource).
+	//
+	// The maximum length of the responders list is 10.
+	// Responders are not supported when the pod is part of a PodGroup (.spec.schedulingGroup is set).
+	// This field can only be set on creation and is immutable afterwards.
+	EvictionResponders []EvictionResponderApplyConfiguration `json:"evictionResponders,omitempty"`
 }
 
 // PodSpecApplyConfiguration constructs a declarative configuration of the PodSpec type for use with
@@ -689,3 +706,16 @@ func (b *PodSpecApplyConfiguration) WithSchedulingGroup(value *PodSchedulingGrou
 	b.SchedulingGroup = value
 	return b
 }
+
+// WithEvictionResponders adds the given value to the EvictionResponders field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the EvictionResponders field.
+func (b *PodSpecApplyConfiguration) WithEvictionResponders(values ...*EvictionResponderApplyConfiguration) *PodSpecApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithEvictionResponders")
+		}
+		b.EvictionResponders = append(b.EvictionResponders, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/podstatus.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/podstatus.go
index 8328d9cdb1..1bc37b5071 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/podstatus.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/podstatus.go
@@ -145,6 +145,9 @@ type PodStatusApplyConfiguration struct {
 	// (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources).
 	// Examples include "cpu", "memory", "ephemeral-storage", and hugepages.
 	NodeAllocatableResourceClaimStatuses []NodeAllocatableResourceClaimStatusApplyConfiguration `json:"nodeAllocatableResourceClaimStatuses,omitempty"`
+	// volumeHealth contains node-reported health for each volume the pod is using.
+	// Populated by the kubelet on the pod's node.
+	VolumeHealth []PodVolumeHealthApplyConfiguration `json:"volumeHealth,omitempty"`
 }
 
 // PodStatusApplyConfiguration constructs a declarative configuration of the PodStatus type for use with
@@ -360,3 +363,16 @@ func (b *PodStatusApplyConfiguration) WithNodeAllocatableResourceClaimStatuses(v
 	}
 	return b
 }
+
+// WithVolumeHealth adds the given value to the VolumeHealth field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the VolumeHealth field.
+func (b *PodStatusApplyConfiguration) WithVolumeHealth(values ...*PodVolumeHealthApplyConfiguration) *PodStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithVolumeHealth")
+		}
+		b.VolumeHealth = append(b.VolumeHealth, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/podtemplate.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/podtemplate.go
index a4a2e300e4..a78cd0430b 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/podtemplate.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/podtemplate.go
@@ -32,7 +32,7 @@ import (
 //
 // PodTemplate describes a template for creating copies of a predefined pod.
 type PodTemplateApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/podvolumehealth.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/podvolumehealth.go
new file mode 100644
index 0000000000..f17399dff7
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/podvolumehealth.go
@@ -0,0 +1,74 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// PodVolumeHealthApplyConfiguration represents a declarative configuration of the PodVolumeHealth type for use
+// with apply.
+//
+// PodVolumeHealth contains health information for a volume used by a pod,
+// reported by the CSI node plugin via the kubelet.
+type PodVolumeHealthApplyConfiguration struct {
+	// name matches an entry in pod.spec.volumes.
+	Name *string `json:"name,omitempty"`
+	// conditions is the set of adverse conditions reported by
+	// the CSI node plugin for this volume on this node.
+	// At most 16 conditions may be reported.
+	HealthConditions []VolumeHealthConditionApplyConfiguration `json:"healthConditions,omitempty"`
+	// lastTransitionTime is when the current set of conditions first appeared.
+	LastTransitionTime *metav1.Time `json:"lastTransitionTime,omitempty"`
+}
+
+// PodVolumeHealthApplyConfiguration constructs a declarative configuration of the PodVolumeHealth type for use with
+// apply.
+func PodVolumeHealth() *PodVolumeHealthApplyConfiguration {
+	return &PodVolumeHealthApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *PodVolumeHealthApplyConfiguration) WithName(value string) *PodVolumeHealthApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithHealthConditions adds the given value to the HealthConditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the HealthConditions field.
+func (b *PodVolumeHealthApplyConfiguration) WithHealthConditions(values ...*VolumeHealthConditionApplyConfiguration) *PodVolumeHealthApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithHealthConditions")
+		}
+		b.HealthConditions = append(b.HealthConditions, *values[i])
+	}
+	return b
+}
+
+// WithLastTransitionTime sets the LastTransitionTime field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the LastTransitionTime field is set to the value of the last call.
+func (b *PodVolumeHealthApplyConfiguration) WithLastTransitionTime(value metav1.Time) *PodVolumeHealthApplyConfiguration {
+	b.LastTransitionTime = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/probe.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/probe.go
index e6b3ddd7c5..5ea41ea5cf 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/probe.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/probe.go
@@ -25,7 +25,7 @@ package v1
 // alive or ready to receive traffic.
 type ProbeApplyConfiguration struct {
 	// The action taken to determine the health of a container
-	ProbeHandlerApplyConfiguration `json:",inline"`
+	ProbeHandlerApplyConfiguration `json:""`
 	// Number of seconds after the container has started before liveness probes are initiated.
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
 	InitialDelaySeconds *int32 `json:"initialDelaySeconds,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/projectedvolumesource.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/projectedvolumesource.go
index a17e4d1dfc..c00e9ca6c4 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/projectedvolumesource.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/projectedvolumesource.go
@@ -33,6 +33,10 @@ type ProjectedVolumeSourceApplyConfiguration struct {
 	// This might be in conflict with other options that affect the file
 	// mode, like fsGroup, and the result can be other mode bits set.
 	DefaultMode *int32 `json:"defaultMode,omitempty"`
+	// defaultUser is Optional: The owner UID of the created files by default.
+	// The defaultUser field is only used as a fallback when the item-level user field is unset.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	DefaultUser *int64 `json:"defaultUser,omitempty"`
 }
 
 // ProjectedVolumeSourceApplyConfiguration constructs a declarative configuration of the ProjectedVolumeSource type for use with
@@ -61,3 +65,11 @@ func (b *ProjectedVolumeSourceApplyConfiguration) WithDefaultMode(value int32) *
 	b.DefaultMode = &value
 	return b
 }
+
+// WithDefaultUser sets the DefaultUser field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DefaultUser field is set to the value of the last call.
+func (b *ProjectedVolumeSourceApplyConfiguration) WithDefaultUser(value int64) *ProjectedVolumeSourceApplyConfiguration {
+	b.DefaultUser = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/replicationcontroller.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/replicationcontroller.go
index a6416c4b77..8d8c43547a 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/replicationcontroller.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/replicationcontroller.go
@@ -32,7 +32,7 @@ import (
 //
 // ReplicationController represents the configuration of a replication controller.
 type ReplicationControllerApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// If the Labels of a ReplicationController are empty, they are defaulted to
 	// be the same as the Pod(s) that the replication controller manages.
 	// Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/resourcequota.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/resourcequota.go
index 6489d2928d..475135b071 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/resourcequota.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/resourcequota.go
@@ -32,7 +32,7 @@ import (
 //
 // ResourceQuota sets aggregate quota restrictions enforced per namespace
 type ResourceQuotaApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/resourcestatus.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/resourcestatus.go
index 511164e7cf..b418ff4cb4 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/resourcestatus.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/resourcestatus.go
@@ -28,8 +28,13 @@ import (
 // ResourceStatus represents the status of a single resource allocated to a Pod.
 type ResourceStatusApplyConfiguration struct {
 	// Name of the resource. Must be unique within the pod and in case of non-DRA resource, match one of the resources from the pod spec.
-	// For DRA resources, the value must be "claim:<claim_name>/<request>".
-	// When this status is reported about a container, the "claim_name" and "request" must match one of the claims of this container.
+	// For DRA resources, the value must be "claim:<claim_name>/<request>" when
+	// container.resources.claims[*].request is set or "claim:<claim_name>" when
+	// container.resources.claims[*].request is empty.
+	// For DRA-backed extended resources, "claim:<claim_name>/<request>" is used
+	// when the claim name and request name are recorded in pod.status.extendedResourceClaimStatus.
+	// When this status is reported about a container, the "claim_name" and "request"
+	// must match one of the claims of this container.
 	Name *corev1.ResourceName `json:"name,omitempty"`
 	// List of unique resources health. Each element in the list contains an unique resource ID and its health.
 	// At a minimum, for the lifetime of a Pod, resource ID must uniquely identify the resource allocated to the Pod on the Node.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/secret.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/secret.go
index 42be779311..e4b12ad2bf 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/secret.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/secret.go
@@ -33,7 +33,7 @@ import (
 // Secret holds secret data of a certain type. The total bytes of the values in
 // the Data field must be less than MaxSecretSize bytes.
 type SecretApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretenvsource.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretenvsource.go
index 21a6b75248..bb2f7243e7 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretenvsource.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretenvsource.go
@@ -28,7 +28,7 @@ package v1
 // key-value pairs as environment variables.
 type SecretEnvSourceApplyConfiguration struct {
 	// The Secret to select from.
-	LocalObjectReferenceApplyConfiguration `json:",inline"`
+	LocalObjectReferenceApplyConfiguration `json:""`
 	// Specify whether the Secret must be defined
 	Optional *bool `json:"optional,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretkeyselector.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretkeyselector.go
index 8e83bc813c..71d48813c5 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretkeyselector.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretkeyselector.go
@@ -24,7 +24,7 @@ package v1
 // SecretKeySelector selects a key of a Secret.
 type SecretKeySelectorApplyConfiguration struct {
 	// The name of the secret in the pod's namespace to select from.
-	LocalObjectReferenceApplyConfiguration `json:",inline"`
+	LocalObjectReferenceApplyConfiguration `json:""`
 	// The key of the secret to select from.  Must be a valid secret key.
 	Key *string `json:"key,omitempty"`
 	// Specify whether the Secret or its key must be defined
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretprojection.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretprojection.go
index 87016d9fa3..879ed4bf4e 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretprojection.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretprojection.go
@@ -28,7 +28,7 @@ package v1
 // Note that this is identical to a secret volume source without the default
 // mode.
 type SecretProjectionApplyConfiguration struct {
-	LocalObjectReferenceApplyConfiguration `json:",inline"`
+	LocalObjectReferenceApplyConfiguration `json:""`
 	// items if unspecified, each key-value pair in the Data field of the referenced
 	// Secret will be projected into the volume as a file whose name is the
 	// key and content is the value. If specified, the listed keys will be
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretvolumesource.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretvolumesource.go
index bdc098535e..a4c37ae01e 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretvolumesource.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/secretvolumesource.go
@@ -48,6 +48,10 @@ type SecretVolumeSourceApplyConfiguration struct {
 	DefaultMode *int32 `json:"defaultMode,omitempty"`
 	// optional field specify whether the Secret or its keys must be defined
 	Optional *bool `json:"optional,omitempty"`
+	// defaultUser is Optional: The owner UID of the created files by default.
+	// The defaultUser field is only used as a fallback when the item-level user field is unset.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	DefaultUser *int64 `json:"defaultUser,omitempty"`
 }
 
 // SecretVolumeSourceApplyConfiguration constructs a declarative configuration of the SecretVolumeSource type for use with
@@ -92,3 +96,11 @@ func (b *SecretVolumeSourceApplyConfiguration) WithOptional(value bool) *SecretV
 	b.Optional = &value
 	return b
 }
+
+// WithDefaultUser sets the DefaultUser field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DefaultUser field is set to the value of the last call.
+func (b *SecretVolumeSourceApplyConfiguration) WithDefaultUser(value int64) *SecretVolumeSourceApplyConfiguration {
+	b.DefaultUser = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/service.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/service.go
index b0e667824b..432aa14eed 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/service.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/service.go
@@ -34,7 +34,7 @@ import (
 // (for example 3306) that the proxy listens on, and the selector that determines which pods
 // will answer requests sent through the proxy.
 type ServiceApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/serviceaccount.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/serviceaccount.go
index d439347778..2104cb4e43 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/serviceaccount.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/serviceaccount.go
@@ -35,7 +35,7 @@ import (
 // * a principal that can be authenticated and authorized
 // * a set of secrets
 type ServiceAccountApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/serviceaccounttokenprojection.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/serviceaccounttokenprojection.go
index e2bf69bc44..93b13a2897 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/serviceaccounttokenprojection.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/serviceaccounttokenprojection.go
@@ -41,6 +41,10 @@ type ServiceAccountTokenProjectionApplyConfiguration struct {
 	// path is the path relative to the mount point of the file to project the
 	// token into.
 	Path *string `json:"path,omitempty"`
+	// user is Optional: The owner UID of the created file.
+	// If specified, the item-level user field takes precedence over defaultUser.
+	// (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+	User *int64 `json:"user,omitempty"`
 }
 
 // ServiceAccountTokenProjectionApplyConfiguration constructs a declarative configuration of the ServiceAccountTokenProjection type for use with
@@ -72,3 +76,11 @@ func (b *ServiceAccountTokenProjectionApplyConfiguration) WithPath(value string)
 	b.Path = &value
 	return b
 }
+
+// WithUser sets the User field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the User field is set to the value of the last call.
+func (b *ServiceAccountTokenProjectionApplyConfiguration) WithUser(value int64) *ServiceAccountTokenProjectionApplyConfiguration {
+	b.User = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/volume.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/volume.go
index 2e4c0e6ad6..a2e0b3fc9d 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/volume.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/volume.go
@@ -30,7 +30,7 @@ type VolumeApplyConfiguration struct {
 	// volumeSource represents the location and type of the mounted volume.
 	// If not specified, the Volume is implied to be an EmptyDir.
 	// This implied behavior is deprecated and will be removed in a future version.
-	VolumeSourceApplyConfiguration `json:",inline"`
+	VolumeSourceApplyConfiguration `json:""`
 }
 
 // VolumeApplyConfiguration constructs a declarative configuration of the Volume type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/volumehealthcondition.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/volumehealthcondition.go
new file mode 100644
index 0000000000..26fa8d1401
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/volumehealthcondition.go
@@ -0,0 +1,73 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	corev1 "k8s.io/api/core/v1"
+)
+
+// VolumeHealthConditionApplyConfiguration represents a declarative configuration of the VolumeHealthCondition type for use
+// with apply.
+//
+// VolumeHealthCondition represents an adverse health condition reported for a volume.
+type VolumeHealthConditionApplyConfiguration struct {
+	// status is the machine-parseable health category.
+	// Possible values:
+	// - "Inaccessible": the volume cannot be accessed.
+	// - "DataLoss": data loss has been detected on the volume.
+	// - "Degraded": the volume is functioning with reduced capability.
+	Status *corev1.VolumeHealthStatusType `json:"status,omitempty"`
+	// reason is a brief CamelCase machine-parseable reason.
+	// Together with status it forms the unique identity of a condition entry.
+	// Maximum permitted length of a reason is 256 bytes.
+	Reason *string `json:"reason,omitempty"`
+	// message is a human-readable description.
+	// Maximum permitted length of a message is 1024 bytes.
+	Message *string `json:"message,omitempty"`
+}
+
+// VolumeHealthConditionApplyConfiguration constructs a declarative configuration of the VolumeHealthCondition type for use with
+// apply.
+func VolumeHealthCondition() *VolumeHealthConditionApplyConfiguration {
+	return &VolumeHealthConditionApplyConfiguration{}
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *VolumeHealthConditionApplyConfiguration) WithStatus(value corev1.VolumeHealthStatusType) *VolumeHealthConditionApplyConfiguration {
+	b.Status = &value
+	return b
+}
+
+// WithReason sets the Reason field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Reason field is set to the value of the last call.
+func (b *VolumeHealthConditionApplyConfiguration) WithReason(value string) *VolumeHealthConditionApplyConfiguration {
+	b.Reason = &value
+	return b
+}
+
+// WithMessage sets the Message field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Message field is set to the value of the last call.
+func (b *VolumeHealthConditionApplyConfiguration) WithMessage(value string) *VolumeHealthConditionApplyConfiguration {
+	b.Message = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/volumehealthstatus.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/volumehealthstatus.go
new file mode 100644
index 0000000000..23d3b22c8d
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/volumehealthstatus.go
@@ -0,0 +1,64 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// VolumeHealthStatusApplyConfiguration represents a declarative configuration of the VolumeHealthStatus type for use
+// with apply.
+//
+// VolumeHealthStatus contains health information for a volume reported
+// by the CSI controller plugin.
+type VolumeHealthStatusApplyConfiguration struct {
+	// conditions is the set of adverse conditions reported by
+	// the CSI controller plugin. An empty list means no adverse condition.
+	// At most 16 conditions may be reported.
+	HealthConditions []VolumeHealthConditionApplyConfiguration `json:"healthConditions,omitempty"`
+	// lastTransitionTime is when the current set of conditions first appeared.
+	LastTransitionTime *metav1.Time `json:"lastTransitionTime,omitempty"`
+}
+
+// VolumeHealthStatusApplyConfiguration constructs a declarative configuration of the VolumeHealthStatus type for use with
+// apply.
+func VolumeHealthStatus() *VolumeHealthStatusApplyConfiguration {
+	return &VolumeHealthStatusApplyConfiguration{}
+}
+
+// WithHealthConditions adds the given value to the HealthConditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the HealthConditions field.
+func (b *VolumeHealthStatusApplyConfiguration) WithHealthConditions(values ...*VolumeHealthConditionApplyConfiguration) *VolumeHealthStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithHealthConditions")
+		}
+		b.HealthConditions = append(b.HealthConditions, *values[i])
+	}
+	return b
+}
+
+// WithLastTransitionTime sets the LastTransitionTime field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the LastTransitionTime field is set to the value of the last call.
+func (b *VolumeHealthStatusApplyConfiguration) WithLastTransitionTime(value metav1.Time) *VolumeHealthStatusApplyConfiguration {
+	b.LastTransitionTime = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/core/v1/volumemount.go b/vendor/k8s.io/client-go/applyconfigurations/core/v1/volumemount.go
index 83b71eb659..35e77e3dac 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/core/v1/volumemount.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/core/v1/volumemount.go
@@ -49,8 +49,7 @@ type VolumeMountApplyConfiguration struct {
 	//
 	// If this field is not specified, it is treated as an equivalent of Disabled.
 	RecursiveReadOnly *corev1.RecursiveReadOnlyMode `json:"recursiveReadOnly,omitempty"`
-	// Path within the container at which the volume should be mounted.  Must
-	// not contain ':'.
+	// Path within the container at which the volume should be mounted.
 	MountPath *string `json:"mountPath,omitempty"`
 	// Path within the volume from which the container's volume should be mounted.
 	// Defaults to "" (volume's root).
@@ -67,6 +66,13 @@ type VolumeMountApplyConfiguration struct {
 	// Defaults to "" (volume's root).
 	// SubPathExpr and SubPath are mutually exclusive.
 	SubPathExpr *string `json:"subPathExpr,omitempty"`
+	// bindMountOptions is the list of additional bind mount options to apply when
+	// mounting this volume into the container. Allowed values are noexec,
+	// nodev, and nosuid. These are Linux mount options and have no effect on
+	// Windows nodes.
+	// This field is not supported with image volumes.
+	// This is an alpha field and requires enabling the VolumeBindMountOptions feature gate.
+	BindMountOptions []string `json:"bindMountOptions,omitempty"`
 }
 
 // VolumeMountApplyConfiguration constructs a declarative configuration of the VolumeMount type for use with
@@ -130,3 +136,13 @@ func (b *VolumeMountApplyConfiguration) WithSubPathExpr(value string) *VolumeMou
 	b.SubPathExpr = &value
 	return b
 }
+
+// WithBindMountOptions adds the given value to the BindMountOptions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the BindMountOptions field.
+func (b *VolumeMountApplyConfiguration) WithBindMountOptions(values ...string) *VolumeMountApplyConfiguration {
+	for i := range values {
+		b.BindMountOptions = append(b.BindMountOptions, values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/discovery/v1/endpointslice.go b/vendor/k8s.io/client-go/applyconfigurations/discovery/v1/endpointslice.go
index cba77dd571..705dd0be44 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/discovery/v1/endpointslice.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/discovery/v1/endpointslice.go
@@ -37,7 +37,7 @@ import (
 // by listing EndpointSlices in the service's namespace whose `kubernetes.io/service-name`
 // label contains the service's name.
 type EndpointSliceApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// addressType specifies the type of address carried by this EndpointSlice.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/discovery/v1beta1/endpointslice.go b/vendor/k8s.io/client-go/applyconfigurations/discovery/v1beta1/endpointslice.go
index 4d40de54a6..2a1ac2ca95 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/discovery/v1beta1/endpointslice.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/discovery/v1beta1/endpointslice.go
@@ -34,7 +34,7 @@ import (
 // For a given service there may be multiple EndpointSlice objects, selected by
 // labels, which must be joined to produce the full set of endpoints.
 type EndpointSliceApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// addressType specifies the type of address carried by this EndpointSlice.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/events/v1/event.go b/vendor/k8s.io/client-go/applyconfigurations/events/v1/event.go
index 122cccad7e..e5c5721733 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/events/v1/event.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/events/v1/event.go
@@ -38,8 +38,8 @@ import (
 // continued existence of events with that Reason.  Events should be
 // treated as informative, best-effort, supplemental data.
 type EventApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// eventTime is the time when this Event was first observed. It is required.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/events/v1beta1/event.go b/vendor/k8s.io/client-go/applyconfigurations/events/v1beta1/event.go
index cf6068f470..a4a6abe6d1 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/events/v1beta1/event.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/events/v1beta1/event.go
@@ -38,8 +38,8 @@ import (
 // continued existence of events with that Reason.  Events should be
 // treated as informative, best-effort, supplemental data.
 type EventApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// eventTime is the time when this Event was first observed. It is required.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/daemonset.go b/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/daemonset.go
index 452f9b1c2d..c6968fec94 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/daemonset.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/daemonset.go
@@ -34,7 +34,7 @@ import (
 // more information.
 // DaemonSet represents the configuration of a daemon set.
 type DaemonSetApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/deployment.go b/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/deployment.go
index 6d0e5f89cf..27a554b12c 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/deployment.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/deployment.go
@@ -34,7 +34,7 @@ import (
 // more information.
 // Deployment enables declarative updates for Pods and ReplicaSets.
 type DeploymentApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Specification of the desired behavior of the Deployment.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/ingress.go b/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/ingress.go
index ba82ba9be4..8b6ed56e05 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/ingress.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/ingress.go
@@ -36,7 +36,7 @@ import (
 // based virtual hosting etc.
 // DEPRECATED - This group version of Ingress is deprecated by networking.k8s.io/v1beta1 Ingress. See the release notes for more information.
 type IngressApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/ingressrule.go b/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/ingressrule.go
index 91ebcf89f0..323574f095 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/ingressrule.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/ingressrule.go
@@ -53,7 +53,7 @@ type IngressRuleApplyConfiguration struct {
 	// just traffic matching the host to the default backend or all traffic to the
 	// default backend, is left to the controller fulfilling the Ingress. Http is
 	// currently the only supported IngressRuleValue.
-	IngressRuleValueApplyConfiguration `json:",inline"`
+	IngressRuleValueApplyConfiguration `json:""`
 }
 
 // IngressRuleApplyConfiguration constructs a declarative configuration of the IngressRule type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/networkpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/networkpolicy.go
index 64d95e4925..860d8ec7e4 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/networkpolicy.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/networkpolicy.go
@@ -33,7 +33,7 @@ import (
 // DEPRECATED 1.9 - This group version of NetworkPolicy is deprecated by networking/v1/NetworkPolicy.
 // NetworkPolicy describes what network traffic is allowed for a set of Pods
 type NetworkPolicyApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/replicaset.go b/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/replicaset.go
index 02d6cbffe4..2dfa8fdcb2 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/replicaset.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/replicaset.go
@@ -34,7 +34,7 @@ import (
 // more information.
 // ReplicaSet ensures that a specified number of pod replicas are running at any given time.
 type ReplicaSetApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// If the Labels of a ReplicaSet are empty, they are defaulted to
 	// be the same as the Pod(s) that the ReplicaSet manages.
 	// Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
diff --git a/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/scale.go b/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/scale.go
index 9637d58c84..8542fa6667 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/scale.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/extensions/v1beta1/scale.go
@@ -30,7 +30,7 @@ import (
 //
 // represents a scaling request for a resource.
 type ScaleApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// defines the behavior of the scale. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/flowschema.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/flowschema.go
index 1bfc945a3f..085dd1bf92 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/flowschema.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/flowschema.go
@@ -33,7 +33,7 @@ import (
 // FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with
 // similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
 type FlowSchemaApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/flowschemacondition.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/flowschemacondition.go
index a9023615de..fa6c672058 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/flowschemacondition.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/flowschemacondition.go
@@ -32,8 +32,7 @@ type FlowSchemaConditionApplyConfiguration struct {
 	// Required.
 	Type *flowcontrolv1.FlowSchemaConditionType `json:"type,omitempty"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
 	Status *flowcontrolv1.ConditionStatus `json:"status,omitempty"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
 	LastTransitionTime *metav1.Time `json:"lastTransitionTime,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/prioritylevelconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/prioritylevelconfiguration.go
index d64c3acb62..ae87170fd7 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/prioritylevelconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/prioritylevelconfiguration.go
@@ -32,7 +32,7 @@ import (
 //
 // PriorityLevelConfiguration represents the configuration of a priority level.
 type PriorityLevelConfigurationApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/prioritylevelconfigurationcondition.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/prioritylevelconfigurationcondition.go
index 82b9547d57..ea7be15dca 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/prioritylevelconfigurationcondition.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1/prioritylevelconfigurationcondition.go
@@ -32,8 +32,7 @@ type PriorityLevelConfigurationConditionApplyConfiguration struct {
 	// Required.
 	Type *flowcontrolv1.PriorityLevelConfigurationConditionType `json:"type,omitempty"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
 	Status *flowcontrolv1.ConditionStatus `json:"status,omitempty"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
 	LastTransitionTime *metav1.Time `json:"lastTransitionTime,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/flowschema.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/flowschema.go
index 80a1f720fa..dbd3a5f291 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/flowschema.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/flowschema.go
@@ -33,7 +33,7 @@ import (
 // FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with
 // similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
 type FlowSchemaApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/flowschemacondition.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/flowschemacondition.go
index 9462bbd02e..aa926a1be5 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/flowschemacondition.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/flowschemacondition.go
@@ -32,8 +32,7 @@ type FlowSchemaConditionApplyConfiguration struct {
 	// Required.
 	Type *flowcontrolv1beta1.FlowSchemaConditionType `json:"type,omitempty"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
 	Status *flowcontrolv1beta1.ConditionStatus `json:"status,omitempty"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
 	LastTransitionTime *v1.Time `json:"lastTransitionTime,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/prioritylevelconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/prioritylevelconfiguration.go
index 8fecf8688c..1f34672a1b 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/prioritylevelconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/prioritylevelconfiguration.go
@@ -32,7 +32,7 @@ import (
 //
 // PriorityLevelConfiguration represents the configuration of a priority level.
 type PriorityLevelConfigurationApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/prioritylevelconfigurationcondition.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/prioritylevelconfigurationcondition.go
index a2ebf71fc5..af4dc6a3a4 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/prioritylevelconfigurationcondition.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1/prioritylevelconfigurationcondition.go
@@ -32,8 +32,7 @@ type PriorityLevelConfigurationConditionApplyConfiguration struct {
 	// Required.
 	Type *flowcontrolv1beta1.PriorityLevelConfigurationConditionType `json:"type,omitempty"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
 	Status *flowcontrolv1beta1.ConditionStatus `json:"status,omitempty"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
 	LastTransitionTime *v1.Time `json:"lastTransitionTime,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/flowschema.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/flowschema.go
index 394f24b993..a083ea91e9 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/flowschema.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/flowschema.go
@@ -33,7 +33,7 @@ import (
 // FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with
 // similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
 type FlowSchemaApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/flowschemacondition.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/flowschemacondition.go
index 6bebc912c6..2706b563cb 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/flowschemacondition.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/flowschemacondition.go
@@ -32,8 +32,7 @@ type FlowSchemaConditionApplyConfiguration struct {
 	// Required.
 	Type *flowcontrolv1beta2.FlowSchemaConditionType `json:"type,omitempty"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
 	Status *flowcontrolv1beta2.ConditionStatus `json:"status,omitempty"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
 	LastTransitionTime *v1.Time `json:"lastTransitionTime,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/prioritylevelconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/prioritylevelconfiguration.go
index a60827b636..56cb3557a3 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/prioritylevelconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/prioritylevelconfiguration.go
@@ -32,7 +32,7 @@ import (
 //
 // PriorityLevelConfiguration represents the configuration of a priority level.
 type PriorityLevelConfigurationApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/prioritylevelconfigurationcondition.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/prioritylevelconfigurationcondition.go
index 26a8b66243..a6c7898868 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/prioritylevelconfigurationcondition.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2/prioritylevelconfigurationcondition.go
@@ -32,8 +32,7 @@ type PriorityLevelConfigurationConditionApplyConfiguration struct {
 	// Required.
 	Type *flowcontrolv1beta2.PriorityLevelConfigurationConditionType `json:"type,omitempty"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
 	Status *flowcontrolv1beta2.ConditionStatus `json:"status,omitempty"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
 	LastTransitionTime *v1.Time `json:"lastTransitionTime,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/flowschema.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/flowschema.go
index 0079748b66..19e43e5cbe 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/flowschema.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/flowschema.go
@@ -33,7 +33,7 @@ import (
 // FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with
 // similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
 type FlowSchemaApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/flowschemacondition.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/flowschemacondition.go
index de2aff5682..74189b100a 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/flowschemacondition.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/flowschemacondition.go
@@ -32,8 +32,7 @@ type FlowSchemaConditionApplyConfiguration struct {
 	// Required.
 	Type *flowcontrolv1beta3.FlowSchemaConditionType `json:"type,omitempty"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
 	Status *flowcontrolv1beta3.ConditionStatus `json:"status,omitempty"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
 	LastTransitionTime *v1.Time `json:"lastTransitionTime,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/prioritylevelconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/prioritylevelconfiguration.go
index 910cb4c25c..5b16a044aa 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/prioritylevelconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/prioritylevelconfiguration.go
@@ -32,7 +32,7 @@ import (
 //
 // PriorityLevelConfiguration represents the configuration of a priority level.
 type PriorityLevelConfigurationApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// `metadata` is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/prioritylevelconfigurationcondition.go b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/prioritylevelconfigurationcondition.go
index bd14650a93..87013c67b1 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/prioritylevelconfigurationcondition.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3/prioritylevelconfigurationcondition.go
@@ -32,8 +32,7 @@ type PriorityLevelConfigurationConditionApplyConfiguration struct {
 	// Required.
 	Type *flowcontrolv1beta3.PriorityLevelConfigurationConditionType `json:"type,omitempty"`
 	// `status` is the status of the condition.
-	// Can be True, False, Unknown.
-	// Required.
+	// Should be specified and set to one of True, False, Unknown.
 	Status *flowcontrolv1beta3.ConditionStatus `json:"status,omitempty"`
 	// `lastTransitionTime` is the last time the condition transitioned from one status to another.
 	LastTransitionTime *v1.Time `json:"lastTransitionTime,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereview.go b/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereview.go
index f63c86ceb2..c2aad9565b 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereview.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereview.go
@@ -32,13 +32,13 @@ import (
 //
 // ImageReview checks if the set of images in a pod are allowed.
 type ImageReviewApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Spec holds information about the pod being evaluated
+	// spec holds information about the pod being evaluated
 	Spec *ImageReviewSpecApplyConfiguration `json:"spec,omitempty"`
-	// Status is filled in by the backend and indicates whether the pod should be allowed.
+	// status is filled in by the backend and indicates whether the pod should be allowed.
 	Status *ImageReviewStatusApplyConfiguration `json:"status,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereviewcontainerspec.go b/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereviewcontainerspec.go
index 1f0193f031..0a24f4332d 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereviewcontainerspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereviewcontainerspec.go
@@ -23,7 +23,7 @@ package v1alpha1
 //
 // ImageReviewContainerSpec is a description of a container within the pod creation request.
 type ImageReviewContainerSpecApplyConfiguration struct {
-	// This can be in the form image:tag or image@SHA:012345679abcdef.
+	// image can be in the form image:tag or image@SHA:012345679abcdef.
 	Image *string `json:"image,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereviewspec.go b/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereviewspec.go
index 14c6603f5e..9abdc95017 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereviewspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereviewspec.go
@@ -23,13 +23,13 @@ package v1alpha1
 //
 // ImageReviewSpec is a description of the pod creation request.
 type ImageReviewSpecApplyConfiguration struct {
-	// Containers is a list of a subset of the information in each container of the Pod being created.
+	// containers is a list of a subset of the information in each container of the Pod being created.
 	Containers []ImageReviewContainerSpecApplyConfiguration `json:"containers,omitempty"`
-	// Annotations is a list of key-value pairs extracted from the Pod's annotations.
+	// annotations is a list of key-value pairs extracted from the Pod's annotations.
 	// It only includes keys which match the pattern `*.image-policy.k8s.io/*`.
 	// It is up to each webhook backend to determine how to interpret these annotations, if at all.
 	Annotations map[string]string `json:"annotations,omitempty"`
-	// Namespace is the namespace the pod is being created in.
+	// namespace is the namespace the pod is being created in.
 	Namespace *string `json:"namespace,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereviewstatus.go b/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereviewstatus.go
index 52828a29c1..53d32ee915 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereviewstatus.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1/imagereviewstatus.go
@@ -23,13 +23,13 @@ package v1alpha1
 //
 // ImageReviewStatus is the result of the review for the pod creation request.
 type ImageReviewStatusApplyConfiguration struct {
-	// Allowed indicates that all images were allowed to be run.
+	// allowed indicates that all images were allowed to be run.
 	Allowed *bool `json:"allowed,omitempty"`
-	// Reason should be empty unless Allowed is false in which case it
+	// reason should be empty unless Allowed is false in which case it
 	// may contain a short description of what is wrong.  Kubernetes
 	// may truncate excessively long errors when displaying to the user.
 	Reason *string `json:"reason,omitempty"`
-	// AuditAnnotations will be added to the attributes object of the
+	// auditAnnotations will be added to the attributes object of the
 	// admission controller request using 'AddAnnotation'.  The keys should
 	// be prefix-less (i.e., the admission controller will add an
 	// appropriate prefix).
diff --git a/vendor/k8s.io/client-go/applyconfigurations/internal/internal.go b/vendor/k8s.io/client-go/applyconfigurations/internal/internal.go
index c0b255cc73..a8007a3d1b 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/internal/internal.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/internal/internal.go
@@ -3188,6 +3188,9 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: message
       type:
         scalar: string
+    - name: observedGeneration
+      type:
+        scalar: numeric
     - name: reason
       type:
         scalar: string
@@ -3517,6 +3520,26 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         scalar: string
       default: ""
+- name: io.k8s.api.batch.v1.JobSchedulingConfiguration
+  map:
+    fields:
+    - name: disruptionMode
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupDisruptionMode
+    - name: resourceClaims
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupResourceClaim
+          elementRelationship: associative
+          keys:
+          - name
+    - name: schedulingConstraints
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupSchedulingConstraints
+    - name: schedulingPolicy
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupSchedulingPolicy
 - name: io.k8s.api.batch.v1.JobSpec
   map:
     fields:
@@ -3553,6 +3576,9 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: podReplacementPolicy
       type:
         scalar: string
+    - name: scheduling
+      type:
+        namedType: io.k8s.api.batch.v1.JobSchedulingConfiguration
     - name: selector
       type:
         namedType: io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector
@@ -3877,6 +3903,120 @@ var schemaYAML = typed.YAMLObject(`types:
           elementRelationship: associative
           keys:
           - type
+- name: io.k8s.api.certificates.v1.ClusterTrustBundle
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: spec
+      type:
+        namedType: io.k8s.api.certificates.v1.ClusterTrustBundleSpec
+      default: {}
+- name: io.k8s.api.certificates.v1.ClusterTrustBundleSpec
+  map:
+    fields:
+    - name: signerName
+      type:
+        scalar: string
+    - name: trustBundle
+      type:
+        scalar: string
+      default: ""
+- name: io.k8s.api.certificates.v1.PodCertificateRequest
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: spec
+      type:
+        namedType: io.k8s.api.certificates.v1.PodCertificateRequestSpec
+      default: {}
+    - name: status
+      type:
+        namedType: io.k8s.api.certificates.v1.PodCertificateRequestStatus
+      default: {}
+- name: io.k8s.api.certificates.v1.PodCertificateRequestSpec
+  map:
+    fields:
+    - name: maxExpirationSeconds
+      type:
+        scalar: numeric
+      default: 86400
+    - name: nodeName
+      type:
+        scalar: string
+      default: ""
+    - name: nodeUID
+      type:
+        scalar: string
+      default: ""
+    - name: podName
+      type:
+        scalar: string
+      default: ""
+    - name: podUID
+      type:
+        scalar: string
+      default: ""
+    - name: serviceAccountName
+      type:
+        scalar: string
+      default: ""
+    - name: serviceAccountUID
+      type:
+        scalar: string
+      default: ""
+    - name: signerName
+      type:
+        scalar: string
+      default: ""
+    - name: stubPKCS10Request
+      type:
+        scalar: string
+    - name: unverifiedUserAnnotations
+      type:
+        map:
+          elementType:
+            scalar: string
+- name: io.k8s.api.certificates.v1.PodCertificateRequestStatus
+  map:
+    fields:
+    - name: beginRefreshAt
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+    - name: certificateChain
+      type:
+        scalar: string
+    - name: conditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition
+          elementRelationship: associative
+          keys:
+          - type
+    - name: notAfter
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+    - name: notBefore
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
 - name: io.k8s.api.certificates.v1alpha1.ClusterTrustBundle
   map:
     fields:
@@ -4572,6 +4712,9 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: signerName
       type:
         scalar: string
+    - name: user
+      type:
+        scalar: numeric
 - name: io.k8s.api.core.v1.ComponentCondition
   map:
     fields:
@@ -4704,6 +4847,9 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: defaultMode
       type:
         scalar: numeric
+    - name: defaultUser
+      type:
+        scalar: numeric
     - name: items
       type:
         list:
@@ -5069,12 +5215,18 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: resourceFieldRef
       type:
         namedType: io.k8s.api.core.v1.ResourceFieldSelector
+    - name: user
+      type:
+        scalar: numeric
 - name: io.k8s.api.core.v1.DownwardAPIVolumeSource
   map:
     fields:
     - name: defaultMode
       type:
         scalar: numeric
+    - name: defaultUser
+      type:
+        scalar: numeric
     - name: items
       type:
         list:
@@ -5087,6 +5239,9 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: medium
       type:
         scalar: string
+    - name: mode
+      type:
+        scalar: numeric
     - name: sizeLimit
       type:
         namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
@@ -5409,6 +5564,17 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: host
       type:
         scalar: string
+- name: io.k8s.api.core.v1.EvictionResponder
+  map:
+    fields:
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: priority
+      type:
+        scalar: numeric
+    elementRelationship: atomic
 - name: io.k8s.api.core.v1.ExecAction
   map:
     fields:
@@ -5532,6 +5698,9 @@ var schemaYAML = typed.YAMLObject(`types:
 - name: io.k8s.api.core.v1.GRPCAction
   map:
     fields:
+    - name: mode
+      type:
+        scalar: string
     - name: port
       type:
         scalar: numeric
@@ -5602,6 +5771,9 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: port
       type:
         namedType: io.k8s.apimachinery.pkg.util.intstr.IntOrString
+    - name: protocol
+      type:
+        scalar: string
     - name: scheme
       type:
         scalar: string
@@ -5761,6 +5933,9 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         scalar: string
       default: ""
+    - name: user
+      type:
+        scalar: numeric
 - name: io.k8s.api.core.v1.Lifecycle
   map:
     fields:
@@ -6040,6 +6215,29 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: requiredDuringSchedulingIgnoredDuringExecution
       type:
         namedType: io.k8s.api.core.v1.NodeSelector
+- name: io.k8s.api.core.v1.NodeAllocatableMappedResources
+  map:
+    fields:
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: quantity
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+- name: io.k8s.api.core.v1.NodeAllocatableOverheadResources
+  map:
+    fields:
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: perContainer
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+    - name: perPod
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
 - name: io.k8s.api.core.v1.NodeAllocatableResourceClaimStatus
   map:
     fields:
@@ -6049,15 +6247,26 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             scalar: string
           elementRelationship: associative
+    - name: mapping
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.core.v1.NodeAllocatableMappedResources
+          elementRelationship: associative
+          keys:
+          - name
+    - name: overhead
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.core.v1.NodeAllocatableOverheadResources
+          elementRelationship: associative
+          keys:
+          - name
     - name: resourceClaimName
       type:
         scalar: string
       default: ""
-    - name: resources
-      type:
-        map:
-          elementType:
-            namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
 - name: io.k8s.api.core.v1.NodeCondition
   map:
     fields:
@@ -6115,6 +6324,15 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: supplementalGroupsPolicy
       type:
         scalar: boolean
+- name: io.k8s.api.core.v1.NodePodPreemptionPolicy
+  map:
+    fields:
+    - name: disableResizePreemption
+      type:
+        list:
+          elementType:
+            scalar: string
+          elementRelationship: associative
 - name: io.k8s.api.core.v1.NodeRuntimeHandler
   map:
     fields:
@@ -6195,6 +6413,9 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             scalar: string
           elementRelationship: associative
+    - name: podPreemptionPolicy
+      type:
+        namedType: io.k8s.api.core.v1.NodePodPreemptionPolicy
     - name: providerID
       type:
         scalar: string
@@ -6328,6 +6549,9 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         scalar: string
       default: ""
+    - name: runningInUserNamespace
+      type:
+        scalar: boolean
     - name: swap
       type:
         namedType: io.k8s.api.core.v1.NodeSwapStatus
@@ -6506,6 +6730,9 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: currentVolumeAttributesClassName
       type:
         scalar: string
+    - name: healthStatus
+      type:
+        namedType: io.k8s.api.core.v1.VolumeHealthStatus
     - name: modifyVolumeStatus
       type:
         namedType: io.k8s.api.core.v1.ModifyVolumeStatus
@@ -6766,6 +6993,9 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: signerName
       type:
         scalar: string
+    - name: user
+      type:
+        scalar: numeric
     - name: userAnnotations
       type:
         map:
@@ -6986,6 +7216,14 @@ var schemaYAML = typed.YAMLObject(`types:
           elementRelationship: associative
           keys:
           - name
+    - name: evictionResponders
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.core.v1.EvictionResponder
+          elementRelationship: associative
+          keys:
+          - name
     - name: hostAliases
       type:
         list:
@@ -7189,7 +7427,9 @@ var schemaYAML = typed.YAMLObject(`types:
         list:
           elementType:
             namedType: io.k8s.api.core.v1.NodeAllocatableResourceClaimStatus
-          elementRelationship: atomic
+          elementRelationship: associative
+          keys:
+          - resourceClaimName
     - name: nominatedNodeName
       type:
         scalar: string
@@ -7233,6 +7473,14 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: startTime
       type:
         namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+    - name: volumeHealth
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.core.v1.PodVolumeHealth
+          elementRelationship: associative
+          keys:
+          - name
 - name: io.k8s.api.core.v1.PodTemplate
   map:
     fields:
@@ -7261,6 +7509,25 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         namedType: io.k8s.api.core.v1.PodSpec
       default: {}
+- name: io.k8s.api.core.v1.PodVolumeHealth
+  map:
+    fields:
+    - name: healthConditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.core.v1.VolumeHealthCondition
+          elementRelationship: associative
+          keys:
+          - status
+          - reason
+    - name: lastTransitionTime
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+    - name: name
+      type:
+        scalar: string
+      default: ""
 - name: io.k8s.api.core.v1.PortStatus
   map:
     fields:
@@ -7338,6 +7605,9 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: defaultMode
       type:
         scalar: numeric
+    - name: defaultUser
+      type:
+        scalar: numeric
     - name: sources
       type:
         list:
@@ -7864,6 +8134,9 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: defaultMode
       type:
         scalar: numeric
+    - name: defaultUser
+      type:
+        scalar: numeric
     - name: items
       type:
         list:
@@ -7979,6 +8252,9 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         scalar: string
       default: ""
+    - name: user
+      type:
+        scalar: numeric
 - name: io.k8s.api.core.v1.ServicePort
   map:
     fields:
@@ -8401,21 +8677,56 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         scalar: string
       default: ""
-- name: io.k8s.api.core.v1.VolumeMount
+- name: io.k8s.api.core.v1.VolumeHealthCondition
   map:
     fields:
-    - name: mountPath
+    - name: message
       type:
         scalar: string
-      default: ""
-    - name: mountPropagation
+    - name: reason
       type:
         scalar: string
-    - name: name
+      default: ""
+    - name: status
       type:
         scalar: string
       default: ""
-    - name: readOnly
+- name: io.k8s.api.core.v1.VolumeHealthStatus
+  map:
+    fields:
+    - name: healthConditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.core.v1.VolumeHealthCondition
+          elementRelationship: associative
+          keys:
+          - status
+          - reason
+    - name: lastTransitionTime
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+- name: io.k8s.api.core.v1.VolumeMount
+  map:
+    fields:
+    - name: bindMountOptions
+      type:
+        list:
+          elementType:
+            scalar: string
+          elementRelationship: associative
+    - name: mountPath
+      type:
+        scalar: string
+      default: ""
+    - name: mountPropagation
+      type:
+        scalar: string
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: readOnly
       type:
         scalar: boolean
     - name: recursiveReadOnly
@@ -10862,6 +11173,214 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: reason
       type:
         scalar: string
+- name: io.k8s.api.lifecycle.v1alpha1.Eviction
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: spec
+      type:
+        namedType: io.k8s.api.lifecycle.v1alpha1.EvictionSpec
+      default: {}
+    - name: status
+      type:
+        namedType: io.k8s.api.lifecycle.v1alpha1.EvictionStatus
+      default: {}
+- name: io.k8s.api.lifecycle.v1alpha1.EvictionPodReference
+  map:
+    fields:
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: uid
+      type:
+        scalar: string
+      default: ""
+- name: io.k8s.api.lifecycle.v1alpha1.EvictionRequest
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: spec
+      type:
+        namedType: io.k8s.api.lifecycle.v1alpha1.EvictionRequestSpec
+      default: {}
+    - name: status
+      type:
+        namedType: io.k8s.api.lifecycle.v1alpha1.EvictionRequestStatus
+      default: {}
+- name: io.k8s.api.lifecycle.v1alpha1.EvictionRequestPodReference
+  map:
+    fields:
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: uid
+      type:
+        scalar: string
+      default: ""
+- name: io.k8s.api.lifecycle.v1alpha1.EvictionRequestSpec
+  map:
+    fields:
+    - name: intent
+      type:
+        scalar: string
+      default: ""
+    - name: requester
+      type:
+        scalar: string
+      default: ""
+    - name: target
+      type:
+        namedType: io.k8s.api.lifecycle.v1alpha1.EvictionRequestTarget
+      default: {}
+- name: io.k8s.api.lifecycle.v1alpha1.EvictionRequestStatus
+  map:
+    fields:
+    - name: conditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition
+          elementRelationship: associative
+          keys:
+          - type
+    - name: observedGeneration
+      type:
+        scalar: numeric
+- name: io.k8s.api.lifecycle.v1alpha1.EvictionRequestTarget
+  map:
+    fields:
+    - name: pod
+      type:
+        namedType: io.k8s.api.lifecycle.v1alpha1.EvictionRequestPodReference
+    unions:
+    - fields:
+      - fieldName: pod
+        discriminatorValue: Pod
+- name: io.k8s.api.lifecycle.v1alpha1.EvictionSpec
+  map:
+    fields:
+    - name: target
+      type:
+        namedType: io.k8s.api.lifecycle.v1alpha1.EvictionTarget
+      default: {}
+- name: io.k8s.api.lifecycle.v1alpha1.EvictionStatus
+  map:
+    fields:
+    - name: conditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition
+          elementRelationship: associative
+          keys:
+          - type
+    - name: observedGeneration
+      type:
+        scalar: numeric
+    - name: requesters
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.lifecycle.v1alpha1.Requester
+          elementRelationship: associative
+          keys:
+          - name
+    - name: responders
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.lifecycle.v1alpha1.ResponderStatus
+          elementRelationship: associative
+          keys:
+          - name
+    - name: targetResponders
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.lifecycle.v1alpha1.TargetResponder
+          elementRelationship: associative
+          keys:
+          - name
+- name: io.k8s.api.lifecycle.v1alpha1.EvictionTarget
+  map:
+    fields:
+    - name: pod
+      type:
+        namedType: io.k8s.api.lifecycle.v1alpha1.EvictionPodReference
+    unions:
+    - fields:
+      - fieldName: pod
+        discriminatorValue: Pod
+- name: io.k8s.api.lifecycle.v1alpha1.Requester
+  map:
+    fields:
+    - name: intent
+      type:
+        scalar: string
+      default: ""
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    elementRelationship: atomic
+- name: io.k8s.api.lifecycle.v1alpha1.ResponderStatus
+  map:
+    fields:
+    - name: completionTime
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+    - name: expectedCompletionTime
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+    - name: heartbeatTime
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+    - name: message
+      type:
+        scalar: string
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: startTime
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+    elementRelationship: separable
+- name: io.k8s.api.lifecycle.v1alpha1.TargetResponder
+  map:
+    fields:
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: priority
+      type:
+        scalar: numeric
+    - name: state
+      type:
+        scalar: string
+      default: ""
+    elementRelationship: atomic
 - name: io.k8s.api.networking.v1.HTTPIngressPath
   map:
     fields:
@@ -12476,11 +12995,11 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         scalar: string
       default: ""
-    - name: nodeAllocatableResourceMappings
+    - name: nodeAllocatableResources
       type:
         map:
           elementType:
-            namedType: io.k8s.api.resource.v1.NodeAllocatableResourceMapping
+            namedType: io.k8s.api.resource.v1.NodeAllocatableResource
     - name: nodeName
       type:
         scalar: string
@@ -12664,6 +13183,12 @@ var schemaYAML = typed.YAMLObject(`types:
 - name: io.k8s.api.resource.v1.DeviceCounterConsumption
   map:
     fields:
+    - name: compatibilityGroups
+      type:
+        list:
+          elementType:
+            scalar: string
+          elementRelationship: atomic
     - name: counterSet
       type:
         scalar: string
@@ -12673,6 +13198,17 @@ var schemaYAML = typed.YAMLObject(`types:
         map:
           elementType:
             namedType: io.k8s.api.resource.v1.Counter
+- name: io.k8s.api.resource.v1.DeviceDerivedAttribute
+  map:
+    fields:
+    - name: expression
+      type:
+        scalar: string
+      default: ""
+    - name: name
+      type:
+        scalar: string
+      default: ""
 - name: io.k8s.api.resource.v1.DeviceRequest
   map:
     fields:
@@ -12731,6 +13267,12 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: shareID
       type:
         scalar: string
+    - name: skipNodeOperations
+      type:
+        list:
+          elementType:
+            scalar: string
+          elementRelationship: associative
     - name: tolerations
       type:
         list:
@@ -12755,6 +13297,12 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: count
       type:
         scalar: numeric
+    - name: derivedAttributes
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.resource.v1.DeviceDerivedAttribute
+          elementRelationship: atomic
     - name: deviceClassName
       type:
         scalar: string
@@ -12792,40 +13340,100 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: value
       type:
         scalar: string
-- name: io.k8s.api.resource.v1.DeviceToleration
+- name: io.k8s.api.resource.v1.DeviceTaintRule
   map:
     fields:
-    - name: effect
+    - name: apiVersion
       type:
         scalar: string
-    - name: key
+    - name: kind
       type:
         scalar: string
-    - name: operator
+    - name: metadata
       type:
-        scalar: string
-      default: Equal
-    - name: tolerationSeconds
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: spec
       type:
-        scalar: numeric
-    - name: value
+        namedType: io.k8s.api.resource.v1.DeviceTaintRuleSpec
+      default: {}
+    - name: status
       type:
-        scalar: string
-- name: io.k8s.api.resource.v1.ExactDeviceRequest
+        namedType: io.k8s.api.resource.v1.DeviceTaintRuleStatus
+      default: {}
+- name: io.k8s.api.resource.v1.DeviceTaintRuleSpec
   map:
     fields:
-    - name: adminAccess
-      type:
-        scalar: boolean
-    - name: allocationMode
+    - name: deviceSelector
       type:
-        scalar: string
-    - name: capacity
+        namedType: io.k8s.api.resource.v1.DeviceTaintSelector
+    - name: taint
       type:
-        namedType: io.k8s.api.resource.v1.CapacityRequirements
-    - name: count
+        namedType: io.k8s.api.resource.v1.DeviceTaint
+      default: {}
+- name: io.k8s.api.resource.v1.DeviceTaintRuleStatus
+  map:
+    fields:
+    - name: conditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition
+          elementRelationship: associative
+          keys:
+          - type
+- name: io.k8s.api.resource.v1.DeviceTaintSelector
+  map:
+    fields:
+    - name: device
+      type:
+        scalar: string
+    - name: driver
+      type:
+        scalar: string
+    - name: pool
+      type:
+        scalar: string
+- name: io.k8s.api.resource.v1.DeviceToleration
+  map:
+    fields:
+    - name: effect
+      type:
+        scalar: string
+    - name: key
+      type:
+        scalar: string
+    - name: operator
+      type:
+        scalar: string
+      default: Equal
+    - name: tolerationSeconds
       type:
         scalar: numeric
+    - name: value
+      type:
+        scalar: string
+- name: io.k8s.api.resource.v1.ExactDeviceRequest
+  map:
+    fields:
+    - name: adminAccess
+      type:
+        scalar: boolean
+    - name: allocationMode
+      type:
+        scalar: string
+    - name: capacity
+      type:
+        namedType: io.k8s.api.resource.v1.CapacityRequirements
+    - name: count
+      type:
+        scalar: numeric
+    - name: derivedAttributes
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.resource.v1.DeviceDerivedAttribute
+          elementRelationship: atomic
     - name: deviceClassName
       type:
         scalar: string
@@ -12857,15 +13465,36 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             scalar: string
           elementRelationship: atomic
-- name: io.k8s.api.resource.v1.NodeAllocatableResourceMapping
+- name: io.k8s.api.resource.v1.NodeAllocatableMapping
   map:
     fields:
-    - name: allocationMultiplier
-      type:
-        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
     - name: capacityKey
       type:
         scalar: string
+    - name: capacityMultiplier
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+    - name: deviceMultiplier
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+- name: io.k8s.api.resource.v1.NodeAllocatableOverhead
+  map:
+    fields:
+    - name: perContainer
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+    - name: perPod
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+- name: io.k8s.api.resource.v1.NodeAllocatableResource
+  map:
+    fields:
+    - name: mapping
+      type:
+        namedType: io.k8s.api.resource.v1.NodeAllocatableMapping
+    - name: overhead
+      type:
+        namedType: io.k8s.api.resource.v1.NodeAllocatableOverhead
 - name: io.k8s.api.resource.v1.OpaqueDeviceConfiguration
   map:
     fields:
@@ -13029,6 +13658,9 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: nodeSelector
       type:
         namedType: io.k8s.api.core.v1.NodeSelector
+    - name: partitionTypeAttribute
+      type:
+        scalar: string
     - name: perDeviceNodeSelection
       type:
         scalar: boolean
@@ -13042,6 +13674,12 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             namedType: io.k8s.api.resource.v1.CounterSet
           elementRelationship: atomic
+    - name: skipNodeOperations
+      type:
+        list:
+          elementType:
+            scalar: string
+          elementRelationship: associative
 - name: io.k8s.api.resource.v1alpha3.DeviceTaint
   map:
     fields:
@@ -13113,6 +13751,21 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: pool
       type:
         scalar: string
+- name: io.k8s.api.resource.v1alpha3.PartitionTypeStatus
+  map:
+    fields:
+    - name: allocatable
+      type:
+        scalar: numeric
+    - name: attribute
+      type:
+        scalar: string
+    - name: total
+      type:
+        scalar: numeric
+    - name: type
+      type:
+        scalar: string
 - name: io.k8s.api.resource.v1alpha3.PoolStatus
   map:
     fields:
@@ -13132,12 +13785,21 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: nodeName
       type:
         scalar: string
+    - name: partitionSummary
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.resource.v1alpha3.PartitionTypeStatus
+          elementRelationship: atomic
     - name: poolName
       type:
         scalar: string
     - name: resourceSliceCount
       type:
         scalar: numeric
+    - name: shareableSummary
+      type:
+        namedType: io.k8s.api.resource.v1alpha3.ShareableSummaryStatus
     - name: totalDevices
       type:
         scalar: numeric
@@ -13170,6 +13832,9 @@ var schemaYAML = typed.YAMLObject(`types:
 - name: io.k8s.api.resource.v1alpha3.ResourcePoolStatusRequestSpec
   map:
     fields:
+    - name: defaultPartitionTypeAttribute
+      type:
+        scalar: string
     - name: driver
       type:
         scalar: string
@@ -13201,6 +13866,36 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             namedType: io.k8s.api.resource.v1alpha3.PoolStatus
           elementRelationship: atomic
+- name: io.k8s.api.resource.v1alpha3.ShareableCapacityStatus
+  map:
+    fields:
+    - name: available
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+    - name: consumed
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+    - name: name
+      type:
+        scalar: string
+    - name: total
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+- name: io.k8s.api.resource.v1alpha3.ShareableSummaryStatus
+  map:
+    fields:
+    - name: capacity
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.resource.v1alpha3.ShareableCapacityStatus
+          elementRelationship: atomic
+    - name: fullyAvailableDevices
+      type:
+        scalar: numeric
+    - name: partiallyAvailableDevices
+      type:
+        scalar: numeric
 - name: io.k8s.api.resource.v1beta1.AllocatedDeviceStatus
   map:
     fields:
@@ -13286,11 +13981,11 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             namedType: io.k8s.api.resource.v1beta1.DeviceCounterConsumption
           elementRelationship: atomic
-    - name: nodeAllocatableResourceMappings
+    - name: nodeAllocatableResources
       type:
         map:
           elementType:
-            namedType: io.k8s.api.resource.v1beta1.NodeAllocatableResourceMapping
+            namedType: io.k8s.api.resource.v1beta1.NodeAllocatableResource
     - name: nodeName
       type:
         scalar: string
@@ -13544,6 +14239,12 @@ var schemaYAML = typed.YAMLObject(`types:
 - name: io.k8s.api.resource.v1beta1.DeviceCounterConsumption
   map:
     fields:
+    - name: compatibilityGroups
+      type:
+        list:
+          elementType:
+            scalar: string
+          elementRelationship: atomic
     - name: counterSet
       type:
         scalar: string
@@ -13553,6 +14254,17 @@ var schemaYAML = typed.YAMLObject(`types:
         map:
           elementType:
             namedType: io.k8s.api.resource.v1beta1.Counter
+- name: io.k8s.api.resource.v1beta1.DeviceDerivedAttribute
+  map:
+    fields:
+    - name: expression
+      type:
+        scalar: string
+      default: ""
+    - name: name
+      type:
+        scalar: string
+      default: ""
 - name: io.k8s.api.resource.v1beta1.DeviceRequest
   map:
     fields:
@@ -13568,6 +14280,12 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: count
       type:
         scalar: numeric
+    - name: derivedAttributes
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.resource.v1beta1.DeviceDerivedAttribute
+          elementRelationship: atomic
     - name: deviceClassName
       type:
         scalar: string
@@ -13636,6 +14354,12 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: shareID
       type:
         scalar: string
+    - name: skipNodeOperations
+      type:
+        list:
+          elementType:
+            scalar: string
+          elementRelationship: associative
     - name: tolerations
       type:
         list:
@@ -13660,6 +14384,12 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: count
       type:
         scalar: numeric
+    - name: derivedAttributes
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.resource.v1beta1.DeviceDerivedAttribute
+          elementRelationship: atomic
     - name: deviceClassName
       type:
         scalar: string
@@ -13731,15 +14461,36 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             scalar: string
           elementRelationship: atomic
-- name: io.k8s.api.resource.v1beta1.NodeAllocatableResourceMapping
+- name: io.k8s.api.resource.v1beta1.NodeAllocatableMapping
   map:
     fields:
-    - name: allocationMultiplier
-      type:
-        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
     - name: capacityKey
       type:
         scalar: string
+    - name: capacityMultiplier
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+    - name: deviceMultiplier
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+- name: io.k8s.api.resource.v1beta1.NodeAllocatableOverhead
+  map:
+    fields:
+    - name: perContainer
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+    - name: perPod
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+- name: io.k8s.api.resource.v1beta1.NodeAllocatableResource
+  map:
+    fields:
+    - name: mapping
+      type:
+        namedType: io.k8s.api.resource.v1beta1.NodeAllocatableMapping
+    - name: overhead
+      type:
+        namedType: io.k8s.api.resource.v1beta1.NodeAllocatableOverhead
 - name: io.k8s.api.resource.v1beta1.OpaqueDeviceConfiguration
   map:
     fields:
@@ -13903,6 +14654,9 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: nodeSelector
       type:
         namedType: io.k8s.api.core.v1.NodeSelector
+    - name: partitionTypeAttribute
+      type:
+        scalar: string
     - name: perDeviceNodeSelection
       type:
         scalar: boolean
@@ -13916,6 +14670,12 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             namedType: io.k8s.api.resource.v1beta1.CounterSet
           elementRelationship: atomic
+    - name: skipNodeOperations
+      type:
+        list:
+          elementType:
+            scalar: string
+          elementRelationship: associative
 - name: io.k8s.api.resource.v1beta2.AllocatedDeviceStatus
   map:
     fields:
@@ -14065,11 +14825,11 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         scalar: string
       default: ""
-    - name: nodeAllocatableResourceMappings
+    - name: nodeAllocatableResources
       type:
         map:
           elementType:
-            namedType: io.k8s.api.resource.v1beta2.NodeAllocatableResourceMapping
+            namedType: io.k8s.api.resource.v1beta2.NodeAllocatableResource
     - name: nodeName
       type:
         scalar: string
@@ -14253,6 +15013,12 @@ var schemaYAML = typed.YAMLObject(`types:
 - name: io.k8s.api.resource.v1beta2.DeviceCounterConsumption
   map:
     fields:
+    - name: compatibilityGroups
+      type:
+        list:
+          elementType:
+            scalar: string
+          elementRelationship: atomic
     - name: counterSet
       type:
         scalar: string
@@ -14262,6 +15028,17 @@ var schemaYAML = typed.YAMLObject(`types:
         map:
           elementType:
             namedType: io.k8s.api.resource.v1beta2.Counter
+- name: io.k8s.api.resource.v1beta2.DeviceDerivedAttribute
+  map:
+    fields:
+    - name: expression
+      type:
+        scalar: string
+      default: ""
+    - name: name
+      type:
+        scalar: string
+      default: ""
 - name: io.k8s.api.resource.v1beta2.DeviceRequest
   map:
     fields:
@@ -14320,6 +15097,12 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: shareID
       type:
         scalar: string
+    - name: skipNodeOperations
+      type:
+        list:
+          elementType:
+            scalar: string
+          elementRelationship: associative
     - name: tolerations
       type:
         list:
@@ -14344,6 +15127,12 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: count
       type:
         scalar: numeric
+    - name: derivedAttributes
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.resource.v1beta2.DeviceDerivedAttribute
+          elementRelationship: atomic
     - name: deviceClassName
       type:
         scalar: string
@@ -14469,6 +15258,12 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: count
       type:
         scalar: numeric
+    - name: derivedAttributes
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.resource.v1beta2.DeviceDerivedAttribute
+          elementRelationship: atomic
     - name: deviceClassName
       type:
         scalar: string
@@ -14500,15 +15295,36 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             scalar: string
           elementRelationship: atomic
-- name: io.k8s.api.resource.v1beta2.NodeAllocatableResourceMapping
+- name: io.k8s.api.resource.v1beta2.NodeAllocatableMapping
   map:
     fields:
-    - name: allocationMultiplier
-      type:
-        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
     - name: capacityKey
       type:
         scalar: string
+    - name: capacityMultiplier
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+    - name: deviceMultiplier
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+- name: io.k8s.api.resource.v1beta2.NodeAllocatableOverhead
+  map:
+    fields:
+    - name: perContainer
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+    - name: perPod
+      type:
+        namedType: io.k8s.apimachinery.pkg.api.resource.Quantity
+- name: io.k8s.api.resource.v1beta2.NodeAllocatableResource
+  map:
+    fields:
+    - name: mapping
+      type:
+        namedType: io.k8s.api.resource.v1beta2.NodeAllocatableMapping
+    - name: overhead
+      type:
+        namedType: io.k8s.api.resource.v1beta2.NodeAllocatableOverhead
 - name: io.k8s.api.resource.v1beta2.OpaqueDeviceConfiguration
   map:
     fields:
@@ -14672,6 +15488,9 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: nodeSelector
       type:
         namedType: io.k8s.api.core.v1.NodeSelector
+    - name: partitionTypeAttribute
+      type:
+        scalar: string
     - name: perDeviceNodeSelection
       type:
         scalar: boolean
@@ -14685,6 +15504,12 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             namedType: io.k8s.api.resource.v1beta2.CounterSet
           elementRelationship: atomic
+    - name: skipNodeOperations
+      type:
+        list:
+          elementType:
+            scalar: string
+          elementRelationship: associative
 - name: io.k8s.api.scheduling.v1.PriorityClass
   map:
     fields:
@@ -14711,7 +15536,7 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         scalar: numeric
       default: 0
-- name: io.k8s.api.scheduling.v1alpha2.BasicSchedulingPolicy
+- name: io.k8s.api.scheduling.v1alpha3.AllCompositeDisruptionMode
   map:
     elementType:
       scalar: untyped
@@ -14723,35 +15548,742 @@ var schemaYAML = typed.YAMLObject(`types:
         elementType:
           namedType: __untyped_deduced_
         elementRelationship: separable
-- name: io.k8s.api.scheduling.v1alpha2.GangSchedulingPolicy
-  map:
-    fields:
-    - name: minCount
-      type:
-        scalar: numeric
-      default: 0
-- name: io.k8s.api.scheduling.v1alpha2.PodGroup
+- name: io.k8s.api.scheduling.v1alpha3.AllDisruptionMode
   map:
-    fields:
-    - name: apiVersion
-      type:
-        scalar: string
-    - name: kind
-      type:
-        scalar: string
-    - name: metadata
-      type:
-        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
-      default: {}
-    - name: spec
-      type:
-        namedType: io.k8s.api.scheduling.v1alpha2.PodGroupSpec
-      default: {}
-    - name: status
-      type:
-        namedType: io.k8s.api.scheduling.v1alpha2.PodGroupStatus
-      default: {}
-- name: io.k8s.api.scheduling.v1alpha2.PodGroupResourceClaim
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_deduced_
+        elementRelationship: separable
+- name: io.k8s.api.scheduling.v1alpha3.BasicSchedulingPolicy
+  map:
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_deduced_
+        elementRelationship: separable
+- name: io.k8s.api.scheduling.v1alpha3.CompositeBasicSchedulingPolicy
+  map:
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_deduced_
+        elementRelationship: separable
+- name: io.k8s.api.scheduling.v1alpha3.CompositeDisruptionMode
+  map:
+    fields:
+    - name: all
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.AllCompositeDisruptionMode
+    - name: single
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.SingleCompositeDisruptionMode
+    unions:
+    - fields:
+      - fieldName: all
+        discriminatorValue: All
+      - fieldName: single
+        discriminatorValue: Single
+- name: io.k8s.api.scheduling.v1alpha3.CompositeGangSchedulingPolicy
+  map:
+    fields:
+    - name: minGroupCount
+      type:
+        scalar: numeric
+      default: 0
+- name: io.k8s.api.scheduling.v1alpha3.CompositePodGroup
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: spec
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.CompositePodGroupSpec
+      default: {}
+    - name: status
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.CompositePodGroupStatus
+      default: {}
+- name: io.k8s.api.scheduling.v1alpha3.CompositePodGroupSchedulingConstraints
+  map:
+    fields:
+    - name: topology
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.scheduling.v1alpha3.TopologyConstraint
+          elementRelationship: atomic
+- name: io.k8s.api.scheduling.v1alpha3.CompositePodGroupSchedulingPolicy
+  map:
+    fields:
+    - name: basic
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.CompositeBasicSchedulingPolicy
+    - name: gang
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.CompositeGangSchedulingPolicy
+    unions:
+    - fields:
+      - fieldName: basic
+        discriminatorValue: Basic
+      - fieldName: gang
+        discriminatorValue: Gang
+- name: io.k8s.api.scheduling.v1alpha3.CompositePodGroupSpec
+  map:
+    fields:
+    - name: disruptionMode
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.CompositeDisruptionMode
+      default:
+        single: {}
+    - name: parentCompositePodGroupName
+      type:
+        scalar: string
+    - name: preemptionPolicy
+      type:
+        scalar: string
+    - name: priority
+      type:
+        scalar: numeric
+    - name: priorityClassName
+      type:
+        scalar: string
+    - name: schedulingConstraints
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.CompositePodGroupSchedulingConstraints
+    - name: schedulingPolicy
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.CompositePodGroupSchedulingPolicy
+      default: {}
+    - name: workloadRef
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.WorkloadReference
+- name: io.k8s.api.scheduling.v1alpha3.CompositePodGroupStatus
+  map:
+    fields:
+    - name: conditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition
+          elementRelationship: associative
+          keys:
+          - type
+- name: io.k8s.api.scheduling.v1alpha3.CompositePodGroupTemplate
+  map:
+    fields:
+    - name: compositePodGroupTemplates
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.scheduling.v1alpha3.CompositePodGroupTemplate
+          elementRelationship: associative
+          keys:
+          - name
+    - name: disruptionMode
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.CompositeDisruptionMode
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: podGroupTemplates
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.scheduling.v1alpha3.PodGroupTemplate
+          elementRelationship: associative
+          keys:
+          - name
+    - name: preemptionPolicy
+      type:
+        scalar: string
+    - name: priority
+      type:
+        scalar: numeric
+    - name: priorityClassName
+      type:
+        scalar: string
+    - name: schedulingConstraints
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.CompositePodGroupSchedulingConstraints
+    - name: schedulingPolicy
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.CompositePodGroupSchedulingPolicy
+      default: {}
+- name: io.k8s.api.scheduling.v1alpha3.DisruptionMode
+  map:
+    fields:
+    - name: all
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.AllDisruptionMode
+    - name: single
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.SingleDisruptionMode
+    unions:
+    - fields:
+      - fieldName: all
+        discriminatorValue: All
+      - fieldName: single
+        discriminatorValue: Single
+- name: io.k8s.api.scheduling.v1alpha3.GangSchedulingPolicy
+  map:
+    fields:
+    - name: minCount
+      type:
+        scalar: numeric
+      default: 0
+- name: io.k8s.api.scheduling.v1alpha3.PodGroup
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: spec
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.PodGroupSpec
+      default: {}
+    - name: status
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.PodGroupStatus
+      default: {}
+- name: io.k8s.api.scheduling.v1alpha3.PodGroupResourceClaim
+  map:
+    fields:
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: resourceClaimName
+      type:
+        scalar: string
+    - name: resourceClaimTemplateName
+      type:
+        scalar: string
+- name: io.k8s.api.scheduling.v1alpha3.PodGroupResourceClaimStatus
+  map:
+    fields:
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: resourceClaimName
+      type:
+        scalar: string
+- name: io.k8s.api.scheduling.v1alpha3.PodGroupSchedulingConstraints
+  map:
+    fields:
+    - name: topology
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.scheduling.v1alpha3.TopologyConstraint
+          elementRelationship: atomic
+- name: io.k8s.api.scheduling.v1alpha3.PodGroupSchedulingPolicy
+  map:
+    fields:
+    - name: basic
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.BasicSchedulingPolicy
+    - name: gang
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.GangSchedulingPolicy
+    unions:
+    - fields:
+      - fieldName: basic
+        discriminatorValue: Basic
+      - fieldName: gang
+        discriminatorValue: Gang
+- name: io.k8s.api.scheduling.v1alpha3.PodGroupSpec
+  map:
+    fields:
+    - name: disruptionMode
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.DisruptionMode
+      default:
+        single: {}
+    - name: parentCompositePodGroupName
+      type:
+        scalar: string
+    - name: preemptionPolicy
+      type:
+        scalar: string
+    - name: priority
+      type:
+        scalar: numeric
+    - name: priorityClassName
+      type:
+        scalar: string
+    - name: resourceClaims
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.scheduling.v1alpha3.PodGroupResourceClaim
+          elementRelationship: associative
+          keys:
+          - name
+    - name: schedulingConstraints
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.PodGroupSchedulingConstraints
+    - name: schedulingPolicy
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.PodGroupSchedulingPolicy
+      default: {}
+    - name: workloadRef
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.WorkloadReference
+- name: io.k8s.api.scheduling.v1alpha3.PodGroupStatus
+  map:
+    fields:
+    - name: conditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition
+          elementRelationship: associative
+          keys:
+          - type
+    - name: resourceClaimStatuses
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.scheduling.v1alpha3.PodGroupResourceClaimStatus
+          elementRelationship: associative
+          keys:
+          - name
+- name: io.k8s.api.scheduling.v1alpha3.PodGroupTemplate
+  map:
+    fields:
+    - name: disruptionMode
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.DisruptionMode
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: preemptionPolicy
+      type:
+        scalar: string
+    - name: priority
+      type:
+        scalar: numeric
+    - name: priorityClassName
+      type:
+        scalar: string
+    - name: resourceClaims
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.scheduling.v1alpha3.PodGroupResourceClaim
+          elementRelationship: associative
+          keys:
+          - name
+    - name: schedulingConstraints
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.PodGroupSchedulingConstraints
+    - name: schedulingPolicy
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.PodGroupSchedulingPolicy
+      default: {}
+- name: io.k8s.api.scheduling.v1alpha3.SingleCompositeDisruptionMode
+  map:
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_deduced_
+        elementRelationship: separable
+- name: io.k8s.api.scheduling.v1alpha3.SingleDisruptionMode
+  map:
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_deduced_
+        elementRelationship: separable
+- name: io.k8s.api.scheduling.v1alpha3.TopologyConstraint
+  map:
+    fields:
+    - name: key
+      type:
+        scalar: string
+      default: ""
+- name: io.k8s.api.scheduling.v1alpha3.TypedLocalObjectReference
+  map:
+    fields:
+    - name: apiGroup
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+      default: ""
+    - name: name
+      type:
+        scalar: string
+      default: ""
+- name: io.k8s.api.scheduling.v1alpha3.Workload
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: spec
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.WorkloadSpec
+      default: {}
+- name: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupAllDisruptionMode
+  map:
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_deduced_
+        elementRelationship: separable
+- name: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupBasicSchedulingPolicy
+  map:
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_deduced_
+        elementRelationship: separable
+- name: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupDisruptionMode
+  map:
+    fields:
+    - name: all
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupAllDisruptionMode
+    - name: single
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupSingleDisruptionMode
+    unions:
+    - fields:
+      - fieldName: all
+        discriminatorValue: All
+      - fieldName: single
+        discriminatorValue: Single
+- name: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupGangSchedulingPolicy
+  map:
+    fields:
+    - name: minCount
+      type:
+        scalar: numeric
+- name: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupResourceClaim
+  map:
+    fields:
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: resourceClaimName
+      type:
+        scalar: string
+    - name: resourceClaimTemplateName
+      type:
+        scalar: string
+- name: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupSchedulingConstraints
+  map:
+    fields:
+    - name: topology
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.scheduling.v1alpha3.TopologyConstraint
+          elementRelationship: atomic
+- name: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupSchedulingPolicy
+  map:
+    fields:
+    - name: basic
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupBasicSchedulingPolicy
+    - name: gang
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupGangSchedulingPolicy
+    unions:
+    - fields:
+      - fieldName: basic
+        discriminatorValue: Basic
+      - fieldName: gang
+        discriminatorValue: Gang
+- name: io.k8s.api.scheduling.v1alpha3.WorkloadPodGroupSingleDisruptionMode
+  map:
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_deduced_
+        elementRelationship: separable
+- name: io.k8s.api.scheduling.v1alpha3.WorkloadReference
+  map:
+    fields:
+    - name: templateName
+      type:
+        scalar: string
+      default: ""
+    - name: workloadName
+      type:
+        scalar: string
+      default: ""
+- name: io.k8s.api.scheduling.v1alpha3.WorkloadSpec
+  map:
+    fields:
+    - name: compositePodGroupTemplates
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.scheduling.v1alpha3.CompositePodGroupTemplate
+          elementRelationship: associative
+          keys:
+          - name
+    - name: controllerRef
+      type:
+        namedType: io.k8s.api.scheduling.v1alpha3.TypedLocalObjectReference
+    - name: podGroupTemplates
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.scheduling.v1alpha3.PodGroupTemplate
+          elementRelationship: associative
+          keys:
+          - name
+- name: io.k8s.api.scheduling.v1beta1.AllCompositeDisruptionMode
+  map:
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_deduced_
+        elementRelationship: separable
+- name: io.k8s.api.scheduling.v1beta1.AllDisruptionMode
+  map:
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_deduced_
+        elementRelationship: separable
+- name: io.k8s.api.scheduling.v1beta1.BasicSchedulingPolicy
+  map:
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_deduced_
+        elementRelationship: separable
+- name: io.k8s.api.scheduling.v1beta1.CompositeBasicSchedulingPolicy
+  map:
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_deduced_
+        elementRelationship: separable
+- name: io.k8s.api.scheduling.v1beta1.CompositeDisruptionMode
+  map:
+    fields:
+    - name: all
+      type:
+        namedType: io.k8s.api.scheduling.v1beta1.AllCompositeDisruptionMode
+    - name: single
+      type:
+        namedType: io.k8s.api.scheduling.v1beta1.SingleCompositeDisruptionMode
+    unions:
+    - fields:
+      - fieldName: all
+        discriminatorValue: All
+      - fieldName: single
+        discriminatorValue: Single
+- name: io.k8s.api.scheduling.v1beta1.CompositeGangSchedulingPolicy
+  map:
+    fields:
+    - name: minGroupCount
+      type:
+        scalar: numeric
+      default: 0
+- name: io.k8s.api.scheduling.v1beta1.CompositePodGroupSchedulingConstraints
+  map:
+    fields:
+    - name: topology
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.scheduling.v1beta1.TopologyConstraint
+          elementRelationship: atomic
+- name: io.k8s.api.scheduling.v1beta1.CompositePodGroupSchedulingPolicy
+  map:
+    fields:
+    - name: basic
+      type:
+        namedType: io.k8s.api.scheduling.v1beta1.CompositeBasicSchedulingPolicy
+    - name: gang
+      type:
+        namedType: io.k8s.api.scheduling.v1beta1.CompositeGangSchedulingPolicy
+    unions:
+    - fields:
+      - fieldName: basic
+        discriminatorValue: Basic
+      - fieldName: gang
+        discriminatorValue: Gang
+- name: io.k8s.api.scheduling.v1beta1.CompositePodGroupTemplate
+  map:
+    fields:
+    - name: compositePodGroupTemplates
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.scheduling.v1beta1.CompositePodGroupTemplate
+          elementRelationship: associative
+          keys:
+          - name
+    - name: disruptionMode
+      type:
+        namedType: io.k8s.api.scheduling.v1beta1.CompositeDisruptionMode
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: podGroupTemplates
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.scheduling.v1beta1.PodGroupTemplate
+          elementRelationship: associative
+          keys:
+          - name
+    - name: preemptionPolicy
+      type:
+        scalar: string
+    - name: priority
+      type:
+        scalar: numeric
+    - name: priorityClassName
+      type:
+        scalar: string
+    - name: schedulingConstraints
+      type:
+        namedType: io.k8s.api.scheduling.v1beta1.CompositePodGroupSchedulingConstraints
+    - name: schedulingPolicy
+      type:
+        namedType: io.k8s.api.scheduling.v1beta1.CompositePodGroupSchedulingPolicy
+      default: {}
+- name: io.k8s.api.scheduling.v1beta1.DisruptionMode
+  map:
+    fields:
+    - name: all
+      type:
+        namedType: io.k8s.api.scheduling.v1beta1.AllDisruptionMode
+    - name: single
+      type:
+        namedType: io.k8s.api.scheduling.v1beta1.SingleDisruptionMode
+    unions:
+    - fields:
+      - fieldName: all
+        discriminatorValue: All
+      - fieldName: single
+        discriminatorValue: Single
+- name: io.k8s.api.scheduling.v1beta1.GangSchedulingPolicy
+  map:
+    fields:
+    - name: minCount
+      type:
+        scalar: numeric
+      default: 0
+- name: io.k8s.api.scheduling.v1beta1.PodGroup
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: spec
+      type:
+        namedType: io.k8s.api.scheduling.v1beta1.PodGroupSpec
+      default: {}
+    - name: status
+      type:
+        namedType: io.k8s.api.scheduling.v1beta1.PodGroupStatus
+      default: {}
+- name: io.k8s.api.scheduling.v1beta1.PodGroupResourceClaim
   map:
     fields:
     - name: name
@@ -14764,7 +16296,7 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: resourceClaimTemplateName
       type:
         scalar: string
-- name: io.k8s.api.scheduling.v1alpha2.PodGroupResourceClaimStatus
+- name: io.k8s.api.scheduling.v1beta1.PodGroupResourceClaimStatus
   map:
     fields:
     - name: name
@@ -14774,40 +16306,44 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: resourceClaimName
       type:
         scalar: string
-- name: io.k8s.api.scheduling.v1alpha2.PodGroupSchedulingConstraints
+- name: io.k8s.api.scheduling.v1beta1.PodGroupSchedulingConstraints
   map:
     fields:
     - name: topology
       type:
         list:
           elementType:
-            namedType: io.k8s.api.scheduling.v1alpha2.TopologyConstraint
+            namedType: io.k8s.api.scheduling.v1beta1.TopologyConstraint
           elementRelationship: atomic
-- name: io.k8s.api.scheduling.v1alpha2.PodGroupSchedulingPolicy
+- name: io.k8s.api.scheduling.v1beta1.PodGroupSchedulingPolicy
   map:
     fields:
     - name: basic
       type:
-        namedType: io.k8s.api.scheduling.v1alpha2.BasicSchedulingPolicy
+        namedType: io.k8s.api.scheduling.v1beta1.BasicSchedulingPolicy
     - name: gang
       type:
-        namedType: io.k8s.api.scheduling.v1alpha2.GangSchedulingPolicy
+        namedType: io.k8s.api.scheduling.v1beta1.GangSchedulingPolicy
     unions:
     - fields:
       - fieldName: basic
         discriminatorValue: Basic
       - fieldName: gang
         discriminatorValue: Gang
-- name: io.k8s.api.scheduling.v1alpha2.PodGroupSpec
+- name: io.k8s.api.scheduling.v1beta1.PodGroupSpec
   map:
     fields:
     - name: disruptionMode
+      type:
+        namedType: io.k8s.api.scheduling.v1beta1.DisruptionMode
+      default:
+        single: {}
+    - name: parentCompositePodGroupName
       type:
         scalar: string
-      default: Pod
-    - name: podGroupTemplateRef
+    - name: preemptionPolicy
       type:
-        namedType: io.k8s.api.scheduling.v1alpha2.PodGroupTemplateReference
+        scalar: string
     - name: priority
       type:
         scalar: numeric
@@ -14818,18 +16354,21 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         list:
           elementType:
-            namedType: io.k8s.api.scheduling.v1alpha2.PodGroupResourceClaim
+            namedType: io.k8s.api.scheduling.v1beta1.PodGroupResourceClaim
           elementRelationship: associative
           keys:
           - name
     - name: schedulingConstraints
       type:
-        namedType: io.k8s.api.scheduling.v1alpha2.PodGroupSchedulingConstraints
+        namedType: io.k8s.api.scheduling.v1beta1.PodGroupSchedulingConstraints
     - name: schedulingPolicy
       type:
-        namedType: io.k8s.api.scheduling.v1alpha2.PodGroupSchedulingPolicy
+        namedType: io.k8s.api.scheduling.v1beta1.PodGroupSchedulingPolicy
       default: {}
-- name: io.k8s.api.scheduling.v1alpha2.PodGroupStatus
+    - name: workloadRef
+      type:
+        namedType: io.k8s.api.scheduling.v1beta1.WorkloadReference
+- name: io.k8s.api.scheduling.v1beta1.PodGroupStatus
   map:
     fields:
     - name: conditions
@@ -14844,20 +16383,23 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         list:
           elementType:
-            namedType: io.k8s.api.scheduling.v1alpha2.PodGroupResourceClaimStatus
+            namedType: io.k8s.api.scheduling.v1beta1.PodGroupResourceClaimStatus
           elementRelationship: associative
           keys:
           - name
-- name: io.k8s.api.scheduling.v1alpha2.PodGroupTemplate
+- name: io.k8s.api.scheduling.v1beta1.PodGroupTemplate
   map:
     fields:
     - name: disruptionMode
       type:
-        scalar: string
+        namedType: io.k8s.api.scheduling.v1beta1.DisruptionMode
     - name: name
       type:
         scalar: string
       default: ""
+    - name: preemptionPolicy
+      type:
+        scalar: string
     - name: priority
       type:
         scalar: numeric
@@ -14868,35 +16410,75 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         list:
           elementType:
-            namedType: io.k8s.api.scheduling.v1alpha2.PodGroupResourceClaim
+            namedType: io.k8s.api.scheduling.v1beta1.PodGroupResourceClaim
           elementRelationship: associative
           keys:
           - name
     - name: schedulingConstraints
       type:
-        namedType: io.k8s.api.scheduling.v1alpha2.PodGroupSchedulingConstraints
+        namedType: io.k8s.api.scheduling.v1beta1.PodGroupSchedulingConstraints
     - name: schedulingPolicy
       type:
-        namedType: io.k8s.api.scheduling.v1alpha2.PodGroupSchedulingPolicy
+        namedType: io.k8s.api.scheduling.v1beta1.PodGroupSchedulingPolicy
       default: {}
-- name: io.k8s.api.scheduling.v1alpha2.PodGroupTemplateReference
+- name: io.k8s.api.scheduling.v1beta1.PriorityClass
   map:
     fields:
-    - name: workload
+    - name: apiVersion
       type:
-        namedType: io.k8s.api.scheduling.v1alpha2.WorkloadPodGroupTemplateReference
-    unions:
-    - fields:
-      - fieldName: workload
-        discriminatorValue: Workload
-- name: io.k8s.api.scheduling.v1alpha2.TopologyConstraint
+        scalar: string
+    - name: description
+      type:
+        scalar: string
+    - name: globalDefault
+      type:
+        scalar: boolean
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: preemptionPolicy
+      type:
+        scalar: string
+    - name: value
+      type:
+        scalar: numeric
+      default: 0
+- name: io.k8s.api.scheduling.v1beta1.SingleCompositeDisruptionMode
+  map:
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_deduced_
+        elementRelationship: separable
+- name: io.k8s.api.scheduling.v1beta1.SingleDisruptionMode
+  map:
+    elementType:
+      scalar: untyped
+      list:
+        elementType:
+          namedType: __untyped_atomic_
+        elementRelationship: atomic
+      map:
+        elementType:
+          namedType: __untyped_deduced_
+        elementRelationship: separable
+- name: io.k8s.api.scheduling.v1beta1.TopologyConstraint
   map:
     fields:
     - name: key
       type:
         scalar: string
       default: ""
-- name: io.k8s.api.scheduling.v1alpha2.TypedLocalObjectReference
+- name: io.k8s.api.scheduling.v1beta1.TypedLocalObjectReference
   map:
     fields:
     - name: apiGroup
@@ -14910,7 +16492,7 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         scalar: string
       default: ""
-- name: io.k8s.api.scheduling.v1alpha2.Workload
+- name: io.k8s.api.scheduling.v1beta1.Workload
   map:
     fields:
     - name: apiVersion
@@ -14925,12 +16507,12 @@ var schemaYAML = typed.YAMLObject(`types:
       default: {}
     - name: spec
       type:
-        namedType: io.k8s.api.scheduling.v1alpha2.WorkloadSpec
+        namedType: io.k8s.api.scheduling.v1beta1.WorkloadSpec
       default: {}
-- name: io.k8s.api.scheduling.v1alpha2.WorkloadPodGroupTemplateReference
+- name: io.k8s.api.scheduling.v1beta1.WorkloadReference
   map:
     fields:
-    - name: podGroupTemplateName
+    - name: templateName
       type:
         scalar: string
       default: ""
@@ -14938,46 +16520,28 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         scalar: string
       default: ""
-- name: io.k8s.api.scheduling.v1alpha2.WorkloadSpec
+- name: io.k8s.api.scheduling.v1beta1.WorkloadSpec
   map:
     fields:
+    - name: compositePodGroupTemplates
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.scheduling.v1beta1.CompositePodGroupTemplate
+          elementRelationship: associative
+          keys:
+          - name
     - name: controllerRef
       type:
-        namedType: io.k8s.api.scheduling.v1alpha2.TypedLocalObjectReference
+        namedType: io.k8s.api.scheduling.v1beta1.TypedLocalObjectReference
     - name: podGroupTemplates
       type:
         list:
           elementType:
-            namedType: io.k8s.api.scheduling.v1alpha2.PodGroupTemplate
+            namedType: io.k8s.api.scheduling.v1beta1.PodGroupTemplate
           elementRelationship: associative
           keys:
           - name
-- name: io.k8s.api.scheduling.v1beta1.PriorityClass
-  map:
-    fields:
-    - name: apiVersion
-      type:
-        scalar: string
-    - name: description
-      type:
-        scalar: string
-    - name: globalDefault
-      type:
-        scalar: boolean
-    - name: kind
-      type:
-        scalar: string
-    - name: metadata
-      type:
-        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
-      default: {}
-    - name: preemptionPolicy
-      type:
-        scalar: string
-    - name: value
-      type:
-        scalar: numeric
-      default: 0
 - name: io.k8s.api.storage.v1.CSIDriver
   map:
     fields:
@@ -15054,6 +16618,10 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         namedType: io.k8s.api.storage.v1.CSINodeSpec
       default: {}
+    - name: status
+      type:
+        namedType: io.k8s.api.storage.v1.CSINodeStatus
+      default: {}
 - name: io.k8s.api.storage.v1.CSINodeDriver
   map:
     fields:
@@ -15085,6 +16653,17 @@ var schemaYAML = typed.YAMLObject(`types:
           elementRelationship: associative
           keys:
           - name
+- name: io.k8s.api.storage.v1.CSINodeStatus
+  map:
+    fields:
+    - name: storageHealth
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.storage.v1.StorageHealth
+          elementRelationship: associative
+          keys:
+          - name
 - name: io.k8s.api.storage.v1.CSIStorageCapacity
   map:
     fields:
@@ -15154,6 +16733,42 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: volumeBindingMode
       type:
         scalar: string
+- name: io.k8s.api.storage.v1.StorageHealth
+  map:
+    fields:
+    - name: healthConditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.storage.v1.StorageHealthCondition
+          elementRelationship: atomic
+    - name: name
+      type:
+        scalar: string
+      default: ""
+- name: io.k8s.api.storage.v1.StorageHealthCondition
+  map:
+    fields:
+    - name: accessMode
+      type:
+        scalar: string
+    - name: lastTransitionTime
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+    - name: message
+      type:
+        scalar: string
+    - name: reason
+      type:
+        scalar: string
+      default: ""
+    - name: status
+      type:
+        scalar: string
+      default: ""
+    - name: volumeMode
+      type:
+        scalar: string
 - name: io.k8s.api.storage.v1.TokenRequest
   map:
     fields:
@@ -15466,6 +17081,10 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         namedType: io.k8s.api.storage.v1beta1.CSINodeSpec
       default: {}
+    - name: status
+      type:
+        namedType: io.k8s.api.storage.v1beta1.CSINodeStatus
+      default: {}
 - name: io.k8s.api.storage.v1beta1.CSINodeDriver
   map:
     fields:
@@ -15497,6 +17116,17 @@ var schemaYAML = typed.YAMLObject(`types:
           elementRelationship: associative
           keys:
           - name
+- name: io.k8s.api.storage.v1beta1.CSINodeStatus
+  map:
+    fields:
+    - name: storageHealth
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.storage.v1beta1.StorageHealth
+          elementRelationship: associative
+          keys:
+          - name
 - name: io.k8s.api.storage.v1beta1.CSIStorageCapacity
   map:
     fields:
@@ -15566,6 +17196,42 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: volumeBindingMode
       type:
         scalar: string
+- name: io.k8s.api.storage.v1beta1.StorageHealth
+  map:
+    fields:
+    - name: healthConditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.api.storage.v1beta1.StorageHealthCondition
+          elementRelationship: atomic
+    - name: name
+      type:
+        scalar: string
+      default: ""
+- name: io.k8s.api.storage.v1beta1.StorageHealthCondition
+  map:
+    fields:
+    - name: accessMode
+      type:
+        scalar: string
+    - name: lastTransitionTime
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Time
+    - name: message
+      type:
+        scalar: string
+    - name: reason
+      type:
+        scalar: string
+      default: ""
+    - name: status
+      type:
+        scalar: string
+      default: ""
+    - name: volumeMode
+      type:
+        scalar: string
 - name: io.k8s.api.storage.v1beta1.TokenRequest
   map:
     fields:
@@ -15679,6 +17345,48 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: count
       type:
         scalar: numeric
+- name: io.k8s.api.storagemigration.v1.StorageVersionMigration
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: spec
+      type:
+        namedType: io.k8s.api.storagemigration.v1.StorageVersionMigrationSpec
+      default: {}
+    - name: status
+      type:
+        namedType: io.k8s.api.storagemigration.v1.StorageVersionMigrationStatus
+      default: {}
+- name: io.k8s.api.storagemigration.v1.StorageVersionMigrationSpec
+  map:
+    fields:
+    - name: resource
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.GroupResource
+      default: {}
+- name: io.k8s.api.storagemigration.v1.StorageVersionMigrationStatus
+  map:
+    fields:
+    - name: conditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition
+          elementRelationship: associative
+          keys:
+          - type
+    - name: resourceVersion
+      type:
+        scalar: string
 - name: io.k8s.api.storagemigration.v1beta1.StorageVersionMigration
   map:
     fields:
diff --git a/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/eviction.go b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/eviction.go
new file mode 100644
index 0000000000..afcf451205
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/eviction.go
@@ -0,0 +1,327 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	lifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	internal "k8s.io/client-go/applyconfigurations/internal"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// EvictionApplyConfiguration represents a declarative configuration of the Eviction type for use
+// with apply.
+//
+// Eviction initiates an eviction process, which should ideally result in a graceful eviction of a
+// .spec.target (e.g. termination of a pod).
+//
+// The evictionrequest-controller observes intents of all EvictionRequests and transforms them into
+// Evictions. It manages the Eviction lifecycle.
+// Requesters are preserved in .status.requesters even after they have withdrawn their request.
+// If all requesters withdraw their eviction intent for a common target, the eviction will be
+// canceled. Once all EvictionRequest corresponding to this Eviction .spec.target have been
+// removed, this Eviction object will eventually be garbage collected.
+//
+// If the target is a pod, the .status.targetResponders is populated from Pod's
+// .spec.evictionResponders.
+//
+// Responders should observe and communicate through the .status to help with the eviction
+// of the target when they see their state == Active in .status.targetResponders. ResponderStatus
+// struct should then be periodically updated to indicate the progress or completion of the eviction
+// process by each responder in .status.responders. If .status.responders[].heartbeatTime is not
+// updated within the heartbeat deadline defined by the Eviction API (currently 20 minutes), the
+// eviction is passed over to the next responder with a lower priority.
+//
+// If there are no other responders and the target is a pod, the last default
+// imperative-eviction.k8s.io/evictor responder with a priority of 100 will evict the pod using the
+// imperative Eviction API (pods/<name>/eviction subresource).
+type EvictionApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
+	// .metadata.name set by the evictionrequest-controller is purely informative and subject to change.
+	// .spec.target field should be used to identify the target precisesly.
+	//
+	// The requester and responder names will be used as label keys and added to the labels of the
+	// eviction in one of the following formats:
+	// 1. acme.io/foo: "requester"
+	// 2. acme.io/foo: "responder"
+	// 3. acme.io/foo: "requester-responder"
+	//
+	// Please see EvictionParticipantRole for available role label values.
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	// spec defines the eviction specification.
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	Spec *EvictionSpecApplyConfiguration `json:"spec,omitempty"`
+	// status represents the most recently observed status of the eviction.
+	// Populated by responders and evictionrequest-controller.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	Status *EvictionStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// Eviction constructs a declarative configuration of the Eviction type for use with
+// apply.
+func Eviction(name, namespace string) *EvictionApplyConfiguration {
+	b := &EvictionApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("Eviction")
+	b.WithAPIVersion("lifecycle.k8s.io/v1alpha1")
+	return b
+}
+
+// ExtractEvictionFrom extracts the applied configuration owned by fieldManager from
+// eviction for the specified subresource. Pass an empty string for subresource to extract
+// the main resource. Common subresources include "status", "scale", etc.
+// eviction must be a unmodified Eviction API object that was retrieved from the Kubernetes API.
+// ExtractEvictionFrom provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractEvictionFrom(eviction *lifecyclev1alpha1.Eviction, fieldManager string, subresource string) (*EvictionApplyConfiguration, error) {
+	b := &EvictionApplyConfiguration{}
+	err := managedfields.ExtractInto(eviction, internal.Parser().Type("io.k8s.api.lifecycle.v1alpha1.Eviction"), fieldManager, b, subresource)
+	if err != nil {
+		return nil, err
+	}
+	b.WithName(eviction.Name)
+	b.WithNamespace(eviction.Namespace)
+
+	b.WithKind("Eviction")
+	b.WithAPIVersion("lifecycle.k8s.io/v1alpha1")
+	return b, nil
+}
+
+// ExtractEviction extracts the applied configuration owned by fieldManager from
+// eviction. If no managedFields are found in eviction for fieldManager, a
+// EvictionApplyConfiguration is returned with only the Name, Namespace (if applicable),
+// APIVersion and Kind populated. It is possible that no managed fields were found for because other
+// field managers have taken ownership of all the fields previously owned by fieldManager, or because
+// the fieldManager never owned fields any fields.
+// eviction must be a unmodified Eviction API object that was retrieved from the Kubernetes API.
+// ExtractEviction provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractEviction(eviction *lifecyclev1alpha1.Eviction, fieldManager string) (*EvictionApplyConfiguration, error) {
+	return ExtractEvictionFrom(eviction, fieldManager, "")
+}
+
+// ExtractEvictionStatus extracts the applied configuration owned by fieldManager from
+// eviction for the status subresource.
+func ExtractEvictionStatus(eviction *lifecyclev1alpha1.Eviction, fieldManager string) (*EvictionApplyConfiguration, error) {
+	return ExtractEvictionFrom(eviction, fieldManager, "status")
+}
+
+func (b EvictionApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *EvictionApplyConfiguration) WithKind(value string) *EvictionApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *EvictionApplyConfiguration) WithAPIVersion(value string) *EvictionApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *EvictionApplyConfiguration) WithName(value string) *EvictionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *EvictionApplyConfiguration) WithGenerateName(value string) *EvictionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *EvictionApplyConfiguration) WithNamespace(value string) *EvictionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *EvictionApplyConfiguration) WithUID(value types.UID) *EvictionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *EvictionApplyConfiguration) WithResourceVersion(value string) *EvictionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *EvictionApplyConfiguration) WithGeneration(value int64) *EvictionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *EvictionApplyConfiguration) WithCreationTimestamp(value metav1.Time) *EvictionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *EvictionApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *EvictionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *EvictionApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *EvictionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *EvictionApplyConfiguration) WithLabels(entries map[string]string) *EvictionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *EvictionApplyConfiguration) WithAnnotations(entries map[string]string) *EvictionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *EvictionApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *EvictionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *EvictionApplyConfiguration) WithFinalizers(values ...string) *EvictionApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *EvictionApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *EvictionApplyConfiguration) WithSpec(value *EvictionSpecApplyConfiguration) *EvictionApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *EvictionApplyConfiguration) WithStatus(value *EvictionStatusApplyConfiguration) *EvictionApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *EvictionApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *EvictionApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *EvictionApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *EvictionApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionpodreference.go b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionpodreference.go
new file mode 100644
index 0000000000..bc5c6e0f20
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionpodreference.go
@@ -0,0 +1,60 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	types "k8s.io/apimachinery/pkg/types"
+)
+
+// EvictionPodReferenceApplyConfiguration represents a declarative configuration of the EvictionPodReference type for use
+// with apply.
+//
+// EvictionPodReference contains enough information to locate the referenced pod inside the same
+// namespace.
+type EvictionPodReferenceApplyConfiguration struct {
+	// name of the target.
+	// This field is required.
+	Name *string `json:"name,omitempty"`
+	// uid of the target.
+	// It can be found in .metadata.uid of the target and is a lowercase UUID in 8-4-4-4-12 format.
+	// This field is required.
+	UID *types.UID `json:"uid,omitempty"`
+}
+
+// EvictionPodReferenceApplyConfiguration constructs a declarative configuration of the EvictionPodReference type for use with
+// apply.
+func EvictionPodReference() *EvictionPodReferenceApplyConfiguration {
+	return &EvictionPodReferenceApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *EvictionPodReferenceApplyConfiguration) WithName(value string) *EvictionPodReferenceApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *EvictionPodReferenceApplyConfiguration) WithUID(value types.UID) *EvictionPodReferenceApplyConfiguration {
+	b.UID = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionrequest.go b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionrequest.go
new file mode 100644
index 0000000000..66bfeb38fb
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionrequest.go
@@ -0,0 +1,310 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	lifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	internal "k8s.io/client-go/applyconfigurations/internal"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// EvictionRequestApplyConfiguration represents a declarative configuration of the EvictionRequest type for use
+// with apply.
+//
+// EvictionRequest defines a request that should ideally result in a graceful eviction of a
+// .spec.target (e.g. termination of a pod).
+//
+// The evictionrequest-controller observes intents of all EvictionRequests and transforms them into
+// Evictions.
+// - .spec.requester is set as a label on the Eviction for easier lookup.
+// - Each target can have a set of responders assigned to it. Eviction objects are observed by
+// these responders, who implement the eviction logic and update the Eviction's status with
+// progress.
+//
+// There is many-to-many relationship between EvictionRequests and Evictions in general.
+// And many-to-one if the target is a  pod.
+//
+// If all requesters withdraw their eviction intent for a common target, the eviction will be
+// canceled. Deleting an EvictionRequest also counts as a withdrawal.
+// Once all EvictionRequest of a target are removed, the corresponding Evictions are eventually
+// garbage collected.
+type EvictionRequestApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	// spec defines the eviction request specification.
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	Spec *EvictionRequestSpecApplyConfiguration `json:"spec,omitempty"`
+	// status represents the most recently observed status of the eviction request.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	Status *EvictionRequestStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// EvictionRequest constructs a declarative configuration of the EvictionRequest type for use with
+// apply.
+func EvictionRequest(name, namespace string) *EvictionRequestApplyConfiguration {
+	b := &EvictionRequestApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("EvictionRequest")
+	b.WithAPIVersion("lifecycle.k8s.io/v1alpha1")
+	return b
+}
+
+// ExtractEvictionRequestFrom extracts the applied configuration owned by fieldManager from
+// evictionRequest for the specified subresource. Pass an empty string for subresource to extract
+// the main resource. Common subresources include "status", "scale", etc.
+// evictionRequest must be a unmodified EvictionRequest API object that was retrieved from the Kubernetes API.
+// ExtractEvictionRequestFrom provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractEvictionRequestFrom(evictionRequest *lifecyclev1alpha1.EvictionRequest, fieldManager string, subresource string) (*EvictionRequestApplyConfiguration, error) {
+	b := &EvictionRequestApplyConfiguration{}
+	err := managedfields.ExtractInto(evictionRequest, internal.Parser().Type("io.k8s.api.lifecycle.v1alpha1.EvictionRequest"), fieldManager, b, subresource)
+	if err != nil {
+		return nil, err
+	}
+	b.WithName(evictionRequest.Name)
+	b.WithNamespace(evictionRequest.Namespace)
+
+	b.WithKind("EvictionRequest")
+	b.WithAPIVersion("lifecycle.k8s.io/v1alpha1")
+	return b, nil
+}
+
+// ExtractEvictionRequest extracts the applied configuration owned by fieldManager from
+// evictionRequest. If no managedFields are found in evictionRequest for fieldManager, a
+// EvictionRequestApplyConfiguration is returned with only the Name, Namespace (if applicable),
+// APIVersion and Kind populated. It is possible that no managed fields were found for because other
+// field managers have taken ownership of all the fields previously owned by fieldManager, or because
+// the fieldManager never owned fields any fields.
+// evictionRequest must be a unmodified EvictionRequest API object that was retrieved from the Kubernetes API.
+// ExtractEvictionRequest provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractEvictionRequest(evictionRequest *lifecyclev1alpha1.EvictionRequest, fieldManager string) (*EvictionRequestApplyConfiguration, error) {
+	return ExtractEvictionRequestFrom(evictionRequest, fieldManager, "")
+}
+
+// ExtractEvictionRequestStatus extracts the applied configuration owned by fieldManager from
+// evictionRequest for the status subresource.
+func ExtractEvictionRequestStatus(evictionRequest *lifecyclev1alpha1.EvictionRequest, fieldManager string) (*EvictionRequestApplyConfiguration, error) {
+	return ExtractEvictionRequestFrom(evictionRequest, fieldManager, "status")
+}
+
+func (b EvictionRequestApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *EvictionRequestApplyConfiguration) WithKind(value string) *EvictionRequestApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *EvictionRequestApplyConfiguration) WithAPIVersion(value string) *EvictionRequestApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *EvictionRequestApplyConfiguration) WithName(value string) *EvictionRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *EvictionRequestApplyConfiguration) WithGenerateName(value string) *EvictionRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *EvictionRequestApplyConfiguration) WithNamespace(value string) *EvictionRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *EvictionRequestApplyConfiguration) WithUID(value types.UID) *EvictionRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *EvictionRequestApplyConfiguration) WithResourceVersion(value string) *EvictionRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *EvictionRequestApplyConfiguration) WithGeneration(value int64) *EvictionRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *EvictionRequestApplyConfiguration) WithCreationTimestamp(value metav1.Time) *EvictionRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *EvictionRequestApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *EvictionRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *EvictionRequestApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *EvictionRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *EvictionRequestApplyConfiguration) WithLabels(entries map[string]string) *EvictionRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *EvictionRequestApplyConfiguration) WithAnnotations(entries map[string]string) *EvictionRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *EvictionRequestApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *EvictionRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *EvictionRequestApplyConfiguration) WithFinalizers(values ...string) *EvictionRequestApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *EvictionRequestApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *EvictionRequestApplyConfiguration) WithSpec(value *EvictionRequestSpecApplyConfiguration) *EvictionRequestApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *EvictionRequestApplyConfiguration) WithStatus(value *EvictionRequestStatusApplyConfiguration) *EvictionRequestApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *EvictionRequestApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *EvictionRequestApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *EvictionRequestApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *EvictionRequestApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionrequestpodreference.go b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionrequestpodreference.go
new file mode 100644
index 0000000000..4e64868656
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionrequestpodreference.go
@@ -0,0 +1,60 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	types "k8s.io/apimachinery/pkg/types"
+)
+
+// EvictionRequestPodReferenceApplyConfiguration represents a declarative configuration of the EvictionRequestPodReference type for use
+// with apply.
+//
+// EvictionRequestPodReference contains enough information to locate the referenced pod inside the
+// same namespace.
+type EvictionRequestPodReferenceApplyConfiguration struct {
+	// name of the target.
+	// This field is required.
+	Name *string `json:"name,omitempty"`
+	// uid of the target.
+	// It can be found in .metadata.uid of the target and is a lowercase UUID in 8-4-4-4-12 format.
+	// This field is required.
+	UID *types.UID `json:"uid,omitempty"`
+}
+
+// EvictionRequestPodReferenceApplyConfiguration constructs a declarative configuration of the EvictionRequestPodReference type for use with
+// apply.
+func EvictionRequestPodReference() *EvictionRequestPodReferenceApplyConfiguration {
+	return &EvictionRequestPodReferenceApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *EvictionRequestPodReferenceApplyConfiguration) WithName(value string) *EvictionRequestPodReferenceApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *EvictionRequestPodReferenceApplyConfiguration) WithUID(value types.UID) *EvictionRequestPodReferenceApplyConfiguration {
+	b.UID = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionrequestspec.go b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionrequestspec.go
new file mode 100644
index 0000000000..6fc40b8c22
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionrequestspec.go
@@ -0,0 +1,79 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	lifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
+)
+
+// EvictionRequestSpecApplyConfiguration represents a declarative configuration of the EvictionRequestSpec type for use
+// with apply.
+//
+// EvictionRequestSpec is a specification of an EvictionRequest.
+type EvictionRequestSpecApplyConfiguration struct {
+	// target contains a reference to an object (e.g. a pod) that should be evicted.
+	// This field is required and immutable.
+	Target *EvictionRequestTargetApplyConfiguration `json:"target,omitempty"`
+	// requester allows you to identify the entity, that requested the eviction of the target.
+	//
+	// It must be a valid domain-prefixed key (such as "acme.io/foo").
+	// Domain names *.k8s.io and *.kubernetes.io are reserved.
+	// This field is required and immutable.
+	Requester *string `json:"requester,omitempty"`
+	// intent specifies the action that should be taken for the specified target.
+	//
+	// - Eviction means that the requester is interested in the eviction of the target.
+	// - Withdrawn means that the requester is no longer interested in the eviction of the target.
+	// If all requesters' intents are withdrawn for a common target, the eviction will be canceled.
+	// Cancellation consequences:
+	// - Inactive responders will never run.
+	// - Active responders are expected to cancel the eviction.
+	// - Completed or Interrupted responders should not take any action.
+	Intent *lifecyclev1alpha1.EvictionRequestIntent `json:"intent,omitempty"`
+}
+
+// EvictionRequestSpecApplyConfiguration constructs a declarative configuration of the EvictionRequestSpec type for use with
+// apply.
+func EvictionRequestSpec() *EvictionRequestSpecApplyConfiguration {
+	return &EvictionRequestSpecApplyConfiguration{}
+}
+
+// WithTarget sets the Target field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Target field is set to the value of the last call.
+func (b *EvictionRequestSpecApplyConfiguration) WithTarget(value *EvictionRequestTargetApplyConfiguration) *EvictionRequestSpecApplyConfiguration {
+	b.Target = value
+	return b
+}
+
+// WithRequester sets the Requester field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Requester field is set to the value of the last call.
+func (b *EvictionRequestSpecApplyConfiguration) WithRequester(value string) *EvictionRequestSpecApplyConfiguration {
+	b.Requester = &value
+	return b
+}
+
+// WithIntent sets the Intent field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Intent field is set to the value of the last call.
+func (b *EvictionRequestSpecApplyConfiguration) WithIntent(value lifecyclev1alpha1.EvictionRequestIntent) *EvictionRequestSpecApplyConfiguration {
+	b.Intent = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionrequeststatus.go b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionrequeststatus.go
new file mode 100644
index 0000000000..8367990f9c
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionrequeststatus.go
@@ -0,0 +1,75 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// EvictionRequestStatusApplyConfiguration represents a declarative configuration of the EvictionRequestStatus type for use
+// with apply.
+//
+// EvictionRequestStatus represents the last observed status of the eviction request.
+type EvictionRequestStatusApplyConfiguration struct {
+	// conditions contain information about the eviction request.
+	//
+	// EvictionRequest specific conditions are: TargetEvicted or Failed (managed by evictionrequest-controller).
+	// - Failed means that the eviction request is no longer being processed
+	// by any eviction responder. This can happen if the request is canceled or if no responder
+	// managed to evict the target (e.g. terminate or delete a pod).
+	// - TargetEvicted means that the target has been evicted (e.g. a pod has been terminated or deleted).
+	//
+	// These conditions can be reset if the eviction was unsuccessful and a new Eviction intent has
+	// been submitted.
+	//
+	// The maximum length of the conditions list is 100.
+	Conditions []v1.ConditionApplyConfiguration `json:"conditions,omitempty"`
+	// observedGeneration is EvictionRequest's .metadata.generation observed by the evictionrequest-controller.
+	// The observed generation value cannot be negative and can only be incremented.
+	// The minimum value is 1.
+	// This field is managed by evictionrequest-controller.
+	ObservedGeneration *int64 `json:"observedGeneration,omitempty"`
+}
+
+// EvictionRequestStatusApplyConfiguration constructs a declarative configuration of the EvictionRequestStatus type for use with
+// apply.
+func EvictionRequestStatus() *EvictionRequestStatusApplyConfiguration {
+	return &EvictionRequestStatusApplyConfiguration{}
+}
+
+// WithConditions adds the given value to the Conditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Conditions field.
+func (b *EvictionRequestStatusApplyConfiguration) WithConditions(values ...*v1.ConditionApplyConfiguration) *EvictionRequestStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithConditions")
+		}
+		b.Conditions = append(b.Conditions, *values[i])
+	}
+	return b
+}
+
+// WithObservedGeneration sets the ObservedGeneration field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ObservedGeneration field is set to the value of the last call.
+func (b *EvictionRequestStatusApplyConfiguration) WithObservedGeneration(value int64) *EvictionRequestStatusApplyConfiguration {
+	b.ObservedGeneration = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionrequesttarget.go b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionrequesttarget.go
new file mode 100644
index 0000000000..1000dc533a
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionrequesttarget.go
@@ -0,0 +1,43 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// EvictionRequestTargetApplyConfiguration represents a declarative configuration of the EvictionRequestTarget type for use
+// with apply.
+//
+// EvictionRequestTarget contains a reference to an object that should be evicted.
+type EvictionRequestTargetApplyConfiguration struct {
+	// pod references a pod that is subject to eviction/termination.
+	// Pods that are part of a PodGroup (.spec.schedulingGroup is set) are not supported.
+	Pod *EvictionRequestPodReferenceApplyConfiguration `json:"pod,omitempty"`
+}
+
+// EvictionRequestTargetApplyConfiguration constructs a declarative configuration of the EvictionRequestTarget type for use with
+// apply.
+func EvictionRequestTarget() *EvictionRequestTargetApplyConfiguration {
+	return &EvictionRequestTargetApplyConfiguration{}
+}
+
+// WithPod sets the Pod field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Pod field is set to the value of the last call.
+func (b *EvictionRequestTargetApplyConfiguration) WithPod(value *EvictionRequestPodReferenceApplyConfiguration) *EvictionRequestTargetApplyConfiguration {
+	b.Pod = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionspec.go b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionspec.go
new file mode 100644
index 0000000000..4ed00a53bf
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionspec.go
@@ -0,0 +1,43 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// EvictionSpecApplyConfiguration represents a declarative configuration of the EvictionSpec type for use
+// with apply.
+//
+// EvictionSpec is a specification of an Eviction.
+type EvictionSpecApplyConfiguration struct {
+	// target contains a reference to an object (e.g. a pod) that should be evicted.
+	// This field is required and immutable.
+	Target *EvictionTargetApplyConfiguration `json:"target,omitempty"`
+}
+
+// EvictionSpecApplyConfiguration constructs a declarative configuration of the EvictionSpec type for use with
+// apply.
+func EvictionSpec() *EvictionSpecApplyConfiguration {
+	return &EvictionSpecApplyConfiguration{}
+}
+
+// WithTarget sets the Target field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Target field is set to the value of the last call.
+func (b *EvictionSpecApplyConfiguration) WithTarget(value *EvictionTargetApplyConfiguration) *EvictionSpecApplyConfiguration {
+	b.Target = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionstatus.go b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionstatus.go
new file mode 100644
index 0000000000..b6d3a96584
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictionstatus.go
@@ -0,0 +1,147 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// EvictionStatusApplyConfiguration represents a declarative configuration of the EvictionStatus type for use
+// with apply.
+//
+// EvictionStatus represents the last observed status of the eviction request.
+type EvictionStatusApplyConfiguration struct {
+	// conditions contain information about the eviction request.
+	//
+	// Eviction specific conditions are: TargetEvicted or Failed (managed by evictionrequest-controller).
+	// - Failed means that the eviction request is no longer being processed
+	// by any eviction responder. This can happen if the request is canceled or if no responder
+	// managed to evict the target (e.g. terminate or delete a pod).
+	// - TargetEvicted means that the target has been evicted (e.g. a pod has been terminated or deleted).
+	//
+	// The maximum length of the conditions list is 100.
+	Conditions []v1.ConditionApplyConfiguration `json:"conditions,omitempty"`
+	// observedGeneration is Eviction's .metadata.generation observed by the evictionrequest-controller.
+	// The observed generation value cannot be negative and can only be incremented.
+	// The minimum value is 1.
+	// This field is managed by evictionrequest-controller.
+	ObservedGeneration *int64 `json:"observedGeneration,omitempty"`
+	// requesters allow you to identify the entities, that requested the eviction of the target.
+	// If all the requesters withdraw their eviction intent, the eviction will be canceled.
+	//
+	// The maximum length of the requesters list is 100.
+	// If this limit is exceeded, requesters with Withdrawn intent should be dropped first.
+	Requesters []RequesterApplyConfiguration `json:"requesters,omitempty"`
+	// targetResponders reference responders that should eventually respond to this eviction
+	// to help with the graceful eviction of a target. These responders are selected sequentially,
+	// according to their specified priority by setting the Active state to the TargetResponder
+	// .state field. The maximum number of active responders allowed is 1.
+	// Eventually each responder can end up in an Interrupted, Canceled or, Completed state.
+	// Responders should observe these states in order to navigate their lifecycle.
+	//
+	// If the target is a pod, the field is populated from Pod's .spec.evictionResponders. Default
+	// responders may be added to the list according to the target.
+	//
+	// Default responders:
+	// - imperative-eviction.k8s.io/evictor responder with a priority of 100 is added to the list if the
+	// target is a pod. It will call the imperative Eviction API (pods/<name>/eviction subresource).
+	// This call may not succeed due to PodDisruptionBudgets, which may block the pod termination.
+	// It will update the responder message and try again with a backoff.
+	//
+	// The maximum length of the responders list is 11.
+	// The length and keys of the list cannot change once set.
+	// This field is managed by evictionrequest-controller.
+	TargetResponders []TargetResponderApplyConfiguration `json:"targetResponders,omitempty"`
+	// responders represents the eviction process status of each declared responder.
+	//
+	// The responder list should be the same length and have the same .name fields as
+	// .status.targetResponders. Only responders with .name that have Active state in
+	// .targetResponders[].state should be updated and can be mutated. First initialization
+	// of the list is allowed.
+	//
+	// Each ResponderStatus is initialized by evictionrequest-controller and then managed by
+	// the designated responder.
+	Responders []ResponderStatusApplyConfiguration `json:"responders,omitempty"`
+}
+
+// EvictionStatusApplyConfiguration constructs a declarative configuration of the EvictionStatus type for use with
+// apply.
+func EvictionStatus() *EvictionStatusApplyConfiguration {
+	return &EvictionStatusApplyConfiguration{}
+}
+
+// WithConditions adds the given value to the Conditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Conditions field.
+func (b *EvictionStatusApplyConfiguration) WithConditions(values ...*v1.ConditionApplyConfiguration) *EvictionStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithConditions")
+		}
+		b.Conditions = append(b.Conditions, *values[i])
+	}
+	return b
+}
+
+// WithObservedGeneration sets the ObservedGeneration field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ObservedGeneration field is set to the value of the last call.
+func (b *EvictionStatusApplyConfiguration) WithObservedGeneration(value int64) *EvictionStatusApplyConfiguration {
+	b.ObservedGeneration = &value
+	return b
+}
+
+// WithRequesters adds the given value to the Requesters field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Requesters field.
+func (b *EvictionStatusApplyConfiguration) WithRequesters(values ...*RequesterApplyConfiguration) *EvictionStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithRequesters")
+		}
+		b.Requesters = append(b.Requesters, *values[i])
+	}
+	return b
+}
+
+// WithTargetResponders adds the given value to the TargetResponders field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the TargetResponders field.
+func (b *EvictionStatusApplyConfiguration) WithTargetResponders(values ...*TargetResponderApplyConfiguration) *EvictionStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithTargetResponders")
+		}
+		b.TargetResponders = append(b.TargetResponders, *values[i])
+	}
+	return b
+}
+
+// WithResponders adds the given value to the Responders field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Responders field.
+func (b *EvictionStatusApplyConfiguration) WithResponders(values ...*ResponderStatusApplyConfiguration) *EvictionStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithResponders")
+		}
+		b.Responders = append(b.Responders, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictiontarget.go b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictiontarget.go
new file mode 100644
index 0000000000..ff353caebb
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/evictiontarget.go
@@ -0,0 +1,43 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// EvictionTargetApplyConfiguration represents a declarative configuration of the EvictionTarget type for use
+// with apply.
+//
+// EvictionTarget contains a reference to an object that should be evicted.
+type EvictionTargetApplyConfiguration struct {
+	// pod references a pod that is subject to eviction/termination.
+	// Pods that are part of a PodGroup (.spec.schedulingGroup is set) are not supported.
+	Pod *EvictionPodReferenceApplyConfiguration `json:"pod,omitempty"`
+}
+
+// EvictionTargetApplyConfiguration constructs a declarative configuration of the EvictionTarget type for use with
+// apply.
+func EvictionTarget() *EvictionTargetApplyConfiguration {
+	return &EvictionTargetApplyConfiguration{}
+}
+
+// WithPod sets the Pod field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Pod field is set to the value of the last call.
+func (b *EvictionTargetApplyConfiguration) WithPod(value *EvictionPodReferenceApplyConfiguration) *EvictionTargetApplyConfiguration {
+	b.Pod = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/requester.go b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/requester.go
new file mode 100644
index 0000000000..3991be03ea
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/requester.go
@@ -0,0 +1,68 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	lifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
+)
+
+// RequesterApplyConfiguration represents a declarative configuration of the Requester type for use
+// with apply.
+//
+// Requester allows you to identify the entity, that requested the eviction of the target.
+type RequesterApplyConfiguration struct {
+	// name allows you to identify the entity, that requested the eviction of the target.
+	//
+	// It must be a valid domain-prefixed key (such as "acme.io/foo").
+	// This field must be unique for each requester.
+	// This field is required.
+	Name *string `json:"name,omitempty"`
+	// intent specifies the action that should be taken for the specified target.
+	//
+	// - Eviction means that the requester is interested in the eviction of the target.
+	// - Withdrawn means that the requester is no longer interested in the eviction of the target.
+	// If all requesters' intents are withdrawn, the eviction will be canceled.
+	// Cancellation consequences:
+	// - Inactive responders will never run.
+	// - Active responders are expected to cancel the eviction.
+	// - Completed or Interrupted responders should not take any action.
+	Intent *lifecyclev1alpha1.RequesterIntent `json:"intent,omitempty"`
+}
+
+// RequesterApplyConfiguration constructs a declarative configuration of the Requester type for use with
+// apply.
+func Requester() *RequesterApplyConfiguration {
+	return &RequesterApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *RequesterApplyConfiguration) WithName(value string) *RequesterApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithIntent sets the Intent field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Intent field is set to the value of the last call.
+func (b *RequesterApplyConfiguration) WithIntent(value lifecyclev1alpha1.RequesterIntent) *RequesterApplyConfiguration {
+	b.Intent = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/responderstatus.go b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/responderstatus.go
new file mode 100644
index 0000000000..e7d41d6670
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/responderstatus.go
@@ -0,0 +1,118 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// ResponderStatusApplyConfiguration represents a declarative configuration of the ResponderStatus type for use
+// with apply.
+//
+// ResponderStatus represents the last observed status of the eviction process of the responder.
+// It should be only updated by the designated responder whose name is .name field.
+type ResponderStatusApplyConfiguration struct {
+	// name allows you to identify the responder reacting to the Eviction.
+	//
+	// It must be a valid domain-prefixed key (such as "acme.io/foo").
+	// This field is initialized by Kubernetes and must be unique for each responder.
+	// This field is required.
+	Name *string `json:"name,omitempty"`
+	// startTime tracks the time at which this responder was designated as active and should start
+	// processing the eviction request.
+	// It should reflect the present time when set.
+	// This field is initialized by Kubernetes when this responder becomes active.
+	// This field becomes immutable once set.
+	StartTime *v1.Time `json:"startTime,omitempty"`
+	// heartbeatTime is the last time at which the eviction process was reported to be in progress
+	// by the responder.
+	// It should reflect the present time when set.
+	// Responders should avoid heartbeats more frequent than 20 seconds to avoid overloading the
+	// control-plane.
+	HeartbeatTime *v1.Time `json:"heartbeatTime,omitempty"`
+	// expectedCompletionTime is the time at which the eviction process step is expected to end for the
+	// responder.
+	// The time cannot be set to the past.
+	// May be omitted if no estimate can be made.
+	ExpectedCompletionTime *v1.Time `json:"expectedCompletionTime,omitempty"`
+	// completionTime tracks the time at which the Responder stopped processing the eviction request.
+	// Completion means that the responders has either fully or partially completed the
+	// eviction process, which may have resulted in target eviction (e.g. pod termination).
+	// It should reflect the present time when set.
+	// This field becomes immutable once set.
+	CompletionTime *v1.Time `json:"completionTime,omitempty"`
+	// message provides human-readable details about the state of the responder and the eviction
+	// process.
+	// Maximum length is 4000 characters.
+	Message *string `json:"message,omitempty"`
+}
+
+// ResponderStatusApplyConfiguration constructs a declarative configuration of the ResponderStatus type for use with
+// apply.
+func ResponderStatus() *ResponderStatusApplyConfiguration {
+	return &ResponderStatusApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ResponderStatusApplyConfiguration) WithName(value string) *ResponderStatusApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithStartTime sets the StartTime field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the StartTime field is set to the value of the last call.
+func (b *ResponderStatusApplyConfiguration) WithStartTime(value v1.Time) *ResponderStatusApplyConfiguration {
+	b.StartTime = &value
+	return b
+}
+
+// WithHeartbeatTime sets the HeartbeatTime field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the HeartbeatTime field is set to the value of the last call.
+func (b *ResponderStatusApplyConfiguration) WithHeartbeatTime(value v1.Time) *ResponderStatusApplyConfiguration {
+	b.HeartbeatTime = &value
+	return b
+}
+
+// WithExpectedCompletionTime sets the ExpectedCompletionTime field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ExpectedCompletionTime field is set to the value of the last call.
+func (b *ResponderStatusApplyConfiguration) WithExpectedCompletionTime(value v1.Time) *ResponderStatusApplyConfiguration {
+	b.ExpectedCompletionTime = &value
+	return b
+}
+
+// WithCompletionTime sets the CompletionTime field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CompletionTime field is set to the value of the last call.
+func (b *ResponderStatusApplyConfiguration) WithCompletionTime(value v1.Time) *ResponderStatusApplyConfiguration {
+	b.CompletionTime = &value
+	return b
+}
+
+// WithMessage sets the Message field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Message field is set to the value of the last call.
+func (b *ResponderStatusApplyConfiguration) WithMessage(value string) *ResponderStatusApplyConfiguration {
+	b.Message = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/targetresponder.go b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/targetresponder.go
new file mode 100644
index 0000000000..a04690e787
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1/targetresponder.go
@@ -0,0 +1,102 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	lifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
+)
+
+// TargetResponderApplyConfiguration represents a declarative configuration of the TargetResponder type for use
+// with apply.
+//
+// TargetResponder allows you to specify the responder reacting to the Eviction.
+// Responders should observe and communicate through the Eviction API (see .state) to help
+// with the graceful eviction of a target (e.g. termination of a pod).
+type TargetResponderApplyConfiguration struct {
+	// name allows you to identify the responder reacting to the Eviction.
+	//
+	// It must be a valid domain-prefixed key (such as "acme.io/foo").
+	// This field must be unique for each responder.
+	// This field is required.
+	Name *string `json:"name,omitempty"`
+	// priority for this responder. Higher priorities are selected first by the evictionrequest-controller.
+	// If there are responders with the same priority, the responder whose domain name comes first in the
+	// alphabetical higher domain order, will be picked. This means that the top domain labels are compared
+	// alphabetically first, followed by the lower domain labels. The key is compared last.
+	//
+	// The responder that is the managing controller of the pod should set the value of
+	// this field to 10000 to allow both for preemption or fallback registration by other
+	// responders.
+	//
+	// The minimum value is 0 and the maximum value is 100000.
+	// The interval 0-999 is reserved for responders with *.k8s.io suffix.
+	// This field is required and immutable.
+	Priority *int32 `json:"priority,omitempty"`
+	// state specifies a state that is assigned by the evictionrequest-controller. Responders should observe
+	// this state in order to navigate their lifecycle.
+	// - Inactive means that the responder should not yet process this eviction request.
+	// - Active means that the responder is either running or expected to start soon.
+	// Also, startTime has been set in the ResponderStatus by the evictionrequest-controller.
+	//
+	// An active responder should currently interact with the eviction process by updating
+	// .status.responders, where .name is the active responder name. ResponderStatus fields
+	// should be periodically updated to indicate the progress or completion of the eviction process.
+	// If .status.responders[].heartbeatTime field is not updated within the heartbeat deadline defined
+	// by the Eviction API (currently 20 minutes), the eviction is passed over to the next responder
+	// with a lower priority. Only one responder can be active at a time.
+	// - Interrupted means that the responder has failed to start or failed to update
+	// heartbeatTime in ResponderStatus in a timely manner.
+	// - Canceled means that the responder has been canceled. In other words, there	is no
+	// EvictionRequest with the same target and Eviction intent in .spec.intent.
+	// - Completed means that the responder has successfully completed and set completionTime
+	// in ResponderStatus.
+	//
+	// Please refer to the ResponderStatus in .status.responders for more details on each responder.
+	State *lifecyclev1alpha1.ResponderStateType `json:"state,omitempty"`
+}
+
+// TargetResponderApplyConfiguration constructs a declarative configuration of the TargetResponder type for use with
+// apply.
+func TargetResponder() *TargetResponderApplyConfiguration {
+	return &TargetResponderApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *TargetResponderApplyConfiguration) WithName(value string) *TargetResponderApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithPriority sets the Priority field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Priority field is set to the value of the last call.
+func (b *TargetResponderApplyConfiguration) WithPriority(value int32) *TargetResponderApplyConfiguration {
+	b.Priority = &value
+	return b
+}
+
+// WithState sets the State field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the State field is set to the value of the last call.
+func (b *TargetResponderApplyConfiguration) WithState(value lifecyclev1alpha1.ResponderStateType) *TargetResponderApplyConfiguration {
+	b.State = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/meta/v1/condition.go b/vendor/k8s.io/client-go/applyconfigurations/meta/v1/condition.go
index 6b0a44312b..11e0260ab8 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/meta/v1/condition.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/meta/v1/condition.go
@@ -36,6 +36,9 @@ import (
 // // +patchStrategy=merge
 // // +listType=map
 // // +listMapKey=type
+// // +k8s:alpha(since: "1.37")=+k8s:optional
+// // +k8s:alpha(since: "1.37")=+k8s:listType=map
+// // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type
 // Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
 //
 // // other fields
diff --git a/vendor/k8s.io/client-go/applyconfigurations/meta/v1/deleteoptions.go b/vendor/k8s.io/client-go/applyconfigurations/meta/v1/deleteoptions.go
index ed4c4bfa50..0679f1c8f1 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/meta/v1/deleteoptions.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/meta/v1/deleteoptions.go
@@ -27,7 +27,7 @@ import (
 //
 // DeleteOptions may be provided when deleting an API object.
 type DeleteOptionsApplyConfiguration struct {
-	TypeMetaApplyConfiguration `json:",inline"`
+	TypeMetaApplyConfiguration `json:""`
 	// The duration in seconds before the object should be deleted. Value must be non-negative integer.
 	// The value zero indicates delete immediately. If this value is nil, the default grace period for the
 	// specified type will be used.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingress.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingress.go
index e6bb92050b..dad98cc876 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingress.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingress.go
@@ -35,8 +35,8 @@ import (
 // externally-reachable urls, load balance traffic, terminate SSL, offer name
 // based virtual hosting etc.
 type IngressApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec is the desired state of the Ingress.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingressclass.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingressclass.go
index 387e45728b..69da66c6c9 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingressclass.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingressclass.go
@@ -36,8 +36,8 @@ import (
 // single IngressClass resource has this annotation set to true, new Ingress
 // resources without a class specified will be assigned this default class.
 type IngressClassApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec is the desired state of the IngressClass.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingressrule.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingressrule.go
index e77494d869..7a8ffbf8bd 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingressrule.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingressrule.go
@@ -53,7 +53,7 @@ type IngressRuleApplyConfiguration struct {
 	// just traffic matching the host to the default backend or all traffic to the
 	// default backend, is left to the controller fulfilling the Ingress. Http is
 	// currently the only supported IngressRuleValue.
-	IngressRuleValueApplyConfiguration `json:",inline"`
+	IngressRuleValueApplyConfiguration `json:""`
 }
 
 // IngressRuleApplyConfiguration constructs a declarative configuration of the IngressRule type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingressrulevalue.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingressrulevalue.go
index c1ca4853e2..198899ee68 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingressrulevalue.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ingressrulevalue.go
@@ -26,6 +26,7 @@ package v1
 // mixing different types of rules in a single Ingress is disallowed, so exactly
 // one of the following must be set.
 type IngressRuleValueApplyConfiguration struct {
+	// http is a HTTP IngressRuleValue, which contains a list of http selectors
 	HTTP *HTTPIngressRuleValueApplyConfiguration `json:"http,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ipaddress.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ipaddress.go
index c0e4298aa3..8f73ecac7a 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ipaddress.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ipaddress.go
@@ -38,8 +38,8 @@ import (
 // Valid: 192.168.1.5 or 2001:db8::1 or 2001:db8:aaaa:bbbb:cccc:dddd:eeee:1
 // Invalid: 10.01.2.3 or 2001:db8:0:0:0::1
 type IPAddressApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec is the desired state of the IPAddress.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ipaddressspec.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ipaddressspec.go
index e9dce93b64..30bb1dbea4 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ipaddressspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/ipaddressspec.go
@@ -23,7 +23,7 @@ package v1
 //
 // IPAddressSpec describe the attributes in an IP Address.
 type IPAddressSpecApplyConfiguration struct {
-	// ParentRef references the resource that an IPAddress is attached to.
+	// parentRef references the resource that an IPAddress is attached to.
 	// An IPAddress must reference a parent object.
 	ParentRef *ParentReferenceApplyConfiguration `json:"parentRef,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/networkpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/networkpolicy.go
index f3e1e1e5ed..be8b78720d 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/networkpolicy.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/networkpolicy.go
@@ -32,8 +32,8 @@ import (
 //
 // NetworkPolicy describes what network traffic is allowed for a set of Pods
 type NetworkPolicyApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec represents the specification of the desired behavior for this NetworkPolicy.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/parentreference.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/parentreference.go
index c725e697b0..34756f07e2 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/parentreference.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/parentreference.go
@@ -23,13 +23,13 @@ package v1
 //
 // ParentReference describes a reference to a parent object.
 type ParentReferenceApplyConfiguration struct {
-	// Group is the group of the object being referenced.
+	// group is the group of the object being referenced.
 	Group *string `json:"group,omitempty"`
-	// Resource is the resource of the object being referenced.
+	// resource is the resource of the object being referenced.
 	Resource *string `json:"resource,omitempty"`
-	// Namespace is the namespace of the object being referenced.
+	// namespace is the namespace of the object being referenced.
 	Namespace *string `json:"namespace,omitempty"`
-	// Name is the name of the object being referenced.
+	// name is the name of the object being referenced.
 	Name *string `json:"name,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/servicecidr.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/servicecidr.go
index 8eede13e36..158ca7f925 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/servicecidr.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/servicecidr.go
@@ -33,8 +33,8 @@ import (
 // ServiceCIDR defines a range of IP addresses using CIDR format (e.g. 192.168.0.0/24 or 2001:db2::/64).
 // This range is used to allocate ClusterIPs to Service objects.
 type ServiceCIDRApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec is the desired state of the ServiceCIDR.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/servicecidrspec.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/servicecidrspec.go
index 9372a162bd..0844008346 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1/servicecidrspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1/servicecidrspec.go
@@ -23,7 +23,7 @@ package v1
 //
 // ServiceCIDRSpec define the CIDRs the user wants to use for allocating ClusterIPs for Services.
 type ServiceCIDRSpecApplyConfiguration struct {
-	// CIDRs defines the IP blocks in CIDR notation (e.g. "192.168.0.0/24" or "2001:db8::/64")
+	// cidrs defines the IP blocks in CIDR notation (e.g. "192.168.0.0/24" or "2001:db8::/64")
 	// from which to assign service cluster IPs. Max of two CIDRs is allowed, one of each IP family.
 	// This field is immutable.
 	CIDRs []string `json:"cidrs,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingress.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingress.go
index 061c29c992..d2144ed9bb 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingress.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingress.go
@@ -35,8 +35,8 @@ import (
 // externally-reachable urls, load balance traffic, terminate SSL, offer name
 // based virtual hosting etc.
 type IngressApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec is the desired state of the Ingress.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingressclass.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingressclass.go
index c4d6df50b4..30882d4ad5 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingressclass.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingressclass.go
@@ -36,8 +36,8 @@ import (
 // single IngressClass resource has this annotation set to true, new Ingress
 // resources without a class specified will be assigned this default class.
 type IngressClassApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec is the desired state of the IngressClass.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingressrule.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingressrule.go
index 6c8b973ed0..b84026d674 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingressrule.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingressrule.go
@@ -53,7 +53,7 @@ type IngressRuleApplyConfiguration struct {
 	// just traffic matching the host to the default backend or all traffic to the
 	// default backend, is left to the controller fulfilling the Ingress. Http is
 	// currently the only supported IngressRuleValue.
-	IngressRuleValueApplyConfiguration `json:",inline"`
+	IngressRuleValueApplyConfiguration `json:""`
 }
 
 // IngressRuleApplyConfiguration constructs a declarative configuration of the IngressRule type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingressrulevalue.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingressrulevalue.go
index 502384fa3d..e215effaf0 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingressrulevalue.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ingressrulevalue.go
@@ -26,6 +26,7 @@ package v1beta1
 // mixing different types of rules in a single Ingress is disallowed, so exactly
 // one of the following must be set.
 type IngressRuleValueApplyConfiguration struct {
+	// http is a HTTP IngressRuleValue, which contains a list of http selectors
 	HTTP *HTTPIngressRuleValueApplyConfiguration `json:"http,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ipaddress.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ipaddress.go
index 28167f1f4c..10919a97ae 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ipaddress.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ipaddress.go
@@ -38,8 +38,8 @@ import (
 // Valid: 192.168.1.5 or 2001:db8::1 or 2001:db8:aaaa:bbbb:cccc:dddd:eeee:1
 // Invalid: 10.01.2.3 or 2001:db8:0:0:0::1
 type IPAddressApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec is the desired state of the IPAddress.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ipaddressspec.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ipaddressspec.go
index c0c012aaa6..7218076ba3 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ipaddressspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/ipaddressspec.go
@@ -23,7 +23,7 @@ package v1beta1
 //
 // IPAddressSpec describe the attributes in an IP Address.
 type IPAddressSpecApplyConfiguration struct {
-	// ParentRef references the resource that an IPAddress is attached to.
+	// parentRef references the resource that an IPAddress is attached to.
 	// An IPAddress must reference a parent object.
 	ParentRef *ParentReferenceApplyConfiguration `json:"parentRef,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/parentreference.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/parentreference.go
index edcc3b95d3..9acf5f7478 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/parentreference.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/parentreference.go
@@ -23,13 +23,13 @@ package v1beta1
 //
 // ParentReference describes a reference to a parent object.
 type ParentReferenceApplyConfiguration struct {
-	// Group is the group of the object being referenced.
+	// group is the group of the object being referenced.
 	Group *string `json:"group,omitempty"`
-	// Resource is the resource of the object being referenced.
+	// resource is the resource of the object being referenced.
 	Resource *string `json:"resource,omitempty"`
-	// Namespace is the namespace of the object being referenced.
+	// namespace is the namespace of the object being referenced.
 	Namespace *string `json:"namespace,omitempty"`
-	// Name is the name of the object being referenced.
+	// name is the name of the object being referenced.
 	Name *string `json:"name,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/servicecidr.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/servicecidr.go
index 07281de616..68704740c9 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/servicecidr.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/servicecidr.go
@@ -33,8 +33,8 @@ import (
 // ServiceCIDR defines a range of IP addresses using CIDR format (e.g. 192.168.0.0/24 or 2001:db2::/64).
 // This range is used to allocate ClusterIPs to Service objects.
 type ServiceCIDRApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec is the desired state of the ServiceCIDR.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/servicecidrspec.go b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/servicecidrspec.go
index 7652700e2a..890dd1410f 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/servicecidrspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/networking/v1beta1/servicecidrspec.go
@@ -23,7 +23,7 @@ package v1beta1
 //
 // ServiceCIDRSpec define the CIDRs the user wants to use for allocating ClusterIPs for Services.
 type ServiceCIDRSpecApplyConfiguration struct {
-	// CIDRs defines the IP blocks in CIDR notation (e.g. "192.168.0.0/24" or "2001:db8::/64")
+	// cidrs defines the IP blocks in CIDR notation (e.g. "192.168.0.0/24" or "2001:db8::/64")
 	// from which to assign service cluster IPs. Max of two CIDRs is allowed, one of each IP family.
 	// This field is immutable.
 	CIDRs []string `json:"cidrs,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/node/v1/runtimeclass.go b/vendor/k8s.io/client-go/applyconfigurations/node/v1/runtimeclass.go
index 6b33701cab..3a05a98942 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/node/v1/runtimeclass.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/node/v1/runtimeclass.go
@@ -38,7 +38,8 @@ import (
 // pod.  For more details, see
 // https://kubernetes.io/docs/concepts/containers/runtime-class/
 type RuntimeClassApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// handler specifies the underlying runtime and configuration that the CRI
diff --git a/vendor/k8s.io/client-go/applyconfigurations/node/v1alpha1/runtimeclass.go b/vendor/k8s.io/client-go/applyconfigurations/node/v1alpha1/runtimeclass.go
index 5fbf9a649a..da0736e769 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/node/v1alpha1/runtimeclass.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/node/v1alpha1/runtimeclass.go
@@ -38,7 +38,8 @@ import (
 // pod.  For more details, see
 // https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
 type RuntimeClassApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec represents specification of the RuntimeClass
diff --git a/vendor/k8s.io/client-go/applyconfigurations/node/v1beta1/runtimeclass.go b/vendor/k8s.io/client-go/applyconfigurations/node/v1beta1/runtimeclass.go
index fc75967fc0..a7d34d2c90 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/node/v1beta1/runtimeclass.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/node/v1beta1/runtimeclass.go
@@ -38,7 +38,8 @@ import (
 // pod.  For more details, see
 // https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
 type RuntimeClassApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// handler specifies the underlying runtime and configuration that the CRI
diff --git a/vendor/k8s.io/client-go/applyconfigurations/policy/v1/eviction.go b/vendor/k8s.io/client-go/applyconfigurations/policy/v1/eviction.go
index bd944a5e8b..a229524661 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/policy/v1/eviction.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/policy/v1/eviction.go
@@ -34,10 +34,10 @@ import (
 // This is a subresource of Pod.  A request to cause such an eviction is
 // created by POSTing to .../pods/<pod name>/evictions.
 type EvictionApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// ObjectMeta describes the pod that is being evicted.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata describes the pod that is being evicted.
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// DeleteOptions may be provided
+	// deleteOptions may be provided
 	DeleteOptions *metav1.DeleteOptionsApplyConfiguration `json:"deleteOptions,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/policy/v1/poddisruptionbudget.go b/vendor/k8s.io/client-go/applyconfigurations/policy/v1/poddisruptionbudget.go
index c9d4fd1a60..84f01bb1c7 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/policy/v1/poddisruptionbudget.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/policy/v1/poddisruptionbudget.go
@@ -32,13 +32,13 @@ import (
 //
 // PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods
 type PodDisruptionBudgetApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Specification of the desired behavior of the PodDisruptionBudget.
+	// spec is the specification of the desired behavior of the PodDisruptionBudget.
 	Spec *PodDisruptionBudgetSpecApplyConfiguration `json:"spec,omitempty"`
-	// Most recently observed status of the PodDisruptionBudget.
+	// status is the most recently observed status of the PodDisruptionBudget.
 	Status *PodDisruptionBudgetStatusApplyConfiguration `json:"status,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/policy/v1/poddisruptionbudgetspec.go b/vendor/k8s.io/client-go/applyconfigurations/policy/v1/poddisruptionbudgetspec.go
index 0d2307332b..acc995b330 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/policy/v1/poddisruptionbudgetspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/policy/v1/poddisruptionbudgetspec.go
@@ -29,22 +29,22 @@ import (
 //
 // PodDisruptionBudgetSpec is a description of a PodDisruptionBudget.
 type PodDisruptionBudgetSpecApplyConfiguration struct {
-	// An eviction is allowed if at least "minAvailable" pods selected by
+	// minAvailable indicates that an eviction is allowed if at least "minAvailable" pods selected by
 	// "selector" will still be available after the eviction, i.e. even in the
 	// absence of the evicted pod.  So for example you can prevent all voluntary
 	// evictions by specifying "100%".
 	MinAvailable *intstr.IntOrString `json:"minAvailable,omitempty"`
-	// Label query over pods whose evictions are managed by the disruption
+	// selector is a label query over pods whose evictions are managed by the disruption
 	// budget.
 	// A null selector will match no pods, while an empty ({}) selector will select
 	// all pods within the namespace.
 	Selector *metav1.LabelSelectorApplyConfiguration `json:"selector,omitempty"`
-	// An eviction is allowed if at most "maxUnavailable" pods selected by
+	// maxUnavailable indicates that an eviction is allowed if at most "maxUnavailable" pods selected by
 	// "selector" are unavailable after the eviction, i.e. even in absence of
 	// the evicted pod. For example, one can prevent all voluntary evictions
 	// by specifying 0. This is a mutually exclusive setting with "minAvailable".
 	MaxUnavailable *intstr.IntOrString `json:"maxUnavailable,omitempty"`
-	// UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
+	// unhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
 	// should be considered for eviction. Current implementation considers healthy pods,
 	// as pods that have status.conditions item with type="Ready",status="True".
 	//
diff --git a/vendor/k8s.io/client-go/applyconfigurations/policy/v1beta1/eviction.go b/vendor/k8s.io/client-go/applyconfigurations/policy/v1beta1/eviction.go
index eeadbbcb7d..333b0869fa 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/policy/v1beta1/eviction.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/policy/v1beta1/eviction.go
@@ -34,10 +34,10 @@ import (
 // This is a subresource of Pod.  A request to cause such an eviction is
 // created by POSTing to .../pods/<pod name>/evictions.
 type EvictionApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// ObjectMeta describes the pod that is being evicted.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata describes the pod that is being evicted.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// DeleteOptions may be provided
+	// deleteOptions may be provided
 	DeleteOptions *v1.DeleteOptionsApplyConfiguration `json:"deleteOptions,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/policy/v1beta1/poddisruptionbudget.go b/vendor/k8s.io/client-go/applyconfigurations/policy/v1beta1/poddisruptionbudget.go
index ca2d839daa..54ee768948 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/policy/v1beta1/poddisruptionbudget.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/policy/v1beta1/poddisruptionbudget.go
@@ -32,13 +32,13 @@ import (
 //
 // PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods
 type PodDisruptionBudgetApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Specification of the desired behavior of the PodDisruptionBudget.
+	// spec is the specification of the desired behavior of the PodDisruptionBudget.
 	Spec *PodDisruptionBudgetSpecApplyConfiguration `json:"spec,omitempty"`
-	// Most recently observed status of the PodDisruptionBudget.
+	// status is the most recently observed status of the PodDisruptionBudget.
 	Status *PodDisruptionBudgetStatusApplyConfiguration `json:"status,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/policy/v1beta1/poddisruptionbudgetspec.go b/vendor/k8s.io/client-go/applyconfigurations/policy/v1beta1/poddisruptionbudgetspec.go
index 1fe247b489..28914430f3 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/policy/v1beta1/poddisruptionbudgetspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/policy/v1beta1/poddisruptionbudgetspec.go
@@ -29,23 +29,23 @@ import (
 //
 // PodDisruptionBudgetSpec is a description of a PodDisruptionBudget.
 type PodDisruptionBudgetSpecApplyConfiguration struct {
-	// An eviction is allowed if at least "minAvailable" pods selected by
+	// minAvailable indicates that an eviction is allowed if at least "minAvailable" pods selected by
 	// "selector" will still be available after the eviction, i.e. even in the
 	// absence of the evicted pod.  So for example you can prevent all voluntary
 	// evictions by specifying "100%".
 	MinAvailable *intstr.IntOrString `json:"minAvailable,omitempty"`
-	// Label query over pods whose evictions are managed by the disruption
+	// selector is a label query over pods whose evictions are managed by the disruption
 	// budget.
 	// A null selector selects no pods.
 	// An empty selector ({}) also selects no pods, which differs from standard behavior of selecting all pods.
 	// In policy/v1, an empty selector will select all pods in the namespace.
 	Selector *v1.LabelSelectorApplyConfiguration `json:"selector,omitempty"`
-	// An eviction is allowed if at most "maxUnavailable" pods selected by
+	// maxUnavailable indicates that an eviction is allowed if at most "maxUnavailable" pods selected by
 	// "selector" are unavailable after the eviction, i.e. even in absence of
 	// the evicted pod. For example, one can prevent all voluntary evictions
 	// by specifying 0. This is a mutually exclusive setting with "minAvailable".
 	MaxUnavailable *intstr.IntOrString `json:"maxUnavailable,omitempty"`
-	// UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
+	// unhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
 	// should be considered for eviction. Current implementation considers healthy pods,
 	// as pods that have status.conditions item with type="Ready",status="True".
 	//
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/aggregationrule.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/aggregationrule.go
index 6f44e79795..572b477410 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/aggregationrule.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/aggregationrule.go
@@ -27,7 +27,7 @@ import (
 //
 // AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
 type AggregationRuleApplyConfiguration struct {
-	// ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
+	// clusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
 	// If any of the selectors match, then the ClusterRole's permissions will be added
 	ClusterRoleSelectors []metav1.LabelSelectorApplyConfiguration `json:"clusterRoleSelectors,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/clusterrole.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/clusterrole.go
index d65387e249..2f8395cf21 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/clusterrole.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/clusterrole.go
@@ -32,12 +32,12 @@ import (
 //
 // ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
 type ClusterRoleApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Rules holds all the PolicyRules for this ClusterRole
+	// rules holds all the PolicyRules for this ClusterRole
 	Rules []PolicyRuleApplyConfiguration `json:"rules,omitempty"`
-	// AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
+	// aggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
 	// If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
 	// stomped by the controller.
 	AggregationRule *AggregationRuleApplyConfiguration `json:"aggregationRule,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/clusterrolebinding.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/clusterrolebinding.go
index 13d3d0201f..f4327511cc 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/clusterrolebinding.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/clusterrolebinding.go
@@ -33,12 +33,12 @@ import (
 // ClusterRoleBinding references a ClusterRole, but not contain it.  It can reference a ClusterRole in the global namespace,
 // and adds who information via Subject.
 type ClusterRoleBindingApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Subjects holds references to the objects the role applies to.
+	// subjects holds references to the objects the role applies to.
 	Subjects []SubjectApplyConfiguration `json:"subjects,omitempty"`
-	// RoleRef can only reference a ClusterRole in the global namespace.
+	// roleRef can only reference a ClusterRole in the global namespace.
 	// If the RoleRef cannot be resolved, the Authorizer must return an error.
 	// This field is immutable.
 	RoleRef *RoleRefApplyConfiguration `json:"roleRef,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/policyrule.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/policyrule.go
index 03556b01c4..9685f7b278 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/policyrule.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/policyrule.go
@@ -28,16 +28,16 @@ package v1
 // PolicyRule holds information that describes a policy rule, but does not contain information
 // about who the rule applies to or which namespace the rule applies to.
 type PolicyRuleApplyConfiguration struct {
-	// Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
+	// verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
 	Verbs []string `json:"verbs,omitempty"`
-	// APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
+	// apiGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
 	// the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
 	APIGroups []string `json:"apiGroups,omitempty"`
-	// Resources is a list of resources this rule applies to. '*' represents all resources.
+	// resources is a list of resources this rule applies to. '*' represents all resources.
 	Resources []string `json:"resources,omitempty"`
-	// ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
+	// resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
 	ResourceNames []string `json:"resourceNames,omitempty"`
-	// NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
+	// nonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
 	// Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
 	// Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.
 	NonResourceURLs []string `json:"nonResourceURLs,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/role.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/role.go
index 9e2895b1a8..fee603dff6 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/role.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/role.go
@@ -32,10 +32,10 @@ import (
 //
 // Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.
 type RoleApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Rules holds all the PolicyRules for this Role
+	// rules holds all the PolicyRules for this Role
 	Rules []PolicyRuleApplyConfiguration `json:"rules,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/rolebinding.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/rolebinding.go
index 776fb3ed30..994779c8c9 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/rolebinding.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/rolebinding.go
@@ -34,12 +34,12 @@ import (
 // It adds who information via Subjects and namespace information by which namespace it exists in.  RoleBindings in a given
 // namespace only have effect in that namespace.
 type RoleBindingApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Subjects holds references to the objects the role applies to.
+	// subjects holds references to the objects the role applies to.
 	Subjects []SubjectApplyConfiguration `json:"subjects,omitempty"`
-	// RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
+	// roleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
 	// If the RoleRef cannot be resolved, the Authorizer must return an error.
 	// This field is immutable.
 	RoleRef *RoleRefApplyConfiguration `json:"roleRef,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/roleref.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/roleref.go
index 231fe0dd49..1df91726d1 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/roleref.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/roleref.go
@@ -23,11 +23,11 @@ package v1
 //
 // RoleRef contains information that points to the role being used
 type RoleRefApplyConfiguration struct {
-	// APIGroup is the group for the resource being referenced
+	// apiGroup is the group for the resource being referenced
 	APIGroup *string `json:"apiGroup,omitempty"`
-	// Kind is the type of resource being referenced
+	// kind is the type of resource being referenced
 	Kind *string `json:"kind,omitempty"`
-	// Name is the name of resource being referenced
+	// name is the name of resource being referenced
 	Name *string `json:"name,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/subject.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/subject.go
index 1914086c0f..1432b410a5 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/subject.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1/subject.go
@@ -24,16 +24,16 @@ package v1
 // Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference,
 // or a value for non-objects such as user and group names.
 type SubjectApplyConfiguration struct {
-	// Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
+	// kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
 	// If the Authorizer does not recognized the kind value, the Authorizer should report an error.
 	Kind *string `json:"kind,omitempty"`
-	// APIGroup holds the API group of the referenced subject.
+	// apiGroup holds the API group of the referenced subject.
 	// Defaults to "" for ServiceAccount subjects.
 	// Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
 	APIGroup *string `json:"apiGroup,omitempty"`
-	// Name of the object being referenced.
+	// name of the object being referenced.
 	Name *string `json:"name,omitempty"`
-	// Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
+	// namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
 	// the Authorizer should report an error.
 	Namespace *string `json:"namespace,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/aggregationrule.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/aggregationrule.go
index 397d14a1ac..169cf984d7 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/aggregationrule.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/aggregationrule.go
@@ -27,7 +27,7 @@ import (
 //
 // AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
 type AggregationRuleApplyConfiguration struct {
-	// ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
+	// clusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
 	// If any of the selectors match, then the ClusterRole's permissions will be added
 	ClusterRoleSelectors []v1.LabelSelectorApplyConfiguration `json:"clusterRoleSelectors,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/clusterrole.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/clusterrole.go
index 678761e6a0..5cc806dea1 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/clusterrole.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/clusterrole.go
@@ -33,12 +33,12 @@ import (
 // ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
 type ClusterRoleApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Rules holds all the PolicyRules for this ClusterRole
+	// rules holds all the PolicyRules for this ClusterRole
 	Rules []PolicyRuleApplyConfiguration `json:"rules,omitempty"`
-	// AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
+	// aggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
 	// If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
 	// stomped by the controller.
 	AggregationRule *AggregationRuleApplyConfiguration `json:"aggregationRule,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/clusterrolebinding.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/clusterrolebinding.go
index f4ee74f18f..fcfe3709ed 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/clusterrolebinding.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/clusterrolebinding.go
@@ -34,12 +34,12 @@ import (
 // and adds who information via Subject.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBinding, and will no longer be served in v1.22.
 type ClusterRoleBindingApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Subjects holds references to the objects the role applies to.
+	// subjects holds references to the objects the role applies to.
 	Subjects []SubjectApplyConfiguration `json:"subjects,omitempty"`
-	// RoleRef can only reference a ClusterRole in the global namespace.
+	// roleRef can only reference a ClusterRole in the global namespace.
 	// If the RoleRef cannot be resolved, the Authorizer must return an error.
 	RoleRef *RoleRefApplyConfiguration `json:"roleRef,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/policyrule.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/policyrule.go
index f4a6d3fff7..7c4e9cca1b 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/policyrule.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/policyrule.go
@@ -28,16 +28,16 @@ package v1alpha1
 // PolicyRule holds information that describes a policy rule, but does not contain information
 // about who the rule applies to or which namespace the rule applies to.
 type PolicyRuleApplyConfiguration struct {
-	// Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
+	// verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
 	Verbs []string `json:"verbs,omitempty"`
-	// APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
+	// apiGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
 	// the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
 	APIGroups []string `json:"apiGroups,omitempty"`
-	// Resources is a list of resources this rule applies to. '*' represents all resources.
+	// resources is a list of resources this rule applies to. '*' represents all resources.
 	Resources []string `json:"resources,omitempty"`
-	// ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
+	// resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
 	ResourceNames []string `json:"resourceNames,omitempty"`
-	// NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
+	// nonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
 	// Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
 	// Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.
 	NonResourceURLs []string `json:"nonResourceURLs,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/role.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/role.go
index 19b123b2d2..b2f8ca8b2c 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/role.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/role.go
@@ -33,10 +33,10 @@ import (
 // Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 Role, and will no longer be served in v1.22.
 type RoleApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Rules holds all the PolicyRules for this Role
+	// rules holds all the PolicyRules for this Role
 	Rules []PolicyRuleApplyConfiguration `json:"rules,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/rolebinding.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/rolebinding.go
index 116f293765..b836c08a5e 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/rolebinding.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/rolebinding.go
@@ -35,12 +35,12 @@ import (
 // namespace only have effect in that namespace.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBinding, and will no longer be served in v1.22.
 type RoleBindingApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Subjects holds references to the objects the role applies to.
+	// subjects holds references to the objects the role applies to.
 	Subjects []SubjectApplyConfiguration `json:"subjects,omitempty"`
-	// RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
+	// roleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
 	// If the RoleRef cannot be resolved, the Authorizer must return an error.
 	RoleRef *RoleRefApplyConfiguration `json:"roleRef,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/roleref.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/roleref.go
index a02a36be89..25aab93791 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/roleref.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/roleref.go
@@ -23,11 +23,11 @@ package v1alpha1
 //
 // RoleRef contains information that points to the role being used
 type RoleRefApplyConfiguration struct {
-	// APIGroup is the group for the resource being referenced
+	// apiGroup is the group for the resource being referenced
 	APIGroup *string `json:"apiGroup,omitempty"`
-	// Kind is the type of resource being referenced
+	// kind is the type of resource being referenced
 	Kind *string `json:"kind,omitempty"`
-	// Name is the name of resource being referenced
+	// name is the name of resource being referenced
 	Name *string `json:"name,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/subject.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/subject.go
index d24f865d4e..51a5b4d4b4 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/subject.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1alpha1/subject.go
@@ -24,16 +24,16 @@ package v1alpha1
 // Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference,
 // or a value for non-objects such as user and group names.
 type SubjectApplyConfiguration struct {
-	// Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
+	// kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
 	// If the Authorizer does not recognized the kind value, the Authorizer should report an error.
 	Kind *string `json:"kind,omitempty"`
-	// APIVersion holds the API group and version of the referenced subject.
+	// apiVersion holds the API group and version of the referenced subject.
 	// Defaults to "v1" for ServiceAccount subjects.
 	// Defaults to "rbac.authorization.k8s.io/v1alpha1" for User and Group subjects.
 	APIVersion *string `json:"apiVersion,omitempty"`
-	// Name of the object being referenced.
+	// name of the object being referenced.
 	Name *string `json:"name,omitempty"`
-	// Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
+	// namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
 	// the Authorizer should report an error.
 	Namespace *string `json:"namespace,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/aggregationrule.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/aggregationrule.go
index b4c6bd5aed..8064db4dd5 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/aggregationrule.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/aggregationrule.go
@@ -27,7 +27,7 @@ import (
 //
 // AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
 type AggregationRuleApplyConfiguration struct {
-	// ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
+	// clusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
 	// If any of the selectors match, then the ClusterRole's permissions will be added
 	ClusterRoleSelectors []v1.LabelSelectorApplyConfiguration `json:"clusterRoleSelectors,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/clusterrole.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/clusterrole.go
index a105df5f0d..dacb3b17b9 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/clusterrole.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/clusterrole.go
@@ -33,12 +33,12 @@ import (
 // ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
 type ClusterRoleApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Rules holds all the PolicyRules for this ClusterRole
+	// rules holds all the PolicyRules for this ClusterRole
 	Rules []PolicyRuleApplyConfiguration `json:"rules,omitempty"`
-	// AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
+	// aggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
 	// If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
 	// stomped by the controller.
 	AggregationRule *AggregationRuleApplyConfiguration `json:"aggregationRule,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/clusterrolebinding.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/clusterrolebinding.go
index c519c6e078..0b400e124d 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/clusterrolebinding.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/clusterrolebinding.go
@@ -34,12 +34,12 @@ import (
 // and adds who information via Subject.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBinding, and will no longer be served in v1.22.
 type ClusterRoleBindingApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Subjects holds references to the objects the role applies to.
+	// subjects holds references to the objects the role applies to.
 	Subjects []SubjectApplyConfiguration `json:"subjects,omitempty"`
-	// RoleRef can only reference a ClusterRole in the global namespace.
+	// roleRef can only reference a ClusterRole in the global namespace.
 	// If the RoleRef cannot be resolved, the Authorizer must return an error.
 	RoleRef *RoleRefApplyConfiguration `json:"roleRef,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/policyrule.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/policyrule.go
index bf3a5a5086..c5cf6a8fcf 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/policyrule.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/policyrule.go
@@ -28,17 +28,17 @@ package v1beta1
 // PolicyRule holds information that describes a policy rule, but does not contain information
 // about who the rule applies to or which namespace the rule applies to.
 type PolicyRuleApplyConfiguration struct {
-	// Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
+	// verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
 	Verbs []string `json:"verbs,omitempty"`
-	// APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
+	// apiGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
 	// the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
 	APIGroups []string `json:"apiGroups,omitempty"`
-	// Resources is a list of resources this rule applies to.  '*' represents all resources in the specified apiGroups.
+	// resources is a list of resources this rule applies to.  '*' represents all resources in the specified apiGroups.
 	// '*/foo' represents the subresource 'foo' for all resources in the specified apiGroups.
 	Resources []string `json:"resources,omitempty"`
-	// ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
+	// resourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
 	ResourceNames []string `json:"resourceNames,omitempty"`
-	// NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
+	// nonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
 	// Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
 	// Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.
 	NonResourceURLs []string `json:"nonResourceURLs,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/role.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/role.go
index d0a4c20c68..df72d643b3 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/role.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/role.go
@@ -33,10 +33,10 @@ import (
 // Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 Role, and will no longer be served in v1.22.
 type RoleApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Rules holds all the PolicyRules for this Role
+	// rules holds all the PolicyRules for this Role
 	Rules []PolicyRuleApplyConfiguration `json:"rules,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/rolebinding.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/rolebinding.go
index 64669c1033..f851aab7b7 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/rolebinding.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/rolebinding.go
@@ -35,12 +35,12 @@ import (
 // namespace only have effect in that namespace.
 // Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBinding, and will no longer be served in v1.22.
 type RoleBindingApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object's metadata.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Subjects holds references to the objects the role applies to.
+	// subjects holds references to the objects the role applies to.
 	Subjects []SubjectApplyConfiguration `json:"subjects,omitempty"`
-	// RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
+	// roleRef can reference a Role in the current namespace or a ClusterRole in the global namespace.
 	// If the RoleRef cannot be resolved, the Authorizer must return an error.
 	RoleRef *RoleRefApplyConfiguration `json:"roleRef,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/roleref.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/roleref.go
index 350930af7a..63d1c40c1d 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/roleref.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/roleref.go
@@ -23,11 +23,11 @@ package v1beta1
 //
 // RoleRef contains information that points to the role being used
 type RoleRefApplyConfiguration struct {
-	// APIGroup is the group for the resource being referenced
+	// apiGroup is the group for the resource being referenced
 	APIGroup *string `json:"apiGroup,omitempty"`
-	// Kind is the type of resource being referenced
+	// kind is the type of resource being referenced
 	Kind *string `json:"kind,omitempty"`
-	// Name is the name of resource being referenced
+	// name is the name of resource being referenced
 	Name *string `json:"name,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/subject.go b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/subject.go
index 8abbaa9fb3..083c8a1a2d 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/subject.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/rbac/v1beta1/subject.go
@@ -24,16 +24,16 @@ package v1beta1
 // Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference,
 // or a value for non-objects such as user and group names.
 type SubjectApplyConfiguration struct {
-	// Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
+	// kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
 	// If the Authorizer does not recognized the kind value, the Authorizer should report an error.
 	Kind *string `json:"kind,omitempty"`
-	// APIGroup holds the API group of the referenced subject.
+	// apiGroup holds the API group of the referenced subject.
 	// Defaults to "" for ServiceAccount subjects.
 	// Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
 	APIGroup *string `json:"apiGroup,omitempty"`
-	// Name of the object being referenced.
+	// name of the object being referenced.
 	Name *string `json:"name,omitempty"`
-	// Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
+	// namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
 	// the Authorizer should report an error.
 	Namespace *string `json:"namespace,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/capacityrequestpolicyrange.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/capacityrequestpolicyrange.go
index b3bade6113..057b1dfd13 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/capacityrequestpolicyrange.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/capacityrequestpolicyrange.go
@@ -27,6 +27,13 @@ import (
 //
 // CapacityRequestPolicyRange defines a valid range for consumable capacity values.
 //
+// If the DRAFractionalCapacityRange feature gate is
+// enabled and at least one of Min, Max, or Step is a fractional quantity (i.e.
+// its value is not an integer), milli-unit arithmetic is used instead,
+// supporting values with up to 3 decimal places (e.g. 100m = 0.1).
+// The largest supported value then is 1000 times smaller compared to using 64-bit integers.
+// Otherwise, all comparisons use 64-bit integer arithmetic via resource.Quantity.Value().
+//
 // - If the requested amount is less than Min, it is rounded up to the Min value.
 // - If Step is set and the requested amount is between Min and Max but not aligned with Step,
 // it will be rounded up to the next value equal to Min + (n * Step).
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/celdeviceselector.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/celdeviceselector.go
index 15ec20da40..d5ca19905d 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/celdeviceselector.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/celdeviceselector.go
@@ -33,7 +33,7 @@ type CELDeviceSelectorApplyConfiguration struct {
 	// - driver (string): the name of the driver which defines this device.
 	// - attributes (map[string]object): the device's attributes, grouped by prefix
 	// (e.g. device.attributes["dra.example.com"] evaluates to an object with all
-	// of the attributes which were prefixed by "dra.example.com".
+	// of the attributes which were prefixed by "dra.example.com").
 	// - capacity (map[string]object): the device's capacities, grouped by prefix.
 	// - allowMultipleAllocations (bool): the allowMultipleAllocations property of the device
 	// (v1.34+ with the DRAConsumableCapacity feature enabled).
@@ -66,6 +66,15 @@ type CELDeviceSelectorApplyConfiguration struct {
 	// A robust expression should check for the existence of attributes
 	// before referencing them.
 	//
+	// Common errors:
+	// - "no such key": Use optional chaining (.? followed by orValue())
+	// or guarding the check with has() for optional fields.
+	// See CEL Optional Types for details:
+	// https://pkg.go.dev/github.com/google/cel-go@v0.17.4/cel#OptionalTypes
+	//
+	// For more CEL expression syntax and examples, see:
+	// https://kubernetes.io/docs/reference/using-api/cel/
+	//
 	// For ease of use, the cel.bind() function is enabled, and can be used
 	// to simplify expressions that access multiple attributes with the
 	// same domain. For example:
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/device.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/device.go
index f19b9000cd..4ebb005fd7 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/device.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/device.go
@@ -114,7 +114,7 @@ type DeviceApplyConfiguration struct {
 	// If AllowMultipleAllocations is set to true, the device can be allocated more than once,
 	// and all of its capacity is consumable, regardless of whether the requestPolicy is defined or not.
 	AllowMultipleAllocations *bool `json:"allowMultipleAllocations,omitempty"`
-	// NodeAllocatableResourceMappings defines the mapping of node resources
+	// NodeAllocatableResources defines the mapping of node resources
 	// that are managed by the DRA driver exposing this device. This includes resources currently
 	// reported in v1.Node `status.allocatable` that are not extended resources
 	// (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources).
@@ -125,7 +125,7 @@ type DeviceApplyConfiguration struct {
 	// dependencies of an accelerator device.
 	// The keys of this map are the node-allocatable resource names (e.g., "cpu", "memory").
 	// Extended resource names are not permitted as keys.
-	NodeAllocatableResourceMappings map[apicorev1.ResourceName]NodeAllocatableResourceMappingApplyConfiguration `json:"nodeAllocatableResourceMappings,omitempty"`
+	NodeAllocatableResources map[apicorev1.ResourceName]NodeAllocatableResourceApplyConfiguration `json:"nodeAllocatableResources,omitempty"`
 }
 
 // DeviceApplyConfiguration constructs a declarative configuration of the Device type for use with
@@ -256,16 +256,16 @@ func (b *DeviceApplyConfiguration) WithAllowMultipleAllocations(value bool) *Dev
 	return b
 }
 
-// WithNodeAllocatableResourceMappings puts the entries into the NodeAllocatableResourceMappings field in the declarative configuration
+// WithNodeAllocatableResources puts the entries into the NodeAllocatableResources field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
-// If called multiple times, the entries provided by each call will be put on the NodeAllocatableResourceMappings field,
-// overwriting an existing map entries in NodeAllocatableResourceMappings field with the same key.
-func (b *DeviceApplyConfiguration) WithNodeAllocatableResourceMappings(entries map[apicorev1.ResourceName]NodeAllocatableResourceMappingApplyConfiguration) *DeviceApplyConfiguration {
-	if b.NodeAllocatableResourceMappings == nil && len(entries) > 0 {
-		b.NodeAllocatableResourceMappings = make(map[apicorev1.ResourceName]NodeAllocatableResourceMappingApplyConfiguration, len(entries))
+// If called multiple times, the entries provided by each call will be put on the NodeAllocatableResources field,
+// overwriting an existing map entries in NodeAllocatableResources field with the same key.
+func (b *DeviceApplyConfiguration) WithNodeAllocatableResources(entries map[apicorev1.ResourceName]NodeAllocatableResourceApplyConfiguration) *DeviceApplyConfiguration {
+	if b.NodeAllocatableResources == nil && len(entries) > 0 {
+		b.NodeAllocatableResources = make(map[apicorev1.ResourceName]NodeAllocatableResourceApplyConfiguration, len(entries))
 	}
 	for k, v := range entries {
-		b.NodeAllocatableResourceMappings[k] = v
+		b.NodeAllocatableResources[k] = v
 	}
 	return b
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceallocationconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceallocationconfiguration.go
index 29e1ba427a..2cfca606d2 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceallocationconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceallocationconfiguration.go
@@ -38,7 +38,7 @@ type DeviceAllocationConfigurationApplyConfiguration struct {
 	// and may include the subrequest using the format <main request>[/<subrequest>]. If just
 	// the main request is given, the configuration applies to all subrequests.
 	Requests                              []string `json:"requests,omitempty"`
-	DeviceConfigurationApplyConfiguration `json:",inline"`
+	DeviceConfigurationApplyConfiguration `json:""`
 }
 
 // DeviceAllocationConfigurationApplyConfiguration constructs a declarative configuration of the DeviceAllocationConfiguration type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclaimconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclaimconfiguration.go
index 402cd877c9..2da8207609 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclaimconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclaimconfiguration.go
@@ -30,7 +30,7 @@ type DeviceClaimConfigurationApplyConfiguration struct {
 	// and may include the subrequest using the format <main request>[/<subrequest>]. If just
 	// the main request is given, the configuration applies to all subrequests.
 	Requests                              []string `json:"requests,omitempty"`
-	DeviceConfigurationApplyConfiguration `json:",inline"`
+	DeviceConfigurationApplyConfiguration `json:""`
 }
 
 // DeviceClaimConfigurationApplyConfiguration constructs a declarative configuration of the DeviceClaimConfiguration type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclass.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclass.go
index 478f90bb04..49d6d7258d 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclass.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclass.go
@@ -35,7 +35,7 @@ import (
 // the device requests of a claim to apply these presets.
 // Cluster scoped.
 type DeviceClassApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Spec defines what can be allocated and how to configure it.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclassconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclassconfiguration.go
index c47fd9f85c..062cde2ab8 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclassconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclassconfiguration.go
@@ -23,7 +23,7 @@ package v1
 //
 // DeviceClassConfiguration is used in DeviceClass.
 type DeviceClassConfigurationApplyConfiguration struct {
-	DeviceConfigurationApplyConfiguration `json:",inline"`
+	DeviceConfigurationApplyConfiguration `json:""`
 }
 
 // DeviceClassConfigurationApplyConfiguration constructs a declarative configuration of the DeviceClassConfiguration type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclassspec.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclassspec.go
index a6a3992c92..5e7d736199 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclassspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/deviceclassspec.go
@@ -40,8 +40,6 @@ type DeviceClassSpecApplyConfiguration struct {
 	// is picked to satisfy a pod's extended resource requests.
 	// If two classes are created at the same time, then the name of the class
 	// lexicographically sorted first is picked.
-	//
-	// This is a beta field.
 	ExtendedResourceName *string `json:"extendedResourceName,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicecounterconsumption.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicecounterconsumption.go
index 9bcd936db2..939894bea7 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicecounterconsumption.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicecounterconsumption.go
@@ -31,6 +31,26 @@ type DeviceCounterConsumptionApplyConfiguration struct {
 	//
 	// The maximum number of counters is 32.
 	Counters map[string]CounterApplyConfiguration `json:"counters,omitempty"`
+	// CompatibilityGroups is a list of opaque group names for
+	// this counter set consumption.
+	//
+	// Devices that consume counters from the same counter set may only be
+	// allocated at the same time ("co-allocated") if they all share at least
+	// one common group: the intersection of the CompatibilityGroups of all
+	// co-allocated devices on that counter set must be non-empty. Devices
+	// that consume from different counter sets are never compared via this
+	// field.
+	//
+	// An unset field, an explicit nil, and an empty list are equivalent and
+	// mean "no groups": such a device is only co-allocatable with sibling
+	// devices on the same counter set that also have no groups, and is never
+	// co-allocatable with a device that declares one or more groups.
+	//
+	// Group names are opaque and meaningful only within the
+	// publishing driver's pool.
+	//
+	// The maximum number of groups is 2, and the names must be unique.
+	CompatibilityGroups []string `json:"compatibilityGroups,omitempty"`
 }
 
 // DeviceCounterConsumptionApplyConfiguration constructs a declarative configuration of the DeviceCounterConsumption type for use with
@@ -60,3 +80,13 @@ func (b *DeviceCounterConsumptionApplyConfiguration) WithCounters(entries map[st
 	}
 	return b
 }
+
+// WithCompatibilityGroups adds the given value to the CompatibilityGroups field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the CompatibilityGroups field.
+func (b *DeviceCounterConsumptionApplyConfiguration) WithCompatibilityGroups(values ...string) *DeviceCounterConsumptionApplyConfiguration {
+	for i := range values {
+		b.CompatibilityGroups = append(b.CompatibilityGroups, values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicederivedattribute.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicederivedattribute.go
new file mode 100644
index 0000000000..9283a257d6
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicederivedattribute.go
@@ -0,0 +1,95 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	resourcev1 "k8s.io/api/resource/v1"
+)
+
+// DeviceDerivedAttributeApplyConfiguration represents a declarative configuration of the DeviceDerivedAttribute type for use
+// with apply.
+//
+// DeviceDerivedAttribute defines a derived attribute computed via CEL.
+type DeviceDerivedAttributeApplyConfiguration struct {
+	// Name is the identifier for this derived attribute, used in constraints.
+	//
+	// It must be a DNS subdomain followed by a slash ("/") followed by a C identifier
+	// (e.g. "example.com/numaNode" or "derived/numaNode").
+	//
+	// If the chosen name matches an existing physical attribute from a driver,
+	// the derived attribute's expression will shadow the physical attribute,
+	// and its evaluated value will be used in constraints instead. When the goal
+	// is to define a derived attribute that is only used within the ResourceClaim
+	// and not meant to shadow an existing attribute, use a domain prefix that
+	// no DRA driver should be using (e.g. "derived/myAttribute").
+	//
+	// It is not valid to define a derived attribute that isn't used in at least
+	// one constraint.
+	Name *resourcev1.FullyQualifiedName `json:"name,omitempty"`
+	// Expression is a CEL expression evaluated against each candidate device.
+	// The expression must evaluate to a primitive scalar (string, integer,
+	// boolean, or semver) or a list of these scalars ([]string, []int64,
+	// []bool, []semver) to act as a virtual grouping key. Any other return type
+	// is an error and causes CEL evaluation for the device to fail.
+	//
+	// The expression's input is an object named "device", which carries the
+	// same properties as in a CELDeviceSelector.
+	//
+	// When pod scheduling encounters CEL runtime errors (such as looking
+	// up an attribute that isn't defined) for some devices, it will abort
+	// allocation and fail scheduling for the Pod. Surfacing evaluation
+	// errors immediately prevents silent topology matching failures that are
+	// extremely hard to detect. A robust expression should, for example, check
+	// for the existence of attributes before referencing them to avoid
+	// runtime evaluation errors.
+	//
+	// The expression gets evaluated after a device has passed the other
+	// selector expressions for the request in which this expression is used.
+	// This allows writing expressions that are tailored towards the specific
+	// devices being requested (for example, by assuming the device is from a
+	// certain vendor and skipping those checks).
+	//
+	// The length of the expression must be smaller or equal to 10 Ki. The
+	// cost of evaluating it is also limited based on the estimated number
+	// of logical steps; the combined cost of all derived attributes in a
+	// claim is capped by a shared CEL cost budget.
+	Expression *string `json:"expression,omitempty"`
+}
+
+// DeviceDerivedAttributeApplyConfiguration constructs a declarative configuration of the DeviceDerivedAttribute type for use with
+// apply.
+func DeviceDerivedAttribute() *DeviceDerivedAttributeApplyConfiguration {
+	return &DeviceDerivedAttributeApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *DeviceDerivedAttributeApplyConfiguration) WithName(value resourcev1.FullyQualifiedName) *DeviceDerivedAttributeApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithExpression sets the Expression field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Expression field is set to the value of the last call.
+func (b *DeviceDerivedAttributeApplyConfiguration) WithExpression(value string) *DeviceDerivedAttributeApplyConfiguration {
+	b.Expression = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicerequestallocationresult.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicerequestallocationresult.go
index 592a641756..a32440eaca 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicerequestallocationresult.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicerequestallocationresult.go
@@ -94,6 +94,12 @@ type DeviceRequestAllocationResultApplyConfiguration struct {
 	// This field is populated only for devices that allow multiple allocations.
 	// All capacity entries are included, even if the consumed amount is zero.
 	ConsumedCapacity map[resourcev1.QualifiedName]resource.Quantity `json:"consumedCapacity,omitempty"`
+	// SkipNodeOperations lists node-local resource operations (gRPC calls)
+	// that will be skipped for this allocated device when determining whether
+	// operations are necessary on the node. If all allocated devices for a driver in
+	// a claim skip an operation, that gRPC call will be skipped. It is a copy of
+	// the ResourceSlice.spec.skipNodeOperations value at the time when the device was allocated.
+	SkipNodeOperations []resourcev1.SkipNodeOperation `json:"skipNodeOperations,omitempty"`
 }
 
 // DeviceRequestAllocationResultApplyConfiguration constructs a declarative configuration of the DeviceRequestAllocationResult type for use with
@@ -196,3 +202,13 @@ func (b *DeviceRequestAllocationResultApplyConfiguration) WithConsumedCapacity(e
 	}
 	return b
 }
+
+// WithSkipNodeOperations adds the given value to the SkipNodeOperations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the SkipNodeOperations field.
+func (b *DeviceRequestAllocationResultApplyConfiguration) WithSkipNodeOperations(values ...resourcev1.SkipNodeOperation) *DeviceRequestAllocationResultApplyConfiguration {
+	for i := range values {
+		b.SkipNodeOperations = append(b.SkipNodeOperations, values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicesubrequest.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicesubrequest.go
index d554522fa1..74a7e96124 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicesubrequest.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicesubrequest.go
@@ -109,6 +109,27 @@ type DeviceSubRequestApplyConfiguration struct {
 	// the request fails if there are devices that otherwise match the request,
 	// and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.
 	Capacity *CapacityRequirementsApplyConfiguration `json:"capacity,omitempty"`
+	// DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+	// for each candidate device. These virtual attributes can be referenced in
+	// `.devices.constraints` to align and match different devices (e.g., co-allocating
+	// a GPU and a NIC on the same NUMA node) even if their drivers publish different
+	// attributes. Derived attributes are not available via `device.attributes`
+	// in the CEL environment when evaluating selector expressions.
+	//
+	// Derived attributes allow you to extract, transform, or normalize topology
+	// information (such as extracting a NUMA index from a complex topology string or
+	// renaming a vendor-specific attribute) into a common virtual attribute name at
+	// scheduling time. The scheduler then evaluates these virtual attributes exactly
+	// like static attributes when matching constraints.
+	//
+	// Every derived attribute defined in this list must be referenced by at least one
+	// MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+	//
+	// The maximum number of derived attributes is 32.
+	//
+	// This is an alpha field and requires enabling the DRADerivedAttributes
+	// feature gate.
+	DerivedAttributes []DeviceDerivedAttributeApplyConfiguration `json:"derivedAttributes,omitempty"`
 }
 
 // DeviceSubRequestApplyConfiguration constructs a declarative configuration of the DeviceSubRequest type for use with
@@ -182,3 +203,16 @@ func (b *DeviceSubRequestApplyConfiguration) WithCapacity(value *CapacityRequire
 	b.Capacity = value
 	return b
 }
+
+// WithDerivedAttributes adds the given value to the DerivedAttributes field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the DerivedAttributes field.
+func (b *DeviceSubRequestApplyConfiguration) WithDerivedAttributes(values ...*DeviceDerivedAttributeApplyConfiguration) *DeviceSubRequestApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithDerivedAttributes")
+		}
+		b.DerivedAttributes = append(b.DerivedAttributes, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicetaintrule.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicetaintrule.go
new file mode 100644
index 0000000000..e97d4855e6
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicetaintrule.go
@@ -0,0 +1,294 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	resourcev1 "k8s.io/api/resource/v1"
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	internal "k8s.io/client-go/applyconfigurations/internal"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// DeviceTaintRuleApplyConfiguration represents a declarative configuration of the DeviceTaintRule type for use
+// with apply.
+//
+// DeviceTaintRule adds one taint to all devices which match the selector.
+// This has the same effect as if the taint was specified directly
+// in the ResourceSlice by the DRA driver.
+type DeviceTaintRuleApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// Standard object metadata
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	// Spec specifies the selector and one taint.
+	//
+	// Changing the spec automatically increments the metadata.generation number.
+	Spec *DeviceTaintRuleSpecApplyConfiguration `json:"spec,omitempty"`
+	// Status provides information about what was requested in the spec.
+	Status *DeviceTaintRuleStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// DeviceTaintRule constructs a declarative configuration of the DeviceTaintRule type for use with
+// apply.
+func DeviceTaintRule(name string) *DeviceTaintRuleApplyConfiguration {
+	b := &DeviceTaintRuleApplyConfiguration{}
+	b.WithName(name)
+	b.WithKind("DeviceTaintRule")
+	b.WithAPIVersion("resource.k8s.io/v1")
+	return b
+}
+
+// ExtractDeviceTaintRuleFrom extracts the applied configuration owned by fieldManager from
+// deviceTaintRule for the specified subresource. Pass an empty string for subresource to extract
+// the main resource. Common subresources include "status", "scale", etc.
+// deviceTaintRule must be a unmodified DeviceTaintRule API object that was retrieved from the Kubernetes API.
+// ExtractDeviceTaintRuleFrom provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractDeviceTaintRuleFrom(deviceTaintRule *resourcev1.DeviceTaintRule, fieldManager string, subresource string) (*DeviceTaintRuleApplyConfiguration, error) {
+	b := &DeviceTaintRuleApplyConfiguration{}
+	err := managedfields.ExtractInto(deviceTaintRule, internal.Parser().Type("io.k8s.api.resource.v1.DeviceTaintRule"), fieldManager, b, subresource)
+	if err != nil {
+		return nil, err
+	}
+	b.WithName(deviceTaintRule.Name)
+
+	b.WithKind("DeviceTaintRule")
+	b.WithAPIVersion("resource.k8s.io/v1")
+	return b, nil
+}
+
+// ExtractDeviceTaintRule extracts the applied configuration owned by fieldManager from
+// deviceTaintRule. If no managedFields are found in deviceTaintRule for fieldManager, a
+// DeviceTaintRuleApplyConfiguration is returned with only the Name, Namespace (if applicable),
+// APIVersion and Kind populated. It is possible that no managed fields were found for because other
+// field managers have taken ownership of all the fields previously owned by fieldManager, or because
+// the fieldManager never owned fields any fields.
+// deviceTaintRule must be a unmodified DeviceTaintRule API object that was retrieved from the Kubernetes API.
+// ExtractDeviceTaintRule provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractDeviceTaintRule(deviceTaintRule *resourcev1.DeviceTaintRule, fieldManager string) (*DeviceTaintRuleApplyConfiguration, error) {
+	return ExtractDeviceTaintRuleFrom(deviceTaintRule, fieldManager, "")
+}
+
+// ExtractDeviceTaintRuleStatus extracts the applied configuration owned by fieldManager from
+// deviceTaintRule for the status subresource.
+func ExtractDeviceTaintRuleStatus(deviceTaintRule *resourcev1.DeviceTaintRule, fieldManager string) (*DeviceTaintRuleApplyConfiguration, error) {
+	return ExtractDeviceTaintRuleFrom(deviceTaintRule, fieldManager, "status")
+}
+
+func (b DeviceTaintRuleApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *DeviceTaintRuleApplyConfiguration) WithKind(value string) *DeviceTaintRuleApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *DeviceTaintRuleApplyConfiguration) WithAPIVersion(value string) *DeviceTaintRuleApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *DeviceTaintRuleApplyConfiguration) WithName(value string) *DeviceTaintRuleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *DeviceTaintRuleApplyConfiguration) WithGenerateName(value string) *DeviceTaintRuleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *DeviceTaintRuleApplyConfiguration) WithNamespace(value string) *DeviceTaintRuleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *DeviceTaintRuleApplyConfiguration) WithUID(value types.UID) *DeviceTaintRuleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *DeviceTaintRuleApplyConfiguration) WithResourceVersion(value string) *DeviceTaintRuleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *DeviceTaintRuleApplyConfiguration) WithGeneration(value int64) *DeviceTaintRuleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *DeviceTaintRuleApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *DeviceTaintRuleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *DeviceTaintRuleApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *DeviceTaintRuleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *DeviceTaintRuleApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *DeviceTaintRuleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *DeviceTaintRuleApplyConfiguration) WithLabels(entries map[string]string) *DeviceTaintRuleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *DeviceTaintRuleApplyConfiguration) WithAnnotations(entries map[string]string) *DeviceTaintRuleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *DeviceTaintRuleApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *DeviceTaintRuleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *DeviceTaintRuleApplyConfiguration) WithFinalizers(values ...string) *DeviceTaintRuleApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *DeviceTaintRuleApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *DeviceTaintRuleApplyConfiguration) WithSpec(value *DeviceTaintRuleSpecApplyConfiguration) *DeviceTaintRuleApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *DeviceTaintRuleApplyConfiguration) WithStatus(value *DeviceTaintRuleStatusApplyConfiguration) *DeviceTaintRuleApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *DeviceTaintRuleApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *DeviceTaintRuleApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *DeviceTaintRuleApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *DeviceTaintRuleApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicetaintrulespec.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicetaintrulespec.go
new file mode 100644
index 0000000000..694a5c4b2d
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicetaintrulespec.go
@@ -0,0 +1,55 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// DeviceTaintRuleSpecApplyConfiguration represents a declarative configuration of the DeviceTaintRuleSpec type for use
+// with apply.
+//
+// DeviceTaintRuleSpec specifies the selector and one taint.
+type DeviceTaintRuleSpecApplyConfiguration struct {
+	// DeviceSelector defines which device(s) the taint is applied to.
+	// All selector criteria must be satisfied for a device to
+	// match. The empty selector matches all devices. Without
+	// a selector, no devices are matches.
+	DeviceSelector *DeviceTaintSelectorApplyConfiguration `json:"deviceSelector,omitempty"`
+	// The taint that gets applied to matching devices.
+	Taint *DeviceTaintApplyConfiguration `json:"taint,omitempty"`
+}
+
+// DeviceTaintRuleSpecApplyConfiguration constructs a declarative configuration of the DeviceTaintRuleSpec type for use with
+// apply.
+func DeviceTaintRuleSpec() *DeviceTaintRuleSpecApplyConfiguration {
+	return &DeviceTaintRuleSpecApplyConfiguration{}
+}
+
+// WithDeviceSelector sets the DeviceSelector field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeviceSelector field is set to the value of the last call.
+func (b *DeviceTaintRuleSpecApplyConfiguration) WithDeviceSelector(value *DeviceTaintSelectorApplyConfiguration) *DeviceTaintRuleSpecApplyConfiguration {
+	b.DeviceSelector = value
+	return b
+}
+
+// WithTaint sets the Taint field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Taint field is set to the value of the last call.
+func (b *DeviceTaintRuleSpecApplyConfiguration) WithTaint(value *DeviceTaintApplyConfiguration) *DeviceTaintRuleSpecApplyConfiguration {
+	b.Taint = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicetaintrulestatus.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicetaintrulestatus.go
new file mode 100644
index 0000000000..568cc205ac
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicetaintrulestatus.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// DeviceTaintRuleStatusApplyConfiguration represents a declarative configuration of the DeviceTaintRuleStatus type for use
+// with apply.
+//
+// DeviceTaintRuleStatus provides information about an on-going pod eviction.
+type DeviceTaintRuleStatusApplyConfiguration struct {
+	// Conditions provide information about the state of the DeviceTaintRule
+	// and the cluster at some point in time,
+	// in a machine-readable and human-readable format.
+	//
+	// The following condition is currently defined as part of this API, more may
+	// get added:
+	// - Type: EvictionInProgress
+	// - Status: True if there are currently pods which need to be evicted, False otherwise
+	// (includes the effects which don't cause eviction).
+	// - Reason: not specified, may change
+	// - Message: includes information about number of pending pods and already evicted pods
+	// in a human-readable format, updated periodically, may change
+	//
+	// For `effect: None`, the condition above gets set once for each change to
+	// the spec, with the message containing information about what would happen
+	// if the effect was `NoExecute`. This feedback can be used to decide whether
+	// changing the effect to `NoExecute` will work as intended. It only gets
+	// set once to avoid having to constantly update the status.
+	//
+	// Must have 8 or fewer entries.
+	Conditions []metav1.ConditionApplyConfiguration `json:"conditions,omitempty"`
+}
+
+// DeviceTaintRuleStatusApplyConfiguration constructs a declarative configuration of the DeviceTaintRuleStatus type for use with
+// apply.
+func DeviceTaintRuleStatus() *DeviceTaintRuleStatusApplyConfiguration {
+	return &DeviceTaintRuleStatusApplyConfiguration{}
+}
+
+// WithConditions adds the given value to the Conditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Conditions field.
+func (b *DeviceTaintRuleStatusApplyConfiguration) WithConditions(values ...*metav1.ConditionApplyConfiguration) *DeviceTaintRuleStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithConditions")
+		}
+		b.Conditions = append(b.Conditions, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicetaintselector.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicetaintselector.go
new file mode 100644
index 0000000000..6d31934be2
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/devicetaintselector.go
@@ -0,0 +1,76 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// DeviceTaintSelectorApplyConfiguration represents a declarative configuration of the DeviceTaintSelector type for use
+// with apply.
+//
+// DeviceTaintSelector defines which device(s) a DeviceTaintRule applies to.
+// The empty selector matches all devices. Without a selector, no devices
+// are matched.
+type DeviceTaintSelectorApplyConfiguration struct {
+	// If driver is set, only devices from that driver are selected.
+	// This fields corresponds to slice.spec.driver.
+	Driver *string `json:"driver,omitempty"`
+	// If pool is set, only devices in that pool are selected.
+	//
+	// Also setting the driver name may be useful to avoid
+	// ambiguity when different drivers use the same pool name,
+	// but this is not required because selecting pools from
+	// different drivers may also be useful, for example when
+	// drivers with node-local devices use the node name as
+	// their pool name.
+	Pool *string `json:"pool,omitempty"`
+	// If device is set, only devices with that name are selected.
+	// This field corresponds to slice.spec.devices[].name.
+	//
+	// Setting also driver and pool may be required to avoid ambiguity,
+	// but is not required.
+	Device *string `json:"device,omitempty"`
+}
+
+// DeviceTaintSelectorApplyConfiguration constructs a declarative configuration of the DeviceTaintSelector type for use with
+// apply.
+func DeviceTaintSelector() *DeviceTaintSelectorApplyConfiguration {
+	return &DeviceTaintSelectorApplyConfiguration{}
+}
+
+// WithDriver sets the Driver field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Driver field is set to the value of the last call.
+func (b *DeviceTaintSelectorApplyConfiguration) WithDriver(value string) *DeviceTaintSelectorApplyConfiguration {
+	b.Driver = &value
+	return b
+}
+
+// WithPool sets the Pool field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Pool field is set to the value of the last call.
+func (b *DeviceTaintSelectorApplyConfiguration) WithPool(value string) *DeviceTaintSelectorApplyConfiguration {
+	b.Pool = &value
+	return b
+}
+
+// WithDevice sets the Device field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Device field is set to the value of the last call.
+func (b *DeviceTaintSelectorApplyConfiguration) WithDevice(value string) *DeviceTaintSelectorApplyConfiguration {
+	b.Device = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/exactdevicerequest.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/exactdevicerequest.go
index 8eb0fd3526..68b3c2d40c 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/exactdevicerequest.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/exactdevicerequest.go
@@ -106,6 +106,27 @@ type ExactDeviceRequestApplyConfiguration struct {
 	// the request fails if there are devices that otherwise match the request,
 	// and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.
 	Capacity *CapacityRequirementsApplyConfiguration `json:"capacity,omitempty"`
+	// DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+	// for each candidate device. These virtual attributes can be referenced in
+	// `.devices.constraints` to align and match different devices (e.g., co-allocating
+	// a GPU and a NIC on the same NUMA node) even if their drivers publish different
+	// attributes. Derived attributes are not available via `device.attributes`
+	// in the CEL environment when evaluating selector expressions.
+	//
+	// Derived attributes allow you to extract, transform, or normalize topology
+	// information (such as extracting a NUMA index from a complex topology string or
+	// renaming a vendor-specific attribute) into a common virtual attribute name at
+	// scheduling time. The scheduler then evaluates these virtual attributes exactly
+	// like static attributes when matching constraints.
+	//
+	// Every derived attribute defined in this list must be referenced by at least one
+	// MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+	//
+	// The maximum number of derived attributes is 32.
+	//
+	// This is an alpha field and requires enabling the DRADerivedAttributes
+	// feature gate.
+	DerivedAttributes []DeviceDerivedAttributeApplyConfiguration `json:"derivedAttributes,omitempty"`
 }
 
 // ExactDeviceRequestApplyConfiguration constructs a declarative configuration of the ExactDeviceRequest type for use with
@@ -179,3 +200,16 @@ func (b *ExactDeviceRequestApplyConfiguration) WithCapacity(value *CapacityRequi
 	b.Capacity = value
 	return b
 }
+
+// WithDerivedAttributes adds the given value to the DerivedAttributes field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the DerivedAttributes field.
+func (b *ExactDeviceRequestApplyConfiguration) WithDerivedAttributes(values ...*DeviceDerivedAttributeApplyConfiguration) *ExactDeviceRequestApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithDerivedAttributes")
+		}
+		b.DerivedAttributes = append(b.DerivedAttributes, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/nodeallocatablemapping.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/nodeallocatablemapping.go
new file mode 100644
index 0000000000..69ba07d5d2
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/nodeallocatablemapping.go
@@ -0,0 +1,90 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	resourcev1 "k8s.io/api/resource/v1"
+	resource "k8s.io/apimachinery/pkg/api/resource"
+)
+
+// NodeAllocatableMappingApplyConfiguration represents a declarative configuration of the NodeAllocatableMapping type for use
+// with apply.
+//
+// NodeAllocatableMapping defines how a DRA allocation directly translates into a node allocatable resource quantity.
+// The mapping can be derived from either the count of allocated devices (via deviceMultiplier) or the specific capacity consumed (via capacityKey and capacityMultiplier). These options are mutually exclusive.
+// Kubelet adds this mapped resource quantity from claim to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.
+type NodeAllocatableMappingApplyConfiguration struct {
+	// CapacityKey references a capacity name defined as a key in the
+	// `spec.devices[*].capacity` map. When this field is set, the value associated with
+	// this key in the `status.allocation.devices.results[*].consumedCapacity` map
+	// (for a specific claim allocation) determines the base quantity for
+	// the node allocatable resource. `capacityMultiplier` must also be set and is
+	// multiplied with the base quantity.
+	// For example, if `spec.devices[*].capacity` has an entry "dra.example.com/memory": "128Gi",
+	// and this field is set to "dra.example.com/memory", then for a claim allocation
+	// that consumes { "dra.example.com/memory": "4Gi" } the base quantity for the
+	// node allocatable resource mapping will be "4Gi".
+	// The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
+	CapacityKey *resourcev1.QualifiedName `json:"capacityKey,omitempty"`
+	// CapacityMultiplier is used as a multiplier for the allocated capacity consumed.
+	// It is only valid if `capacityKey` is set.
+	// The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
+	// For example, if a Device's capacity "dra.example.com/cores" is consumed,
+	// and each "core" provides 2 "cpu"s, the mapping would be:
+	// {ResourceName: "cpu", capacityKey: "dra.example.com/cores", capacityMultiplier: "2"}.
+	// If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
+	CapacityMultiplier *resource.Quantity `json:"capacityMultiplier,omitempty"`
+	// DeviceMultiplier is used as a multiplier for the allocated device count in the claim.
+	// The final node allocatable resource amount is `deviceCount` * `deviceMultiplier`.
+	// For example, a DRA driver representing each cache complex (CCX) as a device would have
+	// {ResourceName: "cpu", deviceMultiplier: "8"} in its `nodeAllocatableResources`.
+	// If 2 devices (CCX) are allocated to the claim, 2 * 8 = 16 CPUs would be considered as allocated.
+	// It is only valid when `capacityKey` and `capacityMultiplier` are not set.
+	DeviceMultiplier *resource.Quantity `json:"deviceMultiplier,omitempty"`
+}
+
+// NodeAllocatableMappingApplyConfiguration constructs a declarative configuration of the NodeAllocatableMapping type for use with
+// apply.
+func NodeAllocatableMapping() *NodeAllocatableMappingApplyConfiguration {
+	return &NodeAllocatableMappingApplyConfiguration{}
+}
+
+// WithCapacityKey sets the CapacityKey field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CapacityKey field is set to the value of the last call.
+func (b *NodeAllocatableMappingApplyConfiguration) WithCapacityKey(value resourcev1.QualifiedName) *NodeAllocatableMappingApplyConfiguration {
+	b.CapacityKey = &value
+	return b
+}
+
+// WithCapacityMultiplier sets the CapacityMultiplier field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CapacityMultiplier field is set to the value of the last call.
+func (b *NodeAllocatableMappingApplyConfiguration) WithCapacityMultiplier(value resource.Quantity) *NodeAllocatableMappingApplyConfiguration {
+	b.CapacityMultiplier = &value
+	return b
+}
+
+// WithDeviceMultiplier sets the DeviceMultiplier field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeviceMultiplier field is set to the value of the last call.
+func (b *NodeAllocatableMappingApplyConfiguration) WithDeviceMultiplier(value resource.Quantity) *NodeAllocatableMappingApplyConfiguration {
+	b.DeviceMultiplier = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/nodeallocatableoverhead.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/nodeallocatableoverhead.go
new file mode 100644
index 0000000000..120fb94f28
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/nodeallocatableoverhead.go
@@ -0,0 +1,67 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+)
+
+// NodeAllocatableOverheadApplyConfiguration represents a declarative configuration of the NodeAllocatableOverhead type for use
+// with apply.
+//
+// NodeAllocatableOverhead defines auxiliary resource overheads incurred when allocating a device.
+// Overheads can be specified as a fixed cost per pod referencing the claim, a variable cost per container reference, or both.
+// Kubelet accounts for this overhead by adding it to both the pod-level and container-level cgroups of referencing containers.
+type NodeAllocatableOverheadApplyConfiguration struct {
+	// PerPod is overhead applied once per pod referencing the claim on this node.
+	// This is a flat overhead incurred for every pod referencing the claim.
+	PerPod *resource.Quantity `json:"perPod,omitempty"`
+	// PerContainer is applied per container reference to the claim.
+	// This models overhead scaling linearly with the number of containers actively using the device.
+	// When both PerPod and PerContainer are specified, the total overhead allocated for each pod referencing
+	// the claim is computed as:
+	// Quantity = PerPod + (PerContainer * NumReferences)
+	// Kubelet accounts for this overhead in cgroups:
+	// - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences).
+	// - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container.
+	// This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once.
+	PerContainer *resource.Quantity `json:"perContainer,omitempty"`
+}
+
+// NodeAllocatableOverheadApplyConfiguration constructs a declarative configuration of the NodeAllocatableOverhead type for use with
+// apply.
+func NodeAllocatableOverhead() *NodeAllocatableOverheadApplyConfiguration {
+	return &NodeAllocatableOverheadApplyConfiguration{}
+}
+
+// WithPerPod sets the PerPod field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PerPod field is set to the value of the last call.
+func (b *NodeAllocatableOverheadApplyConfiguration) WithPerPod(value resource.Quantity) *NodeAllocatableOverheadApplyConfiguration {
+	b.PerPod = &value
+	return b
+}
+
+// WithPerContainer sets the PerContainer field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PerContainer field is set to the value of the last call.
+func (b *NodeAllocatableOverheadApplyConfiguration) WithPerContainer(value resource.Quantity) *NodeAllocatableOverheadApplyConfiguration {
+	b.PerContainer = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/nodeallocatableresource.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/nodeallocatableresource.go
new file mode 100644
index 0000000000..fc13ebdde8
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/nodeallocatableresource.go
@@ -0,0 +1,65 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// NodeAllocatableResourceApplyConfiguration represents a declarative configuration of the NodeAllocatableResource type for use
+// with apply.
+//
+// NodeAllocatableResource defines the translation between the DRA device/capacity
+// units requested to the corresponding quantity of the node allocatable resource.
+// At least one of Mapping or Overhead must be specified. Not specifying either is an invalid configuration.
+type NodeAllocatableResourceApplyConfiguration struct {
+	// Mapping is used when the device directly models a node allocatable resource like standard CPU or memory
+	// (e.g., with a CPU DRA driver). The calculated quantity is accounted for exactly once per claim instance
+	// on the node. To prevent node cgroup isolation friction, the scheduler explicitly
+	// blocks sharing mapped device claims across multiple pods.
+	Mapping *NodeAllocatableMappingApplyConfiguration `json:"mapping,omitempty"`
+	// Overhead contains fields for modeling auxiliary overhead incurred on node allocatable resources
+	// when allocating devices that are not themselves modeling a node allocatable resource (e.g., host memory overhead for GPUs).
+	// Sharing overhead-mapped claims across multiple pods is allowed. The node allocatable overhead is accounted
+	// for individually for each pod referencing the claim.
+	// Overhead is always subtracted from the node's allocatable capacity for the resource, even when mapping
+	// is specified for the same resource.
+	// Eg: If a device models memory capacity per socket as a consumable capacity pool via Mapping (with CapacityKey),
+	// any overhead specified for the same resource will be subtracted from the node's general allocatable capacity
+	// and not from the per-socket capacity pool in Mapping.
+	Overhead *NodeAllocatableOverheadApplyConfiguration `json:"overhead,omitempty"`
+}
+
+// NodeAllocatableResourceApplyConfiguration constructs a declarative configuration of the NodeAllocatableResource type for use with
+// apply.
+func NodeAllocatableResource() *NodeAllocatableResourceApplyConfiguration {
+	return &NodeAllocatableResourceApplyConfiguration{}
+}
+
+// WithMapping sets the Mapping field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Mapping field is set to the value of the last call.
+func (b *NodeAllocatableResourceApplyConfiguration) WithMapping(value *NodeAllocatableMappingApplyConfiguration) *NodeAllocatableResourceApplyConfiguration {
+	b.Mapping = value
+	return b
+}
+
+// WithOverhead sets the Overhead field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Overhead field is set to the value of the last call.
+func (b *NodeAllocatableResourceApplyConfiguration) WithOverhead(value *NodeAllocatableOverheadApplyConfiguration) *NodeAllocatableResourceApplyConfiguration {
+	b.Overhead = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/nodeallocatableresourcemapping.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/nodeallocatableresourcemapping.go
deleted file mode 100644
index 600d96af89..0000000000
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/nodeallocatableresourcemapping.go
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by applyconfiguration-gen. DO NOT EDIT.
-
-package v1
-
-import (
-	resourcev1 "k8s.io/api/resource/v1"
-	resource "k8s.io/apimachinery/pkg/api/resource"
-)
-
-// NodeAllocatableResourceMappingApplyConfiguration represents a declarative configuration of the NodeAllocatableResourceMapping type for use
-// with apply.
-//
-// NodeAllocatableResourceMapping defines the translation between the DRA device/capacity
-// units requested to the corresponding quantity of the node allocatable resource.
-type NodeAllocatableResourceMappingApplyConfiguration struct {
-	// CapacityKey references a capacity name defined as a key in the
-	// `spec.devices[*].capacity` map. When this field is set, the value associated with
-	// this key in the `status.allocation.devices.results[*].consumedCapacity` map
-	// (for a specific claim allocation) determines the base quantity for
-	// the node allocatable resource. If `allocationMultiplier` is also set, it is
-	// multiplied with the base quantity.
-	// For example, if `spec.devices[*].capacity` has an entry "dra.example.com/memory": "128Gi",
-	// and this field is set to "dra.example.com/memory", then for a claim allocation
-	// that consumes { "dra.example.com/memory": "4Gi" } the base quantity for the
-	// node allocatable resource mapping will be "4Gi", and `allocationMultiplier` should
-	// be omitted or set to "1".
-	CapacityKey *resourcev1.QualifiedName `json:"capacityKey,omitempty"`
-	// AllocationMultiplier is used as a multiplier for the allocated device count or the allocated capacity in the claim.
-	// It defaults to 1 if not specified. How the field is used also depends on whether `capacityKey` is set.
-	// 1.  If `capacityKey` is NOT set: `allocationMultiplier` multiplies the device count allocated to the claim.
-	// a. A DRA driver representing each CPU core as a device would have
-	// {ResourceName: "cpu", allocationMultiplier: "2"} in its
-	// `nodeAllocatableResourceMappings`. If 4 devices are allocated to the claim,
-	// 4 * 2 CPUs would be considered as allocated and subtracted from the node's capacity.
-	// b. A GPU device that needs additional node memory per GPU allocation would
-	// have {ResourceName: "memory", allocationMultiplier: "2Gi"}.  Each allocated
-	// GPU device instance of this type will account for 2Gi of memory.
-	//
-	// 2.  If `capacityKey` IS set: `allocationMultiplier` is multiplied by the amount of that capacity consumed.
-	// The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `allocationMultiplier`.
-	// For example, if a Device's capacity "dra.example.com/cores" is consumed,
-	// and each "core" provides 2 "cpu"s, the mapping would be:
-	// {ResourceName: "cpu", capacityKey: "dra.example.com/cores", allocationMultiplier: "2"}.
-	// If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
-	AllocationMultiplier *resource.Quantity `json:"allocationMultiplier,omitempty"`
-}
-
-// NodeAllocatableResourceMappingApplyConfiguration constructs a declarative configuration of the NodeAllocatableResourceMapping type for use with
-// apply.
-func NodeAllocatableResourceMapping() *NodeAllocatableResourceMappingApplyConfiguration {
-	return &NodeAllocatableResourceMappingApplyConfiguration{}
-}
-
-// WithCapacityKey sets the CapacityKey field in the declarative configuration to the given value
-// and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the CapacityKey field is set to the value of the last call.
-func (b *NodeAllocatableResourceMappingApplyConfiguration) WithCapacityKey(value resourcev1.QualifiedName) *NodeAllocatableResourceMappingApplyConfiguration {
-	b.CapacityKey = &value
-	return b
-}
-
-// WithAllocationMultiplier sets the AllocationMultiplier field in the declarative configuration to the given value
-// and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the AllocationMultiplier field is set to the value of the last call.
-func (b *NodeAllocatableResourceMappingApplyConfiguration) WithAllocationMultiplier(value resource.Quantity) *NodeAllocatableResourceMappingApplyConfiguration {
-	b.AllocationMultiplier = &value
-	return b
-}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceclaim.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceclaim.go
index 5a87ea3cbc..ec3504e623 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceclaim.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceclaim.go
@@ -36,7 +36,7 @@ import (
 // stanza tracks whether this claim has been satisfied and what specific
 // resources have been allocated.
 type ResourceClaimApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Spec describes what is being requested and how to configure it.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceclaimtemplate.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceclaimtemplate.go
index cee18f3797..2f2fa25069 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceclaimtemplate.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceclaimtemplate.go
@@ -32,7 +32,7 @@ import (
 //
 // ResourceClaimTemplate is used to produce ResourceClaim objects.
 type ResourceClaimTemplateApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Describes the ResourceClaim that is to be generated.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourcepool.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourcepool.go
index 2c779f3cad..4dce50617c 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourcepool.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourcepool.go
@@ -25,6 +25,8 @@ package v1
 type ResourcePoolApplyConfiguration struct {
 	// Name is used to identify the pool. For node-local devices, this
 	// is often the node name, but this is not required.
+	// A field selector can be used to list only ResourceSlice objects
+	// belonging to a certain pool.
 	//
 	// It must not be longer than 253 characters and must consist of one or more DNS sub-domains
 	// separated by slashes. This field is immutable.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceslice.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceslice.go
index 7a3eec9d5c..d7eb3d6893 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceslice.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceslice.go
@@ -52,7 +52,7 @@ import (
 // For resources that are not local to a node, the node name is not set. Instead,
 // the driver may use a node selector to specify where the devices are available.
 type ResourceSliceApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
+	metav1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Contains the information published by the driver.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceslicespec.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceslicespec.go
index b268fc8d7c..a7c858e0ea 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceslicespec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1/resourceslicespec.go
@@ -19,6 +19,7 @@ limitations under the License.
 package v1
 
 import (
+	resourcev1 "k8s.io/api/resource/v1"
 	corev1 "k8s.io/client-go/applyconfigurations/core/v1"
 )
 
@@ -82,6 +83,28 @@ type ResourceSliceSpecApplyConfiguration struct {
 	//
 	// The maximum number of counter sets is 8.
 	SharedCounters []CounterSetApplyConfiguration `json:"sharedCounters,omitempty"`
+	// PartitionTypeAttribute names a string device attribute (by fully
+	// qualified name, e.g. "gpu.example.com/profile") whose value labels
+	// each device with its partition type, such as "Full" or "Half" for a
+	// MIG-style GPU.
+	//
+	// When set, every partitionable device in the slice must carry the attribute
+	// and devices sharing a value must share the same ConsumesCounters cost.
+	PartitionTypeAttribute *resourcev1.FullyQualifiedName `json:"partitionTypeAttribute,omitempty"`
+	// SkipNodeOperations lists node-local resource operations (gRPC calls)
+	// that will be skipped for the devices in this slice when determining whether
+	// operations are necessary on the node. If all allocated devices for a driver in
+	// a claim skip an operation, that gRPC call will be skipped. Valid values are:
+	//
+	// - "NodePrepareResources": NodePrepareResources gRPC calls are skipped. This
+	// value cannot be specified unless "NodeUnprepareResources" is also listed
+	// (or "*" is specified).
+	// - "NodeUnprepareResources": NodeUnprepareResources gRPC calls are skipped.
+	// - "*": All node-local resource operations are skipped.
+	//
+	// Other values may be added in the future. The kubelet must ignore unknown
+	// values.
+	SkipNodeOperations []resourcev1.SkipNodeOperation `json:"skipNodeOperations,omitempty"`
 }
 
 // ResourceSliceSpecApplyConfiguration constructs a declarative configuration of the ResourceSliceSpec type for use with
@@ -163,3 +186,21 @@ func (b *ResourceSliceSpecApplyConfiguration) WithSharedCounters(values ...*Coun
 	}
 	return b
 }
+
+// WithPartitionTypeAttribute sets the PartitionTypeAttribute field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PartitionTypeAttribute field is set to the value of the last call.
+func (b *ResourceSliceSpecApplyConfiguration) WithPartitionTypeAttribute(value resourcev1.FullyQualifiedName) *ResourceSliceSpecApplyConfiguration {
+	b.PartitionTypeAttribute = &value
+	return b
+}
+
+// WithSkipNodeOperations adds the given value to the SkipNodeOperations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the SkipNodeOperations field.
+func (b *ResourceSliceSpecApplyConfiguration) WithSkipNodeOperations(values ...resourcev1.SkipNodeOperation) *ResourceSliceSpecApplyConfiguration {
+	for i := range values {
+		b.SkipNodeOperations = append(b.SkipNodeOperations, values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/devicetaintrule.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/devicetaintrule.go
index b28d015de3..4824d6ccf8 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/devicetaintrule.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/devicetaintrule.go
@@ -34,7 +34,7 @@ import (
 // This has the same effect as if the taint was specified directly
 // in the ResourceSlice by the DRA driver.
 type DeviceTaintRuleApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Spec specifies the selector and one taint.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/partitiontypestatus.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/partitiontypestatus.go
new file mode 100644
index 0000000000..f6222c71fd
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/partitiontypestatus.go
@@ -0,0 +1,77 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+// PartitionTypeStatusApplyConfiguration represents a declarative configuration of the PartitionTypeStatus type for use
+// with apply.
+//
+// PartitionTypeStatus reports allocatability for a single partition type,
+// identified by the value of a grouping attribute.
+type PartitionTypeStatusApplyConfiguration struct {
+	// Attribute is the fully qualified name of the device attribute whose value
+	// groups this entry. It is the PartitionTypeAttribute declared by the
+	// devices' own slice, or the default named in the request when their slice
+	// declares none.
+	Attribute *string `json:"attribute,omitempty"`
+	// Type is the partition type value (e.g. "Full" or "Half").
+	Type *string `json:"type,omitempty"`
+	// Total is the number of devices of this partition type in the pool.
+	Total *int32 `json:"total,omitempty"`
+	// Allocatable is the number of additional devices of this partition type
+	// that could still be allocated given current shared-counter consumption.
+	Allocatable *int32 `json:"allocatable,omitempty"`
+}
+
+// PartitionTypeStatusApplyConfiguration constructs a declarative configuration of the PartitionTypeStatus type for use with
+// apply.
+func PartitionTypeStatus() *PartitionTypeStatusApplyConfiguration {
+	return &PartitionTypeStatusApplyConfiguration{}
+}
+
+// WithAttribute sets the Attribute field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Attribute field is set to the value of the last call.
+func (b *PartitionTypeStatusApplyConfiguration) WithAttribute(value string) *PartitionTypeStatusApplyConfiguration {
+	b.Attribute = &value
+	return b
+}
+
+// WithType sets the Type field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Type field is set to the value of the last call.
+func (b *PartitionTypeStatusApplyConfiguration) WithType(value string) *PartitionTypeStatusApplyConfiguration {
+	b.Type = &value
+	return b
+}
+
+// WithTotal sets the Total field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Total field is set to the value of the last call.
+func (b *PartitionTypeStatusApplyConfiguration) WithTotal(value int32) *PartitionTypeStatusApplyConfiguration {
+	b.Total = &value
+	return b
+}
+
+// WithAllocatable sets the Allocatable field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Allocatable field is set to the value of the last call.
+func (b *PartitionTypeStatusApplyConfiguration) WithAllocatable(value int32) *PartitionTypeStatusApplyConfiguration {
+	b.Allocatable = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/poolstatus.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/poolstatus.go
index 343fe8247d..3daeed07dc 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/poolstatus.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/poolstatus.go
@@ -63,6 +63,19 @@ type PoolStatusApplyConfiguration struct {
 	// validated (e.g., incomplete slice publication). When set, device
 	// count fields and ResourceSliceCount may be unset.
 	ValidationError *string `json:"validationError,omitempty"`
+	// PartitionSummary reports allocatability per (attribute, partition type)
+	// for a partitionable pool that publishes SharedCounters. Each entry names
+	// the grouping attribute it was resolved from: the PartitionTypeAttribute
+	// declared by a device's own slice, or for devices whose slice declares
+	// none, the default named in the request. A pool that mixes partitions
+	// declared under different attributes reports each independently. When no
+	// slice declares an attribute and the request names no default, the pool
+	// reports no partition summary.
+	PartitionSummary []PartitionTypeStatusApplyConfiguration `json:"partitionSummary,omitempty"`
+	// ShareableSummary reports aggregate capacity for a pool that contains
+	// devices with AllowMultipleAllocations. It is populated only when at
+	// least one device in the pool is shareable.
+	ShareableSummary *ShareableSummaryStatusApplyConfiguration `json:"shareableSummary,omitempty"`
 }
 
 // PoolStatusApplyConfiguration constructs a declarative configuration of the PoolStatus type for use with
@@ -150,3 +163,24 @@ func (b *PoolStatusApplyConfiguration) WithValidationError(value string) *PoolSt
 	b.ValidationError = &value
 	return b
 }
+
+// WithPartitionSummary adds the given value to the PartitionSummary field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the PartitionSummary field.
+func (b *PoolStatusApplyConfiguration) WithPartitionSummary(values ...*PartitionTypeStatusApplyConfiguration) *PoolStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithPartitionSummary")
+		}
+		b.PartitionSummary = append(b.PartitionSummary, *values[i])
+	}
+	return b
+}
+
+// WithShareableSummary sets the ShareableSummary field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ShareableSummary field is set to the value of the last call.
+func (b *PoolStatusApplyConfiguration) WithShareableSummary(value *ShareableSummaryStatusApplyConfiguration) *PoolStatusApplyConfiguration {
+	b.ShareableSummary = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/resourcepoolstatusrequest.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/resourcepoolstatusrequest.go
index aee4d0ed90..e5b82c28ae 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/resourcepoolstatusrequest.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/resourcepoolstatusrequest.go
@@ -34,7 +34,7 @@ import (
 // based on the provided filters. Once status is set, the request is considered complete and will not be reprocessed.
 // Users should delete and recreate requests to get updated information.
 type ResourcePoolStatusRequestApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Spec defines the filters for which pools to include in the status.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/resourcepoolstatusrequestspec.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/resourcepoolstatusrequestspec.go
index bb86727321..85fd362a25 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/resourcepoolstatusrequestspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/resourcepoolstatusrequestspec.go
@@ -40,6 +40,19 @@ type ResourcePoolStatusRequestSpecApplyConfiguration struct {
 	// Minimum: 1
 	// Maximum: 1000
 	Limit *int32 `json:"limit,omitempty"`
+	// DefaultPartitionTypeAttribute optionally names a device attribute (by its
+	// fully qualified name, e.g. "gpu.example.com/profile") to use as the default
+	// grouping attribute for partitionable devices whose slice has not declared
+	// one themselves.
+	//
+	// A slice's own PartitionTypeAttribute always takes precedence. This default
+	// applies only to devices whose slice does not declare one, so that a request
+	// can still get an accurate partitionSummary from a driver that has not
+	// been updated to declare it. When neither the slice nor this default names
+	// an attribute, a partitionable pool reports no partitionSummary.
+	//
+	// Must include the domain qualifier.
+	DefaultPartitionTypeAttribute *string `json:"defaultPartitionTypeAttribute,omitempty"`
 }
 
 // ResourcePoolStatusRequestSpecApplyConfiguration constructs a declarative configuration of the ResourcePoolStatusRequestSpec type for use with
@@ -71,3 +84,11 @@ func (b *ResourcePoolStatusRequestSpecApplyConfiguration) WithLimit(value int32)
 	b.Limit = &value
 	return b
 }
+
+// WithDefaultPartitionTypeAttribute sets the DefaultPartitionTypeAttribute field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DefaultPartitionTypeAttribute field is set to the value of the last call.
+func (b *ResourcePoolStatusRequestSpecApplyConfiguration) WithDefaultPartitionTypeAttribute(value string) *ResourcePoolStatusRequestSpecApplyConfiguration {
+	b.DefaultPartitionTypeAttribute = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/shareablecapacitystatus.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/shareablecapacitystatus.go
new file mode 100644
index 0000000000..1e90896373
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/shareablecapacitystatus.go
@@ -0,0 +1,77 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+)
+
+// ShareableCapacityStatusApplyConfiguration represents a declarative configuration of the ShareableCapacityStatus type for use
+// with apply.
+//
+// ShareableCapacityStatus reports aggregate amounts for a single shareable
+// capacity key.
+type ShareableCapacityStatusApplyConfiguration struct {
+	// Name is the capacity name.
+	Name *string `json:"name,omitempty"`
+	// Total is the sum of this capacity across shareable devices in the pool.
+	Total *resource.Quantity `json:"total,omitempty"`
+	// Consumed is the amount drawn by current allocations.
+	Consumed *resource.Quantity `json:"consumed,omitempty"`
+	// Available is Total minus Consumed, never negative.
+	Available *resource.Quantity `json:"available,omitempty"`
+}
+
+// ShareableCapacityStatusApplyConfiguration constructs a declarative configuration of the ShareableCapacityStatus type for use with
+// apply.
+func ShareableCapacityStatus() *ShareableCapacityStatusApplyConfiguration {
+	return &ShareableCapacityStatusApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ShareableCapacityStatusApplyConfiguration) WithName(value string) *ShareableCapacityStatusApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithTotal sets the Total field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Total field is set to the value of the last call.
+func (b *ShareableCapacityStatusApplyConfiguration) WithTotal(value resource.Quantity) *ShareableCapacityStatusApplyConfiguration {
+	b.Total = &value
+	return b
+}
+
+// WithConsumed sets the Consumed field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Consumed field is set to the value of the last call.
+func (b *ShareableCapacityStatusApplyConfiguration) WithConsumed(value resource.Quantity) *ShareableCapacityStatusApplyConfiguration {
+	b.Consumed = &value
+	return b
+}
+
+// WithAvailable sets the Available field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Available field is set to the value of the last call.
+func (b *ShareableCapacityStatusApplyConfiguration) WithAvailable(value resource.Quantity) *ShareableCapacityStatusApplyConfiguration {
+	b.Available = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/shareablesummarystatus.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/shareablesummarystatus.go
new file mode 100644
index 0000000000..0a52934279
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1alpha3/shareablesummarystatus.go
@@ -0,0 +1,71 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+// ShareableSummaryStatusApplyConfiguration represents a declarative configuration of the ShareableSummaryStatus type for use
+// with apply.
+//
+// ShareableSummaryStatus reports aggregate capacity for a pool that contains
+// devices with AllowMultipleAllocations.
+type ShareableSummaryStatusApplyConfiguration struct {
+	// FullyAvailableDevices is the number of shareable devices with no
+	// capacity consumed.
+	FullyAvailableDevices *int32 `json:"fullyAvailableDevices,omitempty"`
+	// PartiallyAvailableDevices is the number of shareable devices with some
+	// but not all capacity consumed.
+	PartiallyAvailableDevices *int32 `json:"partiallyAvailableDevices,omitempty"`
+	// Capacity reports aggregate total, consumed, and available amounts per
+	// shareable capacity key across the pool.
+	Capacity []ShareableCapacityStatusApplyConfiguration `json:"capacity,omitempty"`
+}
+
+// ShareableSummaryStatusApplyConfiguration constructs a declarative configuration of the ShareableSummaryStatus type for use with
+// apply.
+func ShareableSummaryStatus() *ShareableSummaryStatusApplyConfiguration {
+	return &ShareableSummaryStatusApplyConfiguration{}
+}
+
+// WithFullyAvailableDevices sets the FullyAvailableDevices field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the FullyAvailableDevices field is set to the value of the last call.
+func (b *ShareableSummaryStatusApplyConfiguration) WithFullyAvailableDevices(value int32) *ShareableSummaryStatusApplyConfiguration {
+	b.FullyAvailableDevices = &value
+	return b
+}
+
+// WithPartiallyAvailableDevices sets the PartiallyAvailableDevices field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PartiallyAvailableDevices field is set to the value of the last call.
+func (b *ShareableSummaryStatusApplyConfiguration) WithPartiallyAvailableDevices(value int32) *ShareableSummaryStatusApplyConfiguration {
+	b.PartiallyAvailableDevices = &value
+	return b
+}
+
+// WithCapacity adds the given value to the Capacity field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Capacity field.
+func (b *ShareableSummaryStatusApplyConfiguration) WithCapacity(values ...*ShareableCapacityStatusApplyConfiguration) *ShareableSummaryStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithCapacity")
+		}
+		b.Capacity = append(b.Capacity, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/basicdevice.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/basicdevice.go
index 64527b2938..5d4c565e8a 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/basicdevice.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/basicdevice.go
@@ -110,7 +110,7 @@ type BasicDeviceApplyConfiguration struct {
 	// If AllowMultipleAllocations is set to true, the device can be allocated more than once,
 	// and all of its capacity is consumable, regardless of whether the requestPolicy is defined or not.
 	AllowMultipleAllocations *bool `json:"allowMultipleAllocations,omitempty"`
-	// NodeAllocatableResourceMappings defines the mapping of node resources
+	// NodeAllocatableResources defines the mapping of node resources
 	// that are managed by the DRA driver exposing this device. This includes resources currently
 	// reported in v1.Node `status.allocatable` that are not extended resources
 	// (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources).
@@ -121,7 +121,7 @@ type BasicDeviceApplyConfiguration struct {
 	// dependencies of an accelerator device.
 	// The keys of this map are the node-allocatable resource names (e.g., "cpu", "memory").
 	// Extended resource names are not permitted as keys.
-	NodeAllocatableResourceMappings map[corev1.ResourceName]NodeAllocatableResourceMappingApplyConfiguration `json:"nodeAllocatableResourceMappings,omitempty"`
+	NodeAllocatableResources map[corev1.ResourceName]NodeAllocatableResourceApplyConfiguration `json:"nodeAllocatableResources,omitempty"`
 }
 
 // BasicDeviceApplyConfiguration constructs a declarative configuration of the BasicDevice type for use with
@@ -244,16 +244,16 @@ func (b *BasicDeviceApplyConfiguration) WithAllowMultipleAllocations(value bool)
 	return b
 }
 
-// WithNodeAllocatableResourceMappings puts the entries into the NodeAllocatableResourceMappings field in the declarative configuration
+// WithNodeAllocatableResources puts the entries into the NodeAllocatableResources field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
-// If called multiple times, the entries provided by each call will be put on the NodeAllocatableResourceMappings field,
-// overwriting an existing map entries in NodeAllocatableResourceMappings field with the same key.
-func (b *BasicDeviceApplyConfiguration) WithNodeAllocatableResourceMappings(entries map[corev1.ResourceName]NodeAllocatableResourceMappingApplyConfiguration) *BasicDeviceApplyConfiguration {
-	if b.NodeAllocatableResourceMappings == nil && len(entries) > 0 {
-		b.NodeAllocatableResourceMappings = make(map[corev1.ResourceName]NodeAllocatableResourceMappingApplyConfiguration, len(entries))
+// If called multiple times, the entries provided by each call will be put on the NodeAllocatableResources field,
+// overwriting an existing map entries in NodeAllocatableResources field with the same key.
+func (b *BasicDeviceApplyConfiguration) WithNodeAllocatableResources(entries map[corev1.ResourceName]NodeAllocatableResourceApplyConfiguration) *BasicDeviceApplyConfiguration {
+	if b.NodeAllocatableResources == nil && len(entries) > 0 {
+		b.NodeAllocatableResources = make(map[corev1.ResourceName]NodeAllocatableResourceApplyConfiguration, len(entries))
 	}
 	for k, v := range entries {
-		b.NodeAllocatableResourceMappings[k] = v
+		b.NodeAllocatableResources[k] = v
 	}
 	return b
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/capacityrequestpolicyrange.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/capacityrequestpolicyrange.go
index cddfe6daf9..9216d4deb5 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/capacityrequestpolicyrange.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/capacityrequestpolicyrange.go
@@ -27,6 +27,13 @@ import (
 //
 // CapacityRequestPolicyRange defines a valid range for consumable capacity values.
 //
+// If the DRAFractionalCapacityRange feature gate is
+// enabled and at least one of Min, Max, or Step is a fractional quantity (i.e.
+// its value is not an integer), milli-unit arithmetic is used instead,
+// supporting values with up to 3 decimal places (e.g. 100m = 0.1).
+// The largest supported value then is 1000 times smaller compared to using 64-bit integers.
+// Otherwise, all comparisons use 64-bit integer arithmetic via resource.Quantity.Value().
+//
 // - If the requested amount is less than Min, it is rounded up to the Min value.
 // - If Step is set and the requested amount is between Min and Max but not aligned with Step,
 // it will be rounded up to the next value equal to Min + (n * Step).
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/celdeviceselector.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/celdeviceselector.go
index ba65467ae5..40663836d6 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/celdeviceselector.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/celdeviceselector.go
@@ -33,7 +33,7 @@ type CELDeviceSelectorApplyConfiguration struct {
 	// - driver (string): the name of the driver which defines this device.
 	// - attributes (map[string]object): the device's attributes, grouped by prefix
 	// (e.g. device.attributes["dra.example.com"] evaluates to an object with all
-	// of the attributes which were prefixed by "dra.example.com".
+	// of the attributes which were prefixed by "dra.example.com").
 	// - capacity (map[string]object): the device's capacities, grouped by prefix.
 	// - allowMultipleAllocations (bool): the allowMultipleAllocations property of the device
 	// (v1.34+ with the DRAConsumableCapacity feature enabled).
@@ -66,6 +66,15 @@ type CELDeviceSelectorApplyConfiguration struct {
 	// A robust expression should check for the existence of attributes
 	// before referencing them.
 	//
+	// Common errors:
+	// - "no such key": Use optional chaining (.? followed by orValue())
+	// or guarding the check with has() for optional fields.
+	// See CEL Optional Types for details:
+	// https://pkg.go.dev/github.com/google/cel-go@v0.17.4/cel#OptionalTypes
+	//
+	// For more CEL expression syntax and examples, see:
+	// https://kubernetes.io/docs/reference/using-api/cel/
+	//
 	// For ease of use, the cel.bind() function is enabled, and can be used
 	// to simplify expressions that access multiple attributes with the
 	// same domain. For example:
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceallocationconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceallocationconfiguration.go
index 314ff5fa71..f26f528fbe 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceallocationconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceallocationconfiguration.go
@@ -38,7 +38,7 @@ type DeviceAllocationConfigurationApplyConfiguration struct {
 	// and may include the subrequest using the format <main request>[/<subrequest>]. If just
 	// the main request is given, the configuration applies to all subrequests.
 	Requests                              []string `json:"requests,omitempty"`
-	DeviceConfigurationApplyConfiguration `json:",inline"`
+	DeviceConfigurationApplyConfiguration `json:""`
 }
 
 // DeviceAllocationConfigurationApplyConfiguration constructs a declarative configuration of the DeviceAllocationConfiguration type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclaimconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclaimconfiguration.go
index 2c7faab5b9..1b094a80cb 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclaimconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclaimconfiguration.go
@@ -30,7 +30,7 @@ type DeviceClaimConfigurationApplyConfiguration struct {
 	// and may include the subrequest using the format <main request>[/<subrequest>]. If just
 	// the main request is given, the configuration applies to all subrequests.
 	Requests                              []string `json:"requests,omitempty"`
-	DeviceConfigurationApplyConfiguration `json:",inline"`
+	DeviceConfigurationApplyConfiguration `json:""`
 }
 
 // DeviceClaimConfigurationApplyConfiguration constructs a declarative configuration of the DeviceClaimConfiguration type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclass.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclass.go
index b0fcbac6fb..a242986f95 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclass.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclass.go
@@ -38,7 +38,7 @@ import (
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type DeviceClassApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Spec defines what can be allocated and how to configure it.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclassconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclassconfiguration.go
index d521f01e12..b87b5407ce 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclassconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclassconfiguration.go
@@ -23,7 +23,7 @@ package v1beta1
 //
 // DeviceClassConfiguration is used in DeviceClass.
 type DeviceClassConfigurationApplyConfiguration struct {
-	DeviceConfigurationApplyConfiguration `json:",inline"`
+	DeviceConfigurationApplyConfiguration `json:""`
 }
 
 // DeviceClassConfigurationApplyConfiguration constructs a declarative configuration of the DeviceClassConfiguration type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclassspec.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclassspec.go
index c234bdd732..d01256a3e1 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclassspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/deviceclassspec.go
@@ -40,8 +40,6 @@ type DeviceClassSpecApplyConfiguration struct {
 	// is picked to satisfy a pod's extended resource requests.
 	// If two classes are created at the same time, then the name of the class
 	// lexicographically sorted first is picked.
-	//
-	// This is a beta field.
 	ExtendedResourceName *string `json:"extendedResourceName,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicecounterconsumption.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicecounterconsumption.go
index 1b1956c5cf..667a88bd1c 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicecounterconsumption.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicecounterconsumption.go
@@ -31,6 +31,26 @@ type DeviceCounterConsumptionApplyConfiguration struct {
 	//
 	// The maximum number of counters is 32.
 	Counters map[string]CounterApplyConfiguration `json:"counters,omitempty"`
+	// CompatibilityGroups is a list of opaque group names for
+	// this counter set consumption.
+	//
+	// Devices that consume counters from the same counter set may only be
+	// allocated at the same time ("co-allocated") if they all share at least
+	// one common group: the intersection of the CompatibilityGroups of all
+	// co-allocated devices on that counter set must be non-empty. Devices
+	// that consume from different counter sets are never compared via this
+	// field.
+	//
+	// An unset field, an explicit nil, and an empty list are equivalent and
+	// mean "no groups": such a device is only co-allocatable with sibling
+	// devices on the same counter set that also have no groups, and is never
+	// co-allocatable with a device that declares one or more groups.
+	//
+	// Group names are opaque and meaningful only within the
+	// publishing driver's pool.
+	//
+	// The maximum number of groups is 2, and the names must be unique.
+	CompatibilityGroups []string `json:"compatibilityGroups,omitempty"`
 }
 
 // DeviceCounterConsumptionApplyConfiguration constructs a declarative configuration of the DeviceCounterConsumption type for use with
@@ -60,3 +80,13 @@ func (b *DeviceCounterConsumptionApplyConfiguration) WithCounters(entries map[st
 	}
 	return b
 }
+
+// WithCompatibilityGroups adds the given value to the CompatibilityGroups field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the CompatibilityGroups field.
+func (b *DeviceCounterConsumptionApplyConfiguration) WithCompatibilityGroups(values ...string) *DeviceCounterConsumptionApplyConfiguration {
+	for i := range values {
+		b.CompatibilityGroups = append(b.CompatibilityGroups, values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicederivedattribute.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicederivedattribute.go
new file mode 100644
index 0000000000..0c560d70bc
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicederivedattribute.go
@@ -0,0 +1,95 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
+)
+
+// DeviceDerivedAttributeApplyConfiguration represents a declarative configuration of the DeviceDerivedAttribute type for use
+// with apply.
+//
+// DeviceDerivedAttribute defines a derived attribute computed via CEL.
+type DeviceDerivedAttributeApplyConfiguration struct {
+	// Name is the identifier for this derived attribute, used in constraints.
+	//
+	// It must be a DNS subdomain followed by a slash ("/") followed by a C identifier
+	// (e.g. "example.com/numaNode" or "derived/numaNode").
+	//
+	// If the chosen name matches an existing physical attribute from a driver,
+	// the derived attribute's expression will shadow the physical attribute,
+	// and its evaluated value will be used in constraints instead. When the goal
+	// is to define a derived attribute that is only used within the ResourceClaim
+	// and not meant to shadow an existing attribute, use a domain prefix that
+	// no DRA driver should be using (e.g. "derived/myAttribute").
+	//
+	// It is not valid to define a derived attribute that isn't used in at least
+	// one constraint.
+	Name *resourcev1beta1.FullyQualifiedName `json:"name,omitempty"`
+	// Expression is a CEL expression evaluated against each candidate device.
+	// The expression must evaluate to a primitive scalar (string, integer,
+	// boolean, or semver) or a list of these scalars ([]string, []int64,
+	// []bool, []semver) to act as a virtual grouping key. Any other return type
+	// is an error and causes CEL evaluation for the device to fail.
+	//
+	// The expression's input is an object named "device", which carries the
+	// same properties as in a CELDeviceSelector.
+	//
+	// When pod scheduling encounters CEL runtime errors (such as looking
+	// up an attribute that isn't defined) for some devices, it will abort
+	// allocation and fail scheduling for the Pod. Surfacing evaluation
+	// errors immediately prevents silent topology matching failures that are
+	// extremely hard to detect. A robust expression should, for example, check
+	// for the existence of attributes before referencing them to avoid
+	// runtime evaluation errors.
+	//
+	// The expression gets evaluated after a device has passed the other
+	// selector expressions for the request in which this expression is used.
+	// This allows writing expressions that are tailored towards the specific
+	// devices being requested (for example, by assuming the device is from a
+	// certain vendor and skipping those checks).
+	//
+	// The length of the expression must be smaller or equal to 10 Ki. The
+	// cost of evaluating it is also limited based on the estimated number
+	// of logical steps; the combined cost of all derived attributes in a
+	// claim is capped by a shared CEL cost budget.
+	Expression *string `json:"expression,omitempty"`
+}
+
+// DeviceDerivedAttributeApplyConfiguration constructs a declarative configuration of the DeviceDerivedAttribute type for use with
+// apply.
+func DeviceDerivedAttribute() *DeviceDerivedAttributeApplyConfiguration {
+	return &DeviceDerivedAttributeApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *DeviceDerivedAttributeApplyConfiguration) WithName(value resourcev1beta1.FullyQualifiedName) *DeviceDerivedAttributeApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithExpression sets the Expression field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Expression field is set to the value of the last call.
+func (b *DeviceDerivedAttributeApplyConfiguration) WithExpression(value string) *DeviceDerivedAttributeApplyConfiguration {
+	b.Expression = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicerequest.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicerequest.go
index fdcb928a57..caa52fcd22 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicerequest.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicerequest.go
@@ -149,6 +149,27 @@ type DeviceRequestApplyConfiguration struct {
 	// the request fails if there are devices that otherwise match the request,
 	// and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.
 	Capacity *CapacityRequirementsApplyConfiguration `json:"capacity,omitempty"`
+	// DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+	// for each candidate device. These virtual attributes can be referenced in
+	// `.devices.constraints` to align and match different devices (e.g., co-allocating
+	// a GPU and a NIC on the same NUMA node) even if their drivers publish different
+	// attributes. Derived attributes are not available via `device.attributes`
+	// in the CEL environment when evaluating selector expressions.
+	//
+	// Derived attributes allow you to extract, transform, or normalize topology
+	// information (such as extracting a NUMA index from a complex topology string or
+	// renaming a vendor-specific attribute) into a common virtual attribute name at
+	// scheduling time. The scheduler then evaluates these virtual attributes exactly
+	// like static attributes when matching constraints.
+	//
+	// Every derived attribute defined in this list must be referenced by at least one
+	// MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+	//
+	// The maximum number of derived attributes is 32.
+	//
+	// This is an alpha field and requires enabling the DRADerivedAttributes
+	// feature gate.
+	DerivedAttributes []DeviceDerivedAttributeApplyConfiguration `json:"derivedAttributes,omitempty"`
 }
 
 // DeviceRequestApplyConfiguration constructs a declarative configuration of the DeviceRequest type for use with
@@ -243,3 +264,16 @@ func (b *DeviceRequestApplyConfiguration) WithCapacity(value *CapacityRequiremen
 	b.Capacity = value
 	return b
 }
+
+// WithDerivedAttributes adds the given value to the DerivedAttributes field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the DerivedAttributes field.
+func (b *DeviceRequestApplyConfiguration) WithDerivedAttributes(values ...*DeviceDerivedAttributeApplyConfiguration) *DeviceRequestApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithDerivedAttributes")
+		}
+		b.DerivedAttributes = append(b.DerivedAttributes, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicerequestallocationresult.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicerequestallocationresult.go
index 3a47b9c1f6..d356dd841c 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicerequestallocationresult.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicerequestallocationresult.go
@@ -95,6 +95,12 @@ type DeviceRequestAllocationResultApplyConfiguration struct {
 	// This field is populated only for devices that allow multiple allocations.
 	// All capacity entries are included, even if the consumed amount is zero.
 	ConsumedCapacity map[resourcev1beta1.QualifiedName]resource.Quantity `json:"consumedCapacity,omitempty"`
+	// SkipNodeOperations lists node-local resource operations (gRPC calls)
+	// that will be skipped for this allocated device when determining whether
+	// operations are necessary on the node. If all allocated devices for a driver in
+	// a claim skip an operation, that gRPC call will be skipped. It is a copy of
+	// the ResourceSlice.spec.skipNodeOperations value at the time when the device was allocated.
+	SkipNodeOperations []resourcev1beta1.SkipNodeOperation `json:"skipNodeOperations,omitempty"`
 }
 
 // DeviceRequestAllocationResultApplyConfiguration constructs a declarative configuration of the DeviceRequestAllocationResult type for use with
@@ -197,3 +203,13 @@ func (b *DeviceRequestAllocationResultApplyConfiguration) WithConsumedCapacity(e
 	}
 	return b
 }
+
+// WithSkipNodeOperations adds the given value to the SkipNodeOperations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the SkipNodeOperations field.
+func (b *DeviceRequestAllocationResultApplyConfiguration) WithSkipNodeOperations(values ...resourcev1beta1.SkipNodeOperation) *DeviceRequestAllocationResultApplyConfiguration {
+	for i := range values {
+		b.SkipNodeOperations = append(b.SkipNodeOperations, values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicesubrequest.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicesubrequest.go
index ae7bf65a04..3810b539f8 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicesubrequest.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/devicesubrequest.go
@@ -110,6 +110,27 @@ type DeviceSubRequestApplyConfiguration struct {
 	// the request fails if there are devices that otherwise match the request,
 	// and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.
 	Capacity *CapacityRequirementsApplyConfiguration `json:"capacity,omitempty"`
+	// DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+	// for each candidate device. These virtual attributes can be referenced in
+	// `.devices.constraints` to align and match different devices (e.g., co-allocating
+	// a GPU and a NIC on the same NUMA node) even if their drivers publish different
+	// attributes. Derived attributes are not available via `device.attributes`
+	// in the CEL environment when evaluating selector expressions.
+	//
+	// Derived attributes allow you to extract, transform, or normalize topology
+	// information (such as extracting a NUMA index from a complex topology string or
+	// renaming a vendor-specific attribute) into a common virtual attribute name at
+	// scheduling time. The scheduler then evaluates these virtual attributes exactly
+	// like static attributes when matching constraints.
+	//
+	// Every derived attribute defined in this list must be referenced by at least one
+	// MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+	//
+	// The maximum number of derived attributes is 32.
+	//
+	// This is an alpha field and requires enabling the DRADerivedAttributes
+	// feature gate.
+	DerivedAttributes []DeviceDerivedAttributeApplyConfiguration `json:"derivedAttributes,omitempty"`
 }
 
 // DeviceSubRequestApplyConfiguration constructs a declarative configuration of the DeviceSubRequest type for use with
@@ -183,3 +204,16 @@ func (b *DeviceSubRequestApplyConfiguration) WithCapacity(value *CapacityRequire
 	b.Capacity = value
 	return b
 }
+
+// WithDerivedAttributes adds the given value to the DerivedAttributes field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the DerivedAttributes field.
+func (b *DeviceSubRequestApplyConfiguration) WithDerivedAttributes(values ...*DeviceDerivedAttributeApplyConfiguration) *DeviceSubRequestApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithDerivedAttributes")
+		}
+		b.DerivedAttributes = append(b.DerivedAttributes, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/nodeallocatablemapping.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/nodeallocatablemapping.go
new file mode 100644
index 0000000000..a95af3ab64
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/nodeallocatablemapping.go
@@ -0,0 +1,90 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
+	resource "k8s.io/apimachinery/pkg/api/resource"
+)
+
+// NodeAllocatableMappingApplyConfiguration represents a declarative configuration of the NodeAllocatableMapping type for use
+// with apply.
+//
+// NodeAllocatableMapping defines how a DRA allocation directly translates into a node allocatable resource quantity.
+// The mapping can be derived from either the count of allocated devices or the specific capacity consumed. These options are mutually exclusive.
+// Kubelet adds this mapped resource quantity from claim to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.
+type NodeAllocatableMappingApplyConfiguration struct {
+	// CapacityKey references a capacity name defined as a key in the
+	// `spec.devices[*].capacity` map. When this field is set, the value associated with
+	// this key in the `status.allocation.devices.results[*].consumedCapacity` map
+	// (for a specific claim allocation) determines the base quantity for
+	// the node allocatable resource. `capacityMultiplier` must also be set and is
+	// multiplied with the base quantity.
+	// For example, if `spec.devices[*].capacity` has an entry "dra.example.com/memory": "128Gi",
+	// and this field is set to "dra.example.com/memory", then for a claim allocation
+	// that consumes { "dra.example.com/memory": "4Gi" } the base quantity for the
+	// node allocatable resource mapping will be "4Gi".
+	// The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
+	CapacityKey *resourcev1beta1.QualifiedName `json:"capacityKey,omitempty"`
+	// CapacityMultiplier is used as a multiplier for the allocated capacity consumed.
+	// It is only valid if `capacityKey` is set.
+	// The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
+	// For example, if a Device's capacity "dra.example.com/cores" is consumed,
+	// and each "core" provides 2 "cpu"s, the mapping would be:
+	// {ResourceName: "cpu", capacityKey: "dra.example.com/cores", capacityMultiplier: "2"}.
+	// If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
+	CapacityMultiplier *resource.Quantity `json:"capacityMultiplier,omitempty"`
+	// DeviceMultiplier is used as a multiplier for the allocated device count in the claim.
+	// The final node allocatable resource amount is `deviceCount` * `deviceMultiplier`.
+	// For example, a DRA driver representing each cache complex (CCX) as a device would have
+	// {ResourceName: "cpu", deviceMultiplier: "8"} in its `nodeAllocatableResources`.
+	// If 2 devices (CCX) are allocated to the claim, 2 * 8 = 16 CPUs would be considered as allocated.
+	// It is only valid when `capacityKey` and `capacityMultiplier` are not set.
+	DeviceMultiplier *resource.Quantity `json:"deviceMultiplier,omitempty"`
+}
+
+// NodeAllocatableMappingApplyConfiguration constructs a declarative configuration of the NodeAllocatableMapping type for use with
+// apply.
+func NodeAllocatableMapping() *NodeAllocatableMappingApplyConfiguration {
+	return &NodeAllocatableMappingApplyConfiguration{}
+}
+
+// WithCapacityKey sets the CapacityKey field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CapacityKey field is set to the value of the last call.
+func (b *NodeAllocatableMappingApplyConfiguration) WithCapacityKey(value resourcev1beta1.QualifiedName) *NodeAllocatableMappingApplyConfiguration {
+	b.CapacityKey = &value
+	return b
+}
+
+// WithCapacityMultiplier sets the CapacityMultiplier field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CapacityMultiplier field is set to the value of the last call.
+func (b *NodeAllocatableMappingApplyConfiguration) WithCapacityMultiplier(value resource.Quantity) *NodeAllocatableMappingApplyConfiguration {
+	b.CapacityMultiplier = &value
+	return b
+}
+
+// WithDeviceMultiplier sets the DeviceMultiplier field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeviceMultiplier field is set to the value of the last call.
+func (b *NodeAllocatableMappingApplyConfiguration) WithDeviceMultiplier(value resource.Quantity) *NodeAllocatableMappingApplyConfiguration {
+	b.DeviceMultiplier = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/nodeallocatableoverhead.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/nodeallocatableoverhead.go
new file mode 100644
index 0000000000..00526a9253
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/nodeallocatableoverhead.go
@@ -0,0 +1,67 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+)
+
+// NodeAllocatableOverheadApplyConfiguration represents a declarative configuration of the NodeAllocatableOverhead type for use
+// with apply.
+//
+// NodeAllocatableOverhead defines auxiliary resource overheads incurred when allocating a device.
+// Overheads can be specified as a fixed cost per pod referencing the claim, a variable cost per container reference, or both.
+// Kubelet accounts for this overhead by adding it to both the pod-level and container-level cgroups of referencing containers.
+type NodeAllocatableOverheadApplyConfiguration struct {
+	// PerPod is overhead applied once per pod referencing the claim on this node.
+	// This is a flat overhead incurred for every pod referencing the claim.
+	PerPod *resource.Quantity `json:"perPod,omitempty"`
+	// PerContainer is applied per container reference to the claim.
+	// This models overhead scaling linearly with the number of containers actively using the device.
+	// When both PerPod and PerContainer are specified, the total overhead allocated for each pod referencing
+	// the claim is computed as:
+	// Quantity = PerPod + (PerContainer * NumReferences)
+	// Kubelet accounts for this overhead in cgroups:
+	// - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences).
+	// - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container.
+	// This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once.
+	PerContainer *resource.Quantity `json:"perContainer,omitempty"`
+}
+
+// NodeAllocatableOverheadApplyConfiguration constructs a declarative configuration of the NodeAllocatableOverhead type for use with
+// apply.
+func NodeAllocatableOverhead() *NodeAllocatableOverheadApplyConfiguration {
+	return &NodeAllocatableOverheadApplyConfiguration{}
+}
+
+// WithPerPod sets the PerPod field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PerPod field is set to the value of the last call.
+func (b *NodeAllocatableOverheadApplyConfiguration) WithPerPod(value resource.Quantity) *NodeAllocatableOverheadApplyConfiguration {
+	b.PerPod = &value
+	return b
+}
+
+// WithPerContainer sets the PerContainer field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PerContainer field is set to the value of the last call.
+func (b *NodeAllocatableOverheadApplyConfiguration) WithPerContainer(value resource.Quantity) *NodeAllocatableOverheadApplyConfiguration {
+	b.PerContainer = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/nodeallocatableresource.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/nodeallocatableresource.go
new file mode 100644
index 0000000000..11df524b95
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/nodeallocatableresource.go
@@ -0,0 +1,65 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+// NodeAllocatableResourceApplyConfiguration represents a declarative configuration of the NodeAllocatableResource type for use
+// with apply.
+//
+// NodeAllocatableResource defines the translation between the DRA device/capacity
+// units requested to the corresponding quantity of the node allocatable resource.
+// At least one of Mapping or Overhead must be specified. Not specifying either is an invalid configuration.
+type NodeAllocatableResourceApplyConfiguration struct {
+	// Mapping is used when the device directly models a node allocatable resource like standard CPU or memory
+	// (e.g., with a CPU DRA driver). The calculated quantity is accounted for exactly once per claim instance
+	// on the node. To prevent node cgroup isolation friction, the scheduler explicitly
+	// blocks sharing mapped device claims across multiple pods.
+	Mapping *NodeAllocatableMappingApplyConfiguration `json:"mapping,omitempty"`
+	// Overhead contains fields for modeling auxiliary overhead incurred on node allocatable resources
+	// when allocating devices that are not themselves modeling a node allocatable resource (e.g., host memory overhead for GPUs).
+	// Sharing overhead-mapped claims across multiple pods is allowed. The node allocatable overhead is accounted
+	// for individually for each pod referencing the claim.
+	// Overhead is always subtracted from the node's allocatable capacity for the resource, even when mapping
+	// is specified for the same resource.
+	// Eg: If a device models memory capacity per socket as a consumable capacity pool via Mapping (with CapacityKey),
+	// any overhead specified for the same resource will be subtracted from the node's general allocatable capacity
+	// and not from the per-socket capacity pool in Mapping.
+	Overhead *NodeAllocatableOverheadApplyConfiguration `json:"overhead,omitempty"`
+}
+
+// NodeAllocatableResourceApplyConfiguration constructs a declarative configuration of the NodeAllocatableResource type for use with
+// apply.
+func NodeAllocatableResource() *NodeAllocatableResourceApplyConfiguration {
+	return &NodeAllocatableResourceApplyConfiguration{}
+}
+
+// WithMapping sets the Mapping field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Mapping field is set to the value of the last call.
+func (b *NodeAllocatableResourceApplyConfiguration) WithMapping(value *NodeAllocatableMappingApplyConfiguration) *NodeAllocatableResourceApplyConfiguration {
+	b.Mapping = value
+	return b
+}
+
+// WithOverhead sets the Overhead field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Overhead field is set to the value of the last call.
+func (b *NodeAllocatableResourceApplyConfiguration) WithOverhead(value *NodeAllocatableOverheadApplyConfiguration) *NodeAllocatableResourceApplyConfiguration {
+	b.Overhead = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/nodeallocatableresourcemapping.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/nodeallocatableresourcemapping.go
deleted file mode 100644
index 5cdc2c7512..0000000000
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/nodeallocatableresourcemapping.go
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by applyconfiguration-gen. DO NOT EDIT.
-
-package v1beta1
-
-import (
-	resourcev1beta1 "k8s.io/api/resource/v1beta1"
-	resource "k8s.io/apimachinery/pkg/api/resource"
-)
-
-// NodeAllocatableResourceMappingApplyConfiguration represents a declarative configuration of the NodeAllocatableResourceMapping type for use
-// with apply.
-//
-// NodeAllocatableResourceMapping defines the translation between the DRA device/capacity
-// units requested to the corresponding quantity of the node allocatable resource.
-type NodeAllocatableResourceMappingApplyConfiguration struct {
-	// CapacityKey references a capacity name defined as a key in the
-	// `spec.devices[*].capacity` map. When this field is set, the value associated with
-	// this key in the `status.allocation.devices.results[*].consumedCapacity` map
-	// (for a specific claim allocation) determines the base quantity for
-	// the node allocatable resource. If `allocationMultiplier` is also set, it is
-	// multiplied with the base quantity.
-	// For example, if `spec.devices[*].capacity` has an entry "dra.example.com/memory": "128Gi",
-	// and this field is set to "dra.example.com/memory", then for a claim allocation
-	// that consumes { "dra.example.com/memory": "4Gi" } the base quantity for the
-	// node allocatable resource mapping will be "4Gi", and `allocationMultiplier` should
-	// be omitted or set to "1".
-	CapacityKey *resourcev1beta1.QualifiedName `json:"capacityKey,omitempty"`
-	// AllocationMultiplier is used as a multiplier for the allocated device count or the allocated capacity in the claim.
-	// It defaults to 1 if not specified. How the field is used also depends on whether `capacityKey` is set.
-	// 1.  If `capacityKey` is NOT set: `allocationMultiplier` multiplies the device count allocated to the claim.
-	// a. A DRA driver representing each CPU core as a device would have
-	// {ResourceName: "cpu", allocationMultiplier: "2"} in its
-	// `nodeAllocatableResourceMappings`. If 4 devices are allocated to the claim,
-	// 4 * 2 CPUs would be considered as allocated and subtracted from the node's capacity.
-	// b. A GPU device that needs additional node memory per GPU allocation would
-	// have {ResourceName: "memory", allocationMultiplier: "2Gi"}.  Each allocated
-	// GPU device instance of this type will account for 2Gi of memory.
-	//
-	// 2.  If `capacityKey` IS set: `allocationMultiplier` is multiplied by the amount of that capacity consumed.
-	// The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `allocationMultiplier`.
-	// For example, if a Device's capacity "dra.example.com/cores" is consumed,
-	// and each "core" provides 2 "cpu"s, the mapping would be:
-	// {ResourceName: "cpu", capacityKey: "dra.example.com/cores", allocationMultiplier: "2"}.
-	// If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
-	AllocationMultiplier *resource.Quantity `json:"allocationMultiplier,omitempty"`
-}
-
-// NodeAllocatableResourceMappingApplyConfiguration constructs a declarative configuration of the NodeAllocatableResourceMapping type for use with
-// apply.
-func NodeAllocatableResourceMapping() *NodeAllocatableResourceMappingApplyConfiguration {
-	return &NodeAllocatableResourceMappingApplyConfiguration{}
-}
-
-// WithCapacityKey sets the CapacityKey field in the declarative configuration to the given value
-// and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the CapacityKey field is set to the value of the last call.
-func (b *NodeAllocatableResourceMappingApplyConfiguration) WithCapacityKey(value resourcev1beta1.QualifiedName) *NodeAllocatableResourceMappingApplyConfiguration {
-	b.CapacityKey = &value
-	return b
-}
-
-// WithAllocationMultiplier sets the AllocationMultiplier field in the declarative configuration to the given value
-// and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the AllocationMultiplier field is set to the value of the last call.
-func (b *NodeAllocatableResourceMappingApplyConfiguration) WithAllocationMultiplier(value resource.Quantity) *NodeAllocatableResourceMappingApplyConfiguration {
-	b.AllocationMultiplier = &value
-	return b
-}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceclaim.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceclaim.go
index aaeaf687d6..a617fecd84 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceclaim.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceclaim.go
@@ -39,7 +39,7 @@ import (
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type ResourceClaimApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Spec describes what is being requested and how to configure it.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceclaimtemplate.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceclaimtemplate.go
index fe42003266..4c1eba7cd9 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceclaimtemplate.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceclaimtemplate.go
@@ -35,7 +35,7 @@ import (
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type ResourceClaimTemplateApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Describes the ResourceClaim that is to be generated.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourcepool.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourcepool.go
index eff9e042c8..3452dd18ba 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourcepool.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourcepool.go
@@ -25,6 +25,8 @@ package v1beta1
 type ResourcePoolApplyConfiguration struct {
 	// Name is used to identify the pool. For node-local devices, this
 	// is often the node name, but this is not required.
+	// A field selector can be used to list only ResourceSlice objects
+	// belonging to a certain pool.
 	//
 	// It must not be longer than 253 characters and must consist of one or more DNS sub-domains
 	// separated by slashes. This field is immutable.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceslice.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceslice.go
index c9ec6a7b74..c6b5fc59c6 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceslice.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceslice.go
@@ -55,7 +55,7 @@ import (
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type ResourceSliceApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Contains the information published by the driver.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceslicespec.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceslicespec.go
index 2302486433..d463e72383 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceslicespec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta1/resourceslicespec.go
@@ -19,6 +19,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
 	v1 "k8s.io/client-go/applyconfigurations/core/v1"
 )
 
@@ -82,6 +83,28 @@ type ResourceSliceSpecApplyConfiguration struct {
 	//
 	// The maximum number of counter sets is 8.
 	SharedCounters []CounterSetApplyConfiguration `json:"sharedCounters,omitempty"`
+	// PartitionTypeAttribute names a string device attribute (by fully
+	// qualified name, e.g. "gpu.example.com/profile") whose value labels
+	// each device with its partition type, such as "Full" or "Half" for a
+	// MIG-style GPU.
+	//
+	// When set, every partitionable device in the slice must carry the attribute
+	// and devices sharing a value must share the same ConsumesCounters cost.
+	PartitionTypeAttribute *resourcev1beta1.FullyQualifiedName `json:"partitionTypeAttribute,omitempty"`
+	// SkipNodeOperations lists node-local resource operations (gRPC calls)
+	// that will be skipped for the devices in this slice when determining whether
+	// operations are necessary on the node. If all allocated devices for a driver in
+	// a claim skip an operation, that gRPC call will be skipped. Valid values are:
+	//
+	// - "NodePrepareResources": NodePrepareResources gRPC calls are skipped. This
+	// value cannot be specified unless "NodeUnprepareResources" is also listed
+	// (or "*" is specified).
+	// - "NodeUnprepareResources": NodeUnprepareResources gRPC calls are skipped.
+	// - "*": All node-local resource operations are skipped.
+	//
+	// Other values may be added in the future. The kubelet must ignore unknown
+	// values.
+	SkipNodeOperations []resourcev1beta1.SkipNodeOperation `json:"skipNodeOperations,omitempty"`
 }
 
 // ResourceSliceSpecApplyConfiguration constructs a declarative configuration of the ResourceSliceSpec type for use with
@@ -163,3 +186,21 @@ func (b *ResourceSliceSpecApplyConfiguration) WithSharedCounters(values ...*Coun
 	}
 	return b
 }
+
+// WithPartitionTypeAttribute sets the PartitionTypeAttribute field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PartitionTypeAttribute field is set to the value of the last call.
+func (b *ResourceSliceSpecApplyConfiguration) WithPartitionTypeAttribute(value resourcev1beta1.FullyQualifiedName) *ResourceSliceSpecApplyConfiguration {
+	b.PartitionTypeAttribute = &value
+	return b
+}
+
+// WithSkipNodeOperations adds the given value to the SkipNodeOperations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the SkipNodeOperations field.
+func (b *ResourceSliceSpecApplyConfiguration) WithSkipNodeOperations(values ...resourcev1beta1.SkipNodeOperation) *ResourceSliceSpecApplyConfiguration {
+	for i := range values {
+		b.SkipNodeOperations = append(b.SkipNodeOperations, values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/capacityrequestpolicyrange.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/capacityrequestpolicyrange.go
index bd9a734221..60e71b9045 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/capacityrequestpolicyrange.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/capacityrequestpolicyrange.go
@@ -27,6 +27,13 @@ import (
 //
 // CapacityRequestPolicyRange defines a valid range for consumable capacity values.
 //
+// If the DRAFractionalCapacityRange feature gate is
+// enabled and at least one of Min, Max, or Step is a fractional quantity (i.e.
+// its value is not an integer), milli-unit arithmetic is used instead,
+// supporting values with up to 3 decimal places (e.g. 100m = 0.1).
+// The largest supported value then is 1000 times smaller compared to using 64-bit integers.
+// Otherwise, all comparisons use 64-bit integer arithmetic via resource.Quantity.Value().
+//
 // - If the requested amount is less than Min, it is rounded up to the Min value.
 // - If Step is set and the requested amount is between Min and Max but not aligned with Step,
 // it will be rounded up to the next value equal to Min + (n * Step).
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/celdeviceselector.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/celdeviceselector.go
index a184590ebe..73485f5029 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/celdeviceselector.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/celdeviceselector.go
@@ -33,7 +33,7 @@ type CELDeviceSelectorApplyConfiguration struct {
 	// - driver (string): the name of the driver which defines this device.
 	// - attributes (map[string]object): the device's attributes, grouped by prefix
 	// (e.g. device.attributes["dra.example.com"] evaluates to an object with all
-	// of the attributes which were prefixed by "dra.example.com".
+	// of the attributes which were prefixed by "dra.example.com").
 	// - capacity (map[string]object): the device's capacities, grouped by prefix.
 	// - allowMultipleAllocations (bool): the allowMultipleAllocations property of the device
 	// (v1.34+ with the DRAConsumableCapacity feature enabled).
@@ -66,6 +66,15 @@ type CELDeviceSelectorApplyConfiguration struct {
 	// A robust expression should check for the existence of attributes
 	// before referencing them.
 	//
+	// Common errors:
+	// - "no such key": Use optional chaining (.? followed by orValue())
+	// or guarding the check with has() for optional fields.
+	// See CEL Optional Types for details:
+	// https://pkg.go.dev/github.com/google/cel-go@v0.17.4/cel#OptionalTypes
+	//
+	// For more CEL expression syntax and examples, see:
+	// https://kubernetes.io/docs/reference/using-api/cel/
+	//
 	// For ease of use, the cel.bind() function is enabled, and can be used
 	// to simplify expressions that access multiple attributes with the
 	// same domain. For example:
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/device.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/device.go
index b3985b0ca5..71e2440be7 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/device.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/device.go
@@ -114,7 +114,7 @@ type DeviceApplyConfiguration struct {
 	// If AllowMultipleAllocations is set to true, the device can be allocated more than once,
 	// and all of its capacity is consumable, regardless of whether the requestPolicy is defined or not.
 	AllowMultipleAllocations *bool `json:"allowMultipleAllocations,omitempty"`
-	// NodeAllocatableResourceMappings defines the mapping of node resources
+	// NodeAllocatableResources defines the mapping of node resources
 	// that are managed by the DRA driver exposing this device. This includes resources currently
 	// reported in v1.Node `status.allocatable` that are not extended resources
 	// (see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#extended-resources).
@@ -125,7 +125,7 @@ type DeviceApplyConfiguration struct {
 	// dependencies of an accelerator device.
 	// The keys of this map are the node-allocatable resource names (e.g., "cpu", "memory").
 	// Extended resource names are not permitted as keys.
-	NodeAllocatableResourceMappings map[corev1.ResourceName]NodeAllocatableResourceMappingApplyConfiguration `json:"nodeAllocatableResourceMappings,omitempty"`
+	NodeAllocatableResources map[corev1.ResourceName]NodeAllocatableResourceApplyConfiguration `json:"nodeAllocatableResources,omitempty"`
 }
 
 // DeviceApplyConfiguration constructs a declarative configuration of the Device type for use with
@@ -256,16 +256,16 @@ func (b *DeviceApplyConfiguration) WithAllowMultipleAllocations(value bool) *Dev
 	return b
 }
 
-// WithNodeAllocatableResourceMappings puts the entries into the NodeAllocatableResourceMappings field in the declarative configuration
+// WithNodeAllocatableResources puts the entries into the NodeAllocatableResources field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
-// If called multiple times, the entries provided by each call will be put on the NodeAllocatableResourceMappings field,
-// overwriting an existing map entries in NodeAllocatableResourceMappings field with the same key.
-func (b *DeviceApplyConfiguration) WithNodeAllocatableResourceMappings(entries map[corev1.ResourceName]NodeAllocatableResourceMappingApplyConfiguration) *DeviceApplyConfiguration {
-	if b.NodeAllocatableResourceMappings == nil && len(entries) > 0 {
-		b.NodeAllocatableResourceMappings = make(map[corev1.ResourceName]NodeAllocatableResourceMappingApplyConfiguration, len(entries))
+// If called multiple times, the entries provided by each call will be put on the NodeAllocatableResources field,
+// overwriting an existing map entries in NodeAllocatableResources field with the same key.
+func (b *DeviceApplyConfiguration) WithNodeAllocatableResources(entries map[corev1.ResourceName]NodeAllocatableResourceApplyConfiguration) *DeviceApplyConfiguration {
+	if b.NodeAllocatableResources == nil && len(entries) > 0 {
+		b.NodeAllocatableResources = make(map[corev1.ResourceName]NodeAllocatableResourceApplyConfiguration, len(entries))
 	}
 	for k, v := range entries {
-		b.NodeAllocatableResourceMappings[k] = v
+		b.NodeAllocatableResources[k] = v
 	}
 	return b
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceallocationconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceallocationconfiguration.go
index cbfb0c1f26..fb0c7e6bea 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceallocationconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceallocationconfiguration.go
@@ -38,7 +38,7 @@ type DeviceAllocationConfigurationApplyConfiguration struct {
 	// and may include the subrequest using the format <main request>[/<subrequest>]. If just
 	// the main request is given, the configuration applies to all subrequests.
 	Requests                              []string `json:"requests,omitempty"`
-	DeviceConfigurationApplyConfiguration `json:",inline"`
+	DeviceConfigurationApplyConfiguration `json:""`
 }
 
 // DeviceAllocationConfigurationApplyConfiguration constructs a declarative configuration of the DeviceAllocationConfiguration type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclaimconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclaimconfiguration.go
index 59a4f50f6b..34876049f7 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclaimconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclaimconfiguration.go
@@ -30,7 +30,7 @@ type DeviceClaimConfigurationApplyConfiguration struct {
 	// and may include the subrequest using the format <main request>[/<subrequest>]. If just
 	// the main request is given, the configuration applies to all subrequests.
 	Requests                              []string `json:"requests,omitempty"`
-	DeviceConfigurationApplyConfiguration `json:",inline"`
+	DeviceConfigurationApplyConfiguration `json:""`
 }
 
 // DeviceClaimConfigurationApplyConfiguration constructs a declarative configuration of the DeviceClaimConfiguration type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclass.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclass.go
index 439e03c6d0..687af43937 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclass.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclass.go
@@ -38,7 +38,7 @@ import (
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type DeviceClassApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Spec defines what can be allocated and how to configure it.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclassconfiguration.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclassconfiguration.go
index f668fcf865..6b3f04366c 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclassconfiguration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclassconfiguration.go
@@ -23,7 +23,7 @@ package v1beta2
 //
 // DeviceClassConfiguration is used in DeviceClass.
 type DeviceClassConfigurationApplyConfiguration struct {
-	DeviceConfigurationApplyConfiguration `json:",inline"`
+	DeviceConfigurationApplyConfiguration `json:""`
 }
 
 // DeviceClassConfigurationApplyConfiguration constructs a declarative configuration of the DeviceClassConfiguration type for use with
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclassspec.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclassspec.go
index 4ae2eaa29f..fc510c6ff1 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclassspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/deviceclassspec.go
@@ -40,8 +40,6 @@ type DeviceClassSpecApplyConfiguration struct {
 	// is picked to satisfy a pod's extended resource requests.
 	// If two classes are created at the same time, then the name of the class
 	// lexicographically sorted first is picked.
-	//
-	// This is a beta field.
 	ExtendedResourceName *string `json:"extendedResourceName,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicecounterconsumption.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicecounterconsumption.go
index f636ccdbd8..e94c38fc74 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicecounterconsumption.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicecounterconsumption.go
@@ -31,6 +31,26 @@ type DeviceCounterConsumptionApplyConfiguration struct {
 	//
 	// The maximum number of counters is 32.
 	Counters map[string]CounterApplyConfiguration `json:"counters,omitempty"`
+	// CompatibilityGroups is a list of opaque group names for
+	// this counter set consumption.
+	//
+	// Devices that consume counters from the same counter set may only be
+	// allocated at the same time ("co-allocated") if they all share at least
+	// one common group: the intersection of the CompatibilityGroups of all
+	// co-allocated devices on that counter set must be non-empty. Devices
+	// that consume from different counter sets are never compared via this
+	// field.
+	//
+	// An unset field, an explicit nil, and an empty list are equivalent and
+	// mean "no groups": such a device is only co-allocatable with sibling
+	// devices on the same counter set that also have no groups, and is never
+	// co-allocatable with a device that declares one or more groups.
+	//
+	// Group names are opaque and meaningful only within the
+	// publishing driver's pool.
+	//
+	// The maximum number of groups is 2, and the names must be unique.
+	CompatibilityGroups []string `json:"compatibilityGroups,omitempty"`
 }
 
 // DeviceCounterConsumptionApplyConfiguration constructs a declarative configuration of the DeviceCounterConsumption type for use with
@@ -60,3 +80,13 @@ func (b *DeviceCounterConsumptionApplyConfiguration) WithCounters(entries map[st
 	}
 	return b
 }
+
+// WithCompatibilityGroups adds the given value to the CompatibilityGroups field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the CompatibilityGroups field.
+func (b *DeviceCounterConsumptionApplyConfiguration) WithCompatibilityGroups(values ...string) *DeviceCounterConsumptionApplyConfiguration {
+	for i := range values {
+		b.CompatibilityGroups = append(b.CompatibilityGroups, values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicederivedattribute.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicederivedattribute.go
new file mode 100644
index 0000000000..6b57b3f1a1
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicederivedattribute.go
@@ -0,0 +1,95 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
+)
+
+// DeviceDerivedAttributeApplyConfiguration represents a declarative configuration of the DeviceDerivedAttribute type for use
+// with apply.
+//
+// DeviceDerivedAttribute defines a derived attribute computed via CEL.
+type DeviceDerivedAttributeApplyConfiguration struct {
+	// Name is the identifier for this derived attribute, used in constraints.
+	//
+	// It must be a DNS subdomain followed by a slash ("/") followed by a C identifier
+	// (e.g. "example.com/numaNode" or "derived/numaNode").
+	//
+	// If the chosen name matches an existing physical attribute from a driver,
+	// the derived attribute's expression will shadow the physical attribute,
+	// and its evaluated value will be used in constraints instead. When the goal
+	// is to define a derived attribute that is only used within the ResourceClaim
+	// and not meant to shadow an existing attribute, use a domain prefix that
+	// no DRA driver should be using (e.g. "derived/myAttribute").
+	//
+	// It is not valid to define a derived attribute that isn't used in at least
+	// one constraint.
+	Name *resourcev1beta2.FullyQualifiedName `json:"name,omitempty"`
+	// Expression is a CEL expression evaluated against each candidate device.
+	// The expression must evaluate to a primitive scalar (string, integer,
+	// boolean, or semver) or a list of these scalars ([]string, []int64,
+	// []bool, []semver) to act as a virtual grouping key. Any other return type
+	// is an error and causes CEL evaluation for the device to fail.
+	//
+	// The expression's input is an object named "device", which carries the
+	// same properties as in a CELDeviceSelector.
+	//
+	// When pod scheduling encounters CEL runtime errors (such as looking
+	// up an attribute that isn't defined) for some devices, it will abort
+	// allocation and fail scheduling for the Pod. Surfacing evaluation
+	// errors immediately prevents silent topology matching failures that are
+	// extremely hard to detect. A robust expression should, for example, check
+	// for the existence of attributes before referencing them to avoid
+	// runtime evaluation errors.
+	//
+	// The expression gets evaluated after a device has passed the other
+	// selector expressions for the request in which this expression is used.
+	// This allows writing expressions that are tailored towards the specific
+	// devices being requested (for example, by assuming the device is from a
+	// certain vendor and skipping those checks).
+	//
+	// The length of the expression must be smaller or equal to 10 Ki. The
+	// cost of evaluating it is also limited based on the estimated number
+	// of logical steps; the combined cost of all derived attributes in a
+	// claim is capped by a shared CEL cost budget.
+	Expression *string `json:"expression,omitempty"`
+}
+
+// DeviceDerivedAttributeApplyConfiguration constructs a declarative configuration of the DeviceDerivedAttribute type for use with
+// apply.
+func DeviceDerivedAttribute() *DeviceDerivedAttributeApplyConfiguration {
+	return &DeviceDerivedAttributeApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *DeviceDerivedAttributeApplyConfiguration) WithName(value resourcev1beta2.FullyQualifiedName) *DeviceDerivedAttributeApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithExpression sets the Expression field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Expression field is set to the value of the last call.
+func (b *DeviceDerivedAttributeApplyConfiguration) WithExpression(value string) *DeviceDerivedAttributeApplyConfiguration {
+	b.Expression = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicerequestallocationresult.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicerequestallocationresult.go
index a274e5706c..e80cd933ec 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicerequestallocationresult.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicerequestallocationresult.go
@@ -95,6 +95,12 @@ type DeviceRequestAllocationResultApplyConfiguration struct {
 	// This field is populated only for devices that allow multiple allocations.
 	// All capacity entries are included, even if the consumed amount is zero.
 	ConsumedCapacity map[resourcev1beta2.QualifiedName]resource.Quantity `json:"consumedCapacity,omitempty"`
+	// SkipNodeOperations lists node-local resource operations (gRPC calls)
+	// that will be skipped for this allocated device when determining whether
+	// operations are necessary on the node. If all allocated devices for a driver in
+	// a claim skip an operation, that gRPC call will be skipped. It is a copy of
+	// the ResourceSlice.spec.skipNodeOperations value at the time when the device was allocated.
+	SkipNodeOperations []resourcev1beta2.SkipNodeOperation `json:"skipNodeOperations,omitempty"`
 }
 
 // DeviceRequestAllocationResultApplyConfiguration constructs a declarative configuration of the DeviceRequestAllocationResult type for use with
@@ -197,3 +203,13 @@ func (b *DeviceRequestAllocationResultApplyConfiguration) WithConsumedCapacity(e
 	}
 	return b
 }
+
+// WithSkipNodeOperations adds the given value to the SkipNodeOperations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the SkipNodeOperations field.
+func (b *DeviceRequestAllocationResultApplyConfiguration) WithSkipNodeOperations(values ...resourcev1beta2.SkipNodeOperation) *DeviceRequestAllocationResultApplyConfiguration {
+	for i := range values {
+		b.SkipNodeOperations = append(b.SkipNodeOperations, values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicesubrequest.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicesubrequest.go
index d9f4a5cb57..f0c882185d 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicesubrequest.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicesubrequest.go
@@ -109,6 +109,27 @@ type DeviceSubRequestApplyConfiguration struct {
 	// the request fails if there are devices that otherwise match the request,
 	// and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.
 	Capacity *CapacityRequirementsApplyConfiguration `json:"capacity,omitempty"`
+	// DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+	// for each candidate device. These virtual attributes can be referenced in
+	// `.devices.constraints` to align and match different devices (e.g., co-allocating
+	// a GPU and a NIC on the same NUMA node) even if their drivers publish different
+	// attributes. Derived attributes are not available via `device.attributes`
+	// in the CEL environment when evaluating selector expressions.
+	//
+	// Derived attributes allow you to extract, transform, or normalize topology
+	// information (such as extracting a NUMA index from a complex topology string or
+	// renaming a vendor-specific attribute) into a common virtual attribute name at
+	// scheduling time. The scheduler then evaluates these virtual attributes exactly
+	// like static attributes when matching constraints.
+	//
+	// Every derived attribute defined in this list must be referenced by at least one
+	// MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+	//
+	// The maximum number of derived attributes is 32.
+	//
+	// This is an alpha field and requires enabling the DRADerivedAttributes
+	// feature gate.
+	DerivedAttributes []DeviceDerivedAttributeApplyConfiguration `json:"derivedAttributes,omitempty"`
 }
 
 // DeviceSubRequestApplyConfiguration constructs a declarative configuration of the DeviceSubRequest type for use with
@@ -182,3 +203,16 @@ func (b *DeviceSubRequestApplyConfiguration) WithCapacity(value *CapacityRequire
 	b.Capacity = value
 	return b
 }
+
+// WithDerivedAttributes adds the given value to the DerivedAttributes field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the DerivedAttributes field.
+func (b *DeviceSubRequestApplyConfiguration) WithDerivedAttributes(values ...*DeviceDerivedAttributeApplyConfiguration) *DeviceSubRequestApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithDerivedAttributes")
+		}
+		b.DerivedAttributes = append(b.DerivedAttributes, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicetaintrule.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicetaintrule.go
index 18b2aca188..5e7a5a0cbb 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicetaintrule.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/devicetaintrule.go
@@ -34,7 +34,7 @@ import (
 // This has the same effect as if the taint was specified directly
 // in the ResourceSlice by the DRA driver.
 type DeviceTaintRuleApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Spec specifies the selector and one taint.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/exactdevicerequest.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/exactdevicerequest.go
index bda1152701..b23786194d 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/exactdevicerequest.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/exactdevicerequest.go
@@ -107,6 +107,27 @@ type ExactDeviceRequestApplyConfiguration struct {
 	// the request fails if there are devices that otherwise match the request,
 	// and have this capacity, with a value >= the requested amount, but which cannot be allocated to this request.
 	Capacity *CapacityRequirementsApplyConfiguration `json:"capacity,omitempty"`
+	// DerivedAttributes defines a set of virtual attributes computed via CEL expressions
+	// for each candidate device. These virtual attributes can be referenced in
+	// `.devices.constraints` to align and match different devices (e.g., co-allocating
+	// a GPU and a NIC on the same NUMA node) even if their drivers publish different
+	// attributes. Derived attributes are not available via `device.attributes`
+	// in the CEL environment when evaluating selector expressions.
+	//
+	// Derived attributes allow you to extract, transform, or normalize topology
+	// information (such as extracting a NUMA index from a complex topology string or
+	// renaming a vendor-specific attribute) into a common virtual attribute name at
+	// scheduling time. The scheduler then evaluates these virtual attributes exactly
+	// like static attributes when matching constraints.
+	//
+	// Every derived attribute defined in this list must be referenced by at least one
+	// MatchAttribute or DistinctAttribute constraint in the `.devices.constraints` list.
+	//
+	// The maximum number of derived attributes is 32.
+	//
+	// This is an alpha field and requires enabling the DRADerivedAttributes
+	// feature gate.
+	DerivedAttributes []DeviceDerivedAttributeApplyConfiguration `json:"derivedAttributes,omitempty"`
 }
 
 // ExactDeviceRequestApplyConfiguration constructs a declarative configuration of the ExactDeviceRequest type for use with
@@ -180,3 +201,16 @@ func (b *ExactDeviceRequestApplyConfiguration) WithCapacity(value *CapacityRequi
 	b.Capacity = value
 	return b
 }
+
+// WithDerivedAttributes adds the given value to the DerivedAttributes field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the DerivedAttributes field.
+func (b *ExactDeviceRequestApplyConfiguration) WithDerivedAttributes(values ...*DeviceDerivedAttributeApplyConfiguration) *ExactDeviceRequestApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithDerivedAttributes")
+		}
+		b.DerivedAttributes = append(b.DerivedAttributes, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/nodeallocatablemapping.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/nodeallocatablemapping.go
new file mode 100644
index 0000000000..50b4069736
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/nodeallocatablemapping.go
@@ -0,0 +1,90 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
+	resource "k8s.io/apimachinery/pkg/api/resource"
+)
+
+// NodeAllocatableMappingApplyConfiguration represents a declarative configuration of the NodeAllocatableMapping type for use
+// with apply.
+//
+// NodeAllocatableMapping defines how a DRA allocation directly translates into a node allocatable resource quantity.
+// The mapping can be derived from either the count of allocated devices (via deviceMultiplier) or the specific capacity consumed (via capacityKey and capacityMultiplier). These options are mutually exclusive.
+// Kubelet adds this mapped resource quantity from claim to both requests and limits at the pod-level cgroup, and to limits at the container-level cgroup for each container referencing the claim.
+type NodeAllocatableMappingApplyConfiguration struct {
+	// CapacityKey references a capacity name defined as a key in the
+	// `spec.devices[*].capacity` map. When this field is set, the value associated with
+	// this key in the `status.allocation.devices.results[*].consumedCapacity` map
+	// (for a specific claim allocation) determines the base quantity for
+	// the node allocatable resource. `capacityMultiplier` must also be set and is
+	// multiplied with the base quantity.
+	// For example, if `spec.devices[*].capacity` has an entry "dra.example.com/memory": "128Gi",
+	// and this field is set to "dra.example.com/memory", then for a claim allocation
+	// that consumes { "dra.example.com/memory": "4Gi" } the base quantity for the
+	// node allocatable resource mapping will be "4Gi".
+	// The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
+	CapacityKey *resourcev1beta2.QualifiedName `json:"capacityKey,omitempty"`
+	// CapacityMultiplier is used as a multiplier for the allocated capacity consumed.
+	// It is only valid if `capacityKey` is set.
+	// The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `capacityMultiplier`.
+	// For example, if a Device's capacity "dra.example.com/cores" is consumed,
+	// and each "core" provides 2 "cpu"s, the mapping would be:
+	// {ResourceName: "cpu", capacityKey: "dra.example.com/cores", capacityMultiplier: "2"}.
+	// If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
+	CapacityMultiplier *resource.Quantity `json:"capacityMultiplier,omitempty"`
+	// DeviceMultiplier is used as a multiplier for the allocated device count in the claim.
+	// The final node allocatable resource amount is `deviceCount` * `deviceMultiplier`.
+	// For example, a DRA driver representing each cache complex (CCX) as a device would have
+	// {ResourceName: "cpu", deviceMultiplier: "8"} in its `nodeAllocatableResources`.
+	// If 2 devices (CCX) are allocated to the claim, 2 * 8 = 16 CPUs would be considered as allocated.
+	// It is only valid when `capacityKey` and `capacityMultiplier` are not set.
+	DeviceMultiplier *resource.Quantity `json:"deviceMultiplier,omitempty"`
+}
+
+// NodeAllocatableMappingApplyConfiguration constructs a declarative configuration of the NodeAllocatableMapping type for use with
+// apply.
+func NodeAllocatableMapping() *NodeAllocatableMappingApplyConfiguration {
+	return &NodeAllocatableMappingApplyConfiguration{}
+}
+
+// WithCapacityKey sets the CapacityKey field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CapacityKey field is set to the value of the last call.
+func (b *NodeAllocatableMappingApplyConfiguration) WithCapacityKey(value resourcev1beta2.QualifiedName) *NodeAllocatableMappingApplyConfiguration {
+	b.CapacityKey = &value
+	return b
+}
+
+// WithCapacityMultiplier sets the CapacityMultiplier field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CapacityMultiplier field is set to the value of the last call.
+func (b *NodeAllocatableMappingApplyConfiguration) WithCapacityMultiplier(value resource.Quantity) *NodeAllocatableMappingApplyConfiguration {
+	b.CapacityMultiplier = &value
+	return b
+}
+
+// WithDeviceMultiplier sets the DeviceMultiplier field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeviceMultiplier field is set to the value of the last call.
+func (b *NodeAllocatableMappingApplyConfiguration) WithDeviceMultiplier(value resource.Quantity) *NodeAllocatableMappingApplyConfiguration {
+	b.DeviceMultiplier = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/nodeallocatableoverhead.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/nodeallocatableoverhead.go
new file mode 100644
index 0000000000..49205e8997
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/nodeallocatableoverhead.go
@@ -0,0 +1,67 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	resource "k8s.io/apimachinery/pkg/api/resource"
+)
+
+// NodeAllocatableOverheadApplyConfiguration represents a declarative configuration of the NodeAllocatableOverhead type for use
+// with apply.
+//
+// NodeAllocatableOverhead defines auxiliary resource overheads incurred when allocating a device.
+// Overheads can be specified as a fixed cost per pod referencing the claim, a variable cost per container reference, or both.
+// Kubelet accounts for this overhead by adding it to both the pod-level and container-level cgroups of referencing containers.
+type NodeAllocatableOverheadApplyConfiguration struct {
+	// PerPod is overhead applied once per pod referencing the claim on this node.
+	// This is a flat overhead incurred for every pod referencing the claim.
+	PerPod *resource.Quantity `json:"perPod,omitempty"`
+	// PerContainer is applied per container reference to the claim.
+	// This models overhead scaling linearly with the number of containers actively using the device.
+	// When both PerPod and PerContainer are specified, the total overhead allocated for each pod referencing
+	// the claim is computed as:
+	// Quantity = PerPod + (PerContainer * NumReferences)
+	// Kubelet accounts for this overhead in cgroups:
+	// - Pod-level cgroup (requests and limits): Kubelet adds PerPod + (PerContainer * NumReferences).
+	// - Container-level cgroup (limits only): Kubelet adds PerPod + PerContainer for each referencing container.
+	// This allows any single container to access the pod-level overhead, while the parent cgroup caps the total usage to account for PerPod exactly once.
+	PerContainer *resource.Quantity `json:"perContainer,omitempty"`
+}
+
+// NodeAllocatableOverheadApplyConfiguration constructs a declarative configuration of the NodeAllocatableOverhead type for use with
+// apply.
+func NodeAllocatableOverhead() *NodeAllocatableOverheadApplyConfiguration {
+	return &NodeAllocatableOverheadApplyConfiguration{}
+}
+
+// WithPerPod sets the PerPod field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PerPod field is set to the value of the last call.
+func (b *NodeAllocatableOverheadApplyConfiguration) WithPerPod(value resource.Quantity) *NodeAllocatableOverheadApplyConfiguration {
+	b.PerPod = &value
+	return b
+}
+
+// WithPerContainer sets the PerContainer field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PerContainer field is set to the value of the last call.
+func (b *NodeAllocatableOverheadApplyConfiguration) WithPerContainer(value resource.Quantity) *NodeAllocatableOverheadApplyConfiguration {
+	b.PerContainer = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/nodeallocatableresource.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/nodeallocatableresource.go
new file mode 100644
index 0000000000..ce116f3d47
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/nodeallocatableresource.go
@@ -0,0 +1,65 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta2
+
+// NodeAllocatableResourceApplyConfiguration represents a declarative configuration of the NodeAllocatableResource type for use
+// with apply.
+//
+// NodeAllocatableResource defines the translation between the DRA device/capacity
+// units requested to the corresponding quantity of the node allocatable resource.
+// At least one of Mapping or Overhead must be specified. Not specifying either is an invalid configuration.
+type NodeAllocatableResourceApplyConfiguration struct {
+	// Mapping is used when the device directly models a node allocatable resource like standard CPU or memory
+	// (e.g., with a CPU DRA driver). The calculated quantity is accounted for exactly once per claim instance
+	// on the node. To prevent node cgroup isolation friction, the scheduler explicitly
+	// blocks sharing mapped device claims across multiple pods.
+	Mapping *NodeAllocatableMappingApplyConfiguration `json:"mapping,omitempty"`
+	// Overhead contains fields for modeling auxiliary overhead incurred on node allocatable resources
+	// when allocating devices that are not themselves modeling a node allocatable resource (e.g., host memory overhead for GPUs).
+	// Sharing overhead-mapped claims across multiple pods is allowed. The node allocatable overhead is accounted
+	// for individually for each pod referencing the claim.
+	// Overhead is always subtracted from the node's allocatable capacity for the resource, even when mapping
+	// is specified for the same resource.
+	// Eg: If a device models memory capacity per socket as a consumable capacity pool via Mapping (with CapacityKey),
+	// any overhead specified for the same resource will be subtracted from the node's general allocatable capacity
+	// and not from the per-socket capacity pool in Mapping.
+	Overhead *NodeAllocatableOverheadApplyConfiguration `json:"overhead,omitempty"`
+}
+
+// NodeAllocatableResourceApplyConfiguration constructs a declarative configuration of the NodeAllocatableResource type for use with
+// apply.
+func NodeAllocatableResource() *NodeAllocatableResourceApplyConfiguration {
+	return &NodeAllocatableResourceApplyConfiguration{}
+}
+
+// WithMapping sets the Mapping field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Mapping field is set to the value of the last call.
+func (b *NodeAllocatableResourceApplyConfiguration) WithMapping(value *NodeAllocatableMappingApplyConfiguration) *NodeAllocatableResourceApplyConfiguration {
+	b.Mapping = value
+	return b
+}
+
+// WithOverhead sets the Overhead field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Overhead field is set to the value of the last call.
+func (b *NodeAllocatableResourceApplyConfiguration) WithOverhead(value *NodeAllocatableOverheadApplyConfiguration) *NodeAllocatableResourceApplyConfiguration {
+	b.Overhead = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/nodeallocatableresourcemapping.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/nodeallocatableresourcemapping.go
deleted file mode 100644
index b1490b5e75..0000000000
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/nodeallocatableresourcemapping.go
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by applyconfiguration-gen. DO NOT EDIT.
-
-package v1beta2
-
-import (
-	resourcev1beta2 "k8s.io/api/resource/v1beta2"
-	resource "k8s.io/apimachinery/pkg/api/resource"
-)
-
-// NodeAllocatableResourceMappingApplyConfiguration represents a declarative configuration of the NodeAllocatableResourceMapping type for use
-// with apply.
-//
-// NodeAllocatableResourceMapping defines the translation between the DRA device/capacity
-// units requested to the corresponding quantity of the node allocatable resource.
-type NodeAllocatableResourceMappingApplyConfiguration struct {
-	// CapacityKey references a capacity name defined as a key in the
-	// `spec.devices[*].capacity` map. When this field is set, the value associated with
-	// this key in the `status.allocation.devices.results[*].consumedCapacity` map
-	// (for a specific claim allocation) determines the base quantity for
-	// the node allocatable resource. If `allocationMultiplier` is also set, it is
-	// multiplied with the base quantity.
-	// For example, if `spec.devices[*].capacity` has an entry "dra.example.com/memory": "128Gi",
-	// and this field is set to "dra.example.com/memory", then for a claim allocation
-	// that consumes { "dra.example.com/memory": "4Gi" } the base quantity for the
-	// node allocatable resource mapping will be "4Gi", and `allocationMultiplier` should
-	// be omitted or set to "1".
-	CapacityKey *resourcev1beta2.QualifiedName `json:"capacityKey,omitempty"`
-	// AllocationMultiplier is used as a multiplier for the allocated device count or the allocated capacity in the claim.
-	// It defaults to 1 if not specified. How the field is used also depends on whether `capacityKey` is set.
-	// 1.  If `capacityKey` is NOT set: `allocationMultiplier` multiplies the device count allocated to the claim.
-	// a. A DRA driver representing each CPU core as a device would have
-	// {ResourceName: "cpu", allocationMultiplier: "2"} in its
-	// `nodeAllocatableResourceMappings`. If 4 devices are allocated to the claim,
-	// 4 * 2 CPUs would be considered as allocated and subtracted from the node's capacity.
-	// b. A GPU device that needs additional node memory per GPU allocation would
-	// have {ResourceName: "memory", allocationMultiplier: "2Gi"}.  Each allocated
-	// GPU device instance of this type will account for 2Gi of memory.
-	//
-	// 2.  If `capacityKey` IS set: `allocationMultiplier` is multiplied by the amount of that capacity consumed.
-	// The final node allocatable resource amount is `consumedCapacity[capacityKey]` * `allocationMultiplier`.
-	// For example, if a Device's capacity "dra.example.com/cores" is consumed,
-	// and each "core" provides 2 "cpu"s, the mapping would be:
-	// {ResourceName: "cpu", capacityKey: "dra.example.com/cores", allocationMultiplier: "2"}.
-	// If a claim consumes 8 "dra.example.com/cores", the CPU footprint is 8 * 2 = 16.
-	AllocationMultiplier *resource.Quantity `json:"allocationMultiplier,omitempty"`
-}
-
-// NodeAllocatableResourceMappingApplyConfiguration constructs a declarative configuration of the NodeAllocatableResourceMapping type for use with
-// apply.
-func NodeAllocatableResourceMapping() *NodeAllocatableResourceMappingApplyConfiguration {
-	return &NodeAllocatableResourceMappingApplyConfiguration{}
-}
-
-// WithCapacityKey sets the CapacityKey field in the declarative configuration to the given value
-// and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the CapacityKey field is set to the value of the last call.
-func (b *NodeAllocatableResourceMappingApplyConfiguration) WithCapacityKey(value resourcev1beta2.QualifiedName) *NodeAllocatableResourceMappingApplyConfiguration {
-	b.CapacityKey = &value
-	return b
-}
-
-// WithAllocationMultiplier sets the AllocationMultiplier field in the declarative configuration to the given value
-// and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the AllocationMultiplier field is set to the value of the last call.
-func (b *NodeAllocatableResourceMappingApplyConfiguration) WithAllocationMultiplier(value resource.Quantity) *NodeAllocatableResourceMappingApplyConfiguration {
-	b.AllocationMultiplier = &value
-	return b
-}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceclaim.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceclaim.go
index e35d087cd6..7b8e86139e 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceclaim.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceclaim.go
@@ -39,7 +39,7 @@ import (
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type ResourceClaimApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Spec describes what is being requested and how to configure it.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceclaimtemplate.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceclaimtemplate.go
index 999521cee2..35e5adbdfc 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceclaimtemplate.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceclaimtemplate.go
@@ -35,7 +35,7 @@ import (
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type ResourceClaimTemplateApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Describes the ResourceClaim that is to be generated.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourcepool.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourcepool.go
index f5b0c9b618..4d631c3976 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourcepool.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourcepool.go
@@ -25,6 +25,8 @@ package v1beta2
 type ResourcePoolApplyConfiguration struct {
 	// Name is used to identify the pool. For node-local devices, this
 	// is often the node name, but this is not required.
+	// A field selector can be used to list only ResourceSlice objects
+	// belonging to a certain pool.
 	//
 	// It must not be longer than 253 characters and must consist of one or more DNS sub-domains
 	// separated by slashes. This field is immutable.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceslice.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceslice.go
index dbbe7b2ea2..89eae2d216 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceslice.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceslice.go
@@ -55,7 +55,7 @@ import (
 // This is an alpha type and requires enabling the DynamicResourceAllocation
 // feature gate.
 type ResourceSliceApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// Contains the information published by the driver.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceslicespec.go b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceslicespec.go
index 2efc7d0750..cdd52c111a 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceslicespec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/resource/v1beta2/resourceslicespec.go
@@ -19,6 +19,7 @@ limitations under the License.
 package v1beta2
 
 import (
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
 	v1 "k8s.io/client-go/applyconfigurations/core/v1"
 )
 
@@ -82,6 +83,28 @@ type ResourceSliceSpecApplyConfiguration struct {
 	//
 	// The maximum number of counter sets is 8.
 	SharedCounters []CounterSetApplyConfiguration `json:"sharedCounters,omitempty"`
+	// PartitionTypeAttribute names a string device attribute (by fully
+	// qualified name, e.g. "gpu.example.com/profile") whose value labels
+	// each device with its partition type, such as "Full" or "Half" for a
+	// MIG-style GPU.
+	//
+	// When set, every partitionable device in the slice must carry the attribute
+	// and devices sharing a value must share the same ConsumesCounters cost.
+	PartitionTypeAttribute *resourcev1beta2.FullyQualifiedName `json:"partitionTypeAttribute,omitempty"`
+	// SkipNodeOperations lists node-local resource operations (gRPC calls)
+	// that will be skipped for the devices in this slice when determining whether
+	// operations are necessary on the node. If all allocated devices for a driver in
+	// a claim skip an operation, that gRPC call will be skipped. Valid values are:
+	//
+	// - "NodePrepareResources": NodePrepareResources gRPC calls are skipped. This
+	// value cannot be specified unless "NodeUnprepareResources" is also listed
+	// (or "*" is specified).
+	// - "NodeUnprepareResources": NodeUnprepareResources gRPC calls are skipped.
+	// - "*": All node-local resource operations are skipped.
+	//
+	// Other values may be added in the future. The kubelet must ignore unknown
+	// values.
+	SkipNodeOperations []resourcev1beta2.SkipNodeOperation `json:"skipNodeOperations,omitempty"`
 }
 
 // ResourceSliceSpecApplyConfiguration constructs a declarative configuration of the ResourceSliceSpec type for use with
@@ -163,3 +186,21 @@ func (b *ResourceSliceSpecApplyConfiguration) WithSharedCounters(values ...*Coun
 	}
 	return b
 }
+
+// WithPartitionTypeAttribute sets the PartitionTypeAttribute field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PartitionTypeAttribute field is set to the value of the last call.
+func (b *ResourceSliceSpecApplyConfiguration) WithPartitionTypeAttribute(value resourcev1beta2.FullyQualifiedName) *ResourceSliceSpecApplyConfiguration {
+	b.PartitionTypeAttribute = &value
+	return b
+}
+
+// WithSkipNodeOperations adds the given value to the SkipNodeOperations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the SkipNodeOperations field.
+func (b *ResourceSliceSpecApplyConfiguration) WithSkipNodeOperations(values ...resourcev1beta2.SkipNodeOperation) *ResourceSliceSpecApplyConfiguration {
+	for i := range values {
+		b.SkipNodeOperations = append(b.SkipNodeOperations, values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1/priorityclass.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1/priorityclass.go
index 4056dcdd2f..b8612d6cbb 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1/priorityclass.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1/priorityclass.go
@@ -34,8 +34,8 @@ import (
 // PriorityClass defines mapping from a priority class name to the priority
 // integer value. The value can be any valid integer.
 type PriorityClassApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// value represents the integer value of this priority class. This is the actual priority that pods
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgrouptemplatereference.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgrouptemplatereference.go
deleted file mode 100644
index f8b1f61ffc..0000000000
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgrouptemplatereference.go
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by applyconfiguration-gen. DO NOT EDIT.
-
-package v1alpha2
-
-// PodGroupTemplateReferenceApplyConfiguration represents a declarative configuration of the PodGroupTemplateReference type for use
-// with apply.
-//
-// PodGroupTemplateReference references a PodGroup template defined in some object (e.g. Workload).
-// Exactly one reference must be set.
-type PodGroupTemplateReferenceApplyConfiguration struct {
-	// Workload references the PodGroupTemplate within the Workload object that was used to create
-	// the PodGroup.
-	Workload *WorkloadPodGroupTemplateReferenceApplyConfiguration `json:"workload,omitempty"`
-}
-
-// PodGroupTemplateReferenceApplyConfiguration constructs a declarative configuration of the PodGroupTemplateReference type for use with
-// apply.
-func PodGroupTemplateReference() *PodGroupTemplateReferenceApplyConfiguration {
-	return &PodGroupTemplateReferenceApplyConfiguration{}
-}
-
-// WithWorkload sets the Workload field in the declarative configuration to the given value
-// and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the Workload field is set to the value of the last call.
-func (b *PodGroupTemplateReferenceApplyConfiguration) WithWorkload(value *WorkloadPodGroupTemplateReferenceApplyConfiguration) *PodGroupTemplateReferenceApplyConfiguration {
-	b.Workload = value
-	return b
-}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/workloadpodgrouptemplatereference.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/workloadpodgrouptemplatereference.go
deleted file mode 100644
index ff3ab06c8d..0000000000
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/workloadpodgrouptemplatereference.go
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by applyconfiguration-gen. DO NOT EDIT.
-
-package v1alpha2
-
-// WorkloadPodGroupTemplateReferenceApplyConfiguration represents a declarative configuration of the WorkloadPodGroupTemplateReference type for use
-// with apply.
-//
-// WorkloadPodGroupTemplateReference references the PodGroupTemplate within the Workload object.
-type WorkloadPodGroupTemplateReferenceApplyConfiguration struct {
-	// WorkloadName defines the name of the Workload object.
-	WorkloadName *string `json:"workloadName,omitempty"`
-	// PodGroupTemplateName defines the PodGroupTemplate name within the Workload object.
-	PodGroupTemplateName *string `json:"podGroupTemplateName,omitempty"`
-}
-
-// WorkloadPodGroupTemplateReferenceApplyConfiguration constructs a declarative configuration of the WorkloadPodGroupTemplateReference type for use with
-// apply.
-func WorkloadPodGroupTemplateReference() *WorkloadPodGroupTemplateReferenceApplyConfiguration {
-	return &WorkloadPodGroupTemplateReferenceApplyConfiguration{}
-}
-
-// WithWorkloadName sets the WorkloadName field in the declarative configuration to the given value
-// and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the WorkloadName field is set to the value of the last call.
-func (b *WorkloadPodGroupTemplateReferenceApplyConfiguration) WithWorkloadName(value string) *WorkloadPodGroupTemplateReferenceApplyConfiguration {
-	b.WorkloadName = &value
-	return b
-}
-
-// WithPodGroupTemplateName sets the PodGroupTemplateName field in the declarative configuration to the given value
-// and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the PodGroupTemplateName field is set to the value of the last call.
-func (b *WorkloadPodGroupTemplateReferenceApplyConfiguration) WithPodGroupTemplateName(value string) *WorkloadPodGroupTemplateReferenceApplyConfiguration {
-	b.PodGroupTemplateName = &value
-	return b
-}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositedisruptionmode.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositedisruptionmode.go
new file mode 100644
index 0000000000..70ff0162ac
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositedisruptionmode.go
@@ -0,0 +1,57 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
+)
+
+// CompositeDisruptionModeApplyConfiguration represents a declarative configuration of the CompositeDisruptionMode type for use
+// with apply.
+//
+// CompositeDisruptionMode defines how individual entities within a composite pod group can be disrupted.
+// Exactly one mode must be set.
+type CompositeDisruptionModeApplyConfiguration struct {
+	// single specifies that children groups can be disrupted independently from each other.
+	Single *schedulingv1alpha3.SingleCompositeDisruptionMode `json:"single,omitempty"`
+	// all specifies that all children groups can only be disrupted together.
+	All *schedulingv1alpha3.AllCompositeDisruptionMode `json:"all,omitempty"`
+}
+
+// CompositeDisruptionModeApplyConfiguration constructs a declarative configuration of the CompositeDisruptionMode type for use with
+// apply.
+func CompositeDisruptionMode() *CompositeDisruptionModeApplyConfiguration {
+	return &CompositeDisruptionModeApplyConfiguration{}
+}
+
+// WithSingle sets the Single field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Single field is set to the value of the last call.
+func (b *CompositeDisruptionModeApplyConfiguration) WithSingle(value schedulingv1alpha3.SingleCompositeDisruptionMode) *CompositeDisruptionModeApplyConfiguration {
+	b.Single = &value
+	return b
+}
+
+// WithAll sets the All field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the All field is set to the value of the last call.
+func (b *CompositeDisruptionModeApplyConfiguration) WithAll(value schedulingv1alpha3.AllCompositeDisruptionMode) *CompositeDisruptionModeApplyConfiguration {
+	b.All = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositegangschedulingpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositegangschedulingpolicy.go
new file mode 100644
index 0000000000..c462b55a9e
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositegangschedulingpolicy.go
@@ -0,0 +1,45 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+// CompositeGangSchedulingPolicyApplyConfiguration represents a declarative configuration of the CompositeGangSchedulingPolicy type for use
+// with apply.
+//
+// CompositeGangSchedulingPolicy indicates that the groups belonging to the composite group
+// should be scheduled using all-or-nothing semantics.
+type CompositeGangSchedulingPolicyApplyConfiguration struct {
+	// minGroupCount is the minimum number of child groups that must be schedulable
+	// or scheduled at the same time for the scheduler to admit the entire group.
+	// It must be a positive integer.
+	MinGroupCount *int32 `json:"minGroupCount,omitempty"`
+}
+
+// CompositeGangSchedulingPolicyApplyConfiguration constructs a declarative configuration of the CompositeGangSchedulingPolicy type for use with
+// apply.
+func CompositeGangSchedulingPolicy() *CompositeGangSchedulingPolicyApplyConfiguration {
+	return &CompositeGangSchedulingPolicyApplyConfiguration{}
+}
+
+// WithMinGroupCount sets the MinGroupCount field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MinGroupCount field is set to the value of the last call.
+func (b *CompositeGangSchedulingPolicyApplyConfiguration) WithMinGroupCount(value int32) *CompositeGangSchedulingPolicyApplyConfiguration {
+	b.MinGroupCount = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgroup.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgroup.go
new file mode 100644
index 0000000000..e408c0a791
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgroup.go
@@ -0,0 +1,296 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	internal "k8s.io/client-go/applyconfigurations/internal"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// CompositePodGroupApplyConfiguration represents a declarative configuration of the CompositePodGroup type for use
+// with apply.
+//
+// CompositePodGroup represents a runtime instance of pod groups grouped together.
+// CompositePodGroups are created by workload controllers (LWS, JobSet, etc...) from
+// Workload.compositePodGroupTemplates.
+// CompositePodGroup API enablement is toggled by the CompositePodGroup feature gate.
+type CompositePodGroupApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	// spec defines the desired state of the CompositePodGroup.
+	Spec *CompositePodGroupSpecApplyConfiguration `json:"spec,omitempty"`
+	// status represents the current observed state of the CompositePodGroup.
+	Status *CompositePodGroupStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// CompositePodGroup constructs a declarative configuration of the CompositePodGroup type for use with
+// apply.
+func CompositePodGroup(name, namespace string) *CompositePodGroupApplyConfiguration {
+	b := &CompositePodGroupApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("CompositePodGroup")
+	b.WithAPIVersion("scheduling.k8s.io/v1alpha3")
+	return b
+}
+
+// ExtractCompositePodGroupFrom extracts the applied configuration owned by fieldManager from
+// compositePodGroup for the specified subresource. Pass an empty string for subresource to extract
+// the main resource. Common subresources include "status", "scale", etc.
+// compositePodGroup must be a unmodified CompositePodGroup API object that was retrieved from the Kubernetes API.
+// ExtractCompositePodGroupFrom provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractCompositePodGroupFrom(compositePodGroup *schedulingv1alpha3.CompositePodGroup, fieldManager string, subresource string) (*CompositePodGroupApplyConfiguration, error) {
+	b := &CompositePodGroupApplyConfiguration{}
+	err := managedfields.ExtractInto(compositePodGroup, internal.Parser().Type("io.k8s.api.scheduling.v1alpha3.CompositePodGroup"), fieldManager, b, subresource)
+	if err != nil {
+		return nil, err
+	}
+	b.WithName(compositePodGroup.Name)
+	b.WithNamespace(compositePodGroup.Namespace)
+
+	b.WithKind("CompositePodGroup")
+	b.WithAPIVersion("scheduling.k8s.io/v1alpha3")
+	return b, nil
+}
+
+// ExtractCompositePodGroup extracts the applied configuration owned by fieldManager from
+// compositePodGroup. If no managedFields are found in compositePodGroup for fieldManager, a
+// CompositePodGroupApplyConfiguration is returned with only the Name, Namespace (if applicable),
+// APIVersion and Kind populated. It is possible that no managed fields were found for because other
+// field managers have taken ownership of all the fields previously owned by fieldManager, or because
+// the fieldManager never owned fields any fields.
+// compositePodGroup must be a unmodified CompositePodGroup API object that was retrieved from the Kubernetes API.
+// ExtractCompositePodGroup provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractCompositePodGroup(compositePodGroup *schedulingv1alpha3.CompositePodGroup, fieldManager string) (*CompositePodGroupApplyConfiguration, error) {
+	return ExtractCompositePodGroupFrom(compositePodGroup, fieldManager, "")
+}
+
+// ExtractCompositePodGroupStatus extracts the applied configuration owned by fieldManager from
+// compositePodGroup for the status subresource.
+func ExtractCompositePodGroupStatus(compositePodGroup *schedulingv1alpha3.CompositePodGroup, fieldManager string) (*CompositePodGroupApplyConfiguration, error) {
+	return ExtractCompositePodGroupFrom(compositePodGroup, fieldManager, "status")
+}
+
+func (b CompositePodGroupApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *CompositePodGroupApplyConfiguration) WithKind(value string) *CompositePodGroupApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *CompositePodGroupApplyConfiguration) WithAPIVersion(value string) *CompositePodGroupApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *CompositePodGroupApplyConfiguration) WithName(value string) *CompositePodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *CompositePodGroupApplyConfiguration) WithGenerateName(value string) *CompositePodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *CompositePodGroupApplyConfiguration) WithNamespace(value string) *CompositePodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *CompositePodGroupApplyConfiguration) WithUID(value types.UID) *CompositePodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *CompositePodGroupApplyConfiguration) WithResourceVersion(value string) *CompositePodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *CompositePodGroupApplyConfiguration) WithGeneration(value int64) *CompositePodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *CompositePodGroupApplyConfiguration) WithCreationTimestamp(value metav1.Time) *CompositePodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *CompositePodGroupApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *CompositePodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *CompositePodGroupApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *CompositePodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *CompositePodGroupApplyConfiguration) WithLabels(entries map[string]string) *CompositePodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *CompositePodGroupApplyConfiguration) WithAnnotations(entries map[string]string) *CompositePodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *CompositePodGroupApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *CompositePodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *CompositePodGroupApplyConfiguration) WithFinalizers(values ...string) *CompositePodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *CompositePodGroupApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *CompositePodGroupApplyConfiguration) WithSpec(value *CompositePodGroupSpecApplyConfiguration) *CompositePodGroupApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *CompositePodGroupApplyConfiguration) WithStatus(value *CompositePodGroupStatusApplyConfiguration) *CompositePodGroupApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *CompositePodGroupApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *CompositePodGroupApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *CompositePodGroupApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *CompositePodGroupApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgroupschedulingconstraints.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgroupschedulingconstraints.go
new file mode 100644
index 0000000000..4c6fe983c0
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgroupschedulingconstraints.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+// CompositePodGroupSchedulingConstraintsApplyConfiguration represents a declarative configuration of the CompositePodGroupSchedulingConstraints type for use
+// with apply.
+//
+// CompositePodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a CompositePodGroup.
+type CompositePodGroupSchedulingConstraintsApplyConfiguration struct {
+	// topology defines the topology constraints for the composite pod group.
+	// Currently only a single topology constraint can be specified. This may change in the future.
+	Topology []TopologyConstraintApplyConfiguration `json:"topology,omitempty"`
+}
+
+// CompositePodGroupSchedulingConstraintsApplyConfiguration constructs a declarative configuration of the CompositePodGroupSchedulingConstraints type for use with
+// apply.
+func CompositePodGroupSchedulingConstraints() *CompositePodGroupSchedulingConstraintsApplyConfiguration {
+	return &CompositePodGroupSchedulingConstraintsApplyConfiguration{}
+}
+
+// WithTopology adds the given value to the Topology field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Topology field.
+func (b *CompositePodGroupSchedulingConstraintsApplyConfiguration) WithTopology(values ...*TopologyConstraintApplyConfiguration) *CompositePodGroupSchedulingConstraintsApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithTopology")
+		}
+		b.Topology = append(b.Topology, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgroupschedulingpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgroupschedulingpolicy.go
new file mode 100644
index 0000000000..c98be7fbe3
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgroupschedulingpolicy.go
@@ -0,0 +1,59 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
+)
+
+// CompositePodGroupSchedulingPolicyApplyConfiguration represents a declarative configuration of the CompositePodGroupSchedulingPolicy type for use
+// with apply.
+//
+// CompositePodGroupSchedulingPolicy defines the scheduling configuration for a CompositePodGroup.
+// Exactly one policy must be set.
+type CompositePodGroupSchedulingPolicyApplyConfiguration struct {
+	// basic specifies that the groups of this composite group should be scheduled independently.
+	// This field is immutable.
+	Basic *schedulingv1alpha3.CompositeBasicSchedulingPolicy `json:"basic,omitempty"`
+	// gang specifies that the groups of this composite group should be scheduled using
+	// all-or-nothing semantics.
+	Gang *CompositeGangSchedulingPolicyApplyConfiguration `json:"gang,omitempty"`
+}
+
+// CompositePodGroupSchedulingPolicyApplyConfiguration constructs a declarative configuration of the CompositePodGroupSchedulingPolicy type for use with
+// apply.
+func CompositePodGroupSchedulingPolicy() *CompositePodGroupSchedulingPolicyApplyConfiguration {
+	return &CompositePodGroupSchedulingPolicyApplyConfiguration{}
+}
+
+// WithBasic sets the Basic field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Basic field is set to the value of the last call.
+func (b *CompositePodGroupSchedulingPolicyApplyConfiguration) WithBasic(value schedulingv1alpha3.CompositeBasicSchedulingPolicy) *CompositePodGroupSchedulingPolicyApplyConfiguration {
+	b.Basic = &value
+	return b
+}
+
+// WithGang sets the Gang field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Gang field is set to the value of the last call.
+func (b *CompositePodGroupSchedulingPolicyApplyConfiguration) WithGang(value *CompositeGangSchedulingPolicyApplyConfiguration) *CompositePodGroupSchedulingPolicyApplyConfiguration {
+	b.Gang = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgroupspec.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgroupspec.go
new file mode 100644
index 0000000000..16bc538a54
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgroupspec.go
@@ -0,0 +1,144 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
+)
+
+// CompositePodGroupSpecApplyConfiguration represents a declarative configuration of the CompositePodGroupSpec type for use
+// with apply.
+//
+// CompositePodGroupSpec defines the desired state of CompositePodGroup.
+type CompositePodGroupSpecApplyConfiguration struct {
+	// parentCompositePodGroupName contains the name of the parent composite pod group
+	// within the same namespace as this composite pod group. It must be a DNS name.
+	// If it's nil, then this composite pod group is a root of a workload's hierarchy.
+	// This field is immutable.
+	ParentCompositePodGroupName *string `json:"parentCompositePodGroupName,omitempty"`
+	// workloadRef references an optional CompositePodGroup template within the
+	// Workload object that was used to create the CompositePodGroup.
+	// This field is required.
+	// This field is immutable.
+	WorkloadRef *WorkloadReferenceApplyConfiguration `json:"workloadRef,omitempty"`
+	// schedulingPolicy defines the scheduling policy for this instance of the CompositePodGroup.
+	// Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate.
+	// This field is immutable.
+	SchedulingPolicy *CompositePodGroupSchedulingPolicyApplyConfiguration `json:"schedulingPolicy,omitempty"`
+	// schedulingConstraints defines optional scheduling constraints (e.g. topology) for this CompositePodGroup.
+	// Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate.
+	// This field is immutable.
+	SchedulingConstraints *CompositePodGroupSchedulingConstraintsApplyConfiguration `json:"schedulingConstraints,omitempty"`
+	// disruptionMode defines the mode in which a given CompositePodGroup can be disrupted.
+	// Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate.
+	// One of Single, All. Defaults to Single if unset.
+	// This field is immutable.
+	DisruptionMode *CompositeDisruptionModeApplyConfiguration `json:"disruptionMode,omitempty"`
+	// priorityClassName defines the priority that should be considered when scheduling this CompositePodGroup.
+	// Controllers are expected to fill this field by copying it from a CompositePodGroupTemplate.
+	// If left unspecified, it is validated and resolved similarly to the PriorityClassName field in Pods
+	// (i.e. if no priority class is specified, admission control can set this to the global default
+	// priority class if it exists. Otherwise, the composite pod group's priority will be zero).
+	// This field is immutable.
+	PriorityClassName *string `json:"priorityClassName,omitempty"`
+	// priority is the value of priority of this composite pod group. Various system components
+	// use this field to find the priority of the composite pod group. When Priority Admission
+	// Controller is enabled, it prevents users from setting this field. The admission
+	// controller populates this field from PriorityClassName.
+	// The higher the value, the higher the priority.
+	// This field is immutable.
+	Priority *int32 `json:"priority,omitempty"`
+	// preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+	// One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset.
+	// When Priority Admission Controller is enabled, it populates this field from PriorityClassName,
+	// and defaults to PreemptLowerPriority if value is unset in PriorityClass.
+	// This field is immutable.
+	// This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+	PreemptionPolicy *schedulingv1alpha3.PreemptionPolicy `json:"preemptionPolicy,omitempty"`
+}
+
+// CompositePodGroupSpecApplyConfiguration constructs a declarative configuration of the CompositePodGroupSpec type for use with
+// apply.
+func CompositePodGroupSpec() *CompositePodGroupSpecApplyConfiguration {
+	return &CompositePodGroupSpecApplyConfiguration{}
+}
+
+// WithParentCompositePodGroupName sets the ParentCompositePodGroupName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ParentCompositePodGroupName field is set to the value of the last call.
+func (b *CompositePodGroupSpecApplyConfiguration) WithParentCompositePodGroupName(value string) *CompositePodGroupSpecApplyConfiguration {
+	b.ParentCompositePodGroupName = &value
+	return b
+}
+
+// WithWorkloadRef sets the WorkloadRef field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the WorkloadRef field is set to the value of the last call.
+func (b *CompositePodGroupSpecApplyConfiguration) WithWorkloadRef(value *WorkloadReferenceApplyConfiguration) *CompositePodGroupSpecApplyConfiguration {
+	b.WorkloadRef = value
+	return b
+}
+
+// WithSchedulingPolicy sets the SchedulingPolicy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SchedulingPolicy field is set to the value of the last call.
+func (b *CompositePodGroupSpecApplyConfiguration) WithSchedulingPolicy(value *CompositePodGroupSchedulingPolicyApplyConfiguration) *CompositePodGroupSpecApplyConfiguration {
+	b.SchedulingPolicy = value
+	return b
+}
+
+// WithSchedulingConstraints sets the SchedulingConstraints field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SchedulingConstraints field is set to the value of the last call.
+func (b *CompositePodGroupSpecApplyConfiguration) WithSchedulingConstraints(value *CompositePodGroupSchedulingConstraintsApplyConfiguration) *CompositePodGroupSpecApplyConfiguration {
+	b.SchedulingConstraints = value
+	return b
+}
+
+// WithDisruptionMode sets the DisruptionMode field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DisruptionMode field is set to the value of the last call.
+func (b *CompositePodGroupSpecApplyConfiguration) WithDisruptionMode(value *CompositeDisruptionModeApplyConfiguration) *CompositePodGroupSpecApplyConfiguration {
+	b.DisruptionMode = value
+	return b
+}
+
+// WithPriorityClassName sets the PriorityClassName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PriorityClassName field is set to the value of the last call.
+func (b *CompositePodGroupSpecApplyConfiguration) WithPriorityClassName(value string) *CompositePodGroupSpecApplyConfiguration {
+	b.PriorityClassName = &value
+	return b
+}
+
+// WithPriority sets the Priority field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Priority field is set to the value of the last call.
+func (b *CompositePodGroupSpecApplyConfiguration) WithPriority(value int32) *CompositePodGroupSpecApplyConfiguration {
+	b.Priority = &value
+	return b
+}
+
+// WithPreemptionPolicy sets the PreemptionPolicy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PreemptionPolicy field is set to the value of the last call.
+func (b *CompositePodGroupSpecApplyConfiguration) WithPreemptionPolicy(value schedulingv1alpha3.PreemptionPolicy) *CompositePodGroupSpecApplyConfiguration {
+	b.PreemptionPolicy = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgroupstatus.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgroupstatus.go
new file mode 100644
index 0000000000..7c96916526
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgroupstatus.go
@@ -0,0 +1,72 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// CompositePodGroupStatusApplyConfiguration represents a declarative configuration of the CompositePodGroupStatus type for use
+// with apply.
+//
+// CompositePodGroupStatus represents information about the status of a composite pod group.
+type CompositePodGroupStatusApplyConfiguration struct {
+	// conditions represent the latest observations of the CompositePodGroup's state.
+	//
+	// Known condition types:
+	// - "CompositePodGroupInitiallyScheduled": Indicates whether the overall scheduling requirement
+	// for the subtree under this CompositePodGroup has been satisfied. Once this condition
+	// transitions to True, it serves as a terminal state and will never revert to False,
+	// even if pods are subsequently deleted and group constraints are no longer met.
+	// - "DisruptionTarget": Indicates whether the CompositePodGroup is about to be terminated
+	// due to disruption such as preemption.
+	//
+	// Known reasons for the CompositePodGroupInitiallyScheduled condition:
+	// - "Unschedulable": The CompositePodGroup's subtree could not be placed due to resource constraints,
+	// affinity/anti-affinity, or topological constraints.
+	// - "SchedulerError": The CompositePodGroup cannot be scheduled due to some internal error
+	// that occurred during scheduling.
+	// - "Invalid": Set to True when kube-scheduler detects an invalid group layout during
+	// runtime validation. The `message` field details the specific layout violation (such as
+	// a detected cycle, exceeding the maximum depth of 4, or referencing multiple distinct Workloads).
+	//
+	// Known reasons for the DisruptionTarget condition:
+	// - "PreemptionByScheduler": The CompositePodGroup was targeted by the scheduler's preemption loop
+	// to free up capacity for higher-priority preemptors.
+	Conditions []v1.ConditionApplyConfiguration `json:"conditions,omitempty"`
+}
+
+// CompositePodGroupStatusApplyConfiguration constructs a declarative configuration of the CompositePodGroupStatus type for use with
+// apply.
+func CompositePodGroupStatus() *CompositePodGroupStatusApplyConfiguration {
+	return &CompositePodGroupStatusApplyConfiguration{}
+}
+
+// WithConditions adds the given value to the Conditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Conditions field.
+func (b *CompositePodGroupStatusApplyConfiguration) WithConditions(values ...*v1.ConditionApplyConfiguration) *CompositePodGroupStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithConditions")
+		}
+		b.Conditions = append(b.Conditions, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgrouptemplate.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgrouptemplate.go
new file mode 100644
index 0000000000..fd8aadc2ed
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/compositepodgrouptemplate.go
@@ -0,0 +1,157 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
+)
+
+// CompositePodGroupTemplateApplyConfiguration represents a declarative configuration of the CompositePodGroupTemplate type for use
+// with apply.
+//
+// CompositePodGroupTemplate represents a template for a CompositePodGroup with a scheduling policy.
+type CompositePodGroupTemplateApplyConfiguration struct {
+	// name is a unique identifier for the CompositePodGroupTemplate within the Workload.
+	// It must be a DNS label. This field is required.
+	Name *string `json:"name,omitempty"`
+	// schedulingPolicy defines the scheduling policy for this template.
+	SchedulingPolicy *CompositePodGroupSchedulingPolicyApplyConfiguration `json:"schedulingPolicy,omitempty"`
+	// schedulingConstraints defines optional scheduling constraints (e.g. topology) for this CompositePodGroupTemplate.
+	// This field is immutable.
+	SchedulingConstraints *CompositePodGroupSchedulingConstraintsApplyConfiguration `json:"schedulingConstraints,omitempty"`
+	// disruptionMode defines the mode in which a given CompositePodGroup can be disrupted.
+	// One of Single, All.
+	// This field is immutable.
+	DisruptionMode *CompositeDisruptionModeApplyConfiguration `json:"disruptionMode,omitempty"`
+	// priorityClassName indicates the priority that should be considered when scheduling
+	// a composite pod group created from this template. If no priority class is specified,
+	// admission control can set this to the global default priority class if it exists.
+	// Otherwise, composite pod groups created from this template will have the priority set
+	// to zero.
+	// This field is immutable.
+	PriorityClassName *string `json:"priorityClassName,omitempty"`
+	// priority is the value of priority of composite pod groups created from this template.
+	// Various system components use this field to find the priority of the composite pod group.
+	// When Priority Admission Controller is enabled, it prevents users from setting this field.
+	// The admission controller populates this field from PriorityClassName.
+	// The higher the value, the higher the priority.
+	// This field is immutable.
+	Priority *int32 `json:"priority,omitempty"`
+	// preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+	// One of Never, PreemptLowerPriority.
+	// This field is immutable.
+	// This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+	PreemptionPolicy *schedulingv1alpha3.PreemptionPolicy `json:"preemptionPolicy,omitempty"`
+	// podGroupTemplates is the list of templates for children PodGroups.
+	// The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates
+	// or PodGroupTemplates must be set.
+	PodGroupTemplates []PodGroupTemplateApplyConfiguration `json:"podGroupTemplates,omitempty"`
+	// compositePodGroupTemplates is the list of templates for children CompositePodGroups.
+	// The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates
+	// or PodGroupTemplates must be set.
+	CompositePodGroupTemplates []CompositePodGroupTemplateApplyConfiguration `json:"compositePodGroupTemplates,omitempty"`
+}
+
+// CompositePodGroupTemplateApplyConfiguration constructs a declarative configuration of the CompositePodGroupTemplate type for use with
+// apply.
+func CompositePodGroupTemplate() *CompositePodGroupTemplateApplyConfiguration {
+	return &CompositePodGroupTemplateApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithName(value string) *CompositePodGroupTemplateApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithSchedulingPolicy sets the SchedulingPolicy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SchedulingPolicy field is set to the value of the last call.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithSchedulingPolicy(value *CompositePodGroupSchedulingPolicyApplyConfiguration) *CompositePodGroupTemplateApplyConfiguration {
+	b.SchedulingPolicy = value
+	return b
+}
+
+// WithSchedulingConstraints sets the SchedulingConstraints field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SchedulingConstraints field is set to the value of the last call.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithSchedulingConstraints(value *CompositePodGroupSchedulingConstraintsApplyConfiguration) *CompositePodGroupTemplateApplyConfiguration {
+	b.SchedulingConstraints = value
+	return b
+}
+
+// WithDisruptionMode sets the DisruptionMode field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DisruptionMode field is set to the value of the last call.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithDisruptionMode(value *CompositeDisruptionModeApplyConfiguration) *CompositePodGroupTemplateApplyConfiguration {
+	b.DisruptionMode = value
+	return b
+}
+
+// WithPriorityClassName sets the PriorityClassName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PriorityClassName field is set to the value of the last call.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithPriorityClassName(value string) *CompositePodGroupTemplateApplyConfiguration {
+	b.PriorityClassName = &value
+	return b
+}
+
+// WithPriority sets the Priority field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Priority field is set to the value of the last call.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithPriority(value int32) *CompositePodGroupTemplateApplyConfiguration {
+	b.Priority = &value
+	return b
+}
+
+// WithPreemptionPolicy sets the PreemptionPolicy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PreemptionPolicy field is set to the value of the last call.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithPreemptionPolicy(value schedulingv1alpha3.PreemptionPolicy) *CompositePodGroupTemplateApplyConfiguration {
+	b.PreemptionPolicy = &value
+	return b
+}
+
+// WithPodGroupTemplates adds the given value to the PodGroupTemplates field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the PodGroupTemplates field.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithPodGroupTemplates(values ...*PodGroupTemplateApplyConfiguration) *CompositePodGroupTemplateApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithPodGroupTemplates")
+		}
+		b.PodGroupTemplates = append(b.PodGroupTemplates, *values[i])
+	}
+	return b
+}
+
+// WithCompositePodGroupTemplates adds the given value to the CompositePodGroupTemplates field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the CompositePodGroupTemplates field.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithCompositePodGroupTemplates(values ...*CompositePodGroupTemplateApplyConfiguration) *CompositePodGroupTemplateApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithCompositePodGroupTemplates")
+		}
+		b.CompositePodGroupTemplates = append(b.CompositePodGroupTemplates, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/disruptionmode.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/disruptionmode.go
new file mode 100644
index 0000000000..b500fd3600
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/disruptionmode.go
@@ -0,0 +1,57 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
+)
+
+// DisruptionModeApplyConfiguration represents a declarative configuration of the DisruptionMode type for use
+// with apply.
+//
+// DisruptionMode defines how individual entities within a group can be disrupted.
+// Exactly one mode can be set.
+type DisruptionModeApplyConfiguration struct {
+	// single specifies that children can be disrupted independently from each other.
+	Single *schedulingv1alpha3.SingleDisruptionMode `json:"single,omitempty"`
+	// all specifies that all children can only be disrupted together.
+	All *schedulingv1alpha3.AllDisruptionMode `json:"all,omitempty"`
+}
+
+// DisruptionModeApplyConfiguration constructs a declarative configuration of the DisruptionMode type for use with
+// apply.
+func DisruptionMode() *DisruptionModeApplyConfiguration {
+	return &DisruptionModeApplyConfiguration{}
+}
+
+// WithSingle sets the Single field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Single field is set to the value of the last call.
+func (b *DisruptionModeApplyConfiguration) WithSingle(value schedulingv1alpha3.SingleDisruptionMode) *DisruptionModeApplyConfiguration {
+	b.Single = &value
+	return b
+}
+
+// WithAll sets the All field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the All field is set to the value of the last call.
+func (b *DisruptionModeApplyConfiguration) WithAll(value schedulingv1alpha3.AllDisruptionMode) *DisruptionModeApplyConfiguration {
+	b.All = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/gangschedulingpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/gangschedulingpolicy.go
new file mode 100644
index 0000000000..f0d3561ba4
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/gangschedulingpolicy.go
@@ -0,0 +1,52 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+// GangSchedulingPolicyApplyConfiguration represents a declarative configuration of the GangSchedulingPolicy type for use
+// with apply.
+//
+// GangSchedulingPolicy defines the parameters for gang scheduling.
+type GangSchedulingPolicyApplyConfiguration struct {
+	// minCount is the minimum number of pods that must be schedulable or scheduled
+	// at the same time for the scheduler to admit the entire group.
+	// It must be a positive integer. This field is mutable to support workload scaling.
+	//
+	// Note that the scheduler operates on an eventually consistent model. Updates
+	// to minCount may not be immediately reflected in scheduling decisions due to
+	// propagation delays. If minCount is updated while a scheduling cycle is in
+	// progress for that group, the new value may not take effect until the next
+	// cycle. Moreover, minCount is only enforced during scheduling, meaning that
+	// modifications to this field do not affect already-scheduled pods, applying
+	// only to those evaluated in future cycles.
+	MinCount *int32 `json:"minCount,omitempty"`
+}
+
+// GangSchedulingPolicyApplyConfiguration constructs a declarative configuration of the GangSchedulingPolicy type for use with
+// apply.
+func GangSchedulingPolicy() *GangSchedulingPolicyApplyConfiguration {
+	return &GangSchedulingPolicyApplyConfiguration{}
+}
+
+// WithMinCount sets the MinCount field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MinCount field is set to the value of the last call.
+func (b *GangSchedulingPolicyApplyConfiguration) WithMinCount(value int32) *GangSchedulingPolicyApplyConfiguration {
+	b.MinCount = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroup.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroup.go
similarity index 95%
rename from vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroup.go
rename to vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroup.go
index ee28510624..4970d44cb9 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroup.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroup.go
@@ -16,10 +16,10 @@ limitations under the License.
 
 // Code generated by applyconfiguration-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
 
 import (
-	schedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
@@ -35,13 +35,13 @@ import (
 // Workload.podGroupTemplates.
 // PodGroup API enablement is toggled by the GenericWorkload feature gate.
 type PodGroupApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Spec defines the desired state of the PodGroup.
+	// spec defines the desired state of the PodGroup.
 	Spec *PodGroupSpecApplyConfiguration `json:"spec,omitempty"`
-	// Status represents the current observed state of the PodGroup.
+	// status represents the current observed state of the PodGroup.
 	Status *PodGroupStatusApplyConfiguration `json:"status,omitempty"`
 }
 
@@ -52,7 +52,7 @@ func PodGroup(name, namespace string) *PodGroupApplyConfiguration {
 	b.WithName(name)
 	b.WithNamespace(namespace)
 	b.WithKind("PodGroup")
-	b.WithAPIVersion("scheduling.k8s.io/v1alpha2")
+	b.WithAPIVersion("scheduling.k8s.io/v1alpha3")
 	return b
 }
 
@@ -63,9 +63,9 @@ func PodGroup(name, namespace string) *PodGroupApplyConfiguration {
 // ExtractPodGroupFrom provides a way to perform a extract/modify-in-place/apply workflow.
 // Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
 // applied if another fieldManager has updated or force applied any of the previously applied fields.
-func ExtractPodGroupFrom(podGroup *schedulingv1alpha2.PodGroup, fieldManager string, subresource string) (*PodGroupApplyConfiguration, error) {
+func ExtractPodGroupFrom(podGroup *schedulingv1alpha3.PodGroup, fieldManager string, subresource string) (*PodGroupApplyConfiguration, error) {
 	b := &PodGroupApplyConfiguration{}
-	err := managedfields.ExtractInto(podGroup, internal.Parser().Type("io.k8s.api.scheduling.v1alpha2.PodGroup"), fieldManager, b, subresource)
+	err := managedfields.ExtractInto(podGroup, internal.Parser().Type("io.k8s.api.scheduling.v1alpha3.PodGroup"), fieldManager, b, subresource)
 	if err != nil {
 		return nil, err
 	}
@@ -73,7 +73,7 @@ func ExtractPodGroupFrom(podGroup *schedulingv1alpha2.PodGroup, fieldManager str
 	b.WithNamespace(podGroup.Namespace)
 
 	b.WithKind("PodGroup")
-	b.WithAPIVersion("scheduling.k8s.io/v1alpha2")
+	b.WithAPIVersion("scheduling.k8s.io/v1alpha3")
 	return b, nil
 }
 
@@ -87,13 +87,13 @@ func ExtractPodGroupFrom(podGroup *schedulingv1alpha2.PodGroup, fieldManager str
 // ExtractPodGroup provides a way to perform a extract/modify-in-place/apply workflow.
 // Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
 // applied if another fieldManager has updated or force applied any of the previously applied fields.
-func ExtractPodGroup(podGroup *schedulingv1alpha2.PodGroup, fieldManager string) (*PodGroupApplyConfiguration, error) {
+func ExtractPodGroup(podGroup *schedulingv1alpha3.PodGroup, fieldManager string) (*PodGroupApplyConfiguration, error) {
 	return ExtractPodGroupFrom(podGroup, fieldManager, "")
 }
 
 // ExtractPodGroupStatus extracts the applied configuration owned by fieldManager from
 // podGroup for the status subresource.
-func ExtractPodGroupStatus(podGroup *schedulingv1alpha2.PodGroup, fieldManager string) (*PodGroupApplyConfiguration, error) {
+func ExtractPodGroupStatus(podGroup *schedulingv1alpha3.PodGroup, fieldManager string) (*PodGroupApplyConfiguration, error) {
 	return ExtractPodGroupFrom(podGroup, fieldManager, "status")
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupresourceclaim.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupresourceclaim.go
similarity index 95%
rename from vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupresourceclaim.go
rename to vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupresourceclaim.go
index a7b21b530b..cb132a07d6 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupresourceclaim.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupresourceclaim.go
@@ -16,7 +16,7 @@ limitations under the License.
 
 // Code generated by applyconfiguration-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
 
 // PodGroupResourceClaimApplyConfiguration represents a declarative configuration of the PodGroupResourceClaim type for use
 // with apply.
@@ -30,17 +30,17 @@ package v1alpha2
 // own Spec.ResourceClaims. The Pod's claim must match all fields of the
 // PodGroup's claim exactly.
 type PodGroupResourceClaimApplyConfiguration struct {
-	// Name uniquely identifies this resource claim inside the PodGroup.
+	// name uniquely identifies this resource claim inside the PodGroup.
 	// This must be a DNS_LABEL.
 	Name *string `json:"name,omitempty"`
-	// ResourceClaimName is the name of a ResourceClaim object in the same
+	// resourceClaimName is the name of a ResourceClaim object in the same
 	// namespace as this PodGroup. The ResourceClaim will be reserved for the
 	// PodGroup instead of its individual pods.
 	//
 	// Exactly one of ResourceClaimName and ResourceClaimTemplateName must
 	// be set.
 	ResourceClaimName *string `json:"resourceClaimName,omitempty"`
-	// ResourceClaimTemplateName is the name of a ResourceClaimTemplate
+	// resourceClaimTemplateName is the name of a ResourceClaimTemplate
 	// object in the same namespace as this PodGroup.
 	//
 	// The template will be used to create a new ResourceClaim, which will
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupresourceclaimstatus.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupresourceclaimstatus.go
similarity index 94%
rename from vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupresourceclaimstatus.go
rename to vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupresourceclaimstatus.go
index 5f8498b13e..e3250d82d8 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupresourceclaimstatus.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupresourceclaimstatus.go
@@ -16,7 +16,7 @@ limitations under the License.
 
 // Code generated by applyconfiguration-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
 
 // PodGroupResourceClaimStatusApplyConfiguration represents a declarative configuration of the PodGroupResourceClaimStatus type for use
 // with apply.
@@ -25,11 +25,11 @@ package v1alpha2
 // PodGroupResourceClaim which references a ResourceClaimTemplate. It stores the
 // generated name for the corresponding ResourceClaim.
 type PodGroupResourceClaimStatusApplyConfiguration struct {
-	// Name uniquely identifies this resource claim inside the PodGroup. This
+	// name uniquely identifies this resource claim inside the PodGroup. This
 	// must match the name of an entry in podgroup.spec.resourceClaims, which
 	// implies that the string must be a DNS_LABEL.
 	Name *string `json:"name,omitempty"`
-	// ResourceClaimName is the name of the ResourceClaim that was generated for
+	// resourceClaimName is the name of the ResourceClaim that was generated for
 	// the PodGroup in the namespace of the PodGroup. If this is unset, then
 	// generating a ResourceClaim was not necessary. The
 	// podgroup.spec.resourceClaims entry can be ignored in this case.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupschedulingconstraints.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupschedulingconstraints.go
similarity index 96%
rename from vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupschedulingconstraints.go
rename to vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupschedulingconstraints.go
index eda72ea50e..5dadef14bf 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupschedulingconstraints.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupschedulingconstraints.go
@@ -16,14 +16,14 @@ limitations under the License.
 
 // Code generated by applyconfiguration-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
 
 // PodGroupSchedulingConstraintsApplyConfiguration represents a declarative configuration of the PodGroupSchedulingConstraints type for use
 // with apply.
 //
 // PodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a PodGroup.
 type PodGroupSchedulingConstraintsApplyConfiguration struct {
-	// Topology defines the topology constraints for the pod group.
+	// topology defines the topology constraints for the pod group.
 	// Currently only a single topology constraint can be specified. This may change in the future.
 	Topology []TopologyConstraintApplyConfiguration `json:"topology,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupschedulingpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupschedulingpolicy.go
similarity index 67%
rename from vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupschedulingpolicy.go
rename to vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupschedulingpolicy.go
index 02be5f27eb..67232d1925 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupschedulingpolicy.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupschedulingpolicy.go
@@ -16,23 +16,28 @@ limitations under the License.
 
 // Code generated by applyconfiguration-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
 
 import (
-	schedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
 )
 
 // PodGroupSchedulingPolicyApplyConfiguration represents a declarative configuration of the PodGroupSchedulingPolicy type for use
 // with apply.
 //
 // PodGroupSchedulingPolicy defines the scheduling configuration for a PodGroup.
-// Exactly one policy must be set.
+// Exactly one policy must be set. The policy is chosen at creation time by setting either the
+// Basic or Gang field. The PodGroup may not change policy after creation.
+// Fields within chosen policy may be updated after creation when their individual fields allow it.
 type PodGroupSchedulingPolicyApplyConfiguration struct {
-	// Basic specifies that the pods in this group should be scheduled using
-	// standard Kubernetes scheduling behavior.
-	Basic *schedulingv1alpha2.BasicSchedulingPolicy `json:"basic,omitempty"`
-	// Gang specifies that the pods in this group should be scheduled using
-	// all-or-nothing semantics.
+	// basic specifies that the pods in this group should be scheduled using
+	// standard Kubernetes scheduling behavior. Setting this field at group creation time
+	// opts this group to basic scheduling; this field cannot be changed afterward.
+	Basic *schedulingv1alpha3.BasicSchedulingPolicy `json:"basic,omitempty"`
+	// gang specifies that the pods in this group should be scheduled using
+	// all-or-nothing semantics. Setting this field at group creation time
+	// opts this group to gang scheduling; this field cannot be set or unset afterward.
+	// The minCount field within Gang scheduling policy remains mutable after group creation.
 	Gang *GangSchedulingPolicyApplyConfiguration `json:"gang,omitempty"`
 }
 
@@ -45,7 +50,7 @@ func PodGroupSchedulingPolicy() *PodGroupSchedulingPolicyApplyConfiguration {
 // WithBasic sets the Basic field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Basic field is set to the value of the last call.
-func (b *PodGroupSchedulingPolicyApplyConfiguration) WithBasic(value schedulingv1alpha2.BasicSchedulingPolicy) *PodGroupSchedulingPolicyApplyConfiguration {
+func (b *PodGroupSchedulingPolicyApplyConfiguration) WithBasic(value schedulingv1alpha3.BasicSchedulingPolicy) *PodGroupSchedulingPolicyApplyConfiguration {
 	b.Basic = &value
 	return b
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupspec.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupspec.go
new file mode 100644
index 0000000000..5ca2ee1aba
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupspec.go
@@ -0,0 +1,168 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
+)
+
+// PodGroupSpecApplyConfiguration represents a declarative configuration of the PodGroupSpec type for use
+// with apply.
+//
+// PodGroupSpec defines the desired state of a PodGroup.
+type PodGroupSpecApplyConfiguration struct {
+	// parentCompositePodGroupName contains the name of the parent composite pod group
+	// within the same namespace as this pod group.
+	// If it's nil, then this pod group is a root of a workload's hierarchy.
+	// This field is used only when the CompositePodGroup feature gate is enabled.
+	// This field is immutable.
+	ParentCompositePodGroupName *string `json:"parentCompositePodGroupName,omitempty"`
+	// workloadRef references an optional PodGroup template within the Workload
+	// object that was used to create the PodGroup.
+	// This field is immutable.
+	WorkloadRef *WorkloadReferenceApplyConfiguration `json:"workloadRef,omitempty"`
+	// schedulingPolicy defines the scheduling policy for this instance of the PodGroup.
+	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+	SchedulingPolicy *PodGroupSchedulingPolicyApplyConfiguration `json:"schedulingPolicy,omitempty"`
+	// schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroup.
+	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+	// This field is immutable.
+	// This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
+	SchedulingConstraints *PodGroupSchedulingConstraintsApplyConfiguration `json:"schedulingConstraints,omitempty"`
+	// resourceClaims defines which ResourceClaims may be shared among Pods in
+	// the group. Pods consume the devices allocated to a PodGroup's claim by
+	// defining a claim in its own Spec.ResourceClaims that matches the
+	// PodGroup's claim exactly. The claim must have the same name and refer to
+	// the same ResourceClaim or ResourceClaimTemplate.
+	//
+	// This is a beta-level field and requires that the
+	// DRAWorkloadResourceClaims feature gate is enabled.
+	//
+	// This field is immutable.
+	ResourceClaims []PodGroupResourceClaimApplyConfiguration `json:"resourceClaims,omitempty"`
+	// disruptionMode defines the mode in which a given PodGroup can be disrupted.
+	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+	// One of Single, All. Defaults to Single if unset.
+	// This field is immutable.
+	DisruptionMode *DisruptionModeApplyConfiguration `json:"disruptionMode,omitempty"`
+	// priorityClassName defines the priority that should be considered when scheduling this pod group.
+	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+	// Otherwise, it is validated and resolved similarly to the PriorityClassName on PodGroupTemplate
+	// (i.e. if no priority class is specified, admission control can set this to the global default
+	// priority class if it exists. Otherwise, the pod group's priority will be zero).
+	// This field is immutable.
+	PriorityClassName *string `json:"priorityClassName,omitempty"`
+	// priority is the value of priority of this pod group. Various system components
+	// use this field to find the priority of the pod group. When Priority Admission
+	// Controller is enabled, it prevents users from setting this field. The admission
+	// controller populates this field from PriorityClassName.
+	// The higher the value, the higher the priority.
+	// This field is immutable.
+	Priority *int32 `json:"priority,omitempty"`
+	// preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+	// One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset.
+	// When Priority Admission Controller is enabled, it populates this field from PriorityClassName,
+	// and defaults to PreemptLowerPriority if value is unset in PriorityClass.
+	// This field is immutable.
+	// This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+	PreemptionPolicy *schedulingv1alpha3.PreemptionPolicy `json:"preemptionPolicy,omitempty"`
+}
+
+// PodGroupSpecApplyConfiguration constructs a declarative configuration of the PodGroupSpec type for use with
+// apply.
+func PodGroupSpec() *PodGroupSpecApplyConfiguration {
+	return &PodGroupSpecApplyConfiguration{}
+}
+
+// WithParentCompositePodGroupName sets the ParentCompositePodGroupName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ParentCompositePodGroupName field is set to the value of the last call.
+func (b *PodGroupSpecApplyConfiguration) WithParentCompositePodGroupName(value string) *PodGroupSpecApplyConfiguration {
+	b.ParentCompositePodGroupName = &value
+	return b
+}
+
+// WithWorkloadRef sets the WorkloadRef field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the WorkloadRef field is set to the value of the last call.
+func (b *PodGroupSpecApplyConfiguration) WithWorkloadRef(value *WorkloadReferenceApplyConfiguration) *PodGroupSpecApplyConfiguration {
+	b.WorkloadRef = value
+	return b
+}
+
+// WithSchedulingPolicy sets the SchedulingPolicy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SchedulingPolicy field is set to the value of the last call.
+func (b *PodGroupSpecApplyConfiguration) WithSchedulingPolicy(value *PodGroupSchedulingPolicyApplyConfiguration) *PodGroupSpecApplyConfiguration {
+	b.SchedulingPolicy = value
+	return b
+}
+
+// WithSchedulingConstraints sets the SchedulingConstraints field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SchedulingConstraints field is set to the value of the last call.
+func (b *PodGroupSpecApplyConfiguration) WithSchedulingConstraints(value *PodGroupSchedulingConstraintsApplyConfiguration) *PodGroupSpecApplyConfiguration {
+	b.SchedulingConstraints = value
+	return b
+}
+
+// WithResourceClaims adds the given value to the ResourceClaims field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the ResourceClaims field.
+func (b *PodGroupSpecApplyConfiguration) WithResourceClaims(values ...*PodGroupResourceClaimApplyConfiguration) *PodGroupSpecApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithResourceClaims")
+		}
+		b.ResourceClaims = append(b.ResourceClaims, *values[i])
+	}
+	return b
+}
+
+// WithDisruptionMode sets the DisruptionMode field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DisruptionMode field is set to the value of the last call.
+func (b *PodGroupSpecApplyConfiguration) WithDisruptionMode(value *DisruptionModeApplyConfiguration) *PodGroupSpecApplyConfiguration {
+	b.DisruptionMode = value
+	return b
+}
+
+// WithPriorityClassName sets the PriorityClassName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PriorityClassName field is set to the value of the last call.
+func (b *PodGroupSpecApplyConfiguration) WithPriorityClassName(value string) *PodGroupSpecApplyConfiguration {
+	b.PriorityClassName = &value
+	return b
+}
+
+// WithPriority sets the Priority field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Priority field is set to the value of the last call.
+func (b *PodGroupSpecApplyConfiguration) WithPriority(value int32) *PodGroupSpecApplyConfiguration {
+	b.Priority = &value
+	return b
+}
+
+// WithPreemptionPolicy sets the PreemptionPolicy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PreemptionPolicy field is set to the value of the last call.
+func (b *PodGroupSpecApplyConfiguration) WithPreemptionPolicy(value schedulingv1alpha3.PreemptionPolicy) *PodGroupSpecApplyConfiguration {
+	b.PreemptionPolicy = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupstatus.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupstatus.go
new file mode 100644
index 0000000000..af0b5d31da
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgroupstatus.go
@@ -0,0 +1,83 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// PodGroupStatusApplyConfiguration represents a declarative configuration of the PodGroupStatus type for use
+// with apply.
+//
+// PodGroupStatus represents information about the status of a pod group.
+type PodGroupStatusApplyConfiguration struct {
+	// conditions represent the latest observations of the PodGroup's state.
+	//
+	// Known condition types:
+	// - "PodGroupInitiallyScheduled": Indicates whether the scheduling requirement has been satisfied.
+	// Once this condition transitions to True, it serves as a terminal state and will never revert to False,
+	// even if pods are subsequently evicted and group constraints are no longer met.
+	// - "DisruptionTarget": Indicates whether the PodGroup is about to be terminated
+	// due to disruption such as preemption.
+	//
+	// Known reasons for the PodGroupInitiallyScheduled condition:
+	// - "Unschedulable": The PodGroup cannot be scheduled due to resource constraints,
+	// affinity/anti-affinity rules, or insufficient capacity for the gang.
+	// - "SchedulerError": The PodGroup cannot be scheduled due to some internal error
+	// that happened during scheduling, for example due to nodeAffinity parsing errors.
+	//
+	// Known reasons for the DisruptionTarget condition:
+	// - "PreemptionByScheduler": The PodGroup was preempted by the scheduler to make room for
+	// higher-priority PodGroups or Pods.
+	Conditions []v1.ConditionApplyConfiguration `json:"conditions,omitempty"`
+	// resourceClaimStatuses is status of resource claims.
+	ResourceClaimStatuses []PodGroupResourceClaimStatusApplyConfiguration `json:"resourceClaimStatuses,omitempty"`
+}
+
+// PodGroupStatusApplyConfiguration constructs a declarative configuration of the PodGroupStatus type for use with
+// apply.
+func PodGroupStatus() *PodGroupStatusApplyConfiguration {
+	return &PodGroupStatusApplyConfiguration{}
+}
+
+// WithConditions adds the given value to the Conditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Conditions field.
+func (b *PodGroupStatusApplyConfiguration) WithConditions(values ...*v1.ConditionApplyConfiguration) *PodGroupStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithConditions")
+		}
+		b.Conditions = append(b.Conditions, *values[i])
+	}
+	return b
+}
+
+// WithResourceClaimStatuses adds the given value to the ResourceClaimStatuses field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the ResourceClaimStatuses field.
+func (b *PodGroupStatusApplyConfiguration) WithResourceClaimStatuses(values ...*PodGroupResourceClaimStatusApplyConfiguration) *PodGroupStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithResourceClaimStatuses")
+		}
+		b.ResourceClaimStatuses = append(b.ResourceClaimStatuses, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgrouptemplate.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgrouptemplate.go
new file mode 100644
index 0000000000..b004ac0b32
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/podgrouptemplate.go
@@ -0,0 +1,143 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
+)
+
+// PodGroupTemplateApplyConfiguration represents a declarative configuration of the PodGroupTemplate type for use
+// with apply.
+//
+// PodGroupTemplate represents a template for a set of pods with a scheduling policy.
+type PodGroupTemplateApplyConfiguration struct {
+	// name is a unique identifier for the PodGroupTemplate within the Workload.
+	// It must be a DNS label. This field is immutable.
+	Name *string `json:"name,omitempty"`
+	// schedulingPolicy defines the scheduling policy for this PodGroupTemplate.
+	SchedulingPolicy *PodGroupSchedulingPolicyApplyConfiguration `json:"schedulingPolicy,omitempty"`
+	// schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroupTemplate.
+	// This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
+	// This field is immutable.
+	SchedulingConstraints *PodGroupSchedulingConstraintsApplyConfiguration `json:"schedulingConstraints,omitempty"`
+	// resourceClaims defines which ResourceClaims may be shared among Pods in
+	// the group. Pods consume the devices allocated to a PodGroup's claim by
+	// defining a claim in its own Spec.ResourceClaims that matches the
+	// PodGroup's claim exactly. The claim must have the same name and refer to
+	// the same ResourceClaim or ResourceClaimTemplate.
+	//
+	// This is a beta-level field and requires that the
+	// DRAWorkloadResourceClaims feature gate is enabled.
+	//
+	// This field is immutable.
+	ResourceClaims []PodGroupResourceClaimApplyConfiguration `json:"resourceClaims,omitempty"`
+	// disruptionMode defines the mode in which a given PodGroup can be disrupted.
+	// One of Single, All.
+	// This field is immutable.
+	DisruptionMode *DisruptionModeApplyConfiguration `json:"disruptionMode,omitempty"`
+	// priorityClassName indicates the priority that should be considered when scheduling
+	// a pod group created from this template.
+	// This field is immutable.
+	PriorityClassName *string `json:"priorityClassName,omitempty"`
+	// priority is the value of priority of pod groups created from this template. Various
+	// system components use this field to find the priority of the pod group.
+	// The higher the value, the higher the priority.
+	// This field is immutable.
+	Priority *int32 `json:"priority,omitempty"`
+	// preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+	// One of Never, PreemptLowerPriority.
+	// This field is immutable.
+	// This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+	PreemptionPolicy *schedulingv1alpha3.PreemptionPolicy `json:"preemptionPolicy,omitempty"`
+}
+
+// PodGroupTemplateApplyConfiguration constructs a declarative configuration of the PodGroupTemplate type for use with
+// apply.
+func PodGroupTemplate() *PodGroupTemplateApplyConfiguration {
+	return &PodGroupTemplateApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *PodGroupTemplateApplyConfiguration) WithName(value string) *PodGroupTemplateApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithSchedulingPolicy sets the SchedulingPolicy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SchedulingPolicy field is set to the value of the last call.
+func (b *PodGroupTemplateApplyConfiguration) WithSchedulingPolicy(value *PodGroupSchedulingPolicyApplyConfiguration) *PodGroupTemplateApplyConfiguration {
+	b.SchedulingPolicy = value
+	return b
+}
+
+// WithSchedulingConstraints sets the SchedulingConstraints field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SchedulingConstraints field is set to the value of the last call.
+func (b *PodGroupTemplateApplyConfiguration) WithSchedulingConstraints(value *PodGroupSchedulingConstraintsApplyConfiguration) *PodGroupTemplateApplyConfiguration {
+	b.SchedulingConstraints = value
+	return b
+}
+
+// WithResourceClaims adds the given value to the ResourceClaims field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the ResourceClaims field.
+func (b *PodGroupTemplateApplyConfiguration) WithResourceClaims(values ...*PodGroupResourceClaimApplyConfiguration) *PodGroupTemplateApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithResourceClaims")
+		}
+		b.ResourceClaims = append(b.ResourceClaims, *values[i])
+	}
+	return b
+}
+
+// WithDisruptionMode sets the DisruptionMode field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DisruptionMode field is set to the value of the last call.
+func (b *PodGroupTemplateApplyConfiguration) WithDisruptionMode(value *DisruptionModeApplyConfiguration) *PodGroupTemplateApplyConfiguration {
+	b.DisruptionMode = value
+	return b
+}
+
+// WithPriorityClassName sets the PriorityClassName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PriorityClassName field is set to the value of the last call.
+func (b *PodGroupTemplateApplyConfiguration) WithPriorityClassName(value string) *PodGroupTemplateApplyConfiguration {
+	b.PriorityClassName = &value
+	return b
+}
+
+// WithPriority sets the Priority field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Priority field is set to the value of the last call.
+func (b *PodGroupTemplateApplyConfiguration) WithPriority(value int32) *PodGroupTemplateApplyConfiguration {
+	b.Priority = &value
+	return b
+}
+
+// WithPreemptionPolicy sets the PreemptionPolicy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PreemptionPolicy field is set to the value of the last call.
+func (b *PodGroupTemplateApplyConfiguration) WithPreemptionPolicy(value schedulingv1alpha3.PreemptionPolicy) *PodGroupTemplateApplyConfiguration {
+	b.PreemptionPolicy = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/topologyconstraint.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/topologyconstraint.go
similarity index 95%
rename from vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/topologyconstraint.go
rename to vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/topologyconstraint.go
index 92727eb2bb..b1c4f26389 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/topologyconstraint.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/topologyconstraint.go
@@ -16,14 +16,14 @@ limitations under the License.
 
 // Code generated by applyconfiguration-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
 
 // TopologyConstraintApplyConfiguration represents a declarative configuration of the TopologyConstraint type for use
 // with apply.
 //
 // TopologyConstraint defines a topology constraint for a PodGroup.
 type TopologyConstraintApplyConfiguration struct {
-	// Key specifies the key of the node label representing the topology domain.
+	// key specifies the key of the node label representing the topology domain.
 	// All pods within the PodGroup must be colocated within the same domain instance.
 	// Different PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.
 	// Examples: "topology.kubernetes.io/rack"
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/typedlocalobjectreference.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/typedlocalobjectreference.go
similarity index 94%
rename from vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/typedlocalobjectreference.go
rename to vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/typedlocalobjectreference.go
index cfbbc48e07..e8303eb66e 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/typedlocalobjectreference.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/typedlocalobjectreference.go
@@ -16,22 +16,22 @@ limitations under the License.
 
 // Code generated by applyconfiguration-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
 
 // TypedLocalObjectReferenceApplyConfiguration represents a declarative configuration of the TypedLocalObjectReference type for use
 // with apply.
 //
 // TypedLocalObjectReference allows to reference typed object inside the same namespace.
 type TypedLocalObjectReferenceApplyConfiguration struct {
-	// APIGroup is the group for the resource being referenced.
+	// apiGroup is the group for the resource being referenced.
 	// If APIGroup is empty, the specified Kind must be in the core API group.
 	// For any other third-party types, setting APIGroup is required.
 	// It must be a DNS subdomain.
 	APIGroup *string `json:"apiGroup,omitempty"`
-	// Kind is the type of resource being referenced.
+	// kind is the type of resource being referenced.
 	// It must be a path segment name.
 	Kind *string `json:"kind,omitempty"`
-	// Name is the name of resource being referenced.
+	// name is the name of resource being referenced.
 	// It must be a path segment name.
 	Name *string `json:"name,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/workload.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workload.go
similarity index 96%
rename from vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/workload.go
rename to vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workload.go
index 787095d238..6088ead036 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/workload.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workload.go
@@ -16,10 +16,10 @@ limitations under the License.
 
 // Code generated by applyconfiguration-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
 
 import (
-	schedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
@@ -35,11 +35,11 @@ import (
 // including scheduling, preemption, eviction and other phases.
 // Workload API enablement is toggled by the GenericWorkload feature gate.
 type WorkloadApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Spec defines the desired behavior of a Workload.
+	// spec defines the desired behavior of a Workload.
 	Spec *WorkloadSpecApplyConfiguration `json:"spec,omitempty"`
 }
 
@@ -50,7 +50,7 @@ func Workload(name, namespace string) *WorkloadApplyConfiguration {
 	b.WithName(name)
 	b.WithNamespace(namespace)
 	b.WithKind("Workload")
-	b.WithAPIVersion("scheduling.k8s.io/v1alpha2")
+	b.WithAPIVersion("scheduling.k8s.io/v1alpha3")
 	return b
 }
 
@@ -61,9 +61,9 @@ func Workload(name, namespace string) *WorkloadApplyConfiguration {
 // ExtractWorkloadFrom provides a way to perform a extract/modify-in-place/apply workflow.
 // Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
 // applied if another fieldManager has updated or force applied any of the previously applied fields.
-func ExtractWorkloadFrom(workload *schedulingv1alpha2.Workload, fieldManager string, subresource string) (*WorkloadApplyConfiguration, error) {
+func ExtractWorkloadFrom(workload *schedulingv1alpha3.Workload, fieldManager string, subresource string) (*WorkloadApplyConfiguration, error) {
 	b := &WorkloadApplyConfiguration{}
-	err := managedfields.ExtractInto(workload, internal.Parser().Type("io.k8s.api.scheduling.v1alpha2.Workload"), fieldManager, b, subresource)
+	err := managedfields.ExtractInto(workload, internal.Parser().Type("io.k8s.api.scheduling.v1alpha3.Workload"), fieldManager, b, subresource)
 	if err != nil {
 		return nil, err
 	}
@@ -71,7 +71,7 @@ func ExtractWorkloadFrom(workload *schedulingv1alpha2.Workload, fieldManager str
 	b.WithNamespace(workload.Namespace)
 
 	b.WithKind("Workload")
-	b.WithAPIVersion("scheduling.k8s.io/v1alpha2")
+	b.WithAPIVersion("scheduling.k8s.io/v1alpha3")
 	return b, nil
 }
 
@@ -85,7 +85,7 @@ func ExtractWorkloadFrom(workload *schedulingv1alpha2.Workload, fieldManager str
 // ExtractWorkload provides a way to perform a extract/modify-in-place/apply workflow.
 // Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
 // applied if another fieldManager has updated or force applied any of the previously applied fields.
-func ExtractWorkload(workload *schedulingv1alpha2.Workload, fieldManager string) (*WorkloadApplyConfiguration, error) {
+func ExtractWorkload(workload *schedulingv1alpha3.Workload, fieldManager string) (*WorkloadApplyConfiguration, error) {
 	return ExtractWorkloadFrom(workload, fieldManager, "")
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadpodgroupdisruptionmode.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadpodgroupdisruptionmode.go
new file mode 100644
index 0000000000..4a524de531
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadpodgroupdisruptionmode.go
@@ -0,0 +1,78 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
+)
+
+// WorkloadPodGroupDisruptionModeApplyConfiguration represents a declarative configuration of the WorkloadPodGroupDisruptionMode type for use
+// with apply.
+//
+// WorkloadPodGroupDisruptionMode defines how individual pods within a
+// group can be disrupted. Exactly one mode must be set.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a controller's own
+// API, next to its other scheduling fields (for example, in a Job's
+// spec.scheduling). It's recommended to freeze the field after creation
+// (+k8s:immutable), since the selected mode is immutable in the compiled
+// Workload. For example,
+//
+// type JobSchedulingConfiguration struct {
+// // DisruptionMode defines the mode in which the Job's pods can be disrupted.
+// // One of Single, All.
+// // This field is immutable after creation: it may not be added or removed,
+// // and the selected mode may not be changed.
+// // +optional
+// // +k8s:optional
+// // +k8s:immutable
+// DisruptionMode *schedulingv1alpha3.WorkloadPodGroupDisruptionMode `json:"disruptionMode,omitempty" protobuf:"bytes,N,opt,name=disruptionMode"`
+//
+// // other scheduling fields
+// }
+type WorkloadPodGroupDisruptionModeApplyConfiguration struct {
+	// single specifies that pods can be disrupted independently from each other.
+	Single *schedulingv1alpha3.WorkloadPodGroupSingleDisruptionMode `json:"single,omitempty"`
+	// all specifies that all pods in the group must be disrupted together.
+	All *schedulingv1alpha3.WorkloadPodGroupAllDisruptionMode `json:"all,omitempty"`
+}
+
+// WorkloadPodGroupDisruptionModeApplyConfiguration constructs a declarative configuration of the WorkloadPodGroupDisruptionMode type for use with
+// apply.
+func WorkloadPodGroupDisruptionMode() *WorkloadPodGroupDisruptionModeApplyConfiguration {
+	return &WorkloadPodGroupDisruptionModeApplyConfiguration{}
+}
+
+// WithSingle sets the Single field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Single field is set to the value of the last call.
+func (b *WorkloadPodGroupDisruptionModeApplyConfiguration) WithSingle(value schedulingv1alpha3.WorkloadPodGroupSingleDisruptionMode) *WorkloadPodGroupDisruptionModeApplyConfiguration {
+	b.Single = &value
+	return b
+}
+
+// WithAll sets the All field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the All field is set to the value of the last call.
+func (b *WorkloadPodGroupDisruptionModeApplyConfiguration) WithAll(value schedulingv1alpha3.WorkloadPodGroupAllDisruptionMode) *WorkloadPodGroupDisruptionModeApplyConfiguration {
+	b.All = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadpodgroupgangschedulingpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadpodgroupgangschedulingpolicy.go
new file mode 100644
index 0000000000..4464dfc2a5
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadpodgroupgangschedulingpolicy.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+// WorkloadPodGroupGangSchedulingPolicyApplyConfiguration represents a declarative configuration of the WorkloadPodGroupGangSchedulingPolicy type for use
+// with apply.
+//
+// WorkloadPodGroupGangSchedulingPolicy defines the parameters for gang
+// (all-or-nothing) scheduling.
+type WorkloadPodGroupGangSchedulingPolicyApplyConfiguration struct {
+	// minCount is the minimum number of pods that must be scheduled
+	// at the same time for the scheduler to admit the entire group.
+	// This field is optional. If it is not specified, the controller
+	// should inject a context-specific sane default (e.g.,
+	// parallelism for a Job).
+	// If set, it must be a positive integer.
+	MinCount *int32 `json:"minCount,omitempty"`
+}
+
+// WorkloadPodGroupGangSchedulingPolicyApplyConfiguration constructs a declarative configuration of the WorkloadPodGroupGangSchedulingPolicy type for use with
+// apply.
+func WorkloadPodGroupGangSchedulingPolicy() *WorkloadPodGroupGangSchedulingPolicyApplyConfiguration {
+	return &WorkloadPodGroupGangSchedulingPolicyApplyConfiguration{}
+}
+
+// WithMinCount sets the MinCount field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MinCount field is set to the value of the last call.
+func (b *WorkloadPodGroupGangSchedulingPolicyApplyConfiguration) WithMinCount(value int32) *WorkloadPodGroupGangSchedulingPolicyApplyConfiguration {
+	b.MinCount = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadpodgroupresourceclaim.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadpodgroupresourceclaim.go
new file mode 100644
index 0000000000..a34c5a2e55
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadpodgroupresourceclaim.go
@@ -0,0 +1,98 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+// WorkloadPodGroupResourceClaimApplyConfiguration represents a declarative configuration of the WorkloadPodGroupResourceClaim type for use
+// with apply.
+//
+// WorkloadPodGroupResourceClaim references a dynamic resource claim
+// that is shared across pods in the group.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a controller's own
+// API as a list, next to its other scheduling fields (for example, in a Job's
+// spec.scheduling). It's recommended to freeze the whole list after creation
+// (+k8s:immutable), since the list is immutable in the compiled Workload. For
+// example,
+//
+// type JobSchedulingConfiguration struct {
+// // ResourceClaims lists the ResourceClaims shared among the group's pods.
+// // At most 4 claims may be set, matching the limit on the resulting PodGroup.
+// // This list is immutable after creation: entries may neither be added,
+// // removed, nor modified.
+// // +optional
+// // +patchMergeKey=name
+// // +patchStrategy=merge
+// // +listType=map
+// // +listMapKey=name
+// // +k8s:optional
+// // +k8s:listType=map
+// // +k8s:listMapKey=name
+// // +k8s:maxItems=4
+// // +k8s:immutable
+// ResourceClaims []schedulingv1alpha3.WorkloadPodGroupResourceClaim `json:"resourceClaims,omitempty" protobuf:"bytes,N,rep,name=resourceClaims"`
+//
+// // other scheduling fields
+// }
+type WorkloadPodGroupResourceClaimApplyConfiguration struct {
+	// name uniquely identifies this resource claim inside the group.
+	// This field is required. It must be a DNS_LABEL.
+	Name *string `json:"name,omitempty"`
+	// resourceClaimName is the name of a ResourceClaim object in the same
+	// namespace.
+	// This field is optional. If it is not specified, no resource claim
+	// is used. If set, it must be a DNS subdomain.
+	ResourceClaimName *string `json:"resourceClaimName,omitempty"`
+	// resourceClaimTemplateName is the name of a ResourceClaimTemplate
+	// object in the same namespace.
+	// This field is optional. If it is not specified, no resource claim
+	// template is used. If set, it must be a DNS subdomain.
+	ResourceClaimTemplateName *string `json:"resourceClaimTemplateName,omitempty"`
+}
+
+// WorkloadPodGroupResourceClaimApplyConfiguration constructs a declarative configuration of the WorkloadPodGroupResourceClaim type for use with
+// apply.
+func WorkloadPodGroupResourceClaim() *WorkloadPodGroupResourceClaimApplyConfiguration {
+	return &WorkloadPodGroupResourceClaimApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *WorkloadPodGroupResourceClaimApplyConfiguration) WithName(value string) *WorkloadPodGroupResourceClaimApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithResourceClaimName sets the ResourceClaimName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceClaimName field is set to the value of the last call.
+func (b *WorkloadPodGroupResourceClaimApplyConfiguration) WithResourceClaimName(value string) *WorkloadPodGroupResourceClaimApplyConfiguration {
+	b.ResourceClaimName = &value
+	return b
+}
+
+// WithResourceClaimTemplateName sets the ResourceClaimTemplateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceClaimTemplateName field is set to the value of the last call.
+func (b *WorkloadPodGroupResourceClaimApplyConfiguration) WithResourceClaimTemplateName(value string) *WorkloadPodGroupResourceClaimApplyConfiguration {
+	b.ResourceClaimTemplateName = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadpodgroupschedulingconstraints.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadpodgroupschedulingconstraints.go
new file mode 100644
index 0000000000..1721ca6cbf
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadpodgroupschedulingconstraints.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+// WorkloadPodGroupSchedulingConstraintsApplyConfiguration represents a declarative configuration of the WorkloadPodGroupSchedulingConstraints type for use
+// with apply.
+//
+// WorkloadPodGroupSchedulingConstraints defines leaf-level scheduling
+// constraints, such as topology.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a controller's own
+// API, next to its other scheduling fields (for example, in a Job's
+// spec.scheduling). It's recommended to freeze the field after creation
+// (+k8s:immutable), since constraints are immutable in the compiled Workload.
+// For example,
+//
+// type JobSchedulingConfiguration struct {
+// // SchedulingConstraints defines scheduling constraints (e.g. topology)
+// // for the Job's pods.
+// // This field is immutable after creation.
+// // +optional
+// // +k8s:optional
+// // +k8s:immutable
+// SchedulingConstraints *schedulingv1alpha3.WorkloadPodGroupSchedulingConstraints `json:"schedulingConstraints,omitempty" protobuf:"bytes,N,opt,name=schedulingConstraints"`
+//
+// // other scheduling fields
+// }
+type WorkloadPodGroupSchedulingConstraintsApplyConfiguration struct {
+	// topology specifies desired topological placements for all pods
+	// within the pod group.
+	// If unset, no topology placement is requested.
+	Topology []TopologyConstraintApplyConfiguration `json:"topology,omitempty"`
+}
+
+// WorkloadPodGroupSchedulingConstraintsApplyConfiguration constructs a declarative configuration of the WorkloadPodGroupSchedulingConstraints type for use with
+// apply.
+func WorkloadPodGroupSchedulingConstraints() *WorkloadPodGroupSchedulingConstraintsApplyConfiguration {
+	return &WorkloadPodGroupSchedulingConstraintsApplyConfiguration{}
+}
+
+// WithTopology adds the given value to the Topology field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Topology field.
+func (b *WorkloadPodGroupSchedulingConstraintsApplyConfiguration) WithTopology(values ...*TopologyConstraintApplyConfiguration) *WorkloadPodGroupSchedulingConstraintsApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithTopology")
+		}
+		b.Topology = append(b.Topology, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadpodgroupschedulingpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadpodgroupschedulingpolicy.go
new file mode 100644
index 0000000000..13a1249d88
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadpodgroupschedulingpolicy.go
@@ -0,0 +1,84 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
+)
+
+// WorkloadPodGroupSchedulingPolicyApplyConfiguration represents a declarative configuration of the WorkloadPodGroupSchedulingPolicy type for use
+// with apply.
+//
+// WorkloadPodGroupSchedulingPolicy defines the scheduling policy for a
+// group of pods managed by a workload controller.
+// Exactly one policy must be set.
+//
+// ---
+//
+// This is a reusable building block meant to be embedded in a controller's own
+// API, next to its other scheduling fields (for example, in a Job's
+// spec.scheduling). It's recommended to block changing the policy
+// after creation, while still allowing gang.minCount to change. DV cannot
+// express that only gang.minCount is mutable while the basic/gang variant is
+// frozen, so the embedder must enforce variant immutability with hand-written
+// validation. For example,
+//
+// type JobSchedulingConfiguration struct {
+// // SchedulingPolicy defines the scheduling policy for this Job.
+// // Exactly one of Basic or Gang must be set.
+// // This field is immutable after creation: the policy may not be added or
+// // removed. The policy variant (basic/gang) is frozen by the controller's
+// // hand-written validation; only schedulingPolicy.gang.minCount may be changed.
+// // +optional
+// // +k8s:optional
+// // +k8s:update=NoSet
+// // +k8s:update=NoUnset
+// SchedulingPolicy *schedulingv1alpha3.WorkloadPodGroupSchedulingPolicy `json:"schedulingPolicy,omitempty" protobuf:"bytes,N,opt,name=schedulingPolicy"`
+//
+// // other scheduling fields
+// }
+type WorkloadPodGroupSchedulingPolicyApplyConfiguration struct {
+	// basic specifies that standard, pod-by-pod Kubernetes scheduling
+	// behavior should be used.
+	Basic *schedulingv1alpha3.WorkloadPodGroupBasicSchedulingPolicy `json:"basic,omitempty"`
+	// gang specifies all-or-nothing scheduling semantics.
+	Gang *WorkloadPodGroupGangSchedulingPolicyApplyConfiguration `json:"gang,omitempty"`
+}
+
+// WorkloadPodGroupSchedulingPolicyApplyConfiguration constructs a declarative configuration of the WorkloadPodGroupSchedulingPolicy type for use with
+// apply.
+func WorkloadPodGroupSchedulingPolicy() *WorkloadPodGroupSchedulingPolicyApplyConfiguration {
+	return &WorkloadPodGroupSchedulingPolicyApplyConfiguration{}
+}
+
+// WithBasic sets the Basic field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Basic field is set to the value of the last call.
+func (b *WorkloadPodGroupSchedulingPolicyApplyConfiguration) WithBasic(value schedulingv1alpha3.WorkloadPodGroupBasicSchedulingPolicy) *WorkloadPodGroupSchedulingPolicyApplyConfiguration {
+	b.Basic = &value
+	return b
+}
+
+// WithGang sets the Gang field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Gang field is set to the value of the last call.
+func (b *WorkloadPodGroupSchedulingPolicyApplyConfiguration) WithGang(value *WorkloadPodGroupGangSchedulingPolicyApplyConfiguration) *WorkloadPodGroupSchedulingPolicyApplyConfiguration {
+	b.Gang = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadreference.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadreference.go
new file mode 100644
index 0000000000..e7dd7c7c5e
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadreference.go
@@ -0,0 +1,58 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+// WorkloadReferenceApplyConfiguration represents a declarative configuration of the WorkloadReference type for use
+// with apply.
+//
+// WorkloadReference references the Workload object together with the template
+// that was used to create a particular PodGroup.
+type WorkloadReferenceApplyConfiguration struct {
+	// workloadName is the name of the Workload object that contains a template
+	// that was used when creating a pod group. It must
+	// be a DNS name.
+	// This field is required.
+	WorkloadName *string `json:"workloadName,omitempty"`
+	// templateName is the name of a template within the Workload object that
+	// was used to create a pod group. It must be a DNS label.
+	// This field is required.
+	TemplateName *string `json:"templateName,omitempty"`
+}
+
+// WorkloadReferenceApplyConfiguration constructs a declarative configuration of the WorkloadReference type for use with
+// apply.
+func WorkloadReference() *WorkloadReferenceApplyConfiguration {
+	return &WorkloadReferenceApplyConfiguration{}
+}
+
+// WithWorkloadName sets the WorkloadName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the WorkloadName field is set to the value of the last call.
+func (b *WorkloadReferenceApplyConfiguration) WithWorkloadName(value string) *WorkloadReferenceApplyConfiguration {
+	b.WorkloadName = &value
+	return b
+}
+
+// WithTemplateName sets the TemplateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the TemplateName field is set to the value of the last call.
+func (b *WorkloadReferenceApplyConfiguration) WithTemplateName(value string) *WorkloadReferenceApplyConfiguration {
+	b.TemplateName = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadspec.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadspec.go
new file mode 100644
index 0000000000..475b998745
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha3/workloadspec.go
@@ -0,0 +1,82 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha3
+
+// WorkloadSpecApplyConfiguration represents a declarative configuration of the WorkloadSpec type for use
+// with apply.
+//
+// WorkloadSpec defines the desired state of a Workload.
+type WorkloadSpecApplyConfiguration struct {
+	// controllerRef is an optional reference to the controlling object, such as a
+	// Deployment or Job. This field is intended for use by tools like CLIs
+	// to provide a link back to the original workload definition.
+	// This field is immutable.
+	ControllerRef *TypedLocalObjectReferenceApplyConfiguration `json:"controllerRef,omitempty"`
+	// podGroupTemplates is the list of templates that make up the Workload.
+	// The maximum number of templates is 8. Templates cannot be added or removed after the workload is created.
+	// Existing templates may still be updated where their individual fields allow it.
+	// Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.
+	PodGroupTemplates []PodGroupTemplateApplyConfiguration `json:"podGroupTemplates,omitempty"`
+	// compositePodGroupTemplates is the list of CompositePodGroup templates that make up the Workload.
+	// The maximum number of templates is 8. This field is immutable.
+	// Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.
+	//
+	// This field is used only when the CompositePodGroup feature gate is enabled.
+	CompositePodGroupTemplates []CompositePodGroupTemplateApplyConfiguration `json:"compositePodGroupTemplates,omitempty"`
+}
+
+// WorkloadSpecApplyConfiguration constructs a declarative configuration of the WorkloadSpec type for use with
+// apply.
+func WorkloadSpec() *WorkloadSpecApplyConfiguration {
+	return &WorkloadSpecApplyConfiguration{}
+}
+
+// WithControllerRef sets the ControllerRef field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ControllerRef field is set to the value of the last call.
+func (b *WorkloadSpecApplyConfiguration) WithControllerRef(value *TypedLocalObjectReferenceApplyConfiguration) *WorkloadSpecApplyConfiguration {
+	b.ControllerRef = value
+	return b
+}
+
+// WithPodGroupTemplates adds the given value to the PodGroupTemplates field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the PodGroupTemplates field.
+func (b *WorkloadSpecApplyConfiguration) WithPodGroupTemplates(values ...*PodGroupTemplateApplyConfiguration) *WorkloadSpecApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithPodGroupTemplates")
+		}
+		b.PodGroupTemplates = append(b.PodGroupTemplates, *values[i])
+	}
+	return b
+}
+
+// WithCompositePodGroupTemplates adds the given value to the CompositePodGroupTemplates field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the CompositePodGroupTemplates field.
+func (b *WorkloadSpecApplyConfiguration) WithCompositePodGroupTemplates(values ...*CompositePodGroupTemplateApplyConfiguration) *WorkloadSpecApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithCompositePodGroupTemplates")
+		}
+		b.CompositePodGroupTemplates = append(b.CompositePodGroupTemplates, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/compositedisruptionmode.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/compositedisruptionmode.go
new file mode 100644
index 0000000000..40f9a62984
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/compositedisruptionmode.go
@@ -0,0 +1,57 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+)
+
+// CompositeDisruptionModeApplyConfiguration represents a declarative configuration of the CompositeDisruptionMode type for use
+// with apply.
+//
+// CompositeDisruptionMode defines how individual entities within a composite pod group can be disrupted.
+// Exactly one mode must be set.
+type CompositeDisruptionModeApplyConfiguration struct {
+	// single specifies that children groups can be disrupted independently from each other.
+	Single *schedulingv1beta1.SingleCompositeDisruptionMode `json:"single,omitempty"`
+	// all specifies that all children groups can only be disrupted together.
+	All *schedulingv1beta1.AllCompositeDisruptionMode `json:"all,omitempty"`
+}
+
+// CompositeDisruptionModeApplyConfiguration constructs a declarative configuration of the CompositeDisruptionMode type for use with
+// apply.
+func CompositeDisruptionMode() *CompositeDisruptionModeApplyConfiguration {
+	return &CompositeDisruptionModeApplyConfiguration{}
+}
+
+// WithSingle sets the Single field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Single field is set to the value of the last call.
+func (b *CompositeDisruptionModeApplyConfiguration) WithSingle(value schedulingv1beta1.SingleCompositeDisruptionMode) *CompositeDisruptionModeApplyConfiguration {
+	b.Single = &value
+	return b
+}
+
+// WithAll sets the All field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the All field is set to the value of the last call.
+func (b *CompositeDisruptionModeApplyConfiguration) WithAll(value schedulingv1beta1.AllCompositeDisruptionMode) *CompositeDisruptionModeApplyConfiguration {
+	b.All = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/compositegangschedulingpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/compositegangschedulingpolicy.go
new file mode 100644
index 0000000000..fc007af154
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/compositegangschedulingpolicy.go
@@ -0,0 +1,45 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+// CompositeGangSchedulingPolicyApplyConfiguration represents a declarative configuration of the CompositeGangSchedulingPolicy type for use
+// with apply.
+//
+// CompositeGangSchedulingPolicy indicates that the groups belonging to the composite group
+// should be scheduled using all-or-nothing semantics.
+type CompositeGangSchedulingPolicyApplyConfiguration struct {
+	// minGroupCount is the minimum number of child groups that must be schedulable
+	// or scheduled at the same time for the scheduler to admit the entire group.
+	// It must be a positive integer.
+	MinGroupCount *int32 `json:"minGroupCount,omitempty"`
+}
+
+// CompositeGangSchedulingPolicyApplyConfiguration constructs a declarative configuration of the CompositeGangSchedulingPolicy type for use with
+// apply.
+func CompositeGangSchedulingPolicy() *CompositeGangSchedulingPolicyApplyConfiguration {
+	return &CompositeGangSchedulingPolicyApplyConfiguration{}
+}
+
+// WithMinGroupCount sets the MinGroupCount field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the MinGroupCount field is set to the value of the last call.
+func (b *CompositeGangSchedulingPolicyApplyConfiguration) WithMinGroupCount(value int32) *CompositeGangSchedulingPolicyApplyConfiguration {
+	b.MinGroupCount = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/compositepodgroupschedulingconstraints.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/compositepodgroupschedulingconstraints.go
new file mode 100644
index 0000000000..56361230cd
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/compositepodgroupschedulingconstraints.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+// CompositePodGroupSchedulingConstraintsApplyConfiguration represents a declarative configuration of the CompositePodGroupSchedulingConstraints type for use
+// with apply.
+//
+// CompositePodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a CompositePodGroup.
+type CompositePodGroupSchedulingConstraintsApplyConfiguration struct {
+	// topology defines the topology constraints for the composite pod group.
+	// Currently only a single topology constraint can be specified. This may change in the future.
+	Topology []TopologyConstraintApplyConfiguration `json:"topology,omitempty"`
+}
+
+// CompositePodGroupSchedulingConstraintsApplyConfiguration constructs a declarative configuration of the CompositePodGroupSchedulingConstraints type for use with
+// apply.
+func CompositePodGroupSchedulingConstraints() *CompositePodGroupSchedulingConstraintsApplyConfiguration {
+	return &CompositePodGroupSchedulingConstraintsApplyConfiguration{}
+}
+
+// WithTopology adds the given value to the Topology field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Topology field.
+func (b *CompositePodGroupSchedulingConstraintsApplyConfiguration) WithTopology(values ...*TopologyConstraintApplyConfiguration) *CompositePodGroupSchedulingConstraintsApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithTopology")
+		}
+		b.Topology = append(b.Topology, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/compositepodgroupschedulingpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/compositepodgroupschedulingpolicy.go
new file mode 100644
index 0000000000..8c8905d77d
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/compositepodgroupschedulingpolicy.go
@@ -0,0 +1,59 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+)
+
+// CompositePodGroupSchedulingPolicyApplyConfiguration represents a declarative configuration of the CompositePodGroupSchedulingPolicy type for use
+// with apply.
+//
+// CompositePodGroupSchedulingPolicy defines the scheduling configuration for a CompositePodGroup.
+// Exactly one policy must be set.
+type CompositePodGroupSchedulingPolicyApplyConfiguration struct {
+	// basic specifies that the groups of this composite group should be scheduled independently.
+	// This field is immutable.
+	Basic *schedulingv1beta1.CompositeBasicSchedulingPolicy `json:"basic,omitempty"`
+	// gang specifies that the groups of this composite group should be scheduled using
+	// all-or-nothing semantics.
+	Gang *CompositeGangSchedulingPolicyApplyConfiguration `json:"gang,omitempty"`
+}
+
+// CompositePodGroupSchedulingPolicyApplyConfiguration constructs a declarative configuration of the CompositePodGroupSchedulingPolicy type for use with
+// apply.
+func CompositePodGroupSchedulingPolicy() *CompositePodGroupSchedulingPolicyApplyConfiguration {
+	return &CompositePodGroupSchedulingPolicyApplyConfiguration{}
+}
+
+// WithBasic sets the Basic field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Basic field is set to the value of the last call.
+func (b *CompositePodGroupSchedulingPolicyApplyConfiguration) WithBasic(value schedulingv1beta1.CompositeBasicSchedulingPolicy) *CompositePodGroupSchedulingPolicyApplyConfiguration {
+	b.Basic = &value
+	return b
+}
+
+// WithGang sets the Gang field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Gang field is set to the value of the last call.
+func (b *CompositePodGroupSchedulingPolicyApplyConfiguration) WithGang(value *CompositeGangSchedulingPolicyApplyConfiguration) *CompositePodGroupSchedulingPolicyApplyConfiguration {
+	b.Gang = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/compositepodgrouptemplate.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/compositepodgrouptemplate.go
new file mode 100644
index 0000000000..511b4cca54
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/compositepodgrouptemplate.go
@@ -0,0 +1,157 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+)
+
+// CompositePodGroupTemplateApplyConfiguration represents a declarative configuration of the CompositePodGroupTemplate type for use
+// with apply.
+//
+// CompositePodGroupTemplate represents a template for a CompositePodGroup with a scheduling policy.
+type CompositePodGroupTemplateApplyConfiguration struct {
+	// name is a unique identifier for the CompositePodGroupTemplate within the Workload.
+	// It must be a DNS label. This field is required.
+	Name *string `json:"name,omitempty"`
+	// schedulingPolicy defines the scheduling policy for this template.
+	SchedulingPolicy *CompositePodGroupSchedulingPolicyApplyConfiguration `json:"schedulingPolicy,omitempty"`
+	// schedulingConstraints defines optional scheduling constraints (e.g. topology) for this CompositePodGroupTemplate.
+	// This field is immutable.
+	SchedulingConstraints *CompositePodGroupSchedulingConstraintsApplyConfiguration `json:"schedulingConstraints,omitempty"`
+	// disruptionMode defines the mode in which a given CompositePodGroup can be disrupted.
+	// One of Single, All.
+	// This field is immutable.
+	DisruptionMode *CompositeDisruptionModeApplyConfiguration `json:"disruptionMode,omitempty"`
+	// priorityClassName indicates the priority that should be considered when scheduling
+	// a composite pod group created from this template. If no priority class is specified,
+	// admission control can set this to the global default priority class if it exists.
+	// Otherwise, composite pod groups created from this template will have the priority set
+	// to zero.
+	// This field is immutable.
+	PriorityClassName *string `json:"priorityClassName,omitempty"`
+	// priority is the value of priority of composite pod groups created from this template.
+	// Various system components use this field to find the priority of the composite pod group.
+	// When Priority Admission Controller is enabled, it prevents users from setting this field.
+	// The admission controller populates this field from PriorityClassName.
+	// The higher the value, the higher the priority.
+	// This field is immutable.
+	Priority *int32 `json:"priority,omitempty"`
+	// preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+	// One of Never, PreemptLowerPriority.
+	// This field is immutable.
+	// This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+	PreemptionPolicy *schedulingv1beta1.PreemptionPolicy `json:"preemptionPolicy,omitempty"`
+	// podGroupTemplates is the list of templates for children PodGroups.
+	// The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates
+	// or PodGroupTemplates must be set.
+	PodGroupTemplates []PodGroupTemplateApplyConfiguration `json:"podGroupTemplates,omitempty"`
+	// compositePodGroupTemplates is the list of templates for children CompositePodGroups.
+	// The maximum number of templates is 8. At least one entry in CompositePodGroupTemplates
+	// or PodGroupTemplates must be set.
+	CompositePodGroupTemplates []CompositePodGroupTemplateApplyConfiguration `json:"compositePodGroupTemplates,omitempty"`
+}
+
+// CompositePodGroupTemplateApplyConfiguration constructs a declarative configuration of the CompositePodGroupTemplate type for use with
+// apply.
+func CompositePodGroupTemplate() *CompositePodGroupTemplateApplyConfiguration {
+	return &CompositePodGroupTemplateApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithName(value string) *CompositePodGroupTemplateApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithSchedulingPolicy sets the SchedulingPolicy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SchedulingPolicy field is set to the value of the last call.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithSchedulingPolicy(value *CompositePodGroupSchedulingPolicyApplyConfiguration) *CompositePodGroupTemplateApplyConfiguration {
+	b.SchedulingPolicy = value
+	return b
+}
+
+// WithSchedulingConstraints sets the SchedulingConstraints field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SchedulingConstraints field is set to the value of the last call.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithSchedulingConstraints(value *CompositePodGroupSchedulingConstraintsApplyConfiguration) *CompositePodGroupTemplateApplyConfiguration {
+	b.SchedulingConstraints = value
+	return b
+}
+
+// WithDisruptionMode sets the DisruptionMode field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DisruptionMode field is set to the value of the last call.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithDisruptionMode(value *CompositeDisruptionModeApplyConfiguration) *CompositePodGroupTemplateApplyConfiguration {
+	b.DisruptionMode = value
+	return b
+}
+
+// WithPriorityClassName sets the PriorityClassName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PriorityClassName field is set to the value of the last call.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithPriorityClassName(value string) *CompositePodGroupTemplateApplyConfiguration {
+	b.PriorityClassName = &value
+	return b
+}
+
+// WithPriority sets the Priority field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Priority field is set to the value of the last call.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithPriority(value int32) *CompositePodGroupTemplateApplyConfiguration {
+	b.Priority = &value
+	return b
+}
+
+// WithPreemptionPolicy sets the PreemptionPolicy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PreemptionPolicy field is set to the value of the last call.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithPreemptionPolicy(value schedulingv1beta1.PreemptionPolicy) *CompositePodGroupTemplateApplyConfiguration {
+	b.PreemptionPolicy = &value
+	return b
+}
+
+// WithPodGroupTemplates adds the given value to the PodGroupTemplates field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the PodGroupTemplates field.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithPodGroupTemplates(values ...*PodGroupTemplateApplyConfiguration) *CompositePodGroupTemplateApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithPodGroupTemplates")
+		}
+		b.PodGroupTemplates = append(b.PodGroupTemplates, *values[i])
+	}
+	return b
+}
+
+// WithCompositePodGroupTemplates adds the given value to the CompositePodGroupTemplates field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the CompositePodGroupTemplates field.
+func (b *CompositePodGroupTemplateApplyConfiguration) WithCompositePodGroupTemplates(values ...*CompositePodGroupTemplateApplyConfiguration) *CompositePodGroupTemplateApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithCompositePodGroupTemplates")
+		}
+		b.CompositePodGroupTemplates = append(b.CompositePodGroupTemplates, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/disruptionmode.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/disruptionmode.go
new file mode 100644
index 0000000000..de1d2c8d3b
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/disruptionmode.go
@@ -0,0 +1,57 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+)
+
+// DisruptionModeApplyConfiguration represents a declarative configuration of the DisruptionMode type for use
+// with apply.
+//
+// DisruptionMode defines how individual entities within a group can be disrupted.
+// Exactly one mode can be set.
+type DisruptionModeApplyConfiguration struct {
+	// single specifies that children can be disrupted independently from each other.
+	Single *schedulingv1beta1.SingleDisruptionMode `json:"single,omitempty"`
+	// all specifies that all children can only be disrupted together.
+	All *schedulingv1beta1.AllDisruptionMode `json:"all,omitempty"`
+}
+
+// DisruptionModeApplyConfiguration constructs a declarative configuration of the DisruptionMode type for use with
+// apply.
+func DisruptionMode() *DisruptionModeApplyConfiguration {
+	return &DisruptionModeApplyConfiguration{}
+}
+
+// WithSingle sets the Single field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Single field is set to the value of the last call.
+func (b *DisruptionModeApplyConfiguration) WithSingle(value schedulingv1beta1.SingleDisruptionMode) *DisruptionModeApplyConfiguration {
+	b.Single = &value
+	return b
+}
+
+// WithAll sets the All field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the All field is set to the value of the last call.
+func (b *DisruptionModeApplyConfiguration) WithAll(value schedulingv1beta1.AllDisruptionMode) *DisruptionModeApplyConfiguration {
+	b.All = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/gangschedulingpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/gangschedulingpolicy.go
similarity index 71%
rename from vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/gangschedulingpolicy.go
rename to vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/gangschedulingpolicy.go
index 987a89013b..0c6d1a4d3e 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/gangschedulingpolicy.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/gangschedulingpolicy.go
@@ -16,16 +16,24 @@ limitations under the License.
 
 // Code generated by applyconfiguration-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1beta1
 
 // GangSchedulingPolicyApplyConfiguration represents a declarative configuration of the GangSchedulingPolicy type for use
 // with apply.
 //
 // GangSchedulingPolicy defines the parameters for gang scheduling.
 type GangSchedulingPolicyApplyConfiguration struct {
-	// MinCount is the minimum number of pods that must be schedulable or scheduled
+	// minCount is the minimum number of pods that must be schedulable or scheduled
 	// at the same time for the scheduler to admit the entire group.
-	// It must be a positive integer.
+	// It must be a positive integer. This field is mutable to support workload scaling.
+	//
+	// Note that the scheduler operates on an eventually consistent model. Updates
+	// to minCount may not be immediately reflected in scheduling decisions due to
+	// propagation delays. If minCount is updated while a scheduling cycle is in
+	// progress for that group, the new value may not take effect until the next
+	// cycle. Moreover, minCount is only enforced during scheduling, meaning that
+	// modifications to this field do not affect already-scheduled pods, applying
+	// only to those evaluated in future cycles.
 	MinCount *int32 `json:"minCount,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroup.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroup.go
new file mode 100644
index 0000000000..0bdbc2d4e9
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroup.go
@@ -0,0 +1,296 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	internal "k8s.io/client-go/applyconfigurations/internal"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// PodGroupApplyConfiguration represents a declarative configuration of the PodGroup type for use
+// with apply.
+//
+// PodGroup represents a runtime instance of pods grouped together.
+// PodGroups are created by workload controllers (Job, LWS, JobSet, etc...) from
+// Workload.podGroupTemplates.
+// PodGroup API enablement is toggled by the GenericWorkload feature gate.
+type PodGroupApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	// spec defines the desired state of the PodGroup.
+	Spec *PodGroupSpecApplyConfiguration `json:"spec,omitempty"`
+	// status represents the current observed state of the PodGroup.
+	Status *PodGroupStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// PodGroup constructs a declarative configuration of the PodGroup type for use with
+// apply.
+func PodGroup(name, namespace string) *PodGroupApplyConfiguration {
+	b := &PodGroupApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("PodGroup")
+	b.WithAPIVersion("scheduling.k8s.io/v1beta1")
+	return b
+}
+
+// ExtractPodGroupFrom extracts the applied configuration owned by fieldManager from
+// podGroup for the specified subresource. Pass an empty string for subresource to extract
+// the main resource. Common subresources include "status", "scale", etc.
+// podGroup must be a unmodified PodGroup API object that was retrieved from the Kubernetes API.
+// ExtractPodGroupFrom provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractPodGroupFrom(podGroup *schedulingv1beta1.PodGroup, fieldManager string, subresource string) (*PodGroupApplyConfiguration, error) {
+	b := &PodGroupApplyConfiguration{}
+	err := managedfields.ExtractInto(podGroup, internal.Parser().Type("io.k8s.api.scheduling.v1beta1.PodGroup"), fieldManager, b, subresource)
+	if err != nil {
+		return nil, err
+	}
+	b.WithName(podGroup.Name)
+	b.WithNamespace(podGroup.Namespace)
+
+	b.WithKind("PodGroup")
+	b.WithAPIVersion("scheduling.k8s.io/v1beta1")
+	return b, nil
+}
+
+// ExtractPodGroup extracts the applied configuration owned by fieldManager from
+// podGroup. If no managedFields are found in podGroup for fieldManager, a
+// PodGroupApplyConfiguration is returned with only the Name, Namespace (if applicable),
+// APIVersion and Kind populated. It is possible that no managed fields were found for because other
+// field managers have taken ownership of all the fields previously owned by fieldManager, or because
+// the fieldManager never owned fields any fields.
+// podGroup must be a unmodified PodGroup API object that was retrieved from the Kubernetes API.
+// ExtractPodGroup provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractPodGroup(podGroup *schedulingv1beta1.PodGroup, fieldManager string) (*PodGroupApplyConfiguration, error) {
+	return ExtractPodGroupFrom(podGroup, fieldManager, "")
+}
+
+// ExtractPodGroupStatus extracts the applied configuration owned by fieldManager from
+// podGroup for the status subresource.
+func ExtractPodGroupStatus(podGroup *schedulingv1beta1.PodGroup, fieldManager string) (*PodGroupApplyConfiguration, error) {
+	return ExtractPodGroupFrom(podGroup, fieldManager, "status")
+}
+
+func (b PodGroupApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *PodGroupApplyConfiguration) WithKind(value string) *PodGroupApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *PodGroupApplyConfiguration) WithAPIVersion(value string) *PodGroupApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *PodGroupApplyConfiguration) WithName(value string) *PodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *PodGroupApplyConfiguration) WithGenerateName(value string) *PodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *PodGroupApplyConfiguration) WithNamespace(value string) *PodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *PodGroupApplyConfiguration) WithUID(value types.UID) *PodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *PodGroupApplyConfiguration) WithResourceVersion(value string) *PodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *PodGroupApplyConfiguration) WithGeneration(value int64) *PodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *PodGroupApplyConfiguration) WithCreationTimestamp(value metav1.Time) *PodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *PodGroupApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *PodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *PodGroupApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *PodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *PodGroupApplyConfiguration) WithLabels(entries map[string]string) *PodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *PodGroupApplyConfiguration) WithAnnotations(entries map[string]string) *PodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *PodGroupApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *PodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *PodGroupApplyConfiguration) WithFinalizers(values ...string) *PodGroupApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *PodGroupApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *PodGroupApplyConfiguration) WithSpec(value *PodGroupSpecApplyConfiguration) *PodGroupApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *PodGroupApplyConfiguration) WithStatus(value *PodGroupStatusApplyConfiguration) *PodGroupApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *PodGroupApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *PodGroupApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *PodGroupApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *PodGroupApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupresourceclaim.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupresourceclaim.go
new file mode 100644
index 0000000000..6b4de69ffe
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupresourceclaim.go
@@ -0,0 +1,89 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+// PodGroupResourceClaimApplyConfiguration represents a declarative configuration of the PodGroupResourceClaim type for use
+// with apply.
+//
+// PodGroupResourceClaim references exactly one ResourceClaim, either directly
+// or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim
+// for the PodGroup.
+//
+// It adds a name to it that uniquely identifies the ResourceClaim inside the PodGroup.
+// Pods that need access to the ResourceClaim define a matching reference in its
+// own Spec.ResourceClaims. The Pod's claim must match all fields of the
+// PodGroup's claim exactly.
+type PodGroupResourceClaimApplyConfiguration struct {
+	// name uniquely identifies this resource claim inside the PodGroup.
+	// This must be a DNS_LABEL.
+	Name *string `json:"name,omitempty"`
+	// resourceClaimName is the name of a ResourceClaim object in the same
+	// namespace as this PodGroup. The ResourceClaim will be reserved for the
+	// PodGroup instead of its individual pods.
+	//
+	// Exactly one of ResourceClaimName and ResourceClaimTemplateName must
+	// be set.
+	ResourceClaimName *string `json:"resourceClaimName,omitempty"`
+	// resourceClaimTemplateName is the name of a ResourceClaimTemplate
+	// object in the same namespace as this PodGroup.
+	//
+	// The template will be used to create a new ResourceClaim, which will
+	// be bound to this PodGroup. When this PodGroup is deleted, the ResourceClaim
+	// will also be deleted. The PodGroup name and resource name, along with a
+	// generated component, will be used to form a unique name for the
+	// ResourceClaim, which will be recorded in podgroup.status.resourceClaimStatuses.
+	//
+	// This field is immutable and no changes will be made to the
+	// corresponding ResourceClaim by the control plane after creating the
+	// ResourceClaim.
+	//
+	// Exactly one of ResourceClaimName and ResourceClaimTemplateName must
+	// be set.
+	ResourceClaimTemplateName *string `json:"resourceClaimTemplateName,omitempty"`
+}
+
+// PodGroupResourceClaimApplyConfiguration constructs a declarative configuration of the PodGroupResourceClaim type for use with
+// apply.
+func PodGroupResourceClaim() *PodGroupResourceClaimApplyConfiguration {
+	return &PodGroupResourceClaimApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *PodGroupResourceClaimApplyConfiguration) WithName(value string) *PodGroupResourceClaimApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithResourceClaimName sets the ResourceClaimName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceClaimName field is set to the value of the last call.
+func (b *PodGroupResourceClaimApplyConfiguration) WithResourceClaimName(value string) *PodGroupResourceClaimApplyConfiguration {
+	b.ResourceClaimName = &value
+	return b
+}
+
+// WithResourceClaimTemplateName sets the ResourceClaimTemplateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceClaimTemplateName field is set to the value of the last call.
+func (b *PodGroupResourceClaimApplyConfiguration) WithResourceClaimTemplateName(value string) *PodGroupResourceClaimApplyConfiguration {
+	b.ResourceClaimTemplateName = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupresourceclaimstatus.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupresourceclaimstatus.go
new file mode 100644
index 0000000000..4b41f4e5f8
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupresourceclaimstatus.go
@@ -0,0 +1,59 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+// PodGroupResourceClaimStatusApplyConfiguration represents a declarative configuration of the PodGroupResourceClaimStatus type for use
+// with apply.
+//
+// PodGroupResourceClaimStatus is stored in the PodGroupStatus for each
+// PodGroupResourceClaim which references a ResourceClaimTemplate. It stores the
+// generated name for the corresponding ResourceClaim.
+type PodGroupResourceClaimStatusApplyConfiguration struct {
+	// name uniquely identifies this resource claim inside the PodGroup. This
+	// must match the name of an entry in podgroup.spec.resourceClaims, which
+	// implies that the string must be a DNS_LABEL.
+	Name *string `json:"name,omitempty"`
+	// resourceClaimName is the name of the ResourceClaim that was generated for
+	// the PodGroup in the namespace of the PodGroup. If this is unset, then
+	// generating a ResourceClaim was not necessary. The
+	// podgroup.spec.resourceClaims entry can be ignored in this case.
+	ResourceClaimName *string `json:"resourceClaimName,omitempty"`
+}
+
+// PodGroupResourceClaimStatusApplyConfiguration constructs a declarative configuration of the PodGroupResourceClaimStatus type for use with
+// apply.
+func PodGroupResourceClaimStatus() *PodGroupResourceClaimStatusApplyConfiguration {
+	return &PodGroupResourceClaimStatusApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *PodGroupResourceClaimStatusApplyConfiguration) WithName(value string) *PodGroupResourceClaimStatusApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithResourceClaimName sets the ResourceClaimName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceClaimName field is set to the value of the last call.
+func (b *PodGroupResourceClaimStatusApplyConfiguration) WithResourceClaimName(value string) *PodGroupResourceClaimStatusApplyConfiguration {
+	b.ResourceClaimName = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupschedulingconstraints.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupschedulingconstraints.go
new file mode 100644
index 0000000000..11a0ec79b7
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupschedulingconstraints.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+// PodGroupSchedulingConstraintsApplyConfiguration represents a declarative configuration of the PodGroupSchedulingConstraints type for use
+// with apply.
+//
+// PodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a PodGroup.
+type PodGroupSchedulingConstraintsApplyConfiguration struct {
+	// topology defines the topology constraints for the pod group.
+	// Currently only a single topology constraint can be specified. This may change in the future.
+	Topology []TopologyConstraintApplyConfiguration `json:"topology,omitempty"`
+}
+
+// PodGroupSchedulingConstraintsApplyConfiguration constructs a declarative configuration of the PodGroupSchedulingConstraints type for use with
+// apply.
+func PodGroupSchedulingConstraints() *PodGroupSchedulingConstraintsApplyConfiguration {
+	return &PodGroupSchedulingConstraintsApplyConfiguration{}
+}
+
+// WithTopology adds the given value to the Topology field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Topology field.
+func (b *PodGroupSchedulingConstraintsApplyConfiguration) WithTopology(values ...*TopologyConstraintApplyConfiguration) *PodGroupSchedulingConstraintsApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithTopology")
+		}
+		b.Topology = append(b.Topology, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupschedulingpolicy.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupschedulingpolicy.go
new file mode 100644
index 0000000000..9cd2d05ab8
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupschedulingpolicy.go
@@ -0,0 +1,64 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+)
+
+// PodGroupSchedulingPolicyApplyConfiguration represents a declarative configuration of the PodGroupSchedulingPolicy type for use
+// with apply.
+//
+// PodGroupSchedulingPolicy defines the scheduling configuration for a PodGroup.
+// Exactly one policy must be set. The policy is chosen at creation time by setting either the
+// Basic or Gang field. The PodGroup may not change policy after creation.
+// Fields within chosen policy may be updated after creation when their individual fields allow it.
+type PodGroupSchedulingPolicyApplyConfiguration struct {
+	// basic specifies that the pods in this group should be scheduled using
+	// standard Kubernetes scheduling behavior. Setting this field at group creation time
+	// opts this group to basic scheduling; this field cannot be changed afterward.
+	Basic *schedulingv1beta1.BasicSchedulingPolicy `json:"basic,omitempty"`
+	// gang specifies that the pods in this group should be scheduled using
+	// all-or-nothing semantics. Setting this field at group creation time
+	// opts this group to gang scheduling; this field cannot be set or unset afterward.
+	// The minCount field within Gang scheduling policy remains mutable after group creation.
+	Gang *GangSchedulingPolicyApplyConfiguration `json:"gang,omitempty"`
+}
+
+// PodGroupSchedulingPolicyApplyConfiguration constructs a declarative configuration of the PodGroupSchedulingPolicy type for use with
+// apply.
+func PodGroupSchedulingPolicy() *PodGroupSchedulingPolicyApplyConfiguration {
+	return &PodGroupSchedulingPolicyApplyConfiguration{}
+}
+
+// WithBasic sets the Basic field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Basic field is set to the value of the last call.
+func (b *PodGroupSchedulingPolicyApplyConfiguration) WithBasic(value schedulingv1beta1.BasicSchedulingPolicy) *PodGroupSchedulingPolicyApplyConfiguration {
+	b.Basic = &value
+	return b
+}
+
+// WithGang sets the Gang field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Gang field is set to the value of the last call.
+func (b *PodGroupSchedulingPolicyApplyConfiguration) WithGang(value *GangSchedulingPolicyApplyConfiguration) *PodGroupSchedulingPolicyApplyConfiguration {
+	b.Gang = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupspec.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupspec.go
similarity index 65%
rename from vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupspec.go
rename to vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupspec.go
index 76538c6221..fb40a2f150 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupspec.go
@@ -16,10 +16,10 @@ limitations under the License.
 
 // Code generated by applyconfiguration-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1beta1
 
 import (
-	schedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
+	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
 )
 
 // PodGroupSpecApplyConfiguration represents a declarative configuration of the PodGroupSpec type for use
@@ -27,54 +27,61 @@ import (
 //
 // PodGroupSpec defines the desired state of a PodGroup.
 type PodGroupSpecApplyConfiguration struct {
-	// PodGroupTemplateRef references an optional PodGroup template within other object
-	// (e.g. Workload) that was used to create the PodGroup. This field is immutable.
-	PodGroupTemplateRef *PodGroupTemplateReferenceApplyConfiguration `json:"podGroupTemplateRef,omitempty"`
-	// SchedulingPolicy defines the scheduling policy for this instance of the PodGroup.
-	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
+	// parentCompositePodGroupName contains the name of the parent composite pod group
+	// within the same namespace as this pod group.
+	// If it's nil, then this pod group is a root of a workload's hierarchy.
+	// This field is used only when the CompositePodGroup feature gate is enabled.
+	// This field is immutable.
+	ParentCompositePodGroupName *string `json:"parentCompositePodGroupName,omitempty"`
+	// workloadRef references an optional PodGroup template within the Workload
+	// object that was used to create the PodGroup.
 	// This field is immutable.
+	WorkloadRef *WorkloadReferenceApplyConfiguration `json:"workloadRef,omitempty"`
+	// schedulingPolicy defines the scheduling policy for this instance of the PodGroup.
+	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
 	SchedulingPolicy *PodGroupSchedulingPolicyApplyConfiguration `json:"schedulingPolicy,omitempty"`
-	// SchedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroup.
+	// schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroup.
 	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
 	// This field is immutable.
 	// This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
 	SchedulingConstraints *PodGroupSchedulingConstraintsApplyConfiguration `json:"schedulingConstraints,omitempty"`
-	// ResourceClaims defines which ResourceClaims may be shared among Pods in
+	// resourceClaims defines which ResourceClaims may be shared among Pods in
 	// the group. Pods consume the devices allocated to a PodGroup's claim by
 	// defining a claim in its own Spec.ResourceClaims that matches the
 	// PodGroup's claim exactly. The claim must have the same name and refer to
 	// the same ResourceClaim or ResourceClaimTemplate.
 	//
-	// This is an alpha-level field and requires that the
+	// This is a beta-level field and requires that the
 	// DRAWorkloadResourceClaims feature gate is enabled.
 	//
 	// This field is immutable.
 	ResourceClaims []PodGroupResourceClaimApplyConfiguration `json:"resourceClaims,omitempty"`
-	// DisruptionMode defines the mode in which a given PodGroup can be disrupted.
+	// disruptionMode defines the mode in which a given PodGroup can be disrupted.
 	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
-	// One of Pod, PodGroup. Defaults to Pod if unset.
+	// One of Single, All. Defaults to Single if unset.
 	// This field is immutable.
-	// This field is available only when the WorkloadAwarePreemption feature gate
-	// is enabled.
-	DisruptionMode *schedulingv1alpha2.DisruptionMode `json:"disruptionMode,omitempty"`
-	// PriorityClassName defines the priority that should be considered when scheduling this pod group.
+	DisruptionMode *DisruptionModeApplyConfiguration `json:"disruptionMode,omitempty"`
+	// priorityClassName defines the priority that should be considered when scheduling this pod group.
 	// Controllers are expected to fill this field by copying it from a PodGroupTemplate.
 	// Otherwise, it is validated and resolved similarly to the PriorityClassName on PodGroupTemplate
 	// (i.e. if no priority class is specified, admission control can set this to the global default
 	// priority class if it exists. Otherwise, the pod group's priority will be zero).
 	// This field is immutable.
-	// This field is available only when the WorkloadAwarePreemption feature gate
-	// is enabled.
 	PriorityClassName *string `json:"priorityClassName,omitempty"`
-	// Priority is the value of priority of this pod group. Various system components
+	// priority is the value of priority of this pod group. Various system components
 	// use this field to find the priority of the pod group. When Priority Admission
 	// Controller is enabled, it prevents users from setting this field. The admission
 	// controller populates this field from PriorityClassName.
 	// The higher the value, the higher the priority.
 	// This field is immutable.
-	// This field is available only when the WorkloadAwarePreemption feature gate
-	// is enabled.
 	Priority *int32 `json:"priority,omitempty"`
+	// preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+	// One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset.
+	// When Priority Admission Controller is enabled, it populates this field from PriorityClassName,
+	// and defaults to PreemptLowerPriority if value is unset in PriorityClass.
+	// This field is immutable.
+	// This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+	PreemptionPolicy *schedulingv1beta1.PreemptionPolicy `json:"preemptionPolicy,omitempty"`
 }
 
 // PodGroupSpecApplyConfiguration constructs a declarative configuration of the PodGroupSpec type for use with
@@ -83,11 +90,19 @@ func PodGroupSpec() *PodGroupSpecApplyConfiguration {
 	return &PodGroupSpecApplyConfiguration{}
 }
 
-// WithPodGroupTemplateRef sets the PodGroupTemplateRef field in the declarative configuration to the given value
+// WithParentCompositePodGroupName sets the ParentCompositePodGroupName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ParentCompositePodGroupName field is set to the value of the last call.
+func (b *PodGroupSpecApplyConfiguration) WithParentCompositePodGroupName(value string) *PodGroupSpecApplyConfiguration {
+	b.ParentCompositePodGroupName = &value
+	return b
+}
+
+// WithWorkloadRef sets the WorkloadRef field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the PodGroupTemplateRef field is set to the value of the last call.
-func (b *PodGroupSpecApplyConfiguration) WithPodGroupTemplateRef(value *PodGroupTemplateReferenceApplyConfiguration) *PodGroupSpecApplyConfiguration {
-	b.PodGroupTemplateRef = value
+// If called multiple times, the WorkloadRef field is set to the value of the last call.
+func (b *PodGroupSpecApplyConfiguration) WithWorkloadRef(value *WorkloadReferenceApplyConfiguration) *PodGroupSpecApplyConfiguration {
+	b.WorkloadRef = value
 	return b
 }
 
@@ -123,8 +138,8 @@ func (b *PodGroupSpecApplyConfiguration) WithResourceClaims(values ...*PodGroupR
 // WithDisruptionMode sets the DisruptionMode field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the DisruptionMode field is set to the value of the last call.
-func (b *PodGroupSpecApplyConfiguration) WithDisruptionMode(value schedulingv1alpha2.DisruptionMode) *PodGroupSpecApplyConfiguration {
-	b.DisruptionMode = &value
+func (b *PodGroupSpecApplyConfiguration) WithDisruptionMode(value *DisruptionModeApplyConfiguration) *PodGroupSpecApplyConfiguration {
+	b.DisruptionMode = value
 	return b
 }
 
@@ -143,3 +158,11 @@ func (b *PodGroupSpecApplyConfiguration) WithPriority(value int32) *PodGroupSpec
 	b.Priority = &value
 	return b
 }
+
+// WithPreemptionPolicy sets the PreemptionPolicy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PreemptionPolicy field is set to the value of the last call.
+func (b *PodGroupSpecApplyConfiguration) WithPreemptionPolicy(value schedulingv1beta1.PreemptionPolicy) *PodGroupSpecApplyConfiguration {
+	b.PreemptionPolicy = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupstatus.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupstatus.go
similarity index 87%
rename from vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupstatus.go
rename to vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupstatus.go
index c8c4b30da9..f52dd7cd2b 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgroupstatus.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgroupstatus.go
@@ -16,7 +16,7 @@ limitations under the License.
 
 // Code generated by applyconfiguration-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1beta1
 
 import (
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
@@ -27,14 +27,16 @@ import (
 //
 // PodGroupStatus represents information about the status of a pod group.
 type PodGroupStatusApplyConfiguration struct {
-	// Conditions represent the latest observations of the PodGroup's state.
+	// conditions represent the latest observations of the PodGroup's state.
 	//
 	// Known condition types:
-	// - "PodGroupScheduled": Indicates whether the scheduling requirement has been satisfied.
+	// - "PodGroupInitiallyScheduled": Indicates whether the scheduling requirement has been satisfied.
+	// Once this condition transitions to True, it serves as a terminal state and will never revert to False,
+	// even if pods are subsequently evicted and group constraints are no longer met.
 	// - "DisruptionTarget": Indicates whether the PodGroup is about to be terminated
 	// due to disruption such as preemption.
 	//
-	// Known reasons for the PodGroupScheduled condition:
+	// Known reasons for the PodGroupInitiallyScheduled condition:
 	// - "Unschedulable": The PodGroup cannot be scheduled due to resource constraints,
 	// affinity/anti-affinity rules, or insufficient capacity for the gang.
 	// - "SchedulerError": The PodGroup cannot be scheduled due to some internal error
@@ -44,7 +46,7 @@ type PodGroupStatusApplyConfiguration struct {
 	// - "PreemptionByScheduler": The PodGroup was preempted by the scheduler to make room for
 	// higher-priority PodGroups or Pods.
 	Conditions []v1.ConditionApplyConfiguration `json:"conditions,omitempty"`
-	// Status of resource claims.
+	// resourceClaimStatuses is status of resource claims.
 	ResourceClaimStatuses []PodGroupResourceClaimStatusApplyConfiguration `json:"resourceClaimStatuses,omitempty"`
 }
 
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgrouptemplate.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgrouptemplate.go
similarity index 76%
rename from vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgrouptemplate.go
rename to vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgrouptemplate.go
index 695caf2997..e53e7d41cd 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/podgrouptemplate.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/podgrouptemplate.go
@@ -16,10 +16,10 @@ limitations under the License.
 
 // Code generated by applyconfiguration-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1beta1
 
 import (
-	schedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
+	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
 )
 
 // PodGroupTemplateApplyConfiguration represents a declarative configuration of the PodGroupTemplate type for use
@@ -27,45 +27,44 @@ import (
 //
 // PodGroupTemplate represents a template for a set of pods with a scheduling policy.
 type PodGroupTemplateApplyConfiguration struct {
-	// Name is a unique identifier for the PodGroupTemplate within the Workload.
+	// name is a unique identifier for the PodGroupTemplate within the Workload.
 	// It must be a DNS label. This field is immutable.
 	Name *string `json:"name,omitempty"`
-	// SchedulingPolicy defines the scheduling policy for this PodGroupTemplate.
+	// schedulingPolicy defines the scheduling policy for this PodGroupTemplate.
 	SchedulingPolicy *PodGroupSchedulingPolicyApplyConfiguration `json:"schedulingPolicy,omitempty"`
-	// SchedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroupTemplate.
+	// schedulingConstraints defines optional scheduling constraints (e.g. topology) for this PodGroupTemplate.
 	// This field is only available when the TopologyAwareWorkloadScheduling feature gate is enabled.
+	// This field is immutable.
 	SchedulingConstraints *PodGroupSchedulingConstraintsApplyConfiguration `json:"schedulingConstraints,omitempty"`
-	// ResourceClaims defines which ResourceClaims may be shared among Pods in
+	// resourceClaims defines which ResourceClaims may be shared among Pods in
 	// the group. Pods consume the devices allocated to a PodGroup's claim by
 	// defining a claim in its own Spec.ResourceClaims that matches the
 	// PodGroup's claim exactly. The claim must have the same name and refer to
 	// the same ResourceClaim or ResourceClaimTemplate.
 	//
-	// This is an alpha-level field and requires that the
+	// This is a beta-level field and requires that the
 	// DRAWorkloadResourceClaims feature gate is enabled.
 	//
 	// This field is immutable.
 	ResourceClaims []PodGroupResourceClaimApplyConfiguration `json:"resourceClaims,omitempty"`
-	// DisruptionMode defines the mode in which a given PodGroup can be disrupted.
-	// One of Pod, PodGroup.
-	// This field is available only when the WorkloadAwarePreemption feature gate
-	// is enabled.
-	DisruptionMode *schedulingv1alpha2.DisruptionMode `json:"disruptionMode,omitempty"`
-	// PriorityClassName indicates the priority that should be considered when scheduling
-	// a pod group created from this template. If no priority class is specified, admission
-	// control can set this to the global default priority class if it exists. Otherwise,
-	// pod groups created from this template will have the priority set to zero.
-	// This field is available only when the WorkloadAwarePreemption feature gate
-	// is enabled.
+	// disruptionMode defines the mode in which a given PodGroup can be disrupted.
+	// One of Single, All.
+	// This field is immutable.
+	DisruptionMode *DisruptionModeApplyConfiguration `json:"disruptionMode,omitempty"`
+	// priorityClassName indicates the priority that should be considered when scheduling
+	// a pod group created from this template.
+	// This field is immutable.
 	PriorityClassName *string `json:"priorityClassName,omitempty"`
-	// Priority is the value of priority of pod groups created from this template. Various
-	// system components use this field to find the priority of the pod group. When
-	// Priority Admission Controller is enabled, it prevents users from setting this field.
-	// The admission controller populates this field from PriorityClassName.
+	// priority is the value of priority of pod groups created from this template. Various
+	// system components use this field to find the priority of the pod group.
 	// The higher the value, the higher the priority.
-	// This field is available only when the WorkloadAwarePreemption feature gate
-	// is enabled.
+	// This field is immutable.
 	Priority *int32 `json:"priority,omitempty"`
+	// preemptionPolicy is the Policy for preempting pods/podgroups with lower priority.
+	// One of Never, PreemptLowerPriority.
+	// This field is immutable.
+	// This field is available only when the PodGroupPreemptionPolicy feature gate is enabled.
+	PreemptionPolicy *schedulingv1beta1.PreemptionPolicy `json:"preemptionPolicy,omitempty"`
 }
 
 // PodGroupTemplateApplyConfiguration constructs a declarative configuration of the PodGroupTemplate type for use with
@@ -114,8 +113,8 @@ func (b *PodGroupTemplateApplyConfiguration) WithResourceClaims(values ...*PodGr
 // WithDisruptionMode sets the DisruptionMode field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the DisruptionMode field is set to the value of the last call.
-func (b *PodGroupTemplateApplyConfiguration) WithDisruptionMode(value schedulingv1alpha2.DisruptionMode) *PodGroupTemplateApplyConfiguration {
-	b.DisruptionMode = &value
+func (b *PodGroupTemplateApplyConfiguration) WithDisruptionMode(value *DisruptionModeApplyConfiguration) *PodGroupTemplateApplyConfiguration {
+	b.DisruptionMode = value
 	return b
 }
 
@@ -134,3 +133,11 @@ func (b *PodGroupTemplateApplyConfiguration) WithPriority(value int32) *PodGroup
 	b.Priority = &value
 	return b
 }
+
+// WithPreemptionPolicy sets the PreemptionPolicy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the PreemptionPolicy field is set to the value of the last call.
+func (b *PodGroupTemplateApplyConfiguration) WithPreemptionPolicy(value schedulingv1beta1.PreemptionPolicy) *PodGroupTemplateApplyConfiguration {
+	b.PreemptionPolicy = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/priorityclass.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/priorityclass.go
index 5fab5624ec..3c918fe901 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/priorityclass.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/priorityclass.go
@@ -35,8 +35,8 @@ import (
 // PriorityClass defines mapping from a priority class name to the priority
 // integer value. The value can be any valid integer.
 type PriorityClassApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// value represents the integer value of this priority class. This is the actual priority that pods
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/topologyconstraint.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/topologyconstraint.go
new file mode 100644
index 0000000000..52bd8a77b5
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/topologyconstraint.go
@@ -0,0 +1,45 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+// TopologyConstraintApplyConfiguration represents a declarative configuration of the TopologyConstraint type for use
+// with apply.
+//
+// TopologyConstraint defines a topology constraint for a PodGroup.
+type TopologyConstraintApplyConfiguration struct {
+	// key specifies the key of the node label representing the topology domain.
+	// All pods within the PodGroup must be colocated within the same domain instance.
+	// Different PodGroups can land on different domain instances even if they derive from the same PodGroupTemplate.
+	// Examples: "topology.kubernetes.io/rack"
+	Key *string `json:"key,omitempty"`
+}
+
+// TopologyConstraintApplyConfiguration constructs a declarative configuration of the TopologyConstraint type for use with
+// apply.
+func TopologyConstraint() *TopologyConstraintApplyConfiguration {
+	return &TopologyConstraintApplyConfiguration{}
+}
+
+// WithKey sets the Key field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Key field is set to the value of the last call.
+func (b *TopologyConstraintApplyConfiguration) WithKey(value string) *TopologyConstraintApplyConfiguration {
+	b.Key = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/typedlocalobjectreference.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/typedlocalobjectreference.go
new file mode 100644
index 0000000000..4eb57815f0
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/typedlocalobjectreference.go
@@ -0,0 +1,67 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+// TypedLocalObjectReferenceApplyConfiguration represents a declarative configuration of the TypedLocalObjectReference type for use
+// with apply.
+//
+// TypedLocalObjectReference allows to reference typed object inside the same namespace.
+type TypedLocalObjectReferenceApplyConfiguration struct {
+	// apiGroup is the group for the resource being referenced.
+	// If apiGroup is empty, the specified Kind must be in the core API group.
+	// For any other third-party types, setting apiGroup is required.
+	// It must be a DNS subdomain.
+	APIGroup *string `json:"apiGroup,omitempty"`
+	// kind is the type of resource being referenced.
+	// It must be a path segment name.
+	Kind *string `json:"kind,omitempty"`
+	// name is the name of resource being referenced.
+	// It must be a path segment name.
+	Name *string `json:"name,omitempty"`
+}
+
+// TypedLocalObjectReferenceApplyConfiguration constructs a declarative configuration of the TypedLocalObjectReference type for use with
+// apply.
+func TypedLocalObjectReference() *TypedLocalObjectReferenceApplyConfiguration {
+	return &TypedLocalObjectReferenceApplyConfiguration{}
+}
+
+// WithAPIGroup sets the APIGroup field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIGroup field is set to the value of the last call.
+func (b *TypedLocalObjectReferenceApplyConfiguration) WithAPIGroup(value string) *TypedLocalObjectReferenceApplyConfiguration {
+	b.APIGroup = &value
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *TypedLocalObjectReferenceApplyConfiguration) WithKind(value string) *TypedLocalObjectReferenceApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *TypedLocalObjectReferenceApplyConfiguration) WithName(value string) *TypedLocalObjectReferenceApplyConfiguration {
+	b.Name = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/workload.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/workload.go
new file mode 100644
index 0000000000..179620a4a3
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/workload.go
@@ -0,0 +1,280 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	internal "k8s.io/client-go/applyconfigurations/internal"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// WorkloadApplyConfiguration represents a declarative configuration of the Workload type for use
+// with apply.
+//
+// Workload allows for expressing scheduling constraints that should be used
+// when managing the lifecycle of workloads from the scheduling perspective,
+// including scheduling, preemption, eviction and other phases.
+// Workload API enablement is toggled by the GenericWorkload feature gate.
+type WorkloadApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	// spec defines the desired behavior of a Workload.
+	Spec *WorkloadSpecApplyConfiguration `json:"spec,omitempty"`
+}
+
+// Workload constructs a declarative configuration of the Workload type for use with
+// apply.
+func Workload(name, namespace string) *WorkloadApplyConfiguration {
+	b := &WorkloadApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("Workload")
+	b.WithAPIVersion("scheduling.k8s.io/v1beta1")
+	return b
+}
+
+// ExtractWorkloadFrom extracts the applied configuration owned by fieldManager from
+// workload for the specified subresource. Pass an empty string for subresource to extract
+// the main resource. Common subresources include "status", "scale", etc.
+// workload must be a unmodified Workload API object that was retrieved from the Kubernetes API.
+// ExtractWorkloadFrom provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractWorkloadFrom(workload *schedulingv1beta1.Workload, fieldManager string, subresource string) (*WorkloadApplyConfiguration, error) {
+	b := &WorkloadApplyConfiguration{}
+	err := managedfields.ExtractInto(workload, internal.Parser().Type("io.k8s.api.scheduling.v1beta1.Workload"), fieldManager, b, subresource)
+	if err != nil {
+		return nil, err
+	}
+	b.WithName(workload.Name)
+	b.WithNamespace(workload.Namespace)
+
+	b.WithKind("Workload")
+	b.WithAPIVersion("scheduling.k8s.io/v1beta1")
+	return b, nil
+}
+
+// ExtractWorkload extracts the applied configuration owned by fieldManager from
+// workload. If no managedFields are found in workload for fieldManager, a
+// WorkloadApplyConfiguration is returned with only the Name, Namespace (if applicable),
+// APIVersion and Kind populated. It is possible that no managed fields were found for because other
+// field managers have taken ownership of all the fields previously owned by fieldManager, or because
+// the fieldManager never owned fields any fields.
+// workload must be a unmodified Workload API object that was retrieved from the Kubernetes API.
+// ExtractWorkload provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractWorkload(workload *schedulingv1beta1.Workload, fieldManager string) (*WorkloadApplyConfiguration, error) {
+	return ExtractWorkloadFrom(workload, fieldManager, "")
+}
+
+func (b WorkloadApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *WorkloadApplyConfiguration) WithKind(value string) *WorkloadApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *WorkloadApplyConfiguration) WithAPIVersion(value string) *WorkloadApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *WorkloadApplyConfiguration) WithName(value string) *WorkloadApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *WorkloadApplyConfiguration) WithGenerateName(value string) *WorkloadApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *WorkloadApplyConfiguration) WithNamespace(value string) *WorkloadApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *WorkloadApplyConfiguration) WithUID(value types.UID) *WorkloadApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *WorkloadApplyConfiguration) WithResourceVersion(value string) *WorkloadApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *WorkloadApplyConfiguration) WithGeneration(value int64) *WorkloadApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *WorkloadApplyConfiguration) WithCreationTimestamp(value metav1.Time) *WorkloadApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *WorkloadApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *WorkloadApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *WorkloadApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *WorkloadApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *WorkloadApplyConfiguration) WithLabels(entries map[string]string) *WorkloadApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *WorkloadApplyConfiguration) WithAnnotations(entries map[string]string) *WorkloadApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *WorkloadApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *WorkloadApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *WorkloadApplyConfiguration) WithFinalizers(values ...string) *WorkloadApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *WorkloadApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *WorkloadApplyConfiguration) WithSpec(value *WorkloadSpecApplyConfiguration) *WorkloadApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *WorkloadApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *WorkloadApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *WorkloadApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *WorkloadApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/workloadreference.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/workloadreference.go
new file mode 100644
index 0000000000..ee6a1aee84
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/workloadreference.go
@@ -0,0 +1,58 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+// WorkloadReferenceApplyConfiguration represents a declarative configuration of the WorkloadReference type for use
+// with apply.
+//
+// WorkloadReference references the Workload object together with the template
+// that was used to create a particular PodGroup.
+type WorkloadReferenceApplyConfiguration struct {
+	// workloadName is the name of the Workload object that contains a template
+	// that was used when creating a pod group. It must
+	// be a DNS name.
+	// This field is required.
+	WorkloadName *string `json:"workloadName,omitempty"`
+	// templateName is the name of a template within the Workload object that
+	// was used to create a pod group. It must be a DNS label.
+	// This field is required.
+	TemplateName *string `json:"templateName,omitempty"`
+}
+
+// WorkloadReferenceApplyConfiguration constructs a declarative configuration of the WorkloadReference type for use with
+// apply.
+func WorkloadReference() *WorkloadReferenceApplyConfiguration {
+	return &WorkloadReferenceApplyConfiguration{}
+}
+
+// WithWorkloadName sets the WorkloadName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the WorkloadName field is set to the value of the last call.
+func (b *WorkloadReferenceApplyConfiguration) WithWorkloadName(value string) *WorkloadReferenceApplyConfiguration {
+	b.WorkloadName = &value
+	return b
+}
+
+// WithTemplateName sets the TemplateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the TemplateName field is set to the value of the last call.
+func (b *WorkloadReferenceApplyConfiguration) WithTemplateName(value string) *WorkloadReferenceApplyConfiguration {
+	b.TemplateName = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/workloadspec.go b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/workloadspec.go
similarity index 63%
rename from vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/workloadspec.go
rename to vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/workloadspec.go
index 33eb8a5c09..36a4e37fcd 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1alpha2/workloadspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/scheduling/v1beta1/workloadspec.go
@@ -16,21 +16,29 @@ limitations under the License.
 
 // Code generated by applyconfiguration-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1beta1
 
 // WorkloadSpecApplyConfiguration represents a declarative configuration of the WorkloadSpec type for use
 // with apply.
 //
 // WorkloadSpec defines the desired state of a Workload.
 type WorkloadSpecApplyConfiguration struct {
-	// ControllerRef is an optional reference to the controlling object, such as a
+	// controllerRef is an optional reference to the controlling object, such as a
 	// Deployment or Job. This field is intended for use by tools like CLIs
 	// to provide a link back to the original workload definition.
 	// This field is immutable.
 	ControllerRef *TypedLocalObjectReferenceApplyConfiguration `json:"controllerRef,omitempty"`
-	// PodGroupTemplates is the list of templates that make up the Workload.
-	// The maximum number of templates is 8. This field is immutable.
+	// podGroupTemplates is the list of templates that make up the Workload.
+	// The maximum number of templates is 8. Templates cannot be added or removed after the workload is created.
+	// Existing templates may still be updated where their individual fields allow it.
+	// Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.
 	PodGroupTemplates []PodGroupTemplateApplyConfiguration `json:"podGroupTemplates,omitempty"`
+	// compositePodGroupTemplates is the list of CompositePodGroup templates that make up the Workload.
+	// The maximum number of templates is 8. This field is immutable.
+	// Exactly one of CompositePodGroupTemplates and PodGroupTemplates must be set.
+	//
+	// This field is used only when the CompositePodGroup feature gate is enabled.
+	CompositePodGroupTemplates []CompositePodGroupTemplateApplyConfiguration `json:"compositePodGroupTemplates,omitempty"`
 }
 
 // WorkloadSpecApplyConfiguration constructs a declarative configuration of the WorkloadSpec type for use with
@@ -59,3 +67,16 @@ func (b *WorkloadSpecApplyConfiguration) WithPodGroupTemplates(values ...*PodGro
 	}
 	return b
 }
+
+// WithCompositePodGroupTemplates adds the given value to the CompositePodGroupTemplates field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the CompositePodGroupTemplates field.
+func (b *WorkloadSpecApplyConfiguration) WithCompositePodGroupTemplates(values ...*CompositePodGroupTemplateApplyConfiguration) *WorkloadSpecApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithCompositePodGroupTemplates")
+		}
+		b.CompositePodGroupTemplates = append(b.CompositePodGroupTemplates, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csidriver.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csidriver.go
index 39ce1eb045..a4a1bb11c4 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csidriver.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csidriver.go
@@ -36,8 +36,8 @@ import (
 // Kubelet uses this object to determine whether pod information needs to be passed on mount.
 // CSIDriver objects are non-namespaced.
 type CSIDriverApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// metadata.Name indicates the name of the CSI driver that this object
 	// refers to; it MUST be the same name returned by the CSI GetPluginName()
 	// call for that driver.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csidriverspec.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csidriverspec.go
index 4a715c141b..839b714167 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csidriverspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csidriverspec.go
@@ -178,7 +178,7 @@ type CSIDriverSpecApplyConfiguration struct {
 	//
 	// Default behavior if unset is to pass tokens in the VolumeContext field.
 	ServiceAccountTokenInSecrets *bool `json:"serviceAccountTokenInSecrets,omitempty"`
-	// PreventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod
+	// preventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod
 	// scheduling if the CSI driver on the node is missing.
 	//
 	// Enabling this option will prevent the scheduler (or any other
@@ -193,7 +193,7 @@ type CSIDriverSpecApplyConfiguration struct {
 	// newly created node may be rejected by the scheduler because of missing CSI driver
 	// information from the node.
 	//
-	// This is an alpha feature and requires the VolumeLimitScaling feature gate to be enabled.
+	// This is a beta feature and requires the VolumeLimitScaling feature gate to be enabled.
 	// Default is "false".
 	PreventPodSchedulingIfMissing *bool `json:"preventPodSchedulingIfMissing,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csinode.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csinode.go
index e0b7f349e2..9a43dc622c 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csinode.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csinode.go
@@ -40,12 +40,14 @@ import (
 // enough that it doesn't create this object.
 // CSINode has an OwnerReference that points to the corresponding node object.
 type CSINodeApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// metadata.name must be the Kubernetes node name.
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec is the specification of CSINode
 	Spec *CSINodeSpecApplyConfiguration `json:"spec,omitempty"`
+	// status contains health and status information for the node's storage.
+	Status *CSINodeStatusApplyConfiguration `json:"status,omitempty"`
 }
 
 // CSINode constructs a declarative configuration of the CSINode type for use with
@@ -92,6 +94,12 @@ func ExtractCSINode(cSINode *storagev1.CSINode, fieldManager string) (*CSINodeAp
 	return ExtractCSINodeFrom(cSINode, fieldManager, "")
 }
 
+// ExtractCSINodeStatus extracts the applied configuration owned by fieldManager from
+// cSINode for the status subresource.
+func ExtractCSINodeStatus(cSINode *storagev1.CSINode, fieldManager string) (*CSINodeApplyConfiguration, error) {
+	return ExtractCSINodeFrom(cSINode, fieldManager, "status")
+}
+
 func (b CSINodeApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
@@ -260,6 +268,14 @@ func (b *CSINodeApplyConfiguration) WithSpec(value *CSINodeSpecApplyConfiguratio
 	return b
 }
 
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *CSINodeApplyConfiguration) WithStatus(value *CSINodeStatusApplyConfiguration) *CSINodeApplyConfiguration {
+	b.Status = value
+	return b
+}
+
 // GetKind retrieves the value of the Kind field in the declarative configuration.
 func (b *CSINodeApplyConfiguration) GetKind() *string {
 	return b.TypeMetaApplyConfiguration.Kind
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csinodestatus.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csinodestatus.go
new file mode 100644
index 0000000000..35294a3c29
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csinodestatus.go
@@ -0,0 +1,47 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// CSINodeStatusApplyConfiguration represents a declarative configuration of the CSINodeStatus type for use
+// with apply.
+//
+// CSINodeStatus contains health and status information for storage on a node.
+type CSINodeStatusApplyConfiguration struct {
+	// storageHealth contains backend health reports for CSI drivers registered on the node.
+	StorageHealth []StorageHealthApplyConfiguration `json:"storageHealth,omitempty"`
+}
+
+// CSINodeStatusApplyConfiguration constructs a declarative configuration of the CSINodeStatus type for use with
+// apply.
+func CSINodeStatus() *CSINodeStatusApplyConfiguration {
+	return &CSINodeStatusApplyConfiguration{}
+}
+
+// WithStorageHealth adds the given value to the StorageHealth field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the StorageHealth field.
+func (b *CSINodeStatusApplyConfiguration) WithStorageHealth(values ...*StorageHealthApplyConfiguration) *CSINodeStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithStorageHealth")
+		}
+		b.StorageHealth = append(b.StorageHealth, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csistoragecapacity.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csistoragecapacity.go
index 8682c4349f..9ae931534b 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csistoragecapacity.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/csistoragecapacity.go
@@ -56,8 +56,8 @@ import (
 // the scheduler assumes that capacity is insufficient and tries some other
 // node.
 type CSIStorageCapacityApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// The name has no particular meaning. It must be a DNS subdomain (dots allowed, 253 characters).
 	// To ensure that there are no conflicts with other CSI drivers on the cluster,
 	// the recommendation is to use csisc-<uuid>, a generated name, or a reverse-domain name
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/storageclass.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/storageclass.go
index 766b795c47..f4fdf32d0b 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/storageclass.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/storageclass.go
@@ -38,8 +38,8 @@ import (
 // StorageClasses are non-namespaced; the name of the storage class
 // according to etcd is in ObjectMeta.Name.
 type StorageClassApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// provisioner indicates the type of the provisioner.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/storagehealth.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/storagehealth.go
new file mode 100644
index 0000000000..9d232b2e66
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/storagehealth.go
@@ -0,0 +1,58 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// StorageHealthApplyConfiguration represents a declarative configuration of the StorageHealth type for use
+// with apply.
+//
+// StorageHealth contains storage backend health reported by a CSI driver on a node.
+type StorageHealthApplyConfiguration struct {
+	// name is the CSI driver name, matching CSINodeDriver.name.
+	Name *string `json:"name,omitempty"`
+	// healthConditions are the adverse storage backend conditions reported by the CSI driver.
+	// At most 16 conditions may be reported.
+	HealthConditions []StorageHealthConditionApplyConfiguration `json:"healthConditions,omitempty"`
+}
+
+// StorageHealthApplyConfiguration constructs a declarative configuration of the StorageHealth type for use with
+// apply.
+func StorageHealth() *StorageHealthApplyConfiguration {
+	return &StorageHealthApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *StorageHealthApplyConfiguration) WithName(value string) *StorageHealthApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithHealthConditions adds the given value to the HealthConditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the HealthConditions field.
+func (b *StorageHealthApplyConfiguration) WithHealthConditions(values ...*StorageHealthConditionApplyConfiguration) *StorageHealthApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithHealthConditions")
+		}
+		b.HealthConditions = append(b.HealthConditions, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/storagehealthcondition.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/storagehealthcondition.go
new file mode 100644
index 0000000000..518d00821c
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/storagehealthcondition.go
@@ -0,0 +1,102 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	storagev1 "k8s.io/api/storage/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// StorageHealthConditionApplyConfiguration represents a declarative configuration of the StorageHealthCondition type for use
+// with apply.
+//
+// StorageHealthCondition represents an adverse health condition reported
+// by a CSI driver for its storage backend on a node.
+type StorageHealthConditionApplyConfiguration struct {
+	// status is the health status category.
+	// One of "StorageUnreachable", "StorageDegraded".
+	Status *storagev1.StorageHealthStatusType `json:"status,omitempty"`
+	// reason is a brief CamelCase machine-parseable reason.
+	// Maximum permitted length of a reason is 256 characters.
+	Reason *string `json:"reason,omitempty"`
+	// message is a human-readable description.
+	// Maximum permitted length of a message is 1024 characters.
+	Message *string `json:"message,omitempty"`
+	// accessMode is the access mode affected. Nil means all access modes are affected.
+	AccessMode *corev1.PersistentVolumeAccessMode `json:"accessMode,omitempty"`
+	// volumeMode is the volume mode affected. Nil means both are affected.
+	VolumeMode *corev1.PersistentVolumeMode `json:"volumeMode,omitempty"`
+	// lastTransitionTime is when this condition first appeared at its current state.
+	LastTransitionTime *metav1.Time `json:"lastTransitionTime,omitempty"`
+}
+
+// StorageHealthConditionApplyConfiguration constructs a declarative configuration of the StorageHealthCondition type for use with
+// apply.
+func StorageHealthCondition() *StorageHealthConditionApplyConfiguration {
+	return &StorageHealthConditionApplyConfiguration{}
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *StorageHealthConditionApplyConfiguration) WithStatus(value storagev1.StorageHealthStatusType) *StorageHealthConditionApplyConfiguration {
+	b.Status = &value
+	return b
+}
+
+// WithReason sets the Reason field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Reason field is set to the value of the last call.
+func (b *StorageHealthConditionApplyConfiguration) WithReason(value string) *StorageHealthConditionApplyConfiguration {
+	b.Reason = &value
+	return b
+}
+
+// WithMessage sets the Message field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Message field is set to the value of the last call.
+func (b *StorageHealthConditionApplyConfiguration) WithMessage(value string) *StorageHealthConditionApplyConfiguration {
+	b.Message = &value
+	return b
+}
+
+// WithAccessMode sets the AccessMode field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the AccessMode field is set to the value of the last call.
+func (b *StorageHealthConditionApplyConfiguration) WithAccessMode(value corev1.PersistentVolumeAccessMode) *StorageHealthConditionApplyConfiguration {
+	b.AccessMode = &value
+	return b
+}
+
+// WithVolumeMode sets the VolumeMode field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the VolumeMode field is set to the value of the last call.
+func (b *StorageHealthConditionApplyConfiguration) WithVolumeMode(value corev1.PersistentVolumeMode) *StorageHealthConditionApplyConfiguration {
+	b.VolumeMode = &value
+	return b
+}
+
+// WithLastTransitionTime sets the LastTransitionTime field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the LastTransitionTime field is set to the value of the last call.
+func (b *StorageHealthConditionApplyConfiguration) WithLastTransitionTime(value metav1.Time) *StorageHealthConditionApplyConfiguration {
+	b.LastTransitionTime = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/volumeattachment.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/volumeattachment.go
index 6240421803..2f958f3cde 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/volumeattachment.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/volumeattachment.go
@@ -35,8 +35,8 @@ import (
 //
 // VolumeAttachment objects are non-namespaced.
 type VolumeAttachmentApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec represents specification of the desired attach/detach volume behavior.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/volumeattributesclass.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/volumeattributesclass.go
index aee276c3d7..9e2e8db131 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1/volumeattributesclass.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1/volumeattributesclass.go
@@ -34,11 +34,11 @@ import (
 // defined by the CSI driver. The class can be specified during dynamic provisioning
 // of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.
 type VolumeAttributesClassApplyConfiguration struct {
-	metav1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Name of the CSI driver
+	// driverName is the name of the CSI driver
 	// This field is immutable.
 	DriverName *string `json:"driverName,omitempty"`
 	// parameters hold volume attributes defined by the CSI driver. These values
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1alpha1/csistoragecapacity.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1alpha1/csistoragecapacity.go
index e52c1adf4f..9885263cd8 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1alpha1/csistoragecapacity.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1alpha1/csistoragecapacity.go
@@ -56,8 +56,8 @@ import (
 // the scheduler assumes that capacity is insufficient and tries some other
 // node.
 type CSIStorageCapacityApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata. The name has no particular meaning. It must be
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata. The name has no particular meaning. It must be
 	// be a DNS subdomain (dots allowed, 253 characters). To ensure that
 	// there are no conflicts with other CSI drivers on the cluster, the recommendation
 	// is to use csisc-<uuid>, a generated name, or a reverse-domain name which ends
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1alpha1/volumeattachment.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1alpha1/volumeattachment.go
index bd214650ba..839abce4b1 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1alpha1/volumeattachment.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1alpha1/volumeattachment.go
@@ -35,8 +35,8 @@ import (
 //
 // VolumeAttachment objects are non-namespaced.
 type VolumeAttachmentApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec represents specification of the desired attach/detach volume behavior.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1alpha1/volumeattributesclass.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1alpha1/volumeattributesclass.go
index 62ff6dcbf9..c384c1722a 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1alpha1/volumeattributesclass.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1alpha1/volumeattributesclass.go
@@ -34,11 +34,11 @@ import (
 // defined by the CSI driver. The class can be specified during dynamic provisioning
 // of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.
 type VolumeAttributesClassApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Name of the CSI driver
+	// driverName is the name of the CSI driver
 	// This field is immutable.
 	DriverName *string `json:"driverName,omitempty"`
 	// parameters hold volume attributes defined by the CSI driver. These values
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csidriver.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csidriver.go
index bace6d42b6..4a50776999 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csidriver.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csidriver.go
@@ -39,8 +39,8 @@ import (
 // Kubelet uses this object to determine whether pod information needs to be passed on mount.
 // CSIDriver objects are non-namespaced.
 type CSIDriverApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// metadata.Name indicates the name of the CSI driver that this object
 	// refers to; it MUST be the same name returned by the CSI GetPluginName()
 	// call for that driver.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csidriverspec.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csidriverspec.go
index cec76d9fd8..624fad712c 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csidriverspec.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csidriverspec.go
@@ -178,7 +178,7 @@ type CSIDriverSpecApplyConfiguration struct {
 	//
 	// Default behavior if unset is to pass tokens in the VolumeContext field.
 	ServiceAccountTokenInSecrets *bool `json:"serviceAccountTokenInSecrets,omitempty"`
-	// PreventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod
+	// preventPodSchedulingIfMissing indicates that the CSI driver wants to prevent pod
 	// scheduling if the CSI driver on the node is missing.
 	//
 	// Enabling this option will prevent the scheduler (or any other
@@ -193,7 +193,7 @@ type CSIDriverSpecApplyConfiguration struct {
 	// newly created node may be rejected by the scheduler because of missing CSI driver
 	// information from the node.
 	//
-	// This is an alpha feature and requires the VolumeLimitScaling feature gate to be enabled.
+	// This is a beta feature and requires the VolumeLimitScaling feature gate to be enabled.
 	// Default is "false".
 	PreventPodSchedulingIfMissing *bool `json:"preventPodSchedulingIfMissing,omitempty"`
 }
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csinode.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csinode.go
index 7f6907275e..f1496eb190 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csinode.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csinode.go
@@ -42,11 +42,14 @@ import (
 // enough that it doesn't create this object.
 // CSINode has an OwnerReference that points to the corresponding node object.
 type CSINodeApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// metadata.name must be the Kubernetes node name.
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec is the specification of CSINode
 	Spec *CSINodeSpecApplyConfiguration `json:"spec,omitempty"`
+	// status contains health and status information for the node's storage.
+	Status *CSINodeStatusApplyConfiguration `json:"status,omitempty"`
 }
 
 // CSINode constructs a declarative configuration of the CSINode type for use with
@@ -93,6 +96,12 @@ func ExtractCSINode(cSINode *storagev1beta1.CSINode, fieldManager string) (*CSIN
 	return ExtractCSINodeFrom(cSINode, fieldManager, "")
 }
 
+// ExtractCSINodeStatus extracts the applied configuration owned by fieldManager from
+// cSINode for the status subresource.
+func ExtractCSINodeStatus(cSINode *storagev1beta1.CSINode, fieldManager string) (*CSINodeApplyConfiguration, error) {
+	return ExtractCSINodeFrom(cSINode, fieldManager, "status")
+}
+
 func (b CSINodeApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
@@ -261,6 +270,14 @@ func (b *CSINodeApplyConfiguration) WithSpec(value *CSINodeSpecApplyConfiguratio
 	return b
 }
 
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *CSINodeApplyConfiguration) WithStatus(value *CSINodeStatusApplyConfiguration) *CSINodeApplyConfiguration {
+	b.Status = value
+	return b
+}
+
 // GetKind retrieves the value of the Kind field in the declarative configuration.
 func (b *CSINodeApplyConfiguration) GetKind() *string {
 	return b.TypeMetaApplyConfiguration.Kind
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csinodestatus.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csinodestatus.go
new file mode 100644
index 0000000000..85ab831078
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csinodestatus.go
@@ -0,0 +1,47 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+// CSINodeStatusApplyConfiguration represents a declarative configuration of the CSINodeStatus type for use
+// with apply.
+//
+// CSINodeStatus contains health and status information for storage on a node.
+type CSINodeStatusApplyConfiguration struct {
+	// storageHealth contains backend health reports for CSI drivers registered on the node.
+	StorageHealth []StorageHealthApplyConfiguration `json:"storageHealth,omitempty"`
+}
+
+// CSINodeStatusApplyConfiguration constructs a declarative configuration of the CSINodeStatus type for use with
+// apply.
+func CSINodeStatus() *CSINodeStatusApplyConfiguration {
+	return &CSINodeStatusApplyConfiguration{}
+}
+
+// WithStorageHealth adds the given value to the StorageHealth field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the StorageHealth field.
+func (b *CSINodeStatusApplyConfiguration) WithStorageHealth(values ...*StorageHealthApplyConfiguration) *CSINodeStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithStorageHealth")
+		}
+		b.StorageHealth = append(b.StorageHealth, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csistoragecapacity.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csistoragecapacity.go
index e27221e82c..34f1830e97 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csistoragecapacity.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/csistoragecapacity.go
@@ -56,8 +56,8 @@ import (
 // the scheduler assumes that capacity is insufficient and tries some other
 // node.
 type CSIStorageCapacityApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata. The name has no particular meaning. It must be
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata. The name has no particular meaning. It must be
 	// be a DNS subdomain (dots allowed, 253 characters). To ensure that
 	// there are no conflicts with other CSI drivers on the cluster, the recommendation
 	// is to use csisc-<uuid>, a generated name, or a reverse-domain name which ends
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/storageclass.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/storageclass.go
index 49bf87ac59..d45801926b 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/storageclass.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/storageclass.go
@@ -38,8 +38,8 @@ import (
 // StorageClasses are non-namespaced; the name of the storage class
 // according to etcd is in ObjectMeta.Name.
 type StorageClassApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// provisioner indicates the type of the provisioner.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/storagehealth.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/storagehealth.go
new file mode 100644
index 0000000000..ccd30766e2
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/storagehealth.go
@@ -0,0 +1,58 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+// StorageHealthApplyConfiguration represents a declarative configuration of the StorageHealth type for use
+// with apply.
+//
+// StorageHealth contains storage backend health reported by a CSI driver on a node.
+type StorageHealthApplyConfiguration struct {
+	// name is the CSI driver name, matching CSINodeDriver.name.
+	Name *string `json:"name,omitempty"`
+	// healthConditions are the adverse storage backend conditions reported by the CSI driver.
+	// At most 16 conditions may be reported.
+	HealthConditions []StorageHealthConditionApplyConfiguration `json:"healthConditions,omitempty"`
+}
+
+// StorageHealthApplyConfiguration constructs a declarative configuration of the StorageHealth type for use with
+// apply.
+func StorageHealth() *StorageHealthApplyConfiguration {
+	return &StorageHealthApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *StorageHealthApplyConfiguration) WithName(value string) *StorageHealthApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithHealthConditions adds the given value to the HealthConditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the HealthConditions field.
+func (b *StorageHealthApplyConfiguration) WithHealthConditions(values ...*StorageHealthConditionApplyConfiguration) *StorageHealthApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithHealthConditions")
+		}
+		b.HealthConditions = append(b.HealthConditions, *values[i])
+	}
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/storagehealthcondition.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/storagehealthcondition.go
new file mode 100644
index 0000000000..6fd4e6bfa1
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/storagehealthcondition.go
@@ -0,0 +1,102 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	v1 "k8s.io/api/core/v1"
+	storagev1beta1 "k8s.io/api/storage/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// StorageHealthConditionApplyConfiguration represents a declarative configuration of the StorageHealthCondition type for use
+// with apply.
+//
+// StorageHealthCondition represents an adverse health condition reported
+// by a CSI driver for its storage backend on a node.
+type StorageHealthConditionApplyConfiguration struct {
+	// status is the health status category.
+	// One of "StorageUnreachable", "StorageDegraded".
+	Status *storagev1beta1.StorageHealthStatusType `json:"status,omitempty"`
+	// reason is a brief CamelCase machine-parseable reason.
+	// Maximum permitted length of a reason is 256 characters.
+	Reason *string `json:"reason,omitempty"`
+	// message is a human-readable description.
+	// Maximum permitted length of a message is 1024 characters.
+	Message *string `json:"message,omitempty"`
+	// accessMode is the access mode affected. Nil means all access modes are affected.
+	AccessMode *v1.PersistentVolumeAccessMode `json:"accessMode,omitempty"`
+	// volumeMode is the volume mode affected. Nil means both are affected.
+	VolumeMode *v1.PersistentVolumeMode `json:"volumeMode,omitempty"`
+	// lastTransitionTime is when this condition first appeared at its current state.
+	LastTransitionTime *metav1.Time `json:"lastTransitionTime,omitempty"`
+}
+
+// StorageHealthConditionApplyConfiguration constructs a declarative configuration of the StorageHealthCondition type for use with
+// apply.
+func StorageHealthCondition() *StorageHealthConditionApplyConfiguration {
+	return &StorageHealthConditionApplyConfiguration{}
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *StorageHealthConditionApplyConfiguration) WithStatus(value storagev1beta1.StorageHealthStatusType) *StorageHealthConditionApplyConfiguration {
+	b.Status = &value
+	return b
+}
+
+// WithReason sets the Reason field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Reason field is set to the value of the last call.
+func (b *StorageHealthConditionApplyConfiguration) WithReason(value string) *StorageHealthConditionApplyConfiguration {
+	b.Reason = &value
+	return b
+}
+
+// WithMessage sets the Message field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Message field is set to the value of the last call.
+func (b *StorageHealthConditionApplyConfiguration) WithMessage(value string) *StorageHealthConditionApplyConfiguration {
+	b.Message = &value
+	return b
+}
+
+// WithAccessMode sets the AccessMode field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the AccessMode field is set to the value of the last call.
+func (b *StorageHealthConditionApplyConfiguration) WithAccessMode(value v1.PersistentVolumeAccessMode) *StorageHealthConditionApplyConfiguration {
+	b.AccessMode = &value
+	return b
+}
+
+// WithVolumeMode sets the VolumeMode field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the VolumeMode field is set to the value of the last call.
+func (b *StorageHealthConditionApplyConfiguration) WithVolumeMode(value v1.PersistentVolumeMode) *StorageHealthConditionApplyConfiguration {
+	b.VolumeMode = &value
+	return b
+}
+
+// WithLastTransitionTime sets the LastTransitionTime field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the LastTransitionTime field is set to the value of the last call.
+func (b *StorageHealthConditionApplyConfiguration) WithLastTransitionTime(value metav1.Time) *StorageHealthConditionApplyConfiguration {
+	b.LastTransitionTime = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/volumeattachment.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/volumeattachment.go
index da938bd301..25ffcd1402 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/volumeattachment.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/volumeattachment.go
@@ -35,8 +35,8 @@ import (
 //
 // VolumeAttachment objects are non-namespaced.
 type VolumeAttachmentApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	// spec represents specification of the desired attach/detach volume behavior.
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/volumeattributesclass.go b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/volumeattributesclass.go
index 7d04a86c84..1eab6c2cac 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/volumeattributesclass.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storage/v1beta1/volumeattributesclass.go
@@ -34,11 +34,11 @@ import (
 // defined by the CSI driver. The class can be specified during dynamic provisioning
 // of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.
 type VolumeAttributesClassApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
-	// Standard object's metadata.
+	v1.TypeMetaApplyConfiguration `json:""`
+	// metadata is the standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	// Name of the CSI driver
+	// driverName is the name of the CSI driver
 	// This field is immutable.
 	DriverName *string `json:"driverName,omitempty"`
 	// parameters hold volume attributes defined by the CSI driver. These values
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storagemigration/v1/storageversionmigration.go b/vendor/k8s.io/client-go/applyconfigurations/storagemigration/v1/storageversionmigration.go
new file mode 100644
index 0000000000..b42000e712
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/storagemigration/v1/storageversionmigration.go
@@ -0,0 +1,292 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	storagemigrationv1 "k8s.io/api/storagemigration/v1"
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	internal "k8s.io/client-go/applyconfigurations/internal"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// StorageVersionMigrationApplyConfiguration represents a declarative configuration of the StorageVersionMigration type for use
+// with apply.
+//
+// StorageVersionMigration represents a migration of stored data to the latest
+// storage version.
+type StorageVersionMigrationApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration `json:""`
+	// Standard object metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	// Specification of the migration.
+	Spec *StorageVersionMigrationSpecApplyConfiguration `json:"spec,omitempty"`
+	// Status of the migration.
+	Status *StorageVersionMigrationStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// StorageVersionMigration constructs a declarative configuration of the StorageVersionMigration type for use with
+// apply.
+func StorageVersionMigration(name string) *StorageVersionMigrationApplyConfiguration {
+	b := &StorageVersionMigrationApplyConfiguration{}
+	b.WithName(name)
+	b.WithKind("StorageVersionMigration")
+	b.WithAPIVersion("storagemigration.k8s.io/v1")
+	return b
+}
+
+// ExtractStorageVersionMigrationFrom extracts the applied configuration owned by fieldManager from
+// storageVersionMigration for the specified subresource. Pass an empty string for subresource to extract
+// the main resource. Common subresources include "status", "scale", etc.
+// storageVersionMigration must be a unmodified StorageVersionMigration API object that was retrieved from the Kubernetes API.
+// ExtractStorageVersionMigrationFrom provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractStorageVersionMigrationFrom(storageVersionMigration *storagemigrationv1.StorageVersionMigration, fieldManager string, subresource string) (*StorageVersionMigrationApplyConfiguration, error) {
+	b := &StorageVersionMigrationApplyConfiguration{}
+	err := managedfields.ExtractInto(storageVersionMigration, internal.Parser().Type("io.k8s.api.storagemigration.v1.StorageVersionMigration"), fieldManager, b, subresource)
+	if err != nil {
+		return nil, err
+	}
+	b.WithName(storageVersionMigration.Name)
+
+	b.WithKind("StorageVersionMigration")
+	b.WithAPIVersion("storagemigration.k8s.io/v1")
+	return b, nil
+}
+
+// ExtractStorageVersionMigration extracts the applied configuration owned by fieldManager from
+// storageVersionMigration. If no managedFields are found in storageVersionMigration for fieldManager, a
+// StorageVersionMigrationApplyConfiguration is returned with only the Name, Namespace (if applicable),
+// APIVersion and Kind populated. It is possible that no managed fields were found for because other
+// field managers have taken ownership of all the fields previously owned by fieldManager, or because
+// the fieldManager never owned fields any fields.
+// storageVersionMigration must be a unmodified StorageVersionMigration API object that was retrieved from the Kubernetes API.
+// ExtractStorageVersionMigration provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+func ExtractStorageVersionMigration(storageVersionMigration *storagemigrationv1.StorageVersionMigration, fieldManager string) (*StorageVersionMigrationApplyConfiguration, error) {
+	return ExtractStorageVersionMigrationFrom(storageVersionMigration, fieldManager, "")
+}
+
+// ExtractStorageVersionMigrationStatus extracts the applied configuration owned by fieldManager from
+// storageVersionMigration for the status subresource.
+func ExtractStorageVersionMigrationStatus(storageVersionMigration *storagemigrationv1.StorageVersionMigration, fieldManager string) (*StorageVersionMigrationApplyConfiguration, error) {
+	return ExtractStorageVersionMigrationFrom(storageVersionMigration, fieldManager, "status")
+}
+
+func (b StorageVersionMigrationApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *StorageVersionMigrationApplyConfiguration) WithKind(value string) *StorageVersionMigrationApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *StorageVersionMigrationApplyConfiguration) WithAPIVersion(value string) *StorageVersionMigrationApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *StorageVersionMigrationApplyConfiguration) WithName(value string) *StorageVersionMigrationApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *StorageVersionMigrationApplyConfiguration) WithGenerateName(value string) *StorageVersionMigrationApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *StorageVersionMigrationApplyConfiguration) WithNamespace(value string) *StorageVersionMigrationApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *StorageVersionMigrationApplyConfiguration) WithUID(value types.UID) *StorageVersionMigrationApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *StorageVersionMigrationApplyConfiguration) WithResourceVersion(value string) *StorageVersionMigrationApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *StorageVersionMigrationApplyConfiguration) WithGeneration(value int64) *StorageVersionMigrationApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *StorageVersionMigrationApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *StorageVersionMigrationApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *StorageVersionMigrationApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *StorageVersionMigrationApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *StorageVersionMigrationApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *StorageVersionMigrationApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *StorageVersionMigrationApplyConfiguration) WithLabels(entries map[string]string) *StorageVersionMigrationApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *StorageVersionMigrationApplyConfiguration) WithAnnotations(entries map[string]string) *StorageVersionMigrationApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *StorageVersionMigrationApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *StorageVersionMigrationApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *StorageVersionMigrationApplyConfiguration) WithFinalizers(values ...string) *StorageVersionMigrationApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *StorageVersionMigrationApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *StorageVersionMigrationApplyConfiguration) WithSpec(value *StorageVersionMigrationSpecApplyConfiguration) *StorageVersionMigrationApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *StorageVersionMigrationApplyConfiguration) WithStatus(value *StorageVersionMigrationStatusApplyConfiguration) *StorageVersionMigrationApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *StorageVersionMigrationApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *StorageVersionMigrationApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *StorageVersionMigrationApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *StorageVersionMigrationApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storagemigration/v1/storageversionmigrationspec.go b/vendor/k8s.io/client-go/applyconfigurations/storagemigration/v1/storageversionmigrationspec.go
new file mode 100644
index 0000000000..2c8603560b
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/storagemigration/v1/storageversionmigrationspec.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// StorageVersionMigrationSpecApplyConfiguration represents a declarative configuration of the StorageVersionMigrationSpec type for use
+// with apply.
+//
+// Spec of the storage version migration.
+type StorageVersionMigrationSpecApplyConfiguration struct {
+	// The resource that is being migrated. The migrator sends requests to
+	// the endpoint serving the resource.
+	// Immutable.
+	Resource *metav1.GroupResourceApplyConfiguration `json:"resource,omitempty"`
+}
+
+// StorageVersionMigrationSpecApplyConfiguration constructs a declarative configuration of the StorageVersionMigrationSpec type for use with
+// apply.
+func StorageVersionMigrationSpec() *StorageVersionMigrationSpecApplyConfiguration {
+	return &StorageVersionMigrationSpecApplyConfiguration{}
+}
+
+// WithResource sets the Resource field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Resource field is set to the value of the last call.
+func (b *StorageVersionMigrationSpecApplyConfiguration) WithResource(value *metav1.GroupResourceApplyConfiguration) *StorageVersionMigrationSpecApplyConfiguration {
+	b.Resource = value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storagemigration/v1/storageversionmigrationstatus.go b/vendor/k8s.io/client-go/applyconfigurations/storagemigration/v1/storageversionmigrationstatus.go
new file mode 100644
index 0000000000..14bc869731
--- /dev/null
+++ b/vendor/k8s.io/client-go/applyconfigurations/storagemigration/v1/storageversionmigrationstatus.go
@@ -0,0 +1,63 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// StorageVersionMigrationStatusApplyConfiguration represents a declarative configuration of the StorageVersionMigrationStatus type for use
+// with apply.
+//
+// Status of the storage version migration.
+type StorageVersionMigrationStatusApplyConfiguration struct {
+	// The latest available observations of the migration's current state.
+	Conditions []metav1.ConditionApplyConfiguration `json:"conditions,omitempty"`
+	// ResourceVersion to compare with the GC cache for performing the migration.
+	// This is the current resource version of given group, version and resource when
+	// kube-controller-manager first observes this StorageVersionMigration resource.
+	ResourceVersion *string `json:"resourceVersion,omitempty"`
+}
+
+// StorageVersionMigrationStatusApplyConfiguration constructs a declarative configuration of the StorageVersionMigrationStatus type for use with
+// apply.
+func StorageVersionMigrationStatus() *StorageVersionMigrationStatusApplyConfiguration {
+	return &StorageVersionMigrationStatusApplyConfiguration{}
+}
+
+// WithConditions adds the given value to the Conditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Conditions field.
+func (b *StorageVersionMigrationStatusApplyConfiguration) WithConditions(values ...*metav1.ConditionApplyConfiguration) *StorageVersionMigrationStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithConditions")
+		}
+		b.Conditions = append(b.Conditions, *values[i])
+	}
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *StorageVersionMigrationStatusApplyConfiguration) WithResourceVersion(value string) *StorageVersionMigrationStatusApplyConfiguration {
+	b.ResourceVersion = &value
+	return b
+}
diff --git a/vendor/k8s.io/client-go/applyconfigurations/storagemigration/v1beta1/storageversionmigration.go b/vendor/k8s.io/client-go/applyconfigurations/storagemigration/v1beta1/storageversionmigration.go
index e52fa5d813..f82428997f 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/storagemigration/v1beta1/storageversionmigration.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/storagemigration/v1beta1/storageversionmigration.go
@@ -33,7 +33,7 @@ import (
 // StorageVersionMigration represents a migration of stored data to the latest
 // storage version.
 type StorageVersionMigrationApplyConfiguration struct {
-	v1.TypeMetaApplyConfiguration `json:",inline"`
+	v1.TypeMetaApplyConfiguration `json:""`
 	// Standard object metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
diff --git a/vendor/k8s.io/client-go/applyconfigurations/utils.go b/vendor/k8s.io/client-go/applyconfigurations/utils.go
index 355051fc8d..f498c284ee 100644
--- a/vendor/k8s.io/client-go/applyconfigurations/utils.go
+++ b/vendor/k8s.io/client-go/applyconfigurations/utils.go
@@ -47,6 +47,7 @@ import (
 	flowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
 	v1beta3 "k8s.io/api/flowcontrol/v1beta3"
 	imagepolicyv1alpha1 "k8s.io/api/imagepolicy/v1alpha1"
+	lifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
 	networkingv1 "k8s.io/api/networking/v1"
 	networkingv1beta1 "k8s.io/api/networking/v1beta1"
 	nodev1 "k8s.io/api/node/v1"
@@ -62,11 +63,12 @@ import (
 	resourcev1beta1 "k8s.io/api/resource/v1beta1"
 	resourcev1beta2 "k8s.io/api/resource/v1beta2"
 	schedulingv1 "k8s.io/api/scheduling/v1"
-	schedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
 	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
 	storagev1 "k8s.io/api/storage/v1"
 	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
+	storagemigrationv1 "k8s.io/api/storagemigration/v1"
 	storagemigrationv1beta1 "k8s.io/api/storagemigration/v1beta1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
@@ -101,6 +103,7 @@ import (
 	flowcontrolv1beta3 "k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3"
 	applyconfigurationsimagepolicyv1alpha1 "k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1"
 	internal "k8s.io/client-go/applyconfigurations/internal"
+	applyconfigurationslifecyclev1alpha1 "k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1"
 	applyconfigurationsmetav1 "k8s.io/client-go/applyconfigurations/meta/v1"
 	applyconfigurationsnetworkingv1 "k8s.io/client-go/applyconfigurations/networking/v1"
 	applyconfigurationsnetworkingv1beta1 "k8s.io/client-go/applyconfigurations/networking/v1beta1"
@@ -117,11 +120,12 @@ import (
 	applyconfigurationsresourcev1beta1 "k8s.io/client-go/applyconfigurations/resource/v1beta1"
 	applyconfigurationsresourcev1beta2 "k8s.io/client-go/applyconfigurations/resource/v1beta2"
 	applyconfigurationsschedulingv1 "k8s.io/client-go/applyconfigurations/scheduling/v1"
-	applyconfigurationsschedulingv1alpha2 "k8s.io/client-go/applyconfigurations/scheduling/v1alpha2"
+	applyconfigurationsschedulingv1alpha3 "k8s.io/client-go/applyconfigurations/scheduling/v1alpha3"
 	applyconfigurationsschedulingv1beta1 "k8s.io/client-go/applyconfigurations/scheduling/v1beta1"
 	applyconfigurationsstoragev1 "k8s.io/client-go/applyconfigurations/storage/v1"
 	applyconfigurationsstoragev1alpha1 "k8s.io/client-go/applyconfigurations/storage/v1alpha1"
 	applyconfigurationsstoragev1beta1 "k8s.io/client-go/applyconfigurations/storage/v1beta1"
+	applyconfigurationsstoragemigrationv1 "k8s.io/client-go/applyconfigurations/storagemigration/v1"
 	applyconfigurationsstoragemigrationv1beta1 "k8s.io/client-go/applyconfigurations/storagemigration/v1beta1"
 )
 
@@ -510,6 +514,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &applyconfigurationsbatchv1.JobApplyConfiguration{}
 	case batchv1.SchemeGroupVersion.WithKind("JobCondition"):
 		return &applyconfigurationsbatchv1.JobConditionApplyConfiguration{}
+	case batchv1.SchemeGroupVersion.WithKind("JobSchedulingConfiguration"):
+		return &applyconfigurationsbatchv1.JobSchedulingConfigurationApplyConfiguration{}
 	case batchv1.SchemeGroupVersion.WithKind("JobSpec"):
 		return &applyconfigurationsbatchv1.JobSpecApplyConfiguration{}
 	case batchv1.SchemeGroupVersion.WithKind("JobStatus"):
@@ -550,6 +556,16 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &applyconfigurationscertificatesv1.CertificateSigningRequestSpecApplyConfiguration{}
 	case certificatesv1.SchemeGroupVersion.WithKind("CertificateSigningRequestStatus"):
 		return &applyconfigurationscertificatesv1.CertificateSigningRequestStatusApplyConfiguration{}
+	case certificatesv1.SchemeGroupVersion.WithKind("ClusterTrustBundle"):
+		return &applyconfigurationscertificatesv1.ClusterTrustBundleApplyConfiguration{}
+	case certificatesv1.SchemeGroupVersion.WithKind("ClusterTrustBundleSpec"):
+		return &applyconfigurationscertificatesv1.ClusterTrustBundleSpecApplyConfiguration{}
+	case certificatesv1.SchemeGroupVersion.WithKind("PodCertificateRequest"):
+		return &applyconfigurationscertificatesv1.PodCertificateRequestApplyConfiguration{}
+	case certificatesv1.SchemeGroupVersion.WithKind("PodCertificateRequestSpec"):
+		return &applyconfigurationscertificatesv1.PodCertificateRequestSpecApplyConfiguration{}
+	case certificatesv1.SchemeGroupVersion.WithKind("PodCertificateRequestStatus"):
+		return &applyconfigurationscertificatesv1.PodCertificateRequestStatusApplyConfiguration{}
 
 		// Group=certificates.k8s.io, Version=v1alpha1
 	case certificatesv1alpha1.SchemeGroupVersion.WithKind("ClusterTrustBundle"):
@@ -710,6 +726,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &applyconfigurationscorev1.EventSeriesApplyConfiguration{}
 	case corev1.SchemeGroupVersion.WithKind("EventSource"):
 		return &applyconfigurationscorev1.EventSourceApplyConfiguration{}
+	case corev1.SchemeGroupVersion.WithKind("EvictionResponder"):
+		return &applyconfigurationscorev1.EvictionResponderApplyConfiguration{}
 	case corev1.SchemeGroupVersion.WithKind("ExecAction"):
 		return &applyconfigurationscorev1.ExecActionApplyConfiguration{}
 	case corev1.SchemeGroupVersion.WithKind("FCVolumeSource"):
@@ -790,6 +808,10 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &applyconfigurationscorev1.NodeAddressApplyConfiguration{}
 	case corev1.SchemeGroupVersion.WithKind("NodeAffinity"):
 		return &applyconfigurationscorev1.NodeAffinityApplyConfiguration{}
+	case corev1.SchemeGroupVersion.WithKind("NodeAllocatableMappedResources"):
+		return &applyconfigurationscorev1.NodeAllocatableMappedResourcesApplyConfiguration{}
+	case corev1.SchemeGroupVersion.WithKind("NodeAllocatableOverheadResources"):
+		return &applyconfigurationscorev1.NodeAllocatableOverheadResourcesApplyConfiguration{}
 	case corev1.SchemeGroupVersion.WithKind("NodeAllocatableResourceClaimStatus"):
 		return &applyconfigurationscorev1.NodeAllocatableResourceClaimStatusApplyConfiguration{}
 	case corev1.SchemeGroupVersion.WithKind("NodeCondition"):
@@ -802,6 +824,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &applyconfigurationscorev1.NodeDaemonEndpointsApplyConfiguration{}
 	case corev1.SchemeGroupVersion.WithKind("NodeFeatures"):
 		return &applyconfigurationscorev1.NodeFeaturesApplyConfiguration{}
+	case corev1.SchemeGroupVersion.WithKind("NodePodPreemptionPolicy"):
+		return &applyconfigurationscorev1.NodePodPreemptionPolicyApplyConfiguration{}
 	case corev1.SchemeGroupVersion.WithKind("NodeRuntimeHandler"):
 		return &applyconfigurationscorev1.NodeRuntimeHandlerApplyConfiguration{}
 	case corev1.SchemeGroupVersion.WithKind("NodeRuntimeHandlerFeatures"):
@@ -888,6 +912,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &applyconfigurationscorev1.PodTemplateApplyConfiguration{}
 	case corev1.SchemeGroupVersion.WithKind("PodTemplateSpec"):
 		return &applyconfigurationscorev1.PodTemplateSpecApplyConfiguration{}
+	case corev1.SchemeGroupVersion.WithKind("PodVolumeHealth"):
+		return &applyconfigurationscorev1.PodVolumeHealthApplyConfiguration{}
 	case corev1.SchemeGroupVersion.WithKind("PortStatus"):
 		return &applyconfigurationscorev1.PortStatusApplyConfiguration{}
 	case corev1.SchemeGroupVersion.WithKind("PortworxVolumeSource"):
@@ -998,6 +1024,10 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &applyconfigurationscorev1.VolumeApplyConfiguration{}
 	case corev1.SchemeGroupVersion.WithKind("VolumeDevice"):
 		return &applyconfigurationscorev1.VolumeDeviceApplyConfiguration{}
+	case corev1.SchemeGroupVersion.WithKind("VolumeHealthCondition"):
+		return &applyconfigurationscorev1.VolumeHealthConditionApplyConfiguration{}
+	case corev1.SchemeGroupVersion.WithKind("VolumeHealthStatus"):
+		return &applyconfigurationscorev1.VolumeHealthStatusApplyConfiguration{}
 	case corev1.SchemeGroupVersion.WithKind("VolumeMount"):
 		return &applyconfigurationscorev1.VolumeMountApplyConfiguration{}
 	case corev1.SchemeGroupVersion.WithKind("VolumeMountStatus"):
@@ -1335,6 +1365,34 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 	case apiserverinternalv1alpha1.SchemeGroupVersion.WithKind("StorageVersionStatus"):
 		return &applyconfigurationsapiserverinternalv1alpha1.StorageVersionStatusApplyConfiguration{}
 
+		// Group=lifecycle.k8s.io, Version=v1alpha1
+	case lifecyclev1alpha1.SchemeGroupVersion.WithKind("Eviction"):
+		return &applyconfigurationslifecyclev1alpha1.EvictionApplyConfiguration{}
+	case lifecyclev1alpha1.SchemeGroupVersion.WithKind("EvictionPodReference"):
+		return &applyconfigurationslifecyclev1alpha1.EvictionPodReferenceApplyConfiguration{}
+	case lifecyclev1alpha1.SchemeGroupVersion.WithKind("EvictionRequest"):
+		return &applyconfigurationslifecyclev1alpha1.EvictionRequestApplyConfiguration{}
+	case lifecyclev1alpha1.SchemeGroupVersion.WithKind("EvictionRequestPodReference"):
+		return &applyconfigurationslifecyclev1alpha1.EvictionRequestPodReferenceApplyConfiguration{}
+	case lifecyclev1alpha1.SchemeGroupVersion.WithKind("EvictionRequestSpec"):
+		return &applyconfigurationslifecyclev1alpha1.EvictionRequestSpecApplyConfiguration{}
+	case lifecyclev1alpha1.SchemeGroupVersion.WithKind("EvictionRequestStatus"):
+		return &applyconfigurationslifecyclev1alpha1.EvictionRequestStatusApplyConfiguration{}
+	case lifecyclev1alpha1.SchemeGroupVersion.WithKind("EvictionRequestTarget"):
+		return &applyconfigurationslifecyclev1alpha1.EvictionRequestTargetApplyConfiguration{}
+	case lifecyclev1alpha1.SchemeGroupVersion.WithKind("EvictionSpec"):
+		return &applyconfigurationslifecyclev1alpha1.EvictionSpecApplyConfiguration{}
+	case lifecyclev1alpha1.SchemeGroupVersion.WithKind("EvictionStatus"):
+		return &applyconfigurationslifecyclev1alpha1.EvictionStatusApplyConfiguration{}
+	case lifecyclev1alpha1.SchemeGroupVersion.WithKind("EvictionTarget"):
+		return &applyconfigurationslifecyclev1alpha1.EvictionTargetApplyConfiguration{}
+	case lifecyclev1alpha1.SchemeGroupVersion.WithKind("Requester"):
+		return &applyconfigurationslifecyclev1alpha1.RequesterApplyConfiguration{}
+	case lifecyclev1alpha1.SchemeGroupVersion.WithKind("ResponderStatus"):
+		return &applyconfigurationslifecyclev1alpha1.ResponderStatusApplyConfiguration{}
+	case lifecyclev1alpha1.SchemeGroupVersion.WithKind("TargetResponder"):
+		return &applyconfigurationslifecyclev1alpha1.TargetResponderApplyConfiguration{}
+
 		// Group=meta.k8s.io, Version=v1
 	case metav1.SchemeGroupVersion.WithKind("Condition"):
 		return &applyconfigurationsmetav1.ConditionApplyConfiguration{}
@@ -1606,6 +1664,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &applyconfigurationsresourcev1.DeviceConstraintApplyConfiguration{}
 	case resourcev1.SchemeGroupVersion.WithKind("DeviceCounterConsumption"):
 		return &applyconfigurationsresourcev1.DeviceCounterConsumptionApplyConfiguration{}
+	case resourcev1.SchemeGroupVersion.WithKind("DeviceDerivedAttribute"):
+		return &applyconfigurationsresourcev1.DeviceDerivedAttributeApplyConfiguration{}
 	case resourcev1.SchemeGroupVersion.WithKind("DeviceRequest"):
 		return &applyconfigurationsresourcev1.DeviceRequestApplyConfiguration{}
 	case resourcev1.SchemeGroupVersion.WithKind("DeviceRequestAllocationResult"):
@@ -1616,14 +1676,26 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &applyconfigurationsresourcev1.DeviceSubRequestApplyConfiguration{}
 	case resourcev1.SchemeGroupVersion.WithKind("DeviceTaint"):
 		return &applyconfigurationsresourcev1.DeviceTaintApplyConfiguration{}
+	case resourcev1.SchemeGroupVersion.WithKind("DeviceTaintRule"):
+		return &applyconfigurationsresourcev1.DeviceTaintRuleApplyConfiguration{}
+	case resourcev1.SchemeGroupVersion.WithKind("DeviceTaintRuleSpec"):
+		return &applyconfigurationsresourcev1.DeviceTaintRuleSpecApplyConfiguration{}
+	case resourcev1.SchemeGroupVersion.WithKind("DeviceTaintRuleStatus"):
+		return &applyconfigurationsresourcev1.DeviceTaintRuleStatusApplyConfiguration{}
+	case resourcev1.SchemeGroupVersion.WithKind("DeviceTaintSelector"):
+		return &applyconfigurationsresourcev1.DeviceTaintSelectorApplyConfiguration{}
 	case resourcev1.SchemeGroupVersion.WithKind("DeviceToleration"):
 		return &applyconfigurationsresourcev1.DeviceTolerationApplyConfiguration{}
 	case resourcev1.SchemeGroupVersion.WithKind("ExactDeviceRequest"):
 		return &applyconfigurationsresourcev1.ExactDeviceRequestApplyConfiguration{}
 	case resourcev1.SchemeGroupVersion.WithKind("NetworkDeviceData"):
 		return &applyconfigurationsresourcev1.NetworkDeviceDataApplyConfiguration{}
-	case resourcev1.SchemeGroupVersion.WithKind("NodeAllocatableResourceMapping"):
-		return &applyconfigurationsresourcev1.NodeAllocatableResourceMappingApplyConfiguration{}
+	case resourcev1.SchemeGroupVersion.WithKind("NodeAllocatableMapping"):
+		return &applyconfigurationsresourcev1.NodeAllocatableMappingApplyConfiguration{}
+	case resourcev1.SchemeGroupVersion.WithKind("NodeAllocatableOverhead"):
+		return &applyconfigurationsresourcev1.NodeAllocatableOverheadApplyConfiguration{}
+	case resourcev1.SchemeGroupVersion.WithKind("NodeAllocatableResource"):
+		return &applyconfigurationsresourcev1.NodeAllocatableResourceApplyConfiguration{}
 	case resourcev1.SchemeGroupVersion.WithKind("OpaqueDeviceConfiguration"):
 		return &applyconfigurationsresourcev1.OpaqueDeviceConfigurationApplyConfiguration{}
 	case resourcev1.SchemeGroupVersion.WithKind("ResourceClaim"):
@@ -1656,6 +1728,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &resourcev1alpha3.DeviceTaintRuleStatusApplyConfiguration{}
 	case v1alpha3.SchemeGroupVersion.WithKind("DeviceTaintSelector"):
 		return &resourcev1alpha3.DeviceTaintSelectorApplyConfiguration{}
+	case v1alpha3.SchemeGroupVersion.WithKind("PartitionTypeStatus"):
+		return &resourcev1alpha3.PartitionTypeStatusApplyConfiguration{}
 	case v1alpha3.SchemeGroupVersion.WithKind("PoolStatus"):
 		return &resourcev1alpha3.PoolStatusApplyConfiguration{}
 	case v1alpha3.SchemeGroupVersion.WithKind("ResourcePoolStatusRequest"):
@@ -1664,6 +1738,10 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &resourcev1alpha3.ResourcePoolStatusRequestSpecApplyConfiguration{}
 	case v1alpha3.SchemeGroupVersion.WithKind("ResourcePoolStatusRequestStatus"):
 		return &resourcev1alpha3.ResourcePoolStatusRequestStatusApplyConfiguration{}
+	case v1alpha3.SchemeGroupVersion.WithKind("ShareableCapacityStatus"):
+		return &resourcev1alpha3.ShareableCapacityStatusApplyConfiguration{}
+	case v1alpha3.SchemeGroupVersion.WithKind("ShareableSummaryStatus"):
+		return &resourcev1alpha3.ShareableSummaryStatusApplyConfiguration{}
 
 		// Group=resource.k8s.io, Version=v1beta1
 	case resourcev1beta1.SchemeGroupVersion.WithKind("AllocatedDeviceStatus"):
@@ -1710,6 +1788,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &applyconfigurationsresourcev1beta1.DeviceConstraintApplyConfiguration{}
 	case resourcev1beta1.SchemeGroupVersion.WithKind("DeviceCounterConsumption"):
 		return &applyconfigurationsresourcev1beta1.DeviceCounterConsumptionApplyConfiguration{}
+	case resourcev1beta1.SchemeGroupVersion.WithKind("DeviceDerivedAttribute"):
+		return &applyconfigurationsresourcev1beta1.DeviceDerivedAttributeApplyConfiguration{}
 	case resourcev1beta1.SchemeGroupVersion.WithKind("DeviceRequest"):
 		return &applyconfigurationsresourcev1beta1.DeviceRequestApplyConfiguration{}
 	case resourcev1beta1.SchemeGroupVersion.WithKind("DeviceRequestAllocationResult"):
@@ -1724,8 +1804,12 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &applyconfigurationsresourcev1beta1.DeviceTolerationApplyConfiguration{}
 	case resourcev1beta1.SchemeGroupVersion.WithKind("NetworkDeviceData"):
 		return &applyconfigurationsresourcev1beta1.NetworkDeviceDataApplyConfiguration{}
-	case resourcev1beta1.SchemeGroupVersion.WithKind("NodeAllocatableResourceMapping"):
-		return &applyconfigurationsresourcev1beta1.NodeAllocatableResourceMappingApplyConfiguration{}
+	case resourcev1beta1.SchemeGroupVersion.WithKind("NodeAllocatableMapping"):
+		return &applyconfigurationsresourcev1beta1.NodeAllocatableMappingApplyConfiguration{}
+	case resourcev1beta1.SchemeGroupVersion.WithKind("NodeAllocatableOverhead"):
+		return &applyconfigurationsresourcev1beta1.NodeAllocatableOverheadApplyConfiguration{}
+	case resourcev1beta1.SchemeGroupVersion.WithKind("NodeAllocatableResource"):
+		return &applyconfigurationsresourcev1beta1.NodeAllocatableResourceApplyConfiguration{}
 	case resourcev1beta1.SchemeGroupVersion.WithKind("OpaqueDeviceConfiguration"):
 		return &applyconfigurationsresourcev1beta1.OpaqueDeviceConfigurationApplyConfiguration{}
 	case resourcev1beta1.SchemeGroupVersion.WithKind("ResourceClaim"):
@@ -1790,6 +1874,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &applyconfigurationsresourcev1beta2.DeviceConstraintApplyConfiguration{}
 	case resourcev1beta2.SchemeGroupVersion.WithKind("DeviceCounterConsumption"):
 		return &applyconfigurationsresourcev1beta2.DeviceCounterConsumptionApplyConfiguration{}
+	case resourcev1beta2.SchemeGroupVersion.WithKind("DeviceDerivedAttribute"):
+		return &applyconfigurationsresourcev1beta2.DeviceDerivedAttributeApplyConfiguration{}
 	case resourcev1beta2.SchemeGroupVersion.WithKind("DeviceRequest"):
 		return &applyconfigurationsresourcev1beta2.DeviceRequestApplyConfiguration{}
 	case resourcev1beta2.SchemeGroupVersion.WithKind("DeviceRequestAllocationResult"):
@@ -1814,8 +1900,12 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &applyconfigurationsresourcev1beta2.ExactDeviceRequestApplyConfiguration{}
 	case resourcev1beta2.SchemeGroupVersion.WithKind("NetworkDeviceData"):
 		return &applyconfigurationsresourcev1beta2.NetworkDeviceDataApplyConfiguration{}
-	case resourcev1beta2.SchemeGroupVersion.WithKind("NodeAllocatableResourceMapping"):
-		return &applyconfigurationsresourcev1beta2.NodeAllocatableResourceMappingApplyConfiguration{}
+	case resourcev1beta2.SchemeGroupVersion.WithKind("NodeAllocatableMapping"):
+		return &applyconfigurationsresourcev1beta2.NodeAllocatableMappingApplyConfiguration{}
+	case resourcev1beta2.SchemeGroupVersion.WithKind("NodeAllocatableOverhead"):
+		return &applyconfigurationsresourcev1beta2.NodeAllocatableOverheadApplyConfiguration{}
+	case resourcev1beta2.SchemeGroupVersion.WithKind("NodeAllocatableResource"):
+		return &applyconfigurationsresourcev1beta2.NodeAllocatableResourceApplyConfiguration{}
 	case resourcev1beta2.SchemeGroupVersion.WithKind("OpaqueDeviceConfiguration"):
 		return &applyconfigurationsresourcev1beta2.OpaqueDeviceConfigurationApplyConfiguration{}
 	case resourcev1beta2.SchemeGroupVersion.WithKind("ResourceClaim"):
@@ -1841,41 +1931,107 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 	case schedulingv1.SchemeGroupVersion.WithKind("PriorityClass"):
 		return &applyconfigurationsschedulingv1.PriorityClassApplyConfiguration{}
 
-		// Group=scheduling.k8s.io, Version=v1alpha2
-	case schedulingv1alpha2.SchemeGroupVersion.WithKind("GangSchedulingPolicy"):
-		return &applyconfigurationsschedulingv1alpha2.GangSchedulingPolicyApplyConfiguration{}
-	case schedulingv1alpha2.SchemeGroupVersion.WithKind("PodGroup"):
-		return &applyconfigurationsschedulingv1alpha2.PodGroupApplyConfiguration{}
-	case schedulingv1alpha2.SchemeGroupVersion.WithKind("PodGroupResourceClaim"):
-		return &applyconfigurationsschedulingv1alpha2.PodGroupResourceClaimApplyConfiguration{}
-	case schedulingv1alpha2.SchemeGroupVersion.WithKind("PodGroupResourceClaimStatus"):
-		return &applyconfigurationsschedulingv1alpha2.PodGroupResourceClaimStatusApplyConfiguration{}
-	case schedulingv1alpha2.SchemeGroupVersion.WithKind("PodGroupSchedulingConstraints"):
-		return &applyconfigurationsschedulingv1alpha2.PodGroupSchedulingConstraintsApplyConfiguration{}
-	case schedulingv1alpha2.SchemeGroupVersion.WithKind("PodGroupSchedulingPolicy"):
-		return &applyconfigurationsschedulingv1alpha2.PodGroupSchedulingPolicyApplyConfiguration{}
-	case schedulingv1alpha2.SchemeGroupVersion.WithKind("PodGroupSpec"):
-		return &applyconfigurationsschedulingv1alpha2.PodGroupSpecApplyConfiguration{}
-	case schedulingv1alpha2.SchemeGroupVersion.WithKind("PodGroupStatus"):
-		return &applyconfigurationsschedulingv1alpha2.PodGroupStatusApplyConfiguration{}
-	case schedulingv1alpha2.SchemeGroupVersion.WithKind("PodGroupTemplate"):
-		return &applyconfigurationsschedulingv1alpha2.PodGroupTemplateApplyConfiguration{}
-	case schedulingv1alpha2.SchemeGroupVersion.WithKind("PodGroupTemplateReference"):
-		return &applyconfigurationsschedulingv1alpha2.PodGroupTemplateReferenceApplyConfiguration{}
-	case schedulingv1alpha2.SchemeGroupVersion.WithKind("TopologyConstraint"):
-		return &applyconfigurationsschedulingv1alpha2.TopologyConstraintApplyConfiguration{}
-	case schedulingv1alpha2.SchemeGroupVersion.WithKind("TypedLocalObjectReference"):
-		return &applyconfigurationsschedulingv1alpha2.TypedLocalObjectReferenceApplyConfiguration{}
-	case schedulingv1alpha2.SchemeGroupVersion.WithKind("Workload"):
-		return &applyconfigurationsschedulingv1alpha2.WorkloadApplyConfiguration{}
-	case schedulingv1alpha2.SchemeGroupVersion.WithKind("WorkloadPodGroupTemplateReference"):
-		return &applyconfigurationsschedulingv1alpha2.WorkloadPodGroupTemplateReferenceApplyConfiguration{}
-	case schedulingv1alpha2.SchemeGroupVersion.WithKind("WorkloadSpec"):
-		return &applyconfigurationsschedulingv1alpha2.WorkloadSpecApplyConfiguration{}
+		// Group=scheduling.k8s.io, Version=v1alpha3
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("CompositeDisruptionMode"):
+		return &applyconfigurationsschedulingv1alpha3.CompositeDisruptionModeApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("CompositeGangSchedulingPolicy"):
+		return &applyconfigurationsschedulingv1alpha3.CompositeGangSchedulingPolicyApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("CompositePodGroup"):
+		return &applyconfigurationsschedulingv1alpha3.CompositePodGroupApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("CompositePodGroupSchedulingConstraints"):
+		return &applyconfigurationsschedulingv1alpha3.CompositePodGroupSchedulingConstraintsApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("CompositePodGroupSchedulingPolicy"):
+		return &applyconfigurationsschedulingv1alpha3.CompositePodGroupSchedulingPolicyApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("CompositePodGroupSpec"):
+		return &applyconfigurationsschedulingv1alpha3.CompositePodGroupSpecApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("CompositePodGroupStatus"):
+		return &applyconfigurationsschedulingv1alpha3.CompositePodGroupStatusApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("CompositePodGroupTemplate"):
+		return &applyconfigurationsschedulingv1alpha3.CompositePodGroupTemplateApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("DisruptionMode"):
+		return &applyconfigurationsschedulingv1alpha3.DisruptionModeApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("GangSchedulingPolicy"):
+		return &applyconfigurationsschedulingv1alpha3.GangSchedulingPolicyApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("PodGroup"):
+		return &applyconfigurationsschedulingv1alpha3.PodGroupApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("PodGroupResourceClaim"):
+		return &applyconfigurationsschedulingv1alpha3.PodGroupResourceClaimApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("PodGroupResourceClaimStatus"):
+		return &applyconfigurationsschedulingv1alpha3.PodGroupResourceClaimStatusApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("PodGroupSchedulingConstraints"):
+		return &applyconfigurationsschedulingv1alpha3.PodGroupSchedulingConstraintsApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("PodGroupSchedulingPolicy"):
+		return &applyconfigurationsschedulingv1alpha3.PodGroupSchedulingPolicyApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("PodGroupSpec"):
+		return &applyconfigurationsschedulingv1alpha3.PodGroupSpecApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("PodGroupStatus"):
+		return &applyconfigurationsschedulingv1alpha3.PodGroupStatusApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("PodGroupTemplate"):
+		return &applyconfigurationsschedulingv1alpha3.PodGroupTemplateApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("TopologyConstraint"):
+		return &applyconfigurationsschedulingv1alpha3.TopologyConstraintApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("TypedLocalObjectReference"):
+		return &applyconfigurationsschedulingv1alpha3.TypedLocalObjectReferenceApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("Workload"):
+		return &applyconfigurationsschedulingv1alpha3.WorkloadApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("WorkloadPodGroupDisruptionMode"):
+		return &applyconfigurationsschedulingv1alpha3.WorkloadPodGroupDisruptionModeApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("WorkloadPodGroupGangSchedulingPolicy"):
+		return &applyconfigurationsschedulingv1alpha3.WorkloadPodGroupGangSchedulingPolicyApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("WorkloadPodGroupResourceClaim"):
+		return &applyconfigurationsschedulingv1alpha3.WorkloadPodGroupResourceClaimApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("WorkloadPodGroupSchedulingConstraints"):
+		return &applyconfigurationsschedulingv1alpha3.WorkloadPodGroupSchedulingConstraintsApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("WorkloadPodGroupSchedulingPolicy"):
+		return &applyconfigurationsschedulingv1alpha3.WorkloadPodGroupSchedulingPolicyApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("WorkloadReference"):
+		return &applyconfigurationsschedulingv1alpha3.WorkloadReferenceApplyConfiguration{}
+	case schedulingv1alpha3.SchemeGroupVersion.WithKind("WorkloadSpec"):
+		return &applyconfigurationsschedulingv1alpha3.WorkloadSpecApplyConfiguration{}
 
 		// Group=scheduling.k8s.io, Version=v1beta1
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("CompositeDisruptionMode"):
+		return &applyconfigurationsschedulingv1beta1.CompositeDisruptionModeApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("CompositeGangSchedulingPolicy"):
+		return &applyconfigurationsschedulingv1beta1.CompositeGangSchedulingPolicyApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("CompositePodGroupSchedulingConstraints"):
+		return &applyconfigurationsschedulingv1beta1.CompositePodGroupSchedulingConstraintsApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("CompositePodGroupSchedulingPolicy"):
+		return &applyconfigurationsschedulingv1beta1.CompositePodGroupSchedulingPolicyApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("CompositePodGroupTemplate"):
+		return &applyconfigurationsschedulingv1beta1.CompositePodGroupTemplateApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("DisruptionMode"):
+		return &applyconfigurationsschedulingv1beta1.DisruptionModeApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("GangSchedulingPolicy"):
+		return &applyconfigurationsschedulingv1beta1.GangSchedulingPolicyApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("PodGroup"):
+		return &applyconfigurationsschedulingv1beta1.PodGroupApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("PodGroupResourceClaim"):
+		return &applyconfigurationsschedulingv1beta1.PodGroupResourceClaimApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("PodGroupResourceClaimStatus"):
+		return &applyconfigurationsschedulingv1beta1.PodGroupResourceClaimStatusApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("PodGroupSchedulingConstraints"):
+		return &applyconfigurationsschedulingv1beta1.PodGroupSchedulingConstraintsApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("PodGroupSchedulingPolicy"):
+		return &applyconfigurationsschedulingv1beta1.PodGroupSchedulingPolicyApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("PodGroupSpec"):
+		return &applyconfigurationsschedulingv1beta1.PodGroupSpecApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("PodGroupStatus"):
+		return &applyconfigurationsschedulingv1beta1.PodGroupStatusApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("PodGroupTemplate"):
+		return &applyconfigurationsschedulingv1beta1.PodGroupTemplateApplyConfiguration{}
 	case schedulingv1beta1.SchemeGroupVersion.WithKind("PriorityClass"):
 		return &applyconfigurationsschedulingv1beta1.PriorityClassApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("TopologyConstraint"):
+		return &applyconfigurationsschedulingv1beta1.TopologyConstraintApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("TypedLocalObjectReference"):
+		return &applyconfigurationsschedulingv1beta1.TypedLocalObjectReferenceApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("Workload"):
+		return &applyconfigurationsschedulingv1beta1.WorkloadApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("WorkloadReference"):
+		return &applyconfigurationsschedulingv1beta1.WorkloadReferenceApplyConfiguration{}
+	case schedulingv1beta1.SchemeGroupVersion.WithKind("WorkloadSpec"):
+		return &applyconfigurationsschedulingv1beta1.WorkloadSpecApplyConfiguration{}
 
 		// Group=storage.k8s.io, Version=v1
 	case storagev1.SchemeGroupVersion.WithKind("CSIDriver"):
@@ -1888,10 +2044,16 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &applyconfigurationsstoragev1.CSINodeDriverApplyConfiguration{}
 	case storagev1.SchemeGroupVersion.WithKind("CSINodeSpec"):
 		return &applyconfigurationsstoragev1.CSINodeSpecApplyConfiguration{}
+	case storagev1.SchemeGroupVersion.WithKind("CSINodeStatus"):
+		return &applyconfigurationsstoragev1.CSINodeStatusApplyConfiguration{}
 	case storagev1.SchemeGroupVersion.WithKind("CSIStorageCapacity"):
 		return &applyconfigurationsstoragev1.CSIStorageCapacityApplyConfiguration{}
 	case storagev1.SchemeGroupVersion.WithKind("StorageClass"):
 		return &applyconfigurationsstoragev1.StorageClassApplyConfiguration{}
+	case storagev1.SchemeGroupVersion.WithKind("StorageHealth"):
+		return &applyconfigurationsstoragev1.StorageHealthApplyConfiguration{}
+	case storagev1.SchemeGroupVersion.WithKind("StorageHealthCondition"):
+		return &applyconfigurationsstoragev1.StorageHealthConditionApplyConfiguration{}
 	case storagev1.SchemeGroupVersion.WithKind("TokenRequest"):
 		return &applyconfigurationsstoragev1.TokenRequestApplyConfiguration{}
 	case storagev1.SchemeGroupVersion.WithKind("VolumeAttachment"):
@@ -1936,10 +2098,16 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &applyconfigurationsstoragev1beta1.CSINodeDriverApplyConfiguration{}
 	case storagev1beta1.SchemeGroupVersion.WithKind("CSINodeSpec"):
 		return &applyconfigurationsstoragev1beta1.CSINodeSpecApplyConfiguration{}
+	case storagev1beta1.SchemeGroupVersion.WithKind("CSINodeStatus"):
+		return &applyconfigurationsstoragev1beta1.CSINodeStatusApplyConfiguration{}
 	case storagev1beta1.SchemeGroupVersion.WithKind("CSIStorageCapacity"):
 		return &applyconfigurationsstoragev1beta1.CSIStorageCapacityApplyConfiguration{}
 	case storagev1beta1.SchemeGroupVersion.WithKind("StorageClass"):
 		return &applyconfigurationsstoragev1beta1.StorageClassApplyConfiguration{}
+	case storagev1beta1.SchemeGroupVersion.WithKind("StorageHealth"):
+		return &applyconfigurationsstoragev1beta1.StorageHealthApplyConfiguration{}
+	case storagev1beta1.SchemeGroupVersion.WithKind("StorageHealthCondition"):
+		return &applyconfigurationsstoragev1beta1.StorageHealthConditionApplyConfiguration{}
 	case storagev1beta1.SchemeGroupVersion.WithKind("TokenRequest"):
 		return &applyconfigurationsstoragev1beta1.TokenRequestApplyConfiguration{}
 	case storagev1beta1.SchemeGroupVersion.WithKind("VolumeAttachment"):
@@ -1957,6 +2125,14 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 	case storagev1beta1.SchemeGroupVersion.WithKind("VolumeNodeResources"):
 		return &applyconfigurationsstoragev1beta1.VolumeNodeResourcesApplyConfiguration{}
 
+		// Group=storagemigration.k8s.io, Version=v1
+	case storagemigrationv1.SchemeGroupVersion.WithKind("StorageVersionMigration"):
+		return &applyconfigurationsstoragemigrationv1.StorageVersionMigrationApplyConfiguration{}
+	case storagemigrationv1.SchemeGroupVersion.WithKind("StorageVersionMigrationSpec"):
+		return &applyconfigurationsstoragemigrationv1.StorageVersionMigrationSpecApplyConfiguration{}
+	case storagemigrationv1.SchemeGroupVersion.WithKind("StorageVersionMigrationStatus"):
+		return &applyconfigurationsstoragemigrationv1.StorageVersionMigrationStatusApplyConfiguration{}
+
 		// Group=storagemigration.k8s.io, Version=v1beta1
 	case storagemigrationv1beta1.SchemeGroupVersion.WithKind("StorageVersionMigration"):
 		return &applyconfigurationsstoragemigrationv1beta1.StorageVersionMigrationApplyConfiguration{}
diff --git a/vendor/k8s.io/client-go/discovery/aggregated_discovery.go b/vendor/k8s.io/client-go/discovery/aggregated_discovery.go
index 82d46b4895..2111b26454 100644
--- a/vendor/k8s.io/client-go/discovery/aggregated_discovery.go
+++ b/vendor/k8s.io/client-go/discovery/aggregated_discovery.go
@@ -20,7 +20,6 @@ import (
 	"fmt"
 
 	apidiscovery "k8s.io/api/apidiscovery/v2"
-	apidiscoveryv2beta1 "k8s.io/api/apidiscovery/v2beta1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 )
@@ -155,124 +154,3 @@ func convertAPISubresource(parent metav1.APIResource, in apidiscovery.APISubreso
 	result.Verbs = in.Verbs
 	return result, nil
 }
-
-// Please note the functions below will be removed in v1.35. They facilitate conversion
-// between the deprecated type apidiscoveryv2beta1.APIGroupDiscoveryList.
-
-// SplitGroupsAndResourcesV2Beta1 transforms "aggregated" discovery top-level structure into
-// the previous "unaggregated" discovery groups and resources.
-// Deprecated: Please use SplitGroupsAndResources
-func SplitGroupsAndResourcesV2Beta1(aggregatedGroups apidiscoveryv2beta1.APIGroupDiscoveryList) (
-	*metav1.APIGroupList,
-	map[schema.GroupVersion]*metav1.APIResourceList,
-	map[schema.GroupVersion]error) {
-	// Aggregated group list will contain the entirety of discovery, including
-	// groups, versions, and resources. GroupVersions marked "stale" are failed.
-	groups := []*metav1.APIGroup{}
-	failedGVs := map[schema.GroupVersion]error{}
-	resourcesByGV := map[schema.GroupVersion]*metav1.APIResourceList{}
-	for _, aggGroup := range aggregatedGroups.Items {
-		group, resources, failed := convertAPIGroupv2beta1(aggGroup)
-		groups = append(groups, group)
-		for gv, resourceList := range resources {
-			resourcesByGV[gv] = resourceList
-		}
-		for gv, err := range failed {
-			failedGVs[gv] = err
-		}
-	}
-	// Transform slice of groups to group list before returning.
-	groupList := &metav1.APIGroupList{}
-	groupList.Groups = make([]metav1.APIGroup, 0, len(groups))
-	for _, group := range groups {
-		groupList.Groups = append(groupList.Groups, *group)
-	}
-	return groupList, resourcesByGV, failedGVs
-}
-
-// convertAPIGroupv2beta1 tranforms an "aggregated" APIGroupDiscovery to an "legacy" APIGroup,
-// also returning the map of APIResourceList for resources within GroupVersions.
-func convertAPIGroupv2beta1(g apidiscoveryv2beta1.APIGroupDiscovery) (
-	*metav1.APIGroup,
-	map[schema.GroupVersion]*metav1.APIResourceList,
-	map[schema.GroupVersion]error) {
-	// Iterate through versions to convert to group and resources.
-	group := &metav1.APIGroup{}
-	gvResources := map[schema.GroupVersion]*metav1.APIResourceList{}
-	failedGVs := map[schema.GroupVersion]error{}
-	group.Name = g.ObjectMeta.Name
-	for _, v := range g.Versions {
-		gv := schema.GroupVersion{Group: g.Name, Version: v.Version}
-		if v.Freshness == apidiscoveryv2beta1.DiscoveryFreshnessStale {
-			failedGVs[gv] = StaleGroupVersionError{gv: gv}
-			continue
-		}
-		version := metav1.GroupVersionForDiscovery{}
-		version.GroupVersion = gv.String()
-		version.Version = v.Version
-		group.Versions = append(group.Versions, version)
-		// PreferredVersion is first non-stale Version
-		if group.PreferredVersion == (metav1.GroupVersionForDiscovery{}) {
-			group.PreferredVersion = version
-		}
-		resourceList := &metav1.APIResourceList{}
-		resourceList.GroupVersion = gv.String()
-		for _, r := range v.Resources {
-			resource, err := convertAPIResourcev2beta1(r)
-			if err == nil {
-				resourceList.APIResources = append(resourceList.APIResources, resource)
-			}
-			// Subresources field in new format get transformed into full APIResources.
-			// It is possible a partial result with an error was returned to be used
-			// as the parent resource for the subresource.
-			for _, subresource := range r.Subresources {
-				sr, err := convertAPISubresourcev2beta1(resource, subresource)
-				if err == nil {
-					resourceList.APIResources = append(resourceList.APIResources, sr)
-				}
-			}
-		}
-		gvResources[gv] = resourceList
-	}
-	return group, gvResources, failedGVs
-}
-
-// convertAPIResource tranforms a APIResourceDiscovery to an APIResource. We are
-// resilient to missing GVK, since this resource might be the parent resource
-// for a subresource. If the parent is missing a GVK, it is not returned in
-// discovery, and the subresource MUST have the GVK.
-func convertAPIResourcev2beta1(in apidiscoveryv2beta1.APIResourceDiscovery) (metav1.APIResource, error) {
-	result := metav1.APIResource{
-		Name:         in.Resource,
-		SingularName: in.SingularResource,
-		Namespaced:   in.Scope == apidiscoveryv2beta1.ScopeNamespace,
-		Verbs:        in.Verbs,
-		ShortNames:   in.ShortNames,
-		Categories:   in.Categories,
-	}
-	// Can return partial result with error, which can be the parent for a
-	// subresource. Do not add this result to the returned discovery resources.
-	if in.ResponseKind == nil || (*in.ResponseKind) == emptyKind {
-		return result, fmt.Errorf("discovery resource %s missing GVK", in.Resource)
-	}
-	result.Group = in.ResponseKind.Group
-	result.Version = in.ResponseKind.Version
-	result.Kind = in.ResponseKind.Kind
-	return result, nil
-}
-
-// convertAPISubresource tranforms a APISubresourceDiscovery to an APIResource.
-func convertAPISubresourcev2beta1(parent metav1.APIResource, in apidiscoveryv2beta1.APISubresourceDiscovery) (metav1.APIResource, error) {
-	result := metav1.APIResource{}
-	if in.ResponseKind == nil || (*in.ResponseKind) == emptyKind {
-		return result, fmt.Errorf("subresource %s/%s missing GVK", parent.Name, in.Subresource)
-	}
-	result.Name = fmt.Sprintf("%s/%s", parent.Name, in.Subresource)
-	result.SingularName = parent.SingularName
-	result.Namespaced = parent.Namespaced
-	result.Group = in.ResponseKind.Group
-	result.Version = in.ResponseKind.Version
-	result.Kind = in.ResponseKind.Kind
-	result.Verbs = in.Verbs
-	return result, nil
-}
diff --git a/vendor/k8s.io/client-go/discovery/discovery_client.go b/vendor/k8s.io/client-go/discovery/discovery_client.go
index aae94f9b8a..355c701939 100644
--- a/vendor/k8s.io/client-go/discovery/discovery_client.go
+++ b/vendor/k8s.io/client-go/discovery/discovery_client.go
@@ -33,7 +33,6 @@ import (
 	"google.golang.org/protobuf/proto"
 
 	apidiscoveryv2 "k8s.io/api/apidiscovery/v2"
-	apidiscoveryv2beta1 "k8s.io/api/apidiscovery/v2beta1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -60,22 +59,24 @@ const (
 	defaultBurst = 300
 
 	AcceptV1 = runtime.ContentTypeJSON
-	// Aggregated discovery content-type (v2beta1). NOTE: content-type parameters
+	// Aggregated discovery content-type. NOTE: content-type parameters
 	// MUST be ordered (g, v, as) for server in "Accept" header (BUT we are resilient
 	// to ordering when comparing returned values in "Content-Type" header).
-	AcceptV2Beta1  = runtime.ContentTypeJSON + ";" + "g=apidiscovery.k8s.io;v=v2beta1;as=APIGroupDiscoveryList"
 	AcceptV2       = runtime.ContentTypeJSON + ";" + "g=apidiscovery.k8s.io;v=v2;as=APIGroupDiscoveryList"
 	AcceptV2NoPeer = runtime.ContentTypeJSON + ";" + "g=apidiscovery.k8s.io;v=v2;as=APIGroupDiscoveryList;profile=nopeer"
 	// Prioritize aggregated discovery by placing first in the order of discovery accept types.
-	acceptDiscoveryFormats = AcceptV2 + "," + AcceptV2Beta1 + "," + AcceptV1
+	acceptDiscoveryFormats = AcceptV2 + "," + AcceptV1
 )
 
 // Aggregated discovery content-type GVK.
-var v2Beta1GVK = schema.GroupVersionKind{Group: "apidiscovery.k8s.io", Version: "v2beta1", Kind: "APIGroupDiscoveryList"}
 var v2GVK = schema.GroupVersionKind{Group: "apidiscovery.k8s.io", Version: "v2", Kind: "APIGroupDiscoveryList"}
 
 // DiscoveryInterface holds the methods that discover server-supported API groups,
 // versions and resources.
+//
+// DiscoveryInterfaceWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use DiscoveryInterfaceWithContext instead.
 type DiscoveryInterface interface {
 	RESTClient() restclient.Interface
 	ServerGroupsInterface
@@ -86,22 +87,123 @@ type DiscoveryInterface interface {
 	// Returns copy of current discovery client that will only
 	// receive the legacy discovery format, or pointer to current
 	// discovery client if it does not support legacy-only discovery.
+	//
+	// DiscoveryInterfaceWithContext.WithLegacyWithContext is a better alternative because it supports contextual logging and cancellation.
+	//
+	// Contextual logging: Use DiscoveryInterfaceWithContext.WithLegacyWithContext instead.
 	WithLegacy() DiscoveryInterface
 }
 
+// DiscoveryInterfaceWithContext holds the methods that discover server-supported API groups,
+// versions and resources.
+type DiscoveryInterfaceWithContext interface {
+	RESTClient() restclient.Interface
+	ServerGroupsInterfaceWithContext
+	ServerResourcesInterfaceWithContext
+	ServerVersionInterfaceWithContext
+	OpenAPISchemaInterfaceWithContext
+	OpenAPIV3SchemaInterfaceWithContext
+	// Returns copy of current discovery client that will only
+	// receive the legacy discovery format, or pointer to current
+	// discovery client if it does not support legacy-only discovery.
+	WithLegacyWithContext(ctx context.Context) DiscoveryInterfaceWithContext
+}
+
+// DiscoveryInterfaces combines both interface variants.
+type DiscoveryInterfaces interface {
+	DiscoveryInterface
+	DiscoveryInterfaceWithContext
+}
+
+func ToDiscoveryInterfaceWithContext(i DiscoveryInterface) DiscoveryInterfaceWithContext {
+	if i == nil {
+		return nil
+	}
+	if i, ok := i.(DiscoveryInterfaceWithContext); ok {
+		return i
+	}
+	return &discoveryInterfaceWrapper{
+		ServerGroupsInterfaceWithContext:    ToServerGroupsInterfaceWithContext(i),
+		ServerResourcesInterfaceWithContext: ToServerResourcesInterfaceWithContext(i),
+		ServerVersionInterfaceWithContext:   ToServerVersionInterfaceWithContext(i),
+		OpenAPISchemaInterfaceWithContext:   ToOpenAPISchemaInterfaceWithContext(i),
+		OpenAPIV3SchemaInterfaceWithContext: OpenAPIV3ToSchemaInterfaceWithContext(i),
+		delegate:                            i,
+	}
+}
+
+type discoveryInterfaceWrapper struct {
+	ServerGroupsInterfaceWithContext
+	ServerResourcesInterfaceWithContext
+	ServerVersionInterfaceWithContext
+	OpenAPISchemaInterfaceWithContext
+	OpenAPIV3SchemaInterfaceWithContext
+	delegate DiscoveryInterface
+}
+
+func (i *discoveryInterfaceWrapper) RESTClient() restclient.Interface {
+	return i.delegate.RESTClient()
+}
+
+func (i *discoveryInterfaceWrapper) WithLegacyWithContext(ctx context.Context) DiscoveryInterfaceWithContext {
+	return ToDiscoveryInterfaceWithContext(i.delegate.WithLegacy())
+}
+
 // AggregatedDiscoveryInterface extends DiscoveryInterface to include a method to possibly
 // return discovery resources along with the discovery groups, which is what the newer
 // aggregated discovery format does (APIGroupDiscoveryList).
+//
+// AggregatedDiscoveryInterfaceWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use AggregatedDiscoveryInterfaceWithContext instead.
 type AggregatedDiscoveryInterface interface {
 	DiscoveryInterface
 
+	// AggregatedDiscoveryInterfaceWithContext.GroupsAndMaybeResourcesWithContext is a better alternative because it supports contextual logging and cancellation.
+	//
+	// Contextual logging: Use AggregatedDiscoveryInterfaceWithContext.GroupsAndMaybeResourcesWithContext instead.
 	GroupsAndMaybeResources() (*metav1.APIGroupList, map[schema.GroupVersion]*metav1.APIResourceList, map[schema.GroupVersion]error, error)
 }
 
+// AggregatedDiscoveryInterfaceWithContext extends DiscoveryInterface to include a method to possibly
+// return discovery resources along with the discovery groups, which is what the newer
+// aggregated discovery format does (APIGroupDiscoveryList).
+type AggregatedDiscoveryInterfaceWithContext interface {
+	DiscoveryInterfaceWithContext
+
+	GroupsAndMaybeResourcesWithContext(ctx context.Context) (*metav1.APIGroupList, map[schema.GroupVersion]*metav1.APIResourceList, map[schema.GroupVersion]error, error)
+}
+
+func ToAggregatedDiscoveryInterfaceWithContext(i AggregatedDiscoveryInterface) AggregatedDiscoveryInterfaceWithContext {
+	if i == nil {
+		return nil
+	}
+	if i, ok := i.(AggregatedDiscoveryInterfaceWithContext); ok {
+		return i
+	}
+	return &aggregatedDiscoveryInterfaceWrapper{
+		DiscoveryInterfaceWithContext: ToDiscoveryInterfaceWithContext(i),
+		delegate:                      i,
+	}
+}
+
+type aggregatedDiscoveryInterfaceWrapper struct {
+	DiscoveryInterfaceWithContext
+	delegate AggregatedDiscoveryInterface
+}
+
+func (i *aggregatedDiscoveryInterfaceWrapper) GroupsAndMaybeResourcesWithContext(ctx context.Context) (*metav1.APIGroupList, map[schema.GroupVersion]*metav1.APIResourceList, map[schema.GroupVersion]error, error) {
+	return i.delegate.GroupsAndMaybeResources()
+}
+
 // CachedDiscoveryInterface is a DiscoveryInterface with cache invalidation and freshness.
 // Note that If the ServerResourcesForGroupVersion method returns a cache miss
 // error, the user needs to explicitly call Invalidate to clear the cache,
 // otherwise the same cache miss error will be returned next time.
+//
+// CachedDiscoveryInterfaceWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use CachedDiscoveryInterfaceWithContext instead.
 type CachedDiscoveryInterface interface {
 	DiscoveryInterface
 	// Fresh is supposed to tell the caller whether or not to retry if the cache
@@ -109,58 +211,343 @@ type CachedDiscoveryInterface interface {
 	//
 	// TODO: this needs to be revisited, this interface can't be locked properly
 	// and doesn't make a lot of sense.
+	//
+	// CachedDiscoveryInterfaceWithContext.FreshWithContext is a better alternative because it supports contextual logging and cancellation.
+	//
+	// Contextual logging: Use CachedDiscoveryInterfaceWithContext.FreshWithContext instead.
 	Fresh() bool
 	// Invalidate enforces that no cached data that is older than the current time
 	// is used.
+	//
+	// CachedDiscoveryInterfaceWithContext.InvalidateWithContext is a better alternative because it supports contextual logging and cancellation.
+	//
+	// Contextual logging: Use CachedDiscoveryInterfaceWithContext.InvalidateWithContext instead.
 	Invalidate()
 }
 
+// CachedDiscoveryInterfaceWithContext is a DiscoveryInterfaceWithContext with cache invalidation and freshness.
+// Note that If the ServerResourcesForGroupVersion method returns a cache miss
+// error, the user needs to explicitly call Invalidate to clear the cache,
+// otherwise the same cache miss error will be returned next time.
+type CachedDiscoveryInterfaceWithContext interface {
+	DiscoveryInterfaceWithContext
+	// Fresh is supposed to tell the caller whether or not to retry if the cache
+	// fails to find something (false = retry, true = no need to retry).
+	//
+	// TODO: this needs to be revisited, this interface can't be locked properly
+	// and doesn't make a lot of sense.
+	FreshWithContext(ctx context.Context) bool
+	// Invalidate enforces that no cached data that is older than the current time
+	// is used.
+	InvalidateWithContext(ctx context.Context)
+}
+
+func ToCachedDiscoveryInterfaceWithContext(i CachedDiscoveryInterface) CachedDiscoveryInterfaceWithContext {
+	if i == nil {
+		return nil
+	}
+	if i, ok := i.(CachedDiscoveryInterfaceWithContext); ok {
+		return i
+	}
+	return &cachedDiscoveryInterfaceWrapper{
+		DiscoveryInterfaceWithContext: ToDiscoveryInterfaceWithContext(i),
+		delegate:                      i,
+	}
+}
+
+type cachedDiscoveryInterfaceWrapper struct {
+	DiscoveryInterfaceWithContext
+	delegate CachedDiscoveryInterface
+}
+
+func (i *cachedDiscoveryInterfaceWrapper) FreshWithContext(ctx context.Context) bool {
+	return i.delegate.Fresh()
+}
+
+func (i *cachedDiscoveryInterfaceWrapper) InvalidateWithContext(ctx context.Context) {
+	i.delegate.Invalidate()
+}
+
 // ServerGroupsInterface has methods for obtaining supported groups on the API server
+//
+// ServerGroupsInterfaceWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerGroupsInterfaceWithContext instead.
 type ServerGroupsInterface interface {
 	// ServerGroups returns the supported groups, with information like supported versions and the
 	// preferred version.
+	//
+	// ServerGroupsInterfaceWithContext.ServerGroups is a better alternative because it supports contextual logging and cancellation.
+	//
+	// Contextual logging: Use ServerGroupsInterfaceWithContext.ServerGroups instead.
 	ServerGroups() (*metav1.APIGroupList, error)
 }
 
+// ServerGroupsInterfaceWithContext has methods for obtaining supported groups on the API server
+type ServerGroupsInterfaceWithContext interface {
+	// ServerGroups returns the supported groups, with information like supported versions and the
+	// preferred version.
+	ServerGroupsWithContext(ctx context.Context) (*metav1.APIGroupList, error)
+}
+
+func ToServerGroupsInterfaceWithContext(i ServerGroupsInterface) ServerGroupsInterfaceWithContext {
+	if i == nil {
+		return nil
+	}
+	if i, ok := i.(ServerGroupsInterfaceWithContext); ok {
+		return i
+	}
+	return &serverGroupsInterfaceWrapper{
+		delegate: i,
+	}
+}
+
+type serverGroupsInterfaceWrapper struct {
+	delegate ServerGroupsInterface
+}
+
+func (i *serverGroupsInterfaceWrapper) ServerGroupsWithContext(ctx context.Context) (*metav1.APIGroupList, error) {
+	return i.delegate.ServerGroups()
+}
+
 // ServerResourcesInterface has methods for obtaining supported resources on the API server
+//
+// ServerGroupsAndResourcesWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerGroupsAndResourcesWithContext instead.
 type ServerResourcesInterface interface {
 	// ServerResourcesForGroupVersion returns the supported resources for a group and version.
+	//
+	// ServerGroupsAndResourcesWithContext.ServerResourcesForGroupVersionWithContext is a better alternative because it supports contextual logging and cancellation.
+	//
+	// Contextual logging: Use ServerGroupsAndResourcesWithContext.ServerResourcesForGroupVersionWithContext instead.
 	ServerResourcesForGroupVersion(groupVersion string) (*metav1.APIResourceList, error)
 	// ServerGroupsAndResources returns the supported groups and resources for all groups and versions.
 	//
 	// The returned group and resource lists might be non-nil with partial results even in the
 	// case of non-nil error.
+	//
+	// ServerGroupsAndResourcesWithContext.ServerGroupsAndResourcesWithContext is a better alternative because it supports contextual logging and cancellation.
+	//
+	// Contextual logging: Use ServerGroupsAndResourcesWithContext.ServerGroupsAndResourcesWithContext instead.
 	ServerGroupsAndResources() ([]*metav1.APIGroup, []*metav1.APIResourceList, error)
 	// ServerPreferredResources returns the supported resources with the version preferred by the
 	// server.
 	//
 	// The returned group and resource lists might be non-nil with partial results even in the
 	// case of non-nil error.
+	//
+	// ServerResourcesInterfaceWithContext.ServerPreferredResourcesWithContext is a better alternative because it supports contextual logging and cancellation.
+	//
+	// Contextual logging: Use ServerResourcesInterfaceWithContext.ServerPreferredResourcesWithContext instead.
 	ServerPreferredResources() ([]*metav1.APIResourceList, error)
 	// ServerPreferredNamespacedResources returns the supported namespaced resources with the
 	// version preferred by the server.
 	//
 	// The returned resource list might be non-nil with partial results even in the case of
 	// non-nil error.
+	//
+	// ServerResourcesInterfaceWithContext.ServerPreferredNamespacedResourcesWithContext is a better alternative because it supports contextual logging and cancellation.
+	//
+	// Contextual logging: Use ServerResourcesInterfaceWithContext.ServerPreferredNamespacedResourcesWithContext instead.
 	ServerPreferredNamespacedResources() ([]*metav1.APIResourceList, error)
 }
 
+// ServerResourcesInterfaceWithContext has methods for obtaining supported resources on the API server
+type ServerResourcesInterfaceWithContext interface {
+	// ServerResourcesForGroupVersionWithContext returns the supported resources for a group and version.
+	ServerResourcesForGroupVersionWithContext(ctx context.Context, groupVersion string) (*metav1.APIResourceList, error)
+	// ServerGroupsAndResourcesWithContext returns the supported groups and resources for all groups and versions.
+	//
+	// The returned group and resource lists might be non-nil with partial results even in the
+	// case of non-nil error.
+	ServerGroupsAndResourcesWithContext(ctx context.Context) ([]*metav1.APIGroup, []*metav1.APIResourceList, error)
+	// ServerPreferredResourcesWithContext returns the supported resources with the version preferred by the
+	// server.
+	//
+	// The returned group and resource lists might be non-nil with partial results even in the
+	// case of non-nil error.
+	ServerPreferredResourcesWithContext(ctx context.Context) ([]*metav1.APIResourceList, error)
+	// ServerPreferredNamespacedResourcesWithContext returns the supported namespaced resources with the
+	// version preferred by the server.
+	//
+	// The returned resource list might be non-nil with partial results even in the case of
+	// non-nil error.
+	ServerPreferredNamespacedResourcesWithContext(ctx context.Context) ([]*metav1.APIResourceList, error)
+}
+
+func ToServerResourcesInterfaceWithContext(i ServerResourcesInterface) ServerResourcesInterfaceWithContext {
+	if i == nil {
+		return nil
+	}
+	if i, ok := i.(ServerResourcesInterfaceWithContext); ok {
+		return i
+	}
+	return &serverResourcesInterfaceWrapper{
+		delegate: i,
+	}
+}
+
+type serverResourcesInterfaceWrapper struct {
+	delegate ServerResourcesInterface
+}
+
+func (i *serverResourcesInterfaceWrapper) ServerResourcesForGroupVersionWithContext(ctx context.Context, groupVersion string) (*metav1.APIResourceList, error) {
+	return i.delegate.ServerResourcesForGroupVersion(groupVersion)
+}
+
+func (i *serverResourcesInterfaceWrapper) ServerGroupsAndResourcesWithContext(ctx context.Context) ([]*metav1.APIGroup, []*metav1.APIResourceList, error) {
+	return i.delegate.ServerGroupsAndResources()
+}
+
+func (i *serverResourcesInterfaceWrapper) ServerPreferredResourcesWithContext(ctx context.Context) ([]*metav1.APIResourceList, error) {
+	return i.delegate.ServerPreferredResources()
+}
+
+func (i *serverResourcesInterfaceWrapper) ServerPreferredNamespacedResourcesWithContext(ctx context.Context) ([]*metav1.APIResourceList, error) {
+	return i.delegate.ServerPreferredNamespacedResources()
+}
+
 // ServerVersionInterface has a method for retrieving the server's version.
+//
+// ServerVersionInterfaceWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerVersionInterfaceWithContext instead.
 type ServerVersionInterface interface {
 	// ServerVersion retrieves and parses the server's version (git version).
+	//
+	// ServerVersionInterfaceWithContext.ServerVersionWithContext is a better alternative because it supports contextual logging and cancellation.
+	//
+	// Contextual logging: Use ServerVersionInterfaceWithContext.ServerVersionWithContext instead.
 	ServerVersion() (*version.Info, error)
 }
 
+// ServerVersionInterface has a method for retrieving the server's version.
+type ServerVersionInterfaceWithContext interface {
+	// ServerVersion retrieves and parses the server's version (git version).
+	ServerVersionWithContext(ctx context.Context) (*version.Info, error)
+}
+
+func ToServerVersionInterfaceWithContext(i ServerVersionInterface) ServerVersionInterfaceWithContext {
+	if i == nil {
+		return nil
+	}
+	if i, ok := i.(ServerVersionInterfaceWithContext); ok {
+		return i
+	}
+	return &serverVersionInterfaceWrapper{
+		delegate: i,
+	}
+}
+
+type serverVersionInterfaceWrapper struct {
+	delegate ServerVersionInterface
+}
+
+func (i *serverVersionInterfaceWrapper) ServerVersionWithContext(ctx context.Context) (*version.Info, error) {
+	return i.delegate.ServerVersion()
+}
+
 // OpenAPISchemaInterface has a method to retrieve the open API schema.
+//
+// OpenAPISchemaInterfaceWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use OpenAPISchemaInterfaceWithContext instead.
 type OpenAPISchemaInterface interface {
 	// OpenAPISchema retrieves and parses the swagger API schema the server supports.
+	//
+	// OpenAPISchemaInterfaceWithContext.OpenAPISchemaWithContext is a better alternative because it supports contextual logging and cancellation.
+	//
+	// Contextual logging: Use OpenAPISchemaInterfaceWithContext.OpenAPISchemaWithContext instead.
 	OpenAPISchema() (*openapi_v2.Document, error)
 }
 
+// OpenAPISchemaInterfaceWithContext has a method to retrieve the open API schema.
+type OpenAPISchemaInterfaceWithContext interface {
+	// OpenAPISchemaWithContext retrieves and parses the swagger API schema the server supports.
+	OpenAPISchemaWithContext(ctx context.Context) (*openapi_v2.Document, error)
+}
+
+func ToOpenAPISchemaInterfaceWithContext(i OpenAPISchemaInterface) OpenAPISchemaInterfaceWithContext {
+	if i == nil {
+		return nil
+	}
+	if i, ok := i.(OpenAPISchemaInterfaceWithContext); ok {
+		return i
+	}
+	return &openAPISchemaInterfaceWrapper{
+		delegate: i,
+	}
+}
+
+type openAPISchemaInterfaceWrapper struct {
+	delegate OpenAPISchemaInterface
+}
+
+func (i *openAPISchemaInterfaceWrapper) OpenAPISchemaWithContext(ctx context.Context) (*openapi_v2.Document, error) {
+	return i.delegate.OpenAPISchema()
+}
+
+// OpenAPIV3SchemaInterfaceWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use OpenAPIV3SchemaInterfaceWithContext instead.
 type OpenAPIV3SchemaInterface interface {
+	// OpenAPIV3SchemaInterfaceWithContext.OpenAPIV3WithContext is a better alternative because it supports contextual logging and cancellation.
+	//
+	// Contextual logging: Use OpenAPIV3SchemaInterfaceWithContext.OpenAPIV3WithContext instead.
 	OpenAPIV3() openapi.Client
 }
 
+type OpenAPIV3SchemaInterfaceWithContext interface {
+	OpenAPIV3WithContext(ctx context.Context) openapi.ClientWithContext
+}
+
+func OpenAPIV3ToSchemaInterfaceWithContext(i OpenAPIV3SchemaInterface) OpenAPIV3SchemaInterfaceWithContext {
+	if i == nil {
+		return nil
+	}
+	if i, ok := i.(OpenAPIV3SchemaInterfaceWithContext); ok {
+		return i
+	}
+	return &openAPIV3SchemaInterfaceWrapper{
+		delegate: i,
+	}
+}
+
+type openAPIV3SchemaInterfaceWrapper struct {
+	delegate OpenAPIV3SchemaInterface
+}
+
+func (i *openAPIV3SchemaInterfaceWrapper) OpenAPIV3WithContext(ctx context.Context) openapi.ClientWithContext {
+	return ToOpenAPIClientWithContext(i.delegate.OpenAPIV3())
+}
+
+func ToOpenAPIClientWithContext(i openapi.Client) openapi.ClientWithContext { //nolint:staticcheck // Intentionally using the old interface here.
+	if i == nil {
+		return nil
+	}
+	if i, ok := i.(openapi.ClientWithContext); ok {
+		return i
+	}
+	return &openAPIClientWrapper{
+		delegate: i,
+	}
+}
+
+type openAPIClientWrapper struct {
+	//nolint:staticcheck // Intentionally using the old interface here.
+	delegate openapi.Client
+}
+
+func (i *openAPIClientWrapper) PathsWithContext(ctx context.Context) (map[string]openapi.GroupVersionWithContext, error) {
+	resultWithoutContext, err := i.delegate.Paths()
+	result := make(map[string]openapi.GroupVersionWithContext, len(resultWithoutContext))
+	for key, entry := range resultWithoutContext {
+		result[key] = openapi.ToGroupVersionWithContext(entry)
+	}
+	return result, err
+}
+
 // DiscoveryClient implements the functions that discover server-supported API groups,
 // versions and resources.
 type DiscoveryClient struct {
@@ -202,19 +589,42 @@ func apiVersionsToAPIGroup(apiVersions *metav1.APIVersions) (apiGroup metav1.API
 // as aggregated discovery format or legacy format. For safety, resources will only
 // be returned if both endpoints returned resources. Returned "failedGVs" can be
 // empty, but will only be nil in the case an error is returned.
+//
+// GroupsAndMaybeResourcesWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use GroupsAndMaybeResourcesWithContext instead.
 func (d *DiscoveryClient) GroupsAndMaybeResources() (
 	*metav1.APIGroupList,
 	map[schema.GroupVersion]*metav1.APIResourceList,
 	map[schema.GroupVersion]error,
 	error) {
+	return d.GroupsAndMaybeResourcesWithContext(context.Background())
+}
+
+// GroupsAndMaybeResources returns the discovery groups, and (if new aggregated
+// discovery format) the resources keyed by group/version. Merges discovery groups
+// and resources from /api and /apis (either aggregated or not). Legacy groups
+// must be ordered first. The server will either return both endpoints (/api, /apis)
+// as aggregated discovery format or legacy format. For safety, resources will only
+// be returned if both endpoints returned resources. Returned "failedGVs" can be
+// empty, but will only be nil in the case an error is returned.
+func (d *DiscoveryClient) GroupsAndMaybeResourcesWithContext(ctx context.Context) (
+	*metav1.APIGroupList,
+	map[schema.GroupVersion]*metav1.APIResourceList,
+	map[schema.GroupVersion]error,
+	error) {
+	if err := ctx.Err(); err != nil {
+		return nil, nil, nil, err
+	}
+
 	// Legacy group ordered first (there is only one -- core/v1 group). Returned groups must
 	// be non-nil, but it could be empty. Returned resources, apiResources map could be nil.
-	groups, resources, failedGVs, err := d.downloadLegacy()
+	groups, resources, failedGVs, err := d.downloadLegacy(ctx)
 	if err != nil {
 		return nil, nil, nil, err
 	}
 	// Discovery groups and (possibly) resources downloaded from /apis.
-	apiGroups, apiResources, failedApisGVs, aerr := d.downloadAPIs()
+	apiGroups, apiResources, failedApisGVs, aerr := d.downloadAPIs(ctx)
 	if aerr != nil {
 		return nil, nil, nil, aerr
 	}
@@ -242,7 +652,7 @@ func (d *DiscoveryClient) GroupsAndMaybeResources() (
 // possible for the resource map to be nil if the server returned
 // the unaggregated discovery. Returned "failedGVs" can be empty, but
 // will only be nil in the case of a returned error.
-func (d *DiscoveryClient) downloadLegacy() (
+func (d *DiscoveryClient) downloadLegacy(ctx context.Context) (
 	*metav1.APIGroupList,
 	map[schema.GroupVersion]*metav1.APIResourceList,
 	map[schema.GroupVersion]error,
@@ -252,7 +662,7 @@ func (d *DiscoveryClient) downloadLegacy() (
 	body, err := d.restClient.Get().
 		AbsPath("/api").
 		SetHeader("Accept", accept).
-		Do(context.TODO()).
+		Do(ctx).
 		ContentType(&responseContentType).
 		Raw()
 	apiGroupList := &metav1.APIGroupList{}
@@ -277,13 +687,6 @@ func (d *DiscoveryClient) downloadLegacy() (
 			return nil, nil, nil, err
 		}
 		apiGroupList, resourcesByGV, failedGVs = SplitGroupsAndResources(aggregatedDiscovery)
-	} else if isGVK, _ := ContentTypeIsGVK(responseContentType, v2Beta1GVK); isGVK {
-		var aggregatedDiscovery apidiscoveryv2beta1.APIGroupDiscoveryList
-		err = json.Unmarshal(body, &aggregatedDiscovery)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-		apiGroupList, resourcesByGV, failedGVs = SplitGroupsAndResourcesV2Beta1(aggregatedDiscovery)
 	} else {
 		// Default is unaggregated discovery v1.
 		var v metav1.APIVersions
@@ -305,7 +708,7 @@ func (d *DiscoveryClient) downloadLegacy() (
 // discovery resources. The returned groups will always exist, but the
 // resources map may be nil. Returned "failedGVs" can be empty, but will
 // only be nil in the case of a returned error.
-func (d *DiscoveryClient) downloadAPIs() (
+func (d *DiscoveryClient) downloadAPIs(ctx context.Context) (
 	*metav1.APIGroupList,
 	map[schema.GroupVersion]*metav1.APIResourceList,
 	map[schema.GroupVersion]error,
@@ -315,7 +718,7 @@ func (d *DiscoveryClient) downloadAPIs() (
 	body, err := d.restClient.Get().
 		AbsPath("/apis").
 		SetHeader("Accept", accept).
-		Do(context.TODO()).
+		Do(ctx).
 		ContentType(&responseContentType).
 		Raw()
 	if err != nil {
@@ -333,13 +736,6 @@ func (d *DiscoveryClient) downloadAPIs() (
 			return nil, nil, nil, err
 		}
 		apiGroupList, resourcesByGV, failedGVs = SplitGroupsAndResources(aggregatedDiscovery)
-	} else if isGVK, _ := ContentTypeIsGVK(responseContentType, v2Beta1GVK); isGVK {
-		var aggregatedDiscovery apidiscoveryv2beta1.APIGroupDiscoveryList
-		err = json.Unmarshal(body, &aggregatedDiscovery)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-		apiGroupList, resourcesByGV, failedGVs = SplitGroupsAndResourcesV2Beta1(aggregatedDiscovery)
 	} else {
 		// Default is unaggregated discovery v1.
 		err = json.Unmarshal(body, apiGroupList)
@@ -368,9 +764,9 @@ func selectDiscoveryAcceptHeader(useLegacy, nopeer bool) string {
 // content-type parameters, as well as parameters added by
 // intermediaries such as proxies or gateways. Examples:
 //
-//	("application/json; g=apidiscovery.k8s.io;v=v2beta1;as=APIGroupDiscoveryList", {apidiscovery.k8s.io, v2beta1, APIGroupDiscoveryList}) = (true, nil)
-//	("application/json; as=APIGroupDiscoveryList;v=v2beta1;g=apidiscovery.k8s.io", {apidiscovery.k8s.io, v2beta1, APIGroupDiscoveryList}) = (true, nil)
-//	("application/json; as=APIGroupDiscoveryList;v=v2beta1;g=apidiscovery.k8s.io;charset=utf-8", {apidiscovery.k8s.io, v2beta1, APIGroupDiscoveryList}) = (true, nil)
+//	("application/json; g=apidiscovery.k8s.io;v=v2;as=APIGroupDiscoveryList", {apidiscovery.k8s.io, v2, APIGroupDiscoveryList}) = (true, nil)
+//	("application/json; as=APIGroupDiscoveryList;v=v2;g=apidiscovery.k8s.io", {apidiscovery.k8s.io, v2, APIGroupDiscoveryList}) = (true, nil)
+//	("application/json; as=APIGroupDiscoveryList;v=v2;g=apidiscovery.k8s.io;charset=utf-8", {apidiscovery.k8s.io, v2, APIGroupDiscoveryList}) = (true, nil)
 //	("application/json", any GVK) = (false, nil)
 //	("application/json; charset=UTF-8", any GVK) = (false, nil)
 //	("malformed content type string", any GVK) = (false, error)
@@ -388,8 +784,18 @@ func ContentTypeIsGVK(contentType string, gvk schema.GroupVersionKind) (bool, er
 
 // ServerGroups returns the supported groups, with information like supported versions and the
 // preferred version.
+//
+// ServerGroupsWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerGroupsWithContext instead.
 func (d *DiscoveryClient) ServerGroups() (*metav1.APIGroupList, error) {
-	groups, _, _, err := d.GroupsAndMaybeResources()
+	return d.ServerGroupsWithContext(context.Background())
+}
+
+// ServerGroupsWithContext returns the supported groups, with information like supported versions and the
+// preferred version.
+func (d *DiscoveryClient) ServerGroupsWithContext(ctx context.Context) (*metav1.APIGroupList, error) {
+	groups, _, _, err := d.GroupsAndMaybeResourcesWithContext(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -397,7 +803,16 @@ func (d *DiscoveryClient) ServerGroups() (*metav1.APIGroupList, error) {
 }
 
 // ServerResourcesForGroupVersion returns the supported resources for a group and version.
+//
+// ServerResourcesForGroupVersionWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerResourcesForGroupVersionWithContext instead.
 func (d *DiscoveryClient) ServerResourcesForGroupVersion(groupVersion string) (resources *metav1.APIResourceList, err error) {
+	return d.ServerResourcesForGroupVersionWithContext(context.Background(), groupVersion)
+}
+
+// ServerResourcesForGroupVersionWithContext returns the supported resources for a group and version.
+func (d *DiscoveryClient) ServerResourcesForGroupVersionWithContext(ctx context.Context, groupVersion string) (resources *metav1.APIResourceList, err error) {
 	url := url.URL{}
 	if len(groupVersion) == 0 {
 		return nil, fmt.Errorf("groupVersion shouldn't be empty")
@@ -410,7 +825,7 @@ func (d *DiscoveryClient) ServerResourcesForGroupVersion(groupVersion string) (r
 	resources = &metav1.APIResourceList{
 		GroupVersion: groupVersion,
 	}
-	err = d.restClient.Get().AbsPath(url.String()).Do(context.TODO()).Into(resources)
+	err = d.restClient.Get().AbsPath(url.String()).Do(ctx).Into(resources)
 	if err != nil {
 		// Tolerate core/v1 not found response by returning empty resource list;
 		// this probably should not happen. But we should verify all callers are
@@ -425,8 +840,13 @@ func (d *DiscoveryClient) ServerResourcesForGroupVersion(groupVersion string) (r
 
 // ServerGroupsAndResources returns the supported resources for all groups and versions.
 func (d *DiscoveryClient) ServerGroupsAndResources() ([]*metav1.APIGroup, []*metav1.APIResourceList, error) {
-	return withRetries(defaultRetries, func() ([]*metav1.APIGroup, []*metav1.APIResourceList, error) {
-		return ServerGroupsAndResources(d)
+	return d.ServerGroupsAndResourcesWithContext(context.Background())
+}
+
+// ServerGroupsAndResourcesWithContext returns the supported resources for all groups and versions.
+func (d *DiscoveryClient) ServerGroupsAndResourcesWithContext(ctx context.Context) ([]*metav1.APIGroup, []*metav1.APIResourceList, error) {
+	return withRetries(ctx, defaultRetries, func() ([]*metav1.APIGroup, []*metav1.APIResourceList, error) {
+		return ServerGroupsAndResourcesWithContext(ctx, d)
 	})
 }
 
@@ -469,7 +889,18 @@ func GroupDiscoveryFailedErrorGroups(err error) (map[schema.GroupVersion]error,
 	return nil, false
 }
 
+// ServerGroupsAndResourcesWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerGroupsAndResourcesWithContext instead.
 func ServerGroupsAndResources(d DiscoveryInterface) ([]*metav1.APIGroup, []*metav1.APIResourceList, error) {
+	return ServerGroupsAndResourcesWithContext(context.Background(), ToDiscoveryInterfaceWithContext(d))
+}
+
+func ServerGroupsAndResourcesWithContext(ctx context.Context, d DiscoveryInterfaceWithContext) ([]*metav1.APIGroup, []*metav1.APIResourceList, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, nil, err
+	}
+
 	var sgs *metav1.APIGroupList
 	var resources []*metav1.APIResourceList
 	var failedGVs map[schema.GroupVersion]error
@@ -477,14 +908,21 @@ func ServerGroupsAndResources(d DiscoveryInterface) ([]*metav1.APIGroup, []*meta
 
 	// If the passed discovery object implements the wider AggregatedDiscoveryInterface,
 	// then attempt to retrieve aggregated discovery with both groups and the resources.
-	if ad, ok := d.(AggregatedDiscoveryInterface); ok {
+	ad, ok := d.(AggregatedDiscoveryInterfaceWithContext)
+	if !ok {
+		if ad2, ok2 := d.(AggregatedDiscoveryInterface); ok2 {
+			ad = ToAggregatedDiscoveryInterfaceWithContext(ad2)
+			ok = true
+		}
+	}
+	if ok {
 		var resourcesByGV map[schema.GroupVersion]*metav1.APIResourceList
-		sgs, resourcesByGV, failedGVs, err = ad.GroupsAndMaybeResources()
+		sgs, resourcesByGV, failedGVs, err = ad.GroupsAndMaybeResourcesWithContext(ctx)
 		for _, resourceList := range resourcesByGV {
 			resources = append(resources, resourceList)
 		}
 	} else {
-		sgs, err = d.ServerGroups()
+		sgs, err = d.ServerGroupsWithContext(ctx)
 	}
 
 	if sgs == nil {
@@ -505,7 +943,7 @@ func ServerGroupsAndResources(d DiscoveryInterface) ([]*metav1.APIGroup, []*meta
 		return resultGroups, resources, ferr
 	}
 
-	groupVersionResources, failedGroups := fetchGroupVersionResources(d, sgs)
+	groupVersionResources, failedGroups := fetchGroupVersionResources(ctx, d, sgs)
 
 	// order results by group/version discovery order
 	result := []*metav1.APIResourceList{}
@@ -526,7 +964,20 @@ func ServerGroupsAndResources(d DiscoveryInterface) ([]*metav1.APIGroup, []*meta
 }
 
 // ServerPreferredResources uses the provided discovery interface to look up preferred resources
+//
+// ServerPreferredResourcesWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerPreferredResourcesWithContext instead.
 func ServerPreferredResources(d DiscoveryInterface) ([]*metav1.APIResourceList, error) {
+	return ServerPreferredResourcesWithContext(context.Background(), ToDiscoveryInterfaceWithContext(d))
+}
+
+// ServerPreferredResourcesWithContext uses the provided discovery interface to look up preferred resources
+func ServerPreferredResourcesWithContext(ctx context.Context, d DiscoveryInterfaceWithContext) ([]*metav1.APIResourceList, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+
 	var serverGroupList *metav1.APIGroupList
 	var failedGroups map[schema.GroupVersion]error
 	var groupVersionResources map[schema.GroupVersion]*metav1.APIResourceList
@@ -535,18 +986,24 @@ func ServerPreferredResources(d DiscoveryInterface) ([]*metav1.APIResourceList,
 	// If the passed discovery object implements the wider AggregatedDiscoveryInterface,
 	// then it is attempt to retrieve both the groups and the resources. "failedGroups"
 	// are Group/Versions returned as stale in AggregatedDiscovery format.
-	ad, ok := d.(AggregatedDiscoveryInterface)
+	ad, ok := d.(AggregatedDiscoveryInterfaceWithContext)
+	if !ok {
+		if ad2, ok2 := d.(AggregatedDiscoveryInterface); ok2 {
+			ad = ToAggregatedDiscoveryInterfaceWithContext(ad2)
+			ok = true
+		}
+	}
 	if ok {
-		serverGroupList, groupVersionResources, failedGroups, err = ad.GroupsAndMaybeResources()
+		serverGroupList, groupVersionResources, failedGroups, err = ad.GroupsAndMaybeResourcesWithContext(ctx)
 	} else {
-		serverGroupList, err = d.ServerGroups()
+		serverGroupList, err = d.ServerGroupsWithContext(ctx)
 	}
 	if err != nil {
 		return nil, err
 	}
 	// Non-aggregated discovery must fetch resources from Groups.
 	if groupVersionResources == nil {
-		groupVersionResources, failedGroups = fetchGroupVersionResources(d, serverGroupList)
+		groupVersionResources, failedGroups = fetchGroupVersionResources(ctx, d, serverGroupList)
 	}
 
 	result := []*metav1.APIResourceList{}
@@ -602,7 +1059,7 @@ func ServerPreferredResources(d DiscoveryInterface) ([]*metav1.APIResourceList,
 }
 
 // fetchServerResourcesForGroupVersions uses the discovery client to fetch the resources for the specified groups in parallel.
-func fetchGroupVersionResources(d DiscoveryInterface, apiGroups *metav1.APIGroupList) (map[schema.GroupVersion]*metav1.APIResourceList, map[schema.GroupVersion]error) {
+func fetchGroupVersionResources(ctx context.Context, d DiscoveryInterfaceWithContext, apiGroups *metav1.APIGroupList) (map[schema.GroupVersion]*metav1.APIResourceList, map[schema.GroupVersion]error) {
 	groupVersionResources := make(map[schema.GroupVersion]*metav1.APIResourceList)
 	failedGroups := make(map[schema.GroupVersion]error)
 
@@ -614,9 +1071,9 @@ func fetchGroupVersionResources(d DiscoveryInterface, apiGroups *metav1.APIGroup
 			wg.Add(1)
 			go func() {
 				defer wg.Done()
-				defer utilruntime.HandleCrash()
+				defer utilruntime.HandleCrashWithContext(ctx)
 
-				apiResourceList, err := d.ServerResourcesForGroupVersion(groupVersion.String())
+				apiResourceList, err := d.ServerResourcesForGroupVersionWithContext(ctx, groupVersion.String())
 
 				// lock to record results
 				resultLock.Lock()
@@ -640,23 +1097,56 @@ func fetchGroupVersionResources(d DiscoveryInterface, apiGroups *metav1.APIGroup
 
 // ServerPreferredResources returns the supported resources with the version preferred by the
 // server.
+//
+// ServerPreferredResourcesWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerPreferredResourcesWithContext instead.
 func (d *DiscoveryClient) ServerPreferredResources() ([]*metav1.APIResourceList, error) {
-	_, rs, err := withRetries(defaultRetries, func() ([]*metav1.APIGroup, []*metav1.APIResourceList, error) {
+	_, rs, err := withRetries(context.Background(), defaultRetries, func() ([]*metav1.APIGroup, []*metav1.APIResourceList, error) {
 		rs, err := ServerPreferredResources(d)
 		return nil, rs, err
 	})
 	return rs, err
 }
 
+// ServerPreferredResourcesWithContext returns the supported resources with the version preferred by the
+// server.
+func (d *DiscoveryClient) ServerPreferredResourcesWithContext(ctx context.Context) ([]*metav1.APIResourceList, error) {
+	_, rs, err := withRetries(ctx, defaultRetries, func() ([]*metav1.APIGroup, []*metav1.APIResourceList, error) {
+		rs, err := ServerPreferredResourcesWithContext(ctx, d)
+		return nil, rs, err
+	})
+	return rs, err
+}
+
 // ServerPreferredNamespacedResources returns the supported namespaced resources with the
 // version preferred by the server.
+//
+// ServerPreferredNamespacedResourcesWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerPreferredNamespacedResourcesWithContext instead.
 func (d *DiscoveryClient) ServerPreferredNamespacedResources() ([]*metav1.APIResourceList, error) {
 	return ServerPreferredNamespacedResources(d)
 }
 
+// ServerPreferredNamespacedResources returns the supported namespaced resources with the
+// version preferred by the server.
+func (d *DiscoveryClient) ServerPreferredNamespacedResourcesWithContext(ctx context.Context) ([]*metav1.APIResourceList, error) {
+	return ServerPreferredNamespacedResourcesWithContext(ctx, d)
+}
+
 // ServerPreferredNamespacedResources uses the provided discovery interface to look up preferred namespaced resources
+//
+// ServerPreferredNamespacedResourcesWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerPreferredNamespacedResourcesWithContext instead.
 func ServerPreferredNamespacedResources(d DiscoveryInterface) ([]*metav1.APIResourceList, error) {
-	all, err := ServerPreferredResources(d)
+	return ServerPreferredNamespacedResourcesWithContext(context.Background(), ToDiscoveryInterfaceWithContext(d))
+}
+
+// ServerPreferredNamespacedResourcesWithContext uses the provided discovery interface to look up preferred namespaced resources
+func ServerPreferredNamespacedResourcesWithContext(ctx context.Context, d DiscoveryInterfaceWithContext) ([]*metav1.APIResourceList, error) {
+	all, err := ServerPreferredResourcesWithContext(ctx, d)
 	return FilteredBy(ResourcePredicateFunc(func(groupVersion string, r *metav1.APIResource) bool {
 		return r.Namespaced
 	}), all), err
@@ -664,7 +1154,12 @@ func ServerPreferredNamespacedResources(d DiscoveryInterface) ([]*metav1.APIReso
 
 // ServerVersion retrieves and parses the server's version (git version).
 func (d *DiscoveryClient) ServerVersion() (*version.Info, error) {
-	body, err := d.restClient.Get().AbsPath("/version").Do(context.TODO()).Raw()
+	return d.ServerVersionWithContext(context.Background())
+}
+
+// ServerVersionWithContext retrieves and parses the server's version (git version).
+func (d *DiscoveryClient) ServerVersionWithContext(ctx context.Context) (*version.Info, error) {
+	body, err := d.restClient.Get().AbsPath("/version").Do(ctx).Raw()
 	if err != nil {
 		return nil, err
 	}
@@ -678,7 +1173,12 @@ func (d *DiscoveryClient) ServerVersion() (*version.Info, error) {
 
 // OpenAPISchema fetches the open api v2 schema using a rest client and parses the proto.
 func (d *DiscoveryClient) OpenAPISchema() (*openapi_v2.Document, error) {
-	data, err := d.restClient.Get().AbsPath("/openapi/v2").SetHeader("Accept", openAPIV2mimePb).Do(context.TODO()).Raw()
+	return d.OpenAPISchemaWithContext(context.Background())
+}
+
+// OpenAPISchemaWithContext fetches the open api v2 schema using a rest client and parses the proto.
+func (d *DiscoveryClient) OpenAPISchemaWithContext(ctx context.Context) (*openapi_v2.Document, error) {
+	data, err := d.restClient.Get().AbsPath("/openapi/v2").SetHeader("Accept", openAPIV2mimePb).Do(ctx).Raw()
 	if err != nil {
 		return nil, err
 	}
@@ -690,20 +1190,40 @@ func (d *DiscoveryClient) OpenAPISchema() (*openapi_v2.Document, error) {
 	return document, nil
 }
 
+// OpenAPIV3WithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use OpenAPIV3WithContext instead.
 func (d *DiscoveryClient) OpenAPIV3() openapi.Client {
 	return openapi.NewClient(d.restClient)
 }
 
+func (d *DiscoveryClient) OpenAPIV3WithContext(ctx context.Context) openapi.ClientWithContext {
+	return openapi.NewClientWithContext(d.restClient)
+}
+
 // WithLegacy returns copy of current discovery client that will only
 // receive the legacy discovery format.
+//
+// WithLegacyWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use WithLegacyWithContext instead.
 func (d *DiscoveryClient) WithLegacy() DiscoveryInterface {
 	client := *d
 	client.UseLegacyDiscovery = true
 	return &client
 }
 
+// WithLegacyWithContext returns copy of current discovery client that will only
+// receive the legacy discovery format.
+func (d *DiscoveryClient) WithLegacyWithContext(ctx context.Context) DiscoveryInterfaceWithContext {
+	client := *d
+	client.UseLegacyDiscovery = true
+	return &client
+}
+
 // withRetries retries the given recovery function in case the groups supported by the server change after ServerGroup() returns.
-func withRetries(maxRetries int, f func() ([]*metav1.APIGroup, []*metav1.APIResourceList, error)) ([]*metav1.APIGroup, []*metav1.APIResourceList, error) {
+// It retries only if the context isn't canceled.
+func withRetries(ctx context.Context, maxRetries int, f func() ([]*metav1.APIGroup, []*metav1.APIResourceList, error)) ([]*metav1.APIGroup, []*metav1.APIResourceList, error) {
 	var result []*metav1.APIResourceList
 	var resultGroups []*metav1.APIGroup
 	var err error
@@ -715,6 +1235,10 @@ func withRetries(maxRetries int, f func() ([]*metav1.APIGroup, []*metav1.APIReso
 		if _, ok := err.(*ErrGroupDiscoveryFailed); !ok {
 			return nil, nil, err
 		}
+		if ctx.Err() != nil {
+			// Give up retrying because of context cancellation and propagate the error returned by f.
+			return nil, nil, err
+		}
 	}
 	return resultGroups, result, err
 }
diff --git a/vendor/k8s.io/client-go/discovery/fake/discovery.go b/vendor/k8s.io/client-go/discovery/fake/discovery.go
index e5d9e7f800..02b2416e1f 100644
--- a/vendor/k8s.io/client-go/discovery/fake/discovery.go
+++ b/vendor/k8s.io/client-go/discovery/fake/discovery.go
@@ -17,6 +17,7 @@ limitations under the License.
 package fake
 
 import (
+	"context"
 	"fmt"
 	"net/http"
 
@@ -33,16 +34,33 @@ import (
 	"k8s.io/client-go/testing"
 )
 
-// FakeDiscovery implements discovery.DiscoveryInterface and sometimes calls testing.Fake.Invoke with an action,
+// FakeDiscovery implements discovery.DiscoveryInterface and discovery.DiscoveryInterfaceWithContext.
+// It sometimes calls testing.Fake.Invoke with an action,
 // but doesn't respect the return value if any. There is a way to fake static values like ServerVersion by using the Faked... fields on the struct.
 type FakeDiscovery struct {
 	*testing.Fake
 	FakedServerVersion *version.Info
 }
 
+var (
+	//nolint:staticcheck // Intentionally using the old interface here.
+	_ discovery.DiscoveryInterface            = &FakeDiscovery{}
+	_ discovery.DiscoveryInterfaceWithContext = &FakeDiscovery{}
+)
+
 // ServerResourcesForGroupVersion returns the supported resources for a group
 // and version.
+//
+// ServerResourcesForGroupVersionWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerResourcesForGroupVersionWithContext instead.
 func (c *FakeDiscovery) ServerResourcesForGroupVersion(groupVersion string) (*metav1.APIResourceList, error) {
+	return c.ServerResourcesForGroupVersionWithContext(context.Background(), groupVersion)
+}
+
+// ServerResourcesForGroupVersionWithContext returns the supported resources for a group
+// and version.
+func (c *FakeDiscovery) ServerResourcesForGroupVersionWithContext(ctx context.Context, groupVersion string) (*metav1.APIResourceList, error) {
 	action := testing.ActionImpl{
 		Verb:     "get",
 		Resource: schema.GroupVersionResource{Resource: "resource"},
@@ -65,8 +83,17 @@ func (c *FakeDiscovery) ServerResourcesForGroupVersion(groupVersion string) (*me
 }
 
 // ServerGroupsAndResources returns the supported groups and resources for all groups and versions.
+//
+// ServerGroupsAndResourcesWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerGroupsAndResourcesWithContext instead.
 func (c *FakeDiscovery) ServerGroupsAndResources() ([]*metav1.APIGroup, []*metav1.APIResourceList, error) {
-	sgs, err := c.ServerGroups()
+	return c.ServerGroupsAndResourcesWithContext(context.Background())
+}
+
+// ServerGroupsAndResourcesWithContext returns the supported groups and resources for all groups and versions.
+func (c *FakeDiscovery) ServerGroupsAndResourcesWithContext(ctx context.Context) ([]*metav1.APIGroup, []*metav1.APIResourceList, error) {
+	sgs, err := c.ServerGroupsWithContext(ctx)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -87,19 +114,49 @@ func (c *FakeDiscovery) ServerGroupsAndResources() ([]*metav1.APIGroup, []*metav
 
 // ServerPreferredResources returns the supported resources with the version
 // preferred by the server.
+//
+// ServerPreferredResourcesWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerPreferredResourcesWithContext instead.
 func (c *FakeDiscovery) ServerPreferredResources() ([]*metav1.APIResourceList, error) {
+	return c.ServerPreferredResourcesWithContext(context.Background())
+}
+
+// ServerPreferredResourcesWithContext returns the supported resources with the version
+// preferred by the server.
+func (c *FakeDiscovery) ServerPreferredResourcesWithContext(ctx context.Context) ([]*metav1.APIResourceList, error) {
 	return nil, nil
 }
 
 // ServerPreferredNamespacedResources returns the supported namespaced resources
 // with the version preferred by the server.
+//
+// ServerPreferredNamespacedResourcesWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerPreferredNamespacedResourcesWithContext instead.
 func (c *FakeDiscovery) ServerPreferredNamespacedResources() ([]*metav1.APIResourceList, error) {
+	return c.ServerPreferredNamespacedResourcesWithContext(context.Background())
+}
+
+// ServerPreferredNamespacedResourcesWithContext returns the supported namespaced resources
+// with the version preferred by the server.
+func (c *FakeDiscovery) ServerPreferredNamespacedResourcesWithContext(ctx context.Context) ([]*metav1.APIResourceList, error) {
 	return nil, nil
 }
 
 // ServerGroups returns the supported groups, with information like supported
 // versions and the preferred version.
+//
+// ServerGroupsWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerGroupsWithContext instead.
 func (c *FakeDiscovery) ServerGroups() (*metav1.APIGroupList, error) {
+	return c.ServerGroupsWithContext(context.Background())
+}
+
+// ServerGroupsWithContext returns the supported groups, with information like supported
+// versions and the preferred version.
+func (c *FakeDiscovery) ServerGroupsWithContext(ctx context.Context) (*metav1.APIGroupList, error) {
 	action := testing.ActionImpl{
 		Verb:     "get",
 		Resource: schema.GroupVersionResource{Resource: "group"},
@@ -143,7 +200,16 @@ func (c *FakeDiscovery) ServerGroups() (*metav1.APIGroupList, error) {
 }
 
 // ServerVersion retrieves and parses the server's version.
+//
+// ServerVersionWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ServerVersionWithContext instead.
 func (c *FakeDiscovery) ServerVersion() (*version.Info, error) {
+	return c.ServerVersionWithContext(context.Background())
+}
+
+// ServerVersionWithContext retrieves and parses the server's version.
+func (c *FakeDiscovery) ServerVersionWithContext(ctx context.Context) (*version.Info, error) {
 	action := testing.ActionImpl{}
 	action.Verb = "get"
 	action.Resource = schema.GroupVersionResource{Resource: "version"}
@@ -161,20 +227,43 @@ func (c *FakeDiscovery) ServerVersion() (*version.Info, error) {
 }
 
 // OpenAPISchema retrieves and parses the swagger API schema the server supports.
+//
+// OpenAPISchemaWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use OpenAPISchemaWithContext instead.
 func (c *FakeDiscovery) OpenAPISchema() (*openapi_v2.Document, error) {
+	return c.OpenAPISchemaWithContext(context.Background())
+}
+
+// OpenAPISchemaWithContext retrieves and parses the swagger API schema the server supports.
+func (c *FakeDiscovery) OpenAPISchemaWithContext(ctx context.Context) (*openapi_v2.Document, error) {
 	return &openapi_v2.Document{}, nil
 }
 
+// OpenAPIV3WithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use OpenAPIV3WithContext instead.
 func (c *FakeDiscovery) OpenAPIV3() openapi.Client {
 	panic("unimplemented")
 }
 
+func (c *FakeDiscovery) OpenAPIV3WithContext(ctx context.Context) openapi.ClientWithContext {
+	panic("unimplemented")
+}
+
 // RESTClient returns a RESTClient that is used to communicate with API server
 // by this client implementation.
 func (c *FakeDiscovery) RESTClient() restclient.Interface {
 	return nil
 }
 
+// WithLegacyWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use WithLegacyWithContext instead.
 func (c *FakeDiscovery) WithLegacy() discovery.DiscoveryInterface {
 	panic("unimplemented")
 }
+
+func (c *FakeDiscovery) WithLegacyWithContext(ctx context.Context) discovery.DiscoveryInterfaceWithContext {
+	panic("unimplemented")
+}
diff --git a/vendor/k8s.io/client-go/discovery/helper.go b/vendor/k8s.io/client-go/discovery/helper.go
index e79f073b03..a58bae284a 100644
--- a/vendor/k8s.io/client-go/discovery/helper.go
+++ b/vendor/k8s.io/client-go/discovery/helper.go
@@ -71,7 +71,7 @@ func ServerSupportsVersion(client DiscoveryInterface, requiredGV schema.GroupVer
 		return err
 	}
 	versions := metav1.ExtractGroupVersions(groups)
-	serverVersions := sets.String{}
+	serverVersions := sets.Set[string]{}
 	for _, v := range versions {
 		serverVersions.Insert(v)
 	}
diff --git a/vendor/k8s.io/client-go/dynamic/simple.go b/vendor/k8s.io/client-go/dynamic/simple.go
index 2532329d05..add5b13777 100644
--- a/vendor/k8s.io/client-go/dynamic/simple.go
+++ b/vendor/k8s.io/client-go/dynamic/simple.go
@@ -19,6 +19,8 @@ package dynamic
 import (
 	"context"
 	"fmt"
+	"net/http"
+
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -28,7 +30,6 @@ import (
 	"k8s.io/client-go/features"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/util/apply"
-	"net/http"
 )
 
 type DynamicClient struct {
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1/interface.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1/interface.go
index 4bfe9c4c6e..8e643aa185 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1/interface.go
@@ -25,17 +25,17 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// MutatingAdmissionPolicies returns a MutatingAdmissionPolicyInformer.
-	MutatingAdmissionPolicies() MutatingAdmissionPolicyInformer
+	MutatingAdmissionPolicies() TypedMutatingAdmissionPolicyInformer
 	// MutatingAdmissionPolicyBindings returns a MutatingAdmissionPolicyBindingInformer.
-	MutatingAdmissionPolicyBindings() MutatingAdmissionPolicyBindingInformer
+	MutatingAdmissionPolicyBindings() TypedMutatingAdmissionPolicyBindingInformer
 	// MutatingWebhookConfigurations returns a MutatingWebhookConfigurationInformer.
-	MutatingWebhookConfigurations() MutatingWebhookConfigurationInformer
+	MutatingWebhookConfigurations() TypedMutatingWebhookConfigurationInformer
 	// ValidatingAdmissionPolicies returns a ValidatingAdmissionPolicyInformer.
-	ValidatingAdmissionPolicies() ValidatingAdmissionPolicyInformer
+	ValidatingAdmissionPolicies() TypedValidatingAdmissionPolicyInformer
 	// ValidatingAdmissionPolicyBindings returns a ValidatingAdmissionPolicyBindingInformer.
-	ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingInformer
+	ValidatingAdmissionPolicyBindings() TypedValidatingAdmissionPolicyBindingInformer
 	// ValidatingWebhookConfigurations returns a ValidatingWebhookConfigurationInformer.
-	ValidatingWebhookConfigurations() ValidatingWebhookConfigurationInformer
+	ValidatingWebhookConfigurations() TypedValidatingWebhookConfigurationInformer
 }
 
 type version struct {
@@ -49,32 +49,32 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// MutatingAdmissionPolicies returns a MutatingAdmissionPolicyInformer.
-func (v *version) MutatingAdmissionPolicies() MutatingAdmissionPolicyInformer {
+// MutatingAdmissionPolicies returns a TypedMutatingAdmissionPolicyInformer.
+func (v *version) MutatingAdmissionPolicies() TypedMutatingAdmissionPolicyInformer {
 	return &mutatingAdmissionPolicyInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// MutatingAdmissionPolicyBindings returns a MutatingAdmissionPolicyBindingInformer.
-func (v *version) MutatingAdmissionPolicyBindings() MutatingAdmissionPolicyBindingInformer {
+// MutatingAdmissionPolicyBindings returns a TypedMutatingAdmissionPolicyBindingInformer.
+func (v *version) MutatingAdmissionPolicyBindings() TypedMutatingAdmissionPolicyBindingInformer {
 	return &mutatingAdmissionPolicyBindingInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// MutatingWebhookConfigurations returns a MutatingWebhookConfigurationInformer.
-func (v *version) MutatingWebhookConfigurations() MutatingWebhookConfigurationInformer {
+// MutatingWebhookConfigurations returns a TypedMutatingWebhookConfigurationInformer.
+func (v *version) MutatingWebhookConfigurations() TypedMutatingWebhookConfigurationInformer {
 	return &mutatingWebhookConfigurationInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ValidatingAdmissionPolicies returns a ValidatingAdmissionPolicyInformer.
-func (v *version) ValidatingAdmissionPolicies() ValidatingAdmissionPolicyInformer {
+// ValidatingAdmissionPolicies returns a TypedValidatingAdmissionPolicyInformer.
+func (v *version) ValidatingAdmissionPolicies() TypedValidatingAdmissionPolicyInformer {
 	return &validatingAdmissionPolicyInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ValidatingAdmissionPolicyBindings returns a ValidatingAdmissionPolicyBindingInformer.
-func (v *version) ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingInformer {
+// ValidatingAdmissionPolicyBindings returns a TypedValidatingAdmissionPolicyBindingInformer.
+func (v *version) ValidatingAdmissionPolicyBindings() TypedValidatingAdmissionPolicyBindingInformer {
 	return &validatingAdmissionPolicyBindingInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ValidatingWebhookConfigurations returns a ValidatingWebhookConfigurationInformer.
-func (v *version) ValidatingWebhookConfigurations() ValidatingWebhookConfigurationInformer {
+// ValidatingWebhookConfigurations returns a TypedValidatingWebhookConfigurationInformer.
+func (v *version) ValidatingWebhookConfigurations() TypedValidatingWebhookConfigurationInformer {
 	return &validatingWebhookConfigurationInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1/mutatingadmissionpolicy.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1/mutatingadmissionpolicy.go
index 65df1905a5..8dbb9e8e44 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1/mutatingadmissionpolicy.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1/mutatingadmissionpolicy.go
@@ -34,12 +34,40 @@ import (
 )
 
 // MutatingAdmissionPolicyInformer provides access to a shared informer and lister for
-// MutatingAdmissionPolicies.
+// MutatingAdmissionPolicies. Prefer using the type-safe variant (see [TypedMutatingAdmissionPolicyInformer]).
 type MutatingAdmissionPolicyInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1.MutatingAdmissionPolicyLister
 }
 
+// TypedMutatingAdmissionPolicyInformer provides access to a shared informer and lister for
+// MutatingAdmissionPolicies, including the type-safe TypedInformer variant.
+// It is a superset of MutatingAdmissionPolicyInformer.
+type TypedMutatingAdmissionPolicyInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() MutatingAdmissionPolicyIndexInformer
+	Lister() admissionregistrationv1.MutatingAdmissionPolicyLister
+}
+
+// MutatingAdmissionPolicyIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type MutatingAdmissionPolicyIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1.MutatingAdmissionPolicy]
+
+// MutatingAdmissionPolicyHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for MutatingAdmissionPolicy.
+type MutatingAdmissionPolicyHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1.MutatingAdmissionPolicy]
+
+// MutatingAdmissionPolicyDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for MutatingAdmissionPolicy.
+type MutatingAdmissionPolicyDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1.MutatingAdmissionPolicy]
+
+// MutatingAdmissionPolicyFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for MutatingAdmissionPolicy.
+type MutatingAdmissionPolicyFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1.MutatingAdmissionPolicy]
+
+// MutatingAdmissionPolicyIndexers is a specialization of [cache.TypedIndexers] for MutatingAdmissionPolicy.
+type MutatingAdmissionPolicyIndexers = cache.TypedIndexers[*apiadmissionregistrationv1.MutatingAdmissionPolicy]
+
+// DeletedMutatingAdmissionPolicy is a specialization of [cache.DeletedObject] for MutatingAdmissionPolicy.
+type DeletedMutatingAdmissionPolicy = cache.DeletedObject[*apiadmissionregistrationv1.MutatingAdmissionPolicy]
+
 type mutatingAdmissionPolicyInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type mutatingAdmissionPolicyInformer struct {
 // NewMutatingAdmissionPolicyInformer constructs a new informer for MutatingAdmissionPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingAdmissionPolicyInformer]).
 func NewMutatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedMutatingAdmissionPolicyInformer constructs a new informer for MutatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingAdmissionPolicyIndexers) MutatingAdmissionPolicyIndexInformer {
+	return NewTypedMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredMutatingAdmissionPolicyInformer constructs a new informer for MutatingAdmissionPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredMutatingAdmissionPolicyInformer]).
 func NewFilteredMutatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredMutatingAdmissionPolicyInformer constructs a new informer for MutatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredMutatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingAdmissionPolicyIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) MutatingAdmissionPolicyIndexInformer {
+	return NewTypedMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewMutatingAdmissionPolicyInformerWithOptions constructs a new informer for MutatingAdmissionPolicy type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingAdmissionPolicyInformerWithOptions]).
 func NewMutatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedMutatingAdmissionPolicyInformerWithOptions(client, options)
+}
+
+// NewTypedMutatingAdmissionPolicyInformerWithOptions constructs a new informer for MutatingAdmissionPolicy type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) MutatingAdmissionPolicyIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1", Resource: "mutatingadmissionpolicys"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.MutatingAdmissionPolicy](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewMutatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface,
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *mutatingAdmissionPolicyInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *mutatingAdmissionPolicyInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1.MutatingAdmissionPolicy{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *mutatingAdmissionPolicyInformer) TypedInformer() MutatingAdmissionPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.MutatingAdmissionPolicy](f.factory.InformerFor(&apiadmissionregistrationv1.MutatingAdmissionPolicy{}, f.defaultInformer))
 }
 
 func (f *mutatingAdmissionPolicyInformer) Lister() admissionregistrationv1.MutatingAdmissionPolicyLister {
 	return admissionregistrationv1.NewMutatingAdmissionPolicyLister(f.Informer().GetIndexer())
 }
+
+// ToTypedMutatingAdmissionPolicyInformer converts an untyped informer into a TypedMutatingAdmissionPolicyInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingAdmissionPolicy. If that is not the case, calling type-safe methods of the returned
+// TypedMutatingAdmissionPolicyInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedMutatingAdmissionPolicyInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedMutatingAdmissionPolicyInformer(informer MutatingAdmissionPolicyInformer) TypedMutatingAdmissionPolicyInformer {
+	if informer, ok := informer.(TypedMutatingAdmissionPolicyInformer); ok {
+		return informer
+	}
+	return &mutatingAdmissionPolicyTypedInformerAdapter{informer}
+}
+
+type mutatingAdmissionPolicyTypedInformerAdapter struct {
+	MutatingAdmissionPolicyInformer
+}
+
+func (a *mutatingAdmissionPolicyTypedInformerAdapter) TypedInformer() MutatingAdmissionPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.MutatingAdmissionPolicy](a.Informer())
+}
+
+// ToMutatingAdmissionPolicyIndexInformer converts an untyped informer into a MutatingAdmissionPolicyIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingAdmissionPolicy. If that is not the case, calling type-safe methods of the returned
+// MutatingAdmissionPolicyIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a MutatingAdmissionPolicyIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToMutatingAdmissionPolicyIndexInformer(informer cache.SharedIndexInformer) MutatingAdmissionPolicyIndexInformer {
+	if informer, ok := informer.(MutatingAdmissionPolicyIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.MutatingAdmissionPolicy](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1/mutatingadmissionpolicybinding.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1/mutatingadmissionpolicybinding.go
index d06ca0b4e1..11da9c840c 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1/mutatingadmissionpolicybinding.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1/mutatingadmissionpolicybinding.go
@@ -34,12 +34,40 @@ import (
 )
 
 // MutatingAdmissionPolicyBindingInformer provides access to a shared informer and lister for
-// MutatingAdmissionPolicyBindings.
+// MutatingAdmissionPolicyBindings. Prefer using the type-safe variant (see [TypedMutatingAdmissionPolicyBindingInformer]).
 type MutatingAdmissionPolicyBindingInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1.MutatingAdmissionPolicyBindingLister
 }
 
+// TypedMutatingAdmissionPolicyBindingInformer provides access to a shared informer and lister for
+// MutatingAdmissionPolicyBindings, including the type-safe TypedInformer variant.
+// It is a superset of MutatingAdmissionPolicyBindingInformer.
+type TypedMutatingAdmissionPolicyBindingInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() MutatingAdmissionPolicyBindingIndexInformer
+	Lister() admissionregistrationv1.MutatingAdmissionPolicyBindingLister
+}
+
+// MutatingAdmissionPolicyBindingIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type MutatingAdmissionPolicyBindingIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1.MutatingAdmissionPolicyBinding]
+
+// MutatingAdmissionPolicyBindingHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for MutatingAdmissionPolicyBinding.
+type MutatingAdmissionPolicyBindingHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1.MutatingAdmissionPolicyBinding]
+
+// MutatingAdmissionPolicyBindingDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for MutatingAdmissionPolicyBinding.
+type MutatingAdmissionPolicyBindingDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1.MutatingAdmissionPolicyBinding]
+
+// MutatingAdmissionPolicyBindingFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for MutatingAdmissionPolicyBinding.
+type MutatingAdmissionPolicyBindingFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1.MutatingAdmissionPolicyBinding]
+
+// MutatingAdmissionPolicyBindingIndexers is a specialization of [cache.TypedIndexers] for MutatingAdmissionPolicyBinding.
+type MutatingAdmissionPolicyBindingIndexers = cache.TypedIndexers[*apiadmissionregistrationv1.MutatingAdmissionPolicyBinding]
+
+// DeletedMutatingAdmissionPolicyBinding is a specialization of [cache.DeletedObject] for MutatingAdmissionPolicyBinding.
+type DeletedMutatingAdmissionPolicyBinding = cache.DeletedObject[*apiadmissionregistrationv1.MutatingAdmissionPolicyBinding]
+
 type mutatingAdmissionPolicyBindingInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type mutatingAdmissionPolicyBindingInformer struct {
 // NewMutatingAdmissionPolicyBindingInformer constructs a new informer for MutatingAdmissionPolicyBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingAdmissionPolicyBindingInformer]).
 func NewMutatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedMutatingAdmissionPolicyBindingInformer constructs a new informer for MutatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingAdmissionPolicyBindingIndexers) MutatingAdmissionPolicyBindingIndexInformer {
+	return NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredMutatingAdmissionPolicyBindingInformer constructs a new informer for MutatingAdmissionPolicyBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredMutatingAdmissionPolicyBindingInformer]).
 func NewFilteredMutatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredMutatingAdmissionPolicyBindingInformer constructs a new informer for MutatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredMutatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingAdmissionPolicyBindingIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) MutatingAdmissionPolicyBindingIndexInformer {
+	return NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewMutatingAdmissionPolicyBindingInformerWithOptions constructs a new informer for MutatingAdmissionPolicyBinding type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingAdmissionPolicyBindingInformerWithOptions]).
 func NewMutatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client, options)
+}
+
+// NewTypedMutatingAdmissionPolicyBindingInformerWithOptions constructs a new informer for MutatingAdmissionPolicyBinding type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) MutatingAdmissionPolicyBindingIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1", Resource: "mutatingadmissionpolicybindings"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.MutatingAdmissionPolicyBinding](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewMutatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.Inte
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *mutatingAdmissionPolicyBindingInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *mutatingAdmissionPolicyBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1.MutatingAdmissionPolicyBinding{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *mutatingAdmissionPolicyBindingInformer) TypedInformer() MutatingAdmissionPolicyBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.MutatingAdmissionPolicyBinding](f.factory.InformerFor(&apiadmissionregistrationv1.MutatingAdmissionPolicyBinding{}, f.defaultInformer))
 }
 
 func (f *mutatingAdmissionPolicyBindingInformer) Lister() admissionregistrationv1.MutatingAdmissionPolicyBindingLister {
 	return admissionregistrationv1.NewMutatingAdmissionPolicyBindingLister(f.Informer().GetIndexer())
 }
+
+// ToTypedMutatingAdmissionPolicyBindingInformer converts an untyped informer into a TypedMutatingAdmissionPolicyBindingInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingAdmissionPolicyBinding. If that is not the case, calling type-safe methods of the returned
+// TypedMutatingAdmissionPolicyBindingInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedMutatingAdmissionPolicyBindingInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedMutatingAdmissionPolicyBindingInformer(informer MutatingAdmissionPolicyBindingInformer) TypedMutatingAdmissionPolicyBindingInformer {
+	if informer, ok := informer.(TypedMutatingAdmissionPolicyBindingInformer); ok {
+		return informer
+	}
+	return &mutatingAdmissionPolicyBindingTypedInformerAdapter{informer}
+}
+
+type mutatingAdmissionPolicyBindingTypedInformerAdapter struct {
+	MutatingAdmissionPolicyBindingInformer
+}
+
+func (a *mutatingAdmissionPolicyBindingTypedInformerAdapter) TypedInformer() MutatingAdmissionPolicyBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.MutatingAdmissionPolicyBinding](a.Informer())
+}
+
+// ToMutatingAdmissionPolicyBindingIndexInformer converts an untyped informer into a MutatingAdmissionPolicyBindingIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingAdmissionPolicyBinding. If that is not the case, calling type-safe methods of the returned
+// MutatingAdmissionPolicyBindingIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a MutatingAdmissionPolicyBindingIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToMutatingAdmissionPolicyBindingIndexInformer(informer cache.SharedIndexInformer) MutatingAdmissionPolicyBindingIndexInformer {
+	if informer, ok := informer.(MutatingAdmissionPolicyBindingIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.MutatingAdmissionPolicyBinding](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1/mutatingwebhookconfiguration.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1/mutatingwebhookconfiguration.go
index d7c48e78a6..32f005c250 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1/mutatingwebhookconfiguration.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1/mutatingwebhookconfiguration.go
@@ -34,12 +34,40 @@ import (
 )
 
 // MutatingWebhookConfigurationInformer provides access to a shared informer and lister for
-// MutatingWebhookConfigurations.
+// MutatingWebhookConfigurations. Prefer using the type-safe variant (see [TypedMutatingWebhookConfigurationInformer]).
 type MutatingWebhookConfigurationInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1.MutatingWebhookConfigurationLister
 }
 
+// TypedMutatingWebhookConfigurationInformer provides access to a shared informer and lister for
+// MutatingWebhookConfigurations, including the type-safe TypedInformer variant.
+// It is a superset of MutatingWebhookConfigurationInformer.
+type TypedMutatingWebhookConfigurationInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() MutatingWebhookConfigurationIndexInformer
+	Lister() admissionregistrationv1.MutatingWebhookConfigurationLister
+}
+
+// MutatingWebhookConfigurationIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type MutatingWebhookConfigurationIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1.MutatingWebhookConfiguration]
+
+// MutatingWebhookConfigurationHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for MutatingWebhookConfiguration.
+type MutatingWebhookConfigurationHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1.MutatingWebhookConfiguration]
+
+// MutatingWebhookConfigurationDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for MutatingWebhookConfiguration.
+type MutatingWebhookConfigurationDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1.MutatingWebhookConfiguration]
+
+// MutatingWebhookConfigurationFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for MutatingWebhookConfiguration.
+type MutatingWebhookConfigurationFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1.MutatingWebhookConfiguration]
+
+// MutatingWebhookConfigurationIndexers is a specialization of [cache.TypedIndexers] for MutatingWebhookConfiguration.
+type MutatingWebhookConfigurationIndexers = cache.TypedIndexers[*apiadmissionregistrationv1.MutatingWebhookConfiguration]
+
+// DeletedMutatingWebhookConfiguration is a specialization of [cache.DeletedObject] for MutatingWebhookConfiguration.
+type DeletedMutatingWebhookConfiguration = cache.DeletedObject[*apiadmissionregistrationv1.MutatingWebhookConfiguration]
+
 type mutatingWebhookConfigurationInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type mutatingWebhookConfigurationInformer struct {
 // NewMutatingWebhookConfigurationInformer constructs a new informer for MutatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingWebhookConfigurationInformer]).
 func NewMutatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewMutatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedMutatingWebhookConfigurationInformer constructs a new informer for MutatingWebhookConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingWebhookConfigurationIndexers) MutatingWebhookConfigurationIndexInformer {
+	return NewTypedMutatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredMutatingWebhookConfigurationInformer constructs a new informer for MutatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredMutatingWebhookConfigurationInformer]).
 func NewFilteredMutatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewMutatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedMutatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredMutatingWebhookConfigurationInformer constructs a new informer for MutatingWebhookConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredMutatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingWebhookConfigurationIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) MutatingWebhookConfigurationIndexInformer {
+	return NewTypedMutatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewMutatingWebhookConfigurationInformerWithOptions constructs a new informer for MutatingWebhookConfiguration type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingWebhookConfigurationInformerWithOptions]).
 func NewMutatingWebhookConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedMutatingWebhookConfigurationInformerWithOptions(client, options)
+}
+
+// NewTypedMutatingWebhookConfigurationInformerWithOptions constructs a new informer for MutatingWebhookConfiguration type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingWebhookConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) MutatingWebhookConfigurationIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1", Resource: "mutatingwebhookconfigurations"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.MutatingWebhookConfiguration](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewMutatingWebhookConfigurationInformerWithOptions(client kubernetes.Interf
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *mutatingWebhookConfigurationInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewMutatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedMutatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *mutatingWebhookConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1.MutatingWebhookConfiguration{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *mutatingWebhookConfigurationInformer) TypedInformer() MutatingWebhookConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.MutatingWebhookConfiguration](f.factory.InformerFor(&apiadmissionregistrationv1.MutatingWebhookConfiguration{}, f.defaultInformer))
 }
 
 func (f *mutatingWebhookConfigurationInformer) Lister() admissionregistrationv1.MutatingWebhookConfigurationLister {
 	return admissionregistrationv1.NewMutatingWebhookConfigurationLister(f.Informer().GetIndexer())
 }
+
+// ToTypedMutatingWebhookConfigurationInformer converts an untyped informer into a TypedMutatingWebhookConfigurationInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingWebhookConfiguration. If that is not the case, calling type-safe methods of the returned
+// TypedMutatingWebhookConfigurationInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedMutatingWebhookConfigurationInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedMutatingWebhookConfigurationInformer(informer MutatingWebhookConfigurationInformer) TypedMutatingWebhookConfigurationInformer {
+	if informer, ok := informer.(TypedMutatingWebhookConfigurationInformer); ok {
+		return informer
+	}
+	return &mutatingWebhookConfigurationTypedInformerAdapter{informer}
+}
+
+type mutatingWebhookConfigurationTypedInformerAdapter struct {
+	MutatingWebhookConfigurationInformer
+}
+
+func (a *mutatingWebhookConfigurationTypedInformerAdapter) TypedInformer() MutatingWebhookConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.MutatingWebhookConfiguration](a.Informer())
+}
+
+// ToMutatingWebhookConfigurationIndexInformer converts an untyped informer into a MutatingWebhookConfigurationIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingWebhookConfiguration. If that is not the case, calling type-safe methods of the returned
+// MutatingWebhookConfigurationIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a MutatingWebhookConfigurationIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToMutatingWebhookConfigurationIndexInformer(informer cache.SharedIndexInformer) MutatingWebhookConfigurationIndexInformer {
+	if informer, ok := informer.(MutatingWebhookConfigurationIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.MutatingWebhookConfiguration](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1/validatingadmissionpolicy.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1/validatingadmissionpolicy.go
index bdc5c0b28a..84017947a7 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1/validatingadmissionpolicy.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1/validatingadmissionpolicy.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ValidatingAdmissionPolicyInformer provides access to a shared informer and lister for
-// ValidatingAdmissionPolicies.
+// ValidatingAdmissionPolicies. Prefer using the type-safe variant (see [TypedValidatingAdmissionPolicyInformer]).
 type ValidatingAdmissionPolicyInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1.ValidatingAdmissionPolicyLister
 }
 
+// TypedValidatingAdmissionPolicyInformer provides access to a shared informer and lister for
+// ValidatingAdmissionPolicies, including the type-safe TypedInformer variant.
+// It is a superset of ValidatingAdmissionPolicyInformer.
+type TypedValidatingAdmissionPolicyInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ValidatingAdmissionPolicyIndexInformer
+	Lister() admissionregistrationv1.ValidatingAdmissionPolicyLister
+}
+
+// ValidatingAdmissionPolicyIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ValidatingAdmissionPolicyIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1.ValidatingAdmissionPolicy]
+
+// ValidatingAdmissionPolicyHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ValidatingAdmissionPolicy.
+type ValidatingAdmissionPolicyHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1.ValidatingAdmissionPolicy]
+
+// ValidatingAdmissionPolicyDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ValidatingAdmissionPolicy.
+type ValidatingAdmissionPolicyDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1.ValidatingAdmissionPolicy]
+
+// ValidatingAdmissionPolicyFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ValidatingAdmissionPolicy.
+type ValidatingAdmissionPolicyFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1.ValidatingAdmissionPolicy]
+
+// ValidatingAdmissionPolicyIndexers is a specialization of [cache.TypedIndexers] for ValidatingAdmissionPolicy.
+type ValidatingAdmissionPolicyIndexers = cache.TypedIndexers[*apiadmissionregistrationv1.ValidatingAdmissionPolicy]
+
+// DeletedValidatingAdmissionPolicy is a specialization of [cache.DeletedObject] for ValidatingAdmissionPolicy.
+type DeletedValidatingAdmissionPolicy = cache.DeletedObject[*apiadmissionregistrationv1.ValidatingAdmissionPolicy]
+
 type validatingAdmissionPolicyInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type validatingAdmissionPolicyInformer struct {
 // NewValidatingAdmissionPolicyInformer constructs a new informer for ValidatingAdmissionPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingAdmissionPolicyInformer]).
 func NewValidatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedValidatingAdmissionPolicyInformer constructs a new informer for ValidatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingAdmissionPolicyIndexers) ValidatingAdmissionPolicyIndexInformer {
+	return NewTypedValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredValidatingAdmissionPolicyInformer constructs a new informer for ValidatingAdmissionPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredValidatingAdmissionPolicyInformer]).
 func NewFilteredValidatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredValidatingAdmissionPolicyInformer constructs a new informer for ValidatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredValidatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingAdmissionPolicyIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ValidatingAdmissionPolicyIndexInformer {
+	return NewTypedValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewValidatingAdmissionPolicyInformerWithOptions constructs a new informer for ValidatingAdmissionPolicy type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingAdmissionPolicyInformerWithOptions]).
 func NewValidatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedValidatingAdmissionPolicyInformerWithOptions(client, options)
+}
+
+// NewTypedValidatingAdmissionPolicyInformerWithOptions constructs a new informer for ValidatingAdmissionPolicy type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ValidatingAdmissionPolicyIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1", Resource: "validatingadmissionpolicys"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.ValidatingAdmissionPolicy](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewValidatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *validatingAdmissionPolicyInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *validatingAdmissionPolicyInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1.ValidatingAdmissionPolicy{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *validatingAdmissionPolicyInformer) TypedInformer() ValidatingAdmissionPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.ValidatingAdmissionPolicy](f.factory.InformerFor(&apiadmissionregistrationv1.ValidatingAdmissionPolicy{}, f.defaultInformer))
 }
 
 func (f *validatingAdmissionPolicyInformer) Lister() admissionregistrationv1.ValidatingAdmissionPolicyLister {
 	return admissionregistrationv1.NewValidatingAdmissionPolicyLister(f.Informer().GetIndexer())
 }
+
+// ToTypedValidatingAdmissionPolicyInformer converts an untyped informer into a TypedValidatingAdmissionPolicyInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingAdmissionPolicy. If that is not the case, calling type-safe methods of the returned
+// TypedValidatingAdmissionPolicyInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedValidatingAdmissionPolicyInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedValidatingAdmissionPolicyInformer(informer ValidatingAdmissionPolicyInformer) TypedValidatingAdmissionPolicyInformer {
+	if informer, ok := informer.(TypedValidatingAdmissionPolicyInformer); ok {
+		return informer
+	}
+	return &validatingAdmissionPolicyTypedInformerAdapter{informer}
+}
+
+type validatingAdmissionPolicyTypedInformerAdapter struct {
+	ValidatingAdmissionPolicyInformer
+}
+
+func (a *validatingAdmissionPolicyTypedInformerAdapter) TypedInformer() ValidatingAdmissionPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.ValidatingAdmissionPolicy](a.Informer())
+}
+
+// ToValidatingAdmissionPolicyIndexInformer converts an untyped informer into a ValidatingAdmissionPolicyIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingAdmissionPolicy. If that is not the case, calling type-safe methods of the returned
+// ValidatingAdmissionPolicyIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ValidatingAdmissionPolicyIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToValidatingAdmissionPolicyIndexInformer(informer cache.SharedIndexInformer) ValidatingAdmissionPolicyIndexInformer {
+	if informer, ok := informer.(ValidatingAdmissionPolicyIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.ValidatingAdmissionPolicy](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1/validatingadmissionpolicybinding.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1/validatingadmissionpolicybinding.go
index 1ecf9703a9..d79eaf5411 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1/validatingadmissionpolicybinding.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1/validatingadmissionpolicybinding.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ValidatingAdmissionPolicyBindingInformer provides access to a shared informer and lister for
-// ValidatingAdmissionPolicyBindings.
+// ValidatingAdmissionPolicyBindings. Prefer using the type-safe variant (see [TypedValidatingAdmissionPolicyBindingInformer]).
 type ValidatingAdmissionPolicyBindingInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1.ValidatingAdmissionPolicyBindingLister
 }
 
+// TypedValidatingAdmissionPolicyBindingInformer provides access to a shared informer and lister for
+// ValidatingAdmissionPolicyBindings, including the type-safe TypedInformer variant.
+// It is a superset of ValidatingAdmissionPolicyBindingInformer.
+type TypedValidatingAdmissionPolicyBindingInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ValidatingAdmissionPolicyBindingIndexInformer
+	Lister() admissionregistrationv1.ValidatingAdmissionPolicyBindingLister
+}
+
+// ValidatingAdmissionPolicyBindingIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ValidatingAdmissionPolicyBindingIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1.ValidatingAdmissionPolicyBinding]
+
+// ValidatingAdmissionPolicyBindingHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ValidatingAdmissionPolicyBinding.
+type ValidatingAdmissionPolicyBindingHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1.ValidatingAdmissionPolicyBinding]
+
+// ValidatingAdmissionPolicyBindingDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ValidatingAdmissionPolicyBinding.
+type ValidatingAdmissionPolicyBindingDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1.ValidatingAdmissionPolicyBinding]
+
+// ValidatingAdmissionPolicyBindingFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ValidatingAdmissionPolicyBinding.
+type ValidatingAdmissionPolicyBindingFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1.ValidatingAdmissionPolicyBinding]
+
+// ValidatingAdmissionPolicyBindingIndexers is a specialization of [cache.TypedIndexers] for ValidatingAdmissionPolicyBinding.
+type ValidatingAdmissionPolicyBindingIndexers = cache.TypedIndexers[*apiadmissionregistrationv1.ValidatingAdmissionPolicyBinding]
+
+// DeletedValidatingAdmissionPolicyBinding is a specialization of [cache.DeletedObject] for ValidatingAdmissionPolicyBinding.
+type DeletedValidatingAdmissionPolicyBinding = cache.DeletedObject[*apiadmissionregistrationv1.ValidatingAdmissionPolicyBinding]
+
 type validatingAdmissionPolicyBindingInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type validatingAdmissionPolicyBindingInformer struct {
 // NewValidatingAdmissionPolicyBindingInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingAdmissionPolicyBindingInformer]).
 func NewValidatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedValidatingAdmissionPolicyBindingInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingAdmissionPolicyBindingIndexers) ValidatingAdmissionPolicyBindingIndexInformer {
+	return NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredValidatingAdmissionPolicyBindingInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredValidatingAdmissionPolicyBindingInformer]).
 func NewFilteredValidatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredValidatingAdmissionPolicyBindingInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredValidatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingAdmissionPolicyBindingIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ValidatingAdmissionPolicyBindingIndexInformer {
+	return NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewValidatingAdmissionPolicyBindingInformerWithOptions constructs a new informer for ValidatingAdmissionPolicyBinding type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingAdmissionPolicyBindingInformerWithOptions]).
 func NewValidatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client, options)
+}
+
+// NewTypedValidatingAdmissionPolicyBindingInformerWithOptions constructs a new informer for ValidatingAdmissionPolicyBinding type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ValidatingAdmissionPolicyBindingIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1", Resource: "validatingadmissionpolicybindings"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.ValidatingAdmissionPolicyBinding](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewValidatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.In
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *validatingAdmissionPolicyBindingInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *validatingAdmissionPolicyBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1.ValidatingAdmissionPolicyBinding{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *validatingAdmissionPolicyBindingInformer) TypedInformer() ValidatingAdmissionPolicyBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.ValidatingAdmissionPolicyBinding](f.factory.InformerFor(&apiadmissionregistrationv1.ValidatingAdmissionPolicyBinding{}, f.defaultInformer))
 }
 
 func (f *validatingAdmissionPolicyBindingInformer) Lister() admissionregistrationv1.ValidatingAdmissionPolicyBindingLister {
 	return admissionregistrationv1.NewValidatingAdmissionPolicyBindingLister(f.Informer().GetIndexer())
 }
+
+// ToTypedValidatingAdmissionPolicyBindingInformer converts an untyped informer into a TypedValidatingAdmissionPolicyBindingInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingAdmissionPolicyBinding. If that is not the case, calling type-safe methods of the returned
+// TypedValidatingAdmissionPolicyBindingInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedValidatingAdmissionPolicyBindingInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedValidatingAdmissionPolicyBindingInformer(informer ValidatingAdmissionPolicyBindingInformer) TypedValidatingAdmissionPolicyBindingInformer {
+	if informer, ok := informer.(TypedValidatingAdmissionPolicyBindingInformer); ok {
+		return informer
+	}
+	return &validatingAdmissionPolicyBindingTypedInformerAdapter{informer}
+}
+
+type validatingAdmissionPolicyBindingTypedInformerAdapter struct {
+	ValidatingAdmissionPolicyBindingInformer
+}
+
+func (a *validatingAdmissionPolicyBindingTypedInformerAdapter) TypedInformer() ValidatingAdmissionPolicyBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.ValidatingAdmissionPolicyBinding](a.Informer())
+}
+
+// ToValidatingAdmissionPolicyBindingIndexInformer converts an untyped informer into a ValidatingAdmissionPolicyBindingIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingAdmissionPolicyBinding. If that is not the case, calling type-safe methods of the returned
+// ValidatingAdmissionPolicyBindingIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ValidatingAdmissionPolicyBindingIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToValidatingAdmissionPolicyBindingIndexInformer(informer cache.SharedIndexInformer) ValidatingAdmissionPolicyBindingIndexInformer {
+	if informer, ok := informer.(ValidatingAdmissionPolicyBindingIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.ValidatingAdmissionPolicyBinding](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1/validatingwebhookconfiguration.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1/validatingwebhookconfiguration.go
index 07653c35ce..98ba6e012a 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1/validatingwebhookconfiguration.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1/validatingwebhookconfiguration.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ValidatingWebhookConfigurationInformer provides access to a shared informer and lister for
-// ValidatingWebhookConfigurations.
+// ValidatingWebhookConfigurations. Prefer using the type-safe variant (see [TypedValidatingWebhookConfigurationInformer]).
 type ValidatingWebhookConfigurationInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1.ValidatingWebhookConfigurationLister
 }
 
+// TypedValidatingWebhookConfigurationInformer provides access to a shared informer and lister for
+// ValidatingWebhookConfigurations, including the type-safe TypedInformer variant.
+// It is a superset of ValidatingWebhookConfigurationInformer.
+type TypedValidatingWebhookConfigurationInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ValidatingWebhookConfigurationIndexInformer
+	Lister() admissionregistrationv1.ValidatingWebhookConfigurationLister
+}
+
+// ValidatingWebhookConfigurationIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ValidatingWebhookConfigurationIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1.ValidatingWebhookConfiguration]
+
+// ValidatingWebhookConfigurationHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ValidatingWebhookConfiguration.
+type ValidatingWebhookConfigurationHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1.ValidatingWebhookConfiguration]
+
+// ValidatingWebhookConfigurationDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ValidatingWebhookConfiguration.
+type ValidatingWebhookConfigurationDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1.ValidatingWebhookConfiguration]
+
+// ValidatingWebhookConfigurationFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ValidatingWebhookConfiguration.
+type ValidatingWebhookConfigurationFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1.ValidatingWebhookConfiguration]
+
+// ValidatingWebhookConfigurationIndexers is a specialization of [cache.TypedIndexers] for ValidatingWebhookConfiguration.
+type ValidatingWebhookConfigurationIndexers = cache.TypedIndexers[*apiadmissionregistrationv1.ValidatingWebhookConfiguration]
+
+// DeletedValidatingWebhookConfiguration is a specialization of [cache.DeletedObject] for ValidatingWebhookConfiguration.
+type DeletedValidatingWebhookConfiguration = cache.DeletedObject[*apiadmissionregistrationv1.ValidatingWebhookConfiguration]
+
 type validatingWebhookConfigurationInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type validatingWebhookConfigurationInformer struct {
 // NewValidatingWebhookConfigurationInformer constructs a new informer for ValidatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingWebhookConfigurationInformer]).
 func NewValidatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewValidatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedValidatingWebhookConfigurationInformer constructs a new informer for ValidatingWebhookConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingWebhookConfigurationIndexers) ValidatingWebhookConfigurationIndexInformer {
+	return NewTypedValidatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredValidatingWebhookConfigurationInformer constructs a new informer for ValidatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredValidatingWebhookConfigurationInformer]).
 func NewFilteredValidatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewValidatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedValidatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredValidatingWebhookConfigurationInformer constructs a new informer for ValidatingWebhookConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredValidatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingWebhookConfigurationIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ValidatingWebhookConfigurationIndexInformer {
+	return NewTypedValidatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewValidatingWebhookConfigurationInformerWithOptions constructs a new informer for ValidatingWebhookConfiguration type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingWebhookConfigurationInformerWithOptions]).
 func NewValidatingWebhookConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedValidatingWebhookConfigurationInformerWithOptions(client, options)
+}
+
+// NewTypedValidatingWebhookConfigurationInformerWithOptions constructs a new informer for ValidatingWebhookConfiguration type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingWebhookConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ValidatingWebhookConfigurationIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1", Resource: "validatingwebhookconfigurations"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.ValidatingWebhookConfiguration](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewValidatingWebhookConfigurationInformerWithOptions(client kubernetes.Inte
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *validatingWebhookConfigurationInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewValidatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedValidatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *validatingWebhookConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1.ValidatingWebhookConfiguration{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *validatingWebhookConfigurationInformer) TypedInformer() ValidatingWebhookConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.ValidatingWebhookConfiguration](f.factory.InformerFor(&apiadmissionregistrationv1.ValidatingWebhookConfiguration{}, f.defaultInformer))
 }
 
 func (f *validatingWebhookConfigurationInformer) Lister() admissionregistrationv1.ValidatingWebhookConfigurationLister {
 	return admissionregistrationv1.NewValidatingWebhookConfigurationLister(f.Informer().GetIndexer())
 }
+
+// ToTypedValidatingWebhookConfigurationInformer converts an untyped informer into a TypedValidatingWebhookConfigurationInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingWebhookConfiguration. If that is not the case, calling type-safe methods of the returned
+// TypedValidatingWebhookConfigurationInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedValidatingWebhookConfigurationInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedValidatingWebhookConfigurationInformer(informer ValidatingWebhookConfigurationInformer) TypedValidatingWebhookConfigurationInformer {
+	if informer, ok := informer.(TypedValidatingWebhookConfigurationInformer); ok {
+		return informer
+	}
+	return &validatingWebhookConfigurationTypedInformerAdapter{informer}
+}
+
+type validatingWebhookConfigurationTypedInformerAdapter struct {
+	ValidatingWebhookConfigurationInformer
+}
+
+func (a *validatingWebhookConfigurationTypedInformerAdapter) TypedInformer() ValidatingWebhookConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.ValidatingWebhookConfiguration](a.Informer())
+}
+
+// ToValidatingWebhookConfigurationIndexInformer converts an untyped informer into a ValidatingWebhookConfigurationIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingWebhookConfiguration. If that is not the case, calling type-safe methods of the returned
+// ValidatingWebhookConfigurationIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ValidatingWebhookConfigurationIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToValidatingWebhookConfigurationIndexInformer(informer cache.SharedIndexInformer) ValidatingWebhookConfigurationIndexInformer {
+	if informer, ok := informer.(ValidatingWebhookConfigurationIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1.ValidatingWebhookConfiguration](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/interface.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/interface.go
index 68ae4e25cb..43702bde93 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/interface.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/interface.go
@@ -25,13 +25,13 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// MutatingAdmissionPolicies returns a MutatingAdmissionPolicyInformer.
-	MutatingAdmissionPolicies() MutatingAdmissionPolicyInformer
+	MutatingAdmissionPolicies() TypedMutatingAdmissionPolicyInformer
 	// MutatingAdmissionPolicyBindings returns a MutatingAdmissionPolicyBindingInformer.
-	MutatingAdmissionPolicyBindings() MutatingAdmissionPolicyBindingInformer
+	MutatingAdmissionPolicyBindings() TypedMutatingAdmissionPolicyBindingInformer
 	// ValidatingAdmissionPolicies returns a ValidatingAdmissionPolicyInformer.
-	ValidatingAdmissionPolicies() ValidatingAdmissionPolicyInformer
+	ValidatingAdmissionPolicies() TypedValidatingAdmissionPolicyInformer
 	// ValidatingAdmissionPolicyBindings returns a ValidatingAdmissionPolicyBindingInformer.
-	ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingInformer
+	ValidatingAdmissionPolicyBindings() TypedValidatingAdmissionPolicyBindingInformer
 }
 
 type version struct {
@@ -45,22 +45,22 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// MutatingAdmissionPolicies returns a MutatingAdmissionPolicyInformer.
-func (v *version) MutatingAdmissionPolicies() MutatingAdmissionPolicyInformer {
+// MutatingAdmissionPolicies returns a TypedMutatingAdmissionPolicyInformer.
+func (v *version) MutatingAdmissionPolicies() TypedMutatingAdmissionPolicyInformer {
 	return &mutatingAdmissionPolicyInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// MutatingAdmissionPolicyBindings returns a MutatingAdmissionPolicyBindingInformer.
-func (v *version) MutatingAdmissionPolicyBindings() MutatingAdmissionPolicyBindingInformer {
+// MutatingAdmissionPolicyBindings returns a TypedMutatingAdmissionPolicyBindingInformer.
+func (v *version) MutatingAdmissionPolicyBindings() TypedMutatingAdmissionPolicyBindingInformer {
 	return &mutatingAdmissionPolicyBindingInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ValidatingAdmissionPolicies returns a ValidatingAdmissionPolicyInformer.
-func (v *version) ValidatingAdmissionPolicies() ValidatingAdmissionPolicyInformer {
+// ValidatingAdmissionPolicies returns a TypedValidatingAdmissionPolicyInformer.
+func (v *version) ValidatingAdmissionPolicies() TypedValidatingAdmissionPolicyInformer {
 	return &validatingAdmissionPolicyInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ValidatingAdmissionPolicyBindings returns a ValidatingAdmissionPolicyBindingInformer.
-func (v *version) ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingInformer {
+// ValidatingAdmissionPolicyBindings returns a TypedValidatingAdmissionPolicyBindingInformer.
+func (v *version) ValidatingAdmissionPolicyBindings() TypedValidatingAdmissionPolicyBindingInformer {
 	return &validatingAdmissionPolicyBindingInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/mutatingadmissionpolicy.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/mutatingadmissionpolicy.go
index 3441d6df44..387e8c9046 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/mutatingadmissionpolicy.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/mutatingadmissionpolicy.go
@@ -34,12 +34,40 @@ import (
 )
 
 // MutatingAdmissionPolicyInformer provides access to a shared informer and lister for
-// MutatingAdmissionPolicies.
+// MutatingAdmissionPolicies. Prefer using the type-safe variant (see [TypedMutatingAdmissionPolicyInformer]).
 type MutatingAdmissionPolicyInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1alpha1.MutatingAdmissionPolicyLister
 }
 
+// TypedMutatingAdmissionPolicyInformer provides access to a shared informer and lister for
+// MutatingAdmissionPolicies, including the type-safe TypedInformer variant.
+// It is a superset of MutatingAdmissionPolicyInformer.
+type TypedMutatingAdmissionPolicyInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() MutatingAdmissionPolicyIndexInformer
+	Lister() admissionregistrationv1alpha1.MutatingAdmissionPolicyLister
+}
+
+// MutatingAdmissionPolicyIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type MutatingAdmissionPolicyIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicy]
+
+// MutatingAdmissionPolicyHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for MutatingAdmissionPolicy.
+type MutatingAdmissionPolicyHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicy]
+
+// MutatingAdmissionPolicyDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for MutatingAdmissionPolicy.
+type MutatingAdmissionPolicyDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicy]
+
+// MutatingAdmissionPolicyFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for MutatingAdmissionPolicy.
+type MutatingAdmissionPolicyFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicy]
+
+// MutatingAdmissionPolicyIndexers is a specialization of [cache.TypedIndexers] for MutatingAdmissionPolicy.
+type MutatingAdmissionPolicyIndexers = cache.TypedIndexers[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicy]
+
+// DeletedMutatingAdmissionPolicy is a specialization of [cache.DeletedObject] for MutatingAdmissionPolicy.
+type DeletedMutatingAdmissionPolicy = cache.DeletedObject[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicy]
+
 type mutatingAdmissionPolicyInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type mutatingAdmissionPolicyInformer struct {
 // NewMutatingAdmissionPolicyInformer constructs a new informer for MutatingAdmissionPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingAdmissionPolicyInformer]).
 func NewMutatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedMutatingAdmissionPolicyInformer constructs a new informer for MutatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingAdmissionPolicyIndexers) MutatingAdmissionPolicyIndexInformer {
+	return NewTypedMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredMutatingAdmissionPolicyInformer constructs a new informer for MutatingAdmissionPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredMutatingAdmissionPolicyInformer]).
 func NewFilteredMutatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredMutatingAdmissionPolicyInformer constructs a new informer for MutatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredMutatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingAdmissionPolicyIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) MutatingAdmissionPolicyIndexInformer {
+	return NewTypedMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewMutatingAdmissionPolicyInformerWithOptions constructs a new informer for MutatingAdmissionPolicy type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingAdmissionPolicyInformerWithOptions]).
 func NewMutatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedMutatingAdmissionPolicyInformerWithOptions(client, options)
+}
+
+// NewTypedMutatingAdmissionPolicyInformerWithOptions constructs a new informer for MutatingAdmissionPolicy type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) MutatingAdmissionPolicyIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1alpha1", Resource: "mutatingadmissionpolicys"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicy](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewMutatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface,
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *mutatingAdmissionPolicyInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *mutatingAdmissionPolicyInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1alpha1.MutatingAdmissionPolicy{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *mutatingAdmissionPolicyInformer) TypedInformer() MutatingAdmissionPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicy](f.factory.InformerFor(&apiadmissionregistrationv1alpha1.MutatingAdmissionPolicy{}, f.defaultInformer))
 }
 
 func (f *mutatingAdmissionPolicyInformer) Lister() admissionregistrationv1alpha1.MutatingAdmissionPolicyLister {
 	return admissionregistrationv1alpha1.NewMutatingAdmissionPolicyLister(f.Informer().GetIndexer())
 }
+
+// ToTypedMutatingAdmissionPolicyInformer converts an untyped informer into a TypedMutatingAdmissionPolicyInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingAdmissionPolicy. If that is not the case, calling type-safe methods of the returned
+// TypedMutatingAdmissionPolicyInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedMutatingAdmissionPolicyInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedMutatingAdmissionPolicyInformer(informer MutatingAdmissionPolicyInformer) TypedMutatingAdmissionPolicyInformer {
+	if informer, ok := informer.(TypedMutatingAdmissionPolicyInformer); ok {
+		return informer
+	}
+	return &mutatingAdmissionPolicyTypedInformerAdapter{informer}
+}
+
+type mutatingAdmissionPolicyTypedInformerAdapter struct {
+	MutatingAdmissionPolicyInformer
+}
+
+func (a *mutatingAdmissionPolicyTypedInformerAdapter) TypedInformer() MutatingAdmissionPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicy](a.Informer())
+}
+
+// ToMutatingAdmissionPolicyIndexInformer converts an untyped informer into a MutatingAdmissionPolicyIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingAdmissionPolicy. If that is not the case, calling type-safe methods of the returned
+// MutatingAdmissionPolicyIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a MutatingAdmissionPolicyIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToMutatingAdmissionPolicyIndexInformer(informer cache.SharedIndexInformer) MutatingAdmissionPolicyIndexInformer {
+	if informer, ok := informer.(MutatingAdmissionPolicyIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicy](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go
index 568c911159..b831a8d7a4 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go
@@ -34,12 +34,40 @@ import (
 )
 
 // MutatingAdmissionPolicyBindingInformer provides access to a shared informer and lister for
-// MutatingAdmissionPolicyBindings.
+// MutatingAdmissionPolicyBindings. Prefer using the type-safe variant (see [TypedMutatingAdmissionPolicyBindingInformer]).
 type MutatingAdmissionPolicyBindingInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingLister
 }
 
+// TypedMutatingAdmissionPolicyBindingInformer provides access to a shared informer and lister for
+// MutatingAdmissionPolicyBindings, including the type-safe TypedInformer variant.
+// It is a superset of MutatingAdmissionPolicyBindingInformer.
+type TypedMutatingAdmissionPolicyBindingInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() MutatingAdmissionPolicyBindingIndexInformer
+	Lister() admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingLister
+}
+
+// MutatingAdmissionPolicyBindingIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type MutatingAdmissionPolicyBindingIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBinding]
+
+// MutatingAdmissionPolicyBindingHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for MutatingAdmissionPolicyBinding.
+type MutatingAdmissionPolicyBindingHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBinding]
+
+// MutatingAdmissionPolicyBindingDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for MutatingAdmissionPolicyBinding.
+type MutatingAdmissionPolicyBindingDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBinding]
+
+// MutatingAdmissionPolicyBindingFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for MutatingAdmissionPolicyBinding.
+type MutatingAdmissionPolicyBindingFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBinding]
+
+// MutatingAdmissionPolicyBindingIndexers is a specialization of [cache.TypedIndexers] for MutatingAdmissionPolicyBinding.
+type MutatingAdmissionPolicyBindingIndexers = cache.TypedIndexers[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBinding]
+
+// DeletedMutatingAdmissionPolicyBinding is a specialization of [cache.DeletedObject] for MutatingAdmissionPolicyBinding.
+type DeletedMutatingAdmissionPolicyBinding = cache.DeletedObject[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBinding]
+
 type mutatingAdmissionPolicyBindingInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type mutatingAdmissionPolicyBindingInformer struct {
 // NewMutatingAdmissionPolicyBindingInformer constructs a new informer for MutatingAdmissionPolicyBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingAdmissionPolicyBindingInformer]).
 func NewMutatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedMutatingAdmissionPolicyBindingInformer constructs a new informer for MutatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingAdmissionPolicyBindingIndexers) MutatingAdmissionPolicyBindingIndexInformer {
+	return NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredMutatingAdmissionPolicyBindingInformer constructs a new informer for MutatingAdmissionPolicyBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredMutatingAdmissionPolicyBindingInformer]).
 func NewFilteredMutatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredMutatingAdmissionPolicyBindingInformer constructs a new informer for MutatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredMutatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingAdmissionPolicyBindingIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) MutatingAdmissionPolicyBindingIndexInformer {
+	return NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewMutatingAdmissionPolicyBindingInformerWithOptions constructs a new informer for MutatingAdmissionPolicyBinding type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingAdmissionPolicyBindingInformerWithOptions]).
 func NewMutatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client, options)
+}
+
+// NewTypedMutatingAdmissionPolicyBindingInformerWithOptions constructs a new informer for MutatingAdmissionPolicyBinding type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) MutatingAdmissionPolicyBindingIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1alpha1", Resource: "mutatingadmissionpolicybindings"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBinding](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewMutatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.Inte
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *mutatingAdmissionPolicyBindingInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *mutatingAdmissionPolicyBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBinding{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *mutatingAdmissionPolicyBindingInformer) TypedInformer() MutatingAdmissionPolicyBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBinding](f.factory.InformerFor(&apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBinding{}, f.defaultInformer))
 }
 
 func (f *mutatingAdmissionPolicyBindingInformer) Lister() admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingLister {
 	return admissionregistrationv1alpha1.NewMutatingAdmissionPolicyBindingLister(f.Informer().GetIndexer())
 }
+
+// ToTypedMutatingAdmissionPolicyBindingInformer converts an untyped informer into a TypedMutatingAdmissionPolicyBindingInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingAdmissionPolicyBinding. If that is not the case, calling type-safe methods of the returned
+// TypedMutatingAdmissionPolicyBindingInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedMutatingAdmissionPolicyBindingInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedMutatingAdmissionPolicyBindingInformer(informer MutatingAdmissionPolicyBindingInformer) TypedMutatingAdmissionPolicyBindingInformer {
+	if informer, ok := informer.(TypedMutatingAdmissionPolicyBindingInformer); ok {
+		return informer
+	}
+	return &mutatingAdmissionPolicyBindingTypedInformerAdapter{informer}
+}
+
+type mutatingAdmissionPolicyBindingTypedInformerAdapter struct {
+	MutatingAdmissionPolicyBindingInformer
+}
+
+func (a *mutatingAdmissionPolicyBindingTypedInformerAdapter) TypedInformer() MutatingAdmissionPolicyBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBinding](a.Informer())
+}
+
+// ToMutatingAdmissionPolicyBindingIndexInformer converts an untyped informer into a MutatingAdmissionPolicyBindingIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingAdmissionPolicyBinding. If that is not the case, calling type-safe methods of the returned
+// MutatingAdmissionPolicyBindingIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a MutatingAdmissionPolicyBindingIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToMutatingAdmissionPolicyBindingIndexInformer(informer cache.SharedIndexInformer) MutatingAdmissionPolicyBindingIndexInformer {
+	if informer, ok := informer.(MutatingAdmissionPolicyBindingIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBinding](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/validatingadmissionpolicy.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/validatingadmissionpolicy.go
index c86ca6da62..db8efca26a 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/validatingadmissionpolicy.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/validatingadmissionpolicy.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ValidatingAdmissionPolicyInformer provides access to a shared informer and lister for
-// ValidatingAdmissionPolicies.
+// ValidatingAdmissionPolicies. Prefer using the type-safe variant (see [TypedValidatingAdmissionPolicyInformer]).
 type ValidatingAdmissionPolicyInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1alpha1.ValidatingAdmissionPolicyLister
 }
 
+// TypedValidatingAdmissionPolicyInformer provides access to a shared informer and lister for
+// ValidatingAdmissionPolicies, including the type-safe TypedInformer variant.
+// It is a superset of ValidatingAdmissionPolicyInformer.
+type TypedValidatingAdmissionPolicyInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ValidatingAdmissionPolicyIndexInformer
+	Lister() admissionregistrationv1alpha1.ValidatingAdmissionPolicyLister
+}
+
+// ValidatingAdmissionPolicyIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ValidatingAdmissionPolicyIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicy]
+
+// ValidatingAdmissionPolicyHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ValidatingAdmissionPolicy.
+type ValidatingAdmissionPolicyHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicy]
+
+// ValidatingAdmissionPolicyDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ValidatingAdmissionPolicy.
+type ValidatingAdmissionPolicyDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicy]
+
+// ValidatingAdmissionPolicyFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ValidatingAdmissionPolicy.
+type ValidatingAdmissionPolicyFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicy]
+
+// ValidatingAdmissionPolicyIndexers is a specialization of [cache.TypedIndexers] for ValidatingAdmissionPolicy.
+type ValidatingAdmissionPolicyIndexers = cache.TypedIndexers[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicy]
+
+// DeletedValidatingAdmissionPolicy is a specialization of [cache.DeletedObject] for ValidatingAdmissionPolicy.
+type DeletedValidatingAdmissionPolicy = cache.DeletedObject[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicy]
+
 type validatingAdmissionPolicyInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type validatingAdmissionPolicyInformer struct {
 // NewValidatingAdmissionPolicyInformer constructs a new informer for ValidatingAdmissionPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingAdmissionPolicyInformer]).
 func NewValidatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedValidatingAdmissionPolicyInformer constructs a new informer for ValidatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingAdmissionPolicyIndexers) ValidatingAdmissionPolicyIndexInformer {
+	return NewTypedValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredValidatingAdmissionPolicyInformer constructs a new informer for ValidatingAdmissionPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredValidatingAdmissionPolicyInformer]).
 func NewFilteredValidatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredValidatingAdmissionPolicyInformer constructs a new informer for ValidatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredValidatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingAdmissionPolicyIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ValidatingAdmissionPolicyIndexInformer {
+	return NewTypedValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewValidatingAdmissionPolicyInformerWithOptions constructs a new informer for ValidatingAdmissionPolicy type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingAdmissionPolicyInformerWithOptions]).
 func NewValidatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedValidatingAdmissionPolicyInformerWithOptions(client, options)
+}
+
+// NewTypedValidatingAdmissionPolicyInformerWithOptions constructs a new informer for ValidatingAdmissionPolicy type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ValidatingAdmissionPolicyIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1alpha1", Resource: "validatingadmissionpolicys"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicy](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewValidatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *validatingAdmissionPolicyInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *validatingAdmissionPolicyInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicy{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *validatingAdmissionPolicyInformer) TypedInformer() ValidatingAdmissionPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicy](f.factory.InformerFor(&apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicy{}, f.defaultInformer))
 }
 
 func (f *validatingAdmissionPolicyInformer) Lister() admissionregistrationv1alpha1.ValidatingAdmissionPolicyLister {
 	return admissionregistrationv1alpha1.NewValidatingAdmissionPolicyLister(f.Informer().GetIndexer())
 }
+
+// ToTypedValidatingAdmissionPolicyInformer converts an untyped informer into a TypedValidatingAdmissionPolicyInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingAdmissionPolicy. If that is not the case, calling type-safe methods of the returned
+// TypedValidatingAdmissionPolicyInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedValidatingAdmissionPolicyInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedValidatingAdmissionPolicyInformer(informer ValidatingAdmissionPolicyInformer) TypedValidatingAdmissionPolicyInformer {
+	if informer, ok := informer.(TypedValidatingAdmissionPolicyInformer); ok {
+		return informer
+	}
+	return &validatingAdmissionPolicyTypedInformerAdapter{informer}
+}
+
+type validatingAdmissionPolicyTypedInformerAdapter struct {
+	ValidatingAdmissionPolicyInformer
+}
+
+func (a *validatingAdmissionPolicyTypedInformerAdapter) TypedInformer() ValidatingAdmissionPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicy](a.Informer())
+}
+
+// ToValidatingAdmissionPolicyIndexInformer converts an untyped informer into a ValidatingAdmissionPolicyIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingAdmissionPolicy. If that is not the case, calling type-safe methods of the returned
+// ValidatingAdmissionPolicyIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ValidatingAdmissionPolicyIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToValidatingAdmissionPolicyIndexInformer(informer cache.SharedIndexInformer) ValidatingAdmissionPolicyIndexInformer {
+	if informer, ok := informer.(ValidatingAdmissionPolicyIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicy](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go
index 224049a254..5e1c4accaa 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ValidatingAdmissionPolicyBindingInformer provides access to a shared informer and lister for
-// ValidatingAdmissionPolicyBindings.
+// ValidatingAdmissionPolicyBindings. Prefer using the type-safe variant (see [TypedValidatingAdmissionPolicyBindingInformer]).
 type ValidatingAdmissionPolicyBindingInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingLister
 }
 
+// TypedValidatingAdmissionPolicyBindingInformer provides access to a shared informer and lister for
+// ValidatingAdmissionPolicyBindings, including the type-safe TypedInformer variant.
+// It is a superset of ValidatingAdmissionPolicyBindingInformer.
+type TypedValidatingAdmissionPolicyBindingInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ValidatingAdmissionPolicyBindingIndexInformer
+	Lister() admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingLister
+}
+
+// ValidatingAdmissionPolicyBindingIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ValidatingAdmissionPolicyBindingIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding]
+
+// ValidatingAdmissionPolicyBindingHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ValidatingAdmissionPolicyBinding.
+type ValidatingAdmissionPolicyBindingHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding]
+
+// ValidatingAdmissionPolicyBindingDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ValidatingAdmissionPolicyBinding.
+type ValidatingAdmissionPolicyBindingDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding]
+
+// ValidatingAdmissionPolicyBindingFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ValidatingAdmissionPolicyBinding.
+type ValidatingAdmissionPolicyBindingFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding]
+
+// ValidatingAdmissionPolicyBindingIndexers is a specialization of [cache.TypedIndexers] for ValidatingAdmissionPolicyBinding.
+type ValidatingAdmissionPolicyBindingIndexers = cache.TypedIndexers[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding]
+
+// DeletedValidatingAdmissionPolicyBinding is a specialization of [cache.DeletedObject] for ValidatingAdmissionPolicyBinding.
+type DeletedValidatingAdmissionPolicyBinding = cache.DeletedObject[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding]
+
 type validatingAdmissionPolicyBindingInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type validatingAdmissionPolicyBindingInformer struct {
 // NewValidatingAdmissionPolicyBindingInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingAdmissionPolicyBindingInformer]).
 func NewValidatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedValidatingAdmissionPolicyBindingInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingAdmissionPolicyBindingIndexers) ValidatingAdmissionPolicyBindingIndexInformer {
+	return NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredValidatingAdmissionPolicyBindingInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredValidatingAdmissionPolicyBindingInformer]).
 func NewFilteredValidatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredValidatingAdmissionPolicyBindingInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredValidatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingAdmissionPolicyBindingIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ValidatingAdmissionPolicyBindingIndexInformer {
+	return NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewValidatingAdmissionPolicyBindingInformerWithOptions constructs a new informer for ValidatingAdmissionPolicyBinding type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingAdmissionPolicyBindingInformerWithOptions]).
 func NewValidatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client, options)
+}
+
+// NewTypedValidatingAdmissionPolicyBindingInformerWithOptions constructs a new informer for ValidatingAdmissionPolicyBinding type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ValidatingAdmissionPolicyBindingIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1alpha1", Resource: "validatingadmissionpolicybindings"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewValidatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.In
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *validatingAdmissionPolicyBindingInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *validatingAdmissionPolicyBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *validatingAdmissionPolicyBindingInformer) TypedInformer() ValidatingAdmissionPolicyBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding](f.factory.InformerFor(&apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{}, f.defaultInformer))
 }
 
 func (f *validatingAdmissionPolicyBindingInformer) Lister() admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingLister {
 	return admissionregistrationv1alpha1.NewValidatingAdmissionPolicyBindingLister(f.Informer().GetIndexer())
 }
+
+// ToTypedValidatingAdmissionPolicyBindingInformer converts an untyped informer into a TypedValidatingAdmissionPolicyBindingInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingAdmissionPolicyBinding. If that is not the case, calling type-safe methods of the returned
+// TypedValidatingAdmissionPolicyBindingInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedValidatingAdmissionPolicyBindingInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedValidatingAdmissionPolicyBindingInformer(informer ValidatingAdmissionPolicyBindingInformer) TypedValidatingAdmissionPolicyBindingInformer {
+	if informer, ok := informer.(TypedValidatingAdmissionPolicyBindingInformer); ok {
+		return informer
+	}
+	return &validatingAdmissionPolicyBindingTypedInformerAdapter{informer}
+}
+
+type validatingAdmissionPolicyBindingTypedInformerAdapter struct {
+	ValidatingAdmissionPolicyBindingInformer
+}
+
+func (a *validatingAdmissionPolicyBindingTypedInformerAdapter) TypedInformer() ValidatingAdmissionPolicyBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding](a.Informer())
+}
+
+// ToValidatingAdmissionPolicyBindingIndexInformer converts an untyped informer into a ValidatingAdmissionPolicyBindingIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingAdmissionPolicyBinding. If that is not the case, calling type-safe methods of the returned
+// ValidatingAdmissionPolicyBindingIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ValidatingAdmissionPolicyBindingIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToValidatingAdmissionPolicyBindingIndexInformer(informer cache.SharedIndexInformer) ValidatingAdmissionPolicyBindingIndexInformer {
+	if informer, ok := informer.(ValidatingAdmissionPolicyBindingIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/interface.go
index 9174fd1c72..fa0818f41b 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/interface.go
@@ -25,17 +25,17 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// MutatingAdmissionPolicies returns a MutatingAdmissionPolicyInformer.
-	MutatingAdmissionPolicies() MutatingAdmissionPolicyInformer
+	MutatingAdmissionPolicies() TypedMutatingAdmissionPolicyInformer
 	// MutatingAdmissionPolicyBindings returns a MutatingAdmissionPolicyBindingInformer.
-	MutatingAdmissionPolicyBindings() MutatingAdmissionPolicyBindingInformer
+	MutatingAdmissionPolicyBindings() TypedMutatingAdmissionPolicyBindingInformer
 	// MutatingWebhookConfigurations returns a MutatingWebhookConfigurationInformer.
-	MutatingWebhookConfigurations() MutatingWebhookConfigurationInformer
+	MutatingWebhookConfigurations() TypedMutatingWebhookConfigurationInformer
 	// ValidatingAdmissionPolicies returns a ValidatingAdmissionPolicyInformer.
-	ValidatingAdmissionPolicies() ValidatingAdmissionPolicyInformer
+	ValidatingAdmissionPolicies() TypedValidatingAdmissionPolicyInformer
 	// ValidatingAdmissionPolicyBindings returns a ValidatingAdmissionPolicyBindingInformer.
-	ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingInformer
+	ValidatingAdmissionPolicyBindings() TypedValidatingAdmissionPolicyBindingInformer
 	// ValidatingWebhookConfigurations returns a ValidatingWebhookConfigurationInformer.
-	ValidatingWebhookConfigurations() ValidatingWebhookConfigurationInformer
+	ValidatingWebhookConfigurations() TypedValidatingWebhookConfigurationInformer
 }
 
 type version struct {
@@ -49,32 +49,32 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// MutatingAdmissionPolicies returns a MutatingAdmissionPolicyInformer.
-func (v *version) MutatingAdmissionPolicies() MutatingAdmissionPolicyInformer {
+// MutatingAdmissionPolicies returns a TypedMutatingAdmissionPolicyInformer.
+func (v *version) MutatingAdmissionPolicies() TypedMutatingAdmissionPolicyInformer {
 	return &mutatingAdmissionPolicyInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// MutatingAdmissionPolicyBindings returns a MutatingAdmissionPolicyBindingInformer.
-func (v *version) MutatingAdmissionPolicyBindings() MutatingAdmissionPolicyBindingInformer {
+// MutatingAdmissionPolicyBindings returns a TypedMutatingAdmissionPolicyBindingInformer.
+func (v *version) MutatingAdmissionPolicyBindings() TypedMutatingAdmissionPolicyBindingInformer {
 	return &mutatingAdmissionPolicyBindingInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// MutatingWebhookConfigurations returns a MutatingWebhookConfigurationInformer.
-func (v *version) MutatingWebhookConfigurations() MutatingWebhookConfigurationInformer {
+// MutatingWebhookConfigurations returns a TypedMutatingWebhookConfigurationInformer.
+func (v *version) MutatingWebhookConfigurations() TypedMutatingWebhookConfigurationInformer {
 	return &mutatingWebhookConfigurationInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ValidatingAdmissionPolicies returns a ValidatingAdmissionPolicyInformer.
-func (v *version) ValidatingAdmissionPolicies() ValidatingAdmissionPolicyInformer {
+// ValidatingAdmissionPolicies returns a TypedValidatingAdmissionPolicyInformer.
+func (v *version) ValidatingAdmissionPolicies() TypedValidatingAdmissionPolicyInformer {
 	return &validatingAdmissionPolicyInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ValidatingAdmissionPolicyBindings returns a ValidatingAdmissionPolicyBindingInformer.
-func (v *version) ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingInformer {
+// ValidatingAdmissionPolicyBindings returns a TypedValidatingAdmissionPolicyBindingInformer.
+func (v *version) ValidatingAdmissionPolicyBindings() TypedValidatingAdmissionPolicyBindingInformer {
 	return &validatingAdmissionPolicyBindingInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ValidatingWebhookConfigurations returns a ValidatingWebhookConfigurationInformer.
-func (v *version) ValidatingWebhookConfigurations() ValidatingWebhookConfigurationInformer {
+// ValidatingWebhookConfigurations returns a TypedValidatingWebhookConfigurationInformer.
+func (v *version) ValidatingWebhookConfigurations() TypedValidatingWebhookConfigurationInformer {
 	return &validatingWebhookConfigurationInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/mutatingadmissionpolicy.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/mutatingadmissionpolicy.go
index edfe94417b..5eaff99898 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/mutatingadmissionpolicy.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/mutatingadmissionpolicy.go
@@ -34,12 +34,40 @@ import (
 )
 
 // MutatingAdmissionPolicyInformer provides access to a shared informer and lister for
-// MutatingAdmissionPolicies.
+// MutatingAdmissionPolicies. Prefer using the type-safe variant (see [TypedMutatingAdmissionPolicyInformer]).
 type MutatingAdmissionPolicyInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1beta1.MutatingAdmissionPolicyLister
 }
 
+// TypedMutatingAdmissionPolicyInformer provides access to a shared informer and lister for
+// MutatingAdmissionPolicies, including the type-safe TypedInformer variant.
+// It is a superset of MutatingAdmissionPolicyInformer.
+type TypedMutatingAdmissionPolicyInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() MutatingAdmissionPolicyIndexInformer
+	Lister() admissionregistrationv1beta1.MutatingAdmissionPolicyLister
+}
+
+// MutatingAdmissionPolicyIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type MutatingAdmissionPolicyIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicy]
+
+// MutatingAdmissionPolicyHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for MutatingAdmissionPolicy.
+type MutatingAdmissionPolicyHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicy]
+
+// MutatingAdmissionPolicyDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for MutatingAdmissionPolicy.
+type MutatingAdmissionPolicyDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicy]
+
+// MutatingAdmissionPolicyFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for MutatingAdmissionPolicy.
+type MutatingAdmissionPolicyFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicy]
+
+// MutatingAdmissionPolicyIndexers is a specialization of [cache.TypedIndexers] for MutatingAdmissionPolicy.
+type MutatingAdmissionPolicyIndexers = cache.TypedIndexers[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicy]
+
+// DeletedMutatingAdmissionPolicy is a specialization of [cache.DeletedObject] for MutatingAdmissionPolicy.
+type DeletedMutatingAdmissionPolicy = cache.DeletedObject[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicy]
+
 type mutatingAdmissionPolicyInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type mutatingAdmissionPolicyInformer struct {
 // NewMutatingAdmissionPolicyInformer constructs a new informer for MutatingAdmissionPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingAdmissionPolicyInformer]).
 func NewMutatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedMutatingAdmissionPolicyInformer constructs a new informer for MutatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingAdmissionPolicyIndexers) MutatingAdmissionPolicyIndexInformer {
+	return NewTypedMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredMutatingAdmissionPolicyInformer constructs a new informer for MutatingAdmissionPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredMutatingAdmissionPolicyInformer]).
 func NewFilteredMutatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredMutatingAdmissionPolicyInformer constructs a new informer for MutatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredMutatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingAdmissionPolicyIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) MutatingAdmissionPolicyIndexInformer {
+	return NewTypedMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewMutatingAdmissionPolicyInformerWithOptions constructs a new informer for MutatingAdmissionPolicy type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingAdmissionPolicyInformerWithOptions]).
 func NewMutatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedMutatingAdmissionPolicyInformerWithOptions(client, options)
+}
+
+// NewTypedMutatingAdmissionPolicyInformerWithOptions constructs a new informer for MutatingAdmissionPolicy type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) MutatingAdmissionPolicyIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1beta1", Resource: "mutatingadmissionpolicys"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicy](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewMutatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface,
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *mutatingAdmissionPolicyInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedMutatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *mutatingAdmissionPolicyInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1beta1.MutatingAdmissionPolicy{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *mutatingAdmissionPolicyInformer) TypedInformer() MutatingAdmissionPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicy](f.factory.InformerFor(&apiadmissionregistrationv1beta1.MutatingAdmissionPolicy{}, f.defaultInformer))
 }
 
 func (f *mutatingAdmissionPolicyInformer) Lister() admissionregistrationv1beta1.MutatingAdmissionPolicyLister {
 	return admissionregistrationv1beta1.NewMutatingAdmissionPolicyLister(f.Informer().GetIndexer())
 }
+
+// ToTypedMutatingAdmissionPolicyInformer converts an untyped informer into a TypedMutatingAdmissionPolicyInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingAdmissionPolicy. If that is not the case, calling type-safe methods of the returned
+// TypedMutatingAdmissionPolicyInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedMutatingAdmissionPolicyInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedMutatingAdmissionPolicyInformer(informer MutatingAdmissionPolicyInformer) TypedMutatingAdmissionPolicyInformer {
+	if informer, ok := informer.(TypedMutatingAdmissionPolicyInformer); ok {
+		return informer
+	}
+	return &mutatingAdmissionPolicyTypedInformerAdapter{informer}
+}
+
+type mutatingAdmissionPolicyTypedInformerAdapter struct {
+	MutatingAdmissionPolicyInformer
+}
+
+func (a *mutatingAdmissionPolicyTypedInformerAdapter) TypedInformer() MutatingAdmissionPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicy](a.Informer())
+}
+
+// ToMutatingAdmissionPolicyIndexInformer converts an untyped informer into a MutatingAdmissionPolicyIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingAdmissionPolicy. If that is not the case, calling type-safe methods of the returned
+// MutatingAdmissionPolicyIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a MutatingAdmissionPolicyIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToMutatingAdmissionPolicyIndexInformer(informer cache.SharedIndexInformer) MutatingAdmissionPolicyIndexInformer {
+	if informer, ok := informer.(MutatingAdmissionPolicyIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicy](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/mutatingadmissionpolicybinding.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/mutatingadmissionpolicybinding.go
index bb833f4447..6422d2f7fe 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/mutatingadmissionpolicybinding.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/mutatingadmissionpolicybinding.go
@@ -34,12 +34,40 @@ import (
 )
 
 // MutatingAdmissionPolicyBindingInformer provides access to a shared informer and lister for
-// MutatingAdmissionPolicyBindings.
+// MutatingAdmissionPolicyBindings. Prefer using the type-safe variant (see [TypedMutatingAdmissionPolicyBindingInformer]).
 type MutatingAdmissionPolicyBindingInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1beta1.MutatingAdmissionPolicyBindingLister
 }
 
+// TypedMutatingAdmissionPolicyBindingInformer provides access to a shared informer and lister for
+// MutatingAdmissionPolicyBindings, including the type-safe TypedInformer variant.
+// It is a superset of MutatingAdmissionPolicyBindingInformer.
+type TypedMutatingAdmissionPolicyBindingInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() MutatingAdmissionPolicyBindingIndexInformer
+	Lister() admissionregistrationv1beta1.MutatingAdmissionPolicyBindingLister
+}
+
+// MutatingAdmissionPolicyBindingIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type MutatingAdmissionPolicyBindingIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicyBinding]
+
+// MutatingAdmissionPolicyBindingHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for MutatingAdmissionPolicyBinding.
+type MutatingAdmissionPolicyBindingHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicyBinding]
+
+// MutatingAdmissionPolicyBindingDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for MutatingAdmissionPolicyBinding.
+type MutatingAdmissionPolicyBindingDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicyBinding]
+
+// MutatingAdmissionPolicyBindingFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for MutatingAdmissionPolicyBinding.
+type MutatingAdmissionPolicyBindingFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicyBinding]
+
+// MutatingAdmissionPolicyBindingIndexers is a specialization of [cache.TypedIndexers] for MutatingAdmissionPolicyBinding.
+type MutatingAdmissionPolicyBindingIndexers = cache.TypedIndexers[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicyBinding]
+
+// DeletedMutatingAdmissionPolicyBinding is a specialization of [cache.DeletedObject] for MutatingAdmissionPolicyBinding.
+type DeletedMutatingAdmissionPolicyBinding = cache.DeletedObject[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicyBinding]
+
 type mutatingAdmissionPolicyBindingInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type mutatingAdmissionPolicyBindingInformer struct {
 // NewMutatingAdmissionPolicyBindingInformer constructs a new informer for MutatingAdmissionPolicyBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingAdmissionPolicyBindingInformer]).
 func NewMutatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedMutatingAdmissionPolicyBindingInformer constructs a new informer for MutatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingAdmissionPolicyBindingIndexers) MutatingAdmissionPolicyBindingIndexInformer {
+	return NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredMutatingAdmissionPolicyBindingInformer constructs a new informer for MutatingAdmissionPolicyBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredMutatingAdmissionPolicyBindingInformer]).
 func NewFilteredMutatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredMutatingAdmissionPolicyBindingInformer constructs a new informer for MutatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredMutatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingAdmissionPolicyBindingIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) MutatingAdmissionPolicyBindingIndexInformer {
+	return NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewMutatingAdmissionPolicyBindingInformerWithOptions constructs a new informer for MutatingAdmissionPolicyBinding type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingAdmissionPolicyBindingInformerWithOptions]).
 func NewMutatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client, options)
+}
+
+// NewTypedMutatingAdmissionPolicyBindingInformerWithOptions constructs a new informer for MutatingAdmissionPolicyBinding type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) MutatingAdmissionPolicyBindingIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1beta1", Resource: "mutatingadmissionpolicybindings"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicyBinding](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewMutatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.Inte
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *mutatingAdmissionPolicyBindingInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedMutatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *mutatingAdmissionPolicyBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1beta1.MutatingAdmissionPolicyBinding{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *mutatingAdmissionPolicyBindingInformer) TypedInformer() MutatingAdmissionPolicyBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicyBinding](f.factory.InformerFor(&apiadmissionregistrationv1beta1.MutatingAdmissionPolicyBinding{}, f.defaultInformer))
 }
 
 func (f *mutatingAdmissionPolicyBindingInformer) Lister() admissionregistrationv1beta1.MutatingAdmissionPolicyBindingLister {
 	return admissionregistrationv1beta1.NewMutatingAdmissionPolicyBindingLister(f.Informer().GetIndexer())
 }
+
+// ToTypedMutatingAdmissionPolicyBindingInformer converts an untyped informer into a TypedMutatingAdmissionPolicyBindingInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingAdmissionPolicyBinding. If that is not the case, calling type-safe methods of the returned
+// TypedMutatingAdmissionPolicyBindingInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedMutatingAdmissionPolicyBindingInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedMutatingAdmissionPolicyBindingInformer(informer MutatingAdmissionPolicyBindingInformer) TypedMutatingAdmissionPolicyBindingInformer {
+	if informer, ok := informer.(TypedMutatingAdmissionPolicyBindingInformer); ok {
+		return informer
+	}
+	return &mutatingAdmissionPolicyBindingTypedInformerAdapter{informer}
+}
+
+type mutatingAdmissionPolicyBindingTypedInformerAdapter struct {
+	MutatingAdmissionPolicyBindingInformer
+}
+
+func (a *mutatingAdmissionPolicyBindingTypedInformerAdapter) TypedInformer() MutatingAdmissionPolicyBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicyBinding](a.Informer())
+}
+
+// ToMutatingAdmissionPolicyBindingIndexInformer converts an untyped informer into a MutatingAdmissionPolicyBindingIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingAdmissionPolicyBinding. If that is not the case, calling type-safe methods of the returned
+// MutatingAdmissionPolicyBindingIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a MutatingAdmissionPolicyBindingIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToMutatingAdmissionPolicyBindingIndexInformer(informer cache.SharedIndexInformer) MutatingAdmissionPolicyBindingIndexInformer {
+	if informer, ok := informer.(MutatingAdmissionPolicyBindingIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.MutatingAdmissionPolicyBinding](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/mutatingwebhookconfiguration.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/mutatingwebhookconfiguration.go
index bb077a1746..2aef3f2961 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/mutatingwebhookconfiguration.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/mutatingwebhookconfiguration.go
@@ -34,12 +34,40 @@ import (
 )
 
 // MutatingWebhookConfigurationInformer provides access to a shared informer and lister for
-// MutatingWebhookConfigurations.
+// MutatingWebhookConfigurations. Prefer using the type-safe variant (see [TypedMutatingWebhookConfigurationInformer]).
 type MutatingWebhookConfigurationInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1beta1.MutatingWebhookConfigurationLister
 }
 
+// TypedMutatingWebhookConfigurationInformer provides access to a shared informer and lister for
+// MutatingWebhookConfigurations, including the type-safe TypedInformer variant.
+// It is a superset of MutatingWebhookConfigurationInformer.
+type TypedMutatingWebhookConfigurationInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() MutatingWebhookConfigurationIndexInformer
+	Lister() admissionregistrationv1beta1.MutatingWebhookConfigurationLister
+}
+
+// MutatingWebhookConfigurationIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type MutatingWebhookConfigurationIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1beta1.MutatingWebhookConfiguration]
+
+// MutatingWebhookConfigurationHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for MutatingWebhookConfiguration.
+type MutatingWebhookConfigurationHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1beta1.MutatingWebhookConfiguration]
+
+// MutatingWebhookConfigurationDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for MutatingWebhookConfiguration.
+type MutatingWebhookConfigurationDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1beta1.MutatingWebhookConfiguration]
+
+// MutatingWebhookConfigurationFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for MutatingWebhookConfiguration.
+type MutatingWebhookConfigurationFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1beta1.MutatingWebhookConfiguration]
+
+// MutatingWebhookConfigurationIndexers is a specialization of [cache.TypedIndexers] for MutatingWebhookConfiguration.
+type MutatingWebhookConfigurationIndexers = cache.TypedIndexers[*apiadmissionregistrationv1beta1.MutatingWebhookConfiguration]
+
+// DeletedMutatingWebhookConfiguration is a specialization of [cache.DeletedObject] for MutatingWebhookConfiguration.
+type DeletedMutatingWebhookConfiguration = cache.DeletedObject[*apiadmissionregistrationv1beta1.MutatingWebhookConfiguration]
+
 type mutatingWebhookConfigurationInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type mutatingWebhookConfigurationInformer struct {
 // NewMutatingWebhookConfigurationInformer constructs a new informer for MutatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingWebhookConfigurationInformer]).
 func NewMutatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewMutatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedMutatingWebhookConfigurationInformer constructs a new informer for MutatingWebhookConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingWebhookConfigurationIndexers) MutatingWebhookConfigurationIndexInformer {
+	return NewTypedMutatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredMutatingWebhookConfigurationInformer constructs a new informer for MutatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredMutatingWebhookConfigurationInformer]).
 func NewFilteredMutatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewMutatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedMutatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredMutatingWebhookConfigurationInformer constructs a new informer for MutatingWebhookConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredMutatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers MutatingWebhookConfigurationIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) MutatingWebhookConfigurationIndexInformer {
+	return NewTypedMutatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewMutatingWebhookConfigurationInformerWithOptions constructs a new informer for MutatingWebhookConfiguration type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedMutatingWebhookConfigurationInformerWithOptions]).
 func NewMutatingWebhookConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedMutatingWebhookConfigurationInformerWithOptions(client, options)
+}
+
+// NewTypedMutatingWebhookConfigurationInformerWithOptions constructs a new informer for MutatingWebhookConfiguration type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedMutatingWebhookConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) MutatingWebhookConfigurationIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1beta1", Resource: "mutatingwebhookconfigurations"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.MutatingWebhookConfiguration](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewMutatingWebhookConfigurationInformerWithOptions(client kubernetes.Interf
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *mutatingWebhookConfigurationInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewMutatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedMutatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *mutatingWebhookConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1beta1.MutatingWebhookConfiguration{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *mutatingWebhookConfigurationInformer) TypedInformer() MutatingWebhookConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.MutatingWebhookConfiguration](f.factory.InformerFor(&apiadmissionregistrationv1beta1.MutatingWebhookConfiguration{}, f.defaultInformer))
 }
 
 func (f *mutatingWebhookConfigurationInformer) Lister() admissionregistrationv1beta1.MutatingWebhookConfigurationLister {
 	return admissionregistrationv1beta1.NewMutatingWebhookConfigurationLister(f.Informer().GetIndexer())
 }
+
+// ToTypedMutatingWebhookConfigurationInformer converts an untyped informer into a TypedMutatingWebhookConfigurationInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingWebhookConfiguration. If that is not the case, calling type-safe methods of the returned
+// TypedMutatingWebhookConfigurationInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedMutatingWebhookConfigurationInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedMutatingWebhookConfigurationInformer(informer MutatingWebhookConfigurationInformer) TypedMutatingWebhookConfigurationInformer {
+	if informer, ok := informer.(TypedMutatingWebhookConfigurationInformer); ok {
+		return informer
+	}
+	return &mutatingWebhookConfigurationTypedInformerAdapter{informer}
+}
+
+type mutatingWebhookConfigurationTypedInformerAdapter struct {
+	MutatingWebhookConfigurationInformer
+}
+
+func (a *mutatingWebhookConfigurationTypedInformerAdapter) TypedInformer() MutatingWebhookConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.MutatingWebhookConfiguration](a.Informer())
+}
+
+// ToMutatingWebhookConfigurationIndexInformer converts an untyped informer into a MutatingWebhookConfigurationIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *MutatingWebhookConfiguration. If that is not the case, calling type-safe methods of the returned
+// MutatingWebhookConfigurationIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a MutatingWebhookConfigurationIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToMutatingWebhookConfigurationIndexInformer(informer cache.SharedIndexInformer) MutatingWebhookConfigurationIndexInformer {
+	if informer, ok := informer.(MutatingWebhookConfigurationIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.MutatingWebhookConfiguration](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/validatingadmissionpolicy.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/validatingadmissionpolicy.go
index a88a254d6f..2a4f9ad128 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/validatingadmissionpolicy.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/validatingadmissionpolicy.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ValidatingAdmissionPolicyInformer provides access to a shared informer and lister for
-// ValidatingAdmissionPolicies.
+// ValidatingAdmissionPolicies. Prefer using the type-safe variant (see [TypedValidatingAdmissionPolicyInformer]).
 type ValidatingAdmissionPolicyInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1beta1.ValidatingAdmissionPolicyLister
 }
 
+// TypedValidatingAdmissionPolicyInformer provides access to a shared informer and lister for
+// ValidatingAdmissionPolicies, including the type-safe TypedInformer variant.
+// It is a superset of ValidatingAdmissionPolicyInformer.
+type TypedValidatingAdmissionPolicyInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ValidatingAdmissionPolicyIndexInformer
+	Lister() admissionregistrationv1beta1.ValidatingAdmissionPolicyLister
+}
+
+// ValidatingAdmissionPolicyIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ValidatingAdmissionPolicyIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicy]
+
+// ValidatingAdmissionPolicyHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ValidatingAdmissionPolicy.
+type ValidatingAdmissionPolicyHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicy]
+
+// ValidatingAdmissionPolicyDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ValidatingAdmissionPolicy.
+type ValidatingAdmissionPolicyDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicy]
+
+// ValidatingAdmissionPolicyFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ValidatingAdmissionPolicy.
+type ValidatingAdmissionPolicyFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicy]
+
+// ValidatingAdmissionPolicyIndexers is a specialization of [cache.TypedIndexers] for ValidatingAdmissionPolicy.
+type ValidatingAdmissionPolicyIndexers = cache.TypedIndexers[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicy]
+
+// DeletedValidatingAdmissionPolicy is a specialization of [cache.DeletedObject] for ValidatingAdmissionPolicy.
+type DeletedValidatingAdmissionPolicy = cache.DeletedObject[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicy]
+
 type validatingAdmissionPolicyInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type validatingAdmissionPolicyInformer struct {
 // NewValidatingAdmissionPolicyInformer constructs a new informer for ValidatingAdmissionPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingAdmissionPolicyInformer]).
 func NewValidatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedValidatingAdmissionPolicyInformer constructs a new informer for ValidatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingAdmissionPolicyIndexers) ValidatingAdmissionPolicyIndexInformer {
+	return NewTypedValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredValidatingAdmissionPolicyInformer constructs a new informer for ValidatingAdmissionPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredValidatingAdmissionPolicyInformer]).
 func NewFilteredValidatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredValidatingAdmissionPolicyInformer constructs a new informer for ValidatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredValidatingAdmissionPolicyInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingAdmissionPolicyIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ValidatingAdmissionPolicyIndexInformer {
+	return NewTypedValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewValidatingAdmissionPolicyInformerWithOptions constructs a new informer for ValidatingAdmissionPolicy type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingAdmissionPolicyInformerWithOptions]).
 func NewValidatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedValidatingAdmissionPolicyInformerWithOptions(client, options)
+}
+
+// NewTypedValidatingAdmissionPolicyInformerWithOptions constructs a new informer for ValidatingAdmissionPolicy type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ValidatingAdmissionPolicyIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1beta1", Resource: "validatingadmissionpolicys"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicy](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewValidatingAdmissionPolicyInformerWithOptions(client kubernetes.Interface
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *validatingAdmissionPolicyInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedValidatingAdmissionPolicyInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *validatingAdmissionPolicyInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1beta1.ValidatingAdmissionPolicy{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *validatingAdmissionPolicyInformer) TypedInformer() ValidatingAdmissionPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicy](f.factory.InformerFor(&apiadmissionregistrationv1beta1.ValidatingAdmissionPolicy{}, f.defaultInformer))
 }
 
 func (f *validatingAdmissionPolicyInformer) Lister() admissionregistrationv1beta1.ValidatingAdmissionPolicyLister {
 	return admissionregistrationv1beta1.NewValidatingAdmissionPolicyLister(f.Informer().GetIndexer())
 }
+
+// ToTypedValidatingAdmissionPolicyInformer converts an untyped informer into a TypedValidatingAdmissionPolicyInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingAdmissionPolicy. If that is not the case, calling type-safe methods of the returned
+// TypedValidatingAdmissionPolicyInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedValidatingAdmissionPolicyInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedValidatingAdmissionPolicyInformer(informer ValidatingAdmissionPolicyInformer) TypedValidatingAdmissionPolicyInformer {
+	if informer, ok := informer.(TypedValidatingAdmissionPolicyInformer); ok {
+		return informer
+	}
+	return &validatingAdmissionPolicyTypedInformerAdapter{informer}
+}
+
+type validatingAdmissionPolicyTypedInformerAdapter struct {
+	ValidatingAdmissionPolicyInformer
+}
+
+func (a *validatingAdmissionPolicyTypedInformerAdapter) TypedInformer() ValidatingAdmissionPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicy](a.Informer())
+}
+
+// ToValidatingAdmissionPolicyIndexInformer converts an untyped informer into a ValidatingAdmissionPolicyIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingAdmissionPolicy. If that is not the case, calling type-safe methods of the returned
+// ValidatingAdmissionPolicyIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ValidatingAdmissionPolicyIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToValidatingAdmissionPolicyIndexInformer(informer cache.SharedIndexInformer) ValidatingAdmissionPolicyIndexInformer {
+	if informer, ok := informer.(ValidatingAdmissionPolicyIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicy](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/validatingadmissionpolicybinding.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/validatingadmissionpolicybinding.go
index d1df5a3f2f..2cbc29ac5a 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/validatingadmissionpolicybinding.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/validatingadmissionpolicybinding.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ValidatingAdmissionPolicyBindingInformer provides access to a shared informer and lister for
-// ValidatingAdmissionPolicyBindings.
+// ValidatingAdmissionPolicyBindings. Prefer using the type-safe variant (see [TypedValidatingAdmissionPolicyBindingInformer]).
 type ValidatingAdmissionPolicyBindingInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingLister
 }
 
+// TypedValidatingAdmissionPolicyBindingInformer provides access to a shared informer and lister for
+// ValidatingAdmissionPolicyBindings, including the type-safe TypedInformer variant.
+// It is a superset of ValidatingAdmissionPolicyBindingInformer.
+type TypedValidatingAdmissionPolicyBindingInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ValidatingAdmissionPolicyBindingIndexInformer
+	Lister() admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingLister
+}
+
+// ValidatingAdmissionPolicyBindingIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ValidatingAdmissionPolicyBindingIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBinding]
+
+// ValidatingAdmissionPolicyBindingHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ValidatingAdmissionPolicyBinding.
+type ValidatingAdmissionPolicyBindingHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBinding]
+
+// ValidatingAdmissionPolicyBindingDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ValidatingAdmissionPolicyBinding.
+type ValidatingAdmissionPolicyBindingDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBinding]
+
+// ValidatingAdmissionPolicyBindingFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ValidatingAdmissionPolicyBinding.
+type ValidatingAdmissionPolicyBindingFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBinding]
+
+// ValidatingAdmissionPolicyBindingIndexers is a specialization of [cache.TypedIndexers] for ValidatingAdmissionPolicyBinding.
+type ValidatingAdmissionPolicyBindingIndexers = cache.TypedIndexers[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBinding]
+
+// DeletedValidatingAdmissionPolicyBinding is a specialization of [cache.DeletedObject] for ValidatingAdmissionPolicyBinding.
+type DeletedValidatingAdmissionPolicyBinding = cache.DeletedObject[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBinding]
+
 type validatingAdmissionPolicyBindingInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type validatingAdmissionPolicyBindingInformer struct {
 // NewValidatingAdmissionPolicyBindingInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingAdmissionPolicyBindingInformer]).
 func NewValidatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedValidatingAdmissionPolicyBindingInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingAdmissionPolicyBindingIndexers) ValidatingAdmissionPolicyBindingIndexInformer {
+	return NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredValidatingAdmissionPolicyBindingInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredValidatingAdmissionPolicyBindingInformer]).
 func NewFilteredValidatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredValidatingAdmissionPolicyBindingInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredValidatingAdmissionPolicyBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingAdmissionPolicyBindingIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ValidatingAdmissionPolicyBindingIndexInformer {
+	return NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewValidatingAdmissionPolicyBindingInformerWithOptions constructs a new informer for ValidatingAdmissionPolicyBinding type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingAdmissionPolicyBindingInformerWithOptions]).
 func NewValidatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client, options)
+}
+
+// NewTypedValidatingAdmissionPolicyBindingInformerWithOptions constructs a new informer for ValidatingAdmissionPolicyBinding type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ValidatingAdmissionPolicyBindingIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1beta1", Resource: "validatingadmissionpolicybindings"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBinding](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewValidatingAdmissionPolicyBindingInformerWithOptions(client kubernetes.In
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *validatingAdmissionPolicyBindingInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedValidatingAdmissionPolicyBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *validatingAdmissionPolicyBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBinding{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *validatingAdmissionPolicyBindingInformer) TypedInformer() ValidatingAdmissionPolicyBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBinding](f.factory.InformerFor(&apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBinding{}, f.defaultInformer))
 }
 
 func (f *validatingAdmissionPolicyBindingInformer) Lister() admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingLister {
 	return admissionregistrationv1beta1.NewValidatingAdmissionPolicyBindingLister(f.Informer().GetIndexer())
 }
+
+// ToTypedValidatingAdmissionPolicyBindingInformer converts an untyped informer into a TypedValidatingAdmissionPolicyBindingInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingAdmissionPolicyBinding. If that is not the case, calling type-safe methods of the returned
+// TypedValidatingAdmissionPolicyBindingInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedValidatingAdmissionPolicyBindingInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedValidatingAdmissionPolicyBindingInformer(informer ValidatingAdmissionPolicyBindingInformer) TypedValidatingAdmissionPolicyBindingInformer {
+	if informer, ok := informer.(TypedValidatingAdmissionPolicyBindingInformer); ok {
+		return informer
+	}
+	return &validatingAdmissionPolicyBindingTypedInformerAdapter{informer}
+}
+
+type validatingAdmissionPolicyBindingTypedInformerAdapter struct {
+	ValidatingAdmissionPolicyBindingInformer
+}
+
+func (a *validatingAdmissionPolicyBindingTypedInformerAdapter) TypedInformer() ValidatingAdmissionPolicyBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBinding](a.Informer())
+}
+
+// ToValidatingAdmissionPolicyBindingIndexInformer converts an untyped informer into a ValidatingAdmissionPolicyBindingIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingAdmissionPolicyBinding. If that is not the case, calling type-safe methods of the returned
+// ValidatingAdmissionPolicyBindingIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ValidatingAdmissionPolicyBindingIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToValidatingAdmissionPolicyBindingIndexInformer(informer cache.SharedIndexInformer) ValidatingAdmissionPolicyBindingIndexInformer {
+	if informer, ok := informer.(ValidatingAdmissionPolicyBindingIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBinding](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/validatingwebhookconfiguration.go b/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/validatingwebhookconfiguration.go
index 41852cb03d..b7497aacab 100644
--- a/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/validatingwebhookconfiguration.go
+++ b/vendor/k8s.io/client-go/informers/admissionregistration/v1beta1/validatingwebhookconfiguration.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ValidatingWebhookConfigurationInformer provides access to a shared informer and lister for
-// ValidatingWebhookConfigurations.
+// ValidatingWebhookConfigurations. Prefer using the type-safe variant (see [TypedValidatingWebhookConfigurationInformer]).
 type ValidatingWebhookConfigurationInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() admissionregistrationv1beta1.ValidatingWebhookConfigurationLister
 }
 
+// TypedValidatingWebhookConfigurationInformer provides access to a shared informer and lister for
+// ValidatingWebhookConfigurations, including the type-safe TypedInformer variant.
+// It is a superset of ValidatingWebhookConfigurationInformer.
+type TypedValidatingWebhookConfigurationInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ValidatingWebhookConfigurationIndexInformer
+	Lister() admissionregistrationv1beta1.ValidatingWebhookConfigurationLister
+}
+
+// ValidatingWebhookConfigurationIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ValidatingWebhookConfigurationIndexInformer cache.TypedSharedIndexInformer[*apiadmissionregistrationv1beta1.ValidatingWebhookConfiguration]
+
+// ValidatingWebhookConfigurationHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ValidatingWebhookConfiguration.
+type ValidatingWebhookConfigurationHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiadmissionregistrationv1beta1.ValidatingWebhookConfiguration]
+
+// ValidatingWebhookConfigurationDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ValidatingWebhookConfiguration.
+type ValidatingWebhookConfigurationDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiadmissionregistrationv1beta1.ValidatingWebhookConfiguration]
+
+// ValidatingWebhookConfigurationFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ValidatingWebhookConfiguration.
+type ValidatingWebhookConfigurationFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiadmissionregistrationv1beta1.ValidatingWebhookConfiguration]
+
+// ValidatingWebhookConfigurationIndexers is a specialization of [cache.TypedIndexers] for ValidatingWebhookConfiguration.
+type ValidatingWebhookConfigurationIndexers = cache.TypedIndexers[*apiadmissionregistrationv1beta1.ValidatingWebhookConfiguration]
+
+// DeletedValidatingWebhookConfiguration is a specialization of [cache.DeletedObject] for ValidatingWebhookConfiguration.
+type DeletedValidatingWebhookConfiguration = cache.DeletedObject[*apiadmissionregistrationv1beta1.ValidatingWebhookConfiguration]
+
 type validatingWebhookConfigurationInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type validatingWebhookConfigurationInformer struct {
 // NewValidatingWebhookConfigurationInformer constructs a new informer for ValidatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingWebhookConfigurationInformer]).
 func NewValidatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewValidatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedValidatingWebhookConfigurationInformer constructs a new informer for ValidatingWebhookConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingWebhookConfigurationIndexers) ValidatingWebhookConfigurationIndexInformer {
+	return NewTypedValidatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredValidatingWebhookConfigurationInformer constructs a new informer for ValidatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredValidatingWebhookConfigurationInformer]).
 func NewFilteredValidatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewValidatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedValidatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredValidatingWebhookConfigurationInformer constructs a new informer for ValidatingWebhookConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredValidatingWebhookConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ValidatingWebhookConfigurationIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ValidatingWebhookConfigurationIndexInformer {
+	return NewTypedValidatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewValidatingWebhookConfigurationInformerWithOptions constructs a new informer for ValidatingWebhookConfiguration type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedValidatingWebhookConfigurationInformerWithOptions]).
 func NewValidatingWebhookConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedValidatingWebhookConfigurationInformerWithOptions(client, options)
+}
+
+// NewTypedValidatingWebhookConfigurationInformerWithOptions constructs a new informer for ValidatingWebhookConfiguration type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedValidatingWebhookConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ValidatingWebhookConfigurationIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1beta1", Resource: "validatingwebhookconfigurations"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.ValidatingWebhookConfiguration](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewValidatingWebhookConfigurationInformerWithOptions(client kubernetes.Inte
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *validatingWebhookConfigurationInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewValidatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedValidatingWebhookConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *validatingWebhookConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiadmissionregistrationv1beta1.ValidatingWebhookConfiguration{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *validatingWebhookConfigurationInformer) TypedInformer() ValidatingWebhookConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.ValidatingWebhookConfiguration](f.factory.InformerFor(&apiadmissionregistrationv1beta1.ValidatingWebhookConfiguration{}, f.defaultInformer))
 }
 
 func (f *validatingWebhookConfigurationInformer) Lister() admissionregistrationv1beta1.ValidatingWebhookConfigurationLister {
 	return admissionregistrationv1beta1.NewValidatingWebhookConfigurationLister(f.Informer().GetIndexer())
 }
+
+// ToTypedValidatingWebhookConfigurationInformer converts an untyped informer into a TypedValidatingWebhookConfigurationInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingWebhookConfiguration. If that is not the case, calling type-safe methods of the returned
+// TypedValidatingWebhookConfigurationInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedValidatingWebhookConfigurationInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedValidatingWebhookConfigurationInformer(informer ValidatingWebhookConfigurationInformer) TypedValidatingWebhookConfigurationInformer {
+	if informer, ok := informer.(TypedValidatingWebhookConfigurationInformer); ok {
+		return informer
+	}
+	return &validatingWebhookConfigurationTypedInformerAdapter{informer}
+}
+
+type validatingWebhookConfigurationTypedInformerAdapter struct {
+	ValidatingWebhookConfigurationInformer
+}
+
+func (a *validatingWebhookConfigurationTypedInformerAdapter) TypedInformer() ValidatingWebhookConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.ValidatingWebhookConfiguration](a.Informer())
+}
+
+// ToValidatingWebhookConfigurationIndexInformer converts an untyped informer into a ValidatingWebhookConfigurationIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ValidatingWebhookConfiguration. If that is not the case, calling type-safe methods of the returned
+// ValidatingWebhookConfigurationIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ValidatingWebhookConfigurationIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToValidatingWebhookConfigurationIndexInformer(informer cache.SharedIndexInformer) ValidatingWebhookConfigurationIndexInformer {
+	if informer, ok := informer.(ValidatingWebhookConfigurationIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiadmissionregistrationv1beta1.ValidatingWebhookConfiguration](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/apiserverinternal/v1alpha1/interface.go b/vendor/k8s.io/client-go/informers/apiserverinternal/v1alpha1/interface.go
index 9778325c65..5b6f5eafc6 100644
--- a/vendor/k8s.io/client-go/informers/apiserverinternal/v1alpha1/interface.go
+++ b/vendor/k8s.io/client-go/informers/apiserverinternal/v1alpha1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// StorageVersions returns a StorageVersionInformer.
-	StorageVersions() StorageVersionInformer
+	StorageVersions() TypedStorageVersionInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// StorageVersions returns a StorageVersionInformer.
-func (v *version) StorageVersions() StorageVersionInformer {
+// StorageVersions returns a TypedStorageVersionInformer.
+func (v *version) StorageVersions() TypedStorageVersionInformer {
 	return &storageVersionInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/apiserverinternal/v1alpha1/storageversion.go b/vendor/k8s.io/client-go/informers/apiserverinternal/v1alpha1/storageversion.go
index 6d164a317c..c4ce84fb2a 100644
--- a/vendor/k8s.io/client-go/informers/apiserverinternal/v1alpha1/storageversion.go
+++ b/vendor/k8s.io/client-go/informers/apiserverinternal/v1alpha1/storageversion.go
@@ -34,12 +34,40 @@ import (
 )
 
 // StorageVersionInformer provides access to a shared informer and lister for
-// StorageVersions.
+// StorageVersions. Prefer using the type-safe variant (see [TypedStorageVersionInformer]).
 type StorageVersionInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() apiserverinternalv1alpha1.StorageVersionLister
 }
 
+// TypedStorageVersionInformer provides access to a shared informer and lister for
+// StorageVersions, including the type-safe TypedInformer variant.
+// It is a superset of StorageVersionInformer.
+type TypedStorageVersionInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() StorageVersionIndexInformer
+	Lister() apiserverinternalv1alpha1.StorageVersionLister
+}
+
+// StorageVersionIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type StorageVersionIndexInformer cache.TypedSharedIndexInformer[*apiapiserverinternalv1alpha1.StorageVersion]
+
+// StorageVersionHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for StorageVersion.
+type StorageVersionHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiapiserverinternalv1alpha1.StorageVersion]
+
+// StorageVersionDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for StorageVersion.
+type StorageVersionDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiapiserverinternalv1alpha1.StorageVersion]
+
+// StorageVersionFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for StorageVersion.
+type StorageVersionFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiapiserverinternalv1alpha1.StorageVersion]
+
+// StorageVersionIndexers is a specialization of [cache.TypedIndexers] for StorageVersion.
+type StorageVersionIndexers = cache.TypedIndexers[*apiapiserverinternalv1alpha1.StorageVersion]
+
+// DeletedStorageVersion is a specialization of [cache.DeletedObject] for StorageVersion.
+type DeletedStorageVersion = cache.DeletedObject[*apiapiserverinternalv1alpha1.StorageVersion]
+
 type storageVersionInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type storageVersionInformer struct {
 // NewStorageVersionInformer constructs a new informer for StorageVersion type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStorageVersionInformer]).
 func NewStorageVersionInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewStorageVersionInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedStorageVersionInformer constructs a new informer for StorageVersion type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStorageVersionInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers StorageVersionIndexers) StorageVersionIndexInformer {
+	return NewTypedStorageVersionInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredStorageVersionInformer constructs a new informer for StorageVersion type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredStorageVersionInformer]).
 func NewFilteredStorageVersionInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewStorageVersionInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedStorageVersionInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredStorageVersionInformer constructs a new informer for StorageVersion type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredStorageVersionInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers StorageVersionIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) StorageVersionIndexInformer {
+	return NewTypedStorageVersionInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewStorageVersionInformerWithOptions constructs a new informer for StorageVersion type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStorageVersionInformerWithOptions]).
 func NewStorageVersionInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedStorageVersionInformerWithOptions(client, options)
+}
+
+// NewTypedStorageVersionInformerWithOptions constructs a new informer for StorageVersion type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStorageVersionInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) StorageVersionIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "internal.apiserver.k8s.io", Version: "v1alpha1", Resource: "storageversions"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiapiserverinternalv1alpha1.StorageVersion](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewStorageVersionInformerWithOptions(client kubernetes.Interface, options i
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *storageVersionInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewStorageVersionInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedStorageVersionInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *storageVersionInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiapiserverinternalv1alpha1.StorageVersion{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *storageVersionInformer) TypedInformer() StorageVersionIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiapiserverinternalv1alpha1.StorageVersion](f.factory.InformerFor(&apiapiserverinternalv1alpha1.StorageVersion{}, f.defaultInformer))
 }
 
 func (f *storageVersionInformer) Lister() apiserverinternalv1alpha1.StorageVersionLister {
 	return apiserverinternalv1alpha1.NewStorageVersionLister(f.Informer().GetIndexer())
 }
+
+// ToTypedStorageVersionInformer converts an untyped informer into a TypedStorageVersionInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StorageVersion. If that is not the case, calling type-safe methods of the returned
+// TypedStorageVersionInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedStorageVersionInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedStorageVersionInformer(informer StorageVersionInformer) TypedStorageVersionInformer {
+	if informer, ok := informer.(TypedStorageVersionInformer); ok {
+		return informer
+	}
+	return &storageVersionTypedInformerAdapter{informer}
+}
+
+type storageVersionTypedInformerAdapter struct {
+	StorageVersionInformer
+}
+
+func (a *storageVersionTypedInformerAdapter) TypedInformer() StorageVersionIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiapiserverinternalv1alpha1.StorageVersion](a.Informer())
+}
+
+// ToStorageVersionIndexInformer converts an untyped informer into a StorageVersionIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StorageVersion. If that is not the case, calling type-safe methods of the returned
+// StorageVersionIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a StorageVersionIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToStorageVersionIndexInformer(informer cache.SharedIndexInformer) StorageVersionIndexInformer {
+	if informer, ok := informer.(StorageVersionIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiapiserverinternalv1alpha1.StorageVersion](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/apps/v1/controllerrevision.go b/vendor/k8s.io/client-go/informers/apps/v1/controllerrevision.go
index f58da53f18..86a7796c8d 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1/controllerrevision.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1/controllerrevision.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ControllerRevisionInformer provides access to a shared informer and lister for
-// ControllerRevisions.
+// ControllerRevisions. Prefer using the type-safe variant (see [TypedControllerRevisionInformer]).
 type ControllerRevisionInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() appsv1.ControllerRevisionLister
 }
 
+// TypedControllerRevisionInformer provides access to a shared informer and lister for
+// ControllerRevisions, including the type-safe TypedInformer variant.
+// It is a superset of ControllerRevisionInformer.
+type TypedControllerRevisionInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ControllerRevisionIndexInformer
+	Lister() appsv1.ControllerRevisionLister
+}
+
+// ControllerRevisionIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ControllerRevisionIndexInformer cache.TypedSharedIndexInformer[*apiappsv1.ControllerRevision]
+
+// ControllerRevisionHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ControllerRevision.
+type ControllerRevisionHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiappsv1.ControllerRevision]
+
+// ControllerRevisionDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ControllerRevision.
+type ControllerRevisionDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiappsv1.ControllerRevision]
+
+// ControllerRevisionFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ControllerRevision.
+type ControllerRevisionFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiappsv1.ControllerRevision]
+
+// ControllerRevisionIndexers is a specialization of [cache.TypedIndexers] for ControllerRevision.
+type ControllerRevisionIndexers = cache.TypedIndexers[*apiappsv1.ControllerRevision]
+
+// DeletedControllerRevision is a specialization of [cache.DeletedObject] for ControllerRevision.
+type DeletedControllerRevision = cache.DeletedObject[*apiappsv1.ControllerRevision]
+
 type controllerRevisionInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type controllerRevisionInformer struct {
 // NewControllerRevisionInformer constructs a new informer for ControllerRevision type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedControllerRevisionInformer]).
 func NewControllerRevisionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewControllerRevisionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedControllerRevisionInformer constructs a new informer for ControllerRevision type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedControllerRevisionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ControllerRevisionIndexers) ControllerRevisionIndexInformer {
+	return NewTypedControllerRevisionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredControllerRevisionInformer constructs a new informer for ControllerRevision type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredControllerRevisionInformer]).
 func NewFilteredControllerRevisionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewControllerRevisionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedControllerRevisionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredControllerRevisionInformer constructs a new informer for ControllerRevision type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredControllerRevisionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ControllerRevisionIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ControllerRevisionIndexInformer {
+	return NewTypedControllerRevisionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewControllerRevisionInformerWithOptions constructs a new informer for ControllerRevision type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedControllerRevisionInformerWithOptions]).
 func NewControllerRevisionInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedControllerRevisionInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedControllerRevisionInformerWithOptions constructs a new informer for ControllerRevision type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedControllerRevisionInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ControllerRevisionIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "controllerrevisions"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.ControllerRevision](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewControllerRevisionInformerWithOptions(client kubernetes.Interface, names
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *controllerRevisionInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewControllerRevisionInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedControllerRevisionInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *controllerRevisionInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiappsv1.ControllerRevision{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *controllerRevisionInformer) TypedInformer() ControllerRevisionIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.ControllerRevision](f.factory.InformerFor(&apiappsv1.ControllerRevision{}, f.defaultInformer))
 }
 
 func (f *controllerRevisionInformer) Lister() appsv1.ControllerRevisionLister {
 	return appsv1.NewControllerRevisionLister(f.Informer().GetIndexer())
 }
+
+// ToTypedControllerRevisionInformer converts an untyped informer into a TypedControllerRevisionInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ControllerRevision. If that is not the case, calling type-safe methods of the returned
+// TypedControllerRevisionInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedControllerRevisionInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedControllerRevisionInformer(informer ControllerRevisionInformer) TypedControllerRevisionInformer {
+	if informer, ok := informer.(TypedControllerRevisionInformer); ok {
+		return informer
+	}
+	return &controllerRevisionTypedInformerAdapter{informer}
+}
+
+type controllerRevisionTypedInformerAdapter struct {
+	ControllerRevisionInformer
+}
+
+func (a *controllerRevisionTypedInformerAdapter) TypedInformer() ControllerRevisionIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.ControllerRevision](a.Informer())
+}
+
+// ToControllerRevisionIndexInformer converts an untyped informer into a ControllerRevisionIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ControllerRevision. If that is not the case, calling type-safe methods of the returned
+// ControllerRevisionIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ControllerRevisionIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToControllerRevisionIndexInformer(informer cache.SharedIndexInformer) ControllerRevisionIndexInformer {
+	if informer, ok := informer.(ControllerRevisionIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.ControllerRevision](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/apps/v1/daemonset.go b/vendor/k8s.io/client-go/informers/apps/v1/daemonset.go
index dbdc401242..110fbdbcc5 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1/daemonset.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1/daemonset.go
@@ -34,12 +34,40 @@ import (
 )
 
 // DaemonSetInformer provides access to a shared informer and lister for
-// DaemonSets.
+// DaemonSets. Prefer using the type-safe variant (see [TypedDaemonSetInformer]).
 type DaemonSetInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() appsv1.DaemonSetLister
 }
 
+// TypedDaemonSetInformer provides access to a shared informer and lister for
+// DaemonSets, including the type-safe TypedInformer variant.
+// It is a superset of DaemonSetInformer.
+type TypedDaemonSetInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() DaemonSetIndexInformer
+	Lister() appsv1.DaemonSetLister
+}
+
+// DaemonSetIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type DaemonSetIndexInformer cache.TypedSharedIndexInformer[*apiappsv1.DaemonSet]
+
+// DaemonSetHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for DaemonSet.
+type DaemonSetHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiappsv1.DaemonSet]
+
+// DaemonSetDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for DaemonSet.
+type DaemonSetDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiappsv1.DaemonSet]
+
+// DaemonSetFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for DaemonSet.
+type DaemonSetFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiappsv1.DaemonSet]
+
+// DaemonSetIndexers is a specialization of [cache.TypedIndexers] for DaemonSet.
+type DaemonSetIndexers = cache.TypedIndexers[*apiappsv1.DaemonSet]
+
+// DeletedDaemonSet is a specialization of [cache.DeletedObject] for DaemonSet.
+type DeletedDaemonSet = cache.DeletedObject[*apiappsv1.DaemonSet]
+
 type daemonSetInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type daemonSetInformer struct {
 // NewDaemonSetInformer constructs a new informer for DaemonSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDaemonSetInformer]).
 func NewDaemonSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewDaemonSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedDaemonSetInformer constructs a new informer for DaemonSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDaemonSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers DaemonSetIndexers) DaemonSetIndexInformer {
+	return NewTypedDaemonSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredDaemonSetInformer constructs a new informer for DaemonSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredDaemonSetInformer]).
 func NewFilteredDaemonSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewDaemonSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedDaemonSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredDaemonSetInformer constructs a new informer for DaemonSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredDaemonSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers DaemonSetIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) DaemonSetIndexInformer {
+	return NewTypedDaemonSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewDaemonSetInformerWithOptions constructs a new informer for DaemonSet type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDaemonSetInformerWithOptions]).
 func NewDaemonSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedDaemonSetInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedDaemonSetInformerWithOptions constructs a new informer for DaemonSet type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDaemonSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) DaemonSetIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "daemonsets"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.DaemonSet](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewDaemonSetInformerWithOptions(client kubernetes.Interface, namespace stri
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *daemonSetInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewDaemonSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedDaemonSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *daemonSetInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiappsv1.DaemonSet{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *daemonSetInformer) TypedInformer() DaemonSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.DaemonSet](f.factory.InformerFor(&apiappsv1.DaemonSet{}, f.defaultInformer))
 }
 
 func (f *daemonSetInformer) Lister() appsv1.DaemonSetLister {
 	return appsv1.NewDaemonSetLister(f.Informer().GetIndexer())
 }
+
+// ToTypedDaemonSetInformer converts an untyped informer into a TypedDaemonSetInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DaemonSet. If that is not the case, calling type-safe methods of the returned
+// TypedDaemonSetInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedDaemonSetInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedDaemonSetInformer(informer DaemonSetInformer) TypedDaemonSetInformer {
+	if informer, ok := informer.(TypedDaemonSetInformer); ok {
+		return informer
+	}
+	return &daemonSetTypedInformerAdapter{informer}
+}
+
+type daemonSetTypedInformerAdapter struct {
+	DaemonSetInformer
+}
+
+func (a *daemonSetTypedInformerAdapter) TypedInformer() DaemonSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.DaemonSet](a.Informer())
+}
+
+// ToDaemonSetIndexInformer converts an untyped informer into a DaemonSetIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DaemonSet. If that is not the case, calling type-safe methods of the returned
+// DaemonSetIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a DaemonSetIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToDaemonSetIndexInformer(informer cache.SharedIndexInformer) DaemonSetIndexInformer {
+	if informer, ok := informer.(DaemonSetIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.DaemonSet](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/apps/v1/deployment.go b/vendor/k8s.io/client-go/informers/apps/v1/deployment.go
index dbf4df6a88..1079bc190b 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1/deployment.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1/deployment.go
@@ -34,12 +34,40 @@ import (
 )
 
 // DeploymentInformer provides access to a shared informer and lister for
-// Deployments.
+// Deployments. Prefer using the type-safe variant (see [TypedDeploymentInformer]).
 type DeploymentInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() appsv1.DeploymentLister
 }
 
+// TypedDeploymentInformer provides access to a shared informer and lister for
+// Deployments, including the type-safe TypedInformer variant.
+// It is a superset of DeploymentInformer.
+type TypedDeploymentInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() DeploymentIndexInformer
+	Lister() appsv1.DeploymentLister
+}
+
+// DeploymentIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type DeploymentIndexInformer cache.TypedSharedIndexInformer[*apiappsv1.Deployment]
+
+// DeploymentHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Deployment.
+type DeploymentHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiappsv1.Deployment]
+
+// DeploymentDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Deployment.
+type DeploymentDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiappsv1.Deployment]
+
+// DeploymentFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Deployment.
+type DeploymentFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiappsv1.Deployment]
+
+// DeploymentIndexers is a specialization of [cache.TypedIndexers] for Deployment.
+type DeploymentIndexers = cache.TypedIndexers[*apiappsv1.Deployment]
+
+// DeletedDeployment is a specialization of [cache.DeletedObject] for Deployment.
+type DeletedDeployment = cache.DeletedObject[*apiappsv1.Deployment]
+
 type deploymentInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type deploymentInformer struct {
 // NewDeploymentInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeploymentInformer]).
 func NewDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedDeploymentInformer constructs a new informer for Deployment type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers DeploymentIndexers) DeploymentIndexInformer {
+	return NewTypedDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredDeploymentInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredDeploymentInformer]).
 func NewFilteredDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredDeploymentInformer constructs a new informer for Deployment type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers DeploymentIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) DeploymentIndexInformer {
+	return NewTypedDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewDeploymentInformerWithOptions constructs a new informer for Deployment type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeploymentInformerWithOptions]).
 func NewDeploymentInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedDeploymentInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedDeploymentInformerWithOptions constructs a new informer for Deployment type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeploymentInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) DeploymentIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployments"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.Deployment](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewDeploymentInformerWithOptions(client kubernetes.Interface, namespace str
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *deploymentInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewDeploymentInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedDeploymentInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *deploymentInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiappsv1.Deployment{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *deploymentInformer) TypedInformer() DeploymentIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.Deployment](f.factory.InformerFor(&apiappsv1.Deployment{}, f.defaultInformer))
 }
 
 func (f *deploymentInformer) Lister() appsv1.DeploymentLister {
 	return appsv1.NewDeploymentLister(f.Informer().GetIndexer())
 }
+
+// ToTypedDeploymentInformer converts an untyped informer into a TypedDeploymentInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Deployment. If that is not the case, calling type-safe methods of the returned
+// TypedDeploymentInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedDeploymentInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedDeploymentInformer(informer DeploymentInformer) TypedDeploymentInformer {
+	if informer, ok := informer.(TypedDeploymentInformer); ok {
+		return informer
+	}
+	return &deploymentTypedInformerAdapter{informer}
+}
+
+type deploymentTypedInformerAdapter struct {
+	DeploymentInformer
+}
+
+func (a *deploymentTypedInformerAdapter) TypedInformer() DeploymentIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.Deployment](a.Informer())
+}
+
+// ToDeploymentIndexInformer converts an untyped informer into a DeploymentIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Deployment. If that is not the case, calling type-safe methods of the returned
+// DeploymentIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a DeploymentIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToDeploymentIndexInformer(informer cache.SharedIndexInformer) DeploymentIndexInformer {
+	if informer, ok := informer.(DeploymentIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.Deployment](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/apps/v1/interface.go b/vendor/k8s.io/client-go/informers/apps/v1/interface.go
index fab1e76bd9..d8e4e3bf17 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1/interface.go
@@ -25,15 +25,15 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// ControllerRevisions returns a ControllerRevisionInformer.
-	ControllerRevisions() ControllerRevisionInformer
+	ControllerRevisions() TypedControllerRevisionInformer
 	// DaemonSets returns a DaemonSetInformer.
-	DaemonSets() DaemonSetInformer
+	DaemonSets() TypedDaemonSetInformer
 	// Deployments returns a DeploymentInformer.
-	Deployments() DeploymentInformer
+	Deployments() TypedDeploymentInformer
 	// ReplicaSets returns a ReplicaSetInformer.
-	ReplicaSets() ReplicaSetInformer
+	ReplicaSets() TypedReplicaSetInformer
 	// StatefulSets returns a StatefulSetInformer.
-	StatefulSets() StatefulSetInformer
+	StatefulSets() TypedStatefulSetInformer
 }
 
 type version struct {
@@ -47,27 +47,27 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// ControllerRevisions returns a ControllerRevisionInformer.
-func (v *version) ControllerRevisions() ControllerRevisionInformer {
+// ControllerRevisions returns a TypedControllerRevisionInformer.
+func (v *version) ControllerRevisions() TypedControllerRevisionInformer {
 	return &controllerRevisionInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// DaemonSets returns a DaemonSetInformer.
-func (v *version) DaemonSets() DaemonSetInformer {
+// DaemonSets returns a TypedDaemonSetInformer.
+func (v *version) DaemonSets() TypedDaemonSetInformer {
 	return &daemonSetInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// Deployments returns a DeploymentInformer.
-func (v *version) Deployments() DeploymentInformer {
+// Deployments returns a TypedDeploymentInformer.
+func (v *version) Deployments() TypedDeploymentInformer {
 	return &deploymentInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// ReplicaSets returns a ReplicaSetInformer.
-func (v *version) ReplicaSets() ReplicaSetInformer {
+// ReplicaSets returns a TypedReplicaSetInformer.
+func (v *version) ReplicaSets() TypedReplicaSetInformer {
 	return &replicaSetInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// StatefulSets returns a StatefulSetInformer.
-func (v *version) StatefulSets() StatefulSetInformer {
+// StatefulSets returns a TypedStatefulSetInformer.
+func (v *version) StatefulSets() TypedStatefulSetInformer {
 	return &statefulSetInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/apps/v1/replicaset.go b/vendor/k8s.io/client-go/informers/apps/v1/replicaset.go
index 1115e5adcc..13983f2a7d 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1/replicaset.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1/replicaset.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ReplicaSetInformer provides access to a shared informer and lister for
-// ReplicaSets.
+// ReplicaSets. Prefer using the type-safe variant (see [TypedReplicaSetInformer]).
 type ReplicaSetInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() appsv1.ReplicaSetLister
 }
 
+// TypedReplicaSetInformer provides access to a shared informer and lister for
+// ReplicaSets, including the type-safe TypedInformer variant.
+// It is a superset of ReplicaSetInformer.
+type TypedReplicaSetInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ReplicaSetIndexInformer
+	Lister() appsv1.ReplicaSetLister
+}
+
+// ReplicaSetIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ReplicaSetIndexInformer cache.TypedSharedIndexInformer[*apiappsv1.ReplicaSet]
+
+// ReplicaSetHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ReplicaSet.
+type ReplicaSetHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiappsv1.ReplicaSet]
+
+// ReplicaSetDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ReplicaSet.
+type ReplicaSetDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiappsv1.ReplicaSet]
+
+// ReplicaSetFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ReplicaSet.
+type ReplicaSetFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiappsv1.ReplicaSet]
+
+// ReplicaSetIndexers is a specialization of [cache.TypedIndexers] for ReplicaSet.
+type ReplicaSetIndexers = cache.TypedIndexers[*apiappsv1.ReplicaSet]
+
+// DeletedReplicaSet is a specialization of [cache.DeletedObject] for ReplicaSet.
+type DeletedReplicaSet = cache.DeletedObject[*apiappsv1.ReplicaSet]
+
 type replicaSetInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type replicaSetInformer struct {
 // NewReplicaSetInformer constructs a new informer for ReplicaSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedReplicaSetInformer]).
 func NewReplicaSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewReplicaSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedReplicaSetInformer constructs a new informer for ReplicaSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedReplicaSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ReplicaSetIndexers) ReplicaSetIndexInformer {
+	return NewTypedReplicaSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredReplicaSetInformer constructs a new informer for ReplicaSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredReplicaSetInformer]).
 func NewFilteredReplicaSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewReplicaSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedReplicaSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredReplicaSetInformer constructs a new informer for ReplicaSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredReplicaSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ReplicaSetIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ReplicaSetIndexInformer {
+	return NewTypedReplicaSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewReplicaSetInformerWithOptions constructs a new informer for ReplicaSet type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedReplicaSetInformerWithOptions]).
 func NewReplicaSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedReplicaSetInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedReplicaSetInformerWithOptions constructs a new informer for ReplicaSet type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedReplicaSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ReplicaSetIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "replicasets"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.ReplicaSet](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewReplicaSetInformerWithOptions(client kubernetes.Interface, namespace str
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *replicaSetInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewReplicaSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedReplicaSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *replicaSetInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiappsv1.ReplicaSet{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *replicaSetInformer) TypedInformer() ReplicaSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.ReplicaSet](f.factory.InformerFor(&apiappsv1.ReplicaSet{}, f.defaultInformer))
 }
 
 func (f *replicaSetInformer) Lister() appsv1.ReplicaSetLister {
 	return appsv1.NewReplicaSetLister(f.Informer().GetIndexer())
 }
+
+// ToTypedReplicaSetInformer converts an untyped informer into a TypedReplicaSetInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ReplicaSet. If that is not the case, calling type-safe methods of the returned
+// TypedReplicaSetInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedReplicaSetInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedReplicaSetInformer(informer ReplicaSetInformer) TypedReplicaSetInformer {
+	if informer, ok := informer.(TypedReplicaSetInformer); ok {
+		return informer
+	}
+	return &replicaSetTypedInformerAdapter{informer}
+}
+
+type replicaSetTypedInformerAdapter struct {
+	ReplicaSetInformer
+}
+
+func (a *replicaSetTypedInformerAdapter) TypedInformer() ReplicaSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.ReplicaSet](a.Informer())
+}
+
+// ToReplicaSetIndexInformer converts an untyped informer into a ReplicaSetIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ReplicaSet. If that is not the case, calling type-safe methods of the returned
+// ReplicaSetIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ReplicaSetIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToReplicaSetIndexInformer(informer cache.SharedIndexInformer) ReplicaSetIndexInformer {
+	if informer, ok := informer.(ReplicaSetIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.ReplicaSet](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/apps/v1/statefulset.go b/vendor/k8s.io/client-go/informers/apps/v1/statefulset.go
index 998251edee..64c766e153 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1/statefulset.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1/statefulset.go
@@ -34,12 +34,40 @@ import (
 )
 
 // StatefulSetInformer provides access to a shared informer and lister for
-// StatefulSets.
+// StatefulSets. Prefer using the type-safe variant (see [TypedStatefulSetInformer]).
 type StatefulSetInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() appsv1.StatefulSetLister
 }
 
+// TypedStatefulSetInformer provides access to a shared informer and lister for
+// StatefulSets, including the type-safe TypedInformer variant.
+// It is a superset of StatefulSetInformer.
+type TypedStatefulSetInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() StatefulSetIndexInformer
+	Lister() appsv1.StatefulSetLister
+}
+
+// StatefulSetIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type StatefulSetIndexInformer cache.TypedSharedIndexInformer[*apiappsv1.StatefulSet]
+
+// StatefulSetHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for StatefulSet.
+type StatefulSetHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiappsv1.StatefulSet]
+
+// StatefulSetDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for StatefulSet.
+type StatefulSetDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiappsv1.StatefulSet]
+
+// StatefulSetFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for StatefulSet.
+type StatefulSetFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiappsv1.StatefulSet]
+
+// StatefulSetIndexers is a specialization of [cache.TypedIndexers] for StatefulSet.
+type StatefulSetIndexers = cache.TypedIndexers[*apiappsv1.StatefulSet]
+
+// DeletedStatefulSet is a specialization of [cache.DeletedObject] for StatefulSet.
+type DeletedStatefulSet = cache.DeletedObject[*apiappsv1.StatefulSet]
+
 type statefulSetInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type statefulSetInformer struct {
 // NewStatefulSetInformer constructs a new informer for StatefulSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStatefulSetInformer]).
 func NewStatefulSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewStatefulSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedStatefulSetInformer constructs a new informer for StatefulSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStatefulSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers StatefulSetIndexers) StatefulSetIndexInformer {
+	return NewTypedStatefulSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredStatefulSetInformer constructs a new informer for StatefulSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredStatefulSetInformer]).
 func NewFilteredStatefulSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewStatefulSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedStatefulSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredStatefulSetInformer constructs a new informer for StatefulSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredStatefulSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers StatefulSetIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) StatefulSetIndexInformer {
+	return NewTypedStatefulSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewStatefulSetInformerWithOptions constructs a new informer for StatefulSet type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStatefulSetInformerWithOptions]).
 func NewStatefulSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedStatefulSetInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedStatefulSetInformerWithOptions constructs a new informer for StatefulSet type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStatefulSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) StatefulSetIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "statefulsets"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.StatefulSet](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewStatefulSetInformerWithOptions(client kubernetes.Interface, namespace st
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *statefulSetInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewStatefulSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedStatefulSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *statefulSetInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiappsv1.StatefulSet{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *statefulSetInformer) TypedInformer() StatefulSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.StatefulSet](f.factory.InformerFor(&apiappsv1.StatefulSet{}, f.defaultInformer))
 }
 
 func (f *statefulSetInformer) Lister() appsv1.StatefulSetLister {
 	return appsv1.NewStatefulSetLister(f.Informer().GetIndexer())
 }
+
+// ToTypedStatefulSetInformer converts an untyped informer into a TypedStatefulSetInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StatefulSet. If that is not the case, calling type-safe methods of the returned
+// TypedStatefulSetInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedStatefulSetInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedStatefulSetInformer(informer StatefulSetInformer) TypedStatefulSetInformer {
+	if informer, ok := informer.(TypedStatefulSetInformer); ok {
+		return informer
+	}
+	return &statefulSetTypedInformerAdapter{informer}
+}
+
+type statefulSetTypedInformerAdapter struct {
+	StatefulSetInformer
+}
+
+func (a *statefulSetTypedInformerAdapter) TypedInformer() StatefulSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.StatefulSet](a.Informer())
+}
+
+// ToStatefulSetIndexInformer converts an untyped informer into a StatefulSetIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StatefulSet. If that is not the case, calling type-safe methods of the returned
+// StatefulSetIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a StatefulSetIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToStatefulSetIndexInformer(informer cache.SharedIndexInformer) StatefulSetIndexInformer {
+	if informer, ok := informer.(StatefulSetIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiappsv1.StatefulSet](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/apps/v1beta1/controllerrevision.go b/vendor/k8s.io/client-go/informers/apps/v1beta1/controllerrevision.go
index ee3b156e02..02215f9004 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1beta1/controllerrevision.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1beta1/controllerrevision.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ControllerRevisionInformer provides access to a shared informer and lister for
-// ControllerRevisions.
+// ControllerRevisions. Prefer using the type-safe variant (see [TypedControllerRevisionInformer]).
 type ControllerRevisionInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() appsv1beta1.ControllerRevisionLister
 }
 
+// TypedControllerRevisionInformer provides access to a shared informer and lister for
+// ControllerRevisions, including the type-safe TypedInformer variant.
+// It is a superset of ControllerRevisionInformer.
+type TypedControllerRevisionInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ControllerRevisionIndexInformer
+	Lister() appsv1beta1.ControllerRevisionLister
+}
+
+// ControllerRevisionIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ControllerRevisionIndexInformer cache.TypedSharedIndexInformer[*apiappsv1beta1.ControllerRevision]
+
+// ControllerRevisionHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ControllerRevision.
+type ControllerRevisionHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiappsv1beta1.ControllerRevision]
+
+// ControllerRevisionDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ControllerRevision.
+type ControllerRevisionDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiappsv1beta1.ControllerRevision]
+
+// ControllerRevisionFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ControllerRevision.
+type ControllerRevisionFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiappsv1beta1.ControllerRevision]
+
+// ControllerRevisionIndexers is a specialization of [cache.TypedIndexers] for ControllerRevision.
+type ControllerRevisionIndexers = cache.TypedIndexers[*apiappsv1beta1.ControllerRevision]
+
+// DeletedControllerRevision is a specialization of [cache.DeletedObject] for ControllerRevision.
+type DeletedControllerRevision = cache.DeletedObject[*apiappsv1beta1.ControllerRevision]
+
 type controllerRevisionInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type controllerRevisionInformer struct {
 // NewControllerRevisionInformer constructs a new informer for ControllerRevision type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedControllerRevisionInformer]).
 func NewControllerRevisionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewControllerRevisionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedControllerRevisionInformer constructs a new informer for ControllerRevision type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedControllerRevisionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ControllerRevisionIndexers) ControllerRevisionIndexInformer {
+	return NewTypedControllerRevisionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredControllerRevisionInformer constructs a new informer for ControllerRevision type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredControllerRevisionInformer]).
 func NewFilteredControllerRevisionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewControllerRevisionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedControllerRevisionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredControllerRevisionInformer constructs a new informer for ControllerRevision type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredControllerRevisionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ControllerRevisionIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ControllerRevisionIndexInformer {
+	return NewTypedControllerRevisionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewControllerRevisionInformerWithOptions constructs a new informer for ControllerRevision type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedControllerRevisionInformerWithOptions]).
 func NewControllerRevisionInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedControllerRevisionInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedControllerRevisionInformerWithOptions constructs a new informer for ControllerRevision type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedControllerRevisionInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ControllerRevisionIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "apps", Version: "v1beta1", Resource: "controllerrevisions"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta1.ControllerRevision](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewControllerRevisionInformerWithOptions(client kubernetes.Interface, names
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *controllerRevisionInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewControllerRevisionInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedControllerRevisionInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *controllerRevisionInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiappsv1beta1.ControllerRevision{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *controllerRevisionInformer) TypedInformer() ControllerRevisionIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta1.ControllerRevision](f.factory.InformerFor(&apiappsv1beta1.ControllerRevision{}, f.defaultInformer))
 }
 
 func (f *controllerRevisionInformer) Lister() appsv1beta1.ControllerRevisionLister {
 	return appsv1beta1.NewControllerRevisionLister(f.Informer().GetIndexer())
 }
+
+// ToTypedControllerRevisionInformer converts an untyped informer into a TypedControllerRevisionInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ControllerRevision. If that is not the case, calling type-safe methods of the returned
+// TypedControllerRevisionInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedControllerRevisionInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedControllerRevisionInformer(informer ControllerRevisionInformer) TypedControllerRevisionInformer {
+	if informer, ok := informer.(TypedControllerRevisionInformer); ok {
+		return informer
+	}
+	return &controllerRevisionTypedInformerAdapter{informer}
+}
+
+type controllerRevisionTypedInformerAdapter struct {
+	ControllerRevisionInformer
+}
+
+func (a *controllerRevisionTypedInformerAdapter) TypedInformer() ControllerRevisionIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta1.ControllerRevision](a.Informer())
+}
+
+// ToControllerRevisionIndexInformer converts an untyped informer into a ControllerRevisionIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ControllerRevision. If that is not the case, calling type-safe methods of the returned
+// ControllerRevisionIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ControllerRevisionIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToControllerRevisionIndexInformer(informer cache.SharedIndexInformer) ControllerRevisionIndexInformer {
+	if informer, ok := informer.(ControllerRevisionIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta1.ControllerRevision](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/apps/v1beta1/deployment.go b/vendor/k8s.io/client-go/informers/apps/v1beta1/deployment.go
index 699375e3e1..c29a3b39b6 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1beta1/deployment.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1beta1/deployment.go
@@ -34,12 +34,40 @@ import (
 )
 
 // DeploymentInformer provides access to a shared informer and lister for
-// Deployments.
+// Deployments. Prefer using the type-safe variant (see [TypedDeploymentInformer]).
 type DeploymentInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() appsv1beta1.DeploymentLister
 }
 
+// TypedDeploymentInformer provides access to a shared informer and lister for
+// Deployments, including the type-safe TypedInformer variant.
+// It is a superset of DeploymentInformer.
+type TypedDeploymentInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() DeploymentIndexInformer
+	Lister() appsv1beta1.DeploymentLister
+}
+
+// DeploymentIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type DeploymentIndexInformer cache.TypedSharedIndexInformer[*apiappsv1beta1.Deployment]
+
+// DeploymentHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Deployment.
+type DeploymentHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiappsv1beta1.Deployment]
+
+// DeploymentDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Deployment.
+type DeploymentDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiappsv1beta1.Deployment]
+
+// DeploymentFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Deployment.
+type DeploymentFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiappsv1beta1.Deployment]
+
+// DeploymentIndexers is a specialization of [cache.TypedIndexers] for Deployment.
+type DeploymentIndexers = cache.TypedIndexers[*apiappsv1beta1.Deployment]
+
+// DeletedDeployment is a specialization of [cache.DeletedObject] for Deployment.
+type DeletedDeployment = cache.DeletedObject[*apiappsv1beta1.Deployment]
+
 type deploymentInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type deploymentInformer struct {
 // NewDeploymentInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeploymentInformer]).
 func NewDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedDeploymentInformer constructs a new informer for Deployment type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers DeploymentIndexers) DeploymentIndexInformer {
+	return NewTypedDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredDeploymentInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredDeploymentInformer]).
 func NewFilteredDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredDeploymentInformer constructs a new informer for Deployment type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers DeploymentIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) DeploymentIndexInformer {
+	return NewTypedDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewDeploymentInformerWithOptions constructs a new informer for Deployment type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeploymentInformerWithOptions]).
 func NewDeploymentInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedDeploymentInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedDeploymentInformerWithOptions constructs a new informer for Deployment type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeploymentInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) DeploymentIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "apps", Version: "v1beta1", Resource: "deployments"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta1.Deployment](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewDeploymentInformerWithOptions(client kubernetes.Interface, namespace str
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *deploymentInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewDeploymentInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedDeploymentInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *deploymentInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiappsv1beta1.Deployment{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *deploymentInformer) TypedInformer() DeploymentIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta1.Deployment](f.factory.InformerFor(&apiappsv1beta1.Deployment{}, f.defaultInformer))
 }
 
 func (f *deploymentInformer) Lister() appsv1beta1.DeploymentLister {
 	return appsv1beta1.NewDeploymentLister(f.Informer().GetIndexer())
 }
+
+// ToTypedDeploymentInformer converts an untyped informer into a TypedDeploymentInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Deployment. If that is not the case, calling type-safe methods of the returned
+// TypedDeploymentInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedDeploymentInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedDeploymentInformer(informer DeploymentInformer) TypedDeploymentInformer {
+	if informer, ok := informer.(TypedDeploymentInformer); ok {
+		return informer
+	}
+	return &deploymentTypedInformerAdapter{informer}
+}
+
+type deploymentTypedInformerAdapter struct {
+	DeploymentInformer
+}
+
+func (a *deploymentTypedInformerAdapter) TypedInformer() DeploymentIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta1.Deployment](a.Informer())
+}
+
+// ToDeploymentIndexInformer converts an untyped informer into a DeploymentIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Deployment. If that is not the case, calling type-safe methods of the returned
+// DeploymentIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a DeploymentIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToDeploymentIndexInformer(informer cache.SharedIndexInformer) DeploymentIndexInformer {
+	if informer, ok := informer.(DeploymentIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta1.Deployment](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/apps/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/apps/v1beta1/interface.go
index 326939cd12..4a4d87e930 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1beta1/interface.go
@@ -25,11 +25,11 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// ControllerRevisions returns a ControllerRevisionInformer.
-	ControllerRevisions() ControllerRevisionInformer
+	ControllerRevisions() TypedControllerRevisionInformer
 	// Deployments returns a DeploymentInformer.
-	Deployments() DeploymentInformer
+	Deployments() TypedDeploymentInformer
 	// StatefulSets returns a StatefulSetInformer.
-	StatefulSets() StatefulSetInformer
+	StatefulSets() TypedStatefulSetInformer
 }
 
 type version struct {
@@ -43,17 +43,17 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// ControllerRevisions returns a ControllerRevisionInformer.
-func (v *version) ControllerRevisions() ControllerRevisionInformer {
+// ControllerRevisions returns a TypedControllerRevisionInformer.
+func (v *version) ControllerRevisions() TypedControllerRevisionInformer {
 	return &controllerRevisionInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// Deployments returns a DeploymentInformer.
-func (v *version) Deployments() DeploymentInformer {
+// Deployments returns a TypedDeploymentInformer.
+func (v *version) Deployments() TypedDeploymentInformer {
 	return &deploymentInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// StatefulSets returns a StatefulSetInformer.
-func (v *version) StatefulSets() StatefulSetInformer {
+// StatefulSets returns a TypedStatefulSetInformer.
+func (v *version) StatefulSets() TypedStatefulSetInformer {
 	return &statefulSetInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/apps/v1beta1/statefulset.go b/vendor/k8s.io/client-go/informers/apps/v1beta1/statefulset.go
index 480e68f9d1..ad9dc2d3bd 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1beta1/statefulset.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1beta1/statefulset.go
@@ -34,12 +34,40 @@ import (
 )
 
 // StatefulSetInformer provides access to a shared informer and lister for
-// StatefulSets.
+// StatefulSets. Prefer using the type-safe variant (see [TypedStatefulSetInformer]).
 type StatefulSetInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() appsv1beta1.StatefulSetLister
 }
 
+// TypedStatefulSetInformer provides access to a shared informer and lister for
+// StatefulSets, including the type-safe TypedInformer variant.
+// It is a superset of StatefulSetInformer.
+type TypedStatefulSetInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() StatefulSetIndexInformer
+	Lister() appsv1beta1.StatefulSetLister
+}
+
+// StatefulSetIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type StatefulSetIndexInformer cache.TypedSharedIndexInformer[*apiappsv1beta1.StatefulSet]
+
+// StatefulSetHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for StatefulSet.
+type StatefulSetHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiappsv1beta1.StatefulSet]
+
+// StatefulSetDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for StatefulSet.
+type StatefulSetDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiappsv1beta1.StatefulSet]
+
+// StatefulSetFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for StatefulSet.
+type StatefulSetFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiappsv1beta1.StatefulSet]
+
+// StatefulSetIndexers is a specialization of [cache.TypedIndexers] for StatefulSet.
+type StatefulSetIndexers = cache.TypedIndexers[*apiappsv1beta1.StatefulSet]
+
+// DeletedStatefulSet is a specialization of [cache.DeletedObject] for StatefulSet.
+type DeletedStatefulSet = cache.DeletedObject[*apiappsv1beta1.StatefulSet]
+
 type statefulSetInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type statefulSetInformer struct {
 // NewStatefulSetInformer constructs a new informer for StatefulSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStatefulSetInformer]).
 func NewStatefulSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewStatefulSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedStatefulSetInformer constructs a new informer for StatefulSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStatefulSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers StatefulSetIndexers) StatefulSetIndexInformer {
+	return NewTypedStatefulSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredStatefulSetInformer constructs a new informer for StatefulSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredStatefulSetInformer]).
 func NewFilteredStatefulSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewStatefulSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedStatefulSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredStatefulSetInformer constructs a new informer for StatefulSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredStatefulSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers StatefulSetIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) StatefulSetIndexInformer {
+	return NewTypedStatefulSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewStatefulSetInformerWithOptions constructs a new informer for StatefulSet type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStatefulSetInformerWithOptions]).
 func NewStatefulSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedStatefulSetInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedStatefulSetInformerWithOptions constructs a new informer for StatefulSet type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStatefulSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) StatefulSetIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "apps", Version: "v1beta1", Resource: "statefulsets"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta1.StatefulSet](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewStatefulSetInformerWithOptions(client kubernetes.Interface, namespace st
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *statefulSetInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewStatefulSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedStatefulSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *statefulSetInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiappsv1beta1.StatefulSet{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *statefulSetInformer) TypedInformer() StatefulSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta1.StatefulSet](f.factory.InformerFor(&apiappsv1beta1.StatefulSet{}, f.defaultInformer))
 }
 
 func (f *statefulSetInformer) Lister() appsv1beta1.StatefulSetLister {
 	return appsv1beta1.NewStatefulSetLister(f.Informer().GetIndexer())
 }
+
+// ToTypedStatefulSetInformer converts an untyped informer into a TypedStatefulSetInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StatefulSet. If that is not the case, calling type-safe methods of the returned
+// TypedStatefulSetInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedStatefulSetInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedStatefulSetInformer(informer StatefulSetInformer) TypedStatefulSetInformer {
+	if informer, ok := informer.(TypedStatefulSetInformer); ok {
+		return informer
+	}
+	return &statefulSetTypedInformerAdapter{informer}
+}
+
+type statefulSetTypedInformerAdapter struct {
+	StatefulSetInformer
+}
+
+func (a *statefulSetTypedInformerAdapter) TypedInformer() StatefulSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta1.StatefulSet](a.Informer())
+}
+
+// ToStatefulSetIndexInformer converts an untyped informer into a StatefulSetIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StatefulSet. If that is not the case, calling type-safe methods of the returned
+// StatefulSetIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a StatefulSetIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToStatefulSetIndexInformer(informer cache.SharedIndexInformer) StatefulSetIndexInformer {
+	if informer, ok := informer.(StatefulSetIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta1.StatefulSet](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/apps/v1beta2/controllerrevision.go b/vendor/k8s.io/client-go/informers/apps/v1beta2/controllerrevision.go
index 41e3bf1563..0d686ae442 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1beta2/controllerrevision.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1beta2/controllerrevision.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ControllerRevisionInformer provides access to a shared informer and lister for
-// ControllerRevisions.
+// ControllerRevisions. Prefer using the type-safe variant (see [TypedControllerRevisionInformer]).
 type ControllerRevisionInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() appsv1beta2.ControllerRevisionLister
 }
 
+// TypedControllerRevisionInformer provides access to a shared informer and lister for
+// ControllerRevisions, including the type-safe TypedInformer variant.
+// It is a superset of ControllerRevisionInformer.
+type TypedControllerRevisionInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ControllerRevisionIndexInformer
+	Lister() appsv1beta2.ControllerRevisionLister
+}
+
+// ControllerRevisionIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ControllerRevisionIndexInformer cache.TypedSharedIndexInformer[*apiappsv1beta2.ControllerRevision]
+
+// ControllerRevisionHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ControllerRevision.
+type ControllerRevisionHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiappsv1beta2.ControllerRevision]
+
+// ControllerRevisionDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ControllerRevision.
+type ControllerRevisionDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiappsv1beta2.ControllerRevision]
+
+// ControllerRevisionFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ControllerRevision.
+type ControllerRevisionFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiappsv1beta2.ControllerRevision]
+
+// ControllerRevisionIndexers is a specialization of [cache.TypedIndexers] for ControllerRevision.
+type ControllerRevisionIndexers = cache.TypedIndexers[*apiappsv1beta2.ControllerRevision]
+
+// DeletedControllerRevision is a specialization of [cache.DeletedObject] for ControllerRevision.
+type DeletedControllerRevision = cache.DeletedObject[*apiappsv1beta2.ControllerRevision]
+
 type controllerRevisionInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type controllerRevisionInformer struct {
 // NewControllerRevisionInformer constructs a new informer for ControllerRevision type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedControllerRevisionInformer]).
 func NewControllerRevisionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewControllerRevisionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedControllerRevisionInformer constructs a new informer for ControllerRevision type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedControllerRevisionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ControllerRevisionIndexers) ControllerRevisionIndexInformer {
+	return NewTypedControllerRevisionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredControllerRevisionInformer constructs a new informer for ControllerRevision type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredControllerRevisionInformer]).
 func NewFilteredControllerRevisionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewControllerRevisionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedControllerRevisionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredControllerRevisionInformer constructs a new informer for ControllerRevision type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredControllerRevisionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ControllerRevisionIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ControllerRevisionIndexInformer {
+	return NewTypedControllerRevisionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewControllerRevisionInformerWithOptions constructs a new informer for ControllerRevision type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedControllerRevisionInformerWithOptions]).
 func NewControllerRevisionInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedControllerRevisionInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedControllerRevisionInformerWithOptions constructs a new informer for ControllerRevision type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedControllerRevisionInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ControllerRevisionIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "apps", Version: "v1beta2", Resource: "controllerrevisions"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.ControllerRevision](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewControllerRevisionInformerWithOptions(client kubernetes.Interface, names
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *controllerRevisionInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewControllerRevisionInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedControllerRevisionInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *controllerRevisionInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiappsv1beta2.ControllerRevision{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *controllerRevisionInformer) TypedInformer() ControllerRevisionIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.ControllerRevision](f.factory.InformerFor(&apiappsv1beta2.ControllerRevision{}, f.defaultInformer))
 }
 
 func (f *controllerRevisionInformer) Lister() appsv1beta2.ControllerRevisionLister {
 	return appsv1beta2.NewControllerRevisionLister(f.Informer().GetIndexer())
 }
+
+// ToTypedControllerRevisionInformer converts an untyped informer into a TypedControllerRevisionInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ControllerRevision. If that is not the case, calling type-safe methods of the returned
+// TypedControllerRevisionInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedControllerRevisionInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedControllerRevisionInformer(informer ControllerRevisionInformer) TypedControllerRevisionInformer {
+	if informer, ok := informer.(TypedControllerRevisionInformer); ok {
+		return informer
+	}
+	return &controllerRevisionTypedInformerAdapter{informer}
+}
+
+type controllerRevisionTypedInformerAdapter struct {
+	ControllerRevisionInformer
+}
+
+func (a *controllerRevisionTypedInformerAdapter) TypedInformer() ControllerRevisionIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.ControllerRevision](a.Informer())
+}
+
+// ToControllerRevisionIndexInformer converts an untyped informer into a ControllerRevisionIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ControllerRevision. If that is not the case, calling type-safe methods of the returned
+// ControllerRevisionIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ControllerRevisionIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToControllerRevisionIndexInformer(informer cache.SharedIndexInformer) ControllerRevisionIndexInformer {
+	if informer, ok := informer.(ControllerRevisionIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.ControllerRevision](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/apps/v1beta2/daemonset.go b/vendor/k8s.io/client-go/informers/apps/v1beta2/daemonset.go
index 5c339a78a0..16c73e28fc 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1beta2/daemonset.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1beta2/daemonset.go
@@ -34,12 +34,40 @@ import (
 )
 
 // DaemonSetInformer provides access to a shared informer and lister for
-// DaemonSets.
+// DaemonSets. Prefer using the type-safe variant (see [TypedDaemonSetInformer]).
 type DaemonSetInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() appsv1beta2.DaemonSetLister
 }
 
+// TypedDaemonSetInformer provides access to a shared informer and lister for
+// DaemonSets, including the type-safe TypedInformer variant.
+// It is a superset of DaemonSetInformer.
+type TypedDaemonSetInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() DaemonSetIndexInformer
+	Lister() appsv1beta2.DaemonSetLister
+}
+
+// DaemonSetIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type DaemonSetIndexInformer cache.TypedSharedIndexInformer[*apiappsv1beta2.DaemonSet]
+
+// DaemonSetHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for DaemonSet.
+type DaemonSetHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiappsv1beta2.DaemonSet]
+
+// DaemonSetDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for DaemonSet.
+type DaemonSetDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiappsv1beta2.DaemonSet]
+
+// DaemonSetFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for DaemonSet.
+type DaemonSetFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiappsv1beta2.DaemonSet]
+
+// DaemonSetIndexers is a specialization of [cache.TypedIndexers] for DaemonSet.
+type DaemonSetIndexers = cache.TypedIndexers[*apiappsv1beta2.DaemonSet]
+
+// DeletedDaemonSet is a specialization of [cache.DeletedObject] for DaemonSet.
+type DeletedDaemonSet = cache.DeletedObject[*apiappsv1beta2.DaemonSet]
+
 type daemonSetInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type daemonSetInformer struct {
 // NewDaemonSetInformer constructs a new informer for DaemonSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDaemonSetInformer]).
 func NewDaemonSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewDaemonSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedDaemonSetInformer constructs a new informer for DaemonSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDaemonSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers DaemonSetIndexers) DaemonSetIndexInformer {
+	return NewTypedDaemonSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredDaemonSetInformer constructs a new informer for DaemonSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredDaemonSetInformer]).
 func NewFilteredDaemonSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewDaemonSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedDaemonSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredDaemonSetInformer constructs a new informer for DaemonSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredDaemonSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers DaemonSetIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) DaemonSetIndexInformer {
+	return NewTypedDaemonSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewDaemonSetInformerWithOptions constructs a new informer for DaemonSet type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDaemonSetInformerWithOptions]).
 func NewDaemonSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedDaemonSetInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedDaemonSetInformerWithOptions constructs a new informer for DaemonSet type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDaemonSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) DaemonSetIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "apps", Version: "v1beta2", Resource: "daemonsets"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.DaemonSet](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewDaemonSetInformerWithOptions(client kubernetes.Interface, namespace stri
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *daemonSetInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewDaemonSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedDaemonSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *daemonSetInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiappsv1beta2.DaemonSet{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *daemonSetInformer) TypedInformer() DaemonSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.DaemonSet](f.factory.InformerFor(&apiappsv1beta2.DaemonSet{}, f.defaultInformer))
 }
 
 func (f *daemonSetInformer) Lister() appsv1beta2.DaemonSetLister {
 	return appsv1beta2.NewDaemonSetLister(f.Informer().GetIndexer())
 }
+
+// ToTypedDaemonSetInformer converts an untyped informer into a TypedDaemonSetInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DaemonSet. If that is not the case, calling type-safe methods of the returned
+// TypedDaemonSetInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedDaemonSetInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedDaemonSetInformer(informer DaemonSetInformer) TypedDaemonSetInformer {
+	if informer, ok := informer.(TypedDaemonSetInformer); ok {
+		return informer
+	}
+	return &daemonSetTypedInformerAdapter{informer}
+}
+
+type daemonSetTypedInformerAdapter struct {
+	DaemonSetInformer
+}
+
+func (a *daemonSetTypedInformerAdapter) TypedInformer() DaemonSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.DaemonSet](a.Informer())
+}
+
+// ToDaemonSetIndexInformer converts an untyped informer into a DaemonSetIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DaemonSet. If that is not the case, calling type-safe methods of the returned
+// DaemonSetIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a DaemonSetIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToDaemonSetIndexInformer(informer cache.SharedIndexInformer) DaemonSetIndexInformer {
+	if informer, ok := informer.(DaemonSetIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.DaemonSet](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/apps/v1beta2/deployment.go b/vendor/k8s.io/client-go/informers/apps/v1beta2/deployment.go
index 1e0b64cb28..04743e3276 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1beta2/deployment.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1beta2/deployment.go
@@ -34,12 +34,40 @@ import (
 )
 
 // DeploymentInformer provides access to a shared informer and lister for
-// Deployments.
+// Deployments. Prefer using the type-safe variant (see [TypedDeploymentInformer]).
 type DeploymentInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() appsv1beta2.DeploymentLister
 }
 
+// TypedDeploymentInformer provides access to a shared informer and lister for
+// Deployments, including the type-safe TypedInformer variant.
+// It is a superset of DeploymentInformer.
+type TypedDeploymentInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() DeploymentIndexInformer
+	Lister() appsv1beta2.DeploymentLister
+}
+
+// DeploymentIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type DeploymentIndexInformer cache.TypedSharedIndexInformer[*apiappsv1beta2.Deployment]
+
+// DeploymentHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Deployment.
+type DeploymentHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiappsv1beta2.Deployment]
+
+// DeploymentDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Deployment.
+type DeploymentDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiappsv1beta2.Deployment]
+
+// DeploymentFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Deployment.
+type DeploymentFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiappsv1beta2.Deployment]
+
+// DeploymentIndexers is a specialization of [cache.TypedIndexers] for Deployment.
+type DeploymentIndexers = cache.TypedIndexers[*apiappsv1beta2.Deployment]
+
+// DeletedDeployment is a specialization of [cache.DeletedObject] for Deployment.
+type DeletedDeployment = cache.DeletedObject[*apiappsv1beta2.Deployment]
+
 type deploymentInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type deploymentInformer struct {
 // NewDeploymentInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeploymentInformer]).
 func NewDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedDeploymentInformer constructs a new informer for Deployment type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers DeploymentIndexers) DeploymentIndexInformer {
+	return NewTypedDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredDeploymentInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredDeploymentInformer]).
 func NewFilteredDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredDeploymentInformer constructs a new informer for Deployment type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers DeploymentIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) DeploymentIndexInformer {
+	return NewTypedDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewDeploymentInformerWithOptions constructs a new informer for Deployment type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeploymentInformerWithOptions]).
 func NewDeploymentInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedDeploymentInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedDeploymentInformerWithOptions constructs a new informer for Deployment type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeploymentInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) DeploymentIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "apps", Version: "v1beta2", Resource: "deployments"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.Deployment](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewDeploymentInformerWithOptions(client kubernetes.Interface, namespace str
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *deploymentInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewDeploymentInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedDeploymentInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *deploymentInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiappsv1beta2.Deployment{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *deploymentInformer) TypedInformer() DeploymentIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.Deployment](f.factory.InformerFor(&apiappsv1beta2.Deployment{}, f.defaultInformer))
 }
 
 func (f *deploymentInformer) Lister() appsv1beta2.DeploymentLister {
 	return appsv1beta2.NewDeploymentLister(f.Informer().GetIndexer())
 }
+
+// ToTypedDeploymentInformer converts an untyped informer into a TypedDeploymentInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Deployment. If that is not the case, calling type-safe methods of the returned
+// TypedDeploymentInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedDeploymentInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedDeploymentInformer(informer DeploymentInformer) TypedDeploymentInformer {
+	if informer, ok := informer.(TypedDeploymentInformer); ok {
+		return informer
+	}
+	return &deploymentTypedInformerAdapter{informer}
+}
+
+type deploymentTypedInformerAdapter struct {
+	DeploymentInformer
+}
+
+func (a *deploymentTypedInformerAdapter) TypedInformer() DeploymentIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.Deployment](a.Informer())
+}
+
+// ToDeploymentIndexInformer converts an untyped informer into a DeploymentIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Deployment. If that is not the case, calling type-safe methods of the returned
+// DeploymentIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a DeploymentIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToDeploymentIndexInformer(informer cache.SharedIndexInformer) DeploymentIndexInformer {
+	if informer, ok := informer.(DeploymentIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.Deployment](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/apps/v1beta2/interface.go b/vendor/k8s.io/client-go/informers/apps/v1beta2/interface.go
index ded89bd5be..b00e797b9a 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1beta2/interface.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1beta2/interface.go
@@ -25,15 +25,15 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// ControllerRevisions returns a ControllerRevisionInformer.
-	ControllerRevisions() ControllerRevisionInformer
+	ControllerRevisions() TypedControllerRevisionInformer
 	// DaemonSets returns a DaemonSetInformer.
-	DaemonSets() DaemonSetInformer
+	DaemonSets() TypedDaemonSetInformer
 	// Deployments returns a DeploymentInformer.
-	Deployments() DeploymentInformer
+	Deployments() TypedDeploymentInformer
 	// ReplicaSets returns a ReplicaSetInformer.
-	ReplicaSets() ReplicaSetInformer
+	ReplicaSets() TypedReplicaSetInformer
 	// StatefulSets returns a StatefulSetInformer.
-	StatefulSets() StatefulSetInformer
+	StatefulSets() TypedStatefulSetInformer
 }
 
 type version struct {
@@ -47,27 +47,27 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// ControllerRevisions returns a ControllerRevisionInformer.
-func (v *version) ControllerRevisions() ControllerRevisionInformer {
+// ControllerRevisions returns a TypedControllerRevisionInformer.
+func (v *version) ControllerRevisions() TypedControllerRevisionInformer {
 	return &controllerRevisionInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// DaemonSets returns a DaemonSetInformer.
-func (v *version) DaemonSets() DaemonSetInformer {
+// DaemonSets returns a TypedDaemonSetInformer.
+func (v *version) DaemonSets() TypedDaemonSetInformer {
 	return &daemonSetInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// Deployments returns a DeploymentInformer.
-func (v *version) Deployments() DeploymentInformer {
+// Deployments returns a TypedDeploymentInformer.
+func (v *version) Deployments() TypedDeploymentInformer {
 	return &deploymentInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// ReplicaSets returns a ReplicaSetInformer.
-func (v *version) ReplicaSets() ReplicaSetInformer {
+// ReplicaSets returns a TypedReplicaSetInformer.
+func (v *version) ReplicaSets() TypedReplicaSetInformer {
 	return &replicaSetInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// StatefulSets returns a StatefulSetInformer.
-func (v *version) StatefulSets() StatefulSetInformer {
+// StatefulSets returns a TypedStatefulSetInformer.
+func (v *version) StatefulSets() TypedStatefulSetInformer {
 	return &statefulSetInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/apps/v1beta2/replicaset.go b/vendor/k8s.io/client-go/informers/apps/v1beta2/replicaset.go
index 425ad55333..3ee75c1621 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1beta2/replicaset.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1beta2/replicaset.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ReplicaSetInformer provides access to a shared informer and lister for
-// ReplicaSets.
+// ReplicaSets. Prefer using the type-safe variant (see [TypedReplicaSetInformer]).
 type ReplicaSetInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() appsv1beta2.ReplicaSetLister
 }
 
+// TypedReplicaSetInformer provides access to a shared informer and lister for
+// ReplicaSets, including the type-safe TypedInformer variant.
+// It is a superset of ReplicaSetInformer.
+type TypedReplicaSetInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ReplicaSetIndexInformer
+	Lister() appsv1beta2.ReplicaSetLister
+}
+
+// ReplicaSetIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ReplicaSetIndexInformer cache.TypedSharedIndexInformer[*apiappsv1beta2.ReplicaSet]
+
+// ReplicaSetHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ReplicaSet.
+type ReplicaSetHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiappsv1beta2.ReplicaSet]
+
+// ReplicaSetDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ReplicaSet.
+type ReplicaSetDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiappsv1beta2.ReplicaSet]
+
+// ReplicaSetFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ReplicaSet.
+type ReplicaSetFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiappsv1beta2.ReplicaSet]
+
+// ReplicaSetIndexers is a specialization of [cache.TypedIndexers] for ReplicaSet.
+type ReplicaSetIndexers = cache.TypedIndexers[*apiappsv1beta2.ReplicaSet]
+
+// DeletedReplicaSet is a specialization of [cache.DeletedObject] for ReplicaSet.
+type DeletedReplicaSet = cache.DeletedObject[*apiappsv1beta2.ReplicaSet]
+
 type replicaSetInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type replicaSetInformer struct {
 // NewReplicaSetInformer constructs a new informer for ReplicaSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedReplicaSetInformer]).
 func NewReplicaSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewReplicaSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedReplicaSetInformer constructs a new informer for ReplicaSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedReplicaSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ReplicaSetIndexers) ReplicaSetIndexInformer {
+	return NewTypedReplicaSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredReplicaSetInformer constructs a new informer for ReplicaSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredReplicaSetInformer]).
 func NewFilteredReplicaSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewReplicaSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedReplicaSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredReplicaSetInformer constructs a new informer for ReplicaSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredReplicaSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ReplicaSetIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ReplicaSetIndexInformer {
+	return NewTypedReplicaSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewReplicaSetInformerWithOptions constructs a new informer for ReplicaSet type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedReplicaSetInformerWithOptions]).
 func NewReplicaSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedReplicaSetInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedReplicaSetInformerWithOptions constructs a new informer for ReplicaSet type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedReplicaSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ReplicaSetIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "apps", Version: "v1beta2", Resource: "replicasets"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.ReplicaSet](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewReplicaSetInformerWithOptions(client kubernetes.Interface, namespace str
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *replicaSetInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewReplicaSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedReplicaSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *replicaSetInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiappsv1beta2.ReplicaSet{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *replicaSetInformer) TypedInformer() ReplicaSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.ReplicaSet](f.factory.InformerFor(&apiappsv1beta2.ReplicaSet{}, f.defaultInformer))
 }
 
 func (f *replicaSetInformer) Lister() appsv1beta2.ReplicaSetLister {
 	return appsv1beta2.NewReplicaSetLister(f.Informer().GetIndexer())
 }
+
+// ToTypedReplicaSetInformer converts an untyped informer into a TypedReplicaSetInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ReplicaSet. If that is not the case, calling type-safe methods of the returned
+// TypedReplicaSetInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedReplicaSetInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedReplicaSetInformer(informer ReplicaSetInformer) TypedReplicaSetInformer {
+	if informer, ok := informer.(TypedReplicaSetInformer); ok {
+		return informer
+	}
+	return &replicaSetTypedInformerAdapter{informer}
+}
+
+type replicaSetTypedInformerAdapter struct {
+	ReplicaSetInformer
+}
+
+func (a *replicaSetTypedInformerAdapter) TypedInformer() ReplicaSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.ReplicaSet](a.Informer())
+}
+
+// ToReplicaSetIndexInformer converts an untyped informer into a ReplicaSetIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ReplicaSet. If that is not the case, calling type-safe methods of the returned
+// ReplicaSetIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ReplicaSetIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToReplicaSetIndexInformer(informer cache.SharedIndexInformer) ReplicaSetIndexInformer {
+	if informer, ok := informer.(ReplicaSetIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.ReplicaSet](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/apps/v1beta2/statefulset.go b/vendor/k8s.io/client-go/informers/apps/v1beta2/statefulset.go
index 0fb22661cf..4b449a9c32 100644
--- a/vendor/k8s.io/client-go/informers/apps/v1beta2/statefulset.go
+++ b/vendor/k8s.io/client-go/informers/apps/v1beta2/statefulset.go
@@ -34,12 +34,40 @@ import (
 )
 
 // StatefulSetInformer provides access to a shared informer and lister for
-// StatefulSets.
+// StatefulSets. Prefer using the type-safe variant (see [TypedStatefulSetInformer]).
 type StatefulSetInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() appsv1beta2.StatefulSetLister
 }
 
+// TypedStatefulSetInformer provides access to a shared informer and lister for
+// StatefulSets, including the type-safe TypedInformer variant.
+// It is a superset of StatefulSetInformer.
+type TypedStatefulSetInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() StatefulSetIndexInformer
+	Lister() appsv1beta2.StatefulSetLister
+}
+
+// StatefulSetIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type StatefulSetIndexInformer cache.TypedSharedIndexInformer[*apiappsv1beta2.StatefulSet]
+
+// StatefulSetHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for StatefulSet.
+type StatefulSetHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiappsv1beta2.StatefulSet]
+
+// StatefulSetDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for StatefulSet.
+type StatefulSetDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiappsv1beta2.StatefulSet]
+
+// StatefulSetFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for StatefulSet.
+type StatefulSetFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiappsv1beta2.StatefulSet]
+
+// StatefulSetIndexers is a specialization of [cache.TypedIndexers] for StatefulSet.
+type StatefulSetIndexers = cache.TypedIndexers[*apiappsv1beta2.StatefulSet]
+
+// DeletedStatefulSet is a specialization of [cache.DeletedObject] for StatefulSet.
+type DeletedStatefulSet = cache.DeletedObject[*apiappsv1beta2.StatefulSet]
+
 type statefulSetInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type statefulSetInformer struct {
 // NewStatefulSetInformer constructs a new informer for StatefulSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStatefulSetInformer]).
 func NewStatefulSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewStatefulSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedStatefulSetInformer constructs a new informer for StatefulSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStatefulSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers StatefulSetIndexers) StatefulSetIndexInformer {
+	return NewTypedStatefulSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredStatefulSetInformer constructs a new informer for StatefulSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredStatefulSetInformer]).
 func NewFilteredStatefulSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewStatefulSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedStatefulSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredStatefulSetInformer constructs a new informer for StatefulSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredStatefulSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers StatefulSetIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) StatefulSetIndexInformer {
+	return NewTypedStatefulSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewStatefulSetInformerWithOptions constructs a new informer for StatefulSet type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStatefulSetInformerWithOptions]).
 func NewStatefulSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedStatefulSetInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedStatefulSetInformerWithOptions constructs a new informer for StatefulSet type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStatefulSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) StatefulSetIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "apps", Version: "v1beta2", Resource: "statefulsets"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.StatefulSet](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewStatefulSetInformerWithOptions(client kubernetes.Interface, namespace st
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *statefulSetInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewStatefulSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedStatefulSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *statefulSetInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiappsv1beta2.StatefulSet{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *statefulSetInformer) TypedInformer() StatefulSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.StatefulSet](f.factory.InformerFor(&apiappsv1beta2.StatefulSet{}, f.defaultInformer))
 }
 
 func (f *statefulSetInformer) Lister() appsv1beta2.StatefulSetLister {
 	return appsv1beta2.NewStatefulSetLister(f.Informer().GetIndexer())
 }
+
+// ToTypedStatefulSetInformer converts an untyped informer into a TypedStatefulSetInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StatefulSet. If that is not the case, calling type-safe methods of the returned
+// TypedStatefulSetInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedStatefulSetInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedStatefulSetInformer(informer StatefulSetInformer) TypedStatefulSetInformer {
+	if informer, ok := informer.(TypedStatefulSetInformer); ok {
+		return informer
+	}
+	return &statefulSetTypedInformerAdapter{informer}
+}
+
+type statefulSetTypedInformerAdapter struct {
+	StatefulSetInformer
+}
+
+func (a *statefulSetTypedInformerAdapter) TypedInformer() StatefulSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.StatefulSet](a.Informer())
+}
+
+// ToStatefulSetIndexInformer converts an untyped informer into a StatefulSetIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StatefulSet. If that is not the case, calling type-safe methods of the returned
+// StatefulSetIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a StatefulSetIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToStatefulSetIndexInformer(informer cache.SharedIndexInformer) StatefulSetIndexInformer {
+	if informer, ok := informer.(StatefulSetIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiappsv1beta2.StatefulSet](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/autoscaling/v1/horizontalpodautoscaler.go b/vendor/k8s.io/client-go/informers/autoscaling/v1/horizontalpodautoscaler.go
index e49b035242..e8b5eb54f7 100644
--- a/vendor/k8s.io/client-go/informers/autoscaling/v1/horizontalpodautoscaler.go
+++ b/vendor/k8s.io/client-go/informers/autoscaling/v1/horizontalpodautoscaler.go
@@ -34,12 +34,40 @@ import (
 )
 
 // HorizontalPodAutoscalerInformer provides access to a shared informer and lister for
-// HorizontalPodAutoscalers.
+// HorizontalPodAutoscalers. Prefer using the type-safe variant (see [TypedHorizontalPodAutoscalerInformer]).
 type HorizontalPodAutoscalerInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() autoscalingv1.HorizontalPodAutoscalerLister
 }
 
+// TypedHorizontalPodAutoscalerInformer provides access to a shared informer and lister for
+// HorizontalPodAutoscalers, including the type-safe TypedInformer variant.
+// It is a superset of HorizontalPodAutoscalerInformer.
+type TypedHorizontalPodAutoscalerInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() HorizontalPodAutoscalerIndexInformer
+	Lister() autoscalingv1.HorizontalPodAutoscalerLister
+}
+
+// HorizontalPodAutoscalerIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type HorizontalPodAutoscalerIndexInformer cache.TypedSharedIndexInformer[*apiautoscalingv1.HorizontalPodAutoscaler]
+
+// HorizontalPodAutoscalerHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for HorizontalPodAutoscaler.
+type HorizontalPodAutoscalerHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiautoscalingv1.HorizontalPodAutoscaler]
+
+// HorizontalPodAutoscalerDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for HorizontalPodAutoscaler.
+type HorizontalPodAutoscalerDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiautoscalingv1.HorizontalPodAutoscaler]
+
+// HorizontalPodAutoscalerFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for HorizontalPodAutoscaler.
+type HorizontalPodAutoscalerFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiautoscalingv1.HorizontalPodAutoscaler]
+
+// HorizontalPodAutoscalerIndexers is a specialization of [cache.TypedIndexers] for HorizontalPodAutoscaler.
+type HorizontalPodAutoscalerIndexers = cache.TypedIndexers[*apiautoscalingv1.HorizontalPodAutoscaler]
+
+// DeletedHorizontalPodAutoscaler is a specialization of [cache.DeletedObject] for HorizontalPodAutoscaler.
+type DeletedHorizontalPodAutoscaler = cache.DeletedObject[*apiautoscalingv1.HorizontalPodAutoscaler]
+
 type horizontalPodAutoscalerInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type horizontalPodAutoscalerInformer struct {
 // NewHorizontalPodAutoscalerInformer constructs a new informer for HorizontalPodAutoscaler type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedHorizontalPodAutoscalerInformer]).
 func NewHorizontalPodAutoscalerInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewHorizontalPodAutoscalerInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedHorizontalPodAutoscalerInformer constructs a new informer for HorizontalPodAutoscaler type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedHorizontalPodAutoscalerInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers HorizontalPodAutoscalerIndexers) HorizontalPodAutoscalerIndexInformer {
+	return NewTypedHorizontalPodAutoscalerInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredHorizontalPodAutoscalerInformer constructs a new informer for HorizontalPodAutoscaler type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredHorizontalPodAutoscalerInformer]).
 func NewFilteredHorizontalPodAutoscalerInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewHorizontalPodAutoscalerInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedHorizontalPodAutoscalerInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredHorizontalPodAutoscalerInformer constructs a new informer for HorizontalPodAutoscaler type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredHorizontalPodAutoscalerInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers HorizontalPodAutoscalerIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) HorizontalPodAutoscalerIndexInformer {
+	return NewTypedHorizontalPodAutoscalerInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewHorizontalPodAutoscalerInformerWithOptions constructs a new informer for HorizontalPodAutoscaler type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedHorizontalPodAutoscalerInformerWithOptions]).
 func NewHorizontalPodAutoscalerInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedHorizontalPodAutoscalerInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedHorizontalPodAutoscalerInformerWithOptions constructs a new informer for HorizontalPodAutoscaler type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedHorizontalPodAutoscalerInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) HorizontalPodAutoscalerIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "autoscaling", Version: "v1", Resource: "horizontalpodautoscalers"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiautoscalingv1.HorizontalPodAutoscaler](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewHorizontalPodAutoscalerInformerWithOptions(client kubernetes.Interface,
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *horizontalPodAutoscalerInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewHorizontalPodAutoscalerInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedHorizontalPodAutoscalerInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *horizontalPodAutoscalerInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiautoscalingv1.HorizontalPodAutoscaler{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *horizontalPodAutoscalerInformer) TypedInformer() HorizontalPodAutoscalerIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiautoscalingv1.HorizontalPodAutoscaler](f.factory.InformerFor(&apiautoscalingv1.HorizontalPodAutoscaler{}, f.defaultInformer))
 }
 
 func (f *horizontalPodAutoscalerInformer) Lister() autoscalingv1.HorizontalPodAutoscalerLister {
 	return autoscalingv1.NewHorizontalPodAutoscalerLister(f.Informer().GetIndexer())
 }
+
+// ToTypedHorizontalPodAutoscalerInformer converts an untyped informer into a TypedHorizontalPodAutoscalerInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *HorizontalPodAutoscaler. If that is not the case, calling type-safe methods of the returned
+// TypedHorizontalPodAutoscalerInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedHorizontalPodAutoscalerInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedHorizontalPodAutoscalerInformer(informer HorizontalPodAutoscalerInformer) TypedHorizontalPodAutoscalerInformer {
+	if informer, ok := informer.(TypedHorizontalPodAutoscalerInformer); ok {
+		return informer
+	}
+	return &horizontalPodAutoscalerTypedInformerAdapter{informer}
+}
+
+type horizontalPodAutoscalerTypedInformerAdapter struct {
+	HorizontalPodAutoscalerInformer
+}
+
+func (a *horizontalPodAutoscalerTypedInformerAdapter) TypedInformer() HorizontalPodAutoscalerIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiautoscalingv1.HorizontalPodAutoscaler](a.Informer())
+}
+
+// ToHorizontalPodAutoscalerIndexInformer converts an untyped informer into a HorizontalPodAutoscalerIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *HorizontalPodAutoscaler. If that is not the case, calling type-safe methods of the returned
+// HorizontalPodAutoscalerIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a HorizontalPodAutoscalerIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToHorizontalPodAutoscalerIndexInformer(informer cache.SharedIndexInformer) HorizontalPodAutoscalerIndexInformer {
+	if informer, ok := informer.(HorizontalPodAutoscalerIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiautoscalingv1.HorizontalPodAutoscaler](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/autoscaling/v1/interface.go b/vendor/k8s.io/client-go/informers/autoscaling/v1/interface.go
index 601d0f77f1..730ca89c2a 100644
--- a/vendor/k8s.io/client-go/informers/autoscaling/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/autoscaling/v1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerInformer.
-	HorizontalPodAutoscalers() HorizontalPodAutoscalerInformer
+	HorizontalPodAutoscalers() TypedHorizontalPodAutoscalerInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerInformer.
-func (v *version) HorizontalPodAutoscalers() HorizontalPodAutoscalerInformer {
+// HorizontalPodAutoscalers returns a TypedHorizontalPodAutoscalerInformer.
+func (v *version) HorizontalPodAutoscalers() TypedHorizontalPodAutoscalerInformer {
 	return &horizontalPodAutoscalerInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/autoscaling/v2/horizontalpodautoscaler.go b/vendor/k8s.io/client-go/informers/autoscaling/v2/horizontalpodautoscaler.go
index 3605718d08..dbdac3f6d4 100644
--- a/vendor/k8s.io/client-go/informers/autoscaling/v2/horizontalpodautoscaler.go
+++ b/vendor/k8s.io/client-go/informers/autoscaling/v2/horizontalpodautoscaler.go
@@ -34,12 +34,40 @@ import (
 )
 
 // HorizontalPodAutoscalerInformer provides access to a shared informer and lister for
-// HorizontalPodAutoscalers.
+// HorizontalPodAutoscalers. Prefer using the type-safe variant (see [TypedHorizontalPodAutoscalerInformer]).
 type HorizontalPodAutoscalerInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() autoscalingv2.HorizontalPodAutoscalerLister
 }
 
+// TypedHorizontalPodAutoscalerInformer provides access to a shared informer and lister for
+// HorizontalPodAutoscalers, including the type-safe TypedInformer variant.
+// It is a superset of HorizontalPodAutoscalerInformer.
+type TypedHorizontalPodAutoscalerInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() HorizontalPodAutoscalerIndexInformer
+	Lister() autoscalingv2.HorizontalPodAutoscalerLister
+}
+
+// HorizontalPodAutoscalerIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type HorizontalPodAutoscalerIndexInformer cache.TypedSharedIndexInformer[*apiautoscalingv2.HorizontalPodAutoscaler]
+
+// HorizontalPodAutoscalerHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for HorizontalPodAutoscaler.
+type HorizontalPodAutoscalerHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiautoscalingv2.HorizontalPodAutoscaler]
+
+// HorizontalPodAutoscalerDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for HorizontalPodAutoscaler.
+type HorizontalPodAutoscalerDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiautoscalingv2.HorizontalPodAutoscaler]
+
+// HorizontalPodAutoscalerFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for HorizontalPodAutoscaler.
+type HorizontalPodAutoscalerFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiautoscalingv2.HorizontalPodAutoscaler]
+
+// HorizontalPodAutoscalerIndexers is a specialization of [cache.TypedIndexers] for HorizontalPodAutoscaler.
+type HorizontalPodAutoscalerIndexers = cache.TypedIndexers[*apiautoscalingv2.HorizontalPodAutoscaler]
+
+// DeletedHorizontalPodAutoscaler is a specialization of [cache.DeletedObject] for HorizontalPodAutoscaler.
+type DeletedHorizontalPodAutoscaler = cache.DeletedObject[*apiautoscalingv2.HorizontalPodAutoscaler]
+
 type horizontalPodAutoscalerInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type horizontalPodAutoscalerInformer struct {
 // NewHorizontalPodAutoscalerInformer constructs a new informer for HorizontalPodAutoscaler type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedHorizontalPodAutoscalerInformer]).
 func NewHorizontalPodAutoscalerInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewHorizontalPodAutoscalerInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedHorizontalPodAutoscalerInformer constructs a new informer for HorizontalPodAutoscaler type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedHorizontalPodAutoscalerInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers HorizontalPodAutoscalerIndexers) HorizontalPodAutoscalerIndexInformer {
+	return NewTypedHorizontalPodAutoscalerInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredHorizontalPodAutoscalerInformer constructs a new informer for HorizontalPodAutoscaler type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredHorizontalPodAutoscalerInformer]).
 func NewFilteredHorizontalPodAutoscalerInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewHorizontalPodAutoscalerInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedHorizontalPodAutoscalerInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredHorizontalPodAutoscalerInformer constructs a new informer for HorizontalPodAutoscaler type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredHorizontalPodAutoscalerInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers HorizontalPodAutoscalerIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) HorizontalPodAutoscalerIndexInformer {
+	return NewTypedHorizontalPodAutoscalerInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewHorizontalPodAutoscalerInformerWithOptions constructs a new informer for HorizontalPodAutoscaler type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedHorizontalPodAutoscalerInformerWithOptions]).
 func NewHorizontalPodAutoscalerInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedHorizontalPodAutoscalerInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedHorizontalPodAutoscalerInformerWithOptions constructs a new informer for HorizontalPodAutoscaler type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedHorizontalPodAutoscalerInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) HorizontalPodAutoscalerIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "autoscaling", Version: "v2", Resource: "horizontalpodautoscalers"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiautoscalingv2.HorizontalPodAutoscaler](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewHorizontalPodAutoscalerInformerWithOptions(client kubernetes.Interface,
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *horizontalPodAutoscalerInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewHorizontalPodAutoscalerInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedHorizontalPodAutoscalerInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *horizontalPodAutoscalerInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiautoscalingv2.HorizontalPodAutoscaler{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *horizontalPodAutoscalerInformer) TypedInformer() HorizontalPodAutoscalerIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiautoscalingv2.HorizontalPodAutoscaler](f.factory.InformerFor(&apiautoscalingv2.HorizontalPodAutoscaler{}, f.defaultInformer))
 }
 
 func (f *horizontalPodAutoscalerInformer) Lister() autoscalingv2.HorizontalPodAutoscalerLister {
 	return autoscalingv2.NewHorizontalPodAutoscalerLister(f.Informer().GetIndexer())
 }
+
+// ToTypedHorizontalPodAutoscalerInformer converts an untyped informer into a TypedHorizontalPodAutoscalerInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *HorizontalPodAutoscaler. If that is not the case, calling type-safe methods of the returned
+// TypedHorizontalPodAutoscalerInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedHorizontalPodAutoscalerInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedHorizontalPodAutoscalerInformer(informer HorizontalPodAutoscalerInformer) TypedHorizontalPodAutoscalerInformer {
+	if informer, ok := informer.(TypedHorizontalPodAutoscalerInformer); ok {
+		return informer
+	}
+	return &horizontalPodAutoscalerTypedInformerAdapter{informer}
+}
+
+type horizontalPodAutoscalerTypedInformerAdapter struct {
+	HorizontalPodAutoscalerInformer
+}
+
+func (a *horizontalPodAutoscalerTypedInformerAdapter) TypedInformer() HorizontalPodAutoscalerIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiautoscalingv2.HorizontalPodAutoscaler](a.Informer())
+}
+
+// ToHorizontalPodAutoscalerIndexInformer converts an untyped informer into a HorizontalPodAutoscalerIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *HorizontalPodAutoscaler. If that is not the case, calling type-safe methods of the returned
+// HorizontalPodAutoscalerIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a HorizontalPodAutoscalerIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToHorizontalPodAutoscalerIndexInformer(informer cache.SharedIndexInformer) HorizontalPodAutoscalerIndexInformer {
+	if informer, ok := informer.(HorizontalPodAutoscalerIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiautoscalingv2.HorizontalPodAutoscaler](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/autoscaling/v2/interface.go b/vendor/k8s.io/client-go/informers/autoscaling/v2/interface.go
index 2c71908e40..e8b2d14934 100644
--- a/vendor/k8s.io/client-go/informers/autoscaling/v2/interface.go
+++ b/vendor/k8s.io/client-go/informers/autoscaling/v2/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerInformer.
-	HorizontalPodAutoscalers() HorizontalPodAutoscalerInformer
+	HorizontalPodAutoscalers() TypedHorizontalPodAutoscalerInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerInformer.
-func (v *version) HorizontalPodAutoscalers() HorizontalPodAutoscalerInformer {
+// HorizontalPodAutoscalers returns a TypedHorizontalPodAutoscalerInformer.
+func (v *version) HorizontalPodAutoscalers() TypedHorizontalPodAutoscalerInformer {
 	return &horizontalPodAutoscalerInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/batch/v1/cronjob.go b/vendor/k8s.io/client-go/informers/batch/v1/cronjob.go
index 022710011b..bbd8ebf642 100644
--- a/vendor/k8s.io/client-go/informers/batch/v1/cronjob.go
+++ b/vendor/k8s.io/client-go/informers/batch/v1/cronjob.go
@@ -34,12 +34,40 @@ import (
 )
 
 // CronJobInformer provides access to a shared informer and lister for
-// CronJobs.
+// CronJobs. Prefer using the type-safe variant (see [TypedCronJobInformer]).
 type CronJobInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() batchv1.CronJobLister
 }
 
+// TypedCronJobInformer provides access to a shared informer and lister for
+// CronJobs, including the type-safe TypedInformer variant.
+// It is a superset of CronJobInformer.
+type TypedCronJobInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() CronJobIndexInformer
+	Lister() batchv1.CronJobLister
+}
+
+// CronJobIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type CronJobIndexInformer cache.TypedSharedIndexInformer[*apibatchv1.CronJob]
+
+// CronJobHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for CronJob.
+type CronJobHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apibatchv1.CronJob]
+
+// CronJobDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for CronJob.
+type CronJobDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apibatchv1.CronJob]
+
+// CronJobFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for CronJob.
+type CronJobFilteringHandler = cache.TypedFilteringResourceEventHandler[*apibatchv1.CronJob]
+
+// CronJobIndexers is a specialization of [cache.TypedIndexers] for CronJob.
+type CronJobIndexers = cache.TypedIndexers[*apibatchv1.CronJob]
+
+// DeletedCronJob is a specialization of [cache.DeletedObject] for CronJob.
+type DeletedCronJob = cache.DeletedObject[*apibatchv1.CronJob]
+
 type cronJobInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type cronJobInformer struct {
 // NewCronJobInformer constructs a new informer for CronJob type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCronJobInformer]).
 func NewCronJobInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewCronJobInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedCronJobInformer constructs a new informer for CronJob type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCronJobInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers CronJobIndexers) CronJobIndexInformer {
+	return NewTypedCronJobInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredCronJobInformer constructs a new informer for CronJob type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredCronJobInformer]).
 func NewFilteredCronJobInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewCronJobInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedCronJobInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredCronJobInformer constructs a new informer for CronJob type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredCronJobInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers CronJobIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) CronJobIndexInformer {
+	return NewTypedCronJobInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewCronJobInformerWithOptions constructs a new informer for CronJob type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCronJobInformerWithOptions]).
 func NewCronJobInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedCronJobInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedCronJobInformerWithOptions constructs a new informer for CronJob type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCronJobInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) CronJobIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "batch", Version: "v1", Resource: "cronjobs"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apibatchv1.CronJob](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewCronJobInformerWithOptions(client kubernetes.Interface, namespace string
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *cronJobInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewCronJobInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedCronJobInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *cronJobInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apibatchv1.CronJob{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *cronJobInformer) TypedInformer() CronJobIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apibatchv1.CronJob](f.factory.InformerFor(&apibatchv1.CronJob{}, f.defaultInformer))
 }
 
 func (f *cronJobInformer) Lister() batchv1.CronJobLister {
 	return batchv1.NewCronJobLister(f.Informer().GetIndexer())
 }
+
+// ToTypedCronJobInformer converts an untyped informer into a TypedCronJobInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CronJob. If that is not the case, calling type-safe methods of the returned
+// TypedCronJobInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedCronJobInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedCronJobInformer(informer CronJobInformer) TypedCronJobInformer {
+	if informer, ok := informer.(TypedCronJobInformer); ok {
+		return informer
+	}
+	return &cronJobTypedInformerAdapter{informer}
+}
+
+type cronJobTypedInformerAdapter struct {
+	CronJobInformer
+}
+
+func (a *cronJobTypedInformerAdapter) TypedInformer() CronJobIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apibatchv1.CronJob](a.Informer())
+}
+
+// ToCronJobIndexInformer converts an untyped informer into a CronJobIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CronJob. If that is not the case, calling type-safe methods of the returned
+// CronJobIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a CronJobIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToCronJobIndexInformer(informer cache.SharedIndexInformer) CronJobIndexInformer {
+	if informer, ok := informer.(CronJobIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apibatchv1.CronJob](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/batch/v1/interface.go b/vendor/k8s.io/client-go/informers/batch/v1/interface.go
index 84567fb592..4308f08cb2 100644
--- a/vendor/k8s.io/client-go/informers/batch/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/batch/v1/interface.go
@@ -25,9 +25,9 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// CronJobs returns a CronJobInformer.
-	CronJobs() CronJobInformer
+	CronJobs() TypedCronJobInformer
 	// Jobs returns a JobInformer.
-	Jobs() JobInformer
+	Jobs() TypedJobInformer
 }
 
 type version struct {
@@ -41,12 +41,12 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// CronJobs returns a CronJobInformer.
-func (v *version) CronJobs() CronJobInformer {
+// CronJobs returns a TypedCronJobInformer.
+func (v *version) CronJobs() TypedCronJobInformer {
 	return &cronJobInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// Jobs returns a JobInformer.
-func (v *version) Jobs() JobInformer {
+// Jobs returns a TypedJobInformer.
+func (v *version) Jobs() TypedJobInformer {
 	return &jobInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/batch/v1/job.go b/vendor/k8s.io/client-go/informers/batch/v1/job.go
index 97e88927bf..31d9244c1a 100644
--- a/vendor/k8s.io/client-go/informers/batch/v1/job.go
+++ b/vendor/k8s.io/client-go/informers/batch/v1/job.go
@@ -34,12 +34,40 @@ import (
 )
 
 // JobInformer provides access to a shared informer and lister for
-// Jobs.
+// Jobs. Prefer using the type-safe variant (see [TypedJobInformer]).
 type JobInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() batchv1.JobLister
 }
 
+// TypedJobInformer provides access to a shared informer and lister for
+// Jobs, including the type-safe TypedInformer variant.
+// It is a superset of JobInformer.
+type TypedJobInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() JobIndexInformer
+	Lister() batchv1.JobLister
+}
+
+// JobIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type JobIndexInformer cache.TypedSharedIndexInformer[*apibatchv1.Job]
+
+// JobHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Job.
+type JobHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apibatchv1.Job]
+
+// JobDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Job.
+type JobDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apibatchv1.Job]
+
+// JobFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Job.
+type JobFilteringHandler = cache.TypedFilteringResourceEventHandler[*apibatchv1.Job]
+
+// JobIndexers is a specialization of [cache.TypedIndexers] for Job.
+type JobIndexers = cache.TypedIndexers[*apibatchv1.Job]
+
+// DeletedJob is a specialization of [cache.DeletedObject] for Job.
+type DeletedJob = cache.DeletedObject[*apibatchv1.Job]
+
 type jobInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type jobInformer struct {
 // NewJobInformer constructs a new informer for Job type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedJobInformer]).
 func NewJobInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewJobInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedJobInformer constructs a new informer for Job type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedJobInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers JobIndexers) JobIndexInformer {
+	return NewTypedJobInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredJobInformer constructs a new informer for Job type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredJobInformer]).
 func NewFilteredJobInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewJobInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedJobInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredJobInformer constructs a new informer for Job type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredJobInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers JobIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) JobIndexInformer {
+	return NewTypedJobInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewJobInformerWithOptions constructs a new informer for Job type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedJobInformerWithOptions]).
 func NewJobInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedJobInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedJobInformerWithOptions constructs a new informer for Job type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedJobInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) JobIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "batch", Version: "v1", Resource: "jobs"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apibatchv1.Job](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewJobInformerWithOptions(client kubernetes.Interface, namespace string, op
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *jobInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewJobInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedJobInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *jobInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apibatchv1.Job{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *jobInformer) TypedInformer() JobIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apibatchv1.Job](f.factory.InformerFor(&apibatchv1.Job{}, f.defaultInformer))
 }
 
 func (f *jobInformer) Lister() batchv1.JobLister {
 	return batchv1.NewJobLister(f.Informer().GetIndexer())
 }
+
+// ToTypedJobInformer converts an untyped informer into a TypedJobInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Job. If that is not the case, calling type-safe methods of the returned
+// TypedJobInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedJobInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedJobInformer(informer JobInformer) TypedJobInformer {
+	if informer, ok := informer.(TypedJobInformer); ok {
+		return informer
+	}
+	return &jobTypedInformerAdapter{informer}
+}
+
+type jobTypedInformerAdapter struct {
+	JobInformer
+}
+
+func (a *jobTypedInformerAdapter) TypedInformer() JobIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apibatchv1.Job](a.Informer())
+}
+
+// ToJobIndexInformer converts an untyped informer into a JobIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Job. If that is not the case, calling type-safe methods of the returned
+// JobIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a JobIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToJobIndexInformer(informer cache.SharedIndexInformer) JobIndexInformer {
+	if informer, ok := informer.(JobIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apibatchv1.Job](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/batch/v1beta1/cronjob.go b/vendor/k8s.io/client-go/informers/batch/v1beta1/cronjob.go
index 5d2129323b..9043856ab0 100644
--- a/vendor/k8s.io/client-go/informers/batch/v1beta1/cronjob.go
+++ b/vendor/k8s.io/client-go/informers/batch/v1beta1/cronjob.go
@@ -34,12 +34,40 @@ import (
 )
 
 // CronJobInformer provides access to a shared informer and lister for
-// CronJobs.
+// CronJobs. Prefer using the type-safe variant (see [TypedCronJobInformer]).
 type CronJobInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() batchv1beta1.CronJobLister
 }
 
+// TypedCronJobInformer provides access to a shared informer and lister for
+// CronJobs, including the type-safe TypedInformer variant.
+// It is a superset of CronJobInformer.
+type TypedCronJobInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() CronJobIndexInformer
+	Lister() batchv1beta1.CronJobLister
+}
+
+// CronJobIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type CronJobIndexInformer cache.TypedSharedIndexInformer[*apibatchv1beta1.CronJob]
+
+// CronJobHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for CronJob.
+type CronJobHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apibatchv1beta1.CronJob]
+
+// CronJobDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for CronJob.
+type CronJobDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apibatchv1beta1.CronJob]
+
+// CronJobFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for CronJob.
+type CronJobFilteringHandler = cache.TypedFilteringResourceEventHandler[*apibatchv1beta1.CronJob]
+
+// CronJobIndexers is a specialization of [cache.TypedIndexers] for CronJob.
+type CronJobIndexers = cache.TypedIndexers[*apibatchv1beta1.CronJob]
+
+// DeletedCronJob is a specialization of [cache.DeletedObject] for CronJob.
+type DeletedCronJob = cache.DeletedObject[*apibatchv1beta1.CronJob]
+
 type cronJobInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type cronJobInformer struct {
 // NewCronJobInformer constructs a new informer for CronJob type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCronJobInformer]).
 func NewCronJobInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewCronJobInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedCronJobInformer constructs a new informer for CronJob type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCronJobInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers CronJobIndexers) CronJobIndexInformer {
+	return NewTypedCronJobInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredCronJobInformer constructs a new informer for CronJob type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredCronJobInformer]).
 func NewFilteredCronJobInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewCronJobInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedCronJobInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredCronJobInformer constructs a new informer for CronJob type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredCronJobInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers CronJobIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) CronJobIndexInformer {
+	return NewTypedCronJobInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewCronJobInformerWithOptions constructs a new informer for CronJob type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCronJobInformerWithOptions]).
 func NewCronJobInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedCronJobInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedCronJobInformerWithOptions constructs a new informer for CronJob type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCronJobInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) CronJobIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "batch", Version: "v1beta1", Resource: "cronjobs"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apibatchv1beta1.CronJob](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewCronJobInformerWithOptions(client kubernetes.Interface, namespace string
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *cronJobInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewCronJobInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedCronJobInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *cronJobInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apibatchv1beta1.CronJob{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *cronJobInformer) TypedInformer() CronJobIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apibatchv1beta1.CronJob](f.factory.InformerFor(&apibatchv1beta1.CronJob{}, f.defaultInformer))
 }
 
 func (f *cronJobInformer) Lister() batchv1beta1.CronJobLister {
 	return batchv1beta1.NewCronJobLister(f.Informer().GetIndexer())
 }
+
+// ToTypedCronJobInformer converts an untyped informer into a TypedCronJobInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CronJob. If that is not the case, calling type-safe methods of the returned
+// TypedCronJobInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedCronJobInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedCronJobInformer(informer CronJobInformer) TypedCronJobInformer {
+	if informer, ok := informer.(TypedCronJobInformer); ok {
+		return informer
+	}
+	return &cronJobTypedInformerAdapter{informer}
+}
+
+type cronJobTypedInformerAdapter struct {
+	CronJobInformer
+}
+
+func (a *cronJobTypedInformerAdapter) TypedInformer() CronJobIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apibatchv1beta1.CronJob](a.Informer())
+}
+
+// ToCronJobIndexInformer converts an untyped informer into a CronJobIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CronJob. If that is not the case, calling type-safe methods of the returned
+// CronJobIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a CronJobIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToCronJobIndexInformer(informer cache.SharedIndexInformer) CronJobIndexInformer {
+	if informer, ok := informer.(CronJobIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apibatchv1beta1.CronJob](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/batch/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/batch/v1beta1/interface.go
index 76cae22d68..bfe75d8a1c 100644
--- a/vendor/k8s.io/client-go/informers/batch/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/batch/v1beta1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// CronJobs returns a CronJobInformer.
-	CronJobs() CronJobInformer
+	CronJobs() TypedCronJobInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// CronJobs returns a CronJobInformer.
-func (v *version) CronJobs() CronJobInformer {
+// CronJobs returns a TypedCronJobInformer.
+func (v *version) CronJobs() TypedCronJobInformer {
 	return &cronJobInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/certificates/v1/certificatesigningrequest.go b/vendor/k8s.io/client-go/informers/certificates/v1/certificatesigningrequest.go
index 0e0706893c..4aa2b549e5 100644
--- a/vendor/k8s.io/client-go/informers/certificates/v1/certificatesigningrequest.go
+++ b/vendor/k8s.io/client-go/informers/certificates/v1/certificatesigningrequest.go
@@ -34,12 +34,40 @@ import (
 )
 
 // CertificateSigningRequestInformer provides access to a shared informer and lister for
-// CertificateSigningRequests.
+// CertificateSigningRequests. Prefer using the type-safe variant (see [TypedCertificateSigningRequestInformer]).
 type CertificateSigningRequestInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() certificatesv1.CertificateSigningRequestLister
 }
 
+// TypedCertificateSigningRequestInformer provides access to a shared informer and lister for
+// CertificateSigningRequests, including the type-safe TypedInformer variant.
+// It is a superset of CertificateSigningRequestInformer.
+type TypedCertificateSigningRequestInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() CertificateSigningRequestIndexInformer
+	Lister() certificatesv1.CertificateSigningRequestLister
+}
+
+// CertificateSigningRequestIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type CertificateSigningRequestIndexInformer cache.TypedSharedIndexInformer[*apicertificatesv1.CertificateSigningRequest]
+
+// CertificateSigningRequestHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for CertificateSigningRequest.
+type CertificateSigningRequestHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicertificatesv1.CertificateSigningRequest]
+
+// CertificateSigningRequestDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for CertificateSigningRequest.
+type CertificateSigningRequestDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicertificatesv1.CertificateSigningRequest]
+
+// CertificateSigningRequestFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for CertificateSigningRequest.
+type CertificateSigningRequestFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicertificatesv1.CertificateSigningRequest]
+
+// CertificateSigningRequestIndexers is a specialization of [cache.TypedIndexers] for CertificateSigningRequest.
+type CertificateSigningRequestIndexers = cache.TypedIndexers[*apicertificatesv1.CertificateSigningRequest]
+
+// DeletedCertificateSigningRequest is a specialization of [cache.DeletedObject] for CertificateSigningRequest.
+type DeletedCertificateSigningRequest = cache.DeletedObject[*apicertificatesv1.CertificateSigningRequest]
+
 type certificateSigningRequestInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type certificateSigningRequestInformer struct {
 // NewCertificateSigningRequestInformer constructs a new informer for CertificateSigningRequest type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCertificateSigningRequestInformer]).
 func NewCertificateSigningRequestInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewCertificateSigningRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedCertificateSigningRequestInformer constructs a new informer for CertificateSigningRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCertificateSigningRequestInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers CertificateSigningRequestIndexers) CertificateSigningRequestIndexInformer {
+	return NewTypedCertificateSigningRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredCertificateSigningRequestInformer constructs a new informer for CertificateSigningRequest type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredCertificateSigningRequestInformer]).
 func NewFilteredCertificateSigningRequestInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewCertificateSigningRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedCertificateSigningRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredCertificateSigningRequestInformer constructs a new informer for CertificateSigningRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredCertificateSigningRequestInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers CertificateSigningRequestIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) CertificateSigningRequestIndexInformer {
+	return NewTypedCertificateSigningRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewCertificateSigningRequestInformerWithOptions constructs a new informer for CertificateSigningRequest type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCertificateSigningRequestInformerWithOptions]).
 func NewCertificateSigningRequestInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedCertificateSigningRequestInformerWithOptions(client, options)
+}
+
+// NewTypedCertificateSigningRequestInformerWithOptions constructs a new informer for CertificateSigningRequest type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCertificateSigningRequestInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) CertificateSigningRequestIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "certificates.k8s.io", Version: "v1", Resource: "certificatesigningrequests"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1.CertificateSigningRequest](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewCertificateSigningRequestInformerWithOptions(client kubernetes.Interface
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *certificateSigningRequestInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewCertificateSigningRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedCertificateSigningRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *certificateSigningRequestInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicertificatesv1.CertificateSigningRequest{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *certificateSigningRequestInformer) TypedInformer() CertificateSigningRequestIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1.CertificateSigningRequest](f.factory.InformerFor(&apicertificatesv1.CertificateSigningRequest{}, f.defaultInformer))
 }
 
 func (f *certificateSigningRequestInformer) Lister() certificatesv1.CertificateSigningRequestLister {
 	return certificatesv1.NewCertificateSigningRequestLister(f.Informer().GetIndexer())
 }
+
+// ToTypedCertificateSigningRequestInformer converts an untyped informer into a TypedCertificateSigningRequestInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CertificateSigningRequest. If that is not the case, calling type-safe methods of the returned
+// TypedCertificateSigningRequestInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedCertificateSigningRequestInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedCertificateSigningRequestInformer(informer CertificateSigningRequestInformer) TypedCertificateSigningRequestInformer {
+	if informer, ok := informer.(TypedCertificateSigningRequestInformer); ok {
+		return informer
+	}
+	return &certificateSigningRequestTypedInformerAdapter{informer}
+}
+
+type certificateSigningRequestTypedInformerAdapter struct {
+	CertificateSigningRequestInformer
+}
+
+func (a *certificateSigningRequestTypedInformerAdapter) TypedInformer() CertificateSigningRequestIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1.CertificateSigningRequest](a.Informer())
+}
+
+// ToCertificateSigningRequestIndexInformer converts an untyped informer into a CertificateSigningRequestIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CertificateSigningRequest. If that is not the case, calling type-safe methods of the returned
+// CertificateSigningRequestIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a CertificateSigningRequestIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToCertificateSigningRequestIndexInformer(informer cache.SharedIndexInformer) CertificateSigningRequestIndexInformer {
+	if informer, ok := informer.(CertificateSigningRequestIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1.CertificateSigningRequest](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/certificates/v1/clustertrustbundle.go b/vendor/k8s.io/client-go/informers/certificates/v1/clustertrustbundle.go
new file mode 100644
index 0000000000..e24a1aed5d
--- /dev/null
+++ b/vendor/k8s.io/client-go/informers/certificates/v1/clustertrustbundle.go
@@ -0,0 +1,207 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	apicertificatesv1 "k8s.io/api/certificates/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+	kubernetes "k8s.io/client-go/kubernetes"
+	certificatesv1 "k8s.io/client-go/listers/certificates/v1"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// ClusterTrustBundleInformer provides access to a shared informer and lister for
+// ClusterTrustBundles. Prefer using the type-safe variant (see [TypedClusterTrustBundleInformer]).
+type ClusterTrustBundleInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() certificatesv1.ClusterTrustBundleLister
+}
+
+// TypedClusterTrustBundleInformer provides access to a shared informer and lister for
+// ClusterTrustBundles, including the type-safe TypedInformer variant.
+// It is a superset of ClusterTrustBundleInformer.
+type TypedClusterTrustBundleInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ClusterTrustBundleIndexInformer
+	Lister() certificatesv1.ClusterTrustBundleLister
+}
+
+// ClusterTrustBundleIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ClusterTrustBundleIndexInformer cache.TypedSharedIndexInformer[*apicertificatesv1.ClusterTrustBundle]
+
+// ClusterTrustBundleHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ClusterTrustBundle.
+type ClusterTrustBundleHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicertificatesv1.ClusterTrustBundle]
+
+// ClusterTrustBundleDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ClusterTrustBundle.
+type ClusterTrustBundleDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicertificatesv1.ClusterTrustBundle]
+
+// ClusterTrustBundleFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ClusterTrustBundle.
+type ClusterTrustBundleFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicertificatesv1.ClusterTrustBundle]
+
+// ClusterTrustBundleIndexers is a specialization of [cache.TypedIndexers] for ClusterTrustBundle.
+type ClusterTrustBundleIndexers = cache.TypedIndexers[*apicertificatesv1.ClusterTrustBundle]
+
+// DeletedClusterTrustBundle is a specialization of [cache.DeletedObject] for ClusterTrustBundle.
+type DeletedClusterTrustBundle = cache.DeletedObject[*apicertificatesv1.ClusterTrustBundle]
+
+type clusterTrustBundleInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// NewClusterTrustBundleInformer constructs a new informer for ClusterTrustBundle type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterTrustBundleInformer]).
+func NewClusterTrustBundleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedClusterTrustBundleInformer constructs a new informer for ClusterTrustBundle type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterTrustBundleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterTrustBundleIndexers) ClusterTrustBundleIndexInformer {
+	return NewTypedClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredClusterTrustBundleInformer constructs a new informer for ClusterTrustBundle type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredClusterTrustBundleInformer]).
+func NewFilteredClusterTrustBundleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredClusterTrustBundleInformer constructs a new informer for ClusterTrustBundle type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredClusterTrustBundleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterTrustBundleIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterTrustBundleIndexInformer {
+	return NewTypedClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewClusterTrustBundleInformerWithOptions constructs a new informer for ClusterTrustBundle type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterTrustBundleInformerWithOptions]).
+func NewClusterTrustBundleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedClusterTrustBundleInformerWithOptions(client, options)
+}
+
+// NewTypedClusterTrustBundleInformerWithOptions constructs a new informer for ClusterTrustBundle type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterTrustBundleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ClusterTrustBundleIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "certificates.k8s.io", Version: "v1", Resource: "clustertrustbundles"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1.ClusterTrustBundle](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.CertificatesV1().ClusterTrustBundles().List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.CertificatesV1().ClusterTrustBundles().Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.CertificatesV1().ClusterTrustBundles().List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.CertificatesV1().ClusterTrustBundles().Watch(ctx, opts)
+			},
+		}, client),
+		&apicertificatesv1.ClusterTrustBundle{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *clusterTrustBundleInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *clusterTrustBundleInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *clusterTrustBundleInformer) TypedInformer() ClusterTrustBundleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1.ClusterTrustBundle](f.factory.InformerFor(&apicertificatesv1.ClusterTrustBundle{}, f.defaultInformer))
+}
+
+func (f *clusterTrustBundleInformer) Lister() certificatesv1.ClusterTrustBundleLister {
+	return certificatesv1.NewClusterTrustBundleLister(f.Informer().GetIndexer())
+}
+
+// ToTypedClusterTrustBundleInformer converts an untyped informer into a TypedClusterTrustBundleInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterTrustBundle. If that is not the case, calling type-safe methods of the returned
+// TypedClusterTrustBundleInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedClusterTrustBundleInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedClusterTrustBundleInformer(informer ClusterTrustBundleInformer) TypedClusterTrustBundleInformer {
+	if informer, ok := informer.(TypedClusterTrustBundleInformer); ok {
+		return informer
+	}
+	return &clusterTrustBundleTypedInformerAdapter{informer}
+}
+
+type clusterTrustBundleTypedInformerAdapter struct {
+	ClusterTrustBundleInformer
+}
+
+func (a *clusterTrustBundleTypedInformerAdapter) TypedInformer() ClusterTrustBundleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1.ClusterTrustBundle](a.Informer())
+}
+
+// ToClusterTrustBundleIndexInformer converts an untyped informer into a ClusterTrustBundleIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterTrustBundle. If that is not the case, calling type-safe methods of the returned
+// ClusterTrustBundleIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ClusterTrustBundleIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToClusterTrustBundleIndexInformer(informer cache.SharedIndexInformer) ClusterTrustBundleIndexInformer {
+	if informer, ok := informer.(ClusterTrustBundleIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1.ClusterTrustBundle](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/certificates/v1/interface.go b/vendor/k8s.io/client-go/informers/certificates/v1/interface.go
index 91ccfb715d..b0e1ecc608 100644
--- a/vendor/k8s.io/client-go/informers/certificates/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/certificates/v1/interface.go
@@ -25,7 +25,11 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// CertificateSigningRequests returns a CertificateSigningRequestInformer.
-	CertificateSigningRequests() CertificateSigningRequestInformer
+	CertificateSigningRequests() TypedCertificateSigningRequestInformer
+	// ClusterTrustBundles returns a ClusterTrustBundleInformer.
+	ClusterTrustBundles() TypedClusterTrustBundleInformer
+	// PodCertificateRequests returns a PodCertificateRequestInformer.
+	PodCertificateRequests() TypedPodCertificateRequestInformer
 }
 
 type version struct {
@@ -39,7 +43,17 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// CertificateSigningRequests returns a CertificateSigningRequestInformer.
-func (v *version) CertificateSigningRequests() CertificateSigningRequestInformer {
+// CertificateSigningRequests returns a TypedCertificateSigningRequestInformer.
+func (v *version) CertificateSigningRequests() TypedCertificateSigningRequestInformer {
 	return &certificateSigningRequestInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// ClusterTrustBundles returns a TypedClusterTrustBundleInformer.
+func (v *version) ClusterTrustBundles() TypedClusterTrustBundleInformer {
+	return &clusterTrustBundleInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// PodCertificateRequests returns a TypedPodCertificateRequestInformer.
+func (v *version) PodCertificateRequests() TypedPodCertificateRequestInformer {
+	return &podCertificateRequestInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
diff --git a/vendor/k8s.io/client-go/informers/certificates/v1/podcertificaterequest.go b/vendor/k8s.io/client-go/informers/certificates/v1/podcertificaterequest.go
new file mode 100644
index 0000000000..364740b0db
--- /dev/null
+++ b/vendor/k8s.io/client-go/informers/certificates/v1/podcertificaterequest.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	apicertificatesv1 "k8s.io/api/certificates/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+	kubernetes "k8s.io/client-go/kubernetes"
+	certificatesv1 "k8s.io/client-go/listers/certificates/v1"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// PodCertificateRequestInformer provides access to a shared informer and lister for
+// PodCertificateRequests. Prefer using the type-safe variant (see [TypedPodCertificateRequestInformer]).
+type PodCertificateRequestInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() certificatesv1.PodCertificateRequestLister
+}
+
+// TypedPodCertificateRequestInformer provides access to a shared informer and lister for
+// PodCertificateRequests, including the type-safe TypedInformer variant.
+// It is a superset of PodCertificateRequestInformer.
+type TypedPodCertificateRequestInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PodCertificateRequestIndexInformer
+	Lister() certificatesv1.PodCertificateRequestLister
+}
+
+// PodCertificateRequestIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PodCertificateRequestIndexInformer cache.TypedSharedIndexInformer[*apicertificatesv1.PodCertificateRequest]
+
+// PodCertificateRequestHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for PodCertificateRequest.
+type PodCertificateRequestHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicertificatesv1.PodCertificateRequest]
+
+// PodCertificateRequestDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for PodCertificateRequest.
+type PodCertificateRequestDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicertificatesv1.PodCertificateRequest]
+
+// PodCertificateRequestFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for PodCertificateRequest.
+type PodCertificateRequestFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicertificatesv1.PodCertificateRequest]
+
+// PodCertificateRequestIndexers is a specialization of [cache.TypedIndexers] for PodCertificateRequest.
+type PodCertificateRequestIndexers = cache.TypedIndexers[*apicertificatesv1.PodCertificateRequest]
+
+// DeletedPodCertificateRequest is a specialization of [cache.DeletedObject] for PodCertificateRequest.
+type DeletedPodCertificateRequest = cache.DeletedObject[*apicertificatesv1.PodCertificateRequest]
+
+type podCertificateRequestInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewPodCertificateRequestInformer constructs a new informer for PodCertificateRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodCertificateRequestInformer]).
+func NewPodCertificateRequestInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewPodCertificateRequestInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedPodCertificateRequestInformer constructs a new informer for PodCertificateRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodCertificateRequestInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodCertificateRequestIndexers) PodCertificateRequestIndexInformer {
+	return NewTypedPodCertificateRequestInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredPodCertificateRequestInformer constructs a new informer for PodCertificateRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPodCertificateRequestInformer]).
+func NewFilteredPodCertificateRequestInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedPodCertificateRequestInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPodCertificateRequestInformer constructs a new informer for PodCertificateRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPodCertificateRequestInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodCertificateRequestIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PodCertificateRequestIndexInformer {
+	return NewTypedPodCertificateRequestInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewPodCertificateRequestInformerWithOptions constructs a new informer for PodCertificateRequest type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodCertificateRequestInformerWithOptions]).
+func NewPodCertificateRequestInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPodCertificateRequestInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedPodCertificateRequestInformerWithOptions constructs a new informer for PodCertificateRequest type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodCertificateRequestInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) PodCertificateRequestIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "certificates.k8s.io", Version: "v1", Resource: "podcertificaterequests"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1.PodCertificateRequest](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.CertificatesV1().PodCertificateRequests(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.CertificatesV1().PodCertificateRequests(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.CertificatesV1().PodCertificateRequests(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.CertificatesV1().PodCertificateRequests(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apicertificatesv1.PodCertificateRequest{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *podCertificateRequestInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedPodCertificateRequestInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *podCertificateRequestInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *podCertificateRequestInformer) TypedInformer() PodCertificateRequestIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1.PodCertificateRequest](f.factory.InformerFor(&apicertificatesv1.PodCertificateRequest{}, f.defaultInformer))
+}
+
+func (f *podCertificateRequestInformer) Lister() certificatesv1.PodCertificateRequestLister {
+	return certificatesv1.NewPodCertificateRequestLister(f.Informer().GetIndexer())
+}
+
+// ToTypedPodCertificateRequestInformer converts an untyped informer into a TypedPodCertificateRequestInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PodCertificateRequest. If that is not the case, calling type-safe methods of the returned
+// TypedPodCertificateRequestInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPodCertificateRequestInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPodCertificateRequestInformer(informer PodCertificateRequestInformer) TypedPodCertificateRequestInformer {
+	if informer, ok := informer.(TypedPodCertificateRequestInformer); ok {
+		return informer
+	}
+	return &podCertificateRequestTypedInformerAdapter{informer}
+}
+
+type podCertificateRequestTypedInformerAdapter struct {
+	PodCertificateRequestInformer
+}
+
+func (a *podCertificateRequestTypedInformerAdapter) TypedInformer() PodCertificateRequestIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1.PodCertificateRequest](a.Informer())
+}
+
+// ToPodCertificateRequestIndexInformer converts an untyped informer into a PodCertificateRequestIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PodCertificateRequest. If that is not the case, calling type-safe methods of the returned
+// PodCertificateRequestIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PodCertificateRequestIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPodCertificateRequestIndexInformer(informer cache.SharedIndexInformer) PodCertificateRequestIndexInformer {
+	if informer, ok := informer.(PodCertificateRequestIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1.PodCertificateRequest](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/certificates/v1alpha1/clustertrustbundle.go b/vendor/k8s.io/client-go/informers/certificates/v1alpha1/clustertrustbundle.go
index 637cfd71da..da71ca3ba0 100644
--- a/vendor/k8s.io/client-go/informers/certificates/v1alpha1/clustertrustbundle.go
+++ b/vendor/k8s.io/client-go/informers/certificates/v1alpha1/clustertrustbundle.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ClusterTrustBundleInformer provides access to a shared informer and lister for
-// ClusterTrustBundles.
+// ClusterTrustBundles. Prefer using the type-safe variant (see [TypedClusterTrustBundleInformer]).
 type ClusterTrustBundleInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() certificatesv1alpha1.ClusterTrustBundleLister
 }
 
+// TypedClusterTrustBundleInformer provides access to a shared informer and lister for
+// ClusterTrustBundles, including the type-safe TypedInformer variant.
+// It is a superset of ClusterTrustBundleInformer.
+type TypedClusterTrustBundleInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ClusterTrustBundleIndexInformer
+	Lister() certificatesv1alpha1.ClusterTrustBundleLister
+}
+
+// ClusterTrustBundleIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ClusterTrustBundleIndexInformer cache.TypedSharedIndexInformer[*apicertificatesv1alpha1.ClusterTrustBundle]
+
+// ClusterTrustBundleHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ClusterTrustBundle.
+type ClusterTrustBundleHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicertificatesv1alpha1.ClusterTrustBundle]
+
+// ClusterTrustBundleDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ClusterTrustBundle.
+type ClusterTrustBundleDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicertificatesv1alpha1.ClusterTrustBundle]
+
+// ClusterTrustBundleFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ClusterTrustBundle.
+type ClusterTrustBundleFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicertificatesv1alpha1.ClusterTrustBundle]
+
+// ClusterTrustBundleIndexers is a specialization of [cache.TypedIndexers] for ClusterTrustBundle.
+type ClusterTrustBundleIndexers = cache.TypedIndexers[*apicertificatesv1alpha1.ClusterTrustBundle]
+
+// DeletedClusterTrustBundle is a specialization of [cache.DeletedObject] for ClusterTrustBundle.
+type DeletedClusterTrustBundle = cache.DeletedObject[*apicertificatesv1alpha1.ClusterTrustBundle]
+
 type clusterTrustBundleInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type clusterTrustBundleInformer struct {
 // NewClusterTrustBundleInformer constructs a new informer for ClusterTrustBundle type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterTrustBundleInformer]).
 func NewClusterTrustBundleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedClusterTrustBundleInformer constructs a new informer for ClusterTrustBundle type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterTrustBundleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterTrustBundleIndexers) ClusterTrustBundleIndexInformer {
+	return NewTypedClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredClusterTrustBundleInformer constructs a new informer for ClusterTrustBundle type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredClusterTrustBundleInformer]).
 func NewFilteredClusterTrustBundleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredClusterTrustBundleInformer constructs a new informer for ClusterTrustBundle type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredClusterTrustBundleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterTrustBundleIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterTrustBundleIndexInformer {
+	return NewTypedClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewClusterTrustBundleInformerWithOptions constructs a new informer for ClusterTrustBundle type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterTrustBundleInformerWithOptions]).
 func NewClusterTrustBundleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedClusterTrustBundleInformerWithOptions(client, options)
+}
+
+// NewTypedClusterTrustBundleInformerWithOptions constructs a new informer for ClusterTrustBundle type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterTrustBundleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ClusterTrustBundleIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "certificates.k8s.io", Version: "v1alpha1", Resource: "clustertrustbundles"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1alpha1.ClusterTrustBundle](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewClusterTrustBundleInformerWithOptions(client kubernetes.Interface, optio
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *clusterTrustBundleInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *clusterTrustBundleInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicertificatesv1alpha1.ClusterTrustBundle{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *clusterTrustBundleInformer) TypedInformer() ClusterTrustBundleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1alpha1.ClusterTrustBundle](f.factory.InformerFor(&apicertificatesv1alpha1.ClusterTrustBundle{}, f.defaultInformer))
 }
 
 func (f *clusterTrustBundleInformer) Lister() certificatesv1alpha1.ClusterTrustBundleLister {
 	return certificatesv1alpha1.NewClusterTrustBundleLister(f.Informer().GetIndexer())
 }
+
+// ToTypedClusterTrustBundleInformer converts an untyped informer into a TypedClusterTrustBundleInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterTrustBundle. If that is not the case, calling type-safe methods of the returned
+// TypedClusterTrustBundleInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedClusterTrustBundleInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedClusterTrustBundleInformer(informer ClusterTrustBundleInformer) TypedClusterTrustBundleInformer {
+	if informer, ok := informer.(TypedClusterTrustBundleInformer); ok {
+		return informer
+	}
+	return &clusterTrustBundleTypedInformerAdapter{informer}
+}
+
+type clusterTrustBundleTypedInformerAdapter struct {
+	ClusterTrustBundleInformer
+}
+
+func (a *clusterTrustBundleTypedInformerAdapter) TypedInformer() ClusterTrustBundleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1alpha1.ClusterTrustBundle](a.Informer())
+}
+
+// ToClusterTrustBundleIndexInformer converts an untyped informer into a ClusterTrustBundleIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterTrustBundle. If that is not the case, calling type-safe methods of the returned
+// ClusterTrustBundleIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ClusterTrustBundleIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToClusterTrustBundleIndexInformer(informer cache.SharedIndexInformer) ClusterTrustBundleIndexInformer {
+	if informer, ok := informer.(ClusterTrustBundleIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1alpha1.ClusterTrustBundle](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/certificates/v1alpha1/interface.go b/vendor/k8s.io/client-go/informers/certificates/v1alpha1/interface.go
index 40ce8f42db..8741155be8 100644
--- a/vendor/k8s.io/client-go/informers/certificates/v1alpha1/interface.go
+++ b/vendor/k8s.io/client-go/informers/certificates/v1alpha1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// ClusterTrustBundles returns a ClusterTrustBundleInformer.
-	ClusterTrustBundles() ClusterTrustBundleInformer
+	ClusterTrustBundles() TypedClusterTrustBundleInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// ClusterTrustBundles returns a ClusterTrustBundleInformer.
-func (v *version) ClusterTrustBundles() ClusterTrustBundleInformer {
+// ClusterTrustBundles returns a TypedClusterTrustBundleInformer.
+func (v *version) ClusterTrustBundles() TypedClusterTrustBundleInformer {
 	return &clusterTrustBundleInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/certificates/v1beta1/certificatesigningrequest.go b/vendor/k8s.io/client-go/informers/certificates/v1beta1/certificatesigningrequest.go
index 4d4408d906..bac26740ba 100644
--- a/vendor/k8s.io/client-go/informers/certificates/v1beta1/certificatesigningrequest.go
+++ b/vendor/k8s.io/client-go/informers/certificates/v1beta1/certificatesigningrequest.go
@@ -34,12 +34,40 @@ import (
 )
 
 // CertificateSigningRequestInformer provides access to a shared informer and lister for
-// CertificateSigningRequests.
+// CertificateSigningRequests. Prefer using the type-safe variant (see [TypedCertificateSigningRequestInformer]).
 type CertificateSigningRequestInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() certificatesv1beta1.CertificateSigningRequestLister
 }
 
+// TypedCertificateSigningRequestInformer provides access to a shared informer and lister for
+// CertificateSigningRequests, including the type-safe TypedInformer variant.
+// It is a superset of CertificateSigningRequestInformer.
+type TypedCertificateSigningRequestInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() CertificateSigningRequestIndexInformer
+	Lister() certificatesv1beta1.CertificateSigningRequestLister
+}
+
+// CertificateSigningRequestIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type CertificateSigningRequestIndexInformer cache.TypedSharedIndexInformer[*apicertificatesv1beta1.CertificateSigningRequest]
+
+// CertificateSigningRequestHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for CertificateSigningRequest.
+type CertificateSigningRequestHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicertificatesv1beta1.CertificateSigningRequest]
+
+// CertificateSigningRequestDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for CertificateSigningRequest.
+type CertificateSigningRequestDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicertificatesv1beta1.CertificateSigningRequest]
+
+// CertificateSigningRequestFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for CertificateSigningRequest.
+type CertificateSigningRequestFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicertificatesv1beta1.CertificateSigningRequest]
+
+// CertificateSigningRequestIndexers is a specialization of [cache.TypedIndexers] for CertificateSigningRequest.
+type CertificateSigningRequestIndexers = cache.TypedIndexers[*apicertificatesv1beta1.CertificateSigningRequest]
+
+// DeletedCertificateSigningRequest is a specialization of [cache.DeletedObject] for CertificateSigningRequest.
+type DeletedCertificateSigningRequest = cache.DeletedObject[*apicertificatesv1beta1.CertificateSigningRequest]
+
 type certificateSigningRequestInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type certificateSigningRequestInformer struct {
 // NewCertificateSigningRequestInformer constructs a new informer for CertificateSigningRequest type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCertificateSigningRequestInformer]).
 func NewCertificateSigningRequestInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewCertificateSigningRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedCertificateSigningRequestInformer constructs a new informer for CertificateSigningRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCertificateSigningRequestInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers CertificateSigningRequestIndexers) CertificateSigningRequestIndexInformer {
+	return NewTypedCertificateSigningRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredCertificateSigningRequestInformer constructs a new informer for CertificateSigningRequest type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredCertificateSigningRequestInformer]).
 func NewFilteredCertificateSigningRequestInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewCertificateSigningRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedCertificateSigningRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredCertificateSigningRequestInformer constructs a new informer for CertificateSigningRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredCertificateSigningRequestInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers CertificateSigningRequestIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) CertificateSigningRequestIndexInformer {
+	return NewTypedCertificateSigningRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewCertificateSigningRequestInformerWithOptions constructs a new informer for CertificateSigningRequest type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCertificateSigningRequestInformerWithOptions]).
 func NewCertificateSigningRequestInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedCertificateSigningRequestInformerWithOptions(client, options)
+}
+
+// NewTypedCertificateSigningRequestInformerWithOptions constructs a new informer for CertificateSigningRequest type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCertificateSigningRequestInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) CertificateSigningRequestIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "certificates.k8s.io", Version: "v1beta1", Resource: "certificatesigningrequests"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1beta1.CertificateSigningRequest](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewCertificateSigningRequestInformerWithOptions(client kubernetes.Interface
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *certificateSigningRequestInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewCertificateSigningRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedCertificateSigningRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *certificateSigningRequestInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicertificatesv1beta1.CertificateSigningRequest{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *certificateSigningRequestInformer) TypedInformer() CertificateSigningRequestIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1beta1.CertificateSigningRequest](f.factory.InformerFor(&apicertificatesv1beta1.CertificateSigningRequest{}, f.defaultInformer))
 }
 
 func (f *certificateSigningRequestInformer) Lister() certificatesv1beta1.CertificateSigningRequestLister {
 	return certificatesv1beta1.NewCertificateSigningRequestLister(f.Informer().GetIndexer())
 }
+
+// ToTypedCertificateSigningRequestInformer converts an untyped informer into a TypedCertificateSigningRequestInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CertificateSigningRequest. If that is not the case, calling type-safe methods of the returned
+// TypedCertificateSigningRequestInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedCertificateSigningRequestInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedCertificateSigningRequestInformer(informer CertificateSigningRequestInformer) TypedCertificateSigningRequestInformer {
+	if informer, ok := informer.(TypedCertificateSigningRequestInformer); ok {
+		return informer
+	}
+	return &certificateSigningRequestTypedInformerAdapter{informer}
+}
+
+type certificateSigningRequestTypedInformerAdapter struct {
+	CertificateSigningRequestInformer
+}
+
+func (a *certificateSigningRequestTypedInformerAdapter) TypedInformer() CertificateSigningRequestIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1beta1.CertificateSigningRequest](a.Informer())
+}
+
+// ToCertificateSigningRequestIndexInformer converts an untyped informer into a CertificateSigningRequestIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CertificateSigningRequest. If that is not the case, calling type-safe methods of the returned
+// CertificateSigningRequestIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a CertificateSigningRequestIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToCertificateSigningRequestIndexInformer(informer cache.SharedIndexInformer) CertificateSigningRequestIndexInformer {
+	if informer, ok := informer.(CertificateSigningRequestIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1beta1.CertificateSigningRequest](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/certificates/v1beta1/clustertrustbundle.go b/vendor/k8s.io/client-go/informers/certificates/v1beta1/clustertrustbundle.go
index f665d0b739..4415e589a2 100644
--- a/vendor/k8s.io/client-go/informers/certificates/v1beta1/clustertrustbundle.go
+++ b/vendor/k8s.io/client-go/informers/certificates/v1beta1/clustertrustbundle.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ClusterTrustBundleInformer provides access to a shared informer and lister for
-// ClusterTrustBundles.
+// ClusterTrustBundles. Prefer using the type-safe variant (see [TypedClusterTrustBundleInformer]).
 type ClusterTrustBundleInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() certificatesv1beta1.ClusterTrustBundleLister
 }
 
+// TypedClusterTrustBundleInformer provides access to a shared informer and lister for
+// ClusterTrustBundles, including the type-safe TypedInformer variant.
+// It is a superset of ClusterTrustBundleInformer.
+type TypedClusterTrustBundleInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ClusterTrustBundleIndexInformer
+	Lister() certificatesv1beta1.ClusterTrustBundleLister
+}
+
+// ClusterTrustBundleIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ClusterTrustBundleIndexInformer cache.TypedSharedIndexInformer[*apicertificatesv1beta1.ClusterTrustBundle]
+
+// ClusterTrustBundleHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ClusterTrustBundle.
+type ClusterTrustBundleHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicertificatesv1beta1.ClusterTrustBundle]
+
+// ClusterTrustBundleDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ClusterTrustBundle.
+type ClusterTrustBundleDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicertificatesv1beta1.ClusterTrustBundle]
+
+// ClusterTrustBundleFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ClusterTrustBundle.
+type ClusterTrustBundleFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicertificatesv1beta1.ClusterTrustBundle]
+
+// ClusterTrustBundleIndexers is a specialization of [cache.TypedIndexers] for ClusterTrustBundle.
+type ClusterTrustBundleIndexers = cache.TypedIndexers[*apicertificatesv1beta1.ClusterTrustBundle]
+
+// DeletedClusterTrustBundle is a specialization of [cache.DeletedObject] for ClusterTrustBundle.
+type DeletedClusterTrustBundle = cache.DeletedObject[*apicertificatesv1beta1.ClusterTrustBundle]
+
 type clusterTrustBundleInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type clusterTrustBundleInformer struct {
 // NewClusterTrustBundleInformer constructs a new informer for ClusterTrustBundle type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterTrustBundleInformer]).
 func NewClusterTrustBundleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedClusterTrustBundleInformer constructs a new informer for ClusterTrustBundle type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterTrustBundleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterTrustBundleIndexers) ClusterTrustBundleIndexInformer {
+	return NewTypedClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredClusterTrustBundleInformer constructs a new informer for ClusterTrustBundle type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredClusterTrustBundleInformer]).
 func NewFilteredClusterTrustBundleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredClusterTrustBundleInformer constructs a new informer for ClusterTrustBundle type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredClusterTrustBundleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterTrustBundleIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterTrustBundleIndexInformer {
+	return NewTypedClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewClusterTrustBundleInformerWithOptions constructs a new informer for ClusterTrustBundle type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterTrustBundleInformerWithOptions]).
 func NewClusterTrustBundleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedClusterTrustBundleInformerWithOptions(client, options)
+}
+
+// NewTypedClusterTrustBundleInformerWithOptions constructs a new informer for ClusterTrustBundle type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterTrustBundleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ClusterTrustBundleIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "certificates.k8s.io", Version: "v1beta1", Resource: "clustertrustbundles"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1beta1.ClusterTrustBundle](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewClusterTrustBundleInformerWithOptions(client kubernetes.Interface, optio
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *clusterTrustBundleInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedClusterTrustBundleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *clusterTrustBundleInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicertificatesv1beta1.ClusterTrustBundle{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *clusterTrustBundleInformer) TypedInformer() ClusterTrustBundleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1beta1.ClusterTrustBundle](f.factory.InformerFor(&apicertificatesv1beta1.ClusterTrustBundle{}, f.defaultInformer))
 }
 
 func (f *clusterTrustBundleInformer) Lister() certificatesv1beta1.ClusterTrustBundleLister {
 	return certificatesv1beta1.NewClusterTrustBundleLister(f.Informer().GetIndexer())
 }
+
+// ToTypedClusterTrustBundleInformer converts an untyped informer into a TypedClusterTrustBundleInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterTrustBundle. If that is not the case, calling type-safe methods of the returned
+// TypedClusterTrustBundleInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedClusterTrustBundleInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedClusterTrustBundleInformer(informer ClusterTrustBundleInformer) TypedClusterTrustBundleInformer {
+	if informer, ok := informer.(TypedClusterTrustBundleInformer); ok {
+		return informer
+	}
+	return &clusterTrustBundleTypedInformerAdapter{informer}
+}
+
+type clusterTrustBundleTypedInformerAdapter struct {
+	ClusterTrustBundleInformer
+}
+
+func (a *clusterTrustBundleTypedInformerAdapter) TypedInformer() ClusterTrustBundleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1beta1.ClusterTrustBundle](a.Informer())
+}
+
+// ToClusterTrustBundleIndexInformer converts an untyped informer into a ClusterTrustBundleIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterTrustBundle. If that is not the case, calling type-safe methods of the returned
+// ClusterTrustBundleIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ClusterTrustBundleIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToClusterTrustBundleIndexInformer(informer cache.SharedIndexInformer) ClusterTrustBundleIndexInformer {
+	if informer, ok := informer.(ClusterTrustBundleIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1beta1.ClusterTrustBundle](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/certificates/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/certificates/v1beta1/interface.go
index b2d39e2068..95bce3fa3b 100644
--- a/vendor/k8s.io/client-go/informers/certificates/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/certificates/v1beta1/interface.go
@@ -25,11 +25,11 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// CertificateSigningRequests returns a CertificateSigningRequestInformer.
-	CertificateSigningRequests() CertificateSigningRequestInformer
+	CertificateSigningRequests() TypedCertificateSigningRequestInformer
 	// ClusterTrustBundles returns a ClusterTrustBundleInformer.
-	ClusterTrustBundles() ClusterTrustBundleInformer
+	ClusterTrustBundles() TypedClusterTrustBundleInformer
 	// PodCertificateRequests returns a PodCertificateRequestInformer.
-	PodCertificateRequests() PodCertificateRequestInformer
+	PodCertificateRequests() TypedPodCertificateRequestInformer
 }
 
 type version struct {
@@ -43,17 +43,17 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// CertificateSigningRequests returns a CertificateSigningRequestInformer.
-func (v *version) CertificateSigningRequests() CertificateSigningRequestInformer {
+// CertificateSigningRequests returns a TypedCertificateSigningRequestInformer.
+func (v *version) CertificateSigningRequests() TypedCertificateSigningRequestInformer {
 	return &certificateSigningRequestInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ClusterTrustBundles returns a ClusterTrustBundleInformer.
-func (v *version) ClusterTrustBundles() ClusterTrustBundleInformer {
+// ClusterTrustBundles returns a TypedClusterTrustBundleInformer.
+func (v *version) ClusterTrustBundles() TypedClusterTrustBundleInformer {
 	return &clusterTrustBundleInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// PodCertificateRequests returns a PodCertificateRequestInformer.
-func (v *version) PodCertificateRequests() PodCertificateRequestInformer {
+// PodCertificateRequests returns a TypedPodCertificateRequestInformer.
+func (v *version) PodCertificateRequests() TypedPodCertificateRequestInformer {
 	return &podCertificateRequestInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/certificates/v1beta1/podcertificaterequest.go b/vendor/k8s.io/client-go/informers/certificates/v1beta1/podcertificaterequest.go
index 03f7816cfd..546a8a3eae 100644
--- a/vendor/k8s.io/client-go/informers/certificates/v1beta1/podcertificaterequest.go
+++ b/vendor/k8s.io/client-go/informers/certificates/v1beta1/podcertificaterequest.go
@@ -34,12 +34,40 @@ import (
 )
 
 // PodCertificateRequestInformer provides access to a shared informer and lister for
-// PodCertificateRequests.
+// PodCertificateRequests. Prefer using the type-safe variant (see [TypedPodCertificateRequestInformer]).
 type PodCertificateRequestInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() certificatesv1beta1.PodCertificateRequestLister
 }
 
+// TypedPodCertificateRequestInformer provides access to a shared informer and lister for
+// PodCertificateRequests, including the type-safe TypedInformer variant.
+// It is a superset of PodCertificateRequestInformer.
+type TypedPodCertificateRequestInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PodCertificateRequestIndexInformer
+	Lister() certificatesv1beta1.PodCertificateRequestLister
+}
+
+// PodCertificateRequestIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PodCertificateRequestIndexInformer cache.TypedSharedIndexInformer[*apicertificatesv1beta1.PodCertificateRequest]
+
+// PodCertificateRequestHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for PodCertificateRequest.
+type PodCertificateRequestHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicertificatesv1beta1.PodCertificateRequest]
+
+// PodCertificateRequestDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for PodCertificateRequest.
+type PodCertificateRequestDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicertificatesv1beta1.PodCertificateRequest]
+
+// PodCertificateRequestFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for PodCertificateRequest.
+type PodCertificateRequestFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicertificatesv1beta1.PodCertificateRequest]
+
+// PodCertificateRequestIndexers is a specialization of [cache.TypedIndexers] for PodCertificateRequest.
+type PodCertificateRequestIndexers = cache.TypedIndexers[*apicertificatesv1beta1.PodCertificateRequest]
+
+// DeletedPodCertificateRequest is a specialization of [cache.DeletedObject] for PodCertificateRequest.
+type DeletedPodCertificateRequest = cache.DeletedObject[*apicertificatesv1beta1.PodCertificateRequest]
+
 type podCertificateRequestInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type podCertificateRequestInformer struct {
 // NewPodCertificateRequestInformer constructs a new informer for PodCertificateRequest type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodCertificateRequestInformer]).
 func NewPodCertificateRequestInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewPodCertificateRequestInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedPodCertificateRequestInformer constructs a new informer for PodCertificateRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodCertificateRequestInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodCertificateRequestIndexers) PodCertificateRequestIndexInformer {
+	return NewTypedPodCertificateRequestInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredPodCertificateRequestInformer constructs a new informer for PodCertificateRequest type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPodCertificateRequestInformer]).
 func NewFilteredPodCertificateRequestInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewPodCertificateRequestInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedPodCertificateRequestInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPodCertificateRequestInformer constructs a new informer for PodCertificateRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPodCertificateRequestInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodCertificateRequestIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PodCertificateRequestIndexInformer {
+	return NewTypedPodCertificateRequestInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewPodCertificateRequestInformerWithOptions constructs a new informer for PodCertificateRequest type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodCertificateRequestInformerWithOptions]).
 func NewPodCertificateRequestInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPodCertificateRequestInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedPodCertificateRequestInformerWithOptions constructs a new informer for PodCertificateRequest type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodCertificateRequestInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) PodCertificateRequestIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "certificates.k8s.io", Version: "v1beta1", Resource: "podcertificaterequests"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1beta1.PodCertificateRequest](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewPodCertificateRequestInformerWithOptions(client kubernetes.Interface, na
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *podCertificateRequestInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewPodCertificateRequestInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedPodCertificateRequestInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *podCertificateRequestInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicertificatesv1beta1.PodCertificateRequest{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *podCertificateRequestInformer) TypedInformer() PodCertificateRequestIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1beta1.PodCertificateRequest](f.factory.InformerFor(&apicertificatesv1beta1.PodCertificateRequest{}, f.defaultInformer))
 }
 
 func (f *podCertificateRequestInformer) Lister() certificatesv1beta1.PodCertificateRequestLister {
 	return certificatesv1beta1.NewPodCertificateRequestLister(f.Informer().GetIndexer())
 }
+
+// ToTypedPodCertificateRequestInformer converts an untyped informer into a TypedPodCertificateRequestInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PodCertificateRequest. If that is not the case, calling type-safe methods of the returned
+// TypedPodCertificateRequestInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPodCertificateRequestInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPodCertificateRequestInformer(informer PodCertificateRequestInformer) TypedPodCertificateRequestInformer {
+	if informer, ok := informer.(TypedPodCertificateRequestInformer); ok {
+		return informer
+	}
+	return &podCertificateRequestTypedInformerAdapter{informer}
+}
+
+type podCertificateRequestTypedInformerAdapter struct {
+	PodCertificateRequestInformer
+}
+
+func (a *podCertificateRequestTypedInformerAdapter) TypedInformer() PodCertificateRequestIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1beta1.PodCertificateRequest](a.Informer())
+}
+
+// ToPodCertificateRequestIndexInformer converts an untyped informer into a PodCertificateRequestIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PodCertificateRequest. If that is not the case, calling type-safe methods of the returned
+// PodCertificateRequestIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PodCertificateRequestIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPodCertificateRequestIndexInformer(informer cache.SharedIndexInformer) PodCertificateRequestIndexInformer {
+	if informer, ok := informer.(PodCertificateRequestIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicertificatesv1beta1.PodCertificateRequest](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/coordination/v1/interface.go b/vendor/k8s.io/client-go/informers/coordination/v1/interface.go
index 05c4acbef8..9451e71256 100644
--- a/vendor/k8s.io/client-go/informers/coordination/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/coordination/v1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// Leases returns a LeaseInformer.
-	Leases() LeaseInformer
+	Leases() TypedLeaseInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// Leases returns a LeaseInformer.
-func (v *version) Leases() LeaseInformer {
+// Leases returns a TypedLeaseInformer.
+func (v *version) Leases() TypedLeaseInformer {
 	return &leaseInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/coordination/v1/lease.go b/vendor/k8s.io/client-go/informers/coordination/v1/lease.go
index cce8ab4d13..feec290441 100644
--- a/vendor/k8s.io/client-go/informers/coordination/v1/lease.go
+++ b/vendor/k8s.io/client-go/informers/coordination/v1/lease.go
@@ -34,12 +34,40 @@ import (
 )
 
 // LeaseInformer provides access to a shared informer and lister for
-// Leases.
+// Leases. Prefer using the type-safe variant (see [TypedLeaseInformer]).
 type LeaseInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() coordinationv1.LeaseLister
 }
 
+// TypedLeaseInformer provides access to a shared informer and lister for
+// Leases, including the type-safe TypedInformer variant.
+// It is a superset of LeaseInformer.
+type TypedLeaseInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() LeaseIndexInformer
+	Lister() coordinationv1.LeaseLister
+}
+
+// LeaseIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type LeaseIndexInformer cache.TypedSharedIndexInformer[*apicoordinationv1.Lease]
+
+// LeaseHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Lease.
+type LeaseHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicoordinationv1.Lease]
+
+// LeaseDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Lease.
+type LeaseDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicoordinationv1.Lease]
+
+// LeaseFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Lease.
+type LeaseFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicoordinationv1.Lease]
+
+// LeaseIndexers is a specialization of [cache.TypedIndexers] for Lease.
+type LeaseIndexers = cache.TypedIndexers[*apicoordinationv1.Lease]
+
+// DeletedLease is a specialization of [cache.DeletedObject] for Lease.
+type DeletedLease = cache.DeletedObject[*apicoordinationv1.Lease]
+
 type leaseInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type leaseInformer struct {
 // NewLeaseInformer constructs a new informer for Lease type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedLeaseInformer]).
 func NewLeaseInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewLeaseInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedLeaseInformer constructs a new informer for Lease type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedLeaseInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers LeaseIndexers) LeaseIndexInformer {
+	return NewTypedLeaseInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredLeaseInformer constructs a new informer for Lease type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredLeaseInformer]).
 func NewFilteredLeaseInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewLeaseInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedLeaseInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredLeaseInformer constructs a new informer for Lease type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredLeaseInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers LeaseIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) LeaseIndexInformer {
+	return NewTypedLeaseInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewLeaseInformerWithOptions constructs a new informer for Lease type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedLeaseInformerWithOptions]).
 func NewLeaseInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedLeaseInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedLeaseInformerWithOptions constructs a new informer for Lease type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedLeaseInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) LeaseIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "coordination.k8s.io", Version: "v1", Resource: "leases"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1.Lease](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewLeaseInformerWithOptions(client kubernetes.Interface, namespace string,
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *leaseInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewLeaseInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedLeaseInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *leaseInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicoordinationv1.Lease{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *leaseInformer) TypedInformer() LeaseIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1.Lease](f.factory.InformerFor(&apicoordinationv1.Lease{}, f.defaultInformer))
 }
 
 func (f *leaseInformer) Lister() coordinationv1.LeaseLister {
 	return coordinationv1.NewLeaseLister(f.Informer().GetIndexer())
 }
+
+// ToTypedLeaseInformer converts an untyped informer into a TypedLeaseInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Lease. If that is not the case, calling type-safe methods of the returned
+// TypedLeaseInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedLeaseInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedLeaseInformer(informer LeaseInformer) TypedLeaseInformer {
+	if informer, ok := informer.(TypedLeaseInformer); ok {
+		return informer
+	}
+	return &leaseTypedInformerAdapter{informer}
+}
+
+type leaseTypedInformerAdapter struct {
+	LeaseInformer
+}
+
+func (a *leaseTypedInformerAdapter) TypedInformer() LeaseIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1.Lease](a.Informer())
+}
+
+// ToLeaseIndexInformer converts an untyped informer into a LeaseIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Lease. If that is not the case, calling type-safe methods of the returned
+// LeaseIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a LeaseIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToLeaseIndexInformer(informer cache.SharedIndexInformer) LeaseIndexInformer {
+	if informer, ok := informer.(LeaseIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1.Lease](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/coordination/v1alpha2/interface.go b/vendor/k8s.io/client-go/informers/coordination/v1alpha2/interface.go
index ba83768ade..13aea61e78 100644
--- a/vendor/k8s.io/client-go/informers/coordination/v1alpha2/interface.go
+++ b/vendor/k8s.io/client-go/informers/coordination/v1alpha2/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// LeaseCandidates returns a LeaseCandidateInformer.
-	LeaseCandidates() LeaseCandidateInformer
+	LeaseCandidates() TypedLeaseCandidateInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// LeaseCandidates returns a LeaseCandidateInformer.
-func (v *version) LeaseCandidates() LeaseCandidateInformer {
+// LeaseCandidates returns a TypedLeaseCandidateInformer.
+func (v *version) LeaseCandidates() TypedLeaseCandidateInformer {
 	return &leaseCandidateInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/coordination/v1alpha2/leasecandidate.go b/vendor/k8s.io/client-go/informers/coordination/v1alpha2/leasecandidate.go
index 5aa0ff3ae2..55071de0f8 100644
--- a/vendor/k8s.io/client-go/informers/coordination/v1alpha2/leasecandidate.go
+++ b/vendor/k8s.io/client-go/informers/coordination/v1alpha2/leasecandidate.go
@@ -34,12 +34,40 @@ import (
 )
 
 // LeaseCandidateInformer provides access to a shared informer and lister for
-// LeaseCandidates.
+// LeaseCandidates. Prefer using the type-safe variant (see [TypedLeaseCandidateInformer]).
 type LeaseCandidateInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() coordinationv1alpha2.LeaseCandidateLister
 }
 
+// TypedLeaseCandidateInformer provides access to a shared informer and lister for
+// LeaseCandidates, including the type-safe TypedInformer variant.
+// It is a superset of LeaseCandidateInformer.
+type TypedLeaseCandidateInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() LeaseCandidateIndexInformer
+	Lister() coordinationv1alpha2.LeaseCandidateLister
+}
+
+// LeaseCandidateIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type LeaseCandidateIndexInformer cache.TypedSharedIndexInformer[*apicoordinationv1alpha2.LeaseCandidate]
+
+// LeaseCandidateHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for LeaseCandidate.
+type LeaseCandidateHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicoordinationv1alpha2.LeaseCandidate]
+
+// LeaseCandidateDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for LeaseCandidate.
+type LeaseCandidateDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicoordinationv1alpha2.LeaseCandidate]
+
+// LeaseCandidateFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for LeaseCandidate.
+type LeaseCandidateFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicoordinationv1alpha2.LeaseCandidate]
+
+// LeaseCandidateIndexers is a specialization of [cache.TypedIndexers] for LeaseCandidate.
+type LeaseCandidateIndexers = cache.TypedIndexers[*apicoordinationv1alpha2.LeaseCandidate]
+
+// DeletedLeaseCandidate is a specialization of [cache.DeletedObject] for LeaseCandidate.
+type DeletedLeaseCandidate = cache.DeletedObject[*apicoordinationv1alpha2.LeaseCandidate]
+
 type leaseCandidateInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type leaseCandidateInformer struct {
 // NewLeaseCandidateInformer constructs a new informer for LeaseCandidate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedLeaseCandidateInformer]).
 func NewLeaseCandidateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewLeaseCandidateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedLeaseCandidateInformer constructs a new informer for LeaseCandidate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedLeaseCandidateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers LeaseCandidateIndexers) LeaseCandidateIndexInformer {
+	return NewTypedLeaseCandidateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredLeaseCandidateInformer constructs a new informer for LeaseCandidate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredLeaseCandidateInformer]).
 func NewFilteredLeaseCandidateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewLeaseCandidateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedLeaseCandidateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredLeaseCandidateInformer constructs a new informer for LeaseCandidate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredLeaseCandidateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers LeaseCandidateIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) LeaseCandidateIndexInformer {
+	return NewTypedLeaseCandidateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewLeaseCandidateInformerWithOptions constructs a new informer for LeaseCandidate type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedLeaseCandidateInformerWithOptions]).
 func NewLeaseCandidateInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedLeaseCandidateInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedLeaseCandidateInformerWithOptions constructs a new informer for LeaseCandidate type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedLeaseCandidateInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) LeaseCandidateIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "coordination.k8s.io", Version: "v1alpha2", Resource: "leasecandidates"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1alpha2.LeaseCandidate](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewLeaseCandidateInformerWithOptions(client kubernetes.Interface, namespace
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *leaseCandidateInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewLeaseCandidateInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedLeaseCandidateInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *leaseCandidateInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicoordinationv1alpha2.LeaseCandidate{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *leaseCandidateInformer) TypedInformer() LeaseCandidateIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1alpha2.LeaseCandidate](f.factory.InformerFor(&apicoordinationv1alpha2.LeaseCandidate{}, f.defaultInformer))
 }
 
 func (f *leaseCandidateInformer) Lister() coordinationv1alpha2.LeaseCandidateLister {
 	return coordinationv1alpha2.NewLeaseCandidateLister(f.Informer().GetIndexer())
 }
+
+// ToTypedLeaseCandidateInformer converts an untyped informer into a TypedLeaseCandidateInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *LeaseCandidate. If that is not the case, calling type-safe methods of the returned
+// TypedLeaseCandidateInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedLeaseCandidateInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedLeaseCandidateInformer(informer LeaseCandidateInformer) TypedLeaseCandidateInformer {
+	if informer, ok := informer.(TypedLeaseCandidateInformer); ok {
+		return informer
+	}
+	return &leaseCandidateTypedInformerAdapter{informer}
+}
+
+type leaseCandidateTypedInformerAdapter struct {
+	LeaseCandidateInformer
+}
+
+func (a *leaseCandidateTypedInformerAdapter) TypedInformer() LeaseCandidateIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1alpha2.LeaseCandidate](a.Informer())
+}
+
+// ToLeaseCandidateIndexInformer converts an untyped informer into a LeaseCandidateIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *LeaseCandidate. If that is not the case, calling type-safe methods of the returned
+// LeaseCandidateIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a LeaseCandidateIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToLeaseCandidateIndexInformer(informer cache.SharedIndexInformer) LeaseCandidateIndexInformer {
+	if informer, ok := informer.(LeaseCandidateIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1alpha2.LeaseCandidate](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/coordination/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/coordination/v1beta1/interface.go
index 707e510869..41af125913 100644
--- a/vendor/k8s.io/client-go/informers/coordination/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/coordination/v1beta1/interface.go
@@ -25,9 +25,9 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// Leases returns a LeaseInformer.
-	Leases() LeaseInformer
+	Leases() TypedLeaseInformer
 	// LeaseCandidates returns a LeaseCandidateInformer.
-	LeaseCandidates() LeaseCandidateInformer
+	LeaseCandidates() TypedLeaseCandidateInformer
 }
 
 type version struct {
@@ -41,12 +41,12 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// Leases returns a LeaseInformer.
-func (v *version) Leases() LeaseInformer {
+// Leases returns a TypedLeaseInformer.
+func (v *version) Leases() TypedLeaseInformer {
 	return &leaseInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// LeaseCandidates returns a LeaseCandidateInformer.
-func (v *version) LeaseCandidates() LeaseCandidateInformer {
+// LeaseCandidates returns a TypedLeaseCandidateInformer.
+func (v *version) LeaseCandidates() TypedLeaseCandidateInformer {
 	return &leaseCandidateInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/coordination/v1beta1/lease.go b/vendor/k8s.io/client-go/informers/coordination/v1beta1/lease.go
index 66802fd949..458e2ce48d 100644
--- a/vendor/k8s.io/client-go/informers/coordination/v1beta1/lease.go
+++ b/vendor/k8s.io/client-go/informers/coordination/v1beta1/lease.go
@@ -34,12 +34,40 @@ import (
 )
 
 // LeaseInformer provides access to a shared informer and lister for
-// Leases.
+// Leases. Prefer using the type-safe variant (see [TypedLeaseInformer]).
 type LeaseInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() coordinationv1beta1.LeaseLister
 }
 
+// TypedLeaseInformer provides access to a shared informer and lister for
+// Leases, including the type-safe TypedInformer variant.
+// It is a superset of LeaseInformer.
+type TypedLeaseInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() LeaseIndexInformer
+	Lister() coordinationv1beta1.LeaseLister
+}
+
+// LeaseIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type LeaseIndexInformer cache.TypedSharedIndexInformer[*apicoordinationv1beta1.Lease]
+
+// LeaseHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Lease.
+type LeaseHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicoordinationv1beta1.Lease]
+
+// LeaseDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Lease.
+type LeaseDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicoordinationv1beta1.Lease]
+
+// LeaseFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Lease.
+type LeaseFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicoordinationv1beta1.Lease]
+
+// LeaseIndexers is a specialization of [cache.TypedIndexers] for Lease.
+type LeaseIndexers = cache.TypedIndexers[*apicoordinationv1beta1.Lease]
+
+// DeletedLease is a specialization of [cache.DeletedObject] for Lease.
+type DeletedLease = cache.DeletedObject[*apicoordinationv1beta1.Lease]
+
 type leaseInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type leaseInformer struct {
 // NewLeaseInformer constructs a new informer for Lease type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedLeaseInformer]).
 func NewLeaseInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewLeaseInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedLeaseInformer constructs a new informer for Lease type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedLeaseInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers LeaseIndexers) LeaseIndexInformer {
+	return NewTypedLeaseInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredLeaseInformer constructs a new informer for Lease type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredLeaseInformer]).
 func NewFilteredLeaseInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewLeaseInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedLeaseInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredLeaseInformer constructs a new informer for Lease type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredLeaseInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers LeaseIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) LeaseIndexInformer {
+	return NewTypedLeaseInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewLeaseInformerWithOptions constructs a new informer for Lease type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedLeaseInformerWithOptions]).
 func NewLeaseInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedLeaseInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedLeaseInformerWithOptions constructs a new informer for Lease type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedLeaseInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) LeaseIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "coordination.k8s.io", Version: "v1beta1", Resource: "leases"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1beta1.Lease](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewLeaseInformerWithOptions(client kubernetes.Interface, namespace string,
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *leaseInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewLeaseInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedLeaseInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *leaseInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicoordinationv1beta1.Lease{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *leaseInformer) TypedInformer() LeaseIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1beta1.Lease](f.factory.InformerFor(&apicoordinationv1beta1.Lease{}, f.defaultInformer))
 }
 
 func (f *leaseInformer) Lister() coordinationv1beta1.LeaseLister {
 	return coordinationv1beta1.NewLeaseLister(f.Informer().GetIndexer())
 }
+
+// ToTypedLeaseInformer converts an untyped informer into a TypedLeaseInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Lease. If that is not the case, calling type-safe methods of the returned
+// TypedLeaseInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedLeaseInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedLeaseInformer(informer LeaseInformer) TypedLeaseInformer {
+	if informer, ok := informer.(TypedLeaseInformer); ok {
+		return informer
+	}
+	return &leaseTypedInformerAdapter{informer}
+}
+
+type leaseTypedInformerAdapter struct {
+	LeaseInformer
+}
+
+func (a *leaseTypedInformerAdapter) TypedInformer() LeaseIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1beta1.Lease](a.Informer())
+}
+
+// ToLeaseIndexInformer converts an untyped informer into a LeaseIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Lease. If that is not the case, calling type-safe methods of the returned
+// LeaseIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a LeaseIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToLeaseIndexInformer(informer cache.SharedIndexInformer) LeaseIndexInformer {
+	if informer, ok := informer.(LeaseIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1beta1.Lease](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/coordination/v1beta1/leasecandidate.go b/vendor/k8s.io/client-go/informers/coordination/v1beta1/leasecandidate.go
index ee83397f4c..05cdf9a82f 100644
--- a/vendor/k8s.io/client-go/informers/coordination/v1beta1/leasecandidate.go
+++ b/vendor/k8s.io/client-go/informers/coordination/v1beta1/leasecandidate.go
@@ -34,12 +34,40 @@ import (
 )
 
 // LeaseCandidateInformer provides access to a shared informer and lister for
-// LeaseCandidates.
+// LeaseCandidates. Prefer using the type-safe variant (see [TypedLeaseCandidateInformer]).
 type LeaseCandidateInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() coordinationv1beta1.LeaseCandidateLister
 }
 
+// TypedLeaseCandidateInformer provides access to a shared informer and lister for
+// LeaseCandidates, including the type-safe TypedInformer variant.
+// It is a superset of LeaseCandidateInformer.
+type TypedLeaseCandidateInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() LeaseCandidateIndexInformer
+	Lister() coordinationv1beta1.LeaseCandidateLister
+}
+
+// LeaseCandidateIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type LeaseCandidateIndexInformer cache.TypedSharedIndexInformer[*apicoordinationv1beta1.LeaseCandidate]
+
+// LeaseCandidateHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for LeaseCandidate.
+type LeaseCandidateHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicoordinationv1beta1.LeaseCandidate]
+
+// LeaseCandidateDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for LeaseCandidate.
+type LeaseCandidateDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicoordinationv1beta1.LeaseCandidate]
+
+// LeaseCandidateFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for LeaseCandidate.
+type LeaseCandidateFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicoordinationv1beta1.LeaseCandidate]
+
+// LeaseCandidateIndexers is a specialization of [cache.TypedIndexers] for LeaseCandidate.
+type LeaseCandidateIndexers = cache.TypedIndexers[*apicoordinationv1beta1.LeaseCandidate]
+
+// DeletedLeaseCandidate is a specialization of [cache.DeletedObject] for LeaseCandidate.
+type DeletedLeaseCandidate = cache.DeletedObject[*apicoordinationv1beta1.LeaseCandidate]
+
 type leaseCandidateInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type leaseCandidateInformer struct {
 // NewLeaseCandidateInformer constructs a new informer for LeaseCandidate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedLeaseCandidateInformer]).
 func NewLeaseCandidateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewLeaseCandidateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedLeaseCandidateInformer constructs a new informer for LeaseCandidate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedLeaseCandidateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers LeaseCandidateIndexers) LeaseCandidateIndexInformer {
+	return NewTypedLeaseCandidateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredLeaseCandidateInformer constructs a new informer for LeaseCandidate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredLeaseCandidateInformer]).
 func NewFilteredLeaseCandidateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewLeaseCandidateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedLeaseCandidateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredLeaseCandidateInformer constructs a new informer for LeaseCandidate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredLeaseCandidateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers LeaseCandidateIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) LeaseCandidateIndexInformer {
+	return NewTypedLeaseCandidateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewLeaseCandidateInformerWithOptions constructs a new informer for LeaseCandidate type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedLeaseCandidateInformerWithOptions]).
 func NewLeaseCandidateInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedLeaseCandidateInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedLeaseCandidateInformerWithOptions constructs a new informer for LeaseCandidate type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedLeaseCandidateInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) LeaseCandidateIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "coordination.k8s.io", Version: "v1beta1", Resource: "leasecandidates"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1beta1.LeaseCandidate](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewLeaseCandidateInformerWithOptions(client kubernetes.Interface, namespace
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *leaseCandidateInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewLeaseCandidateInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedLeaseCandidateInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *leaseCandidateInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicoordinationv1beta1.LeaseCandidate{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *leaseCandidateInformer) TypedInformer() LeaseCandidateIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1beta1.LeaseCandidate](f.factory.InformerFor(&apicoordinationv1beta1.LeaseCandidate{}, f.defaultInformer))
 }
 
 func (f *leaseCandidateInformer) Lister() coordinationv1beta1.LeaseCandidateLister {
 	return coordinationv1beta1.NewLeaseCandidateLister(f.Informer().GetIndexer())
 }
+
+// ToTypedLeaseCandidateInformer converts an untyped informer into a TypedLeaseCandidateInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *LeaseCandidate. If that is not the case, calling type-safe methods of the returned
+// TypedLeaseCandidateInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedLeaseCandidateInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedLeaseCandidateInformer(informer LeaseCandidateInformer) TypedLeaseCandidateInformer {
+	if informer, ok := informer.(TypedLeaseCandidateInformer); ok {
+		return informer
+	}
+	return &leaseCandidateTypedInformerAdapter{informer}
+}
+
+type leaseCandidateTypedInformerAdapter struct {
+	LeaseCandidateInformer
+}
+
+func (a *leaseCandidateTypedInformerAdapter) TypedInformer() LeaseCandidateIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1beta1.LeaseCandidate](a.Informer())
+}
+
+// ToLeaseCandidateIndexInformer converts an untyped informer into a LeaseCandidateIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *LeaseCandidate. If that is not the case, calling type-safe methods of the returned
+// LeaseCandidateIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a LeaseCandidateIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToLeaseCandidateIndexInformer(informer cache.SharedIndexInformer) LeaseCandidateIndexInformer {
+	if informer, ok := informer.(LeaseCandidateIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicoordinationv1beta1.LeaseCandidate](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/componentstatus.go b/vendor/k8s.io/client-go/informers/core/v1/componentstatus.go
index 5b6f6556c3..97dbda2b43 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/componentstatus.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/componentstatus.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ComponentStatusInformer provides access to a shared informer and lister for
-// ComponentStatuses.
+// ComponentStatuses. Prefer using the type-safe variant (see [TypedComponentStatusInformer]).
 type ComponentStatusInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.ComponentStatusLister
 }
 
+// TypedComponentStatusInformer provides access to a shared informer and lister for
+// ComponentStatuses, including the type-safe TypedInformer variant.
+// It is a superset of ComponentStatusInformer.
+type TypedComponentStatusInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ComponentStatusIndexInformer
+	Lister() corev1.ComponentStatusLister
+}
+
+// ComponentStatusIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ComponentStatusIndexInformer cache.TypedSharedIndexInformer[*apicorev1.ComponentStatus]
+
+// ComponentStatusHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ComponentStatus.
+type ComponentStatusHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.ComponentStatus]
+
+// ComponentStatusDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ComponentStatus.
+type ComponentStatusDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.ComponentStatus]
+
+// ComponentStatusFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ComponentStatus.
+type ComponentStatusFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.ComponentStatus]
+
+// ComponentStatusIndexers is a specialization of [cache.TypedIndexers] for ComponentStatus.
+type ComponentStatusIndexers = cache.TypedIndexers[*apicorev1.ComponentStatus]
+
+// DeletedComponentStatus is a specialization of [cache.DeletedObject] for ComponentStatus.
+type DeletedComponentStatus = cache.DeletedObject[*apicorev1.ComponentStatus]
+
 type componentStatusInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type componentStatusInformer struct {
 // NewComponentStatusInformer constructs a new informer for ComponentStatus type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedComponentStatusInformer]).
 func NewComponentStatusInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewComponentStatusInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedComponentStatusInformer constructs a new informer for ComponentStatus type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedComponentStatusInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ComponentStatusIndexers) ComponentStatusIndexInformer {
+	return NewTypedComponentStatusInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredComponentStatusInformer constructs a new informer for ComponentStatus type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredComponentStatusInformer]).
 func NewFilteredComponentStatusInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewComponentStatusInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedComponentStatusInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredComponentStatusInformer constructs a new informer for ComponentStatus type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredComponentStatusInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ComponentStatusIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ComponentStatusIndexInformer {
+	return NewTypedComponentStatusInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewComponentStatusInformerWithOptions constructs a new informer for ComponentStatus type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedComponentStatusInformerWithOptions]).
 func NewComponentStatusInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedComponentStatusInformerWithOptions(client, options)
+}
+
+// NewTypedComponentStatusInformerWithOptions constructs a new informer for ComponentStatus type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedComponentStatusInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ComponentStatusIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "componentstatuss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ComponentStatus](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewComponentStatusInformerWithOptions(client kubernetes.Interface, options
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *componentStatusInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewComponentStatusInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedComponentStatusInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *componentStatusInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.ComponentStatus{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *componentStatusInformer) TypedInformer() ComponentStatusIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ComponentStatus](f.factory.InformerFor(&apicorev1.ComponentStatus{}, f.defaultInformer))
 }
 
 func (f *componentStatusInformer) Lister() corev1.ComponentStatusLister {
 	return corev1.NewComponentStatusLister(f.Informer().GetIndexer())
 }
+
+// ToTypedComponentStatusInformer converts an untyped informer into a TypedComponentStatusInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ComponentStatus. If that is not the case, calling type-safe methods of the returned
+// TypedComponentStatusInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedComponentStatusInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedComponentStatusInformer(informer ComponentStatusInformer) TypedComponentStatusInformer {
+	if informer, ok := informer.(TypedComponentStatusInformer); ok {
+		return informer
+	}
+	return &componentStatusTypedInformerAdapter{informer}
+}
+
+type componentStatusTypedInformerAdapter struct {
+	ComponentStatusInformer
+}
+
+func (a *componentStatusTypedInformerAdapter) TypedInformer() ComponentStatusIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ComponentStatus](a.Informer())
+}
+
+// ToComponentStatusIndexInformer converts an untyped informer into a ComponentStatusIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ComponentStatus. If that is not the case, calling type-safe methods of the returned
+// ComponentStatusIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ComponentStatusIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToComponentStatusIndexInformer(informer cache.SharedIndexInformer) ComponentStatusIndexInformer {
+	if informer, ok := informer.(ComponentStatusIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ComponentStatus](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/configmap.go b/vendor/k8s.io/client-go/informers/core/v1/configmap.go
index 5b6389884b..db84d29736 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/configmap.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/configmap.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ConfigMapInformer provides access to a shared informer and lister for
-// ConfigMaps.
+// ConfigMaps. Prefer using the type-safe variant (see [TypedConfigMapInformer]).
 type ConfigMapInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.ConfigMapLister
 }
 
+// TypedConfigMapInformer provides access to a shared informer and lister for
+// ConfigMaps, including the type-safe TypedInformer variant.
+// It is a superset of ConfigMapInformer.
+type TypedConfigMapInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ConfigMapIndexInformer
+	Lister() corev1.ConfigMapLister
+}
+
+// ConfigMapIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ConfigMapIndexInformer cache.TypedSharedIndexInformer[*apicorev1.ConfigMap]
+
+// ConfigMapHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ConfigMap.
+type ConfigMapHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.ConfigMap]
+
+// ConfigMapDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ConfigMap.
+type ConfigMapDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.ConfigMap]
+
+// ConfigMapFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ConfigMap.
+type ConfigMapFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.ConfigMap]
+
+// ConfigMapIndexers is a specialization of [cache.TypedIndexers] for ConfigMap.
+type ConfigMapIndexers = cache.TypedIndexers[*apicorev1.ConfigMap]
+
+// DeletedConfigMap is a specialization of [cache.DeletedObject] for ConfigMap.
+type DeletedConfigMap = cache.DeletedObject[*apicorev1.ConfigMap]
+
 type configMapInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type configMapInformer struct {
 // NewConfigMapInformer constructs a new informer for ConfigMap type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedConfigMapInformer]).
 func NewConfigMapInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewConfigMapInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedConfigMapInformer constructs a new informer for ConfigMap type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedConfigMapInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ConfigMapIndexers) ConfigMapIndexInformer {
+	return NewTypedConfigMapInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredConfigMapInformer constructs a new informer for ConfigMap type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredConfigMapInformer]).
 func NewFilteredConfigMapInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewConfigMapInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedConfigMapInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredConfigMapInformer constructs a new informer for ConfigMap type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredConfigMapInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ConfigMapIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ConfigMapIndexInformer {
+	return NewTypedConfigMapInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewConfigMapInformerWithOptions constructs a new informer for ConfigMap type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedConfigMapInformerWithOptions]).
 func NewConfigMapInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedConfigMapInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedConfigMapInformerWithOptions constructs a new informer for ConfigMap type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedConfigMapInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ConfigMapIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "configmaps"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ConfigMap](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewConfigMapInformerWithOptions(client kubernetes.Interface, namespace stri
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *configMapInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewConfigMapInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedConfigMapInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *configMapInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.ConfigMap{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *configMapInformer) TypedInformer() ConfigMapIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ConfigMap](f.factory.InformerFor(&apicorev1.ConfigMap{}, f.defaultInformer))
 }
 
 func (f *configMapInformer) Lister() corev1.ConfigMapLister {
 	return corev1.NewConfigMapLister(f.Informer().GetIndexer())
 }
+
+// ToTypedConfigMapInformer converts an untyped informer into a TypedConfigMapInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ConfigMap. If that is not the case, calling type-safe methods of the returned
+// TypedConfigMapInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedConfigMapInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedConfigMapInformer(informer ConfigMapInformer) TypedConfigMapInformer {
+	if informer, ok := informer.(TypedConfigMapInformer); ok {
+		return informer
+	}
+	return &configMapTypedInformerAdapter{informer}
+}
+
+type configMapTypedInformerAdapter struct {
+	ConfigMapInformer
+}
+
+func (a *configMapTypedInformerAdapter) TypedInformer() ConfigMapIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ConfigMap](a.Informer())
+}
+
+// ToConfigMapIndexInformer converts an untyped informer into a ConfigMapIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ConfigMap. If that is not the case, calling type-safe methods of the returned
+// ConfigMapIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ConfigMapIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToConfigMapIndexInformer(informer cache.SharedIndexInformer) ConfigMapIndexInformer {
+	if informer, ok := informer.(ConfigMapIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ConfigMap](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/endpoints.go b/vendor/k8s.io/client-go/informers/core/v1/endpoints.go
index 1609ce7f7e..240967c3e4 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/endpoints.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/endpoints.go
@@ -34,12 +34,40 @@ import (
 )
 
 // EndpointsInformer provides access to a shared informer and lister for
-// Endpoints.
+// Endpoints. Prefer using the type-safe variant (see [TypedEndpointsInformer]).
 type EndpointsInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.EndpointsLister
 }
 
+// TypedEndpointsInformer provides access to a shared informer and lister for
+// Endpoints, including the type-safe TypedInformer variant.
+// It is a superset of EndpointsInformer.
+type TypedEndpointsInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() EndpointsIndexInformer
+	Lister() corev1.EndpointsLister
+}
+
+// EndpointsIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type EndpointsIndexInformer cache.TypedSharedIndexInformer[*apicorev1.Endpoints]
+
+// EndpointsHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Endpoints.
+type EndpointsHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.Endpoints]
+
+// EndpointsDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Endpoints.
+type EndpointsDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.Endpoints]
+
+// EndpointsFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Endpoints.
+type EndpointsFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.Endpoints]
+
+// EndpointsIndexers is a specialization of [cache.TypedIndexers] for Endpoints.
+type EndpointsIndexers = cache.TypedIndexers[*apicorev1.Endpoints]
+
+// DeletedEndpoints is a specialization of [cache.DeletedObject] for Endpoints.
+type DeletedEndpoints = cache.DeletedObject[*apicorev1.Endpoints]
+
 type endpointsInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type endpointsInformer struct {
 // NewEndpointsInformer constructs a new informer for Endpoints type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEndpointsInformer]).
 func NewEndpointsInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewEndpointsInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedEndpointsInformer constructs a new informer for Endpoints type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEndpointsInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EndpointsIndexers) EndpointsIndexInformer {
+	return NewTypedEndpointsInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredEndpointsInformer constructs a new informer for Endpoints type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredEndpointsInformer]).
 func NewFilteredEndpointsInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewEndpointsInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedEndpointsInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredEndpointsInformer constructs a new informer for Endpoints type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredEndpointsInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EndpointsIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) EndpointsIndexInformer {
+	return NewTypedEndpointsInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewEndpointsInformerWithOptions constructs a new informer for Endpoints type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEndpointsInformerWithOptions]).
 func NewEndpointsInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedEndpointsInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedEndpointsInformerWithOptions constructs a new informer for Endpoints type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEndpointsInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) EndpointsIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "endpointss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Endpoints](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewEndpointsInformerWithOptions(client kubernetes.Interface, namespace stri
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *endpointsInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewEndpointsInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedEndpointsInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *endpointsInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.Endpoints{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *endpointsInformer) TypedInformer() EndpointsIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Endpoints](f.factory.InformerFor(&apicorev1.Endpoints{}, f.defaultInformer))
 }
 
 func (f *endpointsInformer) Lister() corev1.EndpointsLister {
 	return corev1.NewEndpointsLister(f.Informer().GetIndexer())
 }
+
+// ToTypedEndpointsInformer converts an untyped informer into a TypedEndpointsInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Endpoints. If that is not the case, calling type-safe methods of the returned
+// TypedEndpointsInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedEndpointsInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedEndpointsInformer(informer EndpointsInformer) TypedEndpointsInformer {
+	if informer, ok := informer.(TypedEndpointsInformer); ok {
+		return informer
+	}
+	return &endpointsTypedInformerAdapter{informer}
+}
+
+type endpointsTypedInformerAdapter struct {
+	EndpointsInformer
+}
+
+func (a *endpointsTypedInformerAdapter) TypedInformer() EndpointsIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Endpoints](a.Informer())
+}
+
+// ToEndpointsIndexInformer converts an untyped informer into a EndpointsIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Endpoints. If that is not the case, calling type-safe methods of the returned
+// EndpointsIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a EndpointsIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToEndpointsIndexInformer(informer cache.SharedIndexInformer) EndpointsIndexInformer {
+	if informer, ok := informer.(EndpointsIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Endpoints](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/event.go b/vendor/k8s.io/client-go/informers/core/v1/event.go
index ff9c3c5847..65c078565a 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/event.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/event.go
@@ -34,12 +34,40 @@ import (
 )
 
 // EventInformer provides access to a shared informer and lister for
-// Events.
+// Events. Prefer using the type-safe variant (see [TypedEventInformer]).
 type EventInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.EventLister
 }
 
+// TypedEventInformer provides access to a shared informer and lister for
+// Events, including the type-safe TypedInformer variant.
+// It is a superset of EventInformer.
+type TypedEventInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() EventIndexInformer
+	Lister() corev1.EventLister
+}
+
+// EventIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type EventIndexInformer cache.TypedSharedIndexInformer[*apicorev1.Event]
+
+// EventHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Event.
+type EventHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.Event]
+
+// EventDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Event.
+type EventDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.Event]
+
+// EventFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Event.
+type EventFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.Event]
+
+// EventIndexers is a specialization of [cache.TypedIndexers] for Event.
+type EventIndexers = cache.TypedIndexers[*apicorev1.Event]
+
+// DeletedEvent is a specialization of [cache.DeletedObject] for Event.
+type DeletedEvent = cache.DeletedObject[*apicorev1.Event]
+
 type eventInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type eventInformer struct {
 // NewEventInformer constructs a new informer for Event type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEventInformer]).
 func NewEventInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewEventInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedEventInformer constructs a new informer for Event type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEventInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EventIndexers) EventIndexInformer {
+	return NewTypedEventInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredEventInformer constructs a new informer for Event type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredEventInformer]).
 func NewFilteredEventInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewEventInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedEventInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredEventInformer constructs a new informer for Event type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredEventInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EventIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) EventIndexInformer {
+	return NewTypedEventInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewEventInformerWithOptions constructs a new informer for Event type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEventInformerWithOptions]).
 func NewEventInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedEventInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedEventInformerWithOptions constructs a new informer for Event type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEventInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) EventIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "events"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Event](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewEventInformerWithOptions(client kubernetes.Interface, namespace string,
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *eventInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewEventInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedEventInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *eventInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.Event{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *eventInformer) TypedInformer() EventIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Event](f.factory.InformerFor(&apicorev1.Event{}, f.defaultInformer))
 }
 
 func (f *eventInformer) Lister() corev1.EventLister {
 	return corev1.NewEventLister(f.Informer().GetIndexer())
 }
+
+// ToTypedEventInformer converts an untyped informer into a TypedEventInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Event. If that is not the case, calling type-safe methods of the returned
+// TypedEventInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedEventInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedEventInformer(informer EventInformer) TypedEventInformer {
+	if informer, ok := informer.(TypedEventInformer); ok {
+		return informer
+	}
+	return &eventTypedInformerAdapter{informer}
+}
+
+type eventTypedInformerAdapter struct {
+	EventInformer
+}
+
+func (a *eventTypedInformerAdapter) TypedInformer() EventIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Event](a.Informer())
+}
+
+// ToEventIndexInformer converts an untyped informer into a EventIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Event. If that is not the case, calling type-safe methods of the returned
+// EventIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a EventIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToEventIndexInformer(informer cache.SharedIndexInformer) EventIndexInformer {
+	if informer, ok := informer.(EventIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Event](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/interface.go b/vendor/k8s.io/client-go/informers/core/v1/interface.go
index b2216a05c8..a951b30bd1 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/interface.go
@@ -25,37 +25,37 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// ComponentStatuses returns a ComponentStatusInformer.
-	ComponentStatuses() ComponentStatusInformer
+	ComponentStatuses() TypedComponentStatusInformer
 	// ConfigMaps returns a ConfigMapInformer.
-	ConfigMaps() ConfigMapInformer
+	ConfigMaps() TypedConfigMapInformer
 	// Endpoints returns a EndpointsInformer.
-	Endpoints() EndpointsInformer
+	Endpoints() TypedEndpointsInformer
 	// Events returns a EventInformer.
-	Events() EventInformer
+	Events() TypedEventInformer
 	// LimitRanges returns a LimitRangeInformer.
-	LimitRanges() LimitRangeInformer
+	LimitRanges() TypedLimitRangeInformer
 	// Namespaces returns a NamespaceInformer.
-	Namespaces() NamespaceInformer
+	Namespaces() TypedNamespaceInformer
 	// Nodes returns a NodeInformer.
-	Nodes() NodeInformer
+	Nodes() TypedNodeInformer
 	// PersistentVolumes returns a PersistentVolumeInformer.
-	PersistentVolumes() PersistentVolumeInformer
+	PersistentVolumes() TypedPersistentVolumeInformer
 	// PersistentVolumeClaims returns a PersistentVolumeClaimInformer.
-	PersistentVolumeClaims() PersistentVolumeClaimInformer
+	PersistentVolumeClaims() TypedPersistentVolumeClaimInformer
 	// Pods returns a PodInformer.
-	Pods() PodInformer
+	Pods() TypedPodInformer
 	// PodTemplates returns a PodTemplateInformer.
-	PodTemplates() PodTemplateInformer
+	PodTemplates() TypedPodTemplateInformer
 	// ReplicationControllers returns a ReplicationControllerInformer.
-	ReplicationControllers() ReplicationControllerInformer
+	ReplicationControllers() TypedReplicationControllerInformer
 	// ResourceQuotas returns a ResourceQuotaInformer.
-	ResourceQuotas() ResourceQuotaInformer
+	ResourceQuotas() TypedResourceQuotaInformer
 	// Secrets returns a SecretInformer.
-	Secrets() SecretInformer
+	Secrets() TypedSecretInformer
 	// Services returns a ServiceInformer.
-	Services() ServiceInformer
+	Services() TypedServiceInformer
 	// ServiceAccounts returns a ServiceAccountInformer.
-	ServiceAccounts() ServiceAccountInformer
+	ServiceAccounts() TypedServiceAccountInformer
 }
 
 type version struct {
@@ -69,82 +69,82 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// ComponentStatuses returns a ComponentStatusInformer.
-func (v *version) ComponentStatuses() ComponentStatusInformer {
+// ComponentStatuses returns a TypedComponentStatusInformer.
+func (v *version) ComponentStatuses() TypedComponentStatusInformer {
 	return &componentStatusInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ConfigMaps returns a ConfigMapInformer.
-func (v *version) ConfigMaps() ConfigMapInformer {
+// ConfigMaps returns a TypedConfigMapInformer.
+func (v *version) ConfigMaps() TypedConfigMapInformer {
 	return &configMapInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// Endpoints returns a EndpointsInformer.
-func (v *version) Endpoints() EndpointsInformer {
+// Endpoints returns a TypedEndpointsInformer.
+func (v *version) Endpoints() TypedEndpointsInformer {
 	return &endpointsInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// Events returns a EventInformer.
-func (v *version) Events() EventInformer {
+// Events returns a TypedEventInformer.
+func (v *version) Events() TypedEventInformer {
 	return &eventInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// LimitRanges returns a LimitRangeInformer.
-func (v *version) LimitRanges() LimitRangeInformer {
+// LimitRanges returns a TypedLimitRangeInformer.
+func (v *version) LimitRanges() TypedLimitRangeInformer {
 	return &limitRangeInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// Namespaces returns a NamespaceInformer.
-func (v *version) Namespaces() NamespaceInformer {
+// Namespaces returns a TypedNamespaceInformer.
+func (v *version) Namespaces() TypedNamespaceInformer {
 	return &namespaceInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Nodes returns a NodeInformer.
-func (v *version) Nodes() NodeInformer {
+// Nodes returns a TypedNodeInformer.
+func (v *version) Nodes() TypedNodeInformer {
 	return &nodeInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// PersistentVolumes returns a PersistentVolumeInformer.
-func (v *version) PersistentVolumes() PersistentVolumeInformer {
+// PersistentVolumes returns a TypedPersistentVolumeInformer.
+func (v *version) PersistentVolumes() TypedPersistentVolumeInformer {
 	return &persistentVolumeInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// PersistentVolumeClaims returns a PersistentVolumeClaimInformer.
-func (v *version) PersistentVolumeClaims() PersistentVolumeClaimInformer {
+// PersistentVolumeClaims returns a TypedPersistentVolumeClaimInformer.
+func (v *version) PersistentVolumeClaims() TypedPersistentVolumeClaimInformer {
 	return &persistentVolumeClaimInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// Pods returns a PodInformer.
-func (v *version) Pods() PodInformer {
+// Pods returns a TypedPodInformer.
+func (v *version) Pods() TypedPodInformer {
 	return &podInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// PodTemplates returns a PodTemplateInformer.
-func (v *version) PodTemplates() PodTemplateInformer {
+// PodTemplates returns a TypedPodTemplateInformer.
+func (v *version) PodTemplates() TypedPodTemplateInformer {
 	return &podTemplateInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// ReplicationControllers returns a ReplicationControllerInformer.
-func (v *version) ReplicationControllers() ReplicationControllerInformer {
+// ReplicationControllers returns a TypedReplicationControllerInformer.
+func (v *version) ReplicationControllers() TypedReplicationControllerInformer {
 	return &replicationControllerInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// ResourceQuotas returns a ResourceQuotaInformer.
-func (v *version) ResourceQuotas() ResourceQuotaInformer {
+// ResourceQuotas returns a TypedResourceQuotaInformer.
+func (v *version) ResourceQuotas() TypedResourceQuotaInformer {
 	return &resourceQuotaInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// Secrets returns a SecretInformer.
-func (v *version) Secrets() SecretInformer {
+// Secrets returns a TypedSecretInformer.
+func (v *version) Secrets() TypedSecretInformer {
 	return &secretInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// Services returns a ServiceInformer.
-func (v *version) Services() ServiceInformer {
+// Services returns a TypedServiceInformer.
+func (v *version) Services() TypedServiceInformer {
 	return &serviceInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// ServiceAccounts returns a ServiceAccountInformer.
-func (v *version) ServiceAccounts() ServiceAccountInformer {
+// ServiceAccounts returns a TypedServiceAccountInformer.
+func (v *version) ServiceAccounts() TypedServiceAccountInformer {
 	return &serviceAccountInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/core/v1/limitrange.go b/vendor/k8s.io/client-go/informers/core/v1/limitrange.go
index a3a01de6dc..a71e4496bc 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/limitrange.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/limitrange.go
@@ -34,12 +34,40 @@ import (
 )
 
 // LimitRangeInformer provides access to a shared informer and lister for
-// LimitRanges.
+// LimitRanges. Prefer using the type-safe variant (see [TypedLimitRangeInformer]).
 type LimitRangeInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.LimitRangeLister
 }
 
+// TypedLimitRangeInformer provides access to a shared informer and lister for
+// LimitRanges, including the type-safe TypedInformer variant.
+// It is a superset of LimitRangeInformer.
+type TypedLimitRangeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() LimitRangeIndexInformer
+	Lister() corev1.LimitRangeLister
+}
+
+// LimitRangeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type LimitRangeIndexInformer cache.TypedSharedIndexInformer[*apicorev1.LimitRange]
+
+// LimitRangeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for LimitRange.
+type LimitRangeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.LimitRange]
+
+// LimitRangeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for LimitRange.
+type LimitRangeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.LimitRange]
+
+// LimitRangeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for LimitRange.
+type LimitRangeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.LimitRange]
+
+// LimitRangeIndexers is a specialization of [cache.TypedIndexers] for LimitRange.
+type LimitRangeIndexers = cache.TypedIndexers[*apicorev1.LimitRange]
+
+// DeletedLimitRange is a specialization of [cache.DeletedObject] for LimitRange.
+type DeletedLimitRange = cache.DeletedObject[*apicorev1.LimitRange]
+
 type limitRangeInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type limitRangeInformer struct {
 // NewLimitRangeInformer constructs a new informer for LimitRange type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedLimitRangeInformer]).
 func NewLimitRangeInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewLimitRangeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedLimitRangeInformer constructs a new informer for LimitRange type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedLimitRangeInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers LimitRangeIndexers) LimitRangeIndexInformer {
+	return NewTypedLimitRangeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredLimitRangeInformer constructs a new informer for LimitRange type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredLimitRangeInformer]).
 func NewFilteredLimitRangeInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewLimitRangeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedLimitRangeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredLimitRangeInformer constructs a new informer for LimitRange type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredLimitRangeInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers LimitRangeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) LimitRangeIndexInformer {
+	return NewTypedLimitRangeInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewLimitRangeInformerWithOptions constructs a new informer for LimitRange type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedLimitRangeInformerWithOptions]).
 func NewLimitRangeInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedLimitRangeInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedLimitRangeInformerWithOptions constructs a new informer for LimitRange type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedLimitRangeInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) LimitRangeIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "limitranges"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.LimitRange](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewLimitRangeInformerWithOptions(client kubernetes.Interface, namespace str
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *limitRangeInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewLimitRangeInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedLimitRangeInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *limitRangeInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.LimitRange{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *limitRangeInformer) TypedInformer() LimitRangeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.LimitRange](f.factory.InformerFor(&apicorev1.LimitRange{}, f.defaultInformer))
 }
 
 func (f *limitRangeInformer) Lister() corev1.LimitRangeLister {
 	return corev1.NewLimitRangeLister(f.Informer().GetIndexer())
 }
+
+// ToTypedLimitRangeInformer converts an untyped informer into a TypedLimitRangeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *LimitRange. If that is not the case, calling type-safe methods of the returned
+// TypedLimitRangeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedLimitRangeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedLimitRangeInformer(informer LimitRangeInformer) TypedLimitRangeInformer {
+	if informer, ok := informer.(TypedLimitRangeInformer); ok {
+		return informer
+	}
+	return &limitRangeTypedInformerAdapter{informer}
+}
+
+type limitRangeTypedInformerAdapter struct {
+	LimitRangeInformer
+}
+
+func (a *limitRangeTypedInformerAdapter) TypedInformer() LimitRangeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.LimitRange](a.Informer())
+}
+
+// ToLimitRangeIndexInformer converts an untyped informer into a LimitRangeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *LimitRange. If that is not the case, calling type-safe methods of the returned
+// LimitRangeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a LimitRangeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToLimitRangeIndexInformer(informer cache.SharedIndexInformer) LimitRangeIndexInformer {
+	if informer, ok := informer.(LimitRangeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.LimitRange](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/namespace.go b/vendor/k8s.io/client-go/informers/core/v1/namespace.go
index c2a9894417..38d12c9b37 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/namespace.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/namespace.go
@@ -34,12 +34,40 @@ import (
 )
 
 // NamespaceInformer provides access to a shared informer and lister for
-// Namespaces.
+// Namespaces. Prefer using the type-safe variant (see [TypedNamespaceInformer]).
 type NamespaceInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.NamespaceLister
 }
 
+// TypedNamespaceInformer provides access to a shared informer and lister for
+// Namespaces, including the type-safe TypedInformer variant.
+// It is a superset of NamespaceInformer.
+type TypedNamespaceInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() NamespaceIndexInformer
+	Lister() corev1.NamespaceLister
+}
+
+// NamespaceIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type NamespaceIndexInformer cache.TypedSharedIndexInformer[*apicorev1.Namespace]
+
+// NamespaceHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Namespace.
+type NamespaceHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.Namespace]
+
+// NamespaceDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Namespace.
+type NamespaceDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.Namespace]
+
+// NamespaceFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Namespace.
+type NamespaceFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.Namespace]
+
+// NamespaceIndexers is a specialization of [cache.TypedIndexers] for Namespace.
+type NamespaceIndexers = cache.TypedIndexers[*apicorev1.Namespace]
+
+// DeletedNamespace is a specialization of [cache.DeletedObject] for Namespace.
+type DeletedNamespace = cache.DeletedObject[*apicorev1.Namespace]
+
 type namespaceInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type namespaceInformer struct {
 // NewNamespaceInformer constructs a new informer for Namespace type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedNamespaceInformer]).
 func NewNamespaceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewNamespaceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedNamespaceInformer constructs a new informer for Namespace type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedNamespaceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers NamespaceIndexers) NamespaceIndexInformer {
+	return NewTypedNamespaceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredNamespaceInformer constructs a new informer for Namespace type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredNamespaceInformer]).
 func NewFilteredNamespaceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewNamespaceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedNamespaceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredNamespaceInformer constructs a new informer for Namespace type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredNamespaceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers NamespaceIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) NamespaceIndexInformer {
+	return NewTypedNamespaceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewNamespaceInformerWithOptions constructs a new informer for Namespace type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedNamespaceInformerWithOptions]).
 func NewNamespaceInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedNamespaceInformerWithOptions(client, options)
+}
+
+// NewTypedNamespaceInformerWithOptions constructs a new informer for Namespace type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedNamespaceInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) NamespaceIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "namespaces"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Namespace](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewNamespaceInformerWithOptions(client kubernetes.Interface, options intern
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *namespaceInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewNamespaceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedNamespaceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *namespaceInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.Namespace{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *namespaceInformer) TypedInformer() NamespaceIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Namespace](f.factory.InformerFor(&apicorev1.Namespace{}, f.defaultInformer))
 }
 
 func (f *namespaceInformer) Lister() corev1.NamespaceLister {
 	return corev1.NewNamespaceLister(f.Informer().GetIndexer())
 }
+
+// ToTypedNamespaceInformer converts an untyped informer into a TypedNamespaceInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Namespace. If that is not the case, calling type-safe methods of the returned
+// TypedNamespaceInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedNamespaceInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedNamespaceInformer(informer NamespaceInformer) TypedNamespaceInformer {
+	if informer, ok := informer.(TypedNamespaceInformer); ok {
+		return informer
+	}
+	return &namespaceTypedInformerAdapter{informer}
+}
+
+type namespaceTypedInformerAdapter struct {
+	NamespaceInformer
+}
+
+func (a *namespaceTypedInformerAdapter) TypedInformer() NamespaceIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Namespace](a.Informer())
+}
+
+// ToNamespaceIndexInformer converts an untyped informer into a NamespaceIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Namespace. If that is not the case, calling type-safe methods of the returned
+// NamespaceIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a NamespaceIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToNamespaceIndexInformer(informer cache.SharedIndexInformer) NamespaceIndexInformer {
+	if informer, ok := informer.(NamespaceIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Namespace](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/node.go b/vendor/k8s.io/client-go/informers/core/v1/node.go
index 48e8d7d6aa..9e706202f3 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/node.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/node.go
@@ -34,12 +34,40 @@ import (
 )
 
 // NodeInformer provides access to a shared informer and lister for
-// Nodes.
+// Nodes. Prefer using the type-safe variant (see [TypedNodeInformer]).
 type NodeInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.NodeLister
 }
 
+// TypedNodeInformer provides access to a shared informer and lister for
+// Nodes, including the type-safe TypedInformer variant.
+// It is a superset of NodeInformer.
+type TypedNodeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() NodeIndexInformer
+	Lister() corev1.NodeLister
+}
+
+// NodeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type NodeIndexInformer cache.TypedSharedIndexInformer[*apicorev1.Node]
+
+// NodeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Node.
+type NodeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.Node]
+
+// NodeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Node.
+type NodeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.Node]
+
+// NodeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Node.
+type NodeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.Node]
+
+// NodeIndexers is a specialization of [cache.TypedIndexers] for Node.
+type NodeIndexers = cache.TypedIndexers[*apicorev1.Node]
+
+// DeletedNode is a specialization of [cache.DeletedObject] for Node.
+type DeletedNode = cache.DeletedObject[*apicorev1.Node]
+
 type nodeInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type nodeInformer struct {
 // NewNodeInformer constructs a new informer for Node type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedNodeInformer]).
 func NewNodeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewNodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedNodeInformer constructs a new informer for Node type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedNodeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers NodeIndexers) NodeIndexInformer {
+	return NewTypedNodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredNodeInformer constructs a new informer for Node type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredNodeInformer]).
 func NewFilteredNodeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewNodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedNodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredNodeInformer constructs a new informer for Node type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredNodeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers NodeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) NodeIndexInformer {
+	return NewTypedNodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewNodeInformerWithOptions constructs a new informer for Node type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedNodeInformerWithOptions]).
 func NewNodeInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedNodeInformerWithOptions(client, options)
+}
+
+// NewTypedNodeInformerWithOptions constructs a new informer for Node type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedNodeInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) NodeIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "nodes"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Node](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewNodeInformerWithOptions(client kubernetes.Interface, options internalint
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *nodeInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewNodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedNodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *nodeInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.Node{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *nodeInformer) TypedInformer() NodeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Node](f.factory.InformerFor(&apicorev1.Node{}, f.defaultInformer))
 }
 
 func (f *nodeInformer) Lister() corev1.NodeLister {
 	return corev1.NewNodeLister(f.Informer().GetIndexer())
 }
+
+// ToTypedNodeInformer converts an untyped informer into a TypedNodeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Node. If that is not the case, calling type-safe methods of the returned
+// TypedNodeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedNodeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedNodeInformer(informer NodeInformer) TypedNodeInformer {
+	if informer, ok := informer.(TypedNodeInformer); ok {
+		return informer
+	}
+	return &nodeTypedInformerAdapter{informer}
+}
+
+type nodeTypedInformerAdapter struct {
+	NodeInformer
+}
+
+func (a *nodeTypedInformerAdapter) TypedInformer() NodeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Node](a.Informer())
+}
+
+// ToNodeIndexInformer converts an untyped informer into a NodeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Node. If that is not the case, calling type-safe methods of the returned
+// NodeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a NodeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToNodeIndexInformer(informer cache.SharedIndexInformer) NodeIndexInformer {
+	if informer, ok := informer.(NodeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Node](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/persistentvolume.go b/vendor/k8s.io/client-go/informers/core/v1/persistentvolume.go
index aebe7ffa81..d55333ce82 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/persistentvolume.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/persistentvolume.go
@@ -34,12 +34,40 @@ import (
 )
 
 // PersistentVolumeInformer provides access to a shared informer and lister for
-// PersistentVolumes.
+// PersistentVolumes. Prefer using the type-safe variant (see [TypedPersistentVolumeInformer]).
 type PersistentVolumeInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.PersistentVolumeLister
 }
 
+// TypedPersistentVolumeInformer provides access to a shared informer and lister for
+// PersistentVolumes, including the type-safe TypedInformer variant.
+// It is a superset of PersistentVolumeInformer.
+type TypedPersistentVolumeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PersistentVolumeIndexInformer
+	Lister() corev1.PersistentVolumeLister
+}
+
+// PersistentVolumeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PersistentVolumeIndexInformer cache.TypedSharedIndexInformer[*apicorev1.PersistentVolume]
+
+// PersistentVolumeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for PersistentVolume.
+type PersistentVolumeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.PersistentVolume]
+
+// PersistentVolumeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for PersistentVolume.
+type PersistentVolumeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.PersistentVolume]
+
+// PersistentVolumeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for PersistentVolume.
+type PersistentVolumeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.PersistentVolume]
+
+// PersistentVolumeIndexers is a specialization of [cache.TypedIndexers] for PersistentVolume.
+type PersistentVolumeIndexers = cache.TypedIndexers[*apicorev1.PersistentVolume]
+
+// DeletedPersistentVolume is a specialization of [cache.DeletedObject] for PersistentVolume.
+type DeletedPersistentVolume = cache.DeletedObject[*apicorev1.PersistentVolume]
+
 type persistentVolumeInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type persistentVolumeInformer struct {
 // NewPersistentVolumeInformer constructs a new informer for PersistentVolume type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPersistentVolumeInformer]).
 func NewPersistentVolumeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewPersistentVolumeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedPersistentVolumeInformer constructs a new informer for PersistentVolume type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPersistentVolumeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers PersistentVolumeIndexers) PersistentVolumeIndexInformer {
+	return NewTypedPersistentVolumeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredPersistentVolumeInformer constructs a new informer for PersistentVolume type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPersistentVolumeInformer]).
 func NewFilteredPersistentVolumeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewPersistentVolumeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedPersistentVolumeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPersistentVolumeInformer constructs a new informer for PersistentVolume type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPersistentVolumeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers PersistentVolumeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PersistentVolumeIndexInformer {
+	return NewTypedPersistentVolumeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewPersistentVolumeInformerWithOptions constructs a new informer for PersistentVolume type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPersistentVolumeInformerWithOptions]).
 func NewPersistentVolumeInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPersistentVolumeInformerWithOptions(client, options)
+}
+
+// NewTypedPersistentVolumeInformerWithOptions constructs a new informer for PersistentVolume type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPersistentVolumeInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) PersistentVolumeIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "persistentvolumes"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.PersistentVolume](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewPersistentVolumeInformerWithOptions(client kubernetes.Interface, options
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *persistentVolumeInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewPersistentVolumeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedPersistentVolumeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *persistentVolumeInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.PersistentVolume{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *persistentVolumeInformer) TypedInformer() PersistentVolumeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.PersistentVolume](f.factory.InformerFor(&apicorev1.PersistentVolume{}, f.defaultInformer))
 }
 
 func (f *persistentVolumeInformer) Lister() corev1.PersistentVolumeLister {
 	return corev1.NewPersistentVolumeLister(f.Informer().GetIndexer())
 }
+
+// ToTypedPersistentVolumeInformer converts an untyped informer into a TypedPersistentVolumeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PersistentVolume. If that is not the case, calling type-safe methods of the returned
+// TypedPersistentVolumeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPersistentVolumeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPersistentVolumeInformer(informer PersistentVolumeInformer) TypedPersistentVolumeInformer {
+	if informer, ok := informer.(TypedPersistentVolumeInformer); ok {
+		return informer
+	}
+	return &persistentVolumeTypedInformerAdapter{informer}
+}
+
+type persistentVolumeTypedInformerAdapter struct {
+	PersistentVolumeInformer
+}
+
+func (a *persistentVolumeTypedInformerAdapter) TypedInformer() PersistentVolumeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.PersistentVolume](a.Informer())
+}
+
+// ToPersistentVolumeIndexInformer converts an untyped informer into a PersistentVolumeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PersistentVolume. If that is not the case, calling type-safe methods of the returned
+// PersistentVolumeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PersistentVolumeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPersistentVolumeIndexInformer(informer cache.SharedIndexInformer) PersistentVolumeIndexInformer {
+	if informer, ok := informer.(PersistentVolumeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.PersistentVolume](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/persistentvolumeclaim.go b/vendor/k8s.io/client-go/informers/core/v1/persistentvolumeclaim.go
index 973b5571ed..c14ab0d8eb 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/persistentvolumeclaim.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/persistentvolumeclaim.go
@@ -34,12 +34,40 @@ import (
 )
 
 // PersistentVolumeClaimInformer provides access to a shared informer and lister for
-// PersistentVolumeClaims.
+// PersistentVolumeClaims. Prefer using the type-safe variant (see [TypedPersistentVolumeClaimInformer]).
 type PersistentVolumeClaimInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.PersistentVolumeClaimLister
 }
 
+// TypedPersistentVolumeClaimInformer provides access to a shared informer and lister for
+// PersistentVolumeClaims, including the type-safe TypedInformer variant.
+// It is a superset of PersistentVolumeClaimInformer.
+type TypedPersistentVolumeClaimInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PersistentVolumeClaimIndexInformer
+	Lister() corev1.PersistentVolumeClaimLister
+}
+
+// PersistentVolumeClaimIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PersistentVolumeClaimIndexInformer cache.TypedSharedIndexInformer[*apicorev1.PersistentVolumeClaim]
+
+// PersistentVolumeClaimHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for PersistentVolumeClaim.
+type PersistentVolumeClaimHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.PersistentVolumeClaim]
+
+// PersistentVolumeClaimDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for PersistentVolumeClaim.
+type PersistentVolumeClaimDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.PersistentVolumeClaim]
+
+// PersistentVolumeClaimFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for PersistentVolumeClaim.
+type PersistentVolumeClaimFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.PersistentVolumeClaim]
+
+// PersistentVolumeClaimIndexers is a specialization of [cache.TypedIndexers] for PersistentVolumeClaim.
+type PersistentVolumeClaimIndexers = cache.TypedIndexers[*apicorev1.PersistentVolumeClaim]
+
+// DeletedPersistentVolumeClaim is a specialization of [cache.DeletedObject] for PersistentVolumeClaim.
+type DeletedPersistentVolumeClaim = cache.DeletedObject[*apicorev1.PersistentVolumeClaim]
+
 type persistentVolumeClaimInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type persistentVolumeClaimInformer struct {
 // NewPersistentVolumeClaimInformer constructs a new informer for PersistentVolumeClaim type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPersistentVolumeClaimInformer]).
 func NewPersistentVolumeClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewPersistentVolumeClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedPersistentVolumeClaimInformer constructs a new informer for PersistentVolumeClaim type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPersistentVolumeClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PersistentVolumeClaimIndexers) PersistentVolumeClaimIndexInformer {
+	return NewTypedPersistentVolumeClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredPersistentVolumeClaimInformer constructs a new informer for PersistentVolumeClaim type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPersistentVolumeClaimInformer]).
 func NewFilteredPersistentVolumeClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewPersistentVolumeClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedPersistentVolumeClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPersistentVolumeClaimInformer constructs a new informer for PersistentVolumeClaim type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPersistentVolumeClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PersistentVolumeClaimIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PersistentVolumeClaimIndexInformer {
+	return NewTypedPersistentVolumeClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewPersistentVolumeClaimInformerWithOptions constructs a new informer for PersistentVolumeClaim type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPersistentVolumeClaimInformerWithOptions]).
 func NewPersistentVolumeClaimInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPersistentVolumeClaimInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedPersistentVolumeClaimInformerWithOptions constructs a new informer for PersistentVolumeClaim type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPersistentVolumeClaimInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) PersistentVolumeClaimIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "persistentvolumeclaims"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.PersistentVolumeClaim](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewPersistentVolumeClaimInformerWithOptions(client kubernetes.Interface, na
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *persistentVolumeClaimInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewPersistentVolumeClaimInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedPersistentVolumeClaimInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *persistentVolumeClaimInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.PersistentVolumeClaim{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *persistentVolumeClaimInformer) TypedInformer() PersistentVolumeClaimIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.PersistentVolumeClaim](f.factory.InformerFor(&apicorev1.PersistentVolumeClaim{}, f.defaultInformer))
 }
 
 func (f *persistentVolumeClaimInformer) Lister() corev1.PersistentVolumeClaimLister {
 	return corev1.NewPersistentVolumeClaimLister(f.Informer().GetIndexer())
 }
+
+// ToTypedPersistentVolumeClaimInformer converts an untyped informer into a TypedPersistentVolumeClaimInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PersistentVolumeClaim. If that is not the case, calling type-safe methods of the returned
+// TypedPersistentVolumeClaimInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPersistentVolumeClaimInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPersistentVolumeClaimInformer(informer PersistentVolumeClaimInformer) TypedPersistentVolumeClaimInformer {
+	if informer, ok := informer.(TypedPersistentVolumeClaimInformer); ok {
+		return informer
+	}
+	return &persistentVolumeClaimTypedInformerAdapter{informer}
+}
+
+type persistentVolumeClaimTypedInformerAdapter struct {
+	PersistentVolumeClaimInformer
+}
+
+func (a *persistentVolumeClaimTypedInformerAdapter) TypedInformer() PersistentVolumeClaimIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.PersistentVolumeClaim](a.Informer())
+}
+
+// ToPersistentVolumeClaimIndexInformer converts an untyped informer into a PersistentVolumeClaimIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PersistentVolumeClaim. If that is not the case, calling type-safe methods of the returned
+// PersistentVolumeClaimIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PersistentVolumeClaimIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPersistentVolumeClaimIndexInformer(informer cache.SharedIndexInformer) PersistentVolumeClaimIndexInformer {
+	if informer, ok := informer.(PersistentVolumeClaimIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.PersistentVolumeClaim](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/pod.go b/vendor/k8s.io/client-go/informers/core/v1/pod.go
index f49dee3dee..dac8c6d0c6 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/pod.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/pod.go
@@ -34,12 +34,40 @@ import (
 )
 
 // PodInformer provides access to a shared informer and lister for
-// Pods.
+// Pods. Prefer using the type-safe variant (see [TypedPodInformer]).
 type PodInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.PodLister
 }
 
+// TypedPodInformer provides access to a shared informer and lister for
+// Pods, including the type-safe TypedInformer variant.
+// It is a superset of PodInformer.
+type TypedPodInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PodIndexInformer
+	Lister() corev1.PodLister
+}
+
+// PodIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PodIndexInformer cache.TypedSharedIndexInformer[*apicorev1.Pod]
+
+// PodHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Pod.
+type PodHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.Pod]
+
+// PodDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Pod.
+type PodDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.Pod]
+
+// PodFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Pod.
+type PodFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.Pod]
+
+// PodIndexers is a specialization of [cache.TypedIndexers] for Pod.
+type PodIndexers = cache.TypedIndexers[*apicorev1.Pod]
+
+// DeletedPod is a specialization of [cache.DeletedObject] for Pod.
+type DeletedPod = cache.DeletedObject[*apicorev1.Pod]
+
 type podInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type podInformer struct {
 // NewPodInformer constructs a new informer for Pod type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodInformer]).
 func NewPodInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewPodInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedPodInformer constructs a new informer for Pod type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodIndexers) PodIndexInformer {
+	return NewTypedPodInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredPodInformer constructs a new informer for Pod type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPodInformer]).
 func NewFilteredPodInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewPodInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedPodInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPodInformer constructs a new informer for Pod type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPodInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PodIndexInformer {
+	return NewTypedPodInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewPodInformerWithOptions constructs a new informer for Pod type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodInformerWithOptions]).
 func NewPodInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPodInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedPodInformerWithOptions constructs a new informer for Pod type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) PodIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Pod](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewPodInformerWithOptions(client kubernetes.Interface, namespace string, op
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *podInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewPodInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedPodInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *podInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.Pod{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *podInformer) TypedInformer() PodIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Pod](f.factory.InformerFor(&apicorev1.Pod{}, f.defaultInformer))
 }
 
 func (f *podInformer) Lister() corev1.PodLister {
 	return corev1.NewPodLister(f.Informer().GetIndexer())
 }
+
+// ToTypedPodInformer converts an untyped informer into a TypedPodInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Pod. If that is not the case, calling type-safe methods of the returned
+// TypedPodInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPodInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPodInformer(informer PodInformer) TypedPodInformer {
+	if informer, ok := informer.(TypedPodInformer); ok {
+		return informer
+	}
+	return &podTypedInformerAdapter{informer}
+}
+
+type podTypedInformerAdapter struct {
+	PodInformer
+}
+
+func (a *podTypedInformerAdapter) TypedInformer() PodIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Pod](a.Informer())
+}
+
+// ToPodIndexInformer converts an untyped informer into a PodIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Pod. If that is not the case, calling type-safe methods of the returned
+// PodIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PodIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPodIndexInformer(informer cache.SharedIndexInformer) PodIndexInformer {
+	if informer, ok := informer.(PodIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Pod](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/podtemplate.go b/vendor/k8s.io/client-go/informers/core/v1/podtemplate.go
index 940ae25999..4b705902a6 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/podtemplate.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/podtemplate.go
@@ -34,12 +34,40 @@ import (
 )
 
 // PodTemplateInformer provides access to a shared informer and lister for
-// PodTemplates.
+// PodTemplates. Prefer using the type-safe variant (see [TypedPodTemplateInformer]).
 type PodTemplateInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.PodTemplateLister
 }
 
+// TypedPodTemplateInformer provides access to a shared informer and lister for
+// PodTemplates, including the type-safe TypedInformer variant.
+// It is a superset of PodTemplateInformer.
+type TypedPodTemplateInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PodTemplateIndexInformer
+	Lister() corev1.PodTemplateLister
+}
+
+// PodTemplateIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PodTemplateIndexInformer cache.TypedSharedIndexInformer[*apicorev1.PodTemplate]
+
+// PodTemplateHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for PodTemplate.
+type PodTemplateHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.PodTemplate]
+
+// PodTemplateDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for PodTemplate.
+type PodTemplateDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.PodTemplate]
+
+// PodTemplateFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for PodTemplate.
+type PodTemplateFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.PodTemplate]
+
+// PodTemplateIndexers is a specialization of [cache.TypedIndexers] for PodTemplate.
+type PodTemplateIndexers = cache.TypedIndexers[*apicorev1.PodTemplate]
+
+// DeletedPodTemplate is a specialization of [cache.DeletedObject] for PodTemplate.
+type DeletedPodTemplate = cache.DeletedObject[*apicorev1.PodTemplate]
+
 type podTemplateInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type podTemplateInformer struct {
 // NewPodTemplateInformer constructs a new informer for PodTemplate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodTemplateInformer]).
 func NewPodTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewPodTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedPodTemplateInformer constructs a new informer for PodTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodTemplateIndexers) PodTemplateIndexInformer {
+	return NewTypedPodTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredPodTemplateInformer constructs a new informer for PodTemplate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPodTemplateInformer]).
 func NewFilteredPodTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewPodTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedPodTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPodTemplateInformer constructs a new informer for PodTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPodTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodTemplateIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PodTemplateIndexInformer {
+	return NewTypedPodTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewPodTemplateInformerWithOptions constructs a new informer for PodTemplate type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodTemplateInformerWithOptions]).
 func NewPodTemplateInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPodTemplateInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedPodTemplateInformerWithOptions constructs a new informer for PodTemplate type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodTemplateInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) PodTemplateIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "podtemplates"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.PodTemplate](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewPodTemplateInformerWithOptions(client kubernetes.Interface, namespace st
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *podTemplateInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewPodTemplateInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedPodTemplateInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *podTemplateInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.PodTemplate{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *podTemplateInformer) TypedInformer() PodTemplateIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.PodTemplate](f.factory.InformerFor(&apicorev1.PodTemplate{}, f.defaultInformer))
 }
 
 func (f *podTemplateInformer) Lister() corev1.PodTemplateLister {
 	return corev1.NewPodTemplateLister(f.Informer().GetIndexer())
 }
+
+// ToTypedPodTemplateInformer converts an untyped informer into a TypedPodTemplateInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PodTemplate. If that is not the case, calling type-safe methods of the returned
+// TypedPodTemplateInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPodTemplateInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPodTemplateInformer(informer PodTemplateInformer) TypedPodTemplateInformer {
+	if informer, ok := informer.(TypedPodTemplateInformer); ok {
+		return informer
+	}
+	return &podTemplateTypedInformerAdapter{informer}
+}
+
+type podTemplateTypedInformerAdapter struct {
+	PodTemplateInformer
+}
+
+func (a *podTemplateTypedInformerAdapter) TypedInformer() PodTemplateIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.PodTemplate](a.Informer())
+}
+
+// ToPodTemplateIndexInformer converts an untyped informer into a PodTemplateIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PodTemplate. If that is not the case, calling type-safe methods of the returned
+// PodTemplateIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PodTemplateIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPodTemplateIndexInformer(informer cache.SharedIndexInformer) PodTemplateIndexInformer {
+	if informer, ok := informer.(PodTemplateIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.PodTemplate](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/replicationcontroller.go b/vendor/k8s.io/client-go/informers/core/v1/replicationcontroller.go
index ec323d3c63..8612653d11 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/replicationcontroller.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/replicationcontroller.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ReplicationControllerInformer provides access to a shared informer and lister for
-// ReplicationControllers.
+// ReplicationControllers. Prefer using the type-safe variant (see [TypedReplicationControllerInformer]).
 type ReplicationControllerInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.ReplicationControllerLister
 }
 
+// TypedReplicationControllerInformer provides access to a shared informer and lister for
+// ReplicationControllers, including the type-safe TypedInformer variant.
+// It is a superset of ReplicationControllerInformer.
+type TypedReplicationControllerInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ReplicationControllerIndexInformer
+	Lister() corev1.ReplicationControllerLister
+}
+
+// ReplicationControllerIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ReplicationControllerIndexInformer cache.TypedSharedIndexInformer[*apicorev1.ReplicationController]
+
+// ReplicationControllerHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ReplicationController.
+type ReplicationControllerHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.ReplicationController]
+
+// ReplicationControllerDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ReplicationController.
+type ReplicationControllerDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.ReplicationController]
+
+// ReplicationControllerFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ReplicationController.
+type ReplicationControllerFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.ReplicationController]
+
+// ReplicationControllerIndexers is a specialization of [cache.TypedIndexers] for ReplicationController.
+type ReplicationControllerIndexers = cache.TypedIndexers[*apicorev1.ReplicationController]
+
+// DeletedReplicationController is a specialization of [cache.DeletedObject] for ReplicationController.
+type DeletedReplicationController = cache.DeletedObject[*apicorev1.ReplicationController]
+
 type replicationControllerInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type replicationControllerInformer struct {
 // NewReplicationControllerInformer constructs a new informer for ReplicationController type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedReplicationControllerInformer]).
 func NewReplicationControllerInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewReplicationControllerInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedReplicationControllerInformer constructs a new informer for ReplicationController type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedReplicationControllerInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ReplicationControllerIndexers) ReplicationControllerIndexInformer {
+	return NewTypedReplicationControllerInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredReplicationControllerInformer constructs a new informer for ReplicationController type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredReplicationControllerInformer]).
 func NewFilteredReplicationControllerInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewReplicationControllerInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedReplicationControllerInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredReplicationControllerInformer constructs a new informer for ReplicationController type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredReplicationControllerInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ReplicationControllerIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ReplicationControllerIndexInformer {
+	return NewTypedReplicationControllerInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewReplicationControllerInformerWithOptions constructs a new informer for ReplicationController type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedReplicationControllerInformerWithOptions]).
 func NewReplicationControllerInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedReplicationControllerInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedReplicationControllerInformerWithOptions constructs a new informer for ReplicationController type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedReplicationControllerInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ReplicationControllerIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "replicationcontrollers"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ReplicationController](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewReplicationControllerInformerWithOptions(client kubernetes.Interface, na
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *replicationControllerInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewReplicationControllerInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedReplicationControllerInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *replicationControllerInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.ReplicationController{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *replicationControllerInformer) TypedInformer() ReplicationControllerIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ReplicationController](f.factory.InformerFor(&apicorev1.ReplicationController{}, f.defaultInformer))
 }
 
 func (f *replicationControllerInformer) Lister() corev1.ReplicationControllerLister {
 	return corev1.NewReplicationControllerLister(f.Informer().GetIndexer())
 }
+
+// ToTypedReplicationControllerInformer converts an untyped informer into a TypedReplicationControllerInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ReplicationController. If that is not the case, calling type-safe methods of the returned
+// TypedReplicationControllerInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedReplicationControllerInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedReplicationControllerInformer(informer ReplicationControllerInformer) TypedReplicationControllerInformer {
+	if informer, ok := informer.(TypedReplicationControllerInformer); ok {
+		return informer
+	}
+	return &replicationControllerTypedInformerAdapter{informer}
+}
+
+type replicationControllerTypedInformerAdapter struct {
+	ReplicationControllerInformer
+}
+
+func (a *replicationControllerTypedInformerAdapter) TypedInformer() ReplicationControllerIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ReplicationController](a.Informer())
+}
+
+// ToReplicationControllerIndexInformer converts an untyped informer into a ReplicationControllerIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ReplicationController. If that is not the case, calling type-safe methods of the returned
+// ReplicationControllerIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ReplicationControllerIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToReplicationControllerIndexInformer(informer cache.SharedIndexInformer) ReplicationControllerIndexInformer {
+	if informer, ok := informer.(ReplicationControllerIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ReplicationController](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/resourcequota.go b/vendor/k8s.io/client-go/informers/core/v1/resourcequota.go
index 490a31212b..5726e484c0 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/resourcequota.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/resourcequota.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ResourceQuotaInformer provides access to a shared informer and lister for
-// ResourceQuotas.
+// ResourceQuotas. Prefer using the type-safe variant (see [TypedResourceQuotaInformer]).
 type ResourceQuotaInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.ResourceQuotaLister
 }
 
+// TypedResourceQuotaInformer provides access to a shared informer and lister for
+// ResourceQuotas, including the type-safe TypedInformer variant.
+// It is a superset of ResourceQuotaInformer.
+type TypedResourceQuotaInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ResourceQuotaIndexInformer
+	Lister() corev1.ResourceQuotaLister
+}
+
+// ResourceQuotaIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ResourceQuotaIndexInformer cache.TypedSharedIndexInformer[*apicorev1.ResourceQuota]
+
+// ResourceQuotaHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ResourceQuota.
+type ResourceQuotaHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.ResourceQuota]
+
+// ResourceQuotaDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ResourceQuota.
+type ResourceQuotaDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.ResourceQuota]
+
+// ResourceQuotaFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ResourceQuota.
+type ResourceQuotaFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.ResourceQuota]
+
+// ResourceQuotaIndexers is a specialization of [cache.TypedIndexers] for ResourceQuota.
+type ResourceQuotaIndexers = cache.TypedIndexers[*apicorev1.ResourceQuota]
+
+// DeletedResourceQuota is a specialization of [cache.DeletedObject] for ResourceQuota.
+type DeletedResourceQuota = cache.DeletedObject[*apicorev1.ResourceQuota]
+
 type resourceQuotaInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type resourceQuotaInformer struct {
 // NewResourceQuotaInformer constructs a new informer for ResourceQuota type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceQuotaInformer]).
 func NewResourceQuotaInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewResourceQuotaInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedResourceQuotaInformer constructs a new informer for ResourceQuota type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceQuotaInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ResourceQuotaIndexers) ResourceQuotaIndexInformer {
+	return NewTypedResourceQuotaInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredResourceQuotaInformer constructs a new informer for ResourceQuota type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredResourceQuotaInformer]).
 func NewFilteredResourceQuotaInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewResourceQuotaInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedResourceQuotaInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredResourceQuotaInformer constructs a new informer for ResourceQuota type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredResourceQuotaInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ResourceQuotaIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ResourceQuotaIndexInformer {
+	return NewTypedResourceQuotaInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewResourceQuotaInformerWithOptions constructs a new informer for ResourceQuota type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceQuotaInformerWithOptions]).
 func NewResourceQuotaInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedResourceQuotaInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedResourceQuotaInformerWithOptions constructs a new informer for ResourceQuota type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceQuotaInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ResourceQuotaIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "resourcequotas"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ResourceQuota](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewResourceQuotaInformerWithOptions(client kubernetes.Interface, namespace
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *resourceQuotaInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewResourceQuotaInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedResourceQuotaInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *resourceQuotaInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.ResourceQuota{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *resourceQuotaInformer) TypedInformer() ResourceQuotaIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ResourceQuota](f.factory.InformerFor(&apicorev1.ResourceQuota{}, f.defaultInformer))
 }
 
 func (f *resourceQuotaInformer) Lister() corev1.ResourceQuotaLister {
 	return corev1.NewResourceQuotaLister(f.Informer().GetIndexer())
 }
+
+// ToTypedResourceQuotaInformer converts an untyped informer into a TypedResourceQuotaInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceQuota. If that is not the case, calling type-safe methods of the returned
+// TypedResourceQuotaInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedResourceQuotaInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedResourceQuotaInformer(informer ResourceQuotaInformer) TypedResourceQuotaInformer {
+	if informer, ok := informer.(TypedResourceQuotaInformer); ok {
+		return informer
+	}
+	return &resourceQuotaTypedInformerAdapter{informer}
+}
+
+type resourceQuotaTypedInformerAdapter struct {
+	ResourceQuotaInformer
+}
+
+func (a *resourceQuotaTypedInformerAdapter) TypedInformer() ResourceQuotaIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ResourceQuota](a.Informer())
+}
+
+// ToResourceQuotaIndexInformer converts an untyped informer into a ResourceQuotaIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceQuota. If that is not the case, calling type-safe methods of the returned
+// ResourceQuotaIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ResourceQuotaIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToResourceQuotaIndexInformer(informer cache.SharedIndexInformer) ResourceQuotaIndexInformer {
+	if informer, ok := informer.(ResourceQuotaIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ResourceQuota](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/secret.go b/vendor/k8s.io/client-go/informers/core/v1/secret.go
index 86458285d9..ae75b7d22c 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/secret.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/secret.go
@@ -34,12 +34,40 @@ import (
 )
 
 // SecretInformer provides access to a shared informer and lister for
-// Secrets.
+// Secrets. Prefer using the type-safe variant (see [TypedSecretInformer]).
 type SecretInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.SecretLister
 }
 
+// TypedSecretInformer provides access to a shared informer and lister for
+// Secrets, including the type-safe TypedInformer variant.
+// It is a superset of SecretInformer.
+type TypedSecretInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() SecretIndexInformer
+	Lister() corev1.SecretLister
+}
+
+// SecretIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type SecretIndexInformer cache.TypedSharedIndexInformer[*apicorev1.Secret]
+
+// SecretHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Secret.
+type SecretHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.Secret]
+
+// SecretDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Secret.
+type SecretDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.Secret]
+
+// SecretFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Secret.
+type SecretFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.Secret]
+
+// SecretIndexers is a specialization of [cache.TypedIndexers] for Secret.
+type SecretIndexers = cache.TypedIndexers[*apicorev1.Secret]
+
+// DeletedSecret is a specialization of [cache.DeletedObject] for Secret.
+type DeletedSecret = cache.DeletedObject[*apicorev1.Secret]
+
 type secretInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type secretInformer struct {
 // NewSecretInformer constructs a new informer for Secret type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedSecretInformer]).
 func NewSecretInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewSecretInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedSecretInformer constructs a new informer for Secret type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedSecretInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers SecretIndexers) SecretIndexInformer {
+	return NewTypedSecretInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredSecretInformer constructs a new informer for Secret type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredSecretInformer]).
 func NewFilteredSecretInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewSecretInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedSecretInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredSecretInformer constructs a new informer for Secret type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredSecretInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers SecretIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) SecretIndexInformer {
+	return NewTypedSecretInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewSecretInformerWithOptions constructs a new informer for Secret type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedSecretInformerWithOptions]).
 func NewSecretInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedSecretInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedSecretInformerWithOptions constructs a new informer for Secret type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedSecretInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) SecretIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "secrets"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Secret](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewSecretInformerWithOptions(client kubernetes.Interface, namespace string,
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *secretInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewSecretInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedSecretInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *secretInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.Secret{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *secretInformer) TypedInformer() SecretIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Secret](f.factory.InformerFor(&apicorev1.Secret{}, f.defaultInformer))
 }
 
 func (f *secretInformer) Lister() corev1.SecretLister {
 	return corev1.NewSecretLister(f.Informer().GetIndexer())
 }
+
+// ToTypedSecretInformer converts an untyped informer into a TypedSecretInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Secret. If that is not the case, calling type-safe methods of the returned
+// TypedSecretInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedSecretInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedSecretInformer(informer SecretInformer) TypedSecretInformer {
+	if informer, ok := informer.(TypedSecretInformer); ok {
+		return informer
+	}
+	return &secretTypedInformerAdapter{informer}
+}
+
+type secretTypedInformerAdapter struct {
+	SecretInformer
+}
+
+func (a *secretTypedInformerAdapter) TypedInformer() SecretIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Secret](a.Informer())
+}
+
+// ToSecretIndexInformer converts an untyped informer into a SecretIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Secret. If that is not the case, calling type-safe methods of the returned
+// SecretIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a SecretIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToSecretIndexInformer(informer cache.SharedIndexInformer) SecretIndexInformer {
+	if informer, ok := informer.(SecretIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Secret](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/service.go b/vendor/k8s.io/client-go/informers/core/v1/service.go
index 4ec10b3227..0c804c0220 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/service.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/service.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ServiceInformer provides access to a shared informer and lister for
-// Services.
+// Services. Prefer using the type-safe variant (see [TypedServiceInformer]).
 type ServiceInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.ServiceLister
 }
 
+// TypedServiceInformer provides access to a shared informer and lister for
+// Services, including the type-safe TypedInformer variant.
+// It is a superset of ServiceInformer.
+type TypedServiceInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ServiceIndexInformer
+	Lister() corev1.ServiceLister
+}
+
+// ServiceIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ServiceIndexInformer cache.TypedSharedIndexInformer[*apicorev1.Service]
+
+// ServiceHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Service.
+type ServiceHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.Service]
+
+// ServiceDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Service.
+type ServiceDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.Service]
+
+// ServiceFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Service.
+type ServiceFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.Service]
+
+// ServiceIndexers is a specialization of [cache.TypedIndexers] for Service.
+type ServiceIndexers = cache.TypedIndexers[*apicorev1.Service]
+
+// DeletedService is a specialization of [cache.DeletedObject] for Service.
+type DeletedService = cache.DeletedObject[*apicorev1.Service]
+
 type serviceInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type serviceInformer struct {
 // NewServiceInformer constructs a new informer for Service type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedServiceInformer]).
 func NewServiceInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewServiceInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedServiceInformer constructs a new informer for Service type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedServiceInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ServiceIndexers) ServiceIndexInformer {
+	return NewTypedServiceInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredServiceInformer constructs a new informer for Service type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredServiceInformer]).
 func NewFilteredServiceInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewServiceInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedServiceInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredServiceInformer constructs a new informer for Service type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredServiceInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ServiceIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ServiceIndexInformer {
+	return NewTypedServiceInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewServiceInformerWithOptions constructs a new informer for Service type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedServiceInformerWithOptions]).
 func NewServiceInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedServiceInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedServiceInformerWithOptions constructs a new informer for Service type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedServiceInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ServiceIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "services"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Service](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewServiceInformerWithOptions(client kubernetes.Interface, namespace string
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *serviceInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewServiceInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedServiceInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *serviceInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.Service{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *serviceInformer) TypedInformer() ServiceIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Service](f.factory.InformerFor(&apicorev1.Service{}, f.defaultInformer))
 }
 
 func (f *serviceInformer) Lister() corev1.ServiceLister {
 	return corev1.NewServiceLister(f.Informer().GetIndexer())
 }
+
+// ToTypedServiceInformer converts an untyped informer into a TypedServiceInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Service. If that is not the case, calling type-safe methods of the returned
+// TypedServiceInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedServiceInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedServiceInformer(informer ServiceInformer) TypedServiceInformer {
+	if informer, ok := informer.(TypedServiceInformer); ok {
+		return informer
+	}
+	return &serviceTypedInformerAdapter{informer}
+}
+
+type serviceTypedInformerAdapter struct {
+	ServiceInformer
+}
+
+func (a *serviceTypedInformerAdapter) TypedInformer() ServiceIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Service](a.Informer())
+}
+
+// ToServiceIndexInformer converts an untyped informer into a ServiceIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Service. If that is not the case, calling type-safe methods of the returned
+// ServiceIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ServiceIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToServiceIndexInformer(informer cache.SharedIndexInformer) ServiceIndexInformer {
+	if informer, ok := informer.(ServiceIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.Service](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/core/v1/serviceaccount.go b/vendor/k8s.io/client-go/informers/core/v1/serviceaccount.go
index 32751b6a38..6ca3cf6856 100644
--- a/vendor/k8s.io/client-go/informers/core/v1/serviceaccount.go
+++ b/vendor/k8s.io/client-go/informers/core/v1/serviceaccount.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ServiceAccountInformer provides access to a shared informer and lister for
-// ServiceAccounts.
+// ServiceAccounts. Prefer using the type-safe variant (see [TypedServiceAccountInformer]).
 type ServiceAccountInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() corev1.ServiceAccountLister
 }
 
+// TypedServiceAccountInformer provides access to a shared informer and lister for
+// ServiceAccounts, including the type-safe TypedInformer variant.
+// It is a superset of ServiceAccountInformer.
+type TypedServiceAccountInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ServiceAccountIndexInformer
+	Lister() corev1.ServiceAccountLister
+}
+
+// ServiceAccountIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ServiceAccountIndexInformer cache.TypedSharedIndexInformer[*apicorev1.ServiceAccount]
+
+// ServiceAccountHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ServiceAccount.
+type ServiceAccountHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apicorev1.ServiceAccount]
+
+// ServiceAccountDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ServiceAccount.
+type ServiceAccountDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apicorev1.ServiceAccount]
+
+// ServiceAccountFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ServiceAccount.
+type ServiceAccountFilteringHandler = cache.TypedFilteringResourceEventHandler[*apicorev1.ServiceAccount]
+
+// ServiceAccountIndexers is a specialization of [cache.TypedIndexers] for ServiceAccount.
+type ServiceAccountIndexers = cache.TypedIndexers[*apicorev1.ServiceAccount]
+
+// DeletedServiceAccount is a specialization of [cache.DeletedObject] for ServiceAccount.
+type DeletedServiceAccount = cache.DeletedObject[*apicorev1.ServiceAccount]
+
 type serviceAccountInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type serviceAccountInformer struct {
 // NewServiceAccountInformer constructs a new informer for ServiceAccount type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedServiceAccountInformer]).
 func NewServiceAccountInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewServiceAccountInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedServiceAccountInformer constructs a new informer for ServiceAccount type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedServiceAccountInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ServiceAccountIndexers) ServiceAccountIndexInformer {
+	return NewTypedServiceAccountInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredServiceAccountInformer constructs a new informer for ServiceAccount type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredServiceAccountInformer]).
 func NewFilteredServiceAccountInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewServiceAccountInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedServiceAccountInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredServiceAccountInformer constructs a new informer for ServiceAccount type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredServiceAccountInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ServiceAccountIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ServiceAccountIndexInformer {
+	return NewTypedServiceAccountInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewServiceAccountInformerWithOptions constructs a new informer for ServiceAccount type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedServiceAccountInformerWithOptions]).
 func NewServiceAccountInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedServiceAccountInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedServiceAccountInformerWithOptions constructs a new informer for ServiceAccount type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedServiceAccountInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ServiceAccountIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "", Version: "v1", Resource: "serviceaccounts"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ServiceAccount](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewServiceAccountInformerWithOptions(client kubernetes.Interface, namespace
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *serviceAccountInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewServiceAccountInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedServiceAccountInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *serviceAccountInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apicorev1.ServiceAccount{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *serviceAccountInformer) TypedInformer() ServiceAccountIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ServiceAccount](f.factory.InformerFor(&apicorev1.ServiceAccount{}, f.defaultInformer))
 }
 
 func (f *serviceAccountInformer) Lister() corev1.ServiceAccountLister {
 	return corev1.NewServiceAccountLister(f.Informer().GetIndexer())
 }
+
+// ToTypedServiceAccountInformer converts an untyped informer into a TypedServiceAccountInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ServiceAccount. If that is not the case, calling type-safe methods of the returned
+// TypedServiceAccountInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedServiceAccountInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedServiceAccountInformer(informer ServiceAccountInformer) TypedServiceAccountInformer {
+	if informer, ok := informer.(TypedServiceAccountInformer); ok {
+		return informer
+	}
+	return &serviceAccountTypedInformerAdapter{informer}
+}
+
+type serviceAccountTypedInformerAdapter struct {
+	ServiceAccountInformer
+}
+
+func (a *serviceAccountTypedInformerAdapter) TypedInformer() ServiceAccountIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ServiceAccount](a.Informer())
+}
+
+// ToServiceAccountIndexInformer converts an untyped informer into a ServiceAccountIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ServiceAccount. If that is not the case, calling type-safe methods of the returned
+// ServiceAccountIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ServiceAccountIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToServiceAccountIndexInformer(informer cache.SharedIndexInformer) ServiceAccountIndexInformer {
+	if informer, ok := informer.(ServiceAccountIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apicorev1.ServiceAccount](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/discovery/v1/endpointslice.go b/vendor/k8s.io/client-go/informers/discovery/v1/endpointslice.go
index 999d514598..f037770867 100644
--- a/vendor/k8s.io/client-go/informers/discovery/v1/endpointslice.go
+++ b/vendor/k8s.io/client-go/informers/discovery/v1/endpointslice.go
@@ -34,12 +34,40 @@ import (
 )
 
 // EndpointSliceInformer provides access to a shared informer and lister for
-// EndpointSlices.
+// EndpointSlices. Prefer using the type-safe variant (see [TypedEndpointSliceInformer]).
 type EndpointSliceInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() discoveryv1.EndpointSliceLister
 }
 
+// TypedEndpointSliceInformer provides access to a shared informer and lister for
+// EndpointSlices, including the type-safe TypedInformer variant.
+// It is a superset of EndpointSliceInformer.
+type TypedEndpointSliceInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() EndpointSliceIndexInformer
+	Lister() discoveryv1.EndpointSliceLister
+}
+
+// EndpointSliceIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type EndpointSliceIndexInformer cache.TypedSharedIndexInformer[*apidiscoveryv1.EndpointSlice]
+
+// EndpointSliceHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for EndpointSlice.
+type EndpointSliceHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apidiscoveryv1.EndpointSlice]
+
+// EndpointSliceDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for EndpointSlice.
+type EndpointSliceDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apidiscoveryv1.EndpointSlice]
+
+// EndpointSliceFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for EndpointSlice.
+type EndpointSliceFilteringHandler = cache.TypedFilteringResourceEventHandler[*apidiscoveryv1.EndpointSlice]
+
+// EndpointSliceIndexers is a specialization of [cache.TypedIndexers] for EndpointSlice.
+type EndpointSliceIndexers = cache.TypedIndexers[*apidiscoveryv1.EndpointSlice]
+
+// DeletedEndpointSlice is a specialization of [cache.DeletedObject] for EndpointSlice.
+type DeletedEndpointSlice = cache.DeletedObject[*apidiscoveryv1.EndpointSlice]
+
 type endpointSliceInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type endpointSliceInformer struct {
 // NewEndpointSliceInformer constructs a new informer for EndpointSlice type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEndpointSliceInformer]).
 func NewEndpointSliceInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewEndpointSliceInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedEndpointSliceInformer constructs a new informer for EndpointSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEndpointSliceInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EndpointSliceIndexers) EndpointSliceIndexInformer {
+	return NewTypedEndpointSliceInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredEndpointSliceInformer constructs a new informer for EndpointSlice type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredEndpointSliceInformer]).
 func NewFilteredEndpointSliceInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewEndpointSliceInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedEndpointSliceInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredEndpointSliceInformer constructs a new informer for EndpointSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredEndpointSliceInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EndpointSliceIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) EndpointSliceIndexInformer {
+	return NewTypedEndpointSliceInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewEndpointSliceInformerWithOptions constructs a new informer for EndpointSlice type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEndpointSliceInformerWithOptions]).
 func NewEndpointSliceInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedEndpointSliceInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedEndpointSliceInformerWithOptions constructs a new informer for EndpointSlice type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEndpointSliceInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) EndpointSliceIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "discovery.k8s.io", Version: "v1", Resource: "endpointslices"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apidiscoveryv1.EndpointSlice](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewEndpointSliceInformerWithOptions(client kubernetes.Interface, namespace
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *endpointSliceInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewEndpointSliceInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedEndpointSliceInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *endpointSliceInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apidiscoveryv1.EndpointSlice{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *endpointSliceInformer) TypedInformer() EndpointSliceIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apidiscoveryv1.EndpointSlice](f.factory.InformerFor(&apidiscoveryv1.EndpointSlice{}, f.defaultInformer))
 }
 
 func (f *endpointSliceInformer) Lister() discoveryv1.EndpointSliceLister {
 	return discoveryv1.NewEndpointSliceLister(f.Informer().GetIndexer())
 }
+
+// ToTypedEndpointSliceInformer converts an untyped informer into a TypedEndpointSliceInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *EndpointSlice. If that is not the case, calling type-safe methods of the returned
+// TypedEndpointSliceInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedEndpointSliceInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedEndpointSliceInformer(informer EndpointSliceInformer) TypedEndpointSliceInformer {
+	if informer, ok := informer.(TypedEndpointSliceInformer); ok {
+		return informer
+	}
+	return &endpointSliceTypedInformerAdapter{informer}
+}
+
+type endpointSliceTypedInformerAdapter struct {
+	EndpointSliceInformer
+}
+
+func (a *endpointSliceTypedInformerAdapter) TypedInformer() EndpointSliceIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apidiscoveryv1.EndpointSlice](a.Informer())
+}
+
+// ToEndpointSliceIndexInformer converts an untyped informer into a EndpointSliceIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *EndpointSlice. If that is not the case, calling type-safe methods of the returned
+// EndpointSliceIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a EndpointSliceIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToEndpointSliceIndexInformer(informer cache.SharedIndexInformer) EndpointSliceIndexInformer {
+	if informer, ok := informer.(EndpointSliceIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apidiscoveryv1.EndpointSlice](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/discovery/v1/interface.go b/vendor/k8s.io/client-go/informers/discovery/v1/interface.go
index d90c63c0a9..889b917e05 100644
--- a/vendor/k8s.io/client-go/informers/discovery/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/discovery/v1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// EndpointSlices returns a EndpointSliceInformer.
-	EndpointSlices() EndpointSliceInformer
+	EndpointSlices() TypedEndpointSliceInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// EndpointSlices returns a EndpointSliceInformer.
-func (v *version) EndpointSlices() EndpointSliceInformer {
+// EndpointSlices returns a TypedEndpointSliceInformer.
+func (v *version) EndpointSlices() TypedEndpointSliceInformer {
 	return &endpointSliceInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/discovery/v1beta1/endpointslice.go b/vendor/k8s.io/client-go/informers/discovery/v1beta1/endpointslice.go
index 918e30485f..5fa7068782 100644
--- a/vendor/k8s.io/client-go/informers/discovery/v1beta1/endpointslice.go
+++ b/vendor/k8s.io/client-go/informers/discovery/v1beta1/endpointslice.go
@@ -34,12 +34,40 @@ import (
 )
 
 // EndpointSliceInformer provides access to a shared informer and lister for
-// EndpointSlices.
+// EndpointSlices. Prefer using the type-safe variant (see [TypedEndpointSliceInformer]).
 type EndpointSliceInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() discoveryv1beta1.EndpointSliceLister
 }
 
+// TypedEndpointSliceInformer provides access to a shared informer and lister for
+// EndpointSlices, including the type-safe TypedInformer variant.
+// It is a superset of EndpointSliceInformer.
+type TypedEndpointSliceInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() EndpointSliceIndexInformer
+	Lister() discoveryv1beta1.EndpointSliceLister
+}
+
+// EndpointSliceIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type EndpointSliceIndexInformer cache.TypedSharedIndexInformer[*apidiscoveryv1beta1.EndpointSlice]
+
+// EndpointSliceHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for EndpointSlice.
+type EndpointSliceHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apidiscoveryv1beta1.EndpointSlice]
+
+// EndpointSliceDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for EndpointSlice.
+type EndpointSliceDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apidiscoveryv1beta1.EndpointSlice]
+
+// EndpointSliceFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for EndpointSlice.
+type EndpointSliceFilteringHandler = cache.TypedFilteringResourceEventHandler[*apidiscoveryv1beta1.EndpointSlice]
+
+// EndpointSliceIndexers is a specialization of [cache.TypedIndexers] for EndpointSlice.
+type EndpointSliceIndexers = cache.TypedIndexers[*apidiscoveryv1beta1.EndpointSlice]
+
+// DeletedEndpointSlice is a specialization of [cache.DeletedObject] for EndpointSlice.
+type DeletedEndpointSlice = cache.DeletedObject[*apidiscoveryv1beta1.EndpointSlice]
+
 type endpointSliceInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type endpointSliceInformer struct {
 // NewEndpointSliceInformer constructs a new informer for EndpointSlice type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEndpointSliceInformer]).
 func NewEndpointSliceInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewEndpointSliceInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedEndpointSliceInformer constructs a new informer for EndpointSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEndpointSliceInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EndpointSliceIndexers) EndpointSliceIndexInformer {
+	return NewTypedEndpointSliceInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredEndpointSliceInformer constructs a new informer for EndpointSlice type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredEndpointSliceInformer]).
 func NewFilteredEndpointSliceInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewEndpointSliceInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedEndpointSliceInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredEndpointSliceInformer constructs a new informer for EndpointSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredEndpointSliceInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EndpointSliceIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) EndpointSliceIndexInformer {
+	return NewTypedEndpointSliceInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewEndpointSliceInformerWithOptions constructs a new informer for EndpointSlice type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEndpointSliceInformerWithOptions]).
 func NewEndpointSliceInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedEndpointSliceInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedEndpointSliceInformerWithOptions constructs a new informer for EndpointSlice type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEndpointSliceInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) EndpointSliceIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "discovery.k8s.io", Version: "v1beta1", Resource: "endpointslices"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apidiscoveryv1beta1.EndpointSlice](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewEndpointSliceInformerWithOptions(client kubernetes.Interface, namespace
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *endpointSliceInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewEndpointSliceInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedEndpointSliceInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *endpointSliceInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apidiscoveryv1beta1.EndpointSlice{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *endpointSliceInformer) TypedInformer() EndpointSliceIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apidiscoveryv1beta1.EndpointSlice](f.factory.InformerFor(&apidiscoveryv1beta1.EndpointSlice{}, f.defaultInformer))
 }
 
 func (f *endpointSliceInformer) Lister() discoveryv1beta1.EndpointSliceLister {
 	return discoveryv1beta1.NewEndpointSliceLister(f.Informer().GetIndexer())
 }
+
+// ToTypedEndpointSliceInformer converts an untyped informer into a TypedEndpointSliceInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *EndpointSlice. If that is not the case, calling type-safe methods of the returned
+// TypedEndpointSliceInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedEndpointSliceInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedEndpointSliceInformer(informer EndpointSliceInformer) TypedEndpointSliceInformer {
+	if informer, ok := informer.(TypedEndpointSliceInformer); ok {
+		return informer
+	}
+	return &endpointSliceTypedInformerAdapter{informer}
+}
+
+type endpointSliceTypedInformerAdapter struct {
+	EndpointSliceInformer
+}
+
+func (a *endpointSliceTypedInformerAdapter) TypedInformer() EndpointSliceIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apidiscoveryv1beta1.EndpointSlice](a.Informer())
+}
+
+// ToEndpointSliceIndexInformer converts an untyped informer into a EndpointSliceIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *EndpointSlice. If that is not the case, calling type-safe methods of the returned
+// EndpointSliceIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a EndpointSliceIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToEndpointSliceIndexInformer(informer cache.SharedIndexInformer) EndpointSliceIndexInformer {
+	if informer, ok := informer.(EndpointSliceIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apidiscoveryv1beta1.EndpointSlice](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/discovery/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/discovery/v1beta1/interface.go
index 4661646e01..f0866a4ff6 100644
--- a/vendor/k8s.io/client-go/informers/discovery/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/discovery/v1beta1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// EndpointSlices returns a EndpointSliceInformer.
-	EndpointSlices() EndpointSliceInformer
+	EndpointSlices() TypedEndpointSliceInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// EndpointSlices returns a EndpointSliceInformer.
-func (v *version) EndpointSlices() EndpointSliceInformer {
+// EndpointSlices returns a TypedEndpointSliceInformer.
+func (v *version) EndpointSlices() TypedEndpointSliceInformer {
 	return &endpointSliceInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/events/v1/event.go b/vendor/k8s.io/client-go/informers/events/v1/event.go
index 23aaa68479..d0bd73b500 100644
--- a/vendor/k8s.io/client-go/informers/events/v1/event.go
+++ b/vendor/k8s.io/client-go/informers/events/v1/event.go
@@ -34,12 +34,40 @@ import (
 )
 
 // EventInformer provides access to a shared informer and lister for
-// Events.
+// Events. Prefer using the type-safe variant (see [TypedEventInformer]).
 type EventInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() eventsv1.EventLister
 }
 
+// TypedEventInformer provides access to a shared informer and lister for
+// Events, including the type-safe TypedInformer variant.
+// It is a superset of EventInformer.
+type TypedEventInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() EventIndexInformer
+	Lister() eventsv1.EventLister
+}
+
+// EventIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type EventIndexInformer cache.TypedSharedIndexInformer[*apieventsv1.Event]
+
+// EventHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Event.
+type EventHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apieventsv1.Event]
+
+// EventDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Event.
+type EventDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apieventsv1.Event]
+
+// EventFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Event.
+type EventFilteringHandler = cache.TypedFilteringResourceEventHandler[*apieventsv1.Event]
+
+// EventIndexers is a specialization of [cache.TypedIndexers] for Event.
+type EventIndexers = cache.TypedIndexers[*apieventsv1.Event]
+
+// DeletedEvent is a specialization of [cache.DeletedObject] for Event.
+type DeletedEvent = cache.DeletedObject[*apieventsv1.Event]
+
 type eventInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type eventInformer struct {
 // NewEventInformer constructs a new informer for Event type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEventInformer]).
 func NewEventInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewEventInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedEventInformer constructs a new informer for Event type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEventInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EventIndexers) EventIndexInformer {
+	return NewTypedEventInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredEventInformer constructs a new informer for Event type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredEventInformer]).
 func NewFilteredEventInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewEventInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedEventInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredEventInformer constructs a new informer for Event type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredEventInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EventIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) EventIndexInformer {
+	return NewTypedEventInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewEventInformerWithOptions constructs a new informer for Event type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEventInformerWithOptions]).
 func NewEventInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedEventInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedEventInformerWithOptions constructs a new informer for Event type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEventInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) EventIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "events.k8s.io", Version: "v1", Resource: "events"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apieventsv1.Event](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewEventInformerWithOptions(client kubernetes.Interface, namespace string,
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *eventInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewEventInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedEventInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *eventInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apieventsv1.Event{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *eventInformer) TypedInformer() EventIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apieventsv1.Event](f.factory.InformerFor(&apieventsv1.Event{}, f.defaultInformer))
 }
 
 func (f *eventInformer) Lister() eventsv1.EventLister {
 	return eventsv1.NewEventLister(f.Informer().GetIndexer())
 }
+
+// ToTypedEventInformer converts an untyped informer into a TypedEventInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Event. If that is not the case, calling type-safe methods of the returned
+// TypedEventInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedEventInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedEventInformer(informer EventInformer) TypedEventInformer {
+	if informer, ok := informer.(TypedEventInformer); ok {
+		return informer
+	}
+	return &eventTypedInformerAdapter{informer}
+}
+
+type eventTypedInformerAdapter struct {
+	EventInformer
+}
+
+func (a *eventTypedInformerAdapter) TypedInformer() EventIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apieventsv1.Event](a.Informer())
+}
+
+// ToEventIndexInformer converts an untyped informer into a EventIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Event. If that is not the case, calling type-safe methods of the returned
+// EventIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a EventIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToEventIndexInformer(informer cache.SharedIndexInformer) EventIndexInformer {
+	if informer, ok := informer.(EventIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apieventsv1.Event](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/events/v1/interface.go b/vendor/k8s.io/client-go/informers/events/v1/interface.go
index cd06e23359..8b2571298b 100644
--- a/vendor/k8s.io/client-go/informers/events/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/events/v1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// Events returns a EventInformer.
-	Events() EventInformer
+	Events() TypedEventInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// Events returns a EventInformer.
-func (v *version) Events() EventInformer {
+// Events returns a TypedEventInformer.
+func (v *version) Events() TypedEventInformer {
 	return &eventInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/events/v1beta1/event.go b/vendor/k8s.io/client-go/informers/events/v1beta1/event.go
index ea0117eaca..fc3d7203dc 100644
--- a/vendor/k8s.io/client-go/informers/events/v1beta1/event.go
+++ b/vendor/k8s.io/client-go/informers/events/v1beta1/event.go
@@ -34,12 +34,40 @@ import (
 )
 
 // EventInformer provides access to a shared informer and lister for
-// Events.
+// Events. Prefer using the type-safe variant (see [TypedEventInformer]).
 type EventInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() eventsv1beta1.EventLister
 }
 
+// TypedEventInformer provides access to a shared informer and lister for
+// Events, including the type-safe TypedInformer variant.
+// It is a superset of EventInformer.
+type TypedEventInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() EventIndexInformer
+	Lister() eventsv1beta1.EventLister
+}
+
+// EventIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type EventIndexInformer cache.TypedSharedIndexInformer[*apieventsv1beta1.Event]
+
+// EventHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Event.
+type EventHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apieventsv1beta1.Event]
+
+// EventDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Event.
+type EventDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apieventsv1beta1.Event]
+
+// EventFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Event.
+type EventFilteringHandler = cache.TypedFilteringResourceEventHandler[*apieventsv1beta1.Event]
+
+// EventIndexers is a specialization of [cache.TypedIndexers] for Event.
+type EventIndexers = cache.TypedIndexers[*apieventsv1beta1.Event]
+
+// DeletedEvent is a specialization of [cache.DeletedObject] for Event.
+type DeletedEvent = cache.DeletedObject[*apieventsv1beta1.Event]
+
 type eventInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type eventInformer struct {
 // NewEventInformer constructs a new informer for Event type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEventInformer]).
 func NewEventInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewEventInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedEventInformer constructs a new informer for Event type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEventInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EventIndexers) EventIndexInformer {
+	return NewTypedEventInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredEventInformer constructs a new informer for Event type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredEventInformer]).
 func NewFilteredEventInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewEventInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedEventInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredEventInformer constructs a new informer for Event type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredEventInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EventIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) EventIndexInformer {
+	return NewTypedEventInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewEventInformerWithOptions constructs a new informer for Event type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEventInformerWithOptions]).
 func NewEventInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedEventInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedEventInformerWithOptions constructs a new informer for Event type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEventInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) EventIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "events.k8s.io", Version: "v1beta1", Resource: "events"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apieventsv1beta1.Event](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewEventInformerWithOptions(client kubernetes.Interface, namespace string,
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *eventInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewEventInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedEventInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *eventInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apieventsv1beta1.Event{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *eventInformer) TypedInformer() EventIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apieventsv1beta1.Event](f.factory.InformerFor(&apieventsv1beta1.Event{}, f.defaultInformer))
 }
 
 func (f *eventInformer) Lister() eventsv1beta1.EventLister {
 	return eventsv1beta1.NewEventLister(f.Informer().GetIndexer())
 }
+
+// ToTypedEventInformer converts an untyped informer into a TypedEventInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Event. If that is not the case, calling type-safe methods of the returned
+// TypedEventInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedEventInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedEventInformer(informer EventInformer) TypedEventInformer {
+	if informer, ok := informer.(TypedEventInformer); ok {
+		return informer
+	}
+	return &eventTypedInformerAdapter{informer}
+}
+
+type eventTypedInformerAdapter struct {
+	EventInformer
+}
+
+func (a *eventTypedInformerAdapter) TypedInformer() EventIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apieventsv1beta1.Event](a.Informer())
+}
+
+// ToEventIndexInformer converts an untyped informer into a EventIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Event. If that is not the case, calling type-safe methods of the returned
+// EventIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a EventIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToEventIndexInformer(informer cache.SharedIndexInformer) EventIndexInformer {
+	if informer, ok := informer.(EventIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apieventsv1beta1.Event](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/events/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/events/v1beta1/interface.go
index c71888c9a4..9b69ebe28e 100644
--- a/vendor/k8s.io/client-go/informers/events/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/events/v1beta1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// Events returns a EventInformer.
-	Events() EventInformer
+	Events() TypedEventInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// Events returns a EventInformer.
-func (v *version) Events() EventInformer {
+// Events returns a TypedEventInformer.
+func (v *version) Events() TypedEventInformer {
 	return &eventInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/extensions/v1beta1/daemonset.go b/vendor/k8s.io/client-go/informers/extensions/v1beta1/daemonset.go
index ed8b023038..1c3e4f7ac5 100644
--- a/vendor/k8s.io/client-go/informers/extensions/v1beta1/daemonset.go
+++ b/vendor/k8s.io/client-go/informers/extensions/v1beta1/daemonset.go
@@ -34,12 +34,40 @@ import (
 )
 
 // DaemonSetInformer provides access to a shared informer and lister for
-// DaemonSets.
+// DaemonSets. Prefer using the type-safe variant (see [TypedDaemonSetInformer]).
 type DaemonSetInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() extensionsv1beta1.DaemonSetLister
 }
 
+// TypedDaemonSetInformer provides access to a shared informer and lister for
+// DaemonSets, including the type-safe TypedInformer variant.
+// It is a superset of DaemonSetInformer.
+type TypedDaemonSetInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() DaemonSetIndexInformer
+	Lister() extensionsv1beta1.DaemonSetLister
+}
+
+// DaemonSetIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type DaemonSetIndexInformer cache.TypedSharedIndexInformer[*apiextensionsv1beta1.DaemonSet]
+
+// DaemonSetHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for DaemonSet.
+type DaemonSetHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiextensionsv1beta1.DaemonSet]
+
+// DaemonSetDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for DaemonSet.
+type DaemonSetDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiextensionsv1beta1.DaemonSet]
+
+// DaemonSetFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for DaemonSet.
+type DaemonSetFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiextensionsv1beta1.DaemonSet]
+
+// DaemonSetIndexers is a specialization of [cache.TypedIndexers] for DaemonSet.
+type DaemonSetIndexers = cache.TypedIndexers[*apiextensionsv1beta1.DaemonSet]
+
+// DeletedDaemonSet is a specialization of [cache.DeletedObject] for DaemonSet.
+type DeletedDaemonSet = cache.DeletedObject[*apiextensionsv1beta1.DaemonSet]
+
 type daemonSetInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type daemonSetInformer struct {
 // NewDaemonSetInformer constructs a new informer for DaemonSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDaemonSetInformer]).
 func NewDaemonSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewDaemonSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedDaemonSetInformer constructs a new informer for DaemonSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDaemonSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers DaemonSetIndexers) DaemonSetIndexInformer {
+	return NewTypedDaemonSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredDaemonSetInformer constructs a new informer for DaemonSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredDaemonSetInformer]).
 func NewFilteredDaemonSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewDaemonSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedDaemonSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredDaemonSetInformer constructs a new informer for DaemonSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredDaemonSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers DaemonSetIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) DaemonSetIndexInformer {
+	return NewTypedDaemonSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewDaemonSetInformerWithOptions constructs a new informer for DaemonSet type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDaemonSetInformerWithOptions]).
 func NewDaemonSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedDaemonSetInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedDaemonSetInformerWithOptions constructs a new informer for DaemonSet type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDaemonSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) DaemonSetIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "daemonsets"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.DaemonSet](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewDaemonSetInformerWithOptions(client kubernetes.Interface, namespace stri
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *daemonSetInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewDaemonSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedDaemonSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *daemonSetInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiextensionsv1beta1.DaemonSet{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *daemonSetInformer) TypedInformer() DaemonSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.DaemonSet](f.factory.InformerFor(&apiextensionsv1beta1.DaemonSet{}, f.defaultInformer))
 }
 
 func (f *daemonSetInformer) Lister() extensionsv1beta1.DaemonSetLister {
 	return extensionsv1beta1.NewDaemonSetLister(f.Informer().GetIndexer())
 }
+
+// ToTypedDaemonSetInformer converts an untyped informer into a TypedDaemonSetInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DaemonSet. If that is not the case, calling type-safe methods of the returned
+// TypedDaemonSetInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedDaemonSetInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedDaemonSetInformer(informer DaemonSetInformer) TypedDaemonSetInformer {
+	if informer, ok := informer.(TypedDaemonSetInformer); ok {
+		return informer
+	}
+	return &daemonSetTypedInformerAdapter{informer}
+}
+
+type daemonSetTypedInformerAdapter struct {
+	DaemonSetInformer
+}
+
+func (a *daemonSetTypedInformerAdapter) TypedInformer() DaemonSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.DaemonSet](a.Informer())
+}
+
+// ToDaemonSetIndexInformer converts an untyped informer into a DaemonSetIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DaemonSet. If that is not the case, calling type-safe methods of the returned
+// DaemonSetIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a DaemonSetIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToDaemonSetIndexInformer(informer cache.SharedIndexInformer) DaemonSetIndexInformer {
+	if informer, ok := informer.(DaemonSetIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.DaemonSet](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/extensions/v1beta1/deployment.go b/vendor/k8s.io/client-go/informers/extensions/v1beta1/deployment.go
index ee328bb517..331298be94 100644
--- a/vendor/k8s.io/client-go/informers/extensions/v1beta1/deployment.go
+++ b/vendor/k8s.io/client-go/informers/extensions/v1beta1/deployment.go
@@ -34,12 +34,40 @@ import (
 )
 
 // DeploymentInformer provides access to a shared informer and lister for
-// Deployments.
+// Deployments. Prefer using the type-safe variant (see [TypedDeploymentInformer]).
 type DeploymentInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() extensionsv1beta1.DeploymentLister
 }
 
+// TypedDeploymentInformer provides access to a shared informer and lister for
+// Deployments, including the type-safe TypedInformer variant.
+// It is a superset of DeploymentInformer.
+type TypedDeploymentInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() DeploymentIndexInformer
+	Lister() extensionsv1beta1.DeploymentLister
+}
+
+// DeploymentIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type DeploymentIndexInformer cache.TypedSharedIndexInformer[*apiextensionsv1beta1.Deployment]
+
+// DeploymentHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Deployment.
+type DeploymentHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiextensionsv1beta1.Deployment]
+
+// DeploymentDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Deployment.
+type DeploymentDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiextensionsv1beta1.Deployment]
+
+// DeploymentFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Deployment.
+type DeploymentFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiextensionsv1beta1.Deployment]
+
+// DeploymentIndexers is a specialization of [cache.TypedIndexers] for Deployment.
+type DeploymentIndexers = cache.TypedIndexers[*apiextensionsv1beta1.Deployment]
+
+// DeletedDeployment is a specialization of [cache.DeletedObject] for Deployment.
+type DeletedDeployment = cache.DeletedObject[*apiextensionsv1beta1.Deployment]
+
 type deploymentInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type deploymentInformer struct {
 // NewDeploymentInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeploymentInformer]).
 func NewDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedDeploymentInformer constructs a new informer for Deployment type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers DeploymentIndexers) DeploymentIndexInformer {
+	return NewTypedDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredDeploymentInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredDeploymentInformer]).
 func NewFilteredDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredDeploymentInformer constructs a new informer for Deployment type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredDeploymentInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers DeploymentIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) DeploymentIndexInformer {
+	return NewTypedDeploymentInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewDeploymentInformerWithOptions constructs a new informer for Deployment type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeploymentInformerWithOptions]).
 func NewDeploymentInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedDeploymentInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedDeploymentInformerWithOptions constructs a new informer for Deployment type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeploymentInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) DeploymentIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "deployments"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.Deployment](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewDeploymentInformerWithOptions(client kubernetes.Interface, namespace str
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *deploymentInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewDeploymentInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedDeploymentInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *deploymentInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiextensionsv1beta1.Deployment{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *deploymentInformer) TypedInformer() DeploymentIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.Deployment](f.factory.InformerFor(&apiextensionsv1beta1.Deployment{}, f.defaultInformer))
 }
 
 func (f *deploymentInformer) Lister() extensionsv1beta1.DeploymentLister {
 	return extensionsv1beta1.NewDeploymentLister(f.Informer().GetIndexer())
 }
+
+// ToTypedDeploymentInformer converts an untyped informer into a TypedDeploymentInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Deployment. If that is not the case, calling type-safe methods of the returned
+// TypedDeploymentInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedDeploymentInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedDeploymentInformer(informer DeploymentInformer) TypedDeploymentInformer {
+	if informer, ok := informer.(TypedDeploymentInformer); ok {
+		return informer
+	}
+	return &deploymentTypedInformerAdapter{informer}
+}
+
+type deploymentTypedInformerAdapter struct {
+	DeploymentInformer
+}
+
+func (a *deploymentTypedInformerAdapter) TypedInformer() DeploymentIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.Deployment](a.Informer())
+}
+
+// ToDeploymentIndexInformer converts an untyped informer into a DeploymentIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Deployment. If that is not the case, calling type-safe methods of the returned
+// DeploymentIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a DeploymentIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToDeploymentIndexInformer(informer cache.SharedIndexInformer) DeploymentIndexInformer {
+	if informer, ok := informer.(DeploymentIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.Deployment](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/extensions/v1beta1/ingress.go b/vendor/k8s.io/client-go/informers/extensions/v1beta1/ingress.go
index 852238a481..31fa5723f2 100644
--- a/vendor/k8s.io/client-go/informers/extensions/v1beta1/ingress.go
+++ b/vendor/k8s.io/client-go/informers/extensions/v1beta1/ingress.go
@@ -34,12 +34,40 @@ import (
 )
 
 // IngressInformer provides access to a shared informer and lister for
-// Ingresses.
+// Ingresses. Prefer using the type-safe variant (see [TypedIngressInformer]).
 type IngressInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() extensionsv1beta1.IngressLister
 }
 
+// TypedIngressInformer provides access to a shared informer and lister for
+// Ingresses, including the type-safe TypedInformer variant.
+// It is a superset of IngressInformer.
+type TypedIngressInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() IngressIndexInformer
+	Lister() extensionsv1beta1.IngressLister
+}
+
+// IngressIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type IngressIndexInformer cache.TypedSharedIndexInformer[*apiextensionsv1beta1.Ingress]
+
+// IngressHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Ingress.
+type IngressHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiextensionsv1beta1.Ingress]
+
+// IngressDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Ingress.
+type IngressDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiextensionsv1beta1.Ingress]
+
+// IngressFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Ingress.
+type IngressFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiextensionsv1beta1.Ingress]
+
+// IngressIndexers is a specialization of [cache.TypedIndexers] for Ingress.
+type IngressIndexers = cache.TypedIndexers[*apiextensionsv1beta1.Ingress]
+
+// DeletedIngress is a specialization of [cache.DeletedObject] for Ingress.
+type DeletedIngress = cache.DeletedObject[*apiextensionsv1beta1.Ingress]
+
 type ingressInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type ingressInformer struct {
 // NewIngressInformer constructs a new informer for Ingress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedIngressInformer]).
 func NewIngressInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewIngressInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedIngressInformer constructs a new informer for Ingress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedIngressInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers IngressIndexers) IngressIndexInformer {
+	return NewTypedIngressInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredIngressInformer constructs a new informer for Ingress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredIngressInformer]).
 func NewFilteredIngressInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewIngressInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedIngressInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredIngressInformer constructs a new informer for Ingress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredIngressInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers IngressIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) IngressIndexInformer {
+	return NewTypedIngressInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewIngressInformerWithOptions constructs a new informer for Ingress type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedIngressInformerWithOptions]).
 func NewIngressInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedIngressInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedIngressInformerWithOptions constructs a new informer for Ingress type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedIngressInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) IngressIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "ingresss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.Ingress](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewIngressInformerWithOptions(client kubernetes.Interface, namespace string
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *ingressInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewIngressInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedIngressInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *ingressInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiextensionsv1beta1.Ingress{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *ingressInformer) TypedInformer() IngressIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.Ingress](f.factory.InformerFor(&apiextensionsv1beta1.Ingress{}, f.defaultInformer))
 }
 
 func (f *ingressInformer) Lister() extensionsv1beta1.IngressLister {
 	return extensionsv1beta1.NewIngressLister(f.Informer().GetIndexer())
 }
+
+// ToTypedIngressInformer converts an untyped informer into a TypedIngressInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Ingress. If that is not the case, calling type-safe methods of the returned
+// TypedIngressInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedIngressInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedIngressInformer(informer IngressInformer) TypedIngressInformer {
+	if informer, ok := informer.(TypedIngressInformer); ok {
+		return informer
+	}
+	return &ingressTypedInformerAdapter{informer}
+}
+
+type ingressTypedInformerAdapter struct {
+	IngressInformer
+}
+
+func (a *ingressTypedInformerAdapter) TypedInformer() IngressIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.Ingress](a.Informer())
+}
+
+// ToIngressIndexInformer converts an untyped informer into a IngressIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Ingress. If that is not the case, calling type-safe methods of the returned
+// IngressIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a IngressIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToIngressIndexInformer(informer cache.SharedIndexInformer) IngressIndexInformer {
+	if informer, ok := informer.(IngressIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.Ingress](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/extensions/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/extensions/v1beta1/interface.go
index 600741e3a2..7c56361720 100644
--- a/vendor/k8s.io/client-go/informers/extensions/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/extensions/v1beta1/interface.go
@@ -25,15 +25,15 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// DaemonSets returns a DaemonSetInformer.
-	DaemonSets() DaemonSetInformer
+	DaemonSets() TypedDaemonSetInformer
 	// Deployments returns a DeploymentInformer.
-	Deployments() DeploymentInformer
+	Deployments() TypedDeploymentInformer
 	// Ingresses returns a IngressInformer.
-	Ingresses() IngressInformer
+	Ingresses() TypedIngressInformer
 	// NetworkPolicies returns a NetworkPolicyInformer.
-	NetworkPolicies() NetworkPolicyInformer
+	NetworkPolicies() TypedNetworkPolicyInformer
 	// ReplicaSets returns a ReplicaSetInformer.
-	ReplicaSets() ReplicaSetInformer
+	ReplicaSets() TypedReplicaSetInformer
 }
 
 type version struct {
@@ -47,27 +47,27 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// DaemonSets returns a DaemonSetInformer.
-func (v *version) DaemonSets() DaemonSetInformer {
+// DaemonSets returns a TypedDaemonSetInformer.
+func (v *version) DaemonSets() TypedDaemonSetInformer {
 	return &daemonSetInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// Deployments returns a DeploymentInformer.
-func (v *version) Deployments() DeploymentInformer {
+// Deployments returns a TypedDeploymentInformer.
+func (v *version) Deployments() TypedDeploymentInformer {
 	return &deploymentInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// Ingresses returns a IngressInformer.
-func (v *version) Ingresses() IngressInformer {
+// Ingresses returns a TypedIngressInformer.
+func (v *version) Ingresses() TypedIngressInformer {
 	return &ingressInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// NetworkPolicies returns a NetworkPolicyInformer.
-func (v *version) NetworkPolicies() NetworkPolicyInformer {
+// NetworkPolicies returns a TypedNetworkPolicyInformer.
+func (v *version) NetworkPolicies() TypedNetworkPolicyInformer {
 	return &networkPolicyInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// ReplicaSets returns a ReplicaSetInformer.
-func (v *version) ReplicaSets() ReplicaSetInformer {
+// ReplicaSets returns a TypedReplicaSetInformer.
+func (v *version) ReplicaSets() TypedReplicaSetInformer {
 	return &replicaSetInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/extensions/v1beta1/networkpolicy.go b/vendor/k8s.io/client-go/informers/extensions/v1beta1/networkpolicy.go
index fda46c1d96..2bec16ad2b 100644
--- a/vendor/k8s.io/client-go/informers/extensions/v1beta1/networkpolicy.go
+++ b/vendor/k8s.io/client-go/informers/extensions/v1beta1/networkpolicy.go
@@ -34,12 +34,40 @@ import (
 )
 
 // NetworkPolicyInformer provides access to a shared informer and lister for
-// NetworkPolicies.
+// NetworkPolicies. Prefer using the type-safe variant (see [TypedNetworkPolicyInformer]).
 type NetworkPolicyInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() extensionsv1beta1.NetworkPolicyLister
 }
 
+// TypedNetworkPolicyInformer provides access to a shared informer and lister for
+// NetworkPolicies, including the type-safe TypedInformer variant.
+// It is a superset of NetworkPolicyInformer.
+type TypedNetworkPolicyInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() NetworkPolicyIndexInformer
+	Lister() extensionsv1beta1.NetworkPolicyLister
+}
+
+// NetworkPolicyIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type NetworkPolicyIndexInformer cache.TypedSharedIndexInformer[*apiextensionsv1beta1.NetworkPolicy]
+
+// NetworkPolicyHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for NetworkPolicy.
+type NetworkPolicyHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiextensionsv1beta1.NetworkPolicy]
+
+// NetworkPolicyDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for NetworkPolicy.
+type NetworkPolicyDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiextensionsv1beta1.NetworkPolicy]
+
+// NetworkPolicyFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for NetworkPolicy.
+type NetworkPolicyFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiextensionsv1beta1.NetworkPolicy]
+
+// NetworkPolicyIndexers is a specialization of [cache.TypedIndexers] for NetworkPolicy.
+type NetworkPolicyIndexers = cache.TypedIndexers[*apiextensionsv1beta1.NetworkPolicy]
+
+// DeletedNetworkPolicy is a specialization of [cache.DeletedObject] for NetworkPolicy.
+type DeletedNetworkPolicy = cache.DeletedObject[*apiextensionsv1beta1.NetworkPolicy]
+
 type networkPolicyInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type networkPolicyInformer struct {
 // NewNetworkPolicyInformer constructs a new informer for NetworkPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedNetworkPolicyInformer]).
 func NewNetworkPolicyInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewNetworkPolicyInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedNetworkPolicyInformer constructs a new informer for NetworkPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedNetworkPolicyInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers NetworkPolicyIndexers) NetworkPolicyIndexInformer {
+	return NewTypedNetworkPolicyInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredNetworkPolicyInformer constructs a new informer for NetworkPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredNetworkPolicyInformer]).
 func NewFilteredNetworkPolicyInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewNetworkPolicyInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedNetworkPolicyInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredNetworkPolicyInformer constructs a new informer for NetworkPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredNetworkPolicyInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers NetworkPolicyIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) NetworkPolicyIndexInformer {
+	return NewTypedNetworkPolicyInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewNetworkPolicyInformerWithOptions constructs a new informer for NetworkPolicy type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedNetworkPolicyInformerWithOptions]).
 func NewNetworkPolicyInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedNetworkPolicyInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedNetworkPolicyInformerWithOptions constructs a new informer for NetworkPolicy type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedNetworkPolicyInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) NetworkPolicyIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "networkpolicys"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.NetworkPolicy](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewNetworkPolicyInformerWithOptions(client kubernetes.Interface, namespace
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *networkPolicyInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewNetworkPolicyInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedNetworkPolicyInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *networkPolicyInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiextensionsv1beta1.NetworkPolicy{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *networkPolicyInformer) TypedInformer() NetworkPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.NetworkPolicy](f.factory.InformerFor(&apiextensionsv1beta1.NetworkPolicy{}, f.defaultInformer))
 }
 
 func (f *networkPolicyInformer) Lister() extensionsv1beta1.NetworkPolicyLister {
 	return extensionsv1beta1.NewNetworkPolicyLister(f.Informer().GetIndexer())
 }
+
+// ToTypedNetworkPolicyInformer converts an untyped informer into a TypedNetworkPolicyInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *NetworkPolicy. If that is not the case, calling type-safe methods of the returned
+// TypedNetworkPolicyInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedNetworkPolicyInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedNetworkPolicyInformer(informer NetworkPolicyInformer) TypedNetworkPolicyInformer {
+	if informer, ok := informer.(TypedNetworkPolicyInformer); ok {
+		return informer
+	}
+	return &networkPolicyTypedInformerAdapter{informer}
+}
+
+type networkPolicyTypedInformerAdapter struct {
+	NetworkPolicyInformer
+}
+
+func (a *networkPolicyTypedInformerAdapter) TypedInformer() NetworkPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.NetworkPolicy](a.Informer())
+}
+
+// ToNetworkPolicyIndexInformer converts an untyped informer into a NetworkPolicyIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *NetworkPolicy. If that is not the case, calling type-safe methods of the returned
+// NetworkPolicyIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a NetworkPolicyIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToNetworkPolicyIndexInformer(informer cache.SharedIndexInformer) NetworkPolicyIndexInformer {
+	if informer, ok := informer.(NetworkPolicyIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.NetworkPolicy](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/extensions/v1beta1/replicaset.go b/vendor/k8s.io/client-go/informers/extensions/v1beta1/replicaset.go
index eb0685147f..cc8ba5c76e 100644
--- a/vendor/k8s.io/client-go/informers/extensions/v1beta1/replicaset.go
+++ b/vendor/k8s.io/client-go/informers/extensions/v1beta1/replicaset.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ReplicaSetInformer provides access to a shared informer and lister for
-// ReplicaSets.
+// ReplicaSets. Prefer using the type-safe variant (see [TypedReplicaSetInformer]).
 type ReplicaSetInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() extensionsv1beta1.ReplicaSetLister
 }
 
+// TypedReplicaSetInformer provides access to a shared informer and lister for
+// ReplicaSets, including the type-safe TypedInformer variant.
+// It is a superset of ReplicaSetInformer.
+type TypedReplicaSetInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ReplicaSetIndexInformer
+	Lister() extensionsv1beta1.ReplicaSetLister
+}
+
+// ReplicaSetIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ReplicaSetIndexInformer cache.TypedSharedIndexInformer[*apiextensionsv1beta1.ReplicaSet]
+
+// ReplicaSetHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ReplicaSet.
+type ReplicaSetHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiextensionsv1beta1.ReplicaSet]
+
+// ReplicaSetDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ReplicaSet.
+type ReplicaSetDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiextensionsv1beta1.ReplicaSet]
+
+// ReplicaSetFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ReplicaSet.
+type ReplicaSetFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiextensionsv1beta1.ReplicaSet]
+
+// ReplicaSetIndexers is a specialization of [cache.TypedIndexers] for ReplicaSet.
+type ReplicaSetIndexers = cache.TypedIndexers[*apiextensionsv1beta1.ReplicaSet]
+
+// DeletedReplicaSet is a specialization of [cache.DeletedObject] for ReplicaSet.
+type DeletedReplicaSet = cache.DeletedObject[*apiextensionsv1beta1.ReplicaSet]
+
 type replicaSetInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type replicaSetInformer struct {
 // NewReplicaSetInformer constructs a new informer for ReplicaSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedReplicaSetInformer]).
 func NewReplicaSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewReplicaSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedReplicaSetInformer constructs a new informer for ReplicaSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedReplicaSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ReplicaSetIndexers) ReplicaSetIndexInformer {
+	return NewTypedReplicaSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredReplicaSetInformer constructs a new informer for ReplicaSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredReplicaSetInformer]).
 func NewFilteredReplicaSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewReplicaSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedReplicaSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredReplicaSetInformer constructs a new informer for ReplicaSet type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredReplicaSetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ReplicaSetIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ReplicaSetIndexInformer {
+	return NewTypedReplicaSetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewReplicaSetInformerWithOptions constructs a new informer for ReplicaSet type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedReplicaSetInformerWithOptions]).
 func NewReplicaSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedReplicaSetInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedReplicaSetInformerWithOptions constructs a new informer for ReplicaSet type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedReplicaSetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ReplicaSetIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "replicasets"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.ReplicaSet](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewReplicaSetInformerWithOptions(client kubernetes.Interface, namespace str
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *replicaSetInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewReplicaSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedReplicaSetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *replicaSetInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiextensionsv1beta1.ReplicaSet{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *replicaSetInformer) TypedInformer() ReplicaSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.ReplicaSet](f.factory.InformerFor(&apiextensionsv1beta1.ReplicaSet{}, f.defaultInformer))
 }
 
 func (f *replicaSetInformer) Lister() extensionsv1beta1.ReplicaSetLister {
 	return extensionsv1beta1.NewReplicaSetLister(f.Informer().GetIndexer())
 }
+
+// ToTypedReplicaSetInformer converts an untyped informer into a TypedReplicaSetInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ReplicaSet. If that is not the case, calling type-safe methods of the returned
+// TypedReplicaSetInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedReplicaSetInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedReplicaSetInformer(informer ReplicaSetInformer) TypedReplicaSetInformer {
+	if informer, ok := informer.(TypedReplicaSetInformer); ok {
+		return informer
+	}
+	return &replicaSetTypedInformerAdapter{informer}
+}
+
+type replicaSetTypedInformerAdapter struct {
+	ReplicaSetInformer
+}
+
+func (a *replicaSetTypedInformerAdapter) TypedInformer() ReplicaSetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.ReplicaSet](a.Informer())
+}
+
+// ToReplicaSetIndexInformer converts an untyped informer into a ReplicaSetIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ReplicaSet. If that is not the case, calling type-safe methods of the returned
+// ReplicaSetIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ReplicaSetIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToReplicaSetIndexInformer(informer cache.SharedIndexInformer) ReplicaSetIndexInformer {
+	if informer, ok := informer.(ReplicaSetIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiextensionsv1beta1.ReplicaSet](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/factory.go b/vendor/k8s.io/client-go/informers/factory.go
index 19901079f8..4886f84653 100644
--- a/vendor/k8s.io/client-go/informers/factory.go
+++ b/vendor/k8s.io/client-go/informers/factory.go
@@ -41,6 +41,7 @@ import (
 	extensions "k8s.io/client-go/informers/extensions"
 	flowcontrol "k8s.io/client-go/informers/flowcontrol"
 	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+	lifecycle "k8s.io/client-go/informers/lifecycle"
 	networking "k8s.io/client-go/informers/networking"
 	node "k8s.io/client-go/informers/node"
 	policy "k8s.io/client-go/informers/policy"
@@ -272,7 +273,7 @@ func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internal
 //	ctx, cancel := context.WithCancel(context.Background())
 //	defer cancel()
 //	factory := NewSharedInformerFactory(client, resyncPeriod)
-//	defer factory.WaitForStop()    // Returns immediately if nothing was started.
+//	defer factory.Shutdown()    // Returns immediately if nothing was started.
 //	genericInformer := factory.ForResource(resource)
 //	typedInformer := factory.SomeAPIGroup().V1().SomeType()
 //	handle, err := typeInformer.Informer().AddEventHandler(...)
@@ -330,7 +331,7 @@ type SharedInformerFactory interface {
 	// WaitForCacheSync blocks until all started informers' caches were synced
 	// or the stop channel gets closed.
 	//
-	// Contextual logging: WaitForCacheSync should be used instead of WaitForCacheSync in code which supports contextual logging. It also returns a more useful result.
+	// Contextual logging: WaitForCacheSyncWithContext should be used instead of WaitForCacheSync in code which supports contextual logging. It also returns a more useful result.
 	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
 
 	// WaitForCacheSyncWithContext blocks until all started informers' caches were synced
@@ -356,6 +357,7 @@ type SharedInformerFactory interface {
 	Events() events.Interface
 	Extensions() extensions.Interface
 	Flowcontrol() flowcontrol.Interface
+	Lifecycle() lifecycle.Interface
 	Networking() networking.Interface
 	Node() node.Interface
 	Policy() policy.Interface
@@ -414,6 +416,10 @@ func (f *sharedInformerFactory) Flowcontrol() flowcontrol.Interface {
 	return flowcontrol.New(f, f.namespace, f.tweakListOptions)
 }
 
+func (f *sharedInformerFactory) Lifecycle() lifecycle.Interface {
+	return lifecycle.New(f, f.namespace, f.tweakListOptions)
+}
+
 func (f *sharedInformerFactory) Networking() networking.Interface {
 	return networking.New(f, f.namespace, f.tweakListOptions)
 }
diff --git a/vendor/k8s.io/client-go/informers/flowcontrol/v1/flowschema.go b/vendor/k8s.io/client-go/informers/flowcontrol/v1/flowschema.go
index 624c2f5d6d..429ac3a9ac 100644
--- a/vendor/k8s.io/client-go/informers/flowcontrol/v1/flowschema.go
+++ b/vendor/k8s.io/client-go/informers/flowcontrol/v1/flowschema.go
@@ -34,12 +34,40 @@ import (
 )
 
 // FlowSchemaInformer provides access to a shared informer and lister for
-// FlowSchemas.
+// FlowSchemas. Prefer using the type-safe variant (see [TypedFlowSchemaInformer]).
 type FlowSchemaInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() flowcontrolv1.FlowSchemaLister
 }
 
+// TypedFlowSchemaInformer provides access to a shared informer and lister for
+// FlowSchemas, including the type-safe TypedInformer variant.
+// It is a superset of FlowSchemaInformer.
+type TypedFlowSchemaInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() FlowSchemaIndexInformer
+	Lister() flowcontrolv1.FlowSchemaLister
+}
+
+// FlowSchemaIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type FlowSchemaIndexInformer cache.TypedSharedIndexInformer[*apiflowcontrolv1.FlowSchema]
+
+// FlowSchemaHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for FlowSchema.
+type FlowSchemaHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiflowcontrolv1.FlowSchema]
+
+// FlowSchemaDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for FlowSchema.
+type FlowSchemaDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiflowcontrolv1.FlowSchema]
+
+// FlowSchemaFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for FlowSchema.
+type FlowSchemaFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiflowcontrolv1.FlowSchema]
+
+// FlowSchemaIndexers is a specialization of [cache.TypedIndexers] for FlowSchema.
+type FlowSchemaIndexers = cache.TypedIndexers[*apiflowcontrolv1.FlowSchema]
+
+// DeletedFlowSchema is a specialization of [cache.DeletedObject] for FlowSchema.
+type DeletedFlowSchema = cache.DeletedObject[*apiflowcontrolv1.FlowSchema]
+
 type flowSchemaInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type flowSchemaInformer struct {
 // NewFlowSchemaInformer constructs a new informer for FlowSchema type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFlowSchemaInformer]).
 func NewFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedFlowSchemaInformer constructs a new informer for FlowSchema type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers FlowSchemaIndexers) FlowSchemaIndexInformer {
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredFlowSchemaInformer constructs a new informer for FlowSchema type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredFlowSchemaInformer]).
 func NewFilteredFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredFlowSchemaInformer constructs a new informer for FlowSchema type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers FlowSchemaIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) FlowSchemaIndexInformer {
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewFlowSchemaInformerWithOptions constructs a new informer for FlowSchema type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFlowSchemaInformerWithOptions]).
 func NewFlowSchemaInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedFlowSchemaInformerWithOptions(client, options)
+}
+
+// NewTypedFlowSchemaInformerWithOptions constructs a new informer for FlowSchema type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFlowSchemaInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) FlowSchemaIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1", Resource: "flowschemas"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1.FlowSchema](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewFlowSchemaInformerWithOptions(client kubernetes.Interface, options inter
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *flowSchemaInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *flowSchemaInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiflowcontrolv1.FlowSchema{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *flowSchemaInformer) TypedInformer() FlowSchemaIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1.FlowSchema](f.factory.InformerFor(&apiflowcontrolv1.FlowSchema{}, f.defaultInformer))
 }
 
 func (f *flowSchemaInformer) Lister() flowcontrolv1.FlowSchemaLister {
 	return flowcontrolv1.NewFlowSchemaLister(f.Informer().GetIndexer())
 }
+
+// ToTypedFlowSchemaInformer converts an untyped informer into a TypedFlowSchemaInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *FlowSchema. If that is not the case, calling type-safe methods of the returned
+// TypedFlowSchemaInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedFlowSchemaInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedFlowSchemaInformer(informer FlowSchemaInformer) TypedFlowSchemaInformer {
+	if informer, ok := informer.(TypedFlowSchemaInformer); ok {
+		return informer
+	}
+	return &flowSchemaTypedInformerAdapter{informer}
+}
+
+type flowSchemaTypedInformerAdapter struct {
+	FlowSchemaInformer
+}
+
+func (a *flowSchemaTypedInformerAdapter) TypedInformer() FlowSchemaIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1.FlowSchema](a.Informer())
+}
+
+// ToFlowSchemaIndexInformer converts an untyped informer into a FlowSchemaIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *FlowSchema. If that is not the case, calling type-safe methods of the returned
+// FlowSchemaIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a FlowSchemaIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToFlowSchemaIndexInformer(informer cache.SharedIndexInformer) FlowSchemaIndexInformer {
+	if informer, ok := informer.(FlowSchemaIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1.FlowSchema](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/flowcontrol/v1/interface.go b/vendor/k8s.io/client-go/informers/flowcontrol/v1/interface.go
index 3de934900f..2c4a8465c7 100644
--- a/vendor/k8s.io/client-go/informers/flowcontrol/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/flowcontrol/v1/interface.go
@@ -25,9 +25,9 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// FlowSchemas returns a FlowSchemaInformer.
-	FlowSchemas() FlowSchemaInformer
+	FlowSchemas() TypedFlowSchemaInformer
 	// PriorityLevelConfigurations returns a PriorityLevelConfigurationInformer.
-	PriorityLevelConfigurations() PriorityLevelConfigurationInformer
+	PriorityLevelConfigurations() TypedPriorityLevelConfigurationInformer
 }
 
 type version struct {
@@ -41,12 +41,12 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// FlowSchemas returns a FlowSchemaInformer.
-func (v *version) FlowSchemas() FlowSchemaInformer {
+// FlowSchemas returns a TypedFlowSchemaInformer.
+func (v *version) FlowSchemas() TypedFlowSchemaInformer {
 	return &flowSchemaInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// PriorityLevelConfigurations returns a PriorityLevelConfigurationInformer.
-func (v *version) PriorityLevelConfigurations() PriorityLevelConfigurationInformer {
+// PriorityLevelConfigurations returns a TypedPriorityLevelConfigurationInformer.
+func (v *version) PriorityLevelConfigurations() TypedPriorityLevelConfigurationInformer {
 	return &priorityLevelConfigurationInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/flowcontrol/v1/prioritylevelconfiguration.go b/vendor/k8s.io/client-go/informers/flowcontrol/v1/prioritylevelconfiguration.go
index 5a42509553..7fd72aa9b8 100644
--- a/vendor/k8s.io/client-go/informers/flowcontrol/v1/prioritylevelconfiguration.go
+++ b/vendor/k8s.io/client-go/informers/flowcontrol/v1/prioritylevelconfiguration.go
@@ -34,12 +34,40 @@ import (
 )
 
 // PriorityLevelConfigurationInformer provides access to a shared informer and lister for
-// PriorityLevelConfigurations.
+// PriorityLevelConfigurations. Prefer using the type-safe variant (see [TypedPriorityLevelConfigurationInformer]).
 type PriorityLevelConfigurationInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() flowcontrolv1.PriorityLevelConfigurationLister
 }
 
+// TypedPriorityLevelConfigurationInformer provides access to a shared informer and lister for
+// PriorityLevelConfigurations, including the type-safe TypedInformer variant.
+// It is a superset of PriorityLevelConfigurationInformer.
+type TypedPriorityLevelConfigurationInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PriorityLevelConfigurationIndexInformer
+	Lister() flowcontrolv1.PriorityLevelConfigurationLister
+}
+
+// PriorityLevelConfigurationIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PriorityLevelConfigurationIndexInformer cache.TypedSharedIndexInformer[*apiflowcontrolv1.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiflowcontrolv1.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiflowcontrolv1.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiflowcontrolv1.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationIndexers is a specialization of [cache.TypedIndexers] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationIndexers = cache.TypedIndexers[*apiflowcontrolv1.PriorityLevelConfiguration]
+
+// DeletedPriorityLevelConfiguration is a specialization of [cache.DeletedObject] for PriorityLevelConfiguration.
+type DeletedPriorityLevelConfiguration = cache.DeletedObject[*apiflowcontrolv1.PriorityLevelConfiguration]
+
 type priorityLevelConfigurationInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type priorityLevelConfigurationInformer struct {
 // NewPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPriorityLevelConfigurationInformer]).
 func NewPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers PriorityLevelConfigurationIndexers) PriorityLevelConfigurationIndexInformer {
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPriorityLevelConfigurationInformer]).
 func NewFilteredPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers PriorityLevelConfigurationIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PriorityLevelConfigurationIndexInformer {
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewPriorityLevelConfigurationInformerWithOptions constructs a new informer for PriorityLevelConfiguration type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPriorityLevelConfigurationInformerWithOptions]).
 func NewPriorityLevelConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, options)
+}
+
+// NewTypedPriorityLevelConfigurationInformerWithOptions constructs a new informer for PriorityLevelConfiguration type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPriorityLevelConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) PriorityLevelConfigurationIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1", Resource: "prioritylevelconfigurations"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1.PriorityLevelConfiguration](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewPriorityLevelConfigurationInformerWithOptions(client kubernetes.Interfac
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *priorityLevelConfigurationInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *priorityLevelConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiflowcontrolv1.PriorityLevelConfiguration{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *priorityLevelConfigurationInformer) TypedInformer() PriorityLevelConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1.PriorityLevelConfiguration](f.factory.InformerFor(&apiflowcontrolv1.PriorityLevelConfiguration{}, f.defaultInformer))
 }
 
 func (f *priorityLevelConfigurationInformer) Lister() flowcontrolv1.PriorityLevelConfigurationLister {
 	return flowcontrolv1.NewPriorityLevelConfigurationLister(f.Informer().GetIndexer())
 }
+
+// ToTypedPriorityLevelConfigurationInformer converts an untyped informer into a TypedPriorityLevelConfigurationInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PriorityLevelConfiguration. If that is not the case, calling type-safe methods of the returned
+// TypedPriorityLevelConfigurationInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPriorityLevelConfigurationInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPriorityLevelConfigurationInformer(informer PriorityLevelConfigurationInformer) TypedPriorityLevelConfigurationInformer {
+	if informer, ok := informer.(TypedPriorityLevelConfigurationInformer); ok {
+		return informer
+	}
+	return &priorityLevelConfigurationTypedInformerAdapter{informer}
+}
+
+type priorityLevelConfigurationTypedInformerAdapter struct {
+	PriorityLevelConfigurationInformer
+}
+
+func (a *priorityLevelConfigurationTypedInformerAdapter) TypedInformer() PriorityLevelConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1.PriorityLevelConfiguration](a.Informer())
+}
+
+// ToPriorityLevelConfigurationIndexInformer converts an untyped informer into a PriorityLevelConfigurationIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PriorityLevelConfiguration. If that is not the case, calling type-safe methods of the returned
+// PriorityLevelConfigurationIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PriorityLevelConfigurationIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPriorityLevelConfigurationIndexInformer(informer cache.SharedIndexInformer) PriorityLevelConfigurationIndexInformer {
+	if informer, ok := informer.(PriorityLevelConfigurationIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1.PriorityLevelConfiguration](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta1/flowschema.go b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta1/flowschema.go
index 2e0098e664..d0d8778b3c 100644
--- a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta1/flowschema.go
+++ b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta1/flowschema.go
@@ -34,12 +34,40 @@ import (
 )
 
 // FlowSchemaInformer provides access to a shared informer and lister for
-// FlowSchemas.
+// FlowSchemas. Prefer using the type-safe variant (see [TypedFlowSchemaInformer]).
 type FlowSchemaInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() flowcontrolv1beta1.FlowSchemaLister
 }
 
+// TypedFlowSchemaInformer provides access to a shared informer and lister for
+// FlowSchemas, including the type-safe TypedInformer variant.
+// It is a superset of FlowSchemaInformer.
+type TypedFlowSchemaInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() FlowSchemaIndexInformer
+	Lister() flowcontrolv1beta1.FlowSchemaLister
+}
+
+// FlowSchemaIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type FlowSchemaIndexInformer cache.TypedSharedIndexInformer[*apiflowcontrolv1beta1.FlowSchema]
+
+// FlowSchemaHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for FlowSchema.
+type FlowSchemaHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiflowcontrolv1beta1.FlowSchema]
+
+// FlowSchemaDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for FlowSchema.
+type FlowSchemaDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiflowcontrolv1beta1.FlowSchema]
+
+// FlowSchemaFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for FlowSchema.
+type FlowSchemaFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiflowcontrolv1beta1.FlowSchema]
+
+// FlowSchemaIndexers is a specialization of [cache.TypedIndexers] for FlowSchema.
+type FlowSchemaIndexers = cache.TypedIndexers[*apiflowcontrolv1beta1.FlowSchema]
+
+// DeletedFlowSchema is a specialization of [cache.DeletedObject] for FlowSchema.
+type DeletedFlowSchema = cache.DeletedObject[*apiflowcontrolv1beta1.FlowSchema]
+
 type flowSchemaInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type flowSchemaInformer struct {
 // NewFlowSchemaInformer constructs a new informer for FlowSchema type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFlowSchemaInformer]).
 func NewFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedFlowSchemaInformer constructs a new informer for FlowSchema type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers FlowSchemaIndexers) FlowSchemaIndexInformer {
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredFlowSchemaInformer constructs a new informer for FlowSchema type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredFlowSchemaInformer]).
 func NewFilteredFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredFlowSchemaInformer constructs a new informer for FlowSchema type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers FlowSchemaIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) FlowSchemaIndexInformer {
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewFlowSchemaInformerWithOptions constructs a new informer for FlowSchema type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFlowSchemaInformerWithOptions]).
 func NewFlowSchemaInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedFlowSchemaInformerWithOptions(client, options)
+}
+
+// NewTypedFlowSchemaInformerWithOptions constructs a new informer for FlowSchema type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFlowSchemaInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) FlowSchemaIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta1", Resource: "flowschemas"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta1.FlowSchema](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewFlowSchemaInformerWithOptions(client kubernetes.Interface, options inter
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *flowSchemaInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *flowSchemaInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiflowcontrolv1beta1.FlowSchema{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *flowSchemaInformer) TypedInformer() FlowSchemaIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta1.FlowSchema](f.factory.InformerFor(&apiflowcontrolv1beta1.FlowSchema{}, f.defaultInformer))
 }
 
 func (f *flowSchemaInformer) Lister() flowcontrolv1beta1.FlowSchemaLister {
 	return flowcontrolv1beta1.NewFlowSchemaLister(f.Informer().GetIndexer())
 }
+
+// ToTypedFlowSchemaInformer converts an untyped informer into a TypedFlowSchemaInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *FlowSchema. If that is not the case, calling type-safe methods of the returned
+// TypedFlowSchemaInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedFlowSchemaInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedFlowSchemaInformer(informer FlowSchemaInformer) TypedFlowSchemaInformer {
+	if informer, ok := informer.(TypedFlowSchemaInformer); ok {
+		return informer
+	}
+	return &flowSchemaTypedInformerAdapter{informer}
+}
+
+type flowSchemaTypedInformerAdapter struct {
+	FlowSchemaInformer
+}
+
+func (a *flowSchemaTypedInformerAdapter) TypedInformer() FlowSchemaIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta1.FlowSchema](a.Informer())
+}
+
+// ToFlowSchemaIndexInformer converts an untyped informer into a FlowSchemaIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *FlowSchema. If that is not the case, calling type-safe methods of the returned
+// FlowSchemaIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a FlowSchemaIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToFlowSchemaIndexInformer(informer cache.SharedIndexInformer) FlowSchemaIndexInformer {
+	if informer, ok := informer.(FlowSchemaIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta1.FlowSchema](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta1/interface.go
index 50329bb0ac..576d8de678 100644
--- a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta1/interface.go
@@ -25,9 +25,9 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// FlowSchemas returns a FlowSchemaInformer.
-	FlowSchemas() FlowSchemaInformer
+	FlowSchemas() TypedFlowSchemaInformer
 	// PriorityLevelConfigurations returns a PriorityLevelConfigurationInformer.
-	PriorityLevelConfigurations() PriorityLevelConfigurationInformer
+	PriorityLevelConfigurations() TypedPriorityLevelConfigurationInformer
 }
 
 type version struct {
@@ -41,12 +41,12 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// FlowSchemas returns a FlowSchemaInformer.
-func (v *version) FlowSchemas() FlowSchemaInformer {
+// FlowSchemas returns a TypedFlowSchemaInformer.
+func (v *version) FlowSchemas() TypedFlowSchemaInformer {
 	return &flowSchemaInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// PriorityLevelConfigurations returns a PriorityLevelConfigurationInformer.
-func (v *version) PriorityLevelConfigurations() PriorityLevelConfigurationInformer {
+// PriorityLevelConfigurations returns a TypedPriorityLevelConfigurationInformer.
+func (v *version) PriorityLevelConfigurations() TypedPriorityLevelConfigurationInformer {
 	return &priorityLevelConfigurationInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta1/prioritylevelconfiguration.go b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta1/prioritylevelconfiguration.go
index 9c94839a1a..2b5cb8832f 100644
--- a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta1/prioritylevelconfiguration.go
+++ b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta1/prioritylevelconfiguration.go
@@ -34,12 +34,40 @@ import (
 )
 
 // PriorityLevelConfigurationInformer provides access to a shared informer and lister for
-// PriorityLevelConfigurations.
+// PriorityLevelConfigurations. Prefer using the type-safe variant (see [TypedPriorityLevelConfigurationInformer]).
 type PriorityLevelConfigurationInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() flowcontrolv1beta1.PriorityLevelConfigurationLister
 }
 
+// TypedPriorityLevelConfigurationInformer provides access to a shared informer and lister for
+// PriorityLevelConfigurations, including the type-safe TypedInformer variant.
+// It is a superset of PriorityLevelConfigurationInformer.
+type TypedPriorityLevelConfigurationInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PriorityLevelConfigurationIndexInformer
+	Lister() flowcontrolv1beta1.PriorityLevelConfigurationLister
+}
+
+// PriorityLevelConfigurationIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PriorityLevelConfigurationIndexInformer cache.TypedSharedIndexInformer[*apiflowcontrolv1beta1.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiflowcontrolv1beta1.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiflowcontrolv1beta1.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiflowcontrolv1beta1.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationIndexers is a specialization of [cache.TypedIndexers] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationIndexers = cache.TypedIndexers[*apiflowcontrolv1beta1.PriorityLevelConfiguration]
+
+// DeletedPriorityLevelConfiguration is a specialization of [cache.DeletedObject] for PriorityLevelConfiguration.
+type DeletedPriorityLevelConfiguration = cache.DeletedObject[*apiflowcontrolv1beta1.PriorityLevelConfiguration]
+
 type priorityLevelConfigurationInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type priorityLevelConfigurationInformer struct {
 // NewPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPriorityLevelConfigurationInformer]).
 func NewPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers PriorityLevelConfigurationIndexers) PriorityLevelConfigurationIndexInformer {
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPriorityLevelConfigurationInformer]).
 func NewFilteredPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers PriorityLevelConfigurationIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PriorityLevelConfigurationIndexInformer {
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewPriorityLevelConfigurationInformerWithOptions constructs a new informer for PriorityLevelConfiguration type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPriorityLevelConfigurationInformerWithOptions]).
 func NewPriorityLevelConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, options)
+}
+
+// NewTypedPriorityLevelConfigurationInformerWithOptions constructs a new informer for PriorityLevelConfiguration type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPriorityLevelConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) PriorityLevelConfigurationIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta1", Resource: "prioritylevelconfigurations"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta1.PriorityLevelConfiguration](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewPriorityLevelConfigurationInformerWithOptions(client kubernetes.Interfac
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *priorityLevelConfigurationInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *priorityLevelConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiflowcontrolv1beta1.PriorityLevelConfiguration{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *priorityLevelConfigurationInformer) TypedInformer() PriorityLevelConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta1.PriorityLevelConfiguration](f.factory.InformerFor(&apiflowcontrolv1beta1.PriorityLevelConfiguration{}, f.defaultInformer))
 }
 
 func (f *priorityLevelConfigurationInformer) Lister() flowcontrolv1beta1.PriorityLevelConfigurationLister {
 	return flowcontrolv1beta1.NewPriorityLevelConfigurationLister(f.Informer().GetIndexer())
 }
+
+// ToTypedPriorityLevelConfigurationInformer converts an untyped informer into a TypedPriorityLevelConfigurationInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PriorityLevelConfiguration. If that is not the case, calling type-safe methods of the returned
+// TypedPriorityLevelConfigurationInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPriorityLevelConfigurationInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPriorityLevelConfigurationInformer(informer PriorityLevelConfigurationInformer) TypedPriorityLevelConfigurationInformer {
+	if informer, ok := informer.(TypedPriorityLevelConfigurationInformer); ok {
+		return informer
+	}
+	return &priorityLevelConfigurationTypedInformerAdapter{informer}
+}
+
+type priorityLevelConfigurationTypedInformerAdapter struct {
+	PriorityLevelConfigurationInformer
+}
+
+func (a *priorityLevelConfigurationTypedInformerAdapter) TypedInformer() PriorityLevelConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta1.PriorityLevelConfiguration](a.Informer())
+}
+
+// ToPriorityLevelConfigurationIndexInformer converts an untyped informer into a PriorityLevelConfigurationIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PriorityLevelConfiguration. If that is not the case, calling type-safe methods of the returned
+// PriorityLevelConfigurationIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PriorityLevelConfigurationIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPriorityLevelConfigurationIndexInformer(informer cache.SharedIndexInformer) PriorityLevelConfigurationIndexInformer {
+	if informer, ok := informer.(PriorityLevelConfigurationIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta1.PriorityLevelConfiguration](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta2/flowschema.go b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta2/flowschema.go
index aba4d712af..39cb1fbdfb 100644
--- a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta2/flowschema.go
+++ b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta2/flowschema.go
@@ -34,12 +34,40 @@ import (
 )
 
 // FlowSchemaInformer provides access to a shared informer and lister for
-// FlowSchemas.
+// FlowSchemas. Prefer using the type-safe variant (see [TypedFlowSchemaInformer]).
 type FlowSchemaInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() flowcontrolv1beta2.FlowSchemaLister
 }
 
+// TypedFlowSchemaInformer provides access to a shared informer and lister for
+// FlowSchemas, including the type-safe TypedInformer variant.
+// It is a superset of FlowSchemaInformer.
+type TypedFlowSchemaInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() FlowSchemaIndexInformer
+	Lister() flowcontrolv1beta2.FlowSchemaLister
+}
+
+// FlowSchemaIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type FlowSchemaIndexInformer cache.TypedSharedIndexInformer[*apiflowcontrolv1beta2.FlowSchema]
+
+// FlowSchemaHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for FlowSchema.
+type FlowSchemaHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiflowcontrolv1beta2.FlowSchema]
+
+// FlowSchemaDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for FlowSchema.
+type FlowSchemaDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiflowcontrolv1beta2.FlowSchema]
+
+// FlowSchemaFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for FlowSchema.
+type FlowSchemaFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiflowcontrolv1beta2.FlowSchema]
+
+// FlowSchemaIndexers is a specialization of [cache.TypedIndexers] for FlowSchema.
+type FlowSchemaIndexers = cache.TypedIndexers[*apiflowcontrolv1beta2.FlowSchema]
+
+// DeletedFlowSchema is a specialization of [cache.DeletedObject] for FlowSchema.
+type DeletedFlowSchema = cache.DeletedObject[*apiflowcontrolv1beta2.FlowSchema]
+
 type flowSchemaInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type flowSchemaInformer struct {
 // NewFlowSchemaInformer constructs a new informer for FlowSchema type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFlowSchemaInformer]).
 func NewFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedFlowSchemaInformer constructs a new informer for FlowSchema type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers FlowSchemaIndexers) FlowSchemaIndexInformer {
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredFlowSchemaInformer constructs a new informer for FlowSchema type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredFlowSchemaInformer]).
 func NewFilteredFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredFlowSchemaInformer constructs a new informer for FlowSchema type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers FlowSchemaIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) FlowSchemaIndexInformer {
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewFlowSchemaInformerWithOptions constructs a new informer for FlowSchema type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFlowSchemaInformerWithOptions]).
 func NewFlowSchemaInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedFlowSchemaInformerWithOptions(client, options)
+}
+
+// NewTypedFlowSchemaInformerWithOptions constructs a new informer for FlowSchema type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFlowSchemaInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) FlowSchemaIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta2", Resource: "flowschemas"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta2.FlowSchema](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewFlowSchemaInformerWithOptions(client kubernetes.Interface, options inter
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *flowSchemaInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *flowSchemaInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiflowcontrolv1beta2.FlowSchema{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *flowSchemaInformer) TypedInformer() FlowSchemaIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta2.FlowSchema](f.factory.InformerFor(&apiflowcontrolv1beta2.FlowSchema{}, f.defaultInformer))
 }
 
 func (f *flowSchemaInformer) Lister() flowcontrolv1beta2.FlowSchemaLister {
 	return flowcontrolv1beta2.NewFlowSchemaLister(f.Informer().GetIndexer())
 }
+
+// ToTypedFlowSchemaInformer converts an untyped informer into a TypedFlowSchemaInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *FlowSchema. If that is not the case, calling type-safe methods of the returned
+// TypedFlowSchemaInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedFlowSchemaInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedFlowSchemaInformer(informer FlowSchemaInformer) TypedFlowSchemaInformer {
+	if informer, ok := informer.(TypedFlowSchemaInformer); ok {
+		return informer
+	}
+	return &flowSchemaTypedInformerAdapter{informer}
+}
+
+type flowSchemaTypedInformerAdapter struct {
+	FlowSchemaInformer
+}
+
+func (a *flowSchemaTypedInformerAdapter) TypedInformer() FlowSchemaIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta2.FlowSchema](a.Informer())
+}
+
+// ToFlowSchemaIndexInformer converts an untyped informer into a FlowSchemaIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *FlowSchema. If that is not the case, calling type-safe methods of the returned
+// FlowSchemaIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a FlowSchemaIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToFlowSchemaIndexInformer(informer cache.SharedIndexInformer) FlowSchemaIndexInformer {
+	if informer, ok := informer.(FlowSchemaIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta2.FlowSchema](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta2/interface.go b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta2/interface.go
index 142d552896..f362f533ba 100644
--- a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta2/interface.go
+++ b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta2/interface.go
@@ -25,9 +25,9 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// FlowSchemas returns a FlowSchemaInformer.
-	FlowSchemas() FlowSchemaInformer
+	FlowSchemas() TypedFlowSchemaInformer
 	// PriorityLevelConfigurations returns a PriorityLevelConfigurationInformer.
-	PriorityLevelConfigurations() PriorityLevelConfigurationInformer
+	PriorityLevelConfigurations() TypedPriorityLevelConfigurationInformer
 }
 
 type version struct {
@@ -41,12 +41,12 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// FlowSchemas returns a FlowSchemaInformer.
-func (v *version) FlowSchemas() FlowSchemaInformer {
+// FlowSchemas returns a TypedFlowSchemaInformer.
+func (v *version) FlowSchemas() TypedFlowSchemaInformer {
 	return &flowSchemaInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// PriorityLevelConfigurations returns a PriorityLevelConfigurationInformer.
-func (v *version) PriorityLevelConfigurations() PriorityLevelConfigurationInformer {
+// PriorityLevelConfigurations returns a TypedPriorityLevelConfigurationInformer.
+func (v *version) PriorityLevelConfigurations() TypedPriorityLevelConfigurationInformer {
 	return &priorityLevelConfigurationInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta2/prioritylevelconfiguration.go b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta2/prioritylevelconfiguration.go
index 0ce811759a..9915275498 100644
--- a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta2/prioritylevelconfiguration.go
+++ b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta2/prioritylevelconfiguration.go
@@ -34,12 +34,40 @@ import (
 )
 
 // PriorityLevelConfigurationInformer provides access to a shared informer and lister for
-// PriorityLevelConfigurations.
+// PriorityLevelConfigurations. Prefer using the type-safe variant (see [TypedPriorityLevelConfigurationInformer]).
 type PriorityLevelConfigurationInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() flowcontrolv1beta2.PriorityLevelConfigurationLister
 }
 
+// TypedPriorityLevelConfigurationInformer provides access to a shared informer and lister for
+// PriorityLevelConfigurations, including the type-safe TypedInformer variant.
+// It is a superset of PriorityLevelConfigurationInformer.
+type TypedPriorityLevelConfigurationInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PriorityLevelConfigurationIndexInformer
+	Lister() flowcontrolv1beta2.PriorityLevelConfigurationLister
+}
+
+// PriorityLevelConfigurationIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PriorityLevelConfigurationIndexInformer cache.TypedSharedIndexInformer[*apiflowcontrolv1beta2.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiflowcontrolv1beta2.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiflowcontrolv1beta2.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiflowcontrolv1beta2.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationIndexers is a specialization of [cache.TypedIndexers] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationIndexers = cache.TypedIndexers[*apiflowcontrolv1beta2.PriorityLevelConfiguration]
+
+// DeletedPriorityLevelConfiguration is a specialization of [cache.DeletedObject] for PriorityLevelConfiguration.
+type DeletedPriorityLevelConfiguration = cache.DeletedObject[*apiflowcontrolv1beta2.PriorityLevelConfiguration]
+
 type priorityLevelConfigurationInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type priorityLevelConfigurationInformer struct {
 // NewPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPriorityLevelConfigurationInformer]).
 func NewPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers PriorityLevelConfigurationIndexers) PriorityLevelConfigurationIndexInformer {
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPriorityLevelConfigurationInformer]).
 func NewFilteredPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers PriorityLevelConfigurationIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PriorityLevelConfigurationIndexInformer {
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewPriorityLevelConfigurationInformerWithOptions constructs a new informer for PriorityLevelConfiguration type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPriorityLevelConfigurationInformerWithOptions]).
 func NewPriorityLevelConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, options)
+}
+
+// NewTypedPriorityLevelConfigurationInformerWithOptions constructs a new informer for PriorityLevelConfiguration type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPriorityLevelConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) PriorityLevelConfigurationIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta2", Resource: "prioritylevelconfigurations"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta2.PriorityLevelConfiguration](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewPriorityLevelConfigurationInformerWithOptions(client kubernetes.Interfac
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *priorityLevelConfigurationInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *priorityLevelConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiflowcontrolv1beta2.PriorityLevelConfiguration{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *priorityLevelConfigurationInformer) TypedInformer() PriorityLevelConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta2.PriorityLevelConfiguration](f.factory.InformerFor(&apiflowcontrolv1beta2.PriorityLevelConfiguration{}, f.defaultInformer))
 }
 
 func (f *priorityLevelConfigurationInformer) Lister() flowcontrolv1beta2.PriorityLevelConfigurationLister {
 	return flowcontrolv1beta2.NewPriorityLevelConfigurationLister(f.Informer().GetIndexer())
 }
+
+// ToTypedPriorityLevelConfigurationInformer converts an untyped informer into a TypedPriorityLevelConfigurationInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PriorityLevelConfiguration. If that is not the case, calling type-safe methods of the returned
+// TypedPriorityLevelConfigurationInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPriorityLevelConfigurationInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPriorityLevelConfigurationInformer(informer PriorityLevelConfigurationInformer) TypedPriorityLevelConfigurationInformer {
+	if informer, ok := informer.(TypedPriorityLevelConfigurationInformer); ok {
+		return informer
+	}
+	return &priorityLevelConfigurationTypedInformerAdapter{informer}
+}
+
+type priorityLevelConfigurationTypedInformerAdapter struct {
+	PriorityLevelConfigurationInformer
+}
+
+func (a *priorityLevelConfigurationTypedInformerAdapter) TypedInformer() PriorityLevelConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta2.PriorityLevelConfiguration](a.Informer())
+}
+
+// ToPriorityLevelConfigurationIndexInformer converts an untyped informer into a PriorityLevelConfigurationIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PriorityLevelConfiguration. If that is not the case, calling type-safe methods of the returned
+// PriorityLevelConfigurationIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PriorityLevelConfigurationIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPriorityLevelConfigurationIndexInformer(informer cache.SharedIndexInformer) PriorityLevelConfigurationIndexInformer {
+	if informer, ok := informer.(PriorityLevelConfigurationIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta2.PriorityLevelConfiguration](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta3/flowschema.go b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta3/flowschema.go
index 16ce2ba23c..30bd5e341f 100644
--- a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta3/flowschema.go
+++ b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta3/flowschema.go
@@ -34,12 +34,40 @@ import (
 )
 
 // FlowSchemaInformer provides access to a shared informer and lister for
-// FlowSchemas.
+// FlowSchemas. Prefer using the type-safe variant (see [TypedFlowSchemaInformer]).
 type FlowSchemaInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() flowcontrolv1beta3.FlowSchemaLister
 }
 
+// TypedFlowSchemaInformer provides access to a shared informer and lister for
+// FlowSchemas, including the type-safe TypedInformer variant.
+// It is a superset of FlowSchemaInformer.
+type TypedFlowSchemaInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() FlowSchemaIndexInformer
+	Lister() flowcontrolv1beta3.FlowSchemaLister
+}
+
+// FlowSchemaIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type FlowSchemaIndexInformer cache.TypedSharedIndexInformer[*apiflowcontrolv1beta3.FlowSchema]
+
+// FlowSchemaHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for FlowSchema.
+type FlowSchemaHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiflowcontrolv1beta3.FlowSchema]
+
+// FlowSchemaDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for FlowSchema.
+type FlowSchemaDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiflowcontrolv1beta3.FlowSchema]
+
+// FlowSchemaFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for FlowSchema.
+type FlowSchemaFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiflowcontrolv1beta3.FlowSchema]
+
+// FlowSchemaIndexers is a specialization of [cache.TypedIndexers] for FlowSchema.
+type FlowSchemaIndexers = cache.TypedIndexers[*apiflowcontrolv1beta3.FlowSchema]
+
+// DeletedFlowSchema is a specialization of [cache.DeletedObject] for FlowSchema.
+type DeletedFlowSchema = cache.DeletedObject[*apiflowcontrolv1beta3.FlowSchema]
+
 type flowSchemaInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type flowSchemaInformer struct {
 // NewFlowSchemaInformer constructs a new informer for FlowSchema type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFlowSchemaInformer]).
 func NewFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedFlowSchemaInformer constructs a new informer for FlowSchema type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers FlowSchemaIndexers) FlowSchemaIndexInformer {
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredFlowSchemaInformer constructs a new informer for FlowSchema type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredFlowSchemaInformer]).
 func NewFilteredFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredFlowSchemaInformer constructs a new informer for FlowSchema type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredFlowSchemaInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers FlowSchemaIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) FlowSchemaIndexInformer {
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewFlowSchemaInformerWithOptions constructs a new informer for FlowSchema type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFlowSchemaInformerWithOptions]).
 func NewFlowSchemaInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedFlowSchemaInformerWithOptions(client, options)
+}
+
+// NewTypedFlowSchemaInformerWithOptions constructs a new informer for FlowSchema type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFlowSchemaInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) FlowSchemaIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta3", Resource: "flowschemas"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta3.FlowSchema](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewFlowSchemaInformerWithOptions(client kubernetes.Interface, options inter
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *flowSchemaInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedFlowSchemaInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *flowSchemaInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiflowcontrolv1beta3.FlowSchema{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *flowSchemaInformer) TypedInformer() FlowSchemaIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta3.FlowSchema](f.factory.InformerFor(&apiflowcontrolv1beta3.FlowSchema{}, f.defaultInformer))
 }
 
 func (f *flowSchemaInformer) Lister() flowcontrolv1beta3.FlowSchemaLister {
 	return flowcontrolv1beta3.NewFlowSchemaLister(f.Informer().GetIndexer())
 }
+
+// ToTypedFlowSchemaInformer converts an untyped informer into a TypedFlowSchemaInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *FlowSchema. If that is not the case, calling type-safe methods of the returned
+// TypedFlowSchemaInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedFlowSchemaInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedFlowSchemaInformer(informer FlowSchemaInformer) TypedFlowSchemaInformer {
+	if informer, ok := informer.(TypedFlowSchemaInformer); ok {
+		return informer
+	}
+	return &flowSchemaTypedInformerAdapter{informer}
+}
+
+type flowSchemaTypedInformerAdapter struct {
+	FlowSchemaInformer
+}
+
+func (a *flowSchemaTypedInformerAdapter) TypedInformer() FlowSchemaIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta3.FlowSchema](a.Informer())
+}
+
+// ToFlowSchemaIndexInformer converts an untyped informer into a FlowSchemaIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *FlowSchema. If that is not the case, calling type-safe methods of the returned
+// FlowSchemaIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a FlowSchemaIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToFlowSchemaIndexInformer(informer cache.SharedIndexInformer) FlowSchemaIndexInformer {
+	if informer, ok := informer.(FlowSchemaIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta3.FlowSchema](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta3/interface.go b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta3/interface.go
index 54c5414a2b..cff3a94cb2 100644
--- a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta3/interface.go
+++ b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta3/interface.go
@@ -25,9 +25,9 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// FlowSchemas returns a FlowSchemaInformer.
-	FlowSchemas() FlowSchemaInformer
+	FlowSchemas() TypedFlowSchemaInformer
 	// PriorityLevelConfigurations returns a PriorityLevelConfigurationInformer.
-	PriorityLevelConfigurations() PriorityLevelConfigurationInformer
+	PriorityLevelConfigurations() TypedPriorityLevelConfigurationInformer
 }
 
 type version struct {
@@ -41,12 +41,12 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// FlowSchemas returns a FlowSchemaInformer.
-func (v *version) FlowSchemas() FlowSchemaInformer {
+// FlowSchemas returns a TypedFlowSchemaInformer.
+func (v *version) FlowSchemas() TypedFlowSchemaInformer {
 	return &flowSchemaInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// PriorityLevelConfigurations returns a PriorityLevelConfigurationInformer.
-func (v *version) PriorityLevelConfigurations() PriorityLevelConfigurationInformer {
+// PriorityLevelConfigurations returns a TypedPriorityLevelConfigurationInformer.
+func (v *version) PriorityLevelConfigurations() TypedPriorityLevelConfigurationInformer {
 	return &priorityLevelConfigurationInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta3/prioritylevelconfiguration.go b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta3/prioritylevelconfiguration.go
index ab63c8e62b..0402662b81 100644
--- a/vendor/k8s.io/client-go/informers/flowcontrol/v1beta3/prioritylevelconfiguration.go
+++ b/vendor/k8s.io/client-go/informers/flowcontrol/v1beta3/prioritylevelconfiguration.go
@@ -34,12 +34,40 @@ import (
 )
 
 // PriorityLevelConfigurationInformer provides access to a shared informer and lister for
-// PriorityLevelConfigurations.
+// PriorityLevelConfigurations. Prefer using the type-safe variant (see [TypedPriorityLevelConfigurationInformer]).
 type PriorityLevelConfigurationInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() flowcontrolv1beta3.PriorityLevelConfigurationLister
 }
 
+// TypedPriorityLevelConfigurationInformer provides access to a shared informer and lister for
+// PriorityLevelConfigurations, including the type-safe TypedInformer variant.
+// It is a superset of PriorityLevelConfigurationInformer.
+type TypedPriorityLevelConfigurationInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PriorityLevelConfigurationIndexInformer
+	Lister() flowcontrolv1beta3.PriorityLevelConfigurationLister
+}
+
+// PriorityLevelConfigurationIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PriorityLevelConfigurationIndexInformer cache.TypedSharedIndexInformer[*apiflowcontrolv1beta3.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiflowcontrolv1beta3.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiflowcontrolv1beta3.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiflowcontrolv1beta3.PriorityLevelConfiguration]
+
+// PriorityLevelConfigurationIndexers is a specialization of [cache.TypedIndexers] for PriorityLevelConfiguration.
+type PriorityLevelConfigurationIndexers = cache.TypedIndexers[*apiflowcontrolv1beta3.PriorityLevelConfiguration]
+
+// DeletedPriorityLevelConfiguration is a specialization of [cache.DeletedObject] for PriorityLevelConfiguration.
+type DeletedPriorityLevelConfiguration = cache.DeletedObject[*apiflowcontrolv1beta3.PriorityLevelConfiguration]
+
 type priorityLevelConfigurationInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type priorityLevelConfigurationInformer struct {
 // NewPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPriorityLevelConfigurationInformer]).
 func NewPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers PriorityLevelConfigurationIndexers) PriorityLevelConfigurationIndexInformer {
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPriorityLevelConfigurationInformer]).
 func NewFilteredPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPriorityLevelConfigurationInformer constructs a new informer for PriorityLevelConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPriorityLevelConfigurationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers PriorityLevelConfigurationIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PriorityLevelConfigurationIndexInformer {
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewPriorityLevelConfigurationInformerWithOptions constructs a new informer for PriorityLevelConfiguration type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPriorityLevelConfigurationInformerWithOptions]).
 func NewPriorityLevelConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, options)
+}
+
+// NewTypedPriorityLevelConfigurationInformerWithOptions constructs a new informer for PriorityLevelConfiguration type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPriorityLevelConfigurationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) PriorityLevelConfigurationIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta3", Resource: "prioritylevelconfigurations"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta3.PriorityLevelConfiguration](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewPriorityLevelConfigurationInformerWithOptions(client kubernetes.Interfac
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *priorityLevelConfigurationInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedPriorityLevelConfigurationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *priorityLevelConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiflowcontrolv1beta3.PriorityLevelConfiguration{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *priorityLevelConfigurationInformer) TypedInformer() PriorityLevelConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta3.PriorityLevelConfiguration](f.factory.InformerFor(&apiflowcontrolv1beta3.PriorityLevelConfiguration{}, f.defaultInformer))
 }
 
 func (f *priorityLevelConfigurationInformer) Lister() flowcontrolv1beta3.PriorityLevelConfigurationLister {
 	return flowcontrolv1beta3.NewPriorityLevelConfigurationLister(f.Informer().GetIndexer())
 }
+
+// ToTypedPriorityLevelConfigurationInformer converts an untyped informer into a TypedPriorityLevelConfigurationInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PriorityLevelConfiguration. If that is not the case, calling type-safe methods of the returned
+// TypedPriorityLevelConfigurationInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPriorityLevelConfigurationInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPriorityLevelConfigurationInformer(informer PriorityLevelConfigurationInformer) TypedPriorityLevelConfigurationInformer {
+	if informer, ok := informer.(TypedPriorityLevelConfigurationInformer); ok {
+		return informer
+	}
+	return &priorityLevelConfigurationTypedInformerAdapter{informer}
+}
+
+type priorityLevelConfigurationTypedInformerAdapter struct {
+	PriorityLevelConfigurationInformer
+}
+
+func (a *priorityLevelConfigurationTypedInformerAdapter) TypedInformer() PriorityLevelConfigurationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta3.PriorityLevelConfiguration](a.Informer())
+}
+
+// ToPriorityLevelConfigurationIndexInformer converts an untyped informer into a PriorityLevelConfigurationIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PriorityLevelConfiguration. If that is not the case, calling type-safe methods of the returned
+// PriorityLevelConfigurationIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PriorityLevelConfigurationIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPriorityLevelConfigurationIndexInformer(informer cache.SharedIndexInformer) PriorityLevelConfigurationIndexInformer {
+	if informer, ok := informer.(PriorityLevelConfigurationIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiflowcontrolv1beta3.PriorityLevelConfiguration](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/generic.go b/vendor/k8s.io/client-go/informers/generic.go
index 03c45c71cf..ab966b9490 100644
--- a/vendor/k8s.io/client-go/informers/generic.go
+++ b/vendor/k8s.io/client-go/informers/generic.go
@@ -48,6 +48,7 @@ import (
 	flowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
 	flowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
 	v1beta3 "k8s.io/api/flowcontrol/v1beta3"
+	lifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
 	networkingv1 "k8s.io/api/networking/v1"
 	networkingv1beta1 "k8s.io/api/networking/v1beta1"
 	nodev1 "k8s.io/api/node/v1"
@@ -63,11 +64,12 @@ import (
 	resourcev1beta1 "k8s.io/api/resource/v1beta1"
 	resourcev1beta2 "k8s.io/api/resource/v1beta2"
 	schedulingv1 "k8s.io/api/scheduling/v1"
-	schedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
 	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
 	storagev1 "k8s.io/api/storage/v1"
 	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
+	storagemigrationv1 "k8s.io/api/storagemigration/v1"
 	storagemigrationv1beta1 "k8s.io/api/storagemigration/v1beta1"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	cache "k8s.io/client-go/tools/cache"
@@ -190,6 +192,10 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 		// Group=certificates.k8s.io, Version=v1
 	case certificatesv1.SchemeGroupVersion.WithResource("certificatesigningrequests"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Certificates().V1().CertificateSigningRequests().Informer()}, nil
+	case certificatesv1.SchemeGroupVersion.WithResource("clustertrustbundles"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Certificates().V1().ClusterTrustBundles().Informer()}, nil
+	case certificatesv1.SchemeGroupVersion.WithResource("podcertificaterequests"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Certificates().V1().PodCertificateRequests().Informer()}, nil
 
 		// Group=certificates.k8s.io, Version=v1alpha1
 	case certificatesv1alpha1.SchemeGroupVersion.WithResource("clustertrustbundles"):
@@ -307,6 +313,12 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 	case apiserverinternalv1alpha1.SchemeGroupVersion.WithResource("storageversions"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Internal().V1alpha1().StorageVersions().Informer()}, nil
 
+		// Group=lifecycle.k8s.io, Version=v1alpha1
+	case lifecyclev1alpha1.SchemeGroupVersion.WithResource("evictions"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Lifecycle().V1alpha1().Evictions().Informer()}, nil
+	case lifecyclev1alpha1.SchemeGroupVersion.WithResource("evictionrequests"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Lifecycle().V1alpha1().EvictionRequests().Informer()}, nil
+
 		// Group=networking.k8s.io, Version=v1
 	case networkingv1.SchemeGroupVersion.WithResource("ipaddresses"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Networking().V1().IPAddresses().Informer()}, nil
@@ -382,6 +394,8 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 		// Group=resource.k8s.io, Version=v1
 	case resourcev1.SchemeGroupVersion.WithResource("deviceclasses"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Resource().V1().DeviceClasses().Informer()}, nil
+	case resourcev1.SchemeGroupVersion.WithResource("devicetaintrules"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Resource().V1().DeviceTaintRules().Informer()}, nil
 	case resourcev1.SchemeGroupVersion.WithResource("resourceclaims"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Resource().V1().ResourceClaims().Informer()}, nil
 	case resourcev1.SchemeGroupVersion.WithResource("resourceclaimtemplates"):
@@ -421,15 +435,21 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 	case schedulingv1.SchemeGroupVersion.WithResource("priorityclasses"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Scheduling().V1().PriorityClasses().Informer()}, nil
 
-		// Group=scheduling.k8s.io, Version=v1alpha2
-	case schedulingv1alpha2.SchemeGroupVersion.WithResource("podgroups"):
-		return &genericInformer{resource: resource.GroupResource(), informer: f.Scheduling().V1alpha2().PodGroups().Informer()}, nil
-	case schedulingv1alpha2.SchemeGroupVersion.WithResource("workloads"):
-		return &genericInformer{resource: resource.GroupResource(), informer: f.Scheduling().V1alpha2().Workloads().Informer()}, nil
+		// Group=scheduling.k8s.io, Version=v1alpha3
+	case schedulingv1alpha3.SchemeGroupVersion.WithResource("compositepodgroups"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Scheduling().V1alpha3().CompositePodGroups().Informer()}, nil
+	case schedulingv1alpha3.SchemeGroupVersion.WithResource("podgroups"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Scheduling().V1alpha3().PodGroups().Informer()}, nil
+	case schedulingv1alpha3.SchemeGroupVersion.WithResource("workloads"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Scheduling().V1alpha3().Workloads().Informer()}, nil
 
 		// Group=scheduling.k8s.io, Version=v1beta1
+	case schedulingv1beta1.SchemeGroupVersion.WithResource("podgroups"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Scheduling().V1beta1().PodGroups().Informer()}, nil
 	case schedulingv1beta1.SchemeGroupVersion.WithResource("priorityclasses"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Scheduling().V1beta1().PriorityClasses().Informer()}, nil
+	case schedulingv1beta1.SchemeGroupVersion.WithResource("workloads"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Scheduling().V1beta1().Workloads().Informer()}, nil
 
 		// Group=storage.k8s.io, Version=v1
 	case storagev1.SchemeGroupVersion.WithResource("csidrivers"):
@@ -467,6 +487,10 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 	case storagev1beta1.SchemeGroupVersion.WithResource("volumeattributesclasses"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Storage().V1beta1().VolumeAttributesClasses().Informer()}, nil
 
+		// Group=storagemigration.k8s.io, Version=v1
+	case storagemigrationv1.SchemeGroupVersion.WithResource("storageversionmigrations"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Storagemigration().V1().StorageVersionMigrations().Informer()}, nil
+
 		// Group=storagemigration.k8s.io, Version=v1beta1
 	case storagemigrationv1beta1.SchemeGroupVersion.WithResource("storageversionmigrations"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Storagemigration().V1beta1().StorageVersionMigrations().Informer()}, nil
diff --git a/vendor/k8s.io/client-go/informers/lifecycle/interface.go b/vendor/k8s.io/client-go/informers/lifecycle/interface.go
new file mode 100644
index 0000000000..c9b3e3476f
--- /dev/null
+++ b/vendor/k8s.io/client-go/informers/lifecycle/interface.go
@@ -0,0 +1,46 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package lifecycle
+
+import (
+	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+	v1alpha1 "k8s.io/client-go/informers/lifecycle/v1alpha1"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1alpha1 provides access to shared informers for resources in V1alpha1.
+	V1alpha1() v1alpha1.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1alpha1 returns a new v1alpha1.Interface.
+func (g *group) V1alpha1() v1alpha1.Interface {
+	return v1alpha1.New(g.factory, g.namespace, g.tweakListOptions)
+}
diff --git a/vendor/k8s.io/client-go/informers/lifecycle/v1alpha1/eviction.go b/vendor/k8s.io/client-go/informers/lifecycle/v1alpha1/eviction.go
new file mode 100644
index 0000000000..bf408957fa
--- /dev/null
+++ b/vendor/k8s.io/client-go/informers/lifecycle/v1alpha1/eviction.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+	time "time"
+
+	apilifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+	kubernetes "k8s.io/client-go/kubernetes"
+	lifecyclev1alpha1 "k8s.io/client-go/listers/lifecycle/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// EvictionInformer provides access to a shared informer and lister for
+// Evictions. Prefer using the type-safe variant (see [TypedEvictionInformer]).
+type EvictionInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() lifecyclev1alpha1.EvictionLister
+}
+
+// TypedEvictionInformer provides access to a shared informer and lister for
+// Evictions, including the type-safe TypedInformer variant.
+// It is a superset of EvictionInformer.
+type TypedEvictionInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() EvictionIndexInformer
+	Lister() lifecyclev1alpha1.EvictionLister
+}
+
+// EvictionIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type EvictionIndexInformer cache.TypedSharedIndexInformer[*apilifecyclev1alpha1.Eviction]
+
+// EvictionHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Eviction.
+type EvictionHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apilifecyclev1alpha1.Eviction]
+
+// EvictionDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Eviction.
+type EvictionDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apilifecyclev1alpha1.Eviction]
+
+// EvictionFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Eviction.
+type EvictionFilteringHandler = cache.TypedFilteringResourceEventHandler[*apilifecyclev1alpha1.Eviction]
+
+// EvictionIndexers is a specialization of [cache.TypedIndexers] for Eviction.
+type EvictionIndexers = cache.TypedIndexers[*apilifecyclev1alpha1.Eviction]
+
+// DeletedEviction is a specialization of [cache.DeletedObject] for Eviction.
+type DeletedEviction = cache.DeletedObject[*apilifecyclev1alpha1.Eviction]
+
+type evictionInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewEvictionInformer constructs a new informer for Eviction type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEvictionInformer]).
+func NewEvictionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewEvictionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedEvictionInformer constructs a new informer for Eviction type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEvictionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EvictionIndexers) EvictionIndexInformer {
+	return NewTypedEvictionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredEvictionInformer constructs a new informer for Eviction type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredEvictionInformer]).
+func NewFilteredEvictionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedEvictionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredEvictionInformer constructs a new informer for Eviction type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredEvictionInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EvictionIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) EvictionIndexInformer {
+	return NewTypedEvictionInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewEvictionInformerWithOptions constructs a new informer for Eviction type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEvictionInformerWithOptions]).
+func NewEvictionInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedEvictionInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedEvictionInformerWithOptions constructs a new informer for Eviction type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEvictionInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) EvictionIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "lifecycle.k8s.io", Version: "v1alpha1", Resource: "evictions"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apilifecyclev1alpha1.Eviction](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.LifecycleV1alpha1().Evictions(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.LifecycleV1alpha1().Evictions(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.LifecycleV1alpha1().Evictions(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.LifecycleV1alpha1().Evictions(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apilifecyclev1alpha1.Eviction{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *evictionInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedEvictionInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *evictionInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *evictionInformer) TypedInformer() EvictionIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apilifecyclev1alpha1.Eviction](f.factory.InformerFor(&apilifecyclev1alpha1.Eviction{}, f.defaultInformer))
+}
+
+func (f *evictionInformer) Lister() lifecyclev1alpha1.EvictionLister {
+	return lifecyclev1alpha1.NewEvictionLister(f.Informer().GetIndexer())
+}
+
+// ToTypedEvictionInformer converts an untyped informer into a TypedEvictionInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Eviction. If that is not the case, calling type-safe methods of the returned
+// TypedEvictionInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedEvictionInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedEvictionInformer(informer EvictionInformer) TypedEvictionInformer {
+	if informer, ok := informer.(TypedEvictionInformer); ok {
+		return informer
+	}
+	return &evictionTypedInformerAdapter{informer}
+}
+
+type evictionTypedInformerAdapter struct {
+	EvictionInformer
+}
+
+func (a *evictionTypedInformerAdapter) TypedInformer() EvictionIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apilifecyclev1alpha1.Eviction](a.Informer())
+}
+
+// ToEvictionIndexInformer converts an untyped informer into a EvictionIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Eviction. If that is not the case, calling type-safe methods of the returned
+// EvictionIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a EvictionIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToEvictionIndexInformer(informer cache.SharedIndexInformer) EvictionIndexInformer {
+	if informer, ok := informer.(EvictionIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apilifecyclev1alpha1.Eviction](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/lifecycle/v1alpha1/evictionrequest.go b/vendor/k8s.io/client-go/informers/lifecycle/v1alpha1/evictionrequest.go
new file mode 100644
index 0000000000..2e76157404
--- /dev/null
+++ b/vendor/k8s.io/client-go/informers/lifecycle/v1alpha1/evictionrequest.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+	time "time"
+
+	apilifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+	kubernetes "k8s.io/client-go/kubernetes"
+	lifecyclev1alpha1 "k8s.io/client-go/listers/lifecycle/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// EvictionRequestInformer provides access to a shared informer and lister for
+// EvictionRequests. Prefer using the type-safe variant (see [TypedEvictionRequestInformer]).
+type EvictionRequestInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() lifecyclev1alpha1.EvictionRequestLister
+}
+
+// TypedEvictionRequestInformer provides access to a shared informer and lister for
+// EvictionRequests, including the type-safe TypedInformer variant.
+// It is a superset of EvictionRequestInformer.
+type TypedEvictionRequestInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() EvictionRequestIndexInformer
+	Lister() lifecyclev1alpha1.EvictionRequestLister
+}
+
+// EvictionRequestIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type EvictionRequestIndexInformer cache.TypedSharedIndexInformer[*apilifecyclev1alpha1.EvictionRequest]
+
+// EvictionRequestHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for EvictionRequest.
+type EvictionRequestHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apilifecyclev1alpha1.EvictionRequest]
+
+// EvictionRequestDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for EvictionRequest.
+type EvictionRequestDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apilifecyclev1alpha1.EvictionRequest]
+
+// EvictionRequestFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for EvictionRequest.
+type EvictionRequestFilteringHandler = cache.TypedFilteringResourceEventHandler[*apilifecyclev1alpha1.EvictionRequest]
+
+// EvictionRequestIndexers is a specialization of [cache.TypedIndexers] for EvictionRequest.
+type EvictionRequestIndexers = cache.TypedIndexers[*apilifecyclev1alpha1.EvictionRequest]
+
+// DeletedEvictionRequest is a specialization of [cache.DeletedObject] for EvictionRequest.
+type DeletedEvictionRequest = cache.DeletedObject[*apilifecyclev1alpha1.EvictionRequest]
+
+type evictionRequestInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewEvictionRequestInformer constructs a new informer for EvictionRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEvictionRequestInformer]).
+func NewEvictionRequestInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewEvictionRequestInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedEvictionRequestInformer constructs a new informer for EvictionRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEvictionRequestInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EvictionRequestIndexers) EvictionRequestIndexInformer {
+	return NewTypedEvictionRequestInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredEvictionRequestInformer constructs a new informer for EvictionRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredEvictionRequestInformer]).
+func NewFilteredEvictionRequestInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedEvictionRequestInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredEvictionRequestInformer constructs a new informer for EvictionRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredEvictionRequestInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers EvictionRequestIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) EvictionRequestIndexInformer {
+	return NewTypedEvictionRequestInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewEvictionRequestInformerWithOptions constructs a new informer for EvictionRequest type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedEvictionRequestInformerWithOptions]).
+func NewEvictionRequestInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedEvictionRequestInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedEvictionRequestInformerWithOptions constructs a new informer for EvictionRequest type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedEvictionRequestInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) EvictionRequestIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "lifecycle.k8s.io", Version: "v1alpha1", Resource: "evictionrequests"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apilifecyclev1alpha1.EvictionRequest](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.LifecycleV1alpha1().EvictionRequests(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.LifecycleV1alpha1().EvictionRequests(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.LifecycleV1alpha1().EvictionRequests(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.LifecycleV1alpha1().EvictionRequests(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apilifecyclev1alpha1.EvictionRequest{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *evictionRequestInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedEvictionRequestInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *evictionRequestInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *evictionRequestInformer) TypedInformer() EvictionRequestIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apilifecyclev1alpha1.EvictionRequest](f.factory.InformerFor(&apilifecyclev1alpha1.EvictionRequest{}, f.defaultInformer))
+}
+
+func (f *evictionRequestInformer) Lister() lifecyclev1alpha1.EvictionRequestLister {
+	return lifecyclev1alpha1.NewEvictionRequestLister(f.Informer().GetIndexer())
+}
+
+// ToTypedEvictionRequestInformer converts an untyped informer into a TypedEvictionRequestInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *EvictionRequest. If that is not the case, calling type-safe methods of the returned
+// TypedEvictionRequestInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedEvictionRequestInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedEvictionRequestInformer(informer EvictionRequestInformer) TypedEvictionRequestInformer {
+	if informer, ok := informer.(TypedEvictionRequestInformer); ok {
+		return informer
+	}
+	return &evictionRequestTypedInformerAdapter{informer}
+}
+
+type evictionRequestTypedInformerAdapter struct {
+	EvictionRequestInformer
+}
+
+func (a *evictionRequestTypedInformerAdapter) TypedInformer() EvictionRequestIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apilifecyclev1alpha1.EvictionRequest](a.Informer())
+}
+
+// ToEvictionRequestIndexInformer converts an untyped informer into a EvictionRequestIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *EvictionRequest. If that is not the case, calling type-safe methods of the returned
+// EvictionRequestIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a EvictionRequestIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToEvictionRequestIndexInformer(informer cache.SharedIndexInformer) EvictionRequestIndexInformer {
+	if informer, ok := informer.(EvictionRequestIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apilifecyclev1alpha1.EvictionRequest](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/lifecycle/v1alpha1/interface.go b/vendor/k8s.io/client-go/informers/lifecycle/v1alpha1/interface.go
new file mode 100644
index 0000000000..81141bb1c1
--- /dev/null
+++ b/vendor/k8s.io/client-go/informers/lifecycle/v1alpha1/interface.go
@@ -0,0 +1,52 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// Evictions returns a EvictionInformer.
+	Evictions() TypedEvictionInformer
+	// EvictionRequests returns a EvictionRequestInformer.
+	EvictionRequests() TypedEvictionRequestInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// Evictions returns a TypedEvictionInformer.
+func (v *version) Evictions() TypedEvictionInformer {
+	return &evictionInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
+
+// EvictionRequests returns a TypedEvictionRequestInformer.
+func (v *version) EvictionRequests() TypedEvictionRequestInformer {
+	return &evictionRequestInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
diff --git a/vendor/k8s.io/client-go/informers/networking/v1/ingress.go b/vendor/k8s.io/client-go/informers/networking/v1/ingress.go
index 65be7320d1..9ec5a53dc4 100644
--- a/vendor/k8s.io/client-go/informers/networking/v1/ingress.go
+++ b/vendor/k8s.io/client-go/informers/networking/v1/ingress.go
@@ -34,12 +34,40 @@ import (
 )
 
 // IngressInformer provides access to a shared informer and lister for
-// Ingresses.
+// Ingresses. Prefer using the type-safe variant (see [TypedIngressInformer]).
 type IngressInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() networkingv1.IngressLister
 }
 
+// TypedIngressInformer provides access to a shared informer and lister for
+// Ingresses, including the type-safe TypedInformer variant.
+// It is a superset of IngressInformer.
+type TypedIngressInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() IngressIndexInformer
+	Lister() networkingv1.IngressLister
+}
+
+// IngressIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type IngressIndexInformer cache.TypedSharedIndexInformer[*apinetworkingv1.Ingress]
+
+// IngressHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Ingress.
+type IngressHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apinetworkingv1.Ingress]
+
+// IngressDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Ingress.
+type IngressDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apinetworkingv1.Ingress]
+
+// IngressFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Ingress.
+type IngressFilteringHandler = cache.TypedFilteringResourceEventHandler[*apinetworkingv1.Ingress]
+
+// IngressIndexers is a specialization of [cache.TypedIndexers] for Ingress.
+type IngressIndexers = cache.TypedIndexers[*apinetworkingv1.Ingress]
+
+// DeletedIngress is a specialization of [cache.DeletedObject] for Ingress.
+type DeletedIngress = cache.DeletedObject[*apinetworkingv1.Ingress]
+
 type ingressInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type ingressInformer struct {
 // NewIngressInformer constructs a new informer for Ingress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedIngressInformer]).
 func NewIngressInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewIngressInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedIngressInformer constructs a new informer for Ingress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedIngressInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers IngressIndexers) IngressIndexInformer {
+	return NewTypedIngressInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredIngressInformer constructs a new informer for Ingress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredIngressInformer]).
 func NewFilteredIngressInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewIngressInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedIngressInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredIngressInformer constructs a new informer for Ingress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredIngressInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers IngressIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) IngressIndexInformer {
+	return NewTypedIngressInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewIngressInformerWithOptions constructs a new informer for Ingress type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedIngressInformerWithOptions]).
 func NewIngressInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedIngressInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedIngressInformerWithOptions constructs a new informer for Ingress type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedIngressInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) IngressIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1", Resource: "ingresss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.Ingress](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewIngressInformerWithOptions(client kubernetes.Interface, namespace string
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *ingressInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewIngressInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedIngressInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *ingressInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apinetworkingv1.Ingress{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *ingressInformer) TypedInformer() IngressIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.Ingress](f.factory.InformerFor(&apinetworkingv1.Ingress{}, f.defaultInformer))
 }
 
 func (f *ingressInformer) Lister() networkingv1.IngressLister {
 	return networkingv1.NewIngressLister(f.Informer().GetIndexer())
 }
+
+// ToTypedIngressInformer converts an untyped informer into a TypedIngressInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Ingress. If that is not the case, calling type-safe methods of the returned
+// TypedIngressInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedIngressInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedIngressInformer(informer IngressInformer) TypedIngressInformer {
+	if informer, ok := informer.(TypedIngressInformer); ok {
+		return informer
+	}
+	return &ingressTypedInformerAdapter{informer}
+}
+
+type ingressTypedInformerAdapter struct {
+	IngressInformer
+}
+
+func (a *ingressTypedInformerAdapter) TypedInformer() IngressIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.Ingress](a.Informer())
+}
+
+// ToIngressIndexInformer converts an untyped informer into a IngressIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Ingress. If that is not the case, calling type-safe methods of the returned
+// IngressIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a IngressIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToIngressIndexInformer(informer cache.SharedIndexInformer) IngressIndexInformer {
+	if informer, ok := informer.(IngressIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.Ingress](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/networking/v1/ingressclass.go b/vendor/k8s.io/client-go/informers/networking/v1/ingressclass.go
index bcb118f991..9174877fe4 100644
--- a/vendor/k8s.io/client-go/informers/networking/v1/ingressclass.go
+++ b/vendor/k8s.io/client-go/informers/networking/v1/ingressclass.go
@@ -34,12 +34,40 @@ import (
 )
 
 // IngressClassInformer provides access to a shared informer and lister for
-// IngressClasses.
+// IngressClasses. Prefer using the type-safe variant (see [TypedIngressClassInformer]).
 type IngressClassInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() networkingv1.IngressClassLister
 }
 
+// TypedIngressClassInformer provides access to a shared informer and lister for
+// IngressClasses, including the type-safe TypedInformer variant.
+// It is a superset of IngressClassInformer.
+type TypedIngressClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() IngressClassIndexInformer
+	Lister() networkingv1.IngressClassLister
+}
+
+// IngressClassIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type IngressClassIndexInformer cache.TypedSharedIndexInformer[*apinetworkingv1.IngressClass]
+
+// IngressClassHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for IngressClass.
+type IngressClassHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apinetworkingv1.IngressClass]
+
+// IngressClassDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for IngressClass.
+type IngressClassDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apinetworkingv1.IngressClass]
+
+// IngressClassFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for IngressClass.
+type IngressClassFilteringHandler = cache.TypedFilteringResourceEventHandler[*apinetworkingv1.IngressClass]
+
+// IngressClassIndexers is a specialization of [cache.TypedIndexers] for IngressClass.
+type IngressClassIndexers = cache.TypedIndexers[*apinetworkingv1.IngressClass]
+
+// DeletedIngressClass is a specialization of [cache.DeletedObject] for IngressClass.
+type DeletedIngressClass = cache.DeletedObject[*apinetworkingv1.IngressClass]
+
 type ingressClassInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type ingressClassInformer struct {
 // NewIngressClassInformer constructs a new informer for IngressClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedIngressClassInformer]).
 func NewIngressClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewIngressClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedIngressClassInformer constructs a new informer for IngressClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedIngressClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers IngressClassIndexers) IngressClassIndexInformer {
+	return NewTypedIngressClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredIngressClassInformer constructs a new informer for IngressClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredIngressClassInformer]).
 func NewFilteredIngressClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewIngressClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedIngressClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredIngressClassInformer constructs a new informer for IngressClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredIngressClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers IngressClassIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) IngressClassIndexInformer {
+	return NewTypedIngressClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewIngressClassInformerWithOptions constructs a new informer for IngressClass type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedIngressClassInformerWithOptions]).
 func NewIngressClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedIngressClassInformerWithOptions(client, options)
+}
+
+// NewTypedIngressClassInformerWithOptions constructs a new informer for IngressClass type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedIngressClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) IngressClassIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1", Resource: "ingressclasss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.IngressClass](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewIngressClassInformerWithOptions(client kubernetes.Interface, options int
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *ingressClassInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewIngressClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedIngressClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *ingressClassInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apinetworkingv1.IngressClass{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *ingressClassInformer) TypedInformer() IngressClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.IngressClass](f.factory.InformerFor(&apinetworkingv1.IngressClass{}, f.defaultInformer))
 }
 
 func (f *ingressClassInformer) Lister() networkingv1.IngressClassLister {
 	return networkingv1.NewIngressClassLister(f.Informer().GetIndexer())
 }
+
+// ToTypedIngressClassInformer converts an untyped informer into a TypedIngressClassInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *IngressClass. If that is not the case, calling type-safe methods of the returned
+// TypedIngressClassInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedIngressClassInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedIngressClassInformer(informer IngressClassInformer) TypedIngressClassInformer {
+	if informer, ok := informer.(TypedIngressClassInformer); ok {
+		return informer
+	}
+	return &ingressClassTypedInformerAdapter{informer}
+}
+
+type ingressClassTypedInformerAdapter struct {
+	IngressClassInformer
+}
+
+func (a *ingressClassTypedInformerAdapter) TypedInformer() IngressClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.IngressClass](a.Informer())
+}
+
+// ToIngressClassIndexInformer converts an untyped informer into a IngressClassIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *IngressClass. If that is not the case, calling type-safe methods of the returned
+// IngressClassIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a IngressClassIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToIngressClassIndexInformer(informer cache.SharedIndexInformer) IngressClassIndexInformer {
+	if informer, ok := informer.(IngressClassIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.IngressClass](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/networking/v1/interface.go b/vendor/k8s.io/client-go/informers/networking/v1/interface.go
index 09634929b3..6fecd84d6c 100644
--- a/vendor/k8s.io/client-go/informers/networking/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/networking/v1/interface.go
@@ -25,15 +25,15 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// IPAddresses returns a IPAddressInformer.
-	IPAddresses() IPAddressInformer
+	IPAddresses() TypedIPAddressInformer
 	// Ingresses returns a IngressInformer.
-	Ingresses() IngressInformer
+	Ingresses() TypedIngressInformer
 	// IngressClasses returns a IngressClassInformer.
-	IngressClasses() IngressClassInformer
+	IngressClasses() TypedIngressClassInformer
 	// NetworkPolicies returns a NetworkPolicyInformer.
-	NetworkPolicies() NetworkPolicyInformer
+	NetworkPolicies() TypedNetworkPolicyInformer
 	// ServiceCIDRs returns a ServiceCIDRInformer.
-	ServiceCIDRs() ServiceCIDRInformer
+	ServiceCIDRs() TypedServiceCIDRInformer
 }
 
 type version struct {
@@ -47,27 +47,27 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// IPAddresses returns a IPAddressInformer.
-func (v *version) IPAddresses() IPAddressInformer {
+// IPAddresses returns a TypedIPAddressInformer.
+func (v *version) IPAddresses() TypedIPAddressInformer {
 	return &iPAddressInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Ingresses returns a IngressInformer.
-func (v *version) Ingresses() IngressInformer {
+// Ingresses returns a TypedIngressInformer.
+func (v *version) Ingresses() TypedIngressInformer {
 	return &ingressInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// IngressClasses returns a IngressClassInformer.
-func (v *version) IngressClasses() IngressClassInformer {
+// IngressClasses returns a TypedIngressClassInformer.
+func (v *version) IngressClasses() TypedIngressClassInformer {
 	return &ingressClassInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// NetworkPolicies returns a NetworkPolicyInformer.
-func (v *version) NetworkPolicies() NetworkPolicyInformer {
+// NetworkPolicies returns a TypedNetworkPolicyInformer.
+func (v *version) NetworkPolicies() TypedNetworkPolicyInformer {
 	return &networkPolicyInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// ServiceCIDRs returns a ServiceCIDRInformer.
-func (v *version) ServiceCIDRs() ServiceCIDRInformer {
+// ServiceCIDRs returns a TypedServiceCIDRInformer.
+func (v *version) ServiceCIDRs() TypedServiceCIDRInformer {
 	return &serviceCIDRInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/networking/v1/ipaddress.go b/vendor/k8s.io/client-go/informers/networking/v1/ipaddress.go
index ea4bb280c8..45d85ae872 100644
--- a/vendor/k8s.io/client-go/informers/networking/v1/ipaddress.go
+++ b/vendor/k8s.io/client-go/informers/networking/v1/ipaddress.go
@@ -34,12 +34,40 @@ import (
 )
 
 // IPAddressInformer provides access to a shared informer and lister for
-// IPAddresses.
+// IPAddresses. Prefer using the type-safe variant (see [TypedIPAddressInformer]).
 type IPAddressInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() networkingv1.IPAddressLister
 }
 
+// TypedIPAddressInformer provides access to a shared informer and lister for
+// IPAddresses, including the type-safe TypedInformer variant.
+// It is a superset of IPAddressInformer.
+type TypedIPAddressInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() IPAddressIndexInformer
+	Lister() networkingv1.IPAddressLister
+}
+
+// IPAddressIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type IPAddressIndexInformer cache.TypedSharedIndexInformer[*apinetworkingv1.IPAddress]
+
+// IPAddressHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for IPAddress.
+type IPAddressHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apinetworkingv1.IPAddress]
+
+// IPAddressDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for IPAddress.
+type IPAddressDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apinetworkingv1.IPAddress]
+
+// IPAddressFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for IPAddress.
+type IPAddressFilteringHandler = cache.TypedFilteringResourceEventHandler[*apinetworkingv1.IPAddress]
+
+// IPAddressIndexers is a specialization of [cache.TypedIndexers] for IPAddress.
+type IPAddressIndexers = cache.TypedIndexers[*apinetworkingv1.IPAddress]
+
+// DeletedIPAddress is a specialization of [cache.DeletedObject] for IPAddress.
+type DeletedIPAddress = cache.DeletedObject[*apinetworkingv1.IPAddress]
+
 type iPAddressInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type iPAddressInformer struct {
 // NewIPAddressInformer constructs a new informer for IPAddress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedIPAddressInformer]).
 func NewIPAddressInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewIPAddressInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedIPAddressInformer constructs a new informer for IPAddress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedIPAddressInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers IPAddressIndexers) IPAddressIndexInformer {
+	return NewTypedIPAddressInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredIPAddressInformer constructs a new informer for IPAddress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredIPAddressInformer]).
 func NewFilteredIPAddressInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewIPAddressInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedIPAddressInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredIPAddressInformer constructs a new informer for IPAddress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredIPAddressInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers IPAddressIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) IPAddressIndexInformer {
+	return NewTypedIPAddressInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewIPAddressInformerWithOptions constructs a new informer for IPAddress type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedIPAddressInformerWithOptions]).
 func NewIPAddressInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedIPAddressInformerWithOptions(client, options)
+}
+
+// NewTypedIPAddressInformerWithOptions constructs a new informer for IPAddress type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedIPAddressInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) IPAddressIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1", Resource: "ipaddresss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.IPAddress](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewIPAddressInformerWithOptions(client kubernetes.Interface, options intern
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *iPAddressInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewIPAddressInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedIPAddressInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *iPAddressInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apinetworkingv1.IPAddress{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *iPAddressInformer) TypedInformer() IPAddressIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.IPAddress](f.factory.InformerFor(&apinetworkingv1.IPAddress{}, f.defaultInformer))
 }
 
 func (f *iPAddressInformer) Lister() networkingv1.IPAddressLister {
 	return networkingv1.NewIPAddressLister(f.Informer().GetIndexer())
 }
+
+// ToTypedIPAddressInformer converts an untyped informer into a TypedIPAddressInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *IPAddress. If that is not the case, calling type-safe methods of the returned
+// TypedIPAddressInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedIPAddressInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedIPAddressInformer(informer IPAddressInformer) TypedIPAddressInformer {
+	if informer, ok := informer.(TypedIPAddressInformer); ok {
+		return informer
+	}
+	return &iPAddressTypedInformerAdapter{informer}
+}
+
+type iPAddressTypedInformerAdapter struct {
+	IPAddressInformer
+}
+
+func (a *iPAddressTypedInformerAdapter) TypedInformer() IPAddressIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.IPAddress](a.Informer())
+}
+
+// ToIPAddressIndexInformer converts an untyped informer into a IPAddressIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *IPAddress. If that is not the case, calling type-safe methods of the returned
+// IPAddressIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a IPAddressIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToIPAddressIndexInformer(informer cache.SharedIndexInformer) IPAddressIndexInformer {
+	if informer, ok := informer.(IPAddressIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.IPAddress](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/networking/v1/networkpolicy.go b/vendor/k8s.io/client-go/informers/networking/v1/networkpolicy.go
index 237fe6266d..41586c52ab 100644
--- a/vendor/k8s.io/client-go/informers/networking/v1/networkpolicy.go
+++ b/vendor/k8s.io/client-go/informers/networking/v1/networkpolicy.go
@@ -34,12 +34,40 @@ import (
 )
 
 // NetworkPolicyInformer provides access to a shared informer and lister for
-// NetworkPolicies.
+// NetworkPolicies. Prefer using the type-safe variant (see [TypedNetworkPolicyInformer]).
 type NetworkPolicyInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() networkingv1.NetworkPolicyLister
 }
 
+// TypedNetworkPolicyInformer provides access to a shared informer and lister for
+// NetworkPolicies, including the type-safe TypedInformer variant.
+// It is a superset of NetworkPolicyInformer.
+type TypedNetworkPolicyInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() NetworkPolicyIndexInformer
+	Lister() networkingv1.NetworkPolicyLister
+}
+
+// NetworkPolicyIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type NetworkPolicyIndexInformer cache.TypedSharedIndexInformer[*apinetworkingv1.NetworkPolicy]
+
+// NetworkPolicyHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for NetworkPolicy.
+type NetworkPolicyHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apinetworkingv1.NetworkPolicy]
+
+// NetworkPolicyDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for NetworkPolicy.
+type NetworkPolicyDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apinetworkingv1.NetworkPolicy]
+
+// NetworkPolicyFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for NetworkPolicy.
+type NetworkPolicyFilteringHandler = cache.TypedFilteringResourceEventHandler[*apinetworkingv1.NetworkPolicy]
+
+// NetworkPolicyIndexers is a specialization of [cache.TypedIndexers] for NetworkPolicy.
+type NetworkPolicyIndexers = cache.TypedIndexers[*apinetworkingv1.NetworkPolicy]
+
+// DeletedNetworkPolicy is a specialization of [cache.DeletedObject] for NetworkPolicy.
+type DeletedNetworkPolicy = cache.DeletedObject[*apinetworkingv1.NetworkPolicy]
+
 type networkPolicyInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type networkPolicyInformer struct {
 // NewNetworkPolicyInformer constructs a new informer for NetworkPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedNetworkPolicyInformer]).
 func NewNetworkPolicyInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewNetworkPolicyInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedNetworkPolicyInformer constructs a new informer for NetworkPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedNetworkPolicyInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers NetworkPolicyIndexers) NetworkPolicyIndexInformer {
+	return NewTypedNetworkPolicyInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredNetworkPolicyInformer constructs a new informer for NetworkPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredNetworkPolicyInformer]).
 func NewFilteredNetworkPolicyInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewNetworkPolicyInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedNetworkPolicyInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredNetworkPolicyInformer constructs a new informer for NetworkPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredNetworkPolicyInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers NetworkPolicyIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) NetworkPolicyIndexInformer {
+	return NewTypedNetworkPolicyInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewNetworkPolicyInformerWithOptions constructs a new informer for NetworkPolicy type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedNetworkPolicyInformerWithOptions]).
 func NewNetworkPolicyInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedNetworkPolicyInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedNetworkPolicyInformerWithOptions constructs a new informer for NetworkPolicy type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedNetworkPolicyInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) NetworkPolicyIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1", Resource: "networkpolicys"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.NetworkPolicy](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewNetworkPolicyInformerWithOptions(client kubernetes.Interface, namespace
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *networkPolicyInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewNetworkPolicyInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedNetworkPolicyInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *networkPolicyInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apinetworkingv1.NetworkPolicy{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *networkPolicyInformer) TypedInformer() NetworkPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.NetworkPolicy](f.factory.InformerFor(&apinetworkingv1.NetworkPolicy{}, f.defaultInformer))
 }
 
 func (f *networkPolicyInformer) Lister() networkingv1.NetworkPolicyLister {
 	return networkingv1.NewNetworkPolicyLister(f.Informer().GetIndexer())
 }
+
+// ToTypedNetworkPolicyInformer converts an untyped informer into a TypedNetworkPolicyInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *NetworkPolicy. If that is not the case, calling type-safe methods of the returned
+// TypedNetworkPolicyInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedNetworkPolicyInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedNetworkPolicyInformer(informer NetworkPolicyInformer) TypedNetworkPolicyInformer {
+	if informer, ok := informer.(TypedNetworkPolicyInformer); ok {
+		return informer
+	}
+	return &networkPolicyTypedInformerAdapter{informer}
+}
+
+type networkPolicyTypedInformerAdapter struct {
+	NetworkPolicyInformer
+}
+
+func (a *networkPolicyTypedInformerAdapter) TypedInformer() NetworkPolicyIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.NetworkPolicy](a.Informer())
+}
+
+// ToNetworkPolicyIndexInformer converts an untyped informer into a NetworkPolicyIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *NetworkPolicy. If that is not the case, calling type-safe methods of the returned
+// NetworkPolicyIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a NetworkPolicyIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToNetworkPolicyIndexInformer(informer cache.SharedIndexInformer) NetworkPolicyIndexInformer {
+	if informer, ok := informer.(NetworkPolicyIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.NetworkPolicy](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/networking/v1/servicecidr.go b/vendor/k8s.io/client-go/informers/networking/v1/servicecidr.go
index ee1810f817..e78ac8908b 100644
--- a/vendor/k8s.io/client-go/informers/networking/v1/servicecidr.go
+++ b/vendor/k8s.io/client-go/informers/networking/v1/servicecidr.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ServiceCIDRInformer provides access to a shared informer and lister for
-// ServiceCIDRs.
+// ServiceCIDRs. Prefer using the type-safe variant (see [TypedServiceCIDRInformer]).
 type ServiceCIDRInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() networkingv1.ServiceCIDRLister
 }
 
+// TypedServiceCIDRInformer provides access to a shared informer and lister for
+// ServiceCIDRs, including the type-safe TypedInformer variant.
+// It is a superset of ServiceCIDRInformer.
+type TypedServiceCIDRInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ServiceCIDRIndexInformer
+	Lister() networkingv1.ServiceCIDRLister
+}
+
+// ServiceCIDRIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ServiceCIDRIndexInformer cache.TypedSharedIndexInformer[*apinetworkingv1.ServiceCIDR]
+
+// ServiceCIDRHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ServiceCIDR.
+type ServiceCIDRHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apinetworkingv1.ServiceCIDR]
+
+// ServiceCIDRDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ServiceCIDR.
+type ServiceCIDRDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apinetworkingv1.ServiceCIDR]
+
+// ServiceCIDRFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ServiceCIDR.
+type ServiceCIDRFilteringHandler = cache.TypedFilteringResourceEventHandler[*apinetworkingv1.ServiceCIDR]
+
+// ServiceCIDRIndexers is a specialization of [cache.TypedIndexers] for ServiceCIDR.
+type ServiceCIDRIndexers = cache.TypedIndexers[*apinetworkingv1.ServiceCIDR]
+
+// DeletedServiceCIDR is a specialization of [cache.DeletedObject] for ServiceCIDR.
+type DeletedServiceCIDR = cache.DeletedObject[*apinetworkingv1.ServiceCIDR]
+
 type serviceCIDRInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type serviceCIDRInformer struct {
 // NewServiceCIDRInformer constructs a new informer for ServiceCIDR type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedServiceCIDRInformer]).
 func NewServiceCIDRInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewServiceCIDRInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedServiceCIDRInformer constructs a new informer for ServiceCIDR type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedServiceCIDRInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ServiceCIDRIndexers) ServiceCIDRIndexInformer {
+	return NewTypedServiceCIDRInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredServiceCIDRInformer constructs a new informer for ServiceCIDR type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredServiceCIDRInformer]).
 func NewFilteredServiceCIDRInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewServiceCIDRInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedServiceCIDRInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredServiceCIDRInformer constructs a new informer for ServiceCIDR type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredServiceCIDRInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ServiceCIDRIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ServiceCIDRIndexInformer {
+	return NewTypedServiceCIDRInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewServiceCIDRInformerWithOptions constructs a new informer for ServiceCIDR type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedServiceCIDRInformerWithOptions]).
 func NewServiceCIDRInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedServiceCIDRInformerWithOptions(client, options)
+}
+
+// NewTypedServiceCIDRInformerWithOptions constructs a new informer for ServiceCIDR type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedServiceCIDRInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ServiceCIDRIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1", Resource: "servicecidrs"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.ServiceCIDR](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewServiceCIDRInformerWithOptions(client kubernetes.Interface, options inte
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *serviceCIDRInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewServiceCIDRInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedServiceCIDRInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *serviceCIDRInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apinetworkingv1.ServiceCIDR{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *serviceCIDRInformer) TypedInformer() ServiceCIDRIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.ServiceCIDR](f.factory.InformerFor(&apinetworkingv1.ServiceCIDR{}, f.defaultInformer))
 }
 
 func (f *serviceCIDRInformer) Lister() networkingv1.ServiceCIDRLister {
 	return networkingv1.NewServiceCIDRLister(f.Informer().GetIndexer())
 }
+
+// ToTypedServiceCIDRInformer converts an untyped informer into a TypedServiceCIDRInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ServiceCIDR. If that is not the case, calling type-safe methods of the returned
+// TypedServiceCIDRInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedServiceCIDRInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedServiceCIDRInformer(informer ServiceCIDRInformer) TypedServiceCIDRInformer {
+	if informer, ok := informer.(TypedServiceCIDRInformer); ok {
+		return informer
+	}
+	return &serviceCIDRTypedInformerAdapter{informer}
+}
+
+type serviceCIDRTypedInformerAdapter struct {
+	ServiceCIDRInformer
+}
+
+func (a *serviceCIDRTypedInformerAdapter) TypedInformer() ServiceCIDRIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.ServiceCIDR](a.Informer())
+}
+
+// ToServiceCIDRIndexInformer converts an untyped informer into a ServiceCIDRIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ServiceCIDR. If that is not the case, calling type-safe methods of the returned
+// ServiceCIDRIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ServiceCIDRIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToServiceCIDRIndexInformer(informer cache.SharedIndexInformer) ServiceCIDRIndexInformer {
+	if informer, ok := informer.(ServiceCIDRIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1.ServiceCIDR](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/networking/v1beta1/ingress.go b/vendor/k8s.io/client-go/informers/networking/v1beta1/ingress.go
index ba35b8ac70..60ca6fb847 100644
--- a/vendor/k8s.io/client-go/informers/networking/v1beta1/ingress.go
+++ b/vendor/k8s.io/client-go/informers/networking/v1beta1/ingress.go
@@ -34,12 +34,40 @@ import (
 )
 
 // IngressInformer provides access to a shared informer and lister for
-// Ingresses.
+// Ingresses. Prefer using the type-safe variant (see [TypedIngressInformer]).
 type IngressInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() networkingv1beta1.IngressLister
 }
 
+// TypedIngressInformer provides access to a shared informer and lister for
+// Ingresses, including the type-safe TypedInformer variant.
+// It is a superset of IngressInformer.
+type TypedIngressInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() IngressIndexInformer
+	Lister() networkingv1beta1.IngressLister
+}
+
+// IngressIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type IngressIndexInformer cache.TypedSharedIndexInformer[*apinetworkingv1beta1.Ingress]
+
+// IngressHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Ingress.
+type IngressHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apinetworkingv1beta1.Ingress]
+
+// IngressDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Ingress.
+type IngressDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apinetworkingv1beta1.Ingress]
+
+// IngressFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Ingress.
+type IngressFilteringHandler = cache.TypedFilteringResourceEventHandler[*apinetworkingv1beta1.Ingress]
+
+// IngressIndexers is a specialization of [cache.TypedIndexers] for Ingress.
+type IngressIndexers = cache.TypedIndexers[*apinetworkingv1beta1.Ingress]
+
+// DeletedIngress is a specialization of [cache.DeletedObject] for Ingress.
+type DeletedIngress = cache.DeletedObject[*apinetworkingv1beta1.Ingress]
+
 type ingressInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type ingressInformer struct {
 // NewIngressInformer constructs a new informer for Ingress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedIngressInformer]).
 func NewIngressInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewIngressInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedIngressInformer constructs a new informer for Ingress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedIngressInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers IngressIndexers) IngressIndexInformer {
+	return NewTypedIngressInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredIngressInformer constructs a new informer for Ingress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredIngressInformer]).
 func NewFilteredIngressInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewIngressInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedIngressInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredIngressInformer constructs a new informer for Ingress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredIngressInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers IngressIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) IngressIndexInformer {
+	return NewTypedIngressInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewIngressInformerWithOptions constructs a new informer for Ingress type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedIngressInformerWithOptions]).
 func NewIngressInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedIngressInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedIngressInformerWithOptions constructs a new informer for Ingress type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedIngressInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) IngressIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1beta1", Resource: "ingresss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.Ingress](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewIngressInformerWithOptions(client kubernetes.Interface, namespace string
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *ingressInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewIngressInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedIngressInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *ingressInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apinetworkingv1beta1.Ingress{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *ingressInformer) TypedInformer() IngressIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.Ingress](f.factory.InformerFor(&apinetworkingv1beta1.Ingress{}, f.defaultInformer))
 }
 
 func (f *ingressInformer) Lister() networkingv1beta1.IngressLister {
 	return networkingv1beta1.NewIngressLister(f.Informer().GetIndexer())
 }
+
+// ToTypedIngressInformer converts an untyped informer into a TypedIngressInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Ingress. If that is not the case, calling type-safe methods of the returned
+// TypedIngressInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedIngressInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedIngressInformer(informer IngressInformer) TypedIngressInformer {
+	if informer, ok := informer.(TypedIngressInformer); ok {
+		return informer
+	}
+	return &ingressTypedInformerAdapter{informer}
+}
+
+type ingressTypedInformerAdapter struct {
+	IngressInformer
+}
+
+func (a *ingressTypedInformerAdapter) TypedInformer() IngressIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.Ingress](a.Informer())
+}
+
+// ToIngressIndexInformer converts an untyped informer into a IngressIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Ingress. If that is not the case, calling type-safe methods of the returned
+// IngressIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a IngressIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToIngressIndexInformer(informer cache.SharedIndexInformer) IngressIndexInformer {
+	if informer, ok := informer.(IngressIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.Ingress](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/networking/v1beta1/ingressclass.go b/vendor/k8s.io/client-go/informers/networking/v1beta1/ingressclass.go
index 97d761a633..71ccdad0c0 100644
--- a/vendor/k8s.io/client-go/informers/networking/v1beta1/ingressclass.go
+++ b/vendor/k8s.io/client-go/informers/networking/v1beta1/ingressclass.go
@@ -34,12 +34,40 @@ import (
 )
 
 // IngressClassInformer provides access to a shared informer and lister for
-// IngressClasses.
+// IngressClasses. Prefer using the type-safe variant (see [TypedIngressClassInformer]).
 type IngressClassInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() networkingv1beta1.IngressClassLister
 }
 
+// TypedIngressClassInformer provides access to a shared informer and lister for
+// IngressClasses, including the type-safe TypedInformer variant.
+// It is a superset of IngressClassInformer.
+type TypedIngressClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() IngressClassIndexInformer
+	Lister() networkingv1beta1.IngressClassLister
+}
+
+// IngressClassIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type IngressClassIndexInformer cache.TypedSharedIndexInformer[*apinetworkingv1beta1.IngressClass]
+
+// IngressClassHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for IngressClass.
+type IngressClassHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apinetworkingv1beta1.IngressClass]
+
+// IngressClassDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for IngressClass.
+type IngressClassDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apinetworkingv1beta1.IngressClass]
+
+// IngressClassFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for IngressClass.
+type IngressClassFilteringHandler = cache.TypedFilteringResourceEventHandler[*apinetworkingv1beta1.IngressClass]
+
+// IngressClassIndexers is a specialization of [cache.TypedIndexers] for IngressClass.
+type IngressClassIndexers = cache.TypedIndexers[*apinetworkingv1beta1.IngressClass]
+
+// DeletedIngressClass is a specialization of [cache.DeletedObject] for IngressClass.
+type DeletedIngressClass = cache.DeletedObject[*apinetworkingv1beta1.IngressClass]
+
 type ingressClassInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type ingressClassInformer struct {
 // NewIngressClassInformer constructs a new informer for IngressClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedIngressClassInformer]).
 func NewIngressClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewIngressClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedIngressClassInformer constructs a new informer for IngressClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedIngressClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers IngressClassIndexers) IngressClassIndexInformer {
+	return NewTypedIngressClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredIngressClassInformer constructs a new informer for IngressClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredIngressClassInformer]).
 func NewFilteredIngressClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewIngressClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedIngressClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredIngressClassInformer constructs a new informer for IngressClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredIngressClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers IngressClassIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) IngressClassIndexInformer {
+	return NewTypedIngressClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewIngressClassInformerWithOptions constructs a new informer for IngressClass type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedIngressClassInformerWithOptions]).
 func NewIngressClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedIngressClassInformerWithOptions(client, options)
+}
+
+// NewTypedIngressClassInformerWithOptions constructs a new informer for IngressClass type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedIngressClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) IngressClassIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1beta1", Resource: "ingressclasss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.IngressClass](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewIngressClassInformerWithOptions(client kubernetes.Interface, options int
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *ingressClassInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewIngressClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedIngressClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *ingressClassInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apinetworkingv1beta1.IngressClass{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *ingressClassInformer) TypedInformer() IngressClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.IngressClass](f.factory.InformerFor(&apinetworkingv1beta1.IngressClass{}, f.defaultInformer))
 }
 
 func (f *ingressClassInformer) Lister() networkingv1beta1.IngressClassLister {
 	return networkingv1beta1.NewIngressClassLister(f.Informer().GetIndexer())
 }
+
+// ToTypedIngressClassInformer converts an untyped informer into a TypedIngressClassInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *IngressClass. If that is not the case, calling type-safe methods of the returned
+// TypedIngressClassInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedIngressClassInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedIngressClassInformer(informer IngressClassInformer) TypedIngressClassInformer {
+	if informer, ok := informer.(TypedIngressClassInformer); ok {
+		return informer
+	}
+	return &ingressClassTypedInformerAdapter{informer}
+}
+
+type ingressClassTypedInformerAdapter struct {
+	IngressClassInformer
+}
+
+func (a *ingressClassTypedInformerAdapter) TypedInformer() IngressClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.IngressClass](a.Informer())
+}
+
+// ToIngressClassIndexInformer converts an untyped informer into a IngressClassIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *IngressClass. If that is not the case, calling type-safe methods of the returned
+// IngressClassIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a IngressClassIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToIngressClassIndexInformer(informer cache.SharedIndexInformer) IngressClassIndexInformer {
+	if informer, ok := informer.(IngressClassIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.IngressClass](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/networking/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/networking/v1beta1/interface.go
index 974a8fd5bf..f6489bd5d7 100644
--- a/vendor/k8s.io/client-go/informers/networking/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/networking/v1beta1/interface.go
@@ -25,13 +25,13 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// IPAddresses returns a IPAddressInformer.
-	IPAddresses() IPAddressInformer
+	IPAddresses() TypedIPAddressInformer
 	// Ingresses returns a IngressInformer.
-	Ingresses() IngressInformer
+	Ingresses() TypedIngressInformer
 	// IngressClasses returns a IngressClassInformer.
-	IngressClasses() IngressClassInformer
+	IngressClasses() TypedIngressClassInformer
 	// ServiceCIDRs returns a ServiceCIDRInformer.
-	ServiceCIDRs() ServiceCIDRInformer
+	ServiceCIDRs() TypedServiceCIDRInformer
 }
 
 type version struct {
@@ -45,22 +45,22 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// IPAddresses returns a IPAddressInformer.
-func (v *version) IPAddresses() IPAddressInformer {
+// IPAddresses returns a TypedIPAddressInformer.
+func (v *version) IPAddresses() TypedIPAddressInformer {
 	return &iPAddressInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Ingresses returns a IngressInformer.
-func (v *version) Ingresses() IngressInformer {
+// Ingresses returns a TypedIngressInformer.
+func (v *version) Ingresses() TypedIngressInformer {
 	return &ingressInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// IngressClasses returns a IngressClassInformer.
-func (v *version) IngressClasses() IngressClassInformer {
+// IngressClasses returns a TypedIngressClassInformer.
+func (v *version) IngressClasses() TypedIngressClassInformer {
 	return &ingressClassInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ServiceCIDRs returns a ServiceCIDRInformer.
-func (v *version) ServiceCIDRs() ServiceCIDRInformer {
+// ServiceCIDRs returns a TypedServiceCIDRInformer.
+func (v *version) ServiceCIDRs() TypedServiceCIDRInformer {
 	return &serviceCIDRInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/networking/v1beta1/ipaddress.go b/vendor/k8s.io/client-go/informers/networking/v1beta1/ipaddress.go
index fd94392393..b63d156d76 100644
--- a/vendor/k8s.io/client-go/informers/networking/v1beta1/ipaddress.go
+++ b/vendor/k8s.io/client-go/informers/networking/v1beta1/ipaddress.go
@@ -34,12 +34,40 @@ import (
 )
 
 // IPAddressInformer provides access to a shared informer and lister for
-// IPAddresses.
+// IPAddresses. Prefer using the type-safe variant (see [TypedIPAddressInformer]).
 type IPAddressInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() networkingv1beta1.IPAddressLister
 }
 
+// TypedIPAddressInformer provides access to a shared informer and lister for
+// IPAddresses, including the type-safe TypedInformer variant.
+// It is a superset of IPAddressInformer.
+type TypedIPAddressInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() IPAddressIndexInformer
+	Lister() networkingv1beta1.IPAddressLister
+}
+
+// IPAddressIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type IPAddressIndexInformer cache.TypedSharedIndexInformer[*apinetworkingv1beta1.IPAddress]
+
+// IPAddressHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for IPAddress.
+type IPAddressHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apinetworkingv1beta1.IPAddress]
+
+// IPAddressDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for IPAddress.
+type IPAddressDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apinetworkingv1beta1.IPAddress]
+
+// IPAddressFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for IPAddress.
+type IPAddressFilteringHandler = cache.TypedFilteringResourceEventHandler[*apinetworkingv1beta1.IPAddress]
+
+// IPAddressIndexers is a specialization of [cache.TypedIndexers] for IPAddress.
+type IPAddressIndexers = cache.TypedIndexers[*apinetworkingv1beta1.IPAddress]
+
+// DeletedIPAddress is a specialization of [cache.DeletedObject] for IPAddress.
+type DeletedIPAddress = cache.DeletedObject[*apinetworkingv1beta1.IPAddress]
+
 type iPAddressInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type iPAddressInformer struct {
 // NewIPAddressInformer constructs a new informer for IPAddress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedIPAddressInformer]).
 func NewIPAddressInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewIPAddressInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedIPAddressInformer constructs a new informer for IPAddress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedIPAddressInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers IPAddressIndexers) IPAddressIndexInformer {
+	return NewTypedIPAddressInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredIPAddressInformer constructs a new informer for IPAddress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredIPAddressInformer]).
 func NewFilteredIPAddressInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewIPAddressInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedIPAddressInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredIPAddressInformer constructs a new informer for IPAddress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredIPAddressInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers IPAddressIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) IPAddressIndexInformer {
+	return NewTypedIPAddressInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewIPAddressInformerWithOptions constructs a new informer for IPAddress type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedIPAddressInformerWithOptions]).
 func NewIPAddressInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedIPAddressInformerWithOptions(client, options)
+}
+
+// NewTypedIPAddressInformerWithOptions constructs a new informer for IPAddress type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedIPAddressInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) IPAddressIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1beta1", Resource: "ipaddresss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.IPAddress](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewIPAddressInformerWithOptions(client kubernetes.Interface, options intern
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *iPAddressInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewIPAddressInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedIPAddressInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *iPAddressInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apinetworkingv1beta1.IPAddress{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *iPAddressInformer) TypedInformer() IPAddressIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.IPAddress](f.factory.InformerFor(&apinetworkingv1beta1.IPAddress{}, f.defaultInformer))
 }
 
 func (f *iPAddressInformer) Lister() networkingv1beta1.IPAddressLister {
 	return networkingv1beta1.NewIPAddressLister(f.Informer().GetIndexer())
 }
+
+// ToTypedIPAddressInformer converts an untyped informer into a TypedIPAddressInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *IPAddress. If that is not the case, calling type-safe methods of the returned
+// TypedIPAddressInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedIPAddressInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedIPAddressInformer(informer IPAddressInformer) TypedIPAddressInformer {
+	if informer, ok := informer.(TypedIPAddressInformer); ok {
+		return informer
+	}
+	return &iPAddressTypedInformerAdapter{informer}
+}
+
+type iPAddressTypedInformerAdapter struct {
+	IPAddressInformer
+}
+
+func (a *iPAddressTypedInformerAdapter) TypedInformer() IPAddressIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.IPAddress](a.Informer())
+}
+
+// ToIPAddressIndexInformer converts an untyped informer into a IPAddressIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *IPAddress. If that is not the case, calling type-safe methods of the returned
+// IPAddressIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a IPAddressIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToIPAddressIndexInformer(informer cache.SharedIndexInformer) IPAddressIndexInformer {
+	if informer, ok := informer.(IPAddressIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.IPAddress](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/networking/v1beta1/servicecidr.go b/vendor/k8s.io/client-go/informers/networking/v1beta1/servicecidr.go
index 6fe8c3bd11..538ef31327 100644
--- a/vendor/k8s.io/client-go/informers/networking/v1beta1/servicecidr.go
+++ b/vendor/k8s.io/client-go/informers/networking/v1beta1/servicecidr.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ServiceCIDRInformer provides access to a shared informer and lister for
-// ServiceCIDRs.
+// ServiceCIDRs. Prefer using the type-safe variant (see [TypedServiceCIDRInformer]).
 type ServiceCIDRInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() networkingv1beta1.ServiceCIDRLister
 }
 
+// TypedServiceCIDRInformer provides access to a shared informer and lister for
+// ServiceCIDRs, including the type-safe TypedInformer variant.
+// It is a superset of ServiceCIDRInformer.
+type TypedServiceCIDRInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ServiceCIDRIndexInformer
+	Lister() networkingv1beta1.ServiceCIDRLister
+}
+
+// ServiceCIDRIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ServiceCIDRIndexInformer cache.TypedSharedIndexInformer[*apinetworkingv1beta1.ServiceCIDR]
+
+// ServiceCIDRHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ServiceCIDR.
+type ServiceCIDRHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apinetworkingv1beta1.ServiceCIDR]
+
+// ServiceCIDRDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ServiceCIDR.
+type ServiceCIDRDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apinetworkingv1beta1.ServiceCIDR]
+
+// ServiceCIDRFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ServiceCIDR.
+type ServiceCIDRFilteringHandler = cache.TypedFilteringResourceEventHandler[*apinetworkingv1beta1.ServiceCIDR]
+
+// ServiceCIDRIndexers is a specialization of [cache.TypedIndexers] for ServiceCIDR.
+type ServiceCIDRIndexers = cache.TypedIndexers[*apinetworkingv1beta1.ServiceCIDR]
+
+// DeletedServiceCIDR is a specialization of [cache.DeletedObject] for ServiceCIDR.
+type DeletedServiceCIDR = cache.DeletedObject[*apinetworkingv1beta1.ServiceCIDR]
+
 type serviceCIDRInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type serviceCIDRInformer struct {
 // NewServiceCIDRInformer constructs a new informer for ServiceCIDR type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedServiceCIDRInformer]).
 func NewServiceCIDRInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewServiceCIDRInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedServiceCIDRInformer constructs a new informer for ServiceCIDR type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedServiceCIDRInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ServiceCIDRIndexers) ServiceCIDRIndexInformer {
+	return NewTypedServiceCIDRInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredServiceCIDRInformer constructs a new informer for ServiceCIDR type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredServiceCIDRInformer]).
 func NewFilteredServiceCIDRInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewServiceCIDRInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedServiceCIDRInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredServiceCIDRInformer constructs a new informer for ServiceCIDR type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredServiceCIDRInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ServiceCIDRIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ServiceCIDRIndexInformer {
+	return NewTypedServiceCIDRInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewServiceCIDRInformerWithOptions constructs a new informer for ServiceCIDR type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedServiceCIDRInformerWithOptions]).
 func NewServiceCIDRInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedServiceCIDRInformerWithOptions(client, options)
+}
+
+// NewTypedServiceCIDRInformerWithOptions constructs a new informer for ServiceCIDR type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedServiceCIDRInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ServiceCIDRIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1beta1", Resource: "servicecidrs"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.ServiceCIDR](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewServiceCIDRInformerWithOptions(client kubernetes.Interface, options inte
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *serviceCIDRInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewServiceCIDRInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedServiceCIDRInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *serviceCIDRInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apinetworkingv1beta1.ServiceCIDR{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *serviceCIDRInformer) TypedInformer() ServiceCIDRIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.ServiceCIDR](f.factory.InformerFor(&apinetworkingv1beta1.ServiceCIDR{}, f.defaultInformer))
 }
 
 func (f *serviceCIDRInformer) Lister() networkingv1beta1.ServiceCIDRLister {
 	return networkingv1beta1.NewServiceCIDRLister(f.Informer().GetIndexer())
 }
+
+// ToTypedServiceCIDRInformer converts an untyped informer into a TypedServiceCIDRInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ServiceCIDR. If that is not the case, calling type-safe methods of the returned
+// TypedServiceCIDRInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedServiceCIDRInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedServiceCIDRInformer(informer ServiceCIDRInformer) TypedServiceCIDRInformer {
+	if informer, ok := informer.(TypedServiceCIDRInformer); ok {
+		return informer
+	}
+	return &serviceCIDRTypedInformerAdapter{informer}
+}
+
+type serviceCIDRTypedInformerAdapter struct {
+	ServiceCIDRInformer
+}
+
+func (a *serviceCIDRTypedInformerAdapter) TypedInformer() ServiceCIDRIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.ServiceCIDR](a.Informer())
+}
+
+// ToServiceCIDRIndexInformer converts an untyped informer into a ServiceCIDRIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ServiceCIDR. If that is not the case, calling type-safe methods of the returned
+// ServiceCIDRIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ServiceCIDRIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToServiceCIDRIndexInformer(informer cache.SharedIndexInformer) ServiceCIDRIndexInformer {
+	if informer, ok := informer.(ServiceCIDRIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apinetworkingv1beta1.ServiceCIDR](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/node/v1/interface.go b/vendor/k8s.io/client-go/informers/node/v1/interface.go
index 913fec4aca..53a4abd92e 100644
--- a/vendor/k8s.io/client-go/informers/node/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/node/v1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// RuntimeClasses returns a RuntimeClassInformer.
-	RuntimeClasses() RuntimeClassInformer
+	RuntimeClasses() TypedRuntimeClassInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// RuntimeClasses returns a RuntimeClassInformer.
-func (v *version) RuntimeClasses() RuntimeClassInformer {
+// RuntimeClasses returns a TypedRuntimeClassInformer.
+func (v *version) RuntimeClasses() TypedRuntimeClassInformer {
 	return &runtimeClassInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/node/v1/runtimeclass.go b/vendor/k8s.io/client-go/informers/node/v1/runtimeclass.go
index 3b7d4a25d2..4fe4065465 100644
--- a/vendor/k8s.io/client-go/informers/node/v1/runtimeclass.go
+++ b/vendor/k8s.io/client-go/informers/node/v1/runtimeclass.go
@@ -34,12 +34,40 @@ import (
 )
 
 // RuntimeClassInformer provides access to a shared informer and lister for
-// RuntimeClasses.
+// RuntimeClasses. Prefer using the type-safe variant (see [TypedRuntimeClassInformer]).
 type RuntimeClassInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() nodev1.RuntimeClassLister
 }
 
+// TypedRuntimeClassInformer provides access to a shared informer and lister for
+// RuntimeClasses, including the type-safe TypedInformer variant.
+// It is a superset of RuntimeClassInformer.
+type TypedRuntimeClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() RuntimeClassIndexInformer
+	Lister() nodev1.RuntimeClassLister
+}
+
+// RuntimeClassIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type RuntimeClassIndexInformer cache.TypedSharedIndexInformer[*apinodev1.RuntimeClass]
+
+// RuntimeClassHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for RuntimeClass.
+type RuntimeClassHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apinodev1.RuntimeClass]
+
+// RuntimeClassDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for RuntimeClass.
+type RuntimeClassDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apinodev1.RuntimeClass]
+
+// RuntimeClassFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for RuntimeClass.
+type RuntimeClassFilteringHandler = cache.TypedFilteringResourceEventHandler[*apinodev1.RuntimeClass]
+
+// RuntimeClassIndexers is a specialization of [cache.TypedIndexers] for RuntimeClass.
+type RuntimeClassIndexers = cache.TypedIndexers[*apinodev1.RuntimeClass]
+
+// DeletedRuntimeClass is a specialization of [cache.DeletedObject] for RuntimeClass.
+type DeletedRuntimeClass = cache.DeletedObject[*apinodev1.RuntimeClass]
+
 type runtimeClassInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type runtimeClassInformer struct {
 // NewRuntimeClassInformer constructs a new informer for RuntimeClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRuntimeClassInformer]).
 func NewRuntimeClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedRuntimeClassInformer constructs a new informer for RuntimeClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRuntimeClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers RuntimeClassIndexers) RuntimeClassIndexInformer {
+	return NewTypedRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredRuntimeClassInformer constructs a new informer for RuntimeClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredRuntimeClassInformer]).
 func NewFilteredRuntimeClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredRuntimeClassInformer constructs a new informer for RuntimeClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredRuntimeClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers RuntimeClassIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) RuntimeClassIndexInformer {
+	return NewTypedRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewRuntimeClassInformerWithOptions constructs a new informer for RuntimeClass type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRuntimeClassInformerWithOptions]).
 func NewRuntimeClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedRuntimeClassInformerWithOptions(client, options)
+}
+
+// NewTypedRuntimeClassInformerWithOptions constructs a new informer for RuntimeClass type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRuntimeClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) RuntimeClassIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "node.k8s.io", Version: "v1", Resource: "runtimeclasss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apinodev1.RuntimeClass](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewRuntimeClassInformerWithOptions(client kubernetes.Interface, options int
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *runtimeClassInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *runtimeClassInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apinodev1.RuntimeClass{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *runtimeClassInformer) TypedInformer() RuntimeClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinodev1.RuntimeClass](f.factory.InformerFor(&apinodev1.RuntimeClass{}, f.defaultInformer))
 }
 
 func (f *runtimeClassInformer) Lister() nodev1.RuntimeClassLister {
 	return nodev1.NewRuntimeClassLister(f.Informer().GetIndexer())
 }
+
+// ToTypedRuntimeClassInformer converts an untyped informer into a TypedRuntimeClassInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *RuntimeClass. If that is not the case, calling type-safe methods of the returned
+// TypedRuntimeClassInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedRuntimeClassInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedRuntimeClassInformer(informer RuntimeClassInformer) TypedRuntimeClassInformer {
+	if informer, ok := informer.(TypedRuntimeClassInformer); ok {
+		return informer
+	}
+	return &runtimeClassTypedInformerAdapter{informer}
+}
+
+type runtimeClassTypedInformerAdapter struct {
+	RuntimeClassInformer
+}
+
+func (a *runtimeClassTypedInformerAdapter) TypedInformer() RuntimeClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinodev1.RuntimeClass](a.Informer())
+}
+
+// ToRuntimeClassIndexInformer converts an untyped informer into a RuntimeClassIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *RuntimeClass. If that is not the case, calling type-safe methods of the returned
+// RuntimeClassIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a RuntimeClassIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToRuntimeClassIndexInformer(informer cache.SharedIndexInformer) RuntimeClassIndexInformer {
+	if informer, ok := informer.(RuntimeClassIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apinodev1.RuntimeClass](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/node/v1alpha1/interface.go b/vendor/k8s.io/client-go/informers/node/v1alpha1/interface.go
index c56442957e..402674241c 100644
--- a/vendor/k8s.io/client-go/informers/node/v1alpha1/interface.go
+++ b/vendor/k8s.io/client-go/informers/node/v1alpha1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// RuntimeClasses returns a RuntimeClassInformer.
-	RuntimeClasses() RuntimeClassInformer
+	RuntimeClasses() TypedRuntimeClassInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// RuntimeClasses returns a RuntimeClassInformer.
-func (v *version) RuntimeClasses() RuntimeClassInformer {
+// RuntimeClasses returns a TypedRuntimeClassInformer.
+func (v *version) RuntimeClasses() TypedRuntimeClassInformer {
 	return &runtimeClassInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/node/v1alpha1/runtimeclass.go b/vendor/k8s.io/client-go/informers/node/v1alpha1/runtimeclass.go
index 1907a122d2..d264133fef 100644
--- a/vendor/k8s.io/client-go/informers/node/v1alpha1/runtimeclass.go
+++ b/vendor/k8s.io/client-go/informers/node/v1alpha1/runtimeclass.go
@@ -34,12 +34,40 @@ import (
 )
 
 // RuntimeClassInformer provides access to a shared informer and lister for
-// RuntimeClasses.
+// RuntimeClasses. Prefer using the type-safe variant (see [TypedRuntimeClassInformer]).
 type RuntimeClassInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() nodev1alpha1.RuntimeClassLister
 }
 
+// TypedRuntimeClassInformer provides access to a shared informer and lister for
+// RuntimeClasses, including the type-safe TypedInformer variant.
+// It is a superset of RuntimeClassInformer.
+type TypedRuntimeClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() RuntimeClassIndexInformer
+	Lister() nodev1alpha1.RuntimeClassLister
+}
+
+// RuntimeClassIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type RuntimeClassIndexInformer cache.TypedSharedIndexInformer[*apinodev1alpha1.RuntimeClass]
+
+// RuntimeClassHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for RuntimeClass.
+type RuntimeClassHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apinodev1alpha1.RuntimeClass]
+
+// RuntimeClassDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for RuntimeClass.
+type RuntimeClassDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apinodev1alpha1.RuntimeClass]
+
+// RuntimeClassFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for RuntimeClass.
+type RuntimeClassFilteringHandler = cache.TypedFilteringResourceEventHandler[*apinodev1alpha1.RuntimeClass]
+
+// RuntimeClassIndexers is a specialization of [cache.TypedIndexers] for RuntimeClass.
+type RuntimeClassIndexers = cache.TypedIndexers[*apinodev1alpha1.RuntimeClass]
+
+// DeletedRuntimeClass is a specialization of [cache.DeletedObject] for RuntimeClass.
+type DeletedRuntimeClass = cache.DeletedObject[*apinodev1alpha1.RuntimeClass]
+
 type runtimeClassInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type runtimeClassInformer struct {
 // NewRuntimeClassInformer constructs a new informer for RuntimeClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRuntimeClassInformer]).
 func NewRuntimeClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedRuntimeClassInformer constructs a new informer for RuntimeClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRuntimeClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers RuntimeClassIndexers) RuntimeClassIndexInformer {
+	return NewTypedRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredRuntimeClassInformer constructs a new informer for RuntimeClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredRuntimeClassInformer]).
 func NewFilteredRuntimeClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredRuntimeClassInformer constructs a new informer for RuntimeClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredRuntimeClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers RuntimeClassIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) RuntimeClassIndexInformer {
+	return NewTypedRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewRuntimeClassInformerWithOptions constructs a new informer for RuntimeClass type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRuntimeClassInformerWithOptions]).
 func NewRuntimeClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedRuntimeClassInformerWithOptions(client, options)
+}
+
+// NewTypedRuntimeClassInformerWithOptions constructs a new informer for RuntimeClass type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRuntimeClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) RuntimeClassIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "node.k8s.io", Version: "v1alpha1", Resource: "runtimeclasss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apinodev1alpha1.RuntimeClass](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewRuntimeClassInformerWithOptions(client kubernetes.Interface, options int
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *runtimeClassInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *runtimeClassInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apinodev1alpha1.RuntimeClass{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *runtimeClassInformer) TypedInformer() RuntimeClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinodev1alpha1.RuntimeClass](f.factory.InformerFor(&apinodev1alpha1.RuntimeClass{}, f.defaultInformer))
 }
 
 func (f *runtimeClassInformer) Lister() nodev1alpha1.RuntimeClassLister {
 	return nodev1alpha1.NewRuntimeClassLister(f.Informer().GetIndexer())
 }
+
+// ToTypedRuntimeClassInformer converts an untyped informer into a TypedRuntimeClassInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *RuntimeClass. If that is not the case, calling type-safe methods of the returned
+// TypedRuntimeClassInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedRuntimeClassInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedRuntimeClassInformer(informer RuntimeClassInformer) TypedRuntimeClassInformer {
+	if informer, ok := informer.(TypedRuntimeClassInformer); ok {
+		return informer
+	}
+	return &runtimeClassTypedInformerAdapter{informer}
+}
+
+type runtimeClassTypedInformerAdapter struct {
+	RuntimeClassInformer
+}
+
+func (a *runtimeClassTypedInformerAdapter) TypedInformer() RuntimeClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinodev1alpha1.RuntimeClass](a.Informer())
+}
+
+// ToRuntimeClassIndexInformer converts an untyped informer into a RuntimeClassIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *RuntimeClass. If that is not the case, calling type-safe methods of the returned
+// RuntimeClassIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a RuntimeClassIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToRuntimeClassIndexInformer(informer cache.SharedIndexInformer) RuntimeClassIndexInformer {
+	if informer, ok := informer.(RuntimeClassIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apinodev1alpha1.RuntimeClass](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/node/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/node/v1beta1/interface.go
index 44a1defb6b..6e81a66e4e 100644
--- a/vendor/k8s.io/client-go/informers/node/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/node/v1beta1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// RuntimeClasses returns a RuntimeClassInformer.
-	RuntimeClasses() RuntimeClassInformer
+	RuntimeClasses() TypedRuntimeClassInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// RuntimeClasses returns a RuntimeClassInformer.
-func (v *version) RuntimeClasses() RuntimeClassInformer {
+// RuntimeClasses returns a TypedRuntimeClassInformer.
+func (v *version) RuntimeClasses() TypedRuntimeClassInformer {
 	return &runtimeClassInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/node/v1beta1/runtimeclass.go b/vendor/k8s.io/client-go/informers/node/v1beta1/runtimeclass.go
index ca7e9307ac..58d602da20 100644
--- a/vendor/k8s.io/client-go/informers/node/v1beta1/runtimeclass.go
+++ b/vendor/k8s.io/client-go/informers/node/v1beta1/runtimeclass.go
@@ -34,12 +34,40 @@ import (
 )
 
 // RuntimeClassInformer provides access to a shared informer and lister for
-// RuntimeClasses.
+// RuntimeClasses. Prefer using the type-safe variant (see [TypedRuntimeClassInformer]).
 type RuntimeClassInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() nodev1beta1.RuntimeClassLister
 }
 
+// TypedRuntimeClassInformer provides access to a shared informer and lister for
+// RuntimeClasses, including the type-safe TypedInformer variant.
+// It is a superset of RuntimeClassInformer.
+type TypedRuntimeClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() RuntimeClassIndexInformer
+	Lister() nodev1beta1.RuntimeClassLister
+}
+
+// RuntimeClassIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type RuntimeClassIndexInformer cache.TypedSharedIndexInformer[*apinodev1beta1.RuntimeClass]
+
+// RuntimeClassHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for RuntimeClass.
+type RuntimeClassHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apinodev1beta1.RuntimeClass]
+
+// RuntimeClassDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for RuntimeClass.
+type RuntimeClassDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apinodev1beta1.RuntimeClass]
+
+// RuntimeClassFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for RuntimeClass.
+type RuntimeClassFilteringHandler = cache.TypedFilteringResourceEventHandler[*apinodev1beta1.RuntimeClass]
+
+// RuntimeClassIndexers is a specialization of [cache.TypedIndexers] for RuntimeClass.
+type RuntimeClassIndexers = cache.TypedIndexers[*apinodev1beta1.RuntimeClass]
+
+// DeletedRuntimeClass is a specialization of [cache.DeletedObject] for RuntimeClass.
+type DeletedRuntimeClass = cache.DeletedObject[*apinodev1beta1.RuntimeClass]
+
 type runtimeClassInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type runtimeClassInformer struct {
 // NewRuntimeClassInformer constructs a new informer for RuntimeClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRuntimeClassInformer]).
 func NewRuntimeClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedRuntimeClassInformer constructs a new informer for RuntimeClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRuntimeClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers RuntimeClassIndexers) RuntimeClassIndexInformer {
+	return NewTypedRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredRuntimeClassInformer constructs a new informer for RuntimeClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredRuntimeClassInformer]).
 func NewFilteredRuntimeClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredRuntimeClassInformer constructs a new informer for RuntimeClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredRuntimeClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers RuntimeClassIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) RuntimeClassIndexInformer {
+	return NewTypedRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewRuntimeClassInformerWithOptions constructs a new informer for RuntimeClass type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRuntimeClassInformerWithOptions]).
 func NewRuntimeClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedRuntimeClassInformerWithOptions(client, options)
+}
+
+// NewTypedRuntimeClassInformerWithOptions constructs a new informer for RuntimeClass type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRuntimeClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) RuntimeClassIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "node.k8s.io", Version: "v1beta1", Resource: "runtimeclasss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apinodev1beta1.RuntimeClass](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewRuntimeClassInformerWithOptions(client kubernetes.Interface, options int
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *runtimeClassInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedRuntimeClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *runtimeClassInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apinodev1beta1.RuntimeClass{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *runtimeClassInformer) TypedInformer() RuntimeClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinodev1beta1.RuntimeClass](f.factory.InformerFor(&apinodev1beta1.RuntimeClass{}, f.defaultInformer))
 }
 
 func (f *runtimeClassInformer) Lister() nodev1beta1.RuntimeClassLister {
 	return nodev1beta1.NewRuntimeClassLister(f.Informer().GetIndexer())
 }
+
+// ToTypedRuntimeClassInformer converts an untyped informer into a TypedRuntimeClassInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *RuntimeClass. If that is not the case, calling type-safe methods of the returned
+// TypedRuntimeClassInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedRuntimeClassInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedRuntimeClassInformer(informer RuntimeClassInformer) TypedRuntimeClassInformer {
+	if informer, ok := informer.(TypedRuntimeClassInformer); ok {
+		return informer
+	}
+	return &runtimeClassTypedInformerAdapter{informer}
+}
+
+type runtimeClassTypedInformerAdapter struct {
+	RuntimeClassInformer
+}
+
+func (a *runtimeClassTypedInformerAdapter) TypedInformer() RuntimeClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apinodev1beta1.RuntimeClass](a.Informer())
+}
+
+// ToRuntimeClassIndexInformer converts an untyped informer into a RuntimeClassIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *RuntimeClass. If that is not the case, calling type-safe methods of the returned
+// RuntimeClassIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a RuntimeClassIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToRuntimeClassIndexInformer(informer cache.SharedIndexInformer) RuntimeClassIndexInformer {
+	if informer, ok := informer.(RuntimeClassIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apinodev1beta1.RuntimeClass](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/policy/v1/interface.go b/vendor/k8s.io/client-go/informers/policy/v1/interface.go
index 2c42e1993c..2035254dc1 100644
--- a/vendor/k8s.io/client-go/informers/policy/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/policy/v1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// PodDisruptionBudgets returns a PodDisruptionBudgetInformer.
-	PodDisruptionBudgets() PodDisruptionBudgetInformer
+	PodDisruptionBudgets() TypedPodDisruptionBudgetInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// PodDisruptionBudgets returns a PodDisruptionBudgetInformer.
-func (v *version) PodDisruptionBudgets() PodDisruptionBudgetInformer {
+// PodDisruptionBudgets returns a TypedPodDisruptionBudgetInformer.
+func (v *version) PodDisruptionBudgets() TypedPodDisruptionBudgetInformer {
 	return &podDisruptionBudgetInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/policy/v1/poddisruptionbudget.go b/vendor/k8s.io/client-go/informers/policy/v1/poddisruptionbudget.go
index 2945e543d7..24ed2870df 100644
--- a/vendor/k8s.io/client-go/informers/policy/v1/poddisruptionbudget.go
+++ b/vendor/k8s.io/client-go/informers/policy/v1/poddisruptionbudget.go
@@ -34,12 +34,40 @@ import (
 )
 
 // PodDisruptionBudgetInformer provides access to a shared informer and lister for
-// PodDisruptionBudgets.
+// PodDisruptionBudgets. Prefer using the type-safe variant (see [TypedPodDisruptionBudgetInformer]).
 type PodDisruptionBudgetInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() policyv1.PodDisruptionBudgetLister
 }
 
+// TypedPodDisruptionBudgetInformer provides access to a shared informer and lister for
+// PodDisruptionBudgets, including the type-safe TypedInformer variant.
+// It is a superset of PodDisruptionBudgetInformer.
+type TypedPodDisruptionBudgetInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PodDisruptionBudgetIndexInformer
+	Lister() policyv1.PodDisruptionBudgetLister
+}
+
+// PodDisruptionBudgetIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PodDisruptionBudgetIndexInformer cache.TypedSharedIndexInformer[*apipolicyv1.PodDisruptionBudget]
+
+// PodDisruptionBudgetHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for PodDisruptionBudget.
+type PodDisruptionBudgetHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apipolicyv1.PodDisruptionBudget]
+
+// PodDisruptionBudgetDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for PodDisruptionBudget.
+type PodDisruptionBudgetDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apipolicyv1.PodDisruptionBudget]
+
+// PodDisruptionBudgetFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for PodDisruptionBudget.
+type PodDisruptionBudgetFilteringHandler = cache.TypedFilteringResourceEventHandler[*apipolicyv1.PodDisruptionBudget]
+
+// PodDisruptionBudgetIndexers is a specialization of [cache.TypedIndexers] for PodDisruptionBudget.
+type PodDisruptionBudgetIndexers = cache.TypedIndexers[*apipolicyv1.PodDisruptionBudget]
+
+// DeletedPodDisruptionBudget is a specialization of [cache.DeletedObject] for PodDisruptionBudget.
+type DeletedPodDisruptionBudget = cache.DeletedObject[*apipolicyv1.PodDisruptionBudget]
+
 type podDisruptionBudgetInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type podDisruptionBudgetInformer struct {
 // NewPodDisruptionBudgetInformer constructs a new informer for PodDisruptionBudget type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodDisruptionBudgetInformer]).
 func NewPodDisruptionBudgetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewPodDisruptionBudgetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedPodDisruptionBudgetInformer constructs a new informer for PodDisruptionBudget type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodDisruptionBudgetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodDisruptionBudgetIndexers) PodDisruptionBudgetIndexInformer {
+	return NewTypedPodDisruptionBudgetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredPodDisruptionBudgetInformer constructs a new informer for PodDisruptionBudget type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPodDisruptionBudgetInformer]).
 func NewFilteredPodDisruptionBudgetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewPodDisruptionBudgetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedPodDisruptionBudgetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPodDisruptionBudgetInformer constructs a new informer for PodDisruptionBudget type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPodDisruptionBudgetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodDisruptionBudgetIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PodDisruptionBudgetIndexInformer {
+	return NewTypedPodDisruptionBudgetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewPodDisruptionBudgetInformerWithOptions constructs a new informer for PodDisruptionBudget type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodDisruptionBudgetInformerWithOptions]).
 func NewPodDisruptionBudgetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPodDisruptionBudgetInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedPodDisruptionBudgetInformerWithOptions constructs a new informer for PodDisruptionBudget type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodDisruptionBudgetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) PodDisruptionBudgetIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "policy", Version: "v1", Resource: "poddisruptionbudgets"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apipolicyv1.PodDisruptionBudget](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewPodDisruptionBudgetInformerWithOptions(client kubernetes.Interface, name
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *podDisruptionBudgetInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewPodDisruptionBudgetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedPodDisruptionBudgetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *podDisruptionBudgetInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apipolicyv1.PodDisruptionBudget{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *podDisruptionBudgetInformer) TypedInformer() PodDisruptionBudgetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apipolicyv1.PodDisruptionBudget](f.factory.InformerFor(&apipolicyv1.PodDisruptionBudget{}, f.defaultInformer))
 }
 
 func (f *podDisruptionBudgetInformer) Lister() policyv1.PodDisruptionBudgetLister {
 	return policyv1.NewPodDisruptionBudgetLister(f.Informer().GetIndexer())
 }
+
+// ToTypedPodDisruptionBudgetInformer converts an untyped informer into a TypedPodDisruptionBudgetInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PodDisruptionBudget. If that is not the case, calling type-safe methods of the returned
+// TypedPodDisruptionBudgetInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPodDisruptionBudgetInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPodDisruptionBudgetInformer(informer PodDisruptionBudgetInformer) TypedPodDisruptionBudgetInformer {
+	if informer, ok := informer.(TypedPodDisruptionBudgetInformer); ok {
+		return informer
+	}
+	return &podDisruptionBudgetTypedInformerAdapter{informer}
+}
+
+type podDisruptionBudgetTypedInformerAdapter struct {
+	PodDisruptionBudgetInformer
+}
+
+func (a *podDisruptionBudgetTypedInformerAdapter) TypedInformer() PodDisruptionBudgetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apipolicyv1.PodDisruptionBudget](a.Informer())
+}
+
+// ToPodDisruptionBudgetIndexInformer converts an untyped informer into a PodDisruptionBudgetIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PodDisruptionBudget. If that is not the case, calling type-safe methods of the returned
+// PodDisruptionBudgetIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PodDisruptionBudgetIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPodDisruptionBudgetIndexInformer(informer cache.SharedIndexInformer) PodDisruptionBudgetIndexInformer {
+	if informer, ok := informer.(PodDisruptionBudgetIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apipolicyv1.PodDisruptionBudget](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/policy/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/policy/v1beta1/interface.go
index 055c8adc55..31c09bc17b 100644
--- a/vendor/k8s.io/client-go/informers/policy/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/policy/v1beta1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// PodDisruptionBudgets returns a PodDisruptionBudgetInformer.
-	PodDisruptionBudgets() PodDisruptionBudgetInformer
+	PodDisruptionBudgets() TypedPodDisruptionBudgetInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// PodDisruptionBudgets returns a PodDisruptionBudgetInformer.
-func (v *version) PodDisruptionBudgets() PodDisruptionBudgetInformer {
+// PodDisruptionBudgets returns a TypedPodDisruptionBudgetInformer.
+func (v *version) PodDisruptionBudgets() TypedPodDisruptionBudgetInformer {
 	return &podDisruptionBudgetInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/policy/v1beta1/poddisruptionbudget.go b/vendor/k8s.io/client-go/informers/policy/v1beta1/poddisruptionbudget.go
index 70c79683fe..8069aad312 100644
--- a/vendor/k8s.io/client-go/informers/policy/v1beta1/poddisruptionbudget.go
+++ b/vendor/k8s.io/client-go/informers/policy/v1beta1/poddisruptionbudget.go
@@ -34,12 +34,40 @@ import (
 )
 
 // PodDisruptionBudgetInformer provides access to a shared informer and lister for
-// PodDisruptionBudgets.
+// PodDisruptionBudgets. Prefer using the type-safe variant (see [TypedPodDisruptionBudgetInformer]).
 type PodDisruptionBudgetInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() policyv1beta1.PodDisruptionBudgetLister
 }
 
+// TypedPodDisruptionBudgetInformer provides access to a shared informer and lister for
+// PodDisruptionBudgets, including the type-safe TypedInformer variant.
+// It is a superset of PodDisruptionBudgetInformer.
+type TypedPodDisruptionBudgetInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PodDisruptionBudgetIndexInformer
+	Lister() policyv1beta1.PodDisruptionBudgetLister
+}
+
+// PodDisruptionBudgetIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PodDisruptionBudgetIndexInformer cache.TypedSharedIndexInformer[*apipolicyv1beta1.PodDisruptionBudget]
+
+// PodDisruptionBudgetHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for PodDisruptionBudget.
+type PodDisruptionBudgetHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apipolicyv1beta1.PodDisruptionBudget]
+
+// PodDisruptionBudgetDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for PodDisruptionBudget.
+type PodDisruptionBudgetDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apipolicyv1beta1.PodDisruptionBudget]
+
+// PodDisruptionBudgetFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for PodDisruptionBudget.
+type PodDisruptionBudgetFilteringHandler = cache.TypedFilteringResourceEventHandler[*apipolicyv1beta1.PodDisruptionBudget]
+
+// PodDisruptionBudgetIndexers is a specialization of [cache.TypedIndexers] for PodDisruptionBudget.
+type PodDisruptionBudgetIndexers = cache.TypedIndexers[*apipolicyv1beta1.PodDisruptionBudget]
+
+// DeletedPodDisruptionBudget is a specialization of [cache.DeletedObject] for PodDisruptionBudget.
+type DeletedPodDisruptionBudget = cache.DeletedObject[*apipolicyv1beta1.PodDisruptionBudget]
+
 type podDisruptionBudgetInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type podDisruptionBudgetInformer struct {
 // NewPodDisruptionBudgetInformer constructs a new informer for PodDisruptionBudget type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodDisruptionBudgetInformer]).
 func NewPodDisruptionBudgetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewPodDisruptionBudgetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedPodDisruptionBudgetInformer constructs a new informer for PodDisruptionBudget type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodDisruptionBudgetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodDisruptionBudgetIndexers) PodDisruptionBudgetIndexInformer {
+	return NewTypedPodDisruptionBudgetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredPodDisruptionBudgetInformer constructs a new informer for PodDisruptionBudget type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPodDisruptionBudgetInformer]).
 func NewFilteredPodDisruptionBudgetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewPodDisruptionBudgetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedPodDisruptionBudgetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPodDisruptionBudgetInformer constructs a new informer for PodDisruptionBudget type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPodDisruptionBudgetInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodDisruptionBudgetIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PodDisruptionBudgetIndexInformer {
+	return NewTypedPodDisruptionBudgetInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewPodDisruptionBudgetInformerWithOptions constructs a new informer for PodDisruptionBudget type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodDisruptionBudgetInformerWithOptions]).
 func NewPodDisruptionBudgetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPodDisruptionBudgetInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedPodDisruptionBudgetInformerWithOptions constructs a new informer for PodDisruptionBudget type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodDisruptionBudgetInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) PodDisruptionBudgetIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "policy", Version: "v1beta1", Resource: "poddisruptionbudgets"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apipolicyv1beta1.PodDisruptionBudget](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewPodDisruptionBudgetInformerWithOptions(client kubernetes.Interface, name
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *podDisruptionBudgetInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewPodDisruptionBudgetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedPodDisruptionBudgetInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *podDisruptionBudgetInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apipolicyv1beta1.PodDisruptionBudget{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *podDisruptionBudgetInformer) TypedInformer() PodDisruptionBudgetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apipolicyv1beta1.PodDisruptionBudget](f.factory.InformerFor(&apipolicyv1beta1.PodDisruptionBudget{}, f.defaultInformer))
 }
 
 func (f *podDisruptionBudgetInformer) Lister() policyv1beta1.PodDisruptionBudgetLister {
 	return policyv1beta1.NewPodDisruptionBudgetLister(f.Informer().GetIndexer())
 }
+
+// ToTypedPodDisruptionBudgetInformer converts an untyped informer into a TypedPodDisruptionBudgetInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PodDisruptionBudget. If that is not the case, calling type-safe methods of the returned
+// TypedPodDisruptionBudgetInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPodDisruptionBudgetInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPodDisruptionBudgetInformer(informer PodDisruptionBudgetInformer) TypedPodDisruptionBudgetInformer {
+	if informer, ok := informer.(TypedPodDisruptionBudgetInformer); ok {
+		return informer
+	}
+	return &podDisruptionBudgetTypedInformerAdapter{informer}
+}
+
+type podDisruptionBudgetTypedInformerAdapter struct {
+	PodDisruptionBudgetInformer
+}
+
+func (a *podDisruptionBudgetTypedInformerAdapter) TypedInformer() PodDisruptionBudgetIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apipolicyv1beta1.PodDisruptionBudget](a.Informer())
+}
+
+// ToPodDisruptionBudgetIndexInformer converts an untyped informer into a PodDisruptionBudgetIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PodDisruptionBudget. If that is not the case, calling type-safe methods of the returned
+// PodDisruptionBudgetIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PodDisruptionBudgetIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPodDisruptionBudgetIndexInformer(informer cache.SharedIndexInformer) PodDisruptionBudgetIndexInformer {
+	if informer, ok := informer.(PodDisruptionBudgetIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apipolicyv1beta1.PodDisruptionBudget](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/rbac/v1/clusterrole.go b/vendor/k8s.io/client-go/informers/rbac/v1/clusterrole.go
index d938be79ee..3c0bc9e125 100644
--- a/vendor/k8s.io/client-go/informers/rbac/v1/clusterrole.go
+++ b/vendor/k8s.io/client-go/informers/rbac/v1/clusterrole.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ClusterRoleInformer provides access to a shared informer and lister for
-// ClusterRoles.
+// ClusterRoles. Prefer using the type-safe variant (see [TypedClusterRoleInformer]).
 type ClusterRoleInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() rbacv1.ClusterRoleLister
 }
 
+// TypedClusterRoleInformer provides access to a shared informer and lister for
+// ClusterRoles, including the type-safe TypedInformer variant.
+// It is a superset of ClusterRoleInformer.
+type TypedClusterRoleInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ClusterRoleIndexInformer
+	Lister() rbacv1.ClusterRoleLister
+}
+
+// ClusterRoleIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ClusterRoleIndexInformer cache.TypedSharedIndexInformer[*apirbacv1.ClusterRole]
+
+// ClusterRoleHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ClusterRole.
+type ClusterRoleHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apirbacv1.ClusterRole]
+
+// ClusterRoleDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ClusterRole.
+type ClusterRoleDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apirbacv1.ClusterRole]
+
+// ClusterRoleFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ClusterRole.
+type ClusterRoleFilteringHandler = cache.TypedFilteringResourceEventHandler[*apirbacv1.ClusterRole]
+
+// ClusterRoleIndexers is a specialization of [cache.TypedIndexers] for ClusterRole.
+type ClusterRoleIndexers = cache.TypedIndexers[*apirbacv1.ClusterRole]
+
+// DeletedClusterRole is a specialization of [cache.DeletedObject] for ClusterRole.
+type DeletedClusterRole = cache.DeletedObject[*apirbacv1.ClusterRole]
+
 type clusterRoleInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type clusterRoleInformer struct {
 // NewClusterRoleInformer constructs a new informer for ClusterRole type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterRoleInformer]).
 func NewClusterRoleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedClusterRoleInformer constructs a new informer for ClusterRole type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterRoleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterRoleIndexers) ClusterRoleIndexInformer {
+	return NewTypedClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredClusterRoleInformer constructs a new informer for ClusterRole type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredClusterRoleInformer]).
 func NewFilteredClusterRoleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredClusterRoleInformer constructs a new informer for ClusterRole type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredClusterRoleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterRoleIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterRoleIndexInformer {
+	return NewTypedClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewClusterRoleInformerWithOptions constructs a new informer for ClusterRole type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterRoleInformerWithOptions]).
 func NewClusterRoleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedClusterRoleInformerWithOptions(client, options)
+}
+
+// NewTypedClusterRoleInformerWithOptions constructs a new informer for ClusterRole type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterRoleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ClusterRoleIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1", Resource: "clusterroles"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.ClusterRole](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewClusterRoleInformerWithOptions(client kubernetes.Interface, options inte
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *clusterRoleInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *clusterRoleInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apirbacv1.ClusterRole{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *clusterRoleInformer) TypedInformer() ClusterRoleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.ClusterRole](f.factory.InformerFor(&apirbacv1.ClusterRole{}, f.defaultInformer))
 }
 
 func (f *clusterRoleInformer) Lister() rbacv1.ClusterRoleLister {
 	return rbacv1.NewClusterRoleLister(f.Informer().GetIndexer())
 }
+
+// ToTypedClusterRoleInformer converts an untyped informer into a TypedClusterRoleInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterRole. If that is not the case, calling type-safe methods of the returned
+// TypedClusterRoleInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedClusterRoleInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedClusterRoleInformer(informer ClusterRoleInformer) TypedClusterRoleInformer {
+	if informer, ok := informer.(TypedClusterRoleInformer); ok {
+		return informer
+	}
+	return &clusterRoleTypedInformerAdapter{informer}
+}
+
+type clusterRoleTypedInformerAdapter struct {
+	ClusterRoleInformer
+}
+
+func (a *clusterRoleTypedInformerAdapter) TypedInformer() ClusterRoleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.ClusterRole](a.Informer())
+}
+
+// ToClusterRoleIndexInformer converts an untyped informer into a ClusterRoleIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterRole. If that is not the case, calling type-safe methods of the returned
+// ClusterRoleIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ClusterRoleIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToClusterRoleIndexInformer(informer cache.SharedIndexInformer) ClusterRoleIndexInformer {
+	if informer, ok := informer.(ClusterRoleIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.ClusterRole](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/rbac/v1/clusterrolebinding.go b/vendor/k8s.io/client-go/informers/rbac/v1/clusterrolebinding.go
index 72fe655da8..34dde5197e 100644
--- a/vendor/k8s.io/client-go/informers/rbac/v1/clusterrolebinding.go
+++ b/vendor/k8s.io/client-go/informers/rbac/v1/clusterrolebinding.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ClusterRoleBindingInformer provides access to a shared informer and lister for
-// ClusterRoleBindings.
+// ClusterRoleBindings. Prefer using the type-safe variant (see [TypedClusterRoleBindingInformer]).
 type ClusterRoleBindingInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() rbacv1.ClusterRoleBindingLister
 }
 
+// TypedClusterRoleBindingInformer provides access to a shared informer and lister for
+// ClusterRoleBindings, including the type-safe TypedInformer variant.
+// It is a superset of ClusterRoleBindingInformer.
+type TypedClusterRoleBindingInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ClusterRoleBindingIndexInformer
+	Lister() rbacv1.ClusterRoleBindingLister
+}
+
+// ClusterRoleBindingIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ClusterRoleBindingIndexInformer cache.TypedSharedIndexInformer[*apirbacv1.ClusterRoleBinding]
+
+// ClusterRoleBindingHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ClusterRoleBinding.
+type ClusterRoleBindingHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apirbacv1.ClusterRoleBinding]
+
+// ClusterRoleBindingDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ClusterRoleBinding.
+type ClusterRoleBindingDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apirbacv1.ClusterRoleBinding]
+
+// ClusterRoleBindingFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ClusterRoleBinding.
+type ClusterRoleBindingFilteringHandler = cache.TypedFilteringResourceEventHandler[*apirbacv1.ClusterRoleBinding]
+
+// ClusterRoleBindingIndexers is a specialization of [cache.TypedIndexers] for ClusterRoleBinding.
+type ClusterRoleBindingIndexers = cache.TypedIndexers[*apirbacv1.ClusterRoleBinding]
+
+// DeletedClusterRoleBinding is a specialization of [cache.DeletedObject] for ClusterRoleBinding.
+type DeletedClusterRoleBinding = cache.DeletedObject[*apirbacv1.ClusterRoleBinding]
+
 type clusterRoleBindingInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type clusterRoleBindingInformer struct {
 // NewClusterRoleBindingInformer constructs a new informer for ClusterRoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterRoleBindingInformer]).
 func NewClusterRoleBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedClusterRoleBindingInformer constructs a new informer for ClusterRoleBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterRoleBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterRoleBindingIndexers) ClusterRoleBindingIndexInformer {
+	return NewTypedClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredClusterRoleBindingInformer constructs a new informer for ClusterRoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredClusterRoleBindingInformer]).
 func NewFilteredClusterRoleBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredClusterRoleBindingInformer constructs a new informer for ClusterRoleBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredClusterRoleBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterRoleBindingIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterRoleBindingIndexInformer {
+	return NewTypedClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewClusterRoleBindingInformerWithOptions constructs a new informer for ClusterRoleBinding type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterRoleBindingInformerWithOptions]).
 func NewClusterRoleBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedClusterRoleBindingInformerWithOptions(client, options)
+}
+
+// NewTypedClusterRoleBindingInformerWithOptions constructs a new informer for ClusterRoleBinding type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterRoleBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ClusterRoleBindingIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1", Resource: "clusterrolebindings"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.ClusterRoleBinding](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewClusterRoleBindingInformerWithOptions(client kubernetes.Interface, optio
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *clusterRoleBindingInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *clusterRoleBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apirbacv1.ClusterRoleBinding{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *clusterRoleBindingInformer) TypedInformer() ClusterRoleBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.ClusterRoleBinding](f.factory.InformerFor(&apirbacv1.ClusterRoleBinding{}, f.defaultInformer))
 }
 
 func (f *clusterRoleBindingInformer) Lister() rbacv1.ClusterRoleBindingLister {
 	return rbacv1.NewClusterRoleBindingLister(f.Informer().GetIndexer())
 }
+
+// ToTypedClusterRoleBindingInformer converts an untyped informer into a TypedClusterRoleBindingInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterRoleBinding. If that is not the case, calling type-safe methods of the returned
+// TypedClusterRoleBindingInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedClusterRoleBindingInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedClusterRoleBindingInformer(informer ClusterRoleBindingInformer) TypedClusterRoleBindingInformer {
+	if informer, ok := informer.(TypedClusterRoleBindingInformer); ok {
+		return informer
+	}
+	return &clusterRoleBindingTypedInformerAdapter{informer}
+}
+
+type clusterRoleBindingTypedInformerAdapter struct {
+	ClusterRoleBindingInformer
+}
+
+func (a *clusterRoleBindingTypedInformerAdapter) TypedInformer() ClusterRoleBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.ClusterRoleBinding](a.Informer())
+}
+
+// ToClusterRoleBindingIndexInformer converts an untyped informer into a ClusterRoleBindingIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterRoleBinding. If that is not the case, calling type-safe methods of the returned
+// ClusterRoleBindingIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ClusterRoleBindingIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToClusterRoleBindingIndexInformer(informer cache.SharedIndexInformer) ClusterRoleBindingIndexInformer {
+	if informer, ok := informer.(ClusterRoleBindingIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.ClusterRoleBinding](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/rbac/v1/interface.go b/vendor/k8s.io/client-go/informers/rbac/v1/interface.go
index 7f99c9454b..829564c283 100644
--- a/vendor/k8s.io/client-go/informers/rbac/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/rbac/v1/interface.go
@@ -25,13 +25,13 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// ClusterRoles returns a ClusterRoleInformer.
-	ClusterRoles() ClusterRoleInformer
+	ClusterRoles() TypedClusterRoleInformer
 	// ClusterRoleBindings returns a ClusterRoleBindingInformer.
-	ClusterRoleBindings() ClusterRoleBindingInformer
+	ClusterRoleBindings() TypedClusterRoleBindingInformer
 	// Roles returns a RoleInformer.
-	Roles() RoleInformer
+	Roles() TypedRoleInformer
 	// RoleBindings returns a RoleBindingInformer.
-	RoleBindings() RoleBindingInformer
+	RoleBindings() TypedRoleBindingInformer
 }
 
 type version struct {
@@ -45,22 +45,22 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// ClusterRoles returns a ClusterRoleInformer.
-func (v *version) ClusterRoles() ClusterRoleInformer {
+// ClusterRoles returns a TypedClusterRoleInformer.
+func (v *version) ClusterRoles() TypedClusterRoleInformer {
 	return &clusterRoleInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ClusterRoleBindings returns a ClusterRoleBindingInformer.
-func (v *version) ClusterRoleBindings() ClusterRoleBindingInformer {
+// ClusterRoleBindings returns a TypedClusterRoleBindingInformer.
+func (v *version) ClusterRoleBindings() TypedClusterRoleBindingInformer {
 	return &clusterRoleBindingInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Roles returns a RoleInformer.
-func (v *version) Roles() RoleInformer {
+// Roles returns a TypedRoleInformer.
+func (v *version) Roles() TypedRoleInformer {
 	return &roleInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// RoleBindings returns a RoleBindingInformer.
-func (v *version) RoleBindings() RoleBindingInformer {
+// RoleBindings returns a TypedRoleBindingInformer.
+func (v *version) RoleBindings() TypedRoleBindingInformer {
 	return &roleBindingInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/rbac/v1/role.go b/vendor/k8s.io/client-go/informers/rbac/v1/role.go
index f66decf040..0e288582b3 100644
--- a/vendor/k8s.io/client-go/informers/rbac/v1/role.go
+++ b/vendor/k8s.io/client-go/informers/rbac/v1/role.go
@@ -34,12 +34,40 @@ import (
 )
 
 // RoleInformer provides access to a shared informer and lister for
-// Roles.
+// Roles. Prefer using the type-safe variant (see [TypedRoleInformer]).
 type RoleInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() rbacv1.RoleLister
 }
 
+// TypedRoleInformer provides access to a shared informer and lister for
+// Roles, including the type-safe TypedInformer variant.
+// It is a superset of RoleInformer.
+type TypedRoleInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() RoleIndexInformer
+	Lister() rbacv1.RoleLister
+}
+
+// RoleIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type RoleIndexInformer cache.TypedSharedIndexInformer[*apirbacv1.Role]
+
+// RoleHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Role.
+type RoleHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apirbacv1.Role]
+
+// RoleDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Role.
+type RoleDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apirbacv1.Role]
+
+// RoleFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Role.
+type RoleFilteringHandler = cache.TypedFilteringResourceEventHandler[*apirbacv1.Role]
+
+// RoleIndexers is a specialization of [cache.TypedIndexers] for Role.
+type RoleIndexers = cache.TypedIndexers[*apirbacv1.Role]
+
+// DeletedRole is a specialization of [cache.DeletedObject] for Role.
+type DeletedRole = cache.DeletedObject[*apirbacv1.Role]
+
 type roleInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type roleInformer struct {
 // NewRoleInformer constructs a new informer for Role type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRoleInformer]).
 func NewRoleInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewRoleInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedRoleInformer constructs a new informer for Role type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRoleInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers RoleIndexers) RoleIndexInformer {
+	return NewTypedRoleInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredRoleInformer constructs a new informer for Role type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredRoleInformer]).
 func NewFilteredRoleInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewRoleInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedRoleInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredRoleInformer constructs a new informer for Role type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredRoleInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers RoleIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) RoleIndexInformer {
+	return NewTypedRoleInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewRoleInformerWithOptions constructs a new informer for Role type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRoleInformerWithOptions]).
 func NewRoleInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedRoleInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedRoleInformerWithOptions constructs a new informer for Role type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRoleInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) RoleIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1", Resource: "roles"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.Role](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewRoleInformerWithOptions(client kubernetes.Interface, namespace string, o
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *roleInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewRoleInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedRoleInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *roleInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apirbacv1.Role{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *roleInformer) TypedInformer() RoleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.Role](f.factory.InformerFor(&apirbacv1.Role{}, f.defaultInformer))
 }
 
 func (f *roleInformer) Lister() rbacv1.RoleLister {
 	return rbacv1.NewRoleLister(f.Informer().GetIndexer())
 }
+
+// ToTypedRoleInformer converts an untyped informer into a TypedRoleInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Role. If that is not the case, calling type-safe methods of the returned
+// TypedRoleInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedRoleInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedRoleInformer(informer RoleInformer) TypedRoleInformer {
+	if informer, ok := informer.(TypedRoleInformer); ok {
+		return informer
+	}
+	return &roleTypedInformerAdapter{informer}
+}
+
+type roleTypedInformerAdapter struct {
+	RoleInformer
+}
+
+func (a *roleTypedInformerAdapter) TypedInformer() RoleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.Role](a.Informer())
+}
+
+// ToRoleIndexInformer converts an untyped informer into a RoleIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Role. If that is not the case, calling type-safe methods of the returned
+// RoleIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a RoleIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToRoleIndexInformer(informer cache.SharedIndexInformer) RoleIndexInformer {
+	if informer, ok := informer.(RoleIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.Role](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/rbac/v1/rolebinding.go b/vendor/k8s.io/client-go/informers/rbac/v1/rolebinding.go
index c17b1c474f..261a1d03ae 100644
--- a/vendor/k8s.io/client-go/informers/rbac/v1/rolebinding.go
+++ b/vendor/k8s.io/client-go/informers/rbac/v1/rolebinding.go
@@ -34,12 +34,40 @@ import (
 )
 
 // RoleBindingInformer provides access to a shared informer and lister for
-// RoleBindings.
+// RoleBindings. Prefer using the type-safe variant (see [TypedRoleBindingInformer]).
 type RoleBindingInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() rbacv1.RoleBindingLister
 }
 
+// TypedRoleBindingInformer provides access to a shared informer and lister for
+// RoleBindings, including the type-safe TypedInformer variant.
+// It is a superset of RoleBindingInformer.
+type TypedRoleBindingInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() RoleBindingIndexInformer
+	Lister() rbacv1.RoleBindingLister
+}
+
+// RoleBindingIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type RoleBindingIndexInformer cache.TypedSharedIndexInformer[*apirbacv1.RoleBinding]
+
+// RoleBindingHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for RoleBinding.
+type RoleBindingHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apirbacv1.RoleBinding]
+
+// RoleBindingDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for RoleBinding.
+type RoleBindingDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apirbacv1.RoleBinding]
+
+// RoleBindingFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for RoleBinding.
+type RoleBindingFilteringHandler = cache.TypedFilteringResourceEventHandler[*apirbacv1.RoleBinding]
+
+// RoleBindingIndexers is a specialization of [cache.TypedIndexers] for RoleBinding.
+type RoleBindingIndexers = cache.TypedIndexers[*apirbacv1.RoleBinding]
+
+// DeletedRoleBinding is a specialization of [cache.DeletedObject] for RoleBinding.
+type DeletedRoleBinding = cache.DeletedObject[*apirbacv1.RoleBinding]
+
 type roleBindingInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type roleBindingInformer struct {
 // NewRoleBindingInformer constructs a new informer for RoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRoleBindingInformer]).
 func NewRoleBindingInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewRoleBindingInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedRoleBindingInformer constructs a new informer for RoleBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRoleBindingInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers RoleBindingIndexers) RoleBindingIndexInformer {
+	return NewTypedRoleBindingInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredRoleBindingInformer constructs a new informer for RoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredRoleBindingInformer]).
 func NewFilteredRoleBindingInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewRoleBindingInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedRoleBindingInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredRoleBindingInformer constructs a new informer for RoleBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredRoleBindingInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers RoleBindingIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) RoleBindingIndexInformer {
+	return NewTypedRoleBindingInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewRoleBindingInformerWithOptions constructs a new informer for RoleBinding type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRoleBindingInformerWithOptions]).
 func NewRoleBindingInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedRoleBindingInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedRoleBindingInformerWithOptions constructs a new informer for RoleBinding type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRoleBindingInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) RoleBindingIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1", Resource: "rolebindings"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.RoleBinding](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewRoleBindingInformerWithOptions(client kubernetes.Interface, namespace st
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *roleBindingInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewRoleBindingInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedRoleBindingInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *roleBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apirbacv1.RoleBinding{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *roleBindingInformer) TypedInformer() RoleBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.RoleBinding](f.factory.InformerFor(&apirbacv1.RoleBinding{}, f.defaultInformer))
 }
 
 func (f *roleBindingInformer) Lister() rbacv1.RoleBindingLister {
 	return rbacv1.NewRoleBindingLister(f.Informer().GetIndexer())
 }
+
+// ToTypedRoleBindingInformer converts an untyped informer into a TypedRoleBindingInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *RoleBinding. If that is not the case, calling type-safe methods of the returned
+// TypedRoleBindingInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedRoleBindingInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedRoleBindingInformer(informer RoleBindingInformer) TypedRoleBindingInformer {
+	if informer, ok := informer.(TypedRoleBindingInformer); ok {
+		return informer
+	}
+	return &roleBindingTypedInformerAdapter{informer}
+}
+
+type roleBindingTypedInformerAdapter struct {
+	RoleBindingInformer
+}
+
+func (a *roleBindingTypedInformerAdapter) TypedInformer() RoleBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.RoleBinding](a.Informer())
+}
+
+// ToRoleBindingIndexInformer converts an untyped informer into a RoleBindingIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *RoleBinding. If that is not the case, calling type-safe methods of the returned
+// RoleBindingIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a RoleBindingIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToRoleBindingIndexInformer(informer cache.SharedIndexInformer) RoleBindingIndexInformer {
+	if informer, ok := informer.(RoleBindingIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apirbacv1.RoleBinding](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/rbac/v1alpha1/clusterrole.go b/vendor/k8s.io/client-go/informers/rbac/v1alpha1/clusterrole.go
index cac4ba05b9..2fbc6c2f72 100644
--- a/vendor/k8s.io/client-go/informers/rbac/v1alpha1/clusterrole.go
+++ b/vendor/k8s.io/client-go/informers/rbac/v1alpha1/clusterrole.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ClusterRoleInformer provides access to a shared informer and lister for
-// ClusterRoles.
+// ClusterRoles. Prefer using the type-safe variant (see [TypedClusterRoleInformer]).
 type ClusterRoleInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() rbacv1alpha1.ClusterRoleLister
 }
 
+// TypedClusterRoleInformer provides access to a shared informer and lister for
+// ClusterRoles, including the type-safe TypedInformer variant.
+// It is a superset of ClusterRoleInformer.
+type TypedClusterRoleInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ClusterRoleIndexInformer
+	Lister() rbacv1alpha1.ClusterRoleLister
+}
+
+// ClusterRoleIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ClusterRoleIndexInformer cache.TypedSharedIndexInformer[*apirbacv1alpha1.ClusterRole]
+
+// ClusterRoleHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ClusterRole.
+type ClusterRoleHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apirbacv1alpha1.ClusterRole]
+
+// ClusterRoleDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ClusterRole.
+type ClusterRoleDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apirbacv1alpha1.ClusterRole]
+
+// ClusterRoleFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ClusterRole.
+type ClusterRoleFilteringHandler = cache.TypedFilteringResourceEventHandler[*apirbacv1alpha1.ClusterRole]
+
+// ClusterRoleIndexers is a specialization of [cache.TypedIndexers] for ClusterRole.
+type ClusterRoleIndexers = cache.TypedIndexers[*apirbacv1alpha1.ClusterRole]
+
+// DeletedClusterRole is a specialization of [cache.DeletedObject] for ClusterRole.
+type DeletedClusterRole = cache.DeletedObject[*apirbacv1alpha1.ClusterRole]
+
 type clusterRoleInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type clusterRoleInformer struct {
 // NewClusterRoleInformer constructs a new informer for ClusterRole type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterRoleInformer]).
 func NewClusterRoleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedClusterRoleInformer constructs a new informer for ClusterRole type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterRoleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterRoleIndexers) ClusterRoleIndexInformer {
+	return NewTypedClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredClusterRoleInformer constructs a new informer for ClusterRole type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredClusterRoleInformer]).
 func NewFilteredClusterRoleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredClusterRoleInformer constructs a new informer for ClusterRole type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredClusterRoleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterRoleIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterRoleIndexInformer {
+	return NewTypedClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewClusterRoleInformerWithOptions constructs a new informer for ClusterRole type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterRoleInformerWithOptions]).
 func NewClusterRoleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedClusterRoleInformerWithOptions(client, options)
+}
+
+// NewTypedClusterRoleInformerWithOptions constructs a new informer for ClusterRole type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterRoleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ClusterRoleIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1alpha1", Resource: "clusterroles"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.ClusterRole](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewClusterRoleInformerWithOptions(client kubernetes.Interface, options inte
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *clusterRoleInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *clusterRoleInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apirbacv1alpha1.ClusterRole{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *clusterRoleInformer) TypedInformer() ClusterRoleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.ClusterRole](f.factory.InformerFor(&apirbacv1alpha1.ClusterRole{}, f.defaultInformer))
 }
 
 func (f *clusterRoleInformer) Lister() rbacv1alpha1.ClusterRoleLister {
 	return rbacv1alpha1.NewClusterRoleLister(f.Informer().GetIndexer())
 }
+
+// ToTypedClusterRoleInformer converts an untyped informer into a TypedClusterRoleInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterRole. If that is not the case, calling type-safe methods of the returned
+// TypedClusterRoleInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedClusterRoleInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedClusterRoleInformer(informer ClusterRoleInformer) TypedClusterRoleInformer {
+	if informer, ok := informer.(TypedClusterRoleInformer); ok {
+		return informer
+	}
+	return &clusterRoleTypedInformerAdapter{informer}
+}
+
+type clusterRoleTypedInformerAdapter struct {
+	ClusterRoleInformer
+}
+
+func (a *clusterRoleTypedInformerAdapter) TypedInformer() ClusterRoleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.ClusterRole](a.Informer())
+}
+
+// ToClusterRoleIndexInformer converts an untyped informer into a ClusterRoleIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterRole. If that is not the case, calling type-safe methods of the returned
+// ClusterRoleIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ClusterRoleIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToClusterRoleIndexInformer(informer cache.SharedIndexInformer) ClusterRoleIndexInformer {
+	if informer, ok := informer.(ClusterRoleIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.ClusterRole](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/rbac/v1alpha1/clusterrolebinding.go b/vendor/k8s.io/client-go/informers/rbac/v1alpha1/clusterrolebinding.go
index 944e16cef6..1932c1ef4b 100644
--- a/vendor/k8s.io/client-go/informers/rbac/v1alpha1/clusterrolebinding.go
+++ b/vendor/k8s.io/client-go/informers/rbac/v1alpha1/clusterrolebinding.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ClusterRoleBindingInformer provides access to a shared informer and lister for
-// ClusterRoleBindings.
+// ClusterRoleBindings. Prefer using the type-safe variant (see [TypedClusterRoleBindingInformer]).
 type ClusterRoleBindingInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() rbacv1alpha1.ClusterRoleBindingLister
 }
 
+// TypedClusterRoleBindingInformer provides access to a shared informer and lister for
+// ClusterRoleBindings, including the type-safe TypedInformer variant.
+// It is a superset of ClusterRoleBindingInformer.
+type TypedClusterRoleBindingInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ClusterRoleBindingIndexInformer
+	Lister() rbacv1alpha1.ClusterRoleBindingLister
+}
+
+// ClusterRoleBindingIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ClusterRoleBindingIndexInformer cache.TypedSharedIndexInformer[*apirbacv1alpha1.ClusterRoleBinding]
+
+// ClusterRoleBindingHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ClusterRoleBinding.
+type ClusterRoleBindingHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apirbacv1alpha1.ClusterRoleBinding]
+
+// ClusterRoleBindingDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ClusterRoleBinding.
+type ClusterRoleBindingDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apirbacv1alpha1.ClusterRoleBinding]
+
+// ClusterRoleBindingFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ClusterRoleBinding.
+type ClusterRoleBindingFilteringHandler = cache.TypedFilteringResourceEventHandler[*apirbacv1alpha1.ClusterRoleBinding]
+
+// ClusterRoleBindingIndexers is a specialization of [cache.TypedIndexers] for ClusterRoleBinding.
+type ClusterRoleBindingIndexers = cache.TypedIndexers[*apirbacv1alpha1.ClusterRoleBinding]
+
+// DeletedClusterRoleBinding is a specialization of [cache.DeletedObject] for ClusterRoleBinding.
+type DeletedClusterRoleBinding = cache.DeletedObject[*apirbacv1alpha1.ClusterRoleBinding]
+
 type clusterRoleBindingInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type clusterRoleBindingInformer struct {
 // NewClusterRoleBindingInformer constructs a new informer for ClusterRoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterRoleBindingInformer]).
 func NewClusterRoleBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedClusterRoleBindingInformer constructs a new informer for ClusterRoleBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterRoleBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterRoleBindingIndexers) ClusterRoleBindingIndexInformer {
+	return NewTypedClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredClusterRoleBindingInformer constructs a new informer for ClusterRoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredClusterRoleBindingInformer]).
 func NewFilteredClusterRoleBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredClusterRoleBindingInformer constructs a new informer for ClusterRoleBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredClusterRoleBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterRoleBindingIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterRoleBindingIndexInformer {
+	return NewTypedClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewClusterRoleBindingInformerWithOptions constructs a new informer for ClusterRoleBinding type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterRoleBindingInformerWithOptions]).
 func NewClusterRoleBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedClusterRoleBindingInformerWithOptions(client, options)
+}
+
+// NewTypedClusterRoleBindingInformerWithOptions constructs a new informer for ClusterRoleBinding type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterRoleBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ClusterRoleBindingIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1alpha1", Resource: "clusterrolebindings"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.ClusterRoleBinding](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewClusterRoleBindingInformerWithOptions(client kubernetes.Interface, optio
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *clusterRoleBindingInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *clusterRoleBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apirbacv1alpha1.ClusterRoleBinding{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *clusterRoleBindingInformer) TypedInformer() ClusterRoleBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.ClusterRoleBinding](f.factory.InformerFor(&apirbacv1alpha1.ClusterRoleBinding{}, f.defaultInformer))
 }
 
 func (f *clusterRoleBindingInformer) Lister() rbacv1alpha1.ClusterRoleBindingLister {
 	return rbacv1alpha1.NewClusterRoleBindingLister(f.Informer().GetIndexer())
 }
+
+// ToTypedClusterRoleBindingInformer converts an untyped informer into a TypedClusterRoleBindingInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterRoleBinding. If that is not the case, calling type-safe methods of the returned
+// TypedClusterRoleBindingInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedClusterRoleBindingInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedClusterRoleBindingInformer(informer ClusterRoleBindingInformer) TypedClusterRoleBindingInformer {
+	if informer, ok := informer.(TypedClusterRoleBindingInformer); ok {
+		return informer
+	}
+	return &clusterRoleBindingTypedInformerAdapter{informer}
+}
+
+type clusterRoleBindingTypedInformerAdapter struct {
+	ClusterRoleBindingInformer
+}
+
+func (a *clusterRoleBindingTypedInformerAdapter) TypedInformer() ClusterRoleBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.ClusterRoleBinding](a.Informer())
+}
+
+// ToClusterRoleBindingIndexInformer converts an untyped informer into a ClusterRoleBindingIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterRoleBinding. If that is not the case, calling type-safe methods of the returned
+// ClusterRoleBindingIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ClusterRoleBindingIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToClusterRoleBindingIndexInformer(informer cache.SharedIndexInformer) ClusterRoleBindingIndexInformer {
+	if informer, ok := informer.(ClusterRoleBindingIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.ClusterRoleBinding](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/rbac/v1alpha1/interface.go b/vendor/k8s.io/client-go/informers/rbac/v1alpha1/interface.go
index d27c79987f..fcfc9d232c 100644
--- a/vendor/k8s.io/client-go/informers/rbac/v1alpha1/interface.go
+++ b/vendor/k8s.io/client-go/informers/rbac/v1alpha1/interface.go
@@ -25,13 +25,13 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// ClusterRoles returns a ClusterRoleInformer.
-	ClusterRoles() ClusterRoleInformer
+	ClusterRoles() TypedClusterRoleInformer
 	// ClusterRoleBindings returns a ClusterRoleBindingInformer.
-	ClusterRoleBindings() ClusterRoleBindingInformer
+	ClusterRoleBindings() TypedClusterRoleBindingInformer
 	// Roles returns a RoleInformer.
-	Roles() RoleInformer
+	Roles() TypedRoleInformer
 	// RoleBindings returns a RoleBindingInformer.
-	RoleBindings() RoleBindingInformer
+	RoleBindings() TypedRoleBindingInformer
 }
 
 type version struct {
@@ -45,22 +45,22 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// ClusterRoles returns a ClusterRoleInformer.
-func (v *version) ClusterRoles() ClusterRoleInformer {
+// ClusterRoles returns a TypedClusterRoleInformer.
+func (v *version) ClusterRoles() TypedClusterRoleInformer {
 	return &clusterRoleInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ClusterRoleBindings returns a ClusterRoleBindingInformer.
-func (v *version) ClusterRoleBindings() ClusterRoleBindingInformer {
+// ClusterRoleBindings returns a TypedClusterRoleBindingInformer.
+func (v *version) ClusterRoleBindings() TypedClusterRoleBindingInformer {
 	return &clusterRoleBindingInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Roles returns a RoleInformer.
-func (v *version) Roles() RoleInformer {
+// Roles returns a TypedRoleInformer.
+func (v *version) Roles() TypedRoleInformer {
 	return &roleInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// RoleBindings returns a RoleBindingInformer.
-func (v *version) RoleBindings() RoleBindingInformer {
+// RoleBindings returns a TypedRoleBindingInformer.
+func (v *version) RoleBindings() TypedRoleBindingInformer {
 	return &roleBindingInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/rbac/v1alpha1/role.go b/vendor/k8s.io/client-go/informers/rbac/v1alpha1/role.go
index c4e2a6cf6c..f50036840c 100644
--- a/vendor/k8s.io/client-go/informers/rbac/v1alpha1/role.go
+++ b/vendor/k8s.io/client-go/informers/rbac/v1alpha1/role.go
@@ -34,12 +34,40 @@ import (
 )
 
 // RoleInformer provides access to a shared informer and lister for
-// Roles.
+// Roles. Prefer using the type-safe variant (see [TypedRoleInformer]).
 type RoleInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() rbacv1alpha1.RoleLister
 }
 
+// TypedRoleInformer provides access to a shared informer and lister for
+// Roles, including the type-safe TypedInformer variant.
+// It is a superset of RoleInformer.
+type TypedRoleInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() RoleIndexInformer
+	Lister() rbacv1alpha1.RoleLister
+}
+
+// RoleIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type RoleIndexInformer cache.TypedSharedIndexInformer[*apirbacv1alpha1.Role]
+
+// RoleHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Role.
+type RoleHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apirbacv1alpha1.Role]
+
+// RoleDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Role.
+type RoleDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apirbacv1alpha1.Role]
+
+// RoleFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Role.
+type RoleFilteringHandler = cache.TypedFilteringResourceEventHandler[*apirbacv1alpha1.Role]
+
+// RoleIndexers is a specialization of [cache.TypedIndexers] for Role.
+type RoleIndexers = cache.TypedIndexers[*apirbacv1alpha1.Role]
+
+// DeletedRole is a specialization of [cache.DeletedObject] for Role.
+type DeletedRole = cache.DeletedObject[*apirbacv1alpha1.Role]
+
 type roleInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type roleInformer struct {
 // NewRoleInformer constructs a new informer for Role type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRoleInformer]).
 func NewRoleInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewRoleInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedRoleInformer constructs a new informer for Role type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRoleInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers RoleIndexers) RoleIndexInformer {
+	return NewTypedRoleInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredRoleInformer constructs a new informer for Role type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredRoleInformer]).
 func NewFilteredRoleInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewRoleInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedRoleInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredRoleInformer constructs a new informer for Role type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredRoleInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers RoleIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) RoleIndexInformer {
+	return NewTypedRoleInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewRoleInformerWithOptions constructs a new informer for Role type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRoleInformerWithOptions]).
 func NewRoleInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedRoleInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedRoleInformerWithOptions constructs a new informer for Role type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRoleInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) RoleIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1alpha1", Resource: "roles"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.Role](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewRoleInformerWithOptions(client kubernetes.Interface, namespace string, o
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *roleInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewRoleInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedRoleInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *roleInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apirbacv1alpha1.Role{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *roleInformer) TypedInformer() RoleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.Role](f.factory.InformerFor(&apirbacv1alpha1.Role{}, f.defaultInformer))
 }
 
 func (f *roleInformer) Lister() rbacv1alpha1.RoleLister {
 	return rbacv1alpha1.NewRoleLister(f.Informer().GetIndexer())
 }
+
+// ToTypedRoleInformer converts an untyped informer into a TypedRoleInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Role. If that is not the case, calling type-safe methods of the returned
+// TypedRoleInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedRoleInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedRoleInformer(informer RoleInformer) TypedRoleInformer {
+	if informer, ok := informer.(TypedRoleInformer); ok {
+		return informer
+	}
+	return &roleTypedInformerAdapter{informer}
+}
+
+type roleTypedInformerAdapter struct {
+	RoleInformer
+}
+
+func (a *roleTypedInformerAdapter) TypedInformer() RoleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.Role](a.Informer())
+}
+
+// ToRoleIndexInformer converts an untyped informer into a RoleIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Role. If that is not the case, calling type-safe methods of the returned
+// RoleIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a RoleIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToRoleIndexInformer(informer cache.SharedIndexInformer) RoleIndexInformer {
+	if informer, ok := informer.(RoleIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.Role](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/rbac/v1alpha1/rolebinding.go b/vendor/k8s.io/client-go/informers/rbac/v1alpha1/rolebinding.go
index ef1e246f5b..64b5b257fb 100644
--- a/vendor/k8s.io/client-go/informers/rbac/v1alpha1/rolebinding.go
+++ b/vendor/k8s.io/client-go/informers/rbac/v1alpha1/rolebinding.go
@@ -34,12 +34,40 @@ import (
 )
 
 // RoleBindingInformer provides access to a shared informer and lister for
-// RoleBindings.
+// RoleBindings. Prefer using the type-safe variant (see [TypedRoleBindingInformer]).
 type RoleBindingInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() rbacv1alpha1.RoleBindingLister
 }
 
+// TypedRoleBindingInformer provides access to a shared informer and lister for
+// RoleBindings, including the type-safe TypedInformer variant.
+// It is a superset of RoleBindingInformer.
+type TypedRoleBindingInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() RoleBindingIndexInformer
+	Lister() rbacv1alpha1.RoleBindingLister
+}
+
+// RoleBindingIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type RoleBindingIndexInformer cache.TypedSharedIndexInformer[*apirbacv1alpha1.RoleBinding]
+
+// RoleBindingHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for RoleBinding.
+type RoleBindingHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apirbacv1alpha1.RoleBinding]
+
+// RoleBindingDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for RoleBinding.
+type RoleBindingDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apirbacv1alpha1.RoleBinding]
+
+// RoleBindingFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for RoleBinding.
+type RoleBindingFilteringHandler = cache.TypedFilteringResourceEventHandler[*apirbacv1alpha1.RoleBinding]
+
+// RoleBindingIndexers is a specialization of [cache.TypedIndexers] for RoleBinding.
+type RoleBindingIndexers = cache.TypedIndexers[*apirbacv1alpha1.RoleBinding]
+
+// DeletedRoleBinding is a specialization of [cache.DeletedObject] for RoleBinding.
+type DeletedRoleBinding = cache.DeletedObject[*apirbacv1alpha1.RoleBinding]
+
 type roleBindingInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type roleBindingInformer struct {
 // NewRoleBindingInformer constructs a new informer for RoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRoleBindingInformer]).
 func NewRoleBindingInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewRoleBindingInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedRoleBindingInformer constructs a new informer for RoleBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRoleBindingInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers RoleBindingIndexers) RoleBindingIndexInformer {
+	return NewTypedRoleBindingInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredRoleBindingInformer constructs a new informer for RoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredRoleBindingInformer]).
 func NewFilteredRoleBindingInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewRoleBindingInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedRoleBindingInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredRoleBindingInformer constructs a new informer for RoleBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredRoleBindingInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers RoleBindingIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) RoleBindingIndexInformer {
+	return NewTypedRoleBindingInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewRoleBindingInformerWithOptions constructs a new informer for RoleBinding type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRoleBindingInformerWithOptions]).
 func NewRoleBindingInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedRoleBindingInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedRoleBindingInformerWithOptions constructs a new informer for RoleBinding type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRoleBindingInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) RoleBindingIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1alpha1", Resource: "rolebindings"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.RoleBinding](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewRoleBindingInformerWithOptions(client kubernetes.Interface, namespace st
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *roleBindingInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewRoleBindingInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedRoleBindingInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *roleBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apirbacv1alpha1.RoleBinding{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *roleBindingInformer) TypedInformer() RoleBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.RoleBinding](f.factory.InformerFor(&apirbacv1alpha1.RoleBinding{}, f.defaultInformer))
 }
 
 func (f *roleBindingInformer) Lister() rbacv1alpha1.RoleBindingLister {
 	return rbacv1alpha1.NewRoleBindingLister(f.Informer().GetIndexer())
 }
+
+// ToTypedRoleBindingInformer converts an untyped informer into a TypedRoleBindingInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *RoleBinding. If that is not the case, calling type-safe methods of the returned
+// TypedRoleBindingInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedRoleBindingInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedRoleBindingInformer(informer RoleBindingInformer) TypedRoleBindingInformer {
+	if informer, ok := informer.(TypedRoleBindingInformer); ok {
+		return informer
+	}
+	return &roleBindingTypedInformerAdapter{informer}
+}
+
+type roleBindingTypedInformerAdapter struct {
+	RoleBindingInformer
+}
+
+func (a *roleBindingTypedInformerAdapter) TypedInformer() RoleBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.RoleBinding](a.Informer())
+}
+
+// ToRoleBindingIndexInformer converts an untyped informer into a RoleBindingIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *RoleBinding. If that is not the case, calling type-safe methods of the returned
+// RoleBindingIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a RoleBindingIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToRoleBindingIndexInformer(informer cache.SharedIndexInformer) RoleBindingIndexInformer {
+	if informer, ok := informer.(RoleBindingIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apirbacv1alpha1.RoleBinding](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/rbac/v1beta1/clusterrole.go b/vendor/k8s.io/client-go/informers/rbac/v1beta1/clusterrole.go
index df87d468ca..20261642d4 100644
--- a/vendor/k8s.io/client-go/informers/rbac/v1beta1/clusterrole.go
+++ b/vendor/k8s.io/client-go/informers/rbac/v1beta1/clusterrole.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ClusterRoleInformer provides access to a shared informer and lister for
-// ClusterRoles.
+// ClusterRoles. Prefer using the type-safe variant (see [TypedClusterRoleInformer]).
 type ClusterRoleInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() rbacv1beta1.ClusterRoleLister
 }
 
+// TypedClusterRoleInformer provides access to a shared informer and lister for
+// ClusterRoles, including the type-safe TypedInformer variant.
+// It is a superset of ClusterRoleInformer.
+type TypedClusterRoleInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ClusterRoleIndexInformer
+	Lister() rbacv1beta1.ClusterRoleLister
+}
+
+// ClusterRoleIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ClusterRoleIndexInformer cache.TypedSharedIndexInformer[*apirbacv1beta1.ClusterRole]
+
+// ClusterRoleHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ClusterRole.
+type ClusterRoleHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apirbacv1beta1.ClusterRole]
+
+// ClusterRoleDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ClusterRole.
+type ClusterRoleDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apirbacv1beta1.ClusterRole]
+
+// ClusterRoleFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ClusterRole.
+type ClusterRoleFilteringHandler = cache.TypedFilteringResourceEventHandler[*apirbacv1beta1.ClusterRole]
+
+// ClusterRoleIndexers is a specialization of [cache.TypedIndexers] for ClusterRole.
+type ClusterRoleIndexers = cache.TypedIndexers[*apirbacv1beta1.ClusterRole]
+
+// DeletedClusterRole is a specialization of [cache.DeletedObject] for ClusterRole.
+type DeletedClusterRole = cache.DeletedObject[*apirbacv1beta1.ClusterRole]
+
 type clusterRoleInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type clusterRoleInformer struct {
 // NewClusterRoleInformer constructs a new informer for ClusterRole type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterRoleInformer]).
 func NewClusterRoleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedClusterRoleInformer constructs a new informer for ClusterRole type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterRoleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterRoleIndexers) ClusterRoleIndexInformer {
+	return NewTypedClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredClusterRoleInformer constructs a new informer for ClusterRole type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredClusterRoleInformer]).
 func NewFilteredClusterRoleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredClusterRoleInformer constructs a new informer for ClusterRole type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredClusterRoleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterRoleIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterRoleIndexInformer {
+	return NewTypedClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewClusterRoleInformerWithOptions constructs a new informer for ClusterRole type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterRoleInformerWithOptions]).
 func NewClusterRoleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedClusterRoleInformerWithOptions(client, options)
+}
+
+// NewTypedClusterRoleInformerWithOptions constructs a new informer for ClusterRole type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterRoleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ClusterRoleIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1beta1", Resource: "clusterroles"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.ClusterRole](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewClusterRoleInformerWithOptions(client kubernetes.Interface, options inte
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *clusterRoleInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedClusterRoleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *clusterRoleInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apirbacv1beta1.ClusterRole{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *clusterRoleInformer) TypedInformer() ClusterRoleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.ClusterRole](f.factory.InformerFor(&apirbacv1beta1.ClusterRole{}, f.defaultInformer))
 }
 
 func (f *clusterRoleInformer) Lister() rbacv1beta1.ClusterRoleLister {
 	return rbacv1beta1.NewClusterRoleLister(f.Informer().GetIndexer())
 }
+
+// ToTypedClusterRoleInformer converts an untyped informer into a TypedClusterRoleInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterRole. If that is not the case, calling type-safe methods of the returned
+// TypedClusterRoleInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedClusterRoleInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedClusterRoleInformer(informer ClusterRoleInformer) TypedClusterRoleInformer {
+	if informer, ok := informer.(TypedClusterRoleInformer); ok {
+		return informer
+	}
+	return &clusterRoleTypedInformerAdapter{informer}
+}
+
+type clusterRoleTypedInformerAdapter struct {
+	ClusterRoleInformer
+}
+
+func (a *clusterRoleTypedInformerAdapter) TypedInformer() ClusterRoleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.ClusterRole](a.Informer())
+}
+
+// ToClusterRoleIndexInformer converts an untyped informer into a ClusterRoleIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterRole. If that is not the case, calling type-safe methods of the returned
+// ClusterRoleIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ClusterRoleIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToClusterRoleIndexInformer(informer cache.SharedIndexInformer) ClusterRoleIndexInformer {
+	if informer, ok := informer.(ClusterRoleIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.ClusterRole](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/rbac/v1beta1/clusterrolebinding.go b/vendor/k8s.io/client-go/informers/rbac/v1beta1/clusterrolebinding.go
index 9f14c10daf..a454f0c643 100644
--- a/vendor/k8s.io/client-go/informers/rbac/v1beta1/clusterrolebinding.go
+++ b/vendor/k8s.io/client-go/informers/rbac/v1beta1/clusterrolebinding.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ClusterRoleBindingInformer provides access to a shared informer and lister for
-// ClusterRoleBindings.
+// ClusterRoleBindings. Prefer using the type-safe variant (see [TypedClusterRoleBindingInformer]).
 type ClusterRoleBindingInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() rbacv1beta1.ClusterRoleBindingLister
 }
 
+// TypedClusterRoleBindingInformer provides access to a shared informer and lister for
+// ClusterRoleBindings, including the type-safe TypedInformer variant.
+// It is a superset of ClusterRoleBindingInformer.
+type TypedClusterRoleBindingInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ClusterRoleBindingIndexInformer
+	Lister() rbacv1beta1.ClusterRoleBindingLister
+}
+
+// ClusterRoleBindingIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ClusterRoleBindingIndexInformer cache.TypedSharedIndexInformer[*apirbacv1beta1.ClusterRoleBinding]
+
+// ClusterRoleBindingHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ClusterRoleBinding.
+type ClusterRoleBindingHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apirbacv1beta1.ClusterRoleBinding]
+
+// ClusterRoleBindingDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ClusterRoleBinding.
+type ClusterRoleBindingDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apirbacv1beta1.ClusterRoleBinding]
+
+// ClusterRoleBindingFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ClusterRoleBinding.
+type ClusterRoleBindingFilteringHandler = cache.TypedFilteringResourceEventHandler[*apirbacv1beta1.ClusterRoleBinding]
+
+// ClusterRoleBindingIndexers is a specialization of [cache.TypedIndexers] for ClusterRoleBinding.
+type ClusterRoleBindingIndexers = cache.TypedIndexers[*apirbacv1beta1.ClusterRoleBinding]
+
+// DeletedClusterRoleBinding is a specialization of [cache.DeletedObject] for ClusterRoleBinding.
+type DeletedClusterRoleBinding = cache.DeletedObject[*apirbacv1beta1.ClusterRoleBinding]
+
 type clusterRoleBindingInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type clusterRoleBindingInformer struct {
 // NewClusterRoleBindingInformer constructs a new informer for ClusterRoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterRoleBindingInformer]).
 func NewClusterRoleBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedClusterRoleBindingInformer constructs a new informer for ClusterRoleBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterRoleBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterRoleBindingIndexers) ClusterRoleBindingIndexInformer {
+	return NewTypedClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredClusterRoleBindingInformer constructs a new informer for ClusterRoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredClusterRoleBindingInformer]).
 func NewFilteredClusterRoleBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredClusterRoleBindingInformer constructs a new informer for ClusterRoleBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredClusterRoleBindingInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ClusterRoleBindingIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterRoleBindingIndexInformer {
+	return NewTypedClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewClusterRoleBindingInformerWithOptions constructs a new informer for ClusterRoleBinding type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedClusterRoleBindingInformerWithOptions]).
 func NewClusterRoleBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedClusterRoleBindingInformerWithOptions(client, options)
+}
+
+// NewTypedClusterRoleBindingInformerWithOptions constructs a new informer for ClusterRoleBinding type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedClusterRoleBindingInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ClusterRoleBindingIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1beta1", Resource: "clusterrolebindings"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.ClusterRoleBinding](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewClusterRoleBindingInformerWithOptions(client kubernetes.Interface, optio
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *clusterRoleBindingInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedClusterRoleBindingInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *clusterRoleBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apirbacv1beta1.ClusterRoleBinding{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *clusterRoleBindingInformer) TypedInformer() ClusterRoleBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.ClusterRoleBinding](f.factory.InformerFor(&apirbacv1beta1.ClusterRoleBinding{}, f.defaultInformer))
 }
 
 func (f *clusterRoleBindingInformer) Lister() rbacv1beta1.ClusterRoleBindingLister {
 	return rbacv1beta1.NewClusterRoleBindingLister(f.Informer().GetIndexer())
 }
+
+// ToTypedClusterRoleBindingInformer converts an untyped informer into a TypedClusterRoleBindingInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterRoleBinding. If that is not the case, calling type-safe methods of the returned
+// TypedClusterRoleBindingInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedClusterRoleBindingInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedClusterRoleBindingInformer(informer ClusterRoleBindingInformer) TypedClusterRoleBindingInformer {
+	if informer, ok := informer.(TypedClusterRoleBindingInformer); ok {
+		return informer
+	}
+	return &clusterRoleBindingTypedInformerAdapter{informer}
+}
+
+type clusterRoleBindingTypedInformerAdapter struct {
+	ClusterRoleBindingInformer
+}
+
+func (a *clusterRoleBindingTypedInformerAdapter) TypedInformer() ClusterRoleBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.ClusterRoleBinding](a.Informer())
+}
+
+// ToClusterRoleBindingIndexInformer converts an untyped informer into a ClusterRoleBindingIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ClusterRoleBinding. If that is not the case, calling type-safe methods of the returned
+// ClusterRoleBindingIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ClusterRoleBindingIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToClusterRoleBindingIndexInformer(informer cache.SharedIndexInformer) ClusterRoleBindingIndexInformer {
+	if informer, ok := informer.(ClusterRoleBindingIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.ClusterRoleBinding](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/rbac/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/rbac/v1beta1/interface.go
index 04add43afa..af356b40e2 100644
--- a/vendor/k8s.io/client-go/informers/rbac/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/rbac/v1beta1/interface.go
@@ -25,13 +25,13 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// ClusterRoles returns a ClusterRoleInformer.
-	ClusterRoles() ClusterRoleInformer
+	ClusterRoles() TypedClusterRoleInformer
 	// ClusterRoleBindings returns a ClusterRoleBindingInformer.
-	ClusterRoleBindings() ClusterRoleBindingInformer
+	ClusterRoleBindings() TypedClusterRoleBindingInformer
 	// Roles returns a RoleInformer.
-	Roles() RoleInformer
+	Roles() TypedRoleInformer
 	// RoleBindings returns a RoleBindingInformer.
-	RoleBindings() RoleBindingInformer
+	RoleBindings() TypedRoleBindingInformer
 }
 
 type version struct {
@@ -45,22 +45,22 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// ClusterRoles returns a ClusterRoleInformer.
-func (v *version) ClusterRoles() ClusterRoleInformer {
+// ClusterRoles returns a TypedClusterRoleInformer.
+func (v *version) ClusterRoles() TypedClusterRoleInformer {
 	return &clusterRoleInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ClusterRoleBindings returns a ClusterRoleBindingInformer.
-func (v *version) ClusterRoleBindings() ClusterRoleBindingInformer {
+// ClusterRoleBindings returns a TypedClusterRoleBindingInformer.
+func (v *version) ClusterRoleBindings() TypedClusterRoleBindingInformer {
 	return &clusterRoleBindingInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Roles returns a RoleInformer.
-func (v *version) Roles() RoleInformer {
+// Roles returns a TypedRoleInformer.
+func (v *version) Roles() TypedRoleInformer {
 	return &roleInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// RoleBindings returns a RoleBindingInformer.
-func (v *version) RoleBindings() RoleBindingInformer {
+// RoleBindings returns a TypedRoleBindingInformer.
+func (v *version) RoleBindings() TypedRoleBindingInformer {
 	return &roleBindingInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/rbac/v1beta1/role.go b/vendor/k8s.io/client-go/informers/rbac/v1beta1/role.go
index 4dd948f167..fe0d4acf9a 100644
--- a/vendor/k8s.io/client-go/informers/rbac/v1beta1/role.go
+++ b/vendor/k8s.io/client-go/informers/rbac/v1beta1/role.go
@@ -34,12 +34,40 @@ import (
 )
 
 // RoleInformer provides access to a shared informer and lister for
-// Roles.
+// Roles. Prefer using the type-safe variant (see [TypedRoleInformer]).
 type RoleInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() rbacv1beta1.RoleLister
 }
 
+// TypedRoleInformer provides access to a shared informer and lister for
+// Roles, including the type-safe TypedInformer variant.
+// It is a superset of RoleInformer.
+type TypedRoleInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() RoleIndexInformer
+	Lister() rbacv1beta1.RoleLister
+}
+
+// RoleIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type RoleIndexInformer cache.TypedSharedIndexInformer[*apirbacv1beta1.Role]
+
+// RoleHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Role.
+type RoleHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apirbacv1beta1.Role]
+
+// RoleDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Role.
+type RoleDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apirbacv1beta1.Role]
+
+// RoleFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Role.
+type RoleFilteringHandler = cache.TypedFilteringResourceEventHandler[*apirbacv1beta1.Role]
+
+// RoleIndexers is a specialization of [cache.TypedIndexers] for Role.
+type RoleIndexers = cache.TypedIndexers[*apirbacv1beta1.Role]
+
+// DeletedRole is a specialization of [cache.DeletedObject] for Role.
+type DeletedRole = cache.DeletedObject[*apirbacv1beta1.Role]
+
 type roleInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type roleInformer struct {
 // NewRoleInformer constructs a new informer for Role type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRoleInformer]).
 func NewRoleInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewRoleInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedRoleInformer constructs a new informer for Role type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRoleInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers RoleIndexers) RoleIndexInformer {
+	return NewTypedRoleInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredRoleInformer constructs a new informer for Role type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredRoleInformer]).
 func NewFilteredRoleInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewRoleInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedRoleInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredRoleInformer constructs a new informer for Role type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredRoleInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers RoleIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) RoleIndexInformer {
+	return NewTypedRoleInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewRoleInformerWithOptions constructs a new informer for Role type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRoleInformerWithOptions]).
 func NewRoleInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedRoleInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedRoleInformerWithOptions constructs a new informer for Role type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRoleInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) RoleIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1beta1", Resource: "roles"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.Role](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewRoleInformerWithOptions(client kubernetes.Interface, namespace string, o
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *roleInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewRoleInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedRoleInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *roleInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apirbacv1beta1.Role{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *roleInformer) TypedInformer() RoleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.Role](f.factory.InformerFor(&apirbacv1beta1.Role{}, f.defaultInformer))
 }
 
 func (f *roleInformer) Lister() rbacv1beta1.RoleLister {
 	return rbacv1beta1.NewRoleLister(f.Informer().GetIndexer())
 }
+
+// ToTypedRoleInformer converts an untyped informer into a TypedRoleInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Role. If that is not the case, calling type-safe methods of the returned
+// TypedRoleInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedRoleInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedRoleInformer(informer RoleInformer) TypedRoleInformer {
+	if informer, ok := informer.(TypedRoleInformer); ok {
+		return informer
+	}
+	return &roleTypedInformerAdapter{informer}
+}
+
+type roleTypedInformerAdapter struct {
+	RoleInformer
+}
+
+func (a *roleTypedInformerAdapter) TypedInformer() RoleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.Role](a.Informer())
+}
+
+// ToRoleIndexInformer converts an untyped informer into a RoleIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Role. If that is not the case, calling type-safe methods of the returned
+// RoleIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a RoleIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToRoleIndexInformer(informer cache.SharedIndexInformer) RoleIndexInformer {
+	if informer, ok := informer.(RoleIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.Role](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/rbac/v1beta1/rolebinding.go b/vendor/k8s.io/client-go/informers/rbac/v1beta1/rolebinding.go
index 882d59471e..dc92e5433c 100644
--- a/vendor/k8s.io/client-go/informers/rbac/v1beta1/rolebinding.go
+++ b/vendor/k8s.io/client-go/informers/rbac/v1beta1/rolebinding.go
@@ -34,12 +34,40 @@ import (
 )
 
 // RoleBindingInformer provides access to a shared informer and lister for
-// RoleBindings.
+// RoleBindings. Prefer using the type-safe variant (see [TypedRoleBindingInformer]).
 type RoleBindingInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() rbacv1beta1.RoleBindingLister
 }
 
+// TypedRoleBindingInformer provides access to a shared informer and lister for
+// RoleBindings, including the type-safe TypedInformer variant.
+// It is a superset of RoleBindingInformer.
+type TypedRoleBindingInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() RoleBindingIndexInformer
+	Lister() rbacv1beta1.RoleBindingLister
+}
+
+// RoleBindingIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type RoleBindingIndexInformer cache.TypedSharedIndexInformer[*apirbacv1beta1.RoleBinding]
+
+// RoleBindingHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for RoleBinding.
+type RoleBindingHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apirbacv1beta1.RoleBinding]
+
+// RoleBindingDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for RoleBinding.
+type RoleBindingDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apirbacv1beta1.RoleBinding]
+
+// RoleBindingFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for RoleBinding.
+type RoleBindingFilteringHandler = cache.TypedFilteringResourceEventHandler[*apirbacv1beta1.RoleBinding]
+
+// RoleBindingIndexers is a specialization of [cache.TypedIndexers] for RoleBinding.
+type RoleBindingIndexers = cache.TypedIndexers[*apirbacv1beta1.RoleBinding]
+
+// DeletedRoleBinding is a specialization of [cache.DeletedObject] for RoleBinding.
+type DeletedRoleBinding = cache.DeletedObject[*apirbacv1beta1.RoleBinding]
+
 type roleBindingInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type roleBindingInformer struct {
 // NewRoleBindingInformer constructs a new informer for RoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRoleBindingInformer]).
 func NewRoleBindingInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewRoleBindingInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedRoleBindingInformer constructs a new informer for RoleBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRoleBindingInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers RoleBindingIndexers) RoleBindingIndexInformer {
+	return NewTypedRoleBindingInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredRoleBindingInformer constructs a new informer for RoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredRoleBindingInformer]).
 func NewFilteredRoleBindingInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewRoleBindingInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedRoleBindingInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredRoleBindingInformer constructs a new informer for RoleBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredRoleBindingInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers RoleBindingIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) RoleBindingIndexInformer {
+	return NewTypedRoleBindingInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewRoleBindingInformerWithOptions constructs a new informer for RoleBinding type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedRoleBindingInformerWithOptions]).
 func NewRoleBindingInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedRoleBindingInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedRoleBindingInformerWithOptions constructs a new informer for RoleBinding type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedRoleBindingInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) RoleBindingIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1beta1", Resource: "rolebindings"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.RoleBinding](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewRoleBindingInformerWithOptions(client kubernetes.Interface, namespace st
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *roleBindingInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewRoleBindingInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedRoleBindingInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *roleBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apirbacv1beta1.RoleBinding{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *roleBindingInformer) TypedInformer() RoleBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.RoleBinding](f.factory.InformerFor(&apirbacv1beta1.RoleBinding{}, f.defaultInformer))
 }
 
 func (f *roleBindingInformer) Lister() rbacv1beta1.RoleBindingLister {
 	return rbacv1beta1.NewRoleBindingLister(f.Informer().GetIndexer())
 }
+
+// ToTypedRoleBindingInformer converts an untyped informer into a TypedRoleBindingInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *RoleBinding. If that is not the case, calling type-safe methods of the returned
+// TypedRoleBindingInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedRoleBindingInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedRoleBindingInformer(informer RoleBindingInformer) TypedRoleBindingInformer {
+	if informer, ok := informer.(TypedRoleBindingInformer); ok {
+		return informer
+	}
+	return &roleBindingTypedInformerAdapter{informer}
+}
+
+type roleBindingTypedInformerAdapter struct {
+	RoleBindingInformer
+}
+
+func (a *roleBindingTypedInformerAdapter) TypedInformer() RoleBindingIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.RoleBinding](a.Informer())
+}
+
+// ToRoleBindingIndexInformer converts an untyped informer into a RoleBindingIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *RoleBinding. If that is not the case, calling type-safe methods of the returned
+// RoleBindingIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a RoleBindingIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToRoleBindingIndexInformer(informer cache.SharedIndexInformer) RoleBindingIndexInformer {
+	if informer, ok := informer.(RoleBindingIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apirbacv1beta1.RoleBinding](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1/deviceclass.go b/vendor/k8s.io/client-go/informers/resource/v1/deviceclass.go
index bacc65a28f..807a8f946b 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1/deviceclass.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1/deviceclass.go
@@ -34,12 +34,40 @@ import (
 )
 
 // DeviceClassInformer provides access to a shared informer and lister for
-// DeviceClasses.
+// DeviceClasses. Prefer using the type-safe variant (see [TypedDeviceClassInformer]).
 type DeviceClassInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() resourcev1.DeviceClassLister
 }
 
+// TypedDeviceClassInformer provides access to a shared informer and lister for
+// DeviceClasses, including the type-safe TypedInformer variant.
+// It is a superset of DeviceClassInformer.
+type TypedDeviceClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() DeviceClassIndexInformer
+	Lister() resourcev1.DeviceClassLister
+}
+
+// DeviceClassIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type DeviceClassIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1.DeviceClass]
+
+// DeviceClassHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for DeviceClass.
+type DeviceClassHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1.DeviceClass]
+
+// DeviceClassDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for DeviceClass.
+type DeviceClassDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1.DeviceClass]
+
+// DeviceClassFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for DeviceClass.
+type DeviceClassFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1.DeviceClass]
+
+// DeviceClassIndexers is a specialization of [cache.TypedIndexers] for DeviceClass.
+type DeviceClassIndexers = cache.TypedIndexers[*apiresourcev1.DeviceClass]
+
+// DeletedDeviceClass is a specialization of [cache.DeletedObject] for DeviceClass.
+type DeletedDeviceClass = cache.DeletedObject[*apiresourcev1.DeviceClass]
+
 type deviceClassInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type deviceClassInformer struct {
 // NewDeviceClassInformer constructs a new informer for DeviceClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeviceClassInformer]).
 func NewDeviceClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedDeviceClassInformer constructs a new informer for DeviceClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeviceClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers DeviceClassIndexers) DeviceClassIndexInformer {
+	return NewTypedDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredDeviceClassInformer constructs a new informer for DeviceClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredDeviceClassInformer]).
 func NewFilteredDeviceClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredDeviceClassInformer constructs a new informer for DeviceClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredDeviceClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers DeviceClassIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) DeviceClassIndexInformer {
+	return NewTypedDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewDeviceClassInformerWithOptions constructs a new informer for DeviceClass type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeviceClassInformerWithOptions]).
 func NewDeviceClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedDeviceClassInformerWithOptions(client, options)
+}
+
+// NewTypedDeviceClassInformerWithOptions constructs a new informer for DeviceClass type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeviceClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) DeviceClassIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1", Resource: "deviceclasss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.DeviceClass](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewDeviceClassInformerWithOptions(client kubernetes.Interface, options inte
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *deviceClassInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *deviceClassInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiresourcev1.DeviceClass{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *deviceClassInformer) TypedInformer() DeviceClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.DeviceClass](f.factory.InformerFor(&apiresourcev1.DeviceClass{}, f.defaultInformer))
 }
 
 func (f *deviceClassInformer) Lister() resourcev1.DeviceClassLister {
 	return resourcev1.NewDeviceClassLister(f.Informer().GetIndexer())
 }
+
+// ToTypedDeviceClassInformer converts an untyped informer into a TypedDeviceClassInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DeviceClass. If that is not the case, calling type-safe methods of the returned
+// TypedDeviceClassInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedDeviceClassInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedDeviceClassInformer(informer DeviceClassInformer) TypedDeviceClassInformer {
+	if informer, ok := informer.(TypedDeviceClassInformer); ok {
+		return informer
+	}
+	return &deviceClassTypedInformerAdapter{informer}
+}
+
+type deviceClassTypedInformerAdapter struct {
+	DeviceClassInformer
+}
+
+func (a *deviceClassTypedInformerAdapter) TypedInformer() DeviceClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.DeviceClass](a.Informer())
+}
+
+// ToDeviceClassIndexInformer converts an untyped informer into a DeviceClassIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DeviceClass. If that is not the case, calling type-safe methods of the returned
+// DeviceClassIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a DeviceClassIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToDeviceClassIndexInformer(informer cache.SharedIndexInformer) DeviceClassIndexInformer {
+	if informer, ok := informer.(DeviceClassIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.DeviceClass](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1/devicetaintrule.go b/vendor/k8s.io/client-go/informers/resource/v1/devicetaintrule.go
new file mode 100644
index 0000000000..c0776f5fb8
--- /dev/null
+++ b/vendor/k8s.io/client-go/informers/resource/v1/devicetaintrule.go
@@ -0,0 +1,207 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	apiresourcev1 "k8s.io/api/resource/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+	kubernetes "k8s.io/client-go/kubernetes"
+	resourcev1 "k8s.io/client-go/listers/resource/v1"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// DeviceTaintRuleInformer provides access to a shared informer and lister for
+// DeviceTaintRules. Prefer using the type-safe variant (see [TypedDeviceTaintRuleInformer]).
+type DeviceTaintRuleInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() resourcev1.DeviceTaintRuleLister
+}
+
+// TypedDeviceTaintRuleInformer provides access to a shared informer and lister for
+// DeviceTaintRules, including the type-safe TypedInformer variant.
+// It is a superset of DeviceTaintRuleInformer.
+type TypedDeviceTaintRuleInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() DeviceTaintRuleIndexInformer
+	Lister() resourcev1.DeviceTaintRuleLister
+}
+
+// DeviceTaintRuleIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type DeviceTaintRuleIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1.DeviceTaintRule]
+
+// DeviceTaintRuleHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for DeviceTaintRule.
+type DeviceTaintRuleHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1.DeviceTaintRule]
+
+// DeviceTaintRuleDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for DeviceTaintRule.
+type DeviceTaintRuleDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1.DeviceTaintRule]
+
+// DeviceTaintRuleFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for DeviceTaintRule.
+type DeviceTaintRuleFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1.DeviceTaintRule]
+
+// DeviceTaintRuleIndexers is a specialization of [cache.TypedIndexers] for DeviceTaintRule.
+type DeviceTaintRuleIndexers = cache.TypedIndexers[*apiresourcev1.DeviceTaintRule]
+
+// DeletedDeviceTaintRule is a specialization of [cache.DeletedObject] for DeviceTaintRule.
+type DeletedDeviceTaintRule = cache.DeletedObject[*apiresourcev1.DeviceTaintRule]
+
+type deviceTaintRuleInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// NewDeviceTaintRuleInformer constructs a new informer for DeviceTaintRule type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeviceTaintRuleInformer]).
+func NewDeviceTaintRuleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedDeviceTaintRuleInformer constructs a new informer for DeviceTaintRule type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeviceTaintRuleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers DeviceTaintRuleIndexers) DeviceTaintRuleIndexInformer {
+	return NewTypedDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredDeviceTaintRuleInformer constructs a new informer for DeviceTaintRule type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredDeviceTaintRuleInformer]).
+func NewFilteredDeviceTaintRuleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredDeviceTaintRuleInformer constructs a new informer for DeviceTaintRule type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredDeviceTaintRuleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers DeviceTaintRuleIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) DeviceTaintRuleIndexInformer {
+	return NewTypedDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewDeviceTaintRuleInformerWithOptions constructs a new informer for DeviceTaintRule type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeviceTaintRuleInformerWithOptions]).
+func NewDeviceTaintRuleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedDeviceTaintRuleInformerWithOptions(client, options)
+}
+
+// NewTypedDeviceTaintRuleInformerWithOptions constructs a new informer for DeviceTaintRule type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeviceTaintRuleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) DeviceTaintRuleIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1", Resource: "devicetaintrules"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.DeviceTaintRule](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ResourceV1().DeviceTaintRules().List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ResourceV1().DeviceTaintRules().Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ResourceV1().DeviceTaintRules().List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.ResourceV1().DeviceTaintRules().Watch(ctx, opts)
+			},
+		}, client),
+		&apiresourcev1.DeviceTaintRule{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *deviceTaintRuleInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *deviceTaintRuleInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *deviceTaintRuleInformer) TypedInformer() DeviceTaintRuleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.DeviceTaintRule](f.factory.InformerFor(&apiresourcev1.DeviceTaintRule{}, f.defaultInformer))
+}
+
+func (f *deviceTaintRuleInformer) Lister() resourcev1.DeviceTaintRuleLister {
+	return resourcev1.NewDeviceTaintRuleLister(f.Informer().GetIndexer())
+}
+
+// ToTypedDeviceTaintRuleInformer converts an untyped informer into a TypedDeviceTaintRuleInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DeviceTaintRule. If that is not the case, calling type-safe methods of the returned
+// TypedDeviceTaintRuleInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedDeviceTaintRuleInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedDeviceTaintRuleInformer(informer DeviceTaintRuleInformer) TypedDeviceTaintRuleInformer {
+	if informer, ok := informer.(TypedDeviceTaintRuleInformer); ok {
+		return informer
+	}
+	return &deviceTaintRuleTypedInformerAdapter{informer}
+}
+
+type deviceTaintRuleTypedInformerAdapter struct {
+	DeviceTaintRuleInformer
+}
+
+func (a *deviceTaintRuleTypedInformerAdapter) TypedInformer() DeviceTaintRuleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.DeviceTaintRule](a.Informer())
+}
+
+// ToDeviceTaintRuleIndexInformer converts an untyped informer into a DeviceTaintRuleIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DeviceTaintRule. If that is not the case, calling type-safe methods of the returned
+// DeviceTaintRuleIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a DeviceTaintRuleIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToDeviceTaintRuleIndexInformer(informer cache.SharedIndexInformer) DeviceTaintRuleIndexInformer {
+	if informer, ok := informer.(DeviceTaintRuleIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.DeviceTaintRule](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1/interface.go b/vendor/k8s.io/client-go/informers/resource/v1/interface.go
index 4b409fbba1..c0456078ff 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1/interface.go
@@ -25,13 +25,15 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// DeviceClasses returns a DeviceClassInformer.
-	DeviceClasses() DeviceClassInformer
+	DeviceClasses() TypedDeviceClassInformer
+	// DeviceTaintRules returns a DeviceTaintRuleInformer.
+	DeviceTaintRules() TypedDeviceTaintRuleInformer
 	// ResourceClaims returns a ResourceClaimInformer.
-	ResourceClaims() ResourceClaimInformer
+	ResourceClaims() TypedResourceClaimInformer
 	// ResourceClaimTemplates returns a ResourceClaimTemplateInformer.
-	ResourceClaimTemplates() ResourceClaimTemplateInformer
+	ResourceClaimTemplates() TypedResourceClaimTemplateInformer
 	// ResourceSlices returns a ResourceSliceInformer.
-	ResourceSlices() ResourceSliceInformer
+	ResourceSlices() TypedResourceSliceInformer
 }
 
 type version struct {
@@ -45,22 +47,27 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// DeviceClasses returns a DeviceClassInformer.
-func (v *version) DeviceClasses() DeviceClassInformer {
+// DeviceClasses returns a TypedDeviceClassInformer.
+func (v *version) DeviceClasses() TypedDeviceClassInformer {
 	return &deviceClassInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ResourceClaims returns a ResourceClaimInformer.
-func (v *version) ResourceClaims() ResourceClaimInformer {
+// DeviceTaintRules returns a TypedDeviceTaintRuleInformer.
+func (v *version) DeviceTaintRules() TypedDeviceTaintRuleInformer {
+	return &deviceTaintRuleInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ResourceClaims returns a TypedResourceClaimInformer.
+func (v *version) ResourceClaims() TypedResourceClaimInformer {
 	return &resourceClaimInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// ResourceClaimTemplates returns a ResourceClaimTemplateInformer.
-func (v *version) ResourceClaimTemplates() ResourceClaimTemplateInformer {
+// ResourceClaimTemplates returns a TypedResourceClaimTemplateInformer.
+func (v *version) ResourceClaimTemplates() TypedResourceClaimTemplateInformer {
 	return &resourceClaimTemplateInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// ResourceSlices returns a ResourceSliceInformer.
-func (v *version) ResourceSlices() ResourceSliceInformer {
+// ResourceSlices returns a TypedResourceSliceInformer.
+func (v *version) ResourceSlices() TypedResourceSliceInformer {
 	return &resourceSliceInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/resource/v1/resourceclaim.go b/vendor/k8s.io/client-go/informers/resource/v1/resourceclaim.go
index 996cc77f61..cd54867391 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1/resourceclaim.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1/resourceclaim.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ResourceClaimInformer provides access to a shared informer and lister for
-// ResourceClaims.
+// ResourceClaims. Prefer using the type-safe variant (see [TypedResourceClaimInformer]).
 type ResourceClaimInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() resourcev1.ResourceClaimLister
 }
 
+// TypedResourceClaimInformer provides access to a shared informer and lister for
+// ResourceClaims, including the type-safe TypedInformer variant.
+// It is a superset of ResourceClaimInformer.
+type TypedResourceClaimInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ResourceClaimIndexInformer
+	Lister() resourcev1.ResourceClaimLister
+}
+
+// ResourceClaimIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ResourceClaimIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1.ResourceClaim]
+
+// ResourceClaimHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ResourceClaim.
+type ResourceClaimHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1.ResourceClaim]
+
+// ResourceClaimDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ResourceClaim.
+type ResourceClaimDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1.ResourceClaim]
+
+// ResourceClaimFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ResourceClaim.
+type ResourceClaimFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1.ResourceClaim]
+
+// ResourceClaimIndexers is a specialization of [cache.TypedIndexers] for ResourceClaim.
+type ResourceClaimIndexers = cache.TypedIndexers[*apiresourcev1.ResourceClaim]
+
+// DeletedResourceClaim is a specialization of [cache.DeletedObject] for ResourceClaim.
+type DeletedResourceClaim = cache.DeletedObject[*apiresourcev1.ResourceClaim]
+
 type resourceClaimInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type resourceClaimInformer struct {
 // NewResourceClaimInformer constructs a new informer for ResourceClaim type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceClaimInformer]).
 func NewResourceClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewResourceClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedResourceClaimInformer constructs a new informer for ResourceClaim type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ResourceClaimIndexers) ResourceClaimIndexInformer {
+	return NewTypedResourceClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredResourceClaimInformer constructs a new informer for ResourceClaim type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredResourceClaimInformer]).
 func NewFilteredResourceClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewResourceClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedResourceClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredResourceClaimInformer constructs a new informer for ResourceClaim type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredResourceClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ResourceClaimIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ResourceClaimIndexInformer {
+	return NewTypedResourceClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewResourceClaimInformerWithOptions constructs a new informer for ResourceClaim type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceClaimInformerWithOptions]).
 func NewResourceClaimInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedResourceClaimInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedResourceClaimInformerWithOptions constructs a new informer for ResourceClaim type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceClaimInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ResourceClaimIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1", Resource: "resourceclaims"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.ResourceClaim](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewResourceClaimInformerWithOptions(client kubernetes.Interface, namespace
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *resourceClaimInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewResourceClaimInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedResourceClaimInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *resourceClaimInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiresourcev1.ResourceClaim{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *resourceClaimInformer) TypedInformer() ResourceClaimIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.ResourceClaim](f.factory.InformerFor(&apiresourcev1.ResourceClaim{}, f.defaultInformer))
 }
 
 func (f *resourceClaimInformer) Lister() resourcev1.ResourceClaimLister {
 	return resourcev1.NewResourceClaimLister(f.Informer().GetIndexer())
 }
+
+// ToTypedResourceClaimInformer converts an untyped informer into a TypedResourceClaimInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceClaim. If that is not the case, calling type-safe methods of the returned
+// TypedResourceClaimInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedResourceClaimInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedResourceClaimInformer(informer ResourceClaimInformer) TypedResourceClaimInformer {
+	if informer, ok := informer.(TypedResourceClaimInformer); ok {
+		return informer
+	}
+	return &resourceClaimTypedInformerAdapter{informer}
+}
+
+type resourceClaimTypedInformerAdapter struct {
+	ResourceClaimInformer
+}
+
+func (a *resourceClaimTypedInformerAdapter) TypedInformer() ResourceClaimIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.ResourceClaim](a.Informer())
+}
+
+// ToResourceClaimIndexInformer converts an untyped informer into a ResourceClaimIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceClaim. If that is not the case, calling type-safe methods of the returned
+// ResourceClaimIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ResourceClaimIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToResourceClaimIndexInformer(informer cache.SharedIndexInformer) ResourceClaimIndexInformer {
+	if informer, ok := informer.(ResourceClaimIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.ResourceClaim](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1/resourceclaimtemplate.go b/vendor/k8s.io/client-go/informers/resource/v1/resourceclaimtemplate.go
index e562314dc1..9e2925ec27 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1/resourceclaimtemplate.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1/resourceclaimtemplate.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ResourceClaimTemplateInformer provides access to a shared informer and lister for
-// ResourceClaimTemplates.
+// ResourceClaimTemplates. Prefer using the type-safe variant (see [TypedResourceClaimTemplateInformer]).
 type ResourceClaimTemplateInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() resourcev1.ResourceClaimTemplateLister
 }
 
+// TypedResourceClaimTemplateInformer provides access to a shared informer and lister for
+// ResourceClaimTemplates, including the type-safe TypedInformer variant.
+// It is a superset of ResourceClaimTemplateInformer.
+type TypedResourceClaimTemplateInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ResourceClaimTemplateIndexInformer
+	Lister() resourcev1.ResourceClaimTemplateLister
+}
+
+// ResourceClaimTemplateIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ResourceClaimTemplateIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1.ResourceClaimTemplate]
+
+// ResourceClaimTemplateHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ResourceClaimTemplate.
+type ResourceClaimTemplateHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1.ResourceClaimTemplate]
+
+// ResourceClaimTemplateDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ResourceClaimTemplate.
+type ResourceClaimTemplateDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1.ResourceClaimTemplate]
+
+// ResourceClaimTemplateFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ResourceClaimTemplate.
+type ResourceClaimTemplateFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1.ResourceClaimTemplate]
+
+// ResourceClaimTemplateIndexers is a specialization of [cache.TypedIndexers] for ResourceClaimTemplate.
+type ResourceClaimTemplateIndexers = cache.TypedIndexers[*apiresourcev1.ResourceClaimTemplate]
+
+// DeletedResourceClaimTemplate is a specialization of [cache.DeletedObject] for ResourceClaimTemplate.
+type DeletedResourceClaimTemplate = cache.DeletedObject[*apiresourcev1.ResourceClaimTemplate]
+
 type resourceClaimTemplateInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type resourceClaimTemplateInformer struct {
 // NewResourceClaimTemplateInformer constructs a new informer for ResourceClaimTemplate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceClaimTemplateInformer]).
 func NewResourceClaimTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewResourceClaimTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedResourceClaimTemplateInformer constructs a new informer for ResourceClaimTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceClaimTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ResourceClaimTemplateIndexers) ResourceClaimTemplateIndexInformer {
+	return NewTypedResourceClaimTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredResourceClaimTemplateInformer constructs a new informer for ResourceClaimTemplate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredResourceClaimTemplateInformer]).
 func NewFilteredResourceClaimTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewResourceClaimTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedResourceClaimTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredResourceClaimTemplateInformer constructs a new informer for ResourceClaimTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredResourceClaimTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ResourceClaimTemplateIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ResourceClaimTemplateIndexInformer {
+	return NewTypedResourceClaimTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewResourceClaimTemplateInformerWithOptions constructs a new informer for ResourceClaimTemplate type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceClaimTemplateInformerWithOptions]).
 func NewResourceClaimTemplateInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedResourceClaimTemplateInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedResourceClaimTemplateInformerWithOptions constructs a new informer for ResourceClaimTemplate type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceClaimTemplateInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ResourceClaimTemplateIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1", Resource: "resourceclaimtemplates"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.ResourceClaimTemplate](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewResourceClaimTemplateInformerWithOptions(client kubernetes.Interface, na
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *resourceClaimTemplateInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewResourceClaimTemplateInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedResourceClaimTemplateInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *resourceClaimTemplateInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiresourcev1.ResourceClaimTemplate{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *resourceClaimTemplateInformer) TypedInformer() ResourceClaimTemplateIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.ResourceClaimTemplate](f.factory.InformerFor(&apiresourcev1.ResourceClaimTemplate{}, f.defaultInformer))
 }
 
 func (f *resourceClaimTemplateInformer) Lister() resourcev1.ResourceClaimTemplateLister {
 	return resourcev1.NewResourceClaimTemplateLister(f.Informer().GetIndexer())
 }
+
+// ToTypedResourceClaimTemplateInformer converts an untyped informer into a TypedResourceClaimTemplateInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceClaimTemplate. If that is not the case, calling type-safe methods of the returned
+// TypedResourceClaimTemplateInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedResourceClaimTemplateInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedResourceClaimTemplateInformer(informer ResourceClaimTemplateInformer) TypedResourceClaimTemplateInformer {
+	if informer, ok := informer.(TypedResourceClaimTemplateInformer); ok {
+		return informer
+	}
+	return &resourceClaimTemplateTypedInformerAdapter{informer}
+}
+
+type resourceClaimTemplateTypedInformerAdapter struct {
+	ResourceClaimTemplateInformer
+}
+
+func (a *resourceClaimTemplateTypedInformerAdapter) TypedInformer() ResourceClaimTemplateIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.ResourceClaimTemplate](a.Informer())
+}
+
+// ToResourceClaimTemplateIndexInformer converts an untyped informer into a ResourceClaimTemplateIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceClaimTemplate. If that is not the case, calling type-safe methods of the returned
+// ResourceClaimTemplateIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ResourceClaimTemplateIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToResourceClaimTemplateIndexInformer(informer cache.SharedIndexInformer) ResourceClaimTemplateIndexInformer {
+	if informer, ok := informer.(ResourceClaimTemplateIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.ResourceClaimTemplate](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1/resourceslice.go b/vendor/k8s.io/client-go/informers/resource/v1/resourceslice.go
index 85c877f803..b03bc1b723 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1/resourceslice.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1/resourceslice.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ResourceSliceInformer provides access to a shared informer and lister for
-// ResourceSlices.
+// ResourceSlices. Prefer using the type-safe variant (see [TypedResourceSliceInformer]).
 type ResourceSliceInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() resourcev1.ResourceSliceLister
 }
 
+// TypedResourceSliceInformer provides access to a shared informer and lister for
+// ResourceSlices, including the type-safe TypedInformer variant.
+// It is a superset of ResourceSliceInformer.
+type TypedResourceSliceInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ResourceSliceIndexInformer
+	Lister() resourcev1.ResourceSliceLister
+}
+
+// ResourceSliceIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ResourceSliceIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1.ResourceSlice]
+
+// ResourceSliceHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ResourceSlice.
+type ResourceSliceHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1.ResourceSlice]
+
+// ResourceSliceDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ResourceSlice.
+type ResourceSliceDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1.ResourceSlice]
+
+// ResourceSliceFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ResourceSlice.
+type ResourceSliceFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1.ResourceSlice]
+
+// ResourceSliceIndexers is a specialization of [cache.TypedIndexers] for ResourceSlice.
+type ResourceSliceIndexers = cache.TypedIndexers[*apiresourcev1.ResourceSlice]
+
+// DeletedResourceSlice is a specialization of [cache.DeletedObject] for ResourceSlice.
+type DeletedResourceSlice = cache.DeletedObject[*apiresourcev1.ResourceSlice]
+
 type resourceSliceInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type resourceSliceInformer struct {
 // NewResourceSliceInformer constructs a new informer for ResourceSlice type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceSliceInformer]).
 func NewResourceSliceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedResourceSliceInformer constructs a new informer for ResourceSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceSliceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ResourceSliceIndexers) ResourceSliceIndexInformer {
+	return NewTypedResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredResourceSliceInformer constructs a new informer for ResourceSlice type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredResourceSliceInformer]).
 func NewFilteredResourceSliceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredResourceSliceInformer constructs a new informer for ResourceSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredResourceSliceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ResourceSliceIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ResourceSliceIndexInformer {
+	return NewTypedResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewResourceSliceInformerWithOptions constructs a new informer for ResourceSlice type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceSliceInformerWithOptions]).
 func NewResourceSliceInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedResourceSliceInformerWithOptions(client, options)
+}
+
+// NewTypedResourceSliceInformerWithOptions constructs a new informer for ResourceSlice type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceSliceInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ResourceSliceIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1", Resource: "resourceslices"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.ResourceSlice](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewResourceSliceInformerWithOptions(client kubernetes.Interface, options in
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *resourceSliceInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *resourceSliceInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiresourcev1.ResourceSlice{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *resourceSliceInformer) TypedInformer() ResourceSliceIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.ResourceSlice](f.factory.InformerFor(&apiresourcev1.ResourceSlice{}, f.defaultInformer))
 }
 
 func (f *resourceSliceInformer) Lister() resourcev1.ResourceSliceLister {
 	return resourcev1.NewResourceSliceLister(f.Informer().GetIndexer())
 }
+
+// ToTypedResourceSliceInformer converts an untyped informer into a TypedResourceSliceInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceSlice. If that is not the case, calling type-safe methods of the returned
+// TypedResourceSliceInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedResourceSliceInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedResourceSliceInformer(informer ResourceSliceInformer) TypedResourceSliceInformer {
+	if informer, ok := informer.(TypedResourceSliceInformer); ok {
+		return informer
+	}
+	return &resourceSliceTypedInformerAdapter{informer}
+}
+
+type resourceSliceTypedInformerAdapter struct {
+	ResourceSliceInformer
+}
+
+func (a *resourceSliceTypedInformerAdapter) TypedInformer() ResourceSliceIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.ResourceSlice](a.Informer())
+}
+
+// ToResourceSliceIndexInformer converts an untyped informer into a ResourceSliceIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceSlice. If that is not the case, calling type-safe methods of the returned
+// ResourceSliceIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ResourceSliceIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToResourceSliceIndexInformer(informer cache.SharedIndexInformer) ResourceSliceIndexInformer {
+	if informer, ok := informer.(ResourceSliceIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1.ResourceSlice](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1alpha3/devicetaintrule.go b/vendor/k8s.io/client-go/informers/resource/v1alpha3/devicetaintrule.go
index 0b0029ab54..a8775bd885 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1alpha3/devicetaintrule.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1alpha3/devicetaintrule.go
@@ -34,12 +34,40 @@ import (
 )
 
 // DeviceTaintRuleInformer provides access to a shared informer and lister for
-// DeviceTaintRules.
+// DeviceTaintRules. Prefer using the type-safe variant (see [TypedDeviceTaintRuleInformer]).
 type DeviceTaintRuleInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() resourcev1alpha3.DeviceTaintRuleLister
 }
 
+// TypedDeviceTaintRuleInformer provides access to a shared informer and lister for
+// DeviceTaintRules, including the type-safe TypedInformer variant.
+// It is a superset of DeviceTaintRuleInformer.
+type TypedDeviceTaintRuleInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() DeviceTaintRuleIndexInformer
+	Lister() resourcev1alpha3.DeviceTaintRuleLister
+}
+
+// DeviceTaintRuleIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type DeviceTaintRuleIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1alpha3.DeviceTaintRule]
+
+// DeviceTaintRuleHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for DeviceTaintRule.
+type DeviceTaintRuleHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1alpha3.DeviceTaintRule]
+
+// DeviceTaintRuleDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for DeviceTaintRule.
+type DeviceTaintRuleDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1alpha3.DeviceTaintRule]
+
+// DeviceTaintRuleFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for DeviceTaintRule.
+type DeviceTaintRuleFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1alpha3.DeviceTaintRule]
+
+// DeviceTaintRuleIndexers is a specialization of [cache.TypedIndexers] for DeviceTaintRule.
+type DeviceTaintRuleIndexers = cache.TypedIndexers[*apiresourcev1alpha3.DeviceTaintRule]
+
+// DeletedDeviceTaintRule is a specialization of [cache.DeletedObject] for DeviceTaintRule.
+type DeletedDeviceTaintRule = cache.DeletedObject[*apiresourcev1alpha3.DeviceTaintRule]
+
 type deviceTaintRuleInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type deviceTaintRuleInformer struct {
 // NewDeviceTaintRuleInformer constructs a new informer for DeviceTaintRule type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeviceTaintRuleInformer]).
 func NewDeviceTaintRuleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedDeviceTaintRuleInformer constructs a new informer for DeviceTaintRule type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeviceTaintRuleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers DeviceTaintRuleIndexers) DeviceTaintRuleIndexInformer {
+	return NewTypedDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredDeviceTaintRuleInformer constructs a new informer for DeviceTaintRule type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredDeviceTaintRuleInformer]).
 func NewFilteredDeviceTaintRuleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredDeviceTaintRuleInformer constructs a new informer for DeviceTaintRule type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredDeviceTaintRuleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers DeviceTaintRuleIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) DeviceTaintRuleIndexInformer {
+	return NewTypedDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewDeviceTaintRuleInformerWithOptions constructs a new informer for DeviceTaintRule type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeviceTaintRuleInformerWithOptions]).
 func NewDeviceTaintRuleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedDeviceTaintRuleInformerWithOptions(client, options)
+}
+
+// NewTypedDeviceTaintRuleInformerWithOptions constructs a new informer for DeviceTaintRule type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeviceTaintRuleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) DeviceTaintRuleIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1alpha3", Resource: "devicetaintrules"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1alpha3.DeviceTaintRule](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewDeviceTaintRuleInformerWithOptions(client kubernetes.Interface, options
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *deviceTaintRuleInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *deviceTaintRuleInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiresourcev1alpha3.DeviceTaintRule{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *deviceTaintRuleInformer) TypedInformer() DeviceTaintRuleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1alpha3.DeviceTaintRule](f.factory.InformerFor(&apiresourcev1alpha3.DeviceTaintRule{}, f.defaultInformer))
 }
 
 func (f *deviceTaintRuleInformer) Lister() resourcev1alpha3.DeviceTaintRuleLister {
 	return resourcev1alpha3.NewDeviceTaintRuleLister(f.Informer().GetIndexer())
 }
+
+// ToTypedDeviceTaintRuleInformer converts an untyped informer into a TypedDeviceTaintRuleInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DeviceTaintRule. If that is not the case, calling type-safe methods of the returned
+// TypedDeviceTaintRuleInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedDeviceTaintRuleInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedDeviceTaintRuleInformer(informer DeviceTaintRuleInformer) TypedDeviceTaintRuleInformer {
+	if informer, ok := informer.(TypedDeviceTaintRuleInformer); ok {
+		return informer
+	}
+	return &deviceTaintRuleTypedInformerAdapter{informer}
+}
+
+type deviceTaintRuleTypedInformerAdapter struct {
+	DeviceTaintRuleInformer
+}
+
+func (a *deviceTaintRuleTypedInformerAdapter) TypedInformer() DeviceTaintRuleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1alpha3.DeviceTaintRule](a.Informer())
+}
+
+// ToDeviceTaintRuleIndexInformer converts an untyped informer into a DeviceTaintRuleIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DeviceTaintRule. If that is not the case, calling type-safe methods of the returned
+// DeviceTaintRuleIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a DeviceTaintRuleIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToDeviceTaintRuleIndexInformer(informer cache.SharedIndexInformer) DeviceTaintRuleIndexInformer {
+	if informer, ok := informer.(DeviceTaintRuleIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1alpha3.DeviceTaintRule](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1alpha3/interface.go b/vendor/k8s.io/client-go/informers/resource/v1alpha3/interface.go
index b305681236..46bdb3b162 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1alpha3/interface.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1alpha3/interface.go
@@ -25,9 +25,9 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// DeviceTaintRules returns a DeviceTaintRuleInformer.
-	DeviceTaintRules() DeviceTaintRuleInformer
+	DeviceTaintRules() TypedDeviceTaintRuleInformer
 	// ResourcePoolStatusRequests returns a ResourcePoolStatusRequestInformer.
-	ResourcePoolStatusRequests() ResourcePoolStatusRequestInformer
+	ResourcePoolStatusRequests() TypedResourcePoolStatusRequestInformer
 }
 
 type version struct {
@@ -41,12 +41,12 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// DeviceTaintRules returns a DeviceTaintRuleInformer.
-func (v *version) DeviceTaintRules() DeviceTaintRuleInformer {
+// DeviceTaintRules returns a TypedDeviceTaintRuleInformer.
+func (v *version) DeviceTaintRules() TypedDeviceTaintRuleInformer {
 	return &deviceTaintRuleInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ResourcePoolStatusRequests returns a ResourcePoolStatusRequestInformer.
-func (v *version) ResourcePoolStatusRequests() ResourcePoolStatusRequestInformer {
+// ResourcePoolStatusRequests returns a TypedResourcePoolStatusRequestInformer.
+func (v *version) ResourcePoolStatusRequests() TypedResourcePoolStatusRequestInformer {
 	return &resourcePoolStatusRequestInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/resource/v1alpha3/resourcepoolstatusrequest.go b/vendor/k8s.io/client-go/informers/resource/v1alpha3/resourcepoolstatusrequest.go
index f34d57e138..87842dfbeb 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1alpha3/resourcepoolstatusrequest.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1alpha3/resourcepoolstatusrequest.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ResourcePoolStatusRequestInformer provides access to a shared informer and lister for
-// ResourcePoolStatusRequests.
+// ResourcePoolStatusRequests. Prefer using the type-safe variant (see [TypedResourcePoolStatusRequestInformer]).
 type ResourcePoolStatusRequestInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() resourcev1alpha3.ResourcePoolStatusRequestLister
 }
 
+// TypedResourcePoolStatusRequestInformer provides access to a shared informer and lister for
+// ResourcePoolStatusRequests, including the type-safe TypedInformer variant.
+// It is a superset of ResourcePoolStatusRequestInformer.
+type TypedResourcePoolStatusRequestInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ResourcePoolStatusRequestIndexInformer
+	Lister() resourcev1alpha3.ResourcePoolStatusRequestLister
+}
+
+// ResourcePoolStatusRequestIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ResourcePoolStatusRequestIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1alpha3.ResourcePoolStatusRequest]
+
+// ResourcePoolStatusRequestHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ResourcePoolStatusRequest.
+type ResourcePoolStatusRequestHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1alpha3.ResourcePoolStatusRequest]
+
+// ResourcePoolStatusRequestDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ResourcePoolStatusRequest.
+type ResourcePoolStatusRequestDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1alpha3.ResourcePoolStatusRequest]
+
+// ResourcePoolStatusRequestFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ResourcePoolStatusRequest.
+type ResourcePoolStatusRequestFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1alpha3.ResourcePoolStatusRequest]
+
+// ResourcePoolStatusRequestIndexers is a specialization of [cache.TypedIndexers] for ResourcePoolStatusRequest.
+type ResourcePoolStatusRequestIndexers = cache.TypedIndexers[*apiresourcev1alpha3.ResourcePoolStatusRequest]
+
+// DeletedResourcePoolStatusRequest is a specialization of [cache.DeletedObject] for ResourcePoolStatusRequest.
+type DeletedResourcePoolStatusRequest = cache.DeletedObject[*apiresourcev1alpha3.ResourcePoolStatusRequest]
+
 type resourcePoolStatusRequestInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type resourcePoolStatusRequestInformer struct {
 // NewResourcePoolStatusRequestInformer constructs a new informer for ResourcePoolStatusRequest type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourcePoolStatusRequestInformer]).
 func NewResourcePoolStatusRequestInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewResourcePoolStatusRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedResourcePoolStatusRequestInformer constructs a new informer for ResourcePoolStatusRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourcePoolStatusRequestInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ResourcePoolStatusRequestIndexers) ResourcePoolStatusRequestIndexInformer {
+	return NewTypedResourcePoolStatusRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredResourcePoolStatusRequestInformer constructs a new informer for ResourcePoolStatusRequest type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredResourcePoolStatusRequestInformer]).
 func NewFilteredResourcePoolStatusRequestInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewResourcePoolStatusRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedResourcePoolStatusRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredResourcePoolStatusRequestInformer constructs a new informer for ResourcePoolStatusRequest type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredResourcePoolStatusRequestInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ResourcePoolStatusRequestIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ResourcePoolStatusRequestIndexInformer {
+	return NewTypedResourcePoolStatusRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewResourcePoolStatusRequestInformerWithOptions constructs a new informer for ResourcePoolStatusRequest type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourcePoolStatusRequestInformerWithOptions]).
 func NewResourcePoolStatusRequestInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedResourcePoolStatusRequestInformerWithOptions(client, options)
+}
+
+// NewTypedResourcePoolStatusRequestInformerWithOptions constructs a new informer for ResourcePoolStatusRequest type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourcePoolStatusRequestInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ResourcePoolStatusRequestIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1alpha3", Resource: "resourcepoolstatusrequests"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1alpha3.ResourcePoolStatusRequest](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewResourcePoolStatusRequestInformerWithOptions(client kubernetes.Interface
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *resourcePoolStatusRequestInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewResourcePoolStatusRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedResourcePoolStatusRequestInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *resourcePoolStatusRequestInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiresourcev1alpha3.ResourcePoolStatusRequest{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *resourcePoolStatusRequestInformer) TypedInformer() ResourcePoolStatusRequestIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1alpha3.ResourcePoolStatusRequest](f.factory.InformerFor(&apiresourcev1alpha3.ResourcePoolStatusRequest{}, f.defaultInformer))
 }
 
 func (f *resourcePoolStatusRequestInformer) Lister() resourcev1alpha3.ResourcePoolStatusRequestLister {
 	return resourcev1alpha3.NewResourcePoolStatusRequestLister(f.Informer().GetIndexer())
 }
+
+// ToTypedResourcePoolStatusRequestInformer converts an untyped informer into a TypedResourcePoolStatusRequestInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourcePoolStatusRequest. If that is not the case, calling type-safe methods of the returned
+// TypedResourcePoolStatusRequestInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedResourcePoolStatusRequestInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedResourcePoolStatusRequestInformer(informer ResourcePoolStatusRequestInformer) TypedResourcePoolStatusRequestInformer {
+	if informer, ok := informer.(TypedResourcePoolStatusRequestInformer); ok {
+		return informer
+	}
+	return &resourcePoolStatusRequestTypedInformerAdapter{informer}
+}
+
+type resourcePoolStatusRequestTypedInformerAdapter struct {
+	ResourcePoolStatusRequestInformer
+}
+
+func (a *resourcePoolStatusRequestTypedInformerAdapter) TypedInformer() ResourcePoolStatusRequestIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1alpha3.ResourcePoolStatusRequest](a.Informer())
+}
+
+// ToResourcePoolStatusRequestIndexInformer converts an untyped informer into a ResourcePoolStatusRequestIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourcePoolStatusRequest. If that is not the case, calling type-safe methods of the returned
+// ResourcePoolStatusRequestIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ResourcePoolStatusRequestIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToResourcePoolStatusRequestIndexInformer(informer cache.SharedIndexInformer) ResourcePoolStatusRequestIndexInformer {
+	if informer, ok := informer.(ResourcePoolStatusRequestIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1alpha3.ResourcePoolStatusRequest](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1beta1/deviceclass.go b/vendor/k8s.io/client-go/informers/resource/v1beta1/deviceclass.go
index 0a4d4bea64..bbc371bd27 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1beta1/deviceclass.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1beta1/deviceclass.go
@@ -34,12 +34,40 @@ import (
 )
 
 // DeviceClassInformer provides access to a shared informer and lister for
-// DeviceClasses.
+// DeviceClasses. Prefer using the type-safe variant (see [TypedDeviceClassInformer]).
 type DeviceClassInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() resourcev1beta1.DeviceClassLister
 }
 
+// TypedDeviceClassInformer provides access to a shared informer and lister for
+// DeviceClasses, including the type-safe TypedInformer variant.
+// It is a superset of DeviceClassInformer.
+type TypedDeviceClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() DeviceClassIndexInformer
+	Lister() resourcev1beta1.DeviceClassLister
+}
+
+// DeviceClassIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type DeviceClassIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1beta1.DeviceClass]
+
+// DeviceClassHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for DeviceClass.
+type DeviceClassHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1beta1.DeviceClass]
+
+// DeviceClassDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for DeviceClass.
+type DeviceClassDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1beta1.DeviceClass]
+
+// DeviceClassFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for DeviceClass.
+type DeviceClassFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1beta1.DeviceClass]
+
+// DeviceClassIndexers is a specialization of [cache.TypedIndexers] for DeviceClass.
+type DeviceClassIndexers = cache.TypedIndexers[*apiresourcev1beta1.DeviceClass]
+
+// DeletedDeviceClass is a specialization of [cache.DeletedObject] for DeviceClass.
+type DeletedDeviceClass = cache.DeletedObject[*apiresourcev1beta1.DeviceClass]
+
 type deviceClassInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type deviceClassInformer struct {
 // NewDeviceClassInformer constructs a new informer for DeviceClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeviceClassInformer]).
 func NewDeviceClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedDeviceClassInformer constructs a new informer for DeviceClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeviceClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers DeviceClassIndexers) DeviceClassIndexInformer {
+	return NewTypedDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredDeviceClassInformer constructs a new informer for DeviceClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredDeviceClassInformer]).
 func NewFilteredDeviceClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredDeviceClassInformer constructs a new informer for DeviceClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredDeviceClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers DeviceClassIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) DeviceClassIndexInformer {
+	return NewTypedDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewDeviceClassInformerWithOptions constructs a new informer for DeviceClass type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeviceClassInformerWithOptions]).
 func NewDeviceClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedDeviceClassInformerWithOptions(client, options)
+}
+
+// NewTypedDeviceClassInformerWithOptions constructs a new informer for DeviceClass type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeviceClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) DeviceClassIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1beta1", Resource: "deviceclasss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.DeviceClass](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewDeviceClassInformerWithOptions(client kubernetes.Interface, options inte
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *deviceClassInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *deviceClassInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiresourcev1beta1.DeviceClass{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *deviceClassInformer) TypedInformer() DeviceClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.DeviceClass](f.factory.InformerFor(&apiresourcev1beta1.DeviceClass{}, f.defaultInformer))
 }
 
 func (f *deviceClassInformer) Lister() resourcev1beta1.DeviceClassLister {
 	return resourcev1beta1.NewDeviceClassLister(f.Informer().GetIndexer())
 }
+
+// ToTypedDeviceClassInformer converts an untyped informer into a TypedDeviceClassInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DeviceClass. If that is not the case, calling type-safe methods of the returned
+// TypedDeviceClassInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedDeviceClassInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedDeviceClassInformer(informer DeviceClassInformer) TypedDeviceClassInformer {
+	if informer, ok := informer.(TypedDeviceClassInformer); ok {
+		return informer
+	}
+	return &deviceClassTypedInformerAdapter{informer}
+}
+
+type deviceClassTypedInformerAdapter struct {
+	DeviceClassInformer
+}
+
+func (a *deviceClassTypedInformerAdapter) TypedInformer() DeviceClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.DeviceClass](a.Informer())
+}
+
+// ToDeviceClassIndexInformer converts an untyped informer into a DeviceClassIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DeviceClass. If that is not the case, calling type-safe methods of the returned
+// DeviceClassIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a DeviceClassIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToDeviceClassIndexInformer(informer cache.SharedIndexInformer) DeviceClassIndexInformer {
+	if informer, ok := informer.(DeviceClassIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.DeviceClass](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/resource/v1beta1/interface.go
index 07330763ba..6cddfa8f42 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1beta1/interface.go
@@ -25,13 +25,13 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// DeviceClasses returns a DeviceClassInformer.
-	DeviceClasses() DeviceClassInformer
+	DeviceClasses() TypedDeviceClassInformer
 	// ResourceClaims returns a ResourceClaimInformer.
-	ResourceClaims() ResourceClaimInformer
+	ResourceClaims() TypedResourceClaimInformer
 	// ResourceClaimTemplates returns a ResourceClaimTemplateInformer.
-	ResourceClaimTemplates() ResourceClaimTemplateInformer
+	ResourceClaimTemplates() TypedResourceClaimTemplateInformer
 	// ResourceSlices returns a ResourceSliceInformer.
-	ResourceSlices() ResourceSliceInformer
+	ResourceSlices() TypedResourceSliceInformer
 }
 
 type version struct {
@@ -45,22 +45,22 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// DeviceClasses returns a DeviceClassInformer.
-func (v *version) DeviceClasses() DeviceClassInformer {
+// DeviceClasses returns a TypedDeviceClassInformer.
+func (v *version) DeviceClasses() TypedDeviceClassInformer {
 	return &deviceClassInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ResourceClaims returns a ResourceClaimInformer.
-func (v *version) ResourceClaims() ResourceClaimInformer {
+// ResourceClaims returns a TypedResourceClaimInformer.
+func (v *version) ResourceClaims() TypedResourceClaimInformer {
 	return &resourceClaimInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// ResourceClaimTemplates returns a ResourceClaimTemplateInformer.
-func (v *version) ResourceClaimTemplates() ResourceClaimTemplateInformer {
+// ResourceClaimTemplates returns a TypedResourceClaimTemplateInformer.
+func (v *version) ResourceClaimTemplates() TypedResourceClaimTemplateInformer {
 	return &resourceClaimTemplateInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// ResourceSlices returns a ResourceSliceInformer.
-func (v *version) ResourceSlices() ResourceSliceInformer {
+// ResourceSlices returns a TypedResourceSliceInformer.
+func (v *version) ResourceSlices() TypedResourceSliceInformer {
 	return &resourceSliceInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/resource/v1beta1/resourceclaim.go b/vendor/k8s.io/client-go/informers/resource/v1beta1/resourceclaim.go
index 9ec1ece317..31f1dec80a 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1beta1/resourceclaim.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1beta1/resourceclaim.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ResourceClaimInformer provides access to a shared informer and lister for
-// ResourceClaims.
+// ResourceClaims. Prefer using the type-safe variant (see [TypedResourceClaimInformer]).
 type ResourceClaimInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() resourcev1beta1.ResourceClaimLister
 }
 
+// TypedResourceClaimInformer provides access to a shared informer and lister for
+// ResourceClaims, including the type-safe TypedInformer variant.
+// It is a superset of ResourceClaimInformer.
+type TypedResourceClaimInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ResourceClaimIndexInformer
+	Lister() resourcev1beta1.ResourceClaimLister
+}
+
+// ResourceClaimIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ResourceClaimIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1beta1.ResourceClaim]
+
+// ResourceClaimHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ResourceClaim.
+type ResourceClaimHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1beta1.ResourceClaim]
+
+// ResourceClaimDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ResourceClaim.
+type ResourceClaimDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1beta1.ResourceClaim]
+
+// ResourceClaimFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ResourceClaim.
+type ResourceClaimFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1beta1.ResourceClaim]
+
+// ResourceClaimIndexers is a specialization of [cache.TypedIndexers] for ResourceClaim.
+type ResourceClaimIndexers = cache.TypedIndexers[*apiresourcev1beta1.ResourceClaim]
+
+// DeletedResourceClaim is a specialization of [cache.DeletedObject] for ResourceClaim.
+type DeletedResourceClaim = cache.DeletedObject[*apiresourcev1beta1.ResourceClaim]
+
 type resourceClaimInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type resourceClaimInformer struct {
 // NewResourceClaimInformer constructs a new informer for ResourceClaim type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceClaimInformer]).
 func NewResourceClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewResourceClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedResourceClaimInformer constructs a new informer for ResourceClaim type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ResourceClaimIndexers) ResourceClaimIndexInformer {
+	return NewTypedResourceClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredResourceClaimInformer constructs a new informer for ResourceClaim type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredResourceClaimInformer]).
 func NewFilteredResourceClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewResourceClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedResourceClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredResourceClaimInformer constructs a new informer for ResourceClaim type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredResourceClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ResourceClaimIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ResourceClaimIndexInformer {
+	return NewTypedResourceClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewResourceClaimInformerWithOptions constructs a new informer for ResourceClaim type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceClaimInformerWithOptions]).
 func NewResourceClaimInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedResourceClaimInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedResourceClaimInformerWithOptions constructs a new informer for ResourceClaim type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceClaimInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ResourceClaimIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1beta1", Resource: "resourceclaims"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.ResourceClaim](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewResourceClaimInformerWithOptions(client kubernetes.Interface, namespace
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *resourceClaimInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewResourceClaimInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedResourceClaimInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *resourceClaimInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiresourcev1beta1.ResourceClaim{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *resourceClaimInformer) TypedInformer() ResourceClaimIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.ResourceClaim](f.factory.InformerFor(&apiresourcev1beta1.ResourceClaim{}, f.defaultInformer))
 }
 
 func (f *resourceClaimInformer) Lister() resourcev1beta1.ResourceClaimLister {
 	return resourcev1beta1.NewResourceClaimLister(f.Informer().GetIndexer())
 }
+
+// ToTypedResourceClaimInformer converts an untyped informer into a TypedResourceClaimInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceClaim. If that is not the case, calling type-safe methods of the returned
+// TypedResourceClaimInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedResourceClaimInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedResourceClaimInformer(informer ResourceClaimInformer) TypedResourceClaimInformer {
+	if informer, ok := informer.(TypedResourceClaimInformer); ok {
+		return informer
+	}
+	return &resourceClaimTypedInformerAdapter{informer}
+}
+
+type resourceClaimTypedInformerAdapter struct {
+	ResourceClaimInformer
+}
+
+func (a *resourceClaimTypedInformerAdapter) TypedInformer() ResourceClaimIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.ResourceClaim](a.Informer())
+}
+
+// ToResourceClaimIndexInformer converts an untyped informer into a ResourceClaimIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceClaim. If that is not the case, calling type-safe methods of the returned
+// ResourceClaimIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ResourceClaimIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToResourceClaimIndexInformer(informer cache.SharedIndexInformer) ResourceClaimIndexInformer {
+	if informer, ok := informer.(ResourceClaimIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.ResourceClaim](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1beta1/resourceclaimtemplate.go b/vendor/k8s.io/client-go/informers/resource/v1beta1/resourceclaimtemplate.go
index b6aa9cb919..ff00567105 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1beta1/resourceclaimtemplate.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1beta1/resourceclaimtemplate.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ResourceClaimTemplateInformer provides access to a shared informer and lister for
-// ResourceClaimTemplates.
+// ResourceClaimTemplates. Prefer using the type-safe variant (see [TypedResourceClaimTemplateInformer]).
 type ResourceClaimTemplateInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() resourcev1beta1.ResourceClaimTemplateLister
 }
 
+// TypedResourceClaimTemplateInformer provides access to a shared informer and lister for
+// ResourceClaimTemplates, including the type-safe TypedInformer variant.
+// It is a superset of ResourceClaimTemplateInformer.
+type TypedResourceClaimTemplateInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ResourceClaimTemplateIndexInformer
+	Lister() resourcev1beta1.ResourceClaimTemplateLister
+}
+
+// ResourceClaimTemplateIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ResourceClaimTemplateIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1beta1.ResourceClaimTemplate]
+
+// ResourceClaimTemplateHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ResourceClaimTemplate.
+type ResourceClaimTemplateHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1beta1.ResourceClaimTemplate]
+
+// ResourceClaimTemplateDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ResourceClaimTemplate.
+type ResourceClaimTemplateDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1beta1.ResourceClaimTemplate]
+
+// ResourceClaimTemplateFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ResourceClaimTemplate.
+type ResourceClaimTemplateFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1beta1.ResourceClaimTemplate]
+
+// ResourceClaimTemplateIndexers is a specialization of [cache.TypedIndexers] for ResourceClaimTemplate.
+type ResourceClaimTemplateIndexers = cache.TypedIndexers[*apiresourcev1beta1.ResourceClaimTemplate]
+
+// DeletedResourceClaimTemplate is a specialization of [cache.DeletedObject] for ResourceClaimTemplate.
+type DeletedResourceClaimTemplate = cache.DeletedObject[*apiresourcev1beta1.ResourceClaimTemplate]
+
 type resourceClaimTemplateInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type resourceClaimTemplateInformer struct {
 // NewResourceClaimTemplateInformer constructs a new informer for ResourceClaimTemplate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceClaimTemplateInformer]).
 func NewResourceClaimTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewResourceClaimTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedResourceClaimTemplateInformer constructs a new informer for ResourceClaimTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceClaimTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ResourceClaimTemplateIndexers) ResourceClaimTemplateIndexInformer {
+	return NewTypedResourceClaimTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredResourceClaimTemplateInformer constructs a new informer for ResourceClaimTemplate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredResourceClaimTemplateInformer]).
 func NewFilteredResourceClaimTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewResourceClaimTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedResourceClaimTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredResourceClaimTemplateInformer constructs a new informer for ResourceClaimTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredResourceClaimTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ResourceClaimTemplateIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ResourceClaimTemplateIndexInformer {
+	return NewTypedResourceClaimTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewResourceClaimTemplateInformerWithOptions constructs a new informer for ResourceClaimTemplate type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceClaimTemplateInformerWithOptions]).
 func NewResourceClaimTemplateInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedResourceClaimTemplateInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedResourceClaimTemplateInformerWithOptions constructs a new informer for ResourceClaimTemplate type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceClaimTemplateInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ResourceClaimTemplateIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1beta1", Resource: "resourceclaimtemplates"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.ResourceClaimTemplate](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewResourceClaimTemplateInformerWithOptions(client kubernetes.Interface, na
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *resourceClaimTemplateInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewResourceClaimTemplateInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedResourceClaimTemplateInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *resourceClaimTemplateInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiresourcev1beta1.ResourceClaimTemplate{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *resourceClaimTemplateInformer) TypedInformer() ResourceClaimTemplateIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.ResourceClaimTemplate](f.factory.InformerFor(&apiresourcev1beta1.ResourceClaimTemplate{}, f.defaultInformer))
 }
 
 func (f *resourceClaimTemplateInformer) Lister() resourcev1beta1.ResourceClaimTemplateLister {
 	return resourcev1beta1.NewResourceClaimTemplateLister(f.Informer().GetIndexer())
 }
+
+// ToTypedResourceClaimTemplateInformer converts an untyped informer into a TypedResourceClaimTemplateInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceClaimTemplate. If that is not the case, calling type-safe methods of the returned
+// TypedResourceClaimTemplateInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedResourceClaimTemplateInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedResourceClaimTemplateInformer(informer ResourceClaimTemplateInformer) TypedResourceClaimTemplateInformer {
+	if informer, ok := informer.(TypedResourceClaimTemplateInformer); ok {
+		return informer
+	}
+	return &resourceClaimTemplateTypedInformerAdapter{informer}
+}
+
+type resourceClaimTemplateTypedInformerAdapter struct {
+	ResourceClaimTemplateInformer
+}
+
+func (a *resourceClaimTemplateTypedInformerAdapter) TypedInformer() ResourceClaimTemplateIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.ResourceClaimTemplate](a.Informer())
+}
+
+// ToResourceClaimTemplateIndexInformer converts an untyped informer into a ResourceClaimTemplateIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceClaimTemplate. If that is not the case, calling type-safe methods of the returned
+// ResourceClaimTemplateIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ResourceClaimTemplateIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToResourceClaimTemplateIndexInformer(informer cache.SharedIndexInformer) ResourceClaimTemplateIndexInformer {
+	if informer, ok := informer.(ResourceClaimTemplateIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.ResourceClaimTemplate](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1beta1/resourceslice.go b/vendor/k8s.io/client-go/informers/resource/v1beta1/resourceslice.go
index 39e971aec2..72cc3062b1 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1beta1/resourceslice.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1beta1/resourceslice.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ResourceSliceInformer provides access to a shared informer and lister for
-// ResourceSlices.
+// ResourceSlices. Prefer using the type-safe variant (see [TypedResourceSliceInformer]).
 type ResourceSliceInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() resourcev1beta1.ResourceSliceLister
 }
 
+// TypedResourceSliceInformer provides access to a shared informer and lister for
+// ResourceSlices, including the type-safe TypedInformer variant.
+// It is a superset of ResourceSliceInformer.
+type TypedResourceSliceInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ResourceSliceIndexInformer
+	Lister() resourcev1beta1.ResourceSliceLister
+}
+
+// ResourceSliceIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ResourceSliceIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1beta1.ResourceSlice]
+
+// ResourceSliceHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ResourceSlice.
+type ResourceSliceHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1beta1.ResourceSlice]
+
+// ResourceSliceDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ResourceSlice.
+type ResourceSliceDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1beta1.ResourceSlice]
+
+// ResourceSliceFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ResourceSlice.
+type ResourceSliceFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1beta1.ResourceSlice]
+
+// ResourceSliceIndexers is a specialization of [cache.TypedIndexers] for ResourceSlice.
+type ResourceSliceIndexers = cache.TypedIndexers[*apiresourcev1beta1.ResourceSlice]
+
+// DeletedResourceSlice is a specialization of [cache.DeletedObject] for ResourceSlice.
+type DeletedResourceSlice = cache.DeletedObject[*apiresourcev1beta1.ResourceSlice]
+
 type resourceSliceInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type resourceSliceInformer struct {
 // NewResourceSliceInformer constructs a new informer for ResourceSlice type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceSliceInformer]).
 func NewResourceSliceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedResourceSliceInformer constructs a new informer for ResourceSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceSliceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ResourceSliceIndexers) ResourceSliceIndexInformer {
+	return NewTypedResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredResourceSliceInformer constructs a new informer for ResourceSlice type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredResourceSliceInformer]).
 func NewFilteredResourceSliceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredResourceSliceInformer constructs a new informer for ResourceSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredResourceSliceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ResourceSliceIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ResourceSliceIndexInformer {
+	return NewTypedResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewResourceSliceInformerWithOptions constructs a new informer for ResourceSlice type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceSliceInformerWithOptions]).
 func NewResourceSliceInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedResourceSliceInformerWithOptions(client, options)
+}
+
+// NewTypedResourceSliceInformerWithOptions constructs a new informer for ResourceSlice type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceSliceInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ResourceSliceIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1beta1", Resource: "resourceslices"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.ResourceSlice](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewResourceSliceInformerWithOptions(client kubernetes.Interface, options in
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *resourceSliceInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *resourceSliceInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiresourcev1beta1.ResourceSlice{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *resourceSliceInformer) TypedInformer() ResourceSliceIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.ResourceSlice](f.factory.InformerFor(&apiresourcev1beta1.ResourceSlice{}, f.defaultInformer))
 }
 
 func (f *resourceSliceInformer) Lister() resourcev1beta1.ResourceSliceLister {
 	return resourcev1beta1.NewResourceSliceLister(f.Informer().GetIndexer())
 }
+
+// ToTypedResourceSliceInformer converts an untyped informer into a TypedResourceSliceInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceSlice. If that is not the case, calling type-safe methods of the returned
+// TypedResourceSliceInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedResourceSliceInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedResourceSliceInformer(informer ResourceSliceInformer) TypedResourceSliceInformer {
+	if informer, ok := informer.(TypedResourceSliceInformer); ok {
+		return informer
+	}
+	return &resourceSliceTypedInformerAdapter{informer}
+}
+
+type resourceSliceTypedInformerAdapter struct {
+	ResourceSliceInformer
+}
+
+func (a *resourceSliceTypedInformerAdapter) TypedInformer() ResourceSliceIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.ResourceSlice](a.Informer())
+}
+
+// ToResourceSliceIndexInformer converts an untyped informer into a ResourceSliceIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceSlice. If that is not the case, calling type-safe methods of the returned
+// ResourceSliceIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ResourceSliceIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToResourceSliceIndexInformer(informer cache.SharedIndexInformer) ResourceSliceIndexInformer {
+	if informer, ok := informer.(ResourceSliceIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta1.ResourceSlice](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1beta2/deviceclass.go b/vendor/k8s.io/client-go/informers/resource/v1beta2/deviceclass.go
index d98b4d658e..7108cba10a 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1beta2/deviceclass.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1beta2/deviceclass.go
@@ -34,12 +34,40 @@ import (
 )
 
 // DeviceClassInformer provides access to a shared informer and lister for
-// DeviceClasses.
+// DeviceClasses. Prefer using the type-safe variant (see [TypedDeviceClassInformer]).
 type DeviceClassInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() resourcev1beta2.DeviceClassLister
 }
 
+// TypedDeviceClassInformer provides access to a shared informer and lister for
+// DeviceClasses, including the type-safe TypedInformer variant.
+// It is a superset of DeviceClassInformer.
+type TypedDeviceClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() DeviceClassIndexInformer
+	Lister() resourcev1beta2.DeviceClassLister
+}
+
+// DeviceClassIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type DeviceClassIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1beta2.DeviceClass]
+
+// DeviceClassHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for DeviceClass.
+type DeviceClassHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1beta2.DeviceClass]
+
+// DeviceClassDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for DeviceClass.
+type DeviceClassDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1beta2.DeviceClass]
+
+// DeviceClassFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for DeviceClass.
+type DeviceClassFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1beta2.DeviceClass]
+
+// DeviceClassIndexers is a specialization of [cache.TypedIndexers] for DeviceClass.
+type DeviceClassIndexers = cache.TypedIndexers[*apiresourcev1beta2.DeviceClass]
+
+// DeletedDeviceClass is a specialization of [cache.DeletedObject] for DeviceClass.
+type DeletedDeviceClass = cache.DeletedObject[*apiresourcev1beta2.DeviceClass]
+
 type deviceClassInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type deviceClassInformer struct {
 // NewDeviceClassInformer constructs a new informer for DeviceClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeviceClassInformer]).
 func NewDeviceClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedDeviceClassInformer constructs a new informer for DeviceClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeviceClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers DeviceClassIndexers) DeviceClassIndexInformer {
+	return NewTypedDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredDeviceClassInformer constructs a new informer for DeviceClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredDeviceClassInformer]).
 func NewFilteredDeviceClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredDeviceClassInformer constructs a new informer for DeviceClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredDeviceClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers DeviceClassIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) DeviceClassIndexInformer {
+	return NewTypedDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewDeviceClassInformerWithOptions constructs a new informer for DeviceClass type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeviceClassInformerWithOptions]).
 func NewDeviceClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedDeviceClassInformerWithOptions(client, options)
+}
+
+// NewTypedDeviceClassInformerWithOptions constructs a new informer for DeviceClass type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeviceClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) DeviceClassIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1beta2", Resource: "deviceclasss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.DeviceClass](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewDeviceClassInformerWithOptions(client kubernetes.Interface, options inte
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *deviceClassInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedDeviceClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *deviceClassInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiresourcev1beta2.DeviceClass{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *deviceClassInformer) TypedInformer() DeviceClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.DeviceClass](f.factory.InformerFor(&apiresourcev1beta2.DeviceClass{}, f.defaultInformer))
 }
 
 func (f *deviceClassInformer) Lister() resourcev1beta2.DeviceClassLister {
 	return resourcev1beta2.NewDeviceClassLister(f.Informer().GetIndexer())
 }
+
+// ToTypedDeviceClassInformer converts an untyped informer into a TypedDeviceClassInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DeviceClass. If that is not the case, calling type-safe methods of the returned
+// TypedDeviceClassInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedDeviceClassInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedDeviceClassInformer(informer DeviceClassInformer) TypedDeviceClassInformer {
+	if informer, ok := informer.(TypedDeviceClassInformer); ok {
+		return informer
+	}
+	return &deviceClassTypedInformerAdapter{informer}
+}
+
+type deviceClassTypedInformerAdapter struct {
+	DeviceClassInformer
+}
+
+func (a *deviceClassTypedInformerAdapter) TypedInformer() DeviceClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.DeviceClass](a.Informer())
+}
+
+// ToDeviceClassIndexInformer converts an untyped informer into a DeviceClassIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DeviceClass. If that is not the case, calling type-safe methods of the returned
+// DeviceClassIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a DeviceClassIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToDeviceClassIndexInformer(informer cache.SharedIndexInformer) DeviceClassIndexInformer {
+	if informer, ok := informer.(DeviceClassIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.DeviceClass](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1beta2/devicetaintrule.go b/vendor/k8s.io/client-go/informers/resource/v1beta2/devicetaintrule.go
index 328a9c3939..7bc04a161f 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1beta2/devicetaintrule.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1beta2/devicetaintrule.go
@@ -34,12 +34,40 @@ import (
 )
 
 // DeviceTaintRuleInformer provides access to a shared informer and lister for
-// DeviceTaintRules.
+// DeviceTaintRules. Prefer using the type-safe variant (see [TypedDeviceTaintRuleInformer]).
 type DeviceTaintRuleInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() resourcev1beta2.DeviceTaintRuleLister
 }
 
+// TypedDeviceTaintRuleInformer provides access to a shared informer and lister for
+// DeviceTaintRules, including the type-safe TypedInformer variant.
+// It is a superset of DeviceTaintRuleInformer.
+type TypedDeviceTaintRuleInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() DeviceTaintRuleIndexInformer
+	Lister() resourcev1beta2.DeviceTaintRuleLister
+}
+
+// DeviceTaintRuleIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type DeviceTaintRuleIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1beta2.DeviceTaintRule]
+
+// DeviceTaintRuleHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for DeviceTaintRule.
+type DeviceTaintRuleHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1beta2.DeviceTaintRule]
+
+// DeviceTaintRuleDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for DeviceTaintRule.
+type DeviceTaintRuleDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1beta2.DeviceTaintRule]
+
+// DeviceTaintRuleFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for DeviceTaintRule.
+type DeviceTaintRuleFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1beta2.DeviceTaintRule]
+
+// DeviceTaintRuleIndexers is a specialization of [cache.TypedIndexers] for DeviceTaintRule.
+type DeviceTaintRuleIndexers = cache.TypedIndexers[*apiresourcev1beta2.DeviceTaintRule]
+
+// DeletedDeviceTaintRule is a specialization of [cache.DeletedObject] for DeviceTaintRule.
+type DeletedDeviceTaintRule = cache.DeletedObject[*apiresourcev1beta2.DeviceTaintRule]
+
 type deviceTaintRuleInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type deviceTaintRuleInformer struct {
 // NewDeviceTaintRuleInformer constructs a new informer for DeviceTaintRule type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeviceTaintRuleInformer]).
 func NewDeviceTaintRuleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedDeviceTaintRuleInformer constructs a new informer for DeviceTaintRule type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeviceTaintRuleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers DeviceTaintRuleIndexers) DeviceTaintRuleIndexInformer {
+	return NewTypedDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredDeviceTaintRuleInformer constructs a new informer for DeviceTaintRule type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredDeviceTaintRuleInformer]).
 func NewFilteredDeviceTaintRuleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredDeviceTaintRuleInformer constructs a new informer for DeviceTaintRule type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredDeviceTaintRuleInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers DeviceTaintRuleIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) DeviceTaintRuleIndexInformer {
+	return NewTypedDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewDeviceTaintRuleInformerWithOptions constructs a new informer for DeviceTaintRule type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedDeviceTaintRuleInformerWithOptions]).
 func NewDeviceTaintRuleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedDeviceTaintRuleInformerWithOptions(client, options)
+}
+
+// NewTypedDeviceTaintRuleInformerWithOptions constructs a new informer for DeviceTaintRule type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedDeviceTaintRuleInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) DeviceTaintRuleIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1beta2", Resource: "devicetaintrules"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.DeviceTaintRule](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewDeviceTaintRuleInformerWithOptions(client kubernetes.Interface, options
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *deviceTaintRuleInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedDeviceTaintRuleInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *deviceTaintRuleInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiresourcev1beta2.DeviceTaintRule{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *deviceTaintRuleInformer) TypedInformer() DeviceTaintRuleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.DeviceTaintRule](f.factory.InformerFor(&apiresourcev1beta2.DeviceTaintRule{}, f.defaultInformer))
 }
 
 func (f *deviceTaintRuleInformer) Lister() resourcev1beta2.DeviceTaintRuleLister {
 	return resourcev1beta2.NewDeviceTaintRuleLister(f.Informer().GetIndexer())
 }
+
+// ToTypedDeviceTaintRuleInformer converts an untyped informer into a TypedDeviceTaintRuleInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DeviceTaintRule. If that is not the case, calling type-safe methods of the returned
+// TypedDeviceTaintRuleInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedDeviceTaintRuleInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedDeviceTaintRuleInformer(informer DeviceTaintRuleInformer) TypedDeviceTaintRuleInformer {
+	if informer, ok := informer.(TypedDeviceTaintRuleInformer); ok {
+		return informer
+	}
+	return &deviceTaintRuleTypedInformerAdapter{informer}
+}
+
+type deviceTaintRuleTypedInformerAdapter struct {
+	DeviceTaintRuleInformer
+}
+
+func (a *deviceTaintRuleTypedInformerAdapter) TypedInformer() DeviceTaintRuleIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.DeviceTaintRule](a.Informer())
+}
+
+// ToDeviceTaintRuleIndexInformer converts an untyped informer into a DeviceTaintRuleIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *DeviceTaintRule. If that is not the case, calling type-safe methods of the returned
+// DeviceTaintRuleIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a DeviceTaintRuleIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToDeviceTaintRuleIndexInformer(informer cache.SharedIndexInformer) DeviceTaintRuleIndexInformer {
+	if informer, ok := informer.(DeviceTaintRuleIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.DeviceTaintRule](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1beta2/interface.go b/vendor/k8s.io/client-go/informers/resource/v1beta2/interface.go
index a05e518e2e..29ac4b38f1 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1beta2/interface.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1beta2/interface.go
@@ -25,15 +25,15 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// DeviceClasses returns a DeviceClassInformer.
-	DeviceClasses() DeviceClassInformer
+	DeviceClasses() TypedDeviceClassInformer
 	// DeviceTaintRules returns a DeviceTaintRuleInformer.
-	DeviceTaintRules() DeviceTaintRuleInformer
+	DeviceTaintRules() TypedDeviceTaintRuleInformer
 	// ResourceClaims returns a ResourceClaimInformer.
-	ResourceClaims() ResourceClaimInformer
+	ResourceClaims() TypedResourceClaimInformer
 	// ResourceClaimTemplates returns a ResourceClaimTemplateInformer.
-	ResourceClaimTemplates() ResourceClaimTemplateInformer
+	ResourceClaimTemplates() TypedResourceClaimTemplateInformer
 	// ResourceSlices returns a ResourceSliceInformer.
-	ResourceSlices() ResourceSliceInformer
+	ResourceSlices() TypedResourceSliceInformer
 }
 
 type version struct {
@@ -47,27 +47,27 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// DeviceClasses returns a DeviceClassInformer.
-func (v *version) DeviceClasses() DeviceClassInformer {
+// DeviceClasses returns a TypedDeviceClassInformer.
+func (v *version) DeviceClasses() TypedDeviceClassInformer {
 	return &deviceClassInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// DeviceTaintRules returns a DeviceTaintRuleInformer.
-func (v *version) DeviceTaintRules() DeviceTaintRuleInformer {
+// DeviceTaintRules returns a TypedDeviceTaintRuleInformer.
+func (v *version) DeviceTaintRules() TypedDeviceTaintRuleInformer {
 	return &deviceTaintRuleInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ResourceClaims returns a ResourceClaimInformer.
-func (v *version) ResourceClaims() ResourceClaimInformer {
+// ResourceClaims returns a TypedResourceClaimInformer.
+func (v *version) ResourceClaims() TypedResourceClaimInformer {
 	return &resourceClaimInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// ResourceClaimTemplates returns a ResourceClaimTemplateInformer.
-func (v *version) ResourceClaimTemplates() ResourceClaimTemplateInformer {
+// ResourceClaimTemplates returns a TypedResourceClaimTemplateInformer.
+func (v *version) ResourceClaimTemplates() TypedResourceClaimTemplateInformer {
 	return &resourceClaimTemplateInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// ResourceSlices returns a ResourceSliceInformer.
-func (v *version) ResourceSlices() ResourceSliceInformer {
+// ResourceSlices returns a TypedResourceSliceInformer.
+func (v *version) ResourceSlices() TypedResourceSliceInformer {
 	return &resourceSliceInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/resource/v1beta2/resourceclaim.go b/vendor/k8s.io/client-go/informers/resource/v1beta2/resourceclaim.go
index 61dc6db17d..afea5d0d94 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1beta2/resourceclaim.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1beta2/resourceclaim.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ResourceClaimInformer provides access to a shared informer and lister for
-// ResourceClaims.
+// ResourceClaims. Prefer using the type-safe variant (see [TypedResourceClaimInformer]).
 type ResourceClaimInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() resourcev1beta2.ResourceClaimLister
 }
 
+// TypedResourceClaimInformer provides access to a shared informer and lister for
+// ResourceClaims, including the type-safe TypedInformer variant.
+// It is a superset of ResourceClaimInformer.
+type TypedResourceClaimInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ResourceClaimIndexInformer
+	Lister() resourcev1beta2.ResourceClaimLister
+}
+
+// ResourceClaimIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ResourceClaimIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1beta2.ResourceClaim]
+
+// ResourceClaimHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ResourceClaim.
+type ResourceClaimHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1beta2.ResourceClaim]
+
+// ResourceClaimDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ResourceClaim.
+type ResourceClaimDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1beta2.ResourceClaim]
+
+// ResourceClaimFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ResourceClaim.
+type ResourceClaimFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1beta2.ResourceClaim]
+
+// ResourceClaimIndexers is a specialization of [cache.TypedIndexers] for ResourceClaim.
+type ResourceClaimIndexers = cache.TypedIndexers[*apiresourcev1beta2.ResourceClaim]
+
+// DeletedResourceClaim is a specialization of [cache.DeletedObject] for ResourceClaim.
+type DeletedResourceClaim = cache.DeletedObject[*apiresourcev1beta2.ResourceClaim]
+
 type resourceClaimInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type resourceClaimInformer struct {
 // NewResourceClaimInformer constructs a new informer for ResourceClaim type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceClaimInformer]).
 func NewResourceClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewResourceClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedResourceClaimInformer constructs a new informer for ResourceClaim type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ResourceClaimIndexers) ResourceClaimIndexInformer {
+	return NewTypedResourceClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredResourceClaimInformer constructs a new informer for ResourceClaim type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredResourceClaimInformer]).
 func NewFilteredResourceClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewResourceClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedResourceClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredResourceClaimInformer constructs a new informer for ResourceClaim type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredResourceClaimInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ResourceClaimIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ResourceClaimIndexInformer {
+	return NewTypedResourceClaimInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewResourceClaimInformerWithOptions constructs a new informer for ResourceClaim type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceClaimInformerWithOptions]).
 func NewResourceClaimInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedResourceClaimInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedResourceClaimInformerWithOptions constructs a new informer for ResourceClaim type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceClaimInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ResourceClaimIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1beta2", Resource: "resourceclaims"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.ResourceClaim](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewResourceClaimInformerWithOptions(client kubernetes.Interface, namespace
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *resourceClaimInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewResourceClaimInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedResourceClaimInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *resourceClaimInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiresourcev1beta2.ResourceClaim{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *resourceClaimInformer) TypedInformer() ResourceClaimIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.ResourceClaim](f.factory.InformerFor(&apiresourcev1beta2.ResourceClaim{}, f.defaultInformer))
 }
 
 func (f *resourceClaimInformer) Lister() resourcev1beta2.ResourceClaimLister {
 	return resourcev1beta2.NewResourceClaimLister(f.Informer().GetIndexer())
 }
+
+// ToTypedResourceClaimInformer converts an untyped informer into a TypedResourceClaimInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceClaim. If that is not the case, calling type-safe methods of the returned
+// TypedResourceClaimInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedResourceClaimInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedResourceClaimInformer(informer ResourceClaimInformer) TypedResourceClaimInformer {
+	if informer, ok := informer.(TypedResourceClaimInformer); ok {
+		return informer
+	}
+	return &resourceClaimTypedInformerAdapter{informer}
+}
+
+type resourceClaimTypedInformerAdapter struct {
+	ResourceClaimInformer
+}
+
+func (a *resourceClaimTypedInformerAdapter) TypedInformer() ResourceClaimIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.ResourceClaim](a.Informer())
+}
+
+// ToResourceClaimIndexInformer converts an untyped informer into a ResourceClaimIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceClaim. If that is not the case, calling type-safe methods of the returned
+// ResourceClaimIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ResourceClaimIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToResourceClaimIndexInformer(informer cache.SharedIndexInformer) ResourceClaimIndexInformer {
+	if informer, ok := informer.(ResourceClaimIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.ResourceClaim](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1beta2/resourceclaimtemplate.go b/vendor/k8s.io/client-go/informers/resource/v1beta2/resourceclaimtemplate.go
index ee22977a39..c7ee33df62 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1beta2/resourceclaimtemplate.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1beta2/resourceclaimtemplate.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ResourceClaimTemplateInformer provides access to a shared informer and lister for
-// ResourceClaimTemplates.
+// ResourceClaimTemplates. Prefer using the type-safe variant (see [TypedResourceClaimTemplateInformer]).
 type ResourceClaimTemplateInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() resourcev1beta2.ResourceClaimTemplateLister
 }
 
+// TypedResourceClaimTemplateInformer provides access to a shared informer and lister for
+// ResourceClaimTemplates, including the type-safe TypedInformer variant.
+// It is a superset of ResourceClaimTemplateInformer.
+type TypedResourceClaimTemplateInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ResourceClaimTemplateIndexInformer
+	Lister() resourcev1beta2.ResourceClaimTemplateLister
+}
+
+// ResourceClaimTemplateIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ResourceClaimTemplateIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1beta2.ResourceClaimTemplate]
+
+// ResourceClaimTemplateHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ResourceClaimTemplate.
+type ResourceClaimTemplateHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1beta2.ResourceClaimTemplate]
+
+// ResourceClaimTemplateDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ResourceClaimTemplate.
+type ResourceClaimTemplateDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1beta2.ResourceClaimTemplate]
+
+// ResourceClaimTemplateFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ResourceClaimTemplate.
+type ResourceClaimTemplateFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1beta2.ResourceClaimTemplate]
+
+// ResourceClaimTemplateIndexers is a specialization of [cache.TypedIndexers] for ResourceClaimTemplate.
+type ResourceClaimTemplateIndexers = cache.TypedIndexers[*apiresourcev1beta2.ResourceClaimTemplate]
+
+// DeletedResourceClaimTemplate is a specialization of [cache.DeletedObject] for ResourceClaimTemplate.
+type DeletedResourceClaimTemplate = cache.DeletedObject[*apiresourcev1beta2.ResourceClaimTemplate]
+
 type resourceClaimTemplateInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type resourceClaimTemplateInformer struct {
 // NewResourceClaimTemplateInformer constructs a new informer for ResourceClaimTemplate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceClaimTemplateInformer]).
 func NewResourceClaimTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewResourceClaimTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedResourceClaimTemplateInformer constructs a new informer for ResourceClaimTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceClaimTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ResourceClaimTemplateIndexers) ResourceClaimTemplateIndexInformer {
+	return NewTypedResourceClaimTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredResourceClaimTemplateInformer constructs a new informer for ResourceClaimTemplate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredResourceClaimTemplateInformer]).
 func NewFilteredResourceClaimTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewResourceClaimTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedResourceClaimTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredResourceClaimTemplateInformer constructs a new informer for ResourceClaimTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredResourceClaimTemplateInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers ResourceClaimTemplateIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ResourceClaimTemplateIndexInformer {
+	return NewTypedResourceClaimTemplateInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewResourceClaimTemplateInformerWithOptions constructs a new informer for ResourceClaimTemplate type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceClaimTemplateInformerWithOptions]).
 func NewResourceClaimTemplateInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedResourceClaimTemplateInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedResourceClaimTemplateInformerWithOptions constructs a new informer for ResourceClaimTemplate type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceClaimTemplateInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) ResourceClaimTemplateIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1beta2", Resource: "resourceclaimtemplates"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.ResourceClaimTemplate](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewResourceClaimTemplateInformerWithOptions(client kubernetes.Interface, na
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *resourceClaimTemplateInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewResourceClaimTemplateInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedResourceClaimTemplateInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *resourceClaimTemplateInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiresourcev1beta2.ResourceClaimTemplate{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *resourceClaimTemplateInformer) TypedInformer() ResourceClaimTemplateIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.ResourceClaimTemplate](f.factory.InformerFor(&apiresourcev1beta2.ResourceClaimTemplate{}, f.defaultInformer))
 }
 
 func (f *resourceClaimTemplateInformer) Lister() resourcev1beta2.ResourceClaimTemplateLister {
 	return resourcev1beta2.NewResourceClaimTemplateLister(f.Informer().GetIndexer())
 }
+
+// ToTypedResourceClaimTemplateInformer converts an untyped informer into a TypedResourceClaimTemplateInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceClaimTemplate. If that is not the case, calling type-safe methods of the returned
+// TypedResourceClaimTemplateInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedResourceClaimTemplateInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedResourceClaimTemplateInformer(informer ResourceClaimTemplateInformer) TypedResourceClaimTemplateInformer {
+	if informer, ok := informer.(TypedResourceClaimTemplateInformer); ok {
+		return informer
+	}
+	return &resourceClaimTemplateTypedInformerAdapter{informer}
+}
+
+type resourceClaimTemplateTypedInformerAdapter struct {
+	ResourceClaimTemplateInformer
+}
+
+func (a *resourceClaimTemplateTypedInformerAdapter) TypedInformer() ResourceClaimTemplateIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.ResourceClaimTemplate](a.Informer())
+}
+
+// ToResourceClaimTemplateIndexInformer converts an untyped informer into a ResourceClaimTemplateIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceClaimTemplate. If that is not the case, calling type-safe methods of the returned
+// ResourceClaimTemplateIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ResourceClaimTemplateIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToResourceClaimTemplateIndexInformer(informer cache.SharedIndexInformer) ResourceClaimTemplateIndexInformer {
+	if informer, ok := informer.(ResourceClaimTemplateIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.ResourceClaimTemplate](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/resource/v1beta2/resourceslice.go b/vendor/k8s.io/client-go/informers/resource/v1beta2/resourceslice.go
index 7a8027886e..248ad44786 100644
--- a/vendor/k8s.io/client-go/informers/resource/v1beta2/resourceslice.go
+++ b/vendor/k8s.io/client-go/informers/resource/v1beta2/resourceslice.go
@@ -34,12 +34,40 @@ import (
 )
 
 // ResourceSliceInformer provides access to a shared informer and lister for
-// ResourceSlices.
+// ResourceSlices. Prefer using the type-safe variant (see [TypedResourceSliceInformer]).
 type ResourceSliceInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() resourcev1beta2.ResourceSliceLister
 }
 
+// TypedResourceSliceInformer provides access to a shared informer and lister for
+// ResourceSlices, including the type-safe TypedInformer variant.
+// It is a superset of ResourceSliceInformer.
+type TypedResourceSliceInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() ResourceSliceIndexInformer
+	Lister() resourcev1beta2.ResourceSliceLister
+}
+
+// ResourceSliceIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type ResourceSliceIndexInformer cache.TypedSharedIndexInformer[*apiresourcev1beta2.ResourceSlice]
+
+// ResourceSliceHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for ResourceSlice.
+type ResourceSliceHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apiresourcev1beta2.ResourceSlice]
+
+// ResourceSliceDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for ResourceSlice.
+type ResourceSliceDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apiresourcev1beta2.ResourceSlice]
+
+// ResourceSliceFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for ResourceSlice.
+type ResourceSliceFilteringHandler = cache.TypedFilteringResourceEventHandler[*apiresourcev1beta2.ResourceSlice]
+
+// ResourceSliceIndexers is a specialization of [cache.TypedIndexers] for ResourceSlice.
+type ResourceSliceIndexers = cache.TypedIndexers[*apiresourcev1beta2.ResourceSlice]
+
+// DeletedResourceSlice is a specialization of [cache.DeletedObject] for ResourceSlice.
+type DeletedResourceSlice = cache.DeletedObject[*apiresourcev1beta2.ResourceSlice]
+
 type resourceSliceInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type resourceSliceInformer struct {
 // NewResourceSliceInformer constructs a new informer for ResourceSlice type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceSliceInformer]).
 func NewResourceSliceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedResourceSliceInformer constructs a new informer for ResourceSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceSliceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ResourceSliceIndexers) ResourceSliceIndexInformer {
+	return NewTypedResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredResourceSliceInformer constructs a new informer for ResourceSlice type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredResourceSliceInformer]).
 func NewFilteredResourceSliceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredResourceSliceInformer constructs a new informer for ResourceSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredResourceSliceInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers ResourceSliceIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) ResourceSliceIndexInformer {
+	return NewTypedResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewResourceSliceInformerWithOptions constructs a new informer for ResourceSlice type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedResourceSliceInformerWithOptions]).
 func NewResourceSliceInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedResourceSliceInformerWithOptions(client, options)
+}
+
+// NewTypedResourceSliceInformerWithOptions constructs a new informer for ResourceSlice type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedResourceSliceInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) ResourceSliceIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1beta2", Resource: "resourceslices"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.ResourceSlice](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewResourceSliceInformerWithOptions(client kubernetes.Interface, options in
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *resourceSliceInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedResourceSliceInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *resourceSliceInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apiresourcev1beta2.ResourceSlice{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *resourceSliceInformer) TypedInformer() ResourceSliceIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.ResourceSlice](f.factory.InformerFor(&apiresourcev1beta2.ResourceSlice{}, f.defaultInformer))
 }
 
 func (f *resourceSliceInformer) Lister() resourcev1beta2.ResourceSliceLister {
 	return resourcev1beta2.NewResourceSliceLister(f.Informer().GetIndexer())
 }
+
+// ToTypedResourceSliceInformer converts an untyped informer into a TypedResourceSliceInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceSlice. If that is not the case, calling type-safe methods of the returned
+// TypedResourceSliceInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedResourceSliceInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedResourceSliceInformer(informer ResourceSliceInformer) TypedResourceSliceInformer {
+	if informer, ok := informer.(TypedResourceSliceInformer); ok {
+		return informer
+	}
+	return &resourceSliceTypedInformerAdapter{informer}
+}
+
+type resourceSliceTypedInformerAdapter struct {
+	ResourceSliceInformer
+}
+
+func (a *resourceSliceTypedInformerAdapter) TypedInformer() ResourceSliceIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.ResourceSlice](a.Informer())
+}
+
+// ToResourceSliceIndexInformer converts an untyped informer into a ResourceSliceIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *ResourceSlice. If that is not the case, calling type-safe methods of the returned
+// ResourceSliceIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a ResourceSliceIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToResourceSliceIndexInformer(informer cache.SharedIndexInformer) ResourceSliceIndexInformer {
+	if informer, ok := informer.(ResourceSliceIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apiresourcev1beta2.ResourceSlice](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/scheduling/interface.go b/vendor/k8s.io/client-go/informers/scheduling/interface.go
index e55a8410d1..bd66d6c3ab 100644
--- a/vendor/k8s.io/client-go/informers/scheduling/interface.go
+++ b/vendor/k8s.io/client-go/informers/scheduling/interface.go
@@ -21,7 +21,7 @@ package scheduling
 import (
 	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
 	v1 "k8s.io/client-go/informers/scheduling/v1"
-	v1alpha2 "k8s.io/client-go/informers/scheduling/v1alpha2"
+	v1alpha3 "k8s.io/client-go/informers/scheduling/v1alpha3"
 	v1beta1 "k8s.io/client-go/informers/scheduling/v1beta1"
 )
 
@@ -29,8 +29,8 @@ import (
 type Interface interface {
 	// V1 provides access to shared informers for resources in V1.
 	V1() v1.Interface
-	// V1alpha2 provides access to shared informers for resources in V1alpha2.
-	V1alpha2() v1alpha2.Interface
+	// V1alpha3 provides access to shared informers for resources in V1alpha3.
+	V1alpha3() v1alpha3.Interface
 	// V1beta1 provides access to shared informers for resources in V1beta1.
 	V1beta1() v1beta1.Interface
 }
@@ -51,9 +51,9 @@ func (g *group) V1() v1.Interface {
 	return v1.New(g.factory, g.namespace, g.tweakListOptions)
 }
 
-// V1alpha2 returns a new v1alpha2.Interface.
-func (g *group) V1alpha2() v1alpha2.Interface {
-	return v1alpha2.New(g.factory, g.namespace, g.tweakListOptions)
+// V1alpha3 returns a new v1alpha3.Interface.
+func (g *group) V1alpha3() v1alpha3.Interface {
+	return v1alpha3.New(g.factory, g.namespace, g.tweakListOptions)
 }
 
 // V1beta1 returns a new v1beta1.Interface.
diff --git a/vendor/k8s.io/client-go/informers/scheduling/v1/interface.go b/vendor/k8s.io/client-go/informers/scheduling/v1/interface.go
index fd7931f34a..fd3b20d969 100644
--- a/vendor/k8s.io/client-go/informers/scheduling/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/scheduling/v1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// PriorityClasses returns a PriorityClassInformer.
-	PriorityClasses() PriorityClassInformer
+	PriorityClasses() TypedPriorityClassInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// PriorityClasses returns a PriorityClassInformer.
-func (v *version) PriorityClasses() PriorityClassInformer {
+// PriorityClasses returns a TypedPriorityClassInformer.
+func (v *version) PriorityClasses() TypedPriorityClassInformer {
 	return &priorityClassInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/scheduling/v1/priorityclass.go b/vendor/k8s.io/client-go/informers/scheduling/v1/priorityclass.go
index f1d18f2a01..8b4daf5caa 100644
--- a/vendor/k8s.io/client-go/informers/scheduling/v1/priorityclass.go
+++ b/vendor/k8s.io/client-go/informers/scheduling/v1/priorityclass.go
@@ -34,12 +34,40 @@ import (
 )
 
 // PriorityClassInformer provides access to a shared informer and lister for
-// PriorityClasses.
+// PriorityClasses. Prefer using the type-safe variant (see [TypedPriorityClassInformer]).
 type PriorityClassInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() schedulingv1.PriorityClassLister
 }
 
+// TypedPriorityClassInformer provides access to a shared informer and lister for
+// PriorityClasses, including the type-safe TypedInformer variant.
+// It is a superset of PriorityClassInformer.
+type TypedPriorityClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PriorityClassIndexInformer
+	Lister() schedulingv1.PriorityClassLister
+}
+
+// PriorityClassIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PriorityClassIndexInformer cache.TypedSharedIndexInformer[*apischedulingv1.PriorityClass]
+
+// PriorityClassHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for PriorityClass.
+type PriorityClassHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apischedulingv1.PriorityClass]
+
+// PriorityClassDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for PriorityClass.
+type PriorityClassDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apischedulingv1.PriorityClass]
+
+// PriorityClassFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for PriorityClass.
+type PriorityClassFilteringHandler = cache.TypedFilteringResourceEventHandler[*apischedulingv1.PriorityClass]
+
+// PriorityClassIndexers is a specialization of [cache.TypedIndexers] for PriorityClass.
+type PriorityClassIndexers = cache.TypedIndexers[*apischedulingv1.PriorityClass]
+
+// DeletedPriorityClass is a specialization of [cache.DeletedObject] for PriorityClass.
+type DeletedPriorityClass = cache.DeletedObject[*apischedulingv1.PriorityClass]
+
 type priorityClassInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type priorityClassInformer struct {
 // NewPriorityClassInformer constructs a new informer for PriorityClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPriorityClassInformer]).
 func NewPriorityClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewPriorityClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedPriorityClassInformer constructs a new informer for PriorityClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPriorityClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers PriorityClassIndexers) PriorityClassIndexInformer {
+	return NewTypedPriorityClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredPriorityClassInformer constructs a new informer for PriorityClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPriorityClassInformer]).
 func NewFilteredPriorityClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewPriorityClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedPriorityClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPriorityClassInformer constructs a new informer for PriorityClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPriorityClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers PriorityClassIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PriorityClassIndexInformer {
+	return NewTypedPriorityClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewPriorityClassInformerWithOptions constructs a new informer for PriorityClass type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPriorityClassInformerWithOptions]).
 func NewPriorityClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPriorityClassInformerWithOptions(client, options)
+}
+
+// NewTypedPriorityClassInformerWithOptions constructs a new informer for PriorityClass type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPriorityClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) PriorityClassIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1", Resource: "priorityclasss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1.PriorityClass](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewPriorityClassInformerWithOptions(client kubernetes.Interface, options in
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *priorityClassInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewPriorityClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedPriorityClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *priorityClassInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apischedulingv1.PriorityClass{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *priorityClassInformer) TypedInformer() PriorityClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1.PriorityClass](f.factory.InformerFor(&apischedulingv1.PriorityClass{}, f.defaultInformer))
 }
 
 func (f *priorityClassInformer) Lister() schedulingv1.PriorityClassLister {
 	return schedulingv1.NewPriorityClassLister(f.Informer().GetIndexer())
 }
+
+// ToTypedPriorityClassInformer converts an untyped informer into a TypedPriorityClassInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PriorityClass. If that is not the case, calling type-safe methods of the returned
+// TypedPriorityClassInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPriorityClassInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPriorityClassInformer(informer PriorityClassInformer) TypedPriorityClassInformer {
+	if informer, ok := informer.(TypedPriorityClassInformer); ok {
+		return informer
+	}
+	return &priorityClassTypedInformerAdapter{informer}
+}
+
+type priorityClassTypedInformerAdapter struct {
+	PriorityClassInformer
+}
+
+func (a *priorityClassTypedInformerAdapter) TypedInformer() PriorityClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1.PriorityClass](a.Informer())
+}
+
+// ToPriorityClassIndexInformer converts an untyped informer into a PriorityClassIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PriorityClass. If that is not the case, calling type-safe methods of the returned
+// PriorityClassIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PriorityClassIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPriorityClassIndexInformer(informer cache.SharedIndexInformer) PriorityClassIndexInformer {
+	if informer, ok := informer.(PriorityClassIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1.PriorityClass](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/scheduling/v1alpha2/podgroup.go b/vendor/k8s.io/client-go/informers/scheduling/v1alpha2/podgroup.go
deleted file mode 100644
index 5f39858c65..0000000000
--- a/vendor/k8s.io/client-go/informers/scheduling/v1alpha2/podgroup.go
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by informer-gen. DO NOT EDIT.
-
-package v1alpha2
-
-import (
-	context "context"
-	time "time"
-
-	apischedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	watch "k8s.io/apimachinery/pkg/watch"
-	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
-	kubernetes "k8s.io/client-go/kubernetes"
-	schedulingv1alpha2 "k8s.io/client-go/listers/scheduling/v1alpha2"
-	cache "k8s.io/client-go/tools/cache"
-)
-
-// PodGroupInformer provides access to a shared informer and lister for
-// PodGroups.
-type PodGroupInformer interface {
-	Informer() cache.SharedIndexInformer
-	Lister() schedulingv1alpha2.PodGroupLister
-}
-
-type podGroupInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-	namespace        string
-}
-
-// NewPodGroupInformer constructs a new informer for PodGroup type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewPodGroupInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
-	return NewPodGroupInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
-}
-
-// NewFilteredPodGroupInformer constructs a new informer for PodGroup type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPodGroupInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewPodGroupInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
-}
-
-// NewPodGroupInformerWithOptions constructs a new informer for PodGroup type with additional options.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewPodGroupInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
-	gvr := schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1alpha2", Resource: "podgroups"}
-	identifier := options.InformerName.WithResource(gvr)
-	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
-		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
-			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&opts)
-				}
-				return client.SchedulingV1alpha2().PodGroups(namespace).List(context.Background(), opts)
-			},
-			WatchFunc: func(opts v1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&opts)
-				}
-				return client.SchedulingV1alpha2().PodGroups(namespace).Watch(context.Background(), opts)
-			},
-			ListWithContextFunc: func(ctx context.Context, opts v1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&opts)
-				}
-				return client.SchedulingV1alpha2().PodGroups(namespace).List(ctx, opts)
-			},
-			WatchFuncWithContext: func(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&opts)
-				}
-				return client.SchedulingV1alpha2().PodGroups(namespace).Watch(ctx, opts)
-			},
-		}, client),
-		&apischedulingv1alpha2.PodGroup{},
-		cache.SharedIndexInformerOptions{
-			ResyncPeriod: options.ResyncPeriod,
-			Indexers:     options.Indexers,
-			Identifier:   identifier,
-		},
-	)
-}
-
-func (f *podGroupInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewPodGroupInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
-}
-
-func (f *podGroupInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apischedulingv1alpha2.PodGroup{}, f.defaultInformer)
-}
-
-func (f *podGroupInformer) Lister() schedulingv1alpha2.PodGroupLister {
-	return schedulingv1alpha2.NewPodGroupLister(f.Informer().GetIndexer())
-}
diff --git a/vendor/k8s.io/client-go/informers/scheduling/v1alpha2/workload.go b/vendor/k8s.io/client-go/informers/scheduling/v1alpha2/workload.go
deleted file mode 100644
index ffe2f4ece7..0000000000
--- a/vendor/k8s.io/client-go/informers/scheduling/v1alpha2/workload.go
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by informer-gen. DO NOT EDIT.
-
-package v1alpha2
-
-import (
-	context "context"
-	time "time"
-
-	apischedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	watch "k8s.io/apimachinery/pkg/watch"
-	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
-	kubernetes "k8s.io/client-go/kubernetes"
-	schedulingv1alpha2 "k8s.io/client-go/listers/scheduling/v1alpha2"
-	cache "k8s.io/client-go/tools/cache"
-)
-
-// WorkloadInformer provides access to a shared informer and lister for
-// Workloads.
-type WorkloadInformer interface {
-	Informer() cache.SharedIndexInformer
-	Lister() schedulingv1alpha2.WorkloadLister
-}
-
-type workloadInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-	namespace        string
-}
-
-// NewWorkloadInformer constructs a new informer for Workload type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewWorkloadInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
-	return NewWorkloadInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
-}
-
-// NewFilteredWorkloadInformer constructs a new informer for Workload type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFilteredWorkloadInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewWorkloadInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
-}
-
-// NewWorkloadInformerWithOptions constructs a new informer for Workload type with additional options.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewWorkloadInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
-	gvr := schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1alpha2", Resource: "workloads"}
-	identifier := options.InformerName.WithResource(gvr)
-	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
-		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
-			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&opts)
-				}
-				return client.SchedulingV1alpha2().Workloads(namespace).List(context.Background(), opts)
-			},
-			WatchFunc: func(opts v1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&opts)
-				}
-				return client.SchedulingV1alpha2().Workloads(namespace).Watch(context.Background(), opts)
-			},
-			ListWithContextFunc: func(ctx context.Context, opts v1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&opts)
-				}
-				return client.SchedulingV1alpha2().Workloads(namespace).List(ctx, opts)
-			},
-			WatchFuncWithContext: func(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&opts)
-				}
-				return client.SchedulingV1alpha2().Workloads(namespace).Watch(ctx, opts)
-			},
-		}, client),
-		&apischedulingv1alpha2.Workload{},
-		cache.SharedIndexInformerOptions{
-			ResyncPeriod: options.ResyncPeriod,
-			Indexers:     options.Indexers,
-			Identifier:   identifier,
-		},
-	)
-}
-
-func (f *workloadInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewWorkloadInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
-}
-
-func (f *workloadInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apischedulingv1alpha2.Workload{}, f.defaultInformer)
-}
-
-func (f *workloadInformer) Lister() schedulingv1alpha2.WorkloadLister {
-	return schedulingv1alpha2.NewWorkloadLister(f.Informer().GetIndexer())
-}
diff --git a/vendor/k8s.io/client-go/informers/scheduling/v1alpha3/compositepodgroup.go b/vendor/k8s.io/client-go/informers/scheduling/v1alpha3/compositepodgroup.go
new file mode 100644
index 0000000000..9556755dc9
--- /dev/null
+++ b/vendor/k8s.io/client-go/informers/scheduling/v1alpha3/compositepodgroup.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	context "context"
+	time "time"
+
+	apischedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+	kubernetes "k8s.io/client-go/kubernetes"
+	schedulingv1alpha3 "k8s.io/client-go/listers/scheduling/v1alpha3"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// CompositePodGroupInformer provides access to a shared informer and lister for
+// CompositePodGroups. Prefer using the type-safe variant (see [TypedCompositePodGroupInformer]).
+type CompositePodGroupInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() schedulingv1alpha3.CompositePodGroupLister
+}
+
+// TypedCompositePodGroupInformer provides access to a shared informer and lister for
+// CompositePodGroups, including the type-safe TypedInformer variant.
+// It is a superset of CompositePodGroupInformer.
+type TypedCompositePodGroupInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() CompositePodGroupIndexInformer
+	Lister() schedulingv1alpha3.CompositePodGroupLister
+}
+
+// CompositePodGroupIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type CompositePodGroupIndexInformer cache.TypedSharedIndexInformer[*apischedulingv1alpha3.CompositePodGroup]
+
+// CompositePodGroupHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for CompositePodGroup.
+type CompositePodGroupHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apischedulingv1alpha3.CompositePodGroup]
+
+// CompositePodGroupDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for CompositePodGroup.
+type CompositePodGroupDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apischedulingv1alpha3.CompositePodGroup]
+
+// CompositePodGroupFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for CompositePodGroup.
+type CompositePodGroupFilteringHandler = cache.TypedFilteringResourceEventHandler[*apischedulingv1alpha3.CompositePodGroup]
+
+// CompositePodGroupIndexers is a specialization of [cache.TypedIndexers] for CompositePodGroup.
+type CompositePodGroupIndexers = cache.TypedIndexers[*apischedulingv1alpha3.CompositePodGroup]
+
+// DeletedCompositePodGroup is a specialization of [cache.DeletedObject] for CompositePodGroup.
+type DeletedCompositePodGroup = cache.DeletedObject[*apischedulingv1alpha3.CompositePodGroup]
+
+type compositePodGroupInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewCompositePodGroupInformer constructs a new informer for CompositePodGroup type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCompositePodGroupInformer]).
+func NewCompositePodGroupInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewCompositePodGroupInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedCompositePodGroupInformer constructs a new informer for CompositePodGroup type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCompositePodGroupInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers CompositePodGroupIndexers) CompositePodGroupIndexInformer {
+	return NewTypedCompositePodGroupInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredCompositePodGroupInformer constructs a new informer for CompositePodGroup type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredCompositePodGroupInformer]).
+func NewFilteredCompositePodGroupInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedCompositePodGroupInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredCompositePodGroupInformer constructs a new informer for CompositePodGroup type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredCompositePodGroupInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers CompositePodGroupIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) CompositePodGroupIndexInformer {
+	return NewTypedCompositePodGroupInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewCompositePodGroupInformerWithOptions constructs a new informer for CompositePodGroup type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCompositePodGroupInformerWithOptions]).
+func NewCompositePodGroupInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedCompositePodGroupInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedCompositePodGroupInformerWithOptions constructs a new informer for CompositePodGroup type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCompositePodGroupInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) CompositePodGroupIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1alpha3", Resource: "compositepodgroups"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1alpha3.CompositePodGroup](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1alpha3().CompositePodGroups(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1alpha3().CompositePodGroups(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1alpha3().CompositePodGroups(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1alpha3().CompositePodGroups(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apischedulingv1alpha3.CompositePodGroup{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *compositePodGroupInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedCompositePodGroupInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *compositePodGroupInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *compositePodGroupInformer) TypedInformer() CompositePodGroupIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1alpha3.CompositePodGroup](f.factory.InformerFor(&apischedulingv1alpha3.CompositePodGroup{}, f.defaultInformer))
+}
+
+func (f *compositePodGroupInformer) Lister() schedulingv1alpha3.CompositePodGroupLister {
+	return schedulingv1alpha3.NewCompositePodGroupLister(f.Informer().GetIndexer())
+}
+
+// ToTypedCompositePodGroupInformer converts an untyped informer into a TypedCompositePodGroupInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CompositePodGroup. If that is not the case, calling type-safe methods of the returned
+// TypedCompositePodGroupInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedCompositePodGroupInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedCompositePodGroupInformer(informer CompositePodGroupInformer) TypedCompositePodGroupInformer {
+	if informer, ok := informer.(TypedCompositePodGroupInformer); ok {
+		return informer
+	}
+	return &compositePodGroupTypedInformerAdapter{informer}
+}
+
+type compositePodGroupTypedInformerAdapter struct {
+	CompositePodGroupInformer
+}
+
+func (a *compositePodGroupTypedInformerAdapter) TypedInformer() CompositePodGroupIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1alpha3.CompositePodGroup](a.Informer())
+}
+
+// ToCompositePodGroupIndexInformer converts an untyped informer into a CompositePodGroupIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CompositePodGroup. If that is not the case, calling type-safe methods of the returned
+// CompositePodGroupIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a CompositePodGroupIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToCompositePodGroupIndexInformer(informer cache.SharedIndexInformer) CompositePodGroupIndexInformer {
+	if informer, ok := informer.(CompositePodGroupIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1alpha3.CompositePodGroup](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/scheduling/v1alpha2/interface.go b/vendor/k8s.io/client-go/informers/scheduling/v1alpha3/interface.go
similarity index 70%
rename from vendor/k8s.io/client-go/informers/scheduling/v1alpha2/interface.go
rename to vendor/k8s.io/client-go/informers/scheduling/v1alpha3/interface.go
index 8edc498b67..1471eb3d5b 100644
--- a/vendor/k8s.io/client-go/informers/scheduling/v1alpha2/interface.go
+++ b/vendor/k8s.io/client-go/informers/scheduling/v1alpha3/interface.go
@@ -16,7 +16,7 @@ limitations under the License.
 
 // Code generated by informer-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
 
 import (
 	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
@@ -24,10 +24,12 @@ import (
 
 // Interface provides access to all the informers in this group version.
 type Interface interface {
+	// CompositePodGroups returns a CompositePodGroupInformer.
+	CompositePodGroups() TypedCompositePodGroupInformer
 	// PodGroups returns a PodGroupInformer.
-	PodGroups() PodGroupInformer
+	PodGroups() TypedPodGroupInformer
 	// Workloads returns a WorkloadInformer.
-	Workloads() WorkloadInformer
+	Workloads() TypedWorkloadInformer
 }
 
 type version struct {
@@ -41,12 +43,17 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// PodGroups returns a PodGroupInformer.
-func (v *version) PodGroups() PodGroupInformer {
+// CompositePodGroups returns a TypedCompositePodGroupInformer.
+func (v *version) CompositePodGroups() TypedCompositePodGroupInformer {
+	return &compositePodGroupInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
+
+// PodGroups returns a TypedPodGroupInformer.
+func (v *version) PodGroups() TypedPodGroupInformer {
 	return &podGroupInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// Workloads returns a WorkloadInformer.
-func (v *version) Workloads() WorkloadInformer {
+// Workloads returns a TypedWorkloadInformer.
+func (v *version) Workloads() TypedWorkloadInformer {
 	return &workloadInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/scheduling/v1alpha3/podgroup.go b/vendor/k8s.io/client-go/informers/scheduling/v1alpha3/podgroup.go
new file mode 100644
index 0000000000..3b0c4d8315
--- /dev/null
+++ b/vendor/k8s.io/client-go/informers/scheduling/v1alpha3/podgroup.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	context "context"
+	time "time"
+
+	apischedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+	kubernetes "k8s.io/client-go/kubernetes"
+	schedulingv1alpha3 "k8s.io/client-go/listers/scheduling/v1alpha3"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// PodGroupInformer provides access to a shared informer and lister for
+// PodGroups. Prefer using the type-safe variant (see [TypedPodGroupInformer]).
+type PodGroupInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() schedulingv1alpha3.PodGroupLister
+}
+
+// TypedPodGroupInformer provides access to a shared informer and lister for
+// PodGroups, including the type-safe TypedInformer variant.
+// It is a superset of PodGroupInformer.
+type TypedPodGroupInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PodGroupIndexInformer
+	Lister() schedulingv1alpha3.PodGroupLister
+}
+
+// PodGroupIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PodGroupIndexInformer cache.TypedSharedIndexInformer[*apischedulingv1alpha3.PodGroup]
+
+// PodGroupHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for PodGroup.
+type PodGroupHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apischedulingv1alpha3.PodGroup]
+
+// PodGroupDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for PodGroup.
+type PodGroupDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apischedulingv1alpha3.PodGroup]
+
+// PodGroupFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for PodGroup.
+type PodGroupFilteringHandler = cache.TypedFilteringResourceEventHandler[*apischedulingv1alpha3.PodGroup]
+
+// PodGroupIndexers is a specialization of [cache.TypedIndexers] for PodGroup.
+type PodGroupIndexers = cache.TypedIndexers[*apischedulingv1alpha3.PodGroup]
+
+// DeletedPodGroup is a specialization of [cache.DeletedObject] for PodGroup.
+type DeletedPodGroup = cache.DeletedObject[*apischedulingv1alpha3.PodGroup]
+
+type podGroupInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewPodGroupInformer constructs a new informer for PodGroup type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodGroupInformer]).
+func NewPodGroupInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewPodGroupInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedPodGroupInformer constructs a new informer for PodGroup type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodGroupInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodGroupIndexers) PodGroupIndexInformer {
+	return NewTypedPodGroupInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredPodGroupInformer constructs a new informer for PodGroup type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPodGroupInformer]).
+func NewFilteredPodGroupInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedPodGroupInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPodGroupInformer constructs a new informer for PodGroup type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPodGroupInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodGroupIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PodGroupIndexInformer {
+	return NewTypedPodGroupInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewPodGroupInformerWithOptions constructs a new informer for PodGroup type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodGroupInformerWithOptions]).
+func NewPodGroupInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPodGroupInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedPodGroupInformerWithOptions constructs a new informer for PodGroup type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodGroupInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) PodGroupIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1alpha3", Resource: "podgroups"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1alpha3.PodGroup](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1alpha3().PodGroups(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1alpha3().PodGroups(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1alpha3().PodGroups(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1alpha3().PodGroups(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apischedulingv1alpha3.PodGroup{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *podGroupInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedPodGroupInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *podGroupInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *podGroupInformer) TypedInformer() PodGroupIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1alpha3.PodGroup](f.factory.InformerFor(&apischedulingv1alpha3.PodGroup{}, f.defaultInformer))
+}
+
+func (f *podGroupInformer) Lister() schedulingv1alpha3.PodGroupLister {
+	return schedulingv1alpha3.NewPodGroupLister(f.Informer().GetIndexer())
+}
+
+// ToTypedPodGroupInformer converts an untyped informer into a TypedPodGroupInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PodGroup. If that is not the case, calling type-safe methods of the returned
+// TypedPodGroupInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPodGroupInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPodGroupInformer(informer PodGroupInformer) TypedPodGroupInformer {
+	if informer, ok := informer.(TypedPodGroupInformer); ok {
+		return informer
+	}
+	return &podGroupTypedInformerAdapter{informer}
+}
+
+type podGroupTypedInformerAdapter struct {
+	PodGroupInformer
+}
+
+func (a *podGroupTypedInformerAdapter) TypedInformer() PodGroupIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1alpha3.PodGroup](a.Informer())
+}
+
+// ToPodGroupIndexInformer converts an untyped informer into a PodGroupIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PodGroup. If that is not the case, calling type-safe methods of the returned
+// PodGroupIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PodGroupIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPodGroupIndexInformer(informer cache.SharedIndexInformer) PodGroupIndexInformer {
+	if informer, ok := informer.(PodGroupIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1alpha3.PodGroup](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/scheduling/v1alpha3/workload.go b/vendor/k8s.io/client-go/informers/scheduling/v1alpha3/workload.go
new file mode 100644
index 0000000000..9917620161
--- /dev/null
+++ b/vendor/k8s.io/client-go/informers/scheduling/v1alpha3/workload.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	context "context"
+	time "time"
+
+	apischedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+	kubernetes "k8s.io/client-go/kubernetes"
+	schedulingv1alpha3 "k8s.io/client-go/listers/scheduling/v1alpha3"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// WorkloadInformer provides access to a shared informer and lister for
+// Workloads. Prefer using the type-safe variant (see [TypedWorkloadInformer]).
+type WorkloadInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() schedulingv1alpha3.WorkloadLister
+}
+
+// TypedWorkloadInformer provides access to a shared informer and lister for
+// Workloads, including the type-safe TypedInformer variant.
+// It is a superset of WorkloadInformer.
+type TypedWorkloadInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() WorkloadIndexInformer
+	Lister() schedulingv1alpha3.WorkloadLister
+}
+
+// WorkloadIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type WorkloadIndexInformer cache.TypedSharedIndexInformer[*apischedulingv1alpha3.Workload]
+
+// WorkloadHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Workload.
+type WorkloadHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apischedulingv1alpha3.Workload]
+
+// WorkloadDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Workload.
+type WorkloadDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apischedulingv1alpha3.Workload]
+
+// WorkloadFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Workload.
+type WorkloadFilteringHandler = cache.TypedFilteringResourceEventHandler[*apischedulingv1alpha3.Workload]
+
+// WorkloadIndexers is a specialization of [cache.TypedIndexers] for Workload.
+type WorkloadIndexers = cache.TypedIndexers[*apischedulingv1alpha3.Workload]
+
+// DeletedWorkload is a specialization of [cache.DeletedObject] for Workload.
+type DeletedWorkload = cache.DeletedObject[*apischedulingv1alpha3.Workload]
+
+type workloadInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewWorkloadInformer constructs a new informer for Workload type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedWorkloadInformer]).
+func NewWorkloadInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewWorkloadInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedWorkloadInformer constructs a new informer for Workload type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedWorkloadInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers WorkloadIndexers) WorkloadIndexInformer {
+	return NewTypedWorkloadInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredWorkloadInformer constructs a new informer for Workload type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredWorkloadInformer]).
+func NewFilteredWorkloadInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedWorkloadInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredWorkloadInformer constructs a new informer for Workload type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredWorkloadInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers WorkloadIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) WorkloadIndexInformer {
+	return NewTypedWorkloadInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewWorkloadInformerWithOptions constructs a new informer for Workload type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedWorkloadInformerWithOptions]).
+func NewWorkloadInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedWorkloadInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedWorkloadInformerWithOptions constructs a new informer for Workload type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedWorkloadInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) WorkloadIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1alpha3", Resource: "workloads"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1alpha3.Workload](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1alpha3().Workloads(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1alpha3().Workloads(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1alpha3().Workloads(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1alpha3().Workloads(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apischedulingv1alpha3.Workload{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *workloadInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedWorkloadInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *workloadInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *workloadInformer) TypedInformer() WorkloadIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1alpha3.Workload](f.factory.InformerFor(&apischedulingv1alpha3.Workload{}, f.defaultInformer))
+}
+
+func (f *workloadInformer) Lister() schedulingv1alpha3.WorkloadLister {
+	return schedulingv1alpha3.NewWorkloadLister(f.Informer().GetIndexer())
+}
+
+// ToTypedWorkloadInformer converts an untyped informer into a TypedWorkloadInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Workload. If that is not the case, calling type-safe methods of the returned
+// TypedWorkloadInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedWorkloadInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedWorkloadInformer(informer WorkloadInformer) TypedWorkloadInformer {
+	if informer, ok := informer.(TypedWorkloadInformer); ok {
+		return informer
+	}
+	return &workloadTypedInformerAdapter{informer}
+}
+
+type workloadTypedInformerAdapter struct {
+	WorkloadInformer
+}
+
+func (a *workloadTypedInformerAdapter) TypedInformer() WorkloadIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1alpha3.Workload](a.Informer())
+}
+
+// ToWorkloadIndexInformer converts an untyped informer into a WorkloadIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Workload. If that is not the case, calling type-safe methods of the returned
+// WorkloadIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a WorkloadIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToWorkloadIndexInformer(informer cache.SharedIndexInformer) WorkloadIndexInformer {
+	if informer, ok := informer.(WorkloadIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1alpha3.Workload](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/scheduling/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/scheduling/v1beta1/interface.go
index 52840a9cee..f57d050b18 100644
--- a/vendor/k8s.io/client-go/informers/scheduling/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/scheduling/v1beta1/interface.go
@@ -24,8 +24,12 @@ import (
 
 // Interface provides access to all the informers in this group version.
 type Interface interface {
+	// PodGroups returns a PodGroupInformer.
+	PodGroups() TypedPodGroupInformer
 	// PriorityClasses returns a PriorityClassInformer.
-	PriorityClasses() PriorityClassInformer
+	PriorityClasses() TypedPriorityClassInformer
+	// Workloads returns a WorkloadInformer.
+	Workloads() TypedWorkloadInformer
 }
 
 type version struct {
@@ -39,7 +43,17 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// PriorityClasses returns a PriorityClassInformer.
-func (v *version) PriorityClasses() PriorityClassInformer {
+// PodGroups returns a TypedPodGroupInformer.
+func (v *version) PodGroups() TypedPodGroupInformer {
+	return &podGroupInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
+
+// PriorityClasses returns a TypedPriorityClassInformer.
+func (v *version) PriorityClasses() TypedPriorityClassInformer {
 	return &priorityClassInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// Workloads returns a TypedWorkloadInformer.
+func (v *version) Workloads() TypedWorkloadInformer {
+	return &workloadInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
diff --git a/vendor/k8s.io/client-go/informers/scheduling/v1beta1/podgroup.go b/vendor/k8s.io/client-go/informers/scheduling/v1beta1/podgroup.go
new file mode 100644
index 0000000000..ed77beccd9
--- /dev/null
+++ b/vendor/k8s.io/client-go/informers/scheduling/v1beta1/podgroup.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+	time "time"
+
+	apischedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+	kubernetes "k8s.io/client-go/kubernetes"
+	schedulingv1beta1 "k8s.io/client-go/listers/scheduling/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// PodGroupInformer provides access to a shared informer and lister for
+// PodGroups. Prefer using the type-safe variant (see [TypedPodGroupInformer]).
+type PodGroupInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() schedulingv1beta1.PodGroupLister
+}
+
+// TypedPodGroupInformer provides access to a shared informer and lister for
+// PodGroups, including the type-safe TypedInformer variant.
+// It is a superset of PodGroupInformer.
+type TypedPodGroupInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PodGroupIndexInformer
+	Lister() schedulingv1beta1.PodGroupLister
+}
+
+// PodGroupIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PodGroupIndexInformer cache.TypedSharedIndexInformer[*apischedulingv1beta1.PodGroup]
+
+// PodGroupHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for PodGroup.
+type PodGroupHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apischedulingv1beta1.PodGroup]
+
+// PodGroupDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for PodGroup.
+type PodGroupDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apischedulingv1beta1.PodGroup]
+
+// PodGroupFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for PodGroup.
+type PodGroupFilteringHandler = cache.TypedFilteringResourceEventHandler[*apischedulingv1beta1.PodGroup]
+
+// PodGroupIndexers is a specialization of [cache.TypedIndexers] for PodGroup.
+type PodGroupIndexers = cache.TypedIndexers[*apischedulingv1beta1.PodGroup]
+
+// DeletedPodGroup is a specialization of [cache.DeletedObject] for PodGroup.
+type DeletedPodGroup = cache.DeletedObject[*apischedulingv1beta1.PodGroup]
+
+type podGroupInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewPodGroupInformer constructs a new informer for PodGroup type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodGroupInformer]).
+func NewPodGroupInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewPodGroupInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedPodGroupInformer constructs a new informer for PodGroup type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodGroupInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodGroupIndexers) PodGroupIndexInformer {
+	return NewTypedPodGroupInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredPodGroupInformer constructs a new informer for PodGroup type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPodGroupInformer]).
+func NewFilteredPodGroupInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedPodGroupInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPodGroupInformer constructs a new informer for PodGroup type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPodGroupInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers PodGroupIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PodGroupIndexInformer {
+	return NewTypedPodGroupInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewPodGroupInformerWithOptions constructs a new informer for PodGroup type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPodGroupInformerWithOptions]).
+func NewPodGroupInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPodGroupInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedPodGroupInformerWithOptions constructs a new informer for PodGroup type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPodGroupInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) PodGroupIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1beta1", Resource: "podgroups"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1beta1.PodGroup](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1beta1().PodGroups(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1beta1().PodGroups(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1beta1().PodGroups(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1beta1().PodGroups(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apischedulingv1beta1.PodGroup{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *podGroupInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedPodGroupInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *podGroupInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *podGroupInformer) TypedInformer() PodGroupIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1beta1.PodGroup](f.factory.InformerFor(&apischedulingv1beta1.PodGroup{}, f.defaultInformer))
+}
+
+func (f *podGroupInformer) Lister() schedulingv1beta1.PodGroupLister {
+	return schedulingv1beta1.NewPodGroupLister(f.Informer().GetIndexer())
+}
+
+// ToTypedPodGroupInformer converts an untyped informer into a TypedPodGroupInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PodGroup. If that is not the case, calling type-safe methods of the returned
+// TypedPodGroupInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPodGroupInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPodGroupInformer(informer PodGroupInformer) TypedPodGroupInformer {
+	if informer, ok := informer.(TypedPodGroupInformer); ok {
+		return informer
+	}
+	return &podGroupTypedInformerAdapter{informer}
+}
+
+type podGroupTypedInformerAdapter struct {
+	PodGroupInformer
+}
+
+func (a *podGroupTypedInformerAdapter) TypedInformer() PodGroupIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1beta1.PodGroup](a.Informer())
+}
+
+// ToPodGroupIndexInformer converts an untyped informer into a PodGroupIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PodGroup. If that is not the case, calling type-safe methods of the returned
+// PodGroupIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PodGroupIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPodGroupIndexInformer(informer cache.SharedIndexInformer) PodGroupIndexInformer {
+	if informer, ok := informer.(PodGroupIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1beta1.PodGroup](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/scheduling/v1beta1/priorityclass.go b/vendor/k8s.io/client-go/informers/scheduling/v1beta1/priorityclass.go
index a5cae3ea56..74b968d26e 100644
--- a/vendor/k8s.io/client-go/informers/scheduling/v1beta1/priorityclass.go
+++ b/vendor/k8s.io/client-go/informers/scheduling/v1beta1/priorityclass.go
@@ -34,12 +34,40 @@ import (
 )
 
 // PriorityClassInformer provides access to a shared informer and lister for
-// PriorityClasses.
+// PriorityClasses. Prefer using the type-safe variant (see [TypedPriorityClassInformer]).
 type PriorityClassInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() schedulingv1beta1.PriorityClassLister
 }
 
+// TypedPriorityClassInformer provides access to a shared informer and lister for
+// PriorityClasses, including the type-safe TypedInformer variant.
+// It is a superset of PriorityClassInformer.
+type TypedPriorityClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() PriorityClassIndexInformer
+	Lister() schedulingv1beta1.PriorityClassLister
+}
+
+// PriorityClassIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type PriorityClassIndexInformer cache.TypedSharedIndexInformer[*apischedulingv1beta1.PriorityClass]
+
+// PriorityClassHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for PriorityClass.
+type PriorityClassHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apischedulingv1beta1.PriorityClass]
+
+// PriorityClassDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for PriorityClass.
+type PriorityClassDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apischedulingv1beta1.PriorityClass]
+
+// PriorityClassFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for PriorityClass.
+type PriorityClassFilteringHandler = cache.TypedFilteringResourceEventHandler[*apischedulingv1beta1.PriorityClass]
+
+// PriorityClassIndexers is a specialization of [cache.TypedIndexers] for PriorityClass.
+type PriorityClassIndexers = cache.TypedIndexers[*apischedulingv1beta1.PriorityClass]
+
+// DeletedPriorityClass is a specialization of [cache.DeletedObject] for PriorityClass.
+type DeletedPriorityClass = cache.DeletedObject[*apischedulingv1beta1.PriorityClass]
+
 type priorityClassInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type priorityClassInformer struct {
 // NewPriorityClassInformer constructs a new informer for PriorityClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPriorityClassInformer]).
 func NewPriorityClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewPriorityClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedPriorityClassInformer constructs a new informer for PriorityClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPriorityClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers PriorityClassIndexers) PriorityClassIndexInformer {
+	return NewTypedPriorityClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredPriorityClassInformer constructs a new informer for PriorityClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredPriorityClassInformer]).
 func NewFilteredPriorityClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewPriorityClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedPriorityClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredPriorityClassInformer constructs a new informer for PriorityClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredPriorityClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers PriorityClassIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) PriorityClassIndexInformer {
+	return NewTypedPriorityClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewPriorityClassInformerWithOptions constructs a new informer for PriorityClass type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedPriorityClassInformerWithOptions]).
 func NewPriorityClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedPriorityClassInformerWithOptions(client, options)
+}
+
+// NewTypedPriorityClassInformerWithOptions constructs a new informer for PriorityClass type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedPriorityClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) PriorityClassIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1beta1", Resource: "priorityclasss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1beta1.PriorityClass](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewPriorityClassInformerWithOptions(client kubernetes.Interface, options in
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *priorityClassInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewPriorityClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedPriorityClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *priorityClassInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apischedulingv1beta1.PriorityClass{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *priorityClassInformer) TypedInformer() PriorityClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1beta1.PriorityClass](f.factory.InformerFor(&apischedulingv1beta1.PriorityClass{}, f.defaultInformer))
 }
 
 func (f *priorityClassInformer) Lister() schedulingv1beta1.PriorityClassLister {
 	return schedulingv1beta1.NewPriorityClassLister(f.Informer().GetIndexer())
 }
+
+// ToTypedPriorityClassInformer converts an untyped informer into a TypedPriorityClassInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PriorityClass. If that is not the case, calling type-safe methods of the returned
+// TypedPriorityClassInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedPriorityClassInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedPriorityClassInformer(informer PriorityClassInformer) TypedPriorityClassInformer {
+	if informer, ok := informer.(TypedPriorityClassInformer); ok {
+		return informer
+	}
+	return &priorityClassTypedInformerAdapter{informer}
+}
+
+type priorityClassTypedInformerAdapter struct {
+	PriorityClassInformer
+}
+
+func (a *priorityClassTypedInformerAdapter) TypedInformer() PriorityClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1beta1.PriorityClass](a.Informer())
+}
+
+// ToPriorityClassIndexInformer converts an untyped informer into a PriorityClassIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *PriorityClass. If that is not the case, calling type-safe methods of the returned
+// PriorityClassIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a PriorityClassIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToPriorityClassIndexInformer(informer cache.SharedIndexInformer) PriorityClassIndexInformer {
+	if informer, ok := informer.(PriorityClassIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1beta1.PriorityClass](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/scheduling/v1beta1/workload.go b/vendor/k8s.io/client-go/informers/scheduling/v1beta1/workload.go
new file mode 100644
index 0000000000..86c30f27ea
--- /dev/null
+++ b/vendor/k8s.io/client-go/informers/scheduling/v1beta1/workload.go
@@ -0,0 +1,208 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+	time "time"
+
+	apischedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+	kubernetes "k8s.io/client-go/kubernetes"
+	schedulingv1beta1 "k8s.io/client-go/listers/scheduling/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// WorkloadInformer provides access to a shared informer and lister for
+// Workloads. Prefer using the type-safe variant (see [TypedWorkloadInformer]).
+type WorkloadInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() schedulingv1beta1.WorkloadLister
+}
+
+// TypedWorkloadInformer provides access to a shared informer and lister for
+// Workloads, including the type-safe TypedInformer variant.
+// It is a superset of WorkloadInformer.
+type TypedWorkloadInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() WorkloadIndexInformer
+	Lister() schedulingv1beta1.WorkloadLister
+}
+
+// WorkloadIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type WorkloadIndexInformer cache.TypedSharedIndexInformer[*apischedulingv1beta1.Workload]
+
+// WorkloadHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for Workload.
+type WorkloadHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apischedulingv1beta1.Workload]
+
+// WorkloadDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for Workload.
+type WorkloadDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apischedulingv1beta1.Workload]
+
+// WorkloadFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for Workload.
+type WorkloadFilteringHandler = cache.TypedFilteringResourceEventHandler[*apischedulingv1beta1.Workload]
+
+// WorkloadIndexers is a specialization of [cache.TypedIndexers] for Workload.
+type WorkloadIndexers = cache.TypedIndexers[*apischedulingv1beta1.Workload]
+
+// DeletedWorkload is a specialization of [cache.DeletedObject] for Workload.
+type DeletedWorkload = cache.DeletedObject[*apischedulingv1beta1.Workload]
+
+type workloadInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewWorkloadInformer constructs a new informer for Workload type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedWorkloadInformer]).
+func NewWorkloadInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewWorkloadInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedWorkloadInformer constructs a new informer for Workload type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedWorkloadInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers WorkloadIndexers) WorkloadIndexInformer {
+	return NewTypedWorkloadInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredWorkloadInformer constructs a new informer for Workload type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredWorkloadInformer]).
+func NewFilteredWorkloadInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedWorkloadInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredWorkloadInformer constructs a new informer for Workload type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredWorkloadInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers WorkloadIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) WorkloadIndexInformer {
+	return NewTypedWorkloadInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewWorkloadInformerWithOptions constructs a new informer for Workload type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedWorkloadInformerWithOptions]).
+func NewWorkloadInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedWorkloadInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedWorkloadInformerWithOptions constructs a new informer for Workload type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedWorkloadInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) WorkloadIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1beta1", Resource: "workloads"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1beta1.Workload](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1beta1().Workloads(namespace).List(context.Background(), opts)
+			},
+			WatchFunc: func(opts v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1beta1().Workloads(namespace).Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1beta1().Workloads(namespace).List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.SchedulingV1beta1().Workloads(namespace).Watch(ctx, opts)
+			},
+		}, client),
+		&apischedulingv1beta1.Workload{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *workloadInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedWorkloadInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *workloadInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *workloadInformer) TypedInformer() WorkloadIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1beta1.Workload](f.factory.InformerFor(&apischedulingv1beta1.Workload{}, f.defaultInformer))
+}
+
+func (f *workloadInformer) Lister() schedulingv1beta1.WorkloadLister {
+	return schedulingv1beta1.NewWorkloadLister(f.Informer().GetIndexer())
+}
+
+// ToTypedWorkloadInformer converts an untyped informer into a TypedWorkloadInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Workload. If that is not the case, calling type-safe methods of the returned
+// TypedWorkloadInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedWorkloadInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedWorkloadInformer(informer WorkloadInformer) TypedWorkloadInformer {
+	if informer, ok := informer.(TypedWorkloadInformer); ok {
+		return informer
+	}
+	return &workloadTypedInformerAdapter{informer}
+}
+
+type workloadTypedInformerAdapter struct {
+	WorkloadInformer
+}
+
+func (a *workloadTypedInformerAdapter) TypedInformer() WorkloadIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1beta1.Workload](a.Informer())
+}
+
+// ToWorkloadIndexInformer converts an untyped informer into a WorkloadIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *Workload. If that is not the case, calling type-safe methods of the returned
+// WorkloadIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a WorkloadIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToWorkloadIndexInformer(informer cache.SharedIndexInformer) WorkloadIndexInformer {
+	if informer, ok := informer.(WorkloadIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apischedulingv1beta1.Workload](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storage/v1/csidriver.go b/vendor/k8s.io/client-go/informers/storage/v1/csidriver.go
index 56ed349e26..f7b4d393ea 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1/csidriver.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1/csidriver.go
@@ -34,12 +34,40 @@ import (
 )
 
 // CSIDriverInformer provides access to a shared informer and lister for
-// CSIDrivers.
+// CSIDrivers. Prefer using the type-safe variant (see [TypedCSIDriverInformer]).
 type CSIDriverInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagev1.CSIDriverLister
 }
 
+// TypedCSIDriverInformer provides access to a shared informer and lister for
+// CSIDrivers, including the type-safe TypedInformer variant.
+// It is a superset of CSIDriverInformer.
+type TypedCSIDriverInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() CSIDriverIndexInformer
+	Lister() storagev1.CSIDriverLister
+}
+
+// CSIDriverIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type CSIDriverIndexInformer cache.TypedSharedIndexInformer[*apistoragev1.CSIDriver]
+
+// CSIDriverHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for CSIDriver.
+type CSIDriverHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragev1.CSIDriver]
+
+// CSIDriverDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for CSIDriver.
+type CSIDriverDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragev1.CSIDriver]
+
+// CSIDriverFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for CSIDriver.
+type CSIDriverFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragev1.CSIDriver]
+
+// CSIDriverIndexers is a specialization of [cache.TypedIndexers] for CSIDriver.
+type CSIDriverIndexers = cache.TypedIndexers[*apistoragev1.CSIDriver]
+
+// DeletedCSIDriver is a specialization of [cache.DeletedObject] for CSIDriver.
+type DeletedCSIDriver = cache.DeletedObject[*apistoragev1.CSIDriver]
+
 type cSIDriverInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type cSIDriverInformer struct {
 // NewCSIDriverInformer constructs a new informer for CSIDriver type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSIDriverInformer]).
 func NewCSIDriverInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewCSIDriverInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedCSIDriverInformer constructs a new informer for CSIDriver type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSIDriverInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers CSIDriverIndexers) CSIDriverIndexInformer {
+	return NewTypedCSIDriverInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredCSIDriverInformer constructs a new informer for CSIDriver type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredCSIDriverInformer]).
 func NewFilteredCSIDriverInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewCSIDriverInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedCSIDriverInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredCSIDriverInformer constructs a new informer for CSIDriver type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredCSIDriverInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers CSIDriverIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) CSIDriverIndexInformer {
+	return NewTypedCSIDriverInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewCSIDriverInformerWithOptions constructs a new informer for CSIDriver type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSIDriverInformerWithOptions]).
 func NewCSIDriverInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedCSIDriverInformerWithOptions(client, options)
+}
+
+// NewTypedCSIDriverInformerWithOptions constructs a new informer for CSIDriver type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSIDriverInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) CSIDriverIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1", Resource: "csidrivers"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.CSIDriver](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewCSIDriverInformerWithOptions(client kubernetes.Interface, options intern
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *cSIDriverInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewCSIDriverInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedCSIDriverInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *cSIDriverInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragev1.CSIDriver{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *cSIDriverInformer) TypedInformer() CSIDriverIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.CSIDriver](f.factory.InformerFor(&apistoragev1.CSIDriver{}, f.defaultInformer))
 }
 
 func (f *cSIDriverInformer) Lister() storagev1.CSIDriverLister {
 	return storagev1.NewCSIDriverLister(f.Informer().GetIndexer())
 }
+
+// ToTypedCSIDriverInformer converts an untyped informer into a TypedCSIDriverInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSIDriver. If that is not the case, calling type-safe methods of the returned
+// TypedCSIDriverInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedCSIDriverInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedCSIDriverInformer(informer CSIDriverInformer) TypedCSIDriverInformer {
+	if informer, ok := informer.(TypedCSIDriverInformer); ok {
+		return informer
+	}
+	return &cSIDriverTypedInformerAdapter{informer}
+}
+
+type cSIDriverTypedInformerAdapter struct {
+	CSIDriverInformer
+}
+
+func (a *cSIDriverTypedInformerAdapter) TypedInformer() CSIDriverIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.CSIDriver](a.Informer())
+}
+
+// ToCSIDriverIndexInformer converts an untyped informer into a CSIDriverIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSIDriver. If that is not the case, calling type-safe methods of the returned
+// CSIDriverIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a CSIDriverIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToCSIDriverIndexInformer(informer cache.SharedIndexInformer) CSIDriverIndexInformer {
+	if informer, ok := informer.(CSIDriverIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.CSIDriver](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storage/v1/csinode.go b/vendor/k8s.io/client-go/informers/storage/v1/csinode.go
index c90686bf78..8a841028ba 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1/csinode.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1/csinode.go
@@ -34,12 +34,40 @@ import (
 )
 
 // CSINodeInformer provides access to a shared informer and lister for
-// CSINodes.
+// CSINodes. Prefer using the type-safe variant (see [TypedCSINodeInformer]).
 type CSINodeInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagev1.CSINodeLister
 }
 
+// TypedCSINodeInformer provides access to a shared informer and lister for
+// CSINodes, including the type-safe TypedInformer variant.
+// It is a superset of CSINodeInformer.
+type TypedCSINodeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() CSINodeIndexInformer
+	Lister() storagev1.CSINodeLister
+}
+
+// CSINodeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type CSINodeIndexInformer cache.TypedSharedIndexInformer[*apistoragev1.CSINode]
+
+// CSINodeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for CSINode.
+type CSINodeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragev1.CSINode]
+
+// CSINodeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for CSINode.
+type CSINodeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragev1.CSINode]
+
+// CSINodeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for CSINode.
+type CSINodeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragev1.CSINode]
+
+// CSINodeIndexers is a specialization of [cache.TypedIndexers] for CSINode.
+type CSINodeIndexers = cache.TypedIndexers[*apistoragev1.CSINode]
+
+// DeletedCSINode is a specialization of [cache.DeletedObject] for CSINode.
+type DeletedCSINode = cache.DeletedObject[*apistoragev1.CSINode]
+
 type cSINodeInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type cSINodeInformer struct {
 // NewCSINodeInformer constructs a new informer for CSINode type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSINodeInformer]).
 func NewCSINodeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewCSINodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedCSINodeInformer constructs a new informer for CSINode type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSINodeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers CSINodeIndexers) CSINodeIndexInformer {
+	return NewTypedCSINodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredCSINodeInformer constructs a new informer for CSINode type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredCSINodeInformer]).
 func NewFilteredCSINodeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewCSINodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedCSINodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredCSINodeInformer constructs a new informer for CSINode type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredCSINodeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers CSINodeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) CSINodeIndexInformer {
+	return NewTypedCSINodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewCSINodeInformerWithOptions constructs a new informer for CSINode type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSINodeInformerWithOptions]).
 func NewCSINodeInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedCSINodeInformerWithOptions(client, options)
+}
+
+// NewTypedCSINodeInformerWithOptions constructs a new informer for CSINode type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSINodeInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) CSINodeIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1", Resource: "csinodes"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.CSINode](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewCSINodeInformerWithOptions(client kubernetes.Interface, options internal
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *cSINodeInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewCSINodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedCSINodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *cSINodeInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragev1.CSINode{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *cSINodeInformer) TypedInformer() CSINodeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.CSINode](f.factory.InformerFor(&apistoragev1.CSINode{}, f.defaultInformer))
 }
 
 func (f *cSINodeInformer) Lister() storagev1.CSINodeLister {
 	return storagev1.NewCSINodeLister(f.Informer().GetIndexer())
 }
+
+// ToTypedCSINodeInformer converts an untyped informer into a TypedCSINodeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSINode. If that is not the case, calling type-safe methods of the returned
+// TypedCSINodeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedCSINodeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedCSINodeInformer(informer CSINodeInformer) TypedCSINodeInformer {
+	if informer, ok := informer.(TypedCSINodeInformer); ok {
+		return informer
+	}
+	return &cSINodeTypedInformerAdapter{informer}
+}
+
+type cSINodeTypedInformerAdapter struct {
+	CSINodeInformer
+}
+
+func (a *cSINodeTypedInformerAdapter) TypedInformer() CSINodeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.CSINode](a.Informer())
+}
+
+// ToCSINodeIndexInformer converts an untyped informer into a CSINodeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSINode. If that is not the case, calling type-safe methods of the returned
+// CSINodeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a CSINodeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToCSINodeIndexInformer(informer cache.SharedIndexInformer) CSINodeIndexInformer {
+	if informer, ok := informer.(CSINodeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.CSINode](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storage/v1/csistoragecapacity.go b/vendor/k8s.io/client-go/informers/storage/v1/csistoragecapacity.go
index 52c0e281ac..3052b40d9a 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1/csistoragecapacity.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1/csistoragecapacity.go
@@ -34,12 +34,40 @@ import (
 )
 
 // CSIStorageCapacityInformer provides access to a shared informer and lister for
-// CSIStorageCapacities.
+// CSIStorageCapacities. Prefer using the type-safe variant (see [TypedCSIStorageCapacityInformer]).
 type CSIStorageCapacityInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagev1.CSIStorageCapacityLister
 }
 
+// TypedCSIStorageCapacityInformer provides access to a shared informer and lister for
+// CSIStorageCapacities, including the type-safe TypedInformer variant.
+// It is a superset of CSIStorageCapacityInformer.
+type TypedCSIStorageCapacityInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() CSIStorageCapacityIndexInformer
+	Lister() storagev1.CSIStorageCapacityLister
+}
+
+// CSIStorageCapacityIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type CSIStorageCapacityIndexInformer cache.TypedSharedIndexInformer[*apistoragev1.CSIStorageCapacity]
+
+// CSIStorageCapacityHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for CSIStorageCapacity.
+type CSIStorageCapacityHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragev1.CSIStorageCapacity]
+
+// CSIStorageCapacityDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for CSIStorageCapacity.
+type CSIStorageCapacityDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragev1.CSIStorageCapacity]
+
+// CSIStorageCapacityFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for CSIStorageCapacity.
+type CSIStorageCapacityFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragev1.CSIStorageCapacity]
+
+// CSIStorageCapacityIndexers is a specialization of [cache.TypedIndexers] for CSIStorageCapacity.
+type CSIStorageCapacityIndexers = cache.TypedIndexers[*apistoragev1.CSIStorageCapacity]
+
+// DeletedCSIStorageCapacity is a specialization of [cache.DeletedObject] for CSIStorageCapacity.
+type DeletedCSIStorageCapacity = cache.DeletedObject[*apistoragev1.CSIStorageCapacity]
+
 type cSIStorageCapacityInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type cSIStorageCapacityInformer struct {
 // NewCSIStorageCapacityInformer constructs a new informer for CSIStorageCapacity type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSIStorageCapacityInformer]).
 func NewCSIStorageCapacityInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewCSIStorageCapacityInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedCSIStorageCapacityInformer constructs a new informer for CSIStorageCapacity type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSIStorageCapacityInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers CSIStorageCapacityIndexers) CSIStorageCapacityIndexInformer {
+	return NewTypedCSIStorageCapacityInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredCSIStorageCapacityInformer constructs a new informer for CSIStorageCapacity type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredCSIStorageCapacityInformer]).
 func NewFilteredCSIStorageCapacityInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewCSIStorageCapacityInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedCSIStorageCapacityInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredCSIStorageCapacityInformer constructs a new informer for CSIStorageCapacity type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredCSIStorageCapacityInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers CSIStorageCapacityIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) CSIStorageCapacityIndexInformer {
+	return NewTypedCSIStorageCapacityInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewCSIStorageCapacityInformerWithOptions constructs a new informer for CSIStorageCapacity type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSIStorageCapacityInformerWithOptions]).
 func NewCSIStorageCapacityInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedCSIStorageCapacityInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedCSIStorageCapacityInformerWithOptions constructs a new informer for CSIStorageCapacity type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSIStorageCapacityInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) CSIStorageCapacityIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1", Resource: "csistoragecapacitys"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.CSIStorageCapacity](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewCSIStorageCapacityInformerWithOptions(client kubernetes.Interface, names
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *cSIStorageCapacityInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewCSIStorageCapacityInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedCSIStorageCapacityInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *cSIStorageCapacityInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragev1.CSIStorageCapacity{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *cSIStorageCapacityInformer) TypedInformer() CSIStorageCapacityIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.CSIStorageCapacity](f.factory.InformerFor(&apistoragev1.CSIStorageCapacity{}, f.defaultInformer))
 }
 
 func (f *cSIStorageCapacityInformer) Lister() storagev1.CSIStorageCapacityLister {
 	return storagev1.NewCSIStorageCapacityLister(f.Informer().GetIndexer())
 }
+
+// ToTypedCSIStorageCapacityInformer converts an untyped informer into a TypedCSIStorageCapacityInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSIStorageCapacity. If that is not the case, calling type-safe methods of the returned
+// TypedCSIStorageCapacityInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedCSIStorageCapacityInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedCSIStorageCapacityInformer(informer CSIStorageCapacityInformer) TypedCSIStorageCapacityInformer {
+	if informer, ok := informer.(TypedCSIStorageCapacityInformer); ok {
+		return informer
+	}
+	return &cSIStorageCapacityTypedInformerAdapter{informer}
+}
+
+type cSIStorageCapacityTypedInformerAdapter struct {
+	CSIStorageCapacityInformer
+}
+
+func (a *cSIStorageCapacityTypedInformerAdapter) TypedInformer() CSIStorageCapacityIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.CSIStorageCapacity](a.Informer())
+}
+
+// ToCSIStorageCapacityIndexInformer converts an untyped informer into a CSIStorageCapacityIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSIStorageCapacity. If that is not the case, calling type-safe methods of the returned
+// CSIStorageCapacityIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a CSIStorageCapacityIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToCSIStorageCapacityIndexInformer(informer cache.SharedIndexInformer) CSIStorageCapacityIndexInformer {
+	if informer, ok := informer.(CSIStorageCapacityIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.CSIStorageCapacity](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storage/v1/interface.go b/vendor/k8s.io/client-go/informers/storage/v1/interface.go
index aff778e05c..532e79b5f1 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1/interface.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1/interface.go
@@ -25,17 +25,17 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// CSIDrivers returns a CSIDriverInformer.
-	CSIDrivers() CSIDriverInformer
+	CSIDrivers() TypedCSIDriverInformer
 	// CSINodes returns a CSINodeInformer.
-	CSINodes() CSINodeInformer
+	CSINodes() TypedCSINodeInformer
 	// CSIStorageCapacities returns a CSIStorageCapacityInformer.
-	CSIStorageCapacities() CSIStorageCapacityInformer
+	CSIStorageCapacities() TypedCSIStorageCapacityInformer
 	// StorageClasses returns a StorageClassInformer.
-	StorageClasses() StorageClassInformer
+	StorageClasses() TypedStorageClassInformer
 	// VolumeAttachments returns a VolumeAttachmentInformer.
-	VolumeAttachments() VolumeAttachmentInformer
+	VolumeAttachments() TypedVolumeAttachmentInformer
 	// VolumeAttributesClasses returns a VolumeAttributesClassInformer.
-	VolumeAttributesClasses() VolumeAttributesClassInformer
+	VolumeAttributesClasses() TypedVolumeAttributesClassInformer
 }
 
 type version struct {
@@ -49,32 +49,32 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// CSIDrivers returns a CSIDriverInformer.
-func (v *version) CSIDrivers() CSIDriverInformer {
+// CSIDrivers returns a TypedCSIDriverInformer.
+func (v *version) CSIDrivers() TypedCSIDriverInformer {
 	return &cSIDriverInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// CSINodes returns a CSINodeInformer.
-func (v *version) CSINodes() CSINodeInformer {
+// CSINodes returns a TypedCSINodeInformer.
+func (v *version) CSINodes() TypedCSINodeInformer {
 	return &cSINodeInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// CSIStorageCapacities returns a CSIStorageCapacityInformer.
-func (v *version) CSIStorageCapacities() CSIStorageCapacityInformer {
+// CSIStorageCapacities returns a TypedCSIStorageCapacityInformer.
+func (v *version) CSIStorageCapacities() TypedCSIStorageCapacityInformer {
 	return &cSIStorageCapacityInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// StorageClasses returns a StorageClassInformer.
-func (v *version) StorageClasses() StorageClassInformer {
+// StorageClasses returns a TypedStorageClassInformer.
+func (v *version) StorageClasses() TypedStorageClassInformer {
 	return &storageClassInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// VolumeAttachments returns a VolumeAttachmentInformer.
-func (v *version) VolumeAttachments() VolumeAttachmentInformer {
+// VolumeAttachments returns a TypedVolumeAttachmentInformer.
+func (v *version) VolumeAttachments() TypedVolumeAttachmentInformer {
 	return &volumeAttachmentInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// VolumeAttributesClasses returns a VolumeAttributesClassInformer.
-func (v *version) VolumeAttributesClasses() VolumeAttributesClassInformer {
+// VolumeAttributesClasses returns a TypedVolumeAttributesClassInformer.
+func (v *version) VolumeAttributesClasses() TypedVolumeAttributesClassInformer {
 	return &volumeAttributesClassInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/storage/v1/storageclass.go b/vendor/k8s.io/client-go/informers/storage/v1/storageclass.go
index 533d02fc86..ea123c61a3 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1/storageclass.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1/storageclass.go
@@ -34,12 +34,40 @@ import (
 )
 
 // StorageClassInformer provides access to a shared informer and lister for
-// StorageClasses.
+// StorageClasses. Prefer using the type-safe variant (see [TypedStorageClassInformer]).
 type StorageClassInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagev1.StorageClassLister
 }
 
+// TypedStorageClassInformer provides access to a shared informer and lister for
+// StorageClasses, including the type-safe TypedInformer variant.
+// It is a superset of StorageClassInformer.
+type TypedStorageClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() StorageClassIndexInformer
+	Lister() storagev1.StorageClassLister
+}
+
+// StorageClassIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type StorageClassIndexInformer cache.TypedSharedIndexInformer[*apistoragev1.StorageClass]
+
+// StorageClassHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for StorageClass.
+type StorageClassHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragev1.StorageClass]
+
+// StorageClassDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for StorageClass.
+type StorageClassDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragev1.StorageClass]
+
+// StorageClassFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for StorageClass.
+type StorageClassFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragev1.StorageClass]
+
+// StorageClassIndexers is a specialization of [cache.TypedIndexers] for StorageClass.
+type StorageClassIndexers = cache.TypedIndexers[*apistoragev1.StorageClass]
+
+// DeletedStorageClass is a specialization of [cache.DeletedObject] for StorageClass.
+type DeletedStorageClass = cache.DeletedObject[*apistoragev1.StorageClass]
+
 type storageClassInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type storageClassInformer struct {
 // NewStorageClassInformer constructs a new informer for StorageClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStorageClassInformer]).
 func NewStorageClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewStorageClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedStorageClassInformer constructs a new informer for StorageClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStorageClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers StorageClassIndexers) StorageClassIndexInformer {
+	return NewTypedStorageClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredStorageClassInformer constructs a new informer for StorageClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredStorageClassInformer]).
 func NewFilteredStorageClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewStorageClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedStorageClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredStorageClassInformer constructs a new informer for StorageClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredStorageClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers StorageClassIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) StorageClassIndexInformer {
+	return NewTypedStorageClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewStorageClassInformerWithOptions constructs a new informer for StorageClass type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStorageClassInformerWithOptions]).
 func NewStorageClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedStorageClassInformerWithOptions(client, options)
+}
+
+// NewTypedStorageClassInformerWithOptions constructs a new informer for StorageClass type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStorageClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) StorageClassIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1", Resource: "storageclasss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.StorageClass](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewStorageClassInformerWithOptions(client kubernetes.Interface, options int
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *storageClassInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewStorageClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedStorageClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *storageClassInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragev1.StorageClass{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *storageClassInformer) TypedInformer() StorageClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.StorageClass](f.factory.InformerFor(&apistoragev1.StorageClass{}, f.defaultInformer))
 }
 
 func (f *storageClassInformer) Lister() storagev1.StorageClassLister {
 	return storagev1.NewStorageClassLister(f.Informer().GetIndexer())
 }
+
+// ToTypedStorageClassInformer converts an untyped informer into a TypedStorageClassInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StorageClass. If that is not the case, calling type-safe methods of the returned
+// TypedStorageClassInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedStorageClassInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedStorageClassInformer(informer StorageClassInformer) TypedStorageClassInformer {
+	if informer, ok := informer.(TypedStorageClassInformer); ok {
+		return informer
+	}
+	return &storageClassTypedInformerAdapter{informer}
+}
+
+type storageClassTypedInformerAdapter struct {
+	StorageClassInformer
+}
+
+func (a *storageClassTypedInformerAdapter) TypedInformer() StorageClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.StorageClass](a.Informer())
+}
+
+// ToStorageClassIndexInformer converts an untyped informer into a StorageClassIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StorageClass. If that is not the case, calling type-safe methods of the returned
+// StorageClassIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a StorageClassIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToStorageClassIndexInformer(informer cache.SharedIndexInformer) StorageClassIndexInformer {
+	if informer, ok := informer.(StorageClassIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.StorageClass](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storage/v1/volumeattachment.go b/vendor/k8s.io/client-go/informers/storage/v1/volumeattachment.go
index 49444340ad..fdd91fd740 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1/volumeattachment.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1/volumeattachment.go
@@ -34,12 +34,40 @@ import (
 )
 
 // VolumeAttachmentInformer provides access to a shared informer and lister for
-// VolumeAttachments.
+// VolumeAttachments. Prefer using the type-safe variant (see [TypedVolumeAttachmentInformer]).
 type VolumeAttachmentInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagev1.VolumeAttachmentLister
 }
 
+// TypedVolumeAttachmentInformer provides access to a shared informer and lister for
+// VolumeAttachments, including the type-safe TypedInformer variant.
+// It is a superset of VolumeAttachmentInformer.
+type TypedVolumeAttachmentInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() VolumeAttachmentIndexInformer
+	Lister() storagev1.VolumeAttachmentLister
+}
+
+// VolumeAttachmentIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type VolumeAttachmentIndexInformer cache.TypedSharedIndexInformer[*apistoragev1.VolumeAttachment]
+
+// VolumeAttachmentHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for VolumeAttachment.
+type VolumeAttachmentHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragev1.VolumeAttachment]
+
+// VolumeAttachmentDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for VolumeAttachment.
+type VolumeAttachmentDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragev1.VolumeAttachment]
+
+// VolumeAttachmentFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for VolumeAttachment.
+type VolumeAttachmentFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragev1.VolumeAttachment]
+
+// VolumeAttachmentIndexers is a specialization of [cache.TypedIndexers] for VolumeAttachment.
+type VolumeAttachmentIndexers = cache.TypedIndexers[*apistoragev1.VolumeAttachment]
+
+// DeletedVolumeAttachment is a specialization of [cache.DeletedObject] for VolumeAttachment.
+type DeletedVolumeAttachment = cache.DeletedObject[*apistoragev1.VolumeAttachment]
+
 type volumeAttachmentInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type volumeAttachmentInformer struct {
 // NewVolumeAttachmentInformer constructs a new informer for VolumeAttachment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedVolumeAttachmentInformer]).
 func NewVolumeAttachmentInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedVolumeAttachmentInformer constructs a new informer for VolumeAttachment type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedVolumeAttachmentInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers VolumeAttachmentIndexers) VolumeAttachmentIndexInformer {
+	return NewTypedVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredVolumeAttachmentInformer constructs a new informer for VolumeAttachment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredVolumeAttachmentInformer]).
 func NewFilteredVolumeAttachmentInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredVolumeAttachmentInformer constructs a new informer for VolumeAttachment type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredVolumeAttachmentInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers VolumeAttachmentIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) VolumeAttachmentIndexInformer {
+	return NewTypedVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewVolumeAttachmentInformerWithOptions constructs a new informer for VolumeAttachment type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedVolumeAttachmentInformerWithOptions]).
 func NewVolumeAttachmentInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedVolumeAttachmentInformerWithOptions(client, options)
+}
+
+// NewTypedVolumeAttachmentInformerWithOptions constructs a new informer for VolumeAttachment type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedVolumeAttachmentInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) VolumeAttachmentIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1", Resource: "volumeattachments"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.VolumeAttachment](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewVolumeAttachmentInformerWithOptions(client kubernetes.Interface, options
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *volumeAttachmentInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *volumeAttachmentInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragev1.VolumeAttachment{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *volumeAttachmentInformer) TypedInformer() VolumeAttachmentIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.VolumeAttachment](f.factory.InformerFor(&apistoragev1.VolumeAttachment{}, f.defaultInformer))
 }
 
 func (f *volumeAttachmentInformer) Lister() storagev1.VolumeAttachmentLister {
 	return storagev1.NewVolumeAttachmentLister(f.Informer().GetIndexer())
 }
+
+// ToTypedVolumeAttachmentInformer converts an untyped informer into a TypedVolumeAttachmentInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *VolumeAttachment. If that is not the case, calling type-safe methods of the returned
+// TypedVolumeAttachmentInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedVolumeAttachmentInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedVolumeAttachmentInformer(informer VolumeAttachmentInformer) TypedVolumeAttachmentInformer {
+	if informer, ok := informer.(TypedVolumeAttachmentInformer); ok {
+		return informer
+	}
+	return &volumeAttachmentTypedInformerAdapter{informer}
+}
+
+type volumeAttachmentTypedInformerAdapter struct {
+	VolumeAttachmentInformer
+}
+
+func (a *volumeAttachmentTypedInformerAdapter) TypedInformer() VolumeAttachmentIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.VolumeAttachment](a.Informer())
+}
+
+// ToVolumeAttachmentIndexInformer converts an untyped informer into a VolumeAttachmentIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *VolumeAttachment. If that is not the case, calling type-safe methods of the returned
+// VolumeAttachmentIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a VolumeAttachmentIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToVolumeAttachmentIndexInformer(informer cache.SharedIndexInformer) VolumeAttachmentIndexInformer {
+	if informer, ok := informer.(VolumeAttachmentIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.VolumeAttachment](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storage/v1/volumeattributesclass.go b/vendor/k8s.io/client-go/informers/storage/v1/volumeattributesclass.go
index fa8acccfbd..e41eafe3ba 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1/volumeattributesclass.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1/volumeattributesclass.go
@@ -34,12 +34,40 @@ import (
 )
 
 // VolumeAttributesClassInformer provides access to a shared informer and lister for
-// VolumeAttributesClasses.
+// VolumeAttributesClasses. Prefer using the type-safe variant (see [TypedVolumeAttributesClassInformer]).
 type VolumeAttributesClassInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagev1.VolumeAttributesClassLister
 }
 
+// TypedVolumeAttributesClassInformer provides access to a shared informer and lister for
+// VolumeAttributesClasses, including the type-safe TypedInformer variant.
+// It is a superset of VolumeAttributesClassInformer.
+type TypedVolumeAttributesClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() VolumeAttributesClassIndexInformer
+	Lister() storagev1.VolumeAttributesClassLister
+}
+
+// VolumeAttributesClassIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type VolumeAttributesClassIndexInformer cache.TypedSharedIndexInformer[*apistoragev1.VolumeAttributesClass]
+
+// VolumeAttributesClassHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for VolumeAttributesClass.
+type VolumeAttributesClassHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragev1.VolumeAttributesClass]
+
+// VolumeAttributesClassDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for VolumeAttributesClass.
+type VolumeAttributesClassDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragev1.VolumeAttributesClass]
+
+// VolumeAttributesClassFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for VolumeAttributesClass.
+type VolumeAttributesClassFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragev1.VolumeAttributesClass]
+
+// VolumeAttributesClassIndexers is a specialization of [cache.TypedIndexers] for VolumeAttributesClass.
+type VolumeAttributesClassIndexers = cache.TypedIndexers[*apistoragev1.VolumeAttributesClass]
+
+// DeletedVolumeAttributesClass is a specialization of [cache.DeletedObject] for VolumeAttributesClass.
+type DeletedVolumeAttributesClass = cache.DeletedObject[*apistoragev1.VolumeAttributesClass]
+
 type volumeAttributesClassInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type volumeAttributesClassInformer struct {
 // NewVolumeAttributesClassInformer constructs a new informer for VolumeAttributesClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedVolumeAttributesClassInformer]).
 func NewVolumeAttributesClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedVolumeAttributesClassInformer constructs a new informer for VolumeAttributesClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedVolumeAttributesClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers VolumeAttributesClassIndexers) VolumeAttributesClassIndexInformer {
+	return NewTypedVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredVolumeAttributesClassInformer constructs a new informer for VolumeAttributesClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredVolumeAttributesClassInformer]).
 func NewFilteredVolumeAttributesClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredVolumeAttributesClassInformer constructs a new informer for VolumeAttributesClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredVolumeAttributesClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers VolumeAttributesClassIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) VolumeAttributesClassIndexInformer {
+	return NewTypedVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewVolumeAttributesClassInformerWithOptions constructs a new informer for VolumeAttributesClass type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedVolumeAttributesClassInformerWithOptions]).
 func NewVolumeAttributesClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedVolumeAttributesClassInformerWithOptions(client, options)
+}
+
+// NewTypedVolumeAttributesClassInformerWithOptions constructs a new informer for VolumeAttributesClass type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedVolumeAttributesClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) VolumeAttributesClassIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1", Resource: "volumeattributesclasss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.VolumeAttributesClass](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewVolumeAttributesClassInformerWithOptions(client kubernetes.Interface, op
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *volumeAttributesClassInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *volumeAttributesClassInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragev1.VolumeAttributesClass{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *volumeAttributesClassInformer) TypedInformer() VolumeAttributesClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.VolumeAttributesClass](f.factory.InformerFor(&apistoragev1.VolumeAttributesClass{}, f.defaultInformer))
 }
 
 func (f *volumeAttributesClassInformer) Lister() storagev1.VolumeAttributesClassLister {
 	return storagev1.NewVolumeAttributesClassLister(f.Informer().GetIndexer())
 }
+
+// ToTypedVolumeAttributesClassInformer converts an untyped informer into a TypedVolumeAttributesClassInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *VolumeAttributesClass. If that is not the case, calling type-safe methods of the returned
+// TypedVolumeAttributesClassInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedVolumeAttributesClassInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedVolumeAttributesClassInformer(informer VolumeAttributesClassInformer) TypedVolumeAttributesClassInformer {
+	if informer, ok := informer.(TypedVolumeAttributesClassInformer); ok {
+		return informer
+	}
+	return &volumeAttributesClassTypedInformerAdapter{informer}
+}
+
+type volumeAttributesClassTypedInformerAdapter struct {
+	VolumeAttributesClassInformer
+}
+
+func (a *volumeAttributesClassTypedInformerAdapter) TypedInformer() VolumeAttributesClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.VolumeAttributesClass](a.Informer())
+}
+
+// ToVolumeAttributesClassIndexInformer converts an untyped informer into a VolumeAttributesClassIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *VolumeAttributesClass. If that is not the case, calling type-safe methods of the returned
+// VolumeAttributesClassIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a VolumeAttributesClassIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToVolumeAttributesClassIndexInformer(informer cache.SharedIndexInformer) VolumeAttributesClassIndexInformer {
+	if informer, ok := informer.(VolumeAttributesClassIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragev1.VolumeAttributesClass](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storage/v1alpha1/csistoragecapacity.go b/vendor/k8s.io/client-go/informers/storage/v1alpha1/csistoragecapacity.go
index 2f7accab3d..bfdcc62e31 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1alpha1/csistoragecapacity.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1alpha1/csistoragecapacity.go
@@ -34,12 +34,40 @@ import (
 )
 
 // CSIStorageCapacityInformer provides access to a shared informer and lister for
-// CSIStorageCapacities.
+// CSIStorageCapacities. Prefer using the type-safe variant (see [TypedCSIStorageCapacityInformer]).
 type CSIStorageCapacityInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagev1alpha1.CSIStorageCapacityLister
 }
 
+// TypedCSIStorageCapacityInformer provides access to a shared informer and lister for
+// CSIStorageCapacities, including the type-safe TypedInformer variant.
+// It is a superset of CSIStorageCapacityInformer.
+type TypedCSIStorageCapacityInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() CSIStorageCapacityIndexInformer
+	Lister() storagev1alpha1.CSIStorageCapacityLister
+}
+
+// CSIStorageCapacityIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type CSIStorageCapacityIndexInformer cache.TypedSharedIndexInformer[*apistoragev1alpha1.CSIStorageCapacity]
+
+// CSIStorageCapacityHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for CSIStorageCapacity.
+type CSIStorageCapacityHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragev1alpha1.CSIStorageCapacity]
+
+// CSIStorageCapacityDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for CSIStorageCapacity.
+type CSIStorageCapacityDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragev1alpha1.CSIStorageCapacity]
+
+// CSIStorageCapacityFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for CSIStorageCapacity.
+type CSIStorageCapacityFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragev1alpha1.CSIStorageCapacity]
+
+// CSIStorageCapacityIndexers is a specialization of [cache.TypedIndexers] for CSIStorageCapacity.
+type CSIStorageCapacityIndexers = cache.TypedIndexers[*apistoragev1alpha1.CSIStorageCapacity]
+
+// DeletedCSIStorageCapacity is a specialization of [cache.DeletedObject] for CSIStorageCapacity.
+type DeletedCSIStorageCapacity = cache.DeletedObject[*apistoragev1alpha1.CSIStorageCapacity]
+
 type cSIStorageCapacityInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type cSIStorageCapacityInformer struct {
 // NewCSIStorageCapacityInformer constructs a new informer for CSIStorageCapacity type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSIStorageCapacityInformer]).
 func NewCSIStorageCapacityInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewCSIStorageCapacityInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedCSIStorageCapacityInformer constructs a new informer for CSIStorageCapacity type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSIStorageCapacityInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers CSIStorageCapacityIndexers) CSIStorageCapacityIndexInformer {
+	return NewTypedCSIStorageCapacityInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredCSIStorageCapacityInformer constructs a new informer for CSIStorageCapacity type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredCSIStorageCapacityInformer]).
 func NewFilteredCSIStorageCapacityInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewCSIStorageCapacityInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedCSIStorageCapacityInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredCSIStorageCapacityInformer constructs a new informer for CSIStorageCapacity type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredCSIStorageCapacityInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers CSIStorageCapacityIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) CSIStorageCapacityIndexInformer {
+	return NewTypedCSIStorageCapacityInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewCSIStorageCapacityInformerWithOptions constructs a new informer for CSIStorageCapacity type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSIStorageCapacityInformerWithOptions]).
 func NewCSIStorageCapacityInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedCSIStorageCapacityInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedCSIStorageCapacityInformerWithOptions constructs a new informer for CSIStorageCapacity type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSIStorageCapacityInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) CSIStorageCapacityIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1alpha1", Resource: "csistoragecapacitys"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragev1alpha1.CSIStorageCapacity](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewCSIStorageCapacityInformerWithOptions(client kubernetes.Interface, names
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *cSIStorageCapacityInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewCSIStorageCapacityInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedCSIStorageCapacityInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *cSIStorageCapacityInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragev1alpha1.CSIStorageCapacity{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *cSIStorageCapacityInformer) TypedInformer() CSIStorageCapacityIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1alpha1.CSIStorageCapacity](f.factory.InformerFor(&apistoragev1alpha1.CSIStorageCapacity{}, f.defaultInformer))
 }
 
 func (f *cSIStorageCapacityInformer) Lister() storagev1alpha1.CSIStorageCapacityLister {
 	return storagev1alpha1.NewCSIStorageCapacityLister(f.Informer().GetIndexer())
 }
+
+// ToTypedCSIStorageCapacityInformer converts an untyped informer into a TypedCSIStorageCapacityInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSIStorageCapacity. If that is not the case, calling type-safe methods of the returned
+// TypedCSIStorageCapacityInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedCSIStorageCapacityInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedCSIStorageCapacityInformer(informer CSIStorageCapacityInformer) TypedCSIStorageCapacityInformer {
+	if informer, ok := informer.(TypedCSIStorageCapacityInformer); ok {
+		return informer
+	}
+	return &cSIStorageCapacityTypedInformerAdapter{informer}
+}
+
+type cSIStorageCapacityTypedInformerAdapter struct {
+	CSIStorageCapacityInformer
+}
+
+func (a *cSIStorageCapacityTypedInformerAdapter) TypedInformer() CSIStorageCapacityIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1alpha1.CSIStorageCapacity](a.Informer())
+}
+
+// ToCSIStorageCapacityIndexInformer converts an untyped informer into a CSIStorageCapacityIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSIStorageCapacity. If that is not the case, calling type-safe methods of the returned
+// CSIStorageCapacityIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a CSIStorageCapacityIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToCSIStorageCapacityIndexInformer(informer cache.SharedIndexInformer) CSIStorageCapacityIndexInformer {
+	if informer, ok := informer.(CSIStorageCapacityIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragev1alpha1.CSIStorageCapacity](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storage/v1alpha1/interface.go b/vendor/k8s.io/client-go/informers/storage/v1alpha1/interface.go
index bda3b1add9..5ed95b0efc 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1alpha1/interface.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1alpha1/interface.go
@@ -25,11 +25,11 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// CSIStorageCapacities returns a CSIStorageCapacityInformer.
-	CSIStorageCapacities() CSIStorageCapacityInformer
+	CSIStorageCapacities() TypedCSIStorageCapacityInformer
 	// VolumeAttachments returns a VolumeAttachmentInformer.
-	VolumeAttachments() VolumeAttachmentInformer
+	VolumeAttachments() TypedVolumeAttachmentInformer
 	// VolumeAttributesClasses returns a VolumeAttributesClassInformer.
-	VolumeAttributesClasses() VolumeAttributesClassInformer
+	VolumeAttributesClasses() TypedVolumeAttributesClassInformer
 }
 
 type version struct {
@@ -43,17 +43,17 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// CSIStorageCapacities returns a CSIStorageCapacityInformer.
-func (v *version) CSIStorageCapacities() CSIStorageCapacityInformer {
+// CSIStorageCapacities returns a TypedCSIStorageCapacityInformer.
+func (v *version) CSIStorageCapacities() TypedCSIStorageCapacityInformer {
 	return &cSIStorageCapacityInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// VolumeAttachments returns a VolumeAttachmentInformer.
-func (v *version) VolumeAttachments() VolumeAttachmentInformer {
+// VolumeAttachments returns a TypedVolumeAttachmentInformer.
+func (v *version) VolumeAttachments() TypedVolumeAttachmentInformer {
 	return &volumeAttachmentInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// VolumeAttributesClasses returns a VolumeAttributesClassInformer.
-func (v *version) VolumeAttributesClasses() VolumeAttributesClassInformer {
+// VolumeAttributesClasses returns a TypedVolumeAttributesClassInformer.
+func (v *version) VolumeAttributesClasses() TypedVolumeAttributesClassInformer {
 	return &volumeAttributesClassInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/storage/v1alpha1/volumeattachment.go b/vendor/k8s.io/client-go/informers/storage/v1alpha1/volumeattachment.go
index 1ab135906f..f270fecec0 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1alpha1/volumeattachment.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1alpha1/volumeattachment.go
@@ -34,12 +34,40 @@ import (
 )
 
 // VolumeAttachmentInformer provides access to a shared informer and lister for
-// VolumeAttachments.
+// VolumeAttachments. Prefer using the type-safe variant (see [TypedVolumeAttachmentInformer]).
 type VolumeAttachmentInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagev1alpha1.VolumeAttachmentLister
 }
 
+// TypedVolumeAttachmentInformer provides access to a shared informer and lister for
+// VolumeAttachments, including the type-safe TypedInformer variant.
+// It is a superset of VolumeAttachmentInformer.
+type TypedVolumeAttachmentInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() VolumeAttachmentIndexInformer
+	Lister() storagev1alpha1.VolumeAttachmentLister
+}
+
+// VolumeAttachmentIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type VolumeAttachmentIndexInformer cache.TypedSharedIndexInformer[*apistoragev1alpha1.VolumeAttachment]
+
+// VolumeAttachmentHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for VolumeAttachment.
+type VolumeAttachmentHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragev1alpha1.VolumeAttachment]
+
+// VolumeAttachmentDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for VolumeAttachment.
+type VolumeAttachmentDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragev1alpha1.VolumeAttachment]
+
+// VolumeAttachmentFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for VolumeAttachment.
+type VolumeAttachmentFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragev1alpha1.VolumeAttachment]
+
+// VolumeAttachmentIndexers is a specialization of [cache.TypedIndexers] for VolumeAttachment.
+type VolumeAttachmentIndexers = cache.TypedIndexers[*apistoragev1alpha1.VolumeAttachment]
+
+// DeletedVolumeAttachment is a specialization of [cache.DeletedObject] for VolumeAttachment.
+type DeletedVolumeAttachment = cache.DeletedObject[*apistoragev1alpha1.VolumeAttachment]
+
 type volumeAttachmentInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type volumeAttachmentInformer struct {
 // NewVolumeAttachmentInformer constructs a new informer for VolumeAttachment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedVolumeAttachmentInformer]).
 func NewVolumeAttachmentInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedVolumeAttachmentInformer constructs a new informer for VolumeAttachment type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedVolumeAttachmentInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers VolumeAttachmentIndexers) VolumeAttachmentIndexInformer {
+	return NewTypedVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredVolumeAttachmentInformer constructs a new informer for VolumeAttachment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredVolumeAttachmentInformer]).
 func NewFilteredVolumeAttachmentInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredVolumeAttachmentInformer constructs a new informer for VolumeAttachment type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredVolumeAttachmentInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers VolumeAttachmentIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) VolumeAttachmentIndexInformer {
+	return NewTypedVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewVolumeAttachmentInformerWithOptions constructs a new informer for VolumeAttachment type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedVolumeAttachmentInformerWithOptions]).
 func NewVolumeAttachmentInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedVolumeAttachmentInformerWithOptions(client, options)
+}
+
+// NewTypedVolumeAttachmentInformerWithOptions constructs a new informer for VolumeAttachment type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedVolumeAttachmentInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) VolumeAttachmentIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1alpha1", Resource: "volumeattachments"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragev1alpha1.VolumeAttachment](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewVolumeAttachmentInformerWithOptions(client kubernetes.Interface, options
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *volumeAttachmentInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *volumeAttachmentInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragev1alpha1.VolumeAttachment{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *volumeAttachmentInformer) TypedInformer() VolumeAttachmentIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1alpha1.VolumeAttachment](f.factory.InformerFor(&apistoragev1alpha1.VolumeAttachment{}, f.defaultInformer))
 }
 
 func (f *volumeAttachmentInformer) Lister() storagev1alpha1.VolumeAttachmentLister {
 	return storagev1alpha1.NewVolumeAttachmentLister(f.Informer().GetIndexer())
 }
+
+// ToTypedVolumeAttachmentInformer converts an untyped informer into a TypedVolumeAttachmentInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *VolumeAttachment. If that is not the case, calling type-safe methods of the returned
+// TypedVolumeAttachmentInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedVolumeAttachmentInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedVolumeAttachmentInformer(informer VolumeAttachmentInformer) TypedVolumeAttachmentInformer {
+	if informer, ok := informer.(TypedVolumeAttachmentInformer); ok {
+		return informer
+	}
+	return &volumeAttachmentTypedInformerAdapter{informer}
+}
+
+type volumeAttachmentTypedInformerAdapter struct {
+	VolumeAttachmentInformer
+}
+
+func (a *volumeAttachmentTypedInformerAdapter) TypedInformer() VolumeAttachmentIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1alpha1.VolumeAttachment](a.Informer())
+}
+
+// ToVolumeAttachmentIndexInformer converts an untyped informer into a VolumeAttachmentIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *VolumeAttachment. If that is not the case, calling type-safe methods of the returned
+// VolumeAttachmentIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a VolumeAttachmentIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToVolumeAttachmentIndexInformer(informer cache.SharedIndexInformer) VolumeAttachmentIndexInformer {
+	if informer, ok := informer.(VolumeAttachmentIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragev1alpha1.VolumeAttachment](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storage/v1alpha1/volumeattributesclass.go b/vendor/k8s.io/client-go/informers/storage/v1alpha1/volumeattributesclass.go
index e649c665ee..0ba63295c8 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1alpha1/volumeattributesclass.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1alpha1/volumeattributesclass.go
@@ -34,12 +34,40 @@ import (
 )
 
 // VolumeAttributesClassInformer provides access to a shared informer and lister for
-// VolumeAttributesClasses.
+// VolumeAttributesClasses. Prefer using the type-safe variant (see [TypedVolumeAttributesClassInformer]).
 type VolumeAttributesClassInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagev1alpha1.VolumeAttributesClassLister
 }
 
+// TypedVolumeAttributesClassInformer provides access to a shared informer and lister for
+// VolumeAttributesClasses, including the type-safe TypedInformer variant.
+// It is a superset of VolumeAttributesClassInformer.
+type TypedVolumeAttributesClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() VolumeAttributesClassIndexInformer
+	Lister() storagev1alpha1.VolumeAttributesClassLister
+}
+
+// VolumeAttributesClassIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type VolumeAttributesClassIndexInformer cache.TypedSharedIndexInformer[*apistoragev1alpha1.VolumeAttributesClass]
+
+// VolumeAttributesClassHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for VolumeAttributesClass.
+type VolumeAttributesClassHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragev1alpha1.VolumeAttributesClass]
+
+// VolumeAttributesClassDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for VolumeAttributesClass.
+type VolumeAttributesClassDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragev1alpha1.VolumeAttributesClass]
+
+// VolumeAttributesClassFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for VolumeAttributesClass.
+type VolumeAttributesClassFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragev1alpha1.VolumeAttributesClass]
+
+// VolumeAttributesClassIndexers is a specialization of [cache.TypedIndexers] for VolumeAttributesClass.
+type VolumeAttributesClassIndexers = cache.TypedIndexers[*apistoragev1alpha1.VolumeAttributesClass]
+
+// DeletedVolumeAttributesClass is a specialization of [cache.DeletedObject] for VolumeAttributesClass.
+type DeletedVolumeAttributesClass = cache.DeletedObject[*apistoragev1alpha1.VolumeAttributesClass]
+
 type volumeAttributesClassInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type volumeAttributesClassInformer struct {
 // NewVolumeAttributesClassInformer constructs a new informer for VolumeAttributesClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedVolumeAttributesClassInformer]).
 func NewVolumeAttributesClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedVolumeAttributesClassInformer constructs a new informer for VolumeAttributesClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedVolumeAttributesClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers VolumeAttributesClassIndexers) VolumeAttributesClassIndexInformer {
+	return NewTypedVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredVolumeAttributesClassInformer constructs a new informer for VolumeAttributesClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredVolumeAttributesClassInformer]).
 func NewFilteredVolumeAttributesClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredVolumeAttributesClassInformer constructs a new informer for VolumeAttributesClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredVolumeAttributesClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers VolumeAttributesClassIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) VolumeAttributesClassIndexInformer {
+	return NewTypedVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewVolumeAttributesClassInformerWithOptions constructs a new informer for VolumeAttributesClass type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedVolumeAttributesClassInformerWithOptions]).
 func NewVolumeAttributesClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedVolumeAttributesClassInformerWithOptions(client, options)
+}
+
+// NewTypedVolumeAttributesClassInformerWithOptions constructs a new informer for VolumeAttributesClass type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedVolumeAttributesClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) VolumeAttributesClassIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1alpha1", Resource: "volumeattributesclasss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragev1alpha1.VolumeAttributesClass](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewVolumeAttributesClassInformerWithOptions(client kubernetes.Interface, op
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *volumeAttributesClassInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *volumeAttributesClassInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragev1alpha1.VolumeAttributesClass{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *volumeAttributesClassInformer) TypedInformer() VolumeAttributesClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1alpha1.VolumeAttributesClass](f.factory.InformerFor(&apistoragev1alpha1.VolumeAttributesClass{}, f.defaultInformer))
 }
 
 func (f *volumeAttributesClassInformer) Lister() storagev1alpha1.VolumeAttributesClassLister {
 	return storagev1alpha1.NewVolumeAttributesClassLister(f.Informer().GetIndexer())
 }
+
+// ToTypedVolumeAttributesClassInformer converts an untyped informer into a TypedVolumeAttributesClassInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *VolumeAttributesClass. If that is not the case, calling type-safe methods of the returned
+// TypedVolumeAttributesClassInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedVolumeAttributesClassInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedVolumeAttributesClassInformer(informer VolumeAttributesClassInformer) TypedVolumeAttributesClassInformer {
+	if informer, ok := informer.(TypedVolumeAttributesClassInformer); ok {
+		return informer
+	}
+	return &volumeAttributesClassTypedInformerAdapter{informer}
+}
+
+type volumeAttributesClassTypedInformerAdapter struct {
+	VolumeAttributesClassInformer
+}
+
+func (a *volumeAttributesClassTypedInformerAdapter) TypedInformer() VolumeAttributesClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1alpha1.VolumeAttributesClass](a.Informer())
+}
+
+// ToVolumeAttributesClassIndexInformer converts an untyped informer into a VolumeAttributesClassIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *VolumeAttributesClass. If that is not the case, calling type-safe methods of the returned
+// VolumeAttributesClassIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a VolumeAttributesClassIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToVolumeAttributesClassIndexInformer(informer cache.SharedIndexInformer) VolumeAttributesClassIndexInformer {
+	if informer, ok := informer.(VolumeAttributesClassIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragev1alpha1.VolumeAttributesClass](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storage/v1beta1/csidriver.go b/vendor/k8s.io/client-go/informers/storage/v1beta1/csidriver.go
index 283dc6b17c..33c0f5551a 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1beta1/csidriver.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1beta1/csidriver.go
@@ -34,12 +34,40 @@ import (
 )
 
 // CSIDriverInformer provides access to a shared informer and lister for
-// CSIDrivers.
+// CSIDrivers. Prefer using the type-safe variant (see [TypedCSIDriverInformer]).
 type CSIDriverInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagev1beta1.CSIDriverLister
 }
 
+// TypedCSIDriverInformer provides access to a shared informer and lister for
+// CSIDrivers, including the type-safe TypedInformer variant.
+// It is a superset of CSIDriverInformer.
+type TypedCSIDriverInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() CSIDriverIndexInformer
+	Lister() storagev1beta1.CSIDriverLister
+}
+
+// CSIDriverIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type CSIDriverIndexInformer cache.TypedSharedIndexInformer[*apistoragev1beta1.CSIDriver]
+
+// CSIDriverHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for CSIDriver.
+type CSIDriverHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragev1beta1.CSIDriver]
+
+// CSIDriverDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for CSIDriver.
+type CSIDriverDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragev1beta1.CSIDriver]
+
+// CSIDriverFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for CSIDriver.
+type CSIDriverFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragev1beta1.CSIDriver]
+
+// CSIDriverIndexers is a specialization of [cache.TypedIndexers] for CSIDriver.
+type CSIDriverIndexers = cache.TypedIndexers[*apistoragev1beta1.CSIDriver]
+
+// DeletedCSIDriver is a specialization of [cache.DeletedObject] for CSIDriver.
+type DeletedCSIDriver = cache.DeletedObject[*apistoragev1beta1.CSIDriver]
+
 type cSIDriverInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type cSIDriverInformer struct {
 // NewCSIDriverInformer constructs a new informer for CSIDriver type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSIDriverInformer]).
 func NewCSIDriverInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewCSIDriverInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedCSIDriverInformer constructs a new informer for CSIDriver type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSIDriverInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers CSIDriverIndexers) CSIDriverIndexInformer {
+	return NewTypedCSIDriverInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredCSIDriverInformer constructs a new informer for CSIDriver type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredCSIDriverInformer]).
 func NewFilteredCSIDriverInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewCSIDriverInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedCSIDriverInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredCSIDriverInformer constructs a new informer for CSIDriver type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredCSIDriverInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers CSIDriverIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) CSIDriverIndexInformer {
+	return NewTypedCSIDriverInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewCSIDriverInformerWithOptions constructs a new informer for CSIDriver type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSIDriverInformerWithOptions]).
 func NewCSIDriverInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedCSIDriverInformerWithOptions(client, options)
+}
+
+// NewTypedCSIDriverInformerWithOptions constructs a new informer for CSIDriver type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSIDriverInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) CSIDriverIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1beta1", Resource: "csidrivers"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.CSIDriver](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewCSIDriverInformerWithOptions(client kubernetes.Interface, options intern
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *cSIDriverInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewCSIDriverInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedCSIDriverInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *cSIDriverInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragev1beta1.CSIDriver{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *cSIDriverInformer) TypedInformer() CSIDriverIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.CSIDriver](f.factory.InformerFor(&apistoragev1beta1.CSIDriver{}, f.defaultInformer))
 }
 
 func (f *cSIDriverInformer) Lister() storagev1beta1.CSIDriverLister {
 	return storagev1beta1.NewCSIDriverLister(f.Informer().GetIndexer())
 }
+
+// ToTypedCSIDriverInformer converts an untyped informer into a TypedCSIDriverInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSIDriver. If that is not the case, calling type-safe methods of the returned
+// TypedCSIDriverInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedCSIDriverInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedCSIDriverInformer(informer CSIDriverInformer) TypedCSIDriverInformer {
+	if informer, ok := informer.(TypedCSIDriverInformer); ok {
+		return informer
+	}
+	return &cSIDriverTypedInformerAdapter{informer}
+}
+
+type cSIDriverTypedInformerAdapter struct {
+	CSIDriverInformer
+}
+
+func (a *cSIDriverTypedInformerAdapter) TypedInformer() CSIDriverIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.CSIDriver](a.Informer())
+}
+
+// ToCSIDriverIndexInformer converts an untyped informer into a CSIDriverIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSIDriver. If that is not the case, calling type-safe methods of the returned
+// CSIDriverIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a CSIDriverIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToCSIDriverIndexInformer(informer cache.SharedIndexInformer) CSIDriverIndexInformer {
+	if informer, ok := informer.(CSIDriverIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.CSIDriver](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storage/v1beta1/csinode.go b/vendor/k8s.io/client-go/informers/storage/v1beta1/csinode.go
index f304906ce7..4e7fa6f560 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1beta1/csinode.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1beta1/csinode.go
@@ -34,12 +34,40 @@ import (
 )
 
 // CSINodeInformer provides access to a shared informer and lister for
-// CSINodes.
+// CSINodes. Prefer using the type-safe variant (see [TypedCSINodeInformer]).
 type CSINodeInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagev1beta1.CSINodeLister
 }
 
+// TypedCSINodeInformer provides access to a shared informer and lister for
+// CSINodes, including the type-safe TypedInformer variant.
+// It is a superset of CSINodeInformer.
+type TypedCSINodeInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() CSINodeIndexInformer
+	Lister() storagev1beta1.CSINodeLister
+}
+
+// CSINodeIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type CSINodeIndexInformer cache.TypedSharedIndexInformer[*apistoragev1beta1.CSINode]
+
+// CSINodeHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for CSINode.
+type CSINodeHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragev1beta1.CSINode]
+
+// CSINodeDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for CSINode.
+type CSINodeDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragev1beta1.CSINode]
+
+// CSINodeFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for CSINode.
+type CSINodeFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragev1beta1.CSINode]
+
+// CSINodeIndexers is a specialization of [cache.TypedIndexers] for CSINode.
+type CSINodeIndexers = cache.TypedIndexers[*apistoragev1beta1.CSINode]
+
+// DeletedCSINode is a specialization of [cache.DeletedObject] for CSINode.
+type DeletedCSINode = cache.DeletedObject[*apistoragev1beta1.CSINode]
+
 type cSINodeInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type cSINodeInformer struct {
 // NewCSINodeInformer constructs a new informer for CSINode type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSINodeInformer]).
 func NewCSINodeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewCSINodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedCSINodeInformer constructs a new informer for CSINode type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSINodeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers CSINodeIndexers) CSINodeIndexInformer {
+	return NewTypedCSINodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredCSINodeInformer constructs a new informer for CSINode type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredCSINodeInformer]).
 func NewFilteredCSINodeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewCSINodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedCSINodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredCSINodeInformer constructs a new informer for CSINode type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredCSINodeInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers CSINodeIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) CSINodeIndexInformer {
+	return NewTypedCSINodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewCSINodeInformerWithOptions constructs a new informer for CSINode type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSINodeInformerWithOptions]).
 func NewCSINodeInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedCSINodeInformerWithOptions(client, options)
+}
+
+// NewTypedCSINodeInformerWithOptions constructs a new informer for CSINode type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSINodeInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) CSINodeIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1beta1", Resource: "csinodes"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.CSINode](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewCSINodeInformerWithOptions(client kubernetes.Interface, options internal
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *cSINodeInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewCSINodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedCSINodeInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *cSINodeInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragev1beta1.CSINode{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *cSINodeInformer) TypedInformer() CSINodeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.CSINode](f.factory.InformerFor(&apistoragev1beta1.CSINode{}, f.defaultInformer))
 }
 
 func (f *cSINodeInformer) Lister() storagev1beta1.CSINodeLister {
 	return storagev1beta1.NewCSINodeLister(f.Informer().GetIndexer())
 }
+
+// ToTypedCSINodeInformer converts an untyped informer into a TypedCSINodeInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSINode. If that is not the case, calling type-safe methods of the returned
+// TypedCSINodeInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedCSINodeInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedCSINodeInformer(informer CSINodeInformer) TypedCSINodeInformer {
+	if informer, ok := informer.(TypedCSINodeInformer); ok {
+		return informer
+	}
+	return &cSINodeTypedInformerAdapter{informer}
+}
+
+type cSINodeTypedInformerAdapter struct {
+	CSINodeInformer
+}
+
+func (a *cSINodeTypedInformerAdapter) TypedInformer() CSINodeIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.CSINode](a.Informer())
+}
+
+// ToCSINodeIndexInformer converts an untyped informer into a CSINodeIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSINode. If that is not the case, calling type-safe methods of the returned
+// CSINodeIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a CSINodeIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToCSINodeIndexInformer(informer cache.SharedIndexInformer) CSINodeIndexInformer {
+	if informer, ok := informer.(CSINodeIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.CSINode](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storage/v1beta1/csistoragecapacity.go b/vendor/k8s.io/client-go/informers/storage/v1beta1/csistoragecapacity.go
index 5b24a8c32b..26c7cdb54d 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1beta1/csistoragecapacity.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1beta1/csistoragecapacity.go
@@ -34,12 +34,40 @@ import (
 )
 
 // CSIStorageCapacityInformer provides access to a shared informer and lister for
-// CSIStorageCapacities.
+// CSIStorageCapacities. Prefer using the type-safe variant (see [TypedCSIStorageCapacityInformer]).
 type CSIStorageCapacityInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagev1beta1.CSIStorageCapacityLister
 }
 
+// TypedCSIStorageCapacityInformer provides access to a shared informer and lister for
+// CSIStorageCapacities, including the type-safe TypedInformer variant.
+// It is a superset of CSIStorageCapacityInformer.
+type TypedCSIStorageCapacityInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() CSIStorageCapacityIndexInformer
+	Lister() storagev1beta1.CSIStorageCapacityLister
+}
+
+// CSIStorageCapacityIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type CSIStorageCapacityIndexInformer cache.TypedSharedIndexInformer[*apistoragev1beta1.CSIStorageCapacity]
+
+// CSIStorageCapacityHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for CSIStorageCapacity.
+type CSIStorageCapacityHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragev1beta1.CSIStorageCapacity]
+
+// CSIStorageCapacityDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for CSIStorageCapacity.
+type CSIStorageCapacityDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragev1beta1.CSIStorageCapacity]
+
+// CSIStorageCapacityFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for CSIStorageCapacity.
+type CSIStorageCapacityFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragev1beta1.CSIStorageCapacity]
+
+// CSIStorageCapacityIndexers is a specialization of [cache.TypedIndexers] for CSIStorageCapacity.
+type CSIStorageCapacityIndexers = cache.TypedIndexers[*apistoragev1beta1.CSIStorageCapacity]
+
+// DeletedCSIStorageCapacity is a specialization of [cache.DeletedObject] for CSIStorageCapacity.
+type DeletedCSIStorageCapacity = cache.DeletedObject[*apistoragev1beta1.CSIStorageCapacity]
+
 type cSIStorageCapacityInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -49,25 +77,49 @@ type cSIStorageCapacityInformer struct {
 // NewCSIStorageCapacityInformer constructs a new informer for CSIStorageCapacity type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSIStorageCapacityInformer]).
 func NewCSIStorageCapacityInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewCSIStorageCapacityInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedCSIStorageCapacityInformer constructs a new informer for CSIStorageCapacity type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSIStorageCapacityInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers CSIStorageCapacityIndexers) CSIStorageCapacityIndexInformer {
+	return NewTypedCSIStorageCapacityInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredCSIStorageCapacityInformer constructs a new informer for CSIStorageCapacity type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredCSIStorageCapacityInformer]).
 func NewFilteredCSIStorageCapacityInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewCSIStorageCapacityInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedCSIStorageCapacityInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredCSIStorageCapacityInformer constructs a new informer for CSIStorageCapacity type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredCSIStorageCapacityInformer(client kubernetes.Interface, namespace string, resyncPeriod time.Duration, indexers CSIStorageCapacityIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) CSIStorageCapacityIndexInformer {
+	return NewTypedCSIStorageCapacityInformerWithOptions(client, namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewCSIStorageCapacityInformerWithOptions constructs a new informer for CSIStorageCapacity type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedCSIStorageCapacityInformerWithOptions]).
 func NewCSIStorageCapacityInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedCSIStorageCapacityInformerWithOptions(client, namespace, options)
+}
+
+// NewTypedCSIStorageCapacityInformerWithOptions constructs a new informer for CSIStorageCapacity type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedCSIStorageCapacityInformerWithOptions(client kubernetes.Interface, namespace string, options internalinterfaces.InformerOptions) CSIStorageCapacityIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1beta1", Resource: "csistoragecapacitys"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.CSIStorageCapacity](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -100,17 +152,57 @@ func NewCSIStorageCapacityInformerWithOptions(client kubernetes.Interface, names
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *cSIStorageCapacityInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewCSIStorageCapacityInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedCSIStorageCapacityInformerWithOptions(client, f.namespace, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *cSIStorageCapacityInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragev1beta1.CSIStorageCapacity{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *cSIStorageCapacityInformer) TypedInformer() CSIStorageCapacityIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.CSIStorageCapacity](f.factory.InformerFor(&apistoragev1beta1.CSIStorageCapacity{}, f.defaultInformer))
 }
 
 func (f *cSIStorageCapacityInformer) Lister() storagev1beta1.CSIStorageCapacityLister {
 	return storagev1beta1.NewCSIStorageCapacityLister(f.Informer().GetIndexer())
 }
+
+// ToTypedCSIStorageCapacityInformer converts an untyped informer into a TypedCSIStorageCapacityInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSIStorageCapacity. If that is not the case, calling type-safe methods of the returned
+// TypedCSIStorageCapacityInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedCSIStorageCapacityInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedCSIStorageCapacityInformer(informer CSIStorageCapacityInformer) TypedCSIStorageCapacityInformer {
+	if informer, ok := informer.(TypedCSIStorageCapacityInformer); ok {
+		return informer
+	}
+	return &cSIStorageCapacityTypedInformerAdapter{informer}
+}
+
+type cSIStorageCapacityTypedInformerAdapter struct {
+	CSIStorageCapacityInformer
+}
+
+func (a *cSIStorageCapacityTypedInformerAdapter) TypedInformer() CSIStorageCapacityIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.CSIStorageCapacity](a.Informer())
+}
+
+// ToCSIStorageCapacityIndexInformer converts an untyped informer into a CSIStorageCapacityIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *CSIStorageCapacity. If that is not the case, calling type-safe methods of the returned
+// CSIStorageCapacityIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a CSIStorageCapacityIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToCSIStorageCapacityIndexInformer(informer cache.SharedIndexInformer) CSIStorageCapacityIndexInformer {
+	if informer, ok := informer.(CSIStorageCapacityIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.CSIStorageCapacity](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storage/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/storage/v1beta1/interface.go
index 7433951855..a1a312170c 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1beta1/interface.go
@@ -25,17 +25,17 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// CSIDrivers returns a CSIDriverInformer.
-	CSIDrivers() CSIDriverInformer
+	CSIDrivers() TypedCSIDriverInformer
 	// CSINodes returns a CSINodeInformer.
-	CSINodes() CSINodeInformer
+	CSINodes() TypedCSINodeInformer
 	// CSIStorageCapacities returns a CSIStorageCapacityInformer.
-	CSIStorageCapacities() CSIStorageCapacityInformer
+	CSIStorageCapacities() TypedCSIStorageCapacityInformer
 	// StorageClasses returns a StorageClassInformer.
-	StorageClasses() StorageClassInformer
+	StorageClasses() TypedStorageClassInformer
 	// VolumeAttachments returns a VolumeAttachmentInformer.
-	VolumeAttachments() VolumeAttachmentInformer
+	VolumeAttachments() TypedVolumeAttachmentInformer
 	// VolumeAttributesClasses returns a VolumeAttributesClassInformer.
-	VolumeAttributesClasses() VolumeAttributesClassInformer
+	VolumeAttributesClasses() TypedVolumeAttributesClassInformer
 }
 
 type version struct {
@@ -49,32 +49,32 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// CSIDrivers returns a CSIDriverInformer.
-func (v *version) CSIDrivers() CSIDriverInformer {
+// CSIDrivers returns a TypedCSIDriverInformer.
+func (v *version) CSIDrivers() TypedCSIDriverInformer {
 	return &cSIDriverInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// CSINodes returns a CSINodeInformer.
-func (v *version) CSINodes() CSINodeInformer {
+// CSINodes returns a TypedCSINodeInformer.
+func (v *version) CSINodes() TypedCSINodeInformer {
 	return &cSINodeInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// CSIStorageCapacities returns a CSIStorageCapacityInformer.
-func (v *version) CSIStorageCapacities() CSIStorageCapacityInformer {
+// CSIStorageCapacities returns a TypedCSIStorageCapacityInformer.
+func (v *version) CSIStorageCapacities() TypedCSIStorageCapacityInformer {
 	return &cSIStorageCapacityInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
-// StorageClasses returns a StorageClassInformer.
-func (v *version) StorageClasses() StorageClassInformer {
+// StorageClasses returns a TypedStorageClassInformer.
+func (v *version) StorageClasses() TypedStorageClassInformer {
 	return &storageClassInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// VolumeAttachments returns a VolumeAttachmentInformer.
-func (v *version) VolumeAttachments() VolumeAttachmentInformer {
+// VolumeAttachments returns a TypedVolumeAttachmentInformer.
+func (v *version) VolumeAttachments() TypedVolumeAttachmentInformer {
 	return &volumeAttachmentInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// VolumeAttributesClasses returns a VolumeAttributesClassInformer.
-func (v *version) VolumeAttributesClasses() VolumeAttributesClassInformer {
+// VolumeAttributesClasses returns a TypedVolumeAttributesClassInformer.
+func (v *version) VolumeAttributesClasses() TypedVolumeAttributesClassInformer {
 	return &volumeAttributesClassInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/storage/v1beta1/storageclass.go b/vendor/k8s.io/client-go/informers/storage/v1beta1/storageclass.go
index 2052da70e9..55bbe4446b 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1beta1/storageclass.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1beta1/storageclass.go
@@ -34,12 +34,40 @@ import (
 )
 
 // StorageClassInformer provides access to a shared informer and lister for
-// StorageClasses.
+// StorageClasses. Prefer using the type-safe variant (see [TypedStorageClassInformer]).
 type StorageClassInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagev1beta1.StorageClassLister
 }
 
+// TypedStorageClassInformer provides access to a shared informer and lister for
+// StorageClasses, including the type-safe TypedInformer variant.
+// It is a superset of StorageClassInformer.
+type TypedStorageClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() StorageClassIndexInformer
+	Lister() storagev1beta1.StorageClassLister
+}
+
+// StorageClassIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type StorageClassIndexInformer cache.TypedSharedIndexInformer[*apistoragev1beta1.StorageClass]
+
+// StorageClassHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for StorageClass.
+type StorageClassHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragev1beta1.StorageClass]
+
+// StorageClassDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for StorageClass.
+type StorageClassDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragev1beta1.StorageClass]
+
+// StorageClassFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for StorageClass.
+type StorageClassFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragev1beta1.StorageClass]
+
+// StorageClassIndexers is a specialization of [cache.TypedIndexers] for StorageClass.
+type StorageClassIndexers = cache.TypedIndexers[*apistoragev1beta1.StorageClass]
+
+// DeletedStorageClass is a specialization of [cache.DeletedObject] for StorageClass.
+type DeletedStorageClass = cache.DeletedObject[*apistoragev1beta1.StorageClass]
+
 type storageClassInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type storageClassInformer struct {
 // NewStorageClassInformer constructs a new informer for StorageClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStorageClassInformer]).
 func NewStorageClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewStorageClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedStorageClassInformer constructs a new informer for StorageClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStorageClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers StorageClassIndexers) StorageClassIndexInformer {
+	return NewTypedStorageClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredStorageClassInformer constructs a new informer for StorageClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredStorageClassInformer]).
 func NewFilteredStorageClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewStorageClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedStorageClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredStorageClassInformer constructs a new informer for StorageClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredStorageClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers StorageClassIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) StorageClassIndexInformer {
+	return NewTypedStorageClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewStorageClassInformerWithOptions constructs a new informer for StorageClass type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStorageClassInformerWithOptions]).
 func NewStorageClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedStorageClassInformerWithOptions(client, options)
+}
+
+// NewTypedStorageClassInformerWithOptions constructs a new informer for StorageClass type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStorageClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) StorageClassIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1beta1", Resource: "storageclasss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.StorageClass](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewStorageClassInformerWithOptions(client kubernetes.Interface, options int
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *storageClassInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewStorageClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedStorageClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *storageClassInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragev1beta1.StorageClass{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *storageClassInformer) TypedInformer() StorageClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.StorageClass](f.factory.InformerFor(&apistoragev1beta1.StorageClass{}, f.defaultInformer))
 }
 
 func (f *storageClassInformer) Lister() storagev1beta1.StorageClassLister {
 	return storagev1beta1.NewStorageClassLister(f.Informer().GetIndexer())
 }
+
+// ToTypedStorageClassInformer converts an untyped informer into a TypedStorageClassInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StorageClass. If that is not the case, calling type-safe methods of the returned
+// TypedStorageClassInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedStorageClassInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedStorageClassInformer(informer StorageClassInformer) TypedStorageClassInformer {
+	if informer, ok := informer.(TypedStorageClassInformer); ok {
+		return informer
+	}
+	return &storageClassTypedInformerAdapter{informer}
+}
+
+type storageClassTypedInformerAdapter struct {
+	StorageClassInformer
+}
+
+func (a *storageClassTypedInformerAdapter) TypedInformer() StorageClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.StorageClass](a.Informer())
+}
+
+// ToStorageClassIndexInformer converts an untyped informer into a StorageClassIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StorageClass. If that is not the case, calling type-safe methods of the returned
+// StorageClassIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a StorageClassIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToStorageClassIndexInformer(informer cache.SharedIndexInformer) StorageClassIndexInformer {
+	if informer, ok := informer.(StorageClassIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.StorageClass](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storage/v1beta1/volumeattachment.go b/vendor/k8s.io/client-go/informers/storage/v1beta1/volumeattachment.go
index 11f9840b04..d288cba131 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1beta1/volumeattachment.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1beta1/volumeattachment.go
@@ -34,12 +34,40 @@ import (
 )
 
 // VolumeAttachmentInformer provides access to a shared informer and lister for
-// VolumeAttachments.
+// VolumeAttachments. Prefer using the type-safe variant (see [TypedVolumeAttachmentInformer]).
 type VolumeAttachmentInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagev1beta1.VolumeAttachmentLister
 }
 
+// TypedVolumeAttachmentInformer provides access to a shared informer and lister for
+// VolumeAttachments, including the type-safe TypedInformer variant.
+// It is a superset of VolumeAttachmentInformer.
+type TypedVolumeAttachmentInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() VolumeAttachmentIndexInformer
+	Lister() storagev1beta1.VolumeAttachmentLister
+}
+
+// VolumeAttachmentIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type VolumeAttachmentIndexInformer cache.TypedSharedIndexInformer[*apistoragev1beta1.VolumeAttachment]
+
+// VolumeAttachmentHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for VolumeAttachment.
+type VolumeAttachmentHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragev1beta1.VolumeAttachment]
+
+// VolumeAttachmentDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for VolumeAttachment.
+type VolumeAttachmentDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragev1beta1.VolumeAttachment]
+
+// VolumeAttachmentFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for VolumeAttachment.
+type VolumeAttachmentFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragev1beta1.VolumeAttachment]
+
+// VolumeAttachmentIndexers is a specialization of [cache.TypedIndexers] for VolumeAttachment.
+type VolumeAttachmentIndexers = cache.TypedIndexers[*apistoragev1beta1.VolumeAttachment]
+
+// DeletedVolumeAttachment is a specialization of [cache.DeletedObject] for VolumeAttachment.
+type DeletedVolumeAttachment = cache.DeletedObject[*apistoragev1beta1.VolumeAttachment]
+
 type volumeAttachmentInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type volumeAttachmentInformer struct {
 // NewVolumeAttachmentInformer constructs a new informer for VolumeAttachment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedVolumeAttachmentInformer]).
 func NewVolumeAttachmentInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedVolumeAttachmentInformer constructs a new informer for VolumeAttachment type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedVolumeAttachmentInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers VolumeAttachmentIndexers) VolumeAttachmentIndexInformer {
+	return NewTypedVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredVolumeAttachmentInformer constructs a new informer for VolumeAttachment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredVolumeAttachmentInformer]).
 func NewFilteredVolumeAttachmentInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredVolumeAttachmentInformer constructs a new informer for VolumeAttachment type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredVolumeAttachmentInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers VolumeAttachmentIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) VolumeAttachmentIndexInformer {
+	return NewTypedVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewVolumeAttachmentInformerWithOptions constructs a new informer for VolumeAttachment type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedVolumeAttachmentInformerWithOptions]).
 func NewVolumeAttachmentInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedVolumeAttachmentInformerWithOptions(client, options)
+}
+
+// NewTypedVolumeAttachmentInformerWithOptions constructs a new informer for VolumeAttachment type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedVolumeAttachmentInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) VolumeAttachmentIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1beta1", Resource: "volumeattachments"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.VolumeAttachment](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewVolumeAttachmentInformerWithOptions(client kubernetes.Interface, options
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *volumeAttachmentInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedVolumeAttachmentInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *volumeAttachmentInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragev1beta1.VolumeAttachment{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *volumeAttachmentInformer) TypedInformer() VolumeAttachmentIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.VolumeAttachment](f.factory.InformerFor(&apistoragev1beta1.VolumeAttachment{}, f.defaultInformer))
 }
 
 func (f *volumeAttachmentInformer) Lister() storagev1beta1.VolumeAttachmentLister {
 	return storagev1beta1.NewVolumeAttachmentLister(f.Informer().GetIndexer())
 }
+
+// ToTypedVolumeAttachmentInformer converts an untyped informer into a TypedVolumeAttachmentInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *VolumeAttachment. If that is not the case, calling type-safe methods of the returned
+// TypedVolumeAttachmentInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedVolumeAttachmentInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedVolumeAttachmentInformer(informer VolumeAttachmentInformer) TypedVolumeAttachmentInformer {
+	if informer, ok := informer.(TypedVolumeAttachmentInformer); ok {
+		return informer
+	}
+	return &volumeAttachmentTypedInformerAdapter{informer}
+}
+
+type volumeAttachmentTypedInformerAdapter struct {
+	VolumeAttachmentInformer
+}
+
+func (a *volumeAttachmentTypedInformerAdapter) TypedInformer() VolumeAttachmentIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.VolumeAttachment](a.Informer())
+}
+
+// ToVolumeAttachmentIndexInformer converts an untyped informer into a VolumeAttachmentIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *VolumeAttachment. If that is not the case, calling type-safe methods of the returned
+// VolumeAttachmentIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a VolumeAttachmentIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToVolumeAttachmentIndexInformer(informer cache.SharedIndexInformer) VolumeAttachmentIndexInformer {
+	if informer, ok := informer.(VolumeAttachmentIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.VolumeAttachment](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storage/v1beta1/volumeattributesclass.go b/vendor/k8s.io/client-go/informers/storage/v1beta1/volumeattributesclass.go
index c91dfff0d1..c37a0a22d8 100644
--- a/vendor/k8s.io/client-go/informers/storage/v1beta1/volumeattributesclass.go
+++ b/vendor/k8s.io/client-go/informers/storage/v1beta1/volumeattributesclass.go
@@ -34,12 +34,40 @@ import (
 )
 
 // VolumeAttributesClassInformer provides access to a shared informer and lister for
-// VolumeAttributesClasses.
+// VolumeAttributesClasses. Prefer using the type-safe variant (see [TypedVolumeAttributesClassInformer]).
 type VolumeAttributesClassInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagev1beta1.VolumeAttributesClassLister
 }
 
+// TypedVolumeAttributesClassInformer provides access to a shared informer and lister for
+// VolumeAttributesClasses, including the type-safe TypedInformer variant.
+// It is a superset of VolumeAttributesClassInformer.
+type TypedVolumeAttributesClassInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() VolumeAttributesClassIndexInformer
+	Lister() storagev1beta1.VolumeAttributesClassLister
+}
+
+// VolumeAttributesClassIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type VolumeAttributesClassIndexInformer cache.TypedSharedIndexInformer[*apistoragev1beta1.VolumeAttributesClass]
+
+// VolumeAttributesClassHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for VolumeAttributesClass.
+type VolumeAttributesClassHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragev1beta1.VolumeAttributesClass]
+
+// VolumeAttributesClassDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for VolumeAttributesClass.
+type VolumeAttributesClassDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragev1beta1.VolumeAttributesClass]
+
+// VolumeAttributesClassFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for VolumeAttributesClass.
+type VolumeAttributesClassFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragev1beta1.VolumeAttributesClass]
+
+// VolumeAttributesClassIndexers is a specialization of [cache.TypedIndexers] for VolumeAttributesClass.
+type VolumeAttributesClassIndexers = cache.TypedIndexers[*apistoragev1beta1.VolumeAttributesClass]
+
+// DeletedVolumeAttributesClass is a specialization of [cache.DeletedObject] for VolumeAttributesClass.
+type DeletedVolumeAttributesClass = cache.DeletedObject[*apistoragev1beta1.VolumeAttributesClass]
+
 type volumeAttributesClassInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type volumeAttributesClassInformer struct {
 // NewVolumeAttributesClassInformer constructs a new informer for VolumeAttributesClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedVolumeAttributesClassInformer]).
 func NewVolumeAttributesClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedVolumeAttributesClassInformer constructs a new informer for VolumeAttributesClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedVolumeAttributesClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers VolumeAttributesClassIndexers) VolumeAttributesClassIndexInformer {
+	return NewTypedVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredVolumeAttributesClassInformer constructs a new informer for VolumeAttributesClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredVolumeAttributesClassInformer]).
 func NewFilteredVolumeAttributesClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredVolumeAttributesClassInformer constructs a new informer for VolumeAttributesClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredVolumeAttributesClassInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers VolumeAttributesClassIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) VolumeAttributesClassIndexInformer {
+	return NewTypedVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewVolumeAttributesClassInformerWithOptions constructs a new informer for VolumeAttributesClass type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedVolumeAttributesClassInformerWithOptions]).
 func NewVolumeAttributesClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedVolumeAttributesClassInformerWithOptions(client, options)
+}
+
+// NewTypedVolumeAttributesClassInformerWithOptions constructs a new informer for VolumeAttributesClass type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedVolumeAttributesClassInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) VolumeAttributesClassIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1beta1", Resource: "volumeattributesclasss"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.VolumeAttributesClass](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewVolumeAttributesClassInformerWithOptions(client kubernetes.Interface, op
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *volumeAttributesClassInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedVolumeAttributesClassInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *volumeAttributesClassInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragev1beta1.VolumeAttributesClass{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *volumeAttributesClassInformer) TypedInformer() VolumeAttributesClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.VolumeAttributesClass](f.factory.InformerFor(&apistoragev1beta1.VolumeAttributesClass{}, f.defaultInformer))
 }
 
 func (f *volumeAttributesClassInformer) Lister() storagev1beta1.VolumeAttributesClassLister {
 	return storagev1beta1.NewVolumeAttributesClassLister(f.Informer().GetIndexer())
 }
+
+// ToTypedVolumeAttributesClassInformer converts an untyped informer into a TypedVolumeAttributesClassInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *VolumeAttributesClass. If that is not the case, calling type-safe methods of the returned
+// TypedVolumeAttributesClassInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedVolumeAttributesClassInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedVolumeAttributesClassInformer(informer VolumeAttributesClassInformer) TypedVolumeAttributesClassInformer {
+	if informer, ok := informer.(TypedVolumeAttributesClassInformer); ok {
+		return informer
+	}
+	return &volumeAttributesClassTypedInformerAdapter{informer}
+}
+
+type volumeAttributesClassTypedInformerAdapter struct {
+	VolumeAttributesClassInformer
+}
+
+func (a *volumeAttributesClassTypedInformerAdapter) TypedInformer() VolumeAttributesClassIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.VolumeAttributesClass](a.Informer())
+}
+
+// ToVolumeAttributesClassIndexInformer converts an untyped informer into a VolumeAttributesClassIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *VolumeAttributesClass. If that is not the case, calling type-safe methods of the returned
+// VolumeAttributesClassIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a VolumeAttributesClassIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToVolumeAttributesClassIndexInformer(informer cache.SharedIndexInformer) VolumeAttributesClassIndexInformer {
+	if informer, ok := informer.(VolumeAttributesClassIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragev1beta1.VolumeAttributesClass](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storagemigration/interface.go b/vendor/k8s.io/client-go/informers/storagemigration/interface.go
index 426e50fd57..5996e36529 100644
--- a/vendor/k8s.io/client-go/informers/storagemigration/interface.go
+++ b/vendor/k8s.io/client-go/informers/storagemigration/interface.go
@@ -20,11 +20,14 @@ package storagemigration
 
 import (
 	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+	v1 "k8s.io/client-go/informers/storagemigration/v1"
 	v1beta1 "k8s.io/client-go/informers/storagemigration/v1beta1"
 )
 
 // Interface provides access to each of this group's versions.
 type Interface interface {
+	// V1 provides access to shared informers for resources in V1.
+	V1() v1.Interface
 	// V1beta1 provides access to shared informers for resources in V1beta1.
 	V1beta1() v1beta1.Interface
 }
@@ -40,6 +43,11 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
+// V1 returns a new v1.Interface.
+func (g *group) V1() v1.Interface {
+	return v1.New(g.factory, g.namespace, g.tweakListOptions)
+}
+
 // V1beta1 returns a new v1beta1.Interface.
 func (g *group) V1beta1() v1beta1.Interface {
 	return v1beta1.New(g.factory, g.namespace, g.tweakListOptions)
diff --git a/vendor/k8s.io/client-go/informers/storagemigration/v1/interface.go b/vendor/k8s.io/client-go/informers/storagemigration/v1/interface.go
new file mode 100644
index 0000000000..41854207c1
--- /dev/null
+++ b/vendor/k8s.io/client-go/informers/storagemigration/v1/interface.go
@@ -0,0 +1,45 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// StorageVersionMigrations returns a StorageVersionMigrationInformer.
+	StorageVersionMigrations() TypedStorageVersionMigrationInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// StorageVersionMigrations returns a TypedStorageVersionMigrationInformer.
+func (v *version) StorageVersionMigrations() TypedStorageVersionMigrationInformer {
+	return &storageVersionMigrationInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/vendor/k8s.io/client-go/informers/storagemigration/v1/storageversionmigration.go b/vendor/k8s.io/client-go/informers/storagemigration/v1/storageversionmigration.go
new file mode 100644
index 0000000000..8036df40b2
--- /dev/null
+++ b/vendor/k8s.io/client-go/informers/storagemigration/v1/storageversionmigration.go
@@ -0,0 +1,207 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	apistoragemigrationv1 "k8s.io/api/storagemigration/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+	internalinterfaces "k8s.io/client-go/informers/internalinterfaces"
+	kubernetes "k8s.io/client-go/kubernetes"
+	storagemigrationv1 "k8s.io/client-go/listers/storagemigration/v1"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// StorageVersionMigrationInformer provides access to a shared informer and lister for
+// StorageVersionMigrations. Prefer using the type-safe variant (see [TypedStorageVersionMigrationInformer]).
+type StorageVersionMigrationInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() storagemigrationv1.StorageVersionMigrationLister
+}
+
+// TypedStorageVersionMigrationInformer provides access to a shared informer and lister for
+// StorageVersionMigrations, including the type-safe TypedInformer variant.
+// It is a superset of StorageVersionMigrationInformer.
+type TypedStorageVersionMigrationInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() StorageVersionMigrationIndexInformer
+	Lister() storagemigrationv1.StorageVersionMigrationLister
+}
+
+// StorageVersionMigrationIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type StorageVersionMigrationIndexInformer cache.TypedSharedIndexInformer[*apistoragemigrationv1.StorageVersionMigration]
+
+// StorageVersionMigrationHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for StorageVersionMigration.
+type StorageVersionMigrationHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragemigrationv1.StorageVersionMigration]
+
+// StorageVersionMigrationDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for StorageVersionMigration.
+type StorageVersionMigrationDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragemigrationv1.StorageVersionMigration]
+
+// StorageVersionMigrationFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for StorageVersionMigration.
+type StorageVersionMigrationFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragemigrationv1.StorageVersionMigration]
+
+// StorageVersionMigrationIndexers is a specialization of [cache.TypedIndexers] for StorageVersionMigration.
+type StorageVersionMigrationIndexers = cache.TypedIndexers[*apistoragemigrationv1.StorageVersionMigration]
+
+// DeletedStorageVersionMigration is a specialization of [cache.DeletedObject] for StorageVersionMigration.
+type DeletedStorageVersionMigration = cache.DeletedObject[*apistoragemigrationv1.StorageVersionMigration]
+
+type storageVersionMigrationInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// NewStorageVersionMigrationInformer constructs a new informer for StorageVersionMigration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStorageVersionMigrationInformer]).
+func NewStorageVersionMigrationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewStorageVersionMigrationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
+}
+
+// NewTypedStorageVersionMigrationInformer constructs a new informer for StorageVersionMigration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStorageVersionMigrationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers StorageVersionMigrationIndexers) StorageVersionMigrationIndexInformer {
+	return NewTypedStorageVersionMigrationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
+// NewFilteredStorageVersionMigrationInformer constructs a new informer for StorageVersionMigration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredStorageVersionMigrationInformer]).
+func NewFilteredStorageVersionMigrationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return NewTypedStorageVersionMigrationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredStorageVersionMigrationInformer constructs a new informer for StorageVersionMigration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredStorageVersionMigrationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers StorageVersionMigrationIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) StorageVersionMigrationIndexInformer {
+	return NewTypedStorageVersionMigrationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
+}
+
+// NewStorageVersionMigrationInformerWithOptions constructs a new informer for StorageVersionMigration type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStorageVersionMigrationInformerWithOptions]).
+func NewStorageVersionMigrationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedStorageVersionMigrationInformerWithOptions(client, options)
+}
+
+// NewTypedStorageVersionMigrationInformerWithOptions constructs a new informer for StorageVersionMigration type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStorageVersionMigrationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) StorageVersionMigrationIndexInformer {
+	gvr := schema.GroupVersionResource{Group: "storagemigration.k8s.io", Version: "v1", Resource: "storageversionmigrations"}
+	identifier := options.InformerName.WithResource(gvr)
+	tweakListOptions := options.TweakListOptions
+	return cache.NewTypedSharedIndexInformer[*apistoragemigrationv1.StorageVersionMigration](cache.NewSharedIndexInformerWithOptions(
+		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
+			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.StoragemigrationV1().StorageVersionMigrations().List(context.Background(), opts)
+			},
+			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.StoragemigrationV1().StorageVersionMigrations().Watch(context.Background(), opts)
+			},
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.StoragemigrationV1().StorageVersionMigrations().List(ctx, opts)
+			},
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&opts)
+				}
+				return client.StoragemigrationV1().StorageVersionMigrations().Watch(ctx, opts)
+			},
+		}, client),
+		&apistoragemigrationv1.StorageVersionMigration{},
+		cache.SharedIndexInformerOptions{
+			ResyncPeriod: options.ResyncPeriod,
+			Indexers:     options.Indexers,
+			Identifier:   identifier,
+		},
+	))
+}
+
+func (f *storageVersionMigrationInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewTypedStorageVersionMigrationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+}
+
+func (f *storageVersionMigrationInformer) Informer() cache.SharedIndexInformer {
+	return f.TypedInformer()
+}
+
+func (f *storageVersionMigrationInformer) TypedInformer() StorageVersionMigrationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragemigrationv1.StorageVersionMigration](f.factory.InformerFor(&apistoragemigrationv1.StorageVersionMigration{}, f.defaultInformer))
+}
+
+func (f *storageVersionMigrationInformer) Lister() storagemigrationv1.StorageVersionMigrationLister {
+	return storagemigrationv1.NewStorageVersionMigrationLister(f.Informer().GetIndexer())
+}
+
+// ToTypedStorageVersionMigrationInformer converts an untyped informer into a TypedStorageVersionMigrationInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StorageVersionMigration. If that is not the case, calling type-safe methods of the returned
+// TypedStorageVersionMigrationInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedStorageVersionMigrationInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedStorageVersionMigrationInformer(informer StorageVersionMigrationInformer) TypedStorageVersionMigrationInformer {
+	if informer, ok := informer.(TypedStorageVersionMigrationInformer); ok {
+		return informer
+	}
+	return &storageVersionMigrationTypedInformerAdapter{informer}
+}
+
+type storageVersionMigrationTypedInformerAdapter struct {
+	StorageVersionMigrationInformer
+}
+
+func (a *storageVersionMigrationTypedInformerAdapter) TypedInformer() StorageVersionMigrationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragemigrationv1.StorageVersionMigration](a.Informer())
+}
+
+// ToStorageVersionMigrationIndexInformer converts an untyped informer into a StorageVersionMigrationIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StorageVersionMigration. If that is not the case, calling type-safe methods of the returned
+// StorageVersionMigrationIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a StorageVersionMigrationIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToStorageVersionMigrationIndexInformer(informer cache.SharedIndexInformer) StorageVersionMigrationIndexInformer {
+	if informer, ok := informer.(StorageVersionMigrationIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragemigrationv1.StorageVersionMigration](informer)
+}
diff --git a/vendor/k8s.io/client-go/informers/storagemigration/v1beta1/interface.go b/vendor/k8s.io/client-go/informers/storagemigration/v1beta1/interface.go
index 220e1f5c8c..0035d43b1e 100644
--- a/vendor/k8s.io/client-go/informers/storagemigration/v1beta1/interface.go
+++ b/vendor/k8s.io/client-go/informers/storagemigration/v1beta1/interface.go
@@ -25,7 +25,7 @@ import (
 // Interface provides access to all the informers in this group version.
 type Interface interface {
 	// StorageVersionMigrations returns a StorageVersionMigrationInformer.
-	StorageVersionMigrations() StorageVersionMigrationInformer
+	StorageVersionMigrations() TypedStorageVersionMigrationInformer
 }
 
 type version struct {
@@ -39,7 +39,7 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// StorageVersionMigrations returns a StorageVersionMigrationInformer.
-func (v *version) StorageVersionMigrations() StorageVersionMigrationInformer {
+// StorageVersionMigrations returns a TypedStorageVersionMigrationInformer.
+func (v *version) StorageVersionMigrations() TypedStorageVersionMigrationInformer {
 	return &storageVersionMigrationInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/vendor/k8s.io/client-go/informers/storagemigration/v1beta1/storageversionmigration.go b/vendor/k8s.io/client-go/informers/storagemigration/v1beta1/storageversionmigration.go
index 50e271e6fe..3b8d5f7c9e 100644
--- a/vendor/k8s.io/client-go/informers/storagemigration/v1beta1/storageversionmigration.go
+++ b/vendor/k8s.io/client-go/informers/storagemigration/v1beta1/storageversionmigration.go
@@ -34,12 +34,40 @@ import (
 )
 
 // StorageVersionMigrationInformer provides access to a shared informer and lister for
-// StorageVersionMigrations.
+// StorageVersionMigrations. Prefer using the type-safe variant (see [TypedStorageVersionMigrationInformer]).
 type StorageVersionMigrationInformer interface {
 	Informer() cache.SharedIndexInformer
 	Lister() storagemigrationv1beta1.StorageVersionMigrationLister
 }
 
+// TypedStorageVersionMigrationInformer provides access to a shared informer and lister for
+// StorageVersionMigrations, including the type-safe TypedInformer variant.
+// It is a superset of StorageVersionMigrationInformer.
+type TypedStorageVersionMigrationInformer interface {
+	Informer() cache.SharedIndexInformer
+	TypedInformer() StorageVersionMigrationIndexInformer
+	Lister() storagemigrationv1beta1.StorageVersionMigrationLister
+}
+
+// StorageVersionMigrationIndexInformer is a wrapper around the underlying [cache.SharedIndexInformer]
+// with type-safe variants of several methods.
+type StorageVersionMigrationIndexInformer cache.TypedSharedIndexInformer[*apistoragemigrationv1beta1.StorageVersionMigration]
+
+// StorageVersionMigrationHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerFuncs] for StorageVersionMigration.
+type StorageVersionMigrationHandlerFuncs = cache.TypedResourceEventHandlerFuncs[*apistoragemigrationv1beta1.StorageVersionMigration]
+
+// StorageVersionMigrationDetailedHandlerFuncs is a specialization of [cache.TypedResourceEventHandlerDetailedFuncs] for StorageVersionMigration.
+type StorageVersionMigrationDetailedHandlerFuncs = cache.TypedResourceEventHandlerDetailedFuncs[*apistoragemigrationv1beta1.StorageVersionMigration]
+
+// StorageVersionMigrationFilteringHandler is a specialization of [cache.TypedFilteringResourceEventHandler] for StorageVersionMigration.
+type StorageVersionMigrationFilteringHandler = cache.TypedFilteringResourceEventHandler[*apistoragemigrationv1beta1.StorageVersionMigration]
+
+// StorageVersionMigrationIndexers is a specialization of [cache.TypedIndexers] for StorageVersionMigration.
+type StorageVersionMigrationIndexers = cache.TypedIndexers[*apistoragemigrationv1beta1.StorageVersionMigration]
+
+// DeletedStorageVersionMigration is a specialization of [cache.DeletedObject] for StorageVersionMigration.
+type DeletedStorageVersionMigration = cache.DeletedObject[*apistoragemigrationv1beta1.StorageVersionMigration]
+
 type storageVersionMigrationInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
@@ -48,25 +76,49 @@ type storageVersionMigrationInformer struct {
 // NewStorageVersionMigrationInformer constructs a new informer for StorageVersionMigration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStorageVersionMigrationInformer]).
 func NewStorageVersionMigrationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
 	return NewStorageVersionMigrationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers})
 }
 
+// NewTypedStorageVersionMigrationInformer constructs a new informer for StorageVersionMigration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStorageVersionMigrationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers StorageVersionMigrationIndexers) StorageVersionMigrationIndexInformer {
+	return NewTypedStorageVersionMigrationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers)})
+}
+
 // NewFilteredStorageVersionMigrationInformer constructs a new informer for StorageVersionMigration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedFilteredStorageVersionMigrationInformer]).
 func NewFilteredStorageVersionMigrationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
-	return NewStorageVersionMigrationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+	return NewTypedStorageVersionMigrationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: indexers, TweakListOptions: tweakListOptions})
+}
+
+// NewTypedFilteredStorageVersionMigrationInformer constructs a new informer for StorageVersionMigration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedFilteredStorageVersionMigrationInformer(client kubernetes.Interface, resyncPeriod time.Duration, indexers StorageVersionMigrationIndexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) StorageVersionMigrationIndexInformer {
+	return NewTypedStorageVersionMigrationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.TypedIndexersToIndexers(indexers), TweakListOptions: tweakListOptions})
 }
 
 // NewStorageVersionMigrationInformerWithOptions constructs a new informer for StorageVersionMigration type with additional options.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
+// If you really need an independent one, prefer using the type-safe variant (see [NewTypedStorageVersionMigrationInformerWithOptions]).
 func NewStorageVersionMigrationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) cache.SharedIndexInformer {
+	return NewTypedStorageVersionMigrationInformerWithOptions(client, options)
+}
+
+// NewTypedStorageVersionMigrationInformerWithOptions constructs a new informer for StorageVersionMigration type with additional options.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewTypedStorageVersionMigrationInformerWithOptions(client kubernetes.Interface, options internalinterfaces.InformerOptions) StorageVersionMigrationIndexInformer {
 	gvr := schema.GroupVersionResource{Group: "storagemigration.k8s.io", Version: "v1beta1", Resource: "storageversionmigrations"}
 	identifier := options.InformerName.WithResource(gvr)
 	tweakListOptions := options.TweakListOptions
-	return cache.NewSharedIndexInformerWithOptions(
+	return cache.NewTypedSharedIndexInformer[*apistoragemigrationv1beta1.StorageVersionMigration](cache.NewSharedIndexInformerWithOptions(
 		cache.ToListWatcherWithWatchListSemantics(&cache.ListWatch{
 			ListFunc: func(opts v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
@@ -99,17 +151,57 @@ func NewStorageVersionMigrationInformerWithOptions(client kubernetes.Interface,
 			Indexers:     options.Indexers,
 			Identifier:   identifier,
 		},
-	)
+	))
 }
 
 func (f *storageVersionMigrationInformer) defaultInformer(client kubernetes.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewStorageVersionMigrationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
+	return NewTypedStorageVersionMigrationInformerWithOptions(client, internalinterfaces.InformerOptions{ResyncPeriod: resyncPeriod, Indexers: cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, InformerName: f.factory.InformerName(), TweakListOptions: f.tweakListOptions})
 }
 
 func (f *storageVersionMigrationInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&apistoragemigrationv1beta1.StorageVersionMigration{}, f.defaultInformer)
+	return f.TypedInformer()
+}
+
+func (f *storageVersionMigrationInformer) TypedInformer() StorageVersionMigrationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragemigrationv1beta1.StorageVersionMigration](f.factory.InformerFor(&apistoragemigrationv1beta1.StorageVersionMigration{}, f.defaultInformer))
 }
 
 func (f *storageVersionMigrationInformer) Lister() storagemigrationv1beta1.StorageVersionMigrationLister {
 	return storagemigrationv1beta1.NewStorageVersionMigrationLister(f.Informer().GetIndexer())
 }
+
+// ToTypedStorageVersionMigrationInformer converts an untyped informer into a TypedStorageVersionMigrationInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StorageVersionMigration. If that is not the case, calling type-safe methods of the returned
+// TypedStorageVersionMigrationInformer leads to runtime panics. A safer alternative is to pass
+// around a TypedStorageVersionMigrationInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToTypedStorageVersionMigrationInformer(informer StorageVersionMigrationInformer) TypedStorageVersionMigrationInformer {
+	if informer, ok := informer.(TypedStorageVersionMigrationInformer); ok {
+		return informer
+	}
+	return &storageVersionMigrationTypedInformerAdapter{informer}
+}
+
+type storageVersionMigrationTypedInformerAdapter struct {
+	StorageVersionMigrationInformer
+}
+
+func (a *storageVersionMigrationTypedInformerAdapter) TypedInformer() StorageVersionMigrationIndexInformer {
+	return cache.NewTypedSharedIndexInformer[*apistoragemigrationv1beta1.StorageVersionMigration](a.Informer())
+}
+
+// ToStorageVersionMigrationIndexInformer converts an untyped informer into a StorageVersionMigrationIndexInformer.
+//
+// WARNING: this conversion is only safe if the informer handles objects of type
+// *StorageVersionMigration. If that is not the case, calling type-safe methods of the returned
+// StorageVersionMigrationIndexInformer leads to runtime panics. A safer alternative is to pass
+// around a StorageVersionMigrationIndexInformer instances that was obtained from a
+// SharedInformerFactory.
+func ToStorageVersionMigrationIndexInformer(informer cache.SharedIndexInformer) StorageVersionMigrationIndexInformer {
+	if informer, ok := informer.(StorageVersionMigrationIndexInformer); ok {
+		return informer
+	}
+	return cache.NewTypedSharedIndexInformer[*apistoragemigrationv1beta1.StorageVersionMigration](informer)
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/clientset.go b/vendor/k8s.io/client-go/kubernetes/clientset.go
index 537609b718..4bc28060ad 100644
--- a/vendor/k8s.io/client-go/kubernetes/clientset.go
+++ b/vendor/k8s.io/client-go/kubernetes/clientset.go
@@ -55,6 +55,7 @@ import (
 	flowcontrolv1beta1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta1"
 	flowcontrolv1beta2 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2"
 	flowcontrolv1beta3 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3"
+	lifecyclev1alpha1 "k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1"
 	networkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1"
 	networkingv1beta1 "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
 	nodev1 "k8s.io/client-go/kubernetes/typed/node/v1"
@@ -70,18 +71,19 @@ import (
 	resourcev1beta1 "k8s.io/client-go/kubernetes/typed/resource/v1beta1"
 	resourcev1beta2 "k8s.io/client-go/kubernetes/typed/resource/v1beta2"
 	schedulingv1 "k8s.io/client-go/kubernetes/typed/scheduling/v1"
-	schedulingv1alpha2 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2"
+	schedulingv1alpha3 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3"
 	schedulingv1beta1 "k8s.io/client-go/kubernetes/typed/scheduling/v1beta1"
 	storagev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
 	storagev1alpha1 "k8s.io/client-go/kubernetes/typed/storage/v1alpha1"
 	storagev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
+	storagemigrationv1 "k8s.io/client-go/kubernetes/typed/storagemigration/v1"
 	storagemigrationv1beta1 "k8s.io/client-go/kubernetes/typed/storagemigration/v1beta1"
 	rest "k8s.io/client-go/rest"
 	flowcontrol "k8s.io/client-go/util/flowcontrol"
 )
 
 type Interface interface {
-	Discovery() discovery.DiscoveryInterface
+	Discovery() discovery.DiscoveryInterfaces
 	AdmissionregistrationV1() admissionregistrationv1.AdmissionregistrationV1Interface
 	AdmissionregistrationV1alpha1() admissionregistrationv1alpha1.AdmissionregistrationV1alpha1Interface
 	AdmissionregistrationV1beta1() admissionregistrationv1beta1.AdmissionregistrationV1beta1Interface
@@ -114,6 +116,7 @@ type Interface interface {
 	FlowcontrolV1beta1() flowcontrolv1beta1.FlowcontrolV1beta1Interface
 	FlowcontrolV1beta2() flowcontrolv1beta2.FlowcontrolV1beta2Interface
 	FlowcontrolV1beta3() flowcontrolv1beta3.FlowcontrolV1beta3Interface
+	LifecycleV1alpha1() lifecyclev1alpha1.LifecycleV1alpha1Interface
 	NetworkingV1() networkingv1.NetworkingV1Interface
 	NetworkingV1beta1() networkingv1beta1.NetworkingV1beta1Interface
 	NodeV1() nodev1.NodeV1Interface
@@ -128,12 +131,13 @@ type Interface interface {
 	ResourceV1beta2() resourcev1beta2.ResourceV1beta2Interface
 	ResourceV1beta1() resourcev1beta1.ResourceV1beta1Interface
 	ResourceV1alpha3() resourcev1alpha3.ResourceV1alpha3Interface
-	SchedulingV1alpha2() schedulingv1alpha2.SchedulingV1alpha2Interface
+	SchedulingV1alpha3() schedulingv1alpha3.SchedulingV1alpha3Interface
 	SchedulingV1beta1() schedulingv1beta1.SchedulingV1beta1Interface
 	SchedulingV1() schedulingv1.SchedulingV1Interface
 	StorageV1beta1() storagev1beta1.StorageV1beta1Interface
 	StorageV1() storagev1.StorageV1Interface
 	StorageV1alpha1() storagev1alpha1.StorageV1alpha1Interface
+	StoragemigrationV1() storagemigrationv1.StoragemigrationV1Interface
 	StoragemigrationV1beta1() storagemigrationv1beta1.StoragemigrationV1beta1Interface
 }
 
@@ -172,6 +176,7 @@ type Clientset struct {
 	flowcontrolV1beta1            *flowcontrolv1beta1.FlowcontrolV1beta1Client
 	flowcontrolV1beta2            *flowcontrolv1beta2.FlowcontrolV1beta2Client
 	flowcontrolV1beta3            *flowcontrolv1beta3.FlowcontrolV1beta3Client
+	lifecycleV1alpha1             *lifecyclev1alpha1.LifecycleV1alpha1Client
 	networkingV1                  *networkingv1.NetworkingV1Client
 	networkingV1beta1             *networkingv1beta1.NetworkingV1beta1Client
 	nodeV1                        *nodev1.NodeV1Client
@@ -186,12 +191,13 @@ type Clientset struct {
 	resourceV1beta2               *resourcev1beta2.ResourceV1beta2Client
 	resourceV1beta1               *resourcev1beta1.ResourceV1beta1Client
 	resourceV1alpha3              *resourcev1alpha3.ResourceV1alpha3Client
-	schedulingV1alpha2            *schedulingv1alpha2.SchedulingV1alpha2Client
+	schedulingV1alpha3            *schedulingv1alpha3.SchedulingV1alpha3Client
 	schedulingV1beta1             *schedulingv1beta1.SchedulingV1beta1Client
 	schedulingV1                  *schedulingv1.SchedulingV1Client
 	storageV1beta1                *storagev1beta1.StorageV1beta1Client
 	storageV1                     *storagev1.StorageV1Client
 	storageV1alpha1               *storagev1alpha1.StorageV1alpha1Client
+	storagemigrationV1            *storagemigrationv1.StoragemigrationV1Client
 	storagemigrationV1beta1       *storagemigrationv1beta1.StoragemigrationV1beta1Client
 }
 
@@ -355,6 +361,11 @@ func (c *Clientset) FlowcontrolV1beta3() flowcontrolv1beta3.FlowcontrolV1beta3In
 	return c.flowcontrolV1beta3
 }
 
+// LifecycleV1alpha1 retrieves the LifecycleV1alpha1Client
+func (c *Clientset) LifecycleV1alpha1() lifecyclev1alpha1.LifecycleV1alpha1Interface {
+	return c.lifecycleV1alpha1
+}
+
 // NetworkingV1 retrieves the NetworkingV1Client
 func (c *Clientset) NetworkingV1() networkingv1.NetworkingV1Interface {
 	return c.networkingV1
@@ -425,9 +436,9 @@ func (c *Clientset) ResourceV1alpha3() resourcev1alpha3.ResourceV1alpha3Interfac
 	return c.resourceV1alpha3
 }
 
-// SchedulingV1alpha2 retrieves the SchedulingV1alpha2Client
-func (c *Clientset) SchedulingV1alpha2() schedulingv1alpha2.SchedulingV1alpha2Interface {
-	return c.schedulingV1alpha2
+// SchedulingV1alpha3 retrieves the SchedulingV1alpha3Client
+func (c *Clientset) SchedulingV1alpha3() schedulingv1alpha3.SchedulingV1alpha3Interface {
+	return c.schedulingV1alpha3
 }
 
 // SchedulingV1beta1 retrieves the SchedulingV1beta1Client
@@ -455,13 +466,18 @@ func (c *Clientset) StorageV1alpha1() storagev1alpha1.StorageV1alpha1Interface {
 	return c.storageV1alpha1
 }
 
+// StoragemigrationV1 retrieves the StoragemigrationV1Client
+func (c *Clientset) StoragemigrationV1() storagemigrationv1.StoragemigrationV1Interface {
+	return c.storagemigrationV1
+}
+
 // StoragemigrationV1beta1 retrieves the StoragemigrationV1beta1Client
 func (c *Clientset) StoragemigrationV1beta1() storagemigrationv1beta1.StoragemigrationV1beta1Interface {
 	return c.storagemigrationV1beta1
 }
 
 // Discovery retrieves the DiscoveryClient
-func (c *Clientset) Discovery() discovery.DiscoveryInterface {
+func (c *Clientset) Discovery() discovery.DiscoveryInterfaces {
 	if c == nil {
 		return nil
 	}
@@ -632,6 +648,10 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset,
 	if err != nil {
 		return nil, err
 	}
+	cs.lifecycleV1alpha1, err = lifecyclev1alpha1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
 	cs.networkingV1, err = networkingv1.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
@@ -688,7 +708,7 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset,
 	if err != nil {
 		return nil, err
 	}
-	cs.schedulingV1alpha2, err = schedulingv1alpha2.NewForConfigAndClient(&configShallowCopy, httpClient)
+	cs.schedulingV1alpha3, err = schedulingv1alpha3.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
 	}
@@ -712,6 +732,10 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset,
 	if err != nil {
 		return nil, err
 	}
+	cs.storagemigrationV1, err = storagemigrationv1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
 	cs.storagemigrationV1beta1, err = storagemigrationv1beta1.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
@@ -769,6 +793,7 @@ func New(c rest.Interface) *Clientset {
 	cs.flowcontrolV1beta1 = flowcontrolv1beta1.New(c)
 	cs.flowcontrolV1beta2 = flowcontrolv1beta2.New(c)
 	cs.flowcontrolV1beta3 = flowcontrolv1beta3.New(c)
+	cs.lifecycleV1alpha1 = lifecyclev1alpha1.New(c)
 	cs.networkingV1 = networkingv1.New(c)
 	cs.networkingV1beta1 = networkingv1beta1.New(c)
 	cs.nodeV1 = nodev1.New(c)
@@ -783,12 +808,13 @@ func New(c rest.Interface) *Clientset {
 	cs.resourceV1beta2 = resourcev1beta2.New(c)
 	cs.resourceV1beta1 = resourcev1beta1.New(c)
 	cs.resourceV1alpha3 = resourcev1alpha3.New(c)
-	cs.schedulingV1alpha2 = schedulingv1alpha2.New(c)
+	cs.schedulingV1alpha3 = schedulingv1alpha3.New(c)
 	cs.schedulingV1beta1 = schedulingv1beta1.New(c)
 	cs.schedulingV1 = schedulingv1.New(c)
 	cs.storageV1beta1 = storagev1beta1.New(c)
 	cs.storageV1 = storagev1.New(c)
 	cs.storageV1alpha1 = storagev1alpha1.New(c)
+	cs.storagemigrationV1 = storagemigrationv1.New(c)
 	cs.storagemigrationV1beta1 = storagemigrationv1beta1.New(c)
 
 	cs.DiscoveryClient = discovery.NewDiscoveryClient(c)
diff --git a/vendor/k8s.io/client-go/kubernetes/fake/clientset_generated.go b/vendor/k8s.io/client-go/kubernetes/fake/clientset_generated.go
index 618dd57511..db6c9e1dd1 100644
--- a/vendor/k8s.io/client-go/kubernetes/fake/clientset_generated.go
+++ b/vendor/k8s.io/client-go/kubernetes/fake/clientset_generated.go
@@ -90,6 +90,8 @@ import (
 	fakeflowcontrolv1beta2 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2/fake"
 	flowcontrolv1beta3 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3"
 	fakeflowcontrolv1beta3 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3/fake"
+	lifecyclev1alpha1 "k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1"
+	fakelifecyclev1alpha1 "k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/fake"
 	networkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1"
 	fakenetworkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1/fake"
 	networkingv1beta1 "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
@@ -120,8 +122,8 @@ import (
 	fakeresourcev1beta2 "k8s.io/client-go/kubernetes/typed/resource/v1beta2/fake"
 	schedulingv1 "k8s.io/client-go/kubernetes/typed/scheduling/v1"
 	fakeschedulingv1 "k8s.io/client-go/kubernetes/typed/scheduling/v1/fake"
-	schedulingv1alpha2 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2"
-	fakeschedulingv1alpha2 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/fake"
+	schedulingv1alpha3 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3"
+	fakeschedulingv1alpha3 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake"
 	schedulingv1beta1 "k8s.io/client-go/kubernetes/typed/scheduling/v1beta1"
 	fakeschedulingv1beta1 "k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/fake"
 	storagev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
@@ -130,6 +132,8 @@ import (
 	fakestoragev1alpha1 "k8s.io/client-go/kubernetes/typed/storage/v1alpha1/fake"
 	storagev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 	fakestoragev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1/fake"
+	storagemigrationv1 "k8s.io/client-go/kubernetes/typed/storagemigration/v1"
+	fakestoragemigrationv1 "k8s.io/client-go/kubernetes/typed/storagemigration/v1/fake"
 	storagemigrationv1beta1 "k8s.io/client-go/kubernetes/typed/storagemigration/v1beta1"
 	fakestoragemigrationv1beta1 "k8s.io/client-go/kubernetes/typed/storagemigration/v1beta1/fake"
 	"k8s.io/client-go/testing"
@@ -176,7 +180,7 @@ type Clientset struct {
 	tracker   testing.ObjectTracker
 }
 
-func (c *Clientset) Discovery() discovery.DiscoveryInterface {
+func (c *Clientset) Discovery() discovery.DiscoveryInterfaces {
 	return c.discovery
 }
 
@@ -400,6 +404,11 @@ func (c *Clientset) FlowcontrolV1beta3() flowcontrolv1beta3.FlowcontrolV1beta3In
 	return &fakeflowcontrolv1beta3.FakeFlowcontrolV1beta3{Fake: &c.Fake}
 }
 
+// LifecycleV1alpha1 retrieves the LifecycleV1alpha1Client
+func (c *Clientset) LifecycleV1alpha1() lifecyclev1alpha1.LifecycleV1alpha1Interface {
+	return &fakelifecyclev1alpha1.FakeLifecycleV1alpha1{Fake: &c.Fake}
+}
+
 // NetworkingV1 retrieves the NetworkingV1Client
 func (c *Clientset) NetworkingV1() networkingv1.NetworkingV1Interface {
 	return &fakenetworkingv1.FakeNetworkingV1{Fake: &c.Fake}
@@ -470,9 +479,9 @@ func (c *Clientset) ResourceV1alpha3() resourcev1alpha3.ResourceV1alpha3Interfac
 	return &fakeresourcev1alpha3.FakeResourceV1alpha3{Fake: &c.Fake}
 }
 
-// SchedulingV1alpha2 retrieves the SchedulingV1alpha2Client
-func (c *Clientset) SchedulingV1alpha2() schedulingv1alpha2.SchedulingV1alpha2Interface {
-	return &fakeschedulingv1alpha2.FakeSchedulingV1alpha2{Fake: &c.Fake}
+// SchedulingV1alpha3 retrieves the SchedulingV1alpha3Client
+func (c *Clientset) SchedulingV1alpha3() schedulingv1alpha3.SchedulingV1alpha3Interface {
+	return &fakeschedulingv1alpha3.FakeSchedulingV1alpha3{Fake: &c.Fake}
 }
 
 // SchedulingV1beta1 retrieves the SchedulingV1beta1Client
@@ -500,6 +509,11 @@ func (c *Clientset) StorageV1alpha1() storagev1alpha1.StorageV1alpha1Interface {
 	return &fakestoragev1alpha1.FakeStorageV1alpha1{Fake: &c.Fake}
 }
 
+// StoragemigrationV1 retrieves the StoragemigrationV1Client
+func (c *Clientset) StoragemigrationV1() storagemigrationv1.StoragemigrationV1Interface {
+	return &fakestoragemigrationv1.FakeStoragemigrationV1{Fake: &c.Fake}
+}
+
 // StoragemigrationV1beta1 retrieves the StoragemigrationV1beta1Client
 func (c *Clientset) StoragemigrationV1beta1() storagemigrationv1beta1.StoragemigrationV1beta1Interface {
 	return &fakestoragemigrationv1beta1.FakeStoragemigrationV1beta1{Fake: &c.Fake}
diff --git a/vendor/k8s.io/client-go/kubernetes/fake/register.go b/vendor/k8s.io/client-go/kubernetes/fake/register.go
index 3b5d98c6a8..ad580ed381 100644
--- a/vendor/k8s.io/client-go/kubernetes/fake/register.go
+++ b/vendor/k8s.io/client-go/kubernetes/fake/register.go
@@ -51,6 +51,7 @@ import (
 	flowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
 	flowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
 	flowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
+	lifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
 	networkingv1 "k8s.io/api/networking/v1"
 	networkingv1beta1 "k8s.io/api/networking/v1beta1"
 	nodev1 "k8s.io/api/node/v1"
@@ -66,11 +67,12 @@ import (
 	resourcev1beta1 "k8s.io/api/resource/v1beta1"
 	resourcev1beta2 "k8s.io/api/resource/v1beta2"
 	schedulingv1 "k8s.io/api/scheduling/v1"
-	schedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
 	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
 	storagev1 "k8s.io/api/storage/v1"
 	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
+	storagemigrationv1 "k8s.io/api/storagemigration/v1"
 	storagemigrationv1beta1 "k8s.io/api/storagemigration/v1beta1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
@@ -115,6 +117,7 @@ var localSchemeBuilder = runtime.SchemeBuilder{
 	flowcontrolv1beta1.AddToScheme,
 	flowcontrolv1beta2.AddToScheme,
 	flowcontrolv1beta3.AddToScheme,
+	lifecyclev1alpha1.AddToScheme,
 	networkingv1.AddToScheme,
 	networkingv1beta1.AddToScheme,
 	nodev1.AddToScheme,
@@ -129,12 +132,13 @@ var localSchemeBuilder = runtime.SchemeBuilder{
 	resourcev1beta2.AddToScheme,
 	resourcev1beta1.AddToScheme,
 	resourcev1alpha3.AddToScheme,
-	schedulingv1alpha2.AddToScheme,
+	schedulingv1alpha3.AddToScheme,
 	schedulingv1beta1.AddToScheme,
 	schedulingv1.AddToScheme,
 	storagev1beta1.AddToScheme,
 	storagev1.AddToScheme,
 	storagev1alpha1.AddToScheme,
+	storagemigrationv1.AddToScheme,
 	storagemigrationv1beta1.AddToScheme,
 }
 
diff --git a/vendor/k8s.io/client-go/kubernetes/scheme/register.go b/vendor/k8s.io/client-go/kubernetes/scheme/register.go
index c36fe7eda4..d2304c94ff 100644
--- a/vendor/k8s.io/client-go/kubernetes/scheme/register.go
+++ b/vendor/k8s.io/client-go/kubernetes/scheme/register.go
@@ -51,6 +51,7 @@ import (
 	flowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
 	flowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
 	flowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
+	lifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
 	networkingv1 "k8s.io/api/networking/v1"
 	networkingv1beta1 "k8s.io/api/networking/v1beta1"
 	nodev1 "k8s.io/api/node/v1"
@@ -66,11 +67,12 @@ import (
 	resourcev1beta1 "k8s.io/api/resource/v1beta1"
 	resourcev1beta2 "k8s.io/api/resource/v1beta2"
 	schedulingv1 "k8s.io/api/scheduling/v1"
-	schedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
 	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
 	storagev1 "k8s.io/api/storage/v1"
 	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
+	storagemigrationv1 "k8s.io/api/storagemigration/v1"
 	storagemigrationv1beta1 "k8s.io/api/storagemigration/v1beta1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
@@ -115,6 +117,7 @@ var localSchemeBuilder = runtime.SchemeBuilder{
 	flowcontrolv1beta1.AddToScheme,
 	flowcontrolv1beta2.AddToScheme,
 	flowcontrolv1beta3.AddToScheme,
+	lifecyclev1alpha1.AddToScheme,
 	networkingv1.AddToScheme,
 	networkingv1beta1.AddToScheme,
 	nodev1.AddToScheme,
@@ -129,12 +132,13 @@ var localSchemeBuilder = runtime.SchemeBuilder{
 	resourcev1beta2.AddToScheme,
 	resourcev1beta1.AddToScheme,
 	resourcev1alpha3.AddToScheme,
-	schedulingv1alpha2.AddToScheme,
+	schedulingv1alpha3.AddToScheme,
 	schedulingv1beta1.AddToScheme,
 	schedulingv1.AddToScheme,
 	storagev1beta1.AddToScheme,
 	storagev1.AddToScheme,
 	storagev1alpha1.AddToScheme,
+	storagemigrationv1.AddToScheme,
 	storagemigrationv1beta1.AddToScheme,
 }
 
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/certificates_client.go b/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/certificates_client.go
index a13c3559db..ed84f79e8f 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/certificates_client.go
+++ b/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/certificates_client.go
@@ -29,6 +29,8 @@ import (
 type CertificatesV1Interface interface {
 	RESTClient() rest.Interface
 	CertificateSigningRequestsGetter
+	ClusterTrustBundlesGetter
+	PodCertificateRequestsGetter
 }
 
 // CertificatesV1Client is used to interact with features provided by the certificates.k8s.io group.
@@ -40,6 +42,14 @@ func (c *CertificatesV1Client) CertificateSigningRequests() CertificateSigningRe
 	return newCertificateSigningRequests(c)
 }
 
+func (c *CertificatesV1Client) ClusterTrustBundles() ClusterTrustBundleInterface {
+	return newClusterTrustBundles(c)
+}
+
+func (c *CertificatesV1Client) PodCertificateRequests(namespace string) PodCertificateRequestInterface {
+	return newPodCertificateRequests(c, namespace)
+}
+
 // NewForConfig creates a new CertificatesV1Client for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/clustertrustbundle.go b/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/clustertrustbundle.go
new file mode 100644
index 0000000000..23a5c80bac
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/clustertrustbundle.go
@@ -0,0 +1,71 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	certificatesv1 "k8s.io/api/certificates/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	applyconfigurationscertificatesv1 "k8s.io/client-go/applyconfigurations/certificates/v1"
+	gentype "k8s.io/client-go/gentype"
+	scheme "k8s.io/client-go/kubernetes/scheme"
+)
+
+// ClusterTrustBundlesGetter has a method to return a ClusterTrustBundleInterface.
+// A group's client should implement this interface.
+type ClusterTrustBundlesGetter interface {
+	ClusterTrustBundles() ClusterTrustBundleInterface
+}
+
+// ClusterTrustBundleInterface has methods to work with ClusterTrustBundle resources.
+type ClusterTrustBundleInterface interface {
+	Create(ctx context.Context, clusterTrustBundle *certificatesv1.ClusterTrustBundle, opts metav1.CreateOptions) (*certificatesv1.ClusterTrustBundle, error)
+	Update(ctx context.Context, clusterTrustBundle *certificatesv1.ClusterTrustBundle, opts metav1.UpdateOptions) (*certificatesv1.ClusterTrustBundle, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*certificatesv1.ClusterTrustBundle, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*certificatesv1.ClusterTrustBundleList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *certificatesv1.ClusterTrustBundle, err error)
+	Apply(ctx context.Context, clusterTrustBundle *applyconfigurationscertificatesv1.ClusterTrustBundleApplyConfiguration, opts metav1.ApplyOptions) (result *certificatesv1.ClusterTrustBundle, err error)
+	ClusterTrustBundleExpansion
+}
+
+// clusterTrustBundles implements ClusterTrustBundleInterface
+type clusterTrustBundles struct {
+	*gentype.ClientWithListAndApply[*certificatesv1.ClusterTrustBundle, *certificatesv1.ClusterTrustBundleList, *applyconfigurationscertificatesv1.ClusterTrustBundleApplyConfiguration]
+}
+
+// newClusterTrustBundles returns a ClusterTrustBundles
+func newClusterTrustBundles(c *CertificatesV1Client) *clusterTrustBundles {
+	return &clusterTrustBundles{
+		gentype.NewClientWithListAndApply[*certificatesv1.ClusterTrustBundle, *certificatesv1.ClusterTrustBundleList, *applyconfigurationscertificatesv1.ClusterTrustBundleApplyConfiguration](
+			"clustertrustbundles",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			"",
+			func() *certificatesv1.ClusterTrustBundle { return &certificatesv1.ClusterTrustBundle{} },
+			func() *certificatesv1.ClusterTrustBundleList { return &certificatesv1.ClusterTrustBundleList{} },
+			gentype.PrefersProtobuf[*certificatesv1.ClusterTrustBundle](),
+		),
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/fake/fake_certificates_client.go b/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/fake/fake_certificates_client.go
index 782ebd95ee..a935016f95 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/fake/fake_certificates_client.go
+++ b/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/fake/fake_certificates_client.go
@@ -32,6 +32,14 @@ func (c *FakeCertificatesV1) CertificateSigningRequests() v1.CertificateSigningR
 	return newFakeCertificateSigningRequests(c)
 }
 
+func (c *FakeCertificatesV1) ClusterTrustBundles() v1.ClusterTrustBundleInterface {
+	return newFakeClusterTrustBundles(c)
+}
+
+func (c *FakeCertificatesV1) PodCertificateRequests(namespace string) v1.PodCertificateRequestInterface {
+	return newFakePodCertificateRequests(c, namespace)
+}
+
 // RESTClient returns a RESTClient that is used to communicate
 // with API server by this client implementation.
 func (c *FakeCertificatesV1) RESTClient() rest.Interface {
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/fake/fake_clustertrustbundle.go b/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/fake/fake_clustertrustbundle.go
new file mode 100644
index 0000000000..7cf2667b9f
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/fake/fake_clustertrustbundle.go
@@ -0,0 +1,53 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1 "k8s.io/api/certificates/v1"
+	certificatesv1 "k8s.io/client-go/applyconfigurations/certificates/v1"
+	gentype "k8s.io/client-go/gentype"
+	typedcertificatesv1 "k8s.io/client-go/kubernetes/typed/certificates/v1"
+)
+
+// fakeClusterTrustBundles implements ClusterTrustBundleInterface
+type fakeClusterTrustBundles struct {
+	*gentype.FakeClientWithListAndApply[*v1.ClusterTrustBundle, *v1.ClusterTrustBundleList, *certificatesv1.ClusterTrustBundleApplyConfiguration]
+	Fake *FakeCertificatesV1
+}
+
+func newFakeClusterTrustBundles(fake *FakeCertificatesV1) typedcertificatesv1.ClusterTrustBundleInterface {
+	return &fakeClusterTrustBundles{
+		gentype.NewFakeClientWithListAndApply[*v1.ClusterTrustBundle, *v1.ClusterTrustBundleList, *certificatesv1.ClusterTrustBundleApplyConfiguration](
+			fake.Fake,
+			"",
+			v1.SchemeGroupVersion.WithResource("clustertrustbundles"),
+			v1.SchemeGroupVersion.WithKind("ClusterTrustBundle"),
+			func() *v1.ClusterTrustBundle { return &v1.ClusterTrustBundle{} },
+			func() *v1.ClusterTrustBundleList { return &v1.ClusterTrustBundleList{} },
+			func(dst, src *v1.ClusterTrustBundleList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.ClusterTrustBundleList) []*v1.ClusterTrustBundle {
+				return gentype.ToPointerSlice(list.Items)
+			},
+			func(list *v1.ClusterTrustBundleList, items []*v1.ClusterTrustBundle) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/fake/fake_podcertificaterequest.go b/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/fake/fake_podcertificaterequest.go
new file mode 100644
index 0000000000..2b05be5374
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/fake/fake_podcertificaterequest.go
@@ -0,0 +1,53 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1 "k8s.io/api/certificates/v1"
+	certificatesv1 "k8s.io/client-go/applyconfigurations/certificates/v1"
+	gentype "k8s.io/client-go/gentype"
+	typedcertificatesv1 "k8s.io/client-go/kubernetes/typed/certificates/v1"
+)
+
+// fakePodCertificateRequests implements PodCertificateRequestInterface
+type fakePodCertificateRequests struct {
+	*gentype.FakeClientWithListAndApply[*v1.PodCertificateRequest, *v1.PodCertificateRequestList, *certificatesv1.PodCertificateRequestApplyConfiguration]
+	Fake *FakeCertificatesV1
+}
+
+func newFakePodCertificateRequests(fake *FakeCertificatesV1, namespace string) typedcertificatesv1.PodCertificateRequestInterface {
+	return &fakePodCertificateRequests{
+		gentype.NewFakeClientWithListAndApply[*v1.PodCertificateRequest, *v1.PodCertificateRequestList, *certificatesv1.PodCertificateRequestApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1.SchemeGroupVersion.WithResource("podcertificaterequests"),
+			v1.SchemeGroupVersion.WithKind("PodCertificateRequest"),
+			func() *v1.PodCertificateRequest { return &v1.PodCertificateRequest{} },
+			func() *v1.PodCertificateRequestList { return &v1.PodCertificateRequestList{} },
+			func(dst, src *v1.PodCertificateRequestList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.PodCertificateRequestList) []*v1.PodCertificateRequest {
+				return gentype.ToPointerSlice(list.Items)
+			},
+			func(list *v1.PodCertificateRequestList, items []*v1.PodCertificateRequest) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/generated_expansion.go b/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/generated_expansion.go
index 95fad02126..9024405353 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/generated_expansion.go
+++ b/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/generated_expansion.go
@@ -19,3 +19,7 @@ limitations under the License.
 package v1
 
 type CertificateSigningRequestExpansion interface{}
+
+type ClusterTrustBundleExpansion interface{}
+
+type PodCertificateRequestExpansion interface{}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/podcertificaterequest.go b/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/podcertificaterequest.go
new file mode 100644
index 0000000000..128d1e5ff2
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/certificates/v1/podcertificaterequest.go
@@ -0,0 +1,75 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	certificatesv1 "k8s.io/api/certificates/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	applyconfigurationscertificatesv1 "k8s.io/client-go/applyconfigurations/certificates/v1"
+	gentype "k8s.io/client-go/gentype"
+	scheme "k8s.io/client-go/kubernetes/scheme"
+)
+
+// PodCertificateRequestsGetter has a method to return a PodCertificateRequestInterface.
+// A group's client should implement this interface.
+type PodCertificateRequestsGetter interface {
+	PodCertificateRequests(namespace string) PodCertificateRequestInterface
+}
+
+// PodCertificateRequestInterface has methods to work with PodCertificateRequest resources.
+type PodCertificateRequestInterface interface {
+	Create(ctx context.Context, podCertificateRequest *certificatesv1.PodCertificateRequest, opts metav1.CreateOptions) (*certificatesv1.PodCertificateRequest, error)
+	Update(ctx context.Context, podCertificateRequest *certificatesv1.PodCertificateRequest, opts metav1.UpdateOptions) (*certificatesv1.PodCertificateRequest, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, podCertificateRequest *certificatesv1.PodCertificateRequest, opts metav1.UpdateOptions) (*certificatesv1.PodCertificateRequest, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*certificatesv1.PodCertificateRequest, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*certificatesv1.PodCertificateRequestList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *certificatesv1.PodCertificateRequest, err error)
+	Apply(ctx context.Context, podCertificateRequest *applyconfigurationscertificatesv1.PodCertificateRequestApplyConfiguration, opts metav1.ApplyOptions) (result *certificatesv1.PodCertificateRequest, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, podCertificateRequest *applyconfigurationscertificatesv1.PodCertificateRequestApplyConfiguration, opts metav1.ApplyOptions) (result *certificatesv1.PodCertificateRequest, err error)
+	PodCertificateRequestExpansion
+}
+
+// podCertificateRequests implements PodCertificateRequestInterface
+type podCertificateRequests struct {
+	*gentype.ClientWithListAndApply[*certificatesv1.PodCertificateRequest, *certificatesv1.PodCertificateRequestList, *applyconfigurationscertificatesv1.PodCertificateRequestApplyConfiguration]
+}
+
+// newPodCertificateRequests returns a PodCertificateRequests
+func newPodCertificateRequests(c *CertificatesV1Client, namespace string) *podCertificateRequests {
+	return &podCertificateRequests{
+		gentype.NewClientWithListAndApply[*certificatesv1.PodCertificateRequest, *certificatesv1.PodCertificateRequestList, *applyconfigurationscertificatesv1.PodCertificateRequestApplyConfiguration](
+			"podcertificaterequests",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *certificatesv1.PodCertificateRequest { return &certificatesv1.PodCertificateRequest{} },
+			func() *certificatesv1.PodCertificateRequestList { return &certificatesv1.PodCertificateRequestList{} },
+			gentype.PrefersProtobuf[*certificatesv1.PodCertificateRequest](),
+		),
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/doc.go b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/doc.go
new file mode 100644
index 0000000000..df51baa4d4
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha1
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/eviction.go b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/eviction.go
new file mode 100644
index 0000000000..10a359c29b
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/eviction.go
@@ -0,0 +1,75 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+
+	lifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	applyconfigurationslifecyclev1alpha1 "k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1"
+	gentype "k8s.io/client-go/gentype"
+	scheme "k8s.io/client-go/kubernetes/scheme"
+)
+
+// EvictionsGetter has a method to return a EvictionInterface.
+// A group's client should implement this interface.
+type EvictionsGetter interface {
+	Evictions(namespace string) EvictionInterface
+}
+
+// EvictionInterface has methods to work with Eviction resources.
+type EvictionInterface interface {
+	Create(ctx context.Context, eviction *lifecyclev1alpha1.Eviction, opts v1.CreateOptions) (*lifecyclev1alpha1.Eviction, error)
+	Update(ctx context.Context, eviction *lifecyclev1alpha1.Eviction, opts v1.UpdateOptions) (*lifecyclev1alpha1.Eviction, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, eviction *lifecyclev1alpha1.Eviction, opts v1.UpdateOptions) (*lifecyclev1alpha1.Eviction, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*lifecyclev1alpha1.Eviction, error)
+	List(ctx context.Context, opts v1.ListOptions) (*lifecyclev1alpha1.EvictionList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *lifecyclev1alpha1.Eviction, err error)
+	Apply(ctx context.Context, eviction *applyconfigurationslifecyclev1alpha1.EvictionApplyConfiguration, opts v1.ApplyOptions) (result *lifecyclev1alpha1.Eviction, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, eviction *applyconfigurationslifecyclev1alpha1.EvictionApplyConfiguration, opts v1.ApplyOptions) (result *lifecyclev1alpha1.Eviction, err error)
+	EvictionExpansion
+}
+
+// evictions implements EvictionInterface
+type evictions struct {
+	*gentype.ClientWithListAndApply[*lifecyclev1alpha1.Eviction, *lifecyclev1alpha1.EvictionList, *applyconfigurationslifecyclev1alpha1.EvictionApplyConfiguration]
+}
+
+// newEvictions returns a Evictions
+func newEvictions(c *LifecycleV1alpha1Client, namespace string) *evictions {
+	return &evictions{
+		gentype.NewClientWithListAndApply[*lifecyclev1alpha1.Eviction, *lifecyclev1alpha1.EvictionList, *applyconfigurationslifecyclev1alpha1.EvictionApplyConfiguration](
+			"evictions",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *lifecyclev1alpha1.Eviction { return &lifecyclev1alpha1.Eviction{} },
+			func() *lifecyclev1alpha1.EvictionList { return &lifecyclev1alpha1.EvictionList{} },
+			gentype.PrefersProtobuf[*lifecyclev1alpha1.Eviction](),
+		),
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/evictionrequest.go b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/evictionrequest.go
new file mode 100644
index 0000000000..4a21127bb4
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/evictionrequest.go
@@ -0,0 +1,75 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+
+	lifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	applyconfigurationslifecyclev1alpha1 "k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1"
+	gentype "k8s.io/client-go/gentype"
+	scheme "k8s.io/client-go/kubernetes/scheme"
+)
+
+// EvictionRequestsGetter has a method to return a EvictionRequestInterface.
+// A group's client should implement this interface.
+type EvictionRequestsGetter interface {
+	EvictionRequests(namespace string) EvictionRequestInterface
+}
+
+// EvictionRequestInterface has methods to work with EvictionRequest resources.
+type EvictionRequestInterface interface {
+	Create(ctx context.Context, evictionRequest *lifecyclev1alpha1.EvictionRequest, opts v1.CreateOptions) (*lifecyclev1alpha1.EvictionRequest, error)
+	Update(ctx context.Context, evictionRequest *lifecyclev1alpha1.EvictionRequest, opts v1.UpdateOptions) (*lifecyclev1alpha1.EvictionRequest, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, evictionRequest *lifecyclev1alpha1.EvictionRequest, opts v1.UpdateOptions) (*lifecyclev1alpha1.EvictionRequest, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*lifecyclev1alpha1.EvictionRequest, error)
+	List(ctx context.Context, opts v1.ListOptions) (*lifecyclev1alpha1.EvictionRequestList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *lifecyclev1alpha1.EvictionRequest, err error)
+	Apply(ctx context.Context, evictionRequest *applyconfigurationslifecyclev1alpha1.EvictionRequestApplyConfiguration, opts v1.ApplyOptions) (result *lifecyclev1alpha1.EvictionRequest, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, evictionRequest *applyconfigurationslifecyclev1alpha1.EvictionRequestApplyConfiguration, opts v1.ApplyOptions) (result *lifecyclev1alpha1.EvictionRequest, err error)
+	EvictionRequestExpansion
+}
+
+// evictionRequests implements EvictionRequestInterface
+type evictionRequests struct {
+	*gentype.ClientWithListAndApply[*lifecyclev1alpha1.EvictionRequest, *lifecyclev1alpha1.EvictionRequestList, *applyconfigurationslifecyclev1alpha1.EvictionRequestApplyConfiguration]
+}
+
+// newEvictionRequests returns a EvictionRequests
+func newEvictionRequests(c *LifecycleV1alpha1Client, namespace string) *evictionRequests {
+	return &evictionRequests{
+		gentype.NewClientWithListAndApply[*lifecyclev1alpha1.EvictionRequest, *lifecyclev1alpha1.EvictionRequestList, *applyconfigurationslifecyclev1alpha1.EvictionRequestApplyConfiguration](
+			"evictionrequests",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *lifecyclev1alpha1.EvictionRequest { return &lifecyclev1alpha1.EvictionRequest{} },
+			func() *lifecyclev1alpha1.EvictionRequestList { return &lifecyclev1alpha1.EvictionRequestList{} },
+			gentype.PrefersProtobuf[*lifecyclev1alpha1.EvictionRequest](),
+		),
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/fake/doc.go b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/fake/doc.go
new file mode 100644
index 0000000000..16f4439906
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/fake/fake_eviction.go b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/fake/fake_eviction.go
new file mode 100644
index 0000000000..1c23bee191
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/fake/fake_eviction.go
@@ -0,0 +1,51 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha1 "k8s.io/api/lifecycle/v1alpha1"
+	lifecyclev1alpha1 "k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1"
+	gentype "k8s.io/client-go/gentype"
+	typedlifecyclev1alpha1 "k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1"
+)
+
+// fakeEvictions implements EvictionInterface
+type fakeEvictions struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.Eviction, *v1alpha1.EvictionList, *lifecyclev1alpha1.EvictionApplyConfiguration]
+	Fake *FakeLifecycleV1alpha1
+}
+
+func newFakeEvictions(fake *FakeLifecycleV1alpha1, namespace string) typedlifecyclev1alpha1.EvictionInterface {
+	return &fakeEvictions{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.Eviction, *v1alpha1.EvictionList, *lifecyclev1alpha1.EvictionApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha1.SchemeGroupVersion.WithResource("evictions"),
+			v1alpha1.SchemeGroupVersion.WithKind("Eviction"),
+			func() *v1alpha1.Eviction { return &v1alpha1.Eviction{} },
+			func() *v1alpha1.EvictionList { return &v1alpha1.EvictionList{} },
+			func(dst, src *v1alpha1.EvictionList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.EvictionList) []*v1alpha1.Eviction { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1alpha1.EvictionList, items []*v1alpha1.Eviction) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/fake/fake_evictionrequest.go b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/fake/fake_evictionrequest.go
new file mode 100644
index 0000000000..9fe2633df5
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/fake/fake_evictionrequest.go
@@ -0,0 +1,53 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha1 "k8s.io/api/lifecycle/v1alpha1"
+	lifecyclev1alpha1 "k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1"
+	gentype "k8s.io/client-go/gentype"
+	typedlifecyclev1alpha1 "k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1"
+)
+
+// fakeEvictionRequests implements EvictionRequestInterface
+type fakeEvictionRequests struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.EvictionRequest, *v1alpha1.EvictionRequestList, *lifecyclev1alpha1.EvictionRequestApplyConfiguration]
+	Fake *FakeLifecycleV1alpha1
+}
+
+func newFakeEvictionRequests(fake *FakeLifecycleV1alpha1, namespace string) typedlifecyclev1alpha1.EvictionRequestInterface {
+	return &fakeEvictionRequests{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.EvictionRequest, *v1alpha1.EvictionRequestList, *lifecyclev1alpha1.EvictionRequestApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha1.SchemeGroupVersion.WithResource("evictionrequests"),
+			v1alpha1.SchemeGroupVersion.WithKind("EvictionRequest"),
+			func() *v1alpha1.EvictionRequest { return &v1alpha1.EvictionRequest{} },
+			func() *v1alpha1.EvictionRequestList { return &v1alpha1.EvictionRequestList{} },
+			func(dst, src *v1alpha1.EvictionRequestList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.EvictionRequestList) []*v1alpha1.EvictionRequest {
+				return gentype.ToPointerSlice(list.Items)
+			},
+			func(list *v1alpha1.EvictionRequestList, items []*v1alpha1.EvictionRequest) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/fake/fake_lifecycle_client.go b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/fake/fake_lifecycle_client.go
new file mode 100644
index 0000000000..2b69ec4701
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/fake/fake_lifecycle_client.go
@@ -0,0 +1,44 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha1 "k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1"
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+)
+
+type FakeLifecycleV1alpha1 struct {
+	*testing.Fake
+}
+
+func (c *FakeLifecycleV1alpha1) Evictions(namespace string) v1alpha1.EvictionInterface {
+	return newFakeEvictions(c, namespace)
+}
+
+func (c *FakeLifecycleV1alpha1) EvictionRequests(namespace string) v1alpha1.EvictionRequestInterface {
+	return newFakeEvictionRequests(c, namespace)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeLifecycleV1alpha1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/generated_expansion.go b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/generated_expansion.go
new file mode 100644
index 0000000000..4be788fdf2
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+type EvictionExpansion interface{}
+
+type EvictionRequestExpansion interface{}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/lifecycle_client.go b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/lifecycle_client.go
new file mode 100644
index 0000000000..02c050b829
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/lifecycle_client.go
@@ -0,0 +1,106 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	http "net/http"
+
+	lifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
+	scheme "k8s.io/client-go/kubernetes/scheme"
+	rest "k8s.io/client-go/rest"
+)
+
+type LifecycleV1alpha1Interface interface {
+	RESTClient() rest.Interface
+	EvictionsGetter
+	EvictionRequestsGetter
+}
+
+// LifecycleV1alpha1Client is used to interact with features provided by the lifecycle.k8s.io group.
+type LifecycleV1alpha1Client struct {
+	restClient rest.Interface
+}
+
+func (c *LifecycleV1alpha1Client) Evictions(namespace string) EvictionInterface {
+	return newEvictions(c, namespace)
+}
+
+func (c *LifecycleV1alpha1Client) EvictionRequests(namespace string) EvictionRequestInterface {
+	return newEvictionRequests(c, namespace)
+}
+
+// NewForConfig creates a new LifecycleV1alpha1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*LifecycleV1alpha1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new LifecycleV1alpha1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*LifecycleV1alpha1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &LifecycleV1alpha1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new LifecycleV1alpha1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *LifecycleV1alpha1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new LifecycleV1alpha1Client for the given RESTClient.
+func New(c rest.Interface) *LifecycleV1alpha1Client {
+	return &LifecycleV1alpha1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := lifecyclev1alpha1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *LifecycleV1alpha1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/devicetaintrule.go b/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/devicetaintrule.go
new file mode 100644
index 0000000000..43074f75a7
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/devicetaintrule.go
@@ -0,0 +1,75 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	resourcev1 "k8s.io/api/resource/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	applyconfigurationsresourcev1 "k8s.io/client-go/applyconfigurations/resource/v1"
+	gentype "k8s.io/client-go/gentype"
+	scheme "k8s.io/client-go/kubernetes/scheme"
+)
+
+// DeviceTaintRulesGetter has a method to return a DeviceTaintRuleInterface.
+// A group's client should implement this interface.
+type DeviceTaintRulesGetter interface {
+	DeviceTaintRules() DeviceTaintRuleInterface
+}
+
+// DeviceTaintRuleInterface has methods to work with DeviceTaintRule resources.
+type DeviceTaintRuleInterface interface {
+	Create(ctx context.Context, deviceTaintRule *resourcev1.DeviceTaintRule, opts metav1.CreateOptions) (*resourcev1.DeviceTaintRule, error)
+	Update(ctx context.Context, deviceTaintRule *resourcev1.DeviceTaintRule, opts metav1.UpdateOptions) (*resourcev1.DeviceTaintRule, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, deviceTaintRule *resourcev1.DeviceTaintRule, opts metav1.UpdateOptions) (*resourcev1.DeviceTaintRule, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*resourcev1.DeviceTaintRule, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*resourcev1.DeviceTaintRuleList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *resourcev1.DeviceTaintRule, err error)
+	Apply(ctx context.Context, deviceTaintRule *applyconfigurationsresourcev1.DeviceTaintRuleApplyConfiguration, opts metav1.ApplyOptions) (result *resourcev1.DeviceTaintRule, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, deviceTaintRule *applyconfigurationsresourcev1.DeviceTaintRuleApplyConfiguration, opts metav1.ApplyOptions) (result *resourcev1.DeviceTaintRule, err error)
+	DeviceTaintRuleExpansion
+}
+
+// deviceTaintRules implements DeviceTaintRuleInterface
+type deviceTaintRules struct {
+	*gentype.ClientWithListAndApply[*resourcev1.DeviceTaintRule, *resourcev1.DeviceTaintRuleList, *applyconfigurationsresourcev1.DeviceTaintRuleApplyConfiguration]
+}
+
+// newDeviceTaintRules returns a DeviceTaintRules
+func newDeviceTaintRules(c *ResourceV1Client) *deviceTaintRules {
+	return &deviceTaintRules{
+		gentype.NewClientWithListAndApply[*resourcev1.DeviceTaintRule, *resourcev1.DeviceTaintRuleList, *applyconfigurationsresourcev1.DeviceTaintRuleApplyConfiguration](
+			"devicetaintrules",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			"",
+			func() *resourcev1.DeviceTaintRule { return &resourcev1.DeviceTaintRule{} },
+			func() *resourcev1.DeviceTaintRuleList { return &resourcev1.DeviceTaintRuleList{} },
+			gentype.PrefersProtobuf[*resourcev1.DeviceTaintRule](),
+		),
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/fake/fake_devicetaintrule.go b/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/fake/fake_devicetaintrule.go
new file mode 100644
index 0000000000..da7782d7dd
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/fake/fake_devicetaintrule.go
@@ -0,0 +1,51 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1 "k8s.io/api/resource/v1"
+	resourcev1 "k8s.io/client-go/applyconfigurations/resource/v1"
+	gentype "k8s.io/client-go/gentype"
+	typedresourcev1 "k8s.io/client-go/kubernetes/typed/resource/v1"
+)
+
+// fakeDeviceTaintRules implements DeviceTaintRuleInterface
+type fakeDeviceTaintRules struct {
+	*gentype.FakeClientWithListAndApply[*v1.DeviceTaintRule, *v1.DeviceTaintRuleList, *resourcev1.DeviceTaintRuleApplyConfiguration]
+	Fake *FakeResourceV1
+}
+
+func newFakeDeviceTaintRules(fake *FakeResourceV1) typedresourcev1.DeviceTaintRuleInterface {
+	return &fakeDeviceTaintRules{
+		gentype.NewFakeClientWithListAndApply[*v1.DeviceTaintRule, *v1.DeviceTaintRuleList, *resourcev1.DeviceTaintRuleApplyConfiguration](
+			fake.Fake,
+			"",
+			v1.SchemeGroupVersion.WithResource("devicetaintrules"),
+			v1.SchemeGroupVersion.WithKind("DeviceTaintRule"),
+			func() *v1.DeviceTaintRule { return &v1.DeviceTaintRule{} },
+			func() *v1.DeviceTaintRuleList { return &v1.DeviceTaintRuleList{} },
+			func(dst, src *v1.DeviceTaintRuleList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.DeviceTaintRuleList) []*v1.DeviceTaintRule { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.DeviceTaintRuleList, items []*v1.DeviceTaintRule) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/fake/fake_resource_client.go b/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/fake/fake_resource_client.go
index 53a2954294..5e669b4e6d 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/fake/fake_resource_client.go
+++ b/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/fake/fake_resource_client.go
@@ -32,6 +32,10 @@ func (c *FakeResourceV1) DeviceClasses() v1.DeviceClassInterface {
 	return newFakeDeviceClasses(c)
 }
 
+func (c *FakeResourceV1) DeviceTaintRules() v1.DeviceTaintRuleInterface {
+	return newFakeDeviceTaintRules(c)
+}
+
 func (c *FakeResourceV1) ResourceClaims(namespace string) v1.ResourceClaimInterface {
 	return newFakeResourceClaims(c, namespace)
 }
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/generated_expansion.go b/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/generated_expansion.go
index ea30968587..6cd11a8051 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/generated_expansion.go
+++ b/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/generated_expansion.go
@@ -20,6 +20,8 @@ package v1
 
 type DeviceClassExpansion interface{}
 
+type DeviceTaintRuleExpansion interface{}
+
 type ResourceClaimExpansion interface{}
 
 type ResourceClaimTemplateExpansion interface{}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/resource_client.go b/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/resource_client.go
index e610012dde..0267cb68a8 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/resource_client.go
+++ b/vendor/k8s.io/client-go/kubernetes/typed/resource/v1/resource_client.go
@@ -29,6 +29,7 @@ import (
 type ResourceV1Interface interface {
 	RESTClient() rest.Interface
 	DeviceClassesGetter
+	DeviceTaintRulesGetter
 	ResourceClaimsGetter
 	ResourceClaimTemplatesGetter
 	ResourceSlicesGetter
@@ -43,6 +44,10 @@ func (c *ResourceV1Client) DeviceClasses() DeviceClassInterface {
 	return newDeviceClasses(c)
 }
 
+func (c *ResourceV1Client) DeviceTaintRules() DeviceTaintRuleInterface {
+	return newDeviceTaintRules(c)
+}
+
 func (c *ResourceV1Client) ResourceClaims(namespace string) ResourceClaimInterface {
 	return newResourceClaims(c, namespace)
 }
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/fake/fake_podgroup.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/fake/fake_podgroup.go
deleted file mode 100644
index 3709cf5214..0000000000
--- a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/fake/fake_podgroup.go
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	v1alpha2 "k8s.io/api/scheduling/v1alpha2"
-	schedulingv1alpha2 "k8s.io/client-go/applyconfigurations/scheduling/v1alpha2"
-	gentype "k8s.io/client-go/gentype"
-	typedschedulingv1alpha2 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2"
-)
-
-// fakePodGroups implements PodGroupInterface
-type fakePodGroups struct {
-	*gentype.FakeClientWithListAndApply[*v1alpha2.PodGroup, *v1alpha2.PodGroupList, *schedulingv1alpha2.PodGroupApplyConfiguration]
-	Fake *FakeSchedulingV1alpha2
-}
-
-func newFakePodGroups(fake *FakeSchedulingV1alpha2, namespace string) typedschedulingv1alpha2.PodGroupInterface {
-	return &fakePodGroups{
-		gentype.NewFakeClientWithListAndApply[*v1alpha2.PodGroup, *v1alpha2.PodGroupList, *schedulingv1alpha2.PodGroupApplyConfiguration](
-			fake.Fake,
-			namespace,
-			v1alpha2.SchemeGroupVersion.WithResource("podgroups"),
-			v1alpha2.SchemeGroupVersion.WithKind("PodGroup"),
-			func() *v1alpha2.PodGroup { return &v1alpha2.PodGroup{} },
-			func() *v1alpha2.PodGroupList { return &v1alpha2.PodGroupList{} },
-			func(dst, src *v1alpha2.PodGroupList) { dst.ListMeta = src.ListMeta },
-			func(list *v1alpha2.PodGroupList) []*v1alpha2.PodGroup { return gentype.ToPointerSlice(list.Items) },
-			func(list *v1alpha2.PodGroupList, items []*v1alpha2.PodGroup) {
-				list.Items = gentype.FromPointerSlice(items)
-			},
-		),
-		fake,
-	}
-}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/fake/fake_workload.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/fake/fake_workload.go
deleted file mode 100644
index 29768874cf..0000000000
--- a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/fake/fake_workload.go
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
-Copyright The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	v1alpha2 "k8s.io/api/scheduling/v1alpha2"
-	schedulingv1alpha2 "k8s.io/client-go/applyconfigurations/scheduling/v1alpha2"
-	gentype "k8s.io/client-go/gentype"
-	typedschedulingv1alpha2 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2"
-)
-
-// fakeWorkloads implements WorkloadInterface
-type fakeWorkloads struct {
-	*gentype.FakeClientWithListAndApply[*v1alpha2.Workload, *v1alpha2.WorkloadList, *schedulingv1alpha2.WorkloadApplyConfiguration]
-	Fake *FakeSchedulingV1alpha2
-}
-
-func newFakeWorkloads(fake *FakeSchedulingV1alpha2, namespace string) typedschedulingv1alpha2.WorkloadInterface {
-	return &fakeWorkloads{
-		gentype.NewFakeClientWithListAndApply[*v1alpha2.Workload, *v1alpha2.WorkloadList, *schedulingv1alpha2.WorkloadApplyConfiguration](
-			fake.Fake,
-			namespace,
-			v1alpha2.SchemeGroupVersion.WithResource("workloads"),
-			v1alpha2.SchemeGroupVersion.WithKind("Workload"),
-			func() *v1alpha2.Workload { return &v1alpha2.Workload{} },
-			func() *v1alpha2.WorkloadList { return &v1alpha2.WorkloadList{} },
-			func(dst, src *v1alpha2.WorkloadList) { dst.ListMeta = src.ListMeta },
-			func(list *v1alpha2.WorkloadList) []*v1alpha2.Workload { return gentype.ToPointerSlice(list.Items) },
-			func(list *v1alpha2.WorkloadList, items []*v1alpha2.Workload) {
-				list.Items = gentype.FromPointerSlice(items)
-			},
-		),
-		fake,
-	}
-}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/compositepodgroup.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/compositepodgroup.go
new file mode 100644
index 0000000000..a301cbd35e
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/compositepodgroup.go
@@ -0,0 +1,75 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	context "context"
+
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	applyconfigurationsschedulingv1alpha3 "k8s.io/client-go/applyconfigurations/scheduling/v1alpha3"
+	gentype "k8s.io/client-go/gentype"
+	scheme "k8s.io/client-go/kubernetes/scheme"
+)
+
+// CompositePodGroupsGetter has a method to return a CompositePodGroupInterface.
+// A group's client should implement this interface.
+type CompositePodGroupsGetter interface {
+	CompositePodGroups(namespace string) CompositePodGroupInterface
+}
+
+// CompositePodGroupInterface has methods to work with CompositePodGroup resources.
+type CompositePodGroupInterface interface {
+	Create(ctx context.Context, compositePodGroup *schedulingv1alpha3.CompositePodGroup, opts v1.CreateOptions) (*schedulingv1alpha3.CompositePodGroup, error)
+	Update(ctx context.Context, compositePodGroup *schedulingv1alpha3.CompositePodGroup, opts v1.UpdateOptions) (*schedulingv1alpha3.CompositePodGroup, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, compositePodGroup *schedulingv1alpha3.CompositePodGroup, opts v1.UpdateOptions) (*schedulingv1alpha3.CompositePodGroup, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*schedulingv1alpha3.CompositePodGroup, error)
+	List(ctx context.Context, opts v1.ListOptions) (*schedulingv1alpha3.CompositePodGroupList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *schedulingv1alpha3.CompositePodGroup, err error)
+	Apply(ctx context.Context, compositePodGroup *applyconfigurationsschedulingv1alpha3.CompositePodGroupApplyConfiguration, opts v1.ApplyOptions) (result *schedulingv1alpha3.CompositePodGroup, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, compositePodGroup *applyconfigurationsschedulingv1alpha3.CompositePodGroupApplyConfiguration, opts v1.ApplyOptions) (result *schedulingv1alpha3.CompositePodGroup, err error)
+	CompositePodGroupExpansion
+}
+
+// compositePodGroups implements CompositePodGroupInterface
+type compositePodGroups struct {
+	*gentype.ClientWithListAndApply[*schedulingv1alpha3.CompositePodGroup, *schedulingv1alpha3.CompositePodGroupList, *applyconfigurationsschedulingv1alpha3.CompositePodGroupApplyConfiguration]
+}
+
+// newCompositePodGroups returns a CompositePodGroups
+func newCompositePodGroups(c *SchedulingV1alpha3Client, namespace string) *compositePodGroups {
+	return &compositePodGroups{
+		gentype.NewClientWithListAndApply[*schedulingv1alpha3.CompositePodGroup, *schedulingv1alpha3.CompositePodGroupList, *applyconfigurationsschedulingv1alpha3.CompositePodGroupApplyConfiguration](
+			"compositepodgroups",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *schedulingv1alpha3.CompositePodGroup { return &schedulingv1alpha3.CompositePodGroup{} },
+			func() *schedulingv1alpha3.CompositePodGroupList { return &schedulingv1alpha3.CompositePodGroupList{} },
+			gentype.PrefersProtobuf[*schedulingv1alpha3.CompositePodGroup](),
+		),
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/doc.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/doc.go
new file mode 100644
index 0000000000..fdb23fd37c
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha3
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake/doc.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake/doc.go
new file mode 100644
index 0000000000..16f4439906
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake/fake_compositepodgroup.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake/fake_compositepodgroup.go
new file mode 100644
index 0000000000..658c5fe539
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake/fake_compositepodgroup.go
@@ -0,0 +1,53 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha3 "k8s.io/api/scheduling/v1alpha3"
+	schedulingv1alpha3 "k8s.io/client-go/applyconfigurations/scheduling/v1alpha3"
+	gentype "k8s.io/client-go/gentype"
+	typedschedulingv1alpha3 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3"
+)
+
+// fakeCompositePodGroups implements CompositePodGroupInterface
+type fakeCompositePodGroups struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha3.CompositePodGroup, *v1alpha3.CompositePodGroupList, *schedulingv1alpha3.CompositePodGroupApplyConfiguration]
+	Fake *FakeSchedulingV1alpha3
+}
+
+func newFakeCompositePodGroups(fake *FakeSchedulingV1alpha3, namespace string) typedschedulingv1alpha3.CompositePodGroupInterface {
+	return &fakeCompositePodGroups{
+		gentype.NewFakeClientWithListAndApply[*v1alpha3.CompositePodGroup, *v1alpha3.CompositePodGroupList, *schedulingv1alpha3.CompositePodGroupApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha3.SchemeGroupVersion.WithResource("compositepodgroups"),
+			v1alpha3.SchemeGroupVersion.WithKind("CompositePodGroup"),
+			func() *v1alpha3.CompositePodGroup { return &v1alpha3.CompositePodGroup{} },
+			func() *v1alpha3.CompositePodGroupList { return &v1alpha3.CompositePodGroupList{} },
+			func(dst, src *v1alpha3.CompositePodGroupList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha3.CompositePodGroupList) []*v1alpha3.CompositePodGroup {
+				return gentype.ToPointerSlice(list.Items)
+			},
+			func(list *v1alpha3.CompositePodGroupList, items []*v1alpha3.CompositePodGroup) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake/fake_podgroup.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake/fake_podgroup.go
new file mode 100644
index 0000000000..bc8ab4806d
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake/fake_podgroup.go
@@ -0,0 +1,51 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha3 "k8s.io/api/scheduling/v1alpha3"
+	schedulingv1alpha3 "k8s.io/client-go/applyconfigurations/scheduling/v1alpha3"
+	gentype "k8s.io/client-go/gentype"
+	typedschedulingv1alpha3 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3"
+)
+
+// fakePodGroups implements PodGroupInterface
+type fakePodGroups struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha3.PodGroup, *v1alpha3.PodGroupList, *schedulingv1alpha3.PodGroupApplyConfiguration]
+	Fake *FakeSchedulingV1alpha3
+}
+
+func newFakePodGroups(fake *FakeSchedulingV1alpha3, namespace string) typedschedulingv1alpha3.PodGroupInterface {
+	return &fakePodGroups{
+		gentype.NewFakeClientWithListAndApply[*v1alpha3.PodGroup, *v1alpha3.PodGroupList, *schedulingv1alpha3.PodGroupApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha3.SchemeGroupVersion.WithResource("podgroups"),
+			v1alpha3.SchemeGroupVersion.WithKind("PodGroup"),
+			func() *v1alpha3.PodGroup { return &v1alpha3.PodGroup{} },
+			func() *v1alpha3.PodGroupList { return &v1alpha3.PodGroupList{} },
+			func(dst, src *v1alpha3.PodGroupList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha3.PodGroupList) []*v1alpha3.PodGroup { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1alpha3.PodGroupList, items []*v1alpha3.PodGroup) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake/fake_scheduling_client.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake/fake_scheduling_client.go
new file mode 100644
index 0000000000..920c242afc
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake/fake_scheduling_client.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha3 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3"
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+)
+
+type FakeSchedulingV1alpha3 struct {
+	*testing.Fake
+}
+
+func (c *FakeSchedulingV1alpha3) CompositePodGroups(namespace string) v1alpha3.CompositePodGroupInterface {
+	return newFakeCompositePodGroups(c, namespace)
+}
+
+func (c *FakeSchedulingV1alpha3) PodGroups(namespace string) v1alpha3.PodGroupInterface {
+	return newFakePodGroups(c, namespace)
+}
+
+func (c *FakeSchedulingV1alpha3) Workloads(namespace string) v1alpha3.WorkloadInterface {
+	return newFakeWorkloads(c, namespace)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeSchedulingV1alpha3) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake/fake_workload.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake/fake_workload.go
new file mode 100644
index 0000000000..b491a40273
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake/fake_workload.go
@@ -0,0 +1,51 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha3 "k8s.io/api/scheduling/v1alpha3"
+	schedulingv1alpha3 "k8s.io/client-go/applyconfigurations/scheduling/v1alpha3"
+	gentype "k8s.io/client-go/gentype"
+	typedschedulingv1alpha3 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3"
+)
+
+// fakeWorkloads implements WorkloadInterface
+type fakeWorkloads struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha3.Workload, *v1alpha3.WorkloadList, *schedulingv1alpha3.WorkloadApplyConfiguration]
+	Fake *FakeSchedulingV1alpha3
+}
+
+func newFakeWorkloads(fake *FakeSchedulingV1alpha3, namespace string) typedschedulingv1alpha3.WorkloadInterface {
+	return &fakeWorkloads{
+		gentype.NewFakeClientWithListAndApply[*v1alpha3.Workload, *v1alpha3.WorkloadList, *schedulingv1alpha3.WorkloadApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha3.SchemeGroupVersion.WithResource("workloads"),
+			v1alpha3.SchemeGroupVersion.WithKind("Workload"),
+			func() *v1alpha3.Workload { return &v1alpha3.Workload{} },
+			func() *v1alpha3.WorkloadList { return &v1alpha3.WorkloadList{} },
+			func(dst, src *v1alpha3.WorkloadList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha3.WorkloadList) []*v1alpha3.Workload { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1alpha3.WorkloadList, items []*v1alpha3.Workload) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/generated_expansion.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/generated_expansion.go
similarity index 91%
rename from vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/generated_expansion.go
rename to vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/generated_expansion.go
index 60668af04d..a222ec4604 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/generated_expansion.go
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/generated_expansion.go
@@ -16,7 +16,9 @@ limitations under the License.
 
 // Code generated by client-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
+
+type CompositePodGroupExpansion interface{}
 
 type PodGroupExpansion interface{}
 
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/podgroup.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/podgroup.go
similarity index 59%
rename from vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/podgroup.go
rename to vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/podgroup.go
index bbe91d35ab..81024d7e6c 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/podgroup.go
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/podgroup.go
@@ -16,16 +16,16 @@ limitations under the License.
 
 // Code generated by client-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
 
 import (
 	context "context"
 
-	schedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsschedulingv1alpha2 "k8s.io/client-go/applyconfigurations/scheduling/v1alpha2"
+	applyconfigurationsschedulingv1alpha3 "k8s.io/client-go/applyconfigurations/scheduling/v1alpha3"
 	gentype "k8s.io/client-go/gentype"
 	scheme "k8s.io/client-go/kubernetes/scheme"
 )
@@ -38,38 +38,38 @@ type PodGroupsGetter interface {
 
 // PodGroupInterface has methods to work with PodGroup resources.
 type PodGroupInterface interface {
-	Create(ctx context.Context, podGroup *schedulingv1alpha2.PodGroup, opts v1.CreateOptions) (*schedulingv1alpha2.PodGroup, error)
-	Update(ctx context.Context, podGroup *schedulingv1alpha2.PodGroup, opts v1.UpdateOptions) (*schedulingv1alpha2.PodGroup, error)
+	Create(ctx context.Context, podGroup *schedulingv1alpha3.PodGroup, opts v1.CreateOptions) (*schedulingv1alpha3.PodGroup, error)
+	Update(ctx context.Context, podGroup *schedulingv1alpha3.PodGroup, opts v1.UpdateOptions) (*schedulingv1alpha3.PodGroup, error)
 	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-	UpdateStatus(ctx context.Context, podGroup *schedulingv1alpha2.PodGroup, opts v1.UpdateOptions) (*schedulingv1alpha2.PodGroup, error)
+	UpdateStatus(ctx context.Context, podGroup *schedulingv1alpha3.PodGroup, opts v1.UpdateOptions) (*schedulingv1alpha3.PodGroup, error)
 	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
 	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*schedulingv1alpha2.PodGroup, error)
-	List(ctx context.Context, opts v1.ListOptions) (*schedulingv1alpha2.PodGroupList, error)
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*schedulingv1alpha3.PodGroup, error)
+	List(ctx context.Context, opts v1.ListOptions) (*schedulingv1alpha3.PodGroupList, error)
 	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *schedulingv1alpha2.PodGroup, err error)
-	Apply(ctx context.Context, podGroup *applyconfigurationsschedulingv1alpha2.PodGroupApplyConfiguration, opts v1.ApplyOptions) (result *schedulingv1alpha2.PodGroup, err error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *schedulingv1alpha3.PodGroup, err error)
+	Apply(ctx context.Context, podGroup *applyconfigurationsschedulingv1alpha3.PodGroupApplyConfiguration, opts v1.ApplyOptions) (result *schedulingv1alpha3.PodGroup, err error)
 	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
-	ApplyStatus(ctx context.Context, podGroup *applyconfigurationsschedulingv1alpha2.PodGroupApplyConfiguration, opts v1.ApplyOptions) (result *schedulingv1alpha2.PodGroup, err error)
+	ApplyStatus(ctx context.Context, podGroup *applyconfigurationsschedulingv1alpha3.PodGroupApplyConfiguration, opts v1.ApplyOptions) (result *schedulingv1alpha3.PodGroup, err error)
 	PodGroupExpansion
 }
 
 // podGroups implements PodGroupInterface
 type podGroups struct {
-	*gentype.ClientWithListAndApply[*schedulingv1alpha2.PodGroup, *schedulingv1alpha2.PodGroupList, *applyconfigurationsschedulingv1alpha2.PodGroupApplyConfiguration]
+	*gentype.ClientWithListAndApply[*schedulingv1alpha3.PodGroup, *schedulingv1alpha3.PodGroupList, *applyconfigurationsschedulingv1alpha3.PodGroupApplyConfiguration]
 }
 
 // newPodGroups returns a PodGroups
-func newPodGroups(c *SchedulingV1alpha2Client, namespace string) *podGroups {
+func newPodGroups(c *SchedulingV1alpha3Client, namespace string) *podGroups {
 	return &podGroups{
-		gentype.NewClientWithListAndApply[*schedulingv1alpha2.PodGroup, *schedulingv1alpha2.PodGroupList, *applyconfigurationsschedulingv1alpha2.PodGroupApplyConfiguration](
+		gentype.NewClientWithListAndApply[*schedulingv1alpha3.PodGroup, *schedulingv1alpha3.PodGroupList, *applyconfigurationsschedulingv1alpha3.PodGroupApplyConfiguration](
 			"podgroups",
 			c.RESTClient(),
 			scheme.ParameterCodec,
 			namespace,
-			func() *schedulingv1alpha2.PodGroup { return &schedulingv1alpha2.PodGroup{} },
-			func() *schedulingv1alpha2.PodGroupList { return &schedulingv1alpha2.PodGroupList{} },
-			gentype.PrefersProtobuf[*schedulingv1alpha2.PodGroup](),
+			func() *schedulingv1alpha3.PodGroup { return &schedulingv1alpha3.PodGroup{} },
+			func() *schedulingv1alpha3.PodGroupList { return &schedulingv1alpha3.PodGroupList{} },
+			gentype.PrefersProtobuf[*schedulingv1alpha3.PodGroup](),
 		),
 	}
 }
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/scheduling_client.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/scheduling_client.go
similarity index 65%
rename from vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/scheduling_client.go
rename to vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/scheduling_client.go
index 8ccdc178b9..8c99d51ca5 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/scheduling_client.go
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/scheduling_client.go
@@ -16,39 +16,44 @@ limitations under the License.
 
 // Code generated by client-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
 
 import (
 	http "net/http"
 
-	schedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
 	scheme "k8s.io/client-go/kubernetes/scheme"
 	rest "k8s.io/client-go/rest"
 )
 
-type SchedulingV1alpha2Interface interface {
+type SchedulingV1alpha3Interface interface {
 	RESTClient() rest.Interface
+	CompositePodGroupsGetter
 	PodGroupsGetter
 	WorkloadsGetter
 }
 
-// SchedulingV1alpha2Client is used to interact with features provided by the scheduling.k8s.io group.
-type SchedulingV1alpha2Client struct {
+// SchedulingV1alpha3Client is used to interact with features provided by the scheduling.k8s.io group.
+type SchedulingV1alpha3Client struct {
 	restClient rest.Interface
 }
 
-func (c *SchedulingV1alpha2Client) PodGroups(namespace string) PodGroupInterface {
+func (c *SchedulingV1alpha3Client) CompositePodGroups(namespace string) CompositePodGroupInterface {
+	return newCompositePodGroups(c, namespace)
+}
+
+func (c *SchedulingV1alpha3Client) PodGroups(namespace string) PodGroupInterface {
 	return newPodGroups(c, namespace)
 }
 
-func (c *SchedulingV1alpha2Client) Workloads(namespace string) WorkloadInterface {
+func (c *SchedulingV1alpha3Client) Workloads(namespace string) WorkloadInterface {
 	return newWorkloads(c, namespace)
 }
 
-// NewForConfig creates a new SchedulingV1alpha2Client for the given config.
+// NewForConfig creates a new SchedulingV1alpha3Client for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
-func NewForConfig(c *rest.Config) (*SchedulingV1alpha2Client, error) {
+func NewForConfig(c *rest.Config) (*SchedulingV1alpha3Client, error) {
 	config := *c
 	setConfigDefaults(&config)
 	httpClient, err := rest.HTTPClientFor(&config)
@@ -58,21 +63,21 @@ func NewForConfig(c *rest.Config) (*SchedulingV1alpha2Client, error) {
 	return NewForConfigAndClient(&config, httpClient)
 }
 
-// NewForConfigAndClient creates a new SchedulingV1alpha2Client for the given config and http client.
+// NewForConfigAndClient creates a new SchedulingV1alpha3Client for the given config and http client.
 // Note the http client provided takes precedence over the configured transport values.
-func NewForConfigAndClient(c *rest.Config, h *http.Client) (*SchedulingV1alpha2Client, error) {
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*SchedulingV1alpha3Client, error) {
 	config := *c
 	setConfigDefaults(&config)
 	client, err := rest.RESTClientForConfigAndClient(&config, h)
 	if err != nil {
 		return nil, err
 	}
-	return &SchedulingV1alpha2Client{client}, nil
+	return &SchedulingV1alpha3Client{client}, nil
 }
 
-// NewForConfigOrDie creates a new SchedulingV1alpha2Client for the given config and
+// NewForConfigOrDie creates a new SchedulingV1alpha3Client for the given config and
 // panics if there is an error in the config.
-func NewForConfigOrDie(c *rest.Config) *SchedulingV1alpha2Client {
+func NewForConfigOrDie(c *rest.Config) *SchedulingV1alpha3Client {
 	client, err := NewForConfig(c)
 	if err != nil {
 		panic(err)
@@ -80,13 +85,13 @@ func NewForConfigOrDie(c *rest.Config) *SchedulingV1alpha2Client {
 	return client
 }
 
-// New creates a new SchedulingV1alpha2Client for the given RESTClient.
-func New(c rest.Interface) *SchedulingV1alpha2Client {
-	return &SchedulingV1alpha2Client{c}
+// New creates a new SchedulingV1alpha3Client for the given RESTClient.
+func New(c rest.Interface) *SchedulingV1alpha3Client {
+	return &SchedulingV1alpha3Client{c}
 }
 
 func setConfigDefaults(config *rest.Config) {
-	gv := schedulingv1alpha2.SchemeGroupVersion
+	gv := schedulingv1alpha3.SchemeGroupVersion
 	config.GroupVersion = &gv
 	config.APIPath = "/apis"
 	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
@@ -98,7 +103,7 @@ func setConfigDefaults(config *rest.Config) {
 
 // RESTClient returns a RESTClient that is used to communicate
 // with API server by this client implementation.
-func (c *SchedulingV1alpha2Client) RESTClient() rest.Interface {
+func (c *SchedulingV1alpha3Client) RESTClient() rest.Interface {
 	if c == nil {
 		return nil
 	}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/workload.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/workload.go
similarity index 62%
rename from vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/workload.go
rename to vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/workload.go
index 89790940bc..f4c9d7cf68 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/workload.go
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/workload.go
@@ -16,16 +16,16 @@ limitations under the License.
 
 // Code generated by client-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
 
 import (
 	context "context"
 
-	schedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsschedulingv1alpha2 "k8s.io/client-go/applyconfigurations/scheduling/v1alpha2"
+	applyconfigurationsschedulingv1alpha3 "k8s.io/client-go/applyconfigurations/scheduling/v1alpha3"
 	gentype "k8s.io/client-go/gentype"
 	scheme "k8s.io/client-go/kubernetes/scheme"
 )
@@ -38,34 +38,34 @@ type WorkloadsGetter interface {
 
 // WorkloadInterface has methods to work with Workload resources.
 type WorkloadInterface interface {
-	Create(ctx context.Context, workload *schedulingv1alpha2.Workload, opts v1.CreateOptions) (*schedulingv1alpha2.Workload, error)
-	Update(ctx context.Context, workload *schedulingv1alpha2.Workload, opts v1.UpdateOptions) (*schedulingv1alpha2.Workload, error)
+	Create(ctx context.Context, workload *schedulingv1alpha3.Workload, opts v1.CreateOptions) (*schedulingv1alpha3.Workload, error)
+	Update(ctx context.Context, workload *schedulingv1alpha3.Workload, opts v1.UpdateOptions) (*schedulingv1alpha3.Workload, error)
 	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
 	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*schedulingv1alpha2.Workload, error)
-	List(ctx context.Context, opts v1.ListOptions) (*schedulingv1alpha2.WorkloadList, error)
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*schedulingv1alpha3.Workload, error)
+	List(ctx context.Context, opts v1.ListOptions) (*schedulingv1alpha3.WorkloadList, error)
 	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *schedulingv1alpha2.Workload, err error)
-	Apply(ctx context.Context, workload *applyconfigurationsschedulingv1alpha2.WorkloadApplyConfiguration, opts v1.ApplyOptions) (result *schedulingv1alpha2.Workload, err error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *schedulingv1alpha3.Workload, err error)
+	Apply(ctx context.Context, workload *applyconfigurationsschedulingv1alpha3.WorkloadApplyConfiguration, opts v1.ApplyOptions) (result *schedulingv1alpha3.Workload, err error)
 	WorkloadExpansion
 }
 
 // workloads implements WorkloadInterface
 type workloads struct {
-	*gentype.ClientWithListAndApply[*schedulingv1alpha2.Workload, *schedulingv1alpha2.WorkloadList, *applyconfigurationsschedulingv1alpha2.WorkloadApplyConfiguration]
+	*gentype.ClientWithListAndApply[*schedulingv1alpha3.Workload, *schedulingv1alpha3.WorkloadList, *applyconfigurationsschedulingv1alpha3.WorkloadApplyConfiguration]
 }
 
 // newWorkloads returns a Workloads
-func newWorkloads(c *SchedulingV1alpha2Client, namespace string) *workloads {
+func newWorkloads(c *SchedulingV1alpha3Client, namespace string) *workloads {
 	return &workloads{
-		gentype.NewClientWithListAndApply[*schedulingv1alpha2.Workload, *schedulingv1alpha2.WorkloadList, *applyconfigurationsschedulingv1alpha2.WorkloadApplyConfiguration](
+		gentype.NewClientWithListAndApply[*schedulingv1alpha3.Workload, *schedulingv1alpha3.WorkloadList, *applyconfigurationsschedulingv1alpha3.WorkloadApplyConfiguration](
 			"workloads",
 			c.RESTClient(),
 			scheme.ParameterCodec,
 			namespace,
-			func() *schedulingv1alpha2.Workload { return &schedulingv1alpha2.Workload{} },
-			func() *schedulingv1alpha2.WorkloadList { return &schedulingv1alpha2.WorkloadList{} },
-			gentype.PrefersProtobuf[*schedulingv1alpha2.Workload](),
+			func() *schedulingv1alpha3.Workload { return &schedulingv1alpha3.Workload{} },
+			func() *schedulingv1alpha3.WorkloadList { return &schedulingv1alpha3.WorkloadList{} },
+			gentype.PrefersProtobuf[*schedulingv1alpha3.Workload](),
 		),
 	}
 }
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/fake/fake_podgroup.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/fake/fake_podgroup.go
new file mode 100644
index 0000000000..0874dfd5b5
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/fake/fake_podgroup.go
@@ -0,0 +1,51 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1beta1 "k8s.io/api/scheduling/v1beta1"
+	schedulingv1beta1 "k8s.io/client-go/applyconfigurations/scheduling/v1beta1"
+	gentype "k8s.io/client-go/gentype"
+	typedschedulingv1beta1 "k8s.io/client-go/kubernetes/typed/scheduling/v1beta1"
+)
+
+// fakePodGroups implements PodGroupInterface
+type fakePodGroups struct {
+	*gentype.FakeClientWithListAndApply[*v1beta1.PodGroup, *v1beta1.PodGroupList, *schedulingv1beta1.PodGroupApplyConfiguration]
+	Fake *FakeSchedulingV1beta1
+}
+
+func newFakePodGroups(fake *FakeSchedulingV1beta1, namespace string) typedschedulingv1beta1.PodGroupInterface {
+	return &fakePodGroups{
+		gentype.NewFakeClientWithListAndApply[*v1beta1.PodGroup, *v1beta1.PodGroupList, *schedulingv1beta1.PodGroupApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1beta1.SchemeGroupVersion.WithResource("podgroups"),
+			v1beta1.SchemeGroupVersion.WithKind("PodGroup"),
+			func() *v1beta1.PodGroup { return &v1beta1.PodGroup{} },
+			func() *v1beta1.PodGroupList { return &v1beta1.PodGroupList{} },
+			func(dst, src *v1beta1.PodGroupList) { dst.ListMeta = src.ListMeta },
+			func(list *v1beta1.PodGroupList) []*v1beta1.PodGroup { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1beta1.PodGroupList, items []*v1beta1.PodGroup) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/fake/fake_scheduling_client.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/fake/fake_scheduling_client.go
index f06fdab114..8f81b08983 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/fake/fake_scheduling_client.go
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/fake/fake_scheduling_client.go
@@ -28,10 +28,18 @@ type FakeSchedulingV1beta1 struct {
 	*testing.Fake
 }
 
+func (c *FakeSchedulingV1beta1) PodGroups(namespace string) v1beta1.PodGroupInterface {
+	return newFakePodGroups(c, namespace)
+}
+
 func (c *FakeSchedulingV1beta1) PriorityClasses() v1beta1.PriorityClassInterface {
 	return newFakePriorityClasses(c)
 }
 
+func (c *FakeSchedulingV1beta1) Workloads(namespace string) v1beta1.WorkloadInterface {
+	return newFakeWorkloads(c, namespace)
+}
+
 // RESTClient returns a RESTClient that is used to communicate
 // with API server by this client implementation.
 func (c *FakeSchedulingV1beta1) RESTClient() rest.Interface {
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/fake/fake_workload.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/fake/fake_workload.go
new file mode 100644
index 0000000000..355b228abe
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/fake/fake_workload.go
@@ -0,0 +1,51 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1beta1 "k8s.io/api/scheduling/v1beta1"
+	schedulingv1beta1 "k8s.io/client-go/applyconfigurations/scheduling/v1beta1"
+	gentype "k8s.io/client-go/gentype"
+	typedschedulingv1beta1 "k8s.io/client-go/kubernetes/typed/scheduling/v1beta1"
+)
+
+// fakeWorkloads implements WorkloadInterface
+type fakeWorkloads struct {
+	*gentype.FakeClientWithListAndApply[*v1beta1.Workload, *v1beta1.WorkloadList, *schedulingv1beta1.WorkloadApplyConfiguration]
+	Fake *FakeSchedulingV1beta1
+}
+
+func newFakeWorkloads(fake *FakeSchedulingV1beta1, namespace string) typedschedulingv1beta1.WorkloadInterface {
+	return &fakeWorkloads{
+		gentype.NewFakeClientWithListAndApply[*v1beta1.Workload, *v1beta1.WorkloadList, *schedulingv1beta1.WorkloadApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1beta1.SchemeGroupVersion.WithResource("workloads"),
+			v1beta1.SchemeGroupVersion.WithKind("Workload"),
+			func() *v1beta1.Workload { return &v1beta1.Workload{} },
+			func() *v1beta1.WorkloadList { return &v1beta1.WorkloadList{} },
+			func(dst, src *v1beta1.WorkloadList) { dst.ListMeta = src.ListMeta },
+			func(list *v1beta1.WorkloadList) []*v1beta1.Workload { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1beta1.WorkloadList, items []*v1beta1.Workload) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/generated_expansion.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/generated_expansion.go
index 3bab873e6f..719e1e0e57 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/generated_expansion.go
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/generated_expansion.go
@@ -18,4 +18,8 @@ limitations under the License.
 
 package v1beta1
 
+type PodGroupExpansion interface{}
+
 type PriorityClassExpansion interface{}
+
+type WorkloadExpansion interface{}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/podgroup.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/podgroup.go
new file mode 100644
index 0000000000..4eb85b94c7
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/podgroup.go
@@ -0,0 +1,75 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+
+	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	applyconfigurationsschedulingv1beta1 "k8s.io/client-go/applyconfigurations/scheduling/v1beta1"
+	gentype "k8s.io/client-go/gentype"
+	scheme "k8s.io/client-go/kubernetes/scheme"
+)
+
+// PodGroupsGetter has a method to return a PodGroupInterface.
+// A group's client should implement this interface.
+type PodGroupsGetter interface {
+	PodGroups(namespace string) PodGroupInterface
+}
+
+// PodGroupInterface has methods to work with PodGroup resources.
+type PodGroupInterface interface {
+	Create(ctx context.Context, podGroup *schedulingv1beta1.PodGroup, opts v1.CreateOptions) (*schedulingv1beta1.PodGroup, error)
+	Update(ctx context.Context, podGroup *schedulingv1beta1.PodGroup, opts v1.UpdateOptions) (*schedulingv1beta1.PodGroup, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, podGroup *schedulingv1beta1.PodGroup, opts v1.UpdateOptions) (*schedulingv1beta1.PodGroup, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*schedulingv1beta1.PodGroup, error)
+	List(ctx context.Context, opts v1.ListOptions) (*schedulingv1beta1.PodGroupList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *schedulingv1beta1.PodGroup, err error)
+	Apply(ctx context.Context, podGroup *applyconfigurationsschedulingv1beta1.PodGroupApplyConfiguration, opts v1.ApplyOptions) (result *schedulingv1beta1.PodGroup, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, podGroup *applyconfigurationsschedulingv1beta1.PodGroupApplyConfiguration, opts v1.ApplyOptions) (result *schedulingv1beta1.PodGroup, err error)
+	PodGroupExpansion
+}
+
+// podGroups implements PodGroupInterface
+type podGroups struct {
+	*gentype.ClientWithListAndApply[*schedulingv1beta1.PodGroup, *schedulingv1beta1.PodGroupList, *applyconfigurationsschedulingv1beta1.PodGroupApplyConfiguration]
+}
+
+// newPodGroups returns a PodGroups
+func newPodGroups(c *SchedulingV1beta1Client, namespace string) *podGroups {
+	return &podGroups{
+		gentype.NewClientWithListAndApply[*schedulingv1beta1.PodGroup, *schedulingv1beta1.PodGroupList, *applyconfigurationsschedulingv1beta1.PodGroupApplyConfiguration](
+			"podgroups",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *schedulingv1beta1.PodGroup { return &schedulingv1beta1.PodGroup{} },
+			func() *schedulingv1beta1.PodGroupList { return &schedulingv1beta1.PodGroupList{} },
+			gentype.PrefersProtobuf[*schedulingv1beta1.PodGroup](),
+		),
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/scheduling_client.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/scheduling_client.go
index 0b2aa0e1ac..b2d7e6d261 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/scheduling_client.go
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/scheduling_client.go
@@ -28,7 +28,9 @@ import (
 
 type SchedulingV1beta1Interface interface {
 	RESTClient() rest.Interface
+	PodGroupsGetter
 	PriorityClassesGetter
+	WorkloadsGetter
 }
 
 // SchedulingV1beta1Client is used to interact with features provided by the scheduling.k8s.io group.
@@ -36,10 +38,18 @@ type SchedulingV1beta1Client struct {
 	restClient rest.Interface
 }
 
+func (c *SchedulingV1beta1Client) PodGroups(namespace string) PodGroupInterface {
+	return newPodGroups(c, namespace)
+}
+
 func (c *SchedulingV1beta1Client) PriorityClasses() PriorityClassInterface {
 	return newPriorityClasses(c)
 }
 
+func (c *SchedulingV1beta1Client) Workloads(namespace string) WorkloadInterface {
+	return newWorkloads(c, namespace)
+}
+
 // NewForConfig creates a new SchedulingV1beta1Client for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/workload.go b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/workload.go
new file mode 100644
index 0000000000..e5313ab593
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/workload.go
@@ -0,0 +1,71 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+
+	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	applyconfigurationsschedulingv1beta1 "k8s.io/client-go/applyconfigurations/scheduling/v1beta1"
+	gentype "k8s.io/client-go/gentype"
+	scheme "k8s.io/client-go/kubernetes/scheme"
+)
+
+// WorkloadsGetter has a method to return a WorkloadInterface.
+// A group's client should implement this interface.
+type WorkloadsGetter interface {
+	Workloads(namespace string) WorkloadInterface
+}
+
+// WorkloadInterface has methods to work with Workload resources.
+type WorkloadInterface interface {
+	Create(ctx context.Context, workload *schedulingv1beta1.Workload, opts v1.CreateOptions) (*schedulingv1beta1.Workload, error)
+	Update(ctx context.Context, workload *schedulingv1beta1.Workload, opts v1.UpdateOptions) (*schedulingv1beta1.Workload, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*schedulingv1beta1.Workload, error)
+	List(ctx context.Context, opts v1.ListOptions) (*schedulingv1beta1.WorkloadList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *schedulingv1beta1.Workload, err error)
+	Apply(ctx context.Context, workload *applyconfigurationsschedulingv1beta1.WorkloadApplyConfiguration, opts v1.ApplyOptions) (result *schedulingv1beta1.Workload, err error)
+	WorkloadExpansion
+}
+
+// workloads implements WorkloadInterface
+type workloads struct {
+	*gentype.ClientWithListAndApply[*schedulingv1beta1.Workload, *schedulingv1beta1.WorkloadList, *applyconfigurationsschedulingv1beta1.WorkloadApplyConfiguration]
+}
+
+// newWorkloads returns a Workloads
+func newWorkloads(c *SchedulingV1beta1Client, namespace string) *workloads {
+	return &workloads{
+		gentype.NewClientWithListAndApply[*schedulingv1beta1.Workload, *schedulingv1beta1.WorkloadList, *applyconfigurationsschedulingv1beta1.WorkloadApplyConfiguration](
+			"workloads",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *schedulingv1beta1.Workload { return &schedulingv1beta1.Workload{} },
+			func() *schedulingv1beta1.WorkloadList { return &schedulingv1beta1.WorkloadList{} },
+			gentype.PrefersProtobuf[*schedulingv1beta1.Workload](),
+		),
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/storage/v1/csinode.go b/vendor/k8s.io/client-go/kubernetes/typed/storage/v1/csinode.go
index a4fe6a0ee5..05d7302ba3 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/storage/v1/csinode.go
+++ b/vendor/k8s.io/client-go/kubernetes/typed/storage/v1/csinode.go
@@ -40,6 +40,8 @@ type CSINodesGetter interface {
 type CSINodeInterface interface {
 	Create(ctx context.Context, cSINode *storagev1.CSINode, opts metav1.CreateOptions) (*storagev1.CSINode, error)
 	Update(ctx context.Context, cSINode *storagev1.CSINode, opts metav1.UpdateOptions) (*storagev1.CSINode, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, cSINode *storagev1.CSINode, opts metav1.UpdateOptions) (*storagev1.CSINode, error)
 	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
 	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
 	Get(ctx context.Context, name string, opts metav1.GetOptions) (*storagev1.CSINode, error)
@@ -47,6 +49,8 @@ type CSINodeInterface interface {
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
 	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *storagev1.CSINode, err error)
 	Apply(ctx context.Context, cSINode *applyconfigurationsstoragev1.CSINodeApplyConfiguration, opts metav1.ApplyOptions) (result *storagev1.CSINode, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, cSINode *applyconfigurationsstoragev1.CSINodeApplyConfiguration, opts metav1.ApplyOptions) (result *storagev1.CSINode, err error)
 	CSINodeExpansion
 }
 
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/storage/v1beta1/csinode.go b/vendor/k8s.io/client-go/kubernetes/typed/storage/v1beta1/csinode.go
index 5e8eb2e376..6009d0d9a9 100644
--- a/vendor/k8s.io/client-go/kubernetes/typed/storage/v1beta1/csinode.go
+++ b/vendor/k8s.io/client-go/kubernetes/typed/storage/v1beta1/csinode.go
@@ -40,6 +40,8 @@ type CSINodesGetter interface {
 type CSINodeInterface interface {
 	Create(ctx context.Context, cSINode *storagev1beta1.CSINode, opts v1.CreateOptions) (*storagev1beta1.CSINode, error)
 	Update(ctx context.Context, cSINode *storagev1beta1.CSINode, opts v1.UpdateOptions) (*storagev1beta1.CSINode, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, cSINode *storagev1beta1.CSINode, opts v1.UpdateOptions) (*storagev1beta1.CSINode, error)
 	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
 	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
 	Get(ctx context.Context, name string, opts v1.GetOptions) (*storagev1beta1.CSINode, error)
@@ -47,6 +49,8 @@ type CSINodeInterface interface {
 	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
 	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *storagev1beta1.CSINode, err error)
 	Apply(ctx context.Context, cSINode *applyconfigurationsstoragev1beta1.CSINodeApplyConfiguration, opts v1.ApplyOptions) (result *storagev1beta1.CSINode, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, cSINode *applyconfigurationsstoragev1beta1.CSINodeApplyConfiguration, opts v1.ApplyOptions) (result *storagev1beta1.CSINode, err error)
 	CSINodeExpansion
 }
 
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/doc.go b/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/doc.go
new file mode 100644
index 0000000000..3af5d054f1
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/fake/doc.go b/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/fake/doc.go
new file mode 100644
index 0000000000..16f4439906
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/fake/fake_storagemigration_client.go b/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/fake/fake_storagemigration_client.go
new file mode 100644
index 0000000000..c125b3b3bd
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/fake/fake_storagemigration_client.go
@@ -0,0 +1,40 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1 "k8s.io/client-go/kubernetes/typed/storagemigration/v1"
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+)
+
+type FakeStoragemigrationV1 struct {
+	*testing.Fake
+}
+
+func (c *FakeStoragemigrationV1) StorageVersionMigrations() v1.StorageVersionMigrationInterface {
+	return newFakeStorageVersionMigrations(c)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeStoragemigrationV1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/fake/fake_storageversionmigration.go b/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/fake/fake_storageversionmigration.go
new file mode 100644
index 0000000000..9192f914ab
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/fake/fake_storageversionmigration.go
@@ -0,0 +1,53 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1 "k8s.io/api/storagemigration/v1"
+	storagemigrationv1 "k8s.io/client-go/applyconfigurations/storagemigration/v1"
+	gentype "k8s.io/client-go/gentype"
+	typedstoragemigrationv1 "k8s.io/client-go/kubernetes/typed/storagemigration/v1"
+)
+
+// fakeStorageVersionMigrations implements StorageVersionMigrationInterface
+type fakeStorageVersionMigrations struct {
+	*gentype.FakeClientWithListAndApply[*v1.StorageVersionMigration, *v1.StorageVersionMigrationList, *storagemigrationv1.StorageVersionMigrationApplyConfiguration]
+	Fake *FakeStoragemigrationV1
+}
+
+func newFakeStorageVersionMigrations(fake *FakeStoragemigrationV1) typedstoragemigrationv1.StorageVersionMigrationInterface {
+	return &fakeStorageVersionMigrations{
+		gentype.NewFakeClientWithListAndApply[*v1.StorageVersionMigration, *v1.StorageVersionMigrationList, *storagemigrationv1.StorageVersionMigrationApplyConfiguration](
+			fake.Fake,
+			"",
+			v1.SchemeGroupVersion.WithResource("storageversionmigrations"),
+			v1.SchemeGroupVersion.WithKind("StorageVersionMigration"),
+			func() *v1.StorageVersionMigration { return &v1.StorageVersionMigration{} },
+			func() *v1.StorageVersionMigrationList { return &v1.StorageVersionMigrationList{} },
+			func(dst, src *v1.StorageVersionMigrationList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.StorageVersionMigrationList) []*v1.StorageVersionMigration {
+				return gentype.ToPointerSlice(list.Items)
+			},
+			func(list *v1.StorageVersionMigrationList, items []*v1.StorageVersionMigration) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/generated_expansion.go b/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/generated_expansion.go
new file mode 100644
index 0000000000..65521b370a
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+type StorageVersionMigrationExpansion interface{}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/storagemigration_client.go b/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/storagemigration_client.go
new file mode 100644
index 0000000000..600e7904e5
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/storagemigration_client.go
@@ -0,0 +1,101 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	http "net/http"
+
+	storagemigrationv1 "k8s.io/api/storagemigration/v1"
+	scheme "k8s.io/client-go/kubernetes/scheme"
+	rest "k8s.io/client-go/rest"
+)
+
+type StoragemigrationV1Interface interface {
+	RESTClient() rest.Interface
+	StorageVersionMigrationsGetter
+}
+
+// StoragemigrationV1Client is used to interact with features provided by the storagemigration.k8s.io group.
+type StoragemigrationV1Client struct {
+	restClient rest.Interface
+}
+
+func (c *StoragemigrationV1Client) StorageVersionMigrations() StorageVersionMigrationInterface {
+	return newStorageVersionMigrations(c)
+}
+
+// NewForConfig creates a new StoragemigrationV1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*StoragemigrationV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new StoragemigrationV1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*StoragemigrationV1Client, error) {
+	config := *c
+	setConfigDefaults(&config)
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &StoragemigrationV1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new StoragemigrationV1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *StoragemigrationV1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new StoragemigrationV1Client for the given RESTClient.
+func New(c rest.Interface) *StoragemigrationV1Client {
+	return &StoragemigrationV1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := storagemigrationv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(scheme.Scheme, scheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *StoragemigrationV1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}
diff --git a/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/storageversionmigration.go b/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/storageversionmigration.go
new file mode 100644
index 0000000000..ecc5658d16
--- /dev/null
+++ b/vendor/k8s.io/client-go/kubernetes/typed/storagemigration/v1/storageversionmigration.go
@@ -0,0 +1,79 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	storagemigrationv1 "k8s.io/api/storagemigration/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	applyconfigurationsstoragemigrationv1 "k8s.io/client-go/applyconfigurations/storagemigration/v1"
+	gentype "k8s.io/client-go/gentype"
+	scheme "k8s.io/client-go/kubernetes/scheme"
+)
+
+// StorageVersionMigrationsGetter has a method to return a StorageVersionMigrationInterface.
+// A group's client should implement this interface.
+type StorageVersionMigrationsGetter interface {
+	StorageVersionMigrations() StorageVersionMigrationInterface
+}
+
+// StorageVersionMigrationInterface has methods to work with StorageVersionMigration resources.
+type StorageVersionMigrationInterface interface {
+	Create(ctx context.Context, storageVersionMigration *storagemigrationv1.StorageVersionMigration, opts metav1.CreateOptions) (*storagemigrationv1.StorageVersionMigration, error)
+	Update(ctx context.Context, storageVersionMigration *storagemigrationv1.StorageVersionMigration, opts metav1.UpdateOptions) (*storagemigrationv1.StorageVersionMigration, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, storageVersionMigration *storagemigrationv1.StorageVersionMigration, opts metav1.UpdateOptions) (*storagemigrationv1.StorageVersionMigration, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*storagemigrationv1.StorageVersionMigration, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*storagemigrationv1.StorageVersionMigrationList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *storagemigrationv1.StorageVersionMigration, err error)
+	Apply(ctx context.Context, storageVersionMigration *applyconfigurationsstoragemigrationv1.StorageVersionMigrationApplyConfiguration, opts metav1.ApplyOptions) (result *storagemigrationv1.StorageVersionMigration, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, storageVersionMigration *applyconfigurationsstoragemigrationv1.StorageVersionMigrationApplyConfiguration, opts metav1.ApplyOptions) (result *storagemigrationv1.StorageVersionMigration, err error)
+	StorageVersionMigrationExpansion
+}
+
+// storageVersionMigrations implements StorageVersionMigrationInterface
+type storageVersionMigrations struct {
+	*gentype.ClientWithListAndApply[*storagemigrationv1.StorageVersionMigration, *storagemigrationv1.StorageVersionMigrationList, *applyconfigurationsstoragemigrationv1.StorageVersionMigrationApplyConfiguration]
+}
+
+// newStorageVersionMigrations returns a StorageVersionMigrations
+func newStorageVersionMigrations(c *StoragemigrationV1Client) *storageVersionMigrations {
+	return &storageVersionMigrations{
+		gentype.NewClientWithListAndApply[*storagemigrationv1.StorageVersionMigration, *storagemigrationv1.StorageVersionMigrationList, *applyconfigurationsstoragemigrationv1.StorageVersionMigrationApplyConfiguration](
+			"storageversionmigrations",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			"",
+			func() *storagemigrationv1.StorageVersionMigration {
+				return &storagemigrationv1.StorageVersionMigration{}
+			},
+			func() *storagemigrationv1.StorageVersionMigrationList {
+				return &storagemigrationv1.StorageVersionMigrationList{}
+			},
+			gentype.PrefersProtobuf[*storagemigrationv1.StorageVersionMigration](),
+		),
+	}
+}
diff --git a/vendor/k8s.io/client-go/listers/certificates/v1/clustertrustbundle.go b/vendor/k8s.io/client-go/listers/certificates/v1/clustertrustbundle.go
new file mode 100644
index 0000000000..18f6e15fcb
--- /dev/null
+++ b/vendor/k8s.io/client-go/listers/certificates/v1/clustertrustbundle.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	certificatesv1 "k8s.io/api/certificates/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// ClusterTrustBundleLister helps list ClusterTrustBundles.
+// All objects returned here must be treated as read-only.
+type ClusterTrustBundleLister interface {
+	// List lists all ClusterTrustBundles in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*certificatesv1.ClusterTrustBundle, err error)
+	// Get retrieves the ClusterTrustBundle from the index for a given name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*certificatesv1.ClusterTrustBundle, error)
+	ClusterTrustBundleListerExpansion
+}
+
+// clusterTrustBundleLister implements the ClusterTrustBundleLister interface.
+type clusterTrustBundleLister struct {
+	listers.ResourceIndexer[*certificatesv1.ClusterTrustBundle]
+}
+
+// NewClusterTrustBundleLister returns a new ClusterTrustBundleLister.
+func NewClusterTrustBundleLister(indexer cache.Indexer) ClusterTrustBundleLister {
+	return &clusterTrustBundleLister{listers.New[*certificatesv1.ClusterTrustBundle](indexer, certificatesv1.Resource("clustertrustbundle"))}
+}
diff --git a/vendor/k8s.io/client-go/listers/certificates/v1/expansion_generated.go b/vendor/k8s.io/client-go/listers/certificates/v1/expansion_generated.go
index 616a1f1a09..36a04381e7 100644
--- a/vendor/k8s.io/client-go/listers/certificates/v1/expansion_generated.go
+++ b/vendor/k8s.io/client-go/listers/certificates/v1/expansion_generated.go
@@ -21,3 +21,15 @@ package v1
 // CertificateSigningRequestListerExpansion allows custom methods to be added to
 // CertificateSigningRequestLister.
 type CertificateSigningRequestListerExpansion interface{}
+
+// ClusterTrustBundleListerExpansion allows custom methods to be added to
+// ClusterTrustBundleLister.
+type ClusterTrustBundleListerExpansion interface{}
+
+// PodCertificateRequestListerExpansion allows custom methods to be added to
+// PodCertificateRequestLister.
+type PodCertificateRequestListerExpansion interface{}
+
+// PodCertificateRequestNamespaceListerExpansion allows custom methods to be added to
+// PodCertificateRequestNamespaceLister.
+type PodCertificateRequestNamespaceListerExpansion interface{}
diff --git a/vendor/k8s.io/client-go/listers/certificates/v1/podcertificaterequest.go b/vendor/k8s.io/client-go/listers/certificates/v1/podcertificaterequest.go
new file mode 100644
index 0000000000..71a7a545d8
--- /dev/null
+++ b/vendor/k8s.io/client-go/listers/certificates/v1/podcertificaterequest.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	certificatesv1 "k8s.io/api/certificates/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// PodCertificateRequestLister helps list PodCertificateRequests.
+// All objects returned here must be treated as read-only.
+type PodCertificateRequestLister interface {
+	// List lists all PodCertificateRequests in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*certificatesv1.PodCertificateRequest, err error)
+	// PodCertificateRequests returns an object that can list and get PodCertificateRequests.
+	PodCertificateRequests(namespace string) PodCertificateRequestNamespaceLister
+	PodCertificateRequestListerExpansion
+}
+
+// podCertificateRequestLister implements the PodCertificateRequestLister interface.
+type podCertificateRequestLister struct {
+	listers.ResourceIndexer[*certificatesv1.PodCertificateRequest]
+}
+
+// NewPodCertificateRequestLister returns a new PodCertificateRequestLister.
+func NewPodCertificateRequestLister(indexer cache.Indexer) PodCertificateRequestLister {
+	return &podCertificateRequestLister{listers.New[*certificatesv1.PodCertificateRequest](indexer, certificatesv1.Resource("podcertificaterequest"))}
+}
+
+// PodCertificateRequests returns an object that can list and get PodCertificateRequests.
+func (s *podCertificateRequestLister) PodCertificateRequests(namespace string) PodCertificateRequestNamespaceLister {
+	return podCertificateRequestNamespaceLister{listers.NewNamespaced[*certificatesv1.PodCertificateRequest](s.ResourceIndexer, namespace)}
+}
+
+// PodCertificateRequestNamespaceLister helps list and get PodCertificateRequests.
+// All objects returned here must be treated as read-only.
+type PodCertificateRequestNamespaceLister interface {
+	// List lists all PodCertificateRequests in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*certificatesv1.PodCertificateRequest, err error)
+	// Get retrieves the PodCertificateRequest from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*certificatesv1.PodCertificateRequest, error)
+	PodCertificateRequestNamespaceListerExpansion
+}
+
+// podCertificateRequestNamespaceLister implements the PodCertificateRequestNamespaceLister
+// interface.
+type podCertificateRequestNamespaceLister struct {
+	listers.ResourceIndexer[*certificatesv1.PodCertificateRequest]
+}
diff --git a/vendor/k8s.io/client-go/listers/lifecycle/v1alpha1/eviction.go b/vendor/k8s.io/client-go/listers/lifecycle/v1alpha1/eviction.go
new file mode 100644
index 0000000000..33f3c663cb
--- /dev/null
+++ b/vendor/k8s.io/client-go/listers/lifecycle/v1alpha1/eviction.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	lifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// EvictionLister helps list Evictions.
+// All objects returned here must be treated as read-only.
+type EvictionLister interface {
+	// List lists all Evictions in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*lifecyclev1alpha1.Eviction, err error)
+	// Evictions returns an object that can list and get Evictions.
+	Evictions(namespace string) EvictionNamespaceLister
+	EvictionListerExpansion
+}
+
+// evictionLister implements the EvictionLister interface.
+type evictionLister struct {
+	listers.ResourceIndexer[*lifecyclev1alpha1.Eviction]
+}
+
+// NewEvictionLister returns a new EvictionLister.
+func NewEvictionLister(indexer cache.Indexer) EvictionLister {
+	return &evictionLister{listers.New[*lifecyclev1alpha1.Eviction](indexer, lifecyclev1alpha1.Resource("eviction"))}
+}
+
+// Evictions returns an object that can list and get Evictions.
+func (s *evictionLister) Evictions(namespace string) EvictionNamespaceLister {
+	return evictionNamespaceLister{listers.NewNamespaced[*lifecyclev1alpha1.Eviction](s.ResourceIndexer, namespace)}
+}
+
+// EvictionNamespaceLister helps list and get Evictions.
+// All objects returned here must be treated as read-only.
+type EvictionNamespaceLister interface {
+	// List lists all Evictions in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*lifecyclev1alpha1.Eviction, err error)
+	// Get retrieves the Eviction from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*lifecyclev1alpha1.Eviction, error)
+	EvictionNamespaceListerExpansion
+}
+
+// evictionNamespaceLister implements the EvictionNamespaceLister
+// interface.
+type evictionNamespaceLister struct {
+	listers.ResourceIndexer[*lifecyclev1alpha1.Eviction]
+}
diff --git a/vendor/k8s.io/client-go/listers/lifecycle/v1alpha1/evictionrequest.go b/vendor/k8s.io/client-go/listers/lifecycle/v1alpha1/evictionrequest.go
new file mode 100644
index 0000000000..97caab9cd2
--- /dev/null
+++ b/vendor/k8s.io/client-go/listers/lifecycle/v1alpha1/evictionrequest.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	lifecyclev1alpha1 "k8s.io/api/lifecycle/v1alpha1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// EvictionRequestLister helps list EvictionRequests.
+// All objects returned here must be treated as read-only.
+type EvictionRequestLister interface {
+	// List lists all EvictionRequests in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*lifecyclev1alpha1.EvictionRequest, err error)
+	// EvictionRequests returns an object that can list and get EvictionRequests.
+	EvictionRequests(namespace string) EvictionRequestNamespaceLister
+	EvictionRequestListerExpansion
+}
+
+// evictionRequestLister implements the EvictionRequestLister interface.
+type evictionRequestLister struct {
+	listers.ResourceIndexer[*lifecyclev1alpha1.EvictionRequest]
+}
+
+// NewEvictionRequestLister returns a new EvictionRequestLister.
+func NewEvictionRequestLister(indexer cache.Indexer) EvictionRequestLister {
+	return &evictionRequestLister{listers.New[*lifecyclev1alpha1.EvictionRequest](indexer, lifecyclev1alpha1.Resource("evictionrequest"))}
+}
+
+// EvictionRequests returns an object that can list and get EvictionRequests.
+func (s *evictionRequestLister) EvictionRequests(namespace string) EvictionRequestNamespaceLister {
+	return evictionRequestNamespaceLister{listers.NewNamespaced[*lifecyclev1alpha1.EvictionRequest](s.ResourceIndexer, namespace)}
+}
+
+// EvictionRequestNamespaceLister helps list and get EvictionRequests.
+// All objects returned here must be treated as read-only.
+type EvictionRequestNamespaceLister interface {
+	// List lists all EvictionRequests in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*lifecyclev1alpha1.EvictionRequest, err error)
+	// Get retrieves the EvictionRequest from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*lifecyclev1alpha1.EvictionRequest, error)
+	EvictionRequestNamespaceListerExpansion
+}
+
+// evictionRequestNamespaceLister implements the EvictionRequestNamespaceLister
+// interface.
+type evictionRequestNamespaceLister struct {
+	listers.ResourceIndexer[*lifecyclev1alpha1.EvictionRequest]
+}
diff --git a/vendor/k8s.io/client-go/listers/lifecycle/v1alpha1/expansion_generated.go b/vendor/k8s.io/client-go/listers/lifecycle/v1alpha1/expansion_generated.go
new file mode 100644
index 0000000000..dba8bb0555
--- /dev/null
+++ b/vendor/k8s.io/client-go/listers/lifecycle/v1alpha1/expansion_generated.go
@@ -0,0 +1,35 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// EvictionListerExpansion allows custom methods to be added to
+// EvictionLister.
+type EvictionListerExpansion interface{}
+
+// EvictionNamespaceListerExpansion allows custom methods to be added to
+// EvictionNamespaceLister.
+type EvictionNamespaceListerExpansion interface{}
+
+// EvictionRequestListerExpansion allows custom methods to be added to
+// EvictionRequestLister.
+type EvictionRequestListerExpansion interface{}
+
+// EvictionRequestNamespaceListerExpansion allows custom methods to be added to
+// EvictionRequestNamespaceLister.
+type EvictionRequestNamespaceListerExpansion interface{}
diff --git a/vendor/k8s.io/client-go/listers/resource/v1/devicetaintrule.go b/vendor/k8s.io/client-go/listers/resource/v1/devicetaintrule.go
new file mode 100644
index 0000000000..150ca4f644
--- /dev/null
+++ b/vendor/k8s.io/client-go/listers/resource/v1/devicetaintrule.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	resourcev1 "k8s.io/api/resource/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// DeviceTaintRuleLister helps list DeviceTaintRules.
+// All objects returned here must be treated as read-only.
+type DeviceTaintRuleLister interface {
+	// List lists all DeviceTaintRules in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*resourcev1.DeviceTaintRule, err error)
+	// Get retrieves the DeviceTaintRule from the index for a given name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*resourcev1.DeviceTaintRule, error)
+	DeviceTaintRuleListerExpansion
+}
+
+// deviceTaintRuleLister implements the DeviceTaintRuleLister interface.
+type deviceTaintRuleLister struct {
+	listers.ResourceIndexer[*resourcev1.DeviceTaintRule]
+}
+
+// NewDeviceTaintRuleLister returns a new DeviceTaintRuleLister.
+func NewDeviceTaintRuleLister(indexer cache.Indexer) DeviceTaintRuleLister {
+	return &deviceTaintRuleLister{listers.New[*resourcev1.DeviceTaintRule](indexer, resourcev1.Resource("devicetaintrule"))}
+}
diff --git a/vendor/k8s.io/client-go/listers/resource/v1/expansion_generated.go b/vendor/k8s.io/client-go/listers/resource/v1/expansion_generated.go
index 6e6e22dcd5..53e789fee6 100644
--- a/vendor/k8s.io/client-go/listers/resource/v1/expansion_generated.go
+++ b/vendor/k8s.io/client-go/listers/resource/v1/expansion_generated.go
@@ -22,6 +22,10 @@ package v1
 // DeviceClassLister.
 type DeviceClassListerExpansion interface{}
 
+// DeviceTaintRuleListerExpansion allows custom methods to be added to
+// DeviceTaintRuleLister.
+type DeviceTaintRuleListerExpansion interface{}
+
 // ResourceClaimListerExpansion allows custom methods to be added to
 // ResourceClaimLister.
 type ResourceClaimListerExpansion interface{}
diff --git a/vendor/k8s.io/client-go/listers/scheduling/v1alpha3/compositepodgroup.go b/vendor/k8s.io/client-go/listers/scheduling/v1alpha3/compositepodgroup.go
new file mode 100644
index 0000000000..b5cfe9752f
--- /dev/null
+++ b/vendor/k8s.io/client-go/listers/scheduling/v1alpha3/compositepodgroup.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// CompositePodGroupLister helps list CompositePodGroups.
+// All objects returned here must be treated as read-only.
+type CompositePodGroupLister interface {
+	// List lists all CompositePodGroups in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*schedulingv1alpha3.CompositePodGroup, err error)
+	// CompositePodGroups returns an object that can list and get CompositePodGroups.
+	CompositePodGroups(namespace string) CompositePodGroupNamespaceLister
+	CompositePodGroupListerExpansion
+}
+
+// compositePodGroupLister implements the CompositePodGroupLister interface.
+type compositePodGroupLister struct {
+	listers.ResourceIndexer[*schedulingv1alpha3.CompositePodGroup]
+}
+
+// NewCompositePodGroupLister returns a new CompositePodGroupLister.
+func NewCompositePodGroupLister(indexer cache.Indexer) CompositePodGroupLister {
+	return &compositePodGroupLister{listers.New[*schedulingv1alpha3.CompositePodGroup](indexer, schedulingv1alpha3.Resource("compositepodgroup"))}
+}
+
+// CompositePodGroups returns an object that can list and get CompositePodGroups.
+func (s *compositePodGroupLister) CompositePodGroups(namespace string) CompositePodGroupNamespaceLister {
+	return compositePodGroupNamespaceLister{listers.NewNamespaced[*schedulingv1alpha3.CompositePodGroup](s.ResourceIndexer, namespace)}
+}
+
+// CompositePodGroupNamespaceLister helps list and get CompositePodGroups.
+// All objects returned here must be treated as read-only.
+type CompositePodGroupNamespaceLister interface {
+	// List lists all CompositePodGroups in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*schedulingv1alpha3.CompositePodGroup, err error)
+	// Get retrieves the CompositePodGroup from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*schedulingv1alpha3.CompositePodGroup, error)
+	CompositePodGroupNamespaceListerExpansion
+}
+
+// compositePodGroupNamespaceLister implements the CompositePodGroupNamespaceLister
+// interface.
+type compositePodGroupNamespaceLister struct {
+	listers.ResourceIndexer[*schedulingv1alpha3.CompositePodGroup]
+}
diff --git a/vendor/k8s.io/client-go/listers/scheduling/v1alpha2/expansion_generated.go b/vendor/k8s.io/client-go/listers/scheduling/v1alpha3/expansion_generated.go
similarity index 77%
rename from vendor/k8s.io/client-go/listers/scheduling/v1alpha2/expansion_generated.go
rename to vendor/k8s.io/client-go/listers/scheduling/v1alpha3/expansion_generated.go
index 3a63d7891c..cd99f2d084 100644
--- a/vendor/k8s.io/client-go/listers/scheduling/v1alpha2/expansion_generated.go
+++ b/vendor/k8s.io/client-go/listers/scheduling/v1alpha3/expansion_generated.go
@@ -16,7 +16,15 @@ limitations under the License.
 
 // Code generated by lister-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
+
+// CompositePodGroupListerExpansion allows custom methods to be added to
+// CompositePodGroupLister.
+type CompositePodGroupListerExpansion interface{}
+
+// CompositePodGroupNamespaceListerExpansion allows custom methods to be added to
+// CompositePodGroupNamespaceLister.
+type CompositePodGroupNamespaceListerExpansion interface{}
 
 // PodGroupListerExpansion allows custom methods to be added to
 // PodGroupLister.
diff --git a/vendor/k8s.io/client-go/listers/scheduling/v1alpha2/podgroup.go b/vendor/k8s.io/client-go/listers/scheduling/v1alpha3/podgroup.go
similarity index 80%
rename from vendor/k8s.io/client-go/listers/scheduling/v1alpha2/podgroup.go
rename to vendor/k8s.io/client-go/listers/scheduling/v1alpha3/podgroup.go
index 292e5d62be..0215a7e39f 100644
--- a/vendor/k8s.io/client-go/listers/scheduling/v1alpha2/podgroup.go
+++ b/vendor/k8s.io/client-go/listers/scheduling/v1alpha3/podgroup.go
@@ -16,10 +16,10 @@ limitations under the License.
 
 // Code generated by lister-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
 
 import (
-	schedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
 	labels "k8s.io/apimachinery/pkg/labels"
 	listers "k8s.io/client-go/listers"
 	cache "k8s.io/client-go/tools/cache"
@@ -30,7 +30,7 @@ import (
 type PodGroupLister interface {
 	// List lists all PodGroups in the indexer.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*schedulingv1alpha2.PodGroup, err error)
+	List(selector labels.Selector) (ret []*schedulingv1alpha3.PodGroup, err error)
 	// PodGroups returns an object that can list and get PodGroups.
 	PodGroups(namespace string) PodGroupNamespaceLister
 	PodGroupListerExpansion
@@ -38,17 +38,17 @@ type PodGroupLister interface {
 
 // podGroupLister implements the PodGroupLister interface.
 type podGroupLister struct {
-	listers.ResourceIndexer[*schedulingv1alpha2.PodGroup]
+	listers.ResourceIndexer[*schedulingv1alpha3.PodGroup]
 }
 
 // NewPodGroupLister returns a new PodGroupLister.
 func NewPodGroupLister(indexer cache.Indexer) PodGroupLister {
-	return &podGroupLister{listers.New[*schedulingv1alpha2.PodGroup](indexer, schedulingv1alpha2.Resource("podgroup"))}
+	return &podGroupLister{listers.New[*schedulingv1alpha3.PodGroup](indexer, schedulingv1alpha3.Resource("podgroup"))}
 }
 
 // PodGroups returns an object that can list and get PodGroups.
 func (s *podGroupLister) PodGroups(namespace string) PodGroupNamespaceLister {
-	return podGroupNamespaceLister{listers.NewNamespaced[*schedulingv1alpha2.PodGroup](s.ResourceIndexer, namespace)}
+	return podGroupNamespaceLister{listers.NewNamespaced[*schedulingv1alpha3.PodGroup](s.ResourceIndexer, namespace)}
 }
 
 // PodGroupNamespaceLister helps list and get PodGroups.
@@ -56,15 +56,15 @@ func (s *podGroupLister) PodGroups(namespace string) PodGroupNamespaceLister {
 type PodGroupNamespaceLister interface {
 	// List lists all PodGroups in the indexer for a given namespace.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*schedulingv1alpha2.PodGroup, err error)
+	List(selector labels.Selector) (ret []*schedulingv1alpha3.PodGroup, err error)
 	// Get retrieves the PodGroup from the indexer for a given namespace and name.
 	// Objects returned here must be treated as read-only.
-	Get(name string) (*schedulingv1alpha2.PodGroup, error)
+	Get(name string) (*schedulingv1alpha3.PodGroup, error)
 	PodGroupNamespaceListerExpansion
 }
 
 // podGroupNamespaceLister implements the PodGroupNamespaceLister
 // interface.
 type podGroupNamespaceLister struct {
-	listers.ResourceIndexer[*schedulingv1alpha2.PodGroup]
+	listers.ResourceIndexer[*schedulingv1alpha3.PodGroup]
 }
diff --git a/vendor/k8s.io/client-go/listers/scheduling/v1alpha2/workload.go b/vendor/k8s.io/client-go/listers/scheduling/v1alpha3/workload.go
similarity index 80%
rename from vendor/k8s.io/client-go/listers/scheduling/v1alpha2/workload.go
rename to vendor/k8s.io/client-go/listers/scheduling/v1alpha3/workload.go
index 9526da3b5a..4919ca4ad9 100644
--- a/vendor/k8s.io/client-go/listers/scheduling/v1alpha2/workload.go
+++ b/vendor/k8s.io/client-go/listers/scheduling/v1alpha3/workload.go
@@ -16,10 +16,10 @@ limitations under the License.
 
 // Code generated by lister-gen. DO NOT EDIT.
 
-package v1alpha2
+package v1alpha3
 
 import (
-	schedulingv1alpha2 "k8s.io/api/scheduling/v1alpha2"
+	schedulingv1alpha3 "k8s.io/api/scheduling/v1alpha3"
 	labels "k8s.io/apimachinery/pkg/labels"
 	listers "k8s.io/client-go/listers"
 	cache "k8s.io/client-go/tools/cache"
@@ -30,7 +30,7 @@ import (
 type WorkloadLister interface {
 	// List lists all Workloads in the indexer.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*schedulingv1alpha2.Workload, err error)
+	List(selector labels.Selector) (ret []*schedulingv1alpha3.Workload, err error)
 	// Workloads returns an object that can list and get Workloads.
 	Workloads(namespace string) WorkloadNamespaceLister
 	WorkloadListerExpansion
@@ -38,17 +38,17 @@ type WorkloadLister interface {
 
 // workloadLister implements the WorkloadLister interface.
 type workloadLister struct {
-	listers.ResourceIndexer[*schedulingv1alpha2.Workload]
+	listers.ResourceIndexer[*schedulingv1alpha3.Workload]
 }
 
 // NewWorkloadLister returns a new WorkloadLister.
 func NewWorkloadLister(indexer cache.Indexer) WorkloadLister {
-	return &workloadLister{listers.New[*schedulingv1alpha2.Workload](indexer, schedulingv1alpha2.Resource("workload"))}
+	return &workloadLister{listers.New[*schedulingv1alpha3.Workload](indexer, schedulingv1alpha3.Resource("workload"))}
 }
 
 // Workloads returns an object that can list and get Workloads.
 func (s *workloadLister) Workloads(namespace string) WorkloadNamespaceLister {
-	return workloadNamespaceLister{listers.NewNamespaced[*schedulingv1alpha2.Workload](s.ResourceIndexer, namespace)}
+	return workloadNamespaceLister{listers.NewNamespaced[*schedulingv1alpha3.Workload](s.ResourceIndexer, namespace)}
 }
 
 // WorkloadNamespaceLister helps list and get Workloads.
@@ -56,15 +56,15 @@ func (s *workloadLister) Workloads(namespace string) WorkloadNamespaceLister {
 type WorkloadNamespaceLister interface {
 	// List lists all Workloads in the indexer for a given namespace.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*schedulingv1alpha2.Workload, err error)
+	List(selector labels.Selector) (ret []*schedulingv1alpha3.Workload, err error)
 	// Get retrieves the Workload from the indexer for a given namespace and name.
 	// Objects returned here must be treated as read-only.
-	Get(name string) (*schedulingv1alpha2.Workload, error)
+	Get(name string) (*schedulingv1alpha3.Workload, error)
 	WorkloadNamespaceListerExpansion
 }
 
 // workloadNamespaceLister implements the WorkloadNamespaceLister
 // interface.
 type workloadNamespaceLister struct {
-	listers.ResourceIndexer[*schedulingv1alpha2.Workload]
+	listers.ResourceIndexer[*schedulingv1alpha3.Workload]
 }
diff --git a/vendor/k8s.io/client-go/listers/scheduling/v1beta1/expansion_generated.go b/vendor/k8s.io/client-go/listers/scheduling/v1beta1/expansion_generated.go
index b806e8cf80..449ba455bb 100644
--- a/vendor/k8s.io/client-go/listers/scheduling/v1beta1/expansion_generated.go
+++ b/vendor/k8s.io/client-go/listers/scheduling/v1beta1/expansion_generated.go
@@ -18,6 +18,22 @@ limitations under the License.
 
 package v1beta1
 
+// PodGroupListerExpansion allows custom methods to be added to
+// PodGroupLister.
+type PodGroupListerExpansion interface{}
+
+// PodGroupNamespaceListerExpansion allows custom methods to be added to
+// PodGroupNamespaceLister.
+type PodGroupNamespaceListerExpansion interface{}
+
 // PriorityClassListerExpansion allows custom methods to be added to
 // PriorityClassLister.
 type PriorityClassListerExpansion interface{}
+
+// WorkloadListerExpansion allows custom methods to be added to
+// WorkloadLister.
+type WorkloadListerExpansion interface{}
+
+// WorkloadNamespaceListerExpansion allows custom methods to be added to
+// WorkloadNamespaceLister.
+type WorkloadNamespaceListerExpansion interface{}
diff --git a/vendor/k8s.io/client-go/listers/scheduling/v1beta1/podgroup.go b/vendor/k8s.io/client-go/listers/scheduling/v1beta1/podgroup.go
new file mode 100644
index 0000000000..32ef1ac6eb
--- /dev/null
+++ b/vendor/k8s.io/client-go/listers/scheduling/v1beta1/podgroup.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// PodGroupLister helps list PodGroups.
+// All objects returned here must be treated as read-only.
+type PodGroupLister interface {
+	// List lists all PodGroups in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*schedulingv1beta1.PodGroup, err error)
+	// PodGroups returns an object that can list and get PodGroups.
+	PodGroups(namespace string) PodGroupNamespaceLister
+	PodGroupListerExpansion
+}
+
+// podGroupLister implements the PodGroupLister interface.
+type podGroupLister struct {
+	listers.ResourceIndexer[*schedulingv1beta1.PodGroup]
+}
+
+// NewPodGroupLister returns a new PodGroupLister.
+func NewPodGroupLister(indexer cache.Indexer) PodGroupLister {
+	return &podGroupLister{listers.New[*schedulingv1beta1.PodGroup](indexer, schedulingv1beta1.Resource("podgroup"))}
+}
+
+// PodGroups returns an object that can list and get PodGroups.
+func (s *podGroupLister) PodGroups(namespace string) PodGroupNamespaceLister {
+	return podGroupNamespaceLister{listers.NewNamespaced[*schedulingv1beta1.PodGroup](s.ResourceIndexer, namespace)}
+}
+
+// PodGroupNamespaceLister helps list and get PodGroups.
+// All objects returned here must be treated as read-only.
+type PodGroupNamespaceLister interface {
+	// List lists all PodGroups in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*schedulingv1beta1.PodGroup, err error)
+	// Get retrieves the PodGroup from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*schedulingv1beta1.PodGroup, error)
+	PodGroupNamespaceListerExpansion
+}
+
+// podGroupNamespaceLister implements the PodGroupNamespaceLister
+// interface.
+type podGroupNamespaceLister struct {
+	listers.ResourceIndexer[*schedulingv1beta1.PodGroup]
+}
diff --git a/vendor/k8s.io/client-go/listers/scheduling/v1beta1/workload.go b/vendor/k8s.io/client-go/listers/scheduling/v1beta1/workload.go
new file mode 100644
index 0000000000..9f20d5a063
--- /dev/null
+++ b/vendor/k8s.io/client-go/listers/scheduling/v1beta1/workload.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// WorkloadLister helps list Workloads.
+// All objects returned here must be treated as read-only.
+type WorkloadLister interface {
+	// List lists all Workloads in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*schedulingv1beta1.Workload, err error)
+	// Workloads returns an object that can list and get Workloads.
+	Workloads(namespace string) WorkloadNamespaceLister
+	WorkloadListerExpansion
+}
+
+// workloadLister implements the WorkloadLister interface.
+type workloadLister struct {
+	listers.ResourceIndexer[*schedulingv1beta1.Workload]
+}
+
+// NewWorkloadLister returns a new WorkloadLister.
+func NewWorkloadLister(indexer cache.Indexer) WorkloadLister {
+	return &workloadLister{listers.New[*schedulingv1beta1.Workload](indexer, schedulingv1beta1.Resource("workload"))}
+}
+
+// Workloads returns an object that can list and get Workloads.
+func (s *workloadLister) Workloads(namespace string) WorkloadNamespaceLister {
+	return workloadNamespaceLister{listers.NewNamespaced[*schedulingv1beta1.Workload](s.ResourceIndexer, namespace)}
+}
+
+// WorkloadNamespaceLister helps list and get Workloads.
+// All objects returned here must be treated as read-only.
+type WorkloadNamespaceLister interface {
+	// List lists all Workloads in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*schedulingv1beta1.Workload, err error)
+	// Get retrieves the Workload from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*schedulingv1beta1.Workload, error)
+	WorkloadNamespaceListerExpansion
+}
+
+// workloadNamespaceLister implements the WorkloadNamespaceLister
+// interface.
+type workloadNamespaceLister struct {
+	listers.ResourceIndexer[*schedulingv1beta1.Workload]
+}
diff --git a/vendor/k8s.io/client-go/listers/storagemigration/v1/expansion_generated.go b/vendor/k8s.io/client-go/listers/storagemigration/v1/expansion_generated.go
new file mode 100644
index 0000000000..324da1ffa6
--- /dev/null
+++ b/vendor/k8s.io/client-go/listers/storagemigration/v1/expansion_generated.go
@@ -0,0 +1,23 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+// StorageVersionMigrationListerExpansion allows custom methods to be added to
+// StorageVersionMigrationLister.
+type StorageVersionMigrationListerExpansion interface{}
diff --git a/vendor/k8s.io/client-go/listers/storagemigration/v1/storageversionmigration.go b/vendor/k8s.io/client-go/listers/storagemigration/v1/storageversionmigration.go
new file mode 100644
index 0000000000..37f7afb073
--- /dev/null
+++ b/vendor/k8s.io/client-go/listers/storagemigration/v1/storageversionmigration.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	storagemigrationv1 "k8s.io/api/storagemigration/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// StorageVersionMigrationLister helps list StorageVersionMigrations.
+// All objects returned here must be treated as read-only.
+type StorageVersionMigrationLister interface {
+	// List lists all StorageVersionMigrations in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*storagemigrationv1.StorageVersionMigration, err error)
+	// Get retrieves the StorageVersionMigration from the index for a given name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*storagemigrationv1.StorageVersionMigration, error)
+	StorageVersionMigrationListerExpansion
+}
+
+// storageVersionMigrationLister implements the StorageVersionMigrationLister interface.
+type storageVersionMigrationLister struct {
+	listers.ResourceIndexer[*storagemigrationv1.StorageVersionMigration]
+}
+
+// NewStorageVersionMigrationLister returns a new StorageVersionMigrationLister.
+func NewStorageVersionMigrationLister(indexer cache.Indexer) StorageVersionMigrationLister {
+	return &storageVersionMigrationLister{listers.New[*storagemigrationv1.StorageVersionMigration](indexer, storagemigrationv1.Resource("storageversionmigration"))}
+}
diff --git a/vendor/k8s.io/client-go/openapi/OWNERS b/vendor/k8s.io/client-go/openapi/OWNERS
index e610094242..8bea129e9a 100644
--- a/vendor/k8s.io/client-go/openapi/OWNERS
+++ b/vendor/k8s.io/client-go/openapi/OWNERS
@@ -1,4 +1,7 @@
 # See the OWNERS docs at https://go.k8s.io/owners
 
 approvers:
+  - jpbetz
+  - api-approvers
+emeritus_approvers:
   - apelisse
diff --git a/vendor/k8s.io/client-go/openapi/client.go b/vendor/k8s.io/client-go/openapi/client.go
index d32895a2f5..6e9a55e848 100644
--- a/vendor/k8s.io/client-go/openapi/client.go
+++ b/vendor/k8s.io/client-go/openapi/client.go
@@ -25,25 +25,81 @@ import (
 	"k8s.io/kube-openapi/pkg/handler3"
 )
 
+// ClientWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ClientWithContext instead.
 type Client interface {
 	Paths() (map[string]GroupVersion, error)
 }
 
+type ClientWithContext interface {
+	PathsWithContext(ctx context.Context) (map[string]GroupVersionWithContext, error)
+}
+
+func ToClientWithContext(c Client) ClientWithContext {
+	if c == nil {
+		return nil
+	}
+	if c, ok := c.(ClientWithContext); ok {
+		return c
+	}
+	return &clientWrapper{
+		delegate: c,
+	}
+}
+
+type clientWrapper struct {
+	delegate Client
+}
+
+func (c *clientWrapper) PathsWithContext(ctx context.Context) (map[string]GroupVersionWithContext, error) {
+	resultWithoutContext, err := c.delegate.Paths()
+	result := make(map[string]GroupVersionWithContext, len(resultWithoutContext))
+	for key, entry := range resultWithoutContext {
+		result[key] = ToGroupVersionWithContext(entry)
+	}
+	return result, err
+}
+
 type client struct {
 	// URL includes the `hash` query param to take advantage of cache busting
 	restClient rest.Interface
 }
 
+// NewClientWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use NewClientWithContext instead.
 func NewClient(restClient rest.Interface) Client {
+	return newClient(restClient)
+}
+
+func NewClientWithContext(restClient rest.Interface) ClientWithContext {
+	return newClient(restClient)
+}
+
+func newClient(restClient rest.Interface) *client {
 	return &client{
 		restClient: restClient,
 	}
 }
 
+// PathsWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use PathsWithContext instead.
 func (c *client) Paths() (map[string]GroupVersion, error) {
+	resultWithContext, err := c.PathsWithContext(context.Background())
+	result := make(map[string]GroupVersion, len(resultWithContext))
+	for key, entry := range resultWithContext {
+		// We know that this is a *groupversion which implements GroupVersion.
+		result[key] = entry.(GroupVersion)
+	}
+	return result, err
+}
+
+func (c *client) PathsWithContext(ctx context.Context) (map[string]GroupVersionWithContext, error) {
 	data, err := c.restClient.Get().
 		AbsPath("/openapi/v3").
-		Do(context.TODO()).
+		Do(ctx).
 		Raw()
 
 	if err != nil {
@@ -59,7 +115,7 @@ func (c *client) Paths() (map[string]GroupVersion, error) {
 	// Calculate the client-side prefix for a "root" request
 	rootPrefix := strings.TrimSuffix(c.restClient.Get().AbsPath("/").URL().Path, "/")
 	// Create GroupVersions for each element of the result
-	result := map[string]GroupVersion{}
+	result := make(map[string]GroupVersionWithContext, len(discoMap.Paths))
 	for k, v := range discoMap.Paths {
 		// Trim off the prefix that will always be added in client-side
 		v.ServerRelativeURL = strings.TrimPrefix(v.ServerRelativeURL, rootPrefix)
diff --git a/vendor/k8s.io/client-go/openapi/groupversion.go b/vendor/k8s.io/client-go/openapi/groupversion.go
index 40d91b9a53..0e0b593990 100644
--- a/vendor/k8s.io/client-go/openapi/groupversion.go
+++ b/vendor/k8s.io/client-go/openapi/groupversion.go
@@ -25,6 +25,9 @@ import (
 
 const ContentTypeOpenAPIV3PB = "application/com.github.proto-openapi.spec.v3@v1.0+protobuf"
 
+// GroupVersionWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use GroupVersionWithContext instead.
 type GroupVersion interface {
 	Schema(contentType string) ([]byte, error)
 
@@ -35,22 +38,61 @@ type GroupVersion interface {
 	ServerRelativeURL() string
 }
 
+type GroupVersionWithContext interface {
+	SchemaWithContext(ctx context.Context, contentType string) ([]byte, error)
+
+	// ServerRelativeURL. Returns the path and parameters used to fetch the schema.
+	// You should use the Schema method to fetch it, but this value can be used
+	// to key the current version of the schema in a cache since it contains a
+	// hash string which changes upon schema update.
+	ServerRelativeURL() string
+}
+
+func ToGroupVersionWithContext(gv GroupVersion) GroupVersionWithContext {
+	if gv == nil {
+		return nil
+	}
+	if gv, ok := gv.(GroupVersionWithContext); ok {
+		return gv
+	}
+	return &groupVersionWrapper{
+		GroupVersion: gv,
+	}
+}
+
+type groupVersionWrapper struct {
+	GroupVersion
+}
+
+func (gv *groupVersionWrapper) SchemaWithContext(ctx context.Context, contentType string) ([]byte, error) {
+	return gv.Schema(contentType)
+}
+
 type groupversion struct {
 	client          *client
 	item            handler3.OpenAPIV3DiscoveryGroupVersion
 	useClientPrefix bool
 }
 
+var (
+	_ GroupVersion            = &groupversion{}
+	_ GroupVersionWithContext = &groupversion{}
+)
+
 func newGroupVersion(client *client, item handler3.OpenAPIV3DiscoveryGroupVersion, useClientPrefix bool) *groupversion {
 	return &groupversion{client: client, item: item, useClientPrefix: useClientPrefix}
 }
 
 func (g *groupversion) Schema(contentType string) ([]byte, error) {
+	return g.SchemaWithContext(context.Background(), contentType)
+}
+
+func (g *groupversion) SchemaWithContext(ctx context.Context, contentType string) ([]byte, error) {
 	if !g.useClientPrefix {
 		return g.client.restClient.Get().
 			RequestURI(g.item.ServerRelativeURL).
 			SetHeader("Accept", contentType).
-			Do(context.TODO()).
+			Do(ctx).
 			Raw()
 	}
 
@@ -72,7 +114,7 @@ func (g *groupversion) Schema(contentType string) ([]byte, error) {
 		}
 	}
 
-	return path.Do(context.TODO()).Raw()
+	return path.Do(ctx).Raw()
 }
 
 // URL used for fetching the schema. The URL includes a hash and can be used
diff --git a/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1/types.go b/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1/types.go
index b9082e8145..6e0c84aeab 100644
--- a/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1/types.go
+++ b/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1/types.go
@@ -26,7 +26,7 @@ import (
 // ExecCredential is used by exec-based plugins to communicate credentials to
 // HTTP transports.
 type ExecCredential struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Spec holds information passed to the plugin by the transport.
 	Spec ExecCredentialSpec `json:"spec,omitempty"`
diff --git a/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1/zz_generated.conversion.go b/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1/zz_generated.conversion.go
index 9c3f63fca8..bec865c481 100644
--- a/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1/zz_generated.conversion.go
+++ b/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1/zz_generated.conversion.go
@@ -24,7 +24,6 @@ package v1
 import (
 	unsafe "unsafe"
 
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	conversion "k8s.io/apimachinery/pkg/conversion"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	clientauthentication "k8s.io/client-go/pkg/apis/clientauthentication"
@@ -181,10 +180,7 @@ func Convert_clientauthentication_ExecCredentialSpec_To_v1_ExecCredentialSpec(in
 }
 
 func autoConvert_v1_ExecCredentialStatus_To_clientauthentication_ExecCredentialStatus(in *ExecCredentialStatus, out *clientauthentication.ExecCredentialStatus, s conversion.Scope) error {
-	out.ExpirationTimestamp = (*metav1.Time)(unsafe.Pointer(in.ExpirationTimestamp))
-	out.Token = in.Token
-	out.ClientCertificateData = in.ClientCertificateData
-	out.ClientKeyData = in.ClientKeyData
+	*out = *(*clientauthentication.ExecCredentialStatus)(unsafe.Pointer(in))
 	return nil
 }
 
@@ -194,10 +190,7 @@ func Convert_v1_ExecCredentialStatus_To_clientauthentication_ExecCredentialStatu
 }
 
 func autoConvert_clientauthentication_ExecCredentialStatus_To_v1_ExecCredentialStatus(in *clientauthentication.ExecCredentialStatus, out *ExecCredentialStatus, s conversion.Scope) error {
-	out.ExpirationTimestamp = (*metav1.Time)(unsafe.Pointer(in.ExpirationTimestamp))
-	out.Token = in.Token
-	out.ClientCertificateData = in.ClientCertificateData
-	out.ClientKeyData = in.ClientKeyData
+	*out = *(*ExecCredentialStatus)(unsafe.Pointer(in))
 	return nil
 }
 
diff --git a/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1beta1/types.go b/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1beta1/types.go
index 918eb11e14..d2f2b50791 100644
--- a/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1beta1/types.go
+++ b/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1beta1/types.go
@@ -26,7 +26,7 @@ import (
 // ExecCredential is used by exec-based plugins to communicate credentials to
 // HTTP transports.
 type ExecCredential struct {
-	metav1.TypeMeta `json:",inline"`
+	metav1.TypeMeta `json:""`
 
 	// Spec holds information passed to the plugin by the transport.
 	Spec ExecCredentialSpec `json:"spec,omitempty"`
diff --git a/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1beta1/zz_generated.conversion.go b/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1beta1/zz_generated.conversion.go
index 5372da1513..4e7be35154 100644
--- a/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1beta1/zz_generated.conversion.go
+++ b/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1beta1/zz_generated.conversion.go
@@ -24,7 +24,6 @@ package v1beta1
 import (
 	unsafe "unsafe"
 
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	conversion "k8s.io/apimachinery/pkg/conversion"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	clientauthentication "k8s.io/client-go/pkg/apis/clientauthentication"
@@ -181,10 +180,7 @@ func Convert_clientauthentication_ExecCredentialSpec_To_v1beta1_ExecCredentialSp
 }
 
 func autoConvert_v1beta1_ExecCredentialStatus_To_clientauthentication_ExecCredentialStatus(in *ExecCredentialStatus, out *clientauthentication.ExecCredentialStatus, s conversion.Scope) error {
-	out.ExpirationTimestamp = (*v1.Time)(unsafe.Pointer(in.ExpirationTimestamp))
-	out.Token = in.Token
-	out.ClientCertificateData = in.ClientCertificateData
-	out.ClientKeyData = in.ClientKeyData
+	*out = *(*clientauthentication.ExecCredentialStatus)(unsafe.Pointer(in))
 	return nil
 }
 
@@ -194,10 +190,7 @@ func Convert_v1beta1_ExecCredentialStatus_To_clientauthentication_ExecCredential
 }
 
 func autoConvert_clientauthentication_ExecCredentialStatus_To_v1beta1_ExecCredentialStatus(in *clientauthentication.ExecCredentialStatus, out *ExecCredentialStatus, s conversion.Scope) error {
-	out.ExpirationTimestamp = (*v1.Time)(unsafe.Pointer(in.ExpirationTimestamp))
-	out.Token = in.Token
-	out.ClientCertificateData = in.ClientCertificateData
-	out.ClientKeyData = in.ClientKeyData
+	*out = *(*ExecCredentialStatus)(unsafe.Pointer(in))
 	return nil
 }
 
diff --git a/vendor/k8s.io/client-go/plugin/pkg/client/auth/exec/exec.go b/vendor/k8s.io/client-go/plugin/pkg/client/auth/exec/exec.go
index b2393f4dd3..60f9da50d8 100644
--- a/vendor/k8s.io/client-go/plugin/pkg/client/auth/exec/exec.go
+++ b/vendor/k8s.io/client-go/plugin/pkg/client/auth/exec/exec.go
@@ -159,6 +159,7 @@ func (s *sometimes) Do(f func()) {
 
 // GetAuthenticator returns an exec-based plugin for providing client credentials.
 func GetAuthenticator(config *api.ExecConfig, cluster *clientauthentication.Cluster) (*Authenticator, error) {
+	metrics.EnsureRegistered()
 	return newAuthenticator(globalCache, term.IsTerminal, config, cluster)
 }
 
diff --git a/vendor/k8s.io/client-go/rest/OWNERS b/vendor/k8s.io/client-go/rest/OWNERS
index 7b23294c45..c057852b75 100644
--- a/vendor/k8s.io/client-go/rest/OWNERS
+++ b/vendor/k8s.io/client-go/rest/OWNERS
@@ -3,7 +3,6 @@
 reviewers:
   - thockin
   - smarterclayton
-  - caesarxuchao
   - wojtek-t
   - deads2k
   - liggitt
diff --git a/vendor/k8s.io/client-go/rest/client.go b/vendor/k8s.io/client-go/rest/client.go
index a085c334f9..d92c1b647e 100644
--- a/vendor/k8s.io/client-go/rest/client.go
+++ b/vendor/k8s.io/client-go/rest/client.go
@@ -32,6 +32,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
 	clientfeatures "k8s.io/client-go/features"
+	"k8s.io/client-go/tools/metrics"
 	"k8s.io/client-go/util/flowcontrol"
 )
 
@@ -110,6 +111,8 @@ type RESTClient struct {
 // NewRESTClient creates a new RESTClient. This client performs generic REST functions
 // such as Get, Put, Post, and Delete on specified paths.
 func NewRESTClient(baseURL *url.URL, versionedAPIPath string, config ClientContentConfig, rateLimiter flowcontrol.RateLimiter, client *http.Client) (*RESTClient, error) {
+	metrics.EnsureRegistered()
+
 	base := *baseURL
 	if !strings.HasSuffix(base.Path, "/") {
 		base.Path += "/"
diff --git a/vendor/k8s.io/client-go/rest/config.go b/vendor/k8s.io/client-go/rest/config.go
index 82d4f7136a..3d4fb720c4 100644
--- a/vendor/k8s.io/client-go/rest/config.go
+++ b/vendor/k8s.io/client-go/rest/config.go
@@ -37,6 +37,7 @@ import (
 	"k8s.io/client-go/features"
 	"k8s.io/client-go/pkg/version"
 	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+	"k8s.io/client-go/tools/metrics"
 	"k8s.io/client-go/transport"
 	certutil "k8s.io/client-go/util/cert"
 	"k8s.io/client-go/util/flowcontrol"
@@ -355,6 +356,8 @@ func RESTClientFor(config *Config) (*RESTClient, error) {
 // Note that the http client takes precedence over the transport values configured.
 // The http client defaults to the `http.DefaultClient` if nil.
 func RESTClientForConfigAndClient(config *Config, httpClient *http.Client) (*RESTClient, error) {
+	metrics.EnsureRegistered()
+
 	if config.GroupVersion == nil {
 		return nil, fmt.Errorf("GroupVersion is required when initializing a RESTClient")
 	}
diff --git a/vendor/k8s.io/client-go/rest/request.go b/vendor/k8s.io/client-go/rest/request.go
index fb57216927..fe3c066729 100644
--- a/vendor/k8s.io/client-go/rest/request.go
+++ b/vendor/k8s.io/client-go/rest/request.go
@@ -20,6 +20,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/hex"
+	stderrors "errors"
 	"fmt"
 	"io"
 	"mime"
@@ -671,7 +672,8 @@ func (r *Request) tryThrottleWithInfo(ctx context.Context, retryInfo string) err
 	now := time.Now()
 
 	err := r.rateLimiter.Wait(ctx)
-	if err != nil {
+	// Don't wrap context errors as caller initiated ctx cancellations is not a rate limiter error.
+	if err != nil && !stderrors.Is(err, context.Canceled) && !stderrors.Is(err, context.DeadlineExceeded) {
 		err = fmt.Errorf("client rate limiter Wait returned an error: %w", err)
 	}
 	latency := time.Since(now)
diff --git a/vendor/k8s.io/client-go/rest/transport.go b/vendor/k8s.io/client-go/rest/transport.go
index 53f986cbf3..c958240401 100644
--- a/vendor/k8s.io/client-go/rest/transport.go
+++ b/vendor/k8s.io/client-go/rest/transport.go
@@ -23,6 +23,7 @@ import (
 
 	"k8s.io/client-go/pkg/apis/clientauthentication"
 	"k8s.io/client-go/plugin/pkg/client/auth/exec"
+	"k8s.io/client-go/tools/metrics"
 	"k8s.io/client-go/transport"
 )
 
@@ -82,6 +83,7 @@ func HTTPWrappersForConfig(config *Config, rt http.RoundTripper) (http.RoundTrip
 
 // TransportConfig converts a client config to an appropriate transport config.
 func (c *Config) TransportConfig() (*transport.Config, error) {
+	metrics.EnsureRegistered()
 	conf := &transport.Config{
 		UserAgent:          c.UserAgent,
 		Transport:          c.Transport,
diff --git a/vendor/k8s.io/client-go/restmapper/category_expansion.go b/vendor/k8s.io/client-go/restmapper/category_expansion.go
index 484e4c8393..265cc7c6a5 100644
--- a/vendor/k8s.io/client-go/restmapper/category_expansion.go
+++ b/vendor/k8s.io/client-go/restmapper/category_expansion.go
@@ -17,38 +17,97 @@ limitations under the License.
 package restmapper
 
 import (
+	"context"
+	"iter"
+	"slices"
+
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/discovery"
 )
 
 // CategoryExpander maps category strings to GroupResources.
 // Categories are classification or 'tag' of a group of resources.
+//
+// CategoryExpanderWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use CategoryExpanderWithContext instead.
 type CategoryExpander interface {
 	Expand(category string) ([]schema.GroupResource, bool)
 }
 
-// SimpleCategoryExpander implements CategoryExpander interface
+// CategoryExpanderWithContext maps category strings to GroupResources.
+// Categories are classification or 'tag' of a group of resources.
+type CategoryExpanderWithContext interface {
+	ExpandWithContext(ctx context.Context, category string) ([]schema.GroupResource, bool)
+}
+
+func ToCategoryExpanderWithContext(c CategoryExpander) CategoryExpanderWithContext {
+	if c == nil {
+		return nil
+	}
+	if c, ok := c.(CategoryExpanderWithContext); ok {
+		return c
+	}
+	return &categoryExpanderWrapper{
+		delegate: c,
+	}
+}
+
+type categoryExpanderWrapper struct {
+	delegate CategoryExpander
+}
+
+func (c *categoryExpanderWrapper) ExpandWithContext(ctx context.Context, category string) ([]schema.GroupResource, bool) {
+	return c.delegate.Expand(category)
+}
+
+// SimpleCategoryExpander implements CategoryExpander and CategoryExpanderWithContext interface
 // using a static mapping of categories to GroupResource mapping.
 type SimpleCategoryExpander struct {
 	Expansions map[string][]schema.GroupResource
 }
 
+var (
+	_ CategoryExpander            = SimpleCategoryExpander{}
+	_ CategoryExpanderWithContext = SimpleCategoryExpander{}
+)
+
 // Expand fulfills CategoryExpander
 func (e SimpleCategoryExpander) Expand(category string) ([]schema.GroupResource, bool) {
 	ret, ok := e.Expansions[category]
 	return ret, ok
 }
 
+// ExpandWithContext fulfills CategoryExpanderWithContext
+func (e SimpleCategoryExpander) ExpandWithContext(ctx context.Context, category string) ([]schema.GroupResource, bool) {
+	return e.Expand(category)
+}
+
 // discoveryCategoryExpander struct lets a REST Client wrapper (discoveryClient) to retrieve list of APIResourceList,
 // and then convert to fallbackExpander
 type discoveryCategoryExpander struct {
-	discoveryClient discovery.DiscoveryInterface
+	discoveryClient discovery.DiscoveryInterfaceWithContext
 }
 
 // NewDiscoveryCategoryExpander returns a category expander that makes use of the "categories" fields from
 // the API, found through the discovery client. In case of any error or no category found (which likely
 // means we're at a cluster prior to categories support, fallback to the expander provided.
+//
+// NewDiscoveryCategoryExpanderWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use NewDiscoveryCategoryExpanderWithContext instead.
 func NewDiscoveryCategoryExpander(client discovery.DiscoveryInterface) CategoryExpander {
+	return newDiscoveryCategoryExpander(discovery.ToDiscoveryInterfaceWithContext(client))
+}
+
+// NewDiscoveryCategoryExpanderWithContext returns a category expander that makes use of the "categories" fields from
+// the API, found through the discovery client. In case of any error or no category found (which likely
+// means we're at a cluster prior to categories support, fallback to the expander provided.
+func NewDiscoveryCategoryExpanderWithContext(client discovery.DiscoveryInterfaceWithContext) CategoryExpanderWithContext {
+	return newDiscoveryCategoryExpander(client)
+}
+
+func newDiscoveryCategoryExpander(client discovery.DiscoveryInterfaceWithContext) discoveryCategoryExpander {
 	if client == nil {
 		panic("Please provide discovery client to shortcut expander")
 	}
@@ -56,9 +115,18 @@ func NewDiscoveryCategoryExpander(client discovery.DiscoveryInterface) CategoryE
 }
 
 // Expand fulfills CategoryExpander
+//
+// ExpandWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ExpandWithContext instead.
 func (e discoveryCategoryExpander) Expand(category string) ([]schema.GroupResource, bool) {
+	return e.ExpandWithContext(context.Background(), category)
+}
+
+// ExpandWithContext fulfills CategoryExpanderWithContext
+func (e discoveryCategoryExpander) ExpandWithContext(ctx context.Context, category string) ([]schema.GroupResource, bool) {
 	// Get all supported resources for groups and versions from server, if no resource found, fallback anyway.
-	_, apiResourceLists, _ := e.discoveryClient.ServerGroupsAndResources()
+	_, apiResourceLists, _ := e.discoveryClient.ServerGroupsAndResourcesWithContext(ctx)
 	if len(apiResourceLists) == 0 {
 		return nil, false
 	}
@@ -89,16 +157,43 @@ func (e discoveryCategoryExpander) Expand(category string) ([]schema.GroupResour
 
 // UnionCategoryExpander implements CategoryExpander interface.
 // It maps given category string to union of expansions returned by all the CategoryExpanders in the list.
+//
+// UnionCategoryExpanderWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use UnionCategoryExpanderWithContext instead.
 type UnionCategoryExpander []CategoryExpander
 
+var _ CategoryExpander = UnionCategoryExpander{}
+
 // Expand fulfills CategoryExpander
 func (u UnionCategoryExpander) Expand(category string) ([]schema.GroupResource, bool) {
+	return unionExpand(context.Background(), func(yield func(i int, expander CategoryExpanderWithContext) bool) {
+		for i, expander := range u {
+			if !yield(i, ToCategoryExpanderWithContext(expander)) {
+				break
+			}
+		}
+	}, category)
+}
+
+// UnionCategoryExpanderWithContext implements CategoryExpanderWithContext interface.
+// It maps given category string to union of expansions returned by all the CategoryExpanders in the list.
+type UnionCategoryExpanderWithContext []CategoryExpanderWithContext
+
+var _ CategoryExpanderWithContext = UnionCategoryExpanderWithContext{}
+
+// ExpandWithContext fulfills CategoryExpanderWithContext
+func (u UnionCategoryExpanderWithContext) ExpandWithContext(ctx context.Context, category string) ([]schema.GroupResource, bool) {
+	return unionExpand(ctx, slices.All(u), category)
+}
+
+func unionExpand(ctx context.Context, expanders iter.Seq2[int, CategoryExpanderWithContext], category string) ([]schema.GroupResource, bool) {
 	ret := []schema.GroupResource{}
 	ok := false
 
 	// Expand the category for each CategoryExpander in the list and merge/combine the results.
-	for _, expansion := range u {
-		curr, currOk := expansion.Expand(category)
+	for _, expansion := range expanders {
+		curr, currOk := expansion.ExpandWithContext(ctx, category)
 
 		for _, currGR := range curr {
 			found := false
diff --git a/vendor/k8s.io/client-go/restmapper/discovery.go b/vendor/k8s.io/client-go/restmapper/discovery.go
index 3505178b66..9457cccd3f 100644
--- a/vendor/k8s.io/client-go/restmapper/discovery.go
+++ b/vendor/k8s.io/client-go/restmapper/discovery.go
@@ -17,6 +17,7 @@ limitations under the License.
 package restmapper
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"sync"
@@ -40,8 +41,40 @@ type APIGroupResources struct {
 
 // NewDiscoveryRESTMapper returns a PriorityRESTMapper based on the discovered
 // groups and resources passed in.
+//
+// NewDiscoveryRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use NewDiscoveryRESTMapperWithContext instead.
 func NewDiscoveryRESTMapper(groupResources []*APIGroupResources) meta.RESTMapper {
-	unionMapper := meta.MultiRESTMapper{}
+	mappers, resourcePriority, kindPriority := newDiscoveryRESTMapper(groupResources)
+	multiMapper := make(meta.MultiRESTMapper, len(mappers))
+	for i, m := range mappers {
+		multiMapper[i] = m
+	}
+	return &meta.PriorityRESTMapper{
+		Delegate:         multiMapper,
+		ResourcePriority: resourcePriority,
+		KindPriority:     kindPriority,
+	}
+}
+
+// NewDiscoveryRESTMapperWithContext returns a PriorityRESTMapper based on the discovered
+// groups and resources passed in.
+func NewDiscoveryRESTMapperWithContext(groupResources []*APIGroupResources) meta.RESTMapperWithContext {
+	mappers, resourcePriority, kindPriority := newDiscoveryRESTMapper(groupResources)
+	multiMapper := make(meta.MultiRESTMapperWithContext, len(mappers))
+	for i, m := range mappers {
+		multiMapper[i] = m
+	}
+	return &meta.PriorityRESTMapperWithContext{
+		Delegate:         multiMapper,
+		ResourcePriority: resourcePriority,
+		KindPriority:     kindPriority,
+	}
+}
+
+func newDiscoveryRESTMapper(groupResources []*APIGroupResources) ([]*meta.DefaultRESTMapper, []schema.GroupVersionResource, []schema.GroupVersionKind) {
+	var unionMapper []*meta.DefaultRESTMapper
 
 	var groupPriority []string
 	// /v1 is special.  It should always come first
@@ -135,17 +168,23 @@ func NewDiscoveryRESTMapper(groupResources []*APIGroupResources) meta.RESTMapper
 		})
 	}
 
-	return meta.PriorityRESTMapper{
-		Delegate:         unionMapper,
-		ResourcePriority: resourcePriority,
-		KindPriority:     kindPriority,
-	}
+	return unionMapper, resourcePriority, kindPriority
 }
 
 // GetAPIGroupResources uses the provided discovery client to gather
 // discovery information and populate a slice of APIGroupResources.
+//
+// GetAPIGroupResourcesWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use GetAPIGroupResourcesWithContext instead.
 func GetAPIGroupResources(cl discovery.DiscoveryInterface) ([]*APIGroupResources, error) {
-	gs, rs, err := cl.ServerGroupsAndResources()
+	return GetAPIGroupResourcesWithContext(context.Background(), discovery.ToDiscoveryInterfaceWithContext(cl))
+}
+
+// GetAPIGroupResourcesWithContext uses the provided discovery client to gather
+// discovery information and populate a slice of APIGroupResources.
+func GetAPIGroupResourcesWithContext(ctx context.Context, cl discovery.DiscoveryInterfaceWithContext) ([]*APIGroupResources, error) {
+	gs, rs, err := cl.ServerGroupsAndResourcesWithContext(ctx)
 	if rs == nil || gs == nil {
 		return nil, err
 		// TODO track the errors and update callers to handle partial errors.
@@ -173,25 +212,45 @@ func GetAPIGroupResources(cl discovery.DiscoveryInterface) ([]*APIGroupResources
 	return result, nil
 }
 
-// DeferredDiscoveryRESTMapper is a RESTMapper that will defer
+// DeferredDiscoveryRESTMapper is a RESTMapper and RESTMapperContext that will defer
 // initialization of the RESTMapper until the first mapping is
 // requested.
 type DeferredDiscoveryRESTMapper struct {
 	initMu   sync.Mutex
-	delegate meta.RESTMapper
-	cl       discovery.CachedDiscoveryInterface
+	delegate meta.RESTMapperWithContext
+	cl       discovery.CachedDiscoveryInterfaceWithContext
 }
 
+var (
+	//nolint:staticcheck // Intentionally using the old interface here.
+	_ meta.ResettableRESTMapper            = &DeferredDiscoveryRESTMapper{}
+	_ meta.ResettableRESTMapperWithContext = &DeferredDiscoveryRESTMapper{}
+	_ fmt.Stringer                         = &DeferredDiscoveryRESTMapper{}
+)
+
 // NewDeferredDiscoveryRESTMapper returns a
 // DeferredDiscoveryRESTMapper that will lazily query the provided
 // client for discovery information to do REST mappings.
+//
+// NewDeferredDiscoveryRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use NewDeferredDiscoveryRESTMapperWithContext instead. NewDeferredDiscoveryRESTMapper will try to convert cl to discovery.CachedDiscoveryInterfaceWithContext and use a wrapper if that is not possible, but NewDeferredDiscoveryRESTMapperWithContext ensures that no such conversion is necessary.
 func NewDeferredDiscoveryRESTMapper(cl discovery.CachedDiscoveryInterface) *DeferredDiscoveryRESTMapper {
+	return &DeferredDiscoveryRESTMapper{
+		cl: discovery.ToCachedDiscoveryInterfaceWithContext(cl),
+	}
+}
+
+// NewDeferredDiscoveryRESTMapperWithContext returns a
+// DeferredDiscoveryRESTMapper that will lazily query the provided
+// client for discovery information to do REST mappings.
+func NewDeferredDiscoveryRESTMapperWithContext(cl discovery.CachedDiscoveryInterfaceWithContext) *DeferredDiscoveryRESTMapper {
 	return &DeferredDiscoveryRESTMapper{
 		cl: cl,
 	}
 }
 
-func (d *DeferredDiscoveryRESTMapper) getDelegate() (meta.RESTMapper, error) {
+func (d *DeferredDiscoveryRESTMapper) getDelegate(ctx context.Context) (meta.RESTMapperWithContext, error) {
 	d.initMu.Lock()
 	defer d.initMu.Unlock()
 
@@ -199,98 +258,154 @@ func (d *DeferredDiscoveryRESTMapper) getDelegate() (meta.RESTMapper, error) {
 		return d.delegate, nil
 	}
 
-	groupResources, err := GetAPIGroupResources(d.cl)
+	groupResources, err := GetAPIGroupResourcesWithContext(ctx, d.cl)
 	if err != nil {
 		return nil, err
 	}
 
-	d.delegate = NewDiscoveryRESTMapper(groupResources)
+	d.delegate = NewDiscoveryRESTMapperWithContext(groupResources)
 	return d.delegate, nil
 }
 
 // Reset resets the internally cached Discovery information and will
 // cause the next mapping request to re-discover.
 func (d *DeferredDiscoveryRESTMapper) Reset() {
-	klog.V(5).Info("Invalidating discovery information")
+	d.ResetWithContext(context.Background())
+}
+
+// ResetWithContext resets the internally cached Discovery information and will
+// cause the next mapping request to re-discover.
+func (d *DeferredDiscoveryRESTMapper) ResetWithContext(ctx context.Context) {
+	klog.FromContext(ctx).V(5).Info("Invalidating discovery information")
 
 	d.initMu.Lock()
 	defer d.initMu.Unlock()
 
-	d.cl.Invalidate()
+	d.cl.InvalidateWithContext(ctx)
 	d.delegate = nil
 }
 
 // KindFor takes a partial resource and returns back the single match.
 // It returns an error if there are multiple matches.
+//
+// KindForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use KindForWithContext instead.
 func (d *DeferredDiscoveryRESTMapper) KindFor(resource schema.GroupVersionResource) (gvk schema.GroupVersionKind, err error) {
-	del, err := d.getDelegate()
+	return d.KindForWithContext(context.Background(), resource)
+}
+
+// KindForWithContext takes a partial resource and returns back the single match.
+// It returns an error if there are multiple matches.
+func (d *DeferredDiscoveryRESTMapper) KindForWithContext(ctx context.Context, resource schema.GroupVersionResource) (gvk schema.GroupVersionKind, err error) {
+	del, err := d.getDelegate(ctx)
 	if err != nil {
 		return schema.GroupVersionKind{}, err
 	}
-	gvk, err = del.KindFor(resource)
-	if err != nil && !d.cl.Fresh() {
-		d.Reset()
-		gvk, err = d.KindFor(resource)
+	gvk, err = del.KindForWithContext(ctx, resource)
+	if err != nil && !d.cl.FreshWithContext(ctx) {
+		d.ResetWithContext(ctx)
+		gvk, err = d.KindForWithContext(ctx, resource)
 	}
 	return
 }
 
 // KindsFor takes a partial resource and returns back the list of
 // potential kinds in priority order.
+//
+// KindsForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use KindsForWithContext instead.
 func (d *DeferredDiscoveryRESTMapper) KindsFor(resource schema.GroupVersionResource) (gvks []schema.GroupVersionKind, err error) {
-	del, err := d.getDelegate()
+	return d.KindsForWithContext(context.Background(), resource)
+}
+
+// KindsForWithContext takes a partial resource and returns back the list of
+// potential kinds in priority order.
+func (d *DeferredDiscoveryRESTMapper) KindsForWithContext(ctx context.Context, resource schema.GroupVersionResource) (gvks []schema.GroupVersionKind, err error) {
+	del, err := d.getDelegate(ctx)
 	if err != nil {
 		return nil, err
 	}
-	gvks, err = del.KindsFor(resource)
-	if len(gvks) == 0 && !d.cl.Fresh() {
-		d.Reset()
-		gvks, err = d.KindsFor(resource)
+	gvks, err = del.KindsForWithContext(ctx, resource)
+	if len(gvks) == 0 && !d.cl.FreshWithContext(ctx) {
+		d.ResetWithContext(ctx)
+		gvks, err = d.KindsForWithContext(ctx, resource)
 	}
 	return
 }
 
 // ResourceFor takes a partial resource and returns back the single
 // match. It returns an error if there are multiple matches.
+//
+// ResourceForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ResourceForWithContext instead.
 func (d *DeferredDiscoveryRESTMapper) ResourceFor(input schema.GroupVersionResource) (gvr schema.GroupVersionResource, err error) {
-	del, err := d.getDelegate()
+	return d.ResourceForWithContext(context.Background(), input)
+}
+
+// ResourceForWithContext takes a partial resource and returns back the single
+// match. It returns an error if there are multiple matches.
+func (d *DeferredDiscoveryRESTMapper) ResourceForWithContext(ctx context.Context, input schema.GroupVersionResource) (gvr schema.GroupVersionResource, err error) {
+	del, err := d.getDelegate(ctx)
 	if err != nil {
 		return schema.GroupVersionResource{}, err
 	}
-	gvr, err = del.ResourceFor(input)
-	if err != nil && !d.cl.Fresh() {
-		d.Reset()
-		gvr, err = d.ResourceFor(input)
+	gvr, err = del.ResourceForWithContext(ctx, input)
+	if err != nil && !d.cl.FreshWithContext(ctx) {
+		d.ResetWithContext(ctx)
+		gvr, err = d.ResourceForWithContext(ctx, input)
 	}
 	return
 }
 
 // ResourcesFor takes a partial resource and returns back the list of
 // potential resource in priority order.
+//
+// ResourcesForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ResourcesForWithContext instead.
 func (d *DeferredDiscoveryRESTMapper) ResourcesFor(input schema.GroupVersionResource) (gvrs []schema.GroupVersionResource, err error) {
-	del, err := d.getDelegate()
+	return d.ResourcesForWithContext(context.Background(), input)
+}
+
+// ResourcesForWithContext takes a partial resource and returns back the list of
+// potential resource in priority order.
+func (d *DeferredDiscoveryRESTMapper) ResourcesForWithContext(ctx context.Context, input schema.GroupVersionResource) (gvrs []schema.GroupVersionResource, err error) {
+	del, err := d.getDelegate(ctx)
 	if err != nil {
 		return nil, err
 	}
-	gvrs, err = del.ResourcesFor(input)
-	if len(gvrs) == 0 && !d.cl.Fresh() {
-		d.Reset()
-		gvrs, err = d.ResourcesFor(input)
+	gvrs, err = del.ResourcesForWithContext(ctx, input)
+	if len(gvrs) == 0 && !d.cl.FreshWithContext(ctx) {
+		d.ResetWithContext(ctx)
+		gvrs, err = d.ResourcesForWithContext(ctx, input)
 	}
 	return
 }
 
 // RESTMapping identifies a preferred resource mapping for the
 // provided group kind.
+//
+// RESTMappingWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use RESTMappingWithContext instead.
 func (d *DeferredDiscoveryRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (m *meta.RESTMapping, err error) {
-	del, err := d.getDelegate()
+	return d.RESTMappingWithContext(context.Background(), gk, versions...)
+}
+
+// RESTMappingWithContext identifies a preferred resource mapping for the
+// provided group kind.
+func (d *DeferredDiscoveryRESTMapper) RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (m *meta.RESTMapping, err error) {
+	del, err := d.getDelegate(ctx)
 	if err != nil {
 		return nil, err
 	}
-	m, err = del.RESTMapping(gk, versions...)
-	if err != nil && !d.cl.Fresh() {
-		d.Reset()
-		m, err = d.RESTMapping(gk, versions...)
+	m, err = del.RESTMappingWithContext(ctx, gk, versions...)
+	if err != nil && !d.cl.FreshWithContext(ctx) {
+		d.ResetWithContext(ctx)
+		m, err = d.RESTMappingWithContext(ctx, gk, versions...)
 	}
 	return
 }
@@ -298,41 +413,59 @@ func (d *DeferredDiscoveryRESTMapper) RESTMapping(gk schema.GroupKind, versions
 // RESTMappings returns the RESTMappings for the provided group kind
 // in a rough internal preferred order. If no kind is found, it will
 // return a NoResourceMatchError.
+//
+// RESTMappingsWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use RESTMappingsWithContext instead.
 func (d *DeferredDiscoveryRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) (ms []*meta.RESTMapping, err error) {
-	del, err := d.getDelegate()
+	return d.RESTMappingsWithContext(context.Background(), gk, versions...)
+}
+
+// RESTMappingsWithContext returns the RESTMappings for the provided group kind
+// in a rough internal preferred order. If no kind is found, it will
+// return a NoResourceMatchError.
+func (d *DeferredDiscoveryRESTMapper) RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (ms []*meta.RESTMapping, err error) {
+	del, err := d.getDelegate(ctx)
 	if err != nil {
 		return nil, err
 	}
-	ms, err = del.RESTMappings(gk, versions...)
-	if len(ms) == 0 && !d.cl.Fresh() {
-		d.Reset()
-		ms, err = d.RESTMappings(gk, versions...)
+	ms, err = del.RESTMappingsWithContext(ctx, gk, versions...)
+	if len(ms) == 0 && !d.cl.FreshWithContext(ctx) {
+		d.ResetWithContext(ctx)
+		ms, err = d.RESTMappingsWithContext(ctx, gk, versions...)
 	}
 	return
 }
 
 // ResourceSingularizer converts a resource name from plural to
 // singular (e.g., from pods to pod).
+//
+// ResourceSingularizerWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ResourceSingularizerWithContext instead.
 func (d *DeferredDiscoveryRESTMapper) ResourceSingularizer(resource string) (singular string, err error) {
-	del, err := d.getDelegate()
+	return d.ResourceSingularizerWithContext(context.Background(), resource)
+}
+
+// ResourceSingularizerWithContext converts a resource name from plural to
+// singular (e.g., from pods to pod).
+func (d *DeferredDiscoveryRESTMapper) ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error) {
+	del, err := d.getDelegate(ctx)
 	if err != nil {
 		return resource, err
 	}
-	singular, err = del.ResourceSingularizer(resource)
-	if err != nil && !d.cl.Fresh() {
-		d.Reset()
-		singular, err = d.ResourceSingularizer(resource)
+	singular, err = del.ResourceSingularizerWithContext(ctx, resource)
+	if err != nil && !d.cl.FreshWithContext(ctx) {
+		d.ResetWithContext(ctx)
+		singular, err = d.ResourceSingularizerWithContext(ctx, resource)
 	}
 	return
 }
 
 func (d *DeferredDiscoveryRESTMapper) String() string {
-	del, err := d.getDelegate()
+	del, err := d.getDelegate(context.Background() /* hopefully we already have a delegate and don't need the context */)
 	if err != nil {
 		return fmt.Sprintf("DeferredDiscoveryRESTMapper{%v}", err)
 	}
 	return fmt.Sprintf("DeferredDiscoveryRESTMapper{\n\t%v\n}", del)
 }
-
-// Make sure it satisfies the interface
-var _ meta.ResettableRESTMapper = &DeferredDiscoveryRESTMapper{}
diff --git a/vendor/k8s.io/client-go/restmapper/shortcut.go b/vendor/k8s.io/client-go/restmapper/shortcut.go
index 0afc8689d7..4dbeea07d8 100644
--- a/vendor/k8s.io/client-go/restmapper/shortcut.go
+++ b/vendor/k8s.io/client-go/restmapper/shortcut.go
@@ -17,6 +17,7 @@ limitations under the License.
 package restmapper
 
 import (
+	"context"
 	"fmt"
 	"strings"
 
@@ -30,22 +31,41 @@ import (
 
 // shortcutExpander is a RESTMapper that can be used for Kubernetes resources.   It expands the resource first, then invokes the wrapped
 type shortcutExpander struct {
-	RESTMapper meta.RESTMapper
+	RESTMapper meta.RESTMapperWithContext
 
-	discoveryClient discovery.DiscoveryInterface
+	discoveryClient discovery.DiscoveryInterfaceWithContext
 
 	warningHandler func(string)
 }
 
 var _ meta.ResettableRESTMapper = shortcutExpander{}
+var _ meta.ResettableRESTMapperWithContext = shortcutExpander{}
 
 // NewShortcutExpander wraps a restmapper in a layer that expands shortcuts found via discovery
+//
+// NewShortcutExpanderWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use NewShortcutExpanderWithContext instead.
 func NewShortcutExpander(delegate meta.RESTMapper, client discovery.DiscoveryInterface, warningHandler func(string)) meta.RESTMapper {
+	return newShortcutExpander(meta.ToRESTMapperWithContext(delegate), discovery.ToDiscoveryInterfaceWithContext(client), warningHandler)
+}
+
+// NewShortcutExpanderWithContext wraps a restmapper in a layer that expands shortcuts found via discovery
+func NewShortcutExpanderWithContext(delegate meta.RESTMapperWithContext, client discovery.DiscoveryInterfaceWithContext, warningHandler func(string)) meta.RESTMapperWithContext {
+	return newShortcutExpander(delegate, client, warningHandler)
+}
+
+func newShortcutExpander(delegate meta.RESTMapperWithContext, client discovery.DiscoveryInterfaceWithContext, warningHandler func(string)) shortcutExpander {
 	return shortcutExpander{RESTMapper: delegate, discoveryClient: client, warningHandler: warningHandler}
 }
 
 // KindFor fulfills meta.RESTMapper
 func (e shortcutExpander) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return e.KindForWithContext(context.Background(), resource)
+}
+
+// KindForWithContext fulfills meta.RESTMapperWithContext
+func (e shortcutExpander) KindForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error) {
 	// expandResourceShortcut works with current API resources as read from discovery cache.
 	// In case of new CRDs this means we potentially don't have current state of discovery.
 	// In the current wiring in k8s.io/cli-runtime/pkg/genericclioptions/config_flags.go#toRESTMapper,
@@ -53,59 +73,113 @@ func (e shortcutExpander) KindFor(resource schema.GroupVersionResource) (schema.
 	// cache and fetch all data from a cluster (see k8s.io/client-go/restmapper/discovery.go#KindFor).
 	// Thus another call to expandResourceShortcut, after a NoMatchError should successfully
 	// read Kind to the user or an error.
-	gvk, err := e.RESTMapper.KindFor(e.expandResourceShortcut(resource))
+	gvk, err := e.RESTMapper.KindForWithContext(ctx, e.expandResourceShortcut(ctx, resource))
 	if meta.IsNoMatchError(err) {
-		return e.RESTMapper.KindFor(e.expandResourceShortcut(resource))
+		return e.RESTMapper.KindForWithContext(ctx, e.expandResourceShortcut(ctx, resource))
 	}
 	return gvk, err
 }
 
 // KindsFor fulfills meta.RESTMapper
+//
+// KindsForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use KindsForWithContext instead.
 func (e shortcutExpander) KindsFor(resource schema.GroupVersionResource) ([]schema.GroupVersionKind, error) {
-	return e.RESTMapper.KindsFor(e.expandResourceShortcut(resource))
+	return e.KindsForWithContext(context.Background(), resource)
+}
+
+// KindsForWithContext fulfills meta.RESTMapperWithContext
+func (e shortcutExpander) KindsForWithContext(ctx context.Context, resource schema.GroupVersionResource) ([]schema.GroupVersionKind, error) {
+	return e.RESTMapper.KindsForWithContext(ctx, e.expandResourceShortcut(ctx, resource))
 }
 
 // ResourcesFor fulfills meta.RESTMapper
+//
+// ResourcesForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ResourcesForWithContext instead.
 func (e shortcutExpander) ResourcesFor(resource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
-	return e.RESTMapper.ResourcesFor(e.expandResourceShortcut(resource))
+	return e.ResourcesForWithContext(context.Background(), resource)
+}
+
+// ResourcesForWithContext fulfills meta.RESTMapperWithContext
+func (e shortcutExpander) ResourcesForWithContext(ctx context.Context, resource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) {
+	return e.RESTMapper.ResourcesForWithContext(ctx, e.expandResourceShortcut(ctx, resource))
 }
 
 // ResourceFor fulfills meta.RESTMapper
+//
+// ResourceForWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ResourceForWithContext instead.
 func (e shortcutExpander) ResourceFor(resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
-	return e.RESTMapper.ResourceFor(e.expandResourceShortcut(resource))
+	return e.ResourceForWithContext(context.Background(), resource)
+}
+
+// ResourceForWithContext fulfills meta.RESTMapperWithContext
+func (e shortcutExpander) ResourceForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionResource, error) {
+	return e.RESTMapper.ResourceForWithContext(ctx, e.expandResourceShortcut(ctx, resource))
 }
 
 // ResourceSingularizer fulfills meta.RESTMapper
+//
+// ResourceSingularizerWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ResourceSingularizerWithContext instead.
 func (e shortcutExpander) ResourceSingularizer(resource string) (string, error) {
-	return e.RESTMapper.ResourceSingularizer(e.expandResourceShortcut(schema.GroupVersionResource{Resource: resource}).Resource)
+	return e.ResourceSingularizerWithContext(context.Background(), resource)
+}
+
+// ResourceSingularizerWithContext fulfills meta.RESTMapperWithContext
+func (e shortcutExpander) ResourceSingularizerWithContext(ctx context.Context, resource string) (string, error) {
+	return e.RESTMapper.ResourceSingularizerWithContext(ctx, e.expandResourceShortcut(ctx, schema.GroupVersionResource{Resource: resource}).Resource)
 }
 
 // RESTMapping fulfills meta.RESTMapper
+//
+// RESTMappingWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use RESTMappingWithContext instead.
 func (e shortcutExpander) RESTMapping(gk schema.GroupKind, versions ...string) (*meta.RESTMapping, error) {
-	return e.RESTMapper.RESTMapping(gk, versions...)
+	return e.RESTMappingWithContext(context.Background(), gk, versions...)
+}
+
+// RESTMappingWithContext fulfills meta.RESTMapperWithContext
+func (e shortcutExpander) RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (*meta.RESTMapping, error) {
+	return e.RESTMapper.RESTMappingWithContext(ctx, gk, versions...)
 }
 
 // RESTMappings fulfills meta.RESTMapper
+//
+// RESTMappingsWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use RESTMappingsWithContext instead.
 func (e shortcutExpander) RESTMappings(gk schema.GroupKind, versions ...string) ([]*meta.RESTMapping, error) {
-	return e.RESTMapper.RESTMappings(gk, versions...)
+	return e.RESTMappingsWithContext(context.Background(), gk, versions...)
+}
+
+// RESTMappingsWithContext fulfills meta.RESTMapperWithContext
+func (e shortcutExpander) RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*meta.RESTMapping, error) {
+	return e.RESTMapper.RESTMappingsWithContext(ctx, gk, versions...)
 }
 
 // getShortcutMappings returns a set of tuples which holds short names for resources.
 // First the list of potential resources will be taken from the API server.
 // Next we will append the hardcoded list of resources - to be backward compatible with old servers.
 // NOTE that the list is ordered by group priority.
-func (e shortcutExpander) getShortcutMappings() ([]*metav1.APIResourceList, []resourceShortcuts, error) {
+func (e shortcutExpander) getShortcutMappings(ctx context.Context) ([]*metav1.APIResourceList, []resourceShortcuts, error) {
 	res := []resourceShortcuts{}
 	// get server resources
 	// This can return an error *and* the results it was able to find.  We don't need to fail on the error.
-	_, apiResList, err := e.discoveryClient.ServerGroupsAndResources()
+	_, apiResList, err := e.discoveryClient.ServerGroupsAndResourcesWithContext(ctx)
 	if err != nil {
-		klog.V(1).Infof("Error loading discovery information: %v", err)
+		klog.FromContext(ctx).V(1).Info("Error loading discovery information", "err", err)
 	}
 	for _, apiResources := range apiResList {
 		gv, err := schema.ParseGroupVersion(apiResources.GroupVersion)
 		if err != nil {
-			klog.V(1).Infof("Unable to parse groupversion = %s due to = %s", apiResources.GroupVersion, err.Error())
+			klog.FromContext(ctx).V(1).Info("Unable to parse group/version", "groupVersion", apiResources.GroupVersion, "err", err.Error())
 			continue
 		}
 		for _, apiRes := range apiResources.APIResources {
@@ -126,9 +200,9 @@ func (e shortcutExpander) getShortcutMappings() ([]*metav1.APIResourceList, []re
 // (something that a pkg/api/meta.RESTMapper can understand), if it is
 // indeed a shortcut. If no match has been found, we will match on group prefixing.
 // Lastly we will return resource unmodified.
-func (e shortcutExpander) expandResourceShortcut(resource schema.GroupVersionResource) schema.GroupVersionResource {
+func (e shortcutExpander) expandResourceShortcut(ctx context.Context, resource schema.GroupVersionResource) schema.GroupVersionResource {
 	// get the shortcut mappings and return on first match.
-	if allResources, shortcutResources, err := e.getShortcutMappings(); err == nil {
+	if allResources, shortcutResources, err := e.getShortcutMappings(ctx); err == nil {
 		// avoid expanding if there's an exact match to a full resource name
 		for _, apiResources := range allResources {
 			gv, err := schema.ParseGroupVersion(apiResources.GroupVersion)
@@ -199,8 +273,15 @@ func (e shortcutExpander) expandResourceShortcut(resource schema.GroupVersionRes
 	return resource
 }
 
+// ResetWithContext is a better alternative because it supports contextual logging and cancellation.
+//
+// Contextual logging: Use ResetWithContext instead.
 func (e shortcutExpander) Reset() {
-	meta.MaybeResetRESTMapper(e.RESTMapper)
+	e.ResetWithContext(context.Background())
+}
+
+func (e shortcutExpander) ResetWithContext(ctx context.Context) {
+	meta.MaybeResetRESTMapperWithContext(ctx, e.RESTMapper)
 }
 
 // ResourceShortcuts represents a structure that holds the information how to
diff --git a/vendor/k8s.io/client-go/tools/cache/OWNERS b/vendor/k8s.io/client-go/tools/cache/OWNERS
index 77d7e4d28a..f62d5e3c51 100644
--- a/vendor/k8s.io/client-go/tools/cache/OWNERS
+++ b/vendor/k8s.io/client-go/tools/cache/OWNERS
@@ -5,7 +5,6 @@ approvers:
   - smarterclayton
   - wojtek-t
   - deads2k
-  - caesarxuchao
   - liggitt
 reviewers:
   - thockin
@@ -13,8 +12,6 @@ reviewers:
   - wojtek-t
   - deads2k
   - derekwaynecarr
-  - caesarxuchao
-  - mikedanese
   - liggitt
   - janetkuo
   - justinsb
@@ -24,5 +21,6 @@ reviewers:
   - ingvagabund
   - michaelasp
 emeritus_approvers:
+  - caesarxuchao
   - lavalamp
   - ncdc
diff --git a/vendor/k8s.io/client-go/tools/cache/controller.go b/vendor/k8s.io/client-go/tools/cache/controller.go
index b78ed522e2..adb1fb9308 100644
--- a/vendor/k8s.io/client-go/tools/cache/controller.go
+++ b/vendor/k8s.io/client-go/tools/cache/controller.go
@@ -20,9 +20,11 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 	"sync"
 	"time"
 
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"k8s.io/apimachinery/pkg/util/wait"
@@ -282,6 +284,126 @@ type ResourceEventHandler interface {
 	OnDelete(obj interface{})
 }
 
+// Object is the subset of metav1.Object that is needed to determine the
+// name and, if applicable, namespace of an object. All standard Kubernetes
+// API types satisfy this interface through their embedded ObjectMeta.
+//
+// comparable is required so that a zero T can be compared against
+// OptionalObj to detect a missing object (e.g. a nil pointer).
+type Object interface {
+	comparable
+
+	GetName() string
+	GetNamespace() string
+}
+
+// TypedResourceEventHandler is a type-safe variant of ResourceEventHandler.
+type TypedResourceEventHandler[T Object] interface {
+	OnAdd(obj T, isInInitialList bool)
+	OnUpdate(oldObj, newObj T)
+	OnDelete(obj DeletedObject[T])
+}
+
+// DeletedObject provides information about a deleted object.
+//
+// It implements GetObjectName and GetKey, which replace
+// [DeletionHandlingObjectToName] and [DeletionHandlingMetaNamespaceKeyFunc]
+//
+// It implements the GetName and GetNamespace methods for use
+// with klog.KObj: an OnDelete event handler can log
+// it's parameter directly and is guaranteed to produce the same
+// log output as with klog.KObj applied to the actual object.
+//
+// All of these methods work regardless whether DeletedObject actually has
+// the deleted object.
+type DeletedObject[T Object] struct {
+	// OptionalObj is the deleted object.
+	//
+	// It can be:
+	// - stale: it is some *older* revision, not the one which got deleted
+	// - nil: the informer noticed a deletion without finding *any* copy of the deleted object
+	//
+	// The only guaranteed information is the key under which the deleted
+	// object was stored in the informer cache. Use [DeletedObject.GetObjectName]
+	// and [DeletedObject.GetKey] to extract the namespace and name resp.
+	// the key under which the deleted object was stored. They work in
+	// all cases.
+	OptionalObj T
+
+	// FinalStateUnknown is nil if the deleted object is available and up-to-date.
+	// Otherwise FinalStateUnknown is non-nil to provide the key.
+	// The untyped object inside it matches OptionalObj.
+	FinalStateUnknown *DeletedFinalStateUnknown
+}
+
+// GetObjectName returns the object name (= namespace if available and name)
+// for the deleted object. Note that this is slightly different from
+// GetName which returns just that name without the namespace.
+//
+// This is a type-safe variant of [DeletionHandlingObjectToName] which
+// cannot fail because T is guaranteed to have a name and namespace and
+// the key of FinalStateUnknown, if invalid, is simply treated as a
+// name without a namespace.
+func (d DeletedObject[T]) GetObjectName() ObjectName {
+	if d.FinalStateUnknown != nil {
+		// Same splitting as SplitMetaNamespaceKey and ParseObjectName,
+		// except that a key with more than one "/" is not treated as an error:
+		// the extra "/" become part of the name.
+		namespace, name, found := strings.Cut(d.FinalStateUnknown.Key, "/")
+		if !found {
+			return ObjectName{Name: namespace}
+		}
+		return ObjectName{Namespace: namespace, Name: name}
+	}
+	var null T
+	if d.OptionalObj == null {
+		// Avoid calling GetName/GetNamespace on a zero OptionalObj (e.g. a
+		// nil pointer), which could panic. A nil pointer boxed behind a
+		// further layer of indirection is not detected here and is not
+		// handled.
+		return ObjectName{}
+	}
+	// Same logic as MetaObjectToName, adapted to use T's own
+	// GetNamespace and GetName methods instead of going through
+	// meta.Accessor as ObjectToName does.
+	if namespace := d.OptionalObj.GetNamespace(); len(namespace) > 0 {
+		return ObjectName{Namespace: namespace, Name: d.OptionalObj.GetName()}
+	}
+	return ObjectName{Name: d.OptionalObj.GetName()}
+}
+
+// GetName returns the name without the namespace. Note that this is slightly
+// different from GetObjectName which returns the combination of namespace and name in a
+// struct.
+func (d DeletedObject[T]) GetName() string {
+	return d.GetObjectName().Name
+}
+
+// GetNamespace returns the namespace if there is one, otherwise the empty string.
+func (d DeletedObject[T]) GetNamespace() string {
+	return d.GetObjectName().Namespace
+}
+
+// GetKey returns the key under which the deleted object was stored.
+//
+// This is a type-safe variant of [DeletionHandlingMetaNamespaceKeyFunc]
+// which cannot fail because T is guaranteed to have a name and namespace.
+func (d DeletedObject[T]) GetKey() string {
+	if d.FinalStateUnknown != nil {
+		return d.FinalStateUnknown.Key
+	}
+	var null T
+	if d.OptionalObj == null {
+		return ""
+	}
+	// Same encoding as MetaNamespaceKeyFunc via ObjectName.String,
+	// adapted to use T's own GetNamespace and GetName methods.
+	if namespace := d.OptionalObj.GetNamespace(); len(namespace) > 0 {
+		return namespace + "/" + d.OptionalObj.GetName()
+	}
+	return d.OptionalObj.GetName()
+}
+
 // ResourceEventHandlerFuncs is an adaptor to let you easily specify as many or
 // as few of the notification functions as you want while still implementing
 // ResourceEventHandler.  This adapter does not remove the prohibition against
@@ -316,6 +438,32 @@ func (r ResourceEventHandlerFuncs) OnDelete(obj interface{}) {
 	}
 }
 
+type TypedResourceEventHandlerFuncs[T Object] struct {
+	AddFunc    func(obj T)
+	UpdateFunc func(oldObj, newObj T)
+	DeleteFunc func(obj DeletedObject[T])
+}
+
+var _ TypedResourceEventHandler[*metav1.ObjectMeta] = TypedResourceEventHandlerFuncs[*metav1.ObjectMeta]{}
+
+func (r TypedResourceEventHandlerFuncs[T]) OnAdd(obj T, isInInitialList bool) {
+	if r.AddFunc != nil {
+		r.AddFunc(obj)
+	}
+}
+
+func (r TypedResourceEventHandlerFuncs[T]) OnUpdate(oldObj, newObj T) {
+	if r.UpdateFunc != nil {
+		r.UpdateFunc(oldObj, newObj)
+	}
+}
+
+func (r TypedResourceEventHandlerFuncs[T]) OnDelete(obj DeletedObject[T]) {
+	if r.DeleteFunc != nil {
+		r.DeleteFunc(obj)
+	}
+}
+
 // ResourceEventHandlerDetailedFuncs is exactly like ResourceEventHandlerFuncs
 // except its AddFunc accepts the isInInitialList parameter, for propagating
 // HasSynced.
@@ -346,6 +494,32 @@ func (r ResourceEventHandlerDetailedFuncs) OnDelete(obj interface{}) {
 	}
 }
 
+type TypedResourceEventHandlerDetailedFuncs[T Object] struct {
+	AddFunc    func(obj T, isInInitialList bool)
+	UpdateFunc func(oldObj, newObj T)
+	DeleteFunc func(obj DeletedObject[T])
+}
+
+var _ TypedResourceEventHandler[*metav1.ObjectMeta] = TypedResourceEventHandlerDetailedFuncs[*metav1.ObjectMeta]{}
+
+func (r TypedResourceEventHandlerDetailedFuncs[T]) OnAdd(obj T, isInInitialList bool) {
+	if r.AddFunc != nil {
+		r.AddFunc(obj, isInInitialList)
+	}
+}
+
+func (r TypedResourceEventHandlerDetailedFuncs[T]) OnUpdate(oldObj, newObj T) {
+	if r.UpdateFunc != nil {
+		r.UpdateFunc(oldObj, newObj)
+	}
+}
+
+func (r TypedResourceEventHandlerDetailedFuncs[T]) OnDelete(obj DeletedObject[T]) {
+	if r.DeleteFunc != nil {
+		r.DeleteFunc(obj)
+	}
+}
+
 // FilteringResourceEventHandler applies the provided filter to all events coming
 // in, ensuring the appropriate nested handler method is invoked. An object
 // that starts passing the filter after an update is considered an add, and an
@@ -388,6 +562,48 @@ func (r FilteringResourceEventHandler) OnDelete(obj interface{}) {
 	r.Handler.OnDelete(obj)
 }
 
+// TypedFilteringResourceEventHandler is a type-safe variant of
+// [FilteringResourceEventHandler].
+type TypedFilteringResourceEventHandler[T Object] struct {
+	FilterFunc func(obj T) bool
+	Handler    TypedResourceEventHandler[T]
+}
+
+// OnAdd calls the nested handler only if the filter succeeds
+func (r TypedFilteringResourceEventHandler[T]) OnAdd(obj T, isInInitialList bool) {
+	if !r.FilterFunc(obj) {
+		return
+	}
+	r.Handler.OnAdd(obj, isInInitialList)
+}
+
+// OnUpdate ensures the proper handler is called depending on whether the filter matches
+func (r TypedFilteringResourceEventHandler[T]) OnUpdate(oldObj, newObj T) {
+	newer := r.FilterFunc(newObj)
+	older := r.FilterFunc(oldObj)
+	switch {
+	case newer && older:
+		r.Handler.OnUpdate(oldObj, newObj)
+	case newer && !older:
+		r.Handler.OnAdd(newObj, false)
+	case !newer && older:
+		r.Handler.OnDelete(DeletedObject[T]{OptionalObj: oldObj})
+	default:
+		// do nothing
+	}
+}
+
+// OnDelete calls the nested handler only if the filter succeeds. The filter
+// is applied to [DeletedObject.OptionalObj], which may be the zero value of T
+// if the deleted object could not be recovered; a FilterFunc that relies on T
+// having a valid state must handle that case itself.
+func (r TypedFilteringResourceEventHandler[T]) OnDelete(obj DeletedObject[T]) {
+	if !r.FilterFunc(obj.OptionalObj) {
+		return
+	}
+	r.Handler.OnDelete(obj)
+}
+
 // DeletionHandlingMetaNamespaceKeyFunc checks for
 // DeletedFinalStateUnknown objects before calling
 // MetaNamespaceKeyFunc.
diff --git a/vendor/k8s.io/client-go/tools/cache/fake_custom_store.go b/vendor/k8s.io/client-go/tools/cache/fake_custom_store.go
index 462d22660c..e6456f7c9d 100644
--- a/vendor/k8s.io/client-go/tools/cache/fake_custom_store.go
+++ b/vendor/k8s.io/client-go/tools/cache/fake_custom_store.go
@@ -18,17 +18,21 @@ package cache
 
 // FakeCustomStore lets you define custom functions for store operations.
 type FakeCustomStore struct {
-	AddFunc      func(obj interface{}) error
-	UpdateFunc   func(obj interface{}) error
-	DeleteFunc   func(obj interface{}) error
-	ListFunc     func() []interface{}
-	ListKeysFunc func() []string
-	GetFunc      func(obj interface{}) (item interface{}, exists bool, err error)
-	GetByKeyFunc func(key string) (item interface{}, exists bool, err error)
-	ReplaceFunc  func(list []interface{}, resourceVersion string) error
-	ResyncFunc   func() error
+	AddFunc                          func(obj interface{}) error
+	UpdateFunc                       func(obj interface{}) error
+	DeleteFunc                       func(obj interface{}) error
+	ListFunc                         func() []interface{}
+	ListKeysFunc                     func() []string
+	GetFunc                          func(obj interface{}) (item interface{}, exists bool, err error)
+	GetByKeyFunc                     func(key string) (item interface{}, exists bool, err error)
+	ReplaceFunc                      func(list []interface{}, resourceVersion string) error
+	ResyncFunc                       func() error
+	BookmarkFunc                     func(rv string)
+	LastStoreSyncResourceVersionFunc func() string
 }
 
+var _ Store = &FakeCustomStore{}
+
 // Add calls the custom Add function if defined
 func (f *FakeCustomStore) Add(obj interface{}) error {
 	if f.AddFunc != nil {
@@ -100,3 +104,18 @@ func (f *FakeCustomStore) Resync() error {
 	}
 	return nil
 }
+
+// Bookmark calls the custom Bookmark function if defined
+func (f *FakeCustomStore) Bookmark(rv string) {
+	if f.BookmarkFunc != nil {
+		f.BookmarkFunc(rv)
+	}
+}
+
+// LastStoreSyncResourceVersion calls the custom LastStoreSyncResourceVersion function if defined
+func (f *FakeCustomStore) LastStoreSyncResourceVersion() string {
+	if f.LastStoreSyncResourceVersionFunc != nil {
+		return f.LastStoreSyncResourceVersionFunc()
+	}
+	return ""
+}
diff --git a/vendor/k8s.io/client-go/tools/cache/index.go b/vendor/k8s.io/client-go/tools/cache/index.go
index 395268f68c..ca0d904e65 100644
--- a/vendor/k8s.io/client-go/tools/cache/index.go
+++ b/vendor/k8s.io/client-go/tools/cache/index.go
@@ -98,3 +98,37 @@ type Indexers map[string]IndexFunc
 
 // Indices maps a name to an Index
 type Indices map[string]index
+
+type TypedIndexers[T any] map[string]TypedIndexFunc[T]
+type TypedIndexFunc[T any] func(obj T) ([]string, error)
+type TypedIndexer[T any] interface {
+	Indexer
+
+	TypedIndex(indexName string, obj T) ([]T, error)
+	ByTypedIndex(indexName, indexedValue string) ([]T, error)
+	AddTypedIndexers(newIndexers TypedIndexers[T]) error
+}
+
+// TypedIndexersToIndexers wraps several indexer functions which expect objects
+// of a certain type so that they can be used in an [Indexer].
+// This is needed primarily for setting up [SharedIndexInformerOptions.Indexers].
+// When using one of the typed APIs for installing an indexer function
+// the conversion is done automatically.
+func TypedIndexersToIndexers[T any](indexers TypedIndexers[T]) Indexers {
+	untyped := make(Indexers, len(indexers))
+	for i, indexer := range indexers {
+		untyped[i] = TypedIndexerFuncToIndexerFunc(indexer)
+	}
+	return untyped
+}
+
+// TypedIndexersFuncToIndexerFunc wraps one indexer function which expect objects
+// of a certain type so that they can be used in an [Indexer].
+// This is needed primarily for setting up [SharedIndexInformerOptions.Indexers].
+// When using one of the typed APIs for installing an indexer function
+// the conversion is done automatically.
+func TypedIndexerFuncToIndexerFunc[T any](indexer TypedIndexFunc[T]) IndexFunc {
+	return func(obj any) ([]string, error) {
+		return indexer(obj.(T))
+	}
+}
diff --git a/vendor/k8s.io/client-go/tools/cache/fifo_metrics.go b/vendor/k8s.io/client-go/tools/cache/informer_metrics.go
similarity index 98%
rename from vendor/k8s.io/client-go/tools/cache/fifo_metrics.go
rename to vendor/k8s.io/client-go/tools/cache/informer_metrics.go
index 7a67817240..e0d3b6e930 100644
--- a/vendor/k8s.io/client-go/tools/cache/fifo_metrics.go
+++ b/vendor/k8s.io/client-go/tools/cache/informer_metrics.go
@@ -70,7 +70,7 @@ type storeMetrics struct {
 }
 
 // SetInformerMetricsProvider sets the metrics provider for all subsequently created
-// FIFOs. Only the first call has an effect.
+// informers. Only the first call has an effect.
 func SetInformerMetricsProvider(metricsProvider InformerMetricsProvider) {
 	setInformerMetricsProviderOnce.Do(func() {
 		globalInformerMetricsProvider = metricsProvider
diff --git a/vendor/k8s.io/client-go/tools/cache/mutation_cache.go b/vendor/k8s.io/client-go/tools/cache/mutation_cache.go
index 6800a62508..e70b721a83 100644
--- a/vendor/k8s.io/client-go/tools/cache/mutation_cache.go
+++ b/vendor/k8s.io/client-go/tools/cache/mutation_cache.go
@@ -25,7 +25,10 @@ import (
 	"k8s.io/klog/v2"
 
 	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
 	utilcache "k8s.io/apimachinery/pkg/util/cache"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"k8s.io/apimachinery/pkg/util/sets"
@@ -35,11 +38,19 @@ import (
 // that can be used to provide a more current view of a requested object.  It requires interpreting
 // resourceVersions for comparisons.
 // Implementations must be thread-safe.
-// TODO find a way to layer this into an informer/lister
+// OnAddOrupdate and OnDelete should be called from informer event handlers to increase
+// the accuracy of the cache.
 type MutationCache interface {
 	GetByKey(key string) (interface{}, bool, error)
 	ByIndex(indexName, indexKey string) ([]interface{}, error)
 	Mutation(interface{})
+	OnAddOrUpdate(obj runtime.Object)
+	OnDelete(obj runtime.Object)
+
+	// This interface is not meant to be implemented elsewhere.
+	// Marking it as internal enables future changes without
+	// triggering apidiff.
+	internal()
 }
 
 // ResourceVersionComparator is able to compare object versions.
@@ -47,7 +58,28 @@ type ResourceVersionComparator interface {
 	CompareResourceVersion(lhs, rhs runtime.Object) int
 }
 
-// NewIntegerResourceVersionMutationCache returns a MutationCache that understands how to
+// MutationCacheOptions configures the MutationCache returned by NewIntegerResourceVersionMutationCacheWithOptions.
+type MutationCacheOptions struct {
+	// Indexer is used by ByIndex to look up objects. May be nil, in which case ByIndex returns an error.
+	Indexer Indexer
+
+	// TTL controls how long an item remains in the mutation cache before it is removed.
+	// Zero means the default of 5 minutes.
+	TTL time.Duration
+
+	// IncludeAdds makes the cache return objects even if they don't exist
+	// in the underlying store. This is only safe if your use of the cache
+	// can handle mutation entries remaining in the cache for up to TTL
+	// when mutations and deletes occur very closely in time.
+	IncludeAdds bool
+
+	// MaxCacheSize limits how many mutated objects are tracked; the least
+	// recently used entries are evicted once the limit is reached.
+	// Zero means the default of 100.
+	MaxCacheSize int
+}
+
+// NewIntegerResourceVersionMutationCacheWithOptions returns a MutationCache that understands how to
 // deal with objects that have a resource version that:
 //
 //   - is an integer
@@ -60,18 +92,55 @@ type ResourceVersionComparator interface {
 // If includeAdds is true, objects in the mutation cache will be returned even if they don't exist
 // in the underlying store. This is only safe if your use of the cache can handle mutation entries
 // remaining in the cache for up to ttl when mutations and deletes occur very closely in time.
-func NewIntegerResourceVersionMutationCache(logger klog.Logger, backingCache Store, indexer Indexer, ttl time.Duration, includeAdds bool) MutationCache {
+//
+// Note that this also applies to objects updated by the caller, not just
+// objects added by it.  That's because the MutationCache may hold an updated
+// object at a time when the underlying store already removed it because it was
+// deleted in the apiserver after the update. To address this, the caller
+// can call OnAddOrUpdate and OnDelete from informer event handlers.
+//
+// This informs the MutationCache about all changes observed by the store
+// and enables it to remove a locally added or updated object immediately once
+// it appears in the store, which prevents the "stale updated object" problem.
+//
+// This does not solve the "stale added object" problem reliably because
+// the informer might never see the added object when the add is followed
+// quickly by a delete. The caller has to handle stale added objects by
+// checking whether they still exist once the TTL is over.
+func NewIntegerResourceVersionMutationCacheWithOptions(logger klog.Logger, backingCache Store, options MutationCacheOptions) MutationCache {
+	var (
+		maxCacheSize = 100
+		ttl          = 5 * time.Minute
+	)
+
+	if options.MaxCacheSize != 0 {
+		maxCacheSize = options.MaxCacheSize
+	}
+	if options.TTL != 0 {
+		ttl = options.TTL
+	}
+
 	return &mutationCache{
 		backingCache:  backingCache,
-		indexer:       indexer,
-		mutationCache: utilcache.NewLRUExpireCache(100),
+		indexer:       options.Indexer,
+		mutationCache: utilcache.NewLRUExpireCache(maxCacheSize),
 		comparator:    etcdObjectVersioner{},
 		ttl:           ttl,
-		includeAdds:   includeAdds,
+		includeAdds:   options.IncludeAdds,
 		logger:        logger,
 	}
 }
 
+// NewIntegerResourceVersionMutationCache is like NewIntegerResourceVersionMutationCacheWithOptions with a fixed cache size of 100.
+func NewIntegerResourceVersionMutationCache(logger klog.Logger, backingCache Store, indexer Indexer, ttl time.Duration, includeAdds bool) MutationCache {
+	return NewIntegerResourceVersionMutationCacheWithOptions(logger, backingCache, MutationCacheOptions{
+		TTL:          ttl,
+		Indexer:      indexer,
+		IncludeAdds:  includeAdds,
+		MaxCacheSize: 100,
+	})
+}
+
 // mutationCache doesn't guarantee that it returns values added via Mutation since they can page out and
 // since you can't distinguish between, "didn't observe create" and "was deleted after create",
 // if the key is missing from the backing cache, we always return it as missing
@@ -108,11 +177,24 @@ func (c *mutationCache) GetByKey(key string) (interface{}, bool, error) {
 		if !exists {
 			return nil, false, nil
 		}
+		// Don't return the tombstone.
+		if _, ok := obj.(*tombstone); ok {
+			return nil, false, nil
+		}
 	}
 	objRuntime, ok := obj.(runtime.Object)
 	if !ok {
 		return obj, true, nil
 	}
+	// If the object is from the store,
+	// then this will remove the obsolete tombstone.
+	//
+	// The newer object can never be the tombstone
+	// because a) we don't get here if only the tombstone
+	// exists (early return above) and b) the store's
+	// object must be more recent than the tombstone
+	// (the tombstone was created by an earlier store
+	// deletion).
 	return c.newerObject(key, objRuntime), true, nil
 }
 
@@ -157,6 +239,9 @@ func (c *mutationCache) ByIndex(name string, indexKey string) ([]interface{}, er
 			if keySet.Has(key.(string)) {
 				continue
 			}
+			if _, ok := updated.(*tombstone); ok {
+				continue
+			}
 			elements, err := fn(updated)
 			if err != nil {
 				c.logger.V(4).Info("Unable to calculate an index entry for mutation cache entry", "key", key, "err", err)
@@ -213,15 +298,114 @@ func (c *mutationCache) Mutation(obj interface{}) {
 	if objRuntime, ok := obj.(runtime.Object); ok {
 		if mutatedObj, exists := c.mutationCache.Get(key); exists {
 			if mutatedObjRuntime, ok := mutatedObj.(runtime.Object); ok {
-				if c.comparator.CompareResourceVersion(objRuntime, mutatedObjRuntime) < 0 {
+				cmp := c.comparator.CompareResourceVersion(objRuntime, mutatedObjRuntime)
+				if cmp < 0 {
 					return
 				}
+				if t, ok := mutatedObj.(*tombstone); ok {
+					if cmp == 0 {
+						// Exactly this object instance is known to be deleted.
+						// Don't store it, keep the tombstone.
+						return
+					}
+					objMeta, err := meta.Accessor(obj)
+					if err == nil && t.GetUID() == objMeta.GetUID() {
+						// Some other revision of this object instance
+						// is known to be deleted. Also don't store it.
+						return
+					}
+				}
 			}
 		}
 	}
 	c.mutationCache.Add(key, obj, c.ttl)
 }
 
+// OnAddOrUpdate can be called to informer the cache about an object added to
+// the store or updated in in. If the object is as recent as the cached object
+// or newer, the cached object gets removed because it is no longer
+// needed. This keeps the cache smaller.
+func (c *mutationCache) OnAddOrUpdate(obj runtime.Object) {
+	key, err := DeletionHandlingMetaNamespaceKeyFunc(obj)
+	if err != nil {
+		// this is a "nice to have", so failures shouldn't do anything weird
+		utilruntime.HandleErrorWithLogger(c.logger, err, "DeletionHandlingMetaNamespaceKeyFunc")
+		return
+	}
+
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	if mutatedObj, exists := c.mutationCache.Get(key); exists {
+		if mutatedObj, ok := mutatedObj.(runtime.Object); ok {
+			// No need to compare the UID here: resource versions can be compared
+			// between different instances. If it's newer or equal, then the mutation
+			// cache is out-dated.
+			if c.comparator.CompareResourceVersion(obj, mutatedObj) >= 0 {
+				c.mutationCache.Remove(key)
+			}
+		}
+	}
+}
+
+// OnDelete can be called to informer the cache about an object deleted in the store.
+// If there is a cached object with the same UID or an older RV, it gets removed.
+func (c *mutationCache) OnDelete(obj runtime.Object) {
+	objMeta, err := meta.Accessor(obj)
+	if err != nil {
+		return
+	}
+
+	key, err := DeletionHandlingMetaNamespaceKeyFunc(obj)
+	if err != nil {
+		// this is a "nice to have", so failures shouldn't do anything weird
+		utilruntime.HandleErrorWithLogger(c.logger, err, "DeletionHandlingMetaNamespaceKeyFunc")
+		return
+	}
+
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	if mutatedObj, exists := c.mutationCache.Get(key); exists {
+		if mutatedObj, ok := mutatedObj.(runtime.Object); ok {
+			mutatedObjMeta, err := meta.Accessor(mutatedObj)
+			if err != nil {
+				return
+			}
+			// If the deleted object is known to be more recent than the
+			// mutated one, then the mutated one must have been removed
+			// because resource versions are incremented by type, not by
+			// object instance.
+			//
+			// If the UID matches, then we can also be sure that it got
+			// removed.
+			//
+			// If neither of this is true, then the caller has added
+			// a mutated object that may or may not still exist. They
+			// have to check after the TTL.
+			if c.comparator.CompareResourceVersion(obj, mutatedObj) >= 0 ||
+				mutatedObjMeta.GetUID() == objMeta.GetUID() {
+				c.mutationCache.Remove(key)
+			} else {
+				return
+			}
+		}
+	}
+
+	// Store a tombstone object in the mutation cache.
+	// A future Mutation call is outdated if it has a RV
+	// which is lower or equal or has the same UID.
+	t := &tombstone{
+		namespace: objMeta.GetNamespace(),
+		name:      objMeta.GetName(),
+		uid:       objMeta.GetUID(),
+		rv:        objMeta.GetResourceVersion(),
+	}
+	c.mutationCache.Add(key, t, c.ttl)
+}
+
+func (c *mutationCache) internal() {}
+
 // etcdObjectVersioner implements versioning and extracting etcd node information
 // for objects that have an embedded ObjectMeta or ListMeta field.
 type etcdObjectVersioner struct{}
@@ -262,3 +446,57 @@ func (a etcdObjectVersioner) CompareResourceVersion(lhs, rhs runtime.Object) int
 
 	return 1
 }
+
+// tombstone is a replacement for a deleted object. It has the same key as it
+// and the ResourceVersion at which the deletion was detected.
+//
+// It implements GetName, GetNamespace, GetResourceVersion and GetUID and thus
+// the code above can compare it against other, normal objects. The difference
+// is that it never gets returned by ByIndex or GetByKey.
+type tombstone struct {
+	namespace, name, rv string
+	uid                 types.UID
+}
+
+var _ metav1.Object = &tombstone{}
+var _ runtime.Object = &tombstone{}
+
+func (t *tombstone) DeepCopyObject() runtime.Object {
+	clone := *t
+	return &clone
+}
+
+func (t *tombstone) GetObjectKind() schema.ObjectKind { panic("not implemented") }
+
+func (t *tombstone) GetNamespace() string                          { return t.namespace }
+func (t *tombstone) SetNamespace(namespace string)                 { panic("not implemented") }
+func (t *tombstone) GetName() string                               { return t.name }
+func (t *tombstone) SetName(name string)                           { panic("not implemented") }
+func (t *tombstone) GetGenerateName() string                       { panic("not implemented") }
+func (t *tombstone) SetGenerateName(name string)                   { panic("not implemented") }
+func (t *tombstone) GetUID() types.UID                             { return t.uid }
+func (t *tombstone) SetUID(uid types.UID)                          { panic("not implemented") }
+func (t *tombstone) GetResourceVersion() string                    { return t.rv }
+func (t *tombstone) SetResourceVersion(version string)             { panic("not implemented") }
+func (t *tombstone) GetGeneration() int64                          { panic("not implemented") }
+func (t *tombstone) SetGeneration(generation int64)                { panic("not implemented") }
+func (t *tombstone) GetSelfLink() string                           { panic("not implemented") }
+func (t *tombstone) SetSelfLink(selfLink string)                   { panic("not implemented") }
+func (t *tombstone) GetCreationTimestamp() metav1.Time             { panic("not implemented") }
+func (t *tombstone) SetCreationTimestamp(timestamp metav1.Time)    { panic("not implemented") }
+func (t *tombstone) GetDeletionTimestamp() *metav1.Time            { panic("not implemented") }
+func (t *tombstone) SetDeletionTimestamp(timestamp *metav1.Time)   { panic("not implemented") }
+func (t *tombstone) GetDeletionGracePeriodSeconds() *int64         { panic("not implemented") }
+func (t *tombstone) SetDeletionGracePeriodSeconds(*int64)          { panic("not implemented") }
+func (t *tombstone) GetLabels() map[string]string                  { panic("not implemented") }
+func (t *tombstone) SetLabels(labels map[string]string)            { panic("not implemented") }
+func (t *tombstone) GetAnnotations() map[string]string             { panic("not implemented") }
+func (t *tombstone) SetAnnotations(annotations map[string]string)  { panic("not implemented") }
+func (t *tombstone) GetFinalizers() []string                       { panic("not implemented") }
+func (t *tombstone) SetFinalizers(finalizers []string)             { panic("not implemented") }
+func (t *tombstone) GetOwnerReferences() []metav1.OwnerReference   { panic("not implemented") }
+func (t *tombstone) SetOwnerReferences([]metav1.OwnerReference)    { panic("not implemented") }
+func (t *tombstone) GetManagedFields() []metav1.ManagedFieldsEntry { panic("not implemented") }
+func (t *tombstone) SetManagedFields(managedFields []metav1.ManagedFieldsEntry) {
+	panic("not implemented")
+}
diff --git a/vendor/k8s.io/client-go/tools/cache/reflector.go b/vendor/k8s.io/client-go/tools/cache/reflector.go
index a0e3a701cd..82de01f9ae 100644
--- a/vendor/k8s.io/client-go/tools/cache/reflector.go
+++ b/vendor/k8s.io/client-go/tools/cache/reflector.go
@@ -742,7 +742,7 @@ func (r *Reflector) list(ctx context.Context) error {
 	case <-listCh:
 	}
 
-	initTrace.Step("Objects listed", trace.Field{Key: "error", Value: err})
+	initTrace.Step("Objects listed", trace.Field{Key: "error", Value: err}, trace.Field{Key: "count", Value: meta.LenList(list)})
 	if err != nil {
 		return fmt.Errorf("failed to list %v: %w", r.typeDescription, err)
 	}
diff --git a/vendor/k8s.io/client-go/tools/cache/shared_informer.go b/vendor/k8s.io/client-go/tools/cache/shared_informer.go
index 4cec4283f1..c259cdd9af 100644
--- a/vendor/k8s.io/client-go/tools/cache/shared_informer.go
+++ b/vendor/k8s.io/client-go/tools/cache/shared_informer.go
@@ -28,6 +28,7 @@ import (
 	"time"
 
 	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"k8s.io/apimachinery/pkg/util/wait"
@@ -177,6 +178,15 @@ type SharedInformer interface {
 	// RemoveEventHandler removes a formerly added event handler given by
 	// its registration handle.
 	// This function is guaranteed to be idempotent, and thread-safe.
+	//
+	// Note: RemoveEventHandler is asynchronous. It stops queueing new events
+	// but does not wait for already-queued events to finish executing.
+	// Goroutines processing the remaining events may still be running and
+	// invoking callbacks after this function returns.
+	//
+	// If the caller needs to wait for all handlers to finish executing (for
+	// example, to safely close channels or release resources used by the handler),
+	// they should use [ShutDownEventHandler].
 	RemoveEventHandler(handle ResourceEventHandlerRegistration) error
 	// GetStore returns the informer's local cache as a Store.
 	GetStore() Store
@@ -287,6 +297,118 @@ type SharedIndexInformer interface {
 	GetIndexer() Indexer
 }
 
+// TypedSharedIndexInformer adds type-safe variants for non-type-safe methods
+// in SharedIndexInformer. No type casts are needed when using those variants.
+type TypedSharedIndexInformer[T Object] interface {
+	SharedIndexInformer
+
+	// AddTypedEventHandler is a type-safe replacement for
+	// SharedIndexInformer.AddEventHandlerWithOptions
+	// and SharedIndexInformer.AddEventHandler.
+	//
+	// Without options, it uses the same defaults as AddEventHandler
+	// or AddEventHandlerWithOptions with empty HandlerOptions.
+	// Passing one instance corresponds to AddEventHandlerWithOptions.
+	// Passing more than one is invalid and returns an error.
+	AddTypedEventHandler(handler TypedResourceEventHandler[T], options ...HandlerOptions) (ResourceEventHandlerRegistration, error)
+	AddTypedIndexers(indexers TypedIndexers[T]) error
+	GetTypedIndexer() TypedIndexer[T]
+}
+
+func NewTypedSharedIndexInformer[T Object](informer SharedIndexInformer) TypedSharedIndexInformer[T] {
+	return &typedSharedIndexInformer[T]{SharedIndexInformer: informer}
+}
+
+type typedSharedIndexInformer[T Object] struct {
+	SharedIndexInformer
+}
+
+func (s typedSharedIndexInformer[T]) AddTypedEventHandler(handler TypedResourceEventHandler[T], options ...HandlerOptions) (ResourceEventHandlerRegistration, error) {
+	var o HandlerOptions
+	switch len(options) {
+	case 0:
+	case 1:
+		o = options[0]
+	default:
+		return nil, fmt.Errorf("at most one HandlerOptions may be passed, got %d", len(options))
+	}
+	return s.AddEventHandlerWithOptions(&typedResourceEventHandler[T]{handler}, o)
+}
+
+func (s typedSharedIndexInformer[T]) AddTypedIndexers(indexers TypedIndexers[T]) error {
+	return s.AddIndexers(TypedIndexersToIndexers(indexers))
+}
+
+func (s typedSharedIndexInformer[T]) GetTypedIndexer() TypedIndexer[T] {
+	return &typedIndexer[T]{s.GetIndexer()}
+}
+
+// typedResourceEventHandler implements the untyped ResourceEventHandler interface
+// by invoking the methods of a TypedResourceEventHandler instance.
+type typedResourceEventHandler[T Object] struct {
+	handler TypedResourceEventHandler[T]
+}
+
+var _ ResourceEventHandler = &typedResourceEventHandler[*metav1.ObjectMeta]{}
+
+func (h *typedResourceEventHandler[T]) OnAdd(obj any, isInitialList bool) {
+	h.handler.OnAdd(obj.(T), isInitialList)
+}
+
+func (h *typedResourceEventHandler[T]) OnUpdate(oldObj, newObj any) {
+	h.handler.OnUpdate(oldObj.(T), newObj.(T))
+}
+
+func (h *typedResourceEventHandler[T]) OnDelete(obj any) {
+	if tomb, ok := obj.(DeletedFinalStateUnknown); ok {
+		if tomb.Obj == nil {
+			h.handler.OnDelete(DeletedObject[T]{FinalStateUnknown: &tomb})
+			return
+		}
+		h.handler.OnDelete(DeletedObject[T]{OptionalObj: tomb.Obj.(T), FinalStateUnknown: &tomb})
+		return
+	}
+	h.handler.OnDelete(DeletedObject[T]{OptionalObj: obj.(T)})
+}
+
+type typedIndexer[T any] struct {
+	Indexer
+}
+
+func (i typedIndexer[T]) TypedIndex(indexName string, obj T) ([]T, error) {
+	untyped, err := i.Index(indexName, obj)
+	if err != nil {
+		return nil, err
+	}
+	typed := make([]T, len(untyped))
+	for i, obj := range untyped {
+		typed[i] = obj.(T)
+	}
+	return typed, nil
+}
+
+func (i typedIndexer[T]) ByTypedIndex(indexName, indexedValue string) ([]T, error) {
+	untyped, err := i.ByIndex(indexName, indexedValue)
+	if err != nil {
+		return nil, err
+	}
+	typed := make([]T, len(untyped))
+	for i, obj := range untyped {
+		typed[i] = obj.(T)
+	}
+	return typed, nil
+}
+
+func (i typedIndexer[T]) AddTypedIndexers(newIndexers TypedIndexers[T]) error {
+	untyped := make(Indexers, len(newIndexers))
+	for i, indexer := range newIndexers {
+		untyped[i] = func(obj any) ([]string, error) {
+			return indexer(obj.(T))
+		}
+	}
+	return i.AddIndexers(untyped)
+}
+
 // NewSharedInformer creates a new instance for the ListerWatcher. See NewSharedIndexInformerWithOptions for full details.
 func NewSharedInformer(lw ListerWatcher, exampleObject runtime.Object, defaultEventHandlerResyncPeriod time.Duration) SharedInformer {
 	return NewSharedIndexInformer(lw, exampleObject, defaultEventHandlerResyncPeriod, Indexers{})
@@ -1014,6 +1136,24 @@ func (s *sharedIndexInformer) RemoveEventHandler(handle ResourceEventHandlerRegi
 	return s.processor.removeListener(handle)
 }
 
+// ShutDownEventHandler removes the event handler and blocks until it has fully
+// stopped processing events.
+//
+// Like RemoveEventHandler, it is idempotent and thread-safe. However, it MUST NOT
+// be called from within the event handler's own callbacks, as that will result
+// in a deadlock.
+func ShutDownEventHandler(informer SharedInformer, handle ResourceEventHandlerRegistration) error {
+	if err := informer.RemoveEventHandler(handle); err != nil {
+		return err
+	}
+	if s, ok := handle.(interface{ ShutdownChan() <-chan struct{} }); ok {
+		<-s.ShutdownChan()
+	} else {
+		return fmt.Errorf("handle does not support ShutdownChan()")
+	}
+	return nil
+}
+
 // sharedProcessor has a collection of processorListener and can
 // distribute a notification object to its listeners.  There are two
 // kinds of distribute operations.  The sync distributions go to a
@@ -1086,6 +1226,8 @@ func (p *sharedProcessor) removeListener(handle ResourceEventHandlerRegistration
 
 	if p.listenersStarted {
 		close(listener.addCh)
+	} else {
+		close(listener.runFinished)
 	}
 
 	return nil
@@ -1209,10 +1351,11 @@ func (p *sharedProcessor) resyncCheckPeriodChanged(logger klog.Logger, resyncChe
 // processorListener also keeps track of the adjusted requested resync
 // period of the listener.
 type processorListener struct {
-	logger klog.Logger
-	nextCh chan interface{}
-	addCh  chan interface{}
-	done   chan struct{}
+	logger      klog.Logger
+	nextCh      chan interface{}
+	addCh       chan interface{}
+	done        chan struct{}
+	runFinished chan struct{}
 
 	handler     ResourceEventHandler
 	handlerName string
@@ -1265,6 +1408,10 @@ func (p *processorListener) HasSyncedChecker() DoneChecker {
 	return p.syncTracker
 }
 
+func (p *processorListener) ShutdownChan() <-chan struct{} {
+	return p.runFinished
+}
+
 func newProcessListener(logger klog.Logger, handler ResourceEventHandler, requestedResyncPeriod, resyncPeriod time.Duration, now time.Time, bufferSize int, hasSynced DoneChecker) *processorListener {
 	handlerName := nameForHandler(handler)
 	ret := &processorListener{
@@ -1272,6 +1419,7 @@ func newProcessListener(logger klog.Logger, handler ResourceEventHandler, reques
 		nextCh:                make(chan interface{}),
 		addCh:                 make(chan interface{}),
 		done:                  make(chan struct{}),
+		runFinished:           make(chan struct{}),
 		upstreamHasSynced:     hasSynced,
 		handler:               handler,
 		handlerName:           handlerName,
@@ -1328,6 +1476,7 @@ func (p *processorListener) pop() {
 }
 
 func (p *processorListener) run() {
+	defer close(p.runFinished)
 	// this call blocks until the channel is closed.  When a panic happens during the notification
 	// we will catch it, **the offending item will be skipped!**, and after a short delay (one second)
 	// the next notification will be attempted. This is usually better than the alternative of never
diff --git a/vendor/k8s.io/client-go/tools/cache/store.go b/vendor/k8s.io/client-go/tools/cache/store.go
index 261ed60d9c..76cb70c569 100644
--- a/vendor/k8s.io/client-go/tools/cache/store.go
+++ b/vendor/k8s.io/client-go/tools/cache/store.go
@@ -402,6 +402,9 @@ func WithTransformer(transformer TransformFunc) StoreOption {
 func WithStoreMetrics(identifier InformerNameAndResource, metrics InformerMetricsProvider) StoreOption {
 	return func(c *cache) {
 		c.identifier = identifier
+		if metrics == nil {
+			metrics = globalInformerMetricsProvider
+		}
 		c.metrics = metrics
 	}
 }
diff --git a/vendor/k8s.io/client-go/tools/clientcmd/api/v1/doc.go b/vendor/k8s.io/client-go/tools/clientcmd/api/v1/doc.go
index 3ccdebc1c3..b5a686a4c1 100644
--- a/vendor/k8s.io/client-go/tools/clientcmd/api/v1/doc.go
+++ b/vendor/k8s.io/client-go/tools/clientcmd/api/v1/doc.go
@@ -17,5 +17,6 @@ limitations under the License.
 // +k8s:conversion-gen=k8s.io/client-go/tools/clientcmd/api
 // +k8s:deepcopy-gen=package
 // +k8s:defaulter-gen=Kind
+// +k8s:validation-gen=false
 
 package v1
diff --git a/vendor/k8s.io/client-go/tools/clientcmd/api/v1/zz_generated.conversion.go b/vendor/k8s.io/client-go/tools/clientcmd/api/v1/zz_generated.conversion.go
index ef1e9b8eb2..f4a48d071e 100644
--- a/vendor/k8s.io/client-go/tools/clientcmd/api/v1/zz_generated.conversion.go
+++ b/vendor/k8s.io/client-go/tools/clientcmd/api/v1/zz_generated.conversion.go
@@ -229,8 +229,7 @@ func Convert_api_AuthInfo_To_v1_AuthInfo(in *api.AuthInfo, out *AuthInfo, s conv
 }
 
 func autoConvert_v1_AuthProviderConfig_To_api_AuthProviderConfig(in *AuthProviderConfig, out *api.AuthProviderConfig, s conversion.Scope) error {
-	out.Name = in.Name
-	out.Config = *(*map[string]string)(unsafe.Pointer(&in.Config))
+	*out = *(*api.AuthProviderConfig)(unsafe.Pointer(in))
 	return nil
 }
 
@@ -240,8 +239,7 @@ func Convert_v1_AuthProviderConfig_To_api_AuthProviderConfig(in *AuthProviderCon
 }
 
 func autoConvert_api_AuthProviderConfig_To_v1_AuthProviderConfig(in *api.AuthProviderConfig, out *AuthProviderConfig, s conversion.Scope) error {
-	out.Name = in.Name
-	out.Config = *(*map[string]string)(unsafe.Pointer(&in.Config))
+	*out = *(*AuthProviderConfig)(unsafe.Pointer(in))
 	return nil
 }
 
@@ -411,8 +409,7 @@ func Convert_api_ExecConfig_To_v1_ExecConfig(in *api.ExecConfig, out *ExecConfig
 }
 
 func autoConvert_v1_ExecEnvVar_To_api_ExecEnvVar(in *ExecEnvVar, out *api.ExecEnvVar, s conversion.Scope) error {
-	out.Name = in.Name
-	out.Value = in.Value
+	*out = *(*api.ExecEnvVar)(unsafe.Pointer(in))
 	return nil
 }
 
@@ -422,8 +419,7 @@ func Convert_v1_ExecEnvVar_To_api_ExecEnvVar(in *ExecEnvVar, out *api.ExecEnvVar
 }
 
 func autoConvert_api_ExecEnvVar_To_v1_ExecEnvVar(in *api.ExecEnvVar, out *ExecEnvVar, s conversion.Scope) error {
-	out.Name = in.Name
-	out.Value = in.Value
+	*out = *(*ExecEnvVar)(unsafe.Pointer(in))
 	return nil
 }
 
diff --git a/vendor/k8s.io/client-go/tools/clientcmd/loader.go b/vendor/k8s.io/client-go/tools/clientcmd/loader.go
index d1d0a82954..e6e35a8abe 100644
--- a/vendor/k8s.io/client-go/tools/clientcmd/loader.go
+++ b/vendor/k8s.io/client-go/tools/clientcmd/loader.go
@@ -300,7 +300,8 @@ func (rules *ClientConfigLoadingRules) Migrate() error {
 			return err
 		}
 
-		if sourceInfo, err := os.Stat(source); err != nil {
+		sourceInfo, err := os.Stat(source)
+		if err != nil {
 			if os.IsNotExist(err) || os.IsPermission(err) {
 				// if the source file doesn't exist or we can't access it, there's no work to do.
 				continue
@@ -316,8 +317,8 @@ func (rules *ClientConfigLoadingRules) Migrate() error {
 		if err != nil {
 			return err
 		}
-		// destination is created with mode 0666 before umask
-		err = os.WriteFile(destination, data, 0666)
+		// destination created with source perm, but never executable, and subject to umask
+		err = os.WriteFile(destination, data, sourceInfo.Mode().Perm()&0666)
 		if err != nil {
 			return err
 		}
@@ -641,7 +642,7 @@ func RelativizePathWithNoBacksteps(refs []*string, base string) error {
 			}
 
 			// if we have a backstep, don't mess with the path
-			if strings.HasPrefix(rel, "../") {
+			if strings.HasPrefix(rel, "../") || strings.HasPrefix(rel, ".."+string(os.PathSeparator)) {
 				if filepath.IsAbs(*ref) {
 					continue
 				}
diff --git a/vendor/k8s.io/client-go/tools/events/event_broadcaster.go b/vendor/k8s.io/client-go/tools/events/event_broadcaster.go
index ff6b2c4fab..0987523205 100644
--- a/vendor/k8s.io/client-go/tools/events/event_broadcaster.go
+++ b/vendor/k8s.io/client-go/tools/events/event_broadcaster.go
@@ -328,7 +328,7 @@ func (e *eventBroadcasterImpl) StartStructuredLogging(verbosity klog.Level) func
 // To adjust verbosity, use the logger's V method (i.e. pass `logger.V(3)` instead of `logger`).
 // The returned function can be ignored or used to stop recording, if desired.
 func (e *eventBroadcasterImpl) StartLogging(logger klog.Logger) (func(), error) {
-	return e.StartEventWatcher(
+	return e.startEventWatcher(logger,
 		func(obj runtime.Object) {
 			event, ok := obj.(*eventsv1.Event)
 			if !ok {
@@ -342,12 +342,16 @@ func (e *eventBroadcasterImpl) StartLogging(logger klog.Logger) (func(), error)
 // StartEventWatcher starts sending events received from this EventBroadcaster to the given event handler function.
 // The return value is used to stop recording
 func (e *eventBroadcasterImpl) StartEventWatcher(eventHandler func(event runtime.Object)) (func(), error) {
+	return e.startEventWatcher(klog.Background(), eventHandler)
+}
+
+func (e *eventBroadcasterImpl) startEventWatcher(logger klog.Logger, eventHandler func(event runtime.Object)) (func(), error) {
 	watcher, err := e.Watch()
 	if err != nil {
 		return nil, err
 	}
 	go func() {
-		defer utilruntime.HandleCrash()
+		defer utilruntime.HandleCrashWithLogger(logger)
 		for {
 			watchEvent, ok := <-watcher.ResultChan()
 			if !ok {
@@ -414,7 +418,7 @@ func NewEventBroadcasterAdapter(client clientset.Interface) EventBroadcasterAdap
 // migration of individual components to the new Event API.
 func NewEventBroadcasterAdapterWithContext(ctx context.Context, client clientset.Interface) EventBroadcasterAdapter {
 	eventClient := &eventBroadcasterAdapterImpl{}
-	if _, err := client.Discovery().ServerResourcesForGroupVersion(eventsv1.SchemeGroupVersion.String()); err == nil {
+	if _, err := client.Discovery().ServerResourcesForGroupVersionWithContext(ctx, eventsv1.SchemeGroupVersion.String()); err == nil {
 		eventClient.eventsv1Client = client.EventsV1()
 		eventClient.eventsv1Broadcaster = NewBroadcaster(&EventSinkImpl{Interface: eventClient.eventsv1Client})
 	}
diff --git a/vendor/k8s.io/client-go/tools/events/event_recorder.go b/vendor/k8s.io/client-go/tools/events/event_recorder.go
index ba2ec7be4e..08fa57d9f5 100644
--- a/vendor/k8s.io/client-go/tools/events/event_recorder.go
+++ b/vendor/k8s.io/client-go/tools/events/event_recorder.go
@@ -41,9 +41,14 @@ type recorderImpl struct {
 }
 
 var _ EventRecorder = &recorderImpl{}
+var _ AnnotatedEventRecorder = &recorderImpl{}
 
 func (recorder *recorderImpl) Eventf(regarding runtime.Object, related runtime.Object, eventtype, reason, action, note string, args ...interface{}) {
-	recorder.eventf(klog.Background(), regarding, related, eventtype, reason, action, note, args...)
+	recorder.eventf(klog.Background(), regarding, related, nil, eventtype, reason, action, note, args...)
+}
+
+func (recorder *recorderImpl) AnnotatedEventf(regarding runtime.Object, related runtime.Object, annotations map[string]string, eventtype, reason, action, note string, args ...interface{}) {
+	recorder.eventf(klog.Background(), regarding, related, annotations, eventtype, reason, action, note, args...)
 }
 
 type recorderImplLogger struct {
@@ -54,14 +59,18 @@ type recorderImplLogger struct {
 var _ EventRecorderLogger = &recorderImplLogger{}
 
 func (recorder *recorderImplLogger) Eventf(regarding runtime.Object, related runtime.Object, eventtype, reason, action, note string, args ...interface{}) {
-	recorder.eventf(recorder.logger, regarding, related, eventtype, reason, action, note, args...)
+	recorder.eventf(recorder.logger, regarding, related, nil, eventtype, reason, action, note, args...)
+}
+
+func (recorder *recorderImplLogger) AnnotatedEventf(regarding runtime.Object, related runtime.Object, annotations map[string]string, eventtype, reason, action, note string, args ...interface{}) {
+	recorder.eventf(recorder.logger, regarding, related, annotations, eventtype, reason, action, note, args...)
 }
 
 func (recorder *recorderImplLogger) WithLogger(logger klog.Logger) EventRecorderLogger {
 	return &recorderImplLogger{recorderImpl: recorder.recorderImpl, logger: logger}
 }
 
-func (recorder *recorderImpl) eventf(logger klog.Logger, regarding runtime.Object, related runtime.Object, eventtype, reason, action, note string, args ...interface{}) {
+func (recorder *recorderImpl) eventf(logger klog.Logger, regarding runtime.Object, related runtime.Object, annotations map[string]string, eventtype, reason, action, note string, args ...interface{}) {
 	timestamp := metav1.MicroTime{Time: time.Now()}
 	message := fmt.Sprintf(note, args...)
 	refRegarding, err := reference.GetReference(recorder.scheme, regarding)
@@ -81,14 +90,14 @@ func (recorder *recorderImpl) eventf(logger klog.Logger, regarding runtime.Objec
 		logger.Error(nil, "Unsupported event type", "eventType", eventtype)
 		return
 	}
-	event := recorder.makeEvent(refRegarding, refRelated, timestamp, eventtype, reason, message, recorder.reportingController, recorder.reportingInstance, action)
+	event := recorder.makeEvent(refRegarding, refRelated, timestamp, annotations, eventtype, reason, message, recorder.reportingController, recorder.reportingInstance, action)
 	go func() {
 		defer utilruntime.HandleCrash()
 		recorder.Action(watch.Added, event)
 	}()
 }
 
-func (recorder *recorderImpl) makeEvent(refRegarding *v1.ObjectReference, refRelated *v1.ObjectReference, timestamp metav1.MicroTime, eventtype, reason, message string, reportingController string, reportingInstance string, action string) *eventsv1.Event {
+func (recorder *recorderImpl) makeEvent(refRegarding *v1.ObjectReference, refRelated *v1.ObjectReference, timestamp metav1.MicroTime, annotations map[string]string, eventtype, reason, message string, reportingController string, reportingInstance string, action string) *eventsv1.Event {
 	t := metav1.Time{Time: recorder.clock.Now()}
 	namespace := refRegarding.Namespace
 	if namespace == "" {
@@ -96,8 +105,9 @@ func (recorder *recorderImpl) makeEvent(refRegarding *v1.ObjectReference, refRel
 	}
 	return &eventsv1.Event{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      util.GenerateEventName(refRegarding.Name, t.UnixNano()),
-			Namespace: namespace,
+			Name:        util.GenerateEventName(refRegarding.Name, t.UnixNano()),
+			Namespace:   namespace,
+			Annotations: annotations,
 		},
 		EventTime:           timestamp,
 		Series:              nil,
diff --git a/vendor/k8s.io/client-go/tools/events/fake.go b/vendor/k8s.io/client-go/tools/events/fake.go
index e26826d6c8..5c1892a766 100644
--- a/vendor/k8s.io/client-go/tools/events/fake.go
+++ b/vendor/k8s.io/client-go/tools/events/fake.go
@@ -27,26 +27,71 @@ import (
 // when created manually and not by NewFakeRecorder, however all events may be
 // thrown away in this case.
 type FakeRecorder struct {
-	Events chan string
+	Events  chan string
+	Verbose bool
 }
 
 var _ EventRecorderLogger = &FakeRecorder{}
+var _ AnnotatedEventRecorder = &FakeRecorder{}
 
 // Eventf emits an event
 func (f *FakeRecorder) Eventf(regarding runtime.Object, related runtime.Object, eventtype, reason, action, note string, args ...interface{}) {
-	if f.Events != nil {
-		f.Events <- fmt.Sprintf(eventtype+" "+reason+" "+note, args...)
-	}
+	f.writeEvent(regarding, related, nil, eventtype, reason, action, note, args...)
+}
+
+// AnnotatedEventf emits an event like Eventf, but with annotations attached
+func (f *FakeRecorder) AnnotatedEventf(regarding runtime.Object, related runtime.Object, annotations map[string]string, eventtype, reason, action, note string, args ...interface{}) {
+	f.writeEvent(regarding, related, annotations, eventtype, reason, action, note, args...)
 }
 
 func (f *FakeRecorder) WithLogger(logger klog.Logger) EventRecorderLogger {
 	return f
 }
 
+// writeEvent constructs a string from the event parameters and sends
+// it to the Events channel
+func (f *FakeRecorder) writeEvent(regarding runtime.Object, related runtime.Object, annotations map[string]string, eventtype, reason, action, note string, args ...interface{}) {
+	if f.Events != nil {
+		msg := fmt.Sprintf(eventtype+" "+reason+" "+note, args...)
+		if f.Verbose {
+			msg = eventtype + " " + reason + " " + action + " " + fmt.Sprintf(note, args...) +
+				objectString(regarding) + objectString(related) + annotationsString(annotations)
+		}
+		f.Events <- msg
+	}
+}
+
+// annotationsString returns a formatted string of the annotations map,
+// or empty string if none
+func annotationsString(annotations map[string]string) string {
+	annotationString := ""
+	if len(annotations) > 0 {
+		annotationString = " " + fmt.Sprint(annotations)
+	}
+	return annotationString
+}
+
+// objectString returns a formatted string with the object's kind and
+// apiVersion
+func objectString(object runtime.Object) string {
+	objectString := ""
+	if object != nil {
+		gvk := object.GetObjectKind().GroupVersionKind()
+		if !gvk.Empty() {
+			objectString = fmt.Sprintf(" {kind=%s,apiVersion=%s}",
+				gvk.Kind,
+				gvk.GroupVersion(),
+			)
+		}
+	}
+	return objectString
+}
+
 // NewFakeRecorder creates new fake event recorder with event channel with
 // buffer of given size.
 func NewFakeRecorder(bufferSize int) *FakeRecorder {
 	return &FakeRecorder{
-		Events: make(chan string, bufferSize),
+		Events:  make(chan string, bufferSize),
+		Verbose: false,
 	}
 }
diff --git a/vendor/k8s.io/client-go/tools/events/interfaces.go b/vendor/k8s.io/client-go/tools/events/interfaces.go
index bb6109f623..209b3c0d51 100644
--- a/vendor/k8s.io/client-go/tools/events/interfaces.go
+++ b/vendor/k8s.io/client-go/tools/events/interfaces.go
@@ -28,6 +28,7 @@ import (
 
 type EventRecorder = internalevents.EventRecorder
 type EventRecorderLogger = internalevents.EventRecorderLogger
+type AnnotatedEventRecorder = internalevents.AnnotatedEventRecorder
 
 // EventBroadcaster knows how to receive events and send them to any EventSink, watcher, or log.
 type EventBroadcaster interface {
diff --git a/vendor/k8s.io/client-go/tools/internal/events/interfaces.go b/vendor/k8s.io/client-go/tools/internal/events/interfaces.go
index be6261b531..50bb4d2e80 100644
--- a/vendor/k8s.io/client-go/tools/internal/events/interfaces.go
+++ b/vendor/k8s.io/client-go/tools/internal/events/interfaces.go
@@ -43,6 +43,15 @@ type EventRecorder interface {
 	Eventf(regarding runtime.Object, related runtime.Object, eventtype, reason, action, note string, args ...interface{})
 }
 
+// AnnotatedEventRecorder is an optional extension of EventRecorder that
+// supports attaching annotations to events at creation time.
+// Annotations are intended for low-frequency correlation metadata, not as a general purpose structured-data channel.
+// Kubernetes events are best-effort, supplemental observability data and may be dropped, deduped or aggregated at any
+// point in pipeline. Do not rely on annotations for event-driven control flow.
+type AnnotatedEventRecorder interface {
+	AnnotatedEventf(regarding runtime.Object, related runtime.Object, annotations map[string]string, eventtype, reason, action, note string, args ...interface{})
+}
+
 // EventRecorderLogger extends EventRecorder such that a logger can
 // be set for methods in EventRecorder. Normally, those methods
 // uses the global default logger to record errors and debug messages.
diff --git a/vendor/k8s.io/client-go/tools/leaderelection/OWNERS b/vendor/k8s.io/client-go/tools/leaderelection/OWNERS
index 70787f2b52..0aa6fd9a44 100644
--- a/vendor/k8s.io/client-go/tools/leaderelection/OWNERS
+++ b/vendor/k8s.io/client-go/tools/leaderelection/OWNERS
@@ -1,13 +1,12 @@
 # See the OWNERS docs at https://go.k8s.io/owners
 
 approvers:
-  - mikedanese
   - jefftree
 reviewers:
   - wojtek-t
   - deads2k
-  - mikedanese
   - ingvagabund
   - jefftree
 emeritus_approvers:
   - timothysc
+  - mikedanese
diff --git a/vendor/k8s.io/client-go/tools/leaderelection/leaderelection.go b/vendor/k8s.io/client-go/tools/leaderelection/leaderelection.go
index 00798d82ac..b4e70a6c7a 100644
--- a/vendor/k8s.io/client-go/tools/leaderelection/leaderelection.go
+++ b/vendor/k8s.io/client-go/tools/leaderelection/leaderelection.go
@@ -312,12 +312,20 @@ func (le *LeaderElector) renew(ctx context.Context) {
 }
 
 // release attempts to release the leader lease if we have acquired it.
+// It retries on conflict, which may occur if the context cancellation
+// races with an inflight renew() operation. The client will see a ctx
+// cancellation error while the apiserver completes the update and bumps
+// the resource version.
 func (le *LeaderElector) release(logger klog.Logger) bool {
-	ctx := context.Background()
+	ctx := klog.NewContext(context.Background(), logger)
 	timeoutCtx, timeoutCancel := context.WithTimeout(ctx, le.config.RenewDeadline)
 	defer timeoutCancel()
-	// update the resourceVersion of lease
-	oldLeaderElectionRecord, _, err := le.config.Lock.Get(timeoutCtx)
+	return le.tryRelease(timeoutCtx)
+}
+
+func (le *LeaderElector) tryRelease(ctx context.Context) bool {
+	logger := klog.FromContext(ctx)
+	oldLeaderElectionRecord, _, err := le.config.Lock.Get(ctx)
 	if err != nil {
 		if !errors.IsNotFound(err) {
 			logger.Error(err, "error retrieving resource lock", "lock", le.config.Lock.Describe())
@@ -337,7 +345,11 @@ func (le *LeaderElector) release(logger klog.Logger) bool {
 		RenewTime:            now,
 		AcquireTime:          now,
 	}
-	if err := le.config.Lock.Update(timeoutCtx, leaderElectionRecord); err != nil {
+	if err := le.config.Lock.Update(ctx, leaderElectionRecord); err != nil {
+		if errors.IsConflict(err) {
+			logger.V(4).Info("Conflict when releasing lease, retrying", "lock", le.config.Lock.Describe())
+			return le.tryRelease(ctx)
+		}
 		logger.Error(err, "Failed to release lease", "lock", le.config.Lock.Describe())
 		return false
 	}
diff --git a/vendor/k8s.io/client-go/tools/leaderelection/resourcelock/multilock.go b/vendor/k8s.io/client-go/tools/leaderelection/resourcelock/multilock.go
index 5ee1dcbb50..e2ba21d37e 100644
--- a/vendor/k8s.io/client-go/tools/leaderelection/resourcelock/multilock.go
+++ b/vendor/k8s.io/client-go/tools/leaderelection/resourcelock/multilock.go
@@ -25,10 +25,14 @@ import (
 )
 
 const (
+	// Deprecated: UnknownLeader is only used by MultiLock, which is deprecated.
 	UnknownLeader = "leaderelection.k8s.io/unknown"
 )
 
-// MultiLock is used for lock's migration
+// Deprecated: MultiLock was used to facilitate migration from non-lease
+// based leader election to lease-based leader election. Support for
+// non-lease locks was removed in Kubernetes 1.28, making MultiLock
+// non-functional. Use LeaseLock directly instead.
 type MultiLock struct {
 	Primary   Interface
 	Secondary Interface
@@ -99,6 +103,7 @@ func (ml *MultiLock) Identity() string {
 	return ml.Primary.Identity()
 }
 
+// Deprecated: ConcatRawRecord is only used by MultiLock, which is deprecated.
 func ConcatRawRecord(primaryRaw, secondaryRaw []byte) []byte {
 	return bytes.Join([][]byte{primaryRaw, secondaryRaw}, []byte(","))
 }
diff --git a/vendor/k8s.io/client-go/tools/metrics/metrics.go b/vendor/k8s.io/client-go/tools/metrics/metrics.go
index 2f626475b2..bac15ae140 100644
--- a/vendor/k8s.io/client-go/tools/metrics/metrics.go
+++ b/vendor/k8s.io/client-go/tools/metrics/metrics.go
@@ -25,7 +25,37 @@ import (
 	"time"
 )
 
-var registerMetrics sync.Once
+var (
+	registerMetrics      sync.Once
+	ensureRegisteredOnce sync.Once
+	// ensureRegisteredFn, if set via RegisterOpts.RegisterFn, is invoked
+	// exactly once before any rest client is constructed. Adapter packages
+	// (e.g. k8s.io/component-base/metrics/prometheus/restclient) install
+	// this callback in their init() so that the actual registration with
+	// legacyregistry — and the metric Create() that reads
+	// feature-gate-derived options like NativeHistograms — happens at
+	// runtime rather than at init() time. See EnsureRegistered for the
+	// caller-side contract.
+	ensureRegisteredFn func()
+)
+
+// EnsureRegistered invokes the callback installed via RegisterOpts.RegisterFn (if
+// any) exactly once. Callers should treat it as idempotent; subsequent calls are
+// effectively free.
+//
+// New public constructors or entry points for packages in client-go that create
+// a REST client, HTTP transport, or credential provider should invoke EnsureRegistered()
+// at the very beginning of the function. Adapter Observe methods
+// also call EnsureRegistered(), so no observations are lost if a constructor
+// forgets to invoke it, but if invoked, the entrypoint call shifts registration from
+// "first-observation" to "first client construction", meaning the metric
+// series is visible to Promteheus scrapes from process startup rather than
+// appearing only after the first request.
+func EnsureRegistered() {
+	if ensureRegisteredFn != nil {
+		ensureRegisteredOnce.Do(ensureRegisteredFn)
+	}
+}
 
 // DurationMetric is a measurement of some amount of time.
 type DurationMetric interface {
@@ -163,6 +193,12 @@ type RegisterOpts struct {
 	TransportCAReloads           TransportCAReloadsMetric
 	TransportCertRotationGCCalls TransportCertRotationGCCallsMetric
 	TransportCacheGCCalls        TransportCacheGCCallsMetric
+
+	// RegisterFn, if non-nil, is invoked exactly once by EnsureRegistered().
+	// before the first rest client is constructed. Adapters use this to defer
+	// registrations that depend on runtime state (eg., feature gates read my metric
+	// Create() without changing the import side contract of the adapter package.)
+	RegisterFn func()
 }
 
 // Register registers metrics for the rest client to use. This can
@@ -197,7 +233,7 @@ func Register(opts RegisterOpts) {
 			ExecPluginCalls = opts.ExecPluginCalls
 		}
 		if opts.ExecPluginPolicyCalls != nil {
-			ExecPluginCalls = opts.ExecPluginCalls
+			ExecPluginPolicyCalls = opts.ExecPluginPolicyCalls
 		}
 		if opts.RequestRetry != nil {
 			RequestRetry = opts.RequestRetry
@@ -217,6 +253,9 @@ func Register(opts RegisterOpts) {
 		if opts.TransportCacheGCCalls != nil {
 			TransportCacheGCCalls = opts.TransportCacheGCCalls
 		}
+		if opts.RegisterFn != nil {
+			ensureRegisteredFn = opts.RegisterFn
+		}
 	})
 }
 
diff --git a/vendor/k8s.io/client-go/tools/pager/pager.go b/vendor/k8s.io/client-go/tools/pager/pager.go
index 3c77cc37fa..500923e28f 100644
--- a/vendor/k8s.io/client-go/tools/pager/pager.go
+++ b/vendor/k8s.io/client-go/tools/pager/pager.go
@@ -219,7 +219,7 @@ func (p *ListPager) eachListChunkBuffered(ctx context.Context, options metav1.Li
 	chunkC := make(chan runtime.Object, p.PageBufferSize)
 	bgResultC := make(chan error, 1)
 	go func() {
-		defer utilruntime.HandleCrash()
+		defer utilruntime.HandleCrashWithContext(ctx)
 
 		var err error
 		defer func() {
diff --git a/vendor/k8s.io/client-go/tools/portforward/fallback_dialer.go b/vendor/k8s.io/client-go/tools/portforward/fallback_dialer.go
index 91f8fad4dd..d5c4582f09 100644
--- a/vendor/k8s.io/client-go/tools/portforward/fallback_dialer.go
+++ b/vendor/k8s.io/client-go/tools/portforward/fallback_dialer.go
@@ -70,6 +70,7 @@ func NewFallbackDialerForStreaming(primary, secondary streamhttp.Dialer, shouldF
 func (f *FallbackDialer) Dial(protocols ...string) (httpstream.Connection, string, error) {
 	conn, version, err := f.primary.Dial(protocols...)
 	if err != nil && f.shouldFallback(err) {
+		//nolint:logcheck // This code is only used by kubectl where contextual logging is not that useful.
 		klog.V(4).Infof("fallback to secondary dialer from primary dialer err: %v", err)
 		return f.secondary.Dial(protocols...)
 	}
@@ -81,6 +82,7 @@ func (f *FallbackDialer) Dial(protocols ...string) (httpstream.Connection, strin
 func (f *StreamingFallbackDialer) Dial(protocols ...string) (streamhttp.Connection, string, error) {
 	conn, version, err := f.primary.Dial(protocols...)
 	if err != nil && f.shouldFallback(err) {
+		//nolint:logcheck // This code is only used by kubectl and E2E testing where contextual logging is not that useful.
 		klog.V(4).Infof("fallback to secondary dialer from primary dialer err: %v", err)
 		return f.secondary.Dial(protocols...)
 	}
diff --git a/vendor/k8s.io/client-go/tools/portforward/portforward.go b/vendor/k8s.io/client-go/tools/portforward/portforward.go
index 11e0df6307..c5795264bf 100644
--- a/vendor/k8s.io/client-go/tools/portforward/portforward.go
+++ b/vendor/k8s.io/client-go/tools/portforward/portforward.go
@@ -17,6 +17,7 @@ limitations under the License.
 package portforward
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"io"
@@ -31,6 +32,7 @@ import (
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/util/httpstream"
 	"k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/klog/v2"
 	streamhttp "k8s.io/streaming/pkg/httpstream"
 	netutils "k8s.io/utils/net"
@@ -55,6 +57,7 @@ type PortForwarder struct {
 	ports     []ForwardedPort
 	stopChan  <-chan struct{}
 
+	logger        klog.Logger
 	dialer        httpstream.Dialer
 	streamConn    httpstream.Connection
 	listeners     []io.Closer
@@ -174,7 +177,14 @@ func NewForStreaming(dialer streamhttp.Dialer, ports []string, stopChan <-chan s
 }
 
 // NewOnAddresses creates a new PortForwarder with custom listen addresses.
+//
+//logcheck:context // NewOnAddressesWithContext should be used instead of NewOnAddresses in code which supports contextual logging.
 func NewOnAddresses(dialer httpstream.Dialer, addresses []string, ports []string, stopChan <-chan struct{}, readyChan chan struct{}, out, errOut io.Writer) (*PortForwarder, error) {
+	return NewOnAddressesWithContext(wait.ContextForChannel(stopChan), dialer, addresses, ports, readyChan, out, errOut)
+}
+
+// NewOnAddressesWithContext creates a new PortForwarder with custom listen addresses.
+func NewOnAddressesWithContext(ctx context.Context, dialer httpstream.Dialer, addresses []string, ports []string, readyChan chan struct{}, out, errOut io.Writer) (*PortForwarder, error) {
 	if len(addresses) == 0 {
 		return nil, errors.New("you must specify at least 1 address")
 	}
@@ -190,10 +200,11 @@ func NewOnAddresses(dialer httpstream.Dialer, addresses []string, ports []string
 		return nil, err
 	}
 	return &PortForwarder{
+		logger:    klog.FromContext(ctx),
 		dialer:    dialer,
 		addresses: parsedAddresses,
 		ports:     parsedPorts,
-		stopChan:  stopChan,
+		stopChan:  ctx.Done(),
 		Ready:     readyChan,
 		out:       out,
 		errOut:    errOut,
@@ -202,11 +213,20 @@ func NewOnAddresses(dialer httpstream.Dialer, addresses []string, ports []string
 
 // NewOnAddressesForStreaming creates a new PortForwarder with custom listen
 // addresses for in-tree callers that use k8s.io/streaming/pkg/httpstream types.
+//
+//logcheck:context // NewOnAddressesForStreamingWithContext should be used instead of NewOnAddressesForStreaming in code which supports contextual logging.
 func NewOnAddressesForStreaming(dialer streamhttp.Dialer, addresses []string, ports []string, stopChan <-chan struct{}, readyChan chan struct{}, out, errOut io.Writer) (*PortForwarder, error) {
-	return NewOnAddresses(&compatDialerAdapter{delegate: dialer}, addresses, ports, stopChan, readyChan, out, errOut)
+	return NewOnAddressesForStreamingWithContext(wait.ContextForChannel(stopChan), dialer, addresses, ports, readyChan, out, errOut)
+}
+
+// NewOnAddressesForStreamingWithContext creates a new PortForwarder with custom listen
+// addresses for in-tree callers that use k8s.io/streaming/pkg/httpstream types.
+func NewOnAddressesForStreamingWithContext(ctx context.Context, dialer streamhttp.Dialer, addresses []string, ports []string, readyChan chan struct{}, out, errOut io.Writer) (*PortForwarder, error) {
+	return NewOnAddressesWithContext(ctx, &compatDialerAdapter{logger: klog.FromContext(ctx), delegate: dialer}, addresses, ports, readyChan, out, errOut)
 }
 
 type compatDialerAdapter struct {
+	logger   klog.Logger
 	delegate streamhttp.Dialer
 }
 
@@ -215,10 +235,11 @@ func (d *compatDialerAdapter) Dial(protocols ...string) (httpstream.Connection,
 	if err != nil {
 		return nil, "", err
 	}
-	return &compatConnectionAdapter{delegate: conn}, protocol, nil
+	return &compatConnectionAdapter{logger: d.logger, delegate: conn}, protocol, nil
 }
 
 type compatConnectionAdapter struct {
+	logger   klog.Logger
 	delegate streamhttp.Connection
 }
 
@@ -256,7 +277,7 @@ func (c *compatConnectionAdapter) RemoveStreams(streams ...httpstream.Stream) {
 			streamingStreams = append(streamingStreams, s)
 			continue
 		}
-		klog.V(5).Infof("dropping unadaptable stream %T in portforward RemoveStreams", stream)
+		c.logger.V(5).Info("dropping unadaptable stream in portforward RemoveStreams", "streamType", fmt.Sprintf("%T", stream))
 	}
 	c.delegate.RemoveStreams(streamingStreams...)
 }
@@ -417,7 +438,7 @@ func (pf *PortForwarder) waitForConnection(listener net.Listener, port Forwarded
 			if err != nil {
 				// TODO consider using something like https://github.com/hydrogen18/stoppableListener?
 				if !strings.Contains(strings.ToLower(err.Error()), networkClosedError) {
-					runtime.HandleError(fmt.Errorf("error accepting connection on port %d: %v", port.Local, err))
+					runtime.HandleErrorWithLogger(pf.logger, err, "Error accepting connection", "localPort", port.Local)
 				}
 				return
 			}
@@ -452,21 +473,23 @@ func (pf *PortForwarder) handleConnection(conn net.Conn, port ForwardedPort) {
 	headers.Set(v1.PortForwardRequestIDHeader, strconv.Itoa(requestID))
 	errorStream, err := pf.streamConn.CreateStream(headers)
 	if err != nil {
-		runtime.HandleError(fmt.Errorf("error creating error stream for port %d -> %d: %v", port.Local, port.Remote, err))
+		runtime.HandleErrorWithLogger(pf.logger, err, "Error creating error stream", "localPort", port.Local, "remotePort", port.Remote)
 		return
 	}
 	// we're not writing to this stream
 	errorStream.Close()
 	defer pf.streamConn.RemoveStreams(errorStream)
 
-	errorChan := make(chan error)
+	type readAllResult struct {
+		message []byte
+		err     error
+	}
+	errorChan := make(chan readAllResult)
 	go func() {
 		message, err := io.ReadAll(errorStream)
-		switch {
-		case err != nil:
-			errorChan <- fmt.Errorf("error reading from error stream for port %d -> %d: %v", port.Local, port.Remote, err)
-		case len(message) > 0:
-			errorChan <- fmt.Errorf("an error occurred forwarding %d -> %d: %v", port.Local, port.Remote, string(message))
+		errorChan <- readAllResult{
+			message: message,
+			err:     err,
 		}
 		close(errorChan)
 	}()
@@ -475,7 +498,7 @@ func (pf *PortForwarder) handleConnection(conn net.Conn, port ForwardedPort) {
 	headers.Set(v1.StreamType, v1.StreamTypeData)
 	dataStream, err := pf.streamConn.CreateStream(headers)
 	if err != nil {
-		runtime.HandleError(fmt.Errorf("error creating forwarding stream for port %d -> %d: %v", port.Local, port.Remote, err))
+		runtime.HandleErrorWithLogger(pf.logger, err, "Error creating forwarding stream", "localPort", port.Local, "remotePort", port.Remote)
 		return
 	}
 	defer pf.streamConn.RemoveStreams(dataStream)
@@ -486,7 +509,7 @@ func (pf *PortForwarder) handleConnection(conn net.Conn, port ForwardedPort) {
 	go func() {
 		// Copy from the remote side to the local port.
 		if _, err := io.Copy(conn, dataStream); err != nil && !strings.Contains(strings.ToLower(err.Error()), networkClosedError) {
-			runtime.HandleError(fmt.Errorf("error copying from remote stream to local connection: %v", err))
+			runtime.HandleErrorWithLogger(pf.logger, err, "Error copying from remote stream to local connection", "localPort", port.Local, "remotePort", port.Remote)
 		}
 
 		// inform the select below that the remote copy is done
@@ -499,7 +522,7 @@ func (pf *PortForwarder) handleConnection(conn net.Conn, port ForwardedPort) {
 
 		// Copy from the local port to the remote side.
 		if _, err := io.Copy(dataStream, conn); err != nil && !strings.Contains(strings.ToLower(err.Error()), networkClosedError) {
-			runtime.HandleError(fmt.Errorf("error copying from local connection to remote stream: %v", err))
+			runtime.HandleErrorWithLogger(pf.logger, err, "Error copying from local connection to remote stream", "localPort", port.Local, "remotePort", port.Remote)
 			// break out of the select below without waiting for the other copy to finish
 			close(localError)
 		}
@@ -516,10 +539,14 @@ func (pf *PortForwarder) handleConnection(conn net.Conn, port ForwardedPort) {
 	// the blocking data will affect errorStream and cause <-errorChan to block indefinitely.
 	_ = dataStream.Reset()
 
-	// always expect something on errorChan (it may be nil)
-	err = <-errorChan
-	if err != nil {
-		runtime.HandleError(err)
+	// always expect something on errorChan (it may be empty)
+	errResult := <-errorChan
+	switch {
+	case errResult.err != nil:
+		runtime.HandleErrorWithLogger(pf.logger, errResult.err, "Error reading from error stream", "localPort", port.Local, "remotePort", port.Remote)
+		pf.streamConn.Close()
+	case len(errResult.message) > 0:
+		runtime.HandleErrorWithLogger(pf.logger, errors.New(string(errResult.message)), "An error occurred forwarding", "localPort", port.Local, "remotePort", port.Remote)
 		pf.streamConn.Close()
 	}
 }
@@ -529,7 +556,7 @@ func (pf *PortForwarder) Close() {
 	// stop all listeners
 	for _, l := range pf.listeners {
 		if err := l.Close(); err != nil {
-			runtime.HandleError(fmt.Errorf("error closing listener: %v", err))
+			runtime.HandleErrorWithLogger(pf.logger, err, "Error closing listener")
 		}
 	}
 }
diff --git a/vendor/k8s.io/client-go/tools/portforward/tunneling_connection.go b/vendor/k8s.io/client-go/tools/portforward/tunneling_connection.go
index a9c9b18fd6..b903069196 100644
--- a/vendor/k8s.io/client-go/tools/portforward/tunneling_connection.go
+++ b/vendor/k8s.io/client-go/tools/portforward/tunneling_connection.go
@@ -34,7 +34,7 @@ var _ net.Conn = &TunnelingConnection{}
 // TunnelingConnection implements the "httpstream.Connection" interface, wrapping
 // a websocket connection that tunnels SPDY.
 type TunnelingConnection struct {
-	name              string
+	logger            klog.Logger
 	conn              *gwebsocket.Conn
 	inProgressMessage io.Reader
 	closeOnce         sync.Once
@@ -42,29 +42,46 @@ type TunnelingConnection struct {
 
 // NewTunnelingConnection wraps the passed gorilla/websockets connection
 // with the TunnelingConnection struct (implementing net.Conn).
+// The name is added to all log entries with [klog.LoggerWithName].
+//
+//logcheck:context // NewTunnelingConnectionWithLogger should be used instead of NewTunnelingConnection in code which supports contextual logging.
 func NewTunnelingConnection(name string, conn *gwebsocket.Conn) *TunnelingConnection {
+	logger := klog.LoggerWithName(klog.Background(), name)
+	return NewTunnelingConnectionWithLogger(logger, conn)
+}
+
+// NewTunnelingConnectionWithLogger is a variant of NewTunnelingConnection where
+// the caller is in control of logging. For example, [klog.LoggerWithName] can be used
+// to add a common name for all log entries to identify the connection.
+func NewTunnelingConnectionWithLogger(logger klog.Logger, conn *gwebsocket.Conn) *TunnelingConnection {
 	return &TunnelingConnection{
-		name: name,
-		conn: conn,
+		logger: logger,
+		conn:   conn,
 	}
 }
 
 // Read implements "io.Reader" interface, reading from the stored connection
 // into the passed buffer "p". Returns the number of bytes read and an error.
 // Can keep track of the "inProgress" messsage from the tunneled connection.
-func (c *TunnelingConnection) Read(p []byte) (int, error) {
-	klog.V(7).Infof("%s: tunneling connection read...", c.name)
-	defer klog.V(7).Infof("%s: tunneling connection read...complete", c.name)
+func (c *TunnelingConnection) Read(p []byte) (len int, err error) {
+	c.logger.V(7).Info("Tunneling connection read...")
+	defer func() {
+		if loggerV := c.logger.V(8); loggerV.Enabled() {
+			loggerV.Info("Tunneling connection read...complete", "length", len, "data", p[:len], "err", err)
+		} else {
+			c.logger.V(7).Info("Tunneling connection read...complete")
+		}
+	}()
 	for {
 		if c.inProgressMessage == nil {
-			klog.V(8).Infof("%s: tunneling connection read before NextReader()...", c.name)
+			c.logger.V(8).Info("Tunneling connection read before NextReader()...")
 			messageType, nextReader, err := c.conn.NextReader()
 			if err != nil {
 				closeError := &gwebsocket.CloseError{}
 				if errors.As(err, &closeError) && closeError.Code == gwebsocket.CloseNormalClosure {
 					return 0, io.EOF
 				}
-				klog.V(4).Infof("%s:tunneling connection NextReader() error: %v", c.name, err)
+				c.logger.V(4).Info("Tunneling connection NextReader() failed", "err", err)
 				return 0, err
 			}
 			if messageType != gwebsocket.BinaryMessage {
@@ -72,12 +89,11 @@ func (c *TunnelingConnection) Read(p []byte) (int, error) {
 			}
 			c.inProgressMessage = nextReader
 		}
-		klog.V(8).Infof("%s: tunneling connection read in progress message...", c.name)
+		c.logger.V(8).Info("Tunneling connection read in progress...")
 		i, err := c.inProgressMessage.Read(p)
 		if i == 0 && err == io.EOF {
 			c.inProgressMessage = nil
 		} else {
-			klog.V(8).Infof("%s: read %d bytes, error=%v, bytes=% X", c.name, i, err, p[:i])
 			return i, err
 		}
 	}
@@ -87,8 +103,8 @@ func (c *TunnelingConnection) Read(p []byte) (int, error) {
 // byte array "p" into the stored tunneled connection. Returns the number
 // of bytes written and an error.
 func (c *TunnelingConnection) Write(p []byte) (n int, err error) {
-	klog.V(7).Infof("%s: write: %d bytes, bytes=% X", c.name, len(p), p)
-	defer klog.V(7).Infof("%s: tunneling connection write...complete", c.name)
+	c.logger.V(7).Info("Tunneling connection write", "length", len(p), "data", p)
+	defer c.logger.V(7).Info("Tunneling connection write...complete")
 	w, err := c.conn.NextWriter(gwebsocket.BinaryMessage)
 	if err != nil {
 		return 0, err
@@ -111,7 +127,7 @@ func (c *TunnelingConnection) Write(p []byte) (n int, err error) {
 func (c *TunnelingConnection) Close() error {
 	var err error
 	c.closeOnce.Do(func() {
-		klog.V(7).Infof("%s: tunneling connection Close()...", c.name)
+		c.logger.V(7).Info("Tunneling connection Close()...")
 		// Signal other endpoint that websocket connection is closing; ignore error.
 		normalCloseMsg := gwebsocket.FormatCloseMessage(gwebsocket.CloseNormalClosure, "")
 		writeControlErr := c.conn.WriteControl(gwebsocket.CloseMessage, normalCloseMsg, time.Now().Add(time.Second))
diff --git a/vendor/k8s.io/client-go/tools/portforward/tunneling_dialer.go b/vendor/k8s.io/client-go/tools/portforward/tunneling_dialer.go
index cc9352bfea..f19696dd7c 100644
--- a/vendor/k8s.io/client-go/tools/portforward/tunneling_dialer.go
+++ b/vendor/k8s.io/client-go/tools/portforward/tunneling_dialer.go
@@ -17,6 +17,7 @@ limitations under the License.
 package portforward
 
 import (
+	"context"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -37,6 +38,7 @@ const PingPeriod = 10 * time.Second
 
 // tunnelingDialer implements "httpstream.Dial" interface
 type tunnelingDialer struct {
+	logger    klog.Logger
 	url       *url.URL
 	transport http.RoundTripper
 	holder    websocket.ConnectionHolder
@@ -45,6 +47,7 @@ type tunnelingDialer struct {
 // streamingTunnelingDialer implements "k8s.io/streaming/pkg/httpstream.Dialer"
 // for in-tree callers.
 type streamingTunnelingDialer struct {
+	logger    klog.Logger
 	url       *url.URL
 	transport http.RoundTripper
 	holder    websocket.ConnectionHolder
@@ -53,12 +56,22 @@ type streamingTunnelingDialer struct {
 // NewTunnelingDialer creates and returns the tunnelingDialer structure which implemements the "httpstream.Dialer"
 // interface. The dialer can upgrade a websocket request, creating a websocket connection. This function
 // returns an error if one occurs.
+//
+//logcheck:context // NewSPDYOverWebsocketDialerWithLogger should be used instead of NewSPDYOverWebsocketDialer in code which supports contextual logging.
 func NewSPDYOverWebsocketDialer(url *url.URL, config *restclient.Config) (httpstream.Dialer, error) {
+	return NewSPDYOverWebsocketDialerWithLogger(klog.Background(), url, config)
+}
+
+// NewTunnelingDialer creates and returns the tunnelingDialer structure which implemements the "httpstream.Dialer"
+// interface. The dialer can upgrade a websocket request, creating a websocket connection. This function
+// returns an error if one occurs.
+func NewSPDYOverWebsocketDialerWithLogger(logger klog.Logger, url *url.URL, config *restclient.Config) (httpstream.Dialer, error) {
 	transport, holder, err := websocket.RoundTripperFor(config)
 	if err != nil {
 		return nil, err
 	}
 	return &tunnelingDialer{
+		logger:    logger,
 		url:       url,
 		transport: transport,
 		holder:    holder,
@@ -67,22 +80,33 @@ func NewSPDYOverWebsocketDialer(url *url.URL, config *restclient.Config) (httpst
 
 // NewSPDYOverWebsocketDialerForStreaming creates a SPDY-over-websocket dialer
 // for in-tree callers that use k8s.io/streaming/pkg/httpstream types.
+//
+//logcheck:context // NewSPDYOverWebsocketDialerForStreamingWithLogger should be used instead of NewSPDYOverWebsocketDialerForStreaming in code which supports contextual logging.
 func NewSPDYOverWebsocketDialerForStreaming(url *url.URL, config *restclient.Config) (streamhttp.Dialer, error) {
+	return NewSPDYOverWebsocketDialerForStreamingWithLogger(klog.Background(), url, config)
+}
+
+// NewSPDYOverWebsocketDialerForStreamingWithLogger creates a SPDY-over-websocket dialer
+// for in-tree callers that use k8s.io/streaming/pkg/httpstream types.
+func NewSPDYOverWebsocketDialerForStreamingWithLogger(logger klog.Logger, url *url.URL, config *restclient.Config) (streamhttp.Dialer, error) {
 	transport, holder, err := websocket.RoundTripperFor(config)
 	if err != nil {
 		return nil, err
 	}
 	return &streamingTunnelingDialer{
+		logger:    logger,
 		url:       url,
 		transport: transport,
 		holder:    holder,
 	}, nil
 }
 
-func negotiateSPDYOverWebsocket(url *url.URL, transport http.RoundTripper, holder websocket.ConnectionHolder, protocols ...string) (*TunnelingConnection, string, error) {
-	// There is no passed context, so skip the context when creating request for now.
+func negotiateSPDYOverWebsocket(logger klog.Logger, url *url.URL, transport http.RoundTripper, holder websocket.ConnectionHolder, protocols ...string) (*TunnelingConnection, string, error) {
+	// There is no passed context, so use the background context when creating request for now.
+	ctx := klog.NewContext(context.Background(), logger)
+
 	// Websockets requires "GET" method: RFC 6455 Sec. 4.1 (page 17).
-	req, err := http.NewRequest("GET", url.String(), nil)
+	req, err := http.NewRequestWithContext(ctx, "GET", url.String(), nil)
 	if err != nil {
 		return nil, "", err
 	}
@@ -93,7 +117,7 @@ func negotiateSPDYOverWebsocket(url *url.URL, transport http.RoundTripper, holde
 		tunnelingProtocol := constants.WebsocketsSPDYTunnelingPrefix + protocol
 		tunnelingProtocols = append(tunnelingProtocols, tunnelingProtocol)
 	}
-	klog.V(4).Infoln("Before WebSocket Upgrade Connection...")
+	logger.V(4).Info("Before WebSocket Upgrade Connection...")
 	conn, err := websocket.Negotiate(transport, holder, req, tunnelingProtocols...)
 	if err != nil {
 		return nil, "", err
@@ -103,16 +127,16 @@ func negotiateSPDYOverWebsocket(url *url.URL, transport http.RoundTripper, holde
 	}
 	protocol := conn.Subprotocol()
 	protocol = strings.TrimPrefix(protocol, constants.WebsocketsSPDYTunnelingPrefix)
-	klog.V(4).Infof("negotiated protocol: %s", protocol)
+	logger.V(4).Info("Negotiation complete", "protocol", protocol)
 
-	return NewTunnelingConnection("client", conn), protocol, nil
+	return NewTunnelingConnectionWithLogger(klog.LoggerWithName(logger, "client"), conn), protocol, nil
 }
 
 // Dial upgrades to a tunneling streaming connection, returning a SPDY connection
 // containing a WebSockets connection (which implements "net.Conn"). Also
 // returns the protocol negotiated, or an error.
 func (d *tunnelingDialer) Dial(protocols ...string) (httpstream.Connection, string, error) {
-	tConn, protocol, err := negotiateSPDYOverWebsocket(d.url, d.transport, d.holder, protocols...)
+	tConn, protocol, err := negotiateSPDYOverWebsocket(d.logger, d.url, d.transport, d.holder, protocols...)
 	if err != nil {
 		return nil, "", err
 	}
@@ -125,7 +149,7 @@ func (d *tunnelingDialer) Dial(protocols ...string) (httpstream.Connection, stri
 // Dial upgrades to a tunneling streaming connection for callers using
 // k8s.io/streaming/pkg/httpstream types.
 func (d *streamingTunnelingDialer) Dial(protocols ...string) (streamhttp.Connection, string, error) {
-	tConn, protocol, err := negotiateSPDYOverWebsocket(d.url, d.transport, d.holder, protocols...)
+	tConn, protocol, err := negotiateSPDYOverWebsocket(d.logger, d.url, d.transport, d.holder, protocols...)
 	if err != nil {
 		return nil, "", err
 	}
diff --git a/vendor/k8s.io/client-go/tools/record/event.go b/vendor/k8s.io/client-go/tools/record/event.go
index 305a924388..8f8e3ebf78 100644
--- a/vendor/k8s.io/client-go/tools/record/event.go
+++ b/vendor/k8s.io/client-go/tools/record/event.go
@@ -176,6 +176,12 @@ func (a *EventRecorderAdapter) Eventf(regarding, _ runtime.Object, eventtype, re
 	a.recorder.Eventf(regarding, eventtype, reason, note, args...)
 }
 
+// AnnotatedEventf is a wrapper around v1 AnnotatedEventf
+func (a *EventRecorderAdapter) AnnotatedEventf(regarding, _ runtime.Object, annotations map[string]string, eventtype, reason, action, note string, args ...interface{}) {
+	//nolint:forbidigo // Legacy usage
+	a.recorder.AnnotatedEventf(regarding, annotations, eventtype, reason, note, args...)
+}
+
 func (a *EventRecorderAdapter) WithLogger(logger klog.Logger) internalevents.EventRecorderLogger {
 	return &EventRecorderAdapter{
 		recorder: a.recorder.WithLogger(logger),
@@ -292,7 +298,7 @@ func (e *eventBroadcasterImpl) recordToSink(sink EventSink, event *v1.Event, eve
 	event = &eventCopy
 	result, err := eventCorrelator.EventCorrelate(event)
 	if err != nil {
-		utilruntime.HandleError(err)
+		utilruntime.HandleErrorWithContext(e.cancelationCtx, err, "Event correlation failed")
 	}
 	if result.Skip {
 		return
@@ -402,7 +408,7 @@ func (e *eventBroadcasterImpl) StartEventWatcher(eventHandler func(*v1.Event)) w
 		return watch.NewEmptyWatch()
 	}
 	go func() {
-		defer utilruntime.HandleCrash()
+		defer utilruntime.HandleCrashWithContext(e.cancelationCtx)
 		for {
 			select {
 			case <-e.cancelationCtx.Done():
diff --git a/vendor/k8s.io/client-go/tools/record/events_cache.go b/vendor/k8s.io/client-go/tools/record/events_cache.go
index 9eae6971c1..4b87383011 100644
--- a/vendor/k8s.io/client-go/tools/record/events_cache.go
+++ b/vendor/k8s.io/client-go/tools/record/events_cache.go
@@ -48,7 +48,7 @@ const (
 	defaultSpamQPS   = 1. / 300.
 )
 
-// getEventKey builds unique event key based on source, involvedObject, reason, message
+// getEventKey builds unique event key based on source, involvedObject, reason, message.
 func getEventKey(event *v1.Event) string {
 	return strings.Join([]string{
 		event.Source.Component,
@@ -66,7 +66,7 @@ func getEventKey(event *v1.Event) string {
 		"")
 }
 
-// getSpamKey builds unique event key based on source, involvedObject
+// getSpamKey builds unique event key based on source, involvedObject.
 func getSpamKey(event *v1.Event) string {
 	return strings.Join([]string{
 		event.Source.Component,
@@ -124,6 +124,7 @@ type spamRecord struct {
 }
 
 // Filter controls that a given source+object are not exceeding the allowed rate.
+// The event parameter must not be nil.
 func (f *EventSourceObjectSpamFilter) Filter(event *v1.Event) bool {
 	var record spamRecord
 
@@ -157,7 +158,8 @@ func (f *EventSourceObjectSpamFilter) Filter(event *v1.Event) bool {
 type EventAggregatorKeyFunc func(event *v1.Event) (aggregateKey string, localKey string)
 
 // EventAggregatorByReasonFunc aggregates events by exact match on event.Source, event.InvolvedObject, event.Type,
-// event.Reason, event.ReportingController and event.ReportingInstance
+// event.Reason, event.ReportingController and event.ReportingInstance.
+// The event parameter must not be nil.
 func EventAggregatorByReasonFunc(event *v1.Event) (string, string) {
 	return strings.Join([]string{
 		event.Source.Component,
@@ -235,6 +237,8 @@ type aggregateRecord struct {
 //   - The cache key for the event, for correlation purposes. This will be set to
 //     the full key for normal events, and to the result of
 //     EventAggregatorMessageFunc for aggregate events.
+//
+// The newEvent parameter must not be nil.
 func (e *EventAggregator) EventAggregate(newEvent *v1.Event) (*v1.Event, string) {
 	now := metav1.NewTime(e.clock.Now())
 	var record aggregateRecord
@@ -515,7 +519,8 @@ func (c *EventCorrelator) EventCorrelate(newEvent *v1.Event) (*EventCorrelateRes
 	return &EventCorrelateResult{Event: observedEvent, Patch: patch}, err
 }
 
-// UpdateState based on the latest observed state from server
+// UpdateState based on the latest observed state from server.
+// The event parameter must not be nil.
 func (c *EventCorrelator) UpdateState(event *v1.Event) {
 	c.logger.updateState(event)
 }
diff --git a/vendor/k8s.io/client-go/transport/OWNERS b/vendor/k8s.io/client-go/transport/OWNERS
index 34adee5ec5..17c96a91ef 100644
--- a/vendor/k8s.io/client-go/transport/OWNERS
+++ b/vendor/k8s.io/client-go/transport/OWNERS
@@ -5,4 +5,3 @@ reviewers:
   - wojtek-t
   - deads2k
   - liggitt
-  - caesarxuchao
diff --git a/vendor/k8s.io/client-go/transport/spdy/spdy.go b/vendor/k8s.io/client-go/transport/spdy/spdy.go
index 3bb04b77f3..9c6f07b2de 100644
--- a/vendor/k8s.io/client-go/transport/spdy/spdy.go
+++ b/vendor/k8s.io/client-go/transport/spdy/spdy.go
@@ -220,6 +220,7 @@ func (c *streamingConnectionAdapter) RemoveStreams(streams ...streamhttp.Stream)
 			compatStreams = append(compatStreams, s)
 			continue
 		}
+		//nolint:logcheck // Extending the httpstream.Connection API is not worth it for contextual, structured logging of this.
 		klog.V(5).Infof("dropping unadaptable streaming stream %T in RemoveStreams", stream)
 	}
 	c.delegate.RemoveStreams(compatStreams...)
@@ -301,6 +302,7 @@ func (c *compatConnectionAdapter) RemoveStreams(streams ...httpstream.Stream) {
 			streamingStreams = append(streamingStreams, s)
 			continue
 		}
+		//nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this.
 		klog.V(5).Infof("dropping unadaptable compat stream %T in RemoveStreams", stream)
 	}
 	c.delegate.RemoveStreams(streamingStreams...)
diff --git a/vendor/k8s.io/client-go/transport/transport.go b/vendor/k8s.io/client-go/transport/transport.go
index be97b76210..c4595da308 100644
--- a/vendor/k8s.io/client-go/transport/transport.go
+++ b/vendor/k8s.io/client-go/transport/transport.go
@@ -29,12 +29,14 @@ import (
 
 	utilnet "k8s.io/apimachinery/pkg/util/net"
 	clientgofeaturegate "k8s.io/client-go/features"
+	"k8s.io/client-go/tools/metrics"
 	"k8s.io/klog/v2"
 )
 
 // New returns an http.RoundTripper that will provide the authentication
 // or transport level security defined by the provided Config.
 func New(config *Config) (http.RoundTripper, error) {
+	metrics.EnsureRegistered()
 	// Set transport level security
 	if config.Transport != nil && (config.HasCA() || config.HasCertAuth() || config.HasCertCallback() || config.TLS.Insecure) {
 		return nil, fmt.Errorf("using a custom transport with TLS certificate options or the insecure flag is not allowed")
diff --git a/vendor/k8s.io/client-go/util/consistencydetector/data_consistency_detector.go b/vendor/k8s.io/client-go/util/consistencydetector/data_consistency_detector.go
index 72c0124a0f..d46c429e75 100644
--- a/vendor/k8s.io/client-go/util/consistencydetector/data_consistency_detector.go
+++ b/vendor/k8s.io/client-go/util/consistencydetector/data_consistency_detector.go
@@ -66,12 +66,19 @@ type TransformFunc func(interface{}) (interface{}, error)
 // it is guarded by an environmental variable.
 // we cannot manipulate the environmental variable because
 // it will affect other tests in this package.
+//
+// The identity string can be left empty if the logger in the context already
+// identifies what is being watched.
 func CheckDataConsistency[T runtime.Object, U any](ctx context.Context, identity string, lastSyncedResourceVersion string, listFn ListFunc[T], listItemTransformFunc TransformFunc, listOptions metav1.ListOptions, retrieveItemsFn RetrieveItemsFunc[U]) {
+	logger := klog.FromContext(ctx)
+	if identity != "" {
+		logger = klog.LoggerWithName(logger, identity)
+	}
 	if !canFormAdditionalListCall(lastSyncedResourceVersion, listOptions) {
-		klog.V(4).Infof("data consistency check for %s is enabled but the parameters (RV, ListOptions) doesn't allow for creating a valid LIST request. Skipping the data consistency check.", identity)
+		logger.V(4).Info("Data consistency check is enabled but the parameters (RV, ListOptions) doesn't allow for creating a valid LIST request. Skipping the data consistency check.")
 		return
 	}
-	klog.Warningf("data consistency check for %s is enabled, this will result in an additional call to the API server.", identity)
+	logger.Info("Warning: data consistency check is enabled, this will result in an additional call to the API server.")
 
 	retrievedItems := toMetaObjectSliceOrDie(retrieveItemsFn())
 	listOptions = prepareListCallOptions(lastSyncedResourceVersion, listOptions, len(retrievedItems))
@@ -82,13 +89,13 @@ func CheckDataConsistency[T runtime.Object, U any](ctx context.Context, identity
 			// the consistency check will only be enabled in the CI
 			// and LIST calls in general will be retired by the client-go library
 			// if we fail simply log and retry
-			klog.Errorf("failed to list data from the server, retrying until stopCh is closed, err: %v", err)
+			logger.Info("Failed to list data from the server, retrying until context is canceled", "err", err)
 			return false, nil
 		}
 		return true, nil
 	})
 	if err != nil {
-		klog.Errorf("failed to list data from the server, the data consistency check for %s won't be performed, stopCh was closed, err: %v", identity, err)
+		logger.Error(err, "Failed to list data from the server, the data consistency check won't be performed, stopCh was closed")
 		return
 	}
 
@@ -111,7 +118,7 @@ func CheckDataConsistency[T runtime.Object, U any](ctx context.Context, identity
 	sort.Sort(byUID(retrievedItems))
 
 	if !reflect.DeepEqual(listItems, retrievedItems) {
-		klog.Infof("previously received data for %s is different than received by the standard list api call against etcd, diff: %v", identity, diff.Diff(listItems, retrievedItems))
+		logger.Info("Previously received data is different than received by the standard list api call against etcd", "diff", diff.Diff(listItems, retrievedItems))
 		msg := fmt.Sprintf("data inconsistency detected for %s, panicking!", identity)
 		panic(msg)
 	}
diff --git a/vendor/k8s.io/client-go/util/retry/util.go b/vendor/k8s.io/client-go/util/retry/util.go
index 57d3cd49c1..fd2a959ec6 100644
--- a/vendor/k8s.io/client-go/util/retry/util.go
+++ b/vendor/k8s.io/client-go/util/retry/util.go
@@ -59,7 +59,7 @@ func OnError(backoff wait.Backoff, retriable func(error) bool, fn func() error)
 			return false, err
 		}
 	})
-	if wait.Interrupted(err) {
+	if wait.Interrupted(err) && lastErr != nil {
 		err = lastErr
 	}
 	return err
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/serialization.go b/vendor/k8s.io/kube-openapi/pkg/internal/serialization.go
index 7393bacf70..5d8ee9aa41 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/serialization.go
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/serialization.go
@@ -24,7 +24,7 @@ import (
 // DeterministicMarshal calls the jsonv2 library with the deterministic
 // flag in order to have stable marshaling.
 func DeterministicMarshal(in any) ([]byte, error) {
-	return jsonv2.MarshalOptions{Deterministic: true}.Marshal(jsonv2.EncodeOptions{}, in)
+	return jsonv2.Marshal(in, jsonv2.Deterministic(true))
 }
 
 // JSONRefFromMap populates a json reference object if the map v contains a $ref key.
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/README.md b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/README.md
index 0349adf69d..937c398005 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/README.md
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/README.md
@@ -7,17 +7,24 @@ This module hosts an experimental implementation of v2 `encoding/json`.
 The API is unstable and breaking changes will regularly be made.
 Do not depend on this in publicly available modules.
 
+Any commits that make breaking API or behavior changes will be marked
+with the string "WARNING: " near the top of the commit message.
+It is your responsibility to inspect the list of commit changes
+when upgrading the module. Not all breaking changes will lead to build failures.
+
+A [proposal to include this module in Go as `encoding/json/v2` and `encoding/json/jsontext`](https://github.com/golang/go/issues/71497) has been started on the Go Github project on 2025-01-30. Please provide your feedback there.
+
 ## Goals and objectives
 
 * **Mostly backwards compatible:** If possible, v2 should aim to be _mostly_
 compatible with v1 in terms of both API and default behavior to ease migration.
 For example, the `Marshal` and `Unmarshal` functions are the most widely used
 declarations in the v1 package. It seems sensible for equivalent functionality
-in v2 to be named the same and have the same signature.
+in v2 to be named the same and have a mostly compatible signature.
 Behaviorally, we should aim for 95% to 99% backwards compatibility.
 We do not aim for 100% compatibility since we want the freedom to break
 certain behaviors that are now considered to have been a mistake.
-We may provide options that can bring the v2 implementation to 100% compatibility,
+Options exist that can bring the v2 implementation to 100% compatibility,
 but it will not be the default.
 
 * **More flexible:** There is a
@@ -96,26 +103,32 @@ Syntax deals with the structural representation of JSON (as specified in
 Semantics deals with the meaning of syntactic data as usable application data.
 
 The `Encoder` and `Decoder` types are streaming tokenizers concerned with the
-packing or parsing of JSON data. They operate on `Token` and `RawValue` types
+packing or parsing of JSON data. They operate on `Token` and `Value` types
 which represent the common data structures that are representable in JSON.
 `Encoder` and `Decoder` do not aim to provide any interpretation of the data.
 
-Functions like `Marshal`, `MarshalFull`, `MarshalNext`, `Unmarshal`,
-`UnmarshalFull`, and `UnmarshalNext` provide semantic meaning by correlating
+Functions like `Marshal`, `MarshalWrite`, `MarshalEncode`, `Unmarshal`,
+`UnmarshalRead`, and `UnmarshalDecode` provide semantic meaning by correlating
 any arbitrary Go type with some JSON representation of that type (as stored in
 data types like `[]byte`, `io.Writer`, `io.Reader`, `Encoder`, or `Decoder`).
 
 ![API overview](api.png)
 
-This diagram provides a high-level overview of the v2 `json` package.
+This diagram provides a high-level overview of the v2 `json` and `jsontext` packages.
 Purple blocks represent types, while blue blocks represent functions or methods.
 The arrows and their direction represent the approximate flow of data.
 The bottom half of the diagram contains functionality that is only concerned
-with syntax, while the upper half contains functionality that assigns
-semantic meaning to syntactic data handled by the bottom half.
+with syntax (implemented by the `jsontext` package),
+while the upper half contains functionality that assigns
+semantic meaning to syntactic data handled by the bottom half
+(as implemented by the v2 `json` package).
 
 In contrast to v1 `encoding/json`, options are represented as separate types
 rather than being setter methods on the `Encoder` or `Decoder` types.
+Some options affects JSON serialization at the syntactic layer,
+while others affect it at the semantic layer.
+Some options only affect JSON when decoding,
+while others affect JSON while encoding.
 
 ## Behavior changes
 
@@ -128,194 +141,35 @@ This table shows an overview of the changes:
 
 | v1 | v2 | Details |
 | -- | -- | ------- |
-| JSON object members are unmarshaled into a Go struct using a **case-insensitive name match**. | JSON object members are unmarshaled into a Go struct using a **case-sensitive name match**. | [CaseSensitivity](/diff_test.go#:~:text=TestCaseSensitivity) |
-| When marshaling a Go struct, a struct field marked as `omitempty` is omitted if **the field value is an empty Go value**, which is defined as false, 0, a nil pointer, a nil interface value, and any empty array, slice, map, or string. | When marshaling a Go struct, a struct field marked as `omitempty` is omitted if **the field value would encode as an empty JSON value**, which is defined as a JSON null, or an empty JSON string, object, or array. | [OmitEmptyOption](/diff_test.go#:~:text=TestOmitEmptyOption) |
-| The `string` option **does affect** Go bools. | The `string` option **does not affect** Go bools. | [StringOption](/diff_test.go#:~:text=TestStringOption) |
-| The `string` option **does not recursively affect** sub-values of the Go field value. | The `string` option **does recursively affect** sub-values of the Go field value. | [StringOption](/diff_test.go#:~:text=TestStringOption) |
-| The `string` option **sometimes accepts** a JSON null escaped within a JSON string. | The `string` option **never accepts** a JSON null escaped within a JSON string. | [StringOption](/diff_test.go#:~:text=TestStringOption) |
-| A nil Go slice is marshaled as a **JSON null**. | A nil Go slice is marshaled as an **empty JSON array**. | [NilSlicesAndMaps](/diff_test.go#:~:text=TestNilSlicesAndMaps) |
-| A nil Go map is marshaled as a **JSON null**. | A nil Go map is marshaled as an **empty JSON object**. | [NilSlicesAndMaps](/diff_test.go#:~:text=TestNilSlicesAndMaps) |
-| A Go array may be unmarshaled from a **JSON array of any length**. | A Go array must be unmarshaled from a **JSON array of the same length**. | [Arrays](/diff_test.go#:~:text=Arrays) |
-| A Go byte array is represented as a **JSON array of JSON numbers**. | A Go byte array is represented as a **Base64-encoded JSON string**. | [ByteArrays](/diff_test.go#:~:text=TestByteArrays) |
-| `MarshalJSON` and `UnmarshalJSON` methods declared on a pointer receiver are **inconsistently called**. | `MarshalJSON` and `UnmarshalJSON` methods declared on a pointer receiver are **consistently called**. | [PointerReceiver](/diff_test.go#:~:text=TestPointerReceiver) |
-| A Go map is marshaled in a **deterministic order**. | A Go map is marshaled in a **non-deterministic order**. | [MapDeterminism](/diff_test.go#:~:text=TestMapDeterminism) |
-| JSON strings are encoded **with HTML-specific characters being escaped**. | JSON strings are encoded **without any characters being escaped** (unless necessary). | [EscapeHTML](/diff_test.go#:~:text=TestEscapeHTML) |
-| When marshaling, invalid UTF-8 within a Go string **are silently replaced**. | When marshaling, invalid UTF-8 within a Go string **results in an error**. | [InvalidUTF8](/diff_test.go#:~:text=TestInvalidUTF8) |
-| When unmarshaling, invalid UTF-8 within a JSON string **are silently replaced**. | When unmarshaling, invalid UTF-8 within a JSON string **results in an error**. | [InvalidUTF8](/diff_test.go#:~:text=TestInvalidUTF8) |
-| When marshaling, **an error does not occur** if the output JSON value contains objects with duplicate names. | When marshaling, **an error does occur** if the output JSON value contains objects with duplicate names. | [DuplicateNames](/diff_test.go#:~:text=TestDuplicateNames) |
-| When unmarshaling, **an error does not occur** if the input JSON value contains objects with duplicate names. | When unmarshaling, **an error does occur** if the input JSON value contains objects with duplicate names. | [DuplicateNames](/diff_test.go#:~:text=TestDuplicateNames) |
-| Unmarshaling a JSON null into a non-empty Go value **inconsistently clears the value or does nothing**. | Unmarshaling a JSON null into a non-empty Go value **always clears the value**. | [MergeNull](/diff_test.go#:~:text=TestMergeNull) |
-| Unmarshaling a JSON value into a non-empty Go value **follows inconsistent and bizarre behavior**. | Unmarshaling a JSON value into a non-empty Go value **always merges if the input is an object, and otherwise replaces**.  | [MergeComposite](/diff_test.go#:~:text=TestMergeComposite) |
-| A `time.Duration` is represented as a **JSON number containing the decimal number of nanoseconds**. | A `time.Duration` is represented as a **JSON string containing the formatted duration (e.g., "1h2m3.456s")**. | [TimeDurations](/diff_test.go#:~:text=TestTimeDurations) |
-| Unmarshaling a JSON number into a Go float beyond its representation **results in an error**. | Unmarshaling a JSON number into a Go float beyond its representation **uses the closest representable value (e.g., ±`math.MaxFloat`)**. | [MaxFloats](/diff_test.go#:~:text=TestMaxFloats) |
-| A Go struct with only unexported fields **can be serialized**. | A Go struct with only unexported fields **cannot be serialized**. | [EmptyStructs](/diff_test.go#:~:text=TestEmptyStructs) |
-| A Go struct that embeds an unexported struct type **can sometimes be serialized**. | A Go struct that embeds an unexported struct type **cannot be serialized**. | [EmbedUnexported](/diff_test.go#:~:text=TestEmbedUnexported) |
-
-See [diff_test.go](/diff_test.go) for details about every change.
+| JSON object members are unmarshaled into a Go struct using a **case-insensitive name match**. | JSON object members are unmarshaled into a Go struct using a **case-sensitive name match**. | [CaseSensitivity](/v1/diff_test.go#:~:text=TestCaseSensitivity) |
+| When marshaling a Go struct, a struct field marked as `omitempty` is omitted if **the field value is an empty Go value**, which is defined as false, 0, a nil pointer, a nil interface value, and any empty array, slice, map, or string. | When marshaling a Go struct, a struct field marked as `omitempty` is omitted if **the field value would encode as an empty JSON value**, which is defined as a JSON null, or an empty JSON string, object, or array. | [OmitEmptyOption](/v1/diff_test.go#:~:text=TestOmitEmptyOption) |
+| The `string` option **does affect** Go strings and bools. | The `string` option **does not affect** Go strings or bools. | [StringOption](/v1/diff_test.go#:~:text=TestStringOption) |
+| The `string` option **does not recursively affect** sub-values of the Go field value. | The `string` option **does recursively affect** sub-values of the Go field value. | [StringOption](/v1/diff_test.go#:~:text=TestStringOption) |
+| The `string` option **sometimes accepts** a JSON null escaped within a JSON string. | The `string` option **never accepts** a JSON null escaped within a JSON string. | [StringOption](/v1/diff_test.go#:~:text=TestStringOption) |
+| A nil Go slice is marshaled as a **JSON null**. | A nil Go slice is marshaled as an **empty JSON array**. | [NilSlicesAndMaps](/v1/diff_test.go#:~:text=TestNilSlicesAndMaps) |
+| A nil Go map is marshaled as a **JSON null**. | A nil Go map is marshaled as an **empty JSON object**. | [NilSlicesAndMaps](/v1/diff_test.go#:~:text=TestNilSlicesAndMaps) |
+| A Go array may be unmarshaled from a **JSON array of any length**. | A Go array must be unmarshaled from a **JSON array of the same length**. | [Arrays](/v1/diff_test.go#:~:text=Arrays) |
+| A Go byte array is represented as a **JSON array of JSON numbers**. | A Go byte array is represented as a **Base64-encoded JSON string**. | [ByteArrays](/v1/diff_test.go#:~:text=TestByteArrays) |
+| `MarshalJSON` and `UnmarshalJSON` methods declared on a pointer receiver are **inconsistently called**. | `MarshalJSON` and `UnmarshalJSON` methods declared on a pointer receiver are **consistently called**. | [PointerReceiver](/v1/diff_test.go#:~:text=TestPointerReceiver) |
+| A Go map is marshaled in a **deterministic order**. | A Go map is marshaled in a **non-deterministic order**. | [MapDeterminism](/v1/diff_test.go#:~:text=TestMapDeterminism) |
+| JSON strings are encoded **with HTML-specific characters being escaped**. | JSON strings are encoded **without any characters being escaped** (unless necessary). | [EscapeHTML](/v1/diff_test.go#:~:text=TestEscapeHTML) |
+| When marshaling, invalid UTF-8 within a Go string **are silently replaced**. | When marshaling, invalid UTF-8 within a Go string **results in an error**. | [InvalidUTF8](/v1/diff_test.go#:~:text=TestInvalidUTF8) |
+| When unmarshaling, invalid UTF-8 within a JSON string **are silently replaced**. | When unmarshaling, invalid UTF-8 within a JSON string **results in an error**. | [InvalidUTF8](/v1/diff_test.go#:~:text=TestInvalidUTF8) |
+| When marshaling, **an error does not occur** if the output JSON value contains objects with duplicate names. | When marshaling, **an error does occur** if the output JSON value contains objects with duplicate names. | [DuplicateNames](/v1/diff_test.go#:~:text=TestDuplicateNames) |
+| When unmarshaling, **an error does not occur** if the input JSON value contains objects with duplicate names. | When unmarshaling, **an error does occur** if the input JSON value contains objects with duplicate names. | [DuplicateNames](/v1/diff_test.go#:~:text=TestDuplicateNames) |
+| Unmarshaling a JSON null into a non-empty Go value **inconsistently clears the value or does nothing**. | Unmarshaling a JSON null into a non-empty Go value **always clears the value**. | [MergeNull](/v1/diff_test.go#:~:text=TestMergeNull) |
+| Unmarshaling a JSON value into a non-empty Go value **follows inconsistent and bizarre behavior**. | Unmarshaling a JSON value into a non-empty Go value **always merges if the input is an object, and otherwise replaces**.  | [MergeComposite](/v1/diff_test.go#:~:text=TestMergeComposite) |
+| A `time.Duration` is represented as a **JSON number containing the decimal number of nanoseconds**. | A `time.Duration` has no default representation in v2 (see [#71631](https://golang.org/issue/71631)) and results in an error. | |
+| A Go struct with only unexported fields **can be serialized**. | A Go struct with only unexported fields **cannot be serialized**. | [EmptyStructs](/v1/diff_test.go#:~:text=TestEmptyStructs) |
+
+See [diff_test.go](/v1/diff_test.go) for details about every change.
 
 ## Performance
 
-One of the goals of the v2 module is to be more performant than v1.
-
-Each of the charts below show the performance across
-several different JSON implementations:
-
-* `JSONv1` is `encoding/json` at `v1.18.2`
-* `JSONv2` is `github.com/go-json-experiment/json` at `v0.0.0-20220524042235-dd8be80fc4a7`
-* `JSONIterator` is `github.com/json-iterator/go` at `v1.1.12`
-* `SegmentJSON` is `github.com/segmentio/encoding/json` at `v0.3.5`
-* `GoJSON` is `github.com/goccy/go-json` at `v0.9.7`
-* `SonicJSON` is `github.com/bytedance/sonic` at `v1.3.0`
-
-Benchmarks were run across various datasets:
-
-* `CanadaGeometry` is a GeoJSON (RFC 7946) representation of Canada.
-  It contains many JSON arrays of arrays of two-element arrays of numbers.
-* `CITMCatalog` contains many JSON objects using numeric names.
-* `SyntheaFHIR` is sample JSON data from the healthcare industry.
-  It contains many nested JSON objects with mostly string values,
-  where the set of unique string values is relatively small.
-* `TwitterStatus` is the JSON response from the Twitter API.
-  It contains a mix of all different JSON kinds, where string values
-  are a mix of both single-byte ASCII and multi-byte Unicode.
-* `GolangSource` is a simple tree representing the Go source code.
-  It contains many nested JSON objects, each with the same schema.
-* `StringUnicode` contains many strings with multi-byte Unicode runes.
-
-All of the implementations other than `JSONv1` and `JSONv2` make
-extensive use of `unsafe`. As such, we expect those to generally be faster,
-but at the cost of memory and type safety. `SonicJSON` goes a step even further
-and uses just-in-time compilation to generate machine code specialized
-for the Go type being marshaled or unmarshaled.
-Also, `SonicJSON` does not validate JSON strings for valid UTF-8,
-and so gains a notable performance boost on datasets with multi-byte Unicode.
-Benchmarks are performed based on the default marshal and unmarshal behavior
-of each package. Note that `JSONv2` aims to be safe and correct by default,
-which may not be the most performant strategy.
-
-`JSONv2` has several semantic changes relative to `JSONv1` that
-impacts performance:
-
-1.  When marshaling, `JSONv2` no longer sorts the keys of a Go map.
-    This will improve performance.
-2.  When marshaling or unmarshaling, `JSONv2` always checks
-    to make sure JSON object names are unique.
-    This will hurt performance, but is more correct.
-3.  When marshaling or unmarshaling, `JSONv2` always
-    shallow copies the underlying value for a Go interface and
-    shallow copies the key and value for entries in a Go map.
-    This is done to keep the value as addressable so that `JSONv2` can
-    call methods and functions that operate on a pointer receiver.
-    This will hurt performance, but is more correct.
-
-All of the charts are unit-less since the values are normalized
-relative to `JSONv1`, which is why `JSONv1` always has a value of 1.
-A lower value is better (i.e., runs faster).
-
-Benchmarks were performed on an AMD Ryzen 9 5900X.
-
-The code for the benchmarks is located at
-https://github.com/go-json-experiment/jsonbench.
-
-### Marshal Performance
-
-#### Concrete types
-
-![Benchmark Marshal Concrete](benchmark-marshal-concrete.png)
-
-* This compares marshal performance when serializing
-  [from concrete types](/testdata_test.go).
-* The `JSONv1` implementation is close to optimal (without the use of `unsafe`).
-* Relative to `JSONv1`, `JSONv2` is generally as fast or slightly faster.
-* Relative to `JSONIterator`, `JSONv2` is up to 1.3x faster.
-* Relative to `SegmentJSON`, `JSONv2` is up to 1.8x slower.
-* Relative to `GoJSON`, `JSONv2` is up to 2.0x slower.
-* Relative to `SonicJSON`, `JSONv2` is about 1.8x to 3.2x slower
-  (ignoring `StringUnicode` since `SonicJSON` does not validate UTF-8).
-* For `JSONv1` and `JSONv2`, marshaling from concrete types is
-  mostly limited by the performance of Go reflection.
-
-#### Interface types
-
-![Benchmark Marshal Interface](benchmark-marshal-interface.png)
-
-* This compares marshal performance when serializing from
-  `any`, `map[string]any`, and `[]any` types.
-* Relative to `JSONv1`, `JSONv2` is about 1.5x to 4.2x faster.
-* Relative to `JSONIterator`, `JSONv2` is about 1.1x to 2.4x faster.
-* Relative to `SegmentJSON`, `JSONv2` is about 1.2x to 1.8x faster.
-* Relative to `GoJSON`, `JSONv2` is about 1.1x to 2.5x faster.
-* Relative to `SonicJSON`, `JSONv2` is up to 1.5x slower
-  (ignoring `StringUnicode` since `SonicJSON` does not validate UTF-8).
-* `JSONv2` is faster than the alternatives.
-  One advantange is because it does not sort the keys for a `map[string]any`,
-  while alternatives (except `SonicJSON` and `JSONIterator`) do sort the keys.
-
-#### RawValue types
-
-![Benchmark Marshal Rawvalue](benchmark-marshal-rawvalue.png)
-
-* This compares performance when marshaling from a `json.RawValue`.
-  This mostly exercises the underlying encoder and
-  hides the cost of Go reflection.
-* Relative to `JSONv1`, `JSONv2` is about 3.5x to 7.8x faster.
-* `JSONIterator` is blazingly fast because
-  [it does not validate whether the raw value is valid](https://go.dev/play/p/bun9IXQCKRe)
-  and simply copies it to the output.
-* Relative to `SegmentJSON`, `JSONv2` is about 1.5x to 2.7x faster.
-* Relative to `GoJSON`, `JSONv2` is up to 2.2x faster.
-* Relative to `SonicJSON`, `JSONv2` is up to 1.5x faster.
-* Aside from `JSONIterator`, `JSONv2` is generally the fastest.
-
-### Unmarshal Performance
-
-#### Concrete types
-
-![Benchmark Unmarshal Concrete](benchmark-unmarshal-concrete.png)
-
-* This compares unmarshal performance when deserializing
-  [into concrete types](/testdata_test.go).
-* Relative to `JSONv1`, `JSONv2` is about 1.8x to 5.7x faster.
-* Relative to `JSONIterator`, `JSONv2` is about 1.1x to 1.6x slower.
-* Relative to `SegmentJSON`, `JSONv2` is up to 2.5x slower.
-* Relative to `GoJSON`, `JSONv2` is about 1.4x to 2.1x slower.
-* Relative to `SonicJSON`, `JSONv2` is up to 4.0x slower
-  (ignoring `StringUnicode` since `SonicJSON` does not validate UTF-8).
-* For `JSONv1` and `JSONv2`, unmarshaling into concrete types is
-  mostly limited by the performance of Go reflection.
-
-#### Interface types
-
-![Benchmark Unmarshal Interface](benchmark-unmarshal-interface.png)
-
-* This compares unmarshal performance when deserializing into
-  `any`, `map[string]any`, and `[]any` types.
-* Relative to `JSONv1`, `JSONv2` is about 1.tx to 4.3x faster.
-* Relative to `JSONIterator`, `JSONv2` is up to 1.5x faster.
-* Relative to `SegmentJSON`, `JSONv2` is about 1.5 to 3.7x faster.
-* Relative to `GoJSON`, `JSONv2` is up to 1.3x faster.
-* Relative to `SonicJSON`, `JSONv2` is up to 1.5x slower
-  (ignoring `StringUnicode` since `SonicJSON` does not validate UTF-8).
-* Aside from `SonicJSON`, `JSONv2` is generally just as fast
-  or faster than all the alternatives.
-
-#### RawValue types
-
-![Benchmark Unmarshal Rawvalue](benchmark-unmarshal-rawvalue.png)
-
-* This compares performance when unmarshaling into a `json.RawValue`.
-  This mostly exercises the underlying decoder and
-  hides away most of the cost of Go reflection.
-* Relative to `JSONv1`, `JSONv2` is about 8.3x to 17.0x faster.
-* Relative to `JSONIterator`, `JSONv2` is up to 2.0x faster.
-* Relative to `SegmentJSON`, `JSONv2` is up to 1.6x faster or 1.7x slower.
-* Relative to `GoJSON`, `JSONv2` is up to 1.9x faster or 2.1x slower.
-* Relative to `SonicJSON`, `JSONv2` is up to 2.0x faster
-  (ignoring `StringUnicode` since `SonicJSON` does not validate UTF-8).
-* `JSONv1` takes a
-  [lexical scanning approach](https://talks.golang.org/2011/lex.slide#1),
-  which performs a virtual function call for every byte of input.
-  In contrast, `JSONv2` makes heavy use of iterative and linear parsing logic
-  (with extra complexity to resume parsing when encountering segmented buffers).
-* `JSONv2` is comparable to the alternatives that use `unsafe`.
-  Generally it is faster, but sometimes it is slower.
+One of the goals of the v2 module is to be more performant than v1,
+but not at the expense of correctness.
+In general, v2 is at performance parity with v1 for marshaling,
+but dramatically faster for unmarshaling.
+
+See https://github.com/go-json-experiment/jsonbench for benchmarks
+comparing v2 with v1 and a number of other popular JSON implementations.
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal.go
index e6c6216ff3..dbf92432dd 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal.go
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal.go
@@ -5,109 +5,65 @@
 package json
 
 import (
-	"errors"
+	"bytes"
+	"encoding"
 	"io"
 	"reflect"
+	"slices"
+	"strings"
 	"sync"
-)
-
-// MarshalOptions configures how Go data is serialized as JSON data.
-// The zero value is equivalent to the default marshal settings.
-type MarshalOptions struct {
-	requireKeyedLiterals
-	nonComparable
-
-	// Marshalers is a list of type-specific marshalers to use.
-	Marshalers *Marshalers
-
-	// StringifyNumbers specifies that numeric Go types should be serialized
-	// as a JSON string containing the equivalent JSON number value.
-	//
-	// According to RFC 8259, section 6, a JSON implementation may choose to
-	// limit the representation of a JSON number to an IEEE 754 binary64 value.
-	// This may cause decoders to lose precision for int64 and uint64 types.
-	// Escaping JSON numbers as a JSON string preserves the exact precision.
-	StringifyNumbers bool
-
-	// DiscardUnknownMembers specifies that marshaling should ignore any
-	// JSON object members stored in Go struct fields dedicated to storing
-	// unknown JSON object members.
-	DiscardUnknownMembers bool
-
-	// Deterministic specifies that the same input value will be serialized
-	// as the exact same output bytes. Different processes of
-	// the same program will serialize equal values to the same bytes,
-	// but different versions of the same program are not guaranteed
-	// to produce the exact same sequence of bytes.
-	Deterministic bool
+	"time"
 
-	// formatDepth is the depth at which we respect the format flag.
-	formatDepth int
-	// format is custom formatting for the value at the specified depth.
-	format string
-}
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
+)
 
-// Marshal serializes a Go value as a []byte with default options.
-// It is a thin wrapper over MarshalOptions.Marshal.
-func Marshal(in any) (out []byte, err error) {
-	return MarshalOptions{}.Marshal(EncodeOptions{}, in)
-}
+// Reference encoding and time packages to assist pkgsite
+// in being able to hotlink references to those packages.
+var (
+	_ encoding.TextMarshaler
+	_ encoding.TextAppender
+	_ encoding.TextUnmarshaler
+	_ time.Time
+	_ time.Duration
+)
 
-// MarshalFull serializes a Go value into an io.Writer with default options.
-// It is a thin wrapper over MarshalOptions.MarshalFull.
-func MarshalFull(out io.Writer, in any) error {
-	return MarshalOptions{}.MarshalFull(EncodeOptions{}, out, in)
-}
+// export exposes internal functionality of the "jsontext" package.
+var export = jsontext.Internal.Export(&internal.AllowInternalUse)
 
 // Marshal serializes a Go value as a []byte according to the provided
-// marshal and encode options. It does not terminate the output with a newline.
-// See MarshalNext for details about the conversion of a Go value into JSON.
-func (mo MarshalOptions) Marshal(eo EncodeOptions, in any) (out []byte, err error) {
-	enc := getBufferedEncoder(eo)
-	defer putBufferedEncoder(enc)
-	enc.options.omitTopLevelNewline = true
-	err = mo.MarshalNext(enc, in)
-	// TODO(https://go.dev/issue/45038): Use bytes.Clone.
-	return append([]byte(nil), enc.buf...), err
-}
-
-// MarshalFull serializes a Go value into an io.Writer according to the provided
-// marshal and encode options. It does not terminate the output with a newline.
-// See MarshalNext for details about the conversion of a Go value into JSON.
-func (mo MarshalOptions) MarshalFull(eo EncodeOptions, out io.Writer, in any) error {
-	enc := getStreamingEncoder(out, eo)
-	defer putStreamingEncoder(enc)
-	enc.options.omitTopLevelNewline = true
-	err := mo.MarshalNext(enc, in)
-	return err
-}
-
-// MarshalNext encodes a Go value as the next JSON value according to
-// the provided marshal options.
+// marshal and encode options (while ignoring unmarshal or decode options).
+// It does not terminate the output with a newline.
 //
 // Type-specific marshal functions and methods take precedence
 // over the default representation of a value.
 // Functions or methods that operate on *T are only called when encoding
 // a value of type T (by taking its address) or a non-nil value of *T.
-// MarshalNext ensures that a value is always addressable
+// Marshal ensures that a value is always addressable
 // (by boxing it on the heap if necessary) so that
 // these functions and methods can be consistently called. For performance,
-// it is recommended that MarshalNext be passed a non-nil pointer to the value.
+// it is recommended that Marshal be passed a non-nil pointer to the value.
 //
 // The input value is encoded as JSON according the following rules:
 //
-//   - If any type-specific functions in MarshalOptions.Marshalers match
+//   - If any type-specific functions in a [WithMarshalers] option match
 //     the value type, then those functions are called to encode the value.
-//     If all applicable functions return SkipFunc,
+//     If all applicable functions return [SkipFunc],
 //     then the value is encoded according to subsequent rules.
 //
-//   - If the value type implements MarshalerV2,
-//     then the MarshalNextJSON method is called to encode the value.
+//   - If the value type implements [MarshalerTo],
+//     then the MarshalJSONTo method is called to encode the value.
 //
-//   - If the value type implements MarshalerV1,
+//   - If the value type implements [Marshaler],
 //     then the MarshalJSON method is called to encode the value.
 //
-//   - If the value type implements encoding.TextMarshaler,
+//   - If the value type implements [encoding.TextAppender],
+//     then the AppendText method is called to encode the value and
+//     subsequently encode its result as a JSON string.
+//
+//   - If the value type implements [encoding.TextMarshaler],
 //     then the MarshalText method is called to encode the value and
 //     subsequently encode its result as a JSON string.
 //
@@ -139,25 +95,25 @@ func (mo MarshalOptions) MarshalFull(eo EncodeOptions, out io.Writer, in any) er
 //     where each byte is recursively JSON-encoded as each JSON array element.
 //
 //   - A Go integer is encoded as a JSON number without fractions or exponents.
-//     If MarshalOptions.StringifyNumbers is specified, then the JSON number is
-//     encoded within a JSON string. It does not support any custom format
-//     flags.
+//     If [StringifyNumbers] is specified or encoding a JSON object name,
+//     then the JSON number is encoded within a JSON string.
+//     It does not support any custom format flags.
 //
 //   - A Go float is encoded as a JSON number.
-//     If MarshalOptions.StringifyNumbers is specified,
+//     If [StringifyNumbers] is specified or encoding a JSON object name,
 //     then the JSON number is encoded within a JSON string.
 //     If the format is "nonfinite", then NaN, +Inf, and -Inf are encoded as
 //     the JSON strings "NaN", "Infinity", and "-Infinity", respectively.
-//     Otherwise, the presence of non-finite numbers results in a SemanticError.
+//     Otherwise, the presence of non-finite numbers results in a [SemanticError].
 //
 //   - A Go map is encoded as a JSON object, where each Go map key and value
 //     is recursively encoded as a name and value pair in the JSON object.
 //     The Go map key must encode as a JSON string, otherwise this results
-//     in a SemanticError. When encoding keys, MarshalOptions.StringifyNumbers
-//     is automatically applied so that numeric keys encode as JSON strings.
-//     The Go map is traversed in a non-deterministic order.
-//     For deterministic encoding, consider using RawValue.Canonicalize.
+//     in a [SemanticError]. The Go map is traversed in a non-deterministic order.
+//     For deterministic encoding, consider using the [Deterministic] option.
 //     If the format is "emitnull", then a nil map is encoded as a JSON null.
+//     If the format is "emitempty", then a nil map is encoded as an empty JSON object,
+//     regardless of whether [FormatNilMapAsNull] is specified.
 //     Otherwise by default, a nil map is encoded as an empty JSON object.
 //
 //   - A Go struct is encoded as a JSON object.
@@ -167,6 +123,8 @@ func (mo MarshalOptions) MarshalFull(eo EncodeOptions, out io.Writer, in any) er
 //   - A Go slice is encoded as a JSON array, where each Go slice element
 //     is recursively JSON-encoded as the elements of the JSON array.
 //     If the format is "emitnull", then a nil slice is encoded as a JSON null.
+//     If the format is "emitempty", then a nil slice is encoded as an empty JSON array,
+//     regardless of whether [FormatNilSliceAsNull] is specified.
 //     Otherwise by default, a nil slice is encoded as an empty JSON array.
 //
 //   - A Go array is encoded as a JSON array, where each Go array element
@@ -182,148 +140,144 @@ func (mo MarshalOptions) MarshalFull(eo EncodeOptions, out io.Writer, in any) er
 //     the recursively JSON-encoded representation of the underlying value.
 //     It does not support any custom format flags.
 //
-//   - A Go time.Time is encoded as a JSON string containing the timestamp
-//     formatted in RFC 3339 with nanosecond resolution.
+//   - A Go [time.Time] is encoded as a JSON string containing the timestamp
+//     formatted in RFC 3339 with nanosecond precision.
 //     If the format matches one of the format constants declared
 //     in the time package (e.g., RFC1123), then that format is used.
-//     Otherwise, the format is used as-is with time.Time.Format if non-empty.
-//
-//   - A Go time.Duration is encoded as a JSON string containing the duration
-//     formatted according to time.Duration.String.
-//     If the format is "nanos", it is encoded as a JSON number
-//     containing the number of nanoseconds in the duration.
+//     If the format is "unix", "unixmilli", "unixmicro", or "unixnano",
+//     then the timestamp is encoded as a possibly fractional JSON number
+//     of the number of seconds (or milliseconds, microseconds, or nanoseconds)
+//     since the Unix epoch, which is January 1st, 1970 at 00:00:00 UTC.
+//     To avoid a fractional component, round the timestamp to the relevant unit.
+//     Otherwise, the format is used as-is with [time.Time.Format] if non-empty.
+//
+//   - A Go [time.Duration] currently has no default representation and
+//     requires an explicit format to be specified.
+//     If the format is "sec", "milli", "micro", or "nano",
+//     then the duration is encoded as a possibly fractional JSON number
+//     of the number of seconds (or milliseconds, microseconds, or nanoseconds).
+//     To avoid a fractional component, round the duration to the relevant unit.
+//     If the format is "units", it is encoded as a JSON string formatted using
+//     [time.Duration.String] (e.g., "1h30m" for 1 hour 30 minutes).
+//     If the format is "iso8601", it is encoded as a JSON string using the
+//     ISO 8601 standard for durations (e.g., "PT1H30M" for 1 hour 30 minutes)
+//     using only accurate units of hours, minutes, and seconds.
 //
 //   - All other Go types (e.g., complex numbers, channels, and functions)
-//     have no default representation and result in a SemanticError.
+//     have no default representation and result in a [SemanticError].
 //
-// JSON cannot represent cyclic data structures and
-// MarshalNext does not handle them.
+// JSON cannot represent cyclic data structures and Marshal does not handle them.
 // Passing cyclic structures will result in an error.
-func (mo MarshalOptions) MarshalNext(out *Encoder, in any) error {
+func Marshal(in any, opts ...Options) (out []byte, err error) {
+	enc := export.GetBufferedEncoder(opts...)
+	defer export.PutBufferedEncoder(enc)
+	xe := export.Encoder(enc)
+	xe.Flags.Set(jsonflags.OmitTopLevelNewline | 1)
+	err = marshalEncode(enc, in, &xe.Struct)
+	if err != nil && xe.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+		return nil, internal.TransformMarshalError(in, err)
+	}
+	return bytes.Clone(xe.Buf), err
+}
+
+// MarshalWrite serializes a Go value into an [io.Writer] according to the provided
+// marshal and encode options (while ignoring unmarshal or decode options).
+// It does not terminate the output with a newline.
+// See [Marshal] for details about the conversion of a Go value into JSON.
+func MarshalWrite(out io.Writer, in any, opts ...Options) (err error) {
+	enc := export.GetStreamingEncoder(out, opts...)
+	defer export.PutStreamingEncoder(enc)
+	xe := export.Encoder(enc)
+	xe.Flags.Set(jsonflags.OmitTopLevelNewline | 1)
+	err = marshalEncode(enc, in, &xe.Struct)
+	if err != nil && xe.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+		return internal.TransformMarshalError(in, err)
+	}
+	return err
+}
+
+// MarshalEncode serializes a Go value into an [jsontext.Encoder] according to
+// the provided marshal options (while ignoring unmarshal, encode, or decode options).
+// Any marshal-relevant options already specified on the [jsontext.Encoder]
+// take lower precedence than the set of options provided by the caller.
+// Unlike [Marshal] and [MarshalWrite], encode options are ignored because
+// they must have already been specified on the provided [jsontext.Encoder].
+//
+// See [Marshal] for details about the conversion of a Go value into JSON.
+func MarshalEncode(out *jsontext.Encoder, in any, opts ...Options) (err error) {
+	xe := export.Encoder(out)
+	if len(opts) > 0 {
+		optsOriginal := xe.Struct
+		defer func() { xe.Struct = optsOriginal }()
+		xe.Struct.JoinWithoutCoderOptions(opts...)
+	}
+	err = marshalEncode(out, in, &xe.Struct)
+	if err != nil && xe.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+		return internal.TransformMarshalError(in, err)
+	}
+	return err
+}
+
+func marshalEncode(out *jsontext.Encoder, in any, mo *jsonopts.Struct) (err error) {
 	v := reflect.ValueOf(in)
 	if !v.IsValid() || (v.Kind() == reflect.Pointer && v.IsNil()) {
-		return out.WriteToken(Null)
+		return out.WriteToken(jsontext.Null)
 	}
 	// Shallow copy non-pointer values to obtain an addressable value.
 	// It is beneficial to performance to always pass pointers to avoid this.
-	if v.Kind() != reflect.Pointer {
+	forceAddr := v.Kind() != reflect.Pointer
+	if forceAddr {
 		v2 := reflect.New(v.Type())
 		v2.Elem().Set(v)
 		v = v2
 	}
-	va := addressableValue{v.Elem()} // dereferenced pointer is always addressable
+	va := addressableValue{v.Elem(), forceAddr} // dereferenced pointer is always addressable
 	t := va.Type()
 
 	// Lookup and call the marshal function for this type.
 	marshal := lookupArshaler(t).marshal
 	if mo.Marshalers != nil {
-		marshal, _ = mo.Marshalers.lookup(marshal, t)
+		marshal, _ = mo.Marshalers.(*Marshalers).lookup(marshal, t)
 	}
-	if err := marshal(mo, out, va); err != nil {
-		if !out.options.AllowDuplicateNames {
-			out.tokens.invalidateDisabledNamespaces()
+	if err := marshal(out, va, mo); err != nil {
+		if !mo.Flags.Get(jsonflags.AllowDuplicateNames) {
+			export.Encoder(out).Tokens.InvalidateDisabledNamespaces()
 		}
 		return err
 	}
 	return nil
 }
 
-// UnmarshalOptions configures how JSON data is deserialized as Go data.
-// The zero value is equivalent to the default unmarshal settings.
-type UnmarshalOptions struct {
-	requireKeyedLiterals
-	nonComparable
-
-	// Unmarshalers is a list of type-specific unmarshalers to use.
-	Unmarshalers *Unmarshalers
-
-	// StringifyNumbers specifies that numeric Go types can be deserialized
-	// from either a JSON number or a JSON string containing a JSON number
-	// without any surrounding whitespace.
-	StringifyNumbers bool
-
-	// RejectUnknownMembers specifies that unknown members should be rejected
-	// when unmarshaling a JSON object, regardless of whether there is a field
-	// to store unknown members.
-	RejectUnknownMembers bool
-
-	// formatDepth is the depth at which we respect the format flag.
-	formatDepth int
-	// format is custom formatting for the value at the specified depth.
-	format string
-}
-
-// Unmarshal deserializes a Go value from a []byte with default options.
-// It is a thin wrapper over UnmarshalOptions.Unmarshal.
-func Unmarshal(in []byte, out any) error {
-	return UnmarshalOptions{}.Unmarshal(DecodeOptions{}, in, out)
-}
-
-// UnmarshalFull deserializes a Go value from an io.Reader with default options.
-// It is a thin wrapper over UnmarshalOptions.UnmarshalFull.
-func UnmarshalFull(in io.Reader, out any) error {
-	return UnmarshalOptions{}.UnmarshalFull(DecodeOptions{}, in, out)
-}
-
-// Unmarshal deserializes a Go value from a []byte according to the
-// provided unmarshal and decode options. The output must be a non-nil pointer.
+// Unmarshal decodes a []byte input into a Go value according to the provided
+// unmarshal and decode options (while ignoring marshal or encode options).
 // The input must be a single JSON value with optional whitespace interspersed.
-// See UnmarshalNext for details about the conversion of JSON into a Go value.
-func (uo UnmarshalOptions) Unmarshal(do DecodeOptions, in []byte, out any) error {
-	dec := getBufferedDecoder(in, do)
-	defer putBufferedDecoder(dec)
-	return uo.unmarshalFull(dec, out)
-}
-
-// UnmarshalFull deserializes a Go value from an io.Reader according to the
-// provided unmarshal and decode options. The output must be a non-nil pointer.
-// The input must be a single JSON value with optional whitespace interspersed.
-// It consumes the entirety of io.Reader until io.EOF is encountered.
-// See UnmarshalNext for details about the conversion of JSON into a Go value.
-func (uo UnmarshalOptions) UnmarshalFull(do DecodeOptions, in io.Reader, out any) error {
-	dec := getStreamingDecoder(in, do)
-	defer putStreamingDecoder(dec)
-	return uo.unmarshalFull(dec, out)
-}
-func (uo UnmarshalOptions) unmarshalFull(in *Decoder, out any) error {
-	switch err := uo.UnmarshalNext(in, out); err {
-	case nil:
-		return in.checkEOF()
-	case io.EOF:
-		return io.ErrUnexpectedEOF
-	default:
-		return err
-	}
-}
-
-// UnmarshalNext decodes the next JSON value into a Go value according to
-// the provided unmarshal options. The output must be a non-nil pointer.
+// The output must be a non-nil pointer.
 //
 // Type-specific unmarshal functions and methods take precedence
 // over the default representation of a value.
 // Functions or methods that operate on *T are only called when decoding
 // a value of type T (by taking its address) or a non-nil value of *T.
-// UnmarshalNext ensures that a value is always addressable
+// Unmarshal ensures that a value is always addressable
 // (by boxing it on the heap if necessary) so that
 // these functions and methods can be consistently called.
 //
 // The input is decoded into the output according the following rules:
 //
-//   - If any type-specific functions in UnmarshalOptions.Unmarshalers match
+//   - If any type-specific functions in a [WithUnmarshalers] option match
 //     the value type, then those functions are called to decode the JSON
-//     value. If all applicable functions return SkipFunc,
+//     value. If all applicable functions return [SkipFunc],
 //     then the input is decoded according to subsequent rules.
 //
-//   - If the value type implements UnmarshalerV2,
-//     then the UnmarshalNextJSON method is called to decode the JSON value.
+//   - If the value type implements [UnmarshalerFrom],
+//     then the UnmarshalJSONFrom method is called to decode the JSON value.
 //
-//   - If the value type implements UnmarshalerV1,
+//   - If the value type implements [Unmarshaler],
 //     then the UnmarshalJSON method is called to decode the JSON value.
 //
-//   - If the value type implements encoding.TextUnmarshaler,
+//   - If the value type implements [encoding.TextUnmarshaler],
 //     then the input is decoded as a JSON string and
 //     the UnmarshalText method is called with the decoded string value.
-//     This fails with a SemanticError if the input is not a JSON string.
+//     This fails with a [SemanticError] if the input is not a JSON string.
 //
 //   - Otherwise, the JSON value is decoded according to the value's type
 //     as described in detail below.
@@ -336,7 +290,7 @@ func (uo UnmarshalOptions) unmarshalFull(in *Decoder, out any) error {
 // A JSON null may be decoded into every supported Go value where
 // it is equivalent to storing the zero value of the Go value.
 // If the input JSON kind is not handled by the current Go value type,
-// then this fails with a SemanticError. Unless otherwise specified,
+// then this fails with a [SemanticError]. Unless otherwise specified,
 // the decoded value replaces any pre-existing value.
 //
 // The representation of each type is as follows:
@@ -359,33 +313,31 @@ func (uo UnmarshalOptions) unmarshalFull(in *Decoder, out any) error {
 //     When decoding into a non-nil []byte, the slice length is reset to zero
 //     and the decoded input is appended to it.
 //     When decoding into a [N]byte, the input must decode to exactly N bytes,
-//     otherwise it fails with a SemanticError.
+//     otherwise it fails with a [SemanticError].
 //
 //   - A Go integer is decoded from a JSON number.
-//     It may also be decoded from a JSON string containing a JSON number
-//     if UnmarshalOptions.StringifyNumbers is specified.
-//     It fails with a SemanticError if the JSON number
+//     It must be decoded from a JSON string containing a JSON number
+//     if [StringifyNumbers] is specified or decoding a JSON object name.
+//     It fails with a [SemanticError] if the JSON number
 //     has a fractional or exponent component.
 //     It also fails if it overflows the representation of the Go integer type.
 //     It does not support any custom format flags.
 //
 //   - A Go float is decoded from a JSON number.
-//     It may also be decoded from a JSON string containing a JSON number
-//     if UnmarshalOptions.StringifyNumbers is specified.
-//     The JSON number is parsed as the closest representable Go float value.
+//     It must be decoded from a JSON string containing a JSON number
+//     if [StringifyNumbers] is specified or decoding a JSON object name.
+//     It fails if it overflows the representation of the Go float type.
 //     If the format is "nonfinite", then the JSON strings
 //     "NaN", "Infinity", and "-Infinity" are decoded as NaN, +Inf, and -Inf.
-//     Otherwise, the presence of such strings results in a SemanticError.
+//     Otherwise, the presence of such strings results in a [SemanticError].
 //
 //   - A Go map is decoded from a JSON object,
 //     where each JSON object name and value pair is recursively decoded
-//     as the Go map key and value. When decoding keys,
-//     UnmarshalOptions.StringifyNumbers is automatically applied so that
-//     numeric keys can decode from JSON strings. Maps are not cleared.
+//     as the Go map key and value. Maps are not cleared.
 //     If the Go map is nil, then a new map is allocated to decode into.
 //     If the decoded key matches an existing Go map entry, the entry value
 //     is reused by decoding the JSON object value into it.
-//     The only supported format is "emitnull" and has no effect when decoding.
+//     The formats "emitnull" and "emitempty" have no effect when decoding.
 //
 //   - A Go struct is decoded from a JSON object.
 //     See the “JSON Representation of Go structs” section
@@ -395,12 +347,12 @@ func (uo UnmarshalOptions) unmarshalFull(in *Decoder, out any) error {
 //     is recursively decoded and appended to the Go slice.
 //     Before appending into a Go slice, a new slice is allocated if it is nil,
 //     otherwise the slice length is reset to zero.
-//     The only supported format is "emitnull" and has no effect when decoding.
+//     The formats "emitnull" and "emitempty" have no effect when decoding.
 //
 //   - A Go array is decoded from a JSON array, where each JSON array element
 //     is recursively decoded as each corresponding Go array element.
 //     Each Go array element is zeroed before decoding into it.
-//     It fails with a SemanticError if the JSON array does not contain
+//     It fails with a [SemanticError] if the JSON array does not contain
 //     the exact same number of elements as the Go array.
 //     It does not support any custom format flags.
 //
@@ -415,59 +367,133 @@ func (uo UnmarshalOptions) unmarshalFull(in *Decoder, out any) error {
 //     Otherwise, a nil interface value of an empty interface type is initialized
 //     with a zero Go bool, string, float64, map[string]any, or []any if the
 //     input is a JSON boolean, string, number, object, or array, respectively.
-//     If the interface value is still nil, then this fails with a SemanticError
+//     If the interface value is still nil, then this fails with a [SemanticError]
 //     since decoding could not determine an appropriate Go type to decode into.
 //     For example, unmarshaling into a nil io.Reader fails since
 //     there is no concrete type to populate the interface value with.
 //     Otherwise an underlying value exists and it recursively decodes
 //     the JSON input into it. It does not support any custom format flags.
 //
-//   - A Go time.Time is decoded from a JSON string containing the time
-//     formatted in RFC 3339 with nanosecond resolution.
+//   - A Go [time.Time] is decoded from a JSON string containing the time
+//     formatted in RFC 3339 with nanosecond precision.
 //     If the format matches one of the format constants declared in
 //     the time package (e.g., RFC1123), then that format is used for parsing.
-//     Otherwise, the format is used as-is with time.Time.Parse if non-empty.
-//
-//   - A Go time.Duration is decoded from a JSON string by
-//     passing the decoded string to time.ParseDuration.
-//     If the format is "nanos", it is instead decoded from a JSON number
-//     containing the number of nanoseconds in the duration.
+//     If the format is "unix", "unixmilli", "unixmicro", or "unixnano",
+//     then the timestamp is decoded from an optionally fractional JSON number
+//     of the number of seconds (or milliseconds, microseconds, or nanoseconds)
+//     since the Unix epoch, which is January 1st, 1970 at 00:00:00 UTC.
+//     Otherwise, the format is used as-is with [time.Time.Parse] if non-empty.
+//
+//   - A Go [time.Duration] currently has no default representation and
+//     requires an explicit format to be specified.
+//     If the format is "sec", "milli", "micro", or "nano",
+//     then the duration is decoded from an optionally fractional JSON number
+//     of the number of seconds (or milliseconds, microseconds, or nanoseconds).
+//     If the format is "units", it is decoded from a JSON string parsed using
+//     [time.ParseDuration] (e.g., "1h30m" for 1 hour 30 minutes).
+//     If the format is "iso8601", it is decoded from a JSON string using the
+//     ISO 8601 standard for durations (e.g., "PT1H30M" for 1 hour 30 minutes)
+//     accepting only accurate units of hours, minutes, or seconds.
 //
 //   - All other Go types (e.g., complex numbers, channels, and functions)
-//     have no default representation and result in a SemanticError.
+//     have no default representation and result in a [SemanticError].
 //
 // In general, unmarshaling follows merge semantics (similar to RFC 7396)
 // where the decoded Go value replaces the destination value
 // for any JSON kind other than an object.
 // For JSON objects, the input object is merged into the destination value
 // where matching object members recursively apply merge semantics.
-func (uo UnmarshalOptions) UnmarshalNext(in *Decoder, out any) error {
+func Unmarshal(in []byte, out any, opts ...Options) (err error) {
+	dec := export.GetBufferedDecoder(in, opts...)
+	defer export.PutBufferedDecoder(dec)
+	xd := export.Decoder(dec)
+	err = unmarshalDecode(dec, out, &xd.Struct, true)
+	if err != nil && xd.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+		return internal.TransformUnmarshalError(out, err)
+	}
+	return err
+}
+
+// UnmarshalRead deserializes a Go value from an [io.Reader] according to the
+// provided unmarshal and decode options (while ignoring marshal or encode options).
+// The input must be a single JSON value with optional whitespace interspersed.
+// It consumes the entirety of [io.Reader] until [io.EOF] is encountered,
+// without reporting an error for EOF. The output must be a non-nil pointer.
+// See [Unmarshal] for details about the conversion of JSON into a Go value.
+func UnmarshalRead(in io.Reader, out any, opts ...Options) (err error) {
+	dec := export.GetStreamingDecoder(in, opts...)
+	defer export.PutStreamingDecoder(dec)
+	xd := export.Decoder(dec)
+	err = unmarshalDecode(dec, out, &xd.Struct, true)
+	if err != nil && xd.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+		return internal.TransformUnmarshalError(out, err)
+	}
+	return err
+}
+
+// UnmarshalDecode deserializes a Go value from a [jsontext.Decoder] according to
+// the provided unmarshal options (while ignoring marshal, encode, or decode options).
+// Any unmarshal options already specified on the [jsontext.Decoder]
+// take lower precedence than the set of options provided by the caller.
+// Unlike [Unmarshal] and [UnmarshalRead], decode options are ignored because
+// they must have already been specified on the provided [jsontext.Decoder].
+//
+// The input may be a stream of one or more JSON values,
+// where this only unmarshals the next JSON value in the stream.
+// The output must be a non-nil pointer.
+// See [Unmarshal] for details about the conversion of JSON into a Go value.
+func UnmarshalDecode(in *jsontext.Decoder, out any, opts ...Options) (err error) {
+	xd := export.Decoder(in)
+	if len(opts) > 0 {
+		optsOriginal := xd.Struct
+		defer func() { xd.Struct = optsOriginal }()
+		xd.Struct.JoinWithoutCoderOptions(opts...)
+	}
+	err = unmarshalDecode(in, out, &xd.Struct, false)
+	if err != nil && xd.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+		return internal.TransformUnmarshalError(out, err)
+	}
+	return err
+}
+
+func unmarshalDecode(in *jsontext.Decoder, out any, uo *jsonopts.Struct, last bool) (err error) {
 	v := reflect.ValueOf(out)
-	if !v.IsValid() || v.Kind() != reflect.Pointer || v.IsNil() {
-		var t reflect.Type
-		if v.IsValid() {
-			t = v.Type()
-			if t.Kind() == reflect.Pointer {
-				t = t.Elem()
+	if v.Kind() != reflect.Pointer || v.IsNil() {
+		return &SemanticError{action: "unmarshal", GoType: reflect.TypeOf(out), Err: internal.ErrNonNilReference}
+	}
+	va := addressableValue{v.Elem(), false} // dereferenced pointer is always addressable
+	t := va.Type()
+
+	// In legacy semantics, the entirety of the next JSON value
+	// was validated before attempting to unmarshal it.
+	if uo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+		if err := export.Decoder(in).CheckNextValue(last); err != nil {
+			if err == io.EOF && last {
+				offset := in.InputOffset() + int64(len(in.UnreadBuffer()))
+				return &jsontext.SyntacticError{ByteOffset: offset, Err: io.ErrUnexpectedEOF}
 			}
+			return err
 		}
-		err := errors.New("value must be passed as a non-nil pointer reference")
-		return &SemanticError{action: "unmarshal", GoType: t, Err: err}
 	}
-	va := addressableValue{v.Elem()} // dereferenced pointer is always addressable
-	t := va.Type()
 
 	// Lookup and call the unmarshal function for this type.
 	unmarshal := lookupArshaler(t).unmarshal
 	if uo.Unmarshalers != nil {
-		unmarshal, _ = uo.Unmarshalers.lookup(unmarshal, t)
+		unmarshal, _ = uo.Unmarshalers.(*Unmarshalers).lookup(unmarshal, t)
 	}
-	if err := unmarshal(uo, in, va); err != nil {
-		if !in.options.AllowDuplicateNames {
-			in.tokens.invalidateDisabledNamespaces()
+	if err := unmarshal(in, va, uo); err != nil {
+		if !uo.Flags.Get(jsonflags.AllowDuplicateNames) {
+			export.Decoder(in).Tokens.InvalidateDisabledNamespaces()
+		}
+		if err == io.EOF && last {
+			offset := in.InputOffset() + int64(len(in.UnreadBuffer()))
+			return &jsontext.SyntacticError{ByteOffset: offset, Err: io.ErrUnexpectedEOF}
 		}
 		return err
 	}
+	if last {
+		return export.Decoder(in).CheckEOF()
+	}
 	return nil
 }
 
@@ -477,17 +503,31 @@ func (uo UnmarshalOptions) UnmarshalNext(in *Decoder, out any) error {
 // There is no compile magic that enforces this property,
 // but rather the need to construct this type makes it easier to examine each
 // construction site to ensure that this property is upheld.
-type addressableValue struct{ reflect.Value }
+type addressableValue struct {
+	reflect.Value
+
+	// forcedAddr reports whether this value is addressable
+	// only through the use of [newAddressableValue].
+	// This is only used for [jsonflags.CallMethodsWithLegacySemantics].
+	forcedAddr bool
+}
 
 // newAddressableValue constructs a new addressable value of type t.
 func newAddressableValue(t reflect.Type) addressableValue {
-	return addressableValue{reflect.New(t).Elem()}
+	return addressableValue{reflect.New(t).Elem(), true}
 }
 
+// TODO: Remove *jsonopts.Struct argument from [marshaler] and [unmarshaler].
+// This can be directly accessed on the encoder or decoder.
+
 // All marshal and unmarshal behavior is implemented using these signatures.
+// The *jsonopts.Struct argument is guaranteed to identical to or at least
+// a strict super-set of the options in Encoder.Struct or Decoder.Struct.
+// It is identical for Marshal, Unmarshal, MarshalWrite, and UnmarshalRead.
+// It is a super-set for MarshalEncode and UnmarshalDecode.
 type (
-	marshaler   = func(MarshalOptions, *Encoder, addressableValue) error
-	unmarshaler = func(UnmarshalOptions, *Decoder, addressableValue) error
+	marshaler   = func(*jsontext.Encoder, addressableValue, *jsonopts.Struct) error
+	unmarshaler = func(*jsontext.Decoder, addressableValue, *jsonopts.Struct) error
 )
 
 type arshaler struct {
@@ -511,3 +551,28 @@ func lookupArshaler(t reflect.Type) *arshaler {
 	v, _ := lookupArshalerCache.LoadOrStore(t, fncs)
 	return v.(*arshaler)
 }
+
+var stringsPools = &sync.Pool{New: func() any { return new(stringSlice) }}
+
+type stringSlice []string
+
+// getStrings returns a non-nil pointer to a slice with length n.
+func getStrings(n int) *stringSlice {
+	s := stringsPools.Get().(*stringSlice)
+	if cap(*s) < n {
+		*s = make([]string, n)
+	}
+	*s = (*s)[:n]
+	return s
+}
+
+func putStrings(s *stringSlice) {
+	if cap(*s) > 1<<10 {
+		*s = nil // avoid pinning arbitrarily large amounts of memory
+	}
+	stringsPools.Put(s)
+}
+
+func (ss *stringSlice) Sort() {
+	slices.SortFunc(*ss, func(x, y string) int { return strings.Compare(x, y) })
+}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_any.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_any.go
index c62b1f3203..fd034c1a1b 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_any.go
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_any.go
@@ -4,47 +4,69 @@
 
 package json
 
-import "reflect"
+import (
+	"cmp"
+	"math"
+	"reflect"
+	"strconv"
 
-// This files contains an optimized marshal and unmarshal implementation
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
+)
+
+// This file contains an optimized marshal and unmarshal implementation
 // for the any type. This type is often used when the Go program has
 // no knowledge of the JSON schema. This is a common enough occurrence
 // to justify the complexity of adding logic for this.
 
-func marshalValueAny(mo MarshalOptions, enc *Encoder, val any) error {
+// marshalValueAny marshals a Go any as a JSON value.
+// This assumes that there are no special formatting directives
+// for any possible nested value.
+func marshalValueAny(enc *jsontext.Encoder, val any, mo *jsonopts.Struct) error {
 	switch val := val.(type) {
 	case nil:
-		return enc.WriteToken(Null)
+		return enc.WriteToken(jsontext.Null)
 	case bool:
-		return enc.WriteToken(Bool(val))
+		return enc.WriteToken(jsontext.Bool(val))
 	case string:
-		return enc.WriteToken(String(val))
+		return enc.WriteToken(jsontext.String(val))
 	case float64:
-		return enc.WriteToken(Float(val))
+		if math.IsNaN(val) || math.IsInf(val, 0) {
+			break // use default logic below
+		}
+		return enc.WriteToken(jsontext.Float(val))
 	case map[string]any:
-		return marshalObjectAny(mo, enc, val)
+		return marshalObjectAny(enc, val, mo)
 	case []any:
-		return marshalArrayAny(mo, enc, val)
-	default:
-		v := newAddressableValue(reflect.TypeOf(val))
-		v.Set(reflect.ValueOf(val))
-		marshal := lookupArshaler(v.Type()).marshal
-		if mo.Marshalers != nil {
-			marshal, _ = mo.Marshalers.lookup(marshal, v.Type())
-		}
-		return marshal(mo, enc, v)
+		return marshalArrayAny(enc, val, mo)
 	}
+
+	v := newAddressableValue(reflect.TypeOf(val))
+	v.Set(reflect.ValueOf(val))
+	marshal := lookupArshaler(v.Type()).marshal
+	if mo.Marshalers != nil {
+		marshal, _ = mo.Marshalers.(*Marshalers).lookup(marshal, v.Type())
+	}
+	return marshal(enc, v, mo)
 }
 
-func unmarshalValueAny(uo UnmarshalOptions, dec *Decoder) (any, error) {
+// unmarshalValueAny unmarshals a JSON value as a Go any.
+// This assumes that there are no special formatting directives
+// for any possible nested value.
+// Duplicate names must be rejected since this does not implement merging.
+func unmarshalValueAny(dec *jsontext.Decoder, uo *jsonopts.Struct) (any, error) {
 	switch k := dec.PeekKind(); k {
 	case '{':
-		return unmarshalObjectAny(uo, dec)
+		return unmarshalObjectAny(dec, uo)
 	case '[':
-		return unmarshalArrayAny(uo, dec)
+		return unmarshalArrayAny(dec, uo)
 	default:
-		var flags valueFlags
-		val, err := dec.readValue(&flags)
+		xd := export.Decoder(dec)
+		var flags jsonwire.ValueFlags
+		val, err := xd.ReadValue(&flags)
 		if err != nil {
 			return nil, err
 		}
@@ -56,13 +78,19 @@ func unmarshalValueAny(uo UnmarshalOptions, dec *Decoder) (any, error) {
 		case 't':
 			return true, nil
 		case '"':
-			val = unescapeStringMayCopy(val, flags.isVerbatim())
-			if dec.stringCache == nil {
-				dec.stringCache = new(stringCache)
+			val = jsonwire.UnquoteMayCopy(val, flags.IsVerbatim())
+			if xd.StringCache == nil {
+				xd.StringCache = new(stringCache)
 			}
-			return dec.stringCache.make(val), nil
+			return makeString(xd.StringCache, val), nil
 		case '0':
-			fv, _ := parseFloat(val, 64) // ignore error since readValue guarantees val is valid
+			if uo.Flags.Get(jsonflags.UnmarshalAnyWithRawNumber) {
+				return internal.RawNumberOf(val), nil
+			}
+			fv, ok := jsonwire.ParseFloat(val, 64)
+			if !ok {
+				return fv, newUnmarshalErrorAfterWithValue(dec, float64Type, strconv.ErrRange)
+			}
 			return fv, nil
 		default:
 			panic("BUG: invalid kind: " + k.String())
@@ -70,41 +98,49 @@ func unmarshalValueAny(uo UnmarshalOptions, dec *Decoder) (any, error) {
 	}
 }
 
-func marshalObjectAny(mo MarshalOptions, enc *Encoder, obj map[string]any) error {
+// marshalObjectAny marshals a Go map[string]any as a JSON object
+// (or as a JSON null if nil and [jsonflags.FormatNilMapAsNull]).
+func marshalObjectAny(enc *jsontext.Encoder, obj map[string]any, mo *jsonopts.Struct) error {
 	// Check for cycles.
-	if enc.tokens.depth() > startDetectingCyclesAfter {
+	xe := export.Encoder(enc)
+	if xe.Tokens.Depth() > startDetectingCyclesAfter {
 		v := reflect.ValueOf(obj)
-		if err := enc.seenPointers.visit(v); err != nil {
-			return err
+		if err := visitPointer(&xe.SeenPointers, v); err != nil {
+			return newMarshalErrorBefore(enc, mapStringAnyType, err)
 		}
-		defer enc.seenPointers.leave(v)
+		defer leavePointer(&xe.SeenPointers, v)
 	}
 
-	// Optimize for marshaling an empty map without any preceding whitespace.
-	if len(obj) == 0 && !enc.options.multiline && !enc.tokens.last.needObjectName() {
-		enc.buf = enc.tokens.mayAppendDelim(enc.buf, '{')
-		enc.buf = append(enc.buf, "{}"...)
-		enc.tokens.last.increment()
-		if enc.needFlush() {
-			return enc.flush()
+	// Handle empty maps.
+	if len(obj) == 0 {
+		if mo.Flags.Get(jsonflags.FormatNilMapAsNull) && obj == nil {
+			return enc.WriteToken(jsontext.Null)
+		}
+		// Optimize for marshaling an empty map without any preceding whitespace.
+		if !mo.Flags.Get(jsonflags.AnyWhitespace) && !xe.Tokens.Last.NeedObjectName() {
+			xe.Buf = append(xe.Tokens.MayAppendDelim(xe.Buf, '{'), "{}"...)
+			xe.Tokens.Last.Increment()
+			if xe.NeedFlush() {
+				return xe.Flush()
+			}
+			return nil
 		}
-		return nil
 	}
 
-	if err := enc.WriteToken(ObjectStart); err != nil {
+	if err := enc.WriteToken(jsontext.BeginObject); err != nil {
 		return err
 	}
 	// A Go map guarantees that each entry has a unique key
 	// The only possibility of duplicates is due to invalid UTF-8.
-	if !enc.options.AllowInvalidUTF8 {
-		enc.tokens.last.disableNamespace()
+	if !mo.Flags.Get(jsonflags.AllowInvalidUTF8) {
+		xe.Tokens.Last.DisableNamespace()
 	}
-	if !mo.Deterministic || len(obj) <= 1 {
+	if !mo.Flags.Get(jsonflags.Deterministic) || len(obj) <= 1 {
 		for name, val := range obj {
-			if err := enc.WriteToken(String(name)); err != nil {
+			if err := enc.WriteToken(jsontext.String(name)); err != nil {
 				return err
 			}
-			if err := marshalValueAny(mo, enc, val); err != nil {
+			if err := marshalValueAny(enc, val, mo); err != nil {
 				return err
 			}
 		}
@@ -117,122 +153,133 @@ func marshalObjectAny(mo MarshalOptions, enc *Encoder, obj map[string]any) error
 		}
 		names.Sort()
 		for _, name := range *names {
-			if err := enc.WriteToken(String(name)); err != nil {
+			if err := enc.WriteToken(jsontext.String(name)); err != nil {
 				return err
 			}
-			if err := marshalValueAny(mo, enc, obj[name]); err != nil {
+			if err := marshalValueAny(enc, obj[name], mo); err != nil {
 				return err
 			}
 		}
 		putStrings(names)
 	}
-	if err := enc.WriteToken(ObjectEnd); err != nil {
+	if err := enc.WriteToken(jsontext.EndObject); err != nil {
 		return err
 	}
 	return nil
 }
 
-func unmarshalObjectAny(uo UnmarshalOptions, dec *Decoder) (map[string]any, error) {
-	tok, err := dec.ReadToken()
-	if err != nil {
+// unmarshalObjectAny unmarshals a JSON object as a Go map[string]any.
+// It panics if not decoding a JSON object.
+func unmarshalObjectAny(dec *jsontext.Decoder, uo *jsonopts.Struct) (map[string]any, error) {
+	switch tok, err := dec.ReadToken(); {
+	case err != nil:
 		return nil, err
+	case tok.Kind() != '{':
+		panic("BUG: invalid kind: " + tok.Kind().String())
 	}
-	k := tok.Kind()
-	switch k {
-	case 'n':
-		return nil, nil
-	case '{':
-		obj := make(map[string]any)
-		// A Go map guarantees that each entry has a unique key
-		// The only possibility of duplicates is due to invalid UTF-8.
-		if !dec.options.AllowInvalidUTF8 {
-			dec.tokens.last.disableNamespace()
-		}
-		for dec.PeekKind() != '}' {
-			tok, err := dec.ReadToken()
-			if err != nil {
-				return obj, err
-			}
-			name := tok.String()
+	obj := make(map[string]any)
+	// A Go map guarantees that each entry has a unique key
+	// The only possibility of duplicates is due to invalid UTF-8.
+	if !uo.Flags.Get(jsonflags.AllowInvalidUTF8) {
+		export.Decoder(dec).Tokens.Last.DisableNamespace()
+	}
+	var errUnmarshal error
+	for dec.PeekKind() != '}' {
+		tok, err := dec.ReadToken()
+		if err != nil {
+			return obj, err
+		}
+		name := tok.String()
 
-			// Manually check for duplicate names.
-			if _, ok := obj[name]; ok {
-				name := dec.previousBuffer()
-				err := &SyntacticError{str: "duplicate name " + string(name) + " in object"}
-				return obj, err.withOffset(dec.InputOffset() - int64(len(name)))
-			}
+		// Manually check for duplicate names.
+		if _, ok := obj[name]; ok {
+			// TODO: Unread the object name.
+			name := export.Decoder(dec).PreviousTokenOrValue()
+			err := newDuplicateNameError(dec.StackPointer(), nil, dec.InputOffset()-len64(name))
+			return obj, err
+		}
 
-			val, err := unmarshalValueAny(uo, dec)
-			obj[name] = val
-			if err != nil {
+		val, err := unmarshalValueAny(dec, uo)
+		obj[name] = val
+		if err != nil {
+			if isFatalError(err, uo.Flags) {
 				return obj, err
 			}
+			errUnmarshal = cmp.Or(err, errUnmarshal)
 		}
-		if _, err := dec.ReadToken(); err != nil {
-			return obj, err
-		}
-		return obj, nil
 	}
-	return nil, &SemanticError{action: "unmarshal", JSONKind: k, GoType: mapStringAnyType}
+	if _, err := dec.ReadToken(); err != nil {
+		return obj, err
+	}
+	return obj, errUnmarshal
 }
 
-func marshalArrayAny(mo MarshalOptions, enc *Encoder, arr []any) error {
+// marshalArrayAny marshals a Go []any as a JSON array
+// (or as a JSON null if nil and [jsonflags.FormatNilSliceAsNull]).
+func marshalArrayAny(enc *jsontext.Encoder, arr []any, mo *jsonopts.Struct) error {
 	// Check for cycles.
-	if enc.tokens.depth() > startDetectingCyclesAfter {
+	xe := export.Encoder(enc)
+	if xe.Tokens.Depth() > startDetectingCyclesAfter {
 		v := reflect.ValueOf(arr)
-		if err := enc.seenPointers.visit(v); err != nil {
-			return err
+		if err := visitPointer(&xe.SeenPointers, v); err != nil {
+			return newMarshalErrorBefore(enc, sliceAnyType, err)
 		}
-		defer enc.seenPointers.leave(v)
+		defer leavePointer(&xe.SeenPointers, v)
 	}
 
-	// Optimize for marshaling an empty slice without any preceding whitespace.
-	if len(arr) == 0 && !enc.options.multiline && !enc.tokens.last.needObjectName() {
-		enc.buf = enc.tokens.mayAppendDelim(enc.buf, '[')
-		enc.buf = append(enc.buf, "[]"...)
-		enc.tokens.last.increment()
-		if enc.needFlush() {
-			return enc.flush()
+	// Handle empty slices.
+	if len(arr) == 0 {
+		if mo.Flags.Get(jsonflags.FormatNilSliceAsNull) && arr == nil {
+			return enc.WriteToken(jsontext.Null)
+		}
+		// Optimize for marshaling an empty slice without any preceding whitespace.
+		if !mo.Flags.Get(jsonflags.AnyWhitespace) && !xe.Tokens.Last.NeedObjectName() {
+			xe.Buf = append(xe.Tokens.MayAppendDelim(xe.Buf, '['), "[]"...)
+			xe.Tokens.Last.Increment()
+			if xe.NeedFlush() {
+				return xe.Flush()
+			}
+			return nil
 		}
-		return nil
 	}
 
-	if err := enc.WriteToken(ArrayStart); err != nil {
+	if err := enc.WriteToken(jsontext.BeginArray); err != nil {
 		return err
 	}
 	for _, val := range arr {
-		if err := marshalValueAny(mo, enc, val); err != nil {
+		if err := marshalValueAny(enc, val, mo); err != nil {
 			return err
 		}
 	}
-	if err := enc.WriteToken(ArrayEnd); err != nil {
+	if err := enc.WriteToken(jsontext.EndArray); err != nil {
 		return err
 	}
 	return nil
 }
 
-func unmarshalArrayAny(uo UnmarshalOptions, dec *Decoder) ([]any, error) {
-	tok, err := dec.ReadToken()
-	if err != nil {
+// unmarshalArrayAny unmarshals a JSON array as a Go []any.
+// It panics if not decoding a JSON array.
+func unmarshalArrayAny(dec *jsontext.Decoder, uo *jsonopts.Struct) ([]any, error) {
+	switch tok, err := dec.ReadToken(); {
+	case err != nil:
 		return nil, err
+	case tok.Kind() != '[':
+		panic("BUG: invalid kind: " + tok.Kind().String())
 	}
-	k := tok.Kind()
-	switch k {
-	case 'n':
-		return nil, nil
-	case '[':
-		arr := []any{}
-		for dec.PeekKind() != ']' {
-			val, err := unmarshalValueAny(uo, dec)
-			arr = append(arr, val)
-			if err != nil {
+	arr := []any{}
+	var errUnmarshal error
+	for dec.PeekKind() != ']' {
+		val, err := unmarshalValueAny(dec, uo)
+		arr = append(arr, val)
+		if err != nil {
+			if isFatalError(err, uo.Flags) {
 				return arr, err
 			}
+			errUnmarshal = cmp.Or(errUnmarshal, err)
 		}
-		if _, err := dec.ReadToken(); err != nil {
-			return arr, err
-		}
-		return arr, nil
 	}
-	return nil, &SemanticError{action: "unmarshal", JSONKind: k, GoType: sliceAnyType}
+	if _, err := dec.ReadToken(); err != nil {
+		return arr, err
+	}
+	return arr, errUnmarshal
 }
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_default.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_default.go
index fd26eba352..3f21c8d350 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_default.go
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_default.go
@@ -6,6 +6,8 @@ package json
 
 import (
 	"bytes"
+	"cmp"
+	"encoding"
 	"encoding/base32"
 	"encoding/base64"
 	"encoding/hex"
@@ -13,9 +15,16 @@ import (
 	"fmt"
 	"math"
 	"reflect"
-	"sort"
+	"slices"
 	"strconv"
+	"strings"
 	"sync"
+
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 // optimizeCommon specifies whether to use optimizations targeted for certain
@@ -25,44 +34,56 @@ const optimizeCommon = true
 
 var (
 	// Most natural Go type that correspond with each JSON type.
-	anyType          = reflect.TypeOf((*any)(nil)).Elem()            // JSON value
-	boolType         = reflect.TypeOf((*bool)(nil)).Elem()           // JSON bool
-	stringType       = reflect.TypeOf((*string)(nil)).Elem()         // JSON string
-	float64Type      = reflect.TypeOf((*float64)(nil)).Elem()        // JSON number
-	mapStringAnyType = reflect.TypeOf((*map[string]any)(nil)).Elem() // JSON object
-	sliceAnyType     = reflect.TypeOf((*[]any)(nil)).Elem()          // JSON array
-
-	bytesType       = reflect.TypeOf((*[]byte)(nil)).Elem()
-	emptyStructType = reflect.TypeOf((*struct{})(nil)).Elem()
+	anyType          = reflect.TypeFor[any]()            // JSON value
+	boolType         = reflect.TypeFor[bool]()           // JSON bool
+	stringType       = reflect.TypeFor[string]()         // JSON string
+	float64Type      = reflect.TypeFor[float64]()        // JSON number
+	mapStringAnyType = reflect.TypeFor[map[string]any]() // JSON object
+	sliceAnyType     = reflect.TypeFor[[]any]()          // JSON array
+
+	bytesType       = reflect.TypeFor[[]byte]()
+	emptyStructType = reflect.TypeFor[struct{}]()
 )
 
 const startDetectingCyclesAfter = 1000
 
-type seenPointers map[typedPointer]struct{}
+type seenPointers = map[any]struct{}
 
 type typedPointer struct {
 	typ reflect.Type
 	ptr any // always stores unsafe.Pointer, but avoids depending on unsafe
+	len int // remember slice length to avoid false positives
 }
 
-// visit visits pointer p of type t, reporting an error if seen before.
+// visitPointer visits pointer p of type t, reporting an error if seen before.
 // If successfully visited, then the caller must eventually call leave.
-func (m *seenPointers) visit(v reflect.Value) error {
-	p := typedPointer{v.Type(), v.UnsafePointer()}
+func visitPointer(m *seenPointers, v reflect.Value) error {
+	p := typedPointer{v.Type(), v.UnsafePointer(), sliceLen(v)}
 	if _, ok := (*m)[p]; ok {
-		return &SemanticError{action: "marshal", GoType: p.typ, Err: errors.New("encountered a cycle")}
+		return internal.ErrCycle
 	}
 	if *m == nil {
-		*m = make(map[typedPointer]struct{})
+		*m = make(seenPointers)
 	}
 	(*m)[p] = struct{}{}
 	return nil
 }
-func (m *seenPointers) leave(v reflect.Value) {
-	p := typedPointer{v.Type(), v.UnsafePointer()}
+func leavePointer(m *seenPointers, v reflect.Value) {
+	p := typedPointer{v.Type(), v.UnsafePointer(), sliceLen(v)}
 	delete(*m, p)
 }
 
+func sliceLen(v reflect.Value) int {
+	if v.Kind() == reflect.Slice {
+		return v.Len()
+	}
+	return 0
+}
+
+func len64[Bytes ~[]byte | ~string](in Bytes) int64 {
+	return int64(len(in))
+}
+
 func makeDefaultArshaler(t reflect.Type) *arshaler {
 	switch t.Kind() {
 	case reflect.Bool:
@@ -71,7 +92,7 @@ func makeDefaultArshaler(t reflect.Type) *arshaler {
 		return makeStringArshaler(t)
 	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
 		return makeIntArshaler(t)
-	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
 		return makeUintArshaler(t)
 	case reflect.Float32, reflect.Float64:
 		return makeFloatArshaler(t)
@@ -81,13 +102,13 @@ func makeDefaultArshaler(t reflect.Type) *arshaler {
 		return makeStructArshaler(t)
 	case reflect.Slice:
 		fncs := makeSliceArshaler(t)
-		if t.AssignableTo(bytesType) {
+		if t.Elem().Kind() == reflect.Uint8 {
 			return makeBytesArshaler(t, fncs)
 		}
 		return fncs
 	case reflect.Array:
 		fncs := makeArrayArshaler(t)
-		if reflect.SliceOf(t.Elem()).AssignableTo(bytesType) {
+		if t.Elem().Kind() == reflect.Uint8 {
 			return makeBytesArshaler(t, fncs)
 		}
 		return fncs
@@ -102,31 +123,35 @@ func makeDefaultArshaler(t reflect.Type) *arshaler {
 
 func makeBoolArshaler(t reflect.Type) *arshaler {
 	var fncs arshaler
-	fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
-		if mo.format != "" && mo.formatDepth == enc.tokens.depth() {
-			return newInvalidFormatError("marshal", t, mo.format)
+	fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
+		xe := export.Encoder(enc)
+		if mo.Format != "" && mo.FormatDepth == xe.Tokens.Depth() {
+			return newInvalidFormatError(enc, t)
 		}
 
 		// Optimize for marshaling without preceding whitespace.
-		if optimizeCommon && !enc.options.multiline && !enc.tokens.last.needObjectName() {
-			enc.buf = enc.tokens.mayAppendDelim(enc.buf, 't')
-			if va.Bool() {
-				enc.buf = append(enc.buf, "true"...)
-			} else {
-				enc.buf = append(enc.buf, "false"...)
-			}
-			enc.tokens.last.increment()
-			if enc.needFlush() {
-				return enc.flush()
+		if optimizeCommon && !mo.Flags.Get(jsonflags.AnyWhitespace|jsonflags.StringifyBoolsAndStrings) && !xe.Tokens.Last.NeedObjectName() {
+			xe.Buf = strconv.AppendBool(xe.Tokens.MayAppendDelim(xe.Buf, 't'), va.Bool())
+			xe.Tokens.Last.Increment()
+			if xe.NeedFlush() {
+				return xe.Flush()
 			}
 			return nil
 		}
 
-		return enc.WriteToken(Bool(va.Bool()))
+		if mo.Flags.Get(jsonflags.StringifyBoolsAndStrings) {
+			if va.Bool() {
+				return enc.WriteToken(jsontext.String("true"))
+			} else {
+				return enc.WriteToken(jsontext.String("false"))
+			}
+		}
+		return enc.WriteToken(jsontext.Bool(va.Bool()))
 	}
-	fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-		if uo.format != "" && uo.formatDepth == dec.tokens.depth() {
-			return newInvalidFormatError("unmarshal", t, uo.format)
+	fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+		xd := export.Decoder(dec)
+		if uo.Format != "" && uo.FormatDepth == xd.Tokens.Depth() {
+			return newInvalidFormatError(dec, t)
 		}
 		tok, err := dec.ReadToken()
 		if err != nil {
@@ -135,187 +160,267 @@ func makeBoolArshaler(t reflect.Type) *arshaler {
 		k := tok.Kind()
 		switch k {
 		case 'n':
-			va.SetBool(false)
+			if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+				va.SetBool(false)
+			}
 			return nil
 		case 't', 'f':
-			va.SetBool(tok.Bool())
-			return nil
+			if !uo.Flags.Get(jsonflags.StringifyBoolsAndStrings) {
+				va.SetBool(tok.Bool())
+				return nil
+			}
+		case '"':
+			if uo.Flags.Get(jsonflags.StringifyBoolsAndStrings) {
+				switch tok.String() {
+				case "true":
+					va.SetBool(true)
+				case "false":
+					va.SetBool(false)
+				default:
+					if uo.Flags.Get(jsonflags.StringifyWithLegacySemantics) && tok.String() == "null" {
+						if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+							va.SetBool(false)
+						}
+						return nil
+					}
+					return newUnmarshalErrorAfterWithValue(dec, t, strconv.ErrSyntax)
+				}
+				return nil
+			}
 		}
-		return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t}
+		return newUnmarshalErrorAfterWithSkipping(dec, t, nil)
 	}
 	return &fncs
 }
 
 func makeStringArshaler(t reflect.Type) *arshaler {
 	var fncs arshaler
-	fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
-		if mo.format != "" && mo.formatDepth == enc.tokens.depth() {
-			return newInvalidFormatError("marshal", t, mo.format)
+	fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
+		xe := export.Encoder(enc)
+		if mo.Format != "" && mo.FormatDepth == xe.Tokens.Depth() {
+			return newInvalidFormatError(enc, t)
+		}
+
+		// Optimize for marshaling without preceding whitespace.
+		s := va.String()
+		if optimizeCommon && !mo.Flags.Get(jsonflags.AnyWhitespace|jsonflags.StringifyBoolsAndStrings) && !xe.Tokens.Last.NeedObjectName() {
+			b := xe.Buf
+			b = xe.Tokens.MayAppendDelim(b, '"')
+			b, err := jsonwire.AppendQuote(b, s, &mo.Flags)
+			if err == nil {
+				xe.Buf = b
+				xe.Tokens.Last.Increment()
+				if xe.NeedFlush() {
+					return xe.Flush()
+				}
+				return nil
+			}
+			// Otherwise, the string contains invalid UTF-8,
+			// so let the logic below construct the proper error.
 		}
-		return enc.WriteToken(String(va.String()))
+
+		if mo.Flags.Get(jsonflags.StringifyBoolsAndStrings) {
+			b, err := jsonwire.AppendQuote(nil, s, &mo.Flags)
+			if err != nil {
+				return newMarshalErrorBefore(enc, t, &jsontext.SyntacticError{Err: err})
+			}
+			q, err := jsontext.AppendQuote(nil, b)
+			if err != nil {
+				panic("BUG: second AppendQuote should never fail: " + err.Error())
+			}
+			return enc.WriteValue(q)
+		}
+		return enc.WriteToken(jsontext.String(s))
 	}
-	fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-		if uo.format != "" && uo.formatDepth == dec.tokens.depth() {
-			return newInvalidFormatError("unmarshal", t, uo.format)
+	fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+		xd := export.Decoder(dec)
+		if uo.Format != "" && uo.FormatDepth == xd.Tokens.Depth() {
+			return newInvalidFormatError(dec, t)
 		}
-		var flags valueFlags
-		val, err := dec.readValue(&flags)
+		var flags jsonwire.ValueFlags
+		val, err := xd.ReadValue(&flags)
 		if err != nil {
 			return err
 		}
 		k := val.Kind()
 		switch k {
 		case 'n':
-			va.SetString("")
+			if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+				va.SetString("")
+			}
 			return nil
 		case '"':
-			val = unescapeStringMayCopy(val, flags.isVerbatim())
-			if dec.stringCache == nil {
-				dec.stringCache = new(stringCache)
+			val = jsonwire.UnquoteMayCopy(val, flags.IsVerbatim())
+			if uo.Flags.Get(jsonflags.StringifyBoolsAndStrings) {
+				val, err = jsontext.AppendUnquote(nil, val)
+				if err != nil {
+					return newUnmarshalErrorAfter(dec, t, err)
+				}
+				if uo.Flags.Get(jsonflags.StringifyWithLegacySemantics) && string(val) == "null" {
+					if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+						va.SetString("")
+					}
+					return nil
+				}
+			}
+			if xd.StringCache == nil {
+				xd.StringCache = new(stringCache)
 			}
-			str := dec.stringCache.make(val)
+			str := makeString(xd.StringCache, val)
 			va.SetString(str)
 			return nil
 		}
-		return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t}
+		return newUnmarshalErrorAfter(dec, t, nil)
 	}
 	return &fncs
 }
 
 var (
-	encodeBase16        = func(dst, src []byte) { hex.Encode(dst, src) }
-	encodeBase32        = base32.StdEncoding.Encode
-	encodeBase32Hex     = base32.HexEncoding.Encode
-	encodeBase64        = base64.StdEncoding.Encode
-	encodeBase64URL     = base64.URLEncoding.Encode
-	encodedLenBase16    = hex.EncodedLen
-	encodedLenBase32    = base32.StdEncoding.EncodedLen
-	encodedLenBase32Hex = base32.HexEncoding.EncodedLen
-	encodedLenBase64    = base64.StdEncoding.EncodedLen
-	encodedLenBase64URL = base64.URLEncoding.EncodedLen
-	decodeBase16        = hex.Decode
-	decodeBase32        = base32.StdEncoding.Decode
-	decodeBase32Hex     = base32.HexEncoding.Decode
-	decodeBase64        = base64.StdEncoding.Decode
-	decodeBase64URL     = base64.URLEncoding.Decode
-	decodedLenBase16    = hex.DecodedLen
-	decodedLenBase32    = base32.StdEncoding.WithPadding(base32.NoPadding).DecodedLen
-	decodedLenBase32Hex = base32.HexEncoding.WithPadding(base32.NoPadding).DecodedLen
-	decodedLenBase64    = base64.StdEncoding.WithPadding(base64.NoPadding).DecodedLen
-	decodedLenBase64URL = base64.URLEncoding.WithPadding(base64.NoPadding).DecodedLen
+	appendEncodeBase16    = hex.AppendEncode
+	appendEncodeBase32    = base32.StdEncoding.AppendEncode
+	appendEncodeBase32Hex = base32.HexEncoding.AppendEncode
+	appendEncodeBase64    = base64.StdEncoding.AppendEncode
+	appendEncodeBase64URL = base64.URLEncoding.AppendEncode
+	encodedLenBase16      = hex.EncodedLen
+	encodedLenBase32      = base32.StdEncoding.EncodedLen
+	encodedLenBase32Hex   = base32.HexEncoding.EncodedLen
+	encodedLenBase64      = base64.StdEncoding.EncodedLen
+	encodedLenBase64URL   = base64.URLEncoding.EncodedLen
+	appendDecodeBase16    = hex.AppendDecode
+	appendDecodeBase32    = base32.StdEncoding.AppendDecode
+	appendDecodeBase32Hex = base32.HexEncoding.AppendDecode
+	appendDecodeBase64    = base64.StdEncoding.AppendDecode
+	appendDecodeBase64URL = base64.URLEncoding.AppendDecode
 )
 
 func makeBytesArshaler(t reflect.Type, fncs *arshaler) *arshaler {
-	// NOTE: This handles both []byte and [N]byte.
-	marshalDefault := fncs.marshal
-	fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
-		encode, encodedLen := encodeBase64, encodedLenBase64
-		if mo.format != "" && mo.formatDepth == enc.tokens.depth() {
-			switch mo.format {
+	// NOTE: This handles both []~byte and [N]~byte.
+	// The v2 default is to treat a []namedByte as equivalent to []T
+	// since being able to convert []namedByte to []byte relies on
+	// dubious Go reflection behavior (see https://go.dev/issue/24746).
+	// For v1 emulation, we use jsonflags.FormatBytesWithLegacySemantics
+	// to forcibly treat []namedByte as a []byte.
+	marshalArray := fncs.marshal
+	isNamedByte := t.Elem().PkgPath() != ""
+	hasMarshaler := implementsAny(t.Elem(), allMarshalerTypes...)
+	fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
+		if !mo.Flags.Get(jsonflags.FormatBytesWithLegacySemantics) && isNamedByte {
+			return marshalArray(enc, va, mo) // treat as []T or [N]T
+		}
+		xe := export.Encoder(enc)
+		appendEncode := appendEncodeBase64
+		if mo.Format != "" && mo.FormatDepth == xe.Tokens.Depth() {
+			switch mo.Format {
 			case "base64":
-				encode, encodedLen = encodeBase64, encodedLenBase64
+				appendEncode = appendEncodeBase64
 			case "base64url":
-				encode, encodedLen = encodeBase64URL, encodedLenBase64URL
+				appendEncode = appendEncodeBase64URL
 			case "base32":
-				encode, encodedLen = encodeBase32, encodedLenBase32
+				appendEncode = appendEncodeBase32
 			case "base32hex":
-				encode, encodedLen = encodeBase32Hex, encodedLenBase32Hex
+				appendEncode = appendEncodeBase32Hex
 			case "base16", "hex":
-				encode, encodedLen = encodeBase16, encodedLenBase16
+				appendEncode = appendEncodeBase16
 			case "array":
-				mo.format = ""
-				return marshalDefault(mo, enc, va)
+				mo.Format = ""
+				return marshalArray(enc, va, mo)
 			default:
-				return newInvalidFormatError("marshal", t, mo.format)
+				return newInvalidFormatError(enc, t)
 			}
+		} else if mo.Flags.Get(jsonflags.FormatByteArrayAsArray) && va.Kind() == reflect.Array {
+			return marshalArray(enc, va, mo)
+		} else if mo.Flags.Get(jsonflags.FormatBytesWithLegacySemantics) && hasMarshaler {
+			return marshalArray(enc, va, mo)
 		}
-		val := enc.UnusedBuffer()
-		b := va.Bytes()
-		n := len(`"`) + encodedLen(len(b)) + len(`"`)
-		if cap(val) < n {
-			val = make([]byte, n)
-		} else {
-			val = val[:n]
+		if mo.Flags.Get(jsonflags.FormatNilSliceAsNull) && va.Kind() == reflect.Slice && va.IsNil() {
+			// TODO: Provide a "emitempty" format override?
+			return enc.WriteToken(jsontext.Null)
 		}
-		val[0] = '"'
-		encode(val[len(`"`):len(val)-len(`"`)], b)
-		val[len(val)-1] = '"'
-		return enc.WriteValue(val)
+		return xe.AppendRaw('"', true, func(b []byte) ([]byte, error) {
+			return appendEncode(b, va.Bytes()), nil
+		})
 	}
-	unmarshalDefault := fncs.unmarshal
-	fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-		decode, decodedLen, encodedLen := decodeBase64, decodedLenBase64, encodedLenBase64
-		if uo.format != "" && uo.formatDepth == dec.tokens.depth() {
-			switch uo.format {
+	unmarshalArray := fncs.unmarshal
+	fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+		if !uo.Flags.Get(jsonflags.FormatBytesWithLegacySemantics) && isNamedByte {
+			return unmarshalArray(dec, va, uo) // treat as []T or [N]T
+		}
+		xd := export.Decoder(dec)
+		appendDecode, encodedLen := appendDecodeBase64, encodedLenBase64
+		if uo.Format != "" && uo.FormatDepth == xd.Tokens.Depth() {
+			switch uo.Format {
 			case "base64":
-				decode, decodedLen, encodedLen = decodeBase64, decodedLenBase64, encodedLenBase64
+				appendDecode, encodedLen = appendDecodeBase64, encodedLenBase64
 			case "base64url":
-				decode, decodedLen, encodedLen = decodeBase64URL, decodedLenBase64URL, encodedLenBase64URL
+				appendDecode, encodedLen = appendDecodeBase64URL, encodedLenBase64URL
 			case "base32":
-				decode, decodedLen, encodedLen = decodeBase32, decodedLenBase32, encodedLenBase32
+				appendDecode, encodedLen = appendDecodeBase32, encodedLenBase32
 			case "base32hex":
-				decode, decodedLen, encodedLen = decodeBase32Hex, decodedLenBase32Hex, encodedLenBase32Hex
+				appendDecode, encodedLen = appendDecodeBase32Hex, encodedLenBase32Hex
 			case "base16", "hex":
-				decode, decodedLen, encodedLen = decodeBase16, decodedLenBase16, encodedLenBase16
+				appendDecode, encodedLen = appendDecodeBase16, encodedLenBase16
 			case "array":
-				uo.format = ""
-				return unmarshalDefault(uo, dec, va)
+				uo.Format = ""
+				return unmarshalArray(dec, va, uo)
 			default:
-				return newInvalidFormatError("unmarshal", t, uo.format)
+				return newInvalidFormatError(dec, t)
 			}
+		} else if uo.Flags.Get(jsonflags.FormatByteArrayAsArray) && va.Kind() == reflect.Array {
+			return unmarshalArray(dec, va, uo)
+		} else if uo.Flags.Get(jsonflags.FormatBytesWithLegacySemantics) && dec.PeekKind() == '[' {
+			return unmarshalArray(dec, va, uo)
 		}
-		var flags valueFlags
-		val, err := dec.readValue(&flags)
+		var flags jsonwire.ValueFlags
+		val, err := xd.ReadValue(&flags)
 		if err != nil {
 			return err
 		}
 		k := val.Kind()
 		switch k {
 		case 'n':
-			va.Set(reflect.Zero(t))
+			if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) || va.Kind() != reflect.Array {
+				va.SetZero()
+			}
 			return nil
 		case '"':
-			val = unescapeStringMayCopy(val, flags.isVerbatim())
-
-			// For base64 and base32, decodedLen computes the maximum output size
-			// when given the original input size. To compute the exact size,
-			// adjust the input size by excluding trailing padding characters.
-			// This is unnecessary for base16, but also harmless.
-			n := len(val)
-			for n > 0 && val[n-1] == '=' {
-				n--
-			}
-			n = decodedLen(n)
-			b := va.Bytes()
-			if va.Kind() == reflect.Array {
-				if n != len(b) {
-					err := fmt.Errorf("decoded base64 length of %d mismatches array length of %d", n, len(b))
-					return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t, Err: err}
-				}
-			} else {
-				if b == nil || cap(b) < n {
-					b = make([]byte, n)
-				} else {
-					b = b[:n]
-				}
+			// NOTE: The v2 default is to strictly comply with RFC 4648.
+			// Section 3.2 specifies that padding is required.
+			// Section 3.3 specifies that non-alphabet characters
+			// (e.g., '\r' or '\n') must be rejected.
+			// Section 3.5 specifies that unnecessary non-zero bits in
+			// the last quantum may be rejected. Since this is optional,
+			// we do not reject such inputs.
+			val = jsonwire.UnquoteMayCopy(val, flags.IsVerbatim())
+			b, err := appendDecode(va.Bytes()[:0], val)
+			if err != nil {
+				return newUnmarshalErrorAfter(dec, t, err)
 			}
-			n2, err := decode(b, val)
-			if err == nil && len(val) != encodedLen(n2) {
+			if len(val) != encodedLen(len(b)) && !uo.Flags.Get(jsonflags.ParseBytesWithLooseRFC4648) {
 				// TODO(https://go.dev/issue/53845): RFC 4648, section 3.3,
 				// specifies that non-alphabet characters must be rejected.
 				// Unfortunately, the "base32" and "base64" packages allow
 				// '\r' and '\n' characters by default.
-				err = errors.New("illegal data at input byte " + strconv.Itoa(bytes.IndexAny(val, "\r\n")))
-			}
-			if err != nil {
-				return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t, Err: err}
+				i := bytes.IndexAny(val, "\r\n")
+				err := fmt.Errorf("illegal character %s at offset %d", jsonwire.QuoteRune(val[i:]), i)
+				return newUnmarshalErrorAfter(dec, t, err)
 			}
-			if va.Kind() == reflect.Slice {
+
+			if va.Kind() == reflect.Array {
+				dst := va.Bytes()
+				clear(dst[copy(dst, b):]) // noop if len(b) <= len(dst)
+				if len(b) != len(dst) && !uo.Flags.Get(jsonflags.UnmarshalArrayFromAnyLength) {
+					err := fmt.Errorf("decoded length of %d mismatches array length of %d", len(b), len(dst))
+					return newUnmarshalErrorAfter(dec, t, err)
+				}
+			} else {
+				if b == nil {
+					b = []byte{}
+				}
 				va.SetBytes(b)
 			}
 			return nil
 		}
-		return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t}
+		return newUnmarshalErrorAfter(dec, t, nil)
 	}
 	return fncs
 }
@@ -323,64 +428,77 @@ func makeBytesArshaler(t reflect.Type, fncs *arshaler) *arshaler {
 func makeIntArshaler(t reflect.Type) *arshaler {
 	var fncs arshaler
 	bits := t.Bits()
-	fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
-		if mo.format != "" && mo.formatDepth == enc.tokens.depth() {
-			return newInvalidFormatError("marshal", t, mo.format)
+	fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
+		xe := export.Encoder(enc)
+		if mo.Format != "" && mo.FormatDepth == xe.Tokens.Depth() {
+			return newInvalidFormatError(enc, t)
 		}
 
 		// Optimize for marshaling without preceding whitespace or string escaping.
-		if optimizeCommon && !enc.options.multiline && !mo.StringifyNumbers && !enc.tokens.last.needObjectName() {
-			enc.buf = enc.tokens.mayAppendDelim(enc.buf, '0')
-			enc.buf = strconv.AppendInt(enc.buf, va.Int(), 10)
-			enc.tokens.last.increment()
-			if enc.needFlush() {
-				return enc.flush()
+		if optimizeCommon && !mo.Flags.Get(jsonflags.AnyWhitespace|jsonflags.StringifyNumbers) && !xe.Tokens.Last.NeedObjectName() {
+			xe.Buf = strconv.AppendInt(xe.Tokens.MayAppendDelim(xe.Buf, '0'), va.Int(), 10)
+			xe.Tokens.Last.Increment()
+			if xe.NeedFlush() {
+				return xe.Flush()
 			}
 			return nil
 		}
 
-		x := math.Float64frombits(uint64(va.Int()))
-		return enc.writeNumber(x, rawIntNumber, mo.StringifyNumbers)
+		k := stringOrNumberKind(xe.Tokens.Last.NeedObjectName() || mo.Flags.Get(jsonflags.StringifyNumbers))
+		return xe.AppendRaw(k, true, func(b []byte) ([]byte, error) {
+			return strconv.AppendInt(b, va.Int(), 10), nil
+		})
 	}
-	fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-		if uo.format != "" && uo.formatDepth == dec.tokens.depth() {
-			return newInvalidFormatError("unmarshal", t, uo.format)
-		}
-		var flags valueFlags
-		val, err := dec.readValue(&flags)
+	fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+		xd := export.Decoder(dec)
+		if uo.Format != "" && uo.FormatDepth == xd.Tokens.Depth() {
+			return newInvalidFormatError(dec, t)
+		}
+		stringify := xd.Tokens.Last.NeedObjectName() || uo.Flags.Get(jsonflags.StringifyNumbers)
+		var flags jsonwire.ValueFlags
+		val, err := xd.ReadValue(&flags)
 		if err != nil {
 			return err
 		}
 		k := val.Kind()
 		switch k {
 		case 'n':
-			va.SetInt(0)
+			if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+				va.SetInt(0)
+			}
 			return nil
 		case '"':
-			if !uo.StringifyNumbers {
+			if !stringify {
 				break
 			}
-			val = unescapeStringMayCopy(val, flags.isVerbatim())
+			val = jsonwire.UnquoteMayCopy(val, flags.IsVerbatim())
+			if uo.Flags.Get(jsonflags.StringifyWithLegacySemantics) && string(val) == "null" {
+				if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+					va.SetInt(0)
+				}
+				return nil
+			}
 			fallthrough
 		case '0':
+			if stringify && k == '0' {
+				break
+			}
 			var negOffset int
-			neg := val[0] == '-'
+			neg := len(val) > 0 && val[0] == '-'
 			if neg {
 				negOffset = 1
 			}
-			n, ok := parseDecUint(val[negOffset:])
+			n, ok := jsonwire.ParseUint(val[negOffset:])
 			maxInt := uint64(1) << (bits - 1)
 			overflow := (neg && n > maxInt) || (!neg && n > maxInt-1)
 			if !ok {
 				if n != math.MaxUint64 {
-					err := fmt.Errorf("cannot parse %q as signed integer: %w", val, strconv.ErrSyntax)
-					return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t, Err: err}
+					return newUnmarshalErrorAfterWithValue(dec, t, strconv.ErrSyntax)
 				}
 				overflow = true
 			}
 			if overflow {
-				err := fmt.Errorf("cannot parse %q as signed integer: %w", val, strconv.ErrRange)
-				return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t, Err: err}
+				return newUnmarshalErrorAfterWithValue(dec, t, strconv.ErrRange)
 			}
 			if neg {
 				va.SetInt(int64(-n))
@@ -389,7 +507,7 @@ func makeIntArshaler(t reflect.Type) *arshaler {
 			}
 			return nil
 		}
-		return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t}
+		return newUnmarshalErrorAfter(dec, t, nil)
 	}
 	return &fncs
 }
@@ -397,64 +515,77 @@ func makeIntArshaler(t reflect.Type) *arshaler {
 func makeUintArshaler(t reflect.Type) *arshaler {
 	var fncs arshaler
 	bits := t.Bits()
-	fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
-		if mo.format != "" && mo.formatDepth == enc.tokens.depth() {
-			return newInvalidFormatError("marshal", t, mo.format)
+	fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
+		xe := export.Encoder(enc)
+		if mo.Format != "" && mo.FormatDepth == xe.Tokens.Depth() {
+			return newInvalidFormatError(enc, t)
 		}
 
 		// Optimize for marshaling without preceding whitespace or string escaping.
-		if optimizeCommon && !enc.options.multiline && !mo.StringifyNumbers && !enc.tokens.last.needObjectName() {
-			enc.buf = enc.tokens.mayAppendDelim(enc.buf, '0')
-			enc.buf = strconv.AppendUint(enc.buf, va.Uint(), 10)
-			enc.tokens.last.increment()
-			if enc.needFlush() {
-				return enc.flush()
+		if optimizeCommon && !mo.Flags.Get(jsonflags.AnyWhitespace|jsonflags.StringifyNumbers) && !xe.Tokens.Last.NeedObjectName() {
+			xe.Buf = strconv.AppendUint(xe.Tokens.MayAppendDelim(xe.Buf, '0'), va.Uint(), 10)
+			xe.Tokens.Last.Increment()
+			if xe.NeedFlush() {
+				return xe.Flush()
 			}
 			return nil
 		}
 
-		x := math.Float64frombits(va.Uint())
-		return enc.writeNumber(x, rawUintNumber, mo.StringifyNumbers)
+		k := stringOrNumberKind(xe.Tokens.Last.NeedObjectName() || mo.Flags.Get(jsonflags.StringifyNumbers))
+		return xe.AppendRaw(k, true, func(b []byte) ([]byte, error) {
+			return strconv.AppendUint(b, va.Uint(), 10), nil
+		})
 	}
-	fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-		if uo.format != "" && uo.formatDepth == dec.tokens.depth() {
-			return newInvalidFormatError("unmarshal", t, uo.format)
-		}
-		var flags valueFlags
-		val, err := dec.readValue(&flags)
+	fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+		xd := export.Decoder(dec)
+		if uo.Format != "" && uo.FormatDepth == xd.Tokens.Depth() {
+			return newInvalidFormatError(dec, t)
+		}
+		stringify := xd.Tokens.Last.NeedObjectName() || uo.Flags.Get(jsonflags.StringifyNumbers)
+		var flags jsonwire.ValueFlags
+		val, err := xd.ReadValue(&flags)
 		if err != nil {
 			return err
 		}
 		k := val.Kind()
 		switch k {
 		case 'n':
-			va.SetUint(0)
+			if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+				va.SetUint(0)
+			}
 			return nil
 		case '"':
-			if !uo.StringifyNumbers {
+			if !stringify {
 				break
 			}
-			val = unescapeStringMayCopy(val, flags.isVerbatim())
+			val = jsonwire.UnquoteMayCopy(val, flags.IsVerbatim())
+			if uo.Flags.Get(jsonflags.StringifyWithLegacySemantics) && string(val) == "null" {
+				if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+					va.SetUint(0)
+				}
+				return nil
+			}
 			fallthrough
 		case '0':
-			n, ok := parseDecUint(val)
+			if stringify && k == '0' {
+				break
+			}
+			n, ok := jsonwire.ParseUint(val)
 			maxUint := uint64(1) << bits
 			overflow := n > maxUint-1
 			if !ok {
 				if n != math.MaxUint64 {
-					err := fmt.Errorf("cannot parse %q as unsigned integer: %w", val, strconv.ErrSyntax)
-					return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t, Err: err}
+					return newUnmarshalErrorAfterWithValue(dec, t, strconv.ErrSyntax)
 				}
 				overflow = true
 			}
 			if overflow {
-				err := fmt.Errorf("cannot parse %q as unsigned integer: %w", val, strconv.ErrRange)
-				return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t, Err: err}
+				return newUnmarshalErrorAfterWithValue(dec, t, strconv.ErrRange)
 			}
 			va.SetUint(n)
 			return nil
 		}
-		return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t}
+		return newUnmarshalErrorAfter(dec, t, nil)
 	}
 	return &fncs
 }
@@ -462,59 +593,66 @@ func makeUintArshaler(t reflect.Type) *arshaler {
 func makeFloatArshaler(t reflect.Type) *arshaler {
 	var fncs arshaler
 	bits := t.Bits()
-	fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
+	fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
+		xe := export.Encoder(enc)
 		var allowNonFinite bool
-		if mo.format != "" && mo.formatDepth == enc.tokens.depth() {
-			if mo.format == "nonfinite" {
+		if mo.Format != "" && mo.FormatDepth == xe.Tokens.Depth() {
+			if mo.Format == "nonfinite" {
 				allowNonFinite = true
 			} else {
-				return newInvalidFormatError("marshal", t, mo.format)
+				return newInvalidFormatError(enc, t)
 			}
 		}
 
 		fv := va.Float()
 		if math.IsNaN(fv) || math.IsInf(fv, 0) {
 			if !allowNonFinite {
-				err := fmt.Errorf("invalid value: %v", fv)
-				return &SemanticError{action: "marshal", GoType: t, Err: err}
+				err := fmt.Errorf("unsupported value: %v", fv)
+				return newMarshalErrorBefore(enc, t, err)
 			}
-			return enc.WriteToken(Float(fv))
+			return enc.WriteToken(jsontext.Float(fv))
 		}
 
 		// Optimize for marshaling without preceding whitespace or string escaping.
-		if optimizeCommon && !enc.options.multiline && !mo.StringifyNumbers && !enc.tokens.last.needObjectName() {
-			enc.buf = enc.tokens.mayAppendDelim(enc.buf, '0')
-			enc.buf = appendNumber(enc.buf, fv, bits)
-			enc.tokens.last.increment()
-			if enc.needFlush() {
-				return enc.flush()
+		if optimizeCommon && !mo.Flags.Get(jsonflags.AnyWhitespace|jsonflags.StringifyNumbers) && !xe.Tokens.Last.NeedObjectName() {
+			xe.Buf = jsonwire.AppendFloat(xe.Tokens.MayAppendDelim(xe.Buf, '0'), fv, bits)
+			xe.Tokens.Last.Increment()
+			if xe.NeedFlush() {
+				return xe.Flush()
 			}
 			return nil
 		}
 
-		return enc.writeNumber(fv, bits, mo.StringifyNumbers)
+		k := stringOrNumberKind(xe.Tokens.Last.NeedObjectName() || mo.Flags.Get(jsonflags.StringifyNumbers))
+		return xe.AppendRaw(k, true, func(b []byte) ([]byte, error) {
+			return jsonwire.AppendFloat(b, va.Float(), bits), nil
+		})
 	}
-	fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
+	fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+		xd := export.Decoder(dec)
 		var allowNonFinite bool
-		if uo.format != "" && uo.formatDepth == dec.tokens.depth() {
-			if uo.format == "nonfinite" {
+		if uo.Format != "" && uo.FormatDepth == xd.Tokens.Depth() {
+			if uo.Format == "nonfinite" {
 				allowNonFinite = true
 			} else {
-				return newInvalidFormatError("unmarshal", t, uo.format)
+				return newInvalidFormatError(dec, t)
 			}
 		}
-		var flags valueFlags
-		val, err := dec.readValue(&flags)
+		stringify := xd.Tokens.Last.NeedObjectName() || uo.Flags.Get(jsonflags.StringifyNumbers)
+		var flags jsonwire.ValueFlags
+		val, err := xd.ReadValue(&flags)
 		if err != nil {
 			return err
 		}
 		k := val.Kind()
 		switch k {
 		case 'n':
-			va.SetFloat(0)
+			if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+				va.SetFloat(0)
+			}
 			return nil
 		case '"':
-			val = unescapeStringMayCopy(val, flags.isVerbatim())
+			val = jsonwire.UnquoteMayCopy(val, flags.IsVerbatim())
 			if allowNonFinite {
 				switch string(val) {
 				case "NaN":
@@ -528,24 +666,31 @@ func makeFloatArshaler(t reflect.Type) *arshaler {
 					return nil
 				}
 			}
-			if !uo.StringifyNumbers {
+			if !stringify {
 				break
 			}
-			if n, err := consumeNumber(val); n != len(val) || err != nil {
-				err := fmt.Errorf("cannot parse %q as JSON number: %w", val, strconv.ErrSyntax)
-				return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t, Err: err}
+			if uo.Flags.Get(jsonflags.StringifyWithLegacySemantics) && string(val) == "null" {
+				if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+					va.SetFloat(0)
+				}
+				return nil
+			}
+			if n, err := jsonwire.ConsumeNumber(val); n != len(val) || err != nil {
+				return newUnmarshalErrorAfterWithValue(dec, t, strconv.ErrSyntax)
 			}
 			fallthrough
 		case '0':
-			// NOTE: Floating-point parsing is by nature a lossy operation.
-			// We never report an overflow condition since we can always
-			// round the input to the closest representable finite value.
-			// For extremely large numbers, the closest value is ±MaxFloat.
-			fv, _ := parseFloat(val, bits)
+			if stringify && k == '0' {
+				break
+			}
+			fv, ok := jsonwire.ParseFloat(val, bits)
 			va.SetFloat(fv)
+			if !ok {
+				return newUnmarshalErrorAfterWithValue(dec, t, strconv.ErrRange)
+			}
 			return nil
 		}
-		return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t}
+		return newUnmarshalErrorAfter(dec, t, nil)
 	}
 	return &fncs
 }
@@ -568,54 +713,61 @@ func makeMapArshaler(t reflect.Type) *arshaler {
 		keyFncs = lookupArshaler(t.Key())
 		valFncs = lookupArshaler(t.Elem())
 	}
-	fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
+	nillableLegacyKey := t.Key().Kind() == reflect.Pointer &&
+		implementsAny(t.Key(), textMarshalerType, textAppenderType)
+	fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
 		// Check for cycles.
-		if enc.tokens.depth() > startDetectingCyclesAfter {
-			if err := enc.seenPointers.visit(va.Value); err != nil {
-				return err
-			}
-			defer enc.seenPointers.leave(va.Value)
-		}
-
-		if mo.format != "" && mo.formatDepth == enc.tokens.depth() {
-			if mo.format == "emitnull" {
-				if va.IsNil() {
-					return enc.WriteToken(Null)
-				}
-				mo.format = ""
-			} else {
-				return newInvalidFormatError("marshal", t, mo.format)
+		xe := export.Encoder(enc)
+		if xe.Tokens.Depth() > startDetectingCyclesAfter {
+			if err := visitPointer(&xe.SeenPointers, va.Value); err != nil {
+				return newMarshalErrorBefore(enc, t, err)
+			}
+			defer leavePointer(&xe.SeenPointers, va.Value)
+		}
+
+		emitNull := mo.Flags.Get(jsonflags.FormatNilMapAsNull)
+		if mo.Format != "" && mo.FormatDepth == xe.Tokens.Depth() {
+			switch mo.Format {
+			case "emitnull":
+				emitNull = true
+				mo.Format = ""
+			case "emitempty":
+				emitNull = false
+				mo.Format = ""
+			default:
+				return newInvalidFormatError(enc, t)
 			}
 		}
 
-		// Optimize for marshaling an empty map without any preceding whitespace.
+		// Handle empty maps.
 		n := va.Len()
-		if optimizeCommon && n == 0 && !enc.options.multiline && !enc.tokens.last.needObjectName() {
-			enc.buf = enc.tokens.mayAppendDelim(enc.buf, '{')
-			enc.buf = append(enc.buf, "{}"...)
-			enc.tokens.last.increment()
-			if enc.needFlush() {
-				return enc.flush()
+		if n == 0 {
+			if emitNull && va.IsNil() {
+				return enc.WriteToken(jsontext.Null)
+			}
+			// Optimize for marshaling an empty map without any preceding whitespace.
+			if optimizeCommon && !mo.Flags.Get(jsonflags.AnyWhitespace) && !xe.Tokens.Last.NeedObjectName() {
+				xe.Buf = append(xe.Tokens.MayAppendDelim(xe.Buf, '{'), "{}"...)
+				xe.Tokens.Last.Increment()
+				if xe.NeedFlush() {
+					return xe.Flush()
+				}
+				return nil
 			}
-			return nil
 		}
 
 		once.Do(init)
-		if err := enc.WriteToken(ObjectStart); err != nil {
+		if err := enc.WriteToken(jsontext.BeginObject); err != nil {
 			return err
 		}
 		if n > 0 {
-			// Handle maps with numeric key types by stringifying them.
-			mko := mo
-			mko.StringifyNumbers = true
-
 			nonDefaultKey := keyFncs.nonDefault
 			marshalKey := keyFncs.marshal
 			marshalVal := valFncs.marshal
 			if mo.Marshalers != nil {
 				var ok bool
-				marshalKey, ok = mo.Marshalers.lookup(marshalKey, t.Key())
-				marshalVal, _ = mo.Marshalers.lookup(marshalVal, t.Elem())
+				marshalKey, ok = mo.Marshalers.(*Marshalers).lookup(marshalKey, t.Key())
+				marshalVal, _ = mo.Marshalers.(*Marshalers).lookup(marshalVal, t.Elem())
 				nonDefaultKey = nonDefaultKey || ok
 			}
 			k := newAddressableValue(t.Key())
@@ -624,22 +776,29 @@ func makeMapArshaler(t reflect.Type) *arshaler {
 			// A Go map guarantees that each entry has a unique key.
 			// As such, disable the expensive duplicate name check if we know
 			// that every Go key will serialize as a unique JSON string.
-			if !nonDefaultKey && mapKeyWithUniqueRepresentation(k.Kind(), enc.options.AllowInvalidUTF8) {
-				enc.tokens.last.disableNamespace()
+			if !nonDefaultKey && mapKeyWithUniqueRepresentation(k.Kind(), mo.Flags.Get(jsonflags.AllowInvalidUTF8)) {
+				xe.Tokens.Last.DisableNamespace()
 			}
 
 			switch {
-			case !mo.Deterministic || n <= 1:
+			case !mo.Flags.Get(jsonflags.Deterministic) || n <= 1:
 				for iter := va.Value.MapRange(); iter.Next(); {
 					k.SetIterKey(iter)
-					if err := marshalKey(mko, enc, k); err != nil {
-						// TODO: If err is errMissingName, then wrap it as a
-						// SemanticError since this key type cannot be serialized
-						// as a JSON string.
-						return err
+					err := marshalKey(enc, k, mo)
+					if err != nil {
+						if mo.Flags.Get(jsonflags.CallMethodsWithLegacySemantics) &&
+							errors.Is(err, jsontext.ErrNonStringName) && nillableLegacyKey && k.IsNil() {
+							err = enc.WriteToken(jsontext.String(""))
+						}
+						if err != nil {
+							if serr, ok := err.(*jsontext.SyntacticError); ok && serr.Err == jsontext.ErrNonStringName {
+								err = newMarshalErrorBefore(enc, k.Type(), err)
+							}
+							return err
+						}
 					}
 					v.SetIterValue(iter)
-					if err := marshalVal(mo, enc, v); err != nil {
+					if err := marshalVal(enc, v, mo); err != nil {
 						return err
 					}
 				}
@@ -651,13 +810,13 @@ func makeMapArshaler(t reflect.Type) *arshaler {
 				}
 				names.Sort()
 				for _, name := range *names {
-					if err := enc.WriteToken(String(name)); err != nil {
+					if err := enc.WriteToken(jsontext.String(name)); err != nil {
 						return err
 					}
 					// TODO(https://go.dev/issue/57061): Use v.SetMapIndexOf.
 					k.SetString(name)
 					v.Set(va.MapIndex(k.Value))
-					if err := marshalVal(mo, enc, v); err != nil {
+					if err := marshalVal(enc, v, mo); err != nil {
 						return err
 					}
 				}
@@ -666,52 +825,62 @@ func makeMapArshaler(t reflect.Type) *arshaler {
 				type member struct {
 					name string // unquoted name
 					key  addressableValue
+					val  addressableValue
 				}
 				members := make([]member, n)
 				keys := reflect.MakeSlice(reflect.SliceOf(t.Key()), n, n)
+				vals := reflect.MakeSlice(reflect.SliceOf(t.Elem()), n, n)
 				for i, iter := 0, va.Value.MapRange(); i < n && iter.Next(); i++ {
 					// Marshal the member name.
-					k := addressableValue{keys.Index(i)} // indexed slice element is always addressable
+					k := addressableValue{keys.Index(i), true} // indexed slice element is always addressable
 					k.SetIterKey(iter)
-					if err := marshalKey(mko, enc, k); err != nil {
-						// TODO: If err is errMissingName, then wrap it as a
-						// SemanticError since this key type cannot be serialized
-						// as a JSON string.
-						return err
+					v := addressableValue{vals.Index(i), true} // indexed slice element is always addressable
+					v.SetIterValue(iter)
+					err := marshalKey(enc, k, mo)
+					if err != nil {
+						if mo.Flags.Get(jsonflags.CallMethodsWithLegacySemantics) &&
+							errors.Is(err, jsontext.ErrNonStringName) && nillableLegacyKey && k.IsNil() {
+							err = enc.WriteToken(jsontext.String(""))
+						}
+						if err != nil {
+							if serr, ok := err.(*jsontext.SyntacticError); ok && serr.Err == jsontext.ErrNonStringName {
+								err = newMarshalErrorBefore(enc, k.Type(), err)
+							}
+							return err
+						}
 					}
-					name := enc.unwriteOnlyObjectMemberName()
-					members[i] = member{name, k}
+					name := xe.UnwriteOnlyObjectMemberName()
+					members[i] = member{name, k, v}
 				}
 				// TODO: If AllowDuplicateNames is enabled, then sort according
 				// to reflect.Value as well if the names are equal.
 				// See internal/fmtsort.
-				// TODO(https://go.dev/issue/47619): Use slices.SortFunc instead.
-				sort.Slice(members, func(i, j int) bool {
-					return lessUTF16(members[i].name, members[j].name)
+				slices.SortFunc(members, func(x, y member) int {
+					return strings.Compare(x.name, y.name)
 				})
 				for _, member := range members {
-					if err := enc.WriteToken(String(member.name)); err != nil {
+					if err := enc.WriteToken(jsontext.String(member.name)); err != nil {
 						return err
 					}
-					// TODO(https://go.dev/issue/57061): Use v.SetMapIndexOf.
-					v.Set(va.MapIndex(member.key.Value))
-					if err := marshalVal(mo, enc, v); err != nil {
+					if err := marshalVal(enc, member.val, mo); err != nil {
 						return err
 					}
 				}
 			}
 		}
-		if err := enc.WriteToken(ObjectEnd); err != nil {
+		if err := enc.WriteToken(jsontext.EndObject); err != nil {
 			return err
 		}
 		return nil
 	}
-	fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-		if uo.format != "" && uo.formatDepth == dec.tokens.depth() {
-			if uo.format == "emitnull" {
-				uo.format = "" // only relevant for marshaling
-			} else {
-				return newInvalidFormatError("unmarshal", t, uo.format)
+	fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+		xd := export.Decoder(dec)
+		if uo.Format != "" && uo.FormatDepth == xd.Tokens.Depth() {
+			switch uo.Format {
+			case "emitnull", "emitempty":
+				uo.Format = "" // only relevant for marshaling
+			default:
+				return newInvalidFormatError(dec, t)
 			}
 		}
 		tok, err := dec.ReadToken()
@@ -721,7 +890,7 @@ func makeMapArshaler(t reflect.Type) *arshaler {
 		k := tok.Kind()
 		switch k {
 		case 'n':
-			va.Set(reflect.Zero(t))
+			va.SetZero()
 			return nil
 		case '{':
 			once.Do(init)
@@ -729,17 +898,13 @@ func makeMapArshaler(t reflect.Type) *arshaler {
 				va.Set(reflect.MakeMap(t))
 			}
 
-			// Handle maps with numeric key types by stringifying them.
-			uko := uo
-			uko.StringifyNumbers = true
-
 			nonDefaultKey := keyFncs.nonDefault
 			unmarshalKey := keyFncs.unmarshal
 			unmarshalVal := valFncs.unmarshal
 			if uo.Unmarshalers != nil {
 				var ok bool
-				unmarshalKey, ok = uo.Unmarshalers.lookup(unmarshalKey, t.Key())
-				unmarshalVal, _ = uo.Unmarshalers.lookup(unmarshalVal, t.Elem())
+				unmarshalKey, ok = uo.Unmarshalers.(*Unmarshalers).lookup(unmarshalKey, t.Key())
+				unmarshalVal, _ = uo.Unmarshalers.(*Unmarshalers).lookup(unmarshalVal, t.Elem())
 				nonDefaultKey = nonDefaultKey || ok
 			}
 			k := newAddressableValue(t.Key())
@@ -751,8 +916,8 @@ func makeMapArshaler(t reflect.Type) *arshaler {
 			// will be rejected as duplicates since they semantically refer
 			// to the same Go value. This is an unusual interaction
 			// between syntax and semantics, but is more correct.
-			if !nonDefaultKey && mapKeyWithUniqueRepresentation(k.Kind(), dec.options.AllowInvalidUTF8) {
-				dec.tokens.last.disableNamespace()
+			if !nonDefaultKey && mapKeyWithUniqueRepresentation(k.Kind(), uo.Flags.Get(jsonflags.AllowInvalidUTF8)) {
+				xd.Tokens.Last.DisableNamespace()
 			}
 
 			// In the rare case where the map is not already empty,
@@ -760,46 +925,72 @@ func makeMapArshaler(t reflect.Type) *arshaler {
 			// since existing presence alone is insufficient to indicate
 			// whether the input had a duplicate name.
 			var seen reflect.Value
-			if !dec.options.AllowDuplicateNames && va.Len() > 0 {
+			if !uo.Flags.Get(jsonflags.AllowDuplicateNames) && va.Len() > 0 {
 				seen = reflect.MakeMap(reflect.MapOf(k.Type(), emptyStructType))
 			}
 
+			var errUnmarshal error
 			for dec.PeekKind() != '}' {
-				k.Set(reflect.Zero(t.Key()))
-				if err := unmarshalKey(uko, dec, k); err != nil {
-					return err
+				// Unmarshal the map entry key.
+				k.SetZero()
+				err := unmarshalKey(dec, k, uo)
+				if err != nil {
+					if isFatalError(err, uo.Flags) {
+						return err
+					}
+					if err := dec.SkipValue(); err != nil {
+						return err
+					}
+					errUnmarshal = cmp.Or(errUnmarshal, err)
+					continue
 				}
 				if k.Kind() == reflect.Interface && !k.IsNil() && !k.Elem().Type().Comparable() {
-					err := fmt.Errorf("invalid incomparable key type %v", k.Elem().Type())
-					return &SemanticError{action: "unmarshal", GoType: t, Err: err}
+					err := newUnmarshalErrorAfter(dec, t, fmt.Errorf("invalid incomparable key type %v", k.Elem().Type()))
+					if !uo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+						return err
+					}
+					if err2 := dec.SkipValue(); err2 != nil {
+						return err2
+					}
+					errUnmarshal = cmp.Or(errUnmarshal, err)
+					continue
 				}
 
+				// Check if a pre-existing map entry value exists for this key.
 				if v2 := va.MapIndex(k.Value); v2.IsValid() {
-					if !dec.options.AllowDuplicateNames && (!seen.IsValid() || seen.MapIndex(k.Value).IsValid()) {
+					if !uo.Flags.Get(jsonflags.AllowDuplicateNames) && (!seen.IsValid() || seen.MapIndex(k.Value).IsValid()) {
 						// TODO: Unread the object name.
-						name := dec.previousBuffer()
-						err := &SyntacticError{str: "duplicate name " + string(name) + " in object"}
-						return err.withOffset(dec.InputOffset() - int64(len(name)))
+						name := xd.PreviousTokenOrValue()
+						return newDuplicateNameError(dec.StackPointer(), nil, dec.InputOffset()-len64(name))
+					}
+					if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+						v.Set(v2)
+					} else {
+						v.SetZero()
 					}
-					v.Set(v2)
 				} else {
-					v.Set(reflect.Zero(v.Type()))
+					v.SetZero()
 				}
-				err := unmarshalVal(uo, dec, v)
+
+				// Unmarshal the map entry value.
+				err = unmarshalVal(dec, v, uo)
 				va.SetMapIndex(k.Value, v.Value)
 				if seen.IsValid() {
 					seen.SetMapIndex(k.Value, reflect.Zero(emptyStructType))
 				}
 				if err != nil {
-					return err
+					if isFatalError(err, uo.Flags) {
+						return err
+					}
+					errUnmarshal = cmp.Or(errUnmarshal, err)
 				}
 			}
 			if _, err := dec.ReadToken(); err != nil {
 				return err
 			}
-			return nil
+			return errUnmarshal
 		}
-		return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t}
+		return newUnmarshalErrorAfterWithSkipping(dec, t, nil)
 	}
 	return &fncs
 }
@@ -812,7 +1003,7 @@ func mapKeyWithUniqueRepresentation(k reflect.Kind, allowInvalidUTF8 bool) bool
 	switch k {
 	case reflect.Bool,
 		reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
-		reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
 		return true
 	case reflect.String:
 		// For strings, we have to be careful since names with invalid UTF-8
@@ -825,6 +1016,8 @@ func mapKeyWithUniqueRepresentation(k reflect.Kind, allowInvalidUTF8 bool) bool
 	}
 }
 
+var errNilField = errors.New("cannot set embedded pointer to unexported struct type")
+
 func makeStructArshaler(t reflect.Type) *arshaler {
 	// NOTE: The logic below disables namespaces for tracking duplicate names
 	// and does the tracking locally with an efficient bit-set based on which
@@ -839,27 +1032,26 @@ func makeStructArshaler(t reflect.Type) *arshaler {
 	init := func() {
 		fields, errInit = makeStructFields(t)
 	}
-	fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
-		if mo.format != "" && mo.formatDepth == enc.tokens.depth() {
-			return newInvalidFormatError("marshal", t, mo.format)
+	fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
+		xe := export.Encoder(enc)
+		if mo.Format != "" && mo.FormatDepth == xe.Tokens.Depth() {
+			return newInvalidFormatError(enc, t)
 		}
 		once.Do(init)
-		if errInit != nil {
-			err := *errInit // shallow copy SemanticError
-			err.action = "marshal"
-			return &err
+		if errInit != nil && !mo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+			return newMarshalErrorBefore(enc, errInit.GoType, errInit.Err)
 		}
-		if err := enc.WriteToken(ObjectStart); err != nil {
+		if err := enc.WriteToken(jsontext.BeginObject); err != nil {
 			return err
 		}
 		var seenIdxs uintSet
 		prevIdx := -1
-		enc.tokens.last.disableNamespace() // we manually ensure unique names below
+		xe.Tokens.Last.DisableNamespace() // we manually ensure unique names below
 		for i := range fields.flattened {
 			f := &fields.flattened[i]
-			v := addressableValue{va.Field(f.index[0])} // addressable if struct value is addressable
-			if len(f.index) > 1 {
-				v = v.fieldByIndex(f.index[1:], false)
+			v := addressableValue{va.Field(f.index0), va.forcedAddr} // addressable if struct value is addressable
+			if len(f.index) > 0 {
+				v = v.fieldByIndex(f.index, false)
 				if !v.IsValid() {
 					continue // implies a nil inlined field
 				}
@@ -867,7 +1059,13 @@ func makeStructArshaler(t reflect.Type) *arshaler {
 
 			// OmitZero skips the field if the Go value is zero,
 			// which we can determine up front without calling the marshaler.
-			if f.omitzero && ((f.isZero == nil && v.IsZero()) || (f.isZero != nil && f.isZero(v))) {
+			if (f.omitzero || mo.Flags.Get(jsonflags.OmitZeroStructFields)) &&
+				((f.isZero == nil && v.IsZero()) || (f.isZero != nil && f.isZero(v))) {
+				continue
+			}
+
+			// Check for the legacy definition of omitempty.
+			if f.omitempty && mo.Flags.Get(jsonflags.OmitEmptyWithLegacySemantics) && isLegacyEmpty(v) {
 				continue
 			}
 
@@ -875,14 +1073,15 @@ func makeStructArshaler(t reflect.Type) *arshaler {
 			nonDefault := f.fncs.nonDefault
 			if mo.Marshalers != nil {
 				var ok bool
-				marshal, ok = mo.Marshalers.lookup(marshal, f.typ)
+				marshal, ok = mo.Marshalers.(*Marshalers).lookup(marshal, f.typ)
 				nonDefault = nonDefault || ok
 			}
 
 			// OmitEmpty skips the field if the marshaled JSON value is empty,
 			// which we can know up front if there are no custom marshalers,
 			// otherwise we must marshal the value and unwrite it if empty.
-			if f.omitempty && !nonDefault && f.isEmpty != nil && f.isEmpty(v) {
+			if f.omitempty && !mo.Flags.Get(jsonflags.OmitEmptyWithLegacySemantics) &&
+				!nonDefault && f.isEmpty != nil && f.isEmpty(v) {
 				continue // fast path for omitempty
 			}
 
@@ -898,50 +1097,60 @@ func makeStructArshaler(t reflect.Type) *arshaler {
 			//	5. There is no possibility of an error occurring.
 			if optimizeCommon {
 				// Append any delimiters or optional whitespace.
-				if enc.tokens.last.length() > 0 {
-					enc.buf = append(enc.buf, ',')
+				b := xe.Buf
+				if xe.Tokens.Last.Length() > 0 {
+					b = append(b, ',')
+					if mo.Flags.Get(jsonflags.SpaceAfterComma) {
+						b = append(b, ' ')
+					}
 				}
-				if enc.options.multiline {
-					enc.buf = enc.appendIndent(enc.buf, enc.tokens.needIndent('"'))
+				if mo.Flags.Get(jsonflags.Multiline) {
+					b = xe.AppendIndent(b, xe.Tokens.NeedIndent('"'))
 				}
 
 				// Append the token to the output and to the state machine.
-				n0 := len(enc.buf) // offset before calling appendString
-				if enc.options.EscapeRune == nil {
-					enc.buf = append(enc.buf, f.quotedName...)
+				n0 := len(b) // offset before calling AppendQuote
+				if !f.nameNeedEscape {
+					b = append(b, f.quotedName...)
 				} else {
-					enc.buf, _ = appendString(enc.buf, f.name, false, enc.options.EscapeRune)
-				}
-				if !enc.options.AllowDuplicateNames {
-					enc.names.replaceLastQuotedOffset(n0)
+					b, _ = jsonwire.AppendQuote(b, f.name, &mo.Flags)
 				}
-				enc.tokens.last.increment()
+				xe.Buf = b
+				xe.Names.ReplaceLastQuotedOffset(n0)
+				xe.Tokens.Last.Increment()
 			} else {
-				if err := enc.WriteToken(String(f.name)); err != nil {
+				if err := enc.WriteToken(jsontext.String(f.name)); err != nil {
 					return err
 				}
 			}
 
 			// Write the object member value.
-			mo2 := mo
+			flagsOriginal := mo.Flags
 			if f.string {
-				mo2.StringifyNumbers = true
+				if !mo.Flags.Get(jsonflags.StringifyWithLegacySemantics) {
+					mo.Flags.Set(jsonflags.StringifyNumbers | 1)
+				} else if canLegacyStringify(f.typ) {
+					mo.Flags.Set(jsonflags.StringifyNumbers | jsonflags.StringifyBoolsAndStrings | 1)
+				}
 			}
 			if f.format != "" {
-				mo2.formatDepth = enc.tokens.depth()
-				mo2.format = f.format
+				mo.FormatDepth = xe.Tokens.Depth()
+				mo.Format = f.format
 			}
-			if err := marshal(mo2, enc, v); err != nil {
+			err := marshal(enc, v, mo)
+			mo.Flags = flagsOriginal
+			mo.Format = ""
+			if err != nil {
 				return err
 			}
 
 			// Try unwriting the member if empty (slow path for omitempty).
-			if f.omitempty {
+			if f.omitempty && !mo.Flags.Get(jsonflags.OmitEmptyWithLegacySemantics) {
 				var prevName *string
 				if prevIdx >= 0 {
 					prevName = &fields.flattened[prevIdx].name
 				}
-				if enc.unwriteEmptyObjectMember(prevName) {
+				if xe.UnwriteEmptyObjectMember(prevName) {
 					continue
 				}
 			}
@@ -949,23 +1158,23 @@ func makeStructArshaler(t reflect.Type) *arshaler {
 			// Remember the previous written object member.
 			// The set of seen fields only needs to be updated to detect
 			// duplicate names with those from the inlined fallback.
-			if !enc.options.AllowDuplicateNames && fields.inlinedFallback != nil {
+			if !mo.Flags.Get(jsonflags.AllowDuplicateNames) && fields.inlinedFallback != nil {
 				seenIdxs.insert(uint(f.id))
 			}
 			prevIdx = f.id
 		}
-		if fields.inlinedFallback != nil && !(mo.DiscardUnknownMembers && fields.inlinedFallback.unknown) {
+		if fields.inlinedFallback != nil && !(mo.Flags.Get(jsonflags.DiscardUnknownMembers) && fields.inlinedFallback.unknown) {
 			var insertUnquotedName func([]byte) bool
-			if !enc.options.AllowDuplicateNames {
+			if !mo.Flags.Get(jsonflags.AllowDuplicateNames) {
 				insertUnquotedName = func(name []byte) bool {
 					// Check that the name from inlined fallback does not match
 					// one of the previously marshaled names from known fields.
-					if foldedFields := fields.byFoldedName[string(foldName(name))]; len(foldedFields) > 0 {
+					if foldedFields := fields.lookupByFoldedName(name); len(foldedFields) > 0 {
 						if f := fields.byActualName[string(name)]; f != nil {
 							return seenIdxs.insert(uint(f.id))
 						}
 						for _, f := range foldedFields {
-							if f.nocase {
+							if f.matchFoldedName(name, &mo.Flags) {
 								return seenIdxs.insert(uint(f.id))
 							}
 						}
@@ -973,21 +1182,22 @@ func makeStructArshaler(t reflect.Type) *arshaler {
 
 					// Check that the name does not match any other name
 					// previously marshaled from the inlined fallback.
-					return enc.namespaces.last().insertUnquoted(name)
+					return xe.Namespaces.Last().InsertUnquoted(name)
 				}
 			}
-			if err := marshalInlinedFallbackAll(mo, enc, va, fields.inlinedFallback, insertUnquotedName); err != nil {
+			if err := marshalInlinedFallbackAll(enc, va, mo, fields.inlinedFallback, insertUnquotedName); err != nil {
 				return err
 			}
 		}
-		if err := enc.WriteToken(ObjectEnd); err != nil {
+		if err := enc.WriteToken(jsontext.EndObject); err != nil {
 			return err
 		}
 		return nil
 	}
-	fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-		if uo.format != "" && uo.formatDepth == dec.tokens.depth() {
-			return newInvalidFormatError("unmarshal", t, uo.format)
+	fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+		xd := export.Decoder(dec)
+		if uo.Format != "" && uo.FormatDepth == xd.Tokens.Depth() {
+			return newInvalidFormatError(dec, t)
 		}
 		tok, err := dec.ReadToken()
 		if err != nil {
@@ -996,41 +1206,45 @@ func makeStructArshaler(t reflect.Type) *arshaler {
 		k := tok.Kind()
 		switch k {
 		case 'n':
-			va.Set(reflect.Zero(t))
+			if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+				va.SetZero()
+			}
 			return nil
 		case '{':
 			once.Do(init)
-			if errInit != nil {
-				err := *errInit // shallow copy SemanticError
-				err.action = "unmarshal"
-				return &err
+			if errInit != nil && !uo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+				return newUnmarshalErrorAfter(dec, errInit.GoType, errInit.Err)
 			}
 			var seenIdxs uintSet
-			dec.tokens.last.disableNamespace()
+			xd.Tokens.Last.DisableNamespace()
+			var errUnmarshal error
 			for dec.PeekKind() != '}' {
 				// Process the object member name.
-				var flags valueFlags
-				val, err := dec.readValue(&flags)
+				var flags jsonwire.ValueFlags
+				val, err := xd.ReadValue(&flags)
 				if err != nil {
 					return err
 				}
-				name := unescapeStringMayCopy(val, flags.isVerbatim())
+				name := jsonwire.UnquoteMayCopy(val, flags.IsVerbatim())
 				f := fields.byActualName[string(name)]
 				if f == nil {
-					for _, f2 := range fields.byFoldedName[string(foldName(name))] {
-						if f2.nocase {
+					for _, f2 := range fields.lookupByFoldedName(name) {
+						if f2.matchFoldedName(name, &uo.Flags) {
 							f = f2
 							break
 						}
 					}
 					if f == nil {
-						if uo.RejectUnknownMembers && (fields.inlinedFallback == nil || fields.inlinedFallback.unknown) {
-							return &SemanticError{action: "unmarshal", GoType: t, Err: fmt.Errorf("unknown name %s", val)}
+						if uo.Flags.Get(jsonflags.RejectUnknownMembers) && (fields.inlinedFallback == nil || fields.inlinedFallback.unknown) {
+							err := newUnmarshalErrorAfter(dec, t, ErrUnknownName)
+							if !uo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+								return err
+							}
+							errUnmarshal = cmp.Or(errUnmarshal, err)
 						}
-						if !dec.options.AllowDuplicateNames && !dec.namespaces.last().insertUnquoted(name) {
+						if !uo.Flags.Get(jsonflags.AllowDuplicateNames) && !xd.Namespaces.Last().InsertUnquoted(name) {
 							// TODO: Unread the object name.
-							err := &SyntacticError{str: "duplicate name " + string(val) + " in object"}
-							return err.withOffset(dec.InputOffset() - int64(len(val)))
+							return newDuplicateNameError(dec.StackPointer(), nil, dec.InputOffset()-len64(val))
 						}
 
 						if fields.inlinedFallback == nil {
@@ -1040,46 +1254,68 @@ func makeStructArshaler(t reflect.Type) *arshaler {
 							}
 						} else {
 							// Marshal into value capable of storing arbitrary object members.
-							if err := unmarshalInlinedFallbackNext(uo, dec, va, fields.inlinedFallback, val, name); err != nil {
-								return err
+							if err := unmarshalInlinedFallbackNext(dec, va, uo, fields.inlinedFallback, val, name); err != nil {
+								if isFatalError(err, uo.Flags) {
+									return err
+								}
+								errUnmarshal = cmp.Or(errUnmarshal, err)
 							}
 						}
 						continue
 					}
 				}
-				if !dec.options.AllowDuplicateNames && !seenIdxs.insert(uint(f.id)) {
+				if !uo.Flags.Get(jsonflags.AllowDuplicateNames) && !seenIdxs.insert(uint(f.id)) {
 					// TODO: Unread the object name.
-					err := &SyntacticError{str: "duplicate name " + string(val) + " in object"}
-					return err.withOffset(dec.InputOffset() - int64(len(val)))
+					return newDuplicateNameError(dec.StackPointer(), nil, dec.InputOffset()-len64(val))
 				}
 
 				// Process the object member value.
 				unmarshal := f.fncs.unmarshal
 				if uo.Unmarshalers != nil {
-					unmarshal, _ = uo.Unmarshalers.lookup(unmarshal, f.typ)
+					unmarshal, _ = uo.Unmarshalers.(*Unmarshalers).lookup(unmarshal, f.typ)
 				}
-				uo2 := uo
+				flagsOriginal := uo.Flags
 				if f.string {
-					uo2.StringifyNumbers = true
+					if !uo.Flags.Get(jsonflags.StringifyWithLegacySemantics) {
+						uo.Flags.Set(jsonflags.StringifyNumbers | 1)
+					} else if canLegacyStringify(f.typ) {
+						uo.Flags.Set(jsonflags.StringifyNumbers | jsonflags.StringifyBoolsAndStrings | 1)
+					}
 				}
 				if f.format != "" {
-					uo2.formatDepth = dec.tokens.depth()
-					uo2.format = f.format
+					uo.FormatDepth = xd.Tokens.Depth()
+					uo.Format = f.format
 				}
-				v := addressableValue{va.Field(f.index[0])} // addressable if struct value is addressable
-				if len(f.index) > 1 {
-					v = v.fieldByIndex(f.index[1:], true)
+				v := addressableValue{va.Field(f.index0), va.forcedAddr} // addressable if struct value is addressable
+				if len(f.index) > 0 {
+					v = v.fieldByIndex(f.index, true)
+					if !v.IsValid() {
+						err := newUnmarshalErrorBefore(dec, t, errNilField)
+						if !uo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+							return err
+						}
+						errUnmarshal = cmp.Or(errUnmarshal, err)
+						unmarshal = func(dec *jsontext.Decoder, _ addressableValue, _ *jsonopts.Struct) error {
+							return dec.SkipValue()
+						}
+					}
 				}
-				if err := unmarshal(uo2, dec, v); err != nil {
-					return err
+				err = unmarshal(dec, v, uo)
+				uo.Flags = flagsOriginal
+				uo.Format = ""
+				if err != nil {
+					if isFatalError(err, uo.Flags) {
+						return err
+					}
+					errUnmarshal = cmp.Or(errUnmarshal, err)
 				}
 			}
 			if _, err := dec.ReadToken(); err != nil {
 				return err
 			}
-			return nil
+			return errUnmarshal
 		}
-		return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t}
+		return newUnmarshalErrorAfterWithSkipping(dec, t, nil)
 	}
 	return &fncs
 }
@@ -1090,7 +1326,7 @@ func (va addressableValue) fieldByIndex(index []int, mayAlloc bool) addressableV
 		if !va.IsValid() {
 			return va
 		}
-		va = addressableValue{va.Field(i)} // addressable if struct value is addressable
+		va = addressableValue{va.Field(i), va.forcedAddr} // addressable if struct value is addressable
 	}
 	return va
 }
@@ -1098,16 +1334,55 @@ func (va addressableValue) fieldByIndex(index []int, mayAlloc bool) addressableV
 func (va addressableValue) indirect(mayAlloc bool) addressableValue {
 	if va.Kind() == reflect.Pointer {
 		if va.IsNil() {
-			if !mayAlloc {
+			if !mayAlloc || !va.CanSet() {
 				return addressableValue{}
 			}
 			va.Set(reflect.New(va.Type().Elem()))
 		}
-		va = addressableValue{va.Elem()} // dereferenced pointer is always addressable
+		va = addressableValue{va.Elem(), false} // dereferenced pointer is always addressable
 	}
 	return va
 }
 
+// isLegacyEmpty reports whether a value is empty according to the v1 definition.
+func isLegacyEmpty(v addressableValue) bool {
+	// Equivalent to encoding/json.isEmptyValue@v1.21.0.
+	switch v.Kind() {
+	case reflect.Bool:
+		return v.Bool() == false
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return v.Int() == 0
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		return v.Uint() == 0
+	case reflect.Float32, reflect.Float64:
+		return v.Float() == 0
+	case reflect.String, reflect.Map, reflect.Slice, reflect.Array:
+		return v.Len() == 0
+	case reflect.Pointer, reflect.Interface:
+		return v.IsNil()
+	}
+	return false
+}
+
+// canLegacyStringify reports whether t can be stringified according to v1,
+// where t is a bool, string, or number (or unnamed pointer to such).
+// In v1, the `string` option does not apply recursively to nested types within
+// a composite Go type (e.g., an array, slice, struct, map, or interface).
+func canLegacyStringify(t reflect.Type) bool {
+	// Based on encoding/json.typeFields#L1126-L1143@v1.23.0
+	if t.Name() == "" && t.Kind() == reflect.Ptr {
+		t = t.Elem()
+	}
+	switch t.Kind() {
+	case reflect.Bool, reflect.String,
+		reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+		reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr,
+		reflect.Float32, reflect.Float64:
+		return true
+	}
+	return false
+}
+
 func makeSliceArshaler(t reflect.Type) *arshaler {
 	var fncs arshaler
 	var (
@@ -1117,64 +1392,75 @@ func makeSliceArshaler(t reflect.Type) *arshaler {
 	init := func() {
 		valFncs = lookupArshaler(t.Elem())
 	}
-	fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
+	fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
 		// Check for cycles.
-		if enc.tokens.depth() > startDetectingCyclesAfter {
-			if err := enc.seenPointers.visit(va.Value); err != nil {
-				return err
-			}
-			defer enc.seenPointers.leave(va.Value)
-		}
-
-		if mo.format != "" && mo.formatDepth == enc.tokens.depth() {
-			if mo.format == "emitnull" {
-				if va.IsNil() {
-					return enc.WriteToken(Null)
-				}
-				mo.format = ""
-			} else {
-				return newInvalidFormatError("marshal", t, mo.format)
+		xe := export.Encoder(enc)
+		if xe.Tokens.Depth() > startDetectingCyclesAfter {
+			if err := visitPointer(&xe.SeenPointers, va.Value); err != nil {
+				return newMarshalErrorBefore(enc, t, err)
+			}
+			defer leavePointer(&xe.SeenPointers, va.Value)
+		}
+
+		emitNull := mo.Flags.Get(jsonflags.FormatNilSliceAsNull)
+		if mo.Format != "" && mo.FormatDepth == xe.Tokens.Depth() {
+			switch mo.Format {
+			case "emitnull":
+				emitNull = true
+				mo.Format = ""
+			case "emitempty":
+				emitNull = false
+				mo.Format = ""
+			default:
+				return newInvalidFormatError(enc, t)
 			}
 		}
 
-		// Optimize for marshaling an empty slice without any preceding whitespace.
+		// Handle empty slices.
 		n := va.Len()
-		if optimizeCommon && n == 0 && !enc.options.multiline && !enc.tokens.last.needObjectName() {
-			enc.buf = enc.tokens.mayAppendDelim(enc.buf, '[')
-			enc.buf = append(enc.buf, "[]"...)
-			enc.tokens.last.increment()
-			if enc.needFlush() {
-				return enc.flush()
+		if n == 0 {
+			if emitNull && va.IsNil() {
+				return enc.WriteToken(jsontext.Null)
+			}
+			// Optimize for marshaling an empty slice without any preceding whitespace.
+			if optimizeCommon && !mo.Flags.Get(jsonflags.AnyWhitespace) && !xe.Tokens.Last.NeedObjectName() {
+				xe.Buf = append(xe.Tokens.MayAppendDelim(xe.Buf, '['), "[]"...)
+				xe.Tokens.Last.Increment()
+				if xe.NeedFlush() {
+					return xe.Flush()
+				}
+				return nil
 			}
-			return nil
 		}
 
 		once.Do(init)
-		if err := enc.WriteToken(ArrayStart); err != nil {
+		if err := enc.WriteToken(jsontext.BeginArray); err != nil {
 			return err
 		}
 		marshal := valFncs.marshal
 		if mo.Marshalers != nil {
-			marshal, _ = mo.Marshalers.lookup(marshal, t.Elem())
+			marshal, _ = mo.Marshalers.(*Marshalers).lookup(marshal, t.Elem())
 		}
-		for i := 0; i < n; i++ {
-			v := addressableValue{va.Index(i)} // indexed slice element is always addressable
-			if err := marshal(mo, enc, v); err != nil {
+		for i := range n {
+			v := addressableValue{va.Index(i), false} // indexed slice element is always addressable
+			if err := marshal(enc, v, mo); err != nil {
 				return err
 			}
 		}
-		if err := enc.WriteToken(ArrayEnd); err != nil {
+		if err := enc.WriteToken(jsontext.EndArray); err != nil {
 			return err
 		}
 		return nil
 	}
 	emptySlice := reflect.MakeSlice(t, 0, 0)
-	fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-		if uo.format != "" && uo.formatDepth == dec.tokens.depth() {
-			if uo.format == "emitnull" {
-				uo.format = "" // only relevant for marshaling
-			} else {
-				return newInvalidFormatError("unmarshal", t, uo.format)
+	fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+		xd := export.Decoder(dec)
+		if uo.Format != "" && uo.FormatDepth == xd.Tokens.Depth() {
+			switch uo.Format {
+			case "emitnull", "emitempty":
+				uo.Format = "" // only relevant for marshaling
+			default:
+				return newInvalidFormatError(dec, t)
 			}
 		}
 
@@ -1185,13 +1471,13 @@ func makeSliceArshaler(t reflect.Type) *arshaler {
 		k := tok.Kind()
 		switch k {
 		case 'n':
-			va.Set(reflect.Zero(t))
+			va.SetZero()
 			return nil
 		case '[':
 			once.Do(init)
 			unmarshal := valFncs.unmarshal
 			if uo.Unmarshalers != nil {
-				unmarshal, _ = uo.Unmarshalers.lookup(unmarshal, t.Elem())
+				unmarshal, _ = uo.Unmarshalers.(*Unmarshalers).lookup(unmarshal, t.Elem())
 			}
 			mustZero := true // we do not know the cleanliness of unused capacity
 			cap := va.Cap()
@@ -1199,22 +1485,25 @@ func makeSliceArshaler(t reflect.Type) *arshaler {
 				va.SetLen(cap)
 			}
 			var i int
+			var errUnmarshal error
 			for dec.PeekKind() != ']' {
 				if i == cap {
-					// TODO(https://go.dev/issue/48000): Use reflect.Value.Append.
-					va.Set(reflect.Append(va.Value, reflect.Zero(t.Elem())))
+					va.Value.Grow(1)
 					cap = va.Cap()
 					va.SetLen(cap)
-					mustZero = false // append guarantees that unused capacity is zero-initialized
+					mustZero = false // reflect.Value.Grow ensures new capacity is zero-initialized
 				}
-				v := addressableValue{va.Index(i)} // indexed slice element is always addressable
+				v := addressableValue{va.Index(i), false} // indexed slice element is always addressable
 				i++
-				if mustZero {
-					v.Set(reflect.Zero(t.Elem()))
+				if mustZero && !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+					v.SetZero()
 				}
-				if err := unmarshal(uo, dec, v); err != nil {
-					va.SetLen(i)
-					return err
+				if err := unmarshal(dec, v, uo); err != nil {
+					if isFatalError(err, uo.Flags) {
+						va.SetLen(i)
+						return err
+					}
+					errUnmarshal = cmp.Or(errUnmarshal, err)
 				}
 			}
 			if i == 0 {
@@ -1225,13 +1514,16 @@ func makeSliceArshaler(t reflect.Type) *arshaler {
 			if _, err := dec.ReadToken(); err != nil {
 				return err
 			}
-			return nil
+			return errUnmarshal
 		}
-		return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t}
+		return newUnmarshalErrorAfterWithSkipping(dec, t, nil)
 	}
 	return &fncs
 }
 
+var errArrayUnderflow = errors.New("too few array elements")
+var errArrayOverflow = errors.New("too many array elements")
+
 func makeArrayArshaler(t reflect.Type) *arshaler {
 	var fncs arshaler
 	var (
@@ -1242,32 +1534,34 @@ func makeArrayArshaler(t reflect.Type) *arshaler {
 		valFncs = lookupArshaler(t.Elem())
 	}
 	n := t.Len()
-	fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
-		if mo.format != "" && mo.formatDepth == enc.tokens.depth() {
-			return newInvalidFormatError("marshal", t, mo.format)
+	fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
+		xe := export.Encoder(enc)
+		if mo.Format != "" && mo.FormatDepth == xe.Tokens.Depth() {
+			return newInvalidFormatError(enc, t)
 		}
 		once.Do(init)
-		if err := enc.WriteToken(ArrayStart); err != nil {
+		if err := enc.WriteToken(jsontext.BeginArray); err != nil {
 			return err
 		}
 		marshal := valFncs.marshal
 		if mo.Marshalers != nil {
-			marshal, _ = mo.Marshalers.lookup(marshal, t.Elem())
+			marshal, _ = mo.Marshalers.(*Marshalers).lookup(marshal, t.Elem())
 		}
-		for i := 0; i < n; i++ {
-			v := addressableValue{va.Index(i)} // indexed array element is addressable if array is addressable
-			if err := marshal(mo, enc, v); err != nil {
+		for i := range n {
+			v := addressableValue{va.Index(i), va.forcedAddr} // indexed array element is addressable if array is addressable
+			if err := marshal(enc, v, mo); err != nil {
 				return err
 			}
 		}
-		if err := enc.WriteToken(ArrayEnd); err != nil {
+		if err := enc.WriteToken(jsontext.EndArray); err != nil {
 			return err
 		}
 		return nil
 	}
-	fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-		if uo.format != "" && uo.formatDepth == dec.tokens.depth() {
-			return newInvalidFormatError("unmarshal", t, uo.format)
+	fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+		xd := export.Decoder(dec)
+		if uo.Format != "" && uo.FormatDepth == xd.Tokens.Depth() {
+			return newInvalidFormatError(dec, t)
 		}
 		tok, err := dec.ReadToken()
 		if err != nil {
@@ -1276,37 +1570,51 @@ func makeArrayArshaler(t reflect.Type) *arshaler {
 		k := tok.Kind()
 		switch k {
 		case 'n':
-			va.Set(reflect.Zero(t))
+			if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+				va.SetZero()
+			}
 			return nil
 		case '[':
 			once.Do(init)
 			unmarshal := valFncs.unmarshal
 			if uo.Unmarshalers != nil {
-				unmarshal, _ = uo.Unmarshalers.lookup(unmarshal, t.Elem())
+				unmarshal, _ = uo.Unmarshalers.(*Unmarshalers).lookup(unmarshal, t.Elem())
 			}
 			var i int
+			var errUnmarshal error
 			for dec.PeekKind() != ']' {
 				if i >= n {
-					err := errors.New("too many array elements")
-					return &SemanticError{action: "unmarshal", GoType: t, Err: err}
+					if err := dec.SkipValue(); err != nil {
+						return err
+					}
+					err = errArrayOverflow
+					continue
 				}
-				v := addressableValue{va.Index(i)} // indexed array element is addressable if array is addressable
-				v.Set(reflect.Zero(v.Type()))
-				if err := unmarshal(uo, dec, v); err != nil {
-					return err
+				v := addressableValue{va.Index(i), va.forcedAddr} // indexed array element is addressable if array is addressable
+				if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+					v.SetZero()
+				}
+				if err := unmarshal(dec, v, uo); err != nil {
+					if isFatalError(err, uo.Flags) {
+						return err
+					}
+					errUnmarshal = cmp.Or(errUnmarshal, err)
 				}
 				i++
 			}
+			for ; i < n; i++ {
+				va.Index(i).SetZero()
+				err = errArrayUnderflow
+			}
 			if _, err := dec.ReadToken(); err != nil {
 				return err
 			}
-			if i < n {
-				err := errors.New("too few array elements")
-				return &SemanticError{action: "unmarshal", GoType: t, Err: err}
+			if err != nil && !uo.Flags.Get(jsonflags.UnmarshalArrayFromAnyLength) {
+				return newUnmarshalErrorAfter(dec, t, err)
 			}
-			return nil
+			return errUnmarshal
 		}
-		return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t}
+		return newUnmarshalErrorAfterWithSkipping(dec, t, nil)
 	}
 	return &fncs
 }
@@ -1320,46 +1628,62 @@ func makePointerArshaler(t reflect.Type) *arshaler {
 	init := func() {
 		valFncs = lookupArshaler(t.Elem())
 	}
-	fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
+	fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
 		// Check for cycles.
-		if enc.tokens.depth() > startDetectingCyclesAfter {
-			if err := enc.seenPointers.visit(va.Value); err != nil {
-				return err
+		xe := export.Encoder(enc)
+		if xe.Tokens.Depth() > startDetectingCyclesAfter {
+			if err := visitPointer(&xe.SeenPointers, va.Value); err != nil {
+				return newMarshalErrorBefore(enc, t, err)
 			}
-			defer enc.seenPointers.leave(va.Value)
+			defer leavePointer(&xe.SeenPointers, va.Value)
 		}
 
-		// NOTE: MarshalOptions.format is forwarded to underlying marshal.
+		// NOTE: Struct.Format is forwarded to underlying marshal.
 		if va.IsNil() {
-			return enc.WriteToken(Null)
+			return enc.WriteToken(jsontext.Null)
 		}
 		once.Do(init)
 		marshal := valFncs.marshal
 		if mo.Marshalers != nil {
-			marshal, _ = mo.Marshalers.lookup(marshal, t.Elem())
+			marshal, _ = mo.Marshalers.(*Marshalers).lookup(marshal, t.Elem())
 		}
-		v := addressableValue{va.Elem()} // dereferenced pointer is always addressable
-		return marshal(mo, enc, v)
+		v := addressableValue{va.Elem(), false} // dereferenced pointer is always addressable
+		return marshal(enc, v, mo)
 	}
-	fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-		// NOTE: UnmarshalOptions.format is forwarded to underlying unmarshal.
+	fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+		// NOTE: Struct.Format is forwarded to underlying unmarshal.
 		if dec.PeekKind() == 'n' {
 			if _, err := dec.ReadToken(); err != nil {
 				return err
 			}
-			va.Set(reflect.Zero(t))
+			va.SetZero()
 			return nil
 		}
 		once.Do(init)
 		unmarshal := valFncs.unmarshal
 		if uo.Unmarshalers != nil {
-			unmarshal, _ = uo.Unmarshalers.lookup(unmarshal, t.Elem())
+			unmarshal, _ = uo.Unmarshalers.(*Unmarshalers).lookup(unmarshal, t.Elem())
 		}
 		if va.IsNil() {
 			va.Set(reflect.New(t.Elem()))
 		}
-		v := addressableValue{va.Elem()} // dereferenced pointer is always addressable
-		return unmarshal(uo, dec, v)
+		v := addressableValue{va.Elem(), false} // dereferenced pointer is always addressable
+		if err := unmarshal(dec, v, uo); err != nil {
+			return err
+		}
+		if uo.Flags.Get(jsonflags.StringifyWithLegacySemantics) &&
+			uo.Flags.Get(jsonflags.StringifyNumbers|jsonflags.StringifyBoolsAndStrings) {
+			// A JSON null quoted within a JSON string should take effect
+			// within the pointer value, rather than the indirect value.
+			//
+			// TODO: This does not correctly handle escaped nulls
+			// (e.g., "\u006e\u0075\u006c\u006c"), but is good enough
+			// for such an esoteric use case of the `string` option.
+			if string(export.Decoder(dec).PreviousTokenOrValue()) == `"null"` {
+				va.SetZero()
+			}
+		}
+		return nil
 	}
 	return &fncs
 }
@@ -1370,34 +1694,82 @@ func makeInterfaceArshaler(t reflect.Type) *arshaler {
 	// store them back into the interface afterwards.
 
 	var fncs arshaler
-	fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
-		if mo.format != "" && mo.formatDepth == enc.tokens.depth() {
-			return newInvalidFormatError("marshal", t, mo.format)
+	var whichMarshaler reflect.Type
+	for _, iface := range allMarshalerTypes {
+		if t.Implements(iface) {
+			whichMarshaler = t
+			break
+		}
+	}
+	fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
+		xe := export.Encoder(enc)
+		if mo.Format != "" && mo.FormatDepth == xe.Tokens.Depth() {
+			return newInvalidFormatError(enc, t)
 		}
 		if va.IsNil() {
-			return enc.WriteToken(Null)
+			return enc.WriteToken(jsontext.Null)
+		} else if mo.Flags.Get(jsonflags.CallMethodsWithLegacySemantics) && whichMarshaler != nil {
+			// The marshaler for a pointer never calls the method on a nil receiver.
+			// Wrap the nil pointer within a struct type so that marshal
+			// instead appears on a value receiver and may be called.
+			if va.Elem().Kind() == reflect.Pointer && va.Elem().IsNil() {
+				v2 := newAddressableValue(whichMarshaler)
+				switch whichMarshaler {
+				case jsonMarshalerToType:
+					v2.Set(reflect.ValueOf(struct{ MarshalerTo }{va.Elem().Interface().(MarshalerTo)}))
+				case jsonMarshalerType:
+					v2.Set(reflect.ValueOf(struct{ Marshaler }{va.Elem().Interface().(Marshaler)}))
+				case textAppenderType:
+					v2.Set(reflect.ValueOf(struct{ encoding.TextAppender }{va.Elem().Interface().(encoding.TextAppender)}))
+				case textMarshalerType:
+					v2.Set(reflect.ValueOf(struct{ encoding.TextMarshaler }{va.Elem().Interface().(encoding.TextMarshaler)}))
+				}
+				va = v2
+			}
 		}
 		v := newAddressableValue(va.Elem().Type())
 		v.Set(va.Elem())
 		marshal := lookupArshaler(v.Type()).marshal
 		if mo.Marshalers != nil {
-			marshal, _ = mo.Marshalers.lookup(marshal, v.Type())
+			marshal, _ = mo.Marshalers.(*Marshalers).lookup(marshal, v.Type())
 		}
 		// Optimize for the any type if there are no special options.
-		if optimizeCommon && t == anyType && !mo.StringifyNumbers && mo.format == "" && (mo.Marshalers == nil || !mo.Marshalers.fromAny) {
-			return marshalValueAny(mo, enc, va.Elem().Interface())
+		if optimizeCommon &&
+			t == anyType && !mo.Flags.Get(jsonflags.StringifyNumbers|jsonflags.StringifyBoolsAndStrings) && mo.Format == "" &&
+			(mo.Marshalers == nil || !mo.Marshalers.(*Marshalers).fromAny) {
+			return marshalValueAny(enc, va.Elem().Interface(), mo)
 		}
-		return marshal(mo, enc, v)
+		return marshal(enc, v, mo)
 	}
-	fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-		if uo.format != "" && uo.formatDepth == dec.tokens.depth() {
-			return newInvalidFormatError("unmarshal", t, uo.format)
+	fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+		xd := export.Decoder(dec)
+		if uo.Format != "" && uo.FormatDepth == xd.Tokens.Depth() {
+			return newInvalidFormatError(dec, t)
+		}
+		if uo.Flags.Get(jsonflags.MergeWithLegacySemantics) && !va.IsNil() {
+			// Legacy merge behavior is difficult to explain.
+			// In general, it only merges for non-nil pointer kinds.
+			// As a special case, unmarshaling a JSON null into a pointer
+			// sets a concrete nil pointer of the underlying type
+			// (rather than setting the interface value itself to nil).
+			e := va.Elem()
+			if e.Kind() == reflect.Pointer && !e.IsNil() {
+				if dec.PeekKind() == 'n' && e.Elem().Kind() == reflect.Pointer {
+					if _, err := dec.ReadToken(); err != nil {
+						return err
+					}
+					va.Elem().Elem().SetZero()
+					return nil
+				}
+			} else {
+				va.SetZero()
+			}
 		}
 		if dec.PeekKind() == 'n' {
 			if _, err := dec.ReadToken(); err != nil {
 				return err
 			}
-			va.Set(reflect.Zero(t))
+			va.SetZero()
 			return nil
 		}
 		var v addressableValue
@@ -1407,8 +1779,10 @@ func makeInterfaceArshaler(t reflect.Type) *arshaler {
 			// are always unmarshaled into an any value as Go strings.
 			// Duplicate name check must be enforced since unmarshalValueAny
 			// does not implement merge semantics.
-			if optimizeCommon && t == anyType && uo.format == "" && (uo.Unmarshalers == nil || !uo.Unmarshalers.fromAny) && !dec.options.AllowDuplicateNames {
-				v, err := unmarshalValueAny(uo, dec)
+			if optimizeCommon &&
+				t == anyType && !uo.Flags.Get(jsonflags.AllowDuplicateNames) && uo.Format == "" &&
+				(uo.Unmarshalers == nil || !uo.Unmarshalers.(*Unmarshalers).fromAny) {
+				v, err := unmarshalValueAny(dec, uo)
 				// We must check for nil interface values up front.
 				// See https://go.dev/issue/52310.
 				if v != nil {
@@ -1419,8 +1793,7 @@ func makeInterfaceArshaler(t reflect.Type) *arshaler {
 
 			k := dec.PeekKind()
 			if !isAnyType(t) {
-				err := errors.New("cannot derive concrete type for non-empty interface")
-				return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t, Err: err}
+				return newUnmarshalErrorBeforeWithSkipping(dec, t, internal.ErrNilInterface)
 			}
 			switch k {
 			case 'f', 't':
@@ -1428,7 +1801,11 @@ func makeInterfaceArshaler(t reflect.Type) *arshaler {
 			case '"':
 				v = newAddressableValue(stringType)
 			case '0':
-				v = newAddressableValue(float64Type)
+				if uo.Flags.Get(jsonflags.UnmarshalAnyWithRawNumber) {
+					v = addressableValue{reflect.ValueOf(internal.NewRawNumber()).Elem(), true}
+				} else {
+					v = newAddressableValue(float64Type)
+				}
 			case '{':
 				v = newAddressableValue(mapStringAnyType)
 			case '[':
@@ -1450,9 +1827,9 @@ func makeInterfaceArshaler(t reflect.Type) *arshaler {
 		}
 		unmarshal := lookupArshaler(v.Type()).unmarshal
 		if uo.Unmarshalers != nil {
-			unmarshal, _ = uo.Unmarshalers.lookup(unmarshal, v.Type())
+			unmarshal, _ = uo.Unmarshalers.(*Unmarshalers).lookup(unmarshal, v.Type())
 		}
-		err := unmarshal(uo, dec, v)
+		err := unmarshal(dec, v, uo)
 		va.Set(v.Value)
 		return err
 	}
@@ -1470,16 +1847,62 @@ func isAnyType(t reflect.Type) bool {
 
 func makeInvalidArshaler(t reflect.Type) *arshaler {
 	var fncs arshaler
-	fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
-		return &SemanticError{action: "marshal", GoType: t}
+	fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
+		return newMarshalErrorBefore(enc, t, nil)
 	}
-	fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-		return &SemanticError{action: "unmarshal", GoType: t}
+	fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+		return newUnmarshalErrorBefore(dec, t, nil)
 	}
 	return &fncs
 }
 
-func newInvalidFormatError(action string, t reflect.Type, format string) error {
-	err := fmt.Errorf("invalid format flag: %q", format)
-	return &SemanticError{action: action, GoType: t, Err: err}
+func stringOrNumberKind(isString bool) jsontext.Kind {
+	if isString {
+		return '"'
+	} else {
+		return '0'
+	}
+}
+
+type uintSet64 uint64
+
+func (s uintSet64) has(i uint) bool { return s&(1<<i) > 0 }
+func (s *uintSet64) set(i uint)     { *s |= 1 << i }
+
+// uintSet is a set of unsigned integers.
+// It is optimized for most integers being close to zero.
+type uintSet struct {
+	lo uintSet64
+	hi []uintSet64
+}
+
+// has reports whether i is in the set.
+func (s *uintSet) has(i uint) bool {
+	if i < 64 {
+		return s.lo.has(i)
+	} else {
+		i -= 64
+		iHi, iLo := int(i/64), i%64
+		return iHi < len(s.hi) && s.hi[iHi].has(iLo)
+	}
+}
+
+// insert inserts i into the set and reports whether it was the first insertion.
+func (s *uintSet) insert(i uint) bool {
+	// TODO: Make this inlinable at least for the lower 64-bit case.
+	if i < 64 {
+		has := s.lo.has(i)
+		s.lo.set(i)
+		return !has
+	} else {
+		i -= 64
+		iHi, iLo := int(i/64), i%64
+		if iHi >= len(s.hi) {
+			s.hi = append(s.hi, make([]uintSet64, iHi+1-len(s.hi))...)
+			s.hi = s.hi[:cap(s.hi)]
+		}
+		has := s.hi[iHi].has(iLo)
+		s.hi[iHi].set(iLo)
+		return !has
+	}
 }
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_funcs.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_funcs.go
index 8a4e700839..50dca26b88 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_funcs.go
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_funcs.go
@@ -9,62 +9,75 @@ import (
 	"fmt"
 	"reflect"
 	"sync"
+
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
-// SkipFunc may be returned by MarshalFuncV2 and UnmarshalFuncV2 functions.
+// SkipFunc may be returned by [MarshalToFunc] and [UnmarshalFromFunc] functions.
 //
 // Any function that returns SkipFunc must not cause observable side effects
-// on the provided Encoder or Decoder. For example, it is permissible to call
-// Decoder.PeekKind, but not permissible to call Decoder.ReadToken or
-// Encoder.WriteToken since such methods mutate the state.
-const SkipFunc = jsonError("skip function")
+// on the provided [jsontext.Encoder] or [jsontext.Decoder].
+// For example, it is permissible to call [jsontext.Decoder.PeekKind],
+// but not permissible to call [jsontext.Decoder.ReadToken] or
+// [jsontext.Encoder.WriteToken] since such methods mutate the state.
+var SkipFunc = errors.New("json: skip function")
+
+var errSkipMutation = errors.New("must not read or write any tokens when skipping")
+var errNonSingularValue = errors.New("must read or write exactly one value")
 
 // Marshalers is a list of functions that may override the marshal behavior
-// of specific types. Populate MarshalOptions.Marshalers to use it.
+// of specific types. Populate [WithMarshalers] to use it with
+// [Marshal], [MarshalWrite], or [MarshalEncode].
 // A nil *Marshalers is equivalent to an empty list.
+// There are no exported fields or methods on Marshalers.
 type Marshalers = typedMarshalers
 
-// NewMarshalers constructs a flattened list of marshal functions.
+// JoinMarshalers constructs a flattened list of marshal functions.
 // If multiple functions in the list are applicable for a value of a given type,
 // then those earlier in the list take precedence over those that come later.
-// If a function returns SkipFunc, then the next applicable function is called,
+// If a function returns [SkipFunc], then the next applicable function is called,
 // otherwise the default marshaling behavior is used.
 //
 // For example:
 //
-//	m1 := NewMarshalers(f1, f2)
-//	m2 := NewMarshalers(f0, m1, f3)     // equivalent to m3
-//	m3 := NewMarshalers(f0, f1, f2, f3) // equivalent to m2
-func NewMarshalers(ms ...*Marshalers) *Marshalers {
+//	m1 := JoinMarshalers(f1, f2)
+//	m2 := JoinMarshalers(f0, m1, f3)     // equivalent to m3
+//	m3 := JoinMarshalers(f0, f1, f2, f3) // equivalent to m2
+func JoinMarshalers(ms ...*Marshalers) *Marshalers {
 	return newMarshalers(ms...)
 }
 
 // Unmarshalers is a list of functions that may override the unmarshal behavior
-// of specific types. Populate UnmarshalOptions.Unmarshalers to use it.
+// of specific types. Populate [WithUnmarshalers] to use it with
+// [Unmarshal], [UnmarshalRead], or [UnmarshalDecode].
 // A nil *Unmarshalers is equivalent to an empty list.
+// There are no exported fields or methods on Unmarshalers.
 type Unmarshalers = typedUnmarshalers
 
-// NewUnmarshalers constructs a flattened list of unmarshal functions.
+// JoinUnmarshalers constructs a flattened list of unmarshal functions.
 // If multiple functions in the list are applicable for a value of a given type,
 // then those earlier in the list take precedence over those that come later.
-// If a function returns SkipFunc, then the next applicable function is called,
+// If a function returns [SkipFunc], then the next applicable function is called,
 // otherwise the default unmarshaling behavior is used.
 //
 // For example:
 //
-//	u1 := NewUnmarshalers(f1, f2)
-//	u2 := NewUnmarshalers(f0, u1, f3)     // equivalent to u3
-//	u3 := NewUnmarshalers(f0, f1, f2, f3) // equivalent to u2
-func NewUnmarshalers(us ...*Unmarshalers) *Unmarshalers {
+//	u1 := JoinUnmarshalers(f1, f2)
+//	u2 := JoinUnmarshalers(f0, u1, f3)     // equivalent to u3
+//	u3 := JoinUnmarshalers(f0, f1, f2, f3) // equivalent to u2
+func JoinUnmarshalers(us ...*Unmarshalers) *Unmarshalers {
 	return newUnmarshalers(us...)
 }
 
-type typedMarshalers = typedArshalers[MarshalOptions, Encoder]
-type typedUnmarshalers = typedArshalers[UnmarshalOptions, Decoder]
-type typedArshalers[Options, Coder any] struct {
+type typedMarshalers = typedArshalers[jsontext.Encoder]
+type typedUnmarshalers = typedArshalers[jsontext.Decoder]
+type typedArshalers[Coder any] struct {
 	nonComparable
 
-	fncVals  []typedArshaler[Options, Coder]
+	fncVals  []typedArshaler[Coder]
 	fncCache sync.Map // map[reflect.Type]arshaler
 
 	// fromAny reports whether any of Go types used to represent arbitrary JSON
@@ -78,18 +91,18 @@ type typedArshalers[Options, Coder any] struct {
 	// if this is true.
 	fromAny bool
 }
-type typedMarshaler = typedArshaler[MarshalOptions, Encoder]
-type typedUnmarshaler = typedArshaler[UnmarshalOptions, Decoder]
-type typedArshaler[Options, Coder any] struct {
+type typedMarshaler = typedArshaler[jsontext.Encoder]
+type typedUnmarshaler = typedArshaler[jsontext.Decoder]
+type typedArshaler[Coder any] struct {
 	typ     reflect.Type
-	fnc     func(Options, *Coder, addressableValue) error
+	fnc     func(*Coder, addressableValue, *jsonopts.Struct) error
 	maySkip bool
 }
 
 func newMarshalers(ms ...*Marshalers) *Marshalers       { return newTypedArshalers(ms...) }
 func newUnmarshalers(us ...*Unmarshalers) *Unmarshalers { return newTypedArshalers(us...) }
-func newTypedArshalers[Options, Coder any](as ...*typedArshalers[Options, Coder]) *typedArshalers[Options, Coder] {
-	var a typedArshalers[Options, Coder]
+func newTypedArshalers[Coder any](as ...*typedArshalers[Coder]) *typedArshalers[Coder] {
+	var a typedArshalers[Coder]
 	for _, a2 := range as {
 		if a2 != nil {
 			a.fncVals = append(a.fncVals, a2.fncVals...)
@@ -102,7 +115,7 @@ func newTypedArshalers[Options, Coder any](as ...*typedArshalers[Options, Coder]
 	return &a
 }
 
-func (a *typedArshalers[Options, Coder]) lookup(fnc func(Options, *Coder, addressableValue) error, t reflect.Type) (func(Options, *Coder, addressableValue) error, bool) {
+func (a *typedArshalers[Coder]) lookup(fnc func(*Coder, addressableValue, *jsonopts.Struct) error, t reflect.Type) (func(*Coder, addressableValue, *jsonopts.Struct) error, bool) {
 	if a == nil {
 		return fnc, false
 	}
@@ -110,12 +123,12 @@ func (a *typedArshalers[Options, Coder]) lookup(fnc func(Options, *Coder, addres
 		if v == nil {
 			return fnc, false
 		}
-		return v.(func(Options, *Coder, addressableValue) error), true
+		return v.(func(*Coder, addressableValue, *jsonopts.Struct) error), true
 	}
 
 	// Collect a list of arshalers that can be called for this type.
 	// This list may be longer than 1 since some arshalers can be skipped.
-	var fncs []func(Options, *Coder, addressableValue) error
+	var fncs []func(*Coder, addressableValue, *jsonopts.Struct) error
 	for _, fncVal := range a.fncVals {
 		if !castableTo(t, fncVal.typ) {
 			continue
@@ -133,21 +146,21 @@ func (a *typedArshalers[Options, Coder]) lookup(fnc func(Options, *Coder, addres
 
 	// Construct an arshaler that may call every applicable arshaler.
 	fncDefault := fnc
-	fnc = func(o Options, c *Coder, v addressableValue) error {
+	fnc = func(c *Coder, v addressableValue, o *jsonopts.Struct) error {
 		for _, fnc := range fncs {
-			if err := fnc(o, c, v); err != SkipFunc {
+			if err := fnc(c, v, o); err != SkipFunc {
 				return err // may be nil or non-nil
 			}
 		}
-		return fncDefault(o, c, v)
+		return fncDefault(c, v, o)
 	}
 
 	// Use the first stored so duplicate work can be garbage collected.
 	v, _ := a.fncCache.LoadOrStore(t, fnc)
-	return v.(func(Options, *Coder, addressableValue) error), true
+	return v.(func(*Coder, addressableValue, *jsonopts.Struct) error), true
 }
 
-// MarshalFuncV1 constructs a type-specific marshaler that
+// MarshalFunc constructs a type-specific marshaler that
 // specifies how to marshal values of type T.
 // T can be any type except a named pointer.
 // The function is always provided with a non-nil pointer value
@@ -155,22 +168,30 @@ func (a *typedArshalers[Options, Coder]) lookup(fnc func(Options, *Coder, addres
 //
 // The function must marshal exactly one JSON value.
 // The value of T must not be retained outside the function call.
-// It may not return SkipFunc.
-func MarshalFuncV1[T any](fn func(T) ([]byte, error)) *Marshalers {
-	t := reflect.TypeOf((*T)(nil)).Elem()
+// It may not return [SkipFunc].
+func MarshalFunc[T any](fn func(T) ([]byte, error)) *Marshalers {
+	t := reflect.TypeFor[T]()
 	assertCastableTo(t, true)
 	typFnc := typedMarshaler{
 		typ: t,
-		fnc: func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
+		fnc: func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
 			val, err := fn(va.castTo(t).Interface().(T))
 			if err != nil {
 				err = wrapSkipFunc(err, "marshal function of type func(T) ([]byte, error)")
-				// TODO: Avoid wrapping semantic errors.
-				return &SemanticError{action: "marshal", GoType: t, Err: err}
+				if mo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+					return internal.NewMarshalerError(va.Addr().Interface(), err, "MarshalFunc") // unlike unmarshal, always wrapped
+				}
+				err = newMarshalErrorBefore(enc, t, err)
+				return collapseSemanticErrors(err)
 			}
 			if err := enc.WriteValue(val); err != nil {
-				// TODO: Avoid wrapping semantic or I/O errors.
-				return &SemanticError{action: "marshal", JSONKind: RawValue(val).Kind(), GoType: t, Err: err}
+				if mo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+					return internal.NewMarshalerError(va.Addr().Interface(), err, "MarshalFunc") // unlike unmarshal, always wrapped
+				}
+				if isSyntacticError(err) {
+					err = newMarshalErrorBefore(enc, t, err)
+				}
+				return err
 			}
 			return nil
 		},
@@ -178,39 +199,47 @@ func MarshalFuncV1[T any](fn func(T) ([]byte, error)) *Marshalers {
 	return &Marshalers{fncVals: []typedMarshaler{typFnc}, fromAny: castableToFromAny(t)}
 }
 
-// MarshalFuncV2 constructs a type-specific marshaler that
+// MarshalToFunc constructs a type-specific marshaler that
 // specifies how to marshal values of type T.
 // T can be any type except a named pointer.
 // The function is always provided with a non-nil pointer value
 // if T is an interface or pointer type.
 //
 // The function must marshal exactly one JSON value by calling write methods
-// on the provided encoder. It may return SkipFunc such that marshaling can
+// on the provided encoder. It may return [SkipFunc] such that marshaling can
 // move on to the next marshal function. However, no mutable method calls may
-// be called on the encoder if SkipFunc is returned.
-// The pointer to Encoder and the value of T must not be retained
-// outside the function call.
-func MarshalFuncV2[T any](fn func(MarshalOptions, *Encoder, T) error) *Marshalers {
-	t := reflect.TypeOf((*T)(nil)).Elem()
+// be called on the encoder if [SkipFunc] is returned.
+// The pointer to [jsontext.Encoder] and the value of T
+// must not be retained outside the function call.
+func MarshalToFunc[T any](fn func(*jsontext.Encoder, T) error) *Marshalers {
+	t := reflect.TypeFor[T]()
 	assertCastableTo(t, true)
 	typFnc := typedMarshaler{
 		typ: t,
-		fnc: func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
-			prevDepth, prevLength := enc.tokens.depthLength()
-			err := fn(mo, enc, va.castTo(t).Interface().(T))
-			currDepth, currLength := enc.tokens.depthLength()
+		fnc: func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
+			xe := export.Encoder(enc)
+			prevDepth, prevLength := xe.Tokens.DepthLength()
+			xe.Flags.Set(jsonflags.WithinArshalCall | 1)
+			err := fn(enc, va.castTo(t).Interface().(T))
+			xe.Flags.Set(jsonflags.WithinArshalCall | 0)
+			currDepth, currLength := xe.Tokens.DepthLength()
 			if err == nil && (prevDepth != currDepth || prevLength+1 != currLength) {
-				err = errors.New("must write exactly one JSON value")
+				err = errNonSingularValue
 			}
 			if err != nil {
 				if err == SkipFunc {
 					if prevDepth == currDepth && prevLength == currLength {
 						return SkipFunc
 					}
-					err = errors.New("must not write any JSON tokens when skipping")
+					err = errSkipMutation
+				}
+				if mo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+					return internal.NewMarshalerError(va.Addr().Interface(), err, "MarshalToFunc") // unlike unmarshal, always wrapped
 				}
-				// TODO: Avoid wrapping semantic or I/O errors.
-				return &SemanticError{action: "marshal", GoType: t, Err: err}
+				if !export.IsIOError(err) {
+					err = newSemanticErrorWithPosition(enc, t, prevDepth, prevLength, err)
+				}
+				return err
 			}
 			return nil
 		},
@@ -219,7 +248,7 @@ func MarshalFuncV2[T any](fn func(MarshalOptions, *Encoder, T) error) *Marshaler
 	return &Marshalers{fncVals: []typedMarshaler{typFnc}, fromAny: castableToFromAny(t)}
 }
 
-// UnmarshalFuncV1 constructs a type-specific unmarshaler that
+// UnmarshalFunc constructs a type-specific unmarshaler that
 // specifies how to unmarshal values of type T.
 // T must be an unnamed pointer or an interface type.
 // The function is always provided with a non-nil pointer value.
@@ -227,13 +256,13 @@ func MarshalFuncV2[T any](fn func(MarshalOptions, *Encoder, T) error) *Marshaler
 // The function must unmarshal exactly one JSON value.
 // The input []byte must not be mutated.
 // The input []byte and value T must not be retained outside the function call.
-// It may not return SkipFunc.
-func UnmarshalFuncV1[T any](fn func([]byte, T) error) *Unmarshalers {
-	t := reflect.TypeOf((*T)(nil)).Elem()
+// It may not return [SkipFunc].
+func UnmarshalFunc[T any](fn func([]byte, T) error) *Unmarshalers {
+	t := reflect.TypeFor[T]()
 	assertCastableTo(t, false)
 	typFnc := typedUnmarshaler{
 		typ: t,
-		fnc: func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
+		fnc: func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
 			val, err := dec.ReadValue()
 			if err != nil {
 				return err // must be a syntactic or I/O error
@@ -241,8 +270,11 @@ func UnmarshalFuncV1[T any](fn func([]byte, T) error) *Unmarshalers {
 			err = fn(val, va.castTo(t).Interface().(T))
 			if err != nil {
 				err = wrapSkipFunc(err, "unmarshal function of type func([]byte, T) error")
-				// TODO: Avoid wrapping semantic, syntactic, or I/O errors.
-				return &SemanticError{action: "unmarshal", JSONKind: val.Kind(), GoType: t, Err: err}
+				if uo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+					return err // unlike marshal, never wrapped
+				}
+				err = newUnmarshalErrorAfter(dec, t, err)
+				return collapseSemanticErrors(err)
 			}
 			return nil
 		},
@@ -250,38 +282,49 @@ func UnmarshalFuncV1[T any](fn func([]byte, T) error) *Unmarshalers {
 	return &Unmarshalers{fncVals: []typedUnmarshaler{typFnc}, fromAny: castableToFromAny(t)}
 }
 
-// UnmarshalFuncV2 constructs a type-specific unmarshaler that
+// UnmarshalFromFunc constructs a type-specific unmarshaler that
 // specifies how to unmarshal values of type T.
 // T must be an unnamed pointer or an interface type.
 // The function is always provided with a non-nil pointer value.
 //
 // The function must unmarshal exactly one JSON value by calling read methods
-// on the provided decoder. It may return SkipFunc such that unmarshaling can
+// on the provided decoder. It may return [SkipFunc] such that unmarshaling can
 // move on to the next unmarshal function. However, no mutable method calls may
-// be called on the decoder if SkipFunc is returned.
-// The pointer to Decoder and the value of T must not be retained
-// outside the function call.
-func UnmarshalFuncV2[T any](fn func(UnmarshalOptions, *Decoder, T) error) *Unmarshalers {
-	t := reflect.TypeOf((*T)(nil)).Elem()
+// be called on the decoder if [SkipFunc] is returned.
+// The pointer to [jsontext.Decoder] and the value of T
+// must not be retained outside the function call.
+func UnmarshalFromFunc[T any](fn func(*jsontext.Decoder, T) error) *Unmarshalers {
+	t := reflect.TypeFor[T]()
 	assertCastableTo(t, false)
 	typFnc := typedUnmarshaler{
 		typ: t,
-		fnc: func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-			prevDepth, prevLength := dec.tokens.depthLength()
-			err := fn(uo, dec, va.castTo(t).Interface().(T))
-			currDepth, currLength := dec.tokens.depthLength()
+		fnc: func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+			xd := export.Decoder(dec)
+			prevDepth, prevLength := xd.Tokens.DepthLength()
+			xd.Flags.Set(jsonflags.WithinArshalCall | 1)
+			err := fn(dec, va.castTo(t).Interface().(T))
+			xd.Flags.Set(jsonflags.WithinArshalCall | 0)
+			currDepth, currLength := xd.Tokens.DepthLength()
 			if err == nil && (prevDepth != currDepth || prevLength+1 != currLength) {
-				err = errors.New("must read exactly one JSON value")
+				err = errNonSingularValue
 			}
 			if err != nil {
 				if err == SkipFunc {
 					if prevDepth == currDepth && prevLength == currLength {
 						return SkipFunc
 					}
-					err = errors.New("must not read any JSON tokens when skipping")
+					err = errSkipMutation
+				}
+				if uo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+					if err2 := xd.SkipUntil(prevDepth, prevLength+1); err2 != nil {
+						return err2
+					}
+					return err // unlike marshal, never wrapped
+				}
+				if !isSyntacticError(err) && !export.IsIOError(err) {
+					err = newSemanticErrorWithPosition(dec, t, prevDepth, prevLength, err)
 				}
-				// TODO: Avoid wrapping semantic, syntactic, or I/O errors.
-				return &SemanticError{action: "unmarshal", GoType: t, Err: err}
+				return err
 			}
 			return nil
 		},
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_inlined.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_inlined.go
index 258a98247d..4509b87e41 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_inlined.go
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_inlined.go
@@ -7,7 +7,13 @@ package json
 import (
 	"bytes"
 	"errors"
+	"io"
 	"reflect"
+
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 // This package supports "inlining" a Go struct field, where the contents
@@ -18,18 +24,20 @@ import (
 // nested struct are virtually hoisted up to the parent struct using rules
 // similar to how Go embedding works (but operating within the JSON namespace).
 //
-// However, inlined fields may also be of a Go map type with a string key
-// or a RawValue. Such inlined fields are called "fallback" fields since they
+// However, inlined fields may also be of a Go map type with a string key or
+// a jsontext.Value. Such inlined fields are called "fallback" fields since they
 // represent any arbitrary JSON object member. Explicitly named fields take
 // precedence over the inlined fallback. Only one inlined fallback is allowed.
 
-var rawValueType = reflect.TypeOf((*RawValue)(nil)).Elem()
+var errRawInlinedNotObject = errors.New("inlined raw value must be a JSON object")
+
+var jsontextValueType = reflect.TypeFor[jsontext.Value]()
 
 // marshalInlinedFallbackAll marshals all the members in an inlined fallback.
-func marshalInlinedFallbackAll(mo MarshalOptions, enc *Encoder, va addressableValue, f *structField, insertUnquotedName func([]byte) bool) error {
-	v := addressableValue{va.Field(f.index[0])} // addressable if struct value is addressable
-	if len(f.index) > 1 {
-		v = v.fieldByIndex(f.index[1:], false)
+func marshalInlinedFallbackAll(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct, f *structField, insertUnquotedName func([]byte) bool) error {
+	v := addressableValue{va.Field(f.index0), va.forcedAddr} // addressable if struct value is addressable
+	if len(f.index) > 0 {
+		v = v.fieldByIndex(f.index, false)
 		if !v.IsValid() {
 			return nil // implies a nil inlined field
 		}
@@ -39,34 +47,39 @@ func marshalInlinedFallbackAll(mo MarshalOptions, enc *Encoder, va addressableVa
 		return nil
 	}
 
-	if v.Type() == rawValueType {
-		b := v.Interface().(RawValue)
+	if v.Type() == jsontextValueType {
+		// TODO(https://go.dev/issue/62121): Use reflect.Value.AssertTo.
+		b := *v.Addr().Interface().(*jsontext.Value)
 		if len(b) == 0 { // TODO: Should this be nil? What if it were all whitespace?
 			return nil
 		}
 
-		dec := getBufferedDecoder(b, DecodeOptions{AllowDuplicateNames: true, AllowInvalidUTF8: true})
-		defer putBufferedDecoder(dec)
+		dec := export.GetBufferedDecoder(b)
+		defer export.PutBufferedDecoder(dec)
+		xd := export.Decoder(dec)
+		xd.Flags.Set(jsonflags.AllowDuplicateNames | jsonflags.AllowInvalidUTF8 | 1)
 
 		tok, err := dec.ReadToken()
 		if err != nil {
-			return &SemanticError{action: "marshal", GoType: rawValueType, Err: err}
+			if err == io.EOF {
+				err = io.ErrUnexpectedEOF
+			}
+			return newMarshalErrorBefore(enc, v.Type(), err)
 		}
 		if tok.Kind() != '{' {
-			err := errors.New("inlined raw value must be a JSON object")
-			return &SemanticError{action: "marshal", JSONKind: tok.Kind(), GoType: rawValueType, Err: err}
+			return newMarshalErrorBefore(enc, v.Type(), errRawInlinedNotObject)
 		}
 		for dec.PeekKind() != '}' {
 			// Parse the JSON object name.
-			var flags valueFlags
-			val, err := dec.readValue(&flags)
+			var flags jsonwire.ValueFlags
+			val, err := xd.ReadValue(&flags)
 			if err != nil {
-				return &SemanticError{action: "marshal", GoType: rawValueType, Err: err}
+				return newMarshalErrorBefore(enc, v.Type(), err)
 			}
 			if insertUnquotedName != nil {
-				name := unescapeStringMayCopy(val, flags.isVerbatim())
+				name := jsonwire.UnquoteMayCopy(val, flags.IsVerbatim())
 				if !insertUnquotedName(name) {
-					return &SyntacticError{str: "duplicate name " + string(val) + " in object"}
+					return newDuplicateNameError(enc.StackPointer().Parent(), val, enc.OutputOffset())
 				}
 			}
 			if err := enc.WriteValue(val); err != nil {
@@ -74,55 +87,55 @@ func marshalInlinedFallbackAll(mo MarshalOptions, enc *Encoder, va addressableVa
 			}
 
 			// Parse the JSON object value.
-			val, err = dec.readValue(&flags)
+			val, err = xd.ReadValue(&flags)
 			if err != nil {
-				return &SemanticError{action: "marshal", GoType: rawValueType, Err: err}
+				return newMarshalErrorBefore(enc, v.Type(), err)
 			}
 			if err := enc.WriteValue(val); err != nil {
 				return err
 			}
 		}
 		if _, err := dec.ReadToken(); err != nil {
-			return &SemanticError{action: "marshal", GoType: rawValueType, Err: err}
+			return newMarshalErrorBefore(enc, v.Type(), err)
 		}
-		if err := dec.checkEOF(); err != nil {
-			return &SemanticError{action: "marshal", GoType: rawValueType, Err: err}
+		if err := xd.CheckEOF(); err != nil {
+			return newMarshalErrorBefore(enc, v.Type(), err)
 		}
 		return nil
 	} else {
-		m := v // must be a map[string]V
+		m := v // must be a map[~string]V
 		n := m.Len()
 		if n == 0 {
 			return nil
 		}
-		mk := newAddressableValue(stringType)
+		mk := newAddressableValue(m.Type().Key())
 		mv := newAddressableValue(m.Type().Elem())
 		marshalKey := func(mk addressableValue) error {
-			b, err := appendString(enc.UnusedBuffer(), mk.String(), !enc.options.AllowInvalidUTF8, nil)
+			b, err := jsonwire.AppendQuote(enc.AvailableBuffer(), mk.String(), &mo.Flags)
 			if err != nil {
-				return err
+				return newMarshalErrorBefore(enc, m.Type().Key(), err)
 			}
 			if insertUnquotedName != nil {
 				isVerbatim := bytes.IndexByte(b, '\\') < 0
-				name := unescapeStringMayCopy(b, isVerbatim)
+				name := jsonwire.UnquoteMayCopy(b, isVerbatim)
 				if !insertUnquotedName(name) {
-					return &SyntacticError{str: "duplicate name " + string(b) + " in object"}
+					return newDuplicateNameError(enc.StackPointer().Parent(), b, enc.OutputOffset())
 				}
 			}
 			return enc.WriteValue(b)
 		}
 		marshalVal := f.fncs.marshal
 		if mo.Marshalers != nil {
-			marshalVal, _ = mo.Marshalers.lookup(marshalVal, mv.Type())
+			marshalVal, _ = mo.Marshalers.(*Marshalers).lookup(marshalVal, mv.Type())
 		}
-		if !mo.Deterministic || n <= 1 {
+		if !mo.Flags.Get(jsonflags.Deterministic) || n <= 1 {
 			for iter := m.MapRange(); iter.Next(); {
 				mk.SetIterKey(iter)
 				if err := marshalKey(mk); err != nil {
 					return err
 				}
 				mv.Set(iter.Value())
-				if err := marshalVal(mo, enc, mv); err != nil {
+				if err := marshalVal(enc, mv, mo); err != nil {
 					return err
 				}
 			}
@@ -140,7 +153,7 @@ func marshalInlinedFallbackAll(mo MarshalOptions, enc *Encoder, va addressableVa
 				}
 				// TODO(https://go.dev/issue/57061): Use mv.SetMapIndexOf.
 				mv.Set(m.MapIndex(mk.Value))
-				if err := marshalVal(mo, enc, mv); err != nil {
+				if err := marshalVal(enc, mv, mo); err != nil {
 					return err
 				}
 			}
@@ -151,59 +164,61 @@ func marshalInlinedFallbackAll(mo MarshalOptions, enc *Encoder, va addressableVa
 }
 
 // unmarshalInlinedFallbackNext unmarshals only the next member in an inlined fallback.
-func unmarshalInlinedFallbackNext(uo UnmarshalOptions, dec *Decoder, va addressableValue, f *structField, quotedName, unquotedName []byte) error {
-	v := addressableValue{va.Field(f.index[0])} // addressable if struct value is addressable
-	if len(f.index) > 1 {
-		v = v.fieldByIndex(f.index[1:], true)
+func unmarshalInlinedFallbackNext(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct, f *structField, quotedName, unquotedName []byte) error {
+	v := addressableValue{va.Field(f.index0), va.forcedAddr} // addressable if struct value is addressable
+	if len(f.index) > 0 {
+		v = v.fieldByIndex(f.index, true)
 	}
 	v = v.indirect(true)
 
-	if v.Type() == rawValueType {
-		b := v.Addr().Interface().(*RawValue)
+	if v.Type() == jsontextValueType {
+		b := v.Addr().Interface().(*jsontext.Value)
 		if len(*b) == 0 { // TODO: Should this be nil? What if it were all whitespace?
 			*b = append(*b, '{')
 		} else {
-			*b = trimSuffixWhitespace(*b)
-			if hasSuffixByte(*b, '}') {
+			*b = jsonwire.TrimSuffixWhitespace(*b)
+			if jsonwire.HasSuffixByte(*b, '}') {
 				// TODO: When merging into an object for the first time,
 				// should we verify that it is valid?
-				*b = trimSuffixByte(*b, '}')
-				*b = trimSuffixWhitespace(*b)
-				if !hasSuffixByte(*b, ',') && !hasSuffixByte(*b, '{') {
+				*b = jsonwire.TrimSuffixByte(*b, '}')
+				*b = jsonwire.TrimSuffixWhitespace(*b)
+				if !jsonwire.HasSuffixByte(*b, ',') && !jsonwire.HasSuffixByte(*b, '{') {
 					*b = append(*b, ',')
 				}
 			} else {
-				err := errors.New("inlined raw value must be a JSON object")
-				return &SemanticError{action: "unmarshal", GoType: rawValueType, Err: err}
+				return newUnmarshalErrorAfterWithSkipping(dec, v.Type(), errRawInlinedNotObject)
 			}
 		}
 		*b = append(*b, quotedName...)
 		*b = append(*b, ':')
-		rawValue, err := dec.ReadValue()
+		val, err := dec.ReadValue()
 		if err != nil {
 			return err
 		}
-		*b = append(*b, rawValue...)
+		*b = append(*b, val...)
 		*b = append(*b, '}')
 		return nil
 	} else {
 		name := string(unquotedName) // TODO: Intern this?
 
-		m := v // must be a map[string]V
+		m := v // must be a map[~string]V
 		if m.IsNil() {
 			m.Set(reflect.MakeMap(m.Type()))
 		}
 		mk := reflect.ValueOf(name)
-		mv := newAddressableValue(v.Type().Elem()) // TODO: Cache across calls?
+		if mkt := m.Type().Key(); mkt != stringType {
+			mk = mk.Convert(mkt)
+		}
+		mv := newAddressableValue(m.Type().Elem()) // TODO: Cache across calls?
 		if v2 := m.MapIndex(mk); v2.IsValid() {
 			mv.Set(v2)
 		}
 
 		unmarshal := f.fncs.unmarshal
 		if uo.Unmarshalers != nil {
-			unmarshal, _ = uo.Unmarshalers.lookup(unmarshal, mv.Type())
+			unmarshal, _ = uo.Unmarshalers.(*Unmarshalers).lookup(unmarshal, mv.Type())
 		}
-		err := unmarshal(uo, dec, mv)
+		err := unmarshal(dec, mv, uo)
 		m.SetMapIndex(mk, mv.Value)
 		if err != nil {
 			return err
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_methods.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_methods.go
index 20899c868c..42d6ee8762 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_methods.go
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_methods.go
@@ -8,47 +8,60 @@ import (
 	"encoding"
 	"errors"
 	"reflect"
+
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
+var errNonStringValue = errors.New("JSON value must be string type")
+
 // Interfaces for custom serialization.
 var (
-	jsonMarshalerV1Type   = reflect.TypeOf((*MarshalerV1)(nil)).Elem()
-	jsonMarshalerV2Type   = reflect.TypeOf((*MarshalerV2)(nil)).Elem()
-	jsonUnmarshalerV1Type = reflect.TypeOf((*UnmarshalerV1)(nil)).Elem()
-	jsonUnmarshalerV2Type = reflect.TypeOf((*UnmarshalerV2)(nil)).Elem()
-	textMarshalerType     = reflect.TypeOf((*encoding.TextMarshaler)(nil)).Elem()
-	textUnmarshalerType   = reflect.TypeOf((*encoding.TextUnmarshaler)(nil)).Elem()
+	jsonMarshalerType       = reflect.TypeFor[Marshaler]()
+	jsonMarshalerToType     = reflect.TypeFor[MarshalerTo]()
+	jsonUnmarshalerType     = reflect.TypeFor[Unmarshaler]()
+	jsonUnmarshalerFromType = reflect.TypeFor[UnmarshalerFrom]()
+	textAppenderType        = reflect.TypeFor[encoding.TextAppender]()
+	textMarshalerType       = reflect.TypeFor[encoding.TextMarshaler]()
+	textUnmarshalerType     = reflect.TypeFor[encoding.TextUnmarshaler]()
+
+	allMarshalerTypes   = []reflect.Type{jsonMarshalerToType, jsonMarshalerType, textAppenderType, textMarshalerType}
+	allUnmarshalerTypes = []reflect.Type{jsonUnmarshalerFromType, jsonUnmarshalerType, textUnmarshalerType}
+	allMethodTypes      = append(allMarshalerTypes, allUnmarshalerTypes...)
 )
 
-// MarshalerV1 is implemented by types that can marshal themselves.
-// It is recommended that types implement MarshalerV2 unless the implementation
+// Marshaler is implemented by types that can marshal themselves.
+// It is recommended that types implement [MarshalerTo] unless the implementation
 // is trying to avoid a hard dependency on the "jsontext" package.
 //
 // It is recommended that implementations return a buffer that is safe
 // for the caller to retain and potentially mutate.
-type MarshalerV1 interface {
+type Marshaler interface {
 	MarshalJSON() ([]byte, error)
 }
 
-// MarshalerV2 is implemented by types that can marshal themselves.
-// It is recommended that types implement MarshalerV2 instead of MarshalerV1
+// MarshalerTo is implemented by types that can marshal themselves.
+// It is recommended that types implement MarshalerTo instead of [Marshaler]
 // since this is both more performant and flexible.
-// If a type implements both MarshalerV1 and MarshalerV2,
-// then MarshalerV2 takes precedence. In such a case, both implementations
+// If a type implements both Marshaler and MarshalerTo,
+// then MarshalerTo takes precedence. In such a case, both implementations
 // should aim to have equivalent behavior for the default marshal options.
 //
 // The implementation must write only one JSON value to the Encoder and
-// must not retain the pointer to Encoder.
-type MarshalerV2 interface {
-	MarshalNextJSON(MarshalOptions, *Encoder) error
+// must not retain the pointer to [jsontext.Encoder].
+type MarshalerTo interface {
+	MarshalJSONTo(*jsontext.Encoder) error
 
-	// TODO: Should users call the MarshalOptions.MarshalNext method or
+	// TODO: Should users call the MarshalEncode function or
 	// should/can they call this method directly? Does it matter?
 }
 
-// UnmarshalerV1 is implemented by types that can unmarshal themselves.
-// It is recommended that types implement UnmarshalerV2 unless
-// the implementation is trying to avoid a hard dependency on this package.
+// Unmarshaler is implemented by types that can unmarshal themselves.
+// It is recommended that types implement [UnmarshalerFrom] unless the implementation
+// is trying to avoid a hard dependency on the "jsontext" package.
 //
 // The input can be assumed to be a valid encoding of a JSON value
 // if called from unmarshal functionality in this package.
@@ -57,26 +70,26 @@ type MarshalerV2 interface {
 // unmarshaling into a pre-populated value.
 //
 // Implementations must not retain or mutate the input []byte.
-type UnmarshalerV1 interface {
+type Unmarshaler interface {
 	UnmarshalJSON([]byte) error
 }
 
-// UnmarshalerV2 is implemented by types that can unmarshal themselves.
-// It is recommended that types implement UnmarshalerV2 instead of UnmarshalerV1
+// UnmarshalerFrom is implemented by types that can unmarshal themselves.
+// It is recommended that types implement UnmarshalerFrom instead of [Unmarshaler]
 // since this is both more performant and flexible.
-// If a type implements both UnmarshalerV1 and UnmarshalerV2,
-// then UnmarshalerV2 takes precedence. In such a case, both implementations
+// If a type implements both Unmarshaler and UnmarshalerFrom,
+// then UnmarshalerFrom takes precedence. In such a case, both implementations
 // should aim to have equivalent behavior for the default unmarshal options.
 //
 // The implementation must read only one JSON value from the Decoder.
-// It is recommended that UnmarshalNextJSON implement merge semantics when
+// It is recommended that UnmarshalJSONFrom implement merge semantics when
 // unmarshaling into a pre-populated value.
 //
-// Implementations must not retain the pointer to Decoder.
-type UnmarshalerV2 interface {
-	UnmarshalNextJSON(UnmarshalOptions, *Decoder) error
+// Implementations must not retain the pointer to [jsontext.Decoder].
+type UnmarshalerFrom interface {
+	UnmarshalJSONFrom(*jsontext.Decoder) error
 
-	// TODO: Should users call the UnmarshalOptions.UnmarshalNext method or
+	// TODO: Should users call the UnmarshalDecode function or
 	// should/can they call this method directly? Does it matter?
 }
 
@@ -88,114 +101,205 @@ func makeMethodArshaler(fncs *arshaler, t reflect.Type) *arshaler {
 		return fncs
 	}
 
-	// Handle custom marshaler.
-	switch which, needAddr := implementsWhich(t, jsonMarshalerV2Type, jsonMarshalerV1Type, textMarshalerType); which {
-	case jsonMarshalerV2Type:
+	if needAddr, ok := implements(t, textMarshalerType); ok {
 		fncs.nonDefault = true
-		fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
-			prevDepth, prevLength := enc.tokens.depthLength()
-			err := va.addrWhen(needAddr).Interface().(MarshalerV2).MarshalNextJSON(mo, enc)
-			currDepth, currLength := enc.tokens.depthLength()
-			if (prevDepth != currDepth || prevLength+1 != currLength) && err == nil {
-				err = errors.New("must write exactly one JSON value")
+		prevMarshal := fncs.marshal
+		fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
+			if mo.Flags.Get(jsonflags.CallMethodsWithLegacySemantics) &&
+				(needAddr && va.forcedAddr) {
+				return prevMarshal(enc, va, mo)
 			}
-			if err != nil {
+			marshaler := va.Addr().Interface().(encoding.TextMarshaler)
+			if err := export.Encoder(enc).AppendRaw('"', false, func(b []byte) ([]byte, error) {
+				b2, err := marshaler.MarshalText()
+				return append(b, b2...), err
+			}); err != nil {
 				err = wrapSkipFunc(err, "marshal method")
-				// TODO: Avoid wrapping semantic or I/O errors.
-				return &SemanticError{action: "marshal", GoType: t, Err: err}
+				if mo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+					return internal.NewMarshalerError(va.Addr().Interface(), err, "MarshalText") // unlike unmarshal, always wrapped
+				}
+				if !isSemanticError(err) && !export.IsIOError(err) {
+					err = newMarshalErrorBefore(enc, t, err)
+				}
+				return err
 			}
 			return nil
 		}
-	case jsonMarshalerV1Type:
+	}
+
+	if needAddr, ok := implements(t, textAppenderType); ok {
 		fncs.nonDefault = true
-		fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
-			marshaler := va.addrWhen(needAddr).Interface().(MarshalerV1)
-			val, err := marshaler.MarshalJSON()
-			if err != nil {
-				err = wrapSkipFunc(err, "marshal method")
-				// TODO: Avoid wrapping semantic errors.
-				return &SemanticError{action: "marshal", GoType: t, Err: err}
+		prevMarshal := fncs.marshal
+		fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) (err error) {
+			if mo.Flags.Get(jsonflags.CallMethodsWithLegacySemantics) &&
+				(needAddr && va.forcedAddr) {
+				return prevMarshal(enc, va, mo)
 			}
-			if err := enc.WriteValue(val); err != nil {
-				// TODO: Avoid wrapping semantic or I/O errors.
-				return &SemanticError{action: "marshal", JSONKind: RawValue(val).Kind(), GoType: t, Err: err}
+			appender := va.Addr().Interface().(encoding.TextAppender)
+			if err := export.Encoder(enc).AppendRaw('"', false, appender.AppendText); err != nil {
+				err = wrapSkipFunc(err, "append method")
+				if mo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+					return internal.NewMarshalerError(va.Addr().Interface(), err, "AppendText") // unlike unmarshal, always wrapped
+				}
+				if !isSemanticError(err) && !export.IsIOError(err) {
+					err = newMarshalErrorBefore(enc, t, err)
+				}
+				return err
 			}
 			return nil
 		}
-	case textMarshalerType:
+	}
+
+	if needAddr, ok := implements(t, jsonMarshalerType); ok {
 		fncs.nonDefault = true
-		fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
-			marshaler := va.addrWhen(needAddr).Interface().(encoding.TextMarshaler)
-			s, err := marshaler.MarshalText()
-			if err != nil {
-				err = wrapSkipFunc(err, "marshal method")
-				// TODO: Avoid wrapping semantic errors.
-				return &SemanticError{action: "marshal", JSONKind: '"', GoType: t, Err: err}
+		prevMarshal := fncs.marshal
+		fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
+			if mo.Flags.Get(jsonflags.CallMethodsWithLegacySemantics) &&
+				((needAddr && va.forcedAddr) || export.Encoder(enc).Tokens.Last.NeedObjectName()) {
+				return prevMarshal(enc, va, mo)
 			}
-			val := enc.UnusedBuffer()
-			val, err = appendString(val, string(s), true, nil)
+			marshaler := va.Addr().Interface().(Marshaler)
+			val, err := marshaler.MarshalJSON()
 			if err != nil {
-				return &SemanticError{action: "marshal", JSONKind: '"', GoType: t, Err: err}
+				err = wrapSkipFunc(err, "marshal method")
+				if mo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+					return internal.NewMarshalerError(va.Addr().Interface(), err, "MarshalJSON") // unlike unmarshal, always wrapped
+				}
+				err = newMarshalErrorBefore(enc, t, err)
+				return collapseSemanticErrors(err)
 			}
 			if err := enc.WriteValue(val); err != nil {
-				// TODO: Avoid wrapping syntactic or I/O errors.
-				return &SemanticError{action: "marshal", JSONKind: '"', GoType: t, Err: err}
+				if mo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+					return internal.NewMarshalerError(va.Addr().Interface(), err, "MarshalJSON") // unlike unmarshal, always wrapped
+				}
+				if isSyntacticError(err) {
+					err = newMarshalErrorBefore(enc, t, err)
+				}
+				return err
 			}
 			return nil
 		}
 	}
 
-	// Handle custom unmarshaler.
-	switch which, needAddr := implementsWhich(t, jsonUnmarshalerV2Type, jsonUnmarshalerV1Type, textUnmarshalerType); which {
-	case jsonUnmarshalerV2Type:
+	if needAddr, ok := implements(t, jsonMarshalerToType); ok {
 		fncs.nonDefault = true
-		fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-			prevDepth, prevLength := dec.tokens.depthLength()
-			err := va.addrWhen(needAddr).Interface().(UnmarshalerV2).UnmarshalNextJSON(uo, dec)
-			currDepth, currLength := dec.tokens.depthLength()
+		prevMarshal := fncs.marshal
+		fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
+			if mo.Flags.Get(jsonflags.CallMethodsWithLegacySemantics) &&
+				((needAddr && va.forcedAddr) || export.Encoder(enc).Tokens.Last.NeedObjectName()) {
+				return prevMarshal(enc, va, mo)
+			}
+			xe := export.Encoder(enc)
+			prevDepth, prevLength := xe.Tokens.DepthLength()
+			xe.Flags.Set(jsonflags.WithinArshalCall | 1)
+			err := va.Addr().Interface().(MarshalerTo).MarshalJSONTo(enc)
+			xe.Flags.Set(jsonflags.WithinArshalCall | 0)
+			currDepth, currLength := xe.Tokens.DepthLength()
 			if (prevDepth != currDepth || prevLength+1 != currLength) && err == nil {
-				err = errors.New("must read exactly one JSON value")
+				err = errNonSingularValue
+			}
+			if err != nil {
+				err = wrapSkipFunc(err, "marshal method")
+				if mo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+					return internal.NewMarshalerError(va.Addr().Interface(), err, "MarshalJSONTo") // unlike unmarshal, always wrapped
+				}
+				if !export.IsIOError(err) {
+					err = newSemanticErrorWithPosition(enc, t, prevDepth, prevLength, err)
+				}
+				return err
 			}
+			return nil
+		}
+	}
+
+	if _, ok := implements(t, textUnmarshalerType); ok {
+		fncs.nonDefault = true
+		fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+			xd := export.Decoder(dec)
+			var flags jsonwire.ValueFlags
+			val, err := xd.ReadValue(&flags)
 			if err != nil {
+				return err // must be a syntactic or I/O error
+			}
+			if val.Kind() == 'n' {
+				if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+					va.SetZero()
+				}
+				return nil
+			}
+			if val.Kind() != '"' {
+				return newUnmarshalErrorAfter(dec, t, errNonStringValue)
+			}
+			s := jsonwire.UnquoteMayCopy(val, flags.IsVerbatim())
+			unmarshaler := va.Addr().Interface().(encoding.TextUnmarshaler)
+			if err := unmarshaler.UnmarshalText(s); err != nil {
 				err = wrapSkipFunc(err, "unmarshal method")
-				// TODO: Avoid wrapping semantic, syntactic, or I/O errors.
-				return &SemanticError{action: "unmarshal", GoType: t, Err: err}
+				if uo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+					return err // unlike marshal, never wrapped
+				}
+				if !isSemanticError(err) && !isSyntacticError(err) && !export.IsIOError(err) {
+					err = newUnmarshalErrorAfter(dec, t, err)
+				}
+				return err
 			}
 			return nil
 		}
-	case jsonUnmarshalerV1Type:
+	}
+
+	if _, ok := implements(t, jsonUnmarshalerType); ok {
 		fncs.nonDefault = true
-		fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
+		prevUnmarshal := fncs.unmarshal
+		fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+			if uo.Flags.Get(jsonflags.CallMethodsWithLegacySemantics) &&
+				export.Decoder(dec).Tokens.Last.NeedObjectName() {
+				return prevUnmarshal(dec, va, uo)
+			}
 			val, err := dec.ReadValue()
 			if err != nil {
 				return err // must be a syntactic or I/O error
 			}
-			unmarshaler := va.addrWhen(needAddr).Interface().(UnmarshalerV1)
+			unmarshaler := va.Addr().Interface().(Unmarshaler)
 			if err := unmarshaler.UnmarshalJSON(val); err != nil {
 				err = wrapSkipFunc(err, "unmarshal method")
-				// TODO: Avoid wrapping semantic, syntactic, or I/O errors.
-				return &SemanticError{action: "unmarshal", JSONKind: val.Kind(), GoType: t, Err: err}
+				if uo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+					return err // unlike marshal, never wrapped
+				}
+				err = newUnmarshalErrorAfter(dec, t, err)
+				return collapseSemanticErrors(err)
 			}
 			return nil
 		}
-	case textUnmarshalerType:
+	}
+
+	if _, ok := implements(t, jsonUnmarshalerFromType); ok {
 		fncs.nonDefault = true
-		fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-			var flags valueFlags
-			val, err := dec.readValue(&flags)
-			if err != nil {
-				return err // must be a syntactic or I/O error
+		prevUnmarshal := fncs.unmarshal
+		fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+			if uo.Flags.Get(jsonflags.CallMethodsWithLegacySemantics) &&
+				export.Decoder(dec).Tokens.Last.NeedObjectName() {
+				return prevUnmarshal(dec, va, uo)
 			}
-			if val.Kind() != '"' {
-				err = errors.New("JSON value must be string type")
-				return &SemanticError{action: "unmarshal", JSONKind: val.Kind(), GoType: t, Err: err}
+			xd := export.Decoder(dec)
+			prevDepth, prevLength := xd.Tokens.DepthLength()
+			xd.Flags.Set(jsonflags.WithinArshalCall | 1)
+			err := va.Addr().Interface().(UnmarshalerFrom).UnmarshalJSONFrom(dec)
+			xd.Flags.Set(jsonflags.WithinArshalCall | 0)
+			currDepth, currLength := xd.Tokens.DepthLength()
+			if (prevDepth != currDepth || prevLength+1 != currLength) && err == nil {
+				err = errNonSingularValue
 			}
-			s := unescapeStringMayCopy(val, flags.isVerbatim())
-			unmarshaler := va.addrWhen(needAddr).Interface().(encoding.TextUnmarshaler)
-			if err := unmarshaler.UnmarshalText(s); err != nil {
+			if err != nil {
 				err = wrapSkipFunc(err, "unmarshal method")
-				// TODO: Avoid wrapping semantic, syntactic, or I/O errors.
-				return &SemanticError{action: "unmarshal", JSONKind: val.Kind(), GoType: t, Err: err}
+				if uo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+					if err2 := xd.SkipUntil(prevDepth, prevLength+1); err2 != nil {
+						return err2
+					}
+					return err // unlike marshal, never wrapped
+				}
+				if !isSyntacticError(err) && !export.IsIOError(err) {
+					err = newSemanticErrorWithPosition(dec, t, prevDepth, prevLength, err)
+				}
+				return err
 			}
 			return nil
 		}
@@ -204,26 +308,28 @@ func makeMethodArshaler(fncs *arshaler, t reflect.Type) *arshaler {
 	return fncs
 }
 
-// implementsWhich is like t.Implements(ifaceType) for a list of interfaces,
+// implementsAny is like t.Implements(ifaceType) for a list of interfaces,
 // but checks whether either t or reflect.PointerTo(t) implements the interface.
-// It returns the first interface type that matches and whether a value of t
-// needs to be addressed first before it implements the interface.
-func implementsWhich(t reflect.Type, ifaceTypes ...reflect.Type) (which reflect.Type, needAddr bool) {
+func implementsAny(t reflect.Type, ifaceTypes ...reflect.Type) bool {
 	for _, ifaceType := range ifaceTypes {
-		switch {
-		case t.Implements(ifaceType):
-			return ifaceType, false
-		case reflect.PointerTo(t).Implements(ifaceType):
-			return ifaceType, true
+		if _, ok := implements(t, ifaceType); ok {
+			return true
 		}
 	}
-	return nil, false
+	return false
 }
 
-// addrWhen returns va.Addr if addr is specified, otherwise it returns itself.
-func (va addressableValue) addrWhen(addr bool) reflect.Value {
-	if addr {
-		return va.Addr()
+// implements is like t.Implements(ifaceType) but checks whether
+// either t or reflect.PointerTo(t) implements the interface.
+// It also reports whether the value needs to be addressed
+// in order to satisfy the interface.
+func implements(t, ifaceType reflect.Type) (needAddr, ok bool) {
+	switch {
+	case t.Implements(ifaceType):
+		return false, true
+	case reflect.PointerTo(t).Implements(ifaceType):
+		return true, true
+	default:
+		return false, false
 	}
-	return va.Value
 }
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_time.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_time.go
index fc8d5b0070..30dd584d12 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_time.go
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_time.go
@@ -5,20 +5,31 @@
 package json
 
 import (
+	"bytes"
+	"cmp"
 	"errors"
 	"fmt"
+	"math"
+	"math/bits"
 	"reflect"
+	"strconv"
 	"strings"
 	"time"
+
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 var (
-	timeDurationType = reflect.TypeOf((*time.Duration)(nil)).Elem()
-	timeTimeType     = reflect.TypeOf((*time.Time)(nil)).Elem()
+	timeDurationType = reflect.TypeFor[time.Duration]()
+	timeTimeType     = reflect.TypeFor[time.Time]()
 )
 
 func makeTimeArshaler(fncs *arshaler, t reflect.Type) *arshaler {
-	// Ideally, time types would implement MarshalerV2 and UnmarshalerV2,
+	// Ideally, time types would implement MarshalerTo and UnmarshalerFrom,
 	// but that would incur a dependency on package json from package time.
 	// Given how widely used time is, it is more acceptable that we incur a
 	// dependency on time from json.
@@ -29,213 +40,736 @@ func makeTimeArshaler(fncs *arshaler, t reflect.Type) *arshaler {
 	switch t {
 	case timeDurationType:
 		fncs.nonDefault = true
-		marshalNanos := fncs.marshal
-		fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
-			if mo.format != "" && mo.formatDepth == enc.tokens.depth() {
-				if mo.format == "nanos" {
-					mo.format = ""
-					return marshalNanos(mo, enc, va)
-				} else {
-					return newInvalidFormatError("marshal", t, mo.format)
+		marshalNano := fncs.marshal
+		fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) error {
+			xe := export.Encoder(enc)
+			var m durationArshaler
+			if mo.Format != "" && mo.FormatDepth == xe.Tokens.Depth() {
+				if !m.initFormat(mo.Format) {
+					return newInvalidFormatError(enc, t)
 				}
+			} else if mo.Flags.Get(jsonflags.FormatDurationAsNano) {
+				return marshalNano(enc, va, mo)
+			} else {
+				// TODO(https://go.dev/issue/71631): Decide on default duration representation.
+				return newMarshalErrorBefore(enc, t, errors.New("no default representation (see https://go.dev/issue/71631); specify an explicit format"))
 			}
 
-			td := va.Interface().(time.Duration)
-			b := enc.UnusedBuffer()
-			b = append(b, '"')
-			b = append(b, td.String()...) // never contains special characters
-			b = append(b, '"')
-			return enc.WriteValue(b)
-		}
-		unmarshalNanos := fncs.unmarshal
-		fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-			// TODO: Should there be a flag that specifies that we can unmarshal
-			// from either form since there would be no ambiguity?
-			if uo.format != "" && uo.formatDepth == dec.tokens.depth() {
-				if uo.format == "nanos" {
-					uo.format = ""
-					return unmarshalNanos(uo, dec, va)
-				} else {
-					return newInvalidFormatError("unmarshal", t, uo.format)
+			// TODO(https://go.dev/issue/62121): Use reflect.Value.AssertTo.
+			m.td = *va.Addr().Interface().(*time.Duration)
+			k := stringOrNumberKind(!m.isNumeric() || xe.Tokens.Last.NeedObjectName() || mo.Flags.Get(jsonflags.StringifyNumbers))
+			if err := xe.AppendRaw(k, true, m.appendMarshal); err != nil {
+				if !isSyntacticError(err) && !export.IsIOError(err) {
+					err = newMarshalErrorBefore(enc, t, err)
+				}
+				return err
+			}
+			return nil
+		}
+		unmarshalNano := fncs.unmarshal
+		fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) error {
+			xd := export.Decoder(dec)
+			var u durationArshaler
+			if uo.Format != "" && uo.FormatDepth == xd.Tokens.Depth() {
+				if !u.initFormat(uo.Format) {
+					return newInvalidFormatError(dec, t)
 				}
+			} else if uo.Flags.Get(jsonflags.FormatDurationAsNano) {
+				return unmarshalNano(dec, va, uo)
+			} else {
+				// TODO(https://go.dev/issue/71631): Decide on default duration representation.
+				return newUnmarshalErrorBeforeWithSkipping(dec, t, errors.New("no default representation (see https://go.dev/issue/71631); specify an explicit format"))
 			}
 
-			var flags valueFlags
+			stringify := !u.isNumeric() || xd.Tokens.Last.NeedObjectName() || uo.Flags.Get(jsonflags.StringifyNumbers)
+			var flags jsonwire.ValueFlags
 			td := va.Addr().Interface().(*time.Duration)
-			val, err := dec.readValue(&flags)
+			val, err := xd.ReadValue(&flags)
 			if err != nil {
 				return err
 			}
 			switch k := val.Kind(); k {
 			case 'n':
-				*td = time.Duration(0)
+				if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+					*td = time.Duration(0)
+				}
 				return nil
 			case '"':
-				val = unescapeStringMayCopy(val, flags.isVerbatim())
-				td2, err := time.ParseDuration(string(val))
-				if err != nil {
-					return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t, Err: err}
+				if !stringify {
+					break
+				}
+				val = jsonwire.UnquoteMayCopy(val, flags.IsVerbatim())
+				if err := u.unmarshal(val); err != nil {
+					return newUnmarshalErrorAfter(dec, t, err)
+				}
+				*td = u.td
+				return nil
+			case '0':
+				if stringify {
+					break
+				}
+				if err := u.unmarshal(val); err != nil {
+					return newUnmarshalErrorAfter(dec, t, err)
 				}
-				*td = td2
+				*td = u.td
 				return nil
-			default:
-				return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t}
 			}
+			return newUnmarshalErrorAfter(dec, t, nil)
 		}
 	case timeTimeType:
 		fncs.nonDefault = true
-		fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
-			format := time.RFC3339Nano
-			isRFC3339 := true
-			if mo.format != "" && mo.formatDepth == enc.tokens.depth() {
-				var err error
-				format, isRFC3339, err = checkTimeFormat(mo.format)
-				if err != nil {
-					return &SemanticError{action: "marshal", GoType: t, Err: err}
+		fncs.marshal = func(enc *jsontext.Encoder, va addressableValue, mo *jsonopts.Struct) (err error) {
+			xe := export.Encoder(enc)
+			var m timeArshaler
+			if mo.Format != "" && mo.FormatDepth == xe.Tokens.Depth() {
+				if !m.initFormat(mo.Format) {
+					return newInvalidFormatError(enc, t)
 				}
 			}
 
-			tt := va.Interface().(time.Time)
-			b := enc.UnusedBuffer()
-			b = append(b, '"')
-			b = tt.AppendFormat(b, format)
-			b = append(b, '"')
-			if isRFC3339 {
-				// Not all Go timestamps can be represented as valid RFC 3339.
-				// Explicitly check for these edge cases.
-				// See https://go.dev/issue/4556 and https://go.dev/issue/54580.
-				var err error
-				switch b := b[len(`"`) : len(b)-len(`"`)]; {
-				case b[len("9999")] != '-': // year must be exactly 4 digits wide
-					err = errors.New("year outside of range [0,9999]")
-				case b[len(b)-1] != 'Z':
-					c := b[len(b)-len("Z07:00")]
-					if ('0' <= c && c <= '9') || parseDec2(b[len(b)-len("07:00"):]) >= 24 {
-						err = errors.New("timezone hour outside of range [0,23]")
-					}
+			// TODO(https://go.dev/issue/62121): Use reflect.Value.AssertTo.
+			m.tt = *va.Addr().Interface().(*time.Time)
+			k := stringOrNumberKind(!m.isNumeric() || xe.Tokens.Last.NeedObjectName() || mo.Flags.Get(jsonflags.StringifyNumbers))
+			if err := xe.AppendRaw(k, !m.hasCustomFormat(), m.appendMarshal); err != nil {
+				if mo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+					return internal.NewMarshalerError(va.Addr().Interface(), err, "MarshalJSON") // unlike unmarshal, always wrapped
 				}
-				if err != nil {
-					return &SemanticError{action: "marshal", GoType: t, Err: err}
+				if !isSyntacticError(err) && !export.IsIOError(err) {
+					err = newMarshalErrorBefore(enc, t, err)
 				}
-				return enc.WriteValue(b) // RFC 3339 never needs JSON escaping
-			}
-			// The format may contain special characters that need escaping.
-			// Verify that the result is a valid JSON string (common case),
-			// otherwise escape the string correctly (slower case).
-			if consumeSimpleString(b) != len(b) {
-				b, _ = appendString(nil, string(b[len(`"`):len(b)-len(`"`)]), true, nil)
+				return err
 			}
-			return enc.WriteValue(b)
+			return nil
 		}
-		fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-			format := time.RFC3339
-			isRFC3339 := true
-			if uo.format != "" && uo.formatDepth == dec.tokens.depth() {
-				var err error
-				format, isRFC3339, err = checkTimeFormat(uo.format)
-				if err != nil {
-					return &SemanticError{action: "unmarshal", GoType: t, Err: err}
+		fncs.unmarshal = func(dec *jsontext.Decoder, va addressableValue, uo *jsonopts.Struct) (err error) {
+			xd := export.Decoder(dec)
+			var u timeArshaler
+			if uo.Format != "" && uo.FormatDepth == xd.Tokens.Depth() {
+				if !u.initFormat(uo.Format) {
+					return newInvalidFormatError(dec, t)
 				}
+			} else if uo.Flags.Get(jsonflags.ParseTimeWithLooseRFC3339) {
+				u.looseRFC3339 = true
 			}
 
-			var flags valueFlags
+			stringify := !u.isNumeric() || xd.Tokens.Last.NeedObjectName() || uo.Flags.Get(jsonflags.StringifyNumbers)
+			var flags jsonwire.ValueFlags
 			tt := va.Addr().Interface().(*time.Time)
-			val, err := dec.readValue(&flags)
+			val, err := xd.ReadValue(&flags)
 			if err != nil {
 				return err
 			}
-			k := val.Kind()
-			switch k {
+			switch k := val.Kind(); k {
 			case 'n':
-				*tt = time.Time{}
+				if !uo.Flags.Get(jsonflags.MergeWithLegacySemantics) {
+					*tt = time.Time{}
+				}
 				return nil
 			case '"':
-				val = unescapeStringMayCopy(val, flags.isVerbatim())
-				tt2, err := time.Parse(format, string(val))
-				if isRFC3339 && err == nil {
-					// TODO(https://go.dev/issue/54580): RFC 3339 specifies
-					// the exact grammar of a valid timestamp. However,
-					// the parsing functionality in "time" is too loose and
-					// incorrectly accepts invalid timestamps as valid.
-					// Remove these manual checks when "time" checks it for us.
-					newParseError := func(layout, value, layoutElem, valueElem, message string) error {
-						return &time.ParseError{Layout: layout, Value: value, LayoutElem: layoutElem, ValueElem: valueElem, Message: message}
-					}
-					switch {
-					case val[len("2006-01-02T")+1] == ':': // hour must be two digits
-						err = newParseError(format, string(val), "15", string(val[len("2006-01-02T"):][:1]), "")
-					case val[len("2006-01-02T15:04:05")] == ',': // sub-second separator must be a period
-						err = newParseError(format, string(val), ".", ",", "")
-					case val[len(val)-1] != 'Z':
-						switch {
-						case parseDec2(val[len(val)-len("07:00"):]) >= 24: // timezone hour must be in range
-							err = newParseError(format, string(val), "Z07:00", string(val[len(val)-len("Z07:00"):]), ": timezone hour out of range")
-						case parseDec2(val[len(val)-len("00"):]) >= 60: // timezone minute must be in range
-							err = newParseError(format, string(val), "Z07:00", string(val[len(val)-len("Z07:00"):]), ": timezone minute out of range")
-						}
+				if !stringify {
+					break
+				}
+				val = jsonwire.UnquoteMayCopy(val, flags.IsVerbatim())
+				if err := u.unmarshal(val); err != nil {
+					if uo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+						return err // unlike marshal, never wrapped
 					}
+					return newUnmarshalErrorAfter(dec, t, err)
+				}
+				*tt = u.tt
+				return nil
+			case '0':
+				if stringify {
+					break
 				}
-				if err != nil {
-					return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t, Err: err}
+				if err := u.unmarshal(val); err != nil {
+					if uo.Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+						return err // unlike marshal, never wrapped
+					}
+					return newUnmarshalErrorAfter(dec, t, err)
 				}
-				*tt = tt2
+				*tt = u.tt
 				return nil
-			default:
-				return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t}
 			}
+			return newUnmarshalErrorAfter(dec, t, nil)
 		}
 	}
 	return fncs
 }
 
-func checkTimeFormat(format string) (string, bool, error) {
+type durationArshaler struct {
+	td time.Duration
+
+	// base records the representation where:
+	//   - 0 uses time.Duration.String
+	//   - 1e0, 1e3, 1e6, or 1e9 use a decimal encoding of the duration as
+	//     nanoseconds, microseconds, milliseconds, or seconds.
+	//   - 8601 uses ISO 8601
+	base uint64
+}
+
+func (a *durationArshaler) initFormat(format string) (ok bool) {
+	switch format {
+	case "units":
+		a.base = 0
+	case "sec":
+		a.base = 1e9
+	case "milli":
+		a.base = 1e6
+	case "micro":
+		a.base = 1e3
+	case "nano":
+		a.base = 1e0
+	case "iso8601":
+		a.base = 8601
+	default:
+		return false
+	}
+	return true
+}
+
+func (a *durationArshaler) isNumeric() bool {
+	return a.base != 0 && a.base != 8601
+}
+
+func (a *durationArshaler) appendMarshal(b []byte) ([]byte, error) {
+	switch a.base {
+	case 0:
+		return append(b, a.td.String()...), nil
+	case 8601:
+		return appendDurationISO8601(b, a.td), nil
+	default:
+		return appendDurationBase10(b, a.td, a.base), nil
+	}
+}
+
+func (a *durationArshaler) unmarshal(b []byte) (err error) {
+	switch a.base {
+	case 0:
+		a.td, err = time.ParseDuration(string(b))
+	case 8601:
+		a.td, err = parseDurationISO8601(b)
+	default:
+		a.td, err = parseDurationBase10(b, a.base)
+	}
+	return err
+}
+
+type timeArshaler struct {
+	tt time.Time
+
+	// base records the representation where:
+	//   - 0 uses RFC 3339 encoding of the timestamp
+	//   - 1e0, 1e3, 1e6, or 1e9 use a decimal encoding of the timestamp as
+	//     seconds, milliseconds, microseconds, or nanoseconds since Unix epoch.
+	//   - math.MaxUint uses time.Time.Format to encode the timestamp
+	base   uint64
+	format string // time format passed to time.Parse
+
+	looseRFC3339 bool
+}
+
+func (a *timeArshaler) initFormat(format string) bool {
 	// We assume that an exported constant in the time package will
 	// always start with an uppercase ASCII letter.
-	if len(format) > 0 && 'A' <= format[0] && format[0] <= 'Z' {
-		switch format {
-		case "ANSIC":
-			return time.ANSIC, false, nil
-		case "UnixDate":
-			return time.UnixDate, false, nil
-		case "RubyDate":
-			return time.RubyDate, false, nil
-		case "RFC822":
-			return time.RFC822, false, nil
-		case "RFC822Z":
-			return time.RFC822Z, false, nil
-		case "RFC850":
-			return time.RFC850, false, nil
-		case "RFC1123":
-			return time.RFC1123, false, nil
-		case "RFC1123Z":
-			return time.RFC1123Z, false, nil
-		case "RFC3339":
-			return time.RFC3339, true, nil
-		case "RFC3339Nano":
-			return time.RFC3339Nano, true, nil
-		case "Kitchen":
-			return time.Kitchen, false, nil
-		case "Stamp":
-			return time.Stamp, false, nil
-		case "StampMilli":
-			return time.StampMilli, false, nil
-		case "StampMicro":
-			return time.StampMicro, false, nil
-		case "StampNano":
-			return time.StampNano, false, nil
-		default:
-			// Reject any format that is an exported Go identifier in case
-			// new format constants are added to the time package.
-			if strings.TrimFunc(format, isLetterOrDigit) == "" {
-				return "", false, fmt.Errorf("undefined format layout: %v", format)
+	if len(format) == 0 {
+		return false
+	}
+	a.base = math.MaxUint // implies custom format
+	if c := format[0]; !('a' <= c && c <= 'z') && !('A' <= c && c <= 'Z') {
+		a.format = format
+		return true
+	}
+	switch format {
+	case "ANSIC":
+		a.format = time.ANSIC
+	case "UnixDate":
+		a.format = time.UnixDate
+	case "RubyDate":
+		a.format = time.RubyDate
+	case "RFC822":
+		a.format = time.RFC822
+	case "RFC822Z":
+		a.format = time.RFC822Z
+	case "RFC850":
+		a.format = time.RFC850
+	case "RFC1123":
+		a.format = time.RFC1123
+	case "RFC1123Z":
+		a.format = time.RFC1123Z
+	case "RFC3339":
+		a.base = 0
+		a.format = time.RFC3339
+	case "RFC3339Nano":
+		a.base = 0
+		a.format = time.RFC3339Nano
+	case "Kitchen":
+		a.format = time.Kitchen
+	case "Stamp":
+		a.format = time.Stamp
+	case "StampMilli":
+		a.format = time.StampMilli
+	case "StampMicro":
+		a.format = time.StampMicro
+	case "StampNano":
+		a.format = time.StampNano
+	case "DateTime":
+		a.format = time.DateTime
+	case "DateOnly":
+		a.format = time.DateOnly
+	case "TimeOnly":
+		a.format = time.TimeOnly
+	case "unix":
+		a.base = 1e0
+	case "unixmilli":
+		a.base = 1e3
+	case "unixmicro":
+		a.base = 1e6
+	case "unixnano":
+		a.base = 1e9
+	default:
+		// Reject any Go identifier in case new constants are supported.
+		if strings.TrimFunc(format, isLetterOrDigit) == "" {
+			return false
+		}
+		a.format = format
+	}
+	return true
+}
+
+func (a *timeArshaler) isNumeric() bool {
+	return int(a.base) > 0
+}
+
+func (a *timeArshaler) hasCustomFormat() bool {
+	return a.base == math.MaxUint
+}
+
+func (a *timeArshaler) appendMarshal(b []byte) ([]byte, error) {
+	switch a.base {
+	case 0:
+		format := cmp.Or(a.format, time.RFC3339Nano)
+		n0 := len(b)
+		b = a.tt.AppendFormat(b, format)
+		// Not all Go timestamps can be represented as valid RFC 3339.
+		// Explicitly check for these edge cases.
+		// See https://go.dev/issue/4556 and https://go.dev/issue/54580.
+		switch b := b[n0:]; {
+		case b[len("9999")] != '-': // year must be exactly 4 digits wide
+			return b, errors.New("year outside of range [0,9999]")
+		case b[len(b)-1] != 'Z':
+			c := b[len(b)-len("Z07:00")]
+			if ('0' <= c && c <= '9') || parseDec2(b[len(b)-len("07:00"):]) >= 24 {
+				return b, errors.New("timezone hour outside of range [0,23]")
 			}
 		}
+		return b, nil
+	case math.MaxUint:
+		return a.tt.AppendFormat(b, a.format), nil
+	default:
+		return appendTimeUnix(b, a.tt, a.base), nil
 	}
-	return format, false, nil
+}
+
+func (a *timeArshaler) unmarshal(b []byte) (err error) {
+	switch a.base {
+	case 0:
+		// Use time.Time.UnmarshalText to avoid possible string allocation.
+		if err := a.tt.UnmarshalText(b); err != nil {
+			return err
+		}
+		// TODO(https://go.dev/issue/57912):
+		// RFC 3339 specifies the grammar for a valid timestamp.
+		// However, the parsing functionality in "time" is too loose and
+		// incorrectly accepts invalid timestamps as valid.
+		// Remove these manual checks when "time" checks it for us.
+		newParseError := func(layout, value, layoutElem, valueElem, message string) error {
+			return &time.ParseError{Layout: layout, Value: value, LayoutElem: layoutElem, ValueElem: valueElem, Message: message}
+		}
+		switch {
+		case a.looseRFC3339:
+			return nil
+		case b[len("2006-01-02T")+1] == ':': // hour must be two digits
+			return newParseError(time.RFC3339, string(b), "15", string(b[len("2006-01-02T"):][:1]), "")
+		case b[len("2006-01-02T15:04:05")] == ',': // sub-second separator must be a period
+			return newParseError(time.RFC3339, string(b), ".", ",", "")
+		case b[len(b)-1] != 'Z':
+			switch {
+			case parseDec2(b[len(b)-len("07:00"):]) >= 24: // timezone hour must be in range
+				return newParseError(time.RFC3339, string(b), "Z07:00", string(b[len(b)-len("Z07:00"):]), ": timezone hour out of range")
+			case parseDec2(b[len(b)-len("00"):]) >= 60: // timezone minute must be in range
+				return newParseError(time.RFC3339, string(b), "Z07:00", string(b[len(b)-len("Z07:00"):]), ": timezone minute out of range")
+			}
+		}
+		return nil
+	case math.MaxUint:
+		a.tt, err = time.Parse(a.format, string(b))
+		return err
+	default:
+		a.tt, err = parseTimeUnix(b, a.base)
+		return err
+	}
+}
+
+// appendDurationBase10 appends d formatted as a decimal fractional number,
+// where pow10 is a power-of-10 used to scale down the number.
+func appendDurationBase10(b []byte, d time.Duration, pow10 uint64) []byte {
+	b, n := mayAppendDurationSign(b, d)            // append sign
+	whole, frac := bits.Div64(0, n, uint64(pow10)) // compute whole and frac fields
+	b = strconv.AppendUint(b, whole, 10)           // append whole field
+	return appendFracBase10(b, frac, pow10)        // append frac field
+}
+
+// parseDurationBase10 parses d from a decimal fractional number,
+// where pow10 is a power-of-10 used to scale up the number.
+func parseDurationBase10(b []byte, pow10 uint64) (time.Duration, error) {
+	suffix, neg := consumeSign(b, false)                     // consume sign
+	wholeBytes, fracBytes := bytesCutByte(suffix, '.', true) // consume whole and frac fields
+	whole, okWhole := jsonwire.ParseUint(wholeBytes)         // parse whole field; may overflow
+	frac, okFrac := parseFracBase10(fracBytes, pow10)        // parse frac field
+	hi, lo := bits.Mul64(whole, uint64(pow10))               // overflow if hi > 0
+	sum, co := bits.Add64(lo, uint64(frac), 0)               // overflow if co > 0
+	switch d := mayApplyDurationSign(sum, neg); {            // overflow if neg != (d < 0)
+	case (!okWhole && whole != math.MaxUint64) || !okFrac:
+		return 0, fmt.Errorf("invalid duration %q: %w", b, strconv.ErrSyntax)
+	case !okWhole || hi > 0 || co > 0 || neg != (d < 0):
+		return 0, fmt.Errorf("invalid duration %q: %w", b, strconv.ErrRange)
+	default:
+		return d, nil
+	}
+}
+
+// appendDurationISO8601 appends an ISO 8601 duration with a restricted grammar,
+// where leading and trailing zeroes and zero-value designators are omitted.
+// It only uses hour, minute, and second designators since ISO 8601 defines
+// those as being "accurate", while year, month, week, and day are "nominal".
+func appendDurationISO8601(b []byte, d time.Duration) []byte {
+	if d == 0 {
+		return append(b, "PT0S"...)
+	}
+	b, n := mayAppendDurationSign(b, d)
+	b = append(b, "PT"...)
+	n, nsec := bits.Div64(0, n, 1e9)  // compute nsec field
+	n, sec := bits.Div64(0, n, 60)    // compute sec field
+	hour, min := bits.Div64(0, n, 60) // compute hour and min fields
+	if hour > 0 {
+		b = append(strconv.AppendUint(b, hour, 10), 'H')
+	}
+	if min > 0 {
+		b = append(strconv.AppendUint(b, min, 10), 'M')
+	}
+	if sec > 0 || nsec > 0 {
+		b = append(appendFracBase10(strconv.AppendUint(b, sec, 10), nsec, 1e9), 'S')
+	}
+	return b
+}
+
+// daysPerYear is the exact average number of days in a year according to
+// the Gregorian calender, which has an extra day each year that is
+// a multiple of 4, unless it is evenly divisible by 100 but not by 400.
+// This does not take into account leap seconds, which are not deterministic.
+const daysPerYear = 365.2425
+
+var errInaccurateDateUnits = errors.New("inaccurate year, month, week, or day units")
+
+// parseDurationISO8601 parses a duration according to ISO 8601-1:2019,
+// section 5.5.2.2 and 5.5.2.3 with the following restrictions or extensions:
+//
+//   - A leading minus sign is permitted for negative duration according
+//     to ISO 8601-2:2019, section 4.4.1.9. We do not permit negative values
+//     for each "time scale component", which is permitted by section 4.4.1.1,
+//     but rarely supported by parsers.
+//
+//   - A leading plus sign is permitted (and ignored).
+//     This is not required by ISO 8601, but not forbidden either.
+//     There is some precedent for this as it is supported by the principle of
+//     duration arithmetic as specified in ISO 8601-2-2019, section 14.1.
+//     Of note, the JavaScript grammar for ISO 8601 permits a leading plus sign.
+//
+//   - A fractional value is only permitted for accurate units
+//     (i.e., hour, minute, and seconds) in the last time component,
+//     which is permissible by ISO 8601-1:2019, section 5.5.2.3.
+//
+//   - Both periods ('.') and commas (',') are supported as the separator
+//     between the integer part and fraction part of a number,
+//     as specified in ISO 8601-1:2019, section 3.2.6.
+//     While ISO 8601 recommends comma as the default separator,
+//     most formatters uses a period.
+//
+//   - Leading zeros are ignored. This is not required by ISO 8601,
+//     but also not forbidden by the standard. Many parsers support this.
+//
+//   - Lowercase designators are supported. This is not required by ISO 8601,
+//     but also not forbidden by the standard. Many parsers support this.
+//
+// If the nominal units of year, month, week, or day are present,
+// this produces a best-effort value and also reports [errInaccurateDateUnits].
+//
+// The accepted grammar is identical to JavaScript's Duration:
+//
+//	https://tc39.es/proposal-temporal/#prod-Duration
+//
+// We follow JavaScript's grammar as JSON itself is derived from JavaScript.
+// The Temporal.Duration.toJSON method is guaranteed to produce an output
+// that can be parsed by this function so long as arithmetic in JavaScript
+// do not use a largestUnit value higher than "hours" (which is the default).
+// Even if it does, this will do a best-effort parsing with inaccurate units,
+// but report [errInaccurateDateUnits].
+func parseDurationISO8601(b []byte) (time.Duration, error) {
+	var invalid, overflow, inaccurate, sawFrac bool
+	var sumNanos, n, co uint64
+
+	// cutBytes is like [bytes.Cut], but uses either c0 or c1 as the separator.
+	cutBytes := func(b []byte, c0, c1 byte) (prefix, suffix []byte, ok bool) {
+		for i, c := range b {
+			if c == c0 || c == c1 {
+				return b[:i], b[i+1:], true
+			}
+		}
+		return b, nil, false
+	}
+
+	// mayParseUnit attempts to parse another date or time number
+	// identified by the desHi and desLo unit characters.
+	// If the part is absent for current unit, it returns b as is.
+	mayParseUnit := func(b []byte, desHi, desLo byte, unit time.Duration) []byte {
+		number, suffix, ok := cutBytes(b, desHi, desLo)
+		if !ok || sawFrac {
+			return b // designator is not present or already saw fraction, which can only be in the last component
+		}
+
+		// Parse the number.
+		// A fraction allowed for the accurate units in the last part.
+		whole, frac, ok := cutBytes(number, '.', ',')
+		if ok {
+			sawFrac = true
+			invalid = invalid || len(frac) == len("") || unit > time.Hour
+			if unit == time.Second {
+				n, ok = parsePaddedBase10(frac, uint64(time.Second))
+				invalid = invalid || !ok
+			} else {
+				f, err := strconv.ParseFloat("0."+string(frac), 64)
+				invalid = invalid || err != nil || len(bytes.Trim(frac[len("."):], "0123456789")) > 0
+				n = uint64(math.Round(f * float64(unit))) // never overflows since f is within [0..1]
+			}
+			sumNanos, co = bits.Add64(sumNanos, n, 0) // overflow if co > 0
+			overflow = overflow || co > 0
+		}
+		for len(whole) > 1 && whole[0] == '0' {
+			whole = whole[len("0"):] // trim leading zeros
+		}
+		n, ok := jsonwire.ParseUint(whole)         // overflow if !ok && MaxUint64
+		hi, lo := bits.Mul64(n, uint64(unit))      // overflow if hi > 0
+		sumNanos, co = bits.Add64(sumNanos, lo, 0) // overflow if co > 0
+		invalid = invalid || (!ok && n != math.MaxUint64)
+		overflow = overflow || (!ok && n == math.MaxUint64) || hi > 0 || co > 0
+		inaccurate = inaccurate || unit > time.Hour
+		return suffix
+	}
+
+	suffix, neg := consumeSign(b, true)
+	prefix, suffix, okP := cutBytes(suffix, 'P', 'p')
+	durDate, durTime, okT := cutBytes(suffix, 'T', 't')
+	invalid = invalid || len(prefix) > 0 || !okP || (okT && len(durTime) == 0) || len(durDate)+len(durTime) == 0
+	if len(durDate) > 0 { // nominal portion of the duration
+		durDate = mayParseUnit(durDate, 'Y', 'y', time.Duration(daysPerYear*24*60*60*1e9))
+		durDate = mayParseUnit(durDate, 'M', 'm', time.Duration(daysPerYear/12*24*60*60*1e9))
+		durDate = mayParseUnit(durDate, 'W', 'w', time.Duration(7*24*60*60*1e9))
+		durDate = mayParseUnit(durDate, 'D', 'd', time.Duration(24*60*60*1e9))
+		invalid = invalid || len(durDate) > 0 // unknown elements
+	}
+	if len(durTime) > 0 { // accurate portion of the duration
+		durTime = mayParseUnit(durTime, 'H', 'h', time.Duration(60*60*1e9))
+		durTime = mayParseUnit(durTime, 'M', 'm', time.Duration(60*1e9))
+		durTime = mayParseUnit(durTime, 'S', 's', time.Duration(1e9))
+		invalid = invalid || len(durTime) > 0 // unknown elements
+	}
+	d := mayApplyDurationSign(sumNanos, neg)
+	overflow = overflow || (neg != (d < 0) && d != 0) // overflows signed duration
+
+	switch {
+	case invalid:
+		return 0, fmt.Errorf("invalid ISO 8601 duration %q: %w", b, strconv.ErrSyntax)
+	case overflow:
+		return 0, fmt.Errorf("invalid ISO 8601 duration %q: %w", b, strconv.ErrRange)
+	case inaccurate:
+		return d, fmt.Errorf("invalid ISO 8601 duration %q: %w", b, errInaccurateDateUnits)
+	default:
+		return d, nil
+	}
+}
+
+// mayAppendDurationSign appends a negative sign if n is negative.
+func mayAppendDurationSign(b []byte, d time.Duration) ([]byte, uint64) {
+	if d < 0 {
+		b = append(b, '-')
+		d *= -1
+	}
+	return b, uint64(d)
+}
+
+// mayApplyDurationSign inverts n if neg is specified.
+func mayApplyDurationSign(n uint64, neg bool) time.Duration {
+	if neg {
+		return -1 * time.Duration(n)
+	} else {
+		return +1 * time.Duration(n)
+	}
+}
+
+// appendTimeUnix appends t formatted as a decimal fractional number,
+// where pow10 is a power-of-10 used to scale up the number.
+func appendTimeUnix(b []byte, t time.Time, pow10 uint64) []byte {
+	sec, nsec := t.Unix(), int64(t.Nanosecond())
+	if sec < 0 {
+		b = append(b, '-')
+		sec, nsec = negateSecNano(sec, nsec)
+	}
+	switch {
+	case pow10 == 1e0: // fast case where units is in seconds
+		b = strconv.AppendUint(b, uint64(sec), 10)
+		return appendFracBase10(b, uint64(nsec), 1e9)
+	case uint64(sec) < 1e9: // intermediate case where units is not seconds, but no overflow
+		b = strconv.AppendUint(b, uint64(sec)*uint64(pow10)+uint64(uint64(nsec)/(1e9/pow10)), 10)
+		return appendFracBase10(b, (uint64(nsec)*pow10)%1e9, 1e9)
+	default: // slow case where units is not seconds and overflow would occur
+		b = strconv.AppendUint(b, uint64(sec), 10)
+		b = appendPaddedBase10(b, uint64(nsec)/(1e9/pow10), pow10)
+		return appendFracBase10(b, (uint64(nsec)*pow10)%1e9, 1e9)
+	}
+}
+
+// parseTimeUnix parses t formatted as a decimal fractional number,
+// where pow10 is a power-of-10 used to scale down the number.
+func parseTimeUnix(b []byte, pow10 uint64) (time.Time, error) {
+	suffix, neg := consumeSign(b, false)                     // consume sign
+	wholeBytes, fracBytes := bytesCutByte(suffix, '.', true) // consume whole and frac fields
+	whole, okWhole := jsonwire.ParseUint(wholeBytes)         // parse whole field; may overflow
+	frac, okFrac := parseFracBase10(fracBytes, 1e9/pow10)    // parse frac field
+	var sec, nsec int64
+	switch {
+	case pow10 == 1e0: // fast case where units is in seconds
+		sec = int64(whole) // check overflow later after negation
+		nsec = int64(frac) // cannot overflow
+	case okWhole: // intermediate case where units is not seconds, but no overflow
+		sec = int64(whole / pow10)                     // check overflow later after negation
+		nsec = int64((whole%pow10)*(1e9/pow10) + frac) // cannot overflow
+	case !okWhole && whole == math.MaxUint64: // slow case where units is not seconds and overflow occurred
+		width := int(math.Log10(float64(pow10)))                                // compute len(strconv.Itoa(pow10-1))
+		whole, okWhole = jsonwire.ParseUint(wholeBytes[:len(wholeBytes)-width]) // parse the upper whole field
+		mid, _ := parsePaddedBase10(wholeBytes[len(wholeBytes)-width:], pow10)  // parse the lower whole field
+		sec = int64(whole)                                                      // check overflow later after negation
+		nsec = int64(mid*(1e9/pow10) + frac)                                    // cannot overflow
+	}
+	if neg {
+		sec, nsec = negateSecNano(sec, nsec)
+	}
+	switch t := time.Unix(sec, nsec).UTC(); {
+	case (!okWhole && whole != math.MaxUint64) || !okFrac:
+		return time.Time{}, fmt.Errorf("invalid time %q: %w", b, strconv.ErrSyntax)
+	case !okWhole || neg != (t.Unix() < 0):
+		return time.Time{}, fmt.Errorf("invalid time %q: %w", b, strconv.ErrRange)
+	default:
+		return t, nil
+	}
+}
+
+// negateSecNano negates a Unix timestamp, where nsec must be within [0, 1e9).
+func negateSecNano(sec, nsec int64) (int64, int64) {
+	sec = ^sec               // twos-complement negation (i.e., -1*sec + 1)
+	nsec = -nsec + 1e9       // negate nsec and add 1e9 (which is the extra +1 from sec negation)
+	sec += int64(nsec / 1e9) // handle possible overflow of nsec if it started as zero
+	nsec %= 1e9              // ensure nsec stays within [0, 1e9)
+	return sec, nsec
+}
+
+// appendFracBase10 appends the fraction of n/max10,
+// where max10 is a power-of-10 that is larger than n.
+func appendFracBase10(b []byte, n, max10 uint64) []byte {
+	if n == 0 {
+		return b
+	}
+	return bytes.TrimRight(appendPaddedBase10(append(b, '.'), n, max10), "0")
+}
+
+// parseFracBase10 parses the fraction of n/max10,
+// where max10 is a power-of-10 that is larger than n.
+func parseFracBase10(b []byte, max10 uint64) (n uint64, ok bool) {
+	switch {
+	case len(b) == 0:
+		return 0, true
+	case len(b) < len(".0") || b[0] != '.':
+		return 0, false
+	}
+	return parsePaddedBase10(b[len("."):], max10)
+}
+
+// appendPaddedBase10 appends a zero-padded encoding of n,
+// where max10 is a power-of-10 that is larger than n.
+func appendPaddedBase10(b []byte, n, max10 uint64) []byte {
+	if n < max10/10 {
+		// Formatting of n is shorter than log10(max10),
+		// so add max10/10 to ensure the length is equal to log10(max10).
+		i := len(b)
+		b = strconv.AppendUint(b, n+max10/10, 10)
+		b[i]-- // subtract the addition of max10/10
+		return b
+	}
+	return strconv.AppendUint(b, n, 10)
+}
+
+// parsePaddedBase10 parses b as the zero-padded encoding of n,
+// where max10 is a power-of-10 that is larger than n.
+// Truncated suffix is treated as implicit zeros.
+// Extended suffix is ignored, but verified to contain only digits.
+func parsePaddedBase10(b []byte, max10 uint64) (n uint64, ok bool) {
+	pow10 := uint64(1)
+	for pow10 < max10 {
+		n *= 10
+		if len(b) > 0 {
+			if b[0] < '0' || '9' < b[0] {
+				return n, false
+			}
+			n += uint64(b[0] - '0')
+			b = b[1:]
+		}
+		pow10 *= 10
+	}
+	if len(b) > 0 && len(bytes.TrimRight(b, "0123456789")) > 0 {
+		return n, false // trailing characters are not digits
+	}
+	return n, true
+}
+
+// consumeSign consumes an optional leading negative or positive sign.
+func consumeSign(b []byte, allowPlus bool) ([]byte, bool) {
+	if len(b) > 0 {
+		if b[0] == '-' {
+			return b[len("-"):], true
+		} else if b[0] == '+' && allowPlus {
+			return b[len("+"):], false
+		}
+	}
+	return b, false
+}
+
+// bytesCutByte is similar to bytes.Cut(b, []byte{c}),
+// except c may optionally be included as part of the suffix.
+func bytesCutByte(b []byte, c byte, include bool) ([]byte, []byte) {
+	if i := bytes.IndexByte(b, c); i >= 0 {
+		if include {
+			return b[:i], b[i:]
+		}
+		return b[:i], b[i+1:]
+	}
+	return b, nil
 }
 
 // parseDec2 parses b as an unsigned, base-10, 2-digit number.
-// It panics if len(b) < 2. The result is undefined if digits are not base-10.
+// The result is undefined if digits are not base-10.
 func parseDec2(b []byte) byte {
+	if len(b) < 2 {
+		return 0
+	}
 	return 10*(b[0]-'0') + (b[1] - '0')
 }
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/decode.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/decode.go
deleted file mode 100644
index 0d68b32338..0000000000
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/decode.go
+++ /dev/null
@@ -1,1655 +0,0 @@
-// Copyright 2020 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package json
-
-import (
-	"bytes"
-	"errors"
-	"io"
-	"math"
-	"strconv"
-	"unicode/utf16"
-	"unicode/utf8"
-)
-
-// NOTE: The logic for decoding is complicated by the fact that reading from
-// an io.Reader into a temporary buffer means that the buffer may contain a
-// truncated portion of some valid input, requiring the need to fetch more data.
-//
-// This file is structured in the following way:
-//
-//   - consumeXXX functions parse an exact JSON token from a []byte.
-//     If the buffer appears truncated, then it returns io.ErrUnexpectedEOF.
-//     The consumeSimpleXXX functions are so named because they only handle
-//     a subset of the grammar for the JSON token being parsed.
-//     They do not handle the full grammar to keep these functions inlineable.
-//
-//   - Decoder.consumeXXX methods parse the next JSON token from Decoder.buf,
-//     automatically fetching more input if necessary. These methods take
-//     a position relative to the start of Decoder.buf as an argument and
-//     return the end of the consumed JSON token as a position,
-//     also relative to the start of Decoder.buf.
-//
-//   - In the event of an I/O errors or state machine violations,
-//     the implementation avoids mutating the state of Decoder
-//     (aside from the book-keeping needed to implement Decoder.fetch).
-//     For this reason, only Decoder.ReadToken and Decoder.ReadValue are
-//     responsible for updated Decoder.prevStart and Decoder.prevEnd.
-//
-//   - For performance, much of the implementation uses the pattern of calling
-//     the inlineable consumeXXX functions first, and if more work is necessary,
-//     then it calls the slower Decoder.consumeXXX methods.
-//     TODO: Revisit this pattern if the Go compiler provides finer control
-//     over exactly which calls are inlined or not.
-
-// DecodeOptions configures how JSON decoding operates.
-// The zero value is equivalent to the default settings,
-// which is compliant with both RFC 7493 and RFC 8259.
-type DecodeOptions struct {
-	requireKeyedLiterals
-	nonComparable
-
-	// AllowDuplicateNames specifies that JSON objects may contain
-	// duplicate member names. Disabling the duplicate name check may provide
-	// computational and performance benefits, but breaks compliance with
-	// RFC 7493, section 2.3. The input will still be compliant with RFC 8259,
-	// which leaves the handling of duplicate names as unspecified behavior.
-	AllowDuplicateNames bool
-
-	// AllowInvalidUTF8 specifies that JSON strings may contain invalid UTF-8,
-	// which will be mangled as the Unicode replacement character, U+FFFD.
-	// This causes the decoder to break compliance with
-	// RFC 7493, section 2.1, and RFC 8259, section 8.1.
-	AllowInvalidUTF8 bool
-}
-
-// Decoder is a streaming decoder for raw JSON tokens and values.
-// It is used to read a stream of top-level JSON values,
-// each separated by optional whitespace characters.
-//
-// ReadToken and ReadValue calls may be interleaved.
-// For example, the following JSON value:
-//
-//	{"name":"value","array":[null,false,true,3.14159],"object":{"k":"v"}}
-//
-// can be parsed with the following calls (ignoring errors for brevity):
-//
-//	d.ReadToken() // {
-//	d.ReadToken() // "name"
-//	d.ReadToken() // "value"
-//	d.ReadValue() // "array"
-//	d.ReadToken() // [
-//	d.ReadToken() // null
-//	d.ReadToken() // false
-//	d.ReadValue() // true
-//	d.ReadToken() // 3.14159
-//	d.ReadToken() // ]
-//	d.ReadValue() // "object"
-//	d.ReadValue() // {"k":"v"}
-//	d.ReadToken() // }
-//
-// The above is one of many possible sequence of calls and
-// may not represent the most sensible method to call for any given token/value.
-// For example, it is probably more common to call ReadToken to obtain a
-// string token for object names.
-type Decoder struct {
-	state
-	decodeBuffer
-	options DecodeOptions
-
-	stringCache *stringCache // only used when unmarshaling
-}
-
-// decodeBuffer is a buffer split into 4 segments:
-//
-//   - buf[0:prevEnd]         // already read portion of the buffer
-//   - buf[prevStart:prevEnd] // previously read value
-//   - buf[prevEnd:len(buf)]  // unread portion of the buffer
-//   - buf[len(buf):cap(buf)] // unused portion of the buffer
-//
-// Invariants:
-//
-//	0 ≤ prevStart ≤ prevEnd ≤ len(buf) ≤ cap(buf)
-type decodeBuffer struct {
-	peekPos int   // non-zero if valid offset into buf for start of next token
-	peekErr error // implies peekPos is -1
-
-	buf       []byte // may alias rd if it is a bytes.Buffer
-	prevStart int
-	prevEnd   int
-
-	// baseOffset is added to prevStart and prevEnd to obtain
-	// the absolute offset relative to the start of io.Reader stream.
-	baseOffset int64
-
-	rd io.Reader
-}
-
-// NewDecoder constructs a new streaming decoder reading from r.
-//
-// If r is a bytes.Buffer, then the decoder parses directly from the buffer
-// without first copying the contents to an intermediate buffer.
-// Additional writes to the buffer must not occur while the decoder is in use.
-func NewDecoder(r io.Reader) *Decoder {
-	return DecodeOptions{}.NewDecoder(r)
-}
-
-// NewDecoder constructs a new streaming decoder reading from r
-// configured with the provided options.
-func (o DecodeOptions) NewDecoder(r io.Reader) *Decoder {
-	d := new(Decoder)
-	o.ResetDecoder(d, r)
-	return d
-}
-
-// ResetDecoder resets a decoder such that it is reading afresh from r and
-// configured with the provided options.
-func (o DecodeOptions) ResetDecoder(d *Decoder, r io.Reader) {
-	if d == nil {
-		panic("json: invalid nil Decoder")
-	}
-	if r == nil {
-		panic("json: invalid nil io.Reader")
-	}
-	d.reset(nil, r, o)
-}
-
-func (d *Decoder) reset(b []byte, r io.Reader, o DecodeOptions) {
-	d.state.reset()
-	d.decodeBuffer = decodeBuffer{buf: b, rd: r}
-	d.options = o
-}
-
-// Reset resets a decoder such that it is reading afresh from r but
-// keep any pre-existing decoder options.
-func (d *Decoder) Reset(r io.Reader) {
-	d.options.ResetDecoder(d, r)
-}
-
-var errBufferWriteAfterNext = errors.New("invalid bytes.Buffer.Write call after calling bytes.Buffer.Next")
-
-// fetch reads at least 1 byte from the underlying io.Reader.
-// It returns io.ErrUnexpectedEOF if zero bytes were read and io.EOF was seen.
-func (d *Decoder) fetch() error {
-	if d.rd == nil {
-		return io.ErrUnexpectedEOF
-	}
-
-	// Inform objectNameStack that we are about to fetch new buffer content.
-	d.names.copyQuotedBuffer(d.buf)
-
-	// Specialize bytes.Buffer for better performance.
-	if bb, ok := d.rd.(*bytes.Buffer); ok {
-		switch {
-		case bb.Len() == 0:
-			return io.ErrUnexpectedEOF
-		case len(d.buf) == 0:
-			d.buf = bb.Next(bb.Len()) // "read" all data in the buffer
-			return nil
-		default:
-			// This only occurs if a partially filled bytes.Buffer was provided
-			// and more data is written to it while Decoder is reading from it.
-			// This practice will lead to data corruption since future writes
-			// may overwrite the contents of the current buffer.
-			//
-			// The user is trying to use a bytes.Buffer as a pipe,
-			// but a bytes.Buffer is poor implementation of a pipe,
-			// the purpose-built io.Pipe should be used instead.
-			return &ioError{action: "read", err: errBufferWriteAfterNext}
-		}
-	}
-
-	// Allocate initial buffer if empty.
-	if cap(d.buf) == 0 {
-		d.buf = make([]byte, 0, 64)
-	}
-
-	// Check whether to grow the buffer.
-	const maxBufferSize = 4 << 10
-	const growthSizeFactor = 2 // higher value is faster
-	const growthRateFactor = 2 // higher value is slower
-	// By default, grow if below the maximum buffer size.
-	grow := cap(d.buf) <= maxBufferSize/growthSizeFactor
-	// Growing can be expensive, so only grow
-	// if a sufficient number of bytes have been processed.
-	grow = grow && int64(cap(d.buf)) < d.previousOffsetEnd()/growthRateFactor
-	// If prevStart==0, then fetch was called in order to fetch more data
-	// to finish consuming a large JSON value contiguously.
-	// Grow if less than 25% of the remaining capacity is available.
-	// Note that this may cause the input buffer to exceed maxBufferSize.
-	grow = grow || (d.prevStart == 0 && len(d.buf) >= 3*cap(d.buf)/4)
-
-	if grow {
-		// Allocate a new buffer and copy the contents of the old buffer over.
-		// TODO: Provide a hard limit on the maximum internal buffer size?
-		buf := make([]byte, 0, cap(d.buf)*growthSizeFactor)
-		d.buf = append(buf, d.buf[d.prevStart:]...)
-	} else {
-		// Move unread portion of the data to the front.
-		n := copy(d.buf[:cap(d.buf)], d.buf[d.prevStart:])
-		d.buf = d.buf[:n]
-	}
-	d.baseOffset += int64(d.prevStart)
-	d.prevEnd -= d.prevStart
-	d.prevStart = 0
-
-	// Read more data into the internal buffer.
-	for {
-		n, err := d.rd.Read(d.buf[len(d.buf):cap(d.buf)])
-		switch {
-		case n > 0:
-			d.buf = d.buf[:len(d.buf)+n]
-			return nil // ignore errors if any bytes are read
-		case err == io.EOF:
-			return io.ErrUnexpectedEOF
-		case err != nil:
-			return &ioError{action: "read", err: err}
-		default:
-			continue // Read returned (0, nil)
-		}
-	}
-}
-
-const invalidateBufferByte = '#' // invalid starting character for JSON grammar
-
-// invalidatePreviousRead invalidates buffers returned by Peek and Read calls
-// so that the first byte is an invalid character.
-// This Hyrum-proofs the API against faulty application code that assumes
-// values returned by ReadValue remain valid past subsequent Read calls.
-func (d *decodeBuffer) invalidatePreviousRead() {
-	// Avoid mutating the buffer if d.rd is nil which implies that d.buf
-	// is provided by the user code and may not expect mutations.
-	isBytesBuffer := func(r io.Reader) bool {
-		_, ok := r.(*bytes.Buffer)
-		return ok
-	}
-	if d.rd != nil && !isBytesBuffer(d.rd) && d.prevStart < d.prevEnd && uint(d.prevStart) < uint(len(d.buf)) {
-		d.buf[d.prevStart] = invalidateBufferByte
-		d.prevStart = d.prevEnd
-	}
-}
-
-// needMore reports whether there are no more unread bytes.
-func (d *decodeBuffer) needMore(pos int) bool {
-	// NOTE: The arguments and logic are kept simple to keep this inlineable.
-	return pos == len(d.buf)
-}
-
-// injectSyntacticErrorWithPosition wraps a SyntacticError with the position,
-// otherwise it returns the error as is.
-// It takes a position relative to the start of the start of d.buf.
-func (d *decodeBuffer) injectSyntacticErrorWithPosition(err error, pos int) error {
-	if serr, ok := err.(*SyntacticError); ok {
-		return serr.withOffset(d.baseOffset + int64(pos))
-	}
-	return err
-}
-
-func (d *decodeBuffer) previousOffsetStart() int64 { return d.baseOffset + int64(d.prevStart) }
-func (d *decodeBuffer) previousOffsetEnd() int64   { return d.baseOffset + int64(d.prevEnd) }
-func (d *decodeBuffer) previousBuffer() []byte     { return d.buf[d.prevStart:d.prevEnd] }
-func (d *decodeBuffer) unreadBuffer() []byte       { return d.buf[d.prevEnd:len(d.buf)] }
-
-// PeekKind retrieves the next token kind, but does not advance the read offset.
-// It returns 0 if there are no more tokens.
-func (d *Decoder) PeekKind() Kind {
-	// Check whether we have a cached peek result.
-	if d.peekPos > 0 {
-		return Kind(d.buf[d.peekPos]).normalize()
-	}
-
-	var err error
-	d.invalidatePreviousRead()
-	pos := d.prevEnd
-
-	// Consume leading whitespace.
-	pos += consumeWhitespace(d.buf[pos:])
-	if d.needMore(pos) {
-		if pos, err = d.consumeWhitespace(pos); err != nil {
-			if err == io.ErrUnexpectedEOF && d.tokens.depth() == 1 {
-				err = io.EOF // EOF possibly if no Tokens present after top-level value
-			}
-			d.peekPos, d.peekErr = -1, err
-			return invalidKind
-		}
-	}
-
-	// Consume colon or comma.
-	var delim byte
-	if c := d.buf[pos]; c == ':' || c == ',' {
-		delim = c
-		pos += 1
-		pos += consumeWhitespace(d.buf[pos:])
-		if d.needMore(pos) {
-			if pos, err = d.consumeWhitespace(pos); err != nil {
-				d.peekPos, d.peekErr = -1, err
-				return invalidKind
-			}
-		}
-	}
-	next := Kind(d.buf[pos]).normalize()
-	if d.tokens.needDelim(next) != delim {
-		pos = d.prevEnd // restore position to right after leading whitespace
-		pos += consumeWhitespace(d.buf[pos:])
-		err = d.tokens.checkDelim(delim, next)
-		err = d.injectSyntacticErrorWithPosition(err, pos)
-		d.peekPos, d.peekErr = -1, err
-		return invalidKind
-	}
-
-	// This may set peekPos to zero, which is indistinguishable from
-	// the uninitialized state. While a small hit to performance, it is correct
-	// since ReadValue and ReadToken will disregard the cached result and
-	// recompute the next kind.
-	d.peekPos, d.peekErr = pos, nil
-	return next
-}
-
-// SkipValue is semantically equivalent to calling ReadValue and discarding
-// the result except that memory is not wasted trying to hold the entire result.
-func (d *Decoder) SkipValue() error {
-	switch d.PeekKind() {
-	case '{', '[':
-		// For JSON objects and arrays, keep skipping all tokens
-		// until the depth matches the starting depth.
-		depth := d.tokens.depth()
-		for {
-			if _, err := d.ReadToken(); err != nil {
-				return err
-			}
-			if depth >= d.tokens.depth() {
-				return nil
-			}
-		}
-	default:
-		// Trying to skip a value when the next token is a '}' or ']'
-		// will result in an error being returned here.
-		if _, err := d.ReadValue(); err != nil {
-			return err
-		}
-		return nil
-	}
-}
-
-// ReadToken reads the next Token, advancing the read offset.
-// The returned token is only valid until the next Peek, Read, or Skip call.
-// It returns io.EOF if there are no more tokens.
-func (d *Decoder) ReadToken() (Token, error) {
-	// Determine the next kind.
-	var err error
-	var next Kind
-	pos := d.peekPos
-	if pos != 0 {
-		// Use cached peek result.
-		if d.peekErr != nil {
-			err := d.peekErr
-			d.peekPos, d.peekErr = 0, nil // possibly a transient I/O error
-			return Token{}, err
-		}
-		next = Kind(d.buf[pos]).normalize()
-		d.peekPos = 0 // reset cache
-	} else {
-		d.invalidatePreviousRead()
-		pos = d.prevEnd
-
-		// Consume leading whitespace.
-		pos += consumeWhitespace(d.buf[pos:])
-		if d.needMore(pos) {
-			if pos, err = d.consumeWhitespace(pos); err != nil {
-				if err == io.ErrUnexpectedEOF && d.tokens.depth() == 1 {
-					err = io.EOF // EOF possibly if no Tokens present after top-level value
-				}
-				return Token{}, err
-			}
-		}
-
-		// Consume colon or comma.
-		var delim byte
-		if c := d.buf[pos]; c == ':' || c == ',' {
-			delim = c
-			pos += 1
-			pos += consumeWhitespace(d.buf[pos:])
-			if d.needMore(pos) {
-				if pos, err = d.consumeWhitespace(pos); err != nil {
-					return Token{}, err
-				}
-			}
-		}
-		next = Kind(d.buf[pos]).normalize()
-		if d.tokens.needDelim(next) != delim {
-			pos = d.prevEnd // restore position to right after leading whitespace
-			pos += consumeWhitespace(d.buf[pos:])
-			err = d.tokens.checkDelim(delim, next)
-			return Token{}, d.injectSyntacticErrorWithPosition(err, pos)
-		}
-	}
-
-	// Handle the next token.
-	var n int
-	switch next {
-	case 'n':
-		if consumeNull(d.buf[pos:]) == 0 {
-			pos, err = d.consumeLiteral(pos, "null")
-			if err != nil {
-				return Token{}, d.injectSyntacticErrorWithPosition(err, pos)
-			}
-		} else {
-			pos += len("null")
-		}
-		if err = d.tokens.appendLiteral(); err != nil {
-			return Token{}, d.injectSyntacticErrorWithPosition(err, pos-len("null")) // report position at start of literal
-		}
-		d.prevStart, d.prevEnd = pos, pos
-		return Null, nil
-
-	case 'f':
-		if consumeFalse(d.buf[pos:]) == 0 {
-			pos, err = d.consumeLiteral(pos, "false")
-			if err != nil {
-				return Token{}, d.injectSyntacticErrorWithPosition(err, pos)
-			}
-		} else {
-			pos += len("false")
-		}
-		if err = d.tokens.appendLiteral(); err != nil {
-			return Token{}, d.injectSyntacticErrorWithPosition(err, pos-len("false")) // report position at start of literal
-		}
-		d.prevStart, d.prevEnd = pos, pos
-		return False, nil
-
-	case 't':
-		if consumeTrue(d.buf[pos:]) == 0 {
-			pos, err = d.consumeLiteral(pos, "true")
-			if err != nil {
-				return Token{}, d.injectSyntacticErrorWithPosition(err, pos)
-			}
-		} else {
-			pos += len("true")
-		}
-		if err = d.tokens.appendLiteral(); err != nil {
-			return Token{}, d.injectSyntacticErrorWithPosition(err, pos-len("true")) // report position at start of literal
-		}
-		d.prevStart, d.prevEnd = pos, pos
-		return True, nil
-
-	case '"':
-		var flags valueFlags // TODO: Preserve this in Token?
-		if n = consumeSimpleString(d.buf[pos:]); n == 0 {
-			oldAbsPos := d.baseOffset + int64(pos)
-			pos, err = d.consumeString(&flags, pos)
-			newAbsPos := d.baseOffset + int64(pos)
-			n = int(newAbsPos - oldAbsPos)
-			if err != nil {
-				return Token{}, d.injectSyntacticErrorWithPosition(err, pos)
-			}
-		} else {
-			pos += n
-		}
-		if !d.options.AllowDuplicateNames && d.tokens.last.needObjectName() {
-			if !d.tokens.last.isValidNamespace() {
-				return Token{}, errInvalidNamespace
-			}
-			if d.tokens.last.isActiveNamespace() && !d.namespaces.last().insertQuoted(d.buf[pos-n:pos], flags.isVerbatim()) {
-				err = &SyntacticError{str: "duplicate name " + string(d.buf[pos-n:pos]) + " in object"}
-				return Token{}, d.injectSyntacticErrorWithPosition(err, pos-n) // report position at start of string
-			}
-			d.names.replaceLastQuotedOffset(pos - n) // only replace if insertQuoted succeeds
-		}
-		if err = d.tokens.appendString(); err != nil {
-			return Token{}, d.injectSyntacticErrorWithPosition(err, pos-n) // report position at start of string
-		}
-		d.prevStart, d.prevEnd = pos-n, pos
-		return Token{raw: &d.decodeBuffer, num: uint64(d.previousOffsetStart())}, nil
-
-	case '0':
-		// NOTE: Since JSON numbers are not self-terminating,
-		// we need to make sure that the next byte is not part of a number.
-		if n = consumeSimpleNumber(d.buf[pos:]); n == 0 || d.needMore(pos+n) {
-			oldAbsPos := d.baseOffset + int64(pos)
-			pos, err = d.consumeNumber(pos)
-			newAbsPos := d.baseOffset + int64(pos)
-			n = int(newAbsPos - oldAbsPos)
-			if err != nil {
-				return Token{}, d.injectSyntacticErrorWithPosition(err, pos)
-			}
-		} else {
-			pos += n
-		}
-		if err = d.tokens.appendNumber(); err != nil {
-			return Token{}, d.injectSyntacticErrorWithPosition(err, pos-n) // report position at start of number
-		}
-		d.prevStart, d.prevEnd = pos-n, pos
-		return Token{raw: &d.decodeBuffer, num: uint64(d.previousOffsetStart())}, nil
-
-	case '{':
-		if err = d.tokens.pushObject(); err != nil {
-			return Token{}, d.injectSyntacticErrorWithPosition(err, pos)
-		}
-		if !d.options.AllowDuplicateNames {
-			d.names.push()
-			d.namespaces.push()
-		}
-		pos += 1
-		d.prevStart, d.prevEnd = pos, pos
-		return ObjectStart, nil
-
-	case '}':
-		if err = d.tokens.popObject(); err != nil {
-			return Token{}, d.injectSyntacticErrorWithPosition(err, pos)
-		}
-		if !d.options.AllowDuplicateNames {
-			d.names.pop()
-			d.namespaces.pop()
-		}
-		pos += 1
-		d.prevStart, d.prevEnd = pos, pos
-		return ObjectEnd, nil
-
-	case '[':
-		if err = d.tokens.pushArray(); err != nil {
-			return Token{}, d.injectSyntacticErrorWithPosition(err, pos)
-		}
-		pos += 1
-		d.prevStart, d.prevEnd = pos, pos
-		return ArrayStart, nil
-
-	case ']':
-		if err = d.tokens.popArray(); err != nil {
-			return Token{}, d.injectSyntacticErrorWithPosition(err, pos)
-		}
-		pos += 1
-		d.prevStart, d.prevEnd = pos, pos
-		return ArrayEnd, nil
-
-	default:
-		err = newInvalidCharacterError(d.buf[pos:], "at start of token")
-		return Token{}, d.injectSyntacticErrorWithPosition(err, pos)
-	}
-}
-
-type valueFlags uint
-
-const (
-	_ valueFlags = (1 << iota) / 2 // powers of two starting with zero
-
-	stringNonVerbatim  // string cannot be naively treated as valid UTF-8
-	stringNonCanonical // string not formatted according to RFC 8785, section 3.2.2.2.
-	// TODO: Track whether a number is a non-integer?
-)
-
-func (f *valueFlags) set(f2 valueFlags) { *f |= f2 }
-func (f valueFlags) isVerbatim() bool   { return f&stringNonVerbatim == 0 }
-func (f valueFlags) isCanonical() bool  { return f&stringNonCanonical == 0 }
-
-// ReadValue returns the next raw JSON value, advancing the read offset.
-// The value is stripped of any leading or trailing whitespace.
-// The returned value is only valid until the next Peek, Read, or Skip call and
-// may not be mutated while the Decoder remains in use.
-// If the decoder is currently at the end token for an object or array,
-// then it reports a SyntacticError and the internal state remains unchanged.
-// It returns io.EOF if there are no more values.
-func (d *Decoder) ReadValue() (RawValue, error) {
-	var flags valueFlags
-	return d.readValue(&flags)
-}
-func (d *Decoder) readValue(flags *valueFlags) (RawValue, error) {
-	// Determine the next kind.
-	var err error
-	var next Kind
-	pos := d.peekPos
-	if pos != 0 {
-		// Use cached peek result.
-		if d.peekErr != nil {
-			err := d.peekErr
-			d.peekPos, d.peekErr = 0, nil // possibly a transient I/O error
-			return nil, err
-		}
-		next = Kind(d.buf[pos]).normalize()
-		d.peekPos = 0 // reset cache
-	} else {
-		d.invalidatePreviousRead()
-		pos = d.prevEnd
-
-		// Consume leading whitespace.
-		pos += consumeWhitespace(d.buf[pos:])
-		if d.needMore(pos) {
-			if pos, err = d.consumeWhitespace(pos); err != nil {
-				if err == io.ErrUnexpectedEOF && d.tokens.depth() == 1 {
-					err = io.EOF // EOF possibly if no Tokens present after top-level value
-				}
-				return nil, err
-			}
-		}
-
-		// Consume colon or comma.
-		var delim byte
-		if c := d.buf[pos]; c == ':' || c == ',' {
-			delim = c
-			pos += 1
-			pos += consumeWhitespace(d.buf[pos:])
-			if d.needMore(pos) {
-				if pos, err = d.consumeWhitespace(pos); err != nil {
-					return nil, err
-				}
-			}
-		}
-		next = Kind(d.buf[pos]).normalize()
-		if d.tokens.needDelim(next) != delim {
-			pos = d.prevEnd // restore position to right after leading whitespace
-			pos += consumeWhitespace(d.buf[pos:])
-			err = d.tokens.checkDelim(delim, next)
-			return nil, d.injectSyntacticErrorWithPosition(err, pos)
-		}
-	}
-
-	// Handle the next value.
-	oldAbsPos := d.baseOffset + int64(pos)
-	pos, err = d.consumeValue(flags, pos)
-	newAbsPos := d.baseOffset + int64(pos)
-	n := int(newAbsPos - oldAbsPos)
-	if err != nil {
-		return nil, d.injectSyntacticErrorWithPosition(err, pos)
-	}
-	switch next {
-	case 'n', 't', 'f':
-		err = d.tokens.appendLiteral()
-	case '"':
-		if !d.options.AllowDuplicateNames && d.tokens.last.needObjectName() {
-			if !d.tokens.last.isValidNamespace() {
-				err = errInvalidNamespace
-				break
-			}
-			if d.tokens.last.isActiveNamespace() && !d.namespaces.last().insertQuoted(d.buf[pos-n:pos], flags.isVerbatim()) {
-				err = &SyntacticError{str: "duplicate name " + string(d.buf[pos-n:pos]) + " in object"}
-				break
-			}
-			d.names.replaceLastQuotedOffset(pos - n) // only replace if insertQuoted succeeds
-		}
-		err = d.tokens.appendString()
-	case '0':
-		err = d.tokens.appendNumber()
-	case '{':
-		if err = d.tokens.pushObject(); err != nil {
-			break
-		}
-		if err = d.tokens.popObject(); err != nil {
-			panic("BUG: popObject should never fail immediately after pushObject: " + err.Error())
-		}
-	case '[':
-		if err = d.tokens.pushArray(); err != nil {
-			break
-		}
-		if err = d.tokens.popArray(); err != nil {
-			panic("BUG: popArray should never fail immediately after pushArray: " + err.Error())
-		}
-	}
-	if err != nil {
-		return nil, d.injectSyntacticErrorWithPosition(err, pos-n) // report position at start of value
-	}
-	d.prevEnd = pos
-	d.prevStart = pos - n
-	return d.buf[pos-n : pos : pos], nil
-}
-
-// checkEOF verifies that the input has no more data.
-func (d *Decoder) checkEOF() error {
-	switch pos, err := d.consumeWhitespace(d.prevEnd); err {
-	case nil:
-		return newInvalidCharacterError(d.buf[pos:], "after top-level value")
-	case io.ErrUnexpectedEOF:
-		return nil
-	default:
-		return err
-	}
-}
-
-// consumeWhitespace consumes all whitespace starting at d.buf[pos:].
-// It returns the new position in d.buf immediately after the last whitespace.
-// If it returns nil, there is guaranteed to at least be one unread byte.
-//
-// The following pattern is common in this implementation:
-//
-//	pos += consumeWhitespace(d.buf[pos:])
-//	if d.needMore(pos) {
-//		if pos, err = d.consumeWhitespace(pos); err != nil {
-//			return ...
-//		}
-//	}
-//
-// It is difficult to simplify this without sacrificing performance since
-// consumeWhitespace must be inlined. The body of the if statement is
-// executed only in rare situations where we need to fetch more data.
-// Since fetching may return an error, we also need to check the error.
-func (d *Decoder) consumeWhitespace(pos int) (newPos int, err error) {
-	for {
-		pos += consumeWhitespace(d.buf[pos:])
-		if d.needMore(pos) {
-			absPos := d.baseOffset + int64(pos)
-			err = d.fetch() // will mutate d.buf and invalidate pos
-			pos = int(absPos - d.baseOffset)
-			if err != nil {
-				return pos, err
-			}
-			continue
-		}
-		return pos, nil
-	}
-}
-
-// consumeValue consumes a single JSON value starting at d.buf[pos:].
-// It returns the new position in d.buf immediately after the value.
-func (d *Decoder) consumeValue(flags *valueFlags, pos int) (newPos int, err error) {
-	for {
-		var n int
-		var err error
-		switch next := Kind(d.buf[pos]).normalize(); next {
-		case 'n':
-			if n = consumeNull(d.buf[pos:]); n == 0 {
-				n, err = consumeLiteral(d.buf[pos:], "null")
-			}
-		case 'f':
-			if n = consumeFalse(d.buf[pos:]); n == 0 {
-				n, err = consumeLiteral(d.buf[pos:], "false")
-			}
-		case 't':
-			if n = consumeTrue(d.buf[pos:]); n == 0 {
-				n, err = consumeLiteral(d.buf[pos:], "true")
-			}
-		case '"':
-			if n = consumeSimpleString(d.buf[pos:]); n == 0 {
-				return d.consumeString(flags, pos)
-			}
-		case '0':
-			// NOTE: Since JSON numbers are not self-terminating,
-			// we need to make sure that the next byte is not part of a number.
-			if n = consumeSimpleNumber(d.buf[pos:]); n == 0 || d.needMore(pos+n) {
-				return d.consumeNumber(pos)
-			}
-		case '{':
-			return d.consumeObject(flags, pos)
-		case '[':
-			return d.consumeArray(flags, pos)
-		default:
-			return pos, newInvalidCharacterError(d.buf[pos:], "at start of value")
-		}
-		if err == io.ErrUnexpectedEOF {
-			absPos := d.baseOffset + int64(pos)
-			err = d.fetch() // will mutate d.buf and invalidate pos
-			pos = int(absPos - d.baseOffset)
-			if err != nil {
-				return pos, err
-			}
-			continue
-		}
-		return pos + n, err
-	}
-}
-
-// consumeLiteral consumes a single JSON literal starting at d.buf[pos:].
-// It returns the new position in d.buf immediately after the literal.
-func (d *Decoder) consumeLiteral(pos int, lit string) (newPos int, err error) {
-	for {
-		n, err := consumeLiteral(d.buf[pos:], lit)
-		if err == io.ErrUnexpectedEOF {
-			absPos := d.baseOffset + int64(pos)
-			err = d.fetch() // will mutate d.buf and invalidate pos
-			pos = int(absPos - d.baseOffset)
-			if err != nil {
-				return pos, err
-			}
-			continue
-		}
-		return pos + n, err
-	}
-}
-
-// consumeString consumes a single JSON string starting at d.buf[pos:].
-// It returns the new position in d.buf immediately after the string.
-func (d *Decoder) consumeString(flags *valueFlags, pos int) (newPos int, err error) {
-	var n int
-	for {
-		n, err = consumeStringResumable(flags, d.buf[pos:], n, !d.options.AllowInvalidUTF8)
-		if err == io.ErrUnexpectedEOF {
-			absPos := d.baseOffset + int64(pos)
-			err = d.fetch() // will mutate d.buf and invalidate pos
-			pos = int(absPos - d.baseOffset)
-			if err != nil {
-				return pos, err
-			}
-			continue
-		}
-		return pos + n, err
-	}
-}
-
-// consumeNumber consumes a single JSON number starting at d.buf[pos:].
-// It returns the new position in d.buf immediately after the number.
-func (d *Decoder) consumeNumber(pos int) (newPos int, err error) {
-	var n int
-	var state consumeNumberState
-	for {
-		n, state, err = consumeNumberResumable(d.buf[pos:], n, state)
-		// NOTE: Since JSON numbers are not self-terminating,
-		// we need to make sure that the next byte is not part of a number.
-		if err == io.ErrUnexpectedEOF || d.needMore(pos+n) {
-			mayTerminate := err == nil
-			absPos := d.baseOffset + int64(pos)
-			err = d.fetch() // will mutate d.buf and invalidate pos
-			pos = int(absPos - d.baseOffset)
-			if err != nil {
-				if mayTerminate && err == io.ErrUnexpectedEOF {
-					return pos + n, nil
-				}
-				return pos, err
-			}
-			continue
-		}
-		return pos + n, err
-	}
-}
-
-// consumeObject consumes a single JSON object starting at d.buf[pos:].
-// It returns the new position in d.buf immediately after the object.
-func (d *Decoder) consumeObject(flags *valueFlags, pos int) (newPos int, err error) {
-	var n int
-	var names *objectNamespace
-	if !d.options.AllowDuplicateNames {
-		d.namespaces.push()
-		defer d.namespaces.pop()
-		names = d.namespaces.last()
-	}
-
-	// Handle before start.
-	if d.buf[pos] != '{' {
-		panic("BUG: consumeObject must be called with a buffer that starts with '{'")
-	}
-	pos++
-
-	// Handle after start.
-	pos += consumeWhitespace(d.buf[pos:])
-	if d.needMore(pos) {
-		if pos, err = d.consumeWhitespace(pos); err != nil {
-			return pos, err
-		}
-	}
-	if d.buf[pos] == '}' {
-		pos++
-		return pos, nil
-	}
-
-	for {
-		// Handle before name.
-		pos += consumeWhitespace(d.buf[pos:])
-		if d.needMore(pos) {
-			if pos, err = d.consumeWhitespace(pos); err != nil {
-				return pos, err
-			}
-		}
-		var flags2 valueFlags
-		if n = consumeSimpleString(d.buf[pos:]); n == 0 {
-			oldAbsPos := d.baseOffset + int64(pos)
-			pos, err = d.consumeString(&flags2, pos)
-			newAbsPos := d.baseOffset + int64(pos)
-			n = int(newAbsPos - oldAbsPos)
-			flags.set(flags2)
-			if err != nil {
-				return pos, err
-			}
-		} else {
-			pos += n
-		}
-		if !d.options.AllowDuplicateNames && !names.insertQuoted(d.buf[pos-n:pos], flags2.isVerbatim()) {
-			return pos - n, &SyntacticError{str: "duplicate name " + string(d.buf[pos-n:pos]) + " in object"}
-		}
-
-		// Handle after name.
-		pos += consumeWhitespace(d.buf[pos:])
-		if d.needMore(pos) {
-			if pos, err = d.consumeWhitespace(pos); err != nil {
-				return pos, err
-			}
-		}
-		if d.buf[pos] != ':' {
-			return pos, newInvalidCharacterError(d.buf[pos:], "after object name (expecting ':')")
-		}
-		pos++
-
-		// Handle before value.
-		pos += consumeWhitespace(d.buf[pos:])
-		if d.needMore(pos) {
-			if pos, err = d.consumeWhitespace(pos); err != nil {
-				return pos, err
-			}
-		}
-		pos, err = d.consumeValue(flags, pos)
-		if err != nil {
-			return pos, err
-		}
-
-		// Handle after value.
-		pos += consumeWhitespace(d.buf[pos:])
-		if d.needMore(pos) {
-			if pos, err = d.consumeWhitespace(pos); err != nil {
-				return pos, err
-			}
-		}
-		switch d.buf[pos] {
-		case ',':
-			pos++
-			continue
-		case '}':
-			pos++
-			return pos, nil
-		default:
-			return pos, newInvalidCharacterError(d.buf[pos:], "after object value (expecting ',' or '}')")
-		}
-	}
-}
-
-// consumeArray consumes a single JSON array starting at d.buf[pos:].
-// It returns the new position in d.buf immediately after the array.
-func (d *Decoder) consumeArray(flags *valueFlags, pos int) (newPos int, err error) {
-	// Handle before start.
-	if d.buf[pos] != '[' {
-		panic("BUG: consumeArray must be called with a buffer that starts with '['")
-	}
-	pos++
-
-	// Handle after start.
-	pos += consumeWhitespace(d.buf[pos:])
-	if d.needMore(pos) {
-		if pos, err = d.consumeWhitespace(pos); err != nil {
-			return pos, err
-		}
-	}
-	if d.buf[pos] == ']' {
-		pos++
-		return pos, nil
-	}
-
-	for {
-		// Handle before value.
-		pos += consumeWhitespace(d.buf[pos:])
-		if d.needMore(pos) {
-			if pos, err = d.consumeWhitespace(pos); err != nil {
-				return pos, err
-			}
-		}
-		pos, err = d.consumeValue(flags, pos)
-		if err != nil {
-			return pos, err
-		}
-
-		// Handle after value.
-		pos += consumeWhitespace(d.buf[pos:])
-		if d.needMore(pos) {
-			if pos, err = d.consumeWhitespace(pos); err != nil {
-				return pos, err
-			}
-		}
-		switch d.buf[pos] {
-		case ',':
-			pos++
-			continue
-		case ']':
-			pos++
-			return pos, nil
-		default:
-			return pos, newInvalidCharacterError(d.buf[pos:], "after array value (expecting ',' or ']')")
-		}
-	}
-}
-
-// InputOffset returns the current input byte offset. It gives the location
-// of the next byte immediately after the most recently returned token or value.
-// The number of bytes actually read from the underlying io.Reader may be more
-// than this offset due to internal buffering effects.
-func (d *Decoder) InputOffset() int64 {
-	return d.previousOffsetEnd()
-}
-
-// UnreadBuffer returns the data remaining in the unread buffer,
-// which may contain zero or more bytes.
-// The returned buffer must not be mutated while Decoder continues to be used.
-// The buffer contents are valid until the next Peek, Read, or Skip call.
-func (d *Decoder) UnreadBuffer() []byte {
-	return d.unreadBuffer()
-}
-
-// StackDepth returns the depth of the state machine for read JSON data.
-// Each level on the stack represents a nested JSON object or array.
-// It is incremented whenever an ObjectStart or ArrayStart token is encountered
-// and decremented whenever an ObjectEnd or ArrayEnd token is encountered.
-// The depth is zero-indexed, where zero represents the top-level JSON value.
-func (d *Decoder) StackDepth() int {
-	// NOTE: Keep in sync with Encoder.StackDepth.
-	return d.tokens.depth() - 1
-}
-
-// StackIndex returns information about the specified stack level.
-// It must be a number between 0 and StackDepth, inclusive.
-// For each level, it reports the kind:
-//
-//   - 0 for a level of zero,
-//   - '{' for a level representing a JSON object, and
-//   - '[' for a level representing a JSON array.
-//
-// It also reports the length of that JSON object or array.
-// Each name and value in a JSON object is counted separately,
-// so the effective number of members would be half the length.
-// A complete JSON object must have an even length.
-func (d *Decoder) StackIndex(i int) (Kind, int) {
-	// NOTE: Keep in sync with Encoder.StackIndex.
-	switch s := d.tokens.index(i); {
-	case i > 0 && s.isObject():
-		return '{', s.length()
-	case i > 0 && s.isArray():
-		return '[', s.length()
-	default:
-		return 0, s.length()
-	}
-}
-
-// StackPointer returns a JSON Pointer (RFC 6901) to the most recently read value.
-// Object names are only present if AllowDuplicateNames is false, otherwise
-// object members are represented using their index within the object.
-func (d *Decoder) StackPointer() string {
-	d.names.copyQuotedBuffer(d.buf)
-	return string(d.appendStackPointer(nil))
-}
-
-// consumeWhitespace consumes leading JSON whitespace per RFC 7159, section 2.
-func consumeWhitespace(b []byte) (n int) {
-	// NOTE: The arguments and logic are kept simple to keep this inlineable.
-	for len(b) > n && (b[n] == ' ' || b[n] == '\t' || b[n] == '\r' || b[n] == '\n') {
-		n++
-	}
-	return n
-}
-
-// consumeNull consumes the next JSON null literal per RFC 7159, section 3.
-// It returns 0 if it is invalid, in which case consumeLiteral should be used.
-func consumeNull(b []byte) int {
-	// NOTE: The arguments and logic are kept simple to keep this inlineable.
-	const literal = "null"
-	if len(b) >= len(literal) && string(b[:len(literal)]) == literal {
-		return len(literal)
-	}
-	return 0
-}
-
-// consumeFalse consumes the next JSON false literal per RFC 7159, section 3.
-// It returns 0 if it is invalid, in which case consumeLiteral should be used.
-func consumeFalse(b []byte) int {
-	// NOTE: The arguments and logic are kept simple to keep this inlineable.
-	const literal = "false"
-	if len(b) >= len(literal) && string(b[:len(literal)]) == literal {
-		return len(literal)
-	}
-	return 0
-}
-
-// consumeTrue consumes the next JSON true literal per RFC 7159, section 3.
-// It returns 0 if it is invalid, in which case consumeLiteral should be used.
-func consumeTrue(b []byte) int {
-	// NOTE: The arguments and logic are kept simple to keep this inlineable.
-	const literal = "true"
-	if len(b) >= len(literal) && string(b[:len(literal)]) == literal {
-		return len(literal)
-	}
-	return 0
-}
-
-// consumeLiteral consumes the next JSON literal per RFC 7159, section 3.
-// If the input appears truncated, it returns io.ErrUnexpectedEOF.
-func consumeLiteral(b []byte, lit string) (n int, err error) {
-	for i := 0; i < len(b) && i < len(lit); i++ {
-		if b[i] != lit[i] {
-			return i, newInvalidCharacterError(b[i:], "within literal "+lit+" (expecting "+strconv.QuoteRune(rune(lit[i]))+")")
-		}
-	}
-	if len(b) < len(lit) {
-		return len(b), io.ErrUnexpectedEOF
-	}
-	return len(lit), nil
-}
-
-// consumeSimpleString consumes the next JSON string per RFC 7159, section 7
-// but is limited to the grammar for an ASCII string without escape sequences.
-// It returns 0 if it is invalid or more complicated than a simple string,
-// in which case consumeString should be called.
-func consumeSimpleString(b []byte) (n int) {
-	// NOTE: The arguments and logic are kept simple to keep this inlineable.
-	if len(b) > 0 && b[0] == '"' {
-		n++
-		for len(b) > n && (' ' <= b[n] && b[n] != '\\' && b[n] != '"' && b[n] < utf8.RuneSelf) {
-			n++
-		}
-		if len(b) > n && b[n] == '"' {
-			n++
-			return n
-		}
-	}
-	return 0
-}
-
-// consumeString consumes the next JSON string per RFC 7159, section 7.
-// If validateUTF8 is false, then this allows the presence of invalid UTF-8
-// characters within the string itself.
-// It reports the number of bytes consumed and whether an error was encountered.
-// If the input appears truncated, it returns io.ErrUnexpectedEOF.
-func consumeString(flags *valueFlags, b []byte, validateUTF8 bool) (n int, err error) {
-	return consumeStringResumable(flags, b, 0, validateUTF8)
-}
-
-// consumeStringResumable is identical to consumeString but supports resuming
-// from a previous call that returned io.ErrUnexpectedEOF.
-func consumeStringResumable(flags *valueFlags, b []byte, resumeOffset int, validateUTF8 bool) (n int, err error) {
-	// Consume the leading double quote.
-	switch {
-	case resumeOffset > 0:
-		n = resumeOffset // already handled the leading quote
-	case uint(len(b)) == 0:
-		return n, io.ErrUnexpectedEOF
-	case b[0] == '"':
-		n++
-	default:
-		return n, newInvalidCharacterError(b[n:], `at start of string (expecting '"')`)
-	}
-
-	// Consume every character in the string.
-	for uint(len(b)) > uint(n) {
-		// Optimize for long sequences of unescaped characters.
-		noEscape := func(c byte) bool {
-			return c < utf8.RuneSelf && ' ' <= c && c != '\\' && c != '"'
-		}
-		for uint(len(b)) > uint(n) && noEscape(b[n]) {
-			n++
-		}
-		if uint(len(b)) <= uint(n) {
-			return n, io.ErrUnexpectedEOF
-		}
-
-		// Check for terminating double quote.
-		if b[n] == '"' {
-			n++
-			return n, nil
-		}
-
-		switch r, rn := utf8.DecodeRune(b[n:]); {
-		// Handle UTF-8 encoded byte sequence.
-		// Due to specialized handling of ASCII above, we know that
-		// all normal sequences at this point must be 2 bytes or larger.
-		case rn > 1:
-			n += rn
-		// Handle escape sequence.
-		case r == '\\':
-			flags.set(stringNonVerbatim)
-			resumeOffset = n
-			if uint(len(b)) < uint(n+2) {
-				return resumeOffset, io.ErrUnexpectedEOF
-			}
-			switch r := b[n+1]; r {
-			case '/':
-				// Forward slash is the only character with 3 representations.
-				// Per RFC 8785, section 3.2.2.2., this must not be escaped.
-				flags.set(stringNonCanonical)
-				n += 2
-			case '"', '\\', 'b', 'f', 'n', 'r', 't':
-				n += 2
-			case 'u':
-				if uint(len(b)) < uint(n+6) {
-					if !hasEscapeSequencePrefix(b[n:]) {
-						flags.set(stringNonCanonical)
-						return n, &SyntacticError{str: "invalid escape sequence " + strconv.Quote(string(b[n:])) + " within string"}
-					}
-					return resumeOffset, io.ErrUnexpectedEOF
-				}
-				v1, ok := parseHexUint16(b[n+2 : n+6])
-				if !ok {
-					flags.set(stringNonCanonical)
-					return n, &SyntacticError{str: "invalid escape sequence " + strconv.Quote(string(b[n:n+6])) + " within string"}
-				}
-				// Only certain control characters can use the \uFFFF notation
-				// for canonical formatting (per RFC 8785, section 3.2.2.2.).
-				switch v1 {
-				// \uFFFF notation not permitted for these characters.
-				case '\b', '\f', '\n', '\r', '\t':
-					flags.set(stringNonCanonical)
-				default:
-					// \uFFFF notation only permitted for control characters.
-					if v1 >= ' ' {
-						flags.set(stringNonCanonical)
-					} else {
-						// \uFFFF notation must be lower case.
-						for _, c := range b[n+2 : n+6] {
-							if 'A' <= c && c <= 'F' {
-								flags.set(stringNonCanonical)
-							}
-						}
-					}
-				}
-				n += 6
-
-				if validateUTF8 && utf16.IsSurrogate(rune(v1)) {
-					if uint(len(b)) >= uint(n+2) && (b[n] != '\\' || b[n+1] != 'u') {
-						return n, &SyntacticError{str: "invalid unpaired surrogate half within string"}
-					}
-					if uint(len(b)) < uint(n+6) {
-						if !hasEscapeSequencePrefix(b[n:]) {
-							flags.set(stringNonCanonical)
-							return n, &SyntacticError{str: "invalid escape sequence " + strconv.Quote(string(b[n:])) + " within string"}
-						}
-						return resumeOffset, io.ErrUnexpectedEOF
-					}
-					v2, ok := parseHexUint16(b[n+2 : n+6])
-					if !ok {
-						return n, &SyntacticError{str: "invalid escape sequence " + strconv.Quote(string(b[n:n+6])) + " within string"}
-					}
-					if utf16.DecodeRune(rune(v1), rune(v2)) == utf8.RuneError {
-						return n, &SyntacticError{str: "invalid surrogate pair in string"}
-					}
-					n += 6
-				}
-			default:
-				flags.set(stringNonCanonical)
-				return n, &SyntacticError{str: "invalid escape sequence " + strconv.Quote(string(b[n:n+2])) + " within string"}
-			}
-		// Handle invalid UTF-8.
-		case r == utf8.RuneError:
-			if !utf8.FullRune(b[n:]) {
-				return n, io.ErrUnexpectedEOF
-			}
-			flags.set(stringNonVerbatim | stringNonCanonical)
-			if validateUTF8 {
-				return n, &SyntacticError{str: "invalid UTF-8 within string"}
-			}
-			n++
-		// Handle invalid control characters.
-		case r < ' ':
-			flags.set(stringNonVerbatim | stringNonCanonical)
-			return n, newInvalidCharacterError(b[n:], "within string (expecting non-control character)")
-		default:
-			panic("BUG: unhandled character " + quoteRune(b[n:]))
-		}
-	}
-	return n, io.ErrUnexpectedEOF
-}
-
-// hasEscapeSequencePrefix reports whether b is possibly
-// the truncated prefix of a \uFFFF escape sequence.
-func hasEscapeSequencePrefix(b []byte) bool {
-	for i, c := range b {
-		switch {
-		case i == 0 && c != '\\':
-			return false
-		case i == 1 && c != 'u':
-			return false
-		case i >= 2 && i < 6 && !('0' <= c && c <= '9') && !('a' <= c && c <= 'f') && !('A' <= c && c <= 'F'):
-			return false
-		}
-	}
-	return true
-}
-
-// unescapeString appends the unescaped form of a JSON string in src to dst.
-// Any invalid UTF-8 within the string will be replaced with utf8.RuneError.
-// The input must be an entire JSON string with no surrounding whitespace.
-func unescapeString(dst, src []byte) (v []byte, ok bool) {
-	// Consume leading double quote.
-	if uint(len(src)) == 0 || src[0] != '"' {
-		return dst, false
-	}
-	i, n := 1, 1
-
-	// Consume every character until completion.
-	for uint(len(src)) > uint(n) {
-		// Optimize for long sequences of unescaped characters.
-		noEscape := func(c byte) bool {
-			return c < utf8.RuneSelf && ' ' <= c && c != '\\' && c != '"'
-		}
-		for uint(len(src)) > uint(n) && noEscape(src[n]) {
-			n++
-		}
-		if uint(len(src)) <= uint(n) {
-			break
-		}
-
-		// Check for terminating double quote.
-		if src[n] == '"' {
-			dst = append(dst, src[i:n]...)
-			n++
-			return dst, len(src) == n
-		}
-
-		switch r, rn := utf8.DecodeRune(src[n:]); {
-		// Handle UTF-8 encoded byte sequence.
-		// Due to specialized handling of ASCII above, we know that
-		// all normal sequences at this point must be 2 bytes or larger.
-		case rn > 1:
-			n += rn
-		// Handle escape sequence.
-		case r == '\\':
-			dst = append(dst, src[i:n]...)
-			if r < ' ' {
-				return dst, false // invalid control character or unescaped quote
-			}
-
-			// Handle escape sequence.
-			if uint(len(src)) < uint(n+2) {
-				return dst, false // truncated escape sequence
-			}
-			switch r := src[n+1]; r {
-			case '"', '\\', '/':
-				dst = append(dst, r)
-				n += 2
-			case 'b':
-				dst = append(dst, '\b')
-				n += 2
-			case 'f':
-				dst = append(dst, '\f')
-				n += 2
-			case 'n':
-				dst = append(dst, '\n')
-				n += 2
-			case 'r':
-				dst = append(dst, '\r')
-				n += 2
-			case 't':
-				dst = append(dst, '\t')
-				n += 2
-			case 'u':
-				if uint(len(src)) < uint(n+6) {
-					return dst, false // truncated escape sequence
-				}
-				v1, ok := parseHexUint16(src[n+2 : n+6])
-				if !ok {
-					return dst, false // invalid escape sequence
-				}
-				n += 6
-
-				// Check whether this is a surrogate half.
-				r := rune(v1)
-				if utf16.IsSurrogate(r) {
-					r = utf8.RuneError // assume failure unless the following succeeds
-					if uint(len(src)) >= uint(n+6) && src[n+0] == '\\' && src[n+1] == 'u' {
-						if v2, ok := parseHexUint16(src[n+2 : n+6]); ok {
-							if r = utf16.DecodeRune(rune(v1), rune(v2)); r != utf8.RuneError {
-								n += 6
-							}
-						}
-					}
-				}
-
-				dst = utf8.AppendRune(dst, r)
-			default:
-				return dst, false // invalid escape sequence
-			}
-			i = n
-		// Handle invalid UTF-8.
-		case r == utf8.RuneError:
-			// NOTE: An unescaped string may be longer than the escaped string
-			// because invalid UTF-8 bytes are being replaced.
-			dst = append(dst, src[i:n]...)
-			dst = append(dst, "\uFFFD"...)
-			n += rn
-			i = n
-		// Handle invalid control characters.
-		case r < ' ':
-			dst = append(dst, src[i:n]...)
-			return dst, false // invalid control character or unescaped quote
-		default:
-			panic("BUG: unhandled character " + quoteRune(src[n:]))
-		}
-	}
-	dst = append(dst, src[i:n]...)
-	return dst, false // truncated input
-}
-
-// unescapeStringMayCopy returns the unescaped form of b.
-// If there are no escaped characters, the output is simply a subslice of
-// the input with the surrounding quotes removed.
-// Otherwise, a new buffer is allocated for the output.
-func unescapeStringMayCopy(b []byte, isVerbatim bool) []byte {
-	// NOTE: The arguments and logic are kept simple to keep this inlineable.
-	if isVerbatim {
-		return b[len(`"`) : len(b)-len(`"`)]
-	}
-	b, _ = unescapeString(make([]byte, 0, len(b)), b)
-	return b
-}
-
-// consumeSimpleNumber consumes the next JSON number per RFC 7159, section 6
-// but is limited to the grammar for a positive integer.
-// It returns 0 if it is invalid or more complicated than a simple integer,
-// in which case consumeNumber should be called.
-func consumeSimpleNumber(b []byte) (n int) {
-	// NOTE: The arguments and logic are kept simple to keep this inlineable.
-	if len(b) > 0 {
-		if b[0] == '0' {
-			n++
-		} else if '1' <= b[0] && b[0] <= '9' {
-			n++
-			for len(b) > n && ('0' <= b[n] && b[n] <= '9') {
-				n++
-			}
-		} else {
-			return 0
-		}
-		if len(b) == n || !(b[n] == '.' || b[n] == 'e' || b[n] == 'E') {
-			return n
-		}
-	}
-	return 0
-}
-
-type consumeNumberState uint
-
-const (
-	consumeNumberInit consumeNumberState = iota
-	beforeIntegerDigits
-	withinIntegerDigits
-	beforeFractionalDigits
-	withinFractionalDigits
-	beforeExponentDigits
-	withinExponentDigits
-)
-
-// consumeNumber consumes the next JSON number per RFC 7159, section 6.
-// It reports the number of bytes consumed and whether an error was encountered.
-// If the input appears truncated, it returns io.ErrUnexpectedEOF.
-//
-// Note that JSON numbers are not self-terminating.
-// If the entire input is consumed, then the caller needs to consider whether
-// there may be subsequent unread data that may still be part of this number.
-func consumeNumber(b []byte) (n int, err error) {
-	n, _, err = consumeNumberResumable(b, 0, consumeNumberInit)
-	return n, err
-}
-
-// consumeNumberResumable is identical to consumeNumber but supports resuming
-// from a previous call that returned io.ErrUnexpectedEOF.
-func consumeNumberResumable(b []byte, resumeOffset int, state consumeNumberState) (n int, _ consumeNumberState, err error) {
-	// Jump to the right state when resuming from a partial consumption.
-	n = resumeOffset
-	if state > consumeNumberInit {
-		switch state {
-		case withinIntegerDigits, withinFractionalDigits, withinExponentDigits:
-			// Consume leading digits.
-			for len(b) > n && ('0' <= b[n] && b[n] <= '9') {
-				n++
-			}
-			if len(b) == n {
-				return n, state, nil // still within the same state
-			}
-			state++ // switches "withinX" to "beforeY" where Y is the state after X
-		}
-		switch state {
-		case beforeIntegerDigits:
-			goto beforeInteger
-		case beforeFractionalDigits:
-			goto beforeFractional
-		case beforeExponentDigits:
-			goto beforeExponent
-		default:
-			return n, state, nil
-		}
-	}
-
-	// Consume required integer component (with optional minus sign).
-beforeInteger:
-	resumeOffset = n
-	if len(b) > 0 && b[0] == '-' {
-		n++
-	}
-	switch {
-	case len(b) == n:
-		return resumeOffset, beforeIntegerDigits, io.ErrUnexpectedEOF
-	case b[n] == '0':
-		n++
-		state = beforeFractionalDigits
-	case '1' <= b[n] && b[n] <= '9':
-		n++
-		for len(b) > n && ('0' <= b[n] && b[n] <= '9') {
-			n++
-		}
-		state = withinIntegerDigits
-	default:
-		return n, state, newInvalidCharacterError(b[n:], "within number (expecting digit)")
-	}
-
-	// Consume optional fractional component.
-beforeFractional:
-	if len(b) > n && b[n] == '.' {
-		resumeOffset = n
-		n++
-		switch {
-		case len(b) == n:
-			return resumeOffset, beforeFractionalDigits, io.ErrUnexpectedEOF
-		case '0' <= b[n] && b[n] <= '9':
-			n++
-		default:
-			return n, state, newInvalidCharacterError(b[n:], "within number (expecting digit)")
-		}
-		for len(b) > n && ('0' <= b[n] && b[n] <= '9') {
-			n++
-		}
-		state = withinFractionalDigits
-	}
-
-	// Consume optional exponent component.
-beforeExponent:
-	if len(b) > n && (b[n] == 'e' || b[n] == 'E') {
-		resumeOffset = n
-		n++
-		if len(b) > n && (b[n] == '-' || b[n] == '+') {
-			n++
-		}
-		switch {
-		case len(b) == n:
-			return resumeOffset, beforeExponentDigits, io.ErrUnexpectedEOF
-		case '0' <= b[n] && b[n] <= '9':
-			n++
-		default:
-			return n, state, newInvalidCharacterError(b[n:], "within number (expecting digit)")
-		}
-		for len(b) > n && ('0' <= b[n] && b[n] <= '9') {
-			n++
-		}
-		state = withinExponentDigits
-	}
-
-	return n, state, nil
-}
-
-// parseHexUint16 is similar to strconv.ParseUint,
-// but operates directly on []byte and is optimized for base-16.
-// See https://go.dev/issue/42429.
-func parseHexUint16(b []byte) (v uint16, ok bool) {
-	if len(b) != 4 {
-		return 0, false
-	}
-	for _, c := range b[:4] {
-		switch {
-		case '0' <= c && c <= '9':
-			c = c - '0'
-		case 'a' <= c && c <= 'f':
-			c = 10 + c - 'a'
-		case 'A' <= c && c <= 'F':
-			c = 10 + c - 'A'
-		default:
-			return 0, false
-		}
-		v = v*16 + uint16(c)
-	}
-	return v, true
-}
-
-// parseDecUint is similar to strconv.ParseUint,
-// but operates directly on []byte and is optimized for base-10.
-// If the number is syntactically valid but overflows uint64,
-// then it returns (math.MaxUint64, false).
-// See https://go.dev/issue/42429.
-func parseDecUint(b []byte) (v uint64, ok bool) {
-	// Overflow logic is based on strconv/atoi.go:138-149 from Go1.15, where:
-	//   - cutoff is equal to math.MaxUint64/10+1, and
-	//   - the n1 > maxVal check is unnecessary
-	//     since maxVal is equivalent to math.MaxUint64.
-	var n int
-	var overflow bool
-	for len(b) > n && ('0' <= b[n] && b[n] <= '9') {
-		overflow = overflow || v >= math.MaxUint64/10+1
-		v *= 10
-
-		v1 := v + uint64(b[n]-'0')
-		overflow = overflow || v1 < v
-		v = v1
-
-		n++
-	}
-	if n == 0 || len(b) != n {
-		return 0, false
-	}
-	if overflow {
-		return math.MaxUint64, false
-	}
-	return v, true
-}
-
-// parseFloat parses a floating point number according to the Go float grammar.
-// Note that the JSON number grammar is a strict subset.
-//
-// If the number overflows the finite representation of a float,
-// then we return MaxFloat since any finite value will always be infinitely
-// more accurate at representing another finite value than an infinite value.
-func parseFloat(b []byte, bits int) (v float64, ok bool) {
-	// Fast path for exact integer numbers which fit in the
-	// 24-bit or 53-bit significand of a float32 or float64.
-	var negLen int // either 0 or 1
-	if len(b) > 0 && b[0] == '-' {
-		negLen = 1
-	}
-	u, ok := parseDecUint(b[negLen:])
-	if ok && ((bits == 32 && u <= 1<<24) || (bits == 64 && u <= 1<<53)) {
-		return math.Copysign(float64(u), float64(-1*negLen)), true
-	}
-
-	// Note that the []byte->string conversion unfortunately allocates.
-	// See https://go.dev/issue/42429 for more information.
-	fv, err := strconv.ParseFloat(string(b), bits)
-	if math.IsInf(fv, 0) {
-		switch {
-		case bits == 32 && math.IsInf(fv, +1):
-			return +math.MaxFloat32, true
-		case bits == 64 && math.IsInf(fv, +1):
-			return +math.MaxFloat64, true
-		case bits == 32 && math.IsInf(fv, -1):
-			return -math.MaxFloat32, true
-		case bits == 64 && math.IsInf(fv, -1):
-			return -math.MaxFloat64, true
-		}
-	}
-	return fv, err == nil
-}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/doc.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/doc.go
index e4eefa3de9..ff70951ab5 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/doc.go
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/doc.go
@@ -2,61 +2,41 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Package json implements serialization of JSON
-// as specified in RFC 4627, RFC 7159, RFC 7493, RFC 8259, and RFC 8785.
+// Package json implements semantic processing of JSON as specified in RFC 8259.
 // JSON is a simple data interchange format that can represent
 // primitive data types such as booleans, strings, and numbers,
 // in addition to structured data types such as objects and arrays.
 //
-// # Terminology
-//
-// This package uses the terms "encode" and "decode" for syntactic functionality
-// that is concerned with processing JSON based on its grammar, and
-// uses the terms "marshal" and "unmarshal" for semantic functionality
-// that determines the meaning of JSON values as Go values and vice-versa.
-// It aims to provide a clear distinction between functionality that
-// is purely concerned with encoding versus that of marshaling.
-// For example, one can directly encode a stream of JSON tokens without
-// needing to marshal a concrete Go value representing them.
-// Similarly, one can decode a stream of JSON tokens without
-// needing to unmarshal them into a concrete Go value.
-//
-// This package uses JSON terminology when discussing JSON, which may differ
-// from related concepts in Go or elsewhere in computing literature.
-//
-//   - A JSON "object" refers to an unordered collection of name/value members.
-//   - A JSON "array" refers to an ordered sequence of elements.
-//   - A JSON "value" refers to either a literal (i.e., null, false, or true),
-//     string, number, object, or array.
-//
-// See RFC 8259 for more information.
-//
-// # Specifications
-//
-// Relevant specifications include RFC 4627, RFC 7159, RFC 7493, RFC 8259,
-// and RFC 8785. Each RFC is generally a stricter subset of another RFC.
-// In increasing order of strictness:
-//
-//   - RFC 4627 and RFC 7159 do not require (but recommend) the use of UTF-8
-//     and also do not require (but recommend) that object names be unique.
-//   - RFC 8259 requires the use of UTF-8,
-//     but does not require (but recommends) that object names be unique.
-//   - RFC 7493 requires the use of UTF-8
-//     and also requires that object names be unique.
-//   - RFC 8785 defines a canonical representation. It requires the use of UTF-8
-//     and also requires that object names be unique and in a specific ordering.
-//     It specifies exactly how strings and numbers must be formatted.
-//
-// The primary difference between RFC 4627 and RFC 7159 is that the former
-// restricted top-level values to only JSON objects and arrays, while
-// RFC 7159 and subsequent RFCs permit top-level values to additionally be
-// JSON nulls, booleans, strings, or numbers.
-//
-// By default, this package operates on RFC 7493, but can be configured
-// to operate according to the other RFC specifications.
-// RFC 7493 is a stricter subset of RFC 8259 and fully compliant with it.
-// In particular, it makes specific choices about behavior that RFC 8259
-// leaves as undefined in order to ensure greater interoperability.
+// [Marshal] and [Unmarshal] encode and decode Go values
+// to/from JSON text contained within a []byte.
+// [MarshalWrite] and [UnmarshalRead] operate on JSON text
+// by writing to or reading from an [io.Writer] or [io.Reader].
+// [MarshalEncode] and [UnmarshalDecode] operate on JSON text
+// by encoding to or decoding from a [jsontext.Encoder] or [jsontext.Decoder].
+// [Options] may be passed to each of the marshal or unmarshal functions
+// to configure the semantic behavior of marshaling and unmarshaling
+// (i.e., alter how JSON data is understood as Go data and vice versa).
+// [jsontext.Options] may also be passed to the marshal or unmarshal functions
+// to configure the syntactic behavior of encoding or decoding.
+//
+// The data types of JSON are mapped to/from the data types of Go based on
+// the closest logical equivalent between the two type systems. For example,
+// a JSON boolean corresponds with a Go bool,
+// a JSON string corresponds with a Go string,
+// a JSON number corresponds with a Go int, uint or float,
+// a JSON array corresponds with a Go slice or array, and
+// a JSON object corresponds with a Go struct or map.
+// See the documentation on [Marshal] and [Unmarshal] for a comprehensive list
+// of how the JSON and Go type systems correspond.
+//
+// Arbitrary Go types can customize their JSON representation by implementing
+// [Marshaler], [MarshalerTo], [Unmarshaler], or [UnmarshalerFrom].
+// This provides authors of Go types with control over how their types are
+// serialized as JSON. Alternatively, users can implement functions that match
+// [MarshalFunc], [MarshalToFunc], [UnmarshalFunc], or [UnmarshalFromFunc]
+// to specify the JSON representation for arbitrary types.
+// This provides callers of JSON functionality with control over
+// how any arbitrary type is serialized as JSON.
 //
 // # JSON Representation of Go structs
 //
@@ -68,12 +48,14 @@
 // into the corresponding Go struct fields.
 // Object members that do not match any struct fields,
 // also known as “unknown members”, are ignored by default or rejected
-// if UnmarshalOptions.RejectUnknownMembers is specified.
+// if [RejectUnknownMembers] is specified.
 //
 // The representation of each struct field can be customized in the
 // "json" struct field tag, where the tag is a comma separated list of options.
 // As a special case, if the entire tag is `json:"-"`,
 // then the field is ignored with regard to its JSON representation.
+// Some options also have equivalent behavior controlled by a caller-specified [Options].
+// Field-specified options take precedence over caller-specified options.
 //
 // The first option is the JSON object name override for the Go struct field.
 // If the name is not specified, then the Go struct field name
@@ -98,21 +80,23 @@
 //     encoded as a JSON null, empty string, empty object, or empty array.
 //     This option has no effect when unmarshaling.
 //
-//   - string: The "string" option specifies that
-//     MarshalOptions.StringifyNumbers and UnmarshalOptions.StringifyNumbers
+//   - string: The "string" option specifies that [StringifyNumbers]
 //     be set when marshaling or unmarshaling a struct field value.
 //     This causes numeric types to be encoded as a JSON number
-//     within a JSON string, and to be decoded from either a JSON number or
-//     a JSON string containing a JSON number.
+//     within a JSON string, and to be decoded from a JSON string
+//     containing the JSON number without any surrounding whitespace.
 //     This extra level of encoding is often necessary since
 //     many JSON parsers cannot precisely represent 64-bit integers.
 //
-//   - nocase: When unmarshaling, the "nocase" option specifies that
-//     if the JSON object name does not exactly match the JSON name
-//     for any of the struct fields, then it attempts to match the struct field
-//     using a case-insensitive match that also ignores dashes and underscores.
-//     If multiple fields match, the first declared field in breadth-first order
-//     takes precedence. This option has no effect when marshaling.
+//   - case: When unmarshaling, the "case" option specifies how
+//     JSON object names are matched with the JSON name for Go struct fields.
+//     The option is a key-value pair specified as "case:value" where
+//     the value must either be 'ignore' or 'strict'.
+//     The 'ignore' value specifies that matching is case-insensitive
+//     where dashes and underscores are also ignored. If multiple fields match,
+//     the first declared field in breadth-first order takes precedence.
+//     The 'strict' value specifies that matching is case-sensitive.
+//     This takes precedence over the [MatchCaseInsensitiveNames] option.
 //
 //   - inline: The "inline" option specifies that
 //     the JSON representable content of this field type is to be promoted
@@ -120,10 +104,10 @@
 //     It is the JSON equivalent of Go struct embedding.
 //     A Go embedded field is implicitly inlined unless an explicit JSON name
 //     is specified. The inlined field must be a Go struct
-//     (that does not implement any JSON methods), RawValue, map[string]T,
-//     or an unnamed pointer to such types. When marshaling,
+//     (that does not implement any JSON methods), [jsontext.Value],
+//     map[~string]T, or an unnamed pointer to such types. When marshaling,
 //     inlined fields from a pointer type are omitted if it is nil.
-//     Inlined fields of type RawValue and map[string]T are called
+//     Inlined fields of type [jsontext.Value] and map[~string]T are called
 //     “inlined fallbacks” as they can represent all possible
 //     JSON object members not directly handled by the parent struct.
 //     Only one inlined fallback field may be specified in a struct,
@@ -132,11 +116,11 @@
 //
 //   - unknown: The "unknown" option is a specialized variant
 //     of the inlined fallback to indicate that this Go struct field
-//     contains any number of unknown JSON object members. The field type
-//     must be a RawValue, map[string]T, or an unnamed pointer to such types.
-//     If MarshalOptions.DiscardUnknownMembers is specified when marshaling,
+//     contains any number of unknown JSON object members. The field type must
+//     be a [jsontext.Value], map[~string]T, or an unnamed pointer to such types.
+//     If [DiscardUnknownMembers] is specified when marshaling,
 //     the contents of this field are ignored.
-//     If UnmarshalOptions.RejectUnknownMembers is specified when unmarshaling,
+//     If [RejectUnknownMembers] is specified when unmarshaling,
 //     any unknown object members are rejected regardless of whether
 //     an inlined fallback with the "unknown" option exists. This option
 //     must not be specified with any other option (including the JSON name).
@@ -156,7 +140,7 @@
 // For example, only a nil slice or map is omitted under "omitzero", while
 // an empty slice or map is omitted under "omitempty" regardless of nilness.
 // The "omitzero" option is useful for types with a well-defined zero value
-// (e.g., netip.Addr) or have an IsZero method (e.g., time.Time).
+// (e.g., [net/netip.Addr]) or have an IsZero method (e.g., [time.Time.IsZero]).
 //
 // Every Go struct corresponds to a list of JSON representable fields
 // which is constructed by performing a breadth-first search over
@@ -167,12 +151,108 @@
 // at shallowest depth takes precedence and the other fields at deeper depths
 // are excluded from the list of JSON representable fields.
 // If multiple fields at the shallowest depth have the same JSON name,
-// then all of those fields are excluded from the list. This is analogous to
-// Go visibility rules for struct field selection with embedded struct types.
+// but exactly one is explicitly tagged with a JSON name,
+// then that field takes precedence and all others are excluded from the list.
+// This is analogous to Go visibility rules for struct field selection
+// with embedded struct types.
 //
 // Marshaling or unmarshaling a non-empty struct
-// without any JSON representable fields results in a SemanticError.
+// without any JSON representable fields results in a [SemanticError].
 // Unexported fields must not have any `json` tags except for `json:"-"`.
+//
+// # Security Considerations
+//
+// JSON is frequently used as a data interchange format to communicate
+// between different systems, possibly implemented in different languages.
+// For interoperability and security reasons, it is important that
+// all implementations agree upon the semantic meaning of the data.
+//
+// [For example, suppose we have two micro-services.]
+// The first service is responsible for authenticating a JSON request,
+// while the second service is responsible for executing the request
+// (having assumed that the prior service authenticated the request).
+// If an attacker were able to maliciously craft a JSON request such that
+// both services believe that the same request is from different users,
+// it could bypass the authenticator with valid credentials for one user,
+// but maliciously perform an action on behalf of a different user.
+//
+// According to RFC 8259, there unfortunately exist many JSON texts
+// that are syntactically valid but semantically ambiguous.
+// For example, the standard does not define how to interpret duplicate
+// names within an object.
+//
+// The v1 [encoding/json] and [encoding/json/v2] packages
+// interpret some inputs in different ways. In particular:
+//
+//   - The standard specifies that JSON must be encoded using UTF-8.
+//     By default, v1 replaces invalid bytes of UTF-8 in JSON strings
+//     with the Unicode replacement character,
+//     while v2 rejects inputs with invalid UTF-8.
+//     To change the default, specify the [jsontext.AllowInvalidUTF8] option.
+//     The replacement of invalid UTF-8 is a form of data corruption
+//     that alters the precise meaning of strings.
+//
+//   - The standard does not specify a particular behavior when
+//     duplicate names are encountered within a JSON object,
+//     which means that different implementations may behave differently.
+//     By default, v1 allows for the presence of duplicate names,
+//     while v2 rejects duplicate names.
+//     To change the default, specify the [jsontext.AllowDuplicateNames] option.
+//     If allowed, object members are processed in the order they are observed,
+//     meaning that later values will replace or be merged into prior values,
+//     depending on the Go value type.
+//
+//   - The standard defines a JSON object as an unordered collection of name/value pairs.
+//     While ordering can be observed through the underlying [jsontext] API,
+//     both v1 and v2 generally avoid exposing the ordering.
+//     No application should semantically depend on the order of object members.
+//     Allowing duplicate names is a vector through which ordering of members
+//     can accidentally be observed and depended upon.
+//
+//   - The standard suggests that JSON object names are typically compared
+//     based on equality of the sequence of Unicode code points,
+//     which implies that comparing names is often case-sensitive.
+//     When unmarshaling a JSON object into a Go struct,
+//     by default, v1 uses a (loose) case-insensitive match on the name,
+//     while v2 uses a (strict) case-sensitive match on the name.
+//     To change the default, specify the [MatchCaseInsensitiveNames] option.
+//     The use of case-insensitive matching provides another vector through
+//     which duplicate names can occur. Allowing case-insensitive matching
+//     means that v1 or v2 might interpret JSON objects differently from most
+//     other JSON implementations (which typically use a case-sensitive match).
+//
+//   - The standard does not specify a particular behavior when
+//     an unknown name in a JSON object is encountered.
+//     When unmarshaling a JSON object into a Go struct, by default
+//     both v1 and v2 ignore unknown names and their corresponding values.
+//     To change the default, specify the [RejectUnknownMembers] option.
+//
+//   - The standard suggests that implementations may use a float64
+//     to represent a JSON number. Consequently, large JSON integers
+//     may lose precision when stored as a floating-point type.
+//     Both v1 and v2 correctly preserve precision when marshaling and
+//     unmarshaling a concrete integer type. However, even if v1 and v2
+//     preserve precision for concrete types, other JSON implementations
+//     may not be able to preserve precision for outputs produced by v1 or v2.
+//     The `string` tag option can be used to specify that an integer type
+//     is to be quoted within a JSON string to avoid loss of precision.
+//     Furthermore, v1 and v2 may still lose precision when unmarshaling
+//     into an any interface value, where unmarshal uses a float64
+//     by default to represent a JSON number.
+//     To change the default, specify the [WithUnmarshalers] option
+//     with a custom unmarshaler that pre-populates the interface value
+//     with a concrete Go type that can preserve precision.
+//
+// RFC 8785 specifies a canonical form for any JSON text,
+// which explicitly defines specific behaviors that RFC 8259 leaves undefined.
+// In theory, if a text can successfully [jsontext.Value.Canonicalize]
+// without changing the semantic meaning of the data, then it provides a
+// greater degree of confidence that the data is more secure and interoperable.
+//
+// The v2 API generally chooses more secure defaults than v1,
+// but care should still be taken with large integers or unknown members.
+//
+// [For example, suppose we have two micro-services.]: https://www.youtube.com/watch?v=avilmOcHKHE&t=1057s
 package json
 
 // requireKeyedLiterals can be embedded in a struct to require keyed literals.
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/encode.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/encode.go
deleted file mode 100644
index 5b81ca15af..0000000000
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/encode.go
+++ /dev/null
@@ -1,1170 +0,0 @@
-// Copyright 2020 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package json
-
-import (
-	"bytes"
-	"io"
-	"math"
-	"math/bits"
-	"strconv"
-	"unicode/utf16"
-	"unicode/utf8"
-)
-
-// EncodeOptions configures how JSON encoding operates.
-// The zero value is equivalent to the default settings,
-// which is compliant with both RFC 7493 and RFC 8259.
-type EncodeOptions struct {
-	requireKeyedLiterals
-	nonComparable
-
-	// multiline specifies whether the encoder should emit multiline output.
-	multiline bool
-
-	// omitTopLevelNewline specifies whether to omit the newline
-	// that is appended after every top-level JSON value when streaming.
-	omitTopLevelNewline bool
-
-	// AllowDuplicateNames specifies that JSON objects may contain
-	// duplicate member names. Disabling the duplicate name check may provide
-	// performance benefits, but breaks compliance with RFC 7493, section 2.3.
-	// The output will still be compliant with RFC 8259,
-	// which leaves the handling of duplicate names as unspecified behavior.
-	AllowDuplicateNames bool
-
-	// AllowInvalidUTF8 specifies that JSON strings may contain invalid UTF-8,
-	// which will be mangled as the Unicode replacement character, U+FFFD.
-	// This causes the encoder to break compliance with
-	// RFC 7493, section 2.1, and RFC 8259, section 8.1.
-	AllowInvalidUTF8 bool
-
-	// preserveRawStrings specifies that WriteToken and WriteValue should not
-	// reformat any JSON string, but keep the formatting verbatim.
-	preserveRawStrings bool
-
-	// canonicalizeNumbers specifies that WriteToken and WriteValue should
-	// reformat any JSON numbers according to RFC 8785, section 3.2.2.3.
-	canonicalizeNumbers bool
-
-	// EscapeRune reports whether the provided character should be escaped
-	// as a hexadecimal Unicode codepoint (e.g., \ufffd).
-	// If nil, the shortest and simplest encoding will be used,
-	// which is also the formatting specified by RFC 8785, section 3.2.2.2.
-	EscapeRune func(rune) bool
-
-	// Indent (if non-empty) specifies that the encoder should emit multiline
-	// output where each element in a JSON object or array begins on a new,
-	// indented line beginning with the indent prefix followed by one or more
-	// copies of indent according to the indentation nesting.
-	// It may only be composed of space or tab characters.
-	Indent string
-
-	// IndentPrefix is prepended to each line within a JSON object or array.
-	// The purpose of the indent prefix is to encode data that can more easily
-	// be embedded inside other formatted JSON data.
-	// It may only be composed of space or tab characters.
-	// It is ignored if Indent is empty.
-	IndentPrefix string
-}
-
-// Encoder is a streaming encoder from raw JSON tokens and values.
-// It is used to write a stream of top-level JSON values,
-// each terminated with a newline character.
-//
-// WriteToken and WriteValue calls may be interleaved.
-// For example, the following JSON value:
-//
-//	{"name":"value","array":[null,false,true,3.14159],"object":{"k":"v"}}
-//
-// can be composed with the following calls (ignoring errors for brevity):
-//
-//	e.WriteToken(ObjectStart)           // {
-//	e.WriteToken(String("name"))        // "name"
-//	e.WriteToken(String("value"))       // "value"
-//	e.WriteValue(RawValue(`"array"`))   // "array"
-//	e.WriteToken(ArrayStart)            // [
-//	e.WriteToken(Null)                  // null
-//	e.WriteToken(False)                 // false
-//	e.WriteValue(RawValue("true"))      // true
-//	e.WriteToken(Float(3.14159))        // 3.14159
-//	e.WriteToken(ArrayEnd)              // ]
-//	e.WriteValue(RawValue(`"object"`))  // "object"
-//	e.WriteValue(RawValue(`{"k":"v"}`)) // {"k":"v"}
-//	e.WriteToken(ObjectEnd)             // }
-//
-// The above is one of many possible sequence of calls and
-// may not represent the most sensible method to call for any given token/value.
-// For example, it is probably more common to call WriteToken with a string
-// for object names.
-type Encoder struct {
-	state
-	encodeBuffer
-	options EncodeOptions
-
-	seenPointers seenPointers // only used when marshaling
-}
-
-// encodeBuffer is a buffer split into 2 segments:
-//
-//   - buf[0:len(buf)]        // written (but unflushed) portion of the buffer
-//   - buf[len(buf):cap(buf)] // unused portion of the buffer
-type encodeBuffer struct {
-	buf []byte // may alias wr if it is a bytes.Buffer
-
-	// baseOffset is added to len(buf) to obtain the absolute offset
-	// relative to the start of io.Writer stream.
-	baseOffset int64
-
-	wr io.Writer
-
-	// maxValue is the approximate maximum RawValue size passed to WriteValue.
-	maxValue int
-	// unusedCache is the buffer returned by the UnusedBuffer method.
-	unusedCache []byte
-	// bufStats is statistics about buffer utilization.
-	// It is only used with pooled encoders in pools.go.
-	bufStats bufferStatistics
-}
-
-// NewEncoder constructs a new streaming encoder writing to w.
-func NewEncoder(w io.Writer) *Encoder {
-	return EncodeOptions{}.NewEncoder(w)
-}
-
-// NewEncoder constructs a new streaming encoder writing to w
-// configured with the provided options.
-// It flushes the internal buffer when the buffer is sufficiently full or
-// when a top-level value has been written.
-//
-// If w is a bytes.Buffer, then the encoder appends directly into the buffer
-// without copying the contents from an intermediate buffer.
-func (o EncodeOptions) NewEncoder(w io.Writer) *Encoder {
-	e := new(Encoder)
-	o.ResetEncoder(e, w)
-	return e
-}
-
-// ResetEncoder resets an encoder such that it is writing afresh to w and
-// configured with the provided options.
-func (o EncodeOptions) ResetEncoder(e *Encoder, w io.Writer) {
-	if e == nil {
-		panic("json: invalid nil Encoder")
-	}
-	if w == nil {
-		panic("json: invalid nil io.Writer")
-	}
-	e.reset(nil, w, o)
-}
-
-func (e *Encoder) reset(b []byte, w io.Writer, o EncodeOptions) {
-	if len(o.Indent) > 0 {
-		o.multiline = true
-		if s := trimLeftSpaceTab(o.IndentPrefix); len(s) > 0 {
-			panic("json: invalid character " + quoteRune([]byte(s)) + " in indent prefix")
-		}
-		if s := trimLeftSpaceTab(o.Indent); len(s) > 0 {
-			panic("json: invalid character " + quoteRune([]byte(s)) + " in indent")
-		}
-	}
-	e.state.reset()
-	e.encodeBuffer = encodeBuffer{buf: b, wr: w, bufStats: e.bufStats}
-	e.options = o
-	if bb, ok := w.(*bytes.Buffer); ok && bb != nil {
-		e.buf = bb.Bytes()[bb.Len():] // alias the unused buffer of bb
-	}
-}
-
-// Reset resets an encoder such that it is writing afresh to w but
-// keeps any pre-existing encoder options.
-func (e *Encoder) Reset(w io.Writer) {
-	e.options.ResetEncoder(e, w)
-}
-
-// needFlush determines whether to flush at this point.
-func (e *Encoder) needFlush() bool {
-	// NOTE: This function is carefully written to be inlineable.
-
-	// Avoid flushing if e.wr is nil since there is no underlying writer.
-	// Flush if less than 25% of the capacity remains.
-	// Flushing at some constant fraction ensures that the buffer stops growing
-	// so long as the largest Token or Value fits within that unused capacity.
-	return e.wr != nil && (e.tokens.depth() == 1 || len(e.buf) > 3*cap(e.buf)/4)
-}
-
-// flush flushes the buffer to the underlying io.Writer.
-// It may append a trailing newline after the top-level value.
-func (e *Encoder) flush() error {
-	if e.wr == nil || e.avoidFlush() {
-		return nil
-	}
-
-	// In streaming mode, always emit a newline after the top-level value.
-	if e.tokens.depth() == 1 && !e.options.omitTopLevelNewline {
-		e.buf = append(e.buf, '\n')
-	}
-
-	// Inform objectNameStack that we are about to flush the buffer content.
-	e.names.copyQuotedBuffer(e.buf)
-
-	// Specialize bytes.Buffer for better performance.
-	if bb, ok := e.wr.(*bytes.Buffer); ok {
-		// If e.buf already aliases the internal buffer of bb,
-		// then the Write call simply increments the internal offset,
-		// otherwise Write operates as expected.
-		// See https://go.dev/issue/42986.
-		n, _ := bb.Write(e.buf) // never fails unless bb is nil
-		e.baseOffset += int64(n)
-
-		// If the internal buffer of bytes.Buffer is too small,
-		// append operations elsewhere in the Encoder may grow the buffer.
-		// This would be semantically correct, but hurts performance.
-		// As such, ensure 25% of the current length is always available
-		// to reduce the probability that other appends must allocate.
-		if avail := bb.Cap() - bb.Len(); avail < bb.Len()/4 {
-			bb.Grow(avail + 1)
-		}
-
-		e.buf = bb.Bytes()[bb.Len():] // alias the unused buffer of bb
-		return nil
-	}
-
-	// Flush the internal buffer to the underlying io.Writer.
-	n, err := e.wr.Write(e.buf)
-	e.baseOffset += int64(n)
-	if err != nil {
-		// In the event of an error, preserve the unflushed portion.
-		// Thus, write errors aren't fatal so long as the io.Writer
-		// maintains consistent state after errors.
-		if n > 0 {
-			e.buf = e.buf[:copy(e.buf, e.buf[n:])]
-		}
-		return &ioError{action: "write", err: err}
-	}
-	e.buf = e.buf[:0]
-
-	// Check whether to grow the buffer.
-	// Note that cap(e.buf) may already exceed maxBufferSize since
-	// an append elsewhere already grew it to store a large token.
-	const maxBufferSize = 4 << 10
-	const growthSizeFactor = 2 // higher value is faster
-	const growthRateFactor = 2 // higher value is slower
-	// By default, grow if below the maximum buffer size.
-	grow := cap(e.buf) <= maxBufferSize/growthSizeFactor
-	// Growing can be expensive, so only grow
-	// if a sufficient number of bytes have been processed.
-	grow = grow && int64(cap(e.buf)) < e.previousOffsetEnd()/growthRateFactor
-	if grow {
-		e.buf = make([]byte, 0, cap(e.buf)*growthSizeFactor)
-	}
-
-	return nil
-}
-
-func (e *encodeBuffer) previousOffsetEnd() int64 { return e.baseOffset + int64(len(e.buf)) }
-func (e *encodeBuffer) unflushedBuffer() []byte  { return e.buf }
-
-// avoidFlush indicates whether to avoid flushing to ensure there is always
-// enough in the buffer to unwrite the last object member if it were empty.
-func (e *Encoder) avoidFlush() bool {
-	switch {
-	case e.tokens.last.length() == 0:
-		// Never flush after ObjectStart or ArrayStart since we don't know yet
-		// if the object or array will end up being empty.
-		return true
-	case e.tokens.last.needObjectValue():
-		// Never flush before the object value since we don't know yet
-		// if the object value will end up being empty.
-		return true
-	case e.tokens.last.needObjectName() && len(e.buf) >= 2:
-		// Never flush after the object value if it does turn out to be empty.
-		switch string(e.buf[len(e.buf)-2:]) {
-		case `ll`, `""`, `{}`, `[]`: // last two bytes of every empty value
-			return true
-		}
-	}
-	return false
-}
-
-// unwriteEmptyObjectMember unwrites the last object member if it is empty
-// and reports whether it performed an unwrite operation.
-func (e *Encoder) unwriteEmptyObjectMember(prevName *string) bool {
-	if last := e.tokens.last; !last.isObject() || !last.needObjectName() || last.length() == 0 {
-		panic("BUG: must be called on an object after writing a value")
-	}
-
-	// The flushing logic is modified to never flush a trailing empty value.
-	// The encoder never writes trailing whitespace eagerly.
-	b := e.unflushedBuffer()
-
-	// Detect whether the last value was empty.
-	var n int
-	if len(b) >= 3 {
-		switch string(b[len(b)-2:]) {
-		case "ll": // last two bytes of `null`
-			n = len(`null`)
-		case `""`:
-			// It is possible for a non-empty string to have `""` as a suffix
-			// if the second to the last quote was escaped.
-			if b[len(b)-3] == '\\' {
-				return false // e.g., `"\""` is not empty
-			}
-			n = len(`""`)
-		case `{}`:
-			n = len(`{}`)
-		case `[]`:
-			n = len(`[]`)
-		}
-	}
-	if n == 0 {
-		return false
-	}
-
-	// Unwrite the value, whitespace, colon, name, whitespace, and comma.
-	b = b[:len(b)-n]
-	b = trimSuffixWhitespace(b)
-	b = trimSuffixByte(b, ':')
-	b = trimSuffixString(b)
-	b = trimSuffixWhitespace(b)
-	b = trimSuffixByte(b, ',')
-	e.buf = b // store back truncated unflushed buffer
-
-	// Undo state changes.
-	e.tokens.last.decrement() // for object member value
-	e.tokens.last.decrement() // for object member name
-	if !e.options.AllowDuplicateNames {
-		if e.tokens.last.isActiveNamespace() {
-			e.namespaces.last().removeLast()
-		}
-		e.names.clearLast()
-		if prevName != nil {
-			e.names.copyQuotedBuffer(e.buf) // required by objectNameStack.replaceLastUnquotedName
-			e.names.replaceLastUnquotedName(*prevName)
-		}
-	}
-	return true
-}
-
-// unwriteOnlyObjectMemberName unwrites the only object member name
-// and returns the unquoted name.
-func (e *Encoder) unwriteOnlyObjectMemberName() string {
-	if last := e.tokens.last; !last.isObject() || last.length() != 1 {
-		panic("BUG: must be called on an object after writing first name")
-	}
-
-	// Unwrite the name and whitespace.
-	b := trimSuffixString(e.buf)
-	isVerbatim := bytes.IndexByte(e.buf[len(b):], '\\') < 0
-	name := string(unescapeStringMayCopy(e.buf[len(b):], isVerbatim))
-	e.buf = trimSuffixWhitespace(b)
-
-	// Undo state changes.
-	e.tokens.last.decrement()
-	if !e.options.AllowDuplicateNames {
-		if e.tokens.last.isActiveNamespace() {
-			e.namespaces.last().removeLast()
-		}
-		e.names.clearLast()
-	}
-	return name
-}
-
-func trimSuffixWhitespace(b []byte) []byte {
-	// NOTE: The arguments and logic are kept simple to keep this inlineable.
-	n := len(b) - 1
-	for n >= 0 && (b[n] == ' ' || b[n] == '\t' || b[n] == '\r' || b[n] == '\n') {
-		n--
-	}
-	return b[:n+1]
-}
-
-func trimSuffixString(b []byte) []byte {
-	// NOTE: The arguments and logic are kept simple to keep this inlineable.
-	if len(b) > 0 && b[len(b)-1] == '"' {
-		b = b[:len(b)-1]
-	}
-	for len(b) >= 2 && !(b[len(b)-1] == '"' && b[len(b)-2] != '\\') {
-		b = b[:len(b)-1] // trim all characters except an unescaped quote
-	}
-	if len(b) > 0 && b[len(b)-1] == '"' {
-		b = b[:len(b)-1]
-	}
-	return b
-}
-
-func hasSuffixByte(b []byte, c byte) bool {
-	// NOTE: The arguments and logic are kept simple to keep this inlineable.
-	return len(b) > 0 && b[len(b)-1] == c
-}
-
-func trimSuffixByte(b []byte, c byte) []byte {
-	// NOTE: The arguments and logic are kept simple to keep this inlineable.
-	if len(b) > 0 && b[len(b)-1] == c {
-		return b[:len(b)-1]
-	}
-	return b
-}
-
-// WriteToken writes the next token and advances the internal write offset.
-//
-// The provided token kind must be consistent with the JSON grammar.
-// For example, it is an error to provide a number when the encoder
-// is expecting an object name (which is always a string), or
-// to provide an end object delimiter when the encoder is finishing an array.
-// If the provided token is invalid, then it reports a SyntacticError and
-// the internal state remains unchanged.
-func (e *Encoder) WriteToken(t Token) error {
-	k := t.Kind()
-	b := e.buf // use local variable to avoid mutating e in case of error
-
-	// Append any delimiters or optional whitespace.
-	b = e.tokens.mayAppendDelim(b, k)
-	if e.options.multiline {
-		b = e.appendWhitespace(b, k)
-	}
-
-	// Append the token to the output and to the state machine.
-	var err error
-	switch k {
-	case 'n':
-		b = append(b, "null"...)
-		err = e.tokens.appendLiteral()
-	case 'f':
-		b = append(b, "false"...)
-		err = e.tokens.appendLiteral()
-	case 't':
-		b = append(b, "true"...)
-		err = e.tokens.appendLiteral()
-	case '"':
-		n0 := len(b) // offset before calling t.appendString
-		if b, err = t.appendString(b, !e.options.AllowInvalidUTF8, e.options.preserveRawStrings, e.options.EscapeRune); err != nil {
-			break
-		}
-		if !e.options.AllowDuplicateNames && e.tokens.last.needObjectName() {
-			if !e.tokens.last.isValidNamespace() {
-				err = errInvalidNamespace
-				break
-			}
-			if e.tokens.last.isActiveNamespace() && !e.namespaces.last().insertQuoted(b[n0:], false) {
-				err = &SyntacticError{str: "duplicate name " + string(b[n0:]) + " in object"}
-				break
-			}
-			e.names.replaceLastQuotedOffset(n0) // only replace if insertQuoted succeeds
-		}
-		err = e.tokens.appendString()
-	case '0':
-		if b, err = t.appendNumber(b, e.options.canonicalizeNumbers); err != nil {
-			break
-		}
-		err = e.tokens.appendNumber()
-	case '{':
-		b = append(b, '{')
-		if err = e.tokens.pushObject(); err != nil {
-			break
-		}
-		if !e.options.AllowDuplicateNames {
-			e.names.push()
-			e.namespaces.push()
-		}
-	case '}':
-		b = append(b, '}')
-		if err = e.tokens.popObject(); err != nil {
-			break
-		}
-		if !e.options.AllowDuplicateNames {
-			e.names.pop()
-			e.namespaces.pop()
-		}
-	case '[':
-		b = append(b, '[')
-		err = e.tokens.pushArray()
-	case ']':
-		b = append(b, ']')
-		err = e.tokens.popArray()
-	default:
-		return &SyntacticError{str: "invalid json.Token"}
-	}
-	if err != nil {
-		return err
-	}
-
-	// Finish off the buffer and store it back into e.
-	e.buf = b
-	if e.needFlush() {
-		return e.flush()
-	}
-	return nil
-}
-
-const (
-	rawIntNumber  = -1
-	rawUintNumber = -2
-)
-
-// writeNumber is specialized version of WriteToken, but optimized for numbers.
-// As a special-case, if bits is -1 or -2, it will treat v as
-// the raw-encoded bits of an int64 or uint64, respectively.
-// It is only called from arshal_default.go.
-func (e *Encoder) writeNumber(v float64, bits int, quote bool) error {
-	b := e.buf // use local variable to avoid mutating e in case of error
-
-	// Append any delimiters or optional whitespace.
-	b = e.tokens.mayAppendDelim(b, '0')
-	if e.options.multiline {
-		b = e.appendWhitespace(b, '0')
-	}
-
-	if quote {
-		// Append the value to the output.
-		n0 := len(b) // offset before appending the number
-		b = append(b, '"')
-		switch bits {
-		case rawIntNumber:
-			b = strconv.AppendInt(b, int64(math.Float64bits(v)), 10)
-		case rawUintNumber:
-			b = strconv.AppendUint(b, uint64(math.Float64bits(v)), 10)
-		default:
-			b = appendNumber(b, v, bits)
-		}
-		b = append(b, '"')
-
-		// Escape the string if necessary.
-		if e.options.EscapeRune != nil {
-			b2 := append(e.unusedCache, b[n0+len(`"`):len(b)-len(`"`)]...)
-			b, _ = appendString(b[:n0], string(b2), false, e.options.EscapeRune)
-			e.unusedCache = b2[:0]
-		}
-
-		// Update the state machine.
-		if !e.options.AllowDuplicateNames && e.tokens.last.needObjectName() {
-			if !e.tokens.last.isValidNamespace() {
-				return errInvalidNamespace
-			}
-			if e.tokens.last.isActiveNamespace() && !e.namespaces.last().insertQuoted(b[n0:], false) {
-				return &SyntacticError{str: "duplicate name " + string(b[n0:]) + " in object"}
-			}
-			e.names.replaceLastQuotedOffset(n0) // only replace if insertQuoted succeeds
-		}
-		if err := e.tokens.appendString(); err != nil {
-			return err
-		}
-	} else {
-		switch bits {
-		case rawIntNumber:
-			b = strconv.AppendInt(b, int64(math.Float64bits(v)), 10)
-		case rawUintNumber:
-			b = strconv.AppendUint(b, uint64(math.Float64bits(v)), 10)
-		default:
-			b = appendNumber(b, v, bits)
-		}
-		if err := e.tokens.appendNumber(); err != nil {
-			return err
-		}
-	}
-
-	// Finish off the buffer and store it back into e.
-	e.buf = b
-	if e.needFlush() {
-		return e.flush()
-	}
-	return nil
-}
-
-// WriteValue writes the next raw value and advances the internal write offset.
-// The Encoder does not simply copy the provided value verbatim, but
-// parses it to ensure that it is syntactically valid and reformats it
-// according to how the Encoder is configured to format whitespace and strings.
-//
-// The provided value kind must be consistent with the JSON grammar
-// (see examples on Encoder.WriteToken). If the provided value is invalid,
-// then it reports a SyntacticError and the internal state remains unchanged.
-func (e *Encoder) WriteValue(v RawValue) error {
-	e.maxValue |= len(v) // bitwise OR is a fast approximation of max
-
-	k := v.Kind()
-	b := e.buf // use local variable to avoid mutating e in case of error
-
-	// Append any delimiters or optional whitespace.
-	b = e.tokens.mayAppendDelim(b, k)
-	if e.options.multiline {
-		b = e.appendWhitespace(b, k)
-	}
-
-	// Append the value the output.
-	var err error
-	v = v[consumeWhitespace(v):]
-	n0 := len(b) // offset before calling e.reformatValue
-	b, v, err = e.reformatValue(b, v, e.tokens.depth())
-	if err != nil {
-		return err
-	}
-	v = v[consumeWhitespace(v):]
-	if len(v) > 0 {
-		return newInvalidCharacterError(v[0:], "after top-level value")
-	}
-
-	// Append the kind to the state machine.
-	switch k {
-	case 'n', 'f', 't':
-		err = e.tokens.appendLiteral()
-	case '"':
-		if !e.options.AllowDuplicateNames && e.tokens.last.needObjectName() {
-			if !e.tokens.last.isValidNamespace() {
-				err = errInvalidNamespace
-				break
-			}
-			if e.tokens.last.isActiveNamespace() && !e.namespaces.last().insertQuoted(b[n0:], false) {
-				err = &SyntacticError{str: "duplicate name " + string(b[n0:]) + " in object"}
-				break
-			}
-			e.names.replaceLastQuotedOffset(n0) // only replace if insertQuoted succeeds
-		}
-		err = e.tokens.appendString()
-	case '0':
-		err = e.tokens.appendNumber()
-	case '{':
-		if err = e.tokens.pushObject(); err != nil {
-			break
-		}
-		if err = e.tokens.popObject(); err != nil {
-			panic("BUG: popObject should never fail immediately after pushObject: " + err.Error())
-		}
-	case '[':
-		if err = e.tokens.pushArray(); err != nil {
-			break
-		}
-		if err = e.tokens.popArray(); err != nil {
-			panic("BUG: popArray should never fail immediately after pushArray: " + err.Error())
-		}
-	}
-	if err != nil {
-		return err
-	}
-
-	// Finish off the buffer and store it back into e.
-	e.buf = b
-	if e.needFlush() {
-		return e.flush()
-	}
-	return nil
-}
-
-// appendWhitespace appends whitespace that immediately precedes the next token.
-func (e *Encoder) appendWhitespace(b []byte, next Kind) []byte {
-	if e.tokens.needDelim(next) == ':' {
-		return append(b, ' ')
-	} else {
-		return e.appendIndent(b, e.tokens.needIndent(next))
-	}
-}
-
-// appendIndent appends the appropriate number of indentation characters
-// for the current nested level, n.
-func (e *Encoder) appendIndent(b []byte, n int) []byte {
-	if n == 0 {
-		return b
-	}
-	b = append(b, '\n')
-	b = append(b, e.options.IndentPrefix...)
-	for ; n > 1; n-- {
-		b = append(b, e.options.Indent...)
-	}
-	return b
-}
-
-// reformatValue parses a JSON value from the start of src and
-// appends it to the end of dst, reformatting whitespace and strings as needed.
-// It returns the updated versions of dst and src.
-func (e *Encoder) reformatValue(dst []byte, src RawValue, depth int) ([]byte, RawValue, error) {
-	// TODO: Should this update valueFlags as input?
-	if len(src) == 0 {
-		return dst, src, io.ErrUnexpectedEOF
-	}
-	var n int
-	var err error
-	switch k := Kind(src[0]).normalize(); k {
-	case 'n':
-		if n = consumeNull(src); n == 0 {
-			n, err = consumeLiteral(src, "null")
-		}
-	case 'f':
-		if n = consumeFalse(src); n == 0 {
-			n, err = consumeLiteral(src, "false")
-		}
-	case 't':
-		if n = consumeTrue(src); n == 0 {
-			n, err = consumeLiteral(src, "true")
-		}
-	case '"':
-		if n := consumeSimpleString(src); n > 0 && e.options.EscapeRune == nil {
-			dst, src = append(dst, src[:n]...), src[n:] // copy simple strings verbatim
-			return dst, src, nil
-		}
-		return reformatString(dst, src, !e.options.AllowInvalidUTF8, e.options.preserveRawStrings, e.options.EscapeRune)
-	case '0':
-		if n := consumeSimpleNumber(src); n > 0 && !e.options.canonicalizeNumbers {
-			dst, src = append(dst, src[:n]...), src[n:] // copy simple numbers verbatim
-			return dst, src, nil
-		}
-		return reformatNumber(dst, src, e.options.canonicalizeNumbers)
-	case '{':
-		return e.reformatObject(dst, src, depth)
-	case '[':
-		return e.reformatArray(dst, src, depth)
-	default:
-		return dst, src, newInvalidCharacterError(src, "at start of value")
-	}
-	if err != nil {
-		return dst, src, err
-	}
-	dst, src = append(dst, src[:n]...), src[n:]
-	return dst, src, nil
-}
-
-// reformatObject parses a JSON object from the start of src and
-// appends it to the end of src, reformatting whitespace and strings as needed.
-// It returns the updated versions of dst and src.
-func (e *Encoder) reformatObject(dst []byte, src RawValue, depth int) ([]byte, RawValue, error) {
-	// Append object start.
-	if src[0] != '{' {
-		panic("BUG: reformatObject must be called with a buffer that starts with '{'")
-	}
-	dst, src = append(dst, '{'), src[1:]
-
-	// Append (possible) object end.
-	src = src[consumeWhitespace(src):]
-	if len(src) == 0 {
-		return dst, src, io.ErrUnexpectedEOF
-	}
-	if src[0] == '}' {
-		dst, src = append(dst, '}'), src[1:]
-		return dst, src, nil
-	}
-
-	var err error
-	var names *objectNamespace
-	if !e.options.AllowDuplicateNames {
-		e.namespaces.push()
-		defer e.namespaces.pop()
-		names = e.namespaces.last()
-	}
-	depth++
-	for {
-		// Append optional newline and indentation.
-		if e.options.multiline {
-			dst = e.appendIndent(dst, depth)
-		}
-
-		// Append object name.
-		src = src[consumeWhitespace(src):]
-		if len(src) == 0 {
-			return dst, src, io.ErrUnexpectedEOF
-		}
-		n0 := len(dst) // offset before calling reformatString
-		n := consumeSimpleString(src)
-		if n > 0 && e.options.EscapeRune == nil {
-			dst, src = append(dst, src[:n]...), src[n:] // copy simple strings verbatim
-		} else {
-			dst, src, err = reformatString(dst, src, !e.options.AllowInvalidUTF8, e.options.preserveRawStrings, e.options.EscapeRune)
-		}
-		if err != nil {
-			return dst, src, err
-		}
-		if !e.options.AllowDuplicateNames && !names.insertQuoted(dst[n0:], false) {
-			return dst, src, &SyntacticError{str: "duplicate name " + string(dst[n0:]) + " in object"}
-		}
-
-		// Append colon.
-		src = src[consumeWhitespace(src):]
-		if len(src) == 0 {
-			return dst, src, io.ErrUnexpectedEOF
-		}
-		if src[0] != ':' {
-			return dst, src, newInvalidCharacterError(src, "after object name (expecting ':')")
-		}
-		dst, src = append(dst, ':'), src[1:]
-		if e.options.multiline {
-			dst = append(dst, ' ')
-		}
-
-		// Append object value.
-		src = src[consumeWhitespace(src):]
-		if len(src) == 0 {
-			return dst, src, io.ErrUnexpectedEOF
-		}
-		dst, src, err = e.reformatValue(dst, src, depth)
-		if err != nil {
-			return dst, src, err
-		}
-
-		// Append comma or object end.
-		src = src[consumeWhitespace(src):]
-		if len(src) == 0 {
-			return dst, src, io.ErrUnexpectedEOF
-		}
-		switch src[0] {
-		case ',':
-			dst, src = append(dst, ','), src[1:]
-			continue
-		case '}':
-			if e.options.multiline {
-				dst = e.appendIndent(dst, depth-1)
-			}
-			dst, src = append(dst, '}'), src[1:]
-			return dst, src, nil
-		default:
-			return dst, src, newInvalidCharacterError(src, "after object value (expecting ',' or '}')")
-		}
-	}
-}
-
-// reformatArray parses a JSON array from the start of src and
-// appends it to the end of dst, reformatting whitespace and strings as needed.
-// It returns the updated versions of dst and src.
-func (e *Encoder) reformatArray(dst []byte, src RawValue, depth int) ([]byte, RawValue, error) {
-	// Append array start.
-	if src[0] != '[' {
-		panic("BUG: reformatArray must be called with a buffer that starts with '['")
-	}
-	dst, src = append(dst, '['), src[1:]
-
-	// Append (possible) array end.
-	src = src[consumeWhitespace(src):]
-	if len(src) == 0 {
-		return dst, src, io.ErrUnexpectedEOF
-	}
-	if src[0] == ']' {
-		dst, src = append(dst, ']'), src[1:]
-		return dst, src, nil
-	}
-
-	var err error
-	depth++
-	for {
-		// Append optional newline and indentation.
-		if e.options.multiline {
-			dst = e.appendIndent(dst, depth)
-		}
-
-		// Append array value.
-		src = src[consumeWhitespace(src):]
-		if len(src) == 0 {
-			return dst, src, io.ErrUnexpectedEOF
-		}
-		dst, src, err = e.reformatValue(dst, src, depth)
-		if err != nil {
-			return dst, src, err
-		}
-
-		// Append comma or array end.
-		src = src[consumeWhitespace(src):]
-		if len(src) == 0 {
-			return dst, src, io.ErrUnexpectedEOF
-		}
-		switch src[0] {
-		case ',':
-			dst, src = append(dst, ','), src[1:]
-			continue
-		case ']':
-			if e.options.multiline {
-				dst = e.appendIndent(dst, depth-1)
-			}
-			dst, src = append(dst, ']'), src[1:]
-			return dst, src, nil
-		default:
-			return dst, src, newInvalidCharacterError(src, "after array value (expecting ',' or ']')")
-		}
-	}
-}
-
-// OutputOffset returns the current output byte offset. It gives the location
-// of the next byte immediately after the most recently written token or value.
-// The number of bytes actually written to the underlying io.Writer may be less
-// than this offset due to internal buffering effects.
-func (e *Encoder) OutputOffset() int64 {
-	return e.previousOffsetEnd()
-}
-
-// UnusedBuffer returns a zero-length buffer with a possible non-zero capacity.
-// This buffer is intended to be used to populate a RawValue
-// being passed to an immediately succeeding WriteValue call.
-//
-// Example usage:
-//
-//	b := d.UnusedBuffer()
-//	b = append(b, '"')
-//	b = appendString(b, v) // append the string formatting of v
-//	b = append(b, '"')
-//	... := d.WriteValue(b)
-//
-// It is the user's responsibility to ensure that the value is valid JSON.
-func (e *Encoder) UnusedBuffer() []byte {
-	// NOTE: We don't return e.buf[len(e.buf):cap(e.buf)] since WriteValue would
-	// need to take special care to avoid mangling the data while reformatting.
-	// WriteValue can't easily identify whether the input RawValue aliases e.buf
-	// without using unsafe.Pointer. Thus, we just return a different buffer.
-	// Should this ever alias e.buf, we need to consider how it operates with
-	// the specialized performance optimization for bytes.Buffer.
-	n := 1 << bits.Len(uint(e.maxValue|63)) // fast approximation for max length
-	if cap(e.unusedCache) < n {
-		e.unusedCache = make([]byte, 0, n)
-	}
-	return e.unusedCache
-}
-
-// StackDepth returns the depth of the state machine for written JSON data.
-// Each level on the stack represents a nested JSON object or array.
-// It is incremented whenever an ObjectStart or ArrayStart token is encountered
-// and decremented whenever an ObjectEnd or ArrayEnd token is encountered.
-// The depth is zero-indexed, where zero represents the top-level JSON value.
-func (e *Encoder) StackDepth() int {
-	// NOTE: Keep in sync with Decoder.StackDepth.
-	return e.tokens.depth() - 1
-}
-
-// StackIndex returns information about the specified stack level.
-// It must be a number between 0 and StackDepth, inclusive.
-// For each level, it reports the kind:
-//
-//   - 0 for a level of zero,
-//   - '{' for a level representing a JSON object, and
-//   - '[' for a level representing a JSON array.
-//
-// It also reports the length of that JSON object or array.
-// Each name and value in a JSON object is counted separately,
-// so the effective number of members would be half the length.
-// A complete JSON object must have an even length.
-func (e *Encoder) StackIndex(i int) (Kind, int) {
-	// NOTE: Keep in sync with Decoder.StackIndex.
-	switch s := e.tokens.index(i); {
-	case i > 0 && s.isObject():
-		return '{', s.length()
-	case i > 0 && s.isArray():
-		return '[', s.length()
-	default:
-		return 0, s.length()
-	}
-}
-
-// StackPointer returns a JSON Pointer (RFC 6901) to the most recently written value.
-// Object names are only present if AllowDuplicateNames is false, otherwise
-// object members are represented using their index within the object.
-func (e *Encoder) StackPointer() string {
-	e.names.copyQuotedBuffer(e.buf)
-	return string(e.appendStackPointer(nil))
-}
-
-// appendString appends src to dst as a JSON string per RFC 7159, section 7.
-//
-// If validateUTF8 is specified, this rejects input that contains invalid UTF-8
-// otherwise invalid bytes are replaced with the Unicode replacement character.
-// If escapeRune is provided, it specifies which runes to escape using
-// hexadecimal sequences. If nil, the shortest representable form is used,
-// which is also the canonical form for strings (RFC 8785, section 3.2.2.2).
-//
-// Note that this API allows full control over the formatting of strings
-// except for whether a forward solidus '/' may be formatted as '\/' and
-// the casing of hexadecimal Unicode escape sequences.
-func appendString(dst []byte, src string, validateUTF8 bool, escapeRune func(rune) bool) ([]byte, error) {
-	appendEscapedASCII := func(dst []byte, c byte) []byte {
-		switch c {
-		case '"', '\\':
-			dst = append(dst, '\\', c)
-		case '\b':
-			dst = append(dst, "\\b"...)
-		case '\f':
-			dst = append(dst, "\\f"...)
-		case '\n':
-			dst = append(dst, "\\n"...)
-		case '\r':
-			dst = append(dst, "\\r"...)
-		case '\t':
-			dst = append(dst, "\\t"...)
-		default:
-			dst = append(dst, "\\u"...)
-			dst = appendHexUint16(dst, uint16(c))
-		}
-		return dst
-	}
-	appendEscapedUnicode := func(dst []byte, r rune) []byte {
-		if r1, r2 := utf16.EncodeRune(r); r1 != '\ufffd' && r2 != '\ufffd' {
-			dst = append(dst, "\\u"...)
-			dst = appendHexUint16(dst, uint16(r1))
-			dst = append(dst, "\\u"...)
-			dst = appendHexUint16(dst, uint16(r2))
-		} else {
-			dst = append(dst, "\\u"...)
-			dst = appendHexUint16(dst, uint16(r))
-		}
-		return dst
-	}
-
-	// Optimize for when escapeRune is nil.
-	if escapeRune == nil {
-		var i, n int
-		dst = append(dst, '"')
-		for uint(len(src)) > uint(n) {
-			// Handle single-byte ASCII.
-			if c := src[n]; c < utf8.RuneSelf {
-				n++
-				if c < ' ' || c == '"' || c == '\\' {
-					dst = append(dst, src[i:n-1]...)
-					dst = appendEscapedASCII(dst, c)
-					i = n
-				}
-				continue
-			}
-
-			// Handle multi-byte Unicode.
-			_, rn := utf8.DecodeRuneInString(src[n:])
-			n += rn
-			if rn == 1 { // must be utf8.RuneError since we already checked for single-byte ASCII
-				dst = append(dst, src[i:n-rn]...)
-				if validateUTF8 {
-					return dst, &SyntacticError{str: "invalid UTF-8 within string"}
-				}
-				dst = append(dst, "\ufffd"...)
-				i = n
-			}
-		}
-		dst = append(dst, src[i:n]...)
-		dst = append(dst, '"')
-		return dst, nil
-	}
-
-	// Slower implementation for when escapeRune is non-nil.
-	var i, n int
-	dst = append(dst, '"')
-	for uint(len(src)) > uint(n) {
-		switch r, rn := utf8.DecodeRuneInString(src[n:]); {
-		case r == utf8.RuneError && rn == 1:
-			dst = append(dst, src[i:n]...)
-			if validateUTF8 {
-				return dst, &SyntacticError{str: "invalid UTF-8 within string"}
-			}
-			if escapeRune('\ufffd') {
-				dst = append(dst, `\ufffd`...)
-			} else {
-				dst = append(dst, "\ufffd"...)
-			}
-			n += rn
-			i = n
-		case escapeRune(r):
-			dst = append(dst, src[i:n]...)
-			dst = appendEscapedUnicode(dst, r)
-			n += rn
-			i = n
-		case r < ' ' || r == '"' || r == '\\':
-			dst = append(dst, src[i:n]...)
-			dst = appendEscapedASCII(dst, byte(r))
-			n += rn
-			i = n
-		default:
-			n += rn
-		}
-	}
-	dst = append(dst, src[i:n]...)
-	dst = append(dst, '"')
-	return dst, nil
-}
-
-// reformatString consumes a JSON string from src and appends it to dst,
-// reformatting it if necessary for the given escapeRune parameter.
-// It returns the appended output and the remainder of the input.
-func reformatString(dst, src []byte, validateUTF8, preserveRaw bool, escapeRune func(rune) bool) ([]byte, []byte, error) {
-	// TODO: Should this update valueFlags as input?
-	var flags valueFlags
-	n, err := consumeString(&flags, src, validateUTF8)
-	if err != nil {
-		return dst, src[n:], err
-	}
-	if preserveRaw || (escapeRune == nil && flags.isCanonical()) {
-		dst = append(dst, src[:n]...) // copy the string verbatim
-		return dst, src[n:], nil
-	}
-
-	// TODO: Implement a direct, raw-to-raw reformat for strings.
-	// If the escapeRune option would have resulted in no changes to the output,
-	// it would be faster to simply append src to dst without going through
-	// an intermediary representation in a separate buffer.
-	b, _ := unescapeString(make([]byte, 0, n), src[:n])
-	dst, _ = appendString(dst, string(b), validateUTF8, escapeRune)
-	return dst, src[n:], nil
-}
-
-// appendNumber appends src to dst as a JSON number per RFC 7159, section 6.
-// It formats numbers similar to the ES6 number-to-string conversion.
-// See https://go.dev/issue/14135.
-//
-// The output is identical to ECMA-262, 6th edition, section 7.1.12.1 and with
-// RFC 8785, section 3.2.2.3 for 64-bit floating-point numbers except for -0,
-// which is formatted as -0 instead of just 0.
-//
-// For 32-bit floating-point numbers,
-// the output is a 32-bit equivalent of the algorithm.
-// Note that ECMA-262 specifies no algorithm for 32-bit numbers.
-func appendNumber(dst []byte, src float64, bits int) []byte {
-	if bits == 32 {
-		src = float64(float32(src))
-	}
-
-	abs := math.Abs(src)
-	fmt := byte('f')
-	if abs != 0 {
-		if bits == 64 && (float64(abs) < 1e-6 || float64(abs) >= 1e21) ||
-			bits == 32 && (float32(abs) < 1e-6 || float32(abs) >= 1e21) {
-			fmt = 'e'
-		}
-	}
-	dst = strconv.AppendFloat(dst, src, fmt, -1, bits)
-	if fmt == 'e' {
-		// Clean up e-09 to e-9.
-		n := len(dst)
-		if n >= 4 && dst[n-4] == 'e' && dst[n-3] == '-' && dst[n-2] == '0' {
-			dst[n-2] = dst[n-1]
-			dst = dst[:n-1]
-		}
-	}
-	return dst
-}
-
-// reformatNumber consumes a JSON string from src and appends it to dst,
-// canonicalizing it if specified.
-// It returns the appended output and the remainder of the input.
-func reformatNumber(dst, src []byte, canonicalize bool) ([]byte, []byte, error) {
-	n, err := consumeNumber(src)
-	if err != nil {
-		return dst, src[n:], err
-	}
-	if !canonicalize {
-		dst = append(dst, src[:n]...) // copy the number verbatim
-		return dst, src[n:], nil
-	}
-
-	// Canonicalize the number per RFC 8785, section 3.2.2.3.
-	// As an optimization, we can copy integer numbers below 2⁵³ verbatim.
-	const maxExactIntegerDigits = 16 // len(strconv.AppendUint(nil, 1<<53, 10))
-	if n < maxExactIntegerDigits && consumeSimpleNumber(src[:n]) == n {
-		dst = append(dst, src[:n]...) // copy the number verbatim
-		return dst, src[n:], nil
-	}
-	fv, _ := strconv.ParseFloat(string(src[:n]), 64)
-	switch {
-	case fv == 0:
-		fv = 0 // normalize negative zero as just zero
-	case math.IsInf(fv, +1):
-		fv = +math.MaxFloat64
-	case math.IsInf(fv, -1):
-		fv = -math.MaxFloat64
-	}
-	return appendNumber(dst, fv, 64), src[n:], nil
-}
-
-// appendHexUint16 appends src to dst as a 4-byte hexadecimal number.
-func appendHexUint16(dst []byte, src uint16) []byte {
-	dst = append(dst, "0000"[1+(bits.Len16(src)-1)/4:]...)
-	dst = strconv.AppendUint(dst, uint64(src), 16)
-	return dst
-}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/errors.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/errors.go
index 35be8601ea..1df765384d 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/errors.go
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/errors.go
@@ -5,40 +5,56 @@
 package json
 
 import (
+	"cmp"
 	"errors"
+	"fmt"
 	"reflect"
 	"strconv"
 	"strings"
-	"unicode/utf8"
-)
+	"sync"
 
-const errorPrefix = "json: "
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
+)
 
-// Error matches errors returned by this package according to errors.Is.
-const Error = jsonError("json error")
+// ErrUnknownName indicates that a JSON object member could not be
+// unmarshaled because the name is not known to the target Go struct.
+// This error is directly wrapped within a [SemanticError] when produced.
+//
+// The name of an unknown JSON object member can be extracted as:
+//
+//	err := ...
+//	var serr json.SemanticError
+//	if errors.As(err, &serr) && serr.Err == json.ErrUnknownName {
+//		ptr := serr.JSONPointer // JSON pointer to unknown name
+//		name := ptr.LastToken() // unknown name itself
+//		...
+//	}
+//
+// This error is only returned if [RejectUnknownMembers] is true.
+var ErrUnknownName = errors.New("unknown object member name")
 
-type jsonError string
+const errorPrefix = "json: "
 
-func (e jsonError) Error() string {
-	return string(e)
-}
-func (e jsonError) Is(target error) bool {
-	return e == target || target == Error
+func isSemanticError(err error) bool {
+	_, ok := err.(*SemanticError)
+	return ok
 }
 
-type ioError struct {
-	action string // either "read" or "write"
-	err    error
+func isSyntacticError(err error) bool {
+	_, ok := err.(*jsontext.SyntacticError)
+	return ok
 }
 
-func (e *ioError) Error() string {
-	return errorPrefix + e.action + " error: " + e.err.Error()
-}
-func (e *ioError) Unwrap() error {
-	return e.err
-}
-func (e *ioError) Is(target error) bool {
-	return e == target || target == Error || errors.Is(e.err, target)
+// isFatalError reports whether this error must terminate asharling.
+// All errors are considered fatal unless operating under
+// [jsonflags.ReportErrorsWithLegacySemantics] in which case only
+// syntactic errors and I/O errors are considered fatal.
+func isFatalError(err error, flags jsonflags.Flags) bool {
+	return !flags.Get(jsonflags.ReportErrorsWithLegacySemantics) ||
+		isSyntacticError(err) || export.IsIOError(err)
 }
 
 // SemanticError describes an error determining the meaning
@@ -55,10 +71,13 @@ type SemanticError struct {
 	ByteOffset int64
 	// JSONPointer indicates that an error occurred within this JSON value
 	// as indicated using the JSON Pointer notation (see RFC 6901).
-	JSONPointer string
+	JSONPointer jsontext.Pointer
 
 	// JSONKind is the JSON kind that could not be handled.
-	JSONKind Kind // may be zero if unknown
+	JSONKind jsontext.Kind // may be zero if unknown
+	// JSONValue is the JSON number or string that could not be unmarshaled.
+	// It is not populated during marshaling.
+	JSONValue jsontext.Value // may be nil if irrelevant or unknown
 	// GoType is the Go type that could not be handled.
 	GoType reflect.Type // may be nil if unknown
 
@@ -66,18 +85,228 @@ type SemanticError struct {
 	Err error // may be nil
 }
 
-func (e *SemanticError) Error() string {
-	var sb strings.Builder
-	sb.WriteString(errorPrefix)
+// coder is implemented by [jsontext.Encoder] or [jsontext.Decoder].
+type coder interface {
+	StackPointer() jsontext.Pointer
+	Options() Options
+}
+
+// newInvalidFormatError wraps err in a SemanticError because
+// the current type t cannot handle the provided options format.
+// This error must be called before producing or consuming the next value.
+//
+// If [jsonflags.ReportErrorsWithLegacySemantics] is specified,
+// then this automatically skips the next value when unmarshaling
+// to ensure that the value is fully consumed.
+func newInvalidFormatError(c coder, t reflect.Type) error {
+	err := fmt.Errorf("invalid format flag %q", c.Options().(*jsonopts.Struct).Format)
+	switch c := c.(type) {
+	case *jsontext.Encoder:
+		err = newMarshalErrorBefore(c, t, err)
+	case *jsontext.Decoder:
+		err = newUnmarshalErrorBeforeWithSkipping(c, t, err)
+	}
+	return err
+}
+
+// newMarshalErrorBefore wraps err in a SemanticError assuming that e
+// is positioned right before the next token or value, which causes an error.
+func newMarshalErrorBefore(e *jsontext.Encoder, t reflect.Type, err error) error {
+	return &SemanticError{action: "marshal", GoType: t, Err: err,
+		ByteOffset:  e.OutputOffset() + int64(export.Encoder(e).CountNextDelimWhitespace()),
+		JSONPointer: jsontext.Pointer(export.Encoder(e).AppendStackPointer(nil, +1))}
+}
+
+// newUnmarshalErrorBefore wraps err in a SemanticError assuming that d
+// is positioned right before the next token or value, which causes an error.
+// It does not record the next JSON kind as this error is used to indicate
+// the receiving Go value is invalid to unmarshal into (and not a JSON error).
+// However, if [jsonflags.ReportErrorsWithLegacySemantics] is specified,
+// then it does record the next JSON kind for historical reporting reasons.
+func newUnmarshalErrorBefore(d *jsontext.Decoder, t reflect.Type, err error) error {
+	var k jsontext.Kind
+	if export.Decoder(d).Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+		k = d.PeekKind()
+	}
+	return &SemanticError{action: "unmarshal", GoType: t, Err: err,
+		ByteOffset:  d.InputOffset() + int64(export.Decoder(d).CountNextDelimWhitespace()),
+		JSONPointer: jsontext.Pointer(export.Decoder(d).AppendStackPointer(nil, +1)),
+		JSONKind:    k}
+}
+
+// newUnmarshalErrorBeforeWithSkipping is like [newUnmarshalErrorBefore],
+// but automatically skips the next value if
+// [jsonflags.ReportErrorsWithLegacySemantics] is specified.
+func newUnmarshalErrorBeforeWithSkipping(d *jsontext.Decoder, t reflect.Type, err error) error {
+	err = newUnmarshalErrorBefore(d, t, err)
+	if export.Decoder(d).Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+		if err2 := export.Decoder(d).SkipValue(); err2 != nil {
+			return err2
+		}
+	}
+	return err
+}
+
+// newUnmarshalErrorAfter wraps err in a SemanticError assuming that d
+// is positioned right after the previous token or value, which caused an error.
+func newUnmarshalErrorAfter(d *jsontext.Decoder, t reflect.Type, err error) error {
+	tokOrVal := export.Decoder(d).PreviousTokenOrValue()
+	return &SemanticError{action: "unmarshal", GoType: t, Err: err,
+		ByteOffset:  d.InputOffset() - int64(len(tokOrVal)),
+		JSONPointer: jsontext.Pointer(export.Decoder(d).AppendStackPointer(nil, -1)),
+		JSONKind:    jsontext.Value(tokOrVal).Kind()}
+}
+
+// newUnmarshalErrorAfter wraps err in a SemanticError assuming that d
+// is positioned right after the previous token or value, which caused an error.
+// It also stores a copy of the last JSON value if it is a string or number.
+func newUnmarshalErrorAfterWithValue(d *jsontext.Decoder, t reflect.Type, err error) error {
+	serr := newUnmarshalErrorAfter(d, t, err).(*SemanticError)
+	if serr.JSONKind == '"' || serr.JSONKind == '0' {
+		serr.JSONValue = jsontext.Value(export.Decoder(d).PreviousTokenOrValue()).Clone()
+	}
+	return serr
+}
+
+// newUnmarshalErrorAfterWithSkipping is like [newUnmarshalErrorAfter],
+// but automatically skips the remainder of the current value if
+// [jsonflags.ReportErrorsWithLegacySemantics] is specified.
+func newUnmarshalErrorAfterWithSkipping(d *jsontext.Decoder, t reflect.Type, err error) error {
+	err = newUnmarshalErrorAfter(d, t, err)
+	if export.Decoder(d).Flags.Get(jsonflags.ReportErrorsWithLegacySemantics) {
+		if err2 := export.Decoder(d).SkipValueRemainder(); err2 != nil {
+			return err2
+		}
+	}
+	return err
+}
 
-	// Hyrum-proof the error message by deliberately switching between
-	// two equivalent renderings of the same error message.
-	// The randomization is tied to the Hyrum-proofing already applied
-	// on map iteration in Go.
+// newSemanticErrorWithPosition wraps err in a SemanticError assuming that
+// the error occurred at the provided depth, and length.
+// If err is already a SemanticError, then position information is only
+// injected if it is currently unpopulated.
+//
+// If the position is unpopulated, it is ambiguous where the error occurred
+// in the user code, whether it was before or after the current position.
+// For the byte offset, we assume that the error occurred before the last read
+// token or value when decoding, or before the next value when encoding.
+// For the JSON pointer, we point to the parent object or array unless
+// we can be certain that it happened with an object member.
+//
+// This is used to annotate errors returned by user-provided
+// v2 MarshalJSON or UnmarshalJSON methods or functions.
+func newSemanticErrorWithPosition(c coder, t reflect.Type, prevDepth int, prevLength int64, err error) error {
+	serr, _ := err.(*SemanticError)
+	if serr == nil {
+		serr = &SemanticError{Err: err}
+	}
+	var currDepth int
+	var currLength int64
+	var coderState interface{ AppendStackPointer([]byte, int) []byte }
+	var offset int64
+	switch c := c.(type) {
+	case *jsontext.Encoder:
+		e := export.Encoder(c)
+		serr.action = cmp.Or(serr.action, "marshal")
+		currDepth, currLength = e.Tokens.DepthLength()
+		offset = c.OutputOffset() + int64(export.Encoder(c).CountNextDelimWhitespace())
+		coderState = e
+	case *jsontext.Decoder:
+		d := export.Decoder(c)
+		serr.action = cmp.Or(serr.action, "unmarshal")
+		currDepth, currLength = d.Tokens.DepthLength()
+		tokOrVal := d.PreviousTokenOrValue()
+		offset = c.InputOffset() - int64(len(tokOrVal))
+		if (prevDepth == currDepth && prevLength == currLength) || len(tokOrVal) == 0 {
+			// If no Read method was called in the user-defined method or
+			// if the Peek method was called, then use the offset of the next value.
+			offset = c.InputOffset() + int64(export.Decoder(c).CountNextDelimWhitespace())
+		}
+		coderState = d
+	}
+	serr.ByteOffset = cmp.Or(serr.ByteOffset, offset)
+	if serr.JSONPointer == "" {
+		where := 0 // default to ambiguous positioning
+		switch {
+		case prevDepth == currDepth && prevLength+0 == currLength:
+			where = +1
+		case prevDepth == currDepth && prevLength+1 == currLength:
+			where = -1
+		}
+		serr.JSONPointer = jsontext.Pointer(coderState.AppendStackPointer(nil, where))
+	}
+	serr.GoType = cmp.Or(serr.GoType, t)
+	return serr
+}
+
+// collapseSemanticErrors collapses double SemanticErrors at the outer levels
+// into a single SemanticError by preserving the inner error,
+// but prepending the ByteOffset and JSONPointer with the outer error.
+//
+// For example:
+//
+//	collapseSemanticErrors(&SemanticError{
+//		ByteOffset:  len64(`[0,{"alpha":[0,1,`),
+//		JSONPointer: "/1/alpha/2",
+//		GoType:      reflect.TypeFor[outerType](),
+//		Err: &SemanticError{
+//			ByteOffset:  len64(`{"foo":"bar","fizz":[0,`),
+//			JSONPointer: "/fizz/1",
+//			GoType:      reflect.TypeFor[innerType](),
+//			Err:         ...,
+//		},
+//	})
+//
+// results in:
+//
+//	&SemanticError{
+//		ByteOffset:  len64(`[0,{"alpha":[0,1,`) + len64(`{"foo":"bar","fizz":[0,`),
+//		JSONPointer: "/1/alpha/2" + "/fizz/1",
+//		GoType:      reflect.TypeFor[innerType](),
+//		Err:         ...,
+//	}
+//
+// This is used to annotate errors returned by user-provided
+// v1 MarshalJSON or UnmarshalJSON methods with precise position information
+// if they themselves happened to return a SemanticError.
+// Since MarshalJSON and UnmarshalJSON are not operating on the root JSON value,
+// their positioning must be relative to the nested JSON value
+// returned by UnmarshalJSON or passed to MarshalJSON.
+// Therefore, we can construct an absolute position by concatenating
+// the outer with the inner positions.
+//
+// Note that we do not use collapseSemanticErrors with user-provided functions
+// that take in an [jsontext.Encoder] or [jsontext.Decoder] since they contain
+// methods to report position relative to the root JSON value.
+// We assume user-constructed errors are correctly precise about position.
+func collapseSemanticErrors(err error) error {
+	if serr1, ok := err.(*SemanticError); ok {
+		if serr2, ok := serr1.Err.(*SemanticError); ok {
+			serr2.ByteOffset = serr1.ByteOffset + serr2.ByteOffset
+			serr2.JSONPointer = serr1.JSONPointer + serr2.JSONPointer
+			*serr1 = *serr2
+		}
+	}
+	return err
+}
+
+// errorModalVerb is a modal verb like "cannot" or "unable to".
+//
+// Once per process, Hyrum-proof the error message by deliberately
+// switching between equivalent renderings of the same error message.
+// The randomization is tied to the Hyrum-proofing already applied
+// on map iteration in Go.
+var errorModalVerb = sync.OnceValue(func() string {
 	for phrase := range map[string]struct{}{"cannot": {}, "unable to": {}} {
-		sb.WriteString(phrase)
-		break // use whichever phrase we get in the first iteration
+		return phrase // use whichever phrase we get in the first iteration
 	}
+	return ""
+})
+
+func (e *SemanticError) Error() string {
+	var sb strings.Builder
+	sb.WriteString(errorPrefix)
+	sb.WriteString(errorModalVerb())
 
 	// Format action.
 	var preposition string
@@ -94,7 +323,6 @@ func (e *SemanticError) Error() string {
 	}
 
 	// Format JSON kind.
-	var omitPreposition bool
 	switch e.JSONKind {
 	case 'n':
 		sb.WriteString(" JSON null")
@@ -109,75 +337,92 @@ func (e *SemanticError) Error() string {
 	case '[', ']':
 		sb.WriteString(" JSON array")
 	default:
-		omitPreposition = true
+		if e.action == "" {
+			preposition = ""
+		}
+	}
+	if len(e.JSONValue) > 0 && len(e.JSONValue) < 100 {
+		sb.WriteByte(' ')
+		sb.Write(e.JSONValue)
 	}
 
 	// Format Go type.
 	if e.GoType != nil {
-		if !omitPreposition {
-			sb.WriteString(preposition)
+		typeString := e.GoType.String()
+		if len(typeString) > 100 {
+			// An excessively long type string most likely occurs for
+			// an anonymous struct declaration with many fields.
+			// Reduce the noise by just printing the kind,
+			// and optionally prepending it with the package name
+			// if the struct happens to include an unexported field.
+			typeString = e.GoType.Kind().String()
+			if e.GoType.Kind() == reflect.Struct && e.GoType.Name() == "" {
+				for i := range e.GoType.NumField() {
+					if pkgPath := e.GoType.Field(i).PkgPath; pkgPath != "" {
+						typeString = pkgPath[strings.LastIndexByte(pkgPath, '/')+len("/"):] + ".struct"
+						break
+					}
+				}
+			}
+		}
+		sb.WriteString(preposition)
+		sb.WriteString(" Go ")
+		sb.WriteString(typeString)
+	}
+
+	// Special handling for unknown names.
+	if e.Err == ErrUnknownName {
+		sb.WriteString(": ")
+		sb.WriteString(ErrUnknownName.Error())
+		sb.WriteString(" ")
+		sb.WriteString(strconv.Quote(e.JSONPointer.LastToken()))
+		if parent := e.JSONPointer.Parent(); parent != "" {
+			sb.WriteString(" within ")
+			sb.WriteString(strconv.Quote(jsonwire.TruncatePointer(string(parent), 100)))
 		}
-		sb.WriteString(" Go value of type ")
-		sb.WriteString(e.GoType.String())
+		return sb.String()
 	}
 
 	// Format where.
-	switch {
+	// Avoid printing if it overlaps with a wrapped SyntacticError.
+	switch serr, _ := e.Err.(*jsontext.SyntacticError); {
 	case e.JSONPointer != "":
-		sb.WriteString(" within JSON value at ")
-		sb.WriteString(strconv.Quote(e.JSONPointer))
+		if serr == nil || !e.JSONPointer.Contains(serr.JSONPointer) {
+			sb.WriteString(" within ")
+			sb.WriteString(strconv.Quote(jsonwire.TruncatePointer(string(e.JSONPointer), 100)))
+		}
 	case e.ByteOffset > 0:
-		sb.WriteString(" after byte offset ")
-		sb.WriteString(strconv.FormatInt(e.ByteOffset, 10))
+		if serr == nil || !(e.ByteOffset <= serr.ByteOffset) {
+			sb.WriteString(" after offset ")
+			sb.WriteString(strconv.FormatInt(e.ByteOffset, 10))
+		}
 	}
 
 	// Format underlying error.
 	if e.Err != nil {
+		errString := e.Err.Error()
+		if isSyntacticError(e.Err) {
+			errString = strings.TrimPrefix(errString, "jsontext: ")
+		}
 		sb.WriteString(": ")
-		sb.WriteString(e.Err.Error())
+		sb.WriteString(errString)
 	}
 
 	return sb.String()
 }
-func (e *SemanticError) Is(target error) bool {
-	return e == target || target == Error || errors.Is(e.Err, target)
-}
+
 func (e *SemanticError) Unwrap() error {
 	return e.Err
 }
 
-// SyntacticError is a description of a syntactic error that occurred when
-// encoding or decoding JSON according to the grammar.
-//
-// The contents of this error as produced by this package may change over time.
-type SyntacticError struct {
-	requireKeyedLiterals
-	nonComparable
-
-	// ByteOffset indicates that an error occurred after this byte offset.
-	ByteOffset int64
-	str        string
-}
-
-func (e *SyntacticError) Error() string {
-	return errorPrefix + e.str
-}
-func (e *SyntacticError) Is(target error) bool {
-	return e == target || target == Error
-}
-func (e *SyntacticError) withOffset(pos int64) error {
-	return &SyntacticError{ByteOffset: pos, str: e.str}
-}
-
-func newInvalidCharacterError(prefix []byte, where string) *SyntacticError {
-	what := quoteRune(prefix)
-	return &SyntacticError{str: "invalid character " + what + " " + where}
-}
-
-func quoteRune(b []byte) string {
-	r, n := utf8.DecodeRune(b)
-	if r == utf8.RuneError && n == 1 {
-		return `'\x` + strconv.FormatUint(uint64(b[0]), 16) + `'`
+func newDuplicateNameError(ptr jsontext.Pointer, quotedName []byte, offset int64) error {
+	if quotedName != nil {
+		name, _ := jsonwire.AppendUnquote(nil, quotedName)
+		ptr = ptr.AppendToken(string(name))
+	}
+	return &jsontext.SyntacticError{
+		ByteOffset:  offset,
+		JSONPointer: ptr,
+		Err:         jsontext.ErrDuplicateName,
 	}
-	return strconv.QuoteRune(r)
 }
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/fields.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/fields.go
index c0ee361668..d539feedd1 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/fields.go
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/fields.go
@@ -5,24 +5,26 @@
 package json
 
 import (
+	"cmp"
 	"errors"
 	"fmt"
 	"io"
 	"reflect"
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
 	"unicode"
 	"unicode/utf8"
-)
 
-var errIgnoredField = errors.New("ignored field")
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire"
+)
 
 type isZeroer interface {
 	IsZero() bool
 }
 
-var isZeroerType = reflect.TypeOf((*isZeroer)(nil)).Elem()
+var isZeroerType = reflect.TypeFor[isZeroer]()
 
 type structFields struct {
 	flattened       []structField // listed in depth-first ordering
@@ -31,9 +33,37 @@ type structFields struct {
 	inlinedFallback *structField
 }
 
+// reindex recomputes index to avoid bounds check during runtime.
+//
+// During the construction of each [structField] in [makeStructFields],
+// the index field is 0-indexed. However, before it returns,
+// the 0th field is stored in index0 and index stores the remainder.
+func (sf *structFields) reindex() {
+	reindex := func(f *structField) {
+		f.index0 = f.index[0]
+		f.index = f.index[1:]
+		if len(f.index) == 0 {
+			f.index = nil // avoid pinning the backing slice
+		}
+	}
+	for i := range sf.flattened {
+		reindex(&sf.flattened[i])
+	}
+	if sf.inlinedFallback != nil {
+		reindex(sf.inlinedFallback)
+	}
+}
+
+// lookupByFoldedName looks up name by a case-insensitive match
+// that also ignores the presence of dashes and underscores.
+func (fs *structFields) lookupByFoldedName(name []byte) []*structField {
+	return fs.byFoldedName[string(foldName(name))]
+}
+
 type structField struct {
 	id      int   // unique numeric ID in breadth-first ordering
-	index   []int // index into a struct according to reflect.Type.FieldByIndex
+	index0  int   // 0th index into a struct according to [reflect.Type.FieldByIndex]
+	index   []int // 1st index and remainder according to [reflect.Type.FieldByIndex]
 	typ     reflect.Type
 	fncs    *arshaler
 	isZero  func(addressableValue) bool
@@ -41,18 +71,12 @@ type structField struct {
 	fieldOptions
 }
 
-func makeStructFields(root reflect.Type) (structFields, *SemanticError) {
-	var fs structFields
-	fs.byActualName = make(map[string]*structField, root.NumField())
-	fs.byFoldedName = make(map[string][]*structField, root.NumField())
+var errNoExportedFields = errors.New("Go struct has no exported fields")
 
-	// ambiguous is a sentinel value to indicate that at least two fields
-	// at the same depth have the same name, and thus cancel each other out.
-	// This follows the same rules as selecting a field on embedded structs
-	// where the shallowest field takes precedence. If more than one field
-	// exists at the shallowest depth, then the selection is illegal.
-	// See https://go.dev/ref/spec#Selectors.
-	ambiguous := new(structField)
+func makeStructFields(root reflect.Type) (fs structFields, serr *SemanticError) {
+	orErrorf := func(serr *SemanticError, t reflect.Type, f string, a ...any) *SemanticError {
+		return cmp.Or(serr, &SemanticError{GoType: t, Err: fmt.Errorf(f, a...)})
+	}
 
 	// Setup a queue for a breath-first search.
 	var queueIndex int
@@ -66,6 +90,7 @@ func makeStructFields(root reflect.Type) (structFields, *SemanticError) {
 
 	// Perform a breadth-first search over all reachable fields.
 	// This ensures that len(f.index) will be monotonically increasing.
+	var allFields, inlinedFallbacks []structField
 	for queueIndex < len(queue) {
 		qe := queue[queueIndex]
 		queueIndex++
@@ -75,16 +100,16 @@ func makeStructFields(root reflect.Type) (structFields, *SemanticError) {
 		namesIndex := make(map[string]int) // index of each field with a given JSON object name in current struct
 		var hasAnyJSONTag bool             // whether any Go struct field has a `json` tag
 		var hasAnyJSONField bool           // whether any JSON serializable fields exist in current struct
-		for i := 0; i < t.NumField(); i++ {
+		for i := range t.NumField() {
 			sf := t.Field(i)
 			_, hasTag := sf.Tag.Lookup("json")
 			hasAnyJSONTag = hasAnyJSONTag || hasTag
-			options, err := parseFieldOptions(sf)
+			options, ignored, err := parseFieldOptions(sf)
 			if err != nil {
-				if err == errIgnoredField {
-					continue
-				}
-				return structFields{}, &SemanticError{GoType: t, Err: err}
+				serr = cmp.Or(serr, &SemanticError{GoType: t, Err: err})
+			}
+			if ignored {
+				continue
 			}
 			hasAnyJSONField = true
 			f := structField{
@@ -96,84 +121,104 @@ func makeStructFields(root reflect.Type) (structFields, *SemanticError) {
 				fieldOptions: options,
 			}
 			if sf.Anonymous && !f.hasName {
-				f.inline = true // implied by use of Go embedding without an explicit name
+				if indirectType(f.typ).Kind() != reflect.Struct {
+					serr = orErrorf(serr, t, "embedded Go struct field %s of non-struct type must be explicitly given a JSON name", sf.Name)
+				} else {
+					f.inline = true // implied by use of Go embedding without an explicit name
+				}
 			}
 			if f.inline || f.unknown {
 				// Handle an inlined field that serializes to/from
 				// zero or more JSON object members.
 
-				if f.inline && f.unknown {
-					err := fmt.Errorf("Go struct field %s cannot have both `inline` and `unknown` specified", sf.Name)
-					return structFields{}, &SemanticError{GoType: t, Err: err}
-				}
 				switch f.fieldOptions {
 				case fieldOptions{name: f.name, quotedName: f.quotedName, inline: true}:
 				case fieldOptions{name: f.name, quotedName: f.quotedName, unknown: true}:
+				case fieldOptions{name: f.name, quotedName: f.quotedName, inline: true, unknown: true}:
+					serr = orErrorf(serr, t, "Go struct field %s cannot have both `inline` and `unknown` specified", sf.Name)
+					f.inline = false // let `unknown` take precedence
 				default:
-					err := fmt.Errorf("Go struct field %s cannot have any options other than `inline` or `unknown` specified", sf.Name)
-					return structFields{}, &SemanticError{GoType: t, Err: err}
+					serr = orErrorf(serr, t, "Go struct field %s cannot have any options other than `inline` or `unknown` specified", sf.Name)
+					if f.hasName {
+						continue // invalid inlined field; treat as ignored
+					}
+					f.fieldOptions = fieldOptions{name: f.name, quotedName: f.quotedName, inline: f.inline, unknown: f.unknown}
+					if f.inline && f.unknown {
+						f.inline = false // let `unknown` take precedence
+					}
 				}
 
-				// Unwrap one level of pointer indirection similar to how Go
-				// only allows embedding either T or *T, but not **T.
-				tf := f.typ
-				if tf.Kind() == reflect.Pointer && tf.Name() == "" {
-					tf = tf.Elem()
-				}
 				// Reject any types with custom serialization otherwise
 				// it becomes impossible to know what sub-fields to inline.
-				if which, _ := implementsWhich(tf,
-					jsonMarshalerV2Type, jsonMarshalerV1Type, textMarshalerType,
-					jsonUnmarshalerV2Type, jsonUnmarshalerV1Type, textUnmarshalerType,
-				); which != nil && tf != rawValueType {
-					err := fmt.Errorf("inlined Go struct field %s of type %s must not implement JSON marshal or unmarshal methods", sf.Name, tf)
-					return structFields{}, &SemanticError{GoType: t, Err: err}
+				tf := indirectType(f.typ)
+				if implementsAny(tf, allMethodTypes...) && tf != jsontextValueType {
+					serr = orErrorf(serr, t, "inlined Go struct field %s of type %s must not implement marshal or unmarshal methods", sf.Name, tf)
 				}
 
 				// Handle an inlined field that serializes to/from
 				// a finite number of JSON object members backed by a Go struct.
 				if tf.Kind() == reflect.Struct {
 					if f.unknown {
-						err := fmt.Errorf("inlined Go struct field %s of type %s with `unknown` tag must be a Go map of string key or a json.RawValue", sf.Name, tf)
-						return structFields{}, &SemanticError{GoType: t, Err: err}
+						serr = orErrorf(serr, t, "inlined Go struct field %s of type %s with `unknown` tag must be a Go map of string key or a jsontext.Value", sf.Name, tf)
+						continue // invalid inlined field; treat as ignored
 					}
 					if qe.visitChildren {
 						queue = append(queue, queueEntry{tf, f.index, !seen[tf]})
 					}
 					seen[tf] = true
 					continue
+				} else if !sf.IsExported() {
+					serr = orErrorf(serr, t, "inlined Go struct field %s is not exported", sf.Name)
+					continue // invalid inlined field; treat as ignored
 				}
 
 				// Handle an inlined field that serializes to/from any number of
-				// JSON object members back by a Go map or RawValue.
+				// JSON object members back by a Go map or jsontext.Value.
 				switch {
-				case tf == rawValueType:
+				case tf == jsontextValueType:
 					f.fncs = nil // specially handled in arshal_inlined.go
-				case tf.Kind() == reflect.Map && tf.Key() == stringType:
+				case tf.Kind() == reflect.Map && tf.Key().Kind() == reflect.String:
+					if implementsAny(tf.Key(), allMethodTypes...) {
+						serr = orErrorf(serr, t, "inlined map field %s of type %s must have a string key that does not implement marshal or unmarshal methods", sf.Name, tf)
+						continue // invalid inlined field; treat as ignored
+					}
 					f.fncs = lookupArshaler(tf.Elem())
 				default:
-					err := fmt.Errorf("inlined Go struct field %s of type %s must be a Go struct, Go map of string key, or json.RawValue", sf.Name, tf)
-					return structFields{}, &SemanticError{GoType: t, Err: err}
+					serr = orErrorf(serr, t, "inlined Go struct field %s of type %s must be a Go struct, Go map of string key, or jsontext.Value", sf.Name, tf)
+					continue // invalid inlined field; treat as ignored
 				}
 
 				// Reject multiple inlined fallback fields within the same struct.
 				if inlinedFallbackIndex >= 0 {
-					err := fmt.Errorf("inlined Go struct fields %s and %s cannot both be a Go map or json.RawValue", t.Field(inlinedFallbackIndex).Name, sf.Name)
-					return structFields{}, &SemanticError{GoType: t, Err: err}
+					serr = orErrorf(serr, t, "inlined Go struct fields %s and %s cannot both be a Go map or jsontext.Value", t.Field(inlinedFallbackIndex).Name, sf.Name)
+					// Still append f to inlinedFallbacks as there is still a
+					// check for a dominant inlined fallback before returning.
 				}
 				inlinedFallbackIndex = i
 
-				// Multiple inlined fallback fields across different structs
-				// follow the same precedence rules as Go struct embedding.
-				if fs.inlinedFallback == nil {
-					fs.inlinedFallback = &f // store first occurrence at lowest depth
-				} else if len(fs.inlinedFallback.index) == len(f.index) {
-					fs.inlinedFallback = ambiguous // at least two occurrences at same depth
-				}
+				inlinedFallbacks = append(inlinedFallbacks, f)
 			} else {
 				// Handle normal Go struct field that serializes to/from
 				// a single JSON object member.
 
+				// Unexported fields cannot be serialized except for
+				// embedded fields of a struct type,
+				// which might promote exported fields of their own.
+				if !sf.IsExported() {
+					tf := indirectType(f.typ)
+					if !(sf.Anonymous && tf.Kind() == reflect.Struct) {
+						serr = orErrorf(serr, t, "Go struct field %s is not exported", sf.Name)
+						continue
+					}
+					// Unfortunately, methods on the unexported field
+					// still cannot be called.
+					if implementsAny(tf, allMethodTypes...) ||
+						(f.omitzero && implementsAny(tf, isZeroerType)) {
+						serr = orErrorf(serr, t, "Go struct field %s is not exported for method calls", sf.Name)
+						continue
+					}
+				}
+
 				// Provide a function that uses a type's IsZero method.
 				switch {
 				case sf.Type.Kind() == reflect.Interface && sf.Type.Implements(isZeroerType):
@@ -202,29 +247,17 @@ func makeStructFields(root reflect.Type) (structFields, *SemanticError) {
 					f.isEmpty = func(va addressableValue) bool { return va.IsNil() }
 				}
 
-				f.id = len(fs.flattened)
-				f.fncs = lookupArshaler(sf.Type)
-				fs.flattened = append(fs.flattened, f)
-
-				// Reject user-specified names with invalid UTF-8.
-				if !utf8.ValidString(f.name) {
-					err := fmt.Errorf("Go struct field %s has JSON object name %q with invalid UTF-8", sf.Name, f.name)
-					return structFields{}, &SemanticError{GoType: t, Err: err}
-				}
 				// Reject multiple fields with same name within the same struct.
 				if j, ok := namesIndex[f.name]; ok {
-					err := fmt.Errorf("Go struct fields %s and %s conflict over JSON object name %q", t.Field(j).Name, sf.Name, f.name)
-					return structFields{}, &SemanticError{GoType: t, Err: err}
+					serr = orErrorf(serr, t, "Go struct fields %s and %s conflict over JSON object name %q", t.Field(j).Name, sf.Name, f.name)
+					// Still append f to allFields as there is still a
+					// check for a dominant field before returning.
 				}
 				namesIndex[f.name] = i
 
-				// Multiple fields of the same name across different structs
-				// follow the same precedence rules as Go struct embedding.
-				if f2 := fs.byActualName[f.name]; f2 == nil {
-					fs.byActualName[f.name] = &fs.flattened[len(fs.flattened)-1] // store first occurrence at lowest depth
-				} else if len(f2.index) == len(f.index) {
-					fs.byActualName[f.name] = ambiguous // at least two occurrences at same depth
-				}
+				f.id = len(allFields)
+				f.fncs = lookupArshaler(sf.Type)
+				allFields = append(allFields, f)
 			}
 		}
 
@@ -239,58 +272,58 @@ func makeStructFields(root reflect.Type) (structFields, *SemanticError) {
 		// errors returned by errors.New would fail to serialize.
 		isEmptyStruct := t.NumField() == 0
 		if !isEmptyStruct && !hasAnyJSONTag && !hasAnyJSONField {
-			err := errors.New("Go struct has no exported fields")
-			return structFields{}, &SemanticError{GoType: t, Err: err}
+			serr = cmp.Or(serr, &SemanticError{GoType: t, Err: errNoExportedFields})
 		}
 	}
 
-	// Remove all fields that are duplicates.
-	// This may move elements forward to fill the holes from removed fields.
-	var n int
-	for _, f := range fs.flattened {
-		switch f2 := fs.byActualName[f.name]; {
-		case f2 == ambiguous:
-			delete(fs.byActualName, f.name)
-		case f2 == nil:
-			continue // may be nil due to previous delete
-		// TODO(https://go.dev/issue/45955): Use slices.Equal.
-		case reflect.DeepEqual(f.index, f2.index):
-			f.id = n
-			fs.flattened[n] = f
-			fs.byActualName[f.name] = &fs.flattened[n] // fix pointer to new location
+	// Sort the fields by exact name (breaking ties by depth and
+	// then by presence of an explicitly provided JSON name).
+	// Select the dominant field from each set of fields with the same name.
+	// If multiple fields have the same name, then the dominant field
+	// is the one that exists alone at the shallowest depth,
+	// or the one that is uniquely tagged with a JSON name.
+	// Otherwise, no dominant field exists for the set.
+	flattened := allFields[:0]
+	slices.SortStableFunc(allFields, func(x, y structField) int {
+		return cmp.Or(
+			strings.Compare(x.name, y.name),
+			cmp.Compare(len(x.index), len(y.index)),
+			boolsCompare(!x.hasName, !y.hasName))
+	})
+	for len(allFields) > 0 {
+		n := 1 // number of fields with the same exact name
+		for n < len(allFields) && allFields[n-1].name == allFields[n].name {
 			n++
 		}
+		if n == 1 || len(allFields[0].index) != len(allFields[1].index) || allFields[0].hasName != allFields[1].hasName {
+			flattened = append(flattened, allFields[0]) // only keep field if there is a dominant field
+		}
+		allFields = allFields[n:]
 	}
-	fs.flattened = fs.flattened[:n]
-	if fs.inlinedFallback == ambiguous {
-		fs.inlinedFallback = nil
-	}
-	if len(fs.flattened) != len(fs.byActualName) {
-		panic(fmt.Sprintf("BUG: flattened list of fields mismatches fields mapped by name: %d != %d", len(fs.flattened), len(fs.byActualName)))
+
+	// Sort the fields according to a breadth-first ordering
+	// so that we can re-number IDs with the smallest possible values.
+	// This optimizes use of uintSet such that it fits in the 64-entry bit set.
+	slices.SortFunc(flattened, func(x, y structField) int {
+		return cmp.Compare(x.id, y.id)
+	})
+	for i := range flattened {
+		flattened[i].id = i
 	}
 
-	// Sort the fields according to a depth-first ordering.
-	// This operation will cause pointers in byActualName to become incorrect,
-	// which we will correct in another loop shortly thereafter.
-	sort.Slice(fs.flattened, func(i, j int) bool {
-		si := fs.flattened[i].index
-		sj := fs.flattened[j].index
-		for len(si) > 0 && len(sj) > 0 {
-			switch {
-			case si[0] < sj[0]:
-				return true
-			case si[0] > sj[0]:
-				return false
-			default:
-				si = si[1:]
-				sj = sj[1:]
-			}
-		}
-		return len(si) < len(sj)
+	// Sort the fields according to a depth-first ordering
+	// as the typical order that fields are marshaled.
+	slices.SortFunc(flattened, func(x, y structField) int {
+		return slices.Compare(x.index, y.index)
 	})
 
-	// Recompute the mapping of fields in the byActualName map.
+	// Compute the mapping of fields in the byActualName map.
 	// Pre-fold all names so that we can lookup folded names quickly.
+	fs = structFields{
+		flattened:    flattened,
+		byActualName: make(map[string]*structField, len(flattened)),
+		byFoldedName: make(map[string][]*structField, len(flattened)),
+	}
 	for i, f := range fs.flattened {
 		foldedName := string(foldName([]byte(f.name)))
 		fs.byActualName[f.name] = &fs.flattened[i]
@@ -298,58 +331,99 @@ func makeStructFields(root reflect.Type) (structFields, *SemanticError) {
 	}
 	for foldedName, fields := range fs.byFoldedName {
 		if len(fields) > 1 {
-			// The precedence order for conflicting nocase names
+			// The precedence order for conflicting ignoreCase names
 			// is by breadth-first order, rather than depth-first order.
-			sort.Slice(fields, func(i, j int) bool {
-				return fields[i].id < fields[j].id
+			slices.SortFunc(fields, func(x, y *structField) int {
+				return cmp.Compare(x.id, y.id)
 			})
 			fs.byFoldedName[foldedName] = fields
 		}
 	}
+	if n := len(inlinedFallbacks); n == 1 || (n > 1 && len(inlinedFallbacks[0].index) != len(inlinedFallbacks[1].index)) {
+		fs.inlinedFallback = &inlinedFallbacks[0] // dominant inlined fallback field
+	}
+	fs.reindex()
+	return fs, serr
+}
+
+// indirectType unwraps one level of pointer indirection
+// similar to how Go only allows embedding either T or *T,
+// but not **T or P (which is a named pointer).
+func indirectType(t reflect.Type) reflect.Type {
+	if t.Kind() == reflect.Pointer && t.Name() == "" {
+		t = t.Elem()
+	}
+	return t
+}
 
-	return fs, nil
+// matchFoldedName matches a case-insensitive name depending on the options.
+// It assumes that foldName(f.name) == foldName(name).
+//
+// Case-insensitive matching is used if the `case:ignore` tag option is specified
+// or the MatchCaseInsensitiveNames call option is specified
+// (and the `case:strict` tag option is not specified).
+// Functionally, the `case:ignore` and `case:strict` tag options take precedence.
+//
+// The v1 definition of case-insensitivity operated under strings.EqualFold
+// and would strictly compare dashes and underscores,
+// while the v2 definition would ignore the presence of dashes and underscores.
+// Thus, if the MatchCaseSensitiveDelimiter call option is specified,
+// the match is further restricted to using strings.EqualFold.
+func (f *structField) matchFoldedName(name []byte, flags *jsonflags.Flags) bool {
+	if f.casing == caseIgnore || (flags.Get(jsonflags.MatchCaseInsensitiveNames) && f.casing != caseStrict) {
+		if !flags.Get(jsonflags.MatchCaseSensitiveDelimiter) || strings.EqualFold(string(name), f.name) {
+			return true
+		}
+	}
+	return false
 }
 
+const (
+	caseIgnore = 1
+	caseStrict = 2
+)
+
 type fieldOptions struct {
-	name       string
-	quotedName string // quoted name per RFC 8785, section 3.2.2.2.
-	hasName    bool
-	nocase     bool
-	inline     bool
-	unknown    bool
-	omitzero   bool
-	omitempty  bool
-	string     bool
-	format     string
+	name           string
+	quotedName     string // quoted name per RFC 8785, section 3.2.2.2.
+	hasName        bool
+	nameNeedEscape bool
+	casing         int8 // either 0, caseIgnore, or caseStrict
+	inline         bool
+	unknown        bool
+	omitzero       bool
+	omitempty      bool
+	string         bool
+	format         string
 }
 
 // parseFieldOptions parses the `json` tag in a Go struct field as
 // a structured set of options configuring parameters such as
 // the JSON member name and other features.
-// As a special case, it returns errIgnoredField if the field is ignored.
-func parseFieldOptions(sf reflect.StructField) (out fieldOptions, err error) {
+func parseFieldOptions(sf reflect.StructField) (out fieldOptions, ignored bool, err error) {
 	tag, hasTag := sf.Tag.Lookup("json")
+	tagOrig := tag
 
 	// Check whether this field is explicitly ignored.
 	if tag == "-" {
-		return fieldOptions{}, errIgnoredField
+		return fieldOptions{}, true, nil
 	}
 
-	// Check whether this field is unexported.
-	if !sf.IsExported() {
-		// In contrast to v1, v2 no longer forwards exported fields from
-		// embedded fields of unexported types since Go reflection does not
-		// allow the same set of operations that are available in normal cases
-		// of purely exported fields.
-		// See https://go.dev/issue/21357 and https://go.dev/issue/24153.
-		if sf.Anonymous {
-			return fieldOptions{}, fmt.Errorf("embedded Go struct field %s of an unexported type must be explicitly ignored with a `json:\"-\"` tag", sf.Type.Name())
-		}
+	// Check whether this field is unexported and not embedded,
+	// which Go reflection cannot mutate for the sake of serialization.
+	//
+	// An embedded field of an unexported type is still capable of
+	// forwarding exported fields, which may be JSON serialized.
+	// This technically operates on the edge of what is permissible by
+	// the Go language, but the most recent decision is to permit this.
+	//
+	// See https://go.dev/issue/24153 and https://go.dev/issue/32772.
+	if !sf.IsExported() && !sf.Anonymous {
 		// Tag options specified on an unexported field suggests user error.
 		if hasTag {
-			return fieldOptions{}, fmt.Errorf("unexported Go struct field %s cannot have non-ignored `json:%q` tag", sf.Name, tag)
+			err = cmp.Or(err, fmt.Errorf("unexported Go struct field %s cannot have non-ignored `json:%q` tag", sf.Name, tag))
 		}
-		return fieldOptions{}, errIgnoredField
+		return fieldOptions{}, true, err
 	}
 
 	// Determine the JSON member name for this Go field. A user-specified name
@@ -362,20 +436,38 @@ func parseFieldOptions(sf reflect.StructField) (out fieldOptions, err error) {
 		n := len(tag) - len(strings.TrimLeftFunc(tag, func(r rune) bool {
 			return !strings.ContainsRune(",\\'\"`", r) // reserve comma, backslash, and quotes
 		}))
-		opt := tag[:n]
-		if n == 0 {
-			// Allow a single quoted string for arbitrary names.
-			opt, n, err = consumeTagOption(tag)
-			if err != nil {
-				return fieldOptions{}, fmt.Errorf("Go struct field %s has malformed `json` tag: %v", sf.Name, err)
+		name := tag[:n]
+
+		// If the next character is not a comma, then the name is either
+		// malformed (if n > 0) or a single-quoted name.
+		// In either case, call consumeTagOption to handle it further.
+		var err2 error
+		if !strings.HasPrefix(tag[n:], ",") && len(name) != len(tag) {
+			name, n, err2 = consumeTagOption(tag)
+			if err2 != nil {
+				err = cmp.Or(err, fmt.Errorf("Go struct field %s has malformed `json` tag: %v", sf.Name, err2))
 			}
 		}
-		out.hasName = true
-		out.name = opt
+		if !utf8.ValidString(name) {
+			err = cmp.Or(err, fmt.Errorf("Go struct field %s has JSON object name %q with invalid UTF-8", sf.Name, name))
+			name = string([]rune(name)) // replace invalid UTF-8 with utf8.RuneError
+		}
+		if name == "-" && tag[0] == '-' {
+			defer func() { // defer to let other errors take precedence
+				err = cmp.Or(err, fmt.Errorf("Go struct field %s has JSON object name %q; either "+
+					"use `json:\"-\"` to ignore the field or "+
+					"use `json:\"'-'%s` to specify %q as the name", sf.Name, out.name, strings.TrimPrefix(strconv.Quote(tagOrig), `"-`), name))
+			}()
+		}
+		if err2 == nil {
+			out.hasName = true
+			out.name = name
+		}
 		tag = tag[n:]
 	}
-	b, _ := appendString(nil, out.name, false, nil)
+	b, _ := jsonwire.AppendQuote(nil, out.name, &jsonflags.Flags{})
 	out.quotedName = string(b)
+	out.nameNeedEscape = jsonwire.NeedEscape(out.name)
 
 	// Handle any additional tag options (if any).
 	var wasFormat bool
@@ -383,29 +475,53 @@ func parseFieldOptions(sf reflect.StructField) (out fieldOptions, err error) {
 	for len(tag) > 0 {
 		// Consume comma delimiter.
 		if tag[0] != ',' {
-			return fieldOptions{}, fmt.Errorf("Go struct field %s has malformed `json` tag: invalid character %q before next option (expecting ',')", sf.Name, tag[0])
-		}
-		tag = tag[len(","):]
-		if len(tag) == 0 {
-			return fieldOptions{}, fmt.Errorf("Go struct field %s has malformed `json` tag: invalid trailing ',' character", sf.Name)
+			err = cmp.Or(err, fmt.Errorf("Go struct field %s has malformed `json` tag: invalid character %q before next option (expecting ',')", sf.Name, tag[0]))
+		} else {
+			tag = tag[len(","):]
+			if len(tag) == 0 {
+				err = cmp.Or(err, fmt.Errorf("Go struct field %s has malformed `json` tag: invalid trailing ',' character", sf.Name))
+				break
+			}
 		}
 
 		// Consume and process the tag option.
-		opt, n, err := consumeTagOption(tag)
-		if err != nil {
-			return fieldOptions{}, fmt.Errorf("Go struct field %s has malformed `json` tag: %v", sf.Name, err)
+		opt, n, err2 := consumeTagOption(tag)
+		if err2 != nil {
+			err = cmp.Or(err, fmt.Errorf("Go struct field %s has malformed `json` tag: %v", sf.Name, err2))
 		}
 		rawOpt := tag[:n]
 		tag = tag[n:]
 		switch {
 		case wasFormat:
-			return fieldOptions{}, fmt.Errorf("Go struct field %s has `format` tag option that was not specified last", sf.Name)
+			err = cmp.Or(err, fmt.Errorf("Go struct field %s has `format` tag option that was not specified last", sf.Name))
 		case strings.HasPrefix(rawOpt, "'") && strings.TrimFunc(opt, isLetterOrDigit) == "":
-			return fieldOptions{}, fmt.Errorf("Go struct field %s has unnecessarily quoted appearance of `%s` tag option; specify `%s` instead", sf.Name, rawOpt, opt)
+			err = cmp.Or(err, fmt.Errorf("Go struct field %s has unnecessarily quoted appearance of `%s` tag option; specify `%s` instead", sf.Name, rawOpt, opt))
 		}
 		switch opt {
-		case "nocase":
-			out.nocase = true
+		case "case":
+			if !strings.HasPrefix(tag, ":") {
+				err = cmp.Or(err, fmt.Errorf("Go struct field %s is missing value for `case` tag option; specify `case:ignore` or `case:strict` instead", sf.Name))
+				break
+			}
+			tag = tag[len(":"):]
+			opt, n, err2 := consumeTagOption(tag)
+			if err2 != nil {
+				err = cmp.Or(err, fmt.Errorf("Go struct field %s has malformed value for `case` tag option: %v", sf.Name, err2))
+				break
+			}
+			rawOpt := tag[:n]
+			tag = tag[n:]
+			if strings.HasPrefix(rawOpt, "'") {
+				err = cmp.Or(err, fmt.Errorf("Go struct field %s has unnecessarily quoted appearance of `case:%s` tag option; specify `case:%s` instead", sf.Name, rawOpt, opt))
+			}
+			switch opt {
+			case "ignore":
+				out.casing |= caseIgnore
+			case "strict":
+				out.casing |= caseStrict
+			default:
+				err = cmp.Or(err, fmt.Errorf("Go struct field %s has unknown `case:%s` tag value", sf.Name, rawOpt))
+			}
 		case "inline":
 			out.inline = true
 		case "unknown":
@@ -418,12 +534,14 @@ func parseFieldOptions(sf reflect.StructField) (out fieldOptions, err error) {
 			out.string = true
 		case "format":
 			if !strings.HasPrefix(tag, ":") {
-				return fieldOptions{}, fmt.Errorf("Go struct field %s is missing value for `format` tag option", sf.Name)
+				err = cmp.Or(err, fmt.Errorf("Go struct field %s is missing value for `format` tag option", sf.Name))
+				break
 			}
 			tag = tag[len(":"):]
-			opt, n, err := consumeTagOption(tag)
-			if err != nil {
-				return fieldOptions{}, fmt.Errorf("Go struct field %s has malformed value for `format` tag option: %v", sf.Name, err)
+			opt, n, err2 := consumeTagOption(tag)
+			if err2 != nil {
+				err = cmp.Or(err, fmt.Errorf("Go struct field %s has malformed value for `format` tag option: %v", sf.Name, err2))
+				break
 			}
 			tag = tag[n:]
 			out.format = opt
@@ -433,8 +551,8 @@ func parseFieldOptions(sf reflect.StructField) (out fieldOptions, err error) {
 			// This catches invalid mutants such as "omitEmpty" or "omit_empty".
 			normOpt := strings.ReplaceAll(strings.ToLower(opt), "_", "")
 			switch normOpt {
-			case "nocase", "inline", "unknown", "omitzero", "omitempty", "string", "format":
-				return fieldOptions{}, fmt.Errorf("Go struct field %s has invalid appearance of `%s` tag option; specify `%s` instead", sf.Name, opt, normOpt)
+			case "case", "inline", "unknown", "omitzero", "omitempty", "string", "format":
+				err = cmp.Or(err, fmt.Errorf("Go struct field %s has invalid appearance of `%s` tag option; specify `%s` instead", sf.Name, opt, normOpt))
 			}
 
 			// NOTE: Everything else is ignored. This does not mean it is
@@ -443,15 +561,28 @@ func parseFieldOptions(sf reflect.StructField) (out fieldOptions, err error) {
 		}
 
 		// Reject duplicates.
-		if seenOpts[opt] {
-			return fieldOptions{}, fmt.Errorf("Go struct field %s has duplicate appearance of `%s` tag option", sf.Name, rawOpt)
+		switch {
+		case out.casing == caseIgnore|caseStrict:
+			err = cmp.Or(err, fmt.Errorf("Go struct field %s cannot have both `case:ignore` and `case:strict` tag options", sf.Name))
+		case seenOpts[opt]:
+			err = cmp.Or(err, fmt.Errorf("Go struct field %s has duplicate appearance of `%s` tag option", sf.Name, rawOpt))
 		}
 		seenOpts[opt] = true
 	}
-	return out, nil
+	return out, false, err
 }
 
+// consumeTagOption consumes the next option,
+// which is either a Go identifier or a single-quoted string.
+// If the next option is invalid, it returns all of in until the next comma,
+// and reports an error.
 func consumeTagOption(in string) (string, int, error) {
+	// For legacy compatibility with v1, assume options are comma-separated.
+	i := strings.IndexByte(in, ',')
+	if i < 0 {
+		i = len(in)
+	}
+
 	switch r, _ := utf8.DecodeRuneInString(in); {
 	// Option as a Go identifier.
 	case r == '_' || unicode.IsLetter(r):
@@ -486,7 +617,7 @@ func consumeTagOption(in string) (string, int, error) {
 				n += len(`'`)
 				out, err := strconv.Unquote(string(b))
 				if err != nil {
-					return "", 0, fmt.Errorf("invalid single-quoted string: %s", in[:n])
+					return in[:i], i, fmt.Errorf("invalid single-quoted string: %s", in[:n])
 				}
 				return out, n, nil
 			}
@@ -496,14 +627,26 @@ func consumeTagOption(in string) (string, int, error) {
 		if n > 10 {
 			n = 10 // limit the amount of context printed in the error
 		}
-		return "", 0, fmt.Errorf("single-quoted string not terminated: %s...", in[:n])
+		return in[:i], i, fmt.Errorf("single-quoted string not terminated: %s...", in[:n])
 	case len(in) == 0:
-		return "", 0, io.ErrUnexpectedEOF
+		return in[:i], i, io.ErrUnexpectedEOF
 	default:
-		return "", 0, fmt.Errorf("invalid character %q at start of option (expecting Unicode letter or single quote)", r)
+		return in[:i], i, fmt.Errorf("invalid character %q at start of option (expecting Unicode letter or single quote)", r)
 	}
 }
 
 func isLetterOrDigit(r rune) bool {
 	return r == '_' || unicode.IsLetter(r) || unicode.IsNumber(r)
 }
+
+// boolsCompare compares x and y, ordering false before true.
+func boolsCompare(x, y bool) int {
+	switch {
+	case !x && y:
+		return -1
+	default:
+		return 0
+	case x && !y:
+		return +1
+	}
+}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/intern.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/intern.go
index 700a56db0b..42fc3d4719 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/intern.go
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/intern.go
@@ -10,12 +10,12 @@ import (
 )
 
 // stringCache is a cache for strings converted from a []byte.
-type stringCache [256]string // 256*unsafe.Sizeof(string("")) => 4KiB
+type stringCache = [256]string // 256*unsafe.Sizeof(string("")) => 4KiB
 
-// make returns the string form of b.
+// makeString returns the string form of b.
 // It returns a pre-allocated string from c if present, otherwise
 // it allocates a new string, inserts it into the cache, and returns it.
-func (c *stringCache) make(b []byte) string {
+func makeString(c *stringCache, b []byte) string {
 	const (
 		minCachedLen = 2   // single byte strings are already interned by the runtime
 		maxCachedLen = 256 // large enough for UUIDs, IPv6 addresses, SHA-256 checksums, etc.
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/internal.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/internal.go
new file mode 100644
index 0000000000..05801c6b25
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/internal.go
@@ -0,0 +1,40 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package internal
+
+import "errors"
+
+// NotForPublicUse is a marker type that an API is for internal use only.
+// It does not perfectly prevent usage of that API, but helps to restrict usage.
+// Anything with this marker is not covered by the Go compatibility agreement.
+type NotForPublicUse struct{}
+
+// AllowInternalUse is passed from "json" to "jsontext" to authenticate
+// that the caller can have access to internal functionality.
+var AllowInternalUse NotForPublicUse
+
+// Sentinel error values internally shared between jsonv1 and jsonv2.
+var (
+	ErrCycle           = errors.New("encountered a cycle")
+	ErrNonNilReference = errors.New("value must be passed as a non-nil pointer reference")
+	ErrNilInterface    = errors.New("cannot derive concrete type for nil interface with finite type set")
+)
+
+var (
+	// TransformMarshalError converts a v2 error into a v1 error.
+	// It is called only at the top-level of a Marshal function.
+	TransformMarshalError func(any, error) error
+	// NewMarshalerError constructs a jsonv1.MarshalerError.
+	// It is called after a user-defined Marshal method/function fails.
+	NewMarshalerError func(any, error, string) error
+	// TransformUnmarshalError converts a v2 error into a v1 error.
+	// It is called only at the top-level of a Unmarshal function.
+	TransformUnmarshalError func(any, error) error
+
+	// NewRawNumber returns new(jsonv1.Number).
+	NewRawNumber func() any
+	// RawNumberOf returns jsonv1.Number(b).
+	RawNumberOf func(b []byte) any
+)
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags/flags.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags/flags.go
new file mode 100644
index 0000000000..810128b516
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags/flags.go
@@ -0,0 +1,213 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// jsonflags implements all the optional boolean flags.
+// These flags are shared across both "json", "jsontext", and "jsonopts".
+package jsonflags
+
+import "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal"
+
+// Bools represents zero or more boolean flags, all set to true or false.
+// The least-significant bit is the boolean value of all flags in the set.
+// The remaining bits identify which particular flags.
+//
+// In common usage, this is OR'd with 0 or 1. For example:
+//   - (AllowInvalidUTF8 | 0) means "AllowInvalidUTF8 is false"
+//   - (Multiline | Indent | 1) means "Multiline and Indent are true"
+type Bools uint64
+
+func (Bools) JSONOptions(internal.NotForPublicUse) {}
+
+const (
+	// AllFlags is the set of all flags.
+	AllFlags = AllCoderFlags | AllArshalV2Flags | AllArshalV1Flags
+
+	// AllCoderFlags is the set of all encoder/decoder flags.
+	AllCoderFlags = (maxCoderFlag - 1) - initFlag
+
+	// AllArshalV2Flags is the set of all v2 marshal/unmarshal flags.
+	AllArshalV2Flags = (maxArshalV2Flag - 1) - (maxCoderFlag - 1)
+
+	// AllArshalV1Flags is the set of all v1 marshal/unmarshal flags.
+	AllArshalV1Flags = (maxArshalV1Flag - 1) - (maxArshalV2Flag - 1)
+
+	// NonBooleanFlags is the set of non-boolean flags,
+	// where the value is some other concrete Go type.
+	// The value of the flag is stored within jsonopts.Struct.
+	NonBooleanFlags = 0 |
+		Indent |
+		IndentPrefix |
+		ByteLimit |
+		DepthLimit |
+		Marshalers |
+		Unmarshalers
+
+	// DefaultV1Flags is the set of booleans flags that default to true under
+	// v1 semantics. None of the non-boolean flags differ between v1 and v2.
+	DefaultV1Flags = 0 |
+		AllowDuplicateNames |
+		AllowInvalidUTF8 |
+		EscapeForHTML |
+		EscapeForJS |
+		PreserveRawStrings |
+		Deterministic |
+		FormatNilMapAsNull |
+		FormatNilSliceAsNull |
+		MatchCaseInsensitiveNames |
+		CallMethodsWithLegacySemantics |
+		FormatByteArrayAsArray |
+		FormatBytesWithLegacySemantics |
+		FormatDurationAsNano |
+		MatchCaseSensitiveDelimiter |
+		MergeWithLegacySemantics |
+		OmitEmptyWithLegacySemantics |
+		ParseBytesWithLooseRFC4648 |
+		ParseTimeWithLooseRFC3339 |
+		ReportErrorsWithLegacySemantics |
+		StringifyWithLegacySemantics |
+		UnmarshalArrayFromAnyLength
+
+	// AnyWhitespace reports whether the encoded output might have any whitespace.
+	AnyWhitespace = Multiline | SpaceAfterColon | SpaceAfterComma
+
+	// WhitespaceFlags is the set of flags related to whitespace formatting.
+	// In contrast to AnyWhitespace, this includes Indent and IndentPrefix
+	// as those settings take no effect if Multiline is false.
+	WhitespaceFlags = AnyWhitespace | Indent | IndentPrefix
+
+	// AnyEscape is the set of flags related to escaping in a JSON string.
+	AnyEscape = EscapeForHTML | EscapeForJS
+
+	// CanonicalizeNumbers is the set of flags related to raw number canonicalization.
+	CanonicalizeNumbers = CanonicalizeRawInts | CanonicalizeRawFloats
+)
+
+// Encoder and decoder flags.
+const (
+	initFlag Bools = 1 << iota // reserved for the boolean value itself
+
+	AllowDuplicateNames   // encode or decode
+	AllowInvalidUTF8      // encode or decode
+	WithinArshalCall      // encode or decode; for internal use by json.Marshal and json.Unmarshal
+	OmitTopLevelNewline   // encode only; for internal use by json.Marshal and json.MarshalWrite
+	PreserveRawStrings    // encode only
+	CanonicalizeRawInts   // encode only
+	CanonicalizeRawFloats // encode only
+	ReorderRawObjects     // encode only
+	EscapeForHTML         // encode only
+	EscapeForJS           // encode only
+	Multiline             // encode only
+	SpaceAfterColon       // encode only
+	SpaceAfterComma       // encode only
+	Indent                // encode only; non-boolean flag
+	IndentPrefix          // encode only; non-boolean flag
+	ByteLimit             // encode or decode; non-boolean flag
+	DepthLimit            // encode or decode; non-boolean flag
+
+	maxCoderFlag
+)
+
+// Marshal and Unmarshal flags (for v2).
+const (
+	_ Bools = (maxCoderFlag >> 1) << iota
+
+	StringifyNumbers          // marshal or unmarshal
+	Deterministic             // marshal only
+	FormatNilMapAsNull        // marshal only
+	FormatNilSliceAsNull      // marshal only
+	OmitZeroStructFields      // marshal only
+	MatchCaseInsensitiveNames // marshal or unmarshal
+	DiscardUnknownMembers     // marshal only
+	RejectUnknownMembers      // unmarshal only
+	Marshalers                // marshal only; non-boolean flag
+	Unmarshalers              // unmarshal only; non-boolean flag
+
+	maxArshalV2Flag
+)
+
+// Marshal and Unmarshal flags (for v1).
+const (
+	_ Bools = (maxArshalV2Flag >> 1) << iota
+
+	CallMethodsWithLegacySemantics  // marshal or unmarshal
+	FormatByteArrayAsArray          // marshal or unmarshal
+	FormatBytesWithLegacySemantics  // marshal or unmarshal
+	FormatDurationAsNano            // marshal or unmarshal
+	MatchCaseSensitiveDelimiter     // marshal or unmarshal
+	MergeWithLegacySemantics        // unmarshal
+	OmitEmptyWithLegacySemantics    // marshal
+	ParseBytesWithLooseRFC4648      // unmarshal
+	ParseTimeWithLooseRFC3339       // unmarshal
+	ReportErrorsWithLegacySemantics // marshal or unmarshal
+	StringifyWithLegacySemantics    // marshal or unmarshal
+	StringifyBoolsAndStrings        // marshal or unmarshal; for internal use by jsonv2.makeStructArshaler
+	UnmarshalAnyWithRawNumber       // unmarshal; for internal use by jsonv1.Decoder.UseNumber
+	UnmarshalArrayFromAnyLength     // unmarshal
+
+	maxArshalV1Flag
+)
+
+// bitsUsed is the number of bits used in the 64-bit boolean flags
+const bitsUsed = 42
+
+// Static compile check that bitsUsed and maxArshalV1Flag are in sync.
+const _ = uint64((1<<bitsUsed)-maxArshalV1Flag) + uint64(maxArshalV1Flag-(1<<bitsUsed))
+
+// Flags is a set of boolean flags.
+// If the presence bit is zero, then the value bit must also be zero.
+// The least-significant bit of both fields is always zero.
+//
+// Unlike Bools, which can represent a set of bools that are all true or false,
+// Flags represents a set of bools, each individually may be true or false.
+type Flags struct{ Presence, Values uint64 }
+
+// Join joins two sets of flags such that the latter takes precedence.
+func (dst *Flags) Join(src Flags) {
+	// Copy over all source presence bits over to the destination (using OR),
+	// then invert the source presence bits to clear out source value (using AND-NOT),
+	// then copy over source value bits over to the destination (using OR).
+	//	e.g., dst := Flags{Presence: 0b_1100_0011, Value: 0b_1000_0011}
+	//	e.g., src := Flags{Presence: 0b_0101_1010, Value: 0b_1001_0010}
+	dst.Presence |= src.Presence // e.g., 0b_1100_0011 | 0b_0101_1010 -> 0b_110_11011
+	dst.Values &= ^src.Presence  // e.g., 0b_1000_0011 & 0b_1010_0101 -> 0b_100_00001
+	dst.Values |= src.Values     // e.g., 0b_1000_0001 | 0b_1001_0010 -> 0b_100_10011
+}
+
+// Set sets both the presence and value for the provided bool (or set of bools).
+func (fs *Flags) Set(f Bools) {
+	// Select out the bits for the flag identifiers (everything except LSB),
+	// then set the presence for all the identifier bits (using OR),
+	// then invert the identifier bits to clear out the values (using AND-NOT),
+	// then copy over all the identifier bits to the value if LSB is 1.
+	//	e.g., fs := Flags{Presence: 0b_0101_0010, Value: 0b_0001_0010}
+	//	e.g., f := 0b_1001_0001
+	id := uint64(f) &^ uint64(1)  // e.g., 0b_1001_0001 & 0b_1111_1110 -> 0b_1001_0000
+	fs.Presence |= id             // e.g., 0b_0101_0010 | 0b_1001_0000 -> 0b_1101_0011
+	fs.Values &= ^id              // e.g., 0b_0001_0010 & 0b_0110_1111 -> 0b_0000_0010
+	fs.Values |= uint64(f&1) * id // e.g., 0b_0000_0010 | 0b_1001_0000 -> 0b_1001_0010
+}
+
+// Get reports whether the bool (or any of the bools) is true.
+// This is generally only used with a singular bool.
+// The value bit of f (i.e., the LSB) is ignored.
+func (fs Flags) Get(f Bools) bool {
+	return fs.Values&uint64(f) > 0
+}
+
+// Has reports whether the bool (or any of the bools) is set.
+// The value bit of f (i.e., the LSB) is ignored.
+func (fs Flags) Has(f Bools) bool {
+	return fs.Presence&uint64(f) > 0
+}
+
+// Clear clears both the presence and value for the provided bool or bools.
+// The value bit of f (i.e., the LSB) is ignored.
+func (fs *Flags) Clear(f Bools) {
+	// Invert f to produce a mask to clear all bits in f (using AND).
+	//	e.g., fs := Flags{Presence: 0b_0101_0010, Value: 0b_0001_0010}
+	//	e.g., f := 0b_0001_1000
+	mask := uint64(^f)  // e.g., 0b_0001_1000 -> 0b_1110_0111
+	fs.Presence &= mask // e.g., 0b_0101_0010 &  0b_1110_0111 -> 0b_0100_0010
+	fs.Values &= mask   // e.g., 0b_0001_0010 &  0b_1110_0111 -> 0b_0000_0010
+}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts/options.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts/options.go
new file mode 100644
index 0000000000..142653518d
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts/options.go
@@ -0,0 +1,200 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package jsonopts
+
+import (
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+)
+
+// Options is the common options type shared across json packages.
+type Options interface {
+	// JSONOptions is exported so related json packages can implement Options.
+	JSONOptions(internal.NotForPublicUse)
+}
+
+// Struct is the combination of all options in struct form.
+// This is efficient to pass down the call stack and to query.
+type Struct struct {
+	Flags jsonflags.Flags
+
+	CoderValues
+	ArshalValues
+}
+
+type CoderValues struct {
+	Indent       string // jsonflags.Indent
+	IndentPrefix string // jsonflags.IndentPrefix
+	ByteLimit    int64  // jsonflags.ByteLimit
+	DepthLimit   int    // jsonflags.DepthLimit
+}
+
+type ArshalValues struct {
+	// The Marshalers and Unmarshalers fields use the any type to avoid a
+	// concrete dependency on *json.Marshalers and *json.Unmarshalers,
+	// which would in turn create a dependency on the "reflect" package.
+
+	Marshalers   any // jsonflags.Marshalers
+	Unmarshalers any // jsonflags.Unmarshalers
+
+	Format      string
+	FormatDepth int
+}
+
+// DefaultOptionsV2 is the set of all options that define default v2 behavior.
+var DefaultOptionsV2 = Struct{
+	Flags: jsonflags.Flags{
+		Presence: uint64(jsonflags.AllFlags & ^jsonflags.WhitespaceFlags),
+		Values:   uint64(0),
+	},
+}
+
+// DefaultOptionsV1 is the set of all options that define default v1 behavior.
+var DefaultOptionsV1 = Struct{
+	Flags: jsonflags.Flags{
+		Presence: uint64(jsonflags.AllFlags & ^jsonflags.WhitespaceFlags),
+		Values:   uint64(jsonflags.DefaultV1Flags),
+	},
+}
+
+func (*Struct) JSONOptions(internal.NotForPublicUse) {}
+
+// GetUnknownOption is injected by the "json" package to handle Options
+// declared in that package so that "jsonopts" can handle them.
+var GetUnknownOption = func(Struct, Options) (any, bool) { panic("unknown option") }
+
+func GetOption[T any](opts Options, setter func(T) Options) (T, bool) {
+	// Collapse the options to *Struct to simplify lookup.
+	structOpts, ok := opts.(*Struct)
+	if !ok {
+		var structOpts2 Struct
+		structOpts2.Join(opts)
+		structOpts = &structOpts2
+	}
+
+	// Lookup the option based on the return value of the setter.
+	var zero T
+	switch opt := setter(zero).(type) {
+	case jsonflags.Bools:
+		v := structOpts.Flags.Get(opt)
+		ok := structOpts.Flags.Has(opt)
+		return any(v).(T), ok
+	case Indent:
+		if !structOpts.Flags.Has(jsonflags.Indent) {
+			return zero, false
+		}
+		return any(structOpts.Indent).(T), true
+	case IndentPrefix:
+		if !structOpts.Flags.Has(jsonflags.IndentPrefix) {
+			return zero, false
+		}
+		return any(structOpts.IndentPrefix).(T), true
+	case ByteLimit:
+		if !structOpts.Flags.Has(jsonflags.ByteLimit) {
+			return zero, false
+		}
+		return any(structOpts.ByteLimit).(T), true
+	case DepthLimit:
+		if !structOpts.Flags.Has(jsonflags.DepthLimit) {
+			return zero, false
+		}
+		return any(structOpts.DepthLimit).(T), true
+	default:
+		v, ok := GetUnknownOption(*structOpts, opt)
+		return v.(T), ok
+	}
+}
+
+// JoinUnknownOption is injected by the "json" package to handle Options
+// declared in that package so that "jsonopts" can handle them.
+var JoinUnknownOption = func(Struct, Options) Struct { panic("unknown option") }
+
+func (dst *Struct) Join(srcs ...Options) {
+	dst.join(false, srcs...)
+}
+
+func (dst *Struct) JoinWithoutCoderOptions(srcs ...Options) {
+	dst.join(true, srcs...)
+}
+
+func (dst *Struct) join(excludeCoderOptions bool, srcs ...Options) {
+	for _, src := range srcs {
+		switch src := src.(type) {
+		case nil:
+			continue
+		case jsonflags.Bools:
+			if excludeCoderOptions {
+				src &= ^jsonflags.AllCoderFlags
+			}
+			dst.Flags.Set(src)
+		case Indent:
+			if excludeCoderOptions {
+				continue
+			}
+			dst.Flags.Set(jsonflags.Multiline | jsonflags.Indent | 1)
+			dst.Indent = string(src)
+		case IndentPrefix:
+			if excludeCoderOptions {
+				continue
+			}
+			dst.Flags.Set(jsonflags.Multiline | jsonflags.IndentPrefix | 1)
+			dst.IndentPrefix = string(src)
+		case ByteLimit:
+			if excludeCoderOptions {
+				continue
+			}
+			dst.Flags.Set(jsonflags.ByteLimit | 1)
+			dst.ByteLimit = int64(src)
+		case DepthLimit:
+			if excludeCoderOptions {
+				continue
+			}
+			dst.Flags.Set(jsonflags.DepthLimit | 1)
+			dst.DepthLimit = int(src)
+		case *Struct:
+			srcFlags := src.Flags // shallow copy the flags
+			if excludeCoderOptions {
+				srcFlags.Clear(jsonflags.AllCoderFlags)
+			}
+			dst.Flags.Join(srcFlags)
+			if srcFlags.Has(jsonflags.NonBooleanFlags) {
+				if srcFlags.Has(jsonflags.Indent) {
+					dst.Indent = src.Indent
+				}
+				if srcFlags.Has(jsonflags.IndentPrefix) {
+					dst.IndentPrefix = src.IndentPrefix
+				}
+				if srcFlags.Has(jsonflags.ByteLimit) {
+					dst.ByteLimit = src.ByteLimit
+				}
+				if srcFlags.Has(jsonflags.DepthLimit) {
+					dst.DepthLimit = src.DepthLimit
+				}
+				if srcFlags.Has(jsonflags.Marshalers) {
+					dst.Marshalers = src.Marshalers
+				}
+				if srcFlags.Has(jsonflags.Unmarshalers) {
+					dst.Unmarshalers = src.Unmarshalers
+				}
+			}
+		default:
+			*dst = JoinUnknownOption(*dst, src)
+		}
+	}
+}
+
+type (
+	Indent       string // jsontext.WithIndent
+	IndentPrefix string // jsontext.WithIndentPrefix
+	ByteLimit    int64  // jsontext.WithByteLimit
+	DepthLimit   int    // jsontext.WithDepthLimit
+	// type for jsonflags.Marshalers declared in "json" package
+	// type for jsonflags.Unmarshalers declared in "json" package
+)
+
+func (Indent) JSONOptions(internal.NotForPublicUse)       {}
+func (IndentPrefix) JSONOptions(internal.NotForPublicUse) {}
+func (ByteLimit) JSONOptions(internal.NotForPublicUse)    {}
+func (DepthLimit) JSONOptions(internal.NotForPublicUse)   {}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/decode.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/decode.go
new file mode 100644
index 0000000000..02787719ca
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/decode.go
@@ -0,0 +1,627 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package jsonwire
+
+import (
+	"io"
+	"math"
+	"slices"
+	"strconv"
+	"unicode/utf16"
+	"unicode/utf8"
+)
+
+type ValueFlags uint
+
+const (
+	_ ValueFlags = (1 << iota) / 2 // powers of two starting with zero
+
+	stringNonVerbatim  // string cannot be naively treated as valid UTF-8
+	stringNonCanonical // string not formatted according to RFC 8785, section 3.2.2.2.
+	// TODO: Track whether a number is a non-integer?
+)
+
+func (f *ValueFlags) Join(f2 ValueFlags) { *f |= f2 }
+func (f ValueFlags) IsVerbatim() bool    { return f&stringNonVerbatim == 0 }
+func (f ValueFlags) IsCanonical() bool   { return f&stringNonCanonical == 0 }
+
+// ConsumeWhitespace consumes leading JSON whitespace per RFC 7159, section 2.
+func ConsumeWhitespace(b []byte) (n int) {
+	// NOTE: The arguments and logic are kept simple to keep this inlinable.
+	for len(b) > n && (b[n] == ' ' || b[n] == '\t' || b[n] == '\r' || b[n] == '\n') {
+		n++
+	}
+	return n
+}
+
+// ConsumeNull consumes the next JSON null literal per RFC 7159, section 3.
+// It returns 0 if it is invalid, in which case consumeLiteral should be used.
+func ConsumeNull(b []byte) int {
+	// NOTE: The arguments and logic are kept simple to keep this inlinable.
+	const literal = "null"
+	if len(b) >= len(literal) && string(b[:len(literal)]) == literal {
+		return len(literal)
+	}
+	return 0
+}
+
+// ConsumeFalse consumes the next JSON false literal per RFC 7159, section 3.
+// It returns 0 if it is invalid, in which case consumeLiteral should be used.
+func ConsumeFalse(b []byte) int {
+	// NOTE: The arguments and logic are kept simple to keep this inlinable.
+	const literal = "false"
+	if len(b) >= len(literal) && string(b[:len(literal)]) == literal {
+		return len(literal)
+	}
+	return 0
+}
+
+// ConsumeTrue consumes the next JSON true literal per RFC 7159, section 3.
+// It returns 0 if it is invalid, in which case consumeLiteral should be used.
+func ConsumeTrue(b []byte) int {
+	// NOTE: The arguments and logic are kept simple to keep this inlinable.
+	const literal = "true"
+	if len(b) >= len(literal) && string(b[:len(literal)]) == literal {
+		return len(literal)
+	}
+	return 0
+}
+
+// ConsumeLiteral consumes the next JSON literal per RFC 7159, section 3.
+// If the input appears truncated, it returns io.ErrUnexpectedEOF.
+func ConsumeLiteral(b []byte, lit string) (n int, err error) {
+	for i := 0; i < len(b) && i < len(lit); i++ {
+		if b[i] != lit[i] {
+			return i, NewInvalidCharacterError(b[i:], "in literal "+lit+" (expecting "+strconv.QuoteRune(rune(lit[i]))+")")
+		}
+	}
+	if len(b) < len(lit) {
+		return len(b), io.ErrUnexpectedEOF
+	}
+	return len(lit), nil
+}
+
+// ConsumeSimpleString consumes the next JSON string per RFC 7159, section 7
+// but is limited to the grammar for an ASCII string without escape sequences.
+// It returns 0 if it is invalid or more complicated than a simple string,
+// in which case consumeString should be called.
+//
+// It rejects '<', '>', and '&' for compatibility reasons since these were
+// always escaped in the v1 implementation. Thus, if this function reports
+// non-zero then we know that the string would be encoded the same way
+// under both v1 or v2 escape semantics.
+func ConsumeSimpleString(b []byte) (n int) {
+	// NOTE: The arguments and logic are kept simple to keep this inlinable.
+	if len(b) > 0 && b[0] == '"' {
+		n++
+		for len(b) > n && b[n] < utf8.RuneSelf && escapeASCII[b[n]] == 0 {
+			n++
+		}
+		if uint(len(b)) > uint(n) && b[n] == '"' {
+			n++
+			return n
+		}
+	}
+	return 0
+}
+
+// ConsumeString consumes the next JSON string per RFC 7159, section 7.
+// If validateUTF8 is false, then this allows the presence of invalid UTF-8
+// characters within the string itself.
+// It reports the number of bytes consumed and whether an error was encountered.
+// If the input appears truncated, it returns io.ErrUnexpectedEOF.
+func ConsumeString(flags *ValueFlags, b []byte, validateUTF8 bool) (n int, err error) {
+	return ConsumeStringResumable(flags, b, 0, validateUTF8)
+}
+
+// ConsumeStringResumable is identical to consumeString but supports resuming
+// from a previous call that returned io.ErrUnexpectedEOF.
+func ConsumeStringResumable(flags *ValueFlags, b []byte, resumeOffset int, validateUTF8 bool) (n int, err error) {
+	// Consume the leading double quote.
+	switch {
+	case resumeOffset > 0:
+		n = resumeOffset // already handled the leading quote
+	case uint(len(b)) == 0:
+		return n, io.ErrUnexpectedEOF
+	case b[0] == '"':
+		n++
+	default:
+		return n, NewInvalidCharacterError(b[n:], `at start of string (expecting '"')`)
+	}
+
+	// Consume every character in the string.
+	for uint(len(b)) > uint(n) {
+		// Optimize for long sequences of unescaped characters.
+		noEscape := func(c byte) bool {
+			return c < utf8.RuneSelf && ' ' <= c && c != '\\' && c != '"'
+		}
+		for uint(len(b)) > uint(n) && noEscape(b[n]) {
+			n++
+		}
+		if uint(len(b)) <= uint(n) {
+			return n, io.ErrUnexpectedEOF
+		}
+
+		// Check for terminating double quote.
+		if b[n] == '"' {
+			n++
+			return n, nil
+		}
+
+		switch r, rn := utf8.DecodeRune(b[n:]); {
+		// Handle UTF-8 encoded byte sequence.
+		// Due to specialized handling of ASCII above, we know that
+		// all normal sequences at this point must be 2 bytes or larger.
+		case rn > 1:
+			n += rn
+		// Handle escape sequence.
+		case r == '\\':
+			flags.Join(stringNonVerbatim)
+			resumeOffset = n
+			if uint(len(b)) < uint(n+2) {
+				return resumeOffset, io.ErrUnexpectedEOF
+			}
+			switch r := b[n+1]; r {
+			case '/':
+				// Forward slash is the only character with 3 representations.
+				// Per RFC 8785, section 3.2.2.2., this must not be escaped.
+				flags.Join(stringNonCanonical)
+				n += 2
+			case '"', '\\', 'b', 'f', 'n', 'r', 't':
+				n += 2
+			case 'u':
+				if uint(len(b)) < uint(n+6) {
+					if hasEscapedUTF16Prefix(b[n:], false) {
+						return resumeOffset, io.ErrUnexpectedEOF
+					}
+					flags.Join(stringNonCanonical)
+					return n, NewInvalidEscapeSequenceError(b[n:])
+				}
+				v1, ok := parseHexUint16(b[n+2 : n+6])
+				if !ok {
+					flags.Join(stringNonCanonical)
+					return n, NewInvalidEscapeSequenceError(b[n : n+6])
+				}
+				// Only certain control characters can use the \uFFFF notation
+				// for canonical formatting (per RFC 8785, section 3.2.2.2.).
+				switch v1 {
+				// \uFFFF notation not permitted for these characters.
+				case '\b', '\f', '\n', '\r', '\t':
+					flags.Join(stringNonCanonical)
+				default:
+					// \uFFFF notation only permitted for control characters.
+					if v1 >= ' ' {
+						flags.Join(stringNonCanonical)
+					} else {
+						// \uFFFF notation must be lower case.
+						for _, c := range b[n+2 : n+6] {
+							if 'A' <= c && c <= 'F' {
+								flags.Join(stringNonCanonical)
+							}
+						}
+					}
+				}
+				n += 6
+
+				r := rune(v1)
+				if validateUTF8 && utf16.IsSurrogate(r) {
+					if uint(len(b)) < uint(n+6) {
+						if hasEscapedUTF16Prefix(b[n:], true) {
+							return resumeOffset, io.ErrUnexpectedEOF
+						}
+						flags.Join(stringNonCanonical)
+						return n - 6, NewInvalidEscapeSequenceError(b[n-6:])
+					} else if v2, ok := parseHexUint16(b[n+2 : n+6]); b[n] != '\\' || b[n+1] != 'u' || !ok {
+						flags.Join(stringNonCanonical)
+						return n - 6, NewInvalidEscapeSequenceError(b[n-6 : n+6])
+					} else if r = utf16.DecodeRune(rune(v1), rune(v2)); r == utf8.RuneError {
+						flags.Join(stringNonCanonical)
+						return n - 6, NewInvalidEscapeSequenceError(b[n-6 : n+6])
+					} else {
+						n += 6
+					}
+				}
+			default:
+				flags.Join(stringNonCanonical)
+				return n, NewInvalidEscapeSequenceError(b[n : n+2])
+			}
+		// Handle invalid UTF-8.
+		case r == utf8.RuneError:
+			if !utf8.FullRune(b[n:]) {
+				return n, io.ErrUnexpectedEOF
+			}
+			flags.Join(stringNonVerbatim | stringNonCanonical)
+			if validateUTF8 {
+				return n, ErrInvalidUTF8
+			}
+			n++
+		// Handle invalid control characters.
+		case r < ' ':
+			flags.Join(stringNonVerbatim | stringNonCanonical)
+			return n, NewInvalidCharacterError(b[n:], "in string (expecting non-control character)")
+		default:
+			panic("BUG: unhandled character " + QuoteRune(b[n:]))
+		}
+	}
+	return n, io.ErrUnexpectedEOF
+}
+
+// AppendUnquote appends the unescaped form of a JSON string in src to dst.
+// Any invalid UTF-8 within the string will be replaced with utf8.RuneError,
+// but the error will be specified as having encountered such an error.
+// The input must be an entire JSON string with no surrounding whitespace.
+func AppendUnquote[Bytes ~[]byte | ~string](dst []byte, src Bytes) (v []byte, err error) {
+	dst = slices.Grow(dst, len(src))
+
+	// Consume the leading double quote.
+	var i, n int
+	switch {
+	case uint(len(src)) == 0:
+		return dst, io.ErrUnexpectedEOF
+	case src[0] == '"':
+		i, n = 1, 1
+	default:
+		return dst, NewInvalidCharacterError(src, `at start of string (expecting '"')`)
+	}
+
+	// Consume every character in the string.
+	for uint(len(src)) > uint(n) {
+		// Optimize for long sequences of unescaped characters.
+		noEscape := func(c byte) bool {
+			return c < utf8.RuneSelf && ' ' <= c && c != '\\' && c != '"'
+		}
+		for uint(len(src)) > uint(n) && noEscape(src[n]) {
+			n++
+		}
+		if uint(len(src)) <= uint(n) {
+			dst = append(dst, src[i:n]...)
+			return dst, io.ErrUnexpectedEOF
+		}
+
+		// Check for terminating double quote.
+		if src[n] == '"' {
+			dst = append(dst, src[i:n]...)
+			n++
+			if n < len(src) {
+				err = NewInvalidCharacterError(src[n:], "after string value")
+			}
+			return dst, err
+		}
+
+		switch r, rn := utf8.DecodeRuneInString(string(truncateMaxUTF8(src[n:]))); {
+		// Handle UTF-8 encoded byte sequence.
+		// Due to specialized handling of ASCII above, we know that
+		// all normal sequences at this point must be 2 bytes or larger.
+		case rn > 1:
+			n += rn
+		// Handle escape sequence.
+		case r == '\\':
+			dst = append(dst, src[i:n]...)
+
+			// Handle escape sequence.
+			if uint(len(src)) < uint(n+2) {
+				return dst, io.ErrUnexpectedEOF
+			}
+			switch r := src[n+1]; r {
+			case '"', '\\', '/':
+				dst = append(dst, r)
+				n += 2
+			case 'b':
+				dst = append(dst, '\b')
+				n += 2
+			case 'f':
+				dst = append(dst, '\f')
+				n += 2
+			case 'n':
+				dst = append(dst, '\n')
+				n += 2
+			case 'r':
+				dst = append(dst, '\r')
+				n += 2
+			case 't':
+				dst = append(dst, '\t')
+				n += 2
+			case 'u':
+				if uint(len(src)) < uint(n+6) {
+					if hasEscapedUTF16Prefix(src[n:], false) {
+						return dst, io.ErrUnexpectedEOF
+					}
+					return dst, NewInvalidEscapeSequenceError(src[n:])
+				}
+				v1, ok := parseHexUint16(src[n+2 : n+6])
+				if !ok {
+					return dst, NewInvalidEscapeSequenceError(src[n : n+6])
+				}
+				n += 6
+
+				// Check whether this is a surrogate half.
+				r := rune(v1)
+				if utf16.IsSurrogate(r) {
+					r = utf8.RuneError // assume failure unless the following succeeds
+					if uint(len(src)) < uint(n+6) {
+						if hasEscapedUTF16Prefix(src[n:], true) {
+							return utf8.AppendRune(dst, r), io.ErrUnexpectedEOF
+						}
+						err = NewInvalidEscapeSequenceError(src[n-6:])
+					} else if v2, ok := parseHexUint16(src[n+2 : n+6]); src[n] != '\\' || src[n+1] != 'u' || !ok {
+						err = NewInvalidEscapeSequenceError(src[n-6 : n+6])
+					} else if r = utf16.DecodeRune(rune(v1), rune(v2)); r == utf8.RuneError {
+						err = NewInvalidEscapeSequenceError(src[n-6 : n+6])
+					} else {
+						n += 6
+					}
+				}
+
+				dst = utf8.AppendRune(dst, r)
+			default:
+				return dst, NewInvalidEscapeSequenceError(src[n : n+2])
+			}
+			i = n
+		// Handle invalid UTF-8.
+		case r == utf8.RuneError:
+			dst = append(dst, src[i:n]...)
+			if !utf8.FullRuneInString(string(truncateMaxUTF8(src[n:]))) {
+				return dst, io.ErrUnexpectedEOF
+			}
+			// NOTE: An unescaped string may be longer than the escaped string
+			// because invalid UTF-8 bytes are being replaced.
+			dst = append(dst, "\uFFFD"...)
+			n += rn
+			i = n
+			err = ErrInvalidUTF8
+		// Handle invalid control characters.
+		case r < ' ':
+			dst = append(dst, src[i:n]...)
+			return dst, NewInvalidCharacterError(src[n:], "in string (expecting non-control character)")
+		default:
+			panic("BUG: unhandled character " + QuoteRune(src[n:]))
+		}
+	}
+	dst = append(dst, src[i:n]...)
+	return dst, io.ErrUnexpectedEOF
+}
+
+// hasEscapedUTF16Prefix reports whether b is possibly
+// the truncated prefix of a \uFFFF escape sequence.
+func hasEscapedUTF16Prefix[Bytes ~[]byte | ~string](b Bytes, lowerSurrogateHalf bool) bool {
+	for i := range len(b) {
+		switch c := b[i]; {
+		case i == 0 && c != '\\':
+			return false
+		case i == 1 && c != 'u':
+			return false
+		case i == 2 && lowerSurrogateHalf && c != 'd' && c != 'D':
+			return false // not within ['\uDC00':'\uDFFF']
+		case i == 3 && lowerSurrogateHalf && !('c' <= c && c <= 'f') && !('C' <= c && c <= 'F'):
+			return false // not within ['\uDC00':'\uDFFF']
+		case i >= 2 && i < 6 && !('0' <= c && c <= '9') && !('a' <= c && c <= 'f') && !('A' <= c && c <= 'F'):
+			return false
+		}
+	}
+	return true
+}
+
+// UnquoteMayCopy returns the unescaped form of b.
+// If there are no escaped characters, the output is simply a subslice of
+// the input with the surrounding quotes removed.
+// Otherwise, a new buffer is allocated for the output.
+// It assumes the input is valid.
+func UnquoteMayCopy(b []byte, isVerbatim bool) []byte {
+	// NOTE: The arguments and logic are kept simple to keep this inlinable.
+	if isVerbatim {
+		return b[len(`"`) : len(b)-len(`"`)]
+	}
+	b, _ = AppendUnquote(nil, b)
+	return b
+}
+
+// ConsumeSimpleNumber consumes the next JSON number per RFC 7159, section 6
+// but is limited to the grammar for a positive integer.
+// It returns 0 if it is invalid or more complicated than a simple integer,
+// in which case consumeNumber should be called.
+func ConsumeSimpleNumber(b []byte) (n int) {
+	// NOTE: The arguments and logic are kept simple to keep this inlinable.
+	if len(b) > 0 {
+		if b[0] == '0' {
+			n++
+		} else if '1' <= b[0] && b[0] <= '9' {
+			n++
+			for len(b) > n && ('0' <= b[n] && b[n] <= '9') {
+				n++
+			}
+		} else {
+			return 0
+		}
+		if uint(len(b)) <= uint(n) || (b[n] != '.' && b[n] != 'e' && b[n] != 'E') {
+			return n
+		}
+	}
+	return 0
+}
+
+type ConsumeNumberState uint
+
+const (
+	consumeNumberInit ConsumeNumberState = iota
+	beforeIntegerDigits
+	withinIntegerDigits
+	beforeFractionalDigits
+	withinFractionalDigits
+	beforeExponentDigits
+	withinExponentDigits
+)
+
+// ConsumeNumber consumes the next JSON number per RFC 7159, section 6.
+// It reports the number of bytes consumed and whether an error was encountered.
+// If the input appears truncated, it returns io.ErrUnexpectedEOF.
+//
+// Note that JSON numbers are not self-terminating.
+// If the entire input is consumed, then the caller needs to consider whether
+// there may be subsequent unread data that may still be part of this number.
+func ConsumeNumber(b []byte) (n int, err error) {
+	n, _, err = ConsumeNumberResumable(b, 0, consumeNumberInit)
+	return n, err
+}
+
+// ConsumeNumberResumable is identical to consumeNumber but supports resuming
+// from a previous call that returned io.ErrUnexpectedEOF.
+func ConsumeNumberResumable(b []byte, resumeOffset int, state ConsumeNumberState) (n int, _ ConsumeNumberState, err error) {
+	// Jump to the right state when resuming from a partial consumption.
+	n = resumeOffset
+	if state > consumeNumberInit {
+		switch state {
+		case withinIntegerDigits, withinFractionalDigits, withinExponentDigits:
+			// Consume leading digits.
+			for uint(len(b)) > uint(n) && ('0' <= b[n] && b[n] <= '9') {
+				n++
+			}
+			if uint(len(b)) <= uint(n) {
+				return n, state, nil // still within the same state
+			}
+			state++ // switches "withinX" to "beforeY" where Y is the state after X
+		}
+		switch state {
+		case beforeIntegerDigits:
+			goto beforeInteger
+		case beforeFractionalDigits:
+			goto beforeFractional
+		case beforeExponentDigits:
+			goto beforeExponent
+		default:
+			return n, state, nil
+		}
+	}
+
+	// Consume required integer component (with optional minus sign).
+beforeInteger:
+	resumeOffset = n
+	if uint(len(b)) > 0 && b[0] == '-' {
+		n++
+	}
+	switch {
+	case uint(len(b)) <= uint(n):
+		return resumeOffset, beforeIntegerDigits, io.ErrUnexpectedEOF
+	case b[n] == '0':
+		n++
+		state = beforeFractionalDigits
+	case '1' <= b[n] && b[n] <= '9':
+		n++
+		for uint(len(b)) > uint(n) && ('0' <= b[n] && b[n] <= '9') {
+			n++
+		}
+		state = withinIntegerDigits
+	default:
+		return n, state, NewInvalidCharacterError(b[n:], "in number (expecting digit)")
+	}
+
+	// Consume optional fractional component.
+beforeFractional:
+	if uint(len(b)) > uint(n) && b[n] == '.' {
+		resumeOffset = n
+		n++
+		switch {
+		case uint(len(b)) <= uint(n):
+			return resumeOffset, beforeFractionalDigits, io.ErrUnexpectedEOF
+		case '0' <= b[n] && b[n] <= '9':
+			n++
+		default:
+			return n, state, NewInvalidCharacterError(b[n:], "in number (expecting digit)")
+		}
+		for uint(len(b)) > uint(n) && ('0' <= b[n] && b[n] <= '9') {
+			n++
+		}
+		state = withinFractionalDigits
+	}
+
+	// Consume optional exponent component.
+beforeExponent:
+	if uint(len(b)) > uint(n) && (b[n] == 'e' || b[n] == 'E') {
+		resumeOffset = n
+		n++
+		if uint(len(b)) > uint(n) && (b[n] == '-' || b[n] == '+') {
+			n++
+		}
+		switch {
+		case uint(len(b)) <= uint(n):
+			return resumeOffset, beforeExponentDigits, io.ErrUnexpectedEOF
+		case '0' <= b[n] && b[n] <= '9':
+			n++
+		default:
+			return n, state, NewInvalidCharacterError(b[n:], "in number (expecting digit)")
+		}
+		for uint(len(b)) > uint(n) && ('0' <= b[n] && b[n] <= '9') {
+			n++
+		}
+		state = withinExponentDigits
+	}
+
+	return n, state, nil
+}
+
+// parseHexUint16 is similar to strconv.ParseUint,
+// but operates directly on []byte and is optimized for base-16.
+// See https://go.dev/issue/42429.
+func parseHexUint16[Bytes ~[]byte | ~string](b Bytes) (v uint16, ok bool) {
+	if len(b) != 4 {
+		return 0, false
+	}
+	for i := range 4 {
+		c := b[i]
+		switch {
+		case '0' <= c && c <= '9':
+			c = c - '0'
+		case 'a' <= c && c <= 'f':
+			c = 10 + c - 'a'
+		case 'A' <= c && c <= 'F':
+			c = 10 + c - 'A'
+		default:
+			return 0, false
+		}
+		v = v*16 + uint16(c)
+	}
+	return v, true
+}
+
+// ParseUint parses b as a decimal unsigned integer according to
+// a strict subset of the JSON number grammar, returning the value if valid.
+// It returns (0, false) if there is a syntax error and
+// returns (math.MaxUint64, false) if there is an overflow.
+func ParseUint(b []byte) (v uint64, ok bool) {
+	const unsafeWidth = 20 // len(fmt.Sprint(uint64(math.MaxUint64)))
+	var n int
+	for ; len(b) > n && ('0' <= b[n] && b[n] <= '9'); n++ {
+		v = 10*v + uint64(b[n]-'0')
+	}
+	switch {
+	case n == 0 || len(b) != n || (b[0] == '0' && string(b) != "0"):
+		return 0, false
+	case n >= unsafeWidth && (b[0] != '1' || v < 1e19 || n > unsafeWidth):
+		return math.MaxUint64, false
+	}
+	return v, true
+}
+
+// ParseFloat parses a floating point number according to the Go float grammar.
+// Note that the JSON number grammar is a strict subset.
+//
+// If the number overflows the finite representation of a float,
+// then we return MaxFloat since any finite value will always be infinitely
+// more accurate at representing another finite value than an infinite value.
+func ParseFloat(b []byte, bits int) (v float64, ok bool) {
+	fv, err := strconv.ParseFloat(string(b), bits)
+	if math.IsInf(fv, 0) {
+		switch {
+		case bits == 32 && math.IsInf(fv, +1):
+			fv = +math.MaxFloat32
+		case bits == 64 && math.IsInf(fv, +1):
+			fv = +math.MaxFloat64
+		case bits == 32 && math.IsInf(fv, -1):
+			fv = -math.MaxFloat32
+		case bits == 64 && math.IsInf(fv, -1):
+			fv = -math.MaxFloat64
+		}
+	}
+	return fv, err == nil
+}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/encode.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/encode.go
new file mode 100644
index 0000000000..35b238a2e2
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/encode.go
@@ -0,0 +1,288 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package jsonwire
+
+import (
+	"math"
+	"slices"
+	"strconv"
+	"unicode/utf16"
+	"unicode/utf8"
+
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+)
+
+// escapeASCII reports whether the ASCII character needs to be escaped.
+// It conservatively assumes EscapeForHTML.
+var escapeASCII = [...]uint8{
+	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, // escape control characters
+	1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, // escape control characters
+	0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, // escape '"' and '&'
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, // escape '<' and '>'
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, // escape '\\'
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+}
+
+// NeedEscape reports whether src needs escaping of any characters.
+// It conservatively assumes EscapeForHTML and EscapeForJS.
+// It reports true for inputs with invalid UTF-8.
+func NeedEscape[Bytes ~[]byte | ~string](src Bytes) bool {
+	var i int
+	for uint(len(src)) > uint(i) {
+		if c := src[i]; c < utf8.RuneSelf {
+			if escapeASCII[c] > 0 {
+				return true
+			}
+			i++
+		} else {
+			r, rn := utf8.DecodeRuneInString(string(truncateMaxUTF8(src[i:])))
+			if r == utf8.RuneError || r == '\u2028' || r == '\u2029' {
+				return true
+			}
+			i += rn
+		}
+	}
+	return false
+}
+
+// AppendQuote appends src to dst as a JSON string per RFC 7159, section 7.
+//
+// It takes in flags and respects the following:
+//   - EscapeForHTML escapes '<', '>', and '&'.
+//   - EscapeForJS escapes '\u2028' and '\u2029'.
+//   - AllowInvalidUTF8 avoids reporting an error for invalid UTF-8.
+//
+// Regardless of whether AllowInvalidUTF8 is specified,
+// invalid bytes are replaced with the Unicode replacement character ('\ufffd').
+// If no escape flags are set, then the shortest representable form is used,
+// which is also the canonical form for strings (RFC 8785, section 3.2.2.2).
+func AppendQuote[Bytes ~[]byte | ~string](dst []byte, src Bytes, flags *jsonflags.Flags) ([]byte, error) {
+	var i, n int
+	var hasInvalidUTF8 bool
+	dst = slices.Grow(dst, len(`"`)+len(src)+len(`"`))
+	dst = append(dst, '"')
+	for uint(len(src)) > uint(n) {
+		if c := src[n]; c < utf8.RuneSelf {
+			// Handle single-byte ASCII.
+			n++
+			if escapeASCII[c] == 0 {
+				continue // no escaping possibly needed
+			}
+			// Handle escaping of single-byte ASCII.
+			if !(c == '<' || c == '>' || c == '&') || flags.Get(jsonflags.EscapeForHTML) {
+				dst = append(dst, src[i:n-1]...)
+				dst = appendEscapedASCII(dst, c)
+				i = n
+			}
+		} else {
+			// Handle multi-byte Unicode.
+			r, rn := utf8.DecodeRuneInString(string(truncateMaxUTF8(src[n:])))
+			n += rn
+			if r != utf8.RuneError && r != '\u2028' && r != '\u2029' {
+				continue // no escaping possibly needed
+			}
+			// Handle escaping of multi-byte Unicode.
+			switch {
+			case isInvalidUTF8(r, rn):
+				hasInvalidUTF8 = true
+				dst = append(dst, src[i:n-rn]...)
+				dst = append(dst, "\ufffd"...)
+				i = n
+			case (r == '\u2028' || r == '\u2029') && flags.Get(jsonflags.EscapeForJS):
+				dst = append(dst, src[i:n-rn]...)
+				dst = appendEscapedUnicode(dst, r)
+				i = n
+			}
+		}
+	}
+	dst = append(dst, src[i:n]...)
+	dst = append(dst, '"')
+	if hasInvalidUTF8 && !flags.Get(jsonflags.AllowInvalidUTF8) {
+		return dst, ErrInvalidUTF8
+	}
+	return dst, nil
+}
+
+func appendEscapedASCII(dst []byte, c byte) []byte {
+	switch c {
+	case '"', '\\':
+		dst = append(dst, '\\', c)
+	case '\b':
+		dst = append(dst, "\\b"...)
+	case '\f':
+		dst = append(dst, "\\f"...)
+	case '\n':
+		dst = append(dst, "\\n"...)
+	case '\r':
+		dst = append(dst, "\\r"...)
+	case '\t':
+		dst = append(dst, "\\t"...)
+	default:
+		dst = appendEscapedUTF16(dst, uint16(c))
+	}
+	return dst
+}
+
+func appendEscapedUnicode(dst []byte, r rune) []byte {
+	if r1, r2 := utf16.EncodeRune(r); r1 != '\ufffd' && r2 != '\ufffd' {
+		dst = appendEscapedUTF16(dst, uint16(r1))
+		dst = appendEscapedUTF16(dst, uint16(r2))
+	} else {
+		dst = appendEscapedUTF16(dst, uint16(r))
+	}
+	return dst
+}
+
+func appendEscapedUTF16(dst []byte, x uint16) []byte {
+	const hex = "0123456789abcdef"
+	return append(dst, '\\', 'u', hex[(x>>12)&0xf], hex[(x>>8)&0xf], hex[(x>>4)&0xf], hex[(x>>0)&0xf])
+}
+
+// ReformatString consumes a JSON string from src and appends it to dst,
+// reformatting it if necessary according to the specified flags.
+// It returns the appended output and the number of consumed input bytes.
+func ReformatString(dst, src []byte, flags *jsonflags.Flags) ([]byte, int, error) {
+	// TODO: Should this update ValueFlags as input?
+	var valFlags ValueFlags
+	n, err := ConsumeString(&valFlags, src, !flags.Get(jsonflags.AllowInvalidUTF8))
+	if err != nil {
+		return dst, n, err
+	}
+
+	// If the output requires no special escapes, and the input
+	// is already in canonical form or should be preserved verbatim,
+	// then directly copy the input to the output.
+	if !flags.Get(jsonflags.AnyEscape) &&
+		(valFlags.IsCanonical() || flags.Get(jsonflags.PreserveRawStrings)) {
+		dst = append(dst, src[:n]...) // copy the string verbatim
+		return dst, n, nil
+	}
+
+	// Under [jsonflags.PreserveRawStrings], any pre-escaped sequences
+	// remain escaped, however we still need to respect the
+	// [jsonflags.EscapeForHTML] and [jsonflags.EscapeForJS] options.
+	if flags.Get(jsonflags.PreserveRawStrings) {
+		var i, lastAppendIndex int
+		for i < n {
+			if c := src[i]; c < utf8.RuneSelf {
+				if (c == '<' || c == '>' || c == '&') && flags.Get(jsonflags.EscapeForHTML) {
+					dst = append(dst, src[lastAppendIndex:i]...)
+					dst = appendEscapedASCII(dst, c)
+					lastAppendIndex = i + 1
+				}
+				i++
+			} else {
+				r, rn := utf8.DecodeRune(truncateMaxUTF8(src[i:]))
+				if (r == '\u2028' || r == '\u2029') && flags.Get(jsonflags.EscapeForJS) {
+					dst = append(dst, src[lastAppendIndex:i]...)
+					dst = appendEscapedUnicode(dst, r)
+					lastAppendIndex = i + rn
+				}
+				i += rn
+			}
+		}
+		return append(dst, src[lastAppendIndex:n]...), n, nil
+	}
+
+	// The input contains characters that might need escaping,
+	// unnecessary escape sequences, or invalid UTF-8.
+	// Perform a round-trip unquote and quote to properly reformat
+	// these sequences according the current flags.
+	b, _ := AppendUnquote(nil, src[:n])
+	dst, _ = AppendQuote(dst, b, flags)
+	return dst, n, nil
+}
+
+// AppendFloat appends src to dst as a JSON number per RFC 7159, section 6.
+// It formats numbers similar to the ES6 number-to-string conversion.
+// See https://go.dev/issue/14135.
+//
+// The output is identical to ECMA-262, 6th edition, section 7.1.12.1 and with
+// RFC 8785, section 3.2.2.3 for 64-bit floating-point numbers except for -0,
+// which is formatted as -0 instead of just 0.
+//
+// For 32-bit floating-point numbers,
+// the output is a 32-bit equivalent of the algorithm.
+// Note that ECMA-262 specifies no algorithm for 32-bit numbers.
+func AppendFloat(dst []byte, src float64, bits int) []byte {
+	if bits == 32 {
+		src = float64(float32(src))
+	}
+
+	abs := math.Abs(src)
+	fmt := byte('f')
+	if abs != 0 {
+		if bits == 64 && (float64(abs) < 1e-6 || float64(abs) >= 1e21) ||
+			bits == 32 && (float32(abs) < 1e-6 || float32(abs) >= 1e21) {
+			fmt = 'e'
+		}
+	}
+	dst = strconv.AppendFloat(dst, src, fmt, -1, bits)
+	if fmt == 'e' {
+		// Clean up e-09 to e-9.
+		n := len(dst)
+		if n >= 4 && dst[n-4] == 'e' && dst[n-3] == '-' && dst[n-2] == '0' {
+			dst[n-2] = dst[n-1]
+			dst = dst[:n-1]
+		}
+	}
+	return dst
+}
+
+// ReformatNumber consumes a JSON string from src and appends it to dst,
+// canonicalizing it if specified.
+// It returns the appended output and the number of consumed input bytes.
+func ReformatNumber(dst, src []byte, flags *jsonflags.Flags) ([]byte, int, error) {
+	n, err := ConsumeNumber(src)
+	if err != nil {
+		return dst, n, err
+	}
+	if !flags.Get(jsonflags.CanonicalizeNumbers) {
+		dst = append(dst, src[:n]...) // copy the number verbatim
+		return dst, n, nil
+	}
+
+	// Identify the kind of number.
+	var isFloat bool
+	for _, c := range src[:n] {
+		if c == '.' || c == 'e' || c == 'E' {
+			isFloat = true // has fraction or exponent
+			break
+		}
+	}
+
+	// Check if need to canonicalize this kind of number.
+	switch {
+	case string(src[:n]) == "-0":
+		break // canonicalize -0 as 0 regardless of kind
+	case isFloat:
+		if !flags.Get(jsonflags.CanonicalizeRawFloats) {
+			dst = append(dst, src[:n]...) // copy the number verbatim
+			return dst, n, nil
+		}
+	default:
+		// As an optimization, we can copy integer numbers below 2⁵³ verbatim
+		// since the canonical form is always identical.
+		const maxExactIntegerDigits = 16 // len(strconv.AppendUint(nil, 1<<53, 10))
+		if !flags.Get(jsonflags.CanonicalizeRawInts) || n < maxExactIntegerDigits {
+			dst = append(dst, src[:n]...) // copy the number verbatim
+			return dst, n, nil
+		}
+	}
+
+	// Parse and reformat the number (which uses a canonical format).
+	fv, _ := strconv.ParseFloat(string(src[:n]), 64)
+	switch {
+	case fv == 0:
+		fv = 0 // normalize negative zero as just zero
+	case math.IsInf(fv, +1):
+		fv = +math.MaxFloat64
+	case math.IsInf(fv, -1):
+		fv = -math.MaxFloat64
+	}
+	return AppendFloat(dst, fv, 64), n, nil
+}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/wire.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/wire.go
new file mode 100644
index 0000000000..1831a66bde
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/wire.go
@@ -0,0 +1,215 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package jsonwire implements stateless functionality for handling JSON text.
+package jsonwire
+
+import (
+	"cmp"
+	"errors"
+	"strconv"
+	"strings"
+	"unicode"
+	"unicode/utf16"
+	"unicode/utf8"
+)
+
+// TrimSuffixWhitespace trims JSON from the end of b.
+func TrimSuffixWhitespace(b []byte) []byte {
+	// NOTE: The arguments and logic are kept simple to keep this inlinable.
+	n := len(b) - 1
+	for n >= 0 && (b[n] == ' ' || b[n] == '\t' || b[n] == '\r' || b[n] == '\n') {
+		n--
+	}
+	return b[:n+1]
+}
+
+// TrimSuffixString trims a valid JSON string at the end of b.
+// The behavior is undefined if there is not a valid JSON string present.
+func TrimSuffixString(b []byte) []byte {
+	// NOTE: The arguments and logic are kept simple to keep this inlinable.
+	if len(b) > 0 && b[len(b)-1] == '"' {
+		b = b[:len(b)-1]
+	}
+	for len(b) >= 2 && !(b[len(b)-1] == '"' && b[len(b)-2] != '\\') {
+		b = b[:len(b)-1] // trim all characters except an unescaped quote
+	}
+	if len(b) > 0 && b[len(b)-1] == '"' {
+		b = b[:len(b)-1]
+	}
+	return b
+}
+
+// HasSuffixByte reports whether b ends with c.
+func HasSuffixByte(b []byte, c byte) bool {
+	// NOTE: The arguments and logic are kept simple to keep this inlinable.
+	return len(b) > 0 && b[len(b)-1] == c
+}
+
+// TrimSuffixByte removes c from the end of b if it is present.
+func TrimSuffixByte(b []byte, c byte) []byte {
+	// NOTE: The arguments and logic are kept simple to keep this inlinable.
+	if len(b) > 0 && b[len(b)-1] == c {
+		return b[:len(b)-1]
+	}
+	return b
+}
+
+// QuoteRune quotes the first rune in the input.
+func QuoteRune[Bytes ~[]byte | ~string](b Bytes) string {
+	r, n := utf8.DecodeRuneInString(string(truncateMaxUTF8(b)))
+	if r == utf8.RuneError && n == 1 {
+		return `'\x` + strconv.FormatUint(uint64(b[0]), 16) + `'`
+	}
+	return strconv.QuoteRune(r)
+}
+
+// CompareUTF16 lexicographically compares x to y according
+// to the UTF-16 codepoints of the UTF-8 encoded input strings.
+// This implements the ordering specified in RFC 8785, section 3.2.3.
+func CompareUTF16[Bytes ~[]byte | ~string](x, y Bytes) int {
+	// NOTE: This is an optimized, mostly allocation-free implementation
+	// of CompareUTF16Simple in wire_test.go. FuzzCompareUTF16 verifies that the
+	// two implementations agree on the result of comparing any two strings.
+	isUTF16Self := func(r rune) bool {
+		return ('\u0000' <= r && r <= '\uD7FF') || ('\uE000' <= r && r <= '\uFFFF')
+	}
+
+	for {
+		if len(x) == 0 || len(y) == 0 {
+			return cmp.Compare(len(x), len(y))
+		}
+
+		// ASCII fast-path.
+		if x[0] < utf8.RuneSelf || y[0] < utf8.RuneSelf {
+			if x[0] != y[0] {
+				return cmp.Compare(x[0], y[0])
+			}
+			x, y = x[1:], y[1:]
+			continue
+		}
+
+		// Decode next pair of runes as UTF-8.
+		rx, nx := utf8.DecodeRuneInString(string(truncateMaxUTF8(x)))
+		ry, ny := utf8.DecodeRuneInString(string(truncateMaxUTF8(y)))
+
+		selfx := isUTF16Self(rx)
+		selfy := isUTF16Self(ry)
+		switch {
+		// The x rune is a single UTF-16 codepoint, while
+		// the y rune is a surrogate pair of UTF-16 codepoints.
+		case selfx && !selfy:
+			ry, _ = utf16.EncodeRune(ry)
+		// The y rune is a single UTF-16 codepoint, while
+		// the x rune is a surrogate pair of UTF-16 codepoints.
+		case selfy && !selfx:
+			rx, _ = utf16.EncodeRune(rx)
+		}
+		if rx != ry {
+			return cmp.Compare(rx, ry)
+		}
+
+		// Check for invalid UTF-8, in which case,
+		// we just perform a byte-for-byte comparison.
+		if isInvalidUTF8(rx, nx) || isInvalidUTF8(ry, ny) {
+			if x[0] != y[0] {
+				return cmp.Compare(x[0], y[0])
+			}
+		}
+		x, y = x[nx:], y[ny:]
+	}
+}
+
+// truncateMaxUTF8 truncates b such it contains at least one rune.
+//
+// The utf8 package currently lacks generic variants, which complicates
+// generic functions that operates on either []byte or string.
+// As a hack, we always call the utf8 function operating on strings,
+// but always truncate the input such that the result is identical.
+//
+// Example usage:
+//
+//	utf8.DecodeRuneInString(string(truncateMaxUTF8(b)))
+//
+// Converting a []byte to a string is stack allocated since
+// truncateMaxUTF8 guarantees that the []byte is short.
+func truncateMaxUTF8[Bytes ~[]byte | ~string](b Bytes) Bytes {
+	// TODO(https://go.dev/issue/56948): Remove this function and
+	// instead directly call generic utf8 functions wherever used.
+	if len(b) > utf8.UTFMax {
+		return b[:utf8.UTFMax]
+	}
+	return b
+}
+
+// TODO(https://go.dev/issue/70547): Use utf8.ErrInvalid instead.
+var ErrInvalidUTF8 = errors.New("invalid UTF-8")
+
+func NewInvalidCharacterError[Bytes ~[]byte | ~string](prefix Bytes, where string) error {
+	what := QuoteRune(prefix)
+	return errors.New("invalid character " + what + " " + where)
+}
+
+func NewInvalidEscapeSequenceError[Bytes ~[]byte | ~string](what Bytes) error {
+	label := "escape sequence"
+	if len(what) > 6 {
+		label = "surrogate pair"
+	}
+	needEscape := strings.IndexFunc(string(what), func(r rune) bool {
+		return r == '`' || r == utf8.RuneError || unicode.IsSpace(r) || !unicode.IsPrint(r)
+	}) >= 0
+	if needEscape {
+		return errors.New("invalid " + label + " " + strconv.Quote(string(what)) + " in string")
+	} else {
+		return errors.New("invalid " + label + " `" + string(what) + "` in string")
+	}
+}
+
+// TruncatePointer optionally truncates the JSON pointer,
+// enforcing that the length roughly does not exceed n.
+func TruncatePointer(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	i := n / 2
+	j := len(s) - n/2
+
+	// Avoid truncating a name if there are multiple names present.
+	if k := strings.LastIndexByte(s[:i], '/'); k > 0 {
+		i = k
+	}
+	if k := strings.IndexByte(s[j:], '/'); k >= 0 {
+		j += k + len("/")
+	}
+
+	// Avoid truncation in the middle of a UTF-8 rune.
+	for i > 0 && isInvalidUTF8(utf8.DecodeLastRuneInString(s[:i])) {
+		i--
+	}
+	for j < len(s) && isInvalidUTF8(utf8.DecodeRuneInString(s[j:])) {
+		j++
+	}
+
+	// Determine the right middle fragment to use.
+	var middle string
+	switch strings.Count(s[i:j], "/") {
+	case 0:
+		middle = "…"
+	case 1:
+		middle = "…/…"
+	default:
+		middle = "…/…/…"
+	}
+	if strings.HasPrefix(s[i:j], "/") && middle != "…" {
+		middle = strings.TrimPrefix(middle, "…")
+	}
+	if strings.HasSuffix(s[i:j], "/") && middle != "…" {
+		middle = strings.TrimSuffix(middle, "…")
+	}
+	return s[:i] + middle + s[j:]
+}
+
+func isInvalidUTF8(r rune, rn int) bool {
+	return r == utf8.RuneError && rn == 1
+}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/decode.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/decode.go
new file mode 100644
index 0000000000..96fd5c27cf
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/decode.go
@@ -0,0 +1,1177 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package jsontext
+
+import (
+	"bytes"
+	"errors"
+	"io"
+
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire"
+)
+
+// NOTE: The logic for decoding is complicated by the fact that reading from
+// an io.Reader into a temporary buffer means that the buffer may contain a
+// truncated portion of some valid input, requiring the need to fetch more data.
+//
+// This file is structured in the following way:
+//
+//   - consumeXXX functions parse an exact JSON token from a []byte.
+//     If the buffer appears truncated, then it returns io.ErrUnexpectedEOF.
+//     The consumeSimpleXXX functions are so named because they only handle
+//     a subset of the grammar for the JSON token being parsed.
+//     They do not handle the full grammar to keep these functions inlinable.
+//
+//   - Decoder.consumeXXX methods parse the next JSON token from Decoder.buf,
+//     automatically fetching more input if necessary. These methods take
+//     a position relative to the start of Decoder.buf as an argument and
+//     return the end of the consumed JSON token as a position,
+//     also relative to the start of Decoder.buf.
+//
+//   - In the event of an I/O errors or state machine violations,
+//     the implementation avoids mutating the state of Decoder
+//     (aside from the book-keeping needed to implement Decoder.fetch).
+//     For this reason, only Decoder.ReadToken and Decoder.ReadValue are
+//     responsible for updated Decoder.prevStart and Decoder.prevEnd.
+//
+//   - For performance, much of the implementation uses the pattern of calling
+//     the inlinable consumeXXX functions first, and if more work is necessary,
+//     then it calls the slower Decoder.consumeXXX methods.
+//     TODO: Revisit this pattern if the Go compiler provides finer control
+//     over exactly which calls are inlined or not.
+
+// Decoder is a streaming decoder for raw JSON tokens and values.
+// It is used to read a stream of top-level JSON values,
+// each separated by optional whitespace characters.
+//
+// [Decoder.ReadToken] and [Decoder.ReadValue] calls may be interleaved.
+// For example, the following JSON value:
+//
+//	{"name":"value","array":[null,false,true,3.14159],"object":{"k":"v"}}
+//
+// can be parsed with the following calls (ignoring errors for brevity):
+//
+//	d.ReadToken() // {
+//	d.ReadToken() // "name"
+//	d.ReadToken() // "value"
+//	d.ReadValue() // "array"
+//	d.ReadToken() // [
+//	d.ReadToken() // null
+//	d.ReadToken() // false
+//	d.ReadValue() // true
+//	d.ReadToken() // 3.14159
+//	d.ReadToken() // ]
+//	d.ReadValue() // "object"
+//	d.ReadValue() // {"k":"v"}
+//	d.ReadToken() // }
+//
+// The above is one of many possible sequence of calls and
+// may not represent the most sensible method to call for any given token/value.
+// For example, it is probably more common to call [Decoder.ReadToken] to obtain a
+// string token for object names.
+type Decoder struct {
+	s decoderState
+}
+
+// decoderState is the low-level state of Decoder.
+// It has exported fields and method for use by the "json" package.
+type decoderState struct {
+	state
+	decodeBuffer
+	jsonopts.Struct
+
+	StringCache *[256]string // only used when unmarshaling; identical to json.stringCache
+}
+
+// decodeBuffer is a buffer split into 4 segments:
+//
+//   - buf[0:prevEnd]         // already read portion of the buffer
+//   - buf[prevStart:prevEnd] // previously read value
+//   - buf[prevEnd:len(buf)]  // unread portion of the buffer
+//   - buf[len(buf):cap(buf)] // unused portion of the buffer
+//
+// Invariants:
+//
+//	0 ≤ prevStart ≤ prevEnd ≤ len(buf) ≤ cap(buf)
+type decodeBuffer struct {
+	peekPos int   // non-zero if valid offset into buf for start of next token
+	peekErr error // implies peekPos is -1
+
+	buf       []byte // may alias rd if it is a bytes.Buffer
+	prevStart int
+	prevEnd   int
+
+	// baseOffset is added to prevStart and prevEnd to obtain
+	// the absolute offset relative to the start of io.Reader stream.
+	baseOffset int64
+
+	rd io.Reader
+}
+
+// NewDecoder constructs a new streaming decoder reading from r.
+//
+// If r is a [bytes.Buffer], then the decoder parses directly from the buffer
+// without first copying the contents to an intermediate buffer.
+// Additional writes to the buffer must not occur while the decoder is in use.
+func NewDecoder(r io.Reader, opts ...Options) *Decoder {
+	d := new(Decoder)
+	d.Reset(r, opts...)
+	return d
+}
+
+// Reset resets a decoder such that it is reading afresh from r and
+// configured with the provided options. Reset must not be called on an
+// a Decoder passed to the [encoding/json/v2.UnmarshalerFrom.UnmarshalJSONFrom] method
+// or the [encoding/json/v2.UnmarshalFromFunc] function.
+func (d *Decoder) Reset(r io.Reader, opts ...Options) {
+	switch {
+	case d == nil:
+		panic("jsontext: invalid nil Decoder")
+	case r == nil:
+		panic("jsontext: invalid nil io.Reader")
+	case d.s.Flags.Get(jsonflags.WithinArshalCall):
+		panic("jsontext: cannot reset Decoder passed to json.UnmarshalerFrom")
+	}
+	// Reuse the buffer if it does not alias a previous [bytes.Buffer].
+	b := d.s.buf[:0]
+	if _, ok := d.s.rd.(*bytes.Buffer); ok {
+		b = nil
+	}
+	d.s.reset(b, r, opts...)
+}
+
+func (d *decoderState) reset(b []byte, r io.Reader, opts ...Options) {
+	d.state.reset()
+	d.decodeBuffer = decodeBuffer{buf: b, rd: r}
+	opts2 := jsonopts.Struct{} // avoid mutating d.Struct in case it is part of opts
+	opts2.Join(opts...)
+	d.Struct = opts2
+}
+
+// Options returns the options used to construct the encoder and
+// may additionally contain semantic options passed to a
+// [encoding/json/v2.UnmarshalDecode] call.
+//
+// If operating within
+// a [encoding/json/v2.UnmarshalerFrom.UnmarshalJSONFrom] method call or
+// a [encoding/json/v2.UnmarshalFromFunc] function call,
+// then the returned options are only valid within the call.
+func (d *Decoder) Options() Options {
+	return &d.s.Struct
+}
+
+var errBufferWriteAfterNext = errors.New("invalid bytes.Buffer.Write call after calling bytes.Buffer.Next")
+
+// fetch reads at least 1 byte from the underlying io.Reader.
+// It returns io.ErrUnexpectedEOF if zero bytes were read and io.EOF was seen.
+func (d *decoderState) fetch() error {
+	if d.rd == nil {
+		return io.ErrUnexpectedEOF
+	}
+
+	// Inform objectNameStack that we are about to fetch new buffer content.
+	d.Names.copyQuotedBuffer(d.buf)
+
+	// Specialize bytes.Buffer for better performance.
+	if bb, ok := d.rd.(*bytes.Buffer); ok {
+		switch {
+		case bb.Len() == 0:
+			return io.ErrUnexpectedEOF
+		case len(d.buf) == 0:
+			d.buf = bb.Next(bb.Len()) // "read" all data in the buffer
+			return nil
+		default:
+			// This only occurs if a partially filled bytes.Buffer was provided
+			// and more data is written to it while Decoder is reading from it.
+			// This practice will lead to data corruption since future writes
+			// may overwrite the contents of the current buffer.
+			//
+			// The user is trying to use a bytes.Buffer as a pipe,
+			// but a bytes.Buffer is poor implementation of a pipe,
+			// the purpose-built io.Pipe should be used instead.
+			return &ioError{action: "read", err: errBufferWriteAfterNext}
+		}
+	}
+
+	// Allocate initial buffer if empty.
+	if cap(d.buf) == 0 {
+		d.buf = make([]byte, 0, 64)
+	}
+
+	// Check whether to grow the buffer.
+	const maxBufferSize = 4 << 10
+	const growthSizeFactor = 2 // higher value is faster
+	const growthRateFactor = 2 // higher value is slower
+	// By default, grow if below the maximum buffer size.
+	grow := cap(d.buf) <= maxBufferSize/growthSizeFactor
+	// Growing can be expensive, so only grow
+	// if a sufficient number of bytes have been processed.
+	grow = grow && int64(cap(d.buf)) < d.previousOffsetEnd()/growthRateFactor
+	// If prevStart==0, then fetch was called in order to fetch more data
+	// to finish consuming a large JSON value contiguously.
+	// Grow if less than 25% of the remaining capacity is available.
+	// Note that this may cause the input buffer to exceed maxBufferSize.
+	grow = grow || (d.prevStart == 0 && len(d.buf) >= 3*cap(d.buf)/4)
+
+	if grow {
+		// Allocate a new buffer and copy the contents of the old buffer over.
+		// TODO: Provide a hard limit on the maximum internal buffer size?
+		buf := make([]byte, 0, cap(d.buf)*growthSizeFactor)
+		d.buf = append(buf, d.buf[d.prevStart:]...)
+	} else {
+		// Move unread portion of the data to the front.
+		n := copy(d.buf[:cap(d.buf)], d.buf[d.prevStart:])
+		d.buf = d.buf[:n]
+	}
+	d.baseOffset += int64(d.prevStart)
+	d.prevEnd -= d.prevStart
+	d.prevStart = 0
+
+	// Read more data into the internal buffer.
+	for {
+		n, err := d.rd.Read(d.buf[len(d.buf):cap(d.buf)])
+		switch {
+		case n > 0:
+			d.buf = d.buf[:len(d.buf)+n]
+			return nil // ignore errors if any bytes are read
+		case err == io.EOF:
+			return io.ErrUnexpectedEOF
+		case err != nil:
+			return &ioError{action: "read", err: err}
+		default:
+			continue // Read returned (0, nil)
+		}
+	}
+}
+
+const invalidateBufferByte = '#' // invalid starting character for JSON grammar
+
+// invalidatePreviousRead invalidates buffers returned by Peek and Read calls
+// so that the first byte is an invalid character.
+// This Hyrum-proofs the API against faulty application code that assumes
+// values returned by ReadValue remain valid past subsequent Read calls.
+func (d *decodeBuffer) invalidatePreviousRead() {
+	// Avoid mutating the buffer if d.rd is nil which implies that d.buf
+	// is provided by the user code and may not expect mutations.
+	isBytesBuffer := func(r io.Reader) bool {
+		_, ok := r.(*bytes.Buffer)
+		return ok
+	}
+	if d.rd != nil && !isBytesBuffer(d.rd) && d.prevStart < d.prevEnd && uint(d.prevStart) < uint(len(d.buf)) {
+		d.buf[d.prevStart] = invalidateBufferByte
+		d.prevStart = d.prevEnd
+	}
+}
+
+// needMore reports whether there are no more unread bytes.
+func (d *decodeBuffer) needMore(pos int) bool {
+	// NOTE: The arguments and logic are kept simple to keep this inlinable.
+	return pos == len(d.buf)
+}
+
+func (d *decodeBuffer) offsetAt(pos int) int64     { return d.baseOffset + int64(pos) }
+func (d *decodeBuffer) previousOffsetStart() int64 { return d.baseOffset + int64(d.prevStart) }
+func (d *decodeBuffer) previousOffsetEnd() int64   { return d.baseOffset + int64(d.prevEnd) }
+func (d *decodeBuffer) previousBuffer() []byte     { return d.buf[d.prevStart:d.prevEnd] }
+func (d *decodeBuffer) unreadBuffer() []byte       { return d.buf[d.prevEnd:len(d.buf)] }
+
+// PreviousTokenOrValue returns the previously read token or value
+// unless it has been invalidated by a call to PeekKind.
+// If a token is just a delimiter, then this returns a 1-byte buffer.
+// This method is used for error reporting at the semantic layer.
+func (d *decodeBuffer) PreviousTokenOrValue() []byte {
+	b := d.previousBuffer()
+	// If peek was called, then the previous token or buffer is invalidated.
+	if d.peekPos > 0 || len(b) > 0 && b[0] == invalidateBufferByte {
+		return nil
+	}
+	// ReadToken does not preserve the buffer for null, bools, or delimiters.
+	// Manually re-construct that buffer.
+	if len(b) == 0 {
+		b = d.buf[:d.prevEnd] // entirety of the previous buffer
+		for _, tok := range []string{"null", "false", "true", "{", "}", "[", "]"} {
+			if len(b) >= len(tok) && string(b[len(b)-len(tok):]) == tok {
+				return b[len(b)-len(tok):]
+			}
+		}
+	}
+	return b
+}
+
+// PeekKind retrieves the next token kind, but does not advance the read offset.
+//
+// It returns 0 if an error occurs. Any such error is cached until
+// the next read call and it is the caller's responsibility to eventually
+// follow up a PeekKind call with a read call.
+func (d *Decoder) PeekKind() Kind {
+	return d.s.PeekKind()
+}
+func (d *decoderState) PeekKind() Kind {
+	// Check whether we have a cached peek result.
+	if d.peekPos > 0 {
+		return Kind(d.buf[d.peekPos]).normalize()
+	}
+
+	var err error
+	d.invalidatePreviousRead()
+	pos := d.prevEnd
+
+	// Consume leading whitespace.
+	pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+	if d.needMore(pos) {
+		if pos, err = d.consumeWhitespace(pos); err != nil {
+			if err == io.ErrUnexpectedEOF && d.Tokens.Depth() == 1 {
+				err = io.EOF // EOF possibly if no Tokens present after top-level value
+			}
+			d.peekPos, d.peekErr = -1, wrapSyntacticError(d, err, pos, 0)
+			return invalidKind
+		}
+	}
+
+	// Consume colon or comma.
+	var delim byte
+	if c := d.buf[pos]; c == ':' || c == ',' {
+		delim = c
+		pos += 1
+		pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+		if d.needMore(pos) {
+			if pos, err = d.consumeWhitespace(pos); err != nil {
+				err = wrapSyntacticError(d, err, pos, 0)
+				d.peekPos, d.peekErr = -1, d.checkDelimBeforeIOError(delim, err)
+				return invalidKind
+			}
+		}
+	}
+	next := Kind(d.buf[pos]).normalize()
+	if d.Tokens.needDelim(next) != delim {
+		d.peekPos, d.peekErr = -1, d.checkDelim(delim, next)
+		return invalidKind
+	}
+
+	// This may set peekPos to zero, which is indistinguishable from
+	// the uninitialized state. While a small hit to performance, it is correct
+	// since ReadValue and ReadToken will disregard the cached result and
+	// recompute the next kind.
+	d.peekPos, d.peekErr = pos, nil
+	return next
+}
+
+// checkDelimBeforeIOError checks whether the delim is even valid
+// before returning an IO error, which occurs after the delim.
+func (d *decoderState) checkDelimBeforeIOError(delim byte, err error) error {
+	// Since an IO error occurred, we do not know what the next kind is.
+	// However, knowing the next kind is necessary to validate
+	// whether the current delim is at least potentially valid.
+	// Since a JSON string is always valid as the next token,
+	// conservatively assume that is the next kind for validation.
+	const next = Kind('"')
+	if d.Tokens.needDelim(next) != delim {
+		err = d.checkDelim(delim, next)
+	}
+	return err
+}
+
+// CountNextDelimWhitespace counts the number of upcoming bytes of
+// delimiter or whitespace characters.
+// This method is used for error reporting at the semantic layer.
+func (d *decoderState) CountNextDelimWhitespace() int {
+	d.PeekKind() // populate unreadBuffer
+	return len(d.unreadBuffer()) - len(bytes.TrimLeft(d.unreadBuffer(), ",: \n\r\t"))
+}
+
+// checkDelim checks whether delim is valid for the given next kind.
+func (d *decoderState) checkDelim(delim byte, next Kind) error {
+	where := "at start of value"
+	switch d.Tokens.needDelim(next) {
+	case delim:
+		return nil
+	case ':':
+		where = "after object name (expecting ':')"
+	case ',':
+		if d.Tokens.Last.isObject() {
+			where = "after object value (expecting ',' or '}')"
+		} else {
+			where = "after array element (expecting ',' or ']')"
+		}
+	}
+	pos := d.prevEnd // restore position to right after leading whitespace
+	pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+	err := jsonwire.NewInvalidCharacterError(d.buf[pos:], where)
+	return wrapSyntacticError(d, err, pos, 0)
+}
+
+// SkipValue is semantically equivalent to calling [Decoder.ReadValue] and discarding
+// the result except that memory is not wasted trying to hold the entire result.
+func (d *Decoder) SkipValue() error {
+	return d.s.SkipValue()
+}
+func (d *decoderState) SkipValue() error {
+	switch d.PeekKind() {
+	case '{', '[':
+		// For JSON objects and arrays, keep skipping all tokens
+		// until the depth matches the starting depth.
+		depth := d.Tokens.Depth()
+		for {
+			if _, err := d.ReadToken(); err != nil {
+				return err
+			}
+			if depth >= d.Tokens.Depth() {
+				return nil
+			}
+		}
+	default:
+		// Trying to skip a value when the next token is a '}' or ']'
+		// will result in an error being returned here.
+		var flags jsonwire.ValueFlags
+		if _, err := d.ReadValue(&flags); err != nil {
+			return err
+		}
+		return nil
+	}
+}
+
+// SkipValueRemainder skips the remainder of a value
+// after reading a '{' or '[' token.
+func (d *decoderState) SkipValueRemainder() error {
+	if d.Tokens.Depth()-1 > 0 && d.Tokens.Last.Length() == 0 {
+		for n := d.Tokens.Depth(); d.Tokens.Depth() >= n; {
+			if _, err := d.ReadToken(); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// SkipUntil skips all tokens until the state machine
+// is at or past the specified depth and length.
+func (d *decoderState) SkipUntil(depth int, length int64) error {
+	for d.Tokens.Depth() > depth || (d.Tokens.Depth() == depth && d.Tokens.Last.Length() < length) {
+		if _, err := d.ReadToken(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// ReadToken reads the next [Token], advancing the read offset.
+// The returned token is only valid until the next Peek, Read, or Skip call.
+// It returns [io.EOF] if there are no more tokens.
+func (d *Decoder) ReadToken() (Token, error) {
+	return d.s.ReadToken()
+}
+func (d *decoderState) ReadToken() (Token, error) {
+	// Determine the next kind.
+	var err error
+	var next Kind
+	pos := d.peekPos
+	if pos != 0 {
+		// Use cached peek result.
+		if d.peekErr != nil {
+			err := d.peekErr
+			d.peekPos, d.peekErr = 0, nil // possibly a transient I/O error
+			return Token{}, err
+		}
+		next = Kind(d.buf[pos]).normalize()
+		d.peekPos = 0 // reset cache
+	} else {
+		d.invalidatePreviousRead()
+		pos = d.prevEnd
+
+		// Consume leading whitespace.
+		pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+		if d.needMore(pos) {
+			if pos, err = d.consumeWhitespace(pos); err != nil {
+				if err == io.ErrUnexpectedEOF && d.Tokens.Depth() == 1 {
+					err = io.EOF // EOF possibly if no Tokens present after top-level value
+				}
+				return Token{}, wrapSyntacticError(d, err, pos, 0)
+			}
+		}
+
+		// Consume colon or comma.
+		var delim byte
+		if c := d.buf[pos]; c == ':' || c == ',' {
+			delim = c
+			pos += 1
+			pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+			if d.needMore(pos) {
+				if pos, err = d.consumeWhitespace(pos); err != nil {
+					err = wrapSyntacticError(d, err, pos, 0)
+					return Token{}, d.checkDelimBeforeIOError(delim, err)
+				}
+			}
+		}
+		next = Kind(d.buf[pos]).normalize()
+		if d.Tokens.needDelim(next) != delim {
+			return Token{}, d.checkDelim(delim, next)
+		}
+	}
+
+	// Handle the next token.
+	var n int
+	switch next {
+	case 'n':
+		if jsonwire.ConsumeNull(d.buf[pos:]) == 0 {
+			pos, err = d.consumeLiteral(pos, "null")
+			if err != nil {
+				return Token{}, wrapSyntacticError(d, err, pos, +1)
+			}
+		} else {
+			pos += len("null")
+		}
+		if err = d.Tokens.appendLiteral(); err != nil {
+			return Token{}, wrapSyntacticError(d, err, pos-len("null"), +1) // report position at start of literal
+		}
+		d.prevStart, d.prevEnd = pos, pos
+		return Null, nil
+
+	case 'f':
+		if jsonwire.ConsumeFalse(d.buf[pos:]) == 0 {
+			pos, err = d.consumeLiteral(pos, "false")
+			if err != nil {
+				return Token{}, wrapSyntacticError(d, err, pos, +1)
+			}
+		} else {
+			pos += len("false")
+		}
+		if err = d.Tokens.appendLiteral(); err != nil {
+			return Token{}, wrapSyntacticError(d, err, pos-len("false"), +1) // report position at start of literal
+		}
+		d.prevStart, d.prevEnd = pos, pos
+		return False, nil
+
+	case 't':
+		if jsonwire.ConsumeTrue(d.buf[pos:]) == 0 {
+			pos, err = d.consumeLiteral(pos, "true")
+			if err != nil {
+				return Token{}, wrapSyntacticError(d, err, pos, +1)
+			}
+		} else {
+			pos += len("true")
+		}
+		if err = d.Tokens.appendLiteral(); err != nil {
+			return Token{}, wrapSyntacticError(d, err, pos-len("true"), +1) // report position at start of literal
+		}
+		d.prevStart, d.prevEnd = pos, pos
+		return True, nil
+
+	case '"':
+		var flags jsonwire.ValueFlags // TODO: Preserve this in Token?
+		if n = jsonwire.ConsumeSimpleString(d.buf[pos:]); n == 0 {
+			oldAbsPos := d.baseOffset + int64(pos)
+			pos, err = d.consumeString(&flags, pos)
+			newAbsPos := d.baseOffset + int64(pos)
+			n = int(newAbsPos - oldAbsPos)
+			if err != nil {
+				return Token{}, wrapSyntacticError(d, err, pos, +1)
+			}
+		} else {
+			pos += n
+		}
+		if d.Tokens.Last.NeedObjectName() {
+			if !d.Flags.Get(jsonflags.AllowDuplicateNames) {
+				if !d.Tokens.Last.isValidNamespace() {
+					return Token{}, wrapSyntacticError(d, errInvalidNamespace, pos-n, +1)
+				}
+				if d.Tokens.Last.isActiveNamespace() && !d.Namespaces.Last().insertQuoted(d.buf[pos-n:pos], flags.IsVerbatim()) {
+					err = wrapWithObjectName(ErrDuplicateName, d.buf[pos-n:pos])
+					return Token{}, wrapSyntacticError(d, err, pos-n, +1) // report position at start of string
+				}
+			}
+			d.Names.ReplaceLastQuotedOffset(pos - n) // only replace if insertQuoted succeeds
+		}
+		if err = d.Tokens.appendString(); err != nil {
+			return Token{}, wrapSyntacticError(d, err, pos-n, +1) // report position at start of string
+		}
+		d.prevStart, d.prevEnd = pos-n, pos
+		return Token{raw: &d.decodeBuffer, num: uint64(d.previousOffsetStart())}, nil
+
+	case '0':
+		// NOTE: Since JSON numbers are not self-terminating,
+		// we need to make sure that the next byte is not part of a number.
+		if n = jsonwire.ConsumeSimpleNumber(d.buf[pos:]); n == 0 || d.needMore(pos+n) {
+			oldAbsPos := d.baseOffset + int64(pos)
+			pos, err = d.consumeNumber(pos)
+			newAbsPos := d.baseOffset + int64(pos)
+			n = int(newAbsPos - oldAbsPos)
+			if err != nil {
+				return Token{}, wrapSyntacticError(d, err, pos, +1)
+			}
+		} else {
+			pos += n
+		}
+		if err = d.Tokens.appendNumber(); err != nil {
+			return Token{}, wrapSyntacticError(d, err, pos-n, +1) // report position at start of number
+		}
+		d.prevStart, d.prevEnd = pos-n, pos
+		return Token{raw: &d.decodeBuffer, num: uint64(d.previousOffsetStart())}, nil
+
+	case '{':
+		if err = d.Tokens.pushObject(); err != nil {
+			return Token{}, wrapSyntacticError(d, err, pos, +1)
+		}
+		d.Names.push()
+		if !d.Flags.Get(jsonflags.AllowDuplicateNames) {
+			d.Namespaces.push()
+		}
+		pos += 1
+		d.prevStart, d.prevEnd = pos, pos
+		return BeginObject, nil
+
+	case '}':
+		if err = d.Tokens.popObject(); err != nil {
+			return Token{}, wrapSyntacticError(d, err, pos, +1)
+		}
+		d.Names.pop()
+		if !d.Flags.Get(jsonflags.AllowDuplicateNames) {
+			d.Namespaces.pop()
+		}
+		pos += 1
+		d.prevStart, d.prevEnd = pos, pos
+		return EndObject, nil
+
+	case '[':
+		if err = d.Tokens.pushArray(); err != nil {
+			return Token{}, wrapSyntacticError(d, err, pos, +1)
+		}
+		pos += 1
+		d.prevStart, d.prevEnd = pos, pos
+		return BeginArray, nil
+
+	case ']':
+		if err = d.Tokens.popArray(); err != nil {
+			return Token{}, wrapSyntacticError(d, err, pos, +1)
+		}
+		pos += 1
+		d.prevStart, d.prevEnd = pos, pos
+		return EndArray, nil
+
+	default:
+		err = jsonwire.NewInvalidCharacterError(d.buf[pos:], "at start of value")
+		return Token{}, wrapSyntacticError(d, err, pos, +1)
+	}
+}
+
+// ReadValue returns the next raw JSON value, advancing the read offset.
+// The value is stripped of any leading or trailing whitespace and
+// contains the exact bytes of the input, which may contain invalid UTF-8
+// if [AllowInvalidUTF8] is specified.
+//
+// The returned value is only valid until the next Peek, Read, or Skip call and
+// may not be mutated while the Decoder remains in use.
+// If the decoder is currently at the end token for an object or array,
+// then it reports a [SyntacticError] and the internal state remains unchanged.
+// It returns [io.EOF] if there are no more values.
+func (d *Decoder) ReadValue() (Value, error) {
+	var flags jsonwire.ValueFlags
+	return d.s.ReadValue(&flags)
+}
+func (d *decoderState) ReadValue(flags *jsonwire.ValueFlags) (Value, error) {
+	// Determine the next kind.
+	var err error
+	var next Kind
+	pos := d.peekPos
+	if pos != 0 {
+		// Use cached peek result.
+		if d.peekErr != nil {
+			err := d.peekErr
+			d.peekPos, d.peekErr = 0, nil // possibly a transient I/O error
+			return nil, err
+		}
+		next = Kind(d.buf[pos]).normalize()
+		d.peekPos = 0 // reset cache
+	} else {
+		d.invalidatePreviousRead()
+		pos = d.prevEnd
+
+		// Consume leading whitespace.
+		pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+		if d.needMore(pos) {
+			if pos, err = d.consumeWhitespace(pos); err != nil {
+				if err == io.ErrUnexpectedEOF && d.Tokens.Depth() == 1 {
+					err = io.EOF // EOF possibly if no Tokens present after top-level value
+				}
+				return nil, wrapSyntacticError(d, err, pos, 0)
+			}
+		}
+
+		// Consume colon or comma.
+		var delim byte
+		if c := d.buf[pos]; c == ':' || c == ',' {
+			delim = c
+			pos += 1
+			pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+			if d.needMore(pos) {
+				if pos, err = d.consumeWhitespace(pos); err != nil {
+					err = wrapSyntacticError(d, err, pos, 0)
+					return nil, d.checkDelimBeforeIOError(delim, err)
+				}
+			}
+		}
+		next = Kind(d.buf[pos]).normalize()
+		if d.Tokens.needDelim(next) != delim {
+			return nil, d.checkDelim(delim, next)
+		}
+	}
+
+	// Handle the next value.
+	oldAbsPos := d.baseOffset + int64(pos)
+	pos, err = d.consumeValue(flags, pos, d.Tokens.Depth())
+	newAbsPos := d.baseOffset + int64(pos)
+	n := int(newAbsPos - oldAbsPos)
+	if err != nil {
+		return nil, wrapSyntacticError(d, err, pos, +1)
+	}
+	switch next {
+	case 'n', 't', 'f':
+		err = d.Tokens.appendLiteral()
+	case '"':
+		if d.Tokens.Last.NeedObjectName() {
+			if !d.Flags.Get(jsonflags.AllowDuplicateNames) {
+				if !d.Tokens.Last.isValidNamespace() {
+					err = errInvalidNamespace
+					break
+				}
+				if d.Tokens.Last.isActiveNamespace() && !d.Namespaces.Last().insertQuoted(d.buf[pos-n:pos], flags.IsVerbatim()) {
+					err = wrapWithObjectName(ErrDuplicateName, d.buf[pos-n:pos])
+					break
+				}
+			}
+			d.Names.ReplaceLastQuotedOffset(pos - n) // only replace if insertQuoted succeeds
+		}
+		err = d.Tokens.appendString()
+	case '0':
+		err = d.Tokens.appendNumber()
+	case '{':
+		if err = d.Tokens.pushObject(); err != nil {
+			break
+		}
+		if err = d.Tokens.popObject(); err != nil {
+			panic("BUG: popObject should never fail immediately after pushObject: " + err.Error())
+		}
+	case '[':
+		if err = d.Tokens.pushArray(); err != nil {
+			break
+		}
+		if err = d.Tokens.popArray(); err != nil {
+			panic("BUG: popArray should never fail immediately after pushArray: " + err.Error())
+		}
+	}
+	if err != nil {
+		return nil, wrapSyntacticError(d, err, pos-n, +1) // report position at start of value
+	}
+	d.prevEnd = pos
+	d.prevStart = pos - n
+	return d.buf[pos-n : pos : pos], nil
+}
+
+// CheckNextValue checks whether the next value is syntactically valid,
+// but does not advance the read offset.
+// If last, it verifies that the stream cleanly terminates with [io.EOF].
+func (d *decoderState) CheckNextValue(last bool) error {
+	d.PeekKind() // populates d.peekPos and d.peekErr
+	pos, err := d.peekPos, d.peekErr
+	d.peekPos, d.peekErr = 0, nil
+	if err != nil {
+		return err
+	}
+
+	var flags jsonwire.ValueFlags
+	if pos, err := d.consumeValue(&flags, pos, d.Tokens.Depth()); err != nil {
+		return wrapSyntacticError(d, err, pos, +1)
+	} else if last {
+		return d.checkEOF(pos)
+	}
+	return nil
+}
+
+// CheckEOF verifies that the input has no more data.
+func (d *decoderState) CheckEOF() error {
+	return d.checkEOF(d.prevEnd)
+}
+func (d *decoderState) checkEOF(pos int) error {
+	switch pos, err := d.consumeWhitespace(pos); err {
+	case nil:
+		err := jsonwire.NewInvalidCharacterError(d.buf[pos:], "after top-level value")
+		return wrapSyntacticError(d, err, pos, 0)
+	case io.ErrUnexpectedEOF:
+		return nil
+	default:
+		return err
+	}
+}
+
+// consumeWhitespace consumes all whitespace starting at d.buf[pos:].
+// It returns the new position in d.buf immediately after the last whitespace.
+// If it returns nil, there is guaranteed to at least be one unread byte.
+//
+// The following pattern is common in this implementation:
+//
+//	pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+//	if d.needMore(pos) {
+//		if pos, err = d.consumeWhitespace(pos); err != nil {
+//			return ...
+//		}
+//	}
+//
+// It is difficult to simplify this without sacrificing performance since
+// consumeWhitespace must be inlined. The body of the if statement is
+// executed only in rare situations where we need to fetch more data.
+// Since fetching may return an error, we also need to check the error.
+func (d *decoderState) consumeWhitespace(pos int) (newPos int, err error) {
+	for {
+		pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+		if d.needMore(pos) {
+			absPos := d.baseOffset + int64(pos)
+			err = d.fetch() // will mutate d.buf and invalidate pos
+			pos = int(absPos - d.baseOffset)
+			if err != nil {
+				return pos, err
+			}
+			continue
+		}
+		return pos, nil
+	}
+}
+
+// consumeValue consumes a single JSON value starting at d.buf[pos:].
+// It returns the new position in d.buf immediately after the value.
+func (d *decoderState) consumeValue(flags *jsonwire.ValueFlags, pos, depth int) (newPos int, err error) {
+	for {
+		var n int
+		var err error
+		switch next := Kind(d.buf[pos]).normalize(); next {
+		case 'n':
+			if n = jsonwire.ConsumeNull(d.buf[pos:]); n == 0 {
+				n, err = jsonwire.ConsumeLiteral(d.buf[pos:], "null")
+			}
+		case 'f':
+			if n = jsonwire.ConsumeFalse(d.buf[pos:]); n == 0 {
+				n, err = jsonwire.ConsumeLiteral(d.buf[pos:], "false")
+			}
+		case 't':
+			if n = jsonwire.ConsumeTrue(d.buf[pos:]); n == 0 {
+				n, err = jsonwire.ConsumeLiteral(d.buf[pos:], "true")
+			}
+		case '"':
+			if n = jsonwire.ConsumeSimpleString(d.buf[pos:]); n == 0 {
+				return d.consumeString(flags, pos)
+			}
+		case '0':
+			// NOTE: Since JSON numbers are not self-terminating,
+			// we need to make sure that the next byte is not part of a number.
+			if n = jsonwire.ConsumeSimpleNumber(d.buf[pos:]); n == 0 || d.needMore(pos+n) {
+				return d.consumeNumber(pos)
+			}
+		case '{':
+			return d.consumeObject(flags, pos, depth)
+		case '[':
+			return d.consumeArray(flags, pos, depth)
+		default:
+			if (d.Tokens.Last.isObject() && next == ']') || (d.Tokens.Last.isArray() && next == '}') {
+				return pos, errMismatchDelim
+			}
+			return pos, jsonwire.NewInvalidCharacterError(d.buf[pos:], "at start of value")
+		}
+		if err == io.ErrUnexpectedEOF {
+			absPos := d.baseOffset + int64(pos)
+			err = d.fetch() // will mutate d.buf and invalidate pos
+			pos = int(absPos - d.baseOffset)
+			if err != nil {
+				return pos + n, err
+			}
+			continue
+		}
+		return pos + n, err
+	}
+}
+
+// consumeLiteral consumes a single JSON literal starting at d.buf[pos:].
+// It returns the new position in d.buf immediately after the literal.
+func (d *decoderState) consumeLiteral(pos int, lit string) (newPos int, err error) {
+	for {
+		n, err := jsonwire.ConsumeLiteral(d.buf[pos:], lit)
+		if err == io.ErrUnexpectedEOF {
+			absPos := d.baseOffset + int64(pos)
+			err = d.fetch() // will mutate d.buf and invalidate pos
+			pos = int(absPos - d.baseOffset)
+			if err != nil {
+				return pos + n, err
+			}
+			continue
+		}
+		return pos + n, err
+	}
+}
+
+// consumeString consumes a single JSON string starting at d.buf[pos:].
+// It returns the new position in d.buf immediately after the string.
+func (d *decoderState) consumeString(flags *jsonwire.ValueFlags, pos int) (newPos int, err error) {
+	var n int
+	for {
+		n, err = jsonwire.ConsumeStringResumable(flags, d.buf[pos:], n, !d.Flags.Get(jsonflags.AllowInvalidUTF8))
+		if err == io.ErrUnexpectedEOF {
+			absPos := d.baseOffset + int64(pos)
+			err = d.fetch() // will mutate d.buf and invalidate pos
+			pos = int(absPos - d.baseOffset)
+			if err != nil {
+				return pos + n, err
+			}
+			continue
+		}
+		return pos + n, err
+	}
+}
+
+// consumeNumber consumes a single JSON number starting at d.buf[pos:].
+// It returns the new position in d.buf immediately after the number.
+func (d *decoderState) consumeNumber(pos int) (newPos int, err error) {
+	var n int
+	var state jsonwire.ConsumeNumberState
+	for {
+		n, state, err = jsonwire.ConsumeNumberResumable(d.buf[pos:], n, state)
+		// NOTE: Since JSON numbers are not self-terminating,
+		// we need to make sure that the next byte is not part of a number.
+		if err == io.ErrUnexpectedEOF || d.needMore(pos+n) {
+			mayTerminate := err == nil
+			absPos := d.baseOffset + int64(pos)
+			err = d.fetch() // will mutate d.buf and invalidate pos
+			pos = int(absPos - d.baseOffset)
+			if err != nil {
+				if mayTerminate && err == io.ErrUnexpectedEOF {
+					return pos + n, nil
+				}
+				return pos, err
+			}
+			continue
+		}
+		return pos + n, err
+	}
+}
+
+// consumeObject consumes a single JSON object starting at d.buf[pos:].
+// It returns the new position in d.buf immediately after the object.
+func (d *decoderState) consumeObject(flags *jsonwire.ValueFlags, pos, depth int) (newPos int, err error) {
+	var n int
+	var names *objectNamespace
+	if !d.Flags.Get(jsonflags.AllowDuplicateNames) {
+		d.Namespaces.push()
+		defer d.Namespaces.pop()
+		names = d.Namespaces.Last()
+	}
+
+	// Handle before start.
+	if uint(pos) >= uint(len(d.buf)) || d.buf[pos] != '{' {
+		panic("BUG: consumeObject must be called with a buffer that starts with '{'")
+	} else if depth == maxNestingDepth+1 {
+		return pos, errMaxDepth
+	}
+	pos++
+
+	// Handle after start.
+	pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+	if d.needMore(pos) {
+		if pos, err = d.consumeWhitespace(pos); err != nil {
+			return pos, err
+		}
+	}
+	if d.buf[pos] == '}' {
+		pos++
+		return pos, nil
+	}
+
+	depth++
+	for {
+		// Handle before name.
+		pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+		if d.needMore(pos) {
+			if pos, err = d.consumeWhitespace(pos); err != nil {
+				return pos, err
+			}
+		}
+		var flags2 jsonwire.ValueFlags
+		if n = jsonwire.ConsumeSimpleString(d.buf[pos:]); n == 0 {
+			oldAbsPos := d.baseOffset + int64(pos)
+			pos, err = d.consumeString(&flags2, pos)
+			newAbsPos := d.baseOffset + int64(pos)
+			n = int(newAbsPos - oldAbsPos)
+			flags.Join(flags2)
+			if err != nil {
+				return pos, err
+			}
+		} else {
+			pos += n
+		}
+		quotedName := d.buf[pos-n : pos]
+		if !d.Flags.Get(jsonflags.AllowDuplicateNames) && !names.insertQuoted(quotedName, flags2.IsVerbatim()) {
+			return pos - n, wrapWithObjectName(ErrDuplicateName, quotedName)
+		}
+
+		// Handle after name.
+		pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+		if d.needMore(pos) {
+			if pos, err = d.consumeWhitespace(pos); err != nil {
+				return pos, wrapWithObjectName(err, quotedName)
+			}
+		}
+		if d.buf[pos] != ':' {
+			err := jsonwire.NewInvalidCharacterError(d.buf[pos:], "after object name (expecting ':')")
+			return pos, wrapWithObjectName(err, quotedName)
+		}
+		pos++
+
+		// Handle before value.
+		pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+		if d.needMore(pos) {
+			if pos, err = d.consumeWhitespace(pos); err != nil {
+				return pos, wrapWithObjectName(err, quotedName)
+			}
+		}
+		pos, err = d.consumeValue(flags, pos, depth)
+		if err != nil {
+			return pos, wrapWithObjectName(err, quotedName)
+		}
+
+		// Handle after value.
+		pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+		if d.needMore(pos) {
+			if pos, err = d.consumeWhitespace(pos); err != nil {
+				return pos, err
+			}
+		}
+		switch d.buf[pos] {
+		case ',':
+			pos++
+			continue
+		case '}':
+			pos++
+			return pos, nil
+		default:
+			return pos, jsonwire.NewInvalidCharacterError(d.buf[pos:], "after object value (expecting ',' or '}')")
+		}
+	}
+}
+
+// consumeArray consumes a single JSON array starting at d.buf[pos:].
+// It returns the new position in d.buf immediately after the array.
+func (d *decoderState) consumeArray(flags *jsonwire.ValueFlags, pos, depth int) (newPos int, err error) {
+	// Handle before start.
+	if uint(pos) >= uint(len(d.buf)) || d.buf[pos] != '[' {
+		panic("BUG: consumeArray must be called with a buffer that starts with '['")
+	} else if depth == maxNestingDepth+1 {
+		return pos, errMaxDepth
+	}
+	pos++
+
+	// Handle after start.
+	pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+	if d.needMore(pos) {
+		if pos, err = d.consumeWhitespace(pos); err != nil {
+			return pos, err
+		}
+	}
+	if d.buf[pos] == ']' {
+		pos++
+		return pos, nil
+	}
+
+	var idx int64
+	depth++
+	for {
+		// Handle before value.
+		pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+		if d.needMore(pos) {
+			if pos, err = d.consumeWhitespace(pos); err != nil {
+				return pos, err
+			}
+		}
+		pos, err = d.consumeValue(flags, pos, depth)
+		if err != nil {
+			return pos, wrapWithArrayIndex(err, idx)
+		}
+
+		// Handle after value.
+		pos += jsonwire.ConsumeWhitespace(d.buf[pos:])
+		if d.needMore(pos) {
+			if pos, err = d.consumeWhitespace(pos); err != nil {
+				return pos, err
+			}
+		}
+		switch d.buf[pos] {
+		case ',':
+			pos++
+			idx++
+			continue
+		case ']':
+			pos++
+			return pos, nil
+		default:
+			return pos, jsonwire.NewInvalidCharacterError(d.buf[pos:], "after array element (expecting ',' or ']')")
+		}
+	}
+}
+
+// InputOffset returns the current input byte offset. It gives the location
+// of the next byte immediately after the most recently returned token or value.
+// The number of bytes actually read from the underlying [io.Reader] may be more
+// than this offset due to internal buffering effects.
+func (d *Decoder) InputOffset() int64 {
+	return d.s.previousOffsetEnd()
+}
+
+// UnreadBuffer returns the data remaining in the unread buffer,
+// which may contain zero or more bytes.
+// The returned buffer must not be mutated while Decoder continues to be used.
+// The buffer contents are valid until the next Peek, Read, or Skip call.
+func (d *Decoder) UnreadBuffer() []byte {
+	return d.s.unreadBuffer()
+}
+
+// StackDepth returns the depth of the state machine for read JSON data.
+// Each level on the stack represents a nested JSON object or array.
+// It is incremented whenever an [BeginObject] or [BeginArray] token is encountered
+// and decremented whenever an [EndObject] or [EndArray] token is encountered.
+// The depth is zero-indexed, where zero represents the top-level JSON value.
+func (d *Decoder) StackDepth() int {
+	// NOTE: Keep in sync with Encoder.StackDepth.
+	return d.s.Tokens.Depth() - 1
+}
+
+// StackIndex returns information about the specified stack level.
+// It must be a number between 0 and [Decoder.StackDepth], inclusive.
+// For each level, it reports the kind:
+//
+//   - 0 for a level of zero,
+//   - '{' for a level representing a JSON object, and
+//   - '[' for a level representing a JSON array.
+//
+// It also reports the length of that JSON object or array.
+// Each name and value in a JSON object is counted separately,
+// so the effective number of members would be half the length.
+// A complete JSON object must have an even length.
+func (d *Decoder) StackIndex(i int) (Kind, int64) {
+	// NOTE: Keep in sync with Encoder.StackIndex.
+	switch s := d.s.Tokens.index(i); {
+	case i > 0 && s.isObject():
+		return '{', s.Length()
+	case i > 0 && s.isArray():
+		return '[', s.Length()
+	default:
+		return 0, s.Length()
+	}
+}
+
+// StackPointer returns a JSON Pointer (RFC 6901) to the most recently read value.
+func (d *Decoder) StackPointer() Pointer {
+	return Pointer(d.s.AppendStackPointer(nil, -1))
+}
+
+func (d *decoderState) AppendStackPointer(b []byte, where int) []byte {
+	d.Names.copyQuotedBuffer(d.buf)
+	return d.state.appendStackPointer(b, where)
+}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/doc.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/doc.go
new file mode 100644
index 0000000000..bea3ccd348
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/doc.go
@@ -0,0 +1,109 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package jsontext implements syntactic processing of JSON
+// as specified in RFC 4627, RFC 7159, RFC 7493, RFC 8259, and RFC 8785.
+// JSON is a simple data interchange format that can represent
+// primitive data types such as booleans, strings, and numbers,
+// in addition to structured data types such as objects and arrays.
+//
+// The [Encoder] and [Decoder] types are used to encode or decode
+// a stream of JSON tokens or values.
+//
+// # Tokens and Values
+//
+// A JSON token refers to the basic structural elements of JSON:
+//
+//   - a JSON literal (i.e., null, true, or false)
+//   - a JSON string (e.g., "hello, world!")
+//   - a JSON number (e.g., 123.456)
+//   - a begin or end delimiter for a JSON object (i.e., '{' or '}')
+//   - a begin or end delimiter for a JSON array (i.e., '[' or ']')
+//
+// A JSON token is represented by the [Token] type in Go. Technically,
+// there are two additional structural characters (i.e., ':' and ','),
+// but there is no [Token] representation for them since their presence
+// can be inferred by the structure of the JSON grammar itself.
+// For example, there must always be an implicit colon between
+// the name and value of a JSON object member.
+//
+// A JSON value refers to a complete unit of JSON data:
+//
+//   - a JSON literal, string, or number
+//   - a JSON object (e.g., `{"name":"value"}`)
+//   - a JSON array (e.g., `[1,2,3,]`)
+//
+// A JSON value is represented by the [Value] type in Go and is a []byte
+// containing the raw textual representation of the value. There is some overlap
+// between tokens and values as both contain literals, strings, and numbers.
+// However, only a value can represent the entirety of a JSON object or array.
+//
+// The [Encoder] and [Decoder] types contain methods to read or write the next
+// [Token] or [Value] in a sequence. They maintain a state machine to validate
+// whether the sequence of JSON tokens and/or values produces a valid JSON.
+// [Options] may be passed to the [NewEncoder] or [NewDecoder] constructors
+// to configure the syntactic behavior of encoding and decoding.
+//
+// # Terminology
+//
+// The terms "encode" and "decode" are used for syntactic functionality
+// that is concerned with processing JSON based on its grammar, and
+// the terms "marshal" and "unmarshal" are used for semantic functionality
+// that determines the meaning of JSON values as Go values and vice-versa.
+// This package (i.e., [jsontext]) deals with JSON at a syntactic layer,
+// while [encoding/json/v2] deals with JSON at a semantic layer.
+// The goal is to provide a clear distinction between functionality that
+// is purely concerned with encoding versus that of marshaling.
+// For example, one can directly encode a stream of JSON tokens without
+// needing to marshal a concrete Go value representing them.
+// Similarly, one can decode a stream of JSON tokens without
+// needing to unmarshal them into a concrete Go value.
+//
+// This package uses JSON terminology when discussing JSON, which may differ
+// from related concepts in Go or elsewhere in computing literature.
+//
+//   - a JSON "object" refers to an unordered collection of name/value members.
+//   - a JSON "array" refers to an ordered sequence of elements.
+//   - a JSON "value" refers to either a literal (i.e., null, false, or true),
+//     string, number, object, or array.
+//
+// See RFC 8259 for more information.
+//
+// # Specifications
+//
+// Relevant specifications include RFC 4627, RFC 7159, RFC 7493, RFC 8259,
+// and RFC 8785. Each RFC is generally a stricter subset of another RFC.
+// In increasing order of strictness:
+//
+//   - RFC 4627 and RFC 7159 do not require (but recommend) the use of UTF-8
+//     and also do not require (but recommend) that object names be unique.
+//   - RFC 8259 requires the use of UTF-8,
+//     but does not require (but recommends) that object names be unique.
+//   - RFC 7493 requires the use of UTF-8
+//     and also requires that object names be unique.
+//   - RFC 8785 defines a canonical representation. It requires the use of UTF-8
+//     and also requires that object names be unique and in a specific ordering.
+//     It specifies exactly how strings and numbers must be formatted.
+//
+// The primary difference between RFC 4627 and RFC 7159 is that the former
+// restricted top-level values to only JSON objects and arrays, while
+// RFC 7159 and subsequent RFCs permit top-level values to additionally be
+// JSON nulls, booleans, strings, or numbers.
+//
+// By default, this package operates on RFC 7493, but can be configured
+// to operate according to the other RFC specifications.
+// RFC 7493 is a stricter subset of RFC 8259 and fully compliant with it.
+// In particular, it makes specific choices about behavior that RFC 8259
+// leaves as undefined in order to ensure greater interoperability.
+//
+// # Security Considerations
+//
+// See the "Security Considerations" section in [encoding/json/v2].
+package jsontext
+
+// requireKeyedLiterals can be embedded in a struct to require keyed literals.
+type requireKeyedLiterals struct{}
+
+// nonComparable can be embedded in a struct to prevent comparability.
+type nonComparable [0]func()
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/encode.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/encode.go
new file mode 100644
index 0000000000..36bf7efdf1
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/encode.go
@@ -0,0 +1,975 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package jsontext
+
+import (
+	"bytes"
+	"io"
+	"math/bits"
+
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire"
+)
+
+// Encoder is a streaming encoder from raw JSON tokens and values.
+// It is used to write a stream of top-level JSON values,
+// each terminated with a newline character.
+//
+// [Encoder.WriteToken] and [Encoder.WriteValue] calls may be interleaved.
+// For example, the following JSON value:
+//
+//	{"name":"value","array":[null,false,true,3.14159],"object":{"k":"v"}}
+//
+// can be composed with the following calls (ignoring errors for brevity):
+//
+//	e.WriteToken(BeginObject)        // {
+//	e.WriteToken(String("name"))     // "name"
+//	e.WriteToken(String("value"))    // "value"
+//	e.WriteValue(Value(`"array"`))   // "array"
+//	e.WriteToken(BeginArray)         // [
+//	e.WriteToken(Null)               // null
+//	e.WriteToken(False)              // false
+//	e.WriteValue(Value("true"))      // true
+//	e.WriteToken(Float(3.14159))     // 3.14159
+//	e.WriteToken(EndArray)           // ]
+//	e.WriteValue(Value(`"object"`))  // "object"
+//	e.WriteValue(Value(`{"k":"v"}`)) // {"k":"v"}
+//	e.WriteToken(EndObject)          // }
+//
+// The above is one of many possible sequence of calls and
+// may not represent the most sensible method to call for any given token/value.
+// For example, it is probably more common to call [Encoder.WriteToken] with a string
+// for object names.
+type Encoder struct {
+	s encoderState
+}
+
+// encoderState is the low-level state of Encoder.
+// It has exported fields and method for use by the "json" package.
+type encoderState struct {
+	state
+	encodeBuffer
+	jsonopts.Struct
+
+	SeenPointers map[any]struct{} // only used when marshaling; identical to json.seenPointers
+}
+
+// encodeBuffer is a buffer split into 2 segments:
+//
+//   - buf[0:len(buf)]        // written (but unflushed) portion of the buffer
+//   - buf[len(buf):cap(buf)] // unused portion of the buffer
+type encodeBuffer struct {
+	Buf []byte // may alias wr if it is a bytes.Buffer
+
+	// baseOffset is added to len(buf) to obtain the absolute offset
+	// relative to the start of io.Writer stream.
+	baseOffset int64
+
+	wr io.Writer
+
+	// maxValue is the approximate maximum Value size passed to WriteValue.
+	maxValue int
+	// availBuffer is the buffer returned by the AvailableBuffer method.
+	availBuffer []byte // always has zero length
+	// bufStats is statistics about buffer utilization.
+	// It is only used with pooled encoders in pools.go.
+	bufStats bufferStatistics
+}
+
+// NewEncoder constructs a new streaming encoder writing to w
+// configured with the provided options.
+// It flushes the internal buffer when the buffer is sufficiently full or
+// when a top-level value has been written.
+//
+// If w is a [bytes.Buffer], then the encoder appends directly into the buffer
+// without copying the contents from an intermediate buffer.
+func NewEncoder(w io.Writer, opts ...Options) *Encoder {
+	e := new(Encoder)
+	e.Reset(w, opts...)
+	return e
+}
+
+// Reset resets an encoder such that it is writing afresh to w and
+// configured with the provided options. Reset must not be called on
+// a Encoder passed to the [encoding/json/v2.MarshalerTo.MarshalJSONTo] method
+// or the [encoding/json/v2.MarshalToFunc] function.
+func (e *Encoder) Reset(w io.Writer, opts ...Options) {
+	switch {
+	case e == nil:
+		panic("jsontext: invalid nil Encoder")
+	case w == nil:
+		panic("jsontext: invalid nil io.Writer")
+	case e.s.Flags.Get(jsonflags.WithinArshalCall):
+		panic("jsontext: cannot reset Encoder passed to json.MarshalerTo")
+	}
+	// Reuse the buffer if it does not alias a previous [bytes.Buffer].
+	b := e.s.Buf[:0]
+	if _, ok := e.s.wr.(*bytes.Buffer); ok {
+		b = nil
+	}
+	e.s.reset(b, w, opts...)
+}
+
+func (e *encoderState) reset(b []byte, w io.Writer, opts ...Options) {
+	e.state.reset()
+	e.encodeBuffer = encodeBuffer{Buf: b, wr: w, availBuffer: e.availBuffer, bufStats: e.bufStats}
+	if bb, ok := w.(*bytes.Buffer); ok && bb != nil {
+		e.Buf = bb.AvailableBuffer() // alias the unused buffer of bb
+	}
+	opts2 := jsonopts.Struct{} // avoid mutating e.Struct in case it is part of opts
+	opts2.Join(opts...)
+	e.Struct = opts2
+	if e.Flags.Get(jsonflags.Multiline) {
+		if !e.Flags.Has(jsonflags.SpaceAfterColon) {
+			e.Flags.Set(jsonflags.SpaceAfterColon | 1)
+		}
+		if !e.Flags.Has(jsonflags.SpaceAfterComma) {
+			e.Flags.Set(jsonflags.SpaceAfterComma | 0)
+		}
+		if !e.Flags.Has(jsonflags.Indent) {
+			e.Flags.Set(jsonflags.Indent | 1)
+			e.Indent = "\t"
+		}
+	}
+}
+
+// Options returns the options used to construct the decoder and
+// may additionally contain semantic options passed to a
+// [encoding/json/v2.MarshalEncode] call.
+//
+// If operating within
+// a [encoding/json/v2.MarshalerTo.MarshalJSONTo] method call or
+// a [encoding/json/v2.MarshalToFunc] function call,
+// then the returned options are only valid within the call.
+func (e *Encoder) Options() Options {
+	return &e.s.Struct
+}
+
+// NeedFlush determines whether to flush at this point.
+func (e *encoderState) NeedFlush() bool {
+	// NOTE: This function is carefully written to be inlinable.
+
+	// Avoid flushing if e.wr is nil since there is no underlying writer.
+	// Flush if less than 25% of the capacity remains.
+	// Flushing at some constant fraction ensures that the buffer stops growing
+	// so long as the largest Token or Value fits within that unused capacity.
+	return e.wr != nil && (e.Tokens.Depth() == 1 || len(e.Buf) > 3*cap(e.Buf)/4)
+}
+
+// Flush flushes the buffer to the underlying io.Writer.
+// It may append a trailing newline after the top-level value.
+func (e *encoderState) Flush() error {
+	if e.wr == nil || e.avoidFlush() {
+		return nil
+	}
+
+	// In streaming mode, always emit a newline after the top-level value.
+	if e.Tokens.Depth() == 1 && !e.Flags.Get(jsonflags.OmitTopLevelNewline) {
+		e.Buf = append(e.Buf, '\n')
+	}
+
+	// Inform objectNameStack that we are about to flush the buffer content.
+	e.Names.copyQuotedBuffer(e.Buf)
+
+	// Specialize bytes.Buffer for better performance.
+	if bb, ok := e.wr.(*bytes.Buffer); ok {
+		// If e.buf already aliases the internal buffer of bb,
+		// then the Write call simply increments the internal offset,
+		// otherwise Write operates as expected.
+		// See https://go.dev/issue/42986.
+		n, _ := bb.Write(e.Buf) // never fails unless bb is nil
+		e.baseOffset += int64(n)
+
+		// If the internal buffer of bytes.Buffer is too small,
+		// append operations elsewhere in the Encoder may grow the buffer.
+		// This would be semantically correct, but hurts performance.
+		// As such, ensure 25% of the current length is always available
+		// to reduce the probability that other appends must allocate.
+		if avail := bb.Available(); avail < bb.Len()/4 {
+			bb.Grow(avail + 1)
+		}
+
+		e.Buf = bb.AvailableBuffer()
+		return nil
+	}
+
+	// Flush the internal buffer to the underlying io.Writer.
+	n, err := e.wr.Write(e.Buf)
+	e.baseOffset += int64(n)
+	if err != nil {
+		// In the event of an error, preserve the unflushed portion.
+		// Thus, write errors aren't fatal so long as the io.Writer
+		// maintains consistent state after errors.
+		if n > 0 {
+			e.Buf = e.Buf[:copy(e.Buf, e.Buf[n:])]
+		}
+		return &ioError{action: "write", err: err}
+	}
+	e.Buf = e.Buf[:0]
+
+	// Check whether to grow the buffer.
+	// Note that cap(e.buf) may already exceed maxBufferSize since
+	// an append elsewhere already grew it to store a large token.
+	const maxBufferSize = 4 << 10
+	const growthSizeFactor = 2 // higher value is faster
+	const growthRateFactor = 2 // higher value is slower
+	// By default, grow if below the maximum buffer size.
+	grow := cap(e.Buf) <= maxBufferSize/growthSizeFactor
+	// Growing can be expensive, so only grow
+	// if a sufficient number of bytes have been processed.
+	grow = grow && int64(cap(e.Buf)) < e.previousOffsetEnd()/growthRateFactor
+	if grow {
+		e.Buf = make([]byte, 0, cap(e.Buf)*growthSizeFactor)
+	}
+
+	return nil
+}
+func (d *encodeBuffer) offsetAt(pos int) int64   { return d.baseOffset + int64(pos) }
+func (e *encodeBuffer) previousOffsetEnd() int64 { return e.baseOffset + int64(len(e.Buf)) }
+func (e *encodeBuffer) unflushedBuffer() []byte  { return e.Buf }
+
+// avoidFlush indicates whether to avoid flushing to ensure there is always
+// enough in the buffer to unwrite the last object member if it were empty.
+func (e *encoderState) avoidFlush() bool {
+	switch {
+	case e.Tokens.Last.Length() == 0:
+		// Never flush after BeginObject or BeginArray since we don't know yet
+		// if the object or array will end up being empty.
+		return true
+	case e.Tokens.Last.needObjectValue():
+		// Never flush before the object value since we don't know yet
+		// if the object value will end up being empty.
+		return true
+	case e.Tokens.Last.NeedObjectName() && len(e.Buf) >= 2:
+		// Never flush after the object value if it does turn out to be empty.
+		switch string(e.Buf[len(e.Buf)-2:]) {
+		case `ll`, `""`, `{}`, `[]`: // last two bytes of every empty value
+			return true
+		}
+	}
+	return false
+}
+
+// UnwriteEmptyObjectMember unwrites the last object member if it is empty
+// and reports whether it performed an unwrite operation.
+func (e *encoderState) UnwriteEmptyObjectMember(prevName *string) bool {
+	if last := e.Tokens.Last; !last.isObject() || !last.NeedObjectName() || last.Length() == 0 {
+		panic("BUG: must be called on an object after writing a value")
+	}
+
+	// The flushing logic is modified to never flush a trailing empty value.
+	// The encoder never writes trailing whitespace eagerly.
+	b := e.unflushedBuffer()
+
+	// Detect whether the last value was empty.
+	var n int
+	if len(b) >= 3 {
+		switch string(b[len(b)-2:]) {
+		case "ll": // last two bytes of `null`
+			n = len(`null`)
+		case `""`:
+			// It is possible for a non-empty string to have `""` as a suffix
+			// if the second to the last quote was escaped.
+			if b[len(b)-3] == '\\' {
+				return false // e.g., `"\""` is not empty
+			}
+			n = len(`""`)
+		case `{}`:
+			n = len(`{}`)
+		case `[]`:
+			n = len(`[]`)
+		}
+	}
+	if n == 0 {
+		return false
+	}
+
+	// Unwrite the value, whitespace, colon, name, whitespace, and comma.
+	b = b[:len(b)-n]
+	b = jsonwire.TrimSuffixWhitespace(b)
+	b = jsonwire.TrimSuffixByte(b, ':')
+	b = jsonwire.TrimSuffixString(b)
+	b = jsonwire.TrimSuffixWhitespace(b)
+	b = jsonwire.TrimSuffixByte(b, ',')
+	e.Buf = b // store back truncated unflushed buffer
+
+	// Undo state changes.
+	e.Tokens.Last.decrement() // for object member value
+	e.Tokens.Last.decrement() // for object member name
+	if !e.Flags.Get(jsonflags.AllowDuplicateNames) {
+		if e.Tokens.Last.isActiveNamespace() {
+			e.Namespaces.Last().removeLast()
+		}
+	}
+	e.Names.clearLast()
+	if prevName != nil {
+		e.Names.copyQuotedBuffer(e.Buf) // required by objectNameStack.replaceLastUnquotedName
+		e.Names.replaceLastUnquotedName(*prevName)
+	}
+	return true
+}
+
+// UnwriteOnlyObjectMemberName unwrites the only object member name
+// and returns the unquoted name.
+func (e *encoderState) UnwriteOnlyObjectMemberName() string {
+	if last := e.Tokens.Last; !last.isObject() || last.Length() != 1 {
+		panic("BUG: must be called on an object after writing first name")
+	}
+
+	// Unwrite the name and whitespace.
+	b := jsonwire.TrimSuffixString(e.Buf)
+	isVerbatim := bytes.IndexByte(e.Buf[len(b):], '\\') < 0
+	name := string(jsonwire.UnquoteMayCopy(e.Buf[len(b):], isVerbatim))
+	e.Buf = jsonwire.TrimSuffixWhitespace(b)
+
+	// Undo state changes.
+	e.Tokens.Last.decrement()
+	if !e.Flags.Get(jsonflags.AllowDuplicateNames) {
+		if e.Tokens.Last.isActiveNamespace() {
+			e.Namespaces.Last().removeLast()
+		}
+	}
+	e.Names.clearLast()
+	return name
+}
+
+// WriteToken writes the next token and advances the internal write offset.
+//
+// The provided token kind must be consistent with the JSON grammar.
+// For example, it is an error to provide a number when the encoder
+// is expecting an object name (which is always a string), or
+// to provide an end object delimiter when the encoder is finishing an array.
+// If the provided token is invalid, then it reports a [SyntacticError] and
+// the internal state remains unchanged. The offset reported
+// in [SyntacticError] will be relative to the [Encoder.OutputOffset].
+func (e *Encoder) WriteToken(t Token) error {
+	return e.s.WriteToken(t)
+}
+func (e *encoderState) WriteToken(t Token) error {
+	k := t.Kind()
+	b := e.Buf // use local variable to avoid mutating e in case of error
+
+	// Append any delimiters or optional whitespace.
+	b = e.Tokens.MayAppendDelim(b, k)
+	if e.Flags.Get(jsonflags.AnyWhitespace) {
+		b = e.appendWhitespace(b, k)
+	}
+	pos := len(b) // offset before the token
+
+	// Append the token to the output and to the state machine.
+	var err error
+	switch k {
+	case 'n':
+		b = append(b, "null"...)
+		err = e.Tokens.appendLiteral()
+	case 'f':
+		b = append(b, "false"...)
+		err = e.Tokens.appendLiteral()
+	case 't':
+		b = append(b, "true"...)
+		err = e.Tokens.appendLiteral()
+	case '"':
+		if b, err = t.appendString(b, &e.Flags); err != nil {
+			break
+		}
+		if e.Tokens.Last.NeedObjectName() {
+			if !e.Flags.Get(jsonflags.AllowDuplicateNames) {
+				if !e.Tokens.Last.isValidNamespace() {
+					err = errInvalidNamespace
+					break
+				}
+				if e.Tokens.Last.isActiveNamespace() && !e.Namespaces.Last().insertQuoted(b[pos:], false) {
+					err = wrapWithObjectName(ErrDuplicateName, b[pos:])
+					break
+				}
+			}
+			e.Names.ReplaceLastQuotedOffset(pos) // only replace if insertQuoted succeeds
+		}
+		err = e.Tokens.appendString()
+	case '0':
+		if b, err = t.appendNumber(b, &e.Flags); err != nil {
+			break
+		}
+		err = e.Tokens.appendNumber()
+	case '{':
+		b = append(b, '{')
+		if err = e.Tokens.pushObject(); err != nil {
+			break
+		}
+		e.Names.push()
+		if !e.Flags.Get(jsonflags.AllowDuplicateNames) {
+			e.Namespaces.push()
+		}
+	case '}':
+		b = append(b, '}')
+		if err = e.Tokens.popObject(); err != nil {
+			break
+		}
+		e.Names.pop()
+		if !e.Flags.Get(jsonflags.AllowDuplicateNames) {
+			e.Namespaces.pop()
+		}
+	case '[':
+		b = append(b, '[')
+		err = e.Tokens.pushArray()
+	case ']':
+		b = append(b, ']')
+		err = e.Tokens.popArray()
+	default:
+		err = errInvalidToken
+	}
+	if err != nil {
+		return wrapSyntacticError(e, err, pos, +1)
+	}
+
+	// Finish off the buffer and store it back into e.
+	e.Buf = b
+	if e.NeedFlush() {
+		return e.Flush()
+	}
+	return nil
+}
+
+// AppendRaw appends either a raw string (without double quotes) or number.
+// Specify safeASCII if the string output is guaranteed to be ASCII
+// without any characters (including '<', '>', and '&') that need escaping,
+// otherwise this will validate whether the string needs escaping.
+// The appended bytes for a JSON number must be valid.
+//
+// This is a specialized implementation of Encoder.WriteValue
+// that allows appending directly into the buffer.
+// It is only called from marshal logic in the "json" package.
+func (e *encoderState) AppendRaw(k Kind, safeASCII bool, appendFn func([]byte) ([]byte, error)) error {
+	b := e.Buf // use local variable to avoid mutating e in case of error
+
+	// Append any delimiters or optional whitespace.
+	b = e.Tokens.MayAppendDelim(b, k)
+	if e.Flags.Get(jsonflags.AnyWhitespace) {
+		b = e.appendWhitespace(b, k)
+	}
+	pos := len(b) // offset before the token
+
+	var err error
+	switch k {
+	case '"':
+		// Append directly into the encoder buffer by assuming that
+		// most of the time none of the characters need escaping.
+		b = append(b, '"')
+		if b, err = appendFn(b); err != nil {
+			return err
+		}
+		b = append(b, '"')
+
+		// Check whether we need to escape the string and if necessary
+		// copy it to a scratch buffer and then escape it back.
+		isVerbatim := safeASCII || !jsonwire.NeedEscape(b[pos+len(`"`):len(b)-len(`"`)])
+		if !isVerbatim {
+			var err error
+			b2 := append(e.availBuffer, b[pos+len(`"`):len(b)-len(`"`)]...)
+			b, err = jsonwire.AppendQuote(b[:pos], string(b2), &e.Flags)
+			e.availBuffer = b2[:0]
+			if err != nil {
+				return wrapSyntacticError(e, err, pos, +1)
+			}
+		}
+
+		// Update the state machine.
+		if e.Tokens.Last.NeedObjectName() {
+			if !e.Flags.Get(jsonflags.AllowDuplicateNames) {
+				if !e.Tokens.Last.isValidNamespace() {
+					return wrapSyntacticError(e, err, pos, +1)
+				}
+				if e.Tokens.Last.isActiveNamespace() && !e.Namespaces.Last().insertQuoted(b[pos:], isVerbatim) {
+					err = wrapWithObjectName(ErrDuplicateName, b[pos:])
+					return wrapSyntacticError(e, err, pos, +1)
+				}
+			}
+			e.Names.ReplaceLastQuotedOffset(pos) // only replace if insertQuoted succeeds
+		}
+		if err := e.Tokens.appendString(); err != nil {
+			return wrapSyntacticError(e, err, pos, +1)
+		}
+	case '0':
+		if b, err = appendFn(b); err != nil {
+			return err
+		}
+		if err := e.Tokens.appendNumber(); err != nil {
+			return wrapSyntacticError(e, err, pos, +1)
+		}
+	default:
+		panic("BUG: invalid kind")
+	}
+
+	// Finish off the buffer and store it back into e.
+	e.Buf = b
+	if e.NeedFlush() {
+		return e.Flush()
+	}
+	return nil
+}
+
+// WriteValue writes the next raw value and advances the internal write offset.
+// The Encoder does not simply copy the provided value verbatim, but
+// parses it to ensure that it is syntactically valid and reformats it
+// according to how the Encoder is configured to format whitespace and strings.
+// If [AllowInvalidUTF8] is specified, then any invalid UTF-8 is mangled
+// as the Unicode replacement character, U+FFFD.
+//
+// The provided value kind must be consistent with the JSON grammar
+// (see examples on [Encoder.WriteToken]). If the provided value is invalid,
+// then it reports a [SyntacticError] and the internal state remains unchanged.
+// The offset reported in [SyntacticError] will be relative to the
+// [Encoder.OutputOffset] plus the offset into v of any encountered syntax error.
+func (e *Encoder) WriteValue(v Value) error {
+	return e.s.WriteValue(v)
+}
+func (e *encoderState) WriteValue(v Value) error {
+	e.maxValue |= len(v) // bitwise OR is a fast approximation of max
+
+	k := v.Kind()
+	b := e.Buf // use local variable to avoid mutating e in case of error
+
+	// Append any delimiters or optional whitespace.
+	b = e.Tokens.MayAppendDelim(b, k)
+	if e.Flags.Get(jsonflags.AnyWhitespace) {
+		b = e.appendWhitespace(b, k)
+	}
+	pos := len(b) // offset before the value
+
+	// Append the value the output.
+	var n int
+	n += jsonwire.ConsumeWhitespace(v[n:])
+	b, m, err := e.reformatValue(b, v[n:], e.Tokens.Depth())
+	if err != nil {
+		return wrapSyntacticError(e, err, pos+n+m, +1)
+	}
+	n += m
+	n += jsonwire.ConsumeWhitespace(v[n:])
+	if len(v) > n {
+		err = jsonwire.NewInvalidCharacterError(v[n:], "after top-level value")
+		return wrapSyntacticError(e, err, pos+n, 0)
+	}
+
+	// Append the kind to the state machine.
+	switch k {
+	case 'n', 'f', 't':
+		err = e.Tokens.appendLiteral()
+	case '"':
+		if e.Tokens.Last.NeedObjectName() {
+			if !e.Flags.Get(jsonflags.AllowDuplicateNames) {
+				if !e.Tokens.Last.isValidNamespace() {
+					err = errInvalidNamespace
+					break
+				}
+				if e.Tokens.Last.isActiveNamespace() && !e.Namespaces.Last().insertQuoted(b[pos:], false) {
+					err = wrapWithObjectName(ErrDuplicateName, b[pos:])
+					break
+				}
+			}
+			e.Names.ReplaceLastQuotedOffset(pos) // only replace if insertQuoted succeeds
+		}
+		err = e.Tokens.appendString()
+	case '0':
+		err = e.Tokens.appendNumber()
+	case '{':
+		if err = e.Tokens.pushObject(); err != nil {
+			break
+		}
+		if err = e.Tokens.popObject(); err != nil {
+			panic("BUG: popObject should never fail immediately after pushObject: " + err.Error())
+		}
+		if e.Flags.Get(jsonflags.ReorderRawObjects) {
+			mustReorderObjects(b[pos:])
+		}
+	case '[':
+		if err = e.Tokens.pushArray(); err != nil {
+			break
+		}
+		if err = e.Tokens.popArray(); err != nil {
+			panic("BUG: popArray should never fail immediately after pushArray: " + err.Error())
+		}
+		if e.Flags.Get(jsonflags.ReorderRawObjects) {
+			mustReorderObjects(b[pos:])
+		}
+	}
+	if err != nil {
+		return wrapSyntacticError(e, err, pos, +1)
+	}
+
+	// Finish off the buffer and store it back into e.
+	e.Buf = b
+	if e.NeedFlush() {
+		return e.Flush()
+	}
+	return nil
+}
+
+// CountNextDelimWhitespace counts the number of bytes of delimiter and
+// whitespace bytes assuming the upcoming token is a JSON value.
+// This method is used for error reporting at the semantic layer.
+func (e *encoderState) CountNextDelimWhitespace() (n int) {
+	const next = Kind('"') // arbitrary kind as next JSON value
+	delim := e.Tokens.needDelim(next)
+	if delim > 0 {
+		n += len(",") | len(":")
+	}
+	if delim == ':' {
+		if e.Flags.Get(jsonflags.SpaceAfterColon) {
+			n += len(" ")
+		}
+	} else {
+		if delim == ',' && e.Flags.Get(jsonflags.SpaceAfterComma) {
+			n += len(" ")
+		}
+		if e.Flags.Get(jsonflags.Multiline) {
+			if m := e.Tokens.NeedIndent(next); m > 0 {
+				n += len("\n") + len(e.IndentPrefix) + (m-1)*len(e.Indent)
+			}
+		}
+	}
+	return n
+}
+
+// appendWhitespace appends whitespace that immediately precedes the next token.
+func (e *encoderState) appendWhitespace(b []byte, next Kind) []byte {
+	if delim := e.Tokens.needDelim(next); delim == ':' {
+		if e.Flags.Get(jsonflags.SpaceAfterColon) {
+			b = append(b, ' ')
+		}
+	} else {
+		if delim == ',' && e.Flags.Get(jsonflags.SpaceAfterComma) {
+			b = append(b, ' ')
+		}
+		if e.Flags.Get(jsonflags.Multiline) {
+			b = e.AppendIndent(b, e.Tokens.NeedIndent(next))
+		}
+	}
+	return b
+}
+
+// AppendIndent appends the appropriate number of indentation characters
+// for the current nested level, n.
+func (e *encoderState) AppendIndent(b []byte, n int) []byte {
+	if n == 0 {
+		return b
+	}
+	b = append(b, '\n')
+	b = append(b, e.IndentPrefix...)
+	for ; n > 1; n-- {
+		b = append(b, e.Indent...)
+	}
+	return b
+}
+
+// reformatValue parses a JSON value from the start of src and
+// appends it to the end of dst, reformatting whitespace and strings as needed.
+// It returns the extended dst buffer and the number of consumed input bytes.
+func (e *encoderState) reformatValue(dst []byte, src Value, depth int) ([]byte, int, error) {
+	// TODO: Should this update ValueFlags as input?
+	if len(src) == 0 {
+		return dst, 0, io.ErrUnexpectedEOF
+	}
+	switch k := Kind(src[0]).normalize(); k {
+	case 'n':
+		if jsonwire.ConsumeNull(src) == 0 {
+			n, err := jsonwire.ConsumeLiteral(src, "null")
+			return dst, n, err
+		}
+		return append(dst, "null"...), len("null"), nil
+	case 'f':
+		if jsonwire.ConsumeFalse(src) == 0 {
+			n, err := jsonwire.ConsumeLiteral(src, "false")
+			return dst, n, err
+		}
+		return append(dst, "false"...), len("false"), nil
+	case 't':
+		if jsonwire.ConsumeTrue(src) == 0 {
+			n, err := jsonwire.ConsumeLiteral(src, "true")
+			return dst, n, err
+		}
+		return append(dst, "true"...), len("true"), nil
+	case '"':
+		if n := jsonwire.ConsumeSimpleString(src); n > 0 {
+			dst = append(dst, src[:n]...) // copy simple strings verbatim
+			return dst, n, nil
+		}
+		return jsonwire.ReformatString(dst, src, &e.Flags)
+	case '0':
+		if n := jsonwire.ConsumeSimpleNumber(src); n > 0 && !e.Flags.Get(jsonflags.CanonicalizeNumbers) {
+			dst = append(dst, src[:n]...) // copy simple numbers verbatim
+			return dst, n, nil
+		}
+		return jsonwire.ReformatNumber(dst, src, &e.Flags)
+	case '{':
+		return e.reformatObject(dst, src, depth)
+	case '[':
+		return e.reformatArray(dst, src, depth)
+	default:
+		return dst, 0, jsonwire.NewInvalidCharacterError(src, "at start of value")
+	}
+}
+
+// reformatObject parses a JSON object from the start of src and
+// appends it to the end of src, reformatting whitespace and strings as needed.
+// It returns the extended dst buffer and the number of consumed input bytes.
+func (e *encoderState) reformatObject(dst []byte, src Value, depth int) ([]byte, int, error) {
+	// Append object begin.
+	if len(src) == 0 || src[0] != '{' {
+		panic("BUG: reformatObject must be called with a buffer that starts with '{'")
+	} else if depth == maxNestingDepth+1 {
+		return dst, 0, errMaxDepth
+	}
+	dst = append(dst, '{')
+	n := len("{")
+
+	// Append (possible) object end.
+	n += jsonwire.ConsumeWhitespace(src[n:])
+	if uint(len(src)) <= uint(n) {
+		return dst, n, io.ErrUnexpectedEOF
+	}
+	if src[n] == '}' {
+		dst = append(dst, '}')
+		n += len("}")
+		return dst, n, nil
+	}
+
+	var err error
+	var names *objectNamespace
+	if !e.Flags.Get(jsonflags.AllowDuplicateNames) {
+		e.Namespaces.push()
+		defer e.Namespaces.pop()
+		names = e.Namespaces.Last()
+	}
+	depth++
+	for {
+		// Append optional newline and indentation.
+		if e.Flags.Get(jsonflags.Multiline) {
+			dst = e.AppendIndent(dst, depth)
+		}
+
+		// Append object name.
+		n += jsonwire.ConsumeWhitespace(src[n:])
+		if uint(len(src)) <= uint(n) {
+			return dst, n, io.ErrUnexpectedEOF
+		}
+		m := jsonwire.ConsumeSimpleString(src[n:])
+		isVerbatim := m > 0
+		if isVerbatim {
+			dst = append(dst, src[n:n+m]...)
+		} else {
+			dst, m, err = jsonwire.ReformatString(dst, src[n:], &e.Flags)
+			if err != nil {
+				return dst, n + m, err
+			}
+		}
+		quotedName := src[n : n+m]
+		if !e.Flags.Get(jsonflags.AllowDuplicateNames) && !names.insertQuoted(quotedName, isVerbatim) {
+			return dst, n, wrapWithObjectName(ErrDuplicateName, quotedName)
+		}
+		n += m
+
+		// Append colon.
+		n += jsonwire.ConsumeWhitespace(src[n:])
+		if uint(len(src)) <= uint(n) {
+			return dst, n, wrapWithObjectName(io.ErrUnexpectedEOF, quotedName)
+		}
+		if src[n] != ':' {
+			err = jsonwire.NewInvalidCharacterError(src[n:], "after object name (expecting ':')")
+			return dst, n, wrapWithObjectName(err, quotedName)
+		}
+		dst = append(dst, ':')
+		n += len(":")
+		if e.Flags.Get(jsonflags.SpaceAfterColon) {
+			dst = append(dst, ' ')
+		}
+
+		// Append object value.
+		n += jsonwire.ConsumeWhitespace(src[n:])
+		if uint(len(src)) <= uint(n) {
+			return dst, n, wrapWithObjectName(io.ErrUnexpectedEOF, quotedName)
+		}
+		dst, m, err = e.reformatValue(dst, src[n:], depth)
+		if err != nil {
+			return dst, n + m, wrapWithObjectName(err, quotedName)
+		}
+		n += m
+
+		// Append comma or object end.
+		n += jsonwire.ConsumeWhitespace(src[n:])
+		if uint(len(src)) <= uint(n) {
+			return dst, n, io.ErrUnexpectedEOF
+		}
+		switch src[n] {
+		case ',':
+			dst = append(dst, ',')
+			if e.Flags.Get(jsonflags.SpaceAfterComma) {
+				dst = append(dst, ' ')
+			}
+			n += len(",")
+			continue
+		case '}':
+			if e.Flags.Get(jsonflags.Multiline) {
+				dst = e.AppendIndent(dst, depth-1)
+			}
+			dst = append(dst, '}')
+			n += len("}")
+			return dst, n, nil
+		default:
+			return dst, n, jsonwire.NewInvalidCharacterError(src[n:], "after object value (expecting ',' or '}')")
+		}
+	}
+}
+
+// reformatArray parses a JSON array from the start of src and
+// appends it to the end of dst, reformatting whitespace and strings as needed.
+// It returns the extended dst buffer and the number of consumed input bytes.
+func (e *encoderState) reformatArray(dst []byte, src Value, depth int) ([]byte, int, error) {
+	// Append array begin.
+	if len(src) == 0 || src[0] != '[' {
+		panic("BUG: reformatArray must be called with a buffer that starts with '['")
+	} else if depth == maxNestingDepth+1 {
+		return dst, 0, errMaxDepth
+	}
+	dst = append(dst, '[')
+	n := len("[")
+
+	// Append (possible) array end.
+	n += jsonwire.ConsumeWhitespace(src[n:])
+	if uint(len(src)) <= uint(n) {
+		return dst, n, io.ErrUnexpectedEOF
+	}
+	if src[n] == ']' {
+		dst = append(dst, ']')
+		n += len("]")
+		return dst, n, nil
+	}
+
+	var idx int64
+	var err error
+	depth++
+	for {
+		// Append optional newline and indentation.
+		if e.Flags.Get(jsonflags.Multiline) {
+			dst = e.AppendIndent(dst, depth)
+		}
+
+		// Append array value.
+		n += jsonwire.ConsumeWhitespace(src[n:])
+		if uint(len(src)) <= uint(n) {
+			return dst, n, io.ErrUnexpectedEOF
+		}
+		var m int
+		dst, m, err = e.reformatValue(dst, src[n:], depth)
+		if err != nil {
+			return dst, n + m, wrapWithArrayIndex(err, idx)
+		}
+		n += m
+
+		// Append comma or array end.
+		n += jsonwire.ConsumeWhitespace(src[n:])
+		if uint(len(src)) <= uint(n) {
+			return dst, n, io.ErrUnexpectedEOF
+		}
+		switch src[n] {
+		case ',':
+			dst = append(dst, ',')
+			if e.Flags.Get(jsonflags.SpaceAfterComma) {
+				dst = append(dst, ' ')
+			}
+			n += len(",")
+			idx++
+			continue
+		case ']':
+			if e.Flags.Get(jsonflags.Multiline) {
+				dst = e.AppendIndent(dst, depth-1)
+			}
+			dst = append(dst, ']')
+			n += len("]")
+			return dst, n, nil
+		default:
+			return dst, n, jsonwire.NewInvalidCharacterError(src[n:], "after array value (expecting ',' or ']')")
+		}
+	}
+}
+
+// OutputOffset returns the current output byte offset. It gives the location
+// of the next byte immediately after the most recently written token or value.
+// The number of bytes actually written to the underlying [io.Writer] may be less
+// than this offset due to internal buffering effects.
+func (e *Encoder) OutputOffset() int64 {
+	return e.s.previousOffsetEnd()
+}
+
+// AvailableBuffer returns a zero-length buffer with a possible non-zero capacity.
+// This buffer is intended to be used to populate a [Value]
+// being passed to an immediately succeeding [Encoder.WriteValue] call.
+//
+// Example usage:
+//
+//	b := d.AvailableBuffer()
+//	b = append(b, '"')
+//	b = appendString(b, v) // append the string formatting of v
+//	b = append(b, '"')
+//	... := d.WriteValue(b)
+//
+// It is the user's responsibility to ensure that the value is valid JSON.
+func (e *Encoder) AvailableBuffer() []byte {
+	// NOTE: We don't return e.buf[len(e.buf):cap(e.buf)] since WriteValue would
+	// need to take special care to avoid mangling the data while reformatting.
+	// WriteValue can't easily identify whether the input Value aliases e.buf
+	// without using unsafe.Pointer. Thus, we just return a different buffer.
+	// Should this ever alias e.buf, we need to consider how it operates with
+	// the specialized performance optimization for bytes.Buffer.
+	n := 1 << bits.Len(uint(e.s.maxValue|63)) // fast approximation for max length
+	if cap(e.s.availBuffer) < n {
+		e.s.availBuffer = make([]byte, 0, n)
+	}
+	return e.s.availBuffer
+}
+
+// StackDepth returns the depth of the state machine for written JSON data.
+// Each level on the stack represents a nested JSON object or array.
+// It is incremented whenever an [BeginObject] or [BeginArray] token is encountered
+// and decremented whenever an [EndObject] or [EndArray] token is encountered.
+// The depth is zero-indexed, where zero represents the top-level JSON value.
+func (e *Encoder) StackDepth() int {
+	// NOTE: Keep in sync with Decoder.StackDepth.
+	return e.s.Tokens.Depth() - 1
+}
+
+// StackIndex returns information about the specified stack level.
+// It must be a number between 0 and [Encoder.StackDepth], inclusive.
+// For each level, it reports the kind:
+//
+//   - 0 for a level of zero,
+//   - '{' for a level representing a JSON object, and
+//   - '[' for a level representing a JSON array.
+//
+// It also reports the length of that JSON object or array.
+// Each name and value in a JSON object is counted separately,
+// so the effective number of members would be half the length.
+// A complete JSON object must have an even length.
+func (e *Encoder) StackIndex(i int) (Kind, int64) {
+	// NOTE: Keep in sync with Decoder.StackIndex.
+	switch s := e.s.Tokens.index(i); {
+	case i > 0 && s.isObject():
+		return '{', s.Length()
+	case i > 0 && s.isArray():
+		return '[', s.Length()
+	default:
+		return 0, s.Length()
+	}
+}
+
+// StackPointer returns a JSON Pointer (RFC 6901) to the most recently written value.
+func (e *Encoder) StackPointer() Pointer {
+	return Pointer(e.s.AppendStackPointer(nil, -1))
+}
+
+func (e *encoderState) AppendStackPointer(b []byte, where int) []byte {
+	e.Names.copyQuotedBuffer(e.Buf)
+	return e.state.appendStackPointer(b, where)
+}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/errors.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/errors.go
new file mode 100644
index 0000000000..1af86d5b67
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/errors.go
@@ -0,0 +1,180 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package jsontext
+
+import (
+	"bytes"
+	"io"
+	"strconv"
+
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire"
+)
+
+const errorPrefix = "jsontext: "
+
+type ioError struct {
+	action string // either "read" or "write"
+	err    error
+}
+
+func (e *ioError) Error() string {
+	return errorPrefix + e.action + " error: " + e.err.Error()
+}
+func (e *ioError) Unwrap() error {
+	return e.err
+}
+
+// SyntacticError is a description of a syntactic error that occurred when
+// encoding or decoding JSON according to the grammar.
+//
+// The contents of this error as produced by this package may change over time.
+type SyntacticError struct {
+	requireKeyedLiterals
+	nonComparable
+
+	// ByteOffset indicates that an error occurred after this byte offset.
+	ByteOffset int64
+	// JSONPointer indicates that an error occurred within this JSON value
+	// as indicated using the JSON Pointer notation (see RFC 6901).
+	JSONPointer Pointer
+
+	// Err is the underlying error.
+	Err error
+}
+
+// wrapSyntacticError wraps an error and annotates it with a precise location
+// using the provided [encoderState] or [decoderState].
+// If err is an [ioError] or [io.EOF], then it is not wrapped.
+//
+// It takes a relative offset pos that can be resolved into
+// an absolute offset using state.offsetAt.
+//
+// It takes a where that specify how the JSON pointer is derived.
+// If the underlying error is a [pointerSuffixError],
+// then the suffix is appended to the derived pointer.
+func wrapSyntacticError(state interface {
+	offsetAt(pos int) int64
+	AppendStackPointer(b []byte, where int) []byte
+}, err error, pos, where int) error {
+	if _, ok := err.(*ioError); err == io.EOF || ok {
+		return err
+	}
+	offset := state.offsetAt(pos)
+	ptr := state.AppendStackPointer(nil, where)
+	if serr, ok := err.(*pointerSuffixError); ok {
+		ptr = serr.appendPointer(ptr)
+		err = serr.error
+	}
+	if d, ok := state.(*decoderState); ok && err == errMismatchDelim {
+		where := "at start of value"
+		if len(d.Tokens.Stack) > 0 && d.Tokens.Last.Length() > 0 {
+			switch {
+			case d.Tokens.Last.isArray():
+				where = "after array element (expecting ',' or ']')"
+				ptr = []byte(Pointer(ptr).Parent()) // problem is with parent array
+			case d.Tokens.Last.isObject():
+				where = "after object value (expecting ',' or '}')"
+				ptr = []byte(Pointer(ptr).Parent()) // problem is with parent object
+			}
+		}
+		err = jsonwire.NewInvalidCharacterError(d.buf[pos:], where)
+	}
+	return &SyntacticError{ByteOffset: offset, JSONPointer: Pointer(ptr), Err: err}
+}
+
+func (e *SyntacticError) Error() string {
+	pointer := e.JSONPointer
+	offset := e.ByteOffset
+	b := []byte(errorPrefix)
+	if e.Err != nil {
+		b = append(b, e.Err.Error()...)
+		if e.Err == ErrDuplicateName {
+			b = strconv.AppendQuote(append(b, ' '), pointer.LastToken())
+			pointer = pointer.Parent()
+			offset = 0 // not useful to print offset for duplicate names
+		}
+	} else {
+		b = append(b, "syntactic error"...)
+	}
+	if pointer != "" {
+		b = strconv.AppendQuote(append(b, " within "...), jsonwire.TruncatePointer(string(pointer), 100))
+	}
+	if offset > 0 {
+		b = strconv.AppendInt(append(b, " after offset "...), offset, 10)
+	}
+	return string(b)
+}
+
+func (e *SyntacticError) Unwrap() error {
+	return e.Err
+}
+
+// pointerSuffixError represents a JSON pointer suffix to be appended
+// to [SyntacticError.JSONPointer]. It is an internal error type
+// used within this package and does not appear in the public API.
+//
+// This type is primarily used to annotate errors in Encoder.WriteValue
+// and Decoder.ReadValue with precise positions.
+// At the time WriteValue or ReadValue is called, a JSON pointer to the
+// upcoming value can be constructed using the Encoder/Decoder state.
+// However, tracking pointers within values during normal operation
+// would incur a performance penalty in the error-free case.
+//
+// To provide precise error locations without this overhead,
+// the error is wrapped with object names or array indices
+// as the call stack is popped when an error occurs.
+// Since this happens in reverse order, pointerSuffixError holds
+// the pointer in reverse and is only later reversed when appending to
+// the pointer prefix.
+//
+// For example, if the encoder is at "/alpha/bravo/charlie"
+// and an error occurs in WriteValue at "/xray/yankee/zulu", then
+// the final pointer should be "/alpha/bravo/charlie/xray/yankee/zulu".
+//
+// As pointerSuffixError is populated during the error return path,
+// it first contains "/zulu", then "/zulu/yankee",
+// and finally "/zulu/yankee/xray".
+// These tokens are reversed and concatenated to "/alpha/bravo/charlie"
+// to form the full pointer.
+type pointerSuffixError struct {
+	error
+
+	// reversePointer is a JSON pointer, but with each token in reverse order.
+	reversePointer []byte
+}
+
+// wrapWithObjectName wraps err with a JSON object name access,
+// which must be a valid quoted JSON string.
+func wrapWithObjectName(err error, quotedName []byte) error {
+	serr, _ := err.(*pointerSuffixError)
+	if serr == nil {
+		serr = &pointerSuffixError{error: err}
+	}
+	name := jsonwire.UnquoteMayCopy(quotedName, false)
+	serr.reversePointer = appendEscapePointerName(append(serr.reversePointer, '/'), name)
+	return serr
+}
+
+// wrapWithArrayIndex wraps err with a JSON array index access.
+func wrapWithArrayIndex(err error, index int64) error {
+	serr, _ := err.(*pointerSuffixError)
+	if serr == nil {
+		serr = &pointerSuffixError{error: err}
+	}
+	serr.reversePointer = strconv.AppendUint(append(serr.reversePointer, '/'), uint64(index), 10)
+	return serr
+}
+
+// appendPointer appends the path encoded in e to the end of pointer.
+func (e *pointerSuffixError) appendPointer(pointer []byte) []byte {
+	// Copy each token in reversePointer to the end of pointer in reverse order.
+	// Double reversal means that the appended suffix is now in forward order.
+	bi, bo := e.reversePointer, pointer
+	for len(bi) > 0 {
+		i := bytes.LastIndexByte(bi, '/')
+		bi, bo = bi[:i], append(bo, bi[i:]...)
+	}
+	return bo
+}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/export.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/export.go
new file mode 100644
index 0000000000..b30bb99edf
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/export.go
@@ -0,0 +1,75 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package jsontext
+
+import (
+	"io"
+
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal"
+)
+
+// Internal is for internal use only.
+// This is exempt from the Go compatibility agreement.
+var Internal exporter
+
+type exporter struct{}
+
+// Export exposes internal functionality from "jsontext" to "json".
+// This cannot be dynamically called by other packages since
+// they cannot obtain a reference to the internal.AllowInternalUse value.
+func (exporter) Export(p *internal.NotForPublicUse) export {
+	if p != &internal.AllowInternalUse {
+		panic("unauthorized call to Export")
+	}
+	return export{}
+}
+
+// The export type exposes functionality to packages with visibility to
+// the internal.AllowInternalUse variable. The "json" package uses this
+// to modify low-level state in the Encoder and Decoder types.
+// It mutates the state directly instead of calling ReadToken or WriteToken
+// since this is more performant. The public APIs need to track state to ensure
+// that users are constructing a valid JSON value, but the "json" implementation
+// guarantees that it emits valid JSON by the structure of the code itself.
+type export struct{}
+
+// Encoder returns a pointer to the underlying encoderState.
+func (export) Encoder(e *Encoder) *encoderState { return &e.s }
+
+// Decoder returns a pointer to the underlying decoderState.
+func (export) Decoder(d *Decoder) *decoderState { return &d.s }
+
+func (export) GetBufferedEncoder(o ...Options) *Encoder {
+	return getBufferedEncoder(o...)
+}
+func (export) PutBufferedEncoder(e *Encoder) {
+	putBufferedEncoder(e)
+}
+
+func (export) GetStreamingEncoder(w io.Writer, o ...Options) *Encoder {
+	return getStreamingEncoder(w, o...)
+}
+func (export) PutStreamingEncoder(e *Encoder) {
+	putStreamingEncoder(e)
+}
+
+func (export) GetBufferedDecoder(b []byte, o ...Options) *Decoder {
+	return getBufferedDecoder(b, o...)
+}
+func (export) PutBufferedDecoder(d *Decoder) {
+	putBufferedDecoder(d)
+}
+
+func (export) GetStreamingDecoder(r io.Reader, o ...Options) *Decoder {
+	return getStreamingDecoder(r, o...)
+}
+func (export) PutStreamingDecoder(d *Decoder) {
+	putStreamingDecoder(d)
+}
+
+func (export) IsIOError(err error) bool {
+	_, ok := err.(*ioError)
+	return ok
+}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/options.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/options.go
new file mode 100644
index 0000000000..e973b58d6a
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/options.go
@@ -0,0 +1,302 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package jsontext
+
+import (
+	"strings"
+
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire"
+)
+
+// Options configures [NewEncoder], [Encoder.Reset], [NewDecoder],
+// and [Decoder.Reset] with specific features.
+// Each function takes in a variadic list of options, where properties
+// set in latter options override the value of previously set properties.
+//
+// There is a single Options type, which is used with both encoding and decoding.
+// Some options affect both operations, while others only affect one operation:
+//
+//   - [AllowDuplicateNames] affects encoding and decoding
+//   - [AllowInvalidUTF8] affects encoding and decoding
+//   - [EscapeForHTML] affects encoding only
+//   - [EscapeForJS] affects encoding only
+//   - [PreserveRawStrings] affects encoding only
+//   - [CanonicalizeRawInts] affects encoding only
+//   - [CanonicalizeRawFloats] affects encoding only
+//   - [ReorderRawObjects] affects encoding only
+//   - [SpaceAfterColon] affects encoding only
+//   - [SpaceAfterComma] affects encoding only
+//   - [Multiline] affects encoding only
+//   - [WithIndent] affects encoding only
+//   - [WithIndentPrefix] affects encoding only
+//
+// Options that do not affect a particular operation are ignored.
+//
+// The Options type is identical to [encoding/json.Options] and
+// [encoding/json/v2.Options]. Options from the other packages may
+// be passed to functionality in this package, but are ignored.
+// Options from this package may be used with the other packages.
+type Options = jsonopts.Options
+
+// AllowDuplicateNames specifies that JSON objects may contain
+// duplicate member names. Disabling the duplicate name check may provide
+// performance benefits, but breaks compliance with RFC 7493, section 2.3.
+// The input or output will still be compliant with RFC 8259,
+// which leaves the handling of duplicate names as unspecified behavior.
+//
+// This affects either encoding or decoding.
+func AllowDuplicateNames(v bool) Options {
+	if v {
+		return jsonflags.AllowDuplicateNames | 1
+	} else {
+		return jsonflags.AllowDuplicateNames | 0
+	}
+}
+
+// AllowInvalidUTF8 specifies that JSON strings may contain invalid UTF-8,
+// which will be mangled as the Unicode replacement character, U+FFFD.
+// This causes the encoder or decoder to break compliance with
+// RFC 7493, section 2.1, and RFC 8259, section 8.1.
+//
+// This affects either encoding or decoding.
+func AllowInvalidUTF8(v bool) Options {
+	if v {
+		return jsonflags.AllowInvalidUTF8 | 1
+	} else {
+		return jsonflags.AllowInvalidUTF8 | 0
+	}
+}
+
+// EscapeForHTML specifies that '<', '>', and '&' characters within JSON strings
+// should be escaped as a hexadecimal Unicode codepoint (e.g., \u003c) so that
+// the output is safe to embed within HTML.
+//
+// This only affects encoding and is ignored when decoding.
+func EscapeForHTML(v bool) Options {
+	if v {
+		return jsonflags.EscapeForHTML | 1
+	} else {
+		return jsonflags.EscapeForHTML | 0
+	}
+}
+
+// EscapeForJS specifies that U+2028 and U+2029 characters within JSON strings
+// should be escaped as a hexadecimal Unicode codepoint (e.g., \u2028) so that
+// the output is valid to embed within JavaScript. See RFC 8259, section 12.
+//
+// This only affects encoding and is ignored when decoding.
+func EscapeForJS(v bool) Options {
+	if v {
+		return jsonflags.EscapeForJS | 1
+	} else {
+		return jsonflags.EscapeForJS | 0
+	}
+}
+
+// PreserveRawStrings specifies that when encoding a raw JSON string in a
+// [Token] or [Value], pre-escaped sequences
+// in a JSON string are preserved to the output.
+// However, raw strings still respect [EscapeForHTML] and [EscapeForJS]
+// such that the relevant characters are escaped.
+// If [AllowInvalidUTF8] is enabled, bytes of invalid UTF-8
+// are preserved to the output.
+//
+// This only affects encoding and is ignored when decoding.
+func PreserveRawStrings(v bool) Options {
+	if v {
+		return jsonflags.PreserveRawStrings | 1
+	} else {
+		return jsonflags.PreserveRawStrings | 0
+	}
+}
+
+// CanonicalizeRawInts specifies that when encoding a raw JSON
+// integer number (i.e., a number without a fraction and exponent) in a
+// [Token] or [Value], the number is canonicalized
+// according to RFC 8785, section 3.2.2.3. As a special case,
+// the number -0 is canonicalized as 0.
+//
+// JSON numbers are treated as IEEE 754 double precision numbers.
+// Any numbers with precision beyond what is representable by that form
+// will lose their precision when canonicalized. For example,
+// integer values beyond ±2⁵³ will lose their precision.
+// For example, 1234567890123456789 is formatted as 1234567890123456800.
+//
+// This only affects encoding and is ignored when decoding.
+func CanonicalizeRawInts(v bool) Options {
+	if v {
+		return jsonflags.CanonicalizeRawInts | 1
+	} else {
+		return jsonflags.CanonicalizeRawInts | 0
+	}
+}
+
+// CanonicalizeRawFloats specifies that when encoding a raw JSON
+// floating-point number (i.e., a number with a fraction or exponent) in a
+// [Token] or [Value], the number is canonicalized
+// according to RFC 8785, section 3.2.2.3. As a special case,
+// the number -0 is canonicalized as 0.
+//
+// JSON numbers are treated as IEEE 754 double precision numbers.
+// It is safe to canonicalize a serialized single precision number and
+// parse it back as a single precision number and expect the same value.
+// If a number exceeds ±1.7976931348623157e+308, which is the maximum
+// finite number, then it saturated at that value and formatted as such.
+//
+// This only affects encoding and is ignored when decoding.
+func CanonicalizeRawFloats(v bool) Options {
+	if v {
+		return jsonflags.CanonicalizeRawFloats | 1
+	} else {
+		return jsonflags.CanonicalizeRawFloats | 0
+	}
+}
+
+// ReorderRawObjects specifies that when encoding a raw JSON object in a
+// [Value], the object members are reordered according to
+// RFC 8785, section 3.2.3.
+//
+// This only affects encoding and is ignored when decoding.
+func ReorderRawObjects(v bool) Options {
+	if v {
+		return jsonflags.ReorderRawObjects | 1
+	} else {
+		return jsonflags.ReorderRawObjects | 0
+	}
+}
+
+// SpaceAfterColon specifies that the JSON output should emit a space character
+// after each colon separator following a JSON object name.
+// If false, then no space character appears after the colon separator.
+//
+// This only affects encoding and is ignored when decoding.
+func SpaceAfterColon(v bool) Options {
+	if v {
+		return jsonflags.SpaceAfterColon | 1
+	} else {
+		return jsonflags.SpaceAfterColon | 0
+	}
+}
+
+// SpaceAfterComma specifies that the JSON output should emit a space character
+// after each comma separator following a JSON object value or array element.
+// If false, then no space character appears after the comma separator.
+//
+// This only affects encoding and is ignored when decoding.
+func SpaceAfterComma(v bool) Options {
+	if v {
+		return jsonflags.SpaceAfterComma | 1
+	} else {
+		return jsonflags.SpaceAfterComma | 0
+	}
+}
+
+// Multiline specifies that the JSON output should expand to multiple lines,
+// where every JSON object member or JSON array element appears on
+// a new, indented line according to the nesting depth.
+//
+// If [SpaceAfterColon] is not specified, then the default is true.
+// If [SpaceAfterComma] is not specified, then the default is false.
+// If [WithIndent] is not specified, then the default is "\t".
+//
+// If set to false, then the output is a single-line,
+// where the only whitespace emitted is determined by the current
+// values of [SpaceAfterColon] and [SpaceAfterComma].
+//
+// This only affects encoding and is ignored when decoding.
+func Multiline(v bool) Options {
+	if v {
+		return jsonflags.Multiline | 1
+	} else {
+		return jsonflags.Multiline | 0
+	}
+}
+
+// WithIndent specifies that the encoder should emit multiline output
+// where each element in a JSON object or array begins on a new, indented line
+// beginning with the indent prefix (see [WithIndentPrefix])
+// followed by one or more copies of indent according to the nesting depth.
+// The indent must only be composed of space or tab characters.
+//
+// If the intent to emit indented output without a preference for
+// the particular indent string, then use [Multiline] instead.
+//
+// This only affects encoding and is ignored when decoding.
+// Use of this option implies [Multiline] being set to true.
+func WithIndent(indent string) Options {
+	// Fast-path: Return a constant for common indents, which avoids allocating.
+	// These are derived from analyzing the Go module proxy on 2023-07-01.
+	switch indent {
+	case "\t":
+		return jsonopts.Indent("\t") // ~14k usages
+	case "    ":
+		return jsonopts.Indent("    ") // ~18k usages
+	case "   ":
+		return jsonopts.Indent("   ") // ~1.7k usages
+	case "  ":
+		return jsonopts.Indent("  ") // ~52k usages
+	case " ":
+		return jsonopts.Indent(" ") // ~12k usages
+	case "":
+		return jsonopts.Indent("") // ~1.5k usages
+	}
+
+	// Otherwise, allocate for this unique value.
+	if s := strings.Trim(indent, " \t"); len(s) > 0 {
+		panic("json: invalid character " + jsonwire.QuoteRune(s) + " in indent")
+	}
+	return jsonopts.Indent(indent)
+}
+
+// WithIndentPrefix specifies that the encoder should emit multiline output
+// where each element in a JSON object or array begins on a new, indented line
+// beginning with the indent prefix followed by one or more copies of indent
+// (see [WithIndent]) according to the nesting depth.
+// The prefix must only be composed of space or tab characters.
+//
+// This only affects encoding and is ignored when decoding.
+// Use of this option implies [Multiline] being set to true.
+func WithIndentPrefix(prefix string) Options {
+	if s := strings.Trim(prefix, " \t"); len(s) > 0 {
+		panic("json: invalid character " + jsonwire.QuoteRune(s) + " in indent prefix")
+	}
+	return jsonopts.IndentPrefix(prefix)
+}
+
+/*
+// TODO(https://go.dev/issue/56733): Implement WithByteLimit and WithDepthLimit.
+// Remember to also update the "Security Considerations" section.
+
+// WithByteLimit sets a limit on the number of bytes of input or output bytes
+// that may be consumed or produced for each top-level JSON value.
+// If a [Decoder] or [Encoder] method call would need to consume/produce
+// more than a total of n bytes to make progress on the top-level JSON value,
+// then the call will report an error.
+// Whitespace before and within the top-level value are counted against the limit.
+// Whitespace after a top-level value are counted against the limit
+// for the next top-level value.
+//
+// A non-positive limit is equivalent to no limit at all.
+// If unspecified, the default limit is no limit at all.
+// This affects either encoding or decoding.
+func WithByteLimit(n int64) Options {
+	return jsonopts.ByteLimit(max(n, 0))
+}
+
+// WithDepthLimit sets a limit on the maximum depth of JSON nesting
+// that may be consumed or produced for each top-level JSON value.
+// If a [Decoder] or [Encoder] method call would need to consume or produce
+// a depth greater than n to make progress on the top-level JSON value,
+// then the call will report an error.
+//
+// A non-positive limit is equivalent to no limit at all.
+// If unspecified, the default limit is 10000.
+// This affects either encoding or decoding.
+func WithDepthLimit(n int) Options {
+	return jsonopts.DepthLimit(max(n, 0))
+}
+*/
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/pools.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/pools.go
similarity index 64%
rename from vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/pools.go
rename to vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/pools.go
index 60e93270fb..63941baacb 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/pools.go
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/pools.go
@@ -2,13 +2,12 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package json
+package jsontext
 
 import (
 	"bytes"
 	"io"
 	"math/bits"
-	"sort"
 	"sync"
 )
 
@@ -40,16 +39,16 @@ type bufferStatistics struct {
 	prevLen int // length of previous buffer
 }
 
-func getBufferedEncoder(o EncodeOptions) *Encoder {
+func getBufferedEncoder(opts ...Options) *Encoder {
 	e := bufferedEncoderPool.Get().(*Encoder)
-	if e.buf == nil {
+	if e.s.Buf == nil {
 		// Round up to nearest 2ⁿ to make best use of malloc size classes.
 		// See runtime/sizeclasses.go on Go1.15.
 		// Logical OR with 63 to ensure 64 as the minimum buffer size.
-		n := 1 << bits.Len(uint(e.bufStats.prevLen|63))
-		e.buf = make([]byte, 0, n)
+		n := 1 << bits.Len(uint(e.s.bufStats.prevLen|63))
+		e.s.Buf = make([]byte, 0, n)
 	}
-	e.reset(e.buf[:0], nil, o)
+	e.s.reset(e.s.Buf[:0], nil, opts...)
 	return e
 }
 func putBufferedEncoder(e *Encoder) {
@@ -68,37 +67,37 @@ func putBufferedEncoder(e *Encoder) {
 	//
 	// See https://go.dev/issue/27735.
 	switch {
-	case cap(e.buf) <= 4<<10: // always recycle buffers smaller than 4KiB
-		e.bufStats.strikes = 0
-	case cap(e.buf)/4 <= len(e.buf): // at least 25% utilization
-		e.bufStats.strikes = 0
-	case e.bufStats.strikes < 4: // at most 4 strikes
-		e.bufStats.strikes++
+	case cap(e.s.Buf) <= 4<<10: // always recycle buffers smaller than 4KiB
+		e.s.bufStats.strikes = 0
+	case cap(e.s.Buf)/4 <= len(e.s.Buf): // at least 25% utilization
+		e.s.bufStats.strikes = 0
+	case e.s.bufStats.strikes < 4: // at most 4 strikes
+		e.s.bufStats.strikes++
 	default: // discard the buffer; too large and too often under-utilized
-		e.bufStats.strikes = 0
-		e.bufStats.prevLen = len(e.buf) // heuristic for size to allocate next time
-		e.buf = nil
+		e.s.bufStats.strikes = 0
+		e.s.bufStats.prevLen = len(e.s.Buf) // heuristic for size to allocate next time
+		e.s.Buf = nil
 	}
 	bufferedEncoderPool.Put(e)
 }
 
-func getStreamingEncoder(w io.Writer, o EncodeOptions) *Encoder {
+func getStreamingEncoder(w io.Writer, opts ...Options) *Encoder {
 	if _, ok := w.(*bytes.Buffer); ok {
 		e := bytesBufferEncoderPool.Get().(*Encoder)
-		e.reset(nil, w, o) // buffer taken from bytes.Buffer
+		e.s.reset(nil, w, opts...) // buffer taken from bytes.Buffer
 		return e
 	} else {
 		e := streamingEncoderPool.Get().(*Encoder)
-		e.reset(e.buf[:0], w, o) // preserve existing buffer
+		e.s.reset(e.s.Buf[:0], w, opts...) // preserve existing buffer
 		return e
 	}
 }
 func putStreamingEncoder(e *Encoder) {
-	if _, ok := e.wr.(*bytes.Buffer); ok {
+	if _, ok := e.s.wr.(*bytes.Buffer); ok {
 		bytesBufferEncoderPool.Put(e)
 	} else {
-		if cap(e.buf) > 64<<10 {
-			e.buf = nil // avoid pinning arbitrarily large amounts of memory
+		if cap(e.s.Buf) > 64<<10 {
+			e.s.Buf = nil // avoid pinning arbitrarily large amounts of memory
 		}
 		streamingEncoderPool.Put(e)
 	}
@@ -119,64 +118,33 @@ var (
 	bytesBufferDecoderPool = bufferedDecoderPool
 )
 
-func getBufferedDecoder(b []byte, o DecodeOptions) *Decoder {
+func getBufferedDecoder(b []byte, opts ...Options) *Decoder {
 	d := bufferedDecoderPool.Get().(*Decoder)
-	d.reset(b, nil, o)
+	d.s.reset(b, nil, opts...)
 	return d
 }
 func putBufferedDecoder(d *Decoder) {
 	bufferedDecoderPool.Put(d)
 }
 
-func getStreamingDecoder(r io.Reader, o DecodeOptions) *Decoder {
+func getStreamingDecoder(r io.Reader, opts ...Options) *Decoder {
 	if _, ok := r.(*bytes.Buffer); ok {
 		d := bytesBufferDecoderPool.Get().(*Decoder)
-		d.reset(nil, r, o) // buffer taken from bytes.Buffer
+		d.s.reset(nil, r, opts...) // buffer taken from bytes.Buffer
 		return d
 	} else {
 		d := streamingDecoderPool.Get().(*Decoder)
-		d.reset(d.buf[:0], r, o) // preserve existing buffer
+		d.s.reset(d.s.buf[:0], r, opts...) // preserve existing buffer
 		return d
 	}
 }
 func putStreamingDecoder(d *Decoder) {
-	if _, ok := d.rd.(*bytes.Buffer); ok {
+	if _, ok := d.s.rd.(*bytes.Buffer); ok {
 		bytesBufferDecoderPool.Put(d)
 	} else {
-		if cap(d.buf) > 64<<10 {
-			d.buf = nil // avoid pinning arbitrarily large amounts of memory
+		if cap(d.s.buf) > 64<<10 {
+			d.s.buf = nil // avoid pinning arbitrarily large amounts of memory
 		}
 		streamingDecoderPool.Put(d)
 	}
 }
-
-var stringsPools = &sync.Pool{New: func() any { return new(stringSlice) }}
-
-type stringSlice []string
-
-// getStrings returns a non-nil pointer to a slice with length n.
-func getStrings(n int) *stringSlice {
-	s := stringsPools.Get().(*stringSlice)
-	if cap(*s) < n {
-		*s = make([]string, n)
-	}
-	*s = (*s)[:n]
-	return s
-}
-
-func putStrings(s *stringSlice) {
-	if cap(*s) > 1<<10 {
-		*s = nil // avoid pinning arbitrarily large amounts of memory
-	}
-	stringsPools.Put(s)
-}
-
-// Sort sorts the string slice according to RFC 8785, section 3.2.3.
-func (ss *stringSlice) Sort() {
-	// TODO(https://go.dev/issue/47619): Use slices.SortFunc instead.
-	sort.Sort(ss)
-}
-
-func (ss *stringSlice) Len() int           { return len(*ss) }
-func (ss *stringSlice) Less(i, j int) bool { return lessUTF16((*ss)[i], (*ss)[j]) }
-func (ss *stringSlice) Swap(i, j int)      { (*ss)[i], (*ss)[j] = (*ss)[j], (*ss)[i] }
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/quote.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/quote.go
new file mode 100644
index 0000000000..77897b43f5
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/quote.go
@@ -0,0 +1,39 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package jsontext
+
+import (
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire"
+)
+
+// AppendQuote appends a double-quoted JSON string literal representing src
+// to dst and returns the extended buffer.
+// It uses the minimal string representation per RFC 8785, section 3.2.2.2.
+// Invalid UTF-8 bytes are replaced with the Unicode replacement character
+// and an error is returned at the end indicating the presence of invalid UTF-8.
+// The dst must not overlap with the src.
+func AppendQuote[Bytes ~[]byte | ~string](dst []byte, src Bytes) ([]byte, error) {
+	dst, err := jsonwire.AppendQuote(dst, src, &jsonflags.Flags{})
+	if err != nil {
+		err = &SyntacticError{Err: err}
+	}
+	return dst, err
+}
+
+// AppendUnquote appends the decoded interpretation of src as a
+// double-quoted JSON string literal to dst and returns the extended buffer.
+// The input src must be a JSON string without any surrounding whitespace.
+// Invalid UTF-8 bytes are replaced with the Unicode replacement character
+// and an error is returned at the end indicating the presence of invalid UTF-8.
+// Any trailing bytes after the JSON string literal results in an error.
+// The dst must not overlap with the src.
+func AppendUnquote[Bytes ~[]byte | ~string](dst []byte, src Bytes) ([]byte, error) {
+	dst, err := jsonwire.AppendUnquote(dst, src)
+	if err != nil {
+		err = &SyntacticError{Err: err}
+	}
+	return dst, err
+}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/state.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/state.go
similarity index 63%
rename from vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/state.go
rename to vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/state.go
index ee14c753fe..fdbfd5d3d0 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/state.go
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/state.go
@@ -2,81 +2,214 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package json
+package jsontext
 
 import (
+	"errors"
+	"iter"
 	"math"
 	"strconv"
+	"strings"
+	"unicode/utf8"
+
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire"
 )
 
+// ErrDuplicateName indicates that a JSON token could not be
+// encoded or decoded because it results in a duplicate JSON object name.
+// This error is directly wrapped within a [SyntacticError] when produced.
+//
+// The name of a duplicate JSON object member can be extracted as:
+//
+//	err := ...
+//	var serr jsontext.SyntacticError
+//	if errors.As(err, &serr) && serr.Err == jsontext.ErrDuplicateName {
+//		ptr := serr.JSONPointer // JSON pointer to duplicate name
+//		name := ptr.LastToken() // duplicate name itself
+//		...
+//	}
+//
+// This error is only returned if [AllowDuplicateNames] is false.
+var ErrDuplicateName = errors.New("duplicate object member name")
+
+// ErrNonStringName indicates that a JSON token could not be
+// encoded or decoded because it is not a string,
+// as required for JSON object names according to RFC 8259, section 4.
+// This error is directly wrapped within a [SyntacticError] when produced.
+var ErrNonStringName = errors.New("object member name must be a string")
+
 var (
-	errMissingName   = &SyntacticError{str: "missing string for object name"}
-	errMissingColon  = &SyntacticError{str: "missing character ':' after object name"}
-	errMissingValue  = &SyntacticError{str: "missing value after object name"}
-	errMissingComma  = &SyntacticError{str: "missing character ',' after object or array value"}
-	errMismatchDelim = &SyntacticError{str: "mismatching structural token for object or array"}
+	errMissingValue  = errors.New("missing value after object name")
+	errMismatchDelim = errors.New("mismatching structural token for object or array")
+	errMaxDepth      = errors.New("exceeded max depth")
+
+	errInvalidNamespace = errors.New("object namespace is in an invalid state")
 )
 
-const errInvalidNamespace = jsonError("object namespace is in an invalid state")
+// Per RFC 8259, section 9, implementations may enforce a maximum depth.
+// Such a limit is necessary to prevent stack overflows.
+const maxNestingDepth = 10000
 
 type state struct {
-	// tokens validates whether the next token kind is valid.
-	tokens stateMachine
+	// Tokens validates whether the next token kind is valid.
+	Tokens stateMachine
 
-	// names is a stack of object names.
-	// Not used if AllowDuplicateNames is true.
-	names objectNameStack
+	// Names is a stack of object names.
+	Names objectNameStack
 
-	// namespaces is a stack of object namespaces.
+	// Namespaces is a stack of object namespaces.
 	// For performance reasons, Encoder or Decoder may not update this
 	// if Marshal or Unmarshal is able to track names in a more efficient way.
 	// See makeMapArshaler and makeStructArshaler.
 	// Not used if AllowDuplicateNames is true.
-	namespaces objectNamespaceStack
+	Namespaces objectNamespaceStack
+}
+
+// needObjectValue reports whether the next token should be an object value.
+// This method is used by [wrapSyntacticError].
+func (s *state) needObjectValue() bool {
+	return s.Tokens.Last.needObjectValue()
 }
 
 func (s *state) reset() {
-	s.tokens.reset()
-	s.names.reset()
-	s.namespaces.reset()
+	s.Tokens.reset()
+	s.Names.reset()
+	s.Namespaces.reset()
+}
+
+// Pointer is a JSON Pointer (RFC 6901) that references a particular JSON value
+// relative to the root of the top-level JSON value.
+//
+// A Pointer is a slash-separated list of tokens, where each token is
+// either a JSON object name or an index to a JSON array element
+// encoded as a base-10 integer value.
+// It is impossible to distinguish between an array index and an object name
+// (that happens to be an base-10 encoded integer) without also knowing
+// the structure of the top-level JSON value that the pointer refers to.
+//
+// There is exactly one representation of a pointer to a particular value,
+// so comparability of Pointer values is equivalent to checking whether
+// they both point to the exact same value.
+type Pointer string
+
+// IsValid reports whether p is a valid JSON Pointer according to RFC 6901.
+// Note that the concatenation of two valid pointers produces a valid pointer.
+func (p Pointer) IsValid() bool {
+	for i, r := range p {
+		switch {
+		case r == '~' && (i+1 == len(p) || (p[i+1] != '0' && p[i+1] != '1')):
+			return false // invalid escape
+		case r == '\ufffd' && !strings.HasPrefix(string(p[i:]), "\ufffd"):
+			return false // invalid UTF-8
+		}
+	}
+	return len(p) == 0 || p[0] == '/'
+}
+
+// Contains reports whether the JSON value that p points to
+// is equal to or contains the JSON value that pc points to.
+func (p Pointer) Contains(pc Pointer) bool {
+	// Invariant: len(p) <= len(pc) if p.Contains(pc)
+	suffix, ok := strings.CutPrefix(string(pc), string(p))
+	return ok && (suffix == "" || suffix[0] == '/')
+}
+
+// Parent strips off the last token and returns the remaining pointer.
+// The parent of an empty p is an empty string.
+func (p Pointer) Parent() Pointer {
+	return p[:max(strings.LastIndexByte(string(p), '/'), 0)]
+}
+
+// LastToken returns the last token in the pointer.
+// The last token of an empty p is an empty string.
+func (p Pointer) LastToken() string {
+	last := p[max(strings.LastIndexByte(string(p), '/'), 0):]
+	return unescapePointerToken(strings.TrimPrefix(string(last), "/"))
+}
+
+// AppendToken appends a token to the end of p and returns the full pointer.
+func (p Pointer) AppendToken(tok string) Pointer {
+	return Pointer(appendEscapePointerName([]byte(p+"/"), tok))
+}
+
+// TODO: Add Pointer.AppendTokens,
+// but should this take in a ...string or an iter.Seq[string]?
+
+// Tokens returns an iterator over the reference tokens in the JSON pointer,
+// starting from the first token until the last token (unless stopped early).
+func (p Pointer) Tokens() iter.Seq[string] {
+	return func(yield func(string) bool) {
+		for len(p) > 0 {
+			p = Pointer(strings.TrimPrefix(string(p), "/"))
+			i := min(uint(strings.IndexByte(string(p), '/')), uint(len(p)))
+			if !yield(unescapePointerToken(string(p)[:i])) {
+				return
+			}
+			p = p[i:]
+		}
+	}
+}
+
+func unescapePointerToken(token string) string {
+	if strings.Contains(token, "~") {
+		// Per RFC 6901, section 3, unescape '~' and '/' characters.
+		token = strings.ReplaceAll(token, "~1", "/")
+		token = strings.ReplaceAll(token, "~0", "~")
+	}
+	return token
 }
 
 // appendStackPointer appends a JSON Pointer (RFC 6901) to the current value.
-// The returned pointer is only accurate if s.names is populated,
-// otherwise it uses the numeric index as the object member name.
+//
+//   - If where is -1, then it points to the previously processed token.
+//
+//   - If where is 0, then it points to the parent JSON object or array,
+//     or an object member if in-between an object member key and value.
+//     This is useful when the position is ambiguous whether
+//     we are interested in the previous or next token, or
+//     when we are uncertain whether the next token
+//     continues or terminates the current object or array.
+//
+//   - If where is +1, then it points to the next expected value,
+//     assuming that it continues the current JSON object or array.
+//     As a special case, if the next token is a JSON object name,
+//     then it points to the parent JSON object.
 //
 // Invariant: Must call s.names.copyQuotedBuffer beforehand.
-func (s state) appendStackPointer(b []byte) []byte {
+func (s state) appendStackPointer(b []byte, where int) []byte {
 	var objectDepth int
-	for i := 1; i < s.tokens.depth(); i++ {
-		e := s.tokens.index(i)
-		if e.length() == 0 {
-			break // empty object or array
+	for i := 1; i < s.Tokens.Depth(); i++ {
+		e := s.Tokens.index(i)
+		arrayDelta := -1 // by default point to previous array element
+		if isLast := i == s.Tokens.Depth()-1; isLast {
+			switch {
+			case where < 0 && e.Length() == 0 || where == 0 && !e.needObjectValue() || where > 0 && e.NeedObjectName():
+				return b
+			case where > 0 && e.isArray():
+				arrayDelta = 0 // point to next array element
+			}
 		}
-		b = append(b, '/')
 		switch {
 		case e.isObject():
-			if objectDepth < s.names.length() {
-				for _, c := range s.names.getUnquoted(objectDepth) {
-					// Per RFC 6901, section 3, escape '~' and '/' characters.
-					switch c {
-					case '~':
-						b = append(b, "~0"...)
-					case '/':
-						b = append(b, "~1"...)
-					default:
-						b = append(b, c)
-					}
-				}
-			} else {
-				// Since the names stack is unpopulated, the name is unknown.
-				// As a best-effort replacement, use the numeric member index.
-				// While inaccurate, it produces a syntactically valid pointer.
-				b = strconv.AppendUint(b, uint64((e.length()-1)/2), 10)
-			}
+			b = appendEscapePointerName(append(b, '/'), s.Names.getUnquoted(objectDepth))
 			objectDepth++
 		case e.isArray():
-			b = strconv.AppendUint(b, uint64(e.length()-1), 10)
+			b = strconv.AppendUint(append(b, '/'), uint64(e.Length()+int64(arrayDelta)), 10)
+		}
+	}
+	return b
+}
+
+func appendEscapePointerName[Bytes ~[]byte | ~string](b []byte, name Bytes) []byte {
+	for _, r := range string(name) {
+		// Per RFC 6901, section 3, escape '~' and '/' characters.
+		switch r {
+		case '~':
+			b = append(b, "~0"...)
+		case '/':
+			b = append(b, "~1"...)
+		default:
+			b = utf8.AppendRune(b, r)
 		}
 	}
 	return b
@@ -92,54 +225,54 @@ func (s state) appendStackPointer(b []byte) []byte {
 // The top-level virtual JSON array is special in that it doesn't require commas
 // between each JSON value.
 //
-// For performance, most methods are carefully written to be inlineable.
+// For performance, most methods are carefully written to be inlinable.
 // The zero value is a valid state machine ready for use.
 type stateMachine struct {
-	stack []stateEntry
-	last  stateEntry
+	Stack []stateEntry
+	Last  stateEntry
 }
 
 // reset resets the state machine.
 // The machine always starts with a minimum depth of 1.
 func (m *stateMachine) reset() {
-	m.stack = m.stack[:0]
-	if cap(m.stack) > 1<<10 {
-		m.stack = nil
+	m.Stack = m.Stack[:0]
+	if cap(m.Stack) > 1<<10 {
+		m.Stack = nil
 	}
-	m.last = stateTypeArray
+	m.Last = stateTypeArray
 }
 
-// depth is the current nested depth of JSON objects and arrays.
+// Depth is the current nested depth of JSON objects and arrays.
 // It is one-indexed (i.e., top-level values have a depth of 1).
-func (m stateMachine) depth() int {
-	return len(m.stack) + 1
+func (m stateMachine) Depth() int {
+	return len(m.Stack) + 1
 }
 
 // index returns a reference to the ith entry.
 // It is only valid until the next push method call.
 func (m *stateMachine) index(i int) *stateEntry {
-	if i == len(m.stack) {
-		return &m.last
+	if i == len(m.Stack) {
+		return &m.Last
 	}
-	return &m.stack[i]
+	return &m.Stack[i]
 }
 
-// depthLength reports the current nested depth and
+// DepthLength reports the current nested depth and
 // the length of the last JSON object or array.
-func (m stateMachine) depthLength() (int, int) {
-	return m.depth(), m.last.length()
+func (m stateMachine) DepthLength() (int, int64) {
+	return m.Depth(), m.Last.Length()
 }
 
 // appendLiteral appends a JSON literal as the next token in the sequence.
 // If an error is returned, the state is not mutated.
 func (m *stateMachine) appendLiteral() error {
 	switch {
-	case m.last.needObjectName():
-		return errMissingName
-	case !m.last.isValidNamespace():
+	case m.Last.NeedObjectName():
+		return ErrNonStringName
+	case !m.Last.isValidNamespace():
 		return errInvalidNamespace
 	default:
-		m.last.increment()
+		m.Last.Increment()
 		return nil
 	}
 }
@@ -148,10 +281,10 @@ func (m *stateMachine) appendLiteral() error {
 // If an error is returned, the state is not mutated.
 func (m *stateMachine) appendString() error {
 	switch {
-	case !m.last.isValidNamespace():
+	case !m.Last.isValidNamespace():
 		return errInvalidNamespace
 	default:
-		m.last.increment()
+		m.Last.Increment()
 		return nil
 	}
 }
@@ -162,18 +295,20 @@ func (m *stateMachine) appendNumber() error {
 	return m.appendLiteral()
 }
 
-// pushObject appends a JSON start object token as next in the sequence.
+// pushObject appends a JSON begin object token as next in the sequence.
 // If an error is returned, the state is not mutated.
 func (m *stateMachine) pushObject() error {
 	switch {
-	case m.last.needObjectName():
-		return errMissingName
-	case !m.last.isValidNamespace():
+	case m.Last.NeedObjectName():
+		return ErrNonStringName
+	case !m.Last.isValidNamespace():
 		return errInvalidNamespace
+	case len(m.Stack) == maxNestingDepth:
+		return errMaxDepth
 	default:
-		m.last.increment()
-		m.stack = append(m.stack, m.last)
-		m.last = stateTypeObject
+		m.Last.Increment()
+		m.Stack = append(m.Stack, m.Last)
+		m.Last = stateTypeObject
 		return nil
 	}
 }
@@ -182,31 +317,33 @@ func (m *stateMachine) pushObject() error {
 // If an error is returned, the state is not mutated.
 func (m *stateMachine) popObject() error {
 	switch {
-	case !m.last.isObject():
+	case !m.Last.isObject():
 		return errMismatchDelim
-	case m.last.needObjectValue():
+	case m.Last.needObjectValue():
 		return errMissingValue
-	case !m.last.isValidNamespace():
+	case !m.Last.isValidNamespace():
 		return errInvalidNamespace
 	default:
-		m.last = m.stack[len(m.stack)-1]
-		m.stack = m.stack[:len(m.stack)-1]
+		m.Last = m.Stack[len(m.Stack)-1]
+		m.Stack = m.Stack[:len(m.Stack)-1]
 		return nil
 	}
 }
 
-// pushArray appends a JSON start array token as next in the sequence.
+// pushArray appends a JSON begin array token as next in the sequence.
 // If an error is returned, the state is not mutated.
 func (m *stateMachine) pushArray() error {
 	switch {
-	case m.last.needObjectName():
-		return errMissingName
-	case !m.last.isValidNamespace():
+	case m.Last.NeedObjectName():
+		return ErrNonStringName
+	case !m.Last.isValidNamespace():
 		return errInvalidNamespace
+	case len(m.Stack) == maxNestingDepth:
+		return errMaxDepth
 	default:
-		m.last.increment()
-		m.stack = append(m.stack, m.last)
-		m.last = stateTypeArray
+		m.Last.Increment()
+		m.Stack = append(m.Stack, m.Last)
+		m.Last = stateTypeArray
 		return nil
 	}
 }
@@ -215,43 +352,43 @@ func (m *stateMachine) pushArray() error {
 // If an error is returned, the state is not mutated.
 func (m *stateMachine) popArray() error {
 	switch {
-	case !m.last.isArray() || len(m.stack) == 0: // forbid popping top-level virtual JSON array
+	case !m.Last.isArray() || len(m.Stack) == 0: // forbid popping top-level virtual JSON array
 		return errMismatchDelim
-	case !m.last.isValidNamespace():
+	case !m.Last.isValidNamespace():
 		return errInvalidNamespace
 	default:
-		m.last = m.stack[len(m.stack)-1]
-		m.stack = m.stack[:len(m.stack)-1]
+		m.Last = m.Stack[len(m.Stack)-1]
+		m.Stack = m.Stack[:len(m.Stack)-1]
 		return nil
 	}
 }
 
-// needIndent reports whether indent whitespace should be injected.
+// NeedIndent reports whether indent whitespace should be injected.
 // A zero value means that no whitespace should be injected.
 // A positive value means '\n', indentPrefix, and (n-1) copies of indentBody
 // should be appended to the output immediately before the next token.
-func (m stateMachine) needIndent(next Kind) (n int) {
+func (m stateMachine) NeedIndent(next Kind) (n int) {
 	willEnd := next == '}' || next == ']'
 	switch {
-	case m.depth() == 1:
+	case m.Depth() == 1:
 		return 0 // top-level values are never indented
-	case m.last.length() == 0 && willEnd:
+	case m.Last.Length() == 0 && willEnd:
 		return 0 // an empty object or array is never indented
-	case m.last.length() == 0 || m.last.needImplicitComma(next):
-		return m.depth()
+	case m.Last.Length() == 0 || m.Last.needImplicitComma(next):
+		return m.Depth()
 	case willEnd:
-		return m.depth() - 1
+		return m.Depth() - 1
 	default:
 		return 0
 	}
 }
 
-// mayAppendDelim appends a colon or comma that may precede the next token.
-func (m stateMachine) mayAppendDelim(b []byte, next Kind) []byte {
+// MayAppendDelim appends a colon or comma that may precede the next token.
+func (m stateMachine) MayAppendDelim(b []byte, next Kind) []byte {
 	switch {
-	case m.last.needImplicitColon():
+	case m.Last.needImplicitColon():
 		return append(b, ':')
-	case m.last.needImplicitComma(next) && len(m.stack) != 0: // comma not needed for top-level values
+	case m.Last.needImplicitComma(next) && len(m.Stack) != 0: // comma not needed for top-level values
 		return append(b, ',')
 	default:
 		return b
@@ -263,39 +400,24 @@ func (m stateMachine) mayAppendDelim(b []byte, next Kind) []byte {
 // A zero value means no delimiter should be emitted.
 func (m stateMachine) needDelim(next Kind) (delim byte) {
 	switch {
-	case m.last.needImplicitColon():
+	case m.Last.needImplicitColon():
 		return ':'
-	case m.last.needImplicitComma(next) && len(m.stack) != 0: // comma not needed for top-level values
+	case m.Last.needImplicitComma(next) && len(m.Stack) != 0: // comma not needed for top-level values
 		return ','
 	default:
 		return 0
 	}
 }
 
-// checkDelim reports whether the specified delimiter should be there given
-// the kind of the next token that appears immediately afterwards.
-func (m stateMachine) checkDelim(delim byte, next Kind) error {
-	switch needDelim := m.needDelim(next); {
-	case needDelim == delim:
-		return nil
-	case needDelim == ':':
-		return errMissingColon
-	case needDelim == ',':
-		return errMissingComma
-	default:
-		return newInvalidCharacterError([]byte{delim}, "before next token")
-	}
-}
-
-// invalidateDisabledNamespaces marks all disabled namespaces as invalid.
+// InvalidateDisabledNamespaces marks all disabled namespaces as invalid.
 //
 // For efficiency, Marshal and Unmarshal may disable namespaces since there are
 // more efficient ways to track duplicate names. However, if an error occurs,
 // the namespaces in Encoder or Decoder will be left in an inconsistent state.
 // Mark the namespaces as invalid so that future method calls on
 // Encoder or Decoder will return an error.
-func (m *stateMachine) invalidateDisabledNamespaces() {
-	for i := 0; i < m.depth(); i++ {
+func (m *stateMachine) InvalidateDisabledNamespaces() {
+	for i := range m.Depth() {
 		e := m.index(i)
 		if !e.isActiveNamespace() {
 			e.invalidateNamespace()
@@ -329,10 +451,10 @@ const (
 	stateCountEven    stateEntry = 0x0000_0000_0000_0000
 )
 
-// length reports the number of elements in the JSON object or array.
+// Length reports the number of elements in the JSON object or array.
 // Each name and value in an object entry is treated as a separate element.
-func (e stateEntry) length() int {
-	return int(e & stateCountMask)
+func (e stateEntry) Length() int64 {
+	return int64(e & stateCountMask)
 }
 
 // isObject reports whether this is a JSON object.
@@ -345,9 +467,9 @@ func (e stateEntry) isArray() bool {
 	return e&stateTypeMask == stateTypeArray
 }
 
-// needObjectName reports whether the next token must be a JSON string,
+// NeedObjectName reports whether the next token must be a JSON string,
 // which is necessary for JSON object names.
-func (e stateEntry) needObjectName() bool {
+func (e stateEntry) NeedObjectName() bool {
 	return e&(stateTypeMask|stateCountLSBMask) == stateTypeObject|stateCountEven
 }
 
@@ -367,13 +489,13 @@ func (e stateEntry) needObjectValue() bool {
 // which always occurs after a value in a JSON object or array
 // before the next value (or name).
 func (e stateEntry) needImplicitComma(next Kind) bool {
-	return !e.needObjectValue() && e.length() > 0 && next != '}' && next != ']'
+	return !e.needObjectValue() && e.Length() > 0 && next != '}' && next != ']'
 }
 
-// increment increments the number of elements for the current object or array.
+// Increment increments the number of elements for the current object or array.
 // This assumes that overflow won't practically be an issue since
 // 1<<bits.OnesCount(stateCountMask) is sufficiently large.
-func (e *stateEntry) increment() {
+func (e *stateEntry) Increment() {
 	(*e)++
 }
 
@@ -383,9 +505,9 @@ func (e *stateEntry) decrement() {
 	(*e)--
 }
 
-// disableNamespace disables the JSON object namespace such that the
+// DisableNamespace disables the JSON object namespace such that the
 // Encoder or Decoder no longer updates the namespace.
-func (e *stateEntry) disableNamespace() {
+func (e *stateEntry) DisableNamespace() {
 	*e |= stateDisableNamespace
 }
 
@@ -442,7 +564,7 @@ func (ns *objectNameStack) length() int {
 	return len(ns.offsets)
 }
 
-// getUnquoted retrieves the ith unquoted name in the namespace.
+// getUnquoted retrieves the ith unquoted name in the stack.
 // It returns an empty string if the last object is empty.
 //
 // Invariant: Must call copyQuotedBuffer beforehand.
@@ -463,10 +585,10 @@ func (ns *objectNameStack) push() {
 	ns.offsets = append(ns.offsets, invalidOffset)
 }
 
-// replaceLastQuotedOffset replaces the last name with the starting offset
+// ReplaceLastQuotedOffset replaces the last name with the starting offset
 // to the quoted name in some remote buffer. All offsets provided must be
 // relative to the same buffer until copyQuotedBuffer is called.
-func (ns *objectNameStack) replaceLastQuotedOffset(i int) {
+func (ns *objectNameStack) ReplaceLastQuotedOffset(i int) {
 	// Use bit-wise inversion instead of naive multiplication by -1 to avoid
 	// ambiguity regarding zero (which is a valid offset into the names field).
 	// Bit-wise inversion is mathematically equivalent to -i-1,
@@ -534,10 +656,10 @@ func (ns *objectNameStack) copyQuotedBuffer(b []byte) {
 		if i > 0 {
 			startOffset = ns.offsets[i-1]
 		}
-		if n := consumeSimpleString(quotedName); n > 0 {
+		if n := jsonwire.ConsumeSimpleString(quotedName); n > 0 {
 			ns.unquotedNames = append(ns.unquotedNames[:startOffset], quotedName[len(`"`):n-len(`"`)]...)
 		} else {
-			ns.unquotedNames, _ = unescapeString(ns.unquotedNames[:startOffset], quotedName)
+			ns.unquotedNames, _ = jsonwire.AppendUnquote(ns.unquotedNames[:startOffset], quotedName)
 		}
 		ns.offsets[i] = len(ns.unquotedNames)
 	}
@@ -565,14 +687,14 @@ func (nss *objectNamespaceStack) reset() {
 func (nss *objectNamespaceStack) push() {
 	if cap(*nss) > len(*nss) {
 		*nss = (*nss)[:len(*nss)+1]
-		nss.last().reset()
+		nss.Last().reset()
 	} else {
 		*nss = append(*nss, objectNamespace{})
 	}
 }
 
-// last returns a pointer to the last JSON object namespace.
-func (nss objectNamespaceStack) last() *objectNamespace {
+// Last returns a pointer to the last JSON object namespace.
+func (nss objectNamespaceStack) Last() *objectNamespace {
 	return &nss[len(nss)-1]
 }
 
@@ -641,13 +763,13 @@ func (ns *objectNamespace) insertQuoted(name []byte, isVerbatim bool) bool {
 	}
 	return ns.insert(name, !isVerbatim)
 }
-func (ns *objectNamespace) insertUnquoted(name []byte) bool {
+func (ns *objectNamespace) InsertUnquoted(name []byte) bool {
 	return ns.insert(name, false)
 }
 func (ns *objectNamespace) insert(name []byte, quoted bool) bool {
 	var allNames []byte
 	if quoted {
-		allNames, _ = unescapeString(ns.allUnquotedNames, name)
+		allNames, _ = jsonwire.AppendUnquote(ns.allUnquotedNames, name)
 	} else {
 		allNames = append(ns.allUnquotedNames, name...)
 	}
@@ -702,46 +824,3 @@ func (ns *objectNamespace) removeLast() {
 		ns.allUnquotedNames = ns.allUnquotedNames[:ns.endOffsets[ns.length()-1]]
 	}
 }
-
-type uintSet64 uint64
-
-func (s uintSet64) has(i uint) bool { return s&(1<<i) > 0 }
-func (s *uintSet64) set(i uint)     { *s |= 1 << i }
-
-// uintSet is a set of unsigned integers.
-// It is optimized for most integers being close to zero.
-type uintSet struct {
-	lo uintSet64
-	hi []uintSet64
-}
-
-// has reports whether i is in the set.
-func (s *uintSet) has(i uint) bool {
-	if i < 64 {
-		return s.lo.has(i)
-	} else {
-		i -= 64
-		iHi, iLo := int(i/64), i%64
-		return iHi < len(s.hi) && s.hi[iHi].has(iLo)
-	}
-}
-
-// insert inserts i into the set and reports whether it was the first insertion.
-func (s *uintSet) insert(i uint) bool {
-	// TODO: Make this inlineable at least for the lower 64-bit case.
-	if i < 64 {
-		has := s.lo.has(i)
-		s.lo.set(i)
-		return !has
-	} else {
-		i -= 64
-		iHi, iLo := int(i/64), i%64
-		if iHi >= len(s.hi) {
-			s.hi = append(s.hi, make([]uintSet64, iHi+1-len(s.hi))...)
-			s.hi = s.hi[:cap(s.hi)]
-		}
-		has := s.hi[iHi].has(iLo)
-		s.hi[iHi].set(iLo)
-		return !has
-	}
-}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/token.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/token.go
similarity index 87%
rename from vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/token.go
rename to vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/token.go
index 9acba7dadf..ea8c30eb5b 100644
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/token.go
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/token.go
@@ -2,11 +2,16 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package json
+package jsontext
 
 import (
+	"bytes"
+	"errors"
 	"math"
 	"strconv"
+
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire"
 )
 
 // NOTE: Token is analogous to v1 json.Token.
@@ -17,17 +22,19 @@ const (
 	maxUint64 = math.MaxUint64
 	minUint64 = 0 // for consistency and readability purposes
 
-	invalidTokenPanic = "invalid json.Token; it has been voided by a subsequent json.Decoder call"
+	invalidTokenPanic = "invalid jsontext.Token; it has been voided by a subsequent json.Decoder call"
 )
 
+var errInvalidToken = errors.New("invalid jsontext.Token")
+
 // Token represents a lexical JSON token, which may be one of the following:
 //   - a JSON literal (i.e., null, true, or false)
 //   - a JSON string (e.g., "hello, world!")
 //   - a JSON number (e.g., 123.456)
-//   - a start or end delimiter for a JSON object (i.e., { or } )
-//   - a start or end delimiter for a JSON array (i.e., [ or ] )
+//   - a begin or end delimiter for a JSON object (i.e., { or } )
+//   - a begin or end delimiter for a JSON array (i.e., [ or ] )
 //
-// A Token cannot represent entire array or object values, while a RawValue can.
+// A Token cannot represent entire array or object values, while a [Value] can.
 // There is no Token to represent commas and colons since
 // these structural tokens can be inferred from the surrounding context.
 type Token struct {
@@ -87,10 +94,10 @@ var (
 	False Token = rawToken("false")
 	True  Token = rawToken("true")
 
-	ObjectStart Token = rawToken("{")
-	ObjectEnd   Token = rawToken("}")
-	ArrayStart  Token = rawToken("[")
-	ArrayEnd    Token = rawToken("]")
+	BeginObject Token = rawToken("{")
+	EndObject   Token = rawToken("}")
+	BeginArray  Token = rawToken("[")
+	EndArray    Token = rawToken("]")
 
 	zeroString Token = rawToken(`""`)
 	zeroNumber Token = rawToken(`0`)
@@ -156,7 +163,7 @@ func Uint(n uint64) Token {
 }
 
 // Clone makes a copy of the Token such that its value remains valid
-// even after a subsequent Decoder.Read call.
+// even after a subsequent [Decoder.Read] call.
 func (t Token) Clone() Token {
 	// TODO: Allow caller to avoid any allocations?
 	if raw := t.raw; raw != nil {
@@ -169,22 +176,21 @@ func (t Token) Clone() Token {
 				return False
 			case True.raw:
 				return True
-			case ObjectStart.raw:
-				return ObjectStart
-			case ObjectEnd.raw:
-				return ObjectEnd
-			case ArrayStart.raw:
-				return ArrayStart
-			case ArrayEnd.raw:
-				return ArrayEnd
+			case BeginObject.raw:
+				return BeginObject
+			case EndObject.raw:
+				return EndObject
+			case BeginArray.raw:
+				return BeginArray
+			case EndArray.raw:
+				return EndArray
 			}
 		}
 
 		if uint64(raw.previousOffsetStart()) != t.num {
 			panic(invalidTokenPanic)
 		}
-		// TODO(https://go.dev/issue/45038): Use bytes.Clone.
-		buf := append([]byte(nil), raw.previousBuffer()...)
+		buf := bytes.Clone(raw.previousBuffer())
 		return Token{raw: &decodeBuffer{buf: buf, prevStart: 0, prevEnd: len(buf)}}
 	}
 	return t
@@ -205,20 +211,20 @@ func (t Token) Bool() bool {
 
 // appendString appends a JSON string to dst and returns it.
 // It panics if t is not a JSON string.
-func (t Token) appendString(dst []byte, validateUTF8, preserveRaw bool, escapeRune func(rune) bool) ([]byte, error) {
+func (t Token) appendString(dst []byte, flags *jsonflags.Flags) ([]byte, error) {
 	if raw := t.raw; raw != nil {
 		// Handle raw string value.
 		buf := raw.previousBuffer()
 		if Kind(buf[0]) == '"' {
-			if escapeRune == nil && consumeSimpleString(buf) == len(buf) {
+			if jsonwire.ConsumeSimpleString(buf) == len(buf) {
 				return append(dst, buf...), nil
 			}
-			dst, _, err := reformatString(dst, buf, validateUTF8, preserveRaw, escapeRune)
+			dst, _, err := jsonwire.ReformatString(dst, buf, flags)
 			return dst, err
 		}
 	} else if len(t.str) != 0 && t.num == 0 {
 		// Handle exact string value.
-		return appendString(dst, t.str, validateUTF8, escapeRune)
+		return jsonwire.AppendQuote(dst, t.str, flags)
 	}
 
 	panic("invalid JSON token kind: " + t.Kind().String())
@@ -244,9 +250,9 @@ func (t Token) string() (string, []byte) {
 		}
 		buf := raw.previousBuffer()
 		if buf[0] == '"' {
-			// TODO: Preserve valueFlags in Token?
-			isVerbatim := consumeSimpleString(buf) == len(buf)
-			return "", unescapeStringMayCopy(buf, isVerbatim)
+			// TODO: Preserve ValueFlags in Token?
+			isVerbatim := jsonwire.ConsumeSimpleString(buf) == len(buf)
+			return "", jsonwire.UnquoteMayCopy(buf, isVerbatim)
 		}
 		// Handle tokens that are not JSON strings for fmt.Stringer.
 		return "", buf
@@ -258,34 +264,31 @@ func (t Token) string() (string, []byte) {
 	if t.num > 0 {
 		switch t.str[0] {
 		case 'f':
-			return string(appendNumber(nil, math.Float64frombits(t.num), 64)), nil
+			return string(jsonwire.AppendFloat(nil, math.Float64frombits(t.num), 64)), nil
 		case 'i':
 			return strconv.FormatInt(int64(t.num), 10), nil
 		case 'u':
 			return strconv.FormatUint(uint64(t.num), 10), nil
 		}
 	}
-	return "<invalid json.Token>", nil
+	return "<invalid jsontext.Token>", nil
 }
 
 // appendNumber appends a JSON number to dst and returns it.
 // It panics if t is not a JSON number.
-func (t Token) appendNumber(dst []byte, canonicalize bool) ([]byte, error) {
+func (t Token) appendNumber(dst []byte, flags *jsonflags.Flags) ([]byte, error) {
 	if raw := t.raw; raw != nil {
 		// Handle raw number value.
 		buf := raw.previousBuffer()
 		if Kind(buf[0]).normalize() == '0' {
-			if !canonicalize {
-				return append(dst, buf...), nil
-			}
-			dst, _, err := reformatNumber(dst, buf, canonicalize)
+			dst, _, err := jsonwire.ReformatNumber(dst, buf, flags)
 			return dst, err
 		}
 	} else if t.num != 0 {
 		// Handle exact number value.
 		switch t.str[0] {
 		case 'f':
-			return appendNumber(dst, math.Float64frombits(t.num), 64), nil
+			return jsonwire.AppendFloat(dst, math.Float64frombits(t.num), 64), nil
 		case 'i':
 			return strconv.AppendInt(dst, int64(t.num), 10), nil
 		case 'u':
@@ -308,7 +311,7 @@ func (t Token) Float() float64 {
 		}
 		buf := raw.previousBuffer()
 		if Kind(buf[0]).normalize() == '0' {
-			fv, _ := parseFloat(buf, 64)
+			fv, _ := jsonwire.ParseFloat(buf, 64)
 			return fv
 		}
 	} else if t.num != 0 {
@@ -354,7 +357,7 @@ func (t Token) Int() int64 {
 		if len(buf) > 0 && buf[0] == '-' {
 			neg, buf = true, buf[1:]
 		}
-		if numAbs, ok := parseDecUint(buf); ok {
+		if numAbs, ok := jsonwire.ParseUint(buf); ok {
 			if neg {
 				if numAbs > -minInt64 {
 					return minInt64
@@ -415,7 +418,7 @@ func (t Token) Uint() uint64 {
 		if len(buf) > 0 && buf[0] == '-' {
 			neg, buf = true, buf[1:]
 		}
-		if num, ok := parseDecUint(buf); ok {
+		if num, ok := jsonwire.ParseUint(buf); ok {
 			if neg {
 				return minUint64
 			}
@@ -476,9 +479,9 @@ func (t Token) Kind() Kind {
 //   - 't': true
 //   - '"': string
 //   - '0': number
-//   - '{': object start
+//   - '{': object begin
 //   - '}': object end
-//   - '[': array start
+//   - '[': array begin
 //   - ']': array end
 //
 // An invalid kind is usually represented using 0,
@@ -509,7 +512,7 @@ func (k Kind) String() string {
 	case ']':
 		return "]"
 	default:
-		return "<invalid json.Kind: " + quoteRune([]byte{byte(k)}) + ">"
+		return "<invalid jsontext.Kind: " + jsonwire.QuoteRune(string(k)) + ">"
 	}
 }
 
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/value.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/value.go
new file mode 100644
index 0000000000..3ea05d3a0f
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/value.go
@@ -0,0 +1,393 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package jsontext
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"slices"
+	"sync"
+
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire"
+)
+
+// NOTE: Value is analogous to v1 json.RawMessage.
+
+// AppendFormat formats the JSON value in src and appends it to dst
+// according to the specified options.
+// See [Value.Format] for more details about the formatting behavior.
+//
+// The dst and src may overlap.
+// If an error is reported, then the entirety of src is appended to dst.
+func AppendFormat(dst, src []byte, opts ...Options) ([]byte, error) {
+	e := getBufferedEncoder(opts...)
+	defer putBufferedEncoder(e)
+	e.s.Flags.Set(jsonflags.OmitTopLevelNewline | 1)
+	if err := e.s.WriteValue(src); err != nil {
+		return append(dst, src...), err
+	}
+	return append(dst, e.s.Buf...), nil
+}
+
+// Value represents a single raw JSON value, which may be one of the following:
+//   - a JSON literal (i.e., null, true, or false)
+//   - a JSON string (e.g., "hello, world!")
+//   - a JSON number (e.g., 123.456)
+//   - an entire JSON object (e.g., {"fizz":"buzz"} )
+//   - an entire JSON array (e.g., [1,2,3] )
+//
+// Value can represent entire array or object values, while [Token] cannot.
+// Value may contain leading and/or trailing whitespace.
+type Value []byte
+
+// Clone returns a copy of v.
+func (v Value) Clone() Value {
+	return bytes.Clone(v)
+}
+
+// String returns the string formatting of v.
+func (v Value) String() string {
+	if v == nil {
+		return "null"
+	}
+	return string(v)
+}
+
+// IsValid reports whether the raw JSON value is syntactically valid
+// according to the specified options.
+//
+// By default (if no options are specified), it validates according to RFC 7493.
+// It verifies whether the input is properly encoded as UTF-8,
+// that escape sequences within strings decode to valid Unicode codepoints, and
+// that all names in each object are unique.
+// It does not verify whether numbers are representable within the limits
+// of any common numeric type (e.g., float64, int64, or uint64).
+//
+// Relevant options include:
+//   - [AllowDuplicateNames]
+//   - [AllowInvalidUTF8]
+//
+// All other options are ignored.
+func (v Value) IsValid(opts ...Options) bool {
+	// TODO: Document support for [WithByteLimit] and [WithDepthLimit].
+	d := getBufferedDecoder(v, opts...)
+	defer putBufferedDecoder(d)
+	_, errVal := d.ReadValue()
+	_, errEOF := d.ReadToken()
+	return errVal == nil && errEOF == io.EOF
+}
+
+// Format formats the raw JSON value in place.
+//
+// By default (if no options are specified), it validates according to RFC 7493
+// and produces the minimal JSON representation, where
+// all whitespace is elided and JSON strings use the shortest encoding.
+//
+// Relevant options include:
+//   - [AllowDuplicateNames]
+//   - [AllowInvalidUTF8]
+//   - [EscapeForHTML]
+//   - [EscapeForJS]
+//   - [PreserveRawStrings]
+//   - [CanonicalizeRawInts]
+//   - [CanonicalizeRawFloats]
+//   - [ReorderRawObjects]
+//   - [SpaceAfterColon]
+//   - [SpaceAfterComma]
+//   - [Multiline]
+//   - [WithIndent]
+//   - [WithIndentPrefix]
+//
+// All other options are ignored.
+//
+// It is guaranteed to succeed if the value is valid according to the same options.
+// If the value is already formatted, then the buffer is not mutated.
+func (v *Value) Format(opts ...Options) error {
+	// TODO: Document support for [WithByteLimit] and [WithDepthLimit].
+	return v.format(opts, nil)
+}
+
+// format accepts two []Options to avoid the allocation appending them together.
+// It is equivalent to v.Format(append(opts1, opts2...)...).
+func (v *Value) format(opts1, opts2 []Options) error {
+	e := getBufferedEncoder(opts1...)
+	defer putBufferedEncoder(e)
+	e.s.Join(opts2...)
+	e.s.Flags.Set(jsonflags.OmitTopLevelNewline | 1)
+	if err := e.s.WriteValue(*v); err != nil {
+		return err
+	}
+	if !bytes.Equal(*v, e.s.Buf) {
+		*v = append((*v)[:0], e.s.Buf...)
+	}
+	return nil
+}
+
+// Compact removes all whitespace from the raw JSON value.
+//
+// It does not reformat JSON strings or numbers to use any other representation.
+// To maximize the set of JSON values that can be formatted,
+// this permits values with duplicate names and invalid UTF-8.
+//
+// Compact is equivalent to calling [Value.Format] with the following options:
+//   - [AllowDuplicateNames](true)
+//   - [AllowInvalidUTF8](true)
+//   - [PreserveRawStrings](true)
+//
+// Any options specified by the caller are applied after the initial set
+// and may deliberately override prior options.
+func (v *Value) Compact(opts ...Options) error {
+	return v.format([]Options{
+		AllowDuplicateNames(true),
+		AllowInvalidUTF8(true),
+		PreserveRawStrings(true),
+	}, opts)
+}
+
+// Indent reformats the whitespace in the raw JSON value so that each element
+// in a JSON object or array begins on a indented line according to the nesting.
+//
+// It does not reformat JSON strings or numbers to use any other representation.
+// To maximize the set of JSON values that can be formatted,
+// this permits values with duplicate names and invalid UTF-8.
+//
+// Indent is equivalent to calling [Value.Format] with the following options:
+//   - [AllowDuplicateNames](true)
+//   - [AllowInvalidUTF8](true)
+//   - [PreserveRawStrings](true)
+//   - [Multiline](true)
+//
+// Any options specified by the caller are applied after the initial set
+// and may deliberately override prior options.
+func (v *Value) Indent(opts ...Options) error {
+	return v.format([]Options{
+		AllowDuplicateNames(true),
+		AllowInvalidUTF8(true),
+		PreserveRawStrings(true),
+		Multiline(true),
+	}, opts)
+}
+
+// Canonicalize canonicalizes the raw JSON value according to the
+// JSON Canonicalization Scheme (JCS) as defined by RFC 8785
+// where it produces a stable representation of a JSON value.
+//
+// JSON strings are formatted to use their minimal representation,
+// JSON numbers are formatted as double precision numbers according
+// to some stable serialization algorithm.
+// JSON object members are sorted in ascending order by name.
+// All whitespace is removed.
+//
+// The output stability is dependent on the stability of the application data
+// (see RFC 8785, Appendix E). It cannot produce stable output from
+// fundamentally unstable input. For example, if the JSON value
+// contains ephemeral data (e.g., a frequently changing timestamp),
+// then the value is still unstable regardless of whether this is called.
+//
+// Canonicalize is equivalent to calling [Value.Format] with the following options:
+//   - [CanonicalizeRawInts](true)
+//   - [CanonicalizeRawFloats](true)
+//   - [ReorderRawObjects](true)
+//
+// Any options specified by the caller are applied after the initial set
+// and may deliberately override prior options.
+//
+// Note that JCS treats all JSON numbers as IEEE 754 double precision numbers.
+// Any numbers with precision beyond what is representable by that form
+// will lose their precision when canonicalized. For example, integer values
+// beyond ±2⁵³ will lose their precision. To preserve the original representation
+// of JSON integers, additionally set [CanonicalizeRawInts] to false:
+//
+//	v.Canonicalize(jsontext.CanonicalizeRawInts(false))
+func (v *Value) Canonicalize(opts ...Options) error {
+	return v.format([]Options{
+		CanonicalizeRawInts(true),
+		CanonicalizeRawFloats(true),
+		ReorderRawObjects(true),
+	}, opts)
+}
+
+// MarshalJSON returns v as the JSON encoding of v.
+// It returns the stored value as the raw JSON output without any validation.
+// If v is nil, then this returns a JSON null.
+func (v Value) MarshalJSON() ([]byte, error) {
+	// NOTE: This matches the behavior of v1 json.RawMessage.MarshalJSON.
+	if v == nil {
+		return []byte("null"), nil
+	}
+	return v, nil
+}
+
+// UnmarshalJSON sets v as the JSON encoding of b.
+// It stores a copy of the provided raw JSON input without any validation.
+func (v *Value) UnmarshalJSON(b []byte) error {
+	// NOTE: This matches the behavior of v1 json.RawMessage.UnmarshalJSON.
+	if v == nil {
+		return errors.New("jsontext.Value: UnmarshalJSON on nil pointer")
+	}
+	*v = append((*v)[:0], b...)
+	return nil
+}
+
+// Kind returns the starting token kind.
+// For a valid value, this will never include '}' or ']'.
+func (v Value) Kind() Kind {
+	if v := v[jsonwire.ConsumeWhitespace(v):]; len(v) > 0 {
+		return Kind(v[0]).normalize()
+	}
+	return invalidKind
+}
+
+const commaAndWhitespace = ", \n\r\t"
+
+type objectMember struct {
+	// name is the unquoted name.
+	name []byte // e.g., "name"
+	// buffer is the entirety of the raw JSON object member
+	// starting from right after the previous member (or opening '{')
+	// until right after the member value.
+	buffer []byte // e.g., `, \n\r\t"name": "value"`
+}
+
+func (x objectMember) Compare(y objectMember) int {
+	if c := jsonwire.CompareUTF16(x.name, y.name); c != 0 {
+		return c
+	}
+	// With [AllowDuplicateNames] or [AllowInvalidUTF8],
+	// names could be identical, so also sort using the member value.
+	return jsonwire.CompareUTF16(
+		bytes.TrimLeft(x.buffer, commaAndWhitespace),
+		bytes.TrimLeft(y.buffer, commaAndWhitespace))
+}
+
+var objectMemberPool = sync.Pool{New: func() any { return new([]objectMember) }}
+
+func getObjectMembers() *[]objectMember {
+	ns := objectMemberPool.Get().(*[]objectMember)
+	*ns = (*ns)[:0]
+	return ns
+}
+func putObjectMembers(ns *[]objectMember) {
+	if cap(*ns) < 1<<10 {
+		clear(*ns) // avoid pinning name and buffer
+		objectMemberPool.Put(ns)
+	}
+}
+
+// mustReorderObjects reorders in-place all object members in a JSON value,
+// which must be valid otherwise it panics.
+func mustReorderObjects(b []byte) {
+	// Obtain a buffered encoder just to use its internal buffer as
+	// a scratch buffer for reordering object members.
+	e2 := getBufferedEncoder()
+	defer putBufferedEncoder(e2)
+
+	// Disable unnecessary checks to syntactically parse the JSON value.
+	d := getBufferedDecoder(b)
+	defer putBufferedDecoder(d)
+	d.s.Flags.Set(jsonflags.AllowDuplicateNames | jsonflags.AllowInvalidUTF8 | 1)
+	mustReorderObjectsFromDecoder(d, &e2.s.Buf) // per RFC 8785, section 3.2.3
+}
+
+// mustReorderObjectsFromDecoder recursively reorders all object members in place
+// according to the ordering specified in RFC 8785, section 3.2.3.
+//
+// Pre-conditions:
+//   - The value is valid (i.e., no decoder errors should ever occur).
+//   - Initial call is provided a Decoder reading from the start of v.
+//
+// Post-conditions:
+//   - Exactly one JSON value is read from the Decoder.
+//   - All fully-parsed JSON objects are reordered by directly moving
+//     the members in the value buffer.
+//
+// The runtime is approximately O(n·log(n)) + O(m·log(m)),
+// where n is len(v) and m is the total number of object members.
+func mustReorderObjectsFromDecoder(d *Decoder, scratch *[]byte) {
+	switch tok, err := d.ReadToken(); tok.Kind() {
+	case '{':
+		// Iterate and collect the name and offsets for every object member.
+		members := getObjectMembers()
+		defer putObjectMembers(members)
+		var prevMember objectMember
+		isSorted := true
+
+		beforeBody := d.InputOffset() // offset after '{'
+		for d.PeekKind() != '}' {
+			beforeName := d.InputOffset()
+			var flags jsonwire.ValueFlags
+			name, _ := d.s.ReadValue(&flags)
+			name = jsonwire.UnquoteMayCopy(name, flags.IsVerbatim())
+			mustReorderObjectsFromDecoder(d, scratch)
+			afterValue := d.InputOffset()
+
+			currMember := objectMember{name, d.s.buf[beforeName:afterValue]}
+			if isSorted && len(*members) > 0 {
+				isSorted = objectMember.Compare(prevMember, currMember) < 0
+			}
+			*members = append(*members, currMember)
+			prevMember = currMember
+		}
+		afterBody := d.InputOffset() // offset before '}'
+		d.ReadToken()
+
+		// Sort the members; return early if it's already sorted.
+		if isSorted {
+			return
+		}
+		firstBufferBeforeSorting := (*members)[0].buffer
+		slices.SortFunc(*members, objectMember.Compare)
+		firstBufferAfterSorting := (*members)[0].buffer
+
+		// Append the reordered members to a new buffer,
+		// then copy the reordered members back over the original members.
+		// Avoid swapping in place since each member may be a different size
+		// where moving a member over a smaller member may corrupt the data
+		// for subsequent members before they have been moved.
+		//
+		// The following invariant must hold:
+		//	sum([m.after-m.before for m in members]) == afterBody-beforeBody
+		commaAndWhitespacePrefix := func(b []byte) []byte {
+			return b[:len(b)-len(bytes.TrimLeft(b, commaAndWhitespace))]
+		}
+		sorted := (*scratch)[:0]
+		for i, member := range *members {
+			switch {
+			case i == 0 && &member.buffer[0] != &firstBufferBeforeSorting[0]:
+				// First member after sorting is not the first member before sorting,
+				// so use the prefix of the first member before sorting.
+				sorted = append(sorted, commaAndWhitespacePrefix(firstBufferBeforeSorting)...)
+				sorted = append(sorted, bytes.TrimLeft(member.buffer, commaAndWhitespace)...)
+			case i != 0 && &member.buffer[0] == &firstBufferBeforeSorting[0]:
+				// Later member after sorting is the first member before sorting,
+				// so use the prefix of the first member after sorting.
+				sorted = append(sorted, commaAndWhitespacePrefix(firstBufferAfterSorting)...)
+				sorted = append(sorted, bytes.TrimLeft(member.buffer, commaAndWhitespace)...)
+			default:
+				sorted = append(sorted, member.buffer...)
+			}
+		}
+		if int(afterBody-beforeBody) != len(sorted) {
+			panic("BUG: length invariant violated")
+		}
+		copy(d.s.buf[beforeBody:afterBody], sorted)
+
+		// Update scratch buffer to the largest amount ever used.
+		if len(sorted) > len(*scratch) {
+			*scratch = sorted
+		}
+	case '[':
+		for d.PeekKind() != ']' {
+			mustReorderObjectsFromDecoder(d, scratch)
+		}
+		d.ReadToken()
+	default:
+		if err != nil {
+			panic("BUG: " + err.Error())
+		}
+	}
+}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/migrate.sh b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/migrate.sh
new file mode 100644
index 0000000000..9c34f26eb9
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/migrate.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+GOROOT=${1:-../go}
+JSONROOT="."
+
+cp $JSONROOT/alias_gen.go $JSONROOT/alias_gen.go.bak
+rm -r $JSONROOT/*.go $JSONROOT/internal $JSONROOT/jsontext $JSONROOT/v1
+mv $JSONROOT/alias_gen.go.bak $JSONROOT/alias_gen.go
+cp -r $GOROOT/src/encoding/json/v2/*.go $JSONROOT/
+cp -r $GOROOT/src/encoding/json/internal/ $JSONROOT/internal/
+cp -r $GOROOT/src/encoding/json/jsontext/ $JSONROOT/jsontext/
+mkdir $JSONROOT/v1
+for X in $GOROOT/src/encoding/json/v2_*.go; do
+    cp $X $JSONROOT/v1/$(basename $X | sed "s/v2_//")
+done
+cd $JSONROOT
+for X in $(git ls-files --cached --others --exclude-standard | grep ".*[.]go$"); do
+    if [ ! -e "$X" ]; then
+        continue
+    fi
+    sed -i 's/go:build goexperiment.jsonv2$/go:build !goexperiment.jsonv2 || !go1.25/' $X
+    sed -i 's|"encoding/json/v2"|"github.com/go-json-experiment/json"|' $X
+    sed -i 's|"encoding/json/internal"|"github.com/go-json-experiment/json/internal"|' $X
+    sed -i 's|"encoding/json/internal/jsonflags"|"github.com/go-json-experiment/json/internal/jsonflags"|' $X
+    sed -i 's|"encoding/json/internal/jsonopts"|"github.com/go-json-experiment/json/internal/jsonopts"|' $X
+    sed -i 's|"encoding/json/internal/jsontest"|"github.com/go-json-experiment/json/internal/jsontest"|' $X
+    sed -i 's|"encoding/json/internal/jsonwire"|"github.com/go-json-experiment/json/internal/jsonwire"|' $X
+    sed -i 's|"encoding/json/jsontext"|"github.com/go-json-experiment/json/jsontext"|' $X
+    sed -i 's|"encoding/json"|"github.com/go-json-experiment/json/v1"|' $X
+    sed -i 's|"internal/zstd"|"github.com/go-json-experiment/json/internal/zstd"|' $X
+    goimports -w $X
+done
+sed -i 's/v2[.]struct/json.struct/' $JSONROOT/errors_test.go
+sed -i 's|jsonv1 "github.com/go-json-experiment/json/v1"|jsonv1 "encoding/json"|' $JSONROOT/bench_test.go
+
+# TODO(go1.25): Remove test that relies on "synctest" that is not available yet.
+sed -i '/Issue #73733/,+17d' $JSONROOT/v1/encode_test.go
+goimports -w $JSONROOT/v1/encode_test.go
+
+# Remove documentation that only makes sense within the stdlib.
+sed -i  '/This package .* is experimental/,+4d' $JSONROOT/doc.go
+sed -i  '/This package .* is experimental/,+4d' $JSONROOT/jsontext/doc.go
+
+git checkout internal/zstd # we still need local copy of zstd for testing
+
+go run alias_gen.go "encoding/json"          $JSONROOT/v1
+go run alias_gen.go "encoding/json/v2"       $JSONROOT
+go run alias_gen.go "encoding/json/jsontext" $JSONROOT/jsontext
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/options.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/options.go
new file mode 100644
index 0000000000..2f4744980f
--- /dev/null
+++ b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/options.go
@@ -0,0 +1,287 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"fmt"
+
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts"
+)
+
+// Options configure [Marshal], [MarshalWrite], [MarshalEncode],
+// [Unmarshal], [UnmarshalRead], and [UnmarshalDecode] with specific features.
+// Each function takes in a variadic list of options, where properties
+// set in later options override the value of previously set properties.
+//
+// The Options type is identical to [encoding/json.Options] and
+// [encoding/json/jsontext.Options]. Options from the other packages can
+// be used interchangeably with functionality in this package.
+//
+// Options represent either a singular option or a set of options.
+// It can be functionally thought of as a Go map of option properties
+// (even though the underlying implementation avoids Go maps for performance).
+//
+// The constructors (e.g., [Deterministic]) return a singular option value:
+//
+//	opt := Deterministic(true)
+//
+// which is analogous to creating a single entry map:
+//
+//	opt := Options{"Deterministic": true}
+//
+// [JoinOptions] composes multiple options values to together:
+//
+//	out := JoinOptions(opts...)
+//
+// which is analogous to making a new map and copying the options over:
+//
+//	out := make(Options)
+//	for _, m := range opts {
+//		for k, v := range m {
+//			out[k] = v
+//		}
+//	}
+//
+// [GetOption] looks up the value of options parameter:
+//
+//	v, ok := GetOption(opts, Deterministic)
+//
+// which is analogous to a Go map lookup:
+//
+//	v, ok := Options["Deterministic"]
+//
+// There is a single Options type, which is used with both marshal and unmarshal.
+// Some options affect both operations, while others only affect one operation:
+//
+//   - [StringifyNumbers] affects marshaling and unmarshaling
+//   - [Deterministic] affects marshaling only
+//   - [FormatNilSliceAsNull] affects marshaling only
+//   - [FormatNilMapAsNull] affects marshaling only
+//   - [OmitZeroStructFields] affects marshaling only
+//   - [MatchCaseInsensitiveNames] affects marshaling and unmarshaling
+//   - [DiscardUnknownMembers] affects marshaling only
+//   - [RejectUnknownMembers] affects unmarshaling only
+//   - [WithMarshalers] affects marshaling only
+//   - [WithUnmarshalers] affects unmarshaling only
+//
+// Options that do not affect a particular operation are ignored.
+type Options = jsonopts.Options
+
+// JoinOptions coalesces the provided list of options into a single Options.
+// Properties set in later options override the value of previously set properties.
+func JoinOptions(srcs ...Options) Options {
+	var dst jsonopts.Struct
+	dst.Join(srcs...)
+	return &dst
+}
+
+// GetOption returns the value stored in opts with the provided setter,
+// reporting whether the value is present.
+//
+// Example usage:
+//
+//	v, ok := json.GetOption(opts, json.Deterministic)
+//
+// Options are most commonly introspected to alter the JSON representation of
+// [MarshalerTo.MarshalJSONTo] and [UnmarshalerFrom.UnmarshalJSONFrom] methods, and
+// [MarshalToFunc] and [UnmarshalFromFunc] functions.
+// In such cases, the presence bit should generally be ignored.
+func GetOption[T any](opts Options, setter func(T) Options) (T, bool) {
+	return jsonopts.GetOption(opts, setter)
+}
+
+// DefaultOptionsV2 is the full set of all options that define v2 semantics.
+// It is equivalent to all options under [Options], [encoding/json.Options],
+// and [encoding/json/jsontext.Options] being set to false or the zero value,
+// except for the options related to whitespace formatting.
+func DefaultOptionsV2() Options {
+	return &jsonopts.DefaultOptionsV2
+}
+
+// StringifyNumbers specifies that numeric Go types should be marshaled
+// as a JSON string containing the equivalent JSON number value.
+// When unmarshaling, numeric Go types are parsed from a JSON string
+// containing the JSON number without any surrounding whitespace.
+//
+// According to RFC 8259, section 6, a JSON implementation may choose to
+// limit the representation of a JSON number to an IEEE 754 binary64 value.
+// This may cause decoders to lose precision for int64 and uint64 types.
+// Quoting JSON numbers as a JSON string preserves the exact precision.
+//
+// This affects either marshaling or unmarshaling.
+func StringifyNumbers(v bool) Options {
+	if v {
+		return jsonflags.StringifyNumbers | 1
+	} else {
+		return jsonflags.StringifyNumbers | 0
+	}
+}
+
+// Deterministic specifies that the same input value will be serialized
+// as the exact same output bytes. Different processes of
+// the same program will serialize equal values to the same bytes,
+// but different versions of the same program are not guaranteed
+// to produce the exact same sequence of bytes.
+//
+// This only affects marshaling and is ignored when unmarshaling.
+func Deterministic(v bool) Options {
+	if v {
+		return jsonflags.Deterministic | 1
+	} else {
+		return jsonflags.Deterministic | 0
+	}
+}
+
+// FormatNilSliceAsNull specifies that a nil Go slice should marshal as a
+// JSON null instead of the default representation as an empty JSON array
+// (or an empty JSON string in the case of ~[]byte).
+// Slice fields explicitly marked with `format:emitempty` still marshal
+// as an empty JSON array.
+//
+// This only affects marshaling and is ignored when unmarshaling.
+func FormatNilSliceAsNull(v bool) Options {
+	if v {
+		return jsonflags.FormatNilSliceAsNull | 1
+	} else {
+		return jsonflags.FormatNilSliceAsNull | 0
+	}
+}
+
+// FormatNilMapAsNull specifies that a nil Go map should marshal as a
+// JSON null instead of the default representation as an empty JSON object.
+// Map fields explicitly marked with `format:emitempty` still marshal
+// as an empty JSON object.
+//
+// This only affects marshaling and is ignored when unmarshaling.
+func FormatNilMapAsNull(v bool) Options {
+	if v {
+		return jsonflags.FormatNilMapAsNull | 1
+	} else {
+		return jsonflags.FormatNilMapAsNull | 0
+	}
+}
+
+// OmitZeroStructFields specifies that a Go struct should marshal in such a way
+// that all struct fields that are zero are omitted from the marshaled output
+// if the value is zero as determined by the "IsZero() bool" method if present,
+// otherwise based on whether the field is the zero Go value.
+// This is semantically equivalent to specifying the `omitzero` tag option
+// on every field in a Go struct.
+//
+// This only affects marshaling and is ignored when unmarshaling.
+func OmitZeroStructFields(v bool) Options {
+	if v {
+		return jsonflags.OmitZeroStructFields | 1
+	} else {
+		return jsonflags.OmitZeroStructFields | 0
+	}
+}
+
+// MatchCaseInsensitiveNames specifies that JSON object members are matched
+// against Go struct fields using a case-insensitive match of the name.
+// Go struct fields explicitly marked with `case:strict` or `case:ignore`
+// always use case-sensitive (or case-insensitive) name matching,
+// regardless of the value of this option.
+//
+// This affects either marshaling or unmarshaling.
+// For marshaling, this option may alter the detection of duplicate names
+// (assuming [jsontext.AllowDuplicateNames] is false) from inlined fields
+// if it matches one of the declared fields in the Go struct.
+func MatchCaseInsensitiveNames(v bool) Options {
+	if v {
+		return jsonflags.MatchCaseInsensitiveNames | 1
+	} else {
+		return jsonflags.MatchCaseInsensitiveNames | 0
+	}
+}
+
+// DiscardUnknownMembers specifies that marshaling should ignore any
+// JSON object members stored in Go struct fields dedicated to storing
+// unknown JSON object members.
+//
+// This only affects marshaling and is ignored when unmarshaling.
+func DiscardUnknownMembers(v bool) Options {
+	if v {
+		return jsonflags.DiscardUnknownMembers | 1
+	} else {
+		return jsonflags.DiscardUnknownMembers | 0
+	}
+}
+
+// RejectUnknownMembers specifies that unknown members should be rejected
+// when unmarshaling a JSON object, regardless of whether there is a field
+// to store unknown members.
+//
+// This only affects unmarshaling and is ignored when marshaling.
+func RejectUnknownMembers(v bool) Options {
+	if v {
+		return jsonflags.RejectUnknownMembers | 1
+	} else {
+		return jsonflags.RejectUnknownMembers | 0
+	}
+}
+
+// WithMarshalers specifies a list of type-specific marshalers to use,
+// which can be used to override the default marshal behavior for values
+// of particular types.
+//
+// This only affects marshaling and is ignored when unmarshaling.
+func WithMarshalers(v *Marshalers) Options {
+	return (*marshalersOption)(v)
+}
+
+// WithUnmarshalers specifies a list of type-specific unmarshalers to use,
+// which can be used to override the default unmarshal behavior for values
+// of particular types.
+//
+// This only affects unmarshaling and is ignored when marshaling.
+func WithUnmarshalers(v *Unmarshalers) Options {
+	return (*unmarshalersOption)(v)
+}
+
+// These option types are declared here instead of "jsonopts"
+// to avoid a dependency on "reflect" from "jsonopts".
+type (
+	marshalersOption   Marshalers
+	unmarshalersOption Unmarshalers
+)
+
+func (*marshalersOption) JSONOptions(internal.NotForPublicUse)   {}
+func (*unmarshalersOption) JSONOptions(internal.NotForPublicUse) {}
+
+// Inject support into "jsonopts" to handle these types.
+func init() {
+	jsonopts.GetUnknownOption = func(src jsonopts.Struct, zero jsonopts.Options) (any, bool) {
+		switch zero.(type) {
+		case *marshalersOption:
+			if !src.Flags.Has(jsonflags.Marshalers) {
+				return (*Marshalers)(nil), false
+			}
+			return src.Marshalers.(*Marshalers), true
+		case *unmarshalersOption:
+			if !src.Flags.Has(jsonflags.Unmarshalers) {
+				return (*Unmarshalers)(nil), false
+			}
+			return src.Unmarshalers.(*Unmarshalers), true
+		default:
+			panic(fmt.Sprintf("unknown option %T", zero))
+		}
+	}
+	jsonopts.JoinUnknownOption = func(dst jsonopts.Struct, src jsonopts.Options) jsonopts.Struct {
+		switch src := src.(type) {
+		case *marshalersOption:
+			dst.Flags.Set(jsonflags.Marshalers | 1)
+			dst.Marshalers = (*Marshalers)(src)
+		case *unmarshalersOption:
+			dst.Flags.Set(jsonflags.Unmarshalers | 1)
+			dst.Unmarshalers = (*Unmarshalers)(src)
+		default:
+			panic(fmt.Sprintf("unknown option %T", src))
+		}
+		return dst
+	}
+}
diff --git a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/value.go b/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/value.go
deleted file mode 100644
index e0bd1b31d7..0000000000
--- a/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/value.go
+++ /dev/null
@@ -1,381 +0,0 @@
-// Copyright 2020 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package json
-
-import (
-	"bytes"
-	"errors"
-	"io"
-	"sort"
-	"sync"
-	"unicode/utf16"
-	"unicode/utf8"
-)
-
-// NOTE: RawValue is analogous to v1 json.RawMessage.
-
-// RawValue represents a single raw JSON value, which may be one of the following:
-//   - a JSON literal (i.e., null, true, or false)
-//   - a JSON string (e.g., "hello, world!")
-//   - a JSON number (e.g., 123.456)
-//   - an entire JSON object (e.g., {"fizz":"buzz"} )
-//   - an entire JSON array (e.g., [1,2,3] )
-//
-// RawValue can represent entire array or object values, while Token cannot.
-// RawValue may contain leading and/or trailing whitespace.
-type RawValue []byte
-
-// Clone returns a copy of v.
-func (v RawValue) Clone() RawValue {
-	if v == nil {
-		return nil
-	}
-	return append(RawValue{}, v...)
-}
-
-// String returns the string formatting of v.
-func (v RawValue) String() string {
-	if v == nil {
-		return "null"
-	}
-	return string(v)
-}
-
-// IsValid reports whether the raw JSON value is syntactically valid
-// according to RFC 7493.
-//
-// It verifies whether the input is properly encoded as UTF-8,
-// that escape sequences within strings decode to valid Unicode codepoints, and
-// that all names in each object are unique.
-// It does not verify whether numbers are representable within the limits
-// of any common numeric type (e.g., float64, int64, or uint64).
-func (v RawValue) IsValid() bool {
-	d := getBufferedDecoder(v, DecodeOptions{})
-	defer putBufferedDecoder(d)
-	_, errVal := d.ReadValue()
-	_, errEOF := d.ReadToken()
-	return errVal == nil && errEOF == io.EOF
-}
-
-// Compact removes all whitespace from the raw JSON value.
-//
-// It does not reformat JSON strings to use any other representation.
-// It is guaranteed to succeed if the input is valid.
-// If the value is already compacted, then the buffer is not mutated.
-func (v *RawValue) Compact() error {
-	return v.reformat(false, false, "", "")
-}
-
-// Indent reformats the whitespace in the raw JSON value so that each element
-// in a JSON object or array begins on a new, indented line beginning with
-// prefix followed by one or more copies of indent according to the nesting.
-// The value does not begin with the prefix nor any indention,
-// to make it easier to embed inside other formatted JSON data.
-//
-// It does not reformat JSON strings to use any other representation.
-// It is guaranteed to succeed if the input is valid.
-// If the value is already indented properly, then the buffer is not mutated.
-func (v *RawValue) Indent(prefix, indent string) error {
-	return v.reformat(false, true, prefix, indent)
-}
-
-// Canonicalize canonicalizes the raw JSON value according to the
-// JSON Canonicalization Scheme (JCS) as defined by RFC 8785
-// where it produces a stable representation of a JSON value.
-//
-// The output stability is dependent on the stability of the application data
-// (see RFC 8785, Appendix E). It cannot produce stable output from
-// fundamentally unstable input. For example, if the JSON value
-// contains ephemeral data (e.g., a frequently changing timestamp),
-// then the value is still unstable regardless of whether this is called.
-//
-// Note that JCS treats all JSON numbers as IEEE 754 double precision numbers.
-// Any numbers with precision beyond what is representable by that form
-// will lose their precision when canonicalized. For example, integer values
-// beyond ±2⁵³ will lose their precision. It is recommended that
-// int64 and uint64 data types be represented as a JSON string.
-//
-// It is guaranteed to succeed if the input is valid.
-// If the value is already canonicalized, then the buffer is not mutated.
-func (v *RawValue) Canonicalize() error {
-	return v.reformat(true, false, "", "")
-}
-
-// TODO: Instead of implementing the v1 Marshaler/Unmarshaler,
-// consider implementing the v2 versions instead.
-
-// MarshalJSON returns v as the JSON encoding of v.
-// It returns the stored value as the raw JSON output without any validation.
-// If v is nil, then this returns a JSON null.
-func (v RawValue) MarshalJSON() ([]byte, error) {
-	// NOTE: This matches the behavior of v1 json.RawMessage.MarshalJSON.
-	if v == nil {
-		return []byte("null"), nil
-	}
-	return v, nil
-}
-
-// UnmarshalJSON sets v as the JSON encoding of b.
-// It stores a copy of the provided raw JSON input without any validation.
-func (v *RawValue) UnmarshalJSON(b []byte) error {
-	// NOTE: This matches the behavior of v1 json.RawMessage.UnmarshalJSON.
-	if v == nil {
-		return errors.New("json.RawValue: UnmarshalJSON on nil pointer")
-	}
-	*v = append((*v)[:0], b...)
-	return nil
-}
-
-// Kind returns the starting token kind.
-// For a valid value, this will never include '}' or ']'.
-func (v RawValue) Kind() Kind {
-	if v := v[consumeWhitespace(v):]; len(v) > 0 {
-		return Kind(v[0]).normalize()
-	}
-	return invalidKind
-}
-
-func (v *RawValue) reformat(canonical, multiline bool, prefix, indent string) error {
-	var eo EncodeOptions
-	if canonical {
-		eo.AllowInvalidUTF8 = false    // per RFC 8785, section 3.2.4
-		eo.AllowDuplicateNames = false // per RFC 8785, section 3.1
-		eo.canonicalizeNumbers = true  // per RFC 8785, section 3.2.2.3
-		eo.EscapeRune = nil            // per RFC 8785, section 3.2.2.2
-		eo.multiline = false           // per RFC 8785, section 3.2.1
-	} else {
-		if s := trimLeftSpaceTab(prefix); len(s) > 0 {
-			panic("json: invalid character " + quoteRune([]byte(s)) + " in indent prefix")
-		}
-		if s := trimLeftSpaceTab(indent); len(s) > 0 {
-			panic("json: invalid character " + quoteRune([]byte(s)) + " in indent")
-		}
-		eo.AllowInvalidUTF8 = true
-		eo.AllowDuplicateNames = true
-		eo.preserveRawStrings = true
-		eo.multiline = multiline // in case indent is empty
-		eo.IndentPrefix = prefix
-		eo.Indent = indent
-	}
-	eo.omitTopLevelNewline = true
-
-	// Write the entire value to reformat all tokens and whitespace.
-	e := getBufferedEncoder(eo)
-	defer putBufferedEncoder(e)
-	if err := e.WriteValue(*v); err != nil {
-		return err
-	}
-
-	// For canonical output, we may need to reorder object members.
-	if canonical {
-		// Obtain a buffered encoder just to use its internal buffer as
-		// a scratch buffer in reorderObjects for reordering object members.
-		e2 := getBufferedEncoder(EncodeOptions{})
-		defer putBufferedEncoder(e2)
-
-		// Disable redundant checks performed earlier during encoding.
-		d := getBufferedDecoder(e.buf, DecodeOptions{AllowInvalidUTF8: true, AllowDuplicateNames: true})
-		defer putBufferedDecoder(d)
-		reorderObjects(d, &e2.buf) // per RFC 8785, section 3.2.3
-	}
-
-	// Store the result back into the value if different.
-	if !bytes.Equal(*v, e.buf) {
-		*v = append((*v)[:0], e.buf...)
-	}
-	return nil
-}
-
-func trimLeftSpaceTab(s string) string {
-	for i, r := range s {
-		switch r {
-		case ' ', '\t':
-		default:
-			return s[i:]
-		}
-	}
-	return ""
-}
-
-type memberName struct {
-	// name is the unescaped name.
-	name []byte
-	// before and after are byte offsets into Decoder.buf that represents
-	// the entire name/value pair. It may contain leading commas.
-	before, after int64
-}
-
-var memberNamePool = sync.Pool{New: func() any { return new(memberNames) }}
-
-func getMemberNames() *memberNames {
-	ns := memberNamePool.Get().(*memberNames)
-	*ns = (*ns)[:0]
-	return ns
-}
-func putMemberNames(ns *memberNames) {
-	if cap(*ns) < 1<<10 {
-		for i := range *ns {
-			(*ns)[i] = memberName{} // avoid pinning name
-		}
-		memberNamePool.Put(ns)
-	}
-}
-
-type memberNames []memberName
-
-func (m *memberNames) Len() int           { return len(*m) }
-func (m *memberNames) Less(i, j int) bool { return lessUTF16((*m)[i].name, (*m)[j].name) }
-func (m *memberNames) Swap(i, j int)      { (*m)[i], (*m)[j] = (*m)[j], (*m)[i] }
-
-// reorderObjects recursively reorders all object members in place
-// according to the ordering specified in RFC 8785, section 3.2.3.
-//
-// Pre-conditions:
-//   - The value is valid (i.e., no decoder errors should ever occur).
-//   - The value is compact (i.e., no whitespace is present).
-//   - Initial call is provided a Decoder reading from the start of v.
-//
-// Post-conditions:
-//   - Exactly one JSON value is read from the Decoder.
-//   - All fully-parsed JSON objects are reordered by directly moving
-//     the members in the value buffer.
-//
-// The runtime is approximately O(n·log(n)) + O(m·log(m)),
-// where n is len(v) and m is the total number of object members.
-func reorderObjects(d *Decoder, scratch *[]byte) {
-	switch tok, _ := d.ReadToken(); tok.Kind() {
-	case '{':
-		// Iterate and collect the name and offsets for every object member.
-		members := getMemberNames()
-		defer putMemberNames(members)
-		var prevName []byte
-		isSorted := true
-
-		beforeBody := d.InputOffset() // offset after '{'
-		for d.PeekKind() != '}' {
-			beforeName := d.InputOffset()
-			var flags valueFlags
-			name, _ := d.readValue(&flags)
-			name = unescapeStringMayCopy(name, flags.isVerbatim())
-			reorderObjects(d, scratch)
-			afterValue := d.InputOffset()
-
-			if isSorted && len(*members) > 0 {
-				isSorted = lessUTF16(prevName, []byte(name))
-			}
-			*members = append(*members, memberName{name, beforeName, afterValue})
-			prevName = name
-		}
-		afterBody := d.InputOffset() // offset before '}'
-		d.ReadToken()
-
-		// Sort the members; return early if it's already sorted.
-		if isSorted {
-			return
-		}
-		// TODO(https://go.dev/issue/47619): Use slices.Sort.
-		sort.Sort(members)
-
-		// Append the reordered members to a new buffer,
-		// then copy the reordered members back over the original members.
-		// Avoid swapping in place since each member may be a different size
-		// where moving a member over a smaller member may corrupt the data
-		// for subsequent members before they have been moved.
-		//
-		// The following invariant must hold:
-		//	sum([m.after-m.before for m in members]) == afterBody-beforeBody
-		sorted := (*scratch)[:0]
-		for i, member := range *members {
-			if d.buf[member.before] == ',' {
-				member.before++ // trim leading comma
-			}
-			sorted = append(sorted, d.buf[member.before:member.after]...)
-			if i < len(*members)-1 {
-				sorted = append(sorted, ',') // append trailing comma
-			}
-		}
-		if int(afterBody-beforeBody) != len(sorted) {
-			panic("BUG: length invariant violated")
-		}
-		copy(d.buf[beforeBody:afterBody], sorted)
-
-		// Update scratch buffer to the largest amount ever used.
-		if len(sorted) > len(*scratch) {
-			*scratch = sorted
-		}
-	case '[':
-		for d.PeekKind() != ']' {
-			reorderObjects(d, scratch)
-		}
-		d.ReadToken()
-	}
-}
-
-// lessUTF16 reports whether x is lexicographically less than y according
-// to the UTF-16 codepoints of the UTF-8 encoded input strings.
-// This implements the ordering specified in RFC 8785, section 3.2.3.
-// The inputs must be valid UTF-8, otherwise this may panic.
-func lessUTF16[Bytes []byte | string](x, y Bytes) bool {
-	// NOTE: This is an optimized, allocation-free implementation
-	// of lessUTF16Simple in fuzz_test.go. FuzzLessUTF16 verifies that the
-	// two implementations agree on the result of comparing any two strings.
-
-	isUTF16Self := func(r rune) bool {
-		return ('\u0000' <= r && r <= '\uD7FF') || ('\uE000' <= r && r <= '\uFFFF')
-	}
-
-	var invalidUTF8 bool
-	x0, y0 := x, y
-	for {
-		if len(x) == 0 || len(y) == 0 {
-			if len(x) == len(y) && invalidUTF8 {
-				return string(x0) < string(y0)
-			}
-			return len(x) < len(y)
-		}
-
-		// ASCII fast-path.
-		if x[0] < utf8.RuneSelf || y[0] < utf8.RuneSelf {
-			if x[0] != y[0] {
-				return x[0] < y[0]
-			}
-			x, y = x[1:], y[1:]
-			continue
-		}
-
-		// Decode next pair of runes as UTF-8.
-		// TODO(https://go.dev/issue/56948): Use a generic implementation
-		// of utf8.DecodeRune, or rely on a compiler optimization to statically
-		// hide the cost of a type switch (https://go.dev/issue/57072).
-		var rx, ry rune
-		var nx, ny int
-		switch any(x).(type) {
-		case string:
-			rx, nx = utf8.DecodeRuneInString(string(x))
-			ry, ny = utf8.DecodeRuneInString(string(y))
-		case []byte:
-			rx, nx = utf8.DecodeRune([]byte(x))
-			ry, ny = utf8.DecodeRune([]byte(y))
-		}
-
-		selfx := isUTF16Self(rx)
-		selfy := isUTF16Self(ry)
-		switch {
-		// The x rune is a single UTF-16 codepoint, while
-		// the y rune is a surrogate pair of UTF-16 codepoints.
-		case selfx && !selfy:
-			ry, _ = utf16.EncodeRune(ry)
-		// The y rune is a single UTF-16 codepoint, while
-		// the x rune is a surrogate pair of UTF-16 codepoints.
-		case selfy && !selfx:
-			rx, _ = utf16.EncodeRune(rx)
-		}
-		if rx != ry {
-			return rx < ry
-		}
-		invalidUTF8 = invalidUTF8 || (rx == utf8.RuneError && nx == 1) || (ry == utf8.RuneError && ny == 1)
-		x, y = x[nx:], y[ny:]
-	}
-}
diff --git a/vendor/k8s.io/kube-openapi/pkg/schemaconv/openapi.go b/vendor/k8s.io/kube-openapi/pkg/schemaconv/openapi.go
index 81280aae64..06bcf0c37c 100644
--- a/vendor/k8s.io/kube-openapi/pkg/schemaconv/openapi.go
+++ b/vendor/k8s.io/kube-openapi/pkg/schemaconv/openapi.go
@@ -140,18 +140,20 @@ func (c *convert) makeOpenAPIRef(specSchema *spec.Schema) schema.TypeRef {
 		// 	to deduplicate)
 		mapRelationship, err := getMapElementRelationship(specSchema.Extensions)
 		if err != nil {
-			c.reportError(err.Error())
+			c.reportError("%v", err)
 		}
 
 		if len(mapRelationship) > 0 {
 			return schema.TypeRef{
 				NamedType:           &n,
 				ElementRelationship: &mapRelationship,
+				Nullable:            specSchema.Nullable,
 			}
 		}
 
 		return schema.TypeRef{
 			NamedType: &n,
+			Nullable:  specSchema.Nullable,
 		}
 
 	}
@@ -164,7 +166,8 @@ func (c *convert) makeOpenAPIRef(specSchema *spec.Schema) schema.TypeRef {
 	c.pop(c2)
 
 	return schema.TypeRef{
-		Inlined: inlined,
+		Inlined:  inlined,
+		Nullable: specSchema.Nullable,
 	}
 }
 
@@ -212,7 +215,7 @@ func (c *convert) parseObject(s *spec.Schema) *schema.Map {
 
 	relationship, err := getMapElementRelationship(s.Extensions)
 	if err != nil {
-		c.reportError(err.Error())
+		c.reportError("%v", err)
 	}
 
 	return &schema.Map{
@@ -225,7 +228,7 @@ func (c *convert) parseObject(s *spec.Schema) *schema.Map {
 func (c *convert) parseList(s *spec.Schema) *schema.List {
 	relationship, mapKeys, err := getListElementRelationship(s.Extensions)
 	if err != nil {
-		c.reportError(err.Error())
+		c.reportError("%v", err)
 	}
 	elementType := func() schema.TypeRef {
 		if s.Items != nil {
diff --git a/vendor/k8s.io/kube-openapi/pkg/schemaconv/proto_models.go b/vendor/k8s.io/kube-openapi/pkg/schemaconv/proto_models.go
index e40f6056e7..6a8b9f44ac 100644
--- a/vendor/k8s.io/kube-openapi/pkg/schemaconv/proto_models.go
+++ b/vendor/k8s.io/kube-openapi/pkg/schemaconv/proto_models.go
@@ -72,7 +72,7 @@ func (c *convert) makeRef(model proto.Schema, preserveUnknownFields bool) schema
 		mapRelationship, err := getMapElementRelationship(model.GetExtensions())
 
 		if err != nil {
-			c.reportError(err.Error())
+			c.reportError("%v", err)
 		}
 
 		// empty string means unset.
@@ -114,7 +114,7 @@ func (c *convert) VisitKind(k *proto.Kind) {
 
 	unions, err := makeUnions(k.GetExtensions())
 	if err != nil {
-		c.reportError(err.Error())
+		c.reportError("%v", err)
 		return
 	}
 	// TODO: We should check that the fields and discriminator
@@ -129,14 +129,14 @@ func (c *convert) VisitKind(k *proto.Kind) {
 
 	a.Map.ElementRelationship, err = getMapElementRelationship(k.GetExtensions())
 	if err != nil {
-		c.reportError(err.Error())
+		c.reportError("%v", err)
 	}
 }
 
 func (c *convert) VisitArray(a *proto.Array) {
 	relationship, mapKeys, err := getListElementRelationship(a.GetExtensions())
 	if err != nil {
-		c.reportError(err.Error())
+		c.reportError("%v", err)
 	}
 
 	atom := c.top()
@@ -150,7 +150,7 @@ func (c *convert) VisitArray(a *proto.Array) {
 func (c *convert) VisitMap(m *proto.Map) {
 	relationship, err := getMapElementRelationship(m.GetExtensions())
 	if err != nil {
-		c.reportError(err.Error())
+		c.reportError("%v", err)
 	}
 
 	a := c.top()
diff --git a/vendor/k8s.io/kube-openapi/pkg/spec3/encoding.go b/vendor/k8s.io/kube-openapi/pkg/spec3/encoding.go
index 1f62c6e772..1b3dfff1d1 100644
--- a/vendor/k8s.io/kube-openapi/pkg/spec3/encoding.go
+++ b/vendor/k8s.io/kube-openapi/pkg/spec3/encoding.go
@@ -22,6 +22,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 )
 
@@ -46,14 +47,14 @@ func (e *Encoding) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2), nil
 }
 
-func (e *Encoding) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (e *Encoding) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
 		EncodingProps encodingPropsOmitZero `json:",inline"`
-		spec.Extensions
+		Extensions    spec.Extensions       `json:",inline"`
 	}
 	x.Extensions = internal.SanitizeExtensions(e.Extensions)
 	x.EncodingProps = encodingPropsOmitZero(e.EncodingProps)
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 func (e *Encoding) UnmarshalJSON(data []byte) error {
@@ -69,12 +70,12 @@ func (e *Encoding) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (e *Encoding) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (e *Encoding) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		spec.Extensions
+		Extensions spec.Extensions `json:",inline"`
 		EncodingProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 
diff --git a/vendor/k8s.io/kube-openapi/pkg/spec3/example.go b/vendor/k8s.io/kube-openapi/pkg/spec3/example.go
index 8834a92e6d..3edb104929 100644
--- a/vendor/k8s.io/kube-openapi/pkg/spec3/example.go
+++ b/vendor/k8s.io/kube-openapi/pkg/spec3/example.go
@@ -22,6 +22,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 
 	"k8s.io/kube-openapi/pkg/validation/spec"
 )
@@ -53,16 +54,16 @@ func (e *Example) MarshalJSON() ([]byte, error) {
 	}
 	return swag.ConcatJSON(b1, b2, b3), nil
 }
-func (e *Example) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (e *Example) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
 		Ref          string `json:"$ref,omitempty"`
 		ExampleProps `json:",inline"`
-		spec.Extensions
+		Extensions   spec.Extensions `json:",inline"`
 	}
 	x.Ref = e.Refable.Ref.String()
 	x.Extensions = internal.SanitizeExtensions(e.Extensions)
 	x.ExampleProps = e.ExampleProps
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 func (e *Example) UnmarshalJSON(data []byte) error {
@@ -81,12 +82,12 @@ func (e *Example) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (e *Example) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (e *Example) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		spec.Extensions
+		Extensions spec.Extensions `json:",inline"`
 		ExampleProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	if err := internal.JSONRefFromMap(&e.Ref.Ref, x.Extensions); err != nil {
diff --git a/vendor/k8s.io/kube-openapi/pkg/spec3/external_documentation.go b/vendor/k8s.io/kube-openapi/pkg/spec3/external_documentation.go
index f0515496e4..7a83c53c09 100644
--- a/vendor/k8s.io/kube-openapi/pkg/spec3/external_documentation.go
+++ b/vendor/k8s.io/kube-openapi/pkg/spec3/external_documentation.go
@@ -22,6 +22,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 )
 
@@ -53,14 +54,14 @@ func (e *ExternalDocumentation) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2), nil
 }
 
-func (e *ExternalDocumentation) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (e *ExternalDocumentation) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
 		ExternalDocumentationProps `json:",inline"`
-		spec.Extensions
+		Extensions                 spec.Extensions `json:",inline"`
 	}
 	x.Extensions = internal.SanitizeExtensions(e.Extensions)
 	x.ExternalDocumentationProps = e.ExternalDocumentationProps
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 func (e *ExternalDocumentation) UnmarshalJSON(data []byte) error {
@@ -76,12 +77,12 @@ func (e *ExternalDocumentation) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (e *ExternalDocumentation) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (e *ExternalDocumentation) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		spec.Extensions
+		Extensions spec.Extensions `json:",inline"`
 		ExternalDocumentationProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	e.Extensions = internal.SanitizeExtensions(x.Extensions)
diff --git a/vendor/k8s.io/kube-openapi/pkg/spec3/header.go b/vendor/k8s.io/kube-openapi/pkg/spec3/header.go
index 9ea30628ce..475817f666 100644
--- a/vendor/k8s.io/kube-openapi/pkg/spec3/header.go
+++ b/vendor/k8s.io/kube-openapi/pkg/spec3/header.go
@@ -22,6 +22,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 )
 
@@ -54,16 +55,16 @@ func (h *Header) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2, b3), nil
 }
 
-func (h *Header) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (h *Header) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
 		Ref         string              `json:"$ref,omitempty"`
 		HeaderProps headerPropsOmitZero `json:",inline"`
-		spec.Extensions
+		Extensions  spec.Extensions     `json:",inline"`
 	}
 	x.Ref = h.Refable.Ref.String()
 	x.Extensions = internal.SanitizeExtensions(h.Extensions)
 	x.HeaderProps = headerPropsOmitZero(h.HeaderProps)
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 func (h *Header) UnmarshalJSON(data []byte) error {
@@ -83,12 +84,12 @@ func (h *Header) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (h *Header) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (h *Header) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		spec.Extensions
+		Extensions spec.Extensions `json:",inline"`
 		HeaderProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	if err := internal.JSONRefFromMap(&h.Ref.Ref, x.Extensions); err != nil {
diff --git a/vendor/k8s.io/kube-openapi/pkg/spec3/media_type.go b/vendor/k8s.io/kube-openapi/pkg/spec3/media_type.go
index 47eef1edb0..c9062b2386 100644
--- a/vendor/k8s.io/kube-openapi/pkg/spec3/media_type.go
+++ b/vendor/k8s.io/kube-openapi/pkg/spec3/media_type.go
@@ -22,6 +22,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 )
 
@@ -49,14 +50,14 @@ func (m *MediaType) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2), nil
 }
 
-func (e *MediaType) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (e *MediaType) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
 		MediaTypeProps mediaTypePropsOmitZero `json:",inline"`
-		spec.Extensions
+		Extensions     spec.Extensions        `json:",inline"`
 	}
 	x.Extensions = internal.SanitizeExtensions(e.Extensions)
 	x.MediaTypeProps = mediaTypePropsOmitZero(e.MediaTypeProps)
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 func (m *MediaType) UnmarshalJSON(data []byte) error {
@@ -72,12 +73,12 @@ func (m *MediaType) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (m *MediaType) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (m *MediaType) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		spec.Extensions
+		Extensions spec.Extensions `json:",inline"`
 		MediaTypeProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	m.Extensions = internal.SanitizeExtensions(x.Extensions)
diff --git a/vendor/k8s.io/kube-openapi/pkg/spec3/operation.go b/vendor/k8s.io/kube-openapi/pkg/spec3/operation.go
index f1e1025479..8219b29d0b 100644
--- a/vendor/k8s.io/kube-openapi/pkg/spec3/operation.go
+++ b/vendor/k8s.io/kube-openapi/pkg/spec3/operation.go
@@ -22,6 +22,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 )
 
@@ -49,14 +50,14 @@ func (o *Operation) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2), nil
 }
 
-func (o *Operation) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (o *Operation) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
-		spec.Extensions
+		Extensions     spec.Extensions        `json:",inline"`
 		OperationProps operationPropsOmitZero `json:",inline"`
 	}
 	x.Extensions = internal.SanitizeExtensions(o.Extensions)
 	x.OperationProps = operationPropsOmitZero(o.OperationProps)
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 // UnmarshalJSON hydrates this items instance with the data from JSON
@@ -70,12 +71,12 @@ func (o *Operation) UnmarshalJSON(data []byte) error {
 	return json.Unmarshal(data, &o.VendorExtensible)
 }
 
-func (o *Operation) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (o *Operation) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		spec.Extensions
+		Extensions spec.Extensions `json:",inline"`
 		OperationProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	o.Extensions = internal.SanitizeExtensions(x.Extensions)
diff --git a/vendor/k8s.io/kube-openapi/pkg/spec3/parameter.go b/vendor/k8s.io/kube-openapi/pkg/spec3/parameter.go
index ada7edb637..a5e7d46c48 100644
--- a/vendor/k8s.io/kube-openapi/pkg/spec3/parameter.go
+++ b/vendor/k8s.io/kube-openapi/pkg/spec3/parameter.go
@@ -22,6 +22,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 )
 
@@ -54,16 +55,16 @@ func (p *Parameter) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2, b3), nil
 }
 
-func (p *Parameter) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (p *Parameter) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
 		Ref            string                 `json:"$ref,omitempty"`
 		ParameterProps parameterPropsOmitZero `json:",inline"`
-		spec.Extensions
+		Extensions     spec.Extensions        `json:",inline"`
 	}
 	x.Ref = p.Refable.Ref.String()
 	x.Extensions = internal.SanitizeExtensions(p.Extensions)
 	x.ParameterProps = parameterPropsOmitZero(p.ParameterProps)
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 func (p *Parameter) UnmarshalJSON(data []byte) error {
@@ -84,12 +85,12 @@ func (p *Parameter) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (p *Parameter) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (p *Parameter) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		spec.Extensions
+		Extensions spec.Extensions `json:",inline"`
 		ParameterProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	if err := internal.JSONRefFromMap(&p.Ref.Ref, x.Extensions); err != nil {
diff --git a/vendor/k8s.io/kube-openapi/pkg/spec3/path.go b/vendor/k8s.io/kube-openapi/pkg/spec3/path.go
index 16fbbb4dd9..cb04cf0f9d 100644
--- a/vendor/k8s.io/kube-openapi/pkg/spec3/path.go
+++ b/vendor/k8s.io/kube-openapi/pkg/spec3/path.go
@@ -24,6 +24,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 )
 
@@ -57,7 +58,7 @@ func (p *Paths) MarshalJSON() ([]byte, error) {
 	return concated, nil
 }
 
-func (p *Paths) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (p *Paths) MarshalJSONTo(enc *jsontext.Encoder) error {
 	m := make(map[string]any, len(p.Extensions)+len(p.Paths))
 	for k, v := range p.Extensions {
 		if internal.IsExtensionKey(k) {
@@ -69,7 +70,7 @@ func (p *Paths) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder)
 			m[k] = v
 		}
 	}
-	return opts.MarshalNext(enc, m)
+	return jsonv2.MarshalEncode(enc, m)
 }
 
 // UnmarshalJSON hydrates this items instance with the data from JSON
@@ -106,7 +107,7 @@ func (p *Paths) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (p *Paths) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (p *Paths) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	tok, err := dec.ReadToken()
 	if err != nil {
 		return err
@@ -129,7 +130,7 @@ func (p *Paths) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Deco
 			switch k := tok.String(); {
 			case internal.IsExtensionKey(k):
 				var ext any
-				if err := opts.UnmarshalNext(dec, &ext); err != nil {
+				if err := jsonv2.UnmarshalDecode(dec, &ext); err != nil {
 					return err
 				}
 
@@ -139,7 +140,7 @@ func (p *Paths) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Deco
 				p.Extensions[k] = ext
 			case len(k) > 0 && k[0] == '/':
 				pi := Path{}
-				if err := opts.UnmarshalNext(dec, &pi); err != nil {
+				if err := jsonv2.UnmarshalDecode(dec, &pi); err != nil {
 					return err
 				}
 
@@ -188,16 +189,16 @@ func (p *Path) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2, b3), nil
 }
 
-func (p *Path) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (p *Path) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
-		Ref string `json:"$ref,omitempty"`
-		spec.Extensions
+		Ref        string          `json:"$ref,omitempty"`
+		Extensions spec.Extensions `json:",inline"`
 		PathProps
 	}
 	x.Ref = p.Refable.Ref.String()
 	x.Extensions = internal.SanitizeExtensions(p.Extensions)
 	x.PathProps = p.PathProps
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 func (p *Path) UnmarshalJSON(data []byte) error {
@@ -216,13 +217,13 @@ func (p *Path) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (p *Path) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (p *Path) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		spec.Extensions
+		Extensions spec.Extensions `json:",inline"`
 		PathProps
 	}
 
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	if err := internal.JSONRefFromMap(&p.Ref.Ref, x.Extensions); err != nil {
diff --git a/vendor/k8s.io/kube-openapi/pkg/spec3/request_body.go b/vendor/k8s.io/kube-openapi/pkg/spec3/request_body.go
index 6f8607e400..b39c0d4fee 100644
--- a/vendor/k8s.io/kube-openapi/pkg/spec3/request_body.go
+++ b/vendor/k8s.io/kube-openapi/pkg/spec3/request_body.go
@@ -22,6 +22,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 )
 
@@ -54,16 +55,16 @@ func (r *RequestBody) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2, b3), nil
 }
 
-func (r *RequestBody) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (r *RequestBody) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
 		Ref              string                   `json:"$ref,omitempty"`
 		RequestBodyProps requestBodyPropsOmitZero `json:",inline"`
-		spec.Extensions
+		Extensions       spec.Extensions          `json:",inline"`
 	}
 	x.Ref = r.Refable.Ref.String()
 	x.Extensions = internal.SanitizeExtensions(r.Extensions)
 	x.RequestBodyProps = requestBodyPropsOmitZero(r.RequestBodyProps)
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 func (r *RequestBody) UnmarshalJSON(data []byte) error {
@@ -98,12 +99,12 @@ type requestBodyPropsOmitZero struct {
 	Required    bool                  `json:"required,omitzero"`
 }
 
-func (r *RequestBody) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (r *RequestBody) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		spec.Extensions
+		Extensions spec.Extensions `json:",inline"`
 		RequestBodyProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	if err := internal.JSONRefFromMap(&r.Ref.Ref, x.Extensions); err != nil {
diff --git a/vendor/k8s.io/kube-openapi/pkg/spec3/response.go b/vendor/k8s.io/kube-openapi/pkg/spec3/response.go
index 73e241fdc9..72ad9882d1 100644
--- a/vendor/k8s.io/kube-openapi/pkg/spec3/response.go
+++ b/vendor/k8s.io/kube-openapi/pkg/spec3/response.go
@@ -24,6 +24,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 )
 
@@ -51,11 +52,11 @@ func (r *Responses) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2), nil
 }
 
-func (r Responses) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (r Responses) MarshalJSONTo(enc *jsontext.Encoder) error {
 	type ArbitraryKeys map[string]interface{}
 	var x struct {
-		ArbitraryKeys
-		Default *Response `json:"default,omitzero"`
+		ArbitraryKeys ArbitraryKeys `json:",inline"`
+		Default       *Response     `json:"default,omitzero"`
 	}
 	x.ArbitraryKeys = make(map[string]any, len(r.Extensions)+len(r.StatusCodeResponses))
 	for k, v := range r.Extensions {
@@ -67,7 +68,7 @@ func (r Responses) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encod
 		x.ArbitraryKeys[strconv.Itoa(k)] = v
 	}
 	x.Default = r.Default
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 func (r *Responses) UnmarshalJSON(data []byte) error {
@@ -136,7 +137,7 @@ func (r *ResponsesProps) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (r *Responses) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) (err error) {
+func (r *Responses) UnmarshalJSONFrom(dec *jsontext.Decoder) (err error) {
 	tok, err := dec.ReadToken()
 	if err != nil {
 		return err
@@ -157,7 +158,7 @@ func (r *Responses) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.
 			switch k := tok.String(); {
 			case internal.IsExtensionKey(k):
 				var ext any
-				if err := opts.UnmarshalNext(dec, &ext); err != nil {
+				if err := jsonv2.UnmarshalDecode(dec, &ext); err != nil {
 					return err
 				}
 
@@ -167,14 +168,14 @@ func (r *Responses) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.
 				r.Extensions[k] = ext
 			case k == "default":
 				resp := Response{}
-				if err := opts.UnmarshalNext(dec, &resp); err != nil {
+				if err := jsonv2.UnmarshalDecode(dec, &resp); err != nil {
 					return err
 				}
 				r.ResponsesProps.Default = &resp
 			default:
 				if nk, err := strconv.Atoi(k); err == nil {
 					resp := Response{}
-					if err := opts.UnmarshalNext(dec, &resp); err != nil {
+					if err := jsonv2.UnmarshalDecode(dec, &resp); err != nil {
 						return err
 					}
 
@@ -219,16 +220,16 @@ func (r *Response) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2, b3), nil
 }
 
-func (r Response) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (r Response) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
-		Ref string `json:"$ref,omitempty"`
-		spec.Extensions
+		Ref           string          `json:"$ref,omitempty"`
+		Extensions    spec.Extensions `json:",inline"`
 		ResponseProps `json:",inline"`
 	}
 	x.Ref = r.Refable.Ref.String()
 	x.Extensions = internal.SanitizeExtensions(r.Extensions)
 	x.ResponseProps = r.ResponseProps
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 func (r *Response) UnmarshalJSON(data []byte) error {
@@ -247,12 +248,12 @@ func (r *Response) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (r *Response) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (r *Response) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		spec.Extensions
+		Extensions spec.Extensions `json:",inline"`
 		ResponseProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	if err := internal.JSONRefFromMap(&r.Ref.Ref, x.Extensions); err != nil {
@@ -302,16 +303,16 @@ func (r *Link) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2, b3), nil
 }
 
-func (r *Link) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (r *Link) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
-		Ref string `json:"$ref,omitempty"`
-		spec.Extensions
-		LinkProps `json:",inline"`
+		Ref        string          `json:"$ref,omitempty"`
+		Extensions spec.Extensions `json:",inline"`
+		LinkProps  `json:",inline"`
 	}
 	x.Ref = r.Refable.Ref.String()
 	x.Extensions = internal.SanitizeExtensions(r.Extensions)
 	x.LinkProps = r.LinkProps
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 func (r *Link) UnmarshalJSON(data []byte) error {
@@ -331,12 +332,12 @@ func (r *Link) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (l *Link) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (l *Link) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		spec.Extensions
+		Extensions spec.Extensions `json:",inline"`
 		LinkProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	if err := internal.JSONRefFromMap(&l.Ref.Ref, x.Extensions); err != nil {
diff --git a/vendor/k8s.io/kube-openapi/pkg/spec3/security_scheme.go b/vendor/k8s.io/kube-openapi/pkg/spec3/security_scheme.go
index dd1e98ed88..9bc180eaff 100644
--- a/vendor/k8s.io/kube-openapi/pkg/spec3/security_scheme.go
+++ b/vendor/k8s.io/kube-openapi/pkg/spec3/security_scheme.go
@@ -22,6 +22,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 )
 
@@ -52,16 +53,16 @@ func (s *SecurityScheme) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2, b3), nil
 }
 
-func (s *SecurityScheme) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (s *SecurityScheme) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
 		Ref                 string `json:"$ref,omitempty"`
 		SecuritySchemeProps `json:",inline"`
-		spec.Extensions
+		Extensions          spec.Extensions `json:",inline"`
 	}
 	x.Ref = s.Refable.Ref.String()
 	x.Extensions = internal.SanitizeExtensions(s.Extensions)
 	x.SecuritySchemeProps = s.SecuritySchemeProps
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 // UnmarshalJSON hydrates this items instance with the data from JSON
diff --git a/vendor/k8s.io/kube-openapi/pkg/spec3/server.go b/vendor/k8s.io/kube-openapi/pkg/spec3/server.go
index 654a42c06e..3037fbce44 100644
--- a/vendor/k8s.io/kube-openapi/pkg/spec3/server.go
+++ b/vendor/k8s.io/kube-openapi/pkg/spec3/server.go
@@ -22,6 +22,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 )
 
@@ -55,14 +56,14 @@ func (s *Server) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2), nil
 }
 
-func (s *Server) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (s *Server) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
 		ServerProps `json:",inline"`
-		spec.Extensions
+		Extensions  spec.Extensions `json:",inline"`
 	}
 	x.Extensions = internal.SanitizeExtensions(s.Extensions)
 	x.ServerProps = s.ServerProps
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 func (s *Server) UnmarshalJSON(data []byte) error {
@@ -79,12 +80,12 @@ func (s *Server) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (s *Server) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (s *Server) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		spec.Extensions
+		Extensions spec.Extensions `json:",inline"`
 		ServerProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	s.Extensions = internal.SanitizeExtensions(x.Extensions)
@@ -123,14 +124,14 @@ func (s *ServerVariable) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2), nil
 }
 
-func (s *ServerVariable) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (s *ServerVariable) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
 		ServerVariableProps `json:",inline"`
-		spec.Extensions
+		Extensions          spec.Extensions `json:",inline"`
 	}
 	x.Extensions = internal.SanitizeExtensions(s.Extensions)
 	x.ServerVariableProps = s.ServerVariableProps
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 func (s *ServerVariable) UnmarshalJSON(data []byte) error {
@@ -146,12 +147,12 @@ func (s *ServerVariable) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (s *ServerVariable) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (s *ServerVariable) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		spec.Extensions
+		Extensions spec.Extensions `json:",inline"`
 		ServerVariableProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	s.Extensions = internal.SanitizeExtensions(x.Extensions)
diff --git a/vendor/k8s.io/kube-openapi/pkg/spec3/spec.go b/vendor/k8s.io/kube-openapi/pkg/spec3/spec.go
index 5db819c7f0..91b1ae333d 100644
--- a/vendor/k8s.io/kube-openapi/pkg/spec3/spec.go
+++ b/vendor/k8s.io/kube-openapi/pkg/spec3/spec.go
@@ -21,6 +21,7 @@ import (
 
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 )
 
@@ -60,7 +61,7 @@ func (o *OpenAPI) MarshalJSON() ([]byte, error) {
 	return json.Marshal(&p)
 }
 
-func (o *OpenAPI) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (o *OpenAPI) MarshalJSONTo(enc *jsontext.Encoder) error {
 	type OpenAPIOmitZero struct {
 		Version             string                 `json:"openapi"`
 		Info                *spec.Info             `json:"info"`
@@ -71,5 +72,5 @@ func (o *OpenAPI) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encode
 		ExternalDocs        *ExternalDocumentation `json:"externalDocs,omitzero"`
 	}
 	x := (*OpenAPIOmitZero)(o)
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
diff --git a/vendor/k8s.io/kube-openapi/pkg/validation/spec/header.go b/vendor/k8s.io/kube-openapi/pkg/validation/spec/header.go
index 05310c46b3..5aa66ae25f 100644
--- a/vendor/k8s.io/kube-openapi/pkg/validation/spec/header.go
+++ b/vendor/k8s.io/kube-openapi/pkg/validation/spec/header.go
@@ -20,6 +20,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 const (
@@ -65,18 +66,18 @@ func (h Header) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2, b3, b4), nil
 }
 
-func (h Header) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (h Header) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
 		CommonValidations commonValidationsOmitZero `json:",inline"`
 		SimpleSchema      simpleSchemaOmitZero      `json:",inline"`
-		Extensions
+		Extensions        Extensions                `json:",inline"`
 		HeaderProps
 	}
 	x.CommonValidations = commonValidationsOmitZero(h.CommonValidations)
 	x.SimpleSchema = simpleSchemaOmitZero(h.SimpleSchema)
 	x.Extensions = internal.SanitizeExtensions(h.Extensions)
 	x.HeaderProps = h.HeaderProps
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 // UnmarshalJSON unmarshals this header from JSON
@@ -97,15 +98,15 @@ func (h *Header) UnmarshalJSON(data []byte) error {
 	return json.Unmarshal(data, &h.HeaderProps)
 }
 
-func (h *Header) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (h *Header) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
 		CommonValidations
 		SimpleSchema
-		Extensions
+		Extensions Extensions `json:",inline"`
 		HeaderProps
 	}
 
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 
diff --git a/vendor/k8s.io/kube-openapi/pkg/validation/spec/info.go b/vendor/k8s.io/kube-openapi/pkg/validation/spec/info.go
index d667b705be..8d002a1c58 100644
--- a/vendor/k8s.io/kube-openapi/pkg/validation/spec/info.go
+++ b/vendor/k8s.io/kube-openapi/pkg/validation/spec/info.go
@@ -21,6 +21,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 // Extensions vendor specific extensions
@@ -183,14 +184,14 @@ func (i Info) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2), nil
 }
 
-func (i Info) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (i Info) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
-		Extensions
+		Extensions Extensions `json:",inline"`
 		InfoProps
 	}
 	x.Extensions = i.Extensions
 	x.InfoProps = i.InfoProps
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 // UnmarshalJSON marshal this from JSON
@@ -205,12 +206,12 @@ func (i *Info) UnmarshalJSON(data []byte) error {
 	return json.Unmarshal(data, &i.VendorExtensible)
 }
 
-func (i *Info) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (i *Info) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		Extensions
+		Extensions Extensions `json:",inline"`
 		InfoProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	i.Extensions = internal.SanitizeExtensions(x.Extensions)
diff --git a/vendor/k8s.io/kube-openapi/pkg/validation/spec/items.go b/vendor/k8s.io/kube-openapi/pkg/validation/spec/items.go
index 4132467d24..6fbb19a464 100644
--- a/vendor/k8s.io/kube-openapi/pkg/validation/spec/items.go
+++ b/vendor/k8s.io/kube-openapi/pkg/validation/spec/items.go
@@ -20,6 +20,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 const (
@@ -122,13 +123,13 @@ func (i *Items) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (i *Items) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (i *Items) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
 		CommonValidations
 		SimpleSchema
-		Extensions
+		Extensions Extensions `json:",inline"`
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	if err := i.Refable.Ref.fromMap(x.Extensions); err != nil {
@@ -165,16 +166,16 @@ func (i Items) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b4, b3, b1, b2), nil
 }
 
-func (i Items) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (i Items) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
 		CommonValidations commonValidationsOmitZero `json:",inline"`
 		SimpleSchema      simpleSchemaOmitZero      `json:",inline"`
 		Ref               string                    `json:"$ref,omitempty"`
-		Extensions
+		Extensions        Extensions                `json:",inline"`
 	}
 	x.CommonValidations = commonValidationsOmitZero(i.CommonValidations)
 	x.SimpleSchema = simpleSchemaOmitZero(i.SimpleSchema)
 	x.Ref = i.Refable.Ref.String()
 	x.Extensions = internal.SanitizeExtensions(i.Extensions)
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
diff --git a/vendor/k8s.io/kube-openapi/pkg/validation/spec/operation.go b/vendor/k8s.io/kube-openapi/pkg/validation/spec/operation.go
index 63eed34601..99b620f944 100644
--- a/vendor/k8s.io/kube-openapi/pkg/validation/spec/operation.go
+++ b/vendor/k8s.io/kube-openapi/pkg/validation/spec/operation.go
@@ -20,6 +20,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 // OperationProps describes an operation
@@ -104,13 +105,13 @@ func (o *Operation) UnmarshalJSON(data []byte) error {
 	return json.Unmarshal(data, &o.VendorExtensible)
 }
 
-func (o *Operation) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (o *Operation) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	type OperationPropsNoMethods OperationProps // strip MarshalJSON method
 	var x struct {
-		Extensions
+		Extensions Extensions `json:",inline"`
 		OperationPropsNoMethods
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	o.Extensions = internal.SanitizeExtensions(x.Extensions)
@@ -135,12 +136,12 @@ func (o Operation) MarshalJSON() ([]byte, error) {
 	return concated, nil
 }
 
-func (o Operation) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (o Operation) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
-		Extensions
+		Extensions     Extensions             `json:",inline"`
 		OperationProps operationPropsOmitZero `json:",inline"`
 	}
 	x.Extensions = internal.SanitizeExtensions(o.Extensions)
 	x.OperationProps = operationPropsOmitZero(o.OperationProps)
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
diff --git a/vendor/k8s.io/kube-openapi/pkg/validation/spec/parameter.go b/vendor/k8s.io/kube-openapi/pkg/validation/spec/parameter.go
index 53d1e0aa94..f2e61a7211 100644
--- a/vendor/k8s.io/kube-openapi/pkg/validation/spec/parameter.go
+++ b/vendor/k8s.io/kube-openapi/pkg/validation/spec/parameter.go
@@ -20,6 +20,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 // ParamProps describes the specific attributes of an operation parameter
@@ -107,14 +108,14 @@ func (p *Parameter) UnmarshalJSON(data []byte) error {
 	return json.Unmarshal(data, &p.ParamProps)
 }
 
-func (p *Parameter) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (p *Parameter) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
 		CommonValidations
 		SimpleSchema
-		Extensions
+		Extensions Extensions `json:",inline"`
 		ParamProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	if err := p.Refable.Ref.fromMap(x.Extensions); err != nil {
@@ -155,18 +156,18 @@ func (p Parameter) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b3, b1, b2, b4, b5), nil
 }
 
-func (p Parameter) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (p Parameter) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
 		CommonValidations commonValidationsOmitZero `json:",inline"`
 		SimpleSchema      simpleSchemaOmitZero      `json:",inline"`
 		ParamProps        paramPropsOmitZero        `json:",inline"`
 		Ref               string                    `json:"$ref,omitempty"`
-		Extensions
+		Extensions        Extensions                `json:",inline"`
 	}
 	x.CommonValidations = commonValidationsOmitZero(p.CommonValidations)
 	x.SimpleSchema = simpleSchemaOmitZero(p.SimpleSchema)
 	x.Extensions = internal.SanitizeExtensions(p.Extensions)
 	x.ParamProps = paramPropsOmitZero(p.ParamProps)
 	x.Ref = p.Refable.Ref.String()
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
diff --git a/vendor/k8s.io/kube-openapi/pkg/validation/spec/path_item.go b/vendor/k8s.io/kube-openapi/pkg/validation/spec/path_item.go
index 1d1588cb92..f2a0d9542e 100644
--- a/vendor/k8s.io/kube-openapi/pkg/validation/spec/path_item.go
+++ b/vendor/k8s.io/kube-openapi/pkg/validation/spec/path_item.go
@@ -20,6 +20,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 // PathItemProps the path item specific properties
@@ -61,13 +62,13 @@ func (p *PathItem) UnmarshalJSON(data []byte) error {
 	return json.Unmarshal(data, &p.PathItemProps)
 }
 
-func (p *PathItem) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (p *PathItem) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		Extensions
+		Extensions Extensions `json:",inline"`
 		PathItemProps
 	}
 
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	if err := p.Refable.Ref.fromMap(x.Extensions); err != nil {
@@ -100,14 +101,14 @@ func (p PathItem) MarshalJSON() ([]byte, error) {
 	return concated, nil
 }
 
-func (p PathItem) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (p PathItem) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
-		Ref string `json:"$ref,omitempty"`
-		Extensions
+		Ref        string     `json:"$ref,omitempty"`
+		Extensions Extensions `json:",inline"`
 		PathItemProps
 	}
 	x.Ref = p.Refable.Ref.String()
 	x.Extensions = internal.SanitizeExtensions(p.Extensions)
 	x.PathItemProps = p.PathItemProps
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
diff --git a/vendor/k8s.io/kube-openapi/pkg/validation/spec/paths.go b/vendor/k8s.io/kube-openapi/pkg/validation/spec/paths.go
index 18f6a9f429..23b72cccea 100644
--- a/vendor/k8s.io/kube-openapi/pkg/validation/spec/paths.go
+++ b/vendor/k8s.io/kube-openapi/pkg/validation/spec/paths.go
@@ -22,6 +22,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 // Paths holds the relative paths to the individual endpoints.
@@ -70,7 +71,7 @@ func (p *Paths) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (p *Paths) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (p *Paths) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	tok, err := dec.ReadToken()
 	if err != nil {
 		return err
@@ -94,7 +95,7 @@ func (p *Paths) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Deco
 			switch k := tok.String(); {
 			case internal.IsExtensionKey(k):
 				ext = nil
-				if err := opts.UnmarshalNext(dec, &ext); err != nil {
+				if err := jsonv2.UnmarshalDecode(dec, &ext); err != nil {
 					return err
 				}
 
@@ -104,7 +105,7 @@ func (p *Paths) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Deco
 				p.Extensions[k] = ext
 			case len(k) > 0 && k[0] == '/':
 				pi = PathItem{}
-				if err := opts.UnmarshalNext(dec, &pi); err != nil {
+				if err := jsonv2.UnmarshalDecode(dec, &pi); err != nil {
 					return err
 				}
 
@@ -148,7 +149,7 @@ func (p Paths) MarshalJSON() ([]byte, error) {
 	return concated, nil
 }
 
-func (p Paths) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (p Paths) MarshalJSONTo(enc *jsontext.Encoder) error {
 	m := make(map[string]any, len(p.Extensions)+len(p.Paths))
 	for k, v := range p.Extensions {
 		if internal.IsExtensionKey(k) {
@@ -160,5 +161,5 @@ func (p Paths) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder)
 			m[k] = v
 		}
 	}
-	return opts.MarshalNext(enc, m)
+	return jsonv2.MarshalEncode(enc, m)
 }
diff --git a/vendor/k8s.io/kube-openapi/pkg/validation/spec/response.go b/vendor/k8s.io/kube-openapi/pkg/validation/spec/response.go
index 3ff1fe1322..585a93accf 100644
--- a/vendor/k8s.io/kube-openapi/pkg/validation/spec/response.go
+++ b/vendor/k8s.io/kube-openapi/pkg/validation/spec/response.go
@@ -20,6 +20,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 // ResponseProps properties specific to a response
@@ -67,13 +68,13 @@ func (r *Response) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (r *Response) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (r *Response) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
 		ResponseProps
-		Extensions
+		Extensions Extensions `json:",inline"`
 	}
 
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 
@@ -106,16 +107,16 @@ func (r Response) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2, b3), nil
 }
 
-func (r Response) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (r Response) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
-		Ref string `json:"$ref,omitempty"`
-		Extensions
+		Ref           string                `json:"$ref,omitempty"`
+		Extensions    Extensions            `json:",inline"`
 		ResponseProps responsePropsOmitZero `json:",inline"`
 	}
 	x.Ref = r.Refable.Ref.String()
 	x.Extensions = internal.SanitizeExtensions(r.Extensions)
 	x.ResponseProps = responsePropsOmitZero(r.ResponseProps)
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 // NewResponse creates a new response instance
diff --git a/vendor/k8s.io/kube-openapi/pkg/validation/spec/responses.go b/vendor/k8s.io/kube-openapi/pkg/validation/spec/responses.go
index d9ad760a43..a1a3d0fd57 100644
--- a/vendor/k8s.io/kube-openapi/pkg/validation/spec/responses.go
+++ b/vendor/k8s.io/kube-openapi/pkg/validation/spec/responses.go
@@ -23,6 +23,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 // Responses is a container for the expected responses of an operation.
@@ -78,11 +79,11 @@ func (r Responses) MarshalJSON() ([]byte, error) {
 	return concated, nil
 }
 
-func (r Responses) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (r Responses) MarshalJSONTo(enc *jsontext.Encoder) error {
 	type ArbitraryKeys map[string]interface{}
 	var x struct {
-		ArbitraryKeys
-		Default *Response `json:"default,omitempty"`
+		ArbitraryKeys ArbitraryKeys `json:",inline"`
+		Default       *Response     `json:"default,omitempty"`
 	}
 	x.ArbitraryKeys = make(map[string]any, len(r.Extensions)+len(r.StatusCodeResponses))
 	for k, v := range r.Extensions {
@@ -94,7 +95,7 @@ func (r Responses) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encod
 		x.ArbitraryKeys[strconv.Itoa(k)] = v
 	}
 	x.Default = r.Default
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 // ResponsesProps describes all responses for an operation.
@@ -150,7 +151,7 @@ func (r *ResponsesProps) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (r *Responses) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) (err error) {
+func (r *Responses) UnmarshalJSONFrom(dec *jsontext.Decoder) (err error) {
 	tok, err := dec.ReadToken()
 	if err != nil {
 		return err
@@ -172,7 +173,7 @@ func (r *Responses) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.
 			switch k := tok.String(); {
 			case internal.IsExtensionKey(k):
 				ext = nil
-				if err := opts.UnmarshalNext(dec, &ext); err != nil {
+				if err := jsonv2.UnmarshalDecode(dec, &ext); err != nil {
 					return err
 				}
 
@@ -182,7 +183,7 @@ func (r *Responses) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.
 				r.Extensions[k] = ext
 			case k == "default":
 				resp = Response{}
-				if err := opts.UnmarshalNext(dec, &resp); err != nil {
+				if err := jsonv2.UnmarshalDecode(dec, &resp); err != nil {
 					return err
 				}
 
@@ -191,7 +192,7 @@ func (r *Responses) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.
 			default:
 				if nk, err := strconv.Atoi(k); err == nil {
 					resp = Response{}
-					if err := opts.UnmarshalNext(dec, &resp); err != nil {
+					if err := jsonv2.UnmarshalDecode(dec, &resp); err != nil {
 						return err
 					}
 
diff --git a/vendor/k8s.io/kube-openapi/pkg/validation/spec/schema.go b/vendor/k8s.io/kube-openapi/pkg/validation/spec/schema.go
index dfbb2e05cb..6c0c6fc14c 100644
--- a/vendor/k8s.io/kube-openapi/pkg/validation/spec/schema.go
+++ b/vendor/k8s.io/kube-openapi/pkg/validation/spec/schema.go
@@ -23,6 +23,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 // BooleanProperty creates a boolean property
@@ -517,10 +518,10 @@ func (s Schema) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2, b3, b4, b5, b6), nil
 }
 
-func (s Schema) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (s Schema) MarshalJSONTo(enc *jsontext.Encoder) error {
 	type ArbitraryKeys map[string]interface{}
 	var x struct {
-		ArbitraryKeys
+		ArbitraryKeys      ArbitraryKeys              `json:",inline"`
 		SchemaProps        schemaPropsOmitZero        `json:",inline"`
 		SwaggerSchemaProps swaggerSchemaPropsOmitZero `json:",inline"`
 		Schema             string                     `json:"$schema,omitempty"`
@@ -539,7 +540,7 @@ func (s Schema) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder)
 	x.SwaggerSchemaProps = swaggerSchemaPropsOmitZero(s.SwaggerSchemaProps)
 	x.Ref = s.Ref.String()
 	x.Schema = string(s.Schema)
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 // UnmarshalJSON marshal this from JSON
@@ -595,13 +596,13 @@ func (s *Schema) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (s *Schema) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (s *Schema) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		Extensions
+		Extensions Extensions `json:",inline"`
 		SchemaProps
 		SwaggerSchemaProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 
diff --git a/vendor/k8s.io/kube-openapi/pkg/validation/spec/security_scheme.go b/vendor/k8s.io/kube-openapi/pkg/validation/spec/security_scheme.go
index e2b7da14cf..7c7b6bdd8f 100644
--- a/vendor/k8s.io/kube-openapi/pkg/validation/spec/security_scheme.go
+++ b/vendor/k8s.io/kube-openapi/pkg/validation/spec/security_scheme.go
@@ -20,6 +20,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 // SecuritySchemeProps describes a swagger security scheme in the securityDefinitions section
@@ -60,14 +61,14 @@ func (s SecurityScheme) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2), nil
 }
 
-func (s SecurityScheme) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (s SecurityScheme) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
-		Extensions
+		Extensions Extensions `json:",inline"`
 		SecuritySchemeProps
 	}
 	x.Extensions = internal.SanitizeExtensions(s.Extensions)
 	x.SecuritySchemeProps = s.SecuritySchemeProps
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 // UnmarshalJSON marshal this from JSON
@@ -78,12 +79,12 @@ func (s *SecurityScheme) UnmarshalJSON(data []byte) error {
 	return json.Unmarshal(data, &s.VendorExtensible)
 }
 
-func (s *SecurityScheme) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (s *SecurityScheme) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		Extensions
+		Extensions Extensions `json:",inline"`
 		SecuritySchemeProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	s.Extensions = internal.SanitizeExtensions(x.Extensions)
diff --git a/vendor/k8s.io/kube-openapi/pkg/validation/spec/swagger.go b/vendor/k8s.io/kube-openapi/pkg/validation/spec/swagger.go
index c8f3beaa35..533b7cc83e 100644
--- a/vendor/k8s.io/kube-openapi/pkg/validation/spec/swagger.go
+++ b/vendor/k8s.io/kube-openapi/pkg/validation/spec/swagger.go
@@ -21,6 +21,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 // Swagger this is the root document object for the API specification.
@@ -50,14 +51,14 @@ func (s Swagger) MarshalJSON() ([]byte, error) {
 }
 
 // MarshalJSON marshals this swagger structure to json
-func (s Swagger) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (s Swagger) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
-		Extensions
+		Extensions Extensions `json:",inline"`
 		SwaggerProps
 	}
 	x.Extensions = internal.SanitizeExtensions(s.Extensions)
 	x.SwaggerProps = s.SwaggerProps
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 // UnmarshalJSON unmarshals a swagger spec from json
@@ -76,16 +77,16 @@ func (s *Swagger) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (s *Swagger) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (s *Swagger) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	// Note: If you're willing to make breaking changes, it is possible to
 	// optimize this and other usages of this pattern:
 	// https://github.com/kubernetes/kube-openapi/pull/319#discussion_r983165948
 	var x struct {
-		Extensions
+		Extensions Extensions `json:",inline"`
 		SwaggerProps
 	}
 
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	s.Extensions = internal.SanitizeExtensions(x.Extensions)
@@ -146,15 +147,15 @@ func (s SchemaOrBool) MarshalJSON() ([]byte, error) {
 }
 
 // MarshalJSON convert this object to JSON
-func (s SchemaOrBool) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (s SchemaOrBool) MarshalJSONTo(enc *jsontext.Encoder) error {
 	if s.Schema != nil {
-		return opts.MarshalNext(enc, s.Schema)
+		return jsonv2.MarshalEncode(enc, s.Schema)
 	}
 
 	if s.Schema == nil && !s.Allows {
-		return enc.WriteToken(jsonv2.False)
+		return enc.WriteToken(jsontext.False)
 	}
-	return enc.WriteToken(jsonv2.True)
+	return enc.WriteToken(jsontext.True)
 }
 
 // UnmarshalJSON converts this bool or schema object from a JSON structure
@@ -178,17 +179,17 @@ func (s *SchemaOrBool) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (s *SchemaOrBool) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (s *SchemaOrBool) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	switch k := dec.PeekKind(); k {
 	case '{':
-		err := opts.UnmarshalNext(dec, &s.Schema)
+		err := jsonv2.UnmarshalDecode(dec, &s.Schema)
 		if err != nil {
 			return err
 		}
 		s.Allows = true
 		return nil
 	case 't', 'f':
-		err := opts.UnmarshalNext(dec, &s.Allows)
+		err := jsonv2.UnmarshalDecode(dec, &s.Allows)
 		if err != nil {
 			return err
 		}
@@ -219,14 +220,14 @@ func (s SchemaOrStringArray) MarshalJSON() ([]byte, error) {
 }
 
 // MarshalJSON converts this schema object or array into JSON structure
-func (s SchemaOrStringArray) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (s SchemaOrStringArray) MarshalJSONTo(enc *jsontext.Encoder) error {
 	if len(s.Property) > 0 {
-		return opts.MarshalNext(enc, s.Property)
+		return jsonv2.MarshalEncode(enc, s.Property)
 	}
 	if s.Schema != nil {
-		return opts.MarshalNext(enc, s.Schema)
+		return jsonv2.MarshalEncode(enc, s.Schema)
 	}
-	return enc.WriteToken(jsonv2.Null)
+	return enc.WriteToken(jsontext.Null)
 }
 
 // UnmarshalJSON converts this schema object or array from a JSON structure
@@ -256,12 +257,12 @@ func (s *SchemaOrStringArray) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (s *SchemaOrStringArray) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (s *SchemaOrStringArray) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	switch dec.PeekKind() {
 	case '{':
-		return opts.UnmarshalNext(dec, &s.Schema)
+		return jsonv2.UnmarshalDecode(dec, &s.Schema)
 	case '[':
-		return opts.UnmarshalNext(dec, &s.Property)
+		return jsonv2.UnmarshalDecode(dec, &s.Property)
 	default:
 		_, err := dec.ReadValue()
 		return err
@@ -332,14 +333,14 @@ func (s *StringOrArray) UnmarshalJSON(data []byte) error {
 	}
 }
 
-func (s *StringOrArray) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (s *StringOrArray) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	switch k := dec.PeekKind(); k {
 	case '[':
 		*s = StringOrArray{}
-		return opts.UnmarshalNext(dec, (*[]string)(s))
+		return jsonv2.UnmarshalDecode(dec, (*[]string)(s))
 	case '"':
 		*s = StringOrArray{""}
-		return opts.UnmarshalNext(dec, &(*s)[0])
+		return jsonv2.UnmarshalDecode(dec, &(*s)[0])
 	case 'n':
 		// Throw out null token
 		_, _ = dec.ReadToken()
@@ -392,11 +393,11 @@ func (s SchemaOrArray) MarshalJSON() ([]byte, error) {
 }
 
 // MarshalJSON converts this schema object or array into JSON structure
-func (s SchemaOrArray) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (s SchemaOrArray) MarshalJSONTo(enc *jsontext.Encoder) error {
 	if s.Schemas != nil {
-		return opts.MarshalNext(enc, s.Schemas)
+		return jsonv2.MarshalEncode(enc, s.Schemas)
 	}
-	return opts.MarshalNext(enc, s.Schema)
+	return jsonv2.MarshalEncode(enc, s.Schema)
 }
 
 // UnmarshalJSON converts this schema object or array from a JSON structure
@@ -426,12 +427,12 @@ func (s *SchemaOrArray) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func (s *SchemaOrArray) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (s *SchemaOrArray) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	switch dec.PeekKind() {
 	case '{':
-		return opts.UnmarshalNext(dec, &s.Schema)
+		return jsonv2.UnmarshalDecode(dec, &s.Schema)
 	case '[':
-		return opts.UnmarshalNext(dec, &s.Schemas)
+		return jsonv2.UnmarshalDecode(dec, &s.Schemas)
 	default:
 		_, err := dec.ReadValue()
 		return err
diff --git a/vendor/k8s.io/kube-openapi/pkg/validation/spec/tag.go b/vendor/k8s.io/kube-openapi/pkg/validation/spec/tag.go
index d105d52ca4..89c3d0d820 100644
--- a/vendor/k8s.io/kube-openapi/pkg/validation/spec/tag.go
+++ b/vendor/k8s.io/kube-openapi/pkg/validation/spec/tag.go
@@ -20,6 +20,7 @@ import (
 	"github.com/go-openapi/swag"
 	"k8s.io/kube-openapi/pkg/internal"
 	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+	"k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext"
 )
 
 // TagProps describe a tag entry in the top level tags section of a swagger spec
@@ -55,14 +56,14 @@ func (t Tag) MarshalJSON() ([]byte, error) {
 	return swag.ConcatJSON(b1, b2), nil
 }
 
-func (t Tag) MarshalNextJSON(opts jsonv2.MarshalOptions, enc *jsonv2.Encoder) error {
+func (t Tag) MarshalJSONTo(enc *jsontext.Encoder) error {
 	var x struct {
-		Extensions
+		Extensions Extensions `json:",inline"`
 		TagProps
 	}
 	x.Extensions = internal.SanitizeExtensions(t.Extensions)
 	x.TagProps = t.TagProps
-	return opts.MarshalNext(enc, x)
+	return jsonv2.MarshalEncode(enc, x)
 }
 
 // UnmarshalJSON marshal this from JSON
@@ -77,12 +78,12 @@ func (t *Tag) UnmarshalJSON(data []byte) error {
 	return json.Unmarshal(data, &t.VendorExtensible)
 }
 
-func (t *Tag) UnmarshalNextJSON(opts jsonv2.UnmarshalOptions, dec *jsonv2.Decoder) error {
+func (t *Tag) UnmarshalJSONFrom(dec *jsontext.Decoder) error {
 	var x struct {
-		Extensions
+		Extensions Extensions `json:",inline"`
 		TagProps
 	}
-	if err := opts.UnmarshalNext(dec, &x); err != nil {
+	if err := jsonv2.UnmarshalDecode(dec, &x); err != nil {
 		return err
 	}
 	t.Extensions = internal.SanitizeExtensions(x.Extensions)
diff --git a/vendor/k8s.io/utils/ptr/OWNERS b/vendor/k8s.io/utils/ptr/OWNERS
index 0d6392752a..55da8262a0 100644
--- a/vendor/k8s.io/utils/ptr/OWNERS
+++ b/vendor/k8s.io/utils/ptr/OWNERS
@@ -2,9 +2,11 @@
 
 approvers:
 - apelisse
+- skitt
 - stewart-yu
 - thockin
 reviewers:
 - apelisse
+- skitt
 - stewart-yu
 - thockin
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 960e71e186..9f8df2d57e 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -417,7 +417,7 @@ github.com/felixge/httpsnoop
 ## explicit; go 1.17
 github.com/fsnotify/fsnotify
 github.com/fsnotify/fsnotify/internal
-# github.com/fxamacker/cbor/v2 v2.9.0
+# github.com/fxamacker/cbor/v2 v2.9.1
 ## explicit; go 1.20
 github.com/fxamacker/cbor/v2
 # github.com/go-jose/go-jose/v4 v4.1.4
@@ -436,51 +436,52 @@ github.com/go-logr/stdr
 ## explicit; go 1.12
 github.com/go-ole/go-ole
 github.com/go-ole/go-ole/oleutil
-# github.com/go-openapi/jsonpointer v0.22.4
-## explicit; go 1.24.0
+# github.com/go-openapi/jsonpointer v1.0.0
+## explicit; go 1.25.0
 github.com/go-openapi/jsonpointer
-# github.com/go-openapi/jsonreference v0.21.4
-## explicit; go 1.24.0
+github.com/go-openapi/jsonpointer/jsonname
+# github.com/go-openapi/jsonreference v1.0.0
+## explicit; go 1.25.0
 github.com/go-openapi/jsonreference
 github.com/go-openapi/jsonreference/internal
-# github.com/go-openapi/swag v0.25.4
-## explicit; go 1.24.0
+# github.com/go-openapi/swag v0.27.1
+## explicit; go 1.25.0
 github.com/go-openapi/swag
-# github.com/go-openapi/swag/cmdutils v0.25.4
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/cmdutils v0.27.1
+## explicit; go 1.25.0
 github.com/go-openapi/swag/cmdutils
-# github.com/go-openapi/swag/conv v0.25.4
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/conv v0.27.1
+## explicit; go 1.25.0
 github.com/go-openapi/swag/conv
-# github.com/go-openapi/swag/fileutils v0.25.4
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/fileutils v0.27.1
+## explicit; go 1.25.0
 github.com/go-openapi/swag/fileutils
-# github.com/go-openapi/swag/jsonname v0.25.4
-## explicit; go 1.24.0
-github.com/go-openapi/swag/jsonname
-# github.com/go-openapi/swag/jsonutils v0.25.4
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/jsonutils v0.27.1
+## explicit; go 1.25.0
 github.com/go-openapi/swag/jsonutils
 github.com/go-openapi/swag/jsonutils/adapters
 github.com/go-openapi/swag/jsonutils/adapters/ifaces
 github.com/go-openapi/swag/jsonutils/adapters/stdlib/json
-# github.com/go-openapi/swag/loading v0.25.4
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/loading v0.27.1
+## explicit; go 1.25.0
 github.com/go-openapi/swag/loading
-# github.com/go-openapi/swag/mangling v0.25.4
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/mangling v0.27.1
+## explicit; go 1.25.0
 github.com/go-openapi/swag/mangling
-# github.com/go-openapi/swag/netutils v0.25.4
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/netutils v0.27.1
+## explicit; go 1.25.0
 github.com/go-openapi/swag/netutils
-# github.com/go-openapi/swag/stringutils v0.25.4
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/pools v0.27.1
+## explicit; go 1.25.0
+github.com/go-openapi/swag/pools
+# github.com/go-openapi/swag/stringutils v0.27.1
+## explicit; go 1.25.0
 github.com/go-openapi/swag/stringutils
-# github.com/go-openapi/swag/typeutils v0.25.4
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/typeutils v0.27.1
+## explicit; go 1.25.0
 github.com/go-openapi/swag/typeutils
-# github.com/go-openapi/swag/yamlutils v0.25.4
-## explicit; go 1.24.0
+# github.com/go-openapi/swag/yamlutils v0.27.1
+## explicit; go 1.25.0
 github.com/go-openapi/swag/yamlutils
 # github.com/google/gnostic-models v0.7.0
 ## explicit; go 1.22
@@ -1368,7 +1369,7 @@ gopkg.in/inf.v0
 # gopkg.in/yaml.v3 v3.0.1
 ## explicit
 gopkg.in/yaml.v3
-# k8s.io/api v0.36.1
+# k8s.io/api v0.37.0-rc.0
 ## explicit; go 1.26.0
 k8s.io/api/admission/v1
 k8s.io/api/admission/v1beta1
@@ -1376,7 +1377,6 @@ k8s.io/api/admissionregistration/v1
 k8s.io/api/admissionregistration/v1alpha1
 k8s.io/api/admissionregistration/v1beta1
 k8s.io/api/apidiscovery/v2
-k8s.io/api/apidiscovery/v2beta1
 k8s.io/api/apiserverinternal/v1alpha1
 k8s.io/api/apps/v1
 k8s.io/api/apps/v1beta1
@@ -1407,6 +1407,7 @@ k8s.io/api/flowcontrol/v1beta1
 k8s.io/api/flowcontrol/v1beta2
 k8s.io/api/flowcontrol/v1beta3
 k8s.io/api/imagepolicy/v1alpha1
+k8s.io/api/lifecycle/v1alpha1
 k8s.io/api/networking/v1
 k8s.io/api/networking/v1beta1
 k8s.io/api/node/v1
@@ -1422,11 +1423,12 @@ k8s.io/api/resource/v1alpha3
 k8s.io/api/resource/v1beta1
 k8s.io/api/resource/v1beta2
 k8s.io/api/scheduling/v1
-k8s.io/api/scheduling/v1alpha2
+k8s.io/api/scheduling/v1alpha3
 k8s.io/api/scheduling/v1beta1
 k8s.io/api/storage/v1
 k8s.io/api/storage/v1alpha1
 k8s.io/api/storage/v1beta1
+k8s.io/api/storagemigration/v1
 k8s.io/api/storagemigration/v1beta1
 # k8s.io/apiextensions-apiserver v0.36.1
 ## explicit; go 1.26.0
@@ -1439,7 +1441,7 @@ k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset
 k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/scheme
 k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1
 k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1beta1
-# k8s.io/apimachinery v0.36.1
+# k8s.io/apimachinery v0.37.0-rc.0 => ./third_party/k8s.io/apimachinery
 ## explicit; go 1.26.0
 k8s.io/apimachinery/pkg/api/equality
 k8s.io/apimachinery/pkg/api/errors
@@ -1505,7 +1507,7 @@ k8s.io/apimachinery/pkg/version
 k8s.io/apimachinery/pkg/watch
 k8s.io/apimachinery/third_party/forked/golang/json
 k8s.io/apimachinery/third_party/forked/golang/reflect
-# k8s.io/client-go v0.36.1
+# k8s.io/client-go v0.37.0-rc.0
 ## explicit; go 1.26.0
 k8s.io/client-go/applyconfigurations
 k8s.io/client-go/applyconfigurations/admissionregistration/v1
@@ -1537,6 +1539,7 @@ k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2
 k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3
 k8s.io/client-go/applyconfigurations/imagepolicy/v1alpha1
 k8s.io/client-go/applyconfigurations/internal
+k8s.io/client-go/applyconfigurations/lifecycle/v1alpha1
 k8s.io/client-go/applyconfigurations/meta/v1
 k8s.io/client-go/applyconfigurations/networking/v1
 k8s.io/client-go/applyconfigurations/networking/v1beta1
@@ -1553,11 +1556,12 @@ k8s.io/client-go/applyconfigurations/resource/v1alpha3
 k8s.io/client-go/applyconfigurations/resource/v1beta1
 k8s.io/client-go/applyconfigurations/resource/v1beta2
 k8s.io/client-go/applyconfigurations/scheduling/v1
-k8s.io/client-go/applyconfigurations/scheduling/v1alpha2
+k8s.io/client-go/applyconfigurations/scheduling/v1alpha3
 k8s.io/client-go/applyconfigurations/scheduling/v1beta1
 k8s.io/client-go/applyconfigurations/storage/v1
 k8s.io/client-go/applyconfigurations/storage/v1alpha1
 k8s.io/client-go/applyconfigurations/storage/v1beta1
+k8s.io/client-go/applyconfigurations/storagemigration/v1
 k8s.io/client-go/applyconfigurations/storagemigration/v1beta1
 k8s.io/client-go/discovery
 k8s.io/client-go/discovery/fake
@@ -1605,6 +1609,8 @@ k8s.io/client-go/informers/flowcontrol/v1beta1
 k8s.io/client-go/informers/flowcontrol/v1beta2
 k8s.io/client-go/informers/flowcontrol/v1beta3
 k8s.io/client-go/informers/internalinterfaces
+k8s.io/client-go/informers/lifecycle
+k8s.io/client-go/informers/lifecycle/v1alpha1
 k8s.io/client-go/informers/networking
 k8s.io/client-go/informers/networking/v1
 k8s.io/client-go/informers/networking/v1beta1
@@ -1626,13 +1632,14 @@ k8s.io/client-go/informers/resource/v1beta1
 k8s.io/client-go/informers/resource/v1beta2
 k8s.io/client-go/informers/scheduling
 k8s.io/client-go/informers/scheduling/v1
-k8s.io/client-go/informers/scheduling/v1alpha2
+k8s.io/client-go/informers/scheduling/v1alpha3
 k8s.io/client-go/informers/scheduling/v1beta1
 k8s.io/client-go/informers/storage
 k8s.io/client-go/informers/storage/v1
 k8s.io/client-go/informers/storage/v1alpha1
 k8s.io/client-go/informers/storage/v1beta1
 k8s.io/client-go/informers/storagemigration
+k8s.io/client-go/informers/storagemigration/v1
 k8s.io/client-go/informers/storagemigration/v1beta1
 k8s.io/client-go/kubernetes
 k8s.io/client-go/kubernetes/fake
@@ -1701,6 +1708,8 @@ k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2
 k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2/fake
 k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3
 k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3/fake
+k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1
+k8s.io/client-go/kubernetes/typed/lifecycle/v1alpha1/fake
 k8s.io/client-go/kubernetes/typed/networking/v1
 k8s.io/client-go/kubernetes/typed/networking/v1/fake
 k8s.io/client-go/kubernetes/typed/networking/v1beta1
@@ -1731,8 +1740,8 @@ k8s.io/client-go/kubernetes/typed/resource/v1beta2
 k8s.io/client-go/kubernetes/typed/resource/v1beta2/fake
 k8s.io/client-go/kubernetes/typed/scheduling/v1
 k8s.io/client-go/kubernetes/typed/scheduling/v1/fake
-k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2
-k8s.io/client-go/kubernetes/typed/scheduling/v1alpha2/fake
+k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3
+k8s.io/client-go/kubernetes/typed/scheduling/v1alpha3/fake
 k8s.io/client-go/kubernetes/typed/scheduling/v1beta1
 k8s.io/client-go/kubernetes/typed/scheduling/v1beta1/fake
 k8s.io/client-go/kubernetes/typed/storage/v1
@@ -1741,6 +1750,8 @@ k8s.io/client-go/kubernetes/typed/storage/v1alpha1
 k8s.io/client-go/kubernetes/typed/storage/v1alpha1/fake
 k8s.io/client-go/kubernetes/typed/storage/v1beta1
 k8s.io/client-go/kubernetes/typed/storage/v1beta1/fake
+k8s.io/client-go/kubernetes/typed/storagemigration/v1
+k8s.io/client-go/kubernetes/typed/storagemigration/v1/fake
 k8s.io/client-go/kubernetes/typed/storagemigration/v1beta1
 k8s.io/client-go/kubernetes/typed/storagemigration/v1beta1/fake
 k8s.io/client-go/listers
@@ -1771,6 +1782,7 @@ k8s.io/client-go/listers/flowcontrol/v1
 k8s.io/client-go/listers/flowcontrol/v1beta1
 k8s.io/client-go/listers/flowcontrol/v1beta2
 k8s.io/client-go/listers/flowcontrol/v1beta3
+k8s.io/client-go/listers/lifecycle/v1alpha1
 k8s.io/client-go/listers/networking/v1
 k8s.io/client-go/listers/networking/v1beta1
 k8s.io/client-go/listers/node/v1
@@ -1786,11 +1798,12 @@ k8s.io/client-go/listers/resource/v1alpha3
 k8s.io/client-go/listers/resource/v1beta1
 k8s.io/client-go/listers/resource/v1beta2
 k8s.io/client-go/listers/scheduling/v1
-k8s.io/client-go/listers/scheduling/v1alpha2
+k8s.io/client-go/listers/scheduling/v1alpha3
 k8s.io/client-go/listers/scheduling/v1beta1
 k8s.io/client-go/listers/storage/v1
 k8s.io/client-go/listers/storage/v1alpha1
 k8s.io/client-go/listers/storage/v1beta1
+k8s.io/client-go/listers/storagemigration/v1
 k8s.io/client-go/listers/storagemigration/v1beta1
 k8s.io/client-go/metadata
 k8s.io/client-go/openapi
@@ -1850,13 +1863,18 @@ k8s.io/klog/v2/internal/severity
 k8s.io/klog/v2/internal/sloghandler
 k8s.io/klog/v2/internal/verbosity
 k8s.io/klog/v2/textlogger
-# k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a
-## explicit; go 1.23.0
+# k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad
+## explicit; go 1.25.0
 k8s.io/kube-openapi/pkg/cached
 k8s.io/kube-openapi/pkg/common
 k8s.io/kube-openapi/pkg/handler3
 k8s.io/kube-openapi/pkg/internal
 k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json
+k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal
+k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags
+k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts
+k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire
+k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext
 k8s.io/kube-openapi/pkg/schemaconv
 k8s.io/kube-openapi/pkg/spec3
 k8s.io/kube-openapi/pkg/util
@@ -1871,13 +1889,13 @@ k8s.io/metrics/pkg/client/clientset/versioned
 k8s.io/metrics/pkg/client/clientset/versioned/scheme
 k8s.io/metrics/pkg/client/clientset/versioned/typed/metrics/v1alpha1
 k8s.io/metrics/pkg/client/clientset/versioned/typed/metrics/v1beta1
-# k8s.io/streaming v0.36.1
+# k8s.io/streaming v0.37.0-rc.0
 ## explicit; go 1.26.0
 k8s.io/streaming/pkg/httpstream
 k8s.io/streaming/pkg/httpstream/spdy
 k8s.io/streaming/pkg/httpstream/wsstream
 k8s.io/streaming/pkg/runtime
-# k8s.io/utils v0.0.0-20260319190234-28399d86e0b5
+# k8s.io/utils v0.0.0-20260626114624-be93311217bd
 ## explicit; go 1.23
 k8s.io/utils/buffer
 k8s.io/utils/clock
@@ -1952,7 +1970,7 @@ sigs.k8s.io/json/internal/golang/encoding/json
 ## explicit; go 1.18
 sigs.k8s.io/randfill
 sigs.k8s.io/randfill/bytesource
-# sigs.k8s.io/structured-merge-diff/v6 v6.3.2
+# sigs.k8s.io/structured-merge-diff/v6 v6.4.2
 ## explicit; go 1.23
 sigs.k8s.io/structured-merge-diff/v6/fieldpath
 sigs.k8s.io/structured-merge-diff/v6/merge
@@ -1962,3 +1980,4 @@ sigs.k8s.io/structured-merge-diff/v6/value
 # sigs.k8s.io/yaml v1.6.0
 ## explicit; go 1.22
 sigs.k8s.io/yaml
+# k8s.io/apimachinery => ./third_party/k8s.io/apimachinery
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/element.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/element.go
index 73436912cd..f1607601c4 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/element.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/element.go
@@ -19,7 +19,7 @@ package fieldpath
 import (
 	"fmt"
 	"iter"
-	"sort"
+	"slices"
 	"strings"
 
 	"sigs.k8s.io/structured-merge-diff/v6/value"
@@ -255,19 +255,13 @@ func (s PathElementSet) Copy() PathElementSet {
 
 // Insert adds pe to the set.
 func (s *PathElementSet) Insert(pe PathElement) {
-	loc := sort.Search(len(s.members), func(i int) bool {
-		return !s.members[i].Less(pe)
+	loc, found := slices.BinarySearchFunc(s.members, pe, func(a, b PathElement) int {
+		return a.Compare(b)
 	})
-	if loc == len(s.members) {
-		s.members = append(s.members, pe)
+	if found {
 		return
 	}
-	if s.members[loc].Equals(pe) {
-		return
-	}
-	s.members = append(s.members, PathElement{})
-	copy(s.members[loc+1:], s.members[loc:])
-	s.members[loc] = pe
+	s.members = slices.Insert(s.members, loc, pe)
 }
 
 // Union returns a set containing elements that appear in either s or s2.
@@ -344,16 +338,10 @@ func (s *PathElementSet) Size() int { return len(s.members) }
 
 // Has returns true if pe is a member of the set.
 func (s *PathElementSet) Has(pe PathElement) bool {
-	loc := sort.Search(len(s.members), func(i int) bool {
-		return !s.members[i].Less(pe)
+	_, found := slices.BinarySearchFunc(s.members, pe, func(a, b PathElement) int {
+		return a.Compare(b)
 	})
-	if loc == len(s.members) {
-		return false
-	}
-	if s.members[loc].Equals(pe) {
-		return true
-	}
-	return false
+	return found
 }
 
 // Equals returns true if s and s2 have exactly the same members.
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/pathelementmap.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/pathelementmap.go
index ff7ee510c2..ca50b84e99 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/pathelementmap.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/pathelementmap.go
@@ -17,7 +17,7 @@ limitations under the License.
 package fieldpath
 
 import (
-	"sort"
+	"slices"
 
 	"sigs.k8s.io/structured-merge-diff/v6/value"
 )
@@ -82,32 +82,23 @@ func MakePathElementMap(size int) PathElementMap {
 // Insert adds the pathelement and associated value in the map.
 // If insert is called twice with the same PathElement, the value is replaced.
 func (s *PathElementMap) Insert(pe PathElement, v interface{}) {
-	loc := sort.Search(len(s.members), func(i int) bool {
-		return !s.members[i].PathElement.Less(pe)
+	loc, found := slices.BinarySearchFunc(s.members, pe, func(a pathElementValue, b PathElement) int {
+		return a.PathElement.Compare(b)
 	})
-	if loc == len(s.members) {
-		s.members = append(s.members, pathElementValue{pe, v})
-		return
-	}
-	if s.members[loc].PathElement.Equals(pe) {
+	if found {
 		s.members[loc].Value = v
 		return
 	}
-	s.members = append(s.members, pathElementValue{})
-	copy(s.members[loc+1:], s.members[loc:])
-	s.members[loc] = pathElementValue{pe, v}
+	s.members = slices.Insert(s.members, loc, pathElementValue{PathElement: pe, Value: v})
 }
 
 // Get retrieves the value associated with the given PathElement from the map.
 // (nil, false) is returned if there is no such PathElement.
 func (s *PathElementMap) Get(pe PathElement) (interface{}, bool) {
-	loc := sort.Search(len(s.members), func(i int) bool {
-		return !s.members[i].PathElement.Less(pe)
+	loc, found := slices.BinarySearchFunc(s.members, pe, func(a pathElementValue, b PathElement) int {
+		return a.PathElement.Compare(b)
 	})
-	if loc == len(s.members) {
-		return nil, false
-	}
-	if s.members[loc].PathElement.Equals(pe) {
+	if found {
 		return s.members[loc].Value, true
 	}
 	return nil, false
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize-pe.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize-pe.go
index f4b00c2ee5..b2f62dc693 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize-pe.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize-pe.go
@@ -97,6 +97,14 @@ func DeserializePathElement(s string) (PathElement, error) {
 		if err != nil {
 			return PathElement{}, err
 		}
+		// Lookahead validates that there is no unexpected trailing data.
+		// io.EOF is a successful termination indicator; all other errors or trailing data fail.
+		if iter.WhatIsNext(); iter.Error != io.EOF {
+			if iter.Error == nil {
+				iter.ReportError("managedFields parsing", "unexpected trailing data after JSON object")
+			}
+			return PathElement{}, iter.Error
+		}
 		return PathElement{Value: &v}, nil
 	case peKeySepBytes[0]:
 		iter := readPool.BorrowIterator(b)
@@ -112,8 +120,16 @@ func DeserializePathElement(s string) (PathElement, error) {
 			fields = append(fields, value.Field{Name: key, Value: v})
 			return true
 		})
+		// Lookahead validates that there is no unexpected trailing data.
+		// io.EOF is a successful termination indicator; all other errors or trailing data fail.
+		if iter.WhatIsNext(); iter.Error != io.EOF {
+			if iter.Error == nil {
+				iter.ReportError("managedFields parsing", "unexpected trailing data after JSON object")
+			}
+			return PathElement{}, iter.Error
+		}
 		fields.Sort()
-		return PathElement{Key: &fields}, iter.Error
+		return PathElement{Key: &fields}, nil
 	case peIndexSepBytes[0]:
 		i, err := strconv.Atoi(s[2:])
 		if err != nil {
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize.go
index b992b93c5f..6701f17ee9 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/serialize.go
@@ -175,6 +175,17 @@ func (s *Set) FromJSON(r io.Reader) error {
 	} else {
 		*s = *found
 	}
+	if iter.Error != nil {
+		return iter.Error
+	}
+	if iter.WhatIsNext(); iter.Error == nil {
+		// Piggy back on scanner aware error reporting here.
+		iter.ReportError("managedFields parsing", "unexpected trailing data after JSON object")
+		return iter.Error
+	}
+	if iter.Error == io.EOF {
+		return nil
+	}
 	return iter.Error
 }
 
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/set.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/set.go
index d2d8c8a42b..d7fe643be2 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/set.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/fieldpath/set.go
@@ -19,6 +19,7 @@ package fieldpath
 import (
 	"fmt"
 	"iter"
+	"slices"
 	"sort"
 	"strings"
 
@@ -486,19 +487,13 @@ func (s *SetNodeMap) Copy() SetNodeMap {
 
 // Descend adds pe to the set if necessary, returning the associated subset.
 func (s *SetNodeMap) Descend(pe PathElement) *Set {
-	loc := sort.Search(len(s.members), func(i int) bool {
-		return !s.members[i].pathElement.Less(pe)
+	loc, found := slices.BinarySearchFunc(s.members, pe, func(a setNode, b PathElement) int {
+		return a.pathElement.Compare(b)
 	})
-	if loc == len(s.members) {
-		s.members = append(s.members, setNode{pathElement: pe, set: &Set{}})
+	if found {
 		return s.members[loc].set
 	}
-	if s.members[loc].pathElement.Equals(pe) {
-		return s.members[loc].set
-	}
-	s.members = append(s.members, setNode{})
-	copy(s.members[loc+1:], s.members[loc:])
-	s.members[loc] = setNode{pathElement: pe, set: &Set{}}
+	s.members = slices.Insert(s.members, loc, setNode{pathElement: pe, set: &Set{}})
 	return s.members[loc].set
 }
 
@@ -523,13 +518,10 @@ func (s *SetNodeMap) Empty() bool {
 
 // Get returns (the associated set, true) or (nil, false) if there is none.
 func (s *SetNodeMap) Get(pe PathElement) (*Set, bool) {
-	loc := sort.Search(len(s.members), func(i int) bool {
-		return !s.members[i].pathElement.Less(pe)
+	loc, found := slices.BinarySearchFunc(s.members, pe, func(a setNode, b PathElement) int {
+		return a.pathElement.Compare(b)
 	})
-	if loc == len(s.members) {
-		return nil, false
-	}
-	if s.members[loc].pathElement.Equals(pe) {
+	if found {
 		return s.members[loc].set, true
 	}
 	return nil, false
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/elements.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/elements.go
index c8138a6548..4c0e30b257 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/elements.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/elements.go
@@ -62,6 +62,10 @@ type TypeRef struct {
 	// If this field is nil, then it has no effect.
 	// See `Map` and `List` for more information about `ElementRelationship`
 	ElementRelationship *ElementRelationship `yaml:"elementRelationship,omitempty"`
+
+	// Nullable indicates that an explicit null is a valid value,
+	// corresponding to OpenAPI's `nullable: true`.
+	Nullable bool `yaml:"nullable,omitempty"`
 }
 
 // Atom represents the smallest possible pieces of the type system.
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/equals.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/equals.go
index b668eff833..e1fa5c95dd 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/equals.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/equals.go
@@ -55,6 +55,9 @@ func (a *TypeRef) Equals(b *TypeRef) bool {
 	if a.ElementRelationship != b.ElementRelationship {
 		return false
 	}
+	if a.Nullable != b.Nullable {
+		return false
+	}
 	return a.Inlined.Equals(&b.Inlined)
 }
 
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/schemaschema.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/schemaschema.go
index 6eb6c36df3..4eb367b657 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/schemaschema.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/schema/schemaschema.go
@@ -69,6 +69,9 @@ var SchemaSchemaYAML = `types:
     - name: elementRelationship
       type:
         scalar: string
+    - name: nullable
+      type:
+        scalar: boolean
 - name: scalar
   scalar: string
 - name: map
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/typed/remove.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/typed/remove.go
index 0db1734f94..78ba6f50d0 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/typed/remove.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/typed/remove.go
@@ -75,7 +75,6 @@ func (w *removingWalker) doList(t *schema.List) (errs ValidationErrors) {
 	}
 
 	var newItems []interface{}
-	hadMatches := false
 	iter := l.RangeUsing(w.allocator)
 	defer w.allocator.Free(iter)
 	for iter.Next() {
@@ -99,26 +98,12 @@ func (w *removingWalker) doList(t *schema.List) (errs ValidationErrors) {
 				continue
 			}
 			if isPrefixMatch {
-				// Removing nested items within this list item and preserve if it becomes empty
-				hadMatches = true
-				wasMap := item.IsMap()
-				wasList := item.IsList()
 				item = removeItemsWithSchema(item, w.toRemove.WithPrefix(pe), w.schema, t.ElementType, w.shouldExtract)
-				// If item returned null but we're removing items within the structure(not the item itself),
-				// preserve the empty container structure
-				if item.IsNull() && !w.shouldExtract {
-					if wasMap {
-						item = value.NewValueInterface(map[string]interface{}{})
-					} else if wasList {
-						item = value.NewValueInterface([]interface{}{})
-					}
-				}
 			}
 			newItems = append(newItems, item.Unstructured())
 		}
 	}
-	// Preserve empty lists (non-nil) instead of converting to null when items were matched and removed
-	if len(newItems) > 0 || (hadMatches && !w.shouldExtract) {
+	if len(newItems) > 0 {
 		w.out = newItems
 	}
 	return nil
@@ -156,7 +141,6 @@ func (w *removingWalker) doMap(t *schema.Map) ValidationErrors {
 	}
 
 	newMap := map[string]interface{}{}
-	hadMatches := false
 	m.Iterate(func(k string, val value.Value) bool {
 		pe := fieldpath.PathElement{FieldName: &k}
 		path, _ := fieldpath.MakePath(pe)
@@ -174,19 +158,7 @@ func (w *removingWalker) doMap(t *schema.Map) ValidationErrors {
 			return true
 		}
 		if subset := w.toRemove.WithPrefix(pe); !subset.Empty() {
-			hadMatches = true
-			wasMap := val.IsMap()
-			wasList := val.IsList()
 			val = removeItemsWithSchema(val, subset, w.schema, fieldType, w.shouldExtract)
-			// If val returned null but we're removing items within the structure (not the field itself),
-			// preserve the empty container structure
-			if val.IsNull() && !w.shouldExtract {
-				if wasMap {
-					val = value.NewValueInterface(map[string]interface{}{})
-				} else if wasList {
-					val = value.NewValueInterface([]interface{}{})
-				}
-			}
 		} else {
 			// don't save values not on the path when we shouldExtract.
 			if w.shouldExtract {
@@ -196,8 +168,7 @@ func (w *removingWalker) doMap(t *schema.Map) ValidationErrors {
 		newMap[k] = val.Unstructured()
 		return true
 	})
-	// Preserve empty maps (non-nil) instead of converting to null when items were matched and removed
-	if len(newMap) > 0 || (hadMatches && !w.shouldExtract) {
+	if len(newMap) > 0 {
 		w.out = newMap
 	}
 	return nil
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/value/allocator.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/value/allocator.go
index f70cd41674..acbfe8ceba 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/value/allocator.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/value/allocator.go
@@ -16,6 +16,8 @@ limitations under the License.
 
 package value
 
+import "reflect"
+
 // Allocator provides a value object allocation strategy.
 // Value objects can be allocated by passing an allocator to the "Using"
 // receiver functions on the value interfaces, e.g. Map.ZipUsing(allocator, ...).
@@ -24,8 +26,8 @@ package value
 type Allocator interface {
 	// Free gives the allocator back any value objects returned by the "Using"
 	// receiver functions on the value interfaces.
-	// interface{} may be any of: Value, Map, List or Range.
-	Free(interface{})
+	// any may be any of: Value, Map, List or Range.
+	Free(any)
 
 	// The unexported functions are for "Using" receiver functions of the value types
 	// to request what they need from the allocator.
@@ -74,7 +76,7 @@ func (p *heapAllocator) allocListReflectRange() *listReflectRange {
 	return &listReflectRange{vr: &valueReflect{}}
 }
 
-func (p *heapAllocator) Free(_ interface{}) {}
+func (p *heapAllocator) Free(_ any) {}
 
 // NewFreelistAllocator creates freelist based allocator.
 // This allocator provides fast allocation and freeing of short lived value objects.
@@ -89,25 +91,25 @@ func (p *heapAllocator) Free(_ interface{}) {}
 // for all temporary value access.
 func NewFreelistAllocator() Allocator {
 	return &freelistAllocator{
-		valueUnstructured: &freelist{new: func() interface{} {
+		valueUnstructured: &freelist[*valueUnstructured]{new: func() *valueUnstructured {
 			return &valueUnstructured{}
 		}},
-		listUnstructuredRange: &freelist{new: func() interface{} {
+		listUnstructuredRange: &freelist[*listUnstructuredRange]{new: func() *listUnstructuredRange {
 			return &listUnstructuredRange{vv: &valueUnstructured{}}
 		}},
-		valueReflect: &freelist{new: func() interface{} {
+		valueReflect: &freelist[*valueReflect]{new: func() *valueReflect {
 			return &valueReflect{}
 		}},
-		mapReflect: &freelist{new: func() interface{} {
+		mapReflect: &freelist[*mapReflect]{new: func() *mapReflect {
 			return &mapReflect{}
 		}},
-		structReflect: &freelist{new: func() interface{} {
+		structReflect: &freelist[*structReflect]{new: func() *structReflect {
 			return &structReflect{}
 		}},
-		listReflect: &freelist{new: func() interface{} {
+		listReflect: &freelist[*listReflect]{new: func() *listReflect {
 			return &listReflect{}
 		}},
-		listReflectRange: &freelist{new: func() interface{} {
+		listReflectRange: &freelist[*listReflectRange]{new: func() *listReflectRange {
 			return &listReflectRange{vr: &valueReflect{}}
 		}},
 	}
@@ -119,22 +121,22 @@ func NewFreelistAllocator() Allocator {
 const freelistMaxSize = 1000
 
 type freelistAllocator struct {
-	valueUnstructured     *freelist
-	listUnstructuredRange *freelist
-	valueReflect          *freelist
-	mapReflect            *freelist
-	structReflect         *freelist
-	listReflect           *freelist
-	listReflectRange      *freelist
+	valueUnstructured     *freelist[*valueUnstructured]
+	listUnstructuredRange *freelist[*listUnstructuredRange]
+	valueReflect          *freelist[*valueReflect]
+	mapReflect            *freelist[*mapReflect]
+	structReflect         *freelist[*structReflect]
+	listReflect           *freelist[*listReflect]
+	listReflectRange      *freelist[*listReflectRange]
 }
 
-type freelist struct {
-	list []interface{}
-	new  func() interface{}
+type freelist[T any] struct {
+	list []T
+	new  func() T
 }
 
-func (f *freelist) allocate() interface{} {
-	var w2 interface{}
+func (f *freelist[T]) allocate() T {
+	var w2 T
 	if n := len(f.list); n > 0 {
 		w2, f.list = f.list[n-1], f.list[:n-1]
 	} else {
@@ -143,61 +145,73 @@ func (f *freelist) allocate() interface{} {
 	return w2
 }
 
-func (f *freelist) free(v interface{}) {
+func (f *freelist[T]) free(v T) {
 	if len(f.list) < freelistMaxSize {
 		f.list = append(f.list, v)
 	}
 }
 
-func (w *freelistAllocator) Free(value interface{}) {
+func (w *freelistAllocator) Free(value any) {
 	switch v := value.(type) {
 	case *valueUnstructured:
 		v.Value = nil // don't hold references to unstructured objects
 		w.valueUnstructured.free(v)
 	case *listUnstructuredRange:
+		v.list = nil     // don't hold references to unstructured objects
 		v.vv.Value = nil // don't hold references to unstructured objects
 		w.listUnstructuredRange.free(v)
 	case *valueReflect:
-		v.ParentMapKey = nil
 		v.ParentMap = nil
+		v.ParentMapKey = nil
+		v.Value = reflect.Value{} // don't hold references to reflected objects
 		w.valueReflect.free(v)
 	case *mapReflect:
+		v.valueReflect.ParentMap = nil
+		v.valueReflect.ParentMapKey = nil
+		v.valueReflect.Value = reflect.Value{} // don't hold references to reflected objects
 		w.mapReflect.free(v)
 	case *structReflect:
+		v.valueReflect.ParentMap = nil
+		v.valueReflect.ParentMapKey = nil
+		v.valueReflect.Value = reflect.Value{} // don't hold references to reflected objects
 		w.structReflect.free(v)
 	case *listReflect:
+		v.Value = reflect.Value{} // don't hold references to reflected objects
 		w.listReflect.free(v)
 	case *listReflectRange:
-		v.vr.ParentMapKey = nil
+		v.list = reflect.Value{} // don't hold references to reflected objects
 		v.vr.ParentMap = nil
+		v.vr.ParentMapKey = nil
+		v.vr.Value = reflect.Value{} // don't hold references to reflected objects
+		v.entry = nil
 		w.listReflectRange.free(v)
 	}
 }
 
 func (w *freelistAllocator) allocValueUnstructured() *valueUnstructured {
-	return w.valueUnstructured.allocate().(*valueUnstructured)
+	return w.valueUnstructured.allocate()
 }
 
 func (w *freelistAllocator) allocListUnstructuredRange() *listUnstructuredRange {
-	return w.listUnstructuredRange.allocate().(*listUnstructuredRange)
+	return w.listUnstructuredRange.allocate()
 }
 
 func (w *freelistAllocator) allocValueReflect() *valueReflect {
-	return w.valueReflect.allocate().(*valueReflect)
+	return w.valueReflect.allocate()
 }
 
 func (w *freelistAllocator) allocStructReflect() *structReflect {
-	return w.structReflect.allocate().(*structReflect)
+	return w.structReflect.allocate()
 }
 
 func (w *freelistAllocator) allocMapReflect() *mapReflect {
-	return w.mapReflect.allocate().(*mapReflect)
+	return w.mapReflect.allocate()
 }
 
 func (w *freelistAllocator) allocListReflect() *listReflect {
-	return w.listReflect.allocate().(*listReflect)
+	return w.listReflect.allocate()
 }
 
 func (w *freelistAllocator) allocListReflectRange() *listReflectRange {
-	return w.listReflectRange.allocate().(*listReflectRange)
+	return w.listReflectRange.allocate()
 }
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/value/jsontagutil.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/value/jsontagutil.go
index 3aadceb222..db25613734 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/value/jsontagutil.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/value/jsontagutil.go
@@ -76,11 +76,16 @@ func OmitZeroFunc(t reflect.Type) func(reflect.Value) bool {
 // but is based on the highly efficient approach from https://golang.org/src/encoding/json/encode.go
 
 func lookupJsonTags(f reflect.StructField) (name string, omit bool, inline bool, omitempty bool, omitzero func(reflect.Value) bool) {
+	// Skip unexported non-embedded fields, matching encoding/json behavior.
+	if f.PkgPath != "" && !f.Anonymous {
+		return "", true, false, false, nil
+	}
 	tag := f.Tag.Get("json")
 	if tag == "-" {
 		return "", true, false, false, nil
 	}
 	name, opts := parseTag(tag)
+	inline = f.Anonymous && name == ""
 	if name == "" {
 		name = f.Name
 	}
@@ -89,7 +94,7 @@ func lookupJsonTags(f reflect.StructField) (name string, omit bool, inline bool,
 		omitzero = OmitZeroFunc(f.Type)
 	}
 
-	return name, false, opts.Contains("inline"), opts.Contains("omitempty"), omitzero
+	return name, false, inline, opts.Contains("omitempty"), omitzero
 }
 
 func isEmpty(v reflect.Value) bool {
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/value/reflectcache.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/value/reflectcache.go
index 75b7085c3e..f4f4c2b44d 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/value/reflectcache.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/value/reflectcache.go
@@ -39,14 +39,28 @@ type UnstructuredConverter interface {
 	ToUnstructured() interface{}
 }
 
+// UnstructuredConverterWithError is implemented instead of UnstructuredConverter by types for which
+// some, but not all, values can be converted directly to unstructured. If a type implements both
+// UnstructuredConverter and UnstructuredConverterWithError, its UnstructuredConverterWithError
+// implementation takes precedence during conversion.
+type UnstructuredConverterWithError interface {
+	json.Marshaler // require that json.Marshaler is implemented
+
+	// ToUnstructured returns the unstructured representation, or a non-nil error if the value
+	// cannot be converted to unstructured.
+	ToUnstructuredWithError() (any, error)
+}
+
 // TypeReflectCacheEntry keeps data gathered using reflection about how a type is converted to/from unstructured.
 type TypeReflectCacheEntry struct {
-	isJsonMarshaler        bool
-	ptrIsJsonMarshaler     bool
-	isJsonUnmarshaler      bool
-	ptrIsJsonUnmarshaler   bool
-	isStringConvertable    bool
-	ptrIsStringConvertable bool
+	isJsonMarshaler                     bool
+	ptrIsJsonMarshaler                  bool
+	isJsonUnmarshaler                   bool
+	ptrIsJsonUnmarshaler                bool
+	isUnstructuredConverter             bool
+	ptrIsUnstructuredConverter          bool
+	isUnstructuredConverterWithError    bool
+	ptrIsUnstructuredConverterWithError bool
 
 	structFields        map[string]*FieldCacheEntry
 	orderedStructFields []*FieldCacheEntry
@@ -93,9 +107,10 @@ func (f *FieldCacheEntry) GetFrom(structVal reflect.Value) reflect.Value {
 	return structVal
 }
 
-var marshalerType = reflect.TypeOf(new(json.Marshaler)).Elem()
-var unmarshalerType = reflect.TypeOf(new(json.Unmarshaler)).Elem()
-var unstructuredConvertableType = reflect.TypeOf(new(UnstructuredConverter)).Elem()
+var marshalerType = reflect.TypeFor[json.Marshaler]()
+var unmarshalerType = reflect.TypeFor[json.Unmarshaler]()
+var unstructuredConverterType = reflect.TypeFor[UnstructuredConverter]()
+var unstructuredConverterWithErrorType = reflect.TypeFor[UnstructuredConverterWithError]()
 var defaultReflectCache = newReflectCache()
 
 // TypeReflectEntryOf returns the TypeReflectCacheEntry of the provided reflect.Type.
@@ -122,11 +137,13 @@ func typeReflectEntryOf(cm reflectCacheMap, t reflect.Type, updates reflectCache
 		return record
 	}
 	typeEntry := &TypeReflectCacheEntry{
-		isJsonMarshaler:        t.Implements(marshalerType),
-		ptrIsJsonMarshaler:     reflect.PtrTo(t).Implements(marshalerType),
-		isJsonUnmarshaler:      reflect.PtrTo(t).Implements(unmarshalerType),
-		isStringConvertable:    t.Implements(unstructuredConvertableType),
-		ptrIsStringConvertable: reflect.PtrTo(t).Implements(unstructuredConvertableType),
+		isJsonMarshaler:                     t.Implements(marshalerType),
+		ptrIsJsonMarshaler:                  reflect.PointerTo(t).Implements(marshalerType),
+		isJsonUnmarshaler:                   reflect.PointerTo(t).Implements(unmarshalerType),
+		isUnstructuredConverter:             t.Implements(unstructuredConverterType),
+		ptrIsUnstructuredConverter:          reflect.PointerTo(t).Implements(unstructuredConverterType),
+		isUnstructuredConverterWithError:    t.Implements(unstructuredConverterWithErrorType),
+		ptrIsUnstructuredConverterWithError: reflect.PointerTo(t).Implements(unstructuredConverterWithErrorType),
 	}
 	if t.Kind() == reflect.Struct {
 		fieldEntries := map[string]*FieldCacheEntry{}
@@ -190,7 +207,7 @@ func (e TypeReflectCacheEntry) OrderedFields() []*FieldCacheEntry {
 
 // CanConvertToUnstructured returns true if this TypeReflectCacheEntry can convert values of its type to unstructured.
 func (e TypeReflectCacheEntry) CanConvertToUnstructured() bool {
-	return e.isJsonMarshaler || e.ptrIsJsonMarshaler || e.isStringConvertable || e.ptrIsStringConvertable
+	return e.isJsonMarshaler || e.ptrIsJsonMarshaler || e.isUnstructuredConverter || e.ptrIsUnstructuredConverter || e.isUnstructuredConverterWithError || e.ptrIsUnstructuredConverterWithError
 }
 
 // ToUnstructured converts the provided value to unstructured and returns it.
@@ -206,7 +223,7 @@ func (e TypeReflectCacheEntry) ToUnstructured(sv reflect.Value) (interface{}, er
 	// Check if the object has a custom string converter and use it if available, since it is much more efficient
 	// than round tripping through json.
 	if converter, ok := e.getUnstructuredConverter(sv); ok {
-		return converter.ToUnstructured(), nil
+		return converter.ToUnstructuredWithError()
 	}
 	// Check if the object has a custom JSON marshaller/unmarshaller.
 	if marshaler, ok := e.getJsonMarshaler(sv); ok {
@@ -318,16 +335,26 @@ func (e TypeReflectCacheEntry) getJsonUnmarshaler(v reflect.Value) (json.Unmarsh
 	return v.Addr().Interface().(json.Unmarshaler), true
 }
 
-func (e TypeReflectCacheEntry) getUnstructuredConverter(v reflect.Value) (UnstructuredConverter, bool) {
-	if e.isStringConvertable {
-		return v.Interface().(UnstructuredConverter), true
-	}
-	if e.ptrIsStringConvertable {
+type unstructuredConverterWithNilError struct {
+	UnstructuredConverter
+}
+
+func (c unstructuredConverterWithNilError) ToUnstructuredWithError() (any, error) {
+	return c.UnstructuredConverter.ToUnstructured(), nil
+}
+
+func (e TypeReflectCacheEntry) getUnstructuredConverter(v reflect.Value) (UnstructuredConverterWithError, bool) {
+	switch {
+	case e.isUnstructuredConverterWithError:
+		return v.Interface().(UnstructuredConverterWithError), true
+	case e.ptrIsUnstructuredConverterWithError && v.CanAddr():
 		// Check pointer receivers if v is not a pointer
-		if v.CanAddr() {
-			v = v.Addr()
-			return v.Interface().(UnstructuredConverter), true
-		}
+		return v.Addr().Interface().(UnstructuredConverterWithError), true
+	case e.isUnstructuredConverter:
+		return unstructuredConverterWithNilError{v.Interface().(UnstructuredConverter)}, true
+	case e.ptrIsUnstructuredConverter && v.CanAddr():
+		// Check pointer receivers if v is not a pointer
+		return unstructuredConverterWithNilError{v.Addr().Interface().(UnstructuredConverter)}, true
 	}
 	return nil, false
 }
diff --git a/vendor/sigs.k8s.io/structured-merge-diff/v6/value/value.go b/vendor/sigs.k8s.io/structured-merge-diff/v6/value/value.go
index 140b99038e..167848ebeb 100644
--- a/vendor/sigs.k8s.io/structured-merge-diff/v6/value/value.go
+++ b/vendor/sigs.k8s.io/structured-merge-diff/v6/value/value.go
@@ -118,6 +118,11 @@ func readJSONIter(iter *jsoniter.Iterator) (Value, error) {
 	if iter.Error != nil && iter.Error != io.EOF {
 		return nil, iter.Error
 	}
+	if iter.WhatIsNext(); iter.Error == nil {
+		// Piggy back on scanner aware error reporting here.
+		iter.ReportError("managedFields parsing", "unexpected trailing data after JSON object")
+		return nil, iter.Error
+	}
 	return NewValueInterface(v), nil
 }